diff --git a/.github/DISCUSSION_TEMPLATE/game-bring-up.yml b/.github/DISCUSSION_TEMPLATE/game-bring-up.yml
index afb5f3d3d3..ff08c3cca6 100644
--- a/.github/DISCUSSION_TEMPLATE/game-bring-up.yml
+++ b/.github/DISCUSSION_TEMPLATE/game-bring-up.yml
@@ -6,7 +6,7 @@ body:
         One thread per title, for every platform: search this category for the title ID first. If a thread exists, reply there, also when your OS or GPU differs from the one it reports.
         Name the discussion `Game name (title ID)`, for example `DOOM Shareware (PPSA99666)`, without the platform.
         Bug reports and implementation work belong in issues and pull requests; link them here as the blocker.
-        Per-game progress is also tracked on the [blocker map](https://alxcbtw.github.io/anyps5-roadmap/), built from public GitHub data. Only share material you have the right to distribute.
+        Only share material you have the right to distribute.
   - type: checkboxes
     id: searched
     attributes:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cab59565e5..69f6ed8c96 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ permissions:
 
 concurrency:
   group: build-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 
 env:
   CONFIGURE: >-
@@ -421,7 +421,7 @@ jobs:
 
   linux:
     needs: eligibility
-    if: ${{ (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.linux)) && needs.eligibility.outputs.full == 'true' }}
+    if: ${{ !github.event.repository.fork && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.linux)) && needs.eligibility.outputs.full == 'true' }}
     runs-on: [self-hosted, linux, x64, anyps5]
     timeout-minutes: 60
     env:
@@ -641,7 +641,7 @@ jobs:
         uses: actions/cache/restore@v6
         with:
           path: configure-seed.cmake
-          key: configure-seed-${{ env.WINLIBS_ZIP }}-${{ steps.submodules.outputs.key }}-${{ hashFiles('CMakeLists.txt', 'cmake/**', 'core/libs/CMakeLists.txt', '.github/workflows/build.yml') }}
+          key: configure-seed-${{ env.WINLIBS_ZIP }}-${{ steps.submodules.outputs.key }}-${{ hashFiles('CMakeLists.txt', 'cmake/**', 'core/libs/CMakeLists.txt', 'tools/configure_seed.py', '.github/workflows/build.yml') }}
       - shell: cmd
         run: if exist configure-seed.cmake (cmake -C configure-seed.cmake -S . -B build %CONFIGURE% "-DANYPS5_AGC_EXECUTION_TESTS=F16ToF32Unpack;F64FmaSubnormals;RegistrationPrepareShutdown") else (cmake -S . -B build %CONFIGURE% "-DANYPS5_AGC_EXECUTION_TESTS=F16ToF32Unpack;F64FmaSubnormals;RegistrationPrepareShutdown")
       - if: steps.seed-cache.outputs.cache-hit != 'true'
diff --git a/.github/workflows/input-mapper.yml b/.github/workflows/input-mapper.yml
new file mode 100644
index 0000000000..55120c5b54
--- /dev/null
+++ b/.github/workflows/input-mapper.yml
@@ -0,0 +1,29 @@
+name: Input mapper
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    paths:
+      - '.github/workflows/input-mapper.yml'
+      - 'tools/input-mapper/**'
+      - 'core/libs/prx/libScePad/include/**'
+      - 'core/libs/prx/libSceVideoOut/src/InputMapping.cpp'
+
+permissions:
+  contents: read
+
+jobs:
+  input-mapper:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          package-manager-cache: false
+      - run: npm --prefix tools/input-mapper test
diff --git a/.github/workflows/pages-progress.yml b/.github/workflows/pages-progress.yml
index 88c1f81d5a..5aa5f304a6 100644
--- a/.github/workflows/pages-progress.yml
+++ b/.github/workflows/pages-progress.yml
@@ -18,6 +18,7 @@ concurrency:
 
 jobs:
   progress:
+    if: ${{ !github.event.repository.fork }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 0dc28284b0..bf8d6a0313 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   pages:
-    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
+    if: ${{ !github.event.repository.fork && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') }}
     runs-on: ubuntu-latest
     environment:
       name: github-pages
diff --git a/.github/workflows/web-tests.yml b/.github/workflows/web-tests.yml
index 8de6e8d91f..4c42ec63a0 100644
--- a/.github/workflows/web-tests.yml
+++ b/.github/workflows/web-tests.yml
@@ -36,4 +36,4 @@ jobs:
           node --check demo/web/output-directory.mjs
           node --check demo/web/worker.mjs
       - name: Test browser converter helpers
-        run: node --test demo/web/tests/batch.test.mjs demo/web/tests/output-directory.test.mjs
+        run: node --test demo/web/tests/app.test.mjs demo/web/tests/batch.test.mjs demo/web/tests/output-directory.test.mjs
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 25d411aa58..155214af16 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -6,13 +6,12 @@ endif()
 project(Relinker CXX)
 
 set(ANYPS5_TEST_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/tests")
-set(ANYPS5_WINDOWS_TEST_EXIT "${CMAKE_CURRENT_SOURCE_DIR}/cmake/WindowsTestExit.cpp")
 
 function(add_test_executable target)
     add_executable(${target} ${ARGN})
     set_target_properties(${target} PROPERTIES RUNTIME_OUTPUT_DIRECTORY "$<1:${ANYPS5_TEST_OUTPUT_DIRECTORY}>")
     if(MINGW)
-        target_sources(${target} PRIVATE "${ANYPS5_WINDOWS_TEST_EXIT}")
+        target_sources(${target} PRIVATE $<TARGET_OBJECTS:anyps5_windows_test_exit>)
         target_link_options(${target} PRIVATE LINKER:--wrap=main)
     endif()
 endfunction()
@@ -96,6 +95,10 @@ if(APPLE AND NOT ANYPS5_RELINKER_ONLY)
     add_link_options(-fexperimental-library)
 endif()
 
+if(MINGW)
+    add_library(anyps5_windows_test_exit OBJECT cmake/WindowsTestExit.cpp)
+endif()
+
 if(BUILD_TESTING)
     add_test_executable(shader_cache_file_read_tests
         ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/tests/CacheFileReadTests.cpp)
@@ -133,10 +136,17 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/tests/test_shader_cache_native_paths.py
             ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/ShaderCacheVersion.cmake ${CMAKE_COMMAND})
         set_tests_properties(shader_cache_native_paths PROPERTIES TIMEOUT 20)
-        add_test(NAME shader_cache_runtime_sources COMMAND ${Python3_EXECUTABLE}
-            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_shader_cache_runtime_sources.py
-            ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler ${CMAKE_COMMAND})
-        set_tests_properties(shader_cache_runtime_sources PROPERTIES TIMEOUT 180)
+        foreach(shard RANGE 0 6)
+            if(shard EQUAL 0)
+                set(shader_cache_sources_test_name shader_cache_runtime_sources)
+            else()
+                set(shader_cache_sources_test_name shader_cache_runtime_sources_shard_${shard})
+            endif()
+            add_test(NAME ${shader_cache_sources_test_name} COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_shader_cache_runtime_sources.py
+                ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler ${CMAKE_COMMAND} --shard ${shard}/7)
+            set_tests_properties(${shader_cache_sources_test_name} PROPERTIES TIMEOUT 180)
+        endforeach()
         add_test(NAME pr_overlap_encoding COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_pr_overlap_encoding.py)
         add_test(NAME pr_overlap_dependencies COMMAND ${Python3_EXECUTABLE}
@@ -161,6 +171,8 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_import_audit.py)
         add_test(NAME unwrap_self COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_unwrap_self.py)
+        add_test(NAME audit_dump COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_audit_dump.py)
         foreach(shard RANGE 0 11)
             if(shard EQUAL 0)
                 set(conventions_test_name conventions_function_bodies)
@@ -238,27 +250,51 @@ if(BUILD_TESTING)
         add_test(NAME pad_timeline COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_pad_timeline.py)
         set_tests_properties(pad_timeline PROPERTIES TIMEOUT 20)
+        set(check_compile_modes_source "${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile_modes.py")
+        set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${check_compile_modes_source}")
+        file(STRINGS "${check_compile_modes_source}" check_compile_modes_cases REGEX "^    def test_")
+        foreach(test_case IN LISTS check_compile_modes_cases)
+            string(REGEX REPLACE "^    def (test_[A-Za-z0-9_]+).*" "\\1" test_case "${test_case}")
+            add_test(NAME check_compile_modes_${test_case} COMMAND ${Python3_EXECUTABLE}
+                "${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile_modes.py" CheckCompileModeTests.${test_case})
+            set_tests_properties(check_compile_modes_${test_case} PROPERTIES TIMEOUT 30)
+        endforeach()
         add_test(NAME trace_digest COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_trace_digest.py)
+        add_test(NAME symbolize_samples COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_symbolize_samples.py)
         add_test(NAME conventions_bom_shebang COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_bom_shebang.py)
         set_tests_properties(conventions_bom_shebang PROPERTIES TIMEOUT 20)
         add_test(NAME env_reference COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_env_reference.py)
         set_tests_properties(env_reference PROPERTIES TIMEOUT 20)
-        add_test(NAME conventions_env_reference COMMAND ${Python3_EXECUTABLE}
-            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_env_reference.py)
-        set_tests_properties(conventions_env_reference PROPERTIES TIMEOUT 60)
+        set(env_reference_test_source "${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_env_reference.py")
+        set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${env_reference_test_source}")
+        file(STRINGS "${env_reference_test_source}" env_reference_cases REGEX "^    def test_")
+        foreach(test_case IN LISTS env_reference_cases)
+            string(REGEX REPLACE "^    def (test_[A-Za-z0-9_]+).*" "\\1" test_case "${test_case}")
+            add_test(NAME conventions_env_reference_${test_case} COMMAND ${Python3_EXECUTABLE}
+                "${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_env_reference.py" "EnvReferenceDiffTests.${test_case}")
+            set_tests_properties(conventions_env_reference_${test_case} PROPERTIES TIMEOUT 30)
+        endforeach()
         add_test(NAME conventions_body_bom COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_body_bom.py)
         add_test(NAME conventions_blob_reads COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_blob_reads.py)
         add_test(NAME conventions_agent_files COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_agent_files.py)
+        add_test(NAME conventions_alignment COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_alignment.py)
         add_test(NAME conventions_pr_template COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_pr_template.py)
+        add_test(NAME check_compile_preprocessor COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile_preprocessor.py)
+        set_tests_properties(check_compile_preprocessor PROPERTIES TIMEOUT 20)
         add_test(NAME check_compile COMMAND ${Python3_EXECUTABLE}
-            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile.py)
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile.py CheckCompileTests)
+        add_test(NAME check_compile_outputs COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile.py CheckCompileOutputTests)
         add_test(NAME performance_compare COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_performance_compare.py)
         set_tests_properties(performance_compare PROPERTIES TIMEOUT 20)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 01783ee784..d96b4d4c11 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -3,6 +3,7 @@
 ## Code
 
 - Follow the [coding conventions](docs/dev/CONVENTIONS.md): naming, no comments except [technical debt](docs/dev/TechnicalDebt.md), Conventional Commits.
+- **Every exported PS5 function with `APS5_VABI` must have exactly one declaration in a header reachable through the library's `<library>.hpp`. Duplicate declarations in headers, `.cpp` files and tests are forbidden. This is checked by the Python test [`public_headers`](core/libs/tests/test_public_headers.py).**
 - Every function either does exactly what it is supposed to or throws. Unimplemented exports call `NotImplemented_nid_no_patch(__func__)` (see [libSceAudioIn](core/libs/prx/libSceAudioIn/Export.cpp)).
 - Pull requests that add or change shader instruction semantics say where they come from: measured on hardware (which GPU and what was checked, e.g. with the [hardware oracle](docs/dev/HW_ORACLE.md)) or the exact source (ISA section, LLVM, ACO or Mesa file). Reviewers check the semantics on hardware. Cases the source doesn't settle throw, and behaviour not verified on hardware is recorded in [technical debt](docs/dev/TechnicalDebt.md).
 - An export's signature or behaviour taken from a title's call sites or from a library's disassembly follows [reading titles and libraries](docs/dev/REVERSE_ENGINEERING.md): a call site settles the arguments, not what the library does.
@@ -11,6 +12,7 @@
 - Implement the general behaviour of a function, not what one title happens to need.
 - Don't add replacements for modules that titles ship themselves in `sce_module/`, `sce_modules/` or `prx/`: engine or middleware modules (Cohtml, FMOD, GOG Galaxy) and SDK libraries that only wrap other system libraries. The relinker converts and loads the title's own module, and a host library with the same name is left out of `DT_NEEDED`. Only system libraries, which reach the kernel or the hardware, are reimplemented in [core/libs/prx](core/libs/prx). A host copy may still exist for a wrapped library that some dumps lack entirely, like libSceNpCppWebApi: the title's own module wins whenever one is shipped, so it is only ever consulted by titles that ship nothing.
 - Avoid non-standard extensions (`__attribute__`, etc.) where standard C++ is enough. Helper symbols that must not become NIDs use the `_nid_no_patch` or `_nid_no_patch_cut` suffix.
+- `alignas` takes at most 8192: MinGW GCC, the Windows compiler, rejects static objects aligned above it. A larger block is aligned at run time inside a bigger buffer.
 - The relinker uses only the C++20 standard library.
 - Third-party code is added as a submodule under `3rdparty/` and built from source, not found on the system. With `ANYPS5_USE_SYSTEM_DEPS=ON` the packages packaged by the distributions (SDL2, freetype, Vulkan-Headers, SPIRV-Headers, glslang and SPIRV-Tools) come from the system instead; that resolution lives in [cmake/SystemDeps.cmake](cmake/SystemDeps.cmake) and the default build never reads the system.
 - Don't add tests that only check that a symbol is exported: a missing export already fails at startup.
diff --git a/README.md b/README.md
index 3e7fc3ccf4..1a3a9ac30e 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ The [shader recompiler](core/shader/recompiler/Recompiler.cpp) successfully prod
 
 ## Compatibility
 
-Per-game progress (stage reached, open blockers, libraries and GPU coverage) is tracked on the [blocker map](https://alxcbtw.github.io/anyps5-roadmap/), a community project built from public GitHub data ([source](https://github.com/AlxcBTW/anyps5-roadmap)). Test reports go in the [Game bring-up](https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up) discussions, one thread per title.
+Per-game status and test reports live in the [Game bring-up](https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up) discussions, one thread per title.
 
 ## Input mapping
 
diff --git a/core/Decoder/Png/src/Png.cpp b/core/Decoder/Png/src/Png.cpp
index 434a589d6c..8fb90270e9 100644
--- a/core/Decoder/Png/src/Png.cpp
+++ b/core/Decoder/Png/src/Png.cpp
@@ -48,6 +48,37 @@ bool isChunkType(const std::uint8_t* bytes, const char* type) {
     return std::equal(bytes, bytes + 4, type);
 }
 
+std::optional<std::uint16_t> readGrayscaleTransparencyKey(std::span<const std::uint8_t> png) {
+    std::size_t offset = SIGNATURE.size();
+    if (png.size() < offset || !std::equal(SIGNATURE.begin(), SIGNATURE.end(), png.begin())) return std::nullopt;
+    std::optional<std::uint16_t> key;
+    while (png.size() - offset >= CHUNK_OVERHEAD) {
+        const std::uint32_t length = readBigEndian32(&png[offset]);
+        const std::uint8_t* type = &png[offset + 4];
+        if (length > png.size() - offset - CHUNK_OVERHEAD) return std::nullopt;
+        if (isChunkType(type, "tRNS")) {
+            if (length != 2) return std::nullopt;
+            key = static_cast<std::uint16_t>(png[offset + 8] << 8 | png[offset + 9]);
+        }
+        if (isChunkType(type, "IDAT") || isChunkType(type, "IEND")) return key;
+        offset += CHUNK_OVERHEAD + length;
+    }
+    return std::nullopt;
+}
+
+void repairGrayscaleTransparency(const Header& header, std::span<const std::uint8_t> png, Image& image) {
+    if (header.colorType != ColorType::Grayscale || !header.hasTransparency) return;
+    if (header.bitDepth != 1 && header.bitDepth != 2 && header.bitDepth != 4) return;
+    const std::optional<std::uint16_t> key = readGrayscaleTransparencyKey(png);
+    if (!key.has_value()) return;
+    const std::uint16_t mask = static_cast<std::uint16_t>((1u << header.bitDepth) - 1);
+    if ((*key & 0xFF) == (*key & mask)) return;
+    const std::uint8_t transparent = static_cast<std::uint8_t>((*key & mask) * (255u / mask));
+    for (std::size_t offset = 3; offset < image.pixels.size(); offset += 4) {
+        image.pixels[offset] = static_cast<std::uint8_t>(image.pixels[offset - 3] == transparent ? 0 : 255);
+    }
+}
+
 bool isValidFormat(std::uint8_t bitDepth, std::uint8_t colorType) {
     switch (colorType) {
     case 0:
@@ -158,6 +189,8 @@ std::optional<Image> Decode(std::span<const std::uint8_t> png) {
 
     Image image{static_cast<std::uint32_t>(width), static_cast<std::uint32_t>(height), {}};
     image.pixels.assign(decoded.get(), decoded.get() + static_cast<std::size_t>(image.width) * image.height * 4);
+    const std::optional<Header> header = ParseHeader(png);
+    if (header.has_value()) repairGrayscaleTransparency(*header, png, image);
     return image;
 }
 
diff --git a/core/Decoder/Png/tests/Png.cpp b/core/Decoder/Png/tests/Png.cpp
index 0c1ac81d1e..fbd18d353f 100644
--- a/core/Decoder/Png/tests/Png.cpp
+++ b/core/Decoder/Png/tests/Png.cpp
@@ -3,6 +3,7 @@
 #include <algorithm>
 #include <cstdint>
 #include <cstdlib>
+#include <optional>
 #include <stdexcept>
 #include <vector>
 
@@ -50,6 +51,17 @@ static const std::uint8_t GRAY1[] = {
     0x42, 0x60, 0x82,
 };
 
+static const std::uint8_t GRAY1_TRNS[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0xDC, 0x59, 0x42,
+    0x27, 0x00, 0x00, 0x00, 0x02, 0x74, 0x52, 0x4E, 0x53, 0x00, 0x02, 0x98, 0x9D, 0xAC, 0x14, 0x00,
+    0x00, 0x00, 0x0A, 0x49, 0x44, 0x41, 0x54, 0x78, 0xDA, 0x63, 0x70, 0x00, 0x00, 0x00, 0x42, 0x00,
+    0x41, 0x84, 0xBF, 0x8E, 0x62, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60,
+    0x82,
+};
+
+static const std::uint8_t PNG_SIGNATURE[] = {0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A};
+
 static void AppendBigEndian32(std::vector<std::uint8_t>& bytes, std::uint32_t value) {
     for (int shift = 24; shift >= 0; shift -= 8) bytes.push_back(static_cast<std::uint8_t>(value >> shift));
 }
@@ -64,6 +76,130 @@ static std::vector<std::uint8_t> HeaderOnly(std::uint32_t width, std::uint32_t h
     return bytes;
 }
 
+static std::uint32_t Crc32(std::span<const std::uint8_t> bytes) {
+    std::uint32_t crc = 0xFFFFFFFFu;
+    for (const std::uint8_t byte : bytes) {
+        crc ^= byte;
+        for (int bit = 0; bit < 8; ++bit) crc = (crc >> 1) ^ ((crc & 1) != 0 ? 0xEDB88320u : 0u);
+    }
+    return ~crc;
+}
+
+static std::uint32_t Adler32(std::span<const std::uint8_t> bytes) {
+    std::uint32_t low = 1;
+    std::uint32_t high = 0;
+    for (const std::uint8_t byte : bytes) {
+        low = (low + byte) % 65521;
+        high = (high + low) % 65521;
+    }
+    return high << 16 | low;
+}
+
+static void AppendTestChunk(std::vector<std::uint8_t>& png, const char* type, std::span<const std::uint8_t> data) {
+    AppendBigEndian32(png, static_cast<std::uint32_t>(data.size()));
+    const std::size_t start = png.size();
+    png.insert(png.end(), type, type + 4);
+    png.insert(png.end(), data.begin(), data.end());
+    AppendBigEndian32(png, Crc32(std::span<const std::uint8_t>(png.data() + start, png.size() - start)));
+}
+
+static std::vector<std::uint8_t> ZlibStore(std::span<const std::uint8_t> bytes) {
+    Require(bytes.size() <= 0xFFFF);
+    const std::uint16_t length = static_cast<std::uint16_t>(bytes.size());
+    const std::uint16_t inverse = static_cast<std::uint16_t>(~length);
+    std::vector<std::uint8_t> output{0x78, 0x01, 0x01, static_cast<std::uint8_t>(length), static_cast<std::uint8_t>(length >> 8),
+                                     static_cast<std::uint8_t>(inverse), static_cast<std::uint8_t>(inverse >> 8)};
+    output.insert(output.end(), bytes.begin(), bytes.end());
+    AppendBigEndian32(output, Adler32(bytes));
+    return output;
+}
+
+static std::vector<std::uint8_t> GrayLowBitPng(std::uint8_t bitDepth, std::span<const std::uint8_t> samples,
+                                               std::optional<std::uint16_t> transparency,
+                                               std::optional<std::uint16_t> precedingTransparency = std::nullopt) {
+    Require(bitDepth == 1 || bitDepth == 2 || bitDepth == 4);
+    std::vector<std::uint8_t> rows(1 + (samples.size() * bitDepth + 7) / 8, 0);
+    std::size_t bit = 0;
+    for (const std::uint8_t sample : samples) {
+        Require(sample < (1u << bitDepth));
+        rows[1 + bit / 8] |= static_cast<std::uint8_t>(sample << (8 - bitDepth - bit % 8));
+        bit += bitDepth;
+    }
+
+    std::vector<std::uint8_t> ihdr;
+    AppendBigEndian32(ihdr, static_cast<std::uint32_t>(samples.size()));
+    AppendBigEndian32(ihdr, 1);
+    ihdr.insert(ihdr.end(), {bitDepth, 0, 0, 0, 0});
+
+    std::vector<std::uint8_t> png(PNG_SIGNATURE, PNG_SIGNATURE + sizeof(PNG_SIGNATURE));
+    AppendTestChunk(png, "IHDR", ihdr);
+    if (precedingTransparency.has_value()) {
+        const std::uint8_t key[2] = {static_cast<std::uint8_t>(*precedingTransparency >> 8), static_cast<std::uint8_t>(*precedingTransparency)};
+        AppendTestChunk(png, "tRNS", key);
+    }
+    if (transparency.has_value()) {
+        const std::uint8_t key[2] = {static_cast<std::uint8_t>(*transparency >> 8), static_cast<std::uint8_t>(*transparency)};
+        AppendTestChunk(png, "tRNS", key);
+    }
+    AppendTestChunk(png, "IDAT", ZlibStore(rows));
+    AppendTestChunk(png, "IEND", std::span<const std::uint8_t>());
+    return png;
+}
+
+static std::uint8_t GrayScale(std::uint8_t bitDepth) {
+    if (bitDepth == 1) return 255;
+    if (bitDepth == 2) return 85;
+    return 17;
+}
+
+static void RequireGrayTransparency(std::uint8_t bitDepth, std::span<const std::uint8_t> samples, std::uint16_t key,
+                                    std::uint8_t transparentSample, std::optional<std::uint16_t> precedingKey = std::nullopt) {
+    const std::vector<std::uint8_t> png = GrayLowBitPng(bitDepth, samples, key, precedingKey);
+    const std::vector<std::uint8_t> original = png;
+    const auto header = Decoder::Png::ParseHeader(png);
+    Require(header.has_value());
+    Require(header->width == static_cast<std::uint32_t>(samples.size()) && header->height == 1 && header->bitDepth == bitDepth);
+    Require(header->colorType == Decoder::Png::ColorType::Grayscale && header->hasTransparency);
+
+    const auto image = Decoder::Png::Decode(png);
+    Require(image.has_value() && image->pixels.size() == samples.size() * 4);
+    const std::uint8_t scale = GrayScale(bitDepth);
+    for (std::size_t i = 0; i < samples.size(); ++i) {
+        const std::uint8_t gray = static_cast<std::uint8_t>(samples[i] * scale);
+        Require(image->pixels[i * 4] == gray && image->pixels[i * 4 + 1] == gray && image->pixels[i * 4 + 2] == gray);
+        Require(image->pixels[i * 4 + 3] == (samples[i] == transparentSample ? 0 : 255));
+    }
+    Require(png == original);
+}
+
+static void RequireGrayOpaque(std::uint8_t bitDepth, std::span<const std::uint8_t> samples) {
+    const std::vector<std::uint8_t> png = GrayLowBitPng(bitDepth, samples, std::nullopt);
+    const std::vector<std::uint8_t> original = png;
+    const auto header = Decoder::Png::ParseHeader(png);
+    Require(header.has_value() && !header->hasTransparency);
+    const auto image = Decoder::Png::Decode(png);
+    Require(image.has_value() && image->pixels.size() == samples.size() * 4);
+    const std::uint8_t scale = GrayScale(bitDepth);
+    for (std::size_t i = 0; i < samples.size(); ++i) {
+        const std::uint8_t gray = static_cast<std::uint8_t>(samples[i] * scale);
+        Require(image->pixels[i * 4] == gray && image->pixels[i * 4 + 1] == gray && image->pixels[i * 4 + 2] == gray);
+        Require(image->pixels[i * 4 + 3] == 255);
+    }
+    Require(png == original);
+}
+
+static void RequireTruncatedTransparency() {
+    const std::uint8_t samples[] = {0, 1};
+    const std::vector<std::uint8_t> png = GrayLowBitPng(1, samples, 0x0002);
+    const std::size_t transparencyOffset = sizeof(PNG_SIGNATURE) + 25;
+    const std::vector<std::uint8_t> truncated(png.begin(), png.begin() + transparencyOffset + 9);
+    const std::vector<std::uint8_t> original = truncated;
+    const auto header = Decoder::Png::ParseHeader(truncated);
+    Require(header.has_value() && !header->hasTransparency);
+    (void)Decoder::Png::Decode(truncated);
+    Require(truncated == original);
+}
+
 static void RequireRoundTrip(std::uint32_t channels, Decoder::Png::ColorType colorType) {
     constexpr std::uint32_t width = 20;
     constexpr std::uint32_t height = 10;
@@ -176,6 +312,42 @@ int main() {
     const std::uint8_t levels[8] = {0, 255, 0, 255, 255, 0, 0, 255};
     for (int i = 0; i < 8; ++i) Require(gray1->pixels[i * 4] == levels[i] && gray1->pixels[i * 4 + 3] == 255);
 
+    const auto gray1TrnsHeader = Decoder::Png::ParseHeader(GRAY1_TRNS);
+    Require(gray1TrnsHeader.has_value());
+    Require(gray1TrnsHeader->width == 2 && gray1TrnsHeader->height == 1 && gray1TrnsHeader->bitDepth == 1);
+    Require(gray1TrnsHeader->colorType == Decoder::Png::ColorType::Grayscale && gray1TrnsHeader->hasTransparency);
+    const auto gray1Trns = Decoder::Png::Decode(GRAY1_TRNS);
+    Require(gray1Trns.has_value());
+    Require(gray1Trns->pixels == std::vector<std::uint8_t>({0, 0, 0, 0, 255, 255, 255, 255}));
+
+    const std::uint8_t gray1Samples[] = {0, 1, 0, 1, 1, 0, 0, 1};
+    RequireGrayTransparency(1, gray1Samples, 0x0000, 0);
+    RequireGrayTransparency(1, gray1Samples, 0x0002, 0);
+    RequireGrayTransparency(1, gray1Samples, 0x0100, 0);
+    RequireGrayTransparency(1, gray1Samples, 0xFF02, 0);
+    RequireGrayTransparency(1, gray1Samples, 0xFFFF, 1);
+    RequireGrayTransparency(1, gray1Samples, 0x0001, 1, 0x0002);
+    RequireGrayOpaque(1, gray1Samples);
+
+    const std::uint8_t gray2Samples[] = {0, 1, 2, 3};
+    RequireGrayTransparency(2, gray2Samples, 0x0001, 1);
+    RequireGrayTransparency(2, gray2Samples, 0x0005, 1);
+    RequireGrayTransparency(2, gray2Samples, 0x0100, 0);
+    RequireGrayTransparency(2, gray2Samples, 0x0101, 1);
+    RequireGrayTransparency(2, gray2Samples, 0xFF05, 1);
+    RequireGrayTransparency(2, gray2Samples, 0xFFFF, 3);
+    RequireGrayOpaque(2, gray2Samples);
+
+    const std::uint8_t gray4Samples[] = {0, 3, 10, 15, 1};
+    RequireGrayTransparency(4, gray4Samples, 0x0003, 3);
+    RequireGrayTransparency(4, gray4Samples, 0x0013, 3);
+    RequireGrayTransparency(4, gray4Samples, 0x0100, 0);
+    RequireGrayTransparency(4, gray4Samples, 0x0103, 3);
+    RequireGrayTransparency(4, gray4Samples, 0xFF13, 3);
+    RequireGrayTransparency(4, gray4Samples, 0xFFFF, 15);
+    RequireGrayOpaque(4, gray4Samples);
+    RequireTruncatedTransparency();
+
     const auto interlaced = Decoder::Png::ParseHeader(HeaderOnly(3, 4, 8, 6, 1));
     Require(interlaced.has_value() && interlaced->interlaced && !interlaced->hasTransparency);
     Require(!Decoder::Png::ParseHeader(HeaderOnly(0, 4, 8, 6, 0)).has_value());
diff --git a/core/libs/CMakeLists.txt b/core/libs/CMakeLists.txt
index 98cfe0e1f5..f302226b61 100644
--- a/core/libs/CMakeLists.txt
+++ b/core/libs/CMakeLists.txt
@@ -269,6 +269,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_kernel_sys_sdk_version PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
     endif()
+    add_test_executable(guest_kernel_sys_console_identity_tests tests/GuestKernelSysConsoleIdentity.cpp)
+    target_include_directories(guest_kernel_sys_console_identity_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_console_identity_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_console_identity_tests)
+    add_test(NAME guest_kernel_sys_console_identity COMMAND guest_kernel_sys_console_identity_tests)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_console_identity PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
     add_test_executable(nid_buffer_validation_tests nid/tests/BufferValidation.cpp)
     target_include_directories(nid_buffer_validation_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/nid/include)
     target_compile_features(nid_buffer_validation_tests PRIVATE cxx_std_20)
@@ -278,6 +287,32 @@ if(BUILD_TESTING)
     add_test(NAME nid_buffer_validation COMMAND nid_buffer_validation_tests)
     set_tests_properties(nid_buffer_validation PROPERTIES TIMEOUT 10)
 
+    add_test_executable(guest_dinkumware_fetch_tests ${CMAKE_CURRENT_SOURCE_DIR}/tests/GuestDinkumwareFetch.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/nid/src/NidCompute.cpp ${CMAKE_CURRENT_SOURCE_DIR}/nid/src/Sha1.cpp)
+    target_include_directories(guest_dinkumware_fetch_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_SOURCE_DIR}/nid/include)
+    target_link_libraries(guest_dinkumware_fetch_tests PRIVATE ${CMAKE_DL_LIBS})
+    configure_windows_unwind(guest_dinkumware_fetch_tests)
+    if(MINGW)
+        target_link_libraries(guest_dinkumware_fetch_tests PRIVATE libc)
+    endif()
+    add_custom_target(guest_dinkumware_fetch_libraries DEPENDS ${LIBC_PATCHED})
+    add_dependencies(guest_dinkumware_fetch_tests guest_dinkumware_fetch_libraries)
+    foreach(operation IN ITEMS and or xor)
+        foreach(width IN ITEMS 1 2 4)
+            add_test(NAME guest_dinkumware_fetch_${operation}_${width} COMMAND guest_dinkumware_fetch_tests
+                $<TARGET_FILE_DIR:libc> unpatched ${operation} ${width})
+            add_test(NAME guest_dinkumware_fetch_${operation}_${width}_patched COMMAND guest_dinkumware_fetch_tests
+                ${PATCHED_DIR} patched ${operation} ${width})
+            set_tests_properties(guest_dinkumware_fetch_${operation}_${width}
+                guest_dinkumware_fetch_${operation}_${width}_patched PROPERTIES TIMEOUT 20)
+            if(WIN32)
+                set_tests_properties(guest_dinkumware_fetch_${operation}_${width} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+                set_tests_properties(guest_dinkumware_fetch_${operation}_${width}_patched PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:${PATCHED_DIR}")
+            endif()
+        endforeach()
+    endforeach()
     add_test_executable(pe_import_first_tests allocator/tests/PeImportFirstTests.cpp allocator/PeImportFirst.cpp)
     target_include_directories(pe_import_first_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_compile_features(pe_import_first_tests PRIVATE cxx_std_20)
@@ -289,6 +324,25 @@ if(BUILD_TESTING)
 
     find_package(Python3 QUIET COMPONENTS Interpreter)
     if(Python3_Interpreter_FOUND)
+        set(public_header_compiler_args)
+        if(APPLE)
+            foreach(architecture IN LISTS CMAKE_OSX_ARCHITECTURES)
+                list(APPEND public_header_compiler_args --compiler-arg=-arch "--compiler-arg=${architecture}")
+            endforeach()
+            if(CMAKE_OSX_SYSROOT)
+                list(APPEND public_header_compiler_args --compiler-arg=-isysroot "--compiler-arg=${CMAKE_OSX_SYSROOT}")
+            endif()
+        endif()
+        set(public_header_manifest "${CMAKE_CURRENT_BINARY_DIR}/public_headers.json")
+        add_test(NAME public_headers COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tests/test_public_headers.py --audit-only --manifest "${public_header_manifest}")
+        set_tests_properties(public_headers PROPERTIES TIMEOUT 30 RUN_SERIAL TRUE FIXTURES_SETUP public_headers_manifest)
+        foreach(batch RANGE 0 63)
+            add_test(NAME public_headers_compile_${batch} COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_CURRENT_SOURCE_DIR}/tests/test_public_headers.py --compiler ${CMAKE_CXX_COMPILER} ${public_header_compiler_args}
+                --manifest "${public_header_manifest}" --batch-index ${batch} --batch-count 64)
+            set_tests_properties(public_headers_compile_${batch} PROPERTIES TIMEOUT 30 FIXTURES_REQUIRED public_headers_manifest)
+        endforeach()
         add_test(NAME nid_gnu_hash COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/nid/tests/test_gnu_hash.py $<TARGET_FILE:nid_patcher>)
         add_test(NAME nid_elf_duplicates COMMAND ${Python3_EXECUTABLE}
@@ -347,14 +401,52 @@ if(BUILD_TESTING)
     target_link_libraries(guest_kernel_sys_pthread_tests PRIVATE libkernel_sys libkernel libc)
     configure_windows_unwind(guest_kernel_sys_pthread_tests)
     add_test(NAME guest_kernel_sys_pthread COMMAND guest_kernel_sys_pthread_tests)
+    add_test_executable(guest_kernel_sys_constants_tests tests/GuestKernelSysConstants.cpp)
+    target_include_directories(guest_kernel_sys_constants_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_constants_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_constants_tests)
+    add_test(NAME guest_kernel_sys_constants COMMAND guest_kernel_sys_constants_tests)
+    set_tests_properties(guest_kernel_sys_constants PROPERTIES TIMEOUT 20)
+    add_test_executable(guest_firmware_constant_returns_tests tests/GuestFirmwareConstantReturns.cpp)
+    target_include_directories(guest_firmware_constant_returns_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_firmware_constant_returns_tests PRIVATE libSceComposite libSceFsInternalForVsh libSceHttpCache libScePlayReady libSceSdma libSceSsl libSceVisionManager libmdbg_syscore libkernel libc)
+    configure_windows_unwind(guest_firmware_constant_returns_tests)
+    add_test(NAME guest_firmware_constant_returns COMMAND guest_firmware_constant_returns_tests)
+    set_tests_properties(guest_firmware_constant_returns PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_firmware_constant_returns PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceComposite>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFsInternalForVsh>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceHttpCache>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libScePlayReady>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceSdma>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceSsl>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVisionManager>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libmdbg_syscore>")
+    endif()
     if(Python3_Interpreter_FOUND)
         add_test(NAME nid_verneed COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/nid/tests/test_verneed.py $<TARGET_FILE:nid_patcher>)
     endif()
     if(WIN32)
-        set_tests_properties(guest_kernel_sys guest_kernel_sys_thread_defaults guest_kernel_sys_barrier guest_kernel_sys_pthread PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_kernel_sys guest_kernel_sys_thread_defaults guest_kernel_sys_barrier guest_kernel_sys_pthread guest_kernel_sys_constants PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
     endif()
+    add_test_executable(guest_kernel_sys_threads_tests tests/GuestKernelSysThreads.cpp
+        nid/src/NidCompute.cpp nid/src/Sha1.cpp)
+    target_include_directories(guest_kernel_sys_threads_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_SOURCE_DIR}/nid/include)
+    target_link_libraries(guest_kernel_sys_threads_tests PRIVATE ${CMAKE_DL_LIBS})
+    add_custom_target(guest_kernel_sys_threads_libraries DEPENDS
+        ${PATCHED_DIR}/libkernel_sys.prx ${PATCHED_DIR}/libkernel.prx ${LIBC_PATCHED})
+    add_dependencies(guest_kernel_sys_threads_tests guest_kernel_sys_threads_libraries)
+    configure_windows_unwind(guest_kernel_sys_threads_tests)
+    if(MINGW)
+        target_compile_options(guest_kernel_sys_threads_tests PRIVATE -fasynchronous-unwind-tables)
+        target_link_options(guest_kernel_sys_threads_tests PRIVATE -static -static-libgcc -static-libstdc++)
+    endif()
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        add_test(NAME guest_kernel_sys_threads_main_late_load COMMAND guest_kernel_sys_threads_tests ${UNPATCHED_DIR} unpatched main_late_load)
+        add_test(NAME guest_kernel_sys_threads_main_late_load_patched COMMAND guest_kernel_sys_threads_tests ${PATCHED_DIR} patched main_late_load)
+        set_tests_properties(guest_kernel_sys_threads_main_late_load guest_kernel_sys_threads_main_late_load_patched PROPERTIES TIMEOUT 20)
+    endif()
+    foreach(case IN ITEMS main)
+        add_test(NAME guest_kernel_sys_threads_${case} COMMAND guest_kernel_sys_threads_tests ${UNPATCHED_DIR} unpatched ${case})
+        add_test(NAME guest_kernel_sys_threads_${case}_patched COMMAND guest_kernel_sys_threads_tests ${PATCHED_DIR} patched ${case})
+        set_tests_properties(guest_kernel_sys_threads_${case} guest_kernel_sys_threads_${case}_patched PROPERTIES TIMEOUT 20)
+    endforeach()
 
     add_test_executable(guest_gnm_neo_packets_tests tests/GuestGnmNeoPackets.cpp)
     target_include_directories(guest_gnm_neo_packets_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
@@ -369,6 +461,18 @@ if(BUILD_TESTING)
         add_subdirectory(tests/write_watch)
         add_subdirectory(tests/guest_arena)
     endif()
+    add_test_executable(guest_kernel_sys_pthread_np_tests tests/GuestKernelSysPthreadNp.cpp)
+    target_include_directories(guest_kernel_sys_pthread_np_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_pthread_np_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_pthread_np_tests)
+    foreach(pthreadNpMode IN ITEMS rwlockattr kind)
+        add_test(NAME guest_kernel_sys_pthread_np_${pthreadNpMode} COMMAND guest_kernel_sys_pthread_np_tests ${pthreadNpMode})
+        set_tests_properties(guest_kernel_sys_pthread_np_${pthreadNpMode} PROPERTIES TIMEOUT 20)
+        if(WIN32)
+            set_tests_properties(guest_kernel_sys_pthread_np_${pthreadNpMode} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+        endif()
+    endforeach()
     add_test_executable(guest_kernel_sys_module_internal_tests tests/GuestKernelSysModuleInternal.cpp)
     target_include_directories(guest_kernel_sys_module_internal_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_kernel_sys_module_internal_tests PRIVATE libkernel_sys libkernel libc)
@@ -382,12 +486,29 @@ if(BUILD_TESTING)
     if(WIN32)
         add_test_executable(windows_write_watch_tests tests/WindowsWriteWatch.cpp)
         target_include_directories(windows_write_watch_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
-        target_compile_definitions(windows_write_watch_tests PRIVATE _WIN32_WINNT=0x0A00)
+        target_compile_definitions(windows_write_watch_tests PRIVATE _WIN32_WINNT=0x0A00 APS5_COUNT_MAPPING_QUERIES=1)
         if(MINGW)
             target_compile_options(windows_write_watch_tests PRIVATE -fasynchronous-unwind-tables)
         endif()
         add_test(NAME windows_write_watch COMMAND windows_write_watch_tests)
         set_tests_properties(windows_write_watch PROPERTIES TIMEOUT 20)
+        add_test_executable(windows_shared_map_cost_tests tests/WindowsSharedMapCost.cpp)
+        target_include_directories(windows_shared_map_cost_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+        target_compile_definitions(windows_shared_map_cost_tests PRIVATE _WIN32_WINNT=0x0A00)
+        if(MINGW)
+            target_compile_options(windows_shared_map_cost_tests PRIVATE -fasynchronous-unwind-tables)
+        endif()
+        add_test(NAME windows_shared_map_cost COMMAND windows_shared_map_cost_tests)
+        set_tests_properties(windows_shared_map_cost PROPERTIES TIMEOUT 120)
+    endif()
+    add_test_executable(guest_kernel_sys_login_tests tests/GuestKernelSysLogin.cpp)
+    target_include_directories(guest_kernel_sys_login_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_login_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_login_tests)
+    add_test(NAME guest_kernel_sys_login COMMAND guest_kernel_sys_login_tests)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_login PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
     endif()
 
     if(WIN32)
@@ -407,6 +528,16 @@ if(BUILD_TESTING)
         target_compile_options(crash_text_tests PRIVATE -fasynchronous-unwind-tables)
     endif()
     add_test(NAME crash_text COMMAND crash_text_tests)
+    add_test_executable(guest_kernel_sys_pselect_tests tests/GuestKernelSysPselect.cpp)
+    target_include_directories(guest_kernel_sys_pselect_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_pselect_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_pselect_tests)
+    add_test(NAME guest_kernel_sys_pselect COMMAND guest_kernel_sys_pselect_tests)
+    set_tests_properties(guest_kernel_sys_pselect PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_pselect PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
 
     if(WIN32)
         add_test_executable(windows_crash_text_tests tests/WindowsCrashText.cpp)
@@ -460,6 +591,17 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceMove>")
     endif()
 
+    add_test_executable(guest_pthread_create_suspended_tests tests/GuestPthreadCreateSuspended.cpp)
+    target_include_directories(guest_pthread_create_suspended_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_pthread_create_suspended_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_pthread_create_suspended_tests)
+    add_test(NAME guest_pthread_create_suspended COMMAND guest_pthread_create_suspended_tests)
+    set_tests_properties(guest_pthread_create_suspended PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_pthread_create_suspended PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
+
     add_test_executable(guest_np_party_tests tests/GuestNpParty.cpp)
     target_include_directories(guest_np_party_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_np_party_tests PRIVATE libSceNpParty libc)
@@ -470,6 +612,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpParty>")
     endif()
 
+    add_test_executable(guest_np_ps4_imports_tests tests/GuestNpPs4Imports.cpp)
+    target_include_directories(guest_np_ps4_imports_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_ps4_imports_tests PRIVATE libSceNpMatching2 libSceNpSignaling libSceNpTrophy libc)
+    configure_windows_unwind(guest_np_ps4_imports_tests)
+    add_test(NAME guest_np_ps4_imports COMMAND guest_np_ps4_imports_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_ps4_imports PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpMatching2>")
+    endif()
+
     add_test_executable(guest_np_common_tests tests/GuestNpCommon.cpp)
     target_include_directories(guest_np_common_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_np_common_tests PRIVATE libSceNpCommon libkernel libc)
@@ -483,6 +635,17 @@ if(BUILD_TESTING)
         endif()
     endforeach()
 
+    add_test_executable(guest_np_common_runtime_tests tests/GuestNpCommonRuntime.cpp)
+    target_include_directories(guest_np_common_runtime_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_common_runtime_tests PRIVATE libSceNpCommon libkernel libc)
+    configure_windows_unwind(guest_np_common_runtime_tests)
+    add_test(NAME guest_np_common_runtime COMMAND guest_np_common_runtime_tests)
+    set_tests_properties(guest_np_common_runtime PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_common_runtime PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCommon>")
+    endif()
+
     add_test_executable(guest_offline_imports_tests tests/GuestOfflineImports.cpp)
     target_include_directories(guest_offline_imports_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_offline_imports_tests PRIVATE libSceHttp libSceNpEntitlementAccess libSceRudp libSceVideoRecordingP libc)
@@ -717,6 +880,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCppWebApi>")
     endif()
 
+    add_test_executable(guest_np_cpp_web_api_offline_tests tests/GuestNpCppWebApiOffline.cpp)
+    target_include_directories(guest_np_cpp_web_api_offline_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_cpp_web_api_offline_tests PRIVATE libSceNpCppWebApi libc)
+    configure_windows_unwind(guest_np_cpp_web_api_offline_tests)
+    add_test(NAME guest_np_cpp_web_api_offline COMMAND guest_np_cpp_web_api_offline_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_cpp_web_api_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCppWebApi>")
+    endif()
+
     add_test_executable(savedata_core_write_replacement_tests tests/SaveDataWriteReplacement.cpp)
     target_include_directories(savedata_core_write_replacement_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(savedata_core_write_replacement_tests PRIVATE libSceSaveData)
@@ -799,6 +972,18 @@ if(BUILD_TESTING)
     endif()
     add_test(NAME MemoryPoolTest COMMAND MemoryPoolTest)
 
+    add_test_executable(guest_kernel_sys_swapcontext_tests tests/GuestKernelSysSwapcontext.cpp)
+    target_include_directories(guest_kernel_sys_swapcontext_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_compile_options(guest_kernel_sys_swapcontext_tests PRIVATE -fno-omit-frame-pointer)
+    target_link_libraries(guest_kernel_sys_swapcontext_tests PRIVATE libkernel_sys libSceLibcInternal libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_swapcontext_tests)
+    add_test(NAME guest_kernel_sys_swapcontext COMMAND guest_kernel_sys_swapcontext_tests)
+    set_tests_properties(guest_kernel_sys_swapcontext PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_swapcontext PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
+
     add_test_executable(guest_acm_tests tests/GuestAcm.cpp)
     target_include_directories(guest_acm_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_acm_tests PRIVATE libSceAcm libc)
@@ -819,6 +1004,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVoiceChat>")
     endif()
 
+    add_test_executable(guest_gnm_neo_embedded_tests tests/GuestGnmNeoEmbedded.cpp)
+    target_include_directories(guest_gnm_neo_embedded_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_gnm_neo_embedded_tests PRIVATE libSceGnmDriverForNeoMode libc)
+    configure_windows_unwind(guest_gnm_neo_embedded_tests)
+    add_test(NAME guest_gnm_neo_embedded COMMAND guest_gnm_neo_embedded_tests)
+    if(WIN32)
+        set_tests_properties(guest_gnm_neo_embedded PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGnmDriverForNeoMode>")
+    endif()
+
     add_test_executable(guest_np_game_intent_tests tests/GuestNpGameIntent.cpp)
     target_include_directories(guest_np_game_intent_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_np_game_intent_tests PRIVATE libSceNpGameIntent libc)
@@ -829,6 +1024,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpGameIntent>")
     endif()
 
+    add_test_executable(guest_gnm_neo_shaders_tests tests/GuestGnmNeoShaders.cpp)
+    target_include_directories(guest_gnm_neo_shaders_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_gnm_neo_shaders_tests PRIVATE libSceGnmDriverForNeoMode libc)
+    configure_windows_unwind(guest_gnm_neo_shaders_tests)
+    add_test(NAME guest_gnm_neo_shaders COMMAND guest_gnm_neo_shaders_tests)
+    if(WIN32)
+        set_tests_properties(guest_gnm_neo_shaders PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGnmDriverForNeoMode>")
+    endif()
+
     add_test_executable(guest_vorbis_dec_tests tests/GuestVorbisDec.cpp)
     target_include_directories(guest_vorbis_dec_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_compile_definitions(guest_vorbis_dec_tests PRIVATE OV_EXCLUDE_STATIC_CALLBACKS)
diff --git a/core/libs/SceTypes.hpp b/core/libs/SceTypes.hpp
index 4a61c38ed7..0eb23cef6d 100644
--- a/core/libs/SceTypes.hpp
+++ b/core/libs/SceTypes.hpp
@@ -655,6 +655,13 @@ struct AudioOutPortState {
     std::uint64_t activeState;
 };
 
+struct AudioOutSystemState {
+    float loudness;
+    std::uint8_t reserved8[4];
+    std::uint64_t reserved[3];
+};
+static_assert(sizeof(AudioOutSystemState) == 32);
+
 struct Audio3dOpenParameters {
     std::uint64_t size_this;
     std::uint32_t granularity;
@@ -1495,6 +1502,15 @@ struct SharePlayConnectionInfoA {
     std::int32_t visitorUserId;
 };
 static_assert(sizeof(SharePlayConnectionInfoA) == 72 && offsetof(SharePlayConnectionInfoA, hostAccountId) == 48 && offsetof(SharePlayConnectionInfoA, hostUserId) == 64);
+struct SharePlayConnectionInfo {
+    std::int32_t status;
+    std::int32_t mode;
+    NpOnlineId hostOnlineId;
+    NpOnlineId visitorOnlineId;
+    std::int32_t hostUserId;
+    std::int32_t visitorUserId;
+};
+static_assert(sizeof(SharePlayConnectionInfo) == 56 && offsetof(SharePlayConnectionInfo, hostUserId) == 48);
 struct NpId { NpOnlineId online_id; std::uint8_t opaque[4]; };
 struct NpCreateAsyncRequestParameter { std::uint8_t opaque[64]; };
 struct NpCheckPremiumParameter { std::uint8_t opaque[64]; };
diff --git a/core/libs/nid/include/nid/ElfPatcher.hpp b/core/libs/nid/include/nid/ElfPatcher.hpp
index 0415b4eb7f..f6887aae64 100644
--- a/core/libs/nid/include/nid/ElfPatcher.hpp
+++ b/core/libs/nid/include/nid/ElfPatcher.hpp
@@ -22,6 +22,17 @@ struct Elf64_Ehdr {
     std::uint16_t e_shstrndx;
 };
 
+struct Elf64_Phdr {
+    std::uint32_t p_type;
+    std::uint32_t p_flags;
+    std::uint64_t p_offset;
+    std::uint64_t p_vaddr;
+    std::uint64_t p_paddr;
+    std::uint64_t p_filesz;
+    std::uint64_t p_memsz;
+    std::uint64_t p_align;
+};
+
 struct Elf64_Shdr {
     std::uint32_t sh_name;
     std::uint32_t sh_type;
@@ -103,7 +114,7 @@ constexpr std::uint16_t kShnUndef = 0u;
 
 class ElfNidPatcher final : public IBinaryPatcher {
 public:
-    void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) const override;
+    void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports, const PatchOptions& options = {}) const override;
 };
 
 }
diff --git a/core/libs/nid/include/nid/IBinaryPatcher.hpp b/core/libs/nid/include/nid/IBinaryPatcher.hpp
index 0fbcb88501..4e8cff5cbc 100644
--- a/core/libs/nid/include/nid/IBinaryPatcher.hpp
+++ b/core/libs/nid/include/nid/IBinaryPatcher.hpp
@@ -8,11 +8,16 @@
 
 namespace Nid {
 
+struct PatchOptions {
+    bool executable = false;
+    bool onlySce = false;
+};
+
 class IBinaryPatcher {
 public:
     virtual ~IBinaryPatcher() = default;
 
-    virtual void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) const = 0;
+    virtual void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports, const PatchOptions& options = {}) const = 0;
 };
 
 }
diff --git a/core/libs/nid/include/nid/MachONidPatcher.hpp b/core/libs/nid/include/nid/MachONidPatcher.hpp
index f49732cd88..f6ae370549 100644
--- a/core/libs/nid/include/nid/MachONidPatcher.hpp
+++ b/core/libs/nid/include/nid/MachONidPatcher.hpp
@@ -22,7 +22,7 @@ std::vector<MachOExport> ReadMachOExports(const std::vector<std::uint8_t>& binar
 
 class MachONidPatcher final : public IBinaryPatcher {
 public:
-    void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) const override;
+    void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports, const PatchOptions& options = {}) const override;
 };
 
 }
diff --git a/core/libs/nid/include/nid/NidResolver.hpp b/core/libs/nid/include/nid/NidResolver.hpp
index df144b4519..9822939e4e 100644
--- a/core/libs/nid/include/nid/NidResolver.hpp
+++ b/core/libs/nid/include/nid/NidResolver.hpp
@@ -1,6 +1,7 @@
 #ifndef NID_NIDRESOLVER_HPP
 #define NID_NIDRESOLVER_HPP
 
+#include <nid/IBinaryPatcher.hpp>
 #include <string>
 #include <unordered_map>
 #include <unordered_set>
@@ -8,6 +9,10 @@
 
 namespace Nid {
 
+bool IsSceImport(const std::string& name);
+
+std::unordered_map<std::string, std::string> ResolveImportNids(const std::vector<std::string>& names, const std::unordered_set<std::string>& excluded, const PatchOptions& options);
+
 std::string ResolveOneName(const std::string& funcName);
 
 std::unordered_map<std::string, std::string> ResolveNids(const std::vector<std::string>& exportedNames, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports);
diff --git a/core/libs/nid/include/nid/PeNidPatcher.hpp b/core/libs/nid/include/nid/PeNidPatcher.hpp
index c674c3a80b..d9d14bda4b 100644
--- a/core/libs/nid/include/nid/PeNidPatcher.hpp
+++ b/core/libs/nid/include/nid/PeNidPatcher.hpp
@@ -39,7 +39,7 @@ struct PeSectionHeader {
 
 class PeNidPatcher final : public IBinaryPatcher {
 public:
-    void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) const override;
+    void PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports, const PatchOptions& options = {}) const override;
 };
 
 }
diff --git a/core/libs/nid/src/ElfNidPatcher.cpp b/core/libs/nid/src/ElfNidPatcher.cpp
index 089bcd7107..2e06bc5431 100644
--- a/core/libs/nid/src/ElfNidPatcher.cpp
+++ b/core/libs/nid/src/ElfNidPatcher.cpp
@@ -354,7 +354,7 @@ std::vector<std::uint32_t> CollectVerneedNameOffsets(const std::vector<std::uint
 
 }
 
-void ElfNidPatcher::PatchNids(std::vector<std::uint8_t>& elf, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) const {
+void ElfNidPatcher::PatchNids(std::vector<std::uint8_t>& elf, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports, const PatchOptions& options) const {
     using namespace Internal;
 
     if (elf.size() < sizeof(Elf64_Ehdr)) throw std::runtime_error("file too small");
@@ -370,11 +370,13 @@ void ElfNidPatcher::PatchNids(std::vector<std::uint8_t>& elf, const std::string&
     std::size_t sysvHashOffset = 0u, sysvHashSize = 0u;
     std::uint32_t sysvHashLink = 0u;
     std::size_t versymOffset = 0u;
+    bool hasDynamic = false;
     std::uint32_t dynSymSectionIndex = 0u;
     std::uint32_t gnuHashSymOffset = 0u;
     for (std::uint16_t i = 0u; i < ehdr.e_shnum; ++i) {
         const std::size_t shOffset = static_cast<std::size_t>(ehdr.e_shoff) + i * sizeof(Elf64_Shdr);
         const auto shdr = Read<Elf64_Shdr>(elf, shOffset);
+        if (shdr.sh_type == kShtDynamic) hasDynamic = true;
         if (shdr.sh_type == kShtDynsym) {
             if (shdr.sh_entsize != sizeof(Elf64_Sym) || shdr.sh_size % sizeof(Elf64_Sym) || shdr.sh_link >= ehdr.e_shnum)
                 throw std::runtime_error("invalid ELF dynsym layout");
@@ -398,6 +400,19 @@ void ElfNidPatcher::PatchNids(std::vector<std::uint8_t>& elf, const std::string&
             throw std::runtime_error("unsupported .gnu.version_d section: symbol version definitions cannot be preserved");
     }
 
+    if (options.executable && dynSymOffset == 0u && !hasDynamic) {
+        if (ehdr.e_phnum) {
+            if (!ehdr.e_phoff || ehdr.e_phentsize != sizeof(Elf64_Phdr) || ehdr.e_phnum == 0xffffu)
+                throw std::runtime_error("unsupported ELF program header layout");
+            RequireElfRange(elf, ehdr.e_phoff, std::uint64_t{ehdr.e_phnum} * sizeof(Elf64_Phdr), "program headers");
+            for (std::uint16_t index = 0u; index < ehdr.e_phnum; ++index) {
+                const auto segment = Read<Elf64_Phdr>(elf, ehdr.e_phoff + index * sizeof(Elf64_Phdr));
+                if (segment.p_type == 2u)
+                    throw std::runtime_error("unsupported ELF PT_DYNAMIC without a .dynsym section");
+            }
+        }
+        return;
+    }
     if (dynSymOffset == 0u) throw std::runtime_error("no .dynsym section");
 
     const std::size_t symCount = dynSymSize / sizeof(Elf64_Sym);
@@ -437,19 +452,26 @@ void ElfNidPatcher::PatchNids(std::vector<std::uint8_t>& elf, const std::string&
         elf.begin() + static_cast<std::ptrdiff_t>(dynStrOffset + dynStrSize)
     );
 
+    std::vector<std::string> importedNames;
     std::vector<std::string> exportedNames;
     for (std::size_t i = 1u; i < symCount; ++i) {
         const std::size_t symOffset = dynSymOffset + i * sizeof(Elf64_Sym);
         const auto sym = Read<Elf64_Sym>(elf, symOffset);
         if (sym.st_name == 0u) continue;
         const std::uint8_t binding = sym.st_info >> 4u;
-        if (binding == kStbLocal || sym.st_shndx == kShnUndef) continue;
+        if (binding == kStbLocal) continue;
+        if (sym.st_shndx == kShnUndef) {
+            const auto name = ReadCStr(origDynStr, sym.st_name);
+            if (!name.empty()) importedNames.push_back(name);
+            continue;
+        }
         const std::string symName = ReadCStr(origDynStr, sym.st_name);
         if (symName.empty()) continue;
         exportedNames.push_back(symName);
     }
 
-    const auto nidMap = ResolveNids(exportedNames, libraryName, excludedExports);
+    const auto nidMap = options.executable ? std::unordered_map<std::string, std::string>{} : ResolveNids(exportedNames, libraryName, excludedExports);
+    const auto importMap = ResolveImportNids(importedNames, excludedExports, options);
 
     struct SymbolNameUse {
         std::size_t symIndex;
@@ -481,14 +503,11 @@ void ElfNidPatcher::PatchNids(std::vector<std::uint8_t>& elf, const std::string&
         } else if (binding != kStbLocal && sym.st_shndx == kShnUndef) {
             const bool isUnversioned = versymOffset == 0u ||
                 (Read<std::uint16_t>(elf, versymOffset + i * sizeof(std::uint16_t)) <= 1u);
-            const bool hasNidPostfix = symName.size() >= kNidPostfixLen &&
-                symName.compare(symName.size() - kNidPostfixLen, kNidPostfixLen, kNidPostfix) == 0;
-            const bool hasScePrefix = symName.size() >= 3u &&
-                std::tolower(static_cast<unsigned char>(symName[0])) == 's' &&
-                std::tolower(static_cast<unsigned char>(symName[1])) == 'c' &&
-                std::tolower(static_cast<unsigned char>(symName[2])) == 'e';
-            if (isUnversioned && (hasNidPostfix || hasScePrefix))
-                newValue = ResolveOneName(symName);
+            if (options.executable || isUnversioned) {
+                newValue = importMap.at(symName);
+                if (options.executable && newValue != symName && versymOffset != 0u)
+                    Write(elf, versymOffset + i * sizeof(std::uint16_t), std::uint16_t{1});
+            }
         }
 
         uses.push_back(SymbolNameUse{i, sym.st_name, newValue});
@@ -538,11 +557,69 @@ void ElfNidPatcher::PatchNids(std::vector<std::uint8_t>& elf, const std::string&
     for (const auto offset : preservedOffsets)
         preservedToNewOffset.emplace_back(offset, valueOffsets.at(ReadCStr(origDynStr, offset)));
 
+    if (newDynStr.size() > dynStrSize && options.executable) {
+        if (ehdr.e_phentsize != sizeof(Elf64_Phdr) || ehdr.e_phnum == 0 || ehdr.e_phnum >= 0xfffdu)
+            throw std::runtime_error("invalid ELF program header table for string growth");
+        RequireElfRange(elf, ehdr.e_phoff, std::uint64_t{ehdr.e_phnum} * sizeof(Elf64_Phdr), "program headers");
+        const auto align = [](std::uint64_t value) {
+            if (value > UINT64_MAX - 4095u) throw std::runtime_error("ELF address overflow");
+            return (value + 4095u) & ~std::uint64_t{4095u};
+        };
+        std::vector<Elf64_Phdr> segments;
+        std::uint64_t virtualEnd = 0;
+        bool hasPhdr = false;
+        for (std::size_t index = 0; index < ehdr.e_phnum; ++index) {
+            const auto segment = Read<Elf64_Phdr>(elf, ehdr.e_phoff + index * sizeof(Elf64_Phdr));
+            segments.push_back(segment);
+            hasPhdr |= segment.p_type == 6;
+            if (segment.p_type != 1) continue;
+            if (segment.p_memsz > UINT64_MAX - segment.p_vaddr) throw std::runtime_error("ELF segment address overflow");
+            virtualEnd = std::max(virtualEnd, segment.p_vaddr + segment.p_memsz);
+        }
+        if (!virtualEnd) throw std::runtime_error("ELF executable has no load segment");
+        if (!hasPhdr) segments.insert(segments.begin(), Elf64_Phdr{6, 4, 0, 0, 0, 0, 0, 8});
+        const auto fileOffset = align(elf.size());
+        const auto address = align(virtualEnd);
+        const auto tableSize = (segments.size() + 1u) * sizeof(Elf64_Phdr);
+        const auto segmentSize = tableSize + newDynStr.size();
+        if (segmentSize > UINT64_MAX - address || segmentSize > SIZE_MAX - fileOffset) throw std::runtime_error("ELF string segment overflow");
+        for (auto& segment : segments) {
+            if (segment.p_type != 6) continue;
+            segment = {6, 4, fileOffset, address, address, tableSize, tableSize, 8};
+        }
+        segments.push_back({1, 4, fileOffset, address, address, segmentSize, segmentSize, 4096});
+        elf.resize(static_cast<std::size_t>(fileOffset + segmentSize), 0);
+        for (std::size_t index = 0; index < segments.size(); ++index)
+            Write(elf, fileOffset + index * sizeof(Elf64_Phdr), segments[index]);
+        Write(elf, offsetof(Elf64_Ehdr, e_phoff), fileOffset);
+        Write(elf, offsetof(Elf64_Ehdr, e_phnum), static_cast<std::uint16_t>(segments.size()));
+        dynStrOffset = static_cast<std::size_t>(fileOffset + tableSize);
+        dynStrSize = newDynStr.size();
+        const auto stringAddress = address + tableSize;
+        const auto sectionOffset = ehdr.e_shoff + dynStrSectionLink * sizeof(Elf64_Shdr);
+        auto strings = Read<Elf64_Shdr>(elf, sectionOffset);
+        strings.sh_offset = dynStrOffset;
+        strings.sh_addr = stringAddress;
+        strings.sh_size = dynStrSize;
+        Write(elf, sectionOffset, strings);
+        bool foundAddress = false;
+        bool foundSize = false;
+        for (std::size_t index = 0; index < ehdr.e_shnum; ++index) {
+            const auto section = Read<Elf64_Shdr>(elf, ehdr.e_shoff + index * sizeof(Elf64_Shdr));
+            if (section.sh_type != kShtDynamic) continue;
+            RequireElfRange(elf, section.sh_offset, section.sh_size, "dynamic");
+            for (std::uint64_t offset = 0; offset + sizeof(Elf64_Dyn) <= section.sh_size; offset += sizeof(Elf64_Dyn)) {
+                auto entry = Read<Elf64_Dyn>(elf, section.sh_offset + offset);
+                if (entry.d_tag == kDtNull) break;
+                if (entry.d_tag == 5) { entry.d_val = stringAddress; foundAddress = true; }
+                if (entry.d_tag == 10) { entry.d_val = dynStrSize; foundSize = true; }
+                Write(elf, section.sh_offset + offset, entry);
+            }
+        }
+        if (!foundAddress || !foundSize) throw std::runtime_error("ELF executable lacks DT_STRTAB or DT_STRSZ");
+    }
     if (newDynStr.size() > dynStrSize) {
-        throw std::runtime_error(
-            "rebuilt .dynstr (" + std::to_string(newDynStr.size()) + " bytes) exceeds original section size (" +
-            std::to_string(dynStrSize) + " bytes) - relinking with a larger section is required"
-        );
+        throw std::runtime_error("rebuilt .dynstr exceeds original section size; relinking with a larger section is required");
     }
     newDynStr.resize(dynStrSize, 0u);
 
diff --git a/core/libs/nid/src/MachONidPatcher.cpp b/core/libs/nid/src/MachONidPatcher.cpp
index 45bdee2735..71e8713f27 100644
--- a/core/libs/nid/src/MachONidPatcher.cpp
+++ b/core/libs/nid/src/MachONidPatcher.cpp
@@ -341,15 +341,6 @@ std::string StripUnderscore(const std::string& name) {
     return !name.empty() && name[0] == '_' ? name.substr(1) : name;
 }
 
-bool IsGuestFacingImport(const std::string& name) {
-    using namespace Internal;
-    const bool hasNidPostfix = name.size() >= kNidPostfixLen && name.compare(name.size() - kNidPostfixLen, kNidPostfixLen, kNidPostfix) == 0;
-    const bool hasScePrefix = name.size() >= 3u &&
-        std::tolower(static_cast<unsigned char>(name[0])) == 's' &&
-        std::tolower(static_cast<unsigned char>(name[1])) == 'c' &&
-        std::tolower(static_cast<unsigned char>(name[2])) == 'e';
-    return hasNidPostfix || hasScePrefix;
-}
 
 std::vector<bool> DylibOrdinalsArePrx(const std::vector<std::uint8_t>& binary, const Image& image) {
     std::vector<bool> result;
@@ -364,11 +355,48 @@ std::vector<bool> DylibOrdinalsArePrx(const std::vector<std::uint8_t>& binary, c
     return result;
 }
 
-void PatchChainedImports(std::vector<std::uint8_t>& binary, const Image& image) {
+void WriteLinkeditData(std::vector<std::uint8_t>& binary, const Image& image, const TrieLocation& location, const std::vector<std::uint8_t>& trie) {
+    const auto oldOffset = Read<std::uint32_t>(binary, location.OffsetField);
+    const auto oldSize = Read<std::uint32_t>(binary, location.SizeField);
+    if (trie.size() <= oldSize) {
+        std::copy(trie.begin(), trie.end(), binary.begin() + oldOffset);
+        std::fill(binary.begin() + oldOffset + static_cast<std::ptrdiff_t>(trie.size()), binary.begin() + oldOffset + oldSize, 0);
+        Write(binary, location.SizeField, static_cast<std::uint32_t>(trie.size()));
+        return;
+    }
+    std::optional<std::size_t> linkedit;
+    for (const auto offset : image.Commands) {
+        const auto cmd = Read<LoadCommand>(binary, offset).Cmd;
+        if (cmd == kLcCodeSignature) throw std::runtime_error("signed Mach-O images cannot grow linkedit data");
+        if (cmd != kLcSegment64) continue;
+        const auto segment = Read<SegmentCommand64>(binary, offset);
+        if (std::strncmp(segment.Name, "__LINKEDIT", sizeof(segment.Name)) == 0) linkedit = offset;
+    }
+    if (!linkedit) throw std::runtime_error("Mach-O image has no __LINKEDIT segment");
+    auto segment = Read<SegmentCommand64>(binary, *linkedit);
+    if (segment.FileOffset + segment.FileSize != binary.size()) throw std::runtime_error("__LINKEDIT does not end the file");
+    const auto newOffset = (binary.size() + 7) & ~std::size_t{7};
+    if (newOffset + trie.size() > 0xffffffffu) throw std::runtime_error("linkedit data offset overflow");
+    binary.resize(newOffset, 0);
+    binary.insert(binary.end(), trie.begin(), trie.end());
+    std::fill(binary.begin() + oldOffset, binary.begin() + oldOffset + oldSize, 0);
+    segment.FileSize = binary.size() - segment.FileOffset;
+    segment.VmSize = std::max(segment.VmSize, (segment.FileSize + kPageSize - 1) & ~(kPageSize - 1));
+    Write(binary, *linkedit, segment);
+    Write(binary, location.OffsetField, static_cast<std::uint32_t>(newOffset));
+    Write(binary, location.SizeField, static_cast<std::uint32_t>(trie.size()));
+}
+
+void PatchChainedImports(std::vector<std::uint8_t>& binary, const Image& image, const std::unordered_set<std::string>& excluded, const PatchOptions& options) {
+    std::size_t commandOffset = 0;
     std::optional<LinkeditDataCommand> fixups;
     for (const auto offset : image.Commands) {
         const auto cmd = Read<LoadCommand>(binary, offset).Cmd;
-        if (cmd == kLcDyldChainedFixups) fixups = Read<LinkeditDataCommand>(binary, offset);
+        if (cmd == kLcDyldChainedFixups) {
+            fixups = Read<LinkeditDataCommand>(binary, offset);
+            commandOffset = offset;
+        }
+        if (options.executable && cmd == kLcCodeSignature) throw std::runtime_error("remove the Mach-O code signature before patching and sign again afterwards");
         if ((cmd == kLcDyldInfo || cmd == kLcDyldInfoOnly)) {
             const auto info = Read<DyldInfoCommand>(binary, offset);
             if (info.BindSize != 0 || info.LazyBindSize != 0 || info.WeakBindSize != 0) throw std::runtime_error("Mach-O bind opcodes are not supported; link with chained fixups");
@@ -400,61 +428,72 @@ void PatchChainedImports(std::vector<std::uint8_t>& binary, const Image& image)
             imports.push_back({raw >> 9, raw & 0xff});
         }
     }
-    std::set<std::uint32_t> nameOffsets;
-    for (const auto& item : imports) nameOffsets.insert(item.NameOffset);
-    std::set<std::uint32_t> rewritten;
+    std::vector<std::string> names;
+    std::vector<std::string> originalNames;
+    std::vector<bool> selected;
     for (const auto& item : imports) {
-        const bool special = header.ImportsFormat == kImportFormatAddend64 ? item.Ordinal >= 0xfff0 : item.Ordinal >= 0xf0;
-        if (item.Ordinal == 0 || special || item.Ordinal > prx.size() || !prx[item.Ordinal - 1]) continue;
-        if (rewritten.contains(item.NameOffset)) continue;
         const auto at = symbols + item.NameOffset;
         if (at >= symbolsEnd) throw std::runtime_error("chained import name out of bounds");
         const auto name = Internal::ReadCStr(binary, at);
         if (at + name.size() >= symbolsEnd) throw std::runtime_error("unterminated chained import name");
         const auto bare = StripUnderscore(name);
-        if (bare == name || !IsGuestFacingImport(bare)) continue;
-        const auto patched = "_" + ResolveOneName(bare);
-        if (patched.size() > name.size()) throw std::runtime_error("import NID longer than original name: " + name);
-        const auto inside = nameOffsets.upper_bound(item.NameOffset);
-        if (inside != nameOffsets.end() && *inside <= item.NameOffset + name.size()) throw std::runtime_error("chained import names share storage: " + name);
-        std::memcpy(binary.data() + at, patched.data(), patched.size());
-        std::fill(binary.begin() + static_cast<std::ptrdiff_t>(at + patched.size()), binary.begin() + static_cast<std::ptrdiff_t>(at + name.size() + 1), 0);
-        rewritten.insert(item.NameOffset);
+        const bool special = header.ImportsFormat == kImportFormatAddend64 ? item.Ordinal >= 0xfff0 : item.Ordinal >= 0xf0;
+        const bool eligible = options.executable || (bare != name && item.Ordinal != 0 && !special && item.Ordinal <= prx.size() && prx[item.Ordinal - 1]);
+        originalNames.push_back(name);
+        selected.push_back(eligible);
+        if (eligible) names.push_back(bare);
     }
-}
-
-void WriteTrie(std::vector<std::uint8_t>& binary, const Image& image, const TrieLocation& location, const std::vector<std::uint8_t>& trie) {
-    const auto oldOffset = Read<std::uint32_t>(binary, location.OffsetField);
-    const auto oldSize = Read<std::uint32_t>(binary, location.SizeField);
-    if (trie.size() <= oldSize) {
-        std::copy(trie.begin(), trie.end(), binary.begin() + oldOffset);
-        std::fill(binary.begin() + oldOffset + static_cast<std::ptrdiff_t>(trie.size()), binary.begin() + oldOffset + oldSize, 0);
-        Write(binary, location.SizeField, static_cast<std::uint32_t>(trie.size()));
+    const auto mapping = ResolveImportNids(names, excluded, options);
+    if (!options.executable) {
+        std::set<std::uint32_t> nameOffsets;
+        for (const auto& item : imports) nameOffsets.insert(item.NameOffset);
+        std::set<std::uint32_t> rewritten;
+        for (const auto& item : imports) {
+            const bool special = header.ImportsFormat == kImportFormatAddend64 ? item.Ordinal >= 0xfff0 : item.Ordinal >= 0xf0;
+            if (item.Ordinal == 0 || special || item.Ordinal > prx.size() || !prx[item.Ordinal - 1]) continue;
+            if (rewritten.contains(item.NameOffset)) continue;
+            const auto at = symbols + item.NameOffset;
+            if (at >= symbolsEnd) throw std::runtime_error("chained import name out of bounds");
+            const auto name = Internal::ReadCStr(binary, at);
+            if (at + name.size() >= symbolsEnd) throw std::runtime_error("unterminated chained import name");
+            const auto bare = StripUnderscore(name);
+            if (bare == name) continue;
+            const auto patched = "_" + mapping.at(bare);
+            if (patched.size() > name.size()) throw std::runtime_error("import NID longer than original name: " + name);
+            const auto inside = nameOffsets.upper_bound(item.NameOffset);
+            if (inside != nameOffsets.end() && *inside <= item.NameOffset + name.size()) throw std::runtime_error("chained import names share storage: " + name);
+            std::memcpy(binary.data() + at, patched.data(), patched.size());
+            std::fill(binary.begin() + static_cast<std::ptrdiff_t>(at + patched.size()), binary.begin() + static_cast<std::ptrdiff_t>(at + name.size() + 1), 0);
+            rewritten.insert(item.NameOffset);
+        }
         return;
     }
-    std::optional<std::size_t> linkedit;
-    for (const auto offset : image.Commands) {
-        const auto cmd = Read<LoadCommand>(binary, offset).Cmd;
-        if (cmd == kLcCodeSignature) throw std::runtime_error("signed Mach-O images cannot grow their export trie");
-        if (cmd != kLcSegment64) continue;
-        const auto segment = Read<SegmentCommand64>(binary, offset);
-        if (std::strncmp(segment.Name, "__LINKEDIT", sizeof(segment.Name)) == 0) linkedit = offset;
+    if (imports.empty()) return;
+    std::vector<std::uint8_t> data(binary.begin() + base, binary.begin() + symbolsEnd);
+    const auto newSymbols = data.size();
+    if (newSymbols > 0xffffffffu) throw std::runtime_error("chained symbol offset overflow");
+    Write(data, offsetof(ChainedFixupsHeader, SymbolsOffset), static_cast<std::uint32_t>(newSymbols));
+    for (std::size_t index = 0; index < imports.size(); ++index) {
+        const auto& original = originalNames[index];
+        const auto name = selected[index] ? (original.starts_with("_") ? "_" : "") + mapping.at(StripUnderscore(original)) : original;
+        const auto offset = data.size() - newSymbols;
+        const auto at = header.ImportsOffset + index * entrySize;
+        if (header.ImportsFormat == kImportFormatAddend64) {
+            if (offset > 0xffffffffu) throw std::runtime_error("chained symbol offset overflow");
+            const auto raw = Read<std::uint64_t>(data, at);
+            Write(data, at, (raw & 0xffffffffu) | (std::uint64_t{offset} << 32));
+        } else {
+            if (offset > 0x7fffffu) throw std::runtime_error("chained symbol offset overflow");
+            const auto raw = Read<std::uint32_t>(data, at);
+            Write(data, at, (raw & 0x1ffu) | (static_cast<std::uint32_t>(offset) << 9));
+        }
+        data.insert(data.end(), name.begin(), name.end());
+        data.push_back(0);
     }
-    if (!linkedit) throw std::runtime_error("Mach-O image has no __LINKEDIT segment");
-    auto segment = Read<SegmentCommand64>(binary, *linkedit);
-    if (segment.FileOffset + segment.FileSize != binary.size()) throw std::runtime_error("__LINKEDIT does not end the file");
-    const auto newOffset = (binary.size() + 7) & ~std::size_t{7};
-    if (newOffset + trie.size() > 0xffffffffu) throw std::runtime_error("export trie offset overflow");
-    binary.resize(newOffset, 0);
-    binary.insert(binary.end(), trie.begin(), trie.end());
-    std::fill(binary.begin() + oldOffset, binary.begin() + oldOffset + oldSize, 0);
-    segment.FileSize = binary.size() - segment.FileOffset;
-    segment.VmSize = std::max(segment.VmSize, (segment.FileSize + kPageSize - 1) & ~(kPageSize - 1));
-    Write(binary, *linkedit, segment);
-    Write(binary, location.OffsetField, static_cast<std::uint32_t>(newOffset));
-    Write(binary, location.SizeField, static_cast<std::uint32_t>(trie.size()));
+    WriteLinkeditData(binary, image, {commandOffset + 8, commandOffset + 12}, data);
 }
 
+
 }
 
 std::vector<MachOExport> ReadMachOExports(const std::vector<std::uint8_t>& binary) {
@@ -464,8 +503,12 @@ std::vector<MachOExport> ReadMachOExports(const std::vector<std::uint8_t>& binar
     return ParseTrie(binary, Read<std::uint32_t>(binary, location->OffsetField), Read<std::uint32_t>(binary, location->SizeField));
 }
 
-void MachONidPatcher::PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) const {
+void MachONidPatcher::PatchNids(std::vector<std::uint8_t>& binary, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports, const PatchOptions& options) const {
     const auto image = ParseImage(binary);
+    if (options.executable) {
+        PatchChainedImports(binary, image, excludedExports, options);
+        return;
+    }
     const auto location = FindTrie(binary, image);
     if (!location) throw std::runtime_error("no export trie");
     auto exports = ParseTrie(binary, Read<std::uint32_t>(binary, location->OffsetField), Read<std::uint32_t>(binary, location->SizeField));
@@ -486,8 +529,8 @@ void MachONidPatcher::PatchNids(std::vector<std::uint8_t>& binary, const std::st
         if (found == nidMap.end()) throw std::runtime_error("symbol not in nid map: " + name);
         exports[index].Name = "_" + found->second;
     }
-    WriteTrie(binary, image, *location, TrieBuilder(exports).Build());
-    PatchChainedImports(binary, ParseImage(binary));
+    WriteLinkeditData(binary, image, *location, TrieBuilder(exports).Build());
+    PatchChainedImports(binary, ParseImage(binary), excludedExports, options);
 }
 
 }
diff --git a/core/libs/nid/src/NidResolver.cpp b/core/libs/nid/src/NidResolver.cpp
index 200565a6a7..aefa72ee8c 100644
--- a/core/libs/nid/src/NidResolver.cpp
+++ b/core/libs/nid/src/NidResolver.cpp
@@ -3,21 +3,32 @@
 #include <nid/NidCompute.hpp>
 #include <nid/NidPatcherUtils.hpp>
 #include <cstdint>
+#include <cctype>
 #include <stdexcept>
 #include <unordered_set>
 #include <vector>
 
 namespace Nid {
 
+bool IsSceImport(const std::string& name) {
+    return name.ends_with(Internal::kNidPostfix) || (name.size() >= 3 &&
+        std::tolower(static_cast<unsigned char>(name[0])) == 's' &&
+        std::tolower(static_cast<unsigned char>(name[1])) == 'c' &&
+        std::tolower(static_cast<unsigned char>(name[2])) == 'e');
+}
+
+std::unordered_map<std::string, std::string> ResolveImportNids(const std::vector<std::string>& names, const std::unordered_set<std::string>& excluded, const PatchOptions& options) {
+    const std::unordered_set<std::string> unique(names.begin(), names.end());
+    auto result = ResolveNids(std::vector<std::string>(unique.begin(), unique.end()), "", excluded);
+    for (const auto& name : unique) {
+        if ((!options.executable || options.onlySce) && !IsSceImport(name)) result.at(name) = name;
+        else if (!options.executable) result.at(name) = ResolveOneName(name);
+    }
+    return result;
+}
+
 std::string ResolveOneName(const std::string& funcName) {
-    using namespace Internal;
-
-    if (IsNidNoPatchCut(funcName))
-        return StripNidNoPatchCut(funcName);
-    if (IsNidNoPatch(funcName))
-        return funcName;
-
-    return ComputeNid(StripNidPostfix(funcName), "");
+    return ResolveNids({funcName}, "", {}).at(funcName);
 }
 
 std::unordered_map<std::string, std::string> ResolveNids(const std::vector<std::string>& exportedNames, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) {
diff --git a/core/libs/nid/src/PeNidPatcher.cpp b/core/libs/nid/src/PeNidPatcher.cpp
index 58fb8ade0a..638f3bb29e 100644
--- a/core/libs/nid/src/PeNidPatcher.cpp
+++ b/core/libs/nid/src/PeNidPatcher.cpp
@@ -36,7 +36,7 @@ std::size_t RvaToOffset(const std::vector<std::uint8_t>& pe, std::uint32_t rva,
 
 }
 
-void PeNidPatcher::PatchNids(std::vector<std::uint8_t>& pe, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports) const {
+void PeNidPatcher::PatchNids(std::vector<std::uint8_t>& pe, const std::string& libraryName, const std::unordered_set<std::string>& excludedExports, const PatchOptions& options) const {
     using namespace Internal;
 
     if (pe.size() < 0x40) throw std::runtime_error("file too small");
@@ -54,7 +54,7 @@ void PeNidPatcher::PatchNids(std::vector<std::uint8_t>& pe, const std::string& l
     const std::size_t sectionTableOffset = coffHeaderOffset + 20u + sizeOfOptionalHeader;
     const auto symbolTable = Read<std::uint32_t>(pe, coffHeaderOffset + 8u);
     const auto symbolCount = Read<std::uint32_t>(pe, coffHeaderOffset + 12u);
-    for (std::uint16_t i = 0; i < numberOfSections; ++i) {
+    for (std::uint16_t i = 0; !options.executable && i < numberOfSections; ++i) {
         const auto offset = sectionTableOffset + i * sizeof(PeSectionHeader);
         auto section = Read<PeSectionHeader>(pe, offset);
         if (pe[offset] != '/' || !symbolTable) continue;
@@ -79,159 +79,162 @@ void PeNidPatcher::PatchNids(std::vector<std::uint8_t>& pe, const std::string& l
         throw std::runtime_error("unsupported optional header magic");
     }
 
-    const auto exportDir = Read<PeDataDirectory>(pe, dataDirectoryOffset);
-    if (exportDir.VirtualAddress == 0u) throw std::runtime_error("no export directory");
+    if (!options.executable) {
+        const auto exportDir = Read<PeDataDirectory>(pe, dataDirectoryOffset);
+        if (exportDir.VirtualAddress == 0u) throw std::runtime_error("no export directory");
 
-    const std::size_t exportDirOffset = RvaToOffset(pe, exportDir.VirtualAddress, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
-    const auto exportTable = Read<PeExportDirectory>(pe, exportDirOffset);
+        const std::size_t exportDirOffset = RvaToOffset(pe, exportDir.VirtualAddress, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+        const auto exportTable = Read<PeExportDirectory>(pe, exportDirOffset);
 
-    if (exportTable.NumberOfNames == 0u) throw std::runtime_error("no exported names");
+        if (exportTable.NumberOfNames == 0u) throw std::runtime_error("no exported names");
 
-    const std::size_t namesArrayOffset = RvaToOffset(pe, exportTable.AddressOfNames, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
-    const std::size_t ordinalsArrayOffset = RvaToOffset(pe, exportTable.AddressOfNameOrdinals, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+        const std::size_t namesArrayOffset = RvaToOffset(pe, exportTable.AddressOfNames, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+        const std::size_t ordinalsArrayOffset = RvaToOffset(pe, exportTable.AddressOfNameOrdinals, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
 
-    std::vector<std::uint32_t> nameRvas(exportTable.NumberOfNames);
-    std::vector<std::string> names(exportTable.NumberOfNames);
-    for (std::uint32_t i = 0u; i < exportTable.NumberOfNames; ++i) {
-        const auto nameRva = Read<std::uint32_t>(pe, namesArrayOffset + i * 4u);
-        const std::size_t nameOffset = RvaToOffset(pe, nameRva, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
-        const std::string name = ReadCStr(pe, nameOffset);
-        if (name.empty()) throw std::runtime_error("empty exported name");
-        nameRvas[i] = nameRva;
-        names[i] = name;
-    }
-
-    const auto nidMap = ResolveNids(names, libraryName, excludedExports);
-
-    const std::size_t edataSectionOffset = FindSectionOffsetByRva(pe, exportDir.VirtualAddress, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
-    const auto edataSection = Read<PeSectionHeader>(pe, edataSectionOffset);
-
-    const auto fileAlignment = Read<std::uint32_t>(pe, optionalHeaderOffset + 36u);
-    if (fileAlignment == 0u) throw std::runtime_error("invalid file alignment");
-
-    std::uint32_t stringsRegionStart = std::numeric_limits<std::uint32_t>::max();
-    for (std::uint32_t i = 0u; i < exportTable.NumberOfNames; ++i) {
-        const std::uint32_t rvaFromSection = nameRvas[i] - edataSection.VirtualAddress;
-        if (rvaFromSection < stringsRegionStart) stringsRegionStart = rvaFromSection;
-    }
-    if (stringsRegionStart == std::numeric_limits<std::uint32_t>::max())
-        throw std::runtime_error("could not determine strings region start");
-
-    std::uint32_t rawLimit = ((edataSection.SizeOfRawData + fileAlignment - 1u) / fileAlignment) * fileAlignment;
-    const auto dllName = ReadCStr(pe, RvaToOffset(pe, exportTable.Name, peHeaderOffset, numberOfSections, sizeOfOptionalHeader));
-    const bool repackDllName = exportTable.Name >= edataSection.VirtualAddress &&
-        exportTable.Name - edataSection.VirtualAddress < rawLimit;
-    if (repackDllName) stringsRegionStart = std::min(stringsRegionStart, exportTable.Name - edataSection.VirtualAddress);
-    struct Forwarder {
-        std::size_t EntryOffset;
-        std::string Target;
-    };
-    std::vector<Forwarder> forwarders;
-    std::vector<std::uint32_t> directRvas;
-    const auto functionsArrayOffset = RvaToOffset(pe, exportTable.AddressOfFunctions, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
-    for (std::uint32_t index = 0u; index < exportTable.NumberOfFunctions; ++index) {
-        const auto entryOffset = functionsArrayOffset + index * sizeof(std::uint32_t);
-        const auto rva = Read<std::uint32_t>(pe, entryOffset);
-        if (rva < exportDir.VirtualAddress || std::uint64_t{rva} - exportDir.VirtualAddress >= exportDir.Size) {
-            directRvas.push_back(rva);
-            continue;
+        std::vector<std::uint32_t> nameRvas(exportTable.NumberOfNames);
+        std::vector<std::string> names(exportTable.NumberOfNames);
+        for (std::uint32_t i = 0u; i < exportTable.NumberOfNames; ++i) {
+            const auto nameRva = Read<std::uint32_t>(pe, namesArrayOffset + i * 4u);
+            const std::size_t nameOffset = RvaToOffset(pe, nameRva, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+            const std::string name = ReadCStr(pe, nameOffset);
+            if (name.empty()) throw std::runtime_error("empty exported name");
+            nameRvas[i] = nameRva;
+            names[i] = name;
         }
-        const auto target = ReadCStr(pe, RvaToOffset(pe, rva, peHeaderOffset, numberOfSections, sizeOfOptionalHeader));
-        if (target.size() + 1u > exportDir.Size - (rva - exportDir.VirtualAddress))
-            throw std::runtime_error("forwarder string outside export directory");
-        forwarders.push_back({entryOffset, target});
-        stringsRegionStart = std::min(stringsRegionStart, rva - edataSection.VirtualAddress);
-    }
-    for (const auto rva : directRvas) {
-        if (rva >= edataSection.VirtualAddress && rva - edataSection.VirtualAddress >= stringsRegionStart)
-            rawLimit = std::min(rawLimit, rva - edataSection.VirtualAddress);
-    }
-    const auto reserveTable = [&](std::uint32_t rva, std::uint64_t size) {
-        if (rva < edataSection.VirtualAddress || rva - edataSection.VirtualAddress >= rawLimit) return;
-        const auto end = std::uint64_t{rva - edataSection.VirtualAddress} + size;
-        if (end > rawLimit) throw std::runtime_error("export table outside edata section");
-        stringsRegionStart = std::max(stringsRegionStart, static_cast<std::uint32_t>(end));
-    };
-    reserveTable(exportDir.VirtualAddress, sizeof(PeExportDirectory));
-    reserveTable(exportTable.AddressOfFunctions, std::uint64_t{exportTable.NumberOfFunctions} * 4u);
-    reserveTable(exportTable.AddressOfNames, std::uint64_t{exportTable.NumberOfNames} * 4u);
-    reserveTable(exportTable.AddressOfNameOrdinals, std::uint64_t{exportTable.NumberOfNames} * 2u);
 
-    std::vector<std::string> finalNames(exportTable.NumberOfNames);
-    for (std::uint32_t i = 0u; i < exportTable.NumberOfNames; ++i) {
-        const auto it = nidMap.find(names[i]);
-        if (it == nidMap.end()) throw std::runtime_error("symbol not in nid map: " + names[i]);
-        finalNames[i] = it->second;
-    }
+        const auto nidMap = ResolveNids(names, libraryName, excludedExports);
 
-    std::vector<std::uint8_t> strings;
-    std::unordered_map<std::string, std::uint32_t> stringRvas;
-    const auto storeString = [&](const std::string& name) {
-        const auto existing = stringRvas.find(name);
-        if (existing != stringRvas.end()) return existing->second;
-        const auto rva = edataSection.VirtualAddress + stringsRegionStart + static_cast<std::uint32_t>(strings.size());
-        stringRvas.emplace(name, rva);
-        strings.insert(strings.end(), name.begin(), name.end());
-        strings.push_back(0u);
-        return rva;
-    };
-    std::vector<std::uint32_t> forwarderRvas;
-    for (const auto& forwarder : forwarders) forwarderRvas.push_back(storeString(forwarder.Target));
-    if (!forwarders.empty() && (std::uint64_t{edataSection.VirtualAddress} + stringsRegionStart < exportDir.VirtualAddress ||
-        std::uint64_t{edataSection.VirtualAddress} + stringsRegionStart + strings.size() > std::uint64_t{exportDir.VirtualAddress} + exportDir.Size))
-        throw std::runtime_error("not enough export directory space to repack forwarders");
-    const auto dllNameRva = repackDllName ? storeString(dllName) : exportTable.Name;
-    std::vector<std::uint32_t> finalNameRvas;
-    for (const auto& name : finalNames) finalNameRvas.push_back(storeString(name));
-    const auto requiredSize = std::uint64_t{stringsRegionStart} + strings.size();
-    if (requiredSize > rawLimit)
-        throw std::runtime_error("not enough raw space in edata section to repack export names");
-    const auto directoryEnd = std::max(std::uint64_t{exportDir.VirtualAddress} + exportDir.Size,
-        std::uint64_t{edataSection.VirtualAddress} + requiredSize);
-    for (const auto rva : directRvas) {
-        if (rva != 0u && rva >= exportDir.VirtualAddress && std::uint64_t{rva} < directoryEnd)
-            throw std::runtime_error("repacked export directory would cover a direct export");
-    }
-    const auto directorySize = directoryEnd - exportDir.VirtualAddress;
-    if (directorySize > std::numeric_limits<std::uint32_t>::max()) throw std::runtime_error("export directory too large");
-    const auto stringFileOffset = static_cast<std::size_t>(edataSection.PointerToRawData) + stringsRegionStart;
-    if (stringFileOffset > pe.size() || strings.size() > pe.size() - stringFileOffset)
-        throw std::runtime_error("repack write out of file bounds");
-    std::memcpy(pe.data() + stringFileOffset, strings.data(), strings.size());
-    for (std::size_t index = 0u; index < finalNameRvas.size(); ++index)
-        Write(pe, namesArrayOffset + index * 4u, finalNameRvas[index]);
-    for (std::size_t index = 0u; index < forwarders.size(); ++index)
-        Write(pe, forwarders[index].EntryOffset, forwarderRvas[index]);
-    Write(pe, exportDirOffset + offsetof(PeExportDirectory, Name), dllNameRva);
-    Write(pe, dataDirectoryOffset + offsetof(PeDataDirectory, Size), static_cast<std::uint32_t>(directorySize));
+        const std::size_t edataSectionOffset = FindSectionOffsetByRva(pe, exportDir.VirtualAddress, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+        const auto edataSection = Read<PeSectionHeader>(pe, edataSectionOffset);
 
-    const std::uint32_t newVirtualSize = std::max(edataSection.VirtualSize, static_cast<std::uint32_t>(requiredSize));
-    auto patchedSection = edataSection;
-    patchedSection.VirtualSize = newVirtualSize;
-    Write(pe, edataSectionOffset, patchedSection);
+        const auto fileAlignment = Read<std::uint32_t>(pe, optionalHeaderOffset + 36u);
+        if (fileAlignment == 0u) throw std::runtime_error("invalid file alignment");
 
-    struct ExportName {
-        std::string Name;
-        std::uint32_t Rva;
-        std::uint16_t Ordinal;
-    };
+        std::uint32_t stringsRegionStart = std::numeric_limits<std::uint32_t>::max();
+        for (std::uint32_t i = 0u; i < exportTable.NumberOfNames; ++i) {
+            const std::uint32_t rvaFromSection = nameRvas[i] - edataSection.VirtualAddress;
+            if (rvaFromSection < stringsRegionStart) stringsRegionStart = rvaFromSection;
+        }
+        if (stringsRegionStart == std::numeric_limits<std::uint32_t>::max())
+            throw std::runtime_error("could not determine strings region start");
+
+        std::uint32_t rawLimit = ((edataSection.SizeOfRawData + fileAlignment - 1u) / fileAlignment) * fileAlignment;
+        const auto dllName = ReadCStr(pe, RvaToOffset(pe, exportTable.Name, peHeaderOffset, numberOfSections, sizeOfOptionalHeader));
+        const bool repackDllName = exportTable.Name >= edataSection.VirtualAddress &&
+            exportTable.Name - edataSection.VirtualAddress < rawLimit;
+        if (repackDllName) stringsRegionStart = std::min(stringsRegionStart, exportTable.Name - edataSection.VirtualAddress);
+        struct Forwarder {
+            std::size_t EntryOffset;
+            std::string Target;
+        };
+        std::vector<Forwarder> forwarders;
+        std::vector<std::uint32_t> directRvas;
+        const auto functionsArrayOffset = RvaToOffset(pe, exportTable.AddressOfFunctions, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+        for (std::uint32_t index = 0u; index < exportTable.NumberOfFunctions; ++index) {
+            const auto entryOffset = functionsArrayOffset + index * sizeof(std::uint32_t);
+            const auto rva = Read<std::uint32_t>(pe, entryOffset);
+            if (rva < exportDir.VirtualAddress || std::uint64_t{rva} - exportDir.VirtualAddress >= exportDir.Size) {
+                directRvas.push_back(rva);
+                continue;
+            }
+            const auto target = ReadCStr(pe, RvaToOffset(pe, rva, peHeaderOffset, numberOfSections, sizeOfOptionalHeader));
+            if (target.size() + 1u > exportDir.Size - (rva - exportDir.VirtualAddress))
+                throw std::runtime_error("forwarder string outside export directory");
+            forwarders.push_back({entryOffset, target});
+            stringsRegionStart = std::min(stringsRegionStart, rva - edataSection.VirtualAddress);
+        }
+        for (const auto rva : directRvas) {
+            if (rva >= edataSection.VirtualAddress && rva - edataSection.VirtualAddress >= stringsRegionStart)
+                rawLimit = std::min(rawLimit, rva - edataSection.VirtualAddress);
+        }
+        const auto reserveTable = [&](std::uint32_t rva, std::uint64_t size) {
+            if (rva < edataSection.VirtualAddress || rva - edataSection.VirtualAddress >= rawLimit) return;
+            const auto end = std::uint64_t{rva - edataSection.VirtualAddress} + size;
+            if (end > rawLimit) throw std::runtime_error("export table outside edata section");
+            stringsRegionStart = std::max(stringsRegionStart, static_cast<std::uint32_t>(end));
+        };
+        reserveTable(exportDir.VirtualAddress, sizeof(PeExportDirectory));
+        reserveTable(exportTable.AddressOfFunctions, std::uint64_t{exportTable.NumberOfFunctions} * 4u);
+        reserveTable(exportTable.AddressOfNames, std::uint64_t{exportTable.NumberOfNames} * 4u);
+        reserveTable(exportTable.AddressOfNameOrdinals, std::uint64_t{exportTable.NumberOfNames} * 2u);
+
+        std::vector<std::string> finalNames(exportTable.NumberOfNames);
+        for (std::uint32_t i = 0u; i < exportTable.NumberOfNames; ++i) {
+            const auto it = nidMap.find(names[i]);
+            if (it == nidMap.end()) throw std::runtime_error("symbol not in nid map: " + names[i]);
+            finalNames[i] = it->second;
+        }
+
+        std::vector<std::uint8_t> strings;
+        std::unordered_map<std::string, std::uint32_t> stringRvas;
+        const auto storeString = [&](const std::string& name) {
+            const auto existing = stringRvas.find(name);
+            if (existing != stringRvas.end()) return existing->second;
+            const auto rva = edataSection.VirtualAddress + stringsRegionStart + static_cast<std::uint32_t>(strings.size());
+            stringRvas.emplace(name, rva);
+            strings.insert(strings.end(), name.begin(), name.end());
+            strings.push_back(0u);
+            return rva;
+        };
+        std::vector<std::uint32_t> forwarderRvas;
+        for (const auto& forwarder : forwarders) forwarderRvas.push_back(storeString(forwarder.Target));
+        if (!forwarders.empty() && (std::uint64_t{edataSection.VirtualAddress} + stringsRegionStart < exportDir.VirtualAddress ||
+            std::uint64_t{edataSection.VirtualAddress} + stringsRegionStart + strings.size() > std::uint64_t{exportDir.VirtualAddress} + exportDir.Size))
+            throw std::runtime_error("not enough export directory space to repack forwarders");
+        const auto dllNameRva = repackDllName ? storeString(dllName) : exportTable.Name;
+        std::vector<std::uint32_t> finalNameRvas;
+        for (const auto& name : finalNames) finalNameRvas.push_back(storeString(name));
+        const auto requiredSize = std::uint64_t{stringsRegionStart} + strings.size();
+        if (requiredSize > rawLimit)
+            throw std::runtime_error("not enough raw space in edata section to repack export names");
+        const auto directoryEnd = std::max(std::uint64_t{exportDir.VirtualAddress} + exportDir.Size,
+            std::uint64_t{edataSection.VirtualAddress} + requiredSize);
+        for (const auto rva : directRvas) {
+            if (rva != 0u && rva >= exportDir.VirtualAddress && std::uint64_t{rva} < directoryEnd)
+                throw std::runtime_error("repacked export directory would cover a direct export");
+        }
+        const auto directorySize = directoryEnd - exportDir.VirtualAddress;
+        if (directorySize > std::numeric_limits<std::uint32_t>::max()) throw std::runtime_error("export directory too large");
+        const auto stringFileOffset = static_cast<std::size_t>(edataSection.PointerToRawData) + stringsRegionStart;
+        if (stringFileOffset > pe.size() || strings.size() > pe.size() - stringFileOffset)
+            throw std::runtime_error("repack write out of file bounds");
+        std::memcpy(pe.data() + stringFileOffset, strings.data(), strings.size());
+        for (std::size_t index = 0u; index < finalNameRvas.size(); ++index)
+            Write(pe, namesArrayOffset + index * 4u, finalNameRvas[index]);
+        for (std::size_t index = 0u; index < forwarders.size(); ++index)
+            Write(pe, forwarders[index].EntryOffset, forwarderRvas[index]);
+        Write(pe, exportDirOffset + offsetof(PeExportDirectory, Name), dllNameRva);
+        Write(pe, dataDirectoryOffset + offsetof(PeDataDirectory, Size), static_cast<std::uint32_t>(directorySize));
+
+        const std::uint32_t newVirtualSize = std::max(edataSection.VirtualSize, static_cast<std::uint32_t>(requiredSize));
+        auto patchedSection = edataSection;
+        patchedSection.VirtualSize = newVirtualSize;
+        Write(pe, edataSectionOffset, patchedSection);
+
+        struct ExportName {
+            std::string Name;
+            std::uint32_t Rva;
+            std::uint16_t Ordinal;
+        };
+
+        std::vector<ExportName> exportNames;
+        exportNames.reserve(exportTable.NumberOfNames);
+        for (std::size_t i = 0; i < exportTable.NumberOfNames; ++i) {
+            const auto nameRva = Read<std::uint32_t>(pe, namesArrayOffset + i * sizeof(std::uint32_t));
+            const auto ordinal = Read<std::uint16_t>(pe, ordinalsArrayOffset + i * sizeof(std::uint16_t));
+            if (ordinal >= exportTable.NumberOfFunctions)
+                throw std::runtime_error("export name ordinal out of bounds");
+            const auto nameOffset = RvaToOffset(pe, nameRva, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+            exportNames.push_back({ReadCStr(pe, nameOffset), nameRva, ordinal});
+        }
+        std::sort(exportNames.begin(), exportNames.end(), [](const ExportName& left, const ExportName& right) { return left.Name < right.Name; });
+        for (std::size_t i = 0; i < exportNames.size(); ++i) {
+            if (i != 0 && exportNames[i - 1].Name == exportNames[i].Name)
+                throw std::runtime_error("duplicate patched export name: " + exportNames[i].Name);
+            Write(pe, namesArrayOffset + i * sizeof(std::uint32_t), exportNames[i].Rva);
+            Write(pe, ordinalsArrayOffset + i * sizeof(std::uint16_t), exportNames[i].Ordinal);
+        }
 
-    std::vector<ExportName> exportNames;
-    exportNames.reserve(exportTable.NumberOfNames);
-    for (std::size_t i = 0; i < exportTable.NumberOfNames; ++i) {
-        const auto nameRva = Read<std::uint32_t>(pe, namesArrayOffset + i * sizeof(std::uint32_t));
-        const auto ordinal = Read<std::uint16_t>(pe, ordinalsArrayOffset + i * sizeof(std::uint16_t));
-        if (ordinal >= exportTable.NumberOfFunctions)
-            throw std::runtime_error("export name ordinal out of bounds");
-        const auto nameOffset = RvaToOffset(pe, nameRva, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
-        exportNames.push_back({ReadCStr(pe, nameOffset), nameRva, ordinal});
-    }
-    std::sort(exportNames.begin(), exportNames.end(), [](const ExportName& left, const ExportName& right) { return left.Name < right.Name; });
-    for (std::size_t i = 0; i < exportNames.size(); ++i) {
-        if (i != 0 && exportNames[i - 1].Name == exportNames[i].Name)
-            throw std::runtime_error("duplicate patched export name: " + exportNames[i].Name);
-        Write(pe, namesArrayOffset + i * sizeof(std::uint32_t), exportNames[i].Rva);
-        Write(pe, ordinalsArrayOffset + i * sizeof(std::uint16_t), exportNames[i].Ordinal);
     }
 
     constexpr std::size_t kImportDirIndex = 1u;
@@ -250,6 +253,20 @@ void PeNidPatcher::PatchNids(std::vector<std::uint8_t>& pe, const std::string& l
         std::uint32_t FirstThunk;
     };
 
+    if (options.executable) {
+        for (const auto index : {4u, 11u, 13u}) {
+            const auto directory = Read<PeDataDirectory>(pe, dataDirectoryOffset + index * sizeof(PeDataDirectory));
+            if (directory.VirtualAddress || directory.Size) throw std::runtime_error("signed, bound or delay-loaded PE imports are not supported in --exec mode");
+        }
+    }
+    struct ImportUse {
+        std::size_t NameOffset;
+        std::size_t LookupOffset;
+        std::size_t AddressOffset;
+        std::string Name;
+    };
+    std::vector<ImportUse> imports;
+    std::vector<std::string> importNames;
     std::size_t importDescOffset = RvaToOffset(pe, importDir.VirtualAddress, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
 
     while (true) {
@@ -286,19 +303,9 @@ void PeNidPatcher::PatchNids(std::vector<std::uint8_t>& pe, const std::string& l
 
                 const std::string funcName = ReadCStr(pe, hintNameOffset + 2u);
                 if (!funcName.empty()) {
-                    const bool hasNidPostfix = funcName.size() >= kNidPostfixLen &&
-                        funcName.compare(funcName.size() - kNidPostfixLen, kNidPostfixLen, kNidPostfix) == 0;
-                    const bool hasScePrefix = funcName.size() >= 3u &&
-                        std::tolower(static_cast<unsigned char>(funcName[0])) == 's' &&
-                        std::tolower(static_cast<unsigned char>(funcName[1])) == 'c' &&
-                        std::tolower(static_cast<unsigned char>(funcName[2])) == 'e';
-                    if (hasNidPostfix || hasScePrefix) {
-                        const std::string nid = ResolveOneName(funcName);
-                        if (nid.size() > funcName.size())
-                            throw std::runtime_error("import NID longer than original name: " + funcName);
-                        std::memcpy(pe.data() + hintNameOffset + 2u, nid.data(), nid.size());
-                        pe[hintNameOffset + 2u + nid.size()] = 0u;
-                    }
+                    const auto addressOffset = RvaToOffset(pe, desc.FirstThunk, peHeaderOffset, numberOfSections, sizeOfOptionalHeader) + thunkOffset - RvaToOffset(pe, thunkRva, peHeaderOffset, numberOfSections, sizeOfOptionalHeader);
+                    imports.push_back({hintNameOffset + 2u, thunkOffset, addressOffset, funcName});
+                    importNames.push_back(funcName);
                 }
             }
 
@@ -307,6 +314,72 @@ void PeNidPatcher::PatchNids(std::vector<std::uint8_t>& pe, const std::string& l
 
         importDescOffset += sizeof(PeImportDescriptor);
     }
+    const auto importMap = ResolveImportNids(importNames, excludedExports, options);
+    if (!options.executable) {
+        for (const auto& item : imports) {
+            const auto& name = importMap.at(item.Name);
+            if (name.size() > item.Name.size()) throw std::runtime_error("import NID longer than original name: " + item.Name);
+            std::memcpy(pe.data() + item.NameOffset, name.c_str(), name.size() + 1);
+        }
+        return;
+    }
+    std::vector<std::uint8_t> strings;
+    std::unordered_map<std::string, std::uint32_t> stringOffsets;
+    for (const auto& item : imports) {
+        const auto& name = importMap.at(item.Name);
+        if (name == item.Name || stringOffsets.contains(name)) continue;
+        if (strings.size() & 1u) strings.push_back(0);
+        if (strings.size() > 0xffffffffu - name.size() - 3u) throw std::runtime_error("PE import string table overflow");
+        stringOffsets.emplace(name, static_cast<std::uint32_t>(strings.size()));
+        strings.insert(strings.end(), {0, 0});
+        strings.insert(strings.end(), name.begin(), name.end());
+        strings.push_back(0);
+    }
+    if (strings.empty()) return;
+    const auto fileAlignment = Read<std::uint32_t>(pe, optionalHeaderOffset + 36u);
+    const auto sectionAlignment = Read<std::uint32_t>(pe, optionalHeaderOffset + 32u);
+    const auto align = [](std::uint64_t value, std::uint32_t alignment) {
+        if (!alignment || (alignment & (alignment - 1u))) throw std::runtime_error("invalid PE alignment");
+        const auto result = (value + alignment - 1u) & ~std::uint64_t{alignment - 1u};
+        if (result > 0xffffffffu) throw std::runtime_error("PE section overflow");
+        return static_cast<std::uint32_t>(result);
+    };
+    const auto newHeader = sectionTableOffset + numberOfSections * sizeof(PeSectionHeader);
+    auto headerLimit = std::size_t{Read<std::uint32_t>(pe, optionalHeaderOffset + 60u)};
+    std::uint64_t virtualEnd = headerLimit;
+    for (std::uint16_t index = 0; index < numberOfSections; ++index) {
+        const auto section = Read<PeSectionHeader>(pe, sectionTableOffset + index * sizeof(PeSectionHeader));
+        if (section.PointerToRawData) headerLimit = std::min(headerLimit, std::size_t{section.PointerToRawData});
+        virtualEnd = std::max(virtualEnd, std::uint64_t{section.VirtualAddress} + std::max(section.VirtualSize, section.SizeOfRawData));
+    }
+    if (numberOfSections == 0xffffu || newHeader + sizeof(PeSectionHeader) > headerLimit || headerLimit > pe.size()) throw std::runtime_error("no room for PE import section header");
+    PeSectionHeader section{};
+    const char sectionName[] = ".nidimp";
+    std::memcpy(section.Name, sectionName, sizeof(sectionName));
+    section.VirtualSize = static_cast<std::uint32_t>(strings.size());
+    section.VirtualAddress = align(virtualEnd, sectionAlignment);
+    section.PointerToRawData = align(pe.size(), fileAlignment);
+    section.SizeOfRawData = align(strings.size(), fileAlignment);
+    section.Characteristics = 0x40000040u;
+    const auto imageSize = align(std::uint64_t{section.VirtualAddress} + section.VirtualSize, sectionAlignment);
+    const auto rawEnd = std::uint64_t{section.PointerToRawData} + section.SizeOfRawData;
+    if (rawEnd > 0xffffffffu) throw std::runtime_error("PE file size overflow");
+    pe.resize(static_cast<std::size_t>(rawEnd), 0);
+    std::copy(strings.begin(), strings.end(), pe.begin() + section.PointerToRawData);
+    Write(pe, newHeader, section);
+    Write(pe, coffHeaderOffset + 2u, static_cast<std::uint16_t>(numberOfSections + 1u));
+    Write(pe, optionalHeaderOffset + 56u, imageSize);
+    Write(pe, optionalHeaderOffset + 64u, std::uint32_t{0});
+    for (const auto& item : imports) {
+        const auto& name = importMap.at(item.Name);
+        if (name == item.Name) continue;
+        const auto rva = section.VirtualAddress + stringOffsets.at(name);
+        for (const auto offset : {item.LookupOffset, item.AddressOffset}) {
+            if (magic == 0x20bu) Write(pe, offset, std::uint64_t{rva});
+            else Write(pe, offset, rva);
+        }
+    }
+
 }
 
 }
diff --git a/core/libs/nid/src/main.cpp b/core/libs/nid/src/main.cpp
index 722c765e7c..776480fca6 100644
--- a/core/libs/nid/src/main.cpp
+++ b/core/libs/nid/src/main.cpp
@@ -28,6 +28,7 @@ void _writeFile(const std::string& path, const std::vector<std::uint8_t>& data)
 int Run(int argc, char* argv[]) {
     if (argc < 3) {
         std::cerr << "Usage: nid_patcher <library_name> [--preserve-exports <unpatched-library> | --preserve-export-list <export-list>] <file> [file2 ...]\n"
+                     "       nid_patcher --exec [--only-sce] [--preserve-exports <unpatched-library> | --preserve-export-list <export-list>] <file> [file2 ...]\n"
                      "       nid_patcher --write-export-list <unpatched-library> <export-list>\n";
         return 1;
     }
@@ -46,14 +47,20 @@ int Run(int argc, char* argv[]) {
         return 0;
     }
 
-    const std::string libraryName = argv[1];
+    Nid::PatchOptions options;
+    options.executable = std::string(argv[1]) == "--exec";
+    const std::string libraryName = options.executable ? "" : argv[1];
     std::unordered_set<std::string> excludedExports;
     std::vector<std::string> paths;
     try {
+        if (!options.executable && libraryName.starts_with("--")) throw std::runtime_error("unknown option: " + libraryName);
         bool hasReference = false;
         for (int i = 2; i < argc; ++i) {
             const std::string argument = argv[i];
-            if (argument == "--preserve-exports" || argument == "--preserve-export-list") {
+            if (argument == "--only-sce") {
+                if (!options.executable || options.onlySce) throw std::runtime_error("--only-sce requires --exec and may appear once");
+                options.onlySce = true;
+            } else if (argument == "--preserve-exports" || argument == "--preserve-export-list") {
                 if (hasReference || i + 1 == argc) throw std::runtime_error(argument + " requires exactly one reference");
                 hasReference = true;
                 excludedExports = argument == "--preserve-exports" ? Nid::ReadExportExclusions(argv[++i]) : Nid::ReadExportList(argv[++i]);
@@ -72,7 +79,7 @@ int Run(int argc, char* argv[]) {
         try {
             auto binary = _readFile(path);
             const auto patcher = Nid::MakePatcher(binary);
-            patcher->PatchNids(binary, libraryName, excludedExports);
+            patcher->PatchNids(binary, libraryName, excludedExports, options);
             _writeFile(path, binary);
             std::cout << "OK: " << path << "\n";
         } catch (const std::exception& e) {
diff --git a/core/libs/nid/tests/test_elf_duplicates.py b/core/libs/nid/tests/test_elf_duplicates.py
index 504cf33bdc..25f9853da1 100644
--- a/core/libs/nid/tests/test_elf_duplicates.py
+++ b/core/libs/nid/tests/test_elf_duplicates.py
@@ -4,7 +4,7 @@ import sys
 import unittest
 from pathlib import Path
 
-from test_symbol_versions import build_image, patch, read_dynsym, IMPORTS, NID_NAME, SHN_UNDEF, STT_FUNC
+from test_symbol_versions import build_image, patch, read_dynsym, IMPORTS, NID_NAME, SHN_UNDEF, STT_FUNC, PATCHER
 
 
 def nid(name):
@@ -21,6 +21,7 @@ def image(names, addresses=None):
     return bytes(build_image(entries, False))
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class ElfDuplicateTests(unittest.TestCase):
     def test_exports_patched_to_one_name_are_rejected(self):
         cases = (
@@ -65,5 +66,4 @@ class ElfDuplicateTests(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    PATCHER = Path(sys.argv.pop(1)).resolve()
     unittest.main()
diff --git a/core/libs/nid/tests/test_elf_layout.py b/core/libs/nid/tests/test_elf_layout.py
index 703ac46db3..d4060852f6 100644
--- a/core/libs/nid/tests/test_elf_layout.py
+++ b/core/libs/nid/tests/test_elf_layout.py
@@ -3,9 +3,10 @@ import sys
 import unittest
 from pathlib import Path
 
-from test_symbol_versions import build_image, symbols, patch, SHOFF
+from test_symbol_versions import build_image, symbols, patch, SHOFF, PATCHER
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class ElfLayoutTests(unittest.TestCase):
     def test_declared_layout_must_match_supported_tables(self):
         changes = ((5, "B", 2), (0x3a, "H", 32),
@@ -44,5 +45,4 @@ class ElfLayoutTests(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    PATCHER = Path(sys.argv.pop(1)).resolve()
     unittest.main()
diff --git a/core/libs/nid/tests/test_gnu_hash.py b/core/libs/nid/tests/test_gnu_hash.py
index 2e46a70f32..c1ddde43d4 100644
--- a/core/libs/nid/tests/test_gnu_hash.py
+++ b/core/libs/nid/tests/test_gnu_hash.py
@@ -3,7 +3,7 @@ import sys
 import unittest
 from pathlib import Path
 
-from test_symbol_versions import build_image, symbols, patch, HASH_OFFSET, SHOFF, read_dynsym, gnu_hash, sections
+from test_symbol_versions import build_image, symbols, patch, HASH_OFFSET, SHOFF, read_dynsym, gnu_hash, sections, PATCHER
 
 
 def sysv_hash(name):
@@ -31,6 +31,7 @@ def sysv_lookup(image, name):
     return None
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class GnuHashTests(unittest.TestCase):
     def image(self, buckets=4, bloom=1, shift=6, symoffset=3):
         image = build_image(symbols(False), False)
@@ -95,6 +96,7 @@ class GnuHashTests(unittest.TestCase):
         self.assertEqual(struct.unpack_from("<I", after, HASH_OFFSET)[0], 0)
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class SysvHashTests(unittest.TestCase):
     def image(self, both, buckets):
         entries = symbols(False)
@@ -153,5 +155,4 @@ class SysvHashTests(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    PATCHER = Path(sys.argv.pop(1)).resolve()
     unittest.main()
diff --git a/core/libs/nid/tests/test_macho_nids.py b/core/libs/nid/tests/test_macho_nids.py
index e49dc26e67..0b7e97df74 100644
--- a/core/libs/nid/tests/test_macho_nids.py
+++ b/core/libs/nid/tests/test_macho_nids.py
@@ -7,6 +7,7 @@ import subprocess
 import sys
 import tempfile
 from pathlib import Path
+from test_symbol_versions import find_patcher, PATCHER
 
 SUFFIX = bytes([0x51, 0x8D, 0x64, 0xA6, 0x35, 0xDE, 0xD8, 0xC1, 0xE6, 0xB0, 0x39, 0xB1, 0xC3, 0xE5, 0x52, 0x30])
 BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-"
@@ -262,7 +263,7 @@ def check_export_list(patcher, directory):
 def check_refusals(patcher, directory):
     growing = [("_ab", 0, 0x100), ("_cd", 0, 0x108)]
     result, _ = patch(patcher, directory, "signed.dylib", build_dylib(growing, [], signed=True))
-    assert result.returncode != 0 and "signed Mach-O images cannot grow their export trie" in result.stdout + result.stderr, (result.stdout, result.stderr)
+    assert result.returncode != 0 and "signed Mach-O images cannot grow linkedit data" in result.stdout + result.stderr, (result.stdout, result.stderr)
     result, _ = patch(patcher, directory, "opcodes.dylib", build_dylib([("_puts_nid_postfix", 0, 0x100)], [], bind_opcodes=True))
     assert result.returncode != 0 and "bind opcodes are not supported" in result.stdout + result.stderr, (result.stdout, result.stderr)
     result, _ = patch(patcher, directory, "long.dylib", build_dylib([("_puts_nid_postfix", 0, 0x100)], [("_sceXy", 1)]))
@@ -270,7 +271,13 @@ def check_refusals(patcher, directory):
 
 
 def main():
-    patcher = Path(sys.argv[1]).resolve()
+    if len(sys.argv) > 1:
+        patcher = Path(sys.argv[1]).resolve()
+    else:
+        patcher = PATCHER or find_patcher()
+        if patcher is None:
+            print("nid_patcher executable required")
+            sys.exit(0)
     with tempfile.TemporaryDirectory(prefix="anyps5-macho-nid-a\u00e7\u00e3o-\u65e5\u672c-") as directory:
         check_shrinking(patcher, directory)
         check_growing(patcher, directory)
diff --git a/core/libs/nid/tests/test_native_paths.py b/core/libs/nid/tests/test_native_paths.py
index ccfd9e6b8c..4b5c12193a 100644
--- a/core/libs/nid/tests/test_native_paths.py
+++ b/core/libs/nid/tests/test_native_paths.py
@@ -5,16 +5,14 @@ import tempfile
 import unittest
 from pathlib import Path
 
-from test_macho_nids import build_dylib, exports_of, nid
+from test_macho_nids import build_dylib, exports_of, nid, PATCHER
 
 try:
     import resource
 except ImportError:
     resource = None
 
-PATCHER = Path(sys.argv.pop(1)).resolve()
-
-
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class NativePathTests(unittest.TestCase):
     def invoke(self, *arguments):
         return subprocess.run([str(PATCHER), "libtest", *map(str, arguments)],
diff --git a/core/libs/nid/tests/test_pe_references.py b/core/libs/nid/tests/test_pe_references.py
index 2e6eed7f40..2992a55093 100644
--- a/core/libs/nid/tests/test_pe_references.py
+++ b/core/libs/nid/tests/test_pe_references.py
@@ -5,7 +5,7 @@ import tempfile
 import unittest
 from pathlib import Path
 
-from test_macho_nids import build_dylib, exports_of, nid
+from test_macho_nids import build_dylib, exports_of, nid, PATCHER
 
 
 def reference(*, headers=False, address=0x2000, ordinal=0):
@@ -100,6 +100,7 @@ def forwarding_exports(image, bits):
     return string(table[4]), names, targets, addresses, (export_rva, export_size)
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class ReferenceTests(unittest.TestCase):
     def patch_with_reference(self, data):
         with tempfile.TemporaryDirectory() as tmp:
@@ -135,6 +136,7 @@ class ReferenceTests(unittest.TestCase):
         self.assertEqual(image, original)
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class ForwardingExportTests(unittest.TestCase):
     def patch(self, image):
         with tempfile.TemporaryDirectory() as temporary:
@@ -241,6 +243,203 @@ class ForwardingExportTests(unittest.TestCase):
         self.assertEqual(after, image)
 
 
+class ExecutableImportTests(unittest.TestCase):
+    names = ["foo", "foo_nid_postfix", "z", "sceExample", "helper_nid_no_patch", "plain_nid_no_patch_cut", "SDL_Init", "scePreserved", "hostFunctionLongName", "alias_nid_disambig12_nid_postfix"]
+
+    def pe(self, bits=64):
+        image = bytearray(2048)
+        image[:2] = b"MZ"
+        struct.pack_into("<I", image, 0x3c, 0x40)
+        optional_size = 240 if bits == 64 else 224
+        struct.pack_into("<IHHIIIHH", image, 0x40, 0x4550, 0x8664 if bits == 64 else 0x14c, 1, 0, 0, 0, optional_size, 0x22)
+        struct.pack_into("<H", image, 0x58, 0x20b if bits == 64 else 0x10b)
+        struct.pack_into("<II", image, 0x58 + 32, 4096, 512)
+        struct.pack_into("<II", image, 0x58 + 56, 8192, 512)
+        directory = 0x58 + (112 if bits == 64 else 96)
+        struct.pack_into("<I", image, directory - 4, 16)
+        struct.pack_into("<II", image, directory + 8, 0x1000, 40)
+        struct.pack_into("<8sIIIIIIHHI", image, 0x58 + optional_size, b".idata", 1536, 0x1000, 1536, 512, 0, 0, 0, 0, 0xc0000040)
+        struct.pack_into("<IIIII", image, 512, 0x1040, 0, 0, 0x1028, 0x10c0)
+        image[552:561] = b"test.prx\0"
+        offset = 0x380
+        for index, name in enumerate(self.names):
+            entry = name.encode() + b"\0"
+            struct.pack_into("<H", image, offset, 0)
+            image[offset + 2:offset + 2 + len(entry)] = entry
+            for table in (576, 704):
+                struct.pack_into("<Q" if bits == 64 else "<I", image, table + index * (bits // 8), offset - 512 + 0x1000)
+            offset += len(entry) + 2
+        return image
+
+    def elf(self):
+        from test_symbol_versions import build_image, SHOFF
+        entries = [(None, 1, 0, 0, 0)] + [(name, 1, 0, 2, 0) for name in self.names] + [("application_export", 1, 9, 2, 0x400100)]
+        import test_symbol_versions
+        from unittest.mock import patch
+        with patch.object(test_symbol_versions, "DYNSYM_OFFSET", 0xa00):
+            image = build_image(entries, False)
+        struct.pack_into("<H", image, 16, 2)
+        struct.pack_into("<Q", image, 32, 64)
+        struct.pack_into("<HH", image, 54, 56, 2)
+        struct.pack_into("<IIQQQQQQ", image, 64, 1, 5, 0, 0x400000, 0x400000, 4096, 8192, 4096)
+        struct.pack_into("<IIQQQQQQ", image, 120, 2, 6, 0x700, 0x400700, 0x400700, 48, 48, 8)
+        struct.pack_into("<H", image, 60, 5)
+        struct.pack_into("<IIQQQQIIQQ", image, SHOFF + 4 * 64, 0, 6, 3, 0x400700, 0x700, 48, 2, 0, 8, 16)
+        size = struct.unpack_from("<Q", image, SHOFF + 2 * 64 + 32)[0]
+        struct.pack_into("<qQqQqQ", image, 0x700, 5, 0x400300, 10, size, 0, 0)
+        return image
+
+    def macho(self):
+        image = bytearray(build_dylib([("_application_export", 0, 0x100)], [("_" + name, 1 if index % 2 else 2) for index, name in enumerate(self.names)]))
+        struct.pack_into("<I", image, 12, 2)
+        return image
+
+    def read_names(self, image, kind):
+        if kind == "elf":
+            from test_symbol_versions import read_dynsym
+            return [name for name, section, _ in read_dynsym(image) if name and section == 0]
+        if kind == "macho":
+            from test_macho_nids import chained_imports
+            return [name[1:] for name, _ in chained_imports(image)]
+        bits = 64 if kind == "pe64" else 32
+        optional_size = 240 if bits == 64 else 224
+        count = struct.unpack_from("<H", image, 0x46)[0]
+        sections = [struct.unpack_from("<8sIIIIIIHHI", image, 0x58 + optional_size + index * 40) for index in range(count)]
+        result = []
+        for index in range(len(self.names)):
+            rva = struct.unpack_from("<Q" if bits == 64 else "<I", image, 576 + index * (bits // 8))[0]
+            self.assertEqual(rva, struct.unpack_from("<Q" if bits == 64 else "<I", image, 704 + index * (bits // 8))[0])
+            section = next(s for s in sections if s[2] <= rva < s[2] + s[3])
+            offset = section[4] + rva - section[2] + 2
+            result.append(image[offset:image.index(0, offset)].decode())
+        return result
+
+    def test_shared_import_rules_and_filter_in_all_formats(self):
+        for kind, build in (("pe64", self.pe), ("pe32", lambda: self.pe(32)), ("elf", self.elf), ("macho", self.macho)):
+            for only_sce in (False, True):
+                with self.subTest(kind=kind, only_sce=only_sce), tempfile.TemporaryDirectory() as directory:
+                    path = Path(directory) / "arbitrary.extension"
+                    image = build()
+                    path.write_bytes(image)
+                    excluded = Path(directory) / "preserved.txt"
+                    excluded.write_bytes(b"scePreserved\n")
+                    args = [str(PATCHER), "--exec", "--preserve-export-list", str(excluded)]
+                    if only_sce:
+                        args.append("--only-sce")
+                    result = subprocess.run([*args, str(path)], capture_output=True, text=True, timeout=20)
+                    self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                    expected = ["foo", nid("foo"), nid("z"), nid("sceExample"), "helper_nid_no_patch", "plain", "SDL_Init", "scePreserved", nid("hostFunctionLongName"), nid("alias")]
+                    if only_sce:
+                        expected[2] = "z"
+                        expected[5] = "plain_nid_no_patch_cut"
+                        expected[8] = "hostFunctionLongName"
+                    self.assertCountEqual(self.read_names(path.read_bytes(), kind), expected)
+                    if kind == "macho":
+                        self.assertEqual(exports_of(path.read_bytes()), exports_of(image))
+                    if kind == "elf":
+                        from test_symbol_versions import read_dynsym
+                        self.assertIn(("application_export", 9, 0x400100), read_dynsym(path.read_bytes()))
+
+    def test_exec_accepts_macho_without_exports(self):
+        from test_macho_nids import LC_DYLD_EXPORTS_TRIE, command_fields
+        image = self.macho()
+        command = command_fields(image)[LC_DYLD_EXPORTS_TRIE][0]
+        struct.pack_into("<II", image, command + 8, 0, 0)
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "program"
+            path.write_bytes(image)
+            result = subprocess.run([str(PATCHER), "--exec", str(path)], capture_output=True, text=True, timeout=20)
+            self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_elf_without_sections_rejects_dynamic_segment_without_writing(self):
+        image = self.elf()
+        struct.pack_into("<Q", image, 40, 0)
+        struct.pack_into("<HH", image, 60, 0, 0)
+        for flags in ([], ["--only-sce"]):
+            with self.subTest(flags=flags), tempfile.TemporaryDirectory() as directory:
+                path = Path(directory) / "program"
+                path.write_bytes(image)
+                result = subprocess.run([str(PATCHER), "--exec", *flags, str(path)], capture_output=True, text=True, timeout=20)
+                self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                self.assertIn("PT_DYNAMIC without a .dynsym section", result.stderr)
+                self.assertEqual(path.read_bytes(), image)
+
+    def test_elf_without_sections_or_dynamic_segment_is_unchanged(self):
+        image = self.elf()
+        struct.pack_into("<Q", image, 40, 0)
+        struct.pack_into("<HH", image, 60, 0, 0)
+        struct.pack_into("<H", image, 56, 1)
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "program"
+            path.write_bytes(image)
+            result = subprocess.run([str(PATCHER), "--exec", str(path)], capture_output=True, text=True, timeout=20)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertEqual(path.read_bytes(), image)
+
+    def test_elf_short_imports_grow_without_overwriting_bss(self):
+        from test_symbol_versions import sections
+        self.names = ["a", "b", "c", "d"]
+        image = self.elf()
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "program"
+            path.write_bytes(image)
+            result = subprocess.run([str(PATCHER), "--exec", str(path)], capture_output=True, text=True, timeout=20)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            after = path.read_bytes()
+            self.assertCountEqual(self.read_names(after, "elf"), [nid(name) for name in self.names])
+            offset = struct.unpack_from("<Q", after, 32)[0]
+            count = struct.unpack_from("<H", after, 56)[0]
+            segments = [struct.unpack_from("<IIQQQQQQ", after, offset + index * 56) for index in range(count)]
+            original = next(segment for segment in segments if segment[0] == 1 and segment[3] == 0x400000)
+            self.assertEqual(original[5:7], (4096, 8192))
+            phdr = next(segment for segment in segments if segment[0] == 6)
+            load = next(segment for segment in segments if segment[0] == 1 and segment[2] == offset)
+            self.assertEqual(phdr[2:4], load[2:4])
+            strings = next(section for section in sections(after) if section[1] == 3)
+            self.assertEqual(struct.unpack_from("<Q", after, 0x708)[0], strings[3])
+            self.assertEqual(struct.unpack_from("<Q", after, 0x718)[0], strings[5])
+            self.assertGreater(strings[4], len(image))
+
+    def test_pe_own_exports_remain_unchanged(self):
+        image = self.pe()
+        struct.pack_into("<II", image, 0x58 + 112, 0x1500, 96)
+        struct.pack_into("<IIHHIIIIIII", image, 0x700, 0, 0, 0, 0, 0x1540, 1, 1, 1, 0x1528, 0x152c, 0x1530)
+        struct.pack_into("<IIH", image, 0x728, 0x1100, 0x1550, 0)
+        image[0x740:0x748] = b"app.exe\0"
+        image[0x750:0x75b] = b"own_export\0"
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "program"
+            path.write_bytes(image)
+            result = subprocess.run([str(PATCHER), "--exec", str(path)], capture_output=True, text=True, timeout=20)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual(path.read_bytes()[0x700:0x760], image[0x700:0x760])
+
+    def test_unsupported_exec_layouts_fail_without_writing(self):
+        signed = bytearray(build_dylib([], [("_sceExample", 1)], signed=True))
+        struct.pack_into("<I", signed, 12, 2)
+        pe = self.pe()
+        struct.pack_into("<II", pe, 0x58 + 112 + 13 * 8, 0x1400, 32)
+        full_headers = self.pe()
+        struct.pack_into("<I", full_headers, 0x58 + 60, 0x58 + 240 + 40)
+        for image, message in ((signed, "signature"), (pe, "delay-loaded"), (full_headers, "section header"), (b"invalid", "unrecognized")):
+            with self.subTest(message=message), tempfile.TemporaryDirectory() as directory:
+                path = Path(directory) / "program"
+                path.write_bytes(image)
+                result = subprocess.run([str(PATCHER), "--exec", str(path)], capture_output=True, text=True, timeout=20)
+                self.assertEqual(result.returncode, 2)
+                self.assertIn(message, result.stderr)
+                self.assertEqual(path.read_bytes(), image)
+
+    def test_only_sce_requires_exec_and_failure_does_not_write(self):
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "program"
+            image = self.pe()
+            path.write_bytes(image)
+            for arguments in (["libtest", "--only-sce"], ["--only-sce"], ["--exec", "--only-sce", "--only-sce"]):
+                result = subprocess.run([str(PATCHER), *arguments, str(path)], capture_output=True, timeout=20)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertEqual(path.read_bytes(), image)
+
+
 if __name__ == "__main__":
-    PATCHER = Path(sys.argv.pop(1)).resolve()
     unittest.main()
diff --git a/core/libs/nid/tests/test_shared_strings.py b/core/libs/nid/tests/test_shared_strings.py
index 3bfb64125b..0d4325d8cc 100644
--- a/core/libs/nid/tests/test_shared_strings.py
+++ b/core/libs/nid/tests/test_shared_strings.py
@@ -3,9 +3,10 @@ import sys
 import unittest
 from pathlib import Path
 
-from test_symbol_versions import build_image, symbols, patch, SHOFF, DYNSYM_OFFSET, read_dynsym, sections, DEFINITIONS
+from test_symbol_versions import build_image, symbols, patch, SHOFF, DYNSYM_OFFSET, read_dynsym, sections, DEFINITIONS, PATCHER
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class SharedStringTests(unittest.TestCase):
     def test_dynamic_names_keep_original_string_when_export_shares_offset(self):
         for tag in (1, 14, 15, 29):
@@ -54,5 +55,4 @@ class SharedStringTests(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    PATCHER = Path(sys.argv.pop(1)).resolve()
     unittest.main()
diff --git a/core/libs/nid/tests/test_symbol_versions.py b/core/libs/nid/tests/test_symbol_versions.py
index b824a374c6..c9e9adc43f 100644
--- a/core/libs/nid/tests/test_symbol_versions.py
+++ b/core/libs/nid/tests/test_symbol_versions.py
@@ -1,3 +1,4 @@
+import os
 import re
 import struct
 import subprocess
@@ -198,8 +199,36 @@ def test_unversioned_library_is_still_patched(patcher):
     assert len({entry[0] for entry in after if entry[0]}) == len([entry for entry in after if entry[0]])
 
 
+def find_patcher():
+    for index, argument in enumerate(sys.argv[1:], 1):
+        candidate = Path(argument)
+        if candidate.stem == "nid_patcher" and candidate.is_file():
+            sys.argv.pop(index)
+            return candidate.resolve()
+    env = os.environ.get("ANYPS5_NID_PATCHER") or os.environ.get("NID_PATCHER")
+    if env and Path(env).is_file():
+        return Path(env).resolve()
+    repo_root = Path(__file__).resolve().parents[4]
+    for candidate in (
+        repo_root / "build" / "core" / "libs" / "nid_patcher.exe",
+        repo_root / "build" / "core" / "libs" / "nid_patcher",
+    ):
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+PATCHER = find_patcher()
+
+
 def main():
-    patcher = Path(sys.argv[1]).resolve()
+    if len(sys.argv) > 1:
+        patcher = Path(sys.argv[1]).resolve()
+    else:
+        patcher = PATCHER or find_patcher()
+        if patcher is None:
+            print("nid_patcher executable required")
+            sys.exit(0)
     test_versioned_library_is_rejected(patcher)
     test_unversioned_library_is_still_patched(patcher)
     print("NID patcher symbol version tests passed")
diff --git a/core/libs/nid/tests/test_verneed.py b/core/libs/nid/tests/test_verneed.py
index 58ebc02c6b..79dd7a7789 100644
--- a/core/libs/nid/tests/test_verneed.py
+++ b/core/libs/nid/tests/test_verneed.py
@@ -3,7 +3,7 @@ import sys
 import unittest
 from pathlib import Path
 
-from test_symbol_versions import build_image, symbols, patch, SHOFF, DYNSTR_OFFSET, sections
+from test_symbol_versions import build_image, symbols, patch, SHOFF, DYNSTR_OFFSET, sections, PATCHER
 
 VERNEED = 0x580
 
@@ -22,6 +22,7 @@ def image(*, auxiliary=16, count=1, size=32, version=1, auxnext=0, nextrecord=0)
     return data
 
 
+@unittest.skipUnless(PATCHER is not None and PATCHER.is_file(), "nid_patcher executable required")
 class VersionRequirementsTests(unittest.TestCase):
     def test_auxiliary_record_cannot_leave_declared_section(self):
         self.reject(image(auxiliary=32))
@@ -72,5 +73,4 @@ class VersionRequirementsTests(unittest.TestCase):
 
 
 if __name__ == "__main__":
-    PATCHER = Path(sys.argv.pop(1)).resolve()
     unittest.main()
diff --git a/core/libs/prx/libSceAbstractLocal/libSceAbstractLocal.hpp b/core/libs/prx/libSceAbstractLocal/libSceAbstractLocal.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractLocal/libSceAbstractLocal.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractStorage/libSceAbstractStorage.hpp b/core/libs/prx/libSceAbstractStorage/libSceAbstractStorage.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractStorage/libSceAbstractStorage.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractTcs/libSceAbstractTcs.hpp b/core/libs/prx/libSceAbstractTcs/libSceAbstractTcs.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractTcs/libSceAbstractTcs.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractTwitter/libSceAbstractTwitter.hpp b/core/libs/prx/libSceAbstractTwitter/libSceAbstractTwitter.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractTwitter/libSceAbstractTwitter.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractYoutube/libSceAbstractYoutube.hpp b/core/libs/prx/libSceAbstractYoutube/libSceAbstractYoutube.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractYoutube/libSceAbstractYoutube.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAc3Enc/Export.cpp b/core/libs/prx/libSceAc3Enc/Export.cpp
index 4ee193119b..13a2ad92a5 100644
--- a/core/libs/prx/libSceAc3Enc/Export.cpp
+++ b/core/libs/prx/libSceAc3Enc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAc3Enc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAc3Enc/include/Api.hpp b/core/libs/prx/libSceAc3Enc/include/Api.hpp
new file mode 100644
index 0000000000..02d6fc4467
--- /dev/null
+++ b/core/libs/prx/libSceAc3Enc/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAc3EncCreateEncoder();
+int APS5_VABI sceAc3EncDeleteEncoder();
+int APS5_VABI sceAc3EncEncode();
+int APS5_VABI sceAc3EncEncodeAsync();
+int APS5_VABI sceAc3EncFlush();
+int APS5_VABI sceAc3EncIsEncoding();
+int APS5_VABI sceAc3EncWaitEncode();
+
+}
diff --git a/core/libs/prx/libSceAc3Enc/libSceAc3Enc.hpp b/core/libs/prx/libSceAc3Enc/libSceAc3Enc.hpp
new file mode 100644
index 0000000000..7addfec629
--- /dev/null
+++ b/core/libs/prx/libSceAc3Enc/libSceAc3Enc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAc3Enc/include/Api.hpp"
diff --git a/core/libs/prx/libSceAcm/Export.cpp b/core/libs/prx/libSceAcm/Export.cpp
index 914d474f0b..ddbe893628 100644
--- a/core/libs/prx/libSceAcm/Export.cpp
+++ b/core/libs/prx/libSceAcm/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAcm/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -217,7 +218,6 @@ int APS5_VABI sceAcm_IFFT() {
     return 0;
 }
 
-
 int APS5_VABI sceAcmBatchJobNotification() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceAcm/include/Api.hpp b/core/libs/prx/libSceAcm/include/Api.hpp
new file mode 100644
index 0000000000..c4da065395
--- /dev/null
+++ b/core/libs/prx/libSceAcm/include/Api.hpp
@@ -0,0 +1,20 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAcmBatchStartBuffer(AcmContextId context, const void* batchCommands, size_t batchSize, AcmBatchError* batchError, AcmBatchId* batch);
+int APS5_VABI sceAcmBatchStartBuffers(AcmContextId context, uint32_t batchInfoCount, const AcmBatchInfo* const batch_info[], AcmBatchError* batchError, AcmBatchId* batch);
+int APS5_VABI sceAcmBatchWait(AcmContextId context, AcmBatchId batch, uint32_t timeout);
+int APS5_VABI sceAcmContextCreate(AcmContextId* context);
+int APS5_VABI sceAcmContextDestroy(AcmContextId context);
+int APS5_VABI sceAcm_ConvReverb_SharedInput(AcmBatchInfo* batch, std::uint32_t mode, AcmReverbInput* input, std::uint32_t outputCount, const AcmReverbFilter* const* filters, const float* gains, const AcmReverbOutput* const* outputs);
+int APS5_VABI sceAcm_FFT(AcmBatchInfo* batch, std::int32_t transformSize, std::uint32_t transformCount, std::int32_t inputFormat, const void* const* inputs, std::int32_t outputFormat, void* const* outputs, std::int32_t flags);
+int APS5_VABI sceAcm_Panner(AcmBatchInfo* batch, std::uint32_t sourceCount, const void* const* sources, std::uint32_t sourceMode, std::uint32_t outputMode, std::uint32_t channelCount, const void* const* sourceParameters, const void* const* sourceMatrices, const void* const* inputChannels, void* const* outputChannels);
+int APS5_VABI sceAcmBatchJobPriority(AcmBatchInfo* batch, std::uint32_t priority);
+int APS5_VABI sceAcm_ConvReverb_SharedIr();
+int APS5_VABI sceAcm_IFFT();
+int APS5_VABI sceAcmBatchJobNotification();
+
+}
diff --git a/core/libs/prx/libSceAcm/libSceAcm.hpp b/core/libs/prx/libSceAcm/libSceAcm.hpp
new file mode 100644
index 0000000000..a8b95eefbf
--- /dev/null
+++ b/core/libs/prx/libSceAcm/libSceAcm.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAcm/include/Api.hpp"
diff --git a/core/libs/prx/libSceAgc/Acb/include/Control.hpp b/core/libs/prx/libSceAgc/Acb/include/Control.hpp
index c22dc4e61e..e1862076c3 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Control.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Control.hpp
@@ -1,4 +1,26 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_CONTROL_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_CONTROL_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcAcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode, std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask, std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
+std::uint32_t* APS5_VABI sceAgcAcbJump(CommandBuffer* buf, std::uint8_t cachePolicy, const std::uint32_t* target, std::uint32_t sizeInDwords);
+uint32_t APS5_VABI sceAgcAcbJumpGetSize(void);
+uint32_t* APS5_VABI sceAgcAcbResetQueue(CommandBuffer* buf, uint32_t op, uint32_t value);
+std::uint32_t* APS5_VABI sceAgcAcbRewind(CommandBuffer* buf, std::uint32_t initialState);
+std::uint32_t APS5_VABI sceAgcAcbRewindGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbWaitUntilSafeForRendering(CommandBuffer* buf, std::uint32_t videoOutHandle, std::uint32_t displayBufferIndex);
+std::uint32_t* APS5_VABI sceAgcAcbSetFlip(CommandBuffer* buf, std::uint32_t videoOutHandle, std::int32_t displayBufferIndex, std::uint32_t flipMode, std::int64_t flipArg);
+std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadsActive(CommandBuffer* buf, std::uint32_t streamId, const std::uint32_t* workloadIds, std::uint32_t workloadCount);
+std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadComplete(CommandBuffer* buf, std::uint32_t streamId, std::uint32_t workloadId);
+std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadStreamInactive(CommandBuffer* buf, std::uint32_t streamId);
+uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, uint32_t color);
+uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf);
+uint32_t* APS5_VABI sceAgcAcbSetMarker(CommandBuffer* buf, const char* str, uint32_t color);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp b/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp
index e207781ef7..0915d7aad8 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_DISPATCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_DISPATCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcAcbDispatchIndirect(CommandBuffer* buf, const volatile void* indirectArgs, uint32_t modifier);
+std::uint32_t APS5_VABI sceAgcAcbDispatchIndirectGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/include/Memory.hpp b/core/libs/prx/libSceAgc/Acb/include/Memory.hpp
index 78e8668cb0..93949715e6 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Memory.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Memory.hpp
@@ -1,4 +1,24 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_MEMORY_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_MEMORY_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcAcbAcquireMem(CommandBuffer* buf, std::uint32_t gcrControl, const volatile void* base, std::uint64_t sizeBytes, std::uint32_t pollCycles);
+uint32_t APS5_VABI sceAgcAcbAcquireMemGetSize(void);
+uint32_t* APS5_VABI sceAgcAcbCopyData(CommandBuffer* buf, uint8_t dst, uint8_t dstCachePolicy, uint64_t dstAddress, uint8_t src, uint8_t srcCachePolicy, uint64_t srcAddressOrImmediate, uint8_t itemSize, uint8_t writeConfirm);
+std::uint64_t APS5_VABI sceAgcAcbCopyDataGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbDmaData(CommandBuffer* buf, std::uint8_t dst, std::uint8_t dstCachePolicy, std::uint64_t dstAddress, std::uint8_t src, std::uint8_t srcCachePolicy, std::uint64_t srcAddress, std::uint32_t numBytes, std::uint8_t waitForPrevious, std::uint8_t writeConfirm);
+std::uint32_t APS5_VABI sceAgcAcbDmaDataGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbAtomicMem(CommandBuffer* buf, std::uint8_t atomicOp, std::uint8_t command, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t srcData, std::uint64_t compareData, std::uint16_t loopInterval);
+std::uint32_t APS5_VABI sceAgcAcbAtomicMemGetSize();
+std::uint32_t APS5_VABI sceAgcAcbAtomicGdsGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbPrimeUtcl2(CommandBuffer* buf, const volatile void* address, std::uint32_t sizeInBytes);
+std::uint32_t APS5_VABI sceAgcAcbPrimeUtcl2GetSize();
+std::uint32_t* APS5_VABI sceAgcAcbWriteData(CommandBuffer* buf, std::uint8_t dst, std::uint8_t cachePolicy, std::uint64_t address, const void* data, std::uint32_t numDwords, std::uint8_t increment, std::uint8_t writeConfirm);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/include/Sync.hpp b/core/libs/prx/libSceAgc/Acb/include/Sync.hpp
index ca3084b8b8..fb7a826139 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Sync.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Sync.hpp
@@ -1,4 +1,20 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_SYNC_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_SYNC_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcAcbCondExec(CommandBuffer* buf, const volatile uint32_t* address, uint32_t numDwords);
+uint32_t APS5_VABI sceAgcAcbCondExecGetSize(void);
+std::uint32_t* APS5_VABI sceAgcAcbWaitRegMem(CommandBuffer* buf, std::uint8_t size, std::uint8_t compareFunction, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t reference, std::uint64_t mask, std::uint32_t pollCycles);
+std::uint64_t APS5_VABI sceAgcAcbWaitOnAddressGetSize(std::uint8_t size);
+std::uint32_t* APS5_VABI sceAgcAcbEventWrite(CommandBuffer* buf, std::uint8_t eventType, const volatile void* address);
+std::uint64_t APS5_VABI sceAgcAcbEventWriteGetSize(std::uint8_t eventType);
+std::uint32_t APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/src/Control.cpp b/core/libs/prx/libSceAgc/Acb/src/Control.cpp
index 567bfd5e18..1dd0314800 100644
--- a/core/libs/prx/libSceAgc/Acb/src/Control.cpp
+++ b/core/libs/prx/libSceAgc/Acb/src/Control.cpp
@@ -102,6 +102,18 @@ uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, uin
     return Agc::Marker::Push(buf, str, __func__);
 }
 
+uint32_t* APS5_VABI sceAgcAcbPushMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    return Agc::Marker::PushSpan(buf, str, length, __func__);
+}
+
+uint32_t* APS5_VABI sceAgcAcbSetMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    auto* packet = Agc::Marker::PushSpan(buf, str, length, __func__);
+    Agc::Marker::Pop(buf, __func__);
+    return packet;
+}
+
 uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf) {
     return Agc::Marker::Pop(buf, __func__);
 }
diff --git a/core/libs/prx/libSceAgc/Acb/src/Sync.cpp b/core/libs/prx/libSceAgc/Acb/src/Sync.cpp
index eee05b37c4..cb4ff7f5a6 100644
--- a/core/libs/prx/libSceAgc/Acb/src/Sync.cpp
+++ b/core/libs/prx/libSceAgc/Acb/src/Sync.cpp
@@ -44,10 +44,7 @@ std::uint32_t APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize() {
     return 32;
 }
 
-std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, std::uint8_t action, std::uint8_t clientCode, const volatile void* address) {
-    const std::uint8_t operation = action != 0 ? 7u : 6u;
-    const std::uint8_t signalType = clientCode & 1u;
-    const std::uint8_t waitForMailbox = (clientCode >> 1u) & 1u;
+std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation) {
     return Agc::Command::WriteMemSemaphore(buf, address, waitForMailbox, signalType, operation, __func__);
 }
 
diff --git a/core/libs/prx/libSceAgc/CMakeLists.txt b/core/libs/prx/libSceAgc/CMakeLists.txt
index afff1e8a73..9c26307068 100644
--- a/core/libs/prx/libSceAgc/CMakeLists.txt
+++ b/core/libs/prx/libSceAgc/CMakeLists.txt
@@ -157,7 +157,7 @@ add_test_executable(agc_register_command_tests EXCLUDE_FROM_ALL
         Patch/src/IndirectRegisters.cpp
 )
 target_include_directories(agc_register_command_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_register_command_tests PRIVATE libc)
+target_link_libraries(agc_register_command_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_register_command_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_register_command_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -176,7 +176,7 @@ add_test_executable(agc_cb_cond_write_tests EXCLUDE_FROM_ALL
         Cb/src/Branch.cpp
 )
 target_include_directories(agc_cb_cond_write_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_cb_cond_write_tests PRIVATE libc)
+target_link_libraries(agc_cb_cond_write_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_cb_cond_write_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_cb_cond_write_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -220,7 +220,7 @@ add_test_executable(agc_branch_patch_tests EXCLUDE_FROM_ALL
         Patch/src/Branch.cpp
 )
 target_include_directories(agc_branch_patch_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_branch_patch_tests PRIVATE libc)
+target_link_libraries(agc_branch_patch_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_branch_patch_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_branch_patch_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -240,7 +240,7 @@ add_test_executable(agc_predication_tests EXCLUDE_FROM_ALL
         Predication/src/Predication.cpp
 )
 target_include_directories(agc_predication_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_predication_tests PRIVATE libc)
+target_link_libraries(agc_predication_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_predication_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_predication_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -370,7 +370,7 @@ add_test_executable(agc_dma_data_tests EXCLUDE_FROM_ALL
         DcbFlow/src/Memory.cpp
 )
 target_include_directories(agc_dma_data_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_dma_data_tests PRIVATE libc)
+target_link_libraries(agc_dma_data_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_dma_data_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_dma_data_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -390,7 +390,7 @@ add_test_executable(agc_write_data_patch_tests EXCLUDE_FROM_ALL
         Patch/src/WaitRegMem.cpp
 )
 target_include_directories(agc_write_data_patch_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_write_data_patch_tests PRIVATE libc)
+target_link_libraries(agc_write_data_patch_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_write_data_patch_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_write_data_patch_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -410,7 +410,7 @@ add_test_executable(agc_prime_utcl2_tests EXCLUDE_FROM_ALL
         DcbState/src/Display.cpp
 )
 target_include_directories(agc_prime_utcl2_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_prime_utcl2_tests PRIVATE libc)
+target_link_libraries(agc_prime_utcl2_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_prime_utcl2_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_prime_utcl2_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -431,7 +431,7 @@ add_test_executable(agc_cond_exec_patch_tests EXCLUDE_FROM_ALL
         Patch/src/CondExec.cpp
 )
 target_include_directories(agc_cond_exec_patch_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_cond_exec_patch_tests PRIVATE libc)
+target_link_libraries(agc_cond_exec_patch_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_cond_exec_patch_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_cond_exec_patch_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
diff --git a/core/libs/prx/libSceAgc/Cb/include/Branch.hpp b/core/libs/prx/libSceAgc/Cb/include/Branch.hpp
index 5c74f02461..855d78d8ee 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Branch.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Branch.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_BRANCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_BRANCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbBranch(CommandBuffer* buf, std::uint8_t mode, std::uint8_t compareFunction, const volatile std::uint64_t* compareAddress, std::uint64_t mask, std::uint64_t reference, std::uint8_t cachePolicy1, const volatile std::uint32_t* buffer1, std::uint32_t sizeInDwords1, std::uint8_t cachePolicy2, const volatile std::uint32_t* buffer2, std::uint32_t sizeInDwords2);
+std::uint32_t APS5_VABI sceAgcCbBranchGetSize();
+std::uint32_t* APS5_VABI sceAgcCbCondWrite(CommandBuffer* buf, std::uint32_t compareFunction, std::uint32_t writeSpace, const volatile void* writeAddress, std::uint32_t writeData, const volatile void* pollAddress, std::uint32_t reference, std::uint32_t mask);
+std::uint32_t APS5_VABI sceAgcCbCondWriteGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp b/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp
index 5881aaf5a9..9f741d7e2e 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_DISPATCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_DISPATCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbDispatch(CommandBuffer* buf, std::uint32_t threadGroupX, std::uint32_t threadGroupY, std::uint32_t threadGroupZ, std::uint32_t modifier);
+uint32_t APS5_VABI sceAgcCbDispatchGetSize(void);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Cb/include/Registers.hpp b/core/libs/prx/libSceAgc/Cb/include/Registers.hpp
index e5634b8ad6..d41e1beb42 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Registers.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Registers.hpp
@@ -1,4 +1,20 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_REGISTERS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_REGISTERS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbSetUcRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
+std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
+uint32_t APS5_VABI sceAgcCbSetShRegisterRangeDirectGetSize(uint32_t numValues);
+std::uint32_t APS5_VABI sceAgcCbSetUcRegisterRangeDirectGetSize(std::uint32_t numValues);
+std::uint32_t* APS5_VABI sceAgcCbSetShRegistersDirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcCbSetShRegistersDirectGetSize(std::uint32_t numRegs);
+std::uint32_t* APS5_VABI sceAgcCbSetUcRegistersDirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcCbSetUcRegistersDirectGetSize(std::uint32_t numRegs);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Cb/include/Sync.hpp b/core/libs/prx/libSceAgc/Cb/include/Sync.hpp
index a070c6a5fc..d3be5f9083 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Sync.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Sync.hpp
@@ -4,10 +4,19 @@
 #include "SceTypes.hpp"
 #include <cstdint>
 
-struct CommandBuffer;
-
 extern "C" {
 std::uint32_t* APS5_VABI sceAgcCbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint32_t operation, std::uint32_t modifier, std::uint32_t value);
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbNop_nid_postfix(CommandBuffer* buf, std::uint32_t sizeInDwords);
+uint32_t APS5_VABI sceAgcCbNopGetSize(uint32_t sizeInDwords);
+std::uint32_t APS5_VABI sceAgcCbQueueEndOfPipeActionGetSize();
+std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer* buf, std::uint8_t action, std::uint16_t gcrControl, std::uint8_t dst, std::uint8_t cachePolicy, const volatile Label* address, std::uint8_t dataSelect, std::uint64_t data, std::uint16_t gdsOffset, std::uint16_t gdsSize, std::uint8_t interrupt, std::uint32_t interruptContextId);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Command/src/Packet.cpp b/core/libs/prx/libSceAgc/Command/src/Packet.cpp
index 6ec0e12165..13036e5d12 100644
--- a/core/libs/prx/libSceAgc/Command/src/Packet.cpp
+++ b/core/libs/prx/libSceAgc/Command/src/Packet.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -67,6 +68,7 @@ void Reserve(CommandBuffer* buffer, std::uint32_t count, const char* function) {
 std::uint32_t* Allocate(CommandBuffer* buffer, std::uint32_t count, const char* function) {
     Reserve(buffer, count, function);
     auto* result = buffer->cursor_up;
+    AgcDriverPrepareCommandWrite_nid_no_patch(reinterpret_cast<std::uint64_t>(result), static_cast<std::size_t>(count) * sizeof(std::uint32_t));
     buffer->cursor_up += count;
     return result;
 }
@@ -113,17 +115,23 @@ std::uint32_t* WriteRegisters(CommandBuffer* buffer, std::uint32_t opcode, const
         Require(buffer != nullptr, function, "null command buffer");
         return buffer->cursor_up;
     }
-    CheckAddress(reinterpret_cast<std::uintptr_t>(registers), 4, function);
+    CheckAddress(reinterpret_cast<std::uintptr_t>(registers), 1, function);
+    const auto* bytes = reinterpret_cast<const std::byte*>(const_cast<const ShaderRegister*>(registers));
+    const auto entryAt = [&](std::uint32_t index) {
+        ShaderRegister entry;
+        std::memcpy(&entry, bytes + static_cast<std::size_t>(index) * sizeof(ShaderRegister), sizeof(entry));
+        return entry;
+    };
     std::vector<ShaderRegister> snapshot;
     if (snapshotAll) {
         snapshot.reserve(count);
         for (std::uint32_t i = 0; i < count; ++i) {
-            snapshot.push_back({registers[i].offset, registers[i].value});
+            snapshot.push_back(entryAt(i));
             CheckBits(snapshot.back().offset, 0xffffu, function);
         }
     }
-    const auto offsetAt = [&](std::uint32_t index) { return snapshotAll ? snapshot[index].offset : registers[index].offset; };
-    const auto valueAt = [&](std::uint32_t index) { return snapshotAll ? snapshot[index].value : registers[index].value; };
+    const auto offsetAt = [&](std::uint32_t index) { return snapshotAll ? snapshot[index].offset : entryAt(index).offset; };
+    const auto valueAt = [&](std::uint32_t index) { return snapshotAll ? snapshot[index].value : entryAt(index).value; };
     std::uint32_t* first = nullptr;
     std::uint32_t index = 0;
     while (index < count) {
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp
index e134de925d..1eede737f2 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp
@@ -1,4 +1,24 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWINDEXED_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWINDEXED_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndex(CommandBuffer* buf, std::uint32_t indexCount, const volatile void* indexAddress, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndexAuto(CommandBuffer* buf, std::uint32_t indexCount, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexAutoGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndexOffset(CommandBuffer* buf, std::uint32_t indexOffset, std::uint32_t indexCount, std::uint64_t modifier);
+uint32_t APS5_VABI sceAgcDcbDrawIndexOffsetGetSize(void);
+uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirect(CommandBuffer* buf, uint32_t dataOffsetInBytes, uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexIndirectGetSize();
+uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirectMulti(CommandBuffer* buf, uint32_t dataOffsetInBytes, uint32_t countIndirect, uint32_t maxCountOrCount, const volatile void* countAddr, uint32_t strideInBytes, uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexIndirectMultiGetSize();
+uint32_t* APS5_VABI sceAgcDcbDrawIndexMultiInstanced(CommandBuffer* buf, uint32_t indexCount, const volatile void* indexAddr, const volatile void* objectIds, uint32_t instanceCount, uint64_t modifier);
+uint32_t APS5_VABI sceAgcDcbDrawIndexMultiInstancedGetSize(void);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp
index 19705ed1f2..5ee0a26dc5 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWNONINDEXED_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWNONINDEXED_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndirect(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndirectGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndirectMulti(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint32_t countIndirect, std::uint32_t maxCountOrCount, const volatile void* countAddress, std::uint32_t strideInBytes, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndirectMultiGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp
index b90a2a40d6..652629217a 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp
@@ -1,4 +1,21 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INDEXBUFFER_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INDEXBUFFER_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexBuffer(CommandBuffer* buf, std::uint64_t indexAddress);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexBufferGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexCount(CommandBuffer* buf, std::uint32_t indexCount);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexCountGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexSize(CommandBuffer* buf, std::uint8_t indexSize, std::uint8_t cachePolicy);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexSizeGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexSize_0600(CommandBuffer* buf, std::uint8_t indexSize, std::uint8_t cachePolicy, std::uint8_t perInstanceObjectId);
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexIndirectArgs(CommandBuffer* buf, std::uint64_t attributeAddress, std::uint32_t attributeIndex);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp
index b67b2b5bac..8f74423854 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INSTANCING_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INSTANCING_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbSetNumInstances(CommandBuffer* buf, std::uint32_t numInstances);
+std::uint32_t APS5_VABI sceAgcDcbSetNumInstancesGetSize();
+uint32_t* APS5_VABI sceAgcDcbSetBaseIndirectArgs(CommandBuffer* buf, uint32_t shaderType, const volatile void* indirectBaseAddr);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp
index a2bd44d8bc..de4d9fcf72 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_STATS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_STATS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbGetLodStats(CommandBuffer* buf, std::uint8_t cachePolicy, const volatile void* buffer, std::uint32_t bufferSizeInBytes, std::uint32_t resetCount, std::uint8_t forceReset, std::uint8_t reportAndReset, std::uint32_t reportingIntervalIn100kClocks);
+std::uint32_t APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize(std::int32_t queryType);
+std::uint32_t APS5_VABI sceAgcDcbEndOcclusionQueryGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp
index 6ded533662..2890339f5b 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp
@@ -9,4 +9,18 @@ std::uint32_t* APS5_VABI sceAgcDcbAtomicGds(CommandBuffer* buf, std::uint32_t co
 std::uint32_t* APS5_VABI sceAgcDcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode, std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask, std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbJump(CommandBuffer* buf, uint8_t mode, uint8_t cachePolicy, const uint32_t* target, uint32_t sizeInDwords);
+std::uint32_t APS5_VABI sceAgcDcbJumpGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbResetQueue(CommandBuffer* buf, std::uint32_t op, std::uint32_t state);
+std::uint32_t* APS5_VABI sceAgcDcbClearState(CommandBuffer* buf, std::uint32_t command);
+uint32_t* APS5_VABI sceAgcDcbRewind(CommandBuffer* buf, uint32_t initialState);
+uint32_t APS5_VABI sceAgcDcbRewindGetSize(void);
+uint32_t* APS5_VABI sceAgcDcbWaitUntilSafeForRendering(CommandBuffer* buf, uint32_t videoOutHandle, uint32_t displayBufferIndex);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp
index 025f84ad5c..4266a8cf60 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_DISPATCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_DISPATCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbDispatchIndirect(CommandBuffer* buf, uint32_t dataOffsetInBytes, uint32_t flags);
+std::uint32_t APS5_VABI sceAgcDcbDispatchIndirectGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp
index f089c9a83e..e9202cd6b5 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp
@@ -9,4 +9,20 @@ std::uint32_t* APS5_VABI sceAgcDcbAcquireMem(CommandBuffer* buf, std::uint8_t en
 std::uint32_t APS5_VABI sceAgcDcbAtomicGdsGetSize();
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceAgcDcbAcquireMemGetSize(void);
+uint32_t* APS5_VABI sceAgcDcbCopyData(CommandBuffer* buf, uint8_t dst, uint8_t dstCachePolicy, uint64_t dstAddress, uint8_t src, uint8_t srcCachePolicy, uint64_t srcAddressOrImmediate, uint8_t itemSize, uint8_t writeConfirm);
+std::uint64_t APS5_VABI sceAgcDcbCopyDataGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDmaData(CommandBuffer* buf, std::uint8_t engine, std::uint8_t dst, std::uint8_t dstCachePolicy, std::uint64_t dstAddress, std::uint8_t src, std::uint8_t srcCachePolicy, std::uint64_t srcAddress, std::uint32_t numBytes, std::uint8_t waitForPrevious, std::uint8_t writeConfirm, std::uint8_t blockEngine);
+std::uint32_t APS5_VABI sceAgcDcbDmaDataGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbAtomicMem(CommandBuffer* buf, std::uint8_t atomicOp, std::uint8_t command, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t srcData, std::uint64_t compareData, std::uint16_t loopInterval);
+std::uint32_t APS5_VABI sceAgcDcbAtomicMemGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbWriteData(CommandBuffer* buf, std::uint8_t dst, std::uint8_t cachePolicy, std::uint64_t address, const void* data, std::uint32_t numDwords, std::uint8_t increment, std::uint8_t writeConfirm);
+uint32_t APS5_VABI sceAgcDcbWriteDataGetSize(uint32_t numDwords);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp
index 6cad00334a..fa07f43e62 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp
@@ -1,5 +1,21 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_SYNC_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_SYNC_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbCondExec(CommandBuffer* buf, const volatile uint32_t* address, uint32_t numDwords);
+uint32_t APS5_VABI sceAgcDcbCondExecGetSize(void);
+std::uint32_t* APS5_VABI sceAgcDcbWaitRegMem(CommandBuffer* buf, std::uint8_t size, std::uint8_t compareFunction, std::uint8_t operation, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t reference, std::uint64_t mask, std::uint32_t pollCycles);
+uint32_t APS5_VABI sceAgcDcbWaitOnAddressGetSize(uint32_t size);
+std::uint32_t* APS5_VABI sceAgcDcbEventWrite(CommandBuffer* buf, std::uint8_t eventType, const volatile void* address);
+std::uint64_t APS5_VABI sceAgcDcbEventWriteGetSize(std::uint8_t eventType);
+std::uint32_t* APS5_VABI sceAgcDcbStallCommandBufferParser(CommandBuffer* buf);
+std::uint32_t APS5_VABI sceAgcDcbStallCommandBufferParserGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation);
+
+}
 
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp b/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp
index 96c45f0d3c..d3fb4b534b 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp
@@ -52,10 +52,7 @@ std::uint32_t APS5_VABI sceAgcDcbStallCommandBufferParserGetSize() {
     return 8;
 }
 
-std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, std::uint8_t action, std::uint8_t clientCode, const volatile void* address) {
-    const std::uint8_t operation = action != 0 ? 7u : 6u;
-    const std::uint8_t signalType = clientCode & 1u;
-    const std::uint8_t waitForMailbox = (clientCode >> 1u) & 1u;
+std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation) {
     return Agc::Command::WriteMemSemaphore(buf, address, waitForMailbox, signalType, operation, __func__);
 }
 
diff --git a/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp b/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp
index 99d37d3c6a..19d2e85ba7 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp
@@ -4,8 +4,6 @@
 #include "SceTypes.hpp"
 #include <cstdint>
 
-struct CommandBuffer;
-
 extern "C" {
 
 uint32_t* APS5_VABI sceAgcDcbContextStateOp(CommandBuffer* buf, uint32_t operation);
@@ -14,4 +12,15 @@ uint64_t APS5_VABI sceAgcDcbContextStateOpGetSize(uint32_t operation);
 
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t APS5_VABI sceAgcDcbSetBaseDispatchIndirectArgsGetSize();
+std::uint32_t APS5_VABI sceAgcDcbSetBaseDrawIndirectArgsGetSize();
+std::uint32_t APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize();
+std::uint32_t APS5_VABI sceAgcDcbGetLodStatsGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Display.hpp b/core/libs/prx/libSceAgc/DcbState/include/Display.hpp
index 74fb8caf0d..e6868d17f4 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Display.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Display.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_DISPLAY_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_DISPLAY_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetFlip(CommandBuffer* buf, uint32_t videoOutHandle, int32_t displayBufferIndex, uint32_t flipMode, int64_t flipArg);
+uint32_t* APS5_VABI sceAgcDcbPrimeUtcl2(CommandBuffer* buf, const volatile void* address, uint32_t sizeInBytes);
+std::uint32_t APS5_VABI sceAgcDcbPrimeUtcl2GetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Init.hpp b/core/libs/prx/libSceAgc/DcbState/include/Init.hpp
index de641fea3d..8e278b3fc3 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Init.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Init.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_INIT_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_INIT_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcInit(std::uint32_t version);
+int APS5_VABI sceAgcInit_0090(std::uint32_t* state, std::uint32_t version);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp b/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp
index c0ccfdea02..bb626aa02e 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp
@@ -7,8 +7,19 @@
 namespace Agc::Marker {
 
 std::uint32_t* Push(CommandBuffer* buf, const char* str, const char* function);
+std::uint32_t* PushSpan(CommandBuffer* buf, const char* str, std::uint32_t length, const char* function);
 std::uint32_t* Pop(CommandBuffer* buf, const char* function);
 
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetMarker(CommandBuffer* buf, const char* str, uint32_t color);
+uint32_t* APS5_VABI sceAgcDcbPopMarker(CommandBuffer* buf);
+uint32_t* APS5_VABI sceAgcDcbPushMarker(CommandBuffer* buf, const char* str, uint32_t color);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp b/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp
index 65f64a14eb..5d56b7066a 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_PREDICATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_PREDICATION_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetPredication(CommandBuffer* buf, uint8_t condition, uint8_t op, uint8_t waitOp, const volatile void* address, uint32_t countInDwords);
+std::uint32_t APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize();
+std::uint32_t APS5_VABI sceAgcDcbSetPredicationDisableGetSize();
+std::uint32_t APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp b/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp
index b7beea1499..015d0ed7b2 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp
@@ -1,4 +1,26 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_REGISTERS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_REGISTERS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
+uint32_t* APS5_VABI sceAgcDcbSetCxRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+uint32_t APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize(void);
+std::uint32_t* APS5_VABI sceAgcDcbSetCxRegistersIndirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize(std::uint32_t numRegs);
+uint32_t* APS5_VABI sceAgcDcbSetShRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+std::uint32_t APS5_VABI sceAgcDcbSetShRegisterDirectGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetShRegistersIndirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize(std::uint32_t numRegs);
+uint32_t* APS5_VABI sceAgcDcbSetUcRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+std::uint32_t APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetUcRegistersIndirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcDcbSetUcRegistersIndirectGetSize(std::uint32_t numRegs);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp b/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp
index 3d5d6cac71..562ab7678f 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_WORKLOAD_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_WORKLOAD_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetWorkloadComplete(CommandBuffer* buf, uint32_t streamId, uint32_t workloadId);
+uint32_t* APS5_VABI sceAgcDcbSetWorkloadsActive(CommandBuffer* buf, uint32_t streamId, const uint32_t* workloadIds, uint32_t workloadCount);
+uint32_t* APS5_VABI sceAgcDcbSetWorkloadStreamInactive(CommandBuffer* buf, uint32_t streamId);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp b/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp
index 7e88856ccc..12304f16a3 100644
--- a/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp
+++ b/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp
@@ -22,13 +22,21 @@ namespace Agc::Marker {
 std::uint32_t* Push(CommandBuffer* buf, const char* str, const char* function) {
     Agc::Command::Require(buf != nullptr, function, "null command buffer");
     const char* text = str ? str : "";
-    const std::size_t bytes = std::strlen(text) + 1;
+    const std::size_t length = std::strlen(text);
+    Agc::Command::Require(length < 0x10000u, function, "marker text too long");
+    return PushSpan(buf, text, static_cast<std::uint32_t>(length), function);
+}
+
+std::uint32_t* PushSpan(CommandBuffer* buf, const char* str, std::uint32_t length, const char* function) {
+    Agc::Command::Require(buf != nullptr, function, "null command buffer");
+    Agc::Command::Require(str != nullptr || length == 0, function, "null marker text");
+    const std::size_t bytes = std::size_t{length} + 1;
     const auto payload = static_cast<std::uint32_t>((bytes + 3) / 4);
     Agc::Command::Require(payload <= 0x4000u, function, "marker text too long");
     auto* packet = Agc::Command::Allocate(buf, payload + 1, function);
     packet[0] = Agc::Command::Header(OpcodeNop, payload + 1, CustomPushMarker << 2);
     std::memset(packet + 1, 0, payload * sizeof(std::uint32_t));
-    std::memcpy(packet + 1, text, bytes);
+    if (length != 0) std::memcpy(packet + 1, str, length);
     return packet;
 }
 
@@ -60,4 +68,16 @@ uint32_t* APS5_VABI sceAgcDcbPushMarker(CommandBuffer* buf, const char* str, uin
     return Agc::Marker::Push(buf, str, __func__);
 }
 
+uint32_t* APS5_VABI sceAgcDcbPushMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    return Agc::Marker::PushSpan(buf, str, length, __func__);
+}
+
+uint32_t* APS5_VABI sceAgcDcbSetMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    auto* packet = Agc::Marker::PushSpan(buf, str, length, __func__);
+    Agc::Marker::Pop(buf, __func__);
+    return packet;
+}
+
 }
diff --git a/core/libs/prx/libSceAgc/Export.cpp b/core/libs/prx/libSceAgc/Export.cpp
index 8e933ec1cf..3bab548078 100644
--- a/core/libs/prx/libSceAgc/Export.cpp
+++ b/core/libs/prx/libSceAgc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/include/Agc.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAgc/Misc/include/Debug.hpp b/core/libs/prx/libSceAgc/Misc/include/Debug.hpp
index 58286eb85c..6647ed5d6a 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Debug.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Debug.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_DEBUG_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_DEBUG_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDebugRaiseException(std::uint32_t exceptionId);
+int APS5_VABI sceAgcSetShaderInstrumentation(std::uint32_t flags);
+std::uint32_t APS5_VABI sceAgcGetShaderInstrumentation();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp b/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp
index 04a3d07eb6..29d7253eee 100644
--- a/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp
@@ -14,4 +14,14 @@ int APS5_VABI sceAgcGetDataPacketPayloadAddress(uint32_t** addr, uint32_t* cmd,
 int APS5_VABI sceAgcGetDataPacketPayloadAddress_0090(uint32_t** addr, uint32_t* cmd, int type);
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceAgcGetPacketSize(uint32_t* packet);
+int APS5_VABI sceAgcGetDataPacketPayloadRange(SceAgcMemoryRange* range, uint32_t* cmd, int type);
+int APS5_VABI sceAgcDcbGetSystemSoftwareVersion(uint32_t* destination, const uint32_t* packet);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/Platform.hpp b/core/libs/prx/libSceAgc/Misc/include/Platform.hpp
index fd07f976ab..37e71bb0bd 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Platform.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Platform.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_PLATFORM_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_PLATFORM_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcGetIsTrinityMode(bool* isTrinityMode);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp b/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp
index c7eb4fea76..f8934d9fb0 100644
--- a/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp
@@ -4,6 +4,18 @@
 #include <cstdint>
 
 extern "C" {
-int APS5_VABI sceAgcGetDefaultCxStateFlat(void* out_state, std::uint32_t size);
+int APS5_VABI sceAgcGetDefaultCxStateFlat(void* outState, std::uint32_t size);
 }
+
+#include "SceShaders.hpp"
+
+extern "C" {
+
+void* APS5_VABI sceAgcGetRegisterDefaults();
+void* APS5_VABI sceAgcGetRegisterDefaultsInternal();
+void* APS5_VABI sceAgcGetRegisterDefaults2(std::uint32_t version);
+void* APS5_VABI sceAgcGetRegisterDefaults2Internal(std::uint32_t version);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp b/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp
index 834dcdd962..3f0602453c 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SEMAPHORE_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SEMAPHORE_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSetAmmSemaphoreMemory(void* memory, std::uint64_t sizeInBytes);
+int APS5_VABI sceAgcGetSemaphoreLabel(std::uint32_t index, void** label);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp b/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp
index 0927dc9e51..d90e4d427e 100644
--- a/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp
@@ -10,7 +10,16 @@ struct SizeAlign {
     std::size_t m_align;
 };
 
-extern "C" int APS5_VABI sceAgcFuseShaderHalves_0200(Shader* fused_result, const Shader* front, const Shader* back, void* scratch_mem);
+extern "C" int APS5_VABI sceAgcFuseShaderHalves_0200(Shader* fusedResult, const Shader* front, const Shader* back, void* scratchMem);
 extern "C" int APS5_VABI sceAgcGetFusedShaderSize_0080(SizeAlign* dst, const Shader* front, const Shader* back);
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcFuseShaderHalves_nid_postfix(Shader* fusedResult, const Shader* front, const Shader* back, void* scratchMem);
+int APS5_VABI sceAgcUpdateInterpolantMapping_0100(ShaderRegister* regs, const Shader* vs, const Shader* ps);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp b/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp
index 25b2dd5bf7..295d3761ce 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SUSPEND_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SUSPEND_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSuspendPoint(void);
+int APS5_VABI sceAgcSetSubmitMode(std::uint32_t mode);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp b/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp
index 3ff95978d3..c7ec65c170 100644
--- a/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp
+++ b/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp
@@ -11,37 +11,55 @@
 
 namespace {
 
+constexpr int GRAPHICS5_ERROR_INVALID_ALIGNMENT = static_cast<int>(0x8a6c0002u);
+constexpr int GRAPHICS5_ERROR_OUT_OF_RANGE = static_cast<int>(0x8a6c000bu);
+constexpr int GRAPHICS5_ERROR_SEMAPHORE_MEMORY_REGISTERED = static_cast<int>(0x8a6c0048u);
+constexpr int GRAPHICS5_ERROR_SEMAPHORE_MEMORY_UNREGISTERED = static_cast<int>(0x8a6c0049u);
 constexpr std::uint64_t semaphoreMemoryAlignment = 0x4000u;
+constexpr std::uint64_t semaphoreMemoryLimit = 0x40000000u;
 constexpr std::uint64_t semaphoreLabelBytes = 32u;
 
 std::mutex semaphoreMutex;
 std::uint8_t* semaphoreMemory = nullptr;
 std::uint64_t semaphoreBytes = 0;
 
+bool aligned(std::uint64_t value) {
+    return (value & (semaphoreMemoryAlignment - 1u)) == 0;
+}
 
+int registerSemaphoreMemory(void* memory, std::uint64_t sizeInBytes, bool limited, const char* name) {
+    const auto address = reinterpret_cast<std::uintptr_t>(memory);
+    std::lock_guard lock(semaphoreMutex);
+    if (semaphoreBytes != 0) return GRAPHICS5_ERROR_SEMAPHORE_MEMORY_REGISTERED;
+    if (!aligned(sizeInBytes)) return GRAPHICS5_ERROR_INVALID_ALIGNMENT;
+    if (limited && sizeInBytes > semaphoreMemoryLimit) return GRAPHICS5_ERROR_OUT_OF_RANGE;
+    if (!aligned(address)) return GRAPHICS5_ERROR_INVALID_ALIGNMENT;
+    if (sizeInBytes != 0) {
+        Agc::Command::Require(memory != nullptr, name, "null semaphore memory with a non-zero size");
+        Agc::Command::Require(sizeInBytes - 1u <= std::numeric_limits<std::uintptr_t>::max() - address, name, "semaphore memory wraps the address space");
+        std::memset(memory, 0, sizeInBytes);
+    }
+    semaphoreMemory = static_cast<std::uint8_t*>(memory);
+    semaphoreBytes = sizeInBytes;
+    return 0;
+}
 
 }
 
 extern "C" {
 
 int APS5_VABI sceAgcSetAmmSemaphoreMemory(void* memory, std::uint64_t sizeInBytes) {
-    const auto address = reinterpret_cast<std::uintptr_t>(memory);
-    std::lock_guard lock(semaphoreMutex);
-    if (semaphoreBytes != 0) return static_cast<int>(0x8a6c0048u);
-    if (((address | sizeInBytes) & (semaphoreMemoryAlignment - 1u)) != 0) return static_cast<int>(0x8a6c0002u);
-    Agc::Command::Require(memory != nullptr && sizeInBytes != 0, __func__, "null or empty AMM semaphore memory; the console's error is unknown");
-    Agc::Command::Require(sizeInBytes - 1u <= std::numeric_limits<std::uintptr_t>::max() - address, __func__, "AMM semaphore memory wraps the address space");
-    auto* labels = static_cast<std::uint8_t*>(memory);
-    std::memset(labels, 0, sizeInBytes);
-    semaphoreMemory = labels;
-    semaphoreBytes = sizeInBytes;
-    return 0;
+    return registerSemaphoreMemory(memory, sizeInBytes, false, __func__);
+}
+
+int APS5_VABI sceAgcSetSemaphoreMemory(void* memory, std::uint64_t sizeInBytes) {
+    return registerSemaphoreMemory(memory, sizeInBytes, true, __func__);
 }
 
 int APS5_VABI sceAgcGetSemaphoreLabel(std::uint32_t index, void** label) {
     std::lock_guard lock(semaphoreMutex);
-    if (semaphoreBytes == 0) return static_cast<int>(0x8a6c0049u);
-    if (index >= semaphoreBytes / semaphoreLabelBytes) return static_cast<int>(0x8a6c000bu);
+    if (semaphoreBytes == 0) return GRAPHICS5_ERROR_SEMAPHORE_MEMORY_UNREGISTERED;
+    if (index >= semaphoreBytes / semaphoreLabelBytes) return GRAPHICS5_ERROR_OUT_OF_RANGE;
     Agc::Command::Require(label != nullptr, __func__, "null semaphore label output");
     *label = semaphoreMemory + static_cast<std::uint64_t>(index) * semaphoreLabelBytes;
     return 0;
diff --git a/core/libs/prx/libSceAgc/Patch/include/Branch.hpp b/core/libs/prx/libSceAgc/Patch/include/Branch.hpp
index f4b7c44624..2e13cbeab4 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Branch.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Branch.hpp
@@ -1,4 +1,17 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_BRANCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_BRANCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcBranchPatchSetCompareAddress(std::uint32_t* cmd, const volatile std::uint64_t* compareAddress);
+int APS5_VABI sceAgcBranchPatchSetThenTarget(std::uint32_t* cmd, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+int APS5_VABI sceAgcBranchPatchSetElseTarget(std::uint32_t* cmd, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+int APS5_VABI sceAgcBranchPatchSetThenTarget_0300(std::uint32_t* cmd, std::uint8_t cachePolicy, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+int APS5_VABI sceAgcBranchPatchSetElseTarget_0300(std::uint32_t* cmd, std::uint8_t cachePolicy, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp b/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp
index 8d81efe673..6db4bcedb9 100644
--- a/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_CONDEXEC_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_CONDEXEC_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCondExecPatchSetCommandAddress(uint32_t* cmd, const volatile uint32_t* command);
+int APS5_VABI sceAgcCondExecPatchSetEnd(uint32_t* cmd, const volatile uint32_t* buffer);
+int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress(std::uint32_t* cmd, const volatile std::uint32_t* command);
+int APS5_VABI sceAgcAsyncCondExecPatchSetEnd(std::uint32_t* cmd, const volatile std::uint32_t* buffer);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Dma.hpp b/core/libs/prx/libSceAgc/Patch/include/Dma.hpp
index d28d24df89..50dfc239b6 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Dma.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Dma.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_DMA_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_DMA_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDmaDataPatchSetDstAddressOrOffset(std::uint32_t* cmd, std::uint64_t address);
+int APS5_VABI sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate(std::uint32_t* cmd, std::uint64_t address);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp b/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp
index 72863129b7..9de388c582 100644
--- a/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp
@@ -1,4 +1,21 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_INDIRECTREGISTERS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_INDIRECTREGISTERS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchAddRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress(std::uint32_t* cmd, const volatile ShaderRegister* regs);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetShRegIndirectPatchAddRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress(std::uint32_t* cmd, const volatile ShaderRegister* regs);
+int APS5_VABI sceAgcSetShRegIndirectPatchSetNumRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetUcRegIndirectPatchAddRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress(std::uint32_t* cmd, const volatile ShaderRegister* regs);
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetNumRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Jump.hpp b/core/libs/prx/libSceAgc/Patch/include/Jump.hpp
index b5820f260d..1d6ba6899e 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Jump.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Jump.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_JUMP_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_JUMP_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcJumpPatchSetTarget(uint32_t* cmd, const volatile uint32_t* target, uint32_t sizeInDwords);
+int APS5_VABI sceAgcJumpPatchSetTarget_0300(uint32_t* cmd, uint64_t cachePolicy, const volatile uint32_t* target, uint32_t sizeInDwords);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Nop.hpp b/core/libs/prx/libSceAgc/Patch/include/Nop.hpp
index 9958a2cbc6..390c3de34c 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Nop.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Nop.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_NOP_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_NOP_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcSetNop(CommandBuffer* buf, std::uint32_t sizeDw);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp b/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp
index eb06c3a58d..7c7d61b7cc 100644
--- a/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_QUEUEENDOFPIPEACTION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_QUEUEENDOFPIPEACTION_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchAddress(std::uint32_t* cmd, const volatile Label* address);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchData(uint32_t* cmd, uint64_t data);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchGcrCntl(std::uint32_t* cmd, std::uint16_t gcrControl);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchType(std::uint32_t* cmd, std::uint8_t action);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp b/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp
index 52e1bc2625..9752bd43da 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_REWIND_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_REWIND_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcRewindPatchSetRewindState(uint32_t* cmd, uint8_t state);
+int APS5_VABI sceAgcAsyncRewindPatchSetRewindState(std::uint32_t* cmd, std::uint8_t state);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp b/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp
index 8e14191a5e..0bdd3d5fd6 100644
--- a/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp
@@ -1,4 +1,22 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_WAITREGMEM_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_WAITREGMEM_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcWaitRegMemPatchAddress(std::uint32_t* cmd, const volatile void* address);
+int APS5_VABI sceAgcWaitRegMemPatchReference(std::uint32_t* cmd, std::uint32_t reference);
+int APS5_VABI sceAgcWaitRegMemPatchMask(std::uint32_t* cmd, std::uint32_t mask);
+int APS5_VABI sceAgcWaitRegMemPatchCompareFunction(std::uint32_t* cmd, std::uint8_t compareFunction);
+int APS5_VABI sceAgcWriteDataPatchSetAddressOrOffset(std::uint32_t* cmd, std::uint64_t address);
+int APS5_VABI sceAgcAsyncWriteDataPatchSetAddressOrOffset(std::uint32_t* cmd, std::uint64_t address);
+int APS5_VABI sceAgcWriteDataPatchSetDst(std::uint32_t* cmd, std::uint8_t dst);
+int APS5_VABI sceAgcAsyncWriteDataPatchSetDst(std::uint32_t* cmd, std::uint8_t dst);
+int APS5_VABI sceAgcWriteDataPatchSetCachePolicy(std::uint32_t* cmd, std::uint8_t cachePolicy);
+int APS5_VABI sceAgcAsyncWriteDataPatchSetCachePolicy(std::uint32_t* cmd, std::uint8_t cachePolicy);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Predication/include/Predication.hpp b/core/libs/prx/libSceAgc/Predication/include/Predication.hpp
index 7ae84c8a76..cad10cd236 100644
--- a/core/libs/prx/libSceAgc/Predication/include/Predication.hpp
+++ b/core/libs/prx/libSceAgc/Predication/include/Predication.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PREDICATION_INCLUDE_PREDICATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PREDICATION_INCLUDE_PREDICATION_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSetPacketPredication(uint32_t* packet, uint32_t predication);
+int APS5_VABI sceAgcSetRangePredication(uint32_t* start, const volatile uint32_t* end, uint32_t predication);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp b/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp
index 68117f4735..044d288596 100644
--- a/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp
+++ b/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_CREATESHADER_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_CREATESHADER_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCreateShader(Shader** dst, void* header, const volatile void* code);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/include/GsOversubscription.hpp b/core/libs/prx/libSceAgc/Shader/include/GsOversubscription.hpp
new file mode 100644
index 0000000000..b454416920
--- /dev/null
+++ b/core/libs/prx/libSceAgc/Shader/include/GsOversubscription.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcGetGsOversubscription(ShaderRegister* regs, const Shader* gs, std::uint32_t budget, float factor);
+
+}
diff --git a/core/libs/prx/libSceAgc/Shader/include/GsPrimPayload.hpp b/core/libs/prx/libSceAgc/Shader/include/GsPrimPayload.hpp
new file mode 100644
index 0000000000..d72b485767
--- /dev/null
+++ b/core/libs/prx/libSceAgc/Shader/include/GsPrimPayload.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcGetGsPrimPayload(std::uint32_t* payload, const Shader* gs);
+
+}
diff --git a/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp b/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp
index 91ffb9eeb8..7085d35fe0 100644
--- a/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp
+++ b/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp
@@ -1,4 +1,17 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_INTERPOLANTMAPPING_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_INTERPOLANTMAPPING_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcCreateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcUpdateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcCreateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcUpdateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/include/LinkShaders.hpp b/core/libs/prx/libSceAgc/Shader/include/LinkShaders.hpp
new file mode 100644
index 0000000000..99d9e328a3
--- /dev/null
+++ b/core/libs/prx/libSceAgc/Shader/include/LinkShaders.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcLinkShaders(ShaderRegister* context, ShaderRegister* primitive, const void* reserved, const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType);
+
+}
diff --git a/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp b/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp
index 1dda27a825..090a9a78e6 100644
--- a/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp
+++ b/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_PRIMSTATE_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_PRIMSTATE_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCreatePrimState(ShaderRegister* cxRegs, ShaderRegister* ucRegs, const Shader* hs, const Shader* gs, std::uint32_t primType);
+int APS5_VABI sceAgcUpdatePrimState(ShaderRegister* cxRegs, ShaderRegister* ucRegs, std::uint32_t primType);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp b/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp
index 029ec1c099..79209401f3 100644
--- a/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp
+++ b/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsOversubscription.hpp"
 #include <algorithm>
 #include <cmath>
 #include <cstdint>
diff --git a/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp b/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp
index 722ade98c6..2815c5a02b 100644
--- a/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp
+++ b/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsPrimPayload.hpp"
 #include <cstdint>
 #include <stdexcept>
 #include <string>
diff --git a/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp b/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp
index 59a43354c8..8b6a8ff132 100644
--- a/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp
+++ b/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Shader/include/PrimState.hpp"
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
 #include "SceShaders.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ShaderPreparationScope.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -6,9 +9,6 @@
 #include <array>
 #include <algorithm>
 
-extern "C" int APS5_VABI sceAgcCreatePrimState(ShaderRegister*, ShaderRegister*, const Shader*, const Shader*, std::uint32_t);
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister*, const Shader*, const Shader*);
-
 extern "C" int APS5_VABI sceAgcLinkShaders(ShaderRegister* context, ShaderRegister* primitive,
     const void* reserved, const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) {
     using namespace ShaderRegs;
diff --git a/core/libs/prx/libSceAgc/Unimplemented.cpp b/core/libs/prx/libSceAgc/Unimplemented.cpp
index d7751bec51..919f2d8b77 100644
--- a/core/libs/prx/libSceAgc/Unimplemented.cpp
+++ b/core/libs/prx/libSceAgc/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/include/Agc.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,39 +6,19 @@
 
 extern "C" {
 
-std::uint32_t* APS5_VABI sceAgcAcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
-std::uint32_t* APS5_VABI sceAgcAcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
 int APS5_VABI sceAgcAcquireMemSetEngine(std::uint32_t* packet, std::uint8_t engine) {
  NotImplemented_nid_no_patch(__func__);
  return 0;
 }
 
-std::uint32_t* APS5_VABI sceAgcDcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
-std::uint32_t* APS5_VABI sceAgcDcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
-int APS5_VABI sceAgcSetSemaphoreMemory(void* memory, std::uint64_t size) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
 std::uint32_t* APS5_VABI sceAgcCbMemsetExclusive(CommandBuffer* buffer, void* destination, const void* pattern, std::uint64_t size) {
  NotImplemented_nid_no_patch(__func__);
  return 0;
 }
 
+int APS5_VABI sceAgcAcbInitializeDefaultHardwareState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceAgc/include/Agc.hpp b/core/libs/prx/libSceAgc/include/Agc.hpp
new file mode 100644
index 0000000000..e600558de3
--- /dev/null
+++ b/core/libs/prx/libSceAgc/include/Agc.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSuspendPointAndCheckStatus(void);
+std::uint32_t* APS5_VABI sceAgcAcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+std::uint32_t* APS5_VABI sceAgcAcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+int APS5_VABI sceAgcAcquireMemSetEngine(std::uint32_t* packet, std::uint8_t engine);
+std::uint32_t* APS5_VABI sceAgcDcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+std::uint32_t* APS5_VABI sceAgcDcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+int APS5_VABI sceAgcSetSemaphoreMemory(void* memory, std::uint64_t size);
+std::uint32_t* APS5_VABI sceAgcCbMemsetExclusive(CommandBuffer* buffer, void* destination, const void* pattern, std::uint64_t size);
+
+int APS5_VABI sceAgcAcbInitializeDefaultHardwareState();
+
+}
diff --git a/core/libs/prx/libSceAgc/libSceAgc.hpp b/core/libs/prx/libSceAgc/libSceAgc.hpp
new file mode 100644
index 0000000000..407e5b809c
--- /dev/null
+++ b/core/libs/prx/libSceAgc/libSceAgc.hpp
@@ -0,0 +1,51 @@
+#pragma once
+
+#include "prx/libSceAgc/Acb/include/Control.hpp"
+#include "prx/libSceAgc/Acb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
+#include "prx/libSceAgc/Cb/include/Branch.hpp"
+#include "prx/libSceAgc/Cb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp"
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Instancing.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Stats.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Control.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Dispatch.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
+#include "prx/libSceAgc/DcbState/include/Display.hpp"
+#include "prx/libSceAgc/DcbState/include/Init.hpp"
+#include "prx/libSceAgc/DcbState/include/Marker.hpp"
+#include "prx/libSceAgc/DcbState/include/Predication.hpp"
+#include "prx/libSceAgc/DcbState/include/Registers.hpp"
+#include "prx/libSceAgc/DcbState/include/Workload.hpp"
+#include "prx/libSceAgc/include/Agc.hpp"
+#include "prx/libSceAgc/Misc/include/Debug.hpp"
+#include "prx/libSceAgc/Misc/include/PacketInfo.hpp"
+#include "prx/libSceAgc/Misc/include/Platform.hpp"
+#include "prx/libSceAgc/Misc/include/RegisterDefaults.hpp"
+#include "prx/libSceAgc/Misc/include/Semaphore.hpp"
+#include "prx/libSceAgc/Misc/include/ShaderFusion.hpp"
+#include "prx/libSceAgc/Misc/include/StaticBuffer.hpp"
+#include "prx/libSceAgc/Misc/include/Suspend.hpp"
+#include "prx/libSceAgc/Patch/include/Branch.hpp"
+#include "prx/libSceAgc/Patch/include/CondExec.hpp"
+#include "prx/libSceAgc/Patch/include/Dma.hpp"
+#include "prx/libSceAgc/Patch/include/IndirectRegisters.hpp"
+#include "prx/libSceAgc/Patch/include/Jump.hpp"
+#include "prx/libSceAgc/Patch/include/Nop.hpp"
+#include "prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp"
+#include "prx/libSceAgc/Patch/include/Rewind.hpp"
+#include "prx/libSceAgc/Patch/include/WaitRegMem.hpp"
+#include "prx/libSceAgc/Predication/include/Predication.hpp"
+#include "prx/libSceAgc/Shader/include/CreateShader.hpp"
+#include "prx/libSceAgc/Shader/include/GsOversubscription.hpp"
+#include "prx/libSceAgc/Shader/include/GsPrimPayload.hpp"
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
+#include "prx/libSceAgc/Shader/include/PrimState.hpp"
diff --git a/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp b/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp
index bbc5416bd3..3315cd1312 100644
--- a/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp
+++ b/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp
@@ -1,14 +1,11 @@
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <array>
 #include <cstdio>
 #include <cstdint>
 
-extern "C" std::uint32_t APS5_VABI sceAgcAcbAtomicGdsGetSize();
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode,
-    std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask,
-    std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
-
 int main() {
     constexpr std::uint32_t expectedSize = 11u * sizeof(std::uint32_t);
     if (sceAgcAcbAtomicGdsGetSize() != expectedSize) {
diff --git a/core/libs/prx/libSceAgc/tests/BranchPatch.cpp b/core/libs/prx/libSceAgc/tests/BranchPatch.cpp
index 58afe9b1c9..24c0f213b0 100644
--- a/core/libs/prx/libSceAgc/tests/BranchPatch.cpp
+++ b/core/libs/prx/libSceAgc/tests/BranchPatch.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/Patch/include/Branch.hpp"
+#include "prx/libSceAgc/Cb/include/Branch.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,16 +9,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcCbBranch(CommandBuffer*, std::uint8_t, std::uint8_t, const volatile std::uint64_t*, std::uint64_t, std::uint64_t, std::uint8_t, const volatile std::uint32_t*, std::uint32_t, std::uint8_t, const volatile std::uint32_t*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbBranchGetSize();
-int APS5_VABI sceAgcBranchPatchSetCompareAddress(std::uint32_t*, const volatile std::uint64_t*);
-int APS5_VABI sceAgcBranchPatchSetThenTarget(std::uint32_t*, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcBranchPatchSetElseTarget(std::uint32_t*, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcBranchPatchSetThenTarget_0300(std::uint32_t*, std::uint8_t, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcBranchPatchSetElseTarget_0300(std::uint32_t*, std::uint8_t, const volatile std::uint32_t*, std::uint32_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp b/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp
index 69186e10ba..f08ab6e67b 100644
--- a/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp
+++ b/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Cb/include/Branch.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <array>
@@ -5,11 +6,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcCbCondWrite(CommandBuffer*, std::uint32_t, std::uint32_t, const volatile void*, std::uint32_t, const volatile void*, std::uint32_t, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbCondWriteGetSize();
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/Commands.cpp b/core/libs/prx/libSceAgc/tests/Commands.cpp
index e497ed1fa5..a9ec29ed76 100644
--- a/core/libs/prx/libSceAgc/tests/Commands.cpp
+++ b/core/libs/prx/libSceAgc/tests/Commands.cpp
@@ -1,3 +1,23 @@
+#include "prx/libSceAgc/include/Agc.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Registration.hpp"
+#include "prx/libSceAgc/Patch/include/WaitRegMem.hpp"
+#include "prx/libSceAgc/Patch/include/Nop.hpp"
+#include "prx/libSceAgc/Misc/include/Suspend.hpp"
+#include "prx/libSceAgc/Misc/include/RegisterDefaults.hpp"
+#include "prx/libSceAgc/Misc/include/PacketInfo.hpp"
+#include "prx/libSceAgc/Misc/include/Debug.hpp"
+#include "prx/libSceAgc/DcbState/include/Workload.hpp"
+#include "prx/libSceAgc/DcbState/include/Marker.hpp"
+#include "prx/libSceAgc/DcbState/include/Init.hpp"
+#include "prx/libSceAgc/DcbState/include/Display.hpp"
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Control.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Instancing.hpp"
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libSceAgc/Command/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/RegisterDefaults.hpp"
@@ -10,53 +30,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbEventWrite(CommandBuffer* buf, std::uint8_t eventType, const volatile void* address);
-extern "C" std::uint64_t APS5_VABI sceAgcDcbEventWriteGetSize(std::uint8_t eventType);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbResetQueue(CommandBuffer* buf, std::uint32_t op, std::uint32_t state);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbClearState(CommandBuffer* buf, std::uint32_t command);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetFlip(CommandBuffer* buf, std::uint32_t handle, std::int32_t index, std::uint32_t mode, std::int64_t argument);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbWaitUntilSafeForRendering(CommandBuffer* buf, std::uint32_t handle, std::uint32_t index);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetFlip(CommandBuffer* buf, std::uint32_t handle, std::int32_t index, std::uint32_t mode, std::int64_t argument);
-extern "C" int APS5_VABI sceAgcSuspendPoint();
-extern "C" int APS5_VABI sceAgcInit(std::uint32_t version);
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults();
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults2(std::uint32_t version);
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaultsInternal();
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults2Internal(std::uint32_t version);
-extern "C" int APS5_VABI sceAgcGetDefaultCxStateFlat(void* out_state, std::uint32_t size);
-extern "C" int APS5_VABI sceAgcInit_0090(std::uint32_t* state, std::uint32_t version);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbDrawIndexAuto(CommandBuffer* buf, std::uint32_t indexCount, std::uint64_t modifier);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirect(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint64_t modifier);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirectMulti(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint32_t countIndirect, std::uint32_t maxCountOrCount, const volatile void* countAddress, std::uint32_t strideInBytes, std::uint64_t modifier);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchAddress(std::uint32_t* cmd, const volatile void* address);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchCompareFunction(std::uint32_t* cmd, std::uint8_t compareFunction);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchReference(std::uint32_t* cmd, std::uint32_t reference);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchMask(std::uint32_t* cmd, std::uint32_t mask);
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadAddress_0090(std::uint32_t** addr, std::uint32_t* cmd, int type);
-extern "C" std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbContextStateOp_0100(CommandBuffer* buf, std::uint32_t operation);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbPushMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbPopMarker(CommandBuffer* buf);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetWorkloadComplete(CommandBuffer* buf, std::uint32_t stream_id, std::uint32_t workload_id);
-extern "C" int APS5_VABI sceAgcDriverRegisterWorkloadStream(std::uint32_t stream_id, const void* stream);
-extern "C" int APS5_VABI sceAgcDriverUnregisterWorkloadStream(std::uint32_t stream_id);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetWorkloadsActive(CommandBuffer* buf, std::uint32_t stream_id, const std::uint32_t* workload_ids, std::uint32_t workload_count);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetWorkloadStreamInactive(CommandBuffer* buf, std::uint32_t streamId);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadsActive(CommandBuffer* buf, std::uint32_t streamId, const std::uint32_t* workloadIds, std::uint32_t workloadCount);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadComplete(CommandBuffer* buf, std::uint32_t streamId, std::uint32_t workloadId);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadStreamInactive(CommandBuffer* buf, std::uint32_t streamId);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetIndexBuffer(CommandBuffer* buf, std::uint64_t indexAddress);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetIndexIndirectArgs(CommandBuffer* buf, std::uint64_t attributeAddress, std::uint32_t attributeIndex);
-extern "C" std::uint32_t APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize();
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetBaseIndirectArgs(CommandBuffer* buf, std::uint32_t shaderType, const volatile void* indirectBaseAddr);
-extern "C" std::uint32_t* APS5_VABI sceAgcSetNop(CommandBuffer* buf, std::uint32_t sizeDw);
-extern "C" int APS5_VABI sceAgcDebugRaiseException(std::uint32_t exceptionId);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode, std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask, std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
-
 namespace {
 
 void check(bool condition, const char* message) {
@@ -225,6 +198,29 @@ void testMarkers() {
     expectFailure([] { sceAgcAcbSetMarker(nullptr, "frame", 0); });
 }
 
+void testMarkerSpans() {
+    Storage dcb;
+    Storage acb;
+    const char text[] = "framebuffer";
+    const auto* acbPush = sceAgcAcbPushMarkerSpan(&acb.buffer, text, 5, 0x00ff00u);
+    const auto* dcbPush = sceAgcDcbPushMarkerSpan(&dcb.buffer, text, 5, 0xff0000u);
+    check(acbPush == acb.words.data() && acbPush[0] == Agc::Command::Header(0x10, 3, 0x0bu << 2u), "ACB push marker span header mismatch");
+    check(std::strcmp(reinterpret_cast<const char*>(acbPush + 1), "frame") == 0, "ACB push marker span does not stop at its length");
+    check(dcbPush == dcb.words.data(), "DCB push marker span did not return its packet");
+    const auto* acbSet = sceAgcAcbSetMarkerSpan(&acb.buffer, nullptr, 0, 0);
+    const auto* dcbSet = sceAgcDcbSetMarkerSpan(&dcb.buffer, nullptr, 0, 0);
+    check(acbSet == acb.words.data() + 3 && dcbSet == dcb.words.data() + 3, "set marker span did not return its push packet");
+    check(acbSet[0] == Agc::Command::Header(0x10, 2, 0x0bu << 2u) && acbSet[1] == 0 && acbSet[2] == Agc::Command::Header(0x10, 2, 0x0cu << 2u), "ACB set marker span is not a push and pop pair");
+    check(dcb.words == acb.words && acb.buffer.cursor_up == acb.words.data() + 7, "ACB and DCB marker spans differ");
+    Storage plain;
+    sceAgcAcbPushMarker(&plain.buffer, "frame", 0);
+    check(std::equal(plain.words.begin(), plain.words.begin() + 3, acb.words.begin()), "marker span differs from the same text pushed whole");
+    expectFailure([] { sceAgcAcbPushMarkerSpan(nullptr, "frame", 5, 0); });
+    expectFailure([] { sceAgcAcbPushMarker(nullptr, reinterpret_cast<const char*>(std::uintptr_t{0x10}), 0); });
+    expectFailure([] { sceAgcDcbSetMarkerSpan(nullptr, "frame", 5, 0); });
+    expectFailure([&] { sceAgcDcbPushMarkerSpan(&dcb.buffer, nullptr, 4, 0); });
+}
+
 void testWorkloads() {
     Storage dcb;
     const std::uint32_t ids[2] = {3, 4};
@@ -822,6 +818,7 @@ int main(int argc, char** argv) {
         testClearState();
         testIndexedIndirectDraws();
         testMarkers();
+        testMarkerSpans();
         testWorkloads();
         testWorkloadStreams();
         testIndexBuffer();
diff --git a/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp b/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp
index 762f40b1a7..b5939e0c46 100644
--- a/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp
+++ b/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Patch/include/CondExec.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,15 +10,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbCondExec(CommandBuffer*, const volatile std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcAcbCondExec(CommandBuffer*, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcCondExecPatchSetCommandAddress(std::uint32_t*, const volatile std::uint32_t*);
-int APS5_VABI sceAgcCondExecPatchSetEnd(std::uint32_t*, const volatile std::uint32_t*);
-int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress(std::uint32_t*, const volatile std::uint32_t*);
-int APS5_VABI sceAgcAsyncCondExecPatchSetEnd(std::uint32_t*, const volatile std::uint32_t*);
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp b/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp
index 3de0a5eda6..6d2e583e47 100644
--- a/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp
+++ b/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -7,10 +8,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" std::uint64_t APS5_VABI sceAgcDcbContextStateOpGetSize(std::uint32_t operation);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbContextStateOp(CommandBuffer* buf, std::uint32_t operation);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbContextStateOp_0100(CommandBuffer* buf, std::uint32_t operation);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/DmaData.cpp b/core/libs/prx/libSceAgc/tests/DmaData.cpp
index 77c80988f2..880035d394 100644
--- a/core/libs/prx/libSceAgc/tests/DmaData.cpp
+++ b/core/libs/prx/libSceAgc/tests/DmaData.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,13 +9,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcAcbDmaData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t APS5_VABI sceAgcAcbDmaDataGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbDmaData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint32_t, std::uint8_t, std::uint8_t, std::uint8_t);
-std::uint32_t APS5_VABI sceAgcDcbDmaDataGetSize();
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp b/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp
index cf78ada4a3..5421cb5733 100644
--- a/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp
+++ b/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp
@@ -1,3 +1,8 @@
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Control.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -8,15 +13,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize();
-std::uint32_t APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize();
-std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer*, std::uint8_t, std::uint16_t, std::uint8_t, std::uint8_t, const volatile Label*, std::uint8_t, std::uint64_t, std::uint16_t, std::uint16_t, std::uint8_t, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbAtomicGdsGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbAtomicGds_0900(CommandBuffer*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint16_t, std::uint16_t, std::uint32_t, std::uint32_t, std::uint64_t, std::uint64_t);
-std::uint32_t* APS5_VABI sceAgcDcbAtomicGds(CommandBuffer*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint16_t, std::uint16_t, std::uint32_t, std::uint32_t, std::uint64_t, std::uint64_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp b/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp
index 7c312c879d..3666a2d338 100644
--- a/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp
+++ b/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsOversubscription.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -11,8 +12,6 @@
 #include <limits>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceAgcGetGsOversubscription(ShaderRegister* regs, const Shader* gs, std::uint32_t budget, float factor);
-
 namespace {
 
 using Registers = std::array<ShaderRegister, 2>;
diff --git a/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp b/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp
index 60f3d29b77..396311e9ee 100644
--- a/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp
+++ b/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsPrimPayload.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -9,8 +10,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" int APS5_VABI sceAgcGetGsPrimPayload(std::uint32_t* payload, const Shader* gs);
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xccccccccu;
diff --git a/core/libs/prx/libSceAgc/tests/InstrumentationQuerySize.cpp b/core/libs/prx/libSceAgc/tests/InstrumentationQuerySize.cpp
index 7f75026d39..66e572d0b6 100644
--- a/core/libs/prx/libSceAgc/tests/InstrumentationQuerySize.cpp
+++ b/core/libs/prx/libSceAgc/tests/InstrumentationQuerySize.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/Misc/include/Debug.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Stats.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 
@@ -5,13 +7,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceAgcSetShaderInstrumentation(std::uint32_t);
-std::uint32_t APS5_VABI sceAgcGetShaderInstrumentation();
-std::uint32_t APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize(std::int32_t);
-std::uint32_t APS5_VABI sceAgcDcbEndOcclusionQueryGetSize();
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp b/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp
index 1b38f7df08..2fbd372623 100644
--- a/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp
+++ b/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -11,12 +12,6 @@
 #include <stdexcept>
 #include <span>
 
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-extern "C" int APS5_VABI sceAgcUpdateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-extern "C" int APS5_VABI sceAgcUpdateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-
 namespace {
 
 using Registers = std::array<ShaderRegister, 32>;
diff --git a/core/libs/prx/libSceAgc/tests/PacketInfo.cpp b/core/libs/prx/libSceAgc/tests/PacketInfo.cpp
index 5e95906b5a..9054c828ba 100644
--- a/core/libs/prx/libSceAgc/tests/PacketInfo.cpp
+++ b/core/libs/prx/libSceAgc/tests/PacketInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Misc/include/PacketInfo.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 
@@ -7,8 +8,6 @@
 #include <stdexcept>
 #include <utility>
 
-extern "C" std::uint32_t APS5_VABI sceAgcGetPacketSize(std::uint32_t* packet);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/PayloadRange.cpp b/core/libs/prx/libSceAgc/tests/PayloadRange.cpp
index f920eb0384..d070135e43 100644
--- a/core/libs/prx/libSceAgc/tests/PayloadRange.cpp
+++ b/core/libs/prx/libSceAgc/tests/PayloadRange.cpp
@@ -8,10 +8,6 @@
 #include <stdexcept>
 #include <tuple>
 
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadRange(SceAgcMemoryRange* range, std::uint32_t* cmd, int type);
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadAddress(std::uint32_t** addr, std::uint32_t* cmd, int type);
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadAddress_0090(std::uint32_t** addr, std::uint32_t* cmd, int type);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/Platform.cpp b/core/libs/prx/libSceAgc/tests/Platform.cpp
index daa0634cf3..5ed2b2aea1 100644
--- a/core/libs/prx/libSceAgc/tests/Platform.cpp
+++ b/core/libs/prx/libSceAgc/tests/Platform.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Misc/include/Platform.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 
@@ -5,8 +6,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceAgcGetIsTrinityMode(bool* isTrinityMode);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/Predication.cpp b/core/libs/prx/libSceAgc/tests/Predication.cpp
index 32a6619ed5..7d9511f10f 100644
--- a/core/libs/prx/libSceAgc/tests/Predication.cpp
+++ b/core/libs/prx/libSceAgc/tests/Predication.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Predication/include/Predication.hpp"
+#include "prx/libSceAgc/DcbState/include/Predication.hpp"
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <array>
@@ -5,17 +8,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbSetPredication(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, const volatile void*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetPredicationDisableGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbSetIndexCount(CommandBuffer*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetIndexBuffer(CommandBuffer*, std::uint64_t);
-int APS5_VABI sceAgcSetPacketPredication(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetRangePredication(std::uint32_t*, const volatile std::uint32_t*, std::uint32_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp b/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp
index b1e702d246..4e7791491c 100644
--- a/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp
+++ b/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/DcbState/include/Display.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,13 +9,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcAcbPrimeUtcl2(CommandBuffer*, const volatile void*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcAcbPrimeUtcl2GetSize();
-std::uint32_t* APS5_VABI sceAgcDcbPrimeUtcl2(CommandBuffer*, const volatile void*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbPrimeUtcl2GetSize();
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp b/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp
index 5e6be0c709..4c52d26b8a 100644
--- a/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp
+++ b/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp
@@ -1,39 +1,14 @@
+#include "prx/libSceAgc/Patch/include/IndirectRegisters.hpp"
+#include "prx/libSceAgc/DcbState/include/Registers.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
 #include <array>
 #include <cstdio>
+#include <cstring>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterRangeDirect(CommandBuffer*, std::uint32_t, const std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer*, std::uint32_t, const std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbSetUcRegisterRangeDirect(CommandBuffer*, std::uint32_t, const std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetCxRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t* APS5_VABI sceAgcDcbSetShRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t* APS5_VABI sceAgcDcbSetUcRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetShRegisterDirectGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbSetCxRegistersIndirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetShRegistersIndirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetUcRegistersIndirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize(std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize(std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetUcRegistersIndirectGetSize(std::uint32_t);
-int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetShRegIndirectPatchSetNumRegisters(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetUcRegIndirectPatchSetNumRegisters(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress(std::uint32_t*, const volatile ShaderRegister*);
-int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress(std::uint32_t*, const volatile ShaderRegister*);
-int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress(std::uint32_t*, const volatile ShaderRegister*);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegistersDirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbSetUcRegistersDirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbSetShRegistersDirectGetSize(std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbSetUcRegistersDirectGetSize(std::uint32_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
@@ -125,6 +100,26 @@ void testRangeFromAnyByte() {
     }
 }
 
+void testListFromAnyByte() {
+    const std::array writers{sceAgcCbSetShRegistersDirect, sceAgcCbSetUcRegistersDirect};
+    const std::array opcodes{0x7600u, 0x7900u};
+    const std::array<ShaderRegister, 3> registers{{{0x10u, 0x11223344u}, {0x11u, 0x55667788u}, {0x30u, 0x99aabbccu}}};
+    for (std::size_t i = 0; i < writers.size(); ++i) {
+        for (const std::size_t offset : {1u, 2u, 3u, 5u}) {
+            alignas(16) std::array<unsigned char, 48> bytes{};
+            std::memcpy(bytes.data() + offset, registers.data(), sizeof(registers));
+            Storage storage;
+            storage.words.fill(0xabcdef01u);
+            const auto* list = reinterpret_cast<const volatile ShaderRegister*>(bytes.data() + offset);
+            auto* packet = writers[i](&storage.buffer, list, static_cast<std::uint32_t>(registers.size()));
+            const std::array<std::uint32_t, 7> expected{0xc0020000u | opcodes[i], 0x10u, 0x11223344u, 0x55667788u, 0xc0010000u | opcodes[i], 0x30u, 0x99aabbccu};
+            check(packet == storage.words.data() && storage.buffer.cursor_up == packet + expected.size(), "unaligned register list allocation mismatch");
+            check(std::equal(expected.begin(), expected.end(), packet), "unaligned register list was not read byte for byte");
+            check(packet[expected.size()] == 0xabcdef01u, "unaligned register list overwrote the following word");
+        }
+    }
+}
+
 void testIndirect() {
     const std::array writers{sceAgcDcbSetCxRegistersIndirect, sceAgcDcbSetShRegistersIndirect, sceAgcDcbSetUcRegistersIndirect};
     const std::array sizes{sceAgcDcbSetCxRegistersIndirectGetSize, sceAgcDcbSetShRegistersIndirectGetSize, sceAgcDcbSetUcRegistersIndirectGetSize};
@@ -239,6 +234,7 @@ int main() {
         testDirect();
         testConfig();
         testRangeFromAnyByte();
+        testListFromAnyByte();
         testIndirect();
         testIndirectPlaceholder();
         testDirectList();
diff --git a/core/libs/prx/libSceAgc/tests/Semaphore.cpp b/core/libs/prx/libSceAgc/tests/Semaphore.cpp
index 789a303ad8..3d4ff1c16d 100644
--- a/core/libs/prx/libSceAgc/tests/Semaphore.cpp
+++ b/core/libs/prx/libSceAgc/tests/Semaphore.cpp
@@ -1,3 +1,8 @@
+#include "prx/libSceAgc/include/Agc.hpp"
+#include "prx/libSceAgc/Misc/include/Semaphore.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -12,20 +17,19 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" int APS5_VABI sceAgcSetAmmSemaphoreMemory(void* memory, std::uint64_t sizeInBytes);
-extern "C" int APS5_VABI sceAgcGetSemaphoreLabel(std::uint32_t index, void** label);
-extern "C" std::uint32_t* APS5_VABI sceAgcCbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint32_t operation, std::uint32_t modifier, std::uint32_t value);
-
 namespace {
 
 constexpr std::uint64_t blockBytes = 0x4000u;
 constexpr std::uint64_t labelBytes = 32u;
-constexpr std::uint64_t counterBytes = 8u;
 constexpr std::uint64_t memoryBytes = 2u * blockBytes;
 constexpr std::uint64_t storageBytes = 4u * blockBytes;
 constexpr std::uint32_t labelCount = static_cast<std::uint32_t>(memoryBytes / labelBytes);
 constexpr std::uint8_t guardByte = 0xa5u;
-constexpr std::uint8_t counterByte = 0x5au;
+constexpr std::uint8_t labelByte = 0x5au;
+constexpr int InvalidAlignment = static_cast<int>(0x8a6c0002u);
+constexpr int OutOfRange = static_cast<int>(0x8a6c000bu);
+constexpr int AlreadyRegistered = static_cast<int>(0x8a6c0048u);
+constexpr int NotRegistered = static_cast<int>(0x8a6c0049u);
 
 struct AlignedRelease {
     void operator()(std::uint8_t* memory) const { ::operator delete(memory, std::align_val_t{blockBytes}); }
@@ -62,28 +66,28 @@ void checkUnchanged(const std::vector<std::uint8_t>& before, const char* message
 
 void fillStorage() {
     std::fill(storage.get(), storage.get() + storageBytes, guardByte);
-    for (std::uint64_t label = 0; label < memoryBytes; label += labelBytes) {
-        std::fill(memory() + label, memory() + label + counterBytes, counterByte);
-        std::fill(memory() + label + counterBytes, memory() + label + labelBytes, std::uint8_t{0});
-    }
+    std::fill(memory(), memory() + memoryBytes, labelByte);
 }
 
 void testUnregistered() {
     std::array<void*, 3> labels{storage.get(), storage.get(), storage.get()};
-    check(sceAgcGetSemaphoreLabel(0, &labels[1]) == static_cast<int>(0x8a6c0049u), "unregistered label error mismatch");
-    check(sceAgcGetSemaphoreLabel(0, nullptr) == static_cast<int>(0x8a6c0049u), "unregistered null label error mismatch");
+    check(sceAgcGetSemaphoreLabel(0, &labels[1]) == NotRegistered, "a lookup before registration was not rejected as unregistered");
+    check(sceAgcGetSemaphoreLabel(0, nullptr) == NotRegistered, "a null lookup before registration was not rejected as unregistered");
     check(labels[0] == storage.get() && labels[1] == storage.get() && labels[2] == storage.get(), "a rejected semaphore label changed the output");
 }
 
 void testRegistrationRejections() {
     const auto before = snapshot();
     expectFailure([] { sceAgcSetAmmSemaphoreMemory(nullptr, memoryBytes); });
-    expectFailure([] { sceAgcSetAmmSemaphoreMemory(nullptr, 0); });
-    expectFailure([] { sceAgcSetAmmSemaphoreMemory(memory(), 0); });
-    check(sceAgcSetAmmSemaphoreMemory(memory() + 1, memoryBytes) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(memory() + labelBytes, blockBytes) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes - 1u) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes + labelBytes) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
+    check(sceAgcSetAmmSemaphoreMemory(memory() + 1, memoryBytes) == InvalidAlignment, "unaligned memory was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(memory() + labelBytes, blockBytes) == InvalidAlignment, "memory aligned only to a label was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes - 1u) == InvalidAlignment, "an unaligned size was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes + labelBytes) == InvalidAlignment, "a size aligned only to a label was not rejected");
+    check(sceAgcSetSemaphoreMemory(memory() + 1, blockBytes) == InvalidAlignment, "unaligned memory was not rejected by the non-AMM call");
+    check(sceAgcSetSemaphoreMemory(memory(), 0x40000000u + blockBytes) == OutOfRange, "a size above 1 GiB was not rejected by the non-AMM call");
+    check(sceAgcSetSemaphoreMemory(memory() + 1, 0x40000000u + blockBytes) == OutOfRange, "the size limit was not checked before the memory alignment");
+    check(sceAgcSetSemaphoreMemory(memory(), blockBytes - 1u) == InvalidAlignment, "the size alignment was not checked first");
+    check(sceAgcSetAmmSemaphoreMemory(nullptr, 0) == 0, "an empty registration was rejected");
     expectFailure([] {
         const auto top = std::numeric_limits<std::uintptr_t>::max() & ~static_cast<std::uintptr_t>(blockBytes - 1u);
         sceAgcSetAmmSemaphoreMemory(reinterpret_cast<void*>(top), memoryBytes);
@@ -96,7 +100,7 @@ void testRegistration() {
     std::fill(memory(), memory() + memoryBytes, std::uint8_t{0x77});
     const auto before = snapshot();
     check(sceAgcSetAmmSemaphoreMemory(memory(), memoryBytes) == 0, "registering the AMM semaphore memory failed");
-    check(std::all_of(memory(), memory() + memoryBytes, [](std::uint8_t byte) { return byte == 0; }), "registration did not clear the semaphore counters");
+    check(std::all_of(memory(), memory() + memoryBytes, [](std::uint8_t byte) { return byte == 0; }), "registration did not clear the whole semaphore memory");
     check(std::equal(before.begin(), before.begin() + blockBytes, storage.get()), "registration wrote before the semaphore memory");
     check(std::equal(before.begin() + blockBytes + memoryBytes, before.end(), memory() + memoryBytes), "registration wrote past the semaphore memory");
 }
@@ -113,7 +117,7 @@ void testLabels() {
 void testLabelRejections() {
     for (const std::uint32_t index : {labelCount, labelCount + 1u, std::numeric_limits<std::uint32_t>::max()}) {
         void* label = storage.get();
-        check(sceAgcGetSemaphoreLabel(index, &label) == static_cast<int>(0x8a6c000bu), "out-of-range label error mismatch");
+        check(sceAgcGetSemaphoreLabel(index, &label) == OutOfRange, "a label past the semaphore memory was not rejected");
         check(label == storage.get(), "a rejected semaphore label changed the output");
     }
     expectFailure([] { sceAgcGetSemaphoreLabel(0, nullptr); });
@@ -122,9 +126,10 @@ void testLabelRejections() {
 void testRepeatedRegistration() {
     std::fill(memory(), memory() + memoryBytes, std::uint8_t{0x3c});
     const auto before = snapshot();
-    check(sceAgcSetAmmSemaphoreMemory(memory(), memoryBytes) == static_cast<int>(0x8a6c0048u), "repeated registration error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(storage.get(), blockBytes) == static_cast<int>(0x8a6c0048u), "repeated registration error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(nullptr, 0) == static_cast<int>(0x8a6c0048u), "repeated registration error mismatch");
+    check(sceAgcSetAmmSemaphoreMemory(memory(), memoryBytes) == AlreadyRegistered, "a repeated registration was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(storage.get() + 1, blockBytes) == AlreadyRegistered, "registration was not checked before alignment");
+    check(sceAgcSetSemaphoreMemory(storage.get(), blockBytes) == AlreadyRegistered, "the non-AMM call did not share the registration");
+    check(sceAgcSetAmmSemaphoreMemory(nullptr, 0) == AlreadyRegistered, "an empty registration was not rejected once memory is registered");
     checkUnchanged(before, "a repeated registration changed memory");
     void* label = nullptr;
     check(sceAgcGetSemaphoreLabel(labelCount - 1u, &label) == 0 && label == memory() + memoryBytes - labelBytes, "a repeated registration replaced the semaphore memory");
@@ -180,6 +185,40 @@ void testMemSemaphore() {
     expectFailure([&] { sceAgcCbMemSemaphore(nullptr, label, 0, 0, 0); });
 }
 
+using QueueMemSemaphore = std::uint32_t* APS5_VABI (*)(CommandBuffer*, const volatile void*, std::uint8_t, std::uint8_t, std::uint8_t);
+
+void testQueueMemSemaphore(QueueMemSemaphore write) {
+    const auto* semaphore = reinterpret_cast<const volatile void*>(0x102f221d98ull);
+
+    {
+        std::array<std::uint32_t, 16> words{};
+        words.fill(0xdeadbeefu);
+        CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+        const auto* packet = write(&buffer, semaphore, 0, 1, 6);
+        check(packet == words.data(), "packet address mismatch");
+        check(packet[0] == 0xc0023900u, "MEM_SEMAPHORE header opcode mismatch");
+        check(packet[1] == 0x2f221d98u, "MEM_SEMAPHORE address low mismatch");
+        check(packet[2] == 0x10u, "MEM_SEMAPHORE address high mismatch");
+        check(packet[3] == 0xc0100000u, "MEM_SEMAPHORE signal control word mismatch");
+        check(buffer.cursor_up == words.data() + 4, "cursor did not advance by 4 words");
+        check(words[4] == 0xdeadbeefu, "words past packet modified");
+    }
+
+    {
+        std::array<std::uint32_t, 16> words{};
+        words.fill(0xdeadbeefu);
+        CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+        const auto* packet = write(&buffer, semaphore, 1, 0, 7);
+        check(packet[3] == 0xe0010000u, "MEM_SEMAPHORE wait control word mismatch");
+    }
+
+    std::array<std::uint32_t, 16> words{};
+    CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+    expectFailure([&] { write(&buffer, reinterpret_cast<const volatile void*>(1ull), 0, 1, 6); });
+    expectFailure([&] { write(&buffer, semaphore, 0, 1, 5); });
+    expectFailure([&] { write(&buffer, semaphore, 2, 0, 7); });
+}
+
 }
 
 int main() {
@@ -191,6 +230,8 @@ int main() {
         testRegistration();
         testLabels();
         testMemSemaphore();
+        testQueueMemSemaphore(sceAgcAcbMemSemaphore);
+        testQueueMemSemaphore(sceAgcDcbMemSemaphore);
         testLabelRejections();
         testRepeatedRegistration();
         storage.reset();
diff --git a/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp b/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp
index 46f7c3c8e8..6c842de199 100644
--- a/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp
+++ b/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
 #include "SceShaders.hpp"
 #include "prx/libSceAgc/Shader/include/PrimState.hpp"
 #include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
@@ -11,10 +12,6 @@
 #include <string>
 #include <iostream>
 
-extern "C" int APS5_VABI sceAgcLinkShaders(ShaderRegister*, ShaderRegister*, const void*, const Shader*, const Shader*, std::uint32_t);
-extern "C" int APS5_VABI sceAgcCreatePrimState(ShaderRegister*, ShaderRegister*, const Shader*, const Shader*, std::uint32_t);
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister*, const Shader*, const Shader*);
-
 namespace {
 std::array<ShaderRegister, 2> preparedContext;
 std::array<ShaderRegister, 3> preparedPrimitive;
diff --git a/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp b/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp
index 5f543c8707..a8307962a4 100644
--- a/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp
+++ b/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Patch/include/WaitRegMem.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,17 +10,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcAcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAgcWriteDataPatchSetAddressOrOffset(std::uint32_t*, std::uint64_t);
-int APS5_VABI sceAgcAsyncWriteDataPatchSetAddressOrOffset(std::uint32_t*, std::uint64_t);
-int APS5_VABI sceAgcWriteDataPatchSetDst(std::uint32_t*, std::uint8_t);
-int APS5_VABI sceAgcAsyncWriteDataPatchSetDst(std::uint32_t*, std::uint8_t);
-int APS5_VABI sceAgcWriteDataPatchSetCachePolicy(std::uint32_t*, std::uint8_t);
-int APS5_VABI sceAgcAsyncWriteDataPatchSetCachePolicy(std::uint32_t*, std::uint8_t);
-}
-
 namespace {
 
 constexpr std::array<std::uint32_t, 3> Payload{0x11111111u, 0x22222222u, 0x33333333u};
diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index 7e7d22b021..29669383a9 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -142,28 +142,6 @@ add_custom_command(
         VERBATIM
 )
 
-set(agcDepthSampleShaderSource ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/shaders/DepthSample.comp)
-foreach(agcDepthSampleKind IN ITEMS Single Multisample)
-    string(TOUPPER ${agcDepthSampleKind} agcDepthSampleSymbol)
-    if(agcDepthSampleKind STREQUAL "Multisample")
-        set(agcDepthSampleMultisampled 1)
-    else()
-        set(agcDepthSampleMultisampled 0)
-    endif()
-    set(agcDepthSampleShaderSpv ${agcTextureDetileGeneratedDir}/DepthSample${agcDepthSampleKind}.spv)
-    set(agcDepthSampleShaderHeader ${agcTextureDetileGeneratedDir}/DepthSample${agcDepthSampleKind}_spv.h)
-    add_custom_command(
-            OUTPUT "${agcDepthSampleShaderHeader}"
-            COMMAND ${CMAKE_COMMAND} -E make_directory "${agcTextureDetileGeneratedDir}"
-            COMMAND "$<TARGET_FILE:glslang-standalone>" -V --target-env vulkan1.1 -DMULTISAMPLED=${agcDepthSampleMultisampled} -o "${agcDepthSampleShaderSpv}" "${agcDepthSampleShaderSource}"
-            COMMAND ${CMAKE_COMMAND} -DINPUT=${agcDepthSampleShaderSpv} -DOUTPUT=${agcDepthSampleShaderHeader}
-            -DSYMBOL=DEPTH_SAMPLE_${agcDepthSampleSymbol}_SPV -P "${CMAKE_CURRENT_SOURCE_DIR}/embed_spirv.cmake"
-            DEPENDS "${agcDepthSampleShaderSource}" glslang-standalone
-            VERBATIM
-    )
-    list(APPEND agcDepthSampleShaderHeaders ${agcDepthSampleShaderHeader})
-endforeach()
-
 set(agcSampleCounterShaderSource ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/shaders/SampleCounter.comp)
 set(agcSampleCounterShaderSpv ${agcTextureDetileGeneratedDir}/SampleCounter.spv)
 set(agcSampleCounterShaderHeader ${agcTextureDetileGeneratedDir}/SampleCounter_spv.h)
@@ -225,6 +203,22 @@ foreach(agcSampleOrderVariant IN ITEMS "R8;comp;-DTEXEL_FORMAT=r8ui" "R16;comp;-
     )
     list(APPEND agcSampleOrderShaderHeaders ${agcSampleOrderShaderHeader})
 endforeach()
+foreach(agcFirstSampleClass IN ITEMS Float Uint Sint)
+    string(TOUPPER "${agcFirstSampleClass}" agcFirstSampleSymbol)
+    set(agcFirstSampleShaderSource ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/shaders/FirstSample.frag)
+    set(agcFirstSampleShaderSpv ${agcTextureDetileGeneratedDir}/FirstSample${agcFirstSampleClass}.spv)
+    set(agcFirstSampleShaderHeader ${agcTextureDetileGeneratedDir}/FirstSample${agcFirstSampleClass}_spv.h)
+    add_custom_command(
+            OUTPUT "${agcFirstSampleShaderHeader}"
+            COMMAND ${CMAKE_COMMAND} -E make_directory "${agcTextureDetileGeneratedDir}"
+            COMMAND "$<TARGET_FILE:glslang-standalone>" -V --target-env vulkan1.1 -D${agcFirstSampleSymbol}_SAMPLES=1 -o "${agcFirstSampleShaderSpv}" "${agcFirstSampleShaderSource}"
+            COMMAND ${CMAKE_COMMAND} -DINPUT=${agcFirstSampleShaderSpv} -DOUTPUT=${agcFirstSampleShaderHeader}
+            -DSYMBOL=FIRST_SAMPLE_${agcFirstSampleSymbol}_SPV -P "${CMAKE_CURRENT_SOURCE_DIR}/embed_spirv.cmake"
+            DEPENDS "${agcFirstSampleShaderSource}" glslang-standalone
+            VERBATIM
+    )
+    list(APPEND agcPresentationShaderHeaders ${agcFirstSampleShaderHeader})
+endforeach()
 foreach(agcOverlayStage IN ITEMS Vert Frag)
     string(TOLOWER "${agcOverlayStage}" agcOverlayExtension)
     string(TOUPPER "${agcOverlayStage}" agcOverlaySymbol)
@@ -313,6 +307,8 @@ set(agcDriverSources
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/ShaderDeviceProfile.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/Pm4.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/SubmissionCapture.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FrameCapture.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FrameRecorder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/VulkanDevice.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FloatFlushProbe.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/AspectFit.cpp
@@ -323,6 +319,7 @@ set(agcDriverSources
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Draw.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/DepthSurface.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/MultisampleTarget.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/FirstSampleCopy.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ColorTargetLayout.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ColorTargetTransfer.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Pipeline.cpp
@@ -330,6 +327,7 @@ set(agcDriverSources
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/PipelineCache.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/PipelineJournal.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Resources.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/DeferredDestruction.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/PlaceholderImages.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Recorder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ParallelCompare.cpp
@@ -362,7 +360,6 @@ set(agcDriverSources
         ${agcReadbackHeaders}
         ${agcMultisampleUploadHeader}
         ${agcCmaskClearShaderHeader}
-        ${agcDepthSampleShaderHeaders}
         ${agcMeshArgumentsShaderHeader}
         ${agcTextureDetileImageShaderHeader}
         ${agcTextureRepackShaderHeader}
@@ -424,6 +421,7 @@ target_link_libraries(libSceAgcDriver PRIVATE
         libc
         libkernel
         jpeg_turbo
+        libzstd_static
         ${CMAKE_DL_LIBS}
 )
 if(APS5_ENABLE_TRACY)
@@ -491,6 +489,18 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 
+    add_test_executable(agc_frame_capture_tests tests/FrameCapture.cpp Execution/src/FrameCapture.cpp)
+    target_include_directories(agc_frame_capture_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_frame_capture_tests PRIVATE libc libzstd_static)
+    set_target_properties(agc_frame_capture_tests PROPERTIES CXX_EXTENSIONS OFF)
+    configure_windows_unwind(agc_frame_capture_tests)
+    add_test(NAME agc_frame_capture COMMAND agc_frame_capture_tests)
+    set_tests_properties(agc_frame_capture PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_frame_capture PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+
     add_test_executable(agc_write_watch_coverage_tests tests/WriteWatchCoverage.cpp)
     target_include_directories(agc_write_watch_coverage_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(agc_write_watch_coverage_tests PRIVATE libc)
@@ -556,6 +566,42 @@ if(BUILD_TESTING)
         set_tests_properties(agc_handoff_spin PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+
+    add_test_executable(agc_capture_trace_tests tests/CaptureTrace.cpp)
+    target_include_directories(agc_capture_trace_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_capture_trace_tests PRIVATE libc)
+    configure_windows_unwind(agc_capture_trace_tests)
+    set(agcCaptureTraceDirectory ${CMAKE_CURRENT_BINARY_DIR}/capture_trace_tests)
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/default")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/explicit")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/failure")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/best-effort")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/disabled")
+    set(agcCaptureTraceExplicitPath "${agcCaptureTraceDirectory}/explicit/trace.log")
+    set(agcCaptureTraceFailurePath "${agcCaptureTraceDirectory}/failure/missing-parent/trace.log")
+    set(agcCaptureTraceBestEffortPath "${agcCaptureTraceDirectory}/best-effort/trace.log")
+    add_test(NAME agc_capture_trace_path_default COMMAND agc_capture_trace_tests path-default)
+    add_test(NAME agc_capture_trace_path_empty COMMAND agc_capture_trace_tests path-empty)
+    set_tests_properties(agc_capture_trace_path_empty PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE_PATH=")
+    add_test(NAME agc_capture_trace_path_explicit COMMAND agc_capture_trace_tests path-explicit)
+    set_tests_properties(agc_capture_trace_path_explicit PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceExplicitPath}")
+    add_test(NAME agc_capture_trace_explicit_writes COMMAND agc_capture_trace_tests explicit-writes)
+    set_tests_properties(agc_capture_trace_explicit_writes PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceExplicitPath}")
+    add_test(NAME agc_capture_trace_default_writes COMMAND agc_capture_trace_tests default-writes)
+    set_tests_properties(agc_capture_trace_default_writes PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1" WORKING_DIRECTORY "${agcCaptureTraceDirectory}/default")
+    add_test(NAME agc_capture_trace_open_failure COMMAND agc_capture_trace_tests open-failure)
+    set_tests_properties(agc_capture_trace_open_failure PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceFailurePath}" WORKING_DIRECTORY "${agcCaptureTraceDirectory}/failure")
+    add_test(NAME agc_capture_trace_best_effort_overflow COMMAND agc_capture_trace_tests best-effort-overflow)
+    set_tests_properties(agc_capture_trace_best_effort_overflow PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceBestEffortPath}" WORKING_DIRECTORY "${agcCaptureTraceDirectory}/best-effort")
+    add_test(NAME agc_capture_trace_disabled COMMAND agc_capture_trace_tests disabled)
+    set_tests_properties(agc_capture_trace_disabled PROPERTIES WORKING_DIRECTORY "${agcCaptureTraceDirectory}/disabled")
+    if(WIN32)
+        set_tests_properties(agc_capture_trace_path_default agc_capture_trace_path_empty
+                agc_capture_trace_path_explicit agc_capture_trace_explicit_writes
+                agc_capture_trace_default_writes agc_capture_trace_open_failure agc_capture_trace_best_effort_overflow
+                agc_capture_trace_disabled PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
 endif()
 
 if(WIN32)
@@ -714,6 +760,17 @@ target_link_libraries(agc_shared_write_tests PRIVATE libSceAgcDriver libkernel l
 set_target_properties(agc_shared_write_tests PROPERTIES CXX_EXTENSIONS OFF)
 configure_windows_unwind(agc_shared_write_tests)
 
+if(BUILD_TESTING AND WIN32)
+    add_test_executable(agc_page_state_tests tests/PageStates.cpp)
+    target_include_directories(agc_page_state_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_page_state_tests PRIVATE libSceAgcDriver libc)
+    configure_windows_unwind(agc_page_state_tests)
+    add_test(NAME agc_page_states COMMAND agc_page_state_tests)
+    add_test(NAME agc_page_state_metadata COMMAND agc_page_state_tests --metadata)
+    set_tests_properties(agc_page_states agc_page_state_metadata PROPERTIES
+        TIMEOUT 30 ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+endif()
+
 add_test_executable(agc_locks_tests EXCLUDE_FROM_ALL tests/Locks.cpp)
 target_include_directories(agc_locks_tests PRIVATE
         ${LIBS_INCLUDE_DIR}
@@ -743,11 +800,32 @@ if(BUILD_TESTING)
         set_tests_properties(agc_write_tracking_metadata_commit PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
         add_test(NAME agc_resident_direct_remap COMMAND agc_write_tracking_tests --resident-direct-remap)
         set_tests_properties(agc_resident_direct_remap PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
-        set_tests_properties(agc_write_tracking agc_write_tracking_metadata_commit agc_resident_direct_remap PROPERTIES ENVIRONMENT_MODIFICATION
+        add_test(NAME agc_rewatched_direct_shared COMMAND agc_write_tracking_tests --rewatched-direct-shared)
+        set_tests_properties(agc_rewatched_direct_shared PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
+        add_test(NAME agc_import_alias_shared COMMAND agc_write_tracking_tests --import-alias-shared)
+        set_tests_properties(agc_import_alias_shared PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
+        add_test(NAME agc_compared_shared_generations COMMAND agc_write_tracking_tests --compared-shared-generations)
+        set_tests_properties(agc_compared_shared_generations PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
+        add_test(NAME agc_write_tracking_rewatch_import_pages COMMAND agc_write_tracking_tests --rewatch-import-pages)
+        set_tests_properties(agc_write_tracking_rewatch_import_pages PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
+        set_tests_properties(agc_write_tracking agc_write_tracking_metadata_commit agc_resident_direct_remap agc_rewatched_direct_shared agc_import_alias_shared agc_compared_shared_generations agc_write_tracking_rewatch_import_pages PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 endif()
 
+if(BUILD_TESTING AND NOT WIN32)
+    add_test_executable(agc_collect_memo_generation_tests
+            tests/CollectMemoGeneration.cpp
+            Execution/src/GuestMemory.cpp
+            Execution/src/PerformanceTraceThread.cpp
+    )
+    target_include_directories(agc_collect_memo_generation_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_collect_memo_generation_tests PRIVATE shader_recompiler_agc_driver libc)
+    set_target_properties(agc_collect_memo_generation_tests PROPERTIES CXX_EXTENSIONS OFF)
+    add_test(NAME agc_collect_memo_generation COMMAND agc_collect_memo_generation_tests)
+    set_tests_properties(agc_collect_memo_generation PROPERTIES TIMEOUT 30)
+endif()
+
 add_test_executable(agc_thread_priority_tests EXCLUDE_FROM_ALL
         tests/ThreadPriority.cpp
         Execution/src/ThreadPriority.cpp
@@ -785,6 +863,15 @@ if(BUILD_TESTING)
     add_test(NAME agc_fragment_barycentric COMMAND agc_fragment_barycentric_tests)
 endif()
 
+add_test_executable(agc_tessellation_pipeline_cache_tests EXCLUDE_FROM_ALL tests/TessellationPipelineCache.cpp)
+target_include_directories(agc_tessellation_pipeline_cache_tests PRIVATE ${LIBS_INCLUDE_DIR} ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
+set_target_properties(agc_tessellation_pipeline_cache_tests PROPERTIES CXX_EXTENSIONS OFF)
+configure_windows_unwind(agc_tessellation_pipeline_cache_tests)
+if(BUILD_TESTING)
+    set_target_properties(agc_tessellation_pipeline_cache_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
+    add_test(NAME agc_tessellation_pipeline_cache COMMAND agc_tessellation_pipeline_cache_tests)
+endif()
+
 add_test_executable(agc_float32_flush_control_tests EXCLUDE_FROM_ALL tests/Float32FlushControl.cpp)
 target_include_directories(agc_float32_flush_control_tests PRIVATE ${LIBS_INCLUDE_DIR} ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
 set_target_properties(agc_float32_flush_control_tests PROPERTIES CXX_EXTENSIONS OFF)
@@ -1193,6 +1280,20 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+add_test_executable(agc_deferred_destruction_tests EXCLUDE_FROM_ALL tests/DeferredDestruction.cpp)
+target_include_directories(agc_deferred_destruction_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
+target_link_libraries(agc_deferred_destruction_tests PRIVATE libSceAgcDriver libc)
+set_target_properties(agc_deferred_destruction_tests PROPERTIES CXX_EXTENSIONS OFF)
+configure_windows_unwind(agc_deferred_destruction_tests)
+if(BUILD_TESTING)
+    set_target_properties(agc_deferred_destruction_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
+    add_test(NAME agc_deferred_destruction COMMAND agc_deferred_destruction_tests)
+    if(WIN32)
+        set_tests_properties(agc_deferred_destruction PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 add_test_executable(agc_device_memory_fallback_tests EXCLUDE_FROM_ALL tests/DeviceMemoryFallback.cpp)
 target_include_directories(agc_device_memory_fallback_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
 target_link_libraries(agc_device_memory_fallback_tests PRIVATE libSceAgcDriver libc)
@@ -1446,6 +1547,7 @@ target_include_directories(agc_driver_recorder_tests PRIVATE
 )
 
 target_link_libraries(agc_driver_recorder_tests PRIVATE
+        libSceAgc
         libkernel
         libSceAgcDriver
         SDL2-static
@@ -1465,16 +1567,32 @@ if(BUILD_TESTING)
         set_tests_properties(agc_recorder_device_selection agc_gpu_timing_complete agc_gpu_timing_incomplete PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_command_memory_reuse COMMAND agc_driver_recorder_tests --command-reuse-only)
+    set_tests_properties(agc_command_memory_reuse PROPERTIES SKIP_RETURN_CODE 77)
+    if(WIN32)
+        set_tests_properties(agc_command_memory_reuse PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_pipeline_cache COMMAND agc_driver_recorder_tests --pipeline-cache-only)
     add_test(NAME agc_pipeline_cache_file COMMAND agc_driver_recorder_tests --pipeline-cache-file-only)
+    add_test(NAME agc_pipeline_cache_header COMMAND agc_driver_recorder_tests --pipeline-cache-header-only)
+    set_tests_properties(agc_pipeline_cache_header PROPERTIES TIMEOUT 30 SKIP_RETURN_CODE 77)
+    if(WIN32)
+        set_tests_properties(agc_pipeline_cache_header PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_pipeline_library COMMAND agc_driver_recorder_tests --pipeline-library-only)
     add_test(NAME agc_pipeline_library_off COMMAND agc_driver_recorder_tests --pipeline-library-only)
     set_tests_properties(agc_pipeline_library agc_pipeline_library_off PROPERTIES SKIP_RETURN_CODE 77)
     set_tests_properties(agc_pipeline_library_off PROPERTIES ENVIRONMENT "APS5_NO_GPL=1")
     add_test(NAME agc_pipeline_library_fast_only COMMAND agc_driver_recorder_tests --pipeline-library-only)
     set_tests_properties(agc_pipeline_library_fast_only PROPERTIES ENVIRONMENT "APS5_NO_PIPELINE_LTO=1" SKIP_RETURN_CODE 77)
+    add_test(NAME agc_pipeline_library_lto_info COMMAND agc_driver_recorder_tests --pipeline-library-lto-info-only)
+    add_test(NAME agc_pipeline_library_lto_info_fast_only COMMAND agc_driver_recorder_tests --pipeline-library-lto-info-only)
+    set_tests_properties(agc_pipeline_library_lto_info agc_pipeline_library_lto_info_fast_only PROPERTIES SKIP_RETURN_CODE 77)
+    set_tests_properties(agc_pipeline_library_lto_info_fast_only PROPERTIES ENVIRONMENT "APS5_NO_PIPELINE_LTO=1")
     if(WIN32)
-        set_tests_properties(agc_pipeline_library agc_pipeline_library_off agc_pipeline_library_fast_only PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_pipeline_library agc_pipeline_library_off agc_pipeline_library_fast_only agc_pipeline_library_lto_info agc_pipeline_library_lto_info_fast_only PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_tests_properties(agc_pipeline_cache agc_pipeline_cache_file PROPERTIES SKIP_RETURN_CODE 77)
@@ -1484,17 +1602,26 @@ if(BUILD_TESTING)
     endif()
     add_test(NAME agc_import_watch COMMAND agc_driver_recorder_tests --import-watch-only)
     set_tests_properties(agc_import_watch PROPERTIES SKIP_RETURN_CODE 77)
+    add_test(NAME agc_import_settle_initial_dcc COMMAND agc_driver_recorder_tests --settle-initial-dcc-only)
+    set_tests_properties(agc_import_settle_initial_dcc PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
     if(WIN32)
         add_test(NAME agc_import_watch_other_family COMMAND agc_driver_recorder_tests --import-watch-other-family-only)
         set_tests_properties(agc_import_watch_other_family PROPERTIES SKIP_RETURN_CODE 77)
         add_test(NAME agc_import_settle_deferred COMMAND agc_driver_recorder_tests --deferred-settle-only)
         add_test(NAME agc_import_settle_deferred_other_family COMMAND agc_driver_recorder_tests --deferred-settle-other-family-only)
+        add_test(NAME agc_import_settle_write_order COMMAND agc_driver_recorder_tests --settle-write-order-only)
+        add_test(NAME agc_import_settle_write_order_other_family COMMAND agc_driver_recorder_tests --settle-write-order-other-family-only)
+        add_test(NAME agc_import_settle_wait_failure COMMAND agc_driver_recorder_tests --settle-wait-failure-only)
+        set_tests_properties(agc_import_settle_write_order agc_import_settle_write_order_other_family agc_import_settle_wait_failure PROPERTIES
+            SKIP_RETURN_CODE 77 TIMEOUT 30
+            FAIL_REGULAR_EXPRESSION "SYNC-HAZARD-|VUID-"
+            ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         add_test(NAME agc_import_settle_first_use COMMAND agc_driver_recorder_tests --settle-first-use-only)
         add_test(NAME agc_import_settle_earlier_import COMMAND agc_driver_recorder_tests --settle-earlier-import-only)
         add_test(NAME agc_import_settle_retire COMMAND agc_driver_recorder_tests --settle-retire-only)
         add_test(NAME agc_import_settle_storage_image COMMAND agc_driver_recorder_tests --settle-storage-image-only)
         set_tests_properties(agc_import_settle_deferred agc_import_settle_deferred_other_family agc_import_settle_first_use agc_import_settle_earlier_import agc_import_settle_retire agc_import_settle_storage_image PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 60)
-        set_tests_properties(agc_import_watch agc_import_watch_other_family agc_import_settle_deferred agc_import_settle_deferred_other_family agc_import_settle_first_use agc_import_settle_earlier_import agc_import_settle_retire agc_import_settle_storage_image PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_import_watch agc_import_watch_other_family agc_import_settle_deferred agc_import_settle_deferred_other_family agc_import_settle_first_use agc_import_settle_earlier_import agc_import_settle_retire agc_import_settle_storage_image agc_import_settle_initial_dcc PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     if(WIN32)
@@ -1700,10 +1827,12 @@ if(BUILD_TESTING)
     set_tests_properties(agc_shadowed_key_stores PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
     add_test(NAME agc_sample_dumps COMMAND agc_driver_recorder_tests --sample-dumps-only)
     set_tests_properties(agc_sample_dumps PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    add_test(NAME agc_uncounted_passes COMMAND agc_driver_recorder_tests --uncounted-passes-only)
+    set_tests_properties(agc_uncounted_passes PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
     add_test(NAME agc_draw_descriptors COMMAND agc_driver_recorder_tests --draw-descriptors-only)
     set_tests_properties(agc_draw_descriptors PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 60)
     if(WIN32)
-        set_tests_properties(agc_pending_key_stores agc_shadowed_key_stores agc_sample_dumps agc_draw_descriptors PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_pending_key_stores agc_shadowed_key_stores agc_sample_dumps agc_uncounted_passes agc_draw_descriptors PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test(NAME agc_driver_host_import_lifetime COMMAND agc_driver_recorder_tests --host-import-lifetime-only)
@@ -1903,6 +2032,7 @@ add_test_executable(agc_driver_graphics_tests EXCLUDE_FROM_ALL
         tests/GuestSamplerResource.cpp
         tests/TextureDetiler.cpp
         tests/DepthSurfaceReuse.cpp
+        tests/LastRecordIndices.cpp
 )
 
 if(BUILD_TESTING)
@@ -2070,6 +2200,25 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_address_passes_targets_split PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_driver_address_passes_draw_transitions COMMAND agc_driver_address_passes_tests --targets)
+    set_tests_properties(agc_driver_address_passes_draw_transitions PROPERTIES ENVIRONMENT "APS5_NO_ADDRESS_READ_PASSES=1;APS5_DRAW_TRANSITIONS=1" SKIP_RETURN_CODE 77 TIMEOUT 60)
+    if(WIN32)
+        set_tests_properties(agc_driver_address_passes_draw_transitions PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    set_target_properties(agc_driver_rcp_hardware_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
+    add_test(NAME agc_driver_rcp_hardware_exact COMMAND agc_driver_rcp_hardware_tests)
+    set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT "APS5_EXACT_RCP=1;ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 60)
+    if(WIN32)
+        set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_depth_plane_sampling_evicting COMMAND agc_driver_depth_plane_sampling_tests --evicting)
+    set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT "APS5_DEPTH_PLANE_COPY_MIB=1" SKIP_RETURN_CODE 77 TIMEOUT 120)
+    if(WIN32)
+        set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
 endif()
 foreach(agcExecutionTestName IN LISTS ANYPS5_AGC_EXECUTION_TESTS)
     if(NOT EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/tests/execution/${agcExecutionTestName}.cpp)
@@ -2095,9 +2244,13 @@ if(NOT ANYPS5_AGC_EXECUTION_TESTS OR "PooledBufferRange" IN_LIST ANYPS5_AGC_EXEC
 endif()
 
 target_link_libraries(agc_driver_gpu_map_on_fiber_tests PRIVATE libSceFiber)
+if(ANYPS5_ENABLE_SPIRV_TOOLS)
+    target_link_libraries(agc_driver_optimize_on_fiber_tests PRIVATE libSceFiber shader_recompiler_agc_driver)
+endif()
 
 target_link_libraries(agc_driver_rect_list_corner_tests PRIVATE shader_recompiler_agc_driver)
 target_link_libraries(agc_driver_queue_zero_late_interrupt_tests PRIVATE libkernel)
+target_link_libraries(agc_driver_linear_target_completion_points_tests PRIVATE libkernel)
 
 target_link_libraries(agc_driver_storage_file_write_tests PRIVATE libkernel)
 
@@ -2111,6 +2264,34 @@ target_include_directories(agc_driver_image_table_cache_bounds_tests PRIVATE $<T
 
 target_include_directories(agc_driver_draw_cache_relocation_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
+if(BUILD_TESTING)
+    add_test(NAME agc_driver_linear_target_completion_points_sync_flip COMMAND agc_driver_linear_target_completion_points_tests --flip)
+    set_tests_properties(agc_driver_linear_target_completion_points_sync_flip PROPERTIES
+            ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_SYNC_FLIP=1" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_linear_target_completion_points_unpipelined COMMAND agc_driver_linear_target_completion_points_tests --label --interrupt)
+    set_tests_properties(agc_driver_linear_target_completion_points_unpipelined PROPERTIES
+            ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_PIPELINED_DRAWS=0" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_linear_target_completion_points_sync_flip agc_driver_linear_target_completion_points_unpipelined PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_submit_progress COMMAND agc_driver_submit_progress_tests)
+    set_tests_properties(agc_submit_progress PROPERTIES
+            ENVIRONMENT "APS5_SUBMIT_PROGRESS=1;ANYPS5_REQUIRE_VULKAN=1" TIMEOUT 30 SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_submit_progress PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgcDriver>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_submit_progress_no_timeline COMMAND agc_driver_submit_progress_tests --fallback-only)
+    set_tests_properties(agc_submit_progress_no_timeline PROPERTIES
+            ENVIRONMENT "APS5_SUBMIT_PROGRESS=1;APS5_NO_TIMELINE=1;ANYPS5_REQUIRE_VULKAN=1"
+            TIMEOUT 30 SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_submit_progress_no_timeline PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgcDriver>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 if(BUILD_TESTING)
     add_test(NAME agc_driver_store_pending_identity COMMAND agc_driver_store_over_untracked_tests --pending-identity)
     set_tests_properties(agc_driver_store_pending_identity PROPERTIES
@@ -2155,6 +2336,9 @@ if(BUILD_TESTING)
         set(testName "agc_driver_msaa_dcc_clear_${samples}")
         add_test(NAME ${testName} COMMAND agc_driver_alpha_to_coverage_tests --dcc-fast-clear ${samples})
         list(APPEND multisampledDccClearTests ${testName})
+        set(testName "agc_driver_msaa_dcc_compared_import_${samples}")
+        add_test(NAME ${testName} COMMAND agc_driver_alpha_to_coverage_tests --dcc-compared-import ${samples})
+        list(APPEND multisampledDccClearTests ${testName})
     endforeach()
     set_tests_properties(agc_driver_msaa_dcc_state ${multisampledDccClearTests} PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
@@ -2169,6 +2353,7 @@ if(BUILD_TESTING)
     endif()
 endif()
 target_include_directories(agc_driver_native_multisample_depth_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+target_include_directories(agc_driver_partially_resident_snapshot_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
 foreach(agcReadbackTestKind IN ITEMS Vertex Uint Depth)
     string(TOUPPER ${agcReadbackTestKind} agcReadbackTestSymbol)
@@ -2204,17 +2389,28 @@ target_include_directories(agc_driver_reversed_order_blend_tests PRIVATE $<TARGE
 target_include_directories(agc_driver_swap_alt_blend_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
 target_include_directories(agc_driver_packed_float_color_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+target_include_directories(agc_driver_uint_color_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
 target_link_libraries(agc_driver_job_manager_compute_tests PRIVATE libSceJobManager libSceAgc libkernel)
 
 target_include_directories(agc_driver_packed_unorm_color_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
+target_include_directories(agc_driver_packed_unorm4444_color_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
+target_include_directories(agc_driver_packed_unorm4444_partial_write_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
+target_include_directories(agc_driver_packed_unorm4444_multisample_partial_write_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
 target_include_directories(agc_driver_color1555_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
+target_include_directories(agc_driver_color_logic_op_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
 target_include_directories(agc_driver_color565_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
 target_include_directories(agc_driver_depth_range_remap_draw_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
+target_include_directories(agc_driver_depth_bounds_emulation_draw_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
 foreach(stage IN ITEMS vert frag)
     set(agcProvokingShaderSource ${CMAKE_CURRENT_SOURCE_DIR}/tests/shaders/ProvokingVertex.${stage})
     set(agcProvokingShaderSpv ${agcTestShaderGeneratedRoot}/ProvokingVertex_${stage}.spv)
@@ -2333,12 +2529,14 @@ if(BUILD_TESTING)
     set_tests_properties(agc_shader_srt_read_patching PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_shader_table_snapshot_reuse COMMAND agc_shader_memory_tests --table-snapshot-reuse)
     set_tests_properties(agc_shader_table_snapshot_reuse PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_shader_table_snapshot_reuse_unmasked COMMAND agc_shader_memory_tests --table-snapshot-reuse)
+    set_tests_properties(agc_shader_table_snapshot_reuse_unmasked PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_MASKED_RESULT_MEMO=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_driver_image_table_vouched_lookups COMMAND agc_driver_image_table_cache_bounds_tests --vouched-lookups)
     set_tests_properties(agc_driver_image_table_vouched_lookups PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_WRITE_WATCH_IMPORTS=watch" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 60)
     add_test(NAME agc_driver_image_table_vouch_queued_draws COMMAND agc_driver_image_table_cache_bounds_tests --queued-draws)
     set_tests_properties(agc_driver_image_table_vouch_queued_draws PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 60)
     if(WIN32)
-        set_tests_properties(agc_shader_table_snapshot_reuse agc_driver_image_table_vouched_lookups agc_driver_image_table_vouch_queued_draws PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_shader_table_snapshot_reuse agc_shader_table_snapshot_reuse_unmasked agc_driver_image_table_vouched_lookups agc_driver_image_table_vouch_queued_draws PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test(NAME agc_shader_type_zero_image_materialization COMMAND agc_shader_memory_tests --type-zero-image-materialization)
     set_tests_properties(agc_shader_type_zero_image_materialization PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
@@ -2351,6 +2549,12 @@ if(BUILD_TESTING)
     add_test(NAME agc_shader_frontend_pair_off COMMAND agc_shader_memory_tests --frontend-pair)
     set_tests_properties(agc_shader_frontend_pair PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     set_tests_properties(agc_shader_frontend_pair_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_PERF_FRONTEND_PAIR=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_shader_result_memo_budget COMMAND agc_shader_memory_tests --result-memo-budget)
+    set_tests_properties(agc_shader_result_memo_budget PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_MASKED_RESULT_MEMO=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_shader_result_memo_budget_threads COMMAND agc_shader_memory_tests --result-memo-budget-threads)
+    set_tests_properties(agc_shader_result_memo_budget_threads PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_MASKED_RESULT_MEMO=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_shader_result_memo_budget_masked COMMAND agc_shader_memory_tests --result-memo-budget-masked)
+    set_tests_properties(agc_shader_result_memo_budget_masked PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_shader_layout_pair COMMAND agc_shader_memory_tests --layout-pair)
     add_test(NAME agc_shader_layout_pair_off COMMAND agc_shader_memory_tests --layout-pair)
     set_tests_properties(agc_shader_layout_pair PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
@@ -2358,10 +2562,10 @@ if(BUILD_TESTING)
     add_test(NAME agc_shader_entry_lane_proof_budget COMMAND agc_shader_memory_tests --entry-lane-proof-budget)
     set_tests_properties(agc_shader_entry_lane_proof_budget PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     if(WIN32)
-        set_tests_properties(agc_shader_bindless agc_shader_selected_records_image_limit agc_shader_selected_records_pair_limit agc_shader_selected_records_direct_image_limit agc_shader_selected_records_direct_pair_limit agc_shader_srt_read_patching agc_shader_type_zero_image_materialization agc_shader_frontend_pair agc_shader_frontend_pair_off agc_shader_layout_pair agc_shader_layout_pair_off agc_shader_entry_lane_proof_budget PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_shader_bindless agc_shader_selected_records_image_limit agc_shader_selected_records_pair_limit agc_shader_selected_records_direct_image_limit agc_shader_selected_records_direct_pair_limit agc_shader_srt_read_patching agc_shader_type_zero_image_materialization agc_shader_frontend_pair agc_shader_frontend_pair_off agc_shader_layout_pair agc_shader_layout_pair_off agc_shader_result_memo_budget agc_shader_result_memo_budget_threads agc_shader_result_memo_budget_masked agc_shader_entry_lane_proof_budget PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     foreach(agcTest IN ITEMS agc_vertex_input_tests agc_mesh_output_budget_tests agc_shared_write_tests agc_locks_tests agc_driver_tests agc_shader_memory_tests agc_structurizer_tests agc_spirv_module_tests agc_dpp_write_tests agc_masked_select_tests agc_ir_reclaim_tests agc_vector_window_tests agc_constant_bit_test_tests agc_integer_narrowing_tests agc_scalar_select_mask_tests agc_vertex_input_validation_tests agc_vop1_control_decode_tests agc_validate_program_tests agc_pass_hazards_tests agc_barrier_batch_tests agc_shader_disk_cache_tests agc_screenshot_tests agc_shader_device_profile_tests agc_placeholder_images_tests agc_shader_control_flow_tests agc_driver_flip_tests agc_driver_pm4_tests agc_driver_graphics_tests agc_driver_bda_device_tests agc_driver_mesh_tests agc_driver_cmask_fast_clear_tests agc_formatted_buffer_once_tests agc_formatted_buffer_byte_stores_tests ${agcExecutionTests} agc_fma_mix_once_tests agc_f16_single_convert_tests)
-        if(agcTest STREQUAL "agc_driver_constant_store_tests" OR agcTest STREQUAL "agc_driver_flat_apertures_tests" OR agcTest STREQUAL "agc_driver_pipeline_optimized_readback_tests")
+        if(agcTest STREQUAL "agc_driver_constant_store_tests" OR agcTest STREQUAL "agc_driver_flat_apertures_tests" OR agcTest STREQUAL "agc_driver_pipeline_optimized_readback_tests" OR agcTest STREQUAL "agc_driver_rcp_hardware_tests")
             continue()
         endif()
         string(REGEX REPLACE "_tests$" "" agcTestName "${agcTest}")
@@ -2394,11 +2598,28 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_draw_unsupported_buffer_type_skip_refused PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_driver_period_copy_no_hle COMMAND agc_driver_period_copy_tests)
+    set_tests_properties(agc_driver_period_copy_no_hle PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_COPY_HLE=1" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_period_copy_no_hle PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_sparse_indirect_indices_unreadable COMMAND agc_driver_sparse_indirect_indices_tests --unreadable)
-    set_tests_properties(agc_driver_sparse_indirect_indices agc_driver_sparse_indirect_indices_unreadable PROPERTIES
+    add_test(NAME agc_driver_sparse_indirect_indices_no_size COMMAND agc_driver_sparse_indirect_indices_tests --no-size)
+    add_test(NAME agc_driver_sparse_indirect_indices_no_size_unreadable COMMAND agc_driver_sparse_indirect_indices_tests --no-size-unreadable)
+    add_test(NAME agc_driver_sparse_indirect_indices_no_size_unreadable_record COMMAND agc_driver_sparse_indirect_indices_tests --no-size-unreadable-record)
+    set_tests_properties(agc_driver_sparse_indirect_indices agc_driver_sparse_indirect_indices_unreadable agc_driver_sparse_indirect_indices_no_size agc_driver_sparse_indirect_indices_no_size_unreadable agc_driver_sparse_indirect_indices_no_size_unreadable_record PROPERTIES
         ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     if(WIN32)
-        set_tests_properties(agc_driver_sparse_indirect_indices_unreadable PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_driver_sparse_indirect_indices_unreadable agc_driver_sparse_indirect_indices_no_size agc_driver_sparse_indirect_indices_no_size_unreadable agc_driver_sparse_indirect_indices_no_size_unreadable_record PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_draw_cache_relocation_evicted COMMAND agc_driver_draw_cache_relocation_tests --evicted)
+    add_test(NAME agc_driver_draw_cache_relocation_kept COMMAND agc_driver_draw_cache_relocation_tests --kept)
+    set_tests_properties(agc_driver_draw_cache_relocation_evicted agc_driver_draw_cache_relocation_kept PROPERTIES
+        ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_DRAW_CACHE_ENTRIES=2" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_draw_cache_relocation_evicted agc_driver_draw_cache_relocation_kept PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_tests_properties(agc_driver_pixel_implicit_derivatives PROPERTIES TIMEOUT 30)
@@ -2425,6 +2646,16 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_draw_pipeline_trace_disabled agc_driver_draw_finisher_trace agc_driver_draw_finisher_trace_disabled PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_driver_copied_writer_label_order_drain COMMAND agc_driver_copied_writer_label_order_tests)
+    set_tests_properties(agc_driver_copied_writer_label_order_drain PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_DRAIN_COMPLETION_LABELS=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_driver_copied_writer_label_order_drain PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_lazy_resolved_abi_switch_set COMMAND agc_driver_lazy_resolved_abi_tests)
+    set_tests_properties(agc_driver_lazy_resolved_abi_switch_set PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_LAZY_SHADER_PREPARE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_lazy_resolved_abi_switch_set PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     set_tests_properties(agc_driver_queued_raw_shader PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_PIPELINED_DRAWS=8" TIMEOUT 30)
     set(agcDrawPipelineTests agc_driver_draw_write_ranges agc_driver_draw_unsupported_buffer_type agc_driver_bda_span_reads agc_driver_copied_writer_copy agc_driver_image_table_reuse agc_driver_depth_storage_reuse agc_driver_staged_clear_sampled_read agc_driver_storage_write_back_overhang agc_driver_write_data_written_ahead agc_driver_gated_dispatch_capture agc_driver_buffer_load_store agc_driver_pipelined_dma agc_driver_pipelined_fill agc_driver_pipelined_predication_read agc_driver_pipelined_predicated_label_order agc_driver_pipelined_metadata_pass agc_driver_draw_cache_reuse agc_driver_draw_cache_relocation agc_driver_draw_data_hit_user_words agc_driver_finisher_label_order agc_driver_same_queue_label_wait agc_driver_unimported_label_order)
     foreach(agcTestName IN LISTS agcDrawPipelineTests)
@@ -2502,6 +2733,9 @@ if(BUILD_TESTING)
         add_test(NAME agc_driver_untracked_snapshot_hint COMMAND agc_driver_partially_resident_snapshot_tests --untracked-hint)
         set_tests_properties(agc_driver_untracked_snapshot_hint PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30
             ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        add_test(NAME agc_driver_compared_shared_snapshot COMMAND agc_driver_partially_resident_snapshot_tests --compared-shared)
+        set_tests_properties(agc_driver_compared_shared_snapshot PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30
+            ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_tests_properties(agc_driver_registration_trace PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_TRACE_FRAMES=0:1;APS5_TRACE_EVENTS=64" TIMEOUT 30)
@@ -2550,6 +2784,11 @@ if(BUILD_TESTING)
     set_tests_properties(agc_pipeline_journal_long_paths PROPERTIES TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_pipeline_library_clear_waits_for_build COMMAND agc_driver_graphics_tests --pipeline-library-clear-waits-for-build)
     add_test(NAME agc_pipeline_store_lazy_buffer_pool COMMAND agc_driver_graphics_tests --pipeline-store-lazy-buffer-pool)
+    add_test(NAME agc_pipeline_store_growth COMMAND agc_driver_graphics_tests --pipeline-store-growth)
+    add_test(NAME agc_pipeline_store_fixed_bound COMMAND agc_driver_graphics_tests --pipeline-store-growth)
+    add_test(NAME agc_pipeline_store_replay_growth COMMAND agc_driver_graphics_tests --pipeline-store-replay-growth)
+    set_tests_properties(agc_pipeline_store_growth agc_pipeline_store_fixed_bound agc_pipeline_store_replay_growth PROPERTIES TIMEOUT 60 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    set_tests_properties(agc_pipeline_store_fixed_bound PROPERTIES ENVIRONMENT "APS5_PIPELINE_STORE_ENTRIES=1024")
     set_tests_properties(agc_pipeline_journal PROPERTIES TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     set_tests_properties(agc_pipeline_library_clear_waits_for_build PROPERTIES TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     set_tests_properties(agc_pipeline_store_lazy_buffer_pool PROPERTIES TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
@@ -2557,7 +2796,7 @@ if(BUILD_TESTING)
         add_test(NAME agc_pipeline_journal_extended_paths COMMAND agc_driver_graphics_tests --pipeline-journal-extended-paths)
         set_tests_properties(agc_pipeline_journal_extended_paths PROPERTIES TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
         set_tests_properties(agc_pipeline_journal_long_paths agc_pipeline_journal_extended_paths PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
-        set_tests_properties(agc_pipeline_journal agc_pipeline_library_clear_waits_for_build agc_pipeline_store_lazy_buffer_pool PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_pipeline_journal agc_pipeline_library_clear_waits_for_build agc_pipeline_store_lazy_buffer_pool agc_pipeline_store_growth agc_pipeline_store_fixed_bound agc_pipeline_store_replay_growth PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_tests_properties(agc_driver_sparse_buffer_holes PROPERTIES TIMEOUT 30)
     if(WIN32)
@@ -2585,6 +2824,12 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 
+    add_test(NAME agc_address_copy_cap COMMAND agc_driver_graphics_tests --address-copy-cap)
+    add_test(NAME agc_address_copy_cap_remembered COMMAND agc_driver_graphics_tests --address-copy-cap-remembered)
+    set_tests_properties(agc_address_copy_cap agc_address_copy_cap_remembered PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_address_copy_cap agc_address_copy_cap_remembered PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_emulated_color_compare_srgb_decode COMMAND agc_driver_emulated_color_compare_tests)
     set_tests_properties(agc_driver_emulated_color_compare_srgb_decode PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_SRGB_SHADER_DECODE=1"
@@ -2655,18 +2900,44 @@ if(BUILD_TESTING)
     if(WIN32)
         set_tests_properties(agc_driver_f16_to_f32_unpack_spirv PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    set(agcDrawShaderFailureTraceDirectory ${CMAKE_CURRENT_BINARY_DIR}/draw_shader_failure_tests)
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/failure")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/success")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/disabled")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/failure_correlation_disabled")
+    set_tests_properties(agc_driver_draw_shader_failure PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_TRACE_SHADER_CORRELATION=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/failure/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_successful COMMAND agc_driver_draw_shader_failure_tests successful-draw)
+    set_tests_properties(agc_driver_draw_shader_failure_successful PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_TRACE_SHADER_CORRELATION=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/success/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_correlation_disabled COMMAND agc_driver_draw_shader_failure_tests disabled-correlation)
+    set_tests_properties(agc_driver_draw_shader_failure_correlation_disabled PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/disabled/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_request_correlation_disabled COMMAND agc_driver_draw_shader_failure_tests request-failure-correlation-disabled)
+    set_tests_properties(agc_driver_draw_shader_failure_request_correlation_disabled PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/failure_correlation_disabled/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/materialization")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/materialization_correlation_disabled")
+    add_test(NAME agc_driver_draw_shader_failure_materialization COMMAND agc_driver_draw_shader_failure_tests materialization-failure)
+    set_tests_properties(agc_driver_draw_shader_failure_materialization PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_TRACE_SHADER_CORRELATION=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/materialization/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_materialization_correlation_disabled COMMAND agc_driver_draw_shader_failure_tests materialization-failure-correlation-disabled)
+    set_tests_properties(agc_driver_draw_shader_failure_materialization_correlation_disabled PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/materialization_correlation_disabled/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_draw_shader_failure agc_driver_draw_shader_failure_successful agc_driver_draw_shader_failure_correlation_disabled agc_driver_draw_shader_failure_request_correlation_disabled agc_driver_draw_shader_failure_materialization agc_driver_draw_shader_failure_materialization_correlation_disabled PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_structurizer_intersection_off COMMAND agc_structurizer_tests)
     set_tests_properties(agc_structurizer_intersection_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_PERF_DOM_INTERSECTION=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_structurizer_iteration_selection_off COMMAND agc_structurizer_tests)
     set_tests_properties(agc_structurizer_iteration_selection_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_PERF_ITERATION_SELECTION=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_shader_control_flow_iteration_selection_off COMMAND agc_shader_control_flow_tests)
     set_tests_properties(agc_shader_control_flow_iteration_selection_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_PERF_ITERATION_SELECTION=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_structurizer_dominator_tree_off COMMAND agc_structurizer_tests)
+    set_tests_properties(agc_structurizer_dominator_tree_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_PERF_DOMINATOR_TREE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_shader_control_flow_dominator_tree_off COMMAND agc_shader_control_flow_tests)
+    set_tests_properties(agc_shader_control_flow_dominator_tree_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_PERF_DOMINATOR_TREE=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_structurizer_forced_fallback COMMAND agc_structurizer_tests)
     set_tests_properties(agc_structurizer_forced_fallback PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FORCE_STRUCTURIZER_FALLBACK=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_shader_control_flow_forced_fallback COMMAND agc_shader_control_flow_tests)
     set_tests_properties(agc_shader_control_flow_forced_fallback PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FORCE_STRUCTURIZER_FALLBACK=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     if(WIN32)
-        set_tests_properties(agc_structurizer_intersection_off agc_structurizer_iteration_selection_off agc_shader_control_flow_iteration_selection_off agc_structurizer_forced_fallback agc_shader_control_flow_forced_fallback PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_structurizer_intersection_off agc_structurizer_iteration_selection_off agc_shader_control_flow_iteration_selection_off agc_structurizer_dominator_tree_off agc_shader_control_flow_dominator_tree_off agc_structurizer_forced_fallback agc_shader_control_flow_forced_fallback PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test(NAME agc_driver_gated_dispatch_capture_short_timeout COMMAND agc_driver_gated_dispatch_capture_tests)
     set_tests_properties(agc_driver_gated_dispatch_capture_short_timeout PROPERTIES
@@ -2760,6 +3031,15 @@ if(BUILD_TESTING)
         set_tests_properties(agc_sampled_cache_device_selection agc_driver_sampled_cache_device_selection PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    foreach(imageRecoveryMode IN ITEMS sampled storage srgb repack)
+        add_test(NAME agc_driver_recover_${imageRecoveryMode}_allocation COMMAND agc_driver_sampled_cache_budget_tests recover-${imageRecoveryMode})
+        set_tests_properties(agc_driver_recover_${imageRecoveryMode}_allocation PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 30)
+        if(WIN32)
+            set_tests_properties(agc_driver_recover_${imageRecoveryMode}_allocation PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
+    set_property(TEST agc_driver_recover_srgb_allocation APPEND PROPERTY ENVIRONMENT_MODIFICATION "APS5_SRGB_SHADER_DECODE=set:copy")
     add_test(NAME agc_driver_resource_cache_storage_admission COMMAND agc_driver_sampled_cache_budget_tests resource-admission)
     add_test(NAME agc_driver_resource_cache_oversized_storage_admission COMMAND agc_driver_sampled_cache_budget_tests resource-oversized)
     add_test(NAME agc_driver_resource_cache_storage_clear COMMAND agc_driver_sampled_cache_budget_tests resource-clear)
@@ -2839,6 +3119,12 @@ if(BUILD_TESTING)
     set_tests_properties(agc_driver_draw_cache_reuse_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_GPL=1" SKIP_RETURN_CODE 77)
     add_test(NAME agc_driver_draw_cache_reuse_verify COMMAND agc_driver_draw_cache_reuse_tests)
     set_tests_properties(agc_driver_draw_cache_reuse_verify PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_VERIFY_DRAW_DATA_HITS=1" SKIP_RETURN_CODE 77)
+    add_test(NAME agc_driver_draw_cache_reuse_entry_verify COMMAND agc_driver_draw_cache_reuse_tests)
+    set_tests_properties(agc_driver_draw_cache_reuse_entry_verify PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_VERIFY_DRAW_ENTRIES=1" SKIP_RETURN_CODE 77 FAIL_REGULAR_EXPRESSION "FATAL:")
+    if(WIN32)
+        set_tests_properties(agc_driver_draw_cache_reuse_entry_verify PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_draw_cache_reuse_inline COMMAND agc_driver_draw_cache_reuse_tests)
     set_tests_properties(agc_driver_draw_cache_reuse_inline PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_PIPELINED_DRAWS=0;APS5_VERIFY_DRAW_RECIPE=1;APS5_VERIFY_REGISTER_KEYS=1" SKIP_RETURN_CODE 77)
     set_tests_properties(agc_driver_draw_cache_reuse agc_driver_draw_cache_reuse_off agc_driver_draw_cache_reuse_verify agc_driver_draw_cache_reuse_inline PROPERTIES FAIL_REGULAR_EXPRESSION "FATAL:")
@@ -2896,6 +3182,13 @@ if(BUILD_TESTING)
             endif()
         endforeach()
     endforeach()
+    add_test(NAME agc_driver_depth_plane_partial_store_unimported COMMAND agc_driver_depth_plane_partial_store_tests)
+    set_tests_properties(agc_driver_depth_plane_partial_store_unimported PROPERTIES
+            ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_HOST_IMPORT=1" TIMEOUT 30 SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_depth_plane_partial_store_unimported PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_array_layer_target_cpu COMMAND agc_driver_array_layer_target_tests)
     set_tests_properties(agc_driver_array_layer_target_cpu PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_HOST_IMPORT=1" TIMEOUT 30 SKIP_RETURN_CODE 77)
@@ -2903,7 +3196,7 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_array_layer_target_cpu PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
-    foreach(preparedMode IN ITEMS indirect uncached debug debug_failure deferred deferred_undecodable registered_workgroup registered_workgroup_sync abi_deferred_compute abi_deferred_pixel abi_deferred_stages abi_deferred_rectangle abi_deferred_undecodable_state abi_deferred_registration_failure abi_deferred_vertex_inputs abi_deferred_rectangle_pairs lazy lazy_sync)
+    foreach(preparedMode IN ITEMS indirect uncached debug debug_failure deferred deferred_undecodable registered_workgroup registered_workgroup_sync dispatch_ahead_prewarm abi_deferred_compute abi_deferred_pixel abi_deferred_stages abi_deferred_rectangle abi_deferred_undecodable_state abi_deferred_registration_failure abi_deferred_vertex_inputs abi_deferred_rectangle_pairs lazy lazy_sync)
         set(preparedTest "agc_driver_prepared_shaders_${preparedMode}")
         if(preparedMode MATCHES "^abi_deferred_")
             string(REPLACE "_" "-" preparedArgument ${preparedMode})
@@ -2918,6 +3211,8 @@ if(BUILD_TESTING)
             add_test(NAME ${preparedTest} COMMAND agc_driver_prepared_shaders_tests --lazy)
         elseif(preparedMode STREQUAL "registered_workgroup" OR preparedMode STREQUAL "registered_workgroup_sync")
             add_test(NAME ${preparedTest} COMMAND agc_driver_prepared_shaders_tests --registered-workgroup)
+        elseif(preparedMode STREQUAL "dispatch_ahead_prewarm")
+            add_test(NAME ${preparedTest} COMMAND agc_driver_prepared_shaders_tests --dispatch-ahead-prewarm)
         elseif(preparedMode STREQUAL "debug_failure")
             add_test(NAME ${preparedTest} COMMAND agc_driver_prepared_shaders_tests --fail-before-registration)
             set_tests_properties(${preparedTest} PROPERTIES WILL_FAIL TRUE TIMEOUT 30)
@@ -2955,6 +3250,16 @@ if(BUILD_TESTING)
     if(WIN32)
         set_tests_properties(agc_driver_shutdown_threads_joined agc_driver_shutdown_threads_queued_prebuilds agc_driver_shutdown_threads_compare_helpers agc_driver_shutdown_threads_draw_committer agc_driver_shutdown_threads_shader_cache_writer agc_driver_shutdown_threads_late_shader_cache agc_driver_shutdown_threads_async_log_held agc_driver_shutdown_threads_exit_after_start PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_driver_prepared_shaders_abi_deferred_concurrent_lazy COMMAND agc_driver_prepared_shaders_tests --abi-deferred-concurrent)
+    set_tests_properties(agc_driver_prepared_shaders_abi_deferred_concurrent_lazy PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_FAILURE_MEMO=1;APS5_LAZY_SHADER_PREPARE=1;APS5_SUSPEND_DRAIN=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_prepared_shaders_abi_deferred_concurrent_lazy PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_prepared_shaders_abi_deferred_compute_lazy COMMAND agc_driver_prepared_shaders_tests --abi-deferred-compute)
+    set_tests_properties(agc_driver_prepared_shaders_abi_deferred_compute_lazy PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_FAILURE_MEMO=1;APS5_LAZY_SHADER_PREPARE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_prepared_shaders_abi_deferred_compute_lazy PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_compute_user_data_calls_registered COMMAND agc_driver_compute_user_data_calls_tests --registered)
     set_tests_properties(agc_driver_compute_user_data_calls_registered PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     if(WIN32)
@@ -3099,6 +3404,18 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+add_executable(agc_frame_replay EXCLUDE_FROM_ALL
+        tools/FrameReplay.cpp
+        Execution/src/FrameCapture.cpp
+)
+target_include_directories(agc_frame_replay PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(agc_frame_replay PRIVATE libSceAgcDriver libkernel libc libzstd_static)
+if(WIN32)
+    target_link_options(agc_frame_replay PRIVATE LINKER:--image-base=0x500000000000)
+endif()
+set_target_properties(agc_frame_replay PROPERTIES CXX_EXTENSIONS OFF)
+configure_windows_unwind(agc_frame_replay)
+
 add_executable(agc_pm4_replay EXCLUDE_FROM_ALL
         tools/Pm4Replay.cpp
         tools/Pm4Analysis.cpp
@@ -3145,6 +3462,64 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_pm4_replay agc_driver_pm4_replay_tool PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+
+    if(WIN32)
+        add_test_executable(agc_driver_frame_capture_eop_tests tests/FrameCaptureEop.cpp Execution/src/FrameCapture.cpp)
+        target_include_directories(agc_driver_frame_capture_eop_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR} ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR})
+        target_link_libraries(agc_driver_frame_capture_eop_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static)
+        set_target_properties(agc_driver_frame_capture_eop_tests PROPERTIES CXX_EXTENSIONS OFF)
+        configure_windows_unwind(agc_driver_frame_capture_eop_tests)
+        add_test(NAME agc_driver_frame_capture_eop COMMAND agc_driver_frame_capture_eop_tests)
+        set_tests_properties(agc_driver_frame_capture_eop PROPERTIES
+                ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-capture-eop;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=3"
+                TIMEOUT 120)
+        set_tests_properties(agc_driver_frame_capture_eop PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+
+    add_test_executable(agc_driver_frame_replay_state_tests tests/FrameReplayState.cpp Execution/src/FrameCapture.cpp)
+    target_include_directories(agc_driver_frame_replay_state_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_driver_frame_replay_state_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static)
+    set_target_properties(agc_driver_frame_replay_state_tests PROPERTIES CXX_EXTENSIONS OFF)
+    configure_windows_unwind(agc_driver_frame_replay_state_tests)
+    set(agcFrameReplayModes order tokens blocking)
+    if(WIN32)
+        list(APPEND agcFrameReplayModes zero shader shader_host)
+    endif()
+    foreach(mode IN LISTS agcFrameReplayModes)
+        set(capture "${CMAKE_CURRENT_BINARY_DIR}/frame-replay-${mode}")
+        add_test(NAME agc_driver_frame_replay_${mode} COMMAND agc_driver_frame_replay_state_tests ${mode} "${capture}")
+        set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES TIMEOUT 30)
+        if(mode MATCHES "^shader")
+            set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES ENVIRONMENT
+                    "APS5_FRAME_CAPTURE=${capture};APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=1")
+        endif()
+        if(WIN32)
+            set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
+
+    if(WIN32)
+        add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp)
+        target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static)
+        set_target_properties(agc_driver_frame_replay_tests PROPERTIES CXX_EXTENSIONS OFF)
+        configure_windows_unwind(agc_driver_frame_replay_tests)
+        add_dependencies(agc_driver_frame_replay_tests agc_frame_replay)
+        add_test(NAME agc_driver_frame_replay COMMAND agc_driver_frame_replay_tests $<TARGET_FILE:agc_frame_replay>)
+        set_tests_properties(agc_driver_frame_replay PROPERTIES
+                ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=2"
+                TIMEOUT 120)
+        set_tests_properties(agc_driver_frame_replay PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        add_test(NAME agc_driver_frame_replay_concurrent COMMAND agc_driver_frame_replay_tests $<TARGET_FILE:agc_frame_replay> concurrent)
+        set_tests_properties(agc_driver_frame_replay_concurrent PROPERTIES
+                ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-concurrent-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=8"
+                TIMEOUT 120)
+        set_tests_properties(agc_driver_frame_replay_concurrent PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
 endif()
 
 add_executable(agc_compute_pipeline_replay EXCLUDE_FROM_ALL tools/ComputePipelineReplay.cpp)
@@ -3170,12 +3545,15 @@ if(BUILD_TESTING)
     set_tests_properties(agc_driver_covered_centroid_state PROPERTIES TIMEOUT 30)
     add_test(NAME agc_driver_sample_location_grid_fallback COMMAND agc_driver_graphics_tests --sample-location-grid-fallback)
     set_tests_properties(agc_driver_sample_location_grid_fallback PROPERTIES TIMEOUT 30)
+    add_test(NAME agc_driver_unobserved_provoking_vertex COMMAND agc_driver_graphics_tests --unobserved-provoking-vertex)
+    set_tests_properties(agc_driver_unobserved_provoking_vertex PROPERTIES TIMEOUT 30)
     add_test(NAME agc_driver_sample_order_planning COMMAND agc_driver_graphics_tests --sample-order)
     set_tests_properties(agc_driver_sample_order_planning PROPERTIES TIMEOUT 30)
     if(WIN32)
         set_tests_properties(agc_compute_descriptor_layout_flags PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         set_tests_properties(agc_driver_covered_centroid_state PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         set_tests_properties(agc_driver_sample_location_grid_fallback PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_driver_unobserved_provoking_vertex PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         set_tests_properties(agc_driver_sample_order_planning PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test(NAME agc_compute_pipeline_capture COMMAND agc_compute_pipeline_capture_tests)
@@ -3392,6 +3770,14 @@ if(BUILD_TESTING)
         set_tests_properties(scalar_call PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(ir_dump_memory_tests ${LIBS_INCLUDE_DIR}/tests/IrDumpMemory.cpp)
+    target_link_libraries(ir_dump_memory_tests PRIVATE shader_recompiler_agc_driver libc)
+    configure_windows_unwind(ir_dump_memory_tests)
+    add_test(NAME ir_dump_memory COMMAND ir_dump_memory_tests)
+    if(WIN32)
+        set_tests_properties(ir_dump_memory PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(image_sample_gather_tests ${LIBS_INCLUDE_DIR}/tests/ImageSampleGather.cpp)
     target_link_libraries(image_sample_gather_tests PRIVATE shader_recompiler_agc_driver libc)
     configure_windows_unwind(image_sample_gather_tests)
@@ -3631,6 +4017,16 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+if(BUILD_TESTING)
+    add_test_executable(agc_flat_scratch_tests tests/FlatScratch.cpp)
+    target_link_libraries(agc_flat_scratch_tests PRIVATE shader_recompiler_agc_driver libc)
+    configure_windows_unwind(agc_flat_scratch_tests)
+    add_test(NAME agc_flat_scratch COMMAND agc_flat_scratch_tests)
+    set_tests_properties(agc_flat_scratch PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_flat_scratch PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
 add_test_executable(agc_constant_select_tests EXCLUDE_FROM_ALL tests/ConstantSelect.cpp)
 target_link_libraries(agc_constant_select_tests PRIVATE shader_recompiler_agc_driver libc)
 set_target_properties(agc_constant_select_tests PROPERTIES CXX_EXTENSIONS OFF)
@@ -3646,6 +4042,6 @@ endif()
 
 if(BUILD_TESTING)
     get_directory_property(agcRegisteredTests TESTS)
-    list(FILTER agcRegisteredTests EXCLUDE REGEX "^(agc_pipeline_journal(_long_paths|_extended_paths)?|agc_driver_pipeline_journal)$")
+    list(FILTER agcRegisteredTests EXCLUDE REGEX "^(agc_pipeline_journal(_long_paths|_extended_paths)?|agc_driver_pipeline_journal|agc_pipeline_store_replay_growth)$")
     set_property(TEST ${agcRegisteredTests} APPEND PROPERTY ENVIRONMENT "APS5_NO_PIPELINE_JOURNAL=1")
 endif()
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp
index 56dd9215f3..501c86b224 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp
@@ -13,6 +13,12 @@
 
 namespace AgcDriver {
 
+inline const char* CaptureTracePath() {
+    const char* configuredPath = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    if (configuredPath != nullptr && configuredPath[0] != '\0') return configuredPath;
+    return "capture-trace.log";
+}
+
 class CaptureTrace {
 public:
     static bool Enabled() {
@@ -30,6 +36,14 @@ public:
         trace.append(std::string(line.data(), static_cast<std::size_t>(size)));
     }
 
+    template<typename... TArgs>
+    static void LogBestEffort(const char* format, TArgs... args) noexcept {
+        try {
+            Log(format, args...);
+        } catch (...) {
+        }
+    }
+
 private:
     static CaptureTrace& instance() {
         static CaptureTrace trace;
@@ -37,8 +51,13 @@ private:
     }
 
     CaptureTrace() {
+        const char* path = CaptureTracePath();
+        output.open(path, std::ios::binary);
+        if (!output.is_open()) {
+            std::fprintf(stderr, "Capture trace open failed for %s\n", path);
+            return;
+        }
         output.exceptions(std::ios::badbit | std::ios::failbit);
-        output.open("capture-trace.log", std::ios::binary);
         worker = std::thread([this] { run(); });
     }
 
@@ -48,10 +67,11 @@ private:
             stopping = true;
         }
         changed.notify_one();
-        worker.join();
+        if (worker.joinable()) worker.join();
     }
 
     void append(std::string line) {
+        if (!output.is_open()) return;
         const auto elapsed = std::chrono::duration_cast<std::chrono::microseconds>(std::chrono::steady_clock::now() - start).count();
         std::lock_guard lock(mutex);
         if (pending.size() + line.size() + 64 > 16 * 1024 * 1024) throw std::runtime_error("Capture trace queue exceeded 16 MiB");
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp
index c82357c4ec..4646531f5a 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp
@@ -16,6 +16,17 @@
 
 namespace AgcDriver {
 
+struct DeviceDiagnostics {
+    bool config = false;
+    bool checkpoints = false;
+    VkDeviceDiagnosticsConfigFlagsNV flags = 0;
+};
+
+inline DeviceDiagnostics ChooseDeviceDiagnostics(bool requested, bool configSupported, bool checkpointsSupported) {
+    if (!requested || !configSupported) return {};
+    return {true, checkpointsSupported, VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_DEBUG_INFO_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_RESOURCE_TRACKING_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_AUTOMATIC_CHECKPOINTS_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_ERROR_REPORTING_BIT_NV};
+}
+
 inline const char* DeviceFaultAddressKind(VkDeviceFaultAddressTypeEXT type) {
     switch (type) {
     case VK_DEVICE_FAULT_ADDRESS_TYPE_NONE_EXT: return "none";
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
index b599b88f95..03e68cd1b7 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
@@ -1,8 +1,10 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_HPP
 
+#include <cstddef>
 #include <cstdint>
 #include <span>
+#include <cstddef>
 #include "SceTypes.hpp"
 #include "SceShaders.hpp"
 
@@ -10,8 +12,17 @@ namespace AgcDriver {
 
 void Submit(const Packet* packet, std::uint32_t queue);
 
+struct AwaitedWait {
+    std::uint64_t address = 0;
+    std::uint64_t reference = 0;
+    std::uint64_t mask = 0;
+    std::uint32_t function = 0;
+    std::uint32_t bytes = 0;
+};
+
 }
 
+extern "C" void AgcDriverPrepareCommandWrite_nid_no_patch(std::uint64_t address, std::size_t bytes);
 extern "C" void AgcDriverWaitIdle_nid_postfix();
 extern "C" void AgcDriverRaiseWorkerThreadPriority_nid_postfix(const char* role);
 extern "C" void AgcDriverLockVulkanLoader_nid_postfix();
@@ -19,7 +30,11 @@ extern "C" void AgcDriverUnlockVulkanLoader_nid_postfix();
 extern "C" void AgcDriverShutdown_nid_postfix();
 extern "C" void AgcDriverRequestScreenshot_nid_postfix();
 extern "C" void AgcDriverSuspendPoint_nid_postfix();
+extern "C" void AgcDriverSerialProgress_nid_postfix(std::uint64_t* accepted, std::uint64_t* completed);
+extern "C" std::size_t AgcDriverAwaitedWaits_nid_postfix(AgcDriver::AwaitedWait* waits, std::size_t capacity);
 extern "C" std::uint64_t AgcDriverDispatchesAdoptedAhead_nid_postfix();
+extern "C" std::uint64_t AgcDriverDispatchesRejectedAhead_nid_postfix();
+extern "C" void AgcDriverSetAheadAdoptHook_nid_postfix(void (*hook)());
 extern "C" void AgcDriverRegisterShader_nid_postfix(const Shader* shader);
 extern "C" void AgcDriverResolveShaderAbi_nid_postfix(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
 extern "C" void AgcDriverResolveGraphicsStagesAbi_nid_postfix(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp
index 39bb6c35c9..86505f5a7b 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp
@@ -10,7 +10,7 @@ namespace AgcDriver::DriverDetail {
 
 double TraceMs();
 
-std::uint64_t SkippedShader();
+bool SkippedShader(std::uint64_t address);
 
 class RefusedDraw final : public std::runtime_error {
 public:
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp
index 50844922e8..f2bc4960a5 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp
@@ -55,6 +55,7 @@ public:
     std::uint64_t DecodeDrains() const { return decodeDrains.load(std::memory_order_relaxed); }
     std::optional<std::uint64_t> PendingLabel(std::uint64_t address, std::size_t bytes);
     static bool HeldReads(std::uint64_t address, std::size_t bytes);
+    static std::uint64_t HeldReadQueries();
     void ReleaseRunningReads();
 
     static bool MetadataPassesPipelined();
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
index a331ac8de8..e2b2f7be80 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
@@ -2,6 +2,7 @@
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_DRIVER_HPP
 
 #include "prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionRing.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Packets/PacketHistory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Dispatch/DispatchCache.hpp"
@@ -58,12 +59,20 @@ public:
     void Shutdown();
     void WaitIdle();
     std::uint64_t DispatchesAdoptedAhead() const;
+    std::uint64_t DispatchesRejectedAhead() const;
+    void SetAheadAdoptHook(void (*hook)());
     void CheckFailure();
     void ReportFailure(std::exception_ptr error);
     void Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip = false);
     void SubmitFlip(const FlipInfo& info);
     void SuspendPoint();
     std::uint32_t ReserveEopFlip(const FlipInfo& info);
+    std::uint32_t ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token);
+    std::vector<std::uint32_t> PendingEopFlipTokens();
+    std::pair<std::uint64_t, std::uint64_t> SerialProgress();
+    std::uint64_t FlipSubmissions() const;
+    std::vector<AwaitedWait> AwaitedWaits();
+    bool WaitIdleFor(std::chrono::milliseconds timeout);
     void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output);
     void UnregisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output);
     void AttachWindow(const PresentationWindow& window);
@@ -74,6 +83,17 @@ public:
     void ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
     void ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType);
     void SettleShaderPreparations(std::span<const Shader* const> stages);
+    [[nodiscard]] std::size_t PreparedEntries(const Shader* shader);
+    struct DeferredAbiUseCounts {
+        std::uint64_t firstUses;
+        std::uint64_t found;
+        std::uint64_t own;
+        std::uint64_t entries;
+        std::uint64_t unmatchedEntries;
+    };
+    [[nodiscard]] static DeferredAbiUseCounts DeferredAbiUses();
+    [[nodiscard]] std::vector<std::array<std::uint64_t, 2>> PreparedEntryHashes(const Shader* shader);
+    [[nodiscard]] std::array<std::uint64_t, 4> PrebuiltLibraries();
     static void FoldDrawOffsets(const ShaderRecompiler::RecompileResult& result, const DrawProgram& program, Pm4::DrawParameters& parameters);
     static std::optional<Graphics::IndirectDrawPath> ClassifyIndirectDraw(const ShaderRecompiler::RecompileResult& result, const Graphics::State& graphics, const DrawProgram& frontProgram, const std::shared_ptr<VulkanDevice>& localDevice, Pm4::DrawParameters& drawParameters, bool traceIndirect);
     static void tagVariantRuns(DispatchVariant& variant, std::span<const ShaderRecompiler::MemoryRegion> regions, const ShaderRecompiler::SrtUserDataUse& use, bool eligible, std::uint32_t hiddenWords, std::span<const std::shared_ptr<const ShaderRecompiler::SrtGuestWords>> supplied = {});
@@ -98,6 +118,7 @@ private:
     Driver();
     void rethrowFailure() const;
     void checkStopping() const;
+    std::uint32_t reserveEopFlip(const FlipInfo& info, std::uint32_t token);
     static bool& onWorkerThread();
     static void copyCommands(Submission& submission, const std::uint32_t* guest, std::size_t words);
     static bool copySegment(Submission& submission, const std::uint32_t* guest, std::size_t words, std::size_t& budget);
@@ -115,9 +136,9 @@ private:
     static void forgetUnfinishedWrites(QueueWorker& worker, std::span<const std::uint64_t> labelWrites);
     static bool& completionDeferred();
     void deferCompletion(const Submission& submission);
-    void submitOpenWork();
+    void submitOpenWork(const std::shared_ptr<SubmissionProgress>& progress = {});
     void wakeQueueZeroForCompletions();
-    void completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites);
+    void completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites, const std::shared_ptr<SubmissionProgress>& progress);
     static bool waitFree(const Submission& submission);
     bool queue0Before(std::uint64_t received) const;
     bool orderReleased(std::uint32_t queue, std::uint64_t received) const;
@@ -172,13 +193,13 @@ private:
     std::shared_ptr<DrawDecode> decodeDraw(const QueueState& queue, const Submission& submission, const Graphics::Context& context);
     void resolveDrawDecode(const QueueState& queue, const Submission& submission, const Graphics::Context& context, std::shared_ptr<const DrawDecode>& decode, bool registerKey, std::uint64_t drawKey, bool profile);
     void lookupDraw(const Submission& submission, const std::shared_ptr<VulkanDevice>& localDevice, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<DrawProgram>& programs, const std::vector<ShaderRecompiler::ProgramRole>& roles, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, bool useDrawEntries, bool registerKey, bool profile, std::uint64_t& drawKey, std::shared_ptr<DrawEntry>& entry, std::vector<std::shared_ptr<DispatchVariant>>& matched, std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool& drawHit, bool& verifyHit, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, const std::shared_ptr<DrawEntry>& dataEntry, DrawDataCandidates& dataCandidates, std::vector<StageDataHit>& stageData);
-    std::shared_ptr<const ShaderRecompiler::RecompileResult> materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics);
+    std::shared_ptr<const ShaderRecompiler::RecompileResult> materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::uint64_t traceToken, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics);
     static void recordStageDataPositions(DispatchVariant& variant, const ShaderRecompiler::ResourceCapture& capture, const std::vector<Graphics::DecodeRead>& decodeReads);
-    void cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey, bool shapeNeedsEntry = false);
+    void cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<StageDataHit>& stageData, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey, bool shapeNeedsEntry = false);
     static bool drawPrecheck();
-    std::optional<DrawVerdict> precheckDraw(const QueueState& queue, const Submission& submission, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect);
+    std::optional<DrawVerdict> precheckDraw(const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect);
     static std::uint32_t drawUserWord(const DrawProgram& program, std::int32_t sgpr);
-    DrawVerdict draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::string& rejected);
+    DrawVerdict draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::size_t packetOffset, std::string& rejected);
     DrawVerdict finishDraw(DrawTail& tail, PerformanceTimer& timing);
     void addDriverPhases(DispatchClass which, const std::array<double, DriverPhaseCount>& ms, bool hit, bool validated);
     static PendingDispatchPhases& pendingDispatchPhases();
@@ -251,7 +272,7 @@ private:
     void noteForeignWriter(std::uint64_t begin, std::uint64_t end, std::uint32_t queue);
     void noteDrawWriters(std::span<const Graphics::CompiledShader> stages, std::uint32_t queue);
     static std::vector<std::pair<std::uint64_t, std::uint64_t>> drawWriteRanges(const Graphics::State& graphics, std::span<const Graphics::CompiledShader> stages);
-    void commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey);
+    void commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey, VulkanDevice::DrawTraceContext trace = {});
     bool labelPacketQueues(std::span<const std::uint32_t> packet, std::uint32_t opcode);
     bool enqueueLabelPacket(std::span<const std::uint32_t> packet, std::uint32_t opcode, std::uint32_t queue);
     bool enqueueDmaPacket(std::span<const std::uint32_t> packet, std::uint32_t opcode, std::uint32_t queue, const QueueState& state);
@@ -298,7 +319,7 @@ private:
         std::chrono::steady_clock::time_point resolvedAt{};
     };
     struct GroupCaptureStats {
-        std::uint64_t runs = 0, resolved = 0, resolvedHits = 0, adopted = 0, addressMismatches = 0, keyMismatches = 0, failures = 0, stale = 0, labelOverlaps = 0, writtenBefore = 0, deviceRejects = 0, argumentMismatches = 0;
+        std::uint64_t runs = 0, resolved = 0, resolvedHits = 0, adopted = 0, addressMismatches = 0, keyMismatches = 0, memoryMismatches = 0, failures = 0, stale = 0, labelOverlaps = 0, writtenBefore = 0, deviceRejects = 0, argumentMismatches = 0;
         double resolveMs = 0, resolveMaxMs = 0, ageMs = 0, ageMaxMs = 0;
         std::chrono::steady_clock::time_point reported = std::chrono::steady_clock::now();
     };
@@ -356,6 +377,14 @@ private:
     std::shared_ptr<FrameTiming> pendingFrameTiming;
 
     std::atomic<std::uint64_t> flipsCounted{0};
+    struct AwaitedSlot {
+        std::atomic<std::uint64_t> address{0};
+        std::atomic<std::uint64_t> reference{0};
+        std::atomic<std::uint64_t> mask{0};
+        std::atomic<std::uint64_t> shape{0};
+    };
+    std::array<AwaitedSlot, SubmissionQueueEnd - 0x20 + 1> awaitedSlots{};
+    void noteWaitFields(std::uint32_t queue, std::span<const std::uint32_t> packet);
     std::atomic<std::uint64_t> flipSerial{0};
     std::atomic<std::uint64_t> flipBatchesUnsignaled{0};
 
@@ -389,7 +418,7 @@ private:
     std::unordered_set<std::uint64_t> traceShapes, traceKeysSeen, traceKeysEvicted;
     std::list<std::uint64_t> drawOrder;
     std::unordered_map<std::uint64_t, std::shared_ptr<const DrawRelocation>> drawRelocations;
-    std::unordered_map<std::uint64_t, std::shared_ptr<DrawEntry>> drawAliases;
+    std::unordered_map<std::uint64_t, std::uint64_t> drawAliases;
     DrawRelocationPending drawRelocationPending;
     std::unordered_map<std::uint64_t, DrawRelocationTrial> drawRelocationTrials;
     DrawRelocationCounters drawRelocationCounters;
@@ -447,6 +476,8 @@ private:
     std::atomic<std::uint64_t> evidenceReads{0};
     std::atomic<std::uint64_t> evidenceValidations{0};
     std::atomic<std::uint64_t> dispatchesAdoptedAhead{0};
+    std::atomic<std::uint64_t> dispatchesRejectedAhead{0};
+    std::atomic<void (*)()> aheadAdoptHook{nullptr};
 
     AgcDriver::Mutex writtenBuffersMutex;
     std::deque<WrittenBuffer> writtenBuffers;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp
index e71457e0f3..e45f794362 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp
@@ -3,6 +3,7 @@
 
 #include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstddef>
@@ -22,6 +23,7 @@ struct Submission {
     std::uint64_t serial;
     std::uint32_t queue;
     std::vector<std::uint32_t> commands;
+    std::shared_ptr<SubmissionProgress> progress;
 
     std::shared_ptr<const ShaderRegistry> shaders;
     std::map<std::size_t, std::shared_ptr<IFlipRequest>> flips;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp
new file mode 100644
index 0000000000..5194af7ce4
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp
@@ -0,0 +1,44 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_QUEUES_SUBMISSIONPROGRESS_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_QUEUES_SUBMISSIONPROGRESS_HPP
+
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <utility>
+
+namespace AgcDriver { class VulkanDevice; }
+
+namespace AgcDriver::DriverDetail {
+
+class SubmissionProgress {
+public:
+    using Clock = std::chrono::steady_clock;
+    using Ready = std::pair<std::shared_ptr<VulkanDevice>, std::uint64_t>;
+
+    void Publish(std::shared_ptr<VulkanDevice> device, std::uint64_t epoch) {
+        {
+            std::lock_guard lock(mutex);
+            result = {std::move(device), epoch};
+            ready = true;
+        }
+        changed.notify_one();
+    }
+
+    Ready WaitUntil(Clock::time_point deadline) {
+        std::unique_lock lock(mutex);
+        if (!changed.wait_until(lock, deadline, [&] { return ready; })) return {};
+        return result;
+    }
+
+private:
+    std::mutex mutex;
+    std::condition_variable changed;
+    Ready result;
+    bool ready = false;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp
index 059cd7253c..b1907257c4 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp
@@ -127,6 +127,8 @@ struct PreparedShaderState {
     struct Entry {
         std::size_t codeOffset;
         std::shared_ptr<const ShaderRecompiler::SourceHandle> handle;
+        bool fromDeferredAbi = false;
+        bool matched = false;
     };
     struct Rectangle {
         std::uint64_t vertexId;
@@ -153,6 +155,14 @@ struct PreparedShaderState {
     bool deferred = false;
 };
 struct PreparedShaders : PreparedShaderState {
+    struct DeferredAbi {
+        std::vector<std::uint64_t> key;
+        std::vector<std::pair<std::uint32_t, std::uint32_t>> context;
+        std::vector<std::pair<std::uint32_t, std::uint32_t>> primitive;
+        std::weak_ptr<VulkanDevice> device;
+    };
+    std::vector<DeferredAbi> deferredAbis;
+    bool deferredPreparing = false;
     std::mutex mutex;
     std::condition_variable settled;
     std::exception_ptr failure;
@@ -165,6 +175,8 @@ struct RegisteredShaderState {
     Registers shader;
     Registers context;
     Registers userConfig;
+
+    bool operator==(const RegisteredShaderState&) const = default;
 };
 
 struct ShaderSnapshot {
@@ -200,6 +212,9 @@ std::shared_ptr<const ShaderRecompiler::SourceHandle> PrepareShaderWithDiagnosti
 
 std::uint64_t NullPixelProgramAddress();
 ShaderSnapshot PrepareNullPixelProgram(const VulkanDevice& device);
+std::uint64_t DepthCopyPixelProgramAddress(bool multisampled);
+std::uint32_t DepthCopyPixelUserWords(bool multisampled);
+ShaderSnapshot PrepareDepthCopyPixelProgram(bool multisampled);
 std::optional<ShaderRecompiler::ShaderFloatMode> RegisteredFloatMode(const ShaderSnapshot& snapshot);
 std::optional<ShaderRecompiler::ShaderFloatMode> DispatchFloatMode(const ShaderSnapshot& snapshot, const Registers& live);
 std::shared_ptr<const ShaderSnapshot> RegisteredHeader(const ShaderRegistry& registry, const Shader* shader);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp
new file mode 100644
index 0000000000..b3721a17d5
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp
@@ -0,0 +1,138 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMECAPTURE_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMECAPTURE_HPP
+
+#include "SceShaders.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <mutex>
+#include <span>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace AgcDriver {
+
+enum class FrameCallKind : std::uint32_t {
+    RegisterShader = 1,
+    ResolveShaderAbi,
+    ResolveGraphicsAbi,
+    ResolveGraphicsStagesAbi,
+    RegisterVideoOutput,
+    SetTessellationFactorRing,
+    Submit,
+    Flip,
+    ReserveEopFlip,
+    Suspend,
+    Memory,
+    FrameStart,
+    End,
+    DisplayBuffer,
+    UnregisterVideoOutput,
+};
+
+struct FrameCall {
+    FrameCallKind kind = FrameCallKind::End;
+    std::uint64_t ordinal = 0;
+    std::uint64_t timeNs = 0;
+    std::uint64_t thread = 0;
+    std::uint64_t accepted = 0;
+    std::uint64_t completed = 0;
+    std::uint32_t queue = 0;
+    std::uint32_t flags = 0;
+    bool cpuFlip = false;
+    std::uint64_t address = 0;
+    std::uint64_t size = 0;
+    std::vector<std::uint64_t> values;
+    std::vector<ShaderRegister> context;
+    std::vector<ShaderRegister> primitive;
+};
+
+enum class FrameMemoryKind : std::uint32_t { Range = 1, Snapshot, Delta, Reference };
+
+enum class FrameRangeKind : std::uint32_t { Watched = 1, Unwatched, Section, Alias, File, Host };
+
+struct FrameRangeAccess {
+    static constexpr std::uint32_t Readable = 1;
+    static constexpr std::uint32_t Writable = 2;
+    static constexpr std::uint32_t Gpu = 4;
+};
+
+struct FrameMemoryChunk {
+    FrameMemoryKind kind = FrameMemoryKind::Range;
+    FrameRangeKind rangeKind = FrameRangeKind::Watched;
+    std::uint32_t protection = 0;
+    std::uint32_t access = 0;
+    std::uint64_t group = 0;
+    std::uint64_t completed = 0;
+    std::uint64_t address = 0;
+    std::uint64_t bytes = 0;
+    std::uint64_t compressedBytes = 0;
+    std::uint64_t offset = 0;
+};
+
+class FrameCaptureWriter {
+public:
+    static constexpr std::string_view CallsName = "calls.bin";
+    static constexpr std::string_view MemoryName = "memory.bin";
+    static constexpr std::string_view HeaderName = "capture.json";
+    static constexpr std::string_view CallsMagic = "aps5-frame-calls 1\n";
+    static constexpr std::string_view MemoryMagic = "aps5-frame-memory 1\n";
+    static constexpr std::size_t BlockBytes = 64u * 1024u;
+    static constexpr std::size_t ChunkBytes = 4u * 1024u * 1024u;
+
+    explicit FrameCaptureWriter(const std::filesystem::path& directory, int level = 1);
+    FrameCaptureWriter(const FrameCaptureWriter&) = delete;
+    FrameCaptureWriter& operator=(const FrameCaptureWriter&) = delete;
+
+    void WriteCall(const FrameCall& call);
+    void WriteRange(std::uint64_t address, std::uint64_t bytes, FrameRangeKind kind, std::uint32_t protection, std::uint32_t access);
+    std::uint64_t WriteSnapshot(std::uint64_t address, std::span<const std::byte> bytes);
+    void WriteDelta(std::uint64_t group, std::uint64_t completed, std::uint64_t address, std::span<const std::byte> bytes);
+    void WriteReference(std::uint64_t index, std::uint64_t address, std::span<const std::byte> pixels);
+    void Finish(std::string_view header);
+
+    std::uint64_t RawBytes() const;
+    std::uint64_t StoredBytes() const;
+    const std::filesystem::path& Directory() const;
+
+private:
+    void writeChunk(const FrameMemoryChunk& chunk, std::span<const std::byte> payload);
+    std::vector<std::byte> compress(std::span<const std::byte> bytes) const;
+
+    std::filesystem::path directory;
+    int level;
+    mutable std::mutex mutex;
+    std::ofstream calls;
+    std::ofstream memory;
+    std::uint64_t rawBytes = 0;
+    std::uint64_t storedBytes = 0;
+    bool finished = false;
+};
+
+class FrameCaptureReader {
+public:
+    explicit FrameCaptureReader(const std::filesystem::path& directory);
+
+    const std::vector<FrameCall>& Calls() const;
+    const std::vector<FrameMemoryChunk>& Chunks() const;
+    const std::string& Header() const;
+    bool Truncated() const;
+    void Read(const FrameMemoryChunk& chunk, std::span<std::byte> destination) const;
+    std::vector<std::byte> Read(const FrameMemoryChunk& chunk) const;
+
+private:
+    std::filesystem::path directory;
+    std::vector<FrameCall> calls;
+    std::vector<FrameMemoryChunk> chunks;
+    std::string header;
+    bool truncated = false;
+};
+
+std::string_view FrameCallName(FrameCallKind kind);
+bool AllZero(std::span<const std::byte> bytes);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
new file mode 100644
index 0000000000..e4ed5cf19b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
@@ -0,0 +1,116 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMERECORDER_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMERECORDER_HPP
+
+#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "SceShaders.hpp"
+#include "SceTypes.hpp"
+#include <chrono>
+#include <cstdint>
+#include <deque>
+#include <filesystem>
+#include <functional>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+class FrameRecorder {
+public:
+    static constexpr std::uint64_t DefaultFrames = 10;
+    static constexpr std::size_t ReservationHistory = 256;
+    static constexpr std::size_t SnapshotPieceBytes = 64u * 1024u * 1024u;
+    static constexpr std::uint64_t MinimumFreeBytes = std::uint64_t{4} << 30;
+    static constexpr std::size_t HostPageBytes = 4096;
+
+    static FrameRecorder* Active();
+
+    void RegisterShader(const Shader* shader);
+    void ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
+    void ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
+    void ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType);
+    void RegisterVideoOutput(std::uint32_t handle);
+    void UnregisterVideoOutput(std::uint32_t handle);
+    void Submit(const Packet& packet, std::uint32_t queue, const std::function<void()>& accept);
+    void Flip(const FlipInfo& info, const std::function<void()>& accept);
+    void ReserveEopFlip(const FlipInfo& info, std::uint32_t token);
+    void Suspend(const std::function<void()>& accept);
+    void PresentBuffer(const DisplayBuffer& buffer);
+    void FrameBoundary();
+
+private:
+    enum class State { Waiting, Recording, Done };
+
+    struct Range {
+        std::uint64_t address = 0;
+        std::uint64_t bytes = 0;
+        FrameRangeKind kind = FrameRangeKind::Watched;
+        std::uint32_t protection = 0;
+        std::uint32_t access = 0;
+        bool readable = false;
+    };
+
+    FrameRecorder(std::filesystem::path directory, std::filesystem::path trigger, std::uint64_t atBoundary, std::uint64_t frames);
+    struct Span {
+        std::uint64_t address = 0;
+        std::uint64_t bytes = 0;
+        std::uint64_t since = 0;
+    };
+
+    FrameCall make(FrameCallKind kind);
+    void record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders = {}, const std::function<void()>& accept = {});
+    void recordLocked(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders);
+    void emitDelta();
+    void emitShaderDelta(std::span<const Shader* const> shaders);
+    void writeDelta(std::span<const Span> spans, std::span<const std::uint64_t> hostPages, std::span<const Range> added = {});
+    bool triggered();
+    void start();
+    void finish();
+    void snapshot(const Range& range);
+    void writeReferenceFrames();
+    bool abandonIfDiskLow();
+    void stop(const char* reason);
+    std::string header() const;
+    std::vector<Range> committedRanges();
+    std::vector<Range> newRanges();
+
+    std::filesystem::path directory;
+    std::filesystem::path trigger;
+    std::uint64_t atBoundary = 0;
+    std::uint64_t frames = DefaultFrames;
+    std::mutex mutex;
+    State state = State::Waiting;
+    std::unique_ptr<FrameCaptureWriter> writer;
+    std::vector<FrameCall> prologue;
+    std::deque<FrameCall> reservations;
+    std::vector<Range> ranges;
+    std::map<std::uint64_t, std::uint64_t> shaderMarks;
+    std::map<std::uint64_t, std::uint64_t> hostPageHashes;
+    std::mutex displayMutex;
+    std::map<std::uint64_t, DisplayBuffer> displayBuffers;
+    std::uint64_t ordinal = 0;
+    std::uint64_t boundaries = 0;
+    std::uint64_t startBoundary = 0;
+    std::uint64_t recordedFrames = 0;
+    std::uint64_t generation = 0;
+    std::uint64_t deltaGroups = 0;
+    std::uint64_t deltaBytes = 0;
+    std::uint64_t snapshotBytes = 0;
+    std::uint64_t recordedCalls = 0;
+    std::uint64_t startAttempts = 0;
+    std::uint64_t unreadableBytes = 0;
+    std::uint64_t allocationsGeneration = 0;
+    std::uint64_t lateRanges = 0;
+    std::vector<std::string> warnings;
+    std::chrono::steady_clock::time_point origin;
+    std::chrono::steady_clock::time_point startedAt;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp
index 0e9c7b751a..67170acc07 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp
@@ -63,7 +63,7 @@ void WriteChanged(std::uint64_t address, std::span<const std::byte> current, std
 bool WriteWatched();
 void Unwatch(std::uint64_t address, std::size_t bytes);
 void Rewatch(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges);
-bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function<bool()>& import, bool staysWatched = true);
+bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function<bool()>& import, bool staysWatched = true, bool importMayWriteGuest = true);
 void SetUnwatchHook(void (*hook)(std::uint64_t address, std::size_t bytes));
 #ifdef _WIN32
 using FreshCollectHook = bool (*)(std::uintptr_t address, std::size_t bytes, void (*written)(void*, std::uintptr_t, std::uintptr_t), void* context);
@@ -81,6 +81,8 @@ struct UnchangedQuery {
 bool WrittenSince(std::uint64_t address, std::size_t bytes, std::uint64_t generation);
 bool UnchangedSinceAll(std::span<const UnchangedQuery> queries);
 std::uint64_t CollectCommittedWrites(std::uint64_t address, std::size_t bytes, std::vector<std::pair<std::uint64_t, std::uint64_t>>& ranges);
+std::uint64_t WriteGeneration();
+std::uint64_t CollectWrittenBlocks(std::uint64_t address, std::size_t bytes, std::uint64_t since, std::vector<std::pair<std::uint64_t, std::uint64_t>>& written);
 bool UnchangedCommittedSince(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges, std::uint64_t generation);
 // Returns the generation the blocks were stamped with (0 when the arena is not write-watched):
 // UnchangedSince(range, it) holds until the next store over the range.
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp
index e683bc7695..49858aaa31 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp
@@ -451,18 +451,30 @@ public:
 
     static void AppendString(std::string& output, std::string_view text) {
         output += '"';
-        for (const char character : text) {
+        std::size_t index = 0;
+        while (index < text.size()) {
+            const char character = text[index];
             const auto byte = static_cast<unsigned char>(character);
             if (character == '"' || character == '\\') {
                 output += '\\';
                 output += character;
-            } else if (byte < 0x20 || byte >= 0x7f) {
+            } else if (byte >= 0x80) {
+                if (const auto length = utf8SequenceLength(text, index); length != 0) {
+                    output.append(text.substr(index, length));
+                    index += length;
+                    continue;
+                }
+                char escaped[8];
+                std::snprintf(escaped, sizeof escaped, "\\u%04x", static_cast<unsigned>(byte));
+                output += escaped;
+            } else if (byte < 0x20 || byte == 0x7f) {
                 char escaped[8];
                 std::snprintf(escaped, sizeof escaped, "\\u%04x", static_cast<unsigned>(byte));
                 output += escaped;
             } else {
                 output += character;
             }
+            ++index;
         }
         output += '"';
     }
@@ -697,6 +709,34 @@ public:
     }
 
 private:
+    static std::size_t utf8SequenceLength(std::string_view text, std::size_t index) {
+        const auto lead = static_cast<unsigned char>(text[index]);
+        std::size_t length = 0;
+        unsigned char low = 0x80;
+        unsigned char high = 0xbf;
+        if (lead >= 0xc2 && lead <= 0xdf) {
+            length = 2;
+        } else if (lead >= 0xe0 && lead <= 0xef) {
+            length = 3;
+            if (lead == 0xe0) low = 0xa0;
+            if (lead == 0xed) high = 0x9f;
+        } else if (lead >= 0xf0 && lead <= 0xf4) {
+            length = 4;
+            if (lead == 0xf0) low = 0x90;
+            if (lead == 0xf4) high = 0x8f;
+        } else {
+            return 0;
+        }
+        if (text.size() - index < length) return 0;
+        for (std::size_t offset = 1; offset < length; ++offset) {
+            const auto next = static_cast<unsigned char>(text[index + offset]);
+            if (next < low || next > high) return 0;
+            low = 0x80;
+            high = 0xbf;
+        }
+        return length;
+    }
+
     static void AppendMachine(std::string& output, const TraceSummary& summary) {
         if (summary.host) {
             output += ",\"cpu\":";
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp
index e7d86a28bb..0b9bc1f9f8 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp
@@ -46,6 +46,7 @@ struct DrawParameters {
         std::uint32_t drawIndexLocation;
         bool drawIndexEnabled;
         std::uint32_t indxOffset;
+        bool indexLimitKnown = true;
         enum class Rule : std::uint8_t { InPlace, Constant };
         Rule vertexRule = Rule::Constant;
         Rule instanceRule = Rule::Constant;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/PresentMode.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/PresentMode.hpp
index cb448bbc44..17510d198b 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/PresentMode.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/PresentMode.hpp
@@ -3,6 +3,8 @@
 
 #include <vulkan/vulkan.h>
 #include <algorithm>
+#include <cstdint>
+#include <optional>
 #include <span>
 #include <stdexcept>
 #include <string_view>
@@ -22,6 +24,11 @@ inline VkPresentModeKHR SelectPresentMode(const char* requested, std::span<const
     return mode;
 }
 
+inline std::optional<std::uint32_t> SelectPresentQueue(std::uint32_t familyQueues, std::uint32_t queuesTaken) {
+    if (queuesTaken >= familyQueues) return std::nullopt;
+    return queuesTaken;
+}
+
 }
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp
index b0e88120aa..6507c50a22 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp
@@ -46,6 +46,8 @@ private:
     std::uint32_t sourceHeight = 0;
     VkImage sourceImage = VK_NULL_HANDLE;
     VkDeviceMemory sourceMemory = VK_NULL_HANDLE;
+    VkDeviceSize sourceBytes = 0;
+    std::uint32_t sourceMemoryType = 0;
     VkImage blackImage = VK_NULL_HANDLE;
     VkDeviceMemory blackMemory = VK_NULL_HANDLE;
 };
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp
index 8a178ac8fd..7c10d006f5 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp
@@ -272,7 +272,7 @@ struct QueueState {
     std::uint64_t indexBase = 0;
     std::uint64_t drawIndirectBase = 0;
     std::uint64_t dispatchIndirectBase = 0;
-    std::uint32_t indexBufferSize = 0;
+    std::optional<std::uint32_t> indexBufferSize;
     std::uint32_t indexType = 0;
     std::uint32_t instanceCount = 1;
     std::vector<std::string> markers;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp
index 98fd3cbadd..70d81c98a5 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp
@@ -16,6 +16,7 @@ public:
     ShaderPreparationTransaction& operator=(const ShaderPreparationTransaction&) = delete;
     PreparedShaderState& Edit(const ShaderSnapshot& snapshot);
     const PreparedShaderState& Read(const ShaderSnapshot& snapshot) const;
+    bool Tracks(const ShaderSnapshot& snapshot) const;
     void Hold();
     void Commit();
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp
index 30f42ba2ab..8675650a20 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp
@@ -9,6 +9,10 @@ inline bool SubgroupControlBarrierUsable(VkDriverId driver) {
     return driver != VK_DRIVER_ID_AMD_PROPRIETARY;
 }
 
+inline bool WorkgroupScopeFenceUsable(VkDriverId driver) {
+    return driver != VK_DRIVER_ID_AMD_PROPRIETARY;
+}
+
 }
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/SwapchainImages.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/SwapchainImages.hpp
new file mode 100644
index 0000000000..b3411ca19b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/SwapchainImages.hpp
@@ -0,0 +1,17 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_SWAPCHAINIMAGES_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_SWAPCHAINIMAGES_HPP
+
+#include <vulkan/vulkan.h>
+#include <algorithm>
+#include <cstdint>
+
+namespace AgcDriver {
+
+inline std::uint32_t SwapchainImageCount(const VkSurfaceCapabilitiesKHR& surface) {
+    const std::uint32_t count = std::max(surface.minImageCount, 3u);
+    return surface.maxImageCount != 0 ? std::min(count, surface.maxImageCount) : count;
+}
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/TessellationPipelineCache.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/TessellationPipelineCache.hpp
new file mode 100644
index 0000000000..7605cd2c68
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/TessellationPipelineCache.hpp
@@ -0,0 +1,14 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_TESSELLATIONPIPELINECACHE_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_TESSELLATIONPIPELINECACHE_HPP
+
+#include <vulkan/vulkan.h>
+
+namespace AgcDriver {
+
+inline bool TessellationPipelineCacheUsable(VkDriverId driver) {
+    return driver != VK_DRIVER_ID_MOLTENVK;
+}
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp
index 2c7443e9a5..c642371e8e 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp
@@ -55,6 +55,7 @@ public:
 
 extern "C" std::uint32_t AgcDriverReserveEopFlip_nid_postfix(const AgcDriver::FlipInfo& info);
 extern "C" void AgcDriverSubmitFlip_nid_postfix(const AgcDriver::FlipInfo& info);
+extern "C" std::uint32_t AgcDriverReserveEopFlipAt_nid_postfix(const AgcDriver::FlipInfo& info, std::uint32_t token);
 
 extern "C" void AgcDriverRegisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr<AgcDriver::IVideoOutput>& output);
 extern "C" void AgcDriverUnregisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr<AgcDriver::IVideoOutput>& output);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
index 2a5ed0ac82..dbdcfb88be 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
@@ -33,6 +33,7 @@ struct ComputePipelineObjects;
 struct RecipeHit;
 // The record tail shared by an ordinary dispatch and a recipe hit (VulkanDevice::recordDispatch).
 struct RecordedDispatch;
+struct DispatchCompletion;
 // The module, layout and pipeline a compute dispatch binds (VulkanDevice::createComputePipeline).
 struct ComputePipelineObjects;
 
@@ -44,9 +45,11 @@ struct DeviceQueuePlan {
     bool sparseBinding = false;
     std::uint32_t sparseFamily = VK_QUEUE_FAMILY_IGNORED;
     std::uint32_t sparseIndex = 0;
+    bool present = false;
+    std::uint32_t presentIndex = 0;
 };
 
-DeviceQueuePlan PlanDeviceQueues(std::span<const VkQueueFamilyProperties> families, std::uint32_t family, bool settles, bool sparseBinding);
+DeviceQueuePlan PlanDeviceQueues(std::span<const VkQueueFamilyProperties> families, std::uint32_t family, bool settles, bool sparseBinding, bool presents);
 
 class VulkanDevice {
 public:
@@ -57,6 +60,8 @@ public:
     // Builds the pipeline of a journaled compute result ahead of its first dispatch (the journal
     // replay's hook, on its threads): false when the device already holds a pipeline for the module.
     bool ReplayComputePipeline(const ShaderRecompiler::RecompileResult& shader, bool pushConstants);
+    bool HasComputePipeline(const ShaderRecompiler::RecompileResult& shader) const;
+    void PrebuildComputePipeline(const ShaderRecompiler::RecompileResult& shader, std::uint64_t programAddress = 0);
     // Starts the journal replay if the device has not (a headless device starts it at its first
     // draw or dispatch) and joins it (tests; the teardown joins it anyway).
     void WaitForPipelineJournalReplay();
@@ -104,16 +109,18 @@ public:
     bool CanWaitUnlocked() const;
     std::uint64_t SubmitAndEpoch();
     void WaitRecorded(std::uint64_t serial);
+    std::uint64_t SubmittedEpoch() const;
+    bool WaitRecordedFor(std::uint64_t serial, std::uint64_t timeoutNanos);
     void ReapRecorded(std::uint64_t serial);
     // Completes the batches that already finished (non-blocking); under the mutex.
     void ReapRecorded();
     // Records a store of `bytes` at a guest address behind the recorded work, so the value appears
     // once that work completed; the batch is submitted by the queue worker's flush rules (or at once
     // with APS5_LABEL_SUBMIT_NOW=1). `stamp` is the record-order stamp and `queue` the recording
-    // queue for the recorder's pending-label table. Returns 0 when recorded on the GPU, 5 when kept
-    // as a completion action behind pending write-backs, else why the CPU must write it:
-    // 1 nothing recorded (the write is already ordered), 2 write-backs pending and 3 memory not
-    // imported, 4 unsuitable size or alignment.
+    // queue for the recorder's pending-label table. Returns 0 when recorded on the GPU, 5 when stored
+    // by a completion behind pending CPU write-backs or completion stores, else why the CPU must
+    // write it: 1 nothing recorded (the write is already ordered), 2 write-backs pending (only with
+    // APS5_DRAIN_COMPLETION_LABELS=1) and 3 memory not imported, 4 unsuitable size or alignment.
     // `reapFirst` retires finished batches before the checks; a caller recording a group of labels
     // under one lock passes it for the first label only.
     int WriteLabelOnGpu(std::uint64_t address, std::span<const std::byte> bytes, std::uint64_t stamp, std::uint32_t queue, bool reapFirst = true);
@@ -223,7 +230,7 @@ public:
     bool ProvokingVertexLast() const;
     bool GraphicsPipelineLibraries() const;
     // A presentation is a few steps so the presenter holds GuestMemory::GpuMutex only while it
-    // touches the queue. Presentations are slots (FlipInFlight() + 1, each with its own command
+    // touches the main queue. Presentations are slots (FlipInFlight() + 1, each with its own command
     // buffer, fence, kept resident image and dump buffer): RetirePresents(keep) (no mutex) retires
     // the slots whose fence signaled, oldest first, and waits for the oldest ones until at most
     // `keep` are in flight (the only CPU wait of the flip path; it returns the time spent waiting);
@@ -232,7 +239,9 @@ public:
     // PresentClear/PresentDisplayBuffer record and submit the frame into the next slot (under the
     // mutex; the blit follows the frame's batches in queue order, so the displayed image is always
     // complete) and return whether one was submitted; QueuePresent hands the image to the swapchain
-    // (under the mutex). FinishPresent = RetirePresents(0): the render fence wait of the
+    // (on the device's presentation queue under that queue's mutex, with the GPU mutex released,
+    // when the presentation family had a free queue; otherwise on the main queue under the GPU
+    // mutex). FinishPresent = RetirePresents(0): the render fence wait of the
     // synchronous paths (APS5_FLIP_INFLIGHT=0, APS5_SYNC_FLIP, PresentPixels). AcquireImage returns
     // false when the swapchain is out of date (the frame is dropped; the next Resize recreates it);
     // a present without a prior AcquireImage acquires itself, one whose slot is in flight waits for
@@ -255,6 +264,7 @@ public:
     bool PresentDisplayBuffer(const DisplayBuffer& buffer);
     double FinishPresent();
     void QueuePresent();
+    bool PresentsOnOwnQueue() const;
     // At the flip packet (under the mutex): the recorder's submissions so far and, under
     // APS5_PROFILE_DRAW, how many in flight have not signaled (the frame record's batches_at_flip).
     void FlipBatches(std::uint64_t& submissions, std::uint64_t& unsignaled) const;
@@ -265,8 +275,8 @@ public:
     // blit-submit times after the flip packet; noted in-place reads checked
     // (APS5_FLIP_READ_CHECK=1) and found overwritten before the blit's fence.
     struct PresentStatistics {
-        std::uint64_t presents, gpuUnread, batchesAheadOfBlit, batchesAfterFlip, readsChecked, readsOverwritten, acquireDrops;
-        double gpuBusyMs, gpuGapMs, lastSubmitAfterFlipMs, blitSubmitAfterFlipMs;
+        std::uint64_t presents, gpuUnread, batchesAheadOfBlit, batchesAfterFlip, readsChecked, readsOverwritten, acquireDrops, keyWriterWaits;
+        double gpuBusyMs, gpuGapMs, lastSubmitAfterFlipMs, blitSubmitAfterFlipMs, keyWriterWaitMs;
     };
     static PresentStatistics PresentCounts();
     struct PresyncStatistics {
@@ -331,17 +341,17 @@ public:
     static void NoteRecipe(RecipeEvent event, RecipeKind kind);
     enum class DrawRecipePrecheck : std::size_t { NoRecipe, Device };
     static void NoteDrawRecipeMiss(DrawRecipePrecheck miss);
+    using DrawTraceContext = Graphics::DrawTraceContext;
     // `recipe`, when given, receives the DrawRecipe a recorded, cacheable, reusable, direct draw
     // built for its draw-cache entry (design_cpu_final M8); null otherwise.
-    void Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr);
+    void Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr, const DrawTraceContext* trace = nullptr);
     bool DrawInputsInPlace() const;
     std::optional<std::string> KnownDrawRejection(const Graphics::State& graphics, std::span<const Graphics::CompiledShader> shaders) const;
     void ColorMetadataPass(const Graphics::ColorMetadataPass& pass);
-    void DepthCopyPass(const Graphics::DepthCopyPass& pass);
     // A draw-cache hit recorded from its recipe (Graphics::DrawWithRecipe), under the mutex after
     // the packet's labels; Rebuild when the recipe's device is not this one or DrawWithRecipe
     // missed (nothing recorded: the caller runs Draw with the hit's stages and re-attaches).
-    RecipeOutcome DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe);
+    RecipeOutcome DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const DrawTraceContext* trace = nullptr);
     // The indirect draw features the device enabled, for the driver's decision whether an indirect
     // draw's records can be read by the GPU (Graphics::Draw) or must be resolved on the CPU.
     struct IndirectDrawSupport {
@@ -372,6 +382,7 @@ private:
     Graphics::Context buildContext() const;
     // Body of Dispatch and DispatchIndirect: `arguments` 0 dispatches x, y, z groups.
     IndirectOutcome dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipe, const std::array<std::uint32_t, 3>& threadGroup = {}, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear = std::nullopt);
+    IndirectOutcome recordCompletedDispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::uint64_t programAddress, std::shared_ptr<const Recipe>* recipeOut, const std::array<std::uint32_t, 3>& threadGroup, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear, DispatchCompletion& completion);
     // The stage-A pre-sync over `surfaces` (see PrepareDispatch): the serial waited for, 0 none.
     std::uint64_t presync(std::span<const Graphics::PresyncSurface> surfaces);
     std::shared_ptr<ComputePipelineObjects> computePipeline(const Graphics::Context& context, const ShaderRecompiler::RecompileResult& shader, VkDescriptorSetLayout setLayout, std::span<const std::uint32_t> layoutKey, VkShaderStageFlags pushStages, std::uint64_t programAddress);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp
index b94858e431..ca92adc259 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp
@@ -1,11 +1,19 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
+#include <array>
+#include <atomic>
+#include <charconv>
+#include <chrono>
 #include <cstdio>
 #include <cstdlib>
+#include <filesystem>
+#include <fstream>
 #include <mutex>
+#include <optional>
 #include <set>
 #include <stdexcept>
 #include <string_view>
+#include <system_error>
 
 namespace AgcDriver::DriverDetail {
 
@@ -14,9 +22,65 @@ double TraceMs() {
     return std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - origin).count();
 }
 
-std::uint64_t SkippedShader() {
-    static const std::uint64_t skipped = [] { const char* text = std::getenv("APS5_SKIP_SHADER"); return text ? std::strtoull(text, nullptr, 16) : 0ull; }();
-    return skipped;
+namespace {
+
+constexpr std::size_t MaxSkippedShaders = 256;
+std::array<std::atomic<std::uint64_t>, MaxSkippedShaders> skippedShaders{};
+std::atomic<std::size_t> skippedShaderCount{0};
+
+std::optional<std::uint64_t> programAddress(std::string_view word) {
+    if (word.starts_with("0x") || word.starts_with("0X")) word.remove_prefix(2);
+    std::uint64_t address = 0;
+    const auto [end, error] = std::from_chars(word.data(), word.data() + word.size(), address, 16);
+    if (word.empty() || error != std::errc{} || end != word.data() + word.size()) return std::nullopt;
+    return address;
+}
+
+void ReloadSkippedShaders(const char* path) {
+    static std::mutex reload;
+    static std::filesystem::file_time_type seen{};
+    const std::unique_lock lock(reload, std::try_to_lock);
+    if (!lock.owns_lock()) return;
+    std::error_code error;
+    const auto stamp = std::filesystem::last_write_time(path, error);
+    if (error || stamp == seen) return;
+    seen = stamp;
+    std::ifstream file(path);
+    std::size_t count = 0;
+    skippedShaderCount.store(0, std::memory_order_release);
+    for (std::string word; count < MaxSkippedShaders && file >> word;) {
+        if (word.starts_with('#')) {
+            std::getline(file, word);
+            continue;
+        }
+        const auto address = programAddress(word);
+        if (!address) {
+            std::fprintf(stderr, "[skip-shader] ignoring '%s' in %s: not a hexadecimal program address\n", word.c_str(), path);
+            continue;
+        }
+        if (*address != 0) skippedShaders[count++].store(*address, std::memory_order_relaxed);
+    }
+    skippedShaderCount.store(count, std::memory_order_release);
+    std::fprintf(stderr, "[skip-shader] %zu programs listed in %s\n", count, path);
+}
+
+}
+
+bool SkippedShader(std::uint64_t address) {
+    static const std::uint64_t single = [] { const char* text = std::getenv("APS5_SKIP_SHADER"); return text ? std::strtoull(text, nullptr, 16) : 0ull; }();
+    static const char* const file = std::getenv("APS5_SKIP_SHADER_FILE");
+    if (address == 0) return false;
+    if (address == single) return true;
+    if (file == nullptr) return false;
+    static std::atomic<std::chrono::steady_clock::rep> nextCheck{0};
+    const auto now = std::chrono::steady_clock::now().time_since_epoch();
+    auto due = nextCheck.load(std::memory_order_relaxed);
+    if (now.count() >= due && nextCheck.compare_exchange_strong(due, std::chrono::duration_cast<std::chrono::steady_clock::duration>(now + std::chrono::milliseconds(500)).count(), std::memory_order_relaxed)) ReloadSkippedShaders(file);
+    const auto count = skippedShaderCount.load(std::memory_order_acquire);
+    for (std::size_t index = 0; index < count; ++index) {
+        if (skippedShaders[index].load(std::memory_order_relaxed) == address) return true;
+    }
+    return false;
 }
 
 bool SkipRefusedDraws() {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
index 8110338e83..a08d54121c 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
@@ -16,6 +16,7 @@
 #include "Optimization/ResourceProgram.hpp"
 #include <algorithm>
 #include <cstdlib>
+#include <cstring>
 #include <optional>
 #include <stdexcept>
 #include <utility>
@@ -57,6 +58,19 @@ void ReportDispatchItems(bool profile) {
     std::fprintf(stderr, "[dispatch-item] %llu commit items (%llu recipes rebuilt on the committer); drained instead, cumulative:%s\n", static_cast<unsigned long long>(itemCommits.load(std::memory_order_relaxed)), static_cast<unsigned long long>(itemRebuilds.load(std::memory_order_relaxed)), drained.c_str());
 }
 
+bool CapturedCurrent(std::span<const ShaderRecompiler::MemoryRegion> captured, const ShaderSnapshot& code) {
+    for (const auto& region : captured) {
+        const auto address = region.guestAddress;
+        const auto bytes = region.bytes.size();
+        if (bytes == 0 || (address >= code.codeAddress && address < code.codeAddress + code.code.size() * sizeof(std::uint32_t)) || (!code.header.empty() && address >= code.headerAddress && address < code.headerAddress + code.header.size())) continue;
+        if (Driver::QueryPendingSpan(address, bytes, {}) != ShaderMemory::PendingWrite::None || !GuestMemory::Accessible(reinterpret_cast<const void*>(address), bytes)) return false;
+        GuestMemory::GuardRead(address, bytes);
+        GuestMemory::FlushGpuWrites(address, bytes);
+        if (std::memcmp(region.bytes.data(), reinterpret_cast<const void*>(address), bytes) != 0) return false;
+    }
+    return true;
+}
+
 }
 
 bool Driver::pipelineDispatch() {
@@ -66,7 +80,7 @@ bool Driver::pipelineDispatch() {
 void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::uint64_t indirectArguments) {
     PerformanceTimer timing("Driver.Dispatch");
     const auto address = (static_cast<std::uint64_t>(readRegister(queue.shader, 0x20c)) << 8u) | (static_cast<std::uint64_t>(readRegister(queue.shader, 0x20d) & 0xffu) << 40u);
-    if (address == SkippedShader() && address != 0) return;
+    if (SkippedShader(address)) return;
     auto registeredShader = RegisteredProgram(*submission.shaders, address, {0});
     if (!registeredShader) registeredShader = ReadRawShader(address);
     const auto& snapshot = *registeredShader;
@@ -281,6 +295,14 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
         fromAhead = false;
         ++groupStats.keyMismatches;
     }
+    if (fromAhead) {
+        if (const auto hook = aheadAdoptHook.load(std::memory_order_acquire)) hook();
+        if (!CapturedCurrent(ahead.captured, snapshot)) {
+            fromAhead = false;
+            ++dispatchesRejectedAhead;
+            ++groupStats.memoryMismatches;
+        }
+    }
     phaseTiming.Phase(PhaseKey);
     timing.Mark("decode_key_device_setup");
     bool readsClear = false;
@@ -414,6 +436,11 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
         parked.resolvedAt = std::chrono::steady_clock::now();
         ++groupStats.resolved;
         if (cached) ++groupStats.resolvedHits;
+        if (!cached && compiledResult != nullptr && !localDevice->HasComputePipeline(*compiledResult)) {
+            SubmitLibraryPrebuild([localDevice, compiledResult, address] {
+                try { localDevice->PrebuildComputePipeline(*compiledResult, address); } catch (const std::exception&) {}
+            });
+        }
         return;
     }
     if (verifyDataHits() && dataHit) verifyDataHit(snapshot, codeOffset, request, memory, address, *keepVariant, liveWords, *compiledResult);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
index 6391881462..50a5eee57b 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
@@ -2,9 +2,11 @@
 #include "ThreadOwned.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/DeferredLabels.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "Optimization/ResourceProgram.hpp"
 #include <algorithm>
 #include <cstdlib>
 #include <cstring>
@@ -40,7 +42,25 @@ std::uint64_t Driver::DispatchesAdoptedAhead() const {
     return dispatchesAdoptedAhead.load(std::memory_order_relaxed);
 }
 
+std::uint64_t Driver::DispatchesRejectedAhead() const {
+    return dispatchesRejectedAhead.load(std::memory_order_relaxed);
+}
+
+void Driver::SetAheadAdoptHook(void (*hook)()) {
+    aheadAdoptHook.store(hook, std::memory_order_release);
+}
+
+namespace {
+
+std::size_t& PreviewedUntil() {
+    static thread_local std::size_t until = 0;
+    return until;
+}
+
+}
+
 void Driver::clearResolvedAhead() {
+    PreviewedUntil() = 0;
     auto& resolved = resolvedAhead();
     if (resolved.empty()) return;
     groupCaptureStats().stale += resolved.size();
@@ -107,7 +127,8 @@ void Driver::resolveGroupAhead(const Submission& submission, const QueueState& l
     static const bool allQueues = std::getenv("APS5_GROUP_CAPTURE_ALL_QUEUES") != nullptr;
     if (!allQueues && submission.queue == 0) return;
     auto& resolved = resolvedAhead();
-    if (resolved.contains(from) || device.Load() == nullptr) return;
+    const auto localDevice = device.Load();
+    if (resolved.contains(from) || localDevice == nullptr) return;
     if (submission.queue == 0 && DrawPipeline::Depth() != 0 && DrawPipeline::Queue0().Busy()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, (submission.commands[from] >> 8u) & 0xffu);
     auto& stats = groupCaptureStats();
     const auto begin = std::chrono::steady_clock::now();
@@ -126,6 +147,110 @@ void Driver::resolveGroupAhead(const Submission& submission, const QueueState& l
         }
     } resolving;
     const auto& commands = submission.commands;
+    if (submission.shaders != nullptr && from >= PreviewedUntil()) {
+        bool hasFurtherDispatch = false;
+        std::size_t limit = from < commands.size() ? from + Pm4::PacketWords(commands[from]) : commands.size();
+        while (limit < commands.size()) {
+            const auto header = commands[limit];
+            if (Pm4::FillerPacket(header)) {
+                ++limit;
+                continue;
+            }
+            const auto count = Pm4::PacketWords(header);
+            if (limit + count > commands.size()) break;
+            const auto opcode = (header >> 8u) & 0xffu;
+            if (header == FlipPacketHeader || header == RenderingWaitPacketHeader || opcode == 0x22 || opcode == 0x3f || opcode == 0x3c || opcode == 0x93) break;
+            if (opcode == 0x15 || opcode == 0x16) hasFurtherDispatch = true;
+            limit += count;
+        }
+        PreviewedUntil() = limit;
+        if (hasFurtherDispatch) {
+            static thread_local QueueState* previewSlot = nullptr;
+            auto& preview = ShaderRecompiler::ThreadOwned(previewSlot);
+            preview.shader = live.shader;
+            preview.predication = live.predication;
+            std::vector<PreparedShaders*> pendingShaders;
+            std::vector<PreparedShaders*> submittedShaders;
+            std::size_t scan = from;
+            while (scan < limit) {
+                const auto header = commands[scan];
+                if (Pm4::FillerPacket(header)) {
+                    ++scan;
+                    continue;
+                }
+                const auto count = Pm4::PacketWords(header);
+                if (scan + count > limit) break;
+                const auto packet = std::span(commands).subspan(scan, count);
+                const auto opcode = (header >> 8u) & 0xffu;
+                const auto next = scan + count;
+                if (opcode == 0x15 || opcode == 0x16) {
+                    if (count < (opcode == 0x15 ? 5u : 3u)) break;
+                    if (scan > from) {
+                        const auto low = preview.shader.find(0x20c);
+                        const auto high = preview.shader.find(0x20d);
+                        if (low != preview.shader.end() && high != preview.shader.end()) {
+                            const auto address = (static_cast<std::uint64_t>(low->second) << 8u) | (static_cast<std::uint64_t>(high->second & 0xffu) << 40u);
+                            if (auto registered = RegisteredProgram(*submission.shaders, address, {0}); registered != nullptr && registered->type == 0) {
+                                bool isPending = false;
+                                bool isEmpty = false;
+                                {
+                                    std::lock_guard lock(registered->prepared->mutex);
+                                    isPending = registered->prepared->pending;
+                                    isEmpty = registered->prepared->entries.empty();
+                                }
+                                if (isPending) {
+                                    if (std::ranges::find(pendingShaders, registered->prepared.get()) == pendingShaders.end()) {
+                                        pendingShaders.push_back(registered->prepared.get());
+                                    }
+                                } else if (isEmpty && std::ranges::find(submittedShaders, registered->prepared.get()) == submittedShaders.end()) {
+                                    const auto codeOffset = static_cast<std::size_t>((address - registered->codeAddress) / sizeof(std::uint32_t));
+                                    if (codeOffset < registered->code.size()) {
+                                        try {
+                                            auto compute = Graphics::DecodeComputeStageInfo(preview.shader, registered->header);
+                                            submittedShaders.push_back(registered->prepared.get());
+                                            const auto rsrc2 = preview.shader.find(0x213);
+                                            const auto userCount = rsrc2 != preview.shader.end() ? ((rsrc2->second >> 1u) & 0x1fu) : 0u;
+                                            std::vector<std::uint32_t> userData(userCount, 0u);
+                                            for (std::uint32_t i = 0; i < userCount; ++i) {
+                                                if (const auto reg = preview.shader.find(0x240u + i); reg != preview.shader.end()) userData[i] = reg->second;
+                                            }
+                                            const auto wave = (packet.back() & 0x8000u) != 0 ? 32u : 64u;
+                                            SubmitRegistrationPreparation([registered, localDevice, address, codeOffset, wave, compute, userData = std::move(userData), state = preview.shader]() mutable {
+                                                std::vector<ShaderRecompiler::MemoryRegion> memory{{registered->codeAddress, std::as_bytes(std::span(registered->code))}};
+                                                if (!registered->header.empty()) memory.push_back({registered->headerAddress, registered->header});
+                                                ShaderRecompiler::RecompileRequest request{
+                                                    {ShaderRecompiler::ShaderStage::Compute, address, std::span(registered->code).subspan(codeOffset), registered->headerAddress, registered->header},
+                                                    {wave, 0, userData, compute, std::nullopt, std::nullopt, memory, DispatchFloatMode(*registered, state)},
+                                                    localDevice->ComputeTarget(wave),
+                                                    {0, 0, 0, 128}
+                                                };
+                                                try { static_cast<void>(InvocationFor(*registered, codeOffset, request)); } catch (const std::exception&) {}
+                                            }, registered->prepared.get());
+                                        } catch (const std::exception&) {}
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    Pm4::NoteDispatchRegisters(packet, preview);
+                } else if (Pm4::IndirectRegisterOpcode(opcode)) {
+                    const auto found = submission.registerLists.find(scan);
+                    if (count != 5 || found == submission.registerLists.end() || found->second.size() != static_cast<std::size_t>(packet[4]) * 2 || !Pm4::IndirectRegistersValid(found->second)) break;
+                    Pm4::ExecuteIndirectRegisters(packet, found->second, preview);
+                } else if (!Pm4::AccessesMemory(header) && opcode != 0x3c && opcode != 0x93 && opcode != 0x37 && opcode != 0x42 && opcode != 0x46 && opcode != 0x49 && opcode != 0x58) {
+                    try {
+                        Pm4::Execute(packet, preview);
+                    } catch (const std::exception&) {
+                        break;
+                    }
+                }
+                scan = next;
+            }
+            for (auto it = pendingShaders.rbegin(); it != pendingShaders.rend(); ++it) {
+                PrioritizeRegistrationPreparation(**it);
+            }
+        }
+    }
     for (std::size_t cursor = from; cursor < commands.size();) {
         const auto header = commands[cursor];
         if (Pm4::FillerPacket(header)) {
@@ -141,7 +266,7 @@ void Driver::resolveGroupAhead(const Submission& submission, const QueueState& l
         if (opcode == 0x3c || opcode == 0x93) {
             if (!Pm4::WaitSatisfiedUnchecked(packet) && !WrittenByRun(packet, labels)) break;
         } else if (opcode == 0x15 || opcode == 0x16) {
-            if (resolved.contains(cursor)) break;
+            if (count < (opcode == 0x15 ? 5u : 3u) || resolved.contains(cursor)) break;
             if (opcode == 0x16) {
                 std::uint64_t arguments = 0;
                 try {
@@ -209,9 +334,9 @@ void Driver::reportGroupCapture(std::uint32_t queue) {
     auto& stats = groupCaptureStats();
     const auto now = std::chrono::steady_clock::now();
     if (now - stats.reported < std::chrono::seconds(10)) return;
-    AgcDriver::ProfilePrint_nid_no_patch("[groupcap] queue 0x%x (10 s): %llu runs resolved %llu dispatches (%llu cache hits) in %.1f ms (max %.2f ms); %llu adopted %.2f ms after the resolve on average, max %.2f ms; mismatches: address %llu key %llu; %llu resolve failures, %llu stale, %llu label overlaps, %llu read an earlier dispatch's output, %llu rejected by the device, %llu dropped because the argument re-read differed\n",
+    AgcDriver::ProfilePrint_nid_no_patch("[groupcap] queue 0x%x (10 s): %llu runs resolved %llu dispatches (%llu cache hits) in %.1f ms (max %.2f ms); %llu adopted %.2f ms after the resolve on average, max %.2f ms; mismatches: address %llu key %llu memory %llu; %llu resolve failures, %llu stale, %llu label overlaps, %llu read an earlier dispatch's output, %llu rejected by the device, %llu dropped because the argument re-read differed\n",
                                          queue, static_cast<unsigned long long>(stats.runs), static_cast<unsigned long long>(stats.resolved), static_cast<unsigned long long>(stats.resolvedHits), stats.resolveMs, stats.resolveMaxMs,
-                                         static_cast<unsigned long long>(stats.adopted), stats.adopted != 0 ? stats.ageMs / static_cast<double>(stats.adopted) : 0.0, stats.ageMaxMs, static_cast<unsigned long long>(stats.addressMismatches), static_cast<unsigned long long>(stats.keyMismatches),
+                                         static_cast<unsigned long long>(stats.adopted), stats.adopted != 0 ? stats.ageMs / static_cast<double>(stats.adopted) : 0.0, stats.ageMaxMs, static_cast<unsigned long long>(stats.addressMismatches), static_cast<unsigned long long>(stats.keyMismatches), static_cast<unsigned long long>(stats.memoryMismatches),
                                          static_cast<unsigned long long>(stats.failures), static_cast<unsigned long long>(stats.stale), static_cast<unsigned long long>(stats.labelOverlaps), static_cast<unsigned long long>(stats.writtenBefore), static_cast<unsigned long long>(stats.deviceRejects), static_cast<unsigned long long>(stats.argumentMismatches));
     stats = GroupCaptureStats{};
     stats.reported = now;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp
index 08c3a7d1ac..4d85df3c00 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Memory/DrawWriteRanges.hpp"
@@ -9,6 +10,7 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "Optimization/ResourceProgram.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
 #include <atomic>
@@ -19,12 +21,106 @@
 #include <cstdio>
 #include <unordered_set>
 #include <cstdlib>
+#include <algorithm>
+#include <cstdlib>
 #include <cstdio>
 #include <cstring>
 #include <unordered_map>
+#include <atomic>
+#include <exception>
+#include <mutex>
+#include <set>
+#include <string>
+#include <string_view>
+#include <typeinfo>
 
 namespace AgcDriver::DriverDetail {
 
+namespace {
+
+bool TraceShaderCorrelation() {
+    static const bool enabled = std::getenv("APS5_TRACE_SHADER_CORRELATION") != nullptr;
+    return enabled && AgcDriver::CaptureTrace::Enabled();
+}
+
+std::atomic<std::uint64_t>& NextDrawTraceToken() {
+    static std::atomic<std::uint64_t> next{0};
+    return next;
+}
+
+std::string ExceptionReason(const std::exception_ptr& failure) {
+    try {
+        if (failure != nullptr) std::rethrow_exception(failure);
+    } catch (const std::exception& error) {
+        return error.what();
+    } catch (...) {
+    }
+    return "unknown exception";
+}
+
+const char* ExceptionType(const std::exception_ptr& failure) {
+    try {
+        if (failure != nullptr) std::rethrow_exception(failure);
+    } catch (const std::exception& error) {
+        return typeid(error).name();
+    } catch (...) {
+    }
+    return "unknown";
+}
+
+void TraceMaterializationFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, const char* phase, std::size_t completedSubdraws, const std::exception_ptr& failure) {
+    if (token == 0) return;
+    try {
+        const auto reason = ExceptionReason(failure);
+        AgcDriver::CaptureTrace::Log("draw-materialization-failed token=%llu submission=%llu queue=%x offset=%zu phase=%s exception=%s reason=%.256s completedSubdraws=%zu",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset, phase, ExceptionType(failure), reason.c_str(), completedSubdraws);
+    } catch (...) {
+
+    }
+}
+
+void TraceSubmissionFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, std::size_t completedSubdraws, const std::exception_ptr& failure) {
+    if (token == 0) return;
+    try {
+        const auto reason = ExceptionReason(failure);
+        AgcDriver::CaptureTrace::Log("draw-submission-failed token=%llu submission=%llu queue=%x offset=%zu exception=%s reason=%.256s completedSubdraws=%zu",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset, ExceptionType(failure), reason.c_str(), completedSubdraws);
+    } catch (...) {
+
+    }
+}
+
+void TraceDrawAttemptFailure(std::uint64_t token, const char* phase, const char* outcome, std::uint64_t submission, std::uint32_t queue, std::size_t packetOffset, std::string_view reason, std::string_view exceptionType = "none") {
+    if (token == 0) return;
+        AgcDriver::CaptureTrace::LogBestEffort("draw-attempt-failed token=%llu phase=%s outcome=%s submission=%llu queue=%x offset=%zu exception=%s reason=%.256s",
+            static_cast<unsigned long long>(token), phase, outcome, static_cast<unsigned long long>(submission), queue, packetOffset, exceptionType.data(), reason.data());
+}
+
+void TraceDrawAttemptException(std::uint64_t token, const char* phase, std::uint64_t submission, std::uint32_t queue, std::size_t packetOffset, const std::exception_ptr& failure) noexcept {
+    try {
+        TraceDrawAttemptFailure(token, phase, "exception", submission, queue, packetOffset, ExceptionReason(failure), ExceptionType(failure));
+    } catch (...) {
+
+    }
+}
+
+const char* DrawVerdictName(DrawVerdict verdict) {
+    switch (verdict) {
+        case DrawVerdict::Drawn: return "Drawn";
+        case DrawVerdict::Nothing: return "Nothing";
+        case DrawVerdict::Rejected: return "Rejected";
+    }
+    return "Unknown";
+}
+
+std::string_view TrimmedReason(std::string_view reason) {
+    if (reason.size() > 200) reason = reason.substr(0, 200);
+    return reason;
+    }
+
+}
+
+
 struct DrawTail {
     using GpuLock = std::unique_lock<std::remove_reference_t<decltype(GuestMemory::GpuMutex())>>;
     bool profile = false;
@@ -46,7 +142,8 @@ struct DrawTail {
     std::shared_ptr<DrawEntry> dataEntry;
     std::uint64_t shapeKey = 0;
     ShaderRecompiler::ShaderPixelStageInfo pixel{};
-    std::vector<DrawProgram> programs;
+    std::vector<DrawProgram> writablePrograms;
+    const std::vector<DrawProgram>* programs = nullptr;
     std::vector<ShaderRecompiler::MemoryRegion> memory;
     std::vector<ShaderRecompiler::LinkedProgram> linked;
     std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>> vertexInfos;
@@ -79,6 +176,8 @@ struct DrawTail {
     QueueState* queue = nullptr;
     std::span<const std::uint32_t> packet;
     std::string* rejected = nullptr;
+    std::uint64_t traceToken = 0;
+    VulkanDevice::DrawTraceContext trace{};
     std::string ownRejected;
     GpuLock* gpuLock = nullptr;
     GpuLock ownLock{GuestMemory::GpuMutex(), std::defer_lock};
@@ -94,7 +193,7 @@ void noteFinisherHandOff(bool handed) {
     if (!stats) return;
     const auto tenSeconds = std::chrono::duration_cast<std::chrono::seconds>(std::chrono::steady_clock::now().time_since_epoch()).count() / 10;
     if (reportedAt.exchange(tenSeconds, std::memory_order_relaxed) == tenSeconds) return;
-    std::fprintf(stderr, "[finisher] draws (10 s): %llu handed to the draw finisher, %llu finished on the worker%s\n", static_cast<unsigned long long>(handedOff.exchange(0)), static_cast<unsigned long long>(kept.exchange(0)), DrawFinisher::DrainText().c_str());
+    AgcDriver::ProfilePrint_nid_no_patch("[finisher] draws (10 s): %llu handed to the draw finisher, %llu finished on the worker%s\n", static_cast<unsigned long long>(handedOff.exchange(0)), static_cast<unsigned long long>(kept.exchange(0)), DrawFinisher::DrainText().c_str());
 }
 
 }
@@ -147,7 +246,7 @@ DrawFinisher::Pending heldWrites(const DrawTail& tail) {
         noteHeld(HeldReason::NoDecode);
         return held;
     }
-    if (tail.matched.size() != tail.programs.size()) {
+    if (tail.matched.size() != tail.programs->size()) {
         noteHeld(HeldReason::Size);
         return held;
     }
@@ -157,10 +256,10 @@ DrawFinisher::Pending heldWrites(const DrawTail& tail) {
         const auto& variant = tail.matched[i];
         if (variant == nullptr || variant->compiled == nullptr) {
             const bool candidates = !tail.drawHit && i < tail.dataCandidates.size() && !tail.dataCandidates[i].empty();
-            const auto& program = tail.programs[i];
+            const auto& program = (*tail.programs)[i];
             if (!candidates && program.snapshot != nullptr && !ProgramWritesMemory(*program.snapshot, program.codeOffset) && (program.tailContinuation == nullptr || !ProgramWritesMemory(*program.tailContinuation, 0))) continue;
             if (!candidates) {
-                const auto stage = tail.programs[i].binary.stage;
+                const auto stage = (*tail.programs)[i].binary.stage;
                 noteHeld(stage == ShaderRecompiler::ShaderStage::Fragment ? HeldReason::NullFragment : stage == ShaderRecompiler::ShaderStage::Vertex ? HeldReason::NullVertex : HeldReason::NullOther);
                 return held;
             }
@@ -206,7 +305,7 @@ std::unordered_map<std::uint64_t, bool>& CpuIndirectPrograms() {
 
 }
 
-DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::string& rejected) {
+DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::size_t packetOffset, std::string& rejected) {
     PerformanceTimer timing("Driver.Draw");
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     auto tailHolder = std::make_shared<DrawTail>();
@@ -230,8 +329,18 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         pending.tailAt = phaseLap;
         return DrawVerdict::Drawn;
     };
+    const std::uint64_t traceToken = TraceShaderCorrelation() ? NextDrawTraceToken().fetch_add(1, std::memory_order_relaxed) + 1 : 0;
+    if (traceToken != 0) {
+        AgcDriver::CaptureTrace::LogBestEffort("draw-attempt token=%llu submission=%llu queue=%x offset=%zu",
+                static_cast<unsigned long long>(traceToken), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset);
+    }
     auto& drawParameters = tail.drawParameters;
-    drawParameters = Pm4::ResolveDraw(packet, queue);
+    try {
+        drawParameters = Pm4::ResolveDraw(packet, queue);
+    } catch (...) {
+        TraceDrawAttemptException(traceToken, "resolve-draw", submission.serial, submission.queue, packetOffset, std::current_exception());
+        throw;
+    }
     tail.pipelined = DrawPipeline::Active();
     const bool pipelined = tail.pipelined;
     static const bool pipelinedIndirect = std::getenv("APS5_NO_PIPELINED_INDIRECT") == nullptr;
@@ -242,7 +351,10 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         if (!pipelinedIndirect || overlaps) pipeline.Drain(DrawPipeline::DrainReason::Indirect);
     }
     auto& traceIndirect = tail.traceIndirect;
-    if (const auto verdict = precheckDraw(queue, submission, packet, drawParameters, rejected, traceIndirect)) return *verdict;
+    if (const auto verdict = precheckDraw(queue, submission, packetOffset, packet, drawParameters, rejected, traceIndirect)) {
+        TraceDrawAttemptFailure(traceToken, "precheck", "rejected", submission.serial, submission.queue, packetOffset, rejected);
+        return *verdict;
+    }
     phaseTiming.Phase(DrawRowPrecheck);
     using Stage = ShaderRecompiler::ShaderStage;
     using Role = ShaderRecompiler::ProgramRole;
@@ -391,17 +503,25 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         }
         decode = std::move(refreshed);
     }
-    resolveDrawDecode(queue, submission, localDevice->graphicsContext(), decode, registerKey, drawKey, profile);
+    try {
+        resolveDrawDecode(queue, submission, localDevice->graphicsContext(), decode, registerKey, drawKey, profile);
+    } catch (...) {
+        TraceDrawAttemptFailure(traceToken, "decode", "exception", submission.serial, submission.queue, packetOffset, ExceptionReason(std::current_exception()));
+        throw;
+    }
     const auto& graphics = decode->state;
     auto& pixel = tail.pixel;
     pixel = decode->pixel;
-    auto& programs = tail.programs;
-    programs = decode->programs;
-    for (const auto& patch : userPatches) programs[patch.program].userData[patch.index] = patch.value;
-    if (const auto skipped = SkippedShader(); skipped != 0 && std::any_of(programs.begin(), programs.end(), [skipped](const DrawProgram& program) { return program.binary.codeAddress == skipped; })) return drawn();
+    const bool writesPrograms = graphics.stages.mesh || drawParameters.indirect || !userPatches.empty();
+    auto& writablePrograms = tail.writablePrograms;
+    if (writesPrograms) writablePrograms = decode->programs;
+    for (const auto& patch : userPatches) writablePrograms[patch.program].userData[patch.index] = patch.value;
+    tail.programs = writesPrograms ? &writablePrograms : &decode->programs;
+    const auto& programs = *tail.programs;
+    if (std::any_of(programs.begin(), programs.end(), [](const DrawProgram& program) { return SkippedShader(program.binary.codeAddress); })) return drawn();
     const bool emptyIndirectSkip = EmptyIndirectSkip();
     auto& cpuIndirectPrograms = CpuIndirectPrograms();
-    const auto recordDraws = [&](const Pm4::DrawArguments& arguments) { return arguments.count != 0 && arguments.instances != 0 && (!drawParameters.indexed || arguments.firstVertexOrIndex < drawParameters.indexCount); };
+    const auto recordDraws = [&](const Pm4::DrawArguments& arguments) { return arguments.count != 0 && arguments.instances != 0 && (!drawParameters.indexed || !drawParameters.indirect->indexLimitKnown || arguments.firstVertexOrIndex < drawParameters.indexCount); };
     if (emptyIndirectSkip && drawParameters.indirect && !programs.empty()) {
         const auto known = cpuIndirectPrograms.find(programs.front().binary.codeAddress);
         if (known != cpuIndirectPrograms.end() && known->second) {
@@ -420,7 +540,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     }
     const auto setMeshIndexBuffer = [&](const Pm4::DrawParameters& parameters) {
         if (!graphics.stages.mesh) return;
-        auto& words = programs.front().userData;
+        auto& words = writablePrograms.front().userData;
         require(programs.front().firstUserSgpr == 0 && words.size() >= ShaderRecompiler::MeshIndexBufferUserWord + 4, "mesh program lacks the hidden user words");
         const auto descriptor = Graphics::MeshIndexBufferDescriptor(parameters);
         std::copy(descriptor.begin(), descriptor.end(), words.begin() + ShaderRecompiler::MeshIndexBufferUserWord);
@@ -497,7 +617,6 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     auto& compiledStages = tail.compiledStages;
     compiledStages.reserve(programs.size());
     auto& stages = tail.stages;
-    results.reserve(programs.size() + 2u);
     stages.reserve(programs.size());
     auto& pushCursorBytes = tail.pushCursorBytes;
 
@@ -526,7 +645,12 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     auto& verifyHit = tail.verifyHit;
     tail.stageEntries = useDrawEntries && !(graphics.stages.tessellation && !drawParameters.indirect && drawParameters.instanceCount > 1u);
     const bool stageEntries = tail.stageEntries;
-    lookupDraw(submission, localDevice, graphics, pixel, programs, roles, vertexInfos, stageEntries, registerKey, profile, drawKey, entry, matched, matchedRegions, drawHit, verifyHit, phaseTiming, phaseMs, dataEntry, dataCandidates, stageData);
+    try {
+        lookupDraw(submission, localDevice, graphics, pixel, programs, roles, vertexInfos, stageEntries, registerKey, profile, drawKey, entry, matched, matchedRegions, drawHit, verifyHit, phaseTiming, phaseMs, dataEntry, dataCandidates, stageData);
+    } catch (...) {
+        TraceDrawAttemptException(traceToken, "lookup", submission.serial, submission.queue, packetOffset, std::current_exception());
+        throw;
+    }
     for (std::size_t i = 0; i < matched.size(); ++i) {
         if (matched[i] == nullptr || matched[i]->shaderDataPatches.empty()) continue;
         applyShaderDataPatches(*matched[i]);
@@ -538,6 +662,14 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         if (drawHit || verifyHit) {
             ++drawRelocationCounters.hits;
             ++drawRelocationTrials[drawIdentity].hits;
+            if (const auto alias = drawAliases.find(drawAlias); alias != drawAliases.end()) {
+                const auto donor = drawCache.find(alias->second);
+                if (donor != drawCache.end() && drawCacheHits - donor->second->touched > drawCacheEntries() / 8) {
+                    drawOrder.splice(drawOrder.begin(), drawOrder, donor->second->order);
+                    donor->second->touched = drawCacheHits;
+                    ++drawEntryCounters.touches;
+                }
+            }
         }
         if (profile && drawRelocationCounters.lookups >= 100000) reportDrawRelocation();
     }
@@ -548,6 +680,22 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     }
     tail.patchedStages = std::any_of(stageData.begin(), stageData.end(), [](const StageDataHit& hit) { return hit.compiled != nullptr; });
     tail.relocatedDecode = relocatedDecode;
+    std::uint64_t stageDataVerified = 0;
+    const auto target = graphics.hasColorTarget ? graphics.color.address : 0;
+    const VulkanDevice::DrawTraceContext trace{traceToken, submission.serial, submission.queue, packetOffset, target};
+    const auto* tracePtr = trace.token != 0 ? &trace : nullptr;
+    tail.traceToken = traceToken;
+    tail.trace = trace;
+    if (trace.token != 0) {
+        for (std::size_t i = 0; i < programs.size(); ++i) {
+            const auto& program = programs[i];
+            AgcDriver::CaptureTrace::LogBestEffort("draw-selected token=%llu submission=%llu queue=%x offset=%zu snapshot=0x%llx code=%llx entryOffset=%zu entry=%llx stage=%u role=%u drawCacheHit=%u variantHit=%u target=%llx",
+                    static_cast<unsigned long long>(trace.token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset,
+                    static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(program.snapshot.get())), static_cast<unsigned long long>(program.snapshot->codeAddress), program.codeOffset,
+                    static_cast<unsigned long long>(program.snapshot->codeAddress + program.codeOffset), static_cast<unsigned>(program.binary.stage), static_cast<unsigned>(roles[i]),
+                    drawHit ? 1u : 0u, matched[i] != nullptr ? 1u : 0u, static_cast<unsigned long long>(target));
+        }
+    }
 
     if (registerKey) {
 
@@ -578,6 +726,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     tail.reg207 = readRegister(queue.context, 0x207);
     tail.dumpTarget = dumpTarget;
     tail.dumpSlot1 = dumpSlot1;
+    tail.packetOffset = packetOffset;
     const bool handOff = pipelined && !drawParameters.indirect && !profile && !lockedPrepare && dumpTarget == 0 && dumpSlot1 == 0 && !tracePrograms && !verifyDrawDataHits() && deferredLabels().labels.empty() && DrawFinisher::Enabled();
     if (handOff) {
         tail.epoch = DrawPipeline::EpochToken().load(std::memory_order_relaxed);
@@ -617,6 +766,11 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
     using Stage = ShaderRecompiler::ShaderStage;
     using Role = ShaderRecompiler::ProgramRole;
     const bool profile = tail.profile;
+    const auto traceToken = tail.traceToken;
+    const auto& trace = tail.trace;
+    const auto* tracePtr = trace.token != 0 ? &trace : nullptr;
+    const auto packetOffset = tail.packetOffset;
+    const auto packet = tail.packet;
     auto& phaseMs = tail.phaseMs;
     auto& phaseLap = tail.phaseLap;
     auto& captures = tail.captures;
@@ -640,7 +794,8 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
     auto& shapeKey = tail.shapeKey;
     const auto& graphics = decode->state;
     auto& pixel = tail.pixel;
-    auto& programs = tail.programs;
+    auto& writablePrograms = tail.writablePrograms;
+    const auto& programs = *tail.programs;
     const std::vector<Role>& roles = decode->roles;
     auto& memory = tail.memory;
     auto& linked = tail.linked;
@@ -682,7 +837,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
     };
     const auto setMeshIndexBuffer = [&](const Pm4::DrawParameters& parameters) {
         if (!graphics.stages.mesh) return;
-        auto& words = programs.front().userData;
+        auto& words = writablePrograms.front().userData;
         require(programs.front().firstUserSgpr == 0 && words.size() >= ShaderRecompiler::MeshIndexBufferUserWord + 4, "mesh program lacks the hidden user words");
         const auto descriptor = Graphics::MeshIndexBufferDescriptor(parameters);
         std::copy(descriptor.begin(), descriptor.end(), words.begin() + ShaderRecompiler::MeshIndexBufferUserWord);
@@ -746,6 +901,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
         throw std::runtime_error(message);
     };
     std::optional<Graphics::IndirectDrawPath> indirectCpu;
+    std::size_t completedSubdraws = 0;
     std::vector<std::uint32_t> pushOffsets(programs.size(), 0);
     std::optional<ShaderRecompiler::MeshBarycentricLayout> meshBarycentrics;
     std::vector<std::size_t> resultIndex(programs.size(), 0);
@@ -775,7 +931,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
                         break;
                     }
                 }
-                compiledStages.push_back(materializeDrawStage(i, pushCursorBytes, queue, submission, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
+                compiledStages.push_back(materializeDrawStage(i, pushCursorBytes, queue, submission, packetOffset, trace.token, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
                 if (!rejected.empty()) return DrawVerdict::Rejected;
                 programResults[i] = compiledStages.back().get();
                 if (candidate != dataCandidates[i].end()) verifyDataStage(i, *candidate->first);
@@ -791,10 +947,15 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
         } else if (i == 0) {
             fold(result, drawParameters);
         }
-        const auto slotEnd = (pushCursorBytes / Graphics::PipelinePushSlotBytes + 1u) * Graphics::PipelinePushSlotBytes;
-        require(result.pushConstants.size() <= slotEnd - pushCursorBytes, "stage push constants exceed the pipeline push constant block");
-        stages.push_back({program.binary.stage, &result, result.pushConstants.empty() ? 0u : pushCursorBytes});
-        pushCursorBytes += static_cast<std::uint32_t>(result.pushConstants.size());
+        try {
+            const auto slotEnd = (pushCursorBytes / Graphics::PipelinePushSlotBytes + 1u) * Graphics::PipelinePushSlotBytes;
+            require(result.pushConstants.size() <= slotEnd - pushCursorBytes, "stage push constants exceed the pipeline push constant block");
+            stages.push_back({program.binary.stage, &result, result.pushConstants.empty() ? 0u : pushCursorBytes});
+            pushCursorBytes += static_cast<std::uint32_t>(result.pushConstants.size());
+        } catch (...) {
+            TraceMaterializationFailure(trace.token, submission, packetOffset, "push-constant-validation", completedSubdraws, std::current_exception());
+            throw;
+        }
     }
 
     if (stageDataVerified != 0) {
@@ -828,7 +989,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
         return lastData[shapeKey % lastData.size()].exchange(data, std::memory_order_relaxed) == data;
     };
     const bool shapeNeedsEntry = shapeRefresh && registerKey && shapeKey != 0 && drawDataHits() && !drawParameters.indirect && dataEntry != nullptr && dataStagesCompiled != 0 && refreshSeenTwice();
-    cacheDrawStages(stageEntries, drawHit, drawParameters, indirectCpu, programs, stageCaptures, vertexInfos, decodeReads, verifyHit, matched, fresh, drawKey, registerKey, decode, phaseTiming, reused, entry, shapeKey, shapeNeedsEntry);
+    cacheDrawStages(stageEntries, drawHit, drawParameters, indirectCpu, programs, stageCaptures, vertexInfos, decodeReads, verifyHit, matched, stageData, fresh, drawKey, registerKey, decode, phaseTiming, reused, entry, shapeKey, shapeNeedsEntry);
     timing.Mark("shader_compile_and_link");
 
     for (const auto& reads : decodeReads) {
@@ -836,29 +997,35 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
     }
 
     if (tail.queue != nullptr && pipelined && !deferredLabels().labels.empty()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Labels);
-    if (tail.queue != nullptr && recordQueuedLabelsAfterCapture(submission.queue, memory)) return draw(*tail.queue, tail.packet, submission, rejected);
+    if (recordQueuedLabelsAfterCapture(submission.queue, memory)) return draw(*tail.queue, packet, submission, packetOffset, rejected);
 
     bool rectListBuilt = false;
 
     std::size_t rectIndex = 0;
     const auto buildRectList = [&] {
-        phaseTiming.Phase(DrawRowVectors);
-        require(programs.size() == 2 && programResults[0] != nullptr && programResults[1] != nullptr, "rect-list requires vertex and fragment programs");
-        auto rectangle = DrawRectangle(*programs[0].snapshot, programs[1].snapshot, programResults[0]->variantId, programResults[1]->variantId, localDevice->Target());
-        auto& control = graphics.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT ? rectangle.lastVertexControl : rectangle.control;
-        if (rectListBuilt) {
-            results[rectIndex] = std::move(control);
-            results[rectIndex + 1] = std::move(rectangle.evaluation);
+        try {
+            phaseTiming.Phase(DrawRowVectors);
+            require(programs.size() == 2 && programResults[0] != nullptr && programResults[1] != nullptr, "rect-list requires vertex and fragment programs");
+            auto rectangle = DrawRectangle(*programs[0].snapshot, programs[1].snapshot, programResults[0]->variantId, programResults[1]->variantId, localDevice->Target());
+            auto& control = graphics.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT ? rectangle.lastVertexControl : rectangle.control;
+            if (rectListBuilt) {
+                results[rectIndex] = std::move(control);
+                results[rectIndex + 1] = std::move(rectangle.evaluation);
+                phaseTiming.Phase(DrawRowRectList);
+                return;
+            }
+            require(stages.size() == 2, "rect-list requires vertex and fragment programs");
+            results.reserve(programs.size() + 2u);
+            rectIndex = results.size();
+            results.push_back(std::move(control));
+            results.push_back(std::move(rectangle.evaluation));
+            stages.insert(stages.begin() + 1, {{Stage::TessellationControl, &results[rectIndex], 0}, {Stage::TessellationEvaluation, &results[rectIndex + 1], 0}});
+            rectListBuilt = true;
             phaseTiming.Phase(DrawRowRectList);
-            return;
+        } catch (...) {
+            TraceMaterializationFailure(trace.token, submission, packetOffset, "rect-list", completedSubdraws, std::current_exception());
+            throw;
         }
-        require(stages.size() == 2, "rect-list requires vertex and fragment programs");
-        rectIndex = results.size();
-        results.push_back(std::move(control));
-        results.push_back(std::move(rectangle.evaluation));
-        stages.insert(stages.begin() + 1, {{Stage::TessellationControl, &results[rectIndex], 0}, {Stage::TessellationEvaluation, &results[rectIndex + 1], 0}});
-        rectListBuilt = true;
-        phaseTiming.Phase(DrawRowRectList);
     };
     if (graphics.rectList) buildRectList();
     if (!programs.empty() && programResults.back() != nullptr && programResults.back()->barycentricEmulation.active && graphics.stages.path == Graphics::ShaderPath::Geometry) {
@@ -868,16 +1035,17 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
         if (programResults[0]->meshBarycentrics != meshBarycentrics) {
             const auto pushBytes = programResults[0]->pushConstants.size();
             const auto exports = programResults[0]->parameterExports;
-            compiledStages.push_back(materializeDrawStage(0, pushOffsets[0], queue, submission, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
+            compiledStages.push_back(materializeDrawStage(0, pushOffsets[0], queue, submission, packetOffset, traceToken, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
             if (!rejected.empty()) return DrawVerdict::Rejected;
             programResults[0] = compiledStages.back().get();
             stages[0].program = programResults[0];
             require(programResults[0]->pushConstants.size() == pushBytes && programResults[0]->parameterExports == exports, "pairing the mesh program with its pixel shader changed the push constants or the parameter exports the pixel shader was built for");
         }
         require(programResults[0]->meshBarycentrics == meshBarycentrics, "the mesh program was compiled for a different barycentric layout than its pixel shader");
-    } else if (!programs.empty() && programResults.back() != nullptr && programResults.back()->barycentricEmulation.active) {
-        require(!graphics.rectList && graphics.stages.path == Graphics::ShaderPath::Vertex && programs.size() == 2 && programResults[0] != nullptr && stages.size() == 2, "a pixel shader that reads barycentrics without VK_KHR_fragment_shader_barycentric needs a vertex shader before it");
+    } else if (!graphics.rectList && !programs.empty() && programResults.back() != nullptr && programResults.back()->barycentricEmulation.active) {
+        require(graphics.stages.path == Graphics::ShaderPath::Vertex && programs.size() == 2 && programResults[0] != nullptr && stages.size() == 2, "a pixel shader that reads barycentrics without VK_KHR_fragment_shader_barycentric needs a vertex shader before it");
         const auto geometryLimits = localDevice->GeometryLimits();
+        results.reserve(programs.size() + 2u);
         if (geometryLimits || !localDevice->Target().tessellation) {
             results.push_back(ShaderRecompiler::BuildBarycentricGeometryShader(*programResults[0], *programResults[1], localDevice->Target(), geometryLimits));
             stages.insert(stages.begin() + 1, Graphics::CompiledShader{Stage::Geometry, &results.back(), 0});
@@ -919,6 +1087,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
     if (drawParameters.indirect && indirectCpu) {
 
         const auto indirect = *drawParameters.indirect;
+        results.reserve(programs.size() + 2u);
         for (std::size_t i = 0; i < programs.size(); ++i) {
             if (programResults[i] == nullptr) continue;
             resultIndex[i] = results.size();
@@ -937,7 +1106,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
         const auto baseVertexWords = UserDataWords(programs, roles, indirect.baseVertexLocation);
         const auto startInstanceWords = UserDataWords(programs, roles, indirect.startInstanceLocation);
         const auto drawIndexWords = indirect.drawIndexEnabled ? UserDataWords(programs, roles, indirect.drawIndexLocation) : std::vector<std::pair<std::size_t, std::size_t>>{};
-        const auto drawable = [&](const Pm4::DrawArguments& arguments) { return arguments.count != 0 && arguments.instances != 0 && (!drawParameters.indexed || arguments.firstVertexOrIndex < drawParameters.indexCount); };
+        const auto drawable = [&](const Pm4::DrawArguments& arguments) { return arguments.count != 0 && arguments.instances != 0 && (!drawParameters.indexed || !indirect.indexLimitKnown || arguments.firstVertexOrIndex < drawParameters.indexCount); };
         std::size_t lastDrawable = records.size();
         for (std::size_t record = 0; record < records.size(); ++record) {
             if (drawable(records[record])) lastDrawable = record;
@@ -949,7 +1118,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
             std::set<std::size_t> patched;
             const auto patch = [&](const std::vector<std::pair<std::size_t, std::size_t>>& words, std::uint32_t value) {
                 for (const auto& [program, word] : words) {
-                    programs[program].userData[word] = value;
+                    writablePrograms[program].userData[word] = value;
                     patched.insert(program);
                 }
             };
@@ -963,10 +1132,16 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
             }
             Pm4::DrawParameters direct{0, arguments.count, 0, arguments.instances, drawParameters.flags, drawParameters.indexed, 0, 0};
             if (drawParameters.indexed) {
-
-                if (arguments.firstVertexOrIndex >= drawParameters.indexCount) continue;
+                if (indirect.indexLimitKnown) {
+                    if (arguments.firstVertexOrIndex >= drawParameters.indexCount) continue;
+                    direct.indexCount = std::min(arguments.count, drawParameters.indexCount - arguments.firstVertexOrIndex);
+                } else {
+                    const auto end = static_cast<std::uint64_t>(arguments.firstVertexOrIndex) + arguments.count;
+                    require(end <= std::numeric_limits<std::uint32_t>::max(), "indirect draw index range overflow");
+                    require(end * drawParameters.indexSize <= std::numeric_limits<std::uint64_t>::max() - drawParameters.indexAddress, "indirect draw index range address overflow");
+                    direct.indexCount = arguments.count;
+                }
                 direct.indexAddress = drawParameters.indexAddress + static_cast<std::uint64_t>(arguments.firstVertexOrIndex) * drawParameters.indexSize;
-                direct.indexCount = std::min(arguments.count, drawParameters.indexCount - arguments.firstVertexOrIndex);
                 direct.indexSize = drawParameters.indexSize;
             } else {
                 direct.firstVertex = indirect.indxOffset;
@@ -979,7 +1154,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
                 auto& result = results[resultIndex[programIndex]];
                 const auto pushBytes = result.pushConstants.size();
                 decodeVertexInfo(programIndex);
-                result = *materializeDrawStage(programIndex, pushOffsets[programIndex], queue, submission, programs, graphics, pixel, vertexInfos, memory, linked, programs[programIndex].binary.stage == Stage::TessellationControl || programs[programIndex].binary.stage == Stage::TessellationEvaluation ? direct : drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics);
+                result = *materializeDrawStage(programIndex, pushOffsets[programIndex], queue, submission, packetOffset, trace.token, programs, graphics, pixel, vertexInfos, memory, linked, programs[programIndex].binary.stage == Stage::TessellationControl || programs[programIndex].binary.stage == Stage::TessellationEvaluation ? direct : drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics);
                 if (!rejected.empty()) return DrawVerdict::Rejected;
                 require(result.pushConstants.size() == pushBytes, "patched program changed its push constant layout");
             }
@@ -996,7 +1171,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
                 const auto commitQueue = submission.queue;
                 const auto commitPacket = tail.packetOpcode;
                 const auto epoch = DrawPipeline::EpochToken().load(std::memory_order_relaxed);
-                auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), direct, stages = std::move(stages), snapshots = std::move(snapshots), commitQueue, commitPacket, epoch, programs = std::move(programs), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)] {
+                auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), direct, stages = std::move(stages), snapshots = std::move(snapshots), commitQueue, commitPacket, epoch, writablePrograms = std::move(writablePrograms), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)] {
                     DrawPipeline::FollowEpoch(epoch);
                     GuestMemory::SetCurrentPacket(commitPacket, commitQueue);
                     commitDraw(localDevice, commitQueue, decode->state, direct, stages, snapshots, nullptr, {}, 0);
@@ -1011,7 +1186,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
             lockForDraw();
             noteDrawWriters(stages, submission.queue);
             phaseTiming.Phase(DrawRowVectors);
-            localDevice->Draw(graphics, direct, stages, snapshots);
+            localDevice->Draw(graphics, direct, stages, snapshots, nullptr, tracePtr);
             phaseTiming.Phase(DrawRowGraphics);
         }
         timing.Mark("draw_and_resource_release");
@@ -1042,10 +1217,10 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
         const auto commitPacket = tail.packetOpcode;
         const auto epoch = DrawFinisher::OnFinisherThread() ? tail.epoch : DrawPipeline::EpochToken().load(std::memory_order_relaxed);
         auto reads = QueuedDrawReadRanges(drawParameters, stages);
-        auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), drawParameters, stages = std::move(stages), snapshots = std::move(snapshots), recipe = std::move(recipe), recipeStages = std::move(recipeStages), drawKey, commitQueue, commitPacket, epoch, programs = std::move(programs), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)]() mutable {
+        auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), drawParameters, stages = std::move(stages), snapshots = std::move(snapshots), recipe = std::move(recipe), recipeStages = std::move(recipeStages), drawKey, commitQueue, commitPacket, epoch, trace = trace, writablePrograms = std::move(writablePrograms), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)]() mutable {
             DrawPipeline::FollowEpoch(epoch);
             GuestMemory::SetCurrentPacket(commitPacket, commitQueue);
-            commitDraw(localDevice, commitQueue, decode->state, drawParameters, stages, snapshots, recipe, recipeStages, drawKey);
+            commitDraw(localDevice, commitQueue, decode->state, drawParameters, stages, snapshots, recipe, recipeStages, drawKey, trace);
         };
         auto held = std::make_shared<decltype(commit)>(std::move(commit));
         DrawPipeline::Queue0().Enqueue([held] { (*held)(); }, std::move(writes), 0, {}, std::move(reads), true);
@@ -1058,7 +1233,7 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
     noteDrawWriters(stages, submission.queue);
     phaseTiming.Phase(DrawRowVectors);
     if (recipe != nullptr) {
-        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe) == RecipeOutcome::Recorded) {
+        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe, tracePtr) == RecipeOutcome::Recorded) {
             phaseTiming.Phase(DrawRowGraphics);
             timing.Mark("draw_and_resource_release");
             return drawn();
@@ -1067,14 +1242,15 @@ DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
         VulkanDevice::NoteRecipe(VulkanDevice::RecipeEvent::Restart, VulkanDevice::RecipeKind::Draw);
     }
     std::shared_ptr<const DrawRecipe> built;
-    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built);
+    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built, tracePtr);
     phaseTiming.Phase(DrawRowGraphics);
     if (built != nullptr) attachDrawRecipe(drawKey, recipeStages, std::move(built));
     timing.Mark("draw_and_resource_release");
     return drawn();
 }
 
-void Driver::commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey) {
+void Driver::commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey, VulkanDevice::DrawTraceContext trace) {
+    const auto* tracePtr = trace.token != 0 ? &trace : nullptr;
     GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
     std::lock_guard gpuLock(GuestMemory::GpuMutex());
     if (auto current = device.Load(); current != nullptr && current != localDevice) localDevice = std::move(current);
@@ -1088,11 +1264,11 @@ void Driver::commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t
     recordLabelsForPacket(localDevice.get(), queue);
     noteDrawWriters(stages, queue);
     if (recipe != nullptr) {
-        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe) == RecipeOutcome::Recorded) return;
+        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe, tracePtr) == RecipeOutcome::Recorded) return;
         VulkanDevice::NoteRecipe(VulkanDevice::RecipeEvent::Restart, VulkanDevice::RecipeKind::Draw);
     }
     std::shared_ptr<const DrawRecipe> built;
-    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built);
+    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built, tracePtr);
     if (built != nullptr) attachDrawRecipe(drawKey, recipeStages, std::move(built));
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp
index a76fd8e08d..a6f6b5ebd9 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
@@ -11,10 +12,55 @@
 #include <span>
 #include <sstream>
 #include <stdexcept>
+#include <exception>
+#include <typeinfo>
 
 namespace AgcDriver::DriverDetail {
 
-std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics) try {
+namespace {
+
+void TraceMaterializationFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, std::size_t stage, const char* phase, const std::exception_ptr& failure) {
+    if (token == 0) return;
+    const char* type = "unknown";
+    std::string reason = "unknown exception";
+    try {
+        if (failure != nullptr) std::rethrow_exception(failure);
+    } catch (const std::exception& error) {
+        type = typeid(error).name();
+        reason = error.what();
+    } catch (...) {
+    }
+    try {
+        AgcDriver::CaptureTrace::Log("draw-materialization-failed token=%llu submission=%llu queue=%x offset=%zu stage=%zu phase=%s exception=%s reason=%.256s",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset, stage, phase, type, reason.c_str());
+    } catch (...) {
+    }
+}
+
+void TraceShaderRequestFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, const DrawProgram& program, const std::exception_ptr& failure) noexcept {
+    if (token == 0) return;
+    try {
+        std::string reason = "unknown exception";
+        const char* type = "unknown";
+        try {
+            if (failure != nullptr) std::rethrow_exception(failure);
+        } catch (const std::exception& error) {
+            type = typeid(error).name();
+            reason = error.what();
+        } catch (...) {
+        }
+        AgcDriver::CaptureTrace::LogBestEffort("draw-shader-request-failed token=%llu submission=%llu queue=%x offset=%zu snapshot=0x%llx code=%llx codeOffset=%zu stage=%u type=%u reason=%.256s",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset,
+                static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(program.snapshot.get())),
+                static_cast<unsigned long long>(program.snapshot->codeAddress), program.codeOffset,
+                static_cast<unsigned>(program.binary.stage), static_cast<unsigned>(program.snapshot->type), reason.c_str());
+    } catch (...) {
+    }
+}
+
+}
+
+std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::uint64_t traceToken, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics) try {
     PerformanceTimer timing("Shader.DrawStage");
     using Stage = ShaderRecompiler::ShaderStage;
     phaseTiming.Phase(DrawRowVectors);
@@ -28,7 +74,14 @@ std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDraw
         ShaderRecompiler::GraphicsCompileContext{program.firstUserSgpr, linked, graphics.stages.mesh, graphics.stages.tessellation, {drawParameters.indexAddress, drawParameters.indexCount, drawParameters.indexSize, drawParameters.instanceCount}, program.binary.stage == Stage::Mesh ? meshBarycentrics : std::nullopt}
     };
     const auto waitedBefore = traceCapSync() || profile ? Graphics::Recorder::ThreadWaitedMs() : 0.0;
-    auto invocation = InvocationFor(*program.snapshot, program.codeOffset, request);
+    auto invocation = [&] {
+        try {
+            return InvocationFor(*program.snapshot, program.codeOffset, request);
+        } catch (...) {
+            TraceShaderRequestFailure(traceToken, submission, packetOffset, program, std::current_exception());
+            throw;
+        }
+    }();
     timing.Mark("prepared_invocation");
     auto& stageCapture = stageCaptures[i];
     stageCapture.forgetSerial = GuestMemory::ForgetSerial();
@@ -73,16 +126,16 @@ std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDraw
         ++captures;
         phaseTiming.Phase(DrawRowCapture);
 
-        const auto waited = std::min(Graphics::Recorder::ThreadWaitedMs() - waitedBefore, phaseMs[DrawRowCapture]);
-        phaseMs[DrawRowCapture] -= waited;
-        phaseMs[DrawRowCaptureHookWaits] += waited;
-    }
-    if (dumpTarget != 0) {
+            const auto waited = std::min(Graphics::Recorder::ThreadWaitedMs() - waitedBefore, phaseMs[DrawRowCapture]);
+            phaseMs[DrawRowCapture] -= waited;
+            phaseMs[DrawRowCaptureHookWaits] += waited;
+        }
+        if (dumpTarget != 0) {
 
         const auto slot0 = (static_cast<std::uint64_t>(readRegister(queue.context, 0x390)) << 40u) | (static_cast<std::uint64_t>(readRegister(queue.context, 0x318)) << 8u);
         if ((graphics.hasColorTarget && graphics.color.address == dumpTarget) || slot0 == dumpTarget) static_cast<void>(dumpRequest(program.binary.codeAddress, request));
-    }
-    if (dumpSlot1 != 0) {
+        }
+        if (dumpSlot1 != 0) {
         const auto value = [&](std::uint32_t offset) -> std::uint64_t { const auto it = queue.context.find(offset); return it == queue.context.end() ? 0u : it->second; };
         const auto slot1 = (value(0x391) << 40u) | (value(0x327) << 8u);
         if (slot1 == dumpSlot1) {
@@ -94,17 +147,18 @@ std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDraw
                 std::fclose(file);
             }
         }
-    }
+        }
 
-    phaseTiming.Phase(DrawRowCapture);
+        phaseTiming.Phase(DrawRowCapture);
 
     timing.Mark("capture_resources");
     try {
         stageCapture.compiled = invocation.Materialize(*capture);
+        stageCapture.capture = capture;
     } catch (const std::exception& error) {
+        TraceMaterializationFailure(traceToken, submission, packetOffset, i, "capture-or-materialize", std::current_exception());
         throw named(error, request.context.memory);
     }
-    stageCapture.capture = capture;
     timing.Mark("materialize");
     const auto walked = capture->userDataUse.asValue | capture->userDataUse.asBase;
     auto mask = walked == 0 ? ~std::uint64_t{0} : walked | stageCapture.compiled->userDataRegisterReads;
@@ -152,7 +206,7 @@ void Driver::recordStageDataPositions(DispatchVariant& variant, const ShaderReco
     variant.dataSlots.resize(kept);
 }
 
-void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey, bool shapeNeedsEntry) {
+void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<StageDataHit>& stageData, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey, bool shapeNeedsEntry) {
     const bool cacheable = useDrawEntries && !drawHit && !(drawParameters.indirect && indirectCpu);
     const bool admitted = cacheable && (verifyHit || admitDrawKey(drawKey, registerKey && drawDataHits() ? shapeKey : 0));
     const bool replaceShape = cacheable && !admitted && shapeNeedsEntry;
@@ -192,17 +246,17 @@ void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawP
                     ++differingRunsChanged;
                 }
             }
-            const auto sameContent = [](const DispatchVariant& a, const DispatchVariant& b) {
-                const auto flatten = [](const DispatchVariant& source) {
+            const auto sameContent = [](const DispatchVariant& a, const std::vector<std::uint32_t>& words, const DispatchVariant& b) {
+                const auto flatten = [](const DispatchVariant& source, const std::vector<std::uint32_t>& values) {
                     std::vector<std::pair<std::uint64_t, std::uint32_t>> flat;
                     std::size_t word = 0;
                     for (const auto& [begin, end] : source.runs) {
-                        for (auto address = begin; address < end && word < source.words.size(); address += sizeof(std::uint32_t)) flat.emplace_back(address, source.words[word++]);
+                        for (auto address = begin; address < end && word < values.size(); address += sizeof(std::uint32_t)) flat.emplace_back(address, values[word++]);
                     }
                     std::sort(flat.begin(), flat.end());
                     return flat;
                 };
-                return (a.runs == b.runs && a.words == b.words) || flatten(a) == flatten(b);
+                return (a.runs == b.runs && words == b.words) || flatten(a, words) == flatten(b, b.words);
             };
             const auto sameForwardedWords = [](const ShaderRecompiler::RecompileResult& a, const ShaderRecompiler::RecompileResult& b, std::uint32_t hidden) {
                 if (a.pushConstants.size() != b.pushConstants.size() || a.shaderDataUserWords != b.shaderDataUserWords) return false;
@@ -211,10 +265,14 @@ void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawP
                 }
                 return true;
             };
-            if (verifyHit && matched[i] != nullptr && (!sameContent(*matched[i], *variant) || !sameForwardedWords(*matched[i]->compiled, *variant->compiled, programs[i].hiddenUserWords))) {
-                ++mismatches;
-                static std::atomic<std::uint64_t> reports{0};
-                if (reports.fetch_add(1) < 20) std::fprintf(stderr, "[draw-cache] verify: stage %zu (program 0x%llx) of a hit captured differently: %zu runs / %zu words matched, %zu / %zu fresh\n", i, static_cast<unsigned long long>(programs[i].binary.codeAddress), matched[i]->runs.size(), matched[i]->words.size(), variant->runs.size(), variant->words.size());
+            if (verifyHit && matched[i] != nullptr) {
+                const auto& words = stageData[i].compiled != nullptr ? stageData[i].words : matched[i]->words;
+                const auto& compiled = stageData[i].compiled != nullptr ? *stageData[i].compiled : *matched[i]->compiled;
+                if (!sameContent(*matched[i], words, *variant) || !sameForwardedWords(compiled, *variant->compiled, programs[i].hiddenUserWords)) {
+                    ++mismatches;
+                    static std::atomic<std::uint64_t> reports{0};
+                    if (reports.fetch_add(1) < 20) std::fprintf(stderr, "[draw-cache] verify: stage %zu (program 0x%llx) of a hit captured differently: %zu runs / %zu words matched, %zu / %zu fresh\n", i, static_cast<unsigned long long>(programs[i].binary.codeAddress), matched[i]->runs.size(), words.size(), variant->runs.size(), variant->words.size());
+                }
             }
             if (insertCompare()) {
                 const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::DrawCache);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp
index 4b8ea5e15b..05c6b4dfa2 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp
@@ -179,12 +179,15 @@ std::shared_ptr<DrawDecode> Driver::decodeDraw(const QueueState& queue, const Su
     auto product = std::make_shared<DrawDecode>();
     product->state = Graphics::DecodeState(queue, VertexWorkgroupRequired(queue, *submission.shaders));
     DecodeGraphicsPrograms(*product, queue, *submission.shaders, false, true);
+    product->state.depthCopySource = std::ranges::any_of(product->programs, [](const DrawProgram& program) { return program.binary.codeAddress == DepthCopyPixelProgramAddress(true); });
     product->pixel = Graphics::DecodePixelStageInfo(queue.context, Graphics::ExportMappings(product->state), Graphics::PixelProgramSkipped(queue));
     Graphics::NormalizeUnusedViewportDepth(product->state, product->pixel);
     Graphics::ApplyDepthRemap(context, product->state);
+    Graphics::ApplyDepthBoundsEmulation(context, product->state, product->pixel);
     product->pixel.targetExportPacking = Graphics::ExportPackings(product->state);
     product->pixel.dualSourceBlend = product->state.dualSourceBlend;
     product->pixel.reversedBlend = product->state.reversedBlend;
+    product->pixel.targetMerge = Graphics::ExportTargetMerge(product->state);
     product->pixel.alphaToCoverage = product->state.alphaToCoverage;
     product->pixel.quadPixelMask = Graphics::QuadPixelMask(product->state);
     if (product->state.sampleLocationGrid) {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp
index 5cb9982751..ec65e9734e 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp
@@ -79,6 +79,12 @@ void Driver::lookupDraw(const Submission& submission, const std::shared_ptr<Vulk
             for (const auto value : pixel.targetExportPacking) mix(static_cast<std::uint64_t>(value));
             mix(pixel.dualSourceBlend);
             mix(pixel.reversedBlend);
+            mix(pixel.targetMerge.target);
+            mix(pixel.targetMerge.mask);
+            mix(pixel.targetMerge.samples);
+            for (const auto word : pixel.targetMerge.descriptor) mix(word);
+            mix(pixel.targetMerge.depthStencilWrites);
+            mix(pixel.targetMerge.depthStencilTests);
             mix(pixel.alphaToCoverage);
             mix(static_cast<std::uint64_t>(pixel.rasterPrimitive));
             mix(pixel.ditheredAlphaToCoverage);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp
index c207db4cc2..a34ffbd972 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp
@@ -3,6 +3,7 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/HandoffSpin.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/WorkerSampler.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
 #include <algorithm>
@@ -364,7 +365,7 @@ void DrawPipeline::report(std::chrono::steady_clock::time_point now) {
     std::snprintf(reads, sizeof(reads), " %llu read ranges, %llu stores held, %llu decode drains", static_cast<unsigned long long>(heldReadRanges.load(std::memory_order_relaxed)), static_cast<unsigned long long>(heldReadHits.exchange(0, std::memory_order_relaxed)), static_cast<unsigned long long>(decodeDrainCount - reportedDecodeDrains));
     reportedDecodeDrains = decodeDrainCount;
     drainText += reads;
-    std::fprintf(stderr, "[draw] pipelined (10 s, depth %zu): %llu commits at %.1f us each on the committer, %llu failed; %llu enqueued behind %.2f on average, waiting %.1f us per draw for room, %.2f us for the lock; %llu committer wakes;%s; drains:%s\n", Depth(), static_cast<unsigned long long>(commits), perCommit, static_cast<unsigned long long>(commitErrors), static_cast<unsigned long long>(enqueued), queued, perDraw, enqueued == 0 ? 0.0 : static_cast<double>(lockWaitNs) / 1e3 / static_cast<double>(enqueued), static_cast<unsigned long long>(wakes), reads, drainText.c_str());
+    AgcDriver::ProfilePrint_nid_no_patch("[draw] pipelined (10 s, depth %zu): %llu commits at %.1f us each on the committer, %llu failed; %llu enqueued behind %.2f on average, waiting %.1f us per draw for room, %.2f us for the lock; %llu committer wakes;%s; drains:%s\n", Depth(), static_cast<unsigned long long>(commits), perCommit, static_cast<unsigned long long>(commitErrors), static_cast<unsigned long long>(enqueued), queued, perDraw, enqueued == 0 ? 0.0 : static_cast<double>(lockWaitNs) / 1e3 / static_cast<double>(enqueued), static_cast<unsigned long long>(wakes), reads, drainText.c_str());
     commits = commitNs = commitErrors = enqueued = fullWaitNs = depthSum = wakes = lockWaitNs = 0;
     drains = {};
     drainWaitNs = {};
@@ -481,6 +482,10 @@ bool DrawPipeline::HeldReads(std::uint64_t address, std::size_t bytes) {
     return false;
 }
 
+std::uint64_t DrawPipeline::HeldReadQueries() {
+    return heldReadQueries.load(std::memory_order_relaxed);
+}
+
 void DrawPipeline::ReleaseRunningReads() {
     std::lock_guard lock(mutex);
     if (!items.empty()) items.front().reads.clear();
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp
index b6749edc50..033f0313a8 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp
@@ -1,6 +1,8 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/DeferredLabels.hpp"
@@ -8,12 +10,39 @@
 
 namespace AgcDriver::DriverDetail {
 
+namespace {
+
+QueueState DepthCopyDraw(const QueueState& queue, const Graphics::DepthCopyPass& copy) {
+    const bool multisampled = copy.source.samples != 1u;
+    const auto address = DepthCopyPixelProgramAddress(multisampled);
+    const auto words = Graphics::DepthCopySourceWords(copy.source);
+    QueueState draw = queue;
+    draw.context.insert_or_assign(0x000u, 0u);
+    draw.shader.insert_or_assign(0x008u, static_cast<std::uint32_t>(address >> 8u));
+    draw.shader.insert_or_assign(0x009u, static_cast<std::uint32_t>(address >> 40u));
+    draw.shader.insert_or_assign(0x00au, 0u);
+    draw.shader.insert_or_assign(0x00bu, DepthCopyPixelUserWords(multisampled) << 1u);
+    for (std::uint32_t index = 0; index < words.size(); ++index) draw.shader.insert_or_assign(0x00cu + index, words[index]);
+    if (multisampled) draw.shader.insert_or_assign(0x014u, copy.sample);
+    draw.context.insert_or_assign(0x1b3u, 0x8002u);
+    draw.context.insert_or_assign(0x1b4u, 0x8002u);
+    draw.context.insert_or_assign(0x1b6u, 0u);
+    draw.context.insert_or_assign(0x1c4u, 0u);
+    draw.context.insert_or_assign(0x1c5u, 1u);
+    draw.context.insert_or_assign(0x08fu, 1u);
+    draw.context.insert_or_assign(0x203u, 0u);
+    if (const auto alpha = draw.context.find(0x2dcu); alpha != draw.context.end()) draw.context.insert_or_assign(0x2dcu, alpha->second & ~1u);
+    return draw;
+}
+
+}
+
 bool Driver::drawPrecheck() {
     static const bool precheck = std::getenv("APS5_NO_DRAW_PRECHECK") == nullptr;
     return precheck;
 }
 
-std::optional<DrawVerdict> Driver::precheckDraw(const QueueState& queue, const Submission& submission, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect) {
+std::optional<DrawVerdict> Driver::precheckDraw(const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect) {
     if (!drawParameters.indirect && !drawParameters.indexed && (drawParameters.indexCount == 0 || drawParameters.instanceCount == 0)) return DrawVerdict::Nothing;
     if (const auto pass = Graphics::DecodeColorMetadataPass(queue)) {
         require(!drawParameters.indirect, "indirect CB metadata passes are unsupported");
@@ -47,14 +76,8 @@ std::optional<DrawVerdict> Driver::precheckDraw(const QueueState& queue, const S
     }
     if (const auto copy = Graphics::DecodeDepthCopyPass(queue)) {
         require(!drawParameters.indirect, "indirect DB depth copies are unsupported");
-        if (DrawPipeline::Active()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, (packet[0] >> 8u) & 0xffu);
-        GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
-        std::lock_guard gpuLock(GuestMemory::GpuMutex());
-        if (device == nullptr) device = std::make_shared<VulkanDevice>();
-        const std::shared_ptr<VulkanDevice> localDevice = device;
-        recordLabelsForPacket(localDevice.get(), submission.queue);
-        localDevice->DepthCopyPass(*copy);
-        return DrawVerdict::Drawn;
+        auto copyDraw = DepthCopyDraw(queue, *copy);
+        return draw(copyDraw, packet, submission, packetOffset, rejected);
     }
     if (Graphics::DepthResummarizeDrawsNothing(queue)) return DrawVerdict::Nothing;
     rejected = Graphics::DepthMaintenanceRejection(queue);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp
index 288ce32804..7acaf98715 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp
@@ -228,7 +228,7 @@ bool Driver::sameDecode(const DrawDecode& a, const DrawDecode& b) {
     const auto& s = a.state;
     const auto& t = b.state;
     const auto sameColor = [](const Graphics::ColorTarget& x, const Graphics::ColorTarget& y) {
-        return x.address == y.address && x.extent.width == y.extent.width && x.extent.height == y.extent.height && x.format == y.format && x.bytes == y.bytes && x.componentMapping == y.componentMapping && x.tileMode == y.tileMode && x.elementBytes == y.elementBytes && x.dccAddress == y.dccAddress && x.dccAlphaOnMsb == y.dccAlphaOnMsb && x.slot == y.slot && x.exportIndex == y.exportIndex;
+        return x.address == y.address && x.extent.width == y.extent.width && x.extent.height == y.extent.height && x.format == y.format && x.bytes == y.bytes && x.componentMapping == y.componentMapping && x.tileMode == y.tileMode && x.elementBytes == y.elementBytes && x.dccAddress == y.dccAddress && x.dccAlphaOnMsb == y.dccAlphaOnMsb && x.slot == y.slot && x.exportIndex == y.exportIndex && x.partialWriteMask == y.partialWriteMask;
     };
     const auto sameBlend = [](const VkPipelineColorBlendAttachmentState& x, const VkPipelineColorBlendAttachmentState& y) {
         return x.blendEnable == y.blendEnable && x.srcColorBlendFactor == y.srcColorBlendFactor && x.dstColorBlendFactor == y.dstColorBlendFactor && x.colorBlendOp == y.colorBlendOp && x.srcAlphaBlendFactor == y.srcAlphaBlendFactor && x.dstAlphaBlendFactor == y.dstAlphaBlendFactor && x.alphaBlendOp == y.alphaBlendOp && x.colorWriteMask == y.colorWriteMask;
@@ -251,7 +251,7 @@ bool Driver::sameDecode(const DrawDecode& a, const DrawDecode& b) {
     for (std::size_t i = 0; i < s.blends.size(); ++i) {
         if (!sameBlend(s.blends[i], t.blends[i])) return false;
     }
-    if (s.hasColorTarget != t.hasColorTarget || s.rectList != t.rectList || s.renderExtent.width != t.renderExtent.width || s.renderExtent.height != t.renderExtent.height || s.topology != t.topology || s.negativeOneToOne != t.negativeOneToOne || s.depthClamp != t.depthClamp || s.conservativeRasterization != t.conservativeRasterization || s.perSampleShading != t.perSampleShading || s.cullMode != t.cullMode || s.polygonMode != t.polygonMode || s.frontFace != t.frontFace || !sameBlend(s.blend, t.blend) || s.blendConstants != t.blendConstants) return false;
+    if (s.colorRop != t.colorRop || s.hasColorTarget != t.hasColorTarget || s.rectList != t.rectList || s.renderExtent.width != t.renderExtent.width || s.renderExtent.height != t.renderExtent.height || s.topology != t.topology || s.negativeOneToOne != t.negativeOneToOne || s.depthClamp != t.depthClamp || s.conservativeRasterization != t.conservativeRasterization || s.perSampleShading != t.perSampleShading || s.cullMode != t.cullMode || s.polygonMode != t.polygonMode || s.frontFace != t.frontFace || !sameBlend(s.blend, t.blend) || s.blendConstants != t.blendConstants) return false;
     if (std::memcmp(&s.viewport, &t.viewport, sizeof(VkViewport)) != 0 || std::memcmp(&s.scissor, &t.scissor, sizeof(VkRect2D)) != 0) return false;
     const auto& p = a.pixel;
     const auto& q = b.pixel;
@@ -262,8 +262,8 @@ bool Driver::sameDecode(const DrawDecode& a, const DrawDecode& b) {
         const auto& y = b.programs[i];
         if (x.binary.stage != y.binary.stage || x.binary.codeAddress != y.binary.codeAddress || x.userDataBase != y.userDataBase || x.firstUserSgpr != y.firstUserSgpr || x.userData != y.userData || x.snapshot != y.snapshot || x.codeOffset != y.codeOffset || x.tailContinuation != y.tailContinuation) return false;
     }
-    if (p.targetExportPacking != q.targetExportPacking || p.dualSourceBlend != q.dualSourceBlend || p.reversedBlend != q.reversedBlend || p.alphaToCoverage != q.alphaToCoverage || p.rasterPrimitive != q.rasterPrimitive || p.ditheredAlphaToCoverage != q.ditheredAlphaToCoverage || p.quadPixelMask != q.quadPixelMask || p.quadSampleMask != q.quadSampleMask || p.iteratesSamples != q.iteratesSamples || p.positionLocation != q.positionLocation || p.sampleLocations != q.sampleLocations || p.sampleOrder != q.sampleOrder) return false;
-    if (s.samples != t.samples || s.mergedCoverage != t.mergedCoverage || s.truncatedCoverage != t.truncatedCoverage || s.quadSampleMask != t.quadSampleMask || s.pixelEarlyZ != t.pixelEarlyZ) return false;
+    if (p.targetExportPacking != q.targetExportPacking || p.dualSourceBlend != q.dualSourceBlend || p.reversedBlend != q.reversedBlend || p.targetMerge != q.targetMerge || p.alphaToCoverage != q.alphaToCoverage || p.rasterPrimitive != q.rasterPrimitive || p.ditheredAlphaToCoverage != q.ditheredAlphaToCoverage || p.quadPixelMask != q.quadPixelMask || p.quadSampleMask != q.quadSampleMask || p.iteratesSamples != q.iteratesSamples || p.positionLocation != q.positionLocation || p.sampleLocations != q.sampleLocations || p.sampleOrder != q.sampleOrder) return false;
+    if (s.samples != t.samples || s.mergedCoverage != t.mergedCoverage || s.truncatedCoverage != t.truncatedCoverage || s.quadSampleMask != t.quadSampleMask || s.pixelEarlyZ != t.pixelEarlyZ || s.pixelKill != t.pixelKill) return false;
     return true;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp
index 33665a380c..c03e05baea 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp
@@ -173,15 +173,21 @@ void Driver::learnPendingRelocation() {
     }
     if (pending.alias == 0) return;
     if (drawAliases.size() >= MaxAliases) drawRelocationCounters.evicted += dropEveryOther(drawAliases);
-    drawAliases[pending.alias] = inserted->second;
+    drawAliases[pending.alias] = pending.key;
 }
 
 void Driver::relocateDrawEntry(const QueueState& queue, std::uint64_t alias, std::shared_ptr<DrawEntry>& entry, std::shared_ptr<const DrawDecode>& decode, std::vector<DrawUserPatch>& patches) {
     auto& counters = drawRelocationCounters;
     ++counters.lookups;
     const auto found = drawAliases.find(alias);
-    if (found == drawAliases.end() || found->second->decode == nullptr) return;
-    const auto donor = found->second;
+    if (found == drawAliases.end()) return;
+    const auto cached = drawCache.find(found->second);
+    if (cached == drawCache.end()) {
+        drawAliases.erase(found);
+        return;
+    }
+    if (cached->second->decode == nullptr) return;
+    const auto donor = cached->second;
     const auto& programs = donor->decode->programs;
     if (donor->stages.size() != programs.size()) return;
     struct Move {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp
index d3049765aa..fa1676e68c 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp
@@ -29,7 +29,8 @@ std::optional<Graphics::IndirectDrawPath> Driver::ClassifyIndirectDraw(const Sha
     using Path = Graphics::IndirectDrawPath;
     const auto support = localDevice->DrawIndirectSupport();
     const auto fail = [&](Path reason) { if (!indirectCpu) indirectCpu = reason; };
-    if (drawParameters.indexed && !GuestMemory::Accessible(reinterpret_cast<const void*>(drawParameters.indexAddress), static_cast<std::size_t>(drawParameters.indexCount) * drawParameters.indexSize)) fail(Path::IndexRange);
+    if (drawParameters.indexed && !indirect.indexLimitKnown) fail(Path::IndexLimitUnknown);
+    else if (drawParameters.indexed && !GuestMemory::Accessible(reinterpret_cast<const void*>(drawParameters.indexAddress), static_cast<std::size_t>(drawParameters.indexCount) * drawParameters.indexSize)) fail(Path::IndexRange);
     constexpr std::uint32_t NoLocation = 0x280u;
     const bool meshPath = graphics.stages.mesh.has_value() && !graphics.stages.tessellation && !graphics.rectList;
     const bool meshGpuSide = meshPath && drawParameters.indexed && indirect.count == 1 && !indirect.countIndirect && indirect.baseVertexLocation == NoLocation && indirect.startInstanceLocation == NoLocation && (!indirect.drawIndexEnabled || indirect.drawIndexLocation == NoLocation);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
index 04a1f72a02..e7d9bcc79e 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
@@ -1,14 +1,27 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ThreadPriority.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Screenshot.hpp"
 #include "prx/libkernel/Time/include/SleepWake.hpp"
+#include <algorithm>
 #include <mutex>
 
 namespace AgcDriver {
 
 void Submit(const Packet* packet, std::uint32_t queue) try {
     KernelNoteGpuSubmit_nid_no_patch();
-    DriverDetail::Driver::Get().Submit(packet, queue);
+    auto& driver = DriverDetail::Driver::Get();
+    auto* const recorder = FrameRecorder::Active();
+    if (recorder == nullptr) {
+        driver.Submit(packet, queue);
+        return;
+    }
+    GuestMemory::CheckRange(packet, sizeof(Packet), alignof(Packet));
+    const auto flips = driver.FlipSubmissions();
+    recorder->Submit(*packet, queue, [&] { driver.Submit(packet, queue); });
+    if (driver.FlipSubmissions() != flips) recorder->FrameBoundary();
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
@@ -22,18 +35,26 @@ void Shutdown() {
 }
 
 void RegisterShader(const Shader* shader) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->RegisterShader(shader);
     DriverDetail::Driver::Get().RegisterShader(shader);
 }
 
 void SuspendPoint() {
-    DriverDetail::Driver::Get().SuspendPoint();
+    auto* const recorder = FrameRecorder::Active();
+    if (recorder == nullptr) {
+        DriverDetail::Driver::Get().SuspendPoint();
+        return;
+    }
+    recorder->Suspend([] { DriverDetail::Driver::Get().SuspendPoint(); });
 }
 
 void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->RegisterVideoOutput(handle);
     DriverDetail::Driver::Get().RegisterVideoOutput(handle, output);
 }
 
 void UnregisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->UnregisterVideoOutput(handle);
     DriverDetail::Driver::Get().UnregisterVideoOutput(handle, output);
 }
 
@@ -46,6 +67,7 @@ void PresentClear(const PresentationWindow& window, bool opaque, void (*gpuReady
 }
 
 void PresentBuffer(const PresentationWindow& window, const DisplayBuffer& buffer, void (*gpuReady)(void*), void* context) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->PresentBuffer(buffer);
     DriverDetail::Driver::Get().Present(window, &buffer, true, gpuReady, context);
 }
 
@@ -103,11 +125,36 @@ extern "C" void AgcDriverSuspendPoint_nid_postfix() try {
 }
 
 extern "C" std::uint32_t AgcDriverReserveEopFlip_nid_postfix(const AgcDriver::FlipInfo& info) {
-    return AgcDriver::DriverDetail::Driver::Get().ReserveEopFlip(info);
+    const auto token = AgcDriver::DriverDetail::Driver::Get().ReserveEopFlip(info);
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active(); recorder != nullptr && token != 0) recorder->ReserveEopFlip(info, token);
+    return token;
+}
+
+extern "C" std::uint32_t AgcDriverReserveEopFlipAt_nid_postfix(const AgcDriver::FlipInfo& info, std::uint32_t token) {
+    return AgcDriver::DriverDetail::Driver::Get().ReserveEopFlipAt(info, token);
+}
+
+extern "C" std::size_t AgcDriverAwaitedWaits_nid_postfix(AgcDriver::AwaitedWait* waits, std::size_t capacity) {
+    const auto awaited = AgcDriver::DriverDetail::Driver::Get().AwaitedWaits();
+    const auto count = std::min(capacity, awaited.size());
+    std::copy_n(awaited.begin(), count, waits);
+    return count;
+}
+
+extern "C" void AgcDriverSerialProgress_nid_postfix(std::uint64_t* accepted, std::uint64_t* completed) {
+    const auto [submitted, done] = AgcDriver::DriverDetail::Driver::Get().SerialProgress();
+    *accepted = submitted;
+    *completed = done;
 }
 
 extern "C" void AgcDriverSubmitFlip_nid_postfix(const AgcDriver::FlipInfo& info) try {
-    AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info);
+    auto* const recorder = AgcDriver::FrameRecorder::Active();
+    if (recorder == nullptr) {
+        AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info);
+        return;
+    }
+    recorder->Flip(info, [&] { AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info); });
+    recorder->FrameBoundary();
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
@@ -116,6 +163,14 @@ extern "C" std::uint64_t AgcDriverDispatchesAdoptedAhead_nid_postfix() {
     return AgcDriver::DriverDetail::Driver::Get().DispatchesAdoptedAhead();
 }
 
+extern "C" std::uint64_t AgcDriverDispatchesRejectedAhead_nid_postfix() {
+    return AgcDriver::DriverDetail::Driver::Get().DispatchesRejectedAhead();
+}
+
+extern "C" void AgcDriverSetAheadAdoptHook_nid_postfix(void (*hook)()) {
+    AgcDriver::DriverDetail::Driver::Get().SetAheadAdoptHook(hook);
+}
+
 extern "C" void AgcDriverRegisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr<AgcDriver::IVideoOutput>& output) {
     AgcDriver::RegisterVideoOutput(handle, output);
 }
@@ -145,18 +200,26 @@ extern "C" void AgcDriverReportFailure_nid_postfix(std::exception_ptr error) {
 }
 
 extern "C" void AgcDriverResolveShaderAbi_nid_postfix(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) try {
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveShaderAbi(shader, context, primitive);
     AgcDriver::DriverDetail::Driver::Get().ResolveShaderAbi(shader, context, primitive);
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
 
 extern "C" void AgcDriverResolveGraphicsAbi_nid_postfix(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) try {
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveGraphicsAbi(vertex, pixel, primitiveType);
     AgcDriver::DriverDetail::Driver::Get().ResolveGraphicsAbi(vertex, pixel, primitiveType);
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
 extern "C" void AgcDriverResolveGraphicsStagesAbi_nid_postfix(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) try {
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveGraphicsStagesAbi(stages, context, primitive);
     AgcDriver::DriverDetail::Driver::Get().ResolveGraphicsStagesAbi(stages, context, primitive);
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
+
+extern "C" void AgcDriverPrepareCommandWrite_nid_no_patch(std::uint64_t address, std::size_t bytes) {
+    if (AgcDriver::Graphics::Recorder::SnapshotWriteOverlaps(address, bytes))
+        AgcDriver::GuestMemory::FlushGpuWrites(address, bytes);
+}
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp
index 75637f94d0..ba19bb4a60 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp
@@ -14,6 +14,7 @@
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "ShaderDiskCache.hpp"
 #include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdio>
@@ -87,6 +88,9 @@ void MapDriverMemory() {
     auto* slot = reinterpret_cast<std::uint64_t*>(FsTableAddress);
     slot[0] = (FsRoutineTableAddress & 0xffffffffffffull) | 16ull << 48u;
     slot[1] = FsTableDword3 << 32u | FsRoutineRecords;
+#ifndef _WIN32
+    GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(mapped, DriverMemoryBytes);
+#endif
     GuestAllocations::Mutation mutation;
     mutation.Add(mapped, DriverMemoryBytes, true, true, true);
 }
@@ -243,6 +247,40 @@ void Driver::WaitIdle() {
     if (const auto localDevice = device.Load()) localDevice->WaitIdle();
 }
 
+bool Driver::WaitIdleFor(std::chrono::milliseconds timeout) {
+    require(!onWorkerThread(), "worker cannot wait for itself");
+    std::unique_lock lock(mutex);
+    const auto target = accepted;
+    ++idleWaiters;
+    const bool idle = changed.wait_for(lock, timeout, [&] { return failure != nullptr || stopping || completed >= target; });
+    --idleWaiters;
+    rethrowFailure();
+    checkStopping();
+    return idle;
+}
+
+std::vector<AwaitedWait> Driver::AwaitedWaits() {
+    std::vector<AwaitedWait> result;
+    for (const auto& slot : awaitedSlots) {
+        const auto address = slot.address.load(std::memory_order_acquire);
+        if (address == 0) continue;
+        AwaitedWait wait;
+        wait.address = address;
+        wait.reference = slot.reference.load(std::memory_order_relaxed);
+        wait.mask = slot.mask.load(std::memory_order_relaxed);
+        const auto shape = slot.shape.load(std::memory_order_relaxed);
+        wait.function = static_cast<std::uint32_t>(shape);
+        wait.bytes = static_cast<std::uint32_t>(shape >> 32u);
+        if (slot.address.load(std::memory_order_acquire) == address) result.push_back(wait);
+    }
+    return result;
+}
+
+std::pair<std::uint64_t, std::uint64_t> Driver::SerialProgress() {
+    std::lock_guard lock(mutex);
+    return {accepted, completed};
+}
+
 void Driver::CheckFailure() {
     if (failed.load(std::memory_order_acquire)) {
         std::lock_guard lock(mutex);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp
index 10d28032c9..9e8ca4fe94 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp
@@ -18,14 +18,14 @@ bool Driver::matchesCopyKernel(std::span<const std::uint32_t> code, const std::v
     static const bool enabled = std::getenv("APS5_NO_COPY_HLE") == nullptr;
     if (!enabled || userData.size() != 12 || compute.numThreads[0] != 64 || compute.numThreads[1] != 1 || compute.numThreads[2] != 1 || !compute.groupIdEnable[0]) return false;
     static constexpr std::size_t copyKernelWords = 38;
-    static constexpr std::uint64_t copyKernelHash = 0x6ec00fe8aa95f99aull;
+    static constexpr std::array<std::uint64_t, 2> copyKernelHashes{0x6ec00fe8aa95f99aull, 0xc771c42e4d069d62ull};
     if (code.size() < copyKernelWords || code[0] != 0xbfa00002u || code[copyKernelWords - 1] != 0xbf810000u) return false;
     std::uint64_t hash = 0xcbf29ce484222325ull;
     for (const auto word : code.first(copyKernelWords)) {
         hash ^= word;
         hash *= 0x100000001b3ull;
     }
-    if (hash != copyKernelHash) return false;
+    if (std::find(copyKernelHashes.begin(), copyKernelHashes.end(), hash) == copyKernelHashes.end()) return false;
     const auto stride = [&](std::size_t word) { return (userData[word] >> 16u) & 0x3fffu; };
     const auto swizzled = [&](std::size_t word) { return ((userData[word] >> 31u) & 1u) != 0; };
     return userData[3] == 0x00014004u && userData[7] == 0x00014004u && userData[11] == 0x0004dfacu && stride(1) == 4 && stride(5) == 4 && stride(9) == 16 && !swizzled(1) && !swizzled(5) && !swizzled(9) && userData[10] >= 1;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp
index 276a2ad0cb..5972698258 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp
@@ -11,6 +11,7 @@
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Eq/include/Event.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include <atomic>
 #include <cstdio>
 #include <cstdlib>
@@ -29,11 +30,6 @@ bool orderedFills() {
     return ordered;
 }
 
-bool pipelineDma() {
-    static const bool enabled = std::getenv("APS5_PIPELINE_DMA") != nullptr;
-    return enabled;
-}
-
 bool keepsDrawFinisher(std::uint32_t header, std::uint32_t opcode) {
     if (header == FlipPacketHeader || header == RenderingWaitPacketHeader) return false;
     if (Pm4::DrawOpcode(opcode)) return true;
@@ -65,7 +61,6 @@ bool keepsDrawPipeline(std::span<const std::uint32_t> packet, std::uint32_t head
             if (packet.size() < 7) return false;
             const auto destination = Pm4::DmaDestination(packet);
             if (destination == Pm4::DmaDestinationNowhere) return true;
-            if (!pipelineDma()) return false;
             if (destination == Pm4::DmaSelectGds) return true;
             const auto bytes = Pm4::DmaBytes(packet);
             if (bytes == 0) return true;
@@ -303,8 +298,10 @@ void Driver::execute(const Submission& submission) {
                 continue;
             }
         }
+        timing.Mark("pipeline_prepare");
         if (pipelined && DrawPipeline::Queue0().Busy() && !keepsDrawPipeline(packet, header, opcode)) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, header == FlipPacketHeader ? 0xffu : opcode);
         if (pipelined && predicated && DrawPipeline::Queue0().Busy() && DrawPipeline::Queue0().Overlaps(queue.predication.address, queue.predication.operation == 3 ? 8 : 4)) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, opcode);
+        timing.Mark("pipeline_drain");
         std::shared_lock deviceUse(deviceReplacement, std::defer_lock);
         if (opcode != 0x3c && opcode != 0x93 && header != RenderingWaitPacketHeader && header != FlipPacketHeader) deviceUse.lock();
 
@@ -398,6 +395,7 @@ void Driver::execute(const Submission& submission) {
                 GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Flush);
                 std::lock_guard gpuLock(GuestMemory::GpuMutex());
                 const auto localDevice = device.Load();
+                if (localDevice != nullptr) static_cast<void>(Graphics::StorageTexture::StoreDrawnLinear("flip"));
 
                 if (!recordLabelsForPacket(localDevice.get(), submission.queue) && localDevice != nullptr) localDevice->SubmitRecorded(submission.queue == 0);
                 if (localDevice != nullptr) {
@@ -473,7 +471,7 @@ void Driver::execute(const Submission& submission) {
 
                 try {
                     std::string rejected;
-                    const auto verdict = draw(queue, packet, submission, rejected);
+                    const auto verdict = draw(queue, packet, submission, cursor, rejected);
                     drawn = verdict == DrawVerdict::Drawn;
                     CaptureTrace::Log("draw submission=%llu queue=%x offset=%zu target=%llx mask=%x verdict=%d reason=%.256s", static_cast<unsigned long long>(submission.serial), submission.queue, cursor, static_cast<unsigned long long>(color), readRegister(queue.context, 0x8e), static_cast<int>(verdict), rejected.c_str());
                     if (verdict == DrawVerdict::Rejected) {
@@ -567,8 +565,8 @@ void Driver::execute(const Submission& submission) {
             return;
         }
         if ((std::atomic_ref<std::uint32_t>(*const_cast<std::uint32_t*>(submission.rewindTail - 1)).load(std::memory_order_acquire) & 0x80000000u) != 0) {
-            DrawPipeline::Queue0().Enqueue([this] {
-                submitOpenWork();
+            DrawPipeline::Queue0().Enqueue([this, progress = submission.progress] {
+                submitOpenWork(progress);
                 wakeQueueZeroForCompletions();
             }, {});
             endTiming.Finish();
@@ -592,7 +590,10 @@ void Driver::execute(const Submission& submission) {
         if (localDevice != nullptr) localDevice->SubmitRecorded(submission.queue == 0);
     }
     endTiming.Finish();
-    if (submission.rewindTail != nullptr) executeRewindTail(submission);
+    if (submission.rewindTail != nullptr) {
+        if (submission.progress) submitOpenWork(submission.progress);
+        executeRewindTail(submission);
+    }
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp
index 5c2cc06454..2e9ce460eb 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp
@@ -38,11 +38,12 @@ bool Driver::preparePacketMemory(const Submission& submission, QueueState& queue
             std::lock_guard gpuLock(GuestMemory::GpuMutex());
             const auto localDevice = device.Load();
             recordDeferredLabels(localDevice.get(), submission.queue);
-            const bool workOpen = Graphics::Recorder::RecordedWorkSinceSubmit() != 0;
+            bool workOpen = Graphics::Recorder::RecordedWorkSinceSubmit() != 0;
             int reason = localDevice != nullptr ? 0 : 1;
             if (label.has_value()) {
                 const auto bytes = label->Bytes();
                 const auto stamp = ++eventSerial;
+                if (localDevice != nullptr && submission.queue == 0 && Graphics::StorageTexture::StoreDrawnLinear("label") != 0) workOpen = true;
                 reason = localDevice != nullptr ? localDevice->WriteLabelOnGpu(label->address, bytes, stamp, submission.queue) : 4;
                 if (reason == 1) GuestMemory::Write(label->address, bytes, 4);
                 if (reason == 0 || reason == 1 || reason == 5) {
@@ -52,6 +53,7 @@ bool Driver::preparePacketMemory(const Submission& submission, QueueState& queue
                 countLabelOutcome(reason);
                 ++immediateLabels;
             } else {
+                if (localDevice != nullptr && submission.queue == 0 && Graphics::StorageTexture::StoreDrawnLinear("interrupt") != 0) workOpen = true;
                 if (localDevice != nullptr) Graphics::StorageTexture::StoreReadbackBeforeLabel("readback before interrupt");
                 ++noOpLabels;
             }
@@ -249,6 +251,7 @@ bool Driver::preparePacketMemory(const Submission& submission, QueueState& queue
 
             recordDeferredLabels(draining.get(), submission.queue);
             if (draining != nullptr) {
+                static_cast<void>(Graphics::StorageTexture::StoreDrawnLinear("drain"));
                 if (unlockedDrain && draining->CanWaitUnlocked()) epoch = draining->SubmitAndEpoch();
                 else draining->WaitIdle();
             }
@@ -292,8 +295,7 @@ void Driver::dumpSampleCounters(std::uint64_t address) {
 }
 
 bool Driver::enqueueDmaPacket(std::span<const std::uint32_t> packet, std::uint32_t opcode, std::uint32_t queue, const QueueState& state) {
-    static const bool enabled = std::getenv("APS5_PIPELINE_DMA") != nullptr;
-    if (!enabled || opcode != 0x50 || queue != 0 || packet.size() < 7 || !DrawPipeline::Active() || !deferredLabels().labels.empty()) return false;
+    if (opcode != 0x50 || queue != 0 || packet.size() < 7 || !DrawPipeline::Active() || !deferredLabels().labels.empty()) return false;
     const auto source = ((packet[1] >> 29u) & 3u) | ((packet[6] >> 24u) & 4u) | ((packet[6] >> 25u) & 8u);
     constexpr std::size_t immediateLimit = std::size_t{16} << 20u;
     constexpr std::size_t gpuStoreLimit = 65536;
@@ -438,10 +440,11 @@ void Driver::commitLabel(std::uint32_t queue, std::uint64_t address, std::span<c
     std::lock_guard gpuLock(GuestMemory::GpuMutex());
     const auto localDevice = device.Load();
     recordDeferredLabels(localDevice.get(), queue);
-    const bool workOpen = Graphics::Recorder::RecordedWorkSinceSubmit() != 0;
+    bool workOpen = Graphics::Recorder::RecordedWorkSinceSubmit() != 0;
     int reason = localDevice != nullptr ? 0 : 1;
     if (!bytes.empty()) {
         const auto stamp = ++eventSerial;
+        if (localDevice != nullptr && queue == 0 && Graphics::StorageTexture::StoreDrawnLinear("label") != 0) workOpen = true;
         reason = localDevice != nullptr ? localDevice->WriteLabelOnGpu(address, bytes, stamp, queue) : 4;
         if (reason != 0 && reason != 5 && reason != 6) {
             if (reason != 1 && localDevice != nullptr) localDevice->WaitIdle();
@@ -456,6 +459,7 @@ void Driver::commitLabel(std::uint32_t queue, std::uint64_t address, std::span<c
     }
     if (endOfPipeInterrupt) {
         bool deferred = false;
+        if (bytes.empty() && localDevice != nullptr && queue == 0 && Graphics::StorageTexture::StoreDrawnLinear("interrupt") != 0) workOpen = true;
         if (localDevice != nullptr && (reason == 0 || reason == 5 || reason == 6)) {
             deferred = localDevice->AfterRecordedWork([this, queue] { deliverGuestEopInterrupt(queue); }, queue == 0);
             if (deferred && workOpen) localDevice->SubmitRecorded(queue == 0);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
index d071d049fc..4f3261986a 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
@@ -12,19 +12,35 @@ namespace AgcDriver::DriverDetail {
 
 std::uint32_t Driver::ReserveEopFlip(const FlipInfo& info) {
     std::lock_guard lock(mutex);
+    require(nextEopToken <= EopFlipTokenLimit, "EOP flip token space exhausted");
+    return reserveEopFlip(info, nextEopToken);
+}
+
+std::uint32_t Driver::ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token) {
+    std::lock_guard lock(mutex);
+    return reserveEopFlip(info, token);
+}
+
+std::uint32_t Driver::reserveEopFlip(const FlipInfo& info, std::uint32_t token) {
     rethrowFailure();
     checkStopping();
-    require(nextEopToken <= EopFlipTokenLimit, "EOP flip token space exhausted");
+    require(token >= EopFlipTokenBase && token <= EopFlipTokenLimit && !eopFlips.contains(token), "EOP flip token is not free");
     const auto output = outputs.find(info.handle);
     require(output != outputs.end(), "EOP flip references an unregistered video output");
     auto request = output->second->TryReserve(info);
     if (!request) return 0;
-    const auto token = nextEopToken;
     eopFlips.emplace(token, EopFlip{info.handle, std::move(request)});
-    ++nextEopToken;
+    nextEopToken = std::max(nextEopToken, token + 1);
     return token;
 }
 
+std::vector<std::uint32_t> Driver::PendingEopFlipTokens() {
+    std::lock_guard lock(mutex);
+    std::vector<std::uint32_t> tokens;
+    for (const auto& [token, flip] : eopFlips) tokens.push_back(token);
+    return tokens;
+}
+
 void Driver::RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output) {
     require(output != nullptr, "null video output");
     std::lock_guard lock(mutex);
@@ -77,6 +93,7 @@ void Driver::Present(const PresentationWindow& window, const DisplayBuffer* buff
         bool submitted = false;
         bool presentable = false;
         bool trailing = false;
+        bool queueUnlocked = false;
         double waitedMs = 0;
         {
             GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Present);
@@ -125,12 +142,20 @@ void Driver::Present(const PresentationWindow& window, const DisplayBuffer* buff
             }
             if (submitted && (syncFlip || inFlight != 0)) {
 
-                presenting->QueuePresent();
-                timing.Mark("queue_present");
+                if (presenting->PresentsOnOwnQueue()) {
+                    queueUnlocked = true;
+                } else {
+                    presenting->QueuePresent();
+                    timing.Mark("queue_present");
+                }
                 trailing = !syncFlip;
                 submitted = false;
             }
         }
+        if (queueUnlocked) {
+            presenting->QueuePresent();
+            timing.Mark("queue_present");
+        }
         if (trailing) {
             waitedMs += presenting->FinishPresent();
             timing.Mark("render_fence_wait");
@@ -139,9 +164,13 @@ void Driver::Present(const PresentationWindow& window, const DisplayBuffer* buff
             waitedMs = presenting->FinishPresent();
             timing.Mark("render_fence_wait");
 
-            GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Present);
-            std::lock_guard lock(GuestMemory::GpuMutex());
-            presenting->QueuePresent();
+            if (presenting->PresentsOnOwnQueue()) {
+                presenting->QueuePresent();
+            } else {
+                GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Present);
+                std::lock_guard lock(GuestMemory::GpuMutex());
+                presenting->QueuePresent();
+            }
             timing.Mark("queue_present");
         }
         gpuReady(context);
@@ -177,7 +206,7 @@ void Driver::reportPresents(double waitedMs, std::size_t inFlight) {
     const auto flips = flipsCounted.load() - previousFlips;
     const double perFlip = flips != 0 ? 1.0 / static_cast<double>(flips) : 0.0;
     const auto serial = flipSerial.load();
-    AgcDriver::ProfilePrint_nid_no_patch( "[present] %llu presents over 10 s (%llu dropped: no free swapchain image; %zu may trail on the GPU); %s p50 %.2f ms, p90 %.2f ms, max %.2f ms over %zu; per frame, presented or dropped: GPU busy %.1f ms, idle gaps %.1f ms (%llu batches without a completion record); per flip: %.1f batches recorded (%.1f unsignaled at the flip); per present: %.1f batches ahead of the blit, %.1f after it; after the flip packet: last submit %.1f ms, blit submit %.1f ms; in-place reads overwritten before execution: %llu of %llu checked\n", static_cast<unsigned long long>(presents), static_cast<unsigned long long>(dropped), inFlight, inFlight != 0 ? "inflight_wait" : "render_fence_wait", percentile(0.5), percentile(0.9), waits.empty() ? 0.0 : waits.back(), waits.size(), (counts.gpuBusyMs - previous.gpuBusyMs) * perFrame, (counts.gpuGapMs - previous.gpuGapMs) * perFrame, static_cast<unsigned long long>(counts.gpuUnread - previous.gpuUnread), static_cast<double>(serial - windowSerial) * perFlip, static_cast<double>(flipBatchesUnsignaled.load() - previousUnsignaled) * perFlip, static_cast<double>(counts.batchesAheadOfBlit - previous.batchesAheadOfBlit) * perPresent, static_cast<double>(counts.batchesAfterFlip - previous.batchesAfterFlip) * perPresent, (counts.lastSubmitAfterFlipMs - previous.lastSubmitAfterFlipMs) * perPresent, (counts.blitSubmitAfterFlipMs - previous.blitSubmitAfterFlipMs) * perPresent, static_cast<unsigned long long>(counts.readsOverwritten - previous.readsOverwritten), static_cast<unsigned long long>(counts.readsChecked - previous.readsChecked));
+    AgcDriver::ProfilePrint_nid_no_patch( "[present] %llu presents over 10 s (%llu dropped: no free swapchain image; %zu may trail on the GPU); %s p50 %.2f ms, p90 %.2f ms, max %.2f ms over %zu; per frame, presented or dropped: GPU busy %.1f ms, idle gaps %.1f ms (%llu batches without a completion record); per flip: %.1f batches recorded (%.1f unsignaled at the flip); per present: %.1f batches ahead of the blit, %.1f after it; after the flip packet: last submit %.1f ms, blit submit %.1f ms; in-place reads overwritten before execution: %llu of %llu checked; waits for the display keys' writer outside the GPU mutex: %llu, %.1f ms\n", static_cast<unsigned long long>(presents), static_cast<unsigned long long>(dropped), inFlight, inFlight != 0 ? "inflight_wait" : "render_fence_wait", percentile(0.5), percentile(0.9), waits.empty() ? 0.0 : waits.back(), waits.size(), (counts.gpuBusyMs - previous.gpuBusyMs) * perFrame, (counts.gpuGapMs - previous.gpuGapMs) * perFrame, static_cast<unsigned long long>(counts.gpuUnread - previous.gpuUnread), static_cast<double>(serial - windowSerial) * perFlip, static_cast<double>(flipBatchesUnsignaled.load() - previousUnsignaled) * perFlip, static_cast<double>(counts.batchesAheadOfBlit - previous.batchesAheadOfBlit) * perPresent, static_cast<double>(counts.batchesAfterFlip - previous.batchesAfterFlip) * perPresent, (counts.lastSubmitAfterFlipMs - previous.lastSubmitAfterFlipMs) * perPresent, (counts.blitSubmitAfterFlipMs - previous.blitSubmitAfterFlipMs) * perPresent, static_cast<unsigned long long>(counts.readsOverwritten - previous.readsOverwritten), static_cast<unsigned long long>(counts.readsChecked - previous.readsChecked), static_cast<unsigned long long>(counts.keyWriterWaits - previous.keyWriterWaits), counts.keyWriterWaitMs - previous.keyWriterWaitMs);
     previous = counts;
     previousFlips = flipsCounted.load();
     previousUnsignaled = flipBatchesUnsignaled.load();
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp
index ed1cb37640..546be83644 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp
@@ -70,19 +70,23 @@ void Driver::deferCompletion(const Submission& submission) {
         queue0Uncommitted.push_back(received);
     }
     completionDeferred() = true;
-    DrawPipeline::Queue0().Enqueue([this, serial = submission.serial, received, labelWrites = submission.labelWrites] {
-        completeSubmission(serial, received, labelWrites);
+    DrawPipeline::Queue0().Enqueue([this, serial = submission.serial, received, labelWrites = submission.labelWrites, progress = submission.progress] {
+        completeSubmission(serial, received, labelWrites, progress);
     }, {});
 }
 
-void Driver::submitOpenWork() {
-    if (deferredLabels().labels.empty() && !Graphics::Recorder::PendingLabelSince().has_value() && Graphics::Recorder::RecordedWorkSinceSubmit() == 0) return;
+void Driver::submitOpenWork(const std::shared_ptr<SubmissionProgress>& progress) {
+    const bool work = !deferredLabels().labels.empty() || Graphics::Recorder::PendingLabelSince().has_value() || Graphics::Recorder::RecordedWorkSinceSubmit() != 0;
+    if (!work && !progress) return;
     ++submissionCosts(0).endSubmits;
     GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::End);
     std::lock_guard gpuLock(GuestMemory::GpuMutex());
     const auto localDevice = device.Load();
-    recordDeferredLabels(localDevice.get(), 0);
-    if (localDevice != nullptr) localDevice->SubmitRecorded(true);
+    if (work) {
+        recordDeferredLabels(localDevice.get(), 0);
+        if (localDevice != nullptr) localDevice->SubmitRecorded(true);
+    }
+    if (progress) progress->Publish(localDevice, localDevice ? localDevice->SubmittedEpoch() : 0);
 }
 
 void Driver::wakeQueueZeroForCompletions() {
@@ -91,7 +95,7 @@ void Driver::wakeQueueZeroForCompletions() {
     changed.notify_all();
 }
 
-void Driver::completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites) {
+void Driver::completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites, const std::shared_ptr<SubmissionProgress>& progress) {
     struct Complete {
         Driver& driver;
         std::uint64_t serial, received;
@@ -109,7 +113,7 @@ void Driver::completeSubmission(std::uint64_t serial, std::uint64_t received, st
             if (notify) driver.changed.notify_all();
         }
     } complete{*this, serial, received, labelWrites};
-    submitOpenWork();
+    submitOpenWork(progress);
 }
 
 const std::atomic<std::uint64_t>*& Driver::workerQueued() {
@@ -261,6 +265,7 @@ void Driver::run(std::uint32_t id) noexcept {
                 if (profile && submission.enqueuedAt != std::chrono::steady_clock::time_point{}) costs.dequeueNs += static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - submission.enqueuedAt).count());
             }
             execute(submission);
+            if (submission.progress && submission.rewindTail == nullptr && !completionDeferred()) submitOpenWork(submission.progress);
             if (traceGpu) std::fprintf(stderr, "[gpu] %.1f done serial=%llu queue=0x%x\n", TraceMs(), static_cast<unsigned long long>(submission.serial), id);
             const auto completeStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
             PerformanceContext completionContext(id == 0 ? frameTiming() : FrameTiming::Async());
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp
index 13d45c0f36..eeaea3e126 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp"
@@ -21,6 +22,61 @@ namespace AgcDriver::DriverDetail {
 
 namespace {
 
+bool& submitsQueue0() {
+    struct SubmitsQueue0Storage {};
+    return HostThreadLocal<bool, SubmitsQueue0Storage>();
+}
+
+std::uint64_t& flipSubmissionsOfThread() {
+    struct FlipSubmissionsStorage {};
+    return HostThreadLocal<std::uint64_t, FlipSubmissionsStorage>();
+}
+
+bool progressEligible(const Submission& submission) {
+    if (submission.queue != 0 || !submission.flips.empty()
+        || !submission.renderingWaits.empty() || !submission.conditionalEnds.empty()) return false;
+    bool terminalRelease = false;
+    std::optional<Pm4::LabelWrite> knownWrite;
+    for (std::size_t at = 0; at < submission.commands.size();) {
+        const auto packet = std::span(submission.commands).subspan(at);
+        const auto count = Pm4::PacketWords(packet[0]);
+        if (count == 0 || count > packet.size()) return false;
+        const auto opcode = (packet[0] >> 8u) & 0xffu;
+        const bool type3 = (packet[0] >> 30u) == 3;
+        if (type3 && (opcode == 0x3c || opcode == 0x93)) {
+            if (!knownWrite || Pm4::Predicated(packet[0]) || ((packet[1] >> 4u) & 3u) != 1u) return false;
+            const auto wait = Pm4::DecodeWait(packet.first(count));
+            const auto bytes = knownWrite->Bytes();
+            if (wait.address < knownWrite->address) return false;
+            const auto offset = wait.address - knownWrite->address;
+            if (offset > bytes.size() || wait.bytes > bytes.size() - offset) return false;
+            std::uint64_t value = 0;
+            std::memcpy(&value, bytes.data() + offset, wait.bytes);
+            if (!Pm4::WaitComparesValue(packet.first(count), value)) return false;
+            terminalRelease = false;
+            at += count;
+            continue;
+        }
+        if (type3 && opcode == 0x59 && submission.rewindTail != nullptr && at + count == submission.commands.size()) {
+            at += count;
+            continue;
+        }
+        if (!Pm4::FillerPacket(packet[0]) && !(type3 && opcode == 0x10) && !Pm4::IsTagMarker(packet.first(count))) {
+            if (type3 && (opcode == 0x49 || opcode == 0x37)) {
+                const auto write = Pm4::DecodeLabelWrite(packet.first(count));
+                terminalRelease = opcode == 0x49 && write.has_value();
+                if (write && !Pm4::Predicated(packet[0]) && (opcode == 0x37 || (packet[2] >> 29u) < 3)) knownWrite = *write;
+                else if (opcode != 0x49 || (packet[2] >> 29u) != 0) knownWrite.reset();
+            } else {
+                terminalRelease = false;
+                if (!type3 || (opcode != 0x42 && opcode != 0x58)) knownWrite.reset();
+            }
+        }
+        at += count;
+    }
+    return terminalRelease;
+}
+
 std::uint64_t captureTime() {
     return static_cast<std::uint64_t>(std::llround(TraceMs() * 1000.0));
 }
@@ -38,11 +94,10 @@ bool EopRelease(std::span<const std::uint32_t> words) {
     return words.size() >= 8 && (words[0] >> 30u) == 3u && Pm4::PacketWords(words[0]) == 8u && ((words[0] >> 8u) & 0xffu) == 0x49u && ((words[2] >> 24u) & 7u) == 2u;
 }
 
-bool& submitsQueue0() {
-    struct SubmitsQueue0Storage {};
-    return HostThreadLocal<bool, SubmitsQueue0Storage>();
 }
 
+std::uint64_t Driver::FlipSubmissions() const {
+    return flipSubmissionsOfThread();
 }
 
 std::deque<const std::uint32_t*>& Driver::releasedTails() {
@@ -282,6 +337,7 @@ void Driver::executeRewindTail(const Submission& stalled) {
             checkStopping();
             noteAwaitingTitle(stalled.queue, reinterpret_cast<std::uint64_t>(stalled.rewindTail - 1));
             stall.Check("REWIND at", reinterpret_cast<std::uint64_t>(stalled.rewindTail - 1));
+            if (stalled.queue == 0 && completionsPending()) reapCompletionLabels();
             PollSleep();
         }
     }
@@ -366,6 +422,10 @@ void Driver::Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip) {
     const auto validated = profile ? std::chrono::steady_clock::now() : start;
     auto* const capture = SubmissionCapture::Active();
     auto captured = capture != nullptr ? SubmissionCapture::Prepare(queue, SubmissionKind::Submit, submission.commands, submission.conditionalEnds) : CapturedSubmission{};
+    static const bool progressEnabled = std::getenv("APS5_SUBMIT_PROGRESS") != nullptr;
+    const auto progress = progressEnabled && progressEligible(submission) ? std::make_shared<SubmissionProgress>() : nullptr;
+    submission.progress = progress;
+    const auto progressDeadline = progress ? std::chrono::steady_clock::now() + std::chrono::milliseconds(2) : std::chrono::steady_clock::time_point{};
     {
         std::unique_lock lock(mutex);
         rethrowFailure();
@@ -401,11 +461,31 @@ void Driver::Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip) {
             submission.holdsFlip = true;
             flipsAhead.fetch_add(1, std::memory_order_acq_rel);
         }
+        if (!submission.flips.empty()) ++flipSubmissionsOfThread();
         enqueue(std::move(submission));
         ++accepted;
     }
     changed.notify_all();
     if (capture != nullptr) writeCaptured(*this, *capture, captured);
+    if (progress) {
+        PerformanceTimer timing("Driver.SubmitProgress");
+        const auto [localDevice, epoch] = progress->WaitUntil(progressDeadline);
+        const auto now = std::chrono::steady_clock::now();
+        bool gpuReady = false;
+        if (localDevice && epoch != 0 && now < progressDeadline) {
+            const auto remaining = std::chrono::duration_cast<std::chrono::nanoseconds>(progressDeadline - now).count();
+            gpuReady = localDevice->WaitRecordedFor(epoch, static_cast<std::uint64_t>(remaining));
+        }
+        if (profile) {
+            static std::atomic<std::uint64_t> eligible{0}, ready{0}, expired{0};
+            if (gpuReady) ready.fetch_add(1, std::memory_order_relaxed);
+            else expired.fetch_add(1, std::memory_order_relaxed);
+            const auto count = eligible.fetch_add(1, std::memory_order_relaxed) + 1;
+            if (count % 1000 == 0) AgcDriver::ProfilePrint_nid_no_patch("[submit-progress] %llu eligible terminal releases, %llu GPU-ready returns, %llu expired or unsupported\n",
+                static_cast<unsigned long long>(count), static_cast<unsigned long long>(ready.load()), static_cast<unsigned long long>(expired.load()));
+        }
+        CheckFailure();
+    }
 }
 
 void Driver::SuspendPoint() {
@@ -465,7 +545,18 @@ bool Driver::orderReleased(std::uint32_t queue, std::uint64_t received) const {
     return runningWorkers.load(std::memory_order_acquire) == 0 && !completionsPending() && !Graphics::Recorder::SnapshotWriteOverlaps(awaited, 4);
 }
 
+void Driver::noteWaitFields(std::uint32_t queue, std::span<const std::uint32_t> packet) {
+    const auto fields = Pm4::DecodeWait(packet);
+    auto& slot = awaitedSlots[queue == 0 ? 0 : queue - 0x20 + 1];
+    slot.reference.store(fields.reference, std::memory_order_relaxed);
+    slot.mask.store(fields.mask, std::memory_order_relaxed);
+    slot.shape.store(static_cast<std::uint64_t>(fields.function) | static_cast<std::uint64_t>(fields.bytes) << 32u, std::memory_order_relaxed);
+}
+
 void Driver::noteWaitBlocked(std::uint32_t queue, std::uint64_t awaited, bool blocked) {
+    auto& slot = awaitedSlots[queue == 0 ? 0 : queue - 0x20 + 1];
+    if (!blocked) slot.shape.store(0, std::memory_order_relaxed);
+    slot.address.store(blocked ? awaited : 0, std::memory_order_release);
     if (blocked) {
         if (runningWorkers.fetch_sub(1, std::memory_order_acq_rel) == 1) {
             idleEpoch.fetch_add(1, std::memory_order_release);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
index 1065f7921f..312b71958b 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
@@ -1,9 +1,11 @@
 #include "prx/libc/include/general/LogMacros.hpp"
 #include "ControlFlow/GraphBuilder.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/PipelineLibrary.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "CacheKey.hpp"
@@ -136,7 +138,7 @@ std::shared_ptr<const ShaderSnapshot> ReadRawShader(std::uint64_t address) {
                 cache.erase(found);
             }
             const auto bytes = result->code.size() * sizeof(std::uint32_t);
-            while (!cache.empty() && (cache.size() >= 64 || cacheBytes + bytes > 8 * 1024 * 1024)) {
+            while (!cache.empty() && (cache.size() >= 4096 || cacheBytes + bytes > 64 * 1024 * 1024)) {
                 cacheBytes -= cache.back()->code.size() * sizeof(std::uint32_t);
                 cache.pop_back();
             }
@@ -220,6 +222,24 @@ bool CommittedAbi(const ShaderSnapshot& snapshot, std::span<const std::uint64_t>
     return std::ranges::any_of(snapshot.prepared->registeredAbis, [&](const auto& abi) { return std::ranges::equal(abi, key); });
 }
 
+std::optional<std::vector<std::weak_ptr<const ShaderSnapshot>>> CommittedGraphicsAbi(const ShaderSnapshot& owner, std::span<const std::uint64_t> key, const std::shared_ptr<const ShaderRegistry>& registry) {
+    std::unique_lock lock(owner.prepared->mutex);
+    AwaitRegisteredPreparation(*owner.prepared, lock);
+    const auto& abis = owner.prepared->graphicsAbis;
+    const auto found = std::ranges::find_if(abis, [&](const auto& abi) { return std::ranges::equal(abi.key, key) && abi.registry.lock() == registry; });
+    if (found == abis.end()) return std::nullopt;
+    return found->stages;
+}
+
+bool CommittedLink(const ShaderSnapshot& front, const std::shared_ptr<const ShaderSnapshot>& fragment, std::uint32_t primitiveType) {
+    if (primitiveType == 7 || primitiveType == 17) return false;
+    std::unique_lock lock(front.prepared->mutex);
+    AwaitRegisteredPreparation(*front.prepared, lock);
+    const auto& fragments = front.prepared->fragments;
+    if (front.prepared->rectangleRequested || std::ranges::any_of(fragments, [](const auto& entry) { return entry.expired(); })) return false;
+    return fragment == nullptr || std::ranges::any_of(fragments, [&](const auto& entry) { return entry.lock() == fragment; });
+}
+
 }
 
 bool ProgramUsesWorkgroup(const ShaderSnapshot& snapshot, std::size_t codeOffset) {
@@ -561,6 +581,10 @@ const PreparedShaderState& ShaderPreparationTransaction::Read(const ShaderSnapsh
     return changes.emplace(snapshot.prepared.get(), State::Change{snapshot.prepared, *snapshot.prepared, false, snapshot.prepared->entries.size(), snapshot.prepared->registeredAbis.size()}).first->second.prepared;
 }
 
+bool ShaderPreparationTransaction::Tracks(const ShaderSnapshot& snapshot) const {
+    return root->changes.contains(snapshot.prepared.get());
+}
+
 void ShaderPreparationTransaction::Hold() {
     require(!committed, "shader preparation transaction is already committed");
     root->Hold();
@@ -801,6 +825,65 @@ void PublishRegisteredShader(std::shared_ptr<ShaderRegistry>& registry, const st
 
 namespace {
 
+bool LazyShaderPreparation() {
+    static const bool lazy = std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr;
+    return lazy;
+}
+
+using PreparedAtUse = std::optional<std::vector<const ShaderRecompiler::SourceHandle*>>;
+
+PreparedAtUse PrepareDeferredAbis(const ShaderSnapshot& snapshot, std::unique_lock<std::mutex>& lock);
+
+struct DeferredAbiUseCounters {
+    std::atomic<std::uint64_t> firstUses{0};
+    std::atomic<std::uint64_t> found{0};
+    std::atomic<std::uint64_t> own{0};
+    std::atomic<std::uint64_t> entries{0};
+    std::atomic<std::uint64_t> matchedEntries{0};
+    std::atomic<std::int64_t> lastReport{0};
+};
+
+DeferredAbiUseCounters& DeferredAbiCounters() {
+    static DeferredAbiUseCounters counters;
+    return counters;
+}
+
+void ReportDeferredAbiUses() {
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (!profile) return;
+    auto& counters = DeferredAbiCounters();
+    const auto now = std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::steady_clock::now().time_since_epoch()).count();
+    auto previous = counters.lastReport.load(std::memory_order_relaxed);
+    if ((previous != 0 && now - previous < 60000) || !counters.lastReport.compare_exchange_strong(previous, now, std::memory_order_relaxed)) return;
+    const auto entries = counters.entries.load(std::memory_order_relaxed);
+    const auto matched = counters.matchedEntries.load(std::memory_order_relaxed);
+    AgcDriver::ProfilePrint_nid_no_patch("[shaders] deferred ABIs: %llu prepared at first use, %llu found their artifact there, %llu prepared their own; %llu of the %llu entries prepared from them never matched a use\n", static_cast<unsigned long long>(counters.firstUses.load(std::memory_order_relaxed)), static_cast<unsigned long long>(counters.found.load(std::memory_order_relaxed)), static_cast<unsigned long long>(counters.own.load(std::memory_order_relaxed)), static_cast<unsigned long long>(entries - std::min(entries, matched)), static_cast<unsigned long long>(entries));
+}
+
+void NoteMatchedEntry(PreparedShaders::Entry& entry, const PreparedAtUse& preparedAtUse) {
+    auto& counters = DeferredAbiCounters();
+    bool changed = false;
+    if (entry.fromDeferredAbi && !entry.matched) {
+        entry.matched = true;
+        counters.matchedEntries.fetch_add(1, std::memory_order_relaxed);
+        changed = true;
+    }
+    if (preparedAtUse) {
+        counters.firstUses.fetch_add(1, std::memory_order_relaxed);
+        if (std::ranges::find(*preparedAtUse, entry.handle.get()) != preparedAtUse->end()) counters.found.fetch_add(1, std::memory_order_relaxed);
+        changed = true;
+    }
+    if (changed) ReportDeferredAbiUses();
+}
+
+void NoteOwnPreparation(const PreparedAtUse& preparedAtUse) {
+    if (!preparedAtUse) return;
+    auto& counters = DeferredAbiCounters();
+    counters.firstUses.fetch_add(1, std::memory_order_relaxed);
+    counters.own.fetch_add(1, std::memory_order_relaxed);
+    ReportDeferredAbiUses();
+}
+
 void ReportPreparedAtUse(const ShaderSnapshot& snapshot, const ShaderRecompiler::RecompileRequest& request) {
     if (request.context.convertedSamples) {
         APS5_LOG_OUT_DEBUG("Shader 0x%llx samples a converted image; preparing its converted-sample variant at use", static_cast<unsigned long long>(request.shader.codeAddress));
@@ -836,9 +919,15 @@ std::shared_ptr<const ShaderRecompiler::SourceHandle> SourceHandleFor(const Shad
     ShaderRecompiler::BuildPreparedShaderKey(request, key);
     std::unique_lock lock(snapshot.prepared->mutex);
     AwaitRegisteredPreparation(*snapshot.prepared, lock);
-    for (const auto& entry : snapshot.prepared->entries) {
-        if (entry.codeOffset == codeOffset && ShaderRecompiler::MatchesPreparedShader(request, *entry.handle, key)) return entry.handle;
+    PreparedAtUse preparedAtUse;
+    if (!snapshot.prepared->deferredAbis.empty() || snapshot.prepared->deferredPreparing) preparedAtUse = PrepareDeferredAbis(snapshot, lock);
+    for (auto& entry : snapshot.prepared->entries) {
+        if (entry.codeOffset == codeOffset && ShaderRecompiler::MatchesPreparedShader(request, *entry.handle, key)) {
+            NoteMatchedEntry(entry, preparedAtUse);
+            return entry.handle;
+        }
     }
+    NoteOwnPreparation(preparedAtUse);
     ReportPreparedAtUse(snapshot, request);
     auto handle = PrepareShaderWithDiagnostics(request);
     snapshot.prepared->entries.push_back({codeOffset, handle});
@@ -989,12 +1078,18 @@ ShaderRecompiler::PreparedShaderInvocation InvocationFor(const ShaderSnapshot& s
     struct PreparedKeyStorage {};
     auto& key = HostThreadLocal<std::vector<std::uint64_t>, PreparedKeyStorage>();
     ShaderRecompiler::BuildPreparedShaderKey(source, key);
-    for (const auto& entry : snapshot.prepared->entries) {
+    PreparedAtUse preparedAtUse;
+    if (!snapshot.prepared->deferredAbis.empty() || snapshot.prepared->deferredPreparing) preparedAtUse = PrepareDeferredAbis(snapshot, lock);
+    for (auto& entry : snapshot.prepared->entries) {
         if (entry.codeOffset != codeOffset) continue;
         invocationRequest.shader.code = ShaderRecompiler::GetPreparedCode(*entry.handle);
         if (!linked.code.empty() && !std::ranges::equal(invocationRequest.shader.code, linked.code)) continue;
-        if (auto invocation = ShaderRecompiler::PreparedShaderInvocation::TryCreate(invocationRequest, entry.handle, key)) return std::move(*invocation);
+        if (auto invocation = ShaderRecompiler::PreparedShaderInvocation::TryCreate(invocationRequest, entry.handle, key)) {
+            NoteMatchedEntry(entry, preparedAtUse);
+            return std::move(*invocation);
+        }
     }
+    NoteOwnPreparation(preparedAtUse);
     ReportPreparedAtUse(snapshot, source);
     auto handle = PrepareShaderWithDiagnostics(source);
     invocationRequest = source;
@@ -1281,6 +1376,60 @@ std::vector<PreparedShaders::Entry> PrepareRegistered(const ShaderSnapshot& snap
     return plan != nullptr ? PrepareRegistered(*plan) : std::vector<PreparedShaders::Entry>{};
 }
 
+PreparedAtUse PrepareDeferredAbis(const ShaderSnapshot& snapshot, std::unique_lock<std::mutex>& lock) {
+    auto& prepared = *snapshot.prepared;
+    if (prepared.deferredPreparing) {
+        prepared.settled.wait(lock, [&] { return !prepared.deferredPreparing; });
+        return std::nullopt;
+    }
+    if (prepared.deferredAbis.empty()) return std::nullopt;
+    std::vector<PreparedShaders::DeferredAbi> deferred;
+    deferred.swap(prepared.deferredAbis);
+    prepared.deferredPreparing = true;
+    struct Preparing {
+        PreparedShaders& prepared;
+        std::unique_lock<std::mutex>& lock;
+        ~Preparing() {
+            if (!lock.owns_lock()) lock.lock();
+            prepared.deferredPreparing = false;
+            prepared.settled.notify_all();
+        }
+    } preparing{prepared, lock};
+    lock.unlock();
+    std::vector<PreparedShaders::Entry> entries;
+    for (const auto& abi : deferred) {
+        const auto device = abi.device.lock();
+        if (device == nullptr || snapshot.registeredState == nullptr) continue;
+        QueueState state{};
+        state.shader = snapshot.registeredState->shader;
+        state.context = snapshot.registeredState->context;
+        state.userConfig = snapshot.registeredState->userConfig;
+        for (const auto& [offset, value] : abi.context) state.context[offset] = value;
+        for (const auto& [offset, value] : abi.primitive) state.userConfig[offset] = value;
+        try {
+            const auto plan = PlanRegistered(snapshot, *device, state, false);
+            if (plan == nullptr) continue;
+            plan->prebuildDevice = device;
+            auto made = PrepareRegistered(*plan);
+            std::ranges::move(made, std::back_inserter(entries));
+        } catch (const std::exception& error) {
+            APS5_LOG_ERR("Shader 0x%llx could not be prepared at its first use for its resolved ABI (%s); preparing it for the use instead", static_cast<unsigned long long>(snapshot.codeAddress), error.what());
+            continue;
+        }
+    }
+    lock.lock();
+    std::vector<const ShaderRecompiler::SourceHandle*> added;
+    for (auto& entry : entries) {
+        const auto duplicate = std::ranges::any_of(prepared.entries, [&](const auto& existing) { return existing.codeOffset == entry.codeOffset && existing.handle->artifact == entry.handle->artifact; });
+        if (duplicate) continue;
+        entry.fromDeferredAbi = true;
+        added.push_back(entry.handle.get());
+        prepared.entries.push_back(std::move(entry));
+    }
+    DeferredAbiCounters().entries.fetch_add(added.size(), std::memory_order_relaxed);
+    return added;
+}
+
 void DeferPipelineStage(PreparedShaderState& prepared, const ShaderSnapshot& snapshot, const char* reason) {
     if (!prepared.deferred) APS5_LOG_ERR("Shader 0x%llx could not be prepared when the title created its pipeline (%s); preparing it when it is used", static_cast<unsigned long long>(snapshot.codeAddress), reason);
     prepared.deferred = true;
@@ -1553,7 +1702,7 @@ void PrepareRegisteredInBackground(std::shared_ptr<const ShaderSnapshot> snapsho
         try {
             entries = PrepareRegistered(*plan);
         } catch (const std::exception& error) {
-            APS5_LOG_ERR("Shader 0x%llx could not be prepared after registration: %s", static_cast<unsigned long long>(snapshot->codeAddress), error.what());
+            APS5_LOG_ERR("Shader 0x%llx snapshot=0x%llx could not be prepared after registration: %s", static_cast<unsigned long long>(snapshot->codeAddress), static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(snapshot.get())), error.what());
             failure = std::current_exception();
         } catch (...) {
             failure = std::current_exception();
@@ -1749,14 +1898,23 @@ void Driver::ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std
     auto& key = HostThreadLocal<std::vector<std::uint64_t>, GraphicsAbiKeyStorage>();
     BuildRegisteredAbiKey(state, *localDevice, key);
     const auto primitiveType = state.userConfig.find(0x242u);
-    for (const auto& abi : transaction.Read(*owner).graphicsAbis) {
-        if (abi.key != key || abi.registry.lock() != registry) continue;
-        for (const auto& stage : abi.stages) {
+    const auto resolveStages = [&](const std::vector<std::weak_ptr<const ShaderSnapshot>>& stages) {
+        for (const auto& stage : stages) {
             const auto snapshot = stage.lock();
             require(snapshot != nullptr, "prepared graphics ABI lost a registered stage");
             if (snapshot->type != 1) ResolvePreparedGraphics(*snapshot, {}, primitiveType == state.userConfig.end() ? 0u : primitiveType->second, localDevice->Target(), true);
         }
         transaction.Commit();
+    };
+    if (!transaction.Tracks(*owner)) {
+        if (const auto committed = CommittedGraphicsAbi(*owner, key, registry)) {
+            resolveStages(*committed);
+            return;
+        }
+    }
+    for (const auto& abi : transaction.Read(*owner).graphicsAbis) {
+        if (abi.key != key || abi.registry.lock() != registry) continue;
+        resolveStages(abi.stages);
         return;
     }
     DrawDecode decoded{};
@@ -1792,6 +1950,55 @@ void Driver::ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std
     transaction.Commit();
 }
 
+std::size_t Driver::PreparedEntries(const Shader* shader) {
+    std::shared_ptr<const ShaderSnapshot> snapshot;
+    {
+        std::lock_guard lock(mutex);
+        if (shaders == nullptr) return 0;
+        snapshot = RegisteredHeader(*shaders, shader);
+    }
+    if (snapshot == nullptr) return 0;
+    std::unique_lock lock(snapshot->prepared->mutex);
+    AwaitRegisteredPreparation(*snapshot->prepared, lock);
+    return snapshot->prepared->entries.size();
+}
+
+Driver::DeferredAbiUseCounts Driver::DeferredAbiUses() {
+    auto& counters = DeferredAbiCounters();
+    const auto entries = counters.entries.load(std::memory_order_relaxed);
+    const auto matched = counters.matchedEntries.load(std::memory_order_relaxed);
+    return {counters.firstUses.load(std::memory_order_relaxed), counters.found.load(std::memory_order_relaxed), counters.own.load(std::memory_order_relaxed), entries, entries - std::min(entries, matched)};
+}
+
+std::vector<std::array<std::uint64_t, 2>> Driver::PreparedEntryHashes(const Shader* shader) {
+    std::shared_ptr<const ShaderSnapshot> snapshot;
+    {
+        std::lock_guard lock(mutex);
+        if (shaders == nullptr) return {};
+        snapshot = RegisteredHeader(*shaders, shader);
+    }
+    if (snapshot == nullptr) return {};
+    std::unique_lock lock(snapshot->prepared->mutex);
+    AwaitRegisteredPreparation(*snapshot->prepared, lock);
+    std::vector<std::array<std::uint64_t, 2>> hashes;
+    for (const auto& entry : snapshot->prepared->entries) {
+        if (entry.handle == nullptr || entry.handle->artifact == nullptr) continue;
+        const auto hash = entry.handle->artifact->artifact.spirv.ContentHash();
+        std::uint64_t key = 0xcbf29ce484222325ull;
+        for (const auto word : entry.handle->staticKey) key = (key ^ word) * 0x100000001b3ull;
+        hashes.push_back({hash.low, hash.high ^ key});
+    }
+    std::ranges::sort(hashes);
+    return hashes;
+}
+
+std::array<std::uint64_t, 4> Driver::PrebuiltLibraries() {
+    if (auto* pool = RegistrationPreparePool::ExistingPrebuild()) pool->AwaitSubmitted();
+    const auto localDevice = device.Load();
+    if (localDevice == nullptr) return {};
+    return Graphics::PipelineLibraryCountersOf(localDevice->Device()).built;
+}
+
 void Driver::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) {
     BindTitleThread();
     PerformanceContext timingContext(FrameTiming::Preparation());
@@ -1829,6 +2036,31 @@ void Driver::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegist
     struct RegisteredAbiKeyStorage {};
     auto& key = HostThreadLocal<std::vector<std::uint64_t>, RegisteredAbiKeyStorage>();
     BuildRegisteredAbiKey(state, *localDevice, key);
+    if (LazyShaderPreparation()) {
+        const auto& resolved = transaction.Read(*snapshot).registeredAbis;
+        if (std::ranges::find(resolved, key) != resolved.end()) {
+            transaction.Commit();
+            return;
+        }
+        std::optional<std::string> invalid;
+        try {
+            static_cast<void>(PlanRegistered(*snapshot, *localDevice, state, false));
+        } catch (const std::exception& error) {
+            invalid = error.what();
+        }
+        auto& prepared = transaction.Edit(*snapshot);
+        if (invalid) DeferPipelineStage(prepared, *snapshot, invalid->c_str());
+        prepared.registeredAbis.push_back(key);
+        prepared.deferred = true;
+        transaction.Commit();
+        if (invalid) return;
+        PreparedShaders::DeferredAbi deferred{key, {}, {}, localDevice};
+        for (const auto reg : context) deferred.context.emplace_back(reg.offset, reg.value);
+        for (const auto reg : primitive) deferred.primitive.emplace_back(reg.offset, reg.value);
+        std::lock_guard lock(snapshot->prepared->mutex);
+        snapshot->prepared->deferredAbis.push_back(std::move(deferred));
+        return;
+    }
     std::optional<std::string> deferral;
     const auto prepare = [&] {
         try {
@@ -1842,6 +2074,10 @@ void Driver::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegist
         }
     };
     const bool committedAbi = CommittedAbi(*snapshot, key);
+    if (committedAbi && !transaction.Tracks(*snapshot)) {
+        transaction.Commit();
+        return;
+    }
     auto entries = committedAbi ? std::vector<PreparedShaders::Entry>{} : prepare();
     const auto& registeredAbis = transaction.Read(*snapshot).registeredAbis;
     if (std::ranges::find(registeredAbis, key) != registeredAbis.end()) {
@@ -1875,6 +2111,37 @@ std::uint64_t NullPixelProgramAddress() {
     return reinterpret_cast<std::uintptr_t>(NullPixelCode);
 }
 
+alignas(256) static const std::uint32_t DepthCopyMultisamplePixelCode[64] = {0x360604ffu, 0x0000ffffu, 0x2c080490u, 0x7e0a0208u, 0xf0000130u, 0x00000603u, 0xbf8c3f70u, 0xf8001801u, 0x00000006u, 0xbf810000u};
+alignas(256) static const std::uint32_t DepthCopySinglePixelCode[64] = {0x360604ffu, 0x0000ffffu, 0x2c080490u, 0xf0000108u, 0x00000603u, 0xbf8c3f70u, 0xf8001801u, 0x00000006u, 0xbf810000u};
+static const Shader DepthCopyMultisamplePixelShader = [] {
+    Shader shader{};
+    shader.file_header = 0x34333231u;
+    shader.version = 0x18u;
+    shader.code = DepthCopyMultisamplePixelCode;
+    shader.header_size = sizeof(Shader);
+    shader.shader_size = sizeof(DepthCopyMultisamplePixelCode);
+    shader.type = 1;
+    return shader;
+}();
+static const Shader DepthCopySinglePixelShader = [] {
+    Shader shader{};
+    shader.file_header = 0x34333231u;
+    shader.version = 0x18u;
+    shader.code = DepthCopySinglePixelCode;
+    shader.header_size = sizeof(Shader);
+    shader.shader_size = sizeof(DepthCopySinglePixelCode);
+    shader.type = 1;
+    return shader;
+}();
+
+std::uint64_t DepthCopyPixelProgramAddress(bool multisampled) {
+    return reinterpret_cast<std::uintptr_t>(multisampled ? DepthCopyMultisamplePixelCode : DepthCopySinglePixelCode);
+}
+
+std::uint32_t DepthCopyPixelUserWords(bool multisampled) {
+    return multisampled ? 9u : 8u;
+}
+
 void Driver::ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) {
     BindTitleThread();
     PerformanceContext timingContext(FrameTiming::Preparation());
@@ -1927,6 +2194,10 @@ void ResolvePreparedGraphics(const ShaderSnapshot& front, const std::shared_ptr<
             return;
         }
     }
+    if (!transaction.Tracks(front) && CommittedLink(front, fragment, primitiveType)) {
+        transaction.Commit();
+        return;
+    }
     std::vector<std::shared_ptr<const ShaderSnapshot>> fragments;
     {
         const auto& current = transaction.Read(front);
@@ -2011,6 +2282,25 @@ ShaderSnapshot PrepareNullPixelProgram(const VulkanDevice& device) {
     return null;
 }
 
+ShaderSnapshot PrepareDepthCopyPixelProgram(bool multisampled) {
+    const auto& shader = multisampled ? DepthCopyMultisamplePixelShader : DepthCopySinglePixelShader;
+    const auto* code = multisampled ? DepthCopyMultisamplePixelCode : DepthCopySinglePixelCode;
+    ShaderSnapshot copy{DepthCopyPixelProgramAddress(multisampled), reinterpret_cast<std::uintptr_t>(&shader), shader.type, {}, {}};
+    copy.code.assign(code, code + 64);
+    copy.header.resize(sizeof(Shader));
+    std::memcpy(copy.header.data(), &shader, sizeof(Shader));
+    auto state = DecodeRegisteredState(copy);
+    state.shader.insert_or_assign(0x008u, static_cast<std::uint32_t>(copy.codeAddress >> 8u));
+    state.shader.insert_or_assign(0x009u, static_cast<std::uint32_t>(copy.codeAddress >> 40u));
+    state.shader.insert_or_assign(0x00bu, DepthCopyPixelUserWords(multisampled) << 1u);
+    state.context.insert_or_assign(0x1b3u, 0x8002u);
+    state.context.insert_or_assign(0x1b4u, 0x8002u);
+    state.context.insert_or_assign(0x1c5u, 1u);
+    copy.registeredState = std::make_shared<const RegisteredShaderState>(std::move(state));
+    copy.prepared->deferred = true;
+    return copy;
+}
+
 std::shared_ptr<const ShaderRegistry> Driver::RegisteredShaders() {
     std::lock_guard lock(mutex);
     return shaders;
@@ -2064,13 +2354,24 @@ void Driver::RegisterShader(const Shader* shader) {
         localDevice = device;
     }
     snapshot.registeredState = std::make_shared<const RegisteredShaderState>(DecodeRegisteredState(snapshot));
+    {
+        std::lock_guard lock(mutex);
+        if (shaders != nullptr) {
+            if (const auto found = shaders->find(snapshot.codeAddress); found != shaders->end()) {
+                for (const auto& current : found->second) {
+                    if (current->registeredState == nullptr || current->type != snapshot.type || current->code != snapshot.code || *current->registeredState != *snapshot.registeredState) continue;
+                    snapshot.registeredState = current->registeredState;
+                    break;
+                }
+            }
+        }
+    }
     QueueState registered{};
     registered.shader = snapshot.registeredState->shader;
     registered.context = snapshot.registeredState->context;
     registered.userConfig = snapshot.registeredState->userConfig;
     std::shared_ptr<RegisteredPreparation> preparation;
-    static const bool lazy = std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr;
-    if (lazy) {
+    if (LazyShaderPreparation()) {
         static_cast<void>(PlanRegistered(snapshot, *localDevice, registered, true, &snapshot.prepared->deferred));
         snapshot.prepared->deferred = true;
     } else if (AsyncRegistrationPrepare()) {
@@ -2108,6 +2409,9 @@ void Driver::RegisterShader(const Shader* shader) {
     if (shaders->find(NullPixelProgramAddress()) == shaders->end()) {
         PublishRegisteredShader(shaders, std::make_shared<const ShaderSnapshot>(PrepareNullPixelProgram(*localDevice)));
     }
+    for (const bool multisampled : {false, true}) {
+        if (shaders->find(DepthCopyPixelProgramAddress(multisampled)) == shaders->end()) PublishRegisteredShader(shaders, std::make_shared<const ShaderSnapshot>(PrepareDepthCopyPixelProgram(multisampled)));
+    }
     transaction.Commit();
     if (preparation != nullptr) PrepareRegisteredInBackground(published, std::move(preparation));
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp
index 6aead1a2cc..f1b7df1757 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp
@@ -322,6 +322,7 @@ void Driver::waitMemory(std::span<const std::uint32_t> packet, std::uint32_t que
 
     if (entryTryFailed && pollService(false)) return;
 
+    noteWaitFields(queue, packet);
     noteWaitBlocked(queue, awaited, true);
     struct BlockedWait {
         Driver& driver;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp
new file mode 100644
index 0000000000..7505860321
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp
@@ -0,0 +1,455 @@
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include <zstd.h>
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstring>
+#include <future>
+#include <iterator>
+#include <stdexcept>
+#include <system_error>
+#include <thread>
+
+namespace AgcDriver {
+namespace {
+
+static_assert(std::endian::native == std::endian::little, "frame captures are stored in little-endian order");
+
+constexpr std::size_t ChunkHeaderBytes = 64;
+
+void requireCapture(bool condition, const std::string& reason) {
+    if (!condition) throw std::runtime_error("frame capture: " + reason);
+}
+
+class Encoder {
+public:
+    template <typename TValue>
+    void Put(TValue value) {
+        const auto at = bytes.size();
+        bytes.resize(at + sizeof(TValue));
+        std::memcpy(bytes.data() + at, &value, sizeof(TValue));
+    }
+
+    std::vector<std::byte> bytes;
+};
+
+class Decoder {
+public:
+    explicit Decoder(std::span<const std::byte> bytes) : bytes(bytes) {}
+
+    template <typename TValue>
+    TValue Take(const char* what) {
+        requireCapture(sizeof(TValue) <= bytes.size() - at, std::string("record ends inside ") + what);
+        TValue value{};
+        std::memcpy(&value, bytes.data() + at, sizeof(TValue));
+        at += sizeof(TValue);
+        return value;
+    }
+
+    std::size_t Count(std::size_t elementBytes, const char* what) {
+        const auto count = Take<std::uint32_t>(what);
+        requireCapture(count <= (bytes.size() - at) / elementBytes, std::string("count of ") + what + " exceeds its record");
+        return count;
+    }
+
+    bool Done() const { return at == bytes.size(); }
+
+private:
+    std::span<const std::byte> bytes;
+    std::size_t at = 0;
+};
+
+void putRegisters(Encoder& encoder, const std::vector<ShaderRegister>& registers) {
+    encoder.Put(static_cast<std::uint32_t>(registers.size()));
+    for (const auto& value : registers) {
+        encoder.Put(value.offset);
+        encoder.Put(value.value);
+    }
+}
+
+std::vector<ShaderRegister> takeRegisters(Decoder& decoder) {
+    std::vector<ShaderRegister> registers(decoder.Count(8, "registers"));
+    for (auto& value : registers) {
+        value.offset = decoder.Take<std::uint32_t>("register offset");
+        value.value = decoder.Take<std::uint32_t>("register value");
+    }
+    return registers;
+}
+
+std::vector<std::byte> encodeCall(const FrameCall& call) {
+    Encoder encoder;
+    encoder.Put(call.ordinal);
+    encoder.Put(call.timeNs);
+    encoder.Put(call.thread);
+    encoder.Put(call.accepted);
+    encoder.Put(call.completed);
+    encoder.Put(call.queue);
+    encoder.Put(call.flags);
+    encoder.Put(static_cast<std::uint32_t>(call.cpuFlip ? 1u : 0u));
+    encoder.Put(call.address);
+    encoder.Put(call.size);
+    encoder.Put(static_cast<std::uint32_t>(call.values.size()));
+    for (const auto value : call.values) encoder.Put(value);
+    putRegisters(encoder, call.context);
+    putRegisters(encoder, call.primitive);
+    return std::move(encoder.bytes);
+}
+
+FrameCall decodeCall(FrameCallKind kind, std::span<const std::byte> payload) {
+    Decoder decoder(payload);
+    FrameCall call;
+    call.kind = kind;
+    call.ordinal = decoder.Take<std::uint64_t>("ordinal");
+    call.timeNs = decoder.Take<std::uint64_t>("time");
+    call.thread = decoder.Take<std::uint64_t>("thread");
+    call.accepted = decoder.Take<std::uint64_t>("accepted serial");
+    call.completed = decoder.Take<std::uint64_t>("completed serial");
+    call.queue = decoder.Take<std::uint32_t>("queue");
+    call.flags = decoder.Take<std::uint32_t>("flags");
+    const auto cpuFlip = decoder.Take<std::uint32_t>("cpu flip");
+    requireCapture(cpuFlip <= 1, "cpu flip is not 0 or 1");
+    call.cpuFlip = cpuFlip == 1;
+    call.address = decoder.Take<std::uint64_t>("address");
+    call.size = decoder.Take<std::uint64_t>("size");
+    call.values.resize(decoder.Count(8, "values"));
+    for (auto& value : call.values) value = decoder.Take<std::uint64_t>("value");
+    call.context = takeRegisters(decoder);
+    call.primitive = takeRegisters(decoder);
+    requireCapture(decoder.Done(), "call record has trailing bytes");
+    return call;
+}
+
+bool knownCall(std::uint32_t kind) {
+    return kind >= static_cast<std::uint32_t>(FrameCallKind::RegisterShader) && kind <= static_cast<std::uint32_t>(FrameCallKind::UnregisterVideoOutput);
+}
+
+std::vector<std::byte> readFile(const std::filesystem::path& path) {
+    std::ifstream file(path, std::ios::binary);
+    requireCapture(file.is_open(), "cannot open " + path.string());
+    std::vector<std::byte> bytes;
+    file.seekg(0, std::ios::end);
+    bytes.resize(static_cast<std::size_t>(file.tellg()));
+    file.seekg(0);
+    file.read(reinterpret_cast<char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+    requireCapture(file.good() || bytes.empty(), "cannot read " + path.string());
+    return bytes;
+}
+
+void requireMagic(std::span<const std::byte> bytes, std::string_view magic, const std::filesystem::path& path) {
+    requireCapture(bytes.size() >= magic.size() && std::memcmp(bytes.data(), magic.data(), magic.size()) == 0, path.string() + " is not a frame capture file");
+}
+
+struct Run {
+    std::uint64_t address;
+    std::span<const std::byte> bytes;
+};
+
+}
+
+bool AllZero(std::span<const std::byte> bytes) {
+    constexpr std::size_t Word = sizeof(std::uint64_t);
+    std::size_t at = 0;
+    for (; at + Word <= bytes.size(); at += Word) {
+        std::uint64_t value = 0;
+        std::memcpy(&value, bytes.data() + at, Word);
+        if (value != 0) return false;
+    }
+    return std::all_of(bytes.begin() + static_cast<std::ptrdiff_t>(at), bytes.end(), [](std::byte value) { return value == std::byte{0}; });
+}
+
+std::string_view FrameCallName(FrameCallKind kind) {
+    switch (kind) {
+    case FrameCallKind::RegisterShader: return "register-shader";
+    case FrameCallKind::ResolveShaderAbi: return "resolve-shader-abi";
+    case FrameCallKind::ResolveGraphicsAbi: return "resolve-graphics-abi";
+    case FrameCallKind::ResolveGraphicsStagesAbi: return "resolve-graphics-stages-abi";
+    case FrameCallKind::RegisterVideoOutput: return "register-video-output";
+    case FrameCallKind::UnregisterVideoOutput: return "unregister-video-output";
+    case FrameCallKind::SetTessellationFactorRing: return "set-tf-ring";
+    case FrameCallKind::Submit: return "submit";
+    case FrameCallKind::Flip: return "flip";
+    case FrameCallKind::ReserveEopFlip: return "reserve-eop-flip";
+    case FrameCallKind::Suspend: return "suspend";
+    case FrameCallKind::Memory: return "memory";
+    case FrameCallKind::FrameStart: return "frame-start";
+    case FrameCallKind::End: return "end";
+    case FrameCallKind::DisplayBuffer: return "display-buffer";
+    }
+    throw std::runtime_error("frame capture: unknown call kind " + std::to_string(static_cast<std::uint32_t>(kind)));
+}
+
+FrameCaptureWriter::FrameCaptureWriter(const std::filesystem::path& directory, int level) : directory(directory), level(level) {
+    std::error_code error;
+    std::filesystem::create_directories(directory, error);
+    requireCapture(!error && std::filesystem::is_directory(directory), "cannot create the directory " + directory.string());
+    for (const auto name : {CallsName, MemoryName, HeaderName}) std::filesystem::remove(directory / name, error);
+    calls.open(directory / CallsName, std::ios::binary | std::ios::trunc);
+    memory.open(directory / MemoryName, std::ios::binary | std::ios::trunc);
+    requireCapture(calls.is_open() && memory.is_open(), "cannot create the capture files in " + directory.string());
+    calls.write(CallsMagic.data(), static_cast<std::streamsize>(CallsMagic.size()));
+    memory.write(MemoryMagic.data(), static_cast<std::streamsize>(MemoryMagic.size()));
+    requireCapture(calls.good() && memory.good(), "cannot write the capture files in " + directory.string());
+}
+
+void FrameCaptureWriter::WriteCall(const FrameCall& call) {
+    FrameCallName(call.kind);
+    const auto payload = encodeCall(call);
+    requireCapture(payload.size() <= UINT32_MAX, "call record too large");
+    std::lock_guard lock(mutex);
+    requireCapture(!finished, "call written after the capture finished");
+    const auto kind = static_cast<std::uint32_t>(call.kind);
+    const auto bytes = static_cast<std::uint32_t>(payload.size());
+    calls.write(reinterpret_cast<const char*>(&kind), sizeof(kind));
+    calls.write(reinterpret_cast<const char*>(&bytes), sizeof(bytes));
+    calls.write(reinterpret_cast<const char*>(payload.data()), static_cast<std::streamsize>(payload.size()));
+    requireCapture(calls.good(), "cannot write " + (directory / CallsName).string());
+}
+
+void FrameCaptureWriter::WriteRange(std::uint64_t address, std::uint64_t bytes, FrameRangeKind kind, std::uint32_t protection, std::uint32_t access) {
+    FrameMemoryChunk chunk;
+    chunk.kind = FrameMemoryKind::Range;
+    chunk.rangeKind = kind;
+    chunk.protection = protection;
+    chunk.access = access;
+    chunk.address = address;
+    chunk.bytes = bytes;
+    std::lock_guard lock(mutex);
+    writeChunk(chunk, {});
+}
+
+std::uint64_t FrameCaptureWriter::WriteSnapshot(std::uint64_t address, std::span<const std::byte> bytes) {
+    std::vector<Run> runs;
+    for (std::size_t at = 0; at < bytes.size();) {
+        const auto block = bytes.subspan(at, std::min(BlockBytes, bytes.size() - at));
+        if (AllZero(block)) {
+            at += block.size();
+            continue;
+        }
+        if (!runs.empty() && runs.back().address + runs.back().bytes.size() == address + at && runs.back().bytes.size() + block.size() <= ChunkBytes) {
+            runs.back().bytes = bytes.subspan(runs.back().address - address, runs.back().bytes.size() + block.size());
+        } else {
+            runs.push_back({address + at, block});
+        }
+        at += block.size();
+    }
+    const auto workers = std::max<std::size_t>(1, std::thread::hardware_concurrency() / 2);
+    std::uint64_t stored = 0;
+    for (std::size_t first = 0; first < runs.size(); first += workers) {
+        const auto last = std::min(runs.size(), first + workers);
+        std::vector<std::future<std::vector<std::byte>>> compressed;
+        for (auto index = first; index < last; ++index) {
+            compressed.push_back(std::async(std::launch::async, [this, run = runs[index]] { return compress(run.bytes); }));
+        }
+        std::lock_guard lock(mutex);
+        for (auto index = first; index < last; ++index) {
+            const auto payload = compressed[index - first].get();
+            FrameMemoryChunk chunk;
+            chunk.kind = FrameMemoryKind::Snapshot;
+            chunk.address = runs[index].address;
+            chunk.bytes = runs[index].bytes.size();
+            chunk.compressedBytes = payload.size();
+            writeChunk(chunk, payload);
+            stored += chunk.bytes;
+        }
+    }
+    return stored;
+}
+
+void FrameCaptureWriter::WriteDelta(std::uint64_t group, std::uint64_t completed, std::uint64_t address, std::span<const std::byte> bytes) {
+    for (std::size_t at = 0; at < bytes.size(); at += ChunkBytes) {
+        const auto part = bytes.subspan(at, std::min(ChunkBytes, bytes.size() - at));
+        const auto payload = compress(part);
+        FrameMemoryChunk chunk;
+        chunk.kind = FrameMemoryKind::Delta;
+        chunk.group = group;
+        chunk.completed = completed;
+        chunk.address = address + at;
+        chunk.bytes = part.size();
+        chunk.compressedBytes = payload.size();
+        std::lock_guard lock(mutex);
+        writeChunk(chunk, payload);
+    }
+}
+
+void FrameCaptureWriter::WriteReference(std::uint64_t index, std::uint64_t address, std::span<const std::byte> pixels) {
+    const auto payload = compress(pixels);
+    FrameMemoryChunk chunk;
+    chunk.kind = FrameMemoryKind::Reference;
+    chunk.group = index;
+    chunk.address = address;
+    chunk.bytes = pixels.size();
+    chunk.compressedBytes = payload.size();
+    std::lock_guard lock(mutex);
+    writeChunk(chunk, payload);
+}
+
+void FrameCaptureWriter::Finish(std::string_view header) {
+    std::lock_guard lock(mutex);
+    requireCapture(!finished, "capture finished twice");
+    finished = true;
+    calls.flush();
+    memory.flush();
+    requireCapture(calls.good() && memory.good(), "cannot flush the capture files in " + directory.string());
+    calls.close();
+    memory.close();
+    std::ofstream file(directory / HeaderName, std::ios::binary | std::ios::trunc);
+    file.write(header.data(), static_cast<std::streamsize>(header.size()));
+    file.flush();
+    requireCapture(file.good(), "cannot write " + (directory / HeaderName).string());
+}
+
+std::uint64_t FrameCaptureWriter::RawBytes() const {
+    std::lock_guard lock(mutex);
+    return rawBytes;
+}
+
+std::uint64_t FrameCaptureWriter::StoredBytes() const {
+    std::lock_guard lock(mutex);
+    return storedBytes;
+}
+
+const std::filesystem::path& FrameCaptureWriter::Directory() const {
+    return directory;
+}
+
+void FrameCaptureWriter::writeChunk(const FrameMemoryChunk& chunk, std::span<const std::byte> payload) {
+    requireCapture(!finished, "memory written after the capture finished");
+    Encoder encoder;
+    encoder.Put(static_cast<std::uint32_t>(chunk.kind));
+    encoder.Put(static_cast<std::uint32_t>(chunk.rangeKind));
+    encoder.Put(chunk.protection);
+    encoder.Put(chunk.access);
+    encoder.Put(chunk.group);
+    encoder.Put(chunk.completed);
+    encoder.Put(chunk.address);
+    encoder.Put(chunk.bytes);
+    encoder.Put(static_cast<std::uint64_t>(payload.size()));
+    encoder.Put(std::uint64_t{0});
+    memory.write(reinterpret_cast<const char*>(encoder.bytes.data()), static_cast<std::streamsize>(encoder.bytes.size()));
+    memory.write(reinterpret_cast<const char*>(payload.data()), static_cast<std::streamsize>(payload.size()));
+    requireCapture(memory.good(), "cannot write " + (directory / MemoryName).string());
+    if (chunk.kind != FrameMemoryKind::Range) rawBytes += chunk.bytes;
+    storedBytes += payload.size();
+}
+
+std::vector<std::byte> FrameCaptureWriter::compress(std::span<const std::byte> bytes) const {
+    std::vector<std::byte> output(ZSTD_compressBound(bytes.size()));
+    const auto written = ZSTD_compress(output.data(), output.size(), bytes.data(), bytes.size(), level);
+    requireCapture(ZSTD_isError(written) == 0, std::string("zstd: ") + ZSTD_getErrorName(written));
+    output.resize(written);
+    return output;
+}
+
+FrameCaptureReader::FrameCaptureReader(const std::filesystem::path& directory) : directory(directory) {
+    const auto callsPath = directory / FrameCaptureWriter::CallsName;
+    const auto callBytes = readFile(callsPath);
+    requireMagic(callBytes, FrameCaptureWriter::CallsMagic, callsPath);
+    std::size_t at = FrameCaptureWriter::CallsMagic.size();
+    while (at < callBytes.size()) {
+        if (callBytes.size() - at < 8) {
+            truncated = true;
+            break;
+        }
+        std::uint32_t kind = 0;
+        std::uint32_t bytes = 0;
+        std::memcpy(&kind, callBytes.data() + at, 4);
+        std::memcpy(&bytes, callBytes.data() + at + 4, 4);
+        requireCapture(knownCall(kind), callsPath.string() + ": unknown call kind " + std::to_string(kind) + " at byte " + std::to_string(at));
+        if (callBytes.size() - at - 8 < bytes) {
+            truncated = true;
+            break;
+        }
+        calls.push_back(decodeCall(static_cast<FrameCallKind>(kind), std::span(callBytes).subspan(at + 8, bytes)));
+        at += 8 + static_cast<std::size_t>(bytes);
+    }
+
+    const auto memoryPath = directory / FrameCaptureWriter::MemoryName;
+    std::ifstream memory(memoryPath, std::ios::binary);
+    requireCapture(memory.is_open(), "cannot open " + memoryPath.string());
+    memory.seekg(0, std::ios::end);
+    const auto size = static_cast<std::uint64_t>(memory.tellg());
+    std::string magic(FrameCaptureWriter::MemoryMagic.size(), '\0');
+    memory.seekg(0);
+    memory.read(magic.data(), static_cast<std::streamsize>(magic.size()));
+    requireCapture(memory.good() && magic == FrameCaptureWriter::MemoryMagic, memoryPath.string() + " is not a frame capture file");
+    std::uint64_t offset = magic.size();
+    while (offset < size) {
+        if (size - offset < ChunkHeaderBytes) {
+            truncated = true;
+            break;
+        }
+        std::array<std::byte, ChunkHeaderBytes> raw{};
+        memory.seekg(static_cast<std::streamoff>(offset));
+        memory.read(reinterpret_cast<char*>(raw.data()), static_cast<std::streamsize>(raw.size()));
+        requireCapture(memory.good(), "cannot read " + memoryPath.string());
+        Decoder decoder(raw);
+        FrameMemoryChunk chunk;
+        const auto kind = decoder.Take<std::uint32_t>("memory kind");
+        const auto rangeKind = decoder.Take<std::uint32_t>("range kind");
+        requireCapture(kind >= 1 && kind <= 4 && rangeKind >= 1 && rangeKind <= 6, memoryPath.string() + ": corrupt chunk header at byte " + std::to_string(offset));
+        chunk.kind = static_cast<FrameMemoryKind>(kind);
+        chunk.rangeKind = static_cast<FrameRangeKind>(rangeKind);
+        chunk.protection = decoder.Take<std::uint32_t>("protection");
+        chunk.access = decoder.Take<std::uint32_t>("access");
+        chunk.group = decoder.Take<std::uint64_t>("group");
+        chunk.completed = decoder.Take<std::uint64_t>("completed serial");
+        chunk.address = decoder.Take<std::uint64_t>("address");
+        chunk.bytes = decoder.Take<std::uint64_t>("bytes");
+        chunk.compressedBytes = decoder.Take<std::uint64_t>("compressed bytes");
+        requireCapture((chunk.kind == FrameMemoryKind::Range) == (chunk.compressedBytes == 0), memoryPath.string() + ": chunk payload does not match its kind at byte " + std::to_string(offset));
+        chunk.offset = offset + ChunkHeaderBytes;
+        if (size - chunk.offset < chunk.compressedBytes) {
+            truncated = true;
+            break;
+        }
+        chunks.push_back(chunk);
+        offset = chunk.offset + chunk.compressedBytes;
+    }
+
+    const auto headerPath = directory / FrameCaptureWriter::HeaderName;
+    if (std::filesystem::exists(headerPath)) {
+        const auto bytes = readFile(headerPath);
+        header.assign(reinterpret_cast<const char*>(bytes.data()), bytes.size());
+    } else {
+        truncated = true;
+    }
+}
+
+const std::vector<FrameCall>& FrameCaptureReader::Calls() const {
+    return calls;
+}
+
+const std::vector<FrameMemoryChunk>& FrameCaptureReader::Chunks() const {
+    return chunks;
+}
+
+const std::string& FrameCaptureReader::Header() const {
+    return header;
+}
+
+bool FrameCaptureReader::Truncated() const {
+    return truncated;
+}
+
+void FrameCaptureReader::Read(const FrameMemoryChunk& chunk, std::span<std::byte> destination) const {
+    requireCapture(chunk.kind != FrameMemoryKind::Range, "a range chunk has no bytes");
+    requireCapture(destination.size() == chunk.bytes, "destination size does not match the chunk");
+    const auto path = directory / FrameCaptureWriter::MemoryName;
+    std::ifstream memory(path, std::ios::binary);
+    requireCapture(memory.is_open(), "cannot open " + path.string());
+    std::vector<std::byte> compressed(chunk.compressedBytes);
+    memory.seekg(static_cast<std::streamoff>(chunk.offset));
+    memory.read(reinterpret_cast<char*>(compressed.data()), static_cast<std::streamsize>(compressed.size()));
+    requireCapture(memory.good(), "cannot read " + path.string());
+    const auto written = ZSTD_decompress(destination.data(), destination.size(), compressed.data(), compressed.size());
+    requireCapture(ZSTD_isError(written) == 0, std::string("zstd: ") + ZSTD_getErrorName(written));
+    requireCapture(written == chunk.bytes, "chunk at " + std::to_string(chunk.address) + " decompressed to the wrong size");
+}
+
+std::vector<std::byte> FrameCaptureReader::Read(const FrameMemoryChunk& chunk) const {
+    std::vector<std::byte> bytes(chunk.bytes);
+    Read(chunk, bytes);
+    return bytes;
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
new file mode 100644
index 0000000000..cdfdc9afbe
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
@@ -0,0 +1,605 @@
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/TraceRevision.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/General.hpp"
+#include <algorithm>
+#include <array>
+#include <charconv>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <fstream>
+#include <functional>
+#include <limits>
+#include <set>
+#include <stdexcept>
+#include <thread>
+#include <tuple>
+#include <utility>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <unistd.h>
+#endif
+
+namespace AgcDriver {
+namespace {
+
+std::uint64_t readNumber(const char* text, std::uint64_t fallback) {
+    if (text == nullptr || *text == '\0') return fallback;
+    std::uint64_t value = 0;
+    const std::string_view view(text);
+    const auto [last, error] = std::from_chars(view.data(), view.data() + view.size(), value);
+    if (error != std::errc{} || last != view.data() + view.size()) throw std::runtime_error("frame capture: '" + std::string(view) + "' is not a number");
+    return value;
+}
+
+std::string jsonString(std::string_view text) {
+    std::string result = "\"";
+    for (const char character : text) {
+        if (character == '"' || character == '\\') {
+            result += '\\';
+            result += character;
+        } else if (static_cast<unsigned char>(character) < 0x20) {
+            char escaped[8];
+            std::snprintf(escaped, sizeof(escaped), "\\u%04x", static_cast<unsigned>(static_cast<unsigned char>(character)));
+            result += escaped;
+        } else {
+            result += character;
+        }
+    }
+    return result + "\"";
+}
+
+std::vector<std::pair<std::string, std::string>> captureEnvironment() {
+#ifdef _WIN32
+    char** entries = _environ;
+#else
+    char** entries = environ;
+#endif
+    std::vector<std::pair<std::string, std::string>> result;
+    for (; entries != nullptr && *entries != nullptr; ++entries) {
+        const std::string_view entry = *entries;
+        const auto equals = entry.find('=');
+        if (!entry.starts_with("APS5_") || equals == std::string_view::npos) continue;
+        result.emplace_back(std::string(entry.substr(0, equals)), std::string(entry.substr(equals + 1)));
+    }
+    std::sort(result.begin(), result.end());
+    return result;
+}
+
+std::uint64_t threadId() {
+    return static_cast<std::uint64_t>(std::hash<std::thread::id>{}(std::this_thread::get_id()));
+}
+
+std::vector<ShaderRegister> copyRegisters(std::span<const ShaderRegister> registers) {
+    return {registers.begin(), registers.end()};
+}
+
+std::uint64_t pointer(const void* value) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(value));
+}
+
+std::uint64_t flipValue(std::int64_t value) {
+    return static_cast<std::uint64_t>(value);
+}
+
+std::uint64_t contentHash(std::span<const std::byte> bytes) {
+    std::uint64_t hash = 0xcbf29ce484222325ull;
+    for (const auto value : bytes) hash = (hash ^ static_cast<std::uint64_t>(value)) * 0x100000001b3ull;
+    return hash == 0 ? 1 : hash;
+}
+
+}
+
+FrameRecorder* FrameRecorder::Active() {
+    static FrameRecorder* const recorder = []() -> FrameRecorder* {
+        const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+        if (directory == nullptr || *directory == '\0') return nullptr;
+        const char* trigger = std::getenv("APS5_FRAME_CAPTURE_TRIGGER");
+        const auto atBoundary = readNumber(std::getenv("APS5_FRAME_CAPTURE_AT_FLIP"), 0);
+        const auto frames = readNumber(std::getenv("APS5_FRAME_CAPTURE_FRAMES"), DefaultFrames);
+        if (frames == 0) throw std::runtime_error("frame capture: APS5_FRAME_CAPTURE_FRAMES must be at least 1");
+        return new FrameRecorder(directory, trigger != nullptr ? trigger : "", atBoundary, frames);
+    }();
+    return recorder;
+}
+
+FrameRecorder::FrameRecorder(std::filesystem::path directory, std::filesystem::path trigger, std::uint64_t atBoundary, std::uint64_t frames)
+    : directory(std::move(directory)), trigger(std::move(trigger)), atBoundary(atBoundary), frames(frames), origin(std::chrono::steady_clock::now()) {}
+
+FrameCall FrameRecorder::make(FrameCallKind kind) {
+    FrameCall call;
+    call.kind = kind;
+    call.timeNs = static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - origin).count());
+    call.thread = threadId();
+    return call;
+}
+
+void FrameRecorder::RegisterShader(const Shader* shader) {
+    auto call = make(FrameCallKind::RegisterShader);
+    call.address = pointer(shader);
+    const std::array<const Shader*, 1> shaders{shader};
+    record(std::move(call), true, shaders);
+}
+
+void FrameRecorder::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) {
+    auto call = make(FrameCallKind::ResolveShaderAbi);
+    call.address = pointer(shader);
+    call.context = copyRegisters(context);
+    call.primitive = copyRegisters(primitive);
+    const std::array<const Shader*, 1> shaders{shader};
+    record(std::move(call), true, shaders);
+}
+
+void FrameRecorder::ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) {
+    auto call = make(FrameCallKind::ResolveGraphicsStagesAbi);
+    for (const auto* stage : stages) call.values.push_back(pointer(stage));
+    call.context = copyRegisters(context);
+    call.primitive = copyRegisters(primitive);
+    record(std::move(call), true, stages);
+}
+
+void FrameRecorder::ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) {
+    auto call = make(FrameCallKind::ResolveGraphicsAbi);
+    call.values = {pointer(vertex), pointer(pixel), primitiveType};
+    const std::array<const Shader*, 2> shaders{vertex, pixel};
+    record(std::move(call), true, shaders);
+}
+
+void FrameRecorder::RegisterVideoOutput(std::uint32_t handle) {
+    auto call = make(FrameCallKind::RegisterVideoOutput);
+    call.values = {handle};
+    record(std::move(call), true);
+}
+
+void FrameRecorder::UnregisterVideoOutput(std::uint32_t handle) {
+    auto call = make(FrameCallKind::UnregisterVideoOutput);
+    call.values = {handle};
+    record(std::move(call), true);
+}
+
+void FrameRecorder::Submit(const Packet& packet, std::uint32_t queue, const std::function<void()>& accept) {
+    auto call = make(FrameCallKind::Submit);
+    call.queue = queue;
+    call.address = pointer(packet.addr);
+    call.size = packet.dw_num;
+    call.flags = packet.flags;
+    record(std::move(call), false, {}, accept);
+}
+
+void FrameRecorder::Flip(const FlipInfo& info, const std::function<void()>& accept) {
+    auto call = make(FrameCallKind::Flip);
+    call.cpuFlip = true;
+    call.values = {info.handle, flipValue(info.index), info.mode, flipValue(info.argument)};
+    record(std::move(call), false, {}, accept);
+}
+
+void FrameRecorder::ReserveEopFlip(const FlipInfo& info, std::uint32_t token) {
+    auto call = make(FrameCallKind::ReserveEopFlip);
+    call.values = {info.handle, flipValue(info.index), info.mode, flipValue(info.argument), token};
+    std::lock_guard lock(mutex);
+    if (state == State::Waiting) {
+        call.ordinal = ++ordinal;
+        reservations.push_back(std::move(call));
+        if (reservations.size() > ReservationHistory) reservations.pop_front();
+        return;
+    }
+    if (state != State::Recording) return;
+    emitDelta();
+    if (state != State::Recording) return;
+    call.ordinal = ++ordinal;
+    std::tie(call.accepted, call.completed) = DriverDetail::Driver::Get().SerialProgress();
+    writer->WriteCall(call);
+    ++recordedCalls;
+}
+
+void FrameRecorder::Suspend(const std::function<void()>& accept) {
+    record(make(FrameCallKind::Suspend), false, {}, accept);
+}
+
+void FrameRecorder::PresentBuffer(const DisplayBuffer& buffer) {
+    std::lock_guard lock(displayMutex);
+    displayBuffers[buffer.address] = buffer;
+}
+
+void FrameRecorder::writeReferenceFrames() {
+    std::map<std::uint64_t, DisplayBuffer> presented;
+    {
+        std::lock_guard lock(displayMutex);
+        presented = displayBuffers;
+    }
+    if (presented.empty()) return;
+    if (!DriverDetail::Driver::Get().WaitIdleFor(std::chrono::seconds(10))) {
+        warnings.push_back("no reference frames: the driver did not go idle after the last frame");
+        return;
+    }
+    std::uint64_t index = 0;
+    for (const auto& [address, buffer] : presented) {
+        try {
+            const auto pixels = ReadDisplayBuffer(buffer);
+            writer->WriteReference(index, address, pixels);
+        } catch (const std::exception& failure) {
+            warnings.push_back(std::string("no reference frame for a display buffer: ") + failure.what());
+            continue;
+        }
+        auto call = make(FrameCallKind::DisplayBuffer);
+        call.ordinal = ++ordinal;
+        call.address = buffer.address;
+        call.values = {index, buffer.pixelFormat, buffer.width, buffer.height, buffer.tilingMode, buffer.pitchInPixel, buffer.dccAddress, buffer.dccClearColor, buffer.alignment};
+        writer->WriteCall(call);
+        ++index;
+    }
+}
+
+void FrameRecorder::record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders, const std::function<void()>& accept) {
+    std::lock_guard lock(mutex);
+    recordLocked(std::move(call), prologueCall, shaders);
+    if (accept) accept();
+}
+
+void FrameRecorder::recordLocked(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders) {
+    if (state == State::Waiting) {
+        if (!prologueCall) return;
+        call.ordinal = ++ordinal;
+        prologue.push_back(std::move(call));
+        return;
+    }
+    if (state != State::Recording) return;
+    if (prologueCall) emitShaderDelta(shaders);
+    else emitDelta();
+    if (state != State::Recording) return;
+    call.ordinal = ++ordinal;
+    std::tie(call.accepted, call.completed) = DriverDetail::Driver::Get().SerialProgress();
+    writer->WriteCall(call);
+    ++recordedCalls;
+}
+
+void FrameRecorder::FrameBoundary() {
+    std::lock_guard lock(mutex);
+    ++boundaries;
+    if (state == State::Recording) {
+        if (++recordedFrames >= frames) finish();
+        return;
+    }
+    if (state == State::Waiting && triggered()) start();
+}
+
+bool FrameRecorder::triggered() {
+    if (!trigger.empty()) {
+        std::error_code error;
+        if (!std::filesystem::exists(trigger, error)) return false;
+        std::ifstream file(trigger);
+        std::uint64_t requested = 0;
+        if (file >> requested && requested != 0) frames = requested;
+        return true;
+    }
+    return boundaries >= std::max<std::uint64_t>(atBoundary, 1);
+}
+
+void FrameRecorder::emitDelta() {
+    std::vector<Span> spans;
+    for (const auto& range : ranges) {
+        if (range.kind == FrameRangeKind::Watched || range.kind == FrameRangeKind::Unwatched) spans.push_back({range.address, range.bytes, generation});
+    }
+    const auto mark = GuestMemory::WriteGeneration();
+    const auto added = newRanges();
+    writeDelta(spans, {}, added);
+    generation = mark;
+    shaderMarks.clear();
+}
+
+std::vector<FrameRecorder::Range> FrameRecorder::newRanges() {
+    const auto current = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    if (current == allocationsGeneration) return {};
+    allocationsGeneration = current;
+    std::map<std::uint64_t, std::uint64_t> covered;
+    for (const auto& range : ranges) {
+        auto& end = covered[range.address];
+        end = std::max(end, range.address + range.bytes);
+    }
+    std::vector<Range> added;
+    for (const auto& range : committedRanges()) {
+        const auto end = range.address + range.bytes;
+        for (auto at = range.address; at < end;) {
+            const auto next = covered.upper_bound(at);
+            if (next != covered.begin() && std::prev(next)->second > at) {
+                at = std::prev(next)->second;
+                continue;
+            }
+            auto piece = range;
+            piece.address = at;
+            piece.bytes = (next == covered.end() ? end : std::min(end, next->first)) - at;
+            added.push_back(piece);
+            at += piece.bytes;
+        }
+    }
+    return added;
+}
+
+void FrameRecorder::emitShaderDelta(std::span<const Shader* const> shaders) {
+    std::set<std::uint64_t> blocks;
+    std::set<std::uint64_t> hostPages;
+    std::uintptr_t arenaBase = 0;
+    std::size_t arenaBytes = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&arenaBase, &arenaBytes);
+    const auto note = [&](const void* address, std::uint64_t bytes = 0) {
+        if (address == nullptr) return;
+        const auto at = pointer(address);
+        const bool arena = at >= arenaBase && at - arenaBase < arenaBytes;
+        const auto blockBytes = arena ? FrameCaptureWriter::BlockBytes : HostPageBytes;
+        const auto begin = at & ~std::uint64_t{blockBytes - 1};
+        const auto count = bytes != 0 ? (at - begin + bytes + blockBytes - 1) / blockBytes : 2;
+        auto& pages = arena ? blocks : hostPages;
+        for (std::uint64_t index = 0; index < count; ++index) pages.insert(begin + index * blockBytes);
+    };
+    for (const auto* shader : shaders) {
+        if (shader == nullptr || !GuestMemory::Accessible(shader, sizeof(Shader))) continue;
+        note(shader);
+        note(const_cast<const void*>(shader->code), shader->shader_size);
+        note(shader->user_data);
+        note(shader->cx_registers);
+        note(shader->sh_registers);
+        note(shader->specials);
+        note(shader->input_semantics);
+        note(shader->output_semantics);
+        if (shader->user_data == nullptr || !GuestMemory::Accessible(shader->user_data, sizeof(ShaderUserData))) continue;
+        note(shader->user_data->direct_resource_offset);
+        for (const auto* sharps : shader->user_data->sharp_resource_offset) note(sharps);
+    }
+    if (blocks.empty() && hostPages.empty()) return;
+    const auto mark = GuestMemory::WriteGeneration();
+    std::vector<Span> spans;
+    for (const auto block : blocks) {
+        const auto found = shaderMarks.find(block);
+        spans.push_back({block, FrameCaptureWriter::BlockBytes, found != shaderMarks.end() ? std::max(found->second, generation) : generation});
+    }
+    const std::vector<std::uint64_t> pages(hostPages.begin(), hostPages.end());
+    writeDelta(spans, pages);
+    for (const auto block : blocks) shaderMarks[block] = mark;
+}
+
+void FrameRecorder::writeDelta(std::span<const Span> spans, std::span<const std::uint64_t> hostPages, std::span<const Range> added) {
+    if (abandonIfDiskLow()) return;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> blocks;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> written;
+    for (const auto& span : spans) {
+        GuestMemory::CollectWrittenBlocks(span.address, static_cast<std::size_t>(span.bytes), span.since, written);
+        blocks.insert(blocks.end(), written.begin(), written.end());
+    }
+    auto& driver = DriverDetail::Driver::Get();
+    auto [accepted, completed] = driver.SerialProgress();
+    if (completed < accepted && (!added.empty() || !blocks.empty())) {
+        if (!driver.WaitIdleFor(std::chrono::seconds(10))) {
+            stop("stopped: the GPU work submitted before a memory delta did not finish within 10 s");
+            return;
+        }
+        std::tie(accepted, completed) = driver.SerialProgress();
+    }
+    const auto group = deltaGroups + 1;
+    bool any = false;
+    std::vector<std::byte> bytes;
+    for (const auto& range : added) {
+        writer->WriteRange(range.address, range.bytes, range.kind, range.protection, range.access);
+        ranges.push_back(range);
+        ++lateRanges;
+        if (!range.readable) {
+            unreadableBytes += range.bytes;
+            continue;
+        }
+        for (std::uint64_t at = 0; at < range.bytes;) {
+            bytes.resize(static_cast<std::size_t>(std::min<std::uint64_t>(FrameCaptureWriter::BlockBytes, range.bytes - at)));
+            GuestMemory::ReadCommittedUnsynced(range.address + at, bytes);
+            const bool zero = std::all_of(bytes.begin(), bytes.end(), [](std::byte value) { return value == std::byte{0}; });
+            if (!zero) {
+                writer->WriteDelta(group, completed, range.address + at, bytes);
+                deltaBytes += bytes.size();
+                any = true;
+            }
+            at += bytes.size();
+        }
+    }
+    for (const auto page : hostPages) {
+        if (!GuestMemory::Accessible(reinterpret_cast<const void*>(static_cast<std::uintptr_t>(page)), HostPageBytes)) continue;
+        bytes.resize(HostPageBytes);
+        std::memcpy(bytes.data(), reinterpret_cast<const void*>(static_cast<std::uintptr_t>(page)), HostPageBytes);
+        const auto hash = contentHash(bytes);
+        auto& known = hostPageHashes[page];
+        if (known == hash) continue;
+        known = hash;
+        writer->WriteDelta(group, completed, page, bytes);
+        deltaBytes += bytes.size();
+        any = true;
+    }
+    for (const auto& [begin, end] : blocks) {
+        bytes.resize(static_cast<std::size_t>(end - begin));
+        GuestMemory::ReadCommittedUnsynced(begin, bytes);
+        writer->WriteDelta(group, completed, begin, bytes);
+        deltaBytes += bytes.size();
+        any = true;
+    }
+    if (!any) return;
+    deltaGroups = group;
+    auto call = make(FrameCallKind::Memory);
+    call.ordinal = ++ordinal;
+    call.accepted = accepted;
+    call.completed = completed;
+    call.values = {group};
+    writer->WriteCall(call);
+}
+
+void FrameRecorder::snapshot(const Range& range) {
+    writer->WriteRange(range.address, range.bytes, range.kind, range.protection, range.access);
+    if (!range.readable) {
+        unreadableBytes += range.bytes;
+        return;
+    }
+    std::vector<std::byte> bytes;
+    for (std::uint64_t at = 0; at < range.bytes; at += SnapshotPieceBytes) {
+        if (abandonIfDiskLow()) return;
+        bytes.resize(static_cast<std::size_t>(std::min<std::uint64_t>(SnapshotPieceBytes, range.bytes - at)));
+        GuestMemory::ReadCommitted(range.address + at, bytes);
+        snapshotBytes += writer->WriteSnapshot(range.address + at, bytes);
+    }
+}
+
+bool FrameRecorder::abandonIfDiskLow() {
+    std::error_code error;
+    const auto space = std::filesystem::space(directory, error);
+    if (error || space.available >= MinimumFreeBytes) return false;
+    stop("stopped: less than 4 GiB free on the capture volume");
+    return true;
+}
+
+void FrameRecorder::stop(const char* reason) {
+    warnings.push_back(reason);
+    std::fprintf(stderr, "[frame-capture] %s\n", reason);
+    try {
+        writer->Finish(header());
+    } catch (const std::exception& failure) {
+        std::fprintf(stderr, "[frame-capture] %s\n", failure.what());
+    }
+    writer.reset();
+    state = State::Done;
+}
+
+void FrameRecorder::start() {
+    ++startAttempts;
+    auto& driver = DriverDetail::Driver::Get();
+    if (!driver.WaitIdleFor(std::chrono::seconds(10))) {
+        std::fprintf(stderr, "[frame-capture] the driver did not go idle within 10 s at frame boundary %llu (attempt %llu)\n", static_cast<unsigned long long>(boundaries), static_cast<unsigned long long>(startAttempts));
+        if (startAttempts >= 5) {
+            std::fprintf(stderr, "[frame-capture] giving up: no idle frame boundary\n");
+            state = State::Done;
+        }
+        return;
+    }
+    startedAt = std::chrono::steady_clock::now();
+    startBoundary = boundaries;
+    allocationsGeneration = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    ranges = committedRanges();
+    writer = std::make_unique<FrameCaptureWriter>(directory);
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> written;
+    for (const auto& range : ranges) {
+        if (range.kind == FrameRangeKind::Watched || range.kind == FrameRangeKind::Unwatched) GuestMemory::CollectWrittenBlocks(range.address, static_cast<std::size_t>(range.bytes), std::numeric_limits<std::uint64_t>::max(), written);
+    }
+    generation = GuestMemory::WriteGeneration();
+    for (const auto& range : ranges) {
+        snapshot(range);
+        if (!writer) return;
+    }
+    for (const auto& call : prologue) writer->WriteCall(call);
+    std::uintptr_t ringBase = 0;
+    std::uint32_t ringSize = 0;
+    sceAgcDriverGetTFRing(&ringBase, &ringSize);
+    auto ring = make(FrameCallKind::SetTessellationFactorRing);
+    ring.ordinal = ++ordinal;
+    ring.address = ringBase;
+    ring.size = ringSize;
+    writer->WriteCall(ring);
+    const auto pending = driver.PendingEopFlipTokens();
+    const std::set<std::uint64_t> open(pending.begin(), pending.end());
+    for (const auto& call : reservations) {
+        if (open.contains(call.values.back())) writer->WriteCall(call);
+    }
+    auto begin = make(FrameCallKind::FrameStart);
+    begin.ordinal = ++ordinal;
+    std::tie(begin.accepted, begin.completed) = driver.SerialProgress();
+    begin.values = {boundaries};
+    writer->WriteCall(begin);
+    state = State::Recording;
+    recordedFrames = 0;
+    std::fprintf(stderr, "[frame-capture] started at frame boundary %llu: %zu ranges, %.1f MiB snapshot in %.1f s\n", static_cast<unsigned long long>(boundaries), ranges.size(),
+                 static_cast<double>(snapshotBytes) / (1024.0 * 1024.0), std::chrono::duration<double>(std::chrono::steady_clock::now() - startedAt).count());
+}
+
+void FrameRecorder::finish() {
+    emitDelta();
+    if (!writer) return;
+    auto end = make(FrameCallKind::End);
+    end.ordinal = ++ordinal;
+    std::tie(end.accepted, end.completed) = DriverDetail::Driver::Get().SerialProgress();
+    writer->WriteCall(end);
+    writeReferenceFrames();
+    writer->Finish(header());
+    std::fprintf(stderr, "[frame-capture] %llu frames, %llu calls, %llu memory deltas (%.1f MiB), %.1f MiB raw, %.1f MiB stored in %s\n", static_cast<unsigned long long>(recordedFrames),
+                 static_cast<unsigned long long>(recordedCalls), static_cast<unsigned long long>(deltaGroups), static_cast<double>(deltaBytes) / (1024.0 * 1024.0),
+                 static_cast<double>(writer->RawBytes()) / (1024.0 * 1024.0), static_cast<double>(writer->StoredBytes()) / (1024.0 * 1024.0), directory.string().c_str());
+    writer.reset();
+    state = State::Done;
+}
+
+std::string FrameRecorder::header() const {
+    std::uintptr_t arenaBase = 0;
+    std::size_t arenaBytes = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&arenaBase, &arenaBytes);
+    std::string text = "{\"magic\":\"aps5-frame-capture 1\"";
+    text += ",\"commit\":" + jsonString(APS5_TRACE_COMMIT);
+    text += std::string(",\"dirty\":") + (APS5_TRACE_DIRTY < 0 ? "null" : APS5_TRACE_DIRTY != 0 ? "true" : "false");
+    text += ",\"arena_base\":" + std::to_string(arenaBase) + ",\"arena_bytes\":" + std::to_string(arenaBytes);
+    text += ",\"start_boundary\":" + std::to_string(startBoundary) + ",\"frames\":" + std::to_string(recordedFrames);
+    text += ",\"calls\":" + std::to_string(recordedCalls) + ",\"prologue_calls\":" + std::to_string(prologue.size());
+    text += ",\"ranges\":" + std::to_string(ranges.size()) + ",\"late_ranges\":" + std::to_string(lateRanges) + ",\"snapshot_bytes\":" + std::to_string(snapshotBytes) + ",\"unreadable_bytes\":" + std::to_string(unreadableBytes);
+    text += ",\"memory_groups\":" + std::to_string(deltaGroups) + ",\"delta_bytes\":" + std::to_string(deltaBytes);
+    text += ",\"capture_seconds\":" + std::to_string(std::chrono::duration<double>(std::chrono::steady_clock::now() - startedAt).count());
+    text += ",\"env\":{";
+    bool first = true;
+    for (const auto& [name, value] : captureEnvironment()) {
+        text += (first ? "" : ",") + jsonString(name) + ":" + jsonString(value);
+        first = false;
+    }
+    text += "},\"warnings\":[";
+    first = true;
+    for (const auto& warning : warnings) {
+        text += (first ? "" : ",") + jsonString(warning);
+        first = false;
+    }
+    return text + "]}\n";
+}
+
+std::vector<FrameRecorder::Range> FrameRecorder::committedRanges() {
+#ifdef _WIN32
+    std::uintptr_t base = 0;
+    std::size_t size = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&base, &size);
+    if (size == 0) throw std::runtime_error("frame capture: the guest arena is not reserved");
+    std::vector<Range> result;
+    for (const auto& allocation : GuestAllocations::GuestAllocationsAcquireAll_nid_postfix()) {
+        if (!allocation->readable) continue;
+        const auto first = allocation->address;
+        const auto end = first + allocation->bytes;
+        const bool host = first < base || end > base + size;
+        const auto access = FrameRangeAccess::Readable | (allocation->writable ? FrameRangeAccess::Writable : 0u) | (allocation->gpu ? FrameRangeAccess::Gpu : 0u);
+        for (auto address = first; address < end;) {
+            MEMORY_BASIC_INFORMATION info{};
+            if (VirtualQuery(reinterpret_cast<const void*>(static_cast<std::uintptr_t>(address)), &info, sizeof(info)) == 0) throw std::runtime_error("frame capture: VirtualQuery failed inside the guest arena");
+            const auto regionEnd = std::min<std::uint64_t>(end, reinterpret_cast<std::uintptr_t>(info.BaseAddress) + info.RegionSize);
+            if (info.State == MEM_COMMIT) {
+                Range range;
+                range.address = address;
+                range.bytes = regionEnd - address;
+                range.protection = info.Protect;
+                range.access = access;
+                const auto page = info.Protect & 0xffu;
+                range.readable = (info.Protect & PAGE_GUARD) == 0 && (page == PAGE_READONLY || page == PAGE_READWRITE || page == PAGE_WRITECOPY || page == PAGE_EXECUTE_READ || page == PAGE_EXECUTE_READWRITE || page == PAGE_EXECUTE_WRITECOPY);
+                if (host) range.kind = FrameRangeKind::Host;
+                else if (info.Type == MEM_PRIVATE) range.kind = GuestMemory::Watched(range.address, static_cast<std::size_t>(range.bytes)) ? FrameRangeKind::Watched : FrameRangeKind::Unwatched;
+                else range.kind = FrameRangeKind::Section;
+                auto& last = result.empty() ? range : result.back();
+                if (!result.empty() && last.address + last.bytes == range.address && last.kind == range.kind && last.protection == range.protection && last.readable == range.readable && last.access == range.access) last.bytes += range.bytes;
+                else result.push_back(range);
+            }
+            address = regionEnd;
+        }
+    }
+    return result;
+#else
+    throw std::runtime_error("frame capture: guest memory capture is implemented on Windows only");
+#endif
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
index 69341f8385..e72fabda25 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
@@ -21,7 +21,10 @@
 #include <cstdlib>
 #include <cstring>
 #include <limits>
+#include <map>
 #include <memory>
+#include <new>
+#include <optional>
 #include <stdexcept>
 #include <string>
 #include <tuple>
@@ -372,18 +375,38 @@ struct PageSpan {
     std::size_t size = 0;
     // Per page: access flags, zero while unknown.
     std::uint8_t* pages = nullptr;
+    static constexpr std::size_t ChunkEntries = 65536;
+    struct alignas(8) Chunk { std::array<std::uint8_t, ChunkEntries> entries{}; };
+    std::atomic<Chunk*>* chunks = nullptr;
+
+    std::uint8_t* chunkData(std::size_t index, bool create) const {
+        auto* chunk = chunks[index].load(std::memory_order_acquire);
+        if (chunk == nullptr && create) {
+            auto fresh = std::unique_ptr<Chunk>(new (std::nothrow) Chunk{});
+            if (fresh != nullptr && chunks[index].compare_exchange_strong(chunk, fresh.get(), std::memory_order_acq_rel, std::memory_order_acquire)) chunk = fresh.release();
+        }
+        return chunk == nullptr ? nullptr : chunk->entries.data();
+    }
+
+    std::uint8_t* entry(std::size_t index, bool create) const {
+        if (chunks == nullptr) return pages + index;
+        auto* data = chunkData(index / ChunkEntries, create);
+        return data == nullptr ? nullptr : data + index % ChunkEntries;
+    }
 
-    // Reserves and commits the table; untouched table pages cost nothing until a guest page is recorded.
     bool allocate() {
         if (size == 0) return false;
         const auto count = (size / PageBytes + 8) & ~static_cast<std::size_t>(7);
 #ifdef _WIN32
-        pages = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, count, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        const auto chunkCount = (count + ChunkEntries - 1) / ChunkEntries;
+        chunks = new (std::nothrow) std::atomic<Chunk*>[chunkCount]{};
+        if (chunks == nullptr) size = 0;
+        return chunks != nullptr;
 #else
         pages = static_cast<std::uint8_t*>(std::calloc(count, 1));
-#endif
         if (pages == nullptr) size = 0;
         return pages != nullptr;
+#endif
     }
 
     bool covers(std::uintptr_t address) const {
@@ -391,11 +414,23 @@ struct PageSpan {
     }
 
     std::uint8_t load(std::uintptr_t address) const {
-        return std::atomic_ref<std::uint8_t>(const_cast<std::uint8_t&>(pages[(address - base) / PageBytes])).load(std::memory_order_relaxed);
+        auto* value = entry((address - base) / PageBytes, false);
+        return value == nullptr ? 0 : std::atomic_ref<std::uint8_t>(*value).load(std::memory_order_relaxed);
     }
 
     void store(std::uintptr_t address, std::uint8_t value) {
-        std::atomic_ref<std::uint8_t>(pages[(address - base) / PageBytes]).store(value, std::memory_order_relaxed);
+        if (auto* at = entry((address - base) / PageBytes, value != 0 && value != PageInaccessible)) std::atomic_ref<std::uint8_t>(*at).store(value, std::memory_order_relaxed);
+    }
+
+    void store(std::uintptr_t first, std::uintptr_t last, std::uint8_t value) {
+        auto index = (first - base) / PageBytes;
+        const auto stop = (last - 1 - base) / PageBytes + 1;
+        while (index < stop) {
+            const auto next = std::min(stop, (index / ChunkEntries + 1) * ChunkEntries);
+            if (auto* at = entry(index, value != 0 && value != PageInaccessible)) {
+                for (; index < next; ++index, ++at) std::atomic_ref<std::uint8_t>(*at).store(value, std::memory_order_relaxed);
+            } else index = next;
+        }
     }
 
     // End of the run of pages equal to `value` that starts at `address`, at most `limit`.
@@ -404,11 +439,17 @@ struct PageSpan {
         const auto stop = std::min<std::uintptr_t>((std::min(limit, base + size) - base + PageBytes - 1) / PageBytes, size / PageBytes);
         const std::uint64_t wide = 0x0101010101010101ull * value;
         while (index < stop) {
-            if (index % 8 == 0 && index + 8 <= stop && std::atomic_ref<std::uint64_t>(*reinterpret_cast<std::uint64_t*>(const_cast<std::uint8_t*>(pages + index))).load(std::memory_order_relaxed) == wide) {
+            auto* at = entry(index, false);
+            if (at == nullptr) {
+                if (value != 0) break;
+                index = std::min(stop, (index / ChunkEntries + 1) * ChunkEntries);
+                continue;
+            }
+            if (index % 8 == 0 && index + 8 <= stop && std::atomic_ref<std::uint64_t>(*reinterpret_cast<std::uint64_t*>(at)).load(std::memory_order_relaxed) == wide) {
                 index += 8;
                 continue;
             }
-            if (std::atomic_ref<std::uint8_t>(const_cast<std::uint8_t&>(pages[index])).load(std::memory_order_relaxed) != value) break;
+            if (std::atomic_ref<std::uint8_t>(*at).load(std::memory_order_relaxed) != value) break;
             ++index;
         }
         return std::min(limit, base + index * PageBytes);
@@ -418,7 +459,7 @@ struct PageSpan {
         if (size == 0 || bytes == 0 || address >= base + size || address + bytes <= base) return;
         const auto first = (std::max(address, base) - base) / PageBytes;
         const auto last = (std::min(address + bytes, base + size) - 1 - base) / PageBytes;
-        for (auto page = first; page <= last; ++page) std::atomic_ref<std::uint8_t>(pages[page]).store(0, std::memory_order_relaxed);
+        store(base + first * PageBytes, base + (last + 1) * PageBytes, 0);
     }
 };
 
@@ -449,7 +490,7 @@ struct PageStates {
             const std::uint8_t value = readable ? static_cast<std::uint8_t>(PageReadable | (writable ? PageWritable : 0u)) : PageInaccessible;
             const auto first = std::max(base, span->base);
             const auto last = std::min(regionEnd, span->base + span->size);
-            for (auto at = first; at < last; at += PageBytes) span->store(at, value);
+            span->store(first, last, value);
             if (GuestAllocations::GuestAllocationsGeneration_nid_postfix() != generation || accessSerial.load(std::memory_order_acquire) != access) span->forget(first, static_cast<std::size_t>(last - first));
         }
     }
@@ -878,6 +919,7 @@ struct WriteTracker {
     // bumps, or an image refreshed after a stamp would keep failing UnchangedSince until the next
     // walk of its range and re-upload at every use of the epoch.
     std::atomic<std::uint32_t> generation{1};
+    std::atomic<std::uint32_t> stable{1};
     std::vector<void*> pages;
     // Collect memo: page-rounded ranges walked during the current epoch (see BumpCollectEpoch). A
     // collect fully inside one skips GetWriteWatch, whose cost is proportional to the range's pages,
@@ -1001,6 +1043,7 @@ struct WriteTracker {
     };
     std::unordered_map<std::uint64_t, CpuPages> cpuPages;
     std::unordered_map<std::uint64_t, CpuPages> walkPages;
+    std::map<std::uint64_t, std::uint32_t> refused;
 
     void noteCpuStore(std::uint64_t begin, std::uint64_t end, std::uint32_t stampGeneration) {
         notePages(cpuPages, begin, end, stampGeneration);
@@ -1205,7 +1248,16 @@ struct WriteTracker {
         return false;
     }
 
+    bool refusedSince(std::uint64_t address, std::uint64_t end, std::uint64_t since) const {
+        const auto last = blockOf(end - 1);
+        for (auto it = refused.lower_bound(blockOf(address)); it != refused.end() && it->first <= last; ++it) {
+            if (it->second > since) return true;
+        }
+        return false;
+    }
+
     bool rangeUnchanged(std::uint64_t address, std::size_t bytes, std::uint64_t since) const {
+        if (refusedSince(address, address + bytes, since)) return false;
         return unchanged(blockOf(address), blockOf(address + bytes - 1), since) || !storedOver(address, address + bytes, since, true);
     }
 
@@ -1229,16 +1281,51 @@ WriteTracker& Tracker() {
 
 // Takes the tracker mutex; under APS5_PROFILE_DRAW an acquisition that found it held is counted
 // ('tracker waits N / M' in [guestmem]), which says whether walking outside the lock would pay.
-std::unique_lock<AgcDriver::Mutex> lockTracker(WriteTracker& tracker) {
-    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
-    if (!profile) return std::unique_lock(tracker.mutex);
-    std::unique_lock lock(tracker.mutex, std::try_to_lock);
-    if (!lock.owns_lock()) {
-        trackerWaits.fetch_add(1, std::memory_order_relaxed);
+class TrackerLock {
+public:
+    explicit TrackerLock(WriteTracker& tracker) : tracker(tracker), lock(tracker.mutex, std::defer_lock) {
+        static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+        if (!profile) {
+            lock.lock();
+            return;
+        }
+        if (!lock.try_lock()) {
+            trackerWaits.fetch_add(1, std::memory_order_relaxed);
+            lock.lock();
+        }
+        trackerAcquisitions.fetch_add(1, std::memory_order_relaxed);
+    }
+    ~TrackerLock() {
+        if (lock.owns_lock()) publish();
+    }
+    TrackerLock(const TrackerLock&) = delete;
+    TrackerLock& operator=(const TrackerLock&) = delete;
+
+    void Unlock() {
+        publish();
+        lock.unlock();
+    }
+
+    void Suspend() {
+        lock.unlock();
+    }
+
+    void Resume() {
         lock.lock();
     }
-    trackerAcquisitions.fetch_add(1, std::memory_order_relaxed);
-    return lock;
+
+private:
+    void publish() {
+        const auto current = tracker.generation.load(std::memory_order_relaxed);
+        if (tracker.stable.load(std::memory_order_relaxed) != current) tracker.stable.store(current, std::memory_order_release);
+    }
+
+    WriteTracker& tracker;
+    std::unique_lock<AgcDriver::Mutex> lock;
+};
+
+TrackerLock lockTracker(WriteTracker& tracker) {
+    return TrackerLock(tracker);
 }
 
 #ifdef _WIN32
@@ -1375,13 +1462,32 @@ bool collectWindowsWrites(StampRuns& runs, std::uint64_t first, std::uint64_t st
     if (runs.stamped != 0) collectDirty.fetch_add(1, std::memory_order_relaxed);
     return fresh || singlePass || runs.stamped == 0 || walk(true);
 }
+
+void noteRefusedWalk(WriteTracker& tracker, std::uint64_t first, std::uint64_t stop) {
+    const auto pagesOf = [&](auto list, auto&& each) {
+        auto cursor = first;
+        while (cursor < stop) {
+            std::size_t count = tracker.pages.size();
+            list(static_cast<std::uintptr_t>(cursor), static_cast<std::size_t>(stop - cursor), tracker.pages.data(), &count);
+            for (std::size_t i = 0; i < count; ++i) each(reinterpret_cast<std::uintptr_t>(tracker.pages[i]));
+            if (count < tracker.pages.size()) break;
+            cursor = reinterpret_cast<std::uintptr_t>(tracker.pages[count - 1]) + WritePageBytes;
+        }
+    };
+    StampRuns runs{tracker, StampKind::Cpu};
+    pagesOf(&GuestArena::GuestArenaTakeUnreportedPages_nid_no_patch, [&](std::uintptr_t page) { stampWrittenRun(&runs, page, page + WritePageBytes); });
+    const auto generation = tracker.generation.load(std::memory_order_relaxed);
+    pagesOf(&GuestArena::GuestArenaComparedPages_nid_no_patch, [&](std::uintptr_t page) { tracker.refused[tracker.blockOf(page)] = generation; });
+}
 #endif
 
 bool walkWrites(WriteTracker& tracker, std::uint64_t first, std::uint64_t stop, StampKind kind, bool armedOnly = false, const WindowCopy* window = nullptr) {
     ++tracker.generation;
     StampRuns runs{tracker, kind, 0, window};
 #ifdef _WIN32
-    return collectWindowsWrites(runs, first, stop, armedOnly);
+    if (collectWindowsWrites(runs, first, stop, armedOnly)) return true;
+    noteRefusedWalk(tracker, first, stop);
+    return false;
 #else
     const auto dirtyRuns = collectDirtyRuns.load(std::memory_order_relaxed);
     const auto collect = armedOnly ? &GuestWriteWatch::GuestWriteWatchCollectArmed_nid_postfix : &GuestWriteWatch::GuestWriteWatchCollect_nid_postfix;
@@ -1411,7 +1517,7 @@ std::uint64_t collectWrites(std::uint64_t address, std::size_t bytes, bool memoi
             const auto& map = epochCollectMap(epoch);
             if (const auto found = map.ranges.find(first); found != map.ranges.end() && found->second.unwatched == unwatched && found->second.mapping == mapping && stop <= found->second.end) {
                 collectMemoHits.fetch_add(1, std::memory_order_relaxed);
-                return tracker.generation.load(std::memory_order_relaxed);
+                return tracker.stable.load(std::memory_order_acquire);
             }
         }
         for (const auto& entry : threadCollectMemo().entries) {
@@ -1420,7 +1526,7 @@ std::uint64_t collectWrites(std::uint64_t address, std::size_t bytes, bool memoi
                 // overlapping collect) were written before this caller reads, and an older value would
                 // make every later UnchangedSince fail until the epoch ends.
                 collectMemoHits.fetch_add(1, std::memory_order_relaxed);
-                return tracker.generation.load(std::memory_order_relaxed);
+                return tracker.stable.load(std::memory_order_acquire);
             }
         }
     }
@@ -1474,6 +1580,71 @@ std::uint64_t CollectWritesUncached(std::uint64_t address, std::size_t bytes) {
     return collectWrites(address, bytes, false);
 }
 
+std::uint64_t WriteGeneration() {
+    return Tracker().generation.load(std::memory_order_acquire);
+}
+
+std::uint64_t CollectWrittenBlocks(std::uint64_t address, std::size_t bytes, std::uint64_t since, std::vector<std::pair<std::uint64_t, std::uint64_t>>& written) {
+    written.clear();
+    if (bytes == 0 || bytes > std::numeric_limits<std::uint64_t>::max() - address) return 0;
+    auto& tracker = Tracker();
+    const auto lock = lockTracker(tracker);
+    tracker.initialize();
+    if (!tracker.watched) return 0;
+#ifdef _WIN32
+    if (address < tracker.base || bytes > tracker.size || address - tracker.base > tracker.size - bytes) return 0;
+#endif
+    const auto end = address + bytes;
+    const auto first = tracker.blockOf(address);
+    const auto last = tracker.blockOf(end - 1);
+    const auto clip = [&](std::uint64_t block) {
+        const auto begin = tracker.blockBegin(block);
+        return std::pair{std::max(address, begin), std::min<std::uint64_t>(end, begin + WriteBlockBytes)};
+    };
+    std::uint64_t spanBegin = 0;
+    std::uint64_t spanEnd = 0;
+    const auto walkSpan = [&] {
+        if (spanEnd > spanBegin) walkWrites(tracker, spanBegin & ~std::uint64_t{WritePageBytes - 1}, (spanEnd + WritePageBytes - 1) & ~std::uint64_t{WritePageBytes - 1}, StampKind::Cpu);
+        spanBegin = spanEnd = 0;
+    };
+    for (auto block = first; block <= last; ++block) {
+        const auto [begin, stop] = clip(block);
+        if (!tracker.covers(begin, stop - begin)) {
+            walkSpan();
+            continue;
+        }
+        if (spanEnd != begin) {
+            walkSpan();
+            spanBegin = begin;
+        }
+        spanEnd = stop;
+    }
+    walkSpan();
+    const auto append = [&](std::uint64_t begin, std::uint64_t stop) {
+        if (!written.empty() && written.back().second == begin) written.back().second = stop;
+        else written.emplace_back(begin, stop);
+    };
+    for (auto block = first; block <= last; ++block) {
+        if (tracker.cpuStampOf(block) <= since) continue;
+        const auto [begin, stop] = clip(block);
+        const auto pages = tracker.cpuPages.find(block);
+        bool any = false;
+        if (pages != tracker.cpuPages.end()) {
+            const auto blockStart = tracker.blockBegin(block);
+            for (std::size_t page = 0; page < WritePagesPerBlock; ++page) {
+                if (pages->second.pages[page] <= since) continue;
+                const auto pageBegin = std::max<std::uint64_t>(begin, blockStart + page * WritePageBytes);
+                const auto pageEnd = std::min<std::uint64_t>(stop, blockStart + (page + 1) * WritePageBytes);
+                if (pageBegin >= pageEnd) continue;
+                append(pageBegin, pageEnd);
+                any = true;
+            }
+        }
+        if (!any) append(begin, stop);
+    }
+    return tracker.generation.load(std::memory_order_relaxed);
+}
+
 void BumpCollectEpoch() {
     const auto epoch = nextCollectEpoch.fetch_add(1, std::memory_order_relaxed) + 1;
     HostThreadSlot<std::uint64_t, CollectEpochSlot>::Set(epoch);
@@ -1581,9 +1752,11 @@ void Rewatch(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges) {
     if (!tracker.watched) return;
     bool restored = false;
     for (const auto& [begin, end] : ranges) {
-        if (end <= begin || begin < tracker.base || end - tracker.base > tracker.size || (begin - tracker.base) % WriteBlockBytes != 0 || (end - tracker.base) % WriteBlockBytes != 0) continue;
+        if (end <= begin || begin < tracker.base || end - tracker.base > tracker.size || (begin - tracker.base) % WritePageBytes != 0 || (end - tracker.base) % WritePageBytes != 0) continue;
         const auto bytes = static_cast<std::size_t>(end - begin);
-        if (tracker.coverage.Covers(begin, bytes) || !walkWrites(tracker, begin, end, StampKind::Cpu) || !tracker.coverage.Restore(begin, bytes)) continue;
+        if (tracker.coverage.Covers(begin, bytes)) continue;
+        GuestArena::GuestArenaCompareWhenShared_nid_no_patch(static_cast<std::uintptr_t>(begin), bytes);
+        if (!walkWrites(tracker, begin, end, StampKind::Cpu) || !tracker.coverage.Restore(begin, bytes)) continue;
         ++tracker.generation;
         tracker.noteCpuStore(begin, end, tracker.generation);
         for (auto block = tracker.blockOf(begin); block <= tracker.blockOf(end - 1); ++block) {
@@ -1598,7 +1771,7 @@ void Rewatch(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges) {
 #endif
 }
 
-bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function<bool()>& import, bool staysWatched) {
+bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function<bool()>& import, bool staysWatched, bool importMayWriteGuest) {
     if (bytes == 0 || bytes > std::numeric_limits<std::uint64_t>::max() - address) return import();
     if (!staysWatched) {
         constexpr std::uint64_t page = 4096;
@@ -1609,7 +1782,7 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
     auto lock = lockTracker(tracker);
     tracker.initialize();
     if (!tracker.watched) {
-        lock.unlock();
+        lock.Unlock();
         return import();
     }
     constexpr std::uint64_t page = 4096;
@@ -1618,7 +1791,11 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
     const bool covered = tracker.covers(first, static_cast<std::size_t>(stop - first));
     const auto runImport = [&] {
 #ifdef __APPLE__
-        const GuestArena::HostWrite open(reinterpret_cast<void*>(first), static_cast<std::size_t>(stop - first));
+        std::optional<GuestArena::HostWrite> open;
+        if (importMayWriteGuest) open.emplace(reinterpret_cast<void*>(first), static_cast<std::size_t>(stop - first));
+#endif
+#ifndef __APPLE__
+        static_cast<void>(importMayWriteGuest);
 #endif
         return import();
     };
@@ -1648,12 +1825,29 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
             hashes[static_cast<std::size_t>((cursor - first) / page)] = HashPage(reinterpret_cast<const std::byte*>(cursor));
         }
     }
-    std::erase_if(spans, [&](const auto& span) { return !walkWrites(tracker, span.first, span.second, StampKind::Cpu, true); });
+    const auto saveBytes = [&](std::uint64_t begin, std::uint64_t end) {
+        lock.Suspend();
+        beforeUnwatch(begin, static_cast<std::size_t>(end - begin));
+        lock.Resume();
+    };
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> leaving;
+    std::erase_if(spans, [&](const auto& span) {
+        if (walkWrites(tracker, span.first, span.second, StampKind::Cpu, true)) return false;
+        leaving.push_back(span);
+        return true;
+    });
+    for (const auto& [begin, end] : leaving) saveBytes(begin, end);
     if (!runImport()) return false;
     const WindowCopy window{first, hashes};
     auto unwatchedFrom = first;
     for (const auto& [begin, end] : spans) {
-        if (!walkWrites(tracker, begin, end, StampKind::Cpu, true, &window)) continue;
+        if (!walkWrites(tracker, begin, end, StampKind::Cpu, true, &window)) {
+            saveBytes(begin, end);
+            continue;
+        }
+#ifdef _WIN32
+        GuestArena::GuestArenaCompareResidentWhenShared_nid_no_patch(static_cast<std::uintptr_t>(begin), static_cast<std::size_t>(end - begin));
+#endif
         if (unwatchedFrom < begin) unwatchLocked(tracker, unwatchedFrom, static_cast<std::size_t>(begin - unwatchedFrom));
         unwatchedFrom = end;
     }
@@ -1716,7 +1910,7 @@ bool UnchangedCommittedSince(std::span<const std::pair<std::uint64_t, std::uint6
     tracker.initialize();
     if (!tracker.watched || generation == 0) return false;
     for (const auto& [begin, end] : ranges) {
-        if (end <= begin || !tracker.covers(begin, static_cast<std::size_t>(end - begin)) || tracker.newestStamp(begin, end) > generation) return false;
+        if (end <= begin || !tracker.covers(begin, static_cast<std::size_t>(end - begin)) || tracker.newestStamp(begin, end) > generation || tracker.refusedSince(begin, end, generation)) return false;
     }
     return true;
 }
@@ -1789,9 +1983,9 @@ static std::uint64_t markWritten(std::uint64_t address, std::size_t bytes, bool
         const bool collected = GuestWriteWatch::GuestWriteWatchCollectFresh_nid_postfix(static_cast<std::uintptr_t>(blockFirst), static_cast<std::size_t>(blockStop - blockFirst), &stampWrittenRun, &runs);
 #endif
         if (!collected) {
-            lock.unlock();
+            lock.Suspend();
             beforeUnwatch(blockFirst, static_cast<std::size_t>(blockStop - blockFirst));
-            lock.lock();
+            lock.Resume();
             unwatchLocked(tracker, blockFirst, static_cast<std::size_t>(blockStop - blockFirst));
             tracker.noteUnstampedStore(address, address + bytes);
             return 0;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp
index cbbb9c549d..d33999f9e3 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp
@@ -24,6 +24,41 @@ struct Cache {
     std::uint16_t counts[Classes];
 };
 
+constexpr std::uint16_t KeptLists = 8;
+
+struct Depot {
+    SRWLOCK lock = SRWLOCK_INIT;
+    void* lists = nullptr;
+    std::uint16_t count = 0;
+};
+
+Depot depots[Classes];
+
+bool KeepList(std::size_t sizeClass, void* list) noexcept {
+    auto& depot = depots[sizeClass];
+    AcquireSRWLockExclusive(&depot.lock);
+    const bool kept = depot.count < KeptLists;
+    if (kept) {
+        static_cast<void**>(list)[1] = depot.lists;
+        depot.lists = list;
+        ++depot.count;
+    }
+    ReleaseSRWLockExclusive(&depot.lock);
+    return kept;
+}
+
+void* TakeList(std::size_t sizeClass) noexcept {
+    auto& depot = depots[sizeClass];
+    AcquireSRWLockExclusive(&depot.lock);
+    void* list = depot.lists;
+    if (list != nullptr) {
+        depot.lists = static_cast<void**>(list)[1];
+        --depot.count;
+    }
+    ReleaseSRWLockExclusive(&depot.lock);
+    return list;
+}
+
 Cache* const Closed = reinterpret_cast<Cache*>(std::uintptr_t{1});
 
 constexpr unsigned long TlsSlotsOffset = 0x1480;
@@ -114,6 +149,12 @@ void* TryAllocate(std::size_t bytes) noexcept {
     if (bytes <= LargestCached) {
         const auto sizeClass = (bytes - 1) / Granule;
         if (auto* cache = CurrentCache()) {
+            if (cache->heads[sizeClass] == nullptr) {
+                if (void* list = TakeList(sizeClass)) {
+                    cache->heads[sizeClass] = list;
+                    cache->counts[sizeClass] = Depth(sizeClass);
+                }
+            }
             if (void* block = cache->heads[sizeClass]) {
                 cache->heads[sizeClass] = *static_cast<void**>(block);
                 --cache->counts[sizeClass];
@@ -140,6 +181,10 @@ void Release(void* block, std::size_t bytes = 0) noexcept {
         const auto usable = bytes != 0 && bytes % Granule == 0 ? bytes : _msize(block);
         if (usable >= Granule && usable < LargestCached + Granule) {
             const auto sizeClass = usable / Granule - 1;
+            if (cache->counts[sizeClass] == Depth(sizeClass) && KeepList(sizeClass, cache->heads[sizeClass])) {
+                cache->heads[sizeClass] = nullptr;
+                cache->counts[sizeClass] = 0;
+            }
             if (cache->counts[sizeClass] < Depth(sizeClass)) {
                 *static_cast<void**>(block) = cache->heads[sizeClass];
                 cache->heads[sizeClass] = block;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp
index ea98ec2c06..09dda98153 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp
@@ -1,8 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/PreciseWait.hpp"
 #include <algorithm>
+#include <atomic>
 #include <thread>
 #include <chrono>
 #include <cstdio>
@@ -12,8 +14,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-
 namespace AgcDriver::Pm4 {
 
 std::uint64_t GdsAddress() {
@@ -114,7 +114,6 @@ std::vector<std::byte> copySource(std::uint64_t source, std::size_t bytes, bool
     return data;
 }
 
-
 bool gdsRange(std::uint64_t offset, std::size_t bytes) {
     return offset <= GdsBytes && bytes <= GdsBytes - offset;
 }
@@ -226,8 +225,7 @@ std::string_view UnsupportedReason(std::uint32_t header) {
             return "graphics draw, shader stages and guest render-target materialization are not implemented";
         case 0x33: case 0x3f: return "nested command buffers, branching and nested flip reservation are not implemented";
         case 0x3c: case 0x93: return {};
-        case 0x39:
-            return "cooperative command-queue waits are not implemented";
+        case 0x39: return {};
         case 0x59: return {};
         case 0x84: case 0x85: case 0x86: case 0x88:
             return "separate CE/DE execution and counter synchronization are not implemented";
@@ -458,6 +456,12 @@ void Validate(std::span<const std::uint32_t> packet, std::uint32_t queue) {
             require((packet[1] & 7u) <= 6u, "invalid WAIT_REG_MEM compare function");
             break;
         }
+        case 0x39:
+            size(4);
+            require((packet[3] >> 29u) == 6u || (packet[3] >> 29u) == 7u, "invalid MEM_SEMAPHORE operation");
+            require(address(packet[1], packet[2]) != 0 && (packet[1] & 7u) == 0, "null or misaligned MEM_SEMAPHORE address");
+            require((packet[3] & 0x10000u) == 0, "MEM_SEMAPHORE mailbox waits are not implemented");
+            break;
         case 0x45: {
             size(9);
             require((packet[1] & ~0x317u) == 0, "COND_WRITE reserved fields are not implemented");
@@ -716,6 +720,7 @@ std::vector<PacketStore> DecodeStores(std::span<const std::uint32_t> packet) {
             if (!label.has_value()) return {};
             return {known(label->address, label->Bytes())};
         }
+        case 0x39: return {runTime(address(packet[1], packet[2]), 8)};
         case 0x40: {
             require(packet.size() == 6, "invalid COPY_DATA size");
             if (CopyDataToRegister(packet)) return {};
@@ -771,7 +776,7 @@ bool UsesGpuCacheBarrier(std::span<const std::uint32_t> packet) {
 
 bool AccessesMemory(std::uint32_t header) {
     switch ((header >> 8u) & 0xffu) {
-        case 0x22: case 0x27: case 0x3c: case 0x93: case 0x49: case 0x16: case 0x2d: case 0x35: case 0x24: case 0x25: case 0x2c: case 0x38: case 0x37: case 0x40: case 0x45: case 0x50: case 0x63: case 0x64: case 0x83: case 0x91: case 0x9f: return true;
+        case 0x22: case 0x27: case 0x39: case 0x3c: case 0x93: case 0x49: case 0x16: case 0x2d: case 0x35: case 0x24: case 0x25: case 0x2c: case 0x38: case 0x37: case 0x40: case 0x45: case 0x50: case 0x63: case 0x64: case 0x83: case 0x91: case 0x9f: return true;
         default: return false;
     }
 }
@@ -856,12 +861,17 @@ DrawParameters resolveIndirectDraw(std::span<const std::uint32_t> packet, const
         indirect.indxOffset = offset->second;
     } else {
         const auto indexSize = indexSizeOf(queue);
-        require(queue.indexBufferSize != 0, "INDEX_BUFFER_SIZE has not been set");
-        const auto bytes = static_cast<std::uint64_t>(queue.indexBufferSize) * indexSize;
-        require(bytes <= std::numeric_limits<std::size_t>::max() && bytes <= std::numeric_limits<std::uint64_t>::max() - queue.indexBase, "index range size overflow");
         draw.indexAddress = queue.indexBase;
-        draw.indexCount = queue.indexBufferSize;
         draw.indexSize = indexSize;
+        if (queue.indexBufferSize) {
+            require(*queue.indexBufferSize != 0, "INDEX_BUFFER_SIZE is zero");
+            const auto bytes = static_cast<std::uint64_t>(*queue.indexBufferSize) * indexSize;
+            require(bytes <= std::numeric_limits<std::size_t>::max() && bytes <= std::numeric_limits<std::uint64_t>::max() - queue.indexBase, "index range size overflow");
+            draw.indexCount = *queue.indexBufferSize;
+        } else {
+            draw.indexCount = 0;
+            indirect.indexLimitKnown = false;
+        }
     }
     draw.indirect = indirect;
     return draw;
@@ -1072,6 +1082,47 @@ void Execute(std::span<const std::uint32_t> packet, QueueState& queue) {
             }
             return;
         }
+        case 0x39: {
+            const auto semaphore = address(packet[1], packet[2]);
+            auto* word = reinterpret_cast<std::uint64_t*>(semaphore);
+            std::atomic_ref<std::uint64_t> shared(*word);
+            const auto prepare = [&] {
+                GuestMemory::GuardRead(semaphore, sizeof(*word));
+                GuestMemory::FlushGpuWrites(semaphore, sizeof(*word));
+                GuestMemory::CheckRange(word, sizeof(*word), std::atomic_ref<std::uint64_t>::required_alignment, true);
+            };
+            if ((packet[3] >> 29u) == 6u) {
+                prepare();
+                const bool set = (packet[3] & 0x100000u) != 0;
+                GuestMemory::StoreOwnBytes(semaphore, sizeof(*word), [&] {
+                    if (set) shared.store(1, std::memory_order_release);
+                    else shared.fetch_add(1, std::memory_order_acq_rel);
+                });
+                return;
+            }
+            const auto start = std::chrono::steady_clock::now();
+            bool warned = false;
+            for (;;) {
+                {
+                    const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::Wait);
+                    prepare();
+                }
+                auto value = shared.load(std::memory_order_acquire);
+                if (value != 0) {
+                    bool taken = false;
+                    GuestMemory::StoreOwnBytes(semaphore, sizeof(*word), [&] {
+                        taken = shared.compare_exchange_strong(value, value - 1, std::memory_order_acq_rel);
+                    });
+                    if (taken) return;
+                    continue;
+                }
+                PreciseSleepUs(50);
+                if (!warned && std::chrono::steady_clock::now() - start > std::chrono::seconds(5)) {
+                    warned = true;
+                    std::fprintf(stderr, "[gpu] MEM_SEMAPHORE wait at 0x%llx still waiting after 5s\n", static_cast<unsigned long long>(semaphore));
+                }
+            }
+        }
         case 0x49: {
             // Earlier work has drained by the time the driver reaches this packet, so the end-of-pipe
             // write can happen immediately.
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp
index d7c88d7b7d..bc07a8d8db 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp"
 #include "prx/libSceAgcDriver/Execution/include/AspectFit.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 
 namespace AgcDriver {
@@ -23,7 +24,7 @@ PresentationScaler::~PresentationScaler() {
 
 void PresentationScaler::release() noexcept {
     if (sourceImage != VK_NULL_HANDLE) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, sourceImage, nullptr);
-    if (sourceMemory != VK_NULL_HANDLE) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, sourceMemory, nullptr);
+    if (sourceMemory != VK_NULL_HANDLE) Graphics::ReleaseImageMemory(context, sourceMemory, sourceBytes, sourceMemoryType);
     sourceImage = VK_NULL_HANDLE;
     sourceMemory = VK_NULL_HANDLE;
     sourceWidth = 0;
@@ -50,8 +51,9 @@ void PresentationScaler::EnsureSourceImage(std::uint32_t width, std::uint32_t he
     context.Function<PFN_vkGetImageMemoryRequirements>("vkGetImageMemoryRequirements")(context.device, sourceImage, &requirements);
     VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
     allocation.allocationSize = requirements.size;
-    allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-    Graphics::Check(context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &allocation, nullptr, &sourceMemory), "vkAllocateMemory presentation source");
+    allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "presentation source");
+    sourceMemory = Graphics::AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory presentation source", &sourceMemoryType, true);
+    sourceBytes = requirements.size;
     Graphics::Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, sourceImage, sourceMemory, 0), "vkBindImageMemory presentation source");
     sourceWidth = width;
     sourceHeight = height;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp
index f0e0b777f2..4fc0fb89bc 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp
@@ -392,7 +392,7 @@ bool ShaderMemory::readWords(void* context, std::uint64_t address, std::uint32_t
                 }
                 auto last = first + BlockWords;
                 while (last < end && !page->valid.TestBlock(last)) last += BlockWords;
-                std::memcpy(&page->words[first], reinterpret_cast<const void*>(base + first * sizeof(std::uint32_t)), (last - first) * sizeof(std::uint32_t));
+                GuestMemory::CopyGuestBytes(&page->words[first], reinterpret_cast<const void*>(base + first * sizeof(std::uint32_t)), (last - first) * sizeof(std::uint32_t));
                 page->valid.SetRun(first, last - first);
                 first = last;
             }
@@ -495,8 +495,8 @@ bool ShaderMemory::place(std::uint64_t address, const std::uint32_t* values, std
                 if (!page.valid.Test(index + word)) page.words[index + word] = values[word];
             }
         }
-        if (headOpen && head < index) std::memcpy(&page.words[head], reinterpret_cast<const void*>(base + head * sizeof(std::uint32_t)), (index - head) * sizeof(std::uint32_t));
-        if (tailOpen && index + words < tail) std::memcpy(&page.words[index + words], reinterpret_cast<const void*>(base + (index + words) * sizeof(std::uint32_t)), (tail - index - words) * sizeof(std::uint32_t));
+        if (headOpen && head < index) GuestMemory::CopyGuestBytes(&page.words[head], reinterpret_cast<const void*>(base + head * sizeof(std::uint32_t)), (index - head) * sizeof(std::uint32_t));
+        if (tailOpen && index + words < tail) GuestMemory::CopyGuestBytes(&page.words[index + words], reinterpret_cast<const void*>(base + (index + words) * sizeof(std::uint32_t)), (tail - index - words) * sizeof(std::uint32_t));
         page.valid.SetRun(page.lazy ? head : index, page.lazy ? tail - head : words);
         page.read.SetRun(index, words);
         if (recent) page.recent.SetRun(index, words);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp
index 217e5b0c81..9caddde7bd 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp
@@ -101,8 +101,12 @@ SubmissionCapture::SubmissionCapture(const std::filesystem::path& directory) : d
 
 SubmissionCapture* SubmissionCapture::Active() {
     static SubmissionCapture* const capture = [] {
+#ifdef _WIN32
+        const wchar_t* directory = _wgetenv(L"APS5_DUMP_SUBMITS");
+#else
         const char* directory = std::getenv("APS5_DUMP_SUBMITS");
-        return directory != nullptr && *directory != '\0' ? new SubmissionCapture(directory) : nullptr;
+#endif
+        return directory != nullptr && *directory != 0 ? new SubmissionCapture(directory) : nullptr;
     }();
     return capture;
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp
index 2db74fc43c..e88d6475f4 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp
@@ -12,6 +12,12 @@
 
 #ifdef _WIN32
 #include <windows.h>
+#elif defined(__APPLE__)
+#include <mach/mach.h>
+#include <mach/mach_time.h>
+#include <mach/thread_policy.h>
+#include <pthread.h>
+#include <sys/qos.h>
 #else
 #include <dlfcn.h>
 #include <sched.h>
@@ -42,7 +48,30 @@ void LogOnce(const char* role, const std::string& text) {
     std::fprintf(stderr, "[thread-priority] %s: %s\n", role, text.c_str());
 }
 
-#ifndef _WIN32
+#if defined(__APPLE__)
+
+void Raise(const char* role) {
+    if (RequestedMode() == ThreadPriorityMode::Realtime) {
+        mach_timebase_info_data_t timebase{};
+        mach_timebase_info(&timebase);
+        const auto ticks = [&](std::uint64_t nanos) {
+            return static_cast<std::uint32_t>(nanos * timebase.denom / timebase.numer);
+        };
+        thread_time_constraint_policy_data_t policy{ticks(1000000), ticks(500000), ticks(1000000), TRUE};
+        const auto status = thread_policy_set(pthread_mach_thread_np(pthread_self()), THREAD_TIME_CONSTRAINT_POLICY,
+                                              reinterpret_cast<thread_policy_t>(&policy), THREAD_TIME_CONSTRAINT_POLICY_COUNT);
+        if (status != KERN_SUCCESS)
+            throw std::runtime_error(std::string("APS5_THREAD_PRIORITY=rt: ") + role + " time-constraint policy refused (kern_return " + std::to_string(status) + ")");
+        LogOnce(role, "Mach time-constraint policy");
+        return;
+    }
+    const int error = pthread_set_qos_class_self_np(QOS_CLASS_USER_INTERACTIVE, 0);
+    if (error != 0)
+        throw std::runtime_error(std::string("APS5_THREAD_PRIORITY=high: ") + role + " user-interactive QoS refused: " + std::strerror(error));
+    LogOnce(role, "user-interactive QoS");
+}
+
+#elif !defined(_WIN32)
 
 struct DBusConnection;
 struct DBusMessage;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
index 8336d9e082..2306dbe33b 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
@@ -8,6 +8,7 @@
 #include "SpirvBackend/SpirvOptimizer.hpp"
 #endif
 #include "prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Execution/include/FloatFlushProbe.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -20,15 +21,18 @@
 #include "prx/libSceAgcDriver/Execution/include/PipelineLinkOptimization.hpp"
 #include "prx/libSceAgcDriver/Execution/include/DrawInputsInPlace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp"
+#include "prx/libSceAgcDriver/Execution/include/TessellationPipelineCache.hpp"
 #include "prx/libSceAgcDriver/Execution/include/SubgroupClock.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ShaderDeviceProfile.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PresentMode.hpp"
+#include "prx/libSceAgcDriver/Execution/include/SwapchainImages.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceOverlay.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PresentationPass.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Screenshot.hpp"
 #include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PlaceholderImages.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp"
 #include "prx/libSceAgcDriver/Execution/include/DisplayFormat.hpp"
@@ -82,7 +86,7 @@
 
 namespace AgcDriver {
 
-DeviceQueuePlan PlanDeviceQueues(std::span<const VkQueueFamilyProperties> families, std::uint32_t family, bool settles, bool sparseBinding) {
+DeviceQueuePlan PlanDeviceQueues(std::span<const VkQueueFamilyProperties> families, std::uint32_t family, bool settles, bool sparseBinding, bool presents) {
     DeviceQueuePlan plan;
     const auto count = static_cast<std::uint32_t>(families.size());
     if (settles) {
@@ -101,6 +105,13 @@ DeviceQueuePlan PlanDeviceQueues(std::span<const VkQueueFamilyProperties> famili
             }
         }
     }
+    if (presents && family < count) {
+        if (const auto index = SelectPresentQueue(families[family].queueCount, plan.mainCount)) {
+            plan.present = true;
+            plan.presentIndex = *index;
+            plan.mainCount = *index + 1;
+        }
+    }
     if (!sparseBinding) return plan;
     const auto taken = [&](std::uint32_t index) { return plan.settle && index == plan.settleFamily ? plan.settleIndex + 1 : 0u; };
     const auto binds = [&](std::uint32_t index) { return index != family && families[index].queueCount > taken(index) && (families[index].queueFlags & VK_QUEUE_SPARSE_BINDING_BIT) != 0; };
@@ -168,6 +179,12 @@ void CreateComputePipeline(VkDevice device, PFN_vkCreateComputePipelines create,
     PerformanceCounters::CountPipeline();
 }
 
+#ifdef _WIN32
+const wchar_t* ComputePipelineDumpDirectory() { return _wgetenv(L"APS5_DUMP_COMPUTE_PIPELINES"); }
+#else
+const char* ComputePipelineDumpDirectory() { return std::getenv("APS5_DUMP_COMPUTE_PIPELINES"); }
+#endif
+
 bool CaptureComputePipeline(std::size_t words) {
     const char* minimum = std::getenv("APS5_DUMP_COMPUTE_MIN_WORDS");
     if (minimum == nullptr) return true;
@@ -341,7 +358,10 @@ struct VulkanDevice::State {
     VkDeviceSize uploadSize = 0;
     VkPhysicalDeviceProperties properties{};
     std::string driverInfo;
+    VkDriverId driverId = VK_DRIVER_ID_MAX_ENUM;
+    std::uint32_t pixelFunctionStorageDwords = 4096u;
     bool individuallyFreeDescriptorSets = false;
+    bool tessellationPipelineCache = true;
     PFN_vkGetCalibratedTimestampsKHR calibratedTimestamps = nullptr;
     PFN_vkCmdSetCheckpointNV checkpointMarker = nullptr;
     PFN_vkCmdWriteBufferMarkerAMD bufferMarker = nullptr;
@@ -350,6 +370,8 @@ struct VulkanDevice::State {
     void* markerMapping = nullptr;
     BufferMarkerLog markerLog;
     bool deviceLostHook = false;
+    bool deferDestruction = false;
+    PFN_vkGetDeviceProcAddr contextDeviceProc = nullptr;
     VkTimeDomainKHR hostTimeDomain = VK_TIME_DOMAIN_DEVICE_KHR;
     VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
     std::vector<std::uint32_t> capabilities{1};
@@ -379,6 +401,7 @@ struct VulkanDevice::State {
     bool earlyFragmentSampleMaskTestBeforeSampleCounting = false;
     bool robustBufferAccess2 = false;
     bool subgroupControlBarriers = true;
+    bool workgroupScopeFences = true;
     // VK_EXT_descriptor_indexing with non-uniform image array indexing (bindless image tables in
     // graphics stages, and compute workgroups wider than a wave).
     bool descriptorIndexing = false;
@@ -412,6 +435,7 @@ struct VulkanDevice::State {
     bool depthBounds = false;
     bool depthBiasClamp = false;
     bool dualSrcBlend = false;
+    bool logicOp = false;
     bool occlusionQueryPrecise = false;
     VkDeviceSize hostImportAlignment = 0;
     bool drawInputsInPlace = true;
@@ -428,6 +452,8 @@ struct VulkanDevice::State {
     std::uint32_t settleFamily = 0;
     VkCommandPool settlePool = VK_NULL_HANDLE;
     std::mutex settleQueueMutex;
+    VkQueue presentQueue = VK_NULL_HANDLE;
+    std::mutex presentQueueMutex;
     bool memoryBudget = false;
     bool depthRangeUnrestricted = false;
     bool samplerAnisotropy = false;
@@ -795,7 +821,7 @@ struct VulkanDevice::State {
             for (std::uint32_t x = 0; x < width; ++x) std::memcpy(pixels.data() + (static_cast<std::size_t>(y) * width + x) * 4, full.data() + (static_cast<std::size_t>(y) * scale * slot.dumpWidth + static_cast<std::size_t>(x) * scale) * 4, 4);
         }
         static const auto start = std::chrono::steady_clock::now();
-        std::fprintf(stderr, "[gpu] frame_%03d.bmp: %ux%u display read back on the GPU at %.1f s\n", index, slot.dumpWidth, slot.dumpHeight, std::chrono::duration<double>(std::chrono::steady_clock::now() - start).count());
+        AgcDriver::ProfilePrint_nid_no_patch("[gpu] frame_%03d.bmp: %ux%u display read back on the GPU at %.1f s\n", index, slot.dumpWidth, slot.dumpHeight, std::chrono::duration<double>(std::chrono::steady_clock::now() - start).count());
         dumpWriter.Enqueue(index, width, height, 1, false, std::move(pixels));
     }
 
@@ -922,6 +948,7 @@ struct VulkanDevice::State {
                 destroyPool(device, pool, nullptr);
             }
             if (settlePool != VK_NULL_HANDLE) destroyPool(device, settlePool, nullptr);
+            Graphics::DestroyDeferredObjects(device);
             destroyDevice(device, nullptr);
         }
         if (instance != VK_NULL_HANDLE) {
@@ -1260,10 +1287,25 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         VkPhysicalDeviceProperties2 driverProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &driver};
         state->InstanceFunction<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(selected, &driverProperties);
         driverId = driver.driverID;
+        state->deferDestruction = driver.driverID == VK_DRIVER_ID_MOLTENVK && std::getenv("APS5_NO_DEFERRED_DESTRUCTION") == nullptr;
         state->driverInfo = std::string(driver.driverName) + " " + driver.driverInfo;
+        state->driverId = driver.driverID;
         state->individuallyFreeDescriptorSets = driver.driverID == VK_DRIVER_ID_MESA_LLVMPIPE;
         state->fusedExactArithmetic = driver.driverID == VK_DRIVER_ID_MOLTENVK;
+        state->tessellationPipelineCache = TessellationPipelineCacheUsable(driver.driverID);
         state->subgroupControlBarriers = SubgroupControlBarrierUsable(driver.driverID);
+        state->workgroupScopeFences = WorkgroupScopeFenceUsable(driver.driverID);
+    }
+    if (driverId == VK_DRIVER_ID_NVIDIA_PROPRIETARY && hasExtension(VK_NV_SHADER_SM_BUILTINS_EXTENSION_NAME)) {
+        VkPhysicalDeviceShaderSMBuiltinsPropertiesNV smBuiltins{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SHADER_SM_BUILTINS_PROPERTIES_NV};
+        VkPhysicalDeviceProperties2 smProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &smBuiltins};
+        state->InstanceFunction<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(selected, &smProperties);
+        const auto subgroup = state->subgroup.subgroupSize;
+        if (smBuiltins.shaderSMCount != 0u && smBuiltins.shaderWarpsPerSM != 0u && subgroup != 0u) {
+            const auto invocations = static_cast<std::uint64_t>(smBuiltins.shaderSMCount) * smBuiltins.shaderWarpsPerSM * subgroup;
+            const auto budgetDwords = (4ull << 30) / (invocations * 4ull);
+            if (budgetDwords < state->pixelFunctionStorageDwords) state->pixelFunctionStorageDwords = static_cast<std::uint32_t>(budgetDwords);
+        }
     }
     auto byteFeatures = QueryBdaByteFeatures(selected, state->InstanceFunction<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2"), availableExtensions);
     auto bdaFeatures = QueryBdaFeatures(selected, state->InstanceFunction<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2"), availableExtensions);
@@ -1499,7 +1541,8 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     // Guest memory is host memory: importing it lets address-based shaders use it in place instead of
     // copying every registered allocation per draw.
     if (hasExtension(VK_EXT_EXTERNAL_MEMORY_HOST_EXTENSION_NAME) && std::getenv("APS5_NO_HOST_IMPORT") == nullptr) {
-        VkPhysicalDeviceDriverProperties driverProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DRIVER_PROPERTIES};
+        VkPhysicalDeviceMaintenance3Properties maintenance3{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MAINTENANCE_3_PROPERTIES};
+        VkPhysicalDeviceDriverProperties driverProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DRIVER_PROPERTIES, &maintenance3};
         VkPhysicalDeviceExternalMemoryHostPropertiesEXT hostProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_EXTERNAL_MEMORY_HOST_PROPERTIES_EXT, &driverProperties};
         VkPhysicalDeviceProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &hostProperties};
         state->InstanceFunction<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(selected, &properties);
@@ -1511,6 +1554,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
 #endif
         state->drawInputsInPlace = std::getenv("APS5_NO_DRAW_INPUTS_IN_PLACE") == nullptr && (std::getenv("APS5_DRAW_INPUTS_IN_PLACE") != nullptr || DrawInputsInPlaceUsable(driverProperties.driverID, windows));
         if (!compileOnly) Graphics::SetHostImportWindow(8ull << 20u);
+        if (!compileOnly) Graphics::SetHostImportMaxBytes(maintenance3.maxMemoryAllocationSize);
 #ifdef _WIN32
         // Imported pages are locked; locking is bounded by the process working-set minimum.
         if (const char* value = std::getenv("APS5_WORKING_SET_MIB"); value != nullptr && !compileOnly) {
@@ -1656,7 +1700,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     queueInfo.queueFamilyIndex = family;
     queueInfo.queueCount = 1;
     queueInfo.pQueuePriorities = &priority;
-    const float priorities[2]{1.0f, 1.0f};
+    const float priorities[3]{1.0f, 1.0f, 1.0f};
 #ifdef _WIN32
     const bool settles = true;
 #else
@@ -1703,13 +1747,13 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     // Guest shaders routinely read past descriptor ranges; robust access turns that into zeros
     // instead of a GPU fault that loses the device.
     enabled.robustBufferAccess = available.robustBufferAccess;
-    const auto plan = PlanDeviceQueues(queues, family, settles, available.sparseBinding == VK_TRUE);
+    const auto plan = PlanDeviceQueues(queues, family, settles, available.sparseBinding == VK_TRUE, window != nullptr);
     const bool settleQueue = plan.settle;
     const auto settleFamily = plan.settleFamily;
     const auto settleIndex = plan.settleIndex;
     VkDeviceQueueCreateInfo queueInfos[3]{queueInfo, {VK_STRUCTURE_TYPE_DEVICE_QUEUE_CREATE_INFO}, {VK_STRUCTURE_TYPE_DEVICE_QUEUE_CREATE_INFO}};
     queueInfos[0].queueCount = plan.mainCount;
-    queueInfos[0].pQueuePriorities = plan.mainCount == 2 ? priorities : &priority;
+    queueInfos[0].pQueuePriorities = plan.mainCount > 1 ? priorities : &priority;
     deviceInfo.queueCreateInfoCount = 1;
     const auto addQueue = [&](std::uint32_t queueFamily, std::uint32_t index) {
         for (std::uint32_t info = 1; info < deviceInfo.queueCreateInfoCount; ++info) {
@@ -1750,6 +1794,8 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     enabled.depthBiasClamp = available.depthBiasClamp;
     state->depthBiasClamp = enabled.depthBiasClamp == VK_TRUE;
     enabled.dualSrcBlend = available.dualSrcBlend;
+    enabled.logicOp = available.logicOp;
+    state->logicOp = enabled.logicOp == VK_TRUE;
     state->dualSrcBlend = enabled.dualSrcBlend == VK_TRUE;
     enabled.occlusionQueryPrecise = available.occlusionQueryPrecise;
     state->occlusionQueryPrecise = enabled.occlusionQueryPrecise == VK_TRUE;
@@ -2008,6 +2054,29 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         deviceInfo.enabledExtensionCount = static_cast<std::uint32_t>(deviceExtensions.size());
         deviceInfo.ppEnabledExtensionNames = deviceExtensions.data();
     }
+    const bool diagnosticsRequested = std::getenv("APS5_NV_DIAGNOSTICS") != nullptr;
+    VkPhysicalDeviceDiagnosticsConfigFeaturesNV diagnosticsFeatures{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DIAGNOSTICS_CONFIG_FEATURES_NV};
+    if (diagnosticsRequested && hasExtension(VK_NV_DEVICE_DIAGNOSTICS_CONFIG_EXTENSION_NAME)) {
+        VkPhysicalDeviceFeatures2 features{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_FEATURES_2, &diagnosticsFeatures};
+        state->InstanceFunction<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2")(selected, &features);
+    }
+    const auto diagnostics = ChooseDeviceDiagnostics(diagnosticsRequested, diagnosticsFeatures.diagnosticsConfig == VK_TRUE, hasExtension(VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME));
+    VkDeviceDiagnosticsConfigCreateInfoNV diagnosticsConfig{VK_STRUCTURE_TYPE_DEVICE_DIAGNOSTICS_CONFIG_CREATE_INFO_NV};
+    if (diagnostics.config) {
+        diagnosticsFeatures = {VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DIAGNOSTICS_CONFIG_FEATURES_NV};
+        diagnosticsFeatures.diagnosticsConfig = VK_TRUE;
+        diagnosticsConfig.flags = diagnostics.flags;
+        deviceExtensions.push_back(VK_NV_DEVICE_DIAGNOSTICS_CONFIG_EXTENSION_NAME);
+        if (diagnostics.checkpoints && !checkpoints) deviceExtensions.push_back(VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME);
+        deviceInfo.enabledExtensionCount = static_cast<std::uint32_t>(deviceExtensions.size());
+        deviceInfo.ppEnabledExtensionNames = deviceExtensions.data();
+        diagnosticsConfig.pNext = byteFeatures.pNext;
+        diagnosticsFeatures.pNext = &diagnosticsConfig;
+        byteFeatures.pNext = &diagnosticsFeatures;
+        std::fprintf(stderr, "[gpu] APS5_NV_DIAGNOSTICS: VK_NV_device_diagnostics_config enabled (shader debug info, resource tracking, automatic checkpoints, shader error reporting)\n");
+    } else if (diagnosticsRequested) {
+        std::fprintf(stderr, "[gpu] APS5_NV_DIAGNOSTICS: the device does not support VK_NV_device_diagnostics_config\n");
+    }
     bdaFeatures.pNext = &byteFeatures;
     VkPhysicalDeviceRobustness2FeaturesEXT robustness2{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_ROBUSTNESS_2_FEATURES_EXT};
     if (hasExtension(VK_EXT_ROBUSTNESS_2_EXTENSION_NAME)) {
@@ -2031,6 +2100,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     check(state->InstanceFunction<PFN_vkCreateDevice>("vkCreateDevice")(selected, &deviceInfo, nullptr, &state->device), "vkCreateDevice");
     state->shaderProfile = std::move(shaderProfile);
     if (compileOnly) return;
+    if (state->deferDestruction) state->contextDeviceProc = Graphics::DeferDestructionToIdle(state->device, state->deviceProc);
     if (calibratedTimestamps != nullptr) {
         const bool khr = std::strcmp(calibratedTimestamps, VK_KHR_CALIBRATED_TIMESTAMPS_EXTENSION_NAME) == 0;
         const auto domains = reinterpret_cast<PFN_vkGetPhysicalDeviceCalibrateableTimeDomainsKHR>(state->instanceProc(state->instance, khr ? "vkGetPhysicalDeviceCalibrateableTimeDomainsKHR" : "vkGetPhysicalDeviceCalibrateableTimeDomainsEXT"));
@@ -2052,6 +2122,10 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     }
     state->DeviceFunction<PFN_vkGetDeviceQueue>("vkGetDeviceQueue")(state->device, family, 0, &state->queue);
     state->queueFamily = family;
+    if (plan.present) {
+        state->DeviceFunction<PFN_vkGetDeviceQueue>("vkGetDeviceQueue")(state->device, family, plan.presentIndex, &state->presentQueue);
+        APS5_LOG_OUT("Presentation queue family=%u index=%u", family, plan.presentIndex);
+    }
     if (settleQueue) {
         state->settleFamily = settleFamily;
         state->DeviceFunction<PFN_vkGetDeviceQueue>("vkGetDeviceQueue")(state->device, settleFamily, settleIndex, &state->settleQueue);
@@ -2142,7 +2216,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         require((surface.supportedUsageFlags & VK_IMAGE_USAGE_COLOR_ATTACHMENT_BIT) != 0, "surface does not support color attachment images");
         VkSwapchainCreateInfoKHR swapchain{VK_STRUCTURE_TYPE_SWAPCHAIN_CREATE_INFO_KHR};
         swapchain.surface = state->surface;
-        swapchain.minImageCount = surface.minImageCount;
+        swapchain.minImageCount = AgcDriver::SwapchainImageCount(surface);
         swapchain.imageFormat = state->surfaceFormat;
         swapchain.imageColorSpace = state->surfaceColorSpace;
         swapchain.imageExtent = state->extent;
@@ -2246,6 +2320,26 @@ bool VulkanDevice::ReplayComputePipeline(const ShaderRecompiler::RecompileResult
     return state->computePipelines.try_emplace(key, std::move(objects)).second;
 }
 
+bool VulkanDevice::HasComputePipeline(const ShaderRecompiler::RecompileResult& shader) const {
+    const std::array<Graphics::CompiledShader, 1> shaders{{{ShaderRecompiler::ShaderStage::Compute, &shader, 0}}};
+    const auto key = ComputePipelineKey::Of(shader, Graphics::PushConstantStages(shaders) != 0);
+    std::lock_guard pipelines(state->computePipelinesMutex);
+    return !key.identity.Empty() && (state->computePipelines.contains(key) || state->computePipelinesBuilding.contains(key));
+}
+
+void VulkanDevice::PrebuildComputePipeline(const ShaderRecompiler::RecompileResult& shader, std::uint64_t programAddress) {
+    if (shader.spirv.size() < 5 || shader.spirv[0] != 0x07230203u) return;
+    ShaderRecompiler::RuntimeAbi::RequireVersion(shader.runtimeAbiVersion);
+    const auto context = graphicsContext();
+    if (context.descriptorCache == nullptr) return;
+    const std::array<Graphics::CompiledShader, 1> shaders{{{ShaderRecompiler::ShaderStage::Compute, &shader, 0}}};
+    const auto pushStages = Graphics::PushConstantStages(shaders);
+    if (pushStages != 0 && state->properties.limits.maxPushConstantsSize < Graphics::ComputePushConstantBytes) return;
+    if (HasComputePipeline(shader)) return;
+    const auto layouts = Graphics::DescribeSetLayouts(context, shaders);
+    static_cast<void>(computePipeline(context, shader, layouts.layouts.main, layouts.mainKey, pushStages, programAddress));
+}
+
 bool VulkanDevice::ImportGuestMemory(const GuestAllocations::Mapped& ranges, std::uint64_t generation, bool adoptDevice) {
     if (adoptDevice) GuestMemory::AssertGpuLockHeld("VulkanDevice::ImportGuestMemory");
     return Graphics::ImportMappedRanges(graphicsContext(), ranges, generation, adoptDevice);
@@ -2274,6 +2368,7 @@ void VulkanDevice::PrepareForReplacement() {
 
 void VulkanDevice::WaitIdle() {
     APS5_LOG_CHARS_OUT_DEBUG("VulkanDevice::WaitIdle begin");
+    static_cast<void>(Graphics::StorageTexture::StoreDrawnLinear("wait idle"));
     RetirePresents(0);
     if (state->recorder) {
         // Announced with this call's return address: the [recorder] site table then names the
@@ -2281,7 +2376,10 @@ void VulkanDevice::WaitIdle() {
         if (!state->recorder->Idle()) Graphics::Recorder::CountSync(0, __builtin_return_address(0));
         state->recorder->Sync();
     }
+    std::unique_lock presentQueueLock(state->presentQueueMutex, std::defer_lock);
+    if (state->presentQueue != VK_NULL_HANDLE) presentQueueLock.lock();
     check(state->DeviceFunction<PFN_vkDeviceWaitIdle>("vkDeviceWaitIdle")(state->device), "vkDeviceWaitIdle");
+    Graphics::CheckPixelFunctionLds(graphicsContext());
     APS5_LOG_CHARS_OUT_DEBUG("VulkanDevice::WaitIdle complete");
 }
 
@@ -2328,6 +2426,14 @@ void VulkanDevice::WaitRecorded(std::uint64_t serial) {
     if (state->recorder) state->recorder->WaitSerial(serial);
 }
 
+std::uint64_t VulkanDevice::SubmittedEpoch() const {
+    return state->recorder ? state->recorder->NewestSubmitted() : 0;
+}
+
+bool VulkanDevice::WaitRecordedFor(std::uint64_t serial, std::uint64_t timeoutNanos) {
+    return state->recorder && state->recorder->WaitSerialFor(serial, timeoutNanos);
+}
+
 void VulkanDevice::ReapRecorded(std::uint64_t serial) {
     if (!state->recorder) return;
     // The drain's site in the [recorder] table is this call's caller (Driver::execute's drain,
@@ -2369,6 +2475,7 @@ bool VulkanDevice::StoresPendingOver(std::uint64_t address, std::size_t bytes) c
 int VulkanDevice::WriteLabelOnGpu(std::uint64_t address, std::span<const std::byte> bytes, std::uint64_t stamp, std::uint32_t queue, bool reapFirst) {
     static const bool storeAtLabel = Graphics::StorageTexture::StoreAtLabelRequested(std::getenv("APS5_STORE_AT_LABEL"));
     if (storeAtLabel) Graphics::StorageTexture::FlushAllPending("label");
+    if (queue == 0) static_cast<void>(Graphics::StorageTexture::StoreDrawnLinear("label"));
     Graphics::StorageTexture::StoreReadbackBeforeLabel("readback before label");
     if (!state->recorder || bytes.empty() || bytes.size() > 65536 || address % 4 != 0 || bytes.size() % 4 != 0) return 4;
     auto& recorder = *state->recorder;
@@ -2395,10 +2502,37 @@ int VulkanDevice::WriteLabelOnGpu(std::uint64_t address, std::span<const std::by
     // stores of a run against each other and against the work before and after, the queued DCC
     // key stores included).
     const auto recordStore = [&] { recorder.RecordStore(import->buffer, Graphics::HostImportOffset(*import, address), bytes, address); };
-    // Only a write-back that can land over these bytes (a listed copied writer of the range, as
-    // FillBuffer tests) puts the label behind the completions; any other pending completion
-    // stores elsewhere. Debug aid: APS5_LABEL_GATE_ALL=1 gates on any completion, as before (a
-    // completion label there registered its own completion, so every later label followed).
+    // On the console every store a queue made before a label is in memory once the label is
+    // visible. A listed copied writer (a dispatch or draw whose written buffer the device holds as a
+    // CPU copy) is written back by the CPU when its batch is reaped, after the GPU already ran any
+    // store recorded here, so a title polling the label could rewrite the written region and have
+    // the late write-back land over its bytes (a title that rebuilds its command buffer there sees
+    // a stale packet). While one is listed, a label of 8 bytes or less (every RELEASE_MEM, the fence
+    // WRITE_DATAs) is therefore not recorded on the GPU at all: a completion action of the open (or
+    // newest in-flight) batch stores it when that batch is reaped. Completions run in push order and
+    // batches finish front-first, so it lands after every earlier write-back, whatever range that
+    // one wrote. The GPU store plus completion re-store below would not do: its GPU store is
+    // visible before the write-back, and its re-store runs only over a write-back that overlapped
+    // the label. While such a completion store is pending (PendingCompletionStores: no end-of-pipe
+    // delivery and no write-back counts there), later small labels follow it even after every
+    // writer was written back, or a GPU store would become visible before the earlier completion
+    // store lands (#1458), or land under it at the reap when both are at one address. Larger stores
+    // (DUMP_CONST_RAM, COPY_DATA and DMA_DATA payloads that later GPU work reads through the import)
+    // stay on the GPU and follow only a pending completion store over their own range. Readers of a
+    // range stored this way sync through its batch first (the label is a pending write of its batch
+    // and counted in PendingCompletionLabels). Debug aid: APS5_DRAIN_COMPLETION_LABELS=1 drains
+    // (reason 2) instead and stores the label on the CPU.
+    const bool listed = !state->copiedWriters->empty() || !Graphics::DrawCopiedWriters()->empty();
+    if (drain) {
+        if (listed) return 2;
+    } else if (const bool storesPending = Graphics::Recorder::PendingCompletionStores() != 0; bytes.size() <= 8 ? (listed || storesPending) : (storesPending && recorder.CompletionLabelIn(address, bytes.size()))) {
+        recorder.AfterCompletions(address, bytes, stamp, queue, false);
+        return 5;
+    }
+    // A larger store over a listed copied writer's range (as FillBuffer tests it) goes behind the
+    // completions too, below; any other one stores on the GPU. Debug aid: APS5_LABEL_GATE_ALL=1
+    // gates on any completion, as before (a completion label there registered its own completion,
+    // so every later label followed).
     static const bool gateAll = std::getenv("APS5_LABEL_GATE_ALL") != nullptr;
     if (gateAll ? recorder.HasCompletions() : state->CopiedWriterOverlaps(address, bytes.size())) {
         // A copied buffer's write-back is still to run: the store must land after it. It is stored
@@ -2957,7 +3091,7 @@ void VulkanDevice::recreateSwapchain(std::uint32_t width, std::uint32_t height,
     require((surface.supportedUsageFlags & VK_IMAGE_USAGE_TRANSFER_DST_BIT) != 0 && (surface.supportedCompositeAlpha & VK_COMPOSITE_ALPHA_OPAQUE_BIT_KHR) != 0 && (surface.supportedTransforms & VK_SURFACE_TRANSFORM_IDENTITY_BIT_KHR) != 0, "resized surface capabilities are unsupported");
     VkSwapchainCreateInfoKHR create{VK_STRUCTURE_TYPE_SWAPCHAIN_CREATE_INFO_KHR};
     create.surface = state->surface;
-    create.minImageCount = surface.minImageCount;
+    create.minImageCount = AgcDriver::SwapchainImageCount(surface);
     create.imageFormat = state->surfaceFormat;
     create.imageColorSpace = state->surfaceColorSpace;
     create.imageExtent = {width, height};
@@ -3229,6 +3363,15 @@ FrameDumps& Dumps() {
 }
 
 bool VulkanDevice::PresentDisplayBuffer(const DisplayBuffer& buffer) {
+    if (buffer.dccAddress != 0 && buffer.tilingMode == 0) {
+        static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+        const auto before = profile ? Graphics::Recorder::ThreadWaitedMs() : 0.0;
+        state->recorder->SyncThrough(buffer.dccAddress, DisplayBufferKeyBytes(buffer), true);
+        if (const auto waited = profile ? Graphics::Recorder::ThreadWaitedMs() - before : 0.0; waited > 0.0) {
+            ++presentCounters.keyWriterWaits;
+            presentCounters.keyWriterWaitMs += waited;
+        }
+    }
     static const bool storeAtFlip = Graphics::StorageTexture::StoreAtFlipRequested(std::getenv("APS5_STORE_AT_FLIP"));
     if (storeAtFlip) Graphics::StorageTexture::FlushAllPending("flip");
     else Graphics::StorageTexture::FlushDumpSelected("flip");
@@ -3650,6 +3793,7 @@ double VulkanDevice::RetirePresents(std::size_t keepInFlight) {
     const auto status = state->DeviceFunction<PFN_vkGetFenceStatus>("vkGetFenceStatus");
     auto inFlight = static_cast<std::size_t>(std::count_if(slots.begin(), slots.end(), [](const auto& slot) { return slot.inFlight; }));
     double waitedMs = 0;
+    bool retired = false;
     // Oldest first from the cursor; the fences of one queue signal in submission order, so the
     // first unsignaled one ends the scan, and the ones beyond the bound are the oldest.
     for (std::size_t i = 0; i < slots.size() && inFlight != 0; ++i) {
@@ -3668,9 +3812,11 @@ double VulkanDevice::RetirePresents(std::size_t keepInFlight) {
         }
         const bool dump = slot.dumpRecorded;
         state->RetireSlot(slot);
+        retired = true;
         if (dump) timing.Mark("dump");
         --inFlight;
     }
+    if (retired) Graphics::CheckPixelFunctionLds(graphicsContext());
     return waitedMs;
 }
 
@@ -3690,13 +3836,19 @@ void VulkanDevice::QueuePresent() {
     present.swapchainCount = 1;
     present.pSwapchains = &state->swapchain;
     present.pImageIndices = &index;
-    const auto presented = state->DeviceFunction<PFN_vkQueuePresentKHR>("vkQueuePresentKHR")(state->queue, &present);
+    std::unique_lock presentQueueLock(state->presentQueueMutex, std::defer_lock);
+    if (state->presentQueue != VK_NULL_HANDLE) presentQueueLock.lock();
+    const auto presented = state->DeviceFunction<PFN_vkQueuePresentKHR>("vkQueuePresentKHR")(state->presentQueue != VK_NULL_HANDLE ? state->presentQueue : state->queue, &present);
     if (presented == VK_ERROR_OUT_OF_DATE_KHR || presented == VK_SUBOPTIMAL_KHR) state->extent = {0, 0};
     else check(presented, "vkQueuePresentKHR");
     timing.Mark("queue_present");
     APS5_LOG_OUT_DEBUG("vkQueuePresentKHR queued imageIndex=%u", index);
 }
 
+bool VulkanDevice::PresentsOnOwnQueue() const {
+    return state->presentQueue != VK_NULL_HANDLE;
+}
+
 ShaderRecompiler::SpirvTarget VulkanDevice::ComputeTarget(std::uint32_t waveSize) const {
     auto target = Target();
     if (waveSize == 32u && state->computeWave32) target.subgroupSize = 32u;
@@ -3777,6 +3929,9 @@ ShaderRecompiler::SpirvTarget VulkanDevice::buildTarget() const {
     target.registrationModules = state->graphicsPipelineLibrary;
     target.robustBufferAccess2 = state->robustBufferAccess2;
     target.waveLdsMemoryBarriers = !state->subgroupControlBarriers;
+    target.largePixelFunctionLdsBuffer = state->driverId == VK_DRIVER_ID_NVIDIA_PROPRIETARY;
+    target.pixelFunctionStorageDwords = state->pixelFunctionStorageDwords;
+    target.deviceScopeLdsMemoryBarriers = !state->workgroupScopeFences;
     target.srgbDecodeFormats = state->srgbDecodeFormats & ~state->srgbCopyFormats;
     target.vertexSubgroups = (state->subgroup.supportedStages & VK_SHADER_STAGE_VERTEX_BIT) != 0;
     if (state->meshShader) {
@@ -3837,7 +3992,7 @@ Graphics::Context VulkanDevice::buildContext() const {
         state->physical,
         state->queue,
         state->pool,
-        state->deviceProc,
+        state->contextDeviceProc != nullptr ? state->contextDeviceProc : state->deviceProc,
         state->InstanceFunction<PFN_vkGetPhysicalDeviceFormatProperties>("vkGetPhysicalDeviceFormatProperties"),
         state->InstanceFunction<PFN_vkGetPhysicalDeviceImageFormatProperties>("vkGetPhysicalDeviceImageFormatProperties"),
         state->memoryProperties,
@@ -3862,6 +4017,7 @@ Graphics::Context VulkanDevice::buildContext() const {
     };
     context.pipelineCacheSynchronization = state->pipelineCache ? &state->pipelineCache->Synchronization() : nullptr;
     context.individuallyFreeDescriptorSets = state->individuallyFreeDescriptorSets;
+    context.tessellationPipelineCache = state->tessellationPipelineCache;
     context.dmaBufImport = state->dmaBufImport;
     context.sparseBinding = state->sparseBinding;
     context.sparseResidencyBuffer = state->sparseResidencyBuffer;
@@ -3881,6 +4037,7 @@ Graphics::Context VulkanDevice::buildContext() const {
     context.drawIndirectFirstInstance = state->drawIndirectFirstInstance;
     context.multiDrawIndirect = state->multiDrawIndirect;
     context.dualSrcBlend = state->dualSrcBlend;
+    context.logicOp = state->logicOp;
     context.depthBounds = state->depthBounds;
     context.depthBiasClamp = state->depthBiasClamp;
     context.samplerFilterMinmax = state->samplerFilterMinmax;
@@ -3952,10 +4109,6 @@ std::optional<std::string> VulkanDevice::KnownDrawRejection(const Graphics::Stat
     return Graphics::KnownValidationFailure(graphicsContext(), shaders, graphics);
 }
 
-void VulkanDevice::DepthCopyPass(const Graphics::DepthCopyPass& pass) {
-    Graphics::RunDepthCopyPass(graphicsContext(), pass);
-}
-
 void VulkanDevice::ColorMetadataPass(const Graphics::ColorMetadataPass& pass) {
     Graphics::RunColorMetadataPass(graphicsContext(), pass);
 }
@@ -3998,7 +4151,7 @@ bool VulkanDevice::PrebuildGraphicsLibraries(const Graphics::ShaderStages& stage
     return Graphics::Pipeline::Prebuild(context, state, Graphics::VertexInputLayout{}, layouts.View(), group);
 }
 
-void VulkanDevice::Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipe) {
+void VulkanDevice::Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipe, const DrawTraceContext* trace) {
     startJournalReplay();
     for (const auto& shader : shaders) {
         require(shader.program != nullptr, "missing compiled shader");
@@ -4006,11 +4159,11 @@ void VulkanDevice::Draw(const Graphics::State& graphics, const Pm4::DrawParamete
     }
     // Two stdout lines per draw cost ~1.3 ms per frame of the queue-0 worker (part of it under the
     // GPU mutex); APS5_TRACE_DRAWS=1 restores them.
-    static const bool trace = std::getenv("APS5_TRACE_DRAWS") != nullptr;
-    if (trace) APS5_LOG_OUT("VulkanDevice::Draw indices=%u instances=%u indexSize=%u address=0x%llx shaders=%zu colorTarget=%u", draw.indexCount, draw.instanceCount, draw.indexSize, static_cast<unsigned long long>(draw.indexAddress), shaders.size(), static_cast<unsigned>(graphics.hasColorTarget));
+    static const bool traceDraws = std::getenv("APS5_TRACE_DRAWS") != nullptr;
+    if (traceDraws) APS5_LOG_OUT("VulkanDevice::Draw indices=%u instances=%u indexSize=%u address=0x%llx shaders=%zu colorTarget=%u", draw.indexCount, draw.instanceCount, draw.indexSize, static_cast<unsigned long long>(draw.indexAddress), shaders.size(), static_cast<unsigned>(graphics.hasColorTarget));
     const auto context = graphicsContext();
-    Graphics::Draw(context, graphics, draw, shaders, snapshots, recipe);
-    if (trace) APS5_LOG_CHARS_OUT("VulkanDevice::Draw complete");
+    Graphics::Draw(context, graphics, draw, shaders, snapshots, recipe, trace);
+    if (traceDraws) APS5_LOG_CHARS_OUT("VulkanDevice::Draw complete");
 }
 
 bool VulkanDevice::DrawInputsInPlace() const {
@@ -4242,7 +4395,7 @@ struct DispatchCounters {
     std::array<double, DispatchRows> phaseTotals{};
     std::uint64_t profiledDispatches = 0;
     IndirectHold indirectHold;
-    std::uint64_t cacheHits = 0, cacheMisses = 0, cacheInvalidated = 0, templateRefreshed = 0, templateSameWords = 0;
+    std::uint64_t cacheHits = 0, cacheMisses = 0, cacheInvalidated = 0, templateRefreshed = 0, templateSameWords = 0, templateByNumber = 0;
     double templateRevalidateMs = 0;
     std::uint64_t procLookups = 0, preBarriersRecorded = 0, preBarriersSkipped = 0;
     std::chrono::steady_clock::time_point cacheReport = std::chrono::steady_clock::now();
@@ -4499,6 +4652,24 @@ struct RecordedDispatch {
     std::array<std::uint32_t, 3> threadLimit{};
 };
 
+struct DispatchCompletion {
+    const Graphics::Context& context;
+    const std::array<Graphics::CompiledShader, 1>& shaders;
+    VkShaderStageFlags pushStages;
+    const std::array<std::byte, Graphics::PipelinePushConstantBytes>& pushBytes;
+    const std::shared_ptr<ComputePipelineObjects>& objects;
+    const std::shared_ptr<Graphics::ShaderResources>& resources;
+    const ResourceCache::Key& contentKey;
+    bool cacheable;
+    bool fromCache;
+    double revalidateMs;
+    const std::shared_ptr<Graphics::ShaderResources::DrawBindings>& overlay;
+    std::uint64_t lookupsBefore;
+    DispatchTimer& timer;
+    PerformanceTimer& timing;
+    char* groupsText;
+};
+
 VkDevice VulkanDevice::Device() const {
     return state->device;
 }
@@ -4541,7 +4712,7 @@ void VulkanDevice::NoteDrawRecipeMiss(DrawRecipePrecheck miss) {
     counters.precheckMisses[miss == DrawRecipePrecheck::NoRecipe ? MissNoRecipe : MissDevice].fetch_add(1, std::memory_order_relaxed);
 }
 
-RecipeOutcome VulkanDevice::DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe) {
+RecipeOutcome VulkanDevice::DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const DrawTraceContext* trace) {
     PerformanceTimer timing("Vulkan.DrawFromRecipe");
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     auto& counters = Recipes().kinds[static_cast<std::size_t>(RecipeKind::Draw)];
@@ -4552,7 +4723,7 @@ RecipeOutcome VulkanDevice::DrawFromRecipe(const Graphics::State& graphics, cons
         return RecipeOutcome::Rebuild;
     }
     const auto context = graphicsContext();
-    const auto outcome = Graphics::DrawWithRecipe(context, graphics, draw, shaders, snapshots, *recipe);
+    const auto outcome = Graphics::DrawWithRecipe(context, graphics, draw, shaders, snapshots, *recipe, trace);
     if (!outcome.recorded) {
         switch (outcome.miss) {
             case Graphics::DrawRecipeMiss::NotRecordable: counters.precheckMisses[MissNotRecordable].fetch_add(1, std::memory_order_relaxed); break;
@@ -4867,6 +5038,7 @@ void VulkanDevice::recordDispatch(RecordedDispatch& record) {
     };
     if (recorder.HasQueuedKeyStores() && (resources.HoldsLease() || recorder.AnyQueuedKeyStore(touches))) recorder.FlushKeyStores();
     if (recorder.HasQueuedStores() && (resources.HoldsLease() || recorder.AnyQueuedStore(touches))) recorder.FlushStores();
+    static_cast<void>(Graphics::StorageTexture::StoreDrawnLinearTouching("dispatch access", touches, resources.HoldsLease()));
     VkAccessFlags covered = 0;
     const auto commands = recorder.Commands(&covered);
     recordStep(PhaseRecordCommands);
@@ -4885,6 +5057,7 @@ void VulkanDevice::recordDispatch(RecordedDispatch& record) {
         // after an earlier dispatch's reads of the buffers by that dispatch's trailing barrier. A
         // recipe compares the two 64-bit hashes first: equal hashes mean the buffers hold the words.
         const bool differs = record.dataRefresh == RecordedDispatch::DataRefresh::Words || resources.DataWordsHash() != record.dataWordsHash;
+        if (timer.profile && record.shader->program != nullptr && record.shader->program->bindings.size() != resources.BindingCount()) ++d.templateByNumber;
         if (differs && (record.resourceKeyMatched ? resources.refreshData(commands, *record.shader, &recorder) : resources.RefreshData(commands, *record.shader, &recorder))) {
             covered = 0;
             ++d.templateRefreshed;
@@ -5072,7 +5245,7 @@ std::shared_ptr<ComputePipelineObjects> VulkanDevice::createComputePipeline(cons
     const Graphics::PipelineSpecialization specialization(shader);
     const auto subgroupSize = computeSubgroupSize(shader);
     const auto stageFlags = computeStageFlags(shader);
-    if (const char* directory = std::getenv("APS5_DUMP_COMPUTE_PIPELINES"); directory != nullptr && *directory != '\0' && ComputePipelineCapture::OptionalEnabled() && CaptureComputePipeline(shader.spirv.size())) {
+    if (const auto* directory = ComputePipelineDumpDirectory(); directory != nullptr && *directory != 0 && !state->probingFloatControls && ComputePipelineCapture::OptionalEnabled() && CaptureComputePipeline(shader.spirv.size())) {
         ComputePipelineCapture capture;
         capture.spirv = shader.spirv.Copy();
         ComputeDescriptorSetLayout resourcesLayout;
@@ -5398,7 +5571,7 @@ VulkanDevice::IndirectOutcome VulkanDevice::dispatch(const ShaderRecompiler::Rec
     }
     if (profile && std::chrono::steady_clock::now() - d.cacheReport > std::chrono::seconds(10)) {
         d.cacheReport = std::chrono::steady_clock::now();
-        AgcDriver::ProfilePrint_nid_no_patch("[rescache] (cumulative): %llu hits, %llu misses, %llu invalidated, %zu entries (dispatch + draw); template hits: %llu refreshed the data buffers (revalidate %.1f ms), %llu had the same words; Find calls %llu, Touch calls %llu\n", static_cast<unsigned long long>(d.cacheHits), static_cast<unsigned long long>(d.cacheMisses), static_cast<unsigned long long>(d.cacheInvalidated), state->resourceCache.Size(), static_cast<unsigned long long>(d.templateRefreshed), d.templateRevalidateMs, static_cast<unsigned long long>(d.templateSameWords), static_cast<unsigned long long>(ResourceCache::Finds()), static_cast<unsigned long long>(ResourceCache::Touches()));
+        AgcDriver::ProfilePrint_nid_no_patch("[rescache] (cumulative): %llu hits, %llu misses, %llu invalidated, %zu entries (dispatch + draw); template hits: %llu refreshed the data buffers (revalidate %.1f ms), %llu had the same words, %llu paired their data bindings by number (no image table binding of their own); Find calls %llu, Touch calls %llu\n", static_cast<unsigned long long>(d.cacheHits), static_cast<unsigned long long>(d.cacheMisses), static_cast<unsigned long long>(d.cacheInvalidated), state->resourceCache.Size(), static_cast<unsigned long long>(d.templateRefreshed), d.templateRevalidateMs, static_cast<unsigned long long>(d.templateSameWords), static_cast<unsigned long long>(d.templateByNumber), static_cast<unsigned long long>(ResourceCache::Finds()), static_cast<unsigned long long>(ResourceCache::Touches()));
         AgcDriver::ProfilePrint_nid_no_patch("[vk] deviceProc lookups inside the device call (cumulative): %llu (%.2f per dispatch); pre-dispatch barriers recorded %llu, skipped %llu; compute pipelines created %llu (%llu under the GPU mutex)\n", static_cast<unsigned long long>(d.procLookups), d.profiledDispatches != 0 ? static_cast<double>(d.procLookups) / static_cast<double>(d.profiledDispatches) : 0.0, static_cast<unsigned long long>(d.preBarriersRecorded), static_cast<unsigned long long>(d.preBarriersSkipped), static_cast<unsigned long long>(computePipelinesCreated.load(std::memory_order_relaxed)), static_cast<unsigned long long>(computePipelinesCreatedLocked.load(std::memory_order_relaxed)));
         reportRecipes();
         reportDispatchMove();
@@ -5417,6 +5590,27 @@ VulkanDevice::IndirectOutcome VulkanDevice::dispatch(const ShaderRecompiler::Rec
         timing.Mark("pipeline_create");
         timer.phase(PhasePipeline);
     }
+    DispatchCompletion completion{context, shaders, pushStages, pushBytes, objects, resources, contentKey, cacheable, fromCache, revalidateMs, overlay, lookupsBefore, timer, timing, groupsText};
+    return recordCompletedDispatch(shader, x, y, z, arguments, programAddress, recipeOut, threadGroup, htileClear, completion);
+}
+
+VulkanDevice::IndirectOutcome VulkanDevice::recordCompletedDispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::uint64_t programAddress, std::shared_ptr<const Recipe>* recipeOut, const std::array<std::uint32_t, 3>& threadGroup, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear, DispatchCompletion& completion) {
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    const auto& context = completion.context;
+    const auto& shaders = completion.shaders;
+    const auto pushStages = completion.pushStages;
+    const auto& pushBytes = completion.pushBytes;
+    const auto& objects = completion.objects;
+    const auto& resources = completion.resources;
+    const auto& contentKey = completion.contentKey;
+    const bool cacheable = completion.cacheable;
+    const bool fromCache = completion.fromCache;
+    const double revalidateMs = completion.revalidateMs;
+    const auto& overlay = completion.overlay;
+    const auto lookupsBefore = completion.lookupsBefore;
+    auto& timer = completion.timer;
+    auto& timing = completion.timing;
+    auto* groupsText = completion.groupsText;
     // Recorded into the device's open batch: the CPU moves on to the next command while the GPU
     // works; the batch is waited for where the guest expects results (labels, flips, CPU reads).
     auto& recorder = *state->recorder;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp
index f95ac3a62f..3bdac581be 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp
@@ -163,18 +163,29 @@ struct Sampler {
         return frame;
     }
 
+    static void writeModules(std::FILE* file, const std::map<std::uint64_t, std::string>& loaded) {
+        for (const auto& [base, name] : loaded) {
+            const auto* dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
+            const auto* nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(base + dos->e_lfanew);
+            std::fprintf(file, "# module %s 0x%lx 0x%lx\n", name.c_str(), static_cast<unsigned long>(nt->OptionalHeader.SizeOfImage), static_cast<unsigned long>(nt->FileHeader.TimeDateStamp));
+        }
+    }
+
     void write() {
         std::lock_guard lock(mutex);
         std::FILE* file = std::fopen(path.c_str(), "w");
         if (file == nullptr) return;
         std::fprintf(file, "# %llu samples\n", static_cast<unsigned long long>(samples));
+        std::map<std::uint64_t, std::string> loaded;
         for (const auto& [address, count] : counts) {
             HMODULE module = nullptr;
             char name[MAX_PATH] = "?";
             if (GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, reinterpret_cast<LPCSTR>(address), &module)) GetModuleFileNameA(module, name, sizeof(name));
             const char* base = std::strrchr(name, '\\');
+            if (module != nullptr) loaded.emplace(reinterpret_cast<std::uint64_t>(module), base ? base + 1 : name);
             std::fprintf(file, "%s 0x%llx %llu %llu\n", base ? base + 1 : name, static_cast<unsigned long long>(address - reinterpret_cast<std::uint64_t>(module)), static_cast<unsigned long long>(count.first), static_cast<unsigned long long>(count.second));
         }
+        writeModules(file, loaded);
         std::fclose(file);
         if (keepStacks) writeStacks();
     }
@@ -195,11 +206,7 @@ struct Sampler {
         const double tickUs = 1e6 / static_cast<double>(frequency.QuadPart);
         std::fprintf(file, "# samples=%llu depth=%d truncated=%llu suspended_us_mean=%.1f suspended_us_max=%.1f\n", static_cast<unsigned long long>(samples), depth, static_cast<unsigned long long>(stacks.Truncated()),
             samples != 0 ? static_cast<double>(suspendedTicks) * tickUs / static_cast<double>(samples) : 0.0, static_cast<double>(longestSuspendedTicks) * tickUs);
-        for (const auto& [base, name] : loaded) {
-            const auto* dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
-            const auto* nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(base + dos->e_lfanew);
-            std::fprintf(file, "# module %s 0x%lx 0x%lx\n", name.c_str(), static_cast<unsigned long>(nt->OptionalHeader.SizeOfImage), static_cast<unsigned long>(nt->FileHeader.TimeDateStamp));
-        }
+        writeModules(file, loaded);
         const auto text = stacks.Format([&](std::uint64_t address) { return names.at(address); });
         const bool written = std::fwrite(text.data(), 1, text.size(), file) == text.size();
         if (std::fclose(file) != 0 || !written) return;
@@ -246,6 +253,7 @@ struct ProcessSampler {
         std::FILE* file = std::fopen(path.c_str(), "w");
         if (file == nullptr) return;
         std::fprintf(file, "# %llu rounds\n", static_cast<unsigned long long>(rounds));
+        std::map<std::uint64_t, std::string> loaded;
         for (auto& [id, thread] : threads) {
             std::lock_guard lock(thread.mutex);
             std::vector<std::pair<std::uint64_t, std::pair<std::uint64_t, std::uint64_t>>> hot(thread.counts.begin(), thread.counts.end());
@@ -260,9 +268,11 @@ struct ProcessSampler {
                 char name[MAX_PATH] = "?";
                 if (GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, reinterpret_cast<LPCSTR>(address), &module)) GetModuleFileNameA(module, name, sizeof(name));
                 const char* base = std::strrchr(name, '\\');
+                if (module != nullptr) loaded.emplace(reinterpret_cast<std::uint64_t>(module), base ? base + 1 : name);
                 std::fprintf(file, "  %s 0x%llx %llu %llu\n", base ? base + 1 : name, static_cast<unsigned long long>(address - reinterpret_cast<std::uint64_t>(module)), static_cast<unsigned long long>(hot[i].second.first), static_cast<unsigned long long>(hot[i].second.second));
             }
         }
+        Sampler::writeModules(file, loaded);
         std::fclose(file);
     }
 };
diff --git a/core/libs/prx/libSceAgcDriver/Export.cpp b/core/libs/prx/libSceAgcDriver/Export.cpp
index 18cd1da5d8..fd98ebbdb5 100644
--- a/core/libs/prx/libSceAgcDriver/Export.cpp
+++ b/core/libs/prx/libSceAgcDriver/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp
index 5dcf54c727..01a9c04191 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp
@@ -66,13 +66,14 @@ public:
     // The size a buffer for `bytes` is created with: its size class, or `bytes` itself when large.
     static std::size_t Capacity(std::size_t bytes, VkMemoryPropertyFlags properties);
     static VkBufferUsageFlags Usage(VkBufferUsageFlags usage, VkMemoryPropertyFlags properties);
-    VkDeviceMemory AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr);
+    VkDeviceMemory AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr, bool newImage = false);
     static VkDeviceSize ImageBudget(VkDeviceSize deviceBudget);
-    VkDeviceMemory TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr);
+    VkDeviceMemory TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr, bool newImage = false);
     void PutImageMemory(VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept;
     std::size_t RetainedImages();
     std::optional<BufferAllocation> Take(std::size_t bytes, VkBufferUsageFlags usage, VkMemoryPropertyFlags properties = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT);
     void Put(const BufferAllocation& allocation) noexcept;
+    VkDeviceSize ReclaimIdleDevice(VkDeviceSize bytes, std::chrono::steady_clock::time_point now);
     static bool SlabEligible(std::size_t capacity, VkDeviceSize alignment, VkDeviceSize size, VkDeviceSize atom);
     static VkDeviceSize SlabBlockBytes(std::size_t capacity);
     SlabSlot TakeSlot(const Context& context, std::uint32_t memoryType, std::size_t capacity, bool addressable);
@@ -143,7 +144,7 @@ private:
     // The retained-slot bound of each tier (APS5_BUFFER_POOL_SLOTS, default `defaultSlots`), read once.
     static std::size_t MaxSlots();
     std::size_t maxSlots;
-    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes);
+    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes, bool newImage);
     VkDevice device;
     PFN_vkUnmapMemory unmap;
     PFN_vkDestroyBuffer destroyBuffer;
@@ -168,6 +169,10 @@ private:
     std::uint64_t imageEvictions = 0;
     std::list<Slot*> imageOrder;
     std::uint64_t clock = 0;
+    std::optional<std::chrono::steady_clock::time_point> idleRead;
+    std::uint64_t idleClock = 0;
+    std::uint64_t reclaimBefore = 0;
+    std::uint64_t scannedIdleClock = 0;
     AgcDriver::Mutex slabMutex;
     std::unordered_map<std::uint64_t, Slab> slabs;
     std::unordered_map<VkDeviceMemory, std::unique_ptr<SlabBlock>> slabBlocks;
@@ -182,7 +187,7 @@ private:
 };
 
 std::shared_ptr<BufferPool> GetBufferPool(const Context& context);
-VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType = nullptr);
+VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType = nullptr, bool newImage = false);
 void ReleaseImageMemory(const Context& context, VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept;
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp
index 4019bd9ff5..dc2e00475a 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp
@@ -194,7 +194,7 @@ struct Context {
     std::uint32_t settleFamily = 0;
     std::mutex* settleQueueMutex = nullptr;
     PFN_vkGetPhysicalDeviceMemoryProperties2 memoryProperties2 = nullptr;
-    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes) = nullptr;
+    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes, bool newImage) = nullptr;
     RenderCache* renderCache = nullptr;
     DrawQueue* drawQueue = nullptr;
     GraphicsPipelineCache* graphicsPipelines = nullptr;
@@ -213,6 +213,7 @@ struct Context {
     bool depthBounds = false;
     bool depthBiasClamp = false;
     bool dualSrcBlend = false;
+    bool logicOp = false;
     bool samplerFilterMinmax = false;
     bool nonSeamlessCubeMap = false;
     VkSampleCountFlags mergedCoverageSampleCounts = 0;
@@ -239,6 +240,7 @@ struct Context {
     std::uint32_t imageTableCapacity = 0;
     std::uint32_t samplerTableCapacity = 0;
     bool individuallyFreeDescriptorSets = false;
+    bool tessellationPipelineCache = true;
     bool imageTableUpdateAfterBind = false;
     bool samplerTableUpdateAfterBind = false;
     bool geometryShader = false;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp
new file mode 100644
index 0000000000..70fb764122
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp
@@ -0,0 +1,17 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_DEFERREDDESTRUCTION_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_DEFERREDDESTRUCTION_HPP
+
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+#include <chrono>
+#include <cstddef>
+
+namespace AgcDriver::Graphics {
+
+PFN_vkGetDeviceProcAddr DeferDestructionToIdle(VkDevice device, PFN_vkGetDeviceProcAddr resolver);
+void DestroyDeferredAtIdle(const Context& context, std::chrono::steady_clock::time_point now = std::chrono::steady_clock::now());
+void DestroyDeferredObjects(VkDevice device) noexcept;
+std::size_t DeferredObjects(VkDevice device);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp
index 835b80f59b..ef9852b1e0 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp
@@ -72,11 +72,22 @@ VkImageAspectFlags HtileFillClears(std::uint32_t pattern, bool stencilInHtile);
 std::uint64_t HtileMetadataBytes(VkExtent2D extent);
 bool HtileFillCovers(std::uint64_t htile, VkExtent2D extent, std::uint64_t address, std::size_t bytes);
 std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D);
+std::size_t DepthPlaneCopyCount();
 VkFormat HostDepthFormat(const Context& context, VkFormat format);
 float HostDepthBiasConstant(const Context& context, VkFormat format, float constant);
 std::shared_ptr<StorageTexture> DepthSurfaceStorage(const Context& context, std::span<const std::uint32_t> words, const GuestTextureResource& resource, std::uint32_t mip);
 bool DepthSurfaceStoreBack(const Context& context, const StorageTexture& storage);
-void CopyDepthSample(const Context& context, std::uint64_t depthAddress, std::uint32_t samples, std::uint32_t sample, StorageTexture& destination, VkImageView destinationView, VkExtent2D extent);
+std::array<std::uint32_t, 8> DepthCopySourceWords(const DepthTarget& target);
+class DepthCopySourceScope {
+public:
+    explicit DepthCopySourceScope(bool active);
+    ~DepthCopySourceScope();
+    DepthCopySourceScope(const DepthCopySourceScope&) = delete;
+    DepthCopySourceScope& operator=(const DepthCopySourceScope&) = delete;
+
+private:
+    bool previous;
+};
 
 struct StorageImageClear {
     std::array<std::uint32_t, 8> image{};
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp
index 535e799c9a..ea02167400 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp
@@ -14,10 +14,29 @@ namespace AgcDriver::Graphics {
 
 struct HostImport;
 
+struct DrawTraceContext {
+    std::uint64_t token = 0;
+    std::uint64_t submission = 0;
+    std::uint32_t queue = 0;
+    std::size_t offset = 0;
+    std::uint64_t target = 0;
+};
+
 // `recipe`, when given, receives the DrawRecipe a recorded, cacheable, reusable, non-indirect draw
 // built for its draw-cache entry (design_cpu_final M8; null otherwise, and always under
 // APS5_NO_DRAW_RECIPE=1).
-void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr);
+void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr, const DrawTraceContext* trace = nullptr);
+
+struct PixelFunctionLdsLayouts {
+    VkDescriptorSetLayout empty = VK_NULL_HANDLE;
+    VkDescriptorSetLayout buffer = VK_NULL_HANDLE;
+};
+
+PixelFunctionLdsLayouts PixelFunctionLdsSetLayouts(const Context& context);
+void PreparePixelFunctionLds(const Context& context, VkCommandBuffer commands, std::uint32_t subgroupSize);
+void BindPixelFunctionLds(const Context& context, VkCommandBuffer commands, VkPipelineLayout layout);
+void CheckPixelFunctionLds(const Context& context);
+void ReleasePixelFunctionLds(VkDevice device);
 std::optional<std::string> KnownValidationFailure(const Context& context, std::span<const CompiledShader> shaders, const State& state);
 std::uint64_t DrawRenderPassKey(const Context& context, const State& state, std::span<const VkImageView> targetViews);
 
@@ -81,7 +100,7 @@ struct DrawRecipeOutcome {
 // the template's proof (ProveCurrent) with the alias checks repeated, the pipeline and framebuffer
 // from the recipe, then the record as Draw's (pass continued or begun, Kept, MarkGpuWrites). A
 // miss records nothing.
-DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe);
+DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe, const DrawTraceContext* trace = nullptr);
 // Whether recorded draws build recipes and draw-cache hits use them (APS5_NO_DRAW_RECIPE unset).
 bool DrawRecipes();
 
@@ -91,7 +110,7 @@ bool DrawRecipes();
 // draw index, the vertex ranges, the device features, APS5_NO_GPU_INDIRECT_DRAW) or under the device
 // lock in Draw (the memory state of the records). `readMs` is the CPU read's time (its sync);
 // `rewritten` counts a GPU-side draw whose records were copied and patched with a constant.
-enum class IndirectDrawPath : std::uint8_t { Gpu, NotFolded, FetchUnknown, NonVertexPath, IndxOffset, DrawIndex, VertexRange, FeatureGap, PendingImage, PendingLabelOrCopy, NotImported, Disabled, IndexRange, Count };
+enum class IndirectDrawPath : std::uint8_t { Gpu, NotFolded, FetchUnknown, NonVertexPath, IndxOffset, DrawIndex, VertexRange, FeatureGap, PendingImage, PendingLabelOrCopy, NotImported, Disabled, IndexRange, IndexLimitUnknown, Count };
 void CountIndirectDraw(IndirectDrawPath path, double readMs, bool rewritten = false);
 std::array<std::uint64_t, static_cast<std::size_t>(IndirectDrawPath::Count)> IndirectDrawCounts();
 void CountEmptyIndirectDraw(double readMs);
@@ -129,7 +148,6 @@ void CountDrawSkip(DrawSkip kind, double us);
 std::shared_ptr<std::vector<std::shared_ptr<ShaderResources>>> DrawCopiedWriters();
 
 void RunColorMetadataPass(const Context& context, const ColorMetadataPass& pass);
-void RunDepthCopyPass(const Context& context, const DepthCopyPass& pass);
 std::vector<std::pair<std::uint64_t, std::uint64_t>> PipelinedColorMetadataPassWrites(const ColorMetadataPass& pass);
 bool DrawPipelineEnabled();
 bool CommitTrims();
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp
new file mode 100644
index 0000000000..4f973ff75e
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp
@@ -0,0 +1,40 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_FIRSTSAMPLECOPY_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_FIRSTSAMPLECOPY_HPP
+
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+
+namespace AgcDriver::Graphics {
+
+class Recorder;
+
+class FirstSampleCopy {
+public:
+    FirstSampleCopy(const Context& context, VkFormat format, VkExtent2D extent);
+    ~FirstSampleCopy();
+    FirstSampleCopy(const FirstSampleCopy&) = delete;
+    FirstSampleCopy& operator=(const FirstSampleCopy&) = delete;
+
+    void Record(Recorder& recorder, VkImageView source, VkImageLayout layout);
+    VkImage Image() const { return image; }
+
+private:
+    void release() noexcept;
+
+    Context context;
+    VkExtent2D extent;
+    VkImage image = VK_NULL_HANDLE;
+    VkDeviceMemory memory = VK_NULL_HANDLE;
+    VkImageView view = VK_NULL_HANDLE;
+    VkSampler sampler = VK_NULL_HANDLE;
+    VkDescriptorSetLayout descriptorLayout = VK_NULL_HANDLE;
+    VkPipelineLayout pipelineLayout = VK_NULL_HANDLE;
+    VkRenderPass renderPass = VK_NULL_HANDLE;
+    VkFramebuffer framebuffer = VK_NULL_HANDLE;
+    VkShaderModule vertex = VK_NULL_HANDLE;
+    VkShaderModule fragment = VK_NULL_HANDLE;
+    VkPipeline pipeline = VK_NULL_HANDLE;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp
index f2fa612a4a..6cc9174ea6 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp
@@ -38,6 +38,7 @@ struct HostImport {
     // Identity for the life of this import (see HostImportSerial); 0 until first asked for.
     std::uint64_t serial = 0;
     bool unwatched = false;
+    bool settleOnDemand = false;
     bool dmaBuf = false;
     bool joined = false;
     std::shared_ptr<void> chunk;
@@ -102,6 +103,7 @@ void ReportHostImports();
 // address)` in the import's buffer.
 const HostImport* HostImportFor(const Context& context, std::uint64_t address, std::size_t bytes, ImportRequester requester = ImportRequester::Access);
 const HostImport* ExistingHostImportFor(const Context& context, std::uint64_t address, std::size_t bytes);
+bool WatchedAfterSettle(const Context& context, std::uint64_t address, std::size_t bytes);
 void SetHostImportWindow(std::uint64_t bytes);
 // Tests: the window of one large registered range (64 MiB) and the import budget (0: the configured one).
 void SetHostImportRangeWindow(std::uint64_t bytes);
@@ -113,6 +115,7 @@ void SetHostImportDeferredSettles(bool enabled);
 // The larger of 6 GiB and half the physical memory, at most the largest host heap less the larger of 2 GiB and half
 // that heap: the other half stays for the buffers, mirrors and textures that share it.
 std::uint64_t HostImportBudget(const VkPhysicalDeviceMemoryProperties& memory, std::uint64_t physicalBytes);
+void SetHostImportMaxBytes(std::uint64_t bytes);
 std::uint64_t HostImportLiveBytes();
 std::uint64_t HostImportBudgetRemaining(const Context& context);
 struct HostImportSettleCounts {
@@ -132,6 +135,7 @@ bool ImportMappedRanges(const Context& context, const GuestAllocations::Mapped&
 // made outside the device lock (a sampled texture's path, a dispatch's pre-sync); the path taken
 // re-checks with HostImportFor when it binds the import.
 bool HostImportCovers(const Context& context, std::uint64_t address, std::size_t bytes);
+bool ComparedHostImportCovers(const Context& context, std::uint64_t address, std::size_t bytes);
 struct RegisteredPiece {
     std::uint64_t address;
     std::uint64_t bytes;
@@ -263,6 +267,8 @@ struct AddressCopy {
     std::uint64_t end;
     std::uint64_t committed;
     const char* reason;
+    bool heap = false;
+    bool overBudget = false;
 };
 std::string AddressCopyOverflow(std::vector<AddressCopy> copies, std::uint64_t limit);
 
@@ -508,6 +514,7 @@ private:
     bool prepared = false;
     bool uploaded = false;
     bool committed = false;
+    mutable std::uint64_t directWritesGeneration = 0;
 };
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp
index 89e151fb24..17b5f7cb3b 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp
@@ -97,6 +97,7 @@ float EffectiveMinLod(const GuestTextureResource& resource);
 
 bool IsNullTextureResource(std::span<const std::uint32_t> words);
 GuestTextureResource DecodeTextureResource(std::span<const std::uint32_t> words);
+std::array<std::uint32_t, 8> EncodeTextureResource(const GuestTextureResource& resource);
 bool DescriptorSingleLevel(std::span<const std::uint32_t> words);
 bool FirstLayerDescriptor(std::span<const std::uint32_t> words, std::array<std::uint32_t, 8>& narrowed);
 bool MatchesGuestDimension(ShaderRecompiler::DescriptorImageShape shape, TextureDimension dimension);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp
index b9c18eb7d1..04f7e5ccbd 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp
@@ -67,6 +67,7 @@ bool TakeMultisampledSingleClear(std::span<const std::uint32_t> code, std::span<
 bool TakeMultisampledClear(MultisampledCmask& cmask, MultisampledColorFill& colorFill, const ColorTarget& use, VkClearColorValue& clear);
 SampleOrderTarget MultisampleTargetOrderTarget(const Context& context, const ColorTarget& target);
 std::shared_ptr<Texture> MultisampleTargetTexture(const Context& context, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType viewType = VK_IMAGE_VIEW_TYPE_2D);
+std::shared_ptr<Texture> MultisampleTargetFirstSample(const Context& context, const GuestTextureResource& resource, VkComponentMapping components);
 VkImageView MultisampleTargetView(const Context& context, const ColorTarget& target, VkImage* image = nullptr);
 VkImageView MultisampleTargetView(const Context& context, const ColorTarget& target, std::shared_ptr<void>& owner, VkImage* image = nullptr);
 void KeepMultisampleTarget_nid_no_patch(const std::shared_ptr<void>& owner);
@@ -80,6 +81,7 @@ std::shared_ptr<Texture> MultisampleTargetFmaskTexture_nid_no_patch(const Contex
 void ClearMultisampleTargets(VkDevice device);
 void InstallResidentImageReadGuard_nid_no_patch();
 void UpdateResidentImageUnmapObserver_nid_no_patch();
+void GuardOneFragmentFmask(const Context& context, const ColorTarget& target);
 void RequireNoMultisampleTarget(std::uint64_t address, std::size_t bytes, const char* access);
 void RequireNoMultisampleColorTarget(std::uint64_t address, std::size_t bytes, const char* access);
 
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp
index 1ee631c131..b9cea62862 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp
@@ -87,6 +87,8 @@ private:
     VkPipeline secondChannel = VK_NULL_HANDLE;
     std::size_t attachments = 0;
     std::size_t colorAttachments = 0;
+    std::vector<bool> boundAttachments;
+    std::uint32_t boundColorAttachments = 0;
     bool depthBounds = false;
     bool depthBias = false;
     bool libraries = false;
@@ -107,8 +109,10 @@ private:
 // stages and every pipeline state field. A configuration whose stage has no module gets a private
 // pipeline. A miss builds the pipeline outside the store's mutex (a concurrent build of the same
 // key keeps the first inserted) and records its recipe in the pipeline journal. Entries are
-// LRU-bounded (APS5_PIPELINE_STORE_ENTRIES, 1024) and only evicted once no recorded draw holds
-// them. Debug aid: APS5_NO_PIPELINE_CACHE=1 builds one per draw as before.
+// LRU-bounded and only evicted once no recorded draw holds them. The bound starts at 1024 and
+// doubles up to 4096 for a journal replay that does not fit and while pipelines it evicted keep
+// coming back; it never shrinks during a run. APS5_PIPELINE_STORE_ENTRIES fixes it. Debug aid:
+// APS5_NO_PIPELINE_CACHE=1 builds one per draw as before.
 std::shared_ptr<Pipeline> CachedPipeline(const Context& context, const State& state, const VertexInputLayout& vertexInput, const ShaderResources& resources, std::span<const CompiledShader> shaders, VkImageLayout attachmentLayout = VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL);
 // `created` reports whether this call built the pipeline (false: served from the store or private).
 std::shared_ptr<Pipeline> CachedPipeline(const Context& context, const State& state, const VertexInputLayout& vertexInput, const PipelineSetLayouts& resources, std::span<const CompiledShader> shaders, VkImageLayout attachmentLayout = VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL, bool* created = nullptr);
@@ -122,6 +126,8 @@ struct PipelineStoreCounters {
     std::uint64_t bound = 0;
 };
 PipelineStoreCounters PipelineStoreTotals();
+// Whether the store may still raise its bound (not fixed by APS5_PIPELINE_STORE_ENTRIES, below 4096).
+bool PipelineStoreCanGrow();
 // The pipeline store's key of a configuration (empty when the configuration gets a private pipeline).
 void BuildPipelineStoreKey(std::vector<std::byte>& key, const Context& context, const State& state, const VertexInputLayout& vertexInput, const PipelineSetLayouts& resources, std::span<const CompiledShader> shaders, VkImageLayout attachmentLayout);
 struct DescribedSetLayouts {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp
index c2cf90476e..d905e217cf 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp
@@ -61,11 +61,14 @@ struct PipelineJournalCounters {
     std::uint64_t replayFailed = 0;
     double replayMs = 0;
     std::uint32_t replayThreads = 0;
+    std::uint64_t replayHeldPeakBytes = 0;
     std::uint64_t recordedGraphics = 0;
     std::uint64_t recordedCompute = 0;
     std::uint64_t recordedModules = 0;
     std::uint64_t writtenBytes = 0;
     std::uint64_t writeFailures = 0;
+    std::uint64_t evictedRecords = 0;
+    std::uint64_t evictedBytes = 0;
 };
 
 // A decimal switch of the pipeline store or journal, or its default when unset; anything else throws.
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp
index e322257825..f76e061983 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp
@@ -107,7 +107,8 @@ public:
     static constexpr std::size_t DrawInputEntries = 16384;
     std::shared_ptr<Buffer> UnwrittenDrawSnapshot(std::uint64_t address, std::size_t bytes, const std::array<std::uint64_t, 3>& stamp, VkDeviceSize* offset = nullptr);
     void NoteUnwrittenDrawSnapshot(std::uint64_t address, std::size_t bytes, const std::array<std::uint64_t, 3>& stamp, std::shared_ptr<Buffer> buffer, VkDeviceSize offset = 0);
-    std::shared_ptr<Buffer> ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use = SnapshotUse::Storage, std::uint32_t* derived = nullptr, std::uint64_t generation = 0);
+    std::shared_ptr<Buffer> ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use = SnapshotUse::Storage, std::uint32_t* derived = nullptr, std::uint64_t generation = 0, VkDeviceSize* offset = nullptr);
+    static constexpr std::size_t ContainingSnapshotProbes = 16;
     void KeepDrawSnapshot(std::uint64_t address, std::size_t bytes, std::uint64_t generation, std::uint64_t registryGeneration, std::shared_ptr<Buffer> buffer, SnapshotUse use = SnapshotUse::Storage, std::uint32_t derived = 0);
     static constexpr std::size_t DrawUploadChunk = std::size_t{1} << 20u;
     struct UploadSlice {
@@ -182,6 +183,7 @@ public:
     // Whether the OPEN (unsubmitted) batch writes the range: a wait on such a range must submit it.
     bool OpenWriteOverlaps(std::uint64_t address, std::size_t bytes) const;
     std::uint64_t PendingWriterSerial(std::uint64_t address, std::size_t bytes) const;
+    std::uint64_t PendingWriterSerial(std::uint64_t address, std::size_t bytes, std::span<const std::uint64_t> exceptNotes) const;
     // What SyncThrough(address, bytes) would wait for, for the [hooksync] attribution: the newest
     // batch whose noted range overlaps the access (the open batch counts first, with the serial it
     // will get), whether that batch's fence has already signaled (its GPU work is done, so the
@@ -202,25 +204,30 @@ public:
     // Submits the open batch and returns the serial of the newest submitted batch (0 when nothing was
     // ever submitted); WaitSerial(serial) then covers all recorded work.
     std::uint64_t SubmitAndEpoch();
+    std::uint64_t OpenBatchSerial();
     bool HasTimeline() const { return timeline != VK_NULL_HANDLE; }
     bool RecordDispatchArguments(VkCommandBuffer commands, VkDeviceAddress source, VkDeviceAddress arguments, const std::array<std::uint32_t, 3>* threadGroup = nullptr);
     // Waits until every batch up to `serial` completed on the GPU. Called WITHOUT GuestMemory::GpuMutex:
     // it touches only the immutable timeline semaphore (the caller keeps the device alive). Requires
     // HasTimeline(); the debug switch APS5_NO_TIMELINE makes the device create the recorder without one.
     void WaitSerial(std::uint64_t serial);
+    bool WaitSerialFor(std::uint64_t serial, std::uint64_t timeoutNanos);
     // Under the mutex: finishes (completions, release) the in-flight batches up to `serial`, from the
     // front only; tolerates batches another thread finished meanwhile. Later batches stay in flight.
     void FinishUpTo(std::uint64_t serial);
     // Submits and waits for every batch, running completions in order.
     void Sync();
     void CountSamples();
+    bool CountingSamples() const { return countingSamples; }
     bool RecordMeshArguments(VkCommandBuffer commands, VkDeviceAddress record, VkDeviceAddress arguments, std::span<const std::uint32_t, 7> rules);
     std::uint64_t SamplesTotal();
     bool DumpSamples(VkDeviceAddress target, std::uint64_t address = 0);
     void NoteSampledDraw(VkCommandBuffer commands);
+    void NoteDrawTraceToken(std::uint64_t token) noexcept;
     bool QueuesSampleDumps() const;
     void PrepareSampleSlot();
     void EndPassSamples();
+    void RecordUncounted(const std::function<void(VkCommandBuffer)>& record);
     struct SampleDumpStatistics {
         std::uint64_t queued;
         std::uint64_t queuedInPass;
@@ -403,6 +410,7 @@ public:
     static std::uint64_t PublishGeneration();
     // labels waiting in completion actions (the CPU must reap their batch for them to land);
     static std::uint64_t PendingCompletionLabels();
+    static std::uint64_t PendingCompletionStores();
     // write-back completions (OnComplete) of unfinished batches: a reaper retires them when every
     // worker sleeps, as for the labels above;
     static std::uint64_t PendingWriteBackCompletions();
@@ -579,6 +587,7 @@ private:
         VkQueryPool queries = VK_NULL_HANDLE;
         VkQueryPool samples = VK_NULL_HANDLE;
         std::shared_ptr<void> samplePool;
+        std::vector<VkQueryPool> endedSamples;
         bool sampleActive = false;
         bool samplesDrawn = false;
         VkQueryPool segments = VK_NULL_HANDLE;
@@ -600,6 +609,7 @@ private:
         // Labels stored by this batch's completion actions (see AfterCompletions); subtracted from
         // the lock-free pending count when the batch finishes, whether or not its completions ran.
         std::uint32_t completionLabelCount = 0;
+        std::uint32_t completionStoreCount = 0;
         // Write-back completions (OnComplete), likewise.
         std::uint32_t writeBackCompletionCount = 0;
         // The ranges of the completion labels also stored on the GPU, and whether each entered the
@@ -672,6 +682,8 @@ private:
             std::uint64_t end;
         };
         std::vector<KeyStore> keyStores;
+        std::vector<std::uint64_t> drawTraceTokens;
+        std::unordered_set<std::uint64_t> drawTraceTokenSet;
     };
     struct LabelEntry {
         std::uint32_t value;
@@ -882,6 +894,7 @@ private:
     std::map<DrawSnapshotKey, IndexRange> indexRanges;
     std::list<DrawSnapshotKey> indexRangeRecency;
     bool refreshDrawSnapshot(DrawSnapshot& entry, std::uint64_t address, std::size_t bytes);
+    std::shared_ptr<Buffer> containingDrawSnapshot(std::uint64_t address, std::size_t bytes, VkDeviceSize* offset);
     mutable std::weak_ptr<const WriteRanges> publishedWriteRanges;
     mutable bool publishedWriteRangesValid = false;
 };
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp
index c68ef833c5..2438745430 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp
@@ -30,16 +30,20 @@ class Recorder;
 
 void FlushCachedTextures(VkDevice device);
 void ClearCachedTextures(VkDevice device);
-std::uint64_t ReleaseTextureCaches(std::uint64_t bytes);
+std::uint64_t ReleaseTextureCaches(std::uint64_t bytes, bool newImage = false);
 std::uint64_t TextureCacheBudget(const VkPhysicalDeviceMemoryProperties& memory);
+std::uint64_t StorageTextureCeiling(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported);
 std::uint64_t StorageTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t sampledBytes, std::uint64_t storageBytes);
-std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes);
+std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes, std::uint64_t storageBytes = 0);
 bool SampledBudgetReportDue(std::uint64_t reported, std::uint64_t budget, std::chrono::steady_clock::duration sinceReport);
 std::optional<std::uint32_t> LargestDeviceLocalHeap(const VkPhysicalDeviceMemoryProperties& memory);
 std::uint64_t StorageTextureCacheBudget(const Context& context);
+inline constexpr std::uint64_t SpareSnapshotPresents = 16;
 struct TextureCacheUse {
     std::size_t sampledEntries = 0;
+    std::size_t spareEntries = 0;
     std::uint64_t sampledBytes = 0;
+    std::uint64_t spareBytes = 0;
     std::uint64_t storageBytes = 0;
 };
 TextureCacheUse TextureCacheUsage();
@@ -47,9 +51,11 @@ void OverrideCacheBudgetForTest(std::uint64_t bytes);
 std::uint64_t SampledTextureCacheBudget(const Context& context);
 std::shared_ptr<Texture> CachedSampledTexture(const Context& context, std::span<const std::uint32_t> words, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D);
 bool SampledTexturesShareEntry(std::span<const std::uint32_t> first, std::span<const std::uint32_t> second);
+bool AnyPendingCpuWrites(const Context& context);
 bool CompletePendingCpuWrites(const Context& context, std::uint64_t address, std::size_t bytes);
 bool SpirvStoresThroughAddresses(std::span<const std::uint32_t> words);
 bool ShaderStoresThroughAddresses(const ShaderRecompiler::SharedSpirv& spirv);
+void LastRecordIndices(std::span<const void* const> logged, std::span<const void* const> objects, std::vector<std::size_t>& indices);
 
 // The cached storage image of a surface (render targets use it as their resident image); brought up
 // to date with guest memory before it is returned.
@@ -148,6 +154,7 @@ struct ImageTableReuseCounts {
     std::uint64_t writesMade = 0;
 };
 ImageTableReuseCounts ImageTableReuses();
+std::uint64_t SampledLookupKeyScans();
 
 struct PresyncSurface {
     std::uint64_t address;
@@ -309,6 +316,7 @@ public:
     }
     // Whether RefreshData would record anything for `shader` (the per-word compare; verification).
     bool DataWordsDiffer(const CompiledShader& shader) const;
+    std::size_t BindingCount() const { return bindings.size(); }
     // Why the fast proof of a Revalidate left the object to the full walk (the [rescache]
     // revalidate line's reasons); Count: it did not.
     enum class FastFail : std::size_t { NoRecord, Collect, Pending, Evicted, Changed, Keys, ClearedView, StorageKeys, Depth, Replaced, Audit, Count };
@@ -475,6 +483,7 @@ private:
         std::array<std::uint32_t, 8> words{};
         bool depthCompare = false;
         VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D;
+        bool firstSample = false;
         std::shared_ptr<Texture> texture;
     };
     PreviousSampled previousSampled;
@@ -704,6 +713,7 @@ public:
     // meanwhile by another worker stays).
     void Remove(const Key& key, const ShaderResources* object = nullptr);
     void RemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted = nullptr);
+    bool TryRemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted = nullptr);
     // Moves the entry to the front of the LRU (a recipe hit uses its template without Find, and a
     // hot template must not age out under the recipes that depend on it); false when no entry.
     bool Touch(const Key& key);
@@ -726,6 +736,7 @@ private:
     void noteEvicted(const Key& key);
     void noteReturn(const Key& key);
     void noteUse(const Key& key);
+    void removeImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted);
     struct KeyHash {
         std::size_t operator()(const Key& key) const noexcept {
             constexpr std::uint64_t Prime = 0x9e3779b97f4a7c15ull;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp
index 2008d77be3..13d227b8ea 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp
@@ -45,6 +45,7 @@ struct ColorTarget {
     ShaderRecompiler::ColorExportPacking packing = ShaderRecompiler::ColorExportPacking::None;
     // DCC metadata of a compressed target (CB_COLOR_INFO DCC_ENABLE), or 0 (see DccMetadata.hpp).
     std::uint64_t dccAddress = 0;
+    std::uint64_t chainDccAddress = 0;
     bool dccAlphaOnMsb = false;
     bool dccPipeAligned = false;
     std::uint64_t cmaskAddress = 0;
@@ -67,9 +68,11 @@ struct ColorTarget {
     bool uintExport = false;
     std::uint32_t pipeBankXor = 0;
     std::uint32_t samples = 1;
+    std::uint32_t coverageSamples = 1;
     std::uint32_t dccControl = 0;
     std::uint64_t fmaskAddress = 0;
     std::uint32_t fmaskPipeBankXor = 0;
+    std::uint16_t partialWriteMask = 0;
 };
 
 struct DepthTarget {
@@ -97,6 +100,7 @@ struct State {
     std::optional<DepthTarget> depth;
     bool depthTest = false;
     bool depthWrite = false;
+    bool depthCopySource = false;
     VkCompareOp depthCompare = VK_COMPARE_OP_ALWAYS;
     bool depthBoundsTest = false;
     float minDepthBounds = 0.0f;
@@ -151,6 +155,7 @@ struct State {
     VkProvokingVertexModeEXT provokingVertexMode = VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT;
     VkPipelineColorBlendAttachmentState blend;
     std::array<float, 4> blendConstants;
+    std::uint8_t colorRop = 0xccu;
     std::uint32_t samples = 1;
     std::array<std::uint8_t, 32> sampleLocations{};
     bool customSampleLocations = false;
@@ -162,16 +167,21 @@ struct State {
     float pointSizeMax = 0.0f;
     std::array<std::uint16_t, 4> quadSampleMask{0xffffu, 0xffffu, 0xffffu, 0xffffu};
     bool pixelEarlyZ = false;
+    bool pixelKill = false;
 };
 
 // PA_CL_VS_OUT_CNTL bits that place position exports (clip and cull distances, the misc and the two
 // distance vectors); a vertex program that exports pos1..pos3 depends on them.
 inline constexpr std::uint32_t PositionExportLayoutBits = 0xffffu | (1u << 21u) | (1u << 22u) | (1u << 23u);
 
+inline constexpr std::uint8_t CopyRop = 0xccu;
+VkLogicOp LogicOpFromRop(std::uint8_t rop);
+
 ShaderStages DecodeShaderStages(const QueueState& queue, bool vertexWorkgroup = false);
 void ApplyPointSize(const State& state, ShaderRecompiler::ShaderVertexStageInfo& vertex);
 State DecodeState(const QueueState& queue, bool vertexWorkgroup = false);
 void ApplyDepthRemap(const Context& context, State& state);
+void ApplyDepthBoundsEmulation(const Context& context, State& state, const ShaderRecompiler::ShaderPixelStageInfo& pixel);
 void NormalizeUnusedViewportDepth(State& state, const ShaderRecompiler::ShaderPixelStageInfo& pixel);
 std::array<VkSampleLocationEXT, 32> SampleLocations(const State& state);
 std::array<std::uint8_t, 32> PixelSampleLocations(const State& state, const ShaderRecompiler::ShaderPixelStageInfo& pixel);
@@ -186,6 +196,11 @@ bool SampleMaskFollowsOrder(const State& state, const SampleOrder& order);
 std::array<std::uint16_t, 4> QuadSampleMasks(const State& state, const SampleOrder& order);
 std::array<std::uint8_t, 8> ExportMappings(const State& state);
 std::array<ShaderRecompiler::ColorExportPacking, 8> ExportPackings(const State& state);
+std::uint16_t PackedWriteMask(std::uint8_t componentMapping, std::uint32_t exportedMask);
+GuestTextureResource TargetMergeSurface(const ColorTarget& color);
+bool DepthStencilWrites(const State& state);
+bool DepthStencilTests(const State& state);
+ShaderRecompiler::TargetMerge ExportTargetMerge(const State& state);
 ShaderRecompiler::RasterPrimitive RasterPrimitiveOf(const State& state);
 bool PartialSampleMask(const State& state);
 bool UniformSampleMask(const State& state);
@@ -210,9 +225,7 @@ struct ColorMetadataPass {
 };
 std::optional<ColorMetadataPass> DecodeColorMetadataPass(const QueueState& queue);
 struct DepthCopyPass {
-    std::uint64_t depthAddress;
-    VkExtent2D extent;
-    std::uint32_t samples;
+    DepthTarget source;
     std::uint32_t sample;
     ColorTarget color;
 };
@@ -286,7 +299,7 @@ inline constexpr std::array<DrawKeyRange, 50> DrawKeyRegisters{{
     // PA_SU_VTX_CNTL, the sample masks, PA_SC_CONSERVATIVE_RASTERIZATION_CNTL.
     {RegisterBank::Context, 0x200, 8}, {RegisterBank::Context, 0x286, 2}, {RegisterBank::Context, 0x292, 2}, {RegisterBank::Context, 0x29b, 1}, {RegisterBank::Context, 0x2ab, 1}, {RegisterBank::Context, 0x2af, 1}, {RegisterBank::Context, 0x2ce, 1}, {RegisterBank::Context, 0x2d5, 2}, {RegisterBank::Context, 0x2db, 2}, {RegisterBank::Context, 0x2de, 6}, {RegisterBank::Context, 0x2f8, 2}, {RegisterBank::Context, 0x2fe, 16}, {RegisterBank::Context, 0x30e, 2}, {RegisterBank::Context, 0x313, 1},
     // CB_COLOR0..7_BASE .. DCC_BASE (15 words a slot), CB_COLOR0..7_BASE_EXT, DCC_BASE_EXT, ATTRIB2, ATTRIB3.
-    {RegisterBank::Context, 0x318, 0x78}, {RegisterBank::Context, 0x390, 8}, {RegisterBank::Context, 0x398, 8}, {RegisterBank::Context, 0x3a8, 0x18},
+    {RegisterBank::Context, 0x318, 0x78}, {RegisterBank::Context, 0x390, 8}, {RegisterBank::Context, 0x398, 0x10}, {RegisterBank::Context, 0x3a8, 0x18},
     // The pixel program address, RSRC2 and user words; the geometry-back user pointer and program
     // address; the vertex/geometry-front RSRC1/RSRC2 and user words; the vertex program address;
     // the hull user pointer, program address, RSRC2 and user words; the local program address.
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp
index 4dde83053f..85a45ae60e 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp
@@ -11,10 +11,12 @@
 #include <atomic>
 #include <chrono>
 #include <cstddef>
+#include <functional>
 #include <map>
 #include <memory>
 #include <mutex>
 #include <optional>
+#include <functional>
 #include <span>
 #include <tuple>
 #include <utility>
@@ -47,7 +49,7 @@ struct OwnedImage {
     OwnedImage(const OwnedImage&) = delete;
     OwnedImage& operator=(const OwnedImage&) = delete;
     ~OwnedImage();
-    void Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation);
+    void Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, bool newImage = false);
     Context context;
     VkImage image;
     VkDeviceMemory memory;
@@ -203,6 +205,7 @@ public:
     bool BlockUnits() const { return blockUnits; }
     std::uint32_t TrackedUnits() const { return trackedLayers; }
     void MarkSliceDirty(std::uint32_t slice, std::uint32_t count = 1);
+    bool MarkDrawn(std::uint32_t slice, std::uint32_t count, VkRect2D scissor);
     void Flush();
     bool Dirty() const;
     // Stores every pending image overlapping the range, except `except`; returns whether any was.
@@ -219,6 +222,8 @@ public:
     static constexpr std::uint64_t SmallStoreBytes = 64 * 1024;
     static std::size_t StoreSmallPending(const char* reason);
     static void StoreReadbackBeforeLabel(const char* reason);
+    static std::size_t StoreDrawnLinear(const char* reason);
+    static std::size_t StoreDrawnLinearTouching(const char* reason, const std::function<bool(std::uint64_t, std::uint64_t)>& touches, bool all);
     static bool AnyPending();
     static void FlushDumpSelected(const char* reason);
     static bool StoreAtFlipRequested(const char* value);
@@ -230,6 +235,7 @@ public:
     // any of the [begin, end) ranges: one acquisition of the registry's mutex.
     static bool AnyPendingOverlaps(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges);
     static bool AnyLiveOverlaps(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges);
+    static std::uint64_t StampKeepingNewerResults(std::uint64_t address, std::size_t bytes, std::uint64_t recorded, const std::function<std::uint64_t()>& stamp);
     // Moves with every change of the pending registry (an image marked dirty, stored, flushed or
     // dropped; after the store for a flush), bumped under the registry's mutex with the change, so
     // a reader that loads it before and after its own reads knows the registry it consulted stayed
@@ -480,6 +486,27 @@ private:
     // (`shadowed` receives those guest ranges, `imported` the pieces written to the import).
     std::uint64_t uploadWindows(const HostImport& import, std::span<const std::pair<std::uint64_t, std::uint64_t>> runs, bool discard = false);
     std::uint64_t writeBackWindows(std::span<const ImportSegment> segments, std::span<const std::pair<std::uint64_t, std::uint64_t>> keep, std::uint64_t firstStored, std::uint64_t lastStored, std::vector<ShadowedRange>& shadowed, std::vector<std::pair<std::uint64_t, std::uint64_t>>& imported, Buffer* save = nullptr);
+    struct DrawnRect {
+        std::uint32_t left = 0;
+        std::uint32_t top = 0;
+        std::uint32_t right = 0;
+        std::uint32_t bottom = 0;
+    };
+    struct DrawnArea {
+        bool drawn = false;
+        bool rect = false;
+        std::uint32_t left = 0;
+        std::uint32_t top = 0;
+        std::uint32_t right = 0;
+        std::uint32_t bottom = 0;
+        std::vector<DrawnRect> rects;
+    };
+    DrawnArea drawnArea() const;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> drawnSpans(const DrawnArea& area, std::span<const std::pair<std::uint64_t, std::uint64_t>> keep) const;
+    std::uint64_t storeDrawnRect(const DrawnArea& area, std::span<const ImportSegment> segments, std::span<const std::pair<std::uint64_t, std::uint64_t>> stores, const std::vector<std::uint32_t>& saveUnits);
+    void addDrawnRect(DrawnRect rect);
+    void forgetDrawn();
+    void noteStore(std::uint64_t note);
     // Per-layer validity (thin array surfaces whose layers are 64 KiB-aligned guest slices; every
     // other surface is one tracked layer): a layer's generation is the write generation its guest
     // bytes were last known to match the image at, and a pending layer holds results (a clear, a
@@ -516,6 +543,7 @@ private:
     // Per 64 KiB tracker block of the surface (block 0 holds the base address): the generation of
     // the tracked layer it belongs to, for GuestMemory::ChangedBlocks.
     void blockGenerations(std::vector<std::uint64_t>& generations) const;
+    std::uint64_t unitBlockGeneration(std::uint32_t unit, std::uint64_t at) const;
     // Another image of exactly this surface under another storage format with results pending
     // (block units, uncompressed, still cached), if any: Refresh takes its pending units from its
     // image on the device (borrowUnits) instead of having them stored and re-read, and the alias
@@ -600,6 +628,7 @@ private:
     std::uint32_t trackedLayers = 1;
     std::uint64_t trackedLayerBytes = 0;
     std::vector<std::uint64_t> layerGeneration;
+    std::vector<std::uint64_t> completionKept;
     std::vector<bool> layerPending;
     std::vector<bool> layerBehind;
     bool blockUnits = false;
@@ -639,6 +668,12 @@ private:
     VkFormat storageFormat = VK_FORMAT_UNDEFINED;
     // Results are on the GPU only (guarded by the pending-write registry lock).
     bool dirty = false;
+    bool drawnListed = false;
+    bool drawnWhole = false;
+    bool drawingTarget = false;
+    bool pendingFromOthers = false;
+    std::vector<DrawnRect> drawnRects;
+    std::vector<std::uint64_t> storeNotes;
     std::uint64_t version = 0;
     std::uint64_t writes = 0;
     // `original` holds the guest bytes; false after a GPU-side clear, which never read them.
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp
index e0dc3531e4..d0b15ac51c 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp
@@ -56,7 +56,6 @@ namespace AgcDriver::Graphics {
         void DispatchCmaskClear(VkCommandBuffer commands, VkBuffer cmask, std::uint64_t cmaskOffset, std::size_t cmaskBytes, VkImageView view, std::uint32_t width, std::uint32_t height, std::uint32_t elementBytes, const std::array<std::uint32_t, 2>& clearWords, bool write);
         std::uint32_t CmaskErrors();
         void DispatchMultisampleReadback(VkCommandBuffer commands, VkFormat format, VkBuffer destination, std::uint64_t offset, std::uint64_t bytes, VkImageView arrayView, std::uint32_t width, std::uint32_t height, std::uint32_t layers, std::uint32_t fragments, std::uint32_t firstElement, std::uint32_t elements);
-        void DispatchDepthSample(VkCommandBuffer commands, VkImageView depth, bool multisampled, VkImageView target, std::uint32_t width, std::uint32_t height, std::uint32_t sample);
         void DispatchMultisampleImage(VkCommandBuffer commands, std::uint32_t elementBytes, VkBuffer source, std::uint64_t offset, std::uint64_t bytes, VkImageView arrayView, std::uint32_t width, std::uint32_t height, std::uint32_t layers, std::uint32_t fragments, std::uint32_t firstElement, std::uint32_t elements);
 
     private:
@@ -85,11 +84,6 @@ namespace AgcDriver::Graphics {
         VkPipelineLayout cmaskPipelineLayout = VK_NULL_HANDLE;
         VkPipeline cmaskPipeline = VK_NULL_HANDLE;
         DescriptorRing cmaskDescriptorSets;
-        VkDescriptorSetLayout depthSampleLayout = VK_NULL_HANDLE;
-        VkPipelineLayout depthSamplePipelineLayout = VK_NULL_HANDLE;
-        std::array<VkPipeline, 2> depthSamplePipelines{};
-        VkSampler depthSampler = VK_NULL_HANDLE;
-        DescriptorRing depthSampleSets;
         std::unique_ptr<Buffer> cmaskErrors;
         VkDescriptorSetLayout imageDescriptorLayout = VK_NULL_HANDLE;
         VkPipelineLayout imagePipelineLayout = VK_NULL_HANDLE;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp
index a2625c2e6b..62218d7c9a 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp
@@ -13,6 +13,7 @@ namespace AgcDriver::Graphics {
 struct Context;
 
 VkFormat ResolveTextureFormat(std::uint32_t guestFormat);
+VkFormat DccClearTextureFormat(std::uint32_t guestFormat);
 VkComponentSwizzle TextureComponentChannel(std::uint32_t guestFormat, VkComponentSwizzle component);
 std::uint32_t SrgbDecodeFormats(PFN_vkGetPhysicalDeviceFormatProperties formatProperties, VkPhysicalDevice physical);
 VkFormat SampledTextureFormat(const Context& context, std::uint32_t guestFormat);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp
index 5699bf78e1..dafa52d5f5 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp
@@ -75,7 +75,7 @@ struct SurfaceGeometry {
 };
 SurfaceGeometry DescribeSurface(const GuestTextureResource& descriptor);
 bool LevelsFitAllocation(const GuestTextureResource& surface, std::uint32_t levels);
-GuestTextureResource ViewedArrayWindow(const GuestTextureResource& viewed);
+GuestTextureResource ViewedArrayWindow(const GuestTextureResource& viewed, bool keysReadAsStored);
 GuestTextureResource ArrayLayerWindow(const GuestTextureResource& viewed, std::uint32_t maxArrayLayers);
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp
index aad386bfc1..85f0dbd804 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp
@@ -8,6 +8,7 @@
 #include <mutex>
 #include <unordered_map>
 #include <cstring>
+#include <cstdio>
 #include <limits>
 #include <optional>
 #include <set>
@@ -29,13 +30,13 @@ inline bool NullVertexDescriptor(const ShaderRecompiler::VertexAttribute& attrib
     return fields[0] == 0 && fields[1] == 0 && fields[2] == 0 && fields[3] == 0;
 }
 
-inline VertexFormat DecodeVertexFormat(const ShaderRecompiler::VertexAttribute& attribute) {
+inline VertexFormat DecodeVertexFormat(const ShaderRecompiler::VertexAttribute& attribute, std::uint32_t minimumComponents = 0u) {
     Require(attribute.components >= 1 && attribute.components <= 4, "invalid vertex attribute component count");
     if (NullVertexDescriptor(attribute)) {
         const std::array formats{VK_FORMAT_R32_SFLOAT, VK_FORMAT_R32G32_SFLOAT, VK_FORMAT_R32G32B32_SFLOAT, VK_FORMAT_R32G32B32A32_SFLOAT};
         return {formats[attribute.components - 1], attribute.components * 4u, 4u, "f32"};
     }
-    const auto components = attribute.formatComponents == 0u ? attribute.components : attribute.formatComponents;
+    const auto components = std::max(attribute.formatComponents == 0u ? attribute.components : attribute.formatComponents, minimumComponents);
     Require(components >= 1u && components <= 4u, "invalid vertex format component count");
     const auto format = (attribute.resource.fields[3] >> 12u) & 0x7fu;
     switch (format) {
@@ -106,11 +107,27 @@ inline std::string VertexAttributeSignature(const ShaderRecompiler::VertexAttrib
     return std::string(format.scalar) + (attribute.components == 1 ? "" : "x" + std::to_string(attribute.components));
 }
 
+inline std::uint32_t VertexReadBytes(const ShaderRecompiler::VertexAttribute& attribute, VkFormat host) {
+    for (auto components = 1u; components <= 4u; ++components) {
+        const auto format = DecodeVertexFormat(attribute, components);
+        if (format.format == host) return format.bytes;
+    }
+    throw std::runtime_error("AGC graphics: vertex format " + std::to_string(host) + " is not a form of the attribute's buffer format");
+}
+
 struct VertexInputLayout {
     std::vector<VkVertexInputBindingDescription> bindings;
     std::vector<VkVertexInputAttributeDescription> attributes;
 };
 
+inline std::array<char, 160> VertexDescriptorFlagsMessage(const ShaderRecompiler::VertexAttribute& attribute) {
+    std::array<char, 160> message{};
+    const auto& fields = attribute.resource.fields;
+    std::snprintf(message.data(), message.size(), "unsupported vertex buffer descriptor flags at location %u (V#=[%08x %08x %08x %08x])",
+        attribute.location, fields[0], fields[1], fields[2], fields[3]);
+    return message;
+}
+
 inline VertexInputLayout BuildVertexInputLayout(const Context& context, std::span<const ShaderRecompiler::VertexAttribute> attributes) {
     Require(attributes.size() <= context.limits.maxVertexInputBindings && attributes.size() <= context.limits.maxVertexInputAttributes, "vertex input count exceeds device limits");
     VertexInputLayout result;
@@ -120,18 +137,29 @@ inline VertexInputLayout BuildVertexInputLayout(const Context& context, std::spa
         const auto format = DecodeVertexFormat(attribute);
         Require(attribute.location < context.limits.maxVertexInputAttributes && locations.insert(attribute.location).second, "invalid or duplicate vertex attribute location");
         Require(attribute.fetchIndex <= 1, "unsupported vertex fetch index");
-        Require((fields[1] & 0x80000000u) == 0 && (fields[3] & 0x00800000u) == 0 && (fields[3] >> 30u) == 0, "unsupported vertex buffer descriptor flags");
+        if ((fields[1] & 0x80000000u) != 0 || (fields[3] & 0x00800000u) != 0 || (fields[3] >> 30u) != 0) {
+            Require(false, VertexDescriptorFlagsMessage(attribute).data());
+        }
         const auto stride = (fields[1] >> 16u) & 0x3fffu;
         const auto address = fields[0] | (static_cast<std::uint64_t>(fields[1] & 0xffffu) << 32u);
         Require(NullVertexDescriptor(attribute) || (address != 0 && address % format.alignment == 0 && stride % format.alignment == 0), "unaligned vertex buffer");
         Require(stride <= context.limits.maxVertexInputBindingStride, "vertex stride exceeds device limits");
         Require(context.formatProperties != nullptr, "missing vertex format property query");
-        VkFormatProperties properties{};
-        context.formatProperties(context.physical, format.format, &properties);
-        Require((properties.bufferFeatures & VK_FORMAT_FEATURE_VERTEX_BUFFER_BIT) != 0, "device does not support vertex format " + std::to_string(format.format));
+        const auto supported = [&](VkFormat candidate) {
+            VkFormatProperties properties{};
+            context.formatProperties(context.physical, candidate, &properties);
+            return (properties.bufferFeatures & VK_FORMAT_FEATURE_VERTEX_BUFFER_BIT) != 0;
+        };
+        auto host = format.format;
+        auto hostSupported = supported(host);
+        for (auto components = 1u; !hostSupported && components <= 4u; ++components) {
+            host = DecodeVertexFormat(attribute, components).format;
+            hostSupported = supported(host);
+        }
+        Require(hostSupported, "device does not support vertex format " + std::to_string(format.format));
         const auto binding = static_cast<std::uint32_t>(result.bindings.size());
         result.bindings.push_back({binding, stride, attribute.fetchIndex == 0 ? VK_VERTEX_INPUT_RATE_VERTEX : VK_VERTEX_INPUT_RATE_INSTANCE});
-        result.attributes.push_back({attribute.location, binding, format.format, 0});
+        result.attributes.push_back({attribute.location, binding, host, 0});
     }
     return result;
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/shaders/DepthSample.comp b/core/libs/prx/libSceAgcDriver/Graphics/shaders/DepthSample.comp
deleted file mode 100644
index 36f1883556..0000000000
--- a/core/libs/prx/libSceAgcDriver/Graphics/shaders/DepthSample.comp
+++ /dev/null
@@ -1,27 +0,0 @@
-#version 450
-
-layout(local_size_x = 8, local_size_y = 8) in;
-
-#if MULTISAMPLED
-layout(set = 0, binding = 0) uniform sampler2DMS depth;
-#else
-layout(set = 0, binding = 0) uniform sampler2D depth;
-#endif
-layout(set = 0, binding = 1, r32f) writeonly uniform image2D target;
-
-layout(push_constant) uniform Push {
-    uint width;
-    uint height;
-    int sampleIndex;
-} push;
-
-void main() {
-    uvec2 pixel = gl_GlobalInvocationID.xy;
-    if (pixel.x >= push.width || pixel.y >= push.height) return;
-#if MULTISAMPLED
-    float value = texelFetch(depth, ivec2(pixel), push.sampleIndex).r;
-#else
-    float value = texelFetch(depth, ivec2(pixel), 0).r;
-#endif
-    imageStore(target, ivec2(pixel), vec4(value, 0.0, 0.0, 0.0));
-}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/shaders/FirstSample.frag b/core/libs/prx/libSceAgcDriver/Graphics/shaders/FirstSample.frag
new file mode 100644
index 0000000000..287527d25a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/shaders/FirstSample.frag
@@ -0,0 +1,16 @@
+#version 450
+
+#if defined(UINT_SAMPLES)
+layout(set = 0, binding = 0) uniform usampler2DMS source;
+layout(location = 0) out uvec4 color;
+#elif defined(SINT_SAMPLES)
+layout(set = 0, binding = 0) uniform isampler2DMS source;
+layout(location = 0) out ivec4 color;
+#else
+layout(set = 0, binding = 0) uniform sampler2DMS source;
+layout(location = 0) out vec4 color;
+#endif
+
+void main() {
+    color = texelFetch(source, ivec2(gl_FragCoord.xy), 0);
+}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp
index f9234680ea..aa267a27f6 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp
@@ -283,6 +283,10 @@ void BdaResources::CheckFault() const {
         message << "shader stage " << report.stage << " called address 0x" << std::hex << report.address << " at program counter 0x" << report.instruction << ", which no linked callee of that call matches";
         throw std::runtime_error(message.str());
     }
+    if (report.reason == ShaderRecompiler::BdaAbi::FaultReason::WindowLaneSpill) {
+        message << "shader stage " << report.stage << ": a relative write stored " << report.bytes << " in lane " << (report.address >> 32u) << " of vector window slot " << (report.address & 0xffffffffu) << ", which holds a scalar spilled with v_writelane_b32 that a later v_readlane_b32 was replaced with";
+        throw std::runtime_error(message.str());
+    }
     message << "BDA access failed: address=0x" << std::hex << report.address << " instruction=0x" << report.instruction << std::dec << " bytes=" << report.bytes << " stage=" << report.stage << " reason=" << static_cast<std::uint32_t>(report.reason);
     if (report.reason == ShaderRecompiler::BdaAbi::FaultReason::Permission && table != nullptr) {
         const auto bytes = table->Bytes();
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp
index 128970a898..9b22e6a5b5 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp
@@ -57,7 +57,7 @@ BufferPool::~BufferPool() {
     for (auto& [memory, block] : slabBlocks) freeBlock(*block);
 }
 
-VkDeviceMemory BufferPool::AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType) {
+VkDeviceMemory BufferPool::AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType, bool newImage) {
     if (allocatedType != nullptr) *allocatedType = allocation.memoryTypeIndex;
     VkDeviceMemory memory = VK_NULL_HANDLE;
     auto result = allocateMemory(device, &allocation, nullptr, &memory);
@@ -75,7 +75,7 @@ VkDeviceMemory BufferPool::AllocateMemory(const VkMemoryAllocateInfo& allocation
         }
     }
     if (exhausted(result)) {
-        if (cacheReclaim != nullptr) released = cacheReclaim(ReclaimTarget(allocation.allocationSize));
+        if (cacheReclaim != nullptr) released = cacheReclaim(ReclaimTarget(allocation.allocationSize), newImage);
         if (released != 0) {
             reclaimed += trim();
             memory = VK_NULL_HANDLE;
@@ -146,7 +146,7 @@ bool BufferPool::heapOverBudget() {
     return heapOver;
 }
 
-VkDeviceMemory BufferPool::TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType) {
+VkDeviceMemory BufferPool::TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType, bool newImage) {
     const auto type = allocation.memoryTypeIndex;
     if (imagePooled(allocation.allocationSize, type)) {
         std::lock_guard lock(mutex);
@@ -168,7 +168,7 @@ VkDeviceMemory BufferPool::TakeImageMemory(const VkMemoryAllocateInfo& allocatio
         }
         ++imageMisses;
     }
-    return AllocateMemory(allocation, operation, hostType, allocatedType);
+    return AllocateMemory(allocation, operation, hostType, allocatedType, newImage);
 }
 
 void BufferPool::PutImageMemory(VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept {
@@ -217,7 +217,9 @@ std::size_t BufferPool::RetainedImages() {
 }
 
 VkDeviceSize BufferPool::ReclaimTarget(VkDeviceSize bytes) {
-    return bytes + std::max<VkDeviceSize>(bytes, VkDeviceSize{256} << 20u);
+    const auto reserve = std::max<VkDeviceSize>(bytes, VkDeviceSize{256} << 20u);
+    const auto limit = std::numeric_limits<VkDeviceSize>::max();
+    return bytes > limit - reserve ? limit : bytes + reserve;
 }
 
 bool BufferPool::SlabEligible(std::size_t capacity, VkDeviceSize alignment, VkDeviceSize size, VkDeviceSize atom) {
@@ -454,6 +456,56 @@ bool BufferPool::evictOldestImage(std::vector<BufferAllocation>& evicted) {
     return true;
 }
 
+VkDeviceSize BufferPool::ReclaimIdleDevice(VkDeviceSize bytes, std::chrono::steady_clock::time_point now) {
+    if (bytes == 0) return 0;
+    const auto heaps = std::min<std::uint32_t>(memoryProperties.memoryHeapCount, VK_MAX_MEMORY_HEAPS);
+    if (std::count_if(memoryProperties.memoryHeaps, memoryProperties.memoryHeaps + heaps, [](const auto& heap) { return (heap.flags & VK_MEMORY_HEAP_DEVICE_LOCAL_BIT) != 0; }) != 1) return 0;
+    std::vector<BufferAllocation> evicted;
+    {
+        std::lock_guard lock(mutex);
+        if (!idleRead) {
+            idleRead = now;
+            idleClock = clock;
+            return 0;
+        }
+        if (now < *idleRead) return 0;
+        if (now - *idleRead >= std::chrono::seconds(1)) {
+            reclaimBefore = idleClock;
+            idleClock = clock;
+            idleRead = now;
+        }
+        if (reclaimBefore <= scannedIdleClock) return 0;
+        VkDeviceSize selected = 0;
+        while (selected < bytes) {
+            auto oldest = deviceTier.free.end();
+            for (auto it = deviceTier.free.begin(); it != deviceTier.free.end(); ++it) {
+                if (it->second.empty()) continue;
+                const auto& slot = it->second.front();
+                if (slot.allocation.buffer == VK_NULL_HANDLE || slot.allocation.slab || slot.lastUse > reclaimBefore) continue;
+                if (oldest == deviceTier.free.end() || slot.lastUse < oldest->second.front().lastUse) oldest = it;
+            }
+            if (oldest == deviceTier.free.end()) {
+                scannedIdleClock = reclaimBefore;
+                break;
+            }
+            if (evicted.empty()) evicted.reserve(deviceTier.slots);
+            const auto allocation = oldest->second.front().allocation;
+            evicted.push_back(allocation);
+            selected += allocation.allocationBytes;
+            deviceTier.retainedBytes -= allocation.allocationBytes;
+            oldest->second.pop_front();
+            if (oldest->second.empty()) deviceTier.free.erase(oldest);
+            --deviceTier.slots;
+            ++deviceTier.evictions;
+        }
+    }
+    VkDeviceSize released = 0;
+    for (const auto& allocation : evicted) released += destroy(allocation);
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (profile && released != 0) AgcDriver::ProfilePrint_nid_no_patch("[bufferpool] idle device reclaim: %llu bytes released for %llu bytes of storage-cache pressure\n", static_cast<unsigned long long>(released), static_cast<unsigned long long>(bytes));
+    return released;
+}
+
 std::size_t BufferPool::MaxSlots() {
     // APS5_BUFFER_POOL_SLOTS=<n> bounds the retained allocations; 64 is the capacity the pool had
     // before least-recently-used retention, for A/B runs.
@@ -533,8 +585,8 @@ std::shared_ptr<BufferPool> GetBufferPool(const Context& context) {
     return context.bufferPool;
 }
 
-VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType) {
-    return GetBufferPool(context)->TakeImageMemory(allocation, operation, context.RefusedDeviceMemoryFallback(mask, allocation.memoryTypeIndex), allocatedType);
+VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType, bool newImage) {
+    return GetBufferPool(context)->TakeImageMemory(allocation, operation, context.RefusedDeviceMemoryFallback(mask, allocation.memoryTypeIndex), allocatedType, newImage);
 }
 
 void ReleaseImageMemory(const Context& context, VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp
index 498e656ce0..94751531e6 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp
@@ -521,9 +521,9 @@ DccKeys textureClearKeys(const GuestTextureResource& resource, std::uint64_t gue
     if (const auto known = WaitForKeyWriters(resource, guestBytes)) keys = *known;
     else keys = currentDccKeys(resource.dccAddress, DccKeyBytes(guestBytes), memoized);
     if (keys == DccKeys::Uncompressed || (keys == DccKeys::ClearSingle && SingleKeysReadable(resource))) return keys;
-    if (IsConvertedTextureFormat(resource.format) && (keys == DccKeys::Clear0001 || keys == DccKeys::Clear1110)) throw std::runtime_error(std::string("AGC graphics: DCC clear code ") + DccKeysName(keys) + " of converted texture format " + std::to_string(resource.format) + " is not implemented");
+    if (DccClearTextureFormat(resource.format) == ResolveTextureFormat(resource.format) && IsConvertedTextureFormat(resource.format) && (keys == DccKeys::Clear0001 || keys == DccKeys::Clear1110)) throw std::runtime_error(std::string("AGC graphics: DCC clear code ") + DccKeysName(keys) + " of converted texture format " + std::to_string(resource.format) + " is not implemented");
     std::byte probe[16]{};
-    if (!IsDccClear(keys) || !FillDccClear(ResolveTextureFormat(resource.format), keys, resource.dccAlphaOnMsb, std::span(probe, std::min<std::size_t>(sizeof(probe), BytesPerElement(resource.format))))) {
+    if (!IsDccClear(keys) || !FillDccClear(DccClearTextureFormat(resource.format), keys, resource.dccAlphaOnMsb, std::span(probe, std::min<std::size_t>(sizeof(probe), BytesPerElement(resource.format))))) {
         static AgcDriver::Mutex reportedMutex;
         static std::set<std::pair<std::uint64_t, int>> reported;
         std::lock_guard lock(reportedMutex);
@@ -665,7 +665,10 @@ bool FillDccClear(VkFormat format, DccKeys keys, bool alphaOnMsb, std::span<std:
         return true;
     }
     Layout layout{};
-    if (!IsDccClear(keys) || keys == DccKeys::ClearRegister || !LayoutFor(format, layout)) return false;
+    if (!IsDccClear(keys) || keys == DccKeys::ClearRegister || !LayoutFor(format, layout)) {
+        std::fill(bytes.begin(), bytes.end(), std::byte{0});
+        return false;
+    }
     const bool color = keys == DccKeys::Clear1110 || keys == DccKeys::Clear1111;
     const bool alpha = keys == DccKeys::Clear0001 || keys == DccKeys::Clear1111;
     const int alphaChannel = layout.channels == 3 ? -1 : alphaOnMsb ? static_cast<int>(layout.channels) - 1 : 0;
@@ -680,7 +683,9 @@ bool FillDccClear(VkFormat format, DccKeys keys, bool alphaOnMsb, std::span<std:
             if (((value >> i) & 1u) != 0) element[bit / 8u] |= static_cast<std::byte>(1u << (bit % 8u));
         }
     }
-    for (std::size_t offset = 0; offset + element.size() <= bytes.size(); offset += element.size()) std::memcpy(bytes.data() + offset, element.data(), element.size());
+    std::size_t offset = 0;
+    for (; offset + element.size() <= bytes.size(); offset += element.size()) std::memcpy(bytes.data() + offset, element.data(), element.size());
+    std::fill(bytes.begin() + offset, bytes.end(), std::byte{0});
     return true;
 }
 
@@ -771,7 +776,7 @@ void ReadTextureSurface(const GuestTextureResource& resource, DccKeys keys, std:
     // Named for the [hooksync] attribution: the read goes through the flush hook.
     const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::TextureRead);
     if (keys == DccKeys::Uncompressed || keys == DccKeys::ClearSingle) GuestMemory::ReadCommitted(resource.baseAddress, bytes);
-    else FillDccClear(ResolveTextureFormat(resource.format), keys, resource.dccAlphaOnMsb, bytes);
+    else FillDccClear(DccClearTextureFormat(resource.format), keys, resource.dccAlphaOnMsb, bytes);
     if (keys == DccKeys::ClearSingle) ExpandSingleBlocks(bytes, BytesPerElement(resource.format));
 }
 
@@ -818,7 +823,7 @@ namespace {
 DccKeys EncodedKeys(const GuestTextureResource& resource, DccKeys keys) {
     if (keys == DccKeys::ClearSingle && SingleKeysReadable(resource)) return keys;
     std::byte probe[16]{};
-    if (!IsDccClear(keys) || !FillDccClear(ResolveTextureFormat(resource.format), keys, resource.dccAlphaOnMsb, std::span(probe, std::min<std::size_t>(sizeof(probe), BytesPerElement(resource.format))))) return DccKeys::Uncompressed;
+    if (!IsDccClear(keys) || !FillDccClear(DccClearTextureFormat(resource.format), keys, resource.dccAlphaOnMsb, std::span(probe, std::min<std::size_t>(sizeof(probe), BytesPerElement(resource.format))))) return DccKeys::Uncompressed;
     return keys;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp
new file mode 100644
index 0000000000..1fb049628a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp
@@ -0,0 +1,134 @@
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
+#include <atomic>
+#include <cstring>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+namespace AgcDriver::Graphics {
+
+namespace {
+
+constexpr std::size_t DrainObjects = 512;
+constexpr auto DrainAge = std::chrono::milliseconds(100);
+
+struct Deferred {
+    PFN_vkDestroyBuffer destroyBuffer = nullptr;
+    PFN_vkFreeMemory freeMemory = nullptr;
+    std::vector<VkBuffer> buffers;
+    std::vector<VkDeviceMemory> memory;
+    std::chrono::steady_clock::time_point oldest{};
+};
+
+struct Registry {
+    std::mutex mutex;
+    std::unordered_map<VkDevice, Deferred> devices;
+    std::atomic<PFN_vkGetDeviceProcAddr> resolver{nullptr};
+};
+
+Registry& registry() {
+    static auto& state = *new Registry();
+    return state;
+}
+
+void destroyAll(VkDevice device, const Deferred& deferred) noexcept {
+    for (const auto buffer : deferred.buffers) deferred.destroyBuffer(device, buffer, nullptr);
+    for (const auto memory : deferred.memory) deferred.freeMemory(device, memory, nullptr);
+}
+
+template<typename THandle>
+bool defer(VkDevice device, THandle handle, std::vector<THandle> Deferred::*list) noexcept {
+    try {
+        auto& state = registry();
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(device);
+        if (found == state.devices.end()) return false;
+        auto& deferred = found->second;
+        if (deferred.buffers.empty() && deferred.memory.empty()) deferred.oldest = std::chrono::steady_clock::now();
+        (deferred.*list).push_back(handle);
+        return true;
+    } catch (...) {
+        return false;
+    }
+}
+
+VKAPI_ATTR void VKAPI_CALL deferredDestroyBuffer(VkDevice device, VkBuffer buffer, const VkAllocationCallbacks* allocator) {
+    if (buffer == VK_NULL_HANDLE || defer(device, buffer, &Deferred::buffers)) return;
+    reinterpret_cast<PFN_vkDestroyBuffer>(registry().resolver.load(std::memory_order_acquire)(device, "vkDestroyBuffer"))(device, buffer, allocator);
+}
+
+VKAPI_ATTR void VKAPI_CALL deferredFreeMemory(VkDevice device, VkDeviceMemory memory, const VkAllocationCallbacks* allocator) {
+    if (memory == VK_NULL_HANDLE || defer(device, memory, &Deferred::memory)) return;
+    reinterpret_cast<PFN_vkFreeMemory>(registry().resolver.load(std::memory_order_acquire)(device, "vkFreeMemory"))(device, memory, allocator);
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL deferringDeviceProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkDestroyBuffer") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&deferredDestroyBuffer);
+    if (std::strcmp(name, "vkFreeMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&deferredFreeMemory);
+    return registry().resolver.load(std::memory_order_acquire)(device, name);
+}
+
+}
+
+PFN_vkGetDeviceProcAddr DeferDestructionToIdle(VkDevice device, PFN_vkGetDeviceProcAddr resolver) {
+    if (device == VK_NULL_HANDLE || resolver == nullptr) throw std::invalid_argument("AGC graphics: deferred destruction needs a device and its resolver");
+    Deferred deferred;
+    deferred.destroyBuffer = reinterpret_cast<PFN_vkDestroyBuffer>(resolver(device, "vkDestroyBuffer"));
+    deferred.freeMemory = reinterpret_cast<PFN_vkFreeMemory>(resolver(device, "vkFreeMemory"));
+    if (deferred.destroyBuffer == nullptr || deferred.freeMemory == nullptr) throw std::runtime_error("AGC graphics: missing Vulkan function: vkDestroyBuffer or vkFreeMemory");
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    const auto current = state.resolver.load(std::memory_order_acquire);
+    if (current != nullptr && current != resolver) throw std::runtime_error("AGC graphics: deferred destruction found two different device resolvers");
+    if (!state.devices.emplace(device, std::move(deferred)).second) throw std::runtime_error("AGC graphics: deferred destruction was set up twice for one device");
+    state.resolver.store(resolver, std::memory_order_release);
+    return &deferringDeviceProc;
+}
+
+void DestroyDeferredAtIdle(const Context& context, std::chrono::steady_clock::time_point now) {
+    auto& state = registry();
+    {
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(context.device);
+        if (found == state.devices.end()) return;
+        const auto objects = found->second.buffers.size() + found->second.memory.size();
+        if (objects == 0 || (objects < DrainObjects && now - found->second.oldest < DrainAge)) return;
+    }
+    const auto idle = context.Function<PFN_vkQueueWaitIdle>("vkQueueWaitIdle")(context.queue);
+    if (idle != VK_SUCCESS && idle != VK_ERROR_DEVICE_LOST) throw std::runtime_error("AGC graphics: vkQueueWaitIdle before destroying deferred objects: Vulkan result " + std::to_string(idle));
+    Deferred taken;
+    {
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(context.device);
+        if (found == state.devices.end()) return;
+        taken.destroyBuffer = found->second.destroyBuffer;
+        taken.freeMemory = found->second.freeMemory;
+        taken.buffers.swap(found->second.buffers);
+        taken.memory.swap(found->second.memory);
+    }
+    destroyAll(context.device, taken);
+}
+
+void DestroyDeferredObjects(VkDevice device) noexcept {
+    Deferred taken;
+    {
+        auto& state = registry();
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(device);
+        if (found == state.devices.end()) return;
+        taken = std::move(found->second);
+        state.devices.erase(found);
+    }
+    destroyAll(device, taken);
+}
+
+std::size_t DeferredObjects(VkDevice device) {
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    const auto found = state.devices.find(device);
+    return found == state.devices.end() ? 0 : found->second.buffers.size() + found->second.memory.size();
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
index 16403dc9df..f498c73896 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
@@ -427,8 +427,8 @@ public:
         return (ResolveTextureFormat(resource.format) == expected || depthBits || UnormStencilView(resource)) && oneSlice && resource.width == target.extent.width && resource.height == target.extent.height && resource.baseLevel == 0 && resource.lastLevel == 0 && resource.baseArray == 0;
     }
 
-    std::shared_ptr<Texture> Sampled(std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, bool drawn = false, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D) {
-        CheckCurrent();
+    std::shared_ptr<Texture> Sampled(std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, bool drawn = false, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D, bool copySource = false) {
+        if (!copySource) CheckCurrent();
         CheckResource(resource);
         std::array<std::uint32_t, 13> key{};
         std::copy_n(words.begin(), std::min<std::size_t>(words.size(), 8), key.begin());
@@ -468,7 +468,7 @@ public:
         const auto sampledImage = useSampleShadow ? sampleShadow : owned;
         auto texture = std::make_shared<Texture>(context, useSampleShadow ? sampleShadow->image : image, hostFormat, stencil ? VK_IMAGE_ASPECT_STENCIL_BIT : VK_IMAGE_ASPECT_DEPTH_BIT, components, viewType, 0, sampledImage);
         if (multisampled) {
-            Require(samplingActive, "native multisample depth sampling requires its creation-time owner");
+            Require(copySource || samplingActive, "native multisample depth sampling requires its creation-time owner");
             texture->MarkRefreshedPerUse();
         }
         textures.emplace(key, texture);
@@ -511,30 +511,6 @@ public:
         else Recorder::CountBarriers(Recorder::CommandClass::Draw, 2);
     }
 
-    void CopySample(std::uint32_t sample, StorageTexture& destination, VkImageView destinationView) {
-        auto* recorder = Recorder::Active();
-        Require(recorder != nullptr, "depth sample copies need an active recorder");
-        Require(sampleable, "DB depth copy from a depth surface the device cannot sample at its sample count");
-        ApplyFastClear();
-        if (useSampleShadow) {
-            if (sampleShadow == nullptr) createSampleShadow();
-            refreshSampleShadow(false);
-            recorder->Keep(sampleShadow);
-        }
-        if (depthView == VK_NULL_HANDLE) {
-            VkImageViewCreateInfo viewInfo{VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO};
-            viewInfo.image = useSampleShadow ? sampleShadow->image : image;
-            viewInfo.viewType = VK_IMAGE_VIEW_TYPE_2D;
-            viewInfo.format = hostFormat;
-            viewInfo.subresourceRange = {VK_IMAGE_ASPECT_DEPTH_BIT, 0, 1, 0, 1};
-            Check(context.Function<PFN_vkCreateImageView>("vkCreateImageView")(context.device, &viewInfo, nullptr, &depthView), "vkCreateImageView depth sample copy");
-        }
-        Require(context.detiler != nullptr, "depth sample copies need the texture detiler");
-        context.detiler->DispatchDepthSample(recorder->Commands(), depthView, target.samples > 1, destinationView, target.extent.width, target.extent.height, sample);
-        Recorder::CountBarriers(Recorder::CommandClass::Copy, 2);
-        destination.MarkDirty();
-    }
-
     bool Holds(const Texture* texture) const {
         const auto held = [&](const auto& entry) { return entry.second.get() == texture; };
         return std::any_of(textures.begin(), textures.end(), held) || std::any_of(stencilCopy.textures.begin(), stencilCopy.textures.end(), held);
@@ -743,10 +719,30 @@ public:
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT);
         context.Function<PFN_vkCmdCopyImageToBuffer>("vkCmdCopyImageToBuffer")(commands, storage->Image(), VK_IMAGE_LAYOUT_GENERAL, depthPlane.staging->Handle(), 1, &colorRegion);
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
-        context.Function<PFN_vkCmdCopyBufferToImage>("vkCmdCopyBufferToImage")(commands, depthPlane.staging->Handle(), image, VK_IMAGE_LAYOUT_GENERAL, 1, &depthRegion);
-        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT);
+        if (target.stencilAddress == 0) {
+            VkImageMemoryBarrier discard{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
+            discard.dstAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+            discard.oldLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+            discard.newLayout = VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL;
+            discard.srcQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+            discard.dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+            discard.image = image;
+            discard.subresourceRange = {VK_IMAGE_ASPECT_DEPTH_BIT, 0, 1, 0, 1};
+            const auto barrier = context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier");
+            barrier(commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 0, nullptr, 0, nullptr, 1, &discard);
+            context.Function<PFN_vkCmdCopyBufferToImage>("vkCmdCopyBufferToImage")(commands, depthPlane.staging->Handle(), image, VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL, 1, &depthRegion);
+            VkImageMemoryBarrier toGeneral = discard;
+            toGeneral.srcAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+            toGeneral.dstAccessMask = VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT;
+            toGeneral.oldLayout = VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL;
+            toGeneral.newLayout = VK_IMAGE_LAYOUT_GENERAL;
+            barrier(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, 0, 0, nullptr, 0, nullptr, 1, &toGeneral);
+        } else {
+            context.Function<PFN_vkCmdCopyBufferToImage>("vkCmdCopyBufferToImage")(commands, depthPlane.staging->Handle(), image, VK_IMAGE_LAYOUT_GENERAL, 1, &depthRegion);
+            RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT);
+        }
         if (batch) batch->SubmitAndWait();
-        else Recorder::CountBarriers(Recorder::CommandClass::Copy, 3);
+        else Recorder::CountBarriers(Recorder::CommandClass::Copy, target.stencilAddress == 0 ? 4 : 3);
     }
 
     std::shared_ptr<StorageTexture> Mirror(const GuestTextureResource& resource) {
@@ -915,7 +911,6 @@ public:
     const VkFormat hostFormat;
     VkImage image = VK_NULL_HANDLE;
     VkImageView view = VK_NULL_HANDLE;
-    VkImageView depthView = VK_NULL_HANDLE;
     VkDeviceMemory memory = VK_NULL_HANDLE;
     std::shared_ptr<std::atomic<bool>> active = std::make_shared<std::atomic<bool>>(true);
     bool sampleable = true;
@@ -1175,7 +1170,6 @@ private:
         releaseStencilCopy();
         mirrorPlane = {};
         textures.clear();
-        if (depthView) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, depthView, nullptr);
         if (view) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, view, nullptr);
         if (owned != nullptr) owned.reset();
         else {
@@ -1218,8 +1212,8 @@ public:
             allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
             memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth plane copy");
             Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory depth plane copy");
-            stagingSize = static_cast<std::size_t>(sliceBytes()) * layers;
-            staging = std::make_unique<DeviceBuffer>(context, stagingSize, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+            imageBytes = requirements.size;
+            owned = std::make_shared<OwnedImage>(context, image, memory);
         } catch (...) {
             release();
             throw;
@@ -1238,12 +1232,7 @@ public:
             std::snprintf(text, sizeof(text), "AGC graphics: depth plane copy geometry does not match its layers (copy %ux%u, %u layers, %llu bytes a slice; texture %ux%u guest format %u, dimension %d, tile mode %u, %u layers, %llu bytes a slice, %zu mips)", extent.width, extent.height, layers, static_cast<unsigned long long>(sliceBytes()), resource.width, resource.height, resource.format, static_cast<int>(resource.dimension), resource.tileMode, geometry.layers, static_cast<unsigned long long>(geometry.sliceLinearBytes), geometry.mips.size());
             throw std::runtime_error(text);
         }
-        const auto stagingBytes = static_cast<std::size_t>(geometry.sliceLinearBytes) * layers;
-        if (stagingBytes > stagingSize) {
-            retiredStaging.push_back(std::move(staging));
-            staging = std::make_unique<DeviceBuffer>(context, stagingBytes, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
-            stagingSize = stagingBytes;
-        }
+        const auto stagingBytes = std::max<std::size_t>(static_cast<std::size_t>(geometry.sliceLinearBytes), static_cast<std::size_t>(sliceBytes())) * layers;
         std::vector<std::shared_ptr<Buffer>> uploads;
         std::vector<std::uint32_t> uploadLayers;
         std::vector<std::uint32_t> copiedLayers;
@@ -1258,8 +1247,10 @@ public:
                 continue;
             }
             surface = {};
-            const GuestLayer current{resource.baseAddress + geometry.GuestLayerOffset(layer), geometry.layerBytes, resource.tileMode, geometry.thick, GuestMemory::CollectWrites(resource.baseAddress + geometry.GuestLayerOffset(layer), static_cast<std::size_t>(geometry.layerBytes))};
-            if (held.generation != 0 && held.address == current.address && held.bytes == current.bytes && held.tileMode == current.tileMode && held.thick == current.thick && !Recorder::SnapshotWriteOverlaps(current.address, static_cast<std::size_t>(current.bytes)) && GuestMemory::UnchangedSince(current.address, static_cast<std::size_t>(current.bytes), held.generation)) {
+            GuestLayer current{resource.baseAddress + geometry.GuestLayerOffset(layer), geometry.layerBytes, resource.tileMode, geometry.thick, GuestMemory::CollectWrites(resource.baseAddress + geometry.GuestLayerOffset(layer), static_cast<std::size_t>(geometry.layerBytes))};
+            current.uncommitted = current.generation == 0 && GuestMemory::CommittedRanges(current.address, static_cast<std::size_t>(current.bytes)).empty();
+            const bool unchanged = current.uncommitted ? held.uncommitted : held.generation != 0 && GuestMemory::UnchangedSince(current.address, static_cast<std::size_t>(current.bytes), held.generation);
+            if (held.address == current.address && held.bytes == current.bytes && held.tileMode == current.tileMode && held.thick == current.thick && !Recorder::SnapshotWriteOverlaps(current.address, static_cast<std::size_t>(current.bytes)) && unchanged) {
                 held.generation = current.generation;
                 continue;
             }
@@ -1269,11 +1260,14 @@ public:
             uploadLayers.push_back(layer);
             held = current;
         }
-        if (!copiedLayers.empty() || !uploads.empty()) record(slices, resource, geometry, copiedLayers, uploads, uploadLayers);
+        if (!copiedLayers.empty() || !uploads.empty()) {
+            if (staging == nullptr || stagingBytes > staging->Size()) staging = std::make_shared<DeviceBuffer>(context, stagingBytes, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+            record(slices, resource, geometry, copiedLayers, uploads, uploadLayers, staging);
+        }
         const std::array<std::uint32_t, 6> key{static_cast<std::uint32_t>(components.r), static_cast<std::uint32_t>(components.g), static_cast<std::uint32_t>(components.b), static_cast<std::uint32_t>(components.a), static_cast<std::uint32_t>(viewType), baseLayer};
         auto& texture = textures[key];
         if (texture == nullptr) {
-            texture = std::make_shared<Texture>(context, image, format, aspect(), components, viewType, baseLayer);
+            texture = std::make_shared<Texture>(context, image, format, aspect(), components, viewType, baseLayer, owned);
             texture->MarkRefreshedPerUse();
         }
         return texture;
@@ -1283,6 +1277,9 @@ public:
     const VkExtent2D extent;
     const VkFormat format;
     const std::uint32_t layers;
+    VkDeviceSize imageBytes = 0;
+    std::uint64_t lastUse = 0;
+    VkDeviceSize HeldBytes() const { return imageBytes + (staging != nullptr ? staging->Size() : 0u); }
 
 private:
     struct GuestLayer {
@@ -1291,19 +1288,19 @@ private:
         TextureTileMode tileMode = TextureTileMode::kLinear;
         bool thick = false;
         std::uint64_t generation = 0;
+        bool uncommitted = false;
     };
 
     VkImage image = VK_NULL_HANDLE;
     VkDeviceMemory memory = VK_NULL_HANDLE;
-    std::unique_ptr<DeviceBuffer> staging;
-    std::size_t stagingSize = 0;
-    std::vector<std::unique_ptr<DeviceBuffer>> retiredStaging;
+    std::shared_ptr<OwnedImage> owned;
+    std::shared_ptr<DeviceBuffer> staging;
     std::map<std::array<std::uint32_t, 6>, std::shared_ptr<Texture>> textures;
     std::vector<GuestLayer> guestLayers;
     std::vector<DepthPlaneSlice> surfaceLayers;
     bool filled = false;
 
-    void record(std::span<const DepthPlaneSlice> slices, const GuestTextureResource& resource, const SurfaceGeometry& geometry, std::span<const std::uint32_t> copiedLayers, std::span<const std::shared_ptr<Buffer>> uploads, std::span<const std::uint32_t> uploadLayers) {
+    void record(std::span<const DepthPlaneSlice> slices, const GuestTextureResource& resource, const SurfaceGeometry& geometry, std::span<const std::uint32_t> copiedLayers, std::span<const std::shared_ptr<Buffer>> uploads, std::span<const std::uint32_t> uploadLayers, const std::shared_ptr<DeviceBuffer>& staging) {
         if (!uploads.empty()) {
             Require(context.detiler != nullptr, "depth plane copy requires a texture detiler");
             context.detiler->BeginBatch();
@@ -1360,7 +1357,11 @@ private:
         barrier(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, 0, 0, nullptr, 0, nullptr, 1, &toGeneral);
         filled = true;
         if (batch) batch->SubmitAndWait();
-        else Recorder::CountBarriers(Recorder::CommandClass::Draw, 3);
+        else {
+            Recorder::CountBarriers(Recorder::CommandClass::Draw, 3);
+            recorder->Keep(staging, staging->Size());
+            if (owned != nullptr) recorder->Keep(owned);
+        }
     }
 
     VkDeviceSize sliceBytes() const {
@@ -1374,8 +1375,11 @@ private:
     void release() noexcept {
         textures.clear();
         staging.reset();
-        if (image) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, image, nullptr);
-        if (memory) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, memory, nullptr);
+        if (owned != nullptr) owned.reset();
+        else {
+            if (image) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, image, nullptr);
+            if (memory) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, memory, nullptr);
+        }
         image = VK_NULL_HANDLE;
         memory = VK_NULL_HANDLE;
     }
@@ -1386,6 +1390,32 @@ std::map<std::tuple<VkDevice, std::uint64_t, std::uint32_t, std::uint32_t, VkFor
     return *copies;
 }
 
+std::uint64_t& planeCopyClock() {
+    static std::uint64_t clock = 0;
+    return clock;
+}
+
+void evictPlaneCopies(const std::tuple<VkDevice, std::uint64_t, std::uint32_t, std::uint32_t, VkFormat, std::uint32_t>& keep) {
+    static const VkDeviceSize budget = [] {
+        const char* text = std::getenv("APS5_DEPTH_PLANE_COPY_MIB");
+        return static_cast<VkDeviceSize>(text != nullptr ? std::strtoull(text, nullptr, 10) : 256ull) << 20u;
+    }();
+    if (budget == 0) return;
+    auto& copies = planeCopies();
+    VkDeviceSize total = 0;
+    for (const auto& entry : copies) total += entry.second->HeldBytes();
+    while (total > budget) {
+        auto oldest = copies.end();
+        for (auto it = copies.begin(); it != copies.end(); ++it) {
+            if (it->first == keep) continue;
+            if (oldest == copies.end() || it->second->lastUse < oldest->second->lastUse) oldest = it;
+        }
+        if (oldest == copies.end()) break;
+        total -= oldest->second->HeldBytes();
+        copies.erase(oldest);
+    }
+}
+
 struct LayeredSlice {
     DepthSurface* surface;
     std::uint32_t layer;
@@ -1395,6 +1425,7 @@ class LayeredDepthStorage {
 public:
     LayeredDepthStorage(const Context& context, const GuestTextureResource& resource, const DepthTarget& base, std::uint32_t bytesPerTexel, std::uint32_t firstLayer, std::uint32_t layers) : context(context), base(base), extent(base.extent), bytesPerTexel(bytesPerTexel), firstLayer(firstLayer), layers(layers) {
         const auto bytes = DescribeSurface(resource).guestBytes;
+        layerPitchBytes = DescribeSurface(resource).GuestLayerOffset(1);
         StorageTexture::FlushPending(resource.baseAddress, static_cast<std::size_t>(bytes), nullptr, "storage image creation", PublishScope::None);
         storage = StorageTexture::Create(context, *context.detiler, resource, 0);
         Require(storage->ImageLayers() == layers, "a layered depth storage view's image does not hold its layers");
@@ -1448,6 +1479,7 @@ public:
     const std::uint32_t bytesPerTexel;
     const std::uint32_t firstLayer;
     const std::uint32_t layers;
+    std::uint64_t layerPitchBytes = 0;
     std::shared_ptr<StorageTexture> storage;
 
 private:
@@ -1961,20 +1993,15 @@ VkImageView DepthSurfaceView(const Context& context, const DepthTarget& target,
     const bool created = surface == nullptr;
     GuestAllocations::Lease creationLease;
     if (created) {
-        for (const auto& surface : surfaces()) {
-            if (!surface->active->load(std::memory_order_acquire) || !surface->samplingActive || surface->context.device != context.device) continue;
-            const auto bytes = target.samples == 1u ? DepthSliceBytes(target.extent, target.format == VK_FORMAT_D16_UNORM ? 2u : 4u) : MultisampledDepthBytes_nid_no_patch(target.extent, target.format == VK_FORMAT_D16_UNORM ? 2u : 4u, target.samples);
-            Require(target.address <= std::numeric_limits<std::uint64_t>::max() - bytes && target.htileAddress <= std::numeric_limits<std::uint64_t>::max() - HtileMetadataBytes(target.extent), "native depth attachment range overflows");
-            for (const auto& range : surface->sampling.initial) {
-                Require(target.address >= range.address + range.bytes || range.address >= target.address + bytes, "native multisample depth attachment layout or metadata changed");
-                if (target.stencilAddress != 0u) {
-                    const auto stencilBytes = target.samples == 1u ? DepthSliceBytes(target.extent, 1u) : MultisampledDepthBytes_nid_no_patch(target.extent, 1u, target.samples);
-                    Require(target.stencilAddress <= std::numeric_limits<std::uint64_t>::max() - stencilBytes && (target.stencilAddress >= range.address + range.bytes || range.address >= target.stencilAddress + stencilBytes), "native multisample stencil attachment aliases a resident depth surface");
-                }
-                if (target.htileAddress != 0u) Require(target.htileAddress >= range.address + range.bytes || range.address >= target.htileAddress + HtileMetadataBytes(target.extent), "native multisample depth attachment layout or metadata changed");
-            }
-        }
+        const bool d16 = target.format == VK_FORMAT_D16_UNORM || target.format == VK_FORMAT_D16_UNORM_S8_UINT;
+        const auto depthBytes = target.samples == 1u ? DepthSliceBytes(target.extent, d16 ? 2u : 4u) : MultisampledDepthBytes_nid_no_patch(target.extent, d16 ? 2u : 4u, target.samples);
+        const auto stencilBytes = target.stencilAddress == 0u ? 0u : target.samples == 1u ? DepthSliceBytes(target.extent, 1u) : MultisampledDepthBytes_nid_no_patch(target.extent, 1u, target.samples);
+        const auto metadataBytes = target.htileAddress == 0u ? 0u : HtileMetadataBytes(target.extent);
+        Require(target.address <= std::numeric_limits<std::uint64_t>::max() - depthBytes && target.stencilAddress <= std::numeric_limits<std::uint64_t>::max() - stencilBytes && target.htileAddress <= std::numeric_limits<std::uint64_t>::max() - metadataBytes, "native depth attachment range overflows");
         lock.unlock();
+        RequireNoResidentDepthRead_nid_no_patch(target.address, static_cast<std::size_t>(depthBytes));
+        if (stencilBytes != 0u) RequireNoResidentDepthRead_nid_no_patch(target.stencilAddress, static_cast<std::size_t>(stencilBytes));
+        if (metadataBytes != 0u) RequireNoResidentDepthRead_nid_no_patch(target.htileAddress, static_cast<std::size_t>(metadataBytes));
         auto sampling = target.samples == 1u ? DepthSamplingState{} : prepareDepthSampling(context, target);
         creationLease = target.samples == 1u || !sampling.refusal.empty() ? GuestAllocations::Lease{} : GuestAllocations::GuestAllocationsAcquireAll_nid_postfix();
         lock.lock();
@@ -2096,6 +2123,12 @@ std::vector<std::pair<std::uint64_t, std::uint64_t>> FlushDepthPlanes(std::uint6
             const bool overlapped = !surface->syncing && plane < end && address < plane + planeBytes;
             if (overlapped && (surface->pendingClear & VK_IMAGE_ASPECT_DEPTH_BIT) != 0) surface->MarkAllStale(planeBytes);
             if (overlapped && (scope == DepthPlaneScope::Whole || anyUnit(surface->StaleUnitsIn(planeBytes, address, end)))) {
+                if (GuestMemory::CommittedRanges(plane, static_cast<std::size_t>(planeBytes)).empty()) {
+                    static std::atomic<bool> reported{false};
+                    if (!reported.exchange(true)) std::fprintf(stderr, "[gpu] depth plane 0x%llx+0x%llx was unmapped with GPU results pending; they are dropped\n", static_cast<unsigned long long>(plane), static_cast<unsigned long long>(planeBytes));
+                    surface->ClearStale();
+                    continue;
+                }
                 surface->SyncFromMemory(resource);
                 auto units = scope == DepthPlaneScope::Whole ? surface->staleUnits : surface->StaleUnitsIn(planeBytes, address, end);
                 if (anyUnit(units)) {
@@ -2309,6 +2342,16 @@ void ClearDepthSurfaces(VkDevice device) {
     UpdateResidentImageUnmapObserver_nid_no_patch();
 }
 
+std::size_t DepthPlaneCopyCount() {
+    return planeCopies().size();
+}
+
+namespace {
+
+thread_local bool depthCopySourceActive = false;
+
+}
+
 std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType multisampleViewType) {
     const auto held = [&](const auto& surface) {
         return surface->active->load(std::memory_order_acquire) && surface->context.device == context.device && !surface->retired && (surface->target.address == resource.baseAddress || (surface->target.stencilAddress != 0 && surface->target.stencilAddress == resource.baseAddress));
@@ -2329,12 +2372,17 @@ std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<c
         Require(base.samples > 1u, "multisample reader overlaps a single-sample depth attachment");
         auto* recorder = RecorderFor(context);
         Require(recorder != nullptr, "a native multisampled depth target is sampled only by recorded draws and dispatches");
-        found->CheckCurrent();
-        found->CheckResource(resource);
-        Require(found->pendingClear == 0u, "native multisample depth fast-clear transition is not implemented");
+        if (depthCopySourceActive) {
+            found->CheckResource(resource);
+            found->ApplyFastClear();
+        } else {
+            found->CheckCurrent();
+            found->CheckResource(resource);
+            Require(found->pendingClear == 0u, "native multisample depth fast-clear transition is not implemented");
+        }
         RecordMemoryBarrier(context, recorder->Commands(), VK_PIPELINE_STAGE_EARLY_FRAGMENT_TESTS_BIT | VK_PIPELINE_STAGE_LATE_FRAGMENT_TESTS_BIT | VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT);
         Recorder::CountBarriers(Recorder::CommandClass::Draw, 1);
-        return found->Sampled(words, resource, components, found == drawnDepth, multisampleViewType);
+        return found->Sampled(words, resource, components, found == drawnDepth, multisampleViewType, depthCopySourceActive);
     }
     if (resource.width != base.extent.width || resource.height != base.extent.height || resource.baseLevel != 0) return nullptr;
     const bool d16 = base.format == VK_FORMAT_D16_UNORM || base.format == VK_FORMAT_D16_UNORM_S8_UINT;
@@ -2370,11 +2418,14 @@ std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<c
         else slices.push_back({slice->image, slice == drawnDepth ? 0u : slice->written});
     }
     const auto imageFormat = integer ? VK_FORMAT_R16_UINT : d16 ? VK_FORMAT_D16_UNORM : VK_FORMAT_D32_SFLOAT;
-    auto& copy = planeCopies()[{context.device, base.address, base.extent.width, base.extent.height, imageFormat, layers}];
-    if (copy == nullptr) {
-        copy = std::make_unique<DepthPlaneCopy>(context, base.extent, imageFormat, layers);
-    }
-    return copy->Refresh(slices, resource, components, cube || resource.dimension == TextureDimension::k2DArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D, layered && !cube ? resource.baseArray : 0u);
+    auto& copies = planeCopies();
+    const std::tuple<VkDevice, std::uint64_t, std::uint32_t, std::uint32_t, VkFormat, std::uint32_t> copyKey{context.device, base.address, base.extent.width, base.extent.height, imageFormat, layers};
+    auto& copy = copies[copyKey];
+    if (copy == nullptr) copy = std::make_unique<DepthPlaneCopy>(context, base.extent, imageFormat, layers);
+    copy->lastUse = ++planeCopyClock();
+    auto texture = copy->Refresh(slices, resource, components, cube || resource.dimension == TextureDimension::k2DArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D, layered && !cube ? resource.baseArray : 0u);
+    evictPlaneCopies(copyKey);
+    return texture;
 }
 
 bool DepthSurfaceHolds(const Context& context, const GuestTextureResource& resource, const Texture* texture) {
@@ -2385,7 +2436,7 @@ bool DepthSurfaceHolds(const Context& context, const GuestTextureResource& resou
     std::lock_guard lock(surfacesMutex());
     auto* found = planeSurface(context.device, address);
     if (found == nullptr || !found->Holds(texture)) return false;
-    found->CheckCurrent();
+    if (!depthCopySourceActive) found->CheckCurrent();
     found->CheckResource(resource);
     return true;
 }
@@ -2481,7 +2532,7 @@ std::vector<LayeredSlice> layeredSlices(const Context& context, const LayeredDep
     std::vector<LayeredSlice> slices;
     const auto& list = surfaces();
     for (std::uint32_t layer = storage.firstLayer; layer < storage.layers; ++layer) {
-        const auto address = base.address + static_cast<std::uint64_t>(layer) * DepthSliceBytes(base.extent, storage.bytesPerTexel);
+        const auto address = base.address + static_cast<std::uint64_t>(layer) * storage.layerPitchBytes;
         const auto slice = std::find_if(list.rbegin(), list.rend(), [&](const auto& surface) { return surface->context.device == context.device && !surface->retired && surface->target.address == address && surface->target.extent.width == base.extent.width && surface->target.extent.height == base.extent.height && surface->target.format == base.format && surface->target.samples == 1; });
         if (slice != list.rend()) slices.push_back({slice->get(), layer});
     }
@@ -2494,12 +2545,6 @@ std::shared_ptr<StorageTexture> layeredDepthStorage(const Context& context, Dept
     const bool d16 = target.format == VK_FORMAT_D16_UNORM || target.format == VK_FORMAT_D16_UNORM_S8_UINT;
     const auto bytesPerTexel = d16 ? 2u : 4u;
     surface.RequireStorable(resource);
-    const auto geometry = DescribeSurface(resource);
-    if (layers > 1 && geometry.GuestLayerOffset(1) != DepthSliceBytes(target.extent, bytesPerTexel)) {
-        char text[256];
-        std::snprintf(text, sizeof(text), "AGC graphics: storage image access to the depth planes of depth surface 0x%llx with a layer pitch of 0x%llx bytes, not the depth slice size 0x%llx, is not implemented", static_cast<unsigned long long>(target.address), static_cast<unsigned long long>(geometry.GuestLayerOffset(1)), static_cast<unsigned long long>(DepthSliceBytes(target.extent, bytesPerTexel)));
-        throw std::runtime_error(text);
-    }
     auto& entry = layeredStorages()[{context.device, resource.baseAddress, resource.width, resource.height, layers, resource.format, static_cast<int>(resource.tileMode), static_cast<int>(resource.dimension), resource.baseArray}];
     if (entry == nullptr) entry = std::make_unique<LayeredDepthStorage>(context, resource, target, bytesPerTexel, resource.baseArray, layers);
     else static_cast<void>(entry->storage->Refresh());
@@ -2526,15 +2571,23 @@ std::shared_ptr<StorageTexture> DepthSurfaceStorage(const Context& context, std:
     return layeredDepthStorage(context, surface, resource, mip);
 }
 
-void CopyDepthSample(const Context& context, std::uint64_t depthAddress, std::uint32_t samples, std::uint32_t sample, StorageTexture& destination, VkImageView destinationView, VkExtent2D extent) {
-    std::lock_guard lock(surfacesMutex());
-    auto* found = planeSurface(context.device, depthAddress);
-    Require(found != nullptr && found->target.address == depthAddress, "DB depth copy from a depth plane no draw rendered");
-    Require(found->target.format == VK_FORMAT_D32_SFLOAT || found->target.format == VK_FORMAT_D32_SFLOAT_S8_UINT, "DB depth copy from a depth surface that is not 32-bit float");
-    Require(found->target.samples == samples, "DB depth copy from a depth surface of another sample count");
-    Require(found->target.extent.width == extent.width && found->target.extent.height == extent.height, "DB depth copy from a depth surface of another size");
-    Require(sample < found->target.samples, "DB depth copy of a sample the depth surface does not have");
-    found->CopySample(sample, destination, destinationView);
+DepthCopySourceScope::DepthCopySourceScope(bool active) : previous(depthCopySourceActive) {
+    depthCopySourceActive = active;
+}
+
+DepthCopySourceScope::~DepthCopySourceScope() {
+    depthCopySourceActive = previous;
+}
+
+std::array<std::uint32_t, 8> DepthCopySourceWords(const DepthTarget& target) {
+    const bool multisampled = target.samples != 1u;
+    const auto base = (target.address | target.pipeBankXor) >> 8u;
+    const auto metadata = multisampled ? target.htileAddress >> 8u : 0u;
+    const auto count = static_cast<std::uint32_t>(std::countr_zero(target.samples));
+    const auto width = target.extent.width - 1u, height = target.extent.height - 1u;
+    const auto type = multisampled ? 14u : 9u;
+    const auto word6 = (multisampled && target.iterate256 ? 1u << 10u : 0u) | (multisampled && target.htilePipeAligned ? 1u << 19u : 0u) | (metadata != 0 ? 1u << 21u : 0u) | (static_cast<std::uint32_t>(metadata & 255u) << 24u);
+    return {static_cast<std::uint32_t>(base), static_cast<std::uint32_t>((base >> 32u) & 255u) | (22u << 20u) | ((width & 3u) << 30u), (width >> 2u) | (height << 14u), (type << 28u) | (target.depthSwizzle << 20u) | (count << 16u) | 0x204u, 0u, count << 4u, word6, static_cast<std::uint32_t>(metadata >> 8u)};
 }
 
 bool DepthSurfaceStoreBack(const Context& context, const StorageTexture& storage) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp
index fc04136642..f3dd7f8885 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp
@@ -16,10 +16,12 @@
 #include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "ThreadOwned.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "Optimization/include/Optimization/ShaderStageInputInfo.hpp"
+#include "SpirvBackend/SpirvAnalysis.hpp"
 #include "ThreadOwned.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
 #include <algorithm>
@@ -42,6 +44,184 @@
 
 namespace AgcDriver::Graphics {
 
+namespace {
+
+struct PixelFunctionLdsPool {
+    Context context{};
+    VkBuffer buffer = VK_NULL_HANDLE;
+    VkDeviceMemory memory = VK_NULL_HANDLE;
+    VkDescriptorPool descriptorPool = VK_NULL_HANDLE;
+    VkDescriptorSet set = VK_NULL_HANDLE;
+    VkDescriptorSetLayout empty = VK_NULL_HANDLE;
+    VkDescriptorSetLayout bufferLayout = VK_NULL_HANDLE;
+    std::uint32_t* header = nullptr;
+    std::uint32_t subgroupSize = 0;
+    std::uint32_t slots = 0;
+    bool announced = false;
+};
+
+std::mutex& PixelLdsMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+std::unordered_map<VkDevice, PixelFunctionLdsPool>& PixelLdsPools() {
+    static std::unordered_map<VkDevice, PixelFunctionLdsPool> pools;
+    return pools;
+}
+
+void DestroyPixelFunctionLds(PixelFunctionLdsPool& pool) {
+    if (pool.header != nullptr) pool.context.Function<PFN_vkUnmapMemory>("vkUnmapMemory")(pool.context.device, pool.memory);
+    if (pool.descriptorPool != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(pool.context.device, pool.descriptorPool, nullptr);
+    if (pool.buffer != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(pool.context.device, pool.buffer, nullptr);
+    if (pool.memory != VK_NULL_HANDLE) pool.context.Function<PFN_vkFreeMemory>("vkFreeMemory")(pool.context.device, pool.memory, nullptr);
+    if (pool.bufferLayout != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(pool.context.device, pool.bufferLayout, nullptr);
+    if (pool.empty != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(pool.context.device, pool.empty, nullptr);
+    pool.header = nullptr;
+    pool.descriptorPool = VK_NULL_HANDLE;
+    pool.set = VK_NULL_HANDLE;
+    pool.buffer = VK_NULL_HANDLE;
+    pool.memory = VK_NULL_HANDLE;
+    pool.bufferLayout = VK_NULL_HANDLE;
+    pool.empty = VK_NULL_HANDLE;
+}
+
+}
+
+PixelFunctionLdsLayouts PixelFunctionLdsSetLayouts(const Context& context) {
+    std::lock_guard lock(PixelLdsMutex());
+    auto& pool = PixelLdsPools()[context.device];
+    if (pool.bufferLayout == VK_NULL_HANDLE) {
+        pool.context = context;
+        VkDescriptorSetLayoutCreateInfo emptyInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &emptyInfo, nullptr, &pool.empty), "vkCreateDescriptorSetLayout pixel function LDS empty");
+        const VkDescriptorSetLayoutBinding binding{0u, VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u, VK_SHADER_STAGE_FRAGMENT_BIT, nullptr};
+        VkDescriptorSetLayoutCreateInfo info{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+        info.bindingCount = 1u;
+        info.pBindings = &binding;
+        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &info, nullptr, &pool.bufferLayout), "vkCreateDescriptorSetLayout pixel function LDS");
+    }
+    return {pool.empty, pool.bufferLayout};
+}
+
+void PreparePixelFunctionLds(const Context& context, VkCommandBuffer commands, std::uint32_t subgroupSize) {
+    const auto operations = VK_SUBGROUP_FEATURE_BASIC_BIT | VK_SUBGROUP_FEATURE_BALLOT_BIT;
+    Require((context.subgroup.supportedStages & VK_SHADER_STAGE_FRAGMENT_BIT) != 0 && (context.subgroup.supportedOperations & operations) == operations, "pixel function LDS needs fragment subgroup elect, ballot and broadcast");
+    Require(subgroupSize != 0u && subgroupSize == context.subgroup.subgroupSize, "pixel function LDS subgroup size does not match the device");
+    std::lock_guard lock(PixelLdsMutex());
+    auto& pool = PixelLdsPools()[context.device];
+    Require(pool.bufferLayout != VK_NULL_HANDLE, "pixel function LDS descriptor set layout was not created");
+    if (pool.buffer == VK_NULL_HANDLE) {
+        const auto stride = static_cast<std::uint64_t>(subgroupSize) * ShaderRecompiler::FunctionLdsDwordLimit * 4ull;
+        const auto budget = std::min<std::uint64_t>(context.limits.maxStorageBufferRange, 2ull << 30);
+        Require(budget > 16ull + stride, "pixel function LDS does not fit in the device storage buffer range");
+        pool.slots = static_cast<std::uint32_t>((budget - 16ull) / stride);
+        pool.subgroupSize = subgroupSize;
+        const auto bytes = 16ull + stride * pool.slots;
+        VkBufferCreateInfo bufferInfo{VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO};
+        bufferInfo.size = bytes;
+        bufferInfo.usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT;
+        bufferInfo.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
+        Check(context.Function<PFN_vkCreateBuffer>("vkCreateBuffer")(context.device, &bufferInfo, nullptr, &pool.buffer), "vkCreateBuffer pixel function LDS");
+        VkMemoryRequirements requirements{};
+        context.Function<PFN_vkGetBufferMemoryRequirements>("vkGetBufferMemoryRequirements")(context.device, pool.buffer, &requirements);
+        VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+        allocation.allocationSize = requirements.size;
+        constexpr auto hostCoherent = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT;
+        constexpr auto deviceLocalHost = hostCoherent | VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT;
+        std::optional<std::uint32_t> deviceLocalType;
+        std::optional<std::uint32_t> hostOnlyType;
+        for (std::uint32_t i = 0; i < context.memory.memoryTypeCount; ++i) {
+            if ((requirements.memoryTypeBits & (1u << i)) == 0) continue;
+            const auto flags = context.memory.memoryTypes[i].propertyFlags;
+            const auto heap = context.memory.memoryTypes[i].heapIndex;
+            if (!deviceLocalType && (flags & deviceLocalHost) == deviceLocalHost && context.memory.memoryHeaps[heap].size >= requirements.size) {
+                deviceLocalType = i;
+            }
+            if (!hostOnlyType && (flags & hostCoherent) == hostCoherent && (flags & VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT) == 0) {
+                hostOnlyType = i;
+            }
+        }
+        const auto hostType = hostOnlyType.value_or(context.MemoryType(requirements.memoryTypeBits, hostCoherent));
+        allocation.memoryTypeIndex = deviceLocalType.value_or(hostType);
+        auto allocated = context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &allocation, nullptr, &pool.memory);
+        if (allocated != VK_SUCCESS && deviceLocalType && allocation.memoryTypeIndex == *deviceLocalType && hostType != *deviceLocalType) {
+            allocation.memoryTypeIndex = hostType;
+            allocated = context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &allocation, nullptr, &pool.memory);
+        }
+        if (allocated != VK_SUCCESS) {
+            context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(context.device, pool.buffer, nullptr);
+            pool.buffer = VK_NULL_HANDLE;
+            pool.memory = VK_NULL_HANDLE;
+            Check(allocated, "vkAllocateMemory pixel function LDS");
+        }
+        Check(context.Function<PFN_vkBindBufferMemory>("vkBindBufferMemory")(context.device, pool.buffer, pool.memory, 0), "vkBindBufferMemory pixel function LDS");
+        Check(context.Function<PFN_vkMapMemory>("vkMapMemory")(context.device, pool.memory, 0, 16, 0, reinterpret_cast<void**>(&pool.header)), "vkMapMemory pixel function LDS");
+        pool.header[0] = 0u;
+        pool.header[1] = 0u;
+        pool.header[2] = pool.slots;
+        const VkDescriptorPoolSize size{VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u};
+        VkDescriptorPoolCreateInfo poolInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_POOL_CREATE_INFO};
+        poolInfo.maxSets = 1u;
+        poolInfo.poolSizeCount = 1u;
+        poolInfo.pPoolSizes = &size;
+        Check(context.Function<PFN_vkCreateDescriptorPool>("vkCreateDescriptorPool")(context.device, &poolInfo, nullptr, &pool.descriptorPool), "vkCreateDescriptorPool pixel function LDS");
+        VkDescriptorSetAllocateInfo sets{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_ALLOCATE_INFO};
+        sets.descriptorPool = pool.descriptorPool;
+        sets.descriptorSetCount = 1u;
+        sets.pSetLayouts = &pool.bufferLayout;
+        Check(context.Function<PFN_vkAllocateDescriptorSets>("vkAllocateDescriptorSets")(context.device, &sets, &pool.set), "vkAllocateDescriptorSets pixel function LDS");
+        const VkDescriptorBufferInfo buffer{pool.buffer, 0, bytes};
+        VkWriteDescriptorSet write{VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET};
+        write.dstSet = pool.set;
+        write.dstBinding = 0u;
+        write.descriptorCount = 1u;
+        write.descriptorType = VK_DESCRIPTOR_TYPE_STORAGE_BUFFER;
+        write.pBufferInfo = &buffer;
+        context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, 1u, &write, 0u, nullptr);
+        std::fprintf(stderr, "[gpu] pixel function LDS pool: %u subgroups, %llu MiB, stride %u lanes\n", pool.slots, static_cast<unsigned long long>(bytes >> 20u), subgroupSize);
+        pool.announced = true;
+    }
+    Require(pool.subgroupSize == subgroupSize, "pixel function LDS subgroup size does not match the pool");
+    const VkMemoryBarrier beforeFill{VK_STRUCTURE_TYPE_MEMORY_BARRIER, nullptr, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT};
+    context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_FRAGMENT_SHADER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 1, &beforeFill, 0, nullptr, 0, nullptr);
+    context.Resolved(&DeviceFunctions::cmdFillBuffer, "vkCmdFillBuffer")(commands, pool.buffer, 0, 4, 0u);
+    const VkMemoryBarrier afterFill{VK_STRUCTURE_TYPE_MEMORY_BARRIER, nullptr, VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_HOST_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT};
+    context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TRANSFER_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_FRAGMENT_SHADER_BIT, 0, 1, &afterFill, 0, nullptr, 0, nullptr);
+}
+
+std::uint32_t PixelFunctionLdsSubgroup(std::span<const CompiledShader> shaders) {
+    std::uint32_t subgroup = 0u;
+    for (const auto& shader : shaders) {
+        if (shader.program != nullptr && shader.program->functionLdsBuffer) subgroup = shader.program->hostSubgroupSize;
+    }
+    return subgroup;
+}
+
+void BindPixelFunctionLds(const Context& context, VkCommandBuffer commands, VkPipelineLayout layout) {
+    std::lock_guard lock(PixelLdsMutex());
+    const auto& pool = PixelLdsPools().at(context.device);
+    Require(pool.set != VK_NULL_HANDLE, "pixel function LDS buffer was not prepared");
+    context.Resolved(&DeviceFunctions::cmdBindDescriptorSets, "vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, layout, ShaderRecompiler::PixelFunctionLdsDescriptorSet, 1, &pool.set, 0, nullptr);
+}
+
+void CheckPixelFunctionLds(const Context& context) {
+    std::lock_guard lock(PixelLdsMutex());
+    const auto found = PixelLdsPools().find(context.device);
+    if (found == PixelLdsPools().end() || found->second.header == nullptr) return;
+    const auto exhausted = found->second.header[1] != 0u;
+    found->second.header[1] = 0u;
+    if (exhausted) throw std::runtime_error("AGC graphics: pixel function LDS subgroup slots exhausted");
+}
+
+void ReleasePixelFunctionLds(VkDevice device) {
+    std::lock_guard lock(PixelLdsMutex());
+    const auto found = PixelLdsPools().find(device);
+    if (found == PixelLdsPools().end()) return;
+    DestroyPixelFunctionLds(found->second);
+    PixelLdsPools().erase(found);
+}
+
 std::uint64_t DrawRenderPassKey(const Context& context, const State& state, std::span<const VkImageView> targetViews) {
     std::uint64_t key = 14695981039346656037ull;
     const auto mix = [&](std::uint64_t value) {
@@ -53,6 +233,9 @@ std::uint64_t DrawRenderPassKey(const Context& context, const State& state, std:
         mix(state.blends.size());
         for (const auto& color : state.colors) mix(color.exportIndex);
     }
+    for (const auto& color : state.colors) {
+        if (color.partialWriteMask != 0u) mix(0x6d65726765000000ull | color.exportIndex);
+    }
     mix(state.renderExtent.width);
     mix(state.renderExtent.height);
     mix(state.samples);
@@ -226,6 +409,19 @@ CmaskState readCmask(const ColorTarget& color, const CmaskLayout& layout, std::v
     std::vector<std::byte> mask(bytes);
     GuestMemory::Read(address, mask, CmaskLayout::Alignment);
     const auto uniform = [&](std::byte value) { return std::all_of(mask.begin(), mask.end(), [&](std::byte entry) { return entry == value; }); };
+    if (color.coverageSamples > color.samples) {
+        for (std::uint32_t tileY = 0; tileY < layout.TilesY(); ++tileY) {
+            for (std::uint32_t tileX = 0; tileX < layout.TilesX(); ++tileX) {
+                const auto nibble = layout.Nibble(tileX, tileY);
+                const auto code = (std::to_integer<std::uint32_t>(mask[nibble / 2u]) >> ((nibble % 2u) * 4u)) & 0xfu;
+                if (code != 0u && (code >> 2u) != 3u) {
+                    char text[128];
+                    std::snprintf(text, sizeof(text), "AGC graphics: CMASK code 0x%x of a one-fragment color target is not implemented", code);
+                    throw std::runtime_error(text);
+                }
+            }
+        }
+    }
     if (uniform(std::byte{0xff})) return CmaskState::Expanded;
     if (uniform(std::byte{0})) return CmaskState::Cleared;
     for (std::uint32_t tileY = 0; tileY < layout.TilesY(); ++tileY) {
@@ -282,6 +478,10 @@ bool materializeCmaskClear(const Context& context, const ColorTarget& color, con
     const auto bytes = layout.Bytes();
     Require(color.cmaskBytes == bytes, "CMASK size differs from the color target's CMASK layout");
     if (cmaskProved(color.cmaskAddress, bytes)) return false;
+    if (color.coverageSamples > color.samples) {
+        std::vector<std::uint32_t> codes;
+        static_cast<void>(readCmask(color, layout, codes));
+    }
     auto* recorder = Recorder::Active();
     if (resident != nullptr && context.detiler != nullptr && recorder != nullptr && GuestMemory::GpuMutex().HeldByThisThread()) {
         const auto* import = HostImportFor(context, color.cmaskAddress, bytes);
@@ -354,7 +554,7 @@ constexpr std::array<const char*, PhaseCount> DrawPhaseNames{"validate", "vertex
 enum SyncReason : std::size_t { SyncNone, SyncNotResident, SyncNoRecorder, SyncDisabled, SyncCopiedWrites, SyncLease, SyncCount };
 constexpr std::array<const char*, SyncCount> SyncReasonNames{"none", "non-resident target", "no recorder", "disabled", "copied writes", "lease"};
 constexpr std::size_t IndirectPathCount = static_cast<std::size_t>(IndirectDrawPath::Count);
-constexpr std::array<const char*, IndirectPathCount> IndirectDrawPathNames{"gpu-side", "patched SGPR not folded", "fetch offset unknown", "non-vertex path", "GE_INDX_OFFSET", "draw index", "vertex range too large", "feature gap", "pending image results", "pending label or copied write", "not imported", "disabled", "index range not fully readable"};
+constexpr std::array<const char*, IndirectPathCount> IndirectDrawPathNames{"gpu-side", "patched SGPR not folded", "fetch offset unknown", "non-vertex path", "GE_INDX_OFFSET", "draw index", "vertex range too large", "feature gap", "pending image results", "pending label or copied write", "not imported", "disabled", "index range not fully readable", "index limit unknown"};
 
 // What became of one draw, for the totals.
 struct DrawOutcome {
@@ -581,8 +781,8 @@ void reportDraw(const std::array<double, PhaseCount>& us, const ShaderResources:
     for (std::size_t i = 1; i < profile.recipeMisses.size() && room(); ++i) {
         n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), " %s %llu", DrawRecipeMissName(static_cast<DrawRecipeMiss>(i)), static_cast<unsigned long long>(profile.recipeMisses[i]));
     }
-    std::fprintf(stderr, "%s\n", line);
-    std::fprintf(stderr, "[rescache] draws: %llu hits, %llu misses, %llu invalidated, %llu uncacheable; validation memo %llu hits / %llu misses (which key words the misses differ in: the miss churn line)\n", static_cast<unsigned long long>(profile.cacheHits), static_cast<unsigned long long>(profile.cacheMisses), static_cast<unsigned long long>(profile.cacheInvalidated), static_cast<unsigned long long>(profile.uncacheable), static_cast<unsigned long long>(profile.validateHits), static_cast<unsigned long long>(profile.validateMisses));
+    AgcDriver::ProfilePrint_nid_no_patch("%s\n", line);
+    AgcDriver::ProfilePrint_nid_no_patch("[rescache] draws: %llu hits, %llu misses, %llu invalidated, %llu uncacheable; validation memo %llu hits / %llu misses (which key words the misses differ in: the miss churn line)\n", static_cast<unsigned long long>(profile.cacheHits), static_cast<unsigned long long>(profile.cacheMisses), static_cast<unsigned long long>(profile.cacheInvalidated), static_cast<unsigned long long>(profile.uncacheable), static_cast<unsigned long long>(profile.validateHits), static_cast<unsigned long long>(profile.validateMisses));
     profile.totalsUs.fill(0);
     profile.maxUs.fill(0);
     profile.maxDrawUs = profile.hookWaitUs = profile.maxHookWaitUs = profile.ownSyncUs = 0;
@@ -1096,8 +1296,8 @@ bool StripPatches(const State& state, std::span<const CompiledShader> shaders) {
     return state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP && BarycentricPatches(state, shaders);
 }
 
-std::shared_ptr<Buffer> zeroVertexBuffer(const Context& context, const ShaderRecompiler::VertexAttribute& attribute) {
-    auto zero = std::make_shared<Buffer>(context, DecodeVertexFormat(attribute).bytes, VK_BUFFER_USAGE_VERTEX_BUFFER_BIT);
+std::shared_ptr<Buffer> zeroVertexBuffer(const Context& context, std::size_t bytes) {
+    auto zero = std::make_shared<Buffer>(context, bytes, VK_BUFFER_USAGE_VERTEX_BUFFER_BIT);
     std::fill(zero->Bytes().begin(), zero->Bytes().end(), std::byte{0});
     return zero;
 }
@@ -1143,6 +1343,10 @@ DrawInputs prepareDrawInputs(const Context& context, const State& state, const P
     APS5_LOG_CHARS_OUT_DEBUG("Index buffer range OK");
     Require(!draw.indexed || !state.hasColorTarget || draw.indexAddress + indexBytes <= state.color.address || state.color.address + state.color.bytes <= draw.indexAddress, "index buffer aliases the render target");
     if (draw.indexed) RequireNoMultisampleTarget(draw.indexAddress, static_cast<std::size_t>(indexBytes), "an index buffer read");
+    if (state.pixelKill && !state.pixelEarlyZ && std::ranges::any_of(state.colors, [](const ColorTarget& color) { return color.partialWriteMask != 0; })) {
+        const auto* recorder = Recorder::Active();
+        Require(recorder == nullptr || !recorder->CountingSamples(), "a partial write of a packed color target merges inside the pixel shader after early depth and stencil tests, which a shader that kills pixels under late tests cannot use while occlusion queries count samples: the early tests would count the pixels it kills");
+    }
     APS5_LOG_CHARS_OUT_DEBUG("ValidateShaders");
     if (recipe != nullptr) {
         inputs.fragmentOutputs = recipe->fragmentOutputs;
@@ -1338,14 +1542,19 @@ DrawInputs prepareDrawInputs(const Context& context, const State& state, const P
     fetchValid.reserve(attributes.size());
     std::vector<std::size_t> fetchOf(attributes.size(), 0);
     std::vector<std::shared_ptr<Buffer>> zeroed(attributes.size());
+    const auto& layout = inputs.VertexLayout();
     for (std::size_t i = 0; i < attributes.size(); ++i) {
         const auto& attribute = attributes[i];
+        const auto described = std::find_if(layout.attributes.begin(), layout.attributes.end(), [&](const auto& entry) { return entry.location == attribute.location; });
+        Require(described != layout.attributes.end(), "vertex attribute missing from its input layout");
+        const auto narrow = DecodeVertexFormat(attribute);
+        const std::size_t widened = described->format == narrow.format ? 0u : VertexReadBytes(attribute, described->format) - narrow.bytes;
         if (NullVertexDescriptor(attribute) || VertexFetchOutOfRange(attribute)) {
-            zeroed[i] = zeroVertexBuffer(context, attribute);
+            zeroed[i] = zeroVertexBuffer(context, narrow.bytes + widened);
             continue;
         }
         // An indirect draw's counts are unknown here: the descriptor's whole range is copied.
-        const auto bytes = args != nullptr ? VertexBufferExtent(attribute) : VertexBufferReadSize(attribute, inputs.maxIndex, draw.instanceCount, draw.firstInstance);
+        const auto bytes = (args != nullptr ? VertexBufferExtent(attribute) : VertexBufferReadSize(attribute, inputs.maxIndex, draw.instanceCount, draw.firstInstance)) + widened;
         const auto& fields = attribute.resource.fields;
         const auto address = fields[0] | (static_cast<std::uint64_t>(fields[1] & 0xffffu) << 32u);
         const auto firstByte = args == nullptr ? VertexBufferReadOffset(attribute, draw.firstVertex, draw.firstInstance) : 0;
@@ -1526,16 +1735,24 @@ struct IndirectRecord {
 
 // The draw commands of one draw: the vertex and index buffer binds, then the direct draw, the
 // GPU-side indirect draw from `argumentBuffer` or the CPU-read records with the driver's rules.
-void recordDrawCommands(const Context& context, VkCommandBuffer commands, const State& state, const Pm4::DrawParameters& draw, const DrawInputs& inputs, const IndirectRecord* indirect, VkBuffer argumentBuffer, VkDeviceSize argumentOffset, std::uint32_t firstIndex = 0) {
+void recordDrawCommands(const Context& context, VkCommandBuffer commands, const State& state, const Pm4::DrawParameters& draw, const DrawInputs& inputs, const IndirectRecord* indirect, VkBuffer argumentBuffer, VkDeviceSize argumentOffset, const DrawTraceContext* trace, std::uint32_t& subdraw, std::uint32_t firstIndex = 0) {
     if (context.recorder != nullptr) context.recorder->NoteSampledDraw(commands);
+    const auto recorded = [&](std::uint32_t index) {
+        if (trace != nullptr && context.recorder != nullptr) {
+            context.recorder->NoteDrawTraceToken(trace->token);
+            CaptureTrace::Log("draw-recorded token=%llu batch=%llu submission=%llu queue=%u offset=%zu target=%llx subdraw=%u", static_cast<unsigned long long>(trace->token), static_cast<unsigned long long>(context.recorder->OpenBatchSerial()), static_cast<unsigned long long>(trace->submission), trace->queue, trace->offset, static_cast<unsigned long long>(trace->target), index);
+        }
+    };
     const auto* args = indirect != nullptr ? indirect->args : nullptr;
     if (state.stages.mesh && args != nullptr) {
         context.Function<PFN_vkCmdDrawMeshTasksIndirectEXT>("vkCmdDrawMeshTasksIndirectEXT")(commands, argumentBuffer, argumentOffset, 1, sizeof(VkDrawMeshTasksIndirectCommandEXT));
+        recorded(subdraw++);
         return;
     }
     if (state.stages.mesh) {
         APS5_LOG_OUT_DEBUG("vkCmdDrawMeshTasksEXT groups=%u instances=%u", inputs.meshGroups, draw.instanceCount);
         context.Function<PFN_vkCmdDrawMeshTasksEXT>("vkCmdDrawMeshTasksEXT")(commands, inputs.meshGroups, draw.instanceCount, 1);
+        recorded(subdraw++);
         return;
     }
     if (!inputs.vertexHandles.empty()) context.Resolved(&DeviceFunctions::cmdBindVertexBuffers, "vkCmdBindVertexBuffers")(commands, 0, static_cast<std::uint32_t>(inputs.vertexHandles.size()), inputs.vertexHandles.data(), inputs.vertexOffsets.data());
@@ -1546,8 +1763,13 @@ void recordDrawCommands(const Context& context, VkCommandBuffer commands, const
     }
     if (draw.indexed) context.Resolved(&DeviceFunctions::cmdBindIndexBuffer, "vkCmdBindIndexBuffer")(commands, inputs.indexHandle, inputs.indexOffset, draw.indexSize == 2 ? VK_INDEX_TYPE_UINT16 : VK_INDEX_TYPE_UINT32);
     if (args == nullptr) {
-        if (draw.indexed) context.Resolved(&DeviceFunctions::cmdDrawIndexed, "vkCmdDrawIndexed")(commands, draw.indexCount, draw.instanceCount, firstIndex, static_cast<std::int32_t>(draw.firstVertex), draw.firstInstance);
-        else context.Resolved(&DeviceFunctions::cmdDraw, "vkCmdDraw")(commands, draw.indexCount, draw.instanceCount, draw.firstVertex, draw.firstInstance);
+        if (draw.indexed) {
+            context.Resolved(&DeviceFunctions::cmdDrawIndexed, "vkCmdDrawIndexed")(commands, draw.indexCount, draw.instanceCount, firstIndex, static_cast<std::int32_t>(draw.firstVertex), draw.firstInstance);
+            recorded(subdraw++);
+        } else {
+            context.Resolved(&DeviceFunctions::cmdDraw, "vkCmdDraw")(commands, draw.indexCount, draw.instanceCount, draw.firstVertex, draw.firstInstance);
+            recorded(subdraw++);
+        }
     } else if (indirect->path == IndirectDrawPath::Gpu) {
         if (args->countIndirect) {
             if (draw.indexed) context.Function<PFN_vkCmdDrawIndexedIndirectCountKHR>("vkCmdDrawIndexedIndirectCountKHR")(commands, argumentBuffer, argumentOffset, indirect->countImport->buffer, HostImportOffset(*indirect->countImport, args->countAddress), args->count, args->stride);
@@ -1699,7 +1921,7 @@ struct Kept {
 // The completion side of a recorded draw: the kept objects, the record check, the lease outcome,
 // the GPU write notes, the copied-buffer write-back (listed in DrawCopiedWriters or run as a
 // completion action) and the targets marked dirty.
-void keepRecordedDraw(Recorder& recorder, const std::shared_ptr<ShaderResources>& resources, std::shared_ptr<Pipeline> pipeline, std::shared_ptr<Framebuffer> framebuffer, DrawInputs& inputs, std::vector<std::shared_ptr<StorageTexture>> targets, std::vector<std::pair<std::uint32_t, std::uint32_t>> slices, std::unique_ptr<DeviceBuffer> scratch, std::function<void()> checkRecords, bool listed, bool completion, const DrawOutcome& outcome) {
+void keepRecordedDraw(Recorder& recorder, const std::shared_ptr<ShaderResources>& resources, std::shared_ptr<Pipeline> pipeline, std::shared_ptr<Framebuffer> framebuffer, DrawInputs& inputs, std::vector<std::shared_ptr<StorageTexture>> targets, std::vector<std::pair<std::uint32_t, std::uint32_t>> slices, VkRect2D scissor, std::unique_ptr<DeviceBuffer> scratch, std::function<void()> checkRecords, bool listed, bool completion, const DrawOutcome& outcome) {
     auto kept = std::make_shared<Kept>();
     kept->resources = resources;
     kept->pipeline = std::move(pipeline);
@@ -1739,14 +1961,15 @@ void keepRecordedDraw(Recorder& recorder, const std::shared_ptr<ShaderResources>
         if (resources->Reusable()) recorder.OnComplete([resources] { resources->CheckFaults(); });
         else recorder.OnComplete([resources] { resources->WriteBackBuffers(); });
     }
+    std::vector<bool> storeNow(residents.size(), false);
     for (std::size_t index = 0; index < residents.size(); ++index) {
         if (residents[index] == nullptr) continue;
-        if (index < slices.size()) residents[index]->MarkSliceDirty(slices[index].first, slices[index].second);
+        if (residents[index]->Descriptor().tileMode == TextureTileMode::kLinear) storeNow[index] = !residents[index]->MarkDrawn(index < slices.size() ? slices[index].first : 0u, index < slices.size() ? slices[index].second : 0u, scissor) || !residents[index]->Cached();
+        else if (index < slices.size()) residents[index]->MarkSliceDirty(slices[index].first, slices[index].second);
         else residents[index]->MarkDirty();
     }
-    for (const auto& resident : residents) {
-        if (resident == nullptr || resident->Descriptor().tileMode != TextureTileMode::kLinear) continue;
-        StorageTexture::FlushPending(resident->Descriptor().baseAddress, static_cast<std::size_t>(resident->GuestBytes()), nullptr, "linear target");
+    for (std::size_t index = 0; index < residents.size(); ++index) {
+        if (storeNow[index]) StorageTexture::FlushPending(residents[index]->Descriptor().baseAddress, static_cast<std::size_t>(residents[index]->GuestBytes()), nullptr, "linear target");
     }
 }
 
@@ -1800,6 +2023,7 @@ void recordStencilReplay(const Context& context, VkCommandBuffer commands, const
     const auto referenceOffset = fragment->pushConstantOffset + fragment->program->stencilReferenceDword * sizeof(std::uint32_t);
     Require(referenceOffset <= block.size() - sizeof(std::uint32_t), "stencil replay reference exceeds the push block");
     const auto run = [&](const Pm4::DrawParameters& piece, std::uint32_t firstIndex) {
+        std::uint32_t unusedSubdraw = 0;
         for (const auto& [reference, pipeline] : replay) {
             selected.stencilReplayReference = reference;
             selected.stencilFront.reference = reference;
@@ -1807,7 +2031,7 @@ void recordStencilReplay(const Context& context, VkCommandBuffer commands, const
             context.Resolved(&DeviceFunctions::cmdSetStencilReference, "vkCmdSetStencilReference")(commands, VK_STENCIL_FACE_FRONT_AND_BACK, reference);
             std::memcpy(block.data() + referenceOffset, &reference, sizeof(reference));
             pipeline->PushConstants(commands, stages, block);
-            recordDrawCommands(context, commands, selected, piece, inputs, nullptr, VK_NULL_HANDLE, 0, firstIndex);
+            recordDrawCommands(context, commands, selected, piece, inputs, nullptr, VK_NULL_HANDLE, 0, nullptr, unusedSubdraw, firstIndex);
         }
     };
     if (replay.size() == 1u) {
@@ -1940,7 +2164,8 @@ bool WriteOnlyPasses() {
     return enabled;
 }
 
-void recordDraw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, DrawInputs& inputs, RecordedDraw& record, DrawOutcome& outcome, DrawTimer& timer, double& ownWaitedMs) {
+void recordDraw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, DrawInputs& inputs, RecordedDraw& record, DrawOutcome& outcome, DrawTimer& timer, double& ownWaitedMs, const DrawTraceContext* trace = nullptr) {
+    std::uint32_t subdraw = 0;
     auto* recorder = record.recorder;
     auto& resources = *record.resources;
     const auto* args = record.indirect != nullptr ? record.indirect->args : nullptr;
@@ -1971,7 +2196,6 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
         recorder->FlushStores();
         outcome.storesFlushed = true;
     }
-    const auto drawBindings = resources.PrepareDrawBindings(*recorder, record.moved);
     const bool capture = CaptureInputsEnabled();
     const bool meshIndirect = state.stages.mesh && args != nullptr;
     const bool addressBased = resources.HoldsLease();
@@ -1993,6 +2217,8 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
     }
     for (const auto image : record.multisampleImages) passAttachments.emplace_back(image, true);
     const bool unknownMemory = addressBased || resources.UsesAddressTable() || resources.HasCopiedWrites();
+    static_cast<void>(StorageTexture::StoreDrawnLinearTouching("draw access", [&](std::uint64_t begin, std::uint64_t end) { return std::any_of(passReads.begin(), passReads.end(), [&](const auto& read) { return read.first < end && begin < read.second; }) || resources.WritesOverlap(begin, static_cast<std::size_t>(end - begin)); }, unknownMemory));
+    const auto drawBindings = resources.PrepareDrawBindings(*recorder, record.moved);
     static const bool addressReadPasses = std::getenv("APS5_NO_ADDRESS_READ_PASSES") == nullptr;
     const bool readOnlyBda = addressReadPasses && resources.BdaReadOnly();
     outcome.addressDraw = addressBased;
@@ -2021,7 +2247,7 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
     }
     const PassAccess passAccess{passReads, passWrites, passImages, passAttachments, unknownMemory, unknownWrites, passWriteOnly};
     const bool fenced = state.depth.has_value() || !record.proxies.empty();
-    const auto start = recorder->StartDrawPass(passKey, capture || readsTarget || gpuIndirect || meshIndirect, fenced, passAccess);
+    const auto start = recorder->StartDrawPass(passKey, capture || readsTarget || gpuIndirect || meshIndirect || PixelFunctionLdsSubgroup(shaders) != 0u, fenced, passAccess);
     for (const auto& target : record.multisampleTargets) KeepMultisampleTarget_nid_no_patch(target);
     const bool continued = start.continued;
     outcome.passContinued = continued;
@@ -2068,6 +2294,8 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
             RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_VERTEX_INPUT_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT, VK_ACCESS_VERTEX_ATTRIBUTE_READ_BIT);
             countBarrier(1);
         }
+        const auto pixelLdsSubgroup = PixelFunctionLdsSubgroup(shaders);
+        if (pixelLdsSubgroup != 0u) PreparePixelFunctionLds(context, commands, pixelLdsSubgroup);
         if (meshIndirect) {
             meshArguments = recordMeshArguments(context, commands, recorder, true, state, draw, *record.indirect, countBarrier, inputs.restartTable);
             argumentBuffer = meshArguments->Handle();
@@ -2093,21 +2321,22 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
     } else {
         resources.Bind(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, record.pipeline->Layout());
     }
+    if (std::ranges::any_of(shaders, [](const CompiledShader& shader) { return shader.program != nullptr && shader.program->functionLdsBuffer; })) BindPixelFunctionLds(context, commands, record.pipeline->Layout());
     APS5_LOG_CHARS_OUT_DEBUG("Resources bound");
     pushDrawConstants(*record.pipeline, commands, state, draw, shaders, resources, record.pushBytes, record.pushStages, meshArguments != nullptr ? meshArguments->DeviceAddress() : 0, !inputs.restartTable.empty());
     APS5_LOG_CHARS_OUT_DEBUG("Push constants recorded");
-    if (record.stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset);
+    if (record.stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset, trace, subdraw);
     else {
         recordStencilReplay(context, commands, state, draw, inputs, record.stencilReplay, shaders, resources, record.pushBytes, record.pushStages);
         for (const auto& [reference, pipeline] : record.stencilReplay) recorder->Keep(pipeline);
     }
     if (record.pipeline->SplitsFaces()) {
         record.pipeline->ContinueBackFaces(commands, state);
-        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset, trace, subdraw);
     }
     if (record.pipeline->SplitsSecondChannel()) {
         record.pipeline->ContinueSecondChannel(commands);
-        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset, trace, subdraw);
     }
     if (meshArguments != nullptr) recorder->Keep(meshArguments);
     if (args != nullptr) CountIndirectDraw(record.indirect->path, record.indirect->readMs, rewritten);
@@ -2134,7 +2363,7 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
     }
     recorder->LeaveRenderPassOpen(passKey, drawTiming, fenced, passAccess, std::move(storeProxies));
     timer.phase(PhaseRecord);
-    keepRecordedDraw(*recorder, record.resources, std::move(record.pipeline), std::move(record.framebuffer), inputs, std::move(record.targets), std::move(record.targetSlices), std::move(scratch), std::move(checkRecords), record.listed, record.completion, outcome);
+    keepRecordedDraw(*recorder, record.resources, std::move(record.pipeline), std::move(record.framebuffer), inputs, std::move(record.targets), std::move(record.targetSlices), state.scissor, std::move(scratch), std::move(checkRecords), record.listed, record.completion, outcome);
     timer.phase(PhaseKeep);
     if (record.waited) {
         // The wait the dispatch path makes for such work (source 3, "address-based"): the
@@ -2222,6 +2451,7 @@ struct PreparedDraw {
     PreparedDraw(const PreparedDraw&) = delete;
     PreparedDraw& operator=(const PreparedDraw&) = delete;
     std::shared_ptr<const DrawRecipe>* recipeOut = nullptr;
+    const DrawTraceContext* trace = nullptr;
     std::vector<std::uint32_t> stencilReferences;
     std::optional<PerformanceTimer> timing;
     DrawTimer timer;
@@ -2318,6 +2548,10 @@ bool prepareDraw(const Context& context, const State& state, const Pm4::DrawPara
         if (color.samples > 1) {
             binding.multisampled = true;
             timer.phase(PhaseSetup);
+            if (color.partialWriteMask != 0) {
+                static_cast<void>(MultisampleTargetView(context, color));
+                static_cast<void>(MultisampleTargetStorageView(context, TargetMergeSurface(color)));
+            }
             targetViews.push_back(MultisampleTargetView(context, color, binding.multisampleOwner, &binding.multisampleImage));
             timer.phase(PhaseReadTarget);
             continue;
@@ -2326,6 +2560,7 @@ bool prepareDraw(const Context& context, const State& state, const Pm4::DrawPara
         const ColorTargetLayout colorLayout(color.extent.width, color.extent.height, color.tileMode, color.elementBytes);
         static_cast<void>(FlushDepthPlanes(color.address, colorLayout.Bytes(), DepthPlaneScope::Whole));
         RetireDepthSurfaces(context.device, color.address, colorLayout.Bytes());
+        if (color.fmaskAddress != 0) GuardOneFragmentFmask(context, color);
         constexpr VkBufferUsageFlags copies = VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT;
         timer.phase(PhaseSetup);
         // Debug aid: APS5_NO_RESIDENT_TARGETS=1 copies every target in and out again.
@@ -2549,7 +2784,18 @@ bool prepareDraw(const Context& context, const State& state, const Pm4::DrawPara
     const bool multisampled = prepared.multisampled = std::any_of(targets.begin(), targets.end(), [](const TargetBinding& binding) { return binding.multisampled; });
     Require(lean || !multisampled, "multisampled draws are only rendered as recorded draws");
     for (const auto& binding : targets) {
-        if (binding.multisampled) Require(std::find(resources->MultisampleSources().begin(), resources->MultisampleSources().end(), binding.color.surfaceAddress) == resources->MultisampleSources().end(), "sampling a multisampled color target the draw renders to is not implemented");
+        if (!binding.multisampled) continue;
+        const auto& sources = resources->MultisampleSources();
+        const auto reads = std::count(sources.begin(), sources.end(), binding.color.surfaceAddress);
+        Require(reads == 0 || (reads == 1 && binding.color.partialWriteMask != 0), "sampling a multisampled color target the draw renders to is not implemented");
+        Require(binding.color.partialWriteMask == 0 || (reads == 1 && MultisampleTargetStorable(context, binding.color)), "the partial write of a multisampled packed color target does not store into the target's image");
+        if (binding.color.partialWriteMask != 0) static_cast<void>(MultisampleTargetStorageView(context, TargetMergeSurface(binding.color)));
+    }
+    for (const auto& binding : targets) {
+        if (binding.color.partialWriteMask == 0 || binding.multisampled) continue;
+        Require(lean && binding.resident != nullptr && !binding.proxied, "a partial write of a packed color target is merged into its resident image by a recorded draw only");
+        const auto images = resources->StorageImages();
+        Require(std::ranges::any_of(images, [&](const std::pair<VkImage, bool>& image) { return image.first == binding.resident->Image() && image.second; }), "the partial write of a packed color target does not store into the target's resident image");
     }
     if (!lean && !resolved.moved.empty()) {
         resolved.resources = std::make_shared<ShaderResources>(context, shaders, state.color, static_cast<std::uint32_t>(state.colors.size()), draw.indexAddress, static_cast<std::size_t>(indexBytes), snapshots);
@@ -2677,7 +2923,7 @@ void recordPreparedDraw(const Context& context, const State& state, const Pm4::D
         record.reordered = reordered;
         record.reorderPass = reorderPass;
         record.depthLocations = depthLocations;
-        recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs);
+        recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs, prepared.trace);
         // The recipe for the caller's draw-cache entry (design_cpu_final M8, rule R3 for draws):
         // only a template the resource cache serves under this content key (reusable: no lease,
         // no copied writes, every direct region import- or mirror-served) of a direct draw, so a
@@ -2708,6 +2954,14 @@ void recordPreparedDraw(const Context& context, const State& state, const Pm4::D
         report(outcome.waited ? (outcome.reason == SyncLease ? " recorded then waited (lease)" : " recorded then waited (copied writes)") : completion ? " recorded with completion" : " recorded");
         return;
     }
+    const bool gpuIndirect = args != nullptr && indirect.path == IndirectDrawPath::Gpu;
+    const auto touches = [&](std::uint64_t begin, std::uint64_t end) {
+        const auto bytes = static_cast<std::size_t>(end - begin);
+        if (resources->WritesOverlap(begin, bytes) || resources->ReadsOverlap(begin, bytes)) return true;
+        if (!gpuIndirect) return false;
+        return (begin < args->arguments + args->RangeBytes() && args->arguments < end) || (args->countIndirect && begin < args->countAddress + 4 && args->countAddress < end);
+    };
+    static_cast<void>(StorageTexture::StoreDrawnLinearTouching("draw access", [&](std::uint64_t begin, std::uint64_t end) { return touches(begin, end) || std::any_of(inputs.inPlaceReads.begin(), inputs.inPlaceReads.end(), [&](const auto& read) { return read.first < end && begin < read.second; }); }, resources->HoldsLease() || resources->UsesAddressTable() || resources->HasCopiedWrites()));
     APS5_LOG_CHARS_OUT_DEBUG("Creating CommandBatch");
     std::optional<CommandBatch> batch;
     if (!recorded) {
@@ -2717,16 +2971,9 @@ void recordPreparedDraw(const Context& context, const State& state, const Pm4::D
     }
     using CommandClass = Recorder::CommandClass;
     const auto countBarrier = [&](std::uint32_t count = 1) { if (recorded) Recorder::CountBarriers(CommandClass::Draw, count); };
-    const bool gpuIndirect = args != nullptr && indirect.path == IndirectDrawPath::Gpu;
     // A queued DCC key store over memory the draw writes or reads in place (unknown for an
     // address-based build), or over its GPU-side records, lands before it, as before a dispatch
     // (VulkanDevice::dispatch).
-    const auto touches = [&](std::uint64_t begin, std::uint64_t end) {
-        const auto bytes = static_cast<std::size_t>(end - begin);
-        if (resources->WritesOverlap(begin, bytes) || resources->ReadsOverlap(begin, bytes)) return true;
-        if (!gpuIndirect) return false;
-        return (begin < args->arguments + args->RangeBytes() && args->arguments < end) || (args->countIndirect && begin < args->countAddress + 4 && args->countAddress < end);
-    };
     if (recorded && recorder->HasQueuedKeyStores() && (resources->HoldsLease() || recorder->AnyQueuedKeyStore(touches))) recorder->FlushKeyStores();
     // A queued label store over such memory likewise (Recorder::RecordStore).
     if (recorded && recorder->HasQueuedStores() && (resources->HoldsLease() || recorder->AnyQueuedStore(touches))) recorder->FlushStores();
@@ -2766,6 +3013,8 @@ void recordPreparedDraw(const Context& context, const State& state, const Pm4::D
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_VERTEX_INPUT_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT, VK_ACCESS_VERTEX_ATTRIBUTE_READ_BIT);
         countBarrier();
     }
+    const auto pixelLdsSubgroup = PixelFunctionLdsSubgroup(shaders);
+    if (pixelLdsSubgroup != 0u) PreparePixelFunctionLds(context, commands, pixelLdsSubgroup);
     std::shared_ptr<Buffer> meshArguments;
     if (state.stages.mesh && args != nullptr) {
         meshArguments = recordMeshArguments(context, commands, recorder, recorded, state, draw, indirect, countBarrier, inputs.restartTable);
@@ -2807,21 +3056,23 @@ void recordPreparedDraw(const Context& context, const State& state, const Pm4::D
     pipeline->Begin(commands, *framebuffer, state.renderExtent, state);
     APS5_LOG_CHARS_OUT_DEBUG("Pipeline Begin OK");
     resources->Bind(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline->Layout());
+    if (pixelLdsSubgroup != 0u) BindPixelFunctionLds(context, commands, pipeline->Layout());
     APS5_LOG_CHARS_OUT_DEBUG("Resources bound");
     pushDrawConstants(*pipeline, commands, state, draw, shaders, *resources, nullptr, 0, meshArguments != nullptr ? meshArguments->DeviceAddress() : 0, !inputs.restartTable.empty());
     APS5_LOG_CHARS_OUT_DEBUG("Push constants recorded");
-    if (stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset);
+    std::uint32_t subdraw = 0;
+    if (stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset, prepared.trace, subdraw);
     else {
         recordStencilReplay(context, commands, state, draw, inputs, stencilReplay, shaders, *resources);
         if (recorded) for (const auto& [reference, selectedPipeline] : stencilReplay) recorder->Keep(selectedPipeline);
     }
     if (pipeline->SplitsFaces()) {
         pipeline->ContinueBackFaces(commands, state);
-        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset, prepared.trace, subdraw);
     }
     if (pipeline->SplitsSecondChannel()) {
         pipeline->ContinueSecondChannel(commands);
-        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset, prepared.trace, subdraw);
     }
     if (meshArguments != nullptr && recorded) recorder->Keep(meshArguments);
     if (args != nullptr) CountIndirectDraw(indirect.path, indirect.readMs, rewritten);
@@ -2889,7 +3140,7 @@ void recordPreparedDraw(const Context& context, const State& state, const Pm4::D
     APS5_LOG_CHARS_OUT_DEBUG("SubmitAndWait");
     timer.phase(PhaseRecord);
     if (recorded) {
-        keepRecordedDraw(*recorder, resources, pipeline, framebuffer, inputs, owners, [&] { std::vector<std::pair<std::uint32_t, std::uint32_t>> slices; for (const auto& binding : targets) slices.emplace_back(binding.color.arraySlice, binding.color.arrayLastSlice != 0 ? binding.color.layers : 1u); return slices; }(), std::move(scratch), std::move(checkRecords), listed, completion, outcome);
+        keepRecordedDraw(*recorder, resources, pipeline, framebuffer, inputs, owners, [&] { std::vector<std::pair<std::uint32_t, std::uint32_t>> slices; for (const auto& binding : targets) slices.emplace_back(binding.color.arraySlice, binding.color.arrayLastSlice != 0 ? binding.color.layers : 1u); return slices; }(), state.scissor, std::move(scratch), std::move(checkRecords), listed, completion, outcome);
         timer.phase(PhaseKeep);
         if (outcome.waited) {
             // The wait the dispatch path makes for such work (source 3, "address-based"): the
@@ -2978,14 +3229,17 @@ void recordPreparedDraw(const Context& context, const State& state, const Pm4::D
 
 }
 
-void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipeOut) {
+void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipeOut, const DrawTraceContext* trace) {
+    const DepthCopySourceScope depthCopySource(state.depthCopySource);
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     PreparedDraw prepared(profile);
     prepared.recipeOut = recipeOut;
+    prepared.trace = trace;
     if (prepareDraw(context, state, draw, shaders, snapshots, prepared)) recordPreparedDraw(context, state, draw, shaders, prepared);
 }
 
-DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe) {
+DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe, const DrawTraceContext* trace) {
+    const DepthCopySourceScope depthCopySource(state.depthCopySource);
     if (context.recorder != nullptr) context.recorder->BoundKeptBytes();
     static_cast<void>(snapshots);
     PerformanceTimer timing("Graphics.DrawWithRecipe");
@@ -3026,8 +3280,9 @@ DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, con
     targets.reserve(recipe.targets.size());
     for (std::size_t index = 0; index < recipe.targets.size(); ++index) {
         timer.phase(PhaseSetup);
+        if (state.colors[index].fmaskAddress != 0) GuardOneFragmentFmask(context, state.colors[index]);
         auto stored = recipe.targets[index].lock();
-        if (stored == nullptr || !StorageImageCached(context, stored.get()) || !StorageImageServesKeys(*stored, state.colors[index].dccAddress)) return miss(DrawRecipeMiss::TargetGone);
+        if (stored == nullptr || !StorageImageCached(context, stored.get()) || !StorageImageServesKeys(*stored, SurfaceForTarget(state.colors[index]).dccAddress)) return miss(DrawRecipeMiss::TargetGone);
         auto resident = refreshResidentTarget(context, state, state.colors[index], outcome, profile, [&] {
             if (state.colors[index].arrayLastSlice != 0) stored->RefreshLayers(state.colors[index].arraySlice, 1);
             else stored->Refresh();
@@ -3093,7 +3348,7 @@ DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, con
     record.pushBytes = &recipe.pushBytes;
     record.pushStages = recipe.pushStages;
     record.depthLocations = passDepthLocations(context, state, *record.pipeline);
-    recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs);
+    recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs, trace);
     if (profile) {
         result.recordUs = std::chrono::duration<double, std::micro>(std::chrono::steady_clock::now() - recordStart).count();
         auto& stats = Profile();
@@ -3116,12 +3371,6 @@ std::shared_ptr<StorageTexture> metadataPassResident(const Context& context, con
 
 }
 
-void RunDepthCopyPass(const Context& context, const DepthCopyPass& pass) {
-    Require(pass.color.tileMode != ColorTileMode::Linear && context.detiler != nullptr, "DB depth copy into a target without a resident image is not implemented");
-    const auto resident = CachedStorageSurface(context, SurfaceForTarget(pass.color));
-    CopyDepthSample(context, pass.depthAddress, pass.samples, pass.sample, *resident, resident->StorageView(0, false), pass.extent);
-}
-
 std::vector<std::pair<std::uint64_t, std::uint64_t>> PipelinedColorMetadataPassWrites(const ColorMetadataPass& pass) {
     std::vector<std::pair<std::uint64_t, std::uint64_t>> writes;
     if (pass.mode == ColorMetadataPass::Mode::Resolve) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp
new file mode 100644
index 0000000000..3a33f8bc0d
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp
@@ -0,0 +1,252 @@
+#include "prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/shaders/FirstSampleFloat_spv.h"
+#include "prx/libSceAgcDriver/Graphics/shaders/FirstSampleSint_spv.h"
+#include "prx/libSceAgcDriver/Graphics/shaders/FirstSampleUint_spv.h"
+#include "prx/libSceAgcDriver/Graphics/shaders/PresentationPassVert_spv.h"
+#include <memory>
+#include <span>
+
+namespace AgcDriver::Graphics {
+namespace {
+
+bool sintFormat(VkFormat format) {
+    switch (format) {
+        case VK_FORMAT_R8_SINT: case VK_FORMAT_R8G8_SINT: case VK_FORMAT_R8G8B8A8_SINT: case VK_FORMAT_B8G8R8A8_SINT:
+        case VK_FORMAT_A8B8G8R8_SINT_PACK32: case VK_FORMAT_A2B10G10R10_SINT_PACK32: case VK_FORMAT_R16_SINT: case VK_FORMAT_R16G16_SINT:
+        case VK_FORMAT_R16G16B16A16_SINT: case VK_FORMAT_R32_SINT: case VK_FORMAT_R32G32_SINT: case VK_FORMAT_R32G32B32A32_SINT:
+            return true;
+        default: return false;
+    }
+}
+
+bool uintFormat(VkFormat format) {
+    switch (format) {
+        case VK_FORMAT_R8_UINT: case VK_FORMAT_R8G8_UINT: case VK_FORMAT_R8G8B8A8_UINT: case VK_FORMAT_B8G8R8A8_UINT:
+        case VK_FORMAT_A8B8G8R8_UINT_PACK32: case VK_FORMAT_A2R10G10B10_UINT_PACK32: case VK_FORMAT_A2B10G10R10_UINT_PACK32: case VK_FORMAT_R16_UINT:
+        case VK_FORMAT_R16G16_UINT: case VK_FORMAT_R16G16B16A16_UINT: case VK_FORMAT_R32_UINT: case VK_FORMAT_R32G32_UINT: case VK_FORMAT_R32G32B32A32_UINT:
+            return true;
+        default: return false;
+    }
+}
+
+std::span<const std::uint32_t> fragmentCode(VkFormat format) {
+    if (sintFormat(format)) return FIRST_SAMPLE_SINT_SPV;
+    if (uintFormat(format)) return FIRST_SAMPLE_UINT_SPV;
+    return FIRST_SAMPLE_FLOAT_SPV;
+}
+
+struct DescriptorPool {
+    DescriptorPool(const Context& context, VkDescriptorPool pool) : context(context), pool(pool) {}
+    ~DescriptorPool() { context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr); }
+    DescriptorPool(const DescriptorPool&) = delete;
+    DescriptorPool& operator=(const DescriptorPool&) = delete;
+    Context context;
+    VkDescriptorPool pool;
+};
+
+}
+
+FirstSampleCopy::FirstSampleCopy(const Context& context, VkFormat format, VkExtent2D extent) : context(context), extent(extent) {
+    try {
+        VkImageCreateInfo imageInfo{VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO};
+        imageInfo.imageType = VK_IMAGE_TYPE_2D;
+        imageInfo.format = format;
+        imageInfo.extent = {extent.width, extent.height, 1};
+        imageInfo.mipLevels = 1;
+        imageInfo.arrayLayers = 1;
+        imageInfo.samples = VK_SAMPLE_COUNT_1_BIT;
+        imageInfo.tiling = VK_IMAGE_TILING_OPTIMAL;
+        imageInfo.usage = VK_IMAGE_USAGE_COLOR_ATTACHMENT_BIT | VK_IMAGE_USAGE_SAMPLED_BIT;
+        imageInfo.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
+        imageInfo.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+        Check(context.Function<PFN_vkCreateImage>("vkCreateImage")(context.device, &imageInfo, nullptr, &image), "vkCreateImage first sample");
+        VkMemoryRequirements requirements{};
+        context.Function<PFN_vkGetImageMemoryRequirements>("vkGetImageMemoryRequirements")(context.device, image, &requirements);
+        VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+        allocation.allocationSize = requirements.size;
+        allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
+        memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory first sample");
+        Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory first sample");
+        VkImageViewCreateInfo viewInfo{VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO};
+        viewInfo.image = image;
+        viewInfo.viewType = VK_IMAGE_VIEW_TYPE_2D;
+        viewInfo.format = format;
+        viewInfo.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+        Check(context.Function<PFN_vkCreateImageView>("vkCreateImageView")(context.device, &viewInfo, nullptr, &view), "vkCreateImageView first sample");
+
+        VkSamplerCreateInfo samplerInfo{VK_STRUCTURE_TYPE_SAMPLER_CREATE_INFO};
+        samplerInfo.magFilter = VK_FILTER_NEAREST;
+        samplerInfo.minFilter = VK_FILTER_NEAREST;
+        samplerInfo.mipmapMode = VK_SAMPLER_MIPMAP_MODE_NEAREST;
+        samplerInfo.addressModeU = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
+        samplerInfo.addressModeV = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
+        samplerInfo.addressModeW = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
+        Check(context.Function<PFN_vkCreateSampler>("vkCreateSampler")(context.device, &samplerInfo, nullptr, &sampler), "vkCreateSampler first sample");
+        VkDescriptorSetLayoutBinding binding{};
+        binding.binding = 0;
+        binding.descriptorType = VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER;
+        binding.descriptorCount = 1;
+        binding.stageFlags = VK_SHADER_STAGE_FRAGMENT_BIT;
+        binding.pImmutableSamplers = &sampler;
+        VkDescriptorSetLayoutCreateInfo descriptorInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+        descriptorInfo.bindingCount = 1;
+        descriptorInfo.pBindings = &binding;
+        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &descriptorInfo, nullptr, &descriptorLayout), "vkCreateDescriptorSetLayout first sample");
+        VkPipelineLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
+        layoutInfo.setLayoutCount = 1;
+        layoutInfo.pSetLayouts = &descriptorLayout;
+        Check(context.Function<PFN_vkCreatePipelineLayout>("vkCreatePipelineLayout")(context.device, &layoutInfo, nullptr, &pipelineLayout), "vkCreatePipelineLayout first sample");
+
+        VkAttachmentDescription attachment{};
+        attachment.format = format;
+        attachment.samples = VK_SAMPLE_COUNT_1_BIT;
+        attachment.loadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
+        attachment.storeOp = VK_ATTACHMENT_STORE_OP_STORE;
+        attachment.stencilLoadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
+        attachment.stencilStoreOp = VK_ATTACHMENT_STORE_OP_DONT_CARE;
+        attachment.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+        attachment.finalLayout = VK_IMAGE_LAYOUT_GENERAL;
+        const VkAttachmentReference reference{0, VK_IMAGE_LAYOUT_GENERAL};
+        VkSubpassDescription subpass{};
+        subpass.pipelineBindPoint = VK_PIPELINE_BIND_POINT_GRAPHICS;
+        subpass.colorAttachmentCount = 1;
+        subpass.pColorAttachments = &reference;
+        const VkSubpassDependency dependencies[2] = {
+            {VK_SUBPASS_EXTERNAL, 0, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, 0, VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, 0},
+            {0, VK_SUBPASS_EXTERNAL, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT, 0},
+        };
+        VkRenderPassCreateInfo renderPassInfo{VK_STRUCTURE_TYPE_RENDER_PASS_CREATE_INFO};
+        renderPassInfo.attachmentCount = 1;
+        renderPassInfo.pAttachments = &attachment;
+        renderPassInfo.subpassCount = 1;
+        renderPassInfo.pSubpasses = &subpass;
+        renderPassInfo.dependencyCount = 2;
+        renderPassInfo.pDependencies = dependencies;
+        Check(context.Function<PFN_vkCreateRenderPass>("vkCreateRenderPass")(context.device, &renderPassInfo, nullptr, &renderPass), "vkCreateRenderPass first sample");
+        VkFramebufferCreateInfo framebufferInfo{VK_STRUCTURE_TYPE_FRAMEBUFFER_CREATE_INFO};
+        framebufferInfo.renderPass = renderPass;
+        framebufferInfo.attachmentCount = 1;
+        framebufferInfo.pAttachments = &view;
+        framebufferInfo.width = extent.width;
+        framebufferInfo.height = extent.height;
+        framebufferInfo.layers = 1;
+        Check(context.Function<PFN_vkCreateFramebuffer>("vkCreateFramebuffer")(context.device, &framebufferInfo, nullptr, &framebuffer), "vkCreateFramebuffer first sample");
+
+        vertex = CreateShaderModule(context, PRESENTATION_PASS_VERT_SPV, sizeof(PRESENTATION_PASS_VERT_SPV), "vkCreateShaderModule first sample vertex");
+        const auto code = fragmentCode(format);
+        fragment = CreateShaderModule(context, code.data(), code.size_bytes(), "vkCreateShaderModule first sample fragment");
+        VkPipelineShaderStageCreateInfo stages[2]{{VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO}, {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO}};
+        stages[0].stage = VK_SHADER_STAGE_VERTEX_BIT;
+        stages[0].module = vertex;
+        stages[0].pName = "main";
+        stages[1].stage = VK_SHADER_STAGE_FRAGMENT_BIT;
+        stages[1].module = fragment;
+        stages[1].pName = "main";
+        VkPipelineVertexInputStateCreateInfo vertexInput{VK_STRUCTURE_TYPE_PIPELINE_VERTEX_INPUT_STATE_CREATE_INFO};
+        VkPipelineInputAssemblyStateCreateInfo assembly{VK_STRUCTURE_TYPE_PIPELINE_INPUT_ASSEMBLY_STATE_CREATE_INFO};
+        assembly.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+        const VkViewport viewportRect{0.0f, 0.0f, static_cast<float>(extent.width), static_cast<float>(extent.height), 0.0f, 1.0f};
+        const VkRect2D scissor{{0, 0}, extent};
+        VkPipelineViewportStateCreateInfo viewport{VK_STRUCTURE_TYPE_PIPELINE_VIEWPORT_STATE_CREATE_INFO};
+        viewport.viewportCount = 1;
+        viewport.pViewports = &viewportRect;
+        viewport.scissorCount = 1;
+        viewport.pScissors = &scissor;
+        VkPipelineRasterizationStateCreateInfo rasterization{VK_STRUCTURE_TYPE_PIPELINE_RASTERIZATION_STATE_CREATE_INFO};
+        rasterization.polygonMode = VK_POLYGON_MODE_FILL;
+        rasterization.cullMode = VK_CULL_MODE_NONE;
+        rasterization.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+        rasterization.lineWidth = 1.0f;
+        VkPipelineMultisampleStateCreateInfo multisample{VK_STRUCTURE_TYPE_PIPELINE_MULTISAMPLE_STATE_CREATE_INFO};
+        multisample.rasterizationSamples = VK_SAMPLE_COUNT_1_BIT;
+        VkPipelineColorBlendAttachmentState blendAttachment{};
+        blendAttachment.colorWriteMask = VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT | VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT;
+        VkPipelineColorBlendStateCreateInfo blend{VK_STRUCTURE_TYPE_PIPELINE_COLOR_BLEND_STATE_CREATE_INFO};
+        blend.attachmentCount = 1;
+        blend.pAttachments = &blendAttachment;
+        VkGraphicsPipelineCreateInfo pipelineInfo{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO};
+        pipelineInfo.stageCount = 2;
+        pipelineInfo.pStages = stages;
+        pipelineInfo.pVertexInputState = &vertexInput;
+        pipelineInfo.pInputAssemblyState = &assembly;
+        pipelineInfo.pViewportState = &viewport;
+        pipelineInfo.pRasterizationState = &rasterization;
+        pipelineInfo.pMultisampleState = &multisample;
+        pipelineInfo.pColorBlendState = &blend;
+        pipelineInfo.layout = pipelineLayout;
+        pipelineInfo.renderPass = renderPass;
+        Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, VK_NULL_HANDLE, 1, &pipelineInfo, nullptr, &pipeline), "vkCreateGraphicsPipelines first sample");
+    } catch (...) {
+        release();
+        throw;
+    }
+}
+
+FirstSampleCopy::~FirstSampleCopy() {
+    release();
+}
+
+void FirstSampleCopy::release() noexcept {
+    if (pipeline) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, pipeline, nullptr);
+    if (fragment) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, fragment, nullptr);
+    if (vertex) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, vertex, nullptr);
+    if (framebuffer) context.Function<PFN_vkDestroyFramebuffer>("vkDestroyFramebuffer")(context.device, framebuffer, nullptr);
+    if (renderPass) context.Function<PFN_vkDestroyRenderPass>("vkDestroyRenderPass")(context.device, renderPass, nullptr);
+    if (pipelineLayout) context.Function<PFN_vkDestroyPipelineLayout>("vkDestroyPipelineLayout")(context.device, pipelineLayout, nullptr);
+    if (descriptorLayout) context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(context.device, descriptorLayout, nullptr);
+    if (sampler) context.Function<PFN_vkDestroySampler>("vkDestroySampler")(context.device, sampler, nullptr);
+    if (view) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, view, nullptr);
+    if (image) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, image, nullptr);
+    if (memory) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, memory, nullptr);
+    pipeline = VK_NULL_HANDLE;
+    fragment = vertex = VK_NULL_HANDLE;
+    framebuffer = VK_NULL_HANDLE;
+    renderPass = VK_NULL_HANDLE;
+    pipelineLayout = VK_NULL_HANDLE;
+    descriptorLayout = VK_NULL_HANDLE;
+    sampler = VK_NULL_HANDLE;
+    view = VK_NULL_HANDLE;
+    image = VK_NULL_HANDLE;
+    memory = VK_NULL_HANDLE;
+}
+
+void FirstSampleCopy::Record(Recorder& recorder, VkImageView source, VkImageLayout layout) {
+    const VkDescriptorPoolSize size{VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER, 1};
+    VkDescriptorPoolCreateInfo poolInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_POOL_CREATE_INFO};
+    poolInfo.maxSets = 1;
+    poolInfo.poolSizeCount = 1;
+    poolInfo.pPoolSizes = &size;
+    VkDescriptorPool created = VK_NULL_HANDLE;
+    Check(context.Function<PFN_vkCreateDescriptorPool>("vkCreateDescriptorPool")(context.device, &poolInfo, nullptr, &created), "vkCreateDescriptorPool first sample");
+    const auto pool = std::make_shared<DescriptorPool>(context, created);
+    VkDescriptorSetAllocateInfo allocation{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_ALLOCATE_INFO};
+    allocation.descriptorPool = pool->pool;
+    allocation.descriptorSetCount = 1;
+    allocation.pSetLayouts = &descriptorLayout;
+    VkDescriptorSet set = VK_NULL_HANDLE;
+    Check(context.Function<PFN_vkAllocateDescriptorSets>("vkAllocateDescriptorSets")(context.device, &allocation, &set), "vkAllocateDescriptorSets first sample");
+    const VkDescriptorImageInfo imageInfo{VK_NULL_HANDLE, source, layout};
+    VkWriteDescriptorSet write{VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET};
+    write.dstSet = set;
+    write.dstBinding = 0;
+    write.descriptorCount = 1;
+    write.descriptorType = VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER;
+    write.pImageInfo = &imageInfo;
+    context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, 1, &write, 0, nullptr);
+    recorder.Keep(pool);
+    recorder.RecordUncounted([&](VkCommandBuffer commands) {
+        VkRenderPassBeginInfo begin{VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO};
+        begin.renderPass = renderPass;
+        begin.framebuffer = framebuffer;
+        begin.renderArea = {{0, 0}, extent};
+        context.Resolved(&DeviceFunctions::cmdBeginRenderPass, "vkCmdBeginRenderPass")(commands, &begin, VK_SUBPASS_CONTENTS_INLINE);
+        context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline);
+        context.Function<PFN_vkCmdBindDescriptorSets>("vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipelineLayout, 0, 1, &set, 0, nullptr);
+        context.Function<PFN_vkCmdDraw>("vkCmdDraw")(commands, 3, 1, 0, 0);
+        context.Resolved(&DeviceFunctions::cmdEndRenderPass, "vkCmdEndRenderPass")(commands);
+    });
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
index 8b27cdc9ef..fcd09869de 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
@@ -69,6 +69,7 @@ struct ImageMirror {
     std::uint64_t bytes = 0;
     bool writable = false;
     bool heap = false;
+    bool joinedHeap = false;
     bool sparse = false;
     std::uint64_t reserved = 0;
     std::vector<std::pair<std::uint64_t, std::uint64_t>> committed;
@@ -245,6 +246,7 @@ struct HostImports {
     std::map<std::uint64_t, ImportFailure> failedJoins;
     std::map<std::uint64_t, std::uint64_t> sparseRunEnds;
     std::map<std::uint64_t, std::uint32_t> sparseRunJoins;
+    std::set<std::pair<std::uint64_t, std::size_t>> importedAtMap;
     std::map<std::pair<std::uint64_t, std::uint64_t>, ImportFailure> failedBlocks;
     std::map<std::pair<std::uint64_t, std::uint64_t>, ImportRefusal> refusals;
     std::map<std::pair<std::uint64_t, std::uint64_t>, EvictingRefusal> evictingRefusals;
@@ -284,6 +286,7 @@ struct HostImports {
     bool allocationFailed = false;
     std::uint8_t reportNoted = 0;
     std::map<std::uint64_t, std::uint64_t> spaceUses;
+    std::uint64_t budgetRefusals = 0;
 };
 
 HostImports& Imports() {
@@ -293,7 +296,7 @@ HostImports& Imports() {
 
 #ifdef _WIN32
 void waitSettleBatch(const ImportSettle& settle, VkDevice device, const SettleBatch& batch) {
-    if (batch.busy && settle.waitForFences != nullptr) static_cast<void>(settle.waitForFences(device, 1, &batch.fence, VK_TRUE, 10'000'000'000ull));
+    if (batch.busy && settle.waitForFences != nullptr) Check(settle.waitForFences(device, 1, &batch.fence, VK_TRUE, 60'000'000'000ull), "vkWaitForFences (settle batch)");
 }
 
 bool settleBatchRunning(const ImportSettle& settle, VkDevice device, const SettleBatch& batch) {
@@ -867,6 +870,7 @@ bool importsStale(const Context& context, const HostImports& state);
 constexpr std::uint64_t settleFloorBytes = 0x100000;
 #ifdef _WIN32
 constexpr std::uint64_t settleBlockBytes = 0x10000;
+constexpr std::uint64_t settlePageBytes = 0x1000;
 constexpr auto settlePollPeriod = std::chrono::microseconds(100);
 std::atomic<bool> deferredSettles{std::getenv("APS5_NO_DEFERRED_SETTLES") == nullptr};
 #endif
@@ -987,7 +991,7 @@ const char* prepareSettleBatch(const Context& context, ImportSettle& settle, Set
     }
     if (batch.commands == VK_NULL_HANDLE) {
         VkCommandBufferAllocateInfo allocate{VK_STRUCTURE_TYPE_COMMAND_BUFFER_ALLOCATE_INFO};
-        allocate.commandPool = context.settlePool;
+        allocate.commandPool = context.pool;
         allocate.level = VK_COMMAND_BUFFER_LEVEL_PRIMARY;
         allocate.commandBufferCount = 1;
         if ((result = context.Function<PFN_vkAllocateCommandBuffers>("vkAllocateCommandBuffers")(context.device, &allocate, &batch.commands)) != VK_SUCCESS) {
@@ -1037,9 +1041,7 @@ void submitSettleBatch(const Context& context, HostImports& state) {
     begin.flags = VK_COMMAND_BUFFER_USAGE_ONE_TIME_SUBMIT_BIT;
     if ((result = context.Function<PFN_vkBeginCommandBuffer>("vkBeginCommandBuffer")(batch.commands, &begin)) != VK_SUCCESS) return fail("vkBeginCommandBuffer (settle batch)");
     const auto copy = context.Resolved(&DeviceFunctions::cmdCopyBuffer, "vkCmdCopyBuffer");
-    const bool otherFamily = context.settleFamily != context.queueFamily;
-    const auto createBuffer = otherFamily ? context.Function<PFN_vkCreateBuffer>("vkCreateBuffer") : nullptr;
-    const auto bindBufferMemory = otherFamily ? context.Function<PFN_vkBindBufferMemory>("vkBindBufferMemory") : nullptr;
+    RecordMemoryBarrier(context, batch.commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
     std::size_t consumed = 0;
     for (; consumed < state.settleWanted.size() && batch.bases.size() < settleBatchCopies; ++consumed) {
         const auto base = state.settleWanted[consumed];
@@ -1050,38 +1052,19 @@ void submitSettleBatch(const Context& context, HostImports& state) {
             state.pendingSettles.erase(settle);
             continue;
         }
-        VkBuffer source = import->second.buffer;
-        if (otherFamily) {
-            VkExternalMemoryBufferCreateInfo external{VK_STRUCTURE_TYPE_EXTERNAL_MEMORY_BUFFER_CREATE_INFO};
-            external.handleTypes = VK_EXTERNAL_MEMORY_HANDLE_TYPE_HOST_ALLOCATION_BIT_EXT;
-            VkBufferCreateInfo aliasInfo{VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO, &external};
-            aliasInfo.size = std::min<VkDeviceSize>(import->second.bytes, 65536);
-            aliasInfo.usage = VK_BUFFER_USAGE_TRANSFER_SRC_BIT;
-            VkBuffer alias = VK_NULL_HANDLE;
-            if (createBuffer(context.device, &aliasInfo, nullptr, &alias) != VK_SUCCESS) {
-                state.pendingSettles.erase(settle);
-                continue;
-            }
-            if (bindBufferMemory(context.device, alias, import->second.memory, 0) != VK_SUCCESS) {
-                destroyBuffer(context.device, alias, nullptr);
-                state.pendingSettles.erase(settle);
-                continue;
-            }
-            batch.aliases.push_back(alias);
-            source = alias;
-        }
         const VkBufferCopy region{0, (VkDeviceSize{index} * settleBatchCopies + batch.bases.size()) * 4u, 4};
-        copy(batch.commands, source, deviceSettle.batchTarget, 1, &region);
+        copy(batch.commands, import->second.buffer, deviceSettle.batchTarget, 1, &region);
         settle->second = PendingSettle{SettlePhase::Submitted, index, context.device};
         batch.bases.push_back(base);
     }
     state.settleWanted.erase(state.settleWanted.begin(), state.settleWanted.begin() + static_cast<std::ptrdiff_t>(consumed));
+    RecordMemoryBarrier(context, batch.commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_WRITE_BIT);
     if ((result = context.Function<PFN_vkEndCommandBuffer>("vkEndCommandBuffer")(batch.commands)) != VK_SUCCESS) return fail("vkEndCommandBuffer (settle batch)");
     if (batch.bases.empty()) return;
     VkSubmitInfo submit{VK_STRUCTURE_TYPE_SUBMIT_INFO};
     submit.commandBufferCount = 1;
     submit.pCommandBuffers = &batch.commands;
-    if ((result = context.Function<PFN_vkQueueSubmit>("vkQueueSubmit")(context.settleQueue, 1, &submit, batch.fence)) != VK_SUCCESS) return fail("vkQueueSubmit (settle batch)");
+    if ((result = context.Function<PFN_vkQueueSubmit>("vkQueueSubmit")(context.queue, 1, &submit, batch.fence)) != VK_SUCCESS) return fail("vkQueueSubmit (settle batch)");
     batch.busy = true;
     state.settlesSubmitted += batch.bases.size();
 }
@@ -1114,8 +1097,22 @@ void reapSettleBatches(const Context& context, HostImports& state) {
     }
 }
 
+bool comparedImportShares(const HostImports& state, std::uint64_t own, std::uint64_t begin, std::uint64_t end) {
+    const auto shares = [&](const HostImport& entry) { return entry.unwatched && entry.memoryBase < end && begin < entry.memoryBase + entry.pinnedBytes; };
+    for (const auto& [base, entry] : state.imports) {
+        if (base != own && shares(entry)) return true;
+    }
+    for (const auto& [device, list] : state.parked) {
+        for (const auto& retired : list) {
+            if (shares(retired->node.mapped())) return true;
+        }
+    }
+    return false;
+}
+
 void rewatchSettledImports(HostImports& state) {
     if (state.settleReady.empty()) return;
+    std::vector<std::uint64_t> bases;
     std::vector<std::pair<std::uint64_t, std::uint64_t>> ranges;
     for (const auto base : state.settleReady) {
         const auto settle = state.pendingSettles.find(base);
@@ -1123,19 +1120,23 @@ void rewatchSettledImports(HostImports& state) {
         state.pendingSettles.erase(settle);
         const auto import = state.imports.find(base);
         if (import == state.imports.end() || !import->second.unwatched) continue;
-        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> span{{{base, base + import->second.bytes}}};
+        const auto first = base & ~(settleBlockBytes - 1);
+        const auto stop = (base + import->second.bytes + settleBlockBytes - 1) & ~(settleBlockBytes - 1);
+        if ((first != base || stop != base + import->second.bytes) && comparedImportShares(state, base, first, stop)) continue;
+        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> span{{{first, stop}}};
         if (StorageTexture::AnyLiveOverlaps(span)) {
             ++state.settlesKeptCompared;
             continue;
         }
-        ranges.push_back(span.front());
+        bases.push_back(base);
+        ranges.emplace_back(base & ~(settlePageBytes - 1), (base + import->second.bytes + settlePageBytes - 1) & ~(settlePageBytes - 1));
     }
     state.settleReady.clear();
     if (ranges.empty()) return;
     GuestMemory::Rewatch(ranges);
-    for (const auto& [begin, end] : ranges) {
-        const auto import = state.imports.find(begin);
-        if (import == state.imports.end() || !GuestMemory::Watched(begin, static_cast<std::size_t>(end - begin))) continue;
+    for (const auto base : bases) {
+        const auto import = state.imports.find(base);
+        if (import == state.imports.end() || !GuestMemory::Watched(base, static_cast<std::size_t>(import->second.bytes))) continue;
         import->second.unwatched = false;
         ++state.settlesRewatched;
     }
@@ -1150,6 +1151,49 @@ void settleUnwatchedImports(const Context& context, HostImports& state) {
     rewatchSettledImports(state);
     submitSettleBatch(context, state);
 }
+
+void settleImportsNow(const Context& context, HostImports& state, std::uint64_t begin, std::uint64_t end) {
+    if (context.settleQueue == VK_NULL_HANDLE || context.settleQueueMutex == nullptr || !GuestMemory::GpuMutex().HeldByThisThread()) return;
+    std::vector<std::uint64_t> needed;
+    auto it = state.imports.lower_bound(begin);
+    if (it != state.imports.begin()) --it;
+    for (; it != state.imports.end() && it->first < end; ++it) {
+        auto& entry = it->second;
+        if (entry.base + entry.bytes <= begin || !entry.unwatched) continue;
+        auto settle = state.pendingSettles.find(it->first);
+        if (settle == state.pendingSettles.end()) {
+            if (!entry.settleOnDemand || !deferredSettles.load(std::memory_order_relaxed)) continue;
+            entry.settleOnDemand = false;
+            settle = state.pendingSettles.insert_or_assign(it->first, PendingSettle{}).first;
+        }
+        if (settle->second.phase == SettlePhase::Wanted) {
+            std::erase(state.settleWanted, it->first);
+            state.settleWanted.insert(state.settleWanted.begin(), it->first);
+        }
+        needed.push_back(it->first);
+    }
+    if (needed.empty()) return;
+    auto& deviceSettle = settleFor(context, state);
+    const auto wanted = [&] {
+        return std::any_of(needed.begin(), needed.end(), [&](std::uint64_t base) {
+            const auto settle = state.pendingSettles.find(base);
+            return settle != state.pendingSettles.end() && settle->second.phase == SettlePhase::Wanted;
+        });
+    };
+    while (wanted()) {
+        if (std::all_of(deviceSettle.batches.begin(), deviceSettle.batches.end(), [](const SettleBatch& batch) { return batch.busy; })) {
+            for (const auto& batch : deviceSettle.batches) waitSettleBatch(deviceSettle, context.device, batch);
+            reapSettleBatches(context, state);
+        }
+        submitSettleBatch(context, state);
+    }
+    for (const auto base : needed) {
+        const auto settle = state.pendingSettles.find(base);
+        if (settle != state.pendingSettles.end() && settle->second.phase == SettlePhase::Submitted && settle->second.device == context.device) waitSettleBatch(deviceSettle, context.device, deviceSettle.batches[settle->second.batch]);
+    }
+    reapSettleBatches(context, state);
+    rewatchSettledImports(state);
+}
 #endif
 
 void decideImportWatch(const Context& context, HostImports& state) {
@@ -1385,7 +1429,7 @@ ImportRun joinedRun(const GuestAllocations::Lease& lease, std::uint64_t begin, s
     auto run = crossedRun(lease, begin, end);
     if (run.ranges.empty()) return run;
     if (std::all_of(run.ranges.begin(), run.ranges.end(), [window](const auto& range) { return range->bytes > window; })) return run;
-    if (begin == run.base && end == run.base + run.bytes) return run;
+    if (begin == run.base) return run;
     return {};
 }
 
@@ -1449,8 +1493,32 @@ bool evictingRefusalCurrent(const HostImports& state, const EvictingRefusal& ref
     return refusal.epoch == state.epoch && refusal.liveBytes == state.liveBytes && budget <= refusal.budget && refusal.window == importWindow.load(std::memory_order_relaxed) && state.useCounter < refusal.ready && (state.buildFloor <= refusal.floor || state.useCounter < refusal.readyHeld);
 }
 
+void noteRetiredUnwatched(std::vector<std::pair<std::uint64_t, std::uint64_t>>& spans, const HostImport& entry, const GuestAllocations::Lease& lease) {
+    if (!entry.unwatched) return;
+    for (const auto& range : entry.ranges) {
+        if (leasedRangeOwner(lease, range->address) != range) continue;
+        const auto begin = std::max(range->address, entry.base);
+        const auto end = std::min(range->address + range->bytes, entry.base + entry.bytes);
+        if (begin < end) spans.emplace_back(begin, end);
+    }
+}
+
+void rewatchRetired(const HostImports& state, std::vector<std::pair<std::uint64_t, std::uint64_t>> spans) {
+    std::erase_if(spans, [&](const auto& span) {
+        auto it = state.imports.upper_bound(span.first);
+        if (it != state.imports.begin()) --it;
+        for (; it != state.imports.end() && it->first < span.second; ++it) {
+            if (it->second.unwatched && span.first < it->first + it->second.bytes) return true;
+        }
+        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> one{{span}};
+        return StorageTexture::AnyLiveOverlaps(one);
+    });
+    if (!spans.empty()) GuestMemory::Rewatch(spans);
+}
+
 std::uint64_t retireLeastRecent(const Context& context, HostImports& state, const GuestAllocations::Lease& lease, std::uint64_t wanted) {
     std::uint64_t freed = 0;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> unwatched;
     while (freed < wanted) {
         auto oldest = state.imports.end();
         for (auto it = state.imports.begin(); it != state.imports.end(); ++it) {
@@ -1458,8 +1526,10 @@ std::uint64_t retireLeastRecent(const Context& context, HostImports& state, cons
         }
         if (oldest == state.imports.end()) break;
         freed += oldest->second.pinnedBytes;
+        noteRetiredUnwatched(unwatched, oldest->second, lease);
         retireImport(context.device, state, oldest, lease);
     }
+    rewatchRetired(state, std::move(unwatched));
     return freed;
 }
 
@@ -1546,20 +1616,29 @@ std::string budgetSource(const Context& context, const HostImports& state, std::
 }
 
 std::atomic<std::uint64_t> rangeImportWindow{64ull << 20u};
+std::atomic<std::uint64_t> importMaxBytes{0};
 
 // The import of an access to a registered range larger than the range window: the cells the access touches, grown to
 // the union of the range's imports it overlaps, so accesses across neighbouring cell edges share one import instead of
 // replacing each other's.
-ImportRun windowRun(const HostImports& state, ImportRun run, std::uint64_t begin, std::uint64_t end, std::uint64_t alignment) {
+std::optional<std::pair<std::uint64_t, std::uint64_t>> importWindowBounds(const GuestAllocations::Range& range, std::uint64_t begin, std::uint64_t end, std::uint64_t alignment) {
     const auto window = rangeImportWindow.load(std::memory_order_relaxed);
-    if (run.ranges.size() != 1 || window == 0 || alignment == 0 || window % alignment != 0) return run;
-    const auto& range = *run.ranges.front();
-    if (range.bytes <= window || begin < range.address || end > range.address + range.bytes || end <= begin) return run;
+    if (window == 0 || alignment == 0 || window % alignment != 0 || range.bytes <= window || begin < range.address || end > range.address + range.bytes || end <= begin) return std::nullopt;
     const auto lastCell = range.bytes / window - 1;
     const auto cell = [&](std::uint64_t address) { return std::min((address - range.address) / window, lastCell); };
-    auto windowBegin = range.address + cell(begin) * window;
+    const auto windowBegin = range.address + cell(begin) * window;
     const auto endCell = cell(end - 1);
-    auto windowEnd = endCell == lastCell ? range.address + range.bytes : range.address + (endCell + 1) * window;
+    const auto windowEnd = endCell == lastCell ? range.address + range.bytes : range.address + (endCell + 1) * window;
+    if (windowBegin % alignment != 0 || (windowEnd - windowBegin) % alignment != 0) return std::nullopt;
+    return std::pair{windowBegin, windowEnd};
+}
+
+ImportRun windowRun(const HostImports& state, ImportRun run, std::uint64_t begin, std::uint64_t end, std::uint64_t alignment) {
+    if (run.ranges.size() != 1) return run;
+    const auto& range = *run.ranges.front();
+    const auto bounds = importWindowBounds(range, begin, end, alignment);
+    if (!bounds) return run;
+    auto [windowBegin, windowEnd] = *bounds;
     for (bool grown = true; grown;) {
         grown = false;
         auto it = state.imports.upper_bound(windowBegin);
@@ -1634,11 +1713,15 @@ const HostImport* importAllocation(const Context& context, HostImports& state, s
         }
     }
     const auto budget = evict ? 0 : effectiveBudget(context, state);
-    if (const auto index = leasedIndexContaining(lease, address); budget != 0 && index != lease.size() && stillRefused(state, rememberedRun(state.refusals, lease, index, index), budget) && findImport(state, address, address + 1) == nullptr) {
+    const auto index = leasedIndexContaining(lease, address);
+    const auto windowBounds = index != lease.size() && end != 0 ? importWindowBounds(*lease[index], address, end, context.hostImportAlignment) : std::nullopt;
+    const bool complete = !windowBounds || (windowBounds->first == lease[index]->address && windowBounds->second == lease[index]->address + lease[index]->bytes);
+    if (budget != 0 && index != lease.size() && complete && stillRefused(state, rememberedRun(state.refusals, lease, index, index), budget) && findImport(state, address, address + 1) == nullptr) {
         auto& counts = state.counts[static_cast<std::size_t>(requester)];
         ++counts.refused;
         counts.refusedBytes += lease[index]->bytes;
         ++counts.remembered;
+        ++state.budgetRefusals;
         return nullptr;
     }
     const auto bounds = importRunBounds(lease, address, largest, budget);
@@ -1653,6 +1736,66 @@ const HostImport* importAllocation(const Context& context, HostImports& state, s
     return importRunAt(context, state, std::move(run), false, address, lease, end, evict, requester);
 }
 
+struct ImportPiece {
+    std::uint64_t begin;
+    std::uint64_t end;
+    const HostImport* entry;
+};
+
+std::vector<ImportPiece> importPieces(const Context& context, HostImports& state, const GuestAllocations::Range& range, const GuestAllocations::Lease& lease) {
+    const auto limit = importMaxBytes.load(std::memory_order_relaxed);
+    const auto window = rangeImportWindow.load(std::memory_order_relaxed);
+    const auto alignment = context.hostImportAlignment;
+    if (limit < 2 * window || window == 0 || alignment == 0 || window % alignment != 0 || range.address % alignment != 0) return {};
+    const auto step = (limit / window - 1) * window;
+    const auto end = range.address + range.bytes;
+    std::vector<ImportPiece> pieces;
+    for (auto cursor = range.address; cursor < end;) {
+        const auto wanted = end - cursor < step + window ? end : cursor + step;
+        const auto* entry = importAllocation(context, state, cursor, lease, ImportRequester::Build, wanted, false);
+        if (entry == nullptr || entry->base > cursor || entry->bytes > limit) return {};
+        const auto to = std::min(end, entry->base + entry->bytes);
+        if (to <= cursor) return {};
+        pieces.push_back({cursor, to, entry});
+        cursor = to;
+    }
+    return pieces;
+}
+
+std::vector<ImportPiece> budgetedImportPieces(const Context& context, HostImports& state, const GuestAllocations::Range& range, const GuestAllocations::Lease& lease) {
+    const auto window = rangeImportWindow.load(std::memory_order_relaxed);
+    const auto alignment = context.hostImportAlignment;
+    if (!range.releasable || !GuestMemory::Watched(range.address, range.bytes) || window == 0 || alignment == 0 || window % alignment != 0 || range.address % alignment != 0 || range.bytes <= window) return {};
+    const auto end = range.address + range.bytes;
+    std::vector<ImportPiece> pieces;
+    for (auto cursor = range.address; cursor < end;) {
+        const HostImport* entry = nullptr;
+        if (const auto* previous = peekImport(state, cursor, cursor + 1); previous != nullptr && previous->base >= range.address && previous->base + previous->bytes <= end) {
+            entry = importAllocation(context, state, cursor, lease, ImportRequester::Build, std::min(end, previous->base + previous->bytes), false);
+        }
+        if (entry == nullptr) {
+            const auto budget = effectiveBudget(context, state);
+            auto room = budget - std::min(budget, state.liveBytes);
+            if (const auto limit = importMaxBytes.load(std::memory_order_relaxed); limit != 0) room = std::min(room, limit);
+            if (room < window) break;
+            auto wanted = cursor + std::min(end - cursor, window);
+            if (const auto bounds = importWindowBounds(range, cursor, wanted, alignment); bounds && bounds->second - bounds->first > room) {
+                wanted = range.address + (range.bytes / window - 1) * window;
+                if (wanted <= cursor) break;
+            }
+            entry = importAllocation(context, state, cursor, lease, ImportRequester::Build, wanted, false);
+        }
+        if (entry == nullptr || entry->base > cursor) break;
+        const auto to = std::min(end, entry->base + entry->bytes);
+        if (to <= cursor) break;
+        pieces.push_back({cursor, to, entry});
+        cursor = to;
+    }
+    if (pieces.empty()) return {};
+    if (pieces.back().end != end) pieces.push_back({pieces.back().end, end, nullptr});
+    return pieces;
+}
+
 const HostImport* importJoined(const Context& context, HostImports& state, std::uint64_t begin, std::uint64_t end, const GuestAllocations::Lease& lease) {
     if (const auto* low = peekImport(state, begin, begin + 1); low != nullptr && low->joined) begin = low->base;
     if (const auto* high = peekImport(state, end - 1, end); high != nullptr && high->joined) end = high->base + high->bytes;
@@ -1682,6 +1825,7 @@ const HostImport* importRunAt(const Context& context, HostImports& state, Import
         return &found->second;
     }
     if (alignment == 0 || base % alignment != 0 || bytes % alignment != 0) return nullptr;
+    if (const auto limit = importMaxBytes.load(std::memory_order_relaxed); limit != 0 && bytes > limit) return nullptr;
     if (const auto failed = failures.find(base); !stepDown && failed != failures.end()) {
         if (sameRun(failed->second, run)) return nullptr;
         failures.erase(failed);
@@ -1743,6 +1887,7 @@ const HostImport* importRunAt(const Context& context, HostImports& state, Import
         if (evict) state.evictingRefusals.insert_or_assign(std::pair{base, bytes}, EvictingRefusal{base, bytes, GuestAllocations::Mapped(run.ranges.begin(), run.ranges.end()), state.epoch, state.liveBytes, budget, room, importWindow.load(std::memory_order_relaxed), state.buildFloor, ready, readyHeld, joined});
         if (stepDown && containing != run.ranges.end() && room >= (*containing)->bytes) return importAllocation(context, state, address, lease, requester, end, evict, std::min(bytes / 2, room));
         if (containing != run.ranges.end() && run.ranges.size() > 1) remember((*containing)->address, (*containing)->bytes, GuestAllocations::Mapped{*containing});
+        ++state.budgetRefusals;
         return nullptr;
     }
     for (auto it = first; it != state.imports.end() && it->first < base + bytes;) {
@@ -1831,7 +1976,7 @@ const HostImport* importRunAt(const Context& context, HostImports& state, Import
         GuestMemory::ImportWatched(base, bytes, [&] {
             step = createBackingImport(context, entry, backing, result);
             return step == nullptr;
-        }, watchedDmaBuf);
+        }, watchedDmaBuf, false);
     }
     if (step == nullptr && entry.dmaBuf && bytes >= settleFloorBytes && context.settleQueue != VK_NULL_HANDLE && context.settleQueueMutex != nullptr) {
         static const bool traceSettle = std::getenv("APS5_TRACE_HOST_IMPORT") != nullptr;
@@ -1895,8 +2040,10 @@ const HostImport* importRunAt(const Context& context, HostImports& state, Import
     entry.joined = joined;
     entry.lastUse = ++state.useCounter;
 #ifdef _WIN32
-    if (deferredSettles.load(std::memory_order_relaxed) && entry.alias == nullptr && state.watchPrivateImports && writable && base % settleBlockBytes == 0 && bytes % settleBlockBytes == 0) {
-        if (entry.unwatched) {
+    if (deferredSettles.load(std::memory_order_relaxed) && entry.alias == nullptr && state.watchPrivateImports && writable) {
+        if (base % settleBlockBytes != 0 || bytes % settleBlockBytes != 0) {
+            entry.settleOnDemand = entry.unwatched;
+        } else if (entry.unwatched) {
             state.pendingSettles.insert_or_assign(base, PendingSettle{});
             state.settleWanted.push_back(base);
         } else if (settled && !GuestMemory::Watched(base, static_cast<std::size_t>(bytes))) {
@@ -1948,6 +2095,7 @@ void refreshImports(const Context& context, HostImports& state, const GuestAlloc
         state.reportNoted = 0;
         state.sparseRunEnds.clear();
         state.sparseRunJoins.clear();
+        state.importedAtMap.clear();
         state.device = context.device;
         state.destroyBuffer = context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer");
         state.freeMemory = context.Function<PFN_vkFreeMemory>("vkFreeMemory");
@@ -1966,6 +2114,7 @@ void refreshImports(const Context& context, HostImports& state, const GuestAlloc
     std::erase_if(state.sparseRunEnds, [&](const auto& entry) { return !starts(entry.first); });
     std::erase_if(state.sparseRunJoins, [&](const auto& entry) { return !starts(entry.first); });
     const auto budget = effectiveBudget(context, state);
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> unwatched;
     for (auto it = state.imports.begin(); it != state.imports.end();) {
         if (sameRange(it->second, lease, budget)) {
             if (it->second.unwatched) GuestMemory::Unwatch(it->first, it->second.bytes);
@@ -1975,9 +2124,11 @@ void refreshImports(const Context& context, HostImports& state, const GuestAlloc
         static const bool trace = std::getenv("APS5_TRACE_HOST_IMPORT") != nullptr;
         if (trace && leasedRangeOwner(lease, it->first, it->first + it->second.bytes) != nullptr) std::fprintf(stderr, "[gpu] host import of 0x%llx+0x%llx retired: the range was mapped again\n", static_cast<unsigned long long>(it->first), static_cast<unsigned long long>(it->second.bytes));
         const auto next = std::next(it);
+        noteRetiredUnwatched(unwatched, it->second, lease);
         retireImport(context.device, state, it, lease);
         it = next;
     }
+    rewatchRetired(state, std::move(unwatched));
     for (auto it = state.failed.begin(); it != state.failed.end();) it = sameRange(it->second, lease, budget) ? std::next(it) : state.failed.erase(it);
     for (auto it = state.failedJoins.begin(); it != state.failedJoins.end();) it = sameRun(it->second, joinedRun(lease, it->second.base, it->second.base + it->second.bytes)) ? std::next(it) : state.failedJoins.erase(it);
     for (auto it = state.failedBlocks.begin(); it != state.failedBlocks.end();) it = sameRun(it->second, exactRun(lease, it->first.first, it->first.second)) ? std::next(it) : state.failedBlocks.erase(it);
@@ -2148,6 +2299,39 @@ void unlistMirror(ImageMirrors& state, ImageMirror& mirror) {
     mirror.listed = false;
 }
 
+struct JoinedHeapRange {
+    std::vector<std::weak_ptr<const GuestAllocations::Range>> members;
+    std::shared_ptr<const GuestAllocations::Range> range;
+};
+
+struct JoinedHeapRanges {
+    std::mutex mutex;
+    std::map<std::uint64_t, JoinedHeapRange> entries;
+};
+
+JoinedHeapRanges& JoinedHeaps() {
+    static JoinedHeapRanges ranges;
+    return ranges;
+}
+
+bool releaseExpiredJoinedHeaps() {
+    std::vector<std::shared_ptr<const GuestAllocations::Range>> released;
+    {
+        auto& joined = JoinedHeaps();
+        std::lock_guard lock(joined.mutex);
+        for (auto it = joined.entries.begin(); it != joined.entries.end();) {
+            const auto& members = it->second.members;
+            if (std::none_of(members.begin(), members.end(), [](const auto& member) { return member.expired(); })) {
+                ++it;
+                continue;
+            }
+            released.push_back(std::move(it->second.range));
+            it = joined.entries.erase(it);
+        }
+    }
+    return !released.empty();
+}
+
 std::uint64_t blockBytes(const GuestRuns& runs) {
     constexpr std::uint64_t block = ResidentBuffer::BlockBytes;
     std::uint64_t blocks = 0;
@@ -2654,10 +2838,21 @@ bool importsNow(const Context& context, HostImports& state, const GuestAllocatio
     return context.hostImportAlignment != 0 && (importsStale(context, state) || importAllocation(context, state, address, lease, ImportRequester::Build, 0, false) != nullptr);
 }
 
+const char* heapCopyReason(bool overBudget, bool watched) {
+    if (overBudget) return watched ? "import over the host import budget, heap mirror refused" : "import over the host import budget, heap not fully write-watched";
+    return watched ? "heap mirror refused" : "heap not fully write-watched";
+}
+
 // The mirror for a leased image range: the existing one, or a new one when none exists or the
 // registered Range object changed (a protection change). Null when the range cannot be mirrored. An
 // existing writable mirror's blocks are appended to `blocks` for the caller's one compare of every
-std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::shared_ptr<const GuestAllocations::Range>& range, std::vector<RefreshBlock>& blocks, bool heap) {
+std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::shared_ptr<const GuestAllocations::Range>& range, std::vector<RefreshBlock>& blocks, bool heap, std::uint64_t begin = 0, std::uint64_t bytes = 0, bool joinedHeap = false) {
+    auto selected = *range;
+    if (bytes != 0) {
+        Require(begin >= range->address && bytes <= range->bytes && begin - range->address <= range->bytes - bytes, "heap mirror selection exceeds its registered range");
+        selected.address = begin;
+        selected.bytes = static_cast<std::size_t>(bytes);
+    }
     auto& state = Mirrors();
     std::shared_ptr<ImageMirror> mirror;
     {
@@ -2670,31 +2865,32 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
             state.device = context.device;
             ++state.version;
         }
-        if (state.failed.contains(range->address)) return nullptr;
-        const auto found = state.entries.find(range->address);
-        if (found != state.entries.end() && sameRange(found->second->range, range) && found->second->reserved == range->bytes && found->second->writable == range->writable && found->second->heap == heap) mirror = found->second;
+        if (state.failed.contains(selected.address)) return nullptr;
+        const auto found = state.entries.find(selected.address);
+        if (found != state.entries.end() && sameRange(found->second->range, range) && found->second->reserved == selected.bytes && found->second->writable == range->writable && found->second->heap == heap && found->second->joinedHeap == joinedHeap) mirror = found->second;
     }
     if (mirror != nullptr) {
         if (!mirror->sparse) {
-            if (!heap && prepareRefresh(*mirror, range->address, range->bytes)) appendBlocks(blocks, *mirror, range->address, range->bytes);
+            if (!heap && prepareRefresh(*mirror, selected.address, selected.bytes)) appendBlocks(blocks, *mirror, selected.address, selected.bytes);
             return mirror;
         }
         if (refreshSparseMirror(*mirror, blocks)) return mirror;
     }
     Pieces pieces;
-    if (!GuestMemory::Accessible(reinterpret_cast<const void*>(range->address), range->bytes, range->writable && !heap)) {
+    if (!GuestMemory::Accessible(reinterpret_cast<const void*>(selected.address), selected.bytes, range->writable && !heap)) {
         if (!heap || !sparseMirrorsEnabled()) return nullptr;
-        pieces = GuestMemory::DescribeCommitted(range->address, range->bytes).ranges;
+        pieces = GuestMemory::DescribeCommitted(selected.address, selected.bytes).ranges;
         if (pieces.empty()) return nullptr;
     }
     const bool sparse = !pieces.empty();
     mirror = std::make_shared<ImageMirror>();
-    mirror->base = range->address;
-    mirror->bytes = sparse ? sparseExtent(range->address, range->bytes, pieces) : range->bytes;
-    mirror->reserved = range->bytes;
+    mirror->base = selected.address;
+    mirror->bytes = sparse ? sparseExtent(selected.address, selected.bytes, pieces) : selected.bytes;
+    mirror->reserved = selected.bytes;
     mirror->sparse = sparse;
     mirror->writable = range->writable;
     mirror->heap = heap;
+    mirror->joinedHeap = joinedHeap;
     mirror->range = range;
     GuestRuns backed;
     if (heap) {
@@ -2704,8 +2900,8 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
             syncRange(mirror->base, mirror->bytes);
             if (GuestMemory::Watched(mirror->base, static_cast<std::size_t>(mirror->bytes))) generation = collectPieces(pieces);
         } else {
-            prepareRefresh(*mirror, range->address, range->bytes);
-            generation = GuestMemory::CollectWrites(range->address, range->bytes);
+            prepareRefresh(*mirror, selected.address, selected.bytes);
+            generation = GuestMemory::CollectWrites(selected.address, selected.bytes);
         }
         constexpr std::uint64_t block = 65536;
         mirror->generations.assign(static_cast<std::size_t>(((mirror->base + mirror->bytes + block - 1) / block) - mirror->base / block), generation);
@@ -2713,7 +2909,7 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
             std::shared_ptr<ImageMirror> stale;
             std::lock_guard lock(state.mutex);
             ++state.heapUnwatched;
-            if (const auto found = state.entries.find(range->address); found != state.entries.end() && found->second->heap) {
+            if (const auto found = state.entries.find(selected.address); found != state.entries.end() && found->second->heap) {
                 unlistMirror(state, *found->second);
                 stale = std::move(found->second);
                 state.entries.erase(found);
@@ -2724,7 +2920,7 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
         mirror->watchedSerial.store(serial, std::memory_order_relaxed);
         if (context.sparseBinding && context.sparseResidencyBuffer && context.sparseResidencyAliased) backed = GuestNonzeroBlocks(sparse ? clipPieces(pieces, mirror->base, mirror->base + mirror->bytes) : GuestRuns{{mirror->base, mirror->base + mirror->bytes}});
         auto need = blockBytes(backed);
-        reserveHeapBytes(range->address, range->bytes, need);
+        reserveHeapBytes(selected.address, selected.bytes, need);
         try {
             mirror->resident = ResidentBuffer::Create(context, mirror->base, mirror->bytes, backed);
         } catch (const std::runtime_error& error) {
@@ -2734,7 +2930,7 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
                 state.heapBytes -= need;
                 held = state.heapBytes;
             }
-            throw std::runtime_error(heapMirrorError(range->address, range->bytes, held, error.what()));
+            throw std::runtime_error(heapMirrorError(selected.address, selected.bytes, held, error.what()));
         }
         if (mirror->resident == nullptr) {
             {
@@ -2742,7 +2938,7 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
                 state.heapBytes -= need;
             }
             need = mirror->bytes;
-            reserveHeapBytes(range->address, range->bytes, need);
+            reserveHeapBytes(selected.address, selected.bytes, need);
         }
         mirror->accounted = need;
     }
@@ -2762,9 +2958,9 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
         std::lock_guard lock(state.mutex);
         ++state.rebuilds;
         mirror->serial = (1ull << 63u) | ++state.serials;
-        if (const auto found = state.entries.find(range->address); found != state.entries.end() && found->second->heap) unlistMirror(state, *found->second);
+        if (const auto found = state.entries.find(selected.address); found != state.entries.end() && found->second->heap) unlistMirror(state, *found->second);
         mirror->listed = true;
-        state.entries[range->address] = mirror;
+        state.entries[selected.address] = mirror;
         ++state.version;
         return mirror;
     }
@@ -2778,11 +2974,11 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
                 state.heapBytes -= mirror->accounted;
                 held = state.heapBytes;
             }
-            throw std::runtime_error(heapMirrorError(range->address, range->bytes, held, error.what()));
+            throw std::runtime_error(heapMirrorError(selected.address, selected.bytes, held, error.what()));
         }
-        std::fprintf(stderr, "[gpu] image mirror of 0x%llx+0x%llx failed: %s; falling back to copies\n", static_cast<unsigned long long>(range->address), static_cast<unsigned long long>(range->bytes), error.what());
+        std::fprintf(stderr, "[gpu] image mirror of 0x%llx+0x%llx failed: %s; falling back to copies\n", static_cast<unsigned long long>(selected.address), static_cast<unsigned long long>(selected.bytes), error.what());
         std::lock_guard lock(state.mutex);
-        state.failed.insert(range->address);
+        state.failed.insert(selected.address);
         return nullptr;
     }
     // Read stores GPU results pending in the range first (write-backs of earlier copies of it);
@@ -2790,7 +2986,7 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
     {
         const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::MirrorRefresh);
         const auto target = mirror->buffer->Bytes().first(static_cast<std::size_t>(mirror->bytes));
-        if (!sparse) GuestMemory::Read(range->address, target);
+        if (!sparse) GuestMemory::Read(selected.address, target);
         std::size_t cursor = 0;
         for (const auto& [first, last] : pieces) {
             const auto at = static_cast<std::size_t>(first - mirror->base);
@@ -2806,9 +3002,9 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
     ++state.rebuilds;
     mirror->serial = (1ull << 63u) | ++state.serials;
     // A replaced mirror lives on in the regions of recorded work that bound it.
-    if (const auto found = state.entries.find(range->address); found != state.entries.end() && found->second->heap) unlistMirror(state, *found->second);
+    if (const auto found = state.entries.find(selected.address); found != state.entries.end() && found->second->heap) unlistMirror(state, *found->second);
     mirror->listed = heap;
-    state.entries[range->address] = mirror;
+    state.entries[selected.address] = mirror;
     ++state.version;
     return mirror;
 }
@@ -2827,9 +3023,11 @@ std::shared_ptr<ImageMirror> findMirror(const Context& context, std::uint64_t be
 
 // Drops mirrors whose registered range is gone (a later build made a new one for the replacement).
 void sweepMirrors() {
+    const bool released = releaseExpiredJoinedHeaps();
     const auto space = Spaces().current.load();
     auto& state = Mirrors();
     std::lock_guard lock(state.mutex);
+    if (released) ++state.version;
     if (space != nullptr && state.pinnedSpace == space->serial && state.pinnedVersion == state.version) return;
     ++state.sweeps;
     bool pinned = space != nullptr;
@@ -2851,20 +3049,43 @@ void sweepMirrors() {
     state.pinnedVersion = state.version;
 }
 
-void releaseImportedMirrors(const Context& context, const std::vector<std::uint64_t>& imported) {
+void releaseImportedMirrors(const Context& context, std::span<const std::pair<std::uint64_t, std::uint64_t>> imported) {
     if (imported.empty()) return;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> coverage(imported.begin(), imported.end());
+    std::sort(coverage.begin(), coverage.end());
+    std::size_t count = 0;
+    for (const auto& interval : coverage) {
+        if (count != 0 && interval.first <= coverage[count - 1].second) coverage[count - 1].second = std::max(coverage[count - 1].second, interval.second);
+        else coverage[count++] = interval;
+    }
+    coverage.resize(count);
     std::vector<std::shared_ptr<ImageMirror>> released;
     auto& state = Mirrors();
     std::lock_guard lock(state.mutex);
     if (state.device != context.device || state.entries.empty()) return;
-    for (const auto base : imported) {
-        const auto found = state.entries.find(base);
-        if (found == state.entries.end() || !found->second->heap) continue;
-        state.heapImportedBytes += found->second->accounted;
-        unlistMirror(state, *found->second);
-        ++state.heapImported;
-        released.push_back(std::move(found->second));
-        state.entries.erase(found);
+    for (const auto& [begin, end] : imported) {
+        auto it = state.entries.upper_bound(begin);
+        if (it != state.entries.begin()) --it;
+        while (it != state.entries.end() && it->first < end) {
+            const auto& mirror = it->second;
+            if (!mirror->heap || mirror->base + mirror->bytes <= begin) {
+                ++it;
+                continue;
+            }
+            if (mirror->joinedHeap) {
+                const auto covered = std::upper_bound(coverage.begin(), coverage.end(), mirror->base, [](std::uint64_t address, const auto& interval) { return address < interval.first; });
+                if (covered == coverage.begin() || std::prev(covered)->second < mirror->base + mirror->reserved) {
+                    ++it;
+                    continue;
+                }
+            }
+            ++state.heapImported;
+            state.heapImportedBytes += mirror->accounted;
+            unlistMirror(state, *mirror);
+            released.push_back(std::move(it->second));
+            it = state.entries.erase(it);
+            ++state.version;
+        }
     }
 }
 
@@ -3167,7 +3388,8 @@ std::string AddressCopyOverflow(std::vector<AddressCopy> copies, std::uint64_t l
     std::string message = text;
     for (std::size_t index = 0; index < copies.size() && index < 8; ++index) {
         const auto& copy = copies[index];
-        std::snprintf(text, sizeof(text), " 0x%llx+0x%llx (%.1f MiB committed, %s)", static_cast<unsigned long long>(copy.begin), static_cast<unsigned long long>(copy.end - copy.begin), copy.committed / 1048576.0, copy.reason);
+        const char* reason = copy.heap ? heapCopyReason(copy.overBudget, GuestMemory::Watched(copy.begin, copy.end - copy.begin)) : copy.reason;
+        std::snprintf(text, sizeof(text), " 0x%llx+0x%llx (%.1f MiB committed, %s)", static_cast<unsigned long long>(copy.begin), static_cast<unsigned long long>(copy.end - copy.begin), copy.committed / 1048576.0, reason);
         message += text;
     }
     return message;
@@ -3236,6 +3458,7 @@ void ClearHostImports(VkDevice device) {
     auto& state = Imports();
     std::lock_guard lock(state.mutex);
     state.parked.erase(device);
+    state.importedAtMap.clear();
 #ifdef _WIN32
     if (device == state.device) drainSettles(state);
 #endif
@@ -3498,6 +3721,10 @@ void SetHostImportRangeWindow(std::uint64_t bytes) {
     rangeImportWindow.store(bytes, std::memory_order_relaxed);
 }
 
+void SetHostImportMaxBytes(std::uint64_t bytes) {
+    importMaxBytes.store(bytes, std::memory_order_relaxed);
+}
+
 void SetHostImportBudget(std::uint64_t bytes) {
     budgetOverride.store(bytes, std::memory_order_relaxed);
     auto& state = Imports();
@@ -3643,6 +3870,22 @@ const HostImport* ExistingHostImportFor(const Context& context, std::uint64_t ad
     return findImport(state, address, address + bytes);
 }
 
+bool WatchedAfterSettle(const Context& context, std::uint64_t address, std::size_t bytes) {
+#ifdef _WIN32
+    if (context.hostImportAlignment != 0 && bytes != 0 && bytes <= std::numeric_limits<std::uint64_t>::max() - address && GuestMemory::GpuMutex().HeldByThisThread()) {
+        ensurePinWaiter();
+        auto& state = Imports();
+        std::lock_guard lock(state.mutex);
+        if (importsStale(context, state)) {
+            const auto lease = GuestAllocations::GuestAllocationsAcquire_nid_postfix();
+            refreshImports(context, state, lease);
+        }
+        settleImportsNow(context, state, address, address + bytes);
+    }
+#endif
+    return GuestMemory::Watched(address, bytes);
+}
+
 bool ImportMappedRanges(const Context& context, const GuestAllocations::Mapped& ranges, std::uint64_t generation, bool adoptDevice) {
     if (context.hostImportAlignment == 0) return true;
     ensurePinWaiter();
@@ -3657,16 +3900,18 @@ bool ImportMappedRanges(const Context& context, const GuestAllocations::Mapped&
     } else if (state.refreshedGeneration > generation) {
         return true;
     }
-    if (!adopting) current = GuestAllocations::GuestAllocationsAcquire_nid_postfix();
     for (const auto& mapped : ranges) {
         const auto range = mapped.lock();
-        if (range == nullptr || leasedRangeOwner(current, range->address) != range) continue;
+        if (range == nullptr || range->bytes <= 0x10000) continue;
+        if (current.empty()) current = GuestAllocations::GuestAllocationsAcquire_nid_postfix();
+        if (leasedRangeOwner(current, range->address) != range) continue;
         try {
             if (!GuestMemory::GpuMutex().HeldByThisThread()) {
                 const auto run = importRun(current, range->address, std::numeric_limits<std::uint64_t>::max(), effectiveBudget(context, state));
                 const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> span{{{run.base, run.base + run.bytes}}};
                 if (wouldRetireImport(state, run) || StorageTexture::AnyPendingOverlaps(span)) return false;
             }
+            if (!state.importedAtMap.emplace(range->address, range->bytes).second && findImport(state, range->address, range->address + range->bytes) == nullptr) continue;
             importAllocation(context, state, range->address, current, ImportRequester::Map, 0, false);
         } catch (const std::exception& error) {
             std::fprintf(stderr, "[gpu] import of GPU memory mapped at 0x%llx+0x%zx failed: %s\n", static_cast<unsigned long long>(range->address), range->bytes, error.what());
@@ -3705,6 +3950,21 @@ bool HostImportCovers(const Context& context, std::uint64_t address, std::size_t
     return state.device == context.device && peekImport(state, address, address + bytes) != nullptr;
 }
 
+bool ComparedHostImportCovers(const Context& context, std::uint64_t address, std::size_t bytes) {
+#ifdef _WIN32
+    static_cast<void>(context);
+    static_cast<void>(address);
+    static_cast<void>(bytes);
+    return false;
+#else
+    if (context.hostImportAlignment == 0 || bytes == 0 || bytes > std::numeric_limits<std::uint64_t>::max() - address) return false;
+    auto& state = Imports();
+    std::lock_guard lock(state.mutex);
+    const auto* import = state.device == context.device ? peekImport(state, address, address + bytes) : nullptr;
+    return import != nullptr && import->unwatched;
+#endif
+}
+
 GuestBufferMemory::GuestBufferMemory(const Context& context) : context(context) {}
 
 bool GuestBufferMemory::WritesOverlap(std::uint64_t address, std::size_t bytes) const {
@@ -3850,35 +4110,79 @@ void GuestBufferMemory::AcquireRegistered() {
         // The import lock is taken per range: a mirror's preparation may wait for recorded work, which
         // must not happen under it.
         regions.reserve(lease.size());
+        static const std::uint64_t copyLimit = [] {
+            const char* value = std::getenv("APS5_ADDRESS_COPY_MAX_MIB");
+            return (value ? std::strtoull(value, nullptr, 10) : 64ull) << 20u;
+        }();
+        const auto copyOverride = addressCopyLimitOverride.load(std::memory_order_relaxed);
+        const auto cap = copyOverride != 0 ? copyOverride : copyLimit;
         std::vector<AddressCopy> copies;
-        std::vector<std::uint64_t> imported;
+        std::vector<std::pair<std::uint64_t, std::uint64_t>> imported;
         const HostImport* covering = nullptr;
         std::uint64_t coveredBegin = 0;
         std::uint64_t coveredEnd = 0;
+        std::uint64_t copiedBytes = 0;
         for (const auto& range : lease) {
             if (!range->readable || !range->gpu) continue;
             validate(range->address, range->bytes);
             Region region{range->address, range->address + range->bytes, range->writable, {}, nullptr};
             const HostImport* entry = nullptr;
+            bool overBudget = false;
+            std::vector<ImportPiece> pieces;
+            const auto limit = importMaxBytes.load(std::memory_order_relaxed);
             if (importable && covering != nullptr && range->address >= coveredBegin && range->address + range->bytes <= coveredEnd) {
                 entry = covering;
+            } else if (importable && limit != 0 && range->bytes > limit) {
+                auto& state = Imports();
+                std::lock_guard lock(state.mutex);
+                pieces = importPieces(context, state, *range, lease);
             } else if (importable) {
                 auto& state = Imports();
                 std::lock_guard lock(state.mutex);
+                const auto refusals = state.budgetRefusals;
                 entry = importAllocation(context, state, range->address, lease, ImportRequester::Build, 0, false);
+                overBudget = state.budgetRefusals != refusals;
                 covering = entry;
                 if (entry != nullptr) {
                     coveredBegin = entry->base;
                     coveredEnd = entry->base + entry->bytes;
                 }
             }
+            if (importable && mirrorsEnabled() && entry == nullptr && pieces.empty()) {
+                auto& state = Imports();
+                std::lock_guard lock(state.mutex);
+                pieces = budgetedImportPieces(context, state, *range, lease);
+            }
             lap(timing.importsUs, at);
+            if (!pieces.empty()) {
+                const auto firstImported = imported.size();
+                for (const auto& piece : pieces) if (piece.entry != nullptr) imported.emplace_back(piece.begin, piece.end);
+                releaseImportedMirrors(context, std::span(imported).subspan(firstImported));
+                for (const auto& piece : pieces) {
+                    Region part{piece.begin, piece.end, range->writable, {}, nullptr};
+                    if (piece.entry != nullptr) {
+                        part.hostBacked = true;
+                        part.direct = piece.entry;
+                    } else {
+                        part.mirror = acquireMirror(context, range, blocks, true, piece.begin, piece.end - piece.begin);
+                        lap(timing.mirrorsUs, at);
+                        Require(part.mirror != nullptr, "a partial heap import has no mirror for its remaining bytes");
+                        mirrored = true;
+                        if (part.mirror->sparse) {
+                            part.sparse = true;
+                            part.backed = part.mirror->committed;
+                        } else heaps.push_back(part.mirror.get());
+                    }
+                    regions.push_back(std::move(part));
+                }
+                continue;
+            }
             if (entry != nullptr) {
                 region.hostBacked = true;
                 // Reused by Upload while no import was dropped since (see importsEpoch).
                 region.direct = entry;
                 regions.push_back(std::move(region));
-                imported.push_back(range->address);
+                imported.emplace_back(range->address, range->address + range->bytes);
                 continue;
             }
             if (mirrorsEnabled()) {
@@ -3903,17 +4207,36 @@ void GuestBufferMemory::AcquireRegistered() {
                 committed = 0;
                 for (const auto& [first, last] : copied.backed) committed += last - first;
             }
-            const char* reason = !mirrorsEnabled() ? "mirrors disabled by APS5_NO_LEASE_MIRROR" : copied.sparse ? "unreadable pages" : !range->releasable ? "image mirror refused" : "outside the write-watched arena";
-            copies.push_back({copied.begin, copied.end, committed, reason});
+            if (overBudget && copiedBytes + committed > cap) {
+                auto& state = Imports();
+                std::lock_guard lock(state.mutex);
+                entry = importAllocation(context, state, range->address, lease, ImportRequester::Build, 0, true);
+                if (entry != nullptr) {
+                    covering = entry;
+                    coveredBegin = entry->base;
+                    coveredEnd = entry->base + entry->bytes;
+                }
+                static auto lastReport = std::chrono::steady_clock::now() - std::chrono::seconds(60);
+                if (entry != nullptr && std::chrono::steady_clock::now() - lastReport > std::chrono::seconds(10)) {
+                    lastReport = std::chrono::steady_clock::now();
+                    std::fprintf(stderr, "[gpu] host import budget: 0x%llx+0x%llx imported by evicting idle imports, as copying it would pass APS5_ADDRESS_COPY_MAX_MIB\n", static_cast<unsigned long long>(range->address), static_cast<unsigned long long>(range->bytes));
+                }
+            }
+            if (entry != nullptr) {
+                regions.pop_back();
+                region.hostBacked = true;
+                region.direct = entry;
+                regions.push_back(std::move(region));
+                imported.emplace_back(range->address, range->address + range->bytes);
+                continue;
+            }
+            copiedBytes += committed;
+            const char* reason = !mirrorsEnabled() ? "mirrors disabled by APS5_NO_LEASE_MIRROR" : copied.sparse ? "unreadable pages" : !range->releasable ? "image mirror refused" : nullptr;
+            copies.push_back({copied.begin, copied.end, committed, reason, reason == nullptr, overBudget});
         }
         releaseImportedMirrors(context, imported);
         regionsSorted = sortedLookup;
-        static const std::uint64_t copyLimit = [] {
-            const char* value = std::getenv("APS5_ADDRESS_COPY_MAX_MIB");
-            return (value ? std::strtoull(value, nullptr, 10) : 64ull) << 20u;
-        }();
-        const auto limit = addressCopyLimitOverride.load(std::memory_order_relaxed);
-        if (const auto overflow = AddressCopyOverflow(std::move(copies), limit != 0 ? limit : copyLimit); !overflow.empty()) {
+        if (const auto overflow = AddressCopyOverflow(std::move(copies), cap); !overflow.empty()) {
             std::fprintf(stderr, "FATAL: %s\n", overflow.c_str());
             std::fflush(stderr);
             std::abort();
@@ -4161,15 +4484,40 @@ bool GuestBufferMemory::sparseHeapCandidate(const Region& region) {
     return region.sparseHeap && region.sparse && region.mirror == nullptr && region.direct == nullptr && (region.hostBacked || region.writable) && mirrorsEnabled() && sparseMirrorsEnabled();
 }
 
+std::shared_ptr<const GuestAllocations::Range> joinedHeapRange(const GuestAllocations::Lease& lease, std::uint64_t begin, std::uint64_t end) {
+    const auto run = crossedRun(lease, begin, end);
+    if (run.ranges.size() < 2 || std::any_of(run.ranges.begin(), run.ranges.end(), [](const auto& range) { return !range->releasable; })) return nullptr;
+    releaseExpiredJoinedHeaps();
+    auto& joined = JoinedHeaps();
+    std::lock_guard lock(joined.mutex);
+    auto& entry = joined.entries[run.base];
+    bool same = entry.range != nullptr && entry.members.size() == run.ranges.size();
+    for (std::size_t index = 0; same && index < run.ranges.size(); ++index) same = sameRange(entry.members[index], run.ranges[index]);
+    if (!same) {
+        const auto& first = *run.ranges.front();
+        entry.members.assign(run.ranges.begin(), run.ranges.end());
+        entry.range = std::make_shared<const GuestAllocations::Range>(GuestAllocations::Range{run.base, static_cast<std::size_t>(run.bytes), true, first.writable, first.allocationAddress, first.allocationBytes, true, first.gpu, first.backingSerial});
+    }
+    return entry.range;
+}
+
 bool GuestBufferMemory::bindSparseMirror(Region& region, const GuestAllocations::Lease& lease) {
     const auto backedEnd = region.backed.empty() ? region.begin : region.backed.back().second;
     const auto neededEnd = std::min(region.end, std::max(backedEnd, std::max(region.lastView, region.begin) + 4u));
-    const auto* range = containingRange(lease, region.begin, neededEnd);
-    if (range == nullptr || !range->releasable) return false;
+    std::shared_ptr<const GuestAllocations::Range> owner;
+    bool joined = false;
+    if (const auto* range = containingRange(lease, region.begin, neededEnd); range != nullptr) {
+        if (!range->releasable) return false;
+        owner = leasedRangeOwner(lease, range->address);
+    } else {
+        joined = true;
+        owner = joinedHeapRange(lease, region.begin, neededEnd);
+        if (owner == nullptr) return false;
+    }
     std::vector<RefreshBlock> blocks;
     std::shared_ptr<ImageMirror> mirror;
     try {
-        mirror = acquireMirror(context, leasedRangeOwner(lease, range->address), blocks, true);
+        mirror = acquireMirror(context, owner, blocks, true, 0, 0, joined);
     } catch (const std::runtime_error& error) {
         static std::atomic<int> reported{0};
         if (reported.fetch_add(1, std::memory_order_relaxed) < 4) std::fprintf(stderr, "[gpu] %s; copying the sparse heap instead\n", error.what());
@@ -4353,6 +4701,7 @@ VkBufferUsageFlags gpuCopyUsage(bool addressable) {
 // window takes those elements there. APS5_ATOMIC_STAGE_MAX_KIB (1024) bounds the atomic one.
 constexpr std::uint64_t SweptShadowMax = std::uint64_t{16} << 20u;
 constexpr std::uint64_t DiscreteWrittenShadowMax = std::uint64_t{8} << 20u;
+constexpr std::uint64_t DiscreteSweptShadowMax = std::uint64_t{256} << 20u;
 
 bool writtenShadowEnabled() {
     static const bool disabled = std::getenv("APS5_NO_WRITTEN_SHADOW") != nullptr;
@@ -4495,7 +4844,7 @@ bool GuestBufferMemory::stagingEligible(const Region& region, bool addressable)
     const auto bytes = region.end - region.begin;
     if (!WritesOverlap(region.begin, static_cast<std::size_t>(bytes))) return false;
     if (region.atomic && atomicStagingEnabled() && bytes <= atomicStageMax()) return true;
-    return writtenShadowEnabled() && bytes >= writtenShadowMin() && bytes <= (region.swept ? std::max(writtenShadowMax(context.discreteGpu), SweptShadowMax) : writtenShadowMax(context.discreteGpu));
+    return writtenShadowEnabled() && bytes >= writtenShadowMin() && bytes <= (region.swept ? std::max(writtenShadowMax(context.discreteGpu), context.discreteGpu ? DiscreteSweptShadowMax : SweptShadowMax) : writtenShadowMax(context.discreteGpu));
 }
 
 bool GuestBufferMemory::overlayCandidate(const Region& inside, bool readOnly) const {
@@ -4709,7 +5058,7 @@ void GuestBufferMemory::UploadPrepare(bool addressable) {
 
 void GuestBufferMemory::completeSpaceWrites() const {
     auto* recorder = Recorder::Active();
-    if (recorder == nullptr || Recorder::InCompletion()) return;
+    if (recorder == nullptr || Recorder::InCompletion() || !AnyPendingCpuWrites(context)) return;
     const auto& base = space->base;
     std::vector<std::pair<std::uint64_t, std::uint64_t>> writes;
     std::vector<std::size_t> candidates;
@@ -5488,7 +5837,10 @@ void GuestBufferMemory::MarkDirectWrites() const {
         const auto* found = owner(begin, end);
         if (found == nullptr) continue;
         const auto& region = *found;
-        if (region.direct != nullptr || (region.gpuCopy && region.copiedBack)) GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin));
+        if (region.direct != nullptr || (region.gpuCopy && region.copiedBack)) {
+            const auto generation = GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin));
+            if (generation != 0) directWritesGeneration = std::max(directWritesGeneration, generation);
+        }
     }
 }
 
@@ -5580,7 +5932,7 @@ void GuestBufferMemory::WriteBack() {
         if (region.direct == nullptr && !(region.gpuCopy && (region.copiedBack || region.deviceLocal)) && !(region.mirror != nullptr && !region.mirror->writable)) Recorder::NoteWrittenBack(begin, static_cast<std::size_t>(end - begin));
         if (region.direct != nullptr) {
             // The GPU wrote imported guest memory directly; page write watching did not see it.
-            GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin));
+            StorageTexture::StampKeepingNewerResults(begin, static_cast<std::size_t>(end - begin), directWritesGeneration, [&] { return GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin)); });
             continue;
         }
         if (region.mirror != nullptr) {
@@ -5624,7 +5976,7 @@ void GuestBufferMemory::WriteBack() {
             if (region.copiedBack) {
                 // The GPU copied the written sub-range back into the import; page write watching
                 // did not see it.
-                GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin));
+                StorageTexture::StampKeepingNewerResults(begin, static_cast<std::size_t>(end - begin), directWritesGeneration, [&] { return GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin)); });
                 continue;
             }
             static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp
index 1249e08037..7a7788c964 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp
@@ -6,6 +6,7 @@
 #include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include <algorithm>
 #include <array>
+#include <bit>
 #include <optional>
 #include <stdexcept>
 #include <string>
@@ -179,12 +180,15 @@ GuestTextureResource DecodeTextureResource(std::span<const std::uint32_t> words)
     Require(baseLevel <= lastLevel, "guest texture descriptor has a base mip level past its last mip level");
 
     const bool fmask = ShaderRecompiler::IsFmaskTextureFormat(static_cast<ShaderRecompiler::IrBufferFormat>(format));
+    const auto fmaskLayout = ShaderRecompiler::FmaskLayoutOf(static_cast<ShaderRecompiler::IrBufferFormat>(format));
     if (fmask) {
-        Require(format == static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Fmask32_S8_F8), "guest FMASK format is not implemented");
+        Require(fmaskLayout.has_value(), "guest FMASK format is not implemented");
         Require(!writeCompress && (!metaCompress || metaAddr != 0u), "FMASK CMASK compression is not implemented without readable metadata");
         Require(!metaCompress || metaPipeAligned, "FMASK CMASK metadata must be pipe aligned");
+        Require(!metaCompress || format == static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Fmask32_S8_F8), "FMASK CMASK compression is implemented only for 8-sample, 8-fragment FMASK");
         Require((typeRaw == 9u || typeRaw == 13u) && tileModeRaw == 24u && baseLevel == 0u && lastLevel == 0u && maxMip == 0u, "FMASK reads require a single-mip 2D or 2D-array Z_64KB_X surface");
-        for (const auto selector : {dstSelX, dstSelY, dstSelZ, dstSelW}) Require(selector == 0u || selector == 1u || selector == 4u, "FMASK destination channel selector is not implemented");
+        const bool identity = format != static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Fmask32_S8_F8) && dstSelX == 4u && dstSelY == 5u && dstSelZ == 6u && dstSelW == 7u;
+        for (const auto selector : {dstSelX, dstSelY, dstSelZ, dstSelW}) Require(identity || selector == 0u || selector == 1u || selector == 4u, "FMASK destination channel selector is not implemented");
     }
 
     const auto describe = [&] { return " (format " + std::to_string(format) + ", " + std::to_string(width) + "x" + std::to_string(height) + "x" + std::to_string(depth + 1) + ", type " + std::to_string(typeRaw) + ", tile " + std::to_string(tileModeRaw) + ", mips " + std::to_string(baseLevel) + ".." + std::to_string(lastLevel) + " of " + std::to_string(maxMip + 1) + ")"; };
@@ -265,7 +269,7 @@ GuestTextureResource DecodeTextureResource(std::span<const std::uint32_t> words)
     result.lastLevel = lastLevel;
     result.tileMode = tileMode;
     result.dimension = dimension;
-    result.format = fmask ? static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format32UInt) : format;
+    result.format = !fmask ? format : static_cast<std::uint32_t>(fmaskLayout->storageBits == 8u ? ShaderRecompiler::IrBufferFormat::Format8UInt : fmaskLayout->storageBits == 16u ? ShaderRecompiler::IrBufferFormat::Format16UInt : ShaderRecompiler::IrBufferFormat::Format32UInt);
     result.dstSelX = static_cast<std::uint8_t>(dstSelX);
     result.dstSelY = static_cast<std::uint8_t>(dstSelY);
     result.dstSelZ = static_cast<std::uint8_t>(dstSelZ);
@@ -289,6 +293,43 @@ GuestTextureResource DecodeTextureResource(std::span<const std::uint32_t> words)
     return result;
 }
 
+std::array<std::uint32_t, 8> EncodeTextureResource(const GuestTextureResource& resource) {
+    const bool multisampled = resource.dimension == TextureDimension::k2DMsaa;
+    Require((resource.dimension == TextureDimension::k2D && resource.samples == 1u) || (multisampled && resource.samples >= 2u && resource.samples <= 16u && std::has_single_bit(resource.samples)), "only 2D and multisampled 2D surfaces have a texture descriptor encoding");
+    Require(resource.mipCount == 1u && resource.allocatedMipCount <= 1u && resource.baseLevel == 0u && resource.lastLevel == 0u && resource.depthOrLastArray == 0u && resource.baseArray == 0u && resource.dccAddress == 0u && resource.minLod == 0u && !resource.iterate256 && resource.bcSwizzle == 0u, "only single-level, single-layer surfaces without metadata have a texture descriptor encoding");
+    Require(resource.width >= 1u && resource.width <= 0x4000u && resource.height >= 1u && resource.height <= 0x4000u && resource.format < 0x200u, "the surface's extent or format has no texture descriptor encoding");
+    const auto xorMask = resource.tileMode == TextureTileMode::kS4KBX || resource.tileMode == TextureTileMode::kD4KBX ? 0xfffull : 0xffffull;
+    Require(XorSwizzleMode(resource.tileMode) != 0 ? (resource.baseAddress & xorMask) == 0 && (resource.pipeBankXor & ~xorMask) == 0 : resource.pipeBankXor == 0, "the surface's pipe and bank XOR has no texture descriptor encoding");
+    const auto base = (resource.baseAddress | resource.pipeBankXor) >> 8u;
+    Require(base != 0 && (resource.baseAddress & 0xffu) == 0 && base <= 0xffffffffffull, "the surface's address has no texture descriptor encoding");
+    std::uint32_t tileMode = 0;
+    switch (resource.tileMode) {
+        case TextureTileMode::kLinear: tileMode = 0x00; break;
+        case TextureTileMode::kStandard256B: tileMode = 0x01; break;
+        case TextureTileMode::kD256B: tileMode = 0x02; break;
+        case TextureTileMode::kStandard4KB: tileMode = 0x05; break;
+        case TextureTileMode::kD4KB: tileMode = 0x06; break;
+        case TextureTileMode::kStandard64KB: tileMode = 0x09; break;
+        case TextureTileMode::kD64KB: tileMode = 0x0a; break;
+        case TextureTileMode::kS64KBT: tileMode = 0x11; break;
+        case TextureTileMode::kD64KBT: tileMode = 0x12; break;
+        case TextureTileMode::kS4KBX: tileMode = 0x15; break;
+        case TextureTileMode::kD4KBX: tileMode = 0x16; break;
+        case TextureTileMode::kZ64KBX: tileMode = 0x18; break;
+        case TextureTileMode::kS64KBX: tileMode = 0x19; break;
+        case TextureTileMode::kD64KBX: tileMode = 0x1a; break;
+        case TextureTileMode::kR64KBX: tileMode = 0x1b; break;
+    }
+    const auto sampleLevel = static_cast<std::uint32_t>(std::countr_zero(resource.samples));
+    std::array<std::uint32_t, 8> words{};
+    words[0] = static_cast<std::uint32_t>(base);
+    words[1] = static_cast<std::uint32_t>(base >> 32u) | (resource.format << 20u) | (((resource.width - 1u) & 3u) << 30u);
+    words[2] = ((resource.width - 1u) >> 2u) | ((resource.height - 1u) << 14u);
+    words[3] = resource.dstSelX | (resource.dstSelY << 3u) | (resource.dstSelZ << 6u) | (resource.dstSelW << 9u) | (sampleLevel << 16u) | (tileMode << 20u) | ((multisampled ? 14u : 9u) << 28u);
+    words[5] = sampleLevel << 4u;
+    return words;
+}
+
 float EffectiveMinLod(const GuestTextureResource& resource) {
     if (resource.minLod <= resource.baseLevel * 256u) return 0.0f;
     return std::min(static_cast<float>(resource.minLod) / 256.0f, static_cast<float>(resource.lastLevel));
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp
index 809e680d42..7cb1eafdad 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp
@@ -2,7 +2,9 @@
 #include "prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
@@ -227,7 +229,7 @@ public:
             viewInfo.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
             VkImageViewUsageCreateInfo viewUsage{VK_STRUCTURE_TYPE_IMAGE_VIEW_USAGE_CREATE_INFO};
             viewUsage.usage = imageUsage & ~VK_IMAGE_USAGE_STORAGE_BIT;
-            if (orderFormat != VK_FORMAT_UNDEFINED) viewInfo.pNext = &viewUsage;
+            if ((imageUsage & VK_IMAGE_USAGE_STORAGE_BIT) != 0) viewInfo.pNext = &viewUsage;
             Check(context.Function<PFN_vkCreateImageView>("vkCreateImageView")(context.device, &viewInfo, nullptr, &created.view), "vkCreateImageView multisampled target");
         } catch (...) {
             destroy(created);
@@ -330,7 +332,9 @@ public:
         colorFill = MultisampledColorFill(use);
         fromTexture = false;
         dccRanges.clear();
+        dccCopies.clear();
         fmaskRange.reset();
+        fmaskCopy = {};
         metadataValid = std::make_shared<std::atomic<bool>>(true);
         const auto initial = initialDccClear(use);
         recordCommands(context, [&](VkCommandBuffer commands, Recorder* recorder) {
@@ -426,6 +430,19 @@ public:
         return {shared_from_this(), texture.get()};
     }
 
+    std::shared_ptr<Texture> FirstSample(VkComponentMapping components) {
+        const auto source = Sampled({});
+        if (firstSampleCopy == nullptr) firstSampleCopy = std::make_unique<FirstSampleCopy>(context, target.format, target.extent);
+        firstSampleCopy->Record(*Recorder::Active(), source->View(), source->Layout());
+        const std::array<std::uint32_t, 4> key{static_cast<std::uint32_t>(components.r), static_cast<std::uint32_t>(components.g), static_cast<std::uint32_t>(components.b), static_cast<std::uint32_t>(components.a)};
+        auto& texture = firstSampleTextures[key];
+        if (texture == nullptr) {
+            texture = std::make_shared<Texture>(context, firstSampleCopy->Image(), target.format, VK_IMAGE_ASPECT_COLOR_BIT, components);
+            texture->MarkRefreshedPerUse();
+        }
+        return {shared_from_this(), texture.get()};
+    }
+
     VkImageView View(VkFormat format) {
         if (format == target.format) return view;
         Require(twinFormat != VK_FORMAT_UNDEFINED && format == twinFormat, "a multisampled color target is only viewed in its own format or its sRGB twin");
@@ -486,6 +503,7 @@ public:
 
     Context context;
     std::shared_ptr<std::atomic<bool>> active = std::make_shared<std::atomic<bool>>(true);
+    std::shared_ptr<std::atomic<bool>> hostOnly = std::make_shared<std::atomic<bool>>(true);
     std::shared_ptr<std::atomic<bool>> metadataValid;
     ColorTarget target;
     VkImage image = VK_NULL_HANDLE;
@@ -516,10 +534,38 @@ private:
     std::map<std::array<std::uint32_t, 5>, std::unique_ptr<Texture>> fmaskTextures;
     std::map<std::array<std::uint32_t, 5>, std::shared_ptr<Texture>> textures;
     std::vector<std::shared_ptr<Texture>> retiredTextures;
+    std::unique_ptr<FirstSampleCopy> firstSampleCopy;
+    std::map<std::array<std::uint32_t, 4>, std::shared_ptr<Texture>> firstSampleTextures;
     std::vector<GuestMemory::UnchangedQuery> dccRanges;
+    struct DccCopy {
+        bool compared = false;
+        std::vector<std::byte> bytes;
+        std::uint64_t stamp = 0;
+        std::array<std::uint64_t, 2> checked{};
+    };
+    mutable std::vector<DccCopy> dccCopies;
+    mutable DccCopy fmaskCopy;
     std::optional<std::uint32_t> dccFill;
     std::optional<std::uint32_t> cmaskFill;
 
+    bool compared(std::size_t index) const {
+        return index < dccCopies.size() && dccCopies[index].compared;
+    }
+
+    static DccCopy comparedCopy(const GuestMemory::UnchangedQuery& range, std::vector<std::byte> bytes) {
+        return {true, std::move(bytes), GuestMemory::NewestStamp(range.address, range.bytes), {}};
+    }
+
+    static bool copyCurrent(const GuestMemory::UnchangedQuery& range, DccCopy& copy) {
+        if (GuestMemory::NewestStamp(range.address, range.bytes) != copy.stamp) return false;
+        const auto epoch = GuestMemory::CollectEpoch();
+        const std::array<std::uint64_t, 2> seen{epoch, GuestMemory::ForgetSerial()};
+        if (epoch != 0 && (seen[1] & 1u) == 0 && copy.checked == seen) return true;
+        if (!GuestMemory::EqualsCommittedUnsynced(range.address, copy.bytes)) return false;
+        copy.checked = seen;
+        return true;
+    }
+
     bool absorbDccFill(const ColorTarget& use, VkClearColorValue& clear) {
         const auto dcc = std::exchange(dccFill, std::nullopt);
         const auto cmaskPattern = std::exchange(cmaskFill, std::nullopt);
@@ -530,19 +576,30 @@ private:
         if (dccRanges.size() > 2) {
             const auto& range = dccRanges[2];
             auto* recorder = Recorder::Active();
-            const bool written = !GuestMemory::UnchangedSince(range.address, range.bytes, range.generation) || (recorder != nullptr && recorder->PendingWriteOverlaps(range.address, range.bytes));
+            const bool unchanged = compared(2) ? copyCurrent(range, dccCopies[2]) : GuestMemory::UnchangedSince(range.address, range.bytes, range.generation);
+            const bool written = !unchanged || (recorder != nullptr && recorder->PendingWriteOverlaps(range.address, range.bytes));
             const auto landed = LandedUniformMetadataByte(range.address, range.bytes);
             if (!landed || (written && (!cmaskPattern || *cmaskPattern != *landed * 0x01010101u))) return false;
             cmaskKeys = *landed;
         }
         std::vector<GuestMemory::UnchangedQuery> metadata(dccRanges.begin() + 1, dccRanges.end());
-        for (auto& range : metadata) {
-            if (!GuestMemory::Watched(range.address, range.bytes)) return false;
+        std::vector<bool> comparedMetadata(metadata.size(), false);
+        for (std::size_t index = 0; index < metadata.size(); ++index) {
+            auto& range = metadata[index];
+            if (!GuestMemory::Watched(range.address, range.bytes)) {
+                if (!compared(index + 1) && !ComparedHostImportCovers(context, range.address, range.bytes)) return false;
+                comparedMetadata[index] = true;
+                range.generation = 0;
+                continue;
+            }
             range.generation = collectBlocks(range.address, range.bytes);
             if (range.generation == 0) return false;
         }
-        clear = MultisampledDccClear(use, std::vector<std::byte>(dccRanges[1].bytes, std::byte{*keys}), std::vector<std::byte>(use.cmaskBytes, std::byte{cmaskKeys}));
+        std::array<std::vector<std::byte>, 2> landedBytes{std::vector<std::byte>(dccRanges[1].bytes, std::byte{*keys}), std::vector<std::byte>(use.cmaskBytes, std::byte{cmaskKeys})};
+        clear = MultisampledDccClear(use, landedBytes[0], landedBytes[1]);
         std::copy(metadata.begin(), metadata.end(), dccRanges.begin() + 1);
+        dccCopies.resize(dccRanges.size());
+        for (std::size_t index = 0; index < metadata.size(); ++index) dccCopies[index + 1] = comparedMetadata[index] ? comparedCopy(dccRanges[index + 1], std::move(landedBytes[index])) : DccCopy{};
         return true;
     }
 
@@ -556,11 +613,19 @@ private:
         dccRanges.push_back({use.address, static_cast<std::size_t>(colorBytes), 0});
         dccRanges.push_back({use.dccAddress, dccBytes, 0});
         if (use.cmaskAddress != 0) dccRanges.push_back({use.cmaskAddress, use.cmaskBytes, 0});
-        for (auto& range : dccRanges) {
+        dccCopies.assign(dccRanges.size(), {});
+        std::vector<GuestMemory::UnchangedQuery> watched;
+        for (std::size_t index = 0; index < dccRanges.size(); ++index) {
+            auto& range = dccRanges[index];
             GuestMemory::CheckRange(reinterpret_cast<const void*>(range.address), range.bytes, 256);
+            if (!WatchedAfterSettle(context, range.address, range.bytes) && ComparedHostImportCovers(context, range.address, range.bytes)) {
+                dccCopies[index].compared = true;
+                continue;
+            }
             Require(GuestMemory::Watched(range.address, range.bytes), "initial multisampled DCC contents require watched guest memory");
             range.generation = collectBlocks(range.address, range.bytes);
             Require(range.generation != 0, "initial multisampled DCC contents have no write generation");
+            watched.push_back(range);
         }
         for (std::size_t first = 0; first < dccRanges.size(); ++first) {
             for (std::size_t second = first + 1; second < dccRanges.size(); ++second) {
@@ -575,17 +640,28 @@ private:
             fmaskRange = GuestMemory::UnchangedQuery{use.fmaskAddress, static_cast<std::size_t>(DescribeSurface(resource).guestBytes), 0};
             auto& range = *fmaskRange;
             GuestMemory::CheckRange(reinterpret_cast<const void*>(range.address), range.bytes, 65536u);
-            Require(GuestMemory::Watched(range.address, range.bytes), "native FMASK contents require watched guest memory");
-            range.generation = GuestMemory::CollectWritesUncached(range.address, range.bytes);
-            Require(range.generation != 0, "native FMASK contents have no write generation");
+            fmaskCopy.compared = !WatchedAfterSettle(context, range.address, range.bytes) && ComparedHostImportCovers(context, range.address, range.bytes);
+            Require(fmaskCopy.compared || GuestMemory::Watched(range.address, range.bytes), "native FMASK contents require watched guest memory");
+            if (!fmaskCopy.compared) {
+                range.generation = GuestMemory::CollectWritesUncached(range.address, range.bytes);
+                Require(range.generation != 0, "native FMASK contents have no write generation");
+            }
             for (const auto& other : dccRanges) Require(range.address >= other.address + other.bytes || other.address >= range.address + range.bytes, "native FMASK overlaps its color or metadata planes");
         }
-        std::vector<std::byte> dcc(dccRanges[1].bytes);
-        GuestMemory::Read(use.dccAddress, dcc);
-        std::vector<std::byte> cmask(use.cmaskBytes);
-        if (!cmask.empty()) GuestMemory::Read(use.cmaskAddress, cmask);
-        const auto clear = MultisampledDccClear(use, dcc, cmask);
-        Require(GuestMemory::UnchangedSinceAll(dccRanges) && (!fmaskRange || GuestMemory::UnchangedSinceAll(std::span(&*fmaskRange, 1u))), "initial multisampled DCC contents changed during import");
+        std::array<std::vector<std::byte>, 3> bytes{};
+        for (std::size_t index = 0; index < dccRanges.size(); ++index) {
+            if (index == 0 && !compared(0)) continue;
+            bytes[index].resize(dccRanges[index].bytes);
+            GuestMemory::Read(dccRanges[index].address, bytes[index]);
+        }
+        std::vector<std::byte> fmaskBytes(fmaskCopy.compared ? fmaskRange->bytes : 0u);
+        if (fmaskCopy.compared) GuestMemory::Read(fmaskRange->address, fmaskBytes);
+        const auto clear = MultisampledDccClear(use, bytes[1], bytes[2]);
+        Require((watched.empty() || GuestMemory::UnchangedSinceAll(watched)) && (!fmaskRange || fmaskCopy.compared || GuestMemory::UnchangedSinceAll(std::span(&*fmaskRange, 1u))), "initial multisampled DCC contents changed during import");
+        for (std::size_t index = 0; index < dccRanges.size(); ++index) {
+            if (compared(index)) dccCopies[index] = comparedCopy(dccRanges[index], std::move(bytes[index]));
+        }
+        if (fmaskCopy.compared) fmaskCopy = comparedCopy(*fmaskRange, std::move(fmaskBytes));
         return clear;
     }
 
@@ -605,19 +681,28 @@ private:
         Require(metadataValid->load(std::memory_order_acquire), "multisampled DCC metadata was released while its color target remains resident");
         static_cast<void>(MultisampledDccBytes(use));
         Require(use.address == target.address && use.dccAddress == target.dccAddress && use.dccControl == target.dccControl && use.dccAlphaOnMsb == target.dccAlphaOnMsb && use.dccPipeAligned == target.dccPipeAligned && use.cmaskAddress == target.cmaskAddress && use.cmaskBytes == target.cmaskBytes && use.tileMode == target.tileMode && use.elementBytes == target.elementBytes && use.pipeBankXor == target.pipeBankXor, "multisampled DCC target layout or metadata changed");
-        const auto ranges = std::span(dccRanges).first(metadataRefilled ? 1u : dccRanges.size());
-        for (const auto& range : ranges) requireDccRange(GuestMemory::Watched(range.address, range.bytes), range, "multisampled DCC target reuse requires watched guest memory");
-        for (const auto& range : ranges) {
-            GuestMemory::CollectWritesUncached(range.address, range.bytes);
-            requireDccRange(GuestMemory::UnchangedSince(range.address, range.bytes, range.generation) || !GuestMemory::StoredOver(range.address, range.bytes, range.generation), range, "writes to a resident multisampled DCC target or its metadata are not implemented");
+        const auto ranges = metadataRefilled ? std::size_t{1} : dccRanges.size();
+        for (std::size_t index = 0; index < ranges; ++index) requireDccRange(compared(index) || GuestMemory::Watched(dccRanges[index].address, dccRanges[index].bytes), dccRanges[index], "multisampled DCC target reuse requires watched guest memory");
+        for (std::size_t index = 0; index < ranges; ++index) {
+            const auto& range = dccRanges[index];
+            if (compared(index)) {
+                requireDccRange(copyCurrent(range, dccCopies[index]), range, "writes to a resident multisampled DCC target or its metadata are not implemented");
+            } else {
+                GuestMemory::CollectWritesUncached(range.address, range.bytes);
+                requireDccRange(GuestMemory::UnchangedSince(range.address, range.bytes, range.generation) || !GuestMemory::StoredOver(range.address, range.bytes, range.generation), range, "writes to a resident multisampled DCC target or its metadata are not implemented");
+            }
             if (auto* recorder = Recorder::Active(); recorder != nullptr) requireDccRange(!recorder->PendingWriteOverlaps(range.address, range.bytes), range, "pending writes to a resident multisampled DCC target or its metadata are not implemented");
         }
         if (fmaskRange) {
             Require(use.fmaskAddress == target.fmaskAddress && use.fmaskPipeBankXor == target.fmaskPipeBankXor, "native FMASK target layout changed");
             const auto& range = *fmaskRange;
-            requireDccRange(GuestMemory::Watched(range.address, range.bytes), range, "native FMASK sampling requires watched guest memory");
-            GuestMemory::CollectWritesUncached(range.address, range.bytes);
-            requireDccRange(GuestMemory::UnchangedSince(range.address, range.bytes, range.generation) || !GuestMemory::StoredOver(range.address, range.bytes, range.generation), range, "writes to a resident native FMASK are not implemented");
+            requireDccRange(fmaskCopy.compared || WatchedAfterSettle(context, range.address, range.bytes), range, "native FMASK sampling requires watched guest memory");
+            if (fmaskCopy.compared) {
+                requireDccRange(copyCurrent(range, fmaskCopy), range, "writes to a resident native FMASK are not implemented");
+            } else {
+                GuestMemory::CollectWritesUncached(range.address, range.bytes);
+                requireDccRange(GuestMemory::UnchangedSince(range.address, range.bytes, range.generation) || !GuestMemory::StoredOver(range.address, range.bytes, range.generation), range, "writes to a resident native FMASK are not implemented");
+            }
             if (auto* recorder = Recorder::Active(); recorder != nullptr) requireDccRange(!recorder->PendingWriteOverlaps(range.address, range.bytes), range, "pending writes to a resident native FMASK are not implemented");
         }
     }
@@ -626,6 +711,8 @@ private:
         fmaskTextures.clear();
         textures.clear();
         retiredTextures.clear();
+        firstSampleTextures.clear();
+        firstSampleCopy.reset();
         for (const auto& [format, resolvePass] : resolvePasses) context.Function<PFN_vkDestroyRenderPass>("vkDestroyRenderPass")(context.device, resolvePass, nullptr);
         if (orderView) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, orderView, nullptr);
         if (twinView) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, twinView, nullptr);
@@ -642,6 +729,8 @@ struct GuardedRange {
     std::uint32_t samples;
     std::shared_ptr<std::atomic<bool>> active;
     std::shared_ptr<std::atomic<bool>> metadataValid;
+    std::shared_ptr<std::atomic<bool>> hostOnly;
+    bool fmask = false;
 };
 
 class PrimedSharedMutex : public std::shared_mutex {
@@ -715,7 +804,7 @@ void retireUnmapped(std::uintptr_t address, std::size_t bytes) {
     anyGuarded().store(!guarded().empty(), std::memory_order_release);
 }
 
-void guard(const Context& context, const ColorTarget& target, const std::shared_ptr<std::atomic<bool>>& active, const std::shared_ptr<std::atomic<bool>>& metadataValid) {
+void guard(const Context& context, const ColorTarget& target, const std::shared_ptr<std::atomic<bool>>& active, const std::shared_ptr<std::atomic<bool>>& metadataValid, const std::shared_ptr<std::atomic<bool>>& hostOnly) {
     auto bytes = std::max<std::uint64_t>(target.bytes * target.samples, static_cast<std::uint64_t>(target.extent.width) * target.extent.height * target.elementBytes * target.samples);
     if (MultisampledBlockLog2(target.tileMode) == 16u && target.tileMode != ColorTileMode::Standard64KB && std::has_single_bit(target.elementBytes) && std::has_single_bit(target.samples)) {
         const auto log2Samples = std::countr_zero(target.samples);
@@ -727,11 +816,11 @@ void guard(const Context& context, const ColorTarget& target, const std::shared_
         bytes = align(target.extent.width, blockWidth) * align(target.extent.height, blockHeight) * target.elementBytes * target.samples;
     }
     std::unique_lock lock(guardedMutex());
-    guarded().push_back({context.device, target.address, bytes, target.samples, active});
+    guarded().push_back({context.device, target.address, bytes, target.samples, active, nullptr, hostOnly});
     if (target.dccAddress != 0) {
-        guarded().push_back({context.device, target.dccAddress, MultisampledDccBytes(target), target.samples, active, metadataValid});
-        if (target.cmaskAddress != 0) guarded().push_back({context.device, target.cmaskAddress, target.cmaskBytes, target.samples, active, metadataValid});
-        if (target.samples == 8u && target.fmaskAddress != 0u && target.cmaskAddress != 0u) guarded().push_back({context.device, target.fmaskAddress, DescribeSurface(fmaskResource(target)).guestBytes, target.samples, active, metadataValid});
+        guarded().push_back({context.device, target.dccAddress, MultisampledDccBytes(target), target.samples, active, metadataValid, hostOnly});
+        if (target.cmaskAddress != 0) guarded().push_back({context.device, target.cmaskAddress, target.cmaskBytes, target.samples, active, metadataValid, hostOnly});
+        if (target.samples == 8u && target.fmaskAddress != 0u && target.cmaskAddress != 0u) guarded().push_back({context.device, target.fmaskAddress, DescribeSurface(fmaskResource(target)).guestBytes, target.samples, active, metadataValid, hostOnly});
     }
     anyGuarded().store(true, std::memory_order_release);
     InstallResidentImageReadGuard_nid_no_patch();
@@ -751,6 +840,13 @@ void discardRetiredTargets() {
     std::erase_if(targets(), [](const auto& target) { return !target->active->load(std::memory_order_acquire); });
 }
 
+bool holdHostOnly(const MultisampleTarget& target) {
+    std::unique_lock lock(guardedMutex());
+    if (!target.active->load(std::memory_order_acquire)) return false;
+    target.hostOnly->store(true, std::memory_order_release);
+    return true;
+}
+
 MultisampleTarget& acquire(const Context& context, const ColorTarget& requested) {
     discardRetiredTargets();
     for (const auto& target : targets()) {
@@ -761,14 +857,21 @@ MultisampleTarget& acquire(const Context& context, const ColorTarget& requested)
         if (recreated(target->target, use)) {
             {
                 std::unique_lock lock(guardedMutex());
+                if (!target->active->load(std::memory_order_acquire)) continue;
                 std::erase_if(guarded(), [&](const auto& range) { return range.active == target->active; });
                 anyGuarded().store(!guarded().empty(), std::memory_order_release);
             }
             target->Recreate(use);
-            guard(context, use, target->active, target->metadataValid);
+            target->hostOnly->store(true, std::memory_order_release);
+            guard(context, use, target->active, target->metadataValid, target->hostOnly);
             target->ApplyFastClear(use);
             return *target;
         }
+        {
+            std::unique_lock lock(guardedMutex());
+            if (!target->active->load(std::memory_order_acquire)) continue;
+            target->hostOnly->store(true, std::memory_order_release);
+        }
         if (target->fromTexture && use.cmaskAddress != 0) {
             target->fromTexture = false;
             target->cmask = MultisampledCmask(use.cmaskAddress, use.cmaskBytes);
@@ -784,14 +887,14 @@ MultisampleTarget& acquire(const Context& context, const ColorTarget& requested)
     target->Keep();
     targets().push_back(std::move(target));
     auto& created = *targets().back();
-    guard(context, use, created.active, created.metadataValid);
+    guard(context, use, created.active, created.metadataValid, created.hostOnly);
     if (use.cmaskFastClear && use.dccAddress == 0) created.cmask.SeedCode(CurrentUniformMetadataByte(use.cmaskAddress, static_cast<std::size_t>(use.cmaskBytes)));
     created.ApplyFastClear(use);
     created.Keep();
     return created;
 }
 
-MultisampleTarget& createFilled(const Context& context, const GuestTextureResource& resource, VkFormat format, const char* access) {
+MultisampleTarget& createFilled(const Context& context, const GuestTextureResource& resource, VkFormat format, const char* access, bool written) {
     const auto refuse = [&](const std::string& reason) {
         char text[192];
         std::snprintf(text, sizeof(text), "AGC graphics: %s the %ux%u multisampled texture 0x%llx of %u samples, which no draw rendered to and ", access, resource.width, resource.height, static_cast<unsigned long long>(resource.baseAddress), resource.samples);
@@ -858,7 +961,8 @@ MultisampleTarget& createFilled(const Context& context, const GuestTextureResour
     target->Keep();
     targets().push_back(std::move(target));
     auto& created = *targets().back();
-    guard(context, use, created.active, created.metadataValid);
+    created.hostOnly->store(written, std::memory_order_release);
+    guard(context, use, created.active, created.metadataValid, created.hostOnly);
     created.colorFill.NoteFill(use.address, static_cast<std::size_t>(bytes), value);
     created.fromTexture = true;
     created.htileAddress = resource.dccAddress;
@@ -1015,7 +1119,7 @@ VkClearColorValue MultisampledDccClear(const ColorTarget& target, std::span<cons
     Require(dcc.size() == MultisampledDccBytes(target), "multisampled DCC metadata snapshot size mismatch");
     Require(std::ranges::all_of(dcc, [&](std::byte key) { return key == dcc.front(); }), "mixed multisampled DCC metadata is not implemented");
     Require(target.cmaskAddress == 0 ? cmask.empty() && target.cmaskBytes == 0 : cmask.size() == target.cmaskBytes && target.cmaskBytes == CmaskBytes(target.extent.width, target.extent.height), "multisampled DCC CMASK snapshot size mismatch");
-    if (!cmask.empty()) {
+    if (!cmask.empty() && target.cmaskFastClear) {
         const auto code = std::to_integer<std::uint32_t>(cmask.front());
         const auto expanded = target.samples == 2 ? 0xddu : target.samples == 4 ? 0xeeu : 0xffu;
         Require(std::ranges::all_of(cmask, [&](std::byte key) { return key == cmask.front(); }) && (code == 0xccu || code == expanded), "multisampled DCC CMASK compression or register clear is not implemented");
@@ -1134,6 +1238,12 @@ VkComponentMapping swapRedBlue(VkComponentMapping components) {
     return {swapped(components.r, VK_COMPONENT_SWIZZLE_R), swapped(components.g, VK_COMPONENT_SWIZZLE_G), swapped(components.b, VK_COMPONENT_SWIZZLE_B), swapped(components.a, VK_COMPONENT_SWIZZLE_A)};
 }
 
+bool sameStorageForm(const Context& context, VkFormat rendered, VkFormat requested) {
+    if (rendered == requested) return true;
+    const auto storage = HostStorageFormat(context, rendered);
+    return storage != VK_FORMAT_UNDEFINED && storage == HostStorageFormat(context, requested);
+}
+
 }
 
 std::shared_ptr<Texture> MultisampleTargetTexture(const Context& context, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType viewType) {
@@ -1152,13 +1262,36 @@ std::shared_ptr<Texture> MultisampleTargetTexture(const Context& context, const
     }
     if (other == nullptr) {
         Require(Recorder::Active() != nullptr, "a multisampled texture is only sampled by recorded draws and dispatches");
-        return createFilled(context, resource, format, "sampling").Sampled(components, viewType);
+        return createFilled(context, resource, format, "sampling", false).Sampled(components, viewType);
     }
     char text[320];
     std::snprintf(text, sizeof(text), "AGC graphics: sampling multisampled color target 0x%llx (%ux%u, %u samples, vk format %d) as a %ux%u texture of %u samples and guest format %u (vk %d) is not implemented", static_cast<unsigned long long>(resource.baseAddress), other->target.extent.width, other->target.extent.height, other->target.samples, static_cast<int>(other->target.format), resource.width, resource.height, resource.samples, resource.format, static_cast<int>(format));
     throw std::runtime_error(text);
 }
 
+std::shared_ptr<Texture> MultisampleTargetFirstSample(const Context& context, const GuestTextureResource& resource, VkComponentMapping components) {
+    std::lock_guard lock(targetsMutex());
+    discardRetiredTargets();
+    const auto format = ResolveTextureFormat(resource.format);
+    const MultisampleTarget* other = nullptr;
+    for (const auto& target : targets()) {
+        if (!target->active->load(std::memory_order_acquire)) continue;
+        if (target->context.device != context.device || target->target.surfaceAddress != resource.baseAddress) continue;
+        const auto& rendered = target->target;
+        const bool sameShape = rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0;
+        if (sameShape && rendered.format == format) return target->FirstSample(components);
+        if (sameShape && redBlueSwapped(rendered.format, format)) return target->FirstSample(swapRedBlue(components));
+        other = target.get();
+    }
+    if (other == nullptr) {
+        Require(Recorder::Active() != nullptr, "a multisampled texture is only sampled by recorded draws and dispatches");
+        return createFilled(context, resource, format, "sampling", false).FirstSample(components);
+    }
+    char text[320];
+    std::snprintf(text, sizeof(text), "AGC graphics: reading sample 0 of multisampled color target 0x%llx (%ux%u, %u samples, vk format %d) as a %ux%u texture of %u samples and guest format %u (vk %d) is not implemented", static_cast<unsigned long long>(resource.baseAddress), other->target.extent.width, other->target.extent.height, other->target.samples, static_cast<int>(other->target.format), resource.width, resource.height, resource.samples, resource.format, static_cast<int>(format));
+    throw std::runtime_error(text);
+}
+
 void MaterializeMultisampleTargetClear(const Context& context, const ColorTarget& target) {
     std::lock_guard lock(targetsMutex());
     acquire(context, target);
@@ -1173,12 +1306,15 @@ VkImageView MultisampleTargetStorageView(const Context& context, const GuestText
         if (!target->active->load(std::memory_order_acquire)) continue;
         if (target->context.device != context.device || target->target.surfaceAddress != resource.baseAddress) continue;
         const auto& rendered = target->target;
-        if (rendered.format == format && rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0) return target->Storage(StorageFormatForGuest(context, resource.format));
+        if (sameStorageForm(context, rendered.format, format) && rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0) {
+            if (!holdHostOnly(*target)) continue;
+            return target->Storage(StorageFormatForGuest(context, resource.format));
+        }
         other = target.get();
     }
     if (other == nullptr) {
         Require(Recorder::Active() != nullptr, "a multisampled color target is only written by recorded dispatches");
-        return createFilled(context, resource, format, "writing").Storage(StorageFormatForGuest(context, resource.format));
+        return createFilled(context, resource, format, "writing", true).Storage(StorageFormatForGuest(context, resource.format));
     }
     char text[320];
     std::snprintf(text, sizeof(text), "AGC graphics: storage image access to multisampled color target 0x%llx (%ux%u, %u samples, vk format %d) as a %ux%u texture of %u samples and guest format %u (vk %d) is not implemented", static_cast<unsigned long long>(resource.baseAddress), other->target.extent.width, other->target.extent.height, other->target.samples, static_cast<int>(other->target.format), resource.width, resource.height, resource.samples, resource.format, static_cast<int>(format));
@@ -1218,10 +1354,13 @@ void ResolveMultisampleTarget(const Context& context, const ColorTarget& source,
 bool MultisampledColorFillAbsorbs(std::uint64_t address, std::size_t bytes, std::uint32_t pattern) {
     if (bytes == 0) return false;
     std::lock_guard lock(targetsMutex());
-    return std::any_of(targets().begin(), targets().end(), [&](const auto& target) {
+    bool absorbed = false;
+    for (const auto& target : targets()) {
         VkClearColorValue clear{};
-        return target->active->load(std::memory_order_acquire) && target->target.address == address && MultisampledColorBytes(target->target) == bytes && MultisampledFillClearColor(target->target, pattern, clear);
-    });
+        if (!target->active->load(std::memory_order_acquire) || target->target.address != address || MultisampledColorBytes(target->target) != bytes || !MultisampledFillClearColor(target->target, pattern, clear)) continue;
+        absorbed = holdHostOnly(*target) || absorbed;
+    }
+    return absorbed;
 }
 
 void NoteColorMetadataFill(std::uint64_t address, std::size_t bytes, std::uint32_t pattern) {
@@ -1274,6 +1413,17 @@ void ClearMultisampleTargets(VkDevice device) {
     UpdateResidentImageUnmapObserver_nid_no_patch();
 }
 
+void GuardOneFragmentFmask(const Context& context, const ColorTarget& target) {
+    const auto bits = static_cast<std::uint64_t>(target.extent.width) * target.extent.height * target.coverageSamples;
+    const auto bytes = std::max<std::uint64_t>((bits / 8u + 0xffffu) & ~0xffffull, 0x10000u);
+    std::unique_lock lock(guardedMutex());
+    const bool known = std::ranges::any_of(guarded(), [&](const auto& range) { return range.fmask && range.device == context.device && range.address == target.fmaskAddress && range.bytes == bytes; });
+    if (!known) guarded().push_back({context.device, target.fmaskAddress, bytes, target.coverageSamples, std::make_shared<std::atomic<bool>>(true), nullptr, std::make_shared<std::atomic<bool>>(true), true});
+    anyGuarded().store(true, std::memory_order_release);
+    lock.unlock();
+    InstallResidentImageReadGuard_nid_no_patch();
+}
+
 void RequireNoMultisampleTarget(std::uint64_t address, std::size_t bytes, const char* access) {
     RequireNoResidentDepthRead_nid_no_patch(address, bytes);
     RequireNoMultisampleColorTarget(address, bytes, access);
@@ -1281,13 +1431,36 @@ void RequireNoMultisampleTarget(std::uint64_t address, std::size_t bytes, const
 
 void RequireNoMultisampleColorTarget(std::uint64_t address, std::size_t bytes, const char* access) {
     if (bytes == 0 || !anyGuarded().load(std::memory_order_acquire)) return;
-    std::shared_lock lock(guardedMutex());
-    for (const auto& range : guarded()) {
-        if (address >= range.address + range.bytes || range.address >= address + bytes) continue;
+    const auto overlaps = [&](const GuardedRange& range) { return address < range.address + range.bytes && range.address < address + bytes; };
+    const auto refuse = [&](const GuardedRange& range) {
         char text[256];
+        if (range.fmask) {
+            std::snprintf(text, sizeof(text), "AGC graphics: %s of 0x%llx+0x%zx overlaps the FMASK 0x%llx+0x%llx of a one-fragment color target of %u samples drawn on the host, which does not write it: guest access to it is not implemented", access, static_cast<unsigned long long>(address), bytes, static_cast<unsigned long long>(range.address), static_cast<unsigned long long>(range.bytes), range.samples);
+            throw std::runtime_error(text);
+        }
         std::snprintf(text, sizeof(text), "AGC graphics: %s of 0x%llx+0x%zx overlaps multisampled color target 0x%llx+0x%llx (%u samples), whose samples are only on the host: guest access to it is not implemented", access, static_cast<unsigned long long>(address), bytes, static_cast<unsigned long long>(range.address), static_cast<unsigned long long>(range.bytes), range.samples);
         throw std::runtime_error(text);
+    };
+    {
+        std::shared_lock lock(guardedMutex());
+        bool retirable = false;
+        for (const auto& range : guarded()) {
+            if (!overlaps(range)) continue;
+            if (range.hostOnly->load(std::memory_order_acquire)) refuse(range);
+            retirable = true;
+        }
+        if (!retirable) return;
     }
+    std::unique_lock lock(guardedMutex());
+    std::vector<std::shared_ptr<std::atomic<bool>>> retired;
+    for (const auto& range : guarded()) {
+        if (!overlaps(range)) continue;
+        if (range.hostOnly->load(std::memory_order_acquire)) refuse(range);
+        retired.push_back(range.active);
+    }
+    for (const auto& active : retired) active->store(false, std::memory_order_release);
+    std::erase_if(guarded(), [&](const auto& range) { return std::find(retired.begin(), retired.end(), range.active) != retired.end(); });
+    anyGuarded().store(!guarded().empty(), std::memory_order_release);
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp
index d7a28cebfb..1dd1e6c450 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Execution/include/PerformanceOverlay.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PipelineLibrary.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
@@ -19,6 +20,7 @@
 #include <cstdlib>
 #include <list>
 #include <mutex>
+#include <spirv/unified1/spirv.hpp>
 #include <string_view>
 #include <type_traits>
 #include <unordered_map>
@@ -26,6 +28,34 @@
 
 namespace AgcDriver::Graphics {
 
+namespace {
+
+bool LogicOpFormat(VkFormat format) {
+    switch (format) {
+        case VK_FORMAT_R8_UNORM:
+        case VK_FORMAT_R8G8_UNORM:
+        case VK_FORMAT_R8G8B8A8_UNORM:
+        case VK_FORMAT_B8G8R8A8_UNORM:
+        case VK_FORMAT_A2B10G10R10_UNORM_PACK32:
+        case VK_FORMAT_A2R10G10B10_UNORM_PACK32:
+        case VK_FORMAT_R16_UNORM:
+        case VK_FORMAT_R16G16_UNORM:
+        case VK_FORMAT_R16G16B16A16_UNORM:
+        case VK_FORMAT_R8_UINT:
+        case VK_FORMAT_R8G8_UINT:
+        case VK_FORMAT_R8G8B8A8_UINT:
+        case VK_FORMAT_R16_UINT:
+        case VK_FORMAT_R16G16_UINT:
+        case VK_FORMAT_R16G16B16A16_UINT:
+        case VK_FORMAT_R32_UINT:
+        case VK_FORMAT_R32G32_UINT:
+        case VK_FORMAT_R32G32B32A32_UINT: return true;
+        default: return false;
+    }
+}
+
+}
+
 void LogPipelineStatistics_nid_no_patch(const Context& context, VkPipeline pipeline) {
     if (!context.pipelineExecutableInfo) return;
     const auto getProperties = context.Function<PFN_vkGetPipelineExecutablePropertiesKHR>("vkGetPipelineExecutablePropertiesKHR");
@@ -104,6 +134,18 @@ bool BarycentricPatches(const State& state, std::span<const CompiledShader> shad
     return !state.rectList && state.stages.path == ShaderPath::Vertex && std::any_of(shaders.begin(), shaders.end(), [](const CompiledShader& shader) { return shader.stage == ShaderRecompiler::ShaderStage::TessellationControl; });
 }
 
+bool FragmentInterlock(std::span<const CompiledShader> shaders) {
+    return std::any_of(shaders.begin(), shaders.end(), [](const CompiledShader& shader) {
+        if (shader.stage != ShaderRecompiler::ShaderStage::Fragment || shader.program == nullptr) return false;
+        const auto words = shader.program->spirv.Words();
+        for (std::size_t cursor = 5; cursor + 1 < words.size() && (words[cursor] & 0xffffu) == spv::OpCapability && (words[cursor] >> 16u) == 2u; cursor += 2) {
+            const auto capability = words[cursor + 1];
+            if (capability == spv::CapabilityFragmentShaderPixelInterlockEXT || capability == spv::CapabilityFragmentShaderSampleInterlockEXT || capability == spv::CapabilityFragmentShaderShadingRateInterlockEXT) return true;
+        }
+        return false;
+    });
+}
+
 void ValidateProvokingVertex(const Context& context, const State& state, std::span<const CompiledShader> shaders) {
     Require(state.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT || state.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT, "invalid provoking vertex mode");
     if (state.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT) {
@@ -124,6 +166,70 @@ void ValidateProvokingVertex(const Context& context, const State& state, std::sp
         }
         return;
     }
+    struct Decorations {
+        std::unordered_map<std::uint64_t, std::uint32_t> builtIns;
+        std::vector<std::uint64_t> perVertexValues;
+        std::vector<std::uint64_t> perPrimitiveValues;
+    };
+    const auto readDecorations = [](const ShaderRecompiler::RecompileResult& program, Decorations& decorations) {
+        const auto words = program.spirv.Words();
+        if (words.size() < 5) return false;
+        constexpr std::uint32_t NoMember = 0xffffffffu;
+        const auto key = [](std::uint32_t target, std::uint32_t member) { return (static_cast<std::uint64_t>(target) << 32u) | member; };
+        for (std::size_t cursor = 5; cursor < words.size();) {
+            const auto count = words[cursor] >> 16u;
+            if (count == 0 || count > words.size() - cursor) return false;
+            const auto op = static_cast<spv::Op>(words[cursor] & 0xffffu);
+            const std::size_t decoration = op == spv::OpDecorate ? 2 : op == spv::OpMemberDecorate ? 3 : 0;
+            if (decoration != 0 && count > decoration) {
+                const auto target = key(words[cursor + 1], op == spv::OpMemberDecorate ? words[cursor + 2] : NoMember);
+                if (words[cursor + decoration] == spv::DecorationFlat || words[cursor + decoration] == spv::DecorationPerVertexKHR) decorations.perVertexValues.push_back(target);
+                if (words[cursor + decoration] == spv::DecorationPerPrimitiveEXT) decorations.perPrimitiveValues.push_back(target);
+                if (words[cursor + decoration] == spv::DecorationBuiltIn && count > decoration + 1) decorations.builtIns[target] = words[cursor + decoration + 1];
+            }
+            cursor += count;
+        }
+        return true;
+    };
+    const auto readsProvokingVertex = [&](const ShaderRecompiler::RecompileResult& program) {
+        if (std::any_of(program.fragmentParameters.begin(), program.fragmentParameters.end(), [](const ShaderRecompiler::FragmentParameter& parameter) {
+            return parameter.flat || parameter.perVertex || parameter.custom || parameter.flatP10;
+        })) return true;
+        Decorations decorations;
+        if (!readDecorations(program, decorations)) return true;
+        const auto& builtIns = decorations.builtIns;
+        return std::any_of(decorations.perVertexValues.begin(), decorations.perVertexValues.end(), [&](std::uint64_t target) {
+            const auto builtIn = builtIns.find(target);
+            if (builtIn == builtIns.end()) return true;
+            switch (builtIn->second) {
+            case spv::BuiltInFragCoord:
+            case spv::BuiltInPointCoord:
+            case spv::BuiltInFrontFacing:
+            case spv::BuiltInSampleId:
+            case spv::BuiltInSamplePosition:
+            case spv::BuiltInSampleMask:
+            case spv::BuiltInHelperInvocation:
+            case spv::BuiltInSubgroupSize:
+            case spv::BuiltInSubgroupLocalInvocationId:
+                return false;
+            default:
+                return true;
+            }
+        });
+    };
+    const auto writesProvokingVertexBuiltIn = [&](const ShaderRecompiler::RecompileResult& program) {
+        Decorations decorations;
+        if (!readDecorations(program, decorations)) return true;
+        return std::any_of(decorations.builtIns.begin(), decorations.builtIns.end(), [&](const auto& builtIn) {
+            return (builtIn.second == spv::BuiltInLayer || builtIn.second == spv::BuiltInViewportIndex) &&
+                   std::find(decorations.perPrimitiveValues.begin(), decorations.perPrimitiveValues.end(), builtIn.first) == decorations.perPrimitiveValues.end();
+        });
+    };
+    const bool observed = std::any_of(shaders.begin(), shaders.end(), [&](const CompiledShader& shader) {
+        if (shader.stage == ShaderRecompiler::ShaderStage::Fragment) return shader.program == nullptr || readsProvokingVertex(*shader.program);
+        return shader.program != nullptr && writesProvokingVertexBuiltIn(*shader.program);
+    });
+    if (!context.provokingVertexLast && !observed) return;
     Require(context.provokingVertexLast, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
     const bool meshPrimitives = state.stages.path == ShaderPath::Geometry && state.stages.mesh;
     Require(!state.stages.tessellation && (meshPrimitives || (state.stages.path == ShaderPath::Vertex && !state.stages.mesh)), "last provoking vertex is unsupported for generated primitive pipelines");
@@ -167,8 +273,10 @@ bool ShadersWriteMemory(std::span<const CompiledShader> shaders) {
                 if (binding.kind == ShaderRecompiler::DescriptorKind::StorageImage && any(binding.imageWritten, binding.count)) return true;
                 break;
             case ShaderRecompiler::DescriptorRole::Gds:
-            case ShaderRecompiler::DescriptorRole::BdaPagetable:
                 return true;
+            case ShaderRecompiler::DescriptorRole::BdaPagetable:
+                if (shader.program->bdaWrites) return true;
+                break;
             case ShaderRecompiler::DescriptorRole::GuestSamplers:
             case ShaderRecompiler::DescriptorRole::FaultBuffer:
             case ShaderRecompiler::DescriptorRole::FlattenedSrt:
@@ -213,7 +321,7 @@ void appendKey(std::vector<std::byte>& key, const TValue& value) {
 
 bool libraryKeys(PipelineLibraryKeys& keys, const Context& context, const State& state, const VertexInputLayout& input, const PipelineSetLayouts& resources, std::span<const CompiledShader> shaders) {
     using Stage = ShaderRecompiler::ShaderStage;
-    if (!context.graphicsPipelineLibrary || context.pipelineExecutableInfo || state.depthBiasPerFace || state.rectList || BarycentricPatches(state, shaders) || SplitsAlternateAlpha(state)) return false;
+    if (!context.graphicsPipelineLibrary || context.pipelineExecutableInfo || (state.stages.tessellation && !context.tessellationPipelineCache) || state.depthBiasPerFace || state.rectList || BarycentricPatches(state, shaders) || SplitsAlternateAlpha(state) || std::ranges::any_of(shaders, [](const CompiledShader& shader) { return shader.program != nullptr && shader.program->functionLdsBuffer; }) || FragmentInterlock(shaders)) return false;
     keys = {};
     for (const auto& shader : shaders) {
         const auto identity = shader.program->Identity();
@@ -283,11 +391,13 @@ bool libraryKeys(PipelineLibraryKeys& keys, const Context& context, const State&
         }
     }
     for (const auto& blend : state.blends) appendKey(keys.fragmentOutput, blend);
+    appendKey(keys.fragmentOutput, state.colorRop);
     for (const auto value : state.blendConstants) appendKey(keys.fragmentOutput, value);
     appendKey(keys.renderPass, state.blends.size());
     for (const auto& color : state.colors) {
         appendKey(keys.renderPass, color.format);
         appendKey(keys.renderPass, color.exportIndex);
+        appendKey(keys.renderPass, color.partialWriteMask != 0u);
     }
     appendKey(keys.renderPass, state.depth.has_value());
     if (state.depth) appendKey(keys.renderPass, state.depth->format);
@@ -330,6 +440,8 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
 
 Pipeline::Pipeline(const Context& context, const State& state, const VertexInputLayout& vertexInput, const PipelineSetLayouts& resources, std::span<const CompiledShader> shaders, VkImageLayout attachmentLayout) : context(context), _modules(shaders.size()), attachments(state.colors.size() + (state.depth ? 1u : 0u)), colorAttachments(state.colors.size()), depthBounds(state.depth.has_value() && state.depthBoundsTest), depthBias(state.depth.has_value() && state.depthBias), dynamicRendering(context.graphicsPipelineLibrary) {
     PerformanceTimer timing("Vulkan.GraphicsPipeline");
+    for (const auto& color : state.colors) boundAttachments.push_back(color.partialWriteMask == 0u);
+    if (state.depth) boundAttachments.push_back(true);
     sampleLocationsEnabled = ValidateSampleLocations(context, state);
     const auto host = HostSampleLocationsFor(context, state);
     sampleLocationGrid = host.grid;
@@ -339,12 +451,15 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
     this->context.bufferPool.reset();
     Require(state.blends.size() == (state.colors.empty() ? 0u : state.colors.back().exportIndex + 1u) && state.colors.size() <= state.blends.size(), "blend states do not match decoded color state");
     Require(state.blends.size() <= context.limits.maxColorAttachments, "color targets exceed device attachment limits");
-    Require(state.hasColorTarget || (context.limits.framebufferNoAttachmentsSampleCounts & static_cast<VkSampleCountFlagBits>(state.samples)) != 0, "device does not support rendering without attachments at the draw's sample count");
+    const bool boundColor = std::ranges::any_of(state.colors, [](const ColorTarget& color) { return color.partialWriteMask == 0u; });
+    Require((state.hasColorTarget && (boundColor || state.colors.empty() || state.depth.has_value())) || (context.limits.framebufferNoAttachmentsSampleCounts & static_cast<VkSampleCountFlagBits>(state.samples)) != 0, "device does not support rendering without attachments at the draw's sample count");
     Require(state.samples == 1 || !state.depth.has_value() || (context.limits.framebufferDepthSampleCounts & static_cast<VkSampleCountFlagBits>(state.samples)) != 0, "device does not support depth targets with the draw's sample count");
     Require(!depthBounds || context.depthBounds, "device does not support the depth bounds test");
     Require(!depthBias || state.depthBiasClamp == 0.0f || context.depthBiasClamp, "device does not support depth bias clamping");
     Require(!state.dualSourceBlend || (context.dualSrcBlend && state.blends.size() <= context.limits.maxFragmentDualSrcAttachments), "device does not support dual-source blending into this many attachments");
     Require(state.reversedBlend == 0 || (context.dualSrcBlend && state.blends.size() <= context.limits.maxFragmentDualSrcAttachments), "blending into a color target with a reversed component order through a second source color needs dual-source blending, which the device does not support");
+    Require(LogicOpFromRop(state.colorRop) == VK_LOGIC_OP_COPY || context.logicOp, "device does not support color logic operations");
+    Require(LogicOpFromRop(state.colorRop) == VK_LOGIC_OP_COPY || std::ranges::all_of(state.colors, [](const ColorTarget& color) { return LogicOpFormat(color.format); }), "color logic operations on a color target that is not a normalized or integer format are not implemented");
     Require(!state.negativeOneToOne || context.depthClipControl, "negative-one-to-one depth clipping requires VK_EXT_depth_clip_control with depthClipControl enabled");
     Require(!state.perSampleShading || context.sampleRateShading, "per-sample pixel shading requires the sampleRateShading device feature");
     Require(!state.mergedCoverage || (context.mergedCoverageSampleCounts & state.samples) != 0, "an overrasterized draw (a multisampled rasterizer into one-sample color targets) requires VK_NV_framebuffer_mixed_samples with merged coverage reduction");
@@ -397,12 +512,14 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         }
         // A descriptor set layout with the same bindings as this one is compatible with the pipeline
         // layout, so later draws bind their own ShaderResources' set under it.
-        const std::array<VkDescriptorSetLayout, 2> setLayouts{resources.main, resources.fragment};
+        const bool pixelLds = std::ranges::any_of(shaders, [](const CompiledShader& shader) { return shader.program != nullptr && shader.program->functionLdsBuffer; });
+        const auto pixelLdsLayouts = pixelLds ? PixelFunctionLdsSetLayouts(context) : PixelFunctionLdsLayouts{};
+        const std::array<VkDescriptorSetLayout, 3> setLayouts{resources.main, pixelLds && !resources.split ? pixelLdsLayouts.empty : resources.fragment, pixelLdsLayouts.buffer};
         const VkPushConstantRange push{pushStages, 0, PipelinePushSlotBytes};
         const std::array<VkPushConstantRange, 2> slots{{{pushStagesOf(context), 0, PipelinePushSlotBytes}, {VK_SHADER_STAGE_FRAGMENT_BIT, PipelinePushSlotBytes, PipelinePushSlotBytes}}};
         VkPipelineLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
-        layoutInfo.flags = resources.split ? VK_PIPELINE_LAYOUT_CREATE_INDEPENDENT_SETS_BIT_EXT : 0;
-        layoutInfo.setLayoutCount = resources.split ? 2u : 1u;
+        layoutInfo.flags = pixelLds || !resources.split ? 0 : VK_PIPELINE_LAYOUT_CREATE_INDEPENDENT_SETS_BIT_EXT;
+        layoutInfo.setLayoutCount = pixelLds ? 3u : resources.split ? 2u : 1u;
         layoutInfo.pSetLayouts = setLayouts.data();
         layoutInfo.pushConstantRangeCount = dynamicRendering ? static_cast<std::uint32_t>(slots.size()) : pushStages != 0 ? 1 : 0;
         layoutInfo.pPushConstantRanges = dynamicRendering ? slots.data() : pushStages != 0 ? &push : nullptr;
@@ -410,6 +527,7 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         std::vector<VkAttachmentDescription> colors;
         std::vector<VkAttachmentReference> references(state.blends.size(), VkAttachmentReference{VK_ATTACHMENT_UNUSED, attachmentLayout});
         for (std::uint32_t index = 0; index < state.colors.size(); ++index) {
+            if (state.colors[index].partialWriteMask != 0u) continue;
             VkAttachmentDescription color{};
             color.format = state.colors[index].format;
             color.samples = state.mergedCoverage || state.truncatedCoverage ? VK_SAMPLE_COUNT_1_BIT : static_cast<VkSampleCountFlagBits>(state.samples);
@@ -419,9 +537,10 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
             color.stencilStoreOp = VK_ATTACHMENT_STORE_OP_DONT_CARE;
             color.initialLayout = attachmentLayout;
             color.finalLayout = attachmentLayout;
+            references.at(state.colors[index].exportIndex) = {static_cast<std::uint32_t>(colors.size()), attachmentLayout};
             colors.push_back(color);
-            references.at(state.colors[index].exportIndex) = {index, attachmentLayout};
         }
+        boundColorAttachments = static_cast<std::uint32_t>(colors.size());
         VkSubpassDescription subpass{};
         subpass.pipelineBindPoint = VK_PIPELINE_BIND_POINT_GRAPHICS;
         subpass.colorAttachmentCount = static_cast<std::uint32_t>(references.size());
@@ -441,7 +560,9 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
             subpass.pDepthStencilAttachment = &depthReference;
         }
         std::vector<VkFormat> renderingColors(state.blends.size(), VK_FORMAT_UNDEFINED);
-        for (const auto& color : state.colors) renderingColors.at(color.exportIndex) = color.format;
+        for (const auto& color : state.colors) {
+            if (color.partialWriteMask == 0u) renderingColors.at(color.exportIndex) = color.format;
+        }
         VkPipelineRenderingCreateInfoKHR rendering{VK_STRUCTURE_TYPE_PIPELINE_RENDERING_CREATE_INFO_KHR};
         rendering.colorAttachmentCount = static_cast<std::uint32_t>(renderingColors.size());
         rendering.pColorAttachmentFormats = renderingColors.empty() ? nullptr : renderingColors.data();
@@ -458,7 +579,9 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         if (dynamicRendering) {
             depthFormat = state.depth ? HostDepthFormat(context, state.depth->format) : VK_FORMAT_UNDEFINED;
             colorSlots.assign(state.blends.size(), ~0u);
-            for (std::uint32_t index = 0; index < state.colors.size(); ++index) colorSlots.at(state.colors[index].exportIndex) = index;
+            for (std::uint32_t index = 0; index < state.colors.size(); ++index) {
+                if (state.colors[index].partialWriteMask == 0u) colorSlots.at(state.colors[index].exportIndex) = index;
+            }
             this->attachmentLayout = attachmentLayout;
         }
         VkRenderPassCreateInfo passInfo{VK_STRUCTURE_TYPE_RENDER_PASS_CREATE_INFO};
@@ -560,6 +683,10 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
                 secondChannels[index].colorBlendOp = state.blends[index].alphaBlendOp;
             }
         }
+        if (const auto logicOp = LogicOpFromRop(state.colorRop); logicOp != VK_LOGIC_OP_COPY) {
+            blend.logicOpEnable = VK_TRUE;
+            blend.logicOp = logicOp;
+        }
         blend.attachmentCount = static_cast<std::uint32_t>(firstChannels.size());
         blend.pAttachments = firstChannels.empty() ? nullptr : firstChannels.data();
         std::copy(state.blendConstants.begin(), state.blendConstants.end(), blend.blendConstants);
@@ -596,20 +723,21 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
             prebuilt = true;
             return;
         }
+        const VkPipelineCache pipelineCache = state.stages.tessellation && !context.tessellationPipelineCache ? VK_NULL_HANDLE : context.pipelineCache;
         if (libraries) pipeline = LinkPipelineFromLibraries(context, pipelineInfo, rendering, layoutInfo, keys, &optimized, false, _modules);
         else {
             auto pipelineCacheLock = context.LockPipelineCacheForUse();
-            Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, context.pipelineCache, 1, &pipelineInfo, nullptr, &pipeline), "vkCreateGraphicsPipelines");
+            Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, pipelineCache, 1, &pipelineInfo, nullptr, &pipeline), "vkCreateGraphicsPipelines");
         }
         if (alternateAlpha) {
             blend.pAttachments = secondChannels.data();
             auto pipelineCacheLock = context.LockPipelineCacheForUse();
-            Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, context.pipelineCache, 1, &pipelineInfo, nullptr, &secondChannel), "vkCreateGraphicsPipelines");
+            Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, pipelineCache, 1, &pipelineInfo, nullptr, &secondChannel), "vkCreateGraphicsPipelines");
         }
         if (state.depthBiasPerFace) {
             raster.cullMode = VK_CULL_MODE_FRONT_BIT;
             auto pipelineCacheLock = context.LockPipelineCacheForUse();
-            Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, context.pipelineCache, 1, &pipelineInfo, nullptr, &backFaces), "vkCreateGraphicsPipelines");
+            Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, pipelineCache, 1, &pipelineInfo, nullptr, &backFaces), "vkCreateGraphicsPipelines");
         }
         for (const auto module : _modules) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, module, nullptr);
         _modules.clear();
@@ -704,7 +832,11 @@ std::shared_ptr<Framebuffer> Pipeline::AcquireFramebuffer(std::span<const VkImag
             return framebuffers.back().framebuffer;
         }
     }
-    auto framebuffer = std::make_shared<Framebuffer>(context, renderPass, targets, extent, layers);
+    std::vector<VkImageView> boundViews;
+    for (std::size_t i = 0; i < targets.size(); ++i) {
+        if (boundAttachments[i]) boundViews.push_back(targets[i]);
+    }
+    auto framebuffer = std::make_shared<Framebuffer>(context, renderPass, renderPass == VK_NULL_HANDLE ? targets : std::span<const VkImageView>(boundViews), extent, layers);
     if (!resident) return framebuffer;
     // Beyond the bound the least recently used unreferenced entry goes.
     constexpr std::size_t bound = 8;
@@ -762,7 +894,7 @@ void Pipeline::Begin(VkCommandBuffer commands, const Framebuffer& framebuffer, V
     const auto locations = SampleLocations(state);
     const auto grid = sampleLocationGrid;
     const VkSampleLocationsInfoEXT info{VK_STRUCTURE_TYPE_SAMPLE_LOCATIONS_INFO_EXT, nullptr, static_cast<VkSampleCountFlagBits>(state.samples), grid, state.samples * grid.width * grid.height, locations.data()};
-    const VkAttachmentSampleLocationsEXT initial{static_cast<std::uint32_t>(state.colors.size()), info};
+    const VkAttachmentSampleLocationsEXT initial{boundColorAttachments, info};
     const VkSubpassSampleLocationsEXT post{0, info};
     VkRenderPassSampleLocationsBeginInfoEXT sampleLocations{VK_STRUCTURE_TYPE_RENDER_PASS_SAMPLE_LOCATIONS_BEGIN_INFO_EXT};
     sampleLocations.attachmentInitialSampleLocationsCount = state.depth ? 1 : 0;
@@ -899,6 +1031,7 @@ void pipelineKey(std::vector<std::byte>& key, const Context& context, const Stat
     append(key, state.conservativeRasterization);
     append(key, state.blends.size());
     for (const auto& blend : state.blends) append(key, blend);
+    append(key, state.colorRop);
     for (const auto value : state.blendConstants) append(key, value);
     append(key, state.samples);
     append(key, state.perSampleShading);
@@ -913,6 +1046,7 @@ void pipelineKey(std::vector<std::byte>& key, const Context& context, const Stat
     for (const auto& color : state.colors) {
         append(key, color.format);
         append(key, color.componentMapping);
+        append(key, color.partialWriteMask != 0u);
     }
     if (state.blends.size() != state.colors.size()) {
         for (const auto& color : state.colors) append(key, color.exportIndex);
@@ -993,6 +1127,14 @@ struct PipelineStore {
     std::uint64_t evicted = 0;
     PipelineStoreCounters totals;
     std::chrono::steady_clock::time_point lastReport = std::chrono::steady_clock::now();
+    std::size_t capacity = 0;
+    bool fixedCapacity = false;
+    std::list<std::uint64_t> evictedOrder;
+    std::unordered_map<std::uint64_t, std::list<std::uint64_t>::iterator> evictedKeys;
+    std::size_t evictionsSinceCheck = 0;
+    std::size_t returnsSinceCheck = 0;
+    static constexpr std::size_t BaseEntries = 1024;
+    static constexpr std::size_t MaximumEntries = 4096;
 };
 
 // Never destroyed: the pipelines belong to a device that may already be gone when statics die, and
@@ -1021,9 +1163,41 @@ std::list<PipelineStore::Entry>::iterator abandon(PipelineStore& store, std::lis
     return store.entries.erase(it);
 }
 
-std::size_t storeBound() {
-    static const auto bound = static_cast<std::size_t>(std::max<std::uint64_t>(1u, PipelineSwitch("APS5_PIPELINE_STORE_ENTRIES", 1024u)));
-    return bound;
+std::size_t storeBound(PipelineStore& store) {
+    if (store.capacity == 0) {
+        const auto set = PipelineSwitch("APS5_PIPELINE_STORE_ENTRIES", 0u);
+        store.fixedCapacity = set != 0;
+        store.capacity = store.fixedCapacity ? static_cast<std::size_t>(set) : PipelineStore::BaseEntries;
+    }
+    return store.capacity;
+}
+
+void noteStoreEviction(PipelineStore& store, std::uint64_t hash) {
+    if (store.fixedCapacity) return;
+    if (const auto found = store.evictedKeys.find(hash); found != store.evictedKeys.end()) store.evictedOrder.erase(found->second);
+    store.evictedOrder.push_front(hash);
+    store.evictedKeys[hash] = store.evictedOrder.begin();
+    while (store.evictedOrder.size() > store.capacity) {
+        store.evictedKeys.erase(store.evictedOrder.back());
+        store.evictedOrder.pop_back();
+    }
+    if (++store.evictionsSinceCheck < store.capacity / 32u) return;
+    const bool churning = store.returnsSinceCheck * 2u > store.evictionsSinceCheck;
+    store.evictionsSinceCheck = 0;
+    store.returnsSinceCheck = 0;
+    if (!churning || store.capacity >= PipelineStore::MaximumEntries) return;
+    const auto previous = store.capacity;
+    store.capacity = std::min(store.capacity * 2u, PipelineStore::MaximumEntries);
+    std::fprintf(stderr, "[pipecache] bound %zu -> %zu pipelines: pipelines it evicted keep coming back\n", previous, store.capacity);
+}
+
+void noteStoreReturn(PipelineStore& store, std::uint64_t hash) {
+    if (store.fixedCapacity) return;
+    const auto found = store.evictedKeys.find(hash);
+    if (found == store.evictedKeys.end()) return;
+    store.evictedOrder.erase(found->second);
+    store.evictedKeys.erase(found);
+    ++store.returnsSinceCheck;
 }
 
 void reportPipelines(PipelineStore& store) {
@@ -1095,12 +1269,12 @@ std::shared_ptr<Pipeline> CachedPipeline(const Context& context, const State& st
         }
         ++store.misses;
         ++store.totals.misses;
+        noteStoreReturn(store, hash);
     }
     // Built outside the mutex: a draw that finds its pipeline resident is not held behind another
     // thread's build (the journal replay builds here too), and a device's driver compiles in
     // parallel when several threads build at once.
     auto pipeline = std::make_shared<Pipeline>(context, state, vertexInput, resources, shaders, attachmentLayout);
-    const auto bound = storeBound();
     const bool replaying = PipelineJournalReplaying();
     {
         std::lock_guard lock(store.mutex);
@@ -1118,7 +1292,10 @@ std::shared_ptr<Pipeline> CachedPipeline(const Context& context, const State& st
         }
         // A replayed pipeline enters at the least recently used end and never displaces a draw's:
         // the title's own pipelines evict it first, and a full store takes none.
-        if (replaying && store.entries.size() >= bound) return pipeline;
+        if (replaying && store.entries.size() >= storeBound(store)) {
+            if (store.fixedCapacity || store.capacity >= PipelineStore::MaximumEntries) return pipeline;
+            store.capacity = std::min(store.capacity * 2u, PipelineStore::MaximumEntries);
+        }
         if (replaying) {
             store.entries.push_front({context.device, context.bufferPool, context.bufferPool != nullptr, hash, std::vector<std::byte>(key), pipeline});
             store.index[hash] = store.entries.begin();
@@ -1126,12 +1303,14 @@ std::shared_ptr<Pipeline> CachedPipeline(const Context& context, const State& st
             store.entries.push_back({context.device, context.bufferPool, context.bufferPool != nullptr, hash, std::vector<std::byte>(key), pipeline});
             store.index[hash] = std::prev(store.entries.end());
         }
-        while (store.entries.size() > bound) {
+        while (store.entries.size() > storeBound(store)) {
             // Only an entry no recorded draw still holds may go (Kept keeps its shared_ptr until the fence).
             const auto victim = std::find_if(store.entries.begin(), store.entries.end(), [](const PipelineStore::Entry& entry) { return entry.pipeline.use_count() == 1; });
             if (victim == store.entries.end()) break;
+            const auto evictedHash = victim->hash;
             store.index.erase(victim->hash);
             store.entries.erase(victim);
+            noteStoreEviction(store, evictedHash);
             ++store.evicted;
             ++store.totals.evicted;
         }
@@ -1150,10 +1329,16 @@ PipelineStoreCounters PipelineStoreTotals() {
     std::lock_guard lock(store.mutex);
     auto totals = store.totals;
     totals.cached = store.entries.size();
-    totals.bound = storeBound();
+    totals.bound = storeBound(store);
     return totals;
 }
 
+bool PipelineStoreCanGrow() {
+    auto& store = Pipelines();
+    std::lock_guard lock(store.mutex);
+    return storeBound(store) < PipelineStore::MaximumEntries && !store.fixedCapacity;
+}
+
 void ClearCachedPipelines(VkDevice device) {
     auto& store = Pipelines();
     std::lock_guard lock(store.mutex);
@@ -1165,7 +1350,15 @@ void ClearCachedPipelines(VkDevice device) {
         store.index.erase(it->hash);
         it = store.entries.erase(it);
     }
+    if (store.entries.empty() && !store.fixedCapacity) {
+        store.capacity = 0;
+        store.evictedOrder.clear();
+        store.evictedKeys.clear();
+        store.evictionsSinceCheck = 0;
+        store.returnsSinceCheck = 0;
+    }
     ClearPipelineLibraries(device);
+    ReleasePixelFunctionLds(device);
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp
index 73fac4402d..28df53956c 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp
@@ -197,7 +197,7 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         settledBytes = liveBytes;
         settledFile = file;
     };
-    const auto disk = fileUnchanged ? File{} : readFile();
+    auto disk = fileUnchanged ? File{} : readFile();
     if (disk.state == FileState::Unreadable) {
         std::fprintf(stderr, "[pipeline-cache] cannot read %s; not saving over it\n", path.string().c_str());
         settle(readHeader());
@@ -206,12 +206,16 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
     if (disk.state == FileState::Invalid) std::fprintf(stderr, "[pipeline-cache] replacing %s: %s\n", path.string().c_str(), disk.invalidReason);
     std::size_t floor = fileUnchanged ? std::max<std::size_t>(loadedBytes, settledFile->dataBytes) : 0;
     VkPipelineCache merged = VK_NULL_HANDLE;
+    bool mergedWithFile = false;
     struct DestroyMerged {
         const Context& context;
-        const VkPipelineCache& cache;
-        ~DestroyMerged() {
-            if (cache != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipelineCache>("vkDestroyPipelineCache")(context.device, cache, nullptr);
+        VkPipelineCache& cache;
+        void Reset() {
+            if (cache == VK_NULL_HANDLE) return;
+            context.Function<PFN_vkDestroyPipelineCache>("vkDestroyPipelineCache")(context.device, cache, nullptr);
+            cache = VK_NULL_HANDLE;
         }
+        ~DestroyMerged() { Reset(); }
     } destroyMerged{context, merged};
     if (disk.state == FileState::Valid) {
         const auto data = disk.Payload();
@@ -221,11 +225,13 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         const auto result = context.Function<PFN_vkCreatePipelineCache>("vkCreatePipelineCache")(context.device, &info, nullptr, &merged);
         if (result == VK_SUCCESS) {
             floor = std::max(loadedBytes, data.size());
+            mergedWithFile = true;
         } else {
             merged = VK_NULL_HANDLE;
             std::fprintf(stderr, "[pipeline-cache] replacing %s: the driver refused it (Vulkan result %d)\n", path.string().c_str(), static_cast<int>(result));
         }
     }
+    std::vector<std::byte>().swap(disk.contents);
     if (merged != VK_NULL_HANDLE) {
         auto synchronizationLock = snapshot();
         if (!synchronizationLock.owns_lock()) return;
@@ -251,6 +257,7 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         if (result != VK_SUCCESS && result != VK_INCOMPLETE) return;
         file.resize(sizeof(FileHeader) + size);
     }
+    destroyMerged.Reset();
     if (size < floor) {
         std::fprintf(stderr, "[pipeline-cache] keeping %s: the merged cache has %.1f KiB, less than the %.1f KiB on disk or loaded at start\n", path.string().c_str(), static_cast<double>(size) / 1024.0, static_cast<double>(floor) / 1024.0);
         settle(fileUnchanged ? *settledFile : disk.header);
@@ -263,7 +270,7 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         return;
     }
     settle(header);
-    if (final || profiling()) std::fprintf(stderr, "[pipeline-cache] saved %.1f KiB to %s in %.1f ms%s%s\n", static_cast<double>(size) / 1024.0, path.string().c_str(), std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - started).count(), merged != VK_NULL_HANDLE ? " (merged with the file)" : "", final ? " (teardown)" : "");
+    if (final || profiling()) std::fprintf(stderr, "[pipeline-cache] saved %.1f KiB to %s in %.1f ms%s%s\n", static_cast<double>(size) / 1024.0, path.string().c_str(), std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - started).count(), mergedWithFile ? " (merged with the file)" : "", final ? " (teardown)" : "");
 }
 
 void PipelineCache::SaveNow() {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp
index ceea544e4e..1745c0ed96 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp
@@ -1,11 +1,13 @@
 #include "prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
+#include "prx/libc/include/HostThreadLocal.hpp"
 #include "ShaderCacheDirectory.hpp"
 #include "ShaderDiskCache.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
+#include <cerrno>
 #include <chrono>
 #include <condition_variable>
 #include <cstdlib>
@@ -23,6 +25,7 @@
 #else
 #include <fcntl.h>
 #include <sys/file.h>
+#include <sys/stat.h>
 #include <unistd.h>
 #endif
 
@@ -35,7 +38,7 @@ static_assert(sizeof(VkStencilOpState) == 28, "VkStencilOpState changed: update
 static_assert(sizeof(VkVertexInputBindingDescription) == 12, "VkVertexInputBindingDescription changed: update the recipe codec");
 static_assert(sizeof(VkVertexInputAttributeDescription) == 16, "VkVertexInputAttributeDescription changed: update the recipe codec");
 #if defined(__linux__) && defined(__x86_64__) && defined(__GLIBCXX__)
-static_assert(sizeof(State) == 824, "State changed: update CanonicalPipelineState and the recipe codec");
+static_assert(sizeof(State) == 840, "State changed: update CanonicalPipelineState and the recipe codec");
 static_assert(sizeof(ShaderStages) == 112, "ShaderStages changed: update the recipe codec");
 static_assert(sizeof(ShaderRecompiler::MeshConfiguration) == 40, "MeshConfiguration changed: update the recipe codec");
 static_assert(sizeof(ShaderRecompiler::TessellationConfiguration) == 40, "TessellationConfiguration changed: update the recipe codec");
@@ -44,7 +47,7 @@ static_assert(sizeof(ShaderRecompiler::TessellationConfiguration) == 40, "Tessel
 constexpr std::uint32_t FileMagic = 0x4c4a5041u;
 // Bumped when the recipe codec, CanonicalPipelineState or the store key change in a way the
 // layout guards above do not catch (a field renumbered or reinterpreted at the same size).
-constexpr std::uint32_t FileFormat = 8u;
+constexpr std::uint32_t FileFormat = 10u;
 constexpr std::uint32_t ModuleRecord = 1u;
 constexpr std::uint32_t GraphicsRecord = 2u;
 constexpr std::uint32_t ComputeRecord = 3u;
@@ -195,6 +198,7 @@ void encodeState(Writer& writer, const State& state) {
         writer.U32(static_cast<std::uint32_t>(color.format));
         writer.U32(color.exportIndex);
         writer.Raw(color.componentMapping);
+        writer.Raw(color.partialWriteMask);
     }
     writer.Raws(std::span<const VkPipelineColorBlendAttachmentState>(state.blends));
     for (const auto value : state.blendConstants) writer.Raw(value);
@@ -202,6 +206,7 @@ void encodeState(Writer& writer, const State& state) {
     writer.Bool(state.rectList);
     writer.Bool(state.dualSourceBlend);
     writer.U32(state.reversedBlend);
+    writer.U32(state.colorRop);
     writer.U32(static_cast<std::uint32_t>(state.topology));
     writer.Bool(state.primitiveRestart);
     writer.Bool(state.negativeOneToOne);
@@ -260,6 +265,7 @@ void decodeState(Reader& reader, State& state) {
         color.format = static_cast<VkFormat>(reader.U32());
         color.exportIndex = reader.U32();
         color.componentMapping = reader.Raw<std::uint8_t>();
+        color.partialWriteMask = reader.Raw<std::uint16_t>();
         state.colors.push_back(color);
     }
     reader.Raws(state.blends, 8u);
@@ -268,6 +274,7 @@ void decodeState(Reader& reader, State& state) {
     state.rectList = reader.Bool();
     state.dualSourceBlend = reader.Bool();
     state.reversedBlend = reader.U32();
+    state.colorRop = static_cast<std::uint8_t>(reader.U32());
     state.topology = static_cast<VkPrimitiveTopology>(reader.U32());
     state.primitiveRestart = reader.Bool();
     state.negativeOneToOne = reader.Bool();
@@ -337,6 +344,10 @@ std::uint64_t padded(std::uint64_t bytes) {
     return (bytes + RecordAlignment - 1u) / RecordAlignment * RecordAlignment;
 }
 
+std::uint64_t recordBytes(std::uint64_t payloadBytes) {
+    return padded(sizeof(RecordHeader) + payloadBytes);
+}
+
 bool profiling() {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     return profile;
@@ -357,6 +368,16 @@ std::uint64_t configured(const char* name, std::uint64_t fallback) {
 // second run of the same install) takes the same lock file, so its appends and this run's never
 // interleave and neither cuts a record the other is writing. Taken before the journal's mutex,
 // never while holding it.
+bool replaceFile(const std::filesystem::path& temporary, const std::filesystem::path& target) {
+#ifdef _WIN32
+    return ::MoveFileExW(temporary.c_str(), target.c_str(), MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH) != 0;
+#else
+    std::error_code error;
+    std::filesystem::rename(temporary, target, error);
+    return !error;
+#endif
+}
+
 class FileLock {
 public:
     explicit FileLock(const std::filesystem::path& path) {
@@ -407,13 +428,100 @@ private:
 #endif
 };
 
+class JournalFile {
+public:
+    explicit JournalFile(const std::filesystem::path& path) {
+#ifdef _WIN32
+        handle = CreateFileW(path.c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, nullptr);
+        LARGE_INTEGER length{};
+        if (handle != INVALID_HANDLE_VALUE && GetFileSizeEx(handle, &length) && length.QuadPart >= 0) {
+            size = static_cast<std::uint64_t>(length.QuadPart);
+        } else if (handle != INVALID_HANDLE_VALUE) {
+            CloseHandle(handle);
+            handle = INVALID_HANDLE_VALUE;
+        }
+#else
+        descriptor = ::open(path.c_str(), O_RDONLY | O_CLOEXEC);
+        struct stat status{};
+        if (descriptor >= 0 && ::fstat(descriptor, &status) == 0 && status.st_size >= 0) {
+            size = static_cast<std::uint64_t>(status.st_size);
+        } else if (descriptor >= 0) {
+            ::close(descriptor);
+            descriptor = -1;
+        }
+#endif
+    }
+
+    ~JournalFile() {
+#ifdef _WIN32
+        if (handle != INVALID_HANDLE_VALUE) CloseHandle(handle);
+#else
+        if (descriptor >= 0) ::close(descriptor);
+#endif
+    }
+
+    JournalFile(const JournalFile&) = delete;
+    JournalFile& operator=(const JournalFile&) = delete;
+
+#ifdef _WIN32
+    [[nodiscard]] bool Open() const { return handle != INVALID_HANDLE_VALUE; }
+#else
+    [[nodiscard]] bool Open() const { return descriptor >= 0; }
+#endif
+    [[nodiscard]] std::uint64_t Size() const { return size; }
+
+    bool Read(std::uint64_t offset, std::span<std::byte> bytes) const {
+        for (std::size_t done = 0; done < bytes.size();) {
+            const auto position = offset + done;
+#ifdef _WIN32
+            struct ReadEvent {
+                HANDLE event = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+                ~ReadEvent() {
+                    if (event != nullptr) CloseHandle(event);
+                }
+            };
+            auto& completion = HostThreadLocal<ReadEvent, ReadEvent>();
+            if (completion.event == nullptr) return false;
+            OVERLAPPED at{};
+            at.Offset = static_cast<DWORD>(position);
+            at.OffsetHigh = static_cast<DWORD>(position >> 32u);
+            at.hEvent = completion.event;
+            DWORD count = 0;
+            if (!ReadFile(handle, bytes.data() + done, static_cast<DWORD>(std::min<std::size_t>(bytes.size() - done, MAXDWORD)), nullptr, &at) && GetLastError() != ERROR_IO_PENDING) return false;
+            if (!GetOverlappedResult(handle, &at, &count, TRUE) || count == 0) return false;
+#else
+            const auto count = ::pread(descriptor, bytes.data() + done, bytes.size() - done, static_cast<off_t>(position));
+            if (count < 0 && errno == EINTR) continue;
+            if (count <= 0) return false;
+#endif
+            done += static_cast<std::size_t>(count);
+        }
+        return true;
+    }
+
+    template<typename TValue>
+    bool ReadValue(std::uint64_t offset, TValue& value) const requires std::is_trivially_copyable_v<TValue> {
+        return Read(offset, std::as_writable_bytes(std::span(&value, 1)));
+    }
+
+private:
+#ifdef _WIN32
+    HANDLE handle = INVALID_HANDLE_VALUE;
+#else
+    int descriptor = -1;
+#endif
+    std::uint64_t size = 0;
+};
+
 // The end of the last whole record in [from, size) of the file: records another process appended
 // after this one loaded the file are kept, the torn tail of a record a crashed run left is cut.
 std::uint64_t validTail(const std::filesystem::path& path, std::uint64_t from, std::uint64_t size);
 
 struct LoadedModule {
     ShaderRecompiler::ShaderStage stage;
-    std::shared_ptr<const ShaderRecompiler::RecompileResult> result;
+    std::uint64_t payloadOffset = 0;
+    std::uint64_t payloadBytes = 0;
+    std::uint64_t payloadHash = 0;
 };
 
 struct LoadedEntry {
@@ -424,6 +532,7 @@ struct LoadedEntry {
 };
 
 struct LoadedJournal {
+    std::shared_ptr<const JournalFile> file;
     std::map<ShaderRecompiler::PipelineIdentity, LoadedModule> modules;
     std::vector<LoadedEntry> entries;
     std::set<ShaderRecompiler::PipelineIdentity> indexModules;
@@ -434,6 +543,178 @@ struct LoadedJournal {
     bool headerValid = false;
 };
 
+struct RecordSpan {
+    std::uint64_t offset = 0;
+    std::uint64_t bytes = 0;
+    std::uint32_t kind = 0;
+    std::uint64_t hash = 0;
+    ShaderRecompiler::PipelineIdentity identity{};
+    std::vector<ShaderRecompiler::PipelineIdentity> needs;
+    bool decodable = false;
+};
+
+class PayloadHash {
+public:
+    explicit PayloadHash(std::uint64_t bytes) : hash(bytes * Multiplier) {}
+
+    void Update(std::span<const std::byte> bytes) {
+        while (!bytes.empty()) {
+            const auto take = std::min(bytes.size(), carry.size() - carryBytes);
+            std::memcpy(carry.data() + carryBytes, bytes.data(), take);
+            carryBytes += take;
+            bytes = bytes.subspan(take);
+            if (carryBytes == carry.size()) {
+                std::uint64_t chunk = 0;
+                std::memcpy(&chunk, carry.data(), sizeof(chunk));
+                Mix(chunk);
+                carryBytes = 0;
+            }
+        }
+    }
+
+    [[nodiscard]] std::uint64_t Finish() {
+        if (carryBytes != 0) {
+            std::uint64_t chunk = 0;
+            std::memcpy(&chunk, carry.data(), carryBytes);
+            Mix(chunk ^ 0x8000000000000000ull);
+            carryBytes = 0;
+        }
+        hash ^= hash >> 33u;
+        hash *= 0xff51afd7ed558ccdull;
+        hash ^= hash >> 33u;
+        hash *= 0xc4ceb9fe1a85ec53ull;
+        hash ^= hash >> 33u;
+        return hash;
+    }
+
+private:
+    static constexpr std::uint64_t Multiplier = 0x9e3779b97f4a7c15ull;
+
+    void Mix(std::uint64_t chunk) {
+        chunk *= 0xff51afd7ed558ccdull;
+        chunk ^= chunk >> 32u;
+        hash = (hash ^ chunk) * Multiplier;
+        hash = (hash << 27u) | (hash >> 37u);
+    }
+
+    std::uint64_t hash;
+    std::array<std::byte, 8> carry{};
+    std::size_t carryBytes = 0;
+};
+
+struct SpanScan {
+    bool headerValid = false;
+    std::vector<RecordSpan> spans;
+};
+
+bool readSpanPayload(std::ifstream& file, const RecordHeader& record, std::array<std::byte, 20>& prefix, std::vector<std::byte>& graphics, std::uint64_t& hash) {
+    constexpr std::uint64_t MaxGraphicsBytes = 16u * 1024u * 1024u;
+    PayloadHash hasher(record.payloadBytes);
+    std::array<std::byte, 64u * 1024u> chunk{};
+    const bool capture = record.kind == GraphicsRecord && record.payloadBytes <= MaxGraphicsBytes;
+    if (capture) graphics.resize(static_cast<std::size_t>(record.payloadBytes));
+    std::size_t copied = 0;
+    std::uint64_t left = record.payloadBytes;
+    while (left != 0) {
+        const auto take = static_cast<std::size_t>(std::min<std::uint64_t>(left, chunk.size()));
+        file.read(reinterpret_cast<char*>(chunk.data()), static_cast<std::streamsize>(take));
+        if (file.gcount() != static_cast<std::streamsize>(take)) return false;
+        const auto bytes = std::span<const std::byte>(chunk.data(), take);
+        hasher.Update(bytes);
+        const auto prefixBytes = std::min(take, prefix.size() - copied);
+        std::memcpy(prefix.data() + copied, bytes.data(), prefixBytes);
+        if (prefixBytes < take) copied = prefix.size();
+        else copied += take;
+        if (capture) std::memcpy(graphics.data() + (static_cast<std::size_t>(record.payloadBytes) - static_cast<std::size_t>(left)), bytes.data(), take);
+        left -= take;
+    }
+    hash = hasher.Finish();
+    return true;
+}
+
+bool scanSpans(const std::filesystem::path& path, std::uint64_t device, SpanScan& scan) {
+    std::error_code error;
+    const auto fileSize = std::filesystem::file_size(path, error);
+    if (error) return false;
+    std::ifstream file(path, std::ios::binary);
+    if (!file) return false;
+    FileHeader header{};
+    file.read(reinterpret_cast<char*>(&header), sizeof(header));
+    if (file.gcount() != sizeof(header)) return false;
+    if (header.magic != FileMagic || header.format != FileFormat || header.runtimeAbi != ShaderRecompiler::RuntimeAbi::Version ||
+        header.sourceVersion != ShaderRecompiler::ShaderDiskCache::SourceVersion() || header.device != device) return false;
+    scan.headerValid = true;
+    auto cursor = padded(sizeof(FileHeader));
+    while (cursor + sizeof(RecordHeader) <= fileSize) {
+        file.clear();
+        file.seekg(static_cast<std::streamoff>(cursor), std::ios::beg);
+        RecordHeader record{};
+        file.read(reinterpret_cast<char*>(&record), sizeof(record));
+        if (file.gcount() != sizeof(record) || record.kind == 0 || record.kind > ComputeRecord) break;
+        const auto payloadOffset = cursor + sizeof(RecordHeader);
+        if (record.payloadBytes > fileSize - payloadOffset) break;
+        const auto end = padded(payloadOffset + record.payloadBytes);
+        if (end > fileSize) break;
+        std::array<std::byte, 20> prefix{};
+        std::vector<std::byte> graphics;
+        std::uint64_t hash = 0;
+        if (!readSpanPayload(file, record, prefix, graphics, hash) || hash != record.payloadHash) break;
+        RecordSpan span;
+        span.offset = cursor;
+        span.bytes = end - cursor;
+        span.kind = record.kind;
+        span.hash = record.payloadHash;
+        if (record.kind == ModuleRecord) {
+            if (record.payloadBytes < 20u) break;
+            std::memcpy(&span.identity.low, prefix.data(), sizeof(span.identity.low));
+            std::memcpy(&span.identity.high, prefix.data() + 8, sizeof(span.identity.high));
+        } else if (record.kind == ComputeRecord) {
+            if (record.payloadBytes >= 16u) {
+                std::memcpy(&span.identity.low, prefix.data(), sizeof(span.identity.low));
+                std::memcpy(&span.identity.high, prefix.data() + 8, sizeof(span.identity.high));
+                span.needs.push_back(span.identity);
+                span.decodable = true;
+            }
+        } else {
+            GraphicsPipelineRecipe recipe;
+            if (!graphics.empty() && DecodeGraphicsPipelineRecipe(graphics, recipe)) {
+                for (const auto& stage : recipe.stages) span.needs.push_back(stage.identity);
+                span.decodable = true;
+            }
+        }
+        scan.spans.push_back(std::move(span));
+        cursor = end;
+    }
+    return true;
+}
+
+bool copySpans(const std::filesystem::path& path, const SpanScan& scan, const std::set<std::size_t>& kept, const std::filesystem::path& temporary) {
+    std::ifstream source(path, std::ios::binary);
+    if (!source) return false;
+    std::ofstream out(temporary, std::ios::binary | std::ios::trunc);
+    if (!out) return false;
+    std::array<std::byte, 64u * 1024u> chunk{};
+    source.read(reinterpret_cast<char*>(chunk.data()), static_cast<std::streamsize>(padded(sizeof(FileHeader))));
+    if (source.gcount() != static_cast<std::streamsize>(padded(sizeof(FileHeader)))) return false;
+    out.write(reinterpret_cast<const char*>(chunk.data()), static_cast<std::streamsize>(padded(sizeof(FileHeader))));
+    for (std::size_t position = 0; position < scan.spans.size(); ++position) {
+        if (!kept.contains(position)) continue;
+        const auto& span = scan.spans[position];
+        source.clear();
+        source.seekg(static_cast<std::streamoff>(span.offset), std::ios::beg);
+        auto left = span.bytes;
+        while (left != 0) {
+            const auto take = static_cast<std::size_t>(std::min<std::uint64_t>(left, chunk.size()));
+            source.read(reinterpret_cast<char*>(chunk.data()), static_cast<std::streamsize>(take));
+            if (source.gcount() != static_cast<std::streamsize>(take)) return false;
+            out.write(reinterpret_cast<const char*>(chunk.data()), static_cast<std::streamsize>(take));
+            left -= take;
+        }
+    }
+    out.flush();
+    return !out.fail();
+}
+
 class Journal {
 public:
     static Journal& Instance() {
@@ -462,20 +743,19 @@ public:
         return false;
     }
 
-    // Reads the whole file (modules keep views into the buffer, which lives as long as they do),
-    // fills the dedupe index, and remembers how many bytes parsed so a torn tail is cut before the
-    // next append.
+    // Parses the file a record at a time and keeps it open for the replay, fills the dedupe index,
+    // and remembers how many bytes parsed so a torn tail is cut before the next append.
     LoadedJournal Load() {
         LoadedJournal loaded;
         if (!Enabled() || !bound.load(std::memory_order_acquire)) return loaded;
         const auto started = std::chrono::steady_clock::now();
-        auto file = std::make_shared<std::vector<std::byte>>();
         bool read = false;
         {
             FileLock fileLock(lockPath);
-            read = ShaderRecompiler::ReadWholeFile(path, *file);
+            auto file = std::make_shared<const JournalFile>(path);
+            read = file->Open() && parse(*file, loaded, true);
+            if (read) loaded.file = std::move(file);
         }
-        if (read) parse(*file, file, loaded, true);
         const auto ms = std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - started).count();
         {
             std::lock_guard lock(mutex);
@@ -541,12 +821,15 @@ public:
         totals.recordedModules = counters.recordedModules.load(std::memory_order_relaxed);
         totals.writtenBytes = counters.writtenBytes.load(std::memory_order_relaxed);
         totals.writeFailures = counters.writeFailures.load(std::memory_order_relaxed);
+        totals.evictedRecords = counters.evictedRecords.load(std::memory_order_relaxed);
+        totals.evictedBytes = counters.evictedBytes.load(std::memory_order_relaxed);
         return totals;
     }
 
     struct Counters {
         std::atomic<std::uint64_t> loadedRecipes{0}, loadedModules{0}, loadedBytes{0}, droppedRecords{0};
         std::atomic<std::uint64_t> recordedGraphics{0}, recordedCompute{0}, recordedModules{0}, writtenBytes{0}, writeFailures{0};
+        std::atomic<std::uint64_t> evictedRecords{0}, evictedBytes{0};
     };
 
 private:
@@ -592,27 +875,30 @@ private:
     // Parses the file: with `loaded` set every record is decoded, otherwise only the index (the
     // module identities and record hashes) is built. Stops at the first record that does not
     // parse; the bytes before it stay valid.
-    void parse(const std::vector<std::byte>& file, const std::shared_ptr<const std::vector<std::byte>>& owner, LoadedJournal& loaded, bool decode) {
+    bool parse(const JournalFile& file, LoadedJournal& loaded, bool decode, std::vector<RecordSpan>* spans = nullptr) {
         std::uint64_t valid = 0;
         bool header = false;
         std::uint64_t dropped = 0;
-        const auto bytes = std::span<const std::byte>(file);
-        if (bytes.size() >= sizeof(FileHeader)) {
+        const auto size = file.Size();
+        if (size >= sizeof(FileHeader)) {
             FileHeader fileHeader;
-            std::memcpy(&fileHeader, bytes.data(), sizeof(fileHeader));
+            if (!file.ReadValue(0, fileHeader)) return false;
             header = fileHeader.magic == FileMagic && fileHeader.format == FileFormat && fileHeader.runtimeAbi == ShaderRecompiler::RuntimeAbi::Version && fileHeader.sourceVersion == ShaderRecompiler::ShaderDiskCache::SourceVersion() && fileHeader.device == device.load(std::memory_order_relaxed);
         }
         if (header) {
             valid = padded(sizeof(FileHeader));
             std::uint64_t cursor = valid;
-            while (cursor + sizeof(RecordHeader) <= bytes.size()) {
+            std::vector<std::byte> bytes;
+            while (cursor + sizeof(RecordHeader) <= size) {
                 RecordHeader record;
-                std::memcpy(&record, bytes.data() + cursor, sizeof(record));
+                if (!file.ReadValue(cursor, record)) return false;
                 const auto payloadOffset = cursor + sizeof(RecordHeader);
-                if (record.payloadBytes > bytes.size() - payloadOffset) break;
+                if (record.payloadBytes > size - payloadOffset) break;
                 const auto end = padded(payloadOffset + record.payloadBytes);
-                if (end > bytes.size()) break;
-                const auto payload = bytes.subspan(static_cast<std::size_t>(payloadOffset), static_cast<std::size_t>(record.payloadBytes));
+                if (end > size) break;
+                bytes.resize(static_cast<std::size_t>(record.payloadBytes));
+                if (!file.Read(payloadOffset, bytes)) return false;
+                const auto payload = std::span<const std::byte>(bytes);
                 if (ShaderRecompiler::HashBytes(payload) != record.payloadHash) break;
                 if (record.kind == ModuleRecord) {
                     if (payload.size() < 20u) break;
@@ -623,15 +909,24 @@ private:
                     std::memcpy(&stage, payload.data() + 16, sizeof(stage));
                     bool decoded = !decode;
                     if (decode && !loaded.indexModules.contains(identity)) {
-                        auto result = std::make_shared<ShaderRecompiler::RecompileResult>();
-                        decoded = ShaderRecompiler::ShaderDiskCache::DecodeResult(payload.subspan(20), *result, owner) && result->Identity() == identity;
-                        if (decoded) loaded.modules.emplace(identity, LoadedModule{static_cast<ShaderRecompiler::ShaderStage>(stage), std::move(result)});
+                        ShaderRecompiler::RecompileResult result;
+                        decoded = ShaderRecompiler::ShaderDiskCache::DecodeResult(payload.subspan(20), result) && result.Identity() == identity;
+                        if (decoded) loaded.modules.emplace(identity, LoadedModule{static_cast<ShaderRecompiler::ShaderStage>(stage), payloadOffset, record.payloadBytes, record.payloadHash});
                         else ++dropped;
                     }
                     if (decoded) loaded.indexModules.insert(identity);
+                    if (spans != nullptr) {
+                        RecordSpan span;
+                        span.offset = cursor;
+                        span.bytes = end - cursor;
+                        span.kind = record.kind;
+                        span.hash = record.payloadHash;
+                        span.identity = identity;
+                        spans->push_back(std::move(span));
+                    }
                 } else if (record.kind == GraphicsRecord || record.kind == ComputeRecord) {
                     if (decode && !loaded.indexRecords.contains(record.payloadHash)) {
-                        LoadedEntry entry;
+                        LoadedEntry entry{};
                         entry.kind = record.kind;
                         bool decoded = false;
                         if (record.kind == GraphicsRecord) {
@@ -648,6 +943,28 @@ private:
                         else ++dropped;
                     }
                     loaded.indexRecords.insert(record.payloadHash);
+                    if (spans != nullptr) {
+                        RecordSpan span;
+                        span.offset = cursor;
+                        span.bytes = end - cursor;
+                        span.kind = record.kind;
+                        span.hash = record.payloadHash;
+                        if (record.kind == ComputeRecord) {
+                            if (payload.size() >= 16u) {
+                                std::memcpy(&span.identity.low, payload.data(), sizeof(span.identity.low));
+                                std::memcpy(&span.identity.high, payload.data() + 8, sizeof(span.identity.high));
+                                span.needs.push_back(span.identity);
+                                span.decodable = true;
+                            }
+                        } else {
+                            GraphicsPipelineRecipe recipe;
+                            if (DecodeGraphicsPipelineRecipe(payload, recipe)) {
+                                for (const auto& stage : recipe.stages) span.needs.push_back(stage.identity);
+                                span.decodable = true;
+                            }
+                        }
+                        spans->push_back(std::move(span));
+                    }
                 } else {
                     break;
                 }
@@ -655,11 +972,12 @@ private:
                 cursor = end;
             }
         }
-        if (valid < bytes.size()) ++dropped;
+        if (valid < size) ++dropped;
         loaded.validBytes = valid;
-        loaded.bytes = bytes.size();
+        loaded.bytes = size;
         loaded.dropped = dropped;
         loaded.headerValid = header;
+        return true;
     }
 
     // The index the writer dedupes against, replaced from the file: what it holds and where it
@@ -667,12 +985,12 @@ private:
     // written until it can be (the next record tries again) and the file is never started over for
     // a read failure.
     bool indexLocked() {
-        std::vector<std::byte> file;
         LoadedJournal index;
         std::error_code error;
-        const bool exists = std::filesystem::exists(path, error);
-        if (exists && !ShaderRecompiler::ReadWholeFile(path, file)) return false;
-        if (exists) parse(file, nullptr, index, false);
+        if (std::filesystem::exists(path, error)) {
+            const JournalFile file(path);
+            if (!file.Open() || !parse(file, index, false)) return false;
+        }
         std::lock_guard lock(mutex);
         indexed = true;
         validBytes = index.validBytes;
@@ -733,43 +1051,119 @@ private:
     // tail of a crashed run (bytes past the last parsed record) was cut.
     void write(const Pending& pending) {
         if (!ensureIndexed()) throw std::runtime_error("the journal could not be read");
-        for (unsigned attempt = 0; attempt < 2; ++attempt) {
+        for (unsigned attempt = 0; attempt < 3; ++attempt) {
             if (append(pending)) return;
         }
         throw std::runtime_error("the journal keeps changing under this run");
     }
 
+    bool evictUnderLock(std::uint64_t reserve) {
+        SpanScan scan;
+        if (!scanSpans(path, device.load(std::memory_order_relaxed), scan) || !scan.headerValid) return false;
+        const auto& spans = scan.spans;
+        std::map<ShaderRecompiler::PipelineIdentity, std::size_t> moduleSpans;
+        for (std::size_t position = 0; position < spans.size(); ++position) {
+            if (spans[position].kind == ModuleRecord) moduleSpans[spans[position].identity] = position;
+        }
+        const auto headerBytes = padded(sizeof(FileHeader));
+        const auto target = maxBytes - maxBytes / 4u;
+        auto budget = target > reserve ? target - reserve : headerBytes;
+        if (budget < headerBytes) budget = headerBytes;
+        std::set<ShaderRecompiler::PipelineIdentity> keptModules;
+        std::set<std::size_t> kept;
+        std::uint64_t used = headerBytes;
+        for (std::size_t position = spans.size(); position-- > 0;) {
+            const auto& span = spans[position];
+            if (span.kind == ModuleRecord) continue;
+            if (!span.decodable) continue;
+            std::uint64_t added = span.bytes;
+            std::vector<std::size_t> modules;
+            bool complete = true;
+            for (const auto& identity : span.needs) {
+                if (keptModules.contains(identity)) continue;
+                const auto found = moduleSpans.find(identity);
+                if (found == moduleSpans.end()) {
+                    complete = false;
+                    break;
+                }
+                modules.push_back(found->second);
+                added += spans[found->second].bytes;
+            }
+            if (!complete) continue;
+            if (used + added > budget) break;
+            used += added;
+            for (const auto module : modules) keptModules.insert(spans[module].identity);
+            kept.insert(position);
+        }
+        for (const auto& identity : keptModules) kept.insert(moduleSpans[identity]);
+        const auto temporary = path.string() + ".evict";
+        if (!copySpans(path, scan, kept, temporary)) {
+            std::error_code error;
+            std::filesystem::remove(temporary, error);
+            return false;
+        }
+        if (!replaceFile(temporary, path)) {
+            std::error_code error;
+            std::filesystem::remove(temporary, error);
+            return false;
+        }
+        std::uint64_t evicted = 0;
+        std::uint64_t evictedBytes = 0;
+        {
+            std::lock_guard lock(mutex);
+            for (std::size_t position = 0; position < spans.size(); ++position) {
+                if (kept.contains(position)) continue;
+                ++evicted;
+                evictedBytes += spans[position].bytes;
+            }
+            writtenModules.clear();
+            writtenRecords.clear();
+            for (const auto& identity : keptModules) writtenModules.insert(identity);
+            for (const auto position : kept) {
+                if (spans[position].kind != ModuleRecord) writtenRecords.insert(spans[position].hash);
+            }
+            validBytes = used;
+            headerValid = true;
+        }
+        counters.evictedRecords.fetch_add(evicted, std::memory_order_relaxed);
+        counters.evictedBytes.fetch_add(evictedBytes, std::memory_order_relaxed);
+        std::fprintf(stderr, "[pipeline-journal] %s reached its size cap; %llu records (%.1f MiB) were dropped and the file was rewritten to %.1f MiB\n", path.string().c_str(), static_cast<unsigned long long>(evicted), static_cast<double>(evictedBytes) / (1024.0 * 1024.0), static_cast<double>(used) / (1024.0 * 1024.0));
+        return true;
+    }
+
+    std::vector<std::byte> EncodeModule(const PendingModule& module) {
+        std::vector<std::byte> payload;
+        Writer writer(payload);
+        writer.U64(module.identity.low);
+        writer.U64(module.identity.high);
+        writer.U32(static_cast<std::uint32_t>(module.stage));
+        ShaderRecompiler::ShaderDiskCache::EncodeResult(*module.result, payload);
+        return payload;
+    }
+
     // One attempt: false when the file was cut or replaced by someone else since it was indexed
-    // (it is indexed again, and the batch is rebuilt against that index).
+    // (it is indexed again, and the batch is rebuilt against that index), or when the file was
+    // rewritten to make room for the record (the batch is rebuilt against that file).
     bool append(const Pending& pending) {
         const auto recordHash = ShaderRecompiler::HashBytes(pending.payload);
-        std::vector<std::byte> batch;
-        std::vector<ShaderRecompiler::PipelineIdentity> newModules;
+        std::vector<ShaderRecompiler::PipelineIdentity> missing;
         {
             std::lock_guard lock(mutex);
             if (writtenRecords.contains(recordHash)) return true;
             for (const auto& module : pending.modules) {
-                if (!writtenModules.contains(module.identity) && std::ranges::find(newModules, module.identity) == newModules.end()) newModules.push_back(module.identity);
+                if (writtenModules.contains(module.identity)) continue;
+                if (std::ranges::find(missing, module.identity) != missing.end()) continue;
+                missing.push_back(module.identity);
             }
         }
-        const auto appendRecord = [&](std::uint32_t kind, std::span<const std::byte> payload) {
-            const RecordHeader header{kind, 0u, payload.size(), ShaderRecompiler::HashBytes(payload)};
-            Writer writer(batch);
-            writer.Raw(header);
-            batch.insert(batch.end(), payload.begin(), payload.end());
-            batch.resize(static_cast<std::size_t>(padded(batch.size())));
-        };
-        for (const auto& identity : newModules) {
+        std::vector<std::vector<std::byte>> missingPayloads;
+        missingPayloads.reserve(missing.size());
+        for (const auto& identity : missing) {
             const auto module = std::ranges::find_if(pending.modules, [&](const PendingModule& candidate) { return candidate.identity == identity; });
-            std::vector<std::byte> payload;
-            Writer writer(payload);
-            writer.U64(identity.low);
-            writer.U64(identity.high);
-            writer.U32(static_cast<std::uint32_t>(module->stage));
-            ShaderRecompiler::ShaderDiskCache::EncodeResult(*module->result, payload);
-            appendRecord(ModuleRecord, payload);
+            missingPayloads.push_back(EncodeModule(*module));
         }
-        appendRecord(pending.kind, pending.payload);
+        std::uint64_t batchSize = recordBytes(pending.payload.size());
+        for (const auto& payload : missingPayloads) batchSize += recordBytes(payload.size());
         std::error_code error;
         std::filesystem::create_directories(path.parent_path(), error);
         FileLock fileLock(lockPath);
@@ -780,6 +1174,7 @@ private:
             return true;
         }
         bool fresh = false;
+        bool overCap = false;
         {
             std::lock_guard lock(mutex);
             fresh = !headerValid;
@@ -793,13 +1188,41 @@ private:
                     else validBytes = tail;
                 }
             }
-            if (!fresh && validBytes + batch.size() > maxBytes) {
+            overCap = !fresh && validBytes + batchSize > maxBytes;
+        }
+        if (overCap) {
+            std::uint64_t needed = batchSize;
+            std::vector<ShaderRecompiler::PipelineIdentity> held;
+            for (const auto& module : pending.modules) {
+                if (std::ranges::find(missing, module.identity) != missing.end()) continue;
+                if (std::ranges::find(held, module.identity) != held.end()) continue;
+                held.push_back(module.identity);
+                needed += recordBytes(EncodeModule(module).size());
+            }
+            if (needed + padded(sizeof(FileHeader)) > maxBytes) {
+                static std::atomic<bool> reported{false};
+                if (!reported.exchange(true)) std::fprintf(stderr, "[pipeline-journal] %s cannot hold a record of %llu bytes under APS5_PIPELINE_JOURNAL_MAX_MIB; it is not recorded\n", path.string().c_str(), static_cast<unsigned long long>(needed));
+                counters.writeFailures.fetch_add(1, std::memory_order_relaxed);
+                return true;
+            }
+            if (!evictUnderLock(needed)) {
                 static std::atomic<bool> reported{false};
                 if (!reported.exchange(true)) std::fprintf(stderr, "[pipeline-journal] %s reached APS5_PIPELINE_JOURNAL_MAX_MIB; later pipelines are not recorded\n", path.string().c_str());
                 counters.writeFailures.fetch_add(1, std::memory_order_relaxed);
                 return true;
             }
+            return false;
         }
+        std::vector<std::byte> batch;
+        const auto appendRecord = [&](std::uint32_t kind, std::span<const std::byte> payload) {
+            const RecordHeader header{kind, 0u, payload.size(), ShaderRecompiler::HashBytes(payload)};
+            Writer writer(batch);
+            writer.Raw(header);
+            batch.insert(batch.end(), payload.begin(), payload.end());
+            batch.resize(static_cast<std::size_t>(padded(batch.size())));
+        };
+        for (const auto& payload : missingPayloads) appendRecord(ModuleRecord, payload);
+        appendRecord(pending.kind, pending.payload);
         if (!fresh) {
             const auto size = std::filesystem::file_size(path, error);
             if (!error && size < validBytes) {
@@ -823,9 +1246,9 @@ private:
         std::lock_guard lock(mutex);
         headerValid = true;
         validBytes = (fresh ? padded(sizeof(FileHeader)) : validBytes) + batch.size();
-        for (const auto& identity : newModules) writtenModules.insert(identity);
+        for (const auto& identity : missing) writtenModules.insert(identity);
         writtenRecords.insert(recordHash);
-        counters.recordedModules.fetch_add(newModules.size(), std::memory_order_relaxed);
+        counters.recordedModules.fetch_add(missing.size(), std::memory_order_relaxed);
         if (pending.kind == GraphicsRecord) counters.recordedGraphics.fetch_add(1, std::memory_order_relaxed);
         else counters.recordedCompute.fetch_add(1, std::memory_order_relaxed);
         counters.writtenBytes.fetch_add(prefix.size() + batch.size(), std::memory_order_relaxed);
@@ -879,6 +1302,7 @@ std::uint64_t validTail(const std::filesystem::path& path, std::uint64_t from, s
 
 struct ReplayCounters {
     std::atomic<std::uint64_t> graphics{0}, compute{0}, present{0}, skipped{0}, rejected{0}, failed{0};
+    std::atomic<std::uint64_t> held{0}, heldPeak{0};
     std::atomic<std::uint32_t> threads{0};
     std::atomic<double> ms{0};
 };
@@ -899,6 +1323,7 @@ public:
     Replay(Context context, PipelineJournalHooks hooks, unsigned threads) : context(std::move(context)), hooks(std::move(hooks)), active(threads) {
         started = std::chrono::steady_clock::now();
         replayCounters().threads.store(threads, std::memory_order_relaxed);
+        replayCounters().heldPeak.store(0, std::memory_order_relaxed);
         workers.reserve(threads);
         for (unsigned index = 0; index < threads; ++index) workers.emplace_back([this] { run(); });
     }
@@ -921,11 +1346,14 @@ public:
 
 private:
     void run() {
+#ifdef _WIN32
+        if (!SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_BELOW_NORMAL)) std::fprintf(stderr, "[pipeline-journal] replay thread priority not lowered (error %lu)\n", GetLastError());
+#endif
         std::call_once(loadOnce, [&] {
             try {
                 auto journal = Journal::Instance().Load();
-                const auto limit = configured("APS5_PIPELINE_JOURNAL_ENTRIES", 1024u);
-                if (journal.entries.size() > limit) journal.entries.resize(static_cast<std::size_t>(limit));
+                const auto limit = configured("APS5_PIPELINE_JOURNAL_ENTRIES", 4096u);
+                if (journal.entries.size() > limit) journal.entries.erase(journal.entries.begin(), journal.entries.end() - static_cast<std::ptrdiff_t>(limit));
                 loaded = std::move(journal);
             } catch (const std::exception& error) {
                 std::fprintf(stderr, "[pipeline-journal] cannot load %s: %s\n", Journal::Instance().Path().string().c_str(), error.what());
@@ -952,6 +1380,27 @@ private:
         }
     }
 
+    std::shared_ptr<const ShaderRecompiler::RecompileResult> readModule(const ShaderRecompiler::PipelineIdentity& identity, const LoadedModule& module) const {
+        auto bytes = std::make_shared<std::vector<std::byte>>(static_cast<std::size_t>(module.payloadBytes));
+        if (loaded.file == nullptr || !loaded.file->Read(module.payloadOffset, *bytes) || ShaderRecompiler::HashBytes(*bytes) != module.payloadHash) return nullptr;
+        auto result = std::make_shared<ShaderRecompiler::RecompileResult>();
+        if (!ShaderRecompiler::ShaderDiskCache::DecodeResult(std::span<const std::byte>(*bytes).subspan(20), *result, bytes) || !(result->Identity() == identity)) return nullptr;
+        return result;
+    }
+
+    struct Held {
+        explicit Held(std::uint64_t bytes) : bytes(bytes) {
+            auto& counters = replayCounters();
+            const auto now = counters.held.fetch_add(bytes, std::memory_order_relaxed) + bytes;
+            auto peak = counters.heldPeak.load(std::memory_order_relaxed);
+            while (peak < now && !counters.heldPeak.compare_exchange_weak(peak, now, std::memory_order_relaxed)) {}
+        }
+        ~Held() { replayCounters().held.fetch_sub(bytes, std::memory_order_relaxed); }
+        Held(const Held&) = delete;
+        Held& operator=(const Held&) = delete;
+        std::uint64_t bytes;
+    };
+
     void replay(const LoadedEntry& entry) {
         struct Replaying {
             Replaying() { replayingHere = true; }
@@ -964,27 +1413,47 @@ private:
                 counters.rejected.fetch_add(1, std::memory_order_relaxed);
                 return;
             }
-            (hooks.compute(*module->second.result, entry.pushConstants) ? counters.compute : counters.present).fetch_add(1, std::memory_order_relaxed);
+            const Held held(module->second.payloadBytes);
+            const auto result = readModule(module->first, module->second);
+            if (result == nullptr) {
+                counters.rejected.fetch_add(1, std::memory_order_relaxed);
+                return;
+            }
+            (hooks.compute(*result, entry.pushConstants) ? counters.compute : counters.present).fetch_add(1, std::memory_order_relaxed);
             return;
         }
-        std::vector<CompiledShader> shaders;
+        std::vector<const std::pair<const ShaderRecompiler::PipelineIdentity, LoadedModule>*> modules;
+        std::uint64_t bytes = 0;
         for (const auto& stage : entry.graphics.stages) {
             const auto module = loaded.modules.find(stage.identity);
             if (module == loaded.modules.end() || module->second.stage != stage.stage) {
                 counters.rejected.fetch_add(1, std::memory_order_relaxed);
                 return;
             }
-            shaders.push_back({stage.stage, module->second.result.get(), stage.pushConstantOffset});
+            modules.push_back(&*module);
+            bytes += module->second.payloadBytes;
         }
-        if (shaders.empty() || context.descriptorCache == nullptr) {
+        if (modules.empty() || context.descriptorCache == nullptr) {
             counters.rejected.fetch_add(1, std::memory_order_relaxed);
             return;
         }
         const auto store = PipelineStoreTotals();
-        if (store.cached >= store.bound) {
+        if (store.cached >= store.bound && !PipelineStoreCanGrow()) {
             counters.skipped.fetch_add(1, std::memory_order_relaxed);
             return;
         }
+        const Held held(bytes);
+        std::vector<std::shared_ptr<const ShaderRecompiler::RecompileResult>> results;
+        std::vector<CompiledShader> shaders;
+        for (std::size_t index = 0; index < modules.size(); ++index) {
+            auto result = readModule(modules[index]->first, modules[index]->second);
+            if (result == nullptr) {
+                counters.rejected.fetch_add(1, std::memory_order_relaxed);
+                return;
+            }
+            shaders.push_back({entry.graphics.stages[index].stage, result.get(), entry.graphics.stages[index].pushConstantOffset});
+            results.push_back(std::move(result));
+        }
         const auto layouts = DescribeSetLayouts(context, shaders);
         if (!std::ranges::equal(layouts.mainKey, entry.graphics.mainLayoutKey) || !std::ranges::equal(layouts.fragmentKey, entry.graphics.fragmentLayoutKey) || layouts.layouts.split != entry.graphics.splitSets) {
             counters.rejected.fetch_add(1, std::memory_order_relaxed);
@@ -1038,6 +1507,7 @@ State CanonicalPipelineState(const State& state) {
         canonicalColor.format = color.format;
         canonicalColor.exportIndex = color.exportIndex;
         canonicalColor.componentMapping = color.componentMapping;
+        canonicalColor.partialWriteMask = color.partialWriteMask;
         canonical.colors.push_back(canonicalColor);
     }
     canonical.blends = state.blends;
@@ -1046,6 +1516,7 @@ State CanonicalPipelineState(const State& state) {
     canonical.rectList = state.rectList;
     canonical.dualSourceBlend = state.dualSourceBlend;
     canonical.reversedBlend = state.reversedBlend;
+    canonical.colorRop = state.colorRop;
     canonical.topology = state.topology;
     canonical.primitiveRestart = state.primitiveRestart;
     canonical.negativeOneToOne = state.negativeOneToOne;
@@ -1130,6 +1601,7 @@ PipelineJournalCounters PipelineJournalTotals() {
     totals.replayFailed = replay.failed.load(std::memory_order_relaxed);
     totals.replayMs = replay.ms.load(std::memory_order_relaxed);
     totals.replayThreads = replay.threads.load(std::memory_order_relaxed);
+    totals.replayHeldPeakBytes = replay.heldPeak.load(std::memory_order_relaxed);
     return totals;
 }
 
@@ -1149,10 +1621,10 @@ void FlushPipelineJournal() {
 void ReportPipelineJournal() {
     if (!profiling() || !Journal::Instance().Enabled()) return;
     const auto totals = PipelineJournalTotals();
-    AgcDriver::ProfilePrint_nid_no_patch("[pipeline-journal] loaded %llu pipelines, %llu modules (%.1f MiB, %.0f ms); replay on %u threads: %llu graphics and %llu compute built, %llu present, %llu skipped (store full), %llu rejected, %llu failed in %.0f ms; recorded this run: %llu graphics, %llu compute, %llu modules (%.1f MiB), %llu write failures\n",
+    AgcDriver::ProfilePrint_nid_no_patch("[pipeline-journal] loaded %llu pipelines, %llu modules (%.1f MiB, %.0f ms); replay on %u threads: %llu graphics and %llu compute built, %llu present, %llu skipped (store full), %llu rejected, %llu failed in %.0f ms, holding at most %.1f MiB of modules; recorded this run: %llu graphics, %llu compute, %llu modules (%.1f MiB), %llu write failures, %llu records evicted (%.1f MiB)\n",
                                          static_cast<unsigned long long>(totals.loadedRecipes), static_cast<unsigned long long>(totals.loadedModules), static_cast<double>(totals.loadedBytes) / (1024.0 * 1024.0), totals.loadMs, totals.replayThreads,
-                                         static_cast<unsigned long long>(totals.replayedGraphics), static_cast<unsigned long long>(totals.replayedCompute), static_cast<unsigned long long>(totals.replayPresent), static_cast<unsigned long long>(totals.replaySkipped), static_cast<unsigned long long>(totals.replayRejected), static_cast<unsigned long long>(totals.replayFailed), totals.replayMs,
-                                         static_cast<unsigned long long>(totals.recordedGraphics), static_cast<unsigned long long>(totals.recordedCompute), static_cast<unsigned long long>(totals.recordedModules), static_cast<double>(totals.writtenBytes) / (1024.0 * 1024.0), static_cast<unsigned long long>(totals.writeFailures));
+                                         static_cast<unsigned long long>(totals.replayedGraphics), static_cast<unsigned long long>(totals.replayedCompute), static_cast<unsigned long long>(totals.replayPresent), static_cast<unsigned long long>(totals.replaySkipped), static_cast<unsigned long long>(totals.replayRejected), static_cast<unsigned long long>(totals.replayFailed), totals.replayMs, static_cast<double>(totals.replayHeldPeakBytes) / (1024.0 * 1024.0),
+                                         static_cast<unsigned long long>(totals.recordedGraphics), static_cast<unsigned long long>(totals.recordedCompute), static_cast<unsigned long long>(totals.recordedModules), static_cast<double>(totals.writtenBytes) / (1024.0 * 1024.0), static_cast<unsigned long long>(totals.writeFailures), static_cast<unsigned long long>(totals.evictedRecords), static_cast<double>(totals.evictedBytes) / (1024.0 * 1024.0));
 }
 
 std::uint64_t PipelineJournalDeviceFingerprint(const VkPhysicalDeviceProperties& properties) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
index 77119254d5..0ccd993ac2 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
@@ -185,7 +185,8 @@ VkPipeline LinkPipelineFromLibraries(const Context& context, const VkGraphicsPip
     std::vector<VkPipeline> libraries;
     for (std::size_t part = 0; part < flags.size(); ++part) {
         if (part == 0 && mesh) continue;
-        const auto key = Combined(*partKeys[part], *contextKeys[part]);
+        auto key = Combined(*partKeys[part], *contextKeys[part]);
+        key.push_back(static_cast<std::byte>(optimize));
         auto& cache = device.parts[part];
         if (const auto found = cache.find(key); found != cache.end()) {
             libraries.push_back(found->second);
@@ -195,7 +196,7 @@ VkPipeline LinkPipelineFromLibraries(const Context& context, const VkGraphicsPip
         VkGraphicsPipelineLibraryCreateInfoEXT library{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_LIBRARY_CREATE_INFO_EXT, flags[part] == VK_GRAPHICS_PIPELINE_LIBRARY_FRAGMENT_OUTPUT_INTERFACE_BIT_EXT ? &rendering : &shaderRendering};
         library.flags = flags[part];
         VkGraphicsPipelineCreateInfo create{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO, &library};
-        create.flags = VK_PIPELINE_CREATE_LIBRARY_BIT_KHR | VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT;
+        create.flags = optimize ? VK_PIPELINE_CREATE_LIBRARY_BIT_KHR | VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT : VK_PIPELINE_CREATE_LIBRARY_BIT_KHR;
         create.pDynamicState = info.pDynamicState;
         create.layout = partLayouts[part];
         switch (flags[part]) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
index 4056c6f07a..3abc0aec26 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
@@ -8,6 +8,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ParallelCompare.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
 #include "prx/libSceAgcDriver/Graphics/shaders/MeshArguments_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/SampleCounter_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/SampleDumps_spv.h"
@@ -32,6 +33,7 @@
 #include <map>
 #include <mutex>
 #include <string>
+#include <string_view>
 #include <thread>
 #include <tuple>
 #include <unordered_map>
@@ -516,6 +518,7 @@ std::atomic<std::int64_t> pendingLabelSince{NoPendingLabel};
 std::atomic<std::uint64_t> writeGeneration{0};
 std::atomic<std::uint64_t> publishGeneration{0};
 std::atomic<std::uint64_t> completionLabels{0};
+std::atomic<std::uint64_t> completionStores{0};
 std::atomic<std::uint64_t> writeBackCompletions{0};
 std::atomic<std::uint64_t> completionStoresSkipped{0};
 std::atomic<std::uint64_t> completionStoresRun{0};
@@ -1191,6 +1194,7 @@ Recorder::~Recorder() {
         publishGeneration.fetch_add(1, std::memory_order_release);
         pendingLabelSince.store(NoPendingLabel, std::memory_order_release);
         completionLabels.store(0, std::memory_order_release);
+        completionStores.store(0, std::memory_order_release);
         writeBackCompletions.store(0, std::memory_order_release);
         workSinceSubmit.store(0, std::memory_order_release);
     }
@@ -1266,6 +1270,10 @@ std::uint64_t Recorder::PendingCompletionLabels() {
     return completionLabels.load(std::memory_order_acquire);
 }
 
+std::uint64_t Recorder::PendingCompletionStores() {
+    return completionStores.load(std::memory_order_acquire);
+}
+
 std::uint64_t Recorder::PendingWriteBackCompletions() {
     return writeBackCompletions.load(std::memory_order_acquire);
 }
@@ -2128,6 +2136,22 @@ void Recorder::NoteSampledDraw(VkCommandBuffer commands) {
     if (open->sampleActive) open->samplesDrawn = true;
 }
 
+void Recorder::NoteDrawTraceToken(std::uint64_t token) noexcept {
+    if (token == 0 || open == nullptr) return;
+    try {
+        auto inserted = open->drawTraceTokenSet.insert(token);
+        if (!inserted.second) return;
+        try {
+            open->drawTraceTokens.push_back(token);
+        } catch (...) {
+            open->drawTraceTokenSet.erase(inserted.first);
+            throw;
+        }
+    } catch (...) {
+        AgcDriver::CaptureTrace::Log("draw-token-note-failed token=%llu", static_cast<unsigned long long>(token));
+    }
+}
+
 bool Recorder::gpuSampleCounter() {
     if (sampleCounterState != 0) return sampleCounterState > 0;
     sampleCounterState = -1;
@@ -2281,6 +2305,20 @@ void Recorder::EndPassSamples() {
     if (open != nullptr && open->segmentActive) endSegment(*open);
 }
 
+void Recorder::RecordUncounted(const std::function<void(VkCommandBuffer)>& record) {
+    const auto commands = Commands();
+    if (open->segmentActive) endSegment(*open);
+    const bool counted = open->sampleActive;
+    if (counted) {
+        open->endedSamples.reserve(open->endedSamples.size() + 1);
+        endSamples(*open);
+        open->endedSamples.push_back(open->samples);
+        open->samples = VK_NULL_HANDLE;
+    }
+    record(commands);
+    if (counted) beginSamples(*open);
+}
+
 void Recorder::takeSegmentPool(Batch& batch) {
     auto cache = std::static_pointer_cast<SamplePoolCache>(segmentPools);
     if (cache == nullptr) {
@@ -2571,9 +2609,15 @@ void Recorder::beginSamples(Batch& batch) {
 void Recorder::readSamples(Batch& batch) {
     if (sampleCounterState > 0) return;
     if (batch.samples == VK_NULL_HANDLE || !batch.submitted) return;
+    std::uint64_t total = 0;
+    for (const auto pool : batch.endedSamples) {
+        std::uint64_t samples = 0;
+        Check(context.Function<PFN_vkGetQueryPoolResults>("vkGetQueryPoolResults")(context.device, pool, 0, 1, sizeof(samples), &samples, sizeof(samples), VK_QUERY_RESULT_64_BIT | VK_QUERY_RESULT_WAIT_BIT), "vkGetQueryPoolResults occlusion");
+        total += samples;
+    }
     std::uint64_t samples = 0;
     Check(context.Function<PFN_vkGetQueryPoolResults>("vkGetQueryPoolResults")(context.device, batch.samples, 0, 1, sizeof(samples), &samples, sizeof(samples), VK_QUERY_RESULT_64_BIT | VK_QUERY_RESULT_WAIT_BIT), "vkGetQueryPoolResults occlusion");
-    samplesPassed.fetch_add(samples, std::memory_order_acq_rel);
+    samplesPassed.fetch_add(total + samples, std::memory_order_acq_rel);
 }
 
 void Recorder::readGpuTiming(Batch& batch) {
@@ -2768,9 +2812,13 @@ void Recorder::NoteUnwrittenDrawSnapshot(std::uint64_t address, std::size_t byte
     unwrittenBytes += bytes;
 }
 
-std::shared_ptr<Buffer> Recorder::ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use, std::uint32_t* derived, std::uint64_t generation) {
+std::shared_ptr<Buffer> Recorder::ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use, std::uint32_t* derived, std::uint64_t generation, VkDeviceSize* offset) {
     auto found = use == SnapshotUse::Vertex ? drawSnapshots.lower_bound({address, use, bytes}) : drawSnapshots.find({address, use, bytes});
-    if (found == drawSnapshots.end() || std::get<0>(found->first) != address || std::get<1>(found->first) != use) return {};
+    if (found == drawSnapshots.end() || std::get<0>(found->first) != address || std::get<1>(found->first) != use) {
+        if (use != SnapshotUse::Storage || offset == nullptr) return {};
+        return containingDrawSnapshot(address, bytes, offset);
+    }
+    if (offset != nullptr) *offset = 0;
     const bool sameRegistry = found->second.registryGeneration == GuestAllocations::GuestAllocationsGeneration_nid_postfix();
     if (!sameRegistry || !GuestMemory::UnchangedSince(address, bytes, found->second.generation)) {
         if (!sameRegistry || generation == 0 || use != SnapshotUse::Storage || !refreshDrawSnapshot(found->second, address, bytes)) {
@@ -2785,6 +2833,23 @@ std::shared_ptr<Buffer> Recorder::ReusableDrawSnapshot(std::uint64_t address, st
     return found->second.buffer;
 }
 
+std::shared_ptr<Buffer> Recorder::containingDrawSnapshot(std::uint64_t address, std::size_t bytes, VkDeviceSize* offset) {
+    const VkDeviceSize alignment = std::max<VkDeviceSize>(context.limits.minStorageBufferOffsetAlignment, 4);
+    const auto registry = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    auto entry = drawSnapshots.upper_bound({address, SnapshotUse::Storage, std::numeric_limits<std::size_t>::max()});
+    for (std::size_t probe = 0; probe < ContainingSnapshotProbes && entry != drawSnapshots.begin(); ++probe) {
+        --entry;
+        const auto& [start, use, held] = entry->first;
+        if (use != SnapshotUse::Storage || start + held < address + bytes || (address - start) % alignment != 0) continue;
+        if (entry->second.registryGeneration != registry || !GuestMemory::UnchangedSince(address, bytes, entry->second.generation)) continue;
+        auto& recency = drawSnapshotPools[SnapshotPool(use)].recency;
+        recency.splice(recency.end(), recency, entry->second.recent);
+        *offset = address - start;
+        return entry->second.buffer;
+    }
+    return {};
+}
+
 bool Recorder::refreshDrawSnapshot(DrawSnapshot& entry, std::uint64_t address, std::size_t bytes) {
     const auto held = entry.buffer->Bytes();
     if (held.size() != bytes || bytes == 0) return false;
@@ -3070,6 +3135,26 @@ std::uint64_t Recorder::PendingWriterSerial(std::uint64_t address, std::size_t b
     return 0;
 }
 
+std::uint64_t Recorder::PendingWriterSerial(std::uint64_t address, std::size_t bytes, std::span<const std::uint64_t> exceptNotes) const {
+    if (exceptNotes.empty()) return PendingWriterSerial(address, bytes);
+    if (bytes == 0) return 0;
+    const auto end = address + bytes;
+    const auto writes = [&](const Batch& batch) {
+        for (std::size_t index = 0; index < batch.writes.size(); ++index) {
+            const auto& [begin, finish] = batch.writes[index];
+            if (address >= finish || begin >= end) continue;
+            if (index < batch.writeNotes.size() && std::find(exceptNotes.begin(), exceptNotes.end(), batch.writeNotes[index]) != exceptNotes.end()) continue;
+            return true;
+        }
+        return readOverlap(batch, address, end, ReadKind::AddressBased).has_value();
+    };
+    if (open != nullptr && writes(*open)) return OpenSerial();
+    for (auto it = inFlight.rbegin(); it != inFlight.rend(); ++it) {
+        if (writes(**it)) return (*it)->serial;
+    }
+    return 0;
+}
+
 bool Recorder::signaled(const Batch& batch) const {
     return batch.submitted && fenceStatus(batch.fence) == VK_SUCCESS;
 }
@@ -3450,6 +3535,8 @@ void Recorder::AfterCompletions(std::uint64_t address, std::span<const std::byte
     } else {
         ++batch.completionLabelCount;
         completionLabels.fetch_add(1, std::memory_order_acq_rel);
+        ++batch.completionStoreCount;
+        completionStores.fetch_add(1, std::memory_order_acq_rel);
         GuestMemory::BreakProofs();
     }
     // The table entry before the write note: the note bumps the generation a poller watches, and a
@@ -3497,6 +3584,8 @@ void Recorder::NoteWrittenBack(std::uint64_t address, std::size_t bytes) {
             completionLabels.fetch_add(1, std::memory_order_acq_rel);
         GuestMemory::BreakProofs();
             completionLabelsCountedLate.fetch_add(1, std::memory_order_relaxed);
+            ++batch.completionStoreCount;
+            completionStores.fetch_add(1, std::memory_order_acq_rel);
             recorder->markBehindCompletion(batch, label.begin, label.end);
         }
     };
@@ -3566,7 +3655,13 @@ void Recorder::Submit() {
     submission.pCommandBuffers = &batch->commands;
     // The timeline reaches this batch's serial when it completes (see WaitSerial).
     const std::uint64_t serial = submissions + 1;
-    CaptureTrace::Log("submit batch=%llu reads=%zu writes=%zu", static_cast<unsigned long long>(serial), batch->reads.size(), batch->writes.size());
+    std::string tokensStr = "[";
+    for (std::size_t i = 0; i < batch->drawTraceTokens.size(); ++i) {
+        if (i > 0) tokensStr += ",";
+        tokensStr += std::to_string(batch->drawTraceTokens[i]);
+    }
+    tokensStr += "]";
+    CaptureTrace::Log("submit batch=%llu tokens=%s", static_cast<unsigned long long>(serial), tokensStr.c_str());
     VkTimelineSemaphoreSubmitInfoKHR timelineInfo{VK_STRUCTURE_TYPE_TIMELINE_SEMAPHORE_SUBMIT_INFO_KHR};
     const VkSemaphore hold = std::exchange(submitHold, VK_NULL_HANDLE);
     const std::uint64_t holdValue = submitHoldValue;
@@ -3585,6 +3680,7 @@ void Recorder::Submit() {
         submission.pSignalSemaphores = &timeline;
     }
     if (hold != VK_NULL_HANDLE || timeline != VK_NULL_HANDLE) submission.pNext = &timelineInfo;
+    DestroyDeferredAtIdle(context);
     const auto submitStart = std::chrono::steady_clock::now();
     const auto result = function(queueSubmit, "vkQueueSubmit")(context.queue, 1, &submission, batch->fence);
     if (result == VK_ERROR_DEVICE_LOST) {
@@ -3595,6 +3691,7 @@ void Recorder::Submit() {
     batch->submitted = true;
     batch->serial = ++submissions;
     batch->submittedAt = std::chrono::steady_clock::now();
+    CaptureTrace::Log("submit-confirmed batch=%llu tokens=%s", static_cast<unsigned long long>(batch->serial), tokensStr.c_str());
     if (DrawProfiled()) {
         const auto us = std::chrono::duration<double, std::micro>(batch->submittedAt - submitStart).count();
         ++submitCount;
@@ -3624,6 +3721,10 @@ std::uint64_t Recorder::SubmitAndEpoch() {
     return inFlight.empty() ? 0 : submissions;
 }
 
+std::uint64_t Recorder::OpenBatchSerial() {
+    return open != nullptr ? submissions + 1 : 0;
+}
+
 namespace {
 
 // One thread's registration as a timeline waiter (see `unlockedWaiters`): constructed while the
@@ -3677,6 +3778,20 @@ void Recorder::WaitSerial(std::uint64_t serial) {
     Check(result, "vkWaitSemaphoresKHR recorder");
 }
 
+bool Recorder::WaitSerialFor(std::uint64_t serial, std::uint64_t timeoutNanos) {
+    PerformanceTimer frameTiming("Recorder.WaitSerialFor");
+    if (timeline == VK_NULL_HANDLE || serial == 0) return false;
+    const UnlockedWaiter waiter{id};
+    VkSemaphoreWaitInfoKHR wait{VK_STRUCTURE_TYPE_SEMAPHORE_WAIT_INFO_KHR};
+    wait.semaphoreCount = 1;
+    wait.pSemaphores = &timeline;
+    wait.pValues = &serial;
+    const auto result = context.Function<PFN_vkWaitSemaphoresKHR>("vkWaitSemaphoresKHR")(context.device, &wait, timeoutNanos);
+    if (result == VK_TIMEOUT) return false;
+    Check(result, "vkWaitSemaphoresKHR submission progress");
+    return true;
+}
+
 void Recorder::FinishUpTo(std::uint64_t serial) {
     // A drain: the wait already happened (unlocked), the fences are signaled, so the source-0 wait
     // recorded here is the bookkeeping only (a caller that did not wait first, WaitForLeases, shows
@@ -4001,6 +4116,7 @@ void Recorder::finish(std::unique_ptr<Batch> batch, bool wait, int source, bool
             list.erase(std::remove(list.begin(), list.end(), batch), list.end());
             // The batch's completion labels have landed, or never will (fence failure below).
             if (batch->completionLabelCount != 0) completionLabels.fetch_sub(batch->completionLabelCount, std::memory_order_acq_rel);
+            if (batch->completionStoreCount != 0) completionStores.fetch_sub(batch->completionStoreCount, std::memory_order_acq_rel);
             if (batch->writeBackCompletionCount != 0) writeBackCompletions.fetch_sub(batch->writeBackCompletionCount, std::memory_order_acq_rel);
             // This also runs while the fence-failure throw unwinds: an allocation failure in the
             // rebuild keeps the previous snapshot, which is a superset (a stale entry only causes a
@@ -4145,6 +4261,7 @@ void Recorder::finish(std::unique_ptr<Batch> batch, bool wait, int source, bool
 void Recorder::discard(std::unique_ptr<Batch> batch) noexcept {
     removeLabels(*batch);
     if (batch->completionLabelCount != 0) completionLabels.fetch_sub(batch->completionLabelCount, std::memory_order_acq_rel);
+    if (batch->completionStoreCount != 0) completionStores.fetch_sub(batch->completionStoreCount, std::memory_order_acq_rel);
     if (batch->writeBackCompletionCount != 0) writeBackCompletions.fetch_sub(batch->writeBackCompletionCount, std::memory_order_acq_rel);
     if (activeRecorder == this) pendingLabelSince.store(NoPendingLabel, std::memory_order_release);
     release(*batch);
@@ -4183,6 +4300,8 @@ void Recorder::release(Batch& batch) noexcept {
     if (batch.samples != VK_NULL_HANDLE && batch.samplePool == nullptr) context.Function<PFN_vkDestroyQueryPool>("vkDestroyQueryPool")(context.device, batch.samples, nullptr);
     batch.samples = VK_NULL_HANDLE;
     batch.samplePool.reset();
+    for (const auto pool : batch.endedSamples) context.Function<PFN_vkDestroyQueryPool>("vkDestroyQueryPool")(context.device, pool, nullptr);
+    batch.endedSamples.clear();
     batch.segments = VK_NULL_HANDLE;
     batch.segmentPool.reset();
     // A completed (or never submitted) batch's objects are kept for reuse: the fence is signaled or
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp
index 4f30207def..ea37fed7ef 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
@@ -381,6 +382,7 @@ void CommandBatch::Submit() {
     submission.commandBufferCount = 1;
     submission.pCommandBuffers = &commands;
     timing.Mark("command_end");
+    DestroyDeferredAtIdle(context);
     Check(context.Function<PFN_vkQueueSubmit>("vkQueueSubmit")(context.queue, 1, &submission, fence), "vkQueueSubmit graphics");
     pending = true;
     submitted = true;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp
index dfcef91efc..647b38274c 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp
@@ -185,6 +185,7 @@ public:
         auto copy = copyFor(target.format, target.samples, target.extent, stencil);
         kept.push_back(copy);
         const VkImageAspectFlags aspects = VK_IMAGE_ASPECT_DEPTH_BIT | (stencil ? VK_IMAGE_ASPECT_STENCIL_BIT : 0u);
+        const VkImageAspectFlags layoutAspects = VK_IMAGE_ASPECT_DEPTH_BIT | (HasStencil(target.format) ? VK_IMAGE_ASPECT_STENCIL_BIT : 0u);
         if (!copy->general) {
             VkImageMemoryBarrier toGeneral{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
             toGeneral.dstAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
@@ -193,7 +194,7 @@ public:
             toGeneral.srcQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
             toGeneral.dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
             toGeneral.image = copy->image;
-            toGeneral.subresourceRange = {aspects, 0, 1, 0, 1};
+            toGeneral.subresourceRange = {layoutAspects, 0, 1, 0, 1};
             context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 0, nullptr, 0, nullptr, 1, &toGeneral);
             copy->general = true;
         }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp
index 10d27703c7..5bfb9d604e 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp
@@ -138,7 +138,7 @@ void ShaderResources::prepareAddressBindings(std::span<const CompiledShader> sha
         if (tables != 0 && storesThroughAddressesCached(shader.program->spirv)) bdaReadOnly = false;
         usesFaultBuffer = usesFaultBuffer || faults != 0;
         const bool tableFaultsOnly = std::any_of(shader.program->bindings.begin(), shader.program->bindings.end(), [](const ShaderRecompiler::DescriptorBinding& binding) { return binding.role == ShaderRecompiler::DescriptorRole::ImageTableMap; });
-        faultChecks = faultChecks || tables != 0 || (faults != 0 && (!tableFaultsOnly || shader.program->imageTableFaults != 0 || shader.program->poisonedSrtReads != 0 || loopGuarded));
+        faultChecks = faultChecks || tables != 0 || (faults != 0 && (!tableFaultsOnly || shader.program->imageTableFaults != 0 || shader.program->poisonedSrtReads != 0 || shader.program->windowLaneGuards != 0 || loopGuarded));
     }
     if (usesBda) {
         Require(context.bufferDeviceAddress, "buffer device address is not enabled");
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
index 863d6cd9cf..1c06f2639a 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
@@ -9,6 +9,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PlaceholderImages.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
@@ -16,12 +17,12 @@
 #include <atomic>
 #include <memory>
 #include <mutex>
-#include <thread>
 #include <array>
 #include <chrono>
 #include <cstdio>
 #include <cstdlib>
 #include <exception>
+#include <functional>
 #include <stdexcept>
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
@@ -65,7 +66,7 @@ VkComponentSwizzle ComponentSwizzleFor(std::uint8_t dstSel) {
 }
 
 VkComponentMapping ViewComponents(const GuestTextureResource& resource) {
-    if (IsConvertedTextureFormat(resource.format) && !IsRepackedTextureFormat(resource.format)) return {VK_COMPONENT_SWIZZLE_R, VK_COMPONENT_SWIZZLE_G, VK_COMPONENT_SWIZZLE_B, VK_COMPONENT_SWIZZLE_A};
+    if (IsConvertedTextureFormat(resource.format) && !IsRepackedTextureFormat(resource.format) && resource.format != static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format11_11_10Float)) return {VK_COMPONENT_SWIZZLE_R, VK_COMPONENT_SWIZZLE_G, VK_COMPONENT_SWIZZLE_B, VK_COMPONENT_SWIZZLE_A};
     const auto channel = [&](std::uint8_t dstSel) { return TextureComponentChannel(resource.format, ComponentSwizzleFor(dstSel)); };
     return {channel(resource.dstSelX), channel(resource.dstSelY), channel(resource.dstSelZ), channel(resource.dstSelW)};
 }
@@ -133,6 +134,8 @@ struct TextureCache {
     std::list<CachedTexture> entries;
     std::unordered_map<TextureKey, std::list<CachedTexture>::iterator, TextureKeyHash> index;
     std::unordered_multimap<const StorageTexture*, std::list<CachedTexture>::iterator> views;
+    std::vector<std::pair<std::vector<std::byte>, std::uint64_t>> spare;
+    std::uint64_t spareBytes = 0;
     std::uint64_t bytes = 0;
     std::size_t passed = 0;
     std::chrono::steady_clock::time_point passedSince{};
@@ -162,6 +165,8 @@ TextureCache& Textures() {
 
 thread_local unsigned sampledCacheHeld = 0;
 thread_local unsigned storageCacheHeld = 0;
+thread_local unsigned sampledCacheReclaimable = 0;
+thread_local unsigned storageCacheReclaimable = 0;
 
 struct CacheHold {
     unsigned& depth;
@@ -171,15 +176,6 @@ struct CacheHold {
     CacheHold& operator=(const CacheHold&) = delete;
 };
 
-bool AcquireCache(AgcDriver::Mutex& mutex) {
-    const auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(20);
-    do {
-        if (mutex.try_lock()) return true;
-        std::this_thread::yield();
-    } while (std::chrono::steady_clock::now() < deadline);
-    return false;
-}
-
 struct UncachedImages {
     AgcDriver::Mutex mutex;
     std::vector<std::weak_ptr<StorageTexture>> images;
@@ -267,6 +263,39 @@ void touchTexture(TextureCache& cache, std::list<CachedTexture>::iterator it) {
     it->present = Recorder::Presents();
 }
 
+constexpr std::uint64_t SpareSnapshotBytes = 256ull << 20;
+
+void parkSnapshot(TextureCache& cache, std::vector<std::byte>& bytes) {
+    const auto size = bytes.size();
+    if (size == 0) return;
+    const auto present = Recorder::Presents();
+    while (!cache.spare.empty() && (present - cache.spare.front().second > SpareSnapshotPresents || cache.spareBytes + size > SpareSnapshotBytes)) {
+        cache.spareBytes -= cache.spare.front().first.size();
+        cache.spare.erase(cache.spare.begin());
+    }
+    if (cache.spareBytes + size <= SpareSnapshotBytes) {
+        cache.spareBytes += size;
+        cache.spare.emplace_back(std::move(bytes), present);
+    }
+    bytes = std::vector<std::byte>{};
+}
+
+std::vector<std::byte> spareSnapshot(TextureCache& cache, std::size_t bytes) {
+    const auto present = Recorder::Presents();
+    while (!cache.spare.empty() && present - cache.spare.front().second > SpareSnapshotPresents) {
+        cache.spareBytes -= cache.spare.front().first.size();
+        cache.spare.erase(cache.spare.begin());
+    }
+    for (auto spare = cache.spare.begin(); spare != cache.spare.end(); ++spare) {
+        if (spare->first.size() != bytes) continue;
+        cache.spareBytes -= bytes;
+        std::vector<std::byte> taken = std::move(spare->first);
+        cache.spare.erase(spare);
+        return taken;
+    }
+    return {};
+}
+
 bool admitTexture(TextureCache& cache, const TextureKey& key, std::uint64_t incoming, std::uint64_t budget) {
     if (cache.bytes + incoming <= budget) return true;
     if (const auto now = std::chrono::steady_clock::now(); now - cache.passedSince >= std::chrono::seconds(1)) {
@@ -396,6 +425,8 @@ TextureCounters& TextureCounts() {
     return counters;
 }
 
+thread_local std::uint64_t sampledLookupKeyScans = 0;
+
 void reportTextureCounters() {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     if (!profile) return;
@@ -572,7 +603,7 @@ std::uint64_t forcedCacheBudget() {
     return forced;
 }
 
-std::uint64_t storageBudget(const Context& context) {
+std::uint64_t storageBudget(const Context& context, std::uint64_t required = 0) {
     const auto forced = forcedCacheBudget();
     if (forced != 0) return forced;
     if (context.memoryProperties2 == nullptr || context.physical == VK_NULL_HANDLE) return TextureCacheBudget(context.memory);
@@ -581,17 +612,23 @@ std::uint64_t storageBudget(const Context& context) {
         VkPhysicalDevice device{VK_NULL_HANDLE};
         std::chrono::steady_clock::time_point read{};
         std::uint64_t budget{0};
+        std::uint64_t ceiling{0};
     } cached;
     const auto now = std::chrono::steady_clock::now();
     std::lock_guard lock(cached.mutex);
-    if (cached.device == context.physical && now - cached.read < std::chrono::seconds(1)) return cached.budget;
-    VkPhysicalDeviceMemoryBudgetPropertiesEXT reported{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
-    VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2};
-    properties.pNext = &reported;
-    context.memoryProperties2(context.physical, &properties);
-    cached.device = context.physical;
-    cached.read = now;
-    cached.budget = StorageTextureBudget(context.memory, &reported, SampledTextureMemory(), storageCacheBytes());
+    const auto read = [&] {
+        VkPhysicalDeviceMemoryBudgetPropertiesEXT reported{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
+        VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2};
+        properties.pNext = &reported;
+        context.memoryProperties2(context.physical, &properties);
+        cached.device = context.physical;
+        cached.read = now;
+        cached.budget = StorageTextureBudget(context.memory, &reported, SampledTextureMemory(), storageCacheBytes());
+        cached.ceiling = StorageTextureCeiling(context.memory, &reported);
+    };
+    if (cached.device != context.physical || now - cached.read >= std::chrono::seconds(1)) read();
+    const auto needed = std::min(required, cached.ceiling);
+    if (needed > cached.budget && context.bufferPool != nullptr && context.bufferPool->ReclaimIdleDevice(needed - cached.budget, now) != 0) read();
     return cached.budget;
 }
 
@@ -606,7 +643,7 @@ std::uint64_t sampledBudget(const Context& context, TextureCache& cache) {
     context.memoryProperties2(context.physical, &properties);
     const auto sampled = SampledTextureMemory();
     const auto storage = storageCacheBytes();
-    const auto budget = SampledTextureBudget(context.memory, &reported, sampled + storage);
+    const auto budget = SampledTextureBudget(context.memory, &reported, sampled + storage, storage);
     const bool fresh = cache.budgetDevice != context.physical;
     const auto storageLimit = storageBudget(context);
     if (const auto heap = largestDeviceLocalHeap(context.memory); heap && (fresh || SampledBudgetReportDue(cache.reportedBudget, budget, now - cache.reportedAt) || SampledBudgetReportDue(cache.reportedStorage, storageLimit, now - cache.reportedAt))) {
@@ -712,7 +749,14 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
         normalized.format = unorm16;
         return cachedTexture(context, words, normalized, components, guestBytes, depthCompare);
     }
-    if (const auto window = ViewedArrayWindow(resource); window.baseAddress != resource.baseAddress) {
+    const auto viewedWindow = [&] {
+        const auto window = ViewedArrayWindow(resource, false);
+        if (window.baseAddress != resource.baseAddress || resource.dccAddress == 0) return window;
+        if (ViewedArrayWindow(resource, true).baseAddress == resource.baseAddress) return window;
+        if (TextureClearKeys(resource, guestBytes != 0 ? guestBytes : DescribeSurface(resource).guestBytes) != DccKeys::Uncompressed) return window;
+        return ViewedArrayWindow(resource, true);
+    };
+    if (const auto window = viewedWindow(); window.baseAddress != resource.baseAddress) {
         static std::atomic<std::uint64_t> windows{0};
         const auto count = windows.fetch_add(1) + 1;
         if (count <= 5 || (count & (count - 1)) == 0) std::fprintf(stderr, "[gpu] sampled array view 0x%llx (%ux%u format %u, dimension %d, slices %u..%u) served from its viewed slices at 0x%llx; %llu such views\n", static_cast<unsigned long long>(resource.baseAddress), resource.width, resource.height, resource.format, static_cast<int>(resource.dimension), resource.baseArray, resource.depthOrLastArray, static_cast<unsigned long long>(window.baseAddress), static_cast<unsigned long long>(count));
@@ -730,11 +774,14 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
     static const bool disabled = std::getenv("APS5_NO_TEXTURE_CACHE") != nullptr;
     const bool profile = LookupOutcomes::Profiled();
     const auto start = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
+    std::optional<DccKeys> scanned;
     const auto scanKeys = [&] {
+        if (scanned.has_value()) return *scanned;
         const auto scanStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
-        const auto keys = TextureClearKeys(resource, guestBytes);
+        scanned = TextureClearKeys(resource, guestBytes);
+        if (resource.dccAddress != 0) ++sampledLookupKeyScans;
         if (profile && resource.dccAddress != 0) LookupOutcomes::Add(LookupOutcomes::DccScan, scanStart);
-        return keys;
+        return *scanned;
     };
     auto& counters = TextureCounts();
     const auto address = resource.baseAddress;
@@ -756,7 +803,7 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
         keys = scanKeys();
         if (*keys == source->FilledKeys()) {
             std::array<std::byte, 16> probe{};
-            if (!FillDccClear(ResolveTextureFormat(resource.format), *keys, resource.dccAlphaOnMsb, probe)) {
+            if (!FillDccClear(DccClearTextureFormat(resource.format), *keys, resource.dccAlphaOnMsb, probe)) {
                 char text[256];
                 std::snprintf(text, sizeof(text), "AGC graphics: sampled texture 0x%llx (%ux%u format %u, dcc 0x%llx) reads %s DCC keys filled over its pending image, a clear value the format has no encoding for", static_cast<unsigned long long>(resource.baseAddress), resource.width, resource.height, resource.format, static_cast<unsigned long long>(resource.dccAddress), DccKeysName(*keys));
                 throw std::runtime_error(text);
@@ -790,6 +837,7 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
             auto candidate = sampledStorageSource(context, resource, guestBytes);
             if (candidate != nullptr && candidate->Descriptor().dccAddress == resource.dccAddress) source = std::move(candidate);
         }
+        scanned.reset();
         // The lookup's Refresh may have flushed another image's results over the memory (which
         // marks the keys uncompressed): a surface that stays a snapshot re-reads them behind that
         // flush, as it does behind its own. APS5_NO_KEYS_RESCAN=1 keeps the keys scanned above.
@@ -805,15 +853,19 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
     if (source != nullptr && !GuestMemory::UnchangedSince(address, bytes, source->GenerationFor(address, bytes))) {
         // The CPU wrote the memory while results were pending: Refresh merges them the usual way.
         refreshForView(*source, resource);
+        scanned.reset();
     }
     // Results stored to guest memory just now are stamped newer than `generation`; a snapshot read
     // after them is current at the generation of a second (memoized) collect. The store marks the
     // surface's DCC keys uncompressed, so the keys are read after it.
     const auto flushStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
-    const auto observedKeys = keys.has_value() ? *keys : scanKeys();
-    const bool stagedClear = source != nullptr && resource.dccAddress != 0 && (IsDccClear(observedKeys) || observedKeys == DccKeys::ClearSingle);
+    const bool stagedClear = source != nullptr && resource.dccAddress != 0 && [&] {
+        const auto observedKeys = keys.has_value() ? *keys : scanKeys();
+        return IsDccClear(observedKeys) || observedKeys == DccKeys::ClearSingle;
+    }();
     bool stagedFlushed = false;
-    if ((source == nullptr || stagedClear) && !clearThroughKeys && StorageTexture::FlushPending(address, bytes, nullptr, "sampled texture")) {
+    const bool flushAsked = (source == nullptr || stagedClear) && !clearThroughKeys;
+    if (flushAsked && StorageTexture::FlushPending(address, bytes, nullptr, "sampled texture")) {
         if (profile) LookupOutcomes::Add(LookupOutcomes::PendingFlush, flushStart);
         generation = GuestMemory::CollectWrites(address, bytes);
         if (stagedClear) {
@@ -824,6 +876,7 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
         }
         if (stagedFlushed) source.reset();
     }
+    if (flushAsked) scanned.reset();
     if (!keys.has_value()) keys = scanKeys();
     if (disabled) {
         if (source != nullptr && depthCompare) {
@@ -866,6 +919,7 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
     std::lock_guard lock(cache.mutex);
     const CacheHold held(sampledCacheHeld);
     dropUncachedViews(cache);
+    std::vector<std::byte> recycled;
     if (auto it = findTexture(cache, key); it != cache.entries.end()) {
         if (it->source != nullptr) {
             // The view follows the storage image, whatever the GPU wrote to it since; guest memory
@@ -912,29 +966,37 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
                 return it->texture;
             }
         }
+        if (it->bytes.size() == bytes) recycled = std::move(it->bytes);
+        else parkSnapshot(cache, it->bytes);
         eraseTexture(cache, it);
         ++cache.counts.stale;
     }
-    CachedTexture entry{key, address, std::vector<std::byte>(source != nullptr ? 0u : bytes), nullptr, *keys, snapshotGeneration};
+    if (source != nullptr) parkSnapshot(cache, recycled);
+    else if (recycled.empty()) recycled = spareSnapshot(cache, bytes);
+    CachedTexture entry{key, address, source != nullptr ? std::vector<std::byte>{} : (recycled.empty() ? std::vector<std::byte>(bytes) : std::move(recycled)), nullptr, *keys, snapshotGeneration};
     entry.committed = std::move(committed);
     entry.surfaceBytes = bytes;
+    const auto createTexture = [&](auto&&... args) {
+        const CacheHold reclaimable(sampledCacheReclaimable);
+        return std::make_shared<Texture>(context, std::forward<decltype(args)>(args)...);
+    };
     if (source != nullptr) {
         entry.source = source;
         entry.sourceVersion = source->Version();
         if (depthCompare) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::DepthCopyTag{});
+            entry.texture = createTexture(source, resource, components, Texture::DepthCopyTag{});
             entry.texture->RefreshDepthCopy();
         } else if (blockCopy) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::BlockCopyTag{});
+            entry.texture = createTexture(source, resource, components, Texture::BlockCopyTag{});
             entry.texture->RefreshDepthCopy();
         } else if (IsRepackedTextureFormat(resource.format)) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::RepackCopyTag{});
+            entry.texture = createTexture(source, resource, components, Texture::RepackCopyTag{});
             entry.texture->RefreshDepthCopy();
         } else if (srgbExpand) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::SrgbExpandTag{});
+            entry.texture = createTexture(source, resource, components, Texture::SrgbExpandTag{});
             entry.texture->RefreshDepthCopy();
         } else {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components);
+            entry.texture = createTexture(source, resource, components);
         }
         entry.accounted = source->Cached() ? 0u : heldBytes(*source);
         counters.fromStorage.fetch_add(1, std::memory_order_relaxed);
@@ -950,10 +1012,10 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
             for (std::size_t i = 0; i < entry.bytes.size(); i += 64) nonzero += entry.bytes[i] != std::byte{0};
             std::fprintf(stderr, "[texture] 0x%llx %ux%u format %u tile %d: %zu of %zu sampled bytes nonzero\n", static_cast<unsigned long long>(resource.baseAddress), resource.width, resource.height, resource.format, static_cast<int>(resource.tileMode), nonzero, entry.bytes.size() / 64);
         }
-        entry.texture = std::make_shared<Texture>(context, *context.detiler, resource, components, entry.bytes, depthCompare);
+        entry.texture = createTexture(*context.detiler, resource, components, entry.bytes, depthCompare);
         entry.accounted = entry.texture->AllocationBytes();
         constexpr std::size_t SnapshotCompareBytes = 256u << 10u;
-        if (entry.bytes.size() > SnapshotCompareBytes && (entry.generation != 0 || entry.untracked[0] != 0)) std::vector<std::byte>().swap(entry.bytes);
+        if (entry.bytes.size() > SnapshotCompareBytes && (entry.generation != 0 || entry.untracked[0] != 0)) parkSnapshot(cache, entry.bytes);
         counters.snapshots.fetch_add(1, std::memory_order_relaxed);
     }
     const auto budget = sampledBudget(context, cache);
@@ -1127,9 +1189,9 @@ std::shared_ptr<StorageTexture> cachedStorageTexture(const Context& context, std
     const auto viewed = ArrayLayerWindow(requested, context.limits.maxImageArrayLayers);
     if (viewed.baseAddress != requested.baseAddress) guestBytes = 0;
     Require(viewed.dimension != TextureDimension::k2DMsaa, "storage image access to a multisampled texture is not implemented");
-    RequireNoMultisampleTarget(viewed.baseAddress, guestBytes != 0 ? static_cast<std::size_t>(guestBytes) : 1u, "a storage image access");
-    if (auto depth = DepthSurfaceStorage(context, words, viewed, mip)) return depth;
     const auto viewedBytes = guestBytes != 0 ? guestBytes : DescribeSurface(viewed).guestBytes;
+    RequireNoMultisampleTarget(viewed.baseAddress, static_cast<std::size_t>(viewedBytes), "a storage image access");
+    if (auto depth = DepthSurfaceStorage(context, words, viewed, mip)) return depth;
     if (viewedBytes >= (1ull << 30u)) {
         static std::atomic<std::uint64_t> large{0};
         const auto count = large.fetch_add(1) + 1;
@@ -1138,12 +1200,12 @@ std::shared_ptr<StorageTexture> cachedStorageTexture(const Context& context, std
             reportGuestAllocation(viewed, viewedBytes);
         }
     }
-    if (DepthPlanesStale() || written) static_cast<void>(FlushDepthPlanes(viewed.baseAddress, static_cast<std::size_t>(viewedBytes), written ? DepthPlaneScope::Whole : DepthPlaneScope::Overlapped));
+    static const bool disabled = std::getenv("APS5_NO_TEXTURE_CACHE") != nullptr;
+    if ((DepthPlanesStale() || written) && (written || !layers || disabled)) static_cast<void>(FlushDepthPlanes(viewed.baseAddress, static_cast<std::size_t>(viewedBytes), written ? DepthPlaneScope::Whole : DepthPlaneScope::Overlapped));
     if (written && DepthSurfaceOverlaps(context.device, viewed.baseAddress, viewedBytes)) {
         const auto storage = WrittenStorageBytes(viewed, mip);
         RetireCoveredDepthSurfaces(context.device, storage.bytes, storage.extents);
     }
-    static const bool disabled = std::getenv("APS5_NO_TEXTURE_CACHE") != nullptr;
     if (disabled) return StorageTexture::Create(context, *context.detiler, viewed, mip);
     static_cast<void>(words);
     if (auto* recorder = Recorder::Active(); recorder != nullptr) recorder->BoundKeptBytes();
@@ -1178,11 +1240,16 @@ std::shared_ptr<StorageTexture> cachedStorageTexture(const Context& context, std
         } else {
             if (guestBytes == 0) guestBytes = DescribeSurface(resource).guestBytes;
             if (StorageTexture::FlushPending(resource.baseAddress, static_cast<std::size_t>(guestBytes), nullptr, "storage image creation", PublishScope::None) && profile) start = LookupOutcomes::Add(LookupOutcomes::PendingFlush, start);
-            CachedStorageTexture entry{key, mip, StorageTexture::Create(context, *context.detiler, resource, mip)};
+            std::shared_ptr<StorageTexture> created;
+            {
+                const CacheHold reclaimable(storageCacheReclaimable);
+                created = StorageTexture::Create(context, *context.detiler, resource, mip);
+            }
+            CachedStorageTexture entry{key, mip, std::move(created)};
             static const bool keepNew = std::getenv("APS5_NO_KEEP_NEW_STORAGE") == nullptr;
             if (auto* recorder = Recorder::Active(); keepNew && recorder != nullptr && GuestMemory::GpuMutex().HeldByThisThread() && recorder->Recording()) recorder->Keep(entry.texture);
             entry.accounted = heldBytes(*entry.texture);
-            const auto budget = storageBudget(context);
+            const auto budget = storageBudget(context, cache.bytes + entry.accounted);
             while (!cache.entries.empty() && cache.bytes + entry.accounted > budget) evicted.push_back(evictStorage(cache, std::prev(cache.entries.end())));
             cache.bytes += entry.accounted;
             texture = entry.texture;
@@ -1220,22 +1287,27 @@ std::uint64_t TextureCacheBudget(const VkPhysicalDeviceMemoryProperties& memory)
     return std::max<std::uint64_t>(2048ull << 20u, heap ? memory.memoryHeaps[*heap].size / 4u : 0u);
 }
 
+std::uint64_t StorageTextureCeiling(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported) {
+    const auto heap = largestDeviceLocalHeap(memory);
+    if (reported == nullptr || !heap || reported->heapBudget[*heap] == 0) return TextureCacheBudget(memory);
+    return std::max<std::uint64_t>(512ull << 20u, std::min<std::uint64_t>(memory.memoryHeaps[*heap].size / 2u, reported->heapBudget[*heap] / 2u));
+}
+
 std::uint64_t StorageTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t sampledBytes, std::uint64_t storageBytes) {
     const auto heap = largestDeviceLocalHeap(memory);
     if (reported == nullptr || !heap || reported->heapBudget[*heap] == 0) return TextureCacheBudget(memory);
     const auto budget = reported->heapBudget[*heap];
     const auto usage = reported->heapUsage[*heap];
     const auto reserved = usage - std::min<std::uint64_t>(usage, sampledBytes + storageBytes) + sampledBytes + budget / 8u;
-    const auto cap = std::min<std::uint64_t>(TextureCacheBudget(memory), budget / 4u);
-    return std::max<std::uint64_t>(512ull << 20u, std::min<std::uint64_t>(cap, budget > reserved ? budget - reserved : 0u));
+    return std::min<std::uint64_t>(StorageTextureCeiling(memory, reported), std::max<std::uint64_t>(512ull << 20u, budget > reserved ? budget - reserved : 0u));
 }
 
-std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes) {
+std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes, std::uint64_t storageBytes) {
     const auto heap = largestDeviceLocalHeap(memory);
     if (reported == nullptr || !heap || reported->heapBudget[*heap] == 0) return TextureCacheBudget(memory);
     const auto budget = reported->heapBudget[*heap];
     const auto usage = reported->heapUsage[*heap];
-    const auto reserved = usage - std::min<std::uint64_t>(usage, textureBytes) + TextureCacheBudget(memory) + budget / 8u;
+    const auto reserved = usage - std::min<std::uint64_t>(usage, textureBytes) + std::max(TextureCacheBudget(memory), storageBytes) + budget / 8u;
     return std::max<std::uint64_t>(2048ull << 20u, budget > reserved ? budget - reserved : 0u);
 }
 
@@ -1264,6 +1336,8 @@ TextureCacheUse TextureCacheUsage() {
         dropUncachedViews(sampled);
         use.sampledEntries = sampled.entries.size();
         use.sampledBytes = sampled.bytes;
+        use.spareEntries = sampled.spare.size();
+        use.spareBytes = sampled.spareBytes;
     }
     use.storageBytes = storageCacheBytes();
     return use;
@@ -1293,6 +1367,7 @@ void FlushCachedTextures(VkDevice device) {
     GuestMemory::AssertGpuLockHeld("FlushCachedTextures");
     auto& cache = StorageTextures();
     std::lock_guard lock(cache.mutex);
+    const CacheHold held(storageCacheHeld);
     for (const auto& entry : cache.entries) {
         if (entry.key.device == device) entry.texture->Flush();
     }
@@ -1303,15 +1378,19 @@ void ClearCachedTextures(VkDevice device) {
     auto& sampled = Textures();
     {
         std::lock_guard lock(sampled.mutex);
+        const CacheHold held(sampledCacheHeld);
         for (auto it = sampled.entries.begin(); it != sampled.entries.end();) {
             if (it->key.device == device) eraseTexture(sampled, it++);
             else ++it;
         }
+        sampled.spare.clear();
+        sampled.spareBytes = 0;
     }
     auto& storage = StorageTextures();
     std::vector<std::shared_ptr<StorageTexture>> cleared;
     {
         std::lock_guard lock(storage.mutex);
+        const CacheHold held(storageCacheHeld);
         for (auto it = storage.entries.begin(); it != storage.entries.end();) {
             if (it->key.device != device) {
                 ++it;
@@ -1338,7 +1417,7 @@ void ClearCachedTextures(VkDevice device) {
     }
 }
 
-std::uint64_t ReleaseTextureCaches(std::uint64_t bytes) {
+std::uint64_t ReleaseTextureCaches(std::uint64_t bytes, bool newImage) {
     thread_local bool releasing = false;
     if (releasing) return 0;
     releasing = true;
@@ -1354,63 +1433,67 @@ std::uint64_t ReleaseTextureCaches(std::uint64_t bytes) {
     bool storageSkipped = false;
     {
         auto& cache = Textures();
-        if (sampledCacheHeld != 0 || !AcquireCache(cache.mutex)) {
+        std::unique_lock lock(cache.mutex, std::defer_lock);
+        const bool inherited = sampledCacheHeld != 0;
+        if ((inherited && (!newImage || sampledCacheReclaimable == 0)) || (!inherited && !lock.try_lock())) {
             sampledSkipped = true;
         } else {
-            std::lock_guard lock(cache.mutex, std::adopt_lock);
-            dropUncachedViews(cache);
-            while (freed < bytes && !cache.entries.empty()) {
-                const auto back = std::prev(cache.entries.end());
-                const auto accounted = back->accounted;
-                const bool last = back->texture.use_count() == 1;
-                eraseTexture(cache, back);
+            for (auto it = cache.entries.end(); it != cache.entries.begin() && freed < bytes;) {
+                --it;
+                if (it->texture.use_count() != 1 || (it->source != nullptr && it->source->Dirty())) continue;
+                const auto allocated = it->texture->AllocationBytes();
+                const auto sourceBytes = it->source != nullptr ? it->source->AllocationBytes() : 0u;
+                const std::weak_ptr<StorageTexture> source = it->source;
+                const auto next = std::next(it);
+                eraseTexture(cache, it);
                 ++cache.counts.evicted;
                 ++sampledEntries;
-                if (last) freed += accounted;
+                freed += allocated;
+                if (source.expired()) freed += sourceBytes;
+                it = next;
             }
         }
     }
     if (freed < bytes) {
         auto& cache = StorageTextures();
         std::unique_lock<GuestMemory::GpuMutexType> gpu(GuestMemory::GpuMutex(), std::defer_lock);
-        if (storageCacheHeld != 0 || !gpu.try_lock()) {
+        const bool inherited = storageCacheHeld != 0;
+        if ((inherited && (!newImage || storageCacheReclaimable == 0)) || !gpu.try_lock()) {
             storageSkipped = true;
         } else {
             try {
                 while (freed < bytes) {
-                    std::vector<std::pair<std::shared_ptr<StorageTexture>, std::uint64_t>> evicted;
+                    std::shared_ptr<StorageTexture> image;
                     {
-                        if (!AcquireCache(cache.mutex)) {
+                        std::unique_lock lock(cache.mutex, std::defer_lock);
+                        if (!inherited && !lock.try_lock()) {
                             storageSkipped = true;
                             break;
                         }
-                        std::lock_guard lock(cache.mutex, std::adopt_lock);
-                        std::uint64_t batch = 0;
                         storageKept = 0;
-                        for (auto it = cache.entries.end(); it != cache.entries.begin() && batch + freed < bytes;) {
+                        for (auto it = cache.entries.end(); it != cache.entries.begin();) {
                             --it;
                             if (it->texture->Dirty()) {
                                 ++storageKept;
                                 continue;
                             }
-                            const auto accounted = it->accounted;
-                            const auto next = std::next(it);
-                            evicted.emplace_back(evictStorage(cache, it), accounted);
-                            batch += accounted;
-                            it = next;
+                            image = evictStorage(cache, it);
+                            break;
                         }
-                        if (evicted.empty()) break;
+                        if (image == nullptr) break;
                     }
-                    for (auto& [image, accounted] : evicted) {
-                        std::vector<std::shared_ptr<ShaderResources>> resources;
-                        SharedResourceCache().RemoveImage(image.get(), &resources);
-                        if (auto* recorder = Recorder::Active(); recorder != nullptr && recorder->Recording()) {
-                            for (auto& resource : resources) recorder->Keep(std::move(resource));
-                        }
-                        resources.clear();
-                        ++storageEntries;
-                        if (image.use_count() == 1) freed += accounted;
-                        image.reset();
+                    std::vector<std::shared_ptr<ShaderResources>> resources;
+                    const bool removed = SharedResourceCache().TryRemoveImage(image.get(), &resources);
+                    if (auto* recorder = Recorder::Active(); recorder != nullptr && recorder->Recording()) {
+                        for (auto& resource : resources) recorder->Keep(std::move(resource));
+                    }
+                    resources.clear();
+                    ++storageEntries;
+                    if (image.use_count() == 1) freed += image->AllocationBytes();
+                    image.reset();
+                    if (!removed) {
+                        storageSkipped = true;
+                        break;
                     }
                 }
             } catch (const std::exception& error) {
@@ -2001,9 +2084,10 @@ void ShaderResources::buildPrepare(std::span<const CompiledShader> shaders, cons
                         const bool classified = element < binding.bufferWritten.size() && element < binding.bufferRead.size() && element < binding.bufferAtomic.size();
                         allocations[index].writeOnly = classified && allocations[index].guest && allocations[index].written && binding.bufferWritten[element] && !read && !atomic;
                         const auto& push = shader.program->pushConstants;
-                        if (!push.empty()) {
+                        const auto pushDataBytes = shader.program->stencilReferences.empty() ? push.size() : shader.program->stencilReferenceDword * sizeof(std::uint32_t);
+                        if (pushDataBytes != 0u) {
                             const auto position = shader.program->memoryOffsetDword * 4u + element;
-                            Require(position < push.size(), "guest buffer offset lies outside the shader's push constants");
+                            Require(position < pushDataBytes, "guest buffer offset lies outside the shader's push constants");
                             allocations[index].pushByte = static_cast<std::int32_t>(shader.pushConstantOffset + position);
                         } else {
                             allocations[index].dataByte = shader.program->memoryOffsetDword * 4u + element;
@@ -2371,7 +2455,7 @@ void ShaderResources::buildComplete() {
                         for (auto element = first; element < last; ++element) {
                             const auto index = binding.imageAllocations[element];
                             if (binding.layout.descriptorType == VK_DESCRIPTOR_TYPE_SAMPLER) images.push_back({samplers[index]->Handle(), VK_NULL_HANDLE, VK_IMAGE_LAYOUT_UNDEFINED});
-                            else if (binding.layout.descriptorType == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE) images.push_back({VK_NULL_HANDLE, storageTextures[index]->StorageView(storageMips[index], storageFirstLayer[index]), VK_IMAGE_LAYOUT_GENERAL});
+                            else if (binding.layout.descriptorType == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE) images.push_back({VK_NULL_HANDLE, storageAtomic64[index] ? storageTextures[index]->Atomic64View(storageMips[index], storageFirstLayer[index]) : storageAtomic[index] ? storageTextures[index]->AtomicView(storageMips[index], storageFirstLayer[index]) : storageTextures[index]->StorageView(storageMips[index], storageFirstLayer[index]), VK_IMAGE_LAYOUT_GENERAL});
                             else images.push_back({VK_NULL_HANDLE, textureFirstLayer[index] ? textures[index]->FirstLayerView() : textures[index]->View(), textures[index]->Layout()});
                         }
                         if (recorded) runs.emplace_back(write.dstArrayElement, write.descriptorCount);
@@ -2911,21 +2995,57 @@ bool TemplateAuditDue(std::chrono::steady_clock::time_point last) {
 
 }
 
+void LastRecordIndices(std::span<const void* const> logged, std::span<const void* const> objects, std::vector<std::size_t>& indices) {
+    indices.assign(objects.size(), logged.size());
+    thread_local std::vector<std::pair<const void*, std::size_t>>* wantedSlot = nullptr;
+    auto& wanted = ShaderRecompiler::ThreadOwned(wantedSlot);
+    wanted.clear();
+    for (std::size_t i = 0; i < objects.size(); ++i) wanted.emplace_back(objects[i], i);
+    const auto byObject = [](const std::pair<const void*, std::size_t>& left, const std::pair<const void*, std::size_t>& right) { return std::less<const void*>{}(left.first, right.first); };
+    std::sort(wanted.begin(), wanted.end(), byObject);
+    std::size_t open = wanted.size();
+    for (auto at = logged.size(); at-- > 0 && open != 0;) {
+        const auto [first, last] = std::equal_range(wanted.begin(), wanted.end(), std::pair<const void*, std::size_t>{logged[at], 0}, byObject);
+        if (first == last || indices[first->second] != logged.size()) continue;
+        for (auto it = first; it != last; ++it) indices[it->second] = at;
+        open -= static_cast<std::size_t>(last - first);
+    }
+    if (wanted.capacity() > LookupLogBound + LookupLogBound / 2) {
+        wanted.clear();
+        wanted.shrink_to_fit();
+    }
+}
+
 // Turns the lookups' records into this object's per-texture validation records (see
 // ValidatedSurface); the last record of an object is the freshest.
 void ShaderResources::captureValidation() {
-    const auto record = [](const void* object) -> const LookupRecord* {
-        const auto& log = lookupLog();
-        for (auto it = log.rbegin(); it != log.rend(); ++it) {
-            if (it->object == object) return &*it;
-        }
-        return nullptr;
-    };
+    const auto& log = lookupLog();
+    thread_local std::vector<const void*>* loggedSlot = nullptr;
+    auto& logged = ShaderRecompiler::ThreadOwned(loggedSlot);
+    thread_local std::vector<const void*>* objectsSlot = nullptr;
+    auto& objects = ShaderRecompiler::ThreadOwned(objectsSlot);
+    thread_local std::vector<std::size_t>* indicesSlot = nullptr;
+    auto& indices = ShaderRecompiler::ThreadOwned(indicesSlot);
+    logged.clear();
+    for (const auto& entry : log) logged.push_back(entry.object);
+    objects.clear();
+    for (const auto& texture : textures) objects.push_back(texture.get());
+    LastRecordIndices(logged, objects, indices);
     validatedTextures.assign(textures.size(), {});
     for (std::size_t i = 0; i < textures.size(); ++i) {
-        if (const auto* found = record(textures[i].get())) validatedTextures[i] = {found->resource, found->bytes, found->keys, found->generation, 0, found->source, found->depth, true};
+        if (indices[i] == log.size()) continue;
+        const auto& found = log[indices[i]];
+        validatedTextures[i] = {found.resource, found.bytes, found.keys, found.generation, 0, found.source, found.depth, true};
     }
     lookupLog().clear();
+    const auto trim = [](auto& scratch) {
+        if (scratch.capacity() <= LookupLogBound + LookupLogBound / 2) return;
+        scratch.clear();
+        scratch.shrink_to_fit();
+    };
+    trim(logged);
+    trim(objects);
+    trim(indices);
 }
 
 std::size_t ShaderResources::LookupLogCapacity() {
@@ -3258,6 +3378,11 @@ ShaderResources::OwnRefreshFallback ShaderResources::refreshOwnObjects(std::span
     return OwnRefreshFallback::Count;
 }
 
+bool AnyPendingCpuWrites(const Context& context) {
+    if (Recorder::InCompletion() || Recorder::Active() == nullptr) return false;
+    return (context.copiedWriters != nullptr && !context.copiedWriters->empty()) || !DrawCopiedWriters()->empty() || Recorder::PendingCompletionLabels() != 0;
+}
+
 bool CompletePendingCpuWrites(const Context& context, std::uint64_t address, std::size_t bytes) {
     if (bytes == 0 || Recorder::InCompletion()) return false;
     auto* recorder = Recorder::Active();
@@ -3906,6 +4031,17 @@ void ResourceCache::Remove(const Key& key, const ShaderResources* object) {
 
 void ResourceCache::RemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted) {
     std::lock_guard lock(mutex);
+    removeImage(image, evicted);
+}
+
+bool ResourceCache::TryRemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted) {
+    std::unique_lock lock(mutex, std::try_to_lock);
+    if (!lock.owns_lock()) return false;
+    removeImage(image, evicted);
+    return true;
+}
+
+void ResourceCache::removeImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted) {
     for (auto it = entries.begin(); it != entries.end();) {
         if (!it->second->ReadsImage(image)) {
             ++it;
@@ -4258,7 +4394,8 @@ std::size_t ShaderResources::addGuestBuffer(std::span<const std::uint32_t> words
     Require(!written || !overlap(address, size, indexAddress, indexBytes), "writable shader buffer aliases the index buffer");
     written = written || allWritten;
     const std::uint64_t recordBytes = descriptor.Stride() != 0 ? descriptor.Stride() : extent;
-    const bool swept = read && dispatchThreads != 0 && recordBytes != 0 && dispatchThreads * recordBytes * 2u >= byteSize;
+    constexpr std::uint64_t WidestBufferStoreBytes = 16;
+    const bool swept = (read || (context.discreteGpu && descriptor.Stride() > WidestBufferStoreBytes)) && dispatchThreads != 0 && recordBytes != 0 && dispatchThreads * recordBytes * 2u >= byteSize;
     if (written) guestMemory.AddWritable(address, size, atomic, swept);
     else {
         guestMemory.AddReadable(address, size);
@@ -4366,12 +4503,11 @@ std::uint64_t ShaderResources::DataWordsHash(const CompiledShader& shader) {
 bool ShaderResources::DataWordsDiffer(const CompiledShader& shader) const {
     Require(shader.program != nullptr, "missing compiled shader");
     const auto& program = *shader.program;
-    if (program.bindings.size() != bindings.size()) return true;
-    for (std::size_t index = 0; index < program.bindings.size(); ++index) {
-        const auto& binding = program.bindings[index];
+    for (const auto& binding : program.bindings) {
         if (!DataRole(binding.role)) continue;
-        if (bindings[index].allocations.size() != 1) return true;
-        const auto& allocation = allocations[bindings[index].allocations.front()];
+        const auto held = std::ranges::find_if(bindings, [&](const Binding& candidate) { return candidate.layout.binding == binding.binding; });
+        if (held == bindings.end() || held->allocations.size() != 1) return true;
+        const auto& allocation = allocations[held->allocations.front()];
         if (allocation.dataWords.size() != binding.guestDescriptor.size() || !std::equal(allocation.dataWords.begin(), allocation.dataWords.end(), binding.guestDescriptor.begin())) return true;
     }
     return false;
@@ -4386,23 +4522,23 @@ bool ShaderResources::RefreshData(VkCommandBuffer commands, const CompiledShader
 bool ShaderResources::refreshData(VkCommandBuffer commands, const CompiledShader& shader, Recorder* recorder) {
     Require(shader.program != nullptr, "missing compiled shader");
     const auto& program = *shader.program;
-    Require(program.bindings.size() == bindings.size(), "template bindings disagree with the shader");
     bool recorded = false;
     // One [gputime] range of class TemplateDataRefresh around the updates, begun at the first one
     // (a refresh that finds every word equal records nothing and times nothing).
     auto timing = Recorder::NoTiming;
     std::uint64_t refreshedBytes = 0;
-    for (std::size_t index = 0; index < program.bindings.size(); ++index) {
-        const auto& binding = program.bindings[index];
+    for (const auto& binding : program.bindings) {
         if (!DataRole(binding.role)) continue;
-        Require(bindings[index].allocations.size() == 1, "data binding without its buffer");
-        auto& allocation = allocations[bindings[index].allocations.front()];
+        const auto held = std::ranges::find_if(bindings, [&](const Binding& candidate) { return candidate.layout.binding == binding.binding; });
+        Require(held != bindings.end(), "template bindings disagree with the shader");
+        Require(held->allocations.size() == 1, "data binding without its buffer");
+        auto& allocation = allocations[held->allocations.front()];
         const auto size = binding.guestDescriptor.size() * sizeof(std::uint32_t);
         Require(allocation.buffer != nullptr && !allocation.guest && allocation.size == size && size <= MaxRefreshBytes, "template data buffer cannot take the dispatch's words");
         if (allocation.dataWords.size() == binding.guestDescriptor.size() && std::equal(allocation.dataWords.begin(), allocation.dataWords.end(), binding.guestDescriptor.begin())) continue;
         if (binding.role == ShaderRecompiler::DescriptorRole::ShaderData) ValidateRuntimeResources(shader, binding.guestDescriptor);
         if (recorder != nullptr && timing == Recorder::NoTiming) timing = recorder->BeginGpuTiming(Recorder::CommandClass::TemplateDataRefresh);
-        writeDataWords(commands, bindings[index].allocations.front(), binding.guestDescriptor);
+        writeDataWords(commands, held->allocations.front(), binding.guestDescriptor);
         allocation.dataWords.assign(binding.guestDescriptor.begin(), binding.guestDescriptor.end());
         refreshedBytes += size;
         recorded = true;
@@ -4711,18 +4847,23 @@ void ShaderResources::resolveImageBinding(const ShaderRecompiler::DescriptorBind
             const bool depthCompare = !binding.imageDepthCompare.empty() && binding.imageDepthCompare.at(element);
             const bool firstLayer = binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2D && (resource.dimension == TextureDimension::k2DArray || (depthCompare && resource.dimension == TextureDimension::k1DArray));
             const bool depth1D = depthCompare && ((binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2D && resource.dimension == TextureDimension::k1D) || (binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2DArray && resource.dimension == TextureDimension::k1DArray));
-            if (!firstLayer && !depth1D && !MatchesGuestDimension(*binding.imageShape, resource.dimension)) throw std::runtime_error("AGC graphics: guest texture dimension disagrees with the shader's declared image shape (shape " + std::to_string(static_cast<int>(*binding.imageShape)) + ", dimension " + std::to_string(static_cast<int>(resource.dimension)) + ")");
+            const bool firstSample = binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2D && resource.dimension == TextureDimension::k2DMsaa;
+            if (!firstLayer && !depth1D && !firstSample && !MatchesGuestDimension(*binding.imageShape, resource.dimension)) throw std::runtime_error("AGC graphics: guest texture dimension disagrees with the shader's declared image shape (shape " + std::to_string(static_cast<int>(*binding.imageShape)) + ", dimension " + std::to_string(static_cast<int>(resource.dimension)) + ")");
             const VkComponentMapping components = ViewComponents(resource);
             const auto guestBytes = record != nullptr && record->decoded ? record->guestBytes : DescribeSurface(resource).guestBytes;
             CompletePendingCpuWrites(context, resource.baseAddress, static_cast<std::size_t>(guestBytes));
             if (resource.dccAddress != 0) CompletePendingCpuWrites(context, resource.dccAddress, DccKeyBytes(guestBytes));
             std::shared_ptr<Texture> texture;
             const VkImageViewType multisampleViewType = binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2DMultisampleArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D;
-            if (previousSampled.texture != nullptr && previousSampled.depthCompare == depthCompare && previousSampled.multisampleViewType == multisampleViewType && words.size() == 8 && std::equal(words.begin(), words.end(), previousSampled.words.begin())) texture = previousSampled.texture;
-            if (texture == nullptr && record != nullptr && record->texture != nullptr) {
+            if (previousSampled.texture != nullptr && previousSampled.depthCompare == depthCompare && previousSampled.multisampleViewType == multisampleViewType && previousSampled.firstSample == firstSample && words.size() == 8 && std::equal(words.begin(), words.end(), previousSampled.words.begin())) texture = previousSampled.texture;
+            if (texture == nullptr && !firstSample && record != nullptr && record->texture != nullptr) {
                 texture = fastTexture(*record);
                 (texture != nullptr ? counters.fastHits : counters.fastMisses).fetch_add(1, std::memory_order_relaxed);
             }
+            if (texture == nullptr && firstSample) {
+                Require(!depthCompare && !DepthSurfaceAt(resource.baseAddress), "reading sample 0 of a multisampled depth surface through a 2D image is not implemented");
+                texture = MultisampleTargetFirstSample(context, resource, components);
+            }
             if (texture == nullptr) texture = cachedTexture(context, words, resource, components, guestBytes, depthCompare, multisampleViewType);
             if (resource.dimension == TextureDimension::k2DMsaa) multisampleSources.push_back(resource.baseAddress);
             bool baseLevel = false;
@@ -4750,6 +4891,7 @@ void ShaderResources::resolveImageBinding(const ShaderRecompiler::DescriptorBind
                 std::copy(words.begin(), words.end(), previousSampled.words.begin());
                 previousSampled.depthCompare = depthCompare;
                 previousSampled.multisampleViewType = multisampleViewType;
+                previousSampled.firstSample = firstSample;
                 previousSampled.texture = texture;
             }
             textures.push_back(std::move(texture));
@@ -5094,8 +5236,8 @@ void ShaderResources::resolveImageTables() {
                 storageKeys.push_back(resource.dccAddress);
                 storageFirstLayer.push_back(firstLayer);
                 storageWritten.push_back(true);
-                storageAtomic.push_back(false);
-                storageAtomic64.push_back(false);
+                storageAtomic.push_back(element < binding.imageAtomic.size() && binding.imageAtomic[element]);
+                storageAtomic64.push_back(element < binding.imageAtomic64.size() && binding.imageAtomic64[element]);
                 describedRanges.push_back({"storage", resource.baseAddress, guestBytes, resource.width, resource.height, resource.format, static_cast<int>(resource.tileMode), resource.dccAddress, true});
                 bindings[storageBinding].imageAllocations[absolute] = storageTextures.size() - 1u;
                 continue;
@@ -5153,6 +5295,10 @@ void ShaderResources::resolveImageTables() {
     reportTextureCounters();
 }
 
+std::uint64_t SampledLookupKeyScans() {
+    return sampledLookupKeyScans;
+}
+
 ImageTableReuseCounts ImageTableReuses() {
     const auto& counters = TextureCounts();
     return {counters.tablesReused.load(std::memory_order_relaxed) + counters.tablesReplayed.load(std::memory_order_relaxed), counters.tablesResolved.load(std::memory_order_relaxed), counters.tablesReplayed.load(std::memory_order_relaxed), counters.tableWritesKept.load(std::memory_order_relaxed), counters.tableWritesMade.load(std::memory_order_relaxed)};
@@ -5535,8 +5681,9 @@ std::shared_ptr<ShaderResources::DrawBindings> ShaderResources::PrepareDrawBindi
         if (verifySnapshots && buffer != nullptr) {
             static std::atomic<std::uint64_t> checked{0}, differing{0};
             const auto fast = buffer->Bytes().subspan(static_cast<std::size_t>(offset), bytes);
-            const auto slow = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, GuestMemory::CollectWrites(begin, bytes));
-            const bool same = slow == buffer || (slow != nullptr && slow->Bytes().size() == fast.size() && std::memcmp(slow->Bytes().data(), fast.data(), fast.size()) == 0) || (slow == nullptr && std::memcmp(fast.data(), reinterpret_cast<const void*>(begin), bytes) == 0);
+            VkDeviceSize slowOffset = 0;
+            const auto slow = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, GuestMemory::CollectWrites(begin, bytes), &slowOffset);
+            const bool same = (slow == buffer && slowOffset == offset) || (slow != nullptr && slow->Bytes().size() >= slowOffset + fast.size() && std::memcmp(slow->Bytes().data() + slowOffset, fast.data(), fast.size()) == 0) || (slow == nullptr && std::memcmp(fast.data(), reinterpret_cast<const void*>(begin), bytes) == 0);
             if (!same) differing.fetch_add(1);
             if (checked.fetch_add(1) % 200000 == 199999) std::fprintf(stderr, "[draw-snapshots] verify: %llu fast answers checked, %llu differing%c", static_cast<unsigned long long>(checked.load()), static_cast<unsigned long long>(differing.load()), 10);
         }
@@ -5549,7 +5696,7 @@ std::shared_ptr<ShaderResources::DrawBindings> ShaderResources::PrepareDrawBindi
                 offset = slice.offset;
             } else {
                 const auto generation = GuestMemory::CollectWrites(begin, bytes);
-                buffer = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, generation);
+                buffer = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, generation, &offset);
                 if (buffer == nullptr) {
                     buffer = std::make_shared<Buffer>(context, bytes, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_SRC_BIT);
                     std::memcpy(buffer->Bytes().data(), reinterpret_cast<const void*>(begin), bytes);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp
index abcf13c57c..7dd97e4370 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp
@@ -1,4 +1,5 @@
 #include "BdaAbi.hpp"
+#include "SpirvBackend/SpirvAnalysis.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PipelineSpecialization.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/VertexInput.hpp"
@@ -594,6 +595,10 @@ Module Inspect(const CompiledShader& compiled, const State& state, const VkPhysi
         } else {
             Require(variable.storage == spv::StorageClassStorageBuffer && decoration.set && decoration.binding, "unsupported or unbound shader resource");
             const auto key = std::make_pair(*decoration.set, *decoration.binding);
+            if (*decoration.set == ShaderRecompiler::PixelFunctionLdsDescriptorSet) {
+                Require(fragment && *decoration.binding == 0u, "pixel function LDS buffer binding is wrong");
+                continue;
+            }
             const auto binding = std::find_if(shader.bindings.begin(), shader.bindings.end(), [&](const auto& item) { return item.descriptorSet == key.first && item.binding == key.second; });
             const bool array = binding != shader.bindings.end() && binding->role == ShaderRecompiler::DescriptorRole::GuestBuffers;
             const auto [view, first] = bufferViews.emplace(key, decoration.aliased);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
index c696cab63a..3c280c1312 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
@@ -6,6 +6,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/TextureSwizzleEquations.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libc/include/General.hpp"
 #include <algorithm>
@@ -314,13 +315,33 @@ VkStencilOpState stencilFace(std::uint32_t compare, std::uint32_t ops, std::uint
     auto fixed = compare == 0 || compare == 7 ? 0u : face.compareMask;
     std::uint32_t invertMask = 0;
     std::uint32_t inverted = 0;
+    std::uint32_t logicMask = 0;
+    const auto logic = [](std::uint32_t op) { return op == 10 || op == 11 || op == 12 || op == 15; };
     const auto convert = [&](std::uint32_t op, bool testFailed) {
         if (face.writeMask == 0) return VK_STENCIL_OP_KEEP;
         char detail[112];
-        if (opValExport && ((op == 4 && !opValReference) || op == 5 || op == 6 || op == 8 || op == 9)) {
+        if (opValExport && ((op == 4 && !opValReference) || (op >= 5 && op != 7))) {
             std::snprintf(detail, sizeof(detail), "AGC graphics: stencil operation %u with a pixel shader that exports the stencil operation value is unsupported", op);
             throw std::runtime_error(detail);
         }
+        if (logic(op)) {
+            const auto bits = (op == 11 || op == 12 ? opValue : ~opValue) & face.writeMask;
+            if (bits == 0) return VK_STENCIL_OP_KEEP;
+            if (logicMask != 0 && logicMask != bits) {
+                std::snprintf(detail, sizeof(detail), "AGC graphics: stencil logic operations on write masks 0x%02x and 0x%02x are unsupported", logicMask, bits);
+                throw std::runtime_error(detail);
+            }
+            logicMask = bits;
+            if (op != 11) return op == 10 ? VK_STENCIL_OP_ZERO : VK_STENCIL_OP_INVERT;
+            if (testValExport) throw std::runtime_error("AGC graphics: stencil OR is unsupported with a pixel shader that exports the stencil test value");
+            if ((~reference & fixed & bits) != 0) {
+                std::snprintf(detail, sizeof(detail), "AGC graphics: stencil OR of 0x%02x against test value 0x%02x (masks 0x%02x/0x%02x) is unsupported", opValue, test, face.compareMask, face.writeMask);
+                throw std::runtime_error(detail);
+            }
+            reference |= bits;
+            fixed |= bits;
+            return VK_STENCIL_OP_REPLACE;
+        }
         switch (op) {
             case 0: return VK_STENCIL_OP_KEEP;
             case 1: return VK_STENCIL_OP_ZERO;
@@ -377,35 +398,33 @@ VkStencilOpState stencilFace(std::uint32_t compare, std::uint32_t ops, std::uint
         if (inverted != active) throw std::runtime_error("AGC graphics: a stencil replacement drawn as an inversion beside another stencil operation is unsupported");
         face.writeMask = invertMask;
     }
+    if (logicMask != 0) {
+        const auto other = [&](std::uint32_t op) { return op != 0 && !logic(op); };
+        if ((other(ops & 0xfu) || other((ops >> 4u) & 0xfu) || other((ops >> 8u) & 0xfu)) && logicMask != face.writeMask) {
+            char detail[128];
+            std::snprintf(detail, sizeof(detail), "AGC graphics: stencil operations 0x%03x combine a logic operation on write mask 0x%02x with write mask 0x%02x", ops & 0xfffu, logicMask, face.writeMask);
+            throw std::runtime_error(detail);
+        }
+        face.writeMask = logicMask;
+    }
     face.reference = reference;
     Require(!opValReference || compare == 0 || compare == 7 || face.compareMask == 0, "a stencil compare against the test value is unsupported with a pixel shader that exports the stencil operation value");
     return face;
 }
 
-void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValExport, bool opValExport, State& result) {
-    const bool opValReference = opValExport && StencilOperationValueReplaces(cx);
-    zero(cx, 0x000, 0x0000101cu, "depth copy, resummarize or decompress draws (DB_RENDER_CONTROL)");
-    const bool depthClear = (read(cx, 0x000) & 1u) != 0;
-    const auto view = read(cx, 0x002);
-    zero(cx, 0x010, 0x00001000u, "partially resident depth (DB_Z_INFO)");
+DepthTarget decodeDepthPlane(const Registers& cx) {
+    const auto viewRegister = find(cx, 0x002);
+    const auto view = viewRegister == cx.end() ? 0u : viewRegister->second;
     const auto viewMip = (view >> 26u) & 0xfu;
     const auto maxMip = (read(cx, 0x010) >> 16u) & 0xfu;
-    zero(cx, 0x011, 0x00001000u, "partially resident stencil (DB_STENCIL_INFO)");
     const auto zFormat = read(cx, 0x010) & 3u;
-    const bool stencil = (read(cx, 0x011) & 1u) != 0;
-    const bool stencilClear = stencil && (read(cx, 0x000) & 2u) != 0;
-    Require(zFormat != 2, "Z_24 depth is unsupported");
-    if (zFormat == 0) depthControl &= ~6u;
-    if (!stencil) depthControl &= ~1u;
+    const auto stencilRegister = find(cx, 0x011);
+    const auto stencilInfo = stencilRegister == cx.end() ? 0u : stencilRegister->second;
+    const bool stencil = (stencilInfo & 1u) != 0;
     const auto base = [&](std::uint32_t low, std::uint32_t highOffset) {
         const auto high = find(cx, highOffset);
         return (high == cx.end() ? 0ull : static_cast<std::uint64_t>(high->second & 0xffu) << 40u) | (static_cast<std::uint64_t>(read(cx, low)) << 8u);
     };
-    const bool depthReadOnly = (view & 0x01000000u) != 0;
-    const bool stencilReadOnly = (view & 0x02000000u) != 0;
-    Require(!stencilClear || !stencilReadOnly, "stencil clear requires a writable stencil plane");
-    Require(!stencilClear || !testValExport, "stencil clear with a pixel shader that exports the stencil test value is unsupported");
-    Require(!depthClear || (zFormat != 0 && !depthReadOnly), "depth clear requires a writable depth plane");
     DepthTarget depth{};
     depth.samples = 1u << ((read(cx, 0x010) >> 2u) & 3u);
     depth.depthSwizzle = (read(cx, 0x010) >> 4u) & 31u;
@@ -414,9 +433,6 @@ void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValEx
     depth.lastSlice = (view >> 13u) & 0x7ffu;
     depth.address = zFormat != 0 ? base(0x012, 0x01a) : 0;
     depth.stencilAddress = stencil ? base(0x013, 0x01b) : 0;
-    const bool depthWritten = zFormat != 0 && !depthReadOnly && (depthClear || (depthControl & 6u) == 6u || (read(cx, 0x000) & 0x60u) != 0);
-    Require(!depthWritten || base(0x014, 0x01c) == depth.address, "depth read and written at different addresses is unsupported");
-    Require(!stencil || stencilReadOnly || base(0x015, 0x01d) == depth.stencilAddress, "stencil read and written at different addresses is unsupported");
     if (depth.samples != 1u) {
         depth.pipeBankXor = static_cast<std::uint32_t>(depth.address & 65535u);
         depth.address &= ~std::uint64_t{65535u};
@@ -453,13 +469,44 @@ void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValEx
         if (depth.stencilAddress != 0) depth.stencilAddress += static_cast<std::uint64_t>(slice) * DepthSliceBytes(depth.extent, 1u);
     }
     depth.format = zFormat == 1 ? (stencil ? VK_FORMAT_D16_UNORM_S8_UINT : VK_FORMAT_D16_UNORM) : (stencil ? VK_FORMAT_D32_SFLOAT_S8_UINT : VK_FORMAT_D32_SFLOAT);
-    depth.clearDepth = readFloat(cx, 0x00b);
-    depth.clearStencil = static_cast<std::uint8_t>(read(cx, 0x00a) & 0xffu);
-    depth.htileDepthOnly = (read(cx, 0x011) & (1u << 29u)) != 0u;
+    depth.htileDepthOnly = (stencilInfo & (1u << 29u)) != 0u;
     if (const auto htile = find(cx, 0x005); zFormat != 0 && htile != cx.end() && htile->second != 0 && (read(cx, 0x010) & (1u << 29u)) != 0) {
         depth.htileAddress = base(0x005, 0x01e) + static_cast<std::uint64_t>(view & 0x1fffu) * HtileMetadataBytes(depth.extent);
         depth.htileStencil = stencil && !depth.htileDepthOnly;
     }
+    return depth;
+}
+
+void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValExport, bool opValExport, State& result) {
+    const bool opValReference = opValExport && StencilOperationValueReplaces(cx);
+    zero(cx, 0x000, 0x0000101cu, "depth copy, resummarize or decompress draws (DB_RENDER_CONTROL)");
+    const bool depthClear = (read(cx, 0x000) & 1u) != 0;
+    const auto view = read(cx, 0x002);
+    zero(cx, 0x010, 0x00001000u, "partially resident depth (DB_Z_INFO)");
+    zero(cx, 0x011, 0x00001000u, "partially resident stencil (DB_STENCIL_INFO)");
+    const auto zFormat = read(cx, 0x010) & 3u;
+    const bool stencil = (read(cx, 0x011) & 1u) != 0;
+    const bool stencilClear = stencil && (read(cx, 0x000) & 2u) != 0;
+    Require(zFormat != 2, "Z_24 depth is unsupported");
+    if (zFormat == 0) depthControl &= ~6u;
+    if (!stencil) depthControl &= ~1u;
+    const auto base = [&](std::uint32_t low, std::uint32_t highOffset) {
+        const auto high = find(cx, highOffset);
+        return (high == cx.end() ? 0ull : static_cast<std::uint64_t>(high->second & 0xffu) << 40u) | (static_cast<std::uint64_t>(read(cx, low)) << 8u);
+    };
+    const bool depthReadOnly = (view & 0x01000000u) != 0;
+    const bool stencilReadOnly = (view & 0x02000000u) != 0;
+    Require(!stencilClear || !stencilReadOnly, "stencil clear requires a writable stencil plane");
+    Require(!stencilClear || !testValExport, "stencil clear with a pixel shader that exports the stencil test value is unsupported");
+    Require(!depthClear || (zFormat != 0 && !depthReadOnly), "depth clear requires a writable depth plane");
+    const auto readAddress = zFormat != 0 ? base(0x012, 0x01a) : 0;
+    const auto stencilReadAddress = stencil ? base(0x013, 0x01b) : 0;
+    const bool depthWritten = zFormat != 0 && !depthReadOnly && (depthClear || (depthControl & 6u) == 6u || (read(cx, 0x000) & 0x60u) != 0);
+    Require(!depthWritten || base(0x014, 0x01c) == readAddress, "depth read and written at different addresses is unsupported");
+    Require(!stencil || stencilReadOnly || base(0x015, 0x01d) == stencilReadAddress, "stencil read and written at different addresses is unsupported");
+    auto depth = decodeDepthPlane(cx);
+    depth.clearDepth = readFloat(cx, 0x00b);
+    depth.clearStencil = static_cast<std::uint8_t>(read(cx, 0x00a) & 0xffu);
     result.depth = depth;
     result.depthTest = (depthControl & 2u) != 0;
     result.depthWrite = result.depthTest && (depthControl & 4u) != 0 && !depthReadOnly;
@@ -590,6 +637,11 @@ constexpr std::uint32_t CoveredCentroidIsCenter = 1u << 29u;
 constexpr std::uint32_t SampleZeroRefusedInputs = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveCentroid) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::LinearCentroid) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage);
 constexpr std::uint32_t CentroidInputs = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveCentroid) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::LinearCentroid);
 
+bool staticAnchors(const Registers& cx, std::uint32_t depthSamples) {
+    const auto eqaa = find(cx, 0x201);
+    return eqaa != cx.end() && (eqaa->second & 7u) == static_cast<std::uint32_t>(std::countr_zero(depthSamples)) && (eqaa->second & 0x100000u) != 0;
+}
+
 bool overrasterized(const Registers& cx, std::uint32_t samples) {
     const auto eqaa = find(cx, 0x201);
     const auto mode = find(cx, 0x292);
@@ -605,6 +657,25 @@ bool sampleCoverageSupported(const QueueState& queue, std::uint32_t samples, boo
     return (inputs & PixelSampleCoverageInput) == 0u || (!perSampleShading && (inputs & PixelSampleRateInputs) == 0u);
 }
 
+bool pixelRateInputsKept(const QueueState& queue, const State& state) {
+    using ShaderRecompiler::PixelInput;
+    using ShaderRecompiler::PixelInputBit;
+    constexpr std::uint32_t numbered = PixelInputBit(PixelInput::Ancillary) | PixelInputBit(PixelInput::SampleCoverage);
+    constexpr std::uint32_t located = PixelInputBit(PixelInput::PerspectiveSample) | PixelInputBit(PixelInput::PerspectiveCentroid) | PixelInputBit(PixelInput::PerspectivePullModel) | PixelInputBit(PixelInput::LinearSample) | PixelInputBit(PixelInput::LinearCentroid) | PixelInputBit(PixelInput::PositionZ) | PixelInputBit(PixelInput::PositionW);
+    const bool centred = state.customSampleLocations && std::ranges::all_of(state.sampleLocations, [](std::uint8_t location) { return location == 0u; });
+    const auto moving = numbered | (centred ? 0u : located);
+    if (PixelProgramSkipped(queue)) return true;
+    const auto ena = find(queue.context, 0x1b3);
+    const auto addr = find(queue.context, 0x1b4);
+    if (ena == queue.context.end() || addr == queue.context.end()) return true;
+    const auto inputs = ena->second & addr->second;
+    if ((inputs & moving) != 0u) return false;
+    if (centred || (inputs & (PixelInputBit(PixelInput::PositionX) | PixelInputBit(PixelInput::PositionY))) == 0u) return true;
+    const auto position = find(queue.context, 0x1b8);
+    const auto control = position == queue.context.end() ? 0u : position->second;
+    return (control & 0x100000u) != 0u || ((control >> 16u) & 3u) == 0u;
+}
+
 bool coveredCentroidSupported(const QueueState& queue) {
     const auto config = find(queue.context, 0x2f8);
     if (config == queue.context.end() || (config->second & CoveredCentroidIsCenter) == 0 || PixelProgramSkipped(queue)) return true;
@@ -694,15 +765,19 @@ void rasterizeSampleZero(State& state) {
     state.sampleLocationGrid = sampleZero[8] != sampleZero[0] || sampleZero[16] != sampleZero[0] || sampleZero[24] != sampleZero[0];
 }
 
+bool documentedRop(std::uint32_t rop) {
+    return (rop >> 4u) == (rop & 0xfu) || ((rop >> 2u) & 0x33u) == (rop & 0x33u);
+}
+
 bool colorControlSupported(std::uint32_t colorControl, bool hasColorTarget) {
     colorControl &= ~1u;
-    return colorControl == 0xcc0010u || ((colorControl >> 4u) & 7u) == 0u || (!hasColorTarget && (colorControl & ~0x70u) == 0xcc0000u);
+    return ((colorControl & ~0xff0000u) == 0x10u && documentedRop((colorControl >> 16u) & 0xffu)) || ((colorControl >> 4u) & 7u) == 0u || (!hasColorTarget && (colorControl & ~0x70u) == 0xcc0000u);
 }
 
 std::string colorControlMessage(std::uint32_t colorControl) {
     static constexpr const char* modes[8] = {"disable", "normal", "eliminate fast clear", "resolve", "decompress", "FMASK decompress", "DCC decompress", "reserved"};
     char text[160];
-    std::snprintf(text, sizeof(text), "AGC graphics: only normal color rendering with copy ROP is supported (CB_COLOR_CONTROL 0x%08x, mode %s)", colorControl, modes[(colorControl >> 4u) & 7u]);
+    std::snprintf(text, sizeof(text), "AGC graphics: only normal color rendering with a ROP3 code of the source or brush form is supported (CB_COLOR_CONTROL 0x%08x, mode %s)", colorControl, modes[(colorControl >> 4u) & 7u]);
     return text;
 }
 
@@ -907,12 +982,18 @@ struct DecodedColorFormat {
 };
 
 const char* PackedColorTargetName(ShaderRecompiler::ColorExportPacking packing) {
+    if (packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4) return "4_4_4_4 unorm";
+    if (packing == ShaderRecompiler::ColorExportPacking::Uint) return "unsigned integer";
     return packing == ShaderRecompiler::ColorExportPacking::Float11_11_10 ? "11_11_10 float" : "10_11_11 unorm";
 }
 
+bool WordPacked(ShaderRecompiler::ColorExportPacking packing) {
+    return packing == ShaderRecompiler::ColorExportPacking::Unorm10_11_11 || packing == ShaderRecompiler::ColorExportPacking::Float11_11_10 || packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4;
+}
+
 // CB_COLOR_INFO FORMAT / NUMBER_TYPE / COMP_SWAP to a Vulkan attachment format. AMD formats list
 // components from the least significant bits, as Vulkan's non-packed formats do.
-DecodedColorFormat DecodeColorFormat(std::uint32_t format, std::uint32_t number, std::uint32_t swap) {
+DecodedColorFormat DecodeColorFormatRaw(std::uint32_t format, std::uint32_t number, std::uint32_t swap) {
     constexpr std::uint32_t unorm = 0, snorm = 1, sint = 5, srgb = 6, floating = 7;
     constexpr std::uint32_t uint = 4;
     const auto fail = [&]() -> DecodedColorFormat {
@@ -920,7 +1001,7 @@ DecodedColorFormat DecodeColorFormat(std::uint32_t format, std::uint32_t number,
     };
     const bool alternate = swap == 1;
     const auto single = [&](VkFormat vkFormat, std::uint32_t bytes) { return DecodedColorFormat{vkFormat, bytes, static_cast<std::uint8_t>((0xe4u & ~3u) | swap)}; };
-    if (swap > 1 && format != 1 && format != 2 && format != 4 && format != 7 && format != 10 && format != 12 && format != 16) return fail();
+    if (swap > 1 && format != 1 && format != 2 && format != 4 && format != 7 && format != 10 && format != 12 && format != 16 && format != 19) return fail();
     switch (format) {
         case 1:
             if (number == unorm) return single(VK_FORMAT_R8_UNORM, 1);
@@ -998,6 +1079,9 @@ DecodedColorFormat DecodeColorFormat(std::uint32_t format, std::uint32_t number,
         case 17:
             if (swap != 0 || number != unorm) return fail();
             return {VK_FORMAT_A1R5G5B5_UNORM_PACK16, 2, 0xc6u};
+        case 19:
+            if (swap != 2 || number != unorm) return fail();
+            return {VK_FORMAT_R16_UINT, 2, 0x1bu, ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4};
         default:
             return fail();
     }
@@ -1072,6 +1156,21 @@ std::array<std::uint16_t, 4> QuadSampleMasks(const State& state, const SampleOrd
     return {mask, mask, mask, mask};
 }
 
+VkLogicOp LogicOpFromRop(std::uint8_t rop) {
+    if (!documentedRop(rop)) {
+        char text[96];
+        std::snprintf(text, sizeof(text), "AGC graphics: ROP3 code 0x%02x combines source and brush, which is not implemented", rop);
+        throw std::runtime_error(text);
+    }
+    static constexpr std::array<VkLogicOp, 16> operations{
+        VK_LOGIC_OP_CLEAR, VK_LOGIC_OP_NOR, VK_LOGIC_OP_AND_INVERTED, VK_LOGIC_OP_COPY_INVERTED,
+        VK_LOGIC_OP_AND_REVERSE, VK_LOGIC_OP_INVERT, VK_LOGIC_OP_XOR, VK_LOGIC_OP_NAND,
+        VK_LOGIC_OP_AND, VK_LOGIC_OP_EQUIVALENT, VK_LOGIC_OP_NO_OP, VK_LOGIC_OP_OR_INVERTED,
+        VK_LOGIC_OP_COPY, VK_LOGIC_OP_OR_REVERSE, VK_LOGIC_OP_OR, VK_LOGIC_OP_SET};
+    const std::uint32_t index = (rop & 3u) | ((rop >> 4u) & 4u) | ((rop >> 4u) & 8u);
+    return operations[index];
+}
+
 std::array<VkSampleLocationEXT, 32> SampleLocations(const State& state) {
     Require(state.samples == 1 || state.samples == 2 || state.samples == 4 || state.samples == 8, "invalid sample count");
     std::array<VkSampleLocationEXT, 32> locations{};
@@ -1098,7 +1197,8 @@ std::array<std::uint8_t, 32> PixelSampleLocations(const State& state, const Shad
     std::array<std::uint8_t, 32> locations{};
     const bool sampleBarycentrics = (pixel.inputAddr & (PixelInputBit(PixelInput::PerspectiveSample) | PixelInputBit(PixelInput::LinearSample))) != 0u;
     const bool samplePosition = !state.perSampleShading && (pixel.posX || pixel.posY) && pixel.positionLocation == ShaderRecompiler::PixelPositionLocation::Sample;
-    if (!sampleBarycentrics && !samplePosition) return locations;
+    const bool mergedCentres = pixel.targetMerge.samples > 1u && (pixel.inputAddr & (PixelInputBit(PixelInput::PerspectiveCenter) | PixelInputBit(PixelInput::LinearCenter))) != 0u;
+    if (!sampleBarycentrics && !samplePosition && !mergedCentres) return locations;
     const auto samples = state.perSampleShading ? state.samples : 1u;
     for (std::uint32_t pixelIndex = 0; pixelIndex < 4u; ++pixelIndex) {
         for (std::uint32_t sample = 0; sample < samples; ++sample) {
@@ -1261,6 +1361,27 @@ ReversedBlend TranslateReversedBlend(std::uint32_t blendControl, std::uint8_t co
     return {blend, routing->code};
 }
 
+void ApplyDepthBoundsEmulation(const Context& context, State& state, const ShaderRecompiler::ShaderPixelStageInfo& pixel) {
+    if (!state.depthBoundsTest || !state.depth || context.depthBounds) return;
+    ValidateDepthBounds(context, state);
+    Require(!context.depthRangeUnrestricted, "the depth bounds test without the depthBounds feature is emulated only where stored depth stays in [0, 1]");
+    Require(state.depth->format == VK_FORMAT_D32_SFLOAT || state.depth->format == VK_FORMAT_D32_SFLOAT_S8_UINT, "the depth bounds test on a normalized depth target needs the depthBounds feature");
+    Require(!state.depthTest && !state.depthWrite, "the depth bounds test with depth testing needs the depthBounds feature");
+    Require(!pixel.posZ && !pixel.depthExportEnable, "the depth bounds test from a pixel program that reads or exports depth needs the depthBounds feature");
+    const auto keepsOnFail = [](const VkStencilOpState& face) { return (face.writeMask & 0xffu) == 0 || (face.failOp == VK_STENCIL_OP_KEEP && face.depthFailOp == VK_STENCIL_OP_KEEP); };
+    Require(!state.stencilTest || (keepsOnFail(state.stencilFront) && keepsOnFail(state.stencilBack)), "the depth bounds test with a stencil test that writes on a failed test needs the depthBounds feature");
+    const bool upper = state.minDepthBounds <= 0.0f;
+    Require(upper || state.maxDepthBounds >= 1.0f, "the depth bounds test with both bounds inside (0, 1) needs the depthBounds feature");
+    const float bound = upper ? state.maxDepthBounds : state.minDepthBounds;
+    state.depthBoundsTest = false;
+    state.depthTest = true;
+    state.depthCompare = upper ? VK_COMPARE_OP_GREATER_OR_EQUAL : VK_COMPARE_OP_LESS_OR_EQUAL;
+    state.depthBias = false;
+    state.depthBiasPerFace = false;
+    state.viewport.minDepth = bound;
+    state.viewport.maxDepth = bound;
+}
+
 void ApplyDepthRemap(const Context& context, State& state) {
     const auto& viewport = state.viewport;
     const bool inRange = viewport.minDepth >= 0 && viewport.minDepth <= 1 && viewport.maxDepth >= 0 && viewport.maxDepth <= 1;
@@ -1371,8 +1492,9 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     zero(cx, 0x292, ScanModeMask & ~1u, "scan conversion mode");
     if (depthKeepsSampleZero && (read(cx, 0x292) & 1u) == 0) {
         const bool filled = result.topology != VK_PRIMITIVE_TOPOLOGY_POINT_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_STRIP;
-        const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage));
-        Require(filled && !result.alphaToCoverage && (PixelProgramSkipped(queue) || sampleInputs == 0) && (read(cx, 0x203) & 0x100u) == 0 && (read(cx, 0x201) & 0x0f0c0000u) == 0, "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA Z interpolation or overrasterization");
+        const auto sampleIndex = (read(cx, 0x293) & PixelShaderIteratesSamples) != 0u ? ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) : 0u;
+        const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (sampleIndex | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage));
+        Require(filled && !result.alphaToCoverage && (PixelProgramSkipped(queue) || sampleInputs == 0) && (read(cx, 0x203) & 0x100u) == 0 && (read(cx, 0x201) & 0x0f080000u) == 0, "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index input under PS_ITER_SAMPLE, a coverage input, a sample-mask export, or DB_EQAA source Z interpolation or overrasterization");
         result.samples = 1;
         result.customSampleLocations = false;
         result.sampleLocations.fill(0);
@@ -1413,7 +1535,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     if (auto reason = sampleMaskRejection(queue, read(cx, 0x2f8), read(cx, 0x30e), read(cx, 0x30f)); !reason.empty()) throw std::runtime_error(reason);
     const auto viewportControl = read(cx, 0x206);
     if (viewportControl != 0x43fu) throw std::runtime_error(vteMessage(viewportControl));
-    zero(cx, 0x204, ClipControlMask, "unsupported PA_CL_CLIP_CNTL flags");
+    zero(cx, 0x204, ClipControlMask, "a PA_CL_CLIP_CNTL flag");
     result.depthClamp = (read(cx, 0x204) & 0x0c000000u) != 0;
     result.negativeOneToOne = (read(cx, 0x204) & 0x80000u) == 0;
     const auto raster = read(cx, 0x205);
@@ -1450,6 +1572,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
 
     // CB_COLOR_CONTROL mode 0 disables color writes, which only matters when a target is written.
     if (const auto colorControl = read(cx, 0x202); !colorControlSupported(colorControl, result.hasColorTarget)) throw std::runtime_error(colorControlMessage(colorControl));
+    if (const auto colorControl = read(cx, 0x202); ((colorControl >> 4u) & 7u) == 1u) result.colorRop = static_cast<std::uint8_t>(colorControl >> 16u);
     zero(cx, 0x1c4, zFormatSupported(read(cx, 0x1c4)) ? 0u : ~0u, "depth or sample-mask export");
     const auto exportFormat = result.hasColorTarget ? read(cx, 0x1c5) : 0u;
     APS5_LOG_OUT_DEBUG("Export format=%u", exportFormat);
@@ -1466,11 +1589,13 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
         if (slotExport == 7 && ((read(cx, 0x31c + slot * 0xfu) >> 8u) & 7u) != 4u) throw std::runtime_error("AGC graphics: color export format 7 (UINT16_ABGR) into a target that is not unsigned integer is unsupported");
         color.exportIndex = index;
         color.uintExport = slotExport == 7;
+        if (color.uintExport && color.packing == ShaderRecompiler::ColorExportPacking::Uint) color.packing = ShaderRecompiler::ColorExportPacking::None;
         if (color.samples == 1 && result.samples > 1 && result.colors.empty() && !result.depth && (read(cx, 0x292) & 1u) == 0) {
             const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage));
-            Require(!result.perSampleShading && sampleInputs == 0 && (read(cx, 0x203) & 0x100u) == 0, "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with PS_ITER_SAMPLE, a sample index or coverage input, or a sample-mask export");
+            Require(sampleInputs == 0 && (read(cx, 0x203) & 0x100u) == 0, "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with a sample index or coverage input, or a sample-mask export");
             result.samples = 1;
             result.customSampleLocations = false;
+            result.perSampleShading = false;
         }
         if (color.samples > 1 && result.samples == 1 && result.colors.empty() && !result.depth && !result.alphaToCoverage && (read(cx, 0x292) & 1u) == 0) {
             Require(result.conservativeRasterization == VK_CONSERVATIVE_RASTERIZATION_MODE_DISABLED_EXT || (read(cx, 0x1b3) & 0x44u) == 0, "conservative rasterization with centroid interpolation of a draw raised to a multisampled target is unsupported");
@@ -1478,10 +1603,12 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
             result.customSampleLocations = true;
             result.sampleLocations.fill(0);
         }
-        const bool merged = color.samples == 1u && !result.depth && !result.perSampleShading && (result.colors.empty() || result.mergedCoverage) && overrasterized(cx, result.samples);
-        if (!merged && color.samples == 1 && result.colors.empty() && !result.depth && rasterizesSampleZeroOnly(cx, result)) rasterizeSampleZero(result);
+        const bool merged = color.samples == 1u && color.coverageSamples == 1u && !result.depth && !result.perSampleShading && (result.colors.empty() || result.mergedCoverage) && overrasterized(cx, result.samples);
+        if (!merged && color.samples == 1 && color.coverageSamples == 1u && result.colors.empty() && !result.depth && rasterizesSampleZeroOnly(cx, result)) rasterizeSampleZero(result);
+        Require(color.coverageSamples == color.samples || color.coverageSamples == result.samples || (result.samples == 1u && (read(cx, 0x292) & 1u) == 0), "a one-fragment color target's sample count differs from the rasterizer's");
         const bool truncated = color.samples == 1u && result.samples > 1u && result.depth && result.depth->samples == result.samples && (result.colors.empty() || result.truncatedCoverage) && !overrasterized(cx, result.samples);
         Require((color.samples == result.samples && !result.mergedCoverage && !result.truncatedCoverage) || merged || truncated, "a color target's sample count differs from the rasterizer's");
+        Require(color.coverageSamples == color.samples || result.samples == 1u || staticAnchors(cx, result.depth->samples), "a one-fragment color target is supported only with static DB_EQAA anchors at the depth target's sample count");
         result.mergedCoverage = merged;
         result.truncatedCoverage = truncated;
         APS5_LOG_OUT_DEBUG("Color %u address=0x%llx extent=%ux%u bytes=%llu VkFormat=%u", slot, static_cast<unsigned long long>(color.address), color.extent.width, color.extent.height, static_cast<unsigned long long>(color.bytes), static_cast<unsigned>(color.format));
@@ -1511,6 +1638,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     }
     result.quadSampleMask = decodeQuadSampleMask(cx, result.samples);
     result.pixelEarlyZ = !PixelProgramSkipped(queue) && PixelEarlyZ(read(cx, 0x203));
+    result.pixelKill = !PixelProgramSkipped(queue) && (read(cx, 0x203) & 0x40u) != 0;
     if ((read(cx, 0x207) & LayerExports & ~result.layerExports & ~(1u << 21u)) != 0) {
         static bool reported = false;
         if (!reported) {
@@ -1556,7 +1684,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     result.blends.assign(exportCount, VkPipelineColorBlendAttachmentState{});
     std::array<float, 3> requiredBlendConstants{};
     std::uint32_t requiredBlendMask = 0;
-    for (const auto& color : result.colors) {
+    for (auto& color : result.colors) {
         const auto slot = color.slot;
         const auto blend = read(cx, 0x1e0 + slot);
         APS5_LOG_OUT_DEBUG("Blend %u control=0x%x", slot, blend);
@@ -1619,12 +1747,35 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
                 if ((weighted(state.colorBlendOp) && (constantColor(state.srcColorBlendFactor) || constantColor(state.dstColorBlendFactor))) || (weighted(state.alphaBlendOp) && (constantColor(state.srcAlphaBlendFactor) || constantColor(state.dstAlphaBlendFactor)))) throw std::runtime_error("AGC graphics: blending into an 8_8 color target with the alternate component order with a constant color factor, which Vulkan applies to the second channel with the green blend constant instead of the alpha one, is not implemented");
             }
         }
-        if (color.packing != ShaderRecompiler::ColorExportPacking::None) {
+        if (color.packing == ShaderRecompiler::ColorExportPacking::Uint) state.blendEnable = VK_FALSE;
+        if (WordPacked(color.packing)) {
             const std::string packed = std::string(color.packing == ShaderRecompiler::ColorExportPacking::Float11_11_10 ? "an " : "a ") + PackedColorTargetName(color.packing);
             const auto slotExport = (exportFormat >> (4u * color.exportIndex)) & 0xfu;
             if (slotExport == 5 || slotExport == 6) throw std::runtime_error("AGC graphics: color export format " + std::to_string(slotExport) + " into " + packed + " target is unsupported");
             Require(!state.blendEnable, "blending into " + packed + " color target is unsupported");
-            Require((exportedMask & 7u) == 7u, "partial writes of " + packed + " color target are unsupported");
+            const bool nibbles = color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4;
+            const std::uint32_t packedMask = nibbles ? 0xfu : 7u;
+            Require(nibbles || (exportedMask & packedMask) == packedMask, "partial writes of " + packed + " color target are unsupported");
+            if ((exportedMask & packedMask) != packedMask) {
+                Require(color.mipCount == 1u && color.depth == 1u && color.layers == 1u && color.arrayLastSlice == 0u, "partial writes of a mipmapped, volume or array " + std::string(PackedColorTargetName(color.packing)) + " color target are not implemented");
+                Require(std::ranges::none_of(result.colors, [](const ColorTarget& other) { return other.partialWriteMask != 0; }), "partial writes of more than one packed color target are not implemented");
+                color.partialWriteMask = PackedWriteMask(mapping, exportedMask);
+                state.colorWriteMask = 0;
+                if (color.samples > 1u) {
+                    Require(sampleCoverageSupported(queue, result.samples, true), "SAMPLE_COVERAGE in a multisampled pixel shader that runs per sample, or reads sample-rate or ancillary inputs, is unsupported (the input holds the whole pixel's coverage, gl_SampleMaskIn only the invocation's samples)");
+                    if (!result.perSampleShading && !pixelRateInputsKept(queue, result)) {
+                        const auto value = [&](std::uint32_t offset) { const auto it = queue.context.find(offset); return it == queue.context.end() ? 0u : it->second; };
+                        char detail[160];
+                        std::snprintf(detail, sizeof(detail), " (SPI_PS_INPUT_ENA 0x%x, SPI_PS_INPUT_ADDR 0x%x, SPI_BARYC_CNTL 0x%x, sample 1 location 0x%02x)", value(0x1b3), value(0x1b4), value(0x1b8), result.sampleLocations[1]);
+                        Require(false, std::string("partial writes of a multisampled 4_4_4_4 unorm color target run the pixel shader once per sample, so a shader the guest runs once per pixel cannot read the ancillary word or, unless every sample sits at the pixel centre, centroid, sample-located or pull-model barycentrics, Z, 1/W or a position at the centroid or a sample: they would follow the invocation's sample") + detail);
+                    }
+                    result.perSampleShading = true;
+                }
+            }
+        }
+        if (color.packing == ShaderRecompiler::ColorExportPacking::Uint) {
+            const auto slotExport = (exportFormat >> (4u * color.exportIndex)) & 0xfu;
+            if (slotExport != 1 && slotExport != 2 && slotExport != 3 && slotExport != 9) throw std::runtime_error("AGC graphics: color export format " + std::to_string(slotExport) + " into an unsigned integer target is unsupported");
         }
         if (state.blendEnable && !reversed && (secondSource(state.srcColorBlendFactor) || secondSource(state.dstColorBlendFactor) || secondSource(state.srcAlphaBlendFactor) || secondSource(state.dstAlphaBlendFactor))) {
             const auto addition = [](VkBlendOp op) { return op == VK_BLEND_OP_ADD || op == VK_BLEND_OP_SUBTRACT || op == VK_BLEND_OP_REVERSE_SUBTRACT; };
@@ -1641,7 +1792,14 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     for (std::uint32_t i = 0; i < 3; ++i) {
         if ((requiredBlendMask & (1u << i)) != 0) result.blendConstants[i] = requiredBlendConstants[i];
     }
-    if (!result.colors.empty()) result.blend = result.blends[result.colors.front().exportIndex];
+    Require((!result.mergedCoverage && !result.truncatedCoverage) || std::ranges::none_of(result.colors, [](const ColorTarget& color) { return color.partialWriteMask != 0; }), "partial writes of a 4_4_4_4 unorm color target under merged or truncated coverage (a one-sample target under a multisampled rasterizer) are not implemented");
+    if (!result.colors.empty()) {
+        result.color = result.colors.front();
+        result.blend = result.blends[result.colors.front().exportIndex];
+    }
+    if (LogicOpFromRop(result.colorRop) != VK_LOGIC_OP_COPY) {
+        for (const auto& blend : result.blends) Require(blend.blendEnable == VK_FALSE, "a color logic operation together with blending is not implemented");
+    }
     Require(result.reversedBlend == 0 || (exportSlots.size() == 1 && exportCount == 1), "blending into a color target with a reversed component order through a second source color needs that target to be the shader's only color export");
     if (result.dualSourceBlend) {
         Require(exportSlots.size() == 2 && exportSlots[0] == 0 && exportSlots[1] == 1 && exportCount == 1, "dual-source blending needs pixel exports to MRT slots 0 and 1 and color writes to slot 0 alone");
@@ -1668,6 +1826,50 @@ std::array<ShaderRecompiler::ColorExportPacking, 8> ExportPackings(const State&
     return packings;
 }
 
+std::uint16_t PackedWriteMask(std::uint8_t componentMapping, std::uint32_t exportedMask) {
+    std::uint16_t mask = 0;
+    for (std::uint32_t component = 0; component < 4; ++component) {
+        if (((exportedMask >> ((componentMapping >> (2u * component)) & 3u)) & 1u) != 0) mask = static_cast<std::uint16_t>(mask | (0xfu << (4u * component)));
+    }
+    return mask;
+}
+
+GuestTextureResource TargetMergeSurface(const ColorTarget& color) {
+    auto surface = SurfaceForTarget(color);
+    if (color.samples > 1u) {
+        Require(surface.baseAddress == color.surfaceAddress, "a merged multisampled color target does not start at its surface");
+        surface.dimension = TextureDimension::k2DMsaa;
+        surface.samples = color.samples;
+    }
+    return surface;
+}
+
+bool DepthStencilWrites(const State& state) {
+    if (!state.depth) return false;
+    const auto writes = [](const VkStencilOpState& face) { return (face.writeMask & 0xffu) != 0 && (face.failOp != VK_STENCIL_OP_KEEP || face.passOp != VK_STENCIL_OP_KEEP || face.depthFailOp != VK_STENCIL_OP_KEEP); };
+    return state.depthWrite || (state.stencilTest && (writes(state.stencilFront) || writes(state.stencilBack)));
+}
+
+bool DepthStencilTests(const State& state) {
+    return state.depth.has_value() && (state.depthTest || state.stencilTest || state.depthBoundsTest);
+}
+
+ShaderRecompiler::TargetMerge ExportTargetMerge(const State& state) {
+    ShaderRecompiler::TargetMerge merge;
+    for (const auto& color : state.colors) {
+        if (color.partialWriteMask == 0) continue;
+        Require(merge.mask == 0 && color.exportIndex < 8u && color.samples <= 8u, "a draw merges into one packed color target at most");
+        Require(color.samples == 1u || state.perSampleShading, "a merged multisampled color target needs per-sample shading");
+        merge.target = static_cast<std::uint8_t>(color.exportIndex);
+        merge.mask = color.partialWriteMask;
+        merge.samples = static_cast<std::uint8_t>(color.samples);
+        merge.descriptor = EncodeTextureResource(TargetMergeSurface(color));
+        merge.depthStencilWrites = DepthStencilWrites(state);
+        merge.depthStencilTests = DepthStencilTests(state);
+    }
+    return merge;
+}
+
 bool PartialSampleMask(const State& state) {
     const auto full = (1u << state.samples) - 1u;
     return std::ranges::any_of(state.quadSampleMask, [&](std::uint16_t mask) { return (mask & full) != full; });
@@ -1772,11 +1974,17 @@ GuestTextureResource SurfaceForTarget(const ColorTarget& color) {
     surface.dstSelY = 5;
     surface.dstSelZ = 6;
     surface.dstSelW = 7;
-    surface.dccAddress = color.dccAddress;
+    surface.dccAddress = color.dccAddress != 0 ? color.dccAddress : color.chainDccAddress;
     surface.dccAlphaOnMsb = color.dccAlphaOnMsb;
     surface.dccPipeAligned = color.dccPipeAligned;
     return surface;
 }
+DecodedColorFormat DecodeColorFormat(std::uint32_t format, std::uint32_t number, std::uint32_t swap) {
+    auto decoded = DecodeColorFormatRaw(format, number, swap);
+    if (number == 4u && decoded.packing == ShaderRecompiler::ColorExportPacking::None) decoded.packing = ShaderRecompiler::ColorExportPacking::Uint;
+    return decoded;
+}
+
 
 ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allowMultisampleDcc) {
     const auto stride = slot * 0xfu;
@@ -1790,10 +1998,12 @@ ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allo
     const auto decoded = DecodeColorFormat(format, number, swap);
     const auto attrib = read(cx, 0x31d + stride);
     zero(cx, 0x31d + stride, ~0x3f000u, "color destination alpha override or other CB_COLOR_ATTRIB modes");
-    color.samples = 1u << ((attrib >> 12u) & 7u);
-    Require(color.samples <= 8u, "color targets with more than eight samples are unsupported");
-    Require((1u << ((attrib >> 15u) & 3u)) == color.samples, "color targets with fewer fragments than samples (EQAA) are unsupported");
-    const auto multisampleInfo = color.samples > 1 ? 0x0c006000u : 0u;
+    color.coverageSamples = 1u << ((attrib >> 12u) & 7u);
+    Require(color.coverageSamples <= 8u, "color targets with more than eight samples are unsupported");
+    color.samples = 1u << ((attrib >> 15u) & 3u);
+    Require(color.samples <= color.coverageSamples, "color targets with more fragments than samples are unsupported");
+    Require(color.samples == color.coverageSamples || color.samples == 1u, "color targets with more than one but fewer fragments than samples (EQAA) are unsupported");
+    const auto multisampleInfo = color.coverageSamples > 1 ? 0x0c006000u : 0u;
     // ROUND_MODE (bit 18) only affects unorm rounding and packed float truncation. With DCC_ENABLE (bit 28) the target is written
     if ((info & ~(0x00039f7cu | 0x00040000u | 0x10000000u | 0x00002000u | multisampleInfo)) != 0) throw std::runtime_error("AGC graphics: color compression, DCC, endian conversion, nonstandard rounding or color optimization is unsupported (CB_COLOR_INFO 0x" + [&] { char text[16]; std::snprintf(text, sizeof(text), "%08x", info); return std::string(text); }() + ")");
     Require((info & 0x8000u) != 0 || number <= 1u || number == 7 || number == 4 || number == 5, "unclamped normalized color is unsupported");
@@ -1883,8 +2093,9 @@ ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allo
     color.format = decoded.format;
     color.componentMapping = decoded.componentMapping;
     color.packing = decoded.packing;
-    if (color.packing != ShaderRecompiler::ColorExportPacking::None && (info & 0x10000000u) != 0) throw std::runtime_error("AGC graphics: DCC-compressed " + std::string(PackedColorTargetName(color.packing)) + " color targets are unsupported");
+    if (WordPacked(color.packing) && (info & 0x10000000u) != 0) throw std::runtime_error("AGC graphics: DCC-compressed " + std::string(PackedColorTargetName(color.packing)) + " color targets are unsupported");
     Require(color.packing != ShaderRecompiler::ColorExportPacking::Unorm10_11_11 || (info & 0x00040000u) == 0, "truncating (ROUND_MODE) 10_11_11 unorm color targets are unsupported");
+    Require(color.packing != ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 || (info & 0x00040000u) == 0, "truncating (ROUND_MODE) 4_4_4_4 unorm color targets are unsupported");
     Require(color.packing != ShaderRecompiler::ColorExportPacking::Float11_11_10 || (info & 0x00040000u) != 0, "rounding (ROUND_MODE 0) 11_11_10 float color targets are unsupported");
     for (std::uint32_t word = 0; word < 2; ++word) {
         const auto clear = find(cx, 0x323 + word + stride);
@@ -1932,10 +2143,16 @@ ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allo
             color.fmaskAddress = address - color.fmaskPipeBankXor;
         }
     }
+    if (color.coverageSamples > color.samples && (info & 0x4000u) != 0) {
+        const auto fmaskHigh = find(cx, 0x3a0 + slot);
+        color.fmaskAddress = (((fmaskHigh == cx.end() ? 0ull : static_cast<std::uint64_t>(fmaskHigh->second & 0xffu)) << 40u) | (static_cast<std::uint64_t>(read(cx, 0x321 + stride)) << 8u)) & ~0xffffull;
+        Require(color.fmaskAddress != 0, "a compressed one-fragment color target without an FMASK address is unsupported");
+    }
     if ((info & 0x10000000u) != 0) {
+        const auto dccHigh = find(cx, 0x3a8 + slot);
+        const auto dccBase = ((dccHigh == cx.end() ? 0ull : static_cast<std::uint64_t>(dccHigh->second & 0xffu)) << 40u) | (static_cast<std::uint64_t>(read(cx, 0x325 + stride)) << 8u);
         if (maxMip == 0) {
-            const auto dccHigh = find(cx, 0x3a8 + slot);
-            color.dccAddress = ((dccHigh == cx.end() ? 0ull : static_cast<std::uint64_t>(dccHigh->second & 0xffu)) << 40u) | (static_cast<std::uint64_t>(read(cx, 0x325 + stride)) << 8u);
+            color.dccAddress = dccBase;
             color.dccAlphaOnMsb = DccAlphaOnMsb(color.format, swap);
             color.dccPipeAligned = ((attrib3 >> 30u) & 1u) != 0;
             if (color.samples > 1) {
@@ -1943,11 +2160,15 @@ ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allo
                 color.dccControl = read(cx, 0x31e + stride);
                 if (!allowMultisampleDcc) Require((color.dccControl & 0x3ff80u) == 0, "multisampled DCC color transforms or lossy modes are not implemented");
             }
+        } else if (!volume && color.arrayLastSlice == 0 && slice == 0) {
+            color.chainDccAddress = dccBase;
+            color.dccAlphaOnMsb = DccAlphaOnMsb(color.format, swap);
+            color.dccPipeAligned = ((attrib3 >> 30u) & 1u) != 0;
         } else {
             static bool reported = false;
             if (!reported) {
                 reported = true;
-                std::fprintf(stderr, "[gpu] DCC keys of mipmapped color targets are ignored\n");
+                std::fprintf(stderr, "[gpu] DCC keys of mipmapped array and 3D color targets are ignored\n");
             }
         }
     }
@@ -1988,28 +2209,20 @@ std::optional<DepthCopyPass> DecodeDepthCopyPass(const QueueState& queue) {
     Require((control->second & ~0xf84u) == 0, "DB depth copy combined with a stencil copy, clear, resummarize or decompress");
     Require((read(cx, 0x200) & 0xfu) == 0, "DB depth copy with depth or stencil tests");
     Require((read(cx, 0x010) & 3u) == 3u, "DB depth copy from a depth plane that is not Z_32_FLOAT");
-    Require(ColorWriteMask(cx) == 1u, "DB depth copy into anything but the red channel of color target 0");
     const auto viewRegister = find(cx, 0x002);
-    const auto view = viewRegister == cx.end() ? 0u : viewRegister->second;
-    Require((read(cx, 0x010) & 0x000f1000u) == 0 && (view & 0x3c000000u) == 0, "DB depth copy from a mipmapped or partially resident depth plane");
+    Require((read(cx, 0x010) & 0x000f1000u) == 0 && ((viewRegister == cx.end() ? 0u : viewRegister->second) & 0x3c000000u) == 0, "DB depth copy from a mipmapped or partially resident depth plane");
+    Require(ColorWriteMask(cx) == 1u, "DB depth copy into anything but the red channel of color target 0");
+    Require((read(cx, 0x1e0) & (1u << 30u)) == 0, "DB depth copy with color target 0 blending is unsupported");
     DepthCopyPass pass{};
-    const auto high = find(cx, 0x01a);
-    pass.depthAddress = (high == cx.end() ? 0ull : static_cast<std::uint64_t>(high->second & 0xffu) << 40u) | (static_cast<std::uint64_t>(read(cx, 0x012)) << 8u);
-    const auto size = read(cx, 0x007);
-    pass.extent = {(size & 0x3fffu) + 1u, ((size >> 16u) & 0x3fffu) + 1u};
-    pass.samples = 1u << ((read(cx, 0x010) >> 2u) & 3u);
-    if (pass.samples != 1u) pass.depthAddress &= ~std::uint64_t{65535u};
-    if (const auto slice = view & 0x1fffu; slice != 0) pass.depthAddress += static_cast<std::uint64_t>(slice) * DepthSliceBytes(pass.extent, 4u);
+    pass.source = decodeDepthPlane(cx);
     const auto maskLow = find(cx, 0x30e);
     const auto maskHigh = find(cx, 0x30f);
     Require((maskLow == cx.end() || maskLow->second == 0xffffffffu) && (maskHigh == cx.end() || maskHigh->second == 0xffffffffu), "DB depth copy with a sample mask is unsupported");
     pass.sample = (control->second & 0x80u) != 0 ? 0u : (control->second >> 8u) & 0xfu;
-    Require(pass.sample < pass.samples, "DB depth copy of a sample the depth plane does not have");
+    Require(pass.sample < pass.source.samples, "DB depth copy of a sample the depth plane does not have");
     pass.color = DecodeColorBuffer(cx, 0);
     Require(pass.color.format == VK_FORMAT_R32_SFLOAT && pass.color.samples == 1 && pass.color.mip == 0 && pass.color.layers == 1, "DB depth copy into a color target that is not a single-sample R32 float");
-    Require(pass.color.extent.width == pass.extent.width && pass.color.extent.height == pass.extent.height, "DB depth copy into a color target of another size");
-    Require(pass.color.cmaskAddress == 0, "DB depth copy into a color target with CMASK fast clears is unsupported");
-    Require(drawCovers(cx, pass.extent), "DB depth copy over part of the depth surface");
+    Require(pass.color.extent.width == pass.source.extent.width && pass.color.extent.height == pass.source.extent.height, "DB depth copy into a color target of another size");
     return pass;
 }
 
@@ -2052,7 +2265,7 @@ std::optional<ColorMetadataPass> DecodeColorMetadataPass(const QueueState& queue
         Require(destination.samples == 1, "CB resolve into a multisampled target is unsupported");
         Require(destination.cmaskAddress == 0, "CB resolve into a fast-clear color target is unsupported (the resolve does not update its CMASK)");
         Require(source.format == destination.format && source.extent.width == destination.extent.width && source.extent.height == destination.extent.height, "CB resolve between different formats or extents is unsupported");
-        if (source.packing != ShaderRecompiler::ColorExportPacking::None) throw std::runtime_error("AGC graphics: CB resolves of " + std::string(PackedColorTargetName(source.packing)) + " color targets are unsupported");
+        if (WordPacked(source.packing)) throw std::runtime_error("AGC graphics: CB resolves of " + std::string(PackedColorTargetName(source.packing)) + " color targets are unsupported");
         requireCovered(destination);
         pass.source = source;
         pass.targets.push_back(destination);
@@ -2157,7 +2370,7 @@ std::string DrawRejection(const QueueState& queue, bool indexed) {
         if (auto reason = sampleMaskRejection(queue, config, word, other); !reason.empty()) return reason;
     }
     if (value(cx, 0x206, word) && word != 0x43fu) return vteMessage(word);
-    if (auto reason = nonzero(cx, 0x204, ClipControlMask, "unsupported PA_CL_CLIP_CNTL flags"); !reason.empty()) return reason;
+    if (auto reason = nonzero(cx, 0x204, ClipControlMask, "a PA_CL_CLIP_CNTL flag"); !reason.empty()) return reason;
     std::uint32_t targetMask = 0, shaderMask = 0;
     if (value(cx, 0x8e, targetMask) && value(cx, 0x8f, shaderMask) && value(cx, 0x202, word) && !colorControlSupported(word, ColorWriteMask(cx) != 0)) return colorControlMessage(word);
     if (auto reason = nonzero(cx, 0x1c4, zFormatSupported(zFormat) ? 0u : ~0u, "depth or sample-mask export"); !reason.empty()) return reason;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp
index 893a24eaa1..ada06eab1e 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp
@@ -48,8 +48,8 @@ OwnedImage::~OwnedImage() {
     ReleaseImageMemory(context, memory, memoryBytes, memoryType);
 }
 
-void OwnedImage::Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation) {
-    memory = AllocateImageMemory(device, allocation, mask, operation, &memoryType);
+void OwnedImage::Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, bool newImage) {
+    memory = AllocateImageMemory(device, allocation, mask, operation, &memoryType, newImage);
     memoryBytes = allocation.allocationSize;
     context.bufferPool = device.bufferPool;
 }
@@ -123,6 +123,7 @@ struct StorageTraffic {
     std::map<std::string, std::pair<std::uint64_t, std::uint64_t>> writeBacks;
     std::array<std::pair<std::uint64_t, std::uint64_t>, 4> uploads{};
     std::map<std::string, std::pair<std::uint64_t, std::uint64_t>> uploadReasons;
+    std::map<std::string, std::pair<std::uint64_t, std::uint64_t>> drawnStores;
     std::uint64_t directWriteBacks = 0;
     std::chrono::steady_clock::time_point lastReport = std::chrono::steady_clock::now();
 };
@@ -132,6 +133,14 @@ StorageTraffic& Traffic() {
     return traffic;
 }
 
+struct DrawnPending {
+    std::size_t images = 0;
+    std::uint64_t bytes = 0;
+    double oldestMs = 0;
+};
+
+DrawnPending drawnPending();
+
 void reportStorageTraffic(StorageTraffic& traffic) {
     const auto now = std::chrono::steady_clock::now();
     if (now - traffic.lastReport < std::chrono::seconds(10)) return;
@@ -154,12 +163,19 @@ void reportStorageTraffic(StorageTraffic& traffic) {
         std::snprintf(text, sizeof(text), " %llu/%.1f", static_cast<unsigned long long>(totals.first), totals.second / 1048576.0);
         line += " " + reason + text;
     }
+    std::string drawnLine;
+    for (const auto& [reason, totals] : traffic.drawnStores) {
+        std::snprintf(text, sizeof(text), " %llu/%.1f", static_cast<unsigned long long>(totals.first), totals.second / 1048576.0);
+        drawnLine += " " + reason + text;
+    }
+    const auto drawn = drawnPending();
     const auto take = [](std::atomic<std::uint64_t>& counter) { return static_cast<unsigned long long>(counter.exchange(0, std::memory_order_relaxed)); };
     const auto partialUploadCount = take(partialUploads), partialWriteBackCount = take(partialWriteBacks);
     const auto uploadMiB = take(partialUploadBytes) / 1048576.0, writeBackMiB = take(partialWriteBackBytes) / 1048576.0;
-    AgcDriver::ProfilePrint_nid_no_patch( "[storage] uploads by path (count/MiB, 10 s):%s; %llu write-backs GPU-direct, %llu stored nothing; block units: partial uploads %llu/%.1f, partial write-backs %llu/%.1f, %llu widened to every pending unit, units dropped %llu, superseded %llu, handed over at %llu clear-key refreshes (%llu units superseded), dropped unregistered %llu, kept over a key flip %llu%s, pretest skipped %llu, held for a queued draw read %llu, evicted stale %llu\n", line.c_str(), static_cast<unsigned long long>(traffic.directWriteBacks), take(emptyWriteBacks), partialUploadCount, uploadMiB, partialWriteBackCount, writeBackMiB, take(coalescedWriteBacks), take(unitsDropped), take(unitsSuperseded), take(clearHandOvers), take(handedOverSuperseded), take(unregisteredDropped), take(keyFlipKept), ShadowReport().c_str(), take(pretestSkipped), take(queuedReadHeld), take(staleEvicted));
+    AgcDriver::ProfilePrint_nid_no_patch( "[storage] uploads by path (count/MiB, 10 s):%s; %llu write-backs GPU-direct, %llu stored nothing; block units: partial uploads %llu/%.1f, partial write-backs %llu/%.1f, %llu widened to every pending unit, units dropped %llu, superseded %llu, handed over at %llu clear-key refreshes (%llu units superseded), dropped unregistered %llu, kept over a key flip %llu%s, pretest skipped %llu, held for a queued draw read %llu, evicted stale %llu; drawn linear targets: stores by reason (count/MiB):%s, pending %zu images / %.1f MiB, oldest %.1f ms\n", line.c_str(), static_cast<unsigned long long>(traffic.directWriteBacks), take(emptyWriteBacks), partialUploadCount, uploadMiB, partialWriteBackCount, writeBackMiB, take(coalescedWriteBacks), take(unitsDropped), take(unitsSuperseded), take(clearHandOvers), take(handedOverSuperseded), take(unregisteredDropped), take(keyFlipKept), ShadowReport().c_str(), take(pretestSkipped), take(queuedReadHeld), take(staleEvicted), drawnLine.c_str(), drawn.images, drawn.bytes / 1048576.0, drawn.oldestMs);
     traffic.writeBacks.clear();
     traffic.uploadReasons.clear();
+    traffic.drawnStores.clear();
     traffic.directWriteBacks = 0;
 }
 
@@ -175,7 +191,7 @@ void countStorageUpload(std::size_t path, std::uint64_t bytes) {
     reportStorageTraffic(traffic);
 }
 
-void countStorageWriteBack(std::uint64_t bytes, bool direct) {
+void countStorageWriteBack(std::uint64_t bytes, bool direct, bool drawn = false) {
     if (!LookupOutcomes::Profiled()) return;
     auto& traffic = Traffic();
     std::lock_guard lock(traffic.mutex);
@@ -183,6 +199,11 @@ void countStorageWriteBack(std::uint64_t bytes, bool direct) {
     ++totals.first;
     totals.second += bytes;
     if (direct) ++traffic.directWriteBacks;
+    if (drawn) {
+        auto& stores = traffic.drawnStores[flushReason != nullptr ? flushReason : "other"];
+        ++stores.first;
+        stores.second += bytes;
+    }
     reportStorageTraffic(traffic);
 }
 
@@ -282,7 +303,7 @@ ExpandImage CreateExpandImage(const Context& context, const GuestTextureResource
     VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
     allocation.allocationSize = requirements.size;
     allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "texture");
-    result.owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory sRGB copy");
+    result.owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory sRGB copy", true);
     Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, result.image, result.owned->memory, 0), "vkBindImageMemory sRGB copy");
     result.bytes = requirements.size;
     return result;
@@ -366,7 +387,7 @@ Texture::Texture(const Context& context, TextureDetiler& detiler, const GuestTex
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "texture");
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory texture");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory texture", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory");
 
         const VkImage uploadImage = image;
@@ -642,7 +663,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory repacked copy");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory repacked copy", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory repacked copy");
 
         const auto viewLevelCount = std::min(descriptor.lastLevel, descriptor.mipCount - 1u) - descriptor.baseLevel + 1u;
@@ -689,6 +710,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         imageInfo.arrayLayers = copyLayers;
         imageInfo.samples = VK_SAMPLE_COUNT_1_BIT;
         imageInfo.tiling = VK_IMAGE_TILING_OPTIMAL;
+        imageInfo.flags = SrgbTwinFormat(context, blockFormat) != VK_FORMAT_UNDEFINED ? VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT : 0u;
         imageInfo.usage = VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_SAMPLED_BIT;
         imageInfo.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
         imageInfo.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
@@ -700,7 +722,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory block copy");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory block copy", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory block copy");
 
         const auto viewLevelCount = std::min(descriptor.lastLevel, descriptor.mipCount - 1u) - descriptor.baseLevel + 1u;
@@ -718,6 +740,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         viewRange = {viewInfo.viewType, viewInfo.subresourceRange.levelCount, viewInfo.subresourceRange.layerCount};
         createFirstLayerView(descriptor, viewInfo);
         prepareBaseLevelView(descriptor, viewInfo);
+        prepareSrgbView(descriptor, viewInfo);
     } catch (...) {
         release();
         throw;
@@ -758,7 +781,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth copy");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth copy", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory depth copy");
 
         const auto viewLevelCount = std::min(descriptor.lastLevel, descriptor.mipCount - 1u) - descriptor.baseLevel + 1u;
@@ -1331,7 +1354,10 @@ VkFormat SrgbTwinFormat(const Context& context, VkFormat format) {
     switch (format) {
         case VK_FORMAT_R8_UNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8_SRGB;
         case VK_FORMAT_R8G8_UNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8_8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8G8_SRGB;
-        case VK_FORMAT_R8G8B8A8_UNORM: return VK_FORMAT_R8G8B8A8_SRGB;
+        case VK_FORMAT_R8_SNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8_SRGB;
+        case VK_FORMAT_R8G8_SNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8_8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8G8_SRGB;
+        case VK_FORMAT_R8G8B8A8_UNORM:
+        case VK_FORMAT_R8G8B8A8_SNORM: return VK_FORMAT_R8G8B8A8_SRGB;
         case VK_FORMAT_B8G8R8A8_UNORM: return VK_FORMAT_B8G8R8A8_SRGB;
         case VK_FORMAT_A8B8G8R8_UNORM_PACK32: return VK_FORMAT_A8B8G8R8_SRGB_PACK32;
         case VK_FORMAT_BC1_RGB_UNORM_BLOCK: return VK_FORMAT_BC1_RGB_SRGB_BLOCK;
@@ -1450,7 +1476,7 @@ StorageTexture::StorageTexture(const Context& context, TextureDetiler& detiler,
         allocation.allocationSize = requirements.size;
         memoryBytes = requirements.size;
         allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "storage texture");
-        memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory storage texture", &memoryType);
+        memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory storage texture", &memoryType, true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory storage");
     } catch (...) {
         release();
@@ -1533,6 +1559,13 @@ struct PendingWrites {
     // Images taken out of `textures` by a FlushPending still storing them (see adjacentPendingUnchanged).
     std::vector<StorageTexture*> flushing;
     std::atomic<std::size_t> flushingCount{0};
+    struct Drawn {
+        StorageTexture* texture;
+        std::uint64_t bytes;
+        std::chrono::steady_clock::time_point since;
+    };
+    std::vector<Drawn> drawn;
+    std::atomic<std::size_t> drawnCount{0};
 };
 
 PendingWrites& Pending() {
@@ -1540,6 +1573,20 @@ PendingWrites& Pending() {
     return pending;
 }
 
+DrawnPending drawnPending() {
+    DrawnPending result;
+    auto& pending = Pending();
+    if (pending.drawnCount.load(std::memory_order_acquire) == 0) return result;
+    const auto now = std::chrono::steady_clock::now();
+    std::lock_guard lock(pending.mutex);
+    result.images = pending.drawn.size();
+    for (const auto& entry : pending.drawn) {
+        result.bytes += entry.bytes;
+        result.oldestMs = std::max(result.oldestMs, std::chrono::duration<double, std::milli>(now - entry.since).count());
+    }
+    return result;
+}
+
 // See StorageTexture::PendingSerial: bumped after every mutation of the registry above.
 std::atomic<std::uint64_t> pendingSerial{0};
 
@@ -2061,16 +2108,22 @@ bool StorageTexture::Refresh() {
 }
 
 bool StorageTexture::RefreshLayers(std::uint32_t first, std::uint32_t count) {
-    if (count == 0 || geometry.thick || geometry.imageLayers <= 1 || first >= geometry.imageLayers || count > geometry.imageLayers - first || geometry.layerBytes == 0 || trackedLayerBytes == 0 || descriptor.dccAddress != 0) return Refresh();
+    const auto whole = [this] {
+        static_cast<void>(FlushDepthPlanes(descriptor.baseAddress, static_cast<std::size_t>(guestBytes)));
+        return Refresh();
+    };
+    if (count == 0 || geometry.thick || geometry.imageLayers <= 1 || first >= geometry.imageLayers || count > geometry.imageLayers - first || geometry.layerBytes == 0 || trackedLayerBytes == 0 || descriptor.dccAddress != 0) return whole();
     const auto begin = geometry.GuestLayerOffset(first);
     const auto end = geometry.GuestLayerOffset(first + count - 1) + geometry.layerBytes;
     const auto firstLayer = static_cast<std::uint32_t>(begin / trackedLayerBytes);
     const auto lastLayer = static_cast<std::uint32_t>(std::min<std::uint64_t>((end + trackedLayerBytes - 1) / trackedLayerBytes, trackedLayers));
-    if (firstLayer >= lastLayer || (firstLayer == 0 && lastLayer == trackedLayers)) return Refresh();
+    if (firstLayer >= lastLayer || (firstLayer == 0 && lastLayer == trackedLayers)) return whole();
     for (std::uint32_t layer = 0; layer < trackedLayers; ++layer) {
-        if (layerPending[layer] && (layer < firstLayer || layer >= lastLayer)) return Refresh();
+        if (layerPending[layer] && (layer < firstLayer || layer >= lastLayer)) return whole();
     }
-    if (pendingAlias() != nullptr) return Refresh();
+    if (pendingAlias() != nullptr) return whole();
+    const auto scopeBegin = layerBegin(firstLayer);
+    static_cast<void>(FlushDepthPlanes(scopeBegin, static_cast<std::size_t>(layerBegin(lastLayer - 1) + layerBytes(lastLayer - 1) - scopeBegin)));
     return refresh(firstLayer, lastLayer);
 }
 
@@ -3583,7 +3636,7 @@ std::uint64_t StorageTexture::writeBackWindows(std::span<const ImportSegment> se
         toRead.dstAccessMask = VK_ACCESS_SHADER_READ_BIT;
         toRead.newLayout = VK_IMAGE_LAYOUT_GENERAL;
         const BarrierMask ready{VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, importReady.srcAccessMask | toRead.srcAccessMask, importReady.dstAccessMask | toRead.dstAccessMask, toRead.oldLayout != toRead.newLayout, toRead.srcQueueFamilyIndex != toRead.dstQueueFamilyIndex};
-        const bool ordered = recorder != nullptr && seeds.empty() && padding.copies.empty() && Recorder::ElideCovered(Recorder::CommandClass::StorageWriteBack, ready, covered);
+        const bool ordered = recorder != nullptr && seeds.empty() && padding.copies.empty() && holeCopies.empty() && Recorder::ElideCovered(Recorder::CommandClass::StorageWriteBack, ready, covered);
         if (!ordered) context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, 0, 1, &importReady, 0, nullptr, 1, &toRead);
         for (std::size_t i = 0; i < windows.size(); ++i) {
             const auto& window = windows[i];
@@ -3793,7 +3846,13 @@ void StorageTexture::markLayersPending(std::uint32_t first, std::uint32_t count)
         }
     }
     if (anyUnsaved && !GuestMemory::Watched(descriptor.baseAddress, static_cast<std::size_t>(guestBytes))) captureGuestBytes(&unsaved);
-    for (std::uint32_t layer = first; layer < first + count; ++layer) layerPending[layer] = true;
+    for (std::uint32_t layer = first; layer < first + count; ++layer) {
+        if (!layerPending[layer] && !completionKept.empty()) {
+            const auto end = layerBegin(layer) + layerBytes(layer);
+            for (auto at = layerBegin(layer) & ~std::uint64_t{65535}; at < end; at += 65536) completionKept[static_cast<std::size_t>(at / 65536 - descriptor.baseAddress / 65536)] = 0;
+        }
+        layerPending[layer] = true;
+    }
     // Results of this image now cover the alias's results borrowed into these units: this image
     // stores them, the alias no longer has to (its results, unchanged since the borrow, are in
     // this image's content). An alias written since keeps its own newer results pending.
@@ -3816,6 +3875,10 @@ void StorageTexture::markLayersPending(std::uint32_t first, std::uint32_t count)
     }
     auto& pending = Pending();
     std::lock_guard lock(pending.mutex);
+    if (!drawingTarget) {
+        pendingFromOthers = true;
+        if (drawnListed) drawnWhole = true;
+    }
     // The active recorder installs a hook that also waits for recorded work; without one (tests),
     // pending storage results alone are flushed.
     if (Recorder::Active() == nullptr) {
@@ -3840,6 +3903,7 @@ void StorageTexture::reconcilePending() {
     auto& pending = Pending();
     std::lock_guard lock(pending.mutex);
     const bool any = anyLayerPending();
+    if (!any) forgetDrawn();
     if (any == dirty) return;
     dirty = any;
     if (any) pending.textures.push_back(this);
@@ -3853,6 +3917,215 @@ bool StorageTexture::Dirty() const {
     return dirty;
 }
 
+constexpr std::size_t MaxDrawnRects = 16;
+
+bool StorageTexture::MarkDrawn(std::uint32_t slice, std::uint32_t count, VkRect2D scissor) {
+    struct Drawing {
+        bool& flag;
+        bool previous;
+        ~Drawing() { flag = previous; }
+    } drawing{drawingTarget, std::exchange(drawingTarget, true)};
+    MarkSliceDirty(slice, count);
+    const auto clip = [](std::int64_t value, std::uint32_t limit) { return static_cast<std::uint32_t>(std::clamp<std::int64_t>(value, 0, limit)); };
+    const auto left = clip(scissor.offset.x, descriptor.width);
+    const auto top = clip(scissor.offset.y, descriptor.height);
+    const auto right = clip(std::int64_t{scissor.offset.x} + scissor.extent.width, descriptor.width);
+    const auto bottom = clip(std::int64_t{scissor.offset.y} + scissor.extent.height, descriptor.height);
+    const bool rectangle = proxyImage == VK_NULL_HANDLE && descriptor.tileMode == TextureTileMode::kLinear && !blockUnits && trackedLayers == 1 && descriptor.mipCount == 1 && arrayLayers == 1 && geometry.imageLayers == 1 && geometry.imageDepth == 1 && !geometry.thick && descriptor.dccAddress == 0;
+    auto& pending = Pending();
+    std::lock_guard lock(pending.mutex);
+    if (!anyLayerPending()) return true;
+    if (!drawnListed) {
+        drawnListed = true;
+        drawnWhole = false;
+        drawnRects.clear();
+        pending.drawn.push_back({this, guestBytes, std::chrono::steady_clock::now()});
+        pending.drawnCount.store(pending.drawn.size(), std::memory_order_release);
+    }
+    if (!rectangle || pendingFromOthers) drawnWhole = true;
+    if (!drawnWhole && right > left && bottom > top) addDrawnRect({left, top, right, bottom});
+    return !drawnWhole && drawnRects.size() <= MaxDrawnRects;
+}
+
+void StorageTexture::addDrawnRect(DrawnRect rect) {
+    const auto inside = [](const DrawnRect& outer, const DrawnRect& inner) { return outer.left <= inner.left && outer.top <= inner.top && inner.right <= outer.right && inner.bottom <= outer.bottom; };
+    if (std::any_of(drawnRects.begin(), drawnRects.end(), [&](const DrawnRect& kept) { return inside(kept, rect); })) return;
+    for (auto kept = drawnRects.begin(); kept != drawnRects.end();) {
+        const bool columns = kept->left == rect.left && kept->right == rect.right && kept->top <= rect.bottom && rect.top <= kept->bottom;
+        const bool rows = kept->top == rect.top && kept->bottom == rect.bottom && kept->left <= rect.right && rect.left <= kept->right;
+        if (!columns && !rows && !inside(rect, *kept)) {
+            ++kept;
+            continue;
+        }
+        rect = {std::min(kept->left, rect.left), std::min(kept->top, rect.top), std::max(kept->right, rect.right), std::max(kept->bottom, rect.bottom)};
+        drawnRects.erase(kept);
+        kept = drawnRects.begin();
+    }
+    drawnRects.push_back(rect);
+}
+
+void StorageTexture::forgetDrawn() {
+    pendingFromOthers = false;
+    if (!drawnListed) return;
+    drawnListed = false;
+    drawnWhole = false;
+    drawnRects.clear();
+    auto& pending = Pending();
+    std::erase_if(pending.drawn, [this](const PendingWrites::Drawn& entry) { return entry.texture == this; });
+    pending.drawnCount.store(pending.drawn.size(), std::memory_order_release);
+}
+
+void StorageTexture::noteStore(std::uint64_t note) {
+    if (note == 0) return;
+    auto& pending = Pending();
+    std::lock_guard lock(pending.mutex);
+    storeNotes.push_back(note);
+    if (storeNotes.size() > 8) storeNotes.erase(storeNotes.begin());
+}
+
+StorageTexture::DrawnArea StorageTexture::drawnArea() const {
+    auto& pending = Pending();
+    std::lock_guard lock(pending.mutex);
+    if (!drawnListed) return {};
+    DrawnArea area{true, !drawnWhole && !pendingFromOthers};
+    if (!area.rect || drawnRects.empty()) return area;
+    area.left = area.top = std::numeric_limits<std::uint32_t>::max();
+    for (const auto& rect : drawnRects) {
+        area.left = std::min(area.left, rect.left);
+        area.top = std::min(area.top, rect.top);
+        area.right = std::max(area.right, rect.right);
+        area.bottom = std::max(area.bottom, rect.bottom);
+    }
+    area.rects = drawnRects;
+    return area;
+}
+
+std::vector<std::pair<std::uint64_t, std::uint64_t>> StorageTexture::drawnSpans(const DrawnArea& area, std::span<const std::pair<std::uint64_t, std::uint64_t>> keep) const {
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> spans;
+    if (area.rects.empty()) return spans;
+    const auto& mip = mips.front();
+    const auto elementBytes = static_cast<std::uint64_t>(BytesPerElement(descriptor.format));
+    const auto rowBase = descriptor.baseAddress + mip.tiledOffset;
+    std::vector<std::pair<std::uint32_t, std::uint32_t>> columns;
+    std::size_t next = 0;
+    for (auto row = area.top; row < area.bottom; ++row) {
+        columns.clear();
+        for (const auto& rect : area.rects) {
+            if (rect.top <= row && row < rect.bottom) columns.emplace_back(rect.left, rect.right);
+        }
+        std::sort(columns.begin(), columns.end());
+        const auto rowStart = rowBase + std::uint64_t{row} * mip.pitchBytes;
+        for (std::size_t first = 0; first < columns.size();) {
+            auto right = columns[first].second;
+            auto last = first + 1;
+            for (; last < columns.size() && columns[last].first <= right; ++last) right = std::max(right, columns[last].second);
+            const auto rowBegin = rowStart + columns[first].first * elementBytes;
+            const auto rowEnd = rowStart + right * elementBytes;
+            first = last;
+            while (next < keep.size() && keep[next].second <= rowBegin) ++next;
+            for (auto index = next; index < keep.size() && keep[index].first < rowEnd; ++index) {
+                const auto from = std::max(rowBegin, keep[index].first);
+                const auto to = std::min(rowEnd, keep[index].second);
+                if (from < to) spans.emplace_back(from, to);
+            }
+        }
+    }
+    return spans;
+}
+
+std::uint64_t StorageTexture::storeDrawnRect(const DrawnArea& area, std::span<const ImportSegment> segments, std::span<const std::pair<std::uint64_t, std::uint64_t>> stores, const std::vector<std::uint32_t>& saveUnits) {
+    const auto& mip = mips.front();
+    const auto elementBytes = static_cast<std::uint64_t>(BytesPerElement(descriptor.format));
+    const auto rowBase = descriptor.baseAddress + mip.tiledOffset;
+    const auto width = area.right - area.left;
+    const auto height = area.bottom - area.top;
+    const auto rowBytes = std::uint64_t{width} * elementBytes;
+    const auto hullBegin = stores.front().first;
+    const auto hullBytes = static_cast<std::size_t>(stores.back().second - hullBegin);
+    std::uint64_t storedBytes = 0;
+    for (const auto& [from, to] : stores) storedBytes += to - from;
+    auto scratch = std::make_shared<DeviceBuffer>(context, static_cast<std::size_t>(rowBytes * height), VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT);
+    auto* recorder = Recorder::Active();
+    std::unique_ptr<CommandBatch> batch;
+    VkCommandBuffer commands = VK_NULL_HANDLE;
+    auto timing = Recorder::NoTiming;
+    if (recorder != nullptr) {
+        recorder->FlushKeyStoresOverlapping(hullBegin, hullBytes);
+        recorder->FlushStoresOverlapping(hullBegin, hullBytes);
+        commands = recorder->Commands();
+        timing = recorder->BeginGpuTiming(Recorder::CommandClass::StorageWriteBack);
+        recorder->Keep(scratch, scratch->Size());
+        if (auto self = weak_from_this().lock()) keepStorageTexture(*recorder, std::move(self));
+        Recorder::CountBarriers(Recorder::CommandClass::StorageWriteBack, 3);
+        if (Recorder::BarrierValidate()) {
+            const std::pair<VkImage, bool> read{image, false};
+            recorder->NoteAccess(Recorder::CommandClass::StorageWriteBack, Recorder::Access{{}, stores, std::span(&read, 1), VK_PIPELINE_STAGE_TRANSFER_BIT});
+        }
+    } else {
+        batch = std::make_unique<CommandBatch>(context);
+        commands = batch->Handle();
+    }
+    VkImageMemoryBarrier toSource{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
+    toSource.srcAccessMask = VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT;
+    toSource.dstAccessMask = VK_ACCESS_TRANSFER_READ_BIT;
+    toSource.oldLayout = VK_IMAGE_LAYOUT_GENERAL;
+    toSource.newLayout = VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL;
+    toSource.srcQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+    toSource.dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+    toSource.image = image;
+    toSource.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, descriptor.mipCount, 0, geometry.imageLayers};
+    const VkMemoryBarrier importReady{VK_STRUCTURE_TYPE_MEMORY_BARRIER, nullptr, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_HOST_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT};
+    context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 1, &importReady, 0, nullptr, 1, &toSource);
+    VkBufferImageCopy region{};
+    region.imageSubresource = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 0, 1};
+    region.imageOffset = {static_cast<std::int32_t>(area.left), static_cast<std::int32_t>(area.top), 0};
+    region.imageExtent = {width, height, 1u};
+    context.Function<PFN_vkCmdCopyImageToBuffer>("vkCmdCopyImageToBuffer")(commands, image, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL, scratch->Handle(), 1, &region);
+    const auto scratchRead = WholeBufferBarrier(scratch->Handle(), VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT);
+    context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 0, nullptr, 1, &scratchRead, 0, nullptr);
+    const auto scratchOffset = [&](std::uint64_t address) {
+        const auto offset = address - rowBase;
+        const auto row = offset / mip.pitchBytes;
+        return (row - area.top) * rowBytes + offset - row * mip.pitchBytes - area.left * elementBytes;
+    };
+    const auto copyBuffer = context.Function<PFN_vkCmdCopyBuffer>("vkCmdCopyBuffer");
+    for (const auto& segment : segments) {
+        std::vector<VkBufferCopy> copies;
+        for (const auto& [from, to] : stores) {
+            const auto begin = std::max(from, segment.begin);
+            const auto end = std::min(to, segment.end);
+            if (begin < end) copies.push_back({scratchOffset(begin), HostImportOffset(*segment.import, begin), end - begin});
+        }
+        if (!copies.empty()) copyBuffer(commands, scratch->Handle(), segment.import->buffer, static_cast<std::uint32_t>(copies.size()), copies.data());
+    }
+    if (!saveUnits.empty()) {
+        const auto saved = savedBytes->Bytes();
+        for (const auto unit : saveUnits) {
+            const auto offset = static_cast<std::size_t>(layerBegin(unit) - descriptor.baseAddress);
+            std::memcpy(saved.data() + offset, original.data() + offset, static_cast<std::size_t>(layerBytes(unit)));
+        }
+        std::vector<VkBufferCopy> saves;
+        for (const auto& [from, to] : stores) saves.push_back({scratchOffset(from), from - descriptor.baseAddress, to - from});
+        copyBuffer(commands, scratch->Handle(), savedBytes->Handle(), static_cast<std::uint32_t>(saves.size()), saves.data());
+    }
+    VkImageMemoryBarrier backToGeneral = toSource;
+    backToGeneral.srcAccessMask = VK_ACCESS_TRANSFER_READ_BIT;
+    backToGeneral.dstAccessMask = VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT;
+    backToGeneral.oldLayout = VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL;
+    backToGeneral.newLayout = VK_IMAGE_LAYOUT_GENERAL;
+    const VkMemoryBarrier stored{VK_STRUCTURE_TYPE_MEMORY_BARRIER, nullptr, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_HOST_READ_BIT};
+    context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, 0, 1, &stored, 0, nullptr, 1, &backToGeneral);
+    if (batch) {
+        batch->SubmitAndWait();
+        return storedBytes;
+    }
+    recorder->EndGpuTiming(timing, storedBytes);
+    recorder->MarkShaderReadsCovered();
+    recorder->NotePendingWrite(hullBegin, hullBytes);
+    noteStore(recorder->LastWriteNote(hullBegin, hullBytes));
+    return storedBytes;
+}
+
 void StorageTexture::Flush() {
     {
         auto& live = Live();
@@ -3903,13 +4176,38 @@ void waitForIdlePublish(const char* reason) {
 bool StorageTexture::FlushPending(std::uint64_t address, std::size_t bytes, const StorageTexture* except, const char* reason, PublishScope scope, bool* published, bool waited) {
     static_cast<void>(FlushDepthPlanes(address, bytes));
     if (published != nullptr) *published = false;
+    const auto nothingToStore = [&] {
+        auto& pending = Pending();
+        if (pending.flushingCount.load(std::memory_order_acquire) != 0) return false;
+        if (!pending.textures.SurelyClear(address, bytes)) {
+            std::lock_guard lock(pending.mutex);
+            const auto* exempt = refreshing;
+            if (pending.textures.MayOverlap(address, bytes) && std::any_of(pending.textures.begin(), pending.textures.end(), [&](const StorageTexture* texture) { return texture != except && texture != exempt && texture->overlaps(address, bytes) && texture->pendingUnitInside(address, bytes); })) return false;
+            if (pending.flushingCount.load(std::memory_order_acquire) != 0) return false;
+        }
+        return scope == PublishScope::None || !AnyShadowedOverlaps(address, bytes);
+    };
+    if (nothingToStore()) return false;
     if (AgcDriver::DriverDetail::DrawPipeline::HeldReads(address, bytes)) {
         queuedReadHeld.fetch_add(1, std::memory_order_relaxed);
         return false;
     }
+    std::unique_lock<GuestMemory::GpuMutexType> drawnHold;
+    if (auto& drawnPending = Pending(); drawnPending.drawnCount.load(std::memory_order_acquire) != 0 && !GuestMemory::GpuMutex().HeldByThisThread()) {
+        bool overlap = false;
+        {
+            std::lock_guard lock(drawnPending.mutex);
+            overlap = std::any_of(drawnPending.drawn.begin(), drawnPending.drawn.end(), [&](const PendingWrites::Drawn& entry) { return entry.texture->dirty && entry.texture->overlaps(address, bytes); });
+        }
+        if (overlap) {
+            GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Flush);
+            drawnHold = std::unique_lock(GuestMemory::GpuMutex());
+        }
+    }
     // The images stay alive across the scan: their last owner may be a batch's kept list, which
     // another thread releases outside the GPU mutex once the batch completed.
     std::vector<std::shared_ptr<StorageTexture>> flush;
+    std::vector<std::uint64_t> ownNotes;
     {
         auto& pending = Pending();
         std::lock_guard lock(pending.mutex);
@@ -3937,8 +4235,12 @@ bool StorageTexture::FlushPending(std::uint64_t address, std::size_t bytes, cons
         for (const auto& texture : flush) pending.flushing.push_back(texture.get());
         pending.flushingCount.store(pending.flushing.size(), std::memory_order_release);
         if (!flush.empty()) BumpPendingSerial();
+        for (const auto& texture : flush) {
+            if (texture->drawnListed) ownNotes.insert(ownNotes.end(), texture->storeNotes.begin(), texture->storeNotes.end());
+        }
     }
     if (flush.empty()) {
+        if (drawnHold.owns_lock()) drawnHold.unlock();
         const bool stored = WaitForFlushing(address, bytes, except);
         // Units shadowed over the range (another image's results retiled into the import's unit
         // shadow, or an earlier flush's) still reach the import as the scope asks.
@@ -3962,10 +4264,11 @@ bool StorageTexture::FlushPending(std::uint64_t address, std::size_t bytes, cons
         for (const auto& texture : flush) std::fprintf(stderr, "[flush] image 0x%llx+0x%llx for %s 0x%llx+0x%zx\n", static_cast<unsigned long long>(texture->descriptor.baseAddress), static_cast<unsigned long long>(texture->guestBytes), reason, static_cast<unsigned long long>(address), bytes);
     }
     std::lock_guard gpu(GuestMemory::GpuMutex());
-    if (auto* recorder = Recorder::Active(); recorder != nullptr && !Recorder::InCompletion() && recorder->PendingWriterSerial(address, bytes) != 0) {
+    if (!ownNotes.empty() && (flush.size() != 1 || std::any_of(flush.begin(), flush.end(), [](const std::shared_ptr<StorageTexture>& texture) { return ExistingHostImportFor(texture->context, texture->descriptor.baseAddress, static_cast<std::size_t>(texture->guestBytes)) == nullptr; }))) ownNotes.clear();
+    if (auto* recorder = Recorder::Active(); recorder != nullptr && !Recorder::InCompletion() && recorder->PendingWriterSerial(address, bytes, ownNotes) != 0) {
         try {
             recorder->Reap();
-            if (const auto writer = recorder->PendingWriterSerial(address, bytes); writer == recorder->OpenSerial()) {
+            if (const auto writer = recorder->PendingWriterSerial(address, bytes, ownNotes); writer == recorder->OpenSerial()) {
                 Recorder::CountSync(recorder->OpenWriteOverlaps(address, bytes) ? 1 : 3);
                 recorder->Sync();
             } else if (writer != 0) {
@@ -4075,7 +4378,8 @@ void StorageTexture::saveBeforeUnwatch() {
         const auto end = begin + layerBytes(unit);
         const auto spanBegin = begin & ~(block - 1);
         const auto spanBlocks = static_cast<std::size_t>((end - spanBegin + block - 1) / block);
-        const std::vector<std::uint64_t> generations(spanBlocks, layerGeneration[unit]);
+        std::vector<std::uint64_t> generations(spanBlocks);
+        for (std::size_t k = 0; k < spanBlocks; ++k) generations[k] = unitBlockGeneration(unit, spanBegin + k * block);
         std::vector<std::uint8_t> changedBlocks(spanBlocks);
         if (!GuestMemory::ChangedBlocks(begin, static_cast<std::size_t>(end - begin), generations, changedBlocks)) continue;
         forgetKeptAtUnwatch(unit);
@@ -4083,7 +4387,7 @@ void StorageTexture::saveBeforeUnwatch() {
             const auto from = std::max(at, begin);
             const auto to = std::min(at + block, end);
             const bool edge = from != at || to != at + block;
-            if (changedBlocks[static_cast<std::size_t>((at - spanBegin) / block)] == GuestMemory::BlockWritten && (!edge || GuestMemory::StoredOver(from, static_cast<std::size_t>(to - from), layerGeneration[unit])) && !unchangedSinceBaseline(from, to)) keptAtUnwatch.emplace(from, layerGeneration[unit]);
+            if (changedBlocks[static_cast<std::size_t>((at - spanBegin) / block)] == GuestMemory::BlockWritten && (!edge || GuestMemory::StoredOver(from, static_cast<std::size_t>(to - from), unitBlockGeneration(unit, at))) && !unchangedSinceBaseline(from, to)) keptAtUnwatch.emplace(from, layerGeneration[unit]);
         }
         layerOriginal[unit] = true;
         cancelStoredSave(unit);
@@ -4247,6 +4551,49 @@ void StorageTexture::StoreReadbackBeforeLabel(const char* reason) {
     for (const auto& [address, bytes] : ranges) static_cast<void>(FlushPending(address, bytes, nullptr, reason));
 }
 
+std::size_t StorageTexture::StoreDrawnLinear(const char* reason) {
+    auto& pending = Pending();
+    if (pending.drawnCount.load(std::memory_order_acquire) == 0 || Recorder::InCompletion()) return 0;
+    GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Flush);
+    std::lock_guard gpu(GuestMemory::GpuMutex());
+    std::vector<std::pair<std::uint64_t, std::size_t>> ranges;
+    {
+        std::lock_guard lock(pending.mutex);
+        for (const auto& entry : pending.drawn) {
+            if (entry.texture->dirty) ranges.emplace_back(entry.texture->descriptor.baseAddress, static_cast<std::size_t>(entry.texture->guestBytes));
+        }
+    }
+    std::size_t stored = 0;
+    for (const auto& [address, bytes] : ranges) {
+        if (FlushPending(address, bytes, nullptr, reason)) ++stored;
+    }
+    return stored;
+}
+
+std::size_t StorageTexture::StoreDrawnLinearTouching(const char* reason, const std::function<bool(std::uint64_t, std::uint64_t)>& touches, bool all) {
+    auto& pending = Pending();
+    if (pending.drawnCount.load(std::memory_order_acquire) == 0 || Recorder::InCompletion()) return 0;
+    std::vector<std::pair<std::uint64_t, std::size_t>> ranges;
+    {
+        std::lock_guard lock(pending.mutex);
+        for (const auto& entry : pending.drawn) {
+            if (!entry.texture->dirty) continue;
+            const auto begin = entry.texture->descriptor.baseAddress;
+            const auto end = begin + entry.texture->guestBytes;
+            if (!all && !touches(begin, end)) continue;
+            ranges.emplace_back(begin, static_cast<std::size_t>(entry.texture->guestBytes));
+        }
+    }
+    if (ranges.empty()) return 0;
+    GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Flush);
+    std::lock_guard gpu(GuestMemory::GpuMutex());
+    std::size_t stored = 0;
+    for (const auto& [address, bytes] : ranges) {
+        if (FlushPending(address, bytes, nullptr, reason)) ++stored;
+    }
+    return stored;
+}
+
 bool StorageTexture::AnyPending() {
     auto& pending = Pending();
     std::lock_guard lock(pending.mutex);
@@ -4312,6 +4659,101 @@ bool PendingStorageOverlaps(std::uint64_t address, std::size_t bytes, const Stor
     return false;
 }
 
+std::uint64_t StorageTexture::StampKeepingNewerResults(std::uint64_t address, std::size_t bytes, std::uint64_t recorded, const std::function<std::uint64_t()>& stamp) {
+    struct Candidate {
+        std::shared_ptr<StorageTexture> texture;
+        std::uint32_t unit;
+        bool drawn;
+    };
+    struct Kept {
+        std::shared_ptr<StorageTexture> texture;
+        std::uint32_t unit;
+        std::uint64_t from;
+        std::uint64_t to;
+        std::uint64_t since;
+        bool whole;
+        bool drawn;
+    };
+    std::vector<Candidate> candidates;
+    if (recorded != 0 && bytes != 0) {
+        auto& pending = Pending();
+        std::lock_guard lock(pending.mutex);
+        const auto consider = [&](StorageTexture* texture) {
+            if ((!texture->blockUnits && !texture->drawnListed) || !texture->overlaps(address, bytes)) return;
+            auto alive = texture->weak_from_this().lock();
+            if (alive == nullptr) return;
+            for (std::uint32_t unit = 0; unit < texture->trackedLayers; ++unit) {
+                const auto begin = texture->layerBegin(unit);
+                const auto unitBytes = texture->layerBytes(unit);
+                if (!texture->layerPending[unit] || begin >= address + bytes || address >= begin + unitBytes) continue;
+                if (texture->layerGeneration[unit] >= recorded) candidates.push_back({alive, unit, texture->drawnListed});
+            }
+        };
+        for (auto* texture : pending.textures) consider(texture);
+        for (auto* texture : pending.flushing) consider(texture);
+    }
+    constexpr std::uint64_t block = 65536;
+    std::vector<Kept> kept;
+    for (const auto& [texture, unit, drawn] : candidates) {
+        const auto begin = texture->layerBegin(unit);
+        const auto end = begin + texture->layerBytes(unit);
+        GuestMemory::CollectWritesUncached(begin, static_cast<std::size_t>(end - begin));
+        if (GuestMemory::UnchangedSince(begin, static_cast<std::size_t>(end - begin), texture->layerGeneration[unit])) {
+            kept.push_back({texture, unit, begin, end, texture->layerGeneration[unit], true, drawn});
+            continue;
+        }
+        if (!drawn) continue;
+        const auto first = std::max(begin, address) / block;
+        const auto last = (std::min(end, address + bytes) - 1) / block;
+        const auto from = std::max(begin, first * block);
+        const auto to = std::min(end, (last + 1) * block);
+        std::vector<std::uint64_t> generations(static_cast<std::size_t>(last - first + 1));
+        for (std::size_t k = 0; k < generations.size(); ++k) generations[k] = texture->unitBlockGeneration(unit, (first + k) * block);
+        std::vector<std::uint8_t> changed(generations.size());
+        if (!GuestMemory::ChangedBlocks(from, static_cast<std::size_t>(to - from), generations, changed)) continue;
+        for (std::size_t k = 0; k < generations.size(); ++k) {
+            const auto at = (first + k) * block;
+            const auto blockFrom = std::max(at, begin);
+            const auto blockTo = std::min(at + block, end);
+            const bool edge = blockFrom != at || blockTo != at + block;
+            if (changed[k] == GuestMemory::BlockWritten && (!edge || !GuestMemory::UnchangedSince(blockFrom, static_cast<std::size_t>(blockTo - blockFrom), generations[k]))) continue;
+            if (!kept.empty() && !kept.back().whole && kept.back().texture == texture && kept.back().unit == unit && kept.back().since == generations[k] && kept.back().to == blockFrom) kept.back().to = blockTo;
+            else kept.push_back({texture, unit, blockFrom, blockTo, generations[k], false, true});
+        }
+    }
+    const auto generation = stamp();
+    if (generation == 0 || kept.empty()) return generation;
+    std::vector<Kept> confirmed;
+    for (const auto& entry : kept) {
+        if ((entry.whole && !entry.drawn) || GuestMemory::UnchangedSinceCollected(entry.from, static_cast<std::size_t>(entry.to - entry.from), entry.since)) {
+            confirmed.push_back(entry);
+            continue;
+        }
+        if (entry.from / block == (entry.to - 1) / block) continue;
+        const auto last = (std::min(entry.to, address + bytes) - 1) / block;
+        for (auto at = std::max(entry.from, address) / block * block; at <= last * block; at += block) {
+            const auto from = std::max(at, entry.from);
+            const auto to = std::min(at + block, entry.to);
+            if (GuestMemory::UnchangedSinceCollected(from, static_cast<std::size_t>(to - from), entry.since)) confirmed.push_back({entry.texture, entry.unit, from, to, entry.since, false, true});
+        }
+    }
+    auto& pending = Pending();
+    std::lock_guard lock(pending.mutex);
+    for (const auto& entry : confirmed) {
+        auto& texture = *entry.texture;
+        if (!texture.layerPending[entry.unit]) continue;
+        if (entry.whole) {
+            texture.layerGeneration[entry.unit] = generation;
+            texture.refreshGeneration();
+            continue;
+        }
+        const auto spanBegin = texture.descriptor.baseAddress / block;
+        if (texture.completionKept.empty()) texture.completionKept.assign(static_cast<std::size_t>((texture.descriptor.baseAddress + texture.guestBytes - 1) / block - spanBegin + 1), 0);
+        for (auto at = entry.from / block; at <= (entry.to - 1) / block; ++at) texture.completionKept[static_cast<std::size_t>(at - spanBegin)] = generation;
+    }
+    return generation;
+}
+
 bool StorageTexture::AnyPendingOverlaps(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges) {
     if (ranges.empty()) return false;
     auto& pending = Pending();
@@ -4423,6 +4865,7 @@ bool StorageTexture::AccessKeptByCpu(std::uint64_t address, std::size_t bytes, s
     // store there would see, and the stamps only grow.
     GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Hook);
     std::lock_guard gpu(GuestMemory::GpuMutex());
+    if (std::any_of(overlapping.begin(), overlapping.end(), [](const std::shared_ptr<StorageTexture>& texture) { return texture->drawnArea().drawn; })) return false;
     if (!blocksKept(overlapping, address, bytes)) return false;
     const auto site = static_cast<std::uint8_t>(GuestMemory::CurrentReadSite());
     std::size_t dropped = 0;
@@ -4554,6 +4997,7 @@ std::size_t StorageTexture::DiscardPendingInside(std::uint64_t address, std::siz
             texture->layerPending.assign(texture->trackedLayers, false);
             texture->layerOriginal.assign(texture->trackedLayers, false);
             texture->cancelStoredSaves();
+            texture->forgetDrawn();
             it = pending.textures.erase(it);
             ++discarded;
         } else if (texture != exempt && texture->blockUnits && texture->overlaps(address, bytes)) {
@@ -5163,6 +5607,12 @@ void StorageTexture::blockGenerations(std::vector<std::uint64_t>& generations) c
     }
 }
 
+std::uint64_t StorageTexture::unitBlockGeneration(std::uint32_t unit, std::uint64_t at) const {
+    const auto unitGeneration = layerGeneration[unit];
+    if (unitGeneration == 0 || !layerPending[unit] || completionKept.empty()) return unitGeneration;
+    return std::max(unitGeneration, completionKept[static_cast<std::size_t>(at / 65536 - descriptor.baseAddress / 65536)]);
+}
+
 namespace {
 
 std::atomic<bool>& ClearHandOverOn() {
@@ -5459,10 +5909,12 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
     for (std::uint32_t layer = 0; layer < trackedLayers; ++layer) {
         if (!layers[layer]) continue;
         const auto end = layerBegin(layer) + layerBytes(layer);
-        for (auto at = layerBegin(layer) & ~(block - 1); at < end; at += block) generations[static_cast<std::size_t>((at - spanBegin) / block)] = layerGeneration[layer];
+        for (auto at = layerBegin(layer) & ~(block - 1); at < end; at += block) generations[static_cast<std::size_t>((at - spanBegin) / block)] = unitBlockGeneration(layer, at);
     }
+    const auto drawn = drawnArea();
     std::vector<std::uint8_t> changedBlocks(spanBlocks);
-    const bool tracked = GuestMemory::ChangedBlocks(firstStored, static_cast<std::size_t>(lastStored - firstStored), generations, changedBlocks);
+    std::vector<std::uint8_t> cpuBlocks(drawn.drawn ? spanBlocks : 0);
+    const bool tracked = GuestMemory::ChangedBlocks(firstStored, static_cast<std::size_t>(lastStored - firstStored), generations, changedBlocks, cpuBlocks);
     std::vector<bool> compared(trackedLayers, false);
     if (!tracked) {
         awaitStoredSave(&layers);
@@ -5487,7 +5939,8 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
         if (!layers[layer]) continue;
         const auto begin = layerBegin(layer);
         const auto end = begin + layerBytes(layer);
-        if (tracked ? layerGeneration[layer] == 0 : !compared[layer]) {
+        const bool unknown = tracked ? layerGeneration[layer] == 0 : !compared[layer];
+        if (unknown && !drawn.rect) {
             unsavedOutsideWatch = unsavedOutsideWatch || !tracked;
             keep.emplace_back(begin, end);
             continue;
@@ -5497,12 +5950,16 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
             const auto to = std::min(at + block, end);
             if (from >= to) continue;
             const bool edge = from != at || to != at + block;
-            if (keptAtUnwatchHolds(from, layer) || (changedBlocks[static_cast<std::size_t>((at - spanBegin) / block)] == GuestMemory::BlockWritten && (compared[layer] || !edge || GuestMemory::StoredOver(from, static_cast<std::size_t>(to - from), layerGeneration[layer])) && !unchangedSinceBaseline(from, to))) {
+            const auto index = static_cast<std::size_t>((at - spanBegin) / block);
+            const bool kept = keptAtUnwatchHolds(from, layer);
+            const bool written = kept || unknown || (changedBlocks[index] == GuestMemory::BlockWritten && (compared[layer] || !edge || GuestMemory::StoredOver(from, static_cast<std::size_t>(to - from), unitBlockGeneration(layer, at))) && !unchangedSinceBaseline(from, to));
+            if (written && (!drawn.rect || (tracked && !kept && !unknown && cpuBlocks[index] == 0))) {
                 skippedAny = true;
                 skippedLayer[layer] = true;
                 ++skipped;
                 continue;
             }
+            if (written && drawn.rect) skippedLayer[layer] = true;
             if (!keep.empty() && keep.back().second == from) keep.back().second = to;
             else keep.emplace_back(from, to);
         }
@@ -5516,10 +5973,15 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
         const auto first = keep.empty() ? descriptor.baseAddress + guestBytes : keep.front().first;
         std::fprintf(stderr, "[flush] image 0x%llx+0x%llx keeps %zu CPU-written 64 KiB blocks (first stored byte at +0x%llx, %zu ranges stored, generation %llu)\n", static_cast<unsigned long long>(descriptor.baseAddress), static_cast<unsigned long long>(guestBytes), skipped, static_cast<unsigned long long>(first - descriptor.baseAddress), keep.size(), static_cast<unsigned long long>(generation));
     }
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> spans;
+    if (drawn.rect) spans = drawnSpans(drawn, keep);
+    const auto& stores = drawn.rect ? spans : keep;
+    const auto stampBegin = drawn.rect && !stores.empty() ? stores.front().first : firstStored;
+    const auto stampEnd = drawn.rect && !stores.empty() ? stores.back().second : lastStored;
     // Taken before this write-back stamps anything (see advanceAdjacent), with the 64 KiB block span
     // its stamps cover.
-    const auto firstBlock = firstStored / block;
-    const auto lastBlock = (lastStored - 1) / block;
+    const auto firstBlock = stampBegin / block;
+    const auto lastBlock = (stampEnd - 1) / block;
     const auto adjacent = adjacentPendingUnchanged(firstBlock, lastBlock);
     // After the store: the stored layers are in sync at a fresh generation unless blocks were kept
     // for the CPU (then the layer is stale there, keeps its old generation and re-uploads at its
@@ -5556,7 +6018,7 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
         advanceAdjacent(adjacent, now, firstBlock, lastBlock);
         if (!shadowed.empty()) markShadowed(now);
     };
-    if (keep.empty()) {
+    if (stores.empty()) {
         // Every selected block was written by the CPU since the layer's generation: nothing to
         // store, the keys stay as they are, and the image is stale there (re-uploaded at its next
         // use, never from a matching `original`).
@@ -5586,6 +6048,24 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
             ++Profile().storageDirectWriteBacks;
             return;
         }
+        if (drawn.rect) {
+            PublishShadow(stampBegin, static_cast<std::size_t>(stampEnd - stampBegin), PublishScope::PartialUnits, PublishReason::Upload);
+            const auto storedBytes = storeDrawnRect(drawn, segments, stores, saveUnits);
+            countStorageWriteBack(storedBytes, true, true);
+            if (profile) Profile().storageGpu += timer.lap();
+            forgetStored();
+            uploadedKeys = DccKeys::Uncompressed;
+            std::vector<std::pair<std::uint64_t, std::uint64_t>> stamps;
+            for (const auto& [from, to] : stores) {
+                if (!stamps.empty() && from / block <= (stamps.back().second - 1) / block + 1) stamps.back().second = to;
+                else stamps.emplace_back(from, to);
+            }
+            for (const auto& [from, to] : stamps) GuestMemory::MarkWritten(from, static_cast<std::size_t>(to - from));
+            settle(true);
+            commitStoredSave(saveUnits);
+            ++Profile().storageDirectWriteBacks;
+            return;
+        }
         // The whole-layer copies below overwrite the interior units of the span; the edge units
         // keep a neighbour's shadowed results in the rest of their bytes, which reach the import
         // first (this write-back's stamps then make those units stale).
@@ -5688,8 +6168,9 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
             recorder->EndGpuTiming(timing, storedBytes);
             recorder->MarkShaderReadsCovered();
             recorder->NotePendingWrite(firstStored, static_cast<std::size_t>(lastStored - firstStored));
+            if (drawn.drawn) noteStore(recorder->LastWriteNote(firstStored, static_cast<std::size_t>(lastStored - firstStored)));
         }
-        countStorageWriteBack(storedBytes, true);
+        countStorageWriteBack(storedBytes, true, drawn.drawn);
         if (profile) Profile().storageGpu += timer.lap();
         // The guest bytes now differ from `original`; other caches of the range see the write.
         forgetStored();
@@ -5730,10 +6211,10 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
             overhang = covered >= end;
         }
     }
-    const bool registered = std::all_of(keep.begin(), keep.end(), [](const auto& range) { return RegisteredReadableCovers(range.first, static_cast<std::size_t>(range.second - range.first)); });
+    const bool registered = std::all_of(stores.begin(), stores.end(), [](const auto& range) { return RegisteredReadableCovers(range.first, static_cast<std::size_t>(range.second - range.first)); });
     if (unregisteredDrop && !overhang && !registered) {
         static std::atomic<int> reports{0};
-        if (reports.fetch_add(1) < 4) std::fprintf(stderr, "[gpu] storage image 0x%llx+0x%llx: memory no longer registered; %zu pending ranges dropped\n", static_cast<unsigned long long>(descriptor.baseAddress), static_cast<unsigned long long>(guestBytes), keep.size());
+        if (reports.fetch_add(1) < 4) std::fprintf(stderr, "[gpu] storage image 0x%llx+0x%llx: memory no longer registered; %zu pending ranges dropped\n", static_cast<unsigned long long>(descriptor.baseAddress), static_cast<unsigned long long>(guestBytes), stores.size());
         unregisteredDropped.fetch_add(1, std::memory_order_relaxed);
         forgetStored();
         for (std::uint32_t layer = 0; layer < trackedLayers; ++layer) {
@@ -5750,6 +6231,10 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
     std::vector<bool> unsaved = layerOriginal;
     unsaved.flip();
     for (const auto& [begin, end] : unitRuns(unsaved)) {
+        if (drawn.rect) {
+            GuestMemory::ReadCommitted(descriptor.baseAddress + begin, std::span(original).subspan(static_cast<std::size_t>(begin), static_cast<std::size_t>(end - begin)));
+            continue;
+        }
         for (const auto& [from, to] : keep) {
             const auto first = std::max(descriptor.baseAddress + begin, from);
             const auto last = std::min(descriptor.baseAddress + end, to);
@@ -5811,7 +6296,9 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
     APS5_LOG_CHARS_OUT("StorageTexture writeback submit");
     batch.SubmitAndWait();
     APS5_LOG_CHARS_OUT("StorageTexture writeback done");
-    countStorageWriteBack(guestBytes, false);
+    std::uint64_t storedBytes = 0;
+    for (const auto& [from, to] : stores) storedBytes += to - from;
+    countStorageWriteBack(drawn.rect ? storedBytes : guestBytes, false, drawn.drawn);
     if (profile) Profile().storageGpu += timer.lap();
     if (dump) {
         char name[64];
@@ -5826,7 +6313,7 @@ void StorageTexture::writeBackLayers(const std::vector<bool>& layers) {
     // Store only the kept ranges' blocks that changed, so concurrent CPU writes to untouched texels
     // survive; `original` follows for the stored layers (the others' guest bytes are unchanged).
     const auto current = host.Bytes();
-    for (const auto& [from, to] : keep) {
+    for (const auto& [from, to] : stores) {
         const auto offset = static_cast<std::size_t>(from - descriptor.baseAddress);
         const auto length = static_cast<std::size_t>(to - from);
         GuestMemory::WriteChangedCommitted(from, current.subspan(offset, length), std::span<const std::byte>(original).subspan(offset, length));
@@ -5862,6 +6349,7 @@ StorageTexture::~StorageTexture() {
     {
         auto& pending = Pending();
         std::lock_guard lock(pending.mutex);
+        forgetDrawn();
         if (dirty) {
             dirty = false;
             pending.textures.remove(this);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp
index c571bd1710..344d80c594 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp
@@ -4,8 +4,6 @@
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
 #include "prx/libSceAgcDriver/Graphics/shaders/TextureDetile_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/CmaskClear_spv.h"
-#include "prx/libSceAgcDriver/Graphics/shaders/DepthSampleMultisample_spv.h"
-#include "prx/libSceAgcDriver/Graphics/shaders/DepthSampleSingle_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/TextureDetileImage_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/TextureRepack_spv.h"
 #include <algorithm>
@@ -120,11 +118,6 @@ void TextureDetiler::release() noexcept {
     cmaskErrors.reset();
     for (const auto pool : descriptorSets.pools) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
     for (const auto pool : imageDescriptorSets.pools) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
-    for (const auto pool : depthSampleSets.pools) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
-    for (const auto pipeline : depthSamplePipelines) if (pipeline) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, pipeline, nullptr);
-    if (depthSamplePipelineLayout) context.Function<PFN_vkDestroyPipelineLayout>("vkDestroyPipelineLayout")(context.device, depthSamplePipelineLayout, nullptr);
-    if (depthSampleLayout) context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(context.device, depthSampleLayout, nullptr);
-    if (depthSampler) context.Function<PFN_vkDestroySampler>("vkDestroySampler")(context.device, depthSampler, nullptr);
     if (imageModule) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, imageModule, nullptr);
     if (repackPipeline) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, repackPipeline, nullptr);
     if (repackModule) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, repackModule, nullptr);
@@ -402,79 +395,6 @@ void TextureDetiler::DispatchCmaskClear(VkCommandBuffer commands, VkBuffer cmask
     barrier(VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, anyAccess);
 }
 
-void TextureDetiler::DispatchDepthSample(VkCommandBuffer commands, VkImageView depth, bool multisampled, VkImageView target, std::uint32_t width, std::uint32_t height, std::uint32_t sample) {
-    Require(commands != VK_NULL_HANDLE && depth != VK_NULL_HANDLE && target != VK_NULL_HANDLE, "a depth sample copy needs a command buffer, the depth view and the target view");
-    if (depthSamplePipelineLayout == VK_NULL_HANDLE) {
-        VkSamplerCreateInfo samplerInfo{VK_STRUCTURE_TYPE_SAMPLER_CREATE_INFO};
-        samplerInfo.magFilter = VK_FILTER_NEAREST;
-        samplerInfo.minFilter = VK_FILTER_NEAREST;
-        samplerInfo.addressModeU = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
-        samplerInfo.addressModeV = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
-        samplerInfo.addressModeW = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
-        Check(context.Function<PFN_vkCreateSampler>("vkCreateSampler")(context.device, &samplerInfo, nullptr, &depthSampler), "vkCreateSampler depth sample copy");
-        std::array<VkDescriptorSetLayoutBinding, 2> bindings{};
-        bindings[0] = {0, VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER, 1, VK_SHADER_STAGE_COMPUTE_BIT, &depthSampler};
-        bindings[1] = {1, VK_DESCRIPTOR_TYPE_STORAGE_IMAGE, 1, VK_SHADER_STAGE_COMPUTE_BIT, nullptr};
-        VkDescriptorSetLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
-        layoutInfo.bindingCount = static_cast<std::uint32_t>(bindings.size());
-        layoutInfo.pBindings = bindings.data();
-        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &layoutInfo, nullptr, &depthSampleLayout), "vkCreateDescriptorSetLayout depth sample copy");
-        const VkPushConstantRange pushRange{VK_SHADER_STAGE_COMPUTE_BIT, 0, 3 * sizeof(std::uint32_t)};
-        VkPipelineLayoutCreateInfo pipelineLayoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
-        pipelineLayoutInfo.setLayoutCount = 1;
-        pipelineLayoutInfo.pSetLayouts = &depthSampleLayout;
-        pipelineLayoutInfo.pushConstantRangeCount = 1;
-        pipelineLayoutInfo.pPushConstantRanges = &pushRange;
-        Check(context.Function<PFN_vkCreatePipelineLayout>("vkCreatePipelineLayout")(context.device, &pipelineLayoutInfo, nullptr, &depthSamplePipelineLayout), "vkCreatePipelineLayout depth sample copy");
-    }
-    auto& depthSamplePipeline = depthSamplePipelines[multisampled ? 1u : 0u];
-    if (depthSamplePipeline == VK_NULL_HANDLE) {
-        VkShaderModuleCreateInfo moduleInfo{VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO};
-        moduleInfo.codeSize = multisampled ? sizeof(DEPTH_SAMPLE_MULTISAMPLE_SPV) : sizeof(DEPTH_SAMPLE_SINGLE_SPV);
-        moduleInfo.pCode = multisampled ? DEPTH_SAMPLE_MULTISAMPLE_SPV : DEPTH_SAMPLE_SINGLE_SPV;
-        VkShaderModule depthModule = VK_NULL_HANDLE;
-        Check(context.Function<PFN_vkCreateShaderModule>("vkCreateShaderModule")(context.device, &moduleInfo, nullptr, &depthModule), "vkCreateShaderModule depth sample copy");
-        VkComputePipelineCreateInfo pipelineInfo{VK_STRUCTURE_TYPE_COMPUTE_PIPELINE_CREATE_INFO};
-        pipelineInfo.stage = {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO};
-        pipelineInfo.stage.stage = VK_SHADER_STAGE_COMPUTE_BIT;
-        pipelineInfo.stage.module = depthModule;
-        pipelineInfo.stage.pName = "main";
-        pipelineInfo.layout = depthSamplePipelineLayout;
-        const auto created = context.Function<PFN_vkCreateComputePipelines>("vkCreateComputePipelines")(context.device, context.pipelineCache, 1, &pipelineInfo, nullptr, &depthSamplePipeline);
-        context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, depthModule, nullptr);
-        Check(created, "vkCreateComputePipelines depth sample copy");
-    }
-    const auto set = allocateFrom(depthSampleSets, depthSampleLayout, {{VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER, 64}, {VK_DESCRIPTOR_TYPE_STORAGE_IMAGE, 64}}, "vkCreateDescriptorPool depth sample copy", "vkAllocateDescriptorSets depth sample copy", "vkResetDescriptorPool depth sample copy");
-    const VkDescriptorImageInfo depthInfo{VK_NULL_HANDLE, depth, VK_IMAGE_LAYOUT_GENERAL};
-    const VkDescriptorImageInfo targetInfo{VK_NULL_HANDLE, target, VK_IMAGE_LAYOUT_GENERAL};
-    std::array<VkWriteDescriptorSet, 2> writes{};
-    for (std::uint32_t index = 0; index < writes.size(); ++index) {
-        writes[index].sType = VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET;
-        writes[index].dstSet = set;
-        writes[index].dstBinding = index;
-        writes[index].descriptorCount = 1;
-        writes[index].descriptorType = index == 0 ? VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER : VK_DESCRIPTOR_TYPE_STORAGE_IMAGE;
-    }
-    writes[0].pImageInfo = &depthInfo;
-    writes[1].pImageInfo = &targetInfo;
-    context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, static_cast<std::uint32_t>(writes.size()), writes.data(), 0, nullptr);
-    const auto barrier = [&](VkPipelineStageFlags source, VkPipelineStageFlags destination, VkAccessFlags sourceAccess, VkAccessFlags destinationAccess) {
-        VkMemoryBarrier memory{VK_STRUCTURE_TYPE_MEMORY_BARRIER};
-        memory.srcAccessMask = sourceAccess;
-        memory.dstAccessMask = destinationAccess;
-        context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, source, destination, 0, 1, &memory, 0, nullptr, 0, nullptr);
-    };
-    constexpr VkAccessFlags anyWrite = VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT | VK_ACCESS_HOST_WRITE_BIT;
-    constexpr VkAccessFlags anyAccess = anyWrite | VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_COLOR_ATTACHMENT_READ_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_READ_BIT | VK_ACCESS_HOST_READ_BIT;
-    barrier(VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, anyWrite, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT);
-    context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, depthSamplePipeline);
-    context.Function<PFN_vkCmdBindDescriptorSets>("vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, depthSamplePipelineLayout, 0, 1, &set, 0, nullptr);
-    const std::array<std::uint32_t, 3> push{width, height, sample};
-    context.Function<PFN_vkCmdPushConstants>("vkCmdPushConstants")(commands, depthSamplePipelineLayout, VK_SHADER_STAGE_COMPUTE_BIT, 0, sizeof(push), push.data());
-    context.Function<PFN_vkCmdDispatch>("vkCmdDispatch")(commands, (width + 7u) / 8u, (height + 7u) / 8u, 1);
-    barrier(VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_SHADER_WRITE_BIT, anyAccess);
-}
-
 void TextureDetiler::DispatchImage(VkCommandBuffer commands, TextureTileMode tileMode, std::uint32_t elementBytes, VkBuffer tiled, std::uint64_t tiledOffset, VkImageView view, const TileMipLayout& layout, bool retile, std::uint32_t slice, const DetileWindow& window) {
     Require(commands != VK_NULL_HANDLE, "texture detiling requires an active command buffer");
     Require(window.rangeBegin < window.rangeEnd && window.tiledBase <= window.rangeBegin, "texture detiling window is empty");
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp
index e667909a5b..1756e2fa02 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp
@@ -99,7 +99,7 @@ constexpr auto MakeFormatLookupTable() {
 constexpr auto kFormatLookupTable = MakeFormatLookupTable();
 
 std::uint32_t remapGuestFormat(std::uint32_t guestFormat) {
-    return guestFormat == 30 || guestFormat == 34 || guestFormat == 43 ? 20 : guestFormat;
+    return guestFormat == 30 || guestFormat == 34 || guestFormat == 36 || guestFormat == 43 ? 20 : guestFormat;
 }
 
 const FormatEntry& findFormatEntry(std::uint32_t guestFormat) {
@@ -115,6 +115,11 @@ VkFormat ResolveTextureFormat(std::uint32_t guestFormat) {
     return findFormatEntry(guestFormat).vkFormat;
 }
 
+VkFormat DccClearTextureFormat(std::uint32_t guestFormat) {
+    if (IsRepackedTextureFormat(guestFormat) || guestFormat == static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format11_11_10Float)) return VK_FORMAT_B10G11R11_UFLOAT_PACK32;
+    return ResolveTextureFormat(guestFormat);
+}
+
 std::uint32_t SrgbDecodeFormats(PFN_vkGetPhysicalDeviceFormatProperties formatProperties, VkPhysicalDevice physical) {
     const char* forced = std::getenv("APS5_SRGB_SHADER_DECODE");
     const bool always = forced != nullptr && (std::strcmp(forced, "1") == 0 || std::strcmp(forced, "copy") == 0);
@@ -131,7 +136,7 @@ std::uint32_t SrgbDecodeFormats(PFN_vkGetPhysicalDeviceFormatProperties formatPr
 }
 
 VkFormat SampledTextureFormat(const Context& context, std::uint32_t guestFormat) {
-    if (IsRepackedTextureFormat(guestFormat)) return VK_FORMAT_B10G11R11_UFLOAT_PACK32;
+    if (IsRepackedTextureFormat(guestFormat) || guestFormat == static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format11_11_10Float)) return VK_FORMAT_B10G11R11_UFLOAT_PACK32;
     const auto format = static_cast<ShaderRecompiler::IrBufferFormat>(guestFormat);
     if ((context.srgbDecodeFormats & ShaderRecompiler::SrgbDecodeBit(format)) == 0u) return ResolveTextureFormat(guestFormat);
     return ResolveTextureFormat(static_cast<std::uint32_t>(ShaderRecompiler::SrgbUnormFormat(format)));
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp
index ff1bed0787..494c38359e 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp
@@ -466,23 +466,26 @@ bool LevelsFitAllocation(const GuestTextureResource& surface, std::uint32_t leve
     return true;
 }
 
-GuestTextureResource ViewedArrayWindow(const GuestTextureResource& viewed) {
+GuestTextureResource ViewedArrayWindow(const GuestTextureResource& viewed, bool keysReadAsStored) {
     const bool layered = viewed.dimension == TextureDimension::k2DArray || viewed.dimension == TextureDimension::k1DArray || viewed.dimension == TextureDimension::kCube;
-    if (!layered || viewed.baseArray == 0 || viewed.baseArray > viewed.depthOrLastArray || viewed.dccAddress != 0) return viewed;
+    if (!layered || viewed.baseArray == 0 || viewed.baseArray > viewed.depthOrLastArray || (viewed.dccAddress != 0 && !keysReadAsStored)) return viewed;
+    std::uint32_t sliceMask = 0;
     if (const auto xorMode = XorSwizzleMode(viewed.tileMode); xorMode != 0u) {
         const auto* equation = FindTextureSwizzleEquation(xorMode, BytesPerElement(viewed.format));
         if (equation == nullptr) return viewed;
         std::uint32_t sliceBits = 0;
         for (const auto bit : equation->bits) sliceBits |= bit >> 24u;
-        const auto sliceMask = sliceBits == 0 ? 0u : (1u << std::bit_width(sliceBits)) - 1u;
-        if ((viewed.baseArray & sliceMask) != 0) return viewed;
+        sliceMask = sliceBits == 0 ? 0u : (1u << std::bit_width(sliceBits)) - 1u;
     }
+    const auto first = viewed.baseArray & ~sliceMask;
+    if (first == 0) return viewed;
     const auto geometry = DescribeSurface(viewed);
     if (geometry.thick || geometry.layers != viewed.depthOrLastArray + 1u) return viewed;
     auto window = viewed;
-    window.baseAddress = viewed.baseAddress + geometry.GuestLayerOffset(viewed.baseArray);
-    window.depthOrLastArray = viewed.depthOrLastArray - viewed.baseArray;
-    window.baseArray = 0;
+    window.baseAddress = viewed.baseAddress + geometry.GuestLayerOffset(first);
+    window.depthOrLastArray = viewed.depthOrLastArray - first;
+    window.baseArray = viewed.baseArray - first;
+    window.dccAddress = 0;
     return window;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp b/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp
index d2485e8727..8d49017a87 100644
--- a/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp
+++ b/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_RESOURCE_INCLUDE_LIFECYCLE_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_RESOURCE_INCLUDE_LIFECYCLE_HPP
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceAgcDriverInitResourceRegistration(void);
+uint32_t APS5_VABI sceAgcDriverQueryResourceRegistrationUserMemoryRequirements(uint64_t* sizeInBytes);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp b/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp
index d30f27839a..6cbdcce863 100644
--- a/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp
+++ b/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp
@@ -5,4 +5,33 @@
 
 extern "C" bool AgcDriverWorkloadStreamRegistered_nid_postfix(std::uint32_t streamId);
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDriverRegisterOwner(uint32_t* ownerHandle, const char* name);
+int APS5_VABI sceAgcDriverRegisterResource(uint32_t* resourceHandle, uint32_t ownerHandle, const void* memory, size_t size, const char* name, uint32_t type, uint64_t userData);
+int APS5_VABI sceAgcDriverRegisterMultipleResources(uint32_t* resourceHandle, uint32_t ownerHandle, const void* resources, uint32_t resourceCount);
+int APS5_VABI sceAgcDriverRegisterWorkloadStream(uint32_t streamId, const void* stream);
+int APS5_VABI sceAgcDriverUnregisterOwnerAndResources(uint32_t ownerHandle);
+int APS5_VABI sceAgcDriverUnregisterResource(uint32_t resourceHandle);
+int APS5_VABI sceAgcDriverRegisterGdsResource(uint32_t* resourceHandle, uint32_t ownerHandle, uint32_t gdsOffset, uint32_t gdsSize, const char* name, uint32_t type, uint64_t userData);
+int APS5_VABI sceAgcDriverUnregisterAllResourcesForOwner(uint32_t ownerHandle);
+int APS5_VABI sceAgcDriverUnregisterWorkloadStream(uint32_t streamId);
+int APS5_VABI sceAgcDriverGetDefaultOwner(uint32_t* ownerHandle);
+int APS5_VABI sceAgcDriverGetResourceRegistrationMaxNameLength(uint32_t* maxLength);
+int APS5_VABI sceAgcDriverGetOwnerName(uint32_t ownerHandle, const char** name);
+int APS5_VABI sceAgcDriverGetResourceName(uint32_t resourceHandle, const char** name);
+int APS5_VABI sceAgcDriverGetResourceType(uint32_t resourceHandle, uint32_t* type);
+int APS5_VABI sceAgcDriverGetResourceUserData(uint32_t resourceHandle, uint64_t* userData);
+int APS5_VABI sceAgcDriverSetResourceUserData(uint32_t resourceHandle, uint64_t userData);
+int APS5_VABI sceAgcDriverGetResourceBaseAddressAndSizeInBytes(uint32_t resourceHandle, void** memory, size_t* size);
+int APS5_VABI sceAgcDriverGetResourceShaderGuid(uint32_t resourceHandle, void* guid);
+int APS5_VABI sceAgcDriverFindResourcesPublic(const void* callback, void* userData);
+int APS5_VABI sceAgcDriverRegisterOwnerForSystem();
+int APS5_VABI sceAgcDriverInitResourceRegistrationInterface();
+int APS5_VABI sceAgcDriverSetResourceRegistrationInfo();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp b/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp
index f3fbd0ba67..7cae8c3afb 100644
--- a/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp
+++ b/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp
@@ -9,6 +9,9 @@
 // Resource registration feeds GPU debugging tools, none of which are attached; the game treats this code as benign.
 static constexpr int SCE_AGC_ERROR_RESOURCE_REGISTRATION_UNAVAILABLE = static_cast<int>(0x8A6C9018);
 static constexpr uint32_t RESOURCE_REGISTRATION_MAX_NAME_LENGTH = 0xfc;
+static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID = static_cast<int>(0x8A6C0033);
+static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_NULL = static_cast<int>(0x8A6C0035);
+static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_NOT_REGISTERED = static_cast<int>(0x8A6C003A);
 static constexpr uint32_t WORKLOAD_STREAM_MIN_ID = 1;
 static constexpr uint32_t WORKLOAD_STREAM_MAX_ID = 31;
 
@@ -49,10 +52,11 @@ int APS5_VABI sceAgcDriverRegisterMultipleResources(uint32_t* resourceHandle, ui
 }
 
 int APS5_VABI sceAgcDriverRegisterWorkloadStream(uint32_t stream_id, const void* stream) {
- if (stream != nullptr && stream_id >= WORKLOAD_STREAM_MIN_ID && stream_id <= WORKLOAD_STREAM_MAX_ID) {
-  std::lock_guard lock(g_workloadStreamLock);
-  g_workloadStreams |= 1u << stream_id;
- }
+ if (stream_id < WORKLOAD_STREAM_MIN_ID || stream_id > WORKLOAD_STREAM_MAX_ID) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID;
+ std::lock_guard lock(g_workloadStreamLock);
+ if ((g_workloadStreams & (1u << stream_id)) != 0) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID;
+ if (stream == nullptr) return SCE_AGC_ERROR_WORKLOAD_STREAM_NULL;
+ g_workloadStreams |= 1u << stream_id;
  return 0;
 }
 
@@ -83,10 +87,10 @@ int APS5_VABI sceAgcDriverUnregisterAllResourcesForOwner(uint32_t owner_handle)
 }
 
 int APS5_VABI sceAgcDriverUnregisterWorkloadStream(uint32_t stream_id) {
-    if (stream_id >= WORKLOAD_STREAM_MIN_ID && stream_id <= WORKLOAD_STREAM_MAX_ID) {
-        std::lock_guard lock(g_workloadStreamLock);
-        g_workloadStreams &= ~(1u << stream_id);
-    }
+    if (stream_id < WORKLOAD_STREAM_MIN_ID || stream_id > WORKLOAD_STREAM_MAX_ID) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID;
+    std::lock_guard lock(g_workloadStreamLock);
+    if ((g_workloadStreams & (1u << stream_id)) == 0) return SCE_AGC_ERROR_WORKLOAD_STREAM_NOT_REGISTERED;
+    g_workloadStreams &= ~(1u << stream_id);
     return 0;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp b/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp
index aadd076ce7..54c8fc2cca 100644
--- a/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp
+++ b/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_CONFIGURATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_CONFIGURATION_HPP
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDriverSetHsOffchipParam(uint64_t value0, uint64_t value1, uint64_t value2);
+int APS5_VABI sceAgcDriverSetTFRing(const volatile void* base, uint32_t size);
+int APS5_VABI sceAgcDriverGetTFRing(uintptr_t* base, uint32_t* size);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/State/include/Status.hpp b/core/libs/prx/libSceAgcDriver/State/include/Status.hpp
index d7184e323f..822d5016ab 100644
--- a/core/libs/prx/libSceAgcDriver/State/include/Status.hpp
+++ b/core/libs/prx/libSceAgcDriver/State/include/Status.hpp
@@ -1,4 +1,17 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_STATUS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_STATUS_HPP
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+bool APS5_VABI sceAgcDriverIsCaptureInProgress(void);
+bool APS5_VABI sceAgcDriverIsTraceInProgress(void);
+bool APS5_VABI sceAgcDriverIsSubmitValidationEnabled(void);
+int APS5_VABI sceAgcDriverRequestCaptureStart(const char* path);
+int APS5_VABI sceAgcDriverRequestCaptureStop();
+int APS5_VABI sceAgcDriverTriggerCapture();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp b/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp
index d6d7244c58..d39b6ce6e9 100644
--- a/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp
+++ b/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp
@@ -4,6 +4,6 @@
 #include "SceTypes.hpp"
 
 extern "C" int APS5_VABI sceAgcDriverSubmitAcb(std::uint32_t queue, const Packet* packet);
-extern "C" int APS5_VABI sceAgcDriverSubmitMultiAcbs(std::uint32_t queue, std::uint32_t* const* acbs, const std::uint32_t* sizes_in_dwords, std::uint32_t count);
+extern "C" int APS5_VABI sceAgcDriverSubmitMultiAcbs(std::uint32_t queue, std::uint32_t* const* acbs, const std::uint32_t* sizesInDwords, std::uint32_t count);
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp b/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp
index 52fb4cb31d..bf355fbe65 100644
--- a/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp
+++ b/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp
@@ -4,12 +4,10 @@
 #include "SceTypes.hpp"
 #include <cstdint>
 
-struct Packet;
-
 extern "C" {
 
-int APS5_VABI sceAgcDriverSubmitCommandBuffer(void* queue_context, const Packet* packet);
-int APS5_VABI sceAgcDriverSubmitMultiCommandBuffers(void* queue_context, uint32_t* const* command_buffers, const uint32_t* sizes_in_dwords, uint32_t count);
+int APS5_VABI sceAgcDriverSubmitCommandBuffer(void* queueContext, const Packet* packet);
+int APS5_VABI sceAgcDriverSubmitMultiCommandBuffers(void* queueContext, uint32_t* const* commandBuffers, const uint32_t* sizesInDwords, uint32_t count);
 
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp b/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp
index 9e8fe9fdf7..78cfda269b 100644
--- a/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp
+++ b/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp
@@ -18,4 +18,15 @@ extern "C" int APS5_VABI sceAgcDriverAgrSubmitDcb(const Packet* packet);
 extern "C" int APS5_VABI sceAgcDriverSubmitMultiDcbs(std::uint32_t* const* dcbGpuAddrs, const std::uint32_t* dcbSizesInDwords, std::uint32_t count);
 extern "C" int APS5_VABI sceAgcDriverAgrSubmitMultiDcbs(std::uint32_t* const* dcbGpuAddrs, const std::uint32_t* dcbSizesInDwords, std::uint32_t count);
 
+extern "C" {
+
+std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadsActivePacketSize();
+std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadCompletePacketSize();
+std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadStreamInactivePacketSize();
+std::uint32_t APS5_VABI sceAgcDriverNopDataGetPacketSize(std::uint32_t bytes);
+std::uint32_t APS5_VABI sceAgcDriverUserDataGetPacketSize(std::uint32_t bytes);
+std::uint32_t APS5_VABI sceAgcDriverWaitUntilSafeForRendering(std::uint32_t** command, std::uint32_t capacity, std::uint32_t mode, std::uint32_t handle, int index);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Unimplemented.cpp b/core/libs/prx/libSceAgcDriver/Unimplemented.cpp
index dd330964bc..f361aacbe8 100644
--- a/core/libs/prx/libSceAgcDriver/Unimplemented.cpp
+++ b/core/libs/prx/libSceAgcDriver/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -68,7 +69,6 @@ int APS5_VABI sceAgcDriverNopDataWritePacket(void* destination, uint32_t address
     return data == nullptr || bytes == 0 ? 2 : static_cast<int>(totalBytes / 4);
 }
 
-
 int APS5_VABI sceAgcDriverSetValidationDisabled() {
     return DEBUG_UNAVAILABLE;
 }
diff --git a/core/libs/prx/libSceAgcDriver/include/AgcDriver.hpp b/core/libs/prx/libSceAgcDriver/include/AgcDriver.hpp
new file mode 100644
index 0000000000..6c6e8fea9b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/include/AgcDriver.hpp
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDriverAcquireRazorACQ(void);
+int APS5_VABI sceAgcDriverCreateQueue(void);
+int APS5_VABI sceAgcDriverCwsrResumeAcq(void);
+int APS5_VABI sceAgcDriverCwsrSuspendAcq(void);
+int APS5_VABI sceAgcDriverDebugHardwareStatus(void);
+int APS5_VABI sceAgcDriverDestroyQueue(void);
+int APS5_VABI sceAgcDriverGetPaDebugInterfaceVersion(void);
+int APS5_VABI sceAgcDriverGetRegShadowInfo(void);
+int APS5_VABI sceAgcDriverGetRegShadowInfoAgr(void);
+int APS5_VABI sceAgcDriverGetReservedDmemForAgc(void);
+int APS5_VABI sceAgcDriverGetWorkloadStreamInfo(void);
+int APS5_VABI sceAgcDriverIDHSSubmit(void);
+int APS5_VABI sceAgcDriverModuleRegistration(void);
+int APS5_VABI sceAgcDriverNotifyDefaultStates(void);
+int APS5_VABI sceAgcDriverPassInfoDownward(void);
+int APS5_VABI sceAgcDriverPatchClearState(void);
+int APS5_VABI sceAgcDriverSetFlip(void);
+int APS5_VABI sceAgcDriverSetHsOffchipParamDirect(void);
+int APS5_VABI sceAgcDriverSetWorkloadComplete(void);
+int APS5_VABI sceAgcDriverSetWorkloadsActive(void);
+int APS5_VABI sceAgcDriverSetupAsyncGraphics(void);
+int APS5_VABI sceAgcDriverSetupRegisterShadow(void);
+int APS5_VABI sceAgcDriverSubmitMultiCommandBuffersDirect(void);
+int APS5_VABI sceAgcDriverSubmitToHDRScopesACQ(void);
+int APS5_VABI sceAgcDriverSubmitToRazorACQ(void);
+int APS5_VABI sceAgcDriverSuspendPointSubmit(void);
+int APS5_VABI sceAgcDriverSuspendPointSubmitDirect(void);
+int APS5_VABI sceAgcDriverSysEnableSubmitDone45Exception(void);
+int APS5_VABI sceAgcDriverSysGetClientNumber(void);
+int APS5_VABI sceAgcDriverSysIsGameClosed(void);
+int APS5_VABI sceAgcDriverTmpInitIdhs(void);
+int APS5_VABI sceAgcDriverUserDataWritePacket(void);
+int APS5_VABI sceAgcDriverUserDataWritePopMarker(void);
+int APS5_VABI sceAgcDriverUserDataWritePushMarker(void);
+int APS5_VABI sceAgcDriverUserDataWriteSetMarker(void);
+int APS5_VABI sceAgcDriverGetShaderDebuggingStatus();
+int APS5_VABI sceAgcDriverRegisterDefaultOwner(uint32_t owner);
+int APS5_VABI sceAgcDriverSetValidationErrorOutputFrequency(uint32_t frequency);
+int APS5_VABI sceAgcDriverSetSubmitValidationMode(uint32_t mode);
+int APS5_VABI sceAgcDriverGetSubmitValidationConfig(void* config);
+int APS5_VABI sceAgcDriverGetSubmitValidationMode(uint32_t* mode);
+int APS5_VABI sceAgcDriverSetSubmitValidationConfig(const void* config);
+int APS5_VABI sceAgcDriverGetHsOffchipParam(uint16_t* first, uint16_t* second);
+int APS5_VABI sceAgcDriverNopDataWritePacket(void* destination, uint32_t address, const void* data, uint32_t bytes);
+int APS5_VABI sceAgcDriverSetValidationDisabled();
+int APS5_VABI sceAgcDriverGetCaptureConfig();
+int APS5_VABI sceAgcDriverSetCaptureConfig();
+int APS5_VABI sceAgcDriverGetGpuPrintfWorkArea();
+int APS5_VABI sceAgcDriverSetGpuPrintfEnabled();
+int APS5_VABI sceAgcDriverDbgReadRegister();
+int APS5_VABI sceAgcDriverDbgWriteRegister();
+int APS5_VABI sceAgcDriverGetGpuRefClks();
+int APS5_VABI sceAgcDriverIsSuspendPointInFlight();
+int APS5_VABI sceAgcDriverIsPaDebug();
+int APS5_VABI sceAgcDriverGetExceptionStatus();
+int APS5_VABI sceAgcDriverGetTraceInitiator();
+int APS5_VABI sceAgcDriverRegisterGpuResetCallbacks();
+int APS5_VABI sceAgcDriverUnregisterGpuResetCallbacks();
+int APS5_VABI sceAgdResetGpu();
+int APS5_VABI sceAgcDriverSysSubmitFlipHandleProxy();
+int APS5_VABI sceAgcDriverUserDataImmediateWrite();
+int APS5_VABI sceAgcDriverUserDataImmediateWritePacket();
+int APS5_VABI sceAgcDriverGetCoredumpMode(uint32_t* mode);
+int APS5_VABI sceAgcDriverAllocateToolMemoryForGpuReset(uint64_t, uint64_t, uint64_t, void* range);
+int APS5_VABI sceAgcDriverGetAllocatedToolMemoryForGpuReset(uint64_t, void* range);
+int APS5_VABI sceAgcDriverAcquireHDRScopesACQ();
+void* APS5_VABI sceAgcDriverGetCoredumpAddress();
+int APS5_VABI sceAgcDriverHp3dLockEnd();
+int APS5_VABI sceAgcDriverHp3dLockStart();
+int APS5_VABI sceAgcDriverIsEsvmProcess();
+int APS5_VABI sceAgcDriverReleaseHDRScopesACQ();
+int APS5_VABI sceAgcDriverSetTargetRingForDiag();
+int APS5_VABI sceAgcDriverSetValueToSharedGds();
+int APS5_VABI sceAgcDriverSetWorkloadStreamInactive();
+int APS5_VABI sceAgcDriverSubmitReprojectionAcb();
+int APS5_VABI sceAgcDriverSuspendPointSubmitCdbg();
+int APS5_VABI sceAgcDriverSysGetGfxAppGpuResetStatus();
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/libSceAgcDriver.hpp b/core/libs/prx/libSceAgcDriver/libSceAgcDriver.hpp
new file mode 100644
index 0000000000..342610270a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/libSceAgcDriver.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "prx/libSceAgcDriver/Eq/include/Event.hpp"
+#include "prx/libSceAgcDriver/Eq/include/Query.hpp"
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Lifecycle.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Registration.hpp"
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
+#include "prx/libSceAgcDriver/State/include/Status.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include "prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
diff --git a/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp b/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp
index f334f4b036..a370fe2802 100644
--- a/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp
@@ -243,7 +243,12 @@ void FullQueueBlocksCaller() {
 constexpr int ChildLines = 50;
 
 [[noreturn]] void EndChild(const std::string& mode, const char* output) {
-    std::FILE* file = std::fopen(output, "wb");
+    const auto path = std::filesystem::temp_directory_path() / output;
+#ifdef _WIN32
+    std::FILE* file = _wfopen(path.c_str(), L"wb");
+#else
+    std::FILE* file = std::fopen(path.c_str(), "wb");
+#endif
     Check(file != nullptr, "child output file");
 #ifdef _WIN32
     SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX);
@@ -288,12 +293,18 @@ std::string Quote(const std::string& text) {
 
 void LinesSurviveEnd(const std::string& self, const std::string& mode) {
     const auto output = std::filesystem::temp_directory_path() / ("aps5-async-log-" + mode + "-" + std::to_string(Clock::now().time_since_epoch().count()) + ".txt");
-    std::string command = Quote(self) + " child " + mode + " " + Quote(output.string());
 #ifdef _WIN32
-    command = Quote(command);
-#endif
+    (void)self;
+    std::wstring executable(32768, L'\0');
+    executable.resize(GetModuleFileNameW(nullptr, executable.data(), static_cast<DWORD>(executable.size())));
+    const std::wstring command = L"\"\"" + executable + L"\" child " + std::filesystem::path(mode).wstring() + L" \"" + output.filename().wstring() + L"\"\"";
+    const auto start = Clock::now();
+    const int status = _wsystem(command.c_str());
+#else
+    const std::string command = Quote(self) + " child " + mode + " " + Quote(output.filename().string());
     const auto start = Clock::now();
     const int status = std::system(command.c_str());
+#endif
     const auto lived = Clock::now() - start;
     std::error_code error;
     const bool started = std::filesystem::exists(output, error);
diff --git a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
index 8b06adb667..37e518eb51 100644
--- a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
@@ -602,6 +602,9 @@ void importJoinTests(const Context& context) {
     Require(pieces != nullptr && pieces->base == heapBase && pieces->bytes == 2 * piece && piecesBuffer == pieces->buffer && piecesCopied == 0, "a buffer bound exactly over two pieces no larger than the import window was not imported as one");
     change(heap + 2 * piece, piece, true);
     static_cast<void>(bind(heapBase + 2 * piece - 16));
+    const auto [prefixBuffer, prefixCopied] = bind(heapBase, 2 * piece + 16);
+    const auto* prefix = HostImportFor(importing, heapBase, 2 * piece + 16);
+    Require(prefix != nullptr && prefix->base == heapBase && prefix->bytes == 3 * piece && prefixBuffer == prefix->buffer && prefixCopied == 0, "a buffer bound from the first of three pieces into the last was not imported over the pieces it crosses");
     const auto* kept = HostImportFor(importing, first, 16);
     Require(kept != nullptr && kept->buffer == joinedBuffer && kept->bytes == 2 * large, "a registry change elsewhere re-imported the joined ranges");
     change(guest + 2 * large, large, true);
@@ -880,7 +883,7 @@ private:
 
 void importMappedFailureGenerationTests(const Context& context) {
     ClearHostImports(context.device);
-    WindowedRange range(context, WindowedRange::piece, 1);
+    WindowedRange range(context, 2 * WindowedRange::piece, 1);
     ImportAllocationProbe probe(range.importing);
     probe.failure = VK_ERROR_INVALID_EXTERNAL_HANDLE;
     GuestAllocations::Mapped mapped;
@@ -911,8 +914,10 @@ void importMappedFailureGenerationTests(const Context& context) {
     {
         std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
         Require(ImportMappedRanges(range.importing, mapped, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true), "the replacement owner map import was deferred");
-        Require(probe.calls.size() == 2u, "a replacement owner did not retry its predecessor's failed import");
+        Require(probe.calls.size() == 1u, "a replacement owner was imported again at map instead of on first use");
     }
+    HostImportFor(range.importing, range.First(), range.bytes);
+    Require(probe.calls.size() == 2u, "a replacement owner did not retry its predecessor's failed import on first use");
     ClearHostImports(context.device);
 }
 
@@ -1021,6 +1026,34 @@ void importRefusedWholeRangeTests(const Context& context) {
     Require(kept != nullptr && kept->buffer == buffer, "the range's window was imported again after a refused whole-range import");
 }
 
+void importPiecesOverAllocationLimitTests(const Context& context) {
+    WindowedRange range(context, 2 * WindowedRange::piece, 5);
+    const auto first = range.First();
+    const auto limit = 3 * range.window;
+    SetHostImportMaxBytes(limit);
+    {
+        GuestBufferMemory leased(range.importing);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        std::uint64_t covered = first;
+        for (const auto& entry : leased.AddressRanges()) {
+            if (entry.end <= first || entry.begin >= first + range.bytes) continue;
+            Require(entry.begin == covered, "the pieces of a range over the allocation limit leave a gap or overlap in the BDA table");
+            Require(entry.end - entry.begin <= limit, "a BDA table entry of a range over the allocation limit is larger than the limit");
+            const auto* piece = ExistingHostImportFor(range.importing, entry.begin, static_cast<std::size_t>(entry.end - entry.begin));
+            Require(piece != nullptr && piece->bytes <= limit && entry.deviceAddress == piece->address + (entry.begin - piece->base), "a BDA table entry of a range over the allocation limit is not served in place by an import within the limit");
+            covered = entry.end;
+        }
+        Require(covered == first + range.bytes, "the pieces of a range over the allocation limit do not cover it");
+        for (std::uint64_t at = first; at < first + range.bytes; at += range.window) {
+            const auto* piece = ExistingHostImportFor(range.importing, at, 16);
+            Require(piece != nullptr && piece->bytes <= limit, "a range over the allocation limit has an import larger than the limit");
+        }
+        leased.WriteBack();
+    }
+    SetHostImportMaxBytes(0);
+}
+
 // Two uses across neighbouring cell edges of one range, each in a build of its own, share one import: the second grows
 // the first's window to their union, and later rounds of both keep it. Before, each replaced the other's window at
 // every use.
@@ -1050,7 +1083,8 @@ void importNeighbouringEdgesTests(const Context& context) {
 // A range mapped while the imports are at the budget is refused at map time without retiring an import: the map
 // observer holds no GPU lock, so it must not evict (before, it evicted the least recently used import to fit).
 void importAtMapOverBudgetTests(const Context& context) {
-    constexpr std::size_t bytes = 65536;
+    ClearHostImports(context.device);
+    constexpr std::size_t bytes = 2 * 65536;
     auto importing = context;
     importing.hostImportAlignment = bytes;
     void* kept = ::operator new(bytes, std::align_val_t{bytes});
@@ -1094,6 +1128,7 @@ void importAtMapOverBudgetTests(const Context& context) {
 }
 
 void importRequesterTests(const Context& context, const BdaTestAccess& access) {
+    ClearHostImports(context.device);
     constexpr std::size_t piece = 65536;
     constexpr std::size_t pieces = 8;
     auto* block = static_cast<std::uint8_t*>(::operator new(pieces * piece, std::align_val_t{piece}));
@@ -1110,17 +1145,32 @@ void importRequesterTests(const Context& context, const BdaTestAccess& access) {
     const auto counted = [](ImportRequester requester) { return HostImportCounters().requesters[static_cast<std::size_t>(requester)]; };
     const auto made = [&](ImportRequester requester) { return counted(requester).made; };
     Require(std::string(ImportRequesterName(ImportRequester::Map)) == "map" && std::string(ImportRequesterName(ImportRequester::Build)) == "build" && std::string(ImportRequesterName(ImportRequester::Access)) == "access" && std::string(ImportRequesterName(ImportRequester::Join)) == "join" && std::string(ImportRequesterName(ImportRequester::Segment)) == "segment", "an import requester has the wrong name");
-    change(0, true);
-    {
+    const auto mappedRange = [&](std::size_t index) {
         GuestAllocations::Mapped ranges;
         const auto lease = GuestAllocations::GuestAllocationsAcquire_nid_postfix();
         for (const auto& range : lease) {
-            if (range->address == address(0)) ranges.push_back(range);
+            if (range->address == address(index)) ranges.push_back(range);
         }
         Require(ranges.size() == 1, "the requester test's mapped range is not registered");
+        return ranges;
+    };
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block + 6 * piece, 2 * piece, true, true, true);
+    }
+    {
         const auto before = made(ImportRequester::Map);
-        static_cast<void>(ImportMappedRanges(importing, ranges, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true));
-        Require(made(ImportRequester::Map) == before + 1 && HostImportCovers(importing, address(0), piece), "a range imported at map time was not counted for the map requester");
+        static_cast<void>(ImportMappedRanges(importing, mappedRange(6), GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true));
+        Require(made(ImportRequester::Map) == before + 1 && HostImportCovers(importing, address(6), 2 * piece), "a range imported at map time was not counted for the map requester");
+    }
+    change(0, true);
+    {
+        const auto map = made(ImportRequester::Map);
+        const auto access = made(ImportRequester::Access);
+        static_cast<void>(ImportMappedRanges(importing, mappedRange(0), GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true));
+        Require(made(ImportRequester::Map) == map && !HostImportCovers(importing, address(0), 16), "a range of 64 KiB was imported at map time");
+        Require(HostImportFor(importing, address(0), 16) != nullptr && HostImportCovers(importing, address(0), piece) && made(ImportRequester::Access) == access + 1 && made(ImportRequester::Map) == map,
+            "a range of 64 KiB left to its first GPU use was not imported there, or not counted for that use's requester");
     }
     change(1, true);
     {
@@ -1198,6 +1248,10 @@ void importRequesterTests(const Context& context, const BdaTestAccess& access) {
     const auto counts = HostImportCounters();
     Require(counts.live >= 4 && counts.liveBytes == HostImportLiveBytes(), "the live import counts disagree with the live bytes");
     for (std::size_t index = 0; index < 6; ++index) change(index, false);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Remove(block + 6 * piece);
+    }
     ClearHostImports(importing.device);
     ::operator delete(block, std::align_val_t{piece});
 }
@@ -1219,7 +1273,7 @@ public:
     static constexpr std::size_t Window = std::size_t{8} << 20u;
 
     explicit PieceWindow(const Context& context, bool views = false) : importing(context) {
-#ifndef _WIN32
+#ifdef __linux__
         if (views) {
             reserved = mmap(nullptr, 2 * Window, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
             Require(reserved != MAP_FAILED, "cannot reserve the block of 16 KiB views");
@@ -2138,6 +2192,119 @@ ShaderRecompiler::DescriptorBinding binding(Role role, std::uint32_t slot) {
     return {ShaderRecompiler::DescriptorKind::StorageBuffer, role, 0, slot, 1, {}, false};
 }
 
+void partialHeapImportBudgetCase(const Context& context, const BdaTestAccess& access, std::size_t bytes, std::size_t budgetBytes, std::size_t prefixBytes) {
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) return;
+    constexpr std::size_t window = 2 * 65536;
+    const auto allocated = bytes + 65536;
+    void* block = GuestArena::GuestArenaAllocate_nid_postfix(allocated, 65536);
+#ifdef _WIN32
+    GuestArena::GuestArenaCommit_nid_postfix(block, allocated, PAGE_READWRITE, allocated);
+#endif
+    auto* guest = static_cast<std::uint8_t*>(block);
+    std::memset(block, 0x39, bytes);
+    std::memset(guest + bytes, 0xa7, allocated - bytes);
+    const auto first = reinterpret_cast<std::uintptr_t>(block);
+    auto importing = context;
+    importing.hostImportAlignment = 65536;
+    const auto live = HostImportLiveBytes();
+    const auto before = MirrorCounters();
+    SetHostImportRangeWindow(window);
+    SetHostImportBudget(live + budgetBytes);
+    const auto registry = [&](bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, block, bytes, true, true, true);
+        else GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, block);
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    registry(true);
+    {
+        auto withoutImports = context;
+        withoutImports.hostImportAlignment = 0;
+        GuestBufferMemory leased(withoutImports);
+        leased.AcquireRegistered();
+        leased.AddWritable(first + bytes - 16, 4);
+        leased.Upload(true);
+        std::uint32_t adjustment = 0;
+        const auto view = leased.Descriptor(first + bytes - 16, 4, adjustment);
+        access.bytes(view.buffer)[view.offset + adjustment] = std::byte{0x43};
+        leased.WriteBack();
+    }
+    Require(MirrorCounters().heapBytes == before.heapBytes + bytes && guest[bytes - 16] == 0x43, "the partial-import fixture did not start with a valid full heap mirror");
+    GuestAllocations::GuestAllocationsEnd_nid_postfix(GuestAllocations::GuestAllocationsBegin_nid_postfix());
+    const auto build = [&](bool write) {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        if (write) {
+            leased.AddWritable(first + 16, 32);
+            leased.AddWritable(first + bytes - 48, 32);
+        }
+        leased.Upload(true);
+        const auto* prefix = ExistingHostImportFor(importing, first, window);
+        Require(prefix != nullptr, "a heap exceeding the import budget did not import its fitting prefix");
+        Require(HostImportLiveBytes() <= live + budgetBytes, "partial heap imports exceeded the configured budget");
+        Require(MirrorCounters().heapBytes == before.heapBytes + bytes - prefixBytes, "a partially imported heap mirrored bytes already imported in place");
+        auto covered = first;
+        for (const auto& entry : leased.AddressRanges()) {
+            if (entry.end <= first || entry.begin >= first + bytes) continue;
+            Require(entry.begin == covered && entry.end <= first + bytes, "partial heap BDA ranges have a gap or overlap");
+            if (entry.end <= first + prefixBytes) {
+                const auto* imported = ExistingHostImportFor(importing, entry.begin, static_cast<std::size_t>(entry.end - entry.begin));
+                Require(imported != nullptr && imported->bytes <= window && entry.deviceAddress == imported->address + entry.begin - imported->base, "the partial heap prefix is not served by bounded imports");
+            }
+            if (entry.begin >= first + prefixBytes) {
+                std::uint32_t adjustment = 0;
+                const auto view = leased.Descriptor(entry.begin, static_cast<std::size_t>(entry.end - entry.begin), adjustment);
+                const auto data = access.bytes(view.buffer).subspan(view.offset + adjustment);
+                Require(data[0] == static_cast<std::byte>(guest[entry.begin - first]) && data[entry.end - entry.begin - 1] == static_cast<std::byte>(guest[entry.end - first - 1]), "a partial heap mirror lost its first or last bytes");
+            }
+            covered = entry.end;
+        }
+        Require(covered == first + bytes, "a partially imported heap does not cover its registered range");
+        if (write) {
+            for (const auto at : {first + 16, first + bytes - 48}) {
+                if (at < first + prefixBytes) guest[at - first] = 0x71;
+                else {
+                    std::uint32_t adjustment = 0;
+                    const auto view = leased.Descriptor(at, 32, adjustment);
+                    access.bytes(view.buffer)[view.offset + adjustment] = std::byte{0x71};
+                }
+                guest[at - first + 8] = 0x52;
+            }
+        }
+        leased.WriteBack();
+    };
+    build(true);
+    Require(guest[16] == 0x71 && guest[24] == 0x52 && guest[bytes - 48] == 0x71 && guest[bytes - 40] == 0x52, "partial heap write-back lost GPU or genuine CPU stores");
+    guest[bytes - 1] = 0x67;
+    build(false);
+    const auto quiet = MirrorCounters();
+    guest[bytes + 9] = 0x8a;
+    build(false);
+    Require(MirrorCounters().blocksCopied == quiet.blocksCopied, "a neighboring CPU write refreshed an unrelated partial heap mirror");
+    Require(guest[bytes + 9] == 0x8a && guest[bytes] == 0xa7 && guest[allocated - 1] == 0xa7, "partial heap uses changed unregistered neighboring memory");
+    registry(false);
+    {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        leased.WriteBack();
+    }
+    Require(MirrorCounters().heapBytes == before.heapBytes, "a partial heap mirror outlived its registered range");
+    SetHostImportBudget(0);
+    SetHostImportRangeWindow(std::uint64_t{64} << 20u);
+    GuestArena::GuestArenaReset_nid_postfix(block, allocated);
+    GuestArena::GuestArenaRelease_nid_postfix(block, allocated);
+}
+
+void partialHeapImportBudgetTests(const Context& context, const BdaTestAccess& access) {
+    constexpr std::size_t window = 2 * 65536;
+    partialHeapImportBudgetCase(context, access, 3 * window, 2 * window, 2 * window);
+    partialHeapImportBudgetCase(context, access, 3 * window + 65536, 3 * window, 2 * window);
+    SetHostImportMaxBytes(window);
+    partialHeapImportBudgetCase(context, access, 3 * window, 2 * window, 2 * window);
+    SetHostImportMaxBytes(0);
+}
+
 void importedHeapMirrorTests(const Context& context, const BdaTestAccess& access) {
     if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
         std::cout << "guest arena unavailable or not write-watched: heap mirrors of imported ranges not tested\n";
@@ -2193,6 +2360,64 @@ void importedHeapMirrorTests(const Context& context, const BdaTestAccess& access
     GuestArena::GuestArenaRelease_nid_postfix(block, bytes);
 }
 
+void retiredImportWatchTests(const Context& context) {
+#ifdef _WIN32
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
+        std::cout << "guest arena unavailable or not write-watched: the write watch of retired imports not tested\n";
+        return;
+    }
+    constexpr std::size_t piece = 65536;
+    constexpr std::size_t bytes = 2 * piece;
+    void* block = GuestArena::GuestArenaAllocate_nid_postfix(bytes, bytes);
+    GuestArena::GuestArenaCommit_nid_postfix(block, bytes, PAGE_READWRITE, bytes);
+    std::memset(block, 0x5a, bytes);
+    auto* guest = static_cast<std::uint8_t*>(block);
+    const auto address = reinterpret_cast<std::uintptr_t>(block);
+    auto importing = context;
+    importing.hostImportAlignment = piece;
+    SetHostImportWindow(bytes);
+    SetHostImportDeferredSettles(false);
+    ClearHostImports(importing.device);
+    const auto decided = PrepareImportWatch(importing);
+    SetImportWatch(importing, ImportWatch::Unwatch);
+    const auto registry = [&](std::size_t offset, bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, guest + offset, piece, true, true, true);
+        else GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, guest + offset);
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    const auto build = [&] {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        leased.WriteBack();
+    };
+    registry(0, true);
+    build();
+    Require(HostImportCovers(importing, address, piece), "the first 64 KiB piece was not imported on its own");
+    Require(!AgcDriver::GuestMemory::Watched(address, piece), "an unwatched 64 KiB import kept its piece in the write watch");
+    registry(piece, true);
+    SetHostImportBudget(4096);
+    const auto before = MirrorCounters();
+    build();
+    Require(!HostImportCovers(importing, address, piece), "the piece's import outlived the run that grew past it, or a 128 KiB block fit a 4 KiB budget");
+    Require(AgcDriver::GuestMemory::Watched(address, piece), "a 64 KiB piece whose import retired when its run grew into a block stayed outside the write watch");
+    Require(MirrorCounters().heapMirrors == before.heapMirrors + 2, "a 64 KiB piece whose import retired when its run grew into a block was copied, not heap mirrored, once no import fit");
+    registry(piece, false);
+    registry(0, false);
+    build();
+    SetImportWatch(importing, decided);
+    ClearHostImports(importing.device);
+    SetHostImportBudget(0);
+    SetHostImportWindow(0);
+    SetHostImportDeferredSettles(true);
+    GuestArena::GuestArenaReset_nid_postfix(block, bytes);
+    GuestArena::GuestArenaRelease_nid_postfix(block, bytes);
+#else
+    static_cast<void>(context);
+#endif
+}
+
 void importedFreshTests(const Context& context) {
 #ifndef _WIN32
     if (!GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) {
@@ -3263,6 +3488,137 @@ void RunHeapMirrorRunUnwatchTests(const Context& context, const BdaTestAccess& a
     std::cout << "an address-based build refreshes the unwatched heap of a run in full and its watched neighbour by its writes\n";
 }
 
+void RunAddressCopyCapTests(const Context& context, const BdaTestAccess& access, bool remembered) {
+    constexpr std::size_t block = 65536;
+    constexpr std::size_t heapBytes = 32 * block;
+    constexpr std::size_t idleBytes = 16 * block;
+    constexpr std::size_t busyBytes = block;
+#ifdef _WIN32
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
+        std::cout << "guest arena unavailable or not write-watched: the address copy cap not tested\n";
+        return;
+    }
+#else
+    if (!GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) {
+        std::cout << "write watch unavailable: the address copy cap not tested\n";
+        return;
+    }
+#endif
+    struct Piece {
+        void* pointer = nullptr;
+        void* mapping = nullptr;
+        std::size_t allocated = 0;
+        std::size_t bytes = 0;
+    };
+    std::array<Piece, 4> pieces{};
+    const std::array<std::pair<std::size_t, std::size_t>, 4> sizes{{{heapBytes + block, heapBytes}, {heapBytes + block, idleBytes}, {busyBytes + block, busyBytes}, {busyBytes + block, busyBytes}}};
+    for (std::size_t index = 0; index < pieces.size(); ++index) {
+        auto& piece = pieces[index];
+        piece.allocated = sizes[index].first;
+        piece.bytes = sizes[index].second;
+#ifdef _WIN32
+        piece.pointer = GuestArena::GuestArenaAllocate_nid_postfix(piece.allocated, block);
+        Require(piece.pointer != nullptr, "cannot allocate the address copy cap ranges in the guest arena");
+        GuestArena::GuestArenaCommit_nid_postfix(piece.pointer, piece.allocated, PAGE_READWRITE, piece.allocated);
+        piece.mapping = piece.pointer;
+#else
+        piece.mapping = mmap(nullptr, piece.allocated + block, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        Require(piece.mapping != MAP_FAILED, "cannot map the address copy cap ranges");
+        piece.pointer = reinterpret_cast<void*>((reinterpret_cast<std::uintptr_t>(piece.mapping) + block - 1) & ~std::uintptr_t{block - 1});
+#endif
+        std::memset(piece.pointer, 0x5a, piece.allocated);
+    }
+    if (pieces[1].pointer < pieces[0].pointer) {
+        std::swap(pieces[0].pointer, pieces[1].pointer);
+        std::swap(pieces[0].mapping, pieces[1].mapping);
+    }
+    const auto heap = reinterpret_cast<std::uintptr_t>(pieces[0].pointer);
+    const auto idle = reinterpret_cast<std::uintptr_t>(pieces[1].pointer);
+    const auto busy = reinterpret_cast<std::uintptr_t>(pieces[2].pointer);
+    Require(heap < idle, "the idle range does not follow the heap in the registry");
+#ifndef _WIN32
+    GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(pieces[0].pointer, heapBytes);
+#endif
+    const auto registry = [&](bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        for (std::size_t index = 0; index < 3; ++index) {
+            if (add) GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, pieces[index].pointer, pieces[index].bytes, true, false, true);
+            else GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, pieces[index].pointer);
+        }
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    const auto unrelated = [&](bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, pieces[3].pointer, pieces[3].bytes, true, false, false);
+        else GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, pieces[3].pointer);
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    registry(true);
+#ifdef _WIN32
+    AgcDriver::GuestMemory::Unwatch(idle, idleBytes);
+    AgcDriver::GuestMemory::Unwatch(busy, busyBytes);
+#endif
+    auto importing = context;
+    importing.hostImportAlignment = block;
+    SetHostImportBudget(heapBytes + idleBytes + busyBytes - block);
+    Require(HostImportFor(importing, idle, 64) != nullptr && HostImportFor(importing, busy, 64) != nullptr, "the idle and busy ranges were not imported");
+    Require(HostImportLiveBytes() == idleBytes + busyBytes && !HostImportCovers(importing, heap, heapBytes), "the imports before the build are not the idle and busy ranges");
+    Require(AgcDriver::GuestMemory::Watched(heap, heapBytes), "the heap is not write-watched");
+    const auto before = MirrorCounters();
+    const auto builds = [] { return HostImportCounters().requesters[static_cast<std::size_t>(ImportRequester::Build)]; };
+    const auto unwatch = [&] {
+        AgcDriver::GuestMemory::Unwatch(heap + heapBytes / 2, block);
+        Require(AgcDriver::GuestMemory::Watched(heap, heapBytes / 2) && !AgcDriver::GuestMemory::Watched(heap, heapBytes), "the heap is not partly outside the write watch");
+    };
+    if (remembered) {
+        unwatch();
+        SetAddressCopyLimit(2 * heapBytes);
+        {
+            GuestBufferMemory leased(importing);
+            leased.AcquireRegistered();
+            leased.Upload(true);
+            Require(MirrorCounters().heapMirrors == before.heapMirrors && !HostImportCovers(importing, heap, heapBytes), "the first build did not copy the heap whose import the budget refused");
+            leased.WriteBack();
+        }
+        SetAddressCopyLimit(0);
+        unrelated(true);
+    }
+    for (int use = 0; use < 300; ++use) Require(HostImportFor(importing, busy, 64) != nullptr, "the busy range lost its import");
+    if (!remembered) unwatch();
+    const auto refused = builds();
+    {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        const bool imported = HostImportCovers(importing, heap, heapBytes);
+        Require(imported || (!remembered && MirrorCounters().heapMirrors == before.heapMirrors + 1), "the heap is neither imported nor mirrored");
+        const auto ranges = leased.AddressRanges();
+        const auto found = std::find_if(ranges.begin(), ranges.end(), [&](const auto& range) { return range.begin == heap; });
+        Require(found != ranges.end() && found->deviceAddress != 0u, "the heap is missing from the BDA table");
+        Require(imported || access.addressBytes(found->deviceAddress)[heapBytes / 2 + 3] == std::byte{0x5a}, "the heap mirror does not hold the guest bytes");
+        leased.WriteBack();
+    }
+    Require(!remembered || builds().remembered == refused.remembered + 1, "the build under the copy cap was not answered from the refusal the first build remembered");
+    SetHostImportBudget(0);
+    if (remembered) unrelated(false);
+    registry(false);
+    ClearImageMirrors(importing.device);
+    ClearHostImports(importing.device);
+    ClearSnapshotCopies(importing.device);
+#ifndef _WIN32
+    GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(pieces[0].pointer, heapBytes);
+#endif
+    for (const auto& piece : pieces) {
+#ifdef _WIN32
+        GuestArena::GuestArenaReset_nid_postfix(piece.pointer, piece.allocated);
+        GuestArena::GuestArenaRelease_nid_postfix(piece.pointer, piece.allocated);
+#else
+        munmap(piece.mapping, piece.allocated + block);
+#endif
+    }
+    std::cout << (remembered ? "an address-based build answered from a remembered budget refusal evicts instead of copying a partly unwatched heap past the cap\n" : "an address-based build serves a partly unwatched heap whose import is over the budget\n");
+}
+
 void hostWriteWatchExclusionTests() {
 #ifdef _WIN32
     std::vector<std::uint8_t> host(64, 0x31);
@@ -3276,6 +3632,200 @@ void hostWriteWatchExclusionTests() {
 #endif
 }
 
+void sparseJoinedHeapMirrorTests(const Context& context, const BdaTestAccess& access) {
+    constexpr std::size_t half = 1u << 20u;
+    constexpr std::size_t reserved = 2 * half;
+    constexpr std::size_t page = 65536;
+#ifdef _WIN32
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
+        std::cout << "guest arena unavailable or not write-watched: sparse heap mirrors over adjacent ranges not tested\n";
+        return;
+    }
+    void* block = GuestArena::GuestArenaAllocate_nid_postfix(reserved, page);
+    auto* guest = static_cast<std::uint8_t*>(block);
+    GuestArena::GuestArenaCommit_nid_postfix(guest, page, PAGE_READWRITE, page);
+    GuestArena::GuestArenaCommit_nid_postfix(guest + half, page, PAGE_READWRITE, page);
+#else
+    if (!GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) {
+        std::cout << "write watch unavailable: sparse heap mirrors over adjacent ranges not tested\n";
+        return;
+    }
+    void* mapping = mmap(nullptr, reserved + page, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    Require(mapping != MAP_FAILED, "cannot reserve the sparse heap over adjacent ranges");
+    auto* guest = reinterpret_cast<std::uint8_t*>((reinterpret_cast<std::uintptr_t>(mapping) + page - 1) & ~std::uintptr_t{page - 1});
+    Require(mprotect(guest, page, PROT_READ | PROT_WRITE) == 0 && mprotect(guest + half, page, PROT_READ | PROT_WRITE) == 0, "cannot commit the sparse heap pages");
+    GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(guest, reserved);
+    void* block = guest;
+#endif
+    auto* second = guest + half;
+    std::memset(guest, 0x5a, page);
+    std::memset(second, 0x6b, page);
+    const auto base = reinterpret_cast<std::uintptr_t>(block);
+    const auto registry = [&](bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) {
+            GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, guest, half, true, true, true);
+            GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, second, half, true, true, true);
+        } else {
+            GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, guest);
+            GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, second);
+        }
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    const auto sweep = [&] {
+        GuestBufferMemory memory(context);
+        memory.AcquireRegistered();
+        memory.Upload(true);
+        memory.WriteBack();
+    };
+    sweep();
+    registry(true);
+    const auto bind = [&] {
+        GuestBufferMemory memory(context);
+        memory.AddWritable(base, reserved);
+        memory.Upload(false);
+        std::uint32_t adjustment = 0;
+        const auto view = memory.Descriptor(base, reserved, adjustment);
+        Require(adjustment == 0, "a sparse heap view over adjacent ranges is adjusted");
+        const auto bytes = access.bytes(view.buffer);
+        Require(view.range >= half + page && bytes[view.offset + page - 1] == std::byte{0x5a} && bytes[view.offset + page] == std::byte{} && bytes[view.offset + half] == std::byte{0x6b}, "a sparse heap over adjacent ranges is not bound to its committed extent");
+        bytes[view.offset + half + 8] = std::byte{0x77};
+        memory.WriteBack();
+        return view;
+    };
+    const auto before = MirrorCounters();
+    const auto first = bind();
+    const auto made = MirrorCounters();
+    Require(made.sparseBinds == before.sparseBinds + 1 && made.heapMirrors == before.heapMirrors + 1, "a sparse heap whose committed span crosses an adjacent range was not mirrored");
+    Require(second[8] == 0x77, "a store to the adjacent range of a mirrored sparse heap was not written back");
+    second[8] = 0x6b;
+    const auto again = bind();
+    Require(again.buffer == first.buffer && MirrorCounters().rebuilds == made.rebuilds && MirrorCounters().sparseBinds == made.sparseBinds + 1, "a sparse heap over unchanged adjacent ranges did not reuse its mirror");
+    registry(false);
+    sweep();
+    Require(MirrorCounters().heapMirrors == before.heapMirrors && MirrorCounters().heapBytes == before.heapBytes, "the sparse heap mirror over adjacent ranges outlived its ranges");
+#ifdef _WIN32
+    GuestArena::GuestArenaReset_nid_postfix(block, reserved);
+    GuestArena::GuestArenaRelease_nid_postfix(block, reserved);
+#else
+    GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(guest, reserved);
+    munmap(mapping, reserved + page);
+#endif
+}
+
+void joinedHeapMirrorPartialImportTests(const Context& context, const BdaTestAccess& access) {
+    constexpr std::size_t half = 1u << 20u;
+    constexpr std::size_t committed = 2 * half;
+    constexpr std::size_t reserved = 4 * half;
+    constexpr std::size_t page = 65536;
+#ifdef _WIN32
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
+        std::cout << "guest arena unavailable or not write-watched: joined heap mirrors under a partial import not tested\n";
+        return;
+    }
+    void* block = GuestArena::GuestArenaAllocate_nid_postfix(reserved, half);
+    auto* guest = static_cast<std::uint8_t*>(block);
+    GuestArena::GuestArenaCommit_nid_postfix(guest, committed, PAGE_READWRITE, page);
+#else
+    if (!GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) {
+        std::cout << "write watch unavailable: joined heap mirrors under a partial import not tested\n";
+        return;
+    }
+    void* mapping = mmap(nullptr, reserved + half, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    Require(mapping != MAP_FAILED, "cannot reserve the joined heap");
+    auto* guest = reinterpret_cast<std::uint8_t*>((reinterpret_cast<std::uintptr_t>(mapping) + half - 1) & ~std::uintptr_t{half - 1});
+    Require(mprotect(guest, committed, PROT_READ | PROT_WRITE) == 0, "cannot commit the joined heap ranges");
+    GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(guest, reserved);
+    void* block = guest;
+#endif
+    std::memset(guest, 0x3c, committed);
+    const auto base = reinterpret_cast<std::uintptr_t>(block);
+    const auto registry = [&](bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) {
+            GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, guest, half, true, true, true);
+            GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, guest + half, half, true, true, true);
+        } else {
+            GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, guest);
+            GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, guest + half);
+        }
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    const auto sweep = [&](const Context& with) {
+        GuestBufferMemory memory(with);
+        memory.AcquireRegistered();
+        memory.Upload(true);
+        memory.WriteBack();
+    };
+    const auto bind = [&] {
+        GuestBufferMemory memory(context);
+        memory.AddWritable(base, reserved);
+        memory.Upload(false);
+        std::uint32_t adjustment = 0;
+        const auto view = memory.Descriptor(base, reserved, adjustment);
+        Require(adjustment == 0 && access.bytes(view.buffer)[view.offset + half + 32] == std::byte{0x3c}, "a heap bound across two committed ranges did not read its second range");
+        memory.WriteBack();
+        return view;
+    };
+    sweep(context);
+    registry(true);
+    const auto before = MirrorCounters();
+    const auto first = bind();
+    const auto made = MirrorCounters();
+    Require(made.heapMirrors == before.heapMirrors + 1 && made.sparseBinds == before.sparseBinds + 1, "a heap bound across two committed ranges was not mirrored over both");
+    auto importing = context;
+    importing.hostImportAlignment = page;
+    SetHostImportWindow(half);
+    SetHostImportRangeWindow(half);
+    SetHostImportBudget(HostImportLiveBytes() + half);
+    {
+        GuestBufferMemory memory(importing);
+        memory.AcquireRegistered();
+        Require(ExistingHostImportFor(importing, base, half) != nullptr && ExistingHostImportFor(importing, base + half, half) == nullptr, "the joined heap partial-import fixture did not import exactly its first range");
+        Require(HeapMirrorsWithin(base, base + half).mirrors == 1, "an address build that imported one range of a joined heap mirror released the mirror");
+        memory.Upload(true);
+        memory.WriteBack();
+    }
+    const auto partial = MirrorCounters();
+    const auto again = bind();
+    Require(again.buffer == first.buffer && MirrorCounters().rebuilds == partial.rebuilds, "a joined heap mirror was rebuilt after an import of one of its ranges");
+    {
+        GuestBufferMemory memory(importing);
+        memory.AcquireRegistered();
+        memory.AddWritable(base + half, 32);
+        memory.Upload(true);
+        if (ExistingHostImportFor(importing, base + half, 32) != nullptr) guest[half] = 0x71;
+        else {
+            std::uint32_t adjustment = 0;
+            const auto view = memory.Descriptor(base + half, 32, adjustment);
+            access.bytes(view.buffer)[view.offset + adjustment] = std::byte{0x71};
+        }
+        guest[half + 8] = 0x52;
+        memory.WriteBack();
+    }
+    Require(guest[half] == 0x71 && guest[half + 8] == 0x52, "a joined heap address build lost GPU or genuine CPU stores");
+    const auto refreshed = bind();
+    Require(refreshed.buffer == first.buffer && access.bytes(refreshed.buffer)[refreshed.offset + half] == std::byte{0x71} && access.bytes(refreshed.buffer)[refreshed.offset + half + 8] == std::byte{0x52}, "the retained joined mirror did not refresh stores from an address build");
+    SetHostImportBudget(HostImportLiveBytes() + committed);
+    GuestAllocations::GuestAllocationsEnd_nid_postfix(GuestAllocations::GuestAllocationsBegin_nid_postfix());
+    sweep(importing);
+    Require(ExistingHostImportFor(importing, base, half) != nullptr && ExistingHostImportFor(importing, base + half, half) != nullptr, "the joined heap full-import fixture did not import both ranges");
+    Require(HeapMirrorsWithin(base, base + committed).mirrors == 0, "imports covering every joined heap range left a heap mirror allocated");
+    SetHostImportBudget(0);
+    SetHostImportWindow(0);
+    SetHostImportRangeWindow(std::uint64_t{64} << 20u);
+    ClearHostImports(context.device);
+    registry(false);
+    sweep(context);
+#ifdef _WIN32
+    GuestArena::GuestArenaReset_nid_postfix(block, reserved);
+    GuestArena::GuestArenaRelease_nid_postfix(block, reserved);
+#else
+    GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(guest, reserved);
+    munmap(mapping, reserved + half);
+#endif
+}
+
 void sparseHeapMirrorTests(const Context& context, const BdaTestAccess& access) {
 #ifdef _WIN32
     if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
@@ -3641,12 +4191,13 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     importMappedFailureGenerationTests(context);
     importStaleProbeTests(context, access);
     importRefusedWholeRangeTests(context);
+    importPiecesOverAllocationLimitTests(context);
     importNeighbouringEdgesTests(context);
     importAtMapOverBudgetTests(context);
     importRequesterTests(context, access);
     hostImportReportTests();
     importBlockMapTests(context, false);
-#ifndef _WIN32
+#ifdef __linux__
     importBlockMapTests(context, true);
 #endif
     importBlockBuildTests(context);
@@ -3673,7 +4224,9 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     importReportRefusalMemoryTests(context, access);
     sparseImportedHeapTests(context, access);
     heapMirrorTests(context, access);
+    partialHeapImportBudgetTests(context, access);
     importedHeapMirrorTests(context, access);
+    retiredImportWatchTests(context);
     importWatchTests();
     importedFreshTests(context);
     gpuMappingTests(context);
@@ -3682,8 +4235,15 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     spaceCommittedPagesTests(context, access);
     hostWriteWatchExclusionTests();
     sparseHeapMirrorTests(context, access);
+    sparseJoinedHeapMirrorTests(context, access);
+    joinedHeapMirrorPartialImportTests(context, access);
     Require(AddressCopyOverflow({{0x1000, 0x3000, 0x2000, "uncommitted pages"}}, 0x2000).empty(), "copies within the limit were refused");
     const auto copies = AddressCopyOverflow({{0x1000, 0x2000, 0x1000, "not mirrored"}, {0x10000, 0x30000, 0x18000, "uncommitted pages"}}, 0x2000);
     Require(!copies.empty() && copies.find("0x10000+0x20000 (0.1 MiB committed, uncommitted pages)") < copies.find("0x1000+0x1000"), "the copy limit does not name the largest copy first");
+    AgcDriver::GuestMemory::Unwatch(0x10000, 0x20000);
+    AgcDriver::GuestMemory::Unwatch(0x40000, 0x10000);
+    Require(!AgcDriver::GuestMemory::Watched(0x10000, 0x20000), "the unregistered heap copy range is write-watched");
+    const auto heapCopies = AddressCopyOverflow({{0x10000, 0x30000, 0x18000, nullptr, true, true}, {0x40000, 0x50000, 0x10000, nullptr, true, false}}, 0x2000);
+    Require(heapCopies.find("0x10000+0x20000 (0.1 MiB committed, import over the host import budget, heap not fully write-watched)") != std::string::npos && heapCopies.find("0x40000+0x10000 (0.1 MiB committed, heap not fully write-watched)") != std::string::npos, "the copy limit does not name a copied heap's reason");
     ClearSnapshotCopies(context.device);
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp b/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp
index 49cd994d6e..7479c1f4b1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp
+++ b/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp
@@ -21,6 +21,7 @@ void RunHeapMirrorUnwatchTests(const AgcDriver::Graphics::Context& context, cons
 void RunSparseHeapMirrorUnwatchTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access);
 void RunSparseHeapMirrorBudgetTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access);
 void RunHeapMirrorRunUnwatchTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access);
+void RunAddressCopyCapTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access, bool remembered);
 void RunGuestAllocationTests();
 void RunGuestLeaseWaitTests();
 void RunUnmappedGapTests();
diff --git a/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp b/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp
index abdf8f0166..66ec1aa305 100644
--- a/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp
@@ -11,6 +11,7 @@
 #include <deque>
 #include <initializer_list>
 #include <map>
+#include <limits>
 #include <memory>
 #include <new>
 #include <set>
@@ -675,6 +676,7 @@ struct ReclaimMock {
     VkDeviceSize externalBytes = 0;
     std::uint64_t requests = 0;
     VkDeviceSize asked = 0;
+    bool newImage = false;
 };
 
 ReclaimMock reclaimMock;
@@ -689,7 +691,8 @@ VkDeviceMemory ExternalAllocation(VkDeviceSize bytes) {
     return memory;
 }
 
-VkDeviceSize mockCacheReclaim(VkDeviceSize bytes) {
+VkDeviceSize mockCacheReclaim(VkDeviceSize bytes, bool newImage) {
+    Expect(newImage == reclaimMock.newImage, "an allocation used the wrong image-creation cache access");
     ++reclaimMock.requests;
     reclaimMock.asked = bytes;
     if (reclaimMock.external == VK_NULL_HANDLE) return 0;
@@ -701,6 +704,10 @@ VkDeviceSize mockCacheReclaim(VkDeviceSize bytes) {
 void CacheReclaimRecovery() {
     Expect(BufferPool::ReclaimTarget(4 * MiB) == 260 * MiB, "a 4 MiB request does not ask the caches for 256 MiB on top of itself");
     Expect(BufferPool::ReclaimTarget(512 * MiB) == 1024 * MiB, "a 512 MiB request does not ask the caches for twice its size");
+    const auto limit = std::numeric_limits<VkDeviceSize>::max();
+    Expect(BufferPool::ReclaimTarget(limit / 2u) == limit - 1u, "the largest doubled request without overflow lost its reserve");
+    Expect(BufferPool::ReclaimTarget(limit / 2u + 1u) == limit, "a reclaim target wrapped when twice the request overflowed");
+    Expect(BufferPool::ReclaimTarget(limit) == limit, "the largest reclaim request wrapped to a smaller target");
     constexpr auto usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT;
     mock = MockDevice{};
     reclaimMock = ReclaimMock{};
@@ -775,18 +782,23 @@ void ImageCacheReclaim() {
     VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
     allocation.allocationSize = 8 * MiB;
     allocation.memoryTypeIndex = 0;
-    const auto refuse = [&](std::initializer_list<VkResult> results) {
+    const auto refuse = [&](std::initializer_list<VkResult> results, bool newImage = false) {
         ExternalAllocation(4 * MiB);
+        reclaimMock.newImage = newImage;
         mock.results = results;
         const auto requests = reclaimMock.requests;
-        const auto memory = AllocateImageMemory(context, allocation, 3, "vkAllocateMemory texture");
+        const auto before = mock.attempts;
+        const auto memory = AllocateImageMemory(context, allocation, 3, "vkAllocateMemory texture", nullptr, newImage);
         Expect(reclaimMock.requests == requests + 1 && reclaimMock.external == VK_NULL_HANDLE, "a texture refused device memory did not release the texture caches before retrying");
+        Expect(mock.attempts == before + results.size() + 1, "image recovery or host fallback exceeded its bounded attempts");
         const auto type = mock.memoryTypes.at(memory);
         mockFreeMemory(VK_NULL_HANDLE, memory, nullptr);
         return type;
     };
     Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY}) == 0, "a texture was placed in host memory although releasing the texture caches made room in device memory");
     Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY, VK_ERROR_OUT_OF_DEVICE_MEMORY}) == 1, "a texture still refused device memory after releasing the texture caches was not placed in host memory");
+    Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY}, true) == 0, "a new image was placed in host memory before retrying after cache release");
+    Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY, VK_ERROR_OUT_OF_DEVICE_MEMORY}, true) == 1, "a new image refused device memory after cache release lost its host fallback");
     Expect(mock.liveBytes == 0, "a texture allocation leaked memory");
 }
 
@@ -832,6 +844,103 @@ void AllocationFailureReportsHeapBudgets() {
     Expect(diagnosticBudgetQueries == 0, "missing-extension fallback attempted a memory budget query");
 }
 
+Context reclaimContext() {
+    auto context = mockContext();
+    context.memory.memoryHeapCount = 2;
+    context.memory.memoryHeaps[0] = {4096 * MiB, VK_MEMORY_HEAP_DEVICE_LOCAL_BIT};
+    context.memory.memoryHeaps[1] = {8192 * MiB, 0};
+    context.memory.memoryTypes[1].heapIndex = 1;
+    return context;
+}
+
+void IdleDeviceReclaim() {
+    mock = MockDevice{};
+    {
+        auto context = reclaimContext();
+        VkBuffer cold;
+        VkBuffer nextCold;
+        VkBuffer hot;
+        VkBuffer host;
+        VkBuffer small;
+        { DeviceBuffer buffer(context, 2 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); cold = buffer.Handle(); }
+        { DeviceBuffer buffer(context, 3 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); nextCold = buffer.Handle(); }
+        { DeviceBuffer buffer(context, 4 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); hot = buffer.Handle(); }
+        { Buffer buffer(context, 8 * MiB, VK_BUFFER_USAGE_TRANSFER_SRC_BIT); host = buffer.Handle(); }
+        { Buffer buffer(context, 1024, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT); small = buffer.Handle(); }
+        DeviceBuffer active(context, 16 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+        auto& pool = *context.bufferPool;
+        const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+        Expect(pool.ReclaimIdleDevice(MiB, start) == 0, "the first pressure observation reclaimed a buffer without an idle interval");
+        Expect(pool.ReclaimIdleDevice(MiB, start + std::chrono::milliseconds(999)) == 0, "a partial idle interval reclaimed a buffer");
+        {
+            DeviceBuffer reused(context, 4 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+            Expect(reused.Handle() == hot, "the warm device buffer was not reused");
+        }
+        const auto next = start + std::chrono::seconds(1);
+        SetAllocationFailureCountdown(0);
+        bool threw = false;
+        try {
+            pool.ReclaimIdleDevice(MiB, next);
+        } catch (const std::bad_alloc&) {
+            threw = true;
+        }
+        SetAllocationFailureCountdown(-1);
+        Expect(threw && mock.liveBuffers.contains(cold) && mock.liveBuffers.contains(nextCold), "a failed reclaim collection lost ownership of an allocation");
+        Expect(pool.ReclaimIdleDevice(MiB, next) == 2 * MiB, "reclaim did not release exactly the oldest complete idle allocation");
+        Expect(!mock.liveBuffers.contains(cold) && mock.liveBuffers.contains(nextCold), "bounded reclaim released the wrong allocation or exceeded its request");
+        Expect(pool.ReclaimIdleDevice(0, next) == 0, "zero pressure released a buffer");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next) == 3 * MiB, "reclaim counted a hot, live, host or slab allocation as idle device memory");
+        for (const auto buffer : {hot, host, small, active.Handle()}) Expect(mock.liveBuffers.contains(buffer), "reclaim destroyed a protected buffer");
+        SetAllocationFailureCountdown(0);
+        const auto empty = pool.ReclaimIdleDevice(32 * MiB, next);
+        SetAllocationFailureCountdown(-1);
+        Expect(empty == 0, "an unchanged empty eligible set did not stay empty");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, start) == 0, "a backwards time observation reclaimed a buffer");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next + std::chrono::seconds(1)) == 4 * MiB, "a device buffer did not become reclaimable after a complete idle interval");
+        Expect(mock.liveBuffers.contains(active.Handle()), "reclaim touched an allocation still in use");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next + std::chrono::seconds(2)) == 0, "an empty device tier reported reclaimed memory");
+    }
+    Expect(mock.liveBytes == 0 && mock.liveBuffers.empty(), "idle device reclaim leaked an allocation");
+}
+
+void IdleReclaimPreservesWorkingSet() {
+    mock = MockDevice{};
+    {
+        auto context = reclaimContext();
+        const auto useWorkingSet = [&] {
+            std::vector<std::unique_ptr<DeviceBuffer>> buffers;
+            for (unsigned i = 0; i < 4; ++i) buffers.push_back(std::make_unique<DeviceBuffer>(context, 96 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT));
+        };
+        useWorkingSet();
+        const auto allocations = mock.allocations;
+        const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+        auto& pool = *context.bufferPool;
+        Expect(pool.ReclaimIdleDevice(1024 * MiB, start) == 0, "initial pressure discarded the working set");
+        for (unsigned second = 1; second <= 4; ++second) {
+            useWorkingSet();
+            Expect(pool.ReclaimIdleDevice(1024 * MiB, start + std::chrono::seconds(second)) == 0, "pressure discarded buffers reused during the observation interval");
+            Expect(mock.allocations == allocations && mock.liveBytes == 384 * MiB, "a reusable working set larger than 128 MiB was recreated or shrunk");
+        }
+        Expect(pool.ReclaimIdleDevice(1024 * MiB, start + std::chrono::seconds(5)) == 384 * MiB, "the former working set remained retained after becoming idle");
+        Expect(mock.liveBytes == 0, "reclaim did not return the idle working set to the device");
+    }
+    Expect(mock.liveBuffers.empty(), "working-set reclaim leaked a buffer");
+    for (const auto heaps : {0u, 2u}) {
+        mock = MockDevice{};
+        {
+            auto context = reclaimContext();
+            context.memory.memoryHeapCount = heaps;
+            context.memory.memoryHeaps[1].flags = VK_MEMORY_HEAP_DEVICE_LOCAL_BIT;
+            { DeviceBuffer buffer(context, 2 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); }
+            auto& pool = *context.bufferPool;
+            const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+            Expect(pool.ReclaimIdleDevice(4 * MiB, start) == 0 && pool.ReclaimIdleDevice(4 * MiB, start + std::chrono::seconds(1)) == 0, "reclaim assumed a device heap without unambiguous ownership");
+            Expect(mock.liveBytes == 2 * MiB, "reclaim released memory from an unknown or different local heap");
+        }
+        Expect(mock.liveBytes == 0 && mock.liveBuffers.empty(), "unsupported-heap reclaim leaked an allocation");
+    }
+}
+
 void SuccessfulAllocationKeepsPool() {
     mock = MockDevice{};
     {
@@ -900,7 +1009,7 @@ void DeviceBindingFailures() {
 VkDeviceMemory reclaimImage = VK_NULL_HANDLE;
 const Context* reclaimImageContext = nullptr;
 
-VkDeviceSize mockImageReclaim(VkDeviceSize) {
+VkDeviceSize mockImageReclaim(VkDeviceSize, bool) {
     if (reclaimImage == VK_NULL_HANDLE) return 0;
     ReleaseImageMemory(*reclaimImageContext, reclaimImage, 10 * MiB, 0);
     reclaimImage = VK_NULL_HANDLE;
@@ -1001,10 +1110,50 @@ void ImageMemoryReuse() {
     Expect(mock.frees == 35 && context.bufferPool->RetainedImages() == 1, "the pool retains image memory again after a trim");
 }
 
+void IdleReclaimPreservesImages() {
+    mock = MockDevice{};
+    {
+        auto context = reclaimContext();
+        VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+        allocation.allocationSize = 4 * MiB;
+        allocation.memoryTypeIndex = 0;
+        std::uint32_t type = 99;
+        const auto image = AllocateImageMemory(context, allocation, 1u, "test idle image", &type);
+        ReleaseImageMemory(context, image, 4 * MiB, type);
+        VkBuffer buffer;
+        { DeviceBuffer idle(context, 2 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); buffer = idle.Handle(); }
+        auto& pool = *context.bufferPool;
+        const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+        Expect(pool.RetainedImages() == 1 && mock.liveBytes == 6 * MiB, "the mixed pool fixture was not retained");
+        Expect(pool.ReclaimIdleDevice(MiB, start) == 0, "initial pressure reclaimed mixed pool memory");
+        const auto next = start + std::chrono::seconds(1);
+        const auto released = pool.ReclaimIdleDevice(MiB, next);
+        Expect(released == 2 * MiB, "idle buffer reclaim selected image memory instead of the oldest buffer");
+        if (released != 2 * MiB) return;
+        Expect(!mock.liveBuffers.contains(buffer) && mock.liveBytes == 4 * MiB && pool.RetainedImages() == 1, "buffer reclaim changed image ownership or accounting");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next) == 0, "an image-only pool was reclaimed as idle buffers");
+        SetAllocationFailureCountdown(0);
+        const auto empty = pool.ReclaimIdleDevice(32 * MiB, next);
+        SetAllocationFailureCountdown(-1);
+        Expect(empty == 0, "a repeated image-only scan allocated or reclaimed memory");
+        const auto allocations = mock.allocations;
+        const auto reused = AllocateImageMemory(context, allocation, 1u, "test idle image", &type);
+        Expect(reused == image && mock.allocations == allocations && pool.RetainedImages() == 0, "the retained image was not reusable after buffer reclaim");
+        ReleaseImageMemory(context, reused, 4 * MiB, type);
+        Expect(pool.RetainedImages() == 1 && mock.liveBytes == 4 * MiB, "the reused image was not retained exactly once");
+    }
+    Expect(mock.liveBytes == 0 && mock.liveBuffers.empty() && mock.frees == 2, "mixed pool cleanup leaked or freed an allocation twice");
+}
+
+
 int main(int argc, char** argv) {
     try {
         if (argc == 2 && std::string_view(argv[1]) == "--small-device-retention") {
             SmallDeviceRetention();
+            if (std::getenv("APS5_STAGING_POOL_MIB") == nullptr) {
+                IdleDeviceReclaim();
+                IdleReclaimPreservesWorkingSet();
+            }
             return failures == 0 ? 0 : 1;
         }
         if (argc == 2) {
@@ -1040,6 +1189,9 @@ int main(int argc, char** argv) {
         AllocationFailure(VK_ERROR_OUT_OF_DEVICE_MEMORY, VK_ERROR_DEVICE_LOST, true);
         AllocationFailureReportsHeapBudgets();
         SuccessfulAllocationKeepsPool();
+        IdleDeviceReclaim();
+        IdleReclaimPreservesWorkingSet();
+        IdleReclaimPreservesImages();
         PartialSlabDoesNotRetry();
         CacheReclaimRecovery();
         ImageCacheReclaim();
diff --git a/core/libs/prx/libSceAgcDriver/tests/CaptureTrace.cpp b/core/libs/prx/libSceAgcDriver/tests/CaptureTrace.cpp
new file mode 100644
index 0000000000..b263f9e7b1
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/CaptureTrace.cpp
@@ -0,0 +1,160 @@
+#if !defined(_WIN32) && !defined(_POSIX_C_SOURCE)
+#define _POSIX_C_SOURCE 200809L
+#endif
+
+#include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
+
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <thread>
+
+namespace {
+
+void Check(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+void RemoveEnvironmentVariable(const char* name) {
+#ifdef _WIN32
+    _putenv_s(name, "");
+#else
+    unsetenv(name);
+#endif
+}
+
+bool FileExists(const char* path) {
+    std::error_code error;
+    return std::filesystem::exists(path, error) && !error;
+}
+
+std::string ReadFile(const char* path) {
+    std::ifstream stream(path, std::ios::binary);
+    Check(stream.is_open(), "the trace file was not created at the expected path");
+    std::ostringstream buffer;
+    buffer << stream.rdbuf();
+    return buffer.str();
+}
+
+bool WaitForRecord(const char* path, const std::string& record) {
+    for (int attempt = 0; attempt < 100; ++attempt) {
+        if (FileExists(path) && ReadFile(path).find(record) != std::string::npos) return true;
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    }
+    return false;
+}
+
+const char* RequiredPathVariable() {
+    const char* configured = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    Check(configured != nullptr && configured[0] != '\0',
+          "this case requires a non-empty APS5_CAPTURE_TRACE_PATH");
+    return configured;
+}
+
+void PathDefault() {
+    RemoveEnvironmentVariable("APS5_CAPTURE_TRACE_PATH");
+    Check(std::string(AgcDriver::CaptureTracePath()) == "capture-trace.log",
+          "an absent APS5_CAPTURE_TRACE_PATH must select capture-trace.log");
+}
+
+void PathEmpty() {
+    const char* configured = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    Check(configured != nullptr && configured[0] == '\0',
+          "this case requires an empty APS5_CAPTURE_TRACE_PATH");
+    Check(std::string(AgcDriver::CaptureTracePath()) == "capture-trace.log",
+          "an empty APS5_CAPTURE_TRACE_PATH must select capture-trace.log");
+}
+
+void PathExplicit() {
+    const char* configured = RequiredPathVariable();
+    Check(std::string(AgcDriver::CaptureTracePath()) == std::string(configured),
+          "a non-empty APS5_CAPTURE_TRACE_PATH must be selected verbatim");
+}
+
+void ExplicitWrites() {
+    const char* configured = RequiredPathVariable();
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    AgcDriver::CaptureTrace::Log("capture-trace-explicit label=%d", 7);
+    Check(WaitForRecord(configured, "capture-trace-explicit label=7"),
+          "the configured trace path did not receive the capture record");
+    std::remove(configured);
+}
+
+void DefaultWrites() {
+    RemoveEnvironmentVariable("APS5_CAPTURE_TRACE_PATH");
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    Check(std::string(AgcDriver::CaptureTracePath()) == "capture-trace.log",
+          "an absent APS5_CAPTURE_TRACE_PATH must keep the default path");
+    AgcDriver::CaptureTrace::Log("capture-trace-default label=%d", 5);
+    Check(WaitForRecord("capture-trace.log", "capture-trace-default label=5"),
+          "the default trace path did not receive the capture record");
+    std::remove("capture-trace.log");
+}
+
+void OpenFailure() {
+    const char* configured = RequiredPathVariable();
+    Check(!FileExists(configured), "the configured trace path must not already exist");
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    bool threw = false;
+    try {
+        AgcDriver::CaptureTrace::Log("capture-trace-failure label=%d", 9);
+    } catch (const std::exception& error) {
+        threw = true;
+        std::cerr << "unexpected exception: " << error.what() << '\n';
+    }
+    Check(!threw, "an unopenable trace path must not throw from Log");
+    Check(!FileExists(configured), "an unopenable trace path must not create the requested file");
+    Check(!FileExists("capture-trace.log"),
+          "an unopenable trace path must not fall back to capture-trace.log");
+}
+
+void BestEffortOverflow() {
+    const char* configured = RequiredPathVariable();
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    const std::string oversized(4096, 'x');
+    bool threw = false;
+    try {
+        AgcDriver::CaptureTrace::LogBestEffort("capture-trace-best-effort payload=%s", oversized.c_str());
+    } catch (...) {
+        threw = true;
+    }
+    Check(!threw, "best-effort capture logging must not propagate formatting failures");
+    std::remove(configured);
+}
+
+void Disabled() {
+    RemoveEnvironmentVariable("APS5_CAPTURE_TRACE");
+    Check(!AgcDriver::CaptureTrace::Enabled(),
+          "capture tracing must stay disabled when APS5_CAPTURE_TRACE is absent");
+    AgcDriver::CaptureTrace::Log("capture-trace-disabled label=%d", 3);
+    Check(!FileExists("capture-trace.log"),
+          "disabled tracing must not initialize or write capture-trace.log");
+}
+
+}
+
+int main(int argc, char** argv) {
+    try {
+        if (argc != 2) throw std::runtime_error("expected exactly one test mode argument");
+        const std::string mode = argv[1];
+        if (mode == "path-default") PathDefault();
+        else if (mode == "path-empty") PathEmpty();
+        else if (mode == "path-explicit") PathExplicit();
+        else if (mode == "explicit-writes") ExplicitWrites();
+        else if (mode == "default-writes") DefaultWrites();
+        else if (mode == "open-failure") OpenFailure();
+        else if (mode == "best-effort-overflow") BestEffortOverflow();
+        else if (mode == "disabled") Disabled();
+        else throw std::runtime_error("unknown capture trace test mode: " + mode);
+        std::cout << "capture trace tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp b/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp
index dfadd4aabe..5cf4e302e4 100644
--- a/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp
@@ -155,6 +155,32 @@ void unknownCode(AgcDriver::VulkanDevice& device) {
     expect(device, color, [](std::uint32_t, std::uint32_t) { return Clear; }, "fast-cleared target eliminated after a CMASK code 3");
 }
 
+void expectRefused(const std::function<void()>& action, const std::string& message, const std::string& what) {
+    try {
+        action();
+    } catch (const std::exception& error) {
+        Require(std::string(error.what()).find(message) != std::string::npos, what + ": refused with " + error.what());
+        return;
+    }
+    throw std::runtime_error(what + ": was not refused");
+}
+
+void oneFragment(AgcDriver::VulkanDevice& device) {
+    auto color = target(ColorTileMode::RenderTarget);
+    color.coverageSamples = 4;
+    prepare(color, [](std::uint32_t tileX, std::uint32_t tileY) { return tileX == 2 && tileY == 0; }, 3);
+    expectRefused([&] { eliminate(device, color); }, "CMASK code 0x3 of a one-fragment color target is not implemented", "a one-fragment target with CMASK code 3");
+    prepare(color, [](std::uint32_t, std::uint32_t) { return true; });
+    eliminate(device, color);
+    expect(device, color, [](std::uint32_t, std::uint32_t) { return Clear; }, "a fast-cleared one-fragment target eliminated");
+    prepare(color, [](std::uint32_t tileX, std::uint32_t tileY) { return tileX == 7 && tileY == 1; });
+    eliminate(device, color);
+    expect(device, color, [](std::uint32_t x, std::uint32_t y) { return x >= 56 && y >= 8 ? Clear : Stale; }, "a one-fragment target with one fast-cleared tile eliminated");
+    prepare(color, [](std::uint32_t tileX, std::uint32_t) { return tileX < 4; }, 0xc);
+    eliminate(device, color);
+    expect(device, color, [](std::uint32_t, std::uint32_t) { return Stale; }, "a one-fragment target with CMASK codes 0xc and 0xf eliminated");
+}
+
 }
 
 int main() {
@@ -175,6 +201,7 @@ int main() {
         run(*device, ColorTileMode::Linear, "linear");
         run(*device, ColorTileMode::RenderTarget, "SW_64KB_R_X");
         unknownCode(*device);
+        oneFragment(*device);
         device->WaitIdle();
         device.reset();
         {
diff --git a/core/libs/prx/libSceAgcDriver/tests/CollectMemoGeneration.cpp b/core/libs/prx/libSceAgcDriver/tests/CollectMemoGeneration.cpp
new file mode 100644
index 0000000000..90d5e8a215
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/CollectMemoGeneration.cpp
@@ -0,0 +1,127 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include <algorithm>
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <iostream>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+namespace {
+
+constexpr std::uint64_t Block = 65536;
+constexpr std::uint64_t Page = 4096;
+constexpr std::uint64_t Base = std::uint64_t{1} << 32;
+constexpr std::chrono::seconds Patience{10};
+
+struct FakeWatch {
+    std::mutex mutex;
+    std::condition_variable changed;
+    std::vector<std::pair<std::uintptr_t, std::uintptr_t>> written;
+    bool holdNextWalk = false;
+    bool holding = false;
+    bool released = false;
+    bool timedOut = false;
+};
+
+FakeWatch& Fake() {
+    static FakeWatch fake;
+    return fake;
+}
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+}
+
+namespace GuestWriteWatch {
+
+extern "C" {
+
+bool GuestWriteWatchAvailable_nid_postfix() {
+    return true;
+}
+
+bool GuestWriteWatchCovers_nid_postfix(std::uintptr_t address, std::size_t bytes) {
+    return address >= Base && bytes <= 2 * Block && address - Base <= 2 * Block - bytes;
+}
+
+bool GuestWriteWatchCollect_nid_postfix(std::uintptr_t address, std::size_t bytes, void (*written)(void* context, std::uintptr_t begin, std::uintptr_t end), void* context) {
+    auto& fake = Fake();
+    const auto end = address + bytes;
+    std::vector<std::pair<std::uintptr_t, std::uintptr_t>> runs;
+    {
+        std::unique_lock lock(fake.mutex);
+        if (fake.holdNextWalk) {
+            fake.holdNextWalk = false;
+            fake.holding = true;
+            fake.changed.notify_all();
+            fake.timedOut = !fake.changed.wait_for(lock, Patience, [&] { return fake.released; });
+        }
+        for (auto it = fake.written.begin(); it != fake.written.end();) {
+            if (it->first < end && address < it->second) {
+                runs.emplace_back(std::max(it->first, address), std::min(it->second, end));
+                it = fake.written.erase(it);
+            } else ++it;
+        }
+    }
+    for (const auto& [from, to] : runs) written(context, from, to);
+    return true;
+}
+
+}
+
+}
+
+namespace {
+
+using namespace AgcDriver::GuestMemory;
+
+void CheckMemoHitDuringWalk() {
+    auto& fake = Fake();
+    BumpCollectEpoch();
+    const auto collected = CollectWrites(Base, Block);
+    Require(collected != 0 && UnchangedSince(Base, Block, collected), "the block was not collected");
+    {
+        const std::lock_guard lock(fake.mutex);
+        fake.written.emplace_back(Base + Page, Base + 2 * Page);
+        fake.holdNextWalk = true;
+    }
+    std::thread walker([] { CollectWritesUncached(Base, 2 * Block); });
+    bool holding = false;
+    {
+        std::unique_lock lock(fake.mutex);
+        holding = fake.changed.wait_for(lock, Patience, [&] { return fake.holding; });
+    }
+    const auto memoized = holding ? CollectWrites(Base, Block) : 0;
+    {
+        const std::lock_guard lock(fake.mutex);
+        fake.released = true;
+    }
+    fake.changed.notify_all();
+    walker.join();
+    Require(holding, "the second walk did not reach the write watch");
+    Require(!fake.timedOut, "the memoized collect waited for the walk in progress");
+    Require(!UnchangedSince(Base + Page, Page, memoized), "a memoized collect returned the generation a walk in progress then stamped a write with");
+    BumpCollectEpoch();
+    Require(CollectWrites(Base, Block) > memoized && !UnchangedSince(Base, Block, memoized), "a later epoch trusts the write stamped by the walk in progress");
+}
+
+}
+
+int main() {
+    try {
+        CheckMemoHitDuringWalk();
+    } catch (const std::exception& error) {
+        std::cerr << "collect memo generation test failed: " << error.what() << "\n";
+        return 1;
+    }
+    std::cout << "collect memo generation test passed\n";
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp b/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp
index 2cc4a8b370..09ef9b6dac 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp
@@ -79,6 +79,83 @@ void CheckDiamond(unsigned mode) {
     }
 }
 
+void CheckUnobservedPhiCycles() {
+    IrProgram empty;
+    DeadCodeEliminator{}.EliminateUnobservedPhis(empty);
+    IrProgram program;
+    for (std::uint32_t id = 0; id < 4u; ++id) {
+        auto& block = program.CreateBlock();
+        program.BlockOrder().push_back(&block);
+        BlockInfo info;
+        info.id = id;
+        info.terminator.kind = TerminatorKind::Return;
+        program.Metadata().blockInfo.push_back(info);
+    }
+    auto& entry = *program.BlockOrder()[0];
+    auto& header = *program.BlockOrder()[1];
+    auto& latch = *program.BlockOrder()[2];
+    auto& exit = *program.BlockOrder()[3];
+    program.SetEntryBlock(entry);
+    entry.AddBranch(&header);
+    header.AddBranch(&latch);
+    header.AddBranch(&exit);
+    latch.AddBranch(&header);
+    program.Metadata().blockInfo[0].terminator.kind = TerminatorKind::Branch;
+    program.Metadata().blockInfo[0].terminator.trueBlock = 1u;
+    auto& headerInfo = program.Metadata().blockInfo[1];
+    headerInfo.terminator.kind = TerminatorKind::ConditionalBranch;
+    headerInfo.terminator.trueBlock = 2u;
+    headerInfo.terminator.falseBlock = 3u;
+    program.Metadata().blockInfo[2].terminator.kind = TerminatorKind::Branch;
+    program.Metadata().blockInfo[2].terminator.trueBlock = 1u;
+    IrBuilder builder(program);
+    builder.SetInsertionPoint(entry);
+    auto& zero = builder.Constant(0u);
+    auto& producer = builder.Emit(IrOpcode::LaneId, IrType::U32, {});
+    const auto phi = [&](IrBlock& block, IrType type = IrType::U32) -> IrValue& {
+        auto& value = program.CreateValue(IrOpcode::Phi, type);
+        block.AppendInstruction(&value);
+        return value;
+    };
+    auto& first = phi(header);
+    auto& second = phi(latch);
+    auto& tail = phi(header);
+    auto& self = phi(header);
+    auto& liveFirst = phi(header);
+    auto& liveSecond = phi(latch);
+    auto& condition = phi(header, IrType::Bool);
+    first.AddPhiOperand(&entry, &producer);
+    first.AddPhiOperand(&latch, &second);
+    second.AddPhiOperand(&header, &first);
+    tail.AddPhiOperand(&entry, &zero);
+    tail.AddPhiOperand(&latch, &second);
+    self.AddPhiOperand(&entry, &zero);
+    self.AddPhiOperand(&latch, &self);
+    liveFirst.AddPhiOperand(&entry, &zero);
+    liveFirst.AddPhiOperand(&latch, &liveSecond);
+    liveSecond.AddPhiOperand(&header, &liveFirst);
+    condition.AddPhiOperand(&entry, &builder.ConstantBool(true));
+    condition.AddPhiOperand(&latch, &condition);
+    headerInfo.condition = &condition;
+    builder.SetInsertionPoint(header);
+    static_cast<void>(builder.Emit(IrOpcode::Reference, IrType::Void, {&condition}));
+    builder.SetInsertionPoint(latch);
+    auto& store = builder.Emit(IrOpcode::StoreVectorWindow, IrType::Void, {&zero, &liveSecond});
+    ValidateProgram(program, true);
+    DeadCodeEliminator{}.EliminateUnobservedPhis(program);
+    ValidateProgram(program, true);
+    Require(first.Parent() == nullptr && second.Parent() == nullptr && tail.Parent() == nullptr && self.Parent() == nullptr, "phi cycles: an unobserved cycle or its tail survived");
+    Require(!first.HasUses() && !second.HasUses() && !tail.HasUses() && !self.HasUses(), "phi cycles: a removed cycle retained uses");
+    Require(liveFirst.Parent() == &header && liveSecond.Parent() == &latch && liveFirst.Argument(1) == &liveSecond && liveSecond.Argument(0) == &liveFirst, "phi cycles: an observed cycle was changed");
+    Require(store.Parent() == &latch && store.Argument(1) == &liveSecond, "phi cycles: an observable store was changed");
+    Require(condition.Parent() == &header && headerInfo.condition == &condition && condition.Argument(1) == &condition, "phi cycles: a branch condition was changed");
+    DeadCodeEliminator{}.Eliminate(program);
+    Require(producer.Parent() == nullptr && !producer.HasUses(), "phi cycles: ordinary DCE retained a released producer");
+    DeadCodeEliminator{}.EliminateUnobservedPhis(program);
+    ValidateProgram(program, true);
+    Require(entry.Instructions().empty() && header.Instructions().size() == 3u && latch.Instructions().size() == 2u, "phi cycles: repeated elimination changed the live graph");
+}
+
 void CheckLongAncillaryForwarding() {
     IrProgram program;
     auto& block = program.CreateBlock();
@@ -127,6 +204,7 @@ int main() {
     try {
         for (unsigned mode = 0; mode < 5u; ++mode) CheckDiamond(mode);
         CheckLongAncillaryForwarding();
+        CheckUnobservedPhiCycles();
         std::puts("constant phi dominance tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp b/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp
index 3febba4f40..b59161ab49 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp
@@ -445,6 +445,26 @@ void verifyProgram(const Program& program) {
     }
 }
 
+const std::vector<std::uint32_t> TestedHeaderLatchStore{
+    0xbe880380u, 0x7e020280u, 0xbf0a8408u, 0xbf840004u, 0xe0700000u, 0x80000100u, 0x80088108u, 0xbf82fffau, 0xbf810000u};
+const std::vector<std::uint32_t> SelfLoopLatchStore{
+    0xbe880380u, 0x7e020280u, 0xe0700000u, 0x80000100u, 0x80088108u, 0xbf0a8408u, 0xbf85fffbu, 0xbf810000u};
+
+void verifyEmptyLoopContinues() {
+    for (const auto& [name, code] : {std::pair{"a loop whose latch stores behind a tested header", &TestedHeaderLatchStore}, std::pair{"a single-block loop that stores", &SelfLoopLatchStore}}) {
+        auto graph = GraphBuilder{}.Build(RdnaInstructionDecoder{}.Decode(*code));
+        Structurizer{}.Structurize(graph);
+        bool loops = false;
+        for (const auto& block : graph.blocks) {
+            if (!block.terminator.loopHeader) continue;
+            loops = true;
+            const auto& continueTarget = graph.FindBlock(block.terminator.continueBlock);
+            require(continueTarget.instructionBegin == continueTarget.instructionEnd, std::string(name) + ": the continue block " + std::to_string(continueTarget.id) + " of the loop at block " + std::to_string(block.id) + " holds instructions");
+        }
+        require(loops, std::string(name) + ": no loop was structured");
+    }
+}
+
 const std::vector<std::uint32_t> DwordTableGetpcFirst{
     0xbe8c1f00u, 0x800cff0cu, 0x00000058u, 0x820d800du, 0x83928202u, 0xd4c40016u, 0x02000500u, 0x8f128212u, 0xf4000386u, 0x24000000u,
     0xbf8cc07fu, 0x7d820003u, 0x808c0e0cu, 0x828d800du, 0xbefd210cu, 0x7e020281u, 0xbf820003u, 0x7e020282u, 0xbf820001u, 0x7e020283u,
@@ -711,6 +731,18 @@ loop:
   s_cbranch_scc1 loop
   s_endpgm)",
          {0xbe880380u, 0x7e020280u, 0xe0700000u, 0x80000100u, 0x80088108u, 0xbf0a8408u, 0xbf85fffbu, 0xbf810000u}, Split::None},
+        {"memory access in a loop latch behind a tested header", R"(
+  s_mov_b32 s8, 0
+  v_mov_b32 v1, 0
+loop:
+  s_cmp_lt_u32 s8, 4
+  s_cbranch_scc0 done
+  buffer_store_dword v1, off, s[0:3], 0
+  s_add_u32 s8, s8, 1
+  s_branch loop
+done:
+  s_endpgm)",
+         TestedHeaderLatchStore, Split::None},
         {"shared tail in a loop", R"(
   s_mov_b32 s8, 0
   v_mov_b32 v1, 0
@@ -1421,6 +1453,7 @@ done:
         verifyCallLinkMaskReadByScalarInstruction();
         verifyLargeLoopExitFallback();
         verifyNestedExitForwarders();
+        verifyEmptyLoopContinues();
         verifyIrreducibleLoopEntry();
     } catch (const std::exception& error) {
         std::fprintf(stderr, "%s\n", error.what());
diff --git a/core/libs/prx/libSceAgcDriver/tests/DeferredDestruction.cpp b/core/libs/prx/libSceAgcDriver/tests/DeferredDestruction.cpp
new file mode 100644
index 0000000000..7873086b80
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/DeferredDestruction.cpp
@@ -0,0 +1,131 @@
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <exception>
+#include <string>
+#include <vector>
+
+using namespace AgcDriver::Graphics;
+
+namespace {
+
+int failures = 0;
+
+void Expect(bool condition, const std::string& what) {
+    if (condition) return;
+    std::fprintf(stderr, "FAIL: %s\n", what.c_str());
+    ++failures;
+}
+
+std::vector<std::string> events;
+VkResult idleResult = VK_SUCCESS;
+
+template<typename THandle>
+THandle Handle(std::uintptr_t value) {
+    return reinterpret_cast<THandle>(value);
+}
+
+std::string Name(const char* kind, const void* handle) {
+    return std::string(kind) + std::to_string(reinterpret_cast<std::uintptr_t>(handle));
+}
+
+VKAPI_ATTR void VKAPI_CALL mockDestroyBuffer(VkDevice device, VkBuffer buffer, const VkAllocationCallbacks*) {
+    events.push_back(Name("buffer ", reinterpret_cast<const void*>(buffer)) + Name(" on ", device));
+}
+
+VKAPI_ATTR void VKAPI_CALL mockFreeMemory(VkDevice device, VkDeviceMemory memory, const VkAllocationCallbacks*) {
+    events.push_back(Name("memory ", reinterpret_cast<const void*>(memory)) + Name(" on ", device));
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL mockQueueWaitIdle(VkQueue queue) {
+    events.push_back(Name("idle ", queue));
+    return idleResult;
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL mockProc(VkDevice, const char* name) {
+    if (std::strcmp(name, "vkDestroyBuffer") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&mockDestroyBuffer);
+    if (std::strcmp(name, "vkFreeMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&mockFreeMemory);
+    if (std::strcmp(name, "vkQueueWaitIdle") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&mockQueueWaitIdle);
+    return nullptr;
+}
+
+Context ContextFor(VkDevice device, PFN_vkGetDeviceProcAddr proc) {
+    Context context{};
+    context.device = device;
+    context.queue = Handle<VkQueue>(0x900);
+    context.deviceProc = proc;
+    return context;
+}
+
+void DeferredUntilTheQueueIsIdle() {
+    events.clear();
+    const auto device = Handle<VkDevice>(0x100);
+    const auto proc = DeferDestructionToIdle(device, mockProc);
+    const auto context = ContextFor(device, proc);
+    Expect(context.Function<PFN_vkQueueWaitIdle>("vkQueueWaitIdle") == &mockQueueWaitIdle, "a function other than vkDestroyBuffer and vkFreeMemory was not passed through");
+    context.Function<PFN_vkFreeMemory>("vkFreeMemory")(device, Handle<VkDeviceMemory>(0x21), nullptr);
+    context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, Handle<VkBuffer>(0x11), nullptr);
+    context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, VK_NULL_HANDLE, nullptr);
+    Expect(events.empty() && DeferredObjects(device) == 2, "a destroy or free was not deferred, or a null handle was queued");
+    const auto start = std::chrono::steady_clock::now();
+    DestroyDeferredAtIdle(context, start);
+    Expect(events.empty() && DeferredObjects(device) == 2, "deferred objects younger than the drain age were destroyed, or the queue was waited for");
+    DestroyDeferredAtIdle(context, start + std::chrono::seconds(1));
+    const std::vector<std::string> drained{"idle 2304", "buffer 17 on 256", "memory 33 on 256"};
+    Expect(events == drained && DeferredObjects(device) == 0, "old deferred objects were not destroyed after a queue wait, buffers before memory");
+    events.clear();
+    for (std::uintptr_t index = 0; index < 512; ++index) context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, Handle<VkBuffer>(0x1000 + index), nullptr);
+    DestroyDeferredAtIdle(context, std::chrono::steady_clock::now());
+    Expect(events.size() == 513 && events.front() == "idle 2304" && DeferredObjects(device) == 0, "512 young deferred objects were not destroyed after a queue wait");
+    events.clear();
+    idleResult = VK_ERROR_OUT_OF_HOST_MEMORY;
+    context.Function<PFN_vkFreeMemory>("vkFreeMemory")(device, Handle<VkDeviceMemory>(0x22), nullptr);
+    bool threw = false;
+    try {
+        DestroyDeferredAtIdle(context, std::chrono::steady_clock::now() + std::chrono::seconds(1));
+    } catch (const std::exception&) {
+        threw = true;
+    }
+    Expect(threw && DeferredObjects(device) == 1 && events.size() == 1, "a failed queue wait did not throw, or destroyed the deferred objects");
+    idleResult = VK_SUCCESS;
+    events.clear();
+    DestroyDeferredObjects(device);
+    Expect(events == std::vector<std::string>{"memory 34 on 256"} && DeferredObjects(device) == 0, "the deferred objects were not destroyed when the device went, or the queue was waited for");
+    events.clear();
+    context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, Handle<VkBuffer>(0x12), nullptr);
+    Expect(events == std::vector<std::string>{"buffer 18 on 256"}, "a destroy after the device went was deferred");
+}
+
+void OtherDevicesDestroyAtOnce() {
+    events.clear();
+    const auto device = Handle<VkDevice>(0x101);
+    const auto proc = DeferDestructionToIdle(device, mockProc);
+    const auto other = Handle<VkDevice>(0x102);
+    reinterpret_cast<PFN_vkFreeMemory>(proc(other, "vkFreeMemory"))(other, Handle<VkDeviceMemory>(0x23), nullptr);
+    Expect(events == std::vector<std::string>{"memory 35 on 258"} && DeferredObjects(other) == 0, "a free on a device without deferred destruction was deferred");
+    bool threw = false;
+    try {
+        DeferDestructionToIdle(device, mockProc);
+    } catch (const std::exception&) {
+        threw = true;
+    }
+    Expect(threw, "deferred destruction was set up twice for one device");
+    DestroyDeferredObjects(device);
+}
+
+}
+
+int main() {
+    try {
+        DeferredUntilTheQueueIsIdle();
+        OtherDevicesDestroyAtOnce();
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "FAIL: %s\n", error.what());
+        return 1;
+    }
+    if (failures != 0) return 1;
+    std::puts("deferred destruction tests passed");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/DenormalFlushElimination.cpp b/core/libs/prx/libSceAgcDriver/tests/DenormalFlushElimination.cpp
index cc952f5ea9..5dd5cfc4ba 100644
--- a/core/libs/prx/libSceAgcDriver/tests/DenormalFlushElimination.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/DenormalFlushElimination.cpp
@@ -110,7 +110,8 @@ std::vector<std::uint32_t> Recompiled(std::span<const std::uint32_t> code) {
     request.target.maxWorkgroupSharedMemoryBytes = 49152;
     request.layout = {0, 0, 0, 128};
     request.useCache = false;
-    const auto& words = Recompile(request).spirv.Words();
+    const auto result = Recompile(request);
+    const auto& words = result.spirv.Words();
     return {words.begin(), words.end()};
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp b/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp
index 79878c2766..cd876ad472 100644
--- a/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp
@@ -1,4 +1,5 @@
 #include "GraphicsTests.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
@@ -13,6 +14,14 @@
 #include <tuple>
 #include <utility>
 #include <vector>
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
 
 namespace {
 
@@ -417,6 +426,62 @@ void TestRetiredSurfaceRelease(const Context& context) {
     ClearDepthSurfaces(context.device);
 }
 
+void TestUnmappedStalePlaneFlush(const Context& context) {
+    ClearDepthSurfaces(context.device);
+    constexpr VkExtent2D extent{256, 256};
+    constexpr std::uint64_t unmapped = 0xa0000000;
+    DepthTarget target{unmapped, 0, extent, VK_FORMAT_D32_SFLOAT, 1.0f, 0};
+    target.depthSwizzle = XorSwizzleMode(TextureTileMode::kZ64KBX);
+    Require(DepthSurfaceView(context, target, true) != VK_NULL_HANDLE, "a mirrorable depth surface must render");
+    Require(DepthPlanesStale(), "a written mirrorable depth surface must leave its plane stale");
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> stored;
+    try {
+        stored = FlushDepthPlanes(unmapped, DepthSliceBytes(extent, 4u));
+    } catch (const std::exception& error) {
+        Require(false, std::string("flushing a depth plane whose guest memory is not mapped must drop its results: ") + error.what());
+    }
+    Require(stored.empty(), "a depth plane without mapped guest memory must not be stored");
+    Require(!DepthPlanesStale(), "a dropped depth plane must not stay stale");
+    ClearDepthSurfaces(context.device);
+}
+
+void TestReadOnlyStalePlaneFlush(const Context& context) {
+    ClearDepthSurfaces(context.device);
+    constexpr std::size_t bytes = 1024 * 1024;
+#ifdef _WIN32
+    const auto release = [](void* pointer) { VirtualFree(pointer, 0, MEM_RELEASE); };
+    std::unique_ptr<void, decltype(release)> mapping(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READONLY), release);
+    Require(mapping != nullptr, "cannot map a read-only depth plane");
+#else
+    const auto release = [](void* pointer) { munmap(pointer, bytes); };
+    std::unique_ptr<void, decltype(release)> mapping(mmap(nullptr, bytes, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0), release);
+    Require(mapping.get() != MAP_FAILED, "cannot map a read-only depth plane");
+#endif
+    const auto address = (reinterpret_cast<std::uintptr_t>(mapping.get()) + 65535u) & ~std::uintptr_t{65535u};
+    constexpr VkExtent2D extent{256, 256};
+    const auto planeBytes = DepthSliceBytes(extent, 4u);
+    Require(!AgcDriver::GuestMemory::CommittedRanges(address, planeBytes).empty(), "a read-only depth plane must remain readable");
+    Require(AgcDriver::GuestMemory::CommittedRanges(address, planeBytes, true).empty(), "a read-only depth plane must not be writable");
+    auto storageContext = context;
+    storageContext.formatProperties = [](VkPhysicalDevice, VkFormat, VkFormatProperties* properties) {
+        *properties = {};
+        properties->optimalTilingFeatures = VK_FORMAT_FEATURE_DEPTH_STENCIL_ATTACHMENT_BIT | VK_FORMAT_FEATURE_SAMPLED_IMAGE_BIT | VK_FORMAT_FEATURE_STORAGE_IMAGE_BIT;
+    };
+    DepthTarget target{address, 0, extent, VK_FORMAT_D32_SFLOAT, 1.0f, 0};
+    target.depthSwizzle = XorSwizzleMode(TextureTileMode::kZ64KBX);
+    Require(DepthSurfaceView(storageContext, target, true) != VK_NULL_HANDLE, "a read-only depth plane must render");
+    Require(DepthPlanesStale(), "the read-only depth plane must have pending results");
+    bool rejected = false;
+    try {
+        static_cast<void>(FlushDepthPlanes(address, planeBytes));
+    } catch (const std::runtime_error& error) {
+        rejected = std::string_view(error.what()).find("storage texture has no committed guest pages") != std::string_view::npos;
+    }
+    Require(rejected, "a mapped read-only depth plane must retain the unsupported-store rejection");
+    Require(DepthPlanesStale(), "a mapped read-only depth plane must retain its pending results");
+    ClearDepthSurfaces(context.device);
+}
+
 void RunDepthSurfaceReuseTests() {
     static int deviceTag = 0;
     Context context{};
@@ -432,6 +497,8 @@ void RunDepthSurfaceReuseTests() {
     TestMultisampleDepthOwnership(context);
     TestMultisampleStencilAliases(context);
     TestStencilUnormView(context);
+    TestUnmappedStalePlaneFlush(context);
+    TestReadOnlyStalePlaneFlush(context);
     constexpr std::uint64_t depth32 = 0x40000000;
     constexpr std::uint64_t depth16 = 0x50000000;
     constexpr std::uint64_t depthStencil = 0x60000000;
diff --git a/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp b/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp
index aceac056e4..b2df523ef9 100644
--- a/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp
@@ -60,6 +60,25 @@ VkQueue FakeQueue() {
     return reinterpret_cast<VkQueue>(static_cast<std::uintptr_t>(0x2000));
 }
 
+void Diagnostics() {
+    using AgcDriver::ChooseDeviceDiagnostics;
+    constexpr VkDeviceDiagnosticsConfigFlagsNV all = VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_DEBUG_INFO_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_RESOURCE_TRACKING_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_AUTOMATIC_CHECKPOINTS_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_ERROR_REPORTING_BIT_NV;
+    for (const bool configSupported : {false, true}) {
+        for (const bool checkpointsSupported : {false, true}) {
+            const auto off = ChooseDeviceDiagnostics(false, configSupported, checkpointsSupported);
+            Require(!off.config && !off.checkpoints && off.flags == 0, "diagnostics were chosen without APS5_NV_DIAGNOSTICS");
+        }
+    }
+    for (const bool checkpointsSupported : {false, true}) {
+        const auto unsupported = ChooseDeviceDiagnostics(true, false, checkpointsSupported);
+        Require(!unsupported.config && !unsupported.checkpoints && unsupported.flags == 0, "diagnostics were chosen on a device without VK_NV_device_diagnostics_config");
+    }
+    const auto alone = ChooseDeviceDiagnostics(true, true, false);
+    Require(alone.config && !alone.checkpoints && alone.flags == all, "the diagnostics config without checkpoint support did not enable every crash-dump flag alone");
+    const auto both = ChooseDeviceDiagnostics(true, true, true);
+    Require(both.config && both.checkpoints && both.flags == all, "the diagnostics config did not add the diagnostic checkpoints the device supports");
+}
+
 void FaultInfo() {
     faultCalls = 0;
     faultFails = false;
@@ -139,6 +158,7 @@ void AddressKinds() {
 
 int main() {
     try {
+        Diagnostics();
         FaultInfo();
         FaultInfoFails();
         Checkpoints();
diff --git a/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp b/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp
index 0f3fe85da7..f47e2d0ebc 100644
--- a/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp
@@ -4,6 +4,7 @@
 #include <cstdint>
 #include <cstdio>
 #include <exception>
+#include <optional>
 #include <span>
 #include <stdexcept>
 #include <string>
@@ -19,17 +20,19 @@ void require(bool condition, const std::string& message) {
 }
 
 constexpr std::array<std::uint32_t, 4> CvtF16F32Store{0x7e021500u, 0xe0700000u, 0x80000100u, 0xbf810000u};
+constexpr std::array<std::uint32_t, 4> MovStore{0x7e020300u, 0xe0700000u, 0x80000100u, 0xbf810000u};
 
-std::vector<std::uint32_t> recompile(bool preserve, bool flush, bool flushCapability = true) {
+std::vector<std::uint32_t> recompile(bool preserve, bool flush, bool flushCapability = true, std::optional<ShaderFloatMode> floatMode = std::nullopt, std::span<const std::uint32_t> code = CvtF16F32Store) {
     const std::array<std::uint32_t, 4> capabilities{spv::CapabilityShader, spv::CapabilityGroupNonUniform, spv::CapabilityDenormPreserve, spv::CapabilityDenormFlushToZero};
     const std::array<std::uint32_t, 4> userData{0x10000000u, 0x00100000u, 0x40u, 0x00027facu};
     const std::array<std::string_view, 2> extensions{"SPV_KHR_storage_buffer_storage_class", "SPV_KHR_float_controls"};
     RecompileRequest request{};
-    request.shader = {ShaderStage::Compute, 0x20000u, CvtF16F32Store, 0, {}};
+    request.shader = {ShaderStage::Compute, 0x20000u, code, 0, {}};
     request.context.waveSize = 64;
     request.context.userDataBaseRegister = 0;
     request.context.userData = userData;
     request.context.compute = ShaderComputeStageInfo{{64u, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    request.context.floatMode = floatMode;
     request.target.vulkanVersion = 0x00403000u;
     request.target.spirvVersion = 0x00010600u;
     request.target.subgroupSize = 64;
@@ -79,6 +82,16 @@ void verify() {
     require(flushed.flush32 && !flushed.preserve32, "the hardware 32-bit flush did not take precedence over the preserve flag");
     const auto nativeFlush = scan(recompile(true, true, false));
     require(!nativeFlush.preserve32 && !nativeFlush.flush32, "a hardware flush without the DenormFlushToZero capability declared a 32-bit denormal execution mode");
+    const auto flushingMode = scan(recompile(true, true, true, ShaderFloatMode{0xc0u, true, false, false}, MovStore));
+    require(flushingMode.flush32 && !flushingMode.preserve32, "FLOAT_MODE 0xc0 flushes f32 denormals but the module did not take the hardware flush");
+    for (const std::uint32_t mode : {0xd0u, 0xe0u, 0xf0u}) {
+        char name[64];
+        std::snprintf(name, sizeof(name), "FLOAT_MODE 0x%02x keeps f32 denormals", mode);
+        const auto kept = scan(recompile(true, true, true, ShaderFloatMode{mode, true, false, false}, MovStore));
+        require(kept.preserve32 && kept.preserveCapability && !kept.flush32, std::string(name) + ", but the module did not declare DenormPreserve 32 instead of the hardware flush");
+        const auto unpreserved = scan(recompile(false, true, true, ShaderFloatMode{mode, true, false, false}, MovStore));
+        require(!unpreserved.flush32 && !unpreserved.preserve32, std::string(name) + ", but the module took the hardware flush on a device that cannot preserve them");
+    }
 }
 
 }
@@ -90,6 +103,6 @@ int main() {
         std::fprintf(stderr, "F32DenormPreserve: %s\n", error.what());
         return 1;
     }
-    std::puts("F32DenormPreserve: the 32-bit DenormPreserve execution mode follows the target flag and yields to the hardware flush");
+    std::puts("F32DenormPreserve: the 32-bit DenormPreserve execution mode follows the target flag and yields to the hardware flush in shaders that flush f32 denormals");
     return 0;
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/FlatScratch.cpp b/core/libs/prx/libSceAgcDriver/tests/FlatScratch.cpp
new file mode 100644
index 0000000000..73aef4bdf0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FlatScratch.cpp
@@ -0,0 +1,118 @@
+#include "RdnaDecoder/RdnaMemoryOpDecoder.hpp"
+#include "Translation/TranslationContext.hpp"
+#include <array>
+#include <cstdio>
+#include <stdexcept>
+using namespace ShaderRecompiler;
+static unsigned tests = 0;
+#define Require(value)                                                         \
+  do {                                                                         \
+    if (!(value)) {                                                            \
+      std::fprintf(stderr, "flat scratch assertion line %u: %s\n", __LINE__,   \
+                   #value);                                                    \
+      throw std::runtime_error("flat scratch regression");                     \
+    }                                                                          \
+  } while (false)
+static RdnaInstruction Decode(unsigned seg, unsigned saddr, unsigned addr,
+                              unsigned offset = 0, unsigned opcode = 12) {
+  const std::array<unsigned, 2> code{(0x37u << 26) | (opcode << 18) |
+                                         (seg << 14) | offset,
+                                     (2u << 24) | (saddr << 16) | addr};
+  return DecodeRdnaFlat(0x154cu, code, 0);
+}
+static void Reject(unsigned seg, unsigned saddr, unsigned addr) {
+  try {
+    (void)Decode(seg, saddr, addr);
+  } catch (const std::runtime_error &) {
+    ++tests;
+    return;
+  }
+  throw std::runtime_error("invalid FLAT accepted");
+}
+static void Scratch(unsigned saddr, unsigned addr, unsigned expectedVector,
+                    unsigned expectedScalar) {
+  auto op = Decode(1, saddr, addr, 0xffcu);
+  Require(op.memorySegment == 1 && op.memoryOffset == -4 &&
+          op.sourceCount == 2);
+  Require(op.source0.kind == (expectedVector
+                                  ? RdnaOperandKind::VectorRegister
+                                  : RdnaOperandKind::IntegerInlineConstant));
+  Require(op.source1.kind == (expectedScalar
+                                  ? RdnaOperandKind::ScalarRegister
+                                  : RdnaOperandKind::IntegerInlineConstant));
+  if (expectedVector)
+    Require(op.source0.reg == addr);
+  else
+    Require(op.source0.value == 0);
+  if (expectedScalar)
+    Require(op.source1.reg == saddr);
+  else
+    Require(op.source1.value == 0);
+  IrProgram program;
+  auto &block = program.CreateBlock();
+  program.SetEntryBlock(block);
+  TranslationContext context(program, block, 256);
+  context.TranslateInstruction(op);
+  unsigned vectors = 0, addressReads = 0, destinationReads = 0, scalars = 0,
+           loads = 0, scratch = 0;
+  for (auto *inst : block.Instructions()) {
+    if (inst->Opcode() == IrOpcode::GetVectorRegister) {
+      ++vectors;
+      auto reg = inst->Arguments().at(0)->Register().index;
+      Require(reg < 256);
+      if (reg == addr)
+        ++addressReads;
+      if (reg == 2)
+        ++destinationReads;
+    }
+    if (inst->Opcode() == IrOpcode::GetScalarRegister)
+      ++scalars;
+    if (inst->Opcode() == IrOpcode::LoadAddressU32)
+      ++loads;
+    if (inst->Opcode() == IrOpcode::GetScratchResource)
+      ++scratch;
+  }
+  std::printf(
+      "SV/SS/ST saddr=%u addr=%u vector=%u scalar=%u loads=%u scratch=%u\n",
+      saddr, addr, vectors, scalars, loads, scratch);
+  std::fflush(stdout);
+  Require(vectors == expectedVector + 1 && addressReads == expectedVector &&
+          destinationReads == 1 && scalars == expectedScalar && loads == 1 &&
+          scratch == 1);
+  ++tests;
+}
+int main() {
+
+  const std::array<unsigned, 2> code{0xdc304000u, 0x027d00ffu};
+  auto actual = DecodeRdnaFlat(0x154cu, code, 0);
+  Require(actual.destination.reg == 2 && actual.source0.reg == 255 &&
+          actual.source1.value == 0);
+  ++tests;
+  Scratch(125, 255, 1, 0);
+  Scratch(125, 254, 1, 0);
+  Scratch(0, 255, 0, 1);
+  Scratch(105, 255, 0, 1);
+  Scratch(127, 255, 0, 0);
+  Reject(0, 125, 255);
+  Reject(2, 125, 255);
+  Reject(2, 127, 255);
+  Reject(1, 108, 0);
+  Reject(3, 0, 0);
+  auto flat = Decode(0, 125, 254);
+  Require(flat.source1.kind == RdnaOperandKind::VectorRegister &&
+          flat.source1.reg == 255);
+  ++tests;
+  auto global = Decode(2, 0, 255);
+  Require(global.source0.reg == 255 &&
+          global.source1.kind == RdnaOperandKind::ScalarRegister);
+  ++tests;
+  try {
+    const std::array<unsigned, 1> truncated{0xdc304000u};
+    (void)DecodeRdnaFlat(0, truncated, 0);
+    throw std::logic_error("truncated accepted");
+  } catch (const std::out_of_range &) {
+    ++tests;
+  }
+  std::printf("PASS %u flat scratch decode/IR and invalid boundary cases\n",
+              tests);
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/Flip.cpp b/core/libs/prx/libSceAgcDriver/tests/Flip.cpp
index ec73dea01a..849703ad95 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Flip.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Flip.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PresentMode.hpp"
+#include "prx/libSceAgcDriver/Execution/include/SwapchainImages.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
 #include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
@@ -355,7 +356,11 @@ void testFailureLog() {
     std::fflush(stderr);
     const int saved = APS5_DUP(APS5_FILENO(stderr));
     check(saved >= 0, "stderr could not be saved");
-    check(std::freopen(path.string().c_str(), "wb", stderr) != nullptr, "stderr could not be redirected");
+#ifdef _WIN32
+    check(_wfreopen(path.wstring().c_str(), L"wb", stderr) != nullptr, "stderr could not be redirected");
+#else
+    check(std::freopen(path.c_str(), "wb", stderr) != nullptr, "stderr could not be redirected");
+#endif
     std::string message;
     std::string error;
     try {
@@ -402,6 +407,19 @@ void testReset(bool compute) {
 
 void testPresentMode() {
     using AgcDriver::SelectPresentMode;
+    VkSurfaceCapabilitiesKHR surface{};
+    surface.minImageCount = 2;
+    surface.maxImageCount = 8;
+    check(AgcDriver::SwapchainImageCount(surface) == 3, "the swapchain has no image beyond the surface minimum");
+    surface.minImageCount = 3;
+    check(AgcDriver::SwapchainImageCount(surface) == 3, "a three-image surface minimum gained an image");
+    surface.minImageCount = 5;
+    check(AgcDriver::SwapchainImageCount(surface) == 5, "the swapchain does not follow a larger surface minimum");
+    surface.minImageCount = 2;
+    surface.maxImageCount = 2;
+    check(AgcDriver::SwapchainImageCount(surface) == 2, "the swapchain exceeds the surface maximum");
+    surface.maxImageCount = 0;
+    check(AgcDriver::SwapchainImageCount(surface) == 3, "an unlimited surface maximum capped the swapchain");
     const std::array wayland{VK_PRESENT_MODE_FIFO_KHR, VK_PRESENT_MODE_IMMEDIATE_KHR};
     const std::array all{VK_PRESENT_MODE_IMMEDIATE_KHR, VK_PRESENT_MODE_MAILBOX_KHR, VK_PRESENT_MODE_FIFO_KHR};
     check(SelectPresentMode(nullptr, wayland) == VK_PRESENT_MODE_FIFO_KHR, "the default present mode is not FIFO");
@@ -417,6 +435,11 @@ void testPresentMode() {
     check(expectFailure([&] { SelectPresentMode("", all); }).find("must be fifo, fifo_latest_ready, mailbox or immediate") != std::string::npos, "an empty present mode name was accepted");
     const std::array<VkPresentModeKHR, 0> none{};
     check(expectFailure([&] { SelectPresentMode(nullptr, none); }).find("does not support") != std::string::npos, "FIFO was selected on a surface without it");
+    using AgcDriver::SelectPresentQueue;
+    check(SelectPresentQueue(16, 2) == 2u, "the presentation queue does not follow the main and settle queues");
+    check(SelectPresentQueue(16, 1) == 1u, "the presentation queue does not follow the main queue alone");
+    check(!SelectPresentQueue(2, 2).has_value(), "a presentation queue was taken from a family without a free queue");
+    check(!SelectPresentQueue(1, 1).has_value(), "a presentation queue was taken from a family with one queue");
 }
 
 int main(int argc, char** argv) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp
new file mode 100644
index 0000000000..63bfa42046
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp
@@ -0,0 +1,238 @@
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+#ifdef _WIN32
+#include <process.h>
+#define getpid _getpid
+#else
+#include <unistd.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCall;
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+using AgcDriver::FrameCaptureWriter;
+using AgcDriver::FrameMemoryChunk;
+using AgcDriver::FrameMemoryKind;
+using AgcDriver::FrameRangeKind;
+
+void check(bool condition, const std::string& message) {
+    if (!condition) {
+        std::fprintf(stderr, "FAILED: %s\n", message.c_str());
+        std::exit(1);
+    }
+}
+
+template <typename TFunction>
+void checkThrows(TFunction&& function, const std::string& message) {
+    try {
+        function();
+    } catch (const std::runtime_error&) {
+        return;
+    }
+    check(false, message);
+}
+
+bool sameRegisters(const std::vector<ShaderRegister>& left, const std::vector<ShaderRegister>& right) {
+    if (left.size() != right.size()) return false;
+    for (std::size_t index = 0; index < left.size(); ++index) {
+        if (left[index].offset != right[index].offset || left[index].value != right[index].value) return false;
+    }
+    return true;
+}
+
+bool sameCall(const FrameCall& left, const FrameCall& right) {
+    return left.kind == right.kind && left.ordinal == right.ordinal && left.timeNs == right.timeNs && left.thread == right.thread && left.accepted == right.accepted && left.completed == right.completed && left.queue == right.queue &&
+           left.flags == right.flags && left.cpuFlip == right.cpuFlip && left.address == right.address && left.size == right.size && left.values == right.values && sameRegisters(left.context, right.context) &&
+           sameRegisters(left.primitive, right.primitive);
+}
+
+std::vector<FrameCall> sampleCalls() {
+    std::vector<FrameCall> calls;
+    FrameCall shader;
+    shader.kind = FrameCallKind::RegisterShader;
+    shader.ordinal = 1;
+    shader.address = 0x2000010000;
+    calls.push_back(shader);
+    FrameCall abi;
+    abi.kind = FrameCallKind::ResolveGraphicsStagesAbi;
+    abi.ordinal = 2;
+    abi.values = {0x2000010000, 0x2000020000, 0};
+    abi.context = {{0x1a0, 7}, {0x1a1, 0xffffffffu}};
+    abi.primitive = {{0x242, 3}};
+    calls.push_back(abi);
+    FrameCall submit;
+    submit.kind = FrameCallKind::Submit;
+    submit.ordinal = 3;
+    submit.timeNs = 123456789;
+    submit.thread = 4242;
+    submit.accepted = 20;
+    submit.completed = 17;
+    submit.queue = 0x21;
+    submit.address = 0x2000030000;
+    submit.size = 4096;
+    calls.push_back(submit);
+    FrameCall flip;
+    flip.kind = FrameCallKind::Flip;
+    flip.ordinal = 4;
+    flip.cpuFlip = true;
+    flip.values = {1, 2, 0, static_cast<std::uint64_t>(-5)};
+    calls.push_back(flip);
+    FrameCall unregister;
+    unregister.kind = FrameCallKind::UnregisterVideoOutput;
+    unregister.ordinal = 5;
+    unregister.values = {1};
+    calls.push_back(unregister);
+    FrameCall end;
+    end.kind = FrameCallKind::End;
+    end.ordinal = 6;
+    calls.push_back(end);
+    return calls;
+}
+
+std::vector<std::byte> sampleMemory() {
+    constexpr std::size_t Block = FrameCaptureWriter::BlockBytes;
+    std::vector<std::byte> memory(Block * 150 + 4096);
+    for (std::size_t block = 0; block < 150; ++block) {
+        if (block % 3 == 1 || (block >= 10 && block < 90)) {
+            for (std::size_t at = 0; at < Block; at += 97) memory[block * Block + at] = static_cast<std::byte>((block * 131 + at) & 0xff);
+        }
+    }
+    memory[memory.size() - 1] = std::byte{0x5a};
+    return memory;
+}
+
+void truncateFile(const std::filesystem::path& path, std::uintmax_t removed) {
+    const auto size = std::filesystem::file_size(path);
+    std::filesystem::resize_file(path, size - removed);
+}
+
+void testRoundTrip(const std::filesystem::path& directory) {
+    constexpr std::uint64_t Base = 0x2000000000;
+    const auto calls = sampleCalls();
+    const auto memory = sampleMemory();
+    std::vector<std::byte> delta(8192);
+    for (std::size_t at = 0; at < delta.size(); ++at) delta[at] = static_cast<std::byte>(at * 7);
+    std::uint64_t stored = 0;
+    {
+        FrameCaptureWriter writer(directory);
+        writer.WriteRange(Base, memory.size(), FrameRangeKind::Watched, 3, AgcDriver::FrameRangeAccess::Readable | AgcDriver::FrameRangeAccess::Gpu);
+        stored = writer.WriteSnapshot(Base, memory);
+        for (const auto& call : calls) writer.WriteCall(call);
+        writer.WriteDelta(1, 17, Base + 0x3000, delta);
+        writer.Finish("{\"magic\":\"aps5-frame-capture 1\"}\n");
+        check(writer.RawBytes() == stored + delta.size(), "raw byte count does not add the snapshot and the delta");
+    }
+    std::size_t nonzero = 0;
+    for (std::size_t at = 0; at < memory.size(); at += FrameCaptureWriter::BlockBytes) {
+        const auto bytes = std::min(FrameCaptureWriter::BlockBytes, memory.size() - at);
+        if (!AgcDriver::AllZero(std::span(memory).subspan(at, bytes))) nonzero += bytes;
+    }
+    check(stored == nonzero, "the snapshot stored zero blocks or lost data blocks");
+
+    const FrameCaptureReader reader(directory);
+    check(!reader.Truncated(), "a finished capture reads as truncated");
+    check(reader.Header() == "{\"magic\":\"aps5-frame-capture 1\"}\n", "header does not round-trip");
+    check(reader.Calls().size() == calls.size(), "call count does not round-trip");
+    for (std::size_t index = 0; index < calls.size(); ++index) check(sameCall(reader.Calls()[index], calls[index]), "call " + std::to_string(index) + " does not round-trip");
+
+    std::vector<std::byte> restored(memory.size());
+    std::size_t ranges = 0, snapshots = 0, deltas = 0;
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Range) {
+            ++ranges;
+            check(chunk.address == Base && chunk.bytes == memory.size() && chunk.rangeKind == FrameRangeKind::Watched && chunk.protection == 3 &&
+                      chunk.access == (AgcDriver::FrameRangeAccess::Readable | AgcDriver::FrameRangeAccess::Gpu), "range does not round-trip");
+            continue;
+        }
+        if (chunk.kind == FrameMemoryKind::Snapshot) {
+            ++snapshots;
+            check(chunk.bytes <= FrameCaptureWriter::ChunkBytes, "snapshot chunk is larger than the chunk limit");
+            check(chunk.address >= Base && chunk.address - Base + chunk.bytes <= restored.size(), "snapshot chunk outside its range");
+            reader.Read(chunk, std::span(restored).subspan(chunk.address - Base, chunk.bytes));
+            continue;
+        }
+        ++deltas;
+        check(chunk.group == 1 && chunk.completed == 17 && chunk.address == Base + 0x3000, "delta header does not round-trip");
+        check(reader.Read(chunk) == delta, "delta bytes do not round-trip");
+    }
+    check(ranges == 1 && deltas == 1 && snapshots >= 2, "unexpected chunk counts");
+    check(restored == memory, "snapshot does not restore the memory");
+    std::vector<std::byte> wrong(1);
+    checkThrows([&] { reader.Read(reader.Chunks()[1], wrong); }, "a read into a wrongly sized destination does not throw");
+}
+
+void testTruncated(const std::filesystem::path& source, const std::filesystem::path& directory) {
+    std::filesystem::remove_all(directory);
+    std::filesystem::copy(source, directory, std::filesystem::copy_options::recursive);
+    truncateFile(directory / FrameCaptureWriter::CallsName, 3);
+    truncateFile(directory / FrameCaptureWriter::MemoryName, 10);
+    std::filesystem::remove(directory / FrameCaptureWriter::HeaderName);
+    const FrameCaptureReader reader(directory);
+    const auto calls = sampleCalls();
+    check(reader.Truncated(), "a cut capture does not read as truncated");
+    check(reader.Calls().size() == calls.size() - 1, "a cut call record is not dropped");
+    check(reader.Chunks().back().kind != FrameMemoryKind::Delta, "a cut memory chunk is not dropped");
+}
+
+void testCorrupt(const std::filesystem::path& source, const std::filesystem::path& directory) {
+    std::filesystem::remove_all(directory);
+    std::filesystem::copy(source, directory, std::filesystem::copy_options::recursive);
+    {
+        std::fstream file(directory / FrameCaptureWriter::CallsName, std::ios::binary | std::ios::in | std::ios::out);
+        file.seekp(static_cast<std::streamoff>(FrameCaptureWriter::CallsMagic.size()));
+        const std::uint32_t kind = 99;
+        file.write(reinterpret_cast<const char*>(&kind), sizeof(kind));
+    }
+    checkThrows([&] { FrameCaptureReader reader(directory); }, "an unknown call kind does not throw");
+    std::ofstream(directory / FrameCaptureWriter::CallsName, std::ios::binary | std::ios::trunc) << "not a capture";
+    checkThrows([&] { FrameCaptureReader reader(directory); }, "a file without the magic does not throw");
+}
+
+void testWriter(const std::filesystem::path& directory) {
+    FrameCaptureWriter writer(directory);
+    writer.Finish("{}");
+    FrameCall call;
+    call.kind = FrameCallKind::Suspend;
+    checkThrows([&] { writer.WriteCall(call); }, "a call after Finish does not throw");
+    checkThrows([&] { writer.Finish("{}"); }, "a second Finish does not throw");
+    FrameCall unknown;
+    unknown.kind = static_cast<FrameCallKind>(77);
+    FrameCaptureWriter other(directory / "other");
+    checkThrows([&] { other.WriteCall(unknown); }, "an unknown call kind is written");
+}
+
+void testAllZero() {
+    std::vector<std::byte> bytes(37);
+    check(AgcDriver::AllZero(bytes), "zero bytes are not all zero");
+    check(AgcDriver::AllZero({}), "an empty span is not all zero");
+    bytes[36] = std::byte{1};
+    check(!AgcDriver::AllZero(bytes), "a nonzero tail byte is missed");
+    bytes[36] = std::byte{0};
+    bytes[3] = std::byte{1};
+    check(!AgcDriver::AllZero(bytes), "a nonzero word is missed");
+}
+
+}
+
+int main() {
+    const auto root = std::filesystem::temp_directory_path() / ("aps5-frame-capture-test-" + std::to_string(getpid()));
+    std::filesystem::remove_all(root);
+    testAllZero();
+    testRoundTrip(root / "capture");
+    testTruncated(root / "capture", root / "truncated");
+    testCorrupt(root / "capture", root / "corrupt");
+    testWriter(root / "writer");
+    std::filesystem::remove_all(root);
+    std::puts("frame capture tests passed");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp
new file mode 100644
index 0000000000..88d8cb144e
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp
@@ -0,0 +1,143 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+
+constexpr std::uint32_t Handle = 7;
+constexpr std::size_t BlockBytes = 1u << 20;
+constexpr std::size_t Frames = 6;
+constexpr std::size_t CapturedFrames = 3;
+
+void check(bool condition, const std::string& reason) {
+    if (!condition) throw std::runtime_error(reason);
+}
+
+class Request final : public AgcDriver::IFlipRequest {
+public:
+    explicit Request(std::atomic<int>& ready) : ready(ready) {}
+    void GpuReady(const std::shared_ptr<AgcDriver::FrameTiming>&) override { ++ready; }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+
+private:
+    std::atomic<int>& ready;
+};
+
+class Output final : public AgcDriver::IVideoOutput {
+public:
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared<Request>(ready); }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+    std::atomic<int> ready = 0;
+};
+
+std::byte* allocate() {
+    auto* const block = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536));
+    check(block != nullptr, "cannot allocate guest memory");
+    GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 0x04, BlockBytes);
+    GuestAllocations::Mutation mutation;
+    mutation.Add(block, BlockBytes, true, true, true);
+    return block;
+}
+
+void submitEopFrame(std::byte* block, std::size_t frame) {
+    const auto token = AgcDriverReserveEopFlip_nid_postfix(AgcDriver::FlipInfo{Handle, 0, 1, static_cast<std::int64_t>(frame)});
+    check(token != 0, "the EOP flip of frame " + std::to_string(frame) + " was not reserved");
+    auto* const words = reinterpret_cast<std::uint32_t*>(block + frame * 256);
+    const auto label = reinterpret_cast<std::uintptr_t>(block + BlockBytes / 2 + frame * 8);
+    const std::array<std::uint32_t, 8> release{0xc0064900u, 0x06200504u, 0x42010000u, static_cast<std::uint32_t>(label), static_cast<std::uint32_t>(label >> 32u), 1u, 0u, token};
+    std::memcpy(words, release.data(), sizeof(release));
+    Packet packet{words, static_cast<std::uint32_t>(release.size()), 0, {}};
+    check(sceAgcDriverSubmitDcb(&packet) == 0, "the EOP submission of frame " + std::to_string(frame) + " failed");
+}
+
+void testEopFramesCountOnce() {
+    const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+    check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set");
+    auto* const block = allocate();
+    auto output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+    for (std::size_t frame = 0; frame < Frames; ++frame) submitEopFrame(block, frame);
+    AgcDriverWaitIdle_nid_postfix();
+    check(output->ready.load() == static_cast<int>(Frames), "the driver presented " + std::to_string(output->ready.load()) + " of the EOP flips");
+
+    const FrameCaptureReader reader{std::filesystem::path(directory)};
+    check(!reader.Truncated(), "the capture is truncated");
+    check(reader.Header().find("\"frames\":" + std::to_string(CapturedFrames)) != std::string::npos, "the capture header does not record " + std::to_string(CapturedFrames) + " frames: " + reader.Header());
+    const auto& calls = reader.Calls();
+    const auto start = std::find_if(calls.begin(), calls.end(), [](const auto& call) { return call.kind == FrameCallKind::FrameStart; });
+    check(start != calls.end(), "the capture has no frame start");
+    std::size_t submits = 0, reservations = 0;
+    FrameCallKind first = FrameCallKind::End;
+    for (auto call = start + 1; call != calls.end(); ++call) {
+        if (call->kind == FrameCallKind::Submit || call->kind == FrameCallKind::ReserveEopFlip) {
+            if (first == FrameCallKind::End) first = call->kind;
+            submits += call->kind == FrameCallKind::Submit;
+            reservations += call->kind == FrameCallKind::ReserveEopFlip;
+        }
+    }
+    check(first == FrameCallKind::ReserveEopFlip, "the capture started between a reservation and the submission that flips it");
+    check(submits == CapturedFrames && reservations == CapturedFrames,
+          "the captured frames hold " + std::to_string(submits) + " submissions and " + std::to_string(reservations) + " reservations, expected " + std::to_string(CapturedFrames) + " of each");
+}
+
+void testFlipsCountPerThread() {
+    auto* const block = allocate();
+    const auto& driver = AgcDriver::DriverDetail::Driver::Get();
+    const auto before = driver.FlipSubmissions();
+    std::uint64_t otherBefore = 0, otherAfter = 0;
+    std::exception_ptr failure;
+    std::thread submitter([&] {
+        try {
+            otherBefore = driver.FlipSubmissions();
+            submitEopFrame(block, 0);
+            otherAfter = driver.FlipSubmissions();
+        } catch (...) {
+            failure = std::current_exception();
+        }
+    });
+    submitter.join();
+    if (failure) std::rethrow_exception(failure);
+    AgcDriverWaitIdle_nid_postfix();
+    check(otherAfter == otherBefore + 1, "the flipping submission did not count on the thread that made it");
+    check(driver.FlipSubmissions() == before, "a flip submitted on another thread changed this thread's flip count, so a submission of this thread that overlaps it would end a captured frame");
+}
+
+}
+
+int main() {
+    try {
+        testEopFramesCountOnce();
+        testFlipsCountPerThread();
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "FAILED: %s\n", error.what());
+        return 1;
+    }
+    std::puts("frame capture EOP tests passed");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp
index ec52e5f1d9..f6b12a62e6 100644
--- a/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp
@@ -120,13 +120,15 @@ void DisableAfterFailure() {
     AgcDriver::FrameDumpOutput output;
     const std::array<std::byte, 16> pixels{};
     Check(output.Enabled_nid_no_patch(), "BMP output was disabled before any failure");
-    const auto blocked = directory.string();
+    const auto previous = std::filesystem::current_path();
+    std::filesystem::current_path(directory.parent_path());
+    const auto blocked = directory.filename().string();
     Check(!output.Write_nid_no_patch(blocked.c_str(), 2, 2, pixels), "BMP output accepted a directory as a file");
     Check(!output.Enabled_nid_no_patch(), "failed BMP output remained enabled");
-    const auto skipped = directory / "must-not-exist.bmp";
-    const auto path = skipped.string();
+    const auto path = (directory.filename() / "must-not-exist.bmp").string();
     for (unsigned i = 0; i < 64; ++i) Check(!output.Write_nid_no_patch(path.c_str(), 2, 2, pixels), "disabled BMP output wrote another file");
-    Check(!std::filesystem::exists(skipped), "disabled BMP output created a file");
+    std::filesystem::current_path(previous);
+    Check(!std::filesystem::exists(directory / "must-not-exist.bmp"), "disabled BMP output created a file");
     Check(std::filesystem::remove(directory), "cannot remove empty fixture directory");
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp
new file mode 100644
index 0000000000..23e6c21513
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp
@@ -0,0 +1,270 @@
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <atomic>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+using AgcDriver::FrameMemoryKind;
+
+constexpr std::uint32_t Handle = 7;
+constexpr std::uint8_t GraphicsMemory = 0x0a;
+constexpr std::uint8_t DmaMemory = 0;
+constexpr std::size_t BlockBytes = 1u << 20;
+constexpr std::size_t CommandBytes = 64u * 1024u;
+constexpr std::size_t DataBytes = 4096;
+constexpr std::uint32_t Done = 1;
+
+void check(bool condition, const std::string& reason) {
+    if (!condition) throw std::runtime_error(reason);
+}
+
+std::uint64_t at(const volatile void* pointer) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(pointer));
+}
+
+class Request final : public AgcDriver::IFlipRequest {
+public:
+    explicit Request(std::atomic<int>& ready) : ready(ready) {}
+    void GpuReady(const std::shared_ptr<AgcDriver::FrameTiming>&) override { ++ready; }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+
+private:
+    std::atomic<int>& ready;
+};
+
+class Output final : public AgcDriver::IVideoOutput {
+public:
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared<Request>(ready); }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+    std::atomic<int> ready = 0;
+};
+
+struct Layout {
+    std::byte* base = nullptr;
+    std::uint32_t* firstCommands = nullptr;
+    std::uint32_t* secondCommands = nullptr;
+    std::byte* source = nullptr;
+    std::byte* firstTarget = nullptr;
+    std::byte* secondTarget = nullptr;
+    std::uint32_t* label = nullptr;
+};
+
+Layout allocate() {
+    auto* const block = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536));
+    check(block != nullptr, "cannot allocate guest memory");
+    GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 0x04, BlockBytes);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, BlockBytes, true, true, true);
+    }
+    Layout layout;
+    layout.base = block;
+    layout.firstCommands = reinterpret_cast<std::uint32_t*>(block);
+    layout.secondCommands = reinterpret_cast<std::uint32_t*>(block + CommandBytes);
+    layout.source = block + 2 * CommandBytes;
+    layout.firstTarget = layout.source + DataBytes;
+    layout.secondTarget = layout.firstTarget + DataBytes;
+    layout.label = reinterpret_cast<std::uint32_t*>(layout.secondTarget + DataBytes);
+    return layout;
+}
+
+std::vector<std::byte> pattern(std::uint8_t seed) {
+    std::vector<std::byte> bytes(DataBytes);
+    for (std::size_t index = 0; index < bytes.size(); ++index) bytes[index] = static_cast<std::byte>((index * 31 + seed) & 0xff);
+    return bytes;
+}
+
+void copy(std::uint32_t* words, std::size_t commandBytes, const std::byte* source, std::byte* target, std::uint32_t* label) {
+    CommandBuffer buffer{words, words + commandBytes / sizeof(std::uint32_t), words, words + commandBytes / sizeof(std::uint32_t), nullptr, nullptr, 0};
+    sceAgcDcbDmaData(&buffer, 0, DmaMemory, 0, at(target), DmaMemory, 0, at(source), DataBytes, 0, 1, 0);
+    sceAgcDcbWriteData(&buffer, GraphicsMemory, 0, at(label), &Done, 1, 0, 1);
+    Packet packet{words, static_cast<std::uint32_t>(buffer.cursor_up - words), 0, {}};
+    check(sceAgcDriverSubmitDcb(&packet) == 0, "submission failed");
+}
+
+void copyFrame(std::uint32_t* words, const Layout& layout, std::byte* target) {
+    copy(words, CommandBytes, layout.source, target, layout.label);
+}
+
+void flip() {
+    AgcDriverSubmitFlip_nid_postfix(AgcDriver::FlipInfo{Handle, -1, 1, 0});
+}
+
+std::vector<std::byte> readFile(const std::filesystem::path& path) {
+    std::ifstream file(path, std::ios::binary);
+    check(file.is_open(), "cannot open " + path.string());
+    std::vector<char> bytes((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
+    std::vector<std::byte> result(bytes.size());
+    std::memcpy(result.data(), bytes.data(), bytes.size());
+    return result;
+}
+
+bool equal(const std::byte* bytes, const std::vector<std::byte>& expected) {
+    return std::memcmp(bytes, expected.data(), expected.size()) == 0;
+}
+
+void testCaptureAndReplay(const std::filesystem::path& tool) {
+    const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+    check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set");
+    const std::filesystem::path capture(directory);
+    const auto layout = allocate();
+    const auto first = pattern(3);
+    const auto second = pattern(101);
+    auto output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+    AgcDriverUnregisterVideoOutput_nid_postfix(Handle, output);
+    output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+
+    flip();
+    std::memcpy(layout.source, first.data(), first.size());
+    copyFrame(layout.firstCommands, layout, layout.firstTarget);
+    flip();
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriverUnregisterVideoOutput_nid_postfix(Handle, output);
+    output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+    const auto late = allocate();
+    std::memcpy(late.source, second.data(), second.size());
+    copyFrame(late.firstCommands, late, late.firstTarget);
+    flip();
+    AgcDriverWaitIdle_nid_postfix();
+    check(equal(layout.firstTarget, first) && equal(late.firstTarget, second), "the driver did not run the copies while capturing");
+
+    const FrameCaptureReader reader(capture);
+    check(!reader.Truncated(), "the capture is truncated");
+    check(reader.Header().find("\"frames\":2") != std::string::npos, "the capture header does not record two frames: " + reader.Header());
+    std::size_t submits = 0, flips = 0, memory = 0, starts = 0, registrations = 0, unregistrations = 0;
+    for (const auto& call : reader.Calls()) {
+        submits += call.kind == FrameCallKind::Submit;
+        flips += call.kind == FrameCallKind::Flip;
+        memory += call.kind == FrameCallKind::Memory;
+        starts += call.kind == FrameCallKind::FrameStart;
+        registrations += call.kind == FrameCallKind::RegisterVideoOutput;
+        unregistrations += call.kind == FrameCallKind::UnregisterVideoOutput;
+    }
+    check(starts == 1 && submits == 2 && flips == 2, "the capture holds " + std::to_string(submits) + " submits and " + std::to_string(flips) + " flips after " + std::to_string(starts) + " frame starts");
+    check(memory >= 2, "the CPU writes before each copy were not recorded as memory deltas");
+    check(registrations == 3 && unregistrations == 2, "video output close and reopen was not recorded before and during capture");
+    const auto recorded = [&](const std::byte* base) {
+        return std::any_of(reader.Chunks().begin(), reader.Chunks().end(), [&](const auto& chunk) {
+            return chunk.kind == FrameMemoryKind::Range && chunk.address <= at(base) && at(base) + BlockBytes <= chunk.address + chunk.bytes;
+        });
+    };
+    check(recorded(layout.base), "the guest block is not in the snapshot ranges");
+    check(recorded(late.base), "the block committed during the capture is not in its ranges");
+    check(reader.Header().find("\"late_ranges\":1") != std::string::npos, "the capture header does not count one range committed during the capture: " + reader.Header());
+
+    const auto firstDump = capture / "first.bin";
+    const auto secondDump = capture / "second.bin";
+    const auto command = "\"\"" + tool.string() + "\" \"" + capture.string() + "\" --strict --dump " + std::to_string(at(layout.firstTarget)) + ":" + std::to_string(DataBytes) + ":\"" + firstDump.string() +
+                         "\" --dump " + std::to_string(at(late.firstTarget)) + ":" + std::to_string(DataBytes) + ":\"" + secondDump.string() + "\"\"";
+    const auto code = std::system(command.c_str());
+    check(code == 0, "agc_frame_replay exited with " + std::to_string(code));
+    check(readFile(firstDump) == first, "the replay did not reproduce the first copy");
+    check(readFile(secondDump) == second, "the replay did not reproduce the second copy");
+}
+
+void testConcurrentCopies(const std::filesystem::path& tool) {
+    constexpr std::size_t Copies = 64;
+    constexpr std::size_t Frames = 8;
+    constexpr std::size_t CopyCommandBytes = 1024;
+    const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+    check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set");
+    const std::filesystem::path capture(directory);
+    const auto layout = allocate();
+    const auto other = allocate();
+    auto* const otherSource = other.base + 128 * 1024;
+    auto* const targets = otherSource + DataBytes;
+    auto* const otherLabel = reinterpret_cast<std::uint32_t*>(other.base + 512 * 1024);
+    const auto copied = pattern(57);
+    std::memcpy(otherSource, copied.data(), copied.size());
+    auto output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+
+    flip();
+    std::thread copier([&] {
+        for (std::size_t index = 0; index < Copies; ++index) {
+            copy(reinterpret_cast<std::uint32_t*>(other.base + index * CopyCommandBytes), CopyCommandBytes, otherSource, targets + index * DataBytes, otherLabel);
+        }
+    });
+    for (std::size_t frame = 0; frame + 1 < Frames; ++frame) {
+        const auto bytes = pattern(static_cast<std::uint8_t>(frame));
+        std::memcpy(layout.source, bytes.data(), bytes.size());
+        copyFrame(layout.firstCommands, layout, layout.firstTarget);
+        flip();
+    }
+    copier.join();
+    flip();
+    AgcDriverWaitIdle_nid_postfix();
+
+    const FrameCaptureReader reader(capture);
+    check(!reader.Truncated(), "the capture is truncated");
+    std::uint64_t base = 0;
+    std::size_t submits = 0, memory = 0;
+    for (const auto& call : reader.Calls()) {
+        if (call.kind == FrameCallKind::FrameStart) base = call.completed;
+        if (call.kind == FrameCallKind::Memory) {
+            ++memory;
+            check(call.completed >= base + submits, "a memory delta was read with " + std::to_string(base + submits - call.completed) + " of the " + std::to_string(submits) + " submissions recorded before it unfinished");
+        }
+        submits += call.kind == FrameCallKind::Submit;
+    }
+    check(submits == Copies + Frames - 1, "the capture holds " + std::to_string(submits) + " submits, not " + std::to_string(Copies + Frames - 1));
+    check(memory != 0, "the capture holds no memory deltas");
+
+    const auto dump = capture / "targets.bin";
+    const auto command = "\"\"" + tool.string() + "\" \"" + capture.string() + "\" --strict --dump " + std::to_string(at(targets)) + ":" + std::to_string(Copies * DataBytes) + ":\"" + dump.string() + "\"\"";
+    const auto code = std::system(command.c_str());
+    check(code == 0, "agc_frame_replay exited with " + std::to_string(code));
+    const auto replayed = readFile(dump);
+    check(replayed.size() == Copies * DataBytes, "the replay dumped " + std::to_string(replayed.size()) + " bytes of the copy targets");
+    for (std::size_t index = 0; index < Copies; ++index) {
+        check(std::memcmp(replayed.data() + index * DataBytes, copied.data(), DataBytes) == 0, "the replay did not reproduce copy " + std::to_string(index) + " of the second thread");
+    }
+}
+
+}
+
+int main(int argc, char** argv) {
+    if (argc != 2 && !(argc == 3 && std::string(argv[2]) == "concurrent")) {
+        std::fprintf(stderr, "usage: agc_driver_frame_replay_tests <agc_frame_replay> [concurrent]\n");
+        return 2;
+    }
+    try {
+        if (argc == 3) testConcurrentCopies(argv[1]);
+        else testCaptureAndReplay(argv[1]);
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "FAILED: %s\n", error.what());
+        return 1;
+    }
+    std::puts("frame replay tests passed");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp
new file mode 100644
index 0000000000..c54b01466a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp
@@ -0,0 +1,241 @@
+#define main frameReplayToolMain
+#include "../tools/FrameReplay.cpp"
+#undef main
+#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp"
+#include <barrier>
+
+namespace {
+
+using AgcDriver::FrameCaptureWriter;
+
+void check(bool condition, const char* reason) {
+    if (!condition) throw std::runtime_error(reason);
+}
+
+std::uint64_t address(const void* pointer) {
+    return reinterpret_cast<std::uintptr_t>(pointer);
+}
+
+std::byte* allocate(std::size_t size, bool gpu = true) {
+    auto* bytes = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(size, 65536));
+    check(bytes != nullptr, "guest allocation failed");
+    GuestArena::GuestArenaCommit_nid_postfix(bytes, size, 0x04, size);
+    GuestAllocations::Mutation mutation;
+    mutation.Add(bytes, size, true, true, gpu);
+    return bytes;
+}
+
+void collectGroups(Replay& replay) {
+    for (const auto& chunk : replay.reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Delta) replay.groups[chunk.group].push_back(&chunk);
+    }
+}
+
+FrameCall memoryCall(std::uint64_t group, std::uint64_t thread) {
+    FrameCall call;
+    call.kind = FrameCallKind::Memory;
+    call.values = {group};
+    call.thread = thread;
+    return call;
+}
+
+void testMemoryOrder(const std::filesystem::path& directory) {
+    constexpr std::size_t Size = 64u * 1024u * 1024u;
+    auto* bytes = allocate(Size);
+    const std::vector<std::byte> first(Size, std::byte{0x11});
+    const std::vector<std::byte> second(4096, std::byte{0x22});
+    FrameCaptureWriter writer(directory);
+    writer.WriteDelta(1, 0, address(bytes), first);
+    writer.WriteDelta(2, 0, address(bytes + Size - second.size()), second);
+    writer.Finish("{}");
+    const FrameCaptureReader reader(directory);
+    Options options;
+    options.release = false;
+    Replay replay{options, reader};
+    replay.recording = true;
+    collectGroups(replay);
+    const std::array calls{memoryCall(1, 1), memoryCall(2, 2)};
+    replay.runWindow(calls);
+    check(std::all_of(bytes, bytes + Size - second.size(), [](std::byte value) { return value == std::byte{0x11}; }), "first delta was not restored");
+    check(std::equal(second.begin(), second.end(), bytes + Size - second.size()), "an earlier delta overwrote the later thread's delta");
+}
+
+void testReusedMemory(const std::filesystem::path& directory) {
+#ifdef _WIN32
+    constexpr std::size_t Size = 2 * FrameCaptureWriter::BlockBytes;
+    auto* bytes = allocate(Size);
+    auto* cpu = allocate(FrameCaptureWriter::BlockBytes, false);
+    std::fill_n(bytes, Size, std::byte{0x7f});
+    std::fill_n(cpu, FrameCaptureWriter::BlockBytes, std::byte{0x55});
+    std::vector<std::byte> expected(Size);
+    std::fill(expected.begin() + FrameCaptureWriter::BlockBytes, expected.end(), std::byte{0x22});
+    std::uintptr_t base = 0;
+    std::size_t arenaSize = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&base, &arenaSize);
+    FrameCaptureWriter writer(directory);
+    writer.WriteRange(address(bytes), Size, FrameRangeKind::Watched, PAGE_READWRITE, FrameRangeAccess::Readable | FrameRangeAccess::Writable | FrameRangeAccess::Gpu);
+    writer.WriteRange(address(cpu), FrameCaptureWriter::BlockBytes, FrameRangeKind::Unwatched, PAGE_READWRITE, FrameRangeAccess::Readable | FrameRangeAccess::Writable);
+    check(writer.WriteSnapshot(address(bytes), expected) == FrameCaptureWriter::BlockBytes, "zero snapshot block was not elided");
+    writer.Finish("{\"arena_base\":" + std::to_string(base) + "}");
+    const FrameCaptureReader reader(directory);
+    const auto skipped = restoreMemory(reader);
+    check(std::equal(expected.begin(), expected.end(), bytes), "reused GPU memory did not restore zero and nonzero snapshot blocks");
+    check(skipped.bytes == FrameCaptureWriter::BlockBytes, "unexpected skipped memory");
+    check(std::all_of(cpu, cpu + FrameCaptureWriter::BlockBytes, [](std::byte value) { return value == std::byte{0x55}; }), "reused CPU memory was overwritten");
+#endif
+}
+
+void testEopTokens() {
+    Frames frames;
+    auto output = std::make_shared<ReplayOutput>(frames);
+    AgcDriverRegisterVideoOutput_nid_postfix(7, output);
+    std::barrier together(2);
+    std::atomic<int> wrong{0};
+    const auto worker = [&](int lane) {
+        for (int round = 0; round < 2000; ++round) {
+            const auto requested = AgcDriver::EopFlipTokenBase + round * 8 + lane * 2;
+            together.arrive_and_wait();
+            try {
+                if (AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, requested) != requested) ++wrong;
+            } catch (const std::exception&) { ++wrong; }
+        }
+    };
+    std::thread first(worker, 0), second(worker, 1);
+    first.join();
+    second.join();
+    check(wrong.load() == 0, "concurrent explicit EOP reservations returned the wrong token");
+    const auto high = AgcDriver::EopFlipTokenBase + 20000;
+    check(AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high) == high, "explicit high token was not reserved");
+    check(AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high - 1) == high - 1, "explicit lower token was not reserved");
+    check(AgcDriverReserveEopFlip_nid_postfix({7, -1, 1, 0}) == high + 1, "ordinary reservation reused an explicit token");
+    bool rejected = false;
+    try { AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high); }
+    catch (const std::runtime_error&) { rejected = true; }
+    check(rejected, "duplicate explicit token was not rejected");
+    AgcDriverUnregisterVideoOutput_nid_postfix(7, output);
+}
+
+class WaitingOutput final : public AgcDriver::IVideoOutput {
+public:
+    WaitingOutput(Frames& frames, const std::uint32_t* label) : frames(frames), label(label) {}
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override {
+        const auto deadline = Clock::now() + std::chrono::seconds(2);
+        while (*static_cast<const volatile std::uint32_t*>(label) == 0) {
+            check(Clock::now() < deadline, "a blocking driver call prevented the later memory update");
+            std::this_thread::yield();
+        }
+        return std::make_shared<ReplayFlip>(frames);
+    }
+    void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); }
+
+private:
+    Frames& frames;
+    const std::uint32_t* label;
+};
+
+void testBlockingSubmission(const std::filesystem::path& directory) {
+    auto* bytes = allocate(FrameCaptureWriter::BlockBytes);
+    auto* label = reinterpret_cast<std::uint32_t*>(bytes);
+    const std::uint32_t ready = 1;
+    FrameCaptureWriter writer(directory);
+    writer.WriteDelta(1, 0, address(label), std::as_bytes(std::span(&ready, 1)));
+    writer.Finish("{}");
+    const FrameCaptureReader reader(directory);
+    Options options;
+    options.pace = false;
+    options.release = false;
+    Replay replay{options, reader};
+    collectGroups(replay);
+    auto output = std::make_shared<WaitingOutput>(replay.frames, label);
+    AgcDriverRegisterVideoOutput_nid_postfix(7, output);
+    std::array<std::uint32_t, AgcDriver::FlipPacketWords> words{AgcDriver::FlipPacketHeader, 7, 0xffffffffu, 1, 0, 0};
+    for (const auto kind : {FrameCallKind::Submit, FrameCallKind::Flip, FrameCallKind::ReserveEopFlip}) {
+        *label = 0;
+        FrameCall submit;
+        submit.kind = kind;
+        submit.thread = 1;
+        submit.address = address(words.data());
+        submit.size = words.size();
+        submit.values = {7, static_cast<std::uint64_t>(-1), 1, 0, AgcDriver::EopFlipTokenBase};
+        const std::array calls{submit, memoryCall(1, 2)};
+        replay.runWindow(calls);
+        check(*label == ready && replay.unfinished == 0, "blocking submission did not complete");
+    }
+    check(replay.frames.Times().size() == 2, "blocking submissions lost a flip");
+    AgcDriverUnregisterVideoOutput_nid_postfix(7, output);
+}
+
+void testShaderCode(const std::filesystem::path& directory, bool host) {
+    auto* bytes = allocate(1u << 20);
+    auto* shader = reinterpret_cast<Shader*>(bytes);
+    auto* code = bytes + (1u << 19) + 256;
+    constexpr std::size_t CodeBytes = 3 * FrameCaptureWriter::BlockBytes;
+#ifdef _WIN32
+    if (host) {
+        auto* memory = static_cast<std::byte*>(VirtualAlloc(nullptr, CodeBytes + 4096, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        check(memory != nullptr, "host shader allocation failed");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(memory, CodeBytes + 4096, true, true, true);
+        code = memory + 256;
+    }
+#endif
+    *shader = {};
+    shader->file_header = 0x34333231u;
+    shader->version = 0x18u;
+    shader->header_size = sizeof(Shader);
+    shader->shader_size = CodeBytes;
+    shader->code = code;
+    auto* recorder = AgcDriver::FrameRecorder::Active();
+    check(recorder != nullptr, "frame recorder is disabled");
+    recorder->FrameBoundary();
+    std::vector<std::byte> expected(CodeBytes);
+    for (std::size_t i = 0; i < expected.size(); ++i) expected[i] = static_cast<std::byte>(i * 31 + 17);
+    std::memcpy(code, expected.data(), expected.size());
+    recorder->RegisterShader(shader);
+    recorder->FrameBoundary();
+    const FrameCaptureReader reader(directory);
+    std::vector<std::byte> captured(CodeBytes);
+    const auto apply = [&](const FrameMemoryChunk& chunk) {
+        const auto begin = std::max(address(code), chunk.address);
+        const auto end = std::min(address(code) + CodeBytes, chunk.address + chunk.bytes);
+        if (begin >= end) return;
+        const auto data = reader.Read(chunk);
+        std::memcpy(captured.data() + begin - address(code), data.data() + begin - chunk.address, end - begin);
+    };
+    for (const auto& chunk : reader.Chunks()) if (chunk.kind == FrameMemoryKind::Snapshot) apply(chunk);
+    bool registered = false;
+    for (const auto& call : reader.Calls()) {
+        if (call.kind == FrameCallKind::RegisterShader) {
+            registered = true;
+            break;
+        }
+        if (call.kind != FrameCallKind::Memory) continue;
+        for (const auto& chunk : reader.Chunks()) {
+            if (chunk.kind == FrameMemoryKind::Delta && chunk.group == call.values.at(0)) apply(chunk);
+        }
+    }
+    check(registered && captured == expected, "the complete separate shader code was not captured before registration");
+}
+
+}
+
+int main(int argc, char** argv) {
+    try {
+        check(argc == 3, "expected a test name and capture directory");
+        const std::string mode = argv[1];
+        const std::filesystem::path directory = argv[2];
+        if (mode == "order") testMemoryOrder(directory);
+        else if (mode == "zero") testReusedMemory(directory);
+        else if (mode == "tokens") testEopTokens();
+        else if (mode == "blocking") testBlockingSubmission(directory);
+        else if (mode == "shader" || mode == "shader_host") testShaderCode(directory, mode == "shader_host");
+        else throw std::runtime_error("unknown test");
+        AgcDriverShutdown_nid_postfix();
+        std::puts("frame replay state test passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        try { AgcDriverShutdown_nid_postfix(); } catch (...) {}
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
index 7b4e5bda3d..e1896d291f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "BdaTests.hpp"
 #include "GraphicsTests.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
@@ -10,7 +11,6 @@
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "ShaderDiskCache.hpp"
 #include "ShaderCacheDirectory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp"
@@ -65,8 +65,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" std::terminate_handler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(std::terminate_handler handler);
-
 namespace {
 
 using AgcDriver::Graphics::Require;
@@ -824,7 +822,7 @@ void msaaEnableClearOneSampleTargetTests() {
     queue = drawC();
     queue.context[0x1b3] |= ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
     requireOneSample(queue, "draw C with an enabled but unaddressed ANCILLARY input");
-    constexpr std::string_view refused = "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with PS_ITER_SAMPLE, a sample index or coverage input, or a sample-mask export";
+    constexpr std::string_view refused = "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with a sample index or coverage input, or a sample-mask export";
     for (const auto input : {ShaderRecompiler::PixelInput::Ancillary, ShaderRecompiler::PixelInput::SampleCoverage}) {
         queue = drawC();
         queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(input);
@@ -832,6 +830,10 @@ void msaaEnableClearOneSampleTargetTests() {
     }
     queue = drawC();
     queue.context[0x293] = 0x10000u;
+    queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveSample);
+    requireOneSample(queue, "draw C with PS_ITER_SAMPLE and a sample-interpolated input");
+    Require(!DecodeState(queue).perSampleShading, "PS_ITER_SAMPLE into a one-sample color target without MSAA_ENABLE asked for sample shading");
+    queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
     expectFailure([&] { DecodeState(queue); }, refused);
     queue = drawC();
     queue.context[0x1c4] = 9;
@@ -906,38 +908,24 @@ void msaaEnableClearOneSampleTargetTests() {
     queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage);
     Require(AgcDriver::Graphics::PixelProgramSkipped(queue), "the depth-only draw did not skip its pixel program");
     requireOneSampleDepth(queue, 0, "a one-sample depth target whose skipped pixel program has PS_ITER_SAMPLE and sample index and coverage inputs");
-    constexpr std::string_view depthRefused = "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA Z interpolation or overrasterization";
     for (const bool color : {false, true}) {
-        for (const auto input : {ShaderRecompiler::PixelInput::Ancillary, ShaderRecompiler::PixelInput::SampleCoverage}) {
-            queue = depthTarget(color);
-            queue.context[0x203] |= 0x40u;
-            queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(input);
-            expectFailure([&] { DecodeState(queue); }, depthRefused);
-        }
+        queue = depthTarget(color);
+        queue.context[0x203] |= 0x40u;
+        queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
+        Require(!AgcDriver::Graphics::PixelProgramSkipped(queue), "the ANCILLARY draw skipped its pixel program");
+        requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target whose running pixel program reads ANCILLARY without PS_ITER_SAMPLE");
+        queue.context[0x1b3] = queue.context[0x1b4] = 0x2b01u;
+        requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target whose running pixel program reads PERSP_SAMPLE, the position and ANCILLARY without PS_ITER_SAMPLE");
         queue = depthTarget(color);
         queue.context[0x203] |= 0x40u;
         queue.context[0x293] = 0x10000u;
         Require(!AgcDriver::Graphics::PixelProgramSkipped(queue), "the PS_ITER_SAMPLE draw skipped its pixel program");
         requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target whose running pixel program has PS_ITER_SAMPLE and no sample index or coverage input");
         Require(!DecodeState(queue).perSampleShading, "a PS_ITER_SAMPLE program drawn as one sample still shades per sample");
-        queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
-        expectFailure([&] { DecodeState(queue); }, depthRefused);
-        queue = depthTarget(color);
-        queue.context[0x1c4] = 9;
-        queue.context[0x203] |= 0x100u;
-        expectFailure([&] { DecodeState(queue); }, depthRefused);
-        queue = depthTarget(color);
-        queue.context[0x2dc] = 0x0000aa01u;
-        expectFailure([&] { DecodeState(queue); }, depthRefused);
-        for (const auto primitive : {2u, 3u}) {
-            queue = depthTarget(color);
-            queue.userConfig[0x242] = primitive;
-            expectFailure([&] { DecodeState(queue); }, depthRefused);
-        }
-        for (const auto eqaa : {0x00050002u, 0x00090002u, 0x01010002u, 0x08010002u}) {
+        for (const auto eqaa : {0x00040000u, 0x00050000u}) {
             queue = depthTarget(color);
             queue.context[0x201] = eqaa;
-            expectFailure([&] { DecodeState(queue); }, depthRefused);
+            requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target under a 4x PA_SC_AA_CONFIG without MSAA_ENABLE with DB_EQAA INTERPOLATE_COMP_Z");
         }
     }
     queue = depthTarget(true);
@@ -1936,8 +1924,35 @@ void TuningFieldTests() {
     Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "DISABLE_DUAL_QUAD was rejected");
     Require(state.hasColorTarget && state.blend.colorWriteMask == baseline.blend.colorWriteMask, "DISABLE_DUAL_QUAD changed color output");
     queue.context[0x202] = 0xcc0013;
-    expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "copy ROP");
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "source or brush form");
+    queue.context[0x202] = 0x5b0010;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "source or brush form");
+    queue.context[0x202] = 0x5a0010;
+    state = AgcDriver::Graphics::DecodeState(queue);
+    Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "an XOR ROP was rejected");
+    Require(state.hasColorTarget && state.colorRop == 0x5a && AgcDriver::Graphics::LogicOpFromRop(state.colorRop) == VK_LOGIC_OP_XOR, "an XOR ROP did not decode");
     queue.context[0x202] = 0xcc0010;
+    Require(AgcDriver::Graphics::DecodeState(queue).colorRop == AgcDriver::Graphics::CopyRop, "the copy ROP did not decode as the copy operation");
+    const std::array<std::pair<std::uint8_t, VkLogicOp>, 14> ropOperations{{
+        {0x0f, VK_LOGIC_OP_COPY_INVERTED}, {0xa0, VK_LOGIC_OP_AND}, {0xf0, VK_LOGIC_OP_COPY}, {0xfa, VK_LOGIC_OP_OR},
+        {0x00, VK_LOGIC_OP_CLEAR}, {0x11, VK_LOGIC_OP_NOR}, {0x33, VK_LOGIC_OP_COPY_INVERTED}, {0x55, VK_LOGIC_OP_INVERT}, {0x66, VK_LOGIC_OP_XOR},
+        {0x88, VK_LOGIC_OP_AND}, {0xaa, VK_LOGIC_OP_NO_OP}, {0xcc, VK_LOGIC_OP_COPY}, {0xee, VK_LOGIC_OP_OR}, {0xff, VK_LOGIC_OP_SET}}};
+    for (const auto& [rop, operation] : ropOperations) Require(AgcDriver::Graphics::LogicOpFromRop(rop) == operation, "a ROP3 code mapped to the wrong logic operation");
+    std::uint32_t documentedRops = 0;
+    for (std::uint32_t rop = 0; rop < 256u; ++rop) {
+        try {
+            static_cast<void>(AgcDriver::Graphics::LogicOpFromRop(static_cast<std::uint8_t>(rop)));
+            ++documentedRops;
+        } catch (const std::runtime_error&) {
+        }
+    }
+    Require(documentedRops == 28u, "a ROP3 code outside the source and brush forms was accepted, or one inside them was refused");
+    auto blendedLogic = queue;
+    blendedLogic.context[0x202] = 0x5a0010;
+    blendedLogic.context[0x1e0] = 0x40000101u;
+    for (std::uint32_t index = 0; index < 4u; ++index) blendedLogic.context[0x105 + index] = 0u;
+    blendedLogic.context[0x31c] |= 0x8000u;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(blendedLogic); }, "logic operation together with blending");
     for (const auto groups : {1u, 2u, 15u}) {
         queue.context[0x2d5] = 0x2000u | (groups << 15u);
         state = AgcDriver::Graphics::DecodeState(queue);
@@ -2977,7 +2992,12 @@ void depthCopyPassTests() {
     queue.context[0x31c] = 0x40710;
     queue.context[0x8e] = 1;
     auto pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->depthAddress == 0x100000 && pass->samples == 2 && pass->sample == 0 && pass->extent.width == 64 && pass->extent.height == 4, "a centroid DB depth copy of a two-sample depth plane decoded differently");
+    Require(pass.has_value() && pass->source.address == 0x100000 && pass->source.samples == 2 && pass->sample == 0 && pass->source.extent.width == 64 && pass->source.extent.height == 4, "a centroid DB depth copy of a two-sample depth plane decoded differently");
+    {
+        const auto words = AgcDriver::Graphics::DepthCopySourceWords(pass->source);
+        const auto resource = AgcDriver::Graphics::DecodeTextureResource(words);
+        Require(resource.baseAddress == pass->source.address && resource.dimension == AgcDriver::Graphics::TextureDimension::k2DMsaa && resource.samples == 2 && resource.width == 64 && resource.height == 4 && resource.tileMode == AgcDriver::Graphics::TextureTileMode::kZ64KBX && resource.pipeBankXor == pass->source.pipeBankXor && resource.dccAddress == pass->source.htileAddress, "the DB depth copy source descriptor of a two-sample plane decoded differently");
+    }
     Require(pass->color.format == VK_FORMAT_R32_SFLOAT && pass->color.samples == 1 && pass->color.address == reinterpret_cast<std::uintptr_t>(colorMemory.data()), "the DB depth copy target decoded differently");
     queue.context[0x000] = 0x104;
     Require(DecodeDepthCopyPass(queue)->sample == 1, "COPY_SAMPLE without COPY_CENTROID did not select the sample");
@@ -3002,23 +3022,31 @@ void depthCopyPassTests() {
     expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "single-sample R32 float");
     queue.context[0x31c] = 0x40710;
     queue.context[0x10f] = std::bit_cast<std::uint32_t>(16.0f);
-    expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "over part of the depth surface");
+    Require(DecodeDepthCopyPass(queue).has_value(), "a DB depth copy whose viewport covers part of the depth surface was refused");
     queue.context[0x10f] = std::bit_cast<std::uint32_t>(32.0f);
+    queue.context[0x1e0] = 1u << 30u;
+    expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "blending");
+    queue.context[0x1e0] = 0;
     queue.context[0x010] = 0x80001187;
     expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "mipmapped or partially resident");
     queue.context[0x010] = 0x80000187;
     queue.context[0x012] = 0x00001003;
     pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->depthAddress == 0x100000, "a DB depth copy kept the pipe-bank XOR of a two-sample depth plane in its address");
+    Require(pass.has_value() && pass->source.address == 0x100000 && pass->source.pipeBankXor == 0x300, "a DB depth copy kept the pipe-bank XOR of a two-sample depth plane in its address");
     queue.context[0x012] = 0x00001000;
     queue.context[0x002] = 1u | (1u << 13u);
     pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->depthAddress == 0x100000 + AgcDriver::Graphics::DepthSliceBytes({64, 4}, 4u), "a DB depth copy of slice 1 did not address the slice the depth surface registers");
+    Require(pass.has_value() && pass->source.address == 0x100000 + AgcDriver::Graphics::DepthSliceBytes({64, 4}, 4u), "a DB depth copy of slice 1 did not address the slice the depth surface registers");
     queue.context[0x002] = 0;
     Require(DecodeDepthCopyPass(queue).has_value(), "the restored DB depth copy was refused");
     queue.context[0x010] = 0x80000183;
     pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->samples == 1 && pass->sample == 0, "a centroid DB depth copy of a one-sample depth plane decoded differently");
+    Require(pass.has_value() && pass->source.samples == 1 && pass->sample == 0, "a centroid DB depth copy of a one-sample depth plane decoded differently");
+    {
+        const auto words = AgcDriver::Graphics::DepthCopySourceWords(pass->source);
+        const auto resource = AgcDriver::Graphics::DecodeTextureResource(words);
+        Require(resource.baseAddress == pass->source.address && resource.dimension == AgcDriver::Graphics::TextureDimension::k2D && resource.samples == 1 && resource.width == 64 && resource.height == 4 && resource.dccAddress == 0, "the DB depth copy source descriptor of a one-sample plane decoded differently");
+    }
     queue.context[0x000] = 0x104;
     expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "a sample the depth plane does not have");
 }
@@ -3106,6 +3134,13 @@ void metadataPassTests() {
     auto mipmapped = queue;
     mipmapped.context[0x3b0] |= 1u << 28u;
     expectFailure([&] { DecodeColorMetadataPass(mipmapped); }, "mipmapped DCC");
+    const auto chain = AgcDriver::Graphics::DecodeColorBuffer(mipmapped.context, 0);
+    const auto chainSurface = AgcDriver::Graphics::SurfaceForTarget(chain);
+    Require(chain.dccAddress == 0 && chainSurface.mipCount == 2 && chainSurface.dccAddress == keysAddress, "the surface of a mipmapped DCC color target lost its keys");
+    auto mipmappedArray = mipmapped;
+    mipmappedArray.context[0x3b8] |= 1u;
+    mipmappedArray.context[0x31b] = 1u << 13u;
+    Require(AgcDriver::Graphics::SurfaceForTarget(AgcDriver::Graphics::DecodeColorBuffer(mipmappedArray.context, 0)).dccAddress == 0, "a mipmapped DCC array color target took keys whose layers are not modeled");
     const AgcDriver::Graphics::Context context{};
     const auto texels = [&](std::uint32_t value) {
         for (std::size_t offset = 0; offset < colorMemory.size(); offset += 4) {
@@ -3842,7 +3877,7 @@ void multisampleTests() {
     }
     queue = multisampled();
     queue.context[0x31d] = 0x1000;
-    expectFailure([&] { DecodeState(queue); }, "fewer fragments than samples");
+    expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
     queue.context[0x31d] = 0;
     queue.context[0x293] = 0x10000u;
     Require(DecodeState(queue).samples == 1 && !DecodeState(queue).perSampleShading, "PS_ITER_SAMPLE into a one-sample target did not rasterize sample 0 alone");
@@ -3938,6 +3973,10 @@ void multisampleTests() {
         for (const auto offset : {0x31cu, 0x32bu}) packed.context[offset] = (packed.context[offset] & ~0x41f7cu) | packedInfo;
         expectFailure([&] { DecodeColorMetadataPass(packed); }, std::string("CB resolves of ") + name + " color targets");
     }
+    auto uintSource = rasterizedResolve;
+    for (const auto offset : {0x31cu, 0x32bu}) uintSource.context[offset] = (uintSource.context[offset] & ~0x700u) | (4u << 8u);
+    const auto uintPass = DecodeColorMetadataPass(uintSource);
+    Require(uintPass.has_value() && uintPass->mode == ColorMetadataPass::Mode::Resolve && uintPass->source.has_value() && uintPass->source->packing == ShaderRecompiler::ColorExportPacking::Uint && uintPass->targets.size() == 1, "a CB resolve of an unsigned integer target was refused");
     queue = rasterizedResolve;
     queue.context[0x31c] |= 0x10000000u;
     queue.context[0x325] = 0;
@@ -4231,6 +4270,24 @@ void multisampleDccStateTests() {
         changed.context[0x3b0] |= 1u << 28u;
         expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "multisampled color mips");
     }
+    for (const auto samples : {2u, 4u, 8u}) {
+        AgcDriver::Graphics::ColorTarget target{};
+        target.extent = {64, 64};
+        target.format = VK_FORMAT_R8G8B8A8_UNORM;
+        target.tileMode = AgcDriver::Graphics::ColorTileMode::RenderTarget;
+        target.samples = samples;
+        target.dccAddress = 0x200000u;
+        target.dccPipeAligned = true;
+        target.cmaskAddress = 0x300000u;
+        target.cmaskBytes = AgcDriver::Graphics::CmaskBytes(64, 64);
+        const std::vector<std::byte> dcc(AgcDriver::Graphics::MultisampledDccBytes(target), std::byte{0x00});
+        std::vector<std::byte> cmask(target.cmaskBytes);
+        for (std::size_t index = 0; index < cmask.size(); ++index) cmask[index] = std::byte{static_cast<std::uint8_t>(index * 37u)};
+        const auto clear = AgcDriver::Graphics::MultisampledDccClear(target, dcc, cmask);
+        Require(clear.float32[0] == 0.0f && clear.float32[1] == 0.0f && clear.float32[2] == 0.0f && clear.float32[3] == 0.0f, "a uniform 0000 DCC clear of a multisampled target without CMASK fast clears did not import as 0000");
+        target.cmaskFastClear = true;
+        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::MultisampledDccClear(target, dcc, cmask)); }, "multisampled DCC CMASK compression or register clear");
+    }
 }
 
 void multisampledDepthTests() {
@@ -4320,6 +4377,53 @@ void multisampledDepthTests() {
     queue = truncatedTwoSample();
     queue.context[0x31d] = 0x12000;
     expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
+    const auto oneFragment = [&] {
+        auto queue = singleSampleScan();
+        queue.context[0x2f8] = 0x00210002;
+        queue.context[0x292] = 3;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) queue.context[0x2fe + pixel * 4u] = 0x622ae6ae;
+        queue.context[0x31d] = 0x2000;
+        queue.context[0x201] = 0x112202;
+        return queue;
+    };
+    queue = oneFragment();
+    state = DecodeState(queue);
+    Require(state.samples == 4 && !state.customSampleLocations && state.depth && state.depth->samples == 4 && state.colors.size() == 1 && state.colors[0].samples == 1 && state.truncatedCoverage && !state.mergedCoverage && !state.perSampleShading, "a 4-sample color target with one fragment beside a 4x depth target (PPSA02015's registers) did not keep sample 0's color in its one fragment");
+    Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "the precheck refused a 4-sample color target with one fragment beside a 4x depth target");
+    queue = oneFragment();
+    queue.context[0x31c] |= 0x4000u;
+    queue.context[0x321] = 0x00c3a1b2u;
+    queue.context[0x3a0] = 0x01u;
+    state = DecodeState(queue);
+    Require(state.colors.size() == 1 && state.colors[0].fmaskAddress == ((1ull << 40u) | 0xc3a10000ull), "a compressed one-fragment color target did not decode its FMASK address");
+    queue.context[0x321] = 0u;
+    queue.context[0x3a0] = 0u;
+    expectFailure([&] { DecodeState(queue); }, "a compressed one-fragment color target without an FMASK address is unsupported");
+    queue.context[0x321] = 0xa5u;
+    expectFailure([&] { DecodeState(queue); }, "a compressed one-fragment color target without an FMASK address is unsupported");
+    queue = oneFragment();
+    Require(DecodeState(queue).colors[0].fmaskAddress == 0u, "an uncompressed one-fragment color target noted an FMASK address");
+    queue = oneFragment();
+    queue.context[0x31d] = 0xa000;
+    expectFailure([&] { DecodeState(queue); }, "color targets with more than one but fewer fragments than samples (EQAA) are unsupported");
+    queue = oneFragment();
+    queue.context[0x31d] = 0x8000;
+    expectFailure([&] { DecodeState(queue); }, "color targets with more fragments than samples are unsupported");
+    queue = oneFragment();
+    queue.context[0x201] = 0x012202;
+    expectFailure([&] { DecodeState(queue); }, "a one-fragment color target is supported only with static DB_EQAA anchors at the depth target's sample count");
+    queue = oneFragment();
+    queue.context[0x201] = 0x112201;
+    expectFailure([&] { DecodeState(queue); }, "a one-fragment color target is supported only with static DB_EQAA anchors at the depth target's sample count");
+    queue = oneFragment();
+    queue.context[0x2f8] = 0x00100001;
+    queue.context[0x010] = 0x22900987;
+    for (std::uint32_t pixel = 0; pixel < 4; ++pixel) queue.context[0x2fe + pixel * 4u] = 0xcc44;
+    expectFailure([&] { DecodeState(queue); }, "a one-fragment color target's sample count differs from the rasterizer's");
+    queue = oneFragment();
+    queue.context[0x010] = 0;
+    queue.context[0x011] = 0;
+    expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
     queue = singleSampleScan();
     queue.context[0x010] = 0x22900983;
     expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
@@ -4574,6 +4678,72 @@ void DepthRemapTests() {
     Require(floating.depthRemap.mode == 1 && floating.viewport.minDepth == 0 && floating.viewport.maxDepth == 1 && floating.depthClamp, "a written float depth target refused clipped clamp bounds");
 }
 
+void DepthBoundsEmulationTests() {
+    auto queue = makeState();
+    queue.context[0x204] = 0;
+    queue.context[0x113] = std::bit_cast<std::uint32_t>(0.5f);
+    queue.context[0x114] = std::bit_cast<std::uint32_t>(0.5f);
+    auto base = AgcDriver::Graphics::DecodeState(queue);
+    base.depth = AgcDriver::Graphics::DepthTarget{0x10000, 0, {64, 64}, VK_FORMAT_D32_SFLOAT_S8_UINT, 0.0f, 0};
+    base.depthTest = base.depthWrite = base.stencilTest = false;
+    base.depthBoundsTest = true;
+    base.depthBias = true;
+    base.depthBiasConstant = 4.0f;
+    const ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    const AgcDriver::Graphics::Context emulating{};
+    const auto emulated = [&](float minBound, float maxBound) {
+        auto state = base;
+        state.minDepthBounds = minBound;
+        state.maxDepthBounds = maxBound;
+        AgcDriver::Graphics::ApplyDepthBoundsEmulation(emulating, state, pixel);
+        Require(!state.depthBoundsTest && state.depthTest && !state.depthWrite && !state.depthBias && state.viewport.x == base.viewport.x && state.viewport.width == base.viewport.width && state.viewport.height == base.viewport.height, "an emulated depth bounds test did not become a read-only depth test over the same coverage");
+        return state;
+    };
+    const auto upper = emulated(0.0f, 0.000125f);
+    Require(upper.depthCompare == VK_COMPARE_OP_GREATER_OR_EQUAL && upper.viewport.minDepth == 0.000125f && upper.viewport.maxDepth == 0.000125f, "an upper depth bound was not tested as the bound at or above the stored depth");
+    const auto lower = emulated(0.000125f, 1.0f);
+    Require(lower.depthCompare == VK_COMPARE_OP_LESS_OR_EQUAL && lower.viewport.minDepth == 0.000125f && lower.viewport.maxDepth == 0.000125f, "a lower depth bound was not tested as the bound at or below the stored depth");
+    const auto whole = emulated(0.0f, 1.0f);
+    Require(whole.depthCompare == VK_COMPARE_OP_GREATER_OR_EQUAL && whole.viewport.minDepth == 1.0f && whole.viewport.maxDepth == 1.0f, "bounds covering [0, 1] were not tested against the upper bound");
+    AgcDriver::Graphics::Context native{};
+    native.depthBounds = true;
+    auto kept = base;
+    AgcDriver::Graphics::ApplyDepthBoundsEmulation(native, kept, pixel);
+    Require(kept.depthBoundsTest && !kept.depthTest && kept.depthBias && kept.viewport.minDepth == base.viewport.minDepth, "a device with the depth bounds test had it emulated");
+    auto absent = base;
+    absent.depth.reset();
+    AgcDriver::Graphics::ApplyDepthBoundsEmulation(emulating, absent, pixel);
+    Require(absent.depthBoundsTest && !absent.depthTest, "a draw without a depth target had its depth bounds emulated");
+    const auto refuses = [&](const char* expected, auto change) {
+        auto state = base;
+        state.minDepthBounds = 0.0f;
+        state.maxDepthBounds = 0.5f;
+        auto context = emulating;
+        auto program = pixel;
+        change(state, context, program);
+        expectFailure([&] { AgcDriver::Graphics::ApplyDepthBoundsEmulation(context, state, program); }, expected);
+    };
+    refuses("both bounds inside", [](auto& state, auto&, auto&) { state.minDepthBounds = 0.25f; });
+    refuses("with depth testing", [](auto& state, auto&, auto&) { state.depthTest = true; });
+    refuses("reads or exports depth", [](auto&, auto&, auto& program) { program.posZ = true; });
+    refuses("reads or exports depth", [](auto&, auto&, auto& program) { program.depthExportEnable = true; });
+    refuses("normalized depth target", [](auto& state, auto&, auto&) { state.depth->format = VK_FORMAT_D16_UNORM; });
+    refuses("stays in [0, 1]", [](auto&, auto& context, auto&) { context.depthRangeUnrestricted = true; });
+    refuses("depth bounds outside [0, 1]", [](auto& state, auto&, auto&) { state.maxDepthBounds = 1.5f; });
+    refuses("writes on a failed test", [](auto& state, auto&, auto&) {
+        state.stencilTest = true;
+        state.stencilFront.writeMask = 0xffu;
+        state.stencilFront.failOp = VK_STENCIL_OP_REPLACE;
+    });
+    auto stencil = base;
+    stencil.stencilTest = true;
+    stencil.stencilFront.writeMask = stencil.stencilBack.writeMask = 0xffu;
+    stencil.stencilFront.passOp = stencil.stencilBack.passOp = VK_STENCIL_OP_REPLACE;
+    stencil.maxDepthBounds = 0.5f;
+    AgcDriver::Graphics::ApplyDepthBoundsEmulation(emulating, stencil, pixel);
+    Require(stencil.depthTest && stencil.stencilTest, "a stencil test that writes only on a pass refused the depth bounds emulation");
+}
+
 void UnusedViewportDepthTests() {
     auto queue = makeState();
     queue.context[0x204] = 0;
@@ -5886,6 +6056,7 @@ void descriptorPoolResetFailureTest() {
     });
     cache.Free(allocation);
     _ZSt13set_terminatePFvvE_nid_postfix(previous);
+
 }
 
 void pushConstantTests() {
@@ -6896,8 +7067,37 @@ void sampledTextureBudgetTests() {
     Require(SampledTextureBudget(memory, &reported, 5 * GiB) == 5 * GiB + 128 * MiB, "a 15 GiB budget with 4 GiB used outside the texture caches does not leave 5 GiB 128 MiB after the 4 GiB storage cache and 1 GiB 896 MiB of headroom");
     reported.heapUsage[2] = 3 * GiB;
     Require(SampledTextureBudget(memory, &reported, 5 * GiB) == 9 * GiB + 128 * MiB, "usage below the cached bytes is not read as no other device memory in use");
+    reported.heapUsage[2] = 9 * GiB;
+    Require(SampledTextureBudget(memory, &reported, 5 * GiB, 4 * GiB + 512 * MiB) == 4 * GiB + 640 * MiB, "a storage image cache larger than TextureCacheBudget was not reserved in full");
+    Require(SampledTextureBudget(memory, &reported, 5 * GiB, 1 * GiB) == 5 * GiB + 128 * MiB, "a storage image cache smaller than TextureCacheBudget did not keep the TextureCacheBudget reservation");
     reported.heapUsage[2] = 12 * GiB;
     Require(SampledTextureBudget(memory, &reported, 1 * GiB) == 2 * GiB, "a heap whose other users leave no room does not keep the 2 GiB floor");
+    {
+        using AgcDriver::Graphics::StorageTextureBudget;
+        auto small = memory;
+        small.memoryHeaps[2].size = 8 * GiB;
+        VkPhysicalDeviceMemoryBudgetPropertiesEXT example{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
+        example.heapBudget[2] = 7373 * MiB;
+        example.heapUsage[2] = 2 * GiB + 3686 * MiB;
+        Require(SampledTextureBudget(small, &example, 3686 * MiB, 3686 * MiB) == 2 * GiB, "3686 MiB of storage images on an 8 GiB heap with a 7373 MiB budget and 2 GiB of other use left the sampled cache above its floor");
+        for (const auto heapGiB : {8u, 16u}) {
+            small.memoryHeaps[2].size = heapGiB * GiB;
+            for (std::uint64_t budget = 4 * GiB; budget <= heapGiB * GiB; budget += GiB) {
+                example.heapBudget[2] = budget;
+                for (std::uint64_t other = 0; other <= budget; other += GiB) {
+                    for (std::uint64_t sampled = 0; sampled <= 4 * GiB; sampled += 512 * MiB) {
+                        for (std::uint64_t storage = 0; storage <= heapGiB * GiB / 2u; storage += 512 * MiB) {
+                            example.heapUsage[2] = other + sampled + storage;
+                            const auto sampledLimit = SampledTextureBudget(small, &example, sampled + storage, storage);
+                            const auto storageLimit = StorageTextureBudget(small, &example, sampled, storage);
+                            if (sampledLimit > 2 * GiB) Require(other + storage + sampledLimit + budget / 8u <= budget, "the sampled cache budget and the storage images held exceed the reported budget less its eighth");
+                            if (storageLimit > 512 * MiB) Require(other + sampled + storageLimit + budget / 8u <= budget, "the storage cache budget and the sampled textures held exceed the reported budget less its eighth");
+                        }
+                    }
+                }
+            }
+        }
+    }
     memory.memoryHeaps[0].flags = 0;
     memory.memoryHeaps[2].flags = 0;
     Require(SampledTextureBudget(memory, &reported, 0) == 2 * GiB, "a device without a device-local heap does not keep 2 GiB of sampled textures");
@@ -6918,29 +7118,29 @@ void storageTextureBudgetTests() {
     reported.heapBudget[1] = 100 * GiB;
     Require(StorageTextureBudget(memory, &reported, 0, 0) == 4 * GiB, "a zero budget for the largest device-local heap did not fall back to a quarter of the heap");
     reported.heapBudget[2] = 10 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 0, 0) == 2560 * MiB, "a 10 GiB budget on the 16 GiB heap does not limit the storage image cache to a quarter of the budget");
+    Require(StorageTextureBudget(memory, &reported, 0, 0) == 5 * GiB, "a 10 GiB budget on the 16 GiB heap does not limit the storage image cache to half of the budget");
     reported.heapUsage[2] = 5 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2560 * MiB, "2 GiB used outside the texture caches on a 10 GiB budget lowered the storage image cache below its quarter");
+    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 5 * GiB, "2 GiB used outside the texture caches on a 10 GiB budget lowered the storage image cache below its half");
     reported.heapUsage[2] = 8 * GiB + 512 * MiB;
     Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2304 * MiB, "a 10 GiB budget with 5632 MiB used outside the texture caches does not leave 2304 MiB after 1 GiB of sampled textures and 1280 MiB of headroom");
     reported.heapUsage[2] = 9 * GiB;
     Require(StorageTextureBudget(memory, &reported, 3 * GiB, 2 * GiB) == 1792 * MiB, "3 GiB of sampled textures were not reserved in full");
     reported.heapUsage[2] = 1 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2560 * MiB, "usage below the cached bytes is not read as no other device memory in use");
+    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 5 * GiB, "usage below the cached bytes is not read as no other device memory in use");
     Require(StorageTextureBudget(memory, &reported, 7 * GiB, 1 * GiB) == 1792 * MiB, "7 GiB of sampled textures with the usage below the cached bytes do not leave 1792 MiB after their reservation and 1280 MiB of headroom");
     reported.heapUsage[2] = 9 * GiB + 512 * MiB;
     Require(StorageTextureBudget(memory, &reported, 2 * GiB, 512 * MiB) == 512 * MiB, "a heap whose other users leave no room does not keep the 512 MiB floor");
     reported.heapUsage[2] = 0;
     reported.heapBudget[2] = 6 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 0, 0) == 1536 * MiB, "a 6 GiB budget on the 16 GiB heap does not limit the storage image cache to a quarter of the budget");
+    Require(StorageTextureBudget(memory, &reported, 0, 0) == 3 * GiB, "a 6 GiB budget on the 16 GiB heap does not limit the storage image cache to half of the budget");
     reported.heapBudget[2] = 1 * GiB;
     Require(StorageTextureBudget(memory, &reported, 0, 0) == 512 * MiB, "a 1 GiB budget does not keep the 512 MiB floor");
     reported.heapBudget[2] = 40 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 0, 0) == 4 * GiB, "a budget above the heap size raised the storage image cache past a quarter of the heap");
+    Require(StorageTextureBudget(memory, &reported, 0, 0) == 8 * GiB, "a budget above the heap size raised the storage image cache past half of the heap");
     memory.memoryHeaps[2].size = 8 * GiB;
     reported.heapBudget[2] = 7189 * MiB;
     reported.heapUsage[2] = 4491 * MiB;
-    Require(StorageTextureBudget(memory, &reported, 49 * MiB, 506 * MiB) == 7189 * MiB / 4u, "49 MiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches held the storage image cache below a quarter of the budget");
+    Require(StorageTextureBudget(memory, &reported, 49 * MiB, 506 * MiB) == 7189 * MiB - 3936 * MiB - 49 * MiB - 7189 * MiB / 8u, "49 MiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches did not leave the storage image cache what the budget has left after them and its eighth");
     reported.heapUsage[2] = 6490 * MiB;
     Require(StorageTextureBudget(memory, &reported, 2 * GiB, 506 * MiB) == 512 * MiB, "2 GiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches did not take the storage image cache back to its 512 MiB floor");
     memory.memoryHeaps[2].size = 10 * GiB;
@@ -6957,8 +7157,8 @@ void storageTextureBudgetTests() {
                     reported.heapUsage[2] = outside + sampled + 512 * MiB;
                     const auto limit = StorageTextureBudget(memory, &reported, sampled, 512 * MiB);
                     Require(limit >= 512 * MiB, "pressure sweep lost the storage cache floor");
-                    Require(limit <= std::max<std::uint64_t>(512 * MiB, budget / 4u), "pressure sweep exceeded a quarter of the reported budget above the floor");
-                    Require(limit <= std::max<std::uint64_t>(2 * GiB, heapGiB * GiB / 4u), "pressure sweep exceeded the heap storage cache cap");
+                    Require(limit <= std::max<std::uint64_t>(512 * MiB, budget / 2u), "pressure sweep exceeded half of the reported budget above the floor");
+                    Require(limit <= std::max<std::uint64_t>(512 * MiB, heapGiB * GiB / 2u), "pressure sweep exceeded half of the heap");
                     if (outside != 0) Require(limit <= previous, "additional non-cache memory usage grew the storage cache budget");
                     if (limit > 512 * MiB) Require(outside + sampled + budget / 8u + limit <= budget, "storage cache budget consumed live sampled memory or pressure headroom");
                     previous = limit;
@@ -6969,6 +7169,27 @@ void storageTextureBudgetTests() {
     memory.memoryHeaps[0].flags = 0;
     memory.memoryHeaps[2].flags = 0;
     Require(StorageTextureBudget(memory, &reported, 0, 0) == 2 * GiB, "a device without a device-local heap does not keep 2 GiB of storage images");
+    using AgcDriver::Graphics::StorageTextureCeiling;
+    memory.memoryHeaps[0] = {256 * MiB, VK_MEMORY_HEAP_DEVICE_LOCAL_BIT};
+    memory.memoryHeaps[2] = {16 * GiB, VK_MEMORY_HEAP_DEVICE_LOCAL_BIT};
+    reported = {VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
+    Require(StorageTextureCeiling(memory, nullptr) == 4 * GiB, "without VK_EXT_memory_budget the storage image cache ceiling is not a quarter of the 16 GiB heap");
+    reported.heapBudget[2] = 6 * GiB;
+    Require(StorageTextureCeiling(memory, &reported) == 3 * GiB, "the storage image cache ceiling on a 6 GiB budget is not half of the budget, the cap the cache may reach");
+    reported.heapBudget[2] = 40 * GiB;
+    Require(StorageTextureCeiling(memory, &reported) == 8 * GiB, "the storage image cache ceiling on a 40 GiB budget is not half of the 16 GiB heap");
+    reported.heapBudget[2] = 768 * MiB;
+    Require(StorageTextureCeiling(memory, &reported) == 512 * MiB, "the storage image cache ceiling on a 768 MiB budget does not keep the 512 MiB floor");
+    for (std::uint64_t budget = 1 * GiB; budget <= 24 * GiB; budget += 512 * MiB) {
+        reported.heapBudget[2] = budget;
+        const auto ceiling = StorageTextureCeiling(memory, &reported);
+        for (std::uint64_t used = 0; used <= budget; used += 256 * MiB) {
+            reported.heapUsage[2] = used;
+            Require(StorageTextureBudget(memory, &reported, 256 * MiB, 512 * MiB) <= ceiling, "the storage image cache budget exceeds the ceiling idle device buffers are reclaimed up to");
+        }
+        reported.heapUsage[2] = 0;
+        Require(StorageTextureBudget(memory, &reported, 0, 0) == ceiling, "an idle heap does not give the storage image cache its full ceiling");
+    }
 }
 
 void sampledBudgetReportTests() {
@@ -7015,6 +7236,41 @@ void misalignedShaderDataTests() {
     Require(mock.live == 0, "misaligned shader data resources leaked Vulkan objects");
 }
 
+void imageTableTemplateRefreshTests() {
+    namespace Abi = ShaderRecompiler::ImageTableAbi;
+    mock = MockVulkan{};
+    auto context = mockContext();
+    context.imageTableCapacity = 2;
+    context.limits.maxDescriptorSetSampledImages = 2;
+    context.limits.maxPerStageDescriptorSampledImages = 2;
+    const auto commands = reinterpret_cast<VkCommandBuffer>(std::uintptr_t{1});
+    {
+        ShaderRecompiler::RecompileResult compute;
+        auto map = makeBinding(Role::ImageTableMap, static_cast<std::uint32_t>(ShaderRecompiler::RuntimeAbi::Binding::ImageTableMap), 1, std::vector<std::uint32_t>(Abi::HeaderWords));
+        map.guestDescriptor[Abi::HeaderVersion] = Abi::Version;
+        map.guestDescriptor[Abi::HeaderElementFaults] = Abi::HeaderWords;
+        map.guestDescriptor[Abi::HeaderSamplerFaults] = Abi::HeaderWords;
+        compute.bindings.push_back(map);
+        auto images = makeBinding(Role::ImageTable, ShaderRecompiler::RuntimeAbi::ImageTableBinding, 0, {});
+        images.kind = Kind::SampledImage;
+        compute.bindings.push_back(images);
+        compute.bindings.push_back(makeBinding(Role::ShaderData, 1, 1, ShaderDataWords({0x11, 0x22})));
+        compute.shaderDataDwords = ShaderRecompiler::RuntimeAbi::ShaderDataDwords;
+        auto live = compute;
+        live.bindings[2].guestDescriptor = ShaderDataWords({0x33, 0x44});
+        const AgcDriver::Graphics::CompiledShader shader{ShaderRecompiler::ShaderStage::Compute, &compute, 0};
+        const AgcDriver::Graphics::CompiledShader liveShader{ShaderRecompiler::ShaderStage::Compute, &live, 0};
+        AgcDriver::Graphics::ShaderResources resources(context, shader);
+        const auto data = findWrite(1).buffers.at(0).buffer;
+        Require(!resources.DataWordsDiffer(shader), "a template's own words differ from the shader that built it");
+        Require(resources.DataWordsDiffer(liveShader), "a template with an image table missed the dispatch's new words");
+        Require(resources.RefreshData(commands, liveShader), "a refresh of a template with an image table recorded nothing");
+        Require(sameBytes(bufferBytes(data), live.bindings[2].guestDescriptor.data(), 3u * sizeof(std::uint32_t)), "a refresh of a template with an image table did not write the dispatch's words");
+        Require(!resources.DataWordsDiffer(liveShader), "the refreshed template's words are not the dispatch's");
+    }
+    Require(mock.live == 0, "image table template refresh resources leaked Vulkan objects");
+}
+
 struct ModuleShape {
     bool fragment = false;
     std::optional<std::uint32_t> fragmentMode;
@@ -7953,6 +8209,38 @@ void pipelineLibraryClearWaitsForBuildTests() {
     Require(mock.live == 0, "clearing during a library build leaked Vulkan objects");
 }
 
+void tessellationPipelineLibraryCacheTests() {
+    using namespace AgcDriver::Graphics;
+    for (const auto shared : {true, false}) {
+        mock = MockVulkan{};
+        auto context = mockContext();
+        context.graphicsPipelineLibrary = true;
+        context.tessellationShader = true;
+        context.tessellationPipelineCache = shared;
+        context.limits.maxTessellationPatchSize = 32;
+        context.limits.maxPushConstantsSize = 256;
+        context.limits.framebufferNoAttachmentsSampleCounts = VK_SAMPLE_COUNT_1_BIT;
+        State state{};
+        state.stages.path = ShaderPath::Tessellation;
+        state.stages.tessellation = ShaderRecompiler::TessellationConfiguration{3, 3, 2, 1, 4, 128, 16, false};
+        ShaderRecompiler::RecompileResult vertex, control, evaluation, fragment;
+        vertex.spirv = makeModule({});
+        control.spirv = makeModule({});
+        evaluation.spirv = makeModule({});
+        fragment.spirv = makeModule({.fragment = true});
+        vertex.variantId = 201;
+        control.variantId = 202;
+        evaluation.variantId = 203;
+        fragment.variantId = 204;
+        const std::array<CompiledShader, 4> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::TessellationControl, &control, 0}, {ShaderRecompiler::ShaderStage::TessellationEvaluation, &evaluation, 0}, {ShaderRecompiler::ShaderStage::Fragment, &fragment, PipelinePushSlotBytes}}};
+        std::array<std::uint32_t, 1> mainKey{31};
+        const PipelineSetLayouts resources{makeHandle<VkDescriptorSetLayout>(), VK_NULL_HANDLE, false, mainKey, {}};
+        Require(Pipeline::Prebuild(context, state, VertexInputLayout{}, resources, shaders) == shared, shared ? "tessellation pipelines skipped graphics pipeline libraries with a shared pipeline cache" : "tessellation pipelines without the pipeline cache were built from graphics pipeline libraries");
+        ClearPipelineLibraries(context.device);
+        Require(mock.live == 0, "tessellation pipeline library tests leaked Vulkan objects");
+    }
+}
+
 void framebufferOwnerTests() {
     using namespace AgcDriver::Graphics;
     mock = MockVulkan{};
@@ -8691,6 +8979,24 @@ std::string interlockShape(std::span<const std::uint32_t> words) {
     return shape;
 }
 
+bool coherentImageRead(std::span<const std::uint32_t> words) {
+    std::map<std::uint32_t, std::uint32_t> sources;
+    std::set<std::uint32_t> coherent;
+    std::uint32_t image = 0;
+    for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+        const auto op = static_cast<spv::Op>(words[at] & 0xffffu);
+        if (op == spv::OpDecorate && words[at + 2] == spv::DecorationCoherent) coherent.insert(words[at + 1]);
+        if (op == spv::OpLoad || op == spv::OpAccessChain || op == spv::OpInBoundsAccessChain) sources[words[at + 2]] = words[at + 3];
+        if (op == spv::OpImageRead) image = words[at + 3];
+    }
+    for (std::size_t step = 0; image != 0 && step < 8u; ++step) {
+        if (coherent.contains(image)) return true;
+        const auto source = sources.find(image);
+        image = source == sources.end() ? 0u : source->second;
+    }
+    return false;
+}
+
 std::string interlockExits(std::span<const std::uint32_t> words, std::size_t& kills, std::size_t& terminates) {
     struct Block {
         std::vector<spv::Op> ops;
@@ -8933,7 +9239,7 @@ void stencilRefExportTests() {
             Require(AgcDriver::Graphics::DrawRejection(unused, false).empty(), "the precheck rejected STENCIL_OP_VAL_EXPORT_ENABLE without a stencil test in DB_SHADER_CONTROL " + std::to_string(shaderControl));
             Require(AgcDriver::Graphics::DecodePixelStageInfo(unused.context, IdentityExports).stencilRefExportEnable == ((shaderControl & 2u) != 0), "STENCIL_OP_VAL_EXPORT_ENABLE without a stencil test exported the stencil reference");
             const bool replaces = (shaderControl & 6u) == 4u;
-            for (const auto [ops, writeMask, compare, accepted] : {std::tuple{0x000u, 0xffu, 7u, true}, std::tuple{0x737u, 0xffu, 7u, true}, std::tuple{0x110u, 0xffu, 7u, true}, std::tuple{0x050u, 0x00u, 7u, true}, std::tuple{0x040u, 0xffu, 7u, replaces}, std::tuple{0x40040u, 0xffu, 7u, replaces}, std::tuple{0x404u, 0x0fu, 0u, replaces}, std::tuple{0x040u, 0xffu, 2u, false}, std::tuple{0x340u, 0xffu, 7u, false}, std::tuple{0x042u, 0xffu, 7u, false}, std::tuple{0x050u, 0xffu, 7u, false}, std::tuple{0x600u, 0xffu, 7u, false}, std::tuple{0x008u, 0xffu, 7u, false}, std::tuple{0x900u, 0xffu, 7u, false}, std::tuple{0x5000u, 0xffu, 7u, false}}) {
+            for (const auto [ops, writeMask, compare, accepted] : {std::tuple{0x000u, 0xffu, 7u, true}, std::tuple{0x737u, 0xffu, 7u, true}, std::tuple{0x110u, 0xffu, 7u, true}, std::tuple{0x050u, 0x00u, 7u, true}, std::tuple{0x040u, 0xffu, 7u, replaces}, std::tuple{0x40040u, 0xffu, 7u, replaces}, std::tuple{0x404u, 0x0fu, 0u, replaces}, std::tuple{0x040u, 0xffu, 2u, false}, std::tuple{0x340u, 0xffu, 7u, false}, std::tuple{0x042u, 0xffu, 7u, false}, std::tuple{0x050u, 0xffu, 7u, false}, std::tuple{0x600u, 0xffu, 7u, false}, std::tuple{0x008u, 0xffu, 7u, false}, std::tuple{0x900u, 0xffu, 7u, false}, std::tuple{0x5000u, 0xffu, 7u, false}, std::tuple{0x0c0u, 0xffu, 7u, false}, std::tuple{0x00bu, 0xffu, 7u, false}}) {
                 auto stenciled = stencilRefExportQueue(shaderControl, zFormat);
                 for (const auto [offset, word] : {std::pair{0x010u, 0x80000180u}, std::pair{0x011u, 0x20000181u}, std::pair{0x012u, 0x00001000u}, std::pair{0x013u, 0x00002000u}, std::pair{0x015u, 0x00002000u}, std::pair{0x007u, 0x003f003fu}, std::pair{0x000u, 0u}, std::pair{0x002u, 0u}, std::pair{0x00au, 0u}, std::pair{0x00bu, 0x3f800000u}, std::pair{0x200u, 0x007007b3u}}) stenciled.context[offset] = word;
                 stenciled.context[0x10b] = ops;
@@ -9243,6 +9549,99 @@ void stencilReferenceUnusedTests() {
     std::cout << "Unused stencil reference sample equivalence passed: " << accepted << " accepted states, " << countermodels << " dependent countermodels\n";
 }
 
+void stencilLogicOperationTests() {
+    const auto queueFor = [](std::uint32_t ops, std::uint32_t front, std::uint32_t back, std::uint32_t depthControl) {
+        auto queue = makeState();
+        for (const auto [offset, word] : {std::pair{0x000u, 0u}, std::pair{0x002u, 0u}, std::pair{0x007u, (1u << 16u) | 3u}, std::pair{0x00au, 0u}, std::pair{0x00bu, 0u}, std::pair{0x010u, 0x22900983u}, std::pair{0x011u, 0x20000181u}, std::pair{0x012u, 0x100u}, std::pair{0x014u, 0x100u}, std::pair{0x013u, 0x200u}, std::pair{0x015u, 0x200u}, std::pair{0x005u, 0x300u}, std::pair{0x01eu, 0x1u}}) queue.context[offset] = word;
+        queue.context[0x10b] = ops;
+        queue.context[0x10c] = front;
+        queue.context[0x10d] = back;
+        queue.context[0x200] = depthControl;
+        return queue;
+    };
+    const auto refMaskOf = [](std::uint32_t test, std::uint32_t writeMask, std::uint32_t value) { return test | 0xff00u | (writeMask << 16u) | (value << 24u); };
+    const auto apply = [](std::uint32_t op, std::uint32_t stencil, std::uint32_t value) {
+        switch (op) {
+            case 1: return 0u;
+            case 10: return stencil & value;
+            case 11: return stencil | value;
+            case 12: return stencil ^ value;
+            case 15: return ~(stencil ^ value);
+            default: return stencil;
+        }
+    };
+    const auto matches = [&](const AgcDriver::Graphics::State& state, const VkStencilOpState& face, std::uint32_t ops, std::uint32_t compare, std::uint32_t refMask, const std::string& name) {
+        const auto test = refMask & 0xffu;
+        const auto compareMask = (refMask >> 8u) & 0xffu;
+        const auto writeMask = (refMask >> 16u) & 0xffu;
+        const auto value = refMask >> 24u;
+        for (std::uint32_t stencil = 0; stencil < 256u; ++stencil) {
+            for (const bool depthPass : {false, true}) {
+                const bool stencilPass = stencilComparison(static_cast<VkCompareOp>(compare), test & compareMask, stencil & compareMask);
+                const auto op = (ops >> (!stencilPass ? 0u : !depthPass ? 8u : 4u)) & 0xfu;
+                const auto expected = ((stencil & ~writeMask) | (apply(op, stencil, value) & writeMask)) & 0xffu;
+                const auto [actual, passed] = stencilReferenceOutcome(state, face, face.reference, stencil, depthPass, true);
+                Require(actual == expected && passed == (stencilPass && depthPass), name + ": stencil " + std::to_string(stencil) + (depthPass ? " passing" : " failing") + " the depth test became " + std::to_string(actual) + ", expected " + std::to_string(expected));
+            }
+        }
+    };
+    std::size_t accepted = 0;
+    for (const auto op : {10u, 11u, 12u, 15u}) {
+        for (const auto placement : {0x010u, 0x001u, 0x100u, 0x111u}) {
+            for (const auto compare : {7u, 0u, 2u, 3u}) {
+                for (const auto [test, writeMask, value] : {std::tuple{0x00u, 0xffu, 0x5au}, std::tuple{0xa5u, 0xffu, 0x21u}, std::tuple{0xa5u, 0x3cu, 0xffu}, std::tuple{0xffu, 0xf0u, 0x0fu}, std::tuple{0x5au, 0x81u, 0x00u}}) {
+                    const auto ops = op * placement;
+                    const auto refMask = refMaskOf(test, writeMask, value);
+                    const auto queue = queueFor(ops, refMask, refMask, 0x13u | (compare << 8u));
+                    const auto name = "stencil operation " + std::to_string(op) + " in DB_STENCIL_CONTROL " + std::to_string(ops) + " with compare " + std::to_string(compare) + " and DB_STENCILREFMASK " + std::to_string(refMask);
+                    const auto bits = (op == 11u || op == 12u ? value : ~value) & writeMask;
+                    if (op == 11u && compare != 0u && compare != 7u && (~test & bits) != 0u) {
+                        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::DecodeState(queue)); }, "stencil OR of");
+                        continue;
+                    }
+                    const auto state = AgcDriver::Graphics::DecodeState(queue);
+                    Require(state.stencilTest && state.depthTest && (state.stencilFront.writeMask & 0xffu) == (bits != 0u ? bits : writeMask), "the write mask is not narrowed to the bits changed by " + name);
+                    matches(state, state.stencilFront, ops, compare, refMask, name);
+                    ++accepted;
+                }
+            }
+        }
+    }
+    for (const auto [ops, refMask, name] : {std::tuple{0x0c1u, refMaskOf(0x80u, 0xffu, 0xffu), "XOR of every written bit beside ZERO"}, std::tuple{0x0cbu, refMaskOf(0x8fu, 0xffu, 0x0fu), "OR and XOR of the same bits"}, std::tuple{0x0fau, refMaskOf(0x80u, 0xffu, 0xf0u), "AND and XNOR of the same bits"}, std::tuple{0xb0bu, refMaskOf(0x30u, 0x3cu, 0xf0u), "OR on stencil fail and depth fail"}}) {
+        const auto queue = queueFor(ops, refMask, refMask, 0x13u | (3u << 8u));
+        const auto state = AgcDriver::Graphics::DecodeState(queue);
+        matches(state, state.stencilFront, ops, 3u, refMask, name);
+        ++accepted;
+    }
+    {
+        const auto front = refMaskOf(0x11u, 0xffu, 0x0fu);
+        const auto back = refMaskOf(0x22u, 0x3cu, 0x30u);
+        const auto queue = queueFor(0x0c0u | (0x0a0u << 12u), front, back, 0x93u | (7u << 8u) | (5u << 20u));
+        const auto state = AgcDriver::Graphics::DecodeState(queue);
+        Require(state.stencilFront.passOp == VK_STENCIL_OP_INVERT && state.stencilFront.writeMask == 0x0fu && state.stencilBack.passOp == VK_STENCIL_OP_ZERO && state.stencilBack.writeMask == 0x0cu, "front XOR and back AND did not keep their own write masks");
+        matches(state, state.stencilFront, 0x0c0u, 7u, front, "front XOR beside a back AND");
+        matches(state, state.stencilBack, 0x0a0u, 5u, back, "back AND beside a front XOR");
+        accepted += 2;
+    }
+    for (const auto [ops, refMask, reason] : {std::tuple{0x0d0u, refMaskOf(0u, 0xffu, 0x0fu), "stencil operation 13 is unsupported"}, std::tuple{0x0e0u, refMaskOf(0u, 0xffu, 0x0fu), "stencil operation 14 is unsupported"}, std::tuple{0x0cau, refMaskOf(0u, 0xffu, 0x0fu), "stencil logic operations on write masks"}, std::tuple{0x0fcu, refMaskOf(0u, 0xffu, 0x0fu), "stencil logic operations on write masks"},std::tuple{0x0c1u, refMaskOf(0u, 0xffu, 0x0fu), "combine a logic operation"}, std::tuple{0x5c0u, refMaskOf(0u, 0xffu, 0x01u), "combine a logic operation"}}) {
+        const auto queue = queueFor(ops, refMask, refMask, 0x13u | (7u << 8u));
+        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::DecodeState(queue)); }, reason);
+    }
+    for (const auto ops : {0x0c0u, 0x0b0u}) {
+        auto exported = stencilRefExportQueue(0x12u, 9u);
+        for (const auto [offset, word] : {std::pair{0x010u, 0x80000180u}, std::pair{0x011u, 0x20000181u}, std::pair{0x012u, 0x00001000u}, std::pair{0x013u, 0x00002000u}, std::pair{0x015u, 0x00002000u}, std::pair{0x007u, 0x003f003fu}, std::pair{0x000u, 0u}, std::pair{0x002u, 0u}, std::pair{0x00au, 0u}, std::pair{0x00bu, 0x3f800000u}, std::pair{0x200u, 0x007007b3u}}) exported.context[offset] = word;
+        exported.context[0x10b] = ops;
+        exported.context[0x10c] = exported.context[0x10d] = refMaskOf(0u, 0xffu, 0x0fu);
+        if (ops == 0x0c0u) {
+            const auto state = AgcDriver::Graphics::DecodeState(exported);
+            Require(state.stencilFront.passOp == VK_STENCIL_OP_INVERT && state.stencilFront.writeMask == 0x0fu, "a stencil test value export changed a stencil XOR");
+        } else {
+            expectFailure([&] { static_cast<void>(AgcDriver::Graphics::DecodeState(exported)); }, "stencil OR is unsupported with a pixel shader that exports the stencil test value");
+        }
+    }
+    std::cout << "Stencil logic operations matched AND, OR, XOR and XNOR under the write mask for " << accepted << " register states\n";
+}
+
 std::set<std::string> bufferViews(std::span<const std::uint32_t> words) {
     std::set<std::string> views;
     for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
@@ -9354,7 +9753,7 @@ void ProvokingVertexTests() {
     ValidateProvokingVertex(unsupported, first);
     auto last = first;
     last.provokingVertexMode = VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT;
-    expectFailure([&] { ValidateProvokingVertex(unsupported, last); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+    ValidateProvokingVertex(unsupported, last);
     auto supported = unsupported;
     supported.provokingVertexLast = true;
     ValidateProvokingVertex(supported, last);
@@ -9477,6 +9876,105 @@ void ProvokingVertexTests() {
     expectFailure([&] { ValidateProvokingVertex(supported, last); }, "invalid provoking vertex mode");
 }
 
+void UnobservedProvokingVertexTests() {
+    using namespace AgcDriver::Graphics;
+    auto last = DecodeState(makeState());
+    last.provokingVertexMode = VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT;
+    const Context unsupported{};
+    const auto module = [](std::initializer_list<std::uint32_t> instructions) {
+        std::vector<std::uint32_t> words{spv::MagicNumber, 0x10300u, 0u, 4u, 0u};
+        words.insert(words.end(), instructions);
+        return words;
+    };
+    ShaderRecompiler::RecompileResult fragment{};
+    const std::array<CompiledShader, 1> shaders{{{ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}}};
+    const ShaderRecompiler::FragmentParameter smooth{0, 0, false, false};
+    const auto refused = [&](const State& state) {
+        expectFailure([&] { ValidateProvokingVertex(unsupported, state, shaders); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+    };
+    for (const auto topology : {VK_PRIMITIVE_TOPOLOGY_POINT_LIST, VK_PRIMITIVE_TOPOLOGY_LINE_LIST, VK_PRIMITIVE_TOPOLOGY_LINE_STRIP, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN}) {
+        auto state = last;
+        state.topology = topology;
+        ValidateProvokingVertex(unsupported, state);
+        fragment.fragmentParameters.clear();
+        fragment.spirv = module({});
+        ValidateProvokingVertex(unsupported, state, shaders);
+        fragment.fragmentParameters = {smooth};
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationLocation, 0u});
+        ValidateProvokingVertex(unsupported, state, shaders);
+        for (std::uint32_t read = 0; read < 4; ++read) {
+            const ShaderRecompiler::FragmentParameter observed{1, 1, read == 0, read == 1, read == 2, read == 3, false};
+            fragment.fragmentParameters = {smooth, observed};
+            refused(state);
+        }
+        fragment.fragmentParameters = {smooth};
+        for (const std::uint32_t decoration : {static_cast<std::uint32_t>(spv::DecorationFlat), static_cast<std::uint32_t>(spv::DecorationPerVertexKHR)}) {
+            fragment.spirv = module({(3u << 16u) | spv::OpDecorate, 1u, decoration});
+            refused(state);
+            fragment.spirv = module({(4u << 16u) | spv::OpMemberDecorate, 1u, 0u, decoration});
+            refused(state);
+        }
+        fragment.spirv = module({(5u << 16u) | spv::OpDecorate, 1u, spv::DecorationLocation});
+        refused(state);
+        fragment.spirv = std::vector<std::uint32_t>{};
+        refused(state);
+    }
+    fragment.fragmentParameters = {smooth};
+    for (const std::uint32_t generated : {static_cast<std::uint32_t>(spv::BuiltInSampleId), static_cast<std::uint32_t>(spv::BuiltInFrontFacing), static_cast<std::uint32_t>(spv::BuiltInSubgroupLocalInvocationId)}) {
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, generated, (3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat});
+        ValidateProvokingVertex(unsupported, last, shaders);
+        fragment.spirv = module({(3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat, (4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, generated});
+        ValidateProvokingVertex(unsupported, last, shaders);
+        fragment.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, generated, (4u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationFlat});
+        ValidateProvokingVertex(unsupported, last, shaders);
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, generated, (3u << 16u) | spv::OpDecorate, 2u, spv::DecorationFlat});
+        refused(last);
+        fragment.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, generated, (4u << 16u) | spv::OpMemberDecorate, 1u, 1u, spv::DecorationFlat});
+        refused(last);
+    }
+    for (const std::uint32_t passed : {static_cast<std::uint32_t>(spv::BuiltInLayer), static_cast<std::uint32_t>(spv::BuiltInViewportIndex), static_cast<std::uint32_t>(spv::BuiltInPrimitiveId)}) {
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, passed, (3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat});
+        refused(last);
+        fragment.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, passed, (4u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationFlat});
+        refused(last);
+    }
+    ShaderRecompiler::RecompileResult vertex{};
+    vertex.fragmentParameters = {{0, 0, true, true, true, true, true}};
+    vertex.spirv = module({(3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat});
+    fragment.fragmentParameters = {smooth};
+    fragment.spirv = module({});
+    const std::array<CompiledShader, 2> stages{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}}};
+    ValidateProvokingVertex(unsupported, last, stages);
+    Context supported{};
+    supported.provokingVertexLast = true;
+    for (const auto stage : {ShaderRecompiler::ShaderStage::Vertex, ShaderRecompiler::ShaderStage::TessellationEvaluation, ShaderRecompiler::ShaderStage::Geometry, ShaderRecompiler::ShaderStage::Mesh}) {
+        ShaderRecompiler::RecompileResult writer{};
+        const std::array<CompiledShader, 2> written{{{stage, &writer, 0}, {ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}}};
+        const auto refusedWrite = [&] {
+            expectFailure([&] { ValidateProvokingVertex(unsupported, last, written); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+            ValidateProvokingVertex(supported, last, written);
+        };
+        for (const std::uint32_t selected : {static_cast<std::uint32_t>(spv::BuiltInLayer), static_cast<std::uint32_t>(spv::BuiltInViewportIndex)}) {
+            writer.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, selected});
+            refusedWrite();
+            writer.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, selected});
+            refusedWrite();
+            writer.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, selected, (4u << 16u) | spv::OpMemberDecorate, 1u, 1u, spv::DecorationPerPrimitiveEXT});
+            refusedWrite();
+            writer.spirv = module({(4u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationPerPrimitiveEXT, (5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, selected});
+            ValidateProvokingVertex(unsupported, last, written);
+            writer.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, selected, (3u << 16u) | spv::OpDecorate, 1u, spv::DecorationPerPrimitiveEXT});
+            ValidateProvokingVertex(unsupported, last, written);
+        }
+        writer.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, spv::BuiltInPosition, (5u << 16u) | spv::OpMemberDecorate, 2u, 0u, spv::DecorationBuiltIn, spv::BuiltInPointSize});
+        ValidateProvokingVertex(unsupported, last, written);
+        writer.spirv = std::vector<std::uint32_t>{};
+        refusedWrite();
+    }
+    const std::array<CompiledShader, 1> missing{{{ShaderRecompiler::ShaderStage::Fragment, nullptr, 0}}};
+    expectFailure([&] { ValidateProvokingVertex(unsupported, last, missing); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+}
+
 void ProvokingVertexRenderPassTests() {
     using namespace AgcDriver::Graphics;
     const auto first = DecodeState(makeState());
@@ -9658,6 +10156,34 @@ ShaderRecompiler::RecompileRequest packedExportRequest(const AgcDriver::QueueSta
     return request;
 }
 
+void uintTargetTests() {
+    using ShaderRecompiler::ColorExportPacking;
+    auto queue = makeState();
+    queue.context[0x31c] = (queue.context.at(0x31c) & ~0x1f7cu) | (4u << 2u) | (4u << 8u);
+    queue.context[0x1e0] = 1u << 30u;
+    for (std::uint32_t i = 0; i < 4; ++i) queue.context[0x105 + i] = 0;
+    const auto state = AgcDriver::Graphics::DecodeState(queue);
+    Require(state.color.format == VK_FORMAT_R32_UINT && state.color.elementBytes == 4 && state.color.bytes == colorMemory.size() && state.color.packing == ColorExportPacking::Uint, "a 32-bit UINT target did not get the unsigned integer export packing");
+    const auto packings = AgcDriver::Graphics::ExportPackings(state);
+    Require(packings[0] == ColorExportPacking::Uint && std::all_of(packings.begin() + 1, packings.end(), [](ColorExportPacking packing) { return packing == ColorExportPacking::None; }), "export 0 did not carry the unsigned integer packing");
+    Require(!state.blends.at(0).blendEnable && state.blends.at(0).colorWriteMask != 0, "blending into a UINT target was not dropped");
+    auto bytes = queue;
+    bytes.context[0x31c] = (bytes.context.at(0x31c) & ~0x1f7cu) | (1u << 2u) | (4u << 8u);
+    const auto eight = AgcDriver::Graphics::DecodeState(bytes);
+    Require(eight.color.format == VK_FORMAT_R8_UINT && eight.color.packing == ColorExportPacking::Uint && !eight.blends.at(0).blendEnable, "an 8-bit UINT target did not get the unsigned integer export packing");
+    auto words = queue;
+    words.context[0x1c5] = 7u;
+    words.context[0x1e0] = 0;
+    const auto uint16 = AgcDriver::Graphics::DecodeState(words);
+    Require(uint16.color.packing == ColorExportPacking::None && uint16.color.uintExport, "a UINT16_ABGR export into a UINT target was retyped twice");
+    auto halves = queue;
+    halves.context[0x1c5] = 4u;
+    expectFailure([&] { static_cast<void>(AgcDriver::Graphics::DecodeState(halves)); }, "color export format 4 into an unsigned integer target is unsupported");
+    auto unorm = queue;
+    unorm.context[0x31c] = (unorm.context.at(0x31c) & ~0x1f7cu) | (4u << 2u) | (7u << 8u);
+    Require(AgcDriver::Graphics::DecodeState(unorm).color.packing == ColorExportPacking::None, "a 32-bit float target got the unsigned integer export packing");
+}
+
 void unorm10_11_11TargetTests() {
     using ShaderRecompiler::ColorExportPacking;
     auto queue = makeState();
@@ -9743,6 +10269,332 @@ void unorm10_11_11TargetTests() {
     expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(uintExport)); }, "fragment output 0 has no color export packing path");
 }
 
+void unorm4_4_4_4TargetTests() {
+    using ShaderRecompiler::ColorExportPacking;
+    auto queue = makeState();
+    queue.context[0x31c] = (queue.context.at(0x31c) & ~((0x1fu << 2u) | (7u << 8u) | (3u << 11u))) | (19u << 2u) | (2u << 11u);
+    queue.context[0x1b3] = 2;
+    queue.context[0x1b4] = 2;
+    const auto state = AgcDriver::Graphics::DecodeState(queue);
+    Require(state.color.format == VK_FORMAT_R16_UINT && state.color.elementBytes == 2 && state.color.componentMapping == 0x1bu && state.color.packing == ColorExportPacking::Unorm4_4_4_4, "a 4_4_4_4 unorm target did not decode to an R16_UINT attachment with reversed exports");
+    const auto packings = AgcDriver::Graphics::ExportPackings(state);
+    Require(packings[0] == ColorExportPacking::Unorm4_4_4_4 && std::all_of(packings.begin() + 1, packings.end(), [](ColorExportPacking packing) { return packing == ColorExportPacking::None; }), "export 0 did not carry the 4_4_4_4 unorm packing");
+    Require(state.color.partialWriteMask == 0u && state.blends[0].colorWriteMask == 0xfu && AgcDriver::Graphics::ExportTargetMerge(state).mask == 0u, "a full write of a 4_4_4_4 unorm target merged into the target");
+    auto changed = queue;
+    for (const auto& [targetMask, wordMask] : {std::pair{1u, 0xf000u}, std::pair{7u, 0xfff0u}, std::pair{8u, 0x000fu}, std::pair{0xau, 0x0f0fu}}) {
+        changed.context[0x8e] = targetMask;
+        Require(AgcDriver::Graphics::DrawRejection(changed, false).empty(), "the draw precheck refused CB_TARGET_MASK " + std::to_string(targetMask) + " of a 4_4_4_4 unorm target");
+        const auto partial = AgcDriver::Graphics::DecodeState(changed);
+        Require(partial.color.partialWriteMask == wordMask && partial.colors.front().partialWriteMask == wordMask && partial.blends[0].colorWriteMask == 0u && partial.blend.colorWriteMask == 0u, "CB_TARGET_MASK " + std::to_string(targetMask) + " of a 4_4_4_4 unorm target did not merge its nibbles behind a closed write mask");
+        const auto merge = AgcDriver::Graphics::ExportTargetMerge(partial);
+        const auto expected = AgcDriver::Graphics::SurfaceForTarget(partial.color);
+        const auto surface = AgcDriver::Graphics::DecodeTextureResource(merge.descriptor);
+        Require(merge.target == 0u && merge.mask == wordMask && merge.samples == 1u && !merge.depthStencilWrites && surface.baseAddress == expected.baseAddress && surface.pipeBankXor == expected.pipeBankXor && surface.width == expected.width && surface.height == expected.height && surface.format == expected.format && surface.tileMode == expected.tileMode && surface.dimension == AgcDriver::Graphics::TextureDimension::k2D && surface.mipCount == 1u && surface.samples == 1u, "the merge descriptor of CB_TARGET_MASK " + std::to_string(targetMask) + " does not decode to the target's surface");
+    }
+    {
+        auto depthQueue = queue;
+        depthQueue.context[0x8e] = 1;
+        depthQueue.context[0x000] = 0;
+        depthQueue.context[0x002] = 0;
+        depthQueue.context[0x007] = (1u << 16u) | 3u;
+        depthQueue.context[0x00a] = 7;
+        depthQueue.context[0x00b] = 0;
+        depthQueue.context[0x010] = 0x22900983;
+        depthQueue.context[0x011] = 0x20000181;
+        for (const auto offset : {0x012u, 0x014u}) depthQueue.context[offset] = 0x100;
+        for (const auto offset : {0x013u, 0x015u}) depthQueue.context[offset] = 0x200;
+        depthQueue.context[0x005] = 0x300;
+        depthQueue.context[0x01e] = 0x1;
+        depthQueue.context[0x008] = std::bit_cast<std::uint32_t>(0.25f);
+        depthQueue.context[0x009] = std::bit_cast<std::uint32_t>(0.75f);
+        struct DepthStencilCase {
+            std::uint32_t control;
+            std::uint32_t ops;
+            std::uint32_t masks;
+            bool writes;
+        };
+        for (const auto& [control, ops, masks, writes] : {DepthStencilCase{0x00700710u, 0x00050050u, 0x01ffff01u, false}, DepthStencilCase{0x00700712u, 0x00050050u, 0x01ffff01u, false}, DepthStencilCase{0x00700714u, 0x00050050u, 0x01ffff01u, false}, DepthStencilCase{0x00700716u, 0x00050050u, 0x01ffff01u, true}, DepthStencilCase{0x00700711u, 0x00050050u, 0x01ffff01u, true}, DepthStencilCase{0x00700711u, 0u, 0x01ffff01u, false}, DepthStencilCase{0x00700711u, 0x00050050u, 0x0100ff01u, false}, DepthStencilCase{0x00700713u, 0u, 0x01ffff01u, false}, DepthStencilCase{0x00700718u, 0x00050050u, 0x01ffff01u, false}}) {
+            depthQueue.context[0x200] = control;
+            depthQueue.context[0x10b] = ops;
+            depthQueue.context[0x10c] = depthQueue.context[0x10d] = masks;
+            const auto what = "DB_DEPTH_CONTROL " + std::to_string(control) + " with stencil operations " + std::to_string(ops) + " and masks " + std::to_string(masks);
+            Require(AgcDriver::Graphics::DrawRejection(depthQueue, false).empty(), "the draw precheck refused a partial 4_4_4_4 write under " + what);
+            const auto partial = AgcDriver::Graphics::DecodeState(depthQueue);
+            const auto merge = AgcDriver::Graphics::ExportTargetMerge(partial);
+            Require(partial.depth.has_value() == ((control & 0xbu) != 0u) && partial.depthBoundsTest == ((control & 8u) != 0u) && merge.mask == 0xf000u && AgcDriver::Graphics::DepthStencilWrites(partial) == writes && merge.depthStencilWrites == writes && merge.depthStencilTests == ((control & 0xbu) != 0u), "a partial 4_4_4_4 write under " + what + (writes ? " did not report" : " reported") + " depth or stencil writes");
+        }
+        auto truncated = depthQueue;
+        truncated.context[0x200] = 0x00700712u;
+        truncated.context[0x010] = 0x22900987u;
+        truncated.context[0x2f8] = 0x00100001u;
+        truncated.context[0x292] = 3;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) truncated.context[0x2fe + pixel * 4u] = 0xcc44;
+        truncated.context[0x31d] = truncated.context.at(0x31d) & ~0x3f000u;
+        truncated.context[0x8e] = 0xf;
+        const auto full = AgcDriver::Graphics::DecodeState(truncated);
+        Require(full.samples == 2 && full.truncatedCoverage && !full.mergedCoverage && full.color.samples == 1 && full.color.partialWriteMask == 0u, "a full write of a one-sample 4_4_4_4 unorm target beside a 2x depth target did not decode as truncated coverage");
+        truncated.context[0x8e] = 1;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(truncated); }, "under merged or truncated coverage");
+    }
+    {
+        auto smoothed = queue;
+        smoothed.context[0x2f8] = 0x0020c002u;
+        smoothed.context[0x292] = 3;
+        smoothed.context[0x3b8] = 0x0dc00000u;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) smoothed.context[0x2fe + pixel * 4u] = 0xcc44;
+        smoothed.context[0x31d] = smoothed.context.at(0x31d) & ~0x3f000u;
+        smoothed.context[0x201] = 0x02130000u;
+        const auto merged = AgcDriver::Graphics::DecodeState(smoothed);
+        Require(merged.samples == 4 && merged.mergedCoverage && merged.color.samples == 1 && merged.color.partialWriteMask == 0u, "a full write of a one-sample 4_4_4_4 unorm target under OVERRASTERIZATION_AMOUNT 2 did not decode as merged coverage");
+        smoothed.context[0x8e] = 1;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(smoothed); }, "under merged or truncated coverage");
+    }
+    {
+        changed.context[0x8e] = 1;
+        const auto partial = AgcDriver::Graphics::DecodeState(changed);
+        auto killQueue = changed;
+        killQueue.context[0x203] = 0x40u;
+        const auto killState = AgcDriver::Graphics::DecodeState(killQueue);
+        killQueue.context[0x203] = 0x10u;
+        const auto earlyState = AgcDriver::Graphics::DecodeState(killQueue);
+        Require(killState.pixelKill && !killState.pixelEarlyZ && !earlyState.pixelKill && earlyState.pixelEarlyZ, "DB_SHADER_CONTROL.KILL_ENABLE of a 4_4_4_4 merge did not decode as a kill under late tests");
+        constexpr std::array<std::uint32_t, 3> mergeCode{0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto merging = packedExportRequest(changed, partial, mergeCode);
+        merging.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(partial);
+        const std::array<std::uint32_t, 3> capabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat};
+        merging.target.supportedCapabilities = capabilities;
+        merging.target.registrationWordLimit = 1u << 20u;
+        const ShaderRecompiler::RequestSerializer mergeSerializer;
+        Require(mergeSerializer.Deserialize(mergeSerializer.Serialize(merging)).request.context.pixel->targetMerge == merging.context.pixel->targetMerge, "the 4_4_4_4 target merge was lost in serialization");
+        auto unmerged = merging;
+        unmerged.context.pixel->targetMerge = {};
+        auto moved = merging;
+        moved.context.pixel->targetMerge.descriptor[0] += 0x100u;
+        std::vector<std::uint64_t> mergedKey, unmergedKey, movedKey;
+        ShaderRecompiler::RecompileCacheKey::BuildInterface(merging, mergedKey);
+        ShaderRecompiler::RecompileCacheKey::BuildInterface(unmerged, unmergedKey);
+        ShaderRecompiler::RecompileCacheKey::BuildInterface(moved, movedKey);
+        Require(mergedKey != unmergedKey && mergedKey == movedKey, "the static shader key does not separate merging from plain writes, or depends on the merged target's address");
+        for (const bool registration : {false, true}) {
+            merging.target.registrationModules = registration;
+            const auto merged = ShaderRecompiler::Recompile(merging);
+            const auto words = merged.spirv.Copy();
+            std::size_t reads = 0, writes = 0;
+            for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+                reads += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageRead ? 1u : 0u;
+                writes += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageWrite ? 1u : 0u;
+            }
+            const auto what = std::string(registration ? "a registration" : "a specialized") + " 4_4_4_4 merge module";
+            Require(merged.registrationModule == registration && reads == 1u && writes == 1u && interlockShape(words) == "capability extension ordered begin end " && declaresEarlyFragmentTests(merging), what + " did not read and write the target once inside a pixel interlock after early tests: " + interlockShape(words));
+            Require(coherentImageRead(words), what + " does not read the target through a Coherent image variable");
+            const auto bound = std::ranges::any_of(merged.bindings, [&](const ShaderRecompiler::DescriptorBinding& binding) {
+                if (binding.role != ShaderRecompiler::DescriptorRole::GuestImages || binding.kind != ShaderRecompiler::DescriptorKind::StorageImage) return false;
+                for (std::size_t offset = 0; offset + 8u <= binding.guestDescriptor.size(); offset += 8u) {
+                    if (std::equal(merging.context.pixel->targetMerge.descriptor.begin(), merging.context.pixel->targetMerge.descriptor.end(), binding.guestDescriptor.begin() + static_cast<std::ptrdiff_t>(offset))) return true;
+                }
+                return false;
+            });
+            Require(bound, what + " does not bind the merged target as a storage image");
+            ShaderRecompiler::RecompileResult vertex;
+            vertex.spirv = makeModule({});
+            const VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
+            const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &merged, 0}}};
+            Require(AgcDriver::Graphics::ValidateShaders(shaders, partial, subgroup, false) == std::set<std::uint32_t>{0u}, what + " lost its export to attachment 0");
+        }
+        auto lacking = merging;
+        const std::array<std::uint32_t, 2> noInterlock{spv::CapabilityShader, spv::CapabilityStorageImageReadWithoutFormat};
+        lacking.target.supportedCapabilities = noInterlock;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(lacking)); }, "fragmentShaderPixelInterlock");
+        auto unformatted = merging;
+        const std::array<std::uint32_t, 2> noFormatlessReads{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT};
+        unformatted.target.supportedCapabilities = noFormatlessReads;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(unformatted)); }, "storage image reads without a format");
+        auto killing = merging;
+        killing.context.pixel->pixelKillEnable = true;
+        killing.context.pixel->earlyZ = false;
+        for (const bool registration : {false, true}) {
+            killing.target.registrationModules = registration;
+            const auto words = ShaderRecompiler::Recompile(killing).spirv.Copy();
+            std::size_t reads = 0, writes = 0;
+            for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+                reads += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageRead ? 1u : 0u;
+                writes += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageWrite ? 1u : 0u;
+            }
+            Require(reads == 1u && writes == 1u && interlockShape(words) == "capability extension ordered begin end " && declaresEarlyFragmentTests(killing), "a killing 4_4_4_4 merge module under late tests of a draw without depth or stencil writes did not merge inside a pixel interlock after early tests");
+        }
+        killing.context.pixel->targetMerge.depthStencilWrites = true;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(killing)); }, "kills pixels under late tests of a draw writing depth or stencil");
+        auto earlyKilling = killing;
+        earlyKilling.context.pixel->earlyZ = true;
+        static_cast<void>(ShaderRecompiler::Recompile(earlyKilling));
+        auto exporting = merging;
+        exporting.context.pixel->depthExportEnable = true;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(exporting)); }, "exports depth");
+        alignas(16) static std::array<std::uint32_t, 4> counted{};
+        static const std::array<std::uint32_t, 4> counter{static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data())), static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data()) >> 32u) & 0xffffu, 16u, 0x31016facu};
+        constexpr std::array<std::uint32_t, 6> countingCode{0x7e000281u, 0xe0c80000u, 0x80000000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto counting = packedExportRequest(changed, partial, countingCode);
+        counting.context.userData = counter;
+        counting.context.pixel->targetMerge = merging.context.pixel->targetMerge;
+        counting.target = merging.target;
+        counting.target.registrationModules = false;
+        counting.target.bdaAbiVersion = ShaderRecompiler::BdaAbi::Version;
+        static const std::array<std::uint32_t, 4> atomicCapabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityInt64};
+        counting.target.supportedCapabilities = atomicCapabilities;
+        counting.context.pixel->earlyZ = false;
+        static_cast<void>(ShaderRecompiler::Recompile(counting));
+        counting.context.pixel->targetMerge.depthStencilTests = true;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(counting)); }, "writes guest memory (stores, atomics or GDS) under late tests");
+        counting.context.pixel->earlyZ = true;
+        const auto earlyWords = ShaderRecompiler::Recompile(counting).spirv.Copy();
+        std::size_t atomics = 0;
+        for (std::size_t at = 5; at < earlyWords.size() && (earlyWords[at] >> 16u) != 0; at += earlyWords[at] >> 16u) atomics += static_cast<spv::Op>(earlyWords[at] & 0xffffu) == spv::OpAtomicIAdd ? 1u : 0u;
+        Require(atomics == 1u && interlockShape(earlyWords) == "capability extension ordered begin end " && declaresEarlyFragmentTests(counting), "a 4_4_4_4 merge whose shader adds to a counter under early tests did not keep its one atomic add beside the merge");
+        constexpr std::array<std::uint32_t, 9> gdsReadCode{0xbefc03ffu, 0x00000100u, 0x7e000280u, 0xd8da0000u, 0x04000000u, 0xbf8c0000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto gdsReading = packedExportRequest(changed, partial, gdsReadCode);
+        gdsReading.context.pixel->targetMerge = counting.context.pixel->targetMerge;
+        gdsReading.context.pixel->earlyZ = false;
+        gdsReading.target = counting.target;
+        static_cast<void>(ShaderRecompiler::Recompile(gdsReading));
+        constexpr std::array<std::uint32_t, 9> gdsAddCode{0xbefc03ffu, 0x00000100u, 0x7e000280u, 0xd8020000u, 0x00000000u, 0xbf8c0000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto gdsAdding = gdsReading;
+        gdsAdding.shader.code = gdsAddCode;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(gdsAdding)); }, "writes guest memory (stores, atomics or GDS) under late tests");
+        auto lateMerge = counting;
+        lateMerge.context.pixel->earlyZ = false;
+        lateMerge.context.pixel->targetMerge = {};
+        static_cast<void>(ShaderRecompiler::Recompile(lateMerge));
+    }
+    changed = queue;
+    changed.context[0x8e] = 1u;
+    changed.context[0x31d] = (changed.context.at(0x31d) & ~0x3f000u) | (1u << 12u) | (1u << 15u);
+    {
+        const auto multisampled = AgcDriver::Graphics::DecodeState(changed);
+        Require(multisampled.samples == 2u && multisampled.color.samples == 2u && multisampled.color.partialWriteMask == 0xf000u && multisampled.blends[0].colorWriteMask == 0u && multisampled.perSampleShading, "a partial write of a 2-sample 4_4_4_4 unorm target did not merge per sample behind a closed write mask");
+        auto coverage = changed;
+        coverage.context[0x1b3] = 0x4002u;
+        coverage.context[0x1b4] = 0x4002u;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(coverage); }, "SAMPLE_COVERAGE in a multisampled pixel shader that runs per sample");
+        coverage.context[0x8e] = 0xfu;
+        Require(!AgcDriver::Graphics::DecodeState(coverage).perSampleShading, "a full write of a 2-sample 4_4_4_4 unorm target with a SAMPLE_COVERAGE input was refused or ran per sample");
+        struct InputCase {
+            std::uint32_t inputs;
+            std::uint32_t position;
+            const char* what;
+        };
+        auto rasterized = changed;
+        rasterized.context[0x2f8] = 0x00100001u;
+        rasterized.context[0x292] = 3;
+        rasterized.context[0x3b8] = 0x0dc00000u;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) rasterized.context[0x2fe + pixel * 4u] = 0xcc44;
+        const auto inputState = [](AgcDriver::QueueState queue, std::uint32_t inputs, std::uint32_t position) {
+            queue.context[0x1b3] = inputs;
+            queue.context[0x1b4] = inputs;
+            queue.context[0x1b8] = position;
+            return queue;
+        };
+        for (const auto& [inputs, position, what] : {InputCase{0x0004u, 0u, "PERSP_CENTROID"}, InputCase{0x0040u, 0u, "LINEAR_CENTROID"}, InputCase{0x0001u, 0u, "PERSP_SAMPLE"}, InputCase{0x0008u, 0u, "PERSP_PULL_MODEL"}, InputCase{0x2002u, 0u, "ANCILLARY"}, InputCase{0x0402u, 0u, "POS_Z_FLOAT"}, InputCase{0x0802u, 0u, "POS_W_FLOAT"}, InputCase{0x0302u, 0x20000u, "POS_X_FLOAT and POS_Y_FLOAT at a sample"}, InputCase{0x0102u, 0x10000u, "POS_X_FLOAT at the centroid"}}) {
+            auto moved = inputState(rasterized, inputs, position);
+            expectFailure([&] { AgcDriver::Graphics::DecodeState(moved); }, "cannot read the ancillary word or, unless every sample sits at the pixel centre");
+            moved.context[0x293] = moved.context.at(0x293) | 0x10000u;
+            Require(AgcDriver::Graphics::DecodeState(moved).perSampleShading, std::string("a partial write of a 2-sample 4_4_4_4 unorm target whose shader the guest runs per sample was refused for reading ") + what);
+            if (inputs == 0x2002u) {
+                expectFailure([&] { AgcDriver::Graphics::DecodeState(inputState(changed, inputs, position)); }, "cannot read the ancillary word");
+                continue;
+            }
+            Require(AgcDriver::Graphics::DecodeState(inputState(changed, inputs, position)).perSampleShading, std::string("a partial write of a 2-sample 4_4_4_4 unorm target raised from a one-sample rasterizer, every sample at the pixel centre, was refused for reading ") + what);
+        }
+        for (const auto& [inputs, position, what] : {InputCase{0x0302u, 0u, "POS_X_FLOAT and POS_Y_FLOAT at the centre"}, InputCase{0x0302u, 0x100000u, "POS_X_FLOAT and POS_Y_FLOAT at the upper-left corner"}, InputCase{0x9022u, 0u, "PERSP_CENTER, LINEAR_CENTER, FRONT_FACE and POS_FIXED_PT"}}) {
+            Require(AgcDriver::Graphics::DecodeState(inputState(rasterized, inputs, position)).perSampleShading, std::string("a partial write of a 2-sample 4_4_4_4 unorm target whose pixel-rate shader reads ") + what + " was refused");
+        }
+        const auto merge = AgcDriver::Graphics::ExportTargetMerge(multisampled);
+        const auto surface = AgcDriver::Graphics::DecodeTextureResource(merge.descriptor);
+        Require(merge.samples == 2u && merge.mask == 0xf000u && surface.dimension == AgcDriver::Graphics::TextureDimension::k2DMsaa && surface.samples == 2u && surface.baseAddress == multisampled.color.surfaceAddress && surface.width == multisampled.color.extent.width && surface.height == multisampled.color.extent.height && surface.format == AgcDriver::Graphics::TargetMergeSurface(multisampled.color).format, "the merge descriptor of a 2-sample 4_4_4_4 unorm target does not decode to its multisampled surface");
+        auto unshaded = multisampled;
+        unshaded.perSampleShading = false;
+        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::ExportTargetMerge(unshaded)); }, "needs per-sample shading");
+        constexpr std::array<std::uint32_t, 3> mergeCode{0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto merging = packedExportRequest(changed, multisampled, mergeCode);
+        merging.context.pixel->targetMerge = merge;
+        const std::array<std::uint32_t, 5> capabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityStorageImageMultisample, spv::CapabilityInterpolationFunction};
+        merging.target.supportedCapabilities = capabilities;
+        merging.target.fragmentShaderBarycentricEnabled = true;
+        const auto words = ShaderRecompiler::Recompile(merging).spirv.Copy();
+        std::size_t sampled = 0;
+        bool sampleRate = false;
+        for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+            const auto op = static_cast<spv::Op>(words[at] & 0xffffu);
+            if (op == spv::OpCapability && words[at + 1] == spv::CapabilitySampleRateShading) sampleRate = true;
+            if (op == spv::OpImageRead && (words[at] >> 16u) == 7u && words[at + 5] == spv::ImageOperandsSampleMask) ++sampled;
+            if (op == spv::OpImageWrite && (words[at] >> 16u) == 6u && words[at + 4] == spv::ImageOperandsSampleMask) ++sampled;
+        }
+        Require(sampleRate && sampled == 2u && interlockShape(words) == "capability extension ordered begin end ", "a 2-sample 4_4_4_4 merge module does not read and write the shaded sample inside a pixel interlock");
+        auto single = merging;
+        const std::array<std::uint32_t, 4> noMultisampleStorage{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityInterpolationFunction};
+        single.target.supportedCapabilities = noMultisampleStorage;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(single)); }, "storage image multisampling");
+        auto centred = merging;
+        centred.target.fragmentShaderBarycentricEnabled = false;
+        centred.context.pixel->sampleLocations = AgcDriver::Graphics::PixelSampleLocations(multisampled, *centred.context.pixel);
+        Require(std::ranges::all_of(centred.context.pixel->sampleLocations, [](std::uint8_t location) { return location == 0u; }), "a merge raised from a one-sample rasterizer did not keep every sample at the pixel centre");
+        static_cast<void>(ShaderRecompiler::Recompile(centred));
+        const auto rasterizedState = AgcDriver::Graphics::DecodeState(rasterized);
+        auto offCentre = packedExportRequest(rasterized, rasterizedState, mergeCode);
+        offCentre.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(rasterizedState);
+        offCentre.context.pixel->iteratesSamples = rasterizedState.perSampleShading;
+        offCentre.context.pixel->sampleLocations = AgcDriver::Graphics::PixelSampleLocations(rasterizedState, *offCentre.context.pixel);
+        Require(std::ranges::any_of(offCentre.context.pixel->sampleLocations, [](std::uint8_t location) { return location != 0u; }), "a 2-sample rasterizer's merge did not pass its off-centre sample locations");
+        offCentre.target.supportedCapabilities = capabilities;
+        offCentre.target.fragmentShaderBarycentricEnabled = false;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(offCentre)); }, "its centre-located barycentrics would follow the sample");
+        offCentre.target.fragmentShaderBarycentricEnabled = true;
+        static_cast<void>(ShaderRecompiler::Recompile(offCentre));
+        alignas(16) static std::array<std::uint32_t, 4> counted{};
+        static const std::array<std::uint32_t, 4> counter{static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data())), static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data()) >> 32u) & 0xffffu, 16u, 0x31016facu};
+        constexpr std::array<std::uint32_t, 6> countingCode{0x7e000281u, 0xe0c80000u, 0x80000000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto counting = packedExportRequest(changed, multisampled, countingCode);
+        counting.context.userData = counter;
+        counting.context.pixel->targetMerge = merge;
+        counting.context.pixel->iteratesSamples = true;
+        counting.context.pixel->earlyZ = true;
+        counting.target = merging.target;
+        counting.target.bdaAbiVersion = ShaderRecompiler::BdaAbi::Version;
+        static const std::array<std::uint32_t, 6> atomicCapabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityStorageImageMultisample, spv::CapabilityInterpolationFunction, spv::CapabilityInt64};
+        counting.target.supportedCapabilities = atomicCapabilities;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(counting)); }, "each covered sample would repeat its writes");
+        auto unmergedCounting = counting;
+        unmergedCounting.context.pixel->targetMerge = {};
+        static_cast<void>(ShaderRecompiler::Recompile(unmergedCounting));
+    }
+    for (const auto& [number, swap] : {std::pair{1u, 2u}, std::pair{4u, 2u}, std::pair{0u, 0u}, std::pair{0u, 1u}, std::pair{0u, 3u}}) {
+        changed = queue;
+        changed.context[0x31c] = (changed.context[0x31c] & ~((7u << 8u) | (3u << 11u))) | (number << 8u) | (swap << 11u);
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "unsupported color format 19 number type " + std::to_string(number) + " component swap " + std::to_string(swap));
+    }
+    changed = queue;
+    changed.context[0x31c] |= 0x10000000u;
+    changed.context[0x325] = 0x1234;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "DCC-compressed 4_4_4_4 unorm color targets");
+    changed = queue;
+    changed.context[0x31c] |= 0x40000u;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "truncating (ROUND_MODE) 4_4_4_4 unorm color targets");
+
+    constexpr std::array<std::uint32_t, 3> code{0xf800180fu, 0x07060504u, 0xbf810000u};
+    const auto request = packedExportRequest(queue, state, code);
+    auto plain = request;
+    plain.context.pixel->targetExportPacking.fill(ColorExportPacking::None);
+    const ShaderRecompiler::RequestSerializer serializer;
+    Require(serializer.Deserialize(serializer.Serialize(request)).request.context.pixel->targetExportPacking == request.context.pixel->targetExportPacking, "the 4_4_4_4 unorm packing was lost in serialization");
+    const auto packed = ShaderRecompiler::Recompile(request);
+    const auto unpacked = ShaderRecompiler::Recompile(plain);
+    Require(packed.PipelineVariantId() != unpacked.PipelineVariantId() && !(packed.spirv == unpacked.spirv), "the 4_4_4_4 export packing did not specialize the module");
+    ShaderRecompiler::RecompileResult vertex;
+    vertex.spirv = makeModule({});
+    const VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &packed, 0}}};
+    Require(AgcDriver::Graphics::ValidateShaders(shaders, state, subgroup, false) == std::set<std::uint32_t>{0u}, "the 4_4_4_4 packed export did not reach attachment 0");
+}
+
 void float11_11_10TargetTests() {
     using ShaderRecompiler::ColorExportPacking;
     auto queue = makeState();
@@ -9809,7 +10661,7 @@ void float11_11_10TargetTests() {
     const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &packed, 0}}};
     Require(AgcDriver::Graphics::ValidateShaders(shaders, state, subgroup, false) == std::set<std::uint32_t>{0u}, "the packed float export did not reach attachment 0");
     auto invalid = request;
-    invalid.context.pixel->targetExportPacking[0] = static_cast<ColorExportPacking>(3);
+    invalid.context.pixel->targetExportPacking[0] = static_cast<ColorExportPacking>(5);
     expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(invalid)); }, "invalid prepared fragment export packing");
 }
 
@@ -10248,6 +11100,21 @@ void validationTests() {
         attribute.components = 2;
         attribute.resource.fields[1] |= 0x80000000u;
         expectFailure([&] { AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1)); }, "descriptor flags");
+        attribute.resource.fields = {0x1000, 8u << 16u, 3, 71u << 12u};
+        attribute.components = 3;
+        context.formatProperties = [](VkPhysicalDevice, VkFormat format, VkFormatProperties* properties) {
+            *properties = {};
+            if (format == VK_FORMAT_R16G16B16A16_SFLOAT || format == VK_FORMAT_R8G8B8A8_UNORM) properties->bufferFeatures = VK_FORMAT_FEATURE_VERTEX_BUFFER_BIT;
+        };
+        Require(AgcDriver::Graphics::DecodeVertexFormat(attribute).format == VK_FORMAT_R16G16B16_SFLOAT && AgcDriver::Graphics::DecodeVertexFormat(attribute).bytes == 6, "a 3-component 16_16_16_16 float attribute was not decoded as 3 components");
+        const auto widened = AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1));
+        Require(widened.attributes[0].format == VK_FORMAT_R16G16B16A16_SFLOAT && widened.bindings[0].stride == 8 && AgcDriver::Graphics::VertexReadBytes(attribute, widened.attributes[0].format) == 8, "a 3-component 16_16_16_16 float attribute was not widened to the format the device supports");
+        Require(AgcDriver::Graphics::VertexAttributeSignature(attribute) == "f32x3", "widening the vertex format changed the shader input");
+        attribute.resource.fields = {0x1000, 4u << 16u, 3, 56u << 12u};
+        Require(AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1)).attributes[0].format == VK_FORMAT_R8G8B8A8_UNORM, "a 3-component 8_8_8_8 unorm attribute was not widened to the format the device supports");
+        attribute.resource.fields = {0x1000, 12u << 16u, 3, 74u << 12u};
+        expectFailure([&] { AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1)); }, "device does not support vertex format 106");
+        expectFailure([&] { AgcDriver::Graphics::VertexReadBytes(attribute, VK_FORMAT_R32G32B32A32_SFLOAT); }, "is not a form of");
     }
     for (const auto capability : {spv::CapabilityInt64Atomics, spv::CapabilityInt64ImageEXT}) {
         ShaderRecompiler::RecompileResult vertex;
@@ -10381,7 +11248,6 @@ void validationTests() {
     }
 }
 
-
 }
 
 bool recompilesDebugBranch(std::uint32_t opcode) {
@@ -10798,6 +11664,117 @@ void pipelineStoreLazyBufferPoolTests() {
     Require(mock.live == 0, "lazy buffer pool pipeline tests leaked Vulkan objects");
 }
 
+// The pipeline store's bound without a GPU: 1536 configurations cycled through the default 1024
+// entries keep coming back after their eviction, so the bound doubles and a later pass finds every
+// pipeline resident; a bound set with APS5_PIPELINE_STORE_ENTRIES never moves.
+void pipelineStoreGrowthTests(bool fixed) {
+    using namespace AgcDriver::Graphics;
+    mock = MockVulkan{};
+    auto context = mockContext();
+    context.device = makeHandle<VkDevice>();
+    context.graphicsPipelineLibrary = true;
+    context.pipelineLinkTimeOptimization = false;
+    context.limits.framebufferNoAttachmentsSampleCounts = VK_SAMPLE_COUNT_1_BIT;
+    ShaderRecompiler::RecompileResult vertex, fragment;
+    vertex.spirv = makeModule({});
+    fragment.spirv = makeModule({.fragment = true});
+    vertex.variantId = 301;
+    fragment.variantId = 302;
+    const std::array<CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &fragment, PipelinePushSlotBytes}}};
+    std::array<std::uint32_t, 1> mainKey{41}, fragmentKey{42};
+    const PipelineSetLayouts resources{makeHandle<VkDescriptorSetLayout>(), makeHandle<VkDescriptorSetLayout>(), true, mainKey, fragmentKey};
+    constexpr std::uint32_t configurations = 1536;
+    const auto pass = [&](std::uint32_t count) {
+        std::uint32_t built = 0;
+        for (std::uint32_t configuration = 0; configuration < count; ++configuration) {
+            VertexInputLayout input;
+            input.bindings.push_back({0, 4u * (configuration + 1u), VK_VERTEX_INPUT_RATE_VERTEX});
+            bool created = false;
+            static_cast<void>(CachedPipeline(context, State{}, input, resources, shaders, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL, &created));
+            built += created ? 1u : 0u;
+        }
+        return built;
+    };
+    std::uint32_t lastBuilt = 0;
+    for (int round = 0; round < 6; ++round) lastBuilt = pass(configurations);
+    const auto grown = PipelineStoreTotals();
+    if (fixed) {
+        Require(grown.bound == 1024, "a bound set with APS5_PIPELINE_STORE_ENTRIES changed");
+        Require(lastBuilt == configurations, "a fixed 1024-entry bound kept pipelines of a 1536-configuration cycle");
+    } else {
+        Require(grown.bound == 2048, "the bound did not grow to 2048 while evicted pipelines kept coming back");
+        Require(lastBuilt == 0, "a pass over 1536 configurations still rebuilt pipelines after the bound grew");
+    }
+    ClearCachedPipelines(context.device);
+    Require(mock.live == 0, "pipeline store growth tests leaked Vulkan objects");
+}
+
+// A journal longer than the store's starting bound: 1032 recorded pipelines replayed into an empty
+// store all stay resident (the replay grows the bound instead of dropping what does not fit).
+void pipelineStoreReplayGrowthTests() {
+    using namespace AgcDriver::Graphics;
+    const auto root = std::filesystem::temp_directory_path() / ("aps5-pipeline-store-replay-" + std::to_string(std::random_device{}()));
+    std::filesystem::create_directories(root);
+    struct Cleanup {
+        std::filesystem::path directory;
+        ~Cleanup() {
+            ShaderRecompiler::ShaderDiskCache::Shutdown();
+            std::error_code error;
+            std::filesystem::remove_all(directory, error);
+        }
+    } cleanup{root};
+#ifdef _WIN32
+    _putenv_s("ANYPS5_NO_SHADER_CACHE", "0");
+    _wputenv_s(L"ANYPS5_SHADER_CACHE_DIR", root.c_str());
+    _putenv_s("APS5_PIPELINE_JOURNAL_THREADS", "1");
+#else
+    setenv("ANYPS5_NO_SHADER_CACHE", "0", 1);
+    setenv("ANYPS5_SHADER_CACHE_DIR", root.string().c_str(), 1);
+    setenv("APS5_PIPELINE_JOURNAL_THREADS", "1", 1);
+#endif
+    Require(PipelineJournalEnabled(), "the journal is disabled with a shader cache directory set");
+    mock = MockVulkan{};
+    auto context = mockContext();
+    context.device = makeHandle<VkDevice>();
+    context.graphicsPipelineLibrary = true;
+    context.pipelineLinkTimeOptimization = false;
+    context.limits.framebufferNoAttachmentsSampleCounts = VK_SAMPLE_COUNT_1_BIT;
+    ShaderRecompiler::RecompileResult vertex, fragment;
+    vertex.spirv = makeModule({});
+    fragment.spirv = makeModule({.fragment = true});
+    vertex.variantId = 401;
+    fragment.variantId = 402;
+    const std::array<CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &fragment, PipelinePushSlotBytes}}};
+    auto cache = std::make_unique<DescriptorCache>(context);
+    context.descriptorCache = cache.get();
+    const auto layouts = DescribeSetLayouts(context, shaders);
+    const auto resources = layouts.View();
+    constexpr std::uint64_t fingerprint = 0x5eed'0000'0000'0002ull;
+    {
+        auto absent = StartPipelineJournalReplay(context, fingerprint, {});
+        Require(absent != nullptr, "the first replay did not start");
+        absent->Wait();
+    }
+    constexpr std::uint32_t configurations = 1032;
+    for (std::uint32_t configuration = 0; configuration < configurations; ++configuration) {
+        VertexInputLayout input;
+        input.bindings.push_back({0, 4u * (configuration + 1u), VK_VERTEX_INPUT_RATE_VERTEX});
+        static_cast<void>(CachedPipeline(context, State{}, input, resources, shaders));
+    }
+    FlushPipelineJournal();
+    ClearCachedPipelines(context.device);
+    Require(PipelineStoreTotals().cached == 0, "clearing the device left pipelines in the store");
+    auto replay = StartPipelineJournalReplay(context, fingerprint, {});
+    Require(replay != nullptr, "the replay did not start");
+    replay->Wait();
+    const auto totals = PipelineStoreTotals();
+    Require(totals.cached == configurations, "a replay of " + std::to_string(configurations) + " recorded pipelines kept " + std::to_string(totals.cached) + " in the store (bound " + std::to_string(totals.bound) + ")");
+    ClearCachedPipelines(context.device);
+    context.descriptorCache = nullptr;
+    cache.reset();
+    Require(mock.live == 0, "pipeline store replay growth tests leaked Vulkan objects");
+}
+
 void pipelineJournalTests(bool longPath = false, bool extended = false) {
     using namespace AgcDriver::Graphics;
     using Stage = ShaderRecompiler::ShaderStage;
@@ -11038,6 +12015,15 @@ void pipelineJournalTests(bool longPath = false, bool extended = false) {
         BuildPipelineStoreKey(mergedKey, context, mergedState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL);
         BuildPipelineStoreKey(mergedReplayed, context, mergedDecoded.state, mergedDecoded.vertexInput, layouts.View(), shaders, mergedDecoded.attachmentLayout);
         Require(mergedKey != fourSamples && mergedKey == mergedReplayed, "the decoded merged coverage state keys another pipeline");
+        auto partialState = state;
+        partialState.colors[0].partialWriteMask = 0xf000u;
+        GraphicsPipelineRecipe partialDecoded;
+        Require(DecodeGraphicsPipelineRecipe(EncodeGraphicsPipelineRecipe(MakeGraphicsPipelineRecipe(partialState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL)), partialDecoded), "the partial write recipe does not decode");
+        Require(partialDecoded.state.colors.size() == partialState.colors.size() && partialDecoded.state.colors[0].partialWriteMask == 0xf000u, "the recipe dropped the merged target's partial write mask");
+        std::vector<std::byte> partialKey, partialReplayed;
+        BuildPipelineStoreKey(partialKey, context, partialState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL);
+        BuildPipelineStoreKey(partialReplayed, context, partialDecoded.state, partialDecoded.vertexInput, layouts.View(), shaders, partialDecoded.attachmentLayout);
+        Require(partialKey != original && partialKey == partialReplayed, "the decoded partial write state keys another pipeline");
         auto movedState = state;
         movedState.viewport.x = 5;
         movedState.colors[0].address = 0x9000;
@@ -11220,6 +12206,16 @@ int main(int argc, char** argv) {
             std::cout << "pipeline library clear waits for active part builds\n";
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--pipeline-store-replay-growth") {
+            pipelineStoreReplayGrowthTests();
+            std::cout << "a replayed journal longer than the store bound stays resident\n";
+            return 0;
+        }
+        if (argc == 2 && std::string_view(argv[1]) == "--pipeline-store-growth") {
+            pipelineStoreGrowthTests(std::getenv("APS5_PIPELINE_STORE_ENTRIES") != nullptr);
+            std::cout << "pipeline store bound follows the evicted pipelines that come back\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--pipeline-store-lazy-buffer-pool") {
             pipelineStoreLazyBufferPoolTests();
             std::cout << "cached pipelines survive lazy buffer pool creation\n";
@@ -11328,6 +12324,32 @@ int main(int argc, char** argv) {
             Require(mock.live == 0, "the heap mirror run unwatch test leaked Vulkan objects");
             return 0;
         }
+        if (argc == 2 && (std::string_view(argv[1]) == "--address-copy-cap" || std::string_view(argv[1]) == "--address-copy-cap-remembered")) {
+#ifdef _WIN32
+            _putenv_s("APS5_ADDRESS_COPY_MAX_MIB", "1");
+#else
+            setenv("APS5_ADDRESS_COPY_MAX_MIB", "1", 1);
+#endif
+            {
+                mock = MockVulkan{};
+                auto context = mockContext();
+                context.bufferDeviceAddress = true;
+                context.limits.maxStorageBufferRange = 1u << 27;
+                RunAddressCopyCapTests(context, {
+                    [](VkBuffer buffer) -> std::span<std::byte> { return mockBufferMemory(buffer); },
+                    {},
+                    [](VkDeviceAddress address) {
+                        const auto offset = address - 0x100000000000ULL;
+                        const auto buffer = reinterpret_cast<VkBuffer>(offset / 0x10000);
+                        return mockBufferMemory(buffer).subspan(offset % 0x10000);
+                    },
+                    {},
+                    {}
+                }, std::string_view(argv[1]) == "--address-copy-cap-remembered");
+            }
+            Require(mock.live == 0, "the address copy cap test leaked Vulkan objects");
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--address-space-teardown") {
             addressSpaceTeardownTests();
             std::cout << "address-space device teardown releases cached guest allocations\n";
@@ -11397,6 +12419,12 @@ int main(int argc, char** argv) {
             std::cerr << "descriptor pool reset failure did not terminate\n";
             return 1;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--unobserved-provoking-vertex") {
+            UnobservedProvokingVertexTests();
+            ProvokingVertexTests();
+            std::cout << "Unobserved provoking vertex checks passed\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--covered-centroid-state") {
             multisampleTests();
             std::cout << "Covered-centroid and multisample state checks passed\n";
@@ -11449,6 +12477,7 @@ int main(int argc, char** argv) {
         retainedPixelStageTests();
         pipelineLibrarySetTests();
         pipelineLibraryClearWaitsForBuildTests();
+        tessellationPipelineLibraryCacheTests();
         framebufferOwnerTests();
         hdrComponentSwapTests();
         depthMaintenanceTests();
@@ -11456,6 +12485,7 @@ int main(int argc, char** argv) {
         srgb8TargetTests();
         DepthClipTests();
         DepthRemapTests();
+        DepthBoundsEmulationTests();
         UnusedViewportDepthTests();
         DepthStencilTests();
         OneDimensionalColorTests();
@@ -11465,12 +12495,15 @@ int main(int argc, char** argv) {
         ZExportTests();
         unorm10_11_11TargetTests();
         float11_11_10TargetTests();
+        unorm4_4_4_4TargetTests();
+        uintTargetTests();
         DepthBoundsBiasTests();
         conservativeZExportTests();
         earlyFragmentTestsTests();
         orderedPixelShaderTests();
         stencilRefExportTests();
         stencilReferenceUnusedTests();
+        stencilLogicOperationTests();
         aliasedBufferViewTests();
         LineStripTests();
         ShaderModuleKeyTests();
@@ -11540,6 +12573,7 @@ int main(int argc, char** argv) {
         samplerTableDeviceLimitTests();
         tableUpdateAfterBindTests();
         misalignedShaderDataTests();
+        imageTableTemplateRefreshTests();
         debugBranchTests();
         hostImportBudgetTests();
         textureCacheBudgetTests();
@@ -11599,6 +12633,7 @@ int main(int argc, char** argv) {
         RunGuestTextureResourceTests();
         RunDepthSurfaceReuseTests();
         RunGuestSamplerResourceTests();
+        RunLastRecordIndicesTests();
         mock = MockVulkan{};
         auto textureDetilerContext = mockContext();
         textureDetilerContext.limits.minStorageBufferOffsetAlignment = 16;
diff --git a/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp b/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp
index 28a442b75d..95dcc30770 100644
--- a/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp
+++ b/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp
@@ -36,6 +36,7 @@ void RunTextureTilingTests();
 void RunGuestTextureResourceTests();
 void RunDepthSurfaceReuseTests();
 void RunGuestSamplerResourceTests();
+void RunLastRecordIndicesTests();
 void RunTextureDetilerTests(const AgcDriver::Graphics::Context& context, const TextureDetilerTestAccess& access);
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp b/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp
index e20b23d8d5..452bac82c4 100644
--- a/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp
@@ -32,7 +32,7 @@ struct LoadCase {
     std::uint32_t components = 1;
 };
 
-std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint32_t offset, std::uint32_t records, bool robust) {
+std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint32_t offset, std::uint32_t records, bool robust, bool valid = true) {
     IrProgram program;
     program.SetWaveSize(32);
     program.Resources().stage = IrShaderStage::Compute;
@@ -76,7 +76,8 @@ std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint
         program.Metadata().bindings.pushDataStartDword = 0;
         program.Metadata().bindings.memoryOffsetCount = 1;
         auto& size = constant(records);
-        auto& handle = emit(IrOpcode::GetBufferResource, IrType::BufferResource, {&zero, &zero, &size, &zero});
+        auto& base = constant(valid ? 0x100u : 0u);
+        auto& handle = emit(IrOpcode::GetBufferResource, IrType::BufferResource, {&base, &zero, &size, &zero});
         emit(test.opcode, test.type, {&handle, &zero, &address, &zero, &enabled});
     } else {
         if (test.kind == ResourceKind::Gds) program.Metadata().bindings.descriptors.push_back({DescriptorBindingKind::Gds, {0}});
@@ -104,8 +105,8 @@ std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint
 
 class AccessTrace {
 public:
-    AccessTrace(const std::vector<std::uint32_t>& module, std::uint32_t misalignment = 0, bool valid = true)
-        : words(module), misalignment(misalignment), valid(valid) {
+    AccessTrace(const std::vector<std::uint32_t>& module, std::uint32_t misalignment = 0)
+        : words(module), misalignment(misalignment) {
         require(words.size() >= 5, "SPIR-V module header is missing");
         for (std::size_t offset = 5; offset < words.size();) {
             const auto count = words[offset] >> 16;
@@ -206,7 +207,6 @@ private:
             const auto spec = specializations.at(id);
             if (spec == PipelineSpecialization::BufferBase) return 0;
             if (spec == PipelineSpecialization::BufferBase + 1) return 0x30001000;
-            if (spec == PipelineSpecialization::BufferBase + 2) return valid;
             if (spec == PipelineSpecialization::BufferBase + 3) return misalignment;
             if (spec == PipelineSpecialization::PushDataOffset) return 0;
             throw std::runtime_error("unexpected specialization in access fixture");
@@ -250,7 +250,6 @@ private:
 
     const std::vector<std::uint32_t>& words;
     std::uint32_t misalignment;
-    bool valid;
     std::uint32_t entryFunction = 0;
     std::map<std::uint32_t, std::span<const std::uint32_t>> definitions;
     std::map<std::uint32_t, std::string> names;
@@ -281,8 +280,8 @@ std::uint32_t ldsLength(const std::vector<std::uint32_t>& words) {
 }
 
 void expectReads(const LoadCase& test, bool robust, bool active, std::uint32_t offset, std::vector<std::uint32_t> expected, std::uint32_t records = 64, std::uint32_t misalignment = 0, bool valid = true) {
-    const auto module = emitLoad(test, active, offset, records, robust);
-    const auto actual = AccessTrace(module, misalignment, valid).Run();
+    const auto module = emitLoad(test, active, offset, records, robust, valid);
+    const auto actual = AccessTrace(module, misalignment).Run();
     if (actual != expected) {
         std::string detail = std::string(robust ? "robust" : "plain") + " guest reads:";
         for (const auto index : actual) detail += " " + std::to_string(index);
diff --git a/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp b/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp
index 0cc0c41ed7..ab7db93b7a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp
@@ -184,8 +184,29 @@ void RunGuestTextureResourceTests() {
     fmaskArray.baseArray = 1u;
     const auto fmaskArrayResource = DecodeTextureResource(pack(fmaskArray));
     Require(fmaskArrayResource.format == 20u && fmaskArrayResource.baseArray == 1u && fmaskArrayResource.depthOrLastArray == 2u, "FMASK normalization changed the array view");
-    for (std::uint32_t format = 156u; format <= 168u; ++format) {
-        if (format == 166u) continue;
+    constexpr std::array<std::pair<std::uint32_t, std::uint32_t>, 8> narrowFormats{{{156u, 5u}, {157u, 5u}, {158u, 5u}, {159u, 5u}, {160u, 5u}, {161u, 5u}, {163u, 11u}, {165u, 20u}}};
+    for (const auto& [format, surface] : narrowFormats) {
+        auto narrow = fmask;
+        narrow.format = format;
+        const auto narrowResource = DecodeTextureResource(pack(narrow));
+        Require(narrowResource.format == surface && narrowResource.tileMode == TextureTileMode::kZ64KBX, "FMASK " + std::to_string(format) + " did not use an integer Z surface of its storage width");
+        narrow.dstSelX = 4u;
+        narrow.dstSelY = 5u;
+        narrow.dstSelZ = 6u;
+        narrow.dstSelW = 7u;
+        Require(DecodeTextureResource(pack(narrow)).format == surface, "an expanded FMASK " + std::to_string(format) + " view with identity selectors was refused");
+        auto compressedNarrow = narrow;
+        compressedNarrow.metaCompress = compressedNarrow.metaPipeAligned = true;
+        compressedNarrow.metaAddr = 0x123456789aull;
+        rejectFields(compressedNarrow, "FMASK CMASK compression is implemented only for 8-sample, 8-fragment FMASK");
+    }
+    auto identityWord = fmask;
+    identityWord.dstSelX = 4u;
+    identityWord.dstSelY = 5u;
+    identityWord.dstSelZ = 6u;
+    identityWord.dstSelW = 7u;
+    rejectFields(identityWord, "FMASK destination channel selector is not implemented");
+    for (const auto format : {162u, 164u, 167u, 168u}) {
         auto unsupported = fmask;
         unsupported.format = format;
         rejectFields(unsupported, "FMASK format is not implemented");
diff --git a/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp b/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp
index e6b6ff60c5..43c38ce262 100644
--- a/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp
@@ -5,6 +5,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <memory>
+#include <mutex>
 #include <sstream>
 #include <string>
 #include <thread>
@@ -112,6 +113,50 @@ std::size_t PrivateBytes() {
 #endif
 }
 
+void BlocksFlowToAnotherThread() {
+    constexpr int rounds = 12;
+    constexpr int perRound = 200000;
+    std::size_t afterEarlyRounds = 0;
+    for (int round = 0; round < rounds; ++round) {
+        std::mutex lock;
+        std::vector<unsigned char*> handed;
+        std::atomic<bool> done{false};
+        std::thread freer([&] {
+            std::vector<unsigned char*> taken;
+            for (;;) {
+                const bool finished = done.load(std::memory_order_acquire);
+                {
+                    std::lock_guard guard(lock);
+                    taken.swap(handed);
+                }
+                for (auto* block : taken) {
+                    const auto size = static_cast<std::size_t>(block[0]) * 4 + 1;
+                    Check(block[size - 1] == block[0], "a block freed on another thread keeps its bytes until then");
+                    ::operator delete(block);
+                }
+                taken.clear();
+                if (finished) break;
+                std::this_thread::yield();
+            }
+        });
+        for (int i = 0; i < perRound; ++i) {
+            const auto seed = static_cast<unsigned char>(i % 256);
+            const auto size = static_cast<std::size_t>(seed) * 4 + 1;
+            auto* block = static_cast<unsigned char*>(::operator new(size));
+            block[0] = seed;
+            block[size - 1] = seed;
+            std::lock_guard guard(lock);
+            handed.push_back(block);
+        }
+        done.store(true, std::memory_order_release);
+        freer.join();
+        if (round == 3) afterEarlyRounds = PrivateBytes();
+    }
+    const auto afterLastRound = PrivateBytes();
+    std::printf("private bytes after 4 and after %d rounds of blocks freed on another thread: %zu, %zu\n", rounds, afterEarlyRounds, afterLastRound);
+    Check(afterLastRound < afterEarlyRounds + (64u << 20), "blocks freed on another thread do not pile up");
+}
+
 void ThreadsEndWithCachedBlocks() {
     constexpr int waves = 24;
     std::size_t afterEarlyWaves = 0;
@@ -144,6 +189,7 @@ int main() {
     SizedDeletesKeepTheirClass();
     BlocksCrossIntoLibstdcxx();
     BlocksMoveBetweenThreads();
+    BlocksFlowToAnotherThread();
     ThreadsEndWithCachedBlocks();
     if (failures != 0) {
         std::fprintf(stderr, "%d host allocator checks failed\n", failures);
diff --git a/core/libs/prx/libSceAgcDriver/tests/LastRecordIndices.cpp b/core/libs/prx/libSceAgcDriver/tests/LastRecordIndices.cpp
new file mode 100644
index 0000000000..75b7a3ee21
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/LastRecordIndices.cpp
@@ -0,0 +1,64 @@
+#include "GraphicsTests.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include <array>
+#include <cstddef>
+#include <random>
+#include <string>
+#include <vector>
+
+namespace {
+
+using namespace AgcDriver::Graphics;
+
+std::vector<std::size_t> BackwardScan(const std::vector<const void*>& logged, const std::vector<const void*>& objects) {
+    std::vector<std::size_t> indices(objects.size(), logged.size());
+    for (std::size_t i = 0; i < objects.size(); ++i) {
+        for (auto at = logged.size(); at-- > 0;) {
+            if (logged[at] == objects[i]) {
+                indices[i] = at;
+                break;
+            }
+        }
+    }
+    return indices;
+}
+
+void CheckIndices(const std::vector<const void*>& logged, const std::vector<const void*>& objects, const std::string& what) {
+    std::vector<std::size_t> indices;
+    LastRecordIndices(logged, objects, indices);
+    Require(indices == BackwardScan(logged, objects), "last record indices, " + what + ": an object did not get the index of its last record");
+}
+
+}
+
+void RunLastRecordIndicesTests() {
+    std::array<int, 4096> pool{};
+    const auto object = [&pool](std::size_t index) -> const void* { return &pool[index]; };
+
+    CheckIndices({object(0), object(1), object(0), object(2)}, {object(0), object(1), object(2), object(3), object(0), nullptr}, "repeated records and objects");
+    CheckIndices({}, {object(0), nullptr}, "an empty log");
+    CheckIndices({object(0), nullptr, object(1)}, {}, "no objects");
+    CheckIndices({nullptr, object(0)}, {nullptr, object(0)}, "a null object");
+
+    std::vector<const void*> table;
+    for (std::size_t texture = 0; texture < 1500; ++texture) table.push_back(object(texture));
+    CheckIndices(table, table, "a table of 1500 textures over its own records in table order");
+    std::vector<const void*> repeated = table;
+    repeated.insert(repeated.end(), table.begin(), table.begin() + 548);
+    CheckIndices(repeated, table, "a table of 1500 textures whose first 548 were looked up twice");
+    std::vector<const void*> missing(table.begin() + 476, table.end());
+    CheckIndices(missing, table, "a table of 1500 textures over a log without its first 476 records");
+
+    std::mt19937 generator(0x5eed);
+    for (const std::size_t records : {std::size_t{1}, std::size_t{7}, std::size_t{64}, std::size_t{1023}, std::size_t{1024}, std::size_t{1500}, std::size_t{2048}}) {
+        for (const std::size_t textures : {std::size_t{1}, std::size_t{5}, std::size_t{300}, std::size_t{1500}}) {
+            for (const std::size_t distinct : {std::size_t{8}, pool.size()}) {
+                std::vector<const void*> logged(records);
+                for (auto& entry : logged) entry = object(generator() % distinct);
+                std::vector<const void*> objects(textures);
+                for (auto& entry : objects) entry = object(generator() % distinct);
+                CheckIndices(logged, objects, std::to_string(records) + " records, " + std::to_string(textures) + " objects of " + std::to_string(distinct));
+            }
+        }
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp
index d409fc1d07..55c6fc91b1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp
@@ -114,7 +114,7 @@ void verify(std::uint32_t waveSize, std::uint32_t limit, bool int64Atomics) {
     const bool native = int64Atomics && limit < 68u;
     require(widths.contains(64u) == native, native ? "device-memory LDS did not use a 64-bit compare exchange" : "a 64-bit compare exchange appeared without device-memory LDS and shaderBufferInt64Atomics");
     require(widths.contains(32u) != native, native ? "device-memory LDS with shaderBufferInt64Atomics kept the workgroup lock" : "the 64-bit LDS atomic lost its workgroup lock");
-    require(result.bdaAbiVersion == (limit < 68u ? 1u : 0u), "the fault buffer for a misaligned 64-bit LDS atomic does not follow device-memory LDS at limit " + std::to_string(limit));
+    require(result.bdaAbiVersion == 1u, "a 64-bit LDS atomic did not get the fault buffer for a misaligned address at limit " + std::to_string(limit));
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp b/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp
index ff2a3e40a7..84be667ce8 100644
--- a/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp
@@ -1066,6 +1066,86 @@ int main() {
         return StencilReplaySafe(b.program);
     });
 
+    passed &= run("read-only BDA reads can be replayed and BDA writes cannot", [] {
+        Builder b;
+        b.program.Info().usesDma = true;
+        if (!StencilReplaySafe(b.program)) return false;
+        b.program.Info().bdaWrites = true;
+        return !StencilReplaySafe(b.program);
+    });
+
+    const auto wholeQuadEval = [](Builder& b, IrValue& live) -> IrValue& {
+        auto& ballot = b.emit(IrOpcode::Ballot, IrType::U32x4, {&live});
+        auto& allLow = b.emit(IrOpcode::Ballot, IrType::U32x4, {&b.truth()});
+        auto& allHigh = b.emit(IrOpcode::Ballot, IrType::U32x4, {&b.truth()});
+        auto& low = b.emit(IrOpcode::BitwiseAnd32, IrType::U32, {&b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&ballot, &b.constant(0u)}), &b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&allLow, &b.constant(0u)})});
+        auto& high = b.emit(IrOpcode::BitwiseAnd32, IrType::U32, {&b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&ballot, &b.constant(1u)}), &b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&allHigh, &b.constant(1u)})});
+        return b.emit(IrOpcode::WqmU64, IrType::U64, {&b.emit(IrOpcode::CompositeConstructU64, IrType::U64, {&low, &high})});
+    };
+
+    const auto splitQuads = [&](Builder& b, IrValue& live) -> IrValue& {
+        auto& wqmLow = wholeQuadEval(b, live);
+        auto& wqmHigh = wholeQuadEval(b, live);
+        return b.threadBit(b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqmLow, &b.constant(0u)}), b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqmHigh, &b.constant(1u)}));
+    };
+
+    passed &= run("stencil replay pairs structurally equivalent whole-quad evaluations for split low and high words", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        exportUnder(b, splitQuads(b, b.logicalAnd(pixelPredicate(b), helperPredicate(b, false))), true, true);
+        return StencilReplaySafe(b.program);
+    });
+
+    passed &= run("stencil replay refuses to pair whole-quad evaluations separated by an execution-mask change", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        auto& live = b.logicalAnd(pixelPredicate(b), helperPredicate(b, false));
+        auto& wqmLow = wholeQuadEval(b, live);
+        b.emit(IrOpcode::SetExecLo, IrType::Void, {&b.constant(0xffffffffu)});
+        auto& wqmHigh = wholeQuadEval(b, live);
+        auto& guard = b.threadBit(b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqmLow, &b.constant(0u)}), b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqmHigh, &b.constant(1u)}));
+        exportUnder(b, guard, true, true);
+        return !StencilReplaySafe(b.program);
+    });
+
+    passed &= run("stencil replay refuses to pair whole-quad evaluations whose predicates differ only in a constant", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        auto& helperLow = b.emit(IrOpcode::GetBuiltin, IrType::U32, {&b.constant(static_cast<std::uint32_t>(StageInputKind::HelperInvocation)), &b.constant(0u)});
+        auto& lowLive = b.logicalAnd(pixelPredicate(b), b.emit(IrOpcode::IEqual32, IrType::Bool, {&helperLow, &b.constant(0u)}));
+        auto& wqmLow = wholeQuadEval(b, lowLive);
+        auto& helperHigh = b.emit(IrOpcode::GetBuiltin, IrType::U32, {&b.constant(static_cast<std::uint32_t>(StageInputKind::HelperInvocation)), &b.constant(0u)});
+        auto& highLive = b.logicalAnd(pixelPredicate(b), b.emit(IrOpcode::IEqual32, IrType::Bool, {&helperHigh, &b.constant(1u)}));
+        auto& wqmHigh = wholeQuadEval(b, highLive);
+        auto& guard = b.threadBit(b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqmLow, &b.constant(0u)}), b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqmHigh, &b.constant(1u)}));
+        exportUnder(b, guard, true, true);
+        return !StencilReplaySafe(b.program);
+    });
+
+    const auto execCopy = [](Builder& b, IrValue& low, IrValue& high) -> IrValue& {
+        auto& active = b.emit(IrOpcode::Ballot, IrType::U32x4, {&b.truth()});
+        auto& lanes = b.emit(IrOpcode::CompositeConstructU64, IrType::U64, {&b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&active, &b.constant(0u)}), &b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&active, &b.constant(1u)})});
+        auto& wqm = b.emit(IrOpcode::WqmU64, IrType::U64, {&lanes});
+        return b.threadBit(b.wordAnd(low, b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(0u)})), b.wordAnd(high, b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(1u)})));
+    };
+
+    passed &= run("an exec copy masked by the whole-quad active lanes is a stable export guard", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        const auto [low, high] = b.ballotWords(pixelPredicate(b));
+        exportUnder(b, execCopy(b, *low, *high), true, true);
+        return StencilReplaySafe(b.program);
+    });
+
+    passed &= run("an exec copy does not hide helper participation in a whole-quad expansion", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        const auto [low, high] = b.ballotWords(helperPredicate(b, true));
+        auto& wqm = b.emit(IrOpcode::WqmU64, IrType::U64, {&b.emit(IrOpcode::CompositeConstructU64, IrType::U64, {low, high})});
+        stencilByMask(b, execCopy(b, b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(0u)}), b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(1u)})));
+        return !StencilReplaySafe(b.program);
+    });
+
     passed &= run("only guarded read-only SRT diagnostics can be replayed", [] {
         Builder b;
         b.program.Info().usesFaultBuffer = true;
@@ -1160,6 +1240,169 @@ int main() {
     passed &= run("an optional wave body cannot change helper coordinates for later implicit samples", [&] { return !optionalPixelBody(true); });
     passed &= run("an optional wave body cannot change helper coordinates for LOD queries", [&] { return !optionalPixelBody(true, IrOpcode::ImageQueryLod); });
 
+    const auto optionalPixelRegion = [&](bool unmaskedArm) {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        auto& entry = *b.block;
+        auto& predicate = pixelPredicate(b);
+        auto& zero = b.constant(0u);
+        auto& condition = b.emit(IrOpcode::LogicalNot, IrType::Bool, {&predicate});
+        auto& body = b.newBlock();
+        auto& left = b.newBlock();
+        auto& right = b.newBlock();
+        auto& join = b.newBlock();
+        auto& merge = b.newBlock();
+        entry.AddBranch(&body);
+        entry.AddBranch(&merge);
+        body.AddBranch(&left);
+        body.AddBranch(&right);
+        left.AddBranch(&join);
+        right.AddBranch(&join);
+        join.AddBranch(&merge);
+        auto& entryInfo = b.program.Metadata().blockInfo[0u];
+        entryInfo.terminator.kind = TerminatorKind::ConditionalBranch;
+        entryInfo.terminator.condition = BranchCondition::ExecZero;
+        entryInfo.terminator.trueBlock = merge.Id();
+        entryInfo.terminator.falseBlock = body.Id();
+        entryInfo.condition = &condition;
+        b.block = &body;
+        auto& uniformBit = b.emit(IrOpcode::INotEqual32, IrType::Bool, {&b.emit(IrOpcode::GetUserData, IrType::U32, {}), &zero});
+        auto& bodyInfo = b.program.Metadata().blockInfo[1u];
+        bodyInfo.terminator.kind = TerminatorKind::ConditionalBranch;
+        bodyInfo.terminator.condition = BranchCondition::SccNonZero;
+        bodyInfo.terminator.trueBlock = left.Id();
+        bodyInfo.terminator.falseBlock = right.Id();
+        bodyInfo.condition = &uniformBit;
+        for (const unsigned index : {2u, 3u, 4u}) {
+            b.program.Metadata().blockInfo[index].terminator.kind = TerminatorKind::Branch;
+            b.program.Metadata().blockInfo[index].terminator.trueBlock = index == 4u ? merge.Id() : join.Id();
+        }
+        b.block = &left;
+        auto& leftValue = b.select(predicate, b.constant(42u), zero);
+        b.block = &right;
+        auto& rightValue = unmaskedArm ? b.constant(7u) : b.select(predicate, b.constant(43u), zero);
+        b.block = &join;
+        auto& joined = b.phi(IrType::U32, left, leftValue);
+        joined.AddPhiOperand(&right, &rightValue);
+        b.block = &merge;
+        auto& merged = b.phi(IrType::U32, entry, zero);
+        merged.AddPhiOperand(&join, &joined);
+        b.keep(merged);
+        exportUnder(b, b.truth(), true, true);
+        return StencilReplaySafe(b.program);
+    };
+
+    passed &= run("an optional wave body spanning several blocks preserves inactive values through its own phis", [&] { return optionalPixelRegion(false); });
+    passed &= run("an optional wave body spanning several blocks cannot write an inactive lane on any of its paths", [&] { return !optionalPixelRegion(true); });
+
+    const auto nestedOptionalGuard = [&](bool unsafeInner, bool ballotEscape) {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        auto& entry = *b.block;
+        auto& predicate = pixelPredicate(b);
+        auto& condition = b.emit(IrOpcode::LogicalNot, IrType::Bool, {&predicate});
+        auto& base = helperPredicate(b, false);
+        auto& body = b.newBlock();
+        auto& merge = b.newBlock();
+        auto& inner = b.newBlock();
+        auto& join = b.newBlock();
+        entry.AddBranch(&body);
+        entry.AddBranch(&merge);
+        body.AddBranch(&merge);
+        merge.AddBranch(&inner);
+        merge.AddBranch(&join);
+        inner.AddBranch(&join);
+        auto& entryInfo = b.program.Metadata().blockInfo[0u];
+        entryInfo.terminator.kind = TerminatorKind::ConditionalBranch;
+        entryInfo.terminator.condition = BranchCondition::ExecZero;
+        entryInfo.terminator.trueBlock = merge.Id();
+        entryInfo.terminator.falseBlock = body.Id();
+        entryInfo.condition = &condition;
+        b.program.Metadata().blockInfo[1u].terminator.kind = TerminatorKind::Branch;
+        b.program.Metadata().blockInfo[1u].terminator.trueBlock = merge.Id();
+        b.block = &body;
+        auto& taken = b.emit(IrOpcode::SelectU1, IrType::Bool, {&predicate, &b.truth(), &base});
+        b.block = &merge;
+        auto& merged = b.phi(IrType::Bool, entry, base);
+        merged.AddPhiOperand(&body, &taken);
+        auto& innerCondition = b.emit(IrOpcode::LogicalNot, IrType::Bool, {&merged});
+        auto& mergeInfo = b.program.Metadata().blockInfo[2u];
+        mergeInfo.terminator.kind = TerminatorKind::ConditionalBranch;
+        mergeInfo.terminator.condition = BranchCondition::ExecZero;
+        mergeInfo.terminator.trueBlock = join.Id();
+        mergeInfo.terminator.falseBlock = inner.Id();
+        mergeInfo.condition = &innerCondition;
+        b.program.Metadata().blockInfo[3u].terminator.kind = TerminatorKind::Branch;
+        b.program.Metadata().blockInfo[3u].terminator.trueBlock = join.Id();
+        b.block = &inner;
+        auto& written = b.select(merged, b.constant(42u), b.constant(0u));
+        if (unsafeInner) b.emit(IrOpcode::Discard, IrType::Void, {});
+        b.block = &join;
+        auto& joined = b.phi(IrType::U32, merge, b.constant(0u));
+        joined.AddPhiOperand(&inner, &written);
+        if (ballotEscape) {
+            const auto [low, high] = b.ballotWords(merged);
+            b.keep(b.threadBit(*low, *high));
+            b.keep(b.add(*low, 1u));
+        }
+        b.keep(joined);
+        exportUnder(b, b.truth(), true, true);
+        return StencilReplaySafe(b.program);
+    };
+
+    passed &= run("an optional wave body merge may guard another optional wave body", [&] { return nestedOptionalGuard(false, false); });
+    passed &= run("an optional wave body merge cannot guard a body with side effects", [&] { return !nestedOptionalGuard(true, false); });
+    passed &= run("an optional wave body merge cannot feed a ballot escaping the lane's own bit", [&] { return !nestedOptionalGuard(false, true); });
+
+    passed &= run("an optional wave body merge may feed an own-lane ballot read", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        auto& entry = *b.block;
+        auto& predicate = pixelPredicate(b);
+        auto& condition = b.emit(IrOpcode::LogicalNot, IrType::Bool, {&predicate});
+        auto& base = helperPredicate(b, false);
+        auto& body = b.newBlock();
+        auto& merge = b.newBlock();
+        entry.AddBranch(&body);
+        entry.AddBranch(&merge);
+        body.AddBranch(&merge);
+        auto& entryInfo = b.program.Metadata().blockInfo[0u];
+        entryInfo.terminator.kind = TerminatorKind::ConditionalBranch;
+        entryInfo.terminator.condition = BranchCondition::ExecZero;
+        entryInfo.terminator.trueBlock = merge.Id();
+        entryInfo.terminator.falseBlock = body.Id();
+        entryInfo.condition = &condition;
+        b.program.Metadata().blockInfo[1u].terminator.kind = TerminatorKind::Branch;
+        b.program.Metadata().blockInfo[1u].terminator.trueBlock = merge.Id();
+        b.block = &body;
+        auto& taken = b.emit(IrOpcode::SelectU1, IrType::Bool, {&predicate, &b.truth(), &base});
+        b.block = &merge;
+        auto& merged = b.phi(IrType::Bool, entry, base);
+        merged.AddPhiOperand(&body, &taken);
+        b.keep(b.ballotBit(merged));
+        exportUnder(b, b.truth(), true, true);
+        return StencilReplaySafe(b.program);
+    });
+
+    passed &= run("an active mask may flag a sample with an explicit lod", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        MemoryInfo memory{};
+        memory.kind = ResourceKind::Image;
+        memory.imageSampleFlags = RdnaImageSampleFlagLevelZero;
+        b.program.Resources().memoryInfo.push_back(memory);
+        auto& active = b.ballotBit(b.truth());
+        auto& address = b.emit(IrOpcode::MakeImageAddress, IrType::ImageAddress, {&b.constant(0u)});
+        auto& image = b.emit(IrOpcode::GetImageResource, IrType::ImageResource, {});
+        auto& sampler = b.emit(IrOpcode::GetSamplerResource, IrType::SamplerResource, {});
+        MemoryFlags flags{0u, 0u};
+        std::uint64_t bits = 0;
+        std::memcpy(&bits, &flags, sizeof(flags));
+        b.emit(IrOpcode::ImageSampleRaw, IrType::U32x4, {&image, &sampler, &address, &active}, bits);
+        exportUnder(b, b.truth(), true, true);
+        return StencilReplaySafe(b.program);
+    });
+
     passed &= run("varying attribute sources cannot be treated as uniform any-active predicates", [&] {
         for (const auto opcode : {IrOpcode::GetAttribute, IrOpcode::GetInterpolationParameter, IrOpcode::GetInterpolationParameterF16, IrOpcode::GetTessellationAttribute}) {
             Builder b;
diff --git a/core/libs/prx/libSceAgcDriver/tests/NopDataWritePacket.cpp b/core/libs/prx/libSceAgcDriver/tests/NopDataWritePacket.cpp
index 587bc082bc..6be7c6011a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/NopDataWritePacket.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/NopDataWritePacket.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -5,8 +6,6 @@
 #include <cstdint>
 #include <cstring>
 
-extern "C" int APS5_VABI sceAgcDriverNopDataWritePacket(void* destination, uint32_t address, const void* data, uint32_t bytes);
-
 int main() {
     std::array<std::byte, 24> storage;
     storage.fill(std::byte{0xaa});
@@ -34,5 +33,18 @@ int main() {
     std::memcpy(&address, storage.data() + 8, sizeof(address));
     if (zeroBytesWords != 2 || header != 0xc0001000U || address != 0x01020304U) return 7;
     if (storage[12] != std::byte{0xaa}) return 8;
+
+    for (std::uint32_t len = 1; len <= 4; ++len) {
+        storage.fill(std::byte{0xaa});
+        const auto lenWords = sceAgcDriverNopDataWritePacket(storage.data() + 4, 0xaabbccddU, data.data(), len);
+        std::memcpy(&header, storage.data() + 4, sizeof(header));
+        std::memcpy(&address, storage.data() + 8, sizeof(address));
+        if (lenWords != 3 || header != 0xc0011000U || address != 0xaabbccddU) return 9 + static_cast<int>(len);
+        if (!std::equal(data.begin(), data.begin() + len, storage.begin() + 12)) return 14 + static_cast<int>(len);
+        for (std::size_t pad = 12 + len; pad < 16; ++pad) {
+            if (storage[pad] != std::byte{0}) return 19 + static_cast<int>(len);
+        }
+        if (storage[3] != std::byte{0xaa} || storage[16] != std::byte{0xaa}) return 24 + static_cast<int>(len);
+    }
     return 0;
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/PageStates.cpp b/core/libs/prx/libSceAgcDriver/tests/PageStates.cpp
new file mode 100644
index 0000000000..fb92db485c
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/PageStates.cpp
@@ -0,0 +1,145 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdio>
+#include <cstring>
+#include <stdexcept>
+#include <string_view>
+#include <thread>
+#include <vector>
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#include <psapi.h>
+
+namespace {
+using namespace AgcDriver::GuestMemory;
+constexpr std::size_t Unit = 65536;
+constexpr std::size_t ChunkGuestBytes = 256ull << 20u;
+
+void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+class Range {
+public:
+    explicit Range(std::size_t bytes) : bytes(bytes) {
+        data = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, ChunkGuestBytes));
+        Require(data != nullptr, "cannot reserve page-state fixture");
+    }
+
+    ~Range() {
+        {
+            GuestAllocations::Mutation mutation;
+            for (const auto offset : committed) mutation.Remove(data + offset);
+        }
+        GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+        GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+    }
+
+    std::byte* Commit(std::size_t offset) {
+        auto* at = data + offset;
+        GuestArena::GuestArenaCommit_nid_postfix(at, Unit, PAGE_READWRITE, Unit);
+        std::memset(at, 0x5b, Unit);
+        GuestAllocations::Mutation mutation;
+        mutation.Add(at, Unit, true, true, true);
+        committed.push_back(offset);
+        return at;
+    }
+
+    std::byte* Data() const { return data; }
+
+private:
+    std::byte* data = nullptr;
+    std::size_t bytes;
+    std::vector<std::size_t> committed;
+};
+
+std::size_t PrivateBytes() {
+    PROCESS_MEMORY_COUNTERS_EX counters{};
+    Require(K32GetProcessMemoryInfo(GetCurrentProcess(), reinterpret_cast<PROCESS_MEMORY_COUNTERS*>(&counters), sizeof(counters)), "cannot query page-state fixture private commit");
+    return counters.PrivateUsage;
+}
+
+void CheckMetadata() {
+    Range range(3 * ChunkGuestBytes);
+    auto* data = range.Commit(0);
+    const auto before = PrivateBytes();
+    Require(Accessible(data, Unit, true), "committed fixture is inaccessible");
+    const auto after = PrivateBytes();
+    const auto added = after > before ? after - before : 0;
+    std::printf("page-permission initialization: %zu bytes of private commit\n", added);
+    Require(added < (16ull << 20u), "page permissions committed a dense arena table");
+    const auto queried = PrivateBytes();
+    Require(!Accessible(range.Data() + 2 * ChunkGuestBytes, Unit), "reserved fixture tail is accessible");
+    Require(PrivateBytes() < queried + (4ull << 20u), "querying reserved pages allocated untouched metadata chunks");
+}
+
+void CheckBoundaries() {
+    constexpr auto span = 3 * ChunkGuestBytes;
+    Range range(span);
+    const std::array<std::size_t, 4> offsets{0, ChunkGuestBytes - Unit, ChunkGuestBytes, 2 * ChunkGuestBytes + Unit};
+    for (const auto offset : offsets) range.Commit(offset);
+    auto* block = range.Data();
+    std::atomic<bool> begin{false};
+    std::atomic<unsigned> errors{0};
+    std::vector<std::thread> readers;
+    for (unsigned reader = 0; reader < 8; ++reader) {
+        readers.emplace_back([&] {
+            while (!begin.load(std::memory_order_acquire)) std::this_thread::yield();
+            for (unsigned round = 0; round < 500; ++round) {
+                if (!Accessible(block + offsets.back(), Unit, true)) errors.fetch_add(1, std::memory_order_relaxed);
+            }
+        });
+    }
+    begin.store(true, std::memory_order_release);
+    for (auto& reader : readers) reader.join();
+    Require(errors.load() == 0, "concurrent page-state publication changed access");
+    for (const auto offset : offsets) {
+        std::array<std::byte, 16> copy{};
+        Read(reinterpret_cast<std::uint64_t>(block + offset), copy);
+        Require(std::all_of(copy.begin(), copy.end(), [](std::byte value) { return value == std::byte{0x5b}; }), "page cache changed guest bytes");
+    }
+    Require(Accessible(block + ChunkGuestBytes - Unit, 2 * Unit, true), "adjacent chunks lost their boundary pages");
+    const auto described = DescribeCommitted(reinterpret_cast<std::uint64_t>(block), span, true);
+    std::uint64_t total = 0;
+    for (const auto& [first, last] : described.ranges) total += last - first;
+    Require(!described.whole && total == offsets.size() * Unit, "reserved holes were reported committed");
+    auto* changed = block + offsets[1];
+    const auto protect = [&](bool writable) {
+        GuestAllocations::Mutation mutation;
+        mutation.Protect(changed, Unit, true, writable, true, [&] {
+            const DWORD protection = writable ? PAGE_READWRITE : PAGE_READONLY;
+            DWORD previous = 0;
+            Require(VirtualProtect(changed, Unit, protection, &previous) != 0, "cannot protect page-state fixture");
+            GuestArena::GuestArenaSetProtection_nid_postfix(reinterpret_cast<std::uintptr_t>(changed), Unit, protection);
+        });
+    };
+    protect(false);
+    Require(Accessible(changed, Unit) && !Accessible(changed, Unit, true), "protection invalidation retained writable state");
+    protect(true);
+    Require(Accessible(changed, Unit, true), "restored writable state was not discovered");
+    GuestArena::GuestArenaReset_nid_postfix(block, Unit);
+    GuestAllocations::GuestAllocationsInvalidate_nid_postfix(reinterpret_cast<std::uintptr_t>(block), Unit);
+    Require(!Accessible(block, Unit), "decommitted pages remained readable");
+    GuestArena::GuestArenaCommit_nid_postfix(block, Unit, PAGE_READWRITE, Unit);
+    Require(Accessible(block, Unit, true), "access observer did not invalidate inaccessible state after commit");
+    std::puts("page-state boundaries, publication, holes and invalidation passed");
+}
+}
+
+int main(int argc, char** argv) {
+    try {
+        Require(GuestArena::GuestArenaAvailable_nid_postfix(), "page-state fixture needs the guest arena");
+        if (argc == 2 && std::string_view(argv[1]) == "--metadata") CheckMetadata();
+        else CheckBoundaries();
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp b/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp
index b5db144ac8..2c138fecf3 100644
--- a/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp
@@ -105,6 +105,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -116,6 +118,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
diff --git a/core/libs/prx/libSceAgcDriver/tests/PerformanceTrace.cpp b/core/libs/prx/libSceAgcDriver/tests/PerformanceTrace.cpp
index efad88d641..a6272db6c6 100644
--- a/core/libs/prx/libSceAgcDriver/tests/PerformanceTrace.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/PerformanceTrace.cpp
@@ -134,6 +134,20 @@ void EscapeStrings() {
     Check(output == "\"a\\\"b\\\\c\\u000a\\u00e9\"", "string escaping is not valid JSON");
 }
 
+void Utf8Strings() {
+    std::string output;
+    TraceFormat::AppendString(output, "Ghost of Y\xc5\x8dtei \xe2\x84\xa2 \xf0\x9f\x8e\xae");
+    Check(output == "\"Ghost of Y\xc5\x8dtei \xe2\x84\xa2 \xf0\x9f\x8e\xae\"", "a UTF-8 title was not written as its own characters");
+    output.clear();
+    TraceFormat::AppendString(output, "\xc0\xaf\xed\xa0\x80\xf4\x90\x80\x80\xe2\x84\x7f\xc5");
+    Check(output == "\"\\u00c0\\u00af\\u00ed\\u00a0\\u0080\\u00f4\\u0090\\u0080\\u0080\\u00e2\\u0084\\u007f\\u00c5\"", "a byte outside a valid UTF-8 sequence was not escaped");
+    AgcDriver::TraceSummary summary;
+    summary.title = AgcDriver::TraceTitle{"PPSA26344", "Ghost of Y\xc5\x8dtei", "01.000.000"};
+    const auto origin = Clock::now();
+    const std::vector<Clock::time_point> presents{origin, origin + milliseconds(16)};
+    Check(TraceFormat::Summary(summary, {}, presents).find("\"title\":\"Ghost of Y\xc5\x8dtei\"") != std::string::npos, "the summary line did not keep a UTF-8 title");
+}
+
 void EventsShape() {
     const auto origin = Clock::now();
     const std::vector<TraceThread::Slice> slices{
@@ -576,6 +590,7 @@ int main() {
         FullBufferEvents();
         FoldShortSlices();
         EscapeStrings();
+        Utf8Strings();
         EventsShape();
         BatchIds();
         SummaryFields();
diff --git a/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp b/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp
index 0b219aa514..a95329f86d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -40,8 +41,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI sceKernelAvailableFlexibleMemorySize(size_t* size);
-
 namespace {
 
 void check(bool condition, const char* reason) {
@@ -402,8 +401,17 @@ void testIndirectDraw() {
     alignas(4) std::array<std::uint16_t, 8> indices{};
     state.indexBase = reinterpret_cast<std::uintptr_t>(indices.data());
     state.indexType = 0;
+    state.indexBufferSize.reset();
+    const auto unlimited = AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state);
+    check(unlimited.indexed && unlimited.indirect && !unlimited.indirect->indexLimitKnown && unlimited.indexCount == 0 && unlimited.indexAddress == state.indexBase && unlimited.indexSize == 2 && unlimited.indirect->recordBytes == 20, "an indexed indirect draw without INDEX_BUFFER_SIZE did not resolve with an unknown limit");
+    const auto unlimitedMulti = AgcDriver::Pm4::ResolveDraw(makePacket(0x38, {0, 0x8c, 0x280, 0x280, 3, 0, 0, 20, 0}), state);
+    check(unlimitedMulti.indirect && !unlimitedMulti.indirect->indexLimitKnown && unlimitedMulti.indirect->count == 3 && unlimitedMulti.indirect->stride == 20, "a multi indexed indirect draw without INDEX_BUFFER_SIZE did not resolve with an unknown limit");
+    execute(state, makePacket(0x13, {0}));
+    check(state.indexBufferSize.has_value() && *state.indexBufferSize == 0, "INDEX_BUFFER_SIZE of zero was not recorded as written");
     expectFailure([&] { AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state); }, "INDEX_BUFFER_SIZE");
+    expectFailure([&] { AgcDriver::Pm4::ResolveDraw(makePacket(0x38, {0, 0x8c, 0x280, 0x280, 3, 0, 0, 20, 0}), state); }, "INDEX_BUFFER_SIZE");
     state.indexBufferSize = 8;
+    check(AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state).indirect->indexLimitKnown, "a written INDEX_BUFFER_SIZE resolved with an unknown limit");
     const auto indexed = AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state);
     check(indexed.indexed && indexed.indexAddress == state.indexBase && indexed.indexCount == 8 && indexed.indexSize == 2 && indexed.indirect->recordBytes == 20 && indexed.indirect->stride == 20 && indexed.firstVertex == 0 && indexed.indirect->indxOffset == 0, "indexed indirect draw mismatch");
     check(indexed.indirect->VertexDwordOffset() == 12 && indexed.indirect->InstanceDwordOffset() == 16, "indexed record geometry mismatch");
@@ -1128,6 +1136,63 @@ void testReleaseMemDataSelects() {
     for (const auto select : {6u, 7u}) expectFailure([&] { AgcDriver::Pm4::Validate(release(select), 0); }, "reserved RELEASE_MEM DATA_SEL");
 }
 
+void testMemSemaphore() {
+    alignas(8) static std::uint64_t semaphore = 0;
+    alignas(8) static std::uint32_t marker = 0;
+    const auto packet = [](std::uint32_t control) { return makePacket(0x39, {low(&semaphore), high(&semaphore), control}); };
+    check(AgcDriver::Pm4::AccessesMemory(packet(0xc0100000u)[0]), "MEM_SEMAPHORE must synchronize guest memory");
+    for (const auto queue : {0u, 0x20u}) {
+        AgcDriver::Pm4::Validate(packet(0xc0100000u), queue);
+        AgcDriver::Pm4::Validate(packet(0xe0000000u), queue);
+    }
+    expectFailure([&] { AgcDriver::Pm4::Validate(packet(0xe0010000u), 0); }, "mailbox");
+    expectFailure([&] { AgcDriver::Pm4::Validate(packet(0xa0000000u), 0); }, "MEM_SEMAPHORE operation");
+    expectFailure([&] { AgcDriver::Pm4::Validate(makePacket(0x39, {low(&semaphore), high(&semaphore), 0xc0100000u, 0}), 0); }, "packet size");
+    expectFailure([&] { AgcDriver::Pm4::Validate(makePacket(0x39, {0, 0, 0xc0100000u}), 0); }, "MEM_SEMAPHORE address");
+    expectFailure([&] { AgcDriver::Pm4::Validate(makePacket(0x39, {low(&semaphore) + 4, high(&semaphore), 0xc0100000u}), 0); }, "MEM_SEMAPHORE address");
+
+    semaphore = 0x500000000ull;
+    auto words = packet(0xc0100000u);
+    submitWords(words);
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 1, "a MEM_SEMAPHORE signal of type 1 did not write 1");
+
+    semaphore = 5;
+    words = packet(0xc0000000u);
+    submitWords(words);
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 6, "a MEM_SEMAPHORE signal of type 0 did not increment");
+
+    constexpr std::uint64_t queueSignals = 2000, cpuSignals = 200000;
+    semaphore = 0;
+    std::vector<std::uint32_t> graphicsWords, computeWords;
+    for (std::uint64_t index = 0; index < queueSignals; ++index) {
+        const auto signal = packet(0xc0000000u);
+        graphicsWords.insert(graphicsWords.end(), signal.begin(), signal.end());
+        computeWords.insert(computeWords.end(), signal.begin(), signal.end());
+    }
+    std::thread cpu([] {
+        for (std::uint64_t index = 0; index < cpuSignals; ++index) std::atomic_ref<std::uint64_t>(semaphore).fetch_add(1);
+    });
+    submitWords(graphicsWords);
+    submitWords(computeWords, 0x20);
+    cpu.join();
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 2 * queueSignals + cpuSignals, "competing MEM_SEMAPHORE signals of type 0 lost an increment");
+
+    semaphore = 0;
+    marker = 0;
+    words = joinPackets({packet(0xe0000000u), makePacket(0x49, {0x0030c514, 0x20000000, low(&marker), high(&marker), 1, 0, 0})});
+    submitWords(words);
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    check(std::atomic_ref<std::uint32_t>(marker).load() == 0, "a MEM_SEMAPHORE wait passed a zero semaphore");
+    std::atomic_ref<std::uint64_t>(semaphore).store(2);
+    for (int waited = 0; waited < 2000 && std::atomic_ref<std::uint32_t>(marker).load() == 0; ++waited) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint32_t>(marker).load() == 1, "work after a signalled MEM_SEMAPHORE wait never ran");
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 1, "a MEM_SEMAPHORE wait did not take one from the semaphore");
+}
+
 void testSuspendPointWritesQueuedLabels() {
     alignas(8) static std::uint32_t gate = 0, marker = 0;
     gate = 0;
@@ -2015,6 +2080,7 @@ int main(int argc, char** argv) {
         testPredicatedSubmission();
         testConditionalSubmission();
         testSuspendPointWritesQueuedLabels();
+        testMemSemaphore();
         testNopPadSubmission();
         testBranchSubmission();
         testWaitRegMemMasking();
diff --git a/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp b/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp
index 98cf833fd3..7359bc4598 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp
@@ -1,3 +1,10 @@
+#include "prx/libSceAgc/Patch/include/Rewind.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include "../tools/Pm4Analysis.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/LabelStores.hpp"
@@ -21,18 +28,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcAcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcDcbWaitRegMem(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, std::uint8_t, const volatile void*, std::uint64_t, std::uint64_t, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcAcbWaitRegMem(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, const volatile void*, std::uint64_t, std::uint64_t, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer*, std::uint8_t, std::uint16_t, std::uint8_t, std::uint8_t, const volatile Label*, std::uint8_t, std::uint64_t, std::uint16_t, std::uint16_t, std::uint8_t, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbDmaData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint32_t, std::uint8_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcDcbCondExec(CommandBuffer*, const volatile std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcAcbRewind(CommandBuffer*, std::uint32_t);
-int APS5_VABI sceAgcAsyncRewindPatchSetRewindState(std::uint32_t*, std::uint8_t);
-}
-
 namespace {
 
 using AgcDriver::CapturedSubmission;
@@ -693,8 +688,12 @@ void testCorrupt(const std::filesystem::path& directory) {
 int main() {
     std::filesystem::path scratch;
     try {
+#ifdef _WIN32
+        const wchar_t* captured = _wgetenv(L"APS5_DUMP_SUBMITS");
+#else
         const char* captured = std::getenv("APS5_DUMP_SUBMITS");
-        check(captured != nullptr && *captured != '\0', "set APS5_DUMP_SUBMITS to the capture directory of this test");
+#endif
+        check(captured != nullptr && *captured != 0, "set APS5_DUMP_SUBMITS to the capture directory of this test");
         const std::filesystem::path directory = captured;
         std::filesystem::remove_all(directory);
         scratch = std::filesystem::temp_directory_path() / ("anyps5-pm4-replay-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
diff --git a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
index f55704d524..c8aae68a7a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
@@ -7,6 +7,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
+#include "execution/FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <algorithm>
 #include <array>
@@ -38,6 +39,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -49,6 +52,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -56,7 +65,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto queues = function<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
             queues(context.physical, &count, nullptr);
             std::vector<VkQueueFamilyProperties> families(count);
@@ -559,6 +568,64 @@ void residentPresentTests(const Context& context) {
     blitLetterboxMatchesClear(context);
 }
 
+PFN_vkGetDeviceProcAddr realDeviceProc = nullptr;
+PFN_vkAllocateMemory realAllocateMemory = nullptr;
+const VkPhysicalDeviceMemoryProperties* refusingMemory = nullptr;
+std::uint32_t refusedAllocations = 0;
+std::uint32_t lastAllocatedType = UINT32_MAX;
+
+VKAPI_ATTR VkResult VKAPI_CALL refuseDeviceLocalAllocation(VkDevice device, const VkMemoryAllocateInfo* info, const VkAllocationCallbacks* callbacks, VkDeviceMemory* memory) {
+    const auto heap = refusingMemory->memoryTypes[info->memoryTypeIndex].heapIndex;
+    if ((refusingMemory->memoryHeaps[heap].flags & VK_MEMORY_HEAP_DEVICE_LOCAL_BIT) != 0) {
+        ++refusedAllocations;
+        return VK_ERROR_OUT_OF_DEVICE_MEMORY;
+    }
+    lastAllocatedType = info->memoryTypeIndex;
+    return realAllocateMemory(device, info, callbacks, memory);
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL refusingDeviceProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkAllocateMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&refuseDeviceLocalAllocation);
+    return realDeviceProc(device, name);
+}
+
+void sourceImageOutsideDeviceMemoryTests(const Context& base) {
+    VkImageCreateInfo probeInfo{VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO};
+    probeInfo.imageType = VK_IMAGE_TYPE_2D;
+    probeInfo.format = VK_FORMAT_B8G8R8A8_UNORM;
+    probeInfo.extent = {64u, 64u, 1u};
+    probeInfo.mipLevels = 1;
+    probeInfo.arrayLayers = 1;
+    probeInfo.samples = VK_SAMPLE_COUNT_1_BIT;
+    probeInfo.tiling = VK_IMAGE_TILING_OPTIMAL;
+    probeInfo.usage = VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_TRANSFER_SRC_BIT;
+    VkImage probe = VK_NULL_HANDLE;
+    Check(base.Function<PFN_vkCreateImage>("vkCreateImage")(base.device, &probeInfo, nullptr, &probe), "vkCreateImage probe");
+    VkMemoryRequirements requirements{};
+    base.Function<PFN_vkGetImageMemoryRequirements>("vkGetImageMemoryRequirements")(base.device, probe, &requirements);
+    base.Function<PFN_vkDestroyImage>("vkDestroyImage")(base.device, probe, nullptr);
+    if (!base.HostMemoryType(requirements.memoryTypeBits)) {
+        std::printf("presentation source in host memory: skipped, the device offers no host memory type for the image\n");
+        return;
+    }
+    auto context = base;
+    context.bufferPool.reset();
+    realDeviceProc = base.deviceProc;
+    realAllocateMemory = base.Function<PFN_vkAllocateMemory>("vkAllocateMemory");
+    refusingMemory = &context.memory;
+    refusedAllocations = 0;
+    lastAllocatedType = UINT32_MAX;
+    context.deviceProc = refusingDeviceProc;
+    {
+        PresentationScaler scaler(context, VK_FORMAT_B8G8R8A8_UNORM, VK_FORMAT_B8G8R8A8_UNORM);
+        scaler.EnsureSourceImage(64u, 64u);
+        Require(refusedAllocations != 0, "the presentation source never asked for device-local memory");
+        Require(lastAllocatedType != UINT32_MAX && (context.memory.memoryHeaps[context.memory.memoryTypes[lastAllocatedType].heapIndex].flags & VK_MEMORY_HEAP_DEVICE_LOCAL_BIT) == 0, "the presentation source was not placed in host memory when device-local memory was refused");
+        Require(scaler.SourceWidth() == 64u && scaler.SourceHeight() == 64u, "the presentation source in host memory lost its extent");
+    }
+    context.bufferPool.reset();
+}
+
 }
 
 int main() {
@@ -573,6 +640,7 @@ int main() {
             return VulkanTestSkipped;
         }
         residentPresentTests(device->GetContext());
+        sourceImageOutsideDeviceMemoryTests(device->GetContext());
         std::cout << "resident present format, presentation pass and letterbox tests passed\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
index a5bc67e508..412903f163 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PipelineLinkOptimization.hpp"
 #include "Triangle_frag_spv.h"
 #include "Triangle_vert_spv.h"
@@ -30,6 +32,7 @@
 #include "ResidentPresent.hpp"
 #include "ImageTableAbi.hpp"
 #include "HostImportLifetime.hpp"
+#include "ShaderCacheDirectory.hpp"
 #include "SampleLod_spv.h"
 #include "BufferUpdate_spv.h"
 #include "SampleArray_spv.h"
@@ -47,6 +50,7 @@
 #endif
 #include <io.h>
 #include <windows.h>
+#include <psapi.h>
 #else
 #include <fcntl.h>
 #include <sys/mman.h>
@@ -64,6 +68,7 @@
 #include <cstring>
 #include <filesystem>
 #include <fstream>
+#include <iomanip>
 #include <future>
 #include <iostream>
 #include <memory>
@@ -77,14 +82,6 @@
 
 namespace {
 
-extern "C" {
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-}
-
 using namespace AgcDriver::Graphics;
 using AgcDriver::GuestMemory::GpuMutex;
 
@@ -327,6 +324,7 @@ public:
                 }
                 return false;
             };
+            memoryBudget = hasExtension(VK_EXT_MEMORY_BUDGET_EXTENSION_NAME);
             auto bytes = AgcDriver::QueryBdaByteFeatures(context.physical, function<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2"), available);
             auto address = AgcDriver::QueryBdaFeatures(context.physical, function<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2"), available);
             const auto queues = function<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
@@ -521,6 +519,21 @@ public:
         return properties;
     }
     void WaitQueue() const { Check(context.Function<PFN_vkQueueWaitIdle>("vkQueueWaitIdle")(context.queue), "vkQueueWaitIdle"); }
+    struct HeapUsage {
+        std::uint64_t deviceLocal = 0;
+        std::uint64_t host = 0;
+    };
+    std::optional<HeapUsage> MemoryUsage() const {
+        if (!memoryBudget) return std::nullopt;
+        VkPhysicalDeviceMemoryBudgetPropertiesEXT budget{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
+        VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2, &budget};
+        function<PFN_vkGetPhysicalDeviceMemoryProperties2>("vkGetPhysicalDeviceMemoryProperties2")(context.physical, &properties);
+        HeapUsage usage;
+        for (std::uint32_t heap = 0; heap < properties.memoryProperties.memoryHeapCount; ++heap) {
+            ((properties.memoryProperties.memoryHeaps[heap].flags & VK_MEMORY_HEAP_DEVICE_LOCAL_BIT) != 0 ? usage.deviceLocal : usage.host) += budget.heapUsage[heap];
+        }
+        return usage;
+    }
 
 private:
     template<typename TFunction>
@@ -550,6 +563,7 @@ private:
     bool graphics = false;
     std::mutex settleMutex;
     bool nullDescriptors = false;
+    bool memoryBudget = false;
 };
 
 using Kind = Recorder::ReadKind;
@@ -1222,8 +1236,10 @@ void completionCountTests(const Device& device, Recorder& recorder) {
     recorder.AfterCompletions(base, value, 3, 0, true);
     recorder.AfterCompletions(base + 8, value, 4, 0, true);
     Require(Recorder::PendingCompletionLabels() == registered, "a GPU-stored completion label counts before any write-back");
+    Require(Recorder::PendingCompletionStores() == registered, "a GPU-stored completion label counts as a completion store before any write-back");
     recorder.AfterCompletions(base + 0x40, value, 5, 0, false);
     Require(Recorder::PendingCompletionLabels() == registered + 1, "a label the GPU has no view of is not pending");
+    Require(Recorder::PendingCompletionStores() == registered + 1, "a label the GPU has no view of is not a pending completion store");
     // A late lookup (stamp <= afterStamp) of a label whose value reaches memory only through the
     // batch's completion action is refused as BehindCompletion (a poller reaps for it); a GPU-stored
     // one keeps the ordinary reason (unclosed group, or trust off) until a write-back overlaps it.
@@ -1239,16 +1255,20 @@ void completionCountTests(const Device& device, Recorder& recorder) {
     Recorder::NoteWrittenBack(base + 2, 4);
     const std::uint64_t counted = countAll ? 3 : 2;
     Require(Recorder::PendingCompletionLabels() == counted, "a write-back over a GPU-stored label did not count it exactly once");
+    Require(Recorder::PendingCompletionStores() == counted, "a write-back over a GPU-stored label did not make it a completion store exactly once");
+    int delivered = 0;
+    Require(recorder.AfterRecordedWork([&] { ++delivered; }), "an action after recorded work was refused");
+    Require(Recorder::PendingCompletionLabels() == counted + 1 && Recorder::PendingCompletionStores() == counted, "an action after recorded work counted as a completion store");
     Require(!Recorder::LookupLabel(base, 4, 3, &refusal).has_value() && refusal == Refusal::BehindCompletion, "a written-back GPU-stored label is not refused as behind a completion");
     Require(!Recorder::LookupLabel(base + 8, 4, 4, &refusal).has_value() && refusal == (countAll ? Refusal::BehindCompletion : ordinary), "an untouched GPU-stored label became behind a completion");
     recorder.Submit();
     device.WaitQueue();
-    Require(Recorder::PendingCompletionLabels() == counted && Recorder::PendingWriteBackCompletions() == 1, "counts dropped before the batch finished");
+    Require(Recorder::PendingCompletionLabels() == counted + 1 && Recorder::PendingCompletionStores() == counted && Recorder::PendingWriteBackCompletions() == 1, "counts dropped before the batch finished");
     memory[0] = 7;
     memory[2] = 7;
     memory[16] = 7;
     recorder.Sync();
-    Require(ran == 1 && Recorder::PendingCompletionLabels() == 0 && Recorder::PendingWriteBackCompletions() == 0 && recorder.Idle(), "counts did not return to 0 at finish");
+    Require(ran == 1 && delivered == 1 && Recorder::PendingCompletionLabels() == 0 && Recorder::PendingCompletionStores() == 0 && Recorder::PendingWriteBackCompletions() == 0 && recorder.Idle(), "counts did not return to 0 at finish");
     const bool storeAlways = std::getenv("APS5_LABEL_STORE_ALWAYS") != nullptr;
     Require(memory[0] == 1 && memory[2] == (storeAlways ? 1u : 7u) && memory[16] == 1, "completion stores ran for the wrong labels (overlapped and not-imported ones store, the untouched GPU-stored one skips)");
 }
@@ -1323,7 +1343,7 @@ void directCompletionLabelTests(Recorder& recorder) {
         std::int64_t physical = -1;
         ~Release() {
             recorder.Sync();
-            if (mapping != nullptr) sceKernelMunmap(mapping, size);
+            if (mapping != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), size);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, size);
         }
     } release{recorder};
@@ -1839,6 +1859,16 @@ void storeRunTests(const Device& device, Recorder& recorder) {
     Require(words[0] == 1 && words[1] == 2 && words[2] == 5 && words[4] == 4 && words[3] == 0, "the stores did not land (or the later store of a dword lost)");
     const auto after = Recorder::StoreCounts();
     Require(after.stores == before.stores + 1 && after.replaced == before.replaced + 0 && after.joined == before.joined + 0, "store counters are off");
+    store(8, 1);
+    recorder.NotePendingWrite(address + 32, 4);
+    auto* commandWords = static_cast<std::uint32_t*>(block);
+    CommandBuffer disjoint{commandWords + 12, commandWords + 16, commandWords + 12, nullptr, nullptr, nullptr, 0};
+    Agc::Command::Emit(&disjoint, 0x7a, {0x20000243, 0x400}, __func__);
+    Require(recorder.Recording(), "a disjoint command allocation drained the GPU store");
+    CommandBuffer reused{commandWords + 6, commandWords + 10, commandWords + 6, nullptr, nullptr, nullptr, 0};
+    Agc::Command::Emit(&reused, 0x7a, {0x20000243, 0x400}, __func__);
+    recorder.Sync();
+    Require(words[8] == 0x400, "a pending GPU label overwrote a reused command word");
     // The covered-access mask: reported once by the next Commands() call, then cleared.
     VkAccessFlags covered = 0xffffffffu;
     recorder.Commands(&covered);
@@ -2028,7 +2058,10 @@ bool settleFirstUseRaced(const Context& context, int copies) {
     const auto* import = HostImportFor(context, address, unit);
     Require(import != nullptr && import->unwatched && !Watched(address, unit), "(f) a 64 KiB import was not compared at first");
     const auto commands = recorder.Commands();
-    for (int copy = 0; copy < copies; ++copy) CopyBuffer(context, commands, import->buffer, 0, scratch.Handle(), 0, unit);
+    for (int copy = 0; copy < copies; ++copy) {
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+        CopyBuffer(context, commands, import->buffer, 0, scratch.Handle(), 0, unit);
+    }
     recorder.Submit();
     const auto submittedAt = std::chrono::steady_clock::now();
     const auto deadline = submittedAt + std::chrono::seconds(5);
@@ -2067,6 +2100,177 @@ bool settleFirstUseRaced(const Context& context, int copies) {
     return racing;
 }
 
+bool settleWriteOrderTests(const Device& device) {
+    using namespace AgcDriver::GuestMemory;
+    const auto& context = device.GetContext();
+    constexpr std::size_t unit = 65536;
+    if (context.hostImportAlignment == 0 || context.hostImportAlignment > unit || context.settleQueue == VK_NULL_HANDLE || !WriteWatched()) {
+        std::cout << "host imports within 64 KiB, a settle queue or write watching unavailable: settle write order not tested\n";
+        return false;
+    }
+    std::unique_lock gpu(GpuMutex());
+    PrepareImportWatch(context);
+    if (!settledImportsWatchPrivate(context)) {
+        std::cout << "this device compares every Windows import: settle write order not tested\n";
+        return false;
+    }
+    void* block = AllocateWatched(unit, unit);
+    struct Release {
+        void* block;
+        ~Release() { ReleaseWatched(block, unit); }
+    } release{block};
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, unit, true, true, true);
+    }
+    Recorder recorder(context);
+    recorder.Activate();
+    const auto* import = HostImportFor(context, address, unit);
+    Require(import != nullptr && import->unwatched, "the write-order import was not initially compared");
+    const auto fill = [&](std::uint32_t value) {
+        const auto commands = recorder.Commands();
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+        context.Function<PFN_vkCmdFillBuffer>("vkCmdFillBuffer")(commands, import->buffer, HostImportOffset(*import, address), unit, value);
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT);
+        recorder.NotePendingWrite(address, unit);
+        recorder.Submit();
+    };
+    const auto before = HostImportSettles().submitted;
+    fill(0x22222222u);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (HostImportSettles().submitted == before && std::chrono::steady_clock::now() < deadline) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        Require(HostImportFor(context, address, unit) == import, "the write-order import changed while settling");
+    }
+    Require(HostImportSettles().submitted > before, "the write-order import did not submit a settle");
+    fill(0x33333333u);
+    recorder.Sync();
+    while (!Watched(address, unit) && std::chrono::steady_clock::now() < deadline) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        HostImportFor(context, address, unit);
+    }
+    Require(Watched(address, unit), "the write-order import did not return to the write watch");
+    const auto* bytes = static_cast<const std::uint8_t*>(block);
+    Require(std::all_of(bytes, bytes + unit, [](std::uint8_t value) { return value == 0x33; }), "the GPU store after the settle did not preserve its bytes");
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Remove(block);
+    }
+    HostImportFor(context, address, unit);
+    std::cout << "settle read between main-queue GPU writes passed\n";
+    return true;
+}
+
+struct SettleWaitFailure {
+    PFN_vkGetDeviceProcAddr resolve;
+    VkBuffer buffer = VK_NULL_HANDLE;
+    VkDeviceMemory memory = VK_NULL_HANDLE;
+    VkResult result = VK_SUCCESS;
+    std::uint64_t timeout = 0;
+    unsigned waits = 0;
+    unsigned destroys = 0;
+    unsigned frees = 0;
+};
+
+SettleWaitFailure* settleWaitFailure = nullptr;
+
+VKAPI_ATTR VkResult VKAPI_CALL settleWaitForFences(VkDevice device, std::uint32_t count, const VkFence* fences, VkBool32 all, std::uint64_t timeout) {
+    auto& failure = *settleWaitFailure;
+    if (failure.result != VK_SUCCESS) {
+        failure.timeout = timeout;
+        ++failure.waits;
+        return failure.result;
+    }
+    return reinterpret_cast<PFN_vkWaitForFences>(failure.resolve(device, "vkWaitForFences"))(device, count, fences, all, timeout);
+}
+
+VKAPI_ATTR void VKAPI_CALL settleDestroyBuffer(VkDevice device, VkBuffer buffer, const VkAllocationCallbacks* allocator) {
+    auto& failure = *settleWaitFailure;
+    if (buffer == failure.buffer) ++failure.destroys;
+    reinterpret_cast<PFN_vkDestroyBuffer>(failure.resolve(device, "vkDestroyBuffer"))(device, buffer, allocator);
+}
+
+VKAPI_ATTR void VKAPI_CALL settleFreeMemory(VkDevice device, VkDeviceMemory memory, const VkAllocationCallbacks* allocator) {
+    auto& failure = *settleWaitFailure;
+    if (memory == failure.memory) ++failure.frees;
+    reinterpret_cast<PFN_vkFreeMemory>(failure.resolve(device, "vkFreeMemory"))(device, memory, allocator);
+}
+
+PFN_vkVoidFunction VKAPI_CALL settleWaitDeviceProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkWaitForFences") == 0) return reinterpret_cast<PFN_vkVoidFunction>(settleWaitForFences);
+    if (std::strcmp(name, "vkDestroyBuffer") == 0) return reinterpret_cast<PFN_vkVoidFunction>(settleDestroyBuffer);
+    if (std::strcmp(name, "vkFreeMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(settleFreeMemory);
+    return settleWaitFailure->resolve(device, name);
+}
+
+bool settleWaitFailureTests(const Device& device) {
+    using namespace AgcDriver::GuestMemory;
+    auto context = device.GetContext();
+    constexpr std::size_t unit = 65536;
+    if (context.hostImportAlignment == 0 || context.hostImportAlignment > unit || context.settleQueue == VK_NULL_HANDLE || !WriteWatched()) return false;
+    std::lock_guard gpu(GpuMutex());
+    PrepareImportWatch(context);
+    if (!settledImportsWatchPrivate(context)) return false;
+    ClearHostImports(context.device);
+    SettleWaitFailure failure{context.deviceProc};
+    settleWaitFailure = &failure;
+    context.deviceProc = settleWaitDeviceProc;
+    context.functions = nullptr;
+    void* block = AllocateWatched(unit, unit);
+    Require(block != nullptr, "no watched block for settle wait failure");
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, unit, true, true, true);
+    }
+    struct Release {
+        Context& context;
+        SettleWaitFailure& failure;
+        void* block;
+        ~Release() {
+            failure.result = VK_SUCCESS;
+            ClearHostImports(context.device);
+            {
+                GuestAllocations::Mutation mutation;
+                mutation.Remove(block);
+            }
+            ReleaseWatched(block, unit);
+            settleWaitFailure = nullptr;
+        }
+    } release{context, failure, block};
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    const auto* import = HostImportFor(context, address, unit);
+    Require(import != nullptr && import->unwatched, "wait failure import was not initially compared");
+    failure.buffer = import->buffer;
+    failure.memory = import->memory;
+    const auto before = HostImportSettles().submitted;
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (HostImportSettles().submitted == before && std::chrono::steady_clock::now() < deadline) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        HostImportFor(context, address, unit);
+    }
+    Require(HostImportSettles().submitted > before, "wait failure did not submit a settle");
+    Check(context.Function<PFN_vkDeviceWaitIdle>("vkDeviceWaitIdle")(context.device), "vkDeviceWaitIdle before settle failure");
+    for (const auto result : {VK_TIMEOUT, VK_ERROR_DEVICE_LOST}) {
+        failure.result = result;
+        const auto waits = failure.waits;
+        std::string error;
+        try {
+            ClearHostImports(context.device);
+        } catch (const std::runtime_error& caught) {
+            error = caught.what();
+        }
+        failure.result = VK_SUCCESS;
+        Require(failure.waits == waits + 1 && failure.timeout > 0 && failure.timeout <= 60'000'000'000ull, "settle retirement did not use a bounded fence wait");
+        Require(error == "AGC graphics: vkWaitForFences (settle batch): Vulkan result " + std::to_string(result), "settle retirement did not propagate its Vulkan failure");
+        Require(failure.destroys == 0 && failure.frees == 0 && HostImportCovers(context, address, unit), "failed settle wait released its host import");
+    }
+    ClearHostImports(context.device);
+    Require(failure.destroys == 1 && failure.frees == 1, "successful settle retirement did not release the retained import exactly once");
+    std::cout << "bounded settle wait preserves imports on timeout and device loss; successful retry releases once\n";
+    return true;
+}
+
 bool settleFirstUseTests(const Device& device) {
     using namespace AgcDriver::GuestMemory;
     const auto& context = device.GetContext();
@@ -2081,15 +2285,9 @@ bool settleFirstUseTests(const Device& device) {
         std::cout << "this device compares every Windows import: the first use of a settled import not tested\n";
         return false;
     }
-    for (int copies = 4096; copies <= 65536; copies *= 4) {
-        if (settleFirstUseRaced(context, copies)) {
-            std::cout << "settled import first use tests passed\n";
-            return true;
-        }
-        std::cout << "(f) the main-queue copies had finished before the import returned to the write watch, so its read did not race them\n";
-    }
-    std::cout << "(f) the main-queue copies finished first in every round: the first use of a settled import not tested\n";
-    return false;
+    Require(!settleFirstUseRaced(context, 4096), "(f) the import returned to the write watch while its earlier main-queue reads were still in flight");
+    std::cout << "settled import first use ordering tests passed\n";
+    return true;
 }
 
 bool settleEarlierImportTests(const Device& device) {
@@ -2128,7 +2326,10 @@ bool settleEarlierImportTests(const Device& device) {
     const auto* earlier = HostImportFor(context, address, 16);
     Require(earlier != nullptr && earlier->base == address && earlier->bytes == unit && earlier->unwatched, "(e) the first window of the range was not imported compared");
     const auto commands = recorder.Commands();
-    for (int copy = 0; copy < copies; ++copy) CopyBuffer(context, commands, earlier->buffer, 0, scratch.Handle(), 0, unit);
+    for (int copy = 0; copy < copies; ++copy) {
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+        CopyBuffer(context, commands, earlier->buffer, 0, scratch.Handle(), 0, unit);
+    }
     const auto* whole = HostImportFor(context, address + unit - 16, 32);
     Require(whole != nullptr && whole->base == address && whole->bytes == 2 * unit && whole->unwatched, "(e) an access across the windows did not replace the first window's import");
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
@@ -2329,6 +2530,297 @@ bool settleStorageImageTests(const Device& device) {
     std::cout << "a settled import under a storage image tests passed\n";
     return true;
 }
+
+bool settleInitialDccTests(const Device& device) {
+    using namespace AgcDriver::GuestMemory;
+    const auto& base = device.GetContext();
+    constexpr std::size_t unit = 65536;
+    constexpr std::size_t tail = 0x4000;
+    if ((base.limits.framebufferColorSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0 || !device.Graphics() || base.hostImportAlignment == 0 || base.hostImportAlignment > tail || base.settleQueue == VK_NULL_HANDLE || !WriteWatched()) {
+        std::cout << "4x color targets, graphics, host imports within 16 KiB, a settle queue or write watching unavailable: an initial multisampled DCC import over a pending settle not tested\n";
+        return false;
+    }
+    {
+        std::lock_guard gpu(GpuMutex());
+        PrepareImportWatch(base);
+        if (!settledImportsWatchPrivate(base)) {
+            std::cout << "this device compares every Windows import: an initial multisampled DCC import over a pending settle not tested\n";
+            return false;
+        }
+    }
+    std::cout << "write watch: Windows private imports stay watched after a settle read; imports under 1 MiB wait for a deferred settle\n";
+    for (const std::size_t count : {256u, 257u, 1025u}) {
+        const auto bytes = count * unit;
+        auto* block = static_cast<std::uint8_t*>(AllocateWatched(bytes, unit));
+        Require(block != nullptr, "(m) cannot allocate adjacent pending imports");
+        const auto address = reinterpret_cast<std::uint64_t>(block);
+        struct Release {
+            const Context& context;
+            std::uint8_t* block;
+            std::size_t bytes;
+            std::size_t registered = 0;
+            ~Release() {
+                {
+                    GuestAllocations::Mutation mutation;
+                    for (std::size_t index = 0; index < registered; ++index) mutation.Remove(block + index * unit);
+                }
+                HostImportFor(context, reinterpret_cast<std::uint64_t>(block), unit);
+                SetHostImportWindow(0);
+                ReleaseWatched(block, bytes);
+            }
+        } release{base, block, bytes};
+        std::memset(block, 0x11, bytes);
+        SetHostImportWindow(unit);
+        {
+            GuestAllocations::Mutation mutation;
+            for (std::size_t index = 0; index < count; ++index) {
+                mutation.Add(block + index * unit, unit, true, true, true);
+                ++release.registered;
+            }
+        }
+        for (std::size_t index = 0; index < count; ++index) {
+            const auto at = address + index * unit;
+            const auto* import = HostImportFor(base, at, unit);
+            Require(import != nullptr && import->base == at && import->bytes == unit && import->unwatched,
+                    "(m) an adjacent 64 KiB import did not start with its settle pending");
+        }
+        {
+            std::lock_guard gpu(GpuMutex());
+            Require(!Watched(address, bytes), "(m) adjacent pending imports were already watched");
+            const auto before = HostImportSettles();
+            Require(WatchedAfterSettle(base, address, bytes),
+                    "(m) one synchronous settle left part of " + std::to_string(count) + " adjacent imports unwatched");
+            const auto after = HostImportSettles();
+            BumpCollectEpoch();
+            const auto collected = CollectWrites(address, bytes);
+            Require(collected != 0, "(m) adjacent settled imports were not collected");
+            static_cast<volatile std::uint8_t*>(block)[bytes - 1] = 0x22;
+            CollectWritesUncached(address, bytes);
+            Require(!UnchangedSince(address, bytes, collected), "(m) a CPU write after the final import settled was missed");
+            std::cout << "(m) " << count << " adjacent pending imports settled: " << after.submitted - before.submitted << " reads submitted\n";
+        }
+    }
+    TextureDetiler detiler(base);
+    auto context = base;
+    context.detiler = &detiler;
+    Recorder recorder(context);
+    recorder.Activate();
+    enum class Case { Pending, PartialBlock, ComparedNeighbour, DeferredOff, UnwatchedKeys, PendingFmask, PendingFmaskAlone };
+    const auto run = [&](Case kind, std::uint32_t height) {
+        const bool fmaskAlone = kind == Case::PendingFmaskAlone;
+        const bool eightSamples = kind == Case::PendingFmask || fmaskAlone;
+        if (eightSamples && (!base.storageImageMultisample || (base.limits.framebufferColorSampleCounts & VK_SAMPLE_COUNT_8_BIT) == 0)) {
+            std::cout << "(m) 8x color or multisampled storage images unavailable: an initial FMASK import over a pending settle not tested\n";
+            return;
+        }
+        const bool partial = kind == Case::PartialBlock || kind == Case::ComparedNeighbour;
+        ColorTarget target{};
+        target.extent = {128, height};
+        target.surfaceExtent = target.extent;
+        target.format = VK_FORMAT_R8G8B8A8_UNORM;
+        target.elementBytes = 4;
+        target.samples = eightSamples ? 8 : 4;
+        target.tileMode = ColorTileMode::RenderTarget;
+        target.dccPipeAligned = true;
+        const auto colorBytes = static_cast<std::size_t>(MultisampledColorBytes(target));
+        const auto dccBytes = MultisampledDccBytes(target);
+        const auto importBytes = colorBytes + (partial ? tail : unit);
+        const auto reserved = (importBytes + unit - 1) & ~(unit - 1);
+        const auto fmaskBytes = static_cast<std::size_t>(target.extent.width) * target.extent.height * 4u;
+        const auto fmaskReserved = (fmaskBytes + unit - 1) & ~(unit - 1);
+        const auto regionBytes = unit + reserved + unit + (kind == Case::UnwatchedKeys ? unit : eightSamples ? fmaskReserved + unit : 0);
+        auto* region = static_cast<std::uint8_t*>(AllocateWatched(regionBytes, unit));
+        void* block = region != nullptr ? region + unit : nullptr;
+        void* keys = region != nullptr && kind == Case::UnwatchedKeys ? region + unit + reserved + unit : nullptr;
+        void* fmask = region != nullptr && eightSamples ? region + unit + reserved + unit : nullptr;
+        const auto destBytes = static_cast<std::size_t>(target.extent.width) * target.extent.height * 4u;
+        void* dest = VirtualAlloc(nullptr, destBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+        Require(block != nullptr && dest != nullptr && (kind != Case::UnwatchedKeys || keys != nullptr) && (!eightSamples || fmask != nullptr), "(m) cannot allocate the target");
+        const auto address = reinterpret_cast<std::uint64_t>(block);
+        const auto neighbour = address + importBytes + tail;
+        const auto describe = [](const HostImport* found, std::uint64_t at, std::size_t bytes) {
+            char text[256];
+            if (found == nullptr) std::snprintf(text, sizeof(text), ": no import of 0x%llx+0x%zx, watched %d", static_cast<unsigned long long>(at), bytes, Watched(at, bytes) ? 1 : 0);
+            else std::snprintf(text, sizeof(text), ": import 0x%llx+0x%llx, unwatched %d, settled on demand %d, for 0x%llx+0x%zx, watched %d", static_cast<unsigned long long>(found->base), static_cast<unsigned long long>(found->bytes), found->unwatched ? 1 : 0, found->settleOnDemand ? 1 : 0, static_cast<unsigned long long>(at), bytes, Watched(at, bytes) ? 1 : 0);
+            return std::string(text);
+        };
+        struct Release {
+            const Context& context;
+            Recorder& recorder;
+            void* region;
+            std::size_t regionBytes;
+            void* block;
+            void* keys;
+            void* fmask;
+            void* dest;
+            std::size_t reserved;
+            std::uint64_t neighbour;
+            ~Release() {
+                {
+                    std::lock_guard gpu(GpuMutex());
+                    recorder.Sync();
+                    ClearMultisampleTargets(context.device);
+                    ClearCachedTextures(context.device);
+                    recorder.FlushDeferredReleases();
+                }
+                {
+                    GuestAllocations::Mutation mutation;
+                    mutation.Remove(block);
+                    mutation.Remove(dest);
+                    if (keys != nullptr) mutation.Remove(keys);
+                    if (fmask != nullptr) mutation.Remove(fmask);
+                    if (neighbour < reinterpret_cast<std::uint64_t>(block) + reserved) mutation.Remove(reinterpret_cast<void*>(neighbour));
+                }
+                HostImportFor(context, reinterpret_cast<std::uint64_t>(block), 16);
+                SetHostImportDeferredSettles(true);
+                ReleaseWatched(region, regionBytes);
+                VirtualFree(dest, 0, MEM_RELEASE);
+            }
+        } release{context, recorder, region, regionBytes, block, keys, fmask, dest, reserved, kind == Case::ComparedNeighbour ? neighbour : std::numeric_limits<std::uint64_t>::max()};
+        target.address = address;
+        target.surfaceAddress = address;
+        target.bytes = colorBytes;
+        target.dccAddress = kind == Case::UnwatchedKeys ? reinterpret_cast<std::uint64_t>(keys) : address + colorBytes;
+        std::memset(block, 0, importBytes);
+        std::memset(reinterpret_cast<void*>(target.dccAddress), 0xc0, dccBytes);
+        std::memset(dest, 0x5a, destBytes);
+        if (fmask != nullptr) {
+            target.cmaskAddress = target.dccAddress + ((dccBytes + 4095) & ~std::size_t{4095});
+            target.cmaskBytes = CmaskBytes(target.extent.width, target.extent.height);
+            target.cmaskFastClear = true;
+            target.fmaskAddress = reinterpret_cast<std::uint64_t>(fmask);
+            Require(target.cmaskAddress + target.cmaskBytes <= address + importBytes, "(m) the CMASK does not fit the target's import");
+            std::memset(reinterpret_cast<void*>(target.cmaskAddress), 0xcc, static_cast<std::size_t>(target.cmaskBytes));
+            std::memset(fmask, 0x11, fmaskBytes);
+        }
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Add(block, importBytes, true, true, true);
+            mutation.Add(dest, destBytes, true, true, true);
+            if (keys != nullptr) mutation.Add(keys, unit, true, true, true);
+            if (fmask != nullptr) mutation.Add(fmask, fmaskBytes, true, true, true);
+            if (kind == Case::ComparedNeighbour) mutation.Add(reinterpret_cast<void*>(neighbour), reserved - (importBytes + tail), true, true, true);
+        }
+        if (kind == Case::UnwatchedKeys) Unwatch(target.dccAddress, dccBytes);
+        if (kind == Case::DeferredOff) SetHostImportDeferredSettles(false);
+        if (kind == Case::ComparedNeighbour) {
+            const auto* other = HostImportFor(context, neighbour, reserved - (importBytes + tail));
+            Require(other != nullptr && other->unwatched && !Watched(neighbour, reserved - (importBytes + tail)), "(m) the import sharing the target's last 64 KiB block was not compared" + describe(other, neighbour, reserved - (importBytes + tail)));
+        }
+        if (fmask != nullptr && !fmaskAlone) {
+            const auto* fmaskImport = HostImportFor(context, target.fmaskAddress, fmaskBytes);
+            Require(fmaskImport != nullptr && fmaskImport->base == target.fmaskAddress && fmaskImport->bytes == fmaskBytes && fmaskImport->unwatched && !Watched(target.fmaskAddress, fmaskBytes), "(m) the FMASK's import was not compared at first" + describe(fmaskImport, target.fmaskAddress, fmaskBytes));
+        }
+        const auto* import = HostImportFor(context, address, importBytes);
+        Require(import != nullptr && import->base == address && import->bytes == importBytes && import->unwatched && !Watched(address, importBytes), "(m) the target's import of " + std::to_string(importBytes) + " bytes was not compared at first" + describe(import, address, importBytes));
+        HostImportSettleCounts quiet{};
+        if (fmaskAlone) {
+            {
+                std::lock_guard gpu(GpuMutex());
+                const auto start = HostImportSettles();
+                Require(WatchedAfterSettle(context, address, importBytes), "(m) the target's import did not settle before the FMASK's import" + describe(ExistingHostImportFor(context, address, importBytes), address, importBytes));
+                const auto settledTarget = HostImportSettles();
+                Require(settledTarget.submitted > start.submitted && settledTarget.rewatched > start.rewatched, "(m) the target's import returned to the write watch without a settle read");
+            }
+            const std::array<std::pair<std::uint64_t, std::size_t>, 3> planes{{{address, colorBytes}, {target.dccAddress, dccBytes}, {target.cmaskAddress, static_cast<std::size_t>(target.cmaskBytes)}}};
+            for (const auto& [at, bytes] : planes) {
+                const auto* covering = ExistingHostImportFor(context, at, bytes);
+                Require(Watched(at, bytes) && (covering == nullptr || !covering->unwatched), "(m) a color, DCC or CMASK plane is not watched before the FMASK's import" + describe(covering, at, bytes));
+            }
+            quiet = HostImportSettles();
+            const auto* fmaskImport = HostImportFor(context, target.fmaskAddress, fmaskBytes);
+            Require(fmaskImport != nullptr && fmaskImport->base == target.fmaskAddress && fmaskImport->bytes == fmaskBytes && fmaskImport->unwatched && !fmaskImport->settleOnDemand && !Watched(target.fmaskAddress, fmaskBytes), "(m) the FMASK's import is not compared with its deferred settle wanted" + describe(fmaskImport, target.fmaskAddress, fmaskBytes));
+        }
+        std::unique_lock gpu(GpuMutex());
+        if (partial) {
+            for (int round = 0; round < 20; ++round) {
+                gpu.unlock();
+                std::this_thread::sleep_for(std::chrono::milliseconds(1));
+                gpu.lock();
+                HostImportFor(context, address, importBytes);
+            }
+            Require(!Watched(address, importBytes), "(m) a deferred settle returned an import that is not a whole number of 64 KiB blocks to the write watch");
+        }
+        const auto before = HostImportSettles();
+        Require(!fmaskAlone || before.submitted == quiet.submitted, "(m) a settle read was submitted between the FMASK's import and the target's first use");
+        std::string refusal;
+        try {
+            Require(MultisampleTargetView(context, target) != VK_NULL_HANDLE, "(m) the multisampled DCC target has no view");
+        } catch (const std::exception& error) {
+            refusal = error.what();
+        }
+        const auto after = HostImportSettles();
+        const auto* settled = ExistingHostImportFor(context, address, importBytes);
+        const char* name = kind == Case::Pending ? "a pending settle" : kind == Case::PartialBlock ? "an import of whole and partial 64 KiB blocks" : kind == Case::ComparedNeighbour ? "a compared import in its last 64 KiB block" : kind == Case::DeferredOff ? "deferred settles off" : kind == Case::UnwatchedKeys ? "explicitly unwatched DCC keys" : kind == Case::PendingFmask ? "an eight-sample target whose color and FMASK imports both have pending settles" : "an eight-sample target whose FMASK alone has a pending settle";
+        std::cout << "(m) initial DCC over " << name << " (import " << importBytes << " bytes): " << (refusal.empty() ? "accepted" : refusal) << "; " << after.submitted - before.submitted << " settle reads submitted, " << after.rewatched - before.rewatched << " back in the write watch\n";
+        if (kind == Case::ComparedNeighbour || kind == Case::DeferredOff || kind == Case::UnwatchedKeys) {
+            Require(refusal.find("initial multisampled DCC contents require watched guest memory") != std::string::npos, std::string("(m) an initial multisampled DCC import over ") + name + " was not refused: " + refusal);
+            Require(kind == Case::UnwatchedKeys || !Watched(address, importBytes), std::string("(m) ") + name + " returned the target's import to the write watch");
+            Require(kind != Case::UnwatchedKeys || (Watched(address, importBytes) && !Watched(target.dccAddress, dccBytes)), "(m) the refusal over explicitly unwatched DCC keys did not come from the keys" + describe(settled, address, importBytes));
+            return;
+        }
+        Require(refusal.empty(), std::string("(m) an initial multisampled DCC import over ") + name + " was refused: " + refusal);
+        Require(!fmaskAlone || (after.submitted - before.submitted == 1 && after.rewatched - before.rewatched == 1), "(m) the first use over a pending FMASK settle alone submitted " + std::to_string(after.submitted - before.submitted) + " settle reads, not the FMASK's alone");
+        Require(after.submitted > before.submitted && after.rewatched > before.rewatched && Watched(address, importBytes) && settled != nullptr && !settled->unwatched, std::string("(m) the initial DCC import over ") + name + " did not settle the import and return it to the write watch");
+        if (fmask != nullptr) {
+            const auto* settledFmask = ExistingHostImportFor(context, target.fmaskAddress, fmaskBytes);
+            Require(Watched(target.fmaskAddress, fmaskBytes) && settledFmask != nullptr && !settledFmask->unwatched, "(m) the FMASK's import did not settle back into the write watch" + describe(settledFmask, target.fmaskAddress, fmaskBytes));
+        }
+        ColorTarget destination{};
+        destination.address = reinterpret_cast<std::uint64_t>(dest);
+        destination.surfaceAddress = destination.address;
+        destination.extent = target.extent;
+        destination.surfaceExtent = target.extent;
+        destination.format = VK_FORMAT_R8G8B8A8_UNORM;
+        destination.elementBytes = 4;
+        destination.bytes = destBytes;
+        destination.samples = 1;
+        destination.tileMode = ColorTileMode::RenderTarget;
+        RunColorMetadataPass(context, {ColorMetadataPass::Mode::Resolve, {destination}, target});
+        recorder.Submit();
+        device.WaitQueue();
+        recorder.Sync();
+        std::vector<std::uint32_t> resolved(destBytes / 4);
+        AgcDriver::GuestMemory::Read(destination.address, std::as_writable_bytes(std::span(resolved)));
+        Require(std::ranges::all_of(resolved, [](std::uint32_t word) { return word == 0xffffffffu; }), std::string("(m) the target made over ") + name + " did not start from its DCC fast clear");
+        BumpCollectEpoch();
+        if (fmask != nullptr) {
+            const auto collectedFmask = CollectWrites(target.fmaskAddress, fmaskBytes);
+            Require(collectedFmask != 0, "(m) the settled FMASK import is not collected");
+            static_cast<volatile std::uint8_t*>(fmask)[0] = 0x22;
+            std::string fmaskReuse;
+            try {
+                MultisampleTargetView(context, target);
+            } catch (const std::exception& error) {
+                fmaskReuse = error.what();
+            }
+            Require(fmaskReuse.find("writes to a resident native FMASK are not implemented") != std::string::npos, "(m) the resident target missed the CPU store to its FMASK: " + fmaskReuse);
+            return;
+        }
+        const auto collected = CollectWrites(address, importBytes);
+        Require(collected != 0, "(m) the settled import is not collected");
+        static_cast<volatile std::uint8_t*>(block)[importBytes - 1] = 0x77;
+        static_cast<volatile std::uint8_t*>(block)[colorBytes] = 0x00;
+        CollectWritesUncached(address, importBytes);
+        Require(!UnchangedSince(address + importBytes - 1, 1, collected) && !UnchangedSince(address + colorBytes, 1, collected), "(m) a CPU store after the initial DCC import was missed");
+        std::string reuse;
+        try {
+            MultisampleTargetView(context, target);
+        } catch (const std::exception& error) {
+            reuse = error.what();
+        }
+        Require(reuse.find("writes to a resident multisampled DCC target or its metadata are not implemented") != std::string::npos, "(m) the resident target missed the CPU store to its DCC keys: " + reuse);
+    };
+    run(Case::Pending, 128);
+    run(Case::PartialBlock, 384);
+    run(Case::ComparedNeighbour, 384);
+    run(Case::DeferredOff, 128);
+    run(Case::UnwatchedKeys, 128);
+    run(Case::PendingFmask, 128);
+    run(Case::PendingFmaskAlone, 128);
+    std::cout << "initial multisampled DCC over a pending settle tests passed\n";
+    return true;
+}
 #endif
 
 void remappedImportTests(const Device& device) {
@@ -2372,7 +2864,7 @@ void remappedImportTests(const Device& device) {
 
 void hostImportRetirementTests(const Device& device) {
     const auto& context = device.GetContext();
-    constexpr std::size_t UnitBytes = 65536;
+    constexpr std::size_t UnitBytes = 2 * 65536;
     constexpr std::size_t AllocationBytes = 4 * UnitBytes;
     constexpr std::size_t CopyBytes = 256;
 #ifdef _WIN32
@@ -2505,8 +2997,8 @@ void secondMappingImportTests(const Device& device) {
         void* alias = nullptr;
         std::int64_t physical = -1;
         ~Release() {
-            if (alias != nullptr) sceKernelMunmap(alias, page);
-            if (mapping != nullptr) sceKernelMunmap(mapping, bytes);
+            if (alias != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page);
+            if (mapping != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), bytes);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, bytes);
         }
     } release;
@@ -2577,7 +3069,7 @@ int reimportBench(const Device& device) {
         void* mapping = nullptr;
         std::int64_t physical = -1;
         ~Release() {
-            if (mapping != nullptr) sceKernelMunmap(mapping, bytes);
+            if (mapping != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), bytes);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, bytes);
         }
     };
@@ -2727,8 +3219,8 @@ int hostImportCutTests(const Device& device) {
         std::size_t holeBytes = 0;
         ~Backing() {
             auto* memory = static_cast<std::byte*>(mapping);
-            if (memory != nullptr && hole != 0) sceKernelMunmap(memory, hole);
-            if (memory != nullptr && hole + holeBytes < bytes) sceKernelMunmap(memory + hole + holeBytes, bytes - hole - holeBytes);
+            if (memory != nullptr && hole != 0) sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), hole);
+            if (memory != nullptr && hole + holeBytes < bytes) sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory + hole + holeBytes), bytes - hole - holeBytes);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, bytes);
         }
     };
@@ -2757,7 +3249,7 @@ int hostImportCutTests(const Device& device) {
         auto* cut = memory + test.offset;
         gpu.unlock();
         if (test.unmap) {
-            Require(sceKernelMunmap(cut, test.length) == 0, name + ": the unmap failed");
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(cut), test.length) == 0, name + ": the unmap failed");
             backing.hole = test.offset;
             backing.holeBytes = test.length;
         } else {
@@ -2807,7 +3299,7 @@ int hostImportCutTests(const Device& device) {
         Require(whole != nullptr && whole->base == address && whole->bytes == bytes && whole->alias == nullptr && !whole->unwatched, name + ": the range was not imported whole, settled and watched");
         gpu.unlock();
         Require(sceKernelMprotect(memory, run, 0x03) == 0, name + ": the protection of the head failed");
-        Require(sceKernelMunmap(memory + run, bytes - run) == 0, name + ": the unmap of the kept side failed");
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory + run), bytes - run) == 0, name + ": the unmap of the kept side failed");
         backing.hole = run;
         backing.holeBytes = bytes - run;
         void* again = memory + run;
@@ -3241,7 +3733,7 @@ bool readWrittenStagingTests(const Device& device, Recorder& recorder) {
         std::cout << "host imports unavailable: read and written staging not tested\n";
         return false;
     }
-    constexpr std::size_t bytes = 16u << 20u;
+    constexpr std::size_t bytes = 40u << 20u;
 #ifdef _WIN32
     void* block = VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
 #else
@@ -3274,9 +3766,8 @@ bool readWrittenStagingTests(const Device& device, Recorder& recorder) {
     Require(boundInPlace(address + 4096, 4u << 20u, false) != context.discreteGpu, context.discreteGpu ? "a written-only 4 MiB element was bound in place on a discrete GPU" : "a written-only 4 MiB element was staged past the written window");
     Require(boundInPlace(address + 4096, 12u << 20u, false), "a written-only 12 MiB element was staged past the discrete written window");
     Require(!boundInPlace(address + 4096, 4u << 20u, true), "a read and written 4 MiB element was bound in place");
-    const auto buildInPlace = [&](std::uint64_t dispatchThreads, bool read, std::uint32_t stride, std::uint32_t extent) {
+    const auto buildInPlace = [&](std::uint64_t dispatchThreads, bool read, std::uint32_t stride, std::uint32_t extent, std::uint32_t elementBytes = 12u << 20u) {
         const auto element = address + 4096;
-        constexpr std::uint32_t elementBytes = 12u << 20u;
         const std::uint32_t records = stride != 0 ? elementBytes / stride : elementBytes;
         ShaderRecompiler::RecompileResult program;
         ShaderRecompiler::DescriptorBinding binding;
@@ -3301,7 +3792,12 @@ bool readWrittenStagingTests(const Device& device, Recorder& recorder) {
     Require(!buildInPlace((12u << 20u) / 16u, true, 16, 0), "a dispatch sweeping a read and written 12 MiB element bound it in place");
     Require(buildInPlace(1024, true, 16, 0), "a dispatch touching 16 KiB of a read and written 12 MiB element staged all of it");
     Require(buildInPlace(0, true, 16, 0), "a dispatch of unknown size staged a read and written 12 MiB element");
-    Require(buildInPlace((12u << 20u) / 16u, false, 16, 0), "a dispatch sweeping a written-only 12 MiB element staged it");
+    Require(buildInPlace((12u << 20u) / 32u, false, 32, 0) != context.discreteGpu, context.discreteGpu ? "a dispatch sweeping a written-only 12 MiB element of 32-byte records bound it in place on a discrete GPU" : "a dispatch sweeping a written-only 12 MiB element of 32-byte records staged it on a GPU without separate VRAM");
+    Require(buildInPlace((12u << 20u) / 16u, false, 16, 0), "a dispatch sweeping a written-only 12 MiB element of 16-byte records, which its stores write contiguously, staged it");
+    Require(buildInPlace(1024, false, 32, 0), "a dispatch touching 32 KiB of a written-only 12 MiB element staged all of it");
+    Require(buildInPlace((12u << 20u) / 32u, false, 0, 32), "a dispatch writing a written-only 12 MiB raw element staged it");
+    Require(buildInPlace(204800, false, 160, 0, 204800u * 160u) != context.discreteGpu, context.discreteGpu ? "a dispatch sweeping a written-only 31.25 MiB element of 160-byte records bound it in place on a discrete GPU" : "a dispatch sweeping a written-only 31.25 MiB element of 160-byte records staged it on a GPU without separate VRAM");
+    Require(buildInPlace(204800, true, 160, 0, 204800u * 160u) != context.discreteGpu, context.discreteGpu ? "a dispatch sweeping a read and written 31.25 MiB element bound it in place on a discrete GPU" : "a dispatch sweeping a read and written 31.25 MiB element staged it past the 16 MiB cap on a GPU without separate VRAM");
     Require(!buildInPlace((12u << 20u) / 32u, true, 0, 32), "a dispatch sweeping a read and written 12 MiB raw element bound it in place");
     Require(buildInPlace(1024, true, 0, 32), "a dispatch touching 32 KiB of a read and written 12 MiB raw element staged all of it");
     Require(buildInPlace((12u << 20u) / 32u, true, 0, 0), "a raw element without an access extent was staged");
@@ -3766,10 +4262,11 @@ void drawSnapshotTableSetTests(const Device& device, Recorder& recorder) {
     }
     constexpr std::uint32_t width = 4;
     constexpr std::uint32_t height = 4;
-    alignas(256) static std::array<float, width * height> texels{};
+    alignas(256) static std::array<float, width * height * 16u> texels{};
     texels.fill(1.0f);
     const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texels.data()));
     const std::array<std::uint32_t, 8> texture{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (22u << 20u) | (((width - 1u) & 3u) << 30u), ((width - 1u) >> 2u) | ((height - 1u) << 14u), 0xfacu | (9u << 28u), 0u, 0u, 0u, 0u};
+    Require(DescribeSurface(DecodeTextureResource(texture)).guestBytes <= sizeof(texels), "the draw snapshot table set test T# reads past its texels");
     constexpr auto bindingCount = static_cast<std::uint32_t>(ShaderRecompiler::RuntimeAbi::Binding::Count);
     const auto addTable = [&](ShaderRecompiler::RecompileResult& program, ShaderRecompiler::RuntimeAbi::Stage stage, std::uint32_t set, std::uint32_t elements) {
         ShaderRecompiler::DescriptorBinding map{};
@@ -4363,6 +4860,46 @@ void drawSnapshotEvictionTests(const Device& device) {
     Require(cache.ReusableDrawSnapshot(address, 16) == nullptr && cache.ReusableDrawSnapshot(address, 16) == nullptr, "a snapshot outlived a CPU store");
 }
 
+void containingSnapshotTests(const Device& device) {
+    using namespace AgcDriver::GuestMemory;
+    constexpr std::size_t bytes = 131072;
+    void* block = WriteWatched() ? AllocateWatched(bytes, 65536) : nullptr;
+    if (block == nullptr) {
+        std::cout << "write watching unavailable: containing draw snapshots not tested\n";
+        return;
+    }
+    struct Release {
+        void* block;
+        ~Release() { ReleaseWatched(block, bytes); }
+    } release{block};
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    const VkDeviceSize alignment = std::max<VkDeviceSize>(device.GetContext().limits.minStorageBufferOffsetAlignment, 4);
+    Recorder cache(device.GetContext());
+    const auto whole = std::make_shared<Buffer>(device.GetContext(), bytes, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+    const auto exact = std::make_shared<Buffer>(device.GetContext(), 4096, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+    const auto registry = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    const auto generation = CollectWrites(address, bytes);
+    Require(generation != 0, "the watched block has no generation");
+    cache.KeepDrawSnapshot(address, bytes, generation, registry, whole);
+    const auto inner = address + 65536 + 16 * alignment;
+    VkDeviceSize offset = 1;
+    Require(cache.ReusableDrawSnapshot(inner, 4096) == nullptr, "a lookup without an offset took a containing snapshot");
+    Require(cache.ReusableDrawSnapshot(inner, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == whole && offset == inner - address, "an unchanged range inside a kept snapshot was not taken from it at its offset");
+    Require(cache.ReusableDrawSnapshot(inner, address + bytes - inner + 4, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a range past the end of a kept snapshot was taken from it");
+    Require(cache.ReusableDrawSnapshot(inner + alignment / 2, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a misaligned range was taken from a kept snapshot");
+    Require(cache.ReusableDrawSnapshot(inner, 4096, Recorder::SnapshotUse::Vertex, nullptr, 0, &offset) == nullptr, "a vertex lookup took a storage snapshot");
+    cache.KeepDrawSnapshot(inner, 4096, generation, registry, exact);
+    offset = 1;
+    Require(cache.ReusableDrawSnapshot(inner, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == exact && offset == 0, "an exact snapshot lost to a containing one");
+    std::memset(block, 0x5a, 16);
+    CollectWrites(address, 16);
+    Require(cache.ReusableDrawSnapshot(inner + 4096, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == whole && offset == inner + 4096 - address, "a store outside the range stopped it from being taken from a containing snapshot");
+    Require(cache.ReusableDrawSnapshot(address, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a range over a CPU store was taken from a containing snapshot");
+    std::memset(reinterpret_cast<void*>(inner + 4096), 0x5a, 16);
+    CollectWrites(inner + 4096, 16);
+    Require(cache.ReusableDrawSnapshot(inner + 4096, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a containing snapshot outlived a CPU store into the range");
+}
+
 void unwrittenSnapshotTests(const Device& device) {
     Recorder cache(device.GetContext());
     const auto buffer = std::make_shared<Buffer>(device.GetContext(), 16, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
@@ -5106,6 +5643,11 @@ bool addressShadowTests(const Device& device, Recorder& recorder) {
     }
     const auto decided = PrepareImportWatch(base);
 #ifndef _WIN32
+    const auto probe = ProbeImportWriteProtection(base);
+    if (probe.failure != nullptr || probe.writtenAtImport != 0 || probe.writtenAfterSubmit != 0) {
+        std::cout << "skipped, the device reports watched host memory written when it imports or reads it\n";
+        return false;
+    }
     SetImportWatch(base, ImportWatch::Watch);
 #endif
     struct Restore {
@@ -5241,6 +5783,11 @@ bool completionStoreShadowTests(const Device& device, Recorder& recorder) {
     }
     const auto decided = PrepareImportWatch(base);
 #ifndef _WIN32
+    const auto probe = ProbeImportWriteProtection(base);
+    if (probe.failure != nullptr || probe.writtenAtImport != 0 || probe.writtenAfterSubmit != 0) {
+        std::cout << "skipped, the device reports watched host memory written when it imports or reads it\n";
+        return false;
+    }
     SetImportWatch(base, ImportWatch::Watch);
 #endif
     struct Restore {
@@ -6704,7 +7251,6 @@ void refreshProofTests(const Device& device, Recorder& recorder) {
     recorder.Sync();
 }
 
-
 void unchangedCpuStampTests(const Device& device, Recorder& recorder) {
     const auto& base = device.GetContext();
     constexpr std::uint32_t side = 256;
@@ -6854,7 +7400,7 @@ void keptUnitSettleTests(const Device& device, Recorder& recorder) {
                     return;
                 }
                 if (direct) {
-                    if (block != nullptr) sceKernelMunmap(block, surfaceBytes);
+                    if (block != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(block), surfaceBytes);
                     if (physical >= 0) sceKernelReleaseDirectMemory(physical, surfaceBytes);
                     return;
                 }
@@ -7403,35 +7949,7 @@ public:
         const auto commands = start.commands;
         if (!continued) {
             recorder.PrepareSampleSlot();
-            if (context.graphicsPipelineLibrary) {
-                if (!transitioned) {
-                    transitioned = true;
-                    VkImageMemoryBarrier barrier{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
-                    barrier.dstAccessMask = VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT;
-                    barrier.oldLayout = VK_IMAGE_LAYOUT_UNDEFINED;
-                    barrier.newLayout = VK_IMAGE_LAYOUT_GENERAL;
-                    barrier.image = target.Image();
-                    barrier.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
-                    context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, 0, 0, nullptr, 0, nullptr, 1, &barrier);
-                }
-                VkRenderingAttachmentInfoKHR attachment{VK_STRUCTURE_TYPE_RENDERING_ATTACHMENT_INFO_KHR};
-                attachment.imageView = target.View();
-                attachment.imageLayout = VK_IMAGE_LAYOUT_GENERAL;
-                attachment.loadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
-                attachment.storeOp = VK_ATTACHMENT_STORE_OP_STORE;
-                VkRenderingInfoKHR rendering{VK_STRUCTURE_TYPE_RENDERING_INFO_KHR};
-                rendering.renderArea = {{0, 0}, {8, 8}};
-                rendering.layerCount = 1;
-                rendering.colorAttachmentCount = 1;
-                rendering.pColorAttachments = &attachment;
-                context.Resolved(&DeviceFunctions::cmdBeginRendering, "vkCmdBeginRenderingKHR")(commands, &rendering);
-            } else {
-                VkRenderPassBeginInfo begin{VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO};
-                begin.renderPass = renderPass;
-                begin.framebuffer = framebuffer;
-                begin.renderArea = {{0, 0}, {8, 8}};
-                context.Function<PFN_vkCmdBeginRenderPass>("vkCmdBeginRenderPass")(commands, &begin, VK_SUBPASS_CONTENTS_INLINE);
-            }
+            begin(commands);
         }
         context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline);
         recorder.NoteSampledDraw(commands);
@@ -7440,10 +7958,48 @@ public:
         return continued;
     }
 
+    void Record(VkCommandBuffer commands) const {
+        begin(commands);
+        context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline);
+        context.Function<PFN_vkCmdDraw>("vkCmdDraw")(commands, 3, 1, 0, 0);
+        EndRenderPass(context, commands);
+    }
+
     static constexpr std::uint64_t Samples = 64;
 
 private:
     static constexpr std::uint64_t PassKey = 0xc0de;
+    void begin(VkCommandBuffer commands) const {
+        if (context.graphicsPipelineLibrary) {
+            if (!transitioned) {
+                transitioned = true;
+                VkImageMemoryBarrier barrier{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
+                barrier.dstAccessMask = VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT;
+                barrier.oldLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+                barrier.newLayout = VK_IMAGE_LAYOUT_GENERAL;
+                barrier.image = target.Image();
+                barrier.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+                context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, 0, 0, nullptr, 0, nullptr, 1, &barrier);
+            }
+            VkRenderingAttachmentInfoKHR attachment{VK_STRUCTURE_TYPE_RENDERING_ATTACHMENT_INFO_KHR};
+            attachment.imageView = target.View();
+            attachment.imageLayout = VK_IMAGE_LAYOUT_GENERAL;
+            attachment.loadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
+            attachment.storeOp = VK_ATTACHMENT_STORE_OP_STORE;
+            VkRenderingInfoKHR rendering{VK_STRUCTURE_TYPE_RENDERING_INFO_KHR};
+            rendering.renderArea = {{0, 0}, {8, 8}};
+            rendering.layerCount = 1;
+            rendering.colorAttachmentCount = 1;
+            rendering.pColorAttachments = &attachment;
+            context.Resolved(&DeviceFunctions::cmdBeginRendering, "vkCmdBeginRenderingKHR")(commands, &rendering);
+        } else {
+            VkRenderPassBeginInfo info{VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO};
+            info.renderPass = renderPass;
+            info.framebuffer = framebuffer;
+            info.renderArea = {{0, 0}, {8, 8}};
+            context.Function<PFN_vkCmdBeginRenderPass>("vkCmdBeginRenderPass")(commands, &info, VK_SUBPASS_CONTENTS_INLINE);
+        }
+    }
     void release() noexcept {
         const auto device = context.device;
         if (pipeline != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(device, pipeline, nullptr);
@@ -7791,6 +8347,24 @@ void sampleDumpTests(const Device& device, Recorder& recorder) {
     inPassSampleDumpTests(recorder, context, cover, words, address, target);
 }
 
+void uncountedPassTests(const Device& device) {
+    auto context = device.GetContext();
+    context.bufferDeviceAddress = false;
+    Recorder recorder(context);
+    CoverPass cover(context);
+    recorder.CountSamples();
+    Require(!recorder.QueuesSampleDumps(), "a recorder without buffer device addresses counted samples in segments");
+    const auto base = recorder.SamplesTotal();
+    cover.Draw(recorder);
+    recorder.RecordUncounted([&](VkCommandBuffer commands) { cover.Record(commands); });
+    cover.Draw(recorder);
+    recorder.Submit();
+    recorder.Sync();
+    const auto counted = recorder.SamplesTotal() - base;
+    Require(counted != 0, "the draws around an uncounted pass were not counted");
+    if (context.occlusionQueryPrecise) Require(counted == 2 * CoverPass::Samples, "the batch-wide occlusion query counted " + std::to_string(counted) + " samples, not the " + std::to_string(2 * CoverPass::Samples) + " of the two draws around an uncounted pass");
+}
+
 void cmaskPassTests(const Device& device, Recorder& recorder) {
     namespace GuestMemory = AgcDriver::GuestMemory;
     auto context = device.GetContext();
@@ -8484,6 +9058,106 @@ void multisampleGuestAccessTests(const Device& device, Recorder& recorder) {
     std::cout << "Multisampled target guest access tests passed\n";
 }
 
+void oneFragmentFmaskGuardTests(const Device& device) {
+    const auto& base = device.GetContext();
+    if (!device.NullDescriptors()) {
+        std::cout << "nullDescriptor unavailable: one-fragment FMASK guard not tested\n";
+        return;
+    }
+    constexpr std::uint32_t side = 64;
+    constexpr std::size_t bytes = 3u * 65536u;
+#ifdef _WIN32
+    void* block = VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+#else
+    void* block = std::aligned_alloc(65536, bytes);
+#endif
+    Require(block != nullptr, "cannot allocate the one-fragment FMASK block");
+    std::memset(block, 0, bytes);
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, bytes, true, true, true);
+    }
+    struct Unregister {
+        const Context& context;
+        void* block;
+        ~Unregister() {
+            ClearMultisampleTargets(context.device);
+            ClearCachedTextures(context.device);
+            {
+                GuestAllocations::Mutation mutation;
+                mutation.Remove(block);
+            }
+#ifdef _WIN32
+            VirtualFree(block, 0, MEM_RELEASE);
+#else
+            std::free(block);
+#endif
+        }
+    } unregister{base, block};
+    TextureDetiler detiler(base);
+    auto context = base;
+    context.detiler = &detiler;
+    context.nullDescriptors = true;
+    TextureCache cache(context);
+    context.textureCache = &cache;
+    const auto refused = [](const std::function<void()>& access, const std::string& what) {
+        std::string message;
+        try {
+            access();
+        } catch (const std::exception& error) {
+            message = error.what();
+        }
+        Require(message.find("FMASK") != std::string::npos && message.find("one-fragment color target") != std::string::npos, what + " of a host-drawn one-fragment target's FMASK did not throw: " + message);
+    };
+    ColorTarget target{};
+    target.extent = {128, 128};
+    target.samples = 1;
+    target.coverageSamples = 4;
+    target.fmaskAddress = address;
+    GuardOneFragmentFmask(context, target);
+    GuardOneFragmentFmask(context, target);
+    std::array<std::byte, 64> words{};
+    refused([&] { AgcDriver::GuestMemory::Read(address + 256u, words); }, "a CPU read");
+    refused([&] { RequireNoMultisampleTarget(address + 65535u, 1u, "a DMA copy"); }, "a DMA copy of the last guarded byte");
+    RequireNoMultisampleTarget(address + 65536u, 64u, "a DMA copy");
+    ShaderRecompiler::RecompileResult program;
+    ShaderRecompiler::DescriptorBinding binding;
+    binding.kind = ShaderRecompiler::DescriptorKind::SampledImage;
+    binding.role = ShaderRecompiler::DescriptorRole::GuestImages;
+    binding.descriptorSet = 0;
+    binding.binding = ShaderRecompiler::RuntimeAbi::FirstImageBinding;
+    binding.count = 1;
+    binding.imageShape = ShaderRecompiler::DescriptorImageShape::Image2D;
+    binding.imageSamplers = {0};
+    binding.guestDescriptor = {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (56u << 20u) | (((side - 1u) & 3u) << 30u),
+        ((side - 1u) >> 2u) | ((side - 1u) << 14u),
+        0xfacu | (9u << 28u),
+        0u,
+        0u,
+        0u,
+        0u,
+    };
+    program.bindings.push_back(binding);
+    const CompiledShader compute{ShaderRecompiler::ShaderStage::Compute, &program, 0};
+    for (const char* what : {"a texture read", "a repeated texture read"}) {
+        refused([&] {
+            std::lock_guard gpu(GpuMutex());
+            ShaderResources resources(context, compute);
+        }, what);
+    }
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Unmap(block, bytes, [](const void*, std::size_t, const void*, bool) {});
+        mutation.Add(block, bytes, true, true, true);
+    }
+    AgcDriver::GuestMemory::Read(address + 256u, words);
+    RequireNoMultisampleTarget(address, 65536u, "a DMA copy");
+    std::cout << "One-fragment FMASK guard tests passed\n";
+}
+
 void fmaskDecompressMsaaTests(const Device& device, Recorder& recorder) {
     const auto& base = device.GetContext();
     if ((base.limits.framebufferColorSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0 || base.hostImportAlignment == 0) {
@@ -9457,6 +10131,98 @@ bool vertexTargetRangeTests(const Device& device, Recorder& recorder, bool impor
     return true;
 }
 
+std::uint64_t processPrivateBytes() {
+#ifdef _WIN32
+    PROCESS_MEMORY_COUNTERS_EX counters{};
+    counters.cb = sizeof(counters);
+    if (!K32GetProcessMemoryInfo(GetCurrentProcess(), reinterpret_cast<PROCESS_MEMORY_COUNTERS*>(&counters), sizeof(counters))) return 0;
+    return counters.PrivateUsage;
+#else
+    std::ifstream status("/proc/self/status");
+    std::string line;
+    while (std::getline(status, line)) {
+        if (line.rfind("RssAnon:", 0) == 0) return std::stoull(line.substr(8)) * 1024u;
+    }
+    return 0;
+#endif
+}
+
+// What one graphics pipeline the store keeps costs: `count` pipelines, each with its own fragment
+// module (so its own fragment shader library), built through CachedPipeline and held, after their
+// optimized relinks; process private bytes and VK_EXT_memory_budget heap usage before and after,
+// and after the store is cleared.
+int pipelineStoreMemoryBench(const Device& device, std::uint32_t count) {
+    if (!device.Graphics() || count == 0) {
+        std::cout << "skipped, the pipeline store memory bench requires a graphics queue and at least one pipeline\n";
+        return 77;
+    }
+    std::lock_guard gpu(GpuMutex());
+    const auto& context = device.GetContext();
+    struct Cleanup {
+        VkDevice device;
+        ~Cleanup() { ClearCachedPipelines(device); }
+    } cleanup{context.device};
+    ClearCachedPipelines(context.device);
+    ShaderRecompiler::RecompileResult vertex;
+    vertex.variantId = 21;
+    vertex.spirv = std::vector<std::uint32_t>(std::begin(TRIANGLE_vert_SPV), std::end(TRIANGLE_vert_SPV));
+    std::vector<ShaderRecompiler::RecompileResult> fragments(count + 1u);
+    for (std::uint32_t index = 0; index <= count; ++index) {
+        fragments[index].variantId = 1000u + index;
+        fragments[index].spirv = std::vector<std::uint32_t>(std::begin(TRIANGLE_frag_SPV), std::end(TRIANGLE_frag_SPV));
+        fragments[index].spirv[2] = 0x50535430u + index;
+    }
+    State state{};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.hasColorTarget = true;
+    state.color.format = VK_FORMAT_R8G8B8A8_UNORM;
+    state.colors.push_back(state.color);
+    state.blend.colorWriteMask = 15;
+    state.blends.push_back(state.blend);
+    const std::array first{CompiledShader{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, CompiledShader{ShaderRecompiler::ShaderStage::Fragment, &fragments[count], 0}};
+    ShaderResources resources(context, first, state.color, static_cast<std::uint32_t>(state.colors.size()), 0, 0);
+    const VertexInputLayout input;
+    std::vector<std::shared_ptr<Pipeline>> held;
+    held.reserve(count + 1u);
+    const auto build = [&](std::uint32_t index) {
+        const std::array shaders{CompiledShader{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, CompiledShader{ShaderRecompiler::ShaderStage::Fragment, &fragments[index], 0}};
+        held.push_back(CachedPipeline(context, state, input, resources, shaders, VK_IMAGE_LAYOUT_GENERAL));
+    };
+    struct Sample {
+        std::uint64_t privateBytes;
+        std::optional<Device::HeapUsage> heaps;
+    };
+    const auto sample = [&] {
+        WaitForOptimizedPipelines(context.device);
+        return Sample{processPrivateBytes(), device.MemoryUsage()};
+    };
+    build(count);
+    const auto before = sample();
+    const auto started = std::chrono::steady_clock::now();
+    for (std::uint32_t index = 0; index < count; ++index) build(index);
+    const auto built = std::chrono::steady_clock::now();
+    const auto after = sample();
+    const auto linked = std::chrono::steady_clock::now();
+    const auto totals = PipelineStoreTotals();
+    held.clear();
+    ClearCachedPipelines(context.device);
+    const auto cleared = sample();
+    const auto mib = [](std::uint64_t later, std::uint64_t earlier) { return (static_cast<double>(later) - static_cast<double>(earlier)) / (1024.0 * 1024.0); };
+    const auto perPipeline = [&](std::uint64_t later, std::uint64_t earlier) { return (static_cast<double>(later) - static_cast<double>(earlier)) / 1024.0 / count; };
+    const char* linking = !context.graphicsPipelineLibrary ? "whole pipelines" : context.pipelineLinkTimeOptimization ? "libraries and optimized relinks" : "libraries, fast links only";
+    std::cout << std::fixed << std::setprecision(1);
+    std::cout << "Pipeline store memory: " << count << " graphics pipelines (one fragment module each, " << linking << "), " << totals.cached << " in the store, built in "
+              << std::chrono::duration<double>(built - started).count() << " s, relinked in " << std::chrono::duration<double>(linked - built).count() << " s\n";
+    std::cout << "  process private bytes: +" << mib(after.privateBytes, before.privateBytes) << " MiB = " << perPipeline(after.privateBytes, before.privateBytes) << " KiB per pipeline; after clearing the store " << mib(cleared.privateBytes, before.privateBytes) << " MiB above the start\n";
+    if (before.heaps && after.heaps && cleared.heaps) {
+        std::cout << "  VK_EXT_memory_budget heap usage: device-local +" << mib(after.heaps->deviceLocal, before.heaps->deviceLocal) << " MiB = " << perPipeline(after.heaps->deviceLocal, before.heaps->deviceLocal) << " KiB per pipeline, host +" << mib(after.heaps->host, before.heaps->host) << " MiB = " << perPipeline(after.heaps->host, before.heaps->host)
+                  << " KiB per pipeline; after clearing the store device-local " << mib(cleared.heaps->deviceLocal, before.heaps->deviceLocal) << " MiB, host " << mib(cleared.heaps->host, before.heaps->host) << " MiB above the start\n";
+    } else {
+        std::cout << "  VK_EXT_memory_budget unavailable: no device heap usage\n";
+    }
+    return 0;
+}
+
 void pipelineCacheTests(const Device& device, bool benchmark) {
     std::thread establishThreadedProcess([] {});
     establishThreadedProcess.join();
@@ -9525,6 +10291,109 @@ void pipelineCacheTests(const Device& device, bool benchmark) {
     std::cout << "Pipeline cache key and retained lifetime tests passed\n";
 }
 
+struct PipelineCacheFileProbe {
+    Context& context;
+    PFN_vkGetDeviceProcAddr resolver;
+    std::atomic<std::uint32_t> creations{0};
+    static inline PipelineCacheFileProbe* active = nullptr;
+    explicit PipelineCacheFileProbe(Context& context) : context(context), resolver(context.deviceProc) {
+        Require(active == nullptr, "pipeline cache file probe is already active");
+        active = this;
+        context.deviceProc = resolve;
+    }
+    ~PipelineCacheFileProbe() {
+        context.deviceProc = resolver;
+        active = nullptr;
+    }
+    static VKAPI_ATTR VkResult VKAPI_CALL createCache(VkDevice device, const VkPipelineCacheCreateInfo* info, const VkAllocationCallbacks* callbacks, VkPipelineCache* created) {
+        ++active->creations;
+        return reinterpret_cast<PFN_vkCreatePipelineCache>(active->resolver(device, "vkCreatePipelineCache"))(device, info, callbacks, created);
+    }
+    static VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL resolve(VkDevice device, const char* name) {
+        if (std::strcmp(name, "vkCreatePipelineCache") == 0) return reinterpret_cast<PFN_vkVoidFunction>(createCache);
+        return active->resolver(device, name);
+    }
+};
+
+void pipelineCacheHeaderTests(const Device& device) {
+    const auto root = std::filesystem::temp_directory_path() / ("aps5-pipeline-header-test-" + std::to_string(std::random_device{}()));
+    Require(root.native().size() < 225, "the pipeline cache header test requires a temporary root shorter than 225 characters");
+#ifdef _WIN32
+    std::error_code cleanupError;
+    const auto cleanupRoot = ShaderRecompiler::NativeCachePath_nid_no_patch(root, cleanupError);
+    Require(!cleanupError, "the pipeline cache header test could not resolve its cleanup directory");
+#else
+    const auto& cleanupRoot = root;
+#endif
+    struct RemoveDirectory {
+        std::filesystem::path directory;
+        ~RemoveDirectory() {
+            std::error_code error;
+            std::filesystem::remove_all(directory, error);
+        }
+    } removeDirectory{cleanupRoot};
+    auto directory = root;
+    char version[17];
+    std::snprintf(version, sizeof(version), "%016llx", static_cast<unsigned long long>(ShaderRecompiler::ShaderDiskCache::Generated::SourceVersion));
+    while ((directory / version).native().size() < 220) {
+        const auto length = (directory / version).native().size();
+        const auto remaining = 245 > length ? 245 - length : 1;
+        const auto chunk = std::min<std::size_t>(remaining, 16);
+        directory /= std::string(chunk, 'd');
+    }
+    const auto versionDirectory = directory / version;
+    Require(versionDirectory.native().size() >= 220 && versionDirectory.native().size() <= 249, "the pipeline cache directory is not between 220 and 249 characters");
+#ifdef _WIN32
+    _putenv_s("ANYPS5_NO_SHADER_CACHE", "0");
+    _putenv_s("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str());
+#else
+    setenv("ANYPS5_NO_SHADER_CACHE", "0", 1);
+    setenv("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str(), 1);
+#endif
+    auto context = device.GetContext();
+    PipelineCacheFileProbe probe(context);
+    PipelineCache cache(context, device.Properties());
+    cache.SaveNow();
+    std::vector<std::filesystem::path> files;
+    for (const auto& entry : std::filesystem::directory_iterator(versionDirectory)) files.push_back(entry.path());
+    Require(files.size() == 1 && files.front().filename().string().starts_with("vk-pipelines-"), "the long pipeline cache directory does not hold exactly one cache file");
+    Require(files.front().native().size() > 260, "the pipeline cache header test did not exceed MAX_PATH");
+    std::vector<std::byte> stored;
+    Require(ShaderRecompiler::ReadWholeFile(files.front(), stored) && !stored.empty(), "the long pipeline cache file was not persisted");
+    const auto creations = probe.creations.load();
+    for (int repeat = 0; repeat < 3; ++repeat) cache.SaveNow();
+    Require(probe.creations.load() == creations, "an unchanged long-path pipeline cache was reloaded for an idle save");
+    std::vector<std::byte> after;
+    Require(ShaderRecompiler::ReadWholeFile(files.front(), after) && after == stored, "an idle save changed the long pipeline cache file");
+#ifdef _WIN32
+    std::error_code lockError;
+    const auto lockNative = ShaderRecompiler::NativeCachePath_nid_no_patch(files.front(), lockError);
+    Require(!lockError, "could not resolve long cache path");
+    struct FileLockGuard {
+        HANDLE handle = INVALID_HANDLE_VALUE;
+        ~FileLockGuard() {
+            if (handle != INVALID_HANDLE_VALUE) CloseHandle(handle);
+        }
+    } lockGuard{CreateFileW(lockNative.c_str(), GENERIC_READ, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr)};
+    Require(lockGuard.handle != INVALID_HANDLE_VALUE, "could not lock pipeline cache file");
+    std::string capturedStderr;
+    {
+        StderrCapture capture;
+        PipelineCache lockedCache(context, device.Properties());
+        lockedCache.SaveNow();
+        capturedStderr = capture.Finish();
+    }
+    Require(capturedStderr.find("cannot read") != std::string::npos, "an unreadable long pipeline cache file did not report the cannot read diagnostic");
+    if (lockGuard.handle != INVALID_HANDLE_VALUE) {
+        CloseHandle(lockGuard.handle);
+        lockGuard.handle = INVALID_HANDLE_VALUE;
+    }
+    std::vector<std::byte> retained;
+    Require(ShaderRecompiler::ReadWholeFile(files.front(), retained) && retained == stored, "an unreadable long pipeline cache file was overwritten");
+#endif
+    std::cout << "long-path pipeline cache header reused without reloading\n";
+}
+
 int pipelineCacheFileTests(const Device& device) {
     const auto& context = device.GetContext();
     const auto directory = std::filesystem::temp_directory_path() / ("aps5-pipeline-cache-file-test-" + std::to_string(std::random_device{}()));
@@ -9537,7 +10406,7 @@ int pipelineCacheFileTests(const Device& device) {
     } removeDirectory{directory};
 #ifdef _WIN32
     _putenv_s("ANYPS5_NO_SHADER_CACHE", "0");
-    _putenv_s("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str());
+    _wputenv_s(L"ANYPS5_SHADER_CACHE_DIR", directory.wstring().c_str());
 #else
     setenv("ANYPS5_NO_SHADER_CACHE", "0", 1);
     setenv("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str(), 1);
@@ -10189,6 +11058,97 @@ void denormalClearTests(const Device& device, Recorder& recorder) {
     recorder.Sync();
 }
 
+class LibraryCreateFlags {
+public:
+    explicit LibraryCreateFlags(const Context& context) : resolver(context.deviceProc), device(context.device) {
+        create = function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines");
+        active = this;
+    }
+    ~LibraryCreateFlags() { active = nullptr; }
+    LibraryCreateFlags(const LibraryCreateFlags&) = delete;
+    LibraryCreateFlags& operator=(const LibraryCreateFlags&) = delete;
+    PFN_vkGetDeviceProcAddr Resolver() const { return resolve; }
+    std::uint32_t Libraries() const { return libraries.load(); }
+    std::uint32_t Retaining() const { return retaining.load(); }
+
+private:
+    template<typename TFunction>
+    TFunction function(const char* name) const { return reinterpret_cast<TFunction>(resolver(device, name)); }
+    static VKAPI_ATTR VkResult VKAPI_CALL createPipelines(VkDevice device, VkPipelineCache cache, std::uint32_t count, const VkGraphicsPipelineCreateInfo* infos, const VkAllocationCallbacks* callbacks, VkPipeline* pipelines) {
+        const auto result = active->create(device, cache, count, infos, callbacks, pipelines);
+        for (std::uint32_t index = 0; index < count; ++index) {
+            if (pipelines[index] == VK_NULL_HANDLE || (infos[index].flags & VK_PIPELINE_CREATE_LIBRARY_BIT_KHR) == 0) continue;
+            active->libraries.fetch_add(1);
+            if ((infos[index].flags & VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT) != 0) active->retaining.fetch_add(1);
+        }
+        return result;
+    }
+    static VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL resolve(VkDevice device, const char* name) {
+        if (std::strcmp(name, "vkCreateGraphicsPipelines") == 0) return reinterpret_cast<PFN_vkVoidFunction>(createPipelines);
+        return active->resolver(device, name);
+    }
+    PFN_vkGetDeviceProcAddr resolver;
+    VkDevice device;
+    PFN_vkCreateGraphicsPipelines create = nullptr;
+    std::atomic<std::uint32_t> libraries{0};
+    std::atomic<std::uint32_t> retaining{0};
+    static inline LibraryCreateFlags* active = nullptr;
+};
+
+void pipelineLibraryLtoInfoTests(const Device& device) {
+    std::lock_guard gpu(GpuMutex());
+    const auto& context = device.GetContext();
+    LibraryCreateFlags created(context);
+    struct Cleanup {
+        VkDevice device;
+        ~Cleanup() { ClearCachedPipelines(device); }
+    } cleanup{context.device};
+    ClearCachedPipelines(context.device);
+    if (!context.graphicsPipelineLibrary) {
+        std::cout << "graphics pipeline libraries unavailable or disabled: no library retains link-time optimization info\n";
+        return;
+    }
+    ShaderRecompiler::RecompileResult vertex, fragment;
+    vertex.variantId = 41;
+    fragment.variantId = 42;
+    vertex.spirv = std::vector<std::uint32_t>(std::begin(TRIANGLE_vert_SPV), std::end(TRIANGLE_vert_SPV));
+    fragment.spirv = std::vector<std::uint32_t>(std::begin(TRIANGLE_frag_SPV), std::end(TRIANGLE_frag_SPV));
+    const std::array shaders{CompiledShader{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, CompiledShader{ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}};
+    State state{};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.hasColorTarget = true;
+    state.color.format = VK_FORMAT_R8G8B8A8_UNORM;
+    state.colors.push_back(state.color);
+    state.blend.colorWriteMask = 15;
+    state.blends.push_back(state.blend);
+    ShaderResources resources(context, shaders, state.color, static_cast<std::uint32_t>(state.colors.size()), 0, 0);
+    VertexInputLayout input;
+    auto fast = context;
+    fast.deviceProc = created.Resolver();
+    fast.pipelineLinkTimeOptimization = false;
+    auto optimizing = fast;
+    optimizing.pipelineLinkTimeOptimization = true;
+    const bool lto = std::getenv("APS5_NO_PIPELINE_LTO") == nullptr;
+    const auto fastPipeline = CachedPipeline(fast, state, input, resources, shaders, VK_IMAGE_LAYOUT_GENERAL);
+    const auto fastLibraries = created.Libraries();
+    Require(fastLibraries != 0, "the pipeline was not linked from libraries created through the traced device");
+    Require(created.Retaining() == 0, std::to_string(created.Retaining()) + " of the " + std::to_string(fastLibraries) + " libraries made for a context without optimized links were created to retain link-time optimization info");
+    WaitForOptimizedPipelines(context.device);
+    Require(!fastPipeline->Optimized(), "a pipeline of a context without optimized links was optimized in the background");
+    const auto optimizedPipeline = CachedPipeline(optimizing, state, input, resources, shaders, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL);
+    Require(optimizedPipeline != fastPipeline, "the two attachment layouts shared one cached pipeline");
+    const auto libraries = created.Libraries() - fastLibraries;
+    if (lto) {
+        Require(libraries == fastLibraries, "a link that will be optimized made " + std::to_string(libraries) + " libraries, expected " + std::to_string(fastLibraries) + ": it reused libraries made without link-time optimization info");
+        Require(created.Retaining() == libraries, std::to_string(created.Retaining()) + " of the " + std::to_string(libraries) + " libraries of a link that will be optimized were created to retain link-time optimization info");
+    } else {
+        Require(libraries == 0 && created.Retaining() == 0, "with APS5_NO_PIPELINE_LTO set, forcing pipelineLinkTimeOptimization changed the libraries or their create flags");
+    }
+    WaitForOptimizedPipelines(context.device);
+    Require(optimizedPipeline->Optimized() == lto, lto ? "the pipeline linked from libraries that retain link-time optimization info was not optimized in the background" : "a pipeline was optimized with APS5_NO_PIPELINE_LTO set");
+    std::cout << "Pipeline library link-time optimization info tests passed: " << fastLibraries << " libraries without the info, " << created.Retaining() << " with it\n";
+}
+
 void pipelineLibraryTests(const Device& device) {
     std::lock_guard gpu(GpuMutex());
     const auto& context = device.GetContext();
@@ -10484,7 +11444,7 @@ int main(int argc, char** argv) {
         }
         std::unique_ptr<Device> created;
         try {
-            created = std::make_unique<Device>(argc == 2 && (std::string_view(argv[1]) == "--import-watch-other-family-only" || std::string_view(argv[1]) == "--deferred-settle-other-family-only" || std::string_view(argv[1]) == "--host-import-lifetime-other-family-only"));
+            created = std::make_unique<Device>(argc == 2 && (std::string_view(argv[1]) == "--import-watch-other-family-only" || std::string_view(argv[1]) == "--deferred-settle-other-family-only" || std::string_view(argv[1]) == "--host-import-lifetime-other-family-only" || std::string_view(argv[1]) == "--settle-write-order-other-family-only"));
         } catch (const std::exception& error) {
             if (std::getenv("ANYPS5_REQUIRE_VULKAN") != nullptr) throw;
             std::cout << "skipped, no usable Vulkan device: " << error.what() << '\n';
@@ -10508,6 +11468,14 @@ int main(int argc, char** argv) {
             importWatchTests(device);
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--settle-initial-dcc-only") {
+#ifdef _WIN32
+            return settleInitialDccTests(device) ? 0 : 77;
+#else
+            std::cout << "skipped, the device has no deferred settle of host imports: imports under 1 MiB wait for one only on Windows\n";
+            return 77;
+#endif
+        }
 #ifdef _WIN32
         if (argc == 2 && std::string_view(argv[1]) == "--host-import-lifetime-other-family-only") {
             if (device.GetContext().settleFamily == device.GetContext().queueFamily) {
@@ -10523,6 +11491,14 @@ int main(int argc, char** argv) {
             }
             return deferredSettleTests(device) ? 0 : 77;
         }
+        if (argc == 2 && (std::string_view(argv[1]) == "--settle-write-order-only" || std::string_view(argv[1]) == "--settle-write-order-other-family-only")) {
+            if (std::string_view(argv[1]) == "--settle-write-order-other-family-only" && device.GetContext().settleFamily == device.GetContext().queueFamily) {
+                std::cout << "skipped, no other queue family to settle imports on\n";
+                return 77;
+            }
+            return settleWriteOrderTests(device) ? 0 : 77;
+        }
+        if (argc == 2 && std::string_view(argv[1]) == "--settle-wait-failure-only") return settleWaitFailureTests(device) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--settle-first-use-only") return settleFirstUseTests(device) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--settle-earlier-import-only") return settleEarlierImportTests(device) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--settle-retire-only") return settleRetireTests(device) ? 0 : 77;
@@ -10553,10 +11529,15 @@ int main(int argc, char** argv) {
             }
             return sparseRunImportTests(device, true) ? 0 : 77;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--pipeline-library-lto-info-only") {
+            pipelineLibraryLtoInfoTests(device);
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--pipeline-library-only") {
             pipelineLibraryTests(device);
             return 0;
         }
+        if ((argc == 2 || argc == 3) && std::string_view(argv[1]) == "--benchmark-pipeline-store-memory") return pipelineStoreMemoryBench(device, argc == 3 ? static_cast<std::uint32_t>(std::stoul(argv[2])) : 4096u);
         if (argc == 2 && (std::string_view(argv[1]) == "--benchmark-pipeline-cache" || std::string_view(argv[1]) == "--pipeline-cache-only")) {
             pipelineCacheTests(device, std::string_view(argv[1]) == "--benchmark-pipeline-cache");
             return 0;
@@ -10566,6 +11547,11 @@ int main(int argc, char** argv) {
             return pipelineCacheFileTests(device);
         }
 
+        if (argc == 2 && std::string_view(argv[1]) == "--pipeline-cache-header-only") {
+            pipelineCacheHeaderTests(device);
+            return 0;
+        }
+
         if (argc == 2 && std::string_view(argv[1]) == "--descriptor-pool-only") {
             descriptorPoolTests(device);
             return 0;
@@ -10586,6 +11572,12 @@ int main(int argc, char** argv) {
         std::cout << "host imports " << (PrepareImportWatch(device.GetContext()) == ImportWatch::Unwatch ? "are compared" : "stay watched") << '\n';
         Recorder recorder(device.GetContext());
         recorder.Activate();
+        if (argc == 2 && std::string_view(argv[1]) == "--command-reuse-only") {
+            if (device.GetContext().hostImportAlignment == 0) return 77;
+            const auto before = Recorder::StoreCounts().stores;
+            storeRunTests(device, recorder);
+            return Recorder::StoreCounts().stores != before ? 0 : 77;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--copied-direct-only") {
             copiedDirectOrderingTests(device, recorder);
             return 0;
@@ -10787,6 +11779,15 @@ int main(int argc, char** argv) {
             std::cout << "Occlusion counter dump tests passed\n";
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--uncounted-passes-only") {
+            if (!device.Graphics()) {
+                std::cout << "skipped, the test queue has no graphics\n";
+                return 77;
+            }
+            uncountedPassTests(device);
+            std::cout << "Uncounted pass tests passed\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--shadowed-key-stores-only") {
             if (!shadowedKeyStoreTests(device, recorder)) {
                 std::cout << "skipped, the device imports no watched host memory under a unit shadow\n";
@@ -10807,6 +11808,7 @@ int main(int argc, char** argv) {
         }
         if (argc == 2 && std::string_view(argv[1]) == "--multisample-only") {
             multisampleGuestAccessTests(device, recorder);
+            oneFragmentFmaskGuardTests(device);
             fmaskDecompressMsaaTests(device, recorder);
             return 0;
         }
@@ -10825,6 +11827,7 @@ int main(int argc, char** argv) {
         }
         if (argc == 2 && std::string_view(argv[1]) == "--draw-snapshot-cap-only") {
             drawSnapshotCapTests(device, recorder);
+            containingSnapshotTests(device);
             unwrittenSnapshotTests(device);
             drawSnapshotUploadTests(device, recorder);
             std::cout << "Draw snapshot cap tests passed\n";
@@ -10867,6 +11870,7 @@ int main(int argc, char** argv) {
         bdaStagingTests(device, recorder);
         depthSurfaceProofTests(device, recorder);
         multisampleGuestAccessTests(device, recorder);
+        oneFragmentFmaskGuardTests(device);
         tiledResolveTests(device, recorder);
         fmaskDecompressMsaaTests(device, recorder);
         misalignedSnapshotTests(device, recorder);
@@ -10877,6 +11881,7 @@ int main(int argc, char** argv) {
         imageTableFirstLayerRevalidateTests(device, recorder);
         drawSnapshotCapTests(device, recorder);
         drawSnapshotEvictionTests(device);
+        containingSnapshotTests(device);
         unwrittenSnapshotTests(device);
         drawSnapshotUploadTests(device, recorder);
         drawInputReuseTests(device, recorder);
diff --git a/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp b/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp
index a17b7cf87d..202aa559ae 100644
--- a/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp
@@ -1,4 +1,5 @@
 #include "IntermediateRepresentation/IrProgram.hpp"
+#include "Optimization/DeadCodeEliminator.hpp"
 #include "Optimization/RedundantValueEliminator.hpp"
 #include "Recompiler.hpp"
 #include <array>
@@ -208,7 +209,8 @@ std::vector<std::uint32_t> Recompiled(std::span<const std::uint32_t> code) {
     request.target.maxWorkgroupSharedMemoryBytes = 49152;
     request.layout = {0, 0, 0, 128};
     request.useCache = false;
-    const auto& words = Recompile(request).spirv.Words();
+    const auto result = Recompile(request);
+    const auto& words = result.spirv.Words();
     return {words.begin(), words.end()};
 }
 
@@ -324,6 +326,149 @@ int main() {
         return b.eliminate() == 1u && !dominated.HasUses() && first.UseCount() == 2u && AllUsed({&thenOnly, &sibling, &merged});
     });
 
+    passed &= run("GetSrtResource and ReadConst with the same operands merge in a dominated block, while another slot or a sibling block stays", [] {
+        Builder b;
+        IrBlock& head = *b.block;
+        IrBlock& then = b.newBlock();
+        IrBlock& otherwise = b.newBlock();
+        IrBlock& merge = b.newBlock();
+        head.AddBranch(&then);
+        head.AddBranch(&otherwise);
+        then.AddBranch(&merge);
+        otherwise.AddBranch(&merge);
+        auto& srtHead = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(0u)});
+        auto& readHead = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtHead, &b.constant(2u)});
+        b.keep(readHead);
+        b.block = &then;
+        auto& srtDominated = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(0u)});
+        auto& readDominated = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtDominated, &b.constant(2u)});
+        auto& readOtherSlot = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtDominated, &b.constant(3u)});
+        auto& srtThenOnly = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(1u)});
+        auto& readThenOnly = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtThenOnly, &b.constant(4u)});
+        b.keep(readDominated);
+        b.keep(readOtherSlot);
+        b.keep(readThenOnly);
+        b.block = &otherwise;
+        auto& srtSibling = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(1u)});
+        auto& readSibling = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtSibling, &b.constant(4u)});
+        b.keep(readSibling);
+        b.block = &merge;
+        auto& srtMerge = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(0u)});
+        auto& readMerge = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtMerge, &b.constant(2u)});
+        b.keep(readMerge);
+        return b.eliminate() == 4u && !srtDominated.HasUses() && !readDominated.HasUses() && !srtMerge.HasUses() && !readMerge.HasUses() && srtHead.UseCount() == 4u && readHead.UseCount() == 3u && AllUsed({&readOtherSlot, &srtThenOnly, &readThenOnly, &srtSibling, &readSibling});
+    });
+
+    passed &= run("two ReadConst instructions of the same slot separated by a store to the table address stay", [] {
+        Builder b;
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& first = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        auto& second = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(first);
+        b.keep(second);
+        return b.eliminate() == 0u && AllUsed({&first, &second});
+    });
+
+    passed &= run("a store on one branch keeps ReadConst in the merge block while the clean sibling branch reuses the head read", [] {
+        Builder b;
+        IrBlock& head = *b.block;
+        IrBlock& then = b.newBlock();
+        IrBlock& otherwise = b.newBlock();
+        IrBlock& merge = b.newBlock();
+        head.AddBranch(&then);
+        head.AddBranch(&otherwise);
+        then.AddBranch(&merge);
+        otherwise.AddBranch(&merge);
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& readHead = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readHead);
+        b.block = &then;
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        auto& readThenAfterStore = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readThenAfterStore);
+        b.block = &otherwise;
+        auto& readOtherwise = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readOtherwise);
+        b.block = &merge;
+        auto& readMerge = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readMerge);
+        return b.eliminate() == 1u && !readOtherwise.HasUses() && readHead.UseCount() == 2u && AllUsed({&readHead, &readThenAfterStore, &readMerge});
+    });
+
+    passed &= run("a store on a loop backedge prevents reusing a pre-loop ReadConst in the loop header", [] {
+        Builder b;
+        IrBlock& header = b.newBlock();
+        IrBlock& body = b.newBlock();
+        IrBlock& exit = b.newBlock();
+        b.block->AddBranch(&header);
+        header.AddBranch(&body);
+        header.AddBranch(&exit);
+        body.AddBranch(&header);
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& beforeLoop = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(beforeLoop);
+        b.block = &header;
+        auto& inHeader = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inHeader);
+        b.block = &body;
+        auto& inBodyBeforeStore = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        auto& inBodyAfterStore = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inBodyBeforeStore);
+        b.keep(inBodyAfterStore);
+        b.block = &exit;
+        auto& afterLoop = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(afterLoop);
+        return b.eliminate() == 2u && !inBodyBeforeStore.HasUses() && !afterLoop.HasUses() && beforeLoop.UseCount() == 1u && inHeader.UseCount() == 3u && AllUsed({&beforeLoop, &inHeader, &inBodyAfterStore});
+    });
+
+    passed &= run("a store in an inner loop propagates to the outer loop header across fixed-point iterations", [] {
+        Builder b;
+        IrBlock& outerHeader = b.newBlock();
+        IrBlock& innerHeader = b.newBlock();
+        IrBlock& innerBody = b.newBlock();
+        IrBlock& outerLatch = b.newBlock();
+        IrBlock& exit = b.newBlock();
+        b.block->AddBranch(&outerHeader);
+        outerHeader.AddBranch(&innerHeader);
+        outerHeader.AddBranch(&exit);
+        innerHeader.AddBranch(&innerBody);
+        innerHeader.AddBranch(&outerLatch);
+        innerBody.AddBranch(&innerHeader);
+        outerLatch.AddBranch(&outerHeader);
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& beforeOuter = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(beforeOuter);
+        b.block = &outerHeader;
+        auto& inOuterHeader = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inOuterHeader);
+        b.block = &innerHeader;
+        auto& inInnerHeader = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inInnerHeader);
+        b.block = &innerBody;
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        b.block = &outerLatch;
+        auto& inOuterLatch = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inOuterLatch);
+        b.block = &exit;
+        auto& inExit = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inExit);
+        return b.eliminate() == 2u && !inOuterLatch.HasUses() && !inExit.HasUses() && beforeOuter.UseCount() == 1u && inOuterHeader.UseCount() == 2u && inInnerHeader.UseCount() == 2u && AllUsed({&beforeOuter, &inOuterHeader, &inInnerHeader});
+    });
+
     passed &= run("a loop body reuses a value of its header, the loop exit does not reuse a value of the body", [] {
         Builder b;
         IrBlock& header = b.newBlock();
@@ -362,6 +507,55 @@ int main() {
         return b.eliminate() == 1u && b.program.Metadata().blockInfo.front().condition == &first;
     });
 
+    passed &= run("descriptor dwords name the surviving values after redundancy and dead code elimination", [] {
+        Builder b;
+        auto& input = b.unknown();
+        DescriptorSource descriptor;
+        descriptor.dwordCount = 8u;
+        std::array<IrValue*, 8> kept{};
+        std::array<IrValue*, 8> removed{};
+        for (std::uint32_t index = 0; index < 8u; ++index) {
+            auto& first = b.emit(IrOpcode::IAdd32, IrType::U32, {&input, &b.constant(index + 1u)});
+            auto& second = b.emit(IrOpcode::IAdd32, IrType::U32, {&input, &b.constant(index + 1u)});
+            b.keep(first);
+            b.keep(second);
+            descriptor.dwords[index] = &second;
+            kept[index] = &first;
+            removed[index] = &second;
+        }
+        b.program.Resources().descriptorSources.push_back(descriptor);
+        b.program.Resources().descriptorSources.emplace_back();
+        if (b.eliminate() != 8u) return false;
+        DeadCodeEliminator{}.Eliminate(b.program);
+        const auto& descriptors = b.program.Resources().descriptorSources;
+        for (std::size_t index = 0; index < kept.size(); ++index) {
+            if (descriptors[0].dwords[index] != kept[index] || kept[index]->Parent() != b.block || removed[index]->Parent() != nullptr || descriptors[1].dwords[index] != nullptr) return false;
+        }
+        return true;
+    });
+
+    passed &= run("a selected table column keeps its surviving runtime offset", [] {
+        Builder b;
+        auto& input = b.unknown();
+        auto& first = b.emit(IrOpcode::IMul32, IrType::U32, {&input, &b.constant(48u)});
+        auto& second = b.emit(IrOpcode::IMul32, IrType::U32, {&input, &b.constant(48u)});
+        b.keep(first);
+        b.keep(second);
+        DescriptorSource selection;
+        selection.dwordCount = 1u;
+        selection.dwords[0] = &second;
+        DescriptorSource image;
+        image.tableColumn.emplace();
+        image.tableColumn->selected = true;
+        image.tableColumn->selection = 0u;
+        b.program.Resources().descriptorSources = {selection, image};
+        if (b.eliminate() != 1u) return false;
+        DeadCodeEliminator{}.Eliminate(b.program);
+        const auto& descriptors = b.program.Resources().descriptorSources;
+        const auto selected = descriptors[1].tableColumn->selection;
+        return descriptors[selected].dwords[0] == &first && first.Parent() == b.block && second.Parent() == nullptr;
+    });
+
     passed &= run("lane reads are not merged", [] {
         Builder b;
         auto& first = b.unknown();
diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp
index 8ef8dfde37..cc86441030 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp
@@ -62,11 +62,19 @@ void setEnvironment(const char* name, const std::string& value) {
 #endif
 }
 
+void setPathEnvironment(const char* name, const std::filesystem::path& value) {
+#ifdef _WIN32
+    _wputenv_s(std::filesystem::path(name).wstring().c_str(), value.wstring().c_str());
+#else
+    setenv(name, value.c_str(), 1);
+#endif
+}
+
 #ifdef _WIN32
 void verifyHostStandardError() {
     const auto directory = std::filesystem::temp_directory_path() / ("aps5-shader-host-stderr-" + std::to_string(std::random_device{}()));
     setEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
-    setEnvironment("ANYPS5_SHADER_CACHE_DIR", directory.string());
+    setPathEnvironment("ANYPS5_SHADER_CACHE_DIR", directory);
     int capture[2], guest[2];
     require(::_pipe(capture, 65536, _O_BINARY) == 0, "cannot create host capture");
     require(::_pipe(guest, 65536, _O_BINARY) == 0, "cannot create guest capture");
@@ -148,6 +156,7 @@ void requireSameArtifact(const CompiledShaderArtifact& left, const CompiledShade
     require(left.parameterExports == right.parameterExports, prefix + "parameter exports differ");
     require(left.stencilReferences == right.stencilReferences, prefix + "stencil reference set differs");
     require(left.stencilReplaySafe == right.stencilReplaySafe, prefix + "stencil replay proof differs");
+    require(left.bdaWrites == right.bdaWrites, prefix + "BDA write flag differs");
     require(left.stencilReferenceDword == right.stencilReferenceDword, prefix + "stencil replay push offset differs");
     require(left.fragmentParameters.size() == right.fragmentParameters.size(), prefix + "fragment parameter count differs");
     for (std::size_t i = 0; i < left.fragmentParameters.size(); ++i) {
@@ -259,6 +268,7 @@ RecompileResult sampleResult() {
     result.fragmentParameters = {{0, 1, true, false, true}, {2, 3, false, true}};
     result.stencilReferences = {0u, 17u, 255u};
     result.stencilReplaySafe = true;
+    result.bdaWrites = true;
     result.stencilReferenceDword = 23u;
     result.poisonedSrtReads = 3;
     result.shaderDataUserWords = {2u, 0xffffffffu, 9u};
@@ -322,6 +332,7 @@ CompiledVariant sampleVariant() {
     image.volumeArraySampleCompatible = true;
     image.flatLineCompatible = false;
     image.flatVolumeLineCompatible = false;
+    image.dimensionQueryOnly = false;
     image.foldTexelOffsetsOnly = true;
     image.remappedDepth1D = true;
     image.byElements = 4;
@@ -748,6 +759,7 @@ void verifyKeySensitivity() {
     changes("spanned waves", [](SampleRequest& sample) { sample.request.target.spannedWaves = true; });
     changes("robust buffer access 2", [](SampleRequest& sample) { sample.request.target.robustBufferAccess2 = true; });
     changes("wave LDS memory barriers", [](SampleRequest& sample) { sample.request.target.waveLdsMemoryBarriers = true; });
+    changes("device-scope LDS memory barriers", [](SampleRequest& sample) { sample.request.target.deviceScopeLdsMemoryBarriers = true; });
     changes("the workgroup size limit", [](SampleRequest& sample) { sample.request.target.maxWorkgroupSize[2] = 128; });
     changes("the invocation limit", [](SampleRequest& sample) { sample.request.target.maxWorkgroupInvocations = 512; });
     changes("the shared memory limit", [](SampleRequest& sample) { sample.request.target.maxWorkgroupSharedMemoryBytes = 32768; });
@@ -1070,7 +1082,7 @@ void verifyLongHostPaths() {
     const auto extended = [](const auto& path) { return std::filesystem::path(L"\\\\?\\" + path.native()); };
     std::filesystem::create_directories(extended(directory));
     setEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
-    setEnvironment("ANYPS5_SHADER_CACHE_DIR", directory.string());
+    setPathEnvironment("ANYPS5_SHADER_CACHE_DIR", directory);
     std::vector<std::filesystem::path> files;
     std::filesystem::path entries;
     struct Cleanup {
@@ -2117,6 +2129,36 @@ void verifyMalformedPlans() {
     require(!ShaderDiskCache::EncodePlan(unblocked, bytes), "a phi without predecessor blocks was encoded");
 }
 
+void verifySharedPlans() {
+    auto fixture = planFixtures().front();
+    const auto request = fixture.Request(false);
+    const auto plan = GetResourcePlan(request);
+    const std::vector<std::byte> first{std::byte{0x5a}, std::byte{0x01}, std::byte{0x02}};
+    const std::vector<std::byte> second{std::byte{0x5a}, std::byte{0x01}, std::byte{0x03}};
+    for (const auto* key : {&first, &second}) {
+        const auto entry = ShaderDiskCache::EncodePlanEntry(*key, *plan);
+        require(WriteFileAtomically(ShaderDiskCache::EntryDirectory() / ShaderDiskCache::EntryName(*key), entry), "cannot write the shared plan entries");
+    }
+    constexpr std::uint64_t address = 0x7000u;
+    IrResourcePlan expected;
+    require(ShaderDiskCache::DecodePlan(encodedPlan(*plan), expected), "the shared plan fixture does not decode");
+    expected.shaderHash = address;
+    const auto hits = ShaderDiskCache::Totals().planHits;
+    auto a = ShaderDiskCache::LoadSharedPlan(first, address);
+    auto b = ShaderDiskCache::LoadSharedPlan(second, address);
+    require(a != nullptr && b != nullptr && ShaderDiskCache::Totals().planHits == hits + 2u, "the shared plan entries did not load");
+    require(a.get() == b.get(), "two plan entries with the same payload for one shader decoded into separate plans");
+    require(samePlan(*a, expected), "a shared plan differs from the stored plan");
+    const auto other = ShaderDiskCache::LoadSharedPlan(second, address + 0x100u);
+    require(other != nullptr && other.get() != a.get() && other->shaderHash == address + 0x100u && a->shaderHash == address, "a plan of another shader address was shared");
+    const std::weak_ptr<const IrResourcePlan> released = a;
+    a.reset();
+    b.reset();
+    require(released.expired(), "the shared plan table kept a plan no source uses");
+    const auto again = ShaderDiskCache::LoadSharedPlan(first, address);
+    require(again != nullptr && samePlan(*again, expected), "a released shared plan did not load again");
+}
+
 void verifyPlanRoundTrip() {
     const auto handBuilt = handBuiltPlan();
     const auto handBytes = encodedPlan(handBuilt);
@@ -2496,7 +2538,7 @@ int main(int argc, char** argv) {
         std::filesystem::remove_all(directory);
         verifyDefaultDirectory(argv[0]);
         setEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
-        setEnvironment("ANYPS5_SHADER_CACHE_DIR", directory.string());
+        setPathEnvironment("ANYPS5_SHADER_CACHE_DIR", directory);
         verifyAtomicReplacement(directory);
         verifyResultRoundTrip();
         verifyEntryRoundTrip();
@@ -2507,6 +2549,7 @@ int main(int argc, char** argv) {
         verifyFloatModeSerialization();
         verifyPlanRoundTrip();
         verifyPlanKey();
+        verifySharedPlans();
         verifyStore();
         verifyPersist();
         verifyAcrossProcesses(argv[0]);
diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp
index e206810771..2a31594300 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp
@@ -47,6 +47,7 @@
 #include <atomic>
 #include <functional>
 #include <new>
+#include <chrono>
 #include <thread>
 #include <string>
 #include <string_view>
@@ -170,7 +171,6 @@ void verifyFrontendIdentity() {
     require((preparation.AcquireFrontend(partial) == first) == reuse, "frontend pair: partial-thread state changed the frontend identity");
     auto target = request;
     target.target.subgroupSize = 64u;
-    target.context.waveSize = 32u;
     target.context.compute->numThreads = {32u, 2u, 1u};
     require((preparation.AcquireFrontend(target) == first) == reuse, "frontend pair: translation-only state changed the frontend identity");
     const std::array<std::uint32_t, 2> changedUserData{1u, 2u};
@@ -199,6 +199,10 @@ void verifyFrontendIdentity() {
     changed.context.userDataBaseRegister = 4u;
     verifyMiss(changed, "frontend pair: changed user-data base reused the frontend");
     changed = request;
+    changed.context.waveSize = 32u;
+    changed.context.compute->numThreads = {32u, 2u, 1u};
+    verifyMiss(changed, "frontend pair: a different wave size reused the frontend");
+    changed = request;
     changed.context.userData = std::span<const std::uint32_t>(userData).first(1u);
     verifyMiss(changed, "frontend pair: changed user-data count reused the frontend");
     changed = request;
@@ -224,6 +228,25 @@ void verifyFrontendIdentity() {
     require((preparation.AcquireFrontend(request) == first) == reuse, "frontend pair: a failed miss replaced the prior frontend");
 }
 
+void verifyFrontendWaveSizeCalls() {
+    using namespace ShaderRecompiler;
+    const std::vector<std::uint32_t> code{
+        0xbb0e0005u,
+        0xd4c2000eu, 0x00020300u,
+        0xd5010002u, 0x003a0300u,
+        0xbf820001u,
+        0xbe80200eu,
+        0xbf810000u};
+    const std::array<std::uint32_t, 2> userData{};
+    for (const std::uint32_t waveSize : {32u, 64u}) {
+        auto request = FrontendRequest(code, userData);
+        request.context.waveSize = waveSize;
+        request.context.compute->numThreads = {waveSize, 1u, 1u};
+        ShaderPreparationContext preparation;
+        require(preparation.AcquireFrontend(request) != nullptr, "frontend wave size: a mask write that reuses the link pair and its v_cndmask read were refused");
+    }
+}
+
 void verifyFrontendProgram(const ShaderRecompiler::IrProgram& reused, const ShaderRecompiler::IrProgram& fresh) {
     using namespace ShaderRecompiler;
     require(ProgramToString(reused) == ProgramToString(fresh), "frontend pair: reused frontend changed the IR");
@@ -258,6 +281,7 @@ void verifyFrontendProgram(const ShaderRecompiler::IrProgram& reused, const Shad
 void verifyFrontendPair() {
     using namespace ShaderRecompiler;
     verifyFrontendIdentity();
+    verifyFrontendWaveSizeCalls();
     const bool reuse = std::getenv("APS5_NO_PERF_FRONTEND_PAIR") == nullptr;
     const std::vector<std::uint32_t> code{0xe0700000u, 0x80000000u, 0xbf810000u};
     const std::array<std::uint32_t, 4> buffer{0x10000000u, 0u, 0x40u, 0x00027facu};
@@ -320,7 +344,7 @@ void verifyFrontendPair() {
         const auto freshChanged = PrepareResourceProgram(translated);
         verifyFrontendProgram(changed, freshChanged);
         require(changed.WaveSize() != freshFull.WaveSize(), "frontend pair: changed translation inputs were ignored");
-        require((preparation.AcquireFrontend(request) == retained) == reuse, "frontend pair: translating a variant replaced the frontend");
+        require(preparation.AcquireFrontend(request) != retained, "frontend pair: a variant with another wave size reused the frontend");
     }
 
     for (const bool partialFirst : {false, true}) {
@@ -383,6 +407,120 @@ void verifyFrontendPair() {
     }
 }
 
+void verifySpecializedModuleRelease() {
+    using namespace ShaderRecompiler;
+    const std::array<std::uint32_t, 1> color{0x3f800000u};
+    const std::vector<std::uint32_t> code{0xbf800003u, 0x7e000200u, 0xf800180fu, 0u, 0xbf810000u};
+    auto pixel = FrontendRequest(code, color);
+    pixel.shader.stage = ShaderStage::Fragment;
+    pixel.context.compute.reset();
+    pixel.context.pixel = ShaderPixelStageInfo{};
+    pixel.context.pixel->wave32 = true;
+    pixel.context.pixel->targetOutputMode[0] = 9u;
+    pixel.context.waveSize = 32u;
+    pixel.useCache = true;
+    SharedSpirv::Weak released;
+    std::uint64_t specializationId = 0;
+    std::vector<std::uint32_t> words;
+    {
+        const auto first = Recompile(pixel);
+        require(first.specializationId != 0u, "specialized module release: the pixel fixture was not specialized");
+        released = first.spirv.Weaken();
+        specializationId = first.specializationId;
+        words = first.spirv.Copy();
+    }
+    require(released.Expired(), "specialized module release: the module caches kept the words of a module no result uses");
+    const auto again = Recompile(pixel);
+    require(again.specializationId == specializationId, "specialized module release: a module built again from its key got another specialization ID");
+    require(std::ranges::equal(again.spirv.Words(), words), "specialized module release: a module built again from its key has other words");
+    const auto shared = Recompile(pixel);
+    require(shared.spirv.data() == again.spirv.data(), "specialized module release: a second result of a live module copied its words");
+}
+
+const std::vector<std::uint32_t>& resultMemoPixelCode() {
+    static const std::vector<std::uint32_t> code{0xbf800000u, 0x7e000200u, 0xf800180fu, 0u, 0xbf810000u};
+    return code;
+}
+
+bool compileResultMemoPixel(std::uint32_t value) {
+    using namespace ShaderRecompiler;
+    std::array<std::uint32_t, 1> color{value};
+    auto request = FrontendRequest(resultMemoPixelCode(), color);
+    request.shader.stage = ShaderStage::Fragment;
+    request.context.compute.reset();
+    request.context.pixel = ShaderPixelStageInfo{};
+    request.context.pixel->wave32 = true;
+    request.context.pixel->targetOutputMode[0] = 9u;
+    request.context.waveSize = 32u;
+    request.useCache = true;
+    AgcDriver::ShaderMemory memory({});
+    const auto capture = memory.Capture(request);
+    const auto regions = memory.Regions();
+    request.context.memory = regions;
+    bool hit = false;
+    static_cast<void>(Recompile(request, *capture, &hit));
+    return hit;
+}
+
+void verifyResultMemoBudgetThreads() {
+    using namespace ShaderRecompiler;
+    require(!compileResultMemoPixel(1u) && compileResultMemoPixel(1u), "result memo budget threads: the memo did not keep a result");
+    const auto one = ResultMemoBytes();
+    const auto budget = 3u * one;
+    SetResultMemoBudget(budget);
+    static_cast<void>(compileResultMemoPixel(2u));
+    static_cast<void>(compileResultMemoPixel(3u));
+    require(ResultMemoBytes() == budget, "result memo budget threads: three results did not fill a budget of three");
+    std::vector<std::thread> late;
+    SetResultMemoTrimHook([&] {
+        const auto before = ResultMemoBytes();
+        for (const auto value : {5u, 6u}) late.emplace_back([value] { static_cast<void>(compileResultMemoPixel(value)); });
+        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(30);
+        while (ResultMemoBytes() < before + 2u * one && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    });
+    static_cast<void>(compileResultMemoPixel(4u));
+    for (auto& thread : late) thread.join();
+    require(late.size() == 2u, "result memo budget threads: the fourth result did not start a trim");
+    require(ResultMemoBytes() <= budget, "result memo budget threads: results inserted during a trim left the memo over its budget");
+    SetResultMemoBudget(0u);
+}
+
+void verifyResultMemoBudgetMasked() {
+    using namespace ShaderRecompiler;
+    require(ResultMemoBytes() == 0u, "result memo budget masked: the memo held results before the first compile");
+    require(!compileResultMemoPixel(1u), "result memo budget masked: the first compile hit the memo");
+    const auto first = ResultMemoBytes();
+    require(!compileResultMemoPixel(2u), "result memo budget masked: a new snapshot hit the memo");
+    const auto second = ResultMemoBytes() - first;
+    require(second != 0u && second < first, std::string("result memo budget masked: the masked table's entry was not counted (first result " + std::to_string(first) + " bytes, patched result " + std::to_string(second) + ")").c_str());
+    SetResultMemoBudget(1u);
+    require(ResultMemoBytes() == 0u, std::string("result memo budget masked: a trim to one byte left " + std::to_string(ResultMemoBytes()) + " bytes").c_str());
+    SetResultMemoBudget(0u);
+    require(!compileResultMemoPixel(3u), "result memo budget masked: a snapshot after the trim hit the memo");
+    require(ResultMemoBytes() == first, std::string("result memo budget masked: the trim left a masked entry to patch from (" + std::to_string(ResultMemoBytes()) + " bytes after one compile, " + std::to_string(first) + " for a full one)").c_str());
+}
+
+void verifyResultMemoBudget() {
+    using namespace ShaderRecompiler;
+    const auto compile = [](std::uint32_t value) { return compileResultMemoPixel(value); };
+    require(ResultMemoBytes() == 0u, "result memo budget: the memo held results before the first compile");
+    require(!compile(1u) && compile(1u), "result memo budget: the memo did not keep a result");
+    const auto one = ResultMemoBytes();
+    require(one != 0u, "result memo budget: a memo'd result counted no bytes");
+    const auto budget = 3u * one;
+    SetResultMemoBudget(budget);
+    for (const auto value : {2u, 3u, 4u}) {
+        require(!compile(value), "result memo budget: a new snapshot hit the memo");
+        require(ResultMemoBytes() <= budget, "result memo budget: the memo holds more than its budget");
+    }
+    require(ResultMemoBytes() < budget, "result memo budget: a fourth result over a budget of three was not trimmed");
+    require(compile(4u) && compile(3u), "result memo budget: the most recently used results were dropped");
+    require(!compile(1u), "result memo budget: the least recently used result outlived the trim");
+    SetResultMemoBudget(0u);
+    for (const auto value : {5u, 6u, 7u}) static_cast<void>(compile(value));
+    require(ResultMemoBytes() > budget, "result memo budget: clearing the budget kept bounding the memo");
+}
+
 ShaderRecompiler::RecompileRequest LayoutPairRequest(std::span<const std::uint32_t> code, std::span<const std::uint32_t> userData, bool registration, std::uint32_t wordLimit) {
     using namespace ShaderRecompiler;
     auto request = FrontendRequest(code, userData);
@@ -544,6 +682,297 @@ void verifyRegisterSources() {
     require(!EquivalentValue(plan, &samplerRegister, &firstVector), "different register types were merged");
 }
 
+void verifyPlanConditionPruning() {
+    using namespace ShaderRecompiler;
+    std::vector<std::unique_ptr<IrValue>> values;
+    std::uint32_t ids = 0;
+    const auto make = [&](IrOpcode opcode, IrType type) -> IrValue& {
+        values.push_back(std::make_unique<IrValue>(opcode, type, ids++));
+        return *values.back();
+    };
+    const auto constant = [&](std::uint32_t value) -> IrValue& {
+        auto& immediate = make(IrOpcode::Void, IrType::U32);
+        immediate.SetImmediateU32(value);
+        return immediate;
+    };
+    const auto userData = [&](std::uint32_t index) -> IrValue& {
+        auto& reg = make(IrOpcode::Void, IrType::ScalarReg);
+        reg.SetRegister({RegisterBank::Scalar, index});
+        auto& read = make(IrOpcode::GetUserData, IrType::U32);
+        read.AddArgument(&reg);
+        return read;
+    };
+    const auto equal = [&](IrValue& left, IrValue& right) -> IrValue& {
+        auto& compare = make(IrOpcode::IEqual32, IrType::Bool);
+        compare.AddArgument(&left);
+        compare.AddArgument(&right);
+        return compare;
+    };
+    constexpr std::uint32_t Additions = 64;
+    IrValue* address = &userData(0);
+    for (std::uint32_t index = 0; index < Additions; ++index) {
+        auto& sum = make(IrOpcode::IAdd32, IrType::U32);
+        sum.AddArgument(address);
+        sum.AddArgument(&constant(4));
+        address = &sum;
+    }
+    auto& load = make(IrOpcode::LoadBufferU32, IrType::U32);
+    load.AddArgument(address);
+    auto& pair = make(IrOpcode::CompositeConstructU32x2, IrType::U32x2);
+    pair.AddArgument(&userData(1));
+    pair.AddArgument(&load);
+    auto& low = make(IrOpcode::CompositeExtractU32x2, IrType::U32);
+    low.AddArgument(&pair);
+    low.AddArgument(&constant(0));
+    static std::uint32_t word = 5;
+    const auto wordAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(&word));
+    auto& handle = make(IrOpcode::CompositeConstructU64, IrType::U64);
+    handle.AddArgument(&userData(2));
+    handle.AddArgument(&userData(3));
+    auto& read = make(IrOpcode::LoadAddressU32, IrType::U32);
+    read.SetFlags(MemoryFlags{0, 0});
+    read.AddArgument(&handle);
+    read.AddArgument(&constant(0));
+    IrProgram program;
+    auto& resources = program.Resources();
+    resources.srtPlanComplete = true;
+    resources.resourceTrackingComplete = true;
+    MemoryInfo memory;
+    memory.kind = ResourceKind::ScalarAddress;
+    resources.memoryInfo.push_back(memory);
+    resources.controlFlow.push_back({&equal(load, constant(0)), {1, 2}, {}, {}});
+    resources.controlFlow.push_back({&equal(low, constant(7)), {3, 4}, {}, {}});
+    resources.controlFlow.push_back({&equal(read, constant(5)), {5, 6}, {}, {}});
+    auto& choice = make(IrOpcode::SelectU32, IrType::U32);
+    choice.AddArgument(&equal(userData(4), constant(0)));
+    choice.AddArgument(&load);
+    choice.AddArgument(&constant(1));
+    resources.controlFlow.push_back({&equal(choice, constant(1)), {7, 8}, {}, {}});
+    const auto plan = ResourceMaterializer{}.ExtractPlan(program);
+    const auto copied = std::ranges::count_if(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::IAdd32; });
+    require(copied == 0, "plan pruning: the address computation under a load the evaluator cannot read was copied");
+    require(plan.controlFlow[0].condition == nullptr && plan.controlFlow[3].condition == nullptr, "plan pruning: a condition the evaluator can never read was kept");
+    require(plan.controlFlow[1].condition != nullptr && plan.controlFlow[2].condition != nullptr, "plan pruning: a condition the evaluator can read was dropped");
+    const auto copiedLoad = std::ranges::find_if(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::LoadBufferU32; });
+    require(copiedLoad != plan.valueStorage.end() && copiedLoad->ArgumentCount() == 0u, "plan pruning: the unevaluable load was not kept as a leaf");
+    require(std::ranges::all_of(plan.valueStorage, [](const IrValue& value) { return !value.HasUses() && value.OperandUses().empty() && value.Arguments().capacity() == value.ArgumentCount(); }), "plan compaction: a plan value keeps use lists or spare operand capacity");
+    const std::array<std::uint32_t, 4> data{0x100u, 7u, static_cast<std::uint32_t>(wordAddress), static_cast<std::uint32_t>(wordAddress >> 32u)};
+    SrtRuntime runtime{data};
+    Detail::Evaluator evaluator(plan, runtime);
+    std::uint32_t result = 0;
+    require(evaluator.Evaluate(Detail::IrNode(plan.controlFlow[1].condition), result) && result == 1u, "plan pruning: a condition read through an extracted pair was not evaluated");
+    require(evaluator.Evaluate(Detail::IrNode(plan.controlFlow[2].condition), result) && result == 1u, "plan pruning: a condition on a raw read lost its handle");
+}
+
+struct PlanWalk {
+    std::vector<ShaderRecompiler::DescriptorValue> results;
+    std::vector<std::uint32_t> flat;
+    std::vector<std::uint8_t> active;
+};
+
+PlanWalk walkPlan(const ShaderRecompiler::IrResourcePlan& plan, std::span<const std::uint32_t> sources, std::span<const std::uint8_t> cleanFlatSlots, const ShaderRecompiler::SrtRuntime& runtime) {
+    PlanWalk walk;
+    ShaderRecompiler::SrtWalker{}.EvaluateRuntimeSources(plan, sources, runtime, walk.results, walk.flat, cleanFlatSlots, walk.active);
+    return walk;
+}
+
+bool readFive(void*, std::uint64_t, std::uint32_t* value) {
+    *value = 5u;
+    return true;
+}
+
+void verifyPlanRetention() {
+    using namespace ShaderRecompiler;
+    std::vector<std::unique_ptr<IrValue>> values;
+    std::uint32_t ids = 0;
+    const auto make = [&](IrOpcode opcode, IrType type) -> IrValue& {
+        values.push_back(std::make_unique<IrValue>(opcode, type, ids++));
+        return *values.back();
+    };
+    const auto constant = [&](std::uint32_t value) -> IrValue& {
+        auto& immediate = make(IrOpcode::Void, IrType::U32);
+        immediate.SetImmediateU32(value);
+        return immediate;
+    };
+    const auto userData = [&](std::uint32_t index) -> IrValue& {
+        auto& reg = make(IrOpcode::Void, IrType::ScalarReg);
+        reg.SetRegister({RegisterBank::Scalar, index});
+        auto& read = make(IrOpcode::GetUserData, IrType::U32);
+        read.AddArgument(&reg);
+        return read;
+    };
+    const auto binary = [&](IrOpcode opcode, IrType type, IrValue& left, IrValue& right) -> IrValue& {
+        auto& value = make(opcode, type);
+        value.AddArgument(&left);
+        value.AddArgument(&right);
+        return value;
+    };
+    constexpr std::uint32_t Chain = 64;
+    IrValue* address = &userData(4);
+    for (std::uint32_t step = 0; step < Chain; ++step) address = &binary(IrOpcode::IAdd32, IrType::U32, *address, constant(1));
+    auto& load = make(IrOpcode::LoadBufferU32, IrType::U32);
+    load.AddArgument(address);
+    auto& low = binary(IrOpcode::CompositeExtractU32x2, IrType::U32, binary(IrOpcode::CompositeConstructU32x2, IrType::U32x2, userData(1), load), constant(0));
+    auto& mask = binary(IrOpcode::IEqual32, IrType::Bool, userData(5), constant(0));
+    auto& choice = make(IrOpcode::SelectU32, IrType::U32);
+    choice.AddArgument(&mask);
+    choice.AddArgument(&userData(6));
+    choice.AddArgument(&load);
+    auto& offset = binary(IrOpcode::ReadFirstLane, IrType::U32, choice, mask);
+    auto& read = binary(IrOpcode::LoadAddressU32, IrType::U32, binary(IrOpcode::CompositeConstructU64, IrType::U64, userData(2), userData(3)), offset);
+    read.SetFlags(MemoryFlags{0, 0});
+    IrProgram program;
+    auto& resources = program.Resources();
+    resources.srtPlanComplete = true;
+    resources.resourceTrackingComplete = true;
+    MemoryInfo memory;
+    memory.kind = ResourceKind::ScalarAddress;
+    resources.memoryInfo.push_back(memory);
+    for (std::uint32_t source = 0; source < 2u; ++source) {
+        DescriptorSource descriptor;
+        descriptor.dwordCount = 4;
+        for (std::uint32_t dword = 0; dword < 4u; ++dword) descriptor.dwords[dword] = &userData(10u + source * 4u + dword);
+        resources.descriptorSources.push_back(descriptor);
+        BufferResource buffer;
+        buffer.source = source;
+        resources.info.buffers.push_back(buffer);
+    }
+    resources.controlFlow.push_back({&binary(IrOpcode::IEqual32, IrType::Bool, low, constant(7)), {1, 2}, {0}, {}});
+    resources.controlFlow.push_back({&binary(IrOpcode::IEqual32, IrType::Bool, read, constant(5)), {3, 4}, {}, {}});
+    resources.controlFlow.push_back({nullptr, {}, {}, {}});
+    resources.controlFlow.push_back({nullptr, {}, {}, {}});
+    resources.controlFlow.push_back({nullptr, {}, {1}, {}});
+    const auto plan = ResourceMaterializer{}.ExtractPlan(program);
+    constexpr std::size_t Read = 40;
+    require(plan.valueStorage.Size() == Read, ("plan retention: the plan keeps " + std::to_string(plan.valueStorage.Size()) + " values; its conditions and descriptor sources read " + std::to_string(Read)).c_str());
+    require(std::ranges::none_of(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::IAdd32; }), "plan retention: the address under a vector load was copied");
+    const auto copiedLoad = std::ranges::find_if(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::LoadBufferU32; });
+    require(copiedLoad != plan.valueStorage.end() && copiedLoad->ArgumentCount() == 0u, "plan retention: the vector load was not kept as a leaf");
+    std::array<std::uint32_t, 18> userWords{};
+    userWords[1] = 7u;
+    userWords[2] = 0x1000u;
+    userWords[6] = 8u;
+    for (std::uint32_t word = 10; word < userWords.size(); ++word) userWords[word] = 0x100u + word;
+    SrtRuntime runtime{userWords};
+    runtime.readMemory = readFive;
+    runtime.readSpecializationMemory = readFive;
+    const auto copiedWalk = walkPlan(plan, plan.materializationSources, plan.cleanFlatSlots, runtime);
+    const std::array<std::uint32_t, 2> sources{0u, 1u};
+    const auto wholeWalk = walkPlan(program.Resources(), sources, {}, runtime);
+    require(wholeWalk.active == std::vector<std::uint8_t>{1u, 0u}, "plan retention: the program's walk did not decide both conditions");
+    require(copiedWalk.active == wholeWalk.active && copiedWalk.results == wholeWalk.results && copiedWalk.flat == wholeWalk.flat, "plan retention: the plan's walk differs from the program's");
+}
+
+void verifyPlanRetentionChains() {
+    using namespace ShaderRecompiler;
+    std::vector<std::size_t> kept;
+    std::vector<std::size_t> conditions;
+    for (const std::uint32_t chain : {1u, 16u, 64u}) {
+        std::vector<std::uint32_t> code{0xf4080600u, 0xfa000060u, 0xbf8cc07fu, 0x7e140300u};
+        code.insert(code.end(), chain, 0x4a141481u);
+        code.insert(code.end(), {0x34141482u, 0xe0301000u, 0x80060b0au, 0xbf8c0000u, 0x7e28050bu, 0xf4000540u, 0x28000000u, 0xf4080700u, 0xfa000020u, 0xbf8c0000u, 0xbf078015u, 0xbf840002u, 0xe0700000u, 0x80070000u, 0xbf810000u});
+        const std::array<std::uint32_t, 2> userData{0x10000u, 0u};
+        const auto plan = GetResourcePlan(FrontendRequest(code, userData));
+        kept.push_back(plan->valueStorage.Size());
+        conditions.push_back(static_cast<std::size_t>(std::ranges::count_if(plan->controlFlow, [](const ResourceBlock& block) { return block.condition != nullptr; })));
+    }
+    require(conditions.front() != 0u, "plan retention: the program's plan keeps no branch condition, so the test does not reach the condition's values");
+    require(kept[0] == kept[1] && kept[1] == kept[2], ("plan retention: the plan keeps " + std::to_string(kept[0]) + ", " + std::to_string(kept[1]) + " and " + std::to_string(kept[2]) + " values for vector chains of 1, 16 and 64 steps before the scalar load its branch condition reads; it must keep only what the condition's evaluation can reach").c_str());
+}
+
+void verifyPlanCopyAnswers() {
+    using namespace ShaderRecompiler;
+    std::vector<std::unique_ptr<IrValue>> values;
+    std::vector<std::unique_ptr<IrBlock>> blocks;
+    std::uint32_t ids = 0;
+    const auto make = [&](IrOpcode opcode, IrType type) -> IrValue& {
+        values.push_back(std::make_unique<IrValue>(opcode, type, ids++));
+        return *values.back();
+    };
+    const auto constant = [&](std::uint32_t value) -> IrValue& {
+        auto& immediate = make(IrOpcode::Void, IrType::U32);
+        immediate.SetImmediateU32(value);
+        return immediate;
+    };
+    const auto userData = [&](std::uint32_t index) -> IrValue& {
+        auto& reg = make(IrOpcode::Void, IrType::ScalarReg);
+        reg.SetRegister({RegisterBank::Scalar, index});
+        auto& read = make(IrOpcode::GetUserData, IrType::U32);
+        read.AddArgument(&reg);
+        return read;
+    };
+    const auto binary = [&](IrOpcode opcode, IrType type, IrValue& left, IrValue& right) -> IrValue& {
+        auto& value = make(opcode, type);
+        value.AddArgument(&left);
+        value.AddArgument(&right);
+        return value;
+    };
+    const auto vectorLoad = [&](IrValue& address) -> IrValue& {
+        auto& load = make(IrOpcode::LoadBufferU32, IrType::U32);
+        load.AddArgument(&address);
+        return load;
+    };
+    const auto rawRead = [&](IrValue& low, IrValue& high, IrValue& offset) -> IrValue& {
+        auto& read = binary(IrOpcode::LoadAddressU32, IrType::U32, binary(IrOpcode::CompositeConstructU64, IrType::U64, low, high), offset);
+        read.SetFlags(MemoryFlags{0, 0});
+        return read;
+    };
+    const auto walks = [&](IrProgram& program, IrValue& read, const std::array<std::uint32_t, 14>& userWords, std::uint8_t expected, const char* what) {
+        auto& resources = program.Resources();
+        resources.srtPlanComplete = true;
+        resources.resourceTrackingComplete = true;
+        MemoryInfo memory;
+        memory.kind = ResourceKind::ScalarAddress;
+        resources.memoryInfo.push_back(memory);
+        DescriptorSource descriptor;
+        descriptor.dwordCount = 4;
+        for (std::uint32_t dword = 0; dword < 4u; ++dword) descriptor.dwords[dword] = &userData(10u + dword);
+        resources.descriptorSources.push_back(descriptor);
+        BufferResource buffer;
+        resources.info.buffers.push_back(buffer);
+        resources.controlFlow.push_back({&binary(IrOpcode::IEqual32, IrType::Bool, read, constant(5)), {1, 2}, {}, {}});
+        resources.controlFlow.push_back({nullptr, {}, {}, {}});
+        resources.controlFlow.push_back({nullptr, {}, {0}, {}});
+        const auto plan = ResourceMaterializer{}.ExtractPlan(program);
+        SrtRuntime runtime{userWords};
+        runtime.readMemory = readFive;
+        runtime.readSpecializationMemory = readFive;
+        const std::array<std::uint32_t, 1> sources{0u};
+        const auto whole = walkPlan(resources, sources, {}, runtime);
+        const auto taped = walkPlan(plan, plan.materializationSources, plan.cleanFlatSlots, runtime);
+        const auto interpreted = walkPlan(plan, sources, {}, runtime);
+        require(whole.active == std::vector<std::uint8_t>{expected}, what);
+        require(taped.active == whole.active && taped.results == whole.results, what);
+        require(interpreted.active == whole.active && interpreted.results == whole.results, what);
+    };
+    std::array<std::uint32_t, 14> userWords{};
+    for (std::uint32_t word = 10; word < userWords.size(); ++word) userWords[word] = 0x100u + word;
+
+    IrProgram phiProgram;
+    auto& shared = userData(1);
+    const auto low = [&](IrValue& hidden) -> IrValue& {
+        return binary(IrOpcode::CompositeExtractU32x2, IrType::U32, binary(IrOpcode::CompositeConstructU32x2, IrType::U32x2, shared, hidden), constant(0));
+    };
+    auto& left = *blocks.emplace_back(std::make_unique<IrBlock>(1u));
+    auto& right = *blocks.emplace_back(std::make_unique<IrBlock>(2u));
+    auto& phi = make(IrOpcode::Phi, IrType::U32);
+    phi.AddPhiOperand(&left, &low(vectorLoad(userData(4))));
+    phi.AddPhiOperand(&right, &low(vectorLoad(userData(5))));
+    userWords[1] = 8u;
+    userWords[2] = 0x1000u;
+    walks(phiProgram, rawRead(userData(2), userData(3), phi), userWords, 1u, "plan copy: a phi whose incoming values differ below a vector load resolved in the plan, not in the program");
+
+    IrProgram rootProgram;
+    auto& mask = binary(IrOpcode::IEqual32, IrType::Bool, userData(5), constant(0));
+    auto& choice = make(IrOpcode::SelectU32, IrType::U32);
+    choice.AddArgument(&mask);
+    choice.AddArgument(&userData(2));
+    choice.AddArgument(&vectorLoad(rawRead(userData(8), userData(9), constant(0))));
+    userWords[1] = 0u;
+    userWords[2] = 0u;
+    walks(rootProgram, rawRead(binary(IrOpcode::ReadFirstLane, IrType::U32, choice, mask), userData(3), constant(0)), userWords, 0u, "plan copy: a read from a null base loaded from memory only below a vector load counted as a null root in the plan, not in the program");
+}
+
 void verifySignedMinimum() {
     using namespace ShaderRecompiler;
     IrResourcePlan plan;
@@ -947,6 +1376,135 @@ void verifyPureFlatSlots() {
     require(Detail::ComputePureFlatSlots(plan) == Pure{0, 0, 0, 0}, "pure flat slots: an incomplete plan was classified");
 }
 
+void verifyLaneMaskGuardedDescriptorSources() {
+    using namespace ShaderRecompiler;
+    constexpr std::uint32_t Format8888UNorm = 56;
+    constexpr std::uint32_t Type2D = 9;
+    constexpr std::uint32_t Zero = 0x00000000u;
+    constexpr std::uint32_t NegativeZero = 0x80000000u;
+    constexpr std::uint32_t One = 0x3f800000u;
+    struct alignas(256) Texture { std::array<std::uint8_t, 256> bytes{}; };
+    static Texture texture;
+    const auto base = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texture.bytes.data()));
+    const std::array<std::uint32_t, 8> valid{static_cast<std::uint32_t>(base >> 8u), static_cast<std::uint32_t>((base >> 40u) & 0xffu) | (Format8888UNorm << 20u) | (3u << 30u), 3u << 14u, 0xfacu | (Type2D << 28u), 0u, 0u, 0u, 0u};
+    const std::array<std::uint32_t, 8> invalid{0x43700000u, 0x43070000u, 0x3b888889u, 0x3bf2b9d6u, 0x3b088889u, 0x3b72b9d6u, 0x3f7f7777u, 0x3f7f0d46u};
+    const std::array<std::uint32_t, 4> sampler{0u, 0u, 0u, 0u};
+    std::array<std::uint32_t, 4> output{};
+    const auto outputAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(output.data()));
+    const std::array<std::uint32_t, 4> outputV{static_cast<std::uint32_t>(outputAddress), static_cast<std::uint32_t>((outputAddress >> 32u) & 0xffffu), 16u, 0xfacu};
+    std::array<std::uint32_t, 32> srt{};
+    const auto fill = [&](const std::array<std::uint32_t, 8>& image, std::uint32_t mode) {
+        std::copy(image.begin(), image.end(), srt.begin());
+        std::copy(sampler.begin(), sampler.end(), srt.begin() + 8);
+        std::copy(outputV.begin(), outputV.end(), srt.begin() + 16);
+        srt[20] = mode;
+    };
+    const auto srtAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(srt.data()));
+    const std::array<std::uint32_t, 2> userData{static_cast<std::uint32_t>(srtAddress), static_cast<std::uint32_t>(srtAddress >> 32u)};
+    const std::array<std::uint32_t, 4> capabilities{29u, spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess};
+    const std::array<std::string_view, 2> extensions{"SPV_KHR_physical_storage_buffer", "SPV_KHR_8bit_storage"};
+    RecompileRequest request{};
+    const std::vector<std::uint32_t> code{0xf4000400u, 0xfa000050u, 0xf4080500u, 0xfa000020u, 0xf4080600u, 0xfa000040u, 0xbf8cc07fu, 0xd40d006au, 0x00002080u, 0xbf860006u, 0xf40c0200u, 0xfa000000u, 0xbf8cc07fu, 0xf09c0f08u, 0x00a20000u, 0xbf8c3f70u, 0xe0700000u, 0x80060000u, 0xbf810000u};
+    request.shader = {ShaderStage::Compute, 0x24000u, code, 0, {}};
+    request.context.waveSize = 32;
+    request.context.userDataBaseRegister = 0;
+    request.context.userData = userData;
+    request.context.compute = ShaderComputeStageInfo{{32u, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    request.target.vulkanVersion = 0x00401000u;
+    request.target.spirvVersion = 0x00010300u;
+    request.target.subgroupSize = 32;
+    request.target.supportedCapabilities = capabilities;
+    request.target.supportedExtensions = extensions;
+    request.target.bdaAbiVersion = BdaAbi::Version;
+    request.target.fragmentShaderBarycentricEnabled = false;
+    request.layout.pushConstantSizeBytes = 128;
+
+    fill(invalid, Zero);
+    const auto plan = GetResourcePlan(request);
+    require(plan->info.images.size() == 1u && plan->info.samplers.size() == 1u, "lane-mask guarded sources: the image and its sampler were not planned");
+    require(!plan->controlFlow.empty() && std::ranges::any_of(plan->controlFlow, [](const ResourceBlock& block) { return block.condition != nullptr; }), "lane-mask guarded sources: the VCC branch around the image kept no condition");
+    for (const auto mode : {Zero, NegativeZero}) {
+        fill(invalid, mode);
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::ranges::all_of(capture->snapshot.images[0].dwords, [](std::uint32_t word) { return word == 0u; }), "lane-mask guarded sources: the T# behind a branch no lane takes was not left null");
+    }
+    fill(invalid, One);
+    {
+        AgcDriver::ShaderMemory memory({});
+        expectFailure([&] { static_cast<void>(memory.Capture(request)); }, "runtime image descriptor is invalid", "lane-mask guarded sources: an invalid T# behind a branch the lanes may take was accepted");
+    }
+    fill(valid, One);
+    {
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::equal(valid.begin(), valid.end(), capture->snapshot.images[0].dwords.begin()), "lane-mask guarded sources: the T# behind a branch the lanes may take was not read");
+    }
+}
+
+void verifyExecGuardedDescriptorSources() {
+    using namespace ShaderRecompiler;
+    constexpr std::uint32_t Format8888UNorm = 56;
+    constexpr std::uint32_t Type2D = 9;
+    struct alignas(256) Texture { std::array<std::uint8_t, 256> bytes{}; };
+    static Texture texture;
+    const auto base = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texture.bytes.data()));
+    const std::array<std::uint32_t, 8> valid{static_cast<std::uint32_t>(base >> 8u), static_cast<std::uint32_t>((base >> 40u) & 0xffu) | (Format8888UNorm << 20u) | (3u << 30u), 3u << 14u, 0xfacu | (Type2D << 28u), 0u, 0u, 0u, 0u};
+    const std::array<std::uint32_t, 8> invalid{0x43700000u, 0x43070000u, 0x3b888889u, 0x3bf2b9d6u, 0x3b088889u, 0x3b72b9d6u, 0x3f7f7777u, 0x3f7f0d46u};
+    const std::array<std::uint32_t, 4> sampler{0u, 0u, 0u, 0u};
+    std::array<std::uint32_t, 4> output{};
+    const auto outputAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(output.data()));
+    const std::array<std::uint32_t, 4> outputV{static_cast<std::uint32_t>(outputAddress), static_cast<std::uint32_t>((outputAddress >> 32u) & 0xffffu), 16u, 0xfacu};
+    std::array<std::uint32_t, 32> srt{};
+    const auto fill = [&](const std::array<std::uint32_t, 8>& image, std::uint32_t mode) {
+        std::copy(image.begin(), image.end(), srt.begin());
+        std::copy(sampler.begin(), sampler.end(), srt.begin() + 8);
+        std::copy(outputV.begin(), outputV.end(), srt.begin() + 16);
+        srt[20] = mode;
+    };
+    const auto srtAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(srt.data()));
+    const std::array<std::uint32_t, 2> userData{static_cast<std::uint32_t>(srtAddress), static_cast<std::uint32_t>(srtAddress >> 32u)};
+    const std::array<std::uint32_t, 4> capabilities{29u, spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess};
+    const std::array<std::string_view, 2> extensions{"SPV_KHR_physical_storage_buffer", "SPV_KHR_8bit_storage"};
+    RecompileRequest request{};
+    const std::vector<std::uint32_t> code{0xf4000400u, 0xfa000050u, 0xf4080500u, 0xfa000020u, 0xf4080600u, 0xfa000040u, 0xbf8cc07fu, 0x7da80010u, 0xbf880006u, 0xf40c0200u, 0xfa000000u, 0xbf8cc07fu, 0xf09c0f08u, 0x00a20000u, 0xbf8c3f70u, 0xe0700000u, 0x80060000u, 0xbf810000u};
+    request.shader = {ShaderStage::Compute, 0x24000u, code, 0, {}};
+    request.context.waveSize = 32;
+    request.context.userDataBaseRegister = 0;
+    request.context.userData = userData;
+    request.context.compute = ShaderComputeStageInfo{{32u, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    request.target.vulkanVersion = 0x00401000u;
+    request.target.spirvVersion = 0x00010300u;
+    request.target.subgroupSize = 32;
+    request.target.supportedCapabilities = capabilities;
+    request.target.supportedExtensions = extensions;
+    request.target.bdaAbiVersion = BdaAbi::Version;
+    request.target.fragmentShaderBarycentricEnabled = false;
+    request.layout.pushConstantSizeBytes = 128;
+
+    fill(invalid, 0u);
+    const auto plan = GetResourcePlan(request);
+    require(plan->info.images.size() == 1u && plan->info.samplers.size() == 1u, "exec guarded sources: the image and its sampler were not planned");
+    require(!plan->controlFlow.empty() && std::ranges::any_of(plan->controlFlow, [](const ResourceBlock& block) { return block.condition != nullptr; }), "exec guarded sources: the EXEC branch around the image kept no condition");
+    {
+        fill(invalid, 0u);
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::ranges::all_of(capture->snapshot.images[0].dwords, [](std::uint32_t word) { return word == 0u; }), "exec guarded sources: the T# behind a branch no lane takes was not left null");
+    }
+    fill(invalid, 1u);
+    {
+        AgcDriver::ShaderMemory memory({});
+        expectFailure([&] { static_cast<void>(memory.Capture(request)); }, "runtime image descriptor is invalid", "exec guarded sources: an invalid T# behind a branch the lanes may take was accepted");
+    }
+    fill(valid, 1u);
+    {
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::equal(valid.begin(), valid.end(), capture->snapshot.images[0].dwords.begin()), "exec guarded sources: the T# behind a branch the lanes may take was not read");
+    }
+}
+
 void verifyGuardedDescriptorSources() {
     using namespace ShaderRecompiler;
     constexpr std::uint32_t Format8888UNorm = 56;
@@ -1250,6 +1808,7 @@ constexpr std::uint32_t TableFormat8888UNorm = 56;
 constexpr std::uint32_t TableFormat32UInt = 20;
 constexpr std::uint32_t TableFormat16SInt = 12;
 constexpr std::uint32_t TableFormat11_11_10UInt = 34;
+constexpr std::uint32_t TableFormat32_32UInt = 62;
 constexpr std::uint32_t TableType2D = 9;
 constexpr std::uint32_t TableType3D = 10;
 
@@ -1332,6 +1891,41 @@ std::array<std::uint32_t, 8> TableSelected(const ShaderRecompiler::ImageTableSna
     return column.words.at(column.codes[0]).dwords;
 }
 
+void verifyTargetFeatureKey() {
+    using namespace ShaderRecompiler;
+    static constexpr std::array<std::uint32_t, 1> code{0xbf810000u};
+    RecompileRequest request{};
+    request.shader = {ShaderStage::Compute, 0x10000u, code, 0, {}};
+    request.context.waveSize = 64;
+    const std::vector<std::uint32_t> capabilities{1u, 4448u, 5347u};
+    const std::vector<std::string_view> extensions{"SPV_KHR_8bit_storage", "SPV_KHR_physical_storage_buffer"};
+    const auto build = [&](std::span<const std::uint32_t> capabilityList, std::span<const std::string_view> extensionList) {
+        auto keyed = request;
+        keyed.target.supportedCapabilities = capabilityList;
+        keyed.target.supportedExtensions = extensionList;
+        std::vector<std::uint64_t> key;
+        RecompileCacheKey::Build(keyed, key);
+        return key;
+    };
+    const auto base = build(capabilities, extensions);
+    const std::vector<std::uint32_t> capabilityCopy = capabilities;
+    const std::vector<std::string> extensionStorage{"SPV_KHR_8bit_storage", "SPV_KHR_physical_storage_buffer"};
+    const std::vector<std::string_view> extensionCopy{extensionStorage[0], extensionStorage[1]};
+    require(build(capabilityCopy, extensionCopy) == base, "target feature key: equal capability and extension lists in other storage gave another key");
+    auto renamed = extensionStorage;
+    renamed[1].back() = 'X';
+    const std::vector<std::string_view> renamedViews{renamed[0], renamed[1]};
+    require(build(capabilities, renamedViews) != base, "target feature key: an extension name that differs in its last byte gave the same key");
+    const std::vector<std::string_view> moved{"SPV_KHR_8bit_storageS", "PV_KHR_physical_storage_buffer"};
+    require(build(capabilities, moved) != base, "target feature key: a byte moved between two extension names gave the same key");
+    const std::vector<std::uint32_t> more{1u, 4448u, 5347u, 11u};
+    require(build(more, extensions) != base, "target feature key: an added capability gave the same key");
+    std::vector<std::string> many;
+    for (std::uint32_t index = 0; index < 40u; ++index) many.push_back("SPV_EXT_descriptor_indexing_" + std::to_string(index));
+    const std::vector<std::string_view> manyViews(many.begin(), many.end());
+    require(build(capabilities, manyViews).size() == base.size(), "target feature key: the key grows with the device's extension names");
+}
+
 void verifyImageTableKeys() {
     using namespace ShaderRecompiler;
     namespace Abi = ImageTableAbi;
@@ -1860,7 +2454,10 @@ void verifyTableSnapshotReuse() {
     const auto otherBuffer = CompileTable(request);
     std::copy(outputV.begin(), outputV.end(), guest.srt.begin() + 12);
     const auto resolvedShared = ResourceMaterializer::TableReuse();
-    require(otherBuffer.result != compiled.result && otherBuffer.result->variantId == compiled.result->variantId && resolvedShared.resolutionsShared - resolvedBefore.resolutionsShared == 1u && resolvedShared.resolutions == resolvedBefore.resolutions && TableMap(*otherBuffer.result) == map && TableBinding(*otherBuffer.result, DescriptorRole::ImageTable)->guestDescriptor == images->guestDescriptor, "table snapshot reuse: a result for another buffer did not reuse the unchanged table's resolution");
+    const bool resolves = std::getenv("APS5_NO_MASKED_RESULT_MEMO") != nullptr || std::getenv("APS5_VERIFY_MASKED_RESULT_MEMO") != nullptr;
+    require(otherBuffer.result != compiled.result && otherBuffer.result->variantId == compiled.result->variantId && resolvedShared.resolutionsShared - resolvedBefore.resolutionsShared == (resolves ? 1u : 0u) && resolvedShared.resolutions == resolvedBefore.resolutions && TableMap(*otherBuffer.result) == map && TableBinding(*otherBuffer.result, DescriptorRole::ImageTable)->guestDescriptor == images->guestDescriptor, "table snapshot reuse: a result for another buffer did not reuse the unchanged table's resolution");
+    const auto* otherBuffers = TableBinding(*otherBuffer.result, DescriptorRole::GuestBuffers);
+    require(otherBuffers != nullptr && std::search(otherBuffers->guestDescriptor.begin(), otherBuffers->guestDescriptor.end(), otherOutputV.begin(), otherOutputV.end()) != otherBuffers->guestDescriptor.end(), "table snapshot reuse: a result for another buffer does not hold that buffer's descriptor");
     const auto storedWord = heap[5u * 8u];
     heap[5u * 8u] = heap[6u * 8u];
     const auto restoredMap = map;
@@ -2875,7 +3472,30 @@ void verifyImageTableRegistration() {
     const auto* storeTable = TableBinding(*store.result, DescriptorRole::ImageStorageTable);
     require((storeFault & Abi::PoisonFlag) == 0u && storeTable != nullptr && storeTable->count != 0u && std::all_of(storeTable->imageWritten.begin(), storeTable->imageWritten.end(), [](bool written) { return written; }), "image table registration: the store's table was not bound as written storage elements");
     require(TableBinding(*store.result, DescriptorRole::ImageTable) == nullptr || TableBinding(*store.result, DescriptorRole::ImageTable)->count == 0u, "image table registration: a store-only table bound sampled elements");
-    const std::array<std::pair<std::uint32_t, const char*>, 3> unsupportedStores{{{0xf0240f08u, "image_store_mip"}, {0xf0280f08u, "image_store_pck"}, {0xf0440108u, "image_atomic_add"}}};
+    auto atomicCode = storeCode;
+    atomicCode[8] = 0xf0440108u;
+    const auto atomic = CompileTable(TableRequest(atomicCode, userData));
+    const auto& atomicPlan = *atomic.capture->plan;
+    require(atomicPlan.info.images.size() == 1u && atomicPlan.info.images[0].table == 0u && atomicPlan.info.images[0].tableOperation == TableOperation::Supported, "image table registration: a table T# feeding image_atomic_add was not a supported table operation");
+    const auto& atomicMap = TableMap(*atomic.result);
+    const auto atomicFault = atomicMap[Abi::TableHeader(0) + Abi::TableFault];
+    const auto* atomicTable = TableBinding(*atomic.result, DescriptorRole::ImageStorageTable);
+    require((atomicFault & Abi::PoisonFlag) == 0u && atomicTable != nullptr && atomicTable->count != 0u && atomicTable->imageAtomic.size() == atomicTable->count && std::all_of(atomicTable->imageWritten.begin(), atomicTable->imageWritten.end(), [](bool written) { return written; }) && std::all_of(atomicTable->imageAtomic.begin(), atomicTable->imageAtomic.end(), [](bool atomic) { return atomic; }), "image table registration: the image_atomic_add table was not bound as atomic storage elements");
+    require(TableBinding(*atomic.result, DescriptorRole::ImageTable) == nullptr || TableBinding(*atomic.result, DescriptorRole::ImageTable)->count == 0u, "image table registration: an atomic-only table bound sampled elements");
+    auto atomic64Code = storeCode;
+    atomic64Code[8] = 0xf0440308u;
+    guest.heap[0] = TableT(texture.bytes.data(), TableFormat32_32UInt, TableType2D);
+    static constexpr std::array<std::uint32_t, 5> int64ImageCapabilities{29u, spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess, spv::CapabilityInt64ImageEXT};
+    auto atomic64Request = TableRequest(atomic64Code, userData);
+    atomic64Request.target.supportedCapabilities = int64ImageCapabilities;
+    const auto atomic64 = CompileTable(atomic64Request);
+    const auto& atomic64Plan = *atomic64.capture->plan;
+    require(atomic64Plan.info.images.size() == 1u && atomic64Plan.info.images[0].table == 0u && atomic64Plan.info.images[0].tableOperation == TableOperation::Supported, "image table registration: a table T# feeding image_atomic64_add was not a supported table operation");
+    const auto& atomic64Map = TableMap(*atomic64.result);
+    const auto atomic64Fault = atomic64Map[Abi::TableHeader(0) + Abi::TableFault];
+    const auto* atomic64Table = TableBinding(*atomic64.result, DescriptorRole::ImageStorageTable);
+    require((atomic64Fault & Abi::PoisonFlag) == 0u && atomic64Table != nullptr && atomic64Table->count != 0u && atomic64Table->imageAtomic64.size() == atomic64Table->count && std::all_of(atomic64Table->imageAtomic64.begin(), atomic64Table->imageAtomic64.end(), [](bool atomic) { return atomic; }), "image table registration: the image_atomic64_add table was not bound as 64-bit atomic storage elements");
+    const std::array<std::pair<std::uint32_t, const char*>, 2> unsupportedStores{{{0xf0240f08u, "image_store_mip"}, {0xf0280f08u, "image_store_pck"}}};
     for (const auto& [instruction, name] : unsupportedStores) {
         auto code = storeCode;
         code[8] = instruction;
@@ -3064,6 +3684,18 @@ void verifyPointerImageTable() {
     require(!TableTouched(narrowTable.regions, root + (Palette + 32u) / 4u, 32u) && !TableTouched(narrowTable.regions, root + Committed / 4u, Reserved - Committed), "pointer image table: a record outside the key domain was read");
     const std::vector<std::pair<std::uint64_t, std::uint64_t>> narrowReads{{base + Palette, 32u}, {base + Palette + 2u * 32u, 32u}, {base + Palette + 255u * 32u, 32u}, {base + Palette + 0x102u * 32u, 32u}};
     require(narrowSnapshot.readRanges == narrowReads && narrowTable.result->imageTableReadRanges.size() == 1u && narrowTable.result->imageTableReadRanges[0] == narrowReads, "pointer image table: consumed ranges include skipped keys or the key-domain buffer");
+
+    auto phiCode = maskedCode;
+    phiCode.erase(phiCode.begin() + 8, phiCode.begin() + 10);
+    phiCode.insert(phiCode.begin() + 8, {
+        0xbf068010u, 0xbf850003u, 0xf4200444u, 0x20000000u, 0xbf820002u, 0xf4200444u, 0x20000000u
+    });
+    const auto phiRequest = request(phiCode, 0x36000u);
+    const auto phiPlan = GetResourcePlan(phiRequest);
+    require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer image table: a pointer read through a phi was not planned as a table");
+    const auto phiTable = CompileTable(phiRequest);
+    require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer image table: a pointer read through a phi captured different records");
+
     keys = {};
 #ifdef _WIN32
     VirtualFree(block, 0, MEM_RELEASE);
@@ -3281,7 +3913,7 @@ void verifySelectedRecordDirectOperations() {
     FillTableSrt(guest, heap.data(), 32u, 4u);
     guest.srt[16] = 2u;
     const auto userData = TableUserData(guest);
-    const std::array<std::tuple<const char*, std::uint32_t, std::uint32_t>, 4> operations{{{"image_store", 0xf0200f08u, TableFormat32UInt}, {"image_atomic_add", 0xf0440108u, TableFormat32UInt}, {"image_load_pck", 0xf0080f08u, TableFormat32UInt}, {"image_load_by2", 0xf1080308u, TableFormat16UNorm}}};
+    const std::array<std::tuple<const char*, std::uint32_t, std::uint32_t>, 5> operations{{{"image_store", 0xf0200f08u, TableFormat32UInt}, {"image_atomic_add", 0xf0440108u, TableFormat32UInt}, {"image_atomic64_add", 0xf0440308u, TableFormat32_32UInt}, {"image_load_pck", 0xf0080f08u, TableFormat32UInt}, {"image_load_by2", 0xf1080308u, TableFormat16UNorm}}};
     for (const auto& [name, word0, format] : operations) {
         const auto what = std::string("selected record direct operations: ") + name;
         heap[2] = TableT(textures[1].bytes.data(), format, TableType2D);
@@ -3289,11 +3921,11 @@ void verifySelectedRecordDirectOperations() {
         const auto request = TableRequest(code, userData);
         const auto plan = GetResourcePlan(request);
         require(plan->info.images.size() == 1u && plan->info.images[0].table == NoTable && !plan->descriptorSources.at(plan->info.images[0].source).tableColumn.has_value(), (what + " through a T# whose record the CPU evaluates was planned through an image table").c_str());
-        const auto compiled = CompileTable(request);
-        require(TableBinding(*compiled.result, DescriptorRole::ImageTable) == nullptr && compiled.result->imageTableFaults == 0u && TableCovered(compiled.regions, &heap[2], sizeof(heap[2])), (what + " through a T# whose record the CPU evaluates was not bound from its record").c_str());
+        const auto compiled = word0 == 0xf0440308u ? TableCompiled{} : CompileTable(request);
+        require(word0 == 0xf0440308u || (TableBinding(*compiled.result, DescriptorRole::ImageTable) == nullptr && compiled.result->imageTableFaults == 0u && TableCovered(compiled.regions, &heap[2], sizeof(heap[2]))), (what + " through a T# whose record the CPU evaluates was not bound from its record").c_str());
         const auto wholeCode = WithImageOperation(TableWholeCode, word0, false);
         const auto whole = GetResourcePlan(TableRequest(wholeCode, userData));
-        require(whole->info.images.size() == 1u && whole->info.images[0].table == 0u && whole->info.images[0].tableOperation == (word0 == 0xf0200f08u ? TableOperation::Supported : TableOperation::Unsupported), (what + " through a T# keyed per lane left the image table or has the wrong table operation").c_str());
+        require(whole->info.images.size() == 1u && whole->info.images[0].table == 0u && whole->info.images[0].tableOperation == (word0 == 0xf0200f08u || word0 == 0xf0440108u || word0 == 0xf0440308u ? TableOperation::Supported : TableOperation::Unsupported), (what + " through a T# keyed per lane left the image table or has the wrong table operation").c_str());
     }
     const auto mixedCode = WithImageOperation(TableSrtKeyCode, 0xf0200f08u, true);
     const auto mixed = GetResourcePlan(TableRequest(mixedCode, userData));
@@ -3467,6 +4099,45 @@ void verifyPointerChainImageTable() {
     static_cast<void>(ValidateAndOptimizeSpirv(compiled.result->spirv, request.target.vulkanVersion, request.target.spirvVersion));
 #endif
     store(links[1].data() + 4u, address(descriptors[1].data()));
+
+    auto phiCode = code;
+    phiCode.erase(phiCode.begin() + 15, phiCode.begin() + 17);
+    phiCode.insert(phiCode.begin() + 15, {
+        0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000008u
+    });
+    auto phiRequest = TableRequest(phiCode, userData);
+    phiRequest.shader.codeAddress = 0x38000u;
+    const auto phiPlan = GetResourcePlan(phiRequest);
+    require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer chain image table: a pointer read through a phi was not planned as a table");
+    const auto phiTable = CompileTable(phiRequest);
+    require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer chain image table: a pointer read through a phi captured different records");
+
+    auto divergentCode = code;
+    divergentCode.erase(divergentCode.begin() + 15, divergentCode.begin() + 17);
+    divergentCode.insert(divergentCode.begin() + 15, {
+        0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000018u
+    });
+    auto divergentRequest = TableRequest(divergentCode, userData);
+    divergentRequest.shader.codeAddress = 0x39000u;
+    expectFailure([&] { static_cast<void>(GetResourcePlan(divergentRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi reading different table offsets was planned as a table");
+
+    auto nonTableCode = code;
+    nonTableCode.erase(nonTableCode.begin() + 15, nonTableCode.begin() + 17);
+    nonTableCode.insert(nonTableCode.begin() + 15, {
+        0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xbe960380u, 0xbe970380u
+    });
+    auto nonTableRequest = TableRequest(nonTableCode, userData);
+    nonTableRequest.shader.codeAddress = 0x3a000u;
+    expectFailure([&] { static_cast<void>(GetResourcePlan(nonTableRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi with a non-table branch was planned as a table");
+
+    auto armOffsetCode = code;
+    armOffsetCode.erase(armOffsetCode.begin() + 14, armOffsetCode.begin() + 17);
+    armOffsetCode.insert(armOffsetCode.begin() + 14, {
+        0xbf068010u, 0xbf850004u, 0x8f128411u, 0xf4240b02u, 0x24000008u, 0xbf820003u, 0x8f128411u, 0xf4240b02u, 0x24000008u
+    });
+    auto armOffsetRequest = TableRequest(armOffsetCode, userData);
+    armOffsetRequest.shader.codeAddress = 0x3b000u;
+    expectFailure([&] { static_cast<void>(GetResourcePlan(armOffsetRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi whose arms compute their own table offset was planned as a table");
 }
 
 void verifyWaterfallImageTable() {
@@ -4842,7 +5513,7 @@ void verifyPixelRequestSerialization() {
                         value.posZ, value.posW, value.frontFace, value.frontFaceAllBits, value.ancillary, value.sampleShading,
                         value.noPerspective, value.linearCentroid, value.pixelKillEnable, value.depthExportEnable,
                         value.sampleMaskExportEnable, value.earlyZ, value.executeOnNoop, value.conservativeZExport, value.orderedPixelShader,
-                        value.targetOutputMode, value.targetExportMapping, value.alphaToCoverage, value.stencilRefExportEnable, value.rasterPrimitive, value.layerExported, value.ditheredAlphaToCoverage, value.reversedBlend);
+                        value.targetOutputMode, value.targetExportMapping, value.alphaToCoverage, value.stencilRefExportEnable, value.rasterPrimitive, value.layerExported, value.ditheredAlphaToCoverage, value.reversedBlend, value.targetMerge);
     };
     const std::array<std::uint32_t, 1> code{0xbf810000u};
     const std::array<std::uint32_t, 3> userData{0x12345678u, 0xabcdef01u, 0x87654321u};
@@ -4890,6 +5561,7 @@ void verifyPixelRequestSerialization() {
     pixel.stencilRefExportEnable = true;
     pixel.ditheredAlphaToCoverage = true;
     pixel.reversedBlend = 0x570001u;
+    pixel.targetMerge = {1u, 0x0ff0u, 1u, {0x100u, 0x2u, 0x3u, 0x4u, 0x5u, 0x6u, 0x7u, 0x8u}};
     const std::array<std::array<std::uint8_t, 8>, 3> mappings{{
         {0x00u, 0xe4u, 0xc6u, 0x1bu, 0xffu, 0x80u, 0x55u, 0xaau},
         {0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u},
@@ -4922,6 +5594,22 @@ void verifyPixelRequestSerialization() {
         withoutReversedBlend.context.pixel->reversedBlend = 0u;
         RecompileCacheKey::Build(withoutReversedBlend, replayKey);
         require(key == replayKey && RecompileCacheKey::ContextHash(request) == RecompileCacheKey::ContextHash(withoutReversedBlend), "the reversed-order blend code changed the static shader identity");
+        auto movedMerge = request;
+        movedMerge.context.pixel->targetMerge.descriptor[0] = 0x200u;
+        RecompileCacheKey::Build(movedMerge, replayKey);
+        require(key == replayKey, "the merged target's descriptor changed the static shader identity");
+        auto depthWritingMerge = request;
+        depthWritingMerge.context.pixel->targetMerge.depthStencilWrites = true;
+        RecompileCacheKey::Build(depthWritingMerge, replayKey);
+        require(key != replayKey, "the merge draw's depth or stencil writes did not change the static shader identity");
+        auto depthTestingMerge = request;
+        depthTestingMerge.context.pixel->targetMerge.depthStencilTests = true;
+        RecompileCacheKey::Build(depthTestingMerge, replayKey);
+        require(key != replayKey, "the merge draw's depth or stencil tests did not change the static shader identity");
+        auto withoutMerge = request;
+        withoutMerge.context.pixel->targetMerge = {};
+        RecompileCacheKey::Build(withoutMerge, replayKey);
+        require(key != replayKey, "a color target merge did not change the static shader identity");
         auto withoutCoverage = request;
         withoutCoverage.context.pixel->alphaToCoverage = false;
         RecompileCacheKey::Build(withoutCoverage, replayKey);
@@ -4944,7 +5632,7 @@ void verifyPixelRequestSerialization() {
     minimal.context.pixel->layerExported = true;
     minimal.context.pixel->ditheredAlphaToCoverage = true;
     const auto encoded = serializer.Serialize(minimal);
-    require(requestPrefix(encoded, 8u) == "NVNQQSwAAAA=", "new requests did not use serialization version 44");
+    require(requestPrefix(encoded, 8u) == "NVNQQS4AAAA=", "new requests did not use serialization version 46");
     const std::array<std::uint32_t, 2> fallbacks{0x40u, 0x1ac4u};
     auto withFallbacks = minimal;
     withFallbacks.context.linkedCallFallbacks = fallbacks;
@@ -5062,7 +5750,7 @@ void verifyPixelRequestSerialization() {
     for (std::size_t bytes = 0; bytes < 45u; ++bytes) {
         expectFailure([&] { static_cast<void>(serializer.Deserialize(requestPrefix(encoded, mappingOffset + bytes))); }, "truncated data", "a truncated pixel mapping, packing, dual-source, alpha-to-coverage, stencil reference export flag, primitive class, layer export, dither or front-face flag, quad pixel mask or quad sample mask was accepted");
     }
-    for (const auto unsupported : {"NVNQQQAAAAA=", "NVNQQS0AAAA="}) {
+    for (const auto unsupported : {"NVNQQQAAAAA=", "NVNQQS8AAAA="}) {
         expectFailure([&] { static_cast<void>(serializer.Deserialize(unsupported)); }, "serialization version", "an unsupported request version was accepted");
     }
     static constexpr std::string_view version18Request{
@@ -5153,6 +5841,7 @@ void verifyVertexInfoVersion19() {
     require(offset + 4u <= plain.size() && flagged[offset] == 0xefu && flagged[offset + 1u] == 0xcdu && flagged[offset + 2u] == 0xabu && flagged[offset + 3u] == 0x89u, "PA_CL_VS_OUT_CNTL is not the four bytes the version 20 vertex info adds");
     require(std::equal(plain.begin() + offset + 4u, plain.end(), flagged.begin() + offset + 4u), "PA_CL_VS_OUT_CNTL moved the fields after it");
     auto version20Vertex = flagged;
+    version20Vertex.resize(version20Vertex.size() - sizeof(std::uint32_t));
     version20Vertex.pop_back();
     version20Vertex.pop_back();
     version20Vertex.pop_back();
@@ -5165,6 +5854,7 @@ void verifyVertexInfoVersion19() {
     const auto layered = serializer.Deserialize(serializer.Serialize(vertex));
     require(layered.request.context.vertex.has_value() && layered.request.context.vertex->paClVsOutCntl == vertex.context.vertex->paClVsOutCntl, "a layered vertex info lost its clip distances or render target index");
     auto legacy = plain;
+    legacy.resize(legacy.size() - sizeof(std::uint32_t));
     legacy.pop_back();
     legacy.pop_back();
     legacy.pop_back();
@@ -5204,16 +5894,39 @@ void verifyVertexInfoVersion19() {
     while (allBitsOffset < plainPixel.size() && plainPixel[allBitsOffset] == allBitsBytes[allBitsOffset]) ++allBitsOffset;
     require(allBitsOffset == flagOffset + 2u, "the front-face all-bits flag does not follow the dithered coverage flag");
     require(blendOffset == allBitsOffset + 18u, "the reversed-order blend code is not serialized after the front-face all-bits flag, quad pixel mask and quad sample masks");
-    constexpr std::size_t sampleMaskBytes = 16u;
     constexpr std::size_t iterationBytes = 35u;
     constexpr std::size_t sampleOrderBytes = 16u;
+    constexpr std::size_t mergeBytes = 40u;
+    constexpr std::size_t sampleMaskBytes = 16u;
     const auto orderOffset = blendOffset + 4u + iterationBytes;
+    const auto mergeOffset = static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes);
+    auto merging = pixel;
+    merging.context.pixel->targetMerge = {3u, 0xf00fu, 2u, {1u, 2u, 3u, 4u, 5u, 6u, 7u, 0x89abcdefu}, true, true};
+    const auto mergingBytes = decodeBase64(serializer.Serialize(merging));
+    require(mergingBytes.size() == plainPixel.size() && std::equal(plainPixel.begin(), plainPixel.begin() + mergeOffset, mergingBytes.begin()) && mergingBytes[mergeOffset] == 3u && mergingBytes[mergeOffset + 1] == 0x0fu && mergingBytes[mergeOffset + 2] == 0xf0u && mergingBytes[mergeOffset + 5] == 2u && mergingBytes[mergeOffset + 6] == 1u && mergingBytes[mergeOffset + 34] == 0xefu && mergingBytes[mergeOffset + 37] == 0x89u && mergingBytes[mergeOffset + 38] == 1u && mergingBytes[mergeOffset + 39] == 1u && std::equal(plainPixel.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes), plainPixel.end(), mergingBytes.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes)), "the color target merge is not the 40 bytes the version 46 pixel info adds after the sample order");
+    require(serializer.Deserialize(serializer.Serialize(merging)).request.context.pixel->targetMerge == merging.context.pixel->targetMerge, "a serialized request lost its color target merge");
+    // A version 43 request: no color target merge, and no fused arithmetic flag, pixel function LDS flag or storage size at the end.
+    const auto version43Bytes = [&](std::vector<std::uint8_t> bytes) {
+        require(bytes.end() - bytes.begin() > mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes) && std::equal(plainPixel.begin() + mergeOffset, plainPixel.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes), bytes.begin() + mergeOffset), "a replay fixture does not hold the default color target merge after the sample order");
+        bytes.erase(bytes.begin() + mergeOffset, bytes.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes));
+        bytes.resize(bytes.size() - sizeof(std::uint32_t) - 2u);
+        return bytes;
+    };
+    auto version42 = version43Bytes(plainPixel);
+    version42[4] = 42u;
+    const auto replay42 = serializer.Deserialize(encodeBase64(version42));
+    require(replay42.request.context.pixel.has_value() && replay42.request.context.pixel->targetMerge == TargetMerge{} && serializer.Serialize(replay42.request) == encodedPixel, "a version 42 request read a color target merge or misread the fields after it");
+    auto version39 = version42;
+    version39.pop_back();
+    version39.erase(version39.begin() + static_cast<std::ptrdiff_t>(orderOffset), version39.begin() + mergeOffset);
+    version39[4] = 39u;
+    const auto replay39 = serializer.Deserialize(encodeBase64(version39));
+    require(replay39.request.context.pixel.has_value() && replay39.request.context.pixel->targetMerge == TargetMerge{} && replay39.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{} && serializer.Serialize(replay39.request) == encodedPixel, "a version 39 request read a sample order or color target merge, or misread the fields after them");
     auto ordered = pixel;
     ordered.context.pixel->sampleOrder = {0x76543210u, 0x76543210u, 0x76543201u, 0x76543201u};
     const auto orderedBytes = decodeBase64(serializer.Serialize(ordered));
     require(orderedBytes.size() == plainPixel.size() && std::equal(plainPixel.begin(), plainPixel.begin() + static_cast<std::ptrdiff_t>(orderOffset), orderedBytes.begin()) && orderedBytes[orderOffset] == 0x10u && orderedBytes[orderOffset + 11u] == 0x76u && orderedBytes[orderOffset + 12u] == 0x01u && std::equal(plainPixel.begin() + static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes), plainPixel.end(), orderedBytes.begin() + static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes)), "the sample order is not the four words the version 42 pixel info adds after the stencil operation value export flag");
-    auto orderedVersion34 = orderedBytes;
-    orderedVersion34.pop_back();
+    auto orderedVersion34 = version43Bytes(orderedBytes);
     orderedVersion34.pop_back();
     orderedVersion34.pop_back();
     orderedVersion34.pop_back();
@@ -5221,16 +5934,15 @@ void verifyVertexInfoVersion19() {
     orderedVersion34[4] = 34u;
     const auto orderedReplay34 = serializer.Deserialize(encodeBase64(orderedVersion34));
     require(orderedReplay34.request.context.pixel.has_value() && orderedReplay34.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{} && serializer.Serialize(orderedReplay34.request) == encodedPixel, "a version 34 request read a sample order, or misread the fields after its pixel iteration fields");
-    auto orderedVersion30 = orderedBytes;
-    orderedVersion30.resize(orderedVersion30.size() - 5u);
+    auto orderedVersion30 = version43Bytes(orderedBytes);
+    orderedVersion30.resize(orderedVersion30.size() - 4u);
     orderedVersion30.erase(orderedVersion30.begin() + static_cast<std::ptrdiff_t>(blendOffset + 4u), orderedVersion30.begin() + static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes));
     orderedVersion30[4] = 30u;
     const auto orderedReplay30 = serializer.Deserialize(encodeBase64(orderedVersion30));
     require(orderedReplay30.request.context.pixel.has_value() && orderedReplay30.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{} && serializer.Serialize(orderedReplay30.request) == encodedPixel, "a version 30 request read a sample order, or misread the fields after its reversed-order blend code");
     auto orderedSpanned = ordered;
     orderedSpanned.target.spannedWaves = true;
-    auto orderedVersion32 = decodeBase64(serializer.Serialize(orderedSpanned));
-    orderedVersion32.pop_back();
+    auto orderedVersion32 = version43Bytes(decodeBase64(serializer.Serialize(orderedSpanned)));
     orderedVersion32.pop_back();
     require(orderedVersion32.size() > 2u && orderedVersion32.back() == 0u && orderedVersion32[orderedVersion32.size() - 2u] == 0u && orderedVersion32[orderedVersion32.size() - 3u] == 1u, "the spanned-waves flag is not the byte before the depth remap flag");
     orderedVersion32.pop_back();
@@ -5251,8 +5963,7 @@ void verifyVertexInfoVersion19() {
     sampledPixel.context.pixel->quadSampleMask = {0x1u, 0x2u, 0x4u, 0x8u};
     const auto sampledBytes = decodeBase64(serializer.Serialize(sampledPixel));
     require(std::equal(maskedBytes.begin(), maskedBytes.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u), sampledBytes.begin()) && sampledBytes[maskOffset + 1u] == 0x1u && sampledBytes[maskOffset + 5u] == 0x2u && sampledBytes[maskOffset + 9u] == 0x4u && sampledBytes[maskOffset + 13u] == 0x8u, "the quad sample masks are not the four words after the quad pixel mask");
-    auto version30 = sampledBytes;
-    version30.pop_back();
+    auto version30 = version43Bytes(sampledBytes);
     version30.pop_back();
     version30.pop_back();
     version30.pop_back();
@@ -5263,8 +5974,7 @@ void verifyVertexInfoVersion19() {
     require(replay30.request.context.pixel.has_value() && !replay30.request.context.pixel->iteratesSamples && replay30.request.context.pixel->positionLocation == PixelPositionLocation::Center && replay30.request.context.pixel->sampleLocations == std::array<std::uint8_t, 32>{} && decodeBase64(serializer.Serialize(replay30.request)) == sampledBytes, "a version 30 request read pixel iteration, a position location or sample locations, or misread the fields after its reversed-order blend code");
     auto spanned = sampledPixel;
     spanned.target.spannedWaves = true;
-    auto version32 = decodeBase64(serializer.Serialize(spanned));
-    version32.pop_back();
+    auto version32 = version43Bytes(decodeBase64(serializer.Serialize(spanned)));
     version32.pop_back();
     require(version32.size() > 2u && version32.back() == 0u && version32[version32.size() - 2u] == 0u && version32[version32.size() - 3u] == 1u, "the spanned-waves flag is not the byte before the depth remap flag");
     version32.pop_back();
@@ -5273,15 +5983,13 @@ void verifyVertexInfoVersion19() {
     version32[4] = 32u;
     const auto replay32 = serializer.Deserialize(encodeBase64(version32));
     require(replay32.request.context.pixel.has_value() && !replay32.request.context.pixel->iteratesSamples && replay32.request.context.pixel->sampleLocations == std::array<std::uint8_t, 32>{} && replay32.request.target.spannedWaves && serializer.Serialize(replay32.request) == serializer.Serialize(spanned), "a version 32 request read pixel iteration or sample locations, or lost its spanned-waves flag");
-    auto version29 = sampledBytes;
-    version29.pop_back();
+    auto version29 = version43Bytes(sampledBytes);
     version29.pop_back();
     version29.pop_back();
     version29.pop_back();
     version29.pop_back();
     version29.erase(version29.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes), version29.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes + 4u + iterationBytes + sampleOrderBytes));
-    auto version36 = sampledBytes;
-    version36.pop_back();
+    auto version36 = version43Bytes(sampledBytes);
     version36.pop_back();
     version36.erase(version36.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes + 4u + iterationBytes - 1u), version36.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes + 4u + iterationBytes + sampleOrderBytes));
     version36[4] = 36u;
@@ -5290,8 +5998,7 @@ void verifyVertexInfoVersion19() {
     version29[4] = 29u;
     const auto replay29 = serializer.Deserialize(encodeBase64(version29));
     require(replay29.request.context.pixel.has_value() && replay29.request.context.pixel->quadSampleMask == std::array<std::uint16_t, 4>{0x1u, 0x2u, 0x4u, 0x8u} && replay29.request.context.pixel->reversedBlend == 0u && decodeBase64(serializer.Serialize(replay29.request)) == sampledBytes, "a version 29 request read a reversed-order blend code or misread the fields after the quad sample masks");
-    auto version28 = sampledBytes;
-    version28.pop_back();
+    auto version28 = version43Bytes(sampledBytes);
     version28.pop_back();
     version28.pop_back();
     version28.pop_back();
@@ -5300,8 +6007,7 @@ void verifyVertexInfoVersion19() {
     version28[4] = 28u;
     const auto replay28 = serializer.Deserialize(encodeBase64(version28));
     require(replay28.request.context.pixel.has_value() && replay28.request.context.pixel->quadPixelMask == 0x2u && replay28.request.context.pixel->quadSampleMask == std::array<std::uint16_t, 4>{0xffffu, 0xffffu, 0xffffu, 0xffffu} && replay28.request.context.pixel->reversedBlend == 0u && decodeBase64(serializer.Serialize(replay28.request)) == maskedBytes, "a version 28 request read quad sample masks or a reversed-order blend code, or misread the fields after them");
-    auto version27 = maskedBytes;
-    version27.pop_back();
+    auto version27 = version43Bytes(maskedBytes);
     version27.pop_back();
     version27.pop_back();
     version27.pop_back();
@@ -5310,8 +6016,7 @@ void verifyVertexInfoVersion19() {
     version27[4] = 27u;
     const auto replay27 = serializer.Deserialize(encodeBase64(version27));
     require(replay27.request.context.pixel.has_value() && replay27.request.context.pixel->quadPixelMask == 0xfu && replay27.request.context.pixel->reversedBlend == 0u && serializer.Serialize(replay27.request) == encodedPixel, "a version 27 request read a quad pixel mask or reversed-order blend code, or misread the fields after it");
-    auto legacyPixel = plainPixel;
-    legacyPixel.pop_back();
+    auto legacyPixel = version43Bytes(plainPixel);
     legacyPixel.pop_back();
     legacyPixel.pop_back();
     legacyPixel.pop_back();
@@ -5366,9 +6071,11 @@ void verifyDepthRemapRequests() {
     const auto plainBytes = decodeBase64(plain);
     const auto remappedBytes = decodeBase64(remapped);
     constexpr std::size_t pointTailBytes = 13u;
-    require(plainBytes.size() == remappedBytes.size() && plainBytes.size() > 8u + pointTailBytes && std::equal(plainBytes.begin(), plainBytes.end() - 8 - pointTailBytes, remappedBytes.begin()) && std::equal(plainBytes.end() - 1 - pointTailBytes, plainBytes.end(), remappedBytes.end() - 1 - pointTailBytes), "the depth remap flag and mode are not the 6 bytes before the f32 flush and denormal preserve flags, the point tail and the fused arithmetic flag of a vertex request");
+    require(plainBytes.size() == remappedBytes.size() && plainBytes.size() > 13u + pointTailBytes && std::equal(plainBytes.begin(), plainBytes.end() - 13 - pointTailBytes, remappedBytes.begin()) && std::equal(plainBytes.end() - 6 - pointTailBytes, plainBytes.end(), remappedBytes.end() - 6 - pointTailBytes), "the depth remap flag and mode are not the 6 bytes before the f32 flush and denormal preserve flags, the point tail, the fused arithmetic flag, the pixel function LDS flag and the pixel function storage size of a vertex request");
     for (const std::uint8_t legacyVersion : {32u, 34u}) {
         auto legacyBytes = remappedBytes;
+        legacyBytes.resize(legacyBytes.size() - sizeof(std::uint32_t));
+        legacyBytes.pop_back();
         legacyBytes.pop_back();
         legacyBytes.pop_back();
         legacyBytes[4] = legacyVersion;
@@ -5378,6 +6085,8 @@ void verifyDepthRemapRequests() {
         require(serializer.Serialize(legacy.request) == plain, ("a version " + std::to_string(legacyVersion) + " vertex request misread the fields before the depth remap").c_str());
     }
     auto version35 = remappedBytes;
+    version35.resize(version35.size() - sizeof(std::uint32_t));
+    version35.pop_back();
     version35.pop_back();
     version35.pop_back();
     version35[4] = 35u;
@@ -5427,8 +6136,8 @@ void verifyMergedHullConfiguration() {
     require(!serializer.Deserialize(separate).request.graphics->tessellation->mergedHull, "a separate hull configuration was read as merged");
     constexpr std::size_t pointTailBytes = 13u;
     auto legacy = decodeBase64(merged);
-    require(legacy.size() > 54u + pointTailBytes && legacy[4] == 44u, "a merged hull request did not use serialization version 44");
-    legacy.resize(legacy.size() - 1u - pointTailBytes);
+    require(legacy.size() > 54u + pointTailBytes && legacy[4] == 46u, "a merged hull request did not use serialization version 46");
+    legacy.resize(legacy.size() - sizeof(std::uint32_t) - 2u - pointTailBytes);
     legacy.pop_back();
     require(legacy[legacy.size() - 52u] == 1u, "the merged hull flag is not the last byte of the tessellation configuration");
     legacy.erase(legacy.end() - 52);
@@ -6209,6 +6918,12 @@ void verifyUnnormalizedSamplers() {
     const auto adjusted = recompile(reservedDword3(0xf0800f09u), userData(normalized));
     require(proven(adjusted, false), "sampler dword 3: an image_sample_a whose S# dword 3 holds only a ballot in its reserved bits was not compiled");
     expectFailure([&] { static_cast<void>(recompile(reservedDword3(0xf0800f08u), userData(normalized))); }, "GetSamplerResource dword 3 is not a valid runtime value", "sampler dword 3: an image_sample whose S# dword 3 holds a ballot was accepted");
+    for (const auto& [adjust, plain, compiled, accepted] : {
+             std::tuple{0xf1200109u, 0xf1200108u, "sampler dword 3: an image_gather4_c_a whose S# dword 3 holds only a ballot in its reserved bits was not compiled", "sampler dword 3: an image_gather4_c with a computed S# dword 3 was accepted"},
+             std::tuple{0xf1600109u, 0xf1600108u, "sampler dword 3: an image_gather4_c_o_a whose S# dword 3 holds only a ballot in its reserved bits was not compiled", "sampler dword 3: an image_gather4_c_o with a computed S# dword 3 was accepted"}}) {
+        require(proven(recompile(reservedDword3(adjust), imageData(normalized, Type2D, Format32Float, 0u)), false), compiled);
+        expectFailure([&] { static_cast<void>(recompile(reservedDword3(plain), imageData(normalized, Type2D, Format32Float, 0u))); }, "GetSamplerResource dword 3 is not a valid runtime value", accepted);
+    }
     reject(0xf09c0f18u, imageData(unnormalized, TypeCube, Format8888UNorm, 5u), "unnormalized guest sampler samples a 1D-array, 2D-array, 3D, cube or multisampled image", "unnormalized samplers: a cube T# was accepted");
     reject(0xf09c0f10u, imageData(unnormalized, Type3D, Format8888UNorm, 3u), "unnormalized guest sampler samples a 1D-array, 2D-array, 3D, cube or multisampled image", "unnormalized samplers: a 3D T# was accepted");
     reject(0xf09c0f28u, imageData(unnormalized, Type2DArray, Format8888UNorm, 5u), "unnormalized guest sampler samples a 1D-array, 2D-array, 3D, cube or multisampled image", "unnormalized samplers: a 2D-array sample was accepted");
@@ -7554,8 +8269,19 @@ void verifyFmaskImageMode() {
     const auto modes = ResourceMaterializer::RuntimeImageModes(image);
     const auto selected = ResourceMaterializer::RuntimeImageMode(image, descriptor, modes);
     require(modes[selected].numericClass == IrTextureNumericClass::Uint && modes[selected].packedFormat == IrBufferFormat::Invalid && !modes[selected].constantSwizzle, "FMASK did not select a bound integer image mode");
-    for (std::uint32_t format = 156u; format <= 168u; ++format) {
-        if (format == 166u) continue;
+    for (const auto format : {156u, 157u, 158u, 159u, 160u, 161u, 163u, 165u}) {
+        descriptor.dwords[1] = format << 20u;
+        const auto expanded = ResourceMaterializer::RuntimeImageMode(image, descriptor, modes);
+        require(expanded != selected && modes[expanded].numericClass == IrTextureNumericClass::Uint && modes[expanded].conversionFormat == FmaskExpansion && modes[expanded].dimension == RdnaImageDimension::Dim2D, "an FMASK format of up to 8 samples did not select the FMASK expansion mode");
+    }
+    require(std::ranges::count_if(modes, [](const ImageResource& mode) { return mode.conversionFormat == FmaskExpansion; }) == 1, "FMASK expansion needs exactly one runtime image mode");
+    for (const auto format : {161u, 166u}) {
+        descriptor.dwords[1] = format << 20u;
+        descriptor.dwords[3] = 0x91800005u;
+        expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(image, descriptor, modes)); }, "FMASK destination channel selector is not implemented", "an FMASK load selecting Y was accepted");
+    }
+    descriptor.dwords[3] = 0x91800004u;
+    for (const auto format : {162u, 164u, 167u, 168u}) {
         descriptor.dwords[1] = format << 20u;
         expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(image, descriptor, modes)); }, "FMASK format is not implemented", "an unsupported FMASK format was accepted");
     }
@@ -7613,6 +8339,37 @@ void verifyVolumeArrayLoadMode() {
     expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(store, descriptor, ResourceMaterializer::RuntimeImageModes(store))); }, "incompatible with the static runtime image interface", "2D-array image atomic on a 3D T# was accepted");
 }
 
+void verifyMultisamplePlaneReadMode() {
+    using namespace ShaderRecompiler;
+    const DescriptorValue descriptor{{0x02754d00u, 0xc3800000u, 0x00cbc167u, 0xe1b20facu, 0u, 0x00700020u, 0u, 0u}, 8u};
+    ImageResource image{};
+    image.resourceClass = ImageResourceClass::Sampled;
+    image.dimension = RdnaImageDimension::Dim2D;
+    const auto modes = ResourceMaterializer::RuntimeImageModes(image);
+    const auto selected = ResourceMaterializer::RuntimeImageMode(image, descriptor, modes);
+    require(modes[selected].dimension == RdnaImageDimension::Dim2D && !modes[selected].cube && modes[selected].numericClass == IrTextureNumericClass::Float, "a 2D read of a 2D MSAA T# (PPSA18216's) did not select a 2D runtime mode");
+    for (const auto& [word1, word3, word5, numericClass] : std::array<std::tuple<std::uint32_t, std::uint32_t, std::uint32_t, IrTextureNumericClass>, 4>{{{0xc0100000u, 0xe1b20facu, 0x00700020u, IrTextureNumericClass::Float}, {0xc0500000u, 0xe1810facu, 0x00700010u, IrTextureNumericClass::Uint}, {0xc0c00000u, 0xe1b20facu, 0x00700020u, IrTextureNumericClass::Sint}, {0xc0d00000u, 0xe1830facu, 0x00700030u, IrTextureNumericClass::Float}}}) {
+        const DescriptorValue narrow{{0x02754d00u, word1, 0x00cbc167u, word3, 0u, word5, 0u, 0u}, 8u};
+        const auto mode = ResourceMaterializer::RuntimeImageMode(image, narrow, modes);
+        require(modes[mode].dimension == RdnaImageDimension::Dim2D && !modes[mode].cube && modes[mode].numericClass == numericClass, "a 2D read of a 2D MSAA T# with 8-bit or 16-bit texels did not select a 2D runtime mode");
+    }
+    const DescriptorValue depthBits{{0x02754d00u, 0xc0b00000u, 0x00cbc167u, 0xe1820facu, 0u, 0x00700020u, 0u, 0u}, 8u};
+    expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(image, depthBits, modes)); }, "incompatible with the static runtime image interface", "a 2D read of a 16_UINT SW_64KB_Z_X 2D MSAA T#, read as depth bits, was accepted");
+    const auto refused = [&](const ImageResource& access, const char* what) {
+        expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(access, descriptor, ResourceMaterializer::RuntimeImageModes(access))); }, "incompatible with the static runtime image interface", what);
+    };
+    auto other = image;
+    other.cubeFaceCompatible = false;
+    refused(other, "a 2D read of a 2D MSAA T# through a mip, gather, bias, gradient or offset access was accepted");
+    other = image;
+    other.depthCompare = true;
+    refused(other, "a 2D depth comparison of a 2D MSAA T# was accepted");
+    other = image;
+    other.resourceClass = ImageResourceClass::Storage;
+    other.written = true;
+    refused(other, "a 2D storage access to a 2D MSAA T# was accepted");
+}
+
 void verifyVolumeBiasTableRejection() {
     using namespace ShaderRecompiler;
     namespace Abi = ImageTableAbi;
@@ -7656,6 +8413,85 @@ void verifyVolumeBiasTableRejection() {
     }
 }
 
+void verifySamplerTableDeduplication() {
+    using namespace ShaderRecompiler;
+    namespace Abi = ImageTableAbi;
+    SamplerResource sampler0{};
+    sampler0.table = 0u;
+    SamplerResource sampler1{};
+    sampler1.table = 1u;
+    ShaderInfo info{};
+    info.samplers.push_back(sampler0);
+    info.samplers.push_back(sampler1);
+    ResourceSnapshot snapshot{};
+    snapshot.tables.tables.resize(2u);
+    const DescriptorValue s0{{0x00000600u, 0x00fff000u, 0x06f03fa0u, 0u}, 4u};
+    const DescriptorValue s1{{0x00000700u, 0x00fff000u, 0x06f03fa0u, 0u}, 4u};
+    const DescriptorValue s2{{0x00000800u, 0x00fff000u, 0x06f03fa0u, 0u}, 4u};
+    std::vector<std::uint32_t> codes(300u);
+    for (std::size_t i = 0; i < 300u; ++i) codes[i] = static_cast<std::uint32_t>(i % 3u);
+    for (std::uint32_t table = 0u; table < 2u; ++table) {
+        auto& column = snapshot.tables.tables[table];
+        column.records = 300u;
+        column.keys = 300u;
+        column.codes = SharedValues<std::uint32_t>(codes);
+        column.words = SharedValues<DescriptorValue>(std::vector<DescriptorValue>{s0, s1, s2});
+    }
+    const auto resolved = ResourceMaterializer::ResolveImageTables(info, snapshot);
+    require(resolved.samplers.size() == (3u + 1u) * Abi::SamplerEntryElements, "sampler table deduplication: duplicate sampler entries across tables were not deduplicated");
+    for (std::uint32_t table = 0u; table < 2u; ++table) {
+        const auto mapStart = resolved.map.at(Abi::TableHeader(table) + Abi::TableMapStart);
+        for (std::uint32_t key = 0; key < 300u; ++key) {
+            const auto record = resolved.map.at(mapStart + key);
+            const auto element = resolved.map.at(record + Abi::SamplerRecordElement);
+            require(element == (key % 3u) * Abi::SamplerEntryElements, "sampler table deduplication: record points to the wrong deduplicated sampler element");
+            require((resolved.map.at(record + Abi::SamplerRecordFlags) & Abi::PoisonFlag) == 0u, "sampler table deduplication: deduplicated sampler was poisoned");
+        }
+    }
+
+    constexpr std::uint32_t MaxUnique = Abi::SamplerElementBudget / Abi::SamplerEntryElements;
+    std::vector<DescriptorValue> budgetWords;
+    budgetWords.reserve(MaxUnique + 1u);
+    for (std::uint32_t i = 0; i < MaxUnique + 1u; ++i) {
+        budgetWords.push_back(DescriptorValue{{0x00000600u, 0x00fff000u, 0x06f03fa0u, i + 1u}, 4u});
+    }
+    std::vector<std::uint32_t> budgetCodes(MaxUnique + 2u);
+    for (std::uint32_t i = 0; i < MaxUnique; ++i) budgetCodes[i] = i;
+    budgetCodes[MaxUnique] = 0u;
+    budgetCodes[MaxUnique + 1u] = MaxUnique;
+
+    ShaderInfo budgetInfo{};
+    SamplerResource budgetSampler{};
+    budgetSampler.table = 0u;
+    budgetInfo.samplers.push_back(budgetSampler);
+    ResourceSnapshot budgetSnapshot{};
+    budgetSnapshot.tables.tables.resize(1u);
+    auto& budgetColumn = budgetSnapshot.tables.tables[0];
+    budgetColumn.records = static_cast<std::uint32_t>(budgetCodes.size());
+    budgetColumn.keys = static_cast<std::uint32_t>(budgetCodes.size());
+    budgetColumn.codes = SharedValues<std::uint32_t>(budgetCodes);
+    budgetColumn.words = SharedValues<DescriptorValue>(budgetWords);
+
+    const auto budgetResolved = ResourceMaterializer::ResolveImageTables(budgetInfo, budgetSnapshot);
+    require(budgetResolved.samplers.size() == Abi::SamplerElementBudget, "sampler table budget: valid unique samplers did not fill budget");
+    const auto budgetMapStart = budgetResolved.map.at(Abi::TableHeader(0) + Abi::TableMapStart);
+
+    const auto dupRecord = budgetResolved.map.at(budgetMapStart + MaxUnique);
+    const auto dupFlags = budgetResolved.map.at(dupRecord + Abi::SamplerRecordFlags);
+    require((dupFlags & Abi::PoisonFlag) == 0u, "sampler table budget: duplicate of existing sampler was poisoned when budget is full");
+    require(budgetResolved.map.at(dupRecord + Abi::SamplerRecordElement) == 0u, "sampler table budget: duplicate sampler did not reuse existing element");
+
+    const auto overflowRecord = budgetResolved.map.at(budgetMapStart + MaxUnique + 1u);
+    const auto overflowFlags = budgetResolved.map.at(overflowRecord + Abi::SamplerRecordFlags);
+    require((overflowFlags & Abi::PoisonFlag) != 0u, "sampler table budget: exceeding sampler budget did not poison record");
+    require(budgetResolved.poison.at(overflowFlags & ~Abi::PoisonFlag).reason == Abi::PoisonReason::Budget, "sampler table budget: poisoned reason is not Budget");
+
+    const auto outsideRecord = budgetResolved.map.at(Abi::TableHeader(0) + Abi::TableOutsideCode);
+    const auto outsideFlags = budgetResolved.map.at(outsideRecord + Abi::SamplerRecordFlags);
+    require((outsideFlags & Abi::PoisonFlag) != 0u, "sampler table budget: TableOutsideCode did not poison when budget is full");
+    require(budgetResolved.poison.at(outsideFlags & ~Abi::PoisonFlag).reason == Abi::PoisonReason::Budget, "sampler table budget: TableOutsideCode poisoned reason is not Budget");
+}
+
 void verifyDynamicStorageMipChain() {
     using namespace ShaderRecompiler;
     ImageResource image{};
@@ -7734,6 +8570,21 @@ int main(int argc, char** argv) {
             std::cout << "Prepared frontend reuse preserves full and partial-thread programs\n";
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--result-memo-budget") {
+            verifyResultMemoBudget();
+            std::cout << "The result memo keeps its most recently used results within its byte budget\n";
+            return 0;
+        }
+        if (argc == 2 && std::string_view(argv[1]) == "--result-memo-budget-masked") {
+            verifyResultMemoBudgetMasked();
+            std::cout << "The result memo budget counts and trims the masked table's entries\n";
+            return 0;
+        }
+        if (argc == 2 && std::string_view(argv[1]) == "--result-memo-budget-threads") {
+            verifyResultMemoBudgetThreads();
+            std::cout << "The result memo ends within its byte budget when results are inserted during a trim\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--layout-pair") {
             verifyLayoutPair();
             std::cout << "Both push-constant layouts of a pixel shader compile from one program unchanged\n";
@@ -7820,10 +8671,18 @@ int main(int argc, char** argv) {
         verifySignedMinimum();
         verifyMayEvaluate();
         verifyPureFlatSlots();
+        verifyPlanConditionPruning();
+        verifyPlanRetention();
+        verifyPlanRetentionChains();
+        verifyPlanCopyAnswers();
         verifyGuardedDescriptorSources();
+        verifyLaneMaskGuardedDescriptorSources();
+        verifyExecGuardedDescriptorSources();
         verifySrtTape();
+        verifyTargetFeatureKey();
         verifyImageTableKeys();
         verifyImageTables();
+        verifySpecializedModuleRelease();
         verifyImageTableRegistration();
         verifyScalarAddressRule();
         verifyPointerImageTable();
@@ -7874,7 +8733,9 @@ int main(int argc, char** argv) {
         verifyCubeDepthCompareMode();
         verifyVolumeArrayLoadMode();
         verifyArrayVolumeStoreMode();
+        verifyMultisamplePlaneReadMode();
         verifyVolumeBiasTableRejection();
+        verifySamplerTableDeduplication();
         verifyDynamicStorageMipChain();
         verifySrgbDepthCompareModes();
         verifyQuadMaskNeighbourReads();
diff --git a/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp b/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp
index f1fe06c422..496fb288c5 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
 #include "prx/libc/include/GuestArena.hpp"
@@ -17,14 +18,6 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-}
-
 namespace {
 using namespace AgcDriver::GuestMemory;
 void require(bool condition, const char* reason) { if (!condition) throw std::runtime_error(reason); }
@@ -36,13 +29,14 @@ struct Mapping {
         require(sceKernelAllocateDirectMemory(0, 0x10000000000ll, size, 65536, 3, &physical) == 0, "allocate direct memory failed");
         if (sceKernelMapDirectMemory(&data, size, 3, 0, physical, 65536) != 0) {
             sceKernelReleaseDirectMemory(physical, size);
+
             throw std::runtime_error("map direct memory failed");
         }
     }
     Mapping(const Mapping&) = delete;
     Mapping& operator=(const Mapping&) = delete;
     ~Mapping() {
-        if (data != nullptr) sceKernelMunmap(data, size);
+        if (data != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), size);
         if (physical >= 0) sceKernelReleaseDirectMemory(physical, size);
     }
     std::uint64_t Address() const { return reinterpret_cast<std::uint64_t>(data); }
@@ -180,7 +174,7 @@ void partialCollect() {
     require(collect(alias, 0, mapping.size, 4, true) == std::vector<std::size_t>{page, page * 2}, "writes to two pages were not reported apart");
     require(collect(mapping.data, 0, mapping.size, 4, true) == std::vector<std::size_t>{page, page * 2}, "writes to two pages were not reported for their own view");
     require(collect(mapping.data, 0, mapping.size, 4, false).empty() && collect(alias, 0, mapping.size, 4, false).empty(), "page tracking did not settle");
-    require(sceKernelMunmap(alias, mapping.size) == 0, "partial collect alias unmap failed");
+    require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), mapping.size) == 0, "partial collect alias unmap failed");
 #endif
     std::cout << "Partial shared write collection tests passed\n";
 }
@@ -253,14 +247,14 @@ void run() {
         require(std::memcmp(replacement.data, across.data() + part, part) == 0, "physical alias did not see the write");
         require(std::all_of(static_cast<std::byte*>(originalAlias), static_cast<std::byte*>(originalAlias) + part, [](auto x) { return x == std::byte{29}; }), "replaced virtual range wrote the old backing");
 #ifndef _WIN32
-        require(sceKernelMunmap(middle, part) == 0, "partial unmap failed");
+        require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(middle), part) == 0, "partial unmap failed");
         const auto saved = bytes[0];
         across[0] = std::byte{99};
         require(!GuestArena::GuestArenaWriteSharedBacking_nid_no_patch(mapping.Address(), across.data(), across.size()), "writer accepted an unmapped gap");
         require(bytes[0] == saved, "failed shared write changed its prefix");
 #endif
         require(sceKernelMapDirectMemory(&middle, part, 3, 0x10, mapping.physical + part, part) == 0, "original backing restore failed");
-        require(sceKernelMunmap(originalAlias, part) == 0, "alias unmap failed");
+        require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(originalAlias), part) == 0, "alias unmap failed");
     }
     std::vector<std::thread> threads;
     for (unsigned i = 0; i < 8; ++i) threads.emplace_back([&, i] {
diff --git a/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp b/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp
index 8155564e0b..2bb13e5283 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp
@@ -77,10 +77,18 @@ Usage Scan(std::span<const std::uint32_t> words) {
     std::uint32_t laneZeroBody = 0u;
     std::uint32_t lockPointer = 0u;
     std::map<std::uint32_t, std::uint32_t> constants;
+    std::uint32_t faultFunction = 0u;
+    bool inFaultFunction = false;
     for (std::size_t cursor = 5; cursor < words.size();) {
         const auto count = words[cursor] >> spv::WordCountShift;
         const auto op = static_cast<spv::Op>(words[cursor] & spv::OpCodeMask);
         Require(count != 0 && cursor + count <= words.size(), "truncated SPIR-V instruction");
+        if (op == spv::OpName && count >= 3u && std::string_view(reinterpret_cast<const char*>(words.data() + cursor + 2u)) == "record_bda_fault") faultFunction = words[cursor + 1u];
+        if (op == spv::OpFunction && count >= 3u) inFaultFunction = words[cursor + 2u] == faultFunction;
+        if (inFaultFunction) {
+            cursor += count;
+            continue;
+        }
         if (op == spv::OpDecorate && count >= 4u && words[cursor + 2u] == spv::DecorationBuiltIn && words[cursor + 3u] == spv::BuiltInLocalInvocationIndex) {
             localIndexVariable = words[cursor + 1u];
         }
diff --git a/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp b/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp
index 1be75623e3..956897cb51 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp
@@ -1,5 +1,7 @@
 #include "SpirvBackend/SpirvModule.hpp"
 #include "SpirvBackend/SpirvSpecialization.hpp"
+#include "Recompiler.hpp"
+#include <algorithm>
 #include <array>
 #include <cstdio>
 #include <exception>
@@ -298,6 +300,92 @@ void testIdsBeyondTheBoundAreRejected() {
     check(rejected, "a module whose ids reach its bound was specialized");
 }
 
+void testPrivateCompositeTableLoadFolding() {
+    for (const auto storageClass : {spv::StorageClassPrivate, spv::StorageClassFunction}) {
+        for (const auto accessOp : {spv::OpAccessChain, spv::OpInBoundsAccessChain}) {
+            const auto build = [&](bool dynamicIndex, bool storeThroughChain) {
+                SpirvModule module;
+                module.EmitCapability(spv::CapabilityShader);
+                const auto typeVoid = module.Type(spv::OpTypeVoid);
+                const auto typeBool = module.Type(spv::OpTypeBool);
+                const auto typeU32 = module.Type(spv::OpTypeInt, 32u, 0u);
+                const auto falseVal = module.Constant(spv::OpConstantFalse, typeBool);
+                const auto zero = module.Constant(spv::OpConstant, typeU32, 0u);
+                const auto one = module.Constant(spv::OpConstant, typeU32, 1u);
+                const auto three = module.Constant(spv::OpConstant, typeU32, 3u);
+                const auto sixteen = module.Constant(spv::OpConstant, typeU32, 16u);
+                const auto twenty = module.Constant(spv::OpConstant, typeU32, 20u);
+                const auto thirty = module.Constant(spv::OpConstant, typeU32, 30u);
+                const auto typeArray = module.Type(spv::OpTypeArray, typeU32, three);
+                const auto initial = module.Constant(spv::OpConstantComposite, typeArray, std::vector<std::uint32_t>{sixteen, twenty, thirty});
+                const auto typeInputPtr = module.Type(spv::OpTypePointer, spv::StorageClassInput, typeU32);
+                const auto typeTablePtr = module.Type(spv::OpTypePointer, storageClass, typeArray);
+                const auto typeElementPtr = module.Type(spv::OpTypePointer, storageClass, typeU32);
+                const auto typePrivatePtr = module.Type(spv::OpTypePointer, spv::StorageClassPrivate, typeU32);
+                const auto typeFunction = module.Type(spv::OpTypeFunction, typeVoid);
+                const auto input = module.DefineGlobalVariable(typeInputPtr, spv::StorageClassInput);
+                const auto table = storageClass == spv::StorageClassPrivate
+                    ? module.DefineInitializedGlobalVariable(typeTablePtr, spv::StorageClassPrivate, initial)
+                    : module.AllocateId();
+                const auto output = module.DefineGlobalVariable(typePrivatePtr, spv::StorageClassPrivate);
+                const auto mainId = module.AllocateId();
+                const auto lane = module.AllocateId();
+                const auto rawCond = module.AllocateId();
+                const auto cond = module.AllocateId();
+                const auto baseIndex = module.AllocateId();
+                const auto index = module.AllocateId();
+                const auto element = module.AllocateId();
+                const auto loaded = module.AllocateId();
+                const auto sum = module.AllocateId();
+                module.AddFunction(spv::OpFunction, typeVoid, mainId, spv::FunctionControlMaskNone, typeFunction);
+                module.AddFunction(spv::OpLabel, module.AllocateId());
+                if (storageClass == spv::StorageClassFunction) module.AddFunction(spv::OpVariable, typeTablePtr, table, spv::StorageClassFunction, initial);
+                module.AddFunction(spv::OpLoad, typeU32, lane, input);
+                if (storeThroughChain) {
+                    const auto writePtr = module.AllocateId();
+                    module.AddFunction(accessOp, typeElementPtr, writePtr, table, zero);
+                    module.AddFunction(spv::OpStore, writePtr, lane);
+                }
+                module.AddFunction(spv::OpUGreaterThan, typeBool, rawCond, lane, zero);
+                module.AddFunction(spv::OpLogicalOr, typeBool, cond, rawCond, falseVal);
+                module.AddFunction(spv::OpIAdd, typeU32, baseIndex, one, one);
+                module.AddFunction(spv::OpSelect, typeU32, index, cond, baseIndex, baseIndex);
+                module.AddFunction(accessOp, typeElementPtr, element, table, dynamicIndex ? lane : index);
+                module.AddFunction(spv::OpLoad, typeU32, loaded, element);
+                module.AddFunction(spv::OpIAdd, typeU32, sum, lane, loaded);
+                module.AddFunction(spv::OpStore, output, sum);
+                module.AddFunction(spv::OpReturn);
+                module.AddFunction(spv::OpFunctionEnd);
+                return std::pair{ShaderRecompiler::SpecializeSpirv(module.Finalize()), thirty};
+            };
+            const auto [folded, expectedConstant] = build(false, false);
+            const auto foldedCounts = opcodeCounts(folded);
+            check(!foldedCounts.contains(accessOp), "a constant-index composite table access chain was not removed");
+            check(!foldedCounts.contains(spv::OpLogicalOr), "a right-false OpLogicalOr was not simplified");
+            check(!foldedCounts.contains(spv::OpSelect), "an identical-arm OpSelect was not simplified");
+            check(foldedCounts.contains(spv::OpLoad) && foldedCounts.at(spv::OpLoad) == 1u, "a constant-index composite table load was not folded");
+            bool addedThirty = false;
+            for (std::size_t cursor = 5; cursor < folded.size(); cursor += folded[cursor] >> 16u) {
+                if ((folded[cursor] >> 16u) == 0u) break;
+                if ((folded[cursor] & 0xffffu) == spv::OpIAdd && folded[cursor + 4u] == expectedConstant) addedThirty = true;
+            }
+            check(addedThirty, "a constant-index composite table load did not fold to its element constant");
+
+            const auto [dynamic, unusedDynamic] = build(true, false);
+            static_cast<void>(unusedDynamic);
+            const auto dynamicCounts = opcodeCounts(dynamic);
+            check(dynamicCounts.contains(accessOp) && dynamicCounts.at(accessOp) == 1u, "a dynamic-index composite table access chain was removed");
+            check(dynamicCounts.contains(spv::OpLoad) && dynamicCounts.at(spv::OpLoad) == 2u, "a dynamic-index composite table load was folded");
+
+            const auto [mutated, unusedMutated] = build(false, true);
+            static_cast<void>(unusedMutated);
+            const auto mutatedCounts = opcodeCounts(mutated);
+            check(mutatedCounts.contains(accessOp) && mutatedCounts.at(accessOp) == 2u, "a mutated composite table access chain was removed");
+            check(mutatedCounts.contains(spv::OpLoad) && mutatedCounts.at(spv::OpLoad) == 2u, "a mutated composite table load was folded despite a store through an access chain");
+        }
+    }
+}
+
 void testBlockBallotsOfOnePredicateShareOneBallot() {
     SpirvModule module;
     const auto typeBool = module.Type(spv::OpTypeBool);
@@ -356,10 +444,41 @@ void testBlockBallotsOfOnePredicateShareOneBallot() {
     check(ballotSources.contains(afterLabel), "a ballot in a later block reused one from an earlier block");
 }
 
+void testInternedSpirvSharesEqualWords() {
+    const std::vector<std::uint32_t> words{spv::MagicNumber, 0x00010400u, 0u, 7u, 0u, (2u << 16u) | spv::OpCapability, spv::CapabilityShader};
+    auto changed = words;
+    changed.back() = spv::CapabilityInt64;
+    const auto first = InternSpirv(words);
+    const auto second = InternSpirv(words);
+    const auto other = InternSpirv(changed);
+    check(std::ranges::equal(first.Words(), words) && std::ranges::equal(other.Words(), changed), "interned SPIR-V changed its words");
+    check(first.data() == second.data(), "two equal specialized modules kept separate copies of their words");
+    check(first.data() != other.data(), "different SPIR-V was interned into one copy");
+    auto edited = second;
+    edited[6] = spv::CapabilityFloat64;
+    const auto again = InternSpirv(words);
+    check(edited[6] == spv::CapabilityFloat64 && first[6] == spv::CapabilityShader && again.data() == first.data(), "a write to one holder of interned SPIR-V changed the others");
+}
+
+void testInternedSpirvReleasesUnusedWords() {
+    const std::vector<std::uint32_t> words{spv::MagicNumber, 0x00010400u, 0u, 7u, 0u, (2u << 16u) | spv::OpCapability, spv::CapabilityGeometry};
+    SharedSpirv::Weak released;
+    {
+        const auto first = InternSpirv(words);
+        const auto second = InternSpirv(words);
+        check(first.data() == second.data(), "two equal specialized modules kept separate copies of their words");
+        released = first.Weaken();
+    }
+    check(released.Expired(), "the SPIR-V interning table kept words no holder uses");
+    const auto again = InternSpirv(words);
+    check(std::ranges::equal(again.Words(), words) && released.Lock().empty(), "SPIR-V interned again after its release changed its words");
+}
+
 int main() {
     testFoldingLeavesNoDeadBlocksOrConstants();
     testIdsBeyondTheBoundAreRejected();
     testStructExtractsAreNotShuffled();
+    testPrivateCompositeTableLoadFolding();
     testRepeatedTypesShareOneId();
     testOperandShapesDoNotCollide();
     testOperandKindsAgree();
@@ -371,6 +490,8 @@ int main() {
     testIdsStayUniqueBeyondCacheCapacity();
     testEmittedWordsAreStable();
     testBlockBallotsOfOnePredicateShareOneBallot();
+    testInternedSpirvSharesEqualWords();
+    testInternedSpirvReleasesUnusedWords();
     if (failures != 0) {
         std::fprintf(stderr, "%d check(s) failed\n", failures);
         return 1;
diff --git a/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp b/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp
index eb5a967d31..b50010c578 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp
@@ -396,6 +396,7 @@ std::optional<std::pair<std::uint32_t, std::uint32_t>> storedLaneFunction(const
         switch (opcode) {
         case spv::OpFunction:
         case spv::OpLabel:
+        case spv::OpVariable:
         case spv::OpReturn:
         case spv::OpFunctionEnd:
             break;
@@ -936,6 +937,95 @@ OpStore %slot2 %second
     check(opcodeCount(acrossCall, spv::OpGroupNonUniformBallot) == 2, "a ballot was shared across a function call");
 }
 
+std::string privateTableModuleSource(const std::string& body, bool functionTable = false) {
+    const std::string storage = functionTable ? "Function" : "Private";
+    const std::string globalTable = functionTable ? "" : "%table = OpVariable %tableArray Private %initial\n";
+    const std::string localTable = functionTable ? "%table = OpVariable %tableArray Function %initial\n" : "";
+    return R"(OpCapability Shader
+OpMemoryModel Logical GLSL450
+OpEntryPoint GLCompute %main "main" %index
+OpExecutionMode %main LocalSize 8 1 1
+OpDecorate %index BuiltIn LocalInvocationIndex
+%void = OpTypeVoid
+%bool = OpTypeBool
+%uint = OpTypeInt 32 0
+%false = OpConstantFalse %bool
+%zero = OpConstant %uint 0
+%one = OpConstant %uint 1
+%three = OpConstant %uint 3
+%sixteen = OpConstant %uint 16
+%twenty = OpConstant %uint 20
+%thirty = OpConstant %uint 30
+%array = OpTypeArray %uint %three
+%initial = OpConstantComposite %array %sixteen %twenty %thirty
+%input = OpTypePointer Input %uint
+%tableArray = OpTypePointer )" + storage + R"( %array
+%tableElement = OpTypePointer )" + storage + R"( %uint
+%private = OpTypePointer Private %uint
+%function = OpTypeFunction %void
+%index = OpVariable %input Input
+)" + globalTable + R"(%output = OpVariable %private Private
+%main = OpFunction %void None %function
+%entry = OpLabel
+)" + localTable + R"(%lane = OpLoad %uint %index
+)" + body + R"(OpReturn
+OpFunctionEnd
+)";
+}
+
+void testSpecializedPrivateCompositeTableLoad() {
+    for (const bool functionTable : {false, true}) {
+        for (const bool inBounds : {false, true}) {
+            const auto accessName = inBounds ? "OpInBoundsAccessChain" : "OpAccessChain";
+            const auto accessOp = inBounds ? spv::OpInBoundsAccessChain : spv::OpAccessChain;
+            const std::string label = std::string(accessName) + (functionTable ? " (Function)" : " (Private)");
+            try {
+                const auto folded = assemble(privateTableModuleSource(
+                    "%rawCond = OpUGreaterThan %bool %lane %zero\n"
+                    "%cond = OpLogicalOr %bool %rawCond %false\n"
+                    "%baseOffset = OpIAdd %uint %one %one\n"
+                    "%offset = OpSelect %uint %cond %baseOffset %baseOffset\n"
+                    "%element = " + std::string(accessName) + " %tableElement %table %offset\n"
+                    "%loaded = OpLoad %uint %element\n"
+                    "%sum = OpIAdd %uint %lane %loaded\n"
+                    "OpStore %output %sum\n", functionTable));
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(folded, Vulkan11, Spirv13, false, false));
+                const auto specializedFolded = ShaderRecompiler::SpecializeSpirv(folded);
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(specializedFolded, Vulkan11, Spirv13, false, false));
+                check(opcodeCount(specializedFolded, accessOp) == 0u, label + ": constant-index table access chain was not removed");
+                check(opcodeCount(specializedFolded, spv::OpLogicalOr) == 0u, label + ": right-false OpLogicalOr was not simplified");
+                check(opcodeCount(specializedFolded, spv::OpSelect) == 0u, label + ": identical-arm OpSelect was not simplified");
+                check(opcodeCount(specializedFolded, spv::OpLoad) == 1u, label + ": constant-index table load was not folded");
+                check(storedLaneFunction(specializedFolded) == std::optional<std::pair<std::uint32_t, std::uint32_t>>({1u, 30u}), label + ": constant-index table load folded to the wrong value");
+
+                const auto dynamic = assemble(privateTableModuleSource(
+                    "%element = " + std::string(accessName) + " %tableElement %table %lane\n"
+                    "%loaded = OpLoad %uint %element\n"
+                    "OpStore %output %loaded\n", functionTable));
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(dynamic, Vulkan11, Spirv13, false, false));
+                const auto specializedDynamic = ShaderRecompiler::SpecializeSpirv(dynamic);
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(specializedDynamic, Vulkan11, Spirv13, false, false));
+                check(opcodeCount(specializedDynamic, accessOp) == 1u, label + ": dynamic-index table access chain was removed");
+                check(opcodeCount(specializedDynamic, spv::OpLoad) == 2u, label + ": dynamic-index table load was folded");
+
+                const auto mutated = assemble(privateTableModuleSource(
+                    "%writeElement = " + std::string(accessName) + " %tableElement %table %zero\n"
+                    "OpStore %writeElement %lane\n"
+                    "%readElement = " + std::string(accessName) + " %tableElement %table %one\n"
+                    "%loaded = OpLoad %uint %readElement\n"
+                    "OpStore %output %loaded\n", functionTable));
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(mutated, Vulkan11, Spirv13, false, false));
+                const auto specializedMutated = ShaderRecompiler::SpecializeSpirv(mutated);
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(specializedMutated, Vulkan11, Spirv13, false, false));
+                check(opcodeCount(specializedMutated, accessOp) == 2u, label + ": mutated table access chain was removed");
+                check(opcodeCount(specializedMutated, spv::OpLoad) == 2u, label + ": mutated table load was folded despite a store through an access chain");
+            } catch (const std::exception& error) {
+                check(false, label + " table specialization: " + error.what());
+            }
+        }
+    }
+}
+
 }
 
 int main() {
@@ -953,6 +1043,7 @@ int main() {
     testFoldedConstantUsedByUndecodedInstructionIsKept();
     testSharedConstantsAreNotCopiedForUndecodedUsers();
     testSharedBooleanConstantsKeepTheirValues();
+    testSpecializedPrivateCompositeTableLoad();
     testBallotsMergedIntoOneBlockShareOneBallot(optimizationEnabled);
     if (failures != 0) {
         std::fprintf(stderr, "%d optimizer check(s) failed\n", failures);
@@ -961,3 +1052,4 @@ int main() {
     std::puts("SPIR-V optimizer checks passed");
     return 0;
 }
+
diff --git a/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp b/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp
index 272e5ed914..0578ee283d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp
@@ -5,10 +5,12 @@
 #include <cstdint>
 #include <cstdio>
 #include <exception>
+#include <span>
 #include <stdexcept>
 #include <string>
 #include <string_view>
 #include <unordered_map>
+#include <utility>
 
 namespace {
 
@@ -34,6 +36,10 @@ constexpr std::array<std::uint32_t, 19> BranchedLdsStep{
     0xbf8cc07fu, 0xbf8a0000u, 0xbf810000u,
 };
 
+constexpr std::array<std::uint32_t, 5> LdsHalfStore{0x34040082u, 0xd87c0400u, 0x00000102u, 0xbf8cc07fu, 0xbf810000u};
+constexpr std::array<std::uint32_t, 5> LdsAtomicAdd{0x34040082u, 0xd8000400u, 0x00000102u, 0xbf8cc07fu, 0xbf810000u};
+constexpr std::array<std::uint32_t, 5> LdsAtomicMax{0x34040082u, 0xd84c0400u, 0x00000102u, 0xbf8cc07fu, 0xbf810000u};
+
 struct Barriers {
     std::uint32_t subgroupControl = 0;
     std::uint32_t subgroupMemory = 0;
@@ -43,14 +49,19 @@ void require(bool condition, const std::string& message) {
     if (!condition) throw std::runtime_error(message);
 }
 
-Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
+struct MemoryBarriers {
+    std::uint32_t workgroup = 0;
+    std::uint32_t device = 0;
+};
+
+ShaderRecompiler::RecompileResult recompileProgram(std::span<const std::uint32_t> code, std::uint32_t threads, bool waveLdsMemoryBarriers, bool deviceScopeLdsMemoryBarriers) {
     using namespace ShaderRecompiler;
     const std::array<std::uint32_t, 2> capabilities{spv::CapabilityShader, spv::CapabilityGroupNonUniform};
     const std::array<std::string_view, 1> extensions{"SPV_KHR_storage_buffer_storage_class"};
     RecompileRequest request{};
-    request.shader = {ShaderStage::Compute, 0x20000u, BranchedLdsStep, 0, {}};
+    request.shader = {ShaderStage::Compute, 0x20000u, code, 0, {}};
     request.context.waveSize = 32;
-    request.context.compute = ShaderComputeStageInfo{{threads, 1u, 1u}, 256u, {false, false, false}, false, 1u};
+    request.context.compute = ShaderComputeStageInfo{{threads, 1u, 1u}, 512u, {false, false, false}, false, 1u};
     request.target.vulkanVersion = 0x00403000u;
     request.target.spirvVersion = 0x00010600u;
     request.target.subgroupSize = 32;
@@ -61,15 +72,42 @@ Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
     request.target.maxWorkgroupInvocations = 1024;
     request.target.maxWorkgroupSharedMemoryBytes = 49152;
     request.target.waveLdsMemoryBarriers = waveLdsMemoryBarriers;
+    request.target.deviceScopeLdsMemoryBarriers = deviceScopeLdsMemoryBarriers;
     request.layout = {0, 0, 0, 128};
     request.useCache = false;
-    const auto result = Recompile(request);
-    const auto& words = result.spirv.Words();
+    return Recompile(request);
+}
+
+std::unordered_map<std::uint32_t, std::uint32_t> constantsOf(std::span<const std::uint32_t> words) {
     std::unordered_map<std::uint32_t, std::uint32_t> constants;
+    for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+        if (static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpConstant && (words[at] >> 16u) == 4u) constants[words[at + 2]] = words[at + 3];
+    }
+    return constants;
+}
+
+MemoryBarriers memoryBarriers(std::span<const std::uint32_t> code, bool deviceScopeLdsMemoryBarriers) {
+    const auto result = recompileProgram(code, 128, false, deviceScopeLdsMemoryBarriers);
+    const auto& words = result.spirv.Words();
+    const auto constants = constantsOf(words);
+    MemoryBarriers barriers;
+    for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+        if (static_cast<spv::Op>(words[at] & 0xffffu) != spv::OpMemoryBarrier) continue;
+        const auto scope = constants.find(words[at + 1]);
+        require(scope != constants.end(), "a memory barrier scope is not a 32-bit constant");
+        if (scope->second == spv::ScopeWorkgroup) ++barriers.workgroup;
+        if (scope->second == spv::ScopeDevice) ++barriers.device;
+    }
+    return barriers;
+}
+
+Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
+    const auto result = recompileProgram(BranchedLdsStep, threads, waveLdsMemoryBarriers, false);
+    const auto& words = result.spirv.Words();
+    const auto constants = constantsOf(words);
     Barriers barriers;
     for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
         const auto op = static_cast<spv::Op>(words[at] & 0xffffu);
-        if (op == spv::OpConstant && (words[at] >> 16u) == 4u) constants[words[at + 2]] = words[at + 3];
         if (op != spv::OpControlBarrier && op != spv::OpMemoryBarrier) continue;
         const auto scope = constants.find(words[at + 1]);
         require(scope != constants.end(), "a barrier scope is not a 32-bit constant");
@@ -83,6 +121,17 @@ Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
 void verifyDriverQuirk() {
     for (const auto& item : Cases) {
         require(AgcDriver::SubgroupControlBarrierUsable(item.driver) == item.usable, "driver " + std::to_string(static_cast<int>(item.driver)) + ": expected subgroup control barriers to be " + (item.usable ? "usable" : "unusable"));
+        require(AgcDriver::WorkgroupScopeFenceUsable(item.driver) == item.usable, "driver " + std::to_string(static_cast<int>(item.driver)) + ": expected workgroup-scope fences to be " + (item.usable ? "usable" : "unusable"));
+    }
+}
+
+void verifyLdsMemoryBarrierScope() {
+    const std::array<std::pair<const char*, std::span<const std::uint32_t>>, 3> programs{{{"ds_write_b16", LdsHalfStore}, {"ds_add_u32", LdsAtomicAdd}, {"ds_max_f32", LdsAtomicMax}}};
+    for (const auto& [name, code] : programs) {
+        const auto workgroup = memoryBarriers(code, false);
+        require(workgroup.workgroup == 1 && workgroup.device == 0, std::string(name) + " did not order its LDS update with one workgroup-scope OpMemoryBarrier");
+        const auto device = memoryBarriers(code, true);
+        require(device.workgroup == 0 && device.device == 1, std::string(name) + " with device-scope LDS memory barriers did not order its LDS update with one device-scope OpMemoryBarrier");
     }
 }
 
@@ -101,6 +150,7 @@ int main() {
     try {
         verifyDriverQuirk();
         verifyEmittedBarriers();
+        verifyLdsMemoryBarrierScope();
         std::puts("subgroup barrier tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/Submit.cpp b/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
index d97862941b..fa67366d65 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "execution/VulkanTestDevice.hpp"
 #include "prx/libSceAgcDriver/Execution/include/QueueState.hpp"
@@ -31,9 +32,6 @@
 #include <windows.h>
 #endif
 
-extern "C" int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-extern "C" int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-
 static_assert(sizeof(Packet) == 16);
 static_assert(offsetof(Packet, addr) == 0);
 static_assert(offsetof(Packet, dw_num) == 8);
@@ -593,8 +591,7 @@ void testSmallCopyBehindPendingSource() {
     waitFor(&copied, 1, "the label after a small copy behind a pending source never landed");
     AgcDriverWaitIdle_nid_postfix();
     check(std::equal(destination, destination + smallWords, produced), "a small copy did not see the GPU copy into its source before it");
-    if (std::getenv("APS5_COPY_SYNC") != nullptr) check(AgcDriver::DriverDetail::copiesBehindPendingSources.load() == before, "a small copy that has to wait for a completion store over its source went through the GPU copy");
-    else check(AgcDriver::DriverDetail::copiesBehindPendingSources.load() == before + 1, "a small copy whose source the GPU still stores into was not recorded on the GPU");
+    check(AgcDriver::DriverDetail::copiesBehindPendingSources.load() == before, "a small copy queued behind the pipeline write into its source was recorded inline");
     std::fill(destination, destination + smallWords, 0u);
     const auto settled = AgcDriver::DriverDetail::copiesBehindPendingSources.load();
     submit(0, commands(memoryCopy(destination, produced, smallBytes), writeData(&settledCopied, 1)));
@@ -955,7 +952,8 @@ int main(int argc, char** argv) {
         });
         for (auto& reader : readers) reader.join();
         for (const auto& snapshot : concurrent) check(snapshot == branched, "concurrent raw compute readers lost snapshot reuse");
-        alignas(256) std::array<std::array<std::uint32_t, 64>, 65> programs{};
+        struct alignas(256) RawProgram : std::array<std::uint32_t, 64> {};
+        std::vector<RawProgram> programs(4097);
         for (auto& program : programs) program[0] = 0xbf810000;
         const auto firstAddress = reinterpret_cast<std::uintptr_t>(programs.front().data());
         readers.clear();
@@ -965,6 +963,9 @@ int main(int argc, char** argv) {
         for (auto& reader : readers) reader.join();
         for (const auto& snapshot : concurrent) check(snapshot == concurrent.front(), "concurrent raw compute misses duplicated snapshots");
         const auto evicted = AgcDriver::DriverDetail::ReadRawShader(firstAddress);
+        for (std::size_t i = 1; i <= 400; ++i)
+            AgcDriver::DriverDetail::ReadRawShader(reinterpret_cast<std::uintptr_t>(programs[i].data()));
+        check(AgcDriver::DriverDetail::ReadRawShader(firstAddress) == evicted, "raw shader cache evicted a program while a title used only 401");
         for (std::size_t i = 1; i < programs.size(); ++i)
             AgcDriver::DriverDetail::ReadRawShader(reinterpret_cast<std::uintptr_t>(programs[i].data()));
         check(AgcDriver::DriverDetail::ReadRawShader(firstAddress) != evicted && evicted->code[0] == 0xbf810000,
diff --git a/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp b/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp
index f302a0d119..c6bbb71920 100644
--- a/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp
@@ -1,14 +1,10 @@
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceAgcDriverSetTFRing(const volatile void* base, uint32_t size);
-int APS5_VABI sceAgcDriverGetTFRing(uintptr_t* base, uint32_t* size);
-}
-
 namespace {
 
 constexpr uint32_t Canary = 0xa5a5a5a5;
diff --git a/core/libs/prx/libSceAgcDriver/tests/TessellationPipelineCache.cpp b/core/libs/prx/libSceAgcDriver/tests/TessellationPipelineCache.cpp
new file mode 100644
index 0000000000..6c922e0bc9
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/TessellationPipelineCache.cpp
@@ -0,0 +1,31 @@
+#include "prx/libSceAgcDriver/Execution/include/TessellationPipelineCache.hpp"
+#include <cstdio>
+
+namespace {
+
+struct Case {
+    VkDriverId driver;
+    bool usable;
+};
+
+constexpr Case Cases[]{
+    {VK_DRIVER_ID_MOLTENVK, false},
+    {VK_DRIVER_ID_MESA_RADV, true},
+    {VK_DRIVER_ID_MESA_LLVMPIPE, true},
+    {VK_DRIVER_ID_NVIDIA_PROPRIETARY, true},
+    {VK_DRIVER_ID_AMD_PROPRIETARY, true},
+    {VK_DRIVER_ID_INTEL_PROPRIETARY_WINDOWS, true},
+};
+
+}
+
+int main() {
+    int failures = 0;
+    for (const auto& item : Cases) {
+        if (AgcDriver::TessellationPipelineCacheUsable(item.driver) != item.usable) {
+            std::fprintf(stderr, "driver %d: expected tessellation pipelines %s the pipeline cache\n", static_cast<int>(item.driver), item.usable ? "to use" : "not to use");
+            ++failures;
+        }
+    }
+    return failures == 0 ? 0 : 1;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp b/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp
index 9feb514924..6bfe87eb6d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp
@@ -63,6 +63,7 @@ void srgbTwinTests() {
     Require(SrgbTwinFormat(context, VK_FORMAT_R8_UNORM) == VK_FORMAT_UNDEFINED, "a device that decodes 8_SRGB in the shader must not give R8 an sRGB twin");
     Require(SrgbTwinFormat(context, VK_FORMAT_R8G8B8A8_UNORM) == VK_FORMAT_R8G8B8A8_SRGB && SrgbTwinFormat(context, VK_FORMAT_BC7_UNORM_BLOCK) == VK_FORMAT_BC7_SRGB_BLOCK, "formats without a shader decode must keep their sRGB twins");
     Require(SrgbTwinFormat(context, VK_FORMAT_R32_SFLOAT) == VK_FORMAT_UNDEFINED, "formats without an sRGB counterpart have no twin");
+    Require(SrgbTwinFormat(context, VK_FORMAT_R8G8B8A8_SNORM) == VK_FORMAT_R8G8B8A8_SRGB, "8_8_8_8 SNORM must read its bytes through the sRGB twin");
 }
 
 template<typename TAction>
@@ -116,6 +117,7 @@ void repackedFormatTests() {
     Require(IsRepackedTextureFormat(guest) && !IsRepackedTextureFormat(36u) && !IsRepackedTextureFormat(20u), "only texture format 43 is sampled through a repacked copy");
     Context context{};
     Require(SampledTextureFormat(context, guest) == VK_FORMAT_B10G11R11_UFLOAT_PACK32 && ResolveTextureFormat(guest) == VK_FORMAT_R32_UINT, "format 43 must be sampled as B10G11R11_UFLOAT and stored as R32_UINT");
+    Require(SampledTextureFormat(context, 36u) == VK_FORMAT_B10G11R11_UFLOAT_PACK32 && ResolveTextureFormat(36u) == VK_FORMAT_R32_UINT, "format 36 must be sampled as B10G11R11_UFLOAT and stored as R32_UINT");
     const auto field = [](std::uint32_t word, VkComponentSwizzle channel) -> std::pair<std::uint32_t, std::uint32_t> {
         switch (channel) {
             case VK_COMPONENT_SWIZZLE_R: return {word & 0x7ffu, 6u};
@@ -216,11 +218,38 @@ void packedFloatDccClearTests() {
             for (const auto texel : texels) Require(texel == expected, "packed float DCC clear did not encode RGB zero or one");
         }
     }
-    alignas(64) std::array<std::uint8_t, 4> keys{0xc0, 0xc0, 0xc0, 0xc0};
+    Require(DccClearTextureFormat(36u) == VK_FORMAT_B10G11R11_UFLOAT_PACK32 && DccClearTextureFormat(43u) == VK_FORMAT_B10G11R11_UFLOAT_PACK32, "formats 36 and 43 DCC clears must use native packed float layout");
+    alignas(64) std::array<std::uint8_t, 4> keys{};
     GuestTextureResource resource{};
-    resource.format = 36;
     resource.dccAddress = reinterpret_cast<std::uint64_t>(keys.data());
-    Require(TextureClearKeys(resource, 1024) == DccKeys::Clear1111, "packed float texture discarded its white fast-clear keys");
+    for (const std::uint32_t format : {36u, 43u}) {
+        resource.format = format;
+        keys.fill(0xc0);
+        Require(TextureClearKeys(resource, 1024) == DccKeys::Clear1111, "packed float texture format " + std::to_string(format) + " discarded its white fast-clear keys");
+        keys.fill(0x80);
+        Require(TextureClearKeys(resource, 1024) == DccKeys::Clear1110, "packed float texture format " + std::to_string(format) + " discarded its 1110 fast-clear keys");
+        for (const auto [keysVal, expected] : {std::pair{DccKeys::Clear1111, 0x781e03c0u}, {DccKeys::Clear1110, 0x781e03c0u}, {DccKeys::Clear0000, 0u}}) {
+            std::array<std::uint32_t, 4> surface{};
+            ReadTextureSurface(resource, keysVal, std::as_writable_bytes(std::span(surface)));
+            for (const auto texel : surface) Require(texel == expected, "packed float format " + std::to_string(format) + " DCC clear surface read produced unexpected texel value");
+        }
+    }
+}
+
+void fillContractTests() {
+    std::array<std::uint32_t, 4> texels;
+    texels.fill(0xdeadbeefu);
+    auto span = std::as_writable_bytes(std::span(texels));
+    Require(!FillDccClear(VK_FORMAT_R8G8B8A8_UNORM, DccKeys::ClearRegister, false, span), "a register clear encoded a texel");
+    for (const auto texel : texels) Require(texel == 0u, "a declined clear left its span untouched");
+    texels.fill(0xdeadbeefu);
+    Require(!FillDccClear(VK_FORMAT_R8G8B8A8_UNORM, DccKeys::Uncompressed, false, span), "an uncompressed code encoded a texel");
+    for (const auto texel : texels) Require(texel == 0u, "a declined clear left its span untouched");
+    std::array<std::byte, 10> partial;
+    partial.fill(std::byte{0x5a});
+    Require(FillDccClear(VK_FORMAT_B10G11R11_UFLOAT_PACK32, DccKeys::Clear1111, false, partial), "packed float fast clear was not encoded");
+    const std::array<std::byte, 4> white{std::byte{0xc0}, std::byte{0x03}, std::byte{0x1e}, std::byte{0x78}};
+    for (std::size_t index = 0; index < partial.size(); ++index) Require(partial[index] == (index < 8u ? white[index % 4u] : std::byte{0}), "a clear fill over a partial trailing element did not zero the tail");
 }
 
 }
@@ -287,5 +316,6 @@ void RunTextureFormatTests() {
     convertedDccClearTests();
     singleDccKeysTests();
     packedFloatDccClearTests();
+    fillContractTests();
     gcnBufferFormatTests();
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/TextureTiling.cpp b/core/libs/prx/libSceAgcDriver/tests/TextureTiling.cpp
index 48b7f6fa98..fce3aa0322 100644
--- a/core/libs/prx/libSceAgcDriver/tests/TextureTiling.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/TextureTiling.cpp
@@ -1,4 +1,6 @@
 #include "GraphicsTests.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureSwizzleEquations.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
@@ -424,26 +426,35 @@ void RunTextureTilingTests() {
         array.depthOrLastArray = 1536;
         array.baseArray = 1536;
         const auto layerBytes = DescribeSurface(array).layerBytes;
-        const auto window = ViewedArrayWindow(array);
+        const auto window = ViewedArrayWindow(array, false);
         Require(window.baseAddress == array.baseAddress + 1536ull * layerBytes && window.depthOrLastArray == 0 && window.baseArray == 0, "a sampled view of one slice at 1536 of an R_X array must start at that slice");
         Require(DescribeSurface(window).layerBytes == layerBytes && DescribeSurface(window).layers == 1, "a sampled array window must keep the slice layout");
 
         auto unaligned = array;
         unaligned.baseArray = 1530;
-        Require(ViewedArrayWindow(unaligned).baseAddress == array.baseAddress, "an R_X window at a slice the swizzle mixes in must keep the whole array");
+        const auto mixed = ViewedArrayWindow(unaligned, false);
+        Require(mixed.baseAddress == array.baseAddress + 1520ull * layerBytes && mixed.baseArray == 10 && mixed.depthOrLastArray == 16, "an R_X view at a slice the swizzle mixes in must start its window at the last slice before it with those bits clear");
+        auto low = array;
+        low.baseArray = 9;
+        Require(ViewedArrayWindow(low, false).baseAddress == array.baseAddress, "an R_X view below the first slice with those bits clear keeps the whole array");
 
         auto plain = array;
         plain.tileMode = TextureTileMode::kStandard64KB;
         plain.baseArray = 1530;
-        Require(ViewedArrayWindow(plain).baseAddress == array.baseAddress + 1530ull * DescribeSurface(plain).layerBytes && ViewedArrayWindow(plain).depthOrLastArray == 6, "a non-XOR window may start at any slice");
+        Require(ViewedArrayWindow(plain, false).baseAddress == array.baseAddress + 1530ull * DescribeSurface(plain).layerBytes && ViewedArrayWindow(plain, false).depthOrLastArray == 6, "a non-XOR window may start at any slice");
 
         auto fromZero = array;
         fromZero.baseArray = 0;
-        Require(ViewedArrayWindow(fromZero).baseAddress == array.baseAddress && ViewedArrayWindow(fromZero).depthOrLastArray == 1536, "a view from slice 0 keeps its descriptor");
+        Require(ViewedArrayWindow(fromZero, false).baseAddress == array.baseAddress && ViewedArrayWindow(fromZero, false).depthOrLastArray == 1536, "a view from slice 0 keeps its descriptor");
 
         auto compressed = array;
         compressed.dccAddress = 0x20000000ull;
-        Require(ViewedArrayWindow(compressed).baseAddress == array.baseAddress, "a view with DCC metadata keeps its descriptor");
+        Require(ViewedArrayWindow(compressed, false).baseAddress == array.baseAddress, "a view with DCC metadata keeps its descriptor");
+        const auto stored = ViewedArrayWindow(compressed, true);
+        Require(stored.baseAddress == window.baseAddress && stored.depthOrLastArray == 0 && stored.baseArray == 0 && stored.dccAddress == 0, "a view whose DCC keys read as stored is cut to its slices without metadata");
+        auto compressedFromZero = compressed;
+        compressedFromZero.baseArray = 0;
+        Require(ViewedArrayWindow(compressedFromZero, true).baseAddress == array.baseAddress && ViewedArrayWindow(compressedFromZero, true).dccAddress == compressed.dccAddress, "a view with DCC metadata from slice 0 keeps its descriptor");
 
         GuestTextureResource cube{};
         cube.baseAddress = 0x30000000ull;
@@ -455,13 +466,45 @@ void RunTextureTilingTests() {
         cube.tileMode = TextureTileMode::kStandard4KB;
         cube.depthOrLastArray = 7232;
         cube.baseArray = 7227;
-        const auto faces = ViewedArrayWindow(cube);
+        const auto faces = ViewedArrayWindow(cube, false);
         Require(faces.baseAddress == cube.baseAddress + 7227ull * DescribeSurface(cube).layerBytes && faces.depthOrLastArray == 5 && faces.baseArray == 0 && faces.dimension == TextureDimension::kCube, "a cube view of six faces at 7227 must start at its first face");
 
+        auto compressedVolume = cube;
+        compressedVolume.dimension = TextureDimension::k3D;
+        compressedVolume.baseArray = 0;
+        compressedVolume.dccAddress = 0x20000000ull;
+        Require(ViewedArrayWindow(compressedVolume, true).dccAddress == compressedVolume.dccAddress, "a volume with DCC metadata keeps its descriptor");
+
         auto volume = cube;
         volume.dimension = TextureDimension::k3D;
         volume.baseArray = 0;
-        Require(ViewedArrayWindow(volume).baseAddress == cube.baseAddress, "a volume keeps its descriptor");
+        Require(ViewedArrayWindow(volume, false).baseAddress == cube.baseAddress, "a volume keeps its descriptor");
+    }
+
+    {
+        const std::array<std::uint32_t, 8> words{0x027c0000u, 0xc1600000u, 0x00ffc0ffu, 0xd1800924u, 0x027cc27cu, 0xc1400000u, 0x00704018u, 0x91b00204u};
+        const auto view = DecodeTextureResource(words);
+        Require(view.baseAddress == 0x27c000000ull && view.dccAddress == 0x91b002040000ull && view.dimension == TextureDimension::k2DArray && view.baseArray == 636 && view.depthOrLastArray == 636 && view.width == 1024 && view.height == 1024 && view.format == 22, "the title's DCC array view decodes to slice 636 of 637");
+        const auto whole = DescribeSurface(view);
+        Require(whole.guestBytes == 2671771648ull, "the uncut DCC array view covers all 637 slices (" + std::to_string(whole.guestBytes) + " bytes)");
+        Require(TextureClearKeys(view, whole.guestBytes) == DccKeys::Uncompressed, "unreadable DCC keys of the uncut view read the texels as stored");
+        Require(ViewedArrayWindow(view, false).baseAddress == view.baseAddress, "a DCC view whose keys are not known to read as stored keeps its descriptor");
+        const auto window = ViewedArrayWindow(view, true);
+        const auto cut = DescribeSurface(window);
+        Require(window.baseAddress == view.baseAddress + whole.GuestLayerOffset(624) && window.dccAddress == 0 && window.baseArray == 12 && window.depthOrLastArray == 12, "the window of a stored-keys DCC view starts at the slice-swizzle boundary below its slice without metadata");
+        Require(cut.layers == 13 && cut.layerBytes == whole.layerBytes && window.baseAddress + cut.guestBytes == view.baseAddress + whole.guestBytes, "the window covers slices 624..636 (" + std::to_string(cut.guestBytes) + " bytes)");
+        for (std::uint32_t slice = 0; slice < cut.layers; ++slice) Require(window.baseAddress + cut.GuestLayerOffset(slice) == view.baseAddress + whole.GuestLayerOffset(624 + slice), "a window slice lies where the uncut surface keeps it");
+        const auto* equation = FindTextureSwizzleEquation(XorSwizzleMode(view.tileMode), 4);
+        const auto block = ThinBlockLayout(view.tileMode, 4);
+        Require(equation != nullptr && whole.mips.size() == 1 && !whole.mips[0].tail, "the title's DCC array is one untailed Z_X level");
+        const auto texel = [&](const GuestTextureResource& surface, const SurfaceGeometry& geometry, std::uint32_t x, std::uint32_t y, std::uint32_t slice) {
+            const auto& mip = geometry.mips[0];
+            return surface.baseAddress + geometry.GuestLayerOffset(slice) + mip.tiledOffset + (static_cast<std::uint64_t>(y / block[2]) * mip.blocksPerRow + x / block[1]) * block[0] + equationOffset(*equation, x, y, slice);
+        };
+        for (std::uint32_t y = 0; y < 1024; y += 7) {
+            for (std::uint32_t x = 0; x < 1024; x += 5) Require(texel(window, cut, x, y, window.baseArray) == texel(view, whole, x, y, view.baseArray), "a texel of the viewed slice detiles from the same guest byte in the window as in the uncut surface");
+        }
+        Require(TextureClearKeys(window, cut.guestBytes) == DccKeys::Uncompressed, "the window reads its texels as stored, as the uncut view does");
     }
 
     {
diff --git a/core/libs/prx/libSceAgcDriver/tests/UnsupportedDiagnostics.cpp b/core/libs/prx/libSceAgcDriver/tests/UnsupportedDiagnostics.cpp
index db2f77f1ec..3217dc0eb1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/UnsupportedDiagnostics.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/UnsupportedDiagnostics.cpp
@@ -1,8 +1,6 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include "SceTypes.hpp"
 
-extern "C" void* APS5_VABI sceAgcDriverGetCoredumpAddress();
-extern "C" int APS5_VABI sceAgcDriverSetTargetRingForDiag();
-
 int main() {
     if (sceAgcDriverGetCoredumpAddress() != nullptr) return 1;
     if (sceAgcDriverSetTargetRingForDiag() != static_cast<int>(0x8A6D0001)) return 2;
diff --git a/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp b/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp
index a69e325898..0efed550e8 100644
--- a/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp
@@ -40,6 +40,13 @@ constexpr std::uint32_t SampleV8V2S0S8 = 0x00400802u;
 constexpr std::uint32_t AddV8V1V8 = 0x4a101101u;
 constexpr std::uint32_t BufferStoreDword = 0xe0700000u;
 constexpr std::uint32_t StoreV8WithS12 = 0x80030800u;
+constexpr std::uint32_t AndM0GroupXOne = 0x877c8104u;
+constexpr std::uint32_t MovreldV2V0 = 0x7e048500u;
+constexpr std::uint32_t MoveS16Two = 0xbe900382u;
+constexpr std::uint32_t BranchForwardTwo = 0xbf820002u;
+constexpr std::uint32_t SubtractS16One = 0x80908110u;
+constexpr std::uint32_t CompareS16NotZero = 0xbf078010u;
+constexpr std::uint32_t BranchBackFourOnScc = 0xbf85fffcu;
 
 struct Shape {
     std::size_t functionArrays = 0;
@@ -137,6 +144,57 @@ std::size_t WindowStores(std::span<const std::uint32_t> words) {
     return stores;
 }
 
+constexpr std::array<std::uint32_t, 34> WindowInit{
+    0x34020086, 0x34060088, 0x4a140680, 0x4a160681, 0x4a180682, 0x4a1a0683, 0x4a1c0684, 0x4a1e0685,
+    0x4a200686, 0x4a220687, 0x4a240688, 0x4a260689, 0x4a28068a, 0x4a2a068b, 0x4a2c068c, 0x4a2e068d,
+    0x4a30068e, 0x4a32068f, 0x4a340690, 0x4a360691, 0x4a380692, 0x4a3a0693, 0x4a3c0694, 0x4a3e0695,
+    0x4a400696, 0x4a420697, 0x4a440698, 0x4a460699, 0x4a48069a, 0x4a4a069b, 0x4a4c069c, 0x4a4e069d,
+    0x4a50069e, 0x4a52069f,
+};
+constexpr std::uint32_t MoveM0BoundedS8 = 0x877c8308u;
+constexpr std::uint32_t MoveM0S9 = 0xbefc0309u;
+constexpr std::uint32_t MovrelsV4V10 = 0x7e08870au;
+
+std::vector<std::uint32_t> NarrowingProgram(std::uint32_t unbounded) {
+    std::vector<std::uint32_t> code(WindowInit.begin(), WindowInit.end());
+    code.push_back(MoveM0BoundedS8);
+    code.push_back(MovrelsV4V10);
+    code.push_back(0xe0701ffcu);
+    code.push_back(0x80010401u);
+    code.push_back(MoveM0S9);
+    for (std::uint32_t read = 0; read < unbounded; ++read) {
+        const std::uint32_t destination = 42u + read % 100u;
+        code.push_back((MovrelsV4V10 & ~(0xffu << 17u)) | (destination << 17u));
+        code.push_back(0xe0701000u | ((read * 4u) & 0xfffu));
+        code.push_back(0x80010001u | destination << 8u);
+    }
+    code.push_back(EndProgram);
+    return code;
+}
+
+std::vector<std::uint32_t> RecompileNarrowing(std::uint32_t unbounded) {
+    std::array<std::uint32_t, 10> userData{0u, 0u, 0u, 0u, 0x10000000u, 0u, 0x40u, 0x31016facu, 3u, 5u};
+    return RecompileProgram(NarrowingProgram(unbounded), userData);
+}
+
+struct Narrowing {
+    std::uint32_t functionVariables = 0;
+    std::uint32_t switchCases = 0;
+};
+
+Narrowing ScanNarrowing(std::span<const std::uint32_t> words) {
+    Narrowing result;
+    for (std::size_t cursor = 5; cursor < words.size();) {
+        const auto count = words[cursor] >> spv::WordCountShift;
+        const auto op = static_cast<spv::Op>(words[cursor] & spv::OpCodeMask);
+        Require(count != 0 && cursor + count <= words.size(), "truncated SPIR-V instruction");
+        if (op == spv::OpVariable && words[cursor + 3] == spv::StorageClassFunction) ++result.functionVariables;
+        if (op == spv::OpSwitch) result.switchCases += (count - 3u) / 2u;
+        cursor += count;
+    }
+    return result;
+}
+
 IrProgram TranslateStage(ShaderStageKind stage, std::uint32_t waveSize, std::uint32_t base = 0u, std::uint32_t fetchStart = 0u, std::uint32_t fetchCount = 0u) {
     ShaderComputeInputInfo compute{};
     compute.threadIdsNum = 3;
@@ -306,6 +364,35 @@ int main(int argc, char** argv) {
         return shape.functionArrays == 0 && shape.accessChains == 0;
     });
 
+    passed &= run("a sampler dword spilled into a window register with ordinary writes keeps its definition past a relative write", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 14> spilled{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, MoveV4One, WritelaneV4, FromS8Lane0, MovreldV2V0, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        return Scan(RecompileProgram(spilled, userData)).functionArrays == 1;
+    });
+
+    passed &= run("a sampler dword spilled into a window register and overwritten by an ordinary write before its v_readlane stays a run-time value", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 14> overwritten{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, WritelaneV4, FromS8Lane0, MovreldV2V0, MoveV4One, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        try {
+            RecompileProgram(overwritten, userData);
+        } catch (const std::exception& error) {
+            return std::string_view(error.what()).find("GetSamplerResource dword 0 is not a valid runtime value; chain: ReadLane(LoadVectorWindow(Immediate), Immediate)") != std::string_view::npos;
+        }
+        return false;
+    });
+
+    passed &= run("a sampler dword spilled into a window register before a loop entered at its condition keeps its definition past the loop's relative write", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 18> code{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, WritelaneV4, FromS8Lane0, MoveS16Two, BranchForwardTwo, MovreldV2V0, SubtractS16One, CompareS16NotZero, BranchBackFourOnScc, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        return Scan(RecompileProgram(code, userData)).functionArrays == 1;
+    });
+
+    passed &= run("a sampler dword spilled into a window register with ordinary writes before a loop entered at its condition keeps its definition past the loop's relative write", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 19> code{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, MoveV4One, WritelaneV4, FromS8Lane0, MoveS16Two, BranchForwardTwo, MovreldV2V0, SubtractS16One, CompareS16NotZero, BranchBackFourOnScc, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        return Scan(RecompileProgram(code, userData)).functionArrays == 1;
+    });
+
     passed &= run("a sampler dword spilled into a relatively read register keeps its definition through v_readlane", [] {
         const std::array<std::uint32_t, 14> code{MoveM0GroupX, MoveV2Zero, MoveV3Zero, WritelaneV4, FromS8Lane0, MovrelsV1V4, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, AddV8V1V8, BufferStoreDword, StoreV8WithS12, EndProgram};
         const std::array<std::uint32_t, 16> userData{};
@@ -322,6 +409,19 @@ int main(int argc, char** argv) {
         return twice == single && single >= 3u;
     });
 
+    passed &= run("a window with a few unproven relative reads keeps its unindexed slots out of the array", [] {
+        const auto few = ScanNarrowing(RecompileNarrowing(2));
+        if (few.functionVariables <= 8u || few.switchCases == 0u) std::fprintf(stderr, "  two unproven reads: %u function variables, %u switch cases\n", few.functionVariables, few.switchCases);
+        return few.functionVariables > 8u && few.switchCases != 0u;
+    });
+
+    passed &= run("a window with hundreds of unproven relative reads does not grow a switch for each of them", [] {
+        const auto many = ScanNarrowing(RecompileNarrowing(300));
+        const auto few = ScanNarrowing(RecompileNarrowing(2));
+        if (many.switchCases > 4096u || many.functionVariables >= few.functionVariables) std::fprintf(stderr, "  300 unproven reads: %u function variables, %u switch cases (2 reads: %u, %u)\n", many.functionVariables, many.switchCases, few.functionVariables, few.switchCases);
+        return many.switchCases <= 4096u && many.functionVariables < few.functionVariables;
+    });
+
     if (passed) std::puts("Vector window shape and SSA control tests passed");
     return passed ? 0 : 1;
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp
index 5d56b47f05..48d26f71df 100644
--- a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp
@@ -58,8 +58,36 @@ template<class TAction> void fails(TAction&& fn) {
     Require(failed, "invalid vertex input was accepted");
 }
 
+void descriptorDiagnostics(const Context& ctx) {
+    auto input = attribute(7);
+    input.resource.fields = {0x89abcde0u, 0x0010abcdu, 0x12345678u, 0x0104dfacu};
+    Require(BuildVertexInputLayout(ctx, std::span(&input, 1)).attributes.size() == 1, "valid diagnostic control was rejected");
+    struct Case {
+        unsigned field;
+        std::uint32_t bits;
+        const char* words;
+    };
+    constexpr std::array cases{
+        Case{1, 0x80000000u, "V#=[89abcde0 8010abcd 12345678 0104dfac]"},
+        Case{3, 0x00800000u, "V#=[89abcde0 0010abcd 12345678 0184dfac]"},
+        Case{3, 0x40000000u, "V#=[89abcde0 0010abcd 12345678 4104dfac]"},
+        Case{3, 0x80000000u, "V#=[89abcde0 0010abcd 12345678 8104dfac]"},
+        Case{3, 0xc0800000u, "V#=[89abcde0 0010abcd 12345678 c184dfac]"}
+    };
+    for (const auto& value : cases) {
+        auto described = input;
+        described.resource.fields[value.field] |= value.bits;
+        const auto before = described.resource.fields;
+        const std::string message(VertexDescriptorFlagsMessage(described).data());
+        Require(message.find("unsupported vertex buffer descriptor flags at location 7") != std::string::npos && message.find(value.words) != std::string::npos,
+            "vertex flag message did not identify the attribute and all four descriptor words: " + message);
+        Require(described.resource.fields == before, "formatting changed the descriptor");
+    }
+}
+
 void run() {
     auto ctx = context();
+    descriptorDiagnostics(ctx);
     VertexInputCache cache(ctx, 2);
     std::array attributes{attribute(0), attribute(1)};
     auto first = get(cache, ctx, 1, attributes);
diff --git a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
index 267c945d64..ddc92eaab0 100644
--- a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
@@ -15,6 +15,7 @@
 #ifdef __GLIBC__
 #include <malloc.h>
 #endif
+#include <algorithm>
 #include <array>
 #include <cstdint>
 #include <cstring>
@@ -35,6 +36,10 @@ constexpr std::size_t Block = 65536;
 #ifdef _WIN32
 constexpr wchar_t HostHoleMode[] = L"--host-hole";
 constexpr wchar_t ResidentRemapMode[] = L"--resident-direct-remap";
+constexpr wchar_t RewatchImportPagesMode[] = L"--rewatch-import-pages";
+constexpr wchar_t RewatchedSharedMode[] = L"--rewatched-direct-shared";
+constexpr wchar_t ImportAliasSharedMode[] = L"--import-alias-shared";
+constexpr wchar_t SharedGenerationsMode[] = L"--compared-shared-generations";
 #endif
 
 void Require(bool condition, const std::string& message) {
@@ -708,13 +713,18 @@ void CheckRewatch() {
     const auto unwatched = UnwatchSerial();
     Require(!Watched(imported, Block) && UntrackedHint(imported, Block) != 0, "the unwatched block does not read as untracked");
     bytes[Block + 8] = 0x22;
+    const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> unaligned{{{imported + 1, imported + Block}}};
+    Rewatch(unaligned);
+    Require(!Watched(imported + 4096, Block - 4096) && UnwatchSerial() == unwatched, "a range that is not whole pages returned to the write watch");
     const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> partial{{{imported + 4096, imported + Block}}};
     Rewatch(partial);
-    Require(!Watched(imported, Block) && UnwatchSerial() == unwatched, "part of a block returned to the write watch");
+    Require(Watched(imported + 4096, Block - 4096) && !Watched(imported, 4096) && !Watched(imported, Block), "rewatching part of a block did not return exactly its pages to the write watch");
+    const auto partly = UnwatchSerial();
+    Require(partly != unwatched, "rewatching part of a block did not invalidate what was cached while it was unwatched");
     const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> first{{{imported, imported + Block}}};
     Rewatch(first);
     Require(Watched(imported, Block) && !Watched(imported + Block, Block), "rewatching did not return exactly its block to the write watch");
-    Require(UnwatchSerial() != unwatched, "rewatching did not invalidate what was cached while the block was unwatched");
+    Require(UnwatchSerial() != partly, "rewatching did not invalidate what was cached while the block was unwatched");
     Require(UntrackedHint(imported, Block) == 0, "a rewatched block still reads as untracked");
     Require(!UnchangedSince(imported, Block, before) && StoredOver(imported, Block, before), "a block returned to the write watch reads as unchanged since before it left");
     Require(!UnchangedSinceCollected(imported, Block, before), "a CPU store made while the block was unwatched reads as no CPU store");
@@ -736,6 +746,362 @@ void CheckRewatch() {
     GuestArena::GuestArenaRelease_nid_postfix(memory, 4 * Block);
 }
 
+using RewatchSpan = std::array<std::pair<std::uint64_t, std::uint64_t>, 1>;
+
+RewatchSpan BlockSpan(std::uint64_t address, std::size_t bytes) {
+    return {{{address & ~std::uint64_t{Block - 1}, (address + bytes + Block - 1) & ~std::uint64_t{Block - 1}}}};
+}
+
+RewatchSpan PageSpan(std::uint64_t address, std::size_t bytes) {
+    return {{{address & ~std::uint64_t{4095}, (address + bytes + 4095) & ~std::uint64_t{4095}}}};
+}
+
+void PrintPageState(const char* page, const void* address) {
+    MEMORY_BASIC_INFORMATION info{};
+    Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "cannot query a page next to an import");
+    std::cout << page << ": State 0x" << std::hex << info.State << " Type 0x" << info.Type << " Protect 0x" << info.Protect << std::dec << '\n';
+}
+
+struct ImportFixture {
+    std::uint8_t* memory;
+    std::size_t reserved;
+    ImportFixture(std::size_t reservedBytes, std::size_t committed) : memory(static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(reservedBytes, Block))), reserved(reservedBytes) {
+        Require(memory != nullptr, "cannot reserve an import fixture");
+        GuestArena::GuestArenaCommit_nid_postfix(memory, committed, PAGE_READWRITE, committed);
+        std::memset(memory, 0x11, committed);
+        BumpCollectEpoch();
+        Require(CollectWrites(Base(), committed) != 0, "an import fixture was not collected");
+    }
+    ImportFixture(const ImportFixture&) = delete;
+    ImportFixture& operator=(const ImportFixture&) = delete;
+    ~ImportFixture() {
+        GuestArena::GuestArenaReset_nid_postfix(memory, reserved);
+        GuestArena::GuestArenaRelease_nid_postfix(memory, reserved);
+    }
+    std::uint64_t Base() const {
+        return reinterpret_cast<std::uint64_t>(memory);
+    }
+};
+
+void UnwatchImport(std::uint64_t address, std::size_t bytes) {
+    Require(ImportWatched(address, bytes, [] { return true; }, false) && !Watched(address, bytes), "an import that leaves the watch stayed watched");
+}
+
+void RequireRewatchedStores(std::uint64_t address, std::size_t bytes) {
+    BumpCollectEpoch();
+    const auto collected = CollectWrites(address, bytes);
+    Require(collected != 0 && UnchangedSince(address, bytes, collected), "a rewatched import is not collected");
+    *reinterpret_cast<volatile std::uint8_t*>(address + bytes - 1) = 0x22;
+    CollectWritesUncached(address, bytes);
+    Require(!UnchangedSince(address + bytes - 1, 1, collected), "a CPU store into a rewatched import's last page was missed");
+}
+
+void CheckRewatchWholeBlockImport() {
+    constexpr std::size_t bytes = 4 * Block;
+    ImportFixture fixture(6 * Block, 6 * Block);
+    const auto import = fixture.Base() + Block;
+    const auto before = CollectWrites(fixture.Base(), 6 * Block);
+    UnwatchImport(import, bytes);
+    Require(PageSpan(import, bytes) == BlockSpan(import, bytes), "a whole-block import has a page span unlike its block span");
+    Rewatch(PageSpan(import, bytes));
+    Require(Watched(import, bytes), "a settled whole-block import did not return to the write watch");
+    Require(!UnchangedSince(import, bytes, before) && UnchangedSince(fixture.Base(), Block, before) && UnchangedSince(import + bytes, Block, before), "rewatching a whole-block import did not stamp exactly its blocks");
+    RequireRewatchedStores(import, bytes);
+}
+
+void CheckRewatchImportTail() {
+    constexpr std::size_t bytes = 0xc4000;
+    ImportFixture fixture(13 * Block, bytes);
+    const auto import = fixture.Base();
+    UnwatchImport(import, bytes);
+    PrintPageState("page past a 0xc4000-byte import", fixture.memory + bytes);
+    const auto unwatched = UnwatchSerial();
+    Rewatch(BlockSpan(import, bytes));
+    Require(!Watched(import, bytes) && UnwatchSerial() == unwatched, "the 64 KiB span past the import's committed pages returned to the write watch");
+    Rewatch(PageSpan(import, bytes));
+    Require(Watched(import, bytes), "a settled import whose size is not a whole block did not return to the write watch");
+    Require(Watched(import + 12 * Block, bytes - 12 * Block) && !Watched(import, bytes + 1) && !Watched(import + bytes - 1, 2) && !Watched(import + bytes, 4096), "rewatching an import ending inside a block did not return exactly its pages");
+    Require(UnwatchSerial() != unwatched && UntrackedHint(import, bytes) == 0, "a rewatched import still reads as unwatched");
+    RequireRewatchedStores(import, bytes);
+}
+
+void CheckRewatchUnalignedImport() {
+    constexpr std::size_t offset = 0x1000;
+    constexpr std::size_t bytes = 0xc4000;
+    constexpr std::size_t committed = 0xc8000;
+    ImportFixture fixture(13 * Block, committed);
+    const auto import = fixture.Base() + offset;
+    UnwatchImport(import, bytes);
+    PrintPageState("page past an import at block offset 0x1000", fixture.memory + committed);
+    Rewatch(BlockSpan(import, bytes));
+    Require(!Watched(import, bytes), "the 64 KiB span past the committed pages around an import returned to the write watch");
+    Rewatch(PageSpan(import, bytes));
+    Require(Watched(import, bytes), "a settled import that does not start on a block did not return to the write watch");
+    Require(!Watched(fixture.Base(), offset) && !Watched(import + bytes, 4096), "rewatching an import returned pages outside it");
+    RequireRewatchedStores(import, bytes);
+}
+
+void CheckRewatchImportBesideUnwatchedImport() {
+    constexpr std::size_t bytes = 0xc4000;
+    constexpr std::size_t otherBytes = 0x1c000;
+    ImportFixture fixture(14 * Block, 14 * Block);
+    const auto import = fixture.Base();
+    const auto other = import + bytes;
+    UnwatchImport(import, bytes);
+    UnwatchImport(other, otherBytes);
+    Rewatch(PageSpan(import, bytes));
+    Require(Watched(import, bytes), "an import sharing its last block with another unwatched import did not return to the write watch");
+    Require(!Watched(other, 4096) && !Watched(import + 13 * Block - 4096, 4096) && !Watched(other + otherBytes - 4096, 4096), "rewatching an import returned another unwatched import's pages in its last block");
+    Require(UntrackedHint(other, otherBytes) != 0, "an unwatched import beside a rewatched one does not read as untracked");
+    RequireRewatchedStores(import, bytes);
+    Rewatch(PageSpan(other, otherBytes));
+    Require(Watched(import, bytes + otherBytes), "rewatching the second import did not return both to the write watch");
+}
+
+void CheckRewatchImportPages() {
+    CheckRewatchWholeBlockImport();
+    CheckRewatchImportTail();
+    CheckRewatchUnalignedImport();
+    CheckRewatchImportBesideUnwatchedImport();
+}
+
+void CheckRewatchedDirectMemoryComparedWhenShared() {
+    constexpr std::size_t bytes = 2 * Block;
+    auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, Block));
+    Require(memory != nullptr, "cannot reserve the compared sharing fixture");
+    struct Cleanup {
+        std::uint8_t* memory;
+        HANDLE section = nullptr;
+        ~Cleanup() {
+            GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+            if (section == nullptr) return;
+            GuestArena::GuestArenaForgetSection_nid_postfix(section);
+            CloseHandle(section);
+        }
+    } cleanup{memory};
+    cleanup.section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+    Require(cleanup.section != nullptr, "cannot create the compared sharing backing");
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    const auto native = [](const std::uint8_t* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "cannot query the compared sharing fixture");
+        return info;
+    };
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_PRIVATE && Watched(base, bytes), "the direct memory is not resident and watched");
+    Unwatch(base, Block);
+    const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> imported{{{base, base + Block}}};
+    Rewatch(imported);
+    Require(Watched(base, Block), "the rewatched direct memory is not watched");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) != 0, "rewatched resident direct memory is not collected");
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + bytes, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_MAPPED && native(memory + bytes).Type == MEM_MAPPED, "a second mapping kept the direct memory resident");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) == 0 && CollectWritesUncached(base + bytes, Block) == 0, "rewatched direct memory was collected once shared");
+    Require(native(memory).Protect == PAGE_READWRITE && native(memory + bytes).Protect == PAGE_READWRITE, "rewatched direct memory was armed once shared");
+    memory[8] = 0x5a;
+    Require(memory[bytes + 8] == 0x5a, "the second mapping does not see a store into the first");
+    Require(CollectWritesUncached(base + Block, Block) != 0, "shared direct memory that never left the watch stopped being collected");
+    std::cout << "rewatched direct memory: compared once shared, not armed; other shared direct memory still collected\n";
+}
+
+struct ComparedSharing {
+    static constexpr std::size_t bytes = 2 * Block;
+    std::uint8_t* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, Block));
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+    std::uint64_t base = reinterpret_cast<std::uint64_t>(memory);
+
+    ComparedSharing() {
+        Require(memory != nullptr && section != nullptr, "cannot create the compared sharing generation fixture");
+        GuestArena::GuestArenaForgetSection_nid_postfix(section);
+        GuestArena::GuestArenaMapDirect_nid_postfix(memory, bytes, section, 0, PAGE_READWRITE);
+        Require(Watched(base, bytes), "the compared sharing generation fixture is not watched");
+        Unwatch(base, Block);
+        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> imported{{{base, base + Block}}};
+        Rewatch(imported);
+        Require(Watched(base, Block), "the rewatched direct memory of the generation fixture is not watched");
+        BumpCollectEpoch();
+        Require(CollectWritesUncached(base, Block) != 0, "rewatched resident direct memory of the generation fixture is not collected");
+    }
+    ~ComparedSharing() {
+        GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+        GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+        GuestArena::GuestArenaForgetSection_nid_postfix(section);
+        CloseHandle(section);
+    }
+    ComparedSharing(const ComparedSharing&) = delete;
+    ComparedSharing& operator=(const ComparedSharing&) = delete;
+
+    void Share() {
+        GuestArena::GuestArenaMapDirect_nid_postfix(memory + bytes, bytes, section, 0, PAGE_READWRITE);
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(memory, &info, sizeof(info)) == sizeof(info) && info.Type == MEM_MAPPED, "a second mapping kept the generation fixture resident");
+    }
+    std::uint64_t Collect(std::uint64_t address) {
+        BumpCollectEpoch();
+        return CollectWrites(address, Block);
+    }
+};
+
+void CheckComparedSharingGenerations() {
+    {
+        ComparedSharing fixture;
+        const auto g0 = TrackerGeneration();
+        Require(UnchangedSince(fixture.base, Block, g0) && !WrittenSince(fixture.base, Block, g0), "rewatched resident direct memory reads as written before any store");
+        fixture.memory[16] = 0x21;
+        Require(fixture.Collect(fixture.base) != 0 && !UnchangedSince(fixture.base, Block, g0) && WrittenSince(fixture.base, Block, g0), "a store into rewatched resident direct memory was missed before it was shared");
+        const auto cached = TrackerGeneration();
+        Require(UnchangedSince(fixture.base, Block, cached), "rewatched resident direct memory reads as changed after its collect");
+        fixture.Share();
+        fixture.memory[8] = 0x5a;
+        Require(fixture.memory[ComparedSharing::bytes + 8] == 0x5a, "the second mapping does not see the store into the generation fixture");
+        Require(fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected once shared");
+        Require(!UnchangedSince(fixture.base, Block, cached), "a store into rewatched direct memory once shared reads as unchanged since a generation before the sharing");
+        Require(WrittenSince(fixture.base, Block, cached), "a store into rewatched direct memory once shared reads as not written since a generation before the sharing");
+    }
+    {
+        ComparedSharing fixture;
+        const auto g0 = TrackerGeneration();
+        fixture.Share();
+        Require(fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected once shared, before any store");
+        Require(!UnchangedSince(fixture.base, Block, g0) && WrittenSince(fixture.base, Block, g0), "sharing rewatched direct memory did not report it written once");
+        const auto g1 = TrackerGeneration();
+        Require(fixture.Collect(fixture.base) == 0 && fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected again once shared");
+        std::array<std::uint64_t, 1> generations{g1};
+        std::array<std::uint8_t, 1> changed{};
+        std::array<std::uint8_t, 1> cpu{};
+        Require(!WrittenSince(fixture.base, Block, g1) && ChangedBlocks(fixture.base, Block, generations, changed, cpu) && changed[0] == BlockUnchanged && cpu[0] == 0, "refused collects of shared compared memory reported it written again without a store");
+        Require(!UnchangedSince(fixture.base, Block, g1), "shared compared memory read as unchanged since a generation taken after a refused collect");
+        const auto neighbour = fixture.Collect(fixture.base + Block);
+        const auto spanned = std::max(fixture.Collect(fixture.base), neighbour);
+        Require(spanned != 0 && UnchangedSince(fixture.base + Block, Block, spanned), "shared direct memory that never left the watch is not collected beside compared memory");
+        fixture.memory[24] = 0x3c;
+        Require(fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected once shared, after a store");
+        Require(!UnchangedSince(fixture.base, Block, g1), "a store into shared compared memory reads as unchanged since a generation taken after a refused collect");
+        Require(!UnchangedSince(fixture.base, Block, spanned), "a store into shared compared memory reads as unchanged since the newest generation of a collect over several ranges");
+        Require(fixture.Collect(fixture.base + Block) != 0 && UnchangedSince(fixture.base + Block, Block, spanned), "a refused collect of compared memory made its never-compared neighbour read as changed");
+        const std::array<UnchangedQuery, 2> queries{{{fixture.base + Block, Block, spanned}, {fixture.base, Block, spanned}}};
+        Require(!UnchangedSinceAll(queries), "a batch of queries over shared compared memory read as unchanged");
+        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> committed{{{fixture.base, fixture.base + Block}}};
+        Require(!UnchangedCommittedSince(committed, spanned), "committed ranges over shared compared memory read as unchanged");
+    }
+    std::cout << "shared compared memory: reported written once at the sharing, never unchanged since an older generation, its neighbour still trusted\n";
+}
+
+void CheckImportedDirectMemoryComparedWhenShared() {
+    constexpr std::size_t bytes = 2 * Block;
+    auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, Block));
+    Require(memory != nullptr, "cannot reserve the imported sharing fixture");
+    struct Cleanup {
+        std::uint8_t* memory;
+        HANDLE section = nullptr;
+        ~Cleanup() {
+            GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+            if (section == nullptr) return;
+            GuestArena::GuestArenaForgetSection_nid_postfix(section);
+            CloseHandle(section);
+        }
+    } cleanup{memory};
+    cleanup.section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+    Require(cleanup.section != nullptr, "cannot create the imported sharing backing");
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    const auto native = [](const std::uint8_t* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "cannot query the imported sharing fixture");
+        return info;
+    };
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_PRIVATE && Watched(base, bytes), "the imported direct memory is not resident and watched");
+    Require(ImportWatched(base, Block, [] { return true; }), "the watched import of resident direct memory failed");
+    Require(Watched(base, Block), "a watched import of resident direct memory left the write watch");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) != 0, "imported resident direct memory is not collected");
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + bytes, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_MAPPED && native(memory + bytes).Type == MEM_MAPPED, "a second mapping kept the imported direct memory resident");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) == 0 && CollectWritesUncached(base + bytes, Block) == 0, "imported direct memory was collected once shared");
+    Require(native(memory).Protect == PAGE_READWRITE && native(memory + bytes).Protect == PAGE_READWRITE, "imported direct memory was armed once shared");
+    memory[8] = 0x5a;
+    Require(memory[bytes + 8] == 0x5a, "the second mapping does not see a store into the imported first");
+    Require(CollectWritesUncached(base + Block, Block) != 0, "shared direct memory that was never imported stopped being collected");
+    std::cout << "imported direct memory: compared once shared, not armed; unimported shared direct memory still collected\n";
+}
+
+void CheckImportAliasDemotedComparedWhenShared() {
+    constexpr std::size_t page = 0x4000;
+    auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(5 * Block, Block));
+    Require(memory != nullptr, "cannot reserve the import alias fixture");
+    struct Cleanup {
+        std::uint8_t* memory;
+        std::array<HANDLE, 3> sections{};
+        std::array<void*, 3> aliases{};
+        ~Cleanup() {
+            for (const auto alias : aliases) GuestArena::GuestArenaUnmapAlias_nid_postfix(alias);
+            GuestArena::GuestArenaReset_nid_postfix(memory, 5 * Block);
+            GuestArena::GuestArenaRelease_nid_postfix(memory, 5 * Block);
+            for (const auto section : sections) {
+                if (section == nullptr) continue;
+                GuestArena::GuestArenaForgetSection_nid_postfix(section);
+                CloseHandle(section);
+            }
+        }
+    } cleanup{memory};
+    for (auto& section : cleanup.sections) {
+        section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, Block, nullptr);
+        Require(section != nullptr, "cannot create the import alias backing");
+        GuestArena::GuestArenaForgetSection_nid_postfix(section);
+    }
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    const auto native = [](const std::uint8_t* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "cannot query the import alias fixture");
+        return info;
+    };
+    const auto clearingCollect = [](std::uint64_t address) {
+        std::array<void*, 4> pages{};
+        std::size_t count = pages.size();
+        return GuestArena::GuestArenaCollectWrites_nid_postfix(static_cast<std::uintptr_t>(address), page, pages.data(), &count, true);
+    };
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory, page, cleanup.sections[0], 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_PRIVATE && Watched(base, page), "the aliased direct memory is not resident and watched");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, page) != 0, "resident direct memory is not collected before its import");
+    cleanup.aliases[0] = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base), page);
+    Require(cleanup.aliases[0] != nullptr && native(memory).Type == MEM_MAPPED, "the import alias did not demote the resident run");
+    Require(ImportWatched(base, page, [] { return true; }) && Watched(base, page), "the import of aliased direct memory did not stay watched");
+    Require(native(memory).Protect == PAGE_READWRITE, "memory an import's alias demoted was armed by the import");
+    Require(!clearingCollect(base), "a clearing collect over memory an import's alias demoted was not refused");
+    Require(native(memory).Protect == PAGE_READWRITE, "memory an import's alias demoted was armed by a clearing collect");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, page) == 0, "memory an import's alias demoted was collected once shared");
+    memory[8] = 0x5a;
+    Require(static_cast<const std::uint8_t*>(cleanup.aliases[0])[8] == 0x5a, "the import alias does not see a store into the guest view");
+
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + Block, page, cleanup.sections[1], 0, PAGE_READWRITE);
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + 2 * Block, page, cleanup.sections[1], 0, PAGE_READWRITE);
+    Require(native(memory + Block).Type == MEM_MAPPED && native(memory + 2 * Block).Type == MEM_MAPPED, "a second mapping kept the control direct memory resident");
+    cleanup.aliases[1] = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base + Block), page);
+    Require(cleanup.aliases[1] != nullptr, "the control import alias was refused");
+    Require(ImportWatched(base + Block, page, [] { return true; }) && Watched(base + Block, page), "the control import did not stay watched");
+    Require(clearingCollect(base + Block), "memory shared by a second mapping before its import alias stopped being collected");
+    Require(native(memory + Block).Protect == PAGE_READONLY && native(memory + 2 * Block).Protect == PAGE_READONLY, "memory shared by a second mapping before its import alias was not armed");
+
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + 3 * Block, page, cleanup.sections[2], 0, PAGE_READWRITE);
+    auto* failed = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base + 3 * Block), page);
+    Require(failed != nullptr && native(memory + 3 * Block).Type == MEM_MAPPED, "the alias of a failed import did not demote the resident run");
+    GuestArena::GuestArenaUnmapAlias_nid_postfix(failed);
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + 4 * Block, page, cleanup.sections[2], 0, PAGE_READWRITE);
+    cleanup.aliases[2] = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base + 3 * Block), page);
+    Require(cleanup.aliases[2] != nullptr, "the import alias after a second mapping was refused");
+    Require(ImportWatched(base + 3 * Block, page, [] { return true; }) && Watched(base + 3 * Block, page), "the import after a second mapping did not stay watched");
+    Require(clearingCollect(base + 3 * Block), "memory a second mapping shared after an earlier alias demoted it stopped being collected");
+    Require(native(memory + 3 * Block).Protect == PAGE_READONLY && native(memory + 4 * Block).Protect == PAGE_READONLY, "memory a second mapping shared after an earlier alias demoted it was not armed");
+    std::cout << "direct memory an import's alias demoted: compared once shared, not armed; memory shared before the alias still collected\n";
+}
+
 void CheckResidentDirectMappingReuse() {
     constexpr std::size_t bytes = 5 * Block;
     auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, Block));
@@ -1140,7 +1506,7 @@ void CheckImportWindow() {
         bytes[0x100] = 0x11;
         bytes[Block + 0x2000] = 0x22;
         return true;
-    }), "the import window import failed");
+    }, true, false), "the import window import failed");
     Require(Watched(base, 3 * Block), "an import window left its range unwatched");
     const std::array<std::uint64_t, 3> generations{synced, synced, synced};
     std::array<std::uint8_t, 3> changed{};
@@ -1352,6 +1718,80 @@ void CheckUnwatchedImport() {
 #endif
 }
 
+struct HookCall {
+    std::uint64_t address;
+    std::size_t bytes;
+    bool watched;
+};
+
+std::vector<HookCall> hookCalls;
+std::uint64_t hookProbe = 0;
+std::size_t hookProbeBytes = 0;
+
+void RecordHook(std::uint64_t address, std::size_t bytes) {
+    hookCalls.push_back({address, bytes, Watched(hookProbe, hookProbeBytes)});
+}
+
+struct RecordedHook {
+    RecordedHook() {
+        hookCalls.clear();
+        SetUnwatchHook(&RecordHook);
+    }
+    ~RecordedHook() { SetUnwatchHook(nullptr); }
+    RecordedHook(const RecordedHook&) = delete;
+    RecordedHook& operator=(const RecordedHook&) = delete;
+};
+
+void RequireHookOver(std::uint64_t address, std::size_t bytes, const std::string& path) {
+    Require(hookCalls.size() == 1, path + " did not run the unwatch hook once");
+    const auto& call = hookCalls.front();
+    Require(call.address <= address && address + bytes <= call.address + call.bytes, path + " gave the unwatch hook a range that misses its own");
+    Require(call.watched, path + " ran the unwatch hook after its range left the write watch");
+}
+
+void CheckUnwatchHooks() {
+    void* memory = AllocateWatched(8 * Block);
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    std::memset(memory, 0x11, 8 * Block);
+    Require(CollectWritesUncached(base, 8 * Block) != 0, "the hooked block is not collected");
+    const RecordedHook recorded;
+    hookProbe = base;
+    hookProbeBytes = Block;
+    Unwatch(base, Block);
+    RequireHookOver(base, Block, "Unwatch");
+    Require(!Watched(base, Block), "Unwatch left its range watched");
+
+    hookCalls.clear();
+    hookProbe = base + Block;
+    bool hookedBeforeImport = false;
+    Require(ImportWatched(base + Block, Block, [&] {
+        hookedBeforeImport = hookCalls.size() == 1;
+        return true;
+    }, false), "an import that does not stay watched failed");
+    RequireHookOver(base + Block, Block, "an import that does not stay watched");
+    Require(hookedBeforeImport, "an import that does not stay watched ran the unwatch hook after the import");
+    Require(!Watched(base + Block, Block), "an import that does not stay watched left its range watched");
+
+    hookCalls.clear();
+    Require(ImportWatched(base + 2 * Block, Block, [] { return true; }), "an import that stays watched failed");
+    Require(hookCalls.empty() && Watched(base + 2 * Block, Block), "an import whose page walk vouched for its pages ran the unwatch hook or gave up its range");
+
+#ifndef _WIN32
+    hookCalls.clear();
+    const auto late = base + 4 * Block;
+    hookProbe = late;
+    bool hookedBeforeLoss = false;
+    Require(ImportWatched(late, 3 * Block, [&] {
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(reinterpret_cast<const void*>(late + 2 * Block), Block);
+        hookedBeforeLoss = !hookCalls.empty();
+        return true;
+    }), "an import whose range lost a block during the import failed");
+    RequireHookOver(late, 3 * Block, "an import whose page walk failed after the import");
+    Require(!hookedBeforeLoss, "an import whose page walk failed after the import ran the unwatch hook before it");
+    Require(!Watched(late, Block), "an import whose page walk failed after the import left its range watched");
+#endif
+}
+
 class PartlyCommitted {
 public:
     static constexpr std::size_t Bytes = 4 * Block;
@@ -1532,6 +1972,23 @@ int main() {
             CheckResidentDirectMappingReuse();
             return 0;
         }
+        if (std::wstring_view(GetCommandLineW()).ends_with(RewatchImportPagesMode)) {
+            CheckRewatchImportPages();
+            return 0;
+        }
+        if (std::wstring_view(GetCommandLineW()).ends_with(RewatchedSharedMode)) {
+            CheckRewatchedDirectMemoryComparedWhenShared();
+            CheckImportedDirectMemoryComparedWhenShared();
+            return 0;
+        }
+        if (std::wstring_view(GetCommandLineW()).ends_with(ImportAliasSharedMode)) {
+            CheckImportAliasDemotedComparedWhenShared();
+            return 0;
+        }
+        if (std::wstring_view(GetCommandLineW()).ends_with(SharedGenerationsMode)) {
+            CheckComparedSharingGenerations();
+            return 0;
+        }
 #endif
         CheckSharedBlock();
         CheckStoredOverUsesPageEvidence();
@@ -1565,6 +2022,7 @@ int main() {
         CheckStoreAcrossImports();
         CheckImportWindowFootprint();
         CheckUnwatchedImport();
+        CheckUnwatchHooks();
         CheckCommittedRanges();
         CheckAdoptLatestEpoch();
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/WriteWatchCoverage.cpp b/core/libs/prx/libSceAgcDriver/tests/WriteWatchCoverage.cpp
index 62e56cfe52..121205b1a2 100644
--- a/core/libs/prx/libSceAgcDriver/tests/WriteWatchCoverage.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/WriteWatchCoverage.cpp
@@ -99,6 +99,17 @@ int main() {
         coverage.Exclude(base + block, block, 43);
         require(coverage.Restore(base + block - page, 2 * page, 42), "a newer boundary page was not restored");
         require(coverage.Covers(base + block - page, page) && !coverage.Covers(base + block, page), "a stale boundary mapping erased a newer neighbouring exclusion");
+        constexpr std::size_t tail = 0xc4000;
+        coverage.Initialize(base, 14 * block);
+        coverage.Exclude(base, tail, 50);
+        require(coverage.Restore(base, tail, 51), "an import ending inside a block did not restore its pages");
+        require(coverage.Covers(base, tail) && coverage.Covers(base + 12 * block, tail - 12 * block), "an import ending inside a block is not watched");
+        require(!coverage.Covers(base, tail + 1) && !coverage.Covers(base + tail - 1, 2) && !coverage.Covers(base + tail, page) && !coverage.Covers(base, 13 * block), "a range past an import ending inside a block is watched");
+        require(coverage.Covers(base + tail - page, page) && !coverage.Covers(base + 13 * block - page, page) && coverage.Covers(base + 13 * block, block), "an import ending inside a block changed the pages after it");
+        coverage.Initialize(base, 14 * block);
+        coverage.Exclude(base + page, tail, 60);
+        require(coverage.Restore(base + page, tail, 61) && coverage.Covers(base + page, tail), "an import starting and ending inside blocks is not watched");
+        require(!coverage.Covers(base, page) && !coverage.Covers(base, tail) && !coverage.Covers(base + page + tail, page) && !coverage.Covers(base + page, tail + 1), "an import starting and ending inside blocks watched pages outside it");
         std::cout << "write watch coverage passed\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/AddressPasses.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/AddressPasses.cpp
index 9278d67787..bc4e3ffab8 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/AddressPasses.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/AddressPasses.cpp
@@ -141,6 +141,7 @@ struct Step {
     const std::uint32_t* pixel;
     std::uint64_t pointer;
     std::array<std::uint32_t, 4> descriptor{};
+    std::uint64_t color = 0;
 };
 
 void Submit(const GuestBlock& vertices, const GuestBlock& target, std::initializer_list<Step> steps, bool linear = false) {
@@ -179,6 +180,10 @@ void Submit(const GuestBlock& vertices, const GuestBlock& target, std::initializ
         Append(commands, 0x76, {0x008, static_cast<std::uint32_t>(pixel >> 8u), static_cast<std::uint32_t>(pixel >> 40u)});
         Append(commands, 0x76, {0x00e, static_cast<std::uint32_t>(step.pointer), static_cast<std::uint32_t>(step.pointer >> 32u)});
         Append(commands, 0x76, {0x010, step.descriptor[0], step.descriptor[1], step.descriptor[2], step.descriptor[3]});
+        if (step.color != 0) {
+            Append(commands, 0x69, {0x318, static_cast<std::uint32_t>(step.color >> 8u)});
+            Append(commands, 0x69, {0x390, static_cast<std::uint32_t>(step.color >> 40u)});
+        }
         Append(commands, 0x2d, {3, 2});
     }
     Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
@@ -285,6 +290,26 @@ void TargetReadAsWhenSplit(const GuestBlock& vertices, const GuestBlock& target,
     if (!linear && !split) Expect(after.passesContinued - before.passesContinued == 1, what + ": the reading draw did not continue the rendering draw's pass, so the case does not test it: " + Counts(before, after));
 }
 
+void TargetReadSynchronously(const GuestBlock& vertices, const GuestBlock& target, const GuestBlock& unmapped) {
+    Submit(vertices, target, {{PixelRead.data(), target.At(ColorOffset)}}, true);
+    std::memset(target.Bytes(ColorOffset), 0, ColorBytes);
+    std::memset(unmapped.Bytes(ColorOffset), 0, ColorBytes);
+    const auto before = AddressDraws();
+    const auto otherBefore = OtherDraws();
+    Submit(vertices, target, {{PixelColorWord.data(), 0}, {PixelRead.data(), target.At(ColorOffset), {}, unmapped.At(ColorOffset)}}, true);
+    const auto after = AddressDraws();
+    const auto otherAfter = OtherDraws();
+    const unsigned red = unmapped.Bytes(ColorOffset)[0];
+    std::printf("a synchronous draw reading through the table the linear target the previous draw rendered read %s (red byte %u); recorded: %s, %s\n", red == 255u ? "that draw's color" : "the bytes before it", red, Counts(before, after).c_str(), Counts(otherBefore, otherAfter, "other draws").c_str());
+    if (otherAfter.draws == otherBefore.draws) {
+        std::puts("a synchronous draw reading through the table the linear target the previous draw rendered: skipped, that draw was not recorded because the linear target is not resident on this device, so the target was stored right after it");
+        return;
+    }
+    Expect(otherAfter.draws - otherBefore.draws == 1, "the draw rendering the linear target was not recorded as one draw: " + Counts(otherBefore, otherAfter, "other draws"));
+    Expect(after.draws == before.draws, "the draw reading through the table into an unregistered target was recorded, so the case does not test a synchronous draw: " + Counts(before, after));
+    Expect(red == 255u, "a synchronous draw reading through the table the linear target the previous draw rendered read the bytes before it (red byte " + std::to_string(red) + "), not that draw's color");
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -306,6 +331,7 @@ int main(int argc, char** argv) {
         GuestBlock readOnlyVertices;
         GuestBlock data;
         GuestBlock target;
+        GuestBlock unmapped;
         FillVertices(readOnlyVertices);
         readOnlyVertices.Map(false);
         data.Map(true);
@@ -320,6 +346,7 @@ int main(int argc, char** argv) {
             TargetReadAsWhenSplit(readOnlyVertices, target, false);
             TargetReadAsWhenSplit(readOnlyVertices, target, true);
         }
+        if (only.empty() || only == "--synchronous-target-read") TargetReadSynchronously(readOnlyVertices, target, unmapped);
         AgcDriverShutdown_nid_postfix();
         std::puts("address passes: draws reading through the BDA table share a render pass, and a store through it still begins one");
         return 0;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp
index 5c662f4b2d..8146f69adb 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp
@@ -808,11 +808,12 @@ void DccRefillTests(AgcDriver::VulkanDevice& device, std::uint32_t selectedSampl
                     };
                     record(metadata, dccBytes, 0xc0c0c0c0u);
                     if (cmask != nullptr) record(*cmask, target.cmaskBytes, 0xccccccccu);
-                    if (!AgcDriver::GuestMemory::Watched(metadata.Address(), dccBytes) || (cmask != nullptr && !AgcDriver::GuestMemory::Watched(cmask->Address(), target.cmaskBytes))) expected = "requires watched guest memory";
+                    const bool unwatched = !AgcDriver::GuestMemory::Watched(metadata.Address(), dccBytes) || (cmask != nullptr && !AgcDriver::GuestMemory::Watched(cmask->Address(), target.cmaskBytes));
 #ifdef _WIN32
-                    rewatchable = !expected.empty();
+                    if (unwatched) expected = "requires watched guest memory";
+                    rewatchable = unwatched;
 #else
-                    Require(mode == 6 || expected.empty(), "a GPU fill of multisampled DCC metadata left it unwatched although host imports stay watched");
+                    Require(unwatched == (mode == 6), "a GPU fill of multisampled DCC metadata did not take the write-watch mode of its host import");
 #endif
                 } else if (mode == 2) {
                     fill(metadata, dccBytes / 2u, 0xc0c0c0c0u);
@@ -914,6 +915,170 @@ void DccImportWindowTests(AgcDriver::VulkanDevice& device, std::uint32_t selecte
     }
 }
 
+#ifndef _WIN32
+const char* DccComparedImportTests(AgcDriver::VulkanDevice& device, std::uint32_t selectedSamples) {
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if (context.hostImportAlignment == 0) return "skipped, the device imports no host memory, so no multisampled DCC plane lies in a compared host import";
+    Require(AgcDriver::GuestMemory::WriteWatched(), "the guest arena is not write-watched");
+    const auto decided = AgcDriver::Graphics::PrepareImportWatch(context);
+    if (decided != AgcDriver::Graphics::ImportWatch::Unwatch) return "skipped, the device reports host imports that keep write protection, so the write-watch probe compares none of them";
+    struct Restore {
+        const AgcDriver::Graphics::Context& context;
+        AgcDriver::Graphics::ImportWatch decided;
+        ~Restore() { AgcDriver::Graphics::SetImportWatch(context, decided); }
+    } restore{context, decided};
+    const auto probe = AgcDriver::Graphics::ProbeImportWriteProtection(context);
+    const bool watchedImportsHold = probe.failure == nullptr && probe.writtenAtImport == 0 && probe.writtenAfterSubmit == 0;
+    if (!watchedImportsHold) std::cout << "the watched-import control case is skipped: the device reports watched host memory written when it imports or reads it\n";
+    const ColorTargetLayout layout(Width, Height, ColorTileMode::RenderTarget, 8);
+    std::vector<std::unique_ptr<Block>> blocks;
+    struct ClearTargets {
+        AgcDriver::VulkanDevice& device;
+        ~ClearTargets() {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            device.SubmitRecorded(true);
+            device.WaitIdle();
+            AgcDriver::Graphics::ClearMultisampleTargets(device.Device());
+            AgcDriver::Graphics::ClearCachedTextures(device.Device());
+        }
+    } clearTargets{device};
+    const auto expectRange = [](std::string_view message, const char* plane, std::uint64_t address, std::size_t bytes, std::uint32_t samples) {
+        char detail[160];
+        std::snprintf(detail, sizeof(detail), "(%s range 0x%llx+0x%zx, %u samples)", plane, static_cast<unsigned long long>(address), bytes, samples);
+        Require(message.find(detail) != std::string_view::npos, "a refusal over a compared host import did not identify the affected plane, range and sample count");
+    };
+    const Color written{0.25f, 0.25f, 0.25f, 0.25f};
+    const Color initial{0.0f, 0.0f, 0.0f, 1.0f};
+    constexpr std::string_view deviceLimit = "AGC graphics: the device cannot render color with the target's sample count";
+    for (const auto samples : {2u, 4u, 8u}) {
+        if (selectedSamples != 0 && samples != selectedSamples) continue;
+        for (const auto mode : {7u, 8u, 9u, 10u, 11u, 0u, 1u, 2u, 3u, 4u, 5u, 6u}) {
+            if (mode >= 7 && samples != 8) continue;
+            if (mode == 5 && !watchedImportsHold) continue;
+            const bool watchedImports = mode == 5;
+            AgcDriver::Graphics::SetImportWatch(context, watchedImports ? AgcDriver::Graphics::ImportWatch::Watch : decided);
+            blocks.push_back(std::make_unique<Block>(layout.Bytes() * samples));
+            auto& source = *blocks.back();
+            std::memset(source.data, 0, source.bytes);
+            blocks.push_back(std::make_unique<Block>(BlockBytes));
+            auto& metadata = *blocks.back();
+            std::memset(metadata.data, 0x40, metadata.bytes);
+            blocks.push_back(std::make_unique<Block>(BlockBytes));
+            auto& cmask = *blocks.back();
+            std::memset(cmask.data, 0xcc, cmask.bytes);
+            auto target = DecodeTarget(source, samples);
+            target.dccAddress = metadata.Address();
+            target.dccPipeAligned = true;
+            target.dccAlphaOnMsb = true;
+            target.cmaskAddress = cmask.Address();
+            target.cmaskBytes = AgcDriver::Graphics::CmaskBytes(Width, Height);
+            target.cmaskFastClear = true;
+            Block* fmask = nullptr;
+            if (mode >= 7) {
+                blocks.push_back(std::make_unique<Block>(2u * BlockBytes));
+                fmask = blocks.back().get();
+                std::memset(fmask->data, 0x11, fmask->bytes);
+                target.fmaskAddress = fmask->Address();
+                target.fmaskPipeBankXor = 0;
+            }
+            const std::array<std::pair<const Block*, std::size_t>, 3> planes{{{&source, static_cast<std::size_t>(AgcDriver::Graphics::MultisampledColorBytes(target))}, {&metadata, AgcDriver::Graphics::MultisampledDccBytes(target)}, {&cmask, static_cast<std::size_t>(target.cmaskBytes)}}};
+            if (mode == 4) {
+                AgcDriver::GuestMemory::Unwatch(source.Address(), source.bytes);
+            } else if (mode == 11) {
+                AgcDriver::GuestMemory::Unwatch(fmask->Address(), fmask->bytes);
+            } else {
+                std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+                for (std::size_t plane = 0; plane < planes.size(); ++plane) {
+                    if ((mode == 6 && plane != 1) || mode == 8) continue;
+                    const auto* import = AgcDriver::Graphics::HostImportFor(context, planes[plane].first->Address(), planes[plane].first->bytes);
+                    Require(import != nullptr, "the host import of a multisampled DCC plane failed");
+                    Require(import->unwatched != watchedImports && AgcDriver::GuestMemory::Watched(planes[plane].first->Address(), planes[plane].second) == watchedImports, "a host import of a multisampled DCC plane did not take the write-watch mode the test set");
+                }
+                if (fmask != nullptr) {
+                    const auto* import = AgcDriver::Graphics::HostImportFor(context, fmask->Address(), fmask->bytes);
+                    Require(import != nullptr && import->unwatched && !AgcDriver::GuestMemory::Watched(fmask->Address(), fmask->bytes), "the host import of the FMASK plane was not compared");
+                }
+                if (mode == 8) {
+                    for (const auto& [block, bytes] : planes) Require(AgcDriver::GuestMemory::Watched(block->Address(), bytes), "the FMASK plane's import took a color or metadata plane out of the write watch");
+                }
+            }
+            const char* fmaskCase = mode == 7 ? "color, DCC, CMASK and FMASK compared" : mode == 8 ? "only the FMASK compared" : mode == 9 ? "a CPU store of a new byte into a compared FMASK" : mode == 10 ? "a same-value driver store into a compared FMASK" : "an explicitly unwatched FMASK";
+            const std::string_view refusal = mode == 4 ? "initial multisampled DCC contents require watched" : mode == 11 ? "native FMASK contents require watched guest memory" : "";
+            bool refused = false;
+            try {
+                device.ColorMetadataPass({AgcDriver::Graphics::ColorMetadataPass::Mode::FmaskDecompress, {target}});
+                Draw(device, target, false, Float32Export, Program(written, Float32Export, 1u), false, true);
+            } catch (const std::runtime_error& error) {
+                if (mode >= 7 && mode != 11 && std::string_view(error.what()) == deviceLimit) {
+                    std::printf("8 samples, %s: the FMASK passed the initial import checks, then %s, so its reuse is not tested\n", fmaskCase, error.what());
+                    programCount = 0;
+                    continue;
+                }
+                if (refusal.empty()) throw;
+                refused = std::string_view(error.what()).find(refusal) != std::string_view::npos;
+            }
+            if (!refusal.empty()) {
+                Require(refused, mode == 11 ? "an explicitly unwatched FMASK range was not refused at its initial import" : "an explicitly unwatched multisampled DCC color range was not refused at its initial import");
+                if (mode == 11) std::printf("8 samples, %s: refused at the initial import\n", fmaskCase);
+                programCount = 0;
+                continue;
+            }
+            blocks.push_back(std::make_unique<Block>(layout.Bytes()));
+            auto& resolved = *blocks.back();
+            AgcDriver::Graphics::ColorMetadataPass pass{};
+            pass.mode = AgcDriver::Graphics::ColorMetadataPass::Mode::Resolve;
+            pass.source = target;
+            pass.targets = {DecodeTarget(resolved)};
+            const auto resolve = [&] {
+                std::memset(resolved.data, 0, resolved.bytes);
+                device.ColorMetadataPass(pass);
+                const auto stored = ReadBack(device, resolved);
+                for (std::uint32_t y = 0; y < Height; ++y) {
+                    for (std::uint32_t x = 0; x < Width; ++x) {
+                        for (std::uint32_t channel = 0; channel < 4; ++channel) {
+                            const auto expectedValue = x < ScissorWidth ? initial[channel] + (written[channel] - initial[channel]) / static_cast<float>(samples) : initial[channel];
+                            Require(FromHalf(stored[layout.Offset(x, y) / 2u + channel]) == expectedValue, "a multisampled DCC target over a compared host import did not start from the fast clear its metadata holds");
+                        }
+                    }
+                }
+            };
+            resolve();
+            if (mode == 0 || (mode >= 5 && mode <= 8)) {
+                Draw(device, target, false, Float32Export, Program(written, Float32Export, 1u), false, true);
+                resolve();
+                if (mode >= 7) std::printf("8 samples, %s: imported and reused\n", fmaskCase);
+                programCount = 0;
+                continue;
+            }
+            const char* plane = mode == 1 ? "color" : mode == 2 ? "DCC" : mode == 3 ? "CMASK" : "FMASK";
+            const auto& [block, bytes] = mode >= 9 ? std::pair<const Block*, std::size_t>{fmask, fmask->bytes} : planes[mode - 1u];
+            if (mode == 1) static_cast<volatile std::uint8_t*>(source.data)[0] = 0x5au;
+            if (mode == 2) static_cast<volatile std::uint8_t*>(metadata.data)[0] = 0x00u;
+            if (mode == 3) {
+                const std::array<std::byte, 1> same{std::byte{0xcc}};
+                AgcDriver::GuestMemory::Write(cmask.Address(), same);
+            }
+            if (mode == 9) static_cast<volatile std::uint8_t*>(fmask->data)[0] = 0x5au;
+            if (mode == 10) {
+                const std::array<std::byte, 1> same{std::byte{0x11}};
+                AgcDriver::GuestMemory::Write(fmask->Address(), same);
+            }
+            const std::string_view storeRefusal = mode >= 9 ? "writes to a resident native FMASK" : "writes to a resident multisampled DCC";
+            try {
+                Draw(device, target, false, Float32Export, Program(written, Float32Export, 1u), false, true);
+            } catch (const std::runtime_error& error) {
+                refused = std::string_view(error.what()).find(storeRefusal) != std::string_view::npos;
+                if (refused) expectRange(error.what(), plane, block->Address(), bytes, samples);
+            }
+            Require(refused, mode == 3 ? "a same-value driver store over a compared CMASK range did not invalidate multisampled DCC residency" : mode == 10 ? "a same-value driver store over a compared FMASK range did not invalidate its residency" : mode == 9 ? "a CPU store of a new byte over a compared FMASK range did not invalidate its residency" : "a CPU store of new bytes over a compared multisampled DCC plane did not invalidate its residency");
+            if (mode >= 9) std::printf("8 samples, %s: refused at reuse\n", fmaskCase);
+            programCount = 0;
+        }
+    }
+    return nullptr;
+}
+#endif
+
 int main(int argc, char** argv) {
     try {
         const auto device = OpenVulkanTestDevice();
@@ -933,6 +1098,29 @@ int main(int argc, char** argv) {
             std::cout << "Multisampled DCC fast clear tests passed\n";
             return 0;
         }
+        if ((argc == 2 || argc == 3) && std::string_view(argv[1]) == "--dcc-compared-import") {
+            const auto samples = argc == 2 ? 0u : std::string_view(argv[2]) == "2" ? 2u : std::string_view(argv[2]) == "4" ? 4u : std::string_view(argv[2]) == "8" ? 8u : 0u;
+            Require(argc == 2 || samples != 0, "unknown DCC test sample count");
+#ifdef _WIN32
+            std::puts("skipped, Linux comparison mode only: Windows host imports settle on a second queue or keep their write watch");
+            return VulkanTestSkipped;
+#else
+            const char* skipped = nullptr;
+            try {
+                skipped = DccComparedImportTests(*device, samples);
+            } catch (const std::runtime_error& error) {
+                if (std::string_view(error.what()) != "AGC graphics: the device cannot render color with the target's sample count") throw;
+                std::printf("skipped, the device lacks the requested multisample color attachments: %s\n", error.what());
+                return VulkanTestSkipped;
+            }
+            if (skipped != nullptr) {
+                std::puts(skipped);
+                return VulkanTestSkipped;
+            }
+            std::cout << "Multisampled DCC compared host import tests passed\n";
+            return 0;
+#endif
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--dithered8") {
             try {
                 DitheredCoverage(*device);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp
index 23eeb6dcf7..216bfbc31d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp
@@ -35,6 +35,7 @@ constexpr std::uint32_t Format32x2Uint = 62;
 constexpr std::uint32_t Format32x4Uint = 75;
 constexpr std::uint32_t FormatBc1Unorm = 169;
 constexpr std::uint32_t FormatBc7Unorm = 181;
+constexpr std::uint32_t ForceDegamma = 1u << 20u;
 constexpr std::uint32_t Type2D = 9;
 constexpr std::uint32_t ClampEdge = 2;
 constexpr std::size_t BlockBytes = 1u << 20u;
@@ -130,8 +131,8 @@ std::array<std::uint32_t, 8> TextureDescriptor(const void* data, const Shape& sh
     };
 }
 
-std::array<std::uint32_t, 4> SamplerDescriptor() {
-    return {ClampEdge | (ClampEdge << 3u) | (ClampEdge << 6u), 0u, 0u, 0u};
+std::array<std::uint32_t, 4> SamplerDescriptor(std::uint32_t forced) {
+    return {ClampEdge | (ClampEdge << 3u) | (ClampEdge << 6u) | forced, 0u, 0u, 0u};
 }
 
 ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::span<const std::uint32_t> userData) {
@@ -167,12 +168,12 @@ void Settle(AgcDriver::VulkanDevice& device, std::uint8_t* texels, std::uint64_t
     AgcDriver::GuestMemory::CollectWritesUncached(reinterpret_cast<std::uintptr_t>(texels), bytes);
 }
 
-std::vector<std::uint32_t> Sample(AgcDriver::VulkanDevice& device, std::uint8_t* texels, const Shape& shape) {
+std::vector<std::uint32_t> Sample(AgcDriver::VulkanDevice& device, std::uint8_t* texels, const Shape& shape, std::uint32_t forced = 0u) {
     std::vector<std::uint32_t> userData(24, 0u);
     const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size_bytes()));
     const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size_bytes()));
     const auto texture = TextureDescriptor(texels, shape);
-    const auto sampler = SamplerDescriptor();
+    const auto sampler = SamplerDescriptor(forced);
     std::copy(input.begin(), input.end(), userData.begin());
     std::copy(output.begin(), output.end(), userData.begin() + 4);
     std::copy(texture.begin(), texture.end(), userData.begin() + 8);
@@ -189,12 +190,12 @@ std::vector<std::uint32_t> Sample(AgcDriver::VulkanDevice& device, std::uint8_t*
     return {Output.begin(), Output.end()};
 }
 
-std::vector<std::uint32_t> Reference(AgcDriver::VulkanDevice& device, const Case& test, std::uint32_t value) {
+std::vector<std::uint32_t> Reference(AgcDriver::VulkanDevice& device, const Case& test, std::uint32_t value, std::uint32_t forced = 0u) {
     GuestBlock block;
     auto* texels = block.Data();
     Store(device, texels, test, value);
     Settle(device, texels, SurfaceBytes(texels, test.blocks));
-    return Sample(device, texels, test.compressed);
+    return Sample(device, texels, test.compressed, forced);
 }
 
 void RequireSame(const std::vector<std::uint32_t>& sampled, const std::vector<std::uint32_t>& expected, const std::string& what) {
@@ -208,7 +209,11 @@ void PendingBlocksCase(AgcDriver::VulkanDevice& device, const Case& test) {
     constexpr std::uint32_t Second = 0x9bdf6840u;
     const auto first = Reference(device, test, First);
     const auto second = Reference(device, test, Second);
+    const auto forcedFirst = Reference(device, test, First, ForceDegamma);
+    const auto forcedSecond = Reference(device, test, Second, ForceDegamma);
     Require(first != second, test.name + ": the two block patterns sample alike");
+    Require(forcedFirst != first && forcedSecond != second, test.name + ": a sampler that forces sRGB decoding samples the stored blocks like a plain one");
+    Require(forcedFirst != forcedSecond, test.name + ": the two block patterns sample alike through a sampler that forces sRGB decoding");
     GuestBlock block;
     auto* texels = block.Data();
     const auto bytes = SurfaceBytes(texels, test.compressed);
@@ -222,6 +227,9 @@ void PendingBlocksCase(AgcDriver::VulkanDevice& device, const Case& test) {
     RequireSame(pending, second, test.name + ": sample of pending blocks");
     Store(device, texels, test, First);
     RequireSame(Sample(device, texels, test.compressed), first, test.name + ": sample of blocks stored again");
+    Store(device, texels, test, Second);
+    RequireSame(Sample(device, texels, test.compressed, ForceDegamma), forcedSecond, test.name + ": sRGB-forced sample of pending blocks");
+    Require(AgcDriver::Graphics::StorageTexture::FindPending(reinterpret_cast<std::uintptr_t>(texels), bytes) != nullptr, test.name + ": the sRGB-forced sample stored the pending blocks to guest memory");
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp
index 99a286d6ac..01b015a01b 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp
@@ -149,6 +149,7 @@ void Run(AgcDriver::VulkanDevice& device) {
         {0, 0, 0, 128}
     };
     request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false};
     const auto result = ShaderRecompiler::Recompile(request);
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp
index 7ba31cd239..7394269e39 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp
@@ -171,6 +171,96 @@ void Check() {
     }
 }
 
+constexpr std::array<std::uint32_t, 5> SubwordWord3{0x31005facu, 0x31006facu, 0x3100bfacu, 0x3100cfacu, 0x31012facu};
+
+constexpr const char* SubwordNames[16] = {
+    "buffer_load_format_x 8_UINT +1",
+    "buffer_load_format_x 8_UINT +2",
+    "buffer_load_format_x 8_UINT +3",
+    "buffer_load_format_x 8_SINT +1",
+    "buffer_load_format_x 8_SINT +2",
+    "buffer_load_format_x 8_SINT +3",
+    "buffer_load_format_x 16_UINT +1",
+    "buffer_load_format_x 16_UINT +2",
+    "buffer_load_format_x 16_UINT +3",
+    "buffer_load_format_x 16_SINT +1",
+    "buffer_load_format_x 16_SINT +2",
+    "buffer_load_format_x 16_SINT +3",
+    "buffer_load_format_xy 8_8_UINT +1 x",
+    "buffer_load_format_xy 8_8_UINT +1 y",
+    "buffer_load_format_xy 8_8_UINT +2 x",
+    "buffer_load_format_xy 8_8_UINT +2 y",
+};
+
+std::vector<std::uint32_t> SubwordCode() {
+    std::vector<std::uint32_t> code{0x34060087u, 0x34500085u};
+    std::uint32_t vdata = 10u;
+    const auto emitLoad = [&](std::uint32_t op, std::uint32_t srsrc, std::uint32_t offset, std::uint32_t words) {
+        code.push_back(0xe0001000u | (op << 18u) | offset);
+        code.push_back(0x80000028u | (srsrc << 16u) | (vdata << 8u));
+        vdata += words;
+    };
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 2u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 3u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 4u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 5u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 2u; ++offset) emitLoad(1u, 6u, offset, 2u);
+    code.push_back(0xbf8c3f70u);
+    for (std::uint32_t index = 0u; index < 16u; ++index) {
+        code.push_back(0xe0701000u | (index * 4u));
+        code.push_back(0x80010003u | ((10u + index) << 8u));
+    }
+    code.push_back(0xbf810000u);
+    return code;
+}
+
+void RunSubwordOffsets(AgcDriver::VulkanDevice& device) {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) std::copy(std::begin(Rows[tid]), std::end(Rows[tid]), &Input[tid * Inputs]);
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8u + 4u * SubwordWord3.size(), 0u);
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u), 0x31016facu);
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    for (std::size_t index = 0; index < SubwordWord3.size(); ++index) {
+        const auto descriptor = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u), SubwordWord3[index]);
+        std::copy(descriptor.begin(), descriptor.end(), userData.begin() + 8 + 4 * index);
+    }
+    static const auto program = SubwordCode();
+    const std::span<const std::uint32_t> code(program);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void CheckSubwordOffsets() {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        const std::uint32_t word = Rows[tid][0];
+        const auto u8 = [&](std::uint32_t offset) { return (word >> (offset * 8u)) & 0xffu; };
+        const auto s8 = [&](std::uint32_t offset) { return static_cast<std::uint32_t>(static_cast<std::int32_t>(static_cast<std::int8_t>(u8(offset)))); };
+        const auto u16 = [&](std::uint32_t offset) { return (word >> (offset * 8u)) & 0xffffu; };
+        const auto s16 = [&](std::uint32_t offset) { return static_cast<std::uint32_t>(static_cast<std::int32_t>(static_cast<std::int16_t>(u16(offset)))); };
+        const std::array<std::uint32_t, 16> expected{
+            u8(1u), u8(2u), u8(3u),
+            s8(1u), s8(2u), s8(3u),
+            u16(1u), u16(2u), u16(3u),
+            s16(1u), s16(2u), s16(3u),
+            u8(1u), u8(2u),
+            u8(2u), u8(3u),
+        };
+        for (std::uint32_t index = 0; index < expected.size(); ++index) {
+            Expect(tid, Output[tid * Results + index], expected[index], SubwordNames[index]);
+        }
+    }
+}
+
 }
 
 int main() {
@@ -179,6 +269,8 @@ int main() {
         if (!device) return VulkanTestSkipped;
         Run(*device);
         Check();
+        RunSubwordOffsets(*device);
+        CheckSubwordOffsets();
         std::puts("buffer format tests passed");
         return 0;
     } catch (const std::exception& error) {
@@ -186,3 +278,4 @@ int main() {
         return 1;
     }
 }
+
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ColorLogicOp.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ColorLogicOp.cpp
new file mode 100644
index 0000000000..89963aafb1
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ColorLogicOp.cpp
@@ -0,0 +1,155 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <array>
+#include <cstdio>
+#include <iostream>
+#include <cstdint>
+#include <span>
+#include <string>
+#include <stdexcept>
+#include <string_view>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::uint32_t WaveSize = 64;
+alignas(256) std::array<std::byte, Width * Height * 4> Pixels{};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> PixelCode{
+    0x7e0802ff, 0x3e4ccccd, 0x7e0a02ff, 0x3ecccccd, 0x7e0c02ff, 0x3f19999a, 0x7e0e02ff, 0x3f4ccccd,
+    0xf800180f, 0x07060504, 0xbf810000,
+};
+
+constexpr std::array<std::uint8_t, 4> Source{0x33, 0x66, 0x99, 0xcc};
+
+constexpr std::array<std::array<float, 4>, 3> Vertices{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+alignas(256) std::array<std::array<float, 4>, 3> VertexStorage = Vertices;
+std::array<std::byte, Width * Height * 4> Before{};
+
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+void Draw(AgcDriver::VulkanDevice& device, std::uint8_t rop) {
+    for (std::size_t index = 0; index < Pixels.size(); ++index) Before[index] = Pixels[index] = static_cast<std::byte>((index * 37u + 11u) & 0xffu);
+    const auto target = device.Target();
+
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(VertexStorage.data(), 16u, static_cast<std::uint32_t>(VertexStorage.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {WaveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionX) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionY);
+    pixel.posX = true;
+    pixel.posY = true;
+    pixel.targetOutputMode[0] = 9;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(PixelCode.data()), std::as_bytes(std::span(PixelCode))}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(PixelCode.data()), PixelCode, 0, {}},
+        {WaveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, WaveSize, WaveSize, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(Pixels.data()), {Width, Height}, VK_FORMAT_R8G8B8A8_UNORM, Pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.colorRop = rop;
+    state.scissor = {{0, 0}, {Width, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(VertexStorage.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+    device.WaitIdle();
+}
+
+std::uint8_t Combine(std::uint8_t rop, std::uint8_t destination, std::uint8_t source) {
+    switch (rop) {
+        case 0xcc: return source;
+        case 0x5a: return static_cast<std::uint8_t>(destination ^ source);
+        case 0x88: return static_cast<std::uint8_t>(destination & source);
+        case 0xee: return static_cast<std::uint8_t>(destination | source);
+        default: throw std::runtime_error("the test has no expectation for this ROP");
+    }
+}
+
+void Check(std::uint8_t rop, std::string_view what) {
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            for (std::uint32_t channel = 0; channel < 4; ++channel) {
+                const auto index = (y * Width + x) * 4u + channel;
+                const auto expected = Combine(rop, static_cast<std::uint8_t>(Before[index]), Source[channel]);
+                const auto actual = static_cast<std::uint8_t>(Pixels[index]);
+                Require(actual == expected, std::string(what) + ": pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") channel " + std::to_string(channel) + " is " + std::to_string(actual) + ", expected " + std::to_string(expected));
+            }
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        for (const std::uint8_t rop : {0xcc, 0x5a, 0x88, 0xee, 0xcc}) {
+            try {
+                Draw(*device, rop);
+            } catch (const std::exception& error) {
+                Require(std::string_view(error.what()).find("device does not support color logic operations") != std::string_view::npos, std::string("unexpected rejection: ") + error.what());
+                std::puts("skipped, the device has no logicOp feature");
+                return VulkanTestSkipped;
+            }
+            char what[48];
+            std::snprintf(what, sizeof(what), "ROP3 0x%02x into an 8_8_8_8 unorm target", rop);
+            Check(rop, what);
+        }
+        std::puts("color logic operation tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp
index a5395d5661..d2013c8b53 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
 #include "SceShaders.hpp"
 #include "VulkanTestDevice.hpp"
 #include <array>
@@ -21,6 +22,8 @@ constexpr std::uint32_t Threads = 64;
 constexpr std::uint32_t Untouched = 0xcafebabeu;
 constexpr std::uint32_t Marker = 0x55u;
 constexpr std::uint64_t FsTable = 0xfe0040000ull;
+constexpr std::uint64_t DriverMemory = 0xfe0000000ull;
+constexpr std::size_t DriverMemoryBytes = 2u << 20u;
 
 alignas(256) constexpr std::array<std::uint32_t, 32> Caller{
     0x34040082u, 0x7e0202ffu, 0x00000055u, 0xbeea03ffu, 0xe0040000u, 0xbeeb038fu, 0xf4080235u, 0xfa000000u, 0xbf8cc07fu, 0xf4240384u,
@@ -84,6 +87,9 @@ void CheckTable() {
     Require(AgcDriver::GuestMemory::Accessible(reinterpret_cast<const void*>(table[2]), sizeof(routine)), "the FS routine is not readable");
     std::memcpy(routine.data(), reinterpret_cast<const void*>(table[2]), sizeof(routine));
     Require(routine[0] == 0xbe80200eu, "the FS routine does not start with s_setpc_b64 s[14:15]");
+#ifndef _WIN32
+    if (GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) Require(AgcDriver::GuestMemory::Watched(DriverMemory, DriverMemoryBytes), "the AGC driver memory at 0xfe0000000 is not write-watched, so a refused import copies it on every address-based build");
+#endif
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp
index d9a6a8aa1d..f85c5c7d8a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp
@@ -3,6 +3,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "SceShaders.hpp"
 #include "VulkanTestDevice.hpp"
+#include <algorithm>
 #include <array>
 #include <cstdint>
 #include <cstdio>
@@ -32,10 +33,14 @@ alignas(256) constexpr std::array<std::uint32_t, 64> HoistedCaller{
     0x7e020280u, 0xf4080400u, 0xfa000000u, 0xbf8cc07fu, 0xbf068203u, 0xbf850001u, 0x7e020280u, 0x8f148402u,
     0xf4280208u, 0x28000000u, 0xbf8cc07fu, 0xbe8e0308u, 0xbe8f0309u, 0xbf068103u, 0xbe8e210eu, 0x34040082u,
     0xe0701000u, 0x80010102u, 0xbf810000u, 0xbf9f0000u, 0x30306c73u, 0x00000040u, 0x00000008u};
+alignas(256) constexpr std::array<std::uint32_t, 64> SliceCaller{
+    0x7e020280u, 0xf40c0600u, 0xfa000010u, 0x8f148402u, 0xbf8cc07fu, 0xf428020eu, 0x28000000u, 0xbf8cc07fu,
+    0xbe8e0308u, 0xbe8f0309u, 0xbf068103u, 0xbe8e210eu, 0x34040082u, 0xe0701000u, 0x80010102u, 0xbf810000u,
+    0xbf9f0000u, 0x30306c73u, 0x00000040u, 0x00000008u};
 alignas(256) constexpr std::array<std::uint32_t, 3> SelectSixteen{0x85159091u, 0x7e020215u, 0xbe80200eu};
 alignas(256) constexpr std::array<std::uint32_t, 3> SelectThirtyTwo{0x8515a0a1u, 0x7e020215u, 0xbe80200eu};
 alignas(16) std::array<std::uint32_t, 8> Table{};
-alignas(16) std::array<std::uint32_t, 4> Descriptors{};
+alignas(16) std::array<std::uint32_t, 12> Descriptors{};
 alignas(256) std::array<std::uint32_t, Threads> Output{};
 
 void Fill() {
@@ -43,7 +48,10 @@ void Fill() {
     const auto second = reinterpret_cast<std::uintptr_t>(SelectThirtyTwo.data());
     Table = {static_cast<std::uint32_t>(first), static_cast<std::uint32_t>(first >> 32u), 0u, 0u, static_cast<std::uint32_t>(second), static_cast<std::uint32_t>(second >> 32u), 0u, 0u};
     const auto table = reinterpret_cast<std::uintptr_t>(Table.data());
-    Descriptors = {static_cast<std::uint32_t>(table), static_cast<std::uint32_t>((table >> 32u) & 0xffffu) | (16u << 16u), 2u, 0x31016facu};
+    const std::array<std::uint32_t, 4> descriptor{static_cast<std::uint32_t>(table), static_cast<std::uint32_t>((table >> 32u) & 0xffffu) | (16u << 16u), 2u, 0x31016facu};
+    Descriptors = {};
+    std::copy(descriptor.begin(), descriptor.end(), Descriptors.begin());
+    std::copy(descriptor.begin(), descriptor.end(), Descriptors.begin() + 8);
 }
 
 std::array<std::uint32_t, 8> UserData(std::uint32_t index, bool scc) {
@@ -149,6 +157,8 @@ int main() {
             Check(1u, true, wave32, 33u, "the second record's callee with SCC 1");
             Check(0u, false, wave32, 16u, "the first record's callee through a descriptor loaded before a branch", HoistedCaller.data());
             Check(1u, true, wave32, 33u, "the second record's callee through a descriptor loaded before a branch", HoistedCaller.data());
+            Check(0u, false, wave32, 16u, "the first record's callee through the second half of an s_load_dwordx8", SliceCaller.data());
+            Check(1u, true, wave32, 33u, "the second record's callee through the second half of an s_load_dwordx8", SliceCaller.data());
             const auto log = Dispatch(2u, false, wave32);
             Require(log.find("called address 0x0 at program counter") != std::string::npos && log.find("which no linked callee of that call matches") != std::string::npos,
                 std::string("a record past the table did not report an unlinked call") + (wave32 ? " (wave32)" : " (wave64)") + ": " + log);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/CopiedWriterLabelOrder.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/CopiedWriterLabelOrder.cpp
new file mode 100644
index 0000000000..f143769c82
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/CopiedWriterLabelOrder.cpp
@@ -0,0 +1,270 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <mutex>
+#include <span>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Recorder;
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t RecordBytes = 16;
+constexpr std::size_t StoredOffset = 8;
+constexpr std::size_t CopiedRecordOffset = 0x1004;
+constexpr std::size_t DirectRecordOffset = 0x1000;
+constexpr std::uint32_t CpuValue = 0xc0001000u;
+constexpr std::uint32_t GpuValue = 1;
+constexpr std::uint32_t LabelValue = 1;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> StoreCode{
+    0x7e000281u, 0x7e020288u, 0xe0701000u, 0x80000001u, 0xbf810000u, 0xbf810000u,
+};
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "copied writer label order: cannot allocate a guest block");
+        std::memset(block, 0, BlockBytes);
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    volatile std::uint32_t* Word(std::size_t offset) const { return reinterpret_cast<volatile std::uint32_t*>(block + offset); }
+    std::uint64_t Address() const { return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(block)); }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+void RecordDispatch(AgcDriver::VulkanDevice& device, std::uint64_t record) {
+    std::vector<std::uint32_t> userData(16, 0u);
+    const std::array<std::uint32_t, 4> descriptor{static_cast<std::uint32_t>(record), static_cast<std::uint32_t>((record >> 32u) & 0xffffu), RecordBytes, 0x31016facu};
+    std::copy(descriptor.begin(), descriptor.end(), userData.begin());
+    const std::span<const std::uint32_t> code(StoreCode);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderRecompiler::ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+}
+
+bool Drains() {
+    return std::getenv("APS5_DRAIN_COMPLETION_LABELS") != nullptr;
+}
+
+VkDeviceSize StorageAlignment(AgcDriver::VulkanDevice& device) {
+    return device.graphicsContext().limits.minStorageBufferOffsetAlignment;
+}
+
+std::array<std::byte, 4> LabelBytes(std::uint32_t value) {
+    std::array<std::byte, 4> bytes{};
+    std::memcpy(bytes.data(), &value, sizeof(value));
+    return bytes;
+}
+
+void WaitForGpu(AgcDriver::VulkanDevice& device, std::uint64_t epoch) {
+    if (device.CanWaitUnlocked()) device.WaitRecorded(epoch);
+    else std::this_thread::sleep_for(std::chrono::milliseconds(50));
+}
+
+std::uint64_t SubmitLocked(AgcDriver::VulkanDevice& device) {
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    return device.SubmitAndEpoch();
+}
+
+int LabelPass(AgcDriver::VulkanDevice& device, const GuestBlock& records, std::size_t recordOffset, const GuestBlock& labels, std::size_t labelOffset, std::uint64_t stamp, std::uint64_t writeBacks, int expectedReason, const std::string& what) {
+    volatile std::uint32_t* stored = records.Word(recordOffset + StoredOffset);
+    volatile std::uint32_t* label = labels.Word(labelOffset);
+    *stored = CpuValue;
+    *label = 0;
+    RecordDispatch(device, records.Address() + recordOffset);
+    const auto pending = Recorder::PendingWriteBackCompletions();
+    if (writeBacks != 0 && pending == 0 && recordOffset % StorageAlignment(device) == 0) {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.WaitIdle();
+        return VulkanTestSkipped;
+    }
+    Require(pending == writeBacks, what + ": " + std::to_string(pending) + " write-back completions are pending after the dispatch, expected " + std::to_string(writeBacks));
+    const auto bytes = LabelBytes(LabelValue);
+    int reason = 0;
+    std::uint64_t epoch = 0;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        reason = device.WriteLabelOnGpu(labels.Address() + labelOffset, bytes, stamp, 0, false);
+        if (reason == 3) {
+            device.WaitIdle();
+            return 1;
+        }
+        Require(reason == expectedReason, what + ": the label after the dispatch was handled with reason " + std::to_string(reason) + ", expected " + std::to_string(expectedReason));
+        if (reason >= 1 && reason <= 4) {
+            if (reason != 1) device.WaitIdle();
+            AgcDriver::GuestMemory::Write(labels.Address() + labelOffset, bytes, 4);
+        } else if (reason == 5) {
+            Require(Recorder::PendingWriteBackCompletions() == 1 && Recorder::PendingCompletionStores() == 1, what + ": the label behind the write-back drained the device or is not a pending completion store");
+            const std::array<std::byte, 16> wide{};
+            Require(device.WriteLabelOnGpu(labels.Address() + labelOffset + 0x100, wide, stamp, 0, false) == 0, what + ": a 16-byte store away from the copied writer and the pending completion store was not recorded on the GPU");
+            epoch = device.SubmitAndEpoch();
+        } else {
+            device.SubmitRecorded(true);
+        }
+    }
+    if (reason == 5) {
+        WaitForGpu(device, epoch);
+        Require(*label == 0, what + ": the label is visible before the batch that writes back the dispatch's record was reaped");
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.ReapRecorded(epoch);
+        Require(Recorder::PendingCompletionStores() == 0 && Recorder::PendingWriteBackCompletions() == 0, what + ": completions outlived the reap of their batch");
+    }
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (*label != LabelValue) {
+        Require(std::chrono::steady_clock::now() < deadline, what + ": the label never landed");
+        std::this_thread::sleep_for(std::chrono::microseconds(100));
+    }
+    const std::uint32_t seen = *stored;
+    Require(seen == GpuValue, what + ": the label is visible but the record holds " + Hex(seen) + ", the dispatch stored " + Hex(GpuValue));
+    *stored = CpuValue;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.WaitIdle();
+    }
+    const std::uint32_t kept = *stored;
+    Require(kept == CpuValue, what + ": the record holds " + Hex(kept) + " after the drain, a write-back landed over the value the CPU wrote after the label (" + Hex(CpuValue) + ")");
+    Require(Recorder::PendingWriteBackCompletions() == 0, what + ": write-back completions outlived the drain");
+    return 0;
+}
+
+void StreamOrderPass(AgcDriver::VulkanDevice& device, const GuestBlock& copied, const GuestBlock& direct, const GuestBlock& labels, std::uint64_t stamp) {
+    constexpr std::uint32_t First = 0x11u;
+    constexpr std::uint32_t Second = 0x22u;
+    const std::uint64_t address = labels.Address() + 0x4000;
+    volatile std::uint32_t* label = labels.Word(0x4000);
+    *label = 0;
+    *copied.Word(CopiedRecordOffset + StoredOffset) = CpuValue;
+    RecordDispatch(device, copied.Address() + CopiedRecordOffset);
+    Require(Recorder::PendingWriteBackCompletions() == 1, "stream order: the copied dispatch has no pending write-back");
+    const auto copiedEpoch = SubmitLocked(device);
+    RecordDispatch(device, direct.Address() + DirectRecordOffset);
+    std::uint64_t firstEpoch = 0;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        Require(Recorder::PendingWriteBackCompletions() == 1, "stream order: the copied writer was written back before the first label");
+        const int reason = device.WriteLabelOnGpu(address, LabelBytes(First), stamp, 0, false);
+        Require(reason == 5, "stream order: the first label behind the copied writer was handled with reason " + std::to_string(reason) + ", expected 5");
+        firstEpoch = device.SubmitAndEpoch();
+    }
+    WaitForGpu(device, firstEpoch);
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.ReapRecorded(copiedEpoch);
+        Require(Recorder::PendingWriteBackCompletions() == 0, "stream order: the copied writer was not written back by the reap of its batch");
+        Require(Recorder::PendingCompletionStores() == 1, "stream order: the first label's completion store is not pending after the copied writer's reap");
+        Require(*label == 0, "stream order: the first label landed before its batch was reaped");
+    }
+    RecordDispatch(device, direct.Address() + DirectRecordOffset);
+    std::uint64_t secondEpoch = 0;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        const int reason = device.WriteLabelOnGpu(address, LabelBytes(Second), stamp + 1, 0, false);
+        Require(reason == 5, "stream order: a later label to the address of a pending completion store was handled with reason " + std::to_string(reason) + ", expected 5");
+        secondEpoch = device.SubmitAndEpoch();
+        Require(secondEpoch > firstEpoch, "stream order: the second label went into the first label's batch");
+    }
+    WaitForGpu(device, secondEpoch);
+    const std::uint32_t early = *label;
+    Require(early != Second, "stream order: the later label is visible while the earlier completion store to its address has not landed");
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    device.ReapRecorded(firstEpoch);
+    Require(*label == First, "stream order: the label holds " + Hex(*label) + " after the first label's batch was reaped, expected " + Hex(First));
+    device.ReapRecorded(secondEpoch);
+    const std::uint32_t last = *label;
+    Require(last == Second, "stream order: the label holds " + Hex(last) + " after the reap, the later label stored " + Hex(Second));
+    Require(Recorder::PendingCompletionStores() == 0 && Recorder::PendingCompletionLabels() == 0, "stream order: completion stores outlived the reap of their batches");
+    device.WaitIdle();
+}
+
+}
+
+int main() {
+    try {
+#ifdef _WIN32
+        _putenv_s("APS5_CPU_COPIES", "1");
+        _putenv_s("APS5_NO_OPPORTUNISTIC_REAP", "1");
+#else
+        setenv("APS5_CPU_COPIES", "1", 1);
+        setenv("APS5_NO_OPPORTUNISTIC_REAP", "1", 1);
+#endif
+        const GuestBlock copied;
+        const GuestBlock direct;
+        const GuestBlock labels;
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const int copiedPass = LabelPass(*device, copied, CopiedRecordOffset, labels, 0x2000, 1, 1, Drains() ? 2 : 5, "copied writer");
+        if (copiedPass == VulkanTestSkipped) {
+            std::printf("skipped, the device reports a minStorageBufferOffsetAlignment of %llu, so the dispatch binds its record at +0x%zx in place and nothing is written back; the test needs an alignment above 4\n",
+                static_cast<unsigned long long>(StorageAlignment(*device)), CopiedRecordOffset);
+            return VulkanTestSkipped;
+        }
+        if (copiedPass != 0 || LabelPass(*device, direct, DirectRecordOffset, labels, 0x3000, 2, 0, 0, "direct writer") != 0) {
+            std::puts("skipped, the device imports no host memory");
+            return VulkanTestSkipped;
+        }
+        if (!Drains()) StreamOrderPass(*device, copied, direct, labels, 3);
+        std::puts("copied writer label order tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp
index bed49aed8f..6fcb25ce6f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp
@@ -234,6 +234,22 @@ void RunKnownKeys(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
     RequireSampledClear(scenario, "a dispatch behind a pending fill of the keys");
 }
 
+void RunOneKeyReadPerLookup(AgcDriver::VulkanDevice& device, const Scenario& scenario, const char* what) {
+    Reset(scenario);
+    const auto sample = Compile(device, SampleSecondTexelCode, scenario.sampleData);
+    auto prepared = device.PrepareDispatch(sample, {}, Threads, reinterpret_cast<std::uintptr_t>(SampleSecondTexelCode.data()));
+    const auto before = AgcDriver::Graphics::SampledLookupKeyScans();
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.Dispatch(sample, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(SampleSecondTexelCode.data()), std::move(prepared));
+        device.WaitIdle();
+    }
+    const auto scans = AgcDriver::Graphics::SampledLookupKeyScans() - before;
+    char message[192];
+    std::snprintf(message, sizeof(message), "%s scanned the keys of its sampled texture %llu times with nothing written between the scans, expected at most once", what, static_cast<unsigned long long>(scans));
+    Require(scans <= 1u, message);
+}
+
 void RunNoWriter(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
     const auto sample = Compile(device, SampleSecondTexelCode, scenario.sampleData);
     const auto before = AgcDriver::VulkanDevice::PresyncCounts();
@@ -273,6 +289,11 @@ int main() {
         RunLockedSync(*device, control);
         RunPresync(*device, changed);
         RunNoWriter(*device, changed);
+        GuestBlock single;
+        GuestBlock singleOutput;
+        const auto reads = Prepare(single.Data(), singleOutput.Data());
+        RunOneKeyReadPerLookup(*device, reads, "a dispatch's first lookup");
+        RunOneKeyReadPerLookup(*device, reads, "a dispatch's repeated lookup");
         RunKnownKeys(*device, fills);
         std::puts("DCC key pre-sync tests passed");
         return 0;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp
index 6faa64b11e..5dc96d71c0 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/QueueState.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp"
@@ -7,7 +8,9 @@
 #include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
@@ -826,6 +829,45 @@ void RunSharedImport(AgcDriver::VulkanDevice& device, std::uint8_t* block) {
 
 }
 
+void RunMipmappedTarget(AgcDriver::VulkanDevice& device, std::uint8_t* block) {
+#ifndef _WIN32
+    constexpr std::uint32_t ChainSide = 64;
+    constexpr std::uint32_t ChainLevels = 7;
+    auto* texels = block;
+    auto* keys = block + KeysOffset;
+    const auto surface = AddressOf(texels);
+    const auto meta = AddressOf(keys);
+    std::memset(texels, 0x55, SurfaceBytes);
+    std::memset(keys, 0x00, KeyBytes);
+    AgcDriver::GuestMemory::BumpCollectEpoch();
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(surface >> 8u);
+    cx[0x390] = static_cast<std::uint32_t>(surface >> 40u);
+    cx[0x31b] = 0;
+    cx[0x31c] = 0x10028028u;
+    cx[0x31d] = 0;
+    cx[0x3b0] = ((ChainLevels - 1u) << 28u) | ((ChainSide - 1u) << 14u) | (ChainSide - 1u);
+    cx[0x3b8] = 0x9000000u | (TileRenderTarget64KB << 14u) | (1u << 30u);
+    cx[0x325] = static_cast<std::uint32_t>(meta >> 8u);
+    cx[0x3a8] = static_cast<std::uint32_t>(meta >> 40u);
+    const auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    const auto resource = AgcDriver::Graphics::SurfaceForTarget(color);
+    Require(color.mipCount == ChainLevels && color.dccAddress == 0 && resource.dccAddress == meta, "the resident surface of a mipmapped DCC color target has no keys");
+    const auto bytes = AgcDriver::Graphics::DescribeSurface(resource).guestBytes;
+    Require(bytes <= SurfaceBytes, "the mip chain does not fit the test surface");
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    const auto image = AgcDriver::Graphics::CachedStorageSurface(context, resource);
+    Require(image->UploadedKeys() == DccKeys::Clear0000, "the resident image of a 0000-cleared mipmapped target was not cleared from its keys");
+    image->MarkDirty();
+    Require(AgcDriver::Graphics::CurrentDccKeys(meta, bytes) == DccKeys::Uncompressed, "the first write into a mipmapped DCC target left its keys cleared");
+    Require(AgcDriver::Graphics::TextureClearKeys(resource, bytes) == DccKeys::Uncompressed, "a sampled view of a rendered mipmapped DCC target still reads its clear");
+#else
+    static_cast<void>(device);
+    static_cast<void>(block);
+#endif
+}
+
 int main() {
     try {
 #ifdef _WIN32
@@ -866,6 +908,9 @@ int main() {
         std::optional<GuestBlock> uniform;
         uniform.emplace(false);
         RunUniformKeysBehindKernel(*device, uniform->Data());
+        std::optional<GuestBlock> chain;
+        chain.emplace(false);
+        RunMipmappedTarget(*device, chain->Data());
 #ifdef _WIN32
         shared.emplace(true, true);
         RunSharedImport(*device, shared->Data());
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthBoundsEmulationDraw.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthBoundsEmulationDraw.cpp
new file mode 100644
index 0000000000..eaddbfcf25
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthBoundsEmulationDraw.cpp
@@ -0,0 +1,173 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "Recompiler.hpp"
+#include "DepthFastClearHarness.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <stdexcept>
+#include <vector>
+
+namespace {
+
+namespace Harness = DepthFastClearHarness;
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+struct Bounds {
+    float min;
+    float max;
+};
+
+struct Case {
+    float stored;
+    Bounds bounds;
+    bool covered;
+    const char* what;
+};
+
+alignas(4096) std::array<std::array<float, Harness::Width * Harness::Height>, 16> Depths{};
+alignas(256) std::array<std::array<std::array<float, 4>, 3>, 64> VertexSets{};
+std::size_t vertexSets = 0;
+
+std::uint32_t Draw(AgcDriver::VulkanDevice& device, std::uint64_t depth, float z, std::optional<Bounds> bounds, bool emulate) {
+    Require(vertexSets < VertexSets.size(), "the test ran out of vertex sets");
+    auto& vertices = VertexSets[vertexSets++];
+    vertices = {{{-1.0f, -1.0f, z, 1.0f}, {3.0f, -1.0f, z, 1.0f}, {-1.0f, 3.0f, z, 1.0f}}};
+    Harness::Pixels.fill(std::byte{0});
+
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, 32u, 32u, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(Harness::Pixels.data()), {Harness::Width, Harness::Height}, VK_FORMAT_R8G8B8A8_UNORM, Harness::Pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.depth = AgcDriver::Graphics::DepthTarget{depth, 0, {Harness::Width, Harness::Height}, VK_FORMAT_D32_SFLOAT, 1.0f, 0};
+    state.depthTest = !bounds.has_value();
+    state.depthWrite = !bounds.has_value();
+    state.depthCompare = VK_COMPARE_OP_ALWAYS;
+    if (bounds) {
+        state.depthBoundsTest = true;
+        state.minDepthBounds = bounds->min;
+        state.maxDepthBounds = bounds->max;
+    }
+    state.renderExtent = {Harness::Width, Harness::Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Harness::Height), static_cast<float>(Harness::Width), -static_cast<float>(Harness::Height), 0.0f, 1.0f};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {Harness::Width, Harness::Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.wave32 = true;
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionX) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionY);
+    pixel.posX = true;
+    pixel.posY = true;
+    pixel.targetOutputMode[0] = 9;
+    pixel.targetExportMapping.fill(0xe4u);
+    if (bounds && emulate) {
+        auto context = device.graphicsContext();
+        context.depthBounds = false;
+        context.depthRangeUnrestricted = false;
+        AgcDriver::Graphics::ApplyDepthBoundsEmulation(context, state, pixel);
+        Require(!state.depthBoundsTest && state.depthTest && !state.depthWrite, "the depth bounds test was not emulated");
+    }
+
+    auto target = device.Target();
+    target.depthRangeRemap = false;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = Harness::BufferDescriptor(vertices.data(), 16u, static_cast<std::uint32_t>(vertices.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(Harness::VertexCode.data()), std::as_bytes(std::span(Harness::VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(Harness::VertexCode.data()), Harness::VertexCode, 0, {}},
+        {32, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+    std::vector<std::uint32_t> pixelUserData(4, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(Harness::PixelCode.data()), std::as_bytes(std::span(Harness::PixelCode))}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(Harness::PixelCode.data()), Harness::PixelCode, 0, {}},
+        {32, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(vertices.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+    device.WaitIdle();
+    std::uint32_t covered = 0;
+    for (std::size_t index = 0; index < Harness::Pixels.size() / 4u; ++index) {
+        if (std::to_integer<std::uint8_t>(Harness::Pixels[index * 4u]) == 255u) ++covered;
+    }
+    return covered;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const auto context = device->graphicsContext();
+        const float below = std::nextafter(0.25f, 0.0f);
+        const float above = std::nextafter(0.25f, 1.0f);
+        const std::array<Case, 12> cases{{
+            {0.25f, {0.0f, 0.25f}, true, "stored 0.25, upper bound equal to it"},
+            {0.25f, {0.0f, below}, false, "stored 0.25, upper bound one step below it"},
+            {0.25f, {0.25f, 1.0f}, true, "stored 0.25, lower bound equal to it"},
+            {0.25f, {above, 1.0f}, false, "stored 0.25, lower bound one step above it"},
+            {0.000125f, {0.0f, 0.000125f}, true, "stored 0.000125 inside [0, 0.000125]"},
+            {0.5f, {0.0f, 0.000125f}, false, "stored 0.5 outside [0, 0.000125]"},
+            {0.5f, {0.000125f, 1.0f}, true, "stored 0.5 inside [0.000125, 1]"},
+            {0.0f, {0.000125f, 1.0f}, false, "stored 0 outside [0.000125, 1]"},
+            {0.0f, {0.0f, 1.0f}, true, "stored 0 inside [0, 1]"},
+            {1.0f, {0.0f, 1.0f}, true, "stored 1 inside [0, 1]"},
+            {1.0f, {0.0f, 0.5f}, false, "stored 1 outside [0, 0.5]"},
+            {0.75f, {0.5f, 1.0f}, true, "stored 0.75 inside [0.5, 1]"},
+        }};
+        std::size_t compared = 0;
+        for (std::size_t index = 0; index < cases.size(); ++index) {
+            const auto& test = cases[index];
+            const auto depth = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(Depths[index].data()));
+            Require(Draw(*device, depth, test.stored, std::nullopt, false) == Harness::Covered, "the draw that stores the depth did not cover the target");
+            const auto expected = test.covered ? Harness::Covered : 0u;
+            for (const bool emulate : {true, false}) {
+                if (!emulate && !context.depthBounds) continue;
+                const auto passed = Draw(*device, depth, 0.5f, test.bounds, emulate);
+                if (passed != expected) {
+                    char detail[256];
+                    std::snprintf(detail, sizeof(detail), "%s (%s): %u of %u pixels passed, expected %s", test.what, emulate ? "emulated" : "native", passed, Harness::Covered, test.covered ? "all" : "none");
+                    throw std::runtime_error(detail);
+                }
+                if (!emulate) ++compared;
+            }
+        }
+        std::printf("depth bounds emulation draw tests passed (%zu cases, %zu compared with the native test)\n", cases.size(), compared);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthCopyDraw.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthCopyDraw.cpp
new file mode 100644
index 0000000000..b7c8199b67
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthCopyDraw.cpp
@@ -0,0 +1,166 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <exception>
+#include <initializer_list>
+#include <iostream>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 4;
+constexpr float DrawnDepth = 0.25f;
+constexpr float MemoryDepth = 0.75f;
+constexpr float Untouched = -1.0f;
+
+alignas(256) constexpr std::array<std::uint32_t, 16> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060280u, 0x7e0802f2u, 0xf80008cfu, 0x04030201u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u,
+};
+alignas(256) constexpr std::array<std::uint32_t, 4> WhitePixelCode{0x7e0e02f2u, 0xf800180fu, 0x07070707u, 0xbf810000u};
+alignas(256) std::array<float, Width * Height> CopyTarget{};
+alignas(256) std::array<float, Width * Height> ReferenceTarget{};
+constexpr std::size_t DepthFloats = 16384;
+constexpr std::size_t DepthAlignment = 65536;
+std::array<float, DepthFloats + DepthAlignment / sizeof(float)> DepthStorage{};
+const std::span<float, DepthFloats> DepthMemory{reinterpret_cast<float*>((reinterpret_cast<std::uintptr_t>(DepthStorage.data()) + DepthAlignment - 1) & ~(DepthAlignment - 1)), DepthFloats};
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+    std::array<ShaderRegister, 4> registers{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    if (type == 1) {
+        const auto address = reinterpret_cast<std::uintptr_t>(code);
+        header.registers = {{{0x008, static_cast<std::uint32_t>(address >> 8u)}, {0x009, static_cast<std::uint32_t>(address >> 40u)}, {0x00b, 0}, {0x00a, 0}}};
+        header.shader.sh_registers = header.registers.data();
+        header.shader.num_sh_registers = header.registers.size();
+    }
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+struct DrawOptions {
+    float* color = nullptr;
+    std::uint32_t targetMask = 1;
+    std::uint32_t renderControl = 0;
+    std::uint32_t depthControl = 0;
+};
+
+void AppendDraw(std::vector<std::uint32_t>& commands, const DrawOptions& options) {
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(WhitePixelCode.data());
+    const auto color = reinterpret_cast<std::uintptr_t>(options.color);
+    const auto depth = reinterpret_cast<std::uintptr_t>(DepthMemory.data());
+    Require(depth % DepthAlignment == 0, "the test depth plane is not 64 KiB aligned");
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b3, 0x2}, {0x1b4, 0x2}, {0x1b6, 0}, {0x207, 0}, {0x200, options.depthControl}, {0x203, 0},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, options.targetMask}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 1}, {0x1c3, 4}, {0x31c, 0x8710},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, ((Width - 1u) << 14u) | (Height - 1u)},
+        {0x3b8, 0x9000000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, (Height << 16u) | Width},
+        {0x81, 0x80000000}, {0x82, (Height << 16u) | Width},
+        {0x90, 0x80000000}, {0x91, (Height << 16u) | Width},
+        {0x94, 0x80000000}, {0x95, (Height << 16u) | Width},
+        {0x10f, std::bit_cast<std::uint32_t>(Width / 2.0f)}, {0x110, std::bit_cast<std::uint32_t>(Width / 2.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-(Height / 2.0f))}, {0x112, std::bit_cast<std::uint32_t>(Height / 2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, std::bit_cast<std::uint32_t>(DrawnDepth)},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+        {0x318, static_cast<std::uint32_t>(color >> 8u)}, {0x390, static_cast<std::uint32_t>(color >> 40u)}, {0x292, 2},
+        {0x000, options.renderControl}, {0x002, 0}, {0x007, ((Height - 1u) << 16u) | (Width - 1u)},
+        {0x008, 0}, {0x009, std::bit_cast<std::uint32_t>(1.0f)}, {0x00a, 0}, {0x00b, 0},
+        {0x010, 3}, {0x011, 0},
+        {0x012, static_cast<std::uint32_t>(depth >> 8u)}, {0x014, static_cast<std::uint32_t>(depth >> 8u)},
+        {0x01a, static_cast<std::uint32_t>(depth >> 40u)}, {0x01c, static_cast<std::uint32_t>(depth >> 40u)},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 1u << 1u}, {0x8c, 0},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00a, 0}, {0x00b, 0},
+    };
+    Append(commands, 0x79, {0x242, 4});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    Append(commands, 0x2d, {3, 2});
+}
+
+void CopyCoversTheDraw() {
+    CopyTarget.fill(Untouched);
+    ReferenceTarget.fill(Untouched);
+    std::ranges::fill(DepthMemory, MemoryDepth);
+    Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+    Registered(PixelHeader, WhitePixelCode.data(), sizeof(WhitePixelCode), 1);
+    std::vector<std::uint32_t> commands;
+    AppendDraw(commands, {.color = CopyTarget.data(), .targetMask = 0, .depthControl = 0x76});
+    AppendDraw(commands, {.color = CopyTarget.data(), .renderControl = 0x84});
+    AppendDraw(commands, {.color = ReferenceTarget.data()});
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "the depth write, DB depth copy and reference draws were not submitted");
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(CopyTarget.data()), sizeof(CopyTarget));
+    AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(ReferenceTarget.data()), sizeof(ReferenceTarget));
+    std::size_t covered = 0;
+    for (std::size_t index = 0; index < CopyTarget.size(); ++index) {
+        const bool drawn = ReferenceTarget[index] == 1.0f;
+        Require(drawn || ReferenceTarget[index] == Untouched, "the reference draw wrote " + std::to_string(ReferenceTarget[index]) + " at texel " + std::to_string(index));
+        covered += drawn;
+        const auto expected = drawn ? DrawnDepth : Untouched;
+        Require(CopyTarget[index] == expected, "the DB depth copy holds " + std::to_string(CopyTarget[index]) + " at texel " + std::to_string(index) + ", expected " + std::to_string(expected) + (drawn ? " (the triangle covers it)" : " (outside the triangle)"));
+    }
+    Require(covered != 0 && covered != CopyTarget.size(), "the triangle covered " + std::to_string(covered) + " of " + std::to_string(CopyTarget.size()) + " texels, expected an edge through the target");
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        CopyCoversTheDraw();
+        AgcDriverShutdown_nid_postfix();
+        std::puts("the DB depth copy wrote the drawn depth exactly where its draw rasterized");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp
index cdb94c5363..4d791ac7f7 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp
@@ -7,6 +7,7 @@
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -75,6 +76,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -86,6 +89,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -93,7 +102,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto extensions = function<PFN_vkEnumerateDeviceExtensionProperties>("vkEnumerateDeviceExtensionProperties");
             Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties");
             std::vector<VkExtensionProperties> available(count);
@@ -214,6 +223,65 @@ private:
     std::uint8_t* block = nullptr;
 };
 
+class SparseLayers {
+public:
+    SparseLayers() {
+#ifdef _WIN32
+        memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocateAtOrAbove_nid_postfix(GuestArena::GuestArenaHighestFree_nid_no_patch(BlockBytes, 65536), BlockBytes, 65536));
+#else
+        constexpr std::uintptr_t alignment = 65536;
+        void* raw = mmap(nullptr, BlockBytes + alignment, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        Require(raw != MAP_FAILED, "cannot reserve sparse depth layers");
+        const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+        const auto aligned = (begin + alignment - 1) & ~(alignment - 1);
+        if (aligned != begin) munmap(raw, aligned - begin);
+        if (aligned + BlockBytes != begin + BlockBytes + alignment) munmap(reinterpret_cast<void*>(aligned + BlockBytes), begin + alignment - aligned);
+        memory = reinterpret_cast<std::uint8_t*>(aligned);
+#endif
+        Require(memory != nullptr, "cannot reserve sparse depth layers");
+    }
+
+    ~SparseLayers() {
+#ifdef _WIN32
+        GuestArena::GuestArenaReset_nid_postfix(memory, BlockBytes);
+        GuestAllocations::GuestAllocationsInvalidate_nid_postfix(Address(), BlockBytes);
+        GuestArena::GuestArenaRelease_nid_postfix(memory, BlockBytes);
+#else
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(memory, BlockBytes);
+        munmap(memory, BlockBytes);
+        GuestAllocations::GuestAllocationsInvalidate_nid_postfix(Address(), BlockBytes);
+#endif
+    }
+
+    void Commit(std::size_t offset, std::size_t bytes) {
+#ifdef _WIN32
+        GuestArena::GuestArenaCommit_nid_postfix(memory + offset, bytes, PAGE_READWRITE, 65536);
+#else
+        Require(mmap(memory + offset, bytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0) != MAP_FAILED, "cannot commit sparse depth layer pages");
+        GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(memory + offset, bytes);
+#endif
+        GuestAllocations::GuestAllocationsInvalidate_nid_postfix(Address() + offset, bytes);
+    }
+
+    void DecommitGuestLayer() {
+#ifdef _WIN32
+        GuestArena::GuestArenaReset_nid_postfix(memory + LayerBytes, LayerBytes);
+#else
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(memory + LayerBytes, LayerBytes);
+        Require(mmap(memory + LayerBytes, LayerBytes, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0) != MAP_FAILED, "cannot decommit sparse depth layer pages");
+#endif
+        GuestAllocations::GuestAllocationsInvalidate_nid_postfix(Address() + LayerBytes, LayerBytes);
+    }
+
+    std::uint8_t* Data() const { return memory; }
+    std::uint64_t Address() const { return reinterpret_cast<std::uint64_t>(memory); }
+    SparseLayers(const SparseLayers&) = delete;
+    SparseLayers& operator=(const SparseLayers&) = delete;
+
+private:
+    std::uint8_t* memory = nullptr;
+};
+
 std::atomic<std::uint64_t> watchedBegin{0};
 std::atomic<std::uint64_t> watchedEnd{0};
 std::atomic<std::uint32_t> watchedReads{0};
@@ -299,6 +367,59 @@ void Run(const Context& context, const WatchedBlock& block) {
     AgcDriver::GuestMemory::SetFlushHook(nullptr);
 }
 
+void SparseGuestLayers(const Context& context) {
+    ClearDepthSurfaces(context.device);
+    SparseLayers block;
+    block.Commit(0, LayerBytes);
+    FillLayer(block.Data(), 1.0f);
+    const auto address = block.Address();
+    DepthSurfaceView(context, DepthTarget{address, 0, {Side, Side}, VK_FORMAT_D32_SFLOAT, 1.0f, 0, 0});
+    const auto resource = ArrayOver(address);
+    watchedBegin = address + LayerBytes;
+    watchedEnd = address + BlockBytes;
+    AgcDriver::GuestMemory::SetFlushHook(&CountReads);
+    const auto sample = [&](const char* when, bool changed) {
+        AgcDriver::GuestMemory::BumpCollectEpoch();
+        watchedReads = 0;
+        Require(DepthSurfaceTexture(context, words, resource, components) != nullptr, "sparse depth layers were not sampled");
+        Require((watchedReads.load() != 0) == changed, std::string("sparse depth layer read mismatch ") + when);
+    };
+    try {
+        sample("at first use", true);
+        sample("with the guest layer still uncommitted", false);
+        block.Commit(LayerBytes, 65536);
+        const float value = 0.25f;
+        std::memcpy(block.Data() + LayerBytes, &value, sizeof(value));
+        sample("after committing part of the guest layer", true);
+        block.Data()[LayerBytes + 64] = 1;
+        sample("after a CPU write to the committed part", true);
+        AgcDriver::GuestMemory::MarkWritten(address + LayerBytes + 128, 4);
+        sample("after a driver store to the committed part", true);
+        block.DecommitGuestLayer();
+        sample("after decommitting the guest layer", true);
+        sample("with the guest layer still decommitted", false);
+        block.Commit(LayerBytes, 65536);
+        sample("after committing the same pages again", true);
+        block.DecommitGuestLayer();
+        block.Commit(LayerBytes, 65536);
+        sample("after replacing a mapping with the same committed range", true);
+        block.DecommitGuestLayer();
+        block.Commit(LayerBytes, LayerBytes);
+        FillLayer(block.Data() + LayerBytes, 0.5f);
+        sample("after fully committing the guest layer", true);
+        sample("with the fully committed layer unchanged", false);
+        block.DecommitGuestLayer();
+        sample("after decommitting a fully committed guest layer", true);
+        sample("with the fully committed layer now empty", false);
+    } catch (...) {
+        AgcDriver::GuestMemory::SetFlushHook(nullptr);
+        ClearDepthSurfaces(context.device);
+        throw;
+    }
+    AgcDriver::GuestMemory::SetFlushHook(nullptr);
+    ClearDepthSurfaces(context.device);
+}
+
 void RecordedUploads(const Context& context, const WatchedBlock& block) {
     const auto resource = ArrayOver(block.Address());
     Recorder recorder(context);
@@ -409,6 +530,7 @@ int main() {
             RecordedUploads(context, block);
             RunCubeGather(context, block);
             RunCubeTiledSlice(context, block);
+            SparseGuestLayers(context);
         }
         device.reset();
         std::puts("depth plane guest layer tests passed");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp
index 43b8815b56..8bcdfb60dc 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp
@@ -2,6 +2,9 @@
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
@@ -225,6 +228,62 @@ int main() {
             for (std::size_t unit = 1; unit < Units; ++unit) RequireUnit(loose, unit, 1.0f, UnitTexels, "unwatched plane after a read of the first unit, a unit it does not overlap");
             Require(draw(unwatched, {.minDepth = 0.6f, .maxDepth = 0.6f}) == 0u, "a draw at depth 0.6 passed LESS over unwatched units still holding depth 0.5 on the GPU");
         }
+
+        auto* arrayBlocks = static_cast<std::byte*>(AllocateBlocks(3u * PlaneBytes, true));
+        auto* layerPlane = reinterpret_cast<float*>(arrayBlocks + PlaneBytes);
+        AgcDriver::Graphics::GuestTextureResource array{};
+        array.baseAddress = reinterpret_cast<std::uintptr_t>(arrayBlocks);
+        array.width = PlaneWidth;
+        array.height = PlaneHeight;
+        array.depthOrLastArray = 2;
+        array.mipCount = 1;
+        array.tileMode = AgcDriver::Graphics::TextureTileMode::kR64KBX;
+        array.dimension = AgcDriver::Graphics::TextureDimension::k2DArray;
+        array.format = 22;
+        array.dstSelX = 4;
+        array.dstSelY = 5;
+        array.dstSelZ = 6;
+        array.dstSelW = 7;
+        Require(AgcDriver::Graphics::DescribeSurface(array).layerBytes == PlaneBytes, "a layer of the 384x200 R32 array is not six 64 KiB tiles");
+        const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device);
+        const auto lookup = [&](std::uint32_t first, std::uint32_t count) {
+            std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+            return AgcDriver::Graphics::CachedStorageLayers(context, array, first, count);
+        };
+        Fill(layerPlane, 1.0f);
+        const auto arrayImage = lookup(0, 1);
+        device->WaitIdle();
+        const auto provedBefore = AgcDriver::Graphics::StorageTexture::RefreshesProved();
+        Require(lookup(0, 1) == arrayImage && lookup(0, 1) == arrayImage, "a lookup of the first layer of an unchanged array replaced its cached image");
+        if (!AgcDriver::GuestMemory::WriteWatched() || !AgcDriver::GuestMemory::Watched(array.baseAddress, 3u * PlaneBytes)) {
+            std::puts("guest memory is not write-watched here: lookups of array layers through a refresh proof are not exercised");
+        } else {
+            Require(AgcDriver::Graphics::StorageTexture::RefreshesProved() != provedBefore, "repeated lookups of the first layer of an unchanged array proved no refresh");
+        }
+        const Surface layerDepth{reinterpret_cast<std::uintptr_t>(layerPlane), 0, 0, false, VK_FORMAT_D32_SFLOAT, 0, 0, swizzle};
+        Require(draw(layerDepth, writeHalf) == PlaneTexels, "the draw writing depth 0.5 over the second layer of an array did not cover the plane");
+        before = AgcDriver::Graphics::DepthPlaneStoreCounts();
+        Require(lookup(0, 1) == arrayImage, "a depth draw over the second layer of an array replaced the array's cached image");
+        device->WaitIdle();
+        stored = Since(before);
+        Require(stored.stores == 0, "a lookup of the first layer of an array stored the depth plane over its second layer");
+        for (std::size_t unit = 0; unit < Units; ++unit) RequireUnit(layerPlane, unit, 1.0f, UnitTexels, "a lookup of the first layer of an array, the depth plane over its second layer");
+        Require(AgcDriver::Graphics::DepthPlanesStale(), "a lookup of the first layer of an array left no stale plane");
+
+        before = AgcDriver::Graphics::DepthPlaneStoreCounts();
+        static_cast<void>(lookup(0, 2));
+        device->WaitIdle();
+        stored = Since(before);
+        Require(stored.stores == 1 && stored.units == Units, "a lookup of the first two layers of a three-layer array did not store the depth plane over its second layer");
+        for (std::size_t unit = 0; unit < Units; ++unit) RequireUnit(layerPlane, unit, 0.5f, Texels(unit), "a lookup of the first two layers of a three-layer array, the depth plane over its second layer");
+
+        Require(draw(layerDepth, {.depthWrite = true, .depthCompare = VK_COMPARE_OP_ALWAYS, .minDepth = 0.25f, .maxDepth = 0.25f}) == PlaneTexels, "the draw writing depth 0.25 over the second layer of an array did not cover the plane");
+        before = AgcDriver::Graphics::DepthPlaneStoreCounts();
+        static_cast<void>(lookup(0, 3));
+        device->WaitIdle();
+        stored = Since(before);
+        Require(stored.stores == 1 && stored.units == Units, "a lookup of every layer of an array did not store the depth plane over its second layer");
+        for (std::size_t unit = 0; unit < Units; ++unit) RequireUnit(layerPlane, unit, 0.25f, Texels(unit), "a lookup of every layer of an array, the depth plane over its second layer");
         std::puts("depth plane partial store tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp
index 33c6cfdb6b..f77432e092 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp
@@ -434,8 +434,9 @@ void RefusalCase(AgcDriver::VulkanDevice& device, GuestBlock& block) {
 }
 }
 
-int main() {
+int main(int argc, char** argv) {
     try {
+        const bool evicting = argc > 1 && std::string(argv[1]) == "--evicting";
         GuestBlock block;
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
@@ -452,6 +453,10 @@ int main() {
         PaddedD16CubeCase(*device, block, output);
         BaseSliceCase(*device, block, output);
         RefusalCase(*device, block);
+        if (evicting) {
+            const auto kept = AgcDriver::Graphics::DepthPlaneCopyCount();
+            Require(kept >= 1 && kept < 8, std::to_string(kept) + " depth plane copies were kept with a 1 MiB budget, expected at least the newest and fewer than the 8 an unbounded cache keeps");
+        }
         std::puts("depth plane sampling tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp
index 27236f4199..0c706f407d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp
@@ -1,15 +1,13 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/BdaFeatures.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <vector>
 #include <algorithm>
@@ -32,7 +30,6 @@ using namespace AgcDriver::Graphics;
 constexpr std::uint32_t Side = 64;
 constexpr std::size_t BlockBytes = 65536;
 alignas(4096) std::array<std::uint8_t, BlockBytes * 2> Storage{};
-alignas(4096) std::array<std::uint8_t, BlockBytes * 2> CopyStorage{};
 constexpr std::uint32_t Format32Float = 22;
 constexpr std::uint32_t Format8Uint = 5;
 
@@ -41,6 +38,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -52,6 +51,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -59,7 +64,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto extensions = function<PFN_vkEnumerateDeviceExtensionProperties>("vkEnumerateDeviceExtensionProperties");
             Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties");
             std::vector<VkExtensionProperties> available(count);
@@ -254,9 +259,17 @@ void Run(Context context, std::uint8_t* block) {
     layeredStencil.depthOrLastArray = 1;
     ExpectFailure([&] { static_cast<void>(DepthSurfaceStorage(context, {}, layeredStencil, 0)); }, "storage image access to depth/stencil surface", "a two-layer 2D array view of the stencil plane was accepted");
     layeredDepth.depthOrLastArray = 1;
-    ExpectFailure([&] { static_cast<void>(DepthSurfaceStorage(context, {}, layeredDepth, 0)); }, "with a layer pitch of", "a two-layer 2D array view of the depth plane with a layer pitch other than the depth slice size was accepted");
+    const auto layerPitch = static_cast<std::uint64_t>(DescribeSurface(layeredDepth).GuestLayerOffset(1));
+    const auto sliceBytes = DepthSliceBytes({Side, Side}, 4u);
+    Require(layerPitch != sliceBytes, "the test's layered depth view has the depth slice size as its layer pitch");
+    const auto layered = DepthSurfaceStorage(context, {}, layeredDepth, 0);
+    Require(layered != nullptr && layered->ImageLayers() == 2, "a two-layer 2D array view over the depth plane's guest layer pitch was not taken as a storage image");
+    submit(recorder);
+    readBack(*layered);
+    Require(CountFloats(block + layerPitch, 0.f) == Side * Side, "the two-layer 2D array view did not take the layer that only overlaps the depth slice from guest memory");
+    Require(CountFloats(block, 0.5f) == Side * Side, "the two-layer 2D array view did not receive the layer the depth surface holds");
     layeredDepth.baseArray = 1;
-    ExpectFailure([&] { static_cast<void>(DepthSurfaceStorage(context, {}, layeredDepth, 0)); }, "with a layer pitch of", "a 2D array view of layer 1 of the depth plane with a layer pitch other than the depth slice size was accepted");
+    Require(DepthSurfaceStorage(context, {}, layeredDepth, 0) != nullptr, "a 2D array view from layer 1 of the depth plane was not taken as a storage image");
     const auto own = StorageTexture::Create(context, *context.detiler, PlaneResource(address, Format32Float), 0);
     const std::array<std::uint32_t, 4> eighth{std::bit_cast<std::uint32_t>(0.125f), std::bit_cast<std::uint32_t>(0.125f), std::bit_cast<std::uint32_t>(0.125f), std::bit_cast<std::uint32_t>(0.125f)};
     Require(own->FillClear(eighth, StorageTexture::WholeImage, refusal), refusal != nullptr ? refusal : "the storage image could not be filled");
@@ -267,6 +280,24 @@ void Run(Context context, std::uint8_t* block) {
     submit(recorder);
     readBack(*reread);
     Require(CountFloats(block, 0.125f) == Side * Side, "a storage image written over the depth plane did not reach the depth surface");
+    const float overlapping = 0.375f;
+    for (std::size_t i = 0; i < Side * Side; ++i) std::memcpy(block + layerPitch + i * sizeof(overlapping), &overlapping, sizeof(overlapping));
+    auto swizzled = PlaneResource(address, Format32Float);
+    swizzled.tileMode = TextureTileMode::kStandard64KB;
+    const auto tiled = DepthSurfaceStorage(context, {}, swizzled, 0);
+    Require(tiled != nullptr, "a 64 KiB depth plane has no storage image");
+    const std::array<std::uint32_t, 4> pendingFill{std::bit_cast<std::uint32_t>(0.75f), std::bit_cast<std::uint32_t>(0.75f), std::bit_cast<std::uint32_t>(0.75f), std::bit_cast<std::uint32_t>(0.75f)};
+    Require(tiled->FillClear(pendingFill, StorageTexture::WholeImage, refusal), refusal != nullptr ? refusal : "the 64 KiB depth plane's storage image could not be filled");
+    submit(recorder);
+    auto spanning = layeredDepth;
+    spanning.baseArray = 0;
+    spanning.depthOrLastArray = 3;
+    const auto spanningView = DepthSurfaceStorage(context, {}, spanning, 0);
+    Require(spanningView != nullptr && spanningView->ImageLayers() == 4, "a four-layer 2D array view over a 64 KiB depth plane was not taken as a storage image");
+    Require(CountFloats(block, 0.75f) == Side * Side, "the pending depth result was not stored into guest memory before the layered view was created");
+    submit(recorder);
+    readBack(*spanningView);
+    Require(CountFloats(block + layerPitch, overlapping) == Side * Side, "the layer that only overlaps the depth surface did not hold the guest bytes that were there");
     Require(!DepthSurfaceStoreBack(context, *StorageTexture::Create(context, *context.detiler, PlaneResource(address, Format32Float, Side / 2), 0)), "a storage image of another extent over the depth memory was stored into the depth surface");
 }
 
@@ -305,69 +336,6 @@ void RunPairings(Context context, std::uint8_t* block) {
     ExpectFailure([&] { static_cast<void>(DepthSurfaceStoreBack(context, *depth)); }, "through a view that another view of the plane", "a store back through a replaced view was taken by an older pairing that covers the plane");
 }
 
-void DepthCopyCase(Context context, std::uint8_t* block) {
-    const auto colorAddress = reinterpret_cast<std::uint64_t>(block);
-    const auto depthAddress = colorAddress + BlockBytes / 4;
-    Recorder recorder(context);
-    recorder.Activate();
-    const auto submit = [&] {
-        recorder.Submit();
-        Check(context.Function<PFN_vkQueueWaitIdle>("vkQueueWaitIdle")(context.queue), "vkQueueWaitIdle");
-    };
-    ColorTarget color{};
-    color.address = colorAddress;
-    color.surfaceAddress = colorAddress;
-    color.extent = {Side, Side};
-    color.surfaceExtent = color.extent;
-    color.format = VK_FORMAT_R32_SFLOAT;
-    color.elementBytes = 4;
-    color.tileMode = ColorTileMode::RenderTarget;
-    color.bytes = ColorTargetLayout(Side, Side, ColorTileMode::RenderTarget, 4).Bytes();
-    const auto copy = [&](std::uint32_t samples, std::uint32_t sample, VkExtent2D extent) {
-        RunDepthCopyPass(context, DepthCopyPass{depthAddress, extent, samples, sample, color});
-        submit();
-        const auto resident = CachedStorageSurface(context, SurfaceForTarget(color));
-        resident->MarkDirty();
-        resident->WriteBack();
-        submit();
-    };
-    const auto countBlock = [&](float value) {
-        std::size_t count = 0;
-        for (std::size_t offset = 0; offset < BlockBytes; offset += sizeof(float)) {
-            float texel = 0;
-            std::memcpy(&texel, block + offset, sizeof(texel));
-            if (texel == value) ++count;
-        }
-        return count;
-    };
-    std::fill(block, block + BlockBytes, std::uint8_t{0});
-    ExpectFailure([&] { copy(1, 0, {Side, Side}); }, "no draw rendered", "a DB depth copy from memory without a depth surface was accepted");
-    const auto sampledCounts = context.limits.sampledImageDepthSampleCounts & context.limits.framebufferDepthSampleCounts;
-    const std::uint32_t samples = (sampledCounts & VK_SAMPLE_COUNT_2_BIT) != 0 ? 2u : (sampledCounts & VK_SAMPLE_COUNT_4_BIT) != 0 ? 4u : 0u;
-    if (samples != 0) {
-        Require(DepthSurfaceView(context, DepthTarget{depthAddress, 0, {Side, Side}, VK_FORMAT_D32_SFLOAT, 0.375f, 0, 0, false, samples}) != VK_NULL_HANDLE, "the multisample depth surface was not created");
-        for (std::uint32_t sample = 0; sample < samples; ++sample) {
-            std::fill(block, block + BlockBytes, std::uint8_t{0});
-            copy(samples, sample, {Side, Side});
-            Require(countBlock(0.375f) == Side * Side, "the DB depth copy of sample " + std::to_string(sample) + " of " + std::to_string(samples) + " did not store the cleared depth in every texel of the R32 float target");
-        }
-        ExpectFailure([&] { copy(samples, samples, {Side, Side}); }, "does not have", "a DB depth copy of a sample past the last of a multisample surface was accepted");
-        ExpectFailure([&] { copy(samples, 0, {Side / 2, Side / 2}); }, "of another size", "a DB depth copy of another extent than the depth surface was accepted");
-        ClearDepthSurfaces(context.device);
-    }
-    if ((context.limits.sampledImageDepthSampleCounts & VK_SAMPLE_COUNT_2_BIT) == 0) {
-        Require(DepthSurfaceView(context, DepthTarget{depthAddress, 0, {Side, Side}, VK_FORMAT_D32_SFLOAT, 0.375f, 0, 0, false, 2}) != VK_NULL_HANDLE, "the unsampleable two-sample depth surface was not created");
-        ExpectFailure([&] { copy(2, 0, {Side, Side}); }, "cannot sample at its sample count", "a DB depth copy from an unsampleable two-sample depth surface was accepted");
-        ClearDepthSurfaces(context.device);
-        std::puts("DB depth copy: unsupported two-sample source refused cleanly");
-    }
-    Require(DepthSurfaceView(context, DepthTarget{depthAddress, 0, {Side, Side}, VK_FORMAT_D32_SFLOAT, 0.625f, 0, 0, false, 1}) != VK_NULL_HANDLE, "the one-sample depth surface was not created");
-    std::fill(block, block + BlockBytes, std::uint8_t{0});
-    copy(1, 0, {Side, Side});
-    Require(countBlock(0.625f) == Side * Side, "the DB depth copy of a one-sample depth surface did not store the cleared depth in every texel of the R32 float target");
-    ExpectFailure([&] { copy(1, 1, {Side, Side}); }, "does not have", "a DB depth copy of a second sample of a one-sample surface was accepted");
-}
-
 }
 
 int main() {
@@ -388,11 +356,6 @@ int main() {
         {
             std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
             Run(context, block);
-            auto* copyBlock = CopyStorage.data() + (BlockBytes - reinterpret_cast<std::uintptr_t>(CopyStorage.data()) % BlockBytes) % BlockBytes;
-            GuestAllocations::Mutation().Add(copyBlock, BlockBytes, true, true, true);
-            DepthCopyCase(context, copyBlock);
-            ClearCachedTextures(context.device);
-            GuestAllocations::Mutation().Remove(copyBlock);
             ClearDepthSurfaces(context.device);
             RunPairings(context, block);
             ClearDepthSurfaces(context.device);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp
index b7f809f6ee..cdb726b3bd 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp
@@ -4,6 +4,7 @@
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -36,6 +37,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -47,6 +50,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -54,7 +63,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto queues = function<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
             queues(context.physical, &count, nullptr);
             std::vector<VkQueueFamilyProperties> families(count);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DeviceQueuePlan.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DeviceQueuePlan.cpp
index ca3c05ab27..032a78ccc8 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DeviceQueuePlan.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DeviceQueuePlan.cpp
@@ -34,16 +34,40 @@ VkQueueFamilyProperties family(VkQueueFlags flags, std::uint32_t queues) {
 }
 
 std::string describe(const AgcDriver::DeviceQueuePlan& plan) {
-    return "main " + std::to_string(plan.mainCount) + " queues, settle " + (plan.settle ? std::to_string(plan.settleFamily) + ":" + std::to_string(plan.settleIndex) : std::string("none")) + ", sparse " + (!plan.sparseBinding ? std::string("none") : plan.sparseFamily == Own ? std::string("on the main queue") : std::to_string(plan.sparseFamily) + ":" + std::to_string(plan.sparseIndex));
+    return "main " + std::to_string(plan.mainCount) + " queues, present " + (plan.present ? std::to_string(plan.presentIndex) : std::string("none")) + ", settle " + (plan.settle ? std::to_string(plan.settleFamily) + ":" + std::to_string(plan.settleIndex) : std::string("none")) + ", sparse " + (!plan.sparseBinding ? std::string("none") : plan.sparseFamily == Own ? std::string("on the main queue") : std::to_string(plan.sparseFamily) + ":" + std::to_string(plan.sparseIndex));
 }
 
 void check(const Case& test) {
-    const auto plan = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, true);
-    const auto dense = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, false);
+    const auto plan = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, true, false);
+    const auto dense = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, false, false);
     Require(plan.mainCount == dense.mainCount && plan.settle == dense.settle && plan.settleFamily == dense.settleFamily && plan.settleIndex == dense.settleIndex, std::string("device queue plan, ") + test.name + ": sparse binding changed the queues: " + describe(dense) + " without it, " + describe(plan) + " with it");
     Require(!dense.sparseBinding && dense.sparseFamily == Own, std::string("device queue plan, ") + test.name + ": a device without sparse binding got a sparse queue: " + describe(dense));
     const bool expected = plan.mainCount == test.mainCount && plan.settle == test.settle && (!test.settle || (plan.settleFamily == test.settleFamily && plan.settleIndex == test.settleIndex)) && plan.sparseBinding == test.sparseBinding && plan.sparseFamily == test.sparseFamily && (test.sparseFamily == Own || plan.sparseIndex == test.sparseIndex);
-    Require(expected, std::string("device queue plan, ") + test.name + ": got " + describe(plan));
+    Require(expected && !plan.present, std::string("device queue plan, ") + test.name + ": got " + describe(plan));
+    const auto windowed = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, true, true);
+    const bool kept = windowed.settle == plan.settle && windowed.settleFamily == plan.settleFamily && windowed.settleIndex == plan.settleIndex && windowed.sparseBinding == plan.sparseBinding && windowed.sparseFamily == plan.sparseFamily && windowed.sparseIndex == plan.sparseIndex;
+    const bool counted = windowed.present ? windowed.presentIndex == plan.mainCount && windowed.mainCount == plan.mainCount + 1 : windowed.mainCount == plan.mainCount && plan.mainCount >= test.families[0].queueCount;
+    Require(kept && counted, std::string("device queue plan, ") + test.name + ": a window changed more than the presentation queue: " + describe(plan) + " without it, " + describe(windowed) + " with it");
+}
+
+struct WindowCase {
+    const char* name;
+    std::vector<VkQueueFamilyProperties> families;
+    bool settles;
+    std::uint32_t mainCount;
+    bool present;
+    std::uint32_t presentIndex;
+    bool settle;
+    std::uint32_t settleFamily;
+    std::uint32_t settleIndex;
+    std::uint32_t sparseFamily;
+    std::uint32_t sparseIndex;
+};
+
+void check(const WindowCase& test) {
+    const auto plan = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, true, true);
+    const bool expected = plan.mainCount == test.mainCount && plan.present == test.present && (!test.present || plan.presentIndex == test.presentIndex) && plan.settle == test.settle && (!test.settle || (plan.settleFamily == test.settleFamily && plan.settleIndex == test.settleIndex)) && plan.sparseFamily == test.sparseFamily && (test.sparseFamily == Own || plan.sparseIndex == test.sparseIndex);
+    Require(expected, std::string("device queue plan with a window, ") + test.name + ": got " + describe(plan));
 }
 
 }
@@ -62,6 +86,15 @@ int main() {
             {"only the settle queue binds", {family(Graphics, 1), family(VK_QUEUE_TRANSFER_BIT | Sparse, 1)}, true, 1, true, 1, 0, false, Own, 0},
         };
         for (const auto& test : cases) check(test);
+        const std::vector<WindowCase> windowCases{
+            {"one queue with a window", {family(Graphics | Sparse, 1)}, true, 1, false, 0, false, 0, 0, Own, 0},
+            {"two queues, no settles, with a window", {family(Graphics, 2)}, false, 2, true, 1, false, 0, 0, Own, 0},
+            {"two queues taken by the main and settle queues, with a window", {family(Graphics, 2)}, true, 2, false, 0, true, 0, 1, Own, 0},
+            {"settle on the main family, three queues, with a window", {family(Graphics | Sparse, 3), family(VK_QUEUE_TRANSFER_BIT | Sparse, 1)}, true, 3, true, 2, true, 0, 1, 1, 0},
+            {"one main queue and settle on another family, with a window", {family(Graphics, 1), family(VK_QUEUE_TRANSFER_BIT, 1)}, true, 1, false, 0, true, 1, 0, Own, 0},
+            {"sparse-only family preferred, with a window", {family(Graphics | Sparse, 16), family(VK_QUEUE_TRANSFER_BIT | Sparse, 2), family(Sparse, 1)}, true, 3, true, 2, true, 0, 1, 2, 0},
+        };
+        for (const auto& test : windowCases) check(test);
         std::puts("device queue plan tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DirectWriteCompletion.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DirectWriteCompletion.cpp
new file mode 100644
index 0000000000..889e5f46cb
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DirectWriteCompletion.cpp
@@ -0,0 +1,266 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <stdexcept>
+#include <thread>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using AgcDriver::Graphics::StorageTexture;
+constexpr std::uint32_t Side = 256;
+constexpr std::uint32_t Format32UInt = 20;
+constexpr std::uint32_t TileR64KBX = 0x1b;
+constexpr std::uint32_t Type2D = 9;
+constexpr std::size_t Block = 0x10000;
+constexpr std::size_t SurfaceBytes = 4 * Block;
+constexpr std::size_t SettledImportBytes = 64 * Block;
+constexpr std::uint32_t Untouched = 0xdeadbeefu;
+constexpr std::uint32_t Stored = 0x12345678u;
+constexpr std::uint32_t Filled = 0x9abcdef0u;
+constexpr std::uint32_t Written = 0x0badf00du;
+
+alignas(256) constexpr std::array<std::uint32_t, 7> StoreCode{
+    0x7e040300, 0x7e060280, 0x7e0202ff, Stored, 0xf0200108, 0x00020102, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> FillCode{
+    0xd7460004, 0x04010c08, 0x7e000204, 0x7e020205, 0x7e040206, 0x7e060207, 0xe01c2000, 0x80000004, 0xe01c2000, 0x80020004, 0xbf810000,
+};
+
+std::uint64_t AddressOf(const void* data) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+}
+
+std::array<std::uint32_t, 8> TextureDescriptor(const std::uint32_t* texels) {
+    const auto address = AddressOf(texels);
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32UInt << 20u) | (((Side - 1u) & 3u) << 30u),
+        ((Side - 1u) >> 2u) | ((Side - 1u) << 14u),
+        0xfacu | (TileR64KBX << 20u) | (Type2D << 28u),
+        0u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+void Dispatch(std::vector<std::uint32_t>& words, std::span<const std::uint32_t> code, std::uint32_t threads, std::uint32_t resource, std::span<const std::uint32_t> userData, std::uint32_t groups) {
+    const auto registers = [&](const std::uint32_t first, const std::span<const std::uint32_t> values) {
+        words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
+        words.push_back(first);
+        words.insert(words.end(), values.begin(), values.end());
+    };
+    const std::array<std::uint32_t, 3> shape{threads, 1, 1};
+    registers(0x207, shape);
+    const auto address = AddressOf(code.data());
+    const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
+    registers(0x20c, program);
+    const std::array<std::uint32_t, 1> layout{resource};
+    registers(0x213, layout);
+    registers(0x240, userData);
+    words.insert(words.end(), {0xc0031500u, groups, 1, 1, 0x41u});
+}
+
+void Store(std::vector<std::uint32_t>& words, const std::uint32_t* texels) {
+    std::array<std::uint32_t, 16> userData{};
+    const auto texture = TextureDescriptor(texels);
+    std::copy(texture.begin(), texture.end(), userData.begin() + 8);
+    Dispatch(words, StoreCode, 8, static_cast<std::uint32_t>(userData.size()) << 1u, userData, 1);
+}
+
+void Fill(std::vector<std::uint32_t>& words, const std::uint32_t* texels, const std::uint32_t* copied) {
+    const auto address = AddressOf(texels);
+    const auto other = AddressOf(copied);
+    const std::array<std::uint32_t, 12> userData{
+        static_cast<std::uint32_t>(address),
+        static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u),
+        static_cast<std::uint32_t>(SurfaceBytes / 16u),
+        0x4bfacu,
+        Filled,
+        Filled,
+        Filled,
+        Filled,
+        static_cast<std::uint32_t>(other),
+        static_cast<std::uint32_t>((other >> 32u) & 0xffffu) | (16u << 16u),
+        static_cast<std::uint32_t>(SurfaceBytes / 16u),
+        0x4bfacu,
+    };
+    Dispatch(words, FillCode, 64, (static_cast<std::uint32_t>(userData.size()) << 1u) | 0x80u, userData, static_cast<std::uint32_t>(SurfaceBytes / 1024u));
+}
+
+class Surface {
+public:
+    Surface() {
+#ifdef _WIN32
+        region = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(SurfaceBytes, Block));
+        if (region != nullptr) GuestArena::GuestArenaCommit_nid_postfix(region, SurfaceBytes, PAGE_READWRITE, SurfaceBytes);
+#else
+        void* mapped = mmap(nullptr, SurfaceBytes + Block, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (mapped != MAP_FAILED) {
+            const auto begin = reinterpret_cast<std::uintptr_t>(mapped);
+            const auto aligned = (begin + Block - 1) & ~std::uintptr_t{Block - 1};
+            if (aligned != begin) munmap(mapped, aligned - begin);
+            if (aligned != begin + Block) munmap(reinterpret_cast<void*>(aligned + SurfaceBytes), begin + Block - aligned);
+            region = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(region, SurfaceBytes);
+        }
+#endif
+        Require(region != nullptr, "direct write completion: cannot allocate the guest surface");
+        texels = reinterpret_cast<std::uint32_t*>(region);
+        std::fill(texels, texels + SurfaceBytes / 4u, Untouched);
+        GuestAllocations::Mutation().Add(region, SurfaceBytes, true, true, true);
+    }
+
+    ~Surface() {
+        GuestAllocations::Mutation().Remove(region);
+#ifdef _WIN32
+        GuestArena::GuestArenaReset_nid_postfix(region, SurfaceBytes);
+        GuestArena::GuestArenaRelease_nid_postfix(region, SurfaceBytes);
+#else
+        munmap(region, SurfaceBytes);
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(region, SurfaceBytes);
+#endif
+    }
+
+    Surface(const Surface&) = delete;
+    Surface& operator=(const Surface&) = delete;
+
+    std::uint32_t* Texels() const { return texels; }
+
+private:
+    std::uint8_t* region = nullptr;
+    std::uint32_t* texels = nullptr;
+};
+
+enum class Outcome { Kept, Dropped, Missed };
+
+void WriteOnceRecorded(const Surface& surface) {
+    const auto address = AddressOf(surface.Texels());
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    for (;;) {
+        {
+            std::unique_lock hold(AgcDriver::GuestMemory::GpuMutex());
+            if (StorageTexture::FindPending(address, SurfaceBytes) != nullptr) {
+                surface.Texels()[0] = Written;
+                return;
+            }
+        }
+        Require(std::chrono::steady_clock::now() < deadline, "direct write completion: the image store was never recorded");
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+}
+
+Outcome StoreAfterFill(const Surface& surface, bool cpuWrite) {
+    std::vector<std::uint32_t> copied(SurfaceBytes / 4u, Untouched);
+    GuestAllocations::Mutation().Add(copied.data(), SurfaceBytes, true, true, true);
+    struct Unregister {
+        void* data;
+        ~Unregister() { GuestAllocations::Mutation().Remove(data); }
+    } unregister{copied.data()};
+    std::vector<std::uint32_t> words;
+    Fill(words, surface.Texels(), copied.data());
+    Store(words, surface.Texels());
+    alignas(8) static std::uint32_t gate = 0;
+    gate = 0;
+    if (cpuWrite) {
+        const auto at = AddressOf(&gate);
+        words.insert(words.end(), {0xc0053c00u, 0x13u, static_cast<std::uint32_t>(at), static_cast<std::uint32_t>(at >> 32u), 1u, 0xffffffffu, 0x19u});
+    }
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    AgcDriver::Submit(&packet, 0);
+    if (cpuWrite) {
+        WriteOnceRecorded(surface);
+        std::atomic_ref<std::uint32_t>(gate).store(1);
+    }
+    AgcDriverWaitIdle_nid_postfix();
+    std::vector<std::byte> landed(SurfaceBytes);
+    AgcDriver::GuestMemory::Read(AddressOf(copied.data()), landed);
+    const auto address = AddressOf(surface.Texels());
+    std::unique_lock hold(AgcDriver::GuestMemory::GpuMutex());
+    const auto image = StorageTexture::FindPending(address, SurfaceBytes);
+    if (image == nullptr) return Outcome::Missed;
+    const bool current = image->Refresh();
+    const bool pending = StorageTexture::FindPending(address, SurfaceBytes) == image;
+    StorageTexture::FlushPending(address, SurfaceBytes, nullptr, "direct write completion fixture");
+    return current && pending ? Outcome::Kept : Outcome::Dropped;
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        struct ShutdownGuard {
+            ~ShutdownGuard() { try { AgcDriverShutdown_nid_postfix(); } catch (...) {} }
+        } shutdown;
+        {
+            Surface probe;
+            Require(AgcDriver::Graphics::DescribeSurface(AgcDriver::Graphics::DecodeTextureResource(TextureDescriptor(probe.Texels()))).guestBytes == SurfaceBytes, "direct write completion: unexpected surface size");
+        }
+        {
+            constexpr std::size_t Runs = SettledImportBytes / SurfaceBytes - 1;
+            std::vector<std::unique_ptr<Surface>> surfaces;
+            for (std::size_t index = 0; index <= 2 * Runs + 1; ++index) surfaces.push_back(std::make_unique<Surface>());
+            static_cast<void>(StoreAfterFill(*surfaces[0], false));
+            std::size_t kept = 0;
+            std::size_t dropped = 0;
+            for (std::size_t run = 1; run <= Runs; ++run) {
+                const auto outcome = StoreAfterFill(*surfaces[run], false);
+                kept += outcome == Outcome::Kept;
+                dropped += outcome == Outcome::Dropped;
+            }
+            AgcDriverWaitIdle_nid_postfix();
+            std::printf("[direct write completion] %zu of %zu runs held the image results pending, %zu dropped them\n", kept + dropped, Runs, dropped);
+            Require(kept + dropped != 0, "direct write completion: no run held the image results pending");
+            Require(dropped == 0, "direct write completion: the completion of a buffer write dropped image results recorded after it");
+            static_cast<void>(StoreAfterFill(*surfaces[Runs + 1], false));
+            std::size_t keptOverWrite = 0;
+            std::size_t lostWrites = 0;
+            for (std::size_t run = Runs + 2; run <= 2 * Runs + 1; ++run) {
+                keptOverWrite += StoreAfterFill(*surfaces[run], true) == Outcome::Kept;
+                lostWrites += surfaces[run]->Texels()[0] != Written;
+            }
+            AgcDriverWaitIdle_nid_postfix();
+            std::printf("[direct write completion] %zu of %zu runs with a CPU write before the completion kept the image results, %zu lost the write\n", keptOverWrite, Runs, lostWrites);
+            Require(keptOverWrite == 0, "direct write completion: image results were kept over a CPU write made before the completion");
+            Require(lostWrites == 0, "direct write completion: a CPU write made before the completion was lost");
+        }
+        AgcDriverShutdown_nid_postfix();
+        std::puts("direct write completion tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DispatchAheadAdoptCheck.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DispatchAheadAdoptCheck.cpp
new file mode 100644
index 0000000000..e2453a66f0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DispatchAheadAdoptCheck.cpp
@@ -0,0 +1,208 @@
+#include "VulkanTestDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <initializer_list>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+alignas(256) std::array<std::uint32_t, 7> CounterCode{0xf4080200u, 0xfa000000u, 0xbf8cc07fu, 0x7e000281u, 0xe0c80000u, 0x80020000u, 0xbf810000u};
+alignas(256) std::array<std::uint32_t, 7> StoreCode{0xf4080200u, 0xfa000000u, 0xbf8cc07fu, 0x7e000202u, 0xe0700000u, 0x80020000u, 0xbf810000u};
+alignas(256) std::array<std::uint32_t, 15> SpinCode{0xf4080200u, 0xfa000000u, 0xbe840381u, 0x9304ff04u, 0x0019660du, 0x8004ff04u, 0x3c6ef35fu, 0x80828102u, 0xbf078002u, 0xbf85fff9u, 0xbf8cc07fu, 0x7e000204u, 0xe0700000u, 0x80020000u, 0xbf810000u};
+
+constexpr std::uint32_t Compute = 0x20u;
+constexpr std::uint32_t OtherCompute = 0x28u;
+constexpr std::uint32_t SpinIterations = 1u << 20u;
+
+alignas(256) std::array<std::uint32_t, 4> Stale{};
+alignas(256) std::array<std::uint32_t, 4> Fresh{};
+alignas(256) std::array<std::uint32_t, 4> Target{};
+alignas(256) std::array<std::uint32_t, 4> TargetDescriptor{};
+alignas(256) std::array<std::uint32_t, 4> Spun{};
+alignas(256) std::array<std::uint32_t, 4> SpunDescriptor{};
+alignas(256) volatile std::uint32_t Gate = 1;
+alignas(256) volatile std::uint32_t Done = 0;
+alignas(256) volatile std::uint32_t OtherDone = 0;
+
+enum class Window { None, CpuStore, QueuedGpuStore };
+
+std::atomic<Window> Armed{Window::None};
+std::uint32_t SpinDispatches = 16;
+std::vector<std::uint32_t> OtherWords;
+bool SawPending = false;
+
+std::uint32_t Low(const volatile void* pointer) {
+    return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(pointer));
+}
+
+std::uint32_t High(const volatile void* pointer) {
+    return static_cast<std::uint32_t>(static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(pointer)) >> 32u);
+}
+
+std::array<std::uint32_t, 4> Descriptor(const void* pointer, std::uint32_t bytes) {
+    return {Low(pointer), High(pointer) & 0xffffu, bytes, 0x31016facu};
+}
+
+void SetShaderRegister(std::vector<std::uint32_t>& words, std::uint32_t offset, std::uint32_t value) {
+    words.insert(words.end(), {0xc0017600u, offset, value});
+}
+
+void Program(std::vector<std::uint32_t>& words, const void* code, std::initializer_list<std::uint32_t> userData) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(code));
+    SetShaderRegister(words, 0x20c, static_cast<std::uint32_t>(address >> 8u));
+    SetShaderRegister(words, 0x20d, static_cast<std::uint32_t>(address >> 40u) & 0xffu);
+    for (const std::uint32_t offset : {0x207u, 0x208u, 0x209u}) SetShaderRegister(words, offset, 1);
+    SetShaderRegister(words, 0x212, 0);
+    SetShaderRegister(words, 0x213, static_cast<std::uint32_t>(userData.size()) << 1u);
+    std::uint32_t offset = 0x240;
+    for (const auto value : userData) SetShaderRegister(words, offset++, value);
+}
+
+void Dispatch(std::vector<std::uint32_t>& words, const void* code, std::initializer_list<std::uint32_t> userData) {
+    Program(words, code, userData);
+    words.insert(words.end(), {0xc0031500u, 1, 1, 1, 0x8041u});
+}
+
+void WriteData(std::vector<std::uint32_t>& words, const volatile std::uint32_t* target, std::uint32_t value) {
+    words.insert(words.end(), {0xc0033700u, 0x00100200u, Low(target), High(target), value});
+}
+
+void Submit(std::uint32_t queue, std::vector<std::uint32_t>& words) {
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    Require(sceAgcDriverSubmitAcb(queue, &packet) == 0, "compute submit failed");
+}
+
+void QueueStoreAhead() {
+    OtherWords.clear();
+    for (std::uint32_t index = 0; index < SpinDispatches; ++index) Dispatch(OtherWords, SpinCode.data(), {Low(SpunDescriptor.data()), High(SpunDescriptor.data()), SpinIterations});
+    Dispatch(OtherWords, StoreCode.data(), {Low(TargetDescriptor.data()), High(TargetDescriptor.data()), Low(Fresh.data())});
+    WriteData(OtherWords, &OtherDone, 1);
+    Submit(OtherCompute, OtherWords);
+    const auto start = std::chrono::steady_clock::now();
+    while (std::chrono::steady_clock::now() - start < std::chrono::seconds(5) && OtherDone == 0) {
+        if (AgcDriver::DriverDetail::Driver::QueryPendingSpan(reinterpret_cast<std::uintptr_t>(Target.data()), sizeof(Target), {}) != AgcDriver::ShaderMemory::PendingWrite::None) {
+            SawPending = true;
+            return;
+        }
+        std::this_thread::yield();
+    }
+}
+
+void BeforeAdoption() {
+    const auto window = Armed.exchange(Window::None);
+    if (window == Window::CpuStore) reinterpret_cast<volatile std::uint32_t&>(Target[0]) = Low(Fresh.data());
+    else if (window == Window::QueuedGpuStore) QueueStoreAhead();
+}
+
+void WaitIdle() {
+    AgcDriverWaitIdle_nid_postfix();
+    for (const auto* buffer : {&Stale, &Fresh, &Target}) AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(buffer->data()), sizeof(*buffer));
+}
+
+void Reset() {
+    WaitIdle();
+    Stale = {};
+    Fresh = {};
+    Target = Descriptor(Stale.data(), sizeof(Stale));
+    Done = 0;
+    OtherDone = 0;
+    SawPending = false;
+}
+
+void Gated(Window window) {
+    Reset();
+    std::vector<std::uint32_t> words;
+    words.insert(words.end(), {0xc0053c00u, 0x13u, Low(&Gate), High(&Gate), 1u, 0xffffffffu, 0x19u});
+    Dispatch(words, CounterCode.data(), {Low(Target.data()), High(Target.data())});
+    WriteData(words, &Done, 1);
+    Armed = window;
+    Submit(Compute, words);
+    WaitIdle();
+    Armed = Window::None;
+    Require(Done == 1, "the gated submission did not finish");
+}
+
+std::string Counts() {
+    return "(stale " + std::to_string(Stale[0]) + ", fresh " + std::to_string(Fresh[0]) + ")";
+}
+
+}
+
+int main() {
+    try {
+        auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        device.reset();
+        Require(High(Stale.data()) == High(Fresh.data()), "the stale and fresh buffers differ in their high address word");
+        TargetDescriptor = Descriptor(Target.data(), sizeof(Target));
+        SpunDescriptor = Descriptor(Spun.data(), sizeof(Spun));
+        AgcDriverSetAheadAdoptHook_nid_postfix(&BeforeAdoption);
+        Reset();
+        std::vector<std::uint32_t> warmUp;
+        Dispatch(warmUp, CounterCode.data(), {Low(Target.data()), High(Target.data())});
+        WriteData(warmUp, &Done, 1);
+        Submit(Compute, warmUp);
+        std::vector<std::uint32_t> otherWarmUp;
+        Dispatch(otherWarmUp, SpinCode.data(), {Low(SpunDescriptor.data()), High(SpunDescriptor.data()), SpinIterations});
+        Dispatch(otherWarmUp, StoreCode.data(), {Low(TargetDescriptor.data()), High(TargetDescriptor.data()), Low(Fresh.data())});
+        Submit(OtherCompute, otherWarmUp);
+        WaitIdle();
+        Require(Done == 1 && Target[0] == Low(Fresh.data()), "the warm-up dispatches did not run");
+
+        Gated(Window::None);
+        Require(Stale[0] == 1 && Fresh[0] == 0, "the gated dispatch without a store in the window did not count into the stale buffer " + Counts());
+        const auto adopted = AgcDriverDispatchesAdoptedAhead_nid_postfix();
+        Require(adopted != 0, "the gated dispatch was not resolved ahead and adopted");
+
+        auto rejected = AgcDriverDispatchesRejectedAhead_nid_postfix();
+        Gated(Window::CpuStore);
+        Require(Fresh[0] == 1 && Stale[0] == 0, "a dispatch resolved ahead whose descriptor the CPU replaced before its adoption used the old descriptor " + Counts());
+        Require(AgcDriverDispatchesRejectedAhead_nid_postfix() == rejected + 1, "the CPU store in the adoption window was not caught by the adoption check");
+        std::cout << "cpu store before adoption: passed\n";
+
+        bool conclusive = false;
+        for (int attempt = 0; attempt < 4 && !conclusive; ++attempt, SpinDispatches *= 4) {
+            rejected = AgcDriverDispatchesRejectedAhead_nid_postfix();
+            Gated(Window::QueuedGpuStore);
+            conclusive = SawPending;
+            if (!conclusive) {
+                std::cout << "queued gpu store before adoption: the store finished before the adoption with " << SpinDispatches << " spin dispatches, retrying\n";
+                continue;
+            }
+            Require(Fresh[0] == 1 && Stale[0] == 0, "a dispatch resolved ahead whose descriptor a GPU store queued on another queue replaces before its adoption used the old descriptor " + Counts());
+            Require(AgcDriverDispatchesRejectedAhead_nid_postfix() == rejected + 1, "the queued GPU store in the adoption window was not caught by the adoption check");
+        }
+        AgcDriverSetAheadAdoptHook_nid_postfix(nullptr);
+        if (!conclusive) {
+            std::cout << "queued gpu store before adoption: never observed the store pending at the adoption\n";
+            AgcDriverShutdown_nid_postfix();
+            return VulkanTestSkipped;
+        }
+        std::cout << "queued gpu store before adoption: passed\n";
+        std::cout << "dispatch ahead adopt check test passed\n";
+        AgcDriverShutdown_nid_postfix();
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try {
+            AgcDriverShutdown_nid_postfix();
+        } catch (const std::exception& shutdownError) {
+            std::cerr << shutdownError.what() << '\n';
+        }
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp
index a82e34a36a..45f1e60352 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp
@@ -135,6 +135,69 @@ void MovedDataHitsTheCache(bool libraries) {
     Require(again.lookups == 10 && again.hits == 5, mode + ": a draw at an address seen before did not reuse the cached draw (" + std::to_string(again.hits) + " hits)");
 }
 
+void EvictedEntriesServeNoRelocation(bool libraries) {
+    Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+    Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+    Registered(SecondVertexHeader, SecondVertexCode.data(), sizeof(SecondVertexCode), 2);
+    const auto mode = std::string(libraries ? "with" : "without") + " graphics pipeline libraries";
+    const auto draw = [&](const float* source, const std::uint32_t* vertexCode) {
+        auto commands = DrawFrom({source}, vertexCode);
+        Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+        Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission failed");
+        AgcDriverWaitIdle_nid_postfix();
+        return AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    };
+    static std::array<std::array<float, 4>, 6> same{};
+    for (auto& entry : same) entry = {1.0f, 0.0f, 0.0f, 0.0f};
+    alignas(16) static std::array<std::array<float, 4>, 3> others{};
+    for (std::size_t i = 0; i < others.size(); ++i) others[i] = {0.25f + 0.03125f * static_cast<float>(i), 0.0f, 0.0f, 0.0f};
+    AgcDriver::DriverDetail::DrawEntryCounters counters{};
+    for (std::size_t i = 0; i < 4; ++i) counters = draw(same[i].data(), VertexCode.data());
+    Require(counters.lookups == 4 && counters.hits == 0 && counters.inserts == 2, mode + ": the draws that teach the moved pointer and its contents made " + std::to_string(counters.hits) + " hits and " + std::to_string(counters.inserts) + " inserts, expected 0 and 2");
+    const auto relocated = draw(same[4].data(), VertexCode.data());
+    Require(relocated.hits == 1, mode + ": a draw whose data moved after the teaching draws did not reuse the cached draw (" + std::to_string(relocated.hits) + " hits)");
+    auto evicted = relocated;
+    for (const auto& entry : others) {
+        draw(entry.data(), SecondVertexCode.data());
+        evicted = draw(entry.data(), SecondVertexCode.data());
+    }
+    Require(evicted.evictions - relocated.evictions >= 2 && evicted.inserts - relocated.inserts >= 2, mode + ": draws of another vertex shader did not evict the two taught entries from the draw cache (" + std::to_string(evicted.inserts - relocated.inserts) + " inserts, " + std::to_string(evicted.evictions - relocated.evictions) + " evictions; run with APS5_DRAW_CACHE_ENTRIES=2)");
+    const auto after = draw(same[5].data(), VertexCode.data());
+    Require(after.lookups == evicted.lookups + 1 && after.hits == evicted.hits, mode + ": a draw whose data moved reused a draw the cache had evicted, through its relocation alias (" + std::to_string(after.hits - evicted.hits) + " hits)");
+}
+
+void RelocatingDrawsKeepTheirDonor(bool libraries) {
+    Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+    Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+    Registered(SecondVertexHeader, SecondVertexCode.data(), sizeof(SecondVertexCode), 2);
+    const auto mode = std::string(libraries ? "with" : "without") + " graphics pipeline libraries";
+    const auto draw = [&](const float* source, const std::uint32_t* vertexCode) {
+        auto commands = DrawFrom({source}, vertexCode);
+        Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+        Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission failed");
+        AgcDriverWaitIdle_nid_postfix();
+        return AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    };
+    constexpr std::size_t Rounds = 3;
+    alignas(16) static std::array<std::array<float, 4>, Rounds> others{};
+    for (std::size_t i = 0; i < others.size(); ++i) others[i] = {0.25f + 0.03125f * static_cast<float>(i), 0.0f, 0.0f, 0.0f};
+    static std::array<std::array<float, 4>, 5 + Rounds> same{};
+    for (auto& entry : same) entry = {1.0f, 0.0f, 0.0f, 0.0f};
+    AgcDriver::DriverDetail::DrawEntryCounters counters{};
+    for (std::size_t i = 0; i < 4; ++i) counters = draw(same[i].data(), VertexCode.data());
+    Require(counters.lookups == 4 && counters.hits == 0 && counters.inserts == 2, mode + ": the draws that teach the moved pointer and its contents made " + std::to_string(counters.hits) + " hits and " + std::to_string(counters.inserts) + " inserts, expected 0 and 2");
+    const auto start = draw(same[4].data(), VertexCode.data());
+    Require(start.hits == 1, mode + ": a draw whose data moved after the teaching draws did not reuse the cached draw (" + std::to_string(start.hits) + " hits)");
+    auto relocated = start;
+    for (std::size_t i = 0; i < others.size(); ++i) {
+        draw(others[i].data(), SecondVertexCode.data());
+        const auto inserted = draw(others[i].data(), SecondVertexCode.data());
+        relocated = draw(same[5 + i].data(), VertexCode.data());
+        Require(relocated.hits == inserted.hits + 1, mode + ": a draw whose data moved again lost the cached draw it reused before each of " + std::to_string(i + 1) + " rounds of another vertex shader's draws (" + std::to_string(inserted.inserts - start.inserts) + " inserts, " + std::to_string(inserted.evictions - start.evictions) + " evictions)");
+    }
+    Require(relocated.evictions - start.evictions >= 2, mode + ": draws of another vertex shader evicted " + std::to_string(relocated.evictions - start.evictions) + " entries, expected at least 2 (run with APS5_DRAW_CACHE_ENTRIES=2)");
+}
+
 void SplitRunsNameTheirSharedWords() {
     alignas(16) static std::array<std::uint32_t, 4> data{1u, 2u, 3u, 4u};
     auto table = std::make_shared<ShaderRecompiler::SrtGuestWords>();
@@ -228,9 +291,11 @@ void MovedForwardedWordReachesStageDataHit(bool libraries) {
 
 }
 
-int main() {
+int main(int argc, char** argv) {
     try {
-        SplitRunsNameTheirSharedWords();
+        const bool evicted = argc == 2 && std::string(argv[1]) == "--evicted";
+        const bool kept = argc == 2 && std::string(argv[1]) == "--kept";
+        if (!evicted && !kept) SplitRunsNameTheirSharedWords();
         bool libraries = false;
         {
             const auto device = OpenVulkanTestDevice();
@@ -238,6 +303,18 @@ int main() {
             libraries = device->GraphicsPipelineLibraries();
         }
         if (!libraries && std::getenv("APS5_NO_GPL") == nullptr) return VulkanTestSkipped;
+        if (evicted) {
+            EvictedEntriesServeNoRelocation(libraries);
+            AgcDriverShutdown_nid_postfix();
+            std::cout << "An evicted draw served no relocation " << (libraries ? "with" : "without") << " graphics pipeline libraries\n";
+            return 0;
+        }
+        if (kept) {
+            RelocatingDrawsKeepTheirDonor(libraries);
+            AgcDriverShutdown_nid_postfix();
+            std::cout << "A draw relocated from a cached draw kept it cached " << (libraries ? "with" : "without") << " graphics pipeline libraries\n";
+            return 0;
+        }
         MovedDataHitsTheCache(libraries);
         UnrelocatedAliasesStayOut(libraries);
         MovedForwardedWordReachesStageDataHit(libraries);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp
index ab9818c6ba..41ff2d9a50 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp
@@ -183,6 +183,20 @@ void StageDataHitsRefreshTheirWords(bool libraries) {
     Require(BrightestColorByte() == 255, mode + ": the draw of constant 1.0 wrote " + std::to_string(BrightestColorByte()) + ", expected 255");
 }
 
+void RefreshedStageDataVerifies() {
+    Registered(TriangleVertexHeader, TriangleVertexCode.data(), sizeof(TriangleVertexCode), 2);
+    Registered(ConstantPixelHeader, ConstantPixelCode.data(), sizeof(ConstantPixelCode), 1);
+    ColorMemory.fill(std::byte{0});
+    PixelConstant[0] = 0.25f;
+    const auto cached = SubmitConstantDraws(3);
+    Require(BrightestColorByte() == 64, "draw-entry verification: the initial constant did not render");
+    PixelConstant[0] = 1.0f;
+    const auto refreshed = SubmitConstantDraws(1);
+    Require(refreshed.verifyHits - cached.verifyHits == 1 && refreshed.stageDataHits - cached.stageDataHits == 1, "draw-entry verification: the refreshed constant did not exercise a verified stage data hit");
+    Require(refreshed.verifyMismatches == cached.verifyMismatches, "draw-entry verification: refreshed stage data differed from a fresh capture");
+    Require(BrightestColorByte() == 255, "draw-entry verification: the refreshed constant did not render");
+}
+
 void RetainedPixelCacheTransitions() {
     auto commands = Draws(32.0f, VertexCode.data(), 1, PixelCode.data(), 1, {});
     Append(commands, 0x76, {0x00c, std::bit_cast<std::uint32_t>(1.0f)});
@@ -239,10 +253,14 @@ int main() {
             libraries = device->GraphicsPipelineLibraries();
         }
         if (!libraries && std::getenv("APS5_NO_GPL") == nullptr) return VulkanTestSkipped;
-        ThirdDrawHitsTheCache(libraries);
-        UserDataDrawsReuseTheirShape(libraries);
-        StageDataHitsRefreshTheirWords(libraries);
-        RetainedPixelCacheTransitions();
+        if (std::getenv("APS5_VERIFY_DRAW_ENTRIES") != nullptr) {
+            RefreshedStageDataVerifies();
+        } else {
+            ThirdDrawHitsTheCache(libraries);
+            UserDataDrawsReuseTheirShape(libraries);
+            StageDataHitsRefreshTheirWords(libraries);
+            RetainedPixelCacheTransitions();
+        }
         AgcDriverShutdown_nid_postfix();
         Require(AgcDriver::Graphics::PipelineLibraryWorkers() == 0, "the driver's shutdown left the pipeline library worker running");
         std::cout << "A repeated draw reused the cached draw " << (libraries ? "with" : "without") << " graphics pipeline libraries\n";
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp
index 2da8fc562c..ed4b5280c1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp
@@ -34,6 +34,7 @@ alignas(256) constexpr std::array<std::uint32_t, 16> TriangleVertexCode{
     0x7e060280u, 0x7e0802f2u, 0xf80008cfu, 0x04030201u, 0xbf810000u,
 };
 alignas(256) constexpr std::array<std::uint32_t, 10> ArithmeticPixelCode{0xf4000100u, 0xfa000000u, 0xbf8cc07fu, 0x7e000204u, 0x06000002u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 8> DirectBufferPixelCode{0xe0300000u, 0x80000000u, 0xbf8c3f70u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u};
 alignas(256) std::array<float, 4> PixelConstant{};
 alignas(256) std::array<std::byte, 1024> ColorMemory{};
 
@@ -47,6 +48,7 @@ struct Header {
 alignas(8) Header VertexHeader{};
 alignas(8) Header PixelHeader{};
 alignas(8) Header ArithmeticPixelHeader{};
+alignas(8) Header DirectBufferPixelHeader{};
 
 void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
     header.shader.file_header = 0x34333231u;
@@ -83,10 +85,10 @@ void PixelUserData(std::vector<std::uint32_t>& commands, const std::uint32_t* po
     Append(commands, 0x76, {0x00e, unread});
 }
 
-std::vector<std::uint32_t> Setup(bool triangle = false) {
+std::vector<std::uint32_t> Setup(bool triangle = false, const std::uint32_t* pixelCode = nullptr, std::uint32_t pixelUserSgprs = 3) {
     const auto color = reinterpret_cast<std::uintptr_t>(ColorMemory.data());
     const auto vertex = reinterpret_cast<std::uintptr_t>(triangle ? TriangleVertexCode.data() : VertexCode.data());
-    const auto pixel = reinterpret_cast<std::uintptr_t>(triangle ? ArithmeticPixelCode.data() : PixelCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(pixelCode ? pixelCode : triangle ? ArithmeticPixelCode.data() : PixelCode.data());
     std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
         {0x2d5, 0x2000},
         {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
@@ -110,7 +112,7 @@ std::vector<std::uint32_t> Setup(bool triangle = false) {
     };
     const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
         {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, triangle ? 0u : 1u << 1u}, {0x8c, 0},
-        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 3u << 1u},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, pixelUserSgprs << 1u},
     };
     if (triangle) context.insert(context.end(), {{0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0}});
     std::vector<std::uint32_t> commands;
@@ -223,6 +225,39 @@ void ReadUserWordsChangeTheOutput() {
     Require(closeTo(second, 191), "a pixel stage adding user word 2 changed to 0.5 wrote " + std::to_string(second) + ", expected 191 (" + Counts(after) + ", before: " + Counts(before) + ")");
 }
 
+void DirectBufferBaseMovesWithItsPayload() {
+    Registered(VertexHeader, TriangleVertexCode.data(), sizeof(TriangleVertexCode), 2);
+    Registered(DirectBufferPixelHeader, DirectBufferPixelCode.data(), sizeof(DirectBufferPixelCode), 1);
+    auto* ring = GuestBlock();
+    ColorMemory.fill(std::byte{0});
+    const auto slot = [&](std::size_t index, float value) {
+        auto* data = ring + 1024 + index * 64;
+        data[0] = std::bit_cast<std::uint32_t>(value);
+        return data;
+    };
+    const auto draw = [&](const std::uint32_t* data, bool setup) {
+        auto commands = setup ? Setup(true, DirectBufferPixelCode.data(), 4) : std::vector<std::uint32_t>{};
+        const auto address = reinterpret_cast<std::uintptr_t>(data);
+        Append(commands, 0x76, {0x00c, static_cast<std::uint32_t>(address)});
+        Append(commands, 0x76, {0x00d, static_cast<std::uint32_t>(address >> 32u) & 0xffffu});
+        Append(commands, 0x76, {0x00e, 16});
+        Append(commands, 0x76, {0x00f, 0x3004bfacu});
+        Append(commands, 0x2d, {3, 2});
+        Submit(std::move(commands));
+        return BrightestColorByte();
+    };
+    const auto first = slot(0, 0.25f);
+    const auto second = slot(1, 1.0f);
+    draw(first, true);
+    const auto repeated = draw(first, false);
+    const auto before = AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    const auto moved = draw(second, false);
+    const auto after = AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    Require(moved > repeated, "a draw whose descriptor base and payload both moved read the old payload: " + std::to_string(repeated) + " then " + std::to_string(moved) + " (" + Counts(after) + ", before: " + Counts(before) + ")");
+    Require(after.dataHits == before.dataHits + 1, "a draw whose descriptor base and payload moved was not a data-only hit (" + Counts(after) + ", before: " + Counts(before) + ")");
+    Require(after.dataStagesCompiled - before.dataStagesCompiled >= 1, "a draw whose descriptor base moved reused the pixel stage built for the old base: the rebuild this test documents is gone, flip it to a reuse check (" + Counts(after) + ", before: " + Counts(before) + ")");
+}
+
 }
 
 int main() {
@@ -237,6 +272,7 @@ int main() {
         const bool verify = std::getenv("APS5_VERIFY_DRAW_DATA_HITS") != nullptr;
         UnreadUserWordsKeepTheStage(verify);
         ReadUserWordsChangeTheOutput();
+        DirectBufferBaseMovesWithItsPayload();
         AgcDriverShutdown_nid_postfix();
         std::cout << "Data-only hits " << (verify ? "verified" : "reused") << " the stages whose read user words did not change\n";
         return 0;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawShaderFailure.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawShaderFailure.cpp
new file mode 100644
index 0000000000..2051585c2d
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawShaderFailure.cpp
@@ -0,0 +1,355 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "VulkanTestDevice.hpp"
+#include <array>
+#include <bit>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <cstdlib>
+#include <exception>
+#include <fstream>
+#include <initializer_list>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+alignas(256) constexpr std::array<std::uint32_t, 2> FailingVertexCode{0xbe800200u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 4> RequestFailureVertexCode{0xbe901f00u, 0x809010c0u, 0xbe802010u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 8> ValidVertexCode{0x7e000208u, 0x7e020280u, 0x7e040280u, 0x7e0602f2u, 0xf80008cfu, 0x03020100u, 0xbf810000u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 8> PixelCode{0x7e000200u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u};
+
+struct ColorBuffer {
+    static constexpr std::size_t Size = 65536;
+    ColorBuffer() {
+#ifdef _WIN32
+        data = static_cast<std::byte*>(VirtualAlloc(nullptr, Size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        Require(data != nullptr, "cannot allocate the color target");
+#else
+        void* raw = mmap(nullptr, 2 * Size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        Require(raw != MAP_FAILED, "cannot map the color target");
+        const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+        const auto aligned = (begin + Size - 1) & ~(static_cast<std::uintptr_t>(Size) - 1);
+        if (aligned != begin) munmap(raw, aligned - begin);
+        if (aligned + Size != begin + 2 * Size) munmap(reinterpret_cast<void*>(aligned + Size), begin + 2 * Size - (aligned + Size));
+        data = reinterpret_cast<std::byte*>(aligned);
+#endif
+        std::memset(data, 0, Size);
+        GuestAllocations::Mutation().Add(data, Size, true, true, true);
+    }
+    ~ColorBuffer() {
+        if (data != nullptr) {
+            GuestAllocations::Mutation().Remove(data);
+#ifdef _WIN32
+            VirtualFree(data, 0, MEM_RELEASE);
+#else
+            munmap(data, Size);
+#endif
+            data = nullptr;
+        }
+    }
+    ColorBuffer(const ColorBuffer&) = delete;
+    ColorBuffer& operator=(const ColorBuffer&) = delete;
+
+    std::byte* data = nullptr;
+};
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+const Shader* Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+    return &header.shader;
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+std::vector<std::uint32_t> DrawPacket(std::uintptr_t color, const std::uint32_t* vertex, const std::uint32_t* pixel) {
+    const auto vertexAddress = reinterpret_cast<std::uintptr_t>(vertex);
+    const auto pixelAddress = reinterpret_cast<std::uintptr_t>(pixel);
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x4dc6c000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x318, static_cast<std::uint32_t>(color >> 8u)}, {0x390, static_cast<std::uint32_t>(color >> 40u)},
+        {0x10f, std::bit_cast<std::uint32_t>(32.0f)}, {0x110, std::bit_cast<std::uint32_t>(32.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-2.0f)}, {0x112, std::bit_cast<std::uint32_t>(2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertexAddress >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertexAddress >> 40u)}, {0x8b, 1u << 1u}, {0x8c, 0},
+        {0x008, static_cast<std::uint32_t>(pixelAddress >> 8u)}, {0x009, static_cast<std::uint32_t>(pixelAddress >> 40u)}, {0x00b, 1u << 1u}, {0x00c, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    std::vector<std::uint32_t> commands;
+    Append(commands, 0x79, {0x242, 4});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    Append(commands, 0x2d, {3, 2});
+    return commands;
+}
+
+std::string ReadTraceFile(const char* path) {
+    std::ifstream stream(path, std::ios::binary);
+    if (!stream.is_open()) return {};
+    std::ostringstream buffer;
+    buffer << stream.rdbuf();
+    return buffer.str();
+}
+
+bool WaitForTraceRecord(const char* path, const std::string& record) {
+    for (int attempt = 0; attempt < 200; ++attempt) {
+        if (ReadTraceFile(path).find(record) != std::string::npos) return true;
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    }
+    return false;
+}
+
+std::string TraceLine(const std::string& trace, const std::string& record) {
+    const auto position = trace.find(record);
+    if (position == std::string::npos) return {};
+    const auto end = trace.find('\n', position);
+    return trace.substr(position, end == std::string::npos ? std::string::npos : end - position);
+}
+
+std::string TraceField(const std::string& line, const char* name) {
+    const auto field = line.find(std::string(name) + "=");
+    if (field == std::string::npos) return {};
+    const auto start = field + std::strlen(name) + 1;
+    const auto end = line.find(' ', start);
+    return line.substr(start, end == std::string::npos ? std::string::npos : end - start);
+}
+
+std::string SubmissionSerialOf(const std::string& trace, const std::string& record) {
+    const auto position = trace.find(record);
+    if (position == std::string::npos) return {};
+    const auto field = trace.find("submission=", position);
+    if (field == std::string::npos) return {};
+    const auto start = field + std::string("submission=").size();
+    const auto end = trace.find(' ', start);
+    return trace.substr(start, end == std::string::npos ? std::string::npos : end - start);
+}
+
+void SubmitDraw(std::uintptr_t color, const std::uint32_t* vertex, const std::uint32_t* pixel) {
+    auto commands = DrawPacket(color, vertex, pixel);
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission was not accepted");
+}
+
+void FailingShaderDecodeRecordsTheDraw(const char* tracePath, bool correlationExpected = true) {
+    ColorBuffer color;
+    Registered(VertexHeader, FailingVertexCode.data(), FailingVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), FailingVertexCode.data(), PixelCode.data());
+    std::string failure;
+    try {
+        AgcDriverWaitIdle_nid_postfix();
+        Require(false, "the failing shader request did not fail the submission");
+    } catch (const std::exception& error) {
+        failure = error.what();
+    }
+    Require(failure.find("unsupported SOP1 opcode 2") != std::string::npos, "the submission failure lost the original shader-request error: " + failure);
+    if (!correlationExpected) {
+        const auto trace = ReadTraceFile(tracePath);
+        Require(trace.find("draw-attempt") == std::string::npos, "correlation-disabled failure emitted draw-attempt");
+        Require(trace.find("draw-shader-request-failed") == std::string::npos, "correlation-disabled failure emitted draw-shader-request-failed");
+        Require(trace.find("draw-materialization-failed") == std::string::npos, "correlation-disabled failure emitted draw-materialization-failed");
+        Require(trace.find("draw-submission-failed") == std::string::npos, "correlation-disabled failure emitted draw-submission-failed");
+        Require(trace.find("draw-selected") == std::string::npos, "correlation-disabled failure emitted draw-selected");
+        Require(trace.find("draw-recorded") == std::string::npos, "correlation-disabled failure emitted draw-recorded");
+        return;
+    }
+    Require(WaitForTraceRecord(tracePath, "draw-attempt-failed"), "the capture trace received no draw-attempt-failed record");
+    const auto trace = ReadTraceFile(tracePath);
+    const auto attempt = TraceLine(trace, "draw-attempt ");
+    Require(!attempt.empty(), "the failed draw emitted no draw-attempt record");
+    const auto token = TraceField(attempt, "token");
+    Require(!token.empty() && token != "0", "the draw-attempt record carries no draw token");
+    const auto failed = TraceLine(trace, "draw-attempt-failed");
+    Require(!failed.empty(), "the failed draw emitted no draw-attempt-failed record");
+    Require(failed.find("token=" + token) != std::string::npos, "the decode failure lost the draw token");
+    Require(failed.find("phase=decode") != std::string::npos, "the SOP1 failure was not classified at the decode stage");
+    Require(failed.find("offset=" + TraceField(attempt, "offset")) != std::string::npos, "the decode failure lost the packet offset");
+    Require(failed.find("unsupported SOP1 opcode 2") != std::string::npos, "the decode failure lost the shader-decoder reason");
+    Require(trace.find("draw-selected") == std::string::npos, "a pre-selection decode failure emitted draw-selected");
+    Require(trace.find("draw-shader-request-failed") == std::string::npos, "a pre-request decode failure emitted draw-shader-request-failed");
+    Require(trace.find("draw-recorded token=" + token) == std::string::npos, "a failed draw emitted draw-recorded");
+    Require(trace.find("tokens=[" + token + "]") == std::string::npos, "a failed draw token was attributed to a submitted batch");
+    const auto errorSerial = SubmissionSerialOf(trace, "draw-error");
+    Require(!errorSerial.empty(), "the draw-error record carries no submission serial");
+    Require(errorSerial == SubmissionSerialOf(trace, "draw-attempt"), "the draw-error record (submission " + errorSerial + ") does not correlate with the draw attempt");
+    Require(trace.find("draw-error submission=" + errorSerial + " offset=" + TraceField(attempt, "offset")) != std::string::npos, "the draw-error record lost the attempted packet offset");
+    Require(trace.find("unsupported SOP1 opcode 2") != std::string::npos, "the trace lost the shader-decoder reason");
+}
+
+void FailingShaderMaterializationRecordsTheDraw(const char* tracePath, bool correlationExpected = true) {
+    ColorBuffer color;
+    Registered(VertexHeader, RequestFailureVertexCode.data(), RequestFailureVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), RequestFailureVertexCode.data(), PixelCode.data());
+    std::string failure;
+    try {
+        AgcDriverWaitIdle_nid_postfix();
+        Require(false, "the failing shader request did not fail the submission");
+    } catch (const std::exception& error) {
+        failure = error.what();
+    }
+    Require(failure.find("unsupported dynamic s_setpc_b64") != std::string::npos, "the submission failure lost the original shader-request error: " + failure);
+    if (!correlationExpected) {
+        const auto trace = ReadTraceFile(tracePath);
+        Require(trace.find("draw-attempt") == std::string::npos, "correlation-disabled failure emitted draw-attempt");
+        Require(trace.find("draw-shader-request-failed") == std::string::npos, "correlation-disabled failure emitted draw-shader-request-failed");
+        Require(trace.find("draw-materialization-failed") == std::string::npos, "correlation-disabled failure emitted draw-materialization-failed");
+        Require(trace.find("draw-submission-failed") == std::string::npos, "correlation-disabled failure emitted draw-submission-failed");
+        Require(trace.find("draw-selected") == std::string::npos, "correlation-disabled failure emitted draw-selected");
+        Require(trace.find("draw-recorded") == std::string::npos, "correlation-disabled failure emitted draw-recorded");
+        return;
+    }
+    Require(WaitForTraceRecord(tracePath, "draw-shader-request-failed"), "the capture trace received no draw-shader-request-failed record");
+    const auto trace = ReadTraceFile(tracePath);
+    const auto attempt = TraceLine(trace, "draw-attempt ");
+    Require(!attempt.empty(), "the failed draw emitted no draw-attempt record");
+    const auto token = TraceField(attempt, "token");
+    Require(!token.empty() && token != "0", "the draw-attempt record carries no draw token");
+    const auto request = TraceLine(trace, "draw-shader-request-failed");
+    Require(!request.empty(), "the failed draw emitted no request-failure line");
+    Require(request.find("token=" + token) != std::string::npos, "the request failure lost the draw token");
+    Require(request.find("offset=" + TraceField(attempt, "offset")) != std::string::npos, "the request failure lost the packet offset");
+    const auto snapshot = TraceField(request, "snapshot");
+    Require(!snapshot.empty() && snapshot != "0x0", "the request failure carries no snapshot identity");
+    const auto selected = TraceLine(trace, "draw-selected token=" + token);
+    Require(!selected.empty(), "the failed draw emitted no draw-selected record for its token");
+    Require(selected.find("stage=1") != std::string::npos, "the first selected program is not the failing vertex stage");
+    Require(selected.find("snapshot=" + snapshot) != std::string::npos, "the request failure lost the selected snapshot identity");
+    Require(trace.find("draw-recorded token=" + token) == std::string::npos, "a failed draw emitted draw-recorded");
+    char codeAddress[19];
+    std::snprintf(codeAddress, sizeof(codeAddress), "%llx", static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(RequestFailureVertexCode.data())));
+    Require(request.find(std::string("code=") + codeAddress + " codeOffset=0 stage=1 type=2") != std::string::npos, "the draw-shader-request-failed record does not identify the failing vertex shader");
+    Require(trace.find("tokens=[" + token + "]") == std::string::npos, "a failed draw token was attributed to a submitted batch");
+    const auto requestSerial = SubmissionSerialOf(trace, "draw-shader-request-failed");
+    Require(!requestSerial.empty(), "the draw-shader-request-failed record carries no submission serial");
+    const auto errorSerial = SubmissionSerialOf(trace, "draw-error");
+    Require(requestSerial == errorSerial, "the draw-shader-request-failed record (submission " + requestSerial + ") does not correlate with the draw-error record (submission " + errorSerial + ")");
+    Require(trace.find("draw-error submission=" + requestSerial + " offset=" + TraceField(attempt, "offset")) != std::string::npos, "the draw-error record lost the attempted packet offset");
+    Require(trace.find("unsupported dynamic s_setpc_b64") != std::string::npos, "the draw-shader-request-failed record lost the shader-request reason");
+}
+
+void SuccessfulDrawEmitsNoFailureRecord(const char* tracePath) {
+    ColorBuffer color;
+    Registered(VertexHeader, ValidVertexCode.data(), ValidVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), ValidVertexCode.data(), PixelCode.data());
+    AgcDriverWaitIdle_nid_postfix();
+    Require(WaitForTraceRecord(tracePath, "draw submission="), "the capture trace received no draw submission record");
+    const auto trace = ReadTraceFile(tracePath);
+    const auto selected = TraceLine(trace, "draw-selected");
+    const auto attempt = TraceLine(trace, "draw-attempt");
+    Require(!selected.empty(), "the successful draw emitted no draw-selected record");
+    Require(!attempt.empty(), "the successful draw emitted no draw-attempt record");
+    const auto token = TraceField(selected, "token");
+    Require(!token.empty() && token != "0", "the successful selection record carries no draw token");
+    Require(attempt.find("token=" + token) != std::string::npos, "the successful draw-attempt record lost the draw token");
+    Require(WaitForTraceRecord(tracePath, "draw-recorded token=" + token), "the selected draw emitted no draw-recorded record");
+    const auto recorded = TraceLine(ReadTraceFile(tracePath), "draw-recorded token=" + token);
+    const auto batch = TraceField(recorded, "batch");
+    Require(!batch.empty() && batch != "0", "the draw-recorded record carries no actual batch serial");
+    Require(ReadTraceFile(tracePath).find("submit batch=" + batch + " ") != std::string::npos, "the recorded batch was not submitted");
+    const auto submit = TraceLine(ReadTraceFile(tracePath), "submit batch=" + batch + " ");
+    Require(submit == "submit batch=" + batch + " tokens=[" + token + "]", "the submit record lost the draw token set");
+    Require(ReadTraceFile(tracePath).find("submit-confirmed batch=" + batch + " tokens=[" + token + "]") != std::string::npos, "the confirmed submit record lost the draw token set");
+    Require(trace.find("draw-shader-request-failed") == std::string::npos, "a successful draw emitted a draw-shader-request-failed record");
+}
+
+void DisabledCorrelationTraceLeavesDrawBehaviorUnchanged(const char* tracePath) {
+    ColorBuffer color;
+    Registered(VertexHeader, ValidVertexCode.data(), ValidVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), ValidVertexCode.data(), PixelCode.data());
+    AgcDriverWaitIdle_nid_postfix();
+    Require(WaitForTraceRecord(tracePath, "draw submission="), "the disabled-trace draw did not complete");
+    const auto trace = ReadTraceFile(tracePath);
+    Require(trace.find("draw-attempt") == std::string::npos, "the disabled trace emitted draw-attempt");
+    Require(trace.find("draw-materialization-failed") == std::string::npos, "the disabled trace emitted draw-materialization-failed");
+    Require(trace.find("draw-submission-failed") == std::string::npos, "the disabled trace emitted draw-submission-failed");
+    Require(trace.find("draw-selected") == std::string::npos, "the disabled trace emitted draw-selected");
+    Require(trace.find("draw-recorded") == std::string::npos, "the disabled trace emitted draw-recorded");
+}
+
+}
+
+int main(int argc, char** argv) {
+    const std::string mode = argc > 1 ? argv[1] : "request-failure";
+    const bool expectFailure = mode != "successful-draw" && mode != "disabled-correlation";
+    const char* tracePath = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    try {
+        if (!tracePath || tracePath[0] == '\0') throw std::runtime_error("this case requires a non-empty APS5_CAPTURE_TRACE_PATH");
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (mode == "request-failure") FailingShaderDecodeRecordsTheDraw(tracePath);
+        else if (mode == "request-failure-correlation-disabled") FailingShaderDecodeRecordsTheDraw(tracePath, false);
+        else if (mode == "materialization-failure") FailingShaderMaterializationRecordsTheDraw(tracePath);
+        else if (mode == "materialization-failure-correlation-disabled") FailingShaderMaterializationRecordsTheDraw(tracePath, false);
+        else if (mode == "successful-draw") SuccessfulDrawEmitsNoFailureRecord(tracePath);
+        else if (mode == "disabled-correlation") DisabledCorrelationTraceLeavesDrawBehaviorUnchanged(tracePath);
+        else throw std::runtime_error("unknown draw shader failure test mode: " + mode);
+        try {
+            AgcDriverShutdown_nid_postfix();
+            Require(!expectFailure, "the failed draw was not rethrown at driver shutdown");
+        } catch (const std::exception&) {
+            Require(expectFailure, "driver shutdown failed unexpectedly");
+        }
+        std::cout << "draw shader failure tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try {
+            AgcDriverShutdown_nid_postfix();
+        } catch (...) {
+        }
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32AddMulDenormalModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32AddMulDenormalModes.cpp
new file mode 100644
index 0000000000..7b5780067d
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32AddMulDenormalModes.cpp
@@ -0,0 +1,244 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 96;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t Results = 16;
+constexpr std::uint32_t Instructions = 7;
+constexpr std::uint32_t FirstMultiply = 3;
+constexpr std::uint32_t FirstConstantFactor = 5;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 20> Code{
+    0x34020084u, 0x34040086u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x06140b04u, 0x08160b04u, 0x0a180b04u,
+    0x101a0b04u, 0x0e1c0b04u, 0x101e08ffu, 0x3fc00000u, 0xd5070010u, 0x0001ff04u, 0x3fc00000u, 0xe0781000u,
+    0x80010a02u, 0xe07c1010u, 0x80010e02u, 0xbf810000u,
+};
+
+constexpr const char* Names[Instructions] = {"v_add_f32", "v_sub_f32", "v_subrev_f32", "v_mul_f32", "v_mul_legacy_f32", "v_mul_f32 1.5", "v_mul_legacy_f32 1.5"};
+
+template <std::uint32_t Count>
+struct Vector {
+    std::uint32_t operands[2];
+    std::uint32_t outputsFlushed[Count];
+    std::uint32_t inputsFlushed[Count];
+};
+
+constexpr std::array<Vector<FirstMultiply + 2>, 40> ArithmeticVectors{{
+    {{0x00000000u, 0x00000001u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x00000001u, 0x00800002u}, {0x00800003u, 0x80800001u, 0x00800001u, 0x00000000u, 0x00000000u}, {0x00800002u, 0x80800002u, 0x00800002u, 0x00000000u, 0x00000000u}},
+    {{0x00000001u, 0x81000001u}, {0x81000000u, 0x01000002u, 0x81000002u, 0x80000000u, 0x80000000u}, {0x81000001u, 0x01000001u, 0x81000001u, 0x80000000u, 0x00000000u}},
+    {{0x00000002u, 0x3f800000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}},
+    {{0x00000002u, 0xff7fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0xb57fffffu, 0xb57fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x80000000u, 0x00000000u}},
+    {{0x00000003u, 0x80000001u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u}},
+    {{0x00400000u, 0x00000002u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x00400000u, 0x807fffffu}, {0x80000000u, 0x00bfffffu, 0x80bfffffu, 0x80000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u}},
+    {{0x007fffffu, 0x00800000u}, {0x00ffffffu, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00800000u, 0x80800000u, 0x00800000u, 0x00000000u, 0x00000000u}},
+    {{0x007fffffu, 0x80800002u}, {0x80000000u, 0x01000000u, 0x81000000u, 0x80000000u, 0x80000000u}, {0x80800002u, 0x00800002u, 0x80800002u, 0x80000000u, 0x00000000u}},
+    {{0x00800000u, 0x80000001u}, {0x00000000u, 0x00800001u, 0x80800001u, 0x80000000u, 0x80000000u}, {0x00800000u, 0x00800000u, 0x80800000u, 0x80000000u, 0x00000000u}},
+    {{0x00800001u, 0x33800000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x00000000u, 0x00000000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x00000001u, 0x00000001u}},
+    {{0x00800002u, 0x00800000u}, {0x01000001u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}, {0x01000001u, 0x00000002u, 0x80000002u, 0x00000000u, 0x00000000u}},
+    {{0x00ffffffu, 0x00000002u}, {0x01000000u, 0x00fffffdu, 0x80fffffdu, 0x00000000u, 0x00000000u}, {0x00ffffffu, 0x00ffffffu, 0x80ffffffu, 0x00000000u, 0x00000000u}},
+    {{0x00ffffffu, 0x80800002u}, {0x00000000u, 0x01400000u, 0x81400000u, 0x80000000u, 0x80000000u}, {0x007ffffdu, 0x01400000u, 0x81400000u, 0x80000000u, 0x80000000u}},
+    {{0x01000000u, 0x80000003u}, {0x00fffffdu, 0x01000002u, 0x81000002u, 0x80000000u, 0x80000000u}, {0x01000000u, 0x01000000u, 0x81000000u, 0x80000000u, 0x00000000u}},
+    {{0x01000001u, 0x80000001u}, {0x01000000u, 0x01000002u, 0x81000002u, 0x80000000u, 0x80000000u}, {0x01000001u, 0x01000001u, 0x81000001u, 0x80000000u, 0x00000000u}},
+    {{0x3f800000u, 0x807fffffu}, {0x3f800000u, 0x3f800000u, 0xbf800000u, 0x80000000u, 0x80000000u}, {0x3f800000u, 0x3f800000u, 0xbf800000u, 0x80000000u, 0x00000000u}},
+    {{0x34000000u, 0x00800001u}, {0x34000000u, 0x34000000u, 0xb4000000u, 0x00000000u, 0x00000000u}, {0x34000000u, 0x34000000u, 0xb4000000u, 0x00000001u, 0x00000001u}},
+    {{0x7f7fffffu, 0x00000003u}, {0x7f7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x35bfffffu, 0x35bfffffu}, {0x7f7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {{0x80000000u, 0x00000001u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u}},
+    {{0x80000001u, 0x00800002u}, {0x00800001u, 0x80800003u, 0x00800003u, 0x80000000u, 0x80000000u}, {0x00800002u, 0x80800002u, 0x00800002u, 0x80000000u, 0x00000000u}},
+    {{0x80000001u, 0x80ffffffu}, {0x81000000u, 0x00fffffeu, 0x80fffffeu, 0x00000000u, 0x00000000u}, {0x80ffffffu, 0x00ffffffu, 0x80ffffffu, 0x00000000u, 0x00000000u}},
+    {{0x80000002u, 0x3f800000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x80000000u, 0x80000000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x80000000u, 0x00000000u}},
+    {{0x80000002u, 0xff7fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x357fffffu, 0x357fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {{0x80000003u, 0x7f800000u}, {0x7f800000u, 0xff800000u, 0x7f800000u, 0xff800000u, 0xff800000u}, {0x7f800000u, 0xff800000u, 0x7f800000u, 0xffc00000u, 0x00000000u}},
+    {{0x80400000u, 0x00000002u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u}},
+    {{0x80400000u, 0x80000003u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x807fffffu, 0x00800000u}, {0x00000000u, 0x80ffffffu, 0x00ffffffu, 0x80000000u, 0x80000000u}, {0x00800000u, 0x80800000u, 0x00800000u, 0x80000000u, 0x00000000u}},
+    {{0x807fffffu, 0x80800001u}, {0x81000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}, {0x80800001u, 0x00800001u, 0x80800001u, 0x00000000u, 0x00000000u}},
+    {{0x80800000u, 0x80000001u}, {0x80800001u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80800000u, 0x80800000u, 0x00800000u, 0x00000000u, 0x00000000u}},
+    {{0x80800001u, 0x33800000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x80000000u, 0x80000000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x80000001u, 0x80000001u}},
+    {{0x80800002u, 0x00800000u}, {0x80000000u, 0x81000001u, 0x01000001u, 0x80000000u, 0x80000000u}, {0x80000002u, 0x81000001u, 0x01000001u, 0x80000000u, 0x80000000u}},
+    {{0x80ffffffu, 0x00000002u}, {0x80fffffdu, 0x81000000u, 0x01000000u, 0x80000000u, 0x80000000u}, {0x80ffffffu, 0x80ffffffu, 0x00ffffffu, 0x80000000u, 0x00000000u}},
+    {{0x80ffffffu, 0x80800002u}, {0x81400000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x81400000u, 0x807ffffdu, 0x007ffffdu, 0x00000000u, 0x00000000u}},
+    {{0x81000000u, 0x80000003u}, {0x81000002u, 0x80fffffdu, 0x00fffffdu, 0x00000000u, 0x00000000u}, {0x81000000u, 0x81000000u, 0x01000000u, 0x00000000u, 0x00000000u}},
+    {{0x81000001u, 0x80000001u}, {0x81000002u, 0x81000000u, 0x01000000u, 0x00000000u, 0x00000000u}, {0x81000001u, 0x81000001u, 0x01000001u, 0x00000000u, 0x00000000u}},
+    {{0xbf800000u, 0x807fffffu}, {0xbf800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}, {0xbf800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}},
+    {{0xb4000000u, 0x00000003u}, {0xb4000000u, 0xb4000000u, 0x34000000u, 0x80000000u, 0x80000000u}, {0xb4000000u, 0xb4000000u, 0x34000000u, 0x80000000u, 0x00000000u}},
+    {{0xff7fffffu, 0x00000003u}, {0xff7fffffu, 0xff7fffffu, 0x7f7fffffu, 0xb5bfffffu, 0xb5bfffffu}, {0xff7fffffu, 0xff7fffffu, 0x7f7fffffu, 0x80000000u, 0x00000000u}},
+}};
+
+constexpr std::array<Vector<2>, 24> TinyProductVectors{{
+    {{0x3f7ffffeu, 0x00800001u}, {0x00800000u, 0x00800000u}, {0x00800000u, 0x00800000u}},
+    {{0x3f7ffffeu, 0x80800001u}, {0x80800000u, 0x80800000u}, {0x80800000u, 0x80800000u}},
+    {{0xbf7ffffeu, 0x00800001u}, {0x80800000u, 0x80800000u}, {0x80800000u, 0x80800000u}},
+    {{0xbf7ffffeu, 0x80800001u}, {0x00800000u, 0x00800000u}, {0x00800000u, 0x00800000u}},
+    {{0x3f800001u, 0x007fffffu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f800001u, 0x807fffffu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800001u, 0x007fffffu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800001u, 0x807fffffu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f800002u, 0x007ffffeu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f800002u, 0x807ffffeu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800002u, 0x007ffffeu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800002u, 0x807ffffeu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f7ffffeu, 0x00800000u}, {0x00000000u, 0x00000000u}, {0x007fffffu, 0x007fffffu}},
+    {{0xbf7fffffu, 0x00400000u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x3f800001u, 0x80000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0xbfffffffu, 0x00400000u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x3f400000u, 0x00800000u}, {0x00000000u, 0x00000000u}, {0x00600000u, 0x00600000u}},
+    {{0x40000000u, 0x807fffffu}, {0x80fffffeu, 0x80fffffeu}, {0x80000000u, 0x00000000u}},
+    {{0xcb000000u, 0x007ffffeu}, {0x8bfffffcu, 0x8bfffffcu}, {0x80000000u, 0x00000000u}},
+    {{0xcb7fffffu, 0x807ffffeu}, {0x0c7ffffbu, 0x0c7ffffbu}, {0x00000000u, 0x00000000u}},
+    {{0x5f800000u, 0x00400000u}, {0x20000000u, 0x20000000u}, {0x00000000u, 0x00000000u}},
+    {{0x7f000000u, 0x80400000u}, {0xbf800000u, 0xbf800000u}, {0x80000000u, 0x00000000u}},
+    {{0xb3800000u, 0x00ffffffu}, {0x80000000u, 0x80000000u}, {0x80000001u, 0x80000001u}},
+    {{0xb4000000u, 0x80800000u}, {0x00000000u, 0x00000000u}, {0x00000001u, 0x00000001u}},
+}};
+
+constexpr std::array<Vector<2>, 32> ConstantFactorVectors{{
+    {{0x00000001u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00000002u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00000003u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00155555u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x003fffffu, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00400000u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00400001u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00555555u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x007ffffeu, 0x00000001u}, {0x00bffffdu, 0x00bffffdu}, {0x00000000u, 0x00000000u}},
+    {{0x007fffffu, 0x00000001u}, {0x00bffffeu, 0x00bffffeu}, {0x00000000u, 0x00000000u}},
+    {{0x00800000u, 0x00000001u}, {0x00c00000u, 0x00c00000u}, {0x00c00000u, 0x00c00000u}},
+    {{0x00800001u, 0x00000001u}, {0x00c00002u, 0x00c00002u}, {0x00c00002u, 0x00c00002u}},
+    {{0x00aaaaabu, 0x00000001u}, {0x01000000u, 0x01000000u}, {0x01000000u, 0x01000000u}},
+    {{0x00ffffffu, 0x00000001u}, {0x013fffffu, 0x013fffffu}, {0x013fffffu, 0x013fffffu}},
+    {{0x01000000u, 0x00000001u}, {0x01400000u, 0x01400000u}, {0x01400000u, 0x01400000u}},
+    {{0x3f800000u, 0x00000001u}, {0x3fc00000u, 0x3fc00000u}, {0x3fc00000u, 0x3fc00000u}},
+    {{0x00000000u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x80000001u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80000002u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80000003u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80155555u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x803fffffu, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80400000u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80400001u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80555555u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x807ffffeu, 0x00000001u}, {0x80bffffdu, 0x80bffffdu}, {0x80000000u, 0x00000000u}},
+    {{0x807fffffu, 0x00000001u}, {0x80bffffeu, 0x80bffffeu}, {0x80000000u, 0x00000000u}},
+    {{0x80800000u, 0x00000001u}, {0x80c00000u, 0x80c00000u}, {0x80c00000u, 0x80c00000u}},
+    {{0x80800001u, 0x00000001u}, {0x80c00002u, 0x80c00002u}, {0x80c00002u, 0x80c00002u}},
+    {{0x80aaaaabu, 0x00000001u}, {0x81000000u, 0x81000000u}, {0x81000000u, 0x81000000u}},
+    {{0x80ffffffu, 0x00000001u}, {0x813fffffu, 0x813fffffu}, {0x813fffffu, 0x813fffffu}},
+    {{0x81000000u, 0x00000001u}, {0x81400000u, 0x81400000u}, {0x81400000u, 0x81400000u}},
+}};
+
+constexpr std::uint32_t FirstTinyProductLane = static_cast<std::uint32_t>(ArithmeticVectors.size());
+constexpr std::uint32_t FirstConstantFactorLane = FirstTinyProductLane + static_cast<std::uint32_t>(TinyProductVectors.size());
+static_assert(FirstConstantFactorLane + ConstantFactorVectors.size() <= Threads);
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+template <std::uint32_t Count, std::size_t Size>
+void Fill(const std::array<Vector<Count>, Size>& vectors, std::uint32_t firstLane) {
+    for (std::uint32_t row = 0; row < Size; ++row) {
+        Input[(firstLane + row) * Inputs] = vectors[row].operands[0];
+        Input[(firstLane + row) * Inputs + 1u] = vectors[row].operands[1];
+    }
+}
+
+bool Run(AgcDriver::VulkanDevice& device, ShaderRecompiler::ShaderFloatMode floatMode) {
+    Input.fill(0u);
+    Fill(ArithmeticVectors, 0u);
+    Fill(TinyProductVectors, FirstTinyProductLane);
+    Fill(ConstantFactorVectors, FirstConstantFactorLane);
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::span<const std::uint32_t> code(Code);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    std::optional<decltype(ShaderRecompiler::Recompile(request))> result;
+    try {
+        result.emplace(ShaderRecompiler::Recompile(request));
+    } catch (const std::exception& error) {
+        const std::string message = error.what();
+        const bool keepsDenormals = request.target.float32DenormPreserve && !request.target.float32FlushToZero;
+        Require(!keepsDenormals && message.find("needs DenormPreserve 32") != std::string::npos, "f32 add and multiply FLOAT_MODE " + Hex(floatMode.floatMode) + ": " + message);
+        return false;
+    }
+    device.Dispatch(*result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    return true;
+}
+
+template <std::uint32_t Count, std::size_t Size>
+void Check(const std::array<Vector<Count>, Size>& vectors, std::uint32_t firstLane, std::uint32_t firstInstruction, std::uint32_t denormals, bool ieee) {
+    for (std::uint32_t row = 0; row < Size; ++row) {
+        const auto& vector = vectors[row];
+        for (std::uint32_t index = 0; index < Count; ++index) {
+            const std::uint32_t instruction = firstInstruction + index;
+            const auto actual = Output[(firstLane + row) * Results + instruction];
+            const auto expected = denormals == 1u ? vector.outputsFlushed[index] : vector.inputsFlushed[index];
+            Require(actual == expected, std::string(Names[instruction]) + " f32 denormal mode " + std::to_string(denormals) + (ieee ? ", IEEE=1" : ", IEEE=0") + " of " +
+                                            Hex(vector.operands[0]) + ", " + Hex(vector.operands[1]) + " is " + Hex(actual) + ", expected " + Hex(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        std::uint32_t checked = 0u;
+        for (const std::uint32_t denormals : {1u, 2u}) {
+            for (const bool ieee : {false, true}) {
+                if (!Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u | denormals << 4u, true, ieee, false})) continue;
+                ++checked;
+                Check(ArithmeticVectors, 0u, 0u, denormals, ieee);
+                Check(TinyProductVectors, FirstTinyProductLane, FirstMultiply, denormals, ieee);
+                Check(ConstantFactorVectors, FirstConstantFactorLane, FirstConstantFactor, denormals, ieee);
+            }
+        }
+        std::printf("f32 add and multiply denormal mode 1 and 2 tests passed (%u of 4 modes run; the others need DenormPreserve 32)\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32ConvertDenormalModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32ConvertDenormalModes.cpp
new file mode 100644
index 0000000000..9dcc8b2bf9
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32ConvertDenormalModes.cpp
@@ -0,0 +1,212 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t Results = 16;
+constexpr std::uint32_t Columns = 12;
+constexpr std::uint32_t Float64Low = 5;
+constexpr std::uint32_t Float64High = 6;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 25> Code{
+    0x34020084u, 0x34040086u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x7e141104u, 0x7e160f04u, 0x7e181904u,
+    0x7e1a1b04u, 0x7e1c7f04u, 0xd7680011u, 0x00020b04u, 0xd7690012u, 0x00020b04u, 0xd55e0013u, 0x02010104u,
+    0x5e280b04u, 0x7e2a1504u, 0xe0781000u, 0x80010a02u, 0xe0781010u, 0x80010e02u, 0xe0781020u, 0x80011202u,
+    0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 13> Float64Code{
+    0x34020084u, 0x34040086u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x7e1e2104u, 0xe0781000u, 0x80010a02u,
+    0xe0781010u, 0x80010e02u, 0xe0781020u, 0x80011202u, 0xbf810000u,
+};
+
+constexpr const char* Names[Columns] = {
+    "v_cvt_i32_f32 v10, v4",
+    "v_cvt_u32_f32 v11, v4",
+    "v_cvt_rpi_i32_f32 v12, v4",
+    "v_cvt_flr_i32_f32 v13, v4",
+    "v_frexp_exp_i32_f32 v14, v4",
+    "v_cvt_f64_f32 v[15:16], v4 (low)",
+    "v_cvt_f64_f32 v[15:16], v4 (high)",
+    "v_cvt_pknorm_i16_f32 v17, v4, v5",
+    "v_cvt_pknorm_u16_f32 v18, v4, v5",
+    "v_cvt_pk_u8_f32 v19, v4, 0, 0",
+    "v_cvt_pkrtz_f16_f32 v20, v4, v5",
+    "v_cvt_f16_f32 v21, v4",
+};
+
+struct ConvertVector {
+    std::uint32_t operands[2];
+    std::uint32_t denormalsFlushed[Columns];
+    std::uint32_t denormalsKept[Columns];
+};
+
+constexpr std::array<ConvertVector, 32> Vectors{{
+    {{0x00000001u, 0x00400000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff6cu, 0x00000000u, 0x36a00000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x007fffffu, 0x80000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff82u, 0xc0000000u, 0x380fffffu, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u}},
+    {{0x00400000u, 0x3f800000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x7fff0000u, 0xffff0000u, 0x00000000u, 0x3c000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff82u, 0x00000000u, 0x38000000u, 0x7fff0000u, 0xffff0000u, 0x00000000u, 0x3c000000u, 0x00000000u}},
+    {{0x80000001u, 0x007fffffu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0xffffff6cu, 0x00000000u, 0xb6a00000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}},
+    {{0x807fffffu, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0xffffff82u, 0xc0000000u, 0xb80fffffu, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}},
+    {{0x80400000u, 0xbf000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0xc0000000u, 0x00000000u, 0x00000000u, 0xb8008000u, 0x00008000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0xffffff82u, 0x00000000u, 0xb8000000u, 0xc0000000u, 0x00000000u, 0x00000000u, 0xb8008000u, 0x00008000u}},
+    {{0x00800000u, 0x80400000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff83u, 0x00000000u, 0x38100000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff83u, 0x00000000u, 0x38100000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u}},
+    {{0x80800000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0xffffff83u, 0x00000000u, 0xb8100000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0xffffff83u, 0x00000000u, 0xb8100000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}},
+    {{0x3f000000u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u, 0x00000000u, 0x00000000u, 0x3fe00000u, 0x00004000u, 0x00008000u, 0x00000000u, 0x00003800u, 0x00003800u}, {0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u, 0x00000000u, 0x00000000u, 0x3fe00000u, 0x00004000u, 0x00008000u, 0x00000000u, 0x00003800u, 0x00003800u}},
+    {{0xbfc00000u, 0x807fffffu}, {0xffffffffu, 0x00000000u, 0xffffffffu, 0xfffffffeu, 0x00000001u, 0x00000000u, 0xbff80000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x8000be00u, 0x0000be00u}, {0xffffffffu, 0x00000000u, 0xffffffffu, 0xfffffffeu, 0x00000001u, 0x00000000u, 0xbff80000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x8000be00u, 0x0000be00u}},
+    {{0x3f800000u, 0x80000002u}, {0x00000001u, 0x00000001u, 0x00000001u, 0x00000001u, 0x00000001u, 0x00000000u, 0x3ff00000u, 0x00007fffu, 0x0000ffffu, 0x00000001u, 0x80003c00u, 0x00003c00u}, {0x00000001u, 0x00000001u, 0x00000001u, 0x00000001u, 0x00000001u, 0x00000000u, 0x3ff00000u, 0x00007fffu, 0x0000ffffu, 0x00000001u, 0x80003c00u, 0x00003c00u}},
+    {{0x00000000u, 0x00000002u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x80000000u, 0x3f800000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x7fff0000u, 0xffff0000u, 0x00000000u, 0x3c008000u, 0x00008000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x7fff0000u, 0xffff0000u, 0x00000000u, 0x3c008000u, 0x00008000u}},
+    {{0x33800000u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffffe9u, 0x00000000u, 0x3e700000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000001u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffffe9u, 0x00000000u, 0x3e700000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000001u, 0x00000001u}},
+    {{0x477fe000u, 0x80000001u}, {0x0000ffe0u, 0x0000ffe0u, 0x0000ffe0u, 0x0000ffe0u, 0x00000010u, 0x00000000u, 0x40effc00u, 0x00007fffu, 0x0000ffffu, 0x000000ffu, 0x80007bffu, 0x00007bffu}, {0x0000ffe0u, 0x0000ffe0u, 0x0000ffe0u, 0x0000ffe0u, 0x00000010u, 0x00000000u, 0x40effc00u, 0x00007fffu, 0x0000ffffu, 0x000000ffu, 0x80007bffu, 0x00007bffu}},
+    {{0x501502f9u, 0x00800000u}, {0x7fffffffu, 0xffffffffu, 0x7fffffffu, 0x7fffffffu, 0x00000022u, 0x20000000u, 0x4202a05fu, 0x00007fffu, 0x0000ffffu, 0x000000ffu, 0x00007bffu, 0x00007c00u}, {0x7fffffffu, 0xffffffffu, 0x7fffffffu, 0x7fffffffu, 0x00000022u, 0x20000000u, 0x4202a05fu, 0x00007fffu, 0x0000ffffu, 0x000000ffu, 0x00007bffu, 0x00007c00u}},
+    {{0xd01502f9u, 0x007fffffu}, {0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000022u, 0x20000000u, 0xc202a05fu, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000fbffu, 0x0000fc00u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000022u, 0x20000000u, 0xc202a05fu, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000fbffu, 0x0000fc00u}},
+    {{0x7f800000u, 0xbfc00000u}, {0x7fffffffu, 0xffffffffu, 0x7fffffffu, 0x7fffffffu, 0x00000000u, 0x00000000u, 0x7ff00000u, 0x80017fffu, 0x0000ffffu, 0x000000ffu, 0xbe007c00u, 0x00007c00u}, {0x7fffffffu, 0xffffffffu, 0x7fffffffu, 0x7fffffffu, 0x00000000u, 0x00000000u, 0x7ff00000u, 0x80017fffu, 0x0000ffffu, 0x000000ffu, 0xbe007c00u, 0x00007c00u}},
+    {{0xff800000u, 0x00000001u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0xfff00000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000fc00u, 0x0000fc00u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0xfff00000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000fc00u, 0x0000fc00u}},
+    {{0x7fc00000u, 0x80400000u}, {0x00000000u, 0x00000000u, 0x7fffffffu, 0x7fffffffu, 0x00000000u, 0x00000000u, 0x7ff80000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80007e00u, 0x00007e00u}, {0x00000000u, 0x00000000u, 0x7fffffffu, 0x7fffffffu, 0x00000000u, 0x00000000u, 0x7ff80000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80007e00u, 0x00007e00u}},
+    {{0xffc00000u, 0x00400000u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0xfff80000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x0000fe00u, 0x0000fe00u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0xfff80000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x0000fe00u, 0x0000fe00u}},
+    {{0x4f800000u, 0x80000000u}, {0x7fffffffu, 0xffffffffu, 0x7fffffffu, 0x7fffffffu, 0x00000021u, 0x00000000u, 0x41f00000u, 0x00007fffu, 0x0000ffffu, 0x000000ffu, 0x80007bffu, 0x00007c00u}, {0x7fffffffu, 0xffffffffu, 0x7fffffffu, 0x7fffffffu, 0x00000021u, 0x00000000u, 0x41f00000u, 0x00007fffu, 0x0000ffffu, 0x000000ffu, 0x80007bffu, 0x00007c00u}},
+    {{0xcf000000u, 0x007fffffu}, {0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000020u, 0x00000000u, 0xc1e00000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000fbffu, 0x0000fc00u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000020u, 0x00000000u, 0xc1e00000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000fbffu, 0x0000fc00u}},
+    {{0x3f7fffffu, 0x80000001u}, {0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u, 0x00000000u, 0xe0000000u, 0x3fefffffu, 0x00007fffu, 0x0000ffffu, 0x00000001u, 0x80003bffu, 0x00003c00u}, {0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u, 0x00000000u, 0xe0000000u, 0x3fefffffu, 0x00007fffu, 0x0000ffffu, 0x00000001u, 0x80003bffu, 0x00003c00u}},
+    {{0x00000002u, 0x3f800000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x7fff0000u, 0xffff0000u, 0x00000000u, 0x3c000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff6du, 0x00000000u, 0x36b00000u, 0x7fff0000u, 0xffff0000u, 0x00000000u, 0x3c000000u, 0x00000000u}},
+    {{0x80000002u, 0x00000003u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0xffffff6du, 0x00000000u, 0xb6b00000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}},
+    {{0x00000001u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff6cu, 0x00000000u, 0x36a00000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x007fffffu, 0x807fffffu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffff82u, 0xc0000000u, 0x380fffffu, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u}},
+    {{0x3f000000u, 0x80000001u}, {0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u, 0x00000000u, 0x00000000u, 0x3fe00000u, 0x00004000u, 0x00008000u, 0x00000000u, 0x80003800u, 0x00003800u}, {0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u, 0x00000000u, 0x00000000u, 0x3fe00000u, 0x00004000u, 0x00008000u, 0x00000000u, 0x80003800u, 0x00003800u}},
+    {{0x80000001u, 0x00400000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0xffffff6cu, 0x00000000u, 0xb6a00000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00008000u}},
+    {{0x3e800000u, 0x80800000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0x00000000u, 0x3fd00000u, 0x00002000u, 0x00004000u, 0x00000000u, 0x80003400u, 0x00003400u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0xffffffffu, 0x00000000u, 0x3fd00000u, 0x00002000u, 0x00004000u, 0x00000000u, 0x80003400u, 0x00003400u}},
+    {{0xbf800000u, 0x00000001u}, {0xffffffffu, 0x00000000u, 0xffffffffu, 0xffffffffu, 0x00000001u, 0x00000000u, 0xbff00000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000bc00u, 0x0000bc00u}, {0xffffffffu, 0x00000000u, 0xffffffffu, 0xffffffffu, 0x00000001u, 0x00000000u, 0xbff00000u, 0x00008001u, 0x00000000u, 0x00000000u, 0x0000bc00u, 0x0000bc00u}},
+}};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+bool InPass(std::uint32_t column, bool float64) {
+    return (column == Float64Low || column == Float64High) == float64;
+}
+
+std::vector<std::uint32_t> Run(AgcDriver::VulkanDevice& device, bool float64, ShaderRecompiler::ShaderFloatMode floatMode) {
+    Input.fill(0u);
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        Input[lane * Inputs] = Vectors[lane].operands[0];
+        Input[lane * Inputs + 1u] = Vectors[lane].operands[1];
+    }
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const auto code = float64 ? std::span<const std::uint32_t>(Float64Code) : std::span<const std::uint32_t>(Code);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    return {Output.begin(), Output.end()};
+}
+
+std::string Where(std::uint32_t lane, std::uint32_t column, std::uint32_t denormals, bool ieee) {
+    return std::string(Names[column]) + " of " + Hex(Vectors[lane].operands[0]) + ", " + Hex(Vectors[lane].operands[1]) + " in f32 denormal mode " +
+           std::to_string(denormals) + (ieee ? ", IEEE=1" : ", IEEE=0");
+}
+
+void CheckFlushed(const std::vector<std::uint32_t>& output, bool float64, std::uint32_t denormals, bool ieee) {
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        for (std::uint32_t column = 0; column < Columns; ++column) {
+            if (!InPass(column, float64)) continue;
+            const auto value = output[lane * Results + column];
+            const auto expected = Vectors[lane].denormalsFlushed[column];
+            Require(value == expected, Where(lane, column, denormals, ieee) + " is " + Hex(value) + ", expected " + Hex(expected));
+        }
+    }
+}
+
+void CheckKept(const std::vector<std::uint32_t>& output, bool float64, bool ieee) {
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        for (std::uint32_t column = 0; column < Columns; ++column) {
+            if (!InPass(column, float64)) continue;
+            const auto value = output[lane * Results + column];
+            const auto& vector = Vectors[lane];
+            Require(value == vector.denormalsKept[column] || value == vector.denormalsFlushed[column],
+                    Where(lane, column, 3u, ieee) + " is " + Hex(value) + ", expected " + Hex(vector.denormalsKept[column]) + " or, on a driver that flushes f32 denormals, " +
+                        Hex(vector.denormalsFlushed[column]));
+        }
+    }
+}
+
+void CheckSame(const std::vector<std::uint32_t>& output, const std::vector<std::uint32_t>& reference, bool float64, std::uint32_t denormals, std::uint32_t like, bool ieee) {
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        for (std::uint32_t column = 0; column < Columns; ++column) {
+            if (!InPass(column, float64)) continue;
+            const auto value = output[lane * Results + column];
+            const auto expected = reference[lane * Results + column];
+            Require(value == expected, Where(lane, column, denormals, ieee) + " is " + Hex(value) + ", but mode " + std::to_string(like) + " gave " + Hex(expected));
+        }
+    }
+}
+
+ShaderRecompiler::ShaderFloatMode Mode(std::uint32_t denormals, bool ieee) {
+    return ShaderRecompiler::ShaderFloatMode{0xc0u | denormals << 4u, true, ieee, false};
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const bool hasFloat64 = TargetHasCapability(device->Target(), spv::CapabilityFloat64);
+        if (!hasFloat64) std::puts("v_cvt_f64_f32 skipped, the device has no shaderFloat64");
+        for (const bool float64 : {false, true}) {
+            if (float64 && !hasFloat64) continue;
+            for (const bool ieee : {false, true}) {
+                const auto flushed = Run(*device, float64, Mode(0u, ieee));
+                CheckFlushed(flushed, float64, 0u, ieee);
+                const auto inputsFlushed = Run(*device, float64, Mode(2u, ieee));
+                CheckFlushed(inputsFlushed, float64, 2u, ieee);
+                CheckSame(inputsFlushed, flushed, float64, 2u, 0u, ieee);
+                const auto kept = Run(*device, float64, Mode(3u, ieee));
+                CheckKept(kept, float64, ieee);
+                const auto outputsFlushed = Run(*device, float64, Mode(1u, ieee));
+                CheckSame(outputsFlushed, kept, float64, 1u, 3u, ieee);
+            }
+        }
+        std::puts("f32 conversion denormal mode tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32MinMaxDenormalModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32MinMaxDenormalModes.cpp
new file mode 100644
index 0000000000..a9d0238d0b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32MinMaxDenormalModes.cpp
@@ -0,0 +1,181 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t Results = 16;
+constexpr std::uint32_t Instructions = 5;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 18> Code{
+    0x34020084u, 0x34040086u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x1e140b04u, 0x20160b04u, 0xd551000cu,
+    0x041a0b04u, 0xd554000du, 0x041a0b04u, 0xd557000eu, 0x041a0b04u, 0xe0781000u, 0x80010a02u, 0xe0701010u,
+    0x80010e02u, 0xbf810000u,
+};
+
+constexpr const char* Names[Instructions] = {"v_min_f32", "v_max_f32", "v_min3_f32", "v_max3_f32", "v_med3_f32"};
+
+struct MinMaxVector {
+    std::uint32_t operands[3];
+    std::uint32_t inputsKept[Instructions];
+    std::uint32_t inputsFlushed[Instructions];
+};
+
+constexpr std::array<MinMaxVector, 56> Vectors{{
+    {0x00000000u, 0x00000000u, 0x00000001u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {0x00000000u, 0x80000001u, 0x80000000u, {0x80000001u, 0x00000000u, 0x80000001u, 0x00000000u, 0x80000000u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x00000000u, 0x007fffffu, 0x7f800000u, {0x00000000u, 0x007fffffu, 0x00000000u, 0x7f800000u, 0x007fffffu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x7f800000u, 0x00000000u}},
+    {0x00000000u, 0x80800000u, 0x807fffffu, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x807fffffu}, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x80000000u}},
+    {0x80000000u, 0x80000000u, 0x00000001u, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000001u, 0x80000000u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x80000000u, 0x80000001u, 0x807fffffu, {0x80000001u, 0x80000000u, 0x807fffffu, 0x80000000u, 0x80000001u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u}},
+    {0x80000000u, 0x807fffffu, 0x00000001u, {0x807fffffu, 0x80000000u, 0x807fffffu, 0x00000001u, 0x80000000u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x80000000u, 0x3f800000u, 0x807fffffu, {0x80000000u, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x80000000u}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x00000001u, 0x00000000u, 0x3f800000u, {0x00000000u, 0x00000001u, 0x00000000u, 0x3f800000u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x3f800000u, 0x00000000u}},
+    {0x00000001u, 0x00000001u, 0x807fffffu, {0x00000001u, 0x00000001u, 0x807fffffu, 0x00000001u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}},
+    {0x00000001u, 0x007fffffu, 0x00000001u, {0x00000001u, 0x007fffffu, 0x00000001u, 0x007fffffu, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {0x00000001u, 0x807fffffu, 0xff800000u, {0x807fffffu, 0x00000001u, 0xff800000u, 0x00000001u, 0x807fffffu}, {0x80000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000000u}},
+    {0x00000001u, 0x80800000u, 0x3f800000u, {0x80800000u, 0x00000001u, 0x80800000u, 0x3f800000u, 0x00000001u}, {0x80800000u, 0x00000000u, 0x80800000u, 0x3f800000u, 0x00000000u}},
+    {0x00000001u, 0xbf800000u, 0x807fffffu, {0xbf800000u, 0x00000001u, 0xbf800000u, 0x00000001u, 0x807fffffu}, {0xbf800000u, 0x00000000u, 0xbf800000u, 0x00000000u, 0x80000000u}},
+    {0x00000001u, 0xff800000u, 0x00000001u, {0xff800000u, 0x00000001u, 0xff800000u, 0x00000001u, 0x00000001u}, {0xff800000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x00000000u}},
+    {0x80000001u, 0x00000000u, 0xff800000u, {0x80000001u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000001u}, {0x80000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000000u}},
+    {0x80000001u, 0x00000001u, 0x3f800000u, {0x80000001u, 0x00000001u, 0x80000001u, 0x3f800000u, 0x00000001u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x3f800000u, 0x00000000u}},
+    {0x80000001u, 0x007fffffu, 0x807fffffu, {0x80000001u, 0x007fffffu, 0x807fffffu, 0x007fffffu, 0x80000001u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x80000001u, 0x00800000u, 0x00000001u, {0x80000001u, 0x00800000u, 0x80000001u, 0x00800000u, 0x00000001u}, {0x80000000u, 0x00800000u, 0x80000000u, 0x00800000u, 0x00000000u}},
+    {0x80000001u, 0x80800000u, 0xff800000u, {0x80800000u, 0x80000001u, 0xff800000u, 0x80000001u, 0x80800000u}, {0x80800000u, 0x80000000u, 0xff800000u, 0x80000000u, 0x80800000u}},
+    {0x80000001u, 0xbf800000u, 0x3f800000u, {0xbf800000u, 0x80000001u, 0xbf800000u, 0x3f800000u, 0x80000001u}, {0xbf800000u, 0x80000000u, 0xbf800000u, 0x3f800000u, 0x80000000u}},
+    {0x80000001u, 0xff800000u, 0x807fffffu, {0xff800000u, 0x80000001u, 0xff800000u, 0x80000001u, 0x807fffffu}, {0xff800000u, 0x80000000u, 0xff800000u, 0x80000000u, 0x80000000u}},
+    {0x007fffffu, 0x80000000u, 0x00000001u, {0x80000000u, 0x007fffffu, 0x80000000u, 0x007fffffu, 0x00000001u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}},
+    {0x007fffffu, 0x00000001u, 0xff800000u, {0x00000001u, 0x007fffffu, 0xff800000u, 0x007fffffu, 0x00000001u}, {0x00000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x00000000u}},
+    {0x007fffffu, 0x007fffffu, 0x3f800000u, {0x007fffffu, 0x007fffffu, 0x007fffffu, 0x3f800000u, 0x007fffffu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x3f800000u, 0x00000000u}},
+    {0x007fffffu, 0x00800000u, 0x807fffffu, {0x007fffffu, 0x00800000u, 0x807fffffu, 0x00800000u, 0x007fffffu}, {0x00000000u, 0x00800000u, 0x80000000u, 0x00800000u, 0x00000000u}},
+    {0x007fffffu, 0x3f800000u, 0x00000001u, {0x007fffffu, 0x3f800000u, 0x00000001u, 0x3f800000u, 0x007fffffu}, {0x00000000u, 0x3f800000u, 0x00000000u, 0x3f800000u, 0x00000000u}},
+    {0x007fffffu, 0xbf800000u, 0xff800000u, {0xbf800000u, 0x007fffffu, 0xff800000u, 0x007fffffu, 0xbf800000u}, {0xbf800000u, 0x00000000u, 0xff800000u, 0x00000000u, 0xbf800000u}},
+    {0x007fffffu, 0xff800000u, 0x3f800000u, {0xff800000u, 0x007fffffu, 0xff800000u, 0x3f800000u, 0x007fffffu}, {0xff800000u, 0x00000000u, 0xff800000u, 0x3f800000u, 0x00000000u}},
+    {0x807fffffu, 0x80000000u, 0x807fffffu, {0x807fffffu, 0x80000000u, 0x807fffffu, 0x80000000u, 0x807fffffu}, {0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u}},
+    {0x807fffffu, 0x80000001u, 0x00000001u, {0x807fffffu, 0x80000001u, 0x807fffffu, 0x00000001u, 0x80000001u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x807fffffu, 0x007fffffu, 0xff800000u, {0x807fffffu, 0x007fffffu, 0xff800000u, 0x007fffffu, 0x807fffffu}, {0x80000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000000u}},
+    {0x807fffffu, 0x00800000u, 0x3f800000u, {0x807fffffu, 0x00800000u, 0x807fffffu, 0x3f800000u, 0x00800000u}, {0x80000000u, 0x00800000u, 0x80000000u, 0x3f800000u, 0x00800000u}},
+    {0x807fffffu, 0x3f800000u, 0x807fffffu, {0x807fffffu, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x807fffffu}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x807fffffu, 0x7f800000u, 0x00000001u, {0x807fffffu, 0x7f800000u, 0x807fffffu, 0x7f800000u, 0x00000001u}, {0x80000000u, 0x7f800000u, 0x80000000u, 0x7f800000u, 0x00000000u}},
+    {0x807fffffu, 0xff800000u, 0xff800000u, {0xff800000u, 0x807fffffu, 0xff800000u, 0x807fffffu, 0xff800000u}, {0xff800000u, 0x80000000u, 0xff800000u, 0x80000000u, 0xff800000u}},
+    {0x00800000u, 0x80000001u, 0x00000000u, {0x80000001u, 0x00800000u, 0x80000001u, 0x00800000u, 0x00000000u}, {0x80000000u, 0x00800000u, 0x80000000u, 0x00800000u, 0x00000000u}},
+    {0x00800000u, 0x007fffffu, 0xbf800000u, {0x007fffffu, 0x00800000u, 0xbf800000u, 0x00800000u, 0x007fffffu}, {0x00000000u, 0x00800000u, 0xbf800000u, 0x00800000u, 0x00000000u}},
+    {0x00800000u, 0x80800000u, 0x007fffffu, {0x80800000u, 0x00800000u, 0x80800000u, 0x00800000u, 0x007fffffu}, {0x80800000u, 0x00800000u, 0x80800000u, 0x00800000u, 0x00000000u}},
+    {0x80800000u, 0x00000000u, 0x807fffffu, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x807fffffu}, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x80000000u}},
+    {0x80800000u, 0x80000001u, 0x007fffffu, {0x80800000u, 0x80000001u, 0x80800000u, 0x007fffffu, 0x80000001u}, {0x80800000u, 0x80000000u, 0x80800000u, 0x00000000u, 0x80000000u}},
+    {0x80800000u, 0x807fffffu, 0x80000000u, {0x80800000u, 0x807fffffu, 0x80800000u, 0x80000000u, 0x807fffffu}, {0x80800000u, 0x80000000u, 0x80800000u, 0x80000000u, 0x80000000u}},
+    {0x80800000u, 0x3f800000u, 0x007fffffu, {0x80800000u, 0x3f800000u, 0x80800000u, 0x3f800000u, 0x007fffffu}, {0x80800000u, 0x3f800000u, 0x80800000u, 0x3f800000u, 0x00000000u}},
+    {0x3f800000u, 0x80000000u, 0x807fffffu, {0x80000000u, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x80000000u}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x3f800000u, 0x80000001u, 0x3f800000u, {0x80000001u, 0x3f800000u, 0x80000001u, 0x3f800000u, 0x3f800000u}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x3f800000u}},
+    {0x3f800000u, 0x807fffffu, 0x807fffffu, {0x807fffffu, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x807fffffu}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x3f800000u, 0xbf800000u, 0x007fffffu, {0xbf800000u, 0x3f800000u, 0xbf800000u, 0x3f800000u, 0x007fffffu}, {0xbf800000u, 0x3f800000u, 0xbf800000u, 0x3f800000u, 0x00000000u}},
+    {0xbf800000u, 0x00000001u, 0x80000001u, {0xbf800000u, 0x00000001u, 0xbf800000u, 0x00000001u, 0x80000001u}, {0xbf800000u, 0x00000000u, 0xbf800000u, 0x00000000u, 0x80000000u}},
+    {0xbf800000u, 0x007fffffu, 0x00000000u, {0xbf800000u, 0x007fffffu, 0xbf800000u, 0x007fffffu, 0x00000000u}, {0xbf800000u, 0x00000000u, 0xbf800000u, 0x00000000u, 0x00000000u}},
+    {0xbf800000u, 0x807fffffu, 0xbf800000u, {0xbf800000u, 0x807fffffu, 0xbf800000u, 0x807fffffu, 0xbf800000u}, {0xbf800000u, 0x80000000u, 0xbf800000u, 0x80000000u, 0xbf800000u}},
+    {0xbf800000u, 0x7f800000u, 0x007fffffu, {0xbf800000u, 0x7f800000u, 0xbf800000u, 0x7f800000u, 0x007fffffu}, {0xbf800000u, 0x7f800000u, 0xbf800000u, 0x7f800000u, 0x00000000u}},
+    {0x7f800000u, 0x00000001u, 0x80800000u, {0x00000001u, 0x7f800000u, 0x80800000u, 0x7f800000u, 0x00000001u}, {0x00000000u, 0x7f800000u, 0x80800000u, 0x7f800000u, 0x00000000u}},
+    {0x7f800000u, 0x007fffffu, 0x007fffffu, {0x007fffffu, 0x7f800000u, 0x007fffffu, 0x7f800000u, 0x007fffffu}, {0x00000000u, 0x7f800000u, 0x00000000u, 0x7f800000u, 0x00000000u}},
+    {0x7f800000u, 0x00800000u, 0x80000001u, {0x00800000u, 0x7f800000u, 0x80000001u, 0x7f800000u, 0x00800000u}, {0x00800000u, 0x7f800000u, 0x80000000u, 0x7f800000u, 0x00800000u}},
+    {0x7f800000u, 0xff800000u, 0x007fffffu, {0xff800000u, 0x7f800000u, 0xff800000u, 0x7f800000u, 0x007fffffu}, {0xff800000u, 0x7f800000u, 0xff800000u, 0x7f800000u, 0x00000000u}},
+    {0xff800000u, 0x00000001u, 0xff800000u, {0xff800000u, 0x00000001u, 0xff800000u, 0x00000001u, 0xff800000u}, {0xff800000u, 0x00000000u, 0xff800000u, 0x00000000u, 0xff800000u}},
+}};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+bool Run(AgcDriver::VulkanDevice& device, ShaderRecompiler::ShaderFloatMode floatMode) {
+    Input.fill(0u);
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        std::copy(std::begin(Vectors[lane].operands), std::end(Vectors[lane].operands), Input.begin() + lane * Inputs);
+    }
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::span<const std::uint32_t> code(Code);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    std::optional<decltype(ShaderRecompiler::Recompile(request))> result;
+    try {
+        result.emplace(ShaderRecompiler::Recompile(request));
+    } catch (const std::exception& error) {
+        const std::string message = error.what();
+        const bool keepsDenormals = request.target.float32DenormPreserve && !request.target.float32FlushToZero;
+        Require(!keepsDenormals && ((floatMode.floatMode >> 4u) & 3u) == 1u && message.find("needs DenormPreserve 32") != std::string::npos,
+                "f32 min/max FLOAT_MODE " + Hex(floatMode.floatMode) + ": " + message);
+        return false;
+    }
+    device.Dispatch(*result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    return true;
+}
+
+void Check(std::uint32_t denormals, bool ieee) {
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        const auto& vector = Vectors[lane];
+        for (std::uint32_t instruction = 0; instruction < Instructions; ++instruction) {
+            const auto actual = Output[lane * Results + instruction];
+            const auto expected = denormals == 1u ? vector.inputsKept[instruction] : vector.inputsFlushed[instruction];
+            Require(actual == expected, std::string(Names[instruction]) + " f32 denormal mode " + std::to_string(denormals) + (ieee ? ", IEEE=1" : ", IEEE=0") + " of " +
+                                            Hex(vector.operands[0]) + ", " + Hex(vector.operands[1]) + ", " + Hex(vector.operands[2]) + " is " + Hex(actual) +
+                                            ", expected " + Hex(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        std::uint32_t checked = 0u;
+        for (const std::uint32_t denormals : {1u, 2u}) {
+            for (const bool ieee : {false, true}) {
+                if (!Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u | denormals << 4u, true, ieee, false})) continue;
+                ++checked;
+                Check(denormals, ieee);
+            }
+        }
+        std::printf("f32 min/max denormal mode 1 and 2 tests passed (%u of 4 modes run; mode 1 needs DenormPreserve 32)\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp
new file mode 100644
index 0000000000..5d3e6ebf24
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp
@@ -0,0 +1,106 @@
+#include "FixtureDeviceSelection.hpp"
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+void SetRequest(const char* value) {
+#ifdef _WIN32
+    if (_putenv_s("ANYPS5_GPU", value) != 0) throw std::runtime_error("cannot set ANYPS5_GPU");
+#else
+    if (setenv("ANYPS5_GPU", value, 1) != 0) throw std::runtime_error("cannot set ANYPS5_GPU");
+#endif
+}
+
+VkPhysicalDeviceProperties Properties(const char* name, VkPhysicalDeviceType type) {
+    VkPhysicalDeviceProperties result{};
+    result.apiVersion = VK_API_VERSION_1_1;
+    result.deviceType = type;
+    std::memcpy(result.deviceName, name, std::strlen(name) + 1u);
+    return result;
+}
+
+std::array<VkPhysicalDeviceProperties, 3> described{
+    Properties("llvmpipe (LLVM 20.1.2, 256 bits)", VK_PHYSICAL_DEVICE_TYPE_CPU),
+    Properties("AMD Radeon(TM) Graphics", VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU),
+    Properties("NVIDIA GeForce RTX 5080", VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU),
+};
+
+VkPhysicalDevice Handle(std::size_t index) {
+    return reinterpret_cast<VkPhysicalDevice>(static_cast<std::uintptr_t>(index + 1u));
+}
+
+void VKAPI_CALL Describe(VkPhysicalDevice device, VkPhysicalDeviceProperties* properties) {
+    *properties = described[reinterpret_cast<std::uintptr_t>(device) - 1u];
+}
+
+std::string SelectionError(const char* request) {
+    SetRequest(request);
+    try {
+        static_cast<void>(SelectFixturePhysicalDevice(std::array{Handle(0), Handle(1), Handle(2)}, Describe));
+    } catch (const std::runtime_error& error) {
+        return error.what();
+    }
+    throw std::runtime_error(std::string("ANYPS5_GPU=\"") + request + "\" selected a device");
+}
+
+void SelectionTests() {
+    std::array devices = described;
+    Require(!SelectFixtureDevice({}, {}).has_value(), "an empty device list selected a device");
+    Require(SelectFixtureDevice(devices, {}) == 2u, "default selection did not prefer the discrete GPU");
+    Require(SelectFixtureDevice(std::span(devices).first(2), {}) == 1u, "default selection did not prefer the integrated GPU to the CPU device");
+    Require(SelectFixtureDevice(devices, "AMD") == 1u, "an AMD request lost to the discrete GPU");
+    Require(SelectFixtureDevice(devices, "aMd rAdEoN") == 1u, "GPU name matching was not case-insensitive");
+    Require(SelectFixtureDevice(devices, "RTX 5080") == 2u, "partial GPU name matching failed");
+    Require(SelectFixtureDevice(devices, "llvmpipe") == 0u, "a requested CPU device was not selected");
+    Require(!SelectFixtureDevice(devices, "missing device").has_value(), "an unmatched GPU request selected a device");
+    Require(!SelectFixtureDevice(devices, "NVIDIA GeForce RTX 5080 with a longer name").has_value(), "a request longer than the device name matched");
+    const std::array radeons{
+        Properties("AMD Radeon(TM) Graphics", VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU),
+        Properties("AMD Radeon RX 7900 XTX", VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU),
+    };
+    Require(SelectFixtureDevice(radeons, {}) == 1u, "default selection did not prefer the discrete Radeon");
+    Require(SelectFixtureDevice(radeons, "radeon") == 0u, "a request matching an integrated and a later discrete GPU did not take the first match");
+    devices[0] = devices[1];
+    Require(SelectFixtureDevice(devices, "AMD") == 0u, "equally ranked matches did not keep enumeration order");
+    devices[1].apiVersion = VK_API_VERSION_1_0;
+    devices[2].apiVersion = VK_API_VERSION_1_0;
+    Require(!SelectFixtureDevice(devices, "NVIDIA").has_value(), "a requested device without Vulkan 1.1 was selected");
+}
+
+void EnvironmentTests() {
+    const std::array handles{Handle(0), Handle(1), Handle(2)};
+    SetRequest("");
+    Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(2), "an empty ANYPS5_GPU did not select the discrete GPU");
+    SetRequest("radeon");
+    Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(1), "ANYPS5_GPU=radeon did not select the integrated GPU");
+    SetRequest("LLVMPIPE");
+    Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(0), "ANYPS5_GPU=LLVMPIPE did not select the CPU device");
+    const std::string error = SelectionError("no such device 1d3d154f");
+    Require(error == "no Vulkan 1.1 device whose name contains ANYPS5_GPU=\"no such device 1d3d154f\"; devices: llvmpipe (LLVM 20.1.2, 256 bits), AMD Radeon(TM) Graphics, NVIDIA GeForce RTX 5080", "unexpected error: " + error);
+}
+
+}
+
+int main() {
+    try {
+        SelectionTests();
+        EnvironmentTests();
+        std::puts("fixture device selection tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp
new file mode 100644
index 0000000000..7bc494e0ec
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp
@@ -0,0 +1,57 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_EXECUTION_FIXTUREDEVICESELECTION_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_EXECUTION_FIXTUREDEVICESELECTION_HPP
+
+#include <vulkan/vulkan.h>
+#include <algorithm>
+#include <cctype>
+#include <cstddef>
+#include <cstdlib>
+#include <optional>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <vector>
+
+inline std::optional<std::size_t> SelectFixtureDevice(std::span<const VkPhysicalDeviceProperties> devices, std::string_view request) {
+    const auto rankDeviceType = [](VkPhysicalDeviceType type) {
+        switch (type) {
+            case VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU: return 3;
+            case VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU: return 2;
+            case VK_PHYSICAL_DEVICE_TYPE_VIRTUAL_GPU: return 1;
+            default: return 0;
+        }
+    };
+    std::optional<std::size_t> selected;
+    int selectedRank = -1;
+    for (std::size_t index = 0; index < devices.size(); ++index) {
+        const auto& candidate = devices[index];
+        if (candidate.apiVersion < VK_API_VERSION_1_1) continue;
+        const std::string_view name(candidate.deviceName);
+        if (!request.empty() && std::search(name.begin(), name.end(), request.begin(), request.end(), [](char left, char right) {
+            return std::tolower(static_cast<unsigned char>(left)) == std::tolower(static_cast<unsigned char>(right));
+        }) == name.end()) continue;
+        const int rank = request.empty() ? rankDeviceType(candidate.deviceType) : 4;
+        if (rank <= selectedRank) continue;
+        selected = index;
+        selectedRank = rank;
+    }
+    return selected;
+}
+
+inline VkPhysicalDevice SelectFixturePhysicalDevice(std::span<const VkPhysicalDevice> devices, PFN_vkGetPhysicalDeviceProperties physicalProperties) {
+    std::vector<VkPhysicalDeviceProperties> properties(devices.size());
+    for (std::size_t index = 0; index < devices.size(); ++index) physicalProperties(devices[index], &properties[index]);
+    const char* requestedName = std::getenv("ANYPS5_GPU");
+    const std::string_view request = requestedName != nullptr ? requestedName : "";
+    if (const auto selected = SelectFixtureDevice(properties, request)) return devices[*selected];
+    if (request.empty()) throw std::runtime_error("no Vulkan 1.1 device");
+    std::string names;
+    for (const auto& candidate : properties) {
+        if (!names.empty()) names += ", ";
+        names += candidate.deviceName;
+    }
+    throw std::runtime_error("no Vulkan 1.1 device whose name contains ANYPS5_GPU=\"" + std::string(request) + "\"; devices: " + names);
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/Float16Dot.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/Float16Dot.cpp
index 961afeb7c9..0a96011da8 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/Float16Dot.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/Float16Dot.cpp
@@ -31,6 +31,12 @@ alignas(256) constexpr std::array<std::uint32_t, 37> Code{
     0xe0781020, 0x80011203, 0xe0781030, 0x80011603, 0xbf810000,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 20> AccumulatorCode{
+    0x34020084, 0x34060086, 0xe0381000, 0x80000401, 0xbf8c3f70, 0xcc13600a, 0x1c1a0b04, 0xcc13000b,
+    0x1c1a0b04, 0xcc13440c, 0x1c1a0b04, 0xcc13400d, 0x9c1a0b04, 0xcc13440e, 0x9c1a0b04, 0xe0781000,
+    0x80010a03, 0xe0701010, 0x80010e03, 0xbf810000,
+};
+
 constexpr std::uint32_t Rows[32][4] = {
     {0x0001bc00u, 0x81bfacbau, 0xc541aa2fu, 0x00000000u},
     {0x01f61a79u, 0x3c000381u, 0xc1729fffu, 0x00000000u},
@@ -101,6 +107,43 @@ constexpr std::uint32_t Expected[32][10] = {
     {0xbaf43c38u, 0xbaf43c38u, 0x3af43c38u, 0x3af43c38u, 0x3abe63ecu, 0xbaf43c38u, 0xc021e000u, 0x3fb50000u, 0xba90cd60u, 0x3abe63ecu}
 };
 
+constexpr std::uint32_t AccumulatorExpected[32][5] = {
+    {0xc541a901u, 0xc541a901u, 0x4541ab5du, 0x4541ab5du, 0xc541a901u},
+    {0xc1729fdfu, 0xc1729fdfu, 0x4172a01fu, 0x4172a01fu, 0xc1729fdfu},
+    {0x4187e315u, 0x4187e315u, 0x4187e315u, 0xc1882737u, 0xc1882737u},
+    {0x3f7fdb0fu, 0x3f7fdb0fu, 0x3f7fdb0fu, 0xbf801279u, 0xbf801279u},
+    {0xbe511687u, 0xbe511687u, 0xbe511687u, 0xbe5166f4u, 0xbe5166f4u},
+    {0xc1e56f13u, 0xc1e56f13u, 0x41e55ba5u, 0x41e55ba5u, 0xc1e56f13u},
+    {0x439a1228u, 0x439a1228u, 0x439a1228u, 0xc3a5d2acu, 0xc3a5d2acu},
+    {0x37f5fb14u, 0x37f5fb14u, 0x37f5fc0cu, 0x37f5fc0cu, 0x37f5fb14u},
+    {0x7fd0a000u, 0x7fd0a000u, 0x7fd0a000u, 0x7fd0a000u, 0x7fd0a000u},
+    {0xffc8ab86u, 0xffc8ab86u, 0x7fc8ab86u, 0x7fc8ab86u, 0xffc8ab86u},
+    {0x7fe00000u, 0x7fe00000u, 0x7fe00000u, 0x7fe00000u, 0x7fe00000u},
+    {0xffc00000u, 0xffc00000u, 0xffc00000u, 0xffc00000u, 0xffc00000u},
+    {0xb974e480u, 0xb974e480u, 0xb974e480u, 0xb974e480u, 0xb974e480u},
+    {0x7f800000u, 0x7f800000u, 0x7f800000u, 0xff800000u, 0xff800000u},
+    {0xff800000u, 0xff800000u, 0xff800000u, 0xff800000u, 0xff800000u},
+    {0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u},
+    {0x7fe00000u, 0x7fe00000u, 0x7fe00000u, 0x7fe00000u, 0x7fe00000u},
+    {0x7fc42000u, 0x7fc42000u, 0x7fc42000u, 0x7fc42000u, 0x7fc42000u},
+    {0xbf052ae0u, 0xbf052ae0u, 0xbf052ae0u, 0xbf052ae0u, 0xbf052ae0u},
+    {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u},
+    {0x5f834da7u, 0x5f834da7u, 0x5f834da7u, 0xdf834da7u, 0xdf834da7u},
+    {0x7f7fffffu, 0x7f7fffffu, 0x7f7fffffu, 0xff7fffffu, 0xff7fffffu},
+    {0x42750eeeu, 0x42750eeeu, 0x42750eeeu, 0xc2750eeeu, 0xc2750eeeu},
+    {0x43380748u, 0x43380748u, 0x43380748u, 0xc3380746u, 0xc3380746u},
+    {0xffc00000u, 0xffc00000u, 0xffc00000u, 0xffc00000u, 0xffc00000u},
+    {0xf540cddbu, 0xf540cddbu, 0x7540cddbu, 0x7540cddbu, 0xf540cddbu},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc00000u, 0x7fc00000u, 0x7fc00000u},
+    {0x7fe00000u, 0x7fe00000u, 0x7fe00000u, 0xffe00000u, 0xffe00000u},
+    {0x3cb7c720u, 0x3cb7c720u, 0x3cb7c720u, 0x3cb7c720u, 0x3cb7c720u},
+    {0xbf9bd158u, 0xbf9bd158u, 0xbf9bd158u, 0xbf9bd158u, 0xbf9bd158u},
+    {0x565f49ebu, 0x565f49ebu, 0x565f49ebu, 0xd65f49ebu, 0xd65f49ebu},
+    {0xbaf43c38u, 0xbaf43c38u, 0xbaf43c38u, 0xbaf43c38u, 0xbaf43c38u}
+};
+
+constexpr const char* AccumulatorNames[5] = {"v_dot2 op_sel src2", "v_dot2 op_sel_hi src2 cleared", "v_dot2 neg_hi src2", "v_dot2 neg_lo src2", "v_dot2 neg_lo and neg_hi src2"};
+
 constexpr const char* Names[10] = {"v_dot2c", "v_dot2", "v_dot2 neg_lo src0/src2 neg_hi src1", "v_dot2 neg_lo src1 neg_hi src0", "v_dot2 op_sel src0", "v_dot2 clamp", "v_dot2c inline 1.0", "v_dot2c literal", "v_dot2c dpp quad_perm", "v_dot2 op_sel src1"};
 
 void Fill(std::uint32_t tid, std::uint32_t* words) {
@@ -140,21 +183,9 @@ auto Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> cod
     return ShaderRecompiler::Recompile(request);
 }
 
-void CheckRefused(AgcDriver::VulkanDevice& device, std::uint32_t word0, const std::string& what) {
-    alignas(256) const std::array<std::uint32_t, 3> code{word0, 0x1c1a0b04u, 0xbf810000u};
-    std::string refusal;
-    try {
-        static_cast<void>(Compile(device, code));
-    } catch (const std::exception& error) {
-        refusal = error.what();
-    }
-    Require(refusal.find("v_dot2_f32_f16 accumulator op_sel, op_sel_hi and neg_hi are not implemented") != std::string::npos, what + " was not refused");
-}
-
-void Run(AgcDriver::VulkanDevice& device) {
+void Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code) {
     for (std::uint32_t tid = 0; tid < Threads; ++tid) Fill(tid, &Input[tid * Inputs]);
     Output.fill(0xdeadbeefu);
-    const std::span<const std::uint32_t> code(Code);
     const auto result = Compile(device, code);
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
@@ -167,6 +198,13 @@ void Check() {
     }
 }
 
+void CheckAccumulator() {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        const std::uint32_t* out = &Output[tid * Results];
+        for (std::uint32_t i = 0; i < 5; ++i) Expect(tid, out[i], AccumulatorExpected[tid][i], AccumulatorNames[i]);
+    }
+}
+
 }
 
 int main() {
@@ -177,11 +215,10 @@ int main() {
             std::puts("skipped, v_dot2_f32_f16 is computed in f64 and the device has no shaderFloat64");
             return VulkanTestSkipped;
         }
-        Run(*device);
+        Run(*device, Code);
         Check();
-        CheckRefused(*device, 0xcc13600au, "op_sel on the accumulator");
-        CheckRefused(*device, 0xcc13440au, "neg_hi on the accumulator");
-        CheckRefused(*device, 0xcc13000au, "op_sel_hi cleared on the accumulator");
+        Run(*device, AccumulatorCode);
+        CheckAccumulator();
         std::puts("v_dot2_f32_f16 tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp
index b76ffe2a6d..e4b54fc027 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp
@@ -32,9 +32,9 @@ std::array<std::uint32_t, 4> Buffer(const void* data, std::uint32_t bytes) {
     return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u) & 0xffffu, bytes, 0x31016facu};
 }
 
-std::array<std::uint32_t, 8> Image(bool layered, std::uint32_t pipeXor, std::uint32_t swizzle = 4u) {
+std::array<std::uint32_t, 8> Image(bool layered, std::uint32_t pipeXor, std::uint32_t swizzle = 4u, std::uint32_t format = 166u) {
     const auto address = reinterpret_cast<std::uintptr_t>(Texels.data()) + pipeXor;
-    return {static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u) | (166u << 20u) | (3u << 30u), 31u | ((Height - 1u) << 14u), swizzle | (24u << 20u) | ((layered ? 13u : 9u) << 28u), layered ? 2u | (1u << 16u) : 0u, 0u, 0u, 0u};
+    return {static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u) | (format << 20u) | (3u << 30u), 31u | ((Height - 1u) << 14u), swizzle | (24u << 20u) | ((layered ? 13u : 9u) << 28u), layered ? 2u | (1u << 16u) : 0u, 0u, 0u, 0u};
 }
 
 std::uint32_t Mapping(std::uint32_t x, std::uint32_t y, std::uint32_t layer, std::uint32_t round) {
@@ -56,15 +56,16 @@ std::uint64_t EquationOffset(const TextureSwizzleEquation& equation, std::uint32
     return offset;
 }
 
-void Fill(bool layered, std::uint32_t pipeXor, std::uint32_t round) {
+template<typename TValue>
+void FillWith(bool layered, std::uint32_t pipeXor, std::uint32_t surfaceFormat, std::uint32_t bytes, TValue valueAt) {
     auto words = Image(layered, pipeXor);
-    words[1] = (words[1] & ~(0x1ffu << 20u)) | (20u << 20u);
+    words[1] = (words[1] & ~(0x1ffu << 20u)) | (surfaceFormat << 20u);
     const auto resource = DecodeTextureResource(words);
     const auto geometry = DescribeSurface(resource);
     Require(geometry.guestBytes <= Texels.size(), "FMASK fixture exceeds its allocation");
     const auto& mip = geometry.mips.at(0);
-    const auto block = ThinBlockLayout(resource.tileMode, 4u);
-    const auto* equation = FindTextureSwizzleEquation(24u, 4u);
+    const auto block = ThinBlockLayout(resource.tileMode, bytes);
+    const auto* equation = FindTextureSwizzleEquation(24u, bytes);
     Require(equation != nullptr, "FMASK fixture has no Z swizzle equation");
     std::ranges::fill(Texels, std::byte{0});
     for (std::uint32_t layer = 0; layer < geometry.layers; ++layer) {
@@ -73,14 +74,18 @@ void Fill(bool layered, std::uint32_t pipeXor, std::uint32_t round) {
                 auto offset = geometry.GuestLayerOffset(layer) + mip.tiledOffset;
                 if (mip.tail) offset += EquationOffset(*equation, x + mip.tailX, y + mip.tailY, layer) ^ pipeXor;
                 else offset += (static_cast<std::uint64_t>(y / block[2]) * mip.blocksPerRow + x / block[1]) * block[0] + (EquationOffset(*equation, x, y, layer) ^ pipeXor);
-                const auto value = Mapping(x, y, layer, round);
-                Require(offset + sizeof(value) <= Texels.size(), "FMASK fixture addresses outside its allocation");
-                std::memcpy(Texels.data() + offset, &value, sizeof(value));
+                const std::uint32_t value = valueAt(x, y, layer);
+                Require(offset + bytes <= Texels.size(), "FMASK fixture addresses outside its allocation");
+                std::memcpy(Texels.data() + offset, &value, bytes);
             }
         }
     }
 }
 
+void Fill(bool layered, std::uint32_t pipeXor, std::uint32_t round) {
+    FillWith(layered, pipeXor, 20u, 4u, [round](std::uint32_t x, std::uint32_t y, std::uint32_t layer) { return Mapping(x, y, layer, round); });
+}
+
 ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::span<const std::uint32_t> image, bool registration) {
     std::vector<std::uint32_t> userData(16u);
     const auto input = Buffer(Input.data(), sizeof(Input));
@@ -140,6 +145,68 @@ void Run(AgcDriver::VulkanDevice& device, bool layered, bool registration, std::
     }
 }
 
+struct NarrowFmask {
+    std::uint32_t format;
+    std::uint32_t surfaceFormat;
+    std::uint32_t bytes;
+    std::uint32_t samples;
+    std::uint32_t fragments;
+    std::uint32_t sampleBits;
+    std::uint32_t identity;
+    std::uint32_t expandedIdentity;
+};
+
+constexpr std::array<NarrowFmask, 8> NarrowFormats{{
+    {156u, 5u, 1u, 2u, 1u, 1u, 0x02u, 0x80u},
+    {157u, 5u, 1u, 4u, 1u, 1u, 0x0eu, 0x8880u},
+    {158u, 5u, 1u, 8u, 1u, 1u, 0xfeu, 0x88888880u},
+    {159u, 5u, 1u, 2u, 2u, 1u, 0x02u, 0x10u},
+    {160u, 5u, 1u, 4u, 2u, 2u, 0xa4u, 0x8810u},
+    {161u, 5u, 1u, 4u, 4u, 2u, 0xe4u, 0x3210u},
+    {163u, 11u, 2u, 8u, 2u, 2u, 0xaaa4u, 0x88888810u},
+    {165u, 20u, 4u, 8u, 4u, 4u, 0x44443210u, 0x88883210u},
+}};
+
+std::uint32_t Stored(const NarrowFmask& fmask, std::uint32_t x, std::uint32_t y, std::uint32_t layer, std::uint32_t round) {
+    if (round == 0u) return fmask.identity;
+    const auto value = (x * 0x9e3779b1u) ^ (y * 0x85ebca77u) ^ (layer * 0xc2b2ae3du) ^ (fmask.format * 0x27d4eb2fu);
+    return fmask.bytes == 4u ? value : value & ((1u << (fmask.bytes * 8u)) - 1u);
+}
+
+std::uint32_t Expanded(const NarrowFmask& fmask, std::uint32_t stored) {
+    std::uint32_t expanded = 0;
+    for (std::uint32_t sample = 0; sample < fmask.samples; ++sample) {
+        const auto fragment = (stored >> (sample * fmask.sampleBits)) & ((1u << fmask.sampleBits) - 1u);
+        expanded |= (fragment >= fmask.fragments ? 8u : fragment) << (sample * 4u);
+    }
+    return expanded;
+}
+
+void RunNarrow(AgcDriver::VulkanDevice& device, const NarrowFmask& fmask, bool layered, bool registration) {
+    auto code = Code;
+    if (layered) code[4] = 0xf0001f28u;
+    Require(Expanded(fmask, fmask.identity) == fmask.expandedIdentity, "FMASK " + std::to_string(fmask.format) + " reference does not expand PAL's identity value");
+    for (std::uint32_t round = 0; round < 2u; ++round) {
+        FillWith(layered, 0u, fmask.surfaceFormat, fmask.bytes, [&](std::uint32_t x, std::uint32_t y, std::uint32_t layer) { return Stored(fmask, x, y, layer, round); });
+        for (std::uint32_t lane = 0; lane < Threads; ++lane) {
+            Input[lane * 4u] = (lane * 37u + 11u) % Width;
+            Input[lane * 4u + 1u] = (lane * 23u + 5u) % Height;
+            Input[lane * 4u + 2u] = layered ? lane & 1u : 0u;
+            Input[lane * 4u + 3u] = 0u;
+        }
+        Output.fill(Sentinel);
+        const auto shader = Compile(device, code, Image(layered, 0u, 4u, fmask.format), registration);
+        device.Dispatch(shader, 1u, 1u, 1u);
+        device.WaitIdle();
+        for (std::uint32_t lane = 0; lane < Threads; ++lane) {
+            const auto stored = Stored(fmask, Input[lane * 4u], Input[lane * 4u + 1u], layered ? Input[lane * 4u + 2u] + 1u : 0u, round);
+            const std::array expected{Expanded(fmask, stored), 0u, 0u, 0u};
+            for (std::uint32_t component = 0; component < 4u; ++component) Require(Output[lane * 4u + component] == expected[component], "FMASK " + std::to_string(fmask.format) + " load did not expand its mapping: round " + std::to_string(round) + ", lane " + std::to_string(lane) + ", component " + std::to_string(component) + ", read " + std::to_string(Output[lane * 4u + component]) + ", expected " + std::to_string(expected[component]));
+        }
+        Require(std::all_of(Output.begin() + Threads * 4u, Output.end(), [](auto value) { return value == Sentinel; }), "FMASK load wrote outside its output");
+    }
+}
+
 }
 
 int main() {
@@ -149,9 +216,10 @@ int main() {
         for (const bool registration : {false, true}) {
             for (const bool layered : {false, true}) {
                 for (const auto pipeXor : {0u, 0xf00u}) Run(*device, layered, registration, pipeXor);
+                for (const auto& fmask : NarrowFormats) RunNarrow(*device, fmask, layered, registration);
             }
         }
-        std::cout << "FMASK image reads passed: 40 dispatches, 5120 component checks, 8 compression refusals\n";
+        std::cout << "FMASK image reads passed: 104 dispatches, 13312 component checks, 8 compression refusals\n";
         return 0;
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp
index 503ccf662f..b4827a3b53 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp
@@ -684,6 +684,7 @@ void Dispatch(AgcDriver::VulkanDevice& device, std::uint32_t waveSize, const std
         {0, 0, 0, 128}
     };
     request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false};
     const auto result = ShaderRecompiler::Recompile(request);
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp
index 5a4da94b89..6137424eba 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFiber/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -17,15 +18,6 @@
 #include <iostream>
 #include <string>
 
-using GuestFiberEntry = void (APS5_VABI*)(std::uint64_t, std::uint64_t);
-
-extern "C" {
-std::int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject*, const char*, GuestFiberEntry, std::uint64_t, void*, std::uint64_t, const void*, std::uint32_t);
-std::int32_t APS5_VABI sceFiberFinalize(FiberObject*);
-std::int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject*, std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberReturnToThread(std::uint64_t, std::uint64_t*);
-}
-
 namespace {
 
 using AgcDriver::DriverDetail::Driver;
@@ -77,6 +69,7 @@ void MapForGpu() {
 void APS5_VABI MapOnFiber(std::uint64_t, std::uint64_t) {
     MapForGpu();
     sceFiberReturnToThread(0, nullptr);
+
 }
 
 void ReleaseMapping() {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp
index 172c6a26aa..d05f480585 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp
@@ -270,7 +270,7 @@ void RunTests(AgcDriver::VulkanDevice& device) {
     Require(!Faulted(someLanes), "guarded pointer: a mapped pointer under EXEC faulted:\n" + someLanes.log);
     RequireWords(someLanes, 5u, Payload, "guarded pointer: a mapped pointer read under EXEC");
     const auto noLanes = Run(device, ExecCode, 0u, 0u);
-    Require(!Faulted(noLanes) && noLanes.poisoned == 1u, "guarded pointer: a null pointer read skipped by s_cbranch_execz faulted:\n" + noLanes.log);
+    Require(!Faulted(noLanes) && noLanes.poisoned == 0u && noLanes.cacheable, "guarded pointer: a null pointer read skipped by s_cbranch_execz under an EXEC decided empty at capture faulted, was poisoned or left the caches:\n" + noLanes.log);
     RequireWords(noLanes, 0u, 0u, "guarded pointer: a read skipped by s_cbranch_execz");
     const auto oneLane = Run(device, ExecCode, 0u, 1u);
     Require(Faulted(oneLane) && oneLane.log.find(Fault(0u, 0x34u)) != std::string::npos, "guarded pointer: a null pointer read with one EXEC lane did not fault:\n" + oneLane.log);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp
index 2d737ebc4e..7d6a257711 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
@@ -17,19 +19,6 @@
 #include <stdexcept>
 #include <string_view>
 
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-void* APS5_VABI memalign_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI realloc_nid_postfix(void*, std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-}
-
 namespace {
 
 constexpr std::size_t BlockBytes = 65536;
@@ -141,12 +130,14 @@ void CheckHeap(AgcDriver::VulkanDevice& device) {
     Require(!Imported(device, allocation), "host import survived guest realloc");
     CheckPattern(replacement);
     free_nid_postfix(replacement);
+
     for (int iteration = 0; iteration < 3; ++iteration) {
         allocation = memalign_nid_postfix(BlockBytes, BlockBytes);
         Require(allocation != nullptr, "guest heap reuse allocation failed");
         std::memset(allocation, 0, BlockBytes);
         Fill(device, allocation);
         free_nid_postfix(allocation);
+
         Require(!Imported(device, allocation), "host import survived guest free or heap cache eviction");
     }
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp
index 00a4f23f96..6bc76a11e1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp
@@ -147,7 +147,13 @@ int main() {
         remapped.Unregister();
         remapped.Register();
         Import(*device, remapped.Ranges());
-        Require(Imported(handle, remapped.Address(), AllocationBytes), "host import at map: a range mapped again was not imported");
+        Require(!Imported(handle, remapped.Address(), AllocationBytes), "host import at map: a range mapped again was imported at map instead of on first use");
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            const std::array<std::uint32_t, 4> pattern{9u, 10u, 11u, 12u};
+            Require(device->FillBuffer(remapped.Address(), BlockBytes, pattern), "host import at map: the first use of a range mapped again was not imported");
+            device->WaitIdle();
+        }
         GuestAllocation gone;
         const auto goneRanges = gone.Ranges();
         gone.Unregister();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp
index e6d9bd6b30..35e4f777cd 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp
@@ -21,6 +21,14 @@
 #include <mutex>
 #include <string>
 
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
 namespace {
 
 namespace Graphics = AgcDriver::Graphics;
@@ -163,6 +171,41 @@ Outcome ResidentMappingsImportAfterCollection() {
     return Outcome::Passed;
 }
 
+Outcome SmallMappingsImportOnFirstUse() {
+    GuestBlock small(GuestAlignment);
+    GuestBlock large(2 * GuestAlignment);
+    auto device = OpenVulkanTestDevice();
+    if (!device) return Outcome::NoDevice;
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device);
+    if (context.hostImportAlignment == 0) return Outcome::NoImport;
+    for (auto* guest : {&small, &large}) {
+        Graphics::ClearHostImports(device->Device());
+        GuestAllocations::Mapped ranges;
+        for (const auto& range : GuestAllocations::GuestAllocationsAcquire_nid_postfix()) {
+            if (range->address == guest->Address()) ranges.push_back(range);
+        }
+        Require(ranges.size() == 1, "mapped import test lost its registered range");
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            Require(Graphics::ImportMappedRanges(context, ranges, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true), "mapped import test could not adopt the device");
+        }
+        Require(Graphics::HostImportCovers(context, guest->Address(), ProbeBytes) == (guest == &large), "mapping did not defer exactly the small import");
+        Require(Fill(*device, guest->Address()), "first GPU use could not import the mapped buffer");
+        Require(Graphics::HostImportCovers(context, guest->Address(), ProbeBytes), "first GPU use left the mapped buffer unimported");
+        constexpr std::array<std::uint32_t, 4> pattern{0x11111111u, 0x22222222u, 0x33333333u, 0x44444444u};
+        for (std::size_t offset = 0; offset < ProbeBytes; offset += sizeof(std::uint32_t)) {
+            std::uint32_t actual = 0;
+            std::memcpy(&actual, guest->Data() + offset, sizeof(actual));
+            Require(actual == pattern[(offset / sizeof(actual)) % pattern.size()], "first GPU use changed the fill result");
+        }
+        for (std::size_t offset = ProbeBytes; offset < GuestAlignment; ++offset) {
+            Require(guest->Data()[offset] == 0, "first GPU use overwrote bytes outside the fill");
+        }
+    }
+    Graphics::ClearHostImports(device->Device());
+    return Outcome::Passed;
+}
+
 }
 
 int main() {
@@ -176,6 +219,7 @@ int main() {
         const auto windows = WindowsFollowTheirRange();
         Require(windows == Outcome::Passed, "host import windows: the device stopped importing guest memory between two scenarios");
         Require(ResidentMappingsImportAfterCollection() == Outcome::Passed, "resident import test failed");
+        Require(SmallMappingsImportOnFirstUse() == Outcome::Passed, "mapped import test lost its Vulkan device or host import support");
         std::puts("host import windows tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp
index a7b492f8e8..78b36356c7 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp
@@ -504,6 +504,7 @@ ShaderRecompiler::RecompileResult Compile(std::uint32_t waveSize, const ShaderRe
         {0, 0, 0, 128}
     };
     request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false};
     return ShaderRecompiler::Recompile(request);
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp
index f840ade501..bb50f103fd 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp
@@ -37,7 +37,9 @@ constexpr std::uint32_t Type2D = 9;
 constexpr std::uint32_t UnormFormat = 30;
 constexpr std::uint32_t UintFormat = 34;
 constexpr std::uint32_t FloatFormat = 43;
+constexpr std::uint32_t NativeFloatFormat = 36;
 constexpr std::size_t FloatOffset = 40960;
+constexpr std::size_t Float36Offset = 45056;
 constexpr std::uint32_t SwizzleXYZ1 = 0x3acu;
 constexpr std::uint32_t SwizzleXZY1 = 0x374u;
 constexpr std::uint32_t SwizzleZYX1 = 0x32eu;
@@ -285,6 +287,16 @@ constexpr std::array<std::array<std::uint32_t, 4>, 7> FloatStoreEdges{{
     {0x7f800001u, 0x7f810000u, 0x7fa00000u, 0xfa1f07e1u},
 }};
 
+constexpr std::array<std::array<std::uint32_t, 4>, 7> Float36StoreEdges{{
+    {0xbf800000u, 0x80000000u, 0x7fc00000u, 0xfc000000u},
+    {0x7f800000u, 0x7149f2cau, 0x477fff00u, 0xf7fdffc0u},
+    {0x3f830000u, 0x3f818000u, 0x35800000u, 0x001e03c1u},
+    {0x00000001u, 0xff800000u, 0xffc00000u, 0xfc000000u},
+    {0x477c0000u, 0x4788b800u, 0x33000000u, 0x003dffbeu},
+    {0x36400000u, 0x477e0000u, 0x3dcccccdu, 0x5cfdf803u},
+    {0x7f800001u, 0x7f810000u, 0x7fa00000u, 0xfa3e0fc1u},
+}};
+
 constexpr std::array<std::array<std::uint32_t, 4>, 3> FloatLoadEdges{{
     {0x3e0u | (0x7c0u << 10u) | (0x03fu << 21u), 0x7f800000u, 0x7f800000u, 0x387c0000u},
     {0x001u | (0x041u << 10u) | (0x7bfu << 21u), 0x36000000u, 0x38820000u, 0x477e0000u},
@@ -302,6 +314,10 @@ std::uint32_t FloatTexel(std::uint32_t index) {
     return SmallFloat(FloatValues[index % 11u], 5u) | (SmallFloat(FloatValues[(index + 4u) % 11u], 6u) << 10u) | (SmallFloat(FloatValues[(index + 8u) % 11u], 6u) << 21u);
 }
 
+std::uint32_t Float36Texel(std::uint32_t index) {
+    return SmallFloat(FloatValues[index % 11u], 6u) | (SmallFloat(FloatValues[(index + 4u) % 11u], 6u) << 11u) | (SmallFloat(FloatValues[(index + 8u) % 11u], 5u) << 22u);
+}
+
 void CheckFloatLoad(AgcDriver::VulkanDevice& device, std::uint8_t* texels) {
     for (std::uint32_t index = 0; index < LoadWidth; ++index) {
         const auto texel = index < FloatLoadEdges.size() ? FloatLoadEdges[index][0] : FloatTexel(index);
@@ -344,8 +360,32 @@ void CheckFloatStore(AgcDriver::VulkanDevice& device, std::uint8_t* texels) {
     }
 }
 
-void CheckFloatSample(AgcDriver::VulkanDevice& device, const std::uint8_t* texels, const std::array<std::uint32_t, 4>& expected, const std::string& what) {
-    Run(device, SampleLz, TextureDescriptor(texels, FloatFormat, SwizzleXYZ1, Threads), PointSampler, 1);
+void CheckFloat36Store(AgcDriver::VulkanDevice& device, std::uint8_t* texels) {
+    std::fill(texels, texels + Threads * 4u, static_cast<std::uint8_t>(0xa5u));
+    Input.fill(0u);
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        Input[tid * 4u + 0u] = std::bit_cast<std::uint32_t>(FloatValues[tid % 11u]);
+        Input[tid * 4u + 1u] = std::bit_cast<std::uint32_t>(FloatValues[(tid + 4u) % 11u]);
+        Input[tid * 4u + 2u] = std::bit_cast<std::uint32_t>(FloatValues[(tid + 8u) % 11u]);
+        if (tid < Float36StoreEdges.size()) {
+            for (std::uint32_t component = 0; component < 3u; ++component) {
+                Input[tid * 4u + component] = Float36StoreEdges[tid][component];
+            }
+        }
+    }
+    Run(device, StoreXyz, TextureDescriptor(texels, NativeFloatFormat, SwizzleXYZ1, Threads), BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u)), 1);
+    AgcDriver::Graphics::StorageTexture::FlushPending(reinterpret_cast<std::uintptr_t>(texels), Threads * 4u, nullptr, "test");
+    device.WaitIdle();
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        std::uint32_t actual = 0;
+        std::memcpy(&actual, texels + tid * 4u, 4u);
+        const auto expected = tid < Float36StoreEdges.size() ? Float36StoreEdges[tid][3] : Float36Texel(tid);
+        Require(actual == expected, "image_store of R11_G11_B10_FLOAT: texel " + std::to_string(tid) + " is " + Hex(actual) + ", expected " + Hex(expected));
+    }
+}
+
+void CheckFloatSample(AgcDriver::VulkanDevice& device, const std::uint8_t* texels, const std::array<std::uint32_t, 4>& expected, const std::string& what, std::uint32_t format = FloatFormat) {
+    Run(device, SampleLz, TextureDescriptor(texels, format, SwizzleXYZ1, Threads), PointSampler, 1);
     for (std::uint32_t tid = 0; tid < Threads; ++tid) {
         for (std::uint32_t component = 0; component < 4u; ++component) {
             const auto actual = Output[tid * 4u + component];
@@ -545,6 +585,9 @@ int main(int argc, char** argv) {
         CheckFloatSample(*device, texels + FloatOffset, {0u, 0u, 0x7fc00000u, 0x3f800000u}, "image_sample_lz of R10_G11_B11_FLOAT results still on the GPU");
         CheckFloatLoad(*device, texels + FloatOffset);
         CheckFloatSample(*device, texels + FloatOffset, {0x7f800000u, 0x7f800000u, 0x387c0000u, 0x3f800000u}, "image_sample_lz of R10_G11_B11_FLOAT");
+        CheckFloat36Store(*device, texels + Float36Offset);
+        Run(*device, StoreXyz, TextureDescriptor(texels + Float36Offset, NativeFloatFormat, SwizzleXYZ1, Threads), BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u)), 1);
+        CheckFloatSample(*device, texels + Float36Offset, {0u, 0u, 0x7fc00000u, 0x3f800000u}, "image_sample_lz of R11_G11_B10_FLOAT results still on the GPU", NativeFloatFormat);
         CheckSample(*device, texels, SampleAt, SampleStep, SampleStart, SwizzleXYZ1, PointSampler, false, false, "point image_sample_lz X Y Z 1");
         CheckSample(*device, texels, SampleAt, SampleStep, SampleStart, SwizzleZYX1, BilinearSampler, true, false, "bilinear image_sample_lz Z Y X 1");
         CheckSample(*device, texels, SampleWrapped, SampleStep, WrappedStart, SwizzleX011, WrapPointSampler, false, true, "wrapped point image_sample_lz X 0 1 1");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageResinfoDimension.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageResinfoDimension.cpp
new file mode 100644
index 0000000000..01fd310101
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageResinfoDimension.cpp
@@ -0,0 +1,108 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Size = 8;
+constexpr std::uint32_t Format32Float = 22;
+constexpr std::uint32_t Type3D = 10;
+constexpr std::uint32_t TypeCube = 11;
+constexpr std::uint32_t Type2DArray = 13;
+alignas(256) std::array<std::uint32_t, Threads * 4> Output{};
+alignas(256) std::array<std::uint8_t, 65536> Texels{};
+
+constexpr std::array<std::uint32_t, 8> Code(std::uint32_t dim) {
+    return {0x34060084u, 0x7e020280u, 0xf0380f00u | (dim << 3u), 0x00010a01u, 0xbf8c3f70u, 0xe0781000u, 0x80000a03u, 0xbf810000u};
+}
+
+alignas(256) constexpr auto Query1D = Code(0u);
+alignas(256) constexpr auto Query3D = Code(2u);
+alignas(256) constexpr auto QueryCube = Code(3u);
+alignas(256) constexpr auto Query2DArray = Code(5u);
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::array<std::uint32_t, 8> Descriptor(std::uint32_t type, std::uint32_t depth) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(Texels.data()));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32Float << 20u) | (((Size - 1u) & 3u) << 30u),
+        ((Size - 1u) >> 2u) | ((Size - 1u) << 14u),
+        0xfacu | (type << 28u),
+        depth - 1u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+std::array<std::uint32_t, 4> Query(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::array<std::uint32_t, 8>& texture) {
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(output.begin(), output.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    for (std::uint32_t tid = 1; tid < Threads; ++tid) {
+        Require(std::equal(Output.begin(), Output.begin() + 4, Output.begin() + tid * 4u), "image_get_resinfo: lanes disagree");
+    }
+    return {Output[0], Output[1], Output[2], Output[3]};
+}
+
+std::string Text(const std::array<std::uint32_t, 4>& value) {
+    return std::to_string(value[0]) + "x" + std::to_string(value[1]) + "x" + std::to_string(value[2]) + " levels " + std::to_string(value[3]);
+}
+
+using Result = std::array<std::uint32_t, 4>;
+
+void Check(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> native, const std::array<std::uint32_t, 8>& texture, const char* what, const Result& own, const Result& oneDimensional) {
+    const auto nativeResult = Query(device, native, texture);
+    Require(nativeResult == own, std::string("image_get_resinfo: the ") + what + " query returned " + Text(nativeResult) + ", RDNA 2 returns " + Text(own));
+    const auto lineResult = Query(device, Query1D, texture);
+    Require(lineResult == oneDimensional, std::string("image_get_resinfo: DIM 1D on a ") + what + " T# returned " + Text(lineResult) + ", RDNA 2 returns " + Text(oneDimensional));
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        Check(*device, QueryCube, Descriptor(TypeCube, 6u), "cube", {Size, Size, 6u, 1u}, {Size, Size, 0u, 1u});
+        Check(*device, Query3D, Descriptor(Type3D, 4u), "3D", {Size, Size, 4u, 1u}, {Size, Size, 4u, 1u});
+        Check(*device, Query2DArray, Descriptor(Type2DArray, 3u), "2D array", {Size, Size, 3u, 1u}, {Size, Size, 0u, 1u});
+        std::puts("image resinfo dimension tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp
index 331882d14a..0178717e94 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp
@@ -27,6 +27,7 @@ constexpr std::uint32_t Format8888Srgb = 130;
 constexpr std::uint32_t Format32Float = 22;
 constexpr std::uint32_t Format8888SNorm = 57;
 constexpr std::uint32_t FormatBc4UNorm = 175;
+constexpr std::uint32_t Format32UInt = 20;
 constexpr std::uint32_t Type2D = 9;
 constexpr std::uint32_t FilterPoint = 0;
 constexpr std::uint32_t FilterBilinear = 1;
@@ -177,7 +178,11 @@ int main() {
         RequireSame(Sample(*device, Format8888UNorm, FilterBilinear, ForceDegamma), forcedBilinear, "8_8_8_8_UNORM, bilinear", "through FORCE_DEGAMMA", "as 8_8_8_8_SRGB");
         RequireSame(Sample(*device, Format32Float, FilterPoint, ForceDegamma), Sample(*device, Format32Float, FilterPoint, 0u), "32_FLOAT, point");
         RequireSame(Sample(*device, FormatBc4UNorm, FilterPoint, ForceDegamma), Sample(*device, FormatBc4UNorm, FilterPoint, 0u), "BC4_UNORM, point");
-        Reject(*device, Format8888SNorm, "guest format 57, which is not sRGB and has no sRGB view, is sampled through a sampler that forces sRGB decoding");
+        FillInput(true);
+        RequireSame(Sample(*device, Format8888SNorm, FilterPoint, ForceDegamma), forcedPoint, "8_8_8_8_SNORM, point", "through FORCE_DEGAMMA", "as 8_8_8_8_SRGB");
+        FillInput(false);
+        RequireSame(Sample(*device, Format8888SNorm, FilterBilinear, ForceDegamma), forcedBilinear, "8_8_8_8_SNORM, bilinear", "through FORCE_DEGAMMA", "as 8_8_8_8_SRGB");
+        Reject(*device, Format32UInt, "guest format 20, which is not sRGB and has no sRGB view, is sampled through a sampler that forces sRGB decoding");
         std::puts("image sample force degamma tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreLineThroughPlaneArray.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreLineThroughPlaneArray.cpp
new file mode 100644
index 0000000000..26d3e4d1ff
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreLineThroughPlaneArray.cpp
@@ -0,0 +1,185 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Width = 32;
+constexpr std::uint32_t Type1D = 8;
+constexpr std::uint32_t IdentitySwizzle = 0xfacu;
+constexpr std::size_t TexelBytes = 4096;
+constexpr std::size_t BlockBytes = 65536;
+
+alignas(256) std::array<std::uint32_t, Threads * 4> Input{};
+
+alignas(256) constexpr std::array<std::uint32_t, 17> StoreCode{
+    0x34020084, 0xe0381000, 0x80001401, 0xbf8c3f70, 0x7e3c0300, 0x7e3e0281, 0x7e400280, 0xf0201f28, 0x0001141e,
+    0x7e3e0280, 0x7e4002c1, 0xf0201528, 0x0001141e, 0x7e400281, 0xf0201528, 0x0001141e, 0xbf810000,
+};
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "image store line through plane array: cannot allocate the guest block");
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint8_t* Data() { return block; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+struct Format {
+    const char* name;
+    std::uint32_t format;
+    std::uint32_t components;
+};
+
+constexpr std::array<Format, 2> Formats{{
+    {"32_SINT", 21u, 1u},
+    {"32_32_32_32_SINT", 76u, 4u},
+}};
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::uint32_t Value(std::uint32_t tid, std::uint32_t index) {
+    return (tid * 4u + index + 1u) * 0x9e3779b1u;
+}
+
+std::uint64_t TexelOffset(const Format& format, std::uint32_t x) {
+    const auto mip = AgcDriver::Graphics::ComputeMipLayout(AgcDriver::Graphics::TextureTileMode::kLinear, format.format, Width, 1u, 1u).at(0);
+    return mip.tiledOffset + static_cast<std::uint64_t>(x) * format.components * 4u;
+}
+
+std::vector<std::uint8_t> Initial() {
+    std::vector<std::uint8_t> bytes(TexelBytes);
+    for (std::size_t index = 0; index < bytes.size(); ++index) bytes[index] = static_cast<std::uint8_t>(0x80u + 37u * index + 11u * (index >> 4u));
+    return bytes;
+}
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::array<std::uint32_t, 8> TextureDescriptor(const void* data, std::uint32_t format) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (format << 20u) | (((Width - 1u) & 3u) << 30u),
+        (Width - 1u) >> 2u,
+        IdentitySwizzle | (Type1D << 28u),
+        0u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+void Dispatch(AgcDriver::VulkanDevice& device, std::uint8_t* texels, std::span<const std::uint32_t> code, std::uint32_t format) {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        for (std::uint32_t index = 0; index < 4u; ++index) Input[tid * 4u + index] = Value(tid, index);
+    }
+    const auto initial = Initial();
+    std::copy(initial.begin(), initial.end(), texels);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto buffer = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto texture = TextureDescriptor(texels, format);
+    std::copy(buffer.begin(), buffer.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    AgcDriver::Graphics::StorageTexture::FlushPending(reinterpret_cast<std::uintptr_t>(texels), TexelBytes, nullptr, "test");
+    device.WaitIdle();
+}
+
+void CheckTexels(const std::uint8_t* texels, const Format& format) {
+    const auto initial = Initial();
+    for (std::uint32_t x = 0; x < Width; ++x) {
+        const auto offset = TexelOffset(format, x);
+        for (std::uint32_t component = 0; component < format.components; ++component) {
+            std::uint32_t actual = 0;
+            std::memcpy(&actual, texels + offset + component * 4u, 4u);
+            const auto wanted = Value(x, component);
+            Require(actual == wanted, std::string("image_store 2d_array through a 1D ") + format.name + " T#: texel " + std::to_string(x) + " component " + std::to_string(component) + " is " + Hex(actual) + ", expected the y = 1, slice = 0 store " + Hex(wanted) + " and the stores to slices 0xffffffff and 1 dropped");
+        }
+    }
+    const auto end = TexelOffset(format, Width);
+    Require(std::equal(texels + end, texels + TexelBytes, initial.begin() + static_cast<std::ptrdiff_t>(end)), std::string("image_store 2d_array through a 1D ") + format.name + " T#: bytes past the texture changed");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        GuestBlock block;
+        auto* texels = block.Data();
+        for (const auto& format : Formats) {
+            Dispatch(*device, texels, StoreCode, format.format);
+            CheckTexels(texels, format);
+        }
+        std::puts("image store line through plane array tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp
index d353e82b93..5ee8abca21 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp
@@ -47,6 +47,7 @@ constexpr std::uint32_t MaxGroups = 8;
 constexpr std::uint32_t Format32UInt = 20;
 constexpr std::uint32_t Format32SInt = 21;
 constexpr std::uint32_t Format32Float = 22;
+constexpr std::uint32_t Format32_32UInt = 62;
 constexpr std::uint32_t Format11_11_10UInt = 34;
 constexpr std::uint32_t Format8_8Srgb = 129;
 constexpr std::uint32_t Type2D = 9;
@@ -56,6 +57,7 @@ constexpr std::uint32_t DepthSwizzleMode = 0x18;
 alignas(256) std::array<float, Width * Height> FloatTexels{};
 alignas(256) std::array<float, Width * Height> OtherFloatTexels{};
 alignas(256) std::array<std::uint32_t, Width * Height> UintTexels{};
+alignas(256) std::array<std::uint64_t, Width * Height> Uint64Texels{};
 alignas(256) std::array<std::int32_t, Width * Height> SintTexels{};
 alignas(4096) std::array<std::uint32_t, 49152> DepthStorage{};
 alignas(256) std::array<std::uint32_t, Records * Stride / 4> Table{};
@@ -203,6 +205,28 @@ alignas(256) constexpr std::array<std::uint32_t, 16> StoreLaneTableCode{
     0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0xf0208f08u, 0x00090401u, 0xbf810000u,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 16> AtomicAddLaneTableCode{
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
+    0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0xf0448108u, 0x00090401u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 18> AtomicAdd64LaneTableCode{
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
+    0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0x7e0a02ffu, 0x00000000u, 0xf0448308u,
+    0x00090401u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 16> AtomicSwapLaneTableCode{
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
+    0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0xf03c8108u, 0x00090401u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 18> AtomicCmpSwapLaneTableCode{
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
+    0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0x7e0a0304u, 0x3a080881u, 0xf0408308u,
+    0x00090401u, 0xbf810000u,
+};
+
 alignas(256) constexpr std::array<std::uint32_t, 17> StoreTableCutCode{
     0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
     0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7da400ffu, 0x00001000u, 0xf0208f08u, 0x00090401u,
@@ -1117,6 +1141,67 @@ void RunStoreTests(AgcDriver::VulkanDevice& device) {
     Require(untouched(), "image table store: a store through a null entry reached an image:\n" + null.log);
 }
 
+void RunAtomicTests(AgcDriver::VulkanDevice& device) {
+    struct Registration {
+        void* data;
+        Registration(void* data, std::size_t bytes) : data(data) { GuestAllocations::Mutation().Add(data, bytes, true, true, true); }
+        ~Registration() { GuestAllocations::Mutation().Remove(data); }
+    } registeredUint(UintTexels.data(), sizeof(UintTexels)), registeredFloat(FloatTexels.data(), sizeof(FloatTexels)), registeredSint(SintTexels.data(), sizeof(SintTexels));
+    SetClassRecords();
+    for (std::uint32_t x = 0; x < Width; ++x) UintTexels[x] = 0x5000u + x;
+    for (std::uint32_t x = 0; x < Width; ++x) FloatTexels[x] = 1.0f;
+    Keys = {};
+    Keys[0] = 1;
+    const auto added = Run(device, AtomicAddLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(added), "image table atomic: an add through a table faulted:\n" + added.log);
+    Require(added.imageTableCount != 0u, "image table atomic: the add bound no storage table elements");
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == 0x5000u + x + x, "image table atomic: texel " + std::to_string(x) + " of the selected image is " + Hex(UintTexels[x]) + ", expected " + Hex(0x5000u + x + x));
+    const auto swapped = Run(device, AtomicSwapLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(swapped), "image table atomic: an exchange through a table faulted:\n" + swapped.log);
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == x, "image table atomic: texel " + std::to_string(x) + " of the selected image is " + Hex(UintTexels[x]) + ", expected " + Hex(x));
+    const auto compared = Run(device, AtomicCmpSwapLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(compared), "image table atomic: a compare exchange through a table faulted:\n" + compared.log);
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == (x ^ 1u), "image table atomic: texel " + std::to_string(x) + " of the selected image is " + Hex(UintTexels[x]) + ", expected " + Hex(x ^ 1u));
+    Keys[0] = 8;
+    const auto addedFloat = Run(device, AtomicAddLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(addedFloat), "image table atomic: an add on a float record through a table faulted:\n" + addedFloat.log);
+    for (std::uint32_t x = 0; x < Width; ++x) Require(std::bit_cast<std::uint32_t>(FloatTexels[x]) == 0x3f800000u + x, "image table atomic: float texel " + std::to_string(x) + " is " + Hex(std::bit_cast<std::uint32_t>(FloatTexels[x])) + ", expected " + Hex(0x3f800000u + x));
+    Keys[0] = 6;
+    const auto null = Run(device, AtomicAddLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == (x ^ 1u) && std::bit_cast<std::uint32_t>(FloatTexels[x]) == 0x3f800000u + x, "image table atomic: an add through a null entry reached an image:\n" + null.log);
+}
+
+void RunAtomic64Tests(AgcDriver::VulkanDevice& device) {
+    if (!TargetHasCapability(device.Target(), spv::CapabilityInt64ImageEXT)) {
+        std::puts("skipped the 64-bit table atomic rows, the device has no shaderImageInt64Atomics");
+        return;
+    }
+    struct Registration {
+        void* data;
+        Registration(void* data, std::size_t bytes) : data(data) { GuestAllocations::Mutation().Add(data, bytes, true, true, true); }
+        ~Registration() { GuestAllocations::Mutation().Remove(data); }
+    } registered(Uint64Texels.data(), sizeof(Uint64Texels));
+    SetClassRecords();
+    for (std::uint32_t x = 0; x < Width; ++x) Uint64Texels[x] = 0x5000000000000000ull + x;
+    SetRecord(9, PointClamp, Image(Uint64Texels.data(), Format32_32UInt));
+    Keys = {};
+    Keys[0] = 9;
+    const auto added = Run(device, AtomicAdd64LaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic64 test");
+    Require(!Faulted(added), "image table atomic64: an add through a table faulted:\n" + added.log);
+    Require(added.imageTableCount != 0u, "image table atomic64: the add bound no storage table elements");
+    for (std::uint32_t x = 0; x < Width; ++x) Require(Uint64Texels[x] == 0x5000000000000000ull + x + x, "image table atomic64: texel " + std::to_string(x) + " is wrong");
+    Keys[0] = 6;
+    const auto null = Run(device, AtomicAdd64LaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic64 test");
+    for (std::uint32_t x = 0; x < Width; ++x) Require(Uint64Texels[x] == 0x5000000000000000ull + x + x, "image table atomic64: an add through a null entry reached an image:\n" + null.log);
+}
+
 void RunSelectedStoreTests(AgcDriver::VulkanDevice& device) {
     alignas(256) static std::array<std::uint32_t, Width * Height> storeTexels{};
     struct Registration {
@@ -1509,6 +1594,8 @@ int main() {
         RunSelectedRecordTests(*device);
         RunModeTests(*device);
         RunStoreTests(*device);
+        RunAtomicTests(*device);
+        RunAtomic64Tests(*device);
         RunSelectedStoreTests(*device);
         RunPointerTests(*device);
         RunPointerRecordTests(*device);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp
index 9c332e8aaa..913426408a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp
@@ -262,6 +262,7 @@ struct Generator {
         if (half) return bits;
         const auto value = std::bit_cast<float>(bits);
         if (!std::isfinite(value) || std::fabs(value) > 65504.0f) return Half();
+        if (value == 0.0f) return bits;
         const auto exponent = std::max(std::ilogb(value) - 10, -24);
         return std::bit_cast<std::uint32_t>(static_cast<float>(std::ldexp(std::nearbyint(std::ldexp(value, -exponent)), exponent)));
     }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp
index c149aa41a9..0e677dd20c 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp
@@ -1,5 +1,12 @@
+#include "prx/libSceAgcDriver/libSceAgcDriver.hpp"
+#include "prx/libSceAgc/libSceAgc.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceJobManager/libSceJobManager.hpp"
 #include "VulkanTestDevice.hpp"
 #include "SceTypes.hpp"
+#include <algorithm>
+#include "prx/libc/include/GuestArena.hpp"
 #include <array>
 #include <atomic>
 #include <chrono>
@@ -11,61 +18,8 @@
 #include <stdexcept>
 #include <string>
 #include <thread>
+#include <vector>
 
-extern "C" void AgcDriverShutdown_nid_postfix();
-
-struct MemorySizeQueryParams {
-    std::uint32_t version;
-    std::uint32_t workers;
-    std::uint32_t sequences;
-    std::uint32_t invocations;
-    std::uint32_t dispatches;
-    std::uint32_t syncPoints;
-    std::uint32_t waits;
-    std::uint32_t computeSequences;
-    std::uint64_t computeQueueMask;
-};
-
-struct ConfigParams {
-    std::uint32_t version;
-    std::uint32_t threadFlags;
-    std::uint32_t stackSize;
-    std::uint32_t priority;
-    const char* threadName;
-    std::uint32_t spinMicroseconds;
-    std::uint32_t computeAffinity;
-    std::uint32_t computePriority;
-    std::uint32_t reserved;
-};
-
-using JobEntry = void (APS5_VABI*)(void*, std::uint32_t);
-
-struct Sequence {
-    APS5_VABI virtual int Dispatch(JobEntry, void*, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int SyncPoint() = 0;
-    APS5_VABI virtual int Wait() = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-    APS5_VABI virtual int DispatchCompute(const void*, void*, std::int32_t, std::int32_t, std::int32_t, const char*) = 0;
-    APS5_VABI virtual int DispatchComputeIndirect(const void*, void*, const void*, const char*) = 0;
-};
-
-struct SequenceFactory {
-    APS5_VABI virtual int Create(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int Destroy(Sequence*) = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-    APS5_VABI virtual int CreateCompute(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int DestroyCompute(Sequence*) = 0;
-};
-
-extern "C" {
-void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void*);
-std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams*);
-int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void*, void*, std::uint64_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint64_t, const ConfigParams*);
-int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void*);
-SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void*, std::uint32_t);
-}
 
 #define Construct _ZN3sce3Job10JobManagerC1Ev
 #define RequiredSize _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE
@@ -94,10 +48,10 @@ alignas(256) volatile std::uint32_t Output[4]{};
 alignas(256) std::array<std::uint32_t, 4> OutputDescriptor{};
 alignas(32) std::array<std::uint32_t, 8> IndirectArguments{1, 1, 1, 0, 0, 0, 0, 0};
 alignas(16) std::array<std::uint32_t, 8> Specials{};
-alignas(16) std::array<std::uint32_t, 8> SpecialsWithoutDispatch{};
+alignas(16) std::array<std::uint32_t, 8> SpecialsDefaultModifier{};
 std::array<ShaderRegister, 9> Registers{};
 alignas(16) std::array<unsigned char, 0x80> Shader{};
-alignas(16) std::array<unsigned char, 0x80> ShaderWithoutDispatch{};
+alignas(16) std::array<unsigned char, 0x80> ShaderDefaultModifier{};
 
 std::uint32_t Low(const volatile void* pointer) {
     return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(pointer));
@@ -115,8 +69,8 @@ void BuildShader() {
                   {0x242, Low(OutputDescriptor.data())}, {0x243, High(OutputDescriptor.data())}}};
     Specials[4] = 1;
     const ShaderRegister* registers = Registers.data();
-    for (auto* shader : {&Shader, &ShaderWithoutDispatch}) {
-        const std::uint32_t* specials = shader == &Shader ? Specials.data() : SpecialsWithoutDispatch.data();
+    for (auto* shader : {&Shader, &ShaderDefaultModifier}) {
+        const std::uint32_t* specials = shader == &Shader ? Specials.data() : SpecialsDefaultModifier.data();
         std::memcpy(shader->data() + 0x20, &registers, sizeof(registers));
         std::memcpy(shader->data() + 0x28, &specials, sizeof(specials));
         (*shader)[0x5c] = static_cast<unsigned char>(Registers.size());
@@ -130,6 +84,7 @@ std::uint64_t SizeFor(std::uint32_t computeSequences, std::uint64_t mask, bool l
 
 std::atomic<bool> Released{false};
 std::atomic<std::uint32_t> SeenByJob{0};
+std::atomic<std::uint32_t> SecondSeenByJob{0};
 
 void APS5_VABI BlockingJob(void*, std::uint32_t) {
     while (!Released) std::this_thread::yield();
@@ -139,15 +94,21 @@ void APS5_VABI ReadOutputJob(void*, std::uint32_t) {
     SeenByJob = Output[0];
 }
 
+void APS5_VABI ReadBothOutputsJob(void* argument, std::uint32_t) {
+    SeenByJob = Output[0];
+    SecondSeenByJob = Output[1];
+    std::atomic_ref<std::uint32_t>(*static_cast<std::uint32_t*>(argument)).store(1);
+}
+
 void APS5_VABI Nothing(void*, std::uint32_t) {
 }
 
 void SizeCase() {
     Require(SizeFor(0, 0, false) == 0x10d0 && SizeFor(0, 0, true) == 0x14c0, "size without compute sequences");
-    Require(SizeFor(1, 1, false) == 0x24fd8 && SizeFor(1, 1, true) == 0x253c8, "size with one compute sequence");
-    Require(SizeFor(2, 3, false) == 0x48e20 && SizeFor(2, 3, true) == 0x49210, "size with two compute sequences");
-    Require(SizeFor(3, 7, false) == 0x6cb68, "size with three compute sequences");
-    Require(SizeFor(1, 3, true) == 0x491c8, "size with two queues for one compute sequence");
+    Require(SizeFor(1, 1, false) == 0x29fd8 && SizeFor(1, 1, true) == 0x2a3c8, "size with one compute sequence");
+    Require(SizeFor(2, 3, false) == 0x52de0 && SizeFor(2, 3, true) == 0x531d0, "size with two compute sequences");
+    Require(SizeFor(3, 7, false) == 0x7bb28, "size with three compute sequences");
+    Require(SizeFor(1, 3, true) == 0x53188, "size with two queues for one compute sequence");
     Require(SizeFor(2, 1, true) == 0, "size with fewer queues than compute sequences");
 }
 
@@ -165,9 +126,9 @@ void RunCase() {
     Require(Initialize(manager, memory, size, 2, 1, 1, 2, &wideAffinity) == InvalidArgument, "a handler affinity beyond 13 cores was accepted");
     Require(Initialize(manager, memory, size, 2, 1, 0xffffffffu, 2, nullptr) == InvalidArgument, "a sequence count that wraps was accepted");
     Require(Initialize(manager, memory, size, 2, 1, 1, 2, nullptr) == 0, "initialize with one compute sequence failed");
-    SequenceFactory* factory = Factories(manager, 0);
-    Sequence* sequence = nullptr;
-    Sequence* other = nullptr;
+    ISequenceFactory* factory = Factories(manager, 0);
+    ISequence* sequence = nullptr;
+    ISequence* other = nullptr;
     Require(factory->CreateCompute(&sequence, 100, 4, 4, 2, "compute") == 0, "the compute sequence was not created");
     Require(factory->CreateCompute(&other, 1, 1, 1, 1, "second") == NoneFree, "a second compute sequence was created");
     Require(factory->Create(&other, 1, 1, 1, 1, "cpu") == 0, "the CPU sequence was not created");
@@ -192,24 +153,30 @@ void RunCase() {
     Require(Output[0] == 0x22220002u, "the indirect compute dispatch had not run when the wait returned: " + std::to_string(Output[0]));
 
     Value[0] = 0x33330003u;
-    Require(sequence->DispatchCompute(ShaderWithoutDispatch.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the dispatch of a shader without the dispatch bit failed");
-    Require(sequence->Wait() == 0, "the wait after a shader without the dispatch bit failed");
-    Require(Output[0] == 0x22220002u, "a shader without the dispatch bit ran");
+    Require(sequence->DispatchCompute(ShaderDefaultModifier.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the dispatch with a default modifier failed");
+    Require(sequence->Wait() == 0, "the wait after a default modifier dispatch failed");
+    Require(Output[0] == 0x33330003u, "a default modifier dispatch did not run");
 
+    Value[0] = 0x33330004u;
+    Require(sequence->DispatchComputeIndirect(ShaderDefaultModifier.data(), Table.data(), IndirectArguments.data(), nullptr) == 0, "the indirect dispatch with a default modifier failed");
+    Require(sequence->Wait() == 0, "the wait after an indirect default modifier dispatch failed");
+    Require(Output[0] == 0x33330004u, "an indirect default modifier dispatch did not run");
+
+    Value[0] = 0x33330005u;
     Require(sequence->Dispatch(BlockingJob, nullptr, 1, "blocking") == 0, "the blocking job was not dispatched");
     Require(sequence->SyncPoint() == 0, "the sync point failed");
     Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the compute dispatch behind a sync point failed");
     std::this_thread::sleep_for(std::chrono::milliseconds(200));
-    Require(Output[0] == 0x22220002u, "a compute dispatch ran before the CPU job ahead of its sync point finished");
+    Require(Output[0] == 0x33330004u, "a compute dispatch ran before the CPU job ahead of its sync point finished");
     Released = true;
     Require(sequence->SyncPoint() == 0, "the second sync point failed");
     Require(sequence->Dispatch(ReadOutputJob, nullptr, 1, "reader") == 0, "the reading job was not dispatched");
     Require(sequence->Wait() == 0, "the wait after the ordered dispatches failed");
-    Require(Output[0] == 0x33330003u, "the compute dispatch behind a sync point did not run");
-    Require(SeenByJob == 0x33330003u, "a CPU job behind a sync point ran before the compute dispatch ahead of it finished");
+    Require(Output[0] == 0x33330005u, "the compute dispatch behind a sync point did not run");
+    Require(SeenByJob == 0x33330005u, "a CPU job behind a sync point ran before the compute dispatch ahead of it finished");
 
     Value[0] = 0x44440004u;
-    Require(sequence->DispatchCompute(ShaderWithoutDispatch.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the leading dispatch failed");
+    Require(sequence->DispatchCompute(ShaderDefaultModifier.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the leading dispatch failed");
     Require(sequence->SyncPoint() == 0, "the sync point between compute dispatches failed");
     Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, "behind") == 0, "the compute dispatch behind a compute dispatch failed");
     Require(sequence->Wait() == 0, "the wait after chained compute dispatches failed");
@@ -229,16 +196,395 @@ void RunCase() {
     ::operator delete(memory, std::align_val_t{256});
 }
 
+void CapacityCase() {
+    std::array<ShaderRegister, 255> registers;
+    registers.fill(Registers[2]);
+    std::copy(Registers.begin(), Registers.end(), registers.begin());
+    auto shader = Shader;
+    const ShaderRegister* data = registers.data();
+    std::memcpy(shader.data() + 0x20, &data, sizeof(data));
+    shader[0x5c] = static_cast<unsigned char>(registers.size());
+    const std::string marker(65535, 'm');
+    const MemorySizeQueryParams query{1, 1, 0, 0, 2, 0, 1, 1, 1};
+    const auto size = RequiredSize(&query);
+    const auto allocationSize = (size + 255) & ~std::uint64_t{255};
+    auto* memory = static_cast<std::uint8_t*>(::operator new(allocationSize, std::align_val_t{256}));
+    std::memset(memory, 0, allocationSize);
+    std::memset(memory + size, 0xa5, allocationSize - size);
+    alignas(64) unsigned char manager[0x100]{};
+    Construct(manager);
+    Require(Initialize(manager, memory, size, 1, 0, 1, 1, nullptr) == 0, "capacity manager initialization failed");
+    auto* factory = Factories(manager, 0);
+    ISequence* sequence = nullptr;
+    Require(factory->CreateCompute(&sequence, 0, 2, 0, 1, nullptr) == 0, "capacity sequence creation failed");
+    for (std::uint32_t round = 0; round < 2; ++round) {
+        Value[0] = 0xabcd0000u + round;
+        for (int dispatch = 0; dispatch < 2; ++dispatch)
+            Require(sequence->DispatchCompute(shader.data(), Table.data(), 1, 1, 1, marker.c_str()) == 0, "maximum register and marker dispatch failed");
+        Require(sequence->Wait() == 0, "maximum packet wait failed");
+        Require(Output[0] == Value[0], "maximum packet dispatch did not finish");
+        const auto* words = reinterpret_cast<const std::uint32_t*>(memory);
+        std::uint32_t markers = 0;
+        for (std::size_t offset = 0; offset + 0x4001 <= size / 4; ++offset) {
+            if (words[offset] != 0xffff102cu) continue;
+            Require(std::memcmp(words + offset + 1, marker.c_str(), marker.size() + 1) == 0, "maximum marker was truncated");
+            ++markers;
+        }
+        Require(markers == 2, "the maximum markers were not stored in the command area");
+    }
+    Require(factory->DestroyCompute(sequence) == 0, "capacity sequence destruction failed");
+    Require(Shutdown(manager) == 0, "capacity manager shutdown failed");
+    for (auto offset = size; offset < allocationSize; ++offset)
+        Require(memory[offset] == 0xa5, "maximum packets escaped the supplied work area");
+    ::operator delete(memory, std::align_val_t{256});
 }
 
-int main() {
+void DeferredInputsCase(bool mixed) {
+    for (const bool indirect : {false, true}) {
+        const auto size = SizeFor(1, 1, true);
+        auto* memory = static_cast<std::uint8_t*>(::operator new(size, std::align_val_t{256}));
+        std::memset(memory, 0, size);
+        alignas(64) unsigned char manager[0x100]{};
+        Construct(manager);
+        Require(Initialize(manager, memory, size, 2, 1, 1, 1, nullptr) == 0, "snapshot manager initialization failed");
+        auto* factory = Factories(manager, 0);
+        ISequence* sequence = nullptr;
+        Require(factory->CreateCompute(&sequence, 1, 3, 1, 1, nullptr) == 0, "snapshot sequence creation failed");
+        auto registers = Registers;
+        auto shader = Shader;
+        const ShaderRegister* pointer = registers.data();
+        std::memcpy(shader.data() + 0x20, &pointer, sizeof(pointer));
+        alignas(16) const std::array<std::uint32_t, 4> redirected{Low(Output + 1), High(Output + 1) & 0xffffu, sizeof(Output[1]), 0x31016facu};
+        const std::string expected = indirect ? "snapshot indirect" : "snapshot direct";
+        std::array<char, 32> marker{};
+        std::memcpy(marker.data(), expected.c_str(), expected.size() + 1);
+        Released = false;
+        Output[0] = 0;
+        Output[1] = 0;
+        Value[0] = indirect ? 0x51a70002u : 0x51a70001u;
+        if (mixed) Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "snapshot parallel compute dispatch failed");
+        Require(sequence->Dispatch(BlockingJob, nullptr, 1, nullptr) == 0, "snapshot blocking job failed");
+        Require(sequence->SyncPoint() == 0, "snapshot sync point failed");
+        const int result = indirect ? sequence->DispatchComputeIndirect(shader.data(), Table.data(), IndirectArguments.data(), marker.data())
+                                    : sequence->DispatchCompute(shader.data(), Table.data(), 1, 1, 1, marker.data());
+        Require(result == 0, "snapshot dispatch failed");
+        const bool encoded = std::search(memory, memory + size, expected.begin(), expected.end()) != memory + size;
+        registers[7].value = Low(redirected.data());
+        registers[8].value = High(redirected.data());
+        std::memset(marker.data(), 'x', expected.size());
+        Released = true;
+        Require(sequence->Wait() == 0, "snapshot wait failed");
+        const bool updated = Output[0] == (mixed ? Value[0] : 0) && Output[1] == Value[0];
+        const bool markerUpdated = std::search(memory, memory + size, marker.begin(), marker.begin() + expected.size()) != memory + size;
+        Require(factory->DestroyCompute(sequence) == 0, "snapshot destruction failed");
+        Require(Shutdown(manager) == 0, "snapshot shutdown failed");
+        ::operator delete(memory, std::align_val_t{256});
+        Require(!encoded, "compute commands were encoded before their CPU barrier retired");
+        Require(updated, "queued compute commands did not read their deferred shader registers");
+        Require(markerUpdated, "queued compute commands did not read their deferred marker");
+    }
+}
+
+void GpuBarriersCase() {
+    for (const bool indirect : {false, true}) {
+        const auto size = SizeFor(1, 2, true);
+        auto* memory = static_cast<std::uint8_t*>(::operator new(size, std::align_val_t{256}));
+        std::memset(memory, 0, size);
+        alignas(64) unsigned char manager[0x100]{};
+        Construct(manager);
+        Require(Initialize(manager, memory, size, 2, 1, 1, 2, nullptr) == 0, "GPU barrier initialization failed");
+        auto* factory = Factories(manager, 0);
+        ISequence* sequence = nullptr;
+        Require(factory->CreateCompute(&sequence, 1, 8, 4, 2, nullptr) == 0, "GPU barrier sequence creation failed");
+        auto registers = Registers;
+        auto shader = Shader;
+        const ShaderRegister* pointer = registers.data();
+        std::memcpy(shader.data() + 0x20, &pointer, sizeof(pointer));
+        alignas(16) const std::array<std::uint32_t, 4> redirected{Low(Output + 1), High(Output + 1) & 0xffffu, sizeof(Output[1]), 0x31016facu};
+        alignas(64) std::uint32_t gate = 0;
+        alignas(256) std::array<std::uint32_t, 32> commands{};
+        CommandBuffer buffer{commands.data(), commands.data() + commands.size(), commands.data(), commands.data() + commands.size(), nullptr, nullptr, 0};
+        Require(sceAgcAcbWaitRegMem(&buffer, 0, 3, 3, &gate, 1, 0xffffffffu, 0x190) != nullptr, "GPU barrier gate encoding failed");
+        const Packet packet{commands.data(), static_cast<std::uint32_t>(buffer.cursor_up - commands.data()), 0, {}};
+        Require(sceAgcDriverSubmitAcb(0x21, &packet) == 0, "GPU barrier gate submission failed");
+        Output[0] = 0;
+        Output[1] = 0;
+        Value[0] = indirect ? 0x51a80002u : 0x51a80001u;
+        Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, "first") == 0, "GPU barrier first dispatch failed");
+        Require(sequence->SyncPoint() == 0, "GPU barrier sync point failed");
+        const std::string expected = indirect ? "GPU barrier indirect" : "GPU barrier direct";
+        std::array<char, 32> marker{};
+        std::memcpy(marker.data(), expected.c_str(), expected.size() + 1);
+        const int result = indirect ? sequence->DispatchComputeIndirect(shader.data(), Table.data(), IndirectArguments.data(), marker.data())
+                                    : sequence->DispatchCompute(shader.data(), Table.data(), 1, 1, 1, marker.data());
+        Require(result == 0, "GPU barrier second dispatch failed");
+        const bool encoded = std::search(memory, memory + size, expected.begin(), expected.end()) != memory + size;
+        registers[7].value = Low(redirected.data());
+        registers[8].value = High(redirected.data());
+        std::memset(marker.data(), 'x', expected.size());
+        std::atomic_ref<std::uint32_t>(gate).store(1);
+        Require(sequence->Wait() == 0, "GPU barrier wait failed");
+        Require(encoded, "GPU-only sync deferred the following dispatch inputs");
+        Require(Output[0] == Value[0] && Output[1] == 0, "GPU-only sync did not capture shader registers before dispatch returned");
+        alignas(16) const std::array<std::uint32_t, 2> dependentTable{Low(Output), High(Output)};
+        for (std::uint32_t round = 0; round < 3; ++round) {
+            Output[0] = 0;
+            Output[1] = 0;
+            Value[0] = 0x52a80000u + round;
+            std::atomic_ref<std::uint32_t>(gate).store(0);
+            Require(sceAgcDriverSubmitAcb(0x21, &packet) == 0, "GPU dependency gate submission failed");
+            Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "GPU dependency producer failed");
+            Require(sequence->SyncPoint() == 0, "GPU dependency sync failed");
+            Require(sequence->DispatchCompute(shader.data(), const_cast<std::uint32_t*>(dependentTable.data()), 1, 1, 1, nullptr) == 0, "GPU dependency consumer failed");
+            std::atomic_ref<std::uint32_t>(gate).store(1);
+            Require(sequence->Wait() == 0, "GPU dependency wait failed");
+            Require(Output[0] == Value[0] && Output[1] == Value[0], "GPU sync did not make producer writes visible to its consumer");
+        }
+        if (!indirect) {
+            alignas(64) std::uint32_t overlapGate = 0;
+            alignas(256) std::array<std::uint32_t, 32> overlapCommands{};
+            CommandBuffer overlapBuffer{overlapCommands.data(), overlapCommands.data() + overlapCommands.size(), overlapCommands.data(), overlapCommands.data() + overlapCommands.size(), nullptr, nullptr, 0};
+            Require(sceAgcAcbWaitRegMem(&overlapBuffer, 0, 3, 3, &overlapGate, 1, 0xffffffffu, 0x190) != nullptr, "GPU overlap gate encoding failed");
+            const Packet overlapPacket{overlapCommands.data(), static_cast<std::uint32_t>(overlapBuffer.cursor_up - overlapCommands.data()), 0, {}};
+            Output[0] = 0;
+            Output[1] = 0;
+            std::atomic_ref<std::uint32_t>(gate).store(0);
+            Require(sceAgcDriverSubmitAcb(0x21, &packet) == 0, "GPU overlap gate submission failed");
+            Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "GPU overlap producer failed");
+            Require(sequence->SyncPoint() == 0, "GPU overlap sync failed");
+            Require(sceAgcDriverSubmitAcb(0x21, &overlapPacket) == 0, "GPU overlap gate submission failed");
+            Require(sequence->DispatchCompute(shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "GPU overlap consumer failed");
+            Require(sequence->Dispatch(ReadBothOutputsJob, &overlapGate, 1, nullptr) == 0, "GPU overlap CPU callback failed");
+            std::atomic<bool> missedDeadline{false};
+            std::jthread rescue([&](std::stop_token stop) {
+                const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+                const std::atomic_ref<std::uint32_t> signal(overlapGate);
+                while (!stop.stop_requested() && signal.load() == 0 && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+                if (signal.load() == 0) {
+                    missedDeadline = true;
+                    signal.store(1);
+                }
+            });
+            std::atomic_ref<std::uint32_t>(gate).store(1);
+            Require(sequence->Wait() == 0, "GPU overlap wait failed");
+            rescue.request_stop();
+            rescue.join();
+            Require(!missedDeadline, "CPU work did not release GPU work beyond its preceding sync");
+            Require(SeenByJob == Value[0] && SecondSeenByJob == 0, "CPU work waited for GPU work beyond its preceding sync");
+            Require(Output[1] != 0, "GPU overlap consumer did not finish before Wait returned");
+            alignas(16) const std::array<std::uint32_t, 4> originalTarget{Low(Output + 2), High(Output + 2) & 0xffffu, sizeof(Output[2]), 0x31016facu};
+            alignas(16) const std::array<std::uint32_t, 4> changedTarget{Low(Output + 3), High(Output + 3) & 0xffffu, sizeof(Output[3]), 0x31016facu};
+            Output[2] = 0;
+            Output[3] = 0;
+            registers[7].value = Low(originalTarget.data());
+            registers[8].value = High(originalTarget.data());
+            const std::string afterWait = "after waiting caller";
+            std::memcpy(marker.data(), afterWait.c_str(), afterWait.size() + 1);
+            std::atomic_ref<std::uint32_t>(gate).store(0);
+            Require(sceAgcDriverSubmitAcb(0x21, &packet) == 0, "GPU wait-boundary gate submission failed");
+            Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "GPU wait-boundary producer failed");
+            Require(sequence->SyncPoint() == 0, "GPU wait-boundary sync failed");
+            Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "GPU wait-boundary second dispatch failed");
+            std::atomic<bool> waiting{false};
+            std::thread waiter([&] {
+                waiting.store(true);
+                Require(sequence->Wait() == 0, "GPU wait-boundary first wait failed");
+            });
+            while (!waiting.load()) std::this_thread::yield();
+            std::this_thread::sleep_for(std::chrono::milliseconds(50));
+            Require(sequence->DispatchCompute(shader.data(), Table.data(), 1, 1, 1, marker.data()) == 0, "GPU dispatch after a queued wait failed");
+            const bool crossedWait = std::search(memory, memory + size, afterWait.begin(), afterWait.end()) != memory + size;
+            registers[7].value = Low(changedTarget.data());
+            registers[8].value = High(changedTarget.data());
+            std::atomic_ref<std::uint32_t>(gate).store(1);
+            waiter.join();
+            Require(sequence->Wait() == 0, "GPU wait-boundary final wait failed");
+            Require(!crossedWait && Output[2] == 0 && Output[3] == Value[0], "compute lookahead crossed a waiting caller's boundary");
+        }
+        Require(factory->DestroyCompute(sequence) == 0, "GPU barrier destruction failed");
+        Require(Shutdown(manager) == 0, "GPU barrier shutdown failed");
+        ::operator delete(memory, std::align_val_t{256});
+    }
+}
+
+void ComputeShutdownCase() {
+    for (const std::uint32_t mode : {0u, 1u, 2u}) {
+        const bool waiting = mode == 1;
+        const bool queuedCpu = mode == 2;
+        const auto size = SizeFor(1, 2, true);
+        const auto allocationSize = (size + 255) & ~std::uint64_t{255};
+        auto* memory = static_cast<std::uint8_t*>(::operator new(allocationSize, std::align_val_t{256}));
+        std::memset(memory, 0, size);
+        std::memset(memory + size, 0xa5, allocationSize - size);
+        alignas(64) unsigned char manager[0x100]{};
+        Construct(manager);
+        Require(Initialize(manager, memory, size, 2, 1, 1, 2, nullptr) == 0, "compute shutdown initialization failed");
+        auto* factory = Factories(manager, 0);
+        ISequence* sequence = nullptr;
+        Require(factory->CreateCompute(&sequence, 1, 4, 2, 2, nullptr) == 0, "compute shutdown sequence creation failed");
+        auto registers = Registers;
+        auto shader = Shader;
+        alignas(16) const std::array<std::uint32_t, 4> descriptor{Low(Output + 1), High(Output + 1) & 0xffffu, sizeof(Output[1]), 0x31016facu};
+        registers[7].value = Low(descriptor.data());
+        registers[8].value = High(descriptor.data());
+        const ShaderRegister* registerPointer = registers.data();
+        std::memcpy(shader.data() + 0x20, &registerPointer, sizeof(registerPointer));
+        alignas(64) std::uint32_t gate = 0;
+        alignas(256) std::array<std::uint32_t, 32> commands{};
+        CommandBuffer buffer{commands.data(), commands.data() + commands.size(), commands.data(), commands.data() + commands.size(), nullptr, nullptr, 0};
+        Require(sceAgcAcbWaitRegMem(&buffer, 0, 3, 3, &gate, 1, 0xffffffffu, 0x190) != nullptr, "compute shutdown gate encoding failed");
+        const Packet packet{commands.data(), static_cast<std::uint32_t>(buffer.cursor_up - commands.data()), 0, {}};
+        Require(sceAgcDriverSubmitAcb(0x21, &packet) == 0, "compute shutdown gate submission failed");
+        Output[0] = 0;
+        Output[1] = 0;
+        SeenByJob = 0;
+        Value[0] = 0x5a170000u + mode;
+        Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "compute shutdown first dispatch failed");
+        Require(sequence->SyncPoint() == 0, "compute shutdown first sync failed");
+        if (queuedCpu) {
+            Require(sequence->Dispatch(ReadOutputJob, nullptr, 1, nullptr) == 0, "compute shutdown queued CPU dispatch failed");
+            Require(sequence->SyncPoint() == 0, "compute shutdown second sync failed");
+        }
+        Require(sequence->DispatchCompute(shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "compute shutdown second dispatch failed");
+        std::atomic<bool> waitingStarted{false};
+        std::atomic<bool> waitingReturned{false};
+        std::thread waiter;
+        if (waiting) {
+            waiter = std::thread([&] {
+                waitingStarted.store(true);
+                Require(sequence->Wait() == 0, "compute shutdown canceled wait failed");
+                waitingReturned.store(true);
+            });
+            while (!waitingStarted.load()) std::this_thread::yield();
+            std::this_thread::sleep_for(std::chrono::milliseconds(50));
+            Require(!waitingReturned.load(), "compute shutdown wait passed the held GPU gate");
+        }
+        std::atomic<bool> stopped{false};
+        std::thread stopper([&] {
+            Require(Shutdown(manager) == 0, "compute shutdown failed");
+            stopped.store(true);
+        });
+        const auto stopDeadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+        while (!stopped.load() && std::chrono::steady_clock::now() < stopDeadline) std::this_thread::yield();
+        const bool stoppedBeforeGpu = stopped.load();
+        while (waiting && !waitingReturned.load() && std::chrono::steady_clock::now() < stopDeadline) std::this_thread::yield();
+        const bool waiterBeforeGpu = !waiting || waitingReturned.load();
+        std::atomic_ref<std::uint32_t>(gate).store(1);
+        stopper.join();
+        if (waiting) waiter.join();
+        alignas(256) Label fence{};
+        alignas(256) std::array<std::uint32_t, 32> tailWords{};
+        CommandBuffer tail{tailWords.data(), tailWords.data() + tailWords.size(), tailWords.data(), tailWords.data() + tailWords.size(), nullptr, nullptr, 0};
+        Require(sceAgcCbReleaseMem(&tail, 0x2f, 0x200, 1, 3, &fence, 1, 1, 0, 0, 0, 0) != nullptr, "compute shutdown tail fence encoding failed");
+        const Packet tailPacket{tailWords.data(), static_cast<std::uint32_t>(tail.cursor_up - tailWords.data()), 0, {}};
+        Require(sceAgcDriverSubmitAcb(0x21, &tailPacket) == 0, "compute shutdown tail fence submission failed");
+        const auto gpuDeadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+        while (fence.value != 1 && std::chrono::steady_clock::now() < gpuDeadline) std::this_thread::yield();
+        Require(fence.value == 1, "submitted compute work did not survive manager shutdown");
+        Require(stoppedBeforeGpu && waiterBeforeGpu, "shutdown waited for GPU completion");
+        Require(Output[0] == Value[0] && Output[1] == (queuedCpu ? 0 : Value[0]), "shutdown changed submitted or deferred compute work");
+        Require(SeenByJob == 0, "shutdown published queued CPU work after GPU completion");
+        for (auto offset = size; offset < allocationSize; ++offset) Require(memory[offset] == 0xa5, "compute shutdown wrote past the caller work area");
+        ::operator delete(memory, std::align_val_t{256});
+    }
+}
+
+void StorageCase(bool directMemory) {
+    constexpr std::uint64_t mask = (1u << 1) | (1u << 5) | (1u << 8);
+    const MemorySizeQueryParams query{1, 2, 0, 0, 32, 8, 4, 2, mask};
+    const auto size = RequiredSize(&query);
+    const auto allocationSize = (size + 0xffff) & ~std::uint64_t{0xffff};
+    std::int64_t physical = 0;
+    void* memory = nullptr;
+    if (directMemory) {
+        Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, allocationSize, 0x10000, 0, &physical) == 0, "direct work area allocation failed");
+        Require(sceKernelMapDirectMemory(&memory, allocationSize, 0x33, 0, physical, 0x10000) == 0, "direct work area mapping failed");
+    } else {
+        memory = ::operator new(allocationSize, std::align_val_t{256});
+    }
+    {
+        const GuestArena::HostWrite destination(memory, allocationSize);
+        std::memset(memory, 0, allocationSize);
+        std::memset(static_cast<std::uint8_t*>(memory) + size, 0xa5, allocationSize - size);
+    }
+    alignas(64) unsigned char manager[0x100]{};
+    Construct(manager);
+    Require(Initialize(manager, memory, size, 2, 0, 2, mask, nullptr) == 0, "storage manager initialization failed");
+    const auto inside = [memory, size](const void* pointer) {
+        const auto base = reinterpret_cast<std::uintptr_t>(memory);
+        const auto address = reinterpret_cast<std::uintptr_t>(pointer);
+        return address >= base && address < base + size;
+    };
+    void* implementation = nullptr;
+    std::memcpy(&implementation, manager, sizeof(implementation));
+    Require(inside(implementation), "manager state is outside the supplied work area");
+    auto* factory = Factories(manager, 0);
+    Require(inside(factory), "compute factory is outside the supplied work area");
+    std::array<ISequence*, 2> sequences{};
+    for (auto& sequence : sequences) {
+        Require(factory->CreateCompute(&sequence, 0, 16, 4, 2, nullptr) == 0, "storage sequence creation failed");
+        Require(inside(sequence), "compute sequence is outside the supplied work area");
+    }
+    for (std::uint32_t round = 0; round < 3; ++round) {
+        for (auto* sequence : sequences) {
+            Value[0] = 0x56780000u + round;
+            for (int dispatch = 0; dispatch < 8; ++dispatch)
+                Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, "batch") == 0, "batched dispatch failed");
+            Require(sequence->Wait() == 0, "batched wait failed");
+            Require(Output[0] == Value[0], "batched work was not visible after wait");
+            Require(sequence->Wait() == 0, "empty wait after a batch failed");
+        }
+        const auto* words = static_cast<const std::uint32_t*>(memory);
+        const auto base = reinterpret_cast<std::uintptr_t>(memory);
+        std::vector<std::uintptr_t> labels;
+        for (std::size_t index = 0; index + 8 <= size / 4; ++index) {
+            if (words[index] != 0xc0064900u || (words[index + 2] & 0xe7000000u) != 0x22000000u) continue;
+            const auto address = words[index + 3] | (std::uint64_t{words[index + 4]} << 32);
+            Require(address >= base && address + 8 <= base + size && (address & 7) == 0, "a completion label is outside the caller's work area");
+            Require(words[index + 5] == 8 * (round + 1) && words[index + 6] == 0, "a completion did not publish the batched 32-bit count");
+            Require(*reinterpret_cast<const volatile std::uint64_t*>(address) == words[index + 5], "a published batch was not retired");
+            labels.push_back(address);
+        }
+        Require(labels.size() == 2 && labels[0] != labels[1], "each queue must store one batch completion in the caller's work area");
+    }
+    for (auto* sequence : sequences) Require(factory->DestroyCompute(sequence) == 0, "storage sequence destruction failed");
+    for (auto& sequence : sequences) {
+        Require(factory->CreateCompute(&sequence, 0, 16, 4, 2, nullptr) == 0, "storage sequence reuse failed");
+        Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "dispatch after sequence reuse failed");
+        Require(factory->DestroyCompute(sequence) == 0, "destroy did not wait for reused sequence work");
+    }
+    Require(Shutdown(manager) == 0, "storage manager shutdown failed");
+    const auto* bytes = static_cast<const std::uint8_t*>(memory);
+    for (auto offset = size; offset < allocationSize; ++offset)
+        Require(bytes[offset] == 0xa5, "the manager wrote beyond its supplied work area");
+    if (directMemory) Require(sceKernelReleaseDirectMemory(physical, allocationSize) == 0, "direct work area release failed");
+    else ::operator delete(memory, std::align_val_t{256});
+}
+
+}
+
+int RunJobManagerCase(const char* name) {
     try {
+        Require(std::strcmp(name, "compute") == 0 || std::strcmp(name, "size") == 0 || std::strcmp(name, "execution") == 0 || std::strcmp(name, "storage") == 0 || std::strcmp(name, "capacity") == 0 || std::strcmp(name, "deferred_inputs") == 0 || std::strcmp(name, "gpu_barriers") == 0 || std::strcmp(name, "compute_shutdown") == 0, "unknown compute fixture");
+#ifndef ANYPS5_JOB_MANAGER_REFERENCE
         auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
         device.reset();
+#endif
         BuildShader();
-        SizeCase();
-        RunCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "size") == 0) SizeCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "execution") == 0) RunCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "capacity") == 0) CapacityCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "deferred_inputs") == 0) {
+            DeferredInputsCase(false);
+            DeferredInputsCase(true);
+        }
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "gpu_barriers") == 0) GpuBarriersCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "compute_shutdown") == 0) ComputeShutdownCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "storage") == 0) {
+            StorageCase(false);
+            StorageCase(true);
+        }
         AgcDriverShutdown_nid_postfix();
         std::cout << "job manager compute test passed\n";
         return 0;
@@ -252,3 +598,10 @@ int main() {
         return 1;
     }
 }
+
+#ifndef ANYPS5_JOB_MANAGER_REFERENCE
+int main(int argc, char** argv) {
+    if (argc > 2) return 2;
+    return RunJobManagerCase(argc == 2 ? argv[1] : "compute");
+}
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LazyResolvedAbi.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LazyResolvedAbi.cpp
new file mode 100644
index 0000000000..aad7c87ddb
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LazyResolvedAbi.cpp
@@ -0,0 +1,636 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ShaderPreparationScope.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <chrono>
+#include <random>
+#include <set>
+#include <sstream>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <initializer_list>
+#include <iostream>
+#include <iterator>
+#include <map>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Textures = 16;
+constexpr std::uint32_t VertexBuffers = 3;
+constexpr std::uint32_t MaxDraws = 2048;
+constexpr std::uint32_t Format8888UNorm = 56;
+constexpr std::uint32_t Type2D = 9;
+constexpr std::uint32_t ClampEdge = 2;
+constexpr std::uint32_t TexelByte = 4;
+constexpr std::size_t SrtOffset = 0;
+constexpr std::size_t SamplerOffset = 0x200;
+constexpr std::size_t FrameConstantsOffset = 0x210;
+constexpr std::size_t VertexTableOffset = 0x300;
+constexpr std::size_t FrameDataOffset = 0x400;
+constexpr std::size_t VertexDataOffset = 0x800;
+constexpr std::size_t TextureOffset = 0x1000;
+constexpr std::size_t TextureBytes = 4096;
+constexpr std::size_t ObjectOffset = TextureOffset + Textures * TextureBytes;
+constexpr std::size_t ObjectBytes = 256;
+constexpr std::size_t ColorOffset = (ObjectOffset + MaxDraws * ObjectBytes + 65535) & ~static_cast<std::size_t>(65535);
+constexpr std::size_t ColorBytes = 65536;
+constexpr std::uint32_t RenderTargetTileMode = 0x1b;
+constexpr std::size_t BlockBytes = (ColorOffset + ColorBytes + 65535) & ~static_cast<std::size_t>(65535);
+
+alignas(256) constexpr std::array<std::uint32_t, 40> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060280u, 0x7e0802f2u,
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0xf4080300u, 0xfa000020u,
+    0xbf8cc07fu,
+    0xe00c2000u, 0x80010a05u, 0xe00c2000u, 0x80020e05u, 0xe00c2000u, 0x80031205u,
+    0xbf8c3f70u,
+    0x0602030au, 0x0604050bu, 0x0606070cu, 0x0608090du,
+    0x0602030eu, 0x0604050fu, 0x06060710u, 0x06080911u,
+    0x06020312u, 0x06040513u, 0x06060714u, 0x06080915u,
+    0xf80008cfu, 0x04030201u,
+    0xbf810000u, 0xbf810000u,
+};
+
+constexpr std::size_t PixelWords = 10 + Textures * 10 + 5 + 8 + 3;
+
+constexpr std::array<std::uint32_t, PixelWords> MakePixelCode() {
+    std::array<std::uint32_t, PixelWords> code{};
+    std::size_t n = 0;
+    for (const auto word : {0xf4080200u, 0xfa000200u, 0xf4080300u, 0xfa000210u, 0x7e0002f0u, 0x7e0202f0u, 0x7e100280u, 0x7e120280u, 0x7e140280u, 0x7e160280u}) code[n++] = word;
+    for (std::uint32_t texture = 0; texture < Textures; ++texture) {
+        for (const auto word : {0xf40c0400u, 0xfa000000u | (texture * 32u), 0xbf8cc07fu, 0xf09c0f08u, 0x00440400u, 0xbf8c3f70u, 0x06101104u, 0x06121305u, 0x06141506u, 0x06161707u}) code[n++] = word;
+    }
+    for (const auto word : {0xf4200606u, 0xfa000000u, 0xf4200642u, 0xfa000000u, 0xbf8cc07fu}) code[n++] = word;
+    for (const auto word : {0x10101018u, 0x10121218u, 0x10141418u, 0x10161618u, 0x10101019u, 0x10121219u, 0x10141419u, 0x10161619u}) code[n++] = word;
+    for (const auto word : {0xf800180fu, 0x0b0a0908u, 0xbf810000u}) code[n++] = word;
+    return code;
+}
+
+alignas(256) constexpr std::array<std::uint32_t, PixelWords> PixelCode = MakePixelCode();
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Register(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536));
+        if (block != nullptr) GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, PAGE_READWRITE, BlockBytes);
+#else
+        constexpr std::uintptr_t alignment = 65536;
+        void* mapped = mmap(nullptr, BlockBytes + alignment, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (mapped != MAP_FAILED) {
+            const auto begin = reinterpret_cast<std::uintptr_t>(mapped);
+            const auto aligned = (begin + alignment - 1) & ~(alignment - 1);
+            if (aligned != begin) munmap(mapped, aligned - begin);
+            if (aligned + BlockBytes != begin + BlockBytes + alignment) munmap(reinterpret_cast<void*>(aligned + BlockBytes), begin + alignment - aligned);
+            block = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(block, BlockBytes);
+        }
+#endif
+        Require(block != nullptr, "lazy resolved ABI: cannot allocate the guest block");
+        std::memset(block, 0, BlockBytes);
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint64_t At(std::size_t offset) const { return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(block + offset)); }
+    std::uint8_t* Bytes(std::size_t offset) const { return block + offset; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+struct Layout {
+    const GuestBlock& data;
+    const GuestBlock& textures;
+    const GuestBlock& target;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(std::uint64_t address, std::uint32_t stride, std::uint32_t records, std::uint32_t word3) {
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), records, word3};
+}
+
+void Prepare(const Layout& layout) {
+    const auto& block = layout.data;
+    for (std::uint32_t texture = 0; texture < Textures; ++texture) {
+        const auto address = layout.textures.At(TextureOffset + texture * TextureBytes);
+        std::memset(layout.textures.Bytes(TextureOffset + texture * TextureBytes), static_cast<int>(TexelByte), TextureBytes);
+        const std::array<std::uint32_t, 8> words{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format8888UNorm << 20u) | (3u << 30u), 7u << 14u, 0xfacu | (Type2D << 28u), 0u, 0u, 0u, 0u};
+        std::memcpy(block.Bytes(SrtOffset + texture * 32u), words.data(), sizeof(words));
+    }
+    const std::array<std::uint32_t, 4> sampler{ClampEdge | (ClampEdge << 3u) | (ClampEdge << 6u), 0u, 0u, 0u};
+    std::memcpy(block.Bytes(SamplerOffset), sampler.data(), sizeof(sampler));
+    const auto frame = BufferDescriptor(block.At(FrameDataOffset), 0, 256, 0x31016facu);
+    std::memcpy(block.Bytes(FrameConstantsOffset), frame.data(), sizeof(frame));
+    const float one = 1.0f;
+    std::memcpy(block.Bytes(FrameDataOffset), &one, sizeof(one));
+    for (std::uint32_t buffer = 0; buffer < VertexBuffers; ++buffer) {
+        const auto vertices = BufferDescriptor(block.At(VertexDataOffset + buffer * 0x100u), 16, 3, 0x0104dfacu);
+        std::memcpy(block.Bytes(VertexTableOffset + buffer * 16u), vertices.data(), sizeof(vertices));
+    }
+    for (std::uint32_t draw = 0; draw < MaxDraws; ++draw) std::memcpy(block.Bytes(ObjectOffset + draw * ObjectBytes), &one, sizeof(one));
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+constexpr std::pair<std::uint32_t, std::uint32_t> PrimitiveType{0x242, 4};
+
+std::vector<std::pair<std::uint32_t, std::uint32_t>> DrawContext(const Layout& layout, std::uint32_t blend = 0) {
+    const auto color = layout.target.At(ColorOffset);
+    const float scale = 32.0f;
+    return {
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x9000000u | (RenderTargetTileMode << 14u)}, {0x1e0, blend},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x318, static_cast<std::uint32_t>(color >> 8u)}, {0x390, static_cast<std::uint32_t>(color >> 40u)},
+        {0x10f, std::bit_cast<std::uint32_t>(scale)}, {0x110, std::bit_cast<std::uint32_t>(scale)},
+        {0x111, std::bit_cast<std::uint32_t>(-2.0f)}, {0x112, std::bit_cast<std::uint32_t>(2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+    };
+}
+
+std::vector<std::uint32_t> Commands(const Layout& layout, std::uint32_t draws, std::uintptr_t pixel = reinterpret_cast<std::uintptr_t>(PixelCode.data()), std::uint32_t blend = 0) {
+    const auto& block = layout.data;
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto srt = block.At(SrtOffset);
+    const auto table = block.At(VertexTableOffset);
+    const auto context = DrawContext(layout, blend);
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 2u << 1u},
+        {0x8c, static_cast<std::uint32_t>(table)}, {0x8d, static_cast<std::uint32_t>(table >> 32u)},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 8u << 1u},
+        {0x00c, static_cast<std::uint32_t>(srt)}, {0x00d, static_cast<std::uint32_t>(srt >> 32u)}, {0x00e, 0}, {0x00f, 0},
+    };
+    std::vector<std::uint32_t> commands;
+    Append(commands, 0x79, {PrimitiveType.first, PrimitiveType.second});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    for (std::uint32_t draw = 0; draw < draws; ++draw) {
+        const auto object = BufferDescriptor(block.At(ObjectOffset + draw * ObjectBytes), 0, 16, 0x31016facu);
+        Append(commands, 0x76, {0x010, object[0], object[1], object[2], object[3]});
+        Append(commands, 0x2d, {3, 2});
+    }
+    return commands;
+}
+
+double Submit(std::vector<std::uint32_t>& commands) {
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    const auto start = std::chrono::steady_clock::now();
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "lazy resolved ABI: the draw submission failed");
+    AgcDriverWaitIdle_nid_postfix();
+    return std::chrono::duration<double, std::micro>(std::chrono::steady_clock::now() - start).count();
+}
+
+unsigned ColorByte(const GuestBlock& block) {
+    AgcDriver::GuestMemory::FlushGpuWrites(static_cast<std::uintptr_t>(block.At(ColorOffset)), ColorBytes);
+    unsigned brightest = 0;
+    for (std::size_t i = 0; i < ColorBytes; ++i) brightest = std::max(brightest, static_cast<unsigned>(block.Bytes(ColorOffset)[i]));
+    return brightest;
+}
+
+void Check(const Layout& layout) {
+    std::memset(layout.target.Bytes(ColorOffset), 0, ColorBytes);
+    auto commands = Commands(layout, 16);
+    Submit(commands);
+    const auto byte = ColorByte(layout.target);
+    Require(byte == Textures * TexelByte, "lazy resolved ABI: 16 draws sampling 16 textures of byte " + std::to_string(TexelByte) + " wrote " + std::to_string(byte) + ", expected " + std::to_string(Textures * TexelByte));
+}
+
+
+std::vector<std::uint32_t> SyntheticPixelCode(std::uint32_t index, std::uint32_t blocks) {
+    std::vector<std::uint32_t> code;
+    code.reserve(PixelCode.size() + 2 + blocks * 8);
+    code.push_back(0x7e1802ffu);
+    code.push_back(0x3f800000u + index);
+    for (const auto word : PixelCode) {
+        if (word == 0xf800180fu) {
+            for (std::uint32_t block = 0; block < blocks; ++block) {
+                for (const auto multiply : {0x10101018u, 0x10121218u, 0x10141418u, 0x10161618u, 0x10101019u, 0x10121219u, 0x10141419u, 0x10161619u}) code.push_back(multiply);
+            }
+        }
+        code.push_back(word);
+    }
+    return code;
+}
+
+struct SyntheticHeader {
+    Shader shader{};
+    ShaderUserData userData{};
+    std::array<ShaderRegister, 4> registers{};
+    std::array<ShaderRegister, 1> context{{{0x1b6, 0}}};
+};
+
+struct Synthetic {
+    SyntheticHeader header;
+    std::uint32_t* code = nullptr;
+};
+
+class ProgramArena {
+public:
+    explicit ProgramArena(std::size_t size) : bytes((size + 65535u) & ~std::size_t{65535}) {
+#ifdef _WIN32
+        base = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, 65536));
+        if (base != nullptr) GuestArena::GuestArenaCommit_nid_postfix(base, bytes, PAGE_READWRITE, bytes);
+#else
+        void* mapped = mmap(nullptr, bytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        base = mapped != MAP_FAILED ? static_cast<std::uint8_t*>(mapped) : nullptr;
+#endif
+        Require(base != nullptr, "lazy resolved ABI: cannot allocate the program arena");
+        GuestAllocations::Mutation().Add(base, bytes, true, true, true);
+    }
+    ProgramArena(const ProgramArena&) = delete;
+    ProgramArena& operator=(const ProgramArena&) = delete;
+    std::uint32_t* Place(std::span<const std::uint32_t> code) {
+        const auto aligned = (used + 255u) & ~std::size_t{255};
+        Require(aligned + code.size_bytes() <= bytes, "lazy resolved ABI: the program arena is full");
+        auto* destination = reinterpret_cast<std::uint32_t*>(base + aligned);
+        std::memcpy(destination, code.data(), code.size_bytes());
+        used = aligned + code.size_bytes();
+        return destination;
+    }
+
+private:
+    std::size_t bytes;
+    std::size_t used = 0;
+    std::uint8_t* base = nullptr;
+};
+
+void RegisterHeader(Synthetic& program, std::uint32_t* code, std::size_t words) {
+    program.code = code;
+    const auto address = reinterpret_cast<std::uintptr_t>(program.code);
+    auto& header = program.header;
+    header.registers = {{{0x008, static_cast<std::uint32_t>(address >> 8u)}, {0x009, static_cast<std::uint32_t>(address >> 40u)}, {0x00b, 8u << 1u}, {0x00a, 0}}};
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(SyntheticHeader);
+    header.shader.shader_size = static_cast<std::uint32_t>(words * sizeof(std::uint32_t));
+    header.shader.code = program.code;
+    header.shader.type = 1;
+    header.shader.user_data = &header.userData;
+    header.shader.sh_registers = header.registers.data();
+    header.shader.num_sh_registers = static_cast<std::uint32_t>(header.registers.size());
+    header.shader.cx_registers = header.context.data();
+    header.shader.num_cx_registers = static_cast<std::uint32_t>(header.context.size());
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void RegisterSynthetic(Synthetic& program, ProgramArena& arena, const std::vector<std::uint32_t>& code) {
+    RegisterHeader(program, arena.Place(code), code.size());
+}
+
+constexpr std::uint32_t Programs = 4;
+constexpr std::uint32_t Drawn = 2;
+
+void SetEnvironment(const char* name, const std::string& value) {
+#ifdef _WIN32
+    _putenv_s(name, value.c_str());
+#else
+    setenv(name, value.c_str(), 1);
+#endif
+}
+
+void ClearEnvironment(const char* name) {
+#ifdef _WIN32
+    _putenv_s(name, "");
+#else
+    unsetenv(name);
+#endif
+}
+
+void Settle(std::span<const Synthetic> programs) {
+    std::vector<const Shader*> registered;
+    for (const auto& program : programs) registered.push_back(&program.header.shader);
+    AgcDriverEndShaderPreparation_nid_postfix(AgcDriverBeginShaderPreparation_nid_postfix(registered.data(), registered.size()));
+    AgcDriverWaitIdle_nid_postfix();
+}
+
+std::vector<std::uint8_t> Draw(const Layout& layout, const Synthetic& program) {
+    std::memset(layout.target.Bytes(ColorOffset), 0, ColorBytes);
+    auto commands = Commands(layout, 1, reinterpret_cast<std::uintptr_t>(program.code));
+    Submit(commands);
+    AgcDriver::GuestMemory::FlushGpuWrites(static_cast<std::uintptr_t>(layout.target.At(ColorOffset)), ColorBytes);
+    return {layout.target.Bytes(ColorOffset), layout.target.Bytes(ColorOffset) + ColorBytes};
+}
+
+std::size_t Entries(const Synthetic& program) {
+    return AgcDriver::DriverDetail::Driver::Get().PreparedEntries(&program.header.shader);
+}
+
+std::string Uses(const AgcDriver::DriverDetail::Driver::DeferredAbiUseCounts& uses) {
+    return std::to_string(uses.firstUses) + " first uses, " + std::to_string(uses.found) + " found, " + std::to_string(uses.own) + " own, " + std::to_string(uses.unmatchedEntries) + " of " + std::to_string(uses.entries) + " entries unmatched";
+}
+
+constexpr std::uint32_t Matching = Programs;
+constexpr std::uint32_t Twice = Programs + 1;
+constexpr std::uint32_t Replaced = Programs + 2;
+constexpr std::uint32_t Replacement = Programs + 3;
+constexpr std::array<std::uint32_t, 6> DrawnPrograms{0, 1, Matching, Twice, Replaced, Replacement};
+
+bool RegistrationAbi(std::uint32_t index) {
+    return index < Programs || index == Twice;
+}
+
+using Report = std::map<std::string, std::string>;
+
+std::string Text(std::span<const std::array<std::uint64_t, 2>> hashes) {
+    std::string text = std::to_string(hashes.size());
+    char word[40];
+    for (const auto& hash : hashes) {
+        std::snprintf(word, sizeof(word), " %016llx%016llx", static_cast<unsigned long long>(hash[1]), static_cast<unsigned long long>(hash[0]));
+        text += word;
+    }
+    return text;
+}
+
+std::string Text(const std::array<std::uint64_t, 4>& libraries) {
+    std::string text;
+    for (const auto count : libraries) text += (text.empty() ? "" : " ") + std::to_string(count);
+    return text;
+}
+
+std::size_t Count(const std::string& text) {
+    return static_cast<std::size_t>(std::stoull(text.substr(0, text.find(' '))));
+}
+
+std::vector<std::string> Prints(const std::string& text) {
+    std::vector<std::string> prints;
+    std::istringstream stream(text);
+    std::string word;
+    stream >> word;
+    while (stream >> word) prints.push_back(word);
+    std::ranges::sort(prints);
+    return prints;
+}
+
+std::string Joined(std::span<const std::string> prints) {
+    std::string text = std::to_string(prints.size());
+    for (const auto& print : prints) text += " " + print;
+    return text;
+}
+
+std::vector<std::string> EagerResolutionEntries(const Report& eager, std::uint32_t index) {
+    const auto id = std::to_string(index);
+    const auto registered = Prints(eager.at("registered " + id));
+    const auto drawn = Prints(eager.at("drawn " + id));
+    if (RegistrationAbi(index)) return drawn;
+    std::vector<std::string> made;
+    std::ranges::set_difference(drawn, registered, std::back_inserter(made));
+    return made;
+}
+
+Report Scenario(const Layout& layout, std::vector<std::uint8_t>& first, std::array<AgcDriver::DriverDetail::Driver::DeferredAbiUseCounts, 3>* uses = nullptr) {
+    auto& driver = AgcDriver::DriverDetail::Driver::Get();
+    Report report;
+    report["libraries before"] = Text(driver.PrebuiltLibraries());
+    ProgramArena arena(1u << 20u);
+    std::vector<Synthetic> programs(Replacement + 1);
+    const auto record = [&](const char* phase, std::uint32_t index) {
+        report[std::string(phase) + " " + std::to_string(index)] = Text(driver.PreparedEntryHashes(&programs[index].header.shader));
+    };
+    const auto resolved = std::span(programs).first(Replaced + 1);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) RegisterSynthetic(programs[index], arena, SyntheticPixelCode(index + 1, 0));
+    Settle(resolved);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) record("registered", index);
+    std::vector<ShaderRegister> context;
+    for (const auto& [offset, value] : DrawContext(layout)) context.push_back({offset, value});
+    std::array<ShaderRegister, 1> primitive{{{PrimitiveType.first, PrimitiveType.second}}};
+    for (std::uint32_t index = 0; index < Programs; ++index) AgcDriverResolveShaderAbi_nid_postfix(&programs[index].header.shader, {}, {});
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Matching].header.shader, context, primitive);
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Twice].header.shader, {}, {});
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Twice].header.shader, context, primitive);
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Replaced].header.shader, context, primitive);
+    for (auto& reg : context) reg.value = ~reg.value;
+    primitive.front().value = ~primitive.front().value;
+    Settle(resolved);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) record("resolved", index);
+    report["libraries resolved"] = Text(driver.PrebuiltLibraries());
+    RegisterHeader(programs[Replacement], programs[Replaced].code, programs[Replaced].header.shader.shader_size / sizeof(std::uint32_t));
+    Settle(std::span(programs).subspan(Replacement, 1));
+    record("registered", Replacement);
+    const auto draw = [&](std::uint32_t index, const Synthetic& program) {
+        auto bytes = Draw(layout, program);
+        Require(std::ranges::any_of(bytes, [](std::uint8_t byte) { return byte != 0; }), "lazy resolved ABI: drawn shader " + std::to_string(index) + " wrote nothing");
+        if (index == 0) first = std::move(bytes);
+    };
+    const auto count = [&](std::size_t slot) {
+        if (uses != nullptr) (*uses)[slot] = AgcDriver::DriverDetail::Driver::DeferredAbiUses();
+    };
+    count(0);
+    for (const auto index : {0u, 1u}) draw(index, programs[index]);
+    count(1);
+    draw(Matching, programs[Matching]);
+    count(2);
+    draw(Twice, programs[Twice]);
+    draw(Replacement, programs[Replacement]);
+    AgcDriverRegisterShader_nid_postfix(&programs[Replaced].header.shader);
+    draw(Replaced, programs[Replaced]);
+    for (std::uint32_t index = 0; index <= Replacement; ++index) record("drawn", index);
+    report["libraries drawn"] = Text(driver.PrebuiltLibraries());
+    return report;
+}
+
+std::filesystem::path ReportPath(const std::filesystem::path& reference) {
+    auto path = reference;
+    path += ".report";
+    return path;
+}
+
+std::set<std::string> CacheFiles(const std::filesystem::path& cache) {
+    std::set<std::string> files;
+    for (const auto& entry : std::filesystem::recursive_directory_iterator(cache)) {
+        if (entry.is_regular_file() && entry.path().filename().string().rfind("vk-pipelines-", 0) != 0) files.insert(std::filesystem::relative(entry.path(), cache).generic_string());
+    }
+    return files;
+}
+
+void EagerReference(const Layout& layout, const std::filesystem::path& output) {
+    std::vector<std::uint8_t> bytes;
+    const auto report = Scenario(layout, bytes);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) Require(Count(report.at("resolved " + std::to_string(index))) != 0, "lazy resolved ABI: eager preparation left resolved shader " + std::to_string(index) + " unprepared");
+    std::ofstream file(output, std::ios::binary | std::ios::trunc);
+    file.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+    Require(file.good(), "lazy resolved ABI: cannot write the eager reference");
+    std::ofstream text(ReportPath(output), std::ios::trunc);
+    for (const auto& [key, value] : report) text << key << '=' << value << '\n';
+    Require(text.good(), "lazy resolved ABI: cannot write the eager report");
+}
+
+void LazyResolution(const Layout& layout, const std::filesystem::path& reference, const std::set<std::string>& cached, const std::filesystem::path& cache) {
+    std::vector<std::uint8_t> expected(ColorBytes);
+    {
+        std::ifstream file(reference, std::ios::binary);
+        file.read(reinterpret_cast<char*>(expected.data()), static_cast<std::streamsize>(expected.size()));
+        Require(file.gcount() == static_cast<std::streamsize>(expected.size()), "lazy resolved ABI: the eager reference is missing or short");
+    }
+    Report eager;
+    {
+        std::ifstream text(ReportPath(reference));
+        for (std::string line; std::getline(text, line);) {
+            const auto split = line.find('=');
+            if (split != std::string::npos) eager[line.substr(0, split)] = line.substr(split + 1);
+        }
+        Require(eager.contains("libraries drawn"), "lazy resolved ABI: the eager report is missing or short");
+    }
+    std::vector<std::uint8_t> first;
+    std::array<AgcDriver::DriverDetail::Driver::DeferredAbiUseCounts, 3> uses{};
+    const auto lazy = Scenario(layout, first, &uses);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) {
+        const auto key = "resolved " + std::to_string(index);
+        Require(Count(lazy.at(key)) == 0, "lazy resolved ABI: ResolveShaderAbi prepared " + std::to_string(Count(lazy.at(key))) + " entries for shader " + std::to_string(index) + " under APS5_LAZY_SHADER_PREPARE");
+    }
+    Require(lazy.at("libraries resolved") == lazy.at("libraries before"), "lazy resolved ABI: ResolveShaderAbi built pipeline libraries under APS5_LAZY_SHADER_PREPARE (" + lazy.at("libraries before") + " before, " + lazy.at("libraries resolved") + " after)");
+    for (std::uint32_t index = 0; index <= Replacement; ++index) Require(Count(lazy.at("registered " + std::to_string(index))) == 0, "lazy resolved ABI: registration prepared shader " + std::to_string(index) + " under APS5_LAZY_SHADER_PREPARE");
+    for (const auto index : DrawnPrograms) {
+        const auto expected = EagerResolutionEntries(eager, index);
+        const auto held = Prints(lazy.at("drawn " + std::to_string(index)));
+        Require(held == expected, "lazy resolved ABI: drawn shader " + std::to_string(index) + " holds other prepared entries than eager resolution and its draw made (eager " + Joined(expected) + "; lazy " + Joined(held) + ")");
+    }
+    for (std::uint32_t index = Drawn; index < Programs; ++index) {
+        const auto key = "drawn " + std::to_string(index);
+        Require(Count(lazy.at(key)) == 0, "lazy resolved ABI: shader " + std::to_string(index) + ", which never drew, holds " + std::to_string(Count(lazy.at(key))) + " prepared entries");
+    }
+    const auto& [start, unmatched, matched] = uses;
+    Require(unmatched.firstUses - start.firstUses == Drawn && unmatched.own - start.own == Drawn && unmatched.found == start.found, "lazy resolved ABI: draws whose state differs from the resolved ABI did not count as preparing their own artifact (before: " + Uses(start) + "; after: " + Uses(unmatched) + ")");
+    Require(unmatched.entries > start.entries && unmatched.unmatchedEntries - start.unmatchedEntries == unmatched.entries - start.entries, "lazy resolved ABI: entries prepared for an ABI no draw used do not count as unmatched (before: " + Uses(start) + "; after: " + Uses(unmatched) + ")");
+    Require(matched.firstUses == unmatched.firstUses + 1 && matched.found == unmatched.found + 1 && matched.own == unmatched.own, "lazy resolved ABI: a draw whose state matches the resolved ABI did not count as finding its artifact (before: " + Uses(unmatched) + "; after: " + Uses(matched) + ")");
+    Require(matched.entries > unmatched.entries && matched.unmatchedEntries == unmatched.unmatchedEntries + (matched.entries - unmatched.entries) - 1, "lazy resolved ABI: the entry a matching draw used still counts as unmatched (before: " + Uses(unmatched) + "; after: " + Uses(matched) + ")");
+    for (const auto index : {Matching, Twice, Replaced}) Require(eager.at("drawn " + std::to_string(index)) == eager.at("resolved " + std::to_string(index)), "lazy resolved ABI: shader " + std::to_string(index) + ", drawn with its resolved ABI's state, did not find the ABI's entries with eager preparation");
+    for (std::uint32_t index = 0; index < Drawn; ++index) Require(Count(eager.at("drawn " + std::to_string(index))) == Count(eager.at("resolved " + std::to_string(index))) + 1, "lazy resolved ABI: a draw whose state differs from its resolved ABI did not prepare its own entry with eager preparation");
+    Require(Count(eager.at("drawn " + std::to_string(Replacement))) == Count(eager.at("registered " + std::to_string(Replacement))) + 1, "lazy resolved ABI: the header registered over a resolved one did not prepare its own entry at its draw with eager preparation");
+    Require(lazy.at("libraries drawn") == eager.at("libraries drawn"), "lazy resolved ABI: the pipeline libraries built differ from eager preparation (eager " + eager.at("libraries drawn") + "; lazy " + lazy.at("libraries drawn") + ")");
+    Require(first == expected, "lazy resolved ABI: the shader prepared at its first draw drew other bytes than with eager preparation");
+    AgcDriverWaitIdle_nid_postfix();
+    const auto files = CacheFiles(cache);
+    std::vector<std::string> added;
+    std::ranges::set_difference(files, cached, std::back_inserter(added));
+    Require(added.empty(), "lazy resolved ABI: preparation at first use wrote " + std::to_string(added.size()) + " shader cache files eager preparation had not, the first " + (added.empty() ? std::string() : added.front()));
+    std::printf("lazy resolved ABI: %u shaders drew, %u of them ABI-resolved; the %u resolved ones that never drew hold no prepared entries; the drawn ones hold the entries eager resolution and their draws made: drawn with their ABI's state they found them, with the ABI register arrays overwritten after resolution (one resolved with two ABIs, one whose header was registered over and again before its draw), drawn with another state they prepared their own; the pipeline libraries built match eager's (%s), a drawn one drew the same %zu bytes, and the lazy run wrote none of the %zu shader cache files eager wrote again\n", static_cast<unsigned>(DrawnPrograms.size()), static_cast<unsigned>(DrawnPrograms.size() - 1), Programs - Drawn, lazy.at("libraries drawn").c_str(), first.size(), cached.size());
+}
+
+}
+
+int main(int argc, char** argv) {
+    const bool eager = argc == 2 && std::string(argv[1]) == "--eager-reference";
+    std::filesystem::path reference;
+    std::filesystem::path cache;
+    std::set<std::string> cached;
+    const auto clean = [&] {
+        if (eager) return;
+        std::error_code ignored;
+        if (!reference.empty()) {
+            std::filesystem::remove(reference, ignored);
+            std::filesystem::remove(ReportPath(reference), ignored);
+        }
+        if (!cache.empty()) std::filesystem::remove_all(cache, ignored);
+    };
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        if (eager) {
+            const char* path = std::getenv("LAZY_RESOLVED_ABI_REFERENCE");
+            Require(path != nullptr, "lazy resolved ABI: the eager child has no reference path");
+            reference = path;
+        } else {
+            const auto run = std::to_string(std::random_device{}());
+            reference = std::filesystem::temp_directory_path() / ("aps5-lazy-resolved-abi-" + run + ".bin");
+            cache = std::filesystem::temp_directory_path() / ("aps5-lazy-resolved-abi-cache-" + run);
+            std::filesystem::create_directories(cache);
+            SetEnvironment("LAZY_RESOLVED_ABI_REFERENCE", reference.string());
+            SetEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
+            SetEnvironment("ANYPS5_SHADER_CACHE_DIR", cache.string());
+            SetEnvironment("APS5_NO_PIPELINE_JOURNAL", "1");
+            ClearEnvironment("APS5_LAZY_SHADER_PREPARE");
+            const std::string command = "\"" + std::string(argv[0]) + "\" --eager-reference";
+            Require(std::system(command.c_str()) == 0, "lazy resolved ABI: the eager reference process failed");
+            cached = CacheFiles(cache);
+            Require(!cached.empty(), "lazy resolved ABI: the eager reference process wrote no shader cache files");
+            SetEnvironment("APS5_LAZY_SHADER_PREPARE", "1");
+        }
+        Register(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+        Register(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+        GuestBlock data;
+        GuestBlock textures;
+        GuestBlock target;
+        const Layout layout{data, textures, target};
+        Prepare(layout);
+        Check(layout);
+        if (eager) EagerReference(layout, reference);
+        else LazyResolution(layout, reference, cached, cache);
+        AgcDriverShutdown_nid_postfix();
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try {
+            AgcDriverShutdown_nid_postfix();
+        } catch (...) {
+        }
+        clean();
+        return 1;
+    }
+    clean();
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp
index 1f8032e93c..250f80264a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp
@@ -325,8 +325,9 @@ void Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, c
     if (expectedDeviceDwords) std::printf("lds lock budget: %s GPU readback verified across 256 lanes\n", name);
 }
 
-void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords) {
+void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords, const char* lds) {
     const auto result = Compile(device, MisalignedCode, ldsDwords);
+    Output.fill(0xdeadbeefu);
     StderrCapture capture;
     try {
         device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(MisalignedCode.data()));
@@ -336,8 +337,9 @@ void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords) {
         throw;
     }
     const auto log = capture.Finish();
-    Require(log.find("BDA access failed: address=0x4 instruction=0x2c bytes=8 ") != std::string::npos && log.find("reason=7") != std::string::npos, "lds lock budget: misaligned ds_add_u64 on device-backed LDS did not fault");
-    std::puts("lds lock budget: misaligned ds_add_u64 faulted");
+    Require(log.find("BDA access failed: address=0x4 instruction=0x2c bytes=8 ") != std::string::npos && log.find("reason=7") != std::string::npos, std::string("lds lock budget: misaligned ds_add_u64 on ") + lds + " LDS did not fault");
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) Require(Output[tid * 2u] == 0u && Output[tid * 2u + 1u] == 0u, std::string("lds lock budget: misaligned ds_add_u64 on ") + lds + " LDS changed the slot: lane " + std::to_string(tid) + " read " + Hex(Output[tid * 2u] | (static_cast<std::uint64_t>(Output[tid * 2u + 1u]) << 32u)));
+    std::printf("lds lock budget: misaligned ds_add_u64 on %s LDS faulted\n", lds);
 }
 
 void LockBudget(AgcDriver::VulkanDevice& device) {
@@ -349,7 +351,8 @@ void LockBudget(AgcDriver::VulkanDevice& device) {
     const auto operations = static_cast<std::uint64_t>(Threads) * Iterations;
     Run(device, UniformCode, "limit", operations, 1, limit / 4u, (limit / 4u + 2u) & ~1u);
     const auto& capabilities = target.supportedCapabilities;
-    if (std::find(capabilities.begin(), capabilities.end(), static_cast<std::uint32_t>(spv::CapabilityInt64Atomics)) != capabilities.end()) Misaligned(device, limit / 4u);
+    if (std::find(capabilities.begin(), capabilities.end(), static_cast<std::uint32_t>(spv::CapabilityInt64Atomics)) != capabilities.end()) Misaligned(device, limit / 4u, "device-backed");
+    Misaligned(device, LdsDwords, "workgroup");
     Run(device, UniformCode, "limit-4", operations, 1, (limit - 4u) / 4u, 0u);
     std::puts("lds lock budget tests passed");
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp
new file mode 100644
index 0000000000..ae9d55e2c0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp
@@ -0,0 +1,92 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 128;
+constexpr std::uint32_t BranchThreads = 64;
+constexpr std::uint32_t Iterations = 0x1000;
+constexpr std::uint32_t Rounds = 16;
+constexpr std::uint32_t LdsDwords = 512;
+alignas(256) std::array<std::uint32_t, 2u * Threads> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 36> BranchCode{
+    0x34040082, 0xe0301000, 0x80000102, 0xbf8c3f70, 0xbe86037e, 0x7da800c0, 0xbf880002, 0xd87c0400,
+    0x00000102, 0xbefe0306, 0x7e0e0500, 0xbf0ac007, 0x850580ff, 0x00001000, 0x7e0c0300, 0xbf068005,
+    0xbf850005, 0xd5430006, 0x02050706, 0x80858105, 0xbf078005, 0xbf85fffb, 0xe0701200, 0x80000602,
+    0xd8340000, 0x00000102, 0xbf8cc07f, 0xbf8a0000, 0x3a0604ff, 0x00000100, 0xd8d80000, 0x04000003,
+    0xbf8cc07f, 0xe0701000, 0x80000402, 0xbf810000,
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::uint32_t BranchResult(std::uint32_t thread) {
+    std::uint32_t value = thread;
+    for (std::uint32_t iteration = 0; iteration < Iterations; ++iteration) value = (value & 0xffffffu) * 3u + 1u;
+    return value;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const auto target = device->ComputeTarget(32);
+        if (target.subgroupSize != 32u) {
+            std::printf("skipped, wave32 programs do not run on 32-lane subgroups (%u lanes)\n", target.subgroupSize);
+            return VulkanTestSkipped;
+        }
+        std::vector<std::uint32_t> userData(4, 0u);
+        const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+        std::copy(output.begin(), output.end(), userData.begin());
+        const std::span<const std::uint32_t> code(BranchCode);
+        const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+        const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, LdsDwords, {false, false, false}, false, 1};
+        ShaderRecompiler::RecompileRequest request{
+            {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+            {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+            target,
+            {0, 0, 0, 128}
+        };
+        request.useCache = false;
+        const auto result = ShaderRecompiler::Recompile(request);
+        std::array<std::uint32_t, Threads> input{};
+        for (std::uint32_t round = 0; round < Rounds; ++round) {
+            for (std::uint32_t thread = 0; thread < Threads; ++thread) input[thread] = (round + 1u) * 0x10000u + thread;
+            Output.fill(0xdeadbeefu);
+            std::copy(input.begin(), input.end(), Output.begin());
+            device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+            device->WaitIdle();
+            for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+                const auto expected = input[thread ^ BranchThreads];
+                Require(Output[thread] == expected, "LDS exchange after a 16-bit LDS store in a branch that waves 0-1 take, round " + std::to_string(round) + ": thread " + std::to_string(thread) + " (wave " + std::to_string(thread / 32u) + ") read " + std::to_string(Output[thread]) + ", expected " + std::to_string(expected));
+            }
+            for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+                const auto expected = thread < BranchThreads ? BranchResult(thread) : thread;
+                Require(Output[Threads + thread] == expected, "loop result of thread " + std::to_string(thread) + " in round " + std::to_string(round));
+            }
+        }
+        std::puts("LDS subword store branch tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCompletionPoints.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCompletionPoints.cpp
new file mode 100644
index 0000000000..8c8bd50ef9
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCompletionPoints.cpp
@@ -0,0 +1,395 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Eq/include/Event.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "prx/libkernel/Equeue/Equeue.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <bit>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <functional>
+#include <initializer_list>
+#include <iostream>
+#include <memory>
+#include <span>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <utility>
+#include <vector>
+
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Width = 256;
+constexpr std::uint32_t Height = 128;
+constexpr std::size_t Pitch = std::size_t{Width} * 4u;
+constexpr std::size_t TargetBytes = Pitch * Height;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::size_t LabelOffset = 3 * BlockBytes;
+constexpr std::uint32_t Untouched = 0x5a5a5a5au;
+constexpr std::uint32_t Drawn = 0xff0000ffu;
+constexpr std::uint32_t LabelValue = 0x600dcafeu;
+constexpr std::uint32_t OutputHandle = 9;
+constexpr std::uint32_t Rgba8UnormInfo = 0x28028u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::array<std::uint32_t, 4> Scissor{32, 16, 160, 80};
+
+alignas(256) constexpr std::array<std::uint32_t, 20> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060208u, 0x7e0802f2u, 0x7e0a02ffu, 0x44800000u, 0xf80000d1u, 0x00000005u, 0xf80008cfu, 0x04030201u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u,
+};
+alignas(256) constexpr std::array<std::uint32_t, 8> PixelCode{0x7e000200u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 9> FillCode{
+    0xd7460004, 0x04010c08, 0x7e000204, 0x7e020205, 0x7e040206, 0x7e060207, 0xe01c2000, 0x80000004, 0xbf810000,
+};
+
+alignas(4) std::atomic<std::uint32_t> Gate = 0;
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+void AppendDraw(std::vector<std::uint32_t>& commands, std::uint64_t target) {
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(PixelCode.data());
+    const auto extent = (Height << 16u) | Width;
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0x01200000}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, Rgba8UnormInfo},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, ((Width - 1u) << 14u) | (Height - 1u)},
+        {0x3b8, LinearAttrib3}, {0x1e0, 0},
+        {0xc, 0}, {0xd, extent},
+        {0x81, 0x80000000}, {0x82, extent},
+        {0x90, 0x80000000u | (Scissor[1] << 16u) | Scissor[0]}, {0x91, (Scissor[3] << 16u) | Scissor[2]},
+        {0x94, 0x80000000}, {0x95, extent},
+        {0x10f, std::bit_cast<std::uint32_t>(2.0f * Width)}, {0x110, std::bit_cast<std::uint32_t>(2.0f * Width)},
+        {0x111, std::bit_cast<std::uint32_t>(2.0f * Height)}, {0x112, std::bit_cast<std::uint32_t>(2.0f * Height)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+        {0x318, static_cast<std::uint32_t>(target >> 8u)}, {0x390, static_cast<std::uint32_t>(target >> 40u)},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 1u << 1u}, {0x8c, 0},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 1u << 1u}, {0x00c, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    Append(commands, 0x79, {0x242, 4});
+    Append(commands, 0x79, {0x24a, 0});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    Append(commands, 0x2d, {3, 2});
+}
+
+void AppendGate(std::vector<std::uint32_t>& commands) {
+    const auto gate = reinterpret_cast<std::uintptr_t>(&Gate);
+    commands.insert(commands.end(), {0xc0053c00u, 0x13u, static_cast<std::uint32_t>(gate), static_cast<std::uint32_t>(gate >> 32u), 1u, 0xffffffffu, 0x19u});
+}
+
+void Submit(std::vector<std::uint32_t>& commands) {
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    AgcDriver::Submit(&packet, 0);
+}
+
+class Region {
+public:
+    Region(std::size_t bytes, bool watched) : bytes(bytes), arena(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (arena) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            if (data != nullptr) GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (arena) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "linear target completion points: cannot map the guest region");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "linear target completion points: cannot allocate the guest region");
+        auto* words = reinterpret_cast<std::uint32_t*>(data);
+        std::fill(words, words + bytes / 4u, Untouched);
+        if (arena && !watched) {
+            AgcDriver::GuestMemory::Unwatch(Address(), bytes);
+            Require(!AgcDriver::GuestMemory::Watched(Address(), bytes), "linear target completion points: the region is still write-watched");
+        }
+        GuestAllocations::Mutation().Add(data, bytes, true, true, true);
+    }
+    ~Region() {
+        GuestAllocations::Mutation().Remove(data);
+#ifdef _WIN32
+        if (arena) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (arena) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Region(const Region&) = delete;
+    Region& operator=(const Region&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::uint32_t Word(std::size_t offset) const { return std::atomic_ref<std::uint32_t>(*reinterpret_cast<std::uint32_t*>(data + offset)).load(std::memory_order_acquire); }
+    std::size_t bytes;
+
+private:
+    bool arena;
+    std::uint8_t* data = nullptr;
+};
+
+void Import(const Region& region) {
+    const auto address = region.Address();
+    const std::vector<std::uint32_t> userData{
+        static_cast<std::uint32_t>(address),
+        static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u),
+        static_cast<std::uint32_t>(region.bytes / 16u),
+        0x4bfacu,
+        Untouched,
+        Untouched,
+        Untouched,
+        Untouched,
+    };
+    std::vector<std::uint32_t> commands;
+    const auto code = reinterpret_cast<std::uintptr_t>(FillCode.data());
+    Append(commands, 0x76, {0x207, 64, 1, 1});
+    Append(commands, 0x76, {0x20c, static_cast<std::uint32_t>(code >> 8u), static_cast<std::uint32_t>(code >> 40u)});
+    Append(commands, 0x76, {0x213, (static_cast<std::uint32_t>(userData.size()) << 1u) | 0x80u});
+    commands.push_back(0xc0007600u | (static_cast<std::uint32_t>(userData.size()) << 16u));
+    commands.push_back(0x240u);
+    commands.insert(commands.end(), userData.begin(), userData.end());
+    commands.insert(commands.end(), {0xc0031500u, static_cast<std::uint32_t>(region.bytes / 1024u), 1, 1, 0x41u});
+    Submit(commands);
+    AgcDriverWaitIdle_nid_postfix();
+}
+
+bool InsideScissor(std::uint32_t x, std::uint32_t y) {
+    return x >= Scissor[0] && x < Scissor[2] && y >= Scissor[1] && y < Scissor[3];
+}
+
+std::string Mismatches(const Region& region) {
+    std::size_t drawn = 0, outside = 0;
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto value = region.Word(y * Pitch + x * 4u);
+            if (InsideScissor(x, y)) drawn += value == Drawn ? 0u : 1u;
+            else outside += value == Untouched ? 0u : 1u;
+        }
+    }
+    if (drawn == 0 && outside == 0) return {};
+    return std::to_string(drawn) + " of the " + std::to_string((Scissor[2] - Scissor[0]) * (Scissor[3] - Scissor[1])) + " pixels inside the scissor do not hold the draw's color and " + std::to_string(outside) + " pixels outside it changed";
+}
+
+bool Await(const std::function<bool()>& done) {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (!done()) {
+        if (std::chrono::steady_clock::now() >= deadline) return false;
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    return true;
+}
+
+class Request final : public AgcDriver::IFlipRequest {
+public:
+    explicit Request(std::atomic<int>& ready) : ready(ready) {}
+    void GpuReady(const std::shared_ptr<AgcDriver::FrameTiming>&) override { ++ready; }
+    void Fail(std::exception_ptr) noexcept override {}
+private:
+    std::atomic<int>& ready;
+};
+
+class Output final : public AgcDriver::IVideoOutput {
+public:
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared<Request>(ready); }
+    void Fail(std::exception_ptr) noexcept override {}
+    std::atomic<int> ready = 0;
+};
+
+enum class Point { Flip, Label, Interrupt };
+
+struct Events {
+    KernelEqueue queue = 0;
+    KernelEqueueRef owner;
+    int tag = 0;
+};
+
+std::string Run(Point point, bool watched, const Region& region, Output& output, Events& events) {
+    const char* name = point == Point::Flip ? "flip" : point == Point::Label ? "label" : "end-of-pipe interrupt";
+    const auto target = region.Address();
+    Import(region);
+    Gate.store(0, std::memory_order_release);
+    std::vector<std::uint32_t> commands;
+    AppendDraw(commands, target);
+    if (point == Point::Flip) {
+        commands.insert(commands.end(), {AgcDriver::FlipPacketHeader, OutputHandle, 0xfffffffeu, 1, 0, 0});
+    } else if (point == Point::Label) {
+        const auto label = target + LabelOffset;
+        commands.insert(commands.end(), {0xc0064900u, 0x514u, 1u << 29u, static_cast<std::uint32_t>(label), static_cast<std::uint32_t>(label >> 32u), LabelValue, 0, 0});
+    } else {
+        commands.insert(commands.end(), {0xc0064900u, 0x06000528u, 2u << 24u, 0, 0, 0, 0, 0});
+    }
+    AppendGate(commands);
+    const auto readyBefore = output.ready.load();
+    if (point == Point::Interrupt) {
+        std::array<KernelEvent, 4> stale{};
+        while (events.owner->GetTriggeredEvents(stale.data(), static_cast<int>(stale.size())) > 0) {}
+    }
+    Submit(commands);
+    const bool watchedAtStore = AgcDriver::GuestMemory::Watched(target, TargetBytes);
+    std::string failure;
+    if (point == Point::Flip) {
+        const bool flipped = Await([&] { return output.ready.load() != readyBefore; });
+        if (!flipped) failure = "the flip did not reach the GPU";
+        else if (!Await([&] { return Mismatches(region).empty(); })) failure = "after the flip, while the queue waited: " + Mismatches(region);
+    } else if (point == Point::Label) {
+        if (!Await([&] { return region.Word(LabelOffset) == LabelValue; })) failure = "the label after the draw never landed";
+        else if (const auto mismatches = Mismatches(region); !mismatches.empty()) failure = "when the label after the draw landed: " + mismatches;
+    } else {
+        std::array<KernelEvent, 1> delivered{};
+        if (!Await([&] { return events.owner->GetTriggeredEvents(delivered.data(), 1) == 1; })) failure = "the end-of-pipe interrupt after the draw was not delivered";
+        else if (delivered[0].udata != &events.tag) failure = "an unexpected event was delivered";
+        else if (const auto mismatches = Mismatches(region); !mismatches.empty()) failure = "when the end-of-pipe interrupt after the draw was delivered: " + mismatches;
+    }
+    Gate.store(1, std::memory_order_release);
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriver::Graphics::StorageTexture::FlushPending(target, region.bytes, nullptr, "test release");
+    std::printf("linear target completion point: %s, %s memory (watched at the store: %d): %s\n", name, watched ? "write-watched" : "unwatched", watchedAtStore ? 1 : 0, failure.empty() ? "stored" : failure.c_str());
+    if (failure.empty()) return {};
+    return std::string(name) + (watched ? " (write-watched memory): " : " (unwatched memory): ") + failure;
+}
+
+}
+
+int main(int argc, char** argv) {
+    try {
+        bool flips = argc == 1, labels = argc == 1, interrupts = argc == 1, watchedFlip = argc == 1;
+        for (int index = 1; index < argc; ++index) {
+            const std::string_view argument(argv[index]);
+            if (argument == "--flip") flips = true;
+            else if (argument == "--label") labels = true;
+            else if (argument == "--interrupt") interrupts = true;
+            else Require(false, "linear target completion points: unknown argument " + std::string(argument));
+        }
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+            if (AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).hostImportAlignment == 0) {
+                std::puts("linear target completion point tests skipped: no host import on this device, so the target is never resident");
+                return VulkanTestSkipped;
+            }
+        }
+        std::vector<std::unique_ptr<Region>> regions;
+        struct ShutdownGuard {
+            ~ShutdownGuard() { try { AgcDriverShutdown_nid_postfix(); } catch (...) {} }
+        } shutdown;
+        Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+        Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+        auto output = std::make_shared<Output>();
+        AgcDriverRegisterVideoOutput_nid_postfix(OutputHandle, output);
+        Events events;
+        if (interrupts) {
+            Require(sceKernelCreateEqueue(&events.queue, "AGC linear target") == 0, "linear target completion points: event queue creation failed");
+            events.owner = EqueuePin_nid_postfix(events.queue);
+            Require(sceAgcDriverAddEqEvent(events.queue, 0, &events.tag) == 0, "linear target completion points: graphics event registration failed");
+        }
+        std::vector<std::string> failures;
+        const auto run = [&](Point point, bool watched) {
+            regions.push_back(std::make_unique<Region>(watched ? 16 * BlockBytes : 4 * BlockBytes, watched));
+            if (auto failure = Run(point, watched, *regions.back(), *output, events); !failure.empty()) failures.push_back(std::move(failure));
+        };
+        if (flips) run(Point::Flip, false);
+        if (watchedFlip) run(Point::Flip, true);
+        if (labels) run(Point::Label, false);
+        if (interrupts) run(Point::Interrupt, false);
+        if (interrupts) {
+            Require(sceAgcDriverDeleteEqEvent(events.queue, 0) == 0, "linear target completion points: graphics event deletion failed");
+            events.owner.reset();
+            Require(sceKernelDeleteEqueue(events.queue) == 0, "linear target completion points: event queue deletion failed");
+        }
+        AgcDriverUnregisterVideoOutput_nid_postfix(OutputHandle, output);
+        if (!failures.empty()) {
+            std::string message = "a CPU read after a point where the guest can observe a draw's completion did not see the drawn linear target:";
+            for (const auto& failure : failures) message += "\n  " + failure;
+            Require(false, message);
+        }
+        AgcDriverShutdown_nid_postfix();
+        std::puts("linear target completion point tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCompletionStores.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCompletionStores.cpp
new file mode 100644
index 0000000000..e6abff0879
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCompletionStores.cpp
@@ -0,0 +1,304 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using AgcDriver::Graphics::StorageTexture;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::size_t TargetBytes = std::size_t{Width} * Height * 16u;
+constexpr std::size_t LabelOffset = BlockBytes;
+constexpr std::uint32_t Rgba32FloatInfo = 0x8738u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t Float32AbgrExport = 9;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 16>, 2> Programs{};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+std::span<const std::uint32_t> Program(std::size_t index, bool blue) {
+    auto& code = Programs.at(index);
+    std::size_t at = 0;
+    code[at++] = 0x36000000u | (20u << 17u) | 0xffu;
+    code[at++] = 0x0000ffffu;
+    code[at++] = 0x2c000000u | (21u << 17u) | 0x90u;
+    code[at++] = 0x7e000c00u | (20u << 17u) | (256u + 20u);
+    code[at++] = 0x7e000c00u | (21u << 17u) | (256u + 21u);
+    code[at++] = (blue ? 0x7e0002f2u : 0x7e000280u) | (22u << 17u);
+    code[at++] = 0x7e0002f2u | (23u << 17u);
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x17161514u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color target");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Rgba32FloatInfo;
+    cx[0x31d] = 0;
+    cx[0x323] = 0;
+    cx[0x324] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = LinearAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    color.exportIndex = 0;
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode, VkRect2D scissor) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Triangle.data(), 16u, static_cast<std::uint32_t>(Triangle.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionFixedPoint);
+    pixel.targetOutputMode.at(0) = Float32AbgrExport;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
+        {waveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.blendEnable = VK_FALSE;
+    blend.colorWriteMask = 0xf;
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = scissor;
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::array<float, 4> Texel(const std::uint8_t* target, std::uint32_t x, std::uint32_t y) {
+    std::array<float, 4> texel{};
+    std::memcpy(texel.data(), target + (static_cast<std::size_t>(y) * Width + x) * 16u, sizeof(texel));
+    return texel;
+}
+
+void Label(AgcDriver::VulkanDevice& device, const Block& block, std::uint32_t value, std::uint64_t submissions, bool watched, const char* what) {
+    const auto bytes = std::as_bytes(std::span(&value, 1));
+    const auto reason = device.WriteLabelOnGpu(block.Address() + LabelOffset, bytes, value, 0);
+    Require(reason == 0, std::string(what) + ": the label was not recorded on the GPU (outcome " + std::to_string(reason) + ")");
+    Require(StorageTexture::FindPending(block.Address(), TargetBytes) == nullptr, std::string(what) + ": the drawn linear target was still pending after a label the GPU writes");
+    const auto* recorder = AgcDriver::Graphics::Recorder::Active();
+    Require(!watched || (recorder != nullptr && recorder->Submissions() == submissions), std::string(what) + ": storing the drawn linear target before the label waited for recorded work (" + std::to_string(recorder != nullptr ? recorder->Submissions() - submissions : 0) + " submissions)");
+}
+
+bool Expect(AgcDriver::VulkanDevice& device) {
+    Block block(16 * BlockBytes);
+    std::fill(block.data, block.data + block.bytes, std::uint8_t{0xff});
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if (AgcDriver::Graphics::HostImportFor(context, block.Address(), block.bytes) == nullptr) return false;
+    const auto color = DecodeTarget(block);
+    Require(color.tileMode == AgcDriver::Graphics::ColorTileMode::Linear && color.bytes == TargetBytes, "the target is not a linear R32G32B32A32 target");
+    const auto red = Program(0, false);
+    const auto blue = Program(1, true);
+    const auto* recorder = AgcDriver::Graphics::Recorder::Active();
+    Require(recorder != nullptr, "the device has no recorder");
+    const bool watched = AgcDriver::GuestMemory::Watched(block.Address(), TargetBytes);
+    if (!watched) std::puts("linear target completion stores: the target is outside the write watch, so a store may wait for the previous store's saved bytes; the submission checks are skipped");
+    const auto pending = [&](const char* what) {
+        Require(StorageTexture::FindPending(block.Address(), TargetBytes) != nullptr, std::string(what) + ": the drawn linear target was stored before any point where its completion is observable");
+    };
+    Draw(device, color, red, {{0, 0}, {Width, Height}});
+    pending("after the first draw");
+    const auto submissions = recorder->Submissions();
+    Draw(device, color, blue, {{0, 0}, {Width / 2u, Height}});
+    pending("after the second draw");
+    Require(!watched || recorder->Submissions() == submissions, "the second draw into the linear target submitted recorded work");
+    Draw(device, color, red, {{Width / 4u, Height / 4u}, {Width / 4u, Height / 2u}});
+    pending("after the third draw");
+    Require(!watched || recorder->Submissions() == submissions, "the third draw into the linear target submitted recorded work");
+    Label(device, block, 1u, submissions, watched, "the first label");
+    Draw(device, color, blue, {{Width / 2u, 0}, {Width / 2u, Height}});
+    pending("after the fourth draw");
+    Label(device, block, 2u, submissions, watched, "the second label");
+    Draw(device, color, red, {{0, Height / 2u}, {Width, Height / 2u}});
+    pending("after the fifth draw");
+    Require(!watched || recorder->Submissions() == submissions, "the fifth draw into the linear target submitted recorded work");
+    device.WaitIdle();
+    Require(StorageTexture::FindPending(block.Address(), TargetBytes) == nullptr, "the drawn linear target was still pending after the device wait");
+    std::vector<std::uint8_t> stored(TargetBytes);
+    std::memcpy(stored.data(), block.data, TargetBytes);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const bool lastRed = y >= Height / 2u;
+            const bool lastBlue = !lastRed && x >= Width / 2u;
+            const bool thirdRed = !lastRed && !lastBlue && x >= Width / 4u && x < Width / 2u && y >= Height / 4u;
+            const bool secondBlue = !lastRed && !lastBlue && !thirdRed;
+            const float z = lastRed || thirdRed ? 0.0f : secondBlue || lastBlue ? 1.0f : -1.0f;
+            const std::array<float, 4> expected{static_cast<float>(x), static_cast<float>(y), z, 1.0f};
+            const auto texel = Texel(stored.data(), x, y);
+            Require(texel == expected, "after the device wait, raw guest read: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") holds (" + std::to_string(texel[0]) + ", " + std::to_string(texel[1]) + ", " + std::to_string(texel[2]) + ", " + std::to_string(texel[3]) + ")");
+        }
+    }
+    std::uint32_t label = 0;
+    std::memcpy(&label, block.data + LabelOffset, sizeof(label));
+    Require(label == 2u, "the second label did not land: it holds " + std::to_string(label));
+    return true;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!Expect(*device)) {
+            std::puts("linear target completion store test skipped: no host import on this device");
+            return VulkanTestSkipped;
+        }
+        std::puts("linear target completion store tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCpuWrites.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCpuWrites.cpp
new file mode 100644
index 0000000000..cbd2e525e4
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetCpuWrites.cpp
@@ -0,0 +1,310 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::size_t TargetBytes = std::size_t{Width} * Height * 16u;
+constexpr std::size_t RowBytes = std::size_t{Width} * 16u;
+constexpr std::uint32_t Drawn = Width / 2u;
+constexpr std::uint32_t Rgba32FloatInfo = 0x8738u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t Float32AbgrExport = 9;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 16>, 2> Programs{};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+std::span<const std::uint32_t> Program(std::size_t index, bool blue) {
+    auto& code = Programs.at(index);
+    std::size_t at = 0;
+    code[at++] = 0x36000000u | (20u << 17u) | 0xffu;
+    code[at++] = 0x0000ffffu;
+    code[at++] = 0x2c000000u | (21u << 17u) | 0x90u;
+    code[at++] = 0x7e000c00u | (20u << 17u) | (256u + 20u);
+    code[at++] = 0x7e000c00u | (21u << 17u) | (256u + 21u);
+    code[at++] = (blue ? 0x7e0002f2u : 0x7e000280u) | (22u << 17u);
+    code[at++] = 0x7e0002f2u | (23u << 17u);
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x17161514u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+struct Block {
+    Block(std::size_t bytes, bool stayWatched) : bytes(bytes), arena(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (arena) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (arena) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color target");
+        Require(!arena || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
+        if (arena && !stayWatched) {
+            AgcDriver::GuestMemory::Unwatch(Address(), bytes);
+            Require(!AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is still write-watched");
+        }
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        AgcDriver::Graphics::StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (arena) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (arena) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool arena;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Rgba32FloatInfo;
+    cx[0x31d] = 0;
+    cx[0x323] = 0;
+    cx[0x324] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = LinearAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    color.exportIndex = 0;
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode, std::uint32_t scissorWidth) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Triangle.data(), 16u, static_cast<std::uint32_t>(Triangle.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionFixedPoint);
+    pixel.targetOutputMode.at(0) = Float32AbgrExport;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
+        {waveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.blendEnable = VK_FALSE;
+    blend.colorWriteMask = 0xf;
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {scissorWidth, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::array<float, 4> Texel(const std::uint8_t* target, std::uint32_t x, std::uint32_t y) {
+    std::array<float, 4> texel{};
+    std::memcpy(texel.data(), target + static_cast<std::size_t>(y) * RowBytes + static_cast<std::size_t>(x) * 16u, sizeof(texel));
+    return texel;
+}
+
+enum class Outcome { Kept, Lost, Skipped };
+
+Outcome Run(AgcDriver::VulkanDevice& device, bool watched, bool seeded, bool hookRead) {
+    const auto name = std::string(seeded ? "seeded" : "unseeded") + ", " + (watched ? "write-watched" : "unwatched") + " memory" + (hookRead ? ", driver read before the store" : "");
+    Block block(watched ? std::size_t{16} * BlockBytes : BlockBytes, watched);
+    std::fill(block.data, block.data + block.bytes, std::uint8_t{0xff});
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if (AgcDriver::Graphics::HostImportFor(context, block.Address(), block.bytes) == nullptr) return Outcome::Skipped;
+    const auto color = DecodeTarget(block);
+    Require(color.tileMode == AgcDriver::Graphics::ColorTileMode::Linear && color.bytes == TargetBytes, "the target is not a linear R32G32B32A32 target");
+    Draw(device, color, Program(0, false), Width);
+    const auto* recorder = AgcDriver::Graphics::Recorder::Active();
+    Require(recorder != nullptr && !recorder->Idle(), "the draw into an imported linear target waited for the GPU instead of being recorded");
+    device.WaitIdle();
+    std::vector<std::uint8_t> stored(TargetBytes);
+    std::memcpy(stored.data(), block.data, TargetBytes);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const std::array<float, 4> expected{static_cast<float>(x), static_cast<float>(y), 0.0f, 1.0f};
+            const auto texel = Texel(stored.data(), x, y);
+            Require(texel == expected, name + ": after the first draw, raw guest read: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") holds (" + std::to_string(texel[0]) + ", " + std::to_string(texel[1]) + ", " + std::to_string(texel[2]) + ", " + std::to_string(texel[3]) + ")");
+        }
+    }
+    if (seeded) {
+        for (std::uint32_t y = 0; y < Height; ++y) std::memset(block.data + y * RowBytes, 0x5a, Drawn * 16u);
+    }
+    Draw(device, color, Program(1, true), Drawn);
+    for (std::uint32_t y = 0; y < Height; ++y) std::memset(block.data + y * RowBytes + Drawn * 16u, 0x42, RowBytes - Drawn * 16u);
+    const bool watchedAtStore = AgcDriver::GuestMemory::Watched(block.Address(), TargetBytes);
+    if (hookRead) {
+        std::vector<std::uint8_t> row(RowBytes);
+        AgcDriver::GuestMemory::Read(block.Address(), std::as_writable_bytes(std::span(row)), 1);
+        for (std::uint32_t x = 0; x < Drawn; ++x) {
+            const std::array<float, 4> expected{static_cast<float>(x), 0.0f, 1.0f, 1.0f};
+            const auto texel = Texel(row.data(), x, 0);
+            Require(texel == expected, name + ": a driver read of row 0 before the store: pixel (" + std::to_string(x) + ", 0) holds (" + std::to_string(texel[0]) + ", " + std::to_string(texel[1]) + ", " + std::to_string(texel[2]) + ", " + std::to_string(texel[3]) + "), not the second draw's");
+        }
+    }
+    device.WaitIdle();
+    std::size_t wrongGpu = 0;
+    std::size_t wrongCpu = 0;
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Drawn; ++x) {
+            const std::array<float, 4> expected{static_cast<float>(x), static_cast<float>(y), 1.0f, 1.0f};
+            if (Texel(block.data, x, y) != expected) ++wrongGpu;
+        }
+        auto* begin = block.data + y * RowBytes + Drawn * 16u;
+        wrongCpu += static_cast<std::size_t>(std::count_if(begin, block.data + (y + 1u) * RowBytes, [](std::uint8_t byte) { return byte != 0x42u; }));
+    }
+    std::printf("linear target CPU writes, %s (watched at the store: %d): wrong GPU pixels %zu/%u, wrong CPU bytes %zu/%zu\n", name.c_str(), watchedAtStore ? 1 : 0, wrongGpu, Drawn * Height, wrongCpu, (RowBytes - Drawn * 16u) * Height);
+    return wrongGpu == 0 && wrongCpu == 0 ? Outcome::Kept : Outcome::Lost;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        bool kept = true;
+        bool ran = false;
+        for (const bool watched : {true, false}) {
+            for (const bool seeded : {false, true}) {
+                for (const bool hookRead : {false, true}) {
+                    const auto outcome = Run(*device, watched, seeded, hookRead);
+                    ran = ran || outcome != Outcome::Skipped;
+                    kept = kept && outcome != Outcome::Lost;
+                }
+            }
+        }
+        if (!ran) {
+            std::puts("linear target CPU write test skipped: no host import on this device");
+            return VulkanTestSkipped;
+        }
+        Require(kept, "a drawn linear target's store lost the drawn half or the CPU's later stores to the other half");
+        std::puts("linear target CPU write tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDirectWriteCompletion.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDirectWriteCompletion.cpp
new file mode 100644
index 0000000000..4a10c86def
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDirectWriteCompletion.cpp
@@ -0,0 +1,452 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <bit>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <functional>
+#include <initializer_list>
+#include <iostream>
+#include <memory>
+#include <mutex>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Width = 256;
+constexpr std::uint32_t Height = 128;
+constexpr std::size_t Pitch = std::size_t{Width} * 4u;
+constexpr std::size_t TargetBytes = Pitch * Height;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::size_t RegionBytes = 16 * BlockBytes;
+constexpr std::size_t LabelOffset = 3 * BlockBytes;
+constexpr std::uint32_t Untouched = 0x5a5a5a5au;
+constexpr std::uint32_t Filled = 0x9abcdef0u;
+constexpr std::uint32_t Drawn = 0xff0000ffu;
+constexpr std::uint32_t LabelValue = 0x600dcafeu;
+constexpr std::uint32_t CpuStored = 0x0badf00du;
+constexpr std::uint32_t Rgba8UnormInfo = 0x28028u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t WaitEqual = 3;
+constexpr std::uint32_t WaitAtLeast = 5;
+constexpr std::array<std::array<std::uint32_t, 4>, 2> Scissors{{{16, 8, 128, 96}, {128, 32, 240, 120}}};
+constexpr std::array<std::uint32_t, 4> BlockZeroScissor{24, 8, 232, 56};
+constexpr std::size_t CpuStoreOffset = BlockBytes + 32 * Pitch + 64 * 4;
+static_assert(BlockZeroScissor[3] * Pitch <= BlockBytes);
+static_assert(CpuStoreOffset >= BlockBytes && CpuStoreOffset < TargetBytes);
+
+alignas(256) constexpr std::array<std::uint32_t, 20> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060208u, 0x7e0802f2u, 0x7e0a02ffu, 0x44800000u, 0xf80000d1u, 0x00000005u, 0xf80008cfu, 0x04030201u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u,
+};
+alignas(256) constexpr std::array<std::uint32_t, 8> PixelCode{0x7e000200u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 9> FillCode{
+    0xd7460004, 0x04010c08, 0x7e000204, 0x7e020205, 0x7e040206, 0x7e060207, 0xe01c2000, 0x80000004, 0xbf810000,
+};
+alignas(256) constexpr std::array<std::uint32_t, 11> PairFillCode{
+    0xd7460004, 0x04010c0c, 0x7e000204, 0x7e020205, 0x7e040206, 0x7e060207, 0xe01c2000, 0x80000004, 0xe01c2000, 0x80020004, 0xbf810000,
+};
+
+alignas(4) std::atomic<std::uint32_t> Gate = 0;
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+void AppendDraw(std::vector<std::uint32_t>& commands, std::uint64_t target, const std::array<std::uint32_t, 4>& scissor) {
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(PixelCode.data());
+    const auto extent = (Height << 16u) | Width;
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0x01200000}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, Rgba8UnormInfo},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, ((Width - 1u) << 14u) | (Height - 1u)},
+        {0x3b8, LinearAttrib3}, {0x1e0, 0},
+        {0xc, 0}, {0xd, extent},
+        {0x81, 0x80000000}, {0x82, extent},
+        {0x90, 0x80000000u | (scissor[1] << 16u) | scissor[0]}, {0x91, (scissor[3] << 16u) | scissor[2]},
+        {0x94, 0x80000000}, {0x95, extent},
+        {0x10f, std::bit_cast<std::uint32_t>(2.0f * Width)}, {0x110, std::bit_cast<std::uint32_t>(2.0f * Width)},
+        {0x111, std::bit_cast<std::uint32_t>(2.0f * Height)}, {0x112, std::bit_cast<std::uint32_t>(2.0f * Height)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+        {0x318, static_cast<std::uint32_t>(target >> 8u)}, {0x390, static_cast<std::uint32_t>(target >> 40u)},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 1u << 1u}, {0x8c, 0},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 1u << 1u}, {0x00c, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    Append(commands, 0x79, {0x242, 4});
+    Append(commands, 0x79, {0x24a, 0});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    Append(commands, 0x2d, {3, 2});
+}
+
+std::array<std::uint32_t, 4> BufferDescriptor(std::uint64_t address, std::size_t bytes) {
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(bytes / 16u), 0x4bfacu};
+}
+
+void AppendDispatch(std::vector<std::uint32_t>& commands, const std::uint32_t* program, const std::vector<std::uint32_t>& userData, std::uint32_t groups) {
+    const auto code = reinterpret_cast<std::uintptr_t>(program);
+    Append(commands, 0x76, {0x207, 64, 1, 1});
+    Append(commands, 0x76, {0x20c, static_cast<std::uint32_t>(code >> 8u), static_cast<std::uint32_t>(code >> 40u)});
+    Append(commands, 0x76, {0x213, (static_cast<std::uint32_t>(userData.size()) << 1u) | 0x80u});
+    commands.push_back(0xc0007600u | (static_cast<std::uint32_t>(userData.size()) << 16u));
+    commands.push_back(0x240u);
+    commands.insert(commands.end(), userData.begin(), userData.end());
+    commands.insert(commands.end(), {0xc0031500u, groups, 1, 1, 0x41u});
+}
+
+void AppendFill(std::vector<std::uint32_t>& commands, std::uint64_t target, const std::uint32_t* copied, std::size_t bytes) {
+    const auto direct = BufferDescriptor(target, bytes);
+    const auto other = BufferDescriptor(reinterpret_cast<std::uintptr_t>(copied), bytes);
+    std::vector<std::uint32_t> userData(direct.begin(), direct.end());
+    userData.insert(userData.end(), {Filled, Filled, Filled, Filled});
+    userData.insert(userData.end(), other.begin(), other.end());
+    AppendDispatch(commands, PairFillCode.data(), userData, static_cast<std::uint32_t>(bytes / 1024u));
+}
+
+void AppendLabel(std::vector<std::uint32_t>& commands, std::uint64_t label) {
+    commands.insert(commands.end(), {0xc0064900u, 0x514u, 1u << 29u, static_cast<std::uint32_t>(label), static_cast<std::uint32_t>(label >> 32u), LabelValue, 0, 0});
+}
+
+void AppendGate(std::vector<std::uint32_t>& commands, std::uint32_t function, std::uint32_t reference) {
+    const auto gate = reinterpret_cast<std::uintptr_t>(&Gate);
+    commands.insert(commands.end(), {0xc0053c00u, 0x10u | function, static_cast<std::uint32_t>(gate), static_cast<std::uint32_t>(gate >> 32u), reference, 0xffffffffu, 0x19u});
+}
+
+void Submit(std::vector<std::uint32_t>& commands) {
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    AgcDriver::Submit(&packet, 0);
+}
+
+class Region {
+public:
+    explicit Region(std::size_t bytes) : bytes(bytes), arena(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (arena) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            if (data != nullptr) GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (arena) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "linear target direct write completion: cannot map the guest region");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "linear target direct write completion: cannot allocate the guest region");
+        auto* words = reinterpret_cast<std::uint32_t*>(data);
+        std::fill(words, words + bytes / 4u, Untouched);
+        GuestAllocations::Mutation().Add(data, bytes, true, true, true);
+    }
+    ~Region() {
+        GuestAllocations::Mutation().Remove(data);
+#ifdef _WIN32
+        if (arena) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (arena) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Region(const Region&) = delete;
+    Region& operator=(const Region&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::uint32_t Word(std::size_t offset) const { return std::atomic_ref<std::uint32_t>(*reinterpret_cast<std::uint32_t*>(data + offset)).load(std::memory_order_acquire); }
+    void Put(std::size_t offset, std::uint32_t value) const { std::atomic_ref<std::uint32_t>(*reinterpret_cast<std::uint32_t*>(data + offset)).store(value, std::memory_order_release); }
+    std::size_t bytes;
+
+private:
+    bool arena;
+    std::uint8_t* data = nullptr;
+};
+
+void Import(const Region& region) {
+    const auto buffer = BufferDescriptor(region.Address(), region.bytes);
+    std::vector<std::uint32_t> userData(buffer.begin(), buffer.end());
+    userData.insert(userData.end(), {Untouched, Untouched, Untouched, Untouched});
+    std::vector<std::uint32_t> commands;
+    AppendDispatch(commands, FillCode.data(), userData, static_cast<std::uint32_t>(region.bytes / 1024u));
+    Submit(commands);
+    AgcDriverWaitIdle_nid_postfix();
+}
+
+bool Covered(std::uint32_t x, std::uint32_t y) {
+    return std::any_of(Scissors.begin(), Scissors.end(), [&](const std::array<std::uint32_t, 4>& scissor) { return x >= scissor[0] && x < scissor[2] && y >= scissor[1] && y < scissor[3]; });
+}
+
+std::string Mismatches(const Region& region, bool drawsLast) {
+    std::size_t covered = 0, wrongCovered = 0, filledCovered = 0, wrongElsewhere = 0, drawnElsewhere = 0;
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto value = region.Word(y * Pitch + x * 4u);
+            if (drawsLast && Covered(x, y)) {
+                ++covered;
+                wrongCovered += value == Drawn ? 0u : 1u;
+                filledCovered += value == Filled ? 1u : 0u;
+            } else {
+                wrongElsewhere += value == Filled ? 0u : 1u;
+                drawnElsewhere += value == Drawn ? 1u : 0u;
+            }
+        }
+    }
+    if (wrongCovered == 0 && wrongElsewhere == 0) return {};
+    const auto elsewhere = std::to_string(std::size_t{Width} * Height - covered);
+    if (!drawsLast) return std::to_string(wrongElsewhere) + " of the " + elsewhere + " pixels do not hold the fill's pattern (" + std::to_string(drawnElsewhere) + " hold the draws' color)";
+    return std::to_string(wrongCovered) + " of the " + std::to_string(covered) + " pixels the draws covered do not hold their color (" + std::to_string(filledCovered) + " hold the fill's pattern) and " + std::to_string(wrongElsewhere) + " of the " + elsewhere + " pixels outside them do not hold the fill's pattern";
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::string CpuStoreMismatches(const Region& region) {
+    std::size_t covered = 0, wrongCovered = 0, filledCovered = 0, others = 0, wrongOthers = 0;
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto offset = y * Pitch + x * 4u;
+            if (offset == CpuStoreOffset) continue;
+            const auto value = region.Word(offset);
+            if (x >= BlockZeroScissor[0] && x < BlockZeroScissor[2] && y >= BlockZeroScissor[1] && y < BlockZeroScissor[3]) {
+                ++covered;
+                wrongCovered += value == Drawn ? 0u : 1u;
+                filledCovered += value == Filled ? 1u : 0u;
+            } else {
+                ++others;
+                wrongOthers += value == (offset < BlockBytes ? Filled : Untouched) ? 0u : 1u;
+            }
+        }
+    }
+    std::vector<std::string> parts;
+    if (wrongCovered != 0) parts.push_back(std::to_string(wrongCovered) + " of the " + std::to_string(covered) + " pixels the draw covered in block 0 do not hold its color (" + std::to_string(filledCovered) + " hold the fill's pattern)");
+    if (const auto stored = region.Word(CpuStoreOffset); stored != CpuStored) parts.push_back("the CPU store in block 1 holds " + Hex(stored) + ", not " + Hex(CpuStored));
+    if (wrongOthers != 0) parts.push_back(std::to_string(wrongOthers) + " of the " + std::to_string(others) + " other pixels do not hold the fill's pattern in block 0 or the untouched pattern in block 1");
+    std::string text;
+    for (const auto& part : parts) text += (text.empty() ? "" : "; ") + part;
+    return text;
+}
+
+bool Await(const std::function<bool()>& done) {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (!done()) {
+        if (std::chrono::steady_clock::now() >= deadline) return false;
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    return true;
+}
+
+enum class Order { FillFirst, DrawsFirst };
+
+bool Run(Order order, const Region& region, std::vector<std::string>& failures) {
+    const bool fillFirst = order == Order::FillFirst;
+    const char* name = fillFirst ? "fill, then draws" : "draws, then fill";
+    const auto target = region.Address();
+    Import(region);
+    if (!AgcDriver::GuestMemory::Watched(target, TargetBytes)) return false;
+    std::vector<std::uint32_t> copied(TargetBytes / 4u + 4u, Untouched);
+    GuestAllocations::Mutation().Add(copied.data(), TargetBytes + 16u, true, true, true);
+    struct Unregister {
+        void* data;
+        ~Unregister() { GuestAllocations::Mutation().Remove(data); }
+    } unregister{copied.data()};
+    Gate.store(0, std::memory_order_release);
+    std::vector<std::uint32_t> commands;
+    if (fillFirst) AppendFill(commands, target, copied.data(), TargetBytes);
+    for (const auto& scissor : Scissors) AppendDraw(commands, target, scissor);
+    if (!fillFirst) AppendFill(commands, target, copied.data(), TargetBytes);
+    AppendLabel(commands, target + LabelOffset);
+    if (fillFirst) AppendGate(commands, WaitEqual, 1);
+    Submit(commands);
+    std::string failure;
+    if (fillFirst) {
+        if (!Await([&] { return region.Word(LabelOffset) == LabelValue; })) failure = "the label after the draws never landed";
+        else if (const auto mismatches = Mismatches(region, true); !mismatches.empty()) failure = "when the label after the draws landed: " + mismatches;
+        Gate.store(1, std::memory_order_release);
+        AgcDriverWaitIdle_nid_postfix();
+    } else {
+        AgcDriverWaitIdle_nid_postfix();
+        if (region.Word(LabelOffset) != LabelValue) failure = "the label after the fill had not landed by the device wait";
+        else if (const auto mismatches = Mismatches(region, false); !mismatches.empty()) failure = "after the label and the device wait: " + mismatches;
+    }
+    AgcDriver::Graphics::StorageTexture::FlushPending(target, region.bytes, nullptr, "test release");
+    std::printf("linear target direct write completion, %s: %s\n", name, failure.empty() ? "the later writer's values" : failure.c_str());
+    if (!failure.empty()) failures.push_back(std::string(name) + ": " + failure);
+    return true;
+}
+
+bool RunCpuStore(bool watched, const Region& region, std::vector<std::string>& failures) {
+    const std::string name = std::string("fill, draw in block 0, CPU store in block 1, ") + (watched ? "write-watched" : "unwatched") + " memory";
+    const auto target = region.Address();
+    Import(region);
+    if (watched && !AgcDriver::GuestMemory::Watched(target, TargetBytes)) return false;
+    if (!watched) {
+        AgcDriver::GuestMemory::Unwatch(target, region.bytes);
+        Require(!AgcDriver::GuestMemory::Watched(target, region.bytes), "linear target direct write completion: the region is still write-watched");
+    }
+    std::vector<std::uint32_t> copied(TargetBytes / 4u + 4u, Untouched);
+    GuestAllocations::Mutation().Add(copied.data(), TargetBytes + 16u, true, true, true);
+    struct Unregister {
+        void* data;
+        ~Unregister() { GuestAllocations::Mutation().Remove(data); }
+    } unregister{copied.data()};
+    Gate.store(0, std::memory_order_release);
+    std::vector<std::uint32_t> commands;
+    AppendFill(commands, target, copied.data(), BlockBytes);
+    AppendDraw(commands, target, BlockZeroScissor);
+    AppendGate(commands, WaitAtLeast, 1);
+    AppendLabel(commands, target + LabelOffset);
+    AppendGate(commands, WaitAtLeast, 2);
+    Submit(commands);
+    const auto completed = [&] { return std::atomic_ref<std::uint32_t>(copied[0]).load(std::memory_order_acquire) == Filled; };
+    bool pendingAtStore = false;
+    const bool recorded = Await([&] {
+        std::unique_lock hold(AgcDriver::GuestMemory::GpuMutex());
+        if (AgcDriver::Graphics::StorageTexture::FindLive(target, TargetBytes) == nullptr) return false;
+        pendingAtStore = !completed();
+        region.Put(CpuStoreOffset, CpuStored);
+        return true;
+    });
+    Gate.store(1, std::memory_order_release);
+    std::string failure;
+    bool completedAtLabel = false;
+    if (!recorded) failure = "the draw into block 0 never made the target's image";
+    else if (!Await([&] { return region.Word(LabelOffset) == LabelValue; })) failure = "the label after the draw never landed";
+    else {
+        completedAtLabel = completed();
+        failure = CpuStoreMismatches(region);
+        if (!failure.empty()) failure = "when the label after the draw landed: " + failure;
+        if (watched && (!pendingAtStore || !completedAtLabel)) failure += std::string(failure.empty() ? "" : "; ") + (pendingAtStore ? "the fill's completion had not run when the label landed" : "the fill's completion had run before the CPU store") + ", so the ordering under test did not occur";
+    }
+    const bool watchedAtLabel = AgcDriver::GuestMemory::Watched(target, TargetBytes);
+    Gate.store(2, std::memory_order_release);
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriver::Graphics::StorageTexture::FlushPending(target, region.bytes, nullptr, "test release");
+    std::printf("linear target direct write completion, %s (watched at the label: %d, completion pending at the CPU store: %d, run by the label: %d): %s\n", name.c_str(), watchedAtLabel ? 1 : 0, pendingAtStore ? 1 : 0, completedAtLabel ? 1 : 0, failure.empty() ? "the draw's color and the CPU store" : failure.c_str());
+    if (!failure.empty()) failures.push_back(name + ": " + failure);
+    return true;
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+            if (AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).hostImportAlignment == 0) {
+                std::puts("linear target direct write completion tests skipped, host imports are unavailable on this device, so the target is never resident");
+                return VulkanTestSkipped;
+            }
+        }
+        std::vector<std::unique_ptr<Region>> regions;
+        struct ShutdownGuard {
+            ~ShutdownGuard() { try { AgcDriverShutdown_nid_postfix(); } catch (...) {} }
+        } shutdown;
+        Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+        Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+        const auto unwatchedImports = [] {
+            std::puts("linear target direct write completion tests skipped, the device does not keep host imports write-watched, so no completion stamp over the target is tracked");
+            return VulkanTestSkipped;
+        };
+        std::vector<std::string> failures;
+        for (const auto order : {Order::FillFirst, Order::DrawsFirst}) {
+            regions.push_back(std::make_unique<Region>(RegionBytes));
+            if (!Run(order, *regions.back(), failures)) return unwatchedImports();
+        }
+        for (const bool watched : {true, false}) {
+            regions.push_back(std::make_unique<Region>(RegionBytes));
+            if (!RunCpuStore(watched, *regions.back(), failures)) return unwatchedImports();
+        }
+        if (!failures.empty()) {
+            std::string message = "linear target direct write completion: at a completion point, the memory of a resident linear target did not hold the later of a direct buffer write with completion work and draws into it, or lost a CPU store made outside the draws:";
+            for (const auto& failure : failures) message += "\n  " + failure;
+            Require(false, message);
+        }
+        AgcDriverShutdown_nid_postfix();
+        std::puts("linear target direct write completion tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDispatchAccess.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDispatchAccess.cpp
new file mode 100644
index 0000000000..809ffd4d91
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDispatchAccess.cpp
@@ -0,0 +1,300 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using AgcDriver::Graphics::StorageTexture;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::uint32_t Threads = 64;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::size_t TargetBytes = std::size_t{Width} * Height * 16u;
+constexpr std::uint32_t Rgba32FloatInfo = 0x8738u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t Float32AbgrExport = 9;
+constexpr std::uint32_t ReadX = 10;
+constexpr std::uint32_t ReadY = 6;
+constexpr std::uint32_t Drawn = 0x3f800000u;
+constexpr std::uint32_t Unwritten = 0xdeadbeefu;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> CopyCode{0x7e000280u, 0xdc308000u, 0x01000000u, 0xbf8c3f70u, 0xdc708000u, 0x00020100u, 0xbf810000u};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 16>, 2> Programs{};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+std::span<const std::uint32_t> Program(std::size_t index, bool blue) {
+    auto& code = Programs.at(index);
+    std::size_t at = 0;
+    code[at++] = 0x36000000u | (20u << 17u) | 0xffu;
+    code[at++] = 0x0000ffffu;
+    code[at++] = 0x2c000000u | (21u << 17u) | 0x90u;
+    code[at++] = 0x7e000c00u | (20u << 17u) | (256u + 20u);
+    code[at++] = 0x7e000c00u | (21u << 17u) | (256u + 21u);
+    code[at++] = (blue ? 0x7e0002f2u : 0x7e000280u) | (22u << 17u);
+    code[at++] = 0x7e0002f2u | (23u << 17u);
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x17161514u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map a guest block");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate a guest block");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "a guest block is not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Rgba32FloatInfo;
+    cx[0x31d] = 0;
+    cx[0x323] = 0;
+    cx[0x324] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = LinearAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    color.exportIndex = 0;
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode, VkRect2D scissor) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Triangle.data(), 16u, static_cast<std::uint32_t>(Triangle.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionFixedPoint);
+    pixel.targetOutputMode.at(0) = Float32AbgrExport;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
+        {waveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.blendEnable = VK_FALSE;
+    blend.colorWriteMask = 0xf;
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = scissor;
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+void Dispatch(AgcDriver::VulkanDevice& device, std::uint64_t source, std::uint64_t destination) {
+    constexpr std::uint32_t waveSize = 64;
+    const std::array<std::uint32_t, 4> userData{static_cast<std::uint32_t>(source), static_cast<std::uint32_t>(source >> 32u), static_cast<std::uint32_t>(destination), static_cast<std::uint32_t>(destination >> 32u)};
+    const std::span<const std::uint32_t> code(CopyCode);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {waveSize, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::uint32_t Dword(const std::uint8_t* bytes) {
+    std::uint32_t value = 0;
+    std::memcpy(&value, bytes, sizeof(value));
+    return value;
+}
+
+bool Expect(AgcDriver::VulkanDevice& device) {
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if (!context.bufferDeviceAddress) {
+        std::puts("skipped, the device lacks bufferDeviceAddress");
+        return false;
+    }
+    Block block(16 * BlockBytes);
+    std::fill(block.data, block.data + block.bytes, std::uint8_t{0});
+    Block output(BlockBytes);
+    for (std::size_t offset = 0; offset < output.bytes; offset += sizeof(Unwritten)) std::memcpy(output.data + offset, &Unwritten, sizeof(Unwritten));
+    if (AgcDriver::Graphics::HostImportFor(context, block.Address(), block.bytes) == nullptr) {
+        std::puts("skipped, host imports are unavailable");
+        return false;
+    }
+    const auto color = DecodeTarget(block);
+    Require(color.tileMode == AgcDriver::Graphics::ColorTileMode::Linear && color.bytes == TargetBytes, "the target is not a linear R32G32B32A32 target");
+    const auto* recorder = AgcDriver::Graphics::Recorder::Active();
+    Require(recorder != nullptr, "the device has no recorder");
+    Draw(device, color, Program(0, false), {{0, 0}, {Width, Height}});
+    device.WaitIdle();
+    Require(StorageTexture::FindPending(block.Address(), TargetBytes) == nullptr, "the linear target was still pending after the device wait");
+    const auto blueOffset = (static_cast<std::size_t>(ReadY) * Width + ReadX) * 16u + 8u;
+    Require(Dword(block.data + blueOffset) == 0u, "the first draw left " + Hex(Dword(block.data + blueOffset)) + " in the blue channel of pixel (" + std::to_string(ReadX) + ", " + std::to_string(ReadY) + ")");
+    Draw(device, color, Program(1, true), {{8, 4}, {16, 8}});
+    Require(recorder->Recording(), "the draw into the linear target was not left in the open batch");
+    Dispatch(device, block.Address() + blueOffset, output.Address());
+    device.WaitIdle();
+    const auto read = Dword(output.data);
+    Require(read == Drawn, "the address-based dispatch recorded after the draw read " + Hex(read) + " from the blue channel of pixel (" + std::to_string(ReadX) + ", " + std::to_string(ReadY) + "), not the drawn " + Hex(Drawn));
+    Require(Dword(block.data + blueOffset) == Drawn, "the second draw left " + Hex(Dword(block.data + blueOffset)) + " in the blue channel of pixel (" + std::to_string(ReadX) + ", " + std::to_string(ReadY) + ")");
+    return true;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!Expect(*device)) return VulkanTestSkipped;
+        std::puts("linear target dispatch access tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDrawBindings.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDrawBindings.cpp
new file mode 100644
index 0000000000..4335e86e2c
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetDrawBindings.cpp
@@ -0,0 +1,334 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using AgcDriver::Graphics::StorageTexture;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::size_t TargetBytes = std::size_t{Width} * Height * 16u;
+constexpr std::size_t CopyTargetOffset = 0x40000;
+constexpr std::size_t FirstSourceOffset = 0x80000;
+constexpr std::size_t SecondSourceOffset = 0x90000;
+constexpr std::size_t PointedOffset = 0xa0000;
+constexpr std::uint32_t Rgba32FloatInfo = 0x8738u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t Float32AbgrExport = 9;
+constexpr std::uint32_t FirstSource = 0x3e800000u;
+constexpr std::uint32_t SecondSource = 0x3f400000u;
+constexpr std::uint32_t Pointed = 0x3f800000u;
+constexpr std::uint32_t Unwritten = 0xdeadbeefu;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> PixelOpaque{0x7e100280u, 0x7e120280u, 0x7e140280u, 0x7e1602f2u, 0xf800180fu, 0x0b0a0908u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 11> PixelRead{0x7e1a0280u, 0xdc308000u, 0x0c02000du, 0xbf8c3f70u, 0x7e10030cu, 0x7e120280u, 0x7e140280u, 0x7e160280u, 0xf800180fu, 0x0b0a0908u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 13> PixelCopy{0x7e040280u, 0xe0301000u, 0x80010102u, 0xbf8c3f70u, 0xe0701000u, 0x80020102u, 0x7e100301u, 0x7e120280u, 0x7e140280u, 0x7e1602f2u, 0xf800180fu, 0x0b0a0908u, 0xbf810000u};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::uint32_t, 4> FirstOutput{};
+alignas(256) std::array<std::uint32_t, 4> SecondOutput{};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+std::array<std::uint32_t, 4> RawBuffer(std::uint64_t address, std::uint32_t bytes) {
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color targets");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color targets");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color targets are not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(std::uint64_t address) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(address >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Rgba32FloatInfo;
+    cx[0x31d] = 0;
+    cx[0x323] = 0;
+    cx[0x324] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = LinearAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(address >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    color.exportIndex = 0;
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode, std::span<const std::uint32_t> pixelUserData, VkRect2D scissor) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Triangle.data(), 16u, static_cast<std::uint32_t>(Triangle.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionFixedPoint);
+    pixel.targetOutputMode.at(0) = Float32AbgrExport;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
+        {waveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.blendEnable = VK_FALSE;
+    blend.colorWriteMask = 0xf;
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = scissor;
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::array<std::uint32_t, 12> CopyUserData(std::uint64_t source, const std::array<std::uint32_t, 4>& output) {
+    std::array<std::uint32_t, 12> userData{};
+    const auto read = RawBuffer(source, 16u);
+    const auto written = RawBuffer(reinterpret_cast<std::uintptr_t>(output.data()), 16u);
+    std::copy(read.begin(), read.end(), userData.begin() + 4);
+    std::copy(written.begin(), written.end(), userData.begin() + 8);
+    return userData;
+}
+
+std::array<float, 4> Texel(const std::uint8_t* target, std::uint32_t x, std::uint32_t y) {
+    std::array<float, 4> texel{};
+    std::memcpy(texel.data(), target + (static_cast<std::size_t>(y) * Width + x) * 16u, sizeof(texel));
+    return texel;
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::string Describe(const std::array<float, 4>& texel) {
+    return "(" + std::to_string(texel[0]) + ", " + std::to_string(texel[1]) + ", " + std::to_string(texel[2]) + ", " + std::to_string(texel[3]) + ")";
+}
+
+void ExpectTexels(const std::uint8_t* target, const char* what, std::uint32_t firstX, std::uint32_t lastX, const std::array<float, 4>& expected) {
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = firstX; x < lastX; ++x) {
+            const auto texel = Texel(target, x, y);
+            Require(texel == expected, std::string(what) + ": pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") holds " + Describe(texel) + ", expected " + Describe(expected));
+        }
+    }
+}
+
+bool Expect(AgcDriver::VulkanDevice& device, bool unwatch) {
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if (!context.bufferDeviceAddress) {
+        std::puts("skipped, the device lacks bufferDeviceAddress");
+        return false;
+    }
+    Block block(16 * BlockBytes);
+    std::fill(block.data, block.data + block.bytes, std::uint8_t{0});
+    const auto put = [&](std::size_t offset, std::uint32_t value, std::size_t dwords) {
+        for (std::size_t dword = 0; dword < dwords; ++dword) std::memcpy(block.data + offset + dword * 4u, &value, sizeof(value));
+    };
+    put(FirstSourceOffset, FirstSource, 4);
+    put(SecondSourceOffset, SecondSource, 4);
+    put(PointedOffset, Pointed, 1);
+    FirstOutput.fill(Unwritten);
+    SecondOutput.fill(Unwritten);
+    if (AgcDriver::Graphics::HostImportFor(context, block.Address(), block.bytes) == nullptr) {
+        std::puts("skipped, host imports are unavailable");
+        return false;
+    }
+    const auto drawn = DecodeTarget(block.Address());
+    const auto copied = DecodeTarget(block.Address() + CopyTargetOffset);
+    Require(drawn.tileMode == AgcDriver::Graphics::ColorTileMode::Linear && drawn.bytes == TargetBytes && copied.tileMode == AgcDriver::Graphics::ColorTileMode::Linear && copied.bytes == TargetBytes, "the targets are not linear R32G32B32A32 targets");
+    auto* recorder = AgcDriver::Graphics::Recorder::Active();
+    Require(recorder != nullptr && context.descriptorCache != nullptr, "the device has no recorder or descriptor cache");
+    const auto pending = [](std::uint64_t address) { return StorageTexture::FindPending(address, TargetBytes) != nullptr; };
+    const VkRect2D whole{{0, 0}, {Width, Height}};
+    Draw(device, drawn, PixelOpaque, {}, whole);
+    Draw(device, copied, PixelOpaque, {}, whole);
+    device.WaitIdle();
+    Require(!pending(drawn.address) && !pending(copied.address), "a linear target was still pending after the device wait");
+    if (unwatch) AgcDriver::GuestMemory::Unwatch(block.Address(), block.bytes);
+    const bool watched = AgcDriver::GuestMemory::Watched(copied.address, TargetBytes);
+    Require(!unwatch || !watched, "the copied target is still write-watched after its block was taken out of the write watch");
+    const auto submitted = recorder->Submissions();
+    const auto pointed = block.Address() + PointedOffset;
+    const std::array<std::uint32_t, 4> pointer{0u, 0u, static_cast<std::uint32_t>(pointed), static_cast<std::uint32_t>(pointed >> 32u)};
+    Draw(device, drawn, PixelRead, pointer, whole);
+    Require(pending(drawn.address), "the address-based draw did not leave its linear target pending");
+    Require(recorder->Recording() && recorder->Submissions() == submitted, "the address-based draw did not stay in the open batch");
+    const auto setsBefore = context.descriptorCache->Counters().sets;
+    const auto firstCopy = CopyUserData(block.Address() + FirstSourceOffset, FirstOutput);
+    Draw(device, copied, PixelCopy, firstCopy, {{0, 0}, {Width / 2u, Height}});
+    Require(!pending(drawn.address), "the draw writing a copied buffer did not store the drawn linear target first");
+    Require(pending(copied.address), "the first copying draw did not leave its linear target pending");
+    Require(recorder->Recording() && recorder->Submissions() == submitted + 1, "storing the drawn linear target did not submit the batch the address-based draw read it in (" + std::to_string(recorder->Submissions() - submitted) + " submissions)");
+    const auto setsBetween = context.descriptorCache->Counters().sets;
+    const auto secondCopy = CopyUserData(block.Address() + SecondSourceOffset, SecondOutput);
+    Draw(device, copied, PixelCopy, secondCopy, {{static_cast<std::int32_t>(Width / 2u), 0}, {Width / 2u, Height}});
+    if (watched) Require(recorder->Recording() && recorder->Submissions() == submitted + 1, "the second copying draw submitted recorded work");
+    else Require(recorder->Submissions() == submitted + 2, "the second copying draw into a stored target outside the write watch did not submit once to capture its bytes (" + std::to_string(recorder->Submissions() - submitted - 1) + " submissions)");
+    const auto setsAfter = context.descriptorCache->Counters().sets;
+    device.WaitIdle();
+    Require(FirstOutput[0] == FirstSource, "the first copying draw's output holds " + Hex(FirstOutput[0]) + ", not its source's " + Hex(FirstSource));
+    Require(SecondOutput[0] == SecondSource, "the second copying draw's output holds " + Hex(SecondOutput[0]) + ", not its source's " + Hex(SecondSource));
+    ExpectTexels(block.data + CopyTargetOffset, "the first copying draw's half", 0, Width / 2u, {0.25f, 0.0f, 0.0f, 1.0f});
+    ExpectTexels(block.data + CopyTargetOffset, "the second copying draw's half", Width / 2u, Width, {0.75f, 0.0f, 0.0f, 1.0f});
+    ExpectTexels(block.data, "the address-based draw's target", 0, Width, {1.0f, 0.0f, 0.0f, 0.0f});
+    Require(setsAfter - setsBetween == setsBetween - setsBefore, "the second copying draw allocated " + std::to_string(setsAfter - setsBetween) + " descriptor sets, the first " + std::to_string(setsBetween - setsBefore));
+    return true;
+}
+
+}
+
+int main() {
+#ifdef _WIN32
+    _putenv_s("APS5_RELEASE_ON_UNLOCK", "1");
+#else
+    setenv("APS5_RELEASE_ON_UNLOCK", "1", 1);
+#endif
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!Expect(*device, false)) return VulkanTestSkipped;
+        if (!Expect(*device, true)) return VulkanTestSkipped;
+        std::puts("linear target draw binding tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetRectangleBound.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetRectangleBound.cpp
new file mode 100644
index 0000000000..c19854ea05
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearTargetRectangleBound.cpp
@@ -0,0 +1,344 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::size_t RegionBytes = 8 * BlockBytes;
+constexpr std::uint32_t Rgba32FloatInfo = 0x8738u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t Float32AbgrExport = 9;
+constexpr std::uint8_t Initial = 0x3f;
+constexpr std::uint8_t Sentinel = 0x37;
+constexpr std::uint8_t Gap = 0x29;
+constexpr std::size_t GapBytes = 0x100;
+
+struct Surface {
+    std::size_t offset;
+    std::uint32_t width;
+    std::uint32_t height;
+    std::size_t RowBytes() const { return std::size_t{width} * 16u; }
+    std::size_t Bytes() const { return RowBytes() * height; }
+};
+
+constexpr Surface Tall{0, 64, 256};
+constexpr Surface Shifted{6 * BlockBytes + GapBytes, 64, 16};
+constexpr VkRect2D Seed{{63, 255}, {1, 1}};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 16>, 2> Programs{};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+std::span<const std::uint32_t> Program(std::size_t index, bool blue) {
+    auto& code = Programs.at(index);
+    std::size_t at = 0;
+    code[at++] = 0x36000000u | (20u << 17u) | 0xffu;
+    code[at++] = 0x0000ffffu;
+    code[at++] = 0x2c000000u | (21u << 17u) | 0x90u;
+    code[at++] = 0x7e000c00u | (20u << 17u) | (256u + 20u);
+    code[at++] = 0x7e000c00u | (21u << 17u) | (256u + 21u);
+    code[at++] = (blue ? 0x7e0002f2u : 0x7e000280u) | (22u << 17u);
+    code[at++] = 0x7e0002f2u | (23u << 17u);
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x17161514u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), arena(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (arena) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (arena) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color targets");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color targets");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        AgcDriver::Graphics::StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (arena) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (arena) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool arena;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, const Surface& surface) {
+    const auto address = block.Address() + surface.offset;
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(address >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Rgba32FloatInfo;
+    cx[0x31d] = 0;
+    cx[0x323] = 0;
+    cx[0x324] = 0;
+    cx[0x3b0] = ((surface.width - 1u) << 14u) | (surface.height - 1u);
+    cx[0x3b8] = LinearAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(address >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    color.exportIndex = 0;
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, const Surface& surface, std::span<const std::uint32_t> pixelCode, VkRect2D scissor) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Triangle.data(), 16u, static_cast<std::uint32_t>(Triangle.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionFixedPoint);
+    pixel.targetOutputMode.at(0) = Float32AbgrExport;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
+        {waveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.blendEnable = VK_FALSE;
+    blend.colorWriteMask = 0xf;
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {surface.width, surface.height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(surface.height), static_cast<float>(surface.width), -static_cast<float>(surface.height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = scissor;
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+bool Inside(const VkRect2D& rect, std::uint32_t x, std::uint32_t y) {
+    return x >= static_cast<std::uint32_t>(rect.offset.x) && x < static_cast<std::uint32_t>(rect.offset.x) + rect.extent.width && y >= static_cast<std::uint32_t>(rect.offset.y) && y < static_cast<std::uint32_t>(rect.offset.y) + rect.extent.height;
+}
+
+std::uint8_t* Pixel(const Block& block, const Surface& surface, std::uint32_t x, std::uint32_t y) {
+    return block.data + surface.offset + static_cast<std::size_t>(y) * surface.RowBytes() + static_cast<std::size_t>(x) * 16u;
+}
+
+bool Holds(const std::uint8_t* pixel, std::uint8_t value) {
+    return std::all_of(pixel, pixel + 16, [&](std::uint8_t byte) { return byte == value; });
+}
+
+bool HoldsOutput(const std::uint8_t* pixel, std::uint32_t x, std::uint32_t y, float z) {
+    std::array<float, 4> texel{};
+    std::memcpy(texel.data(), pixel, sizeof(texel));
+    return texel == std::array<float, 4>{static_cast<float>(x), static_cast<float>(y), z, 1.0f};
+}
+
+bool Expect(AgcDriver::VulkanDevice& device) {
+    Block block(RegionBytes);
+    std::fill(block.data, block.data + block.bytes, Initial);
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if (AgcDriver::Graphics::HostImportFor(context, block.Address(), block.bytes) == nullptr) return false;
+    const auto tall = DecodeTarget(block, Tall);
+    const auto shifted = DecodeTarget(block, Shifted);
+    Require(tall.tileMode == AgcDriver::Graphics::ColorTileMode::Linear && tall.bytes == Tall.Bytes() && shifted.bytes == Shifted.Bytes(), "the targets are not linear R32G32B32A32 targets");
+    constexpr VkRect2D first{{8, 4}, {16, 16}};
+    constexpr VkRect2D second{{16, 12}, {24, 16}};
+    constexpr VkRect2D whole{{0, 0}, {Shifted.width, Shifted.height}};
+    Draw(device, tall, Tall, Program(0, false), Seed);
+    device.WaitIdle();
+    Draw(device, tall, Tall, Program(0, false), first);
+    Draw(device, tall, Tall, Program(1, true), second);
+    Draw(device, shifted, Shifted, Program(0, false), whole);
+    const std::array<std::array<std::uint32_t, 2>, 3> sentinels{{{50, 10}, {20, 40}, {30, 200}}};
+    const std::array<std::array<std::uint32_t, 2>, 2> between{{{30, 6}, {10, 25}}};
+    for (const auto& [x, y] : sentinels) std::memset(Pixel(block, Tall, x, y), Sentinel, 16);
+    for (const auto& [x, y] : between) std::memset(Pixel(block, Tall, x, y), Sentinel, 16);
+    Require((block.Address() + Shifted.offset) / BlockBytes * BlockBytes == block.Address() + Shifted.offset - GapBytes, "the shifted target does not start past a 64 KiB boundary");
+    std::memset(block.data + Shifted.offset - GapBytes, Gap, GapBytes);
+    device.WaitIdle();
+    std::size_t wrongDrawn = 0, wrongSentinels = 0, wrongBetween = 0, wrongUntouched = 0, wrongShifted = 0;
+    for (std::uint32_t y = 0; y < Tall.height; ++y) {
+        for (std::uint32_t x = 0; x < Tall.width; ++x) {
+            const auto* pixel = Pixel(block, Tall, x, y);
+            const auto at = [&](const auto& point) { return point[0] == x && point[1] == y; };
+            if (std::any_of(sentinels.begin(), sentinels.end(), at)) wrongSentinels += Holds(pixel, Sentinel) ? 0u : 1u;
+            else if (std::any_of(between.begin(), between.end(), at)) wrongBetween += Holds(pixel, Sentinel) ? 0u : 1u;
+            else if (Inside(second, x, y)) wrongDrawn += HoldsOutput(pixel, x, y, 1.0f) ? 0u : 1u;
+            else if (Inside(first, x, y) || Inside(Seed, x, y)) wrongDrawn += HoldsOutput(pixel, x, y, 0.0f) ? 0u : 1u;
+            else wrongUntouched += Holds(pixel, Initial) ? 0u : 1u;
+        }
+    }
+    for (std::uint32_t y = 0; y < Shifted.height; ++y) {
+        for (std::uint32_t x = 0; x < Shifted.width; ++x) wrongShifted += HoldsOutput(Pixel(block, Shifted, x, y), x, y, 0.0f) ? 0u : 1u;
+    }
+    const auto gapLost = static_cast<std::size_t>(std::count_if(block.data + Shifted.offset - GapBytes, block.data + Shifted.offset, [](std::uint8_t byte) { return byte != Gap; }));
+    std::printf("linear target rectangle bound: wrong drawn pixels %zu, lost sentinels %zu/%zu, lost sentinels between the rectangles %zu/%zu, changed untouched pixels %zu, wrong shifted-target pixels %zu, lost gap bytes %zu/%zu\n", wrongDrawn, wrongSentinels, sentinels.size(), wrongBetween, between.size(), wrongUntouched, wrongShifted, gapLost, GapBytes);
+    Require(wrongDrawn == 0 && wrongShifted == 0, "a drawn linear target's store lost pixels its draws wrote");
+    Require(wrongSentinels == 0 && gapLost == 0, "a drawn linear target's store overwrote CPU stores outside the drawn rectangles");
+    Require(wrongBetween == 0, "a drawn linear target's store overwrote CPU stores between two draws' scissor rectangles");
+    Require(wrongUntouched == 0, "a drawn linear target's store changed pixels no draw and no CPU store wrote");
+    return true;
+}
+
+bool ExpectManyRows(AgcDriver::VulkanDevice& device) {
+    Block block(RegionBytes);
+    std::fill(block.data, block.data + block.bytes, Initial);
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if (AgcDriver::Graphics::HostImportFor(context, block.Address(), block.bytes) == nullptr) return false;
+    const auto tall = DecodeTarget(block, Tall);
+    constexpr std::uint32_t Rows = 17;
+    constexpr std::uint32_t Spacing = 15;
+    Draw(device, tall, Tall, Program(0, false), Seed);
+    device.WaitIdle();
+    for (std::uint32_t row = 0; row < Rows; ++row) Draw(device, tall, Tall, Program(0, false), VkRect2D{{8, static_cast<std::int32_t>(row * Spacing)}, {16, 1}});
+    constexpr std::array<std::uint32_t, 2> between{10, 70};
+    std::memset(Pixel(block, Tall, between[0], between[1]), Sentinel, 16);
+    device.WaitIdle();
+    std::size_t wrongDrawn = 0, wrongUntouched = 0;
+    for (std::uint32_t y = 0; y < Tall.height; ++y) {
+        const bool drawnRow = y % Spacing == 0 && y / Spacing < Rows;
+        for (std::uint32_t x = 0; x < Tall.width; ++x) {
+            if (x == between[0] && y == between[1]) continue;
+            const auto* pixel = Pixel(block, Tall, x, y);
+            if ((drawnRow && x >= 8 && x < 24) || Inside(Seed, x, y)) wrongDrawn += HoldsOutput(pixel, x, y, 0.0f) ? 0u : 1u;
+            else wrongUntouched += Holds(pixel, Initial) ? 0u : 1u;
+        }
+    }
+    const bool kept = Holds(Pixel(block, Tall, between[0], between[1]), Sentinel);
+    std::printf("linear target rectangle bound, %u one-row scissors: wrong drawn pixels %zu, sentinel between the rows %s, changed untouched pixels %zu\n", Rows, wrongDrawn, kept ? "kept" : "lost", wrongUntouched);
+    Require(wrongDrawn == 0, "a drawn linear target's store lost pixels its one-row draws wrote");
+    Require(kept, "a drawn linear target's store overwrote a CPU store between two one-row scissors");
+    Require(wrongUntouched == 0, "a drawn linear target's store changed pixels no one-row draw and no CPU store wrote");
+    return true;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!Expect(*device) || !ExpectManyRows(*device)) {
+            std::puts("linear target rectangle bound test skipped: no host import on this device");
+            return VulkanTestSkipped;
+        }
+        std::puts("linear target rectangle bound tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MemoryFloatAtomicModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MemoryFloatAtomicModes.cpp
new file mode 100644
index 0000000000..572e59d66f
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MemoryFloatAtomicModes.cpp
@@ -0,0 +1,447 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Inputs = 12;
+constexpr std::uint32_t Results = 32;
+constexpr std::uint32_t TargetDwords = 512;
+constexpr std::uint32_t Format32Float = 22;
+constexpr std::uint32_t Type2D = 9;
+constexpr std::size_t BlockBytes = 4096;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results + TargetDwords> Output{};
+alignas(4096) std::array<std::uint32_t, 4096> Texels{};
+
+alignas(256) constexpr std::array<std::uint32_t, 112> BufferCode{
+    0x160200b0u, 0x34180087u, 0xe0381000u, 0x80000201u, 0xe0381010u, 0x80000601u, 0xe0341020u, 0x80000a01u,
+    0xbf8c3f70u, 0x341a0082u, 0x4a1a1affu, 0x00001000u, 0x341c0083u, 0x4a1c1cffu, 0x00001200u, 0xe0701000u,
+    0x8001020du, 0xbbfd0000u, 0x7e200303u, 0x7e220304u, 0xe0fc5000u, 0x8001100du, 0xbf8c3f70u, 0xe0305000u,
+    0x8001120du, 0xbf8c3f70u, 0xe0701000u, 0x8001100cu, 0xe0701004u, 0x8001120cu, 0xe0701080u, 0x8001020du,
+    0xbbfd0000u, 0x7e200303u, 0x7e220304u, 0xe1005080u, 0x8001100du, 0xbf8c3f70u, 0xe0305080u, 0x8001120du,
+    0xbf8c3f70u, 0xe0701008u, 0x8001100cu, 0xe070100cu, 0x8001120cu, 0xe0701100u, 0x8001020du, 0xbbfd0000u,
+    0x7e200303u, 0x7e220304u, 0xe0f85100u, 0x8001100du, 0xbf8c3f70u, 0xe0305100u, 0x8001120du, 0xbf8c3f70u,
+    0xe0701010u, 0x8001100cu, 0xe0701014u, 0x8001120cu, 0xe0741000u, 0x8001060eu, 0xbbfd0000u, 0x7e280308u,
+    0x7e2a0309u, 0x7e2c030au, 0x7e2e030bu, 0xe17c5000u, 0x8001140eu, 0xbf8c3f70u, 0xe0345000u, 0x8001180eu,
+    0xbf8c3f70u, 0xe0741018u, 0x8001140cu, 0xe0741020u, 0x8001180cu, 0xe0741100u, 0x8001060eu, 0xbbfd0000u,
+    0x7e280308u, 0x7e2a0309u, 0x7e2c030au, 0x7e2e030bu, 0xe1805100u, 0x8001140eu, 0xbf8c3f70u, 0xe0345100u,
+    0x8001180eu, 0xbf8c3f70u, 0xe0741028u, 0x8001140cu, 0xe0741030u, 0x8001180cu, 0xe0741200u, 0x8001060eu,
+    0xbbfd0000u, 0x7e280308u, 0x7e2a0309u, 0x7e2c030au, 0x7e2e030bu, 0xe1785200u, 0x8001140eu, 0xbf8c3f70u,
+    0xe0345200u, 0x8001180eu, 0xbf8c3f70u, 0xe0741038u, 0x8001140cu, 0xe0741040u, 0x8001180cu, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 59> ImageCode{
+    0x160200b0u, 0x34180087u, 0xe0381000u, 0x80000201u, 0xe0381010u, 0x80000601u, 0xe0341020u, 0x80000a01u,
+    0xbf8c3f70u, 0x7e3c0300u, 0x7e3e0280u, 0x7e260302u, 0xf03c0108u, 0x0002131eu, 0x7e200303u, 0x7e220304u,
+    0xf0782108u, 0x0002101eu, 0x7e240280u, 0xf0442108u, 0x0002121eu, 0xbf8c3f70u, 0xe0701000u, 0x8001100cu,
+    0xe0701004u, 0x8001120cu, 0x7e3e0281u, 0x7e260302u, 0xf03c0108u, 0x0002131eu, 0x7e200303u, 0x7e220304u,
+    0xf07c2108u, 0x0002101eu, 0x7e240280u, 0xf0442108u, 0x0002121eu, 0xbf8c3f70u, 0xe0701008u, 0x8001100cu,
+    0xe070100cu, 0x8001120cu, 0x7e3e0282u, 0x7e260302u, 0xf03c0108u, 0x0002131eu, 0x7e200303u, 0x7e220304u,
+    0xf0742308u, 0x0002101eu, 0x7e240280u, 0xf0442108u, 0x0002121eu, 0xbf8c3f70u, 0xe0701010u, 0x8001100cu,
+    0xe0701014u, 0x8001120cu, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 52> GlobalCode{
+    0x160200b0u, 0x34180087u, 0xe0381000u, 0x80000201u, 0xe0381010u, 0x80000601u, 0xe0341020u, 0x80000a01u,
+    0xbf8c3f70u, 0x34340082u, 0xd70f6a1au, 0x00023408u, 0x7e360209u, 0x50363680u, 0x34380083u, 0xd70f6a1cu,
+    0x00023808u, 0x7e3a0209u, 0x503a3a80u, 0xdc708000u, 0x007d021au, 0xbbfd0000u, 0x7e200303u, 0x7e220304u,
+    0xdcfd8000u, 0x137d101au, 0xbf8c3f70u, 0xdc318000u, 0x127d001au, 0xbf8c3f70u, 0xe0701000u, 0x8001130cu,
+    0xe0701004u, 0x8001120cu, 0xdc748200u, 0x007d061cu, 0xbbfd0000u, 0x7e280308u, 0x7e2a0309u, 0x7e2c030au,
+    0x7e2e030bu, 0xdd7d8200u, 0x207d141cu, 0xbf8c3f70u, 0xdc358200u, 0x187d001cu, 0xbf8c3f70u, 0xe0741018u,
+    0x8001200cu, 0xe0741020u, 0x8001180cu, 0xbf810000u,
+};
+
+constexpr std::uint32_t Rows32[Threads][3] = {
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x80000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0x00000000u, 0x00000001u, 0x00000000u},
+    {0x00000000u, 0x80000001u, 0x80000001u},
+    {0x00000001u, 0x00000000u, 0x00000001u},
+    {0x00000001u, 0x3f800000u, 0x3f800000u},
+    {0x80000001u, 0x80000000u, 0x80000000u},
+    {0x00000001u, 0x80000001u, 0x80000001u},
+    {0x007fffffu, 0x00800000u, 0x007fffffu},
+    {0x807fffffu, 0xbf800000u, 0x807fffffu},
+    {0x7fc00000u, 0x00000001u, 0x7fc00000u},
+    {0x00000001u, 0x7fc00000u, 0x00000001u},
+    {0x7f800001u, 0x00000001u, 0x7f800001u},
+    {0x00000001u, 0x7f800001u, 0x00000001u},
+    {0x3f800000u, 0xbf800000u, 0x3f800000u},
+    {0x7f800000u, 0xff800000u, 0xff800000u},
+    {0x80000000u, 0x00000001u, 0x80000000u},
+    {0x7fc12345u, 0x7fc00000u, 0x7fc12345u},
+    {0xffc00000u, 0x3f800000u, 0x3f800000u},
+    {0x7fa00000u, 0x3f800000u, 0x3f800000u},
+    {0x40490fdbu, 0x007fffffu, 0x40490fdbu},
+    {0x807fffffu, 0x80000001u, 0x80000001u},
+    {0x00800000u, 0x007fffffu, 0x00800000u},
+    {0x00000000u, 0xff800001u, 0xff800001u},
+    {0x80000001u, 0x00000001u, 0x80000001u},
+    {0x7f7fffffu, 0xff7fffffu, 0xff7fffffu},
+    {0x00000001u, 0x00000001u, 0x00000001u},
+    {0x007fffffu, 0x80000000u, 0x80000000u},
+    {0xff800000u, 0x80000001u, 0x80000001u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc00000u},
+    {0x3f800000u, 0x00000001u, 0x3f800000u}
+};
+
+constexpr std::uint64_t Rows64[Threads][3] = {
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000001ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x0000000000000001ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x0000000000000001ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull},
+    {0x8000000000000001ull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0x0000000000000001ull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x000fffffffffffffull, 0x0010000000000000ull, 0x000fffffffffffffull},
+    {0x800fffffffffffffull, 0xbff0000000000000ull, 0x800fffffffffffffull},
+    {0x7ff8000000000000ull, 0x0000000000000001ull, 0x7ff8000000000000ull},
+    {0x0000000000000001ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x7ff0000000000001ull, 0x0000000000000001ull, 0x7ff0000000000001ull},
+    {0x0000000000000001ull, 0x7ff0000000000001ull, 0x7ff0000000000001ull},
+    {0x3ff0000000000000ull, 0xbff0000000000000ull, 0x3ff0000000000000ull},
+    {0x7ff0000000000000ull, 0xfff0000000000000ull, 0x7ff0000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000001ull, 0x8000000000000000ull},
+    {0x7ff8000000012345ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0xfff8000000000000ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull},
+    {0xfff0000000000001ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull},
+    {0x400921fb54442d18ull, 0x000fffffffffffffull, 0x400921fb54442d18ull},
+    {0x800fffffffffffffull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x0010000000000000ull, 0x000fffffffffffffull, 0x0010000000000000ull},
+    {0x0000000000000000ull, 0xfff0000000000001ull, 0x0000000000000000ull},
+    {0x8000000000000001ull, 0x0000000000000001ull, 0x8000000000000001ull},
+    {0x7fefffffffffffffull, 0xfff0000000000000ull, 0x7fefffffffffffffull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x000fffffffffffffull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0xfff0000000000000ull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x3ff0000000000000ull, 0x0000000000000001ull, 0x3ff0000000000000ull}
+};
+
+constexpr std::uint32_t Flushed32[Threads][3] = {
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x00000000u, 0x00000001u},
+    {0x80000000u, 0x00000000u, 0x80000001u},
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x3f800000u, 0x00000001u},
+    {0x80000000u, 0x80000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x80000001u},
+    {0x00000000u, 0x00800000u, 0x00800000u},
+    {0xbf800000u, 0x80000000u, 0xbf800000u},
+    {0x00000000u, 0x00000000u, 0x7fc00000u},
+    {0x00000000u, 0x00000000u, 0x7fc00000u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0xbf800000u, 0x3f800000u, 0xbf800000u},
+    {0xff800000u, 0x7f800000u, 0x7f800000u},
+    {0x80000000u, 0x00000000u, 0x00000001u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc12345u},
+    {0x3f800000u, 0x3f800000u, 0xffc00000u},
+    {0x7fe00000u, 0x7fe00000u, 0x7fa00000u},
+    {0x00000000u, 0x40490fdbu, 0x007fffffu},
+    {0x80000000u, 0x80000000u, 0x80000001u},
+    {0x00000000u, 0x00800000u, 0x007fffffu},
+    {0xffc00001u, 0xffc00001u, 0x00000000u},
+    {0x80000000u, 0x00000000u, 0x00000001u},
+    {0xff7fffffu, 0x7f7fffffu, 0x7f7fffffu},
+    {0x00000000u, 0x00000000u, 0x00000001u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0xff800000u, 0x80000000u, 0xff800000u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc00000u},
+    {0x00000000u, 0x3f800000u, 0x00000001u}
+};
+
+constexpr std::uint32_t Kept32[Threads][3] = {
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x00000001u, 0x00000001u},
+    {0x80000001u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x00000001u, 0x00000000u},
+    {0x00000001u, 0x3f800000u, 0x00000001u},
+    {0x80000001u, 0x80000000u, 0x80000001u},
+    {0x80000001u, 0x00000001u, 0x00000001u},
+    {0x007fffffu, 0x00800000u, 0x00800000u},
+    {0xbf800000u, 0x807fffffu, 0xbf800000u},
+    {0x00000001u, 0x00000001u, 0x7fc00000u},
+    {0x00000001u, 0x00000001u, 0x7fc00000u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0xbf800000u, 0x3f800000u, 0xbf800000u},
+    {0xff800000u, 0x7f800000u, 0x7f800000u},
+    {0x80000000u, 0x00000001u, 0x00000001u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc12345u},
+    {0x3f800000u, 0x3f800000u, 0xffc00000u},
+    {0x7fe00000u, 0x7fe00000u, 0x7fa00000u},
+    {0x007fffffu, 0x40490fdbu, 0x007fffffu},
+    {0x807fffffu, 0x80000001u, 0x807fffffu},
+    {0x007fffffu, 0x00800000u, 0x007fffffu},
+    {0xffc00001u, 0xffc00001u, 0x00000000u},
+    {0x80000001u, 0x00000001u, 0x00000001u},
+    {0xff7fffffu, 0x7f7fffffu, 0x7f7fffffu},
+    {0x00000001u, 0x00000001u, 0x00000001u},
+    {0x80000000u, 0x007fffffu, 0x007fffffu},
+    {0xff800000u, 0x80000001u, 0xff800000u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc00000u},
+    {0x00000001u, 0x3f800000u, 0x00000001u}
+};
+
+constexpr std::uint64_t Flushed64[Threads][3] = {
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000001ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x3ff0000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000001ull},
+    {0x0000000000000000ull, 0x0010000000000000ull, 0x0010000000000000ull},
+    {0xbff0000000000000ull, 0x8000000000000000ull, 0xbff0000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x7ff8000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x7ff0000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x0000000000000001ull},
+    {0xbff0000000000000ull, 0x3ff0000000000000ull, 0xbff0000000000000ull},
+    {0xfff0000000000000ull, 0x7ff0000000000000ull, 0xfff0000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000012345ull},
+    {0x3ff0000000000000ull, 0x3ff0000000000000ull, 0xfff8000000000000ull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x0000000000000000ull, 0x400921fb54442d18ull, 0x000fffffffffffffull},
+    {0x8000000000000000ull, 0x8000000000000000ull, 0x8000000000000001ull},
+    {0x0000000000000000ull, 0x0010000000000000ull, 0x000fffffffffffffull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0xfff0000000000000ull, 0x7fefffffffffffffull, 0xfff0000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0xfff0000000000000ull, 0x8000000000000000ull, 0xfff0000000000000ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x0000000000000000ull, 0x3ff0000000000000ull, 0x0000000000000001ull}
+};
+
+constexpr std::uint64_t Kept64[Threads][3] = {
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x8000000000000001ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000001ull, 0x0000000000000000ull},
+    {0x0000000000000001ull, 0x3ff0000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000001ull, 0x8000000000000000ull, 0x8000000000000001ull},
+    {0x8000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x000fffffffffffffull, 0x0010000000000000ull, 0x0010000000000000ull},
+    {0xbff0000000000000ull, 0x800fffffffffffffull, 0xbff0000000000000ull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x7ff8000000000000ull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x7ff0000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x0000000000000001ull},
+    {0xbff0000000000000ull, 0x3ff0000000000000ull, 0xbff0000000000000ull},
+    {0xfff0000000000000ull, 0x7ff0000000000000ull, 0xfff0000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000012345ull},
+    {0x3ff0000000000000ull, 0x3ff0000000000000ull, 0xfff8000000000000ull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x000fffffffffffffull, 0x400921fb54442d18ull, 0x000fffffffffffffull},
+    {0x800fffffffffffffull, 0x8000000000000001ull, 0x800fffffffffffffull},
+    {0x000fffffffffffffull, 0x0010000000000000ull, 0x000fffffffffffffull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x8000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0xfff0000000000000ull, 0x7fefffffffffffffull, 0xfff0000000000000ull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x000fffffffffffffull, 0x000fffffffffffffull},
+    {0xfff0000000000000ull, 0x8000000000000001ull, 0xfff0000000000000ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x0000000000000001ull, 0x3ff0000000000000ull, 0x0000000000000001ull}
+};
+
+constexpr std::array<const char*, 3> Names{"fmin", "fmax", "fcmpswap"};
+
+enum class Kind { Buffer, Image, Global };
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "memory float atomic modes: cannot allocate the guest block");
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+    }
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+    std::uint8_t* Data() { return block; }
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::array<std::uint32_t, 8> TextureDescriptor(const void* data) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32Float << 20u) | (((Threads - 1u) & 3u) << 30u),
+        ((Threads - 1u) >> 2u) | (2u << 14u),
+        0xfacu | (Type2D << 28u),
+        0u, 0u, 0u, 0u,
+    };
+}
+
+std::string Hex(std::uint64_t value, int digits) {
+    char text[24];
+    std::snprintf(text, sizeof(text), "0x%0*llx", digits, static_cast<unsigned long long>(value));
+    return text;
+}
+
+const char* KindName(Kind kind) {
+    return kind == Kind::Buffer ? "buffer" : kind == Kind::Image ? "image" : "global";
+}
+
+void FillInput() {
+    Input.fill(0u);
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        auto* row = &Input[tid * Inputs];
+        row[0] = Rows32[tid][0];
+        row[1] = Rows32[tid][1];
+        row[2] = Rows32[tid][2];
+        for (std::uint32_t i = 0; i < 3u; ++i) {
+            row[4u + 2u * i] = static_cast<std::uint32_t>(Rows64[tid][i]);
+            row[5u + 2u * i] = static_cast<std::uint32_t>(Rows64[tid][i] >> 32u);
+        }
+    }
+}
+
+void Run(AgcDriver::VulkanDevice& device, Kind kind, GuestBlock& guest, const std::optional<ShaderRecompiler::ShaderFloatMode>& floatMode) {
+    Output.fill(0xdeadbeefu);
+    Texels.fill(0xdeadbeefu);
+    std::memset(guest.Data(), 0xcd, BlockBytes);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    if (kind == Kind::Image) {
+        const auto texture = TextureDescriptor(Texels.data());
+        std::copy(texture.begin(), texture.end(), userData.begin() + 8);
+    } else if (kind == Kind::Global) {
+        const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(guest.Data()));
+        userData[8] = static_cast<std::uint32_t>(address);
+        userData[9] = static_cast<std::uint32_t>(address >> 32u);
+    }
+    const std::span<const std::uint32_t> code = kind == Kind::Buffer ? std::span<const std::uint32_t>(BufferCode) : kind == Kind::Image ? std::span<const std::uint32_t>(ImageCode) : std::span<const std::uint32_t>(GlobalCode);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void Check(Kind kind, const char* mode, bool flush32, bool flush64) {
+    const auto where = std::string("memory float atomic modes: ") + KindName(kind) + ", " + mode + ", lane ";
+    const std::uint32_t ops = kind == Kind::Global ? 1u : 3u;
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        const std::uint32_t* out = &Output[tid * Results];
+        for (std::uint32_t op = 0; op < ops; ++op) {
+            const std::uint32_t expected = flush32 ? Flushed32[tid][op] : Kept32[tid][op];
+            Require(out[2u * op] == Rows32[tid][0], where + std::to_string(tid) + " " + Names[op] + " returned " + Hex(out[2u * op], 8) + ", expected " + Hex(Rows32[tid][0], 8));
+            Require(out[2u * op + 1u] == expected, where + std::to_string(tid) + " " + Names[op] + " stored " + Hex(out[2u * op + 1u], 8) + ", expected " + Hex(expected, 8));
+        }
+        if (kind == Kind::Image) continue;
+        for (std::uint32_t op = 0; op < ops; ++op) {
+            const std::uint64_t returned = out[6u + 4u * op] | (static_cast<std::uint64_t>(out[7u + 4u * op]) << 32u);
+            const std::uint64_t stored = out[8u + 4u * op] | (static_cast<std::uint64_t>(out[9u + 4u * op]) << 32u);
+            const std::uint64_t expected = flush64 ? Flushed64[tid][op] : Kept64[tid][op];
+            Require(returned == Rows64[tid][0], where + std::to_string(tid) + " " + Names[op] + "_x2 returned " + Hex(returned, 16) + ", expected " + Hex(Rows64[tid][0], 16));
+            Require(stored == expected, where + std::to_string(tid) + " " + Names[op] + "_x2 stored " + Hex(stored, 16) + ", expected " + Hex(expected, 16));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!TargetHasCapability(device->Target(), spv::CapabilityInt64Atomics)) {
+            std::puts("skipped, the device has no shaderBufferInt64Atomics");
+            return VulkanTestSkipped;
+        }
+        GuestBlock guest;
+        FillInput();
+        struct Mode {
+            std::optional<ShaderRecompiler::ShaderFloatMode> floatMode;
+            const char* name;
+            bool flush32;
+            bool flush64;
+            bool global;
+        };
+        const std::array<Mode, 6> modes{{
+            {std::nullopt, "no float mode", true, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0xc0u, true, false, false}, "FLOAT_MODE 0xc0", true, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false}, "FLOAT_MODE 0xf0", false, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0x00u, true, false, false}, "FLOAT_MODE 0x00", true, true, true},
+            {ShaderRecompiler::ShaderFloatMode{0x50u, true, false, false}, "FLOAT_MODE 0x50", false, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0xa0u, true, false, false}, "FLOAT_MODE 0xa0", true, true, false},
+        }};
+        for (const auto kind : {Kind::Buffer, Kind::Image, Kind::Global}) {
+            for (const auto& mode : modes) {
+                if (kind == Kind::Global && !mode.global) continue;
+                Run(*device, kind, guest, mode.floatMode);
+                Check(kind, mode.name, mode.flush32, mode.flush64);
+            }
+        }
+        std::puts("memory float atomic modes tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MullitF32DenormalModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MullitF32DenormalModes.cpp
new file mode 100644
index 0000000000..2dd9886984
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MullitF32DenormalModes.cpp
@@ -0,0 +1,226 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t ConstantForms = 4;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * ConstantForms> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> MullitCode{
+    0x34020084u, 0x34040082u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x7e140280u, 0xd550000au, 0x041a0b04u,
+    0xe0701000u, 0x80010a02u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 17> ConstantMullitCode{
+    0x34020084u, 0x34040084u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0xd550000au, 0x041a08f2u, 0xd550000bu,
+    0x0419e904u, 0xd550000cu, 0x041a0a81u, 0xd550000du, 0x041a08ffu, 0x3fc00000u, 0xe0781000u, 0x80010a02u,
+    0xbf810000u,
+};
+
+constexpr const char* ConstantNames[ConstantForms] = {"v_mullit_f32 1.0, v4, v6", "v_mullit_f32 v4, 2.0, v6", "v_mullit_f32 0x1, v5, v6", "v_mullit_f32 0x3fc00000, v4, v6"};
+
+struct Vector {
+    std::uint32_t lhs;
+    std::uint32_t rhs;
+    std::uint32_t limit;
+    std::uint32_t expected[8];
+};
+
+constexpr Vector Vectors[] = {
+    {0x00000000u, 0x00000000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00000000u, 0x00800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00000001u, 0x80000001u, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u}},
+    {0x00000001u, 0x3f800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000001u, 0x00000001u}},
+    {0x00000001u, 0x3f800000u, 0x00800000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000001u, 0x00000001u}},
+    {0x00000001u, 0xbf800000u, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80000001u, 0x80000001u}},
+    {0x00000001u, 0x7f7fffffu, 0x00800000u, {0x00000000u, 0x00000000u, 0x34ffffffu, 0x34ffffffu, 0x00000000u, 0x00000000u, 0x34ffffffu, 0x34ffffffu}},
+    {0x00800000u, 0x00000000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00800000u, 0x80000001u, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u}},
+    {0x00800000u, 0x00800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00800000u, 0x3f000000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00400000u, 0x00400000u}},
+    {0x00800000u, 0x3f000000u, 0x00800000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00400000u, 0x00400000u, 0x00400000u, 0x00400000u}},
+    {0x3f000000u, 0x007fffffu, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00400000u, 0x00400000u}},
+    {0x3f000000u, 0x007fffffu, 0x00800000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00400000u, 0x00400000u}},
+    {0x3f000000u, 0x807fffffu, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80400000u, 0x80400000u}},
+    {0x7f800001u, 0x00000001u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u, 0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u}},
+    {0x7f800001u, 0x00000001u, 0x00800000u, {0x00000000u, 0x00000000u, 0x7f800001u, 0x7fc00001u, 0x00000000u, 0x00000000u, 0x7f800001u, 0x7fc00001u}},
+    {0x7f800001u, 0x00800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u, 0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u}},
+    {0x7f800001u, 0x00800000u, 0x00800000u, {0x7f800001u, 0x7fc00001u, 0x7f800001u, 0x7fc00001u, 0x7f800001u, 0x7fc00001u, 0x7f800001u, 0x7fc00001u}},
+    {0x3f800000u, 0x40000000u, 0x3f800000u, {0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u}},
+    {0x3f800000u, 0xff7fffffu, 0x3f800000u, {0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu}},
+    {0x3f800000u, 0x3f800000u, 0x80000000u, {0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu}},
+    {0x7f7fffffu, 0x7f7fffffu, 0x3f800000u, {0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u}},
+};
+
+struct ConstantVector {
+    std::uint32_t inputs[3];
+    std::uint32_t expected[4][ConstantForms];
+};
+
+constexpr ConstantVector ConstantVectors[] = {
+    {{0x00000001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000001u, 0x00000002u, 0x00000000u, 0x00000002u}}},
+    {{0x00000001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000001u, 0x00000002u, 0x00000000u, 0x00000002u}}},
+    {{0x00000002u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000002u, 0x00000004u, 0x00000000u, 0x00000003u}}},
+    {{0x00000002u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000002u, 0x00000004u, 0x00000000u, 0x00000003u}}},
+    {{0x00000003u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000003u, 0x00000006u, 0x00000000u, 0x00000004u}}},
+    {{0x00000003u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000003u, 0x00000006u, 0x00000000u, 0x00000004u}}},
+    {{0x00155555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00155555u, 0x002aaaaau, 0x00000000u, 0x00200000u}}},
+    {{0x00155555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00155555u, 0x002aaaaau, 0x00000000u, 0x00200000u}}},
+    {{0x003fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x003fffffu, 0x007ffffeu, 0x00000000u, 0x005ffffeu}}},
+    {{0x003fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x003fffffu, 0x007ffffeu, 0x00000000u, 0x005ffffeu}}},
+    {{0x00400000u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400000u, 0x00800000u, 0x00000000u, 0x00600000u}}},
+    {{0x00400000u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400000u, 0x00800000u, 0x00000000u, 0x00600000u}}},
+    {{0x00400001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800002u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400001u, 0x00800002u, 0x00000000u, 0x00600002u}}},
+    {{0x00400001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800002u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400001u, 0x00800002u, 0x00000000u, 0x00600002u}}},
+    {{0x00555555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00aaaaaau, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00555555u, 0x00aaaaaau, 0x00000000u, 0x00800000u}}},
+    {{0x00555555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00aaaaaau, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00555555u, 0x00aaaaaau, 0x00000000u, 0x00800000u}}},
+    {{0x007ffffeu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffcu, 0x00000000u, 0x00bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007ffffeu, 0x00fffffcu, 0x00000000u, 0x00bffffdu}}},
+    {{0x007ffffeu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffcu, 0x00000000u, 0x00bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007ffffeu, 0x00fffffcu, 0x00000000u, 0x00bffffdu}}},
+    {{0x007fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffeu, 0x00000000u, 0x00bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007fffffu, 0x00fffffeu, 0x00000000u, 0x00bffffeu}}},
+    {{0x007fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffeu, 0x00000000u, 0x00bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007fffffu, 0x00fffffeu, 0x00000000u, 0x00bffffeu}}},
+    {{0x80000001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000001u, 0x80000002u, 0x00000000u, 0x80000002u}}},
+    {{0x80000001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000001u, 0x80000002u, 0x00000000u, 0x80000002u}}},
+    {{0x80000002u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000002u, 0x80000004u, 0x00000000u, 0x80000003u}}},
+    {{0x80000002u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000002u, 0x80000004u, 0x00000000u, 0x80000003u}}},
+    {{0x80000003u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000003u, 0x80000006u, 0x00000000u, 0x80000004u}}},
+    {{0x80000003u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000003u, 0x80000006u, 0x00000000u, 0x80000004u}}},
+    {{0x80155555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80155555u, 0x802aaaaau, 0x00000000u, 0x80200000u}}},
+    {{0x80155555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80155555u, 0x802aaaaau, 0x00000000u, 0x80200000u}}},
+    {{0x803fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x803fffffu, 0x807ffffeu, 0x00000000u, 0x805ffffeu}}},
+    {{0x803fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x803fffffu, 0x807ffffeu, 0x00000000u, 0x805ffffeu}}},
+    {{0x80400000u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400000u, 0x80800000u, 0x00000000u, 0x80600000u}}},
+    {{0x80400000u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400000u, 0x80800000u, 0x00000000u, 0x80600000u}}},
+    {{0x80400001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800002u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400001u, 0x80800002u, 0x00000000u, 0x80600002u}}},
+    {{0x80400001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800002u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400001u, 0x80800002u, 0x00000000u, 0x80600002u}}},
+    {{0x80555555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80aaaaaau, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80555555u, 0x80aaaaaau, 0x00000000u, 0x80800000u}}},
+    {{0x80555555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80aaaaaau, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80555555u, 0x80aaaaaau, 0x00000000u, 0x80800000u}}},
+    {{0x807ffffeu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffcu, 0x00000000u, 0x80bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807ffffeu, 0x80fffffcu, 0x00000000u, 0x80bffffdu}}},
+    {{0x807ffffeu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffcu, 0x00000000u, 0x80bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807ffffeu, 0x80fffffcu, 0x00000000u, 0x80bffffdu}}},
+    {{0x807fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffeu, 0x00000000u, 0x80bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807fffffu, 0x80fffffeu, 0x00000000u, 0x80bffffeu}}},
+    {{0x807fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffeu, 0x00000000u, 0x80bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807fffffu, 0x80fffffeu, 0x00000000u, 0x80bffffeu}}},
+};
+
+static_assert(std::size(Vectors) <= Threads && std::size(ConstantVectors) <= Threads);
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+bool KeepsDenormals(const AgcDriver::VulkanDevice& device) {
+    const auto target = device.Target();
+    return target.float32DenormPreserve && !target.float32FlushToZero;
+}
+
+bool Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::uint32_t denorm32, bool ieee) {
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{(denorm32 << 4u) | (3u << 6u), true, ieee, false};
+    std::optional<decltype(ShaderRecompiler::Recompile(request))> result;
+    try {
+        result.emplace(ShaderRecompiler::Recompile(request));
+    } catch (const std::exception& error) {
+        const std::string message = error.what();
+        Require(!KeepsDenormals(device) && (denorm32 == 1u || denorm32 == 2u) && message.find("needs DenormPreserve 32") != std::string::npos,
+                "v_mullit_f32 denorm32 " + std::to_string(denorm32) + ": " + message);
+        return false;
+    }
+    device.Dispatch(*result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    return true;
+}
+
+void CheckRegisters(std::uint32_t denorm32, bool ieee) {
+    for (std::uint32_t row = 0; row < std::size(Vectors); ++row) {
+        const auto& vector = Vectors[row];
+        const auto actual = Output[row];
+        const auto expected = vector.expected[denorm32 * 2u + (ieee ? 1u : 0u)];
+        Require(actual == expected, "v_mullit_f32 denorm32 " + std::to_string(denorm32) + (ieee ? " ieee" : " no ieee") + " inputs " + Hex(vector.lhs) + " " + Hex(vector.rhs) + " " +
+                                        Hex(vector.limit) + " is " + Hex(actual) + ", expected " + Hex(expected));
+    }
+}
+
+void CheckConstants(std::uint32_t denorm32, bool ieee) {
+    for (std::uint32_t row = 0; row < std::size(ConstantVectors); ++row) {
+        const auto& vector = ConstantVectors[row];
+        for (std::uint32_t form = 0; form < ConstantForms; ++form) {
+            const auto actual = Output[row * ConstantForms + form];
+            const auto expected = vector.expected[denorm32][form];
+            Require(actual == expected, std::string(ConstantNames[form]) + " denorm32 " + std::to_string(denorm32) + (ieee ? " ieee" : " no ieee") + " inputs " + Hex(vector.inputs[0]) + " " +
+                                            Hex(vector.inputs[1]) + " " + Hex(vector.inputs[2]) + " is " + Hex(actual) + ", expected " + Hex(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const bool keeps = KeepsDenormals(*device);
+        std::uint32_t checked = 0u;
+        for (std::uint32_t denorm32 = 0u; denorm32 < 4u; ++denorm32) {
+            if (denorm32 == 3u && !keeps) continue;
+            for (const bool ieee : {false, true}) {
+                Input.fill(0u);
+                for (std::uint32_t row = 0; row < std::size(Vectors); ++row) {
+                    Input[row * Inputs] = Vectors[row].lhs;
+                    Input[row * Inputs + 1] = Vectors[row].rhs;
+                    Input[row * Inputs + 2] = Vectors[row].limit;
+                }
+                if (Run(*device, MullitCode, denorm32, ieee)) {
+                    CheckRegisters(denorm32, ieee);
+                    ++checked;
+                }
+                Input.fill(0u);
+                for (std::uint32_t row = 0; row < std::size(ConstantVectors); ++row) std::copy(std::begin(ConstantVectors[row].inputs), std::end(ConstantVectors[row].inputs), Input.begin() + row * Inputs);
+                if (Run(*device, ConstantMullitCode, denorm32, ieee)) {
+                    CheckConstants(denorm32, ieee);
+                    ++checked;
+                }
+            }
+        }
+        std::printf("v_mullit_f32 denormal mode tests passed (%u of 16 runs checked; denormal modes 1 and 2 need DenormPreserve 32, mode 3 is checked only where the device keeps f32 denormals)\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp
index 27f7d4ae49..5cc437a819 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp
@@ -265,11 +265,11 @@ private:
     bool mapped = false;
 };
 
-ColorTarget Target(const GuestBlock& block) {
+ColorTarget Target(const GuestBlock& block, VkFormat format = VK_FORMAT_R8G8B8A8_UNORM) {
     ColorTarget target{};
     target.address = target.surfaceAddress = block.Address();
     target.extent = target.surfaceExtent = {Side, Side};
-    target.format = VK_FORMAT_R8G8B8A8_UNORM;
+    target.format = format;
     target.elementBytes = 4;
     target.samples = 4;
     target.tileMode = ColorTileMode::RenderTarget;
@@ -556,6 +556,36 @@ public:
         AwaitImages(0, "MSAA targets with twin views were not fully released");
     }
 
+    void StorageSrgbTwin() {
+        if (!context.storageImageMultisample || HostStorageFormat(context, VK_FORMAT_R8G8B8A8_SRGB) != VK_FORMAT_R8G8B8A8_UNORM) {
+            std::puts("the device has no UNORM storage form for a multisampled sRGB target; its storage twin case is skipped");
+            return;
+        }
+        GuestBlock block;
+        const auto target = Target(block, VK_FORMAT_R8G8B8A8_SRGB);
+        auto resource = Resource(block);
+        VkImageView storageView = VK_NULL_HANDLE;
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            MultisampleTargetView(context, target);
+            storageView = MultisampleTargetStorageView(context, resource);
+            Require(storageView != VK_NULL_HANDLE, "a UNORM storage access to a multisampled sRGB target has no view");
+            Require(MultisampleTargetStorageView(context, resource) == storageView, "a repeated UNORM storage access to a multisampled sRGB target changed its view");
+            resource.format = 60;
+            bool refused = false;
+            try {
+                MultisampleTargetStorageView(context, resource);
+            } catch (const std::exception&) {
+                refused = true;
+            }
+            Require(refused, "a storage access in an unrelated format reached a multisampled sRGB target");
+        }
+        Sync();
+        block.Unmap();
+        Clear();
+        AwaitImages(0, "the sRGB storage twin targets were not fully released");
+    }
+
 private:
     AgcDriver::VulkanDevice& device;
     Context context;
@@ -574,6 +604,7 @@ int main() {
         run.RecordedRemap();
         run.SampledRemap();
         run.StorageRemap();
+        run.StorageSrgbTwin();
         run.OrderRemap();
         if (context.storageImageMultisample) run.StorageTwin();
         std::puts("retired MSAA allocations stay bounded, recorded clears and storage promotions retain their images, sampled aliases release their parents after the last batch, and sample-order targets keep their retired images until their batch completes");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
index 641eaf93b0..3d3531a577 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
@@ -15,6 +15,7 @@
 #include "prx/libc/include/GuestWriteWatch.hpp"
 #include "SpirvBackend/SpirvModule.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <algorithm>
 #include <array>
@@ -54,6 +55,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -65,26 +68,22 @@ public:
             app.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &app;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0u;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
             Check(enumerate(instance, &count, nullptr), "vkEnumeratePhysicalDevices");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            int selected = -1;
-            for (const auto physical : devices) {
-                VkPhysicalDeviceProperties properties{};
-                function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties")(physical, &properties);
-                if (const auto* wanted = std::getenv("ANYPS5_GPU"); wanted != nullptr && std::string(properties.deviceName).find(wanted) == std::string::npos) continue;
-                const int rank = properties.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU ? 3 : properties.deviceType == VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU ? 2 : 1;
-                if (properties.apiVersion < VK_API_VERSION_1_1 || rank <= selected) continue;
-                context.physical = physical;
-                context.limits = properties.limits;
-                selected = rank;
-            }
-            Require(context.physical != VK_NULL_HANDLE, "no Vulkan 1.1 device");
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             VkPhysicalDeviceProperties selectedProperties{};
             function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties")(context.physical, &selectedProperties);
+            context.limits = selectedProperties.limits;
             std::printf("Selected GPU name=%s vendor=0x%x device=0x%x driver=%u\n", selectedProperties.deviceName, selectedProperties.vendorID, selectedProperties.deviceID, selectedProperties.driverVersion);
             const auto queues = function<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
             queues(context.physical, &count, nullptr);
@@ -672,6 +671,81 @@ void CheckDrawFeedback() {
     std::puts("Native depth feedback refused through the draw resource path; a written surface refused and a depth-tested one retired on guest read");
 }
 
+void CheckDepthAttachmentAlias() {
+    const auto device = OpenVulkanTestDevice();
+    Require(device != nullptr, "native depth attachment alias requires Vulkan");
+    const auto context = device->graphicsContext();
+    constexpr VkExtent2D extent{5u, 3u};
+    constexpr std::uint32_t samples = 4u;
+    const auto bytes = static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, 4u, samples));
+    TargetMemory memory(bytes), firstMetadata(65536u), secondMetadata(65536u);
+    std::memset(memory.Data(), 0x3c, bytes);
+    std::memset(firstMetadata.Data(), 0, 65536u);
+    std::memset(secondMetadata.Data(), 0, 65536u);
+    struct Cleanup {
+        AgcDriver::VulkanDevice& device;
+        ~Cleanup() { device.WaitIdle(); ClearCachedTextures(device.Device()); ClearDepthSurfaces(device.Device()); }
+    } cleanup{*device};
+    DepthTarget first{memory.Address(), 0u, extent, VK_FORMAT_D32_SFLOAT, 0.0f, 0u, firstMetadata.Address(), false, samples};
+    first.depthSwizzle = 24u;
+    first.iterate256 = first.htilePipeAligned = first.htileDepthOnly = true;
+    const auto firstView = DepthSurfaceView(context, first);
+    const auto words = DepthSampleWords(first);
+    auto kept = DepthSurfaceTexture(context, words, DecodeTextureResource(words), VkComponentMapping{});
+    Require(kept != nullptr, "attachment alias fixture has no held native depth view");
+    auto second = first;
+    second.extent.width = 6u;
+    second.htileAddress = secondMetadata.Address();
+    Require(MultisampledDepthBytes_nid_no_patch(second.extent, 4u, samples) <= bytes, "attachment alias fixture exceeds its backing");
+    const auto secondView = DepthSurfaceView(context, second);
+    Require(secondView != VK_NULL_HANDLE && secondView != firstView, "an aliased depth attachment reused the previous layout's view");
+    Require(DepthSurfaceView(context, second) == secondView, "an unchanged native depth attachment was not reused");
+    for (std::size_t offset = 0u; offset < bytes; ++offset) Require(memory.Data()[offset] == std::byte{0x3c}, "retiring an unwritten attachment alias changed guest bytes");
+    std::puts("native depth attachment alias changes layout while retaining held GPU views");
+}
+
+void CheckStorageAliasRetirement() {
+    const auto device = OpenVulkanTestDevice();
+    Require(device != nullptr, "native depth storage alias requires Vulkan");
+    const auto context = device->graphicsContext();
+    constexpr VkExtent2D extent{5u, 3u};
+    constexpr std::uint32_t samples = 4u;
+    constexpr std::size_t prefix = 65536u;
+    const auto bytes = static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, 4u, samples));
+    TargetMemory memory(prefix + bytes), metadata(65536u);
+    std::memset(memory.Data(), 0x3c, prefix + bytes);
+    std::memset(metadata.Data(), 0, 65536u);
+    struct Cleanup {
+        AgcDriver::VulkanDevice& device;
+        ~Cleanup() { device.WaitIdle(); ClearCachedTextures(device.Device()); ClearDepthSurfaces(device.Device()); }
+    } cleanup{*device};
+    GuestTextureResource alias{};
+    alias.baseAddress = memory.Address();
+    alias.width = 256u;
+    alias.height = static_cast<std::uint32_t>((prefix + bytes) / 1024u);
+    alias.mipCount = alias.allocatedMipCount = 1u;
+    alias.dimension = TextureDimension::k2D;
+    alias.tileMode = TextureTileMode::kLinear;
+    alias.format = 22u;
+    alias.dstSelX = 0u;
+    alias.dstSelY = alias.dstSelZ = 4u;
+    alias.dstSelW = 5u;
+    auto cached = CachedStorageSurface(context, alias);
+    Require(cached != nullptr, "storage alias was not cached before native depth creation");
+    DepthTarget depth{memory.Address() + prefix, 0u, extent, VK_FORMAT_D32_SFLOAT, 0.0f, 0u, metadata.Address(), false, samples};
+    depth.depthSwizzle = 24u;
+    depth.iterate256 = depth.htilePipeAligned = depth.htileDepthOnly = true;
+    Require(DepthSurfaceView(context, depth) != VK_NULL_HANDLE && DepthSurfaceAt(depth.address), "storage alias fixture has no native depth owner");
+    auto disjoint = alias;
+    disjoint.height = static_cast<std::uint32_t>(prefix / 1024u);
+    Require(CachedStorageSurface(context, disjoint) != nullptr, "disjoint storage alias was not created");
+    Require(DepthSurfaceAt(depth.address), "storage access ending at native depth retired a disjoint owner");
+    Require(CachedStorageSurface(context, alias) != nullptr, "overlapping cached storage alias was not returned");
+    Require(!DepthSurfaceAt(depth.address), "a cached storage view kept a native depth owner inside its range");
+    for (std::size_t offset = 0u; offset < prefix + bytes; ++offset) Require(memory.Data()[offset] == std::byte{0x3c}, "retiring unwritten native depth changed guest bytes");
+    std::puts("cached storage span retires only intersecting native depth owners");
+}
+
 enum class ClearFault { None, PartialStore, CpuWrite, DepthWrite, BadMetadata, UnprovenDispatch, PendingWrite, Overlap, PossibleStore, CompletedPossibleStore, DriverDispatch, ImportWindowWrite };
 
 void CheckClearDispatch() {
@@ -927,10 +1001,10 @@ void CheckDepthTarget(Context context, VkFormat format, std::uint32_t fragments,
     Require(probe[0] == std::byte{0xa5}, "resident depth guard blocked an unrelated read");
     auto alias = target;
     alias.htileAddress += 65536u;
-    TargetRefuses([&] { DepthSurfaceView(context, alias); }, "layout or metadata changed");
+    TargetRefuses([&] { DepthSurfaceView(context, alias); }, "sample-preserving guest publication");
     alias = target;
     alias.htileDepthOnly = !target.htileDepthOnly;
-    TargetRefuses([&] { DepthSurfaceView(context, alias); }, "layout or metadata changed");
+    TargetRefuses([&] { DepthSurfaceView(context, alias); }, "sample-preserving guest publication");
     auto resource = DecodeTextureResource(words);
     for (std::uint32_t field = 0u; field < 18u; ++field) {
         auto changed = resource;
@@ -1042,7 +1116,7 @@ void CheckHtileRouting(Context context, VkFormat format, std::uint32_t fragments
     auto alias = target;
     alias.samples = 1u;
     alias.address = single.Address();
-    TargetRefuses([&] { DepthSurfaceView(context, alias); }, "layout or metadata changed");
+    Require(DepthSurfaceView(context, alias) != VK_NULL_HANDLE, "a single-sample bind could not retire an unwritten native HTILE owner");
     Require(untouched(), "a single-sample bind over a native owner's HTILE stored expanded words into it");
     std::printf("Native depth format=%u samples=%u: binds over the owner's HTILE left its words alone\n", static_cast<std::uint32_t>(format), fragments);
 }
@@ -1304,6 +1378,8 @@ int main(int argc, char** argv) {
         }
         CheckDrawFeedback();
         const auto context = device->GetContext();
+        if (argc == 1) CheckDepthAttachmentAlias();
+        if (argc == 1) CheckStorageAliasRetirement();
         std::unique_lock lock(AgcDriver::GuestMemory::GpuMutex());
         Require(DepthSupported(context, VK_FORMAT_D32_SFLOAT, 4u), "the native depth regression requires sampled D32 with four samples");
         if (argc == 2 && std::string_view(argv[1]) == "--clear-refusals") {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/OptimizeOnFiber.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/OptimizeOnFiber.cpp
new file mode 100644
index 0000000000..68f3ccb6a6
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/OptimizeOnFiber.cpp
@@ -0,0 +1,140 @@
+#include "prx/libSceFiber/include/Api.hpp"
+#if defined(ANYPS5_ENABLE_SPIRV_TOOLS) && ANYPS5_ENABLE_SPIRV_TOOLS
+#include "SpirvBackend/SpirvOptimizer.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "SceTypes.hpp"
+#include <array>
+#include <cstdint>
+#include <exception>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+constexpr std::size_t ContextBytes = 64 * 1024;
+constexpr std::size_t FiberStackLimit = 8 * 1024;
+constexpr std::uint32_t VulkanVersion = 0x00401000u;
+constexpr std::uint32_t SpirvVersion = 0x00010300u;
+constexpr std::uint64_t Fill = 0x5aa5c33c5aa5c33cull;
+
+alignas(16) std::array<std::uint64_t, ContextBytes / sizeof(std::uint64_t)> FiberContext;
+struct alignas(8) FiberStorage {
+    unsigned char bytes[0x100];
+};
+FiberStorage FiberObjectStorage;
+
+constexpr std::array<std::uint32_t, 410> Module{
+    0x07230203u, 0x00010300u, 0x0008000bu, 0x00000044u, 0x00000000u, 0x00020011u, 0x00000001u, 0x0006000bu,
+    0x00000001u, 0x4c534c47u, 0x6474732eu, 0x3035342eu, 0x00000000u, 0x0003000eu, 0x00000000u, 0x00000001u,
+    0x0006000fu, 0x00000005u, 0x00000004u, 0x6e69616du, 0x00000000u, 0x0000000bu, 0x00060010u, 0x00000004u,
+    0x00000011u, 0x00000040u, 0x00000001u, 0x00000001u, 0x00030003u, 0x00000002u, 0x000001c2u, 0x00040005u,
+    0x00000004u, 0x6e69616du, 0x00000000u, 0x00040005u, 0x00000008u, 0x65646e69u, 0x00000078u, 0x00080005u,
+    0x0000000bu, 0x475f6c67u, 0x61626f6cu, 0x766e496cu, 0x7461636fu, 0x496e6f69u, 0x00000044u, 0x00030005u,
+    0x00000010u, 0x006d7573u, 0x00040005u, 0x00000011u, 0x74617473u, 0x00000065u, 0x00040005u, 0x00000013u,
+    0x61746144u, 0x00000000u, 0x00050006u, 0x00000013u, 0x00000000u, 0x756c6176u, 0x00007365u, 0x00030005u,
+    0x00000015u, 0x00000000u, 0x00030005u, 0x0000001cu, 0x00000069u, 0x00040047u, 0x0000000bu, 0x0000000bu,
+    0x0000001cu, 0x00040047u, 0x00000012u, 0x00000006u, 0x00000004u, 0x00030047u, 0x00000013u, 0x00000002u,
+    0x00050048u, 0x00000013u, 0x00000000u, 0x00000023u, 0x00000000u, 0x00040047u, 0x00000015u, 0x00000021u,
+    0x00000000u, 0x00040047u, 0x00000015u, 0x00000022u, 0x00000000u, 0x00040047u, 0x00000043u, 0x0000000bu,
+    0x00000019u, 0x00020013u, 0x00000002u, 0x00030021u, 0x00000003u, 0x00000002u, 0x00040015u, 0x00000006u,
+    0x00000020u, 0x00000000u, 0x00040020u, 0x00000007u, 0x00000007u, 0x00000006u, 0x00040017u, 0x00000009u,
+    0x00000006u, 0x00000003u, 0x00040020u, 0x0000000au, 0x00000001u, 0x00000009u, 0x0004003bu, 0x0000000au,
+    0x0000000bu, 0x00000001u, 0x0004002bu, 0x00000006u, 0x0000000cu, 0x00000000u, 0x00040020u, 0x0000000du,
+    0x00000001u, 0x00000006u, 0x0003001du, 0x00000012u, 0x00000006u, 0x0003001eu, 0x00000013u, 0x00000012u,
+    0x00040020u, 0x00000014u, 0x0000000cu, 0x00000013u, 0x0004003bu, 0x00000014u, 0x00000015u, 0x0000000cu,
+    0x00040015u, 0x00000016u, 0x00000020u, 0x00000001u, 0x0004002bu, 0x00000016u, 0x00000017u, 0x00000000u,
+    0x00040020u, 0x00000019u, 0x0000000cu, 0x00000006u, 0x0004002bu, 0x00000006u, 0x00000023u, 0x00000010u,
+    0x00020014u, 0x00000024u, 0x0004002bu, 0x00000006u, 0x00000027u, 0x00000001u, 0x0004002bu, 0x00000006u,
+    0x00000038u, 0x0019660du, 0x0004002bu, 0x00000006u, 0x0000003au, 0x3c6ef35fu, 0x0004002bu, 0x00000016u,
+    0x0000003du, 0x00000001u, 0x0004002bu, 0x00000006u, 0x00000042u, 0x00000040u, 0x0006002cu, 0x00000009u,
+    0x00000043u, 0x00000042u, 0x00000027u, 0x00000027u, 0x00050036u, 0x00000002u, 0x00000004u, 0x00000000u,
+    0x00000003u, 0x000200f8u, 0x00000005u, 0x0004003bu, 0x00000007u, 0x00000008u, 0x00000007u, 0x0004003bu,
+    0x00000007u, 0x00000010u, 0x00000007u, 0x0004003bu, 0x00000007u, 0x00000011u, 0x00000007u, 0x0004003bu,
+    0x00000007u, 0x0000001cu, 0x00000007u, 0x00050041u, 0x0000000du, 0x0000000eu, 0x0000000bu, 0x0000000cu,
+    0x0004003du, 0x00000006u, 0x0000000fu, 0x0000000eu, 0x0003003eu, 0x00000008u, 0x0000000fu, 0x0003003eu,
+    0x00000010u, 0x0000000cu, 0x0004003du, 0x00000006u, 0x00000018u, 0x00000008u, 0x00060041u, 0x00000019u,
+    0x0000001au, 0x00000015u, 0x00000017u, 0x00000018u, 0x0004003du, 0x00000006u, 0x0000001bu, 0x0000001au,
+    0x0003003eu, 0x00000011u, 0x0000001bu, 0x0003003eu, 0x0000001cu, 0x0000000cu, 0x000200f9u, 0x0000001du,
+    0x000200f8u, 0x0000001du, 0x000400f6u, 0x0000001fu, 0x00000020u, 0x00000000u, 0x000200f9u, 0x00000021u,
+    0x000200f8u, 0x00000021u, 0x0004003du, 0x00000006u, 0x00000022u, 0x0000001cu, 0x000500b0u, 0x00000024u,
+    0x00000025u, 0x00000022u, 0x00000023u, 0x000400fau, 0x00000025u, 0x0000001eu, 0x0000001fu, 0x000200f8u,
+    0x0000001eu, 0x0004003du, 0x00000006u, 0x00000026u, 0x00000011u, 0x000500c7u, 0x00000006u, 0x00000028u,
+    0x00000026u, 0x00000027u, 0x000500abu, 0x00000024u, 0x00000029u, 0x00000028u, 0x0000000cu, 0x000300f7u,
+    0x0000002bu, 0x00000000u, 0x000400fau, 0x00000029u, 0x0000002au, 0x00000031u, 0x000200f8u, 0x0000002au,
+    0x0004003du, 0x00000006u, 0x0000002cu, 0x00000011u, 0x0004003du, 0x00000006u, 0x0000002du, 0x0000001cu,
+    0x00050084u, 0x00000006u, 0x0000002eu, 0x0000002cu, 0x0000002du, 0x0004003du, 0x00000006u, 0x0000002fu,
+    0x00000010u, 0x00050080u, 0x00000006u, 0x00000030u, 0x0000002fu, 0x0000002eu, 0x0003003eu, 0x00000010u,
+    0x00000030u, 0x000200f9u, 0x0000002bu, 0x000200f8u, 0x00000031u, 0x0004003du, 0x00000006u, 0x00000032u,
+    0x00000011u, 0x0004003du, 0x00000006u, 0x00000033u, 0x0000001cu, 0x00050080u, 0x00000006u, 0x00000034u,
+    0x00000032u, 0x00000033u, 0x0004003du, 0x00000006u, 0x00000035u, 0x00000010u, 0x000500c6u, 0x00000006u,
+    0x00000036u, 0x00000035u, 0x00000034u, 0x0003003eu, 0x00000010u, 0x00000036u, 0x000200f9u, 0x0000002bu,
+    0x000200f8u, 0x0000002bu, 0x0004003du, 0x00000006u, 0x00000037u, 0x00000011u, 0x00050084u, 0x00000006u,
+    0x00000039u, 0x00000037u, 0x00000038u, 0x00050080u, 0x00000006u, 0x0000003bu, 0x00000039u, 0x0000003au,
+    0x0003003eu, 0x00000011u, 0x0000003bu, 0x000200f9u, 0x00000020u, 0x000200f8u, 0x00000020u, 0x0004003du,
+    0x00000006u, 0x0000003cu, 0x0000001cu, 0x00050080u, 0x00000006u, 0x0000003eu, 0x0000003cu, 0x0000003du,
+    0x0003003eu, 0x0000001cu, 0x0000003eu, 0x000200f9u, 0x0000001du, 0x000200f8u, 0x0000001fu, 0x0004003du,
+    0x00000006u, 0x0000003fu, 0x00000008u, 0x0004003du, 0x00000006u, 0x00000040u, 0x00000010u, 0x00060041u,
+    0x00000019u, 0x00000041u, 0x00000015u, 0x00000017u, 0x0000003fu, 0x0003003eu, 0x00000041u, 0x00000040u,
+    0x000100fdu, 0x00010038u
+};
+
+std::vector<std::uint32_t> Optimized;
+std::exception_ptr Failure;
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+std::vector<std::uint32_t> Optimize() {
+    return ShaderRecompiler::ValidateAndOptimizeSpirv(Module, VulkanVersion, SpirvVersion);
+}
+
+void APS5_VABI OptimizeOnFiber(std::uint64_t, std::uint64_t) {
+    try {
+        Optimized = Optimize();
+    } catch (...) {
+        Failure = std::current_exception();
+    }
+    sceFiberReturnToThread(0, nullptr);
+}
+
+std::size_t FiberStackUsed() {
+    std::size_t untouched = 0;
+    while (untouched < FiberContext.size() && FiberContext[untouched] == Fill) ++untouched;
+    return (FiberContext.size() - untouched) * sizeof(std::uint64_t);
+}
+
+}
+
+int main() {
+    try {
+        FiberContext.fill(Fill);
+        auto* fiber = reinterpret_cast<FiberObject*>(&FiberObjectStorage);
+        Require(_sceFiberInitializeImpl_nid_postfix(fiber, "optimize", OptimizeOnFiber, 0, FiberContext.data(), ContextBytes, nullptr, 0) == 0, "SPIR-V optimization on a fiber: the fiber was not initialized");
+        const auto before = ShaderRecompiler::OptimizerHostThreads();
+        Require(sceFiberRun_nid_postfix(fiber, 0, nullptr) == 0, "SPIR-V optimization on a fiber: the fiber did not run");
+        const auto onFiber = ShaderRecompiler::OptimizerHostThreads() - before;
+        Require(sceFiberFinalize(fiber) == 0, "SPIR-V optimization on a fiber: the fiber was not finalized");
+        if (Failure) std::rethrow_exception(Failure);
+        const auto used = FiberStackUsed();
+        const auto beforeThread = ShaderRecompiler::OptimizerHostThreads();
+        const auto onThreadResult = Optimize();
+        const auto onThread = ShaderRecompiler::OptimizerHostThreads() - beforeThread;
+        Require(Optimized == onThreadResult, "SPIR-V optimization on a fiber returned another module than on the thread");
+        Require(used <= FiberStackLimit, "SPIR-V optimization on a fiber running on its context used " + std::to_string(used) + " bytes of it, more than " + std::to_string(FiberStackLimit) + ": the optimizer ran on it");
+        Require(onFiber == 1, "SPIR-V optimization on a fiber running on its context started " + std::to_string(onFiber) + " host threads instead of one");
+        Require(onThread == 0, "SPIR-V optimization on an ordinary thread started " + std::to_string(onThread) + " host threads instead of optimizing on its own stack");
+        std::cout << "SPIR-V optimization on a fiber used " << used << " bytes of its context\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
+#else
+int main() {
+    return 77;
+}
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp
index 8984302a91..213d8c7aaf 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <array>
 #include <cstdint>
@@ -50,15 +51,7 @@ public:
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
             const auto properties = function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties");
-            context.physical = devices.front();
-            for (const auto candidate : devices) {
-                VkPhysicalDeviceProperties described{};
-                properties(candidate, &described);
-                if (described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU) {
-                    context.physical = candidate;
-                    break;
-                }
-            }
+            context.physical = SelectFixturePhysicalDevice(devices, properties);
             VkPhysicalDeviceProperties selected{};
             properties(context.physical, &selected);
             context.limits = selected.limits;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444ColorTarget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444ColorTarget.cpp
new file mode 100644
index 0000000000..85326136cf
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444ColorTarget.cpp
@@ -0,0 +1,330 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "Optimization/ResourceProgram.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <limits>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::ColorTargetLayout;
+using AgcDriver::Graphics::ColorTileMode;
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 256;
+constexpr std::uint32_t Height = 128;
+constexpr std::uint32_t ScissorWidth = 128;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t Unorm4_4_4_4Info = 0x8000u | (19u << 2u) | (2u << 11u);
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Float16Export = 4;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 64>, 32> Programs{};
+std::size_t programCount = 0;
+
+struct Golden {
+    std::array<float, 4> rgba;
+    std::uint16_t word;
+};
+
+std::uint32_t Half(float value) {
+    Require(value == 0.0f || (value >= 0.0625f && value <= 1.0f), "the test's half values are normal and at most 1");
+    if (value == 0.0f) return 0;
+    const auto bits = std::bit_cast<std::uint32_t>(value);
+    Require((bits & 0x1fffu) == 0, "the test's half values are exact");
+    return ((((bits >> 23u) & 0xffu) - 112u) << 10u) | ((bits >> 13u) & 0x3ffu);
+}
+
+std::span<const std::uint32_t> Program(const std::array<std::uint32_t, 4>& vgprs, bool compressed) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    for (std::uint32_t vgpr = 0; vgpr < (compressed ? 2u : 4u); ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = vgprs[vgpr];
+    }
+    code[at++] = compressed ? 0xf8001c0fu : 0xf800180fu;
+    code[at++] = compressed ? 0x00000504u : 0x07060504u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+std::span<const std::uint32_t> Float32Program(std::array<float, 4> rgba) {
+    return Program({std::bit_cast<std::uint32_t>(rgba[0]), std::bit_cast<std::uint32_t>(rgba[1]), std::bit_cast<std::uint32_t>(rgba[2]), std::bit_cast<std::uint32_t>(rgba[3])}, false);
+}
+
+std::span<const std::uint32_t> Float16Program(std::array<float, 4> rgba) {
+    return Program({Half(rgba[0]) | (Half(rgba[1]) << 16u), Half(rgba[2]) | (Half(rgba[3]) << 16u), 0, 0}, true);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color target");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        AgcDriver::Graphics::StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t attrib3) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Unorm4_4_4_4Info;
+    cx[0x31d] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = attrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R16_UINT && color.elementBytes == 2 && color.componentMapping == 0x1bu && color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 && color.bytes == block.bytes, "the 4_4_4_4 unorm target did not decode as a packed R16_UINT target");
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::uint32_t exportFormat, std::span<const std::uint32_t> pixelCode) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(Triangle.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(Triangle.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {ScissorWidth, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.colorWriteMask = VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT | VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, exportFormat}};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {waveSize, 0, {}, std::nullopt, AgcDriver::Graphics::DecodePixelStageInfo(context, {}), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    const auto handle = ShaderRecompiler::PrepareShader(fragment);
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{codeAddress, 0, 1, {pixelCode.begin(), pixelCode.end()}, {}};
+    snapshot.prepared->entries.push_back({0, handle});
+    fragment.shader.code = snapshot.code;
+    fragment.context.pixel = AgcDriver::Graphics::DecodePixelStageInfo(context, AgcDriver::Graphics::ExportMappings(state));
+    fragment.context.pixel->targetExportPacking = AgcDriver::Graphics::ExportPackings(state);
+    const ShaderRecompiler::SrtRuntime runtime{};
+    const auto materialize = [&](const ShaderRecompiler::RecompileRequest& request) {
+        const auto invocation = AgcDriver::DriverDetail::InvocationFor(snapshot, 0, request);
+        return invocation.Materialize(*invocation.Capture(runtime));
+    };
+    const auto pixelResult = materialize(fragment);
+    auto unpacked = fragment;
+    unpacked.context.pixel->targetExportPacking.fill(ShaderRecompiler::ColorExportPacking::None);
+    const auto plain = materialize(unpacked);
+    Require(pixelResult->variantId == ShaderRecompiler::GetPreparedArtifact(*handle).variantId && plain->variantId == pixelResult->variantId, "the draw did not use the registered pixel shader");
+    Require(plain->PipelineVariantId() != pixelResult->PipelineVariantId() && materialize(fragment)->PipelineVariantId() == pixelResult->PipelineVariantId(), "the 4_4_4_4 unorm packing did not key its own specialization");
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, pixelResult.get(), PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::vector<std::uint16_t> ReadBack(AgcDriver::VulkanDevice& device, const Block& block) {
+    AgcDriver::Graphics::StorageTexture::FlushPending(block.Address(), block.bytes, nullptr, "test read-back");
+    device.WaitIdle();
+    std::vector<std::uint16_t> stored(block.bytes / 2u);
+    AgcDriver::GuestMemory::Read(block.Address(), std::as_writable_bytes(std::span(stored)), 1);
+    return stored;
+}
+
+void ExpectSurface(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& before, std::uint32_t word, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            const bool inside = x < ScissorWidth;
+            const std::uint32_t expected = inside ? word : before[index];
+            if (stored[index] == expected) continue;
+            char detail[160];
+            std::snprintf(detail, sizeof(detail), ": pixel (%u, %u) %s the scissor holds 0x%04x, expected 0x%04x", x, y, inside ? "inside" : "outside", stored[index], expected);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+std::vector<std::uint16_t> Fill(Block& block) {
+    std::vector<std::uint16_t> words(block.bytes / 2u);
+    for (std::size_t index = 0; index < words.size(); ++index) words[index] = static_cast<std::uint16_t>((index * 0x9e3779b9u) >> 11u);
+    std::memcpy(block.data, words.data(), block.bytes);
+    return words;
+}
+
+std::string Describe(std::array<float, 4> rgba) {
+    char text[112];
+    std::snprintf(text, sizeof(text), "(%.9g, %.9g, %.9g, %.9g)", rgba[0], rgba[1], rgba[2], rgba[3]);
+    return text;
+}
+
+void TargetTests(AgcDriver::VulkanDevice& device, Block& block, std::uint32_t attrib3, ColorTileMode mode, const char* kind) {
+    const ColorTargetLayout layout(Width, Height, mode, 2);
+    Require(layout.Bytes() == block.bytes, "the test surface size disagrees with its layout");
+    const auto color = DecodeTarget(block, attrib3);
+    auto before = Fill(block);
+    const float nan = std::numeric_limits<float>::quiet_NaN();
+    const float infinity = std::numeric_limits<float>::infinity();
+    const std::array<Golden, 11> float32Cases{{
+        {{1.0f, 0.0f, 0.0f, 0.0f}, 0xf000u},
+        {{0.0f, 1.0f, 0.0f, 0.0f}, 0x0f00u},
+        {{0.0f, 0.0f, 1.0f, 0.0f}, 0x00f0u},
+        {{0.0f, 0.0f, 0.0f, 1.0f}, 0x000fu},
+        {{1.0f, 1.0f, 1.0f, 1.0f}, 0xffffu},
+        {{1.0f, 0.5f, 0.0f, 0.25f}, 0xf804u},
+        {{0.0f, 1.0f, 0.5f, 0.25f}, 0x0f84u},
+        {{nan, -1.0f, 2.0f, infinity}, 0x00ffu},
+        {{1.0f / 15.0f, 2.0f / 15.0f, 7.0f / 15.0f, 14.0f / 15.0f}, 0x127eu},
+        {{0.1f, 0.7f, 0.9f, 0.3f}, 0x2ad5u},
+        {{-infinity, std::numeric_limits<float>::min(), 0.999999940f, std::numeric_limits<float>::denorm_min()}, 0x00f0u},
+    }};
+    for (const auto& golden : float32Cases) {
+        Draw(device, color, Float32Export, Float32Program(golden.rgba));
+        ExpectSurface(device, block, layout, before, golden.word, std::string("a 32_ABGR export of ") + Describe(golden.rgba) + " into a " + kind + " 4_4_4_4 unorm target");
+        before = ReadBack(device, block);
+    }
+    const std::array<Golden, 7> float16Cases{{
+        {{1.0f, 0.0f, 0.0f, 0.0f}, 0xf000u},
+        {{0.0f, 1.0f, 0.0f, 0.0f}, 0x0f00u},
+        {{0.0f, 0.0f, 1.0f, 0.0f}, 0x00f0u},
+        {{0.0f, 0.0f, 0.0f, 1.0f}, 0x000fu},
+        {{1.0f, 1.0f, 1.0f, 1.0f}, 0xffffu},
+        {{1.0f, 0.5f, 0.0f, 0.25f}, 0xf804u},
+        {{0.5f, 0.75f, 0.125f, 0.25f}, 0x8b24u},
+    }};
+    for (const auto& golden : float16Cases) {
+        Draw(device, color, Float16Export, Float16Program(golden.rgba));
+        ExpectSurface(device, block, layout, before, golden.word, std::string("an FP16_ABGR export of ") + Describe(golden.rgba) + " into a " + kind + " 4_4_4_4 unorm target");
+        before = ReadBack(device, block);
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        Block linear(ColorTargetLayout(Width, Height, ColorTileMode::Linear, 2).Bytes());
+        TargetTests(*device, linear, LinearAttrib3, ColorTileMode::Linear, "linear");
+        std::puts("4_4_4_4 unorm color target tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp
new file mode 100644
index 0000000000..894ccc375a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp
@@ -0,0 +1,427 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "Optimization/ResourceProgram.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <memory>
+#include <numeric>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Side = 16;
+constexpr std::array<std::uint32_t, 3> SampleCounts{2, 4, 8};
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t Unorm4_4_4_4Info = 0x8000u | (19u << 2u) | (2u << 11u);
+constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
+constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Words = 32;
+constexpr std::uint32_t LoadResult = 12;
+constexpr double EdgeMargin = 1.0 / 32.0;
+constexpr std::array<float, 4> First{0.2f, 0.4f, 0.6f, 0.8f};
+constexpr std::array<float, 4> Second{13.0f / 15.0f, 0.0f, 1.0f, 0.0f};
+constexpr std::array<float, 4> Third{1.0f / 15.0f, 1.0f, 0.0f, 4.0f / 15.0f};
+constexpr std::array<float, 4> Fourth{0.0f, 7.0f / 15.0f, 0.0f, 11.0f / 15.0f};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 26> LoadCode{
+    0x34020087, 0xe0301000, 0x80000201, 0xe0301004, 0x80000301, 0xe0301008, 0x80000401, 0xe030100c,
+    0x80000501, 0xe0301010, 0x80000601, 0xe0301014, 0x80000701, 0xbf8c3f70, 0xf0001f30, 0x00011005,
+    0xbf8c3f70, 0xe0701030, 0x80001001, 0xe0701034, 0x80001101, 0xe0701038, 0x80001201, 0xe070103c,
+    0x80001301, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Covering{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+constexpr std::array<std::array<float, 4>, 3> Cutting{{
+    {-0.93f, -1.0f, 0.5f, 1.0f}, {0.37f, -1.0f, 0.5f, 1.0f}, {-0.21f, 0.94f, 0.5f, 1.0f}
+}};
+
+constexpr std::array<std::array<float, 4>, 3> Crossing{{
+    {-0.6f, -0.2f, 0.5f, 1.0f}, {0.9f, -0.85f, 0.5f, 1.0f}, {0.5f, 0.9f, 0.5f, 1.0f}
+}};
+
+constexpr std::array<std::array<float, 4>, 3> Overlapping{{
+    {-0.08f, -0.47f, 0.5f, 1.0f}, {1.0f, -0.13f, 0.5f, 1.0f}, {0.29f, 1.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 16>, 24> Programs{};
+std::size_t programCount = 0;
+alignas(256) std::array<std::uint32_t, Threads * Words> Buffer{};
+
+std::uint32_t MultisampledAttrib(std::uint32_t samples) {
+    const auto shift = static_cast<std::uint32_t>(std::countr_zero(samples));
+    return (shift << 12u) | (shift << 15u);
+}
+
+std::uint32_t Unorm(float value) {
+    if (!(value > 0.0f)) return 0;
+    if (value >= 1.0f) return 15;
+    return static_cast<std::uint32_t>(std::nearbyint(static_cast<double>(value) * 15.0));
+}
+
+std::uint32_t Packed(std::array<float, 4> rgba) {
+    return Unorm(rgba[3]) | (Unorm(rgba[2]) << 4u) | (Unorm(rgba[1]) << 8u) | (Unorm(rgba[0]) << 12u);
+}
+
+std::span<const std::uint32_t> Float32Program(std::array<float, 4> rgba) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    for (std::uint32_t vgpr = 0; vgpr < 4u; ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = std::bit_cast<std::uint32_t>(rgba[vgpr]);
+    }
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x07060504u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes) {
+#ifdef _WIN32
+        data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+#endif
+        Require(data != nullptr, "cannot allocate the multisampled color target");
+        std::memset(data, 0, bytes);
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        VirtualFree(data, 0, MEM_RELEASE);
+#else
+        std::free(data);
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t samples) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Unorm4_4_4_4Info;
+    cx[0x31d] = MultisampledAttrib(samples);
+    cx[0x3b0] = ((Side - 1u) << 14u) | (Side - 1u);
+    cx[0x3b8] = TiledAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    const auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R16_UINT && color.componentMapping == 0x1bu && color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 && color.samples == samples && color.extent.width == Side && color.extent.height == Side, "the target did not decode as a 16x16 packed R16_UINT surface of " + std::to_string(samples) + " samples");
+    return color;
+}
+
+AgcDriver::QueueState Queue(const Block& block, std::uint32_t targetMask, std::uint32_t samples) {
+    AgcDriver::QueueState queue;
+    queue.userConfig[0x242] = 4;
+    queue.context = {
+        {0x2d5, 0x2000}, {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, targetMask}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, Float32Export}, {0x1c3, 4},
+        {0x318, static_cast<std::uint32_t>(block.Address() >> 8u)}, {0x390, static_cast<std::uint32_t>(block.Address() >> 40u)},
+        {0x31b, 0}, {0x31c, Unorm4_4_4_4Info}, {0x31d, MultisampledAttrib(samples)},
+        {0x3b0, ((Side - 1u) << 14u) | (Side - 1u)}, {0x3b8, TiledAttrib3}, {0x1e0, 0},
+        {0xc, 0}, {0xd, (Side << 16u) | Side},
+        {0x81, 0x80000000}, {0x82, (Side << 16u) | Side},
+        {0x90, 0x80000000}, {0x91, (Side << 16u) | Side},
+        {0x94, 0x80000000}, {0x95, (Side << 16u) | Side},
+        {0x10f, std::bit_cast<std::uint32_t>(static_cast<float>(Side) / 2.0f)}, {0x110, std::bit_cast<std::uint32_t>(static_cast<float>(Side) / 2.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-static_cast<float>(Side) / 2.0f)}, {0x112, std::bit_cast<std::uint32_t>(static_cast<float>(Side) / 2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)}
+    };
+    queue.shader[0x008] = 0x100;
+    queue.shader[0x009] = 0;
+    return queue;
+}
+
+AgcDriver::Graphics::State TargetState(const Block& block, std::uint32_t exportedMask, std::uint32_t samples) {
+    const bool partial = exportedMask != 0xfu;
+    const auto decoded = AgcDriver::Graphics::DecodeState(Queue(block, exportedMask, samples));
+    const auto& color = decoded.colors.front();
+    char detail[256];
+    std::snprintf(detail, sizeof(detail), "CB_TARGET_MASK 0x%x of the %u-sample 4_4_4_4 target decoded %zu targets, %u samples, word mask 0x%04x, write mask 0x%x and %s shading", exportedMask, samples, decoded.colors.size(), decoded.samples, color.partialWriteMask, decoded.blends.front().colorWriteMask, decoded.perSampleShading ? "per-sample" : "pixel-rate");
+    Require(decoded.colors.size() == 1u && decoded.samples == samples && color.samples == samples && color.partialWriteMask == (partial ? AgcDriver::Graphics::PackedWriteMask(color.componentMapping, exportedMask) : 0u) && decoded.blends.size() == 1u && decoded.blends.front().colorWriteMask == (partial ? 0u : 0xfu) && decoded.blend.colorWriteMask == decoded.blends.front().colorWriteMask && decoded.perSampleShading == partial, detail);
+    const auto merge = AgcDriver::Graphics::ExportTargetMerge(decoded);
+    Require(merge.mask == color.partialWriteMask && merge.samples == (partial ? samples : 1u) && !merge.depthStencilWrites && merge.descriptor == (partial ? AgcDriver::Graphics::EncodeTextureResource(AgcDriver::Graphics::TargetMergeSurface(color)) : std::array<std::uint32_t, 8>{}), "the decoded " + std::to_string(samples) + "-sample target exported another merge than its own surface");
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, 64u, 64u, std::nullopt, std::nullopt};
+    state.colors = decoded.colors;
+    state.color = decoded.color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Side, Side};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Side), static_cast<float>(Side), -static_cast<float>(Side), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {Side, Side}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blends = decoded.blends;
+    state.blend = decoded.blend;
+    state.blendConstants = {};
+    state.samples = decoded.samples;
+    state.perSampleShading = decoded.perSampleShading;
+    return state;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::State& state, const std::array<std::array<float, 4>, 3>& triangle, std::span<const std::uint32_t> pixelCode) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(triangle.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(triangle.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, Float32Export}};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {waveSize, 0, {}, std::nullopt, AgcDriver::Graphics::DecodePixelStageInfo(context, {}), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    const auto handle = ShaderRecompiler::PrepareShader(fragment);
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{codeAddress, 0, 1, {pixelCode.begin(), pixelCode.end()}, {}};
+    snapshot.prepared->entries.push_back({0, handle});
+    fragment.shader.code = snapshot.code;
+    fragment.context.pixel = AgcDriver::Graphics::DecodePixelStageInfo(context, AgcDriver::Graphics::ExportMappings(state));
+    fragment.context.pixel->targetExportPacking = AgcDriver::Graphics::ExportPackings(state);
+    fragment.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(state);
+    const ShaderRecompiler::SrtRuntime runtime{};
+    const auto invocation = AgcDriver::DriverDetail::InvocationFor(snapshot, 0, fragment);
+    const auto pixelResult = invocation.Materialize(*invocation.Capture(runtime));
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, pixelResult.get(), PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::vector<std::uint32_t> LoadSamples(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture, std::uint32_t samples) {
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(Buffer.data());
+    const std::array<std::uint32_t, 4> buffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), static_cast<std::uint32_t>(Buffer.size() * 4u), 0x31016facu};
+    std::copy(buffer.begin(), buffer.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(LoadCode.data()), std::as_bytes(std::span(LoadCode))}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(LoadCode.data()), LoadCode, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto program = ShaderRecompiler::Recompile(request);
+    std::vector<std::uint32_t> loaded(Side * Side * samples);
+    for (std::uint32_t first = 0; first < loaded.size(); first += Threads) {
+        Buffer.fill(0xdeadbeefu);
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            const auto index = first + tid;
+            const auto pixel = index / samples;
+            const std::array<std::uint32_t, 6> words{0u, 0u, 0u, pixel % Side, pixel / Side, index % samples};
+            std::copy(words.begin(), words.end(), &Buffer[tid * Words]);
+        }
+        device.Dispatch(program, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(LoadCode.data()));
+        device.WaitIdle();
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) loaded[first + tid] = Buffer[tid * Words + LoadResult];
+    }
+    return loaded;
+}
+
+double EdgeDistance(const std::array<std::array<float, 4>, 3>& triangle, double x, double y, std::size_t from) {
+    const auto pixels = [](const std::array<float, 4>& vertex) {
+        return std::array<double, 2>{(static_cast<double>(vertex[0]) + 1.0) * 0.5 * Side, Side - (static_cast<double>(vertex[1]) + 1.0) * 0.5 * Side};
+    };
+    const auto a = pixels(triangle[from]);
+    const auto b = pixels(triangle[(from + 1u) % triangle.size()]);
+    const auto c = pixels(triangle[(from + 2u) % triangle.size()]);
+    const auto length = std::hypot(b[0] - a[0], b[1] - a[1]);
+    const auto side = [&](double px, double py) { return ((b[0] - a[0]) * (py - a[1]) - (b[1] - a[1]) * (px - a[0])) / length; };
+    return side(c[0], c[1]) < 0 ? -side(x, y) : side(x, y);
+}
+
+double Inside(const std::array<std::array<float, 4>, 3>& triangle, double x, double y) {
+    return std::min({EdgeDistance(triangle, x, y, 0), EdgeDistance(triangle, x, y, 1), EdgeDistance(triangle, x, y, 2)});
+}
+
+void RunSamples(AgcDriver::VulkanDevice& device, const Block& block, std::uint32_t samples) {
+    const auto color = DecodeTarget(block, samples);
+    const auto full = TargetState(block, 0xfu, samples);
+    Draw(device, full, Covering, Float32Program(First));
+    const auto merged = TargetState(block, 0x1u, samples);
+    Require(merged.colors.front().partialWriteMask == 0xf000u, "an X write of the 4_4_4_4 target did not merge bits 15..12");
+    Draw(device, merged, Cutting, Float32Program(Second));
+    Draw(device, full, Overlapping, Float32Program(Third));
+    const auto texture = AgcDriver::Graphics::EncodeTextureResource(AgcDriver::Graphics::TargetMergeSurface(color));
+    const auto loaded = LoadSamples(device, texture, samples);
+    const auto background = Packed(First);
+    const auto written = (background & 0x0fffu) | (Packed(Second) & 0xf000u);
+    const auto over = Packed(Third);
+    Require(written != background && over != written && over != background, "the test colors do not differ in the merged nibble");
+    const auto locations = AgcDriver::Graphics::SampleLocations(merged);
+    std::vector<std::uint32_t> pixelsByCoverage(samples + 1u);
+    std::uint32_t checked = 0;
+    std::uint32_t overdrawn = 0;
+    std::uint32_t mergedAfterOverdraw = 0;
+    for (std::uint32_t y = 0; y < Side; ++y) {
+        for (std::uint32_t x = 0; x < Side; ++x) {
+            std::uint32_t covered = 0;
+            for (std::uint32_t sample = 0; sample < samples; ++sample) {
+                const auto word = loaded[(y * Side + x) * samples + sample];
+                char where[160];
+                std::snprintf(where, sizeof(where), "sample %u of pixel (%u, %u) holds 0x%04x", sample, x, y, word);
+                Require(word == written || word == background || word == over, std::string(where) + ", neither the merged word, the first draw's word nor the last draw's word");
+                covered += word == written ? 1u : 0u;
+                const auto px = x + static_cast<double>(locations[sample].x);
+                const auto py = y + static_cast<double>(locations[sample].y);
+                const auto distance = Inside(Cutting, px, py);
+                const auto overDistance = Inside(Overlapping, px, py);
+                if (std::fabs(distance) < EdgeMargin || std::fabs(overDistance) < EdgeMargin) continue;
+                ++checked;
+                const auto expected = overDistance > 0 ? over : distance > 0 ? written : background;
+                overdrawn += overDistance > 0 && distance > 0 ? 1u : 0u;
+                mergedAfterOverdraw += overDistance <= 0 && distance > 0 ? 1u : 0u;
+                Require(word == expected, std::string(where) + (overDistance > 0 ? ", which the last full write covers" : distance > 0 ? ", which only the merging triangle covers" : ", which no later triangle covers"));
+            }
+            ++pixelsByCoverage[covered];
+        }
+    }
+    const auto partlyMerged = std::accumulate(pixelsByCoverage.begin() + 1, pixelsByCoverage.end() - 1, 0u);
+    Require(checked >= Side * Side * samples * 8u / 10u, "fewer than eight in ten samples are clear of the triangles' edges");
+    Require(pixelsByCoverage[0] != 0 && pixelsByCoverage[samples] != 0 && partlyMerged != 0, "the merged samples do not leave pixels unmerged, merged and partly merged");
+    Require(overdrawn != 0 && mergedAfterOverdraw != 0, "the last full write does not cover some merged samples and leave others");
+    Draw(device, full, Covering, Float32Program(First));
+    const auto lowMerged = TargetState(block, 0x8u, samples);
+    Require(lowMerged.colors.front().partialWriteMask == 0x000fu, "a W write of the 4_4_4_4 target did not merge bits 3..0");
+    Draw(device, merged, Cutting, Float32Program(Second));
+    Draw(device, lowMerged, Crossing, Float32Program(Fourth));
+    const auto twice = LoadSamples(device, texture, samples);
+    std::uint32_t checkedTwice = 0;
+    std::uint32_t mergedTwice = 0;
+    for (std::uint32_t y = 0; y < Side; ++y) {
+        for (std::uint32_t x = 0; x < Side; ++x) {
+            for (std::uint32_t sample = 0; sample < samples; ++sample) {
+                const auto px = x + static_cast<double>(locations[sample].x);
+                const auto py = y + static_cast<double>(locations[sample].y);
+                const auto high = Inside(Cutting, px, py);
+                const auto low = Inside(Crossing, px, py);
+                if (std::fabs(high) < EdgeMargin || std::fabs(low) < EdgeMargin) continue;
+                ++checkedTwice;
+                mergedTwice += high > 0 && low > 0 ? 1u : 0u;
+                auto expected = background;
+                if (high > 0) expected = (expected & 0x0fffu) | (Packed(Second) & 0xf000u);
+                if (low > 0) expected = (expected & 0xfff0u) | (Packed(Fourth) & 0x000fu);
+                const auto word = twice[(y * Side + x) * samples + sample];
+                char where[192];
+                std::snprintf(where, sizeof(where), "after an X merge and a W merge drawn back to back, sample %u of pixel (%u, %u) holds 0x%04x, expected 0x%04x", sample, x, y, word, expected);
+                Require(word == expected, where);
+            }
+        }
+    }
+    Require(checkedTwice >= Side * Side * samples * 8u / 10u && mergedTwice != 0, "the back-to-back merges leave fewer than eight in ten samples clear of their edges, or no sample inside both");
+    std::printf("4_4_4_4 unorm %u-sample partial write tests passed: %u partly merged pixels kept bits 15..12 merged into their covered samples only, a full write drawn right after covered %u merged samples, and %u samples kept both of two merges drawn back to back\n", samples, partlyMerged, overdrawn, mergedTwice);
+}
+
+bool SupportsSamples(const AgcDriver::Graphics::Context& context, std::uint32_t samples) {
+    VkImageFormatProperties properties{};
+    const VkImageUsageFlags usage = VK_IMAGE_USAGE_COLOR_ATTACHMENT_BIT | VK_IMAGE_USAGE_TRANSFER_SRC_BIT | VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_STORAGE_BIT;
+    return (context.limits.framebufferColorSampleCounts & samples) != 0u && context.imageFormatProperties(context.physical, VK_FORMAT_R16_UINT, VK_IMAGE_TYPE_2D, VK_IMAGE_TILING_OPTIMAL, usage, 0, &properties) == VK_SUCCESS && (properties.sampleCounts & samples) != 0u;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device);
+        for (const auto& [present, feature] : {std::pair{context.storageImageMultisample, "shaderStorageImageMultisample"}, std::pair{context.sampleRateShading, "sampleRateShading"}, std::pair{TargetHasCapability(device->Target(), spv::CapabilityFragmentShaderPixelInterlockEXT), "fragmentShaderPixelInterlock"}}) {
+            if (present) continue;
+            std::printf("skipped, the device lacks %s\n", feature);
+            return VulkanTestSkipped;
+        }
+        std::vector<std::unique_ptr<Block>> blocks;
+        std::uint32_t tested = 0;
+        for (const auto samples : SampleCounts) {
+            if (!SupportsSamples(context, samples)) {
+                std::printf("%u-sample R16_UINT storage color targets skipped, the device lacks them\n", samples);
+                continue;
+            }
+            blocks.push_back(std::make_unique<Block>(4u * BlockBytes));
+            RunSamples(*device, *blocks.back(), samples);
+            ++tested;
+        }
+        if (tested == 0) return VulkanTestSkipped;
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444PartialWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444PartialWrite.cpp
new file mode 100644
index 0000000000..1acad9581f
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444PartialWrite.cpp
@@ -0,0 +1,531 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "Optimization/ResourceProgram.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <array>
+#include <bit>
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <map>
+#include <mutex>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::ColorTargetLayout;
+using AgcDriver::Graphics::ColorTileMode;
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 256;
+constexpr std::uint32_t Height = 128;
+constexpr std::uint32_t ScissorWidth = 128;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t Unorm4_4_4_4Info = 0x8000u | (19u << 2u) | (2u << 11u);
+constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
+constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Float16Export = 4;
+constexpr std::uint32_t PositionInputs = 0x300u;
+constexpr std::uint32_t DepthInput = 0x400u;
+constexpr std::uint32_t LateKill = 0x40u;
+constexpr std::array<std::uint32_t, 5> CheckerboardKill{0x7e040f00u, 0x7e060f01u, 0x3a040702u, 0x36040481u, 0x7da40480u};
+
+enum class Kill { None, BeforeExport, AfterExport };
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 64>, 64> Programs{};
+std::size_t programCount = 0;
+
+std::uint32_t Unorm(float value) {
+    if (!(value > 0.0f)) return 0;
+    if (value >= 1.0f) return 15;
+    return static_cast<std::uint32_t>(std::nearbyint(static_cast<double>(value) * 15.0));
+}
+
+std::uint32_t Packed(std::array<float, 4> rgba) {
+    return Unorm(rgba[3]) | (Unorm(rgba[2]) << 4u) | (Unorm(rgba[1]) << 8u) | (Unorm(rgba[0]) << 12u);
+}
+
+std::uint32_t Half(float value) {
+    Require(value == 0.0f || (value >= 0.0625f && value <= 1.0f), "the test's half values are normal and at most 1");
+    if (value == 0.0f) return 0;
+    const auto bits = std::bit_cast<std::uint32_t>(value);
+    Require((bits & 0x1fffu) == 0, "the test's half values are exact");
+    return ((((bits >> 23u) & 0xffu) - 112u) << 10u) | ((bits >> 13u) & 0x3ffu);
+}
+
+std::span<const std::uint32_t> Program(const std::array<std::uint32_t, 4>& vgprs, bool compressed, Kill kill = Kill::None) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    if (kill == Kill::BeforeExport) {
+        for (const auto word : CheckerboardKill) code[at++] = word;
+    }
+    for (std::uint32_t vgpr = 0; vgpr < (compressed ? 2u : 4u); ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = vgprs[vgpr];
+    }
+    if (kill == Kill::AfterExport) {
+        code[at++] = compressed ? 0xf800040fu : 0xf800000fu;
+        code[at++] = compressed ? 0x00000504u : 0x07060504u;
+        for (const auto word : CheckerboardKill) code[at++] = word;
+        code[at++] = 0xf8001890u;
+        code[at++] = 0u;
+    } else {
+        code[at++] = compressed ? 0xf8001c0fu : 0xf800180fu;
+        code[at++] = compressed ? 0x00000504u : 0x07060504u;
+    }
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+std::span<const std::uint32_t> Float32Program(std::array<float, 4> rgba, Kill kill = Kill::None) {
+    return Program({std::bit_cast<std::uint32_t>(rgba[0]), std::bit_cast<std::uint32_t>(rgba[1]), std::bit_cast<std::uint32_t>(rgba[2]), std::bit_cast<std::uint32_t>(rgba[3])}, false, kill);
+}
+
+std::span<const std::uint32_t> Float16Program(std::array<float, 4> rgba) {
+    return Program({Half(rgba[0]) | (Half(rgba[1]) << 16u), Half(rgba[2]) | (Half(rgba[3]) << 16u), 0, 0}, true);
+}
+
+std::span<const std::uint32_t> DepthAsXProgram(std::array<float, 4> rgba) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    code[at++] = 0x7e080300u;
+    for (std::uint32_t vgpr = 1; vgpr < 4u; ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = std::bit_cast<std::uint32_t>(rgba[vgpr]);
+    }
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x07060504u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+const std::array<std::array<float, 4>, 3>& TriangleAt(float z) {
+    static std::map<float, std::array<std::array<float, 4>, 3>> triangles;
+    return triangles.try_emplace(z, std::array<std::array<float, 4>, 3>{{{-1.0f, -1.0f, z, 1.0f}, {3.0f, -1.0f, z, 1.0f}, {-1.0f, 3.0f, z, 1.0f}}}).first->second;
+}
+
+struct DrawSetup {
+    std::uint32_t inputs = 0;
+    std::uint32_t shaderControl = 0;
+    std::span<const std::array<float, 4>> vertices = Triangle;
+    std::uint64_t depth = 0;
+    bool depthWrite = false;
+};
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color target");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        AgcDriver::Graphics::StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Unorm4_4_4_4Info;
+    cx[0x31d] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = TiledAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R16_UINT && color.componentMapping == 0x1bu && color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 && color.tileMode == ColorTileMode::RenderTarget && color.bytes == block.bytes, "the tiled 4_4_4_4 unorm target did not decode as a packed R16_UINT target");
+    return color;
+}
+
+std::uint32_t Draw(AgcDriver::VulkanDevice& device, AgcDriver::Graphics::ColorTarget color, std::uint32_t exportedMask, std::uint32_t exportFormat, std::span<const std::uint32_t> pixelCode, const DrawSetup& setup = {}) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(setup.vertices.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(setup.vertices.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    const bool partial = exportedMask != 0xfu;
+    color.partialWriteMask = partial ? AgcDriver::Graphics::PackedWriteMask(color.componentMapping, exportedMask) : 0u;
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {ScissorWidth, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.colorWriteMask = partial ? 0u : VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT | VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+    state.pixelKill = (setup.shaderControl & LateKill) != 0u;
+    if (setup.depth != 0) {
+        state.depth = AgcDriver::Graphics::DepthTarget{setup.depth, 0, {Width, Height}, VK_FORMAT_D32_SFLOAT, 1.0f, 0, 0, false};
+        state.depthTest = true;
+        state.depthWrite = setup.depthWrite;
+        state.depthCompare = VK_COMPARE_OP_LESS;
+    }
+
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, setup.inputs}, {0x1b4, setup.inputs}, {0x203, setup.shaderControl}, {0x1c5, exportFormat}};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {waveSize, 0, {}, std::nullopt, AgcDriver::Graphics::DecodePixelStageInfo(context, {}), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    const auto handle = ShaderRecompiler::PrepareShader(fragment);
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{codeAddress, 0, 1, {pixelCode.begin(), pixelCode.end()}, {}};
+    snapshot.prepared->entries.push_back({0, handle});
+    fragment.shader.code = snapshot.code;
+    fragment.context.pixel = AgcDriver::Graphics::DecodePixelStageInfo(context, AgcDriver::Graphics::ExportMappings(state));
+    fragment.context.pixel->targetExportPacking = AgcDriver::Graphics::ExportPackings(state);
+    fragment.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(state);
+    Require(fragment.context.pixel->pixelKillEnable == ((setup.shaderControl & LateKill) != 0u) && !fragment.context.pixel->earlyZ && fragment.context.pixel->targetMerge.depthStencilWrites == (partial && setup.depth != 0 && setup.depthWrite), "the draw's pixel kill under late tests or its depth and stencil writes did not decode");
+    Require((fragment.context.pixel->targetMerge.mask != 0u) == partial && fragment.context.pixel->targetMerge.mask == color.partialWriteMask, "the draw's target merge disagrees with its write mask");
+    const ShaderRecompiler::SrtRuntime runtime{};
+    const auto invocation = AgcDriver::DriverDetail::InvocationFor(snapshot, 0, fragment);
+    const auto pixelResult = invocation.Materialize(*invocation.Capture(runtime));
+    const bool registered = pixelResult->variantId == ShaderRecompiler::GetPreparedArtifact(*handle).variantId;
+    Require(registered != partial, partial ? "the merging draw reused the registered pixel shader" : "the full write did not use the registered pixel shader");
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, pixelResult.get(), PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(setup.vertices.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+    return color.partialWriteMask;
+}
+
+std::vector<std::uint16_t> ReadBack(AgcDriver::VulkanDevice& device, const Block& block) {
+    AgcDriver::Graphics::StorageTexture::FlushPending(block.Address(), block.bytes, nullptr, "test read-back");
+    device.WaitIdle();
+    std::vector<std::uint16_t> stored(block.bytes / 2u);
+    AgcDriver::GuestMemory::Read(block.Address(), std::as_writable_bytes(std::span(stored)), 1);
+    return stored;
+}
+
+void ExpectSurface(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& before, std::uint32_t word, std::uint32_t wordMask, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            const bool inside = x < ScissorWidth;
+            const std::uint32_t expected = inside ? (before[index] & ~wordMask) | (word & wordMask) : before[index];
+            if (stored[index] == expected) continue;
+            char detail[192];
+            std::snprintf(detail, sizeof(detail), ": pixel (%u, %u) %s the scissor holds 0x%04x, expected 0x%04x (it held 0x%04x)", x, y, inside ? "inside" : "outside", stored[index], expected, before[index]);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+std::vector<std::uint16_t> Fill(Block& block, std::uint32_t seed) {
+    std::vector<std::uint16_t> words(block.bytes / 2u);
+    for (std::size_t index = 0; index < words.size(); ++index) words[index] = static_cast<std::uint16_t>(((index + seed) * 0x9e3779b9u) >> 11u);
+    std::memcpy(block.data, words.data(), block.bytes);
+    return words;
+}
+
+struct Case {
+    std::uint32_t mask;
+    std::uint32_t wordMask;
+    std::array<float, 4> rgba;
+};
+
+std::uint32_t DrawCase(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::uint32_t mask, std::uint32_t wordMask, std::uint32_t exportFormat, std::span<const std::uint32_t> pixelCode, const DrawSetup& setup = {}) {
+    const auto drawn = Draw(device, color, mask, exportFormat, pixelCode, setup);
+    char detail[160];
+    std::snprintf(detail, sizeof(detail), "CB_TARGET_MASK 0x%x merged the word mask 0x%04x, not 0x%04x", mask, drawn, mask == 0xfu ? 0u : wordMask);
+    Require(drawn == (mask == 0xfu ? 0u : wordMask), detail);
+    return wordMask;
+}
+
+void ExpectWords(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& expected, const std::vector<std::uint16_t>& before, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            if (stored[index] == expected[index]) continue;
+            char detail[192];
+            std::snprintf(detail, sizeof(detail), ": pixel (%u, %u) holds 0x%04x, expected 0x%04x (it held 0x%04x)", x, y, stored[index], expected[index], before[index]);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+void BackToBack(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color, std::span<const Case> draws, std::uint32_t seed, const std::string& what) {
+    const auto before = Fill(block, seed);
+    auto expected = before;
+    for (const auto& [mask, wordMask, rgba] : draws) {
+        DrawCase(device, color, mask, wordMask, Float32Export, Float32Program(rgba));
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < ScissorWidth; ++x) {
+                auto& word = expected[layout.Offset(x, y) / 2u];
+                word = static_cast<std::uint16_t>((word & ~wordMask) | (Packed(rgba) & wordMask));
+            }
+        }
+    }
+    ExpectWords(device, block, layout, expected, before, what);
+}
+
+void SameDrawOverdraw(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color, float first, float last, std::uint32_t seed) {
+    constexpr std::uint32_t Layers = 16;
+    static std::map<float, std::vector<std::array<float, 4>>> stacks;
+    auto& vertices = stacks[last];
+    for (std::uint32_t layer = 0; layer < Layers; ++layer) {
+        const auto& triangle = TriangleAt(layer % 2u == Layers % 2u ? first : last);
+        vertices.insert(vertices.end(), triangle.begin(), triangle.end());
+    }
+    const auto before = Fill(block, seed);
+    auto expected = before;
+    const std::uint32_t nibble = static_cast<std::uint32_t>(std::nearbyint(static_cast<double>(last) * 15.0));
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < ScissorWidth; ++x) {
+            auto& word = expected[layout.Offset(x, y) / 2u];
+            word = static_cast<std::uint16_t>((word & 0x0fffu) | (nibble << 12u));
+        }
+    }
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, DepthAsXProgram({0.0f, 0.4f, 0.6f, 1.0f}), {DepthInput, 0u, vertices});
+    char what[160];
+    std::snprintf(what, sizeof(what), "one draw of %u full-screen triangles alternating z %.2f and %.2f, merging z into X", Layers, first, last);
+    ExpectWords(device, block, layout, expected, before, what);
+}
+
+void DepthRejection(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color) {
+    Block depth(static_cast<std::size_t>(Width) * Height * 4u);
+    const std::vector<float> cleared(depth.bytes / 4u, 1.0f);
+    std::memcpy(depth.data, cleared.data(), depth.bytes);
+    const std::array<float, 4> nearer{0.6f, 0.2f, 0.8f, 0.4f};
+    const std::array<float, 4> behind{0.0f, 1.0f, 1.0f, 1.0f};
+    const std::array<float, 4> front{1.0f, 0.0f, 0.0f, 1.0f / 15.0f};
+    auto before = Fill(block, 301u);
+    auto expected = before;
+    const auto inside = [](std::uint32_t x) { return x < ScissorWidth; };
+    const auto survivor = [&](std::uint32_t x, std::uint32_t y) { return inside(x) && ((x ^ y) & 1u) == 0u; };
+    const auto expect = [&](const auto& select, std::uint32_t word, std::uint32_t wordMask) {
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < Width; ++x) {
+                if (!select(x, y)) continue;
+                auto& stored = expected[layout.Offset(x, y) / 2u];
+                stored = static_cast<std::uint16_t>((stored & ~wordMask) | (word & wordMask));
+            }
+        }
+    };
+    DrawCase(device, color, 0xfu, 0xffffu, Float32Export, Float32Program(nearer, Kill::BeforeExport), {PositionInputs, LateKill, TriangleAt(0.5f), depth.Address(), true});
+    expect(survivor, Packed(nearer), 0xffffu);
+    ExpectWords(device, block, layout, expected, before, "a full write at z 0.5 that kills a checkerboard and writes depth");
+    before = expected;
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(behind), {0u, 0u, TriangleAt(0.75f), depth.Address(), false});
+    expect([&](std::uint32_t x, std::uint32_t y) { return inside(x) && !survivor(x, y); }, Packed(behind), 0xf000u);
+    ExpectWords(device, block, layout, expected, before, "an X merge at z 0.75 behind the depth 0.5 the surviving pixels hold");
+    before = expected;
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(front), {0u, 0u, TriangleAt(0.25f), depth.Address(), false});
+    expect([&](std::uint32_t x, std::uint32_t) { return inside(x); }, Packed(front), 0xf000u);
+    ExpectWords(device, block, layout, expected, before, "an X merge at z 0.25 in front of every stored depth");
+}
+
+void CountedKill(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color) {
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        auto* recorder = AgcDriver::Graphics::Recorder::Active();
+        Require(recorder != nullptr, "the test device has no command recorder to count samples");
+        recorder->CountSamples();
+    }
+    const auto before = Fill(block, 501u);
+    const std::array<float, 4> rgba{0.6f, 0.2f, 0.8f, 0.4f};
+    std::string refusal;
+    try {
+        DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(rgba, Kill::BeforeExport), {PositionInputs, LateKill});
+    } catch (const std::exception& error) {
+        refusal = error.what();
+    }
+    Require(refusal.find("while occlusion queries count samples") != std::string::npos, "a merge that kills under late tests drew while occlusion queries count samples" + (refusal.empty() ? std::string() : ": " + refusal));
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(rgba));
+    ExpectSurface(device, block, layout, before, Packed(rgba), 0xf000u, "a merged X write that kills nothing while occlusion queries count samples");
+}
+
+void ExpectKilled(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& before, std::uint32_t word, std::uint32_t wordMask, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            const bool kept = x < ScissorWidth && ((x ^ y) & 1u) == 0u;
+            const std::uint32_t expected = kept ? (before[index] & ~wordMask) | (word & wordMask) : before[index];
+            if (stored[index] == expected) continue;
+            char detail[192];
+            std::snprintf(detail, sizeof(detail), ": %s pixel (%u, %u) holds 0x%04x, expected 0x%04x (it held 0x%04x)", kept ? "a surviving" : x < ScissorWidth ? "a killed" : "an unscissored", x, y, stored[index], expected, before[index]);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+std::string Describe(std::uint32_t mask, std::array<float, 4> rgba) {
+    char text[160];
+    std::snprintf(text, sizeof(text), "CB_TARGET_MASK 0x%x write of (%.9g, %.9g, %.9g, %.9g)", mask, rgba[0], rgba[1], rgba[2], rgba[3]);
+    return text;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!TargetHasCapability(device->Target(), spv::CapabilityFragmentShaderPixelInterlockEXT)) {
+            std::puts("skipped, the device lacks fragmentShaderPixelInterlock");
+            return VulkanTestSkipped;
+        }
+        const ColorTargetLayout layout(Width, Height, ColorTileMode::RenderTarget, 2);
+        Block block(layout.Bytes());
+        const auto color = DecodeTarget(block);
+        Require(AgcDriver::Graphics::PackedWriteMask(color.componentMapping, 1u) == 0xf000u && AgcDriver::Graphics::PackedWriteMask(color.componentMapping, 8u) == 0x000fu && AgcDriver::Graphics::PackedWriteMask(color.componentMapping, 5u) == 0xf0f0u, "the export components did not map to the guest nibbles (X in 15..12, W in 3..0)");
+        const std::array<Case, 9> cases{{
+            {0x1u, 0xf000u, {1.0f, 0.0f, 0.0f, 0.0f}},
+            {0x1u, 0xf000u, {7.0f / 15.0f, 1.0f, 1.0f, 1.0f}},
+            {0x5u, 0xf0f0u, {0.2f, 0.4f, 0.6f, 0.8f}},
+            {0x2u, 0x0f00u, {0.0f, 2.0f / 15.0f, 1.0f, 1.0f}},
+            {0x8u, 0x000fu, {1.0f, 1.0f, 1.0f, 11.0f / 15.0f}},
+            {0x6u, 0x0ff0u, {0.0f, 0.0f, 0.0f, 0.0f}},
+            {0xeu, 0x0fffu, {0.0f, 1.0f, 0.5f, 0.25f}},
+            {0xfu, 0xffffu, {0.1f, 0.7f, 0.9f, 0.3f}},
+            {0x1u, 0xf000u, {0.0f, 0.0f, 0.0f, 0.0f}},
+        }};
+        const std::array<std::uint16_t, 9> goldens{0xf000u, 0x7fffu, 0x369cu, 0x02ffu, 0xfffbu, 0x0000u, 0x0f84u, 0x2ad5u, 0x0000u};
+        auto before = Fill(block, 0);
+        for (std::size_t index = 0; index < cases.size(); ++index) {
+            const auto& [mask, wordMask, rgba] = cases[index];
+            DrawCase(*device, color, mask, wordMask, Float32Export, Float32Program(rgba));
+            ExpectSurface(*device, block, layout, before, goldens[index], wordMask, "a 32_ABGR " + Describe(mask, rgba) + " into a tiled 4_4_4_4 unorm target");
+            before = ReadBack(*device, block);
+        }
+        const std::array<float, 4> b{2.0f / 15.0f, 1.0f, 1.0f, 1.0f};
+        const std::array<float, 4> c{0.6f, 0.2f, 0.8f, 0.4f};
+        const std::array<float, 4> d{1.0f, 0.0f, 9.0f / 15.0f, 0.0f};
+        const std::array<Case, 2> mergeThenFull{{{0x1u, 0xf000u, b}, {0xfu, 0xffffu, c}}};
+        const std::array<Case, 2> fullThenMerge{{{0xfu, 0xffffu, c}, {0x1u, 0xf000u, b}}};
+        const std::array<Case, 3> mergeThenMerge{{{0x1u, 0xf000u, b}, {0x4u, 0x00f0u, d}, {0x8u, 0x000fu, c}}};
+        BackToBack(*device, block, layout, color, mergeThenFull, 11, "a merged X write followed at once by a full write");
+        BackToBack(*device, block, layout, color, fullThenMerge, 12, "a full write followed at once by a merged X write");
+        BackToBack(*device, block, layout, color, mergeThenMerge, 13, "merged X, Z and W writes drawn back to back");
+        before = Fill(block, 77);
+        const std::array<float, 4> halves{0.5f, 0.75f, 0.125f, 0.25f};
+        const auto wordMask = DrawCase(*device, color, 0x9u, 0xf00fu, Float16Export, Float16Program(halves));
+        ExpectSurface(*device, block, layout, before, Packed(halves), wordMask, "an FP16_ABGR " + Describe(0x9u, halves) + " into a tiled 4_4_4_4 unorm target");
+        for (const auto kill : {Kill::BeforeExport, Kill::AfterExport}) {
+            for (const auto& [mask, wordMask, rgba] : {Case{0x1u, 0xf000u, {0.6f, 0.2f, 0.8f, 0.4f}}, Case{0x6u, 0x0ff0u, {1.0f, 2.0f / 15.0f, 13.0f / 15.0f, 0.0f}}}) {
+                before = Fill(block, 91u + mask);
+                const auto killedMask = DrawCase(*device, color, mask, wordMask, Float32Export, Float32Program(rgba, kill), {PositionInputs, LateKill});
+                ExpectKilled(*device, block, layout, before, Packed(rgba), killedMask, std::string(kill == Kill::BeforeExport ? "a late-test checkerboard kill before " : "a late-test checkerboard kill after ") + Describe(mask, rgba) + " into a tiled 4_4_4_4 unorm target");
+            }
+        }
+        SameDrawOverdraw(*device, block, layout, color, 0.2f, 0.8f, 401u);
+        SameDrawOverdraw(*device, block, layout, color, 0.8f, 0.2f, 402u);
+        DepthRejection(*device, block, layout, color);
+        CountedKill(*device, block, layout, color);
+        std::printf("4_4_4_4 unorm partial write tests passed: %zu masked draws, 3 back-to-back sequences, 4 checkerboard-killing draws, 2 same-draw overdraws of 16 layers, a depth-rejected merge and a refused killing merge while samples are counted, into a %ux%u tiled target, the killed, rejected and unscissored pixels kept\n", cases.size() + 1u, Width, Height);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp
index 0afb33266f..7d4ab406e6 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp
@@ -2,13 +2,16 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "SpirvBackend/SpirvModule.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -18,6 +21,7 @@
 #else
 #include <sys/mman.h>
 #endif
+#include <algorithm>
 #include <array>
 #include <atomic>
 #include <cstddef>
@@ -29,6 +33,7 @@
 #include <memory>
 #include <mutex>
 #include <optional>
+#include <span>
 #include <stdexcept>
 #include <string>
 #include <string_view>
@@ -54,6 +59,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -65,6 +72,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -72,7 +85,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto extensions = function<PFN_vkEnumerateDeviceExtensionProperties>("vkEnumerateDeviceExtensionProperties");
             Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties");
             std::vector<VkExtensionProperties> available(count);
@@ -353,6 +366,201 @@ void UntrackedHint(const Context& context, ReservedSurface& surface) {
 }
 #endif
 
+#ifdef _WIN32
+std::vector<std::uint32_t> TexelFetchShader(std::uint32_t side) {
+    ShaderRecompiler::SpirvModule module;
+    module.EmitCapability(spv::CapabilityShader);
+    module.AddMemoryModel(spv::AddressingModelLogical, spv::MemoryModelGLSL450);
+    const auto u32 = module.Type(spv::OpTypeInt, 32u, 0u);
+    const auto i32 = module.Type(spv::OpTypeInt, 32u, 1u);
+    const auto v4 = module.Type(spv::OpTypeVector, u32, 4u);
+    const auto v3 = module.Type(spv::OpTypeVector, u32, 3u);
+    const auto v2 = module.Type(spv::OpTypeVector, i32, 2u);
+    const auto voidType = module.Type(spv::OpTypeVoid);
+    const auto constant = [&](std::uint32_t value) { return module.Constant(spv::OpConstant, u32, value); };
+    const auto array = module.Type(spv::OpTypeRuntimeArray, v4);
+    module.AddAnnotation(spv::OpDecorate, array, spv::DecorationArrayStride, 16u);
+    const auto block = module.Type(spv::OpTypeStruct, array);
+    module.AddAnnotation(spv::OpDecorate, block, spv::DecorationBlock);
+    module.AddAnnotation(spv::OpMemberDecorate, block, 0u, spv::DecorationOffset, 0u);
+    const auto buffer = module.DefineGlobalVariable(module.Type(spv::OpTypePointer, spv::StorageClassStorageBuffer, block), spv::StorageClassStorageBuffer);
+    module.AddAnnotation(spv::OpDecorate, buffer, spv::DecorationDescriptorSet, 0u);
+    module.AddAnnotation(spv::OpDecorate, buffer, spv::DecorationBinding, 1u);
+    const auto imageType = module.Type(spv::OpTypeImage, u32, spv::Dim2D, 0u, 0u, 0u, 1u, spv::ImageFormatUnknown);
+    const auto image = module.DefineGlobalVariable(module.Type(spv::OpTypePointer, spv::StorageClassUniformConstant, imageType), spv::StorageClassUniformConstant);
+    module.AddAnnotation(spv::OpDecorate, image, spv::DecorationDescriptorSet, 0u);
+    module.AddAnnotation(spv::OpDecorate, image, spv::DecorationBinding, 0u);
+    const auto group = module.DefineGlobalVariable(module.Type(spv::OpTypePointer, spv::StorageClassInput, v3), spv::StorageClassInput);
+    module.AddAnnotation(spv::OpDecorate, group, spv::DecorationBuiltIn, spv::BuiltInWorkgroupId);
+    const auto main = module.AllocateId();
+    module.AddFunction(spv::OpFunction, voidType, main, spv::FunctionControlMaskNone, module.Type(spv::OpTypeFunction, voidType));
+    module.AddFunction(spv::OpLabel, module.AllocateId());
+    const auto loaded = module.AllocateId();
+    module.AddFunction(spv::OpLoad, v3, loaded, group);
+    const auto index = module.AllocateId();
+    module.AddFunction(spv::OpCompositeExtract, u32, index, loaded, 0u);
+    const auto binary = [&](spv::Op op, std::uint32_t a, std::uint32_t b) {
+        const auto result = module.AllocateId();
+        module.AddFunction(op, u32, result, a, b);
+        return result;
+    };
+    const auto signedValue = [&](std::uint32_t value) {
+        const auto result = module.AllocateId();
+        module.AddFunction(spv::OpBitcast, i32, result, value);
+        return result;
+    };
+    const auto coordinate = module.AllocateId();
+    module.AddFunction(spv::OpCompositeConstruct, v2, coordinate, signedValue(binary(spv::OpUMod, index, constant(side))), signedValue(binary(spv::OpUDiv, index, constant(side))));
+    const auto object = module.AllocateId();
+    module.AddFunction(spv::OpLoad, imageType, object, image);
+    const auto value = module.AllocateId();
+    module.AddFunction(spv::OpImageFetch, v4, value, object, coordinate, spv::ImageOperandsLodMask, constant(0u));
+    const auto pointer = module.AllocateId();
+    module.AddFunction(spv::OpAccessChain, module.Type(spv::OpTypePointer, spv::StorageClassStorageBuffer, v4), pointer, buffer, constant(0u), index);
+    module.AddFunction(spv::OpStore, pointer, value);
+    module.AddFunction(spv::OpReturn);
+    module.AddFunction(spv::OpFunctionEnd);
+    module.EmitEntryPoint(spv::ExecutionModelGLCompute, main, "main", {group});
+    module.AddExecutionMode(main, spv::ExecutionModeLocalSize, 1u, 1u, 1u);
+    return module.Finalize();
+}
+
+class TexelFetch {
+public:
+    TexelFetch(const Context& context, const Texture& texture, Buffer& output, std::span<const std::uint32_t> code) : context(context) {
+        try {
+            const std::array<VkDescriptorSetLayoutBinding, 2> bindings{{{0u, VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE, 1u, VK_SHADER_STAGE_COMPUTE_BIT, nullptr}, {1u, VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u, VK_SHADER_STAGE_COMPUTE_BIT, nullptr}}};
+            VkDescriptorSetLayoutCreateInfo info{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+            info.bindingCount = 2u;
+            info.pBindings = bindings.data();
+            Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &info, nullptr, &setLayout), "texel fetch descriptor layout");
+            const std::array<VkDescriptorPoolSize, 2> sizes{{{VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE, 1u}, {VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u}}};
+            VkDescriptorPoolCreateInfo poolInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_POOL_CREATE_INFO};
+            poolInfo.maxSets = 1u;
+            poolInfo.poolSizeCount = 2u;
+            poolInfo.pPoolSizes = sizes.data();
+            Check(context.Function<PFN_vkCreateDescriptorPool>("vkCreateDescriptorPool")(context.device, &poolInfo, nullptr, &pool), "texel fetch descriptor pool");
+            const VkDescriptorSetAllocateInfo allocate{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_ALLOCATE_INFO, nullptr, pool, 1u, &setLayout};
+            Check(context.Function<PFN_vkAllocateDescriptorSets>("vkAllocateDescriptorSets")(context.device, &allocate, &set), "texel fetch descriptor set");
+            const VkDescriptorImageInfo image{VK_NULL_HANDLE, texture.View(), texture.Layout()};
+            const VkDescriptorBufferInfo buffer{output.Handle(), 0u, output.Bytes().size()};
+            const std::array<VkWriteDescriptorSet, 2> writes{{{VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET, nullptr, set, 0u, 0u, 1u, VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE, &image, nullptr, nullptr}, {VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET, nullptr, set, 1u, 0u, 1u, VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, nullptr, &buffer, nullptr}}};
+            context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, 2u, writes.data(), 0u, nullptr);
+            VkPipelineLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
+            layoutInfo.setLayoutCount = 1u;
+            layoutInfo.pSetLayouts = &setLayout;
+            Check(context.Function<PFN_vkCreatePipelineLayout>("vkCreatePipelineLayout")(context.device, &layoutInfo, nullptr, &layout), "texel fetch pipeline layout");
+            VkShaderModuleCreateInfo shaderInfo{VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO};
+            shaderInfo.codeSize = code.size_bytes();
+            shaderInfo.pCode = code.data();
+            Check(context.Function<PFN_vkCreateShaderModule>("vkCreateShaderModule")(context.device, &shaderInfo, nullptr, &module), "texel fetch shader module");
+            VkComputePipelineCreateInfo pipelineInfo{VK_STRUCTURE_TYPE_COMPUTE_PIPELINE_CREATE_INFO};
+            pipelineInfo.layout = layout;
+            pipelineInfo.stage = {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO, nullptr, 0u, VK_SHADER_STAGE_COMPUTE_BIT, module, "main", nullptr};
+            Check(context.Function<PFN_vkCreateComputePipelines>("vkCreateComputePipelines")(context.device, VK_NULL_HANDLE, 1u, &pipelineInfo, nullptr, &pipeline), "texel fetch pipeline");
+        } catch (...) {
+            release();
+            throw;
+        }
+    }
+    ~TexelFetch() { release(); }
+    TexelFetch(const TexelFetch&) = delete;
+    TexelFetch& operator=(const TexelFetch&) = delete;
+
+    void Run(VkCommandBuffer commands, std::uint32_t groups) const {
+        context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, pipeline);
+        context.Function<PFN_vkCmdBindDescriptorSets>("vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, layout, 0u, 1u, &set, 0u, nullptr);
+        context.Function<PFN_vkCmdDispatch>("vkCmdDispatch")(commands, groups, 1u, 1u);
+    }
+
+private:
+    void release() noexcept {
+        if (pipeline != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, pipeline, nullptr);
+        if (module != VK_NULL_HANDLE) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, module, nullptr);
+        if (layout != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipelineLayout>("vkDestroyPipelineLayout")(context.device, layout, nullptr);
+        if (pool != VK_NULL_HANDLE) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
+        if (setLayout != VK_NULL_HANDLE) context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(context.device, setLayout, nullptr);
+    }
+
+    Context context;
+    VkDescriptorSetLayout setLayout = VK_NULL_HANDLE;
+    VkDescriptorPool pool = VK_NULL_HANDLE;
+    VkDescriptorSet set = VK_NULL_HANDLE;
+    VkPipelineLayout layout = VK_NULL_HANDLE;
+    VkShaderModule module = VK_NULL_HANDLE;
+    VkPipeline pipeline = VK_NULL_HANDLE;
+};
+
+std::vector<std::uint32_t> FetchTexels(const Context& context, const Texture& texture, std::uint32_t side) {
+    const auto count = side * side;
+    Buffer output(context, std::size_t{count} * 16u, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+    std::memset(output.Bytes().data(), 0xa5, output.Bytes().size());
+    const TexelFetch fetch(context, texture, output, TexelFetchShader(side));
+    CommandBatch batch(context);
+    fetch.Run(batch.Handle(), count);
+    RecordMemoryBarrier(context, batch.Handle(), VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_SHADER_WRITE_BIT, VK_ACCESS_HOST_READ_BIT);
+    batch.SubmitAndWait();
+    output.Invalidate();
+    std::vector<std::uint32_t> texels(count);
+    for (std::uint32_t index = 0; index < count; ++index) std::memcpy(&texels[index], output.Bytes().data() + std::size_t{index} * 16u, sizeof(std::uint32_t));
+    return texels;
+}
+
+void ComparedShared(const Context& context) {
+    constexpr std::uint32_t side = 128;
+    constexpr std::size_t bytes = 2 * BlockBytes;
+    constexpr std::uint32_t before = 0x5a5a5a5au;
+    constexpr std::uint32_t stored = 0x13579bdfu;
+    struct Direct {
+        std::uint8_t* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, BlockBytes));
+        HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+        bool registered = false;
+        ~Direct() {
+            if (registered) GuestAllocations::Mutation().Remove(memory);
+            if (memory != nullptr) {
+                GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+                GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+            }
+            if (section == nullptr) return;
+            GuestArena::GuestArenaForgetSection_nid_postfix(section);
+            CloseHandle(section);
+        }
+    } direct;
+    Require(direct.memory != nullptr && direct.section != nullptr, "compared shared snapshot: cannot create the direct memory");
+    GuestArena::GuestArenaForgetSection_nid_postfix(direct.section);
+    GuestArena::GuestArenaMapDirect_nid_postfix(direct.memory, bytes, direct.section, 0, PAGE_READWRITE);
+    GuestAllocations::Mutation().Add(direct.memory, bytes, true, true, true);
+    direct.registered = true;
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(direct.memory));
+    std::fill_n(reinterpret_cast<std::uint32_t*>(direct.memory), bytes / sizeof(std::uint32_t), before);
+    Require(AgcDriver::GuestMemory::Watched(address, bytes), "compared shared snapshot: the direct memory is not watched");
+    AgcDriver::GuestMemory::Unwatch(address, BlockBytes);
+    const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> imported{{{address, address + BlockBytes}}};
+    AgcDriver::GuestMemory::Rewatch(imported);
+    Require(AgcDriver::GuestMemory::Watched(address, BlockBytes), "compared shared snapshot: the rewatched block is not watched");
+    const auto words = Descriptor(address, side);
+    Require(DescribeSurface(DecodeTextureResource(words)).guestBytes == BlockBytes, "compared shared snapshot: the descriptor does not describe the rewatched block");
+    const auto lookup = [&] {
+        AgcDriver::GuestMemory::BumpCollectEpoch();
+        return CachedSampledTexture(context, words);
+    };
+    const auto cached = lookup();
+    Require(cached != nullptr && !cached->ViewsStorageImage(), "compared shared snapshot: the rewatched block was not sampled through a snapshot");
+    Require(lookup() == cached, "compared shared snapshot: the unchanged rewatched block did not reuse its snapshot");
+    const auto initial = FetchTexels(context, *cached, side);
+    Require(std::all_of(initial.begin(), initial.end(), [](std::uint32_t texel) { return texel == before; }), "compared shared snapshot: the GPU did not read the cached texels");
+    GuestArena::GuestArenaMapDirect_nid_postfix(direct.memory + bytes, bytes, direct.section, 0, PAGE_READWRITE);
+    *reinterpret_cast<volatile std::uint32_t*>(direct.memory) = stored;
+    const auto fresh = lookup();
+    Require(fresh != nullptr && fresh != cached, "the first lookup after a CPU store into shared compared memory returned the snapshot cached before the sharing");
+    const auto texels = FetchTexels(context, *fresh, side);
+    Require(texels.front() == stored, "the GPU read the old texel on the first lookup after a CPU store into shared compared memory");
+    Require(std::all_of(texels.begin() + 1, texels.end(), [](std::uint32_t texel) { return texel == before; }), "the GPU read texels the CPU store into shared compared memory did not write");
+    Require(lookup() == fresh, "the snapshot of shared compared memory was not reused after its compare");
+    ClearCachedTextures(context.device);
+}
+#endif
+
 void PendingStores(const Context& context, ReservedSurface& surface) {
     const auto address = surface.Address();
     const auto words = Descriptor(address);
@@ -421,6 +629,14 @@ int main(int argc, char** argv) {
                 LargeTracked(context, surface, LargeSurfaceBytes);
                 LargeTracked(context, surface, BlockBytes);
             } else if (argc == 2 && std::string_view(argv[1]) == "--pending-stores") PendingStores(context, surface);
+            else if (argc == 2 && std::string_view(argv[1]) == "--compared-shared") {
+#ifdef _WIN32
+                ComparedShared(context);
+#else
+                std::puts("skipped, only Windows direct memory is compared once shared");
+                return Skipped;
+#endif
+            }
             else if (argc == 2 && std::string_view(argv[1]) == "--untracked-hint") {
 #ifdef _WIN32
                 UntrackedHint(context, surface);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PeriodCopy.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PeriodCopy.cpp
new file mode 100644
index 0000000000..0c4fecdb35
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PeriodCopy.cpp
@@ -0,0 +1,116 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "VulkanTestDevice.hpp"
+#include <array>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+alignas(256) constexpr std::array<std::uint32_t, 38> Code{
+    0xbfa00002u, 0xd7460000u, 0x04010c0cu, 0xf4201a84u, 0xfa000000u, 0xbf8cc07fu, 0x7da8006au, 0xbf88001du,
+    0xf4200204u, 0xfa000004u, 0xbf8cc07fu, 0x7e020c08u, 0x81ea0880u, 0x7e025701u, 0x100202ffu, 0x4f7ffffeu,
+    0x7e020f01u, 0x7ed60501u, 0x936a6b6au, 0x9aea6b6au, 0x4a02026au, 0xd56a0001u, 0x00020101u, 0xd5690001u,
+    0x00020208u, 0x4c020300u, 0x7d860208u, 0x4e040208u, 0x02020501u, 0x7d860208u, 0x4e040208u, 0x02020501u,
+    0xe0002000u, 0x80000101u, 0xbf8c3f70u, 0xe0102000u, 0x80010100u, 0xbf810000u};
+constexpr std::uint32_t Untouched = 0xcafebabeu;
+constexpr std::uint32_t ElementFormat = 0x00014004u;
+constexpr std::uint32_t RecordFormat = 0x0004dfacu;
+constexpr std::uint32_t Elements = 8192;
+alignas(256) std::array<std::uint32_t, Elements> Source{};
+alignas(256) std::array<std::uint32_t, Elements> Destination{};
+alignas(256) std::array<std::uint32_t, 4> Record{};
+
+void AppendDescriptor(std::vector<std::uint32_t>& data, const void* base, std::uint32_t stride, std::uint32_t records, std::uint32_t format) {
+    const auto address = reinterpret_cast<std::uintptr_t>(base);
+    data.insert(data.end(), {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), records, format});
+}
+
+std::vector<std::uint32_t> Commands(std::uint32_t groups) {
+    std::vector<std::uint32_t> data;
+    AppendDescriptor(data, Source.data(), 4, Elements, ElementFormat);
+    AppendDescriptor(data, Destination.data(), 4, Elements, ElementFormat);
+    AppendDescriptor(data, Record.data(), 16, 1, RecordFormat);
+    std::vector<std::uint32_t> words;
+    const auto registers = [&](std::uint32_t first, std::span<const std::uint32_t> values) {
+        words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
+        words.push_back(first);
+        words.insert(words.end(), values.begin(), values.end());
+    };
+    const std::array<std::uint32_t, 3> shape{64, 1, 1};
+    registers(0x207, shape);
+    const auto address = reinterpret_cast<std::uintptr_t>(Code.data());
+    const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
+    registers(0x20c, program);
+    const std::array<std::uint32_t, 1> resource{(static_cast<std::uint32_t>(data.size()) << 1u) | (1u << 7u)};
+    registers(0x213, resource);
+    registers(0x240, data);
+    words.insert(words.end(), {0xc0031500u, groups, 1, 1, 0x41u});
+    return words;
+}
+
+std::uint64_t Taken() {
+    using namespace AgcDriver::DriverDetail;
+    return copyPathCounts[CopyCpu].load() + copyPathCounts[CopyGpu].load() + copyPathCounts[CopyAliased].load();
+}
+
+void ExecuteTests() {
+    struct Case {
+        const char* name;
+        std::uint32_t count, period, groups;
+        bool hle;
+    };
+    constexpr std::array<Case, 5> cases{{
+        {"one full group", 64, 64, 1, true},
+        {"a period above the count", 1000, 4096, 16, true},
+        {"a partial last group", 100, 100, 2, true},
+        {"a period below the count", 300, 7, 5, false},
+        {"more groups than the count needs", 64, 64, 2, false},
+    }};
+    const bool hleEnabled = std::getenv("APS5_NO_COPY_HLE") == nullptr;
+    for (const auto& item : cases) {
+        const bool hle = item.hle && hleEnabled;
+        for (std::size_t i = 0; i < Source.size(); ++i) Source[i] = static_cast<std::uint32_t>(i) * 2654435761u + 1u;
+        Destination.fill(Untouched);
+        Record = {item.count, item.period, 0, 0};
+        const auto taken = Taken();
+        const auto words = Commands(item.groups);
+        Packet packet{const_cast<std::uint32_t*>(words.data()), static_cast<std::uint32_t>(words.size()), 0, {}};
+        AgcDriver::Submit(&packet, 0);
+        AgcDriverWaitIdle_nid_postfix();
+        AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(Destination.data()), sizeof(Destination));
+        const std::string where = std::string(" (") + item.name + ")";
+        Require(Taken() - taken == (hle ? 1u : 0u), (hle ? "the copy did not take the HLE path" : "the copy took the HLE path") + where);
+        for (std::size_t i = 0; i < Destination.size(); ++i) {
+            const auto expected = i < item.count ? Source[i % item.period] : Untouched;
+            Require(Destination[i] == expected, "copy mismatch at element " + std::to_string(i) + where + ": got " + std::to_string(Destination[i]) + ", expected " + std::to_string(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        ExecuteTests();
+        AgcDriverShutdown_nid_postfix();
+        std::puts("period copy tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp
index 16d3742761..403380ca02 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp
@@ -11,6 +11,7 @@
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "ShaderCacheDirectory.hpp"
 #include "../NarrowConstantStoreFixture.hpp"
 #include "Recompiler.hpp"
 #include "Optimization/ResourceProgram.hpp"
@@ -31,6 +32,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <filesystem>
+#include <fstream>
 #include <iostream>
 #include <random>
 #include <span>
@@ -149,7 +151,7 @@ AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block) {
     return color;
 }
 
-void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode) {
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode, std::uint32_t colorWriteMask = 0xf) {
     const auto target = device.Target();
     constexpr std::uint32_t waveSize = 64;
     std::vector<std::uint32_t> vertexUserData(4, 0u);
@@ -180,7 +182,7 @@ void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarge
     state.cullMode = VK_CULL_MODE_NONE;
     state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
     VkPipelineColorBlendAttachmentState blend{};
-    blend.colorWriteMask = 0xf;
+    blend.colorWriteMask = colorWriteMask;
     state.blends = {blend};
     state.blend = blend;
     state.blendConstants = {};
@@ -344,6 +346,36 @@ void JournalTests() {
     }
 }
 
+void HeldModuleTests() {
+    using namespace NarrowConstantStoreFixture;
+    constexpr std::uint32_t programs = 16;
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    std::vector<std::vector<std::uint32_t>> codes;
+    for (std::uint32_t salt = 1; salt <= programs; ++salt) codes.push_back(ComputeCode(salt));
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "no device to record the compute programs");
+        device->WaitForPipelineJournalReplay();
+        std::vector<ShaderRecompiler::RecompileResult> results;
+        for (const auto& code : codes) results.push_back(CompileCompute(*device, code, words, 32));
+        for (std::size_t index = 0; index < results.size(); ++index) device->Dispatch(results[index], 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(codes[index].data()));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    SetEnvironment("APS5_PIPELINE_JOURNAL_THREADS", "1");
+    const auto before = Snapshot();
+    const auto device = OpenVulkanTestDevice();
+    Require(device != nullptr, "no device to replay the compute programs");
+    device->WaitForPipelineJournalReplay();
+    const auto replayed = Snapshot();
+    SetEnvironment("APS5_PIPELINE_JOURNAL_THREADS", "2");
+    Require(replayed.journal.loadedRecipes == programs + 2 && replayed.journal.loadedModules == programs + 3 && replayed.journal.droppedRecords == 0, "the journal does not hold the 16 compute programs beside the first two pipelines");
+    Require(replayed.journal.replayedCompute - before.journal.replayedCompute == programs + 1 && replayed.journal.replayedGraphics - before.journal.replayedGraphics == 1 && replayed.journal.replayRejected == before.journal.replayRejected && replayed.journal.replayFailed == before.journal.replayFailed, "the one-thread replay did not build every recorded pipeline");
+    const auto held = replayed.journal.replayHeldPeakBytes;
+    Require(held > 0 && held * 4 < replayed.journal.loadedBytes, "the one-thread replay held " + std::to_string(held) + " bytes of modules at once from a " + std::to_string(replayed.journal.loadedBytes) + "-byte journal");
+}
+
 // --benchmark [count]: `count` distinct compute programs, dispatched for the first time on three
 // devices in turn. The first device starts without the driver's pipeline cache file (a driver with
 // an on-disk shader cache of its own, lavapipe's Mesa cache here, still serves from it unless that
@@ -395,6 +427,272 @@ void Benchmark(std::uint32_t count) {
     std::printf("  warm driver cache, journal:     %llu pipelines built by the replay in %.1f ms of replay work (%.1f ms from the device opening), then %llu built at their dispatches, %u dispatches in %.1f ms (%.2f ms each)\n", static_cast<unsigned long long>(replayed.journal.replayedCompute), replayed.journal.replayMs, replayed.openMs, static_cast<unsigned long long>(replayed.created), count, replayed.dispatchMs, replayed.dispatchMs / count);
 }
 
+struct JournalRecordHeader {
+    std::uint32_t kind;
+    std::uint32_t reserved;
+    std::uint64_t payloadBytes;
+    std::uint64_t payloadHash;
+};
+static_assert(sizeof(JournalRecordHeader) == 24);
+
+constexpr std::uint32_t JournalModuleRecord = 1u;
+constexpr std::uint32_t JournalComputeRecord = 3u;
+constexpr std::uint32_t JournalHeaderBytes = 32u;
+
+void AppendJournalRecord(std::vector<std::byte>& file, std::uint32_t kind, const std::vector<std::byte>& payload) {
+    const JournalRecordHeader header{kind, 0u, payload.size(), ShaderRecompiler::HashBytes(payload)};
+    const auto offset = file.size();
+    file.resize(offset + sizeof(header) + payload.size());
+    std::memcpy(file.data() + offset, &header, sizeof(header));
+    std::memcpy(file.data() + offset + sizeof(header), payload.data(), payload.size());
+    while ((file.size() - offset - sizeof(header)) % 8u != 0) file.push_back(std::byte{0});
+}
+
+std::vector<ShaderRecompiler::PipelineIdentity> ReadJournalComputeIdentities(const std::filesystem::path& path) {
+    std::vector<std::byte> file;
+    std::ifstream input(path, std::ios::binary);
+    const std::vector<char> bytes((std::istreambuf_iterator<char>(input)), std::istreambuf_iterator<char>());
+    file.reserve(bytes.size());
+    for (const auto byte : bytes) file.push_back(static_cast<std::byte>(byte));
+    std::vector<ShaderRecompiler::PipelineIdentity> identities;
+    std::size_t cursor = JournalHeaderBytes;
+    while (cursor + sizeof(JournalRecordHeader) <= file.size()) {
+        JournalRecordHeader header{};
+        std::memcpy(&header, file.data() + cursor, sizeof(header));
+        const auto payload = cursor + sizeof(header);
+        if (header.payloadBytes > file.size() - payload) break;
+        if (header.kind == JournalComputeRecord && header.payloadBytes >= 17u) {
+            ShaderRecompiler::PipelineIdentity identity;
+            std::memcpy(&identity.low, file.data() + payload, sizeof(identity.low));
+            std::memcpy(&identity.high, file.data() + payload + 8, sizeof(identity.high));
+            identities.push_back(identity);
+        }
+        cursor = payload + header.payloadBytes;
+        while (cursor % 8u != 0) ++cursor;
+    }
+    return identities;
+}
+
+void NewestEntriesTests() {
+    using namespace NarrowConstantStoreFixture;
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    const auto recorded = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the newest entries test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        for (std::uint32_t salt = 1; salt <= 3; ++salt) {
+            const auto code = ComputeCode(salt);
+            const auto result = CompileCompute(*device, code, words, 32);
+            device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+        }
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+        const auto after = Snapshot();
+        Require(after.journal.recordedCompute == recorded.journal.recordedCompute + 3, "the three compute pipelines were not recorded");
+    }
+    SetEnvironment("APS5_PIPELINE_JOURNAL_ENTRIES", "2");
+    const auto before = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the newest entries replay could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto replayed = Snapshot();
+        Require(replayed.journal.replayedCompute == before.journal.replayedCompute + 2, "the replay did not build the two newest entries: built " + std::to_string(replayed.journal.replayedCompute - before.journal.replayedCompute) + " compute and " + std::to_string(replayed.journal.replayedGraphics - before.journal.replayedGraphics) + " graphics, " + std::to_string(replayed.journal.replayRejected - before.journal.replayRejected) + " rejected, " + std::to_string(replayed.journal.replayPresent - before.journal.replayPresent) + " present, " + std::to_string(replayed.journal.replaySkipped - before.journal.replaySkipped) + " skipped");
+        Require(replayed.journal.replayedGraphics == before.journal.replayedGraphics, "the replay built an entry that is not among the newest");
+        const auto created = device->ComputePipelinesCreated();
+        const auto newest = ComputeCode(3);
+        const auto result = CompileCompute(*device, newest, words, 32);
+        device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(newest.data()));
+        device->WaitIdle();
+        Require(device->ComputePipelinesCreated() == created, "the newest pipeline was not built by the replay");
+        const auto oldest = ComputeCode(0);
+        const auto old = CompileCompute(*device, oldest, words, 32);
+        device->Dispatch(old, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(oldest.data()));
+        device->WaitIdle();
+        Require(device->ComputePipelinesCreated() == created + 1, "the oldest pipeline was built by the replay");
+    }
+    SetEnvironment("APS5_PIPELINE_JOURNAL_ENTRIES", "1024");
+}
+
+void EvictionTests() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    AgcDriver::Graphics::FlushPipelineJournal();
+    constexpr std::size_t Modules = 24;
+    constexpr std::size_t ModuleBytes = 64u * 1024u;
+    std::vector<std::byte> file;
+    for (std::size_t index = 0; index < Modules; ++index) {
+        std::vector<std::byte> module(20u + ModuleBytes, std::byte{0x5a});
+        const std::uint64_t low = index + 1u;
+        const std::uint64_t high = 0u;
+        std::memcpy(module.data(), &low, sizeof(low));
+        std::memcpy(module.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalModuleRecord, module);
+        std::vector<std::byte> compute(17u, std::byte{0});
+        std::memcpy(compute.data(), &low, sizeof(low));
+        std::memcpy(compute.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalComputeRecord, compute);
+    }
+    {
+        std::ofstream out(path, std::ios::binary | std::ios::app);
+        Require(static_cast<bool>(out), "the synthetic journal records could not be written");
+        out.write(reinterpret_cast<const char*>(file.data()), static_cast<std::streamsize>(file.size()));
+        out.flush();
+        Require(!out.fail(), "the synthetic journal records could not be written");
+    }
+    Require(std::filesystem::file_size(path) > 1024u * 1024u, "the journal is smaller than the cap");
+    const auto before = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the eviction test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        Block compute(BlockBytes);
+        Block target(ColorTargetLayout(Width, Height, ColorTileMode::Linear, 2).Bytes());
+        const auto words = AddressWords(compute);
+        const auto code = ComputeCode(7);
+        const auto result = CompileCompute(*device, code, words, 32);
+        device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+        device->WaitIdle();
+        std::memset(target.data, 0, target.bytes);
+        Draw(*device, DecodeTarget(target), Program(std::array<float, 4>{1.0f, 0.0f, 0.0f, 1.0f}));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto after = Snapshot();
+    Require(after.journal.evictedRecords > before.journal.evictedRecords, "the journal was not rewritten when it reached its cap: " + std::to_string(after.journal.evictedRecords) + " records evicted, " + std::to_string(after.journal.writeFailures - before.journal.writeFailures) + " write failures");
+    const auto size = std::filesystem::file_size(path);
+    Require(size <= 1024u * 1024u + 64u * 1024u, "the rewritten journal is larger than the cap");
+    const auto identities = ReadJournalComputeIdentities(path);
+    Require(!identities.empty(), "the rewritten journal holds no compute pipeline");
+    bool newest = false;
+    for (const auto& identity : identities) {
+        if (identity.low == Modules) newest = true;
+        Require(identity.low != 1u, "the oldest pipeline survived the rewrite");
+    }
+    Require(newest, "the newest pipeline did not survive the rewrite");
+}
+
+void EvictionWatermarkTests() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    const auto before = Snapshot();
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the eviction watermark test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        for (std::uint32_t salt = 8; salt <= 10; ++salt) {
+            auto result = CompileCompute(*device, ComputeCode(salt), words, 32);
+            result.shaderDataUserWords.assign(16u * 1024u, salt);
+            AgcDriver::Graphics::RecordComputePipeline(result, true);
+        }
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto after = Snapshot();
+    Require(after.journal.recordedCompute == before.journal.recordedCompute + 3, "the records after the rewrite were not recorded");
+    Require(after.journal.writeFailures == before.journal.writeFailures, "the records after the rewrite failed to write");
+    Require(after.journal.evictedRecords == before.journal.evictedRecords, "three consecutive records after a rewrite triggered another rewrite");
+    Require(std::filesystem::file_size(path) <= 1024u * 1024u, "the journal exceeded its cap after the consecutive records");
+}
+
+void EvictionKeepsPendingModules() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    Block target(ColorTargetLayout(Width, Height, ColorTileMode::Linear, 2).Bytes());
+    const auto color = DecodeTarget(target);
+    const std::array<float, 4> red{1.0f, 0.0f, 0.0f, 1.0f};
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the pending module test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        std::memset(target.data, 0, target.bytes);
+        Draw(*device, color, Program(red));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    constexpr std::size_t FillerBytes = 600u * 1024u;
+    {
+        std::vector<std::byte> file;
+        std::vector<std::byte> module(20u + FillerBytes, std::byte{0x5a});
+        const std::uint64_t low = 0x5a5au;
+        const std::uint64_t high = 0u;
+        std::memcpy(module.data(), &low, sizeof(low));
+        std::memcpy(module.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalModuleRecord, module);
+        std::vector<std::byte> compute(17u + FillerBytes, std::byte{0});
+        std::memcpy(compute.data(), &low, sizeof(low));
+        std::memcpy(compute.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalComputeRecord, compute);
+        std::ofstream out(path, std::ios::binary | std::ios::app);
+        Require(static_cast<bool>(out), "the filler records could not be written");
+        out.write(reinterpret_cast<const char*>(file.data()), static_cast<std::streamsize>(file.size()));
+        out.flush();
+        Require(!out.fail(), "the filler records could not be written");
+    }
+    Require(std::filesystem::file_size(path) > 1024u * 1024u, "the journal is smaller than the cap");
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the pending module test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        std::memset(target.data, 0, target.bytes);
+        Draw(*device, color, Program(red), 0x7);
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto before = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the pending module replay could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto replayed = Snapshot();
+        Require(replayed.journal.replayedGraphics == before.journal.replayedGraphics + 1, "the record written after the eviction was not replayed: " + std::to_string(replayed.journal.replayedGraphics - before.journal.replayedGraphics) + " graphics built, " + std::to_string(replayed.journal.replayRejected - before.journal.replayRejected) + " rejected");
+        Require(replayed.journal.replayRejected == before.journal.replayRejected, "the record written after the eviction was rejected: the eviction dropped a module it needed");
+    }
+}
+
+void OversizedRecordKeepsTheJournal() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the oversized record test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto code = ComputeCode(0);
+        const auto result = CompileCompute(*device, code, words, 32);
+        device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto before = Snapshot();
+    const auto sizeBefore = std::filesystem::file_size(path);
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the oversized record test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto code = ComputeCode(2);
+        auto result = CompileCompute(*device, code, words, 32);
+        result.shaderDataUserWords.assign(400000u, 0u);
+        AgcDriver::Graphics::RecordComputePipeline(result, false);
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto after = Snapshot();
+    Require(after.journal.writeFailures == before.journal.writeFailures + 1, "the oversized record was not counted as a write failure");
+    Require(std::filesystem::file_size(path) == sizeBefore, "the oversized record emptied the journal: " + std::to_string(sizeBefore) + " bytes became " + std::to_string(std::filesystem::file_size(path)));
+    const auto before2 = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the oversized record replay could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto replayed = Snapshot();
+        Require(replayed.journal.replayedCompute == before2.journal.replayedCompute + 1, "the record that was in the journal did not survive the oversized one");
+    }
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -406,6 +704,7 @@ int main(int argc, char** argv) {
         SetEnvironment("APS5_NO_PIPELINE_JOURNAL", "0");
         SetEnvironment("APS5_VERIFY_SET_LAYOUTS", "1");
         SetEnvironment("APS5_PIPELINE_JOURNAL_THREADS", "2");
+        SetEnvironment("APS5_PIPELINE_JOURNAL_MAX_MIB", "1");
         struct Cleanup {
             std::filesystem::path directory;
             ~Cleanup() {
@@ -422,6 +721,12 @@ int main(int argc, char** argv) {
             return 0;
         }
         JournalTests();
+        NewestEntriesTests();
+        EvictionTests();
+        EvictionWatermarkTests();
+        EvictionKeepsPendingModules();
+        OversizedRecordKeepsTheJournal();
+        HeldModuleTests();
         std::puts("pipeline journal record and replay passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp
index f2b56411c0..2ff511dcd1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp
@@ -64,6 +64,8 @@ struct PipelineTrace {
     std::mutex mutex;
     std::condition_variable released;
     bool allowOptimization = false;
+    std::uint32_t libraries = 0;
+    std::uint32_t retaining = 0;
     std::vector<VkPipeline> fast;
     std::vector<VkPipeline> optimized;
     VkCommandBuffer boundCommands = VK_NULL_HANDLE;
@@ -90,7 +92,12 @@ VKAPI_ATTR VkResult VKAPI_CALL CreatePipelines(VkDevice device, VkPipelineCache
     const auto result = Trace->create(device, cache, count, infos, allocator, pipelines);
     std::lock_guard lock(Trace->mutex);
     for (std::uint32_t index = 0; index < count; ++index) {
-        if (pipelines[index] == VK_NULL_HANDLE || (infos[index].flags & VK_PIPELINE_CREATE_LIBRARY_BIT_KHR) != 0) continue;
+        if (pipelines[index] == VK_NULL_HANDLE) continue;
+        if ((infos[index].flags & VK_PIPELINE_CREATE_LIBRARY_BIT_KHR) != 0) {
+            ++Trace->libraries;
+            if ((infos[index].flags & VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT) != 0) ++Trace->retaining;
+            continue;
+        }
         auto& handles = (infos[index].flags & VK_PIPELINE_CREATE_LINK_TIME_OPTIMIZATION_BIT_EXT) != 0 ? Trace->optimized : Trace->fast;
         handles.push_back(pipelines[index]);
     }
@@ -217,12 +224,17 @@ void Run(AgcDriver::VulkanDevice& device, Context context, PipelineTrace& trace,
         CheckPixels(masked, phase);
     };
     render(false, "fast link");
+    {
+        std::lock_guard lock(trace.mutex);
+        Require(trace.libraries != 0, "the readback pipeline's libraries were not created through the traced device");
+        Require(trace.retaining == (optimize ? trace.libraries : 0u), std::to_string(trace.retaining) + " of the " + std::to_string(trace.libraries) + " libraries were created to retain link-time optimization info, expected " + (optimize ? "all of them" : "none, since no optimized link will be made"));
+    }
     trace.ReleaseOptimization();
     WaitForOptimizedPipelines(context.device);
     Require(PipelineLibraryCountersOf(context.device).linked == 1, "the readback pipeline was not linked from graphics libraries");
     Require(trace.optimized.size() == (optimize ? 1u : 0u), "the optimized pipeline creation count differs from the requested mode");
     render(optimize, "completed link");
-    std::printf("pipeline readback passed: fast draws %u, optimized draws %u, optimized creations %zu\n", optimize ? 1u : 2u, optimize ? 1u : 0u, trace.optimized.size());
+    std::printf("pipeline readback passed: fast draws %u, optimized draws %u, optimized creations %zu, libraries %u (%u retaining link-time optimization info)\n", optimize ? 1u : 2u, optimize ? 1u : 0u, trace.optimized.size(), trace.libraries, trace.retaining);
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDispatch.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDispatch.cpp
index 8cc143e3c5..4996854346 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDispatch.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDispatch.cpp
@@ -132,10 +132,8 @@ void Submit(std::vector<std::uint32_t>& words) {
 int main() {
 #ifdef _WIN32
     _putenv_s("APS5_PIPELINED_DRAWS", "1");
-    _putenv_s("APS5_PIPELINE_DMA", "1");
 #else
     setenv("APS5_PIPELINED_DRAWS", "1", 1);
-    setenv("APS5_PIPELINE_DMA", "1", 1);
 #endif
     try {
         {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDma.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDma.cpp
index d43e135c35..553e26c52f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDma.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedDma.cpp
@@ -11,6 +11,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <iostream>
+#include <memory>
 #include <stdexcept>
 #include <string>
 #include <thread>
@@ -43,13 +44,13 @@ void Submit(std::vector<std::uint32_t>& words) {
 }
 
 struct Gate {
-    std::atomic<bool> release{false};
-    ~Gate() { release.store(true, std::memory_order_release); }
+    std::shared_ptr<std::atomic<bool>> release = std::make_shared<std::atomic<bool>>(false);
+    ~Gate() { release->store(true, std::memory_order_release); }
 };
 
 void Hold(Gate& gate, std::uint64_t address, std::size_t bytes) {
-    DrawPipeline::Queue0().Enqueue([&gate] {
-        while (!gate.release.load(std::memory_order_acquire)) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    DrawPipeline::Queue0().Enqueue([release = gate.release] {
+        while (!release->load(std::memory_order_acquire)) std::this_thread::sleep_for(std::chrono::milliseconds(1));
     }, {{address, address + bytes}});
 }
 
@@ -58,7 +59,7 @@ void ExpectDrains(std::vector<std::uint32_t>& words, std::uint32_t opcode, Gate&
     std::thread releaser([&] {
         const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
         while (DrawPipeline::DrainRequestsByOpcode(opcode) == before && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
-        gate.release.store(true, std::memory_order_release);
+        gate.release->store(true, std::memory_order_release);
     });
     Submit(words);
     releaser.join();
@@ -74,10 +75,8 @@ void ExpectNoDrain(std::uint32_t opcode, std::uint64_t before, const char* what)
 int main() {
 #ifdef _WIN32
     _putenv_s("APS5_PIPELINED_DRAWS", "1");
-    _putenv_s("APS5_PIPELINE_DMA", "1");
 #else
     setenv("APS5_PIPELINED_DRAWS", "1", 1);
-    setenv("APS5_PIPELINE_DMA", "1", 1);
 #endif
     try {
         alignas(256) static std::array<std::uint32_t, 1024> first{};
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedMetadataPass.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedMetadataPass.cpp
index 7fa9eb1f07..0410e4c9a6 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedMetadataPass.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedMetadataPass.cpp
@@ -120,11 +120,9 @@ void expectEliminated(const std::string& what) {
 int main() {
 #ifdef _WIN32
     _putenv_s("APS5_PIPELINED_DRAWS", "1");
-    _putenv_s("APS5_PIPELINE_DMA", "1");
     _putenv_s("APS5_DRAW_PIPELINE", "1");
 #else
     setenv("APS5_PIPELINED_DRAWS", "1", 1);
-    setenv("APS5_PIPELINE_DMA", "1", 1);
     setenv("APS5_DRAW_PIPELINE", "1", 1);
 #endif
     try {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedPrefetch.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedPrefetch.cpp
index cf3574966c..fe2b116f63 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedPrefetch.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedPrefetch.cpp
@@ -106,12 +106,12 @@ int main() {
         const auto prefetched = SubmitBehindBusyPipeline(prefetch, 0x11111111u, true);
         check(prefetched.outstanding >= 2, "a DMA_DATA prefetch drained the draw pipeline: the label behind it never queued behind the held commit (" + std::to_string(prefetched.outstanding) + " outstanding)");
         check(prefetched.drains == 0, "a DMA_DATA prefetch drained the draw pipeline (" + std::to_string(prefetched.drains) + " packet drains)");
-        const auto copied = SubmitBehindBusyPipeline(copy, 0x22222222u, false);
-        check(copied.outstanding == 1, "a DMA_DATA copy did not hold the queue worker (" + std::to_string(copied.outstanding) + " outstanding)");
-        check(copied.drains == 1, "a DMA_DATA copy did not drain the draw pipeline (" + std::to_string(copied.drains) + " packet drains)");
+        const auto copied = SubmitBehindBusyPipeline(copy, 0x22222222u, true);
+        check(copied.outstanding >= 2, "a DMA_DATA copy that misses every queued write drained the draw pipeline: the label behind it never queued behind the held commit (" + std::to_string(copied.outstanding) + " outstanding)");
+        check(copied.drains == 0, "a DMA_DATA copy that misses every queued write drained the draw pipeline (" + std::to_string(copied.drains) + " packet drains)");
         for (std::size_t i = 0; i < Destination.size(); ++i) check(Destination[i] == (i < 128 ? Source[i] : 0u), "the copy did not land, or wrote past its bytes");
         LibcRunShutdown_nid_postfix();
-        std::puts("a DMA_DATA prefetch keeps the draw pipeline, a copy drains it");
+        std::puts("a DMA_DATA prefetch and a copy that misses every queued write keep the draw pipeline");
         return 0;
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp
index f364c83039..6eb4c60d13 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp
@@ -49,11 +49,23 @@ struct Vertex {
     float w;
 };
 
-constexpr std::array<Vertex, 3> Corners{{{-0.8f, -0.8f, 1.0f}, {0.9f, -0.6f, 2.5f}, {-0.5f, 0.85f, 0.5f}}};
+constexpr std::array<Vertex, 3> TriangleCorners{{{-0.8f, -0.8f, 1.0f}, {0.9f, -0.6f, 2.5f}, {-0.5f, 0.85f, 0.5f}}};
+constexpr std::array<Vertex, 3> RectangleCorners{{{-0.8f, -0.8f, 1.5f}, {0.7f, -0.8f, 1.5f}, {-0.8f, 0.6f, 1.5f}}};
 
-std::array<std::array<float, 4>, 3> ClipPositions() {
+enum class Emulation {
+    Geometry,
+    Tessellation,
+    RectList,
+};
+
+const std::array<Vertex, 3>& Corners(Emulation emulation) {
+    return emulation == Emulation::RectList ? RectangleCorners : TriangleCorners;
+}
+
+std::array<std::array<float, 4>, 3> ClipPositions(Emulation emulation) {
+    const auto& corners = Corners(emulation);
     std::array<std::array<float, 4>, 3> positions{};
-    for (std::size_t i = 0; i < Corners.size(); ++i) positions[i] = {Corners[i].x * Corners[i].w, Corners[i].y * Corners[i].w, 0.5f * Corners[i].w, Corners[i].w};
+    for (std::size_t i = 0; i < corners.size(); ++i) positions[i] = {corners[i].x * corners[i].w, corners[i].y * corners[i].w, 0.5f * corners[i].w, corners[i].w};
     return positions;
 }
 
@@ -70,18 +82,14 @@ std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t st
     return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
 }
 
-enum class Emulation {
-    Geometry,
-    Tessellation,
-};
-
 ShaderRecompiler::RecompileResult Draw(AgcDriver::VulkanDevice& device, Emulation emulation, std::span<const std::uint32_t> pixelCode, std::uint32_t inputs, VkCullModeFlags cullMode = VK_CULL_MODE_NONE, bool flat = false, VkProvokingVertexModeEXT provoking = VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT, bool strip = false) {
     Pixels.fill(Unwritten);
     auto target = device.Target();
     target.fragmentShaderBarycentricEnabled = false;
-    static const auto trianglePositions = ClipPositions();
+    static const auto trianglePositions = ClipPositions(Emulation::Geometry);
+    static const auto rectanglePositions = ClipPositions(Emulation::RectList);
     static const auto stripPositions = StripPositions();
-    const auto positions = strip ? std::span<const std::array<float, 4>>(stripPositions) : std::span<const std::array<float, 4>>(trianglePositions);
+    const auto positions = strip ? std::span<const std::array<float, 4>>(stripPositions) : std::span<const std::array<float, 4>>(emulation == Emulation::RectList ? rectanglePositions : trianglePositions);
 
     std::vector<std::uint32_t> vertexUserData(4, 0u);
     const auto vertexBuffer = BufferDescriptor(positions.data(), 16u, static_cast<std::uint32_t>(positions.size()));
@@ -119,7 +127,12 @@ ShaderRecompiler::RecompileResult Draw(AgcDriver::VulkanDevice& device, Emulatio
     std::vector<AgcDriver::Graphics::CompiledShader> shaders{{ShaderStage::Vertex, &vertexResult, 0}};
     ShaderRecompiler::RecompileResult geometry;
     ShaderRecompiler::BarycentricTessellationShaders patches;
-    if (pixelResult.barycentricEmulation.active && emulation == Emulation::Geometry) {
+    ShaderRecompiler::RectListShaders rectangle;
+    if (emulation == Emulation::RectList) {
+        rectangle = ShaderRecompiler::BuildRectListShaders(vertexResult, pixelResult, target);
+        shaders.push_back({ShaderStage::TessellationControl, &rectangle.control, 0});
+        shaders.push_back({ShaderStage::TessellationEvaluation, &rectangle.evaluation, 0});
+    } else if (pixelResult.barycentricEmulation.active && emulation == Emulation::Geometry) {
         geometry = ShaderRecompiler::BuildBarycentricGeometryShader(vertexResult, pixelResult, target, device.GeometryLimits());
         shaders.push_back({ShaderStage::Geometry, &geometry, 0});
     } else if (pixelResult.barycentricEmulation.active) {
@@ -135,7 +148,8 @@ ShaderRecompiler::RecompileResult Draw(AgcDriver::VulkanDevice& device, Emulatio
     state.colors = {state.color};
     state.hasColorTarget = true;
     state.renderExtent = {Width, Height};
-    state.topology = strip ? VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP : VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.topology = strip ? VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP : emulation == Emulation::RectList ? VK_PRIMITIVE_TOPOLOGY_PATCH_LIST : VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.rectList = emulation == Emulation::RectList;
     state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
     state.negativeOneToOne = false;
     state.scissor = {{0, 0}, {Width, Height}};
@@ -157,9 +171,10 @@ struct Expected {
     std::array<float, 3> perspective;
 };
 
-Expected Barycentrics(std::uint32_t x, std::uint32_t y, bool snapped) {
+Expected Barycentrics(Emulation emulation, std::uint32_t x, std::uint32_t y, bool snapped) {
+    const auto& corners = Corners(emulation);
     std::array<std::array<double, 2>, 3> window{};
-    for (std::size_t i = 0; i < Corners.size(); ++i) window[i] = {(Corners[i].x + 1.0) * Width / 2.0, (1.0 - Corners[i].y) * Height / 2.0};
+    for (std::size_t i = 0; i < corners.size(); ++i) window[i] = {(corners[i].x + 1.0) * Width / 2.0, (1.0 - corners[i].y) * Height / 2.0};
     if (snapped) {
         for (auto& corner : window) {
             for (auto& coordinate : corner) coordinate = std::round(coordinate * 256.0) / 256.0;
@@ -170,22 +185,23 @@ Expected Barycentrics(std::uint32_t x, std::uint32_t y, bool snapped) {
     const auto edge = [](const std::array<double, 2>& a, const std::array<double, 2>& b, double cx, double cy) { return (b[0] - a[0]) * (cy - a[1]) - (b[1] - a[1]) * (cx - a[0]); };
     const double area = edge(window[0], window[1], window[2][0], window[2][1]);
     const std::array<double, 3> b{edge(window[1], window[2], px, py) / area, edge(window[2], window[0], px, py) / area, edge(window[0], window[1], px, py) / area};
-    Expected expected{std::min({b[0], b[1], b[2]}) > 0.02, {}, {}};
+    const bool inside = emulation == Emulation::RectList ? std::min(b[1], b[2]) > 0.02 && std::max(b[1], b[2]) < 0.98 : std::min({b[0], b[1], b[2]}) > 0.02;
+    Expected expected{inside, {}, {}};
     double sum = 0.0;
-    for (std::size_t i = 0; i < 3; ++i) sum += b[i] / Corners[i].w;
+    for (std::size_t i = 0; i < 3; ++i) sum += b[i] / corners[i].w;
     for (std::size_t i = 0; i < 3; ++i) {
         expected.linear[i] = static_cast<float>(b[i]);
-        expected.perspective[i] = static_cast<float>(b[i] / Corners[i].w / sum);
+        expected.perspective[i] = static_cast<float>(b[i] / corners[i].w / sum);
     }
     return expected;
 }
 
-Expected BarycentricsUnsnapped(std::uint32_t x, std::uint32_t y) {
-    return Barycentrics(x, y, false);
+Expected BarycentricsUnsnapped(Emulation emulation, std::uint32_t x, std::uint32_t y) {
+    return Barycentrics(emulation, x, y, false);
 }
 
-Expected BarycentricsSnapped(std::uint32_t x, std::uint32_t y) {
-    return Barycentrics(x, y, true);
+Expected BarycentricsSnapped(Emulation emulation, std::uint32_t x, std::uint32_t y) {
+    return Barycentrics(emulation, x, y, true);
 }
 
 bool MatchesEither(float value, float unsnapped, float snapped) {
@@ -196,13 +212,15 @@ float Pixel(std::uint32_t x, std::uint32_t y, std::uint32_t channel) {
     return Pixels[(y * Width + x) * 4u + channel];
 }
 
-std::uint32_t CheckBarycentrics(const std::string& what, bool perspective) {
+std::uint32_t CheckBarycentrics(Emulation emulation, const std::string& what, bool perspective) {
     std::uint32_t checked = 0;
+    std::uint32_t beyond = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            const auto expected = BarycentricsUnsnapped(x, y);
+            const auto expected = BarycentricsUnsnapped(emulation, x, y);
             if (!expected.inside) continue;
-            const auto snapped = BarycentricsSnapped(x, y);
+            const auto snapped = BarycentricsSnapped(emulation, x, y);
+            if (expected.linear[0] < -0.02f) ++beyond;
             const auto& weights = perspective ? expected.perspective : expected.linear;
             const auto& snappedWeights = perspective ? snapped.perspective : snapped.linear;
             for (std::uint32_t channel = 0; channel < 4; ++channel) {
@@ -215,17 +233,18 @@ std::uint32_t CheckBarycentrics(const std::string& what, bool perspective) {
         }
     }
     Require(checked > 200u, what + ": too few interior pixels were checked");
+    Require(emulation != Emulation::RectList || beyond > 200u, what + ": too few pixels past the rectangle's diagonal were checked");
     return checked;
 }
 
-void CheckVertexValues() {
-    const auto positions = ClipPositions();
+void CheckVertexValues(Emulation emulation) {
+    const auto positions = ClipPositions(emulation);
     const auto p0 = positions[0][0];
     const std::array<float, 3> expected{positions[1][0] - p0, positions[2][0] - p0, p0};
     std::uint32_t checked = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            if (!BarycentricsUnsnapped(x, y).inside) continue;
+            if (!BarycentricsUnsnapped(emulation, x, y).inside) continue;
             for (std::uint32_t channel = 0; channel < 3; ++channel) {
                 Require(Pixel(x, y, channel) == expected[channel], "v_interp_mov: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") channel " + std::to_string(channel) + " is " + std::to_string(Pixel(x, y, channel)) + ", expected " + std::to_string(expected[channel]));
             }
@@ -235,14 +254,14 @@ void CheckVertexValues() {
     Require(checked > 200u, "v_interp_mov: too few interior pixels were checked");
 }
 
-void CheckInterpolated() {
-    const auto positions = ClipPositions();
+void CheckInterpolated(Emulation emulation) {
+    const auto positions = ClipPositions(emulation);
     std::uint32_t checked = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            const auto expected = BarycentricsUnsnapped(x, y);
+            const auto expected = BarycentricsUnsnapped(emulation, x, y);
             if (!expected.inside) continue;
-            const auto snapped = BarycentricsSnapped(x, y);
+            const auto snapped = BarycentricsSnapped(emulation, x, y);
             float reference = 0.0f;
             float snappedReference = 0.0f;
             for (std::size_t i = 0; i < 3; ++i) {
@@ -259,13 +278,13 @@ void CheckInterpolated() {
 }
 
 void CheckFlat(const std::string& what, std::size_t provoking) {
-    const auto positions = ClipPositions();
+    const auto positions = ClipPositions(Emulation::Geometry);
     std::uint32_t checked = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            const auto expected = BarycentricsUnsnapped(x, y);
+            const auto expected = BarycentricsUnsnapped(Emulation::Geometry, x, y);
             if (!expected.inside) continue;
-            const auto snapped = BarycentricsSnapped(x, y);
+            const auto snapped = BarycentricsSnapped(Emulation::Geometry, x, y);
             for (std::uint32_t channel = 0; channel < 2; ++channel) {
                 Require(MatchesEither(Pixel(x, y, channel), expected.perspective[1u + channel], snapped.perspective[1u + channel]), what + ": pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") weight " + std::to_string(channel) + " is " + std::to_string(Pixel(x, y, channel)));
             }
@@ -374,32 +393,34 @@ void CheckStripFlatLast(AgcDriver::VulkanDevice& device, Emulation emulation, co
 }
 
 void RunEmulation(AgcDriver::VulkanDevice& device, Emulation emulation) {
-    const std::string name = emulation == Emulation::Geometry ? "geometry stage" : "tessellation stages";
+    const std::string name = emulation == Emulation::Geometry ? "geometry stage" : emulation == Emulation::Tessellation ? "tessellation stages" : "rect-list stages";
     const auto perspective = PixelInputBit(PixelInput::PerspectiveCenter);
     const auto linear = PixelInputBit(PixelInput::LinearCenter);
     auto result = Draw(device, emulation, BarycentricPixelCode, perspective);
     Require(result.barycentricEmulation.active && result.barycentricEmulation.smooth && !result.barycentricEmulation.linear, "reading PERSP_CENTER I/J did not emulate perspective barycentrics");
-    const auto smooth = CheckBarycentrics(name + " PERSP_CENTER I/J", true);
+    const auto smooth = CheckBarycentrics(emulation, name + " PERSP_CENTER I/J", true);
     result = Draw(device, emulation, BarycentricPixelCode, linear);
     Require(result.barycentricEmulation.active && !result.barycentricEmulation.smooth && result.barycentricEmulation.linear, "reading LINEAR_CENTER I/J did not emulate linear barycentrics");
-    const auto noPerspective = CheckBarycentrics(name + " LINEAR_CENTER I/J", false);
+    const auto noPerspective = CheckBarycentrics(emulation, name + " LINEAR_CENTER I/J", false);
     result = Draw(device, emulation, VertexValuePixelCode, perspective);
     Require(result.barycentricEmulation.active && result.fragmentParameters.size() == 1 && result.fragmentParameters[0].perVertex, "v_interp_mov of P10 and P20 did not emulate per-vertex parameters");
-    CheckVertexValues();
+    CheckVertexValues(emulation);
     result = Draw(device, emulation, InterpolatedPixelCode, perspective);
     Require(!result.barycentricEmulation.active, "plain v_interp_p1/p2 needed a generated stage");
-    CheckInterpolated();
-    CheckWinding(device, emulation, name);
-    result = Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true);
-    Require(result.barycentricEmulation.active && std::any_of(result.fragmentParameters.begin(), result.fragmentParameters.end(), [](const auto& parameter) { return parameter.flat && !parameter.perVertex; }), "a flat P0 read beside raw I/J did not pass a flat parameter through the emulation");
-    CheckFlat(name + " flat input, first provoking vertex", 0u);
-    if (emulation == Emulation::Tessellation) {
-        Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true, VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT);
-        CheckFlat(name + " flat input, last provoking vertex", 2u);
-        CheckStripFlatLast(device, emulation, name);
+    CheckInterpolated(emulation);
+    if (emulation != Emulation::RectList) {
+        CheckWinding(device, emulation, name);
+        result = Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true);
+        Require(result.barycentricEmulation.active && std::any_of(result.fragmentParameters.begin(), result.fragmentParameters.end(), [](const auto& parameter) { return parameter.flat && !parameter.perVertex; }), "a flat P0 read beside raw I/J did not pass a flat parameter through the emulation");
+        CheckFlat(name + " flat input, first provoking vertex", 0u);
+        if (emulation == Emulation::Tessellation) {
+            Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true, VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT);
+            CheckFlat(name + " flat input, last provoking vertex", 2u);
+            CheckStripFlatLast(device, emulation, name);
+        }
+        CheckStrip(device, emulation, name);
     }
-    CheckStrip(device, emulation, name);
-    std::printf("barycentric emulation through the %s passed: %u perspective and %u linear I/J pixels, raw vertex values, host interpolation, face culling, flat inputs and triangle strips\n", name.c_str(), smooth, noPerspective);
+    std::printf("barycentric emulation through the %s passed: %u perspective and %u linear I/J pixels, raw vertex values, host interpolation%s\n", name.c_str(), smooth, noPerspective, emulation == Emulation::RectList ? "" : ", face culling, flat inputs and triangle strips");
 }
 
 }
@@ -416,8 +437,12 @@ int main() {
         }
         if (geometry) RunEmulation(*device, Emulation::Geometry);
         else std::puts("geometry stage skipped, the device lacks geometryShader");
-        if (tessellation) RunEmulation(*device, Emulation::Tessellation);
-        else std::puts("tessellation stages skipped, the device lacks tessellationShader");
+        if (tessellation) {
+            RunEmulation(*device, Emulation::Tessellation);
+            RunEmulation(*device, Emulation::RectList);
+        } else {
+            std::puts("tessellation and rect-list stages skipped, the device lacks tessellationShader");
+        }
         return 0;
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp
index 116235fa11..74adeac4c0 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/PipelineLibrary.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "Recompiler.hpp"
 #include "VulkanTestDevice.hpp"
@@ -228,6 +229,7 @@ int main() {
             Draw(*device, waveSize);
             Check(waveSize, 3);
         }
+        Require(!device->GraphicsPipelineLibraries() || AgcDriver::Graphics::PipelineLibraryCountersOf(device->Device()).linked == 0, "pixel interlock: a primitive-ordered pixel shader's pipeline was linked from graphics pipeline libraries");
         std::printf("pixel interlock tests passed: 10 draws of %u overlapping triangles over %u pixels, 2 of them with a killed BDA fault in every %uth column\n", Layers, Width * Height, FaultColumns);
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelLdsLimit.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelLdsLimit.cpp
new file mode 100644
index 0000000000..594281d148
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelLdsLimit.cpp
@@ -0,0 +1,181 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 32;
+constexpr std::uint32_t High = 0x11110000u;
+constexpr std::uint32_t Last = 0x22220000u;
+constexpr std::uint32_t Past = 0x33330000u;
+alignas(256) std::array<std::byte, Width * Height * 4> Pixels{};
+alignas(256) std::array<std::uint32_t, Width * Height * 4> Results{};
+constexpr std::uint32_t Overflow = 256u;
+alignas(256) std::array<std::byte, Overflow * Overflow * 4> OverflowPixels{};
+alignas(256) std::array<std::uint32_t, Overflow * Overflow * 4> OverflowResults{};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+std::vector<std::uint32_t> PixelCode(std::uint32_t width) {
+    std::vector<std::uint32_t> code{0x7e040f00, 0x7e060f01, 0xd5430006, 0x0409ff03, width};
+    const auto mov = [&](std::uint32_t reg, std::uint32_t literal) {
+        code.push_back(0x7e0002ffu | (reg << 17u));
+        code.push_back(literal);
+    };
+    const auto shl = [&](std::uint32_t dest, std::uint32_t source) {
+        code.push_back(0x34000000u | (dest << 17u) | (source << 9u) | 0x82u);
+    };
+    const auto write = [&](std::uint32_t index, std::uint32_t value) {
+        mov(16u, index);
+        shl(17u, 16u);
+        mov(18u, value);
+        code.push_back(0xd8340000u);
+        code.push_back((18u << 8u) | 17u);
+    };
+    write(8000u, High);
+    write(8191u, Last);
+    write(8192u, Past);
+    code.push_back(0xbf8cc07fu);
+    const auto read = [&](std::uint32_t index, std::uint32_t dest) {
+        mov(16u, index);
+        shl(17u, 16u);
+        code.push_back(0xd8d80000u);
+        code.push_back((dest << 24u) | 17u);
+    };
+    read(8000u, 10u);
+    read(8191u, 11u);
+    read(8192u, 12u);
+    shl(15u, 3u);
+    code.push_back(0xd8d80000u);
+    code.push_back((13u << 24u) | 15u);
+    code.push_back(0xbf8cc07fu);
+    for (std::uint32_t slot = 0; slot < 4u; ++slot) {
+        code.push_back(0xe0702000u | (slot * 4u));
+        code.push_back(0x80010006u | ((10u + slot) << 8u));
+    }
+    code.insert(code.end(), {0x7e0e02f2, 0xf800180f, 0x07070707, 0xbf810000});
+    return code;
+}
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+constexpr std::array<std::array<float, 4>, 3> Triangles{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+void Draw(AgcDriver::VulkanDevice& device, std::uint32_t width, std::uint32_t height, std::span<std::byte> pixels, std::span<std::uint32_t> results, std::uint32_t draws = 1u) {
+    const auto pixelCode = PixelCode(width);
+    std::fill(pixels.begin(), pixels.end(), std::byte{0});
+    std::fill(results.begin(), results.end(), 0u);
+    const auto target = device.Target();
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Triangles.data(), 16u, static_cast<std::uint32_t>(Triangles.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {64u, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.wave32 = false;
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionX) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionY);
+    pixel.posX = true;
+    pixel.posY = true;
+    pixel.targetOutputMode[0] = 9;
+    pixel.targetExportMapping.fill(0xe4u);
+    std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const auto stored = BufferDescriptor(results.data(), 16u, width * height);
+    std::copy(stored.begin(), stored.end(), pixelUserData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(std::span(pixelCode))}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
+        {64u, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    Require(pixelResult.functionLdsBuffer == target.largePixelFunctionLdsBuffer, target.largePixelFunctionLdsBuffer ? "pixel LDS limit: the full array was not backed by a buffer" : "pixel LDS limit: a driver that keeps the function array used the buffer");
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, 64u, 64u, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(pixels.data()), {width, height}, VK_FORMAT_R8G8B8A8_UNORM, pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.renderExtent = {width, height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(height), static_cast<float>(width), -static_cast<float>(height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {width, height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangles.size()), 0, 1, 0, false};
+    for (std::uint32_t n = 0; n < draws; ++n) device.Draw(state, draw, shaders);
+    device.WaitIdle();
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (device->Target().subgroupSize < 32u) {
+            std::printf("skipped, subgroup size %u cannot hold a wave32\n", device->Target().subgroupSize);
+            return VulkanTestSkipped;
+        }
+        Draw(*device, Width, Height, Pixels, Results, 2u);
+        for (std::uint32_t pixel = 0; pixel < Width * Height; ++pixel) {
+            for (std::uint32_t channel = 0; channel < 4u; ++channel) Require(Pixels[pixel * 4u + channel] == std::byte{255}, "pixel LDS limit: missing color");
+            const auto base = pixel * 4u;
+            Require(Results[base] == High, "pixel LDS limit: dword 8000 expected " + std::to_string(High) + " got " + std::to_string(Results[base]));
+            Require(Results[base + 1u] == Last, "pixel LDS limit: dword 8191 expected " + std::to_string(Last) + " got " + std::to_string(Results[base + 1u]));
+            Require(Results[base + 2u] == 0u, "pixel LDS limit: dword 8192 wrote " + std::to_string(Results[base + 2u]));
+        }
+        std::puts("pixel LDS limit passed: dword 8000 and 8191, 2048 pixels, two draws");
+        if (device->Target().largePixelFunctionLdsBuffer) {
+            bool threw = false;
+            try {
+                Draw(*device, Overflow, Overflow, OverflowPixels, OverflowResults);
+            } catch (const std::exception& error) {
+                threw = std::string_view(error.what()) == "AGC graphics: pixel function LDS subgroup slots exhausted";
+                if (!threw) throw;
+            }
+            Require(threw, "pixel LDS limit: a draw past the subgroup slots did not throw");
+            std::puts("pixel LDS limit overflow passed");
+        }
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp
index ce79a9b375..f3e0672a31 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp
@@ -67,7 +67,7 @@ constexpr std::array<std::array<float, 4>, 3> OtherHalfTriangle{{
     {1.0f, -1.0f, 0.5f, 1.0f}, {1.0f, 1.0f, 0.5f, 1.0f}, {-1.0f, 1.0f, 0.5f, 1.0f}
 }};
 
-alignas(256) std::array<std::array<std::uint32_t, 16>, 8> Programs{};
+alignas(256) std::array<std::array<std::uint32_t, 16>, 16> Programs{};
 alignas(256) std::array<std::byte, 256 * 1024> DepthMemory{};
 std::size_t programCount = 0;
 
@@ -164,12 +164,12 @@ struct Block {
     std::uint8_t* data = nullptr;
 };
 
-AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t info) {
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t info, std::uint32_t attrib = 0) {
     AgcDriver::Registers cx;
     cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
     cx[0x31b] = 0;
     cx[0x31c] = info;
-    cx[0x31d] = 0;
+    cx[0x31d] = attrib;
     cx[0x323] = 0;
     cx[0x324] = 0;
     cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
@@ -374,6 +374,51 @@ std::string ExpectTruncated(AgcDriver::VulkanDevice& device) {
     return {};
 }
 
+std::string ExpectOneFragment(AgcDriver::VulkanDevice& device) {
+    if ((AgcDriver::VulkanDeviceTestAccess::Context(device).limits.framebufferDepthSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0) return "the device has no four-sample depth targets (framebufferDepthSampleCounts)";
+    constexpr std::size_t bytes = std::size_t{Width} * Height * 16u;
+    AgcDriver::Graphics::DepthTarget depth{reinterpret_cast<std::uintptr_t>(DepthMemory.data()), 0u, {Width, Height}, VK_FORMAT_D32_SFLOAT, 0.0f, 0};
+    depth.samples = 4;
+    std::array<std::uint32_t, 16> written{};
+    std::uint32_t untouched = 0;
+    for (const auto* triangle : {&HalfTriangle, &OtherHalfTriangle}) {
+        Block block(bytes);
+        std::fill(block.data, block.data + bytes, std::uint8_t{0xff});
+        const auto color = DecodeTarget(block, Rgba32FloatInfo, 0x2000u);
+        Require(color.samples == 1u, "a 4-sample color target with one fragment did not decode as one stored sample");
+        try {
+            Draw(device, color, ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage), Program(0u), *triangle, 4u, &depth);
+        } catch (const std::exception& error) {
+            if (std::string_view(error.what()).find("truncated coverage reduction") == std::string_view::npos) throw;
+            return "the device lacks VK_AMD_mixed_attachment_samples and VK_NV_framebuffer_mixed_samples with truncated coverage reduction";
+        }
+        const auto stored = ReadBack(device, block.Address(), bytes);
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < Width; ++x) {
+                const auto* texel = stored.data() + (static_cast<std::size_t>(y) * Width + x) * 16u;
+                if (std::all_of(texel, texel + 16, [](std::uint8_t byte) { return byte == 0xffu; })) {
+                    ++untouched;
+                    continue;
+                }
+                std::array<float, 4> value{};
+                std::memcpy(value.data(), texel, sizeof(value));
+                const auto mask = static_cast<std::uint32_t>(value[0]);
+                Require(value[0] == static_cast<float>(mask) && mask >= 1u && mask <= 15u && value[1] == 0.0f && value[2] == 0.0f && value[3] == 1.0f, "one-fragment coverage: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") holds (" + std::to_string(value[0]) + ", " + std::to_string(value[1]) + ", " + std::to_string(value[2]) + ", " + std::to_string(value[3]) + ")");
+                ++written[mask];
+            }
+        }
+    }
+    std::uint32_t withoutSampleZero = 0;
+    std::uint32_t partial = 0;
+    for (std::uint32_t mask = 1; mask < 16u; ++mask) {
+        if ((mask & 1u) == 0) withoutSampleZero += written[mask];
+        else if (mask != 15u) partial += written[mask];
+    }
+    Require(withoutSampleZero == 0, "one-fragment coverage: " + std::to_string(withoutSampleZero) + " pixels whose coverage lacks sample 0 were written into the one fragment");
+    Require(written[15] != 0 && partial != 0 && untouched != 0, "one-fragment coverage: two half-covering triangles wrote " + std::to_string(written[15]) + " fully covered and " + std::to_string(partial) + " partly covered pixels and left " + std::to_string(untouched) + " untouched");
+    return {};
+}
+
 }
 
 int main() {
@@ -387,6 +432,7 @@ int main() {
         Expect(*device, PixelInputBit(PixelInput::Ancillary) | PixelInputBit(PixelInput::SampleCoverage), 1u, "SAMPLE_COVERAGE after ANCILLARY");
         if (!ExpectMerged(*device)) std::puts("merged coverage not tested: the device lacks VK_NV_framebuffer_mixed_samples with merged coverage reduction");
         if (const auto skipped = ExpectTruncated(*device); !skipped.empty()) std::printf("truncated coverage not tested: %s\n", skipped.c_str());
+        if (const auto skipped = ExpectOneFragment(*device); !skipped.empty()) std::printf("one-fragment coverage not tested: %s\n", skipped.c_str());
         std::puts("pixel sample coverage tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp
index 785886aa84..988207259f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp
@@ -3,6 +3,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include "../AllocationFailure.hpp"
 #include "../SlabReturn.hpp"
 #include <SDL_loadso.h>
@@ -143,6 +144,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -154,6 +157,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -162,22 +171,11 @@ public:
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
             const auto properties = function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties");
-            const auto* requested = std::getenv("ANYPS5_GPU");
-            const bool named = requested != nullptr && *requested != '\0';
-            context.physical = devices.front();
-            for (const auto candidate : devices) {
-                VkPhysicalDeviceProperties described{};
-                properties(candidate, &described);
-                if (named ? std::strstr(described.deviceName, requested) != nullptr : described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU) {
-                    context.physical = candidate;
-                    break;
-                }
-            }
+            context.physical = SelectFixturePhysicalDevice(devices, properties);
             VkPhysicalDeviceProperties selected{};
             properties(context.physical, &selected);
             context.limits = selected.limits;
             std::printf("device %s vendor=0x%x device=0x%x driver=0x%x\n", selected.deviceName, selected.vendorID, selected.deviceID, selected.driverVersion);
-            Require(requested == nullptr || std::strstr(selected.deviceName, requested) != nullptr, "selected device does not match ANYPS5_GPU");
             VkPhysicalDeviceFeatures supported{};
             function<PFN_vkGetPhysicalDeviceFeatures>("vkGetPhysicalDeviceFeatures")(context.physical, &supported);
             Require(supported.robustBufferAccess == VK_TRUE, "the device lacks robustBufferAccess");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp
index b67059d036..ab06a87e40 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
 #include "VulkanTestDevice.hpp"
 #include "SceShaders.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -15,8 +16,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-
 namespace {
 
 void Require(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp
index beaed11d60..1273ff05c7 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp
@@ -371,6 +371,34 @@ void TransactionLock() {
     Require(excluded, "a transaction ran beside one that had read prepared state");
 }
 
+void CommittedLinks() {
+    ShaderSnapshot front{};
+    auto pixel = std::make_shared<ShaderSnapshot>();
+    ResolvePreparedGraphics(front, pixel, 0, {});
+    Require(front.prepared->fragments.size() == 1 && front.prepared->fragments.front().lock() == pixel, "a resolved link was not published");
+    ShaderSnapshot unrelated{};
+    auto other = std::make_shared<ShaderSnapshot>();
+    std::optional<ShaderPreparationTransaction> open(std::in_place);
+    static_cast<void>(open->Read(unrelated));
+    auto repeated = std::async(std::launch::async, [&] { ResolvePreparedGraphics(front, pixel, 0, {}); });
+    const bool unblocked = repeated.wait_for(std::chrono::seconds(10)) == std::future_status::ready;
+    auto linking = std::async(std::launch::async, [&] { ResolvePreparedGraphics(front, other, 0, {}); });
+    const bool excluded = linking.wait_for(std::chrono::milliseconds(200)) == std::future_status::timeout;
+    open->Commit();
+    open.reset();
+    repeated.get();
+    linking.get();
+    Require(unblocked, "resolving a link the shader already had waited for another thread's transaction");
+    Require(excluded && front.prepared->fragments.size() == 2, "a new link was published beside a transaction that had read prepared state");
+    {
+        ShaderPreparationTransaction transaction;
+        transaction.Edit(front).fragments.clear();
+        ResolvePreparedGraphics(front, pixel, 0, {});
+        transaction.Commit();
+    }
+    Require(front.prepared->fragments.size() == 1 && front.prepared->fragments.front().lock() == pixel, "a link resolved in a transaction that had changed the shader was checked against the published links");
+}
+
 void PreparationPriority(bool beforeSubmit) {
     const auto workers = std::max(2u, std::thread::hardware_concurrency() / 2u);
     std::barrier started(static_cast<std::ptrdiff_t>(workers + 1u));
@@ -415,6 +443,7 @@ int main() {
         RegistryVersions();
         FusedHullHeaderSelection();
         TransactionLock();
+        CommittedLinks();
         PreparationPriority(false);
         PreparationPriority(true);
         auto device = OpenVulkanTestDevice();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp
index 734a7c6825..82c999000d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp
@@ -437,6 +437,15 @@ void SharedCodeHeaders() {
     AgcDriverRegisterShader_nid_postfix(&mesh.shader);
     AgcDriverResolveShaderAbi_nid_postfix(&vertex.shader, {}, primitive);
     AgcDriverRegisterShader_nid_postfix(&mesh.shader);
+    const auto snapshots = [&] {
+        const auto registry = AgcDriver::DriverDetail::Driver::Get().RegisteredShaders();
+        Require(registry != nullptr, "shared-code headers published no shader registry");
+        auto pair = std::pair{AgcDriver::DriverDetail::RegisteredHeader(*registry, &vertex.shader), AgcDriver::DriverDetail::RegisteredHeader(*registry, &mesh.shader)};
+        Require(pair.first != nullptr && pair.second != nullptr && pair.first != pair.second, "the shared-code headers were not registered apart");
+        return pair;
+    };
+    const auto [vertexSnapshot, meshSnapshot] = snapshots();
+    Require(vertexSnapshot->registeredState != meshSnapshot->registeredState, "a header with other registers shared another header's registered state");
     Shader copy = vertex.shader;
     copy.user_data = nullptr;
     AgcDriverResolveShaderAbi_nid_postfix(&copy, {}, primitive);
@@ -461,6 +470,8 @@ void SharedCodeHeaders() {
     mesh.shader.cx_registers = mesh.context.data();
     mesh.shader.num_cx_registers = mesh.context.size();
     AgcDriverRegisterShader_nid_postfix(&mesh.shader);
+    const auto [sameVertex, sameMesh] = snapshots();
+    Require(sameVertex->registeredState == sameMesh->registeredState && sameMesh->registeredState->context.at(0x2d5) == 0x2000u, "two headers with the same code and registers decoded their registered state twice");
     AgcDriverResolveShaderAbi_nid_postfix(&mesh.shader, {}, primitive);
     AgcDriverResolveShaderAbi_nid_postfix(&vertex.shader, {}, primitive);
     Require(sceAgcDriverSubmitDcb(&packet) == 0, "same-type registered header draw failed");
@@ -958,11 +969,13 @@ void AbiDeferredCompute() {
     caller.shader.specials = &caller.specials;
     caller.specials.dispatch_modifier = 0x8000u;
     AgcDriverRegisterShader_nid_postfix(&caller.shader);
+    const bool lazy = std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr;
     const auto before = ShaderRecompiler::FrontEndBuilds();
     AgcDriverResolveShaderAbi_nid_postfix(&caller.shader, {}, {});
     const auto attempted = ShaderRecompiler::FrontEndBuilds();
     AgcDriverResolveShaderAbi_nid_postfix(&caller.shader, {}, {});
-    Require(attempted > before && ShaderRecompiler::FrontEndBuilds() == attempted, "a compute static ABI deferred to its dispatch was prepared again for the same state");
+    if (lazy) Require(attempted == before && ShaderRecompiler::FrontEndBuilds() == attempted, "a compute static ABI resolved under lazy preparation built its front end before its dispatch");
+    else Require(attempted > before && ShaderRecompiler::FrontEndBuilds() == attempted, "a compute static ABI deferred to its dispatch was prepared again for the same state");
     const auto first = reinterpret_cast<std::uintptr_t>(AddFiveCallee.data());
     const auto second = reinterpret_cast<std::uintptr_t>(AddSixtyFourCallee.data());
     const auto output = reinterpret_cast<std::uintptr_t>(CallerOutput.data());
@@ -981,6 +994,88 @@ void AbiDeferredCompute() {
     AgcDriverShutdown_nid_postfix();
 }
 
+void AbiDeferredConcurrent() {
+    using namespace NarrowConstantStoreFixture;
+    Require(std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr, "lazy preparation is not enabled");
+    struct Header {
+        Shader shader{};
+        std::array<ShaderRegister, 7> registers{};
+        ShaderSpecialRegs specials{};
+    };
+    static Header header;
+    const auto address = reinterpret_cast<std::uintptr_t>(Code.data());
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18;
+    header.shader.header_size = sizeof(header);
+    header.shader.shader_size = sizeof(Code);
+    header.shader.code = Code.data();
+    header.shader.sh_registers = header.registers.data();
+    header.shader.num_sh_registers = header.registers.size();
+    header.shader.specials = &header.specials;
+    header.specials.dispatch_modifier = 0x8000;
+    header.registers = {{{0x20c, static_cast<std::uint32_t>(address >> 8u)}, {0x20d, static_cast<std::uint32_t>(address >> 40u)}, {0x207, Threads}, {0x208, 1}, {0x209, 1}, {0x212, 0}, {0x213, 4}}};
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+    AgcDriverResolveShaderAbi_nid_postfix(&header.shader, {}, {});
+    constexpr std::size_t Queues = 4;
+    constexpr std::size_t OutputBytes = 65536;
+#ifdef _WIN32
+    auto* allocation = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, Queues * OutputBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+    auto* allocation = static_cast<std::uint8_t*>(std::aligned_alloc(OutputBytes, Queues * OutputBytes));
+#endif
+    Require(allocation != nullptr, "cannot allocate the concurrent first use outputs");
+    const auto release = [](std::uint8_t* block) {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    };
+    const std::unique_ptr<std::uint8_t, decltype(release)> ownedOutputs(allocation, release);
+    GuestAllocations::Mutation().Add(allocation, Queues * OutputBytes, true, true, true);
+    std::fill_n(allocation, Queues * OutputBytes, Fill);
+    std::vector<std::vector<std::uint32_t>> commands(Queues);
+    std::vector<Packet> packets;
+    for (std::size_t queue = 0; queue < Queues; ++queue) {
+        const auto output = reinterpret_cast<std::uintptr_t>(allocation + queue * OutputBytes);
+        for (const auto reg : header.registers) commands[queue].insert(commands[queue].end(), {0xc0017600u, reg.offset, reg.value});
+        commands[queue].insert(commands[queue].end(), {0xc0027600u, 0x240, static_cast<std::uint32_t>(output), static_cast<std::uint32_t>(output >> 32u), 0xc0031500u, 1, 1, 1, 0x8041});
+        packets.push_back({commands[queue].data(), static_cast<std::uint32_t>(commands[queue].size()), 0, {}});
+    }
+    const auto builds = ShaderRecompiler::FrontEndBuilds();
+    const auto uses = AgcDriver::DriverDetail::Driver::DeferredAbiUses();
+    std::barrier start(static_cast<std::ptrdiff_t>(Queues));
+    std::vector<std::thread> threads;
+    for (std::size_t queue = 0; queue < Queues; ++queue) {
+        threads.emplace_back([&, queue] {
+            start.arrive_and_wait();
+            sceAgcDriverSubmitAcb(0x20u + static_cast<std::uint32_t>(queue), &packets[queue]);
+        });
+    }
+    for (auto& thread : threads) thread.join();
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriverSuspendPoint_nid_postfix();
+    AgcDriverWaitIdle_nid_postfix();
+    for (std::size_t queue = 0; queue < Queues; ++queue) {
+        const auto* output = allocation + queue * OutputBytes;
+        for (std::size_t offset = 0; offset < OutputBytes; ++offset) {
+            const auto expected = offset < Threads * LaneBytes ? ExpectedLane[offset % LaneBytes] : Fill;
+            if (output[offset] != expected) throw std::runtime_error("concurrent first use: queue " + std::to_string(queue) + " byte " + std::to_string(offset) + " is " + std::to_string(output[offset]) + ", expected " + std::to_string(expected));
+        }
+    }
+    const auto after = AgcDriver::DriverDetail::Driver::DeferredAbiUses();
+    const auto built = ShaderRecompiler::FrontEndBuilds() - builds;
+    const auto entries = AgcDriver::DriverDetail::Driver::Get().PreparedEntries(&header.shader);
+    const auto matched = (after.entries - after.unmatchedEntries) - (uses.entries - uses.unmatchedEntries);
+    const auto counts = std::to_string(built) + " front-end builds, " + std::to_string(entries) + " prepared entries, " + std::to_string(after.firstUses - uses.firstUses) + " first uses, " + std::to_string(after.found - uses.found) + " found, " + std::to_string(after.own - uses.own) + " own, " + std::to_string(matched) + " entries used";
+    std::cout << "concurrent first use of a deferred ABI: " << counts << '\n';
+    Require(after.firstUses == uses.firstUses + 1 && after.found == uses.found + 1 && after.own == uses.own, ("four queues making the first use of one deferred ABI at once did not prepare it once (" + counts + ")").c_str());
+    Require(built == after.entries - uses.entries && entries == built, ("four queues making the first use of one deferred ABI at once prepared an artifact besides its preparation (" + counts + ")").c_str());
+    Require(matched == 1, ("four queues making the first use of one deferred ABI at once did not all use the same entry of its preparation (" + counts + ")").c_str());
+    AgcDriverShutdown_nid_postfix();
+}
+
 void AbiDeferredRegistrationFailure() {
     static AbiHeader store;
     DescribeAbi(store, WaterfallStoreCode, 0, {{0x20c, ProgramLow(WaterfallStoreCode.data())}, {0x20d, ProgramHigh(WaterfallStoreCode.data())}, {0x207, 64}, {0x208, 1}, {0x209, 1}, {0x212, 0}, {0x213, 2u << 1u}}, {});
@@ -1198,6 +1293,63 @@ void AbiDeferredRectanglePairs() {
     ExpectFailure([] { AgcDriverShutdown_nid_postfix(); }, "custom per-vertex interpolation is unsupported");
 }
 
+void CommittedAbis() {
+    static AbiHeader front;
+    static AbiHeader pixel;
+    DescribeFront(front);
+    DescribeAbi(pixel, PassthroughPixelCode, 1, {{0x8, ProgramLow(PassthroughPixelCode.data())}, {0x9, ProgramHigh(PassthroughPixelCode.data())}, {0xa, 0}, {0xb, 0}}, {{0x1b6, 1}, {0x1b3, 2}, {0x1b4, 2}, {0x191, 0}, {0x1c5, 4}});
+    for (auto* header : {&front, &pixel}) AgcDriverRegisterShader_nid_postfix(&header->shader);
+    const std::array<const Shader*, 2> stages{&front.shader, &pixel.shader};
+    const std::array<ShaderRegister, 1> primitive{{{0x242, 4}}};
+    const std::array<ShaderRegister, 1> interpolant{{{0x191, 0x20}}};
+    const auto resolve = [&] {
+        AgcDriver::ShaderPreparationScope scope({&front.shader, &pixel.shader});
+        AgcDriverResolveShaderAbi_nid_postfix(&pixel.shader, {}, {});
+        AgcDriverResolveGraphicsStagesAbi_nid_postfix(stages, {}, primitive);
+        AgcDriverResolveGraphicsAbi_nid_postfix(&front.shader, &pixel.shader, 0);
+        scope.Commit();
+    };
+    const auto resolveOther = [&] {
+        AgcDriver::ShaderPreparationScope scope({&pixel.shader});
+        AgcDriverResolveShaderAbi_nid_postfix(&pixel.shader, interpolant, {});
+        scope.Commit();
+    };
+    resolve();
+    const auto registry = AgcDriver::DriverDetail::Driver::Get().RegisteredShaders();
+    Require(registry != nullptr, "committed ABI resolution published no shader registry");
+    const auto pixelSnapshot = AgcDriver::DriverDetail::RegisteredHeader(*registry, &pixel.shader);
+    Require(pixelSnapshot != nullptr, "committed ABI resolution published no pixel snapshot");
+    const auto committedAbis = [&] {
+        std::lock_guard lock(pixelSnapshot->prepared->mutex);
+        return pixelSnapshot->prepared->registeredAbis.size();
+    };
+    AgcDriver::DriverDetail::AwaitRegistrationPreparation();
+    const auto before = ShaderRecompiler::FrontEndBuilds();
+    const auto abisBefore = committedAbis();
+    bool unblocked = false;
+    bool excluded = false;
+    std::uint64_t repeatedBuilds = 0;
+    std::future<void> repeated;
+    std::future<void> other;
+    {
+        AgcDriver::DriverDetail::ShaderSnapshot unrelated{};
+        AgcDriver::DriverDetail::ShaderPreparationTransaction open;
+        static_cast<void>(open.Read(unrelated));
+        repeated = std::async(std::launch::async, resolve);
+        unblocked = repeated.wait_for(std::chrono::seconds(10)) == std::future_status::ready;
+        repeatedBuilds = ShaderRecompiler::FrontEndBuilds() - before;
+        other = std::async(std::launch::async, resolveOther);
+        const auto started = std::chrono::steady_clock::now();
+        while (ShaderRecompiler::FrontEndBuilds() == before + repeatedBuilds && std::chrono::steady_clock::now() - started < std::chrono::seconds(10)) std::this_thread::yield();
+        excluded = other.wait_for(std::chrono::milliseconds(500)) == std::future_status::timeout && committedAbis() == abisBefore;
+        open.Commit();
+    }
+    repeated.get();
+    other.get();
+    Require(unblocked && repeatedBuilds == 0, "resolving ABIs the shaders already had waited for another thread's shader preparation, or prepared them again");
+    Require(excluded, "a new ABI was published beside a shader preparation that had read prepared state");
+}
+
 void RelocatedHeaders() {
     alignas(256) static const std::array<std::uint32_t, 11> code{0x7e0002ffu, 0, 0x7e0202ffu, 0, 0x7e0402ffu, 0, 0x7e0602ffu, 0x3f800000u, 0xf80008cfu, 0x03020100u, 0xbf810000u};
     struct Header {
@@ -1261,16 +1413,85 @@ void RelocatedHeaders() {
     ExpectFailure([&] { AgcDriverResolveShaderAbi_nid_postfix(&otherContext.shader, {}, primitive); }, "replaced shader header");
 }
 
+void DispatchAheadPrewarm() {
+    alignas(256) std::array<std::uint32_t, 1> pendingCode{0xbf810000u};
+    alignas(256) std::array<std::uint32_t, 65> lazyCode{};
+    lazyCode[0] = 0xbf810000u;
+    lazyCode[64] = 0xbf810000u;
+    struct Header {
+        Shader shader{};
+        std::array<ShaderRegister, 7> registers{};
+        ShaderSpecialRegs specials{};
+    } pendingHeader, lazyHeader;
+    const auto fillHeader = [](Header& header, const void* code, std::size_t codeBytes) {
+        const auto address = reinterpret_cast<std::uintptr_t>(code);
+        header.shader.file_header = 0x34333231u;
+        header.shader.version = 0x18;
+        header.shader.header_size = sizeof(Header);
+        header.shader.shader_size = static_cast<std::uint32_t>(codeBytes);
+        header.shader.code = const_cast<void*>(code);
+        header.shader.sh_registers = header.registers.data();
+        header.shader.num_sh_registers = header.registers.size();
+        header.shader.specials = &header.specials;
+        header.specials.dispatch_modifier = 0x8000;
+        header.registers = {{{0x20c, static_cast<std::uint32_t>(address >> 8u)}, {0x20d, static_cast<std::uint32_t>(address >> 40u)}, {0x207, 1}, {0x208, 1}, {0x209, 1}, {0x212, 0}, {0x213, 2}}};
+    };
+    fillHeader(pendingHeader, pendingCode.data(), sizeof(pendingCode));
+    fillHeader(lazyHeader, lazyCode.data(), sizeof(lazyCode));
+    AgcDriverRegisterShader_nid_postfix(&pendingHeader.shader);
+    AgcDriverRegisterShader_nid_postfix(&lazyHeader.shader);
+    AgcDriver::DriverDetail::AwaitRegistrationPreparation();
+    const auto registry = AgcDriver::DriverDetail::Driver::Get().RegisteredShaders();
+    Require(registry != nullptr, "dispatch ahead prewarm test published no shader registry");
+    const auto pendingSnapshot = AgcDriver::DriverDetail::RegisteredHeader(*registry, &pendingHeader.shader);
+    const auto lazySnapshot = AgcDriver::DriverDetail::RegisteredHeader(*registry, &lazyHeader.shader);
+    Require(pendingSnapshot != nullptr && lazySnapshot != nullptr, "dispatch ahead prewarm test published no snapshots");
+    {
+        std::lock_guard lock(pendingSnapshot->prepared->mutex);
+        pendingSnapshot->prepared->entries.clear();
+        pendingSnapshot->prepared->demanded.store(false, std::memory_order_release);
+        pendingSnapshot->prepared->pending = true;
+    }
+    {
+        std::lock_guard lock(lazySnapshot->prepared->mutex);
+        lazySnapshot->prepared->entries.clear();
+        lazySnapshot->prepared->pending = false;
+    }
+    alignas(256) static const std::array<std::uint32_t, 1> invalidCode{0xbf9f0000u};
+    const auto invalidAddress = reinterpret_cast<std::uintptr_t>(invalidCode.data());
+    const auto lazyOffsetAddress = reinterpret_cast<std::uintptr_t>(lazyCode.data() + 64);
+    alignas(16) const std::array<std::uint32_t, 6> indirectPairs{0x20cu, static_cast<std::uint32_t>(lazyOffsetAddress >> 8u), 0x20du, static_cast<std::uint32_t>(lazyOffsetAddress >> 40u), 0x240u, 7u};
+    const auto pairsAddress = reinterpret_cast<std::uintptr_t>(indirectPairs.data());
+    std::vector<std::uint32_t> commands;
+    for (const auto reg : pendingHeader.registers) commands.insert(commands.end(), {0xc0017600u, reg.offset, reg.value});
+    commands.insert(commands.end(), {0xc0017600u, 0x20cu, static_cast<std::uint32_t>(invalidAddress >> 8u), 0xc0017600u, 0x20du, static_cast<std::uint32_t>(invalidAddress >> 40u), 0xc0031500u, 1, 1, 1, 0x8041u, 0xffff1000u});
+    commands.insert(commands.end(), {0xc0017600u, 0x20cu, pendingHeader.registers[0].value, 0xc0017600u, 0x20du, pendingHeader.registers[1].value, 0xc0031500u, 1, 1, 1, 0x8041u});
+    commands.insert(commands.end(), {0xc0036300u, static_cast<std::uint32_t>(pairsAddress), static_cast<std::uint32_t>(pairsAddress >> 32u), 0x80000000u, 3u});
+    commands.insert(commands.end(), {0xc0031500u, 1, 1, 1, 0x8041u});
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    Require(sceAgcDriverSubmitAcb(0x20, &packet) == 0, "dispatch ahead prewarm submit failed");
+    ExpectFailure([] { AgcDriverWaitIdle_nid_postfix(); }, "s_code_end");
+    AgcDriver::DriverDetail::AwaitRegistrationPreparation();
+    AgcDriver::DriverDetail::AwaitLibraryPrebuilds();
+    Require(pendingSnapshot->prepared->demanded.load(std::memory_order_acquire), "dispatch ahead did not prioritize the pending shader");
+    {
+        std::lock_guard lock(lazySnapshot->prepared->mutex);
+        Require(lazySnapshot->prepared->entries.size() == 1 && lazySnapshot->prepared->entries.front().codeOffset == 64 && lazySnapshot->prepared->entries.front().handle != nullptr, "dispatch ahead did not prewarm the lazy shader for its dispatched offset");
+    }
+    ExpectFailure([] { AgcDriverShutdown_nid_postfix(); }, "s_code_end");
+}
+
 }
 
 int main(int argc, char** argv) {
     try {
         const std::string_view abiMode = argc == 2 ? argv[1] : "";
-        const bool abiDeferred = abiMode == "--abi-deferred-compute" || abiMode == "--abi-deferred-pixel" || abiMode == "--abi-deferred-stages" || abiMode == "--abi-deferred-rectangle" || abiMode == "--abi-deferred-undecodable-state" || abiMode == "--abi-deferred-registration-failure" || abiMode == "--abi-deferred-vertex-inputs" || abiMode == "--abi-deferred-rectangle-pairs";
-        Require(argc == 1 || abiDeferred || (argc == 2 && (std::string_view(argv[1]) == "--indirect" || std::string_view(argv[1]) == "--fail-before-registration" || std::string_view(argv[1]) == "--deferred" || std::string_view(argv[1]) == "--deferred-undecodable" || std::string_view(argv[1]) == "--registered-workgroup" || std::string_view(argv[1]) == "--lazy")), "invalid test arguments");
+        const bool abiDeferred = abiMode == "--abi-deferred-compute" || abiMode == "--abi-deferred-concurrent" || abiMode == "--abi-deferred-pixel" || abiMode == "--abi-deferred-stages" || abiMode == "--abi-deferred-rectangle" || abiMode == "--abi-deferred-undecodable-state" || abiMode == "--abi-deferred-registration-failure" || abiMode == "--abi-deferred-vertex-inputs" || abiMode == "--abi-deferred-rectangle-pairs";
+        Require(argc == 1 || abiDeferred || (argc == 2 && (std::string_view(argv[1]) == "--indirect" || std::string_view(argv[1]) == "--fail-before-registration" || std::string_view(argv[1]) == "--deferred" || std::string_view(argv[1]) == "--deferred-undecodable" || std::string_view(argv[1]) == "--registered-workgroup" || std::string_view(argv[1]) == "--dispatch-ahead-prewarm" || std::string_view(argv[1]) == "--lazy")), "invalid test arguments");
         if (abiDeferred) {
             if (!OpenVulkanTestDevice()) return VulkanTestSkipped;
             if (abiMode == "--abi-deferred-compute") AbiDeferredCompute();
+            else if (abiMode == "--abi-deferred-concurrent") AbiDeferredConcurrent();
             else if (abiMode == "--abi-deferred-pixel") AbiDeferredPixel();
             else if (abiMode == "--abi-deferred-stages") AbiDeferredStages();
             else if (abiMode == "--abi-deferred-undecodable-state") AbiDeferredUndecodableState();
@@ -1294,6 +1515,12 @@ int main(int argc, char** argv) {
             AgcDriverShutdown_nid_postfix();
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--dispatch-ahead-prewarm") {
+            if (!OpenVulkanTestDevice()) return VulkanTestSkipped;
+            DispatchAheadPrewarm();
+            std::cout << "dispatch ahead prewarm tests passed\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--deferred") {
             if (!OpenVulkanTestDevice()) return VulkanTestSkipped;
             DeferredRegistration();
@@ -1318,6 +1545,7 @@ int main(int argc, char** argv) {
         device.reset();
         SharedCodeHeaders();
         RelocatedHeaders();
+        CommittedAbis();
         RegistrationWithoutSpecials();
         Registration(argc == 2);
         std::cout << "prepared shader and transactional registration tests passed\n";
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PresentKeyWriterWait.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PresentKeyWriterWait.cpp
new file mode 100644
index 0000000000..e85b6e55d0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PresentKeyWriterWait.cpp
@@ -0,0 +1,202 @@
+#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <iostream>
+#include <mutex>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Side = 128;
+constexpr std::uint64_t DisplayFormat = 0x8000000000000000ull;
+constexpr std::size_t SurfaceBytes = 65536;
+constexpr std::size_t KeysOffset = SurfaceBytes;
+constexpr std::size_t KeysCapacity = 32768;
+constexpr std::size_t CopiedKeys = 256;
+constexpr std::size_t SourceKeysOffset = KeysOffset + KeysCapacity;
+constexpr std::size_t BlockBytes = 2 * 65536;
+constexpr std::uint8_t Uncompressed = 0xff;
+constexpr std::uint8_t Cleared = 0x00;
+
+alignas(256) constexpr std::array<std::uint32_t, 7> CopyKeysCode{
+    0x34020083, 0xe0341000, 0x80000201, 0xbf8c3f70, 0xe0741000, 0x80010201, 0xbf810000,
+};
+
+std::uint64_t AddressOf(const void* data) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+}
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(65536, BlockBytes));
+#endif
+        Require(block != nullptr, "present key writer wait: cannot allocate the guest block");
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint8_t* Data() { return block; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = AddressOf(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::vector<std::uint32_t>& userData) {
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    return ShaderRecompiler::Recompile(request);
+}
+
+struct Scenario {
+    std::uint8_t* surface;
+    std::uint8_t* keys;
+    std::uint8_t* source;
+    std::size_t keyBytes;
+    AgcDriver::DisplayBuffer buffer;
+    std::vector<std::uint32_t> copyData;
+};
+
+Scenario Prepare(std::uint8_t* block) {
+    Scenario scenario{block, block + KeysOffset, block + SourceKeysOffset, 0, {AddressOf(block), DisplayFormat, Side, Side}, std::vector<std::uint32_t>(16, 0u)};
+    scenario.buffer.dccAddress = AddressOf(scenario.keys);
+    scenario.keyBytes = AgcDriver::DisplayBufferKeyBytes(scenario.buffer);
+    Require(AgcDriver::DisplayBufferSize(scenario.buffer) <= SurfaceBytes && scenario.keyBytes >= CopiedKeys && scenario.keyBytes <= KeysCapacity, "present key writer wait: the display buffer does not fit the guest block");
+    const auto source = BufferDescriptor(scenario.source, CopiedKeys);
+    const auto destination = BufferDescriptor(scenario.keys, CopiedKeys);
+    std::copy(source.begin(), source.end(), scenario.copyData.begin());
+    std::copy(destination.begin(), destination.end(), scenario.copyData.begin() + 4);
+    return scenario;
+}
+
+void Reset(const Scenario& scenario) {
+    std::memset(scenario.surface, 0x55, SurfaceBytes);
+    std::memset(scenario.keys, Uncompressed, scenario.keyBytes);
+    std::memset(scenario.keys, Cleared, CopiedKeys);
+    std::memset(scenario.source, Uncompressed, CopiedKeys);
+    AgcDriver::GuestMemory::BumpCollectEpoch();
+}
+
+std::string PresentFailure(AgcDriver::VulkanDevice& device, const AgcDriver::DisplayBuffer& buffer) {
+    try {
+        device.PresentDisplayBuffer(buffer);
+    } catch (const std::exception& error) {
+        return error.what();
+    }
+    return "the headless present succeeded";
+}
+
+const std::string NoSwapchain = "Vulkan presentation: device has no swapchain";
+
+bool CanCopyKeys(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
+    const std::array<std::uint32_t, 4> pattern{0xffffffffu, 0xffffffffu, 0xffffffffu, 0xffffffffu};
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    const bool filled = device.FillBuffer(AddressOf(scenario.keys), CopiedKeys, pattern);
+    device.WaitIdle();
+    return filled;
+}
+
+void RunPendingWriter(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
+    Reset(scenario);
+    const auto copy = Compile(device, CopyKeysCode, scenario.copyData);
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    Require(AgcDriver::GuestMemory::GpuMutex().DepthOnThisThread() == 1, "present key writer wait: the presenter's hold is not the outermost");
+    device.Dispatch(copy, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(CopyKeysCode.data()));
+    Require(AgcDriver::Graphics::DccKeyWritersPending(scenario.buffer.dccAddress, scenario.keyBytes), "a recorded kernel that copies data over the display keys is not seen as a pending key writer");
+    const auto holds = AgcDriver::GuestMemory::GpuHoldSerial();
+    const auto failure = PresentFailure(device, scenario.buffer);
+    const auto acquired = AgcDriver::GuestMemory::GpuHoldSerial() - holds;
+    Require(failure == NoSwapchain, "a present behind a pending writer of the display keys stopped before the swapchain: " + failure);
+    Require(acquired != 0, "the presenter synchronized with the display keys' writer without releasing the GPU mutex");
+    Require(!AgcDriver::Graphics::DccKeyWritersPending(scenario.buffer.dccAddress, scenario.keyBytes), "the display keys' writer is still pending after the present");
+    Require(scenario.keys[0] == Uncompressed && scenario.keys[CopiedKeys - 1] == Uncompressed, "the present read the display keys before their writer landed");
+}
+
+void RunNoWriter(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
+    std::memset(scenario.keys, Uncompressed, scenario.keyBytes);
+    AgcDriver::GuestMemory::BumpCollectEpoch();
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    device.WaitIdle();
+    Require(!AgcDriver::Graphics::DccKeyWritersPending(scenario.buffer.dccAddress, scenario.keyBytes), "the idle device still reports a pending writer of the display keys");
+    const auto holds = AgcDriver::GuestMemory::GpuHoldSerial();
+    const auto failure = PresentFailure(device, scenario.buffer);
+    const auto acquired = AgcDriver::GuestMemory::GpuHoldSerial() - holds;
+    Require(failure == NoSwapchain, "a present with no pending writer of the display keys stopped before the swapchain: " + failure);
+    Require(acquired == 0, "a present with no pending writer of the display keys released the GPU mutex");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!device->CanWaitUnlocked()) {
+            std::puts("skipped, the device has no timeline semaphores: the presenter cannot wait without the GPU mutex");
+            return VulkanTestSkipped;
+        }
+        GuestBlock block;
+        const auto scenario = Prepare(block.Data());
+        if (!CanCopyKeys(*device, scenario)) {
+            std::puts("skipped, host imports are unavailable: the key writer of the test is a copied writer");
+            return VulkanTestSkipped;
+        }
+        RunPendingWriter(*device, scenario);
+        RunNoWriter(*device, scenario);
+        std::puts("present key writer wait tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp
index 00f3ca4d2e..b1b08b90c9 100755
--- a/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/SynchronizationStatistics.hpp"
@@ -27,9 +28,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-extern "C" int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-
 namespace {
 
 constexpr std::uint32_t Lanes = 32;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/QueuedIndexReadOrder.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/QueuedIndexReadOrder.cpp
index acc2b1617a..d69048386f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/QueuedIndexReadOrder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/QueuedIndexReadOrder.cpp
@@ -343,10 +343,8 @@ void CopyPendingImage(std::size_t bytes, const char* phase) {
 int main() {
 #ifdef _WIN32
     _putenv_s("APS5_PIPELINED_DRAWS", "1");
-    _putenv_s("APS5_PIPELINE_DMA", "1");
 #else
     setenv("APS5_PIPELINED_DRAWS", "1", 1);
-    setenv("APS5_PIPELINE_DMA", "1", 1);
 #endif
     try {
         {
@@ -373,6 +371,11 @@ int main() {
         AgcDriverWaitIdle_nid_postfix();
         Require(AgcDriver::Graphics::StorageTexture::AnyPending(), "queued index read: the image write left no pending result to order against");
         Require(IndicesIntact(), "queued index read: the image's results reached guest memory before any consumer asked");
+        const auto copiedAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(Copied));
+        const auto heldQueries = AgcDriver::DriverDetail::DrawPipeline::HeldReadQueries();
+        Require(!AgcDriver::Graphics::StorageTexture::FlushPending(copiedAddress, PoolBytes), "queued index read: a flush over memory without pending results stored something");
+        Require(AgcDriver::DriverDetail::DrawPipeline::HeldReadQueries() == heldQueries, "queued index read: a flush with nothing to store asked the draw pipeline for held reads");
+        Require(IndicesIntact(), "queued index read: a flush over other memory stored the image's results");
         GateUntilQueued();
         std::fill_n(ColorMemory, ColorBytes, std::byte{0});
         Submit(Draw(Vertices.data(), Vertices.size()), "the indexed draw");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp
new file mode 100644
index 0000000000..66a3c78357
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp
@@ -0,0 +1,162 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdlib>
+#include <cstdio>
+#include <iostream>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::array<std::array<std::uint32_t, 2>, 256> Measured{{
+    {0x000000u, 0x3f800000u}, {0x002922u, 0x3f7fadd6u}, {0x00a1a9u, 0x3f7ebe44u}, {0x010c47u, 0x3f7debceu},
+    {0x013df5u, 0x3f7d8a32u}, {0x01a87fu, 0x3f7cb9ddu}, {0x024f43u, 0x3f7b766fu}, {0x02d76du, 0x3f7a70beu},
+    {0x031690u, 0x3f79f820u}, {0x033035u, 0x3f79c742u}, {0x03adabu, 0x3f78d946u}, {0x04435bu, 0x3f77bfa4u},
+    {0x04f3a1u, 0x3f76772au}, {0x057a96u, 0x3f757df8u}, {0x05c6afu, 0x3f74f253u}, {0x06342au, 0x3f742a80u},
+    {0x06bf6fu, 0x3f732e24u}, {0x07709au, 0x3f71f00au}, {0x07eb02u, 0x3f711627u}, {0x086273u, 0x3f704304u},
+    {0x09362bu, 0x3f6ed04au}, {0x099950u, 0x3f6e2438u}, {0x09f75cu, 0x3f6d81e2u}, {0x0a097cu, 0x3f6d62b3u},
+    {0x0ab7e3u, 0x3f6c3840u}, {0x0b1a69u, 0x3f6b90f0u}, {0x0b93a5u, 0x3f6ac454u}, {0x0becd7u, 0x3f6a2eadu},
+    {0x0bf0b4u, 0x3f6a2836u}, {0x0c5c7fu, 0x3f697463u}, {0x0c9164u, 0x3f691c8au}, {0x0cb1e2u, 0x3f68e6b5u},
+    {0x0d5f89u, 0x3f67c8a0u}, {0x0dd27au, 0x3f670cc6u}, {0x0e09e4u, 0x3f66b2a2u}, {0x0ead02u, 0x3f65aae2u},
+    {0x0ed904u, 0x3f656421u}, {0x0f17a3u, 0x3f64ffbeu}, {0x0f21ddu, 0x3f64ef61u}, {0x0f2bcdu, 0x3f64df7du},
+    {0x0f4205u, 0x3f64bbfeu}, {0x0f8808u, 0x3f644c6cu}, {0x0faddcu, 0x3f641050u}, {0x0fd630u, 0x3f63d05fu},
+    {0x1012f0u, 0x3f637050u}, {0x108fe7u, 0x3f62abb4u}, {0x10a3d6u, 0x3f628c77u}, {0x1184b9u, 0x3f612e5au},
+    {0x119a72u, 0x3f610cc2u}, {0x11e20bu, 0x3f609e4fu}, {0x123f59u, 0x3f600f00u}, {0x128b2fu, 0x3f5f9b0du},
+    {0x12bd4au, 0x3f5f4eb3u}, {0x12f18du, 0x3f5eff48u}, {0x135d16u, 0x3f5e5c8du}, {0x13deefu, 0x3f5d994bu},
+    {0x140ceeu, 0x3f5d5472u}, {0x14a0f9u, 0x3f5c77fdu}, {0x14f473u, 0x3f5bfc70u}, {0x15051au, 0x3f5be3dau},
+    {0x153e7cu, 0x3f5b8f4fu}, {0x15b949u, 0x3f5adb3au}, {0x1600a3u, 0x3f5a7320u}, {0x1676ebu, 0x3f59c766u},
+    {0x172abbu, 0x3f58c45au}, {0x1738f7u, 0x3f58aff3u}, {0x17a05au, 0x3f581c33u}, {0x17f5e8u, 0x3f57a288u},
+    {0x1818e8u, 0x3f5770e9u}, {0x185f1au, 0x3f570da8u}, {0x18f135u, 0x3f564038u}, {0x194f2fu, 0x3f55bce2u},
+    {0x1a61dbu, 0x3f54409cu}, {0x1a63e2u, 0x3f543dd2u}, {0x1af098u, 0x3f537d12u}, {0x1bd958u, 0x3f52413au},
+    {0x1cb224u, 0x3f511e54u}, {0x1deb7au, 0x3f4f7f68u}, {0x1df9fdu, 0x3f4f6c59u}, {0x1e27a1u, 0x3f4f307du},
+    {0x1e398fu, 0x3f4f1903u}, {0x1ef9d8u, 0x3f4e1e85u}, {0x1fb17cu, 0x3f4d317eu}, {0x1fec12u, 0x3f4ce652u},
+    {0x202036u, 0x3f4ca39au}, {0x20b671u, 0x3f4be450u}, {0x211c70u, 0x3f4b633bu}, {0x21b455u, 0x3f4aa42eu},
+    {0x2217beu, 0x3f4a27e7u}, {0x22c947u, 0x3f494b6eu}, {0x230d97u, 0x3f48f719u}, {0x23a75fu, 0x3f483a41u},
+    {0x244f6fu, 0x3f476d74u}, {0x24ede6u, 0x3f46add8u}, {0x250d33u, 0x3f46882au}, {0x254b0cu, 0x3f463de2u},
+    {0x263ba6u, 0x3f451ef3u}, {0x269e0du, 0x3f44aa89u}, {0x26a2c0u, 0x3f44a4fdu}, {0x26bb7du, 0x3f4487d0u},
+    {0x26e875u, 0x3f4452ddu}, {0x2744e3u, 0x3f43e660u}, {0x281972u, 0x3f42eeaau}, {0x29b882u, 0x3f4111f2u},
+    {0x2a3af4u, 0x3f407e00u}, {0x2a96fbu, 0x3f401628u}, {0x2afa95u, 0x3f3fa642u}, {0x2b0537u, 0x3f3f9a58u},
+    {0x2baf6au, 0x3f3edc66u}, {0x2c7557u, 0x3f3e015au}, {0x2d1c9au, 0x3f3d49c5u}, {0x2d711au, 0x3f3ced8cu},
+    {0x2e0531u, 0x3f3c4cc6u}, {0x2e4415u, 0x3f3c08d1u}, {0x2e8e7du, 0x3f3bb8aau}, {0x2eae05u, 0x3f3b96c8u},
+    {0x2fa54eu, 0x3f3a8eaeu}, {0x301850u, 0x3f3a14d7u}, {0x30d16au, 0x3f39520au}, {0x31f5efu, 0x3f38216cu},
+    {0x32c6ecu, 0x3f374a2du}, {0x33d0ceu, 0x3f363b28u}, {0x34b9b5u, 0x3f355051u}, {0x34c9ebu, 0x3f35400eu},
+    {0x364b9du, 0x3f33c092u}, {0x36f675u, 0x3f3318bau}, {0x376cbfu, 0x3f32a53au}, {0x37dc76u, 0x3f3238afu},
+    {0x387a34u, 0x3f31a04au}, {0x3898d1u, 0x3f3182d5u}, {0x392630u, 0x3f30fb4bu}, {0x398406u, 0x3f30a1c6u},
+    {0x3aa8b5u, 0x3f2f8cd0u}, {0x3b1287u, 0x3f2f2983u}, {0x3b6186u, 0x3f2edfabu}, {0x3bbbe9u, 0x3f2e8b79u},
+    {0x3bfb1eu, 0x3f2e50c8u}, {0x3cf38cu, 0x3f2d6b98u}, {0x3d9c17u, 0x3f2cd172u}, {0x3e7d1bu, 0x3f2c054du},
+    {0x3e875fu, 0x3f2bfc08u}, {0x3f63afu, 0x3f2b360fu}, {0x3f98e2u, 0x3f2b0685u}, {0x3fa7d9u, 0x3f2af92au},
+    {0x407b49u, 0x3f2a3d5au}, {0x4174afu, 0x3f2961e2u}, {0x427df9u, 0x3f287ad8u}, {0x43435cu, 0x3f27d089u},
+    {0x437bcbu, 0x3f27a016u}, {0x44985eu, 0x3f26ad72u}, {0x451abdu, 0x3f263f34u}, {0x457d42u, 0x3f25ec44u},
+    {0x472077u, 0x3f248ef6u}, {0x4724dau, 0x3f248b56u}, {0x47469au, 0x3f246f78u}, {0x482c9cu, 0x3f23b287u},
+    {0x486824u, 0x3f2381e6u}, {0x48db40u, 0x3f232432u}, {0x499523u, 0x3f228dc2u}, {0x49b64au, 0x3f22730au},
+    {0x49dea9u, 0x3f22528du}, {0x4a23d5u, 0x3f221b02u}, {0x4b14f9u, 0x3f215a86u}, {0x4c25fcu, 0x3f2082beu},
+    {0x4cbd87u, 0x3f200befu}, {0x4cdd20u, 0x3f1ff340u}, {0x4dd422u, 0x3f1f334cu}, {0x4ef8aau, 0x3f1e5249u},
+    {0x4f20f3u, 0x3f1e337eu}, {0x4f426du, 0x3f1e19f1u}, {0x5051c1u, 0x3f1d4c05u}, {0x506bf2u, 0x3f1d3841u},
+    {0x507313u, 0x3f1d32e0u}, {0x519088u, 0x3f1c5cc0u}, {0x520935u, 0x3f1c02eau}, {0x52e6b4u, 0x3f1b5f10u},
+    {0x536d35u, 0x3f1afc38u}, {0x54a6d8u, 0x3f1a17a2u}, {0x55c663u, 0x3f19485eu}, {0x56ed5bu, 0x3f187600u},
+    {0x571242u, 0x3f185bd8u}, {0x5790f8u, 0x3f180249u}, {0x57ee05u, 0x3f17c0c8u}, {0x588a7eu, 0x3f175320u},
+    {0x58d556u, 0x3f171ee4u}, {0x59a54au, 0x3f168e80u}, {0x59f999u, 0x3f165444u}, {0x5affb2u, 0x3f15a05bu},
+    {0x5b855cu, 0x3f15453fu}, {0x5bd86du, 0x3f150cd9u}, {0x5c90a9u, 0x3f149059u}, {0x5cd546u, 0x3f146230u},
+    {0x5d9dc9u, 0x3f13dbf0u}, {0x5e14d9u, 0x3f138caau}, {0x5e8766u, 0x3f1340b6u}, {0x5f41cau, 0x3f12c5c6u},
+    {0x5f5572u, 0x3f12b8dcu}, {0x60fd9bu, 0x3f11a440u}, {0x616499u, 0x3f1161b4u}, {0x625d1cu, 0x3f10c218u},
+    {0x62c33au, 0x3f1080e8u}, {0x63c0e3u, 0x3f0fdff7u}, {0x641547u, 0x3f0faabcu}, {0x64b8d7u, 0x3f0f43feu},
+    {0x651327u, 0x3f0f0b83u}, {0x658cdau, 0x3f0ebfadu}, {0x65dc9fu, 0x3f0e8e23u}, {0x662b59u, 0x3f0e5d60u},
+    {0x66d228u, 0x3f0df67eu}, {0x670f27u, 0x3f0dd104u}, {0x67e4c4u, 0x3f0d4e61u}, {0x6916adu, 0x3f0c94eeu},
+    {0x6a50dfu, 0x3f0bd86cu}, {0x6a7a5au, 0x3f0bbfaeu}, {0x6b0a18u, 0x3f0b6a37u}, {0x6b0d54u, 0x3f0b684cu},
+    {0x6b4013u, 0x3f0b4a3au}, {0x6b4cb2u, 0x3f0b42c1u}, {0x6bd361u, 0x3f0af338u}, {0x6bf46cu, 0x3f0adfc3u},
+    {0x6cad4au, 0x3f0a734au}, {0x6cb93du, 0x3f0a6c4cu}, {0x6d76b0u, 0x3f09fdddu}, {0x6dc676u, 0x3f09cf92u},
+    {0x6e36aau, 0x3f098ea8u}, {0x6f0367u, 0x3f0918d3u}, {0x6fa5cau, 0x3f08bbedu}, {0x70c958u, 0x3f08165eu},
+    {0x71e6c2u, 0x3f0775ccu}, {0x721583u, 0x3f075ba3u}, {0x72e6ccu, 0x3f06e703u}, {0x72fdf2u, 0x3f06da29u},
+    {0x73596du, 0x3f06a778u}, {0x7403e4u, 0x3f064966u}, {0x744916u, 0x3f06235cu}, {0x74c9dfu, 0x3f05dccau},
+    {0x74e69au, 0x3f05cd16u}, {0x756dbau, 0x3f05836cu}, {0x7631a9u, 0x3f05192au}, {0x7731afu, 0x3f048f50u},
+    {0x7774a2u, 0x3f046b72u}, {0x791a7cu, 0x3f038b32u}, {0x795e82u, 0x3f036751u}, {0x7aa2c1u, 0x3f02bd52u},
+    {0x7c2684u, 0x3f01f444u}, {0x7c64ebu, 0x3f01d422u}, {0x7d2cafu, 0x3f016db2u}, {0x7d959fu, 0x3f013822u},
+    {0x7e62aau, 0x3f00cffbu}, {0x7ebff2u, 0x3f00a0d0u}, {0x7eecf4u, 0x3f008a1au}, {0x7f1505u, 0x3f0075eau},
+    {0x7f1b10u, 0x3f0072dfu}, {0x7f2614u, 0x3f006d53u}, {0x7ff486u, 0x3f0005beu}, {0x7fffffu, 0x3f000001u},
+}};
+constexpr std::array<std::uint32_t, 6> Exponents{1u, 60u, 127u, 128u, 200u, 252u};
+constexpr std::uint32_t Cases = static_cast<std::uint32_t>(Measured.size() * Exponents.size() * 2u);
+constexpr std::uint32_t Batches = Cases / Threads;
+alignas(256) std::array<std::uint32_t, Threads> Input{};
+alignas(256) std::array<std::uint32_t, Threads> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 9> Code{
+    0x34020082, 0xe0301000, 0x80000201, 0xbf8c3f70, 0x7e065502, 0xe0701000, 0x80010301, 0xbf8c3f70,
+    0xbf810000,
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::uint32_t Sample(std::uint32_t index) {
+    const auto& measured = Measured[index % Measured.size()];
+    const auto exponent = Exponents[(index / Measured.size()) % Exponents.size()];
+    const auto sign = (index / static_cast<std::uint32_t>(Measured.size() * Exponents.size())) << 31u;
+    return sign | exponent << 23u | measured[0];
+}
+
+std::uint32_t Expected(std::uint32_t index) {
+    const auto& measured = Measured[index % Measured.size()];
+    const auto exponent = Exponents[(index / Measured.size()) % Exponents.size()];
+    const auto sign = (index / static_cast<std::uint32_t>(Measured.size() * Exponents.size())) << 31u;
+    return sign | ((measured[1] >> 23u) + 127u - exponent) << 23u | (measured[1] & 0x7fffffu);
+}
+}
+
+int main() {
+    try {
+        if (std::getenv("APS5_EXACT_RCP") == nullptr) return VulkanTestSkipped;
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        std::vector<std::uint32_t> userData(8, 0u);
+        const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+        const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+        std::copy(input.begin(), input.end(), userData.begin());
+        std::copy(output.begin(), output.end(), userData.begin() + 4);
+        const std::span<const std::uint32_t> code(Code);
+        const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+        const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+        ShaderRecompiler::RecompileRequest request{
+            {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+            {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+            device->Target(),
+            {0, 0, 0, 128}
+        };
+        request.useCache = false;
+        request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, true, false};
+        const auto result = ShaderRecompiler::Recompile(request);
+        for (std::uint32_t batch = 0; batch < Batches; ++batch) {
+            for (std::uint32_t tid = 0; tid < Threads; ++tid) Input[tid] = Sample(batch * Threads + tid);
+            Output.fill(0xdeadbeefu);
+            device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+            device->WaitIdle();
+            for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+                const auto wanted = Expected(batch * Threads + tid);
+                Require(Output[tid] == wanted, std::string("v_rcp_f32 of ") + Hex(Input[tid]) + " is " + Hex(Output[tid]) + ", expected the RDNA 2 value " + Hex(wanted));
+            }
+        }
+        std::puts("rcp hardware tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp
index 0657f99bca..eeeb0fd05c 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp
@@ -2,6 +2,9 @@
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "Recompiler.hpp"
 #include "SpirvBackend/SpirvModule.hpp"
+#if ANYPS5_ENABLE_SPIRV_TOOLS
+#include "SpirvBackend/SpirvOptimizer.hpp"
+#endif
 #include "VulkanTestDevice.hpp"
 #include <array>
 #include <bit>
@@ -46,8 +49,11 @@ public:
         builder.EmitEntryPoint(spv::ExecutionModelVertex, main, "main", {vertexIndex, position, identity});
         result(spv::OpLabel);
         const auto index = result(spv::OpLoad, intType, vertexIndex);
-        const auto first = result(spv::OpIEqual, boolType, index, constant(intType, 0u));
-        const auto second = result(spv::OpIEqual, boolType, index, constant(intType, 1u));
+        const auto boolVectorType = type(spv::OpTypeVector, boolType, 4u);
+        const auto firstScalar = result(spv::OpIEqual, boolType, index, constant(intType, 0u));
+        const auto secondScalar = result(spv::OpIEqual, boolType, index, constant(intType, 1u));
+        const auto first = result(spv::OpCompositeConstruct, boolVectorType, firstScalar, firstScalar, firstScalar, firstScalar);
+        const auto second = result(spv::OpCompositeConstruct, boolVectorType, secondScalar, secondScalar, secondScalar, secondScalar);
         const auto positionValue = result(spv::OpSelect, vec4Type, first, vector(-1.0f, -1.0f, 0.0f, 1.0f), result(spv::OpSelect, vec4Type, second, vector(1.0f, -1.0f, 0.0f, 1.0f), vector(-1.0f, 1.0f, 0.0f, 1.0f)));
         const auto identityValue = result(spv::OpSelect, vec4Type, first, vector(0.0f, 0.0f, 0.0f, 1.0f), result(spv::OpSelect, vec4Type, second, vector(1.0f, 0.0f, 0.0f, 1.0f), vector(0.0f, 1.0f, 0.0f, 1.0f)));
         emit(spv::OpStore, position, positionValue);
@@ -128,19 +134,24 @@ std::uint32_t VertexOf(std::uint32_t x, std::uint32_t y) {
     return (red >= 128u ? 1u : 0u) + (green >= 128u ? 2u : 0u);
 }
 
-int Run(AgcDriver::VulkanDevice& device) {
+int Run(AgcDriver::VulkanDevice& device, std::uint32_t maximumVersion) {
     std::cout << "device: " << device.DeviceName() << "\n";
     auto target = device.Target();
     if (!target.tessellation.has_value() || !TargetHasCapability(target, spv::CapabilityTessellation)) {
         std::cout << "skipped, device has no tessellation\n";
         return VulkanTestSkipped;
     }
-    if (target.spirvVersion > 0x00010400u) target.spirvVersion = 0x00010400u;
+    if (target.spirvVersion > maximumVersion) target.spirvVersion = maximumVersion;
     Require(target.spirvVersion >= 0x00010300u, "rect-list corner draw needs SPIR-V 1.3");
+    std::cout << "SPIR-V " << (target.spirvVersion >> 16u) << "." << ((target.spirvVersion >> 8u) & 0xffu) << "\n";
     ShaderRecompiler::RecompileResult vertex;
     ShaderRecompiler::RecompileResult fragment;
     vertex.spirv = ShaderRecompiler::SharedSpirv(Emitter(target.spirvVersion).Vertex());
     fragment.spirv = ShaderRecompiler::SharedSpirv(Emitter(target.spirvVersion).Fragment());
+#if ANYPS5_ENABLE_SPIRV_TOOLS
+    static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(vertex.spirv, target.vulkanVersion, target.spirvVersion, target.nonConstantImageOffsets, false));
+    static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(fragment.spirv, target.vulkanVersion, target.spirvVersion, target.nonConstantImageOffsets, false));
+#endif
     vertex.parameterExports = {0u};
     fragment.fragmentParameters = {{0u, 0u, false, false}};
     const auto rectangle = ShaderRecompiler::BuildRectListShaders(vertex, fragment, target);
@@ -194,8 +205,12 @@ int main() {
     try {
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
-        const auto result = Run(*device);
+        auto result = Run(*device, 0x00010300u);
         if (result != 0) return result;
+        if (device->Target().spirvVersion >= 0x00010400u) {
+            result = Run(*device, 0x00010400u);
+            if (result != 0) return result;
+        }
         std::cout << "rect-list corner tests passed\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ResidentHeapMirror.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ResidentHeapMirror.cpp
index 1ea57a498b..bf1cc2eae4 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ResidentHeapMirror.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ResidentHeapMirror.cpp
@@ -270,6 +270,45 @@ void CopiedTests(AgcDriver::VulkanDevice& device) {
     CheckStores(written, "copied, after a guest write");
 }
 
+struct ImportWindow {
+    explicit ImportWindow(std::uint64_t bytes) { AgcDriver::Graphics::SetHostImportRangeWindow(bytes); }
+    ~ImportWindow() { AgcDriver::Graphics::SetHostImportRangeWindow(std::uint64_t{64} << 20u); }
+    ImportWindow(const ImportWindow&) = delete;
+    ImportWindow& operator=(const ImportWindow&) = delete;
+};
+
+void PartialImportTests(AgcDriver::VulkanDevice& device, bool copied, bool readFirst) {
+    const AddressSpaceLimit limit(copied ? 1 : 0);
+    const ImportWindow window(2 * Block);
+    GuestHeap first(!readFirst);
+    GuestHeap second(readFirst);
+    const auto& read = readFirst ? first : second;
+    const auto& written = readFirst ? second : first;
+    const OutputBlock output;
+    const auto tail = HeapBytes - Block;
+    for (std::uint32_t thread = 0; thread * ThreadStride < Block; ++thread) read.Store(thread * ThreadStride, Pattern(thread));
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+        read.Store(tail + thread * sizeof(std::uint32_t), Pattern(thread));
+        written.Store(tail + thread * sizeof(std::uint32_t), Pattern(thread));
+    }
+    const ImportBudget budget(AgcDriver::Graphics::HostImportLiveBytes() + 3 * Block);
+    Dispatch(device, read, written, output);
+    CheckReads(output, "partial heap import", false);
+    const auto& selected = read.Address() < written.Address() ? read : written;
+    const auto* prefix = AgcDriver::Graphics::ExistingHostImportFor(device.graphicsContext(), selected.Address(), 2 * Block);
+    Require(prefix != nullptr && prefix->base == selected.Address() && prefix->bytes == 2 * Block, "partial heap import: the first registered heap has no exact two-block imported prefix");
+    const auto held = AgcDriver::Graphics::HeapMirrorsWithin(selected.Address(), selected.Address() + HeapBytes);
+    const auto expected = copied ? HeapBytes - prefix->bytes : (selected.Address() == read.Address() ? Block : 2 * Block);
+    Require(held.mirrors == 1 && held.bytes == expected, "partial heap import: its mirror holds " + std::to_string(held.bytes) + " bytes, expected " + std::to_string(expected));
+    Copy(device, selected.Address() + tail, output);
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) Require(output.Data()[thread] == Pattern(thread), "partial heap import: GPU read of the mirrored tail lost its contents");
+    selected.Store(tail + 2 * sizeof(std::uint32_t), 0x12345678u);
+    Copy(device, selected.Address() + tail, output);
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) Require(output.Data()[thread] == (thread == 2 ? 0x12345678u : Pattern(thread)), "partial heap import: refresh lost a CPU write or its unchanged neighbors");
+    const auto refreshed = AgcDriver::Graphics::HeapMirrorsWithin(selected.Address(), selected.Address() + HeapBytes);
+    Require(refreshed.mirrors == 1 && refreshed.bytes == expected, "partial heap import: refreshing the selected tail changed its accounted extent");
+}
+
 void ReusedAddressTests(AgcDriver::VulkanDevice& device) {
     GuestHeap written(true);
     const OutputBlock output;
@@ -342,6 +381,9 @@ int main() {
         ReusedAddressTests(*device);
         JoinedImportTests(*device);
         CopiedTests(*device);
+        for (const bool copied : {false, true}) {
+            for (const bool readFirst : {false, true}) PartialImportTests(*device, copied, readFirst);
+        }
         std::puts("resident heap mirror tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp
index abe81b5503..5870d759ac 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp
@@ -62,9 +62,13 @@ constexpr std::uint32_t Float16x4Info = 0x0730u;
 constexpr std::uint32_t MultisampledAttrib = (SampleShift << 12u) | (SampleShift << 15u);
 constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
 constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Uint16AbgrExport = 7;
 constexpr std::uint32_t Format16161616Float = 71;
 constexpr std::uint32_t Unorm8x4SwappedInfo = 0x8828u;
+constexpr std::uint32_t Uint8x4Info = 0x8428u;
 constexpr std::uint32_t Format8888Unorm = 56;
+constexpr std::uint32_t Format8888Uint = 60;
+constexpr std::uint32_t Format8888Sint = 61;
 constexpr std::uint32_t Type2DMsaa = 14;
 constexpr std::uint32_t TileRenderTarget = 0x1b;
 constexpr std::uint32_t TileZ64KBX = 0x18;
@@ -79,6 +83,7 @@ constexpr std::uint32_t FillOnes = 0x3c003c00u;
 constexpr std::array<float, 4> Ones{1.0f, 1.0f, 1.0f, 1.0f};
 constexpr std::array<float, 4> Written{0.75f, 0.25f, 0.5f, 1.0f};
 constexpr std::uint32_t StoredSample = 1;
+constexpr std::array<std::uint32_t, 4> PointMipSampler{0u, 0xfffu << 12u, 1u << 26u, 0u};
 
 alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
     0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
@@ -91,6 +96,12 @@ constexpr std::array<float, 4> DrawnUnorm8{64.0f / 255.0f, 128.0f / 255.0f, 32.0
 alignas(256) constexpr std::array<std::uint32_t, 11> Unorm8PixelCode{
     0x7e0802ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[0]), 0x7e0a02ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[1]), 0x7e0c02ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[2]), 0x7e0e02ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[3]), 0xf800180f, 0x07060504, 0xbf810000,
 };
+constexpr std::array<std::uint32_t, 4> DrawnUint8{0x12u, 0xbeu, 0x42u, 0x81u};
+alignas(256) constexpr std::array<std::uint32_t, 7> Uint8PixelCode{
+    0x7e0802ff, DrawnUint8[0] | (DrawnUint8[1] << 16u), 0x7e0a02ff, DrawnUint8[2] | (DrawnUint8[3] << 16u), 0xf8001c0f, 0x00000504, 0xbf810000,
+};
+constexpr std::uint32_t FilledSint8 = 0x81beff12u;
+constexpr std::array<std::uint32_t, 4> FilledSint8Texel{0x12u, 0xffffffffu, 0xffffffbeu, 0xffffff81u};
 
 alignas(256) constexpr std::array<std::uint32_t, 26> LoadCode{
     0x34020087, 0xe0301000, 0x80000201, 0xe0301004, 0x80000301, 0xe0301008, 0x80000401, 0xe030100c,
@@ -106,6 +117,15 @@ alignas(256) constexpr std::array<std::uint32_t, 26> ArrayLoadCode{
     0x80001301, 0xbf810000,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 44> PlaneCode{
+    0x34020087, 0xe0301000, 0x80000201, 0xe0301004, 0x80000301, 0xe0301008, 0x80000401, 0xe030100c,
+    0x80000501, 0xe0301010, 0x80000601, 0xbf8c3f70, 0xf0001f08, 0x00011005, 0xf09c0f08, 0x00611402,
+    0xf0900f08, 0x00611802, 0xbf8c3f70, 0xe0701030, 0x80001001, 0xe0701034, 0x80001101, 0xe0701038,
+    0x80001201, 0xe070103c, 0x80001301, 0xe0701040, 0x80001401, 0xe0701044, 0x80001501, 0xe0701048,
+    0x80001601, 0xe070104c, 0x80001701, 0xe0701050, 0x80001801, 0xe0701054, 0x80001901, 0xe0701058,
+    0x80001a01, 0xe070105c, 0x80001b01, 0xbf810000,
+};
+
 alignas(256) constexpr std::array<std::uint32_t, 19> StoreCode{
     0x34020087, 0xe030100c, 0x80000501, 0xe0301010, 0x80000601, 0xe0301014, 0x80000701, 0xe0301018,
     0x80001001, 0xe030101c, 0x80001101, 0xe0301020, 0x80001201, 0xe0301024, 0x80001301, 0xbf8c3f70,
@@ -210,6 +230,21 @@ AgcDriver::Graphics::ColorTarget DecodeSwappedTarget(const Block& block) {
     return color;
 }
 
+AgcDriver::Graphics::ColorTarget DecodeUintTarget(const Block& block) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Uint8x4Info;
+    cx[0x31d] = MultisampledAttrib;
+    cx[0x3b0] = ((Side - 1u) << 14u) | (Side - 1u);
+    cx[0x3b8] = TiledAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R8G8B8A8_UINT && color.samples == Samples && color.extent.width == Side && color.extent.height == Side, "the 8_8_8_8_UINT target did not decode as a 16x16 RGBA8 UINT surface of 4 samples");
+    color.uintExport = true;
+    return color;
+}
+
 void CheckSwappedSamples(const std::vector<std::array<float, 4>>& loaded) {
     const std::array<float, 4> swapped{DrawnUnorm8[2], DrawnUnorm8[1], DrawnUnorm8[0], DrawnUnorm8[3]};
     const auto codes = [](const std::array<float, 4>& texel) {
@@ -229,6 +264,19 @@ void CheckSwappedSamples(const std::vector<std::array<float, 4>>& loaded) {
     Require(drawn != 0, "no sample of the BGRA8 target holds the drawn color");
 }
 
+void CheckUintSamples(const std::vector<std::array<float, 4>>& loaded) {
+    std::size_t drawn = 0;
+    for (const auto& texel : loaded) {
+        const auto words = std::bit_cast<std::array<std::uint32_t, 4>>(texel);
+        if (words == std::array<std::uint32_t, 4>{}) continue;
+        char text[128];
+        std::snprintf(text, sizeof(text), "a sample of the 8_8_8_8_UINT target reads %08x %08x %08x %08x instead of the drawn color", words[0], words[1], words[2], words[3]);
+        Require(words == DrawnUint8, text);
+        ++drawn;
+    }
+    Require(drawn != 0, "no sample of the 8_8_8_8_UINT target holds the drawn color");
+}
+
 AgcDriver::Graphics::State TargetState(const AgcDriver::Graphics::ColorTarget& color) {
     VkPipelineColorBlendAttachmentState blend{};
     blend.colorWriteMask = 0xf;
@@ -269,7 +317,7 @@ void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::State& sta
     const auto vertexResult = ShaderRecompiler::Recompile(vertex);
     const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
     const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
-    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, Float32Export}};
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, state.color.uintExport ? Uint16AbgrExport : Float32Export}};
     const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
     ShaderRecompiler::RecompileRequest fragment{
         {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
@@ -307,12 +355,13 @@ std::array<std::uint32_t, 8> TargetDescriptor(const Block& block, std::uint32_t
     };
 }
 
-ShaderRecompiler::RecompileResult CompileProgram(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::array<std::uint32_t, 8>& texture, std::vector<std::uint32_t>& userData) {
+ShaderRecompiler::RecompileResult CompileProgram(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::array<std::uint32_t, 8>& texture, std::vector<std::uint32_t>& userData, const std::array<std::uint32_t, 4>& sampler = {}) {
     const auto address = reinterpret_cast<std::uintptr_t>(Buffer.data());
     const std::array<std::uint32_t, 4> buffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), static_cast<std::uint32_t>(Buffer.size() * 4u), 0x31016facu};
     userData.assign(16, 0u);
     std::copy(buffer.begin(), buffer.end(), userData.begin());
     std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    std::copy(sampler.begin(), sampler.end(), userData.begin() + 12);
     const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
     const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
     ShaderRecompiler::RecompileRequest request{
@@ -417,6 +466,37 @@ std::vector<std::array<float, 4>> LoadSamples(AgcDriver::VulkanDevice& device, c
     return LoadSamples(device, TargetDescriptor(block, SampleShift, format, tileMode));
 }
 
+void CheckFirstSampleReads(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture, const std::vector<std::array<float, 4>>& samples, bool distinct, const std::string& what) {
+    std::vector<std::uint32_t> userData;
+    const auto program = CompileProgram(device, PlaneCode, texture, userData, PointMipSampler);
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(PlaneCode.data());
+    const auto bits = [&](std::size_t index) { return std::bit_cast<std::array<std::uint32_t, 4>>(samples[index]); };
+    bool differs = false;
+    for (std::uint32_t first = 0; first < Side * Side; first += Threads) {
+        Buffer.fill(0xdeadbeefu);
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            const auto pixel = first + tid;
+            const std::array<std::uint32_t, 5> words{std::bit_cast<std::uint32_t>((pixel % Side + 0.5f) / Side), std::bit_cast<std::uint32_t>((pixel / Side + 0.5f) / Side), std::bit_cast<std::uint32_t>(1.0f), pixel % Side, pixel / Side};
+            std::copy(words.begin(), words.end(), &Buffer[tid * Words]);
+        }
+        device.Dispatch(program, 1, 1, 1, {}, codeAddress);
+        device.WaitIdle();
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            const auto pixel = first + tid;
+            const auto sampleZero = bits(pixel * Samples);
+            for (std::uint32_t sample = 1; sample < Samples; ++sample) differs = differs || bits(pixel * Samples + sample) != sampleZero;
+            for (std::uint32_t read = 0; read < 3u; ++read) {
+                std::array<std::uint32_t, 4> texel{};
+                std::copy_n(&Buffer[tid * Words + LoadResult + read * 4u], texel.size(), texel.begin());
+                char where[200];
+                std::snprintf(where, sizeof(where), "%s of pixel (%u, %u) read %08x %08x %08x %08x, sample 0 is %08x %08x %08x %08x", read == 0u ? "a DIM 2D image_load" : read == 1u ? "a DIM 2D image_sample_lz" : "a DIM 2D image_sample_l at LOD 1", pixel % Side, pixel / Side, texel[0], texel[1], texel[2], texel[3], sampleZero[0], sampleZero[1], sampleZero[2], sampleZero[3]);
+                Require(texel == sampleZero, std::string(where) + " " + what);
+            }
+        }
+    }
+    Require(!distinct || differs, "no pixel's sample 0 differs from its other samples " + what);
+}
+
 std::array<std::uint32_t, 8> CompressedDescriptor(const Block& block, std::uint32_t tileMode, std::uint64_t htile) {
     auto texture = TargetDescriptor(block, SampleShift, Format16161616Float, tileMode);
     const auto meta = htile >> 8u;
@@ -885,12 +965,46 @@ int main(int argc, char** argv) {
         Block other(BlockBytes);
         const auto color = DecodeTarget(block);
         const auto state = TargetState(color);
+        Draw(*device, state);
+        const auto drawn = LoadSamples(*device, block);
+        CheckSamples(state, drawn, {});
+        CheckFirstSampleReads(*device, TargetDescriptor(block, SampleShift), drawn, true, "from the drawn 4x target");
+        Draw(*device, state, 0, 2u, Unorm8PixelCode);
+        const auto redrawn = LoadSamples(*device, block);
+        Require(redrawn != drawn, "drawing the 4x target again with another color left its samples unchanged");
+        CheckFirstSampleReads(*device, TargetDescriptor(block, SampleShift), redrawn, true, "from the 4x target drawn again with another color after a first read");
+        Block zeroed(BlockBytes);
+        CheckFirstSampleReads(*device, TargetDescriptor(zeroed, SampleShift), std::vector<std::array<float, 4>>(Side * Side * Samples), false, "from zeroed color memory no draw rendered to");
+        Block aliased(4u * BlockBytes);
+        Draw(*device, TargetState(DecodeSwappedTarget(aliased)), 0, 2u, Unorm8PixelCode);
+        Draw(*device, TargetState(DecodeTarget(aliased)));
+        const auto aliasedSamples = LoadSamples(*device, aliased);
+        CheckSamples(state, aliasedSamples, {});
+        CheckFirstSampleReads(*device, TargetDescriptor(aliased, SampleShift), aliasedSamples, true, "from a 4x RGBA16F target drawn after a BGRA8 target at the same address");
+        std::puts("DIM 2D image_load, image_sample_lz and image_sample_l reads of a 4x color target return each pixel's sample 0");
+        Block swapped(4u * BlockBytes);
+        Draw(*device, TargetState(DecodeSwappedTarget(swapped)), 0, 2u, Unorm8PixelCode);
+        const auto swappedSamples = LoadSamples(*device, swapped, Format8888Unorm);
+        CheckSwappedSamples(swappedSamples);
+        CheckFirstSampleReads(*device, TargetDescriptor(swapped, SampleShift, Format8888Unorm), swappedSamples, true, "from a 4x BGRA8 target read through an RGBA8 descriptor");
+        std::puts("a 4x BGRA8 color target loaded through an RGBA8 texture descriptor reads its drawn color with red and blue swapped");
+        Block integer(4u * BlockBytes);
+        Block signedFill(BlockBytes);
+        if ((AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).limits.sampledImageIntegerSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0) {
+            std::puts("DIM 2D reads of 4x 8_8_8_8_UINT and 8_8_8_8_SINT targets not tested: sampledImageIntegerSampleCounts lacks VK_SAMPLE_COUNT_4_BIT");
+        } else {
+            Draw(*device, TargetState(DecodeUintTarget(integer)), 0, 2u, Uint8PixelCode);
+            const auto integerSamples = LoadSamples(*device, integer, Format8888Uint);
+            CheckUintSamples(integerSamples);
+            CheckFirstSampleReads(*device, TargetDescriptor(integer, SampleShift, Format8888Uint), integerSamples, true, "from a drawn 4x 8_8_8_8_UINT target");
+            StoreWords(signedFill, BlockBytes, FilledSint8);
+            CheckFirstSampleReads(*device, TargetDescriptor(signedFill, SampleShift, Format8888Sint), std::vector<std::array<float, 4>>(Side * Side * Samples, std::bit_cast<std::array<float, 4>>(FilledSint8Texel)), false, "from 8_8_8_8_SINT color memory no draw rendered to");
+            std::puts("DIM 2D reads of a drawn 4x 8_8_8_8_UINT target and of 8_8_8_8_SINT color memory no draw rendered to return each pixel's sample 0 bit for bit");
+        }
         if (!AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).storageImageMultisample) {
-            std::puts("multisampled target sampling not tested: storage image multisampling unavailable");
+            std::puts("multisampled target fills, stores and swizzle modes not tested: storage image multisampling unavailable");
             return VulkanTestSkipped;
         }
-        Draw(*device, state);
-        CheckSamples(state, LoadSamples(*device, block), {});
         const auto colorBytes = AgcDriver::Graphics::MultisampledColorBytes(color);
         Require(colorBytes != 0 && colorBytes <= block.bytes, "the 4x target's color memory does not fit its block");
         AgcDriver::Graphics::NoteColorMetadataFill(block.Address(), static_cast<std::size_t>(colorBytes), FillOnes);
@@ -901,6 +1015,20 @@ int main(int argc, char** argv) {
         Block stored(BlockBytes);
         StoreWords(stored, colorBytes, FillOnes);
         CheckUniform(LoadSamples(*device, stored), Ones, "from color memory of half-float ones no draw rendered to");
+        Block reused(BlockBytes);
+        StoreWords(reused, colorBytes, FillOnes);
+        CheckUniform(LoadSamples(*device, reused), Ones, "from color memory of half-float ones no draw rendered to, before the title reuses it");
+        AgcDriver::Graphics::RequireNoMultisampleColorTarget(reused.Address(), static_cast<std::size_t>(colorBytes / 2u), "a storage image access");
+        StoreWords(reused, colorBytes, 0u);
+        CheckUniform(LoadSamples(*device, reused), {}, "from color memory no draw rendered to after the title reused it for zeros");
+        std::string drawnRefusal;
+        try {
+            AgcDriver::Graphics::RequireNoMultisampleColorTarget(block.Address(), static_cast<std::size_t>(colorBytes / 2u), "a storage image access");
+        } catch (const std::exception& error) {
+            drawnRefusal = error.what();
+        }
+        Require(drawnRefusal.find("whose samples are only on the host") != std::string::npos, "a guest access over a drawn 4x target is not refused");
+        std::puts("a guest access over a 4x texture no draw rendered to retires it, so a later load reads the memory's new value, and a guest access over a drawn target is still refused");
         const auto storedState = TargetState(DecodeTarget(stored));
         Draw(*device, storedState);
         CheckSamples(storedState, LoadSamples(*device, stored), Ones);
@@ -917,6 +1045,23 @@ int main(int argc, char** argv) {
         Block undrawn(BlockBytes);
         StoreSamples(*device, TargetDescriptor(undrawn, SampleShift), SampleWrites(leftHalf));
         CheckWritten(std::vector<std::array<float, 4>>(Side * Side * Samples), LoadSamples(*device, undrawn), leftHalf, "into zeroed color memory no draw rendered to");
+        const auto refusedOver = [&](const Block& over) {
+            try {
+                AgcDriver::Graphics::RequireNoMultisampleColorTarget(over.Address(), static_cast<std::size_t>(colorBytes / 2u), "a storage image access");
+            } catch (const std::exception& error) {
+                return std::string(error.what()).find("whose samples are only on the host") != std::string::npos;
+            }
+            return false;
+        };
+        Require(refusedOver(undrawn), "a guest access over a 4x texture no draw rendered to but a dispatch wrote is not refused");
+        Block absorbing(BlockBytes);
+        StoreWords(absorbing, colorBytes, FillOnes);
+        CheckUniform(LoadSamples(*device, absorbing), Ones, "from color memory of half-float ones no draw rendered to, before a fill the texture absorbs");
+        Require(AgcDriver::Graphics::MultisampledColorFillAbsorbs(absorbing.Address(), static_cast<std::size_t>(colorBytes), 0u), "a fill of 0 over the whole color memory of a 4x texture no draw rendered to is not absorbed");
+        AgcDriver::Graphics::NoteColorMetadataFill(absorbing.Address(), static_cast<std::size_t>(colorBytes), 0u);
+        Require(refusedOver(absorbing), "a guest access over a 4x texture no draw rendered to that absorbed a fill is not refused");
+        CheckUniform(LoadSamples(*device, absorbing), {}, "from a 4x texture no draw rendered to after it absorbed a fill of 0");
+        std::puts("a guest access over a 4x texture no draw rendered to is still refused once a dispatch wrote it or it absorbed a fill");
         Block mixedStore(BlockBytes);
         StoreWords(mixedStore, colorBytes, FillOnes);
         std::memcpy(mixedStore.data + colorBytes - sizeof(odd), &odd, sizeof(odd));
@@ -953,10 +1098,6 @@ int main(int argc, char** argv) {
         StoreWords(standard, colorBytes, FillOnes);
         RequireRefused(*device, TargetDescriptor(standard, SampleShift, Format16161616Float, TileS64KBX), "has no modeled multisampled color footprint", "loading an S swizzle multisampled texture no draw rendered to");
         std::puts("every sample of a 4x color target loaded through its multisampled texture descriptor matches the triangle drawn into it, then the fill of its color memory; a surface no draw rendered to loads the value its color memory repeats and keeps it under a later draw");
-        Block swapped(4u * BlockBytes);
-        Draw(*device, TargetState(DecodeSwappedTarget(swapped)), 0, 2u, Unorm8PixelCode);
-        CheckSwappedSamples(LoadSamples(*device, swapped, Format8888Unorm));
-        std::puts("a 4x BGRA8 color target loaded through an RGBA8 texture descriptor reads its drawn color with red and blue swapped");
         Block destination(BlockBytes);
         struct ReleaseIndexDevice {
             std::unique_ptr<AgcDriver::VulkanDevice>& device;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp
index 9e534056ab..ba9346b3e7 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp
@@ -1122,6 +1122,22 @@ Samples ReadTarget(const Context& context, VkImageView view, bool color, std::ui
     return ReadValues(values, count);
 }
 
+Samples ReadDepth(const Context& context, const AgcDriver::Graphics::DepthTarget& depth, std::uint32_t samples) {
+    const auto target = AgcDriver::Graphics::DepthSurfaceOrderTarget(context, depth);
+    const VkImageAspectFlags aspects = VK_IMAGE_ASPECT_DEPTH_BIT | (AgcDriver::Graphics::HasStencil(target.format) ? VK_IMAGE_ASPECT_STENCIL_BIT : 0u);
+    Image copy(context, target.format, samples, ReferenceExtent, DepthUsage, 0u);
+    VkImageCopy region{};
+    region.srcSubresource = {VK_IMAGE_ASPECT_DEPTH_BIT, 0u, 0u, 1u};
+    region.dstSubresource = region.srcSubresource;
+    region.extent = {ReferenceExtent.width, ReferenceExtent.height, 1u};
+    Submit(context, [&](VkCommandBuffer commands) {
+        copy.ToGeneral(commands, aspects);
+        FullBarrier(context, commands);
+        context.Function<PFN_vkCmdCopyImage>("vkCmdCopyImage")(commands, target.image, VK_IMAGE_LAYOUT_GENERAL, copy.Handle(), VK_IMAGE_LAYOUT_GENERAL, 1u, &region);
+    });
+    return ReadTarget(context, copy.View(target.format, VK_IMAGE_ASPECT_DEPTH_BIT, VK_IMAGE_USAGE_SAMPLED_BIT), false, samples);
+}
+
 Rendered RenderCheckerboard(AgcDriver::VulkanDevice& device, const Context& context, std::uint32_t samples, std::size_t run, const std::optional<std::array<std::uint8_t, 32>>& locations) {
     AgcDriver::Graphics::ColorTarget color{};
     color.extent = ReferenceExtent;
@@ -1169,7 +1185,7 @@ Rendered RenderCheckerboard(AgcDriver::VulkanDevice& device, const Context& cont
     Settle(device);
     Rendered rendered;
     rendered.color = ReadTarget(context, AgcDriver::Graphics::MultisampleTargetView(context, color), true, samples);
-    rendered.depth = ReadTarget(context, AgcDriver::Graphics::DepthSurfaceOrderTarget(context, depth).view, false, samples);
+    rendered.depth = ReadDepth(context, depth, samples);
     return rendered;
 }
 
@@ -1348,7 +1364,7 @@ void CheckRecipeDepth(AgcDriver::VulkanDevice& device, const Context& context, c
         std::printf("%s: builds no recipe, since a draw that reorders its samples is built in full each time, with its sample swaps\n", what.c_str());
         return;
     }
-    const auto read = [&] { return ReadTarget(context, AgcDriver::Graphics::DepthSurfaceOrderTarget(context, depth).view, false, samples); };
+    const auto read = [&] { return ReadDepth(context, depth, samples); };
     Samples recorded;
     slopes.beforeReplay = [&] {
         Settle(device);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp
index 46e3184ea6..6cfb074620 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp
@@ -1,10 +1,12 @@
 #include "prx/libSceAgcDriver/Execution/include/BdaFeatures.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureCache.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PlaceholderImages.hpp"
@@ -281,38 +283,38 @@ private:
 
 class WatchedSurface {
 public:
-    explicit WatchedSurface(const Context& context) : context(context) {
+    explicit WatchedSurface(const Context& context, std::size_t bytes = SurfaceBytes) : context(context), span(bytes) {
 #ifdef _WIN32
-        memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(SurfaceBytes, 65536));
-        if (memory != nullptr) GuestArena::GuestArenaCommit_nid_postfix(memory, SurfaceBytes, PAGE_READWRITE, SurfaceBytes);
+        memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, 65536));
+        if (memory != nullptr) GuestArena::GuestArenaCommit_nid_postfix(memory, bytes, PAGE_READWRITE, bytes);
 #else
         constexpr std::uintptr_t alignment = 65536;
-        void* mapped = mmap(nullptr, SurfaceBytes + alignment, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        void* mapped = mmap(nullptr, bytes + alignment, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
         if (mapped != MAP_FAILED) {
             const auto begin = reinterpret_cast<std::uintptr_t>(mapped);
             const auto aligned = (begin + alignment - 1) & ~(alignment - 1);
             if (aligned != begin) munmap(mapped, aligned - begin);
-            if (aligned + SurfaceBytes != begin + SurfaceBytes + alignment) munmap(reinterpret_cast<void*>(aligned + SurfaceBytes), begin + alignment - aligned);
+            if (aligned + bytes != begin + bytes + alignment) munmap(reinterpret_cast<void*>(aligned + bytes), begin + alignment - aligned);
             memory = reinterpret_cast<std::uint8_t*>(aligned);
-            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(memory, SurfaceBytes);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(memory, bytes);
         }
 #endif
         Require(memory != nullptr, "cannot allocate the watched surface");
-        Require(AgcDriver::GuestMemory::Watched(Address(), SurfaceBytes), "the watched surface is not write-watched");
-        std::memset(memory, 0x5a, SurfaceBytes);
-        GuestAllocations::Mutation().Add(memory, SurfaceBytes, true, true, true);
-        AgcDriver::GuestMemory::CollectWritesUncached(Address(), SurfaceBytes);
+        Require(AgcDriver::GuestMemory::Watched(Address(), bytes), "the watched surface is not write-watched");
+        std::memset(memory, 0x5a, bytes);
+        GuestAllocations::Mutation().Add(memory, bytes, true, true, true);
+        AgcDriver::GuestMemory::CollectWritesUncached(Address(), bytes);
     }
 
     ~WatchedSurface() {
         ClearCachedTextures(context.device);
         GuestAllocations::Mutation().Remove(memory);
 #ifdef _WIN32
-        GuestArena::GuestArenaReset_nid_postfix(memory, SurfaceBytes);
-        GuestArena::GuestArenaRelease_nid_postfix(memory, SurfaceBytes);
+        GuestArena::GuestArenaReset_nid_postfix(memory, span);
+        GuestArena::GuestArenaRelease_nid_postfix(memory, span);
 #else
-        munmap(memory, SurfaceBytes);
-        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(memory, SurfaceBytes);
+        munmap(memory, span);
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(memory, span);
 #endif
     }
 
@@ -323,13 +325,14 @@ public:
 
 private:
     const Context& context;
+    std::size_t span = 0;
     std::uint8_t* memory = nullptr;
 };
 
-std::array<std::uint32_t, 8> Descriptor(std::uint64_t address, std::uint32_t side = Side) {
+std::array<std::uint32_t, 8> Descriptor(std::uint64_t address, std::uint32_t side = Side, std::uint32_t format = Format32UInt) {
     return {
         static_cast<std::uint32_t>(address >> 8u),
-        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32UInt << 20u) | (((side - 1u) & 3u) << 30u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (format << 20u) | (((side - 1u) & 3u) << 30u),
         ((side - 1u) >> 2u) | ((side - 1u) << 14u),
         0xfacu | (TileR64KBX << 20u) | (Type2D << 28u),
         0u,
@@ -339,13 +342,13 @@ std::array<std::uint32_t, 8> Descriptor(std::uint64_t address, std::uint32_t sid
     };
 }
 
-std::shared_ptr<Texture> Sampled(const Context& context, std::uint64_t address, std::uint32_t side = Side) {
-    const auto words = Descriptor(address, side);
+std::shared_ptr<Texture> Sampled(const Context& context, std::uint64_t address, std::uint32_t side = Side, std::uint32_t format = Format32UInt) {
+    const auto words = Descriptor(address, side, format);
     return CachedSampledTexture(context, words);
 }
 
-GuestTextureResource Resource(std::uint64_t address, std::uint32_t side = Side) {
-    const auto words = Descriptor(address, side);
+GuestTextureResource Resource(std::uint64_t address, std::uint32_t side = Side, std::uint32_t format = Format32UInt) {
+    const auto words = Descriptor(address, side, format);
     return DecodeTextureResource(words);
 }
 
@@ -672,6 +675,55 @@ void snapshotTests(const Context& context) {
     Require(TextureCacheUsage().sampledBytes == tiny->AllocationBytes(), "a snapshot whose " + std::to_string(tiny->AllocationBytes()) + "-byte image is smaller than its " + std::to_string(guestBytes) + " guest bytes counted " + std::to_string(TextureCacheUsage().sampledBytes) + " bytes, not its allocation");
 }
 
+void recycleTests(const Context& context) {
+    Block block(context);
+    ClearCachedTextures(context.device);
+    const auto address = block.Surface(0);
+    std::memset(reinterpret_cast<void*>(address), 0xa1, SurfaceBytes);
+    const auto first = Sampled(context, address);
+    Require(Sampled(context, address) == first, "an unchanged surface did not serve its snapshot");
+    std::memset(reinterpret_cast<void*>(address), 0xb2, SurfaceBytes);
+    const auto second = Sampled(context, address);
+    Require(second != first, "a changed surface did not replace its snapshot");
+    std::memset(reinterpret_cast<void*>(address), 0xa1, SurfaceBytes);
+    const auto third = Sampled(context, address);
+    Require(third != second, "the replaced snapshot's size-equal buffer was not reread from guest memory");
+    Require(Sampled(context, address) == third, "an unchanged surface did not serve its remade snapshot");
+    constexpr std::uint32_t BigSide = Side * 2;
+    constexpr std::size_t BigBytes = std::size_t{BigSide} * BigSide * 4u;
+    const WatchedSurface watchedFirst(context, BigBytes);
+    const WatchedSurface watchedSecond(context, BigBytes);
+    const auto bigFirst = Sampled(context, watchedFirst.Address(), BigSide);
+    Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the first big snapshot did not park its dropped " + std::to_string(BigBytes) + "-byte buffer in the spare pool");
+    const auto bigSecond = Sampled(context, watchedSecond.Address(), BigSide);
+    Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the second big snapshot did not take the parked spare of its size");
+}
+
+void spareAgeTests(const Context& context) {
+    Block block(context);
+    ClearCachedTextures(context.device);
+    constexpr std::uint32_t BigSide = Side * 2;
+    constexpr std::size_t BigBytes = std::size_t{BigSide} * BigSide * 4u;
+    {
+        const WatchedSurface watched(context, BigBytes);
+        const auto first = Sampled(context, watched.Address(), BigSide);
+        Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the big snapshot did not park its dropped buffer in the spare pool");
+        for (std::uint64_t present = 0; present <= SpareSnapshotPresents; ++present) Recorder::CountPresent();
+        const auto small = Sampled(context, block.Surface(0));
+        Require(TextureCacheUsage().spareEntries == 0 && TextureCacheUsage().spareBytes == 0, "a spare idle for " + std::to_string(SpareSnapshotPresents + 1u) + " presents was not released");
+    }
+    ClearCachedTextures(context.device);
+    {
+        const WatchedSurface watchedFirst(context, BigBytes);
+        const WatchedSurface watchedSecond(context, BigBytes);
+        const auto second = Sampled(context, watchedFirst.Address(), BigSide);
+        Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the second big snapshot did not park its dropped buffer in the spare pool");
+        for (std::uint64_t present = 0; present < SpareSnapshotPresents; ++present) Recorder::CountPresent();
+        const auto third = Sampled(context, watchedSecond.Address(), BigSide);
+        Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "a spare taken within " + std::to_string(SpareSnapshotPresents) + " presents was released instead of reused");
+    }
+}
+
 void heldTests(const Context& context) {
     Block block(context);
     auto held = Sampled(context, block.Surface(0));
@@ -952,7 +1004,7 @@ std::uint64_t ExpectedBudget(const Context& context) {
     VkPhysicalDeviceMemoryBudgetPropertiesEXT reported{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
     VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2, &reported};
     ReportBudget(context.physical, &properties);
-    return SampledTextureBudget(context.memory, &reported, SampledTextureMemory() + TextureCacheUsage().storageBytes);
+    return SampledTextureBudget(context.memory, &reported, SampledTextureMemory() + TextureCacheUsage().storageBytes, TextureCacheUsage().storageBytes);
 }
 
 std::uint64_t ReadBudget(const Context& context) {
@@ -997,8 +1049,10 @@ void storageMemoryTests(Context context) {
     context.memoryProperties2 = &ReportBudget;
     Block block(context);
     auto held = Sampled(context, block.Surface(0));
-    const auto quarter = std::min<std::uint64_t>(StorageTextureBudget(context.memory, nullptr, 0, 0), ReportedBudget / 4u);
-    Require(ReadStorageBudget(context) == quarter, "52 GiB free of a 64 GiB budget does not leave the storage image cache its quarter");
+    const auto heap = LargestDeviceLocalHeap(context.memory);
+    Require(heap.has_value(), "the device has no device-local heap");
+    const auto half = std::min<std::uint64_t>(context.memory.memoryHeaps[*heap].size / 2u, ReportedBudget / 2u);
+    Require(ReadStorageBudget(context) == half, "52 GiB free of a 64 GiB budget does not leave the storage image cache half of the heap or of the budget");
     context.memoryProperties2 = &ReportPressure;
     const auto pressed = ReadStorageBudget(context);
     const auto expected = GiB + TextureCacheUsage().storageBytes;
@@ -1006,6 +1060,116 @@ void storageMemoryTests(Context context) {
     std::printf("reported heap budget %llu MiB with %llu MiB in use: storage image cache budget %llu MiB\n", static_cast<unsigned long long>(ReportedBudget >> 20u), static_cast<unsigned long long>(PressedUsage >> 20u), static_cast<unsigned long long>(pressed >> 20u));
 }
 
+struct RecoveryProbe {
+    PFN_vkGetDeviceProcAddr deviceProc = nullptr;
+    std::uint64_t released = 0;
+    unsigned requests = 0;
+    unsigned failures = 0;
+    bool pressure = false;
+};
+
+RecoveryProbe recovery;
+
+VkDeviceSize ReclaimForTest(VkDeviceSize bytes, bool newImage) {
+    Require(newImage, "an image allocation did not identify itself to the recovery callback");
+    ++recovery.requests;
+    Require(ReleaseTextureCaches(bytes, false) == 0, "a buffer allocation was allowed to reclaim the cache held by image creation");
+    const auto released = ReleaseTextureCaches(bytes, newImage);
+    recovery.released += released;
+    return released;
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL AllocateForTest(VkDevice device, const VkMemoryAllocateInfo* info, const VkAllocationCallbacks* allocator, VkDeviceMemory* memory) {
+    if (recovery.pressure && recovery.released == 0) {
+        ++recovery.failures;
+        return VK_ERROR_OUT_OF_DEVICE_MEMORY;
+    }
+    return reinterpret_cast<PFN_vkAllocateMemory>(recovery.deviceProc(device, "vkAllocateMemory"))(device, info, allocator, memory);
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL RecoveryProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkAllocateMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(AllocateForTest);
+    return recovery.deviceProc(device, name);
+}
+
+void recoveryTests(Context context, const std::string& mode) {
+    recovery = RecoveryProbe{};
+    recovery.deviceProc = context.deviceProc;
+    context.deviceProc = RecoveryProc;
+    context.cacheReclaim = ReclaimForTest;
+    context.bufferPool.reset();
+    Block block(context);
+    const bool storage = mode == "recover-storage";
+    if (storage) {
+        auto oldest = CachedStorageSurface(context, Resource(block.Surface(0)));
+        const auto allocated = oldest->AllocationBytes();
+        std::weak_ptr<StorageTexture> released = oldest;
+        oldest.reset();
+        auto pending = CachedStorageSurface(context, Resource(block.Surface(1)));
+        pending->MarkDirty();
+        recovery.pressure = true;
+        auto made = CachedStorageSurface(context, Resource(block.Surface(2)));
+        recovery.pressure = false;
+        Require(made != nullptr && released.expired(), "storage allocation recovery did not release its own oldest clean image");
+        Require(pending->Dirty() && StorageImageCached(context, pending.get()), "storage allocation recovery changed an image with pending results");
+        Require(recovery.released == allocated, "storage allocation recovery counted memory still held by its caller");
+        pending->Flush();
+        Require(!pending->Dirty(), "pending storage results could not be stored after memory recovery");
+    } else if (mode == "recover-sampled") {
+        auto oldest = Sampled(context, block.Surface(0));
+        Require(!oldest->ViewsStorageImage(), "the sampled recovery fixture needs a snapshot allocation");
+        const auto allocated = oldest->AllocationBytes();
+        std::weak_ptr<Texture> released = oldest;
+        oldest.reset();
+        auto held = Sampled(context, block.Surface(1));
+        recovery.pressure = true;
+        auto made = Sampled(context, block.Surface(2));
+        recovery.pressure = false;
+        Require(made != nullptr && released.expired(), "sampled allocation recovery did not release its own oldest unused texture");
+        Require(Sampled(context, block.Surface(1)) == held, "sampled allocation recovery removed a texture still held by its caller");
+        Require(recovery.released == allocated, "sampled allocation recovery counted memory still held by its caller");
+    } else {
+        const bool srgb = mode == "recover-srgb";
+        if (srgb) {
+            context.srgbDecodeFormats = SrgbDecodeFormats(context.formatProperties, context.physical);
+            context.srgbCopyFormats = SrgbCopyFormats(context.formatProperties, context.physical, context.srgbDecodeFormats);
+            Require(SrgbExpandsToRgba8(context, 128u), "the device cannot serve the sRGB expansion copy fixture");
+        }
+        auto oldest = Sampled(context, block.Surface(0));
+        Require(!oldest->ViewsStorageImage(), "the sampled recovery fixture needs a snapshot allocation");
+        const auto allocated = oldest->AllocationBytes();
+        std::weak_ptr<Texture> released = oldest;
+        oldest.reset();
+        auto held = Sampled(context, block.Surface(1));
+        const auto side = srgb ? 1024u : 512u;
+        const auto format = srgb ? 128u : 43u;
+        const auto sourceWords = Descriptor(block.Surface(4), side, format);
+        const auto sourceResource = DecodeTextureResource(sourceWords);
+        auto source = CachedStorageSurface(context, sourceResource);
+        source->MarkDirty();
+        if (srgb) {
+            Require(Texture::CanSrgbExpandFrom(context, *source, sourceResource), "the storage surface cannot serve an sRGB expansion copy");
+        } else {
+            Require(Texture::CanRepackCopyFrom(*source, sourceResource), "the storage surface cannot serve a repacked copy");
+        }
+        recovery.pressure = true;
+        auto made = CachedSampledTexture(context, sourceWords);
+        recovery.pressure = false;
+        Require(made != nullptr && made->SharedStorageSource() == source, "sampled copy allocation recovery did not serve the pending storage image");
+        Require(released.expired(), "sampled copy allocation recovery did not release its own oldest unused texture");
+        Require(source->Dirty() && StorageImageCached(context, source.get()), "sampled copy allocation recovery changed or evicted an image with pending results");
+        Require(!held->Released() && held.use_count() == 2, "sampled copy allocation recovery removed a texture still held by its caller");
+        const auto refreshed = Sampled(context, block.Surface(1));
+        Require(refreshed != nullptr && (refreshed == held || refreshed->ViewsStorageImage()), "sampled copy cache refresh did not serve the surface");
+        Require(recovery.released == allocated, "sampled copy allocation recovery counted memory still held by its caller");
+        source->Flush();
+        Require(!source->Dirty(), "pending storage results could not be stored after memory recovery");
+    }
+    Require(recovery.requests == 1 && recovery.failures >= 1 && recovery.failures <= 2, "image allocation recovery was skipped or retried without a bound");
+    const char* label = storage ? "storage" : mode == "recover-srgb" ? "sRGB" : mode == "recover-repack" ? "repacked" : "sampled";
+    std::printf("%s image allocation recovered after %u injected failures: %llu bytes released\n", label, recovery.failures, static_cast<unsigned long long>(recovery.released));
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -1018,11 +1182,12 @@ int main(int argc, char** argv) {
         }
         const bool resources = mode == "resource-admission" || mode == "resource-oversized" || mode == "resource-clear";
         const bool disableStorageImageMultisample = mode == "without-storage-image-multisample";
+        const bool recover = mode == "recover-sampled" || mode == "recover-storage" || mode == "recover-srgb" || mode == "recover-repack";
 #ifdef _WIN32
-        if (!memory) _putenv_s("APS5_TEXTURE_CACHE_MIB", "1");
+        if (!memory) _putenv_s("APS5_TEXTURE_CACHE_MIB", recover ? "16" : "1");
         if (std::getenv("APS5_TEMPLATE_AUDIT_MS") == nullptr) _putenv_s("APS5_TEMPLATE_AUDIT_MS", "250");
 #else
-        if (!memory) setenv("APS5_TEXTURE_CACHE_MIB", "1", 1);
+        if (!memory) setenv("APS5_TEXTURE_CACHE_MIB", recover ? "16" : "1", 1);
         setenv("APS5_TEMPLATE_AUDIT_MS", "250", 0);
 #endif
         std::unique_ptr<Device> device;
@@ -1082,10 +1247,16 @@ int main(int argc, char** argv) {
             std::puts("sampled texture memory budget tests passed");
             return 0;
         }
+        if (recover) {
+            std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+            recoveryTests(context, mode);
+            return 0;
+        }
         {
             std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
             reportedBudgetTests(context);
             snapshotTests(context);
+            recycleTests(context);
             heldTests(context);
             releasedTests(context);
             rescanTests(context);
@@ -1097,6 +1268,7 @@ int main(int argc, char** argv) {
             secondUseTests(context);
             earlyMissTests(context);
             collidingKeyTests(context);
+            spareAgeTests(context);
             ClearCachedTextures(context.device);
         }
         std::puts("sampled texture cache budget tests passed");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SdwaCvtF32Ubyte.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SdwaCvtF32Ubyte.cpp
index 4468d5d220..dac88be437 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SdwaCvtF32Ubyte.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SdwaCvtF32Ubyte.cpp
@@ -17,20 +17,50 @@ using ShaderRecompiler::ShaderStage;
 constexpr std::uint32_t Threads = 64;
 constexpr std::uint32_t Inputs = 4;
 constexpr std::uint32_t Results = 4;
+constexpr std::uint32_t Selectors = 7;
 alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
 alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
 
-alignas(256) constexpr std::array<std::uint32_t, 30> SdwaCode{
+constexpr std::array<std::uint32_t, Results> ModifierWords{14, 16, 18, 20};
+
+alignas(256) std::array<std::uint32_t, 30> SdwaCode{
     0x34020082, 0x34060082, 0xe0302000, 0x80000401,
     0x7e1402ff, 0xabcd1234, 0x7e1602ff, 0xabcd1234, 0x7e1802ff, 0xabcd1234, 0x7e1a02ff, 0xabcd1234,
-    0xbf8c3f70, 0x7e1424f9, 0x00040604, 0x7e1624f9, 0x00050604, 0x7e1826f9, 0x000d0604, 0x7e1a28f9, 0x000b0604,
+    0xbf8c3f70, 0x7e1422f9, 0x00060604, 0x7e1624f9, 0x00060604, 0x7e1826f9, 0x00060604, 0x7e1a28f9, 0x00060604,
     0xe0702000, 0x80010a03, 0xe0702004, 0x80010b03, 0xe0702008, 0x80010c03, 0xe070200c, 0x80010d03,
     0xbf810000,
 };
 
+const std::array<const char*, Selectors> SelectorNames{"BYTE_0", "BYTE_1", "BYTE_2", "BYTE_3", "WORD_0", "WORD_1", "DWORD"};
+
+struct SelectVector {
+    std::uint32_t value;
+    std::array<std::uint32_t, Selectors> zeroExtended;
+    std::array<std::uint32_t, Selectors> signExtended;
+};
+
+constexpr std::array<SelectVector, 16> Vectors{{
+    {0x00000000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {0xffffffffu, {0x000000ffu, 0x000000ffu, 0x000000ffu, 0x000000ffu, 0x0000ffffu, 0x0000ffffu, 0xffffffffu}, {0xffffffffu, 0xffffffffu, 0xffffffffu, 0xffffffffu, 0xffffffffu, 0xffffffffu, 0xffffffffu}},
+    {0x12345678u, {0x00000078u, 0x00000056u, 0x00000034u, 0x00000012u, 0x00005678u, 0x00001234u, 0x12345678u}, {0x00000078u, 0x00000056u, 0x00000034u, 0x00000012u, 0x00005678u, 0x00001234u, 0x12345678u}},
+    {0x80808080u, {0x00000080u, 0x00000080u, 0x00000080u, 0x00000080u, 0x00008080u, 0x00008080u, 0x80808080u}, {0xffffff80u, 0xffffff80u, 0xffffff80u, 0xffffff80u, 0xffff8080u, 0xffff8080u, 0x80808080u}},
+    {0x7f7f7f7fu, {0x0000007fu, 0x0000007fu, 0x0000007fu, 0x0000007fu, 0x00007f7fu, 0x00007f7fu, 0x7f7f7f7fu}, {0x0000007fu, 0x0000007fu, 0x0000007fu, 0x0000007fu, 0x00007f7fu, 0x00007f7fu, 0x7f7f7f7fu}},
+    {0x8182a3f4u, {0x000000f4u, 0x000000a3u, 0x00000082u, 0x00000081u, 0x0000a3f4u, 0x00008182u, 0x8182a3f4u}, {0xfffffff4u, 0xffffffa3u, 0xffffff82u, 0xffffff81u, 0xffffa3f4u, 0xffff8182u, 0x8182a3f4u}},
+    {0x7f00ff80u, {0x00000080u, 0x000000ffu, 0x00000000u, 0x0000007fu, 0x0000ff80u, 0x00007f00u, 0x7f00ff80u}, {0xffffff80u, 0xffffffffu, 0x00000000u, 0x0000007fu, 0xffffff80u, 0x00007f00u, 0x7f00ff80u}},
+    {0x00008000u, {0x00000000u, 0x00000080u, 0x00000000u, 0x00000000u, 0x00008000u, 0x00000000u, 0x00008000u}, {0x00000000u, 0xffffff80u, 0x00000000u, 0x00000000u, 0xffff8000u, 0x00000000u, 0x00008000u}},
+    {0x0000007fu, {0x0000007fu, 0x00000000u, 0x00000000u, 0x00000000u, 0x0000007fu, 0x00000000u, 0x0000007fu}, {0x0000007fu, 0x00000000u, 0x00000000u, 0x00000000u, 0x0000007fu, 0x00000000u, 0x0000007fu}},
+    {0x00000080u, {0x00000080u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000080u, 0x00000000u, 0x00000080u}, {0xffffff80u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000080u, 0x00000000u, 0x00000080u}},
+    {0x80000000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000080u, 0x00000000u, 0x00008000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0xffffff80u, 0x00000000u, 0xffff8000u, 0x80000000u}},
+    {0x00800000u, {0x00000000u, 0x00000000u, 0x00000080u, 0x00000000u, 0x00000000u, 0x00000080u, 0x00800000u}, {0x00000000u, 0x00000000u, 0xffffff80u, 0x00000000u, 0x00000000u, 0x00000080u, 0x00800000u}},
+    {0x0000ff00u, {0x00000000u, 0x000000ffu, 0x00000000u, 0x00000000u, 0x0000ff00u, 0x00000000u, 0x0000ff00u}, {0x00000000u, 0xffffffffu, 0x00000000u, 0x00000000u, 0xffffff00u, 0x00000000u, 0x0000ff00u}},
+    {0xdeadbeefu, {0x000000efu, 0x000000beu, 0x000000adu, 0x000000deu, 0x0000beefu, 0x0000deadu, 0xdeadbeefu}, {0xffffffefu, 0xffffffbeu, 0xffffffadu, 0xffffffdeu, 0xffffbeefu, 0xffffdeadu, 0xdeadbeefu}},
+    {0x01020304u, {0x00000004u, 0x00000003u, 0x00000002u, 0x00000001u, 0x00000304u, 0x00000102u, 0x01020304u}, {0x00000004u, 0x00000003u, 0x00000002u, 0x00000001u, 0x00000304u, 0x00000102u, 0x01020304u}},
+    {0xf0e0d0c0u, {0x000000c0u, 0x000000d0u, 0x000000e0u, 0x000000f0u, 0x0000d0c0u, 0x0000f0e0u, 0xf0e0d0c0u}, {0xffffffc0u, 0xffffffd0u, 0xffffffe0u, 0xfffffff0u, 0xffffd0c0u, 0xfffff0e0u, 0xf0e0d0c0u}},
+}};
+
 void FillInput() {
     for (std::uint32_t tid = 0; tid < Threads; ++tid) {
-        Input[tid * Inputs] = tid | ((tid + 64u) << 8u) | ((255u - tid) << 16u) | (((tid * 3u + 128u) & 0xffu) << 24u);
+        Input[tid * Inputs] = Vectors[tid % Vectors.size()].value;
     }
 }
 
@@ -49,7 +79,10 @@ std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t co
     return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (4u << 16u), count, 0x11016facu};
 }
 
-void Run(AgcDriver::VulkanDevice& device) {
+void Run(AgcDriver::VulkanDevice& device, std::uint32_t selector, bool signExtend) {
+    for (const auto word : ModifierWords) {
+        SdwaCode[word] = 0x00000604u | (selector << 16u) | (signExtend ? 1u << 19u : 0u);
+    }
     Output.fill(0xdeadbeefu);
     std::vector<std::uint32_t> userData(8, 0u);
     const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size()));
@@ -71,18 +104,16 @@ void Run(AgcDriver::VulkanDevice& device) {
     device.WaitIdle();
 }
 
-void Check() {
+void Check(std::uint32_t selector, bool signExtend) {
     for (std::uint32_t tid = 0; tid < Threads; ++tid) {
-        const auto source = Input[tid * Inputs];
+        const auto& vector = Vectors[tid % Vectors.size()];
+        const auto selected = signExtend ? vector.signExtended[selector] : vector.zeroExtended[selector];
         const auto* out = &Output[tid * Results];
-        const auto where = [&](std::uint32_t result) { return "sdwa cvt f32 ubyte: thread " + std::to_string(tid) + " result " + std::to_string(result) + " is " + Hex(out[result]); };
-        const auto byte1 = FloatBits((source >> 8u) & 0xffu);
-        const auto byte3 = FloatBits(source >> 24u);
-        const auto signFill = FloatBits((source & 0x80000000u) != 0u ? 0xffu : 0u);
-        Require(out[0] == byte1, where(0) + ", expected " + Hex(byte1) + ": v_cvt_f32_ubyte1 src0_sel:WORD_0 must convert bits 15:8");
-        Require(out[1] == byte3, where(1) + ", expected " + Hex(byte3) + ": v_cvt_f32_ubyte1 src0_sel:WORD_1 must convert bits 31:24");
-        Require(out[2] == signFill, where(2) + ", expected " + Hex(signFill) + ": v_cvt_f32_ubyte2 src0_sel:WORD_1 src0_sext must convert the sign extension of the high word");
-        Require(out[3] == signFill, where(3) + ", expected " + Hex(signFill) + ": v_cvt_f32_ubyte3 src0_sel:BYTE_3 src0_sext must convert the sign extension of the top byte");
+        for (std::uint32_t byte = 0; byte < Results; ++byte) {
+            const auto expected = FloatBits((selected >> (byte * 8u)) & 0xffu);
+            Require(out[byte] == expected, "sdwa v_cvt_f32_ubyte" + std::to_string(byte) + " src0_sel:" + SelectorNames[selector] + (signExtend ? " src0_sext" : "") + " of " +
+                                               Hex(vector.value) + " is " + Hex(out[byte]) + ", expected " + Hex(expected));
+        }
     }
 }
 
@@ -93,8 +124,12 @@ int main() {
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
         FillInput();
-        Run(*device);
-        Check();
+        for (const bool signExtend : {false, true}) {
+            for (std::uint32_t selector = 0; selector < Selectors; ++selector) {
+                Run(*device, selector, signExtend);
+                Check(selector, signExtend);
+            }
+        }
         std::puts("sdwa cvt f32 ubyte tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp
index c6dd1e4ca1..8d0bdf3153 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp
@@ -98,7 +98,7 @@ void MatchTests() {
 
 alignas(8) std::uint32_t Finished = 0;
 std::uint32_t Submitted = 0;
-constexpr std::uint32_t MaxResubmits = 16;
+constexpr std::uint32_t MaxResubmits = 512;
 
 void Submit(const std::vector<std::uint32_t>& data, std::uint32_t groups) {
     std::vector<std::uint32_t> words;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SkipShaderFile.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SkipShaderFile.cpp
new file mode 100644
index 0000000000..cec7c1cc4c
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SkipShaderFile.cpp
@@ -0,0 +1,102 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "VulkanTestDevice.hpp"
+#include <array>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+alignas(256) constexpr std::array<std::uint32_t, 7> First{0xd7460000u, 0x04010c04u, 0x7e0202ffu, 0x12345678u, 0xe0702000u, 0x80000100u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 7> Second{0xd7460000u, 0x04010c04u, 0x7e0202ffu, 0x12345678u, 0xe0702000u, 0x80000100u, 0xbf810000u};
+constexpr std::uint32_t Untouched = 0xcafebabeu;
+constexpr std::uint32_t Stored = 0x12345678u;
+alignas(256) std::array<std::uint32_t, 64> FirstOutput{};
+alignas(256) std::array<std::uint32_t, 64> SecondOutput{};
+
+void Dispatch(const std::array<std::uint32_t, 7>& code, std::array<std::uint32_t, 64>& output) {
+    const auto address = reinterpret_cast<std::uintptr_t>(output.data());
+    const std::array<std::uint32_t, 4> data{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (4u << 16u), static_cast<std::uint32_t>(output.size()), 0x00014204u};
+    const auto program = reinterpret_cast<std::uintptr_t>(code.data());
+    std::vector<std::uint32_t> words{
+        0xc0037600u, 0x207, 64, 1, 1,
+        0xc0027600u, 0x20c, static_cast<std::uint32_t>(program >> 8u), static_cast<std::uint32_t>(program >> 40u),
+        0xc0017600u, 0x213, (4u << 1u) | (1u << 7u),
+        0xc0047600u, 0x240, data[0], data[1], data[2], data[3],
+        0xc0031500u, 1, 1, 1, 0x41u,
+    };
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    AgcDriver::Submit(&packet, 0);
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriver::GuestMemory::FlushGpuWrites(address, sizeof(output));
+}
+
+std::string Hex(const void* address) {
+    char text[32];
+    std::snprintf(text, sizeof(text), "%llx", static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(address)));
+    return text;
+}
+
+void List(const std::filesystem::path& path, const std::string& contents) {
+    std::ofstream(path, std::ios::trunc) << contents;
+    std::this_thread::sleep_for(std::chrono::milliseconds(1100));
+}
+
+void Run(const char* phase, bool firstSkipped, bool secondSkipped) {
+    FirstOutput.fill(Untouched);
+    SecondOutput.fill(Untouched);
+    Dispatch(First, FirstOutput);
+    Dispatch(Second, SecondOutput);
+    for (std::size_t i = 0; i < FirstOutput.size(); ++i) {
+        Require(FirstOutput[i] == (firstSkipped ? Untouched : Stored), std::string(phase) + ": the first shader's dispatch " + (firstSkipped ? "stored" : "did not store") + " dword " + std::to_string(i));
+        Require(SecondOutput[i] == (secondSkipped ? Untouched : Stored), std::string(phase) + ": the second shader's dispatch " + (secondSkipped ? "stored" : "did not store") + " dword " + std::to_string(i));
+    }
+}
+
+}
+
+int main() {
+    const auto path = std::filesystem::temp_directory_path() / ("aps5-skip-shader-file-" + Hex(&FirstOutput) + ".txt");
+    try {
+        List(path, "# listed\n" + Hex(First.data()) + "\n");
+#ifdef _WIN32
+        Require(_putenv_s("APS5_SKIP_SHADER_FILE", path.string().c_str()) == 0, "cannot set APS5_SKIP_SHADER_FILE");
+#else
+        Require(setenv("APS5_SKIP_SHADER_FILE", path.string().c_str(), 1) == 0, "cannot set APS5_SKIP_SHADER_FILE");
+#endif
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) {
+                std::filesystem::remove(path);
+                return VulkanTestSkipped;
+            }
+        }
+        Run("first listed", true, false);
+        List(path, Hex(Second.data()) + " # the first is not listed any more\n");
+        Run("second listed", false, true);
+        List(path, Hex(First.data()) + "zz 1" + std::string(16, '0') + " 0x" + Hex(Second.data()) + "\n");
+        Run("malformed and overflowing tokens", false, true);
+        List(path, "");
+        Run("none listed", false, false);
+        AgcDriverShutdown_nid_postfix();
+        std::filesystem::remove(path);
+        std::puts("skip shader file tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        std::error_code ignored;
+        std::filesystem::remove(path, ignored);
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp
index 64835ea370..55cae19285 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -40,6 +41,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -51,6 +54,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -58,18 +67,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            const auto properties = function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties");
-            int rank = -1;
-            for (const auto candidate : devices) {
-                VkPhysicalDeviceProperties described{};
-                properties(candidate, &described);
-                if (described.apiVersion < VK_API_VERSION_1_1) continue;
-                const int candidateRank = described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU ? 2 : described.deviceType == VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU ? 1 : 0;
-                if (candidateRank <= rank) continue;
-                context.physical = candidate;
-                rank = candidateRank;
-            }
-            Require(context.physical != VK_NULL_HANDLE, "no Vulkan 1.1 device");
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
             VkPhysicalDeviceProperties2 selected{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &subgroup};
             function<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(context.physical, &selected);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp
index 809321d1b5..20a4dc48e2 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp
@@ -168,7 +168,7 @@ void Target(std::vector<std::uint32_t>& words, void* pointer) {
     Append(words, 0x69, {0x390, static_cast<std::uint32_t>(address >> 40u)});
 }
 
-void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap, bool unreadable) {
+void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap, bool unreadable, bool sized = true, std::uint32_t second = DeclaredIndices) {
     indices.Fill(size);
     Reference.fill(Kept);
     Actual.fill(Kept);
@@ -177,7 +177,7 @@ void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap,
     const auto first = unreadable ? 16u / size : afterGap ? indices.AfterGap(size) : 0u;
     Records[8] = 3;
     Records[9] = 1;
-    Records[10] = DeclaredIndices;
+    Records[10] = second;
     Records[16] = 3;
     Records[17] = 1;
     Records[18] = 16u / size;
@@ -192,7 +192,7 @@ void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap,
     Target(words, Actual.data());
     Append(words, 0x2a, {size == 2 ? 0u : 1u});
     Append(words, 0x26, {Low(indices.Base()), High(indices.Base())});
-    Append(words, 0x13, {DeclaredIndices});
+    if (sized) Append(words, 0x13, {DeclaredIndices});
     Append(words, 0x11, {1, Low(Records.data()), High(Records.data())});
     if (multi) Append(words, 0x38, {0, 0, 0, 0x40000280u, 3, Low(Count.data()), High(Count.data()), 32, 0});
     else Append(words, 0x25, {0, 0, 0, 0});
@@ -204,7 +204,7 @@ void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap,
     const auto covered = std::count_if(Reference.begin(), Reference.end(), [](std::byte value) { return value != Kept; });
     Require(covered != 0, "the reference triangle did not draw");
     Require(Actual == Reference, "the sparse indexed indirect draw differs from the reference triangle");
-    std::cout << "sparse indices " << size << " bytes, " << (multi ? "counted multi" : "single") << ", " << (afterGap ? "after gap" : "before gap") << " passed\n";
+    std::cout << "sparse indices " << size << " bytes, " << (multi ? "counted multi" : "single") << ", " << (afterGap ? "after gap" : "before gap") << (sized ? "" : ", no index size") << " passed\n";
 }
 
 }
@@ -218,10 +218,13 @@ int main(int argc, char** argv) {
         Register(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
         Register(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
         SparseIndices indices;
-        if (argc == 2 && std::string(argv[1]) == "--unreadable") {
+        const std::string mode = argc == 2 ? argv[1] : "";
+        if (mode == "--unreadable" || mode == "--no-size-unreadable" || mode == "--no-size-unreadable-record") {
             bool refused = false;
             try {
-                Run(indices, 2, false, false, true);
+                if (mode == "--unreadable") Run(indices, 2, false, false, true);
+                else if (mode == "--no-size-unreadable") Run(indices, 2, false, false, true, false);
+                else Run(indices, 2, true, false, false, false);
             } catch (const std::runtime_error& error) {
                 const std::string message = error.what();
                 refused = message.find("guest memory is not readable") != std::string::npos && message.find("+0x6)") != std::string::npos;
@@ -232,10 +235,11 @@ int main(int argc, char** argv) {
             std::cout << "the unreadable indirect index range was refused\n";
             return 0;
         }
+        const bool sized = mode != "--no-size";
         for (const auto size : {2u, 4u}) {
             for (const auto multi : {false, true}) {
-                Run(indices, size, multi, false, false);
-                Run(indices, size, multi, true, false);
+                Run(indices, size, multi, false, false, sized, sized ? DeclaredIndices : 0u);
+                Run(indices, size, multi, true, false, sized, sized ? DeclaredIndices : 0u);
             }
         }
         AgcDriverShutdown_nid_postfix();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StencilLogicOperations.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StencilLogicOperations.cpp
new file mode 100644
index 0000000000..21f62c48d6
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StencilLogicOperations.cpp
@@ -0,0 +1,202 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::uint32_t WaveSize = 64;
+constexpr std::uint32_t PlainControl = 0x50u;
+constexpr std::byte Kept{0x40};
+alignas(256) std::array<std::byte, Width * Height * 4> Pixels{};
+alignas(256) std::array<std::byte, 128 * 128 * 4> DepthMemory{};
+alignas(256) std::array<std::byte, 256 * 256> StencilMemory{};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 4> PixelCode{
+    0x7e0e02f2, 0xf800180f, 0x07070707, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::array<float, 4>, 3> Vertices{{
+    {-1.0f, -1.0f, 0.25f, 1.0f}, {3.0f, -1.0f, 0.25f, 1.0f}, {-1.0f, 3.0f, 0.25f, 1.0f},
+}};
+
+struct Shaders {
+    ShaderRecompiler::RecompileResult vertex;
+    ShaderRecompiler::RecompileResult pixel;
+    std::uint32_t pixelPush = 0;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+ShaderRecompiler::ShaderPixelStageInfo PixelInfo() {
+    const AgcDriver::Registers context{
+        {0x1b3, 0x700u}, {0x1b4, 0x700u}, {0x1b6, 0u}, {0x1c5, 9u}, {0x203, PlainControl},
+    };
+    return AgcDriver::Graphics::DecodePixelStageInfo(context, {0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u});
+}
+
+Shaders Compile(AgcDriver::VulkanDevice& device) {
+    const auto target = device.Target();
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Vertices.data(), 16u, static_cast<std::uint32_t>(Vertices.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {WaveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    Shaders shaders{ShaderRecompiler::Recompile(vertex), {}, 0};
+    const auto vertexPush = static_cast<std::uint32_t>(shaders.vertex.pushConstants.size());
+    std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(PixelCode.data()), std::as_bytes(std::span(PixelCode))}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(PixelCode.data()), PixelCode, 0, {}},
+        {WaveSize, 0, pixelUserData, std::nullopt, PixelInfo(), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    shaders.pixel = ShaderRecompiler::Recompile(fragment);
+    shaders.pixelPush = PixelPushOffset(vertexPush, target);
+    return shaders;
+}
+
+AgcDriver::QueueState StencilQueue(std::uint32_t ops, std::uint32_t refMask, std::uint32_t depthControl) {
+    AgcDriver::QueueState queue;
+    queue.userConfig[0x242] = 4;
+    queue.context = {
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x1b8, 0}, {0x207, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x9000000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x000, 0}, {0x002, 0}, {0x007, (1u << 16u) | 3u}, {0x00a, 0}, {0x00b, 0}, {0x010, 0x22900983u}, {0x011, 0x20000181u},
+        {0x012, 0x100}, {0x014, 0x100}, {0x013, 0x200}, {0x015, 0x200}, {0x005, 0x300}, {0x01e, 0x1},
+        {0x10b, ops}, {0x10c, refMask}, {0x10d, refMask}, {0x200, depthControl}
+    };
+    const auto address = reinterpret_cast<std::uintptr_t>(Pixels.data());
+    queue.context[0x318] = static_cast<std::uint32_t>(address >> 8u);
+    queue.context[0x390] = static_cast<std::uint32_t>(address >> 40u);
+    queue.context[0x10f] = std::bit_cast<std::uint32_t>(32.0f);
+    queue.context[0x110] = std::bit_cast<std::uint32_t>(32.0f);
+    queue.context[0x111] = std::bit_cast<std::uint32_t>(-2.0f);
+    queue.context[0x112] = std::bit_cast<std::uint32_t>(2.0f);
+    queue.context[0x113] = std::bit_cast<std::uint32_t>(1.0f);
+    queue.context[0x114] = 0;
+    queue.context[0xb4] = 0;
+    queue.context[0xb5] = std::bit_cast<std::uint32_t>(1.0f);
+    queue.shader[0x008] = 0x100;
+    queue.shader[0x009] = 0;
+    return queue;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const Shaders& shaders, const VkStencilOpState& stencil) {
+    Pixels.fill(Kept);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> stages{{
+        {ShaderStage::Vertex, &shaders.vertex, 0},
+        {ShaderStage::Fragment, &shaders.pixel, shaders.pixelPush}
+    }};
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, WaveSize, WaveSize, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(Pixels.data()), {Width, Height}, VK_FORMAT_R8G8B8A8_UNORM, Pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.depth = AgcDriver::Graphics::DepthTarget{reinterpret_cast<std::uintptr_t>(DepthMemory.data()), reinterpret_cast<std::uintptr_t>(StencilMemory.data()), {Width, Height}, VK_FORMAT_D32_SFLOAT_S8_UINT, 1.0f, 0};
+    state.depthTest = false;
+    state.depthCompare = VK_COMPARE_OP_ALWAYS;
+    state.stencilTest = true;
+    state.stencilFront = stencil;
+    state.stencilBack = stencil;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {Width, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+    device.Draw(state, AgcDriver::Pm4::DrawParameters{0, 3u, 0, 1u, 0, false}, stages);
+    device.WaitIdle();
+}
+
+std::uint32_t Expected(std::uint32_t op, std::uint32_t stored, std::uint32_t value, std::uint32_t writeMask) {
+    const auto result = op == 10u ? stored & value : op == 11u ? stored | value : op == 12u ? stored ^ value : ~(stored ^ value);
+    return ((stored & ~writeMask) | (result & writeMask)) & 0xffu;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const auto shaders = Compile(*device);
+        const auto replace = [](std::uint32_t value) { return VkStencilOpState{VK_STENCIL_OP_REPLACE, VK_STENCIL_OP_REPLACE, VK_STENCIL_OP_REPLACE, VK_COMPARE_OP_ALWAYS, 0xffu, 0xffu, value}; };
+        const auto equal = [](std::uint32_t value) { return VkStencilOpState{VK_STENCIL_OP_KEEP, VK_STENCIL_OP_KEEP, VK_STENCIL_OP_KEEP, VK_COMPARE_OP_EQUAL, 0xffu, 0u, value}; };
+        std::size_t checked = 0;
+        for (const auto stored : {0xa5u, 0x3cu}) {
+            for (const auto op : {10u, 11u, 12u, 15u}) {
+                for (const auto [writeMask, value] : {std::pair{0xffu, 0x3cu}, std::pair{0x0fu, 0x96u}, std::pair{0xf6u, 0xffu}}) {
+                    for (const auto [ops, compare] : {std::pair{op << 4u, 7u}, std::pair{op, 0u}}) {
+                        const auto refMask = 0xff00u | (writeMask << 16u) | (value << 24u);
+                        const auto face = AgcDriver::Graphics::DecodeState(StencilQueue(ops, refMask, 1u | (compare << 8u))).stencilFront;
+                        const auto expected = Expected(op, stored, value, writeMask);
+                        const auto name = "stencil operation " + std::to_string(op) + " in DB_STENCIL_CONTROL " + std::to_string(ops) + " with DB_STENCILREFMASK " + std::to_string(refMask) + " on stored value " + std::to_string(stored);
+                        Draw(*device, shaders, replace(stored));
+                        Draw(*device, shaders, face);
+                        Draw(*device, shaders, equal(expected));
+                        for (std::uint32_t pixel = 0; pixel < Width * Height; ++pixel) {
+                            Require(Pixels[pixel * 4u] == std::byte{255}, name + ": pixel " + std::to_string(pixel) + " does not hold the expected stencil value " + std::to_string(expected));
+                        }
+                        Draw(*device, shaders, equal(expected ^ 0x80u));
+                        Require(std::ranges::all_of(std::span(Pixels).first(4), [](std::byte value) { return value == Kept; }), name + ": the stencil value also equals " + std::to_string(expected ^ 0x80u));
+                        ++checked;
+                    }
+                }
+            }
+        }
+        std::printf("stencil logic operation tests passed: %zu states\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
index 3612fae6ef..14d571cf48 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
@@ -88,7 +88,7 @@ ShaderRecompiler::ShaderPixelStageInfo PixelInfo(std::uint32_t shaderControl) {
     return AgcDriver::Graphics::DecodePixelStageInfo(context, {0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u});
 }
 
-void Draw(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> pixelCode, std::uint32_t shaderControl, const VkStencilOpState& stencil, std::uint32_t vertices = 3u, std::uint32_t instances = 1u, bool depthFail = false, const std::function<void(AgcDriver::Graphics::State&)>& alter = {}, const std::function<void(AgcDriver::Pm4::DrawParameters&)>& alterDraw = {}, std::span<const std::array<float, 4>> vertexData = Vertices, std::span<const std::uint32_t> vertexCode = VertexCode, std::span<const std::uint32_t> pixelData = {}, std::span<const ShaderRecompiler::MemoryRegion> pixelSrt = {}, const std::function<void(ShaderRecompiler::RecompileResult&)>& alterVertex = {}) {
+void Draw(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> pixelCode, std::uint32_t shaderControl, const VkStencilOpState& stencil, std::uint32_t vertices = 3u, std::uint32_t instances = 1u, bool depthFail = false, const std::function<void(AgcDriver::Graphics::State&)>& alter = {}, const std::function<void(AgcDriver::Pm4::DrawParameters&)>& alterDraw = {}, std::span<const std::array<float, 4>> vertexData = Vertices, std::span<const std::uint32_t> vertexCode = VertexCode, std::span<const std::uint32_t> pixelData = {}, std::span<const ShaderRecompiler::MemoryRegion> pixelSrt = {}, const std::function<void(ShaderRecompiler::RecompileResult&)>& alterVertex = {}, std::uint32_t pixelPushBytes = 0u) {
     Pixels.fill(Kept);
     auto target = device.Target();
     std::vector<std::uint32_t> capabilities(target.supportedCapabilities.begin(), target.supportedCapabilities.end());
@@ -113,11 +113,13 @@ void Draw(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> pixelC
     auto pixelUserData = pixelData.empty() ? std::vector<std::uint32_t>(8, 0u) : std::vector<std::uint32_t>(pixelData.begin(), pixelData.end());
     std::vector<ShaderRecompiler::MemoryRegion> pixelMemory{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(pixelCode)}};
     pixelMemory.insert(pixelMemory.end(), pixelSrt.begin(), pixelSrt.end());
+    auto pixelLayout = PixelPushLayout(vertexPush, target);
+    if (pixelPushBytes != 0u) pixelLayout.pushConstantSizeBytes = pixelPushBytes;
     ShaderRecompiler::RecompileRequest fragment{
         {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
         {WaveSize, 0, pixelUserData, std::nullopt, PixelInfo(shaderControl), std::nullopt, pixelMemory},
         target,
-        PixelPushLayout(vertexPush, target)
+        pixelLayout
     };
     fragment.useCache = false;
     const auto pixelResult = ShaderRecompiler::Recompile(fragment);
@@ -350,6 +352,14 @@ int main() {
         const std::array<std::uint32_t, 1> colorData{0x3f800000u};
         Draw(*device, userColor, exported, replace(), 3u, 1u, false, {}, {}, Vertices, VertexCode, colorData);
         Check(all, "dynamic reference preserves the adjacent shader-data push payload");
+        auto bufferColor = std::vector<std::uint32_t>(alternating.begin(), alternating.end());
+        *std::find(bufferColor.begin(), bufferColor.end(), 0x7e0e02f2u) = 0x7e0e0208u;
+        bufferColor.insert(bufferColor.begin(), {0xf4200200u, 0xfa000000u, 0xbf8cc07fu});
+        alignas(256) const std::array<std::uint32_t, 4> colorBuffer{0x3f800000u, 0u, 0u, 0u};
+        const auto colorDescriptor = BufferDescriptor(colorBuffer.data(), 4u, static_cast<std::uint32_t>(colorBuffer.size()));
+        const std::array<ShaderRecompiler::MemoryRegion, 1> colorMemory{{{reinterpret_cast<std::uintptr_t>(colorBuffer.data()), std::as_bytes(std::span(colorBuffer))}}};
+        Draw(*device, bufferColor, exported, replace(), 3u, 1u, false, {}, {}, Vertices, VertexCode, colorDescriptor, colorMemory, {}, sizeof(std::uint32_t));
+        Check(all, "dynamic reference keeps guest buffer offsets in shader data outside the push constants");
         auto guarded = std::vector<std::uint32_t>(alternating.begin(), alternating.end());
         *std::find(guarded.begin(), guarded.end(), 0x7e0e02f2u) = 0x7e0e020cu;
         guarded.insert(guarded.begin(), {0xf4040280u, 0xfa000018u, 0xf4000305u, 0xfa000000u, 0xbf8cc07fu});
@@ -369,6 +379,29 @@ int main() {
         catch (const std::exception& error) { faultThrown = std::string(error.what()).find("BDA") != std::string::npos; }
         Require(faultThrown, "poisoned readonly SRT replay did not throw a host fault");
         Require(std::ranges::all_of(Pixels, [](std::byte value) { return value == Kept; }), "poisoned replay published guest color results before its fault");
+        alignas(256) std::array<std::uint32_t, Width + 1u> columnValues{};
+        alignas(256) std::array<float, Width> columnTexels{};
+        columnValues[0] = 0x2fu;
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            columnValues[x + 1u] = 0x30u + x;
+            columnTexels[x] = 1.0f;
+        }
+        constexpr std::array<std::uint32_t, 15> bufferImageCode{
+            0x7e060f00u, 0x7e080280u, 0xf0001108u, 0x00010503u, 0xe0302000u, 0x80000603u, 0xe0302000u, 0x80030803u,
+            0xbf8c3f70u, 0x7e0e02f2u, 0xf8000082u, 0x00000600u, 0xf800180fu, 0x07050805u, 0xbf810000u,
+        };
+        const auto columnBuffer = BufferDescriptor(columnValues.data() + 1, 4u, Width);
+        const auto alignedBuffer = BufferDescriptor(columnValues.data(), 4u, Width + 1u);
+        const auto texelAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(columnTexels.data()));
+        const std::array<std::uint32_t, 8> columnTexture{static_cast<std::uint32_t>(texelAddress >> 8u), static_cast<std::uint32_t>((texelAddress >> 40u) & 0xffu) | (22u << 20u) | (((Width - 1u) & 3u) << 30u), (Width - 1u) >> 2u, 0xfacu | (9u << 28u), 0u, 0u, 0u, 0u};
+        std::vector<std::uint32_t> bufferImageData(columnBuffer.begin(), columnBuffer.end());
+        bufferImageData.insert(bufferImageData.end(), columnTexture.begin(), columnTexture.end());
+        bufferImageData.insert(bufferImageData.end(), alignedBuffer.begin(), alignedBuffer.end());
+        Draw(*device, PlainPixelCode, plain, replace(0u));
+        Draw(*device, bufferImageCode, exported, replace(), 3u, 1u, false, {}, {}, Vertices, VertexCode, bufferImageData);
+        Check(all, "a replayed export beside an image draws the image's texels");
+        Draw(*device, PlainPixelCode, plain, equal(0x35u));
+        Check([](std::uint32_t x, std::uint32_t) { return x == 5u; }, "a replayed export beside an image reads its guest buffer at a 4-byte offset");
         std::puts("stencil replay tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp
index a3a273ff50..87090fa580 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp
@@ -162,6 +162,7 @@ int main(int argc, char** argv) {
             Require(first != nullptr, "surface 0 has no cached storage image");
             Require(AgcDriver::Graphics::SharedResourceCache().Size() != 0, "the storage cache workload did not populate the resource cache");
             const auto held = std::max<std::uint64_t>(first->AllocationBytes(), first->GuestBytes());
+            const auto allocated = first->AllocationBytes();
             const auto reused = static_cast<std::uint32_t>(FixedBudget / held) + 1u;
             std::printf("texture cache budget %llu MiB; each 512x512 32_UINT surface holds %llu MiB; cyclic set of %u surfaces (%llu MiB)\n", static_cast<unsigned long long>(budget >> 20u), static_cast<unsigned long long>(held >> 20u), reused, static_cast<unsigned long long>((reused * held) >> 20u));
             Require(budget >= reused * held, "the cyclic set exceeds the test cache budget");
@@ -183,8 +184,8 @@ int main(int argc, char** argv) {
                 Require(cached == (surface >= 2u), "surface " + std::to_string(surface) + (cached ? " is still cached" : " was evicted") + " after " + std::to_string(capacity + 2u) + " surfaces under a budget of " + std::to_string(capacity) + " of them");
                 Require(cached == !images[surface].expired(), "surface " + std::to_string(surface) + (cached ? " is cached but its weak image expired" : " was evicted but its resource cache image is still alive"));
             }
-            const auto released = AgcDriver::Graphics::ReleaseTextureCaches(held);
-            Require(released >= held, "a release of one image's bytes freed " + std::to_string(released >> 20u) + " MiB, less than the " + std::to_string(held >> 20u) + " MiB of the oldest image");
+            const auto released = AgcDriver::Graphics::ReleaseTextureCaches(allocated);
+            Require(released == allocated, "a release of one image's bytes counted " + std::to_string(released) + " bytes, not its " + std::to_string(allocated) + "-byte allocation");
             Require(StorageTexture::FindLive(base + 2u * Stride, SurfaceBytes) == nullptr && images[2].expired(), "the oldest cached storage image survived a release of its bytes");
             Require(StorageTexture::FindLive(base + 3u * Stride, SurfaceBytes) != nullptr && !images[3].expired(), "a release of one image's bytes evicted more than the oldest image");
             Require(StorageTexture::FindLive(base + (capacity + 1u) * Stride, SurfaceBytes) != nullptr, "a release of one image's bytes evicted the newest image");
@@ -194,11 +195,11 @@ int main(int argc, char** argv) {
                 Require(Store(*device, base, 4) != nullptr, "surface 4 is not cached");
                 for (std::uint32_t surface = 5; surface < capacity + 2u; ++surface) Require(Store(*device, base, surface) != nullptr, "surface " + std::to_string(surface) + " is not cached");
             }
-            Require(AgcDriver::Graphics::ReleaseTextureCaches(held) >= held, "a release with a dirty oldest image freed nothing");
+            Require(AgcDriver::Graphics::ReleaseTextureCaches(allocated) == allocated, "a release with a dirty oldest image did not free one clean allocation");
             Require(StorageTexture::FindLive(base + 3u * Stride, SurfaceBytes) != nullptr, "a release took the dirty oldest image before a clean one");
             Require(StorageTexture::FindLive(base + 4u * Stride, SurfaceBytes) == nullptr && images[4].expired(), "a release did not take the oldest clean image");
             const auto rest = AgcDriver::Graphics::ReleaseTextureCaches(~std::uint64_t{0});
-            Require(rest >= held * (capacity - 3u), "a release of everything freed " + std::to_string(rest >> 20u) + " MiB of the " + std::to_string((held * (capacity - 3u)) >> 20u) + " MiB cached");
+            Require(rest == allocated * (capacity - 3u), "a release of everything counted " + std::to_string(rest) + " bytes, not the " + std::to_string(allocated * (capacity - 3u)) + " bytes allocated");
             device->WaitIdle();
             for (std::uint32_t surface = 0; surface < capacity + 2u; ++surface) {
                 if (surface == 3u) continue;
@@ -210,7 +211,7 @@ int main(int argc, char** argv) {
             }
             StorageTexture::FlushPending(base + 3u * Stride, static_cast<std::size_t>(SurfaceBytes), nullptr, "test");
             device->WaitIdle();
-            Require(AgcDriver::Graphics::ReleaseTextureCaches(~std::uint64_t{0}) >= held, "a release did not take the image once its results were stored");
+            Require(AgcDriver::Graphics::ReleaseTextureCaches(~std::uint64_t{0}) == allocated, "a release did not take the image once its results were stored");
             Require(StorageTexture::FindLive(base + 3u * Stride, SurfaceBytes) == nullptr, "surface 3 survived a release after its results were stored");
             Require(AgcDriver::Graphics::ReleaseTextureCaches(held) == 0, "a release from empty caches reported freed bytes");
         } catch (...) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp
index 6fd7ebae81..8658f5b45b 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
@@ -35,27 +38,6 @@
 #endif
 
 class FileStream;
-struct GuestIovec { void* base; std::size_t length; };
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelWritev(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelPwritev(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI _write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest*, std::int32_t, std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest*, std::int32_t, std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t, std::int32_t*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-}
 
 namespace {
 
@@ -192,7 +174,7 @@ bool CheckWrite(Api api, const char* name, GuestSurface& surface, GuestSurface&
     const auto hold = ProduceHeld(surface, unrelated);
     OutputFile file;
     auto* source = surface.Data() + SourceOffset;
-    const std::array<GuestIovec, 4> vectors{{{source, 111}, {nullptr, 0}, {source + 111, 65537}, {source + 65648, TransferBytes - 65648}}};
+    const std::array<KernelIovec, 4> vectors{{{source, 111}, {nullptr, 0}, {source + 111, 65537}, {source + 65648, TransferBytes - 65648}}};
     const bool positioned = api == Api::Pwrite || api == Api::PosixPwrite || api == Api::Pwritev || api == Api::PosixPwritev || api == Api::Aio || api == Api::AioMultiple;
     if (api == Api::Fwrite) {
         auto* stream = fopen_nid_postfix(file.Name().c_str(), "wb");
@@ -237,7 +219,7 @@ bool CheckWrite(Api api, const char* name, GuestSurface& surface, GuestSurface&
             KernelAioResult result{};
             KernelAioRwRequest request{FileOffset, TransferBytes, source, &result, output};
             std::int32_t id = 0;
-            Require((api == Api::Aio ? sceKernelAioSubmitWriteCommands(&request, 1, 0, &id) : sceKernelAioSubmitWriteCommandsMultiple(&request, 1, 0, &id)) == 0, "file write: AIO submission failed");
+            Require((api == Api::Aio ? sceKernelAioSubmitWriteCommands(&request, 1, 1, &id) : sceKernelAioSubmitWriteCommandsMultiple(&request, 1, 1, &id)) == 0, "file write: AIO submission failed");
             std::int32_t removed = -1;
             Require(sceKernelAioDeleteRequest(id, &removed) == 0 && removed == 0, "file write: AIO deletion failed");
             Require(result.state == 3, "file write: AIO did not complete");
@@ -326,8 +308,8 @@ void CheckShutdownAndGuard() {
     OutputFile file;
     std::vector<std::byte> source(TransferBytes, std::byte{0x5a});
     AgcDriver::GuestMemory::SetFlushHook(nullptr);
-    AgcDriver::GuestMemory::SetReadGuard([](std::uint64_t, std::size_t) { throw std::runtime_error("file source read guard"); });
     const auto descriptor = file.Open();
+    AgcDriver::GuestMemory::SetReadGuard([](std::uint64_t, std::size_t) { throw std::runtime_error("file source read guard"); });
     bool refused = false;
     try { sceKernelWrite(descriptor, source.data(), source.size()); }
     catch (const std::runtime_error& error) { refused = std::string(error.what()) == "file source read guard"; }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp
index b2935dd9c9..c9c8e08c3a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp
@@ -112,7 +112,7 @@ int main(int argc, char** argv) {
 
         Store(texels);
         if (wake) {
-            const auto pendingDeadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+            const auto pendingDeadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
             while (!AgcDriver::Graphics::StorageTexture::AnyPending() && std::chrono::steady_clock::now() < pendingDeadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
             Require(AgcDriver::Graphics::StorageTexture::AnyPending(), "idle wake fixture did not observe pending storage results");
             std::this_thread::sleep_for(std::chrono::milliseconds(5));
@@ -127,7 +127,7 @@ int main(int argc, char** argv) {
             cpu = nextTexels;
             Store(nextTexels);
         }
-        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
         while (!stored() && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
         Require(stored(), "the queue-idle store did not bring the result to guest memory without a direct flush or further submission");
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SubmitProgress.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SubmitProgress.cpp
new file mode 100644
index 0000000000..1996782ef5
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SubmitProgress.cpp
@@ -0,0 +1,154 @@
+#include "VulkanTestDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <stdexcept>
+#include <thread>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+void Require(bool condition, const char* message) { if (!condition) throw std::runtime_error(message); }
+alignas(256) std::array<std::uint32_t, 15> Code{0xf4080200u, 0xfa000000u, 0xbe840381u, 0x9304ff04u, 0x0019660du, 0x8004ff04u, 0x3c6ef35fu, 0x80828102u, 0xbf078002u, 0xbf85fff9u, 0xbf8cc07fu, 0x7e000204u, 0xe0700000u, 0x80020000u, 0xbf810000u};
+std::uint32_t Low(const void* p) { return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(p)); }
+std::uint32_t High(const void* p) { return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(p) >> 32u); }
+void Set(std::vector<std::uint32_t>& words, std::uint32_t reg, std::uint32_t value) { words.insert(words.end(), {0xc0017600u, reg, value}); }
+void Dispatch(std::vector<std::uint32_t>& words, const void* descriptor, std::uint32_t iterations = 32) {
+    const auto address = reinterpret_cast<std::uintptr_t>(Code.data());
+    Set(words, 0x20c, static_cast<std::uint32_t>(address >> 8u));
+    Set(words, 0x20d, static_cast<std::uint32_t>(address >> 40u));
+    for (auto reg : {0x207u, 0x208u, 0x209u}) Set(words, reg, 1);
+    Set(words, 0x212, 0); Set(words, 0x213, 6); Set(words, 0x240, Low(descriptor)); Set(words, 0x241, High(descriptor)); Set(words, 0x242, iterations);
+    words.insert(words.end(), {0xc0031500u, 1, 1, 1, 0x8041u});
+}
+void Release(std::vector<std::uint32_t>& words, const void* label, std::uint32_t value) {
+    const std::uint32_t interrupt = value % 2 == 0 ? 2 : 0;
+    words.insert(words.end(), {0xc0064900u, 0x514u, (2u << 29u) | (interrupt << 24u), Low(label), High(label), value, 0u, 0u});
+}
+void Await(const std::uint32_t* label, std::uint32_t value) {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    while (*static_cast<const volatile std::uint32_t*>(label) != value) {
+        Require(std::chrono::steady_clock::now() < deadline, "submission lost its real GPU completion store");
+        std::this_thread::yield();
+    }
+    AgcDriverWaitIdle_nid_postfix();
+}
+}
+
+int main() {
+    void* block = nullptr;
+    try {
+        auto device = OpenVulkanTestDevice(); if (!device) return VulkanTestSkipped; device.reset();
+#ifdef _WIN32
+        block = VirtualAlloc(nullptr, 65536, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+#else
+        block = std::aligned_alloc(65536, 65536);
+#endif
+        Require(block != nullptr, "cannot allocate submit-progress guest memory");
+        std::memset(block, 0, 65536);
+        GuestAllocations::Mutation().Add(block, 65536, true, true, true);
+        auto* output = static_cast<std::uint32_t*>(block);
+        auto* descriptor = output + 64; auto* label = output + 128; auto* neighbor = output + 192;
+        descriptor[0] = Low(output); descriptor[1] = High(output) & 0xffffu; descriptor[2] = 16; descriptor[3] = 0x31016facu;
+        *neighbor = 0xabcdef12u;
+        const auto submit = [&](std::uint32_t value) {
+            *label = 0; label[1] = 0xfeedbeefu;
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 8);
+            std::vector<std::uint32_t> words; Dispatch(words, descriptor);
+            if (value % 2 != 0) {
+                auto* selfGate = output + 384; selfGate[0] = 0; selfGate[1] = 0;
+                AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(selfGate), 8);
+                Release(words, selfGate, 1);
+                if (value % 3 == 0) words.insert(words.end(), {0xc0079300u, 0x13u, Low(selfGate), High(selfGate), 1, 0, 0xffffffffu, 0xffffffffu, 4});
+                else words.insert(words.end(), {0xc0053c00u, 0x13u, Low(selfGate), High(selfGate), 1, 0xffffffffu, 4});
+            }
+            Release(words, label, value);
+            Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+            AgcDriver::Submit(&packet, 0);
+        };
+        submit(1); Await(label, 1);
+        std::uint32_t ready = 0;
+        for (std::uint32_t value = 2; value < 66; ++value) {
+            submit(value);
+            ready += *static_cast<volatile std::uint32_t*>(label) == value;
+            Await(label, value);
+            Require(*label == value, "submission lost its real GPU completion store");
+            Require(label[1] == 0, "64-bit GPU marker did not replace its genuine CPU-written high word");
+            Require(*neighbor == 0xabcdef12u, "progress wait damaged neighboring guest bytes");
+        }
+        std::cout << ready << "/64 small dependent submissions completed at return\n";
+        std::uint32_t prefixesReady = 0;
+        for (std::uint32_t index = 0; index < 16; ++index) {
+            auto* continued = output + 320;
+            *continued = 0; *label = 0;
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 8);
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(continued), 8);
+            std::vector<std::uint32_t> prefix; Dispatch(prefix, descriptor); Release(prefix, label, 100 + index);
+            prefix.insert(prefix.end(), {0xc0005900u, 0u});
+            const auto control = prefix.size() - 1;
+            Release(prefix, continued, 200 + index);
+            Packet prefixPacket{prefix.data(), static_cast<std::uint32_t>(prefix.size()), 0, {}};
+            AgcDriver::Submit(&prefixPacket, 0);
+            prefixesReady += *static_cast<volatile std::uint32_t*>(label) == 100 + index;
+            Require(*continued == 0, "an unreleased REWIND continuation executed early");
+            std::atomic<bool> logicalDone{false}, waiterFailed{false};
+            std::thread waiter;
+            bool earlyLogicalCompletion = false;
+            if (index == 0) {
+                waiter = std::thread([&] {
+                    try { AgcDriverWaitIdle_nid_postfix(); logicalDone.store(true, std::memory_order_release); }
+                    catch (...) { waiterFailed.store(true, std::memory_order_release); }
+                });
+                std::this_thread::sleep_for(std::chrono::milliseconds(2));
+                earlyLogicalCompletion = logicalDone.load(std::memory_order_acquire);
+            }
+            std::atomic_ref<std::uint32_t>(prefix[control]).store(0x80000000u, std::memory_order_release);
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(&prefix[control]), 4);
+            Await(label, 100 + index); Await(continued, 200 + index);
+            if (waiter.joinable()) waiter.join();
+            Require(!waiterFailed.load() && !earlyLogicalCompletion, "prefix acknowledgement completed the unreleased logical submission");
+        }
+        std::cout << prefixesReady << "/16 finite REWIND prefixes completed at return\n";
+        auto* gate = output + 256; *gate = 0; *label = 0;
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(gate), 4);
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 4);
+        std::vector<std::uint32_t> waiting{0xc0053c00u, 0x13u, Low(gate), High(gate), 1, 0xffffffffu, 0x19u};
+        Release(waiting, label, 77);
+        Packet waitPacket{waiting.data(), static_cast<std::uint32_t>(waiting.size()), 0, {}};
+        AgcDriver::Submit(&waitPacket, 0);
+        Require(*label == 0, "dependent wait fabricated its completion");
+        *gate = 1;
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(gate), 4);
+        Await(label, 77);
+        *label = 0;
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 4);
+        std::vector<std::uint32_t> slow; Dispatch(slow, descriptor, 1u << 22u); Release(slow, label, 78);
+        Packet slowPacket{slow.data(), static_cast<std::uint32_t>(slow.size()), 0, {}};
+        const auto began = std::chrono::steady_clock::now();
+        AgcDriver::Submit(&slowPacket, 0);
+        Require(std::chrono::steady_clock::now() - began < std::chrono::milliseconds(100), "progress budget became an unbounded GPU drain");
+        Await(label, 78);
+        Require(*neighbor == 0xabcdef12u, "pending progress work damaged neighboring guest bytes");
+        AgcDriverShutdown_nid_postfix();
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try { AgcDriverShutdown_nid_postfix(); } catch (...) {}
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp
index 8eee7b840b..7f13530d09 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp
@@ -157,6 +157,22 @@ alignas(256) constexpr std::array<std::uint32_t, 29> LocalIndexAsData{
     0x0000030a, 0xd8340010, 0x0000070a, 0xbf8cc07f, 0xbefd2106,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 7> LocalInactiveIndex{
+    0x7e108704, 0x7da80b02, 0x160e06a8, 0x7e060302, 0xd9340020, 0x00000207, 0xbe802006,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 8> LocalRestoredIndex{
+    0x7e108704, 0x160e06a8, 0x7da80b02, 0x7e060302, 0xbefe04c1, 0xd9340020, 0x00000207, 0xbe802006,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> LocalObservedWindow{
+    0xbefc0383, 0x7da80b02, 0x160e06a8, 0x7e108704, 0xd9340020, 0x00000807, 0xbe802006,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 9> LocalNegatedConjunction{
+    0x7d880b02, 0x160e06a8, 0x02100e80, 0x7da20d02, 0x87fe6a7e, 0xbefe087e, 0xd9340020, 0x00000807, 0xbe802006,
+};
+
 alignas(256) constexpr std::array<std::uint32_t, 50> HullDescendingRecords{
     0xd7650000, 0x000100c1, 0xd7660000, 0x000200c1, 0xbf8a0000, 0x7da206f9, 0x81060000, 0xd5480014,
     0x02151101, 0x362402ff, 0x000000ff, 0x160028a0, 0xd5430015, 0x040224ff, 0x00000060, 0xdbfc0000,
@@ -1005,6 +1021,13 @@ int main() {
         ExpectRefusal(target, ShaderStage::TessellationEvaluation, DomainNeighbourPoint, "neither its patch's control points nor a patch-constant record", RecordPatches);
         ExpectRefusal(target, ShaderStage::TessellationEvaluation, DomainCulledPrimitive, "passthrough primitive");
         ExpectRefusal(target, ShaderStage::Local, LocalIndexAsData, "outside a tessellation ring or LDS address");
+        {
+            std::uint32_t cursor = 0;
+            Require(!Compile(target, ShaderStage::Local, LocalInactiveIndex, cursor).spirv.empty(), "a local program whose relative index survives only on inactive lanes was not compiled");
+        }
+        ExpectRefusal(target, ShaderStage::Local, LocalRestoredIndex, "outside a tessellation ring or LDS address");
+        ExpectRefusal(target, ShaderStage::Local, LocalObservedWindow, "outside a tessellation ring or LDS address");
+        ExpectRefusal(target, ShaderStage::Local, LocalNegatedConjunction, "outside a tessellation ring or LDS address");
         ExpectRefusal(target, ShaderStage::TessellationControl, HullRelativeData, "GE_CNTL.PRIM_GRP_SIZE is 0", RecordPatches);
         ExpectRefusal(target, ShaderStage::TessellationEvaluation, DomainRelativeData, "GE_CNTL.PRIM_GRP_SIZE is 0", RecordPatches);
         ExpectRefusal(target, ShaderStage::TessellationControl, HullCode, "outside its patch's quad factors", {{3u, 3u, 2u, 2u, 2u}, Indices});
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/UintColorTarget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/UintColorTarget.cpp
new file mode 100644
index 0000000000..9c9d7f8230
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/UintColorTarget.cpp
@@ -0,0 +1,332 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "Optimization/ResourceProgram.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <limits>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::ColorTargetLayout;
+using AgcDriver::Graphics::ColorTileMode;
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 256;
+constexpr std::uint32_t Height = 128;
+constexpr std::uint32_t ScissorWidth = 128;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+
+struct TargetFormat {
+    const char* name;
+    std::uint32_t info;
+    VkFormat format;
+    std::uint32_t channels;
+    std::uint32_t channelBytes;
+};
+
+constexpr TargetFormat R32{"R32_UINT", 0x410u, VK_FORMAT_R32_UINT, 1, 4};
+constexpr TargetFormat R32G32{"R32G32_UINT", 0x42cu, VK_FORMAT_R32G32_UINT, 2, 4};
+constexpr TargetFormat R32G32B32A32{"R32G32B32A32_UINT", 0x438u, VK_FORMAT_R32G32B32A32_UINT, 4, 4};
+constexpr TargetFormat R8{"R8_UINT", 0x404u, VK_FORMAT_R8_UINT, 1, 1};
+
+struct ExportCase {
+    const char* name;
+    std::uint32_t format;
+    VkColorComponentFlags writeMask;
+};
+
+constexpr ExportCase Export32R{"32_R", 1, VK_COLOR_COMPONENT_R_BIT};
+constexpr ExportCase Export32GR{"32_GR", 2, VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT};
+constexpr ExportCase Export32AR{"32_AR", 3, VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_A_BIT};
+constexpr ExportCase Export32ABGR{"32_ABGR", 9, VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT | VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 64>, 128> Programs{};
+std::size_t programCount = 0;
+
+std::span<const std::uint32_t> Program(const std::array<std::uint32_t, 4>& vgprs, bool compressed) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    for (std::uint32_t vgpr = 0; vgpr < (compressed ? 2u : 4u); ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = vgprs[vgpr];
+    }
+    code[at++] = compressed ? 0xf8001c0fu : 0xf800180fu;
+    code[at++] = compressed ? 0x00000504u : 0x07060504u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+std::span<const std::uint32_t> WordProgram(const std::array<std::uint32_t, 4>& words) {
+    return Program(words, false);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color target");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        AgcDriver::Graphics::StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::size_t bytes, const TargetFormat& target, std::uint32_t attrib3) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = target.info;
+    cx[0x31d] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = attrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == target.format && color.elementBytes == target.channels * target.channelBytes && color.componentMapping == 0xe4u && color.packing == ShaderRecompiler::ColorExportPacking::Uint && color.bytes == bytes, std::string("the UINT target did not decode as an ") + target.name + " surface with the unsigned integer packing");
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, const ExportCase& exported, std::span<const std::uint32_t> pixelCode) {
+    const auto exportFormat = exported.format;
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(Triangle.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(Triangle.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {ScissorWidth, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.colorWriteMask = exported.writeMask;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, exportFormat}};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {waveSize, 0, {}, std::nullopt, AgcDriver::Graphics::DecodePixelStageInfo(context, {}), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    const auto handle = ShaderRecompiler::PrepareShader(fragment);
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{codeAddress, 0, 1, {pixelCode.begin(), pixelCode.end()}, {}};
+    snapshot.prepared->entries.push_back({0, handle});
+    fragment.shader.code = snapshot.code;
+    fragment.context.pixel = AgcDriver::Graphics::DecodePixelStageInfo(context, AgcDriver::Graphics::ExportMappings(state));
+    fragment.context.pixel->targetExportPacking = AgcDriver::Graphics::ExportPackings(state);
+    const ShaderRecompiler::SrtRuntime runtime{};
+    const auto materialize = [&](const ShaderRecompiler::RecompileRequest& request) {
+        const auto invocation = AgcDriver::DriverDetail::InvocationFor(snapshot, 0, request);
+        return invocation.Materialize(*invocation.Capture(runtime));
+    };
+    const auto pixelResult = materialize(fragment);
+    auto unpacked = fragment;
+    unpacked.context.pixel->targetExportPacking.fill(ShaderRecompiler::ColorExportPacking::None);
+    const auto plain = materialize(unpacked);
+    Require(pixelResult->variantId == ShaderRecompiler::GetPreparedArtifact(*handle).variantId && plain->variantId == pixelResult->variantId, "the draw did not use the registered pixel shader");
+    Require(plain->PipelineVariantId() != pixelResult->PipelineVariantId() && materialize(fragment)->PipelineVariantId() == pixelResult->PipelineVariantId(), "the unsigned integer packing did not key its own specialization");
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, pixelResult.get(), PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::vector<std::uint8_t> ReadBack(AgcDriver::VulkanDevice& device, const Block& block) {
+    AgcDriver::Graphics::StorageTexture::FlushPending(block.Address(), block.bytes, nullptr, "test read-back");
+    device.WaitIdle();
+    std::vector<std::uint8_t> stored(block.bytes);
+    AgcDriver::GuestMemory::Read(block.Address(), std::as_writable_bytes(std::span(stored)), 1);
+    return stored;
+}
+
+std::uint32_t Channel(const std::vector<std::uint8_t>& bytes, std::size_t at, std::uint32_t channelBytes) {
+    std::uint32_t value = 0;
+    std::memcpy(&value, bytes.data() + at, channelBytes);
+    return value;
+}
+
+void ExpectSurface(AgcDriver::VulkanDevice& device, const Block& block, const TargetFormat& target, const ColorTargetLayout& layout, const std::vector<std::uint8_t>& before, const ExportCase& exported, const std::array<std::uint32_t, 4>& expected, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            for (std::uint32_t channel = 0; channel < target.channels; ++channel) {
+                const auto at = layout.Offset(x, y) + channel * target.channelBytes;
+                const bool written = x < ScissorWidth && (exported.writeMask & (1u << channel)) != 0;
+                const auto want = written ? expected[channel] : Channel(before, at, target.channelBytes);
+                const auto got = Channel(stored, at, target.channelBytes);
+                if (got == want) continue;
+                char detail[192];
+                std::snprintf(detail, sizeof(detail), ": channel %u of pixel (%u, %u) %s holds 0x%08x, expected 0x%08x", channel, x, y, written ? "written" : "not written", got, want);
+                throw std::runtime_error(what + detail);
+            }
+        }
+    }
+}
+
+std::vector<std::uint8_t> Fill(Block& block) {
+    std::vector<std::uint32_t> words(block.bytes / 4u);
+    for (std::size_t index = 0; index < words.size(); ++index) words[index] = static_cast<std::uint32_t>(index * 0x9e3779b9u);
+    std::memcpy(block.data, words.data(), block.bytes);
+    return {block.data, block.data + block.bytes};
+}
+
+std::array<std::uint32_t, 4> Expected(const ExportCase& exported, const std::array<std::uint32_t, 4>& vgprs) {
+    if (exported.format == Export32AR.format) return {vgprs[0], 0u, 0u, vgprs[1]};
+    return vgprs;
+}
+
+void TargetTests(AgcDriver::VulkanDevice& device, const TargetFormat& target, const ExportCase& exported, std::span<const std::array<std::uint32_t, 4>> values, ColorTileMode mode, const char* kind) {
+    const auto elementBytes = target.channels * target.channelBytes;
+    const ColorTargetLayout layout(Width, Height, mode, elementBytes);
+    Block block((layout.Bytes() + BlockBytes - 1) / BlockBytes * BlockBytes);
+    const auto color = DecodeTarget(block, layout.Bytes(), target, mode == ColorTileMode::Linear ? LinearAttrib3 : TiledAttrib3);
+    auto before = Fill(block);
+    for (const auto& vgprs : values) {
+        Draw(device, color, exported, WordProgram(vgprs));
+        char what[160];
+        std::snprintf(what, sizeof(what), "a %s export of 0x%08x 0x%08x 0x%08x 0x%08x into a %s %s target", exported.name, vgprs[0], vgprs[1], vgprs[2], vgprs[3], kind, target.name);
+        ExpectSurface(device, block, target, layout, before, exported, Expected(exported, vgprs), what);
+        before = ReadBack(device, block);
+    }
+}
+
+void FormatTests(AgcDriver::VulkanDevice& device, const TargetFormat& target, const ExportCase& exported, std::span<const std::array<std::uint32_t, 4>> values) {
+    TargetTests(device, target, exported, values, ColorTileMode::RenderTarget, "tiled");
+    TargetTests(device, target, exported, values, ColorTileMode::Linear, "linear");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        constexpr std::array<std::uint32_t, 8> words{{0u, 1u, 0x3f800000u, 0x7fc00000u, 0xff800000u, 0x80000000u, 0xdeadbeefu, 0xffffffffu}};
+        std::vector<std::array<std::uint32_t, 4>> single;
+        for (const auto word : words) single.push_back({word, 0x11111111u, 0x22222222u, 0x33333333u});
+        FormatTests(*device, R32, Export32R, single);
+        std::vector<std::array<std::uint32_t, 4>> wide;
+        for (std::size_t index = 0; index < words.size(); ++index) wide.push_back({words[index], words[(index + 1) % words.size()], words[(index + 2) % words.size()], words[(index + 4) % words.size()]});
+        FormatTests(*device, R32G32, Export32GR, wide);
+        FormatTests(*device, R32G32B32A32, Export32AR, wide);
+        FormatTests(*device, R32G32B32A32, Export32ABGR, wide);
+        const std::vector<std::array<std::uint32_t, 4>> narrow{{0u, 0x11111111u, 0x22222222u, 0x33333333u}, {1u, 0u, 0u, 0u}, {0x7fu, 0u, 0u, 0u}, {0xa5u, 0u, 0u, 0u}, {0xffu, 0u, 0u, 0u}};
+        FormatTests(*device, R8, Export32R, narrow);
+        std::puts("UINT color target tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/VCvtPkU8F32RoundMode.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/VCvtPkU8F32RoundMode.cpp
new file mode 100644
index 0000000000..88725601dd
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/VCvtPkU8F32RoundMode.cpp
@@ -0,0 +1,150 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint32_t Inputs = 4;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 10> Code{
+    0x34020084u, 0x34040082u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0xd55e000au, 0x02010104u, 0xe0701000u,
+    0x80010a02u, 0xbf810000u,
+};
+
+alignas(256) std::array<std::uint32_t, 11> RoundModeCode{
+    0x34020084u, 0x34040082u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0xbfa40000u, 0xd55e000au, 0x02010104u,
+    0xe0701000u, 0x80010a02u, 0xbf810000u,
+};
+
+struct PackVector {
+    std::uint32_t value;
+    std::uint32_t denormalsFlushed[4];
+    std::uint32_t denormalsKept[4];
+};
+
+constexpr std::array<PackVector, 38> Vectors{{
+    {0x00000000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x3e000000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x3e800000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x3f000000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x3f400000u, {0x01u, 0x01u, 0x00u, 0x00u}, {0x01u, 0x01u, 0x00u, 0x00u}},
+    {0x3f800000u, {0x01u, 0x01u, 0x01u, 0x01u}, {0x01u, 0x01u, 0x01u, 0x01u}},
+    {0x3fa00000u, {0x01u, 0x02u, 0x01u, 0x01u}, {0x01u, 0x02u, 0x01u, 0x01u}},
+    {0x3fc00000u, {0x02u, 0x02u, 0x01u, 0x01u}, {0x02u, 0x02u, 0x01u, 0x01u}},
+    {0x40200000u, {0x02u, 0x03u, 0x02u, 0x02u}, {0x02u, 0x03u, 0x02u, 0x02u}},
+    {0x40600000u, {0x04u, 0x04u, 0x03u, 0x03u}, {0x04u, 0x04u, 0x03u, 0x03u}},
+    {0x40700000u, {0x04u, 0x04u, 0x03u, 0x03u}, {0x04u, 0x04u, 0x03u, 0x03u}},
+    {0x42ff0000u, {0x80u, 0x80u, 0x7fu, 0x7fu}, {0x80u, 0x80u, 0x7fu, 0x7fu}},
+    {0x43008000u, {0x80u, 0x81u, 0x80u, 0x80u}, {0x80u, 0x81u, 0x80u, 0x80u}},
+    {0x43482000u, {0xc8u, 0xc9u, 0xc8u, 0xc8u}, {0xc8u, 0xc9u, 0xc8u, 0xc8u}},
+    {0x437e8000u, {0xfeu, 0xffu, 0xfeu, 0xfeu}, {0xfeu, 0xffu, 0xfeu, 0xfeu}},
+    {0x437ea000u, {0xffu, 0xffu, 0xfeu, 0xfeu}, {0xffu, 0xffu, 0xfeu, 0xfeu}},
+    {0x437ee000u, {0xffu, 0xffu, 0xfeu, 0xfeu}, {0xffu, 0xffu, 0xfeu, 0xfeu}},
+    {0x437f0000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437f4000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437f7fffu, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437f8000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437fe000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x43800000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x501502f9u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0xbe000000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xbf000000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xbeffffffu, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xbf800000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xd01502f9u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x00000001u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x80000001u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x007fffffu, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x00800000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x7f800000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0xff800000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x7fc00000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xffc00000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x7f800001u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+}};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+void Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, ShaderRecompiler::ShaderFloatMode floatMode) {
+    Input.fill(0u);
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) Input[lane * Inputs] = Vectors[lane].value;
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void Check(bool kept, std::uint32_t rounding, bool ieee, const std::string& setting) {
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        const auto& vector = Vectors[lane];
+        const auto expected = kept ? vector.denormalsKept[rounding] : vector.denormalsFlushed[rounding];
+        Require(Output[lane] == expected, std::string("v_cvt_pk_u8_f32 round mode ") + std::to_string(rounding) + setting + (kept ? ", f32 denormals kept" : ", f32 denormals flushed") +
+                                              (ieee ? ", IEEE=1" : ", IEEE=0") + " of " + Hex(vector.value) + " is " + Hex(Output[lane]) + ", expected " + Hex(expected));
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        for (std::uint32_t denormals = 0; denormals < 4u; ++denormals) {
+            const bool kept = (denormals & 1u) != 0u;
+            const std::string field = ", f32 denormal mode " + std::to_string(denormals);
+            for (std::uint32_t rounding = 0; rounding < 4u; ++rounding) {
+                for (const bool ieee : {false, true}) {
+                    Run(*device, Code, ShaderRecompiler::ShaderFloatMode{0xc0u | denormals << 4u | rounding, true, ieee, false});
+                    Check(kept, rounding, ieee, field);
+                    RoundModeCode[5] = 0xbfa40000u | rounding;
+                    Run(*device, RoundModeCode, ShaderRecompiler::ShaderFloatMode{0xc0u | denormals << 4u, true, ieee, false});
+                    Check(kept, rounding, ieee, field + " set by s_round_mode");
+                }
+            }
+        }
+        std::puts("v_cvt_pk_u8_f32 round mode tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDistances.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDistances.cpp
index 08adb9fde4..23c82c25eb 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDistances.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDistances.cpp
@@ -18,6 +18,7 @@ using ShaderRecompiler::ShaderStage;
 constexpr std::uint32_t Width = 192;
 constexpr std::uint32_t Height = 128;
 constexpr std::uint32_t DistanceVector = 0x00400000u;
+constexpr std::uint32_t CullDistanceEnables = 0x0000ff00u;
 alignas(256) std::array<std::byte, Width * Height * 4> Pixels{};
 
 alignas(256) constexpr std::array<std::uint32_t, 10> VertexCode{
@@ -185,14 +186,19 @@ int main() {
             std::printf("skipped, subgroup size %u cannot hold a wave32\n", device->Target().subgroupSize);
             return VulkanTestSkipped;
         }
+        const bool cullDistance = TargetHasCapability(device->Target(), spv::CapabilityCullDistance);
+        if (!cullDistance) std::puts("cull distance cases skipped, the device has no shaderCullDistance");
+        const auto runs = [&](const Row& row) { return cullDistance || (row.control & CullDistanceEnables) == 0u; };
         for (const auto waveSize : {64u, 32u}) {
             for (const auto& row : Rows) {
+                if (!runs(row)) continue;
                 Draw(*device, waveSize, row, false);
                 Check(row, waveSize, false);
             }
         }
         if (device->Target().mesh.has_value()) {
             for (const auto& row : Rows) {
+                if (!runs(row)) continue;
                 Draw(*device, 64u, row, true);
                 Check(row, 64u, true);
             }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDraw.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDraw.cpp
index 076e006c49..b4d62cdc54 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDraw.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/VertexClipCullDraw.cpp
@@ -33,6 +33,7 @@ using AgcDriver::Graphics::Require;
 constexpr std::uint32_t Width = 192;
 constexpr std::uint32_t Height = 128;
 constexpr std::uint32_t DistanceVector = 0x00400000u;
+constexpr std::uint32_t CullDistanceEnables = 0x0000ff00u;
 constexpr std::uint32_t SetContextReg = 0x69u;
 constexpr std::uint32_t SetShReg = 0x76u;
 constexpr std::uint32_t SetUconfigReg = 0x79u;
@@ -212,14 +213,18 @@ int main(int argc, char** argv) {
         const bool noKey = argc > 1 && std::string(argv[1]) == "no-key";
         if (noKey) Require(std::getenv("APS5_NO_DRAW_KEY") != nullptr, "the no-key run must start with APS5_NO_DRAW_KEY set");
         PositionExportLayoutTests();
+        bool cullDistance = false;
         {
             const auto device = OpenVulkanTestDevice();
             if (!device) return VulkanTestSkipped;
+            cullDistance = TargetHasCapability(device->Target(), spv::CapabilityCullDistance);
         }
+        if (!cullDistance) std::puts("cull distance steps skipped, the device has no shaderCullDistance");
         ColorMemory = AllocateWatched(2 * Block);
         Register(VertexShader, VertexCode.data(), sizeof(VertexCode), 2);
         Register(PixelShader, PixelCode.data(), sizeof(PixelCode), 1);
         for (const auto& step : Steps) {
+            if (!cullDistance && (step.control & CullDistanceEnables) != 0u) continue;
             std::array<Vertex, 3> vertices{};
             for (std::size_t i = 0; i < vertices.size(); ++i) {
                 vertices[i] = {{PositionX[i], PositionY[i], 0.5f, 1.0f}, {step.component0[i], step.component1[i], step.component2[i], 0.0f}};
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/VertexUserDataTail.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/VertexUserDataTail.cpp
index df9e6f2c6d..2130d6f232 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/VertexUserDataTail.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/VertexUserDataTail.cpp
@@ -125,7 +125,7 @@ void ControlStateDraws(std::vector<std::uint32_t> prefix) {
     CheckBranchColors(activeExec, emptyExec, "EXEC");
 }
 
-void VertexTailDraws() {
+void VertexTailDraws(bool cullDistance) {
     std::vector<std::uint32_t> prefix{
         0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
         0x7e060280u, 0x7e0802f2u, 0xbe8c03ffu, 0x3f800000u, 0xbf060c0cu,
@@ -142,8 +142,12 @@ void VertexTailDraws() {
     alignas(256) const std::array<std::uint32_t, 7> clipContinuation{0xbf840005u, 0x7e08020cu, 0xf80000cfu, 0x04030201u, 0xf80008dfu, 0x01010101u, 0xbf810000u};
     const auto clipped = Check(prefix, clipContinuation, 0x00400001u, clipContinuation.size());
     Require(clipped != original && std::count(clipped.begin(), clipped.end(), Kept) > kept, "a clip distance exported by the continuation did not clip the triangle");
-    const auto culled = Check(prefix, clipContinuation, 0x00400100u, clipContinuation.size());
-    Require(culled == original, "a mixed-sign cull distance discarded the triangle");
+    if (cullDistance) {
+        const auto culled = Check(prefix, clipContinuation, 0x00400100u, clipContinuation.size());
+        Require(culled == original, "a mixed-sign cull distance discarded the triangle");
+    } else {
+        std::puts("cull distance draw skipped, the device has no shaderCullDistance");
+    }
     ControlStateDraws(prefix);
 }
 
@@ -151,11 +155,13 @@ void VertexTailDraws() {
 
 int main() {
     try {
+        bool cullDistance = false;
         {
             const auto device = OpenVulkanTestDevice();
             if (!device) return VulkanTestSkipped;
+            cullDistance = TargetHasCapability(device->Target(), spv::CapabilityCullDistance);
         }
-        VertexTailDraws();
+        VertexTailDraws(cullDistance);
         AgcDriverShutdown_nid_postfix();
         std::puts("vertex user-data tail tests passed");
         return 0;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp
index f597fc79ee..a18422c711 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp
@@ -7,7 +7,13 @@
 #include <iostream>
 #include <span>
 #include <string>
+#include <string_view>
 #include <vector>
+#ifdef _WIN32
+#include <io.h>
+#else
+#include <unistd.h>
+#endif
 
 namespace {
 
@@ -15,7 +21,8 @@ using AgcDriver::Graphics::Require;
 using ShaderRecompiler::ShaderStage;
 
 constexpr std::uint32_t Threads = 32;
-alignas(256) std::array<std::uint32_t, Threads> Output{};
+constexpr std::uint32_t WideThreads = 64;
+alignas(256) std::array<std::uint32_t, WideThreads> Output{};
 
 alignas(256) constexpr std::array<std::uint32_t, 26> Code{
     0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x00010004, 0xd7610003, 0x00010205, 0xd7610003, 0x00010406,
@@ -29,28 +36,111 @@ alignas(256) constexpr std::array<std::uint32_t, 27> IndexedStoreCode{
     0xd7600009, 0x00010303, 0xd760000a, 0x00010503, 0xd760000b, 0x00010703, 0xe0702000, 0x80020001, 0xbf810000,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 28> ReusedRegisterCode{
+    0x7e060300, 0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x00010004, 0xd7610003, 0x00010205, 0xd7610003,
+    0x00010406, 0xd7610003, 0x00010607, 0x7e048500, 0xbe840380, 0xbe850380, 0xbe860380, 0xbe870380, 0xd7600008,
+    0x00010103, 0xd7600009, 0x00010303, 0xd760000a, 0x00010503, 0xd760000b, 0x00010703, 0xe0702000, 0x80020001,
+    0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 14> OverwrittenSpillCode{
+    0x877c8104, 0x7e040280, 0x7e060280, 0xd7610004, 0x00010008, 0x7e048500, 0x7e0802f2, 0xd7600008, 0x00010104,
+    0xf09c0f08, 0x00400802, 0xe0700000, 0x80030800, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 13> AliasingStoreCode{
+    0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x0001000d, 0x7e040287, 0x7e048500,
+    0xd7600008, 0x00010103, 0x7e040208, 0xe0702000, 0x80010201, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 13> WideAliasingStoreCode{
+    0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x0001500d, 0x7e040287, 0x7e048500,
+    0xd7600008, 0x00015103, 0x7e040208, 0xe0702000, 0x80010201, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 12> StoreAfterReadCode{
+    0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x0001000d, 0xd7600008,
+    0x00010103, 0x7e048500, 0x7e040208, 0xe0702000, 0x80010201, 0xbf810000,
+};
+
+constexpr std::uint32_t Spilled = 0x1234u;
+
+class StderrCapture {
+public:
+    StderrCapture() {
+        std::fflush(stderr);
+        file = std::tmpfile();
+        Require(file != nullptr, "cannot open a temporary file for stderr");
+#ifdef _WIN32
+        saved = _dup(_fileno(stderr));
+        _dup2(_fileno(file), _fileno(stderr));
+#else
+        saved = dup(fileno(stderr));
+        dup2(fileno(file), fileno(stderr));
+#endif
+    }
+    std::string Finish() {
+        std::fflush(stderr);
+#ifdef _WIN32
+        _dup2(saved, _fileno(stderr));
+        _close(saved);
+#else
+        dup2(saved, fileno(stderr));
+        close(saved);
+#endif
+        std::rewind(file);
+        std::string text;
+        char buffer[4096];
+        for (std::size_t read = 0; (read = std::fread(buffer, 1, sizeof(buffer), file)) != 0;) text.append(buffer, read);
+        std::fclose(file);
+        std::fwrite(text.data(), 1, text.size(), stderr);
+        return text;
+    }
+
+private:
+    std::FILE* file = nullptr;
+    int saved = -1;
+};
+
 std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t count) {
     const auto address = reinterpret_cast<std::uintptr_t>(data);
     return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (4u << 16u), count, 0x11016facu};
 }
 
-void Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code) {
-    Output.fill(0xdeadbeefu);
-    std::vector<std::uint32_t> userData(16, 0u);
-    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size()));
-    std::copy(output.begin(), output.end(), userData.begin() + 4);
+ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::span<const std::uint32_t> userData, std::uint32_t waveSize = Threads) {
     const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
-    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{waveSize, 1, 1}, 0, {false, false, false}, false, 1};
     ShaderRecompiler::RecompileRequest request{
         {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
-        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        {waveSize, 0, userData, compute, std::nullopt, std::nullopt, memory},
         device.Target(),
         {0, 0, 0, 128}
     };
     request.useCache = false;
-    const auto result = ShaderRecompiler::Recompile(request);
+    return ShaderRecompiler::Recompile(request);
+}
+
+std::string Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::uint32_t relativeIndex = 0, std::uint32_t waveSize = Threads) {
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size()));
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    userData[12] = relativeIndex;
+    userData[13] = Spilled;
+    const auto result = Compile(device, code, userData, waveSize);
+    StderrCapture log;
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
+    return log.Finish();
+}
+
+constexpr std::string_view Overwritten = "which holds a scalar spilled with v_writelane_b32 that a later v_readlane_b32 was replaced with";
+
+void CheckSpilled(const std::string& log, const std::string& name, std::uint32_t lanes = Threads) {
+    Require(log.find(Overwritten) == std::string::npos, name + ": reported an overwritten spill: " + log);
+    for (std::uint32_t tid = 0; tid < lanes; ++tid) {
+        Require(Output[tid] == Spilled, name + ": lane " + std::to_string(tid) + " stored " + std::to_string(Output[tid]) + ", expected the spilled " + std::to_string(Spilled));
+    }
 }
 
 void Check(const std::string& name) {
@@ -59,6 +149,17 @@ void Check(const std::string& name) {
     }
 }
 
+void CheckRefused(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::string& name) {
+    const std::vector<std::uint32_t> userData(16, 0u);
+    std::string error;
+    try {
+        static_cast<void>(Compile(device, code, userData));
+    } catch (const std::exception& thrown) {
+        error = thrown.what();
+    }
+    Require(error.find("GetSamplerResource dword 0 is not a valid runtime value") != std::string::npos, name + ": " + (error.empty() ? std::string("recompiled") : error));
+}
+
 }
 
 int main() {
@@ -73,6 +174,20 @@ int main() {
         Check("window lane spill");
         Run(*device, IndexedStoreCode);
         Check("window lane spill past an indexed store");
+        CheckRefused(*device, OverwrittenSpillCode, "window lane spill overwritten by an ordinary write before its v_readlane");
+        Run(*device, ReusedRegisterCode);
+        Check("window lane spill into a register with ordinary writes past an indexed store");
+        CheckSpilled(Run(*device, AliasingStoreCode, 0), "window lane spill past an indexed store with m0 = 0");
+        const auto aliased = Run(*device, AliasingStoreCode, 1);
+        Require(aliased.find(Overwritten) != std::string::npos, "window lane spill overwritten by an indexed store with m0 = 1 was not reported: " + aliased);
+        CheckSpilled(Run(*device, StoreAfterReadCode, 1), "window lane spill overwritten by an indexed store with m0 = 1 after its v_readlane");
+        if (device->Target().subgroupSize >= WideThreads) {
+            CheckSpilled(Run(*device, WideAliasingStoreCode, 0, WideThreads), "wave64 window lane spill in lane 40 past an indexed store with m0 = 0", WideThreads);
+            const auto wide = Run(*device, WideAliasingStoreCode, 1, WideThreads);
+            Require(wide.find("stored 40 in lane 40 of vector window slot 1") != std::string::npos, "wave64 window lane spill in lane 40 overwritten by an indexed store with m0 = 1 was not reported: " + wide);
+        } else {
+            std::printf("wave64 cases skipped, subgroup size %u\n", device->Target().subgroupSize);
+        }
         std::puts("window lane spill tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp
index e5804bf70a..0642450135 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp
@@ -124,6 +124,28 @@ void Draw(AgcDriver::VulkanDevice& device, const Case& value) {
     device.WaitIdle();
 }
 
+void DescriptorDiagnostics(AgcDriver::VulkanDevice& device) {
+    for (std::uint32_t component = 0; component < 4u; ++component) {
+        for (const auto selector : {2u, 3u}) {
+            const auto shift = component * 3u;
+            const Case value{3u, 16u, true, "reserved selector", (0xfacu & ~(7u << shift)) | (selector << shift)};
+            const auto fields = VertexBufferDescriptor(value);
+            char expected[192];
+            std::snprintf(expected, sizeof(expected), "reserved prepared vertex component selector %u at location 0 component %u (V#=[%08x %08x %08x %08x])",
+                selector, component, fields[0], fields[1], fields[2], fields[3]);
+            bool rejected = false;
+            try {
+                Draw(device, value);
+            } catch (const std::runtime_error& error) {
+                const std::string message(error.what());
+                Require(message.find(expected) != std::string::npos, "reserved selector error did not identify the component and descriptor: " + message);
+                rejected = true;
+            }
+            Require(rejected, "a reserved vertex component selector was accepted");
+        }
+    }
+}
+
 void Check(const Case& value) {
     for (std::uint32_t vertex = 0; vertex < Vertices; ++vertex) {
         for (std::uint32_t component = 0; component < 4u; ++component) {
@@ -169,6 +191,7 @@ int main() {
             Draw(*device, value);
             Check(value);
         }
+        DescriptorDiagnostics(*device);
         std::puts("zero-stride vertex fetch tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp
new file mode 100644
index 0000000000..943f962b6e
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp
@@ -0,0 +1,743 @@
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
+#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameDumpIo.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cerrno>
+#include <chrono>
+#include <condition_variable>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <filesystem>
+#include <fstream>
+#include <future>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <utility>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCall;
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+using AgcDriver::FrameMemoryChunk;
+using AgcDriver::FrameMemoryKind;
+using AgcDriver::FrameRangeAccess;
+using AgcDriver::FrameRangeKind;
+using Clock = std::chrono::steady_clock;
+
+struct Dump {
+    std::uint64_t address = 0;
+    std::uint64_t bytes = 0;
+    std::filesystem::path path;
+};
+
+struct Options {
+    std::filesystem::path directory;
+    std::vector<Dump> dumps;
+    std::filesystem::path frames;
+    bool pace = true;
+    bool strict = false;
+    std::chrono::milliseconds paceTimeout{10000};
+    std::chrono::milliseconds memoryPaceTimeout{10000};
+    std::chrono::milliseconds releaseAfter{3};
+    std::chrono::milliseconds drainTimeout{10000};
+    bool release = true;
+    bool synthesize = true;
+};
+
+class Frames {
+public:
+    void MarkReady() {
+        std::lock_guard lock(mutex);
+        ready.push_back(Clock::now());
+    }
+
+    void Failed(std::exception_ptr error) {
+        std::lock_guard lock(mutex);
+        if (!failure) failure = error;
+    }
+
+    std::vector<Clock::time_point> Times() const {
+        std::lock_guard lock(mutex);
+        return ready;
+    }
+
+    std::exception_ptr Failure() const {
+        std::lock_guard lock(mutex);
+        return failure;
+    }
+
+private:
+    mutable std::mutex mutex;
+    std::vector<Clock::time_point> ready;
+    std::exception_ptr failure;
+};
+
+class ReplayFlip final : public AgcDriver::IFlipRequest {
+public:
+    explicit ReplayFlip(Frames& frames) : frames(frames) {}
+    void GpuReady(const std::shared_ptr<AgcDriver::FrameTiming>&) override { frames.MarkReady(); }
+    void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); }
+
+private:
+    Frames& frames;
+};
+
+class ReplayRenderingWait final : public AgcDriver::IRenderingWait {
+public:
+    void Wait() override {}
+};
+
+class ReplayOutput final : public AgcDriver::IVideoOutput {
+public:
+    explicit ReplayOutput(Frames& frames) : frames(frames) {}
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared<ReplayFlip>(frames); }
+    std::shared_ptr<AgcDriver::IRenderingWait> CaptureRenderingWait(std::uint32_t) override { return std::make_shared<ReplayRenderingWait>(); }
+    void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); }
+
+private:
+    Frames& frames;
+};
+
+std::uint64_t headerNumber(const std::string& header, std::string_view key) {
+    const auto quoted = "\"" + std::string(key) + "\":";
+    const auto at = header.find(quoted);
+    if (at == std::string::npos) throw std::runtime_error("frame replay: the capture header has no " + std::string(key));
+    return std::strtoull(header.c_str() + at + quoted.size(), nullptr, 10);
+}
+
+void restore(const FrameCaptureReader& reader, const FrameMemoryChunk& chunk) {
+    reader.Read(chunk, std::span(reinterpret_cast<std::byte*>(static_cast<std::uintptr_t>(chunk.address)), static_cast<std::size_t>(chunk.bytes)));
+}
+
+bool committedWritable(std::uint64_t address, std::uint64_t bytes) {
+#ifdef _WIN32
+    for (auto at = address; at < address + bytes;) {
+        MEMORY_BASIC_INFORMATION info{};
+        if (VirtualQuery(reinterpret_cast<const void*>(static_cast<std::uintptr_t>(at)), &info, sizeof(info)) == 0 || info.State != MEM_COMMIT) return false;
+        const auto access = info.Protect & 0xffu;
+        if ((info.Protect & PAGE_GUARD) != 0 || (access != PAGE_READWRITE && access != PAGE_EXECUTE_READWRITE)) return false;
+        at = reinterpret_cast<std::uintptr_t>(info.BaseAddress) + info.RegionSize;
+    }
+    return true;
+#else
+    static_cast<void>(address);
+    static_cast<void>(bytes);
+    return false;
+#endif
+}
+
+std::pair<std::uint64_t, std::uint64_t> progress();
+
+struct Skipped {
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> ranges;
+    std::uint64_t bytes = 0;
+
+    void Add(const FrameMemoryChunk& chunk) {
+        ranges.emplace_back(chunk.address, chunk.address + chunk.bytes);
+        bytes += chunk.bytes;
+    }
+
+    bool Overlaps(const FrameMemoryChunk& chunk) const {
+        return std::any_of(ranges.begin(), ranges.end(), [&](const auto& range) { return chunk.address < range.second && range.first < chunk.address + chunk.bytes; });
+    }
+};
+
+void mapHostRanges(const FrameCaptureReader& reader, Skipped& skipped) {
+    std::vector<const FrameMemoryChunk*> host;
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Range && chunk.rangeKind == FrameRangeKind::Host) host.push_back(&chunk);
+    }
+#ifdef _WIN32
+    constexpr std::uint64_t Granularity = 64u * 1024u;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> envelopes;
+    for (const auto* chunk : host) {
+        const auto begin = chunk->address & ~(Granularity - 1);
+        const auto end = (chunk->address + chunk->bytes + Granularity - 1) & ~(Granularity - 1);
+        if (!envelopes.empty() && begin <= envelopes.back().second) envelopes.back().second = std::max(envelopes.back().second, end);
+        else envelopes.emplace_back(begin, end);
+    }
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> refused;
+    for (const auto& [begin, end] : envelopes) {
+        if (VirtualAlloc(reinterpret_cast<void*>(static_cast<std::uintptr_t>(begin)), static_cast<SIZE_T>(end - begin), MEM_RESERVE, PAGE_NOACCESS) == nullptr) refused.emplace_back(begin, end);
+    }
+    for (const auto* chunk : host) {
+        const bool blocked = std::any_of(refused.begin(), refused.end(), [&](const auto& range) { return chunk->address < range.second && range.first < chunk->address + chunk->bytes; });
+        if (!blocked && VirtualAlloc(reinterpret_cast<void*>(static_cast<std::uintptr_t>(chunk->address)), static_cast<SIZE_T>(chunk->bytes), MEM_COMMIT, PAGE_READWRITE) != nullptr) continue;
+        if ((chunk->access & FrameRangeAccess::Gpu) != 0) throw std::runtime_error("frame replay: cannot map the GPU-visible host range at " + std::to_string(chunk->address));
+        skipped.Add(*chunk);
+    }
+#else
+    for (const auto* chunk : host) skipped.Add(*chunk);
+#endif
+}
+
+Skipped restoreMemory(const FrameCaptureReader& reader) {
+    std::uintptr_t base = 0;
+    std::size_t size = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&base, &size);
+    if (!reader.Header().empty() && headerNumber(reader.Header(), "arena_base") != base) throw std::runtime_error("frame replay: the guest arena is at a different address than in the capture");
+    progress();
+    Skipped skipped;
+    mapHostRanges(reader, skipped);
+    {
+        GuestAllocations::Mutation mutation;
+        for (const auto& chunk : reader.Chunks()) {
+            if (chunk.kind != FrameMemoryKind::Range || chunk.rangeKind == FrameRangeKind::Host) continue;
+            const bool gpu = (chunk.access & FrameRangeAccess::Gpu) != 0;
+            if (committedWritable(chunk.address, chunk.bytes)) {
+                if (!gpu) skipped.Add(chunk);
+                else std::memset(reinterpret_cast<void*>(static_cast<std::uintptr_t>(chunk.address)), 0, static_cast<std::size_t>(chunk.bytes));
+                continue;
+            }
+            auto* const pointer = reinterpret_cast<void*>(static_cast<std::uintptr_t>(chunk.address));
+            const auto bytes = static_cast<std::size_t>(chunk.bytes);
+            try {
+                GuestArena::GuestArenaMarkUsed_nid_postfix(pointer, bytes);
+            } catch (const std::exception&) {
+                if (gpu) throw;
+                skipped.Add(chunk);
+                continue;
+            }
+            GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, 0x04, bytes);
+            mutation.Add(pointer, bytes, (chunk.access & FrameRangeAccess::Readable) != 0, (chunk.access & FrameRangeAccess::Writable) != 0, gpu);
+        }
+    }
+    std::vector<const FrameMemoryChunk*> snapshot;
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Snapshot && !skipped.Overlaps(chunk)) snapshot.push_back(&chunk);
+    }
+    const auto workers = std::max<std::size_t>(1, std::thread::hardware_concurrency());
+    for (std::size_t first = 0; first < snapshot.size(); first += workers) {
+        std::vector<std::future<void>> pending;
+        for (auto index = first; index < std::min(snapshot.size(), first + workers); ++index) {
+            pending.push_back(std::async(std::launch::async, [&reader, chunk = snapshot[index]] { restore(reader, *chunk); }));
+        }
+        for (auto& future : pending) future.get();
+    }
+    return skipped;
+}
+
+std::pair<std::uint64_t, std::uint64_t> progress() {
+    std::uint64_t accepted = 0;
+    std::uint64_t completed = 0;
+    AgcDriverSerialProgress_nid_postfix(&accepted, &completed);
+    return {accepted, completed};
+}
+
+struct Replay {
+    const Options& options;
+    const FrameCaptureReader& reader;
+    Frames frames;
+    std::map<std::uint32_t, std::shared_ptr<ReplayOutput>> outputs;
+    std::mutex memoryMutex;
+    std::map<std::uint64_t, std::vector<const FrameMemoryChunk*>> groups;
+    Skipped skipped;
+    std::atomic<std::uint64_t> paceTimeouts{0};
+    std::atomic<std::uint64_t> staleRegistrations{0};
+    std::atomic<std::uint64_t> failedRegistrations{0};
+    std::atomic<std::uint64_t> submits{0};
+    std::atomic<std::uint64_t> deltaBytes{0};
+    std::atomic<std::int64_t> paceWaitedNs{0};
+    std::atomic<bool> stalled{false};
+    std::atomic<std::uint64_t> stalledAt{0};
+    std::atomic<std::uint64_t> earlyReleases{0};
+    std::atomic<std::uint64_t> lateReleases{0};
+    std::atomic<std::uint64_t> syntheticReleases{0};
+    std::atomic<std::size_t> sequenced{0};
+    std::uint64_t unfinished = 0;
+    std::size_t threads = 0;
+    bool recording = false;
+    Clock::time_point startedAt{};
+    Clock::time_point endedAt{};
+
+    double paceWaitedSeconds() const {
+        return static_cast<double>(paceWaitedNs.load()) / 1e9;
+    }
+
+    void report() const {
+        const auto [accepted, completed] = progress();
+        std::fprintf(stderr, "[frame-replay] %llu submits, %zu frames ready, %.1f s since the first frame, pacing waited %.1f s (%llu timeouts), serials %llu/%llu\n",
+                     static_cast<unsigned long long>(submits.load()), frames.Times().size(), std::chrono::duration<double>(Clock::now() - startedAt).count(), paceWaitedSeconds(),
+                     static_cast<unsigned long long>(paceTimeouts.load()), static_cast<unsigned long long>(completed), static_cast<unsigned long long>(accepted));
+    }
+
+    static bool paced(FrameCallKind kind) {
+        return kind == FrameCallKind::Submit || kind == FrameCallKind::Flip || kind == FrameCallKind::ReserveEopFlip || kind == FrameCallKind::Suspend || kind == FrameCallKind::Memory;
+    }
+
+    void pace(const FrameCall& call) {
+        if (!options.pace || !recording || !paced(call.kind) || call.accepted < call.completed) return;
+        if (stalled.load()) {
+            if (progress().second == stalledAt.load()) return;
+            stalled.store(false);
+        }
+        const auto inFlight = call.accepted - call.completed;
+        const bool memory = call.kind == FrameCallKind::Memory;
+        const auto began = Clock::now();
+        const auto deadline = began + (memory ? options.memoryPaceTimeout : options.paceTimeout);
+        const auto waited = [&] { paceWaitedNs += std::chrono::duration_cast<std::chrono::nanoseconds>(Clock::now() - began).count(); };
+        while (true) {
+            const auto [accepted, completed] = progress();
+            if (accepted - completed <= inFlight) return waited();
+            if (Clock::now() >= deadline) {
+                waited();
+                if (memory) return;
+                stalled.store(true);
+                stalledAt.store(completed);
+                std::fprintf(stderr, "[frame-replay] pacing gave up at call %llu (%s): serials %llu/%llu, the capture had %llu in flight\n", static_cast<unsigned long long>(call.ordinal),
+                             std::string(AgcDriver::FrameCallName(call.kind)).c_str(), static_cast<unsigned long long>(completed), static_cast<unsigned long long>(accepted), static_cast<unsigned long long>(inFlight));
+                ++paceTimeouts;
+                if (options.strict) throw std::runtime_error("frame replay: call " + std::to_string(call.ordinal) + " waited longer than the pacing timeout");
+                return;
+            }
+            std::this_thread::sleep_for(std::chrono::microseconds(50));
+        }
+    }
+
+    void execute(const FrameCall& call) {
+        pace(call);
+        switch (call.kind) {
+        case FrameCallKind::RegisterShader:
+            registration([&] { AgcDriverRegisterShader_nid_postfix(shader(call.address)); });
+            return;
+        case FrameCallKind::ResolveShaderAbi:
+            registration([&] { AgcDriverResolveShaderAbi_nid_postfix(shader(call.address), call.context, call.primitive); });
+            return;
+        case FrameCallKind::ResolveGraphicsAbi:
+            registration([&] { AgcDriverResolveGraphicsAbi_nid_postfix(shader(call.values.at(0)), shader(call.values.at(1)), static_cast<std::uint32_t>(call.values.at(2))); });
+            return;
+        case FrameCallKind::ResolveGraphicsStagesAbi: {
+            std::vector<const Shader*> stages;
+            for (const auto value : call.values) stages.push_back(shader(value));
+            registration([&] { AgcDriverResolveGraphicsStagesAbi_nid_postfix(stages, call.context, call.primitive); });
+            return;
+        }
+        case FrameCallKind::RegisterVideoOutput: {
+            const auto handle = static_cast<std::uint32_t>(call.values.at(0));
+            auto output = std::make_shared<ReplayOutput>(frames);
+            AgcDriverRegisterVideoOutput_nid_postfix(handle, output);
+            outputs.emplace(handle, std::move(output));
+            return;
+        }
+        case FrameCallKind::UnregisterVideoOutput: {
+            const auto handle = static_cast<std::uint32_t>(call.values.at(0));
+            AgcDriverUnregisterVideoOutput_nid_postfix(handle, outputs.at(handle));
+            outputs.erase(handle);
+            return;
+        }
+        case FrameCallKind::SetTessellationFactorRing:
+            sceAgcDriverSetTFRing(reinterpret_cast<const volatile void*>(static_cast<std::uintptr_t>(call.address)), static_cast<std::uint32_t>(call.size));
+            return;
+        case FrameCallKind::Submit: {
+            const Packet packet{reinterpret_cast<std::uint32_t*>(static_cast<std::uintptr_t>(call.address)), static_cast<std::uint32_t>(call.size), static_cast<std::uint8_t>(call.flags), {}};
+            if (call.queue == 0) sceAgcDriverSubmitDcb(&packet);
+            else sceAgcDriverSubmitAcb(call.queue, &packet);
+            if (++submits % 25 == 0) report();
+            return;
+        }
+        case FrameCallKind::Flip:
+            AgcDriverSubmitFlip_nid_postfix(flipInfo(call));
+            return;
+        case FrameCallKind::ReserveEopFlip: {
+            const auto token = static_cast<std::uint32_t>(call.values.at(4));
+            if (AgcDriverReserveEopFlipAt_nid_postfix(flipInfo(call), token) != token) throw std::runtime_error("frame replay: EOP flip token " + std::to_string(token) + " was not reserved");
+            return;
+        }
+        case FrameCallKind::Suspend:
+            AgcDriverSuspendPoint_nid_postfix();
+            return;
+        case FrameCallKind::Memory: {
+            std::lock_guard lock(memoryMutex);
+            const auto found = groups.find(call.values.at(0));
+            if (found == groups.end()) return;
+            for (const auto* chunk : found->second) {
+                if (skipped.Overlaps(*chunk)) continue;
+                restore(reader, *chunk);
+                deltaBytes += chunk->bytes;
+            }
+            return;
+        }
+        case FrameCallKind::FrameStart:
+        case FrameCallKind::End:
+        case FrameCallKind::DisplayBuffer:
+            return;
+        }
+        throw std::runtime_error("frame replay: unknown call kind");
+    }
+
+    static std::uint64_t load(std::uint64_t address, std::size_t bytes) {
+        std::uint64_t value = 0;
+        std::memcpy(&value, reinterpret_cast<const void*>(static_cast<std::uintptr_t>(address)), bytes);
+        return value;
+    }
+
+    static bool satisfies(const AgcDriver::AwaitedWait& wait, std::uint64_t value) {
+        const auto masked = value & wait.mask;
+        const auto reference = wait.reference & wait.mask;
+        switch (wait.function) {
+        case 1: return masked < reference;
+        case 2: return masked <= reference;
+        case 3: return masked == reference;
+        case 4: return masked != reference;
+        case 5: return masked >= reference;
+        case 6: return masked > reference;
+        default: return false;
+        }
+    }
+
+    static std::optional<std::uint64_t> satisfying(const AgcDriver::AwaitedWait& wait, std::uint64_t current) {
+        const auto keep = current & ~wait.mask;
+        const auto reference = wait.reference & wait.mask;
+        switch (wait.function) {
+        case 2:
+        case 3:
+        case 5: return keep | reference;
+        case 1: return reference == 0 ? std::nullopt : std::optional<std::uint64_t>(keep);
+        case 4: return keep | (~reference & wait.mask);
+        case 6: return reference == wait.mask ? std::nullopt : std::optional<std::uint64_t>(keep | ((reference + 1) & wait.mask));
+        default: return std::nullopt;
+        }
+    }
+
+    bool writeRecordedValue(const FrameCall& call, const AgcDriver::AwaitedWait& wait) {
+        if (call.kind != FrameCallKind::Memory) return false;
+        const auto found = groups.find(call.values.at(0));
+        if (found == groups.end()) return false;
+        const auto address = wait.address;
+        for (const auto* chunk : found->second) {
+            if (chunk->address > address || address + 4 > chunk->address + chunk->bytes || skipped.Overlaps(*chunk)) continue;
+            const auto bytes = reader.Read(*chunk);
+            const auto length = static_cast<std::size_t>(std::min<std::uint64_t>(wait.bytes == 8 ? 8 : 4, chunk->address + chunk->bytes - address));
+            const auto* const recorded = bytes.data() + (address - chunk->address);
+            auto* const target = reinterpret_cast<std::byte*>(static_cast<std::uintptr_t>(address));
+            if (std::memcmp(target, recorded, length) == 0) return false;
+            std::uint64_t value = 0;
+            std::memcpy(&value, recorded, length);
+            if (wait.function != 0 && !satisfies(wait, value)) return false;
+            std::memcpy(target, recorded, length);
+            return true;
+        }
+        return false;
+    }
+
+    void releaseAwaited(std::span<const FrameCall> calls, std::size_t from) {
+        std::lock_guard lock(memoryMutex);
+        std::array<AgcDriver::AwaitedWait, 64> awaited{};
+        const auto count = AgcDriverAwaitedWaits_nid_postfix(awaited.data(), awaited.size());
+        for (std::size_t slot = 0; slot < count; ++slot) {
+            const auto& wait = awaited[slot];
+            if (wait.address == 0) continue;
+            const std::size_t bytes = wait.bytes == 8 ? 8 : 4;
+            if (wait.function != 0 && satisfies(wait, load(wait.address, bytes))) continue;
+            bool released = false;
+            for (auto index = from; index < calls.size() && !released; ++index) released = writeRecordedValue(calls[index], wait);
+            for (auto index = std::min(from, calls.size()); index > 0 && !released; --index) {
+                released = writeRecordedValue(calls[index - 1], wait);
+                if (released) ++lateReleases;
+            }
+            if (!released && options.synthesize) {
+                if (const auto value = satisfying(wait, load(wait.address, bytes))) {
+                    std::memcpy(reinterpret_cast<void*>(static_cast<std::uintptr_t>(wait.address)), &*value, bytes);
+                    ++syntheticReleases;
+                    released = true;
+                }
+            }
+            if (released) ++earlyReleases;
+        }
+    }
+
+    void runWindow(std::span<const FrameCall> calls) {
+        std::map<std::uint64_t, std::vector<std::size_t>> byThread;
+        for (std::size_t index = 0; index < calls.size(); ++index) byThread[calls[index].thread].push_back(index);
+        threads = byThread.size();
+        std::mutex mutex;
+        std::condition_variable turn;
+        std::size_t started = 0;
+        std::exception_ptr failure;
+        std::atomic<bool> finished{false};
+        std::thread breaker([&] {
+            if (!options.release) return;
+            auto lastCompleted = progress().second;
+            auto lastProgress = Clock::now();
+            while (!finished.load()) {
+                std::this_thread::sleep_for(std::chrono::milliseconds(1));
+                const auto completed = progress().second;
+                if (completed != lastCompleted) {
+                    lastCompleted = completed;
+                    lastProgress = Clock::now();
+                    continue;
+                }
+                if (Clock::now() - lastProgress < options.releaseAfter) continue;
+                releaseAwaited(calls, sequenced.load());
+                lastProgress = Clock::now();
+            }
+        });
+        std::vector<std::thread> workers;
+        for (const auto& entry : byThread) {
+            workers.emplace_back([&, &indices = entry.second] {
+                for (const auto index : indices) {
+                    std::unique_lock lock(mutex);
+                    turn.wait(lock, [&] { return started == index || failure != nullptr; });
+                    if (failure != nullptr) return;
+                    const auto advance = [&] {
+                        ++started;
+                        sequenced.store(started);
+                        lock.unlock();
+                        turn.notify_all();
+                    };
+                    const auto kind = calls[index].kind;
+                    const bool ordered = kind == FrameCallKind::Memory || kind == FrameCallKind::RegisterVideoOutput || kind == FrameCallKind::UnregisterVideoOutput;
+                    if (!ordered) advance();
+                    try {
+                        execute(calls[index]);
+                        if (ordered) advance();
+                    } catch (...) {
+                        if (!lock.owns_lock()) lock.lock();
+                        if (failure == nullptr) failure = std::current_exception();
+                        turn.notify_all();
+                        return;
+                    }
+                }
+            });
+        }
+        for (auto& worker : workers) worker.join();
+        if (failure == nullptr) drain();
+        finished.store(true);
+        breaker.join();
+        if (failure != nullptr) std::rethrow_exception(failure);
+    }
+
+    void drain() {
+        auto lastCompleted = progress().second;
+        auto lastProgress = Clock::now();
+        while (true) {
+            const auto [accepted, completed] = progress();
+            unfinished = accepted - completed;
+            if (unfinished == 0) return;
+            if (completed != lastCompleted) {
+                lastCompleted = completed;
+                lastProgress = Clock::now();
+            } else if (Clock::now() - lastProgress >= options.drainTimeout) {
+                std::fprintf(stderr, "[frame-replay] %llu submissions did not complete after the last captured call (serials %llu/%llu)\n", static_cast<unsigned long long>(unfinished),
+                             static_cast<unsigned long long>(completed), static_cast<unsigned long long>(accepted));
+                return;
+            }
+            std::this_thread::sleep_for(std::chrono::milliseconds(5));
+        }
+    }
+
+    template <typename TFunction>
+    void registration(TFunction&& function) {
+        try {
+            function();
+        } catch (const std::exception& error) {
+            if (recording && options.strict) throw;
+            ++(recording ? failedRegistrations : staleRegistrations);
+            std::fprintf(stderr, "[frame-replay] %s registration failed: %s\n", recording ? "recorded" : "prologue", error.what());
+        }
+    }
+
+    static const Shader* shader(std::uint64_t address) {
+        return reinterpret_cast<const Shader*>(static_cast<std::uintptr_t>(address));
+    }
+
+    static AgcDriver::FlipInfo flipInfo(const FrameCall& call) {
+        return {static_cast<std::uint32_t>(call.values.at(0)), static_cast<std::int32_t>(call.values.at(1)), static_cast<std::uint32_t>(call.values.at(2)), static_cast<std::int64_t>(call.values.at(3))};
+    }
+};
+
+int usage() {
+    std::fprintf(stderr, "usage: agc_frame_replay <capture directory> [--no-pace] [--no-release] [--release-after-ms <n>] [--strict]\n"
+                         "                        [--dump <address>:<bytes>:<file>]...\n"
+                         "  replays the driver calls and guest memory that APS5_FRAME_CAPTURE=<directory> recorded, through this\n"
+                         "  build's AGC driver with no title running, and prints one JSON line with the frame times\n"
+                         "  --no-pace           issues calls without waiting for the in-flight depth the title had\n"
+                         "  --no-release        never copies recorded CPU stores early to release a GPU wait\n"
+                         "  --release-after-ms  milliseconds without a completion before awaited dwords are released (3)\n"
+                         "  --no-synthesize     releases a wait only with a value the capture recorded, never with its reference value\n"
+                         "  --strict            fails on a pacing timeout or a failed registration inside the captured frames\n"
+                         "  --dump              writes guest memory to a file after the replay (hexadecimal or decimal)\n"
+                         "  --frames <dir>      writes each recorded and replayed display buffer as reference-<n>.bmp and replay-<n>.bmp\n");
+    return 2;
+}
+
+Dump parseDump(std::string_view text) {
+    const auto first = text.find(':');
+    const auto second = first == std::string_view::npos ? std::string_view::npos : text.find(':', first + 1);
+    if (second == std::string_view::npos) throw std::invalid_argument("frame replay: --dump takes <address>:<bytes>:<file>");
+    const auto number = [](std::string_view part) {
+        const std::string value(part);
+        char* end = nullptr;
+        const auto parsed = std::strtoull(value.c_str(), &end, 0);
+        if (value.empty() || end != value.c_str() + value.size()) throw std::invalid_argument("frame replay: '" + value + "' is not a number");
+        return static_cast<std::uint64_t>(parsed);
+    };
+    return {number(text.substr(0, first)), number(text.substr(first + 1, second - first - 1)), std::filesystem::path(std::string(text.substr(second + 1)))};
+}
+
+void writeDump(const Dump& dump) {
+    auto* const pointer = reinterpret_cast<const std::byte*>(static_cast<std::uintptr_t>(dump.address));
+    GuestArena::GuestArenaPrepareHostRead_nid_no_patch(pointer, static_cast<std::size_t>(dump.bytes));
+    std::ofstream file(dump.path, std::ios::binary | std::ios::trunc);
+    file.write(reinterpret_cast<const char*>(pointer), static_cast<std::streamsize>(dump.bytes));
+    if (!file.good()) throw std::runtime_error("frame replay: cannot write " + dump.path.string());
+}
+
+struct FrameCheck {
+    std::size_t compared = 0;
+    double identical = 1.0;
+    int maxDifference = 0;
+};
+
+void writeFrame(const std::filesystem::path& path, const AgcDriver::DisplayBuffer& buffer, std::span<const std::byte> pixels) {
+    std::FILE* file = std::fopen(path.string().c_str(), "wb");
+    const auto failure = file != nullptr ? AgcDriver::WriteBmpAndClose_nid_no_patch(file, buffer.width, buffer.height, pixels) : AgcDriver::FrameDumpIoFailure{"open", errno};
+    if (failure) std::fprintf(stderr, "[frame-replay] cannot write %s (%s failed)\n", path.string().c_str(), failure.operation);
+}
+
+FrameCheck compareFrames(const FrameCaptureReader& reader, const Options& options) {
+    FrameCheck check;
+    if (!options.frames.empty()) std::filesystem::create_directories(options.frames);
+    for (const auto& call : reader.Calls()) {
+        if (call.kind != FrameCallKind::DisplayBuffer || call.values.size() < 9) continue;
+        AgcDriver::DisplayBuffer buffer{};
+        buffer.address = call.address;
+        buffer.pixelFormat = call.values[1];
+        buffer.width = static_cast<std::uint32_t>(call.values[2]);
+        buffer.height = static_cast<std::uint32_t>(call.values[3]);
+        buffer.tilingMode = static_cast<std::uint32_t>(call.values[4]);
+        buffer.pitchInPixel = static_cast<std::uint32_t>(call.values[5]);
+        buffer.dccAddress = call.values[6];
+        buffer.dccClearColor = call.values[7];
+        buffer.alignment = static_cast<std::uint32_t>(call.values[8]);
+        const auto chunk = std::find_if(reader.Chunks().begin(), reader.Chunks().end(), [&](const FrameMemoryChunk& candidate) { return candidate.kind == FrameMemoryKind::Reference && candidate.group == call.values[0]; });
+        if (chunk == reader.Chunks().end()) continue;
+        const auto reference = reader.Read(*chunk);
+        const auto replayed = AgcDriver::ReadDisplayBuffer(buffer);
+        ++check.compared;
+        std::size_t same = 0;
+        const auto pixels = std::min(reference.size(), replayed.size()) / 4;
+        for (std::size_t pixel = 0; pixel < pixels; ++pixel) {
+            bool equal = true;
+            for (std::size_t channel = 0; channel < 4; ++channel) {
+                const auto difference = std::abs(static_cast<int>(reference[pixel * 4 + channel]) - static_cast<int>(replayed[pixel * 4 + channel]));
+                check.maxDifference = std::max(check.maxDifference, difference);
+                equal = equal && difference == 0;
+            }
+            same += equal ? 1 : 0;
+        }
+        const auto total = std::max(reference.size(), replayed.size()) / 4;
+        check.identical = std::min(check.identical, total == 0 ? 1.0 : static_cast<double>(same) / static_cast<double>(total));
+        if (options.frames.empty()) continue;
+        const auto index = std::to_string(call.values[0]);
+        writeFrame(options.frames / ("reference-" + index + ".bmp"), buffer, reference);
+        writeFrame(options.frames / ("replay-" + index + ".bmp"), buffer, replayed);
+    }
+    return check;
+}
+
+int run(const Options& options) {
+    const auto loadStart = Clock::now();
+    const FrameCaptureReader reader(options.directory);
+    if (reader.Truncated()) std::fprintf(stderr, "[frame-replay] the capture is truncated; replaying the complete records\n");
+    auto skipped = restoreMemory(reader);
+    const auto loaded = Clock::now();
+    Replay replay{options, reader};
+    replay.skipped = std::move(skipped);
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Delta) replay.groups[chunk.group].push_back(&chunk);
+    }
+    const auto& calls = reader.Calls();
+    const auto frameStart = std::find_if(calls.begin(), calls.end(), [](const FrameCall& call) { return call.kind == FrameCallKind::FrameStart; });
+    for (auto call = calls.begin(); call != frameStart; ++call) replay.execute(*call);
+    replay.recording = true;
+    replay.startedAt = Clock::now();
+    if (frameStart != calls.end()) replay.runWindow(std::span(calls).subspan(static_cast<std::size_t>(frameStart - calls.begin()) + 1));
+    if (frameStart == calls.end()) AgcDriverWaitIdle_nid_postfix();
+    replay.endedAt = Clock::now();
+    if (const auto failure = replay.frames.Failure()) std::rethrow_exception(failure);
+    FrameCheck check;
+    if (replay.unfinished == 0) {
+        for (const auto& dump : options.dumps) writeDump(dump);
+        check = compareFrames(reader, options);
+    } else if (!options.dumps.empty()) {
+        std::fprintf(stderr, "[frame-replay] no dumps written: the GPU work did not finish\n");
+    }
+    const auto ready = replay.frames.Times();
+    std::vector<double> frameMs;
+    for (std::size_t index = 1; index < ready.size(); ++index) frameMs.push_back(std::chrono::duration<double, std::milli>(ready[index] - ready[index - 1]).count());
+    std::string frameList;
+    for (const auto value : frameMs) frameList += (frameList.empty() ? "" : ",") + std::to_string(static_cast<long long>(value));
+    std::sort(frameMs.begin(), frameMs.end());
+    const auto percentile = [&](double fraction) { return frameMs.empty() ? 0.0 : frameMs[std::min(frameMs.size() - 1, static_cast<std::size_t>(fraction * static_cast<double>(frameMs.size())))]; };
+    const auto seconds = std::chrono::duration<double>(replay.endedAt - replay.startedAt).count();
+    std::printf("{\"frames\":%zu,\"replay_s\":%.3f,\"fps\":%.3f,\"frame_ms\":{\"p50\":%.3f,\"p90\":%.3f,\"max\":%.3f,\"each\":[%s]},\"submits\":%llu,\"delta_mib\":%.1f,\"pace_timeouts\":%llu,\"pace_wait_s\":%.3f,\"stale_registrations\":%llu,\"failed_registrations\":%llu,\"skipped_mib\":%.1f,\"threads\":%zu,\"released_waits\":%llu,\"of_them_from_earlier_writes\":%llu,\"of_them_synthesized\":%llu,\"unfinished\":%llu,\"frames_compared\":%zu,\"pixels_identical\":%.6f,\"max_channel_diff\":%d,\"load_s\":%.3f}\n",
+                ready.size(), seconds, seconds > 0 ? static_cast<double>(ready.size()) / seconds : 0.0, percentile(0.5), percentile(0.9), frameMs.empty() ? 0.0 : frameMs.back(), frameList.c_str(),
+                static_cast<unsigned long long>(replay.submits.load()), static_cast<double>(replay.deltaBytes.load()) / (1024.0 * 1024.0), static_cast<unsigned long long>(replay.paceTimeouts.load()),
+                replay.paceWaitedSeconds(), static_cast<unsigned long long>(replay.staleRegistrations.load()), static_cast<unsigned long long>(replay.failedRegistrations.load()),
+                static_cast<double>(replay.skipped.bytes) / (1024.0 * 1024.0), replay.threads, static_cast<unsigned long long>(replay.earlyReleases.load()), static_cast<unsigned long long>(replay.lateReleases.load()),
+                static_cast<unsigned long long>(replay.syntheticReleases.load()),
+                static_cast<unsigned long long>(replay.unfinished), check.compared, check.identical, check.maxDifference, std::chrono::duration<double>(loaded - loadStart).count());
+    std::fflush(stdout);
+    return replay.unfinished == 0 ? 0 : 3;
+}
+
+}
+
+int main(int argc, char** argv) {
+    Options options;
+    for (int index = 1; index < argc; ++index) {
+        const std::string_view argument = argv[index];
+        if (argument == "--no-pace") options.pace = false;
+        else if (argument == "--no-release") options.release = false;
+        else if (argument == "--no-synthesize") options.synthesize = false;
+        else if (argument == "--release-after-ms" && index + 1 < argc) options.releaseAfter = std::chrono::milliseconds(std::strtoll(argv[++index], nullptr, 10));
+        else if (argument == "--strict") options.strict = true;
+        else if (argument == "--dump" && index + 1 < argc) options.dumps.push_back(parseDump(argv[++index]));
+        else if (argument == "--frames" && index + 1 < argc) options.frames = argv[++index];
+        else if (!argument.starts_with("-") && options.directory.empty()) options.directory = argument;
+        else return usage();
+    }
+    if (options.directory.empty()) return usage();
+#ifdef _WIN32
+    _putenv_s("APS5_FRAME_CAPTURE", "");
+#else
+    unsetenv("APS5_FRAME_CAPTURE");
+#endif
+    int code = 2;
+    try {
+        code = run(options);
+        if (code == 0) {
+            AgcDriverShutdown_nid_postfix();
+            return 0;
+        }
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "agc_frame_replay: %s\n", error.what());
+    }
+    std::fflush(stdout);
+    std::fflush(stderr);
+    std::_Exit(code);
+}
diff --git a/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp b/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp
index e4eeec9174..7bad5361bb 100644
--- a/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp
@@ -49,6 +49,7 @@ bool g_graph = false;
 bool g_maintenance8 = false;
 bool g_robust2 = false;
 bool g_waveLdsMemoryBarriers = false;
+bool g_deviceScopeLdsMemoryBarriers = false;
 bool g_code = false;
 
 bool Replay(const char* path) {
@@ -149,6 +150,7 @@ bool Replay(const char* path) {
         if (g_maintenance8) request.request.target.nonConstantImageOffsets = true;
         if (g_robust2) request.request.target.robustBufferAccess2 = true;
         if (g_waveLdsMemoryBarriers) request.request.target.waveLdsMemoryBarriers = true;
+        if (g_deviceScopeLdsMemoryBarriers) request.request.target.deviceScopeLdsMemoryBarriers = true;
         const auto result = ShaderRecompiler::Recompile(request.request);
         std::printf("  recompiled: %zu SPIR-V words\n", result.spirv.size());
         if (g_spirv) {
@@ -186,7 +188,7 @@ bool Replay(const char* path) {
 
 int main(int argc, char** argv) {
     if (argc < 2) {
-        std::fprintf(stderr, "usage: agc_shader_replay [--dis] [--asm] [--cfg] [--mem] [--spv] [--prepare] [--materialize] [--code] [--maintenance8] [--robust2] [--wave-lds-memory-barriers] <shader.req>...\n  the driver writes shader_<address>.req files when APS5_DUMP_SHADERS is set; shader_<address>.prepare.req holds a request whose preparation failed before any resource capture, so replay it with --prepare\n");
+        std::fprintf(stderr, "usage: agc_shader_replay [--dis] [--asm] [--cfg] [--mem] [--spv] [--prepare] [--materialize] [--code] [--maintenance8] [--robust2] [--wave-lds-memory-barriers] [--device-scope-lds-memory-barriers] <shader.req>...\n  the driver writes shader_<address>.req files when APS5_DUMP_SHADERS is set; shader_<address>.prepare.req holds a request whose preparation failed before any resource capture, so replay it with --prepare\n");
         return 2;
     }
     int failures = 0;
@@ -215,6 +217,10 @@ int main(int argc, char** argv) {
             g_waveLdsMemoryBarriers = true;
             continue;
         }
+        if (std::string(argv[i]) == "--device-scope-lds-memory-barriers") {
+            g_deviceScopeLdsMemoryBarriers = true;
+            continue;
+        }
         if (std::string(argv[i]) == "--mem") {
             g_memory = true;
             continue;
diff --git a/core/libs/prx/libSceAgcResourceRegistration/libSceAgcResourceRegistration.hpp b/core/libs/prx/libSceAgcResourceRegistration/libSceAgcResourceRegistration.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAgcResourceRegistration/libSceAgcResourceRegistration.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAgcVsh/Export.cpp b/core/libs/prx/libSceAgcVsh/Export.cpp
index fb34206c21..b648c87cc5 100644
--- a/core/libs/prx/libSceAgcVsh/Export.cpp
+++ b/core/libs/prx/libSceAgcVsh/Export.cpp
@@ -1,3 +1,153 @@
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,6 +155,904 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceAgcDcbCopyData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1rZSWUv1IRc", sceAgcDcbCopyData_nid_no_patch);
+
+int APS5_VABI sceAgcBranchPatchSetElseTarget_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("QmfvaYpsOcI", sceAgcBranchPatchSetElseTarget_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegistersDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("UZbQjYAwwXM", sceAgcCbSetShRegistersDirect_nid_no_patch);
+
+int APS5_VABI sceAgcCreateShader_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("f3dg2CSgRKY", sceAgcCreateShader_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetNumInstancesGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("6DFuRKT4C9w", sceAgcDcbSetNumInstancesGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("aP1Ki9G3++4", sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("r98I08t+LOg", sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicGdsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1tB0xkLNjcw", sceAgcDcbAtomicGdsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbCopyDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("CbQh3DKMSno", sceAgcAcbCopyDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbWaitUntilSafeForRendering_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GPbUp9jXQa8", sceAgcAcbWaitUntilSafeForRendering_nid_no_patch);
+
+int APS5_VABI sceAgcAsyncCondExecPatchSetEnd_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("k-JpyR2dYAM", sceAgcAsyncCondExecPatchSetEnd_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDmaDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("2ccJz9LQI+w", sceAgcDcbDmaDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetUcRegistersIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hvUfkUIQcOE", sceAgcDcbSetUcRegistersIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaults2_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("2JtWUUiYBXs", sceAgcGetRegisterDefaults2_nid_no_patch);
+
+int APS5_VABI sceAgcCbReleaseMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("wr23dPKyWc0", sceAgcCbReleaseMem_nid_no_patch);
+
+int APS5_VABI sceAgcCondExecPatchSetEnd_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ORWsxIbk4TE", sceAgcCondExecPatchSetEnd_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicGds_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("pH3-dfRpfA0", sceAgcDcbAtomicGds_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GBCh3zCihoU", sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MDLD5Ly94Xk", sceAgcCbSetUcRegisterRangeDirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbEventWrite_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("aJf+j5yntiU", sceAgcDcbEventWrite_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWriteData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("i1jyy49AjXU", sceAgcDcbWriteData_nid_no_patch);
+
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("6lNcCp+fxi4", sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch);
+
+int APS5_VABI sceAgcCbCondWriteGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("FuVbkyKlf+s", sceAgcCbCondWriteGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("zg6u-N6Otxs", sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcGetPacketSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Lkf86B98qPc", sceAgcGetPacketSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAcquireMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("KT-hTp-Ch14", sceAgcAcbAcquireMem_nid_no_patch);
+
+int APS5_VABI sceAgcAcbEventWriteGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Y-5vneiBtzk", sceAgcAcbEventWriteGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexIndirectArgs_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("0o3VDdtA6nM", sceAgcDcbSetIndexIndirectArgs_nid_no_patch);
+
+int APS5_VABI sceAgcAcbDmaData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("-RnpfpxIhec", sceAgcAcbDmaData_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("t1vNu082-jM", sceAgcDcbDrawIndexIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbPrimeUtcl2GetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("KjPeVduz6jU", sceAgcDcbPrimeUtcl2GetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("3ZWa3AoyWZQ", sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAcquireMemGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ewobAQeMo5k", sceAgcAcbAcquireMemGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("AFIh8SQkYlQ", sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCreateInterpolantMapping_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("pdEV7bI6COI", sceAgcCreateInterpolantMapping_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirectMulti_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ypVBz4uPKcQ", sceAgcDcbDrawIndexIndirectMulti_nid_no_patch);
+
+int APS5_VABI sceAgcDcbEventWriteGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("C4l9fB17t8w", sceAgcDcbEventWriteGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetUcRegisterDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w4-d0n60hdo", sceAgcDcbSetUcRegisterDirect_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("0fWWK5uG9rQ", sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("pYoKs3lPy88", sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MMlmJAL7N5w", sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetNumInstances_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("tSBxhAPyytQ", sceAgcDcbSetNumInstances_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWaitOnAddressGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("43WJ08sSugE", sceAgcDcbWaitOnAddressGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicGds_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("cduV1f0dcGQ", sceAgcAcbAtomicGds_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("yheJGN-ay+A", sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicMemGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("da1Sm8-QDoU", sceAgcAcbAtomicMemGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("BVFg3CWU6Eo", sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbCondExecGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ou16V5hh5sg", sceAgcDcbCondExecGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexMultiInstanced_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Rlx+bykm0r0", sceAgcDcbDrawIndexMultiInstanced_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegistersIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ZvwO9euwYzc", sceAgcDcbSetCxRegistersIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegistersDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("yUBESvCCJ4I", sceAgcCbSetShRegistersDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCondExecPatchSetCommandAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("YWTKOju587o", sceAgcCondExecPatchSetCommandAddress_nid_no_patch);
+
+int APS5_VABI sceAgcRewindPatchSetRewindState_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ziVA3whp3p4", sceAgcRewindPatchSetRewindState_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("J8YCgfKAMQs", sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch);
+
+int APS5_VABI sceAgcWaitRegMemPatchReference_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("7nOoijNPvEU", sceAgcWaitRegMemPatchReference_nid_no_patch);
+
+int APS5_VABI sceAgcAcbRewind_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("DwICrVxerkY", sceAgcAcbRewind_nid_no_patch);
+
+int APS5_VABI sceAgcAcbCondExecGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ozKzBP4aki4", sceAgcAcbCondExecGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcSuspendPointAndCheckStatus_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("b+fis+WZ3Ig", sceAgcSuspendPointAndCheckStatus_nid_no_patch);
+
+int APS5_VABI sceAgcAcbWaitRegMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("htn36gPnBk4", sceAgcAcbWaitRegMem_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAcquireMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("57labkp+rSQ", sceAgcDcbAcquireMem_nid_no_patch);
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("whb1RL7K4Ss", sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch);
+
+int APS5_VABI sceAgcDcbContextStateOp_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("HabmgqPwPw0", sceAgcDcbContextStateOp_nid_no_patch);
+
+int APS5_VABI sceAgcAcbWriteData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("eZ4+17OQz4Q", sceAgcAcbWriteData_nid_no_patch);
+
+int APS5_VABI sceAgcAcbDmaDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("M0ttm8h7SKA", sceAgcAcbDmaDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("bxGoVxpdSPQ", sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbNop_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("LtTouSCZjHM", sceAgcCbNop_nid_no_patch);
+
+int APS5_VABI sceAgcDcbResetQueue_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("TRO721eVt4g", sceAgcDcbResetQueue_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDmaData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("WmAc2MEj6Io", sceAgcDcbDmaData_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("6ee9Hd3EWXQ", sceAgcDcbDrawIndexGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("IxYiarKlXxM", sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch);
+
+int APS5_VABI sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hL7C0IRpWZI", sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetFlip_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("YUeqkyT7mEQ", sceAgcDcbSetFlip_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetMarker_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("QhCbS4X9Rl8", sceAgcDcbSetMarker_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetPredication_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("bbFueFP+J4k", sceAgcDcbSetPredication_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1-gUn1PI4Sw", sceAgcDcbAtomicMem_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaults2Internal_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("wRbq6ZjNop4", sceAgcGetRegisterDefaults2Internal_nid_no_patch);
+
+int APS5_VABI sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("z2duB-hHQSM", sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch);
+
+int APS5_VABI sceAgcDcbPrimeUtcl2_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("jt3pl7EN17o", sceAgcDcbPrimeUtcl2_nid_no_patch);
+
+int APS5_VABI sceAgcAcbRewindGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("0ZOG0jc9nRg", sceAgcAcbRewindGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("XN+Iuu7XsM8", sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWaitUntilSafeForRendering_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MWiElSNE8j8", sceAgcDcbWaitUntilSafeForRendering_nid_no_patch);
+
+int APS5_VABI sceAgcBranchPatchSetThenTarget_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("xb8VgcXQhvI", sceAgcBranchPatchSetThenTarget_nid_no_patch);
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vcmNN+AAXnY", sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicMemGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("oz6zQq1JwCE", sceAgcDcbAtomicMemGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcUpdatePrimState_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Y3ymLfZ1384", sceAgcUpdatePrimState_nid_no_patch);
+
+int APS5_VABI sceAgcCbNopGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("t7PlZ9nt5Lc", sceAgcCbNopGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbGetLodStats_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vuSXe69VILM", sceAgcDcbGetLodStats_nid_no_patch);
+
+int APS5_VABI sceAgcWaitRegMemPatchAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("3KDcnM3lrcU", sceAgcWaitRegMemPatchAddress_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MlEw1feXcjg", sceAgcQueueEndOfPipeActionPatchData_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaultsInternal_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("uIwxsqDlHRc", sceAgcGetRegisterDefaultsInternal_nid_no_patch);
+
+int APS5_VABI sceAgcInit_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("kW3GLb7QfPg", sceAgcInit_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDispatchIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w8HVkEeXPv8", sceAgcDcbDispatchIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbCondExec_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("BIPexNBSGog", sceAgcDcbCondExec_nid_no_patch);
+
+int APS5_VABI sceAgcAcbSetMarker_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("xAeBOa0A3kk", sceAgcAcbSetMarker_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("qMlfB1ZhMDc", sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbJump_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("e1DFTg+Sd8U", sceAgcAcbJump_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexCount_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("8N2tmT3jmC8", sceAgcDcbSetIndexCount_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("nNlUtdDDvZ0", sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("+u6dKSLWM2o", sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcSuspendPoint_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("h9z6+0hEydk", sceAgcSuspendPoint_nid_no_patch);
+
+int APS5_VABI sceAgcWaitRegMemPatchMask_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hXAnLgDHCoI", sceAgcWaitRegMemPatchMask_nid_no_patch);
+
+int APS5_VABI sceAgcAcbDispatchIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("PxKWV2fVAps", sceAgcAcbDispatchIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicGdsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hcIxS8pmXF4", sceAgcAcbAtomicGdsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbCondWrite_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("7toV+elXqNM", sceAgcCbCondWrite_nid_no_patch);
+
+int APS5_VABI sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("P1CugZ99Uzc", sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetPredicationDisableGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vLrBL8DQiz8", sceAgcDcbSetPredicationDisableGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcLinkShaders_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MqAdbRMdNz4", sceAgcLinkShaders_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWaitRegMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("VmW0Tdpy420", sceAgcDcbWaitRegMem_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaults_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Wi82ArQtAwg", sceAgcGetRegisterDefaults_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegisterRangeDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("n2fD4A+pb+g", sceAgcCbSetShRegisterRangeDirect_nid_no_patch);
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("d-6uF9sZDIU", sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDispatchIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("CtB+A9-VxO0", sceAgcDcbDispatchIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcCbMemSemaphore_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vHX9guneRBY", sceAgcCbMemSemaphore_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("JOWmDrl+j20", sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbDispatch_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("k3GhuSNmBLU", sceAgcCbDispatch_nid_no_patch);
+
+int APS5_VABI sceAgcDcbCopyDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("b5u0Jzm8TF8", sceAgcDcbCopyDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("mR9j7+SfM34", sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("cdDRpqcFGbU", sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch);
+
+int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Qrj4c+61z4A", sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbJump_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("xSAR0LTcRKM", sceAgcDcbJump_nid_no_patch);
+
+int APS5_VABI sceAgcDcbJumpGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("VEGu4dixjUg", sceAgcDcbJumpGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbPrimeUtcl2_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("szG7hz2yEhA", sceAgcAcbPrimeUtcl2_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1DeUNpRIDDA", sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchType_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("T9fjQIINoeE", sceAgcQueueEndOfPipeActionPatchType_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegisterDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("LHFXRrlTPD8", sceAgcDcbSetCxRegisterDirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndex_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("q88lQ+GP5Yk", sceAgcDcbDrawIndex_nid_no_patch);
+
+int APS5_VABI sceAgcCbDispatchGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Abendgtz+3o", sceAgcCbDispatchGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbGetLodStatsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("rUuVjyR+Rd4", sceAgcDcbGetLodStatsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcGetDataPacketPayloadAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("CQsSq6l6+kA", sceAgcGetDataPacketPayloadAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1q1titRBL6o", sceAgcDcbDrawIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcAcbSetFlip_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ebixW91gpPw", sceAgcAcbSetFlip_nid_no_patch);
+
+int APS5_VABI sceAgcGetFusedShaderSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("nQT5kYLv0cg", sceAgcGetFusedShaderSize_nid_no_patch);
+
+int APS5_VABI sceAgcSetRangePredication_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("n8vgpaQg6dA", sceAgcSetRangePredication_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("QhPDD513V0w", sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GIIW2J37e70", sceAgcDcbSetIndexSize_nid_no_patch);
+
+int APS5_VABI sceAgcSetPacketPredication_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w6Dj1VJt5qY", sceAgcSetPacketPredication_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexOffset_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("B+aG9DUnTKA", sceAgcDcbDrawIndexOffset_nid_no_patch);
+
+int APS5_VABI sceAgcAsyncRewindPatchSetRewindState_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("eWaWyFegzgQ", sceAgcAsyncRewindPatchSetRewindState_nid_no_patch);
+
+int APS5_VABI sceAgcJumpPatchSetTarget_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("2BS4EtAaF28", sceAgcJumpPatchSetTarget_nid_no_patch);
+
+int APS5_VABI sceAgcBranchPatchSetCompareAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GXBlM-ekzrI", sceAgcBranchPatchSetCompareAddress_nid_no_patch);
+
+int APS5_VABI sceAgcAcbJumpGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("b-oySn+G2tE", sceAgcAcbJumpGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbBranch_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w1KFAHVqpaU", sceAgcCbBranch_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("mStuvI0zOtc", sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbCopyData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("qzMN2XKGA4k", sceAgcAcbCopyData_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWriteDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("p9tI+yTvx68", sceAgcDcbWriteDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("XKKuA6VkSRc", sceAgcAcbAtomicMem_nid_no_patch);
+
+int APS5_VABI sceAgcAcbPrimeUtcl2GetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("eCjKaqeeQ5s", sceAgcAcbPrimeUtcl2GetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbResetQueue_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("JrtiDtKeS38", sceAgcAcbResetQueue_nid_no_patch);
+
+int APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("F8NLhWvFemI", sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ms1xVoZ-Vwc", sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch);
 
 }
diff --git a/core/libs/prx/libSceAgcVsh/include/Api.hpp b/core/libs/prx/libSceAgcVsh/include/Api.hpp
new file mode 100644
index 0000000000..efe8a800e6
--- /dev/null
+++ b/core/libs/prx/libSceAgcVsh/include/Api.hpp
@@ -0,0 +1,158 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDcbCopyData_nid_no_patch(void);
+int APS5_VABI sceAgcBranchPatchSetElseTarget_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegistersDirect_nid_no_patch(void);
+int APS5_VABI sceAgcCreateShader_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetNumInstancesGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicGdsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbCopyDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbWaitUntilSafeForRendering_nid_no_patch(void);
+int APS5_VABI sceAgcAsyncCondExecPatchSetEnd_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDmaDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetUcRegistersIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaults2_nid_no_patch(void);
+int APS5_VABI sceAgcCbReleaseMem_nid_no_patch(void);
+int APS5_VABI sceAgcCondExecPatchSetEnd_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicGds_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbEventWrite_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWriteData_nid_no_patch(void);
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch(void);
+int APS5_VABI sceAgcCbCondWriteGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcGetPacketSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAcquireMem_nid_no_patch(void);
+int APS5_VABI sceAgcAcbEventWriteGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexIndirectArgs_nid_no_patch(void);
+int APS5_VABI sceAgcAcbDmaData_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbPrimeUtcl2GetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAcquireMemGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCreateInterpolantMapping_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirectMulti_nid_no_patch(void);
+int APS5_VABI sceAgcDcbEventWriteGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetUcRegisterDirect_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetNumInstances_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWaitOnAddressGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicGds_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicMemGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbCondExecGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexMultiInstanced_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegistersIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegistersDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCondExecPatchSetCommandAddress_nid_no_patch(void);
+int APS5_VABI sceAgcRewindPatchSetRewindState_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch(void);
+int APS5_VABI sceAgcWaitRegMemPatchReference_nid_no_patch(void);
+int APS5_VABI sceAgcAcbRewind_nid_no_patch(void);
+int APS5_VABI sceAgcAcbCondExecGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcSuspendPointAndCheckStatus_nid_no_patch(void);
+int APS5_VABI sceAgcAcbWaitRegMem_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAcquireMem_nid_no_patch(void);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch(void);
+int APS5_VABI sceAgcDcbContextStateOp_nid_no_patch(void);
+int APS5_VABI sceAgcAcbWriteData_nid_no_patch(void);
+int APS5_VABI sceAgcAcbDmaDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbNop_nid_no_patch(void);
+int APS5_VABI sceAgcDcbResetQueue_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDmaData_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch(void);
+int APS5_VABI sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetFlip_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetMarker_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetPredication_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicMem_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaults2Internal_nid_no_patch(void);
+int APS5_VABI sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch(void);
+int APS5_VABI sceAgcDcbPrimeUtcl2_nid_no_patch(void);
+int APS5_VABI sceAgcAcbRewindGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWaitUntilSafeForRendering_nid_no_patch(void);
+int APS5_VABI sceAgcBranchPatchSetThenTarget_nid_no_patch(void);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicMemGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcUpdatePrimState_nid_no_patch(void);
+int APS5_VABI sceAgcCbNopGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbGetLodStats_nid_no_patch(void);
+int APS5_VABI sceAgcWaitRegMemPatchAddress_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchData_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaultsInternal_nid_no_patch(void);
+int APS5_VABI sceAgcInit_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDispatchIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbCondExec_nid_no_patch(void);
+int APS5_VABI sceAgcAcbSetMarker_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbJump_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexCount_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcSuspendPoint_nid_no_patch(void);
+int APS5_VABI sceAgcWaitRegMemPatchMask_nid_no_patch(void);
+int APS5_VABI sceAgcAcbDispatchIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicGdsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbCondWrite_nid_no_patch(void);
+int APS5_VABI sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetPredicationDisableGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcLinkShaders_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWaitRegMem_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaults_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegisterRangeDirect_nid_no_patch(void);
+int APS5_VABI sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDispatchIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcCbMemSemaphore_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbDispatch_nid_no_patch(void);
+int APS5_VABI sceAgcDcbCopyDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch(void);
+int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbJump_nid_no_patch(void);
+int APS5_VABI sceAgcDcbJumpGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbPrimeUtcl2_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchType_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegisterDirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndex_nid_no_patch(void);
+int APS5_VABI sceAgcCbDispatchGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbGetLodStatsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcGetDataPacketPayloadAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcAcbSetFlip_nid_no_patch(void);
+int APS5_VABI sceAgcGetFusedShaderSize_nid_no_patch(void);
+int APS5_VABI sceAgcSetRangePredication_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexSize_nid_no_patch(void);
+int APS5_VABI sceAgcSetPacketPredication_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexOffset_nid_no_patch(void);
+int APS5_VABI sceAgcAsyncRewindPatchSetRewindState_nid_no_patch(void);
+int APS5_VABI sceAgcJumpPatchSetTarget_nid_no_patch(void);
+int APS5_VABI sceAgcBranchPatchSetCompareAddress_nid_no_patch(void);
+int APS5_VABI sceAgcAcbJumpGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbBranch_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbCopyData_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWriteDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicMem_nid_no_patch(void);
+int APS5_VABI sceAgcAcbPrimeUtcl2GetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbResetQueue_nid_no_patch(void);
+int APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch(void);
+
+}
diff --git a/core/libs/prx/libSceAgcVsh/libSceAgcVsh.hpp b/core/libs/prx/libSceAgcVsh/libSceAgcVsh.hpp
new file mode 100644
index 0000000000..9291d1e52e
--- /dev/null
+++ b/core/libs/prx/libSceAgcVsh/libSceAgcVsh.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAgcVsh/include/Api.hpp"
diff --git a/core/libs/prx/libSceAgcVshDebug/libSceAgcVshDebug.hpp b/core/libs/prx/libSceAgcVshDebug/libSceAgcVshDebug.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAgcVshDebug/libSceAgcVshDebug.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAjm.native/CMakeLists.txt b/core/libs/prx/libSceAjm.native/CMakeLists.txt
index 20f6cf1f20..9f0a86e55b 100644
--- a/core/libs/prx/libSceAjm.native/CMakeLists.txt
+++ b/core/libs/prx/libSceAjm.native/CMakeLists.txt
@@ -2,7 +2,7 @@ enable_language(C)
 
 set(LIBATRAC9_DIR ${CMAKE_SOURCE_DIR}/3rdparty/LibAtrac9/C/src)
 set(LIBATRAC9_PATCHED_DIR ${CMAKE_CURRENT_BINARY_DIR}/atrac9)
-set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${LIBATRAC9_DIR}/unpack.c ${LIBATRAC9_DIR}/bit_reader.c ${LIBATRAC9_DIR}/decinit.c)
+set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${LIBATRAC9_DIR}/unpack.c ${LIBATRAC9_DIR}/bit_reader.c ${LIBATRAC9_DIR}/decinit.c ${LIBATRAC9_DIR}/utility.c)
 include(${CMAKE_CURRENT_SOURCE_DIR}/PatchLibAtrac9.cmake)
 add_library(atrac9 STATIC EXCLUDE_FROM_ALL
         ${LIBATRAC9_DIR}/band_extension.c
@@ -17,7 +17,7 @@ add_library(atrac9 STATIC EXCLUDE_FROM_ALL
         ${LIBATRAC9_DIR}/scale_factors.c
         ${LIBATRAC9_DIR}/tables.c
         ${LIBATRAC9_PATCHED_DIR}/unpack.c
-        ${LIBATRAC9_DIR}/utility.c
+        ${LIBATRAC9_PATCHED_DIR}/utility.c
 )
 target_include_directories(atrac9 PRIVATE ${LIBATRAC9_DIR})
 set_target_properties(atrac9 PROPERTIES POSITION_INDEPENDENT_CODE ON)
@@ -36,6 +36,9 @@ if(BUILD_TESTING)
     add_test_executable(atrac9_gradient_tests tests/Atrac9Gradient.c ${LIBATRAC9_DIR}/bit_reader.c)
     target_include_directories(atrac9_gradient_tests PRIVATE ${LIBATRAC9_PATCHED_DIR} ${LIBATRAC9_DIR})
     target_link_libraries(atrac9_gradient_tests PRIVATE atrac9)
+    if(NOT WIN32)
+        target_link_libraries(atrac9_gradient_tests PRIVATE m)
+    endif()
     target_compile_options(atrac9_gradient_tests PRIVATE -ffunction-sections -fdata-sections)
     if(APPLE)
         target_link_options(atrac9_gradient_tests PRIVATE LINKER:-dead_strip)
diff --git a/core/libs/prx/libSceAjm.native/Export.cpp b/core/libs/prx/libSceAjm.native/Export.cpp
index 3b0b5e4a8a..c9f1f976a7 100644
--- a/core/libs/prx/libSceAjm.native/Export.cpp
+++ b/core/libs/prx/libSceAjm.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -13,32 +14,6 @@ static void AjmStub(const char* name) {
     NotImplemented_nid_no_patch(name);
 }
 
-struct WVorbisHeaderPacketParameter {
-    std::size_t size;
-    std::int32_t channels;
-    std::uint32_t sampleRate;
-    std::int32_t bytesPerSecond;
-    std::int32_t shortBlockExponent;
-    std::int32_t longBlockExponent;
-    std::uint32_t reserved;
-    const void* setupPacket;
-    std::size_t setupPacketSize;
-    void* output;
-    std::size_t outputCapacity;
-    std::size_t outputSize;
-};
-
-struct WVorbisSetupPacketParameter {
-    std::size_t size;
-    std::int32_t channels;
-    std::uint32_t reserved;
-    const void* input;
-    std::size_t inputSize;
-    void* output;
-    std::size_t outputCapacity;
-    std::size_t outputSize;
-};
-
 static_assert(sizeof(WVorbisHeaderPacketParameter) == 72);
 static_assert(offsetof(WVorbisHeaderPacketParameter, setupPacket) == 32);
 static_assert(sizeof(WVorbisSetupPacketParameter) == 56);
diff --git a/core/libs/prx/libSceAjm.native/PatchLibAtrac9.cmake b/core/libs/prx/libSceAjm.native/PatchLibAtrac9.cmake
index 6c1b91c006..ed0a64c6e9 100644
--- a/core/libs/prx/libSceAjm.native/PatchLibAtrac9.cmake
+++ b/core/libs/prx/libSceAjm.native/PatchLibAtrac9.cmake
@@ -28,3 +28,21 @@ if(libatrac9ConfigGuardPosition EQUAL -1)
 endif()
 string(REPLACE "${libatrac9OldConfigGuard}" "${libatrac9NewConfigGuard}" libatrac9Decinit "${libatrac9Decinit}")
 file(WRITE ${LIBATRAC9_PATCHED_DIR}/decinit.c "${libatrac9Decinit}")
+
+file(READ ${LIBATRAC9_DIR}/utility.c libatrac9Utility)
+set(libatrac9OldReverse "\treturn value >> (32 - bitCount);")
+set(libatrac9NewReverse "\treturn bitCount ? value >> (32 - bitCount) : 0u;")
+string(FIND "${libatrac9Utility}" "${libatrac9OldReverse}" libatrac9ReversePosition)
+if(libatrac9ReversePosition EQUAL -1)
+    message(FATAL_ERROR "LibAtrac9 BitReverse32 has changed; review the local shift-by-32 guard")
+endif()
+string(REPLACE "${libatrac9OldReverse}" "${libatrac9NewReverse}" libatrac9Utility "${libatrac9Utility}")
+
+set(libatrac9OldSignExtend "\treturn (value << shift) >> shift;")
+set(libatrac9NewSignExtend "\treturn (int)((unsigned int)value << shift) >> shift;")
+string(FIND "${libatrac9Utility}" "${libatrac9OldSignExtend}" libatrac9SignExtendPosition)
+if(libatrac9SignExtendPosition EQUAL -1)
+    message(FATAL_ERROR "LibAtrac9 SignExtend32 has changed; review the local signed-shift guard")
+endif()
+string(REPLACE "${libatrac9OldSignExtend}" "${libatrac9NewSignExtend}" libatrac9Utility "${libatrac9Utility}")
+file(WRITE ${LIBATRAC9_PATCHED_DIR}/utility.c "${libatrac9Utility}")
diff --git a/core/libs/prx/libSceAjm.native/include/Api.hpp b/core/libs/prx/libSceAjm.native/include/Api.hpp
new file mode 100644
index 0000000000..6547522846
--- /dev/null
+++ b/core/libs/prx/libSceAjm.native/include/Api.hpp
@@ -0,0 +1,78 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct WVorbisHeaderPacketParameter {
+    std::size_t size;
+    std::int32_t channels;
+    std::uint32_t sampleRate;
+    std::int32_t bytesPerSecond;
+    std::int32_t shortBlockExponent;
+    std::int32_t longBlockExponent;
+    std::uint32_t reserved;
+    const void* setupPacket;
+    std::size_t setupPacketSize;
+    void* output;
+    std::size_t outputCapacity;
+    std::size_t outputSize;
+};
+
+struct WVorbisSetupPacketParameter {
+    std::size_t size;
+    std::int32_t channels;
+    std::uint32_t reserved;
+    const void* input;
+    std::size_t inputSize;
+    void* output;
+    std::size_t outputCapacity;
+    std::size_t outputSize;
+};
+
+extern "C" {
+
+int APS5_VABI sceAjmBatchJobEncode(AjmBatchInfo* info, uint32_t instance, const void* pcmInput, size_t pcmInputSize, void* bitstreamOutput, size_t bitstreamOutputSize, void* result);
+const char* APS5_VABI sceAjmStrError(int error);
+int APS5_VABI sceAjmDecWVorbisCreateHeaderPacket(WVorbisHeaderPacketParameter* param);
+int APS5_VABI sceAjmDecWVorbisCreateSetupPacket(WVorbisSetupPacketParameter* parameter);
+int APS5_VABI sceAjmBatchGetLog();
+int APS5_VABI sceAjmInstanceAvailable();
+uint32_t APS5_VABI sceAjmInstanceCodecType(uint32_t instanceId);
+int APS5_VABI sceAjmInstanceExtend(uint32_t context, uint32_t codec, uint64_t flags, uint32_t instance);
+int APS5_VABI sceAjmInstanceSwitch(uint32_t context, uint32_t codec, uint64_t flags, uint32_t instance);
+int APS5_VABI sceAjmInitialize(int64_t reserved, uint32_t* context);
+int APS5_VABI sceAjmFinalize(uint32_t context);
+int APS5_VABI sceAjmModuleRegister(uint32_t context, uint32_t codec, int64_t reserved);
+int APS5_VABI sceAjmModuleUnregister(uint32_t context, uint32_t codec);
+int APS5_VABI sceAjmMemoryRegister(uint32_t context, void* ptr, size_t pages);
+int APS5_VABI sceAjmMemoryUnregister(uint32_t context, void* ptr);
+int APS5_VABI sceAjmInstanceCreate(uint32_t context, uint32_t codec, uint64_t flags, uint32_t* instance);
+int APS5_VABI sceAjmInstanceDestroy(uint32_t context, uint32_t instance);
+int APS5_VABI sceAjmDecAt9ParseConfigData(const void* configData, AjmDecAt9ConfigDataInfo* configInfo);
+int APS5_VABI sceAjmDecMp3ParseFrame(const uint8_t* stream, uint32_t streamSize, int parseOfl, AjmDecMp3ParseFrame* frame);
+int APS5_VABI sceAjmBatchInitialize(void* buffer, size_t size, AjmBatchInfo* info);
+int APS5_VABI sceAjmBatchJobInitialize(AjmBatchInfo* info, uint32_t instance, const void* codecParameters, size_t codecParametersSize, void* result);
+int APS5_VABI sceAjmBatchJobClearContext(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobSetGaplessDecode(AjmBatchInfo* info, uint32_t instance, const void* gaplessDecode, int reset, void* result);
+int APS5_VABI sceAjmBatchJobControl(AjmBatchInfo* info, uint32_t instance, uint64_t flags, const void* sidebandInput, size_t sidebandInputSize, void* sidebandOutput, size_t sidebandOutputSize);
+int APS5_VABI sceAjmBatchJobRunSplit(AjmBatchInfo* info, uint32_t instance, uint64_t flags, const AjmBuffer* inputBuffers, size_t inputBuffersNum, const AjmBuffer* outputBuffers, size_t outputBuffersNum, void* sidebandOutput, size_t sidebandOutputSize);
+int APS5_VABI sceAjmBatchJobRun(AjmBatchInfo* info, uint32_t instance, uint64_t flags, const void* dataInput, size_t dataInputSize, void* dataOutput, size_t dataOutputSize, void* sidebandOutput, size_t sidebandOutputSize);
+int APS5_VABI sceAjmBatchJobSetResampleParameters(AjmBatchInfo* info, uint32_t instance, float ratio, uint32_t flags, void* result);
+int APS5_VABI sceAjmBatchJobSetResampleParametersEx(AjmBatchInfo* info, uint32_t instance, float ratioStart, float ratioChangePerSample, uint32_t flags, void* result);
+int APS5_VABI sceAjmBatchJobGetResampleInfo(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobDecode(AjmBatchInfo* info, uint32_t instance, const void* bitstreamInput, size_t bitstreamInputSize, void* pcmOutput, size_t pcmOutputSize, void* result);
+int APS5_VABI sceAjmBatchJobDecodeSplit(AjmBatchInfo* info, uint32_t instance, const AjmBuffer* inputBuffers, size_t inputBuffersNum, const AjmBuffer* outputBuffers, size_t outputBuffersNum, void* result);
+int APS5_VABI sceAjmBatchJobDecodeSingle(AjmBatchInfo* info, uint32_t instance, const void* bitstreamInput, size_t bitstreamInputSize, void* pcmOutput, size_t pcmOutputSize, void* result);
+int APS5_VABI sceAjmBatchJobGetGaplessDecode(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobGetInfo(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobGetCodecInfo(AjmBatchInfo* info, uint32_t instance, void* result, size_t resultSize);
+int APS5_VABI sceAjmBatchJobGetStatistics(AjmBatchInfo* info, float interval, void* result);
+int APS5_VABI sceAjmBatchStart(uint32_t context, const AjmBatchInfo* info, int priority, AjmBatchError* error, uint32_t* batch);
+int APS5_VABI sceAjmBatchWait(uint32_t context, uint32_t batch, uint32_t timeout, AjmBatchError* error);
+int APS5_VABI sceAjmBatchCancel(uint32_t context, uint32_t batch);
+int APS5_VABI sceAjmBatchErrorDump(const AjmBatchInfo* info, AjmBatchError* error);
+void* APS5_VABI sceAjmBatchJobControlBufferRa(void* position, uint32_t instance, uint64_t flags, const void* sideband_input, size_t sideband_input_size, void* sideband_output, size_t sideband_output_size, void* return_address);
+void* APS5_VABI sceAjmBatchJobRunBufferRa(void* position, uint32_t instance, uint64_t flags, const void* data_input, size_t data_input_size, void* data_output, size_t data_output_size, void* sideband_output, size_t sideband_output_size, void* return_address);
+void* APS5_VABI sceAjmBatchJobRunSplitBufferRa(void* position, uint32_t instance, uint64_t flags, const AjmBuffer* input_buffers, size_t input_buffers_num, const AjmBuffer* output_buffers, size_t output_buffers_num, void* sideband_output, size_t sideband_output_size, void* return_address);
+int APS5_VABI sceAjmBatchStartBuffer(uint32_t context, const uint8_t* batch, uint32_t batch_size, int priority, AjmBatchError* error, uint32_t* batch_id);
+
+}
diff --git a/core/libs/prx/libSceAjm.native/libSceAjm.native.hpp b/core/libs/prx/libSceAjm.native/libSceAjm.native.hpp
new file mode 100644
index 0000000000..ed8be05e6b
--- /dev/null
+++ b/core/libs/prx/libSceAjm.native/libSceAjm.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAjm.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceAjm.native/src/Ajm.cpp b/core/libs/prx/libSceAjm.native/src/Ajm.cpp
index 1a27be97b1..72284a8281 100644
--- a/core/libs/prx/libSceAjm.native/src/Ajm.cpp
+++ b/core/libs/prx/libSceAjm.native/src/Ajm.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -35,6 +36,8 @@ constexpr int SCE_AJM_ERROR_INVALID_INSTANCE = static_cast<int>(0x80930003);
 constexpr int SCE_AJM_ERROR_INVALID_BATCH = static_cast<int>(0x80930004);
 constexpr int SCE_AJM_ERROR_INVALID_PARAMETER = static_cast<int>(0x80930005);
 constexpr int SCE_AJM_ERROR_OUT_OF_RESOURCES = static_cast<int>(0x80930007);
+constexpr int SCE_AJM_ERROR_MALFORMED_BATCH = static_cast<int>(0x80930011);
+constexpr int SCE_AJM_ERROR_INVALID_ADDRESS = static_cast<int>(0x80930016);
 
 constexpr std::int32_t AJM_RESULT_NOT_INITIALIZED = 0x00000001;
 constexpr std::int32_t AJM_RESULT_INVALID_DATA = 0x00000002;
@@ -215,6 +218,7 @@ struct JobHeader {
     std::uint32_t inputCount;
     std::uint32_t outputCount;
     std::uint8_t parameters[16];
+    bool console;
 };
 
 struct PackedJob {
@@ -690,9 +694,17 @@ void EmitFrame(Instance& instance, PcmOutputs& outputs, const std::uint8_t* pcm,
     ResamplerProduce(instance, outputs, channels, encoding, sampleBytes);
 }
 
+// A PS4 reports an ATRAC9 stream's bitrate from its superframe: 448-byte superframes of 4 frames of 256
+// samples at 48 kHz gave 168000 (Knowledge is Power: Decades, every run job's format sideband).
+std::uint32_t At9Bitrate(const Instance& instance) {
+    const auto samples = static_cast<std::uint64_t>(instance.info.framesInSuperframe) * static_cast<std::uint64_t>(instance.info.frameSamples);
+    if (samples == 0) return 0;
+    return static_cast<std::uint32_t>(static_cast<std::uint64_t>(instance.info.superframeSize) * 8u * static_cast<std::uint64_t>(instance.info.samplingRate) / samples);
+}
+
 SidebandFormat CurrentFormat(const Instance& instance) {
     switch (instance.codec) {
-    case CODEC_AT9: return {static_cast<std::uint32_t>(instance.info.channels), ChannelMask(static_cast<std::size_t>(instance.info.channels)), static_cast<std::uint32_t>(instance.info.samplingRate), PcmEncoding(instance), 0, 0};
+    case CODEC_AT9: return {static_cast<std::uint32_t>(instance.info.channels), ChannelMask(static_cast<std::size_t>(instance.info.channels)), static_cast<std::uint32_t>(instance.info.samplingRate), PcmEncoding(instance), At9Bitrate(instance), 0};
     case CODEC_MP3: return {instance.mp3Channels, ChannelMask(instance.mp3Channels), instance.mp3SampleRate, PcmEncoding(instance), instance.mp3Bitrate, 0};
     case CODEC_OPUS: return {instance.opusChannels, ChannelMask(instance.opusChannels), instance.opusSampleRate, PcmEncoding(instance), 0, 0};
     case CODEC_M4AAC: return {instance.aacChannels, ChannelMask(instance.aacChannels), instance.aacSampleRate, PcmEncoding(instance), instance.aacBitrate, 0};
@@ -767,12 +779,22 @@ void RunAt9(Instance& instance, const JobHeader& job, const AjmBuffer* inputs, c
         if (segmentEnded()) break;
         if (instance.superframeRemaining == 0) consumed += RiffDataOffset(input.data() + consumed, input.size() - consumed);
         const std::size_t needed = instance.superframeRemaining == 0 ? superframeSize : instance.superframeRemaining;
+        const bool roomForFrame = Resampling(instance) ? pcmOutputs.Room() >= channels * sampleBytes : pcmOutputs.Room() >= frameBytes;
+        // A PS4 reports which side ran out (probe runs of a title's ATRAC9 stream through libSceAjm's
+        // builders): PARTIAL_INPUT when the input ran out, on a superframe boundary or not, with room
+        // left; NOT_ENOUGH_ROOM when the room ran out with input left, after however many frames (and
+        // with none decoded for a zero room); both (0x18) when the input ended just as the output
+        // filled, which is every Wwise run job. A run without input (a format query) reports 0.
+        // Resampled runs were not measured and keep the earlier rule: a trailing partial superframe is
+        // partial input, a zero-output run is out of room.
+        const bool measured = !Resampling(instance);
         if (input.size() - consumed < needed) {
-            if (input.size() != consumed) result |= AJM_RESULT_PARTIAL_INPUT;
+            if (input.size() != consumed || (measured && !input.empty())) result |= AJM_RESULT_PARTIAL_INPUT;
+            if (measured && !input.empty() && !roomForFrame) result |= AJM_RESULT_NOT_ENOUGH_ROOM;
             break;
         }
-        if (Resampling(instance) ? pcmOutputs.Room() < channels * sampleBytes : pcmOutputs.Room() < frameBytes) {
-            if (frames == 0 && pcmOutputs.produced == 0) result |= AJM_RESULT_NOT_ENOUGH_ROOM;
+        if (!roomForFrame) {
+            if (measured || (frames == 0 && pcmOutputs.produced == 0)) result |= AJM_RESULT_NOT_ENOUGH_ROOM;
             break;
         }
         if (instance.superframeRemaining == 0) {
@@ -796,6 +818,7 @@ void RunAt9(Instance& instance, const JobHeader& job, const AjmBuffer* inputs, c
         ++frames;
 
         EmitFrame(instance, pcmOutputs, pcm.data(), frameSamples, channels, sampleBytes);
+        if (job.console && (job.flags & RUN_MULTIPLE_FRAMES) == 0) break;
     }
     if (segmentEnded()) instance.segmentSamples = 0;
 
@@ -1136,7 +1159,6 @@ std::size_t OpusPacketSamples(const std::uint8_t* packet, std::size_t size) {
     return frames * frameSamples;
 }
 
-
 std::size_t OpusLength(const std::uint8_t* data, std::size_t size, std::size_t& at) {
     if (at >= size) return SIZE_MAX;
     const std::size_t first = data[at++];
@@ -1692,6 +1714,169 @@ void Execute(const JobHeader& job, const AjmBuffer* inputs, const AjmBuffer* out
     }
 }
 
+int RegisterBatch(std::uint32_t context, AjmBatchError* error, std::uint32_t* batch) {
+    if (error) std::memset(error, 0, sizeof(*error));
+    const auto id = g_nextBatch.fetch_add(1, std::memory_order_relaxed);
+    {
+        std::lock_guard lock(g_batchLock);
+        g_batches.emplace(id, context);
+    }
+    *batch = id;
+    return 0;
+}
+
+// The PS4 batch buffer (sceAjmBatchStartBuffer) is not private: the PS4 SDK builds it with inline code
+// in the title, so it has the console's layout, taken from shadPS4's reimplementation of the PS4
+// library. It is a run of chunks, each starting with a 32-bit word that holds the chunk kind in bits
+// 0-5 and a payload in bits 6-25. A job chunk has the instance as payload and, in a second word, the
+// byte count of the chunks after it that describe the job; an inline chunk holds that many bytes of data
+// a job's control buffer may point to. A job's flags chunk has flags bits 32-51 as payload and bits 0-31
+// in its second word; its buffer chunks have a 32-bit size and a 64-bit address.
+enum class ConsoleChunk : std::uint32_t {
+    Job = 0,
+    InputRunBuffer = 1,
+    InputControlBuffer = 2,
+    ControlFlags = 3,
+    RunFlags = 4,
+    ReturnAddress = 6,
+    InlineBuffer = 7,
+    OutputRunBuffer = 17,
+    OutputControlBuffer = 18,
+};
+
+constexpr std::uint32_t CONSOLE_STATISTICS_INSTANCE = 0x80000;
+constexpr std::uint64_t CONSOLE_FLAGS_VERSION_AND_CODEC = 0x7FF;
+
+// The low header word as the PS4's libSceAjm builders write it (a trace of 32 545 batches a Wwise title
+// started on a PS4): bits 0-3 the kind, bit 4 the output direction of a buffer chunk
+// (0x11 output run, 0x12 output control), bits 6-25 the job's instance or the flags' bits 32-51. The
+// builders leave bits 5, 26, 27 and 31 as they were, and a title that reuses its batch memory (Wwise
+// does) carries the previous batch's bytes there: a 6-bit kind read job headers as 16, 32 or 48 and run
+// flags as 20, 36 or 52, and a 26-bit payload read flags bit 52 set.
+ConsoleChunk ConsoleChunkKind(std::uint32_t word) {
+    const std::uint32_t kind = word & 0xFu;
+    return static_cast<ConsoleChunk>(kind == 1 || kind == 2 ? kind | (word & 0x10u) : kind);
+}
+
+std::uint32_t ConsoleChunkPayload(std::uint32_t word) {
+    return (word >> 6) & 0xFFFFFu;
+}
+
+std::uint8_t* PutConsoleChunk(std::uint8_t* at, ConsoleChunk kind, std::uint32_t payload, std::uint32_t word) {
+    const std::uint32_t words[2] = {static_cast<std::uint32_t>(kind) | ((payload & 0xFFFFFu) << 6), word};
+    std::memcpy(at, words, sizeof(words));
+    return at + sizeof(words);
+}
+
+std::uint8_t* PutConsoleFlags(std::uint8_t* at, ConsoleChunk kind, std::uint64_t flags) {
+    return PutConsoleChunk(at, kind, static_cast<std::uint32_t>(flags >> 32), static_cast<std::uint32_t>(flags));
+}
+
+std::uint8_t* PutConsoleBuffer(std::uint8_t* at, ConsoleChunk kind, const void* address, std::size_t size) {
+    at = PutConsoleChunk(at, kind, 0, static_cast<std::uint32_t>(size));
+    std::memcpy(at, &address, sizeof(address));
+    return at + sizeof(address);
+}
+
+std::uint8_t* BeginConsoleJob(std::uint8_t* job, const void* returnAddress) {
+    std::uint8_t* at = job + 2 * sizeof(std::uint32_t);
+    return returnAddress ? PutConsoleBuffer(at, ConsoleChunk::ReturnAddress, returnAddress, 0) : at;
+}
+
+void* EndConsoleJob(std::uint8_t* job, std::uint8_t* end, std::uint32_t instance) {
+    PutConsoleChunk(job, ConsoleChunk::Job, instance, static_cast<std::uint32_t>(end - job) - 2 * sizeof(std::uint32_t));
+    return end;
+}
+
+struct ConsoleJob {
+    JobHeader header;
+    std::vector<AjmBuffer> buffers;
+};
+
+// What sceAjmBatchStartBuffer reports in the AjmBatchError when it refuses a batch: the error, the job
+// chunk, the offending chunk's offset in the job and the job's return address, as a PS4 fills them for a
+// buffer chunk with a null address and a nonzero size (INVALID_ADDRESS, nothing of the batch run). The
+// other refusals here report MALFORMED_BATCH the same way; they were not measured.
+struct ConsoleRefusal {
+    std::int32_t code = SCE_AJM_ERROR_MALFORMED_BATCH;
+    const std::uint8_t* job = nullptr;
+    std::uint32_t offset = 0;
+    const void* returnAddress = nullptr;
+};
+
+// Reads one console job: the chunks between the job header at `job` and `end`. A buffer chunk of size
+// zero is dropped whatever its address, as a PS4 does. Returns false with the refusal filled for a null
+// address with a nonzero size, for chunks that overrun the job and for a job without flags.
+bool ReadConsoleJob(std::uint32_t instance, const std::uint8_t* job, const std::uint8_t* end, ConsoleJob& out, ConsoleRefusal& refusal) {
+    out.header = JobHeader{};
+    out.header.instance = instance;
+    out.header.console = true;
+    std::vector<AjmBuffer> inputs;
+    std::vector<AjmBuffer> outputs;
+    AjmBuffer controlInput{};
+    AjmBuffer controlOutput{};
+    ConsoleChunk flagsKind = ConsoleChunk::Job;
+    refusal = ConsoleRefusal{};
+    refusal.job = job;
+    const std::uint8_t* at = job + 2 * sizeof(std::uint32_t);
+    while (at < end) {
+        refusal.offset = static_cast<std::uint32_t>(at - job);
+        if (end - at < 8) return false;
+        std::uint32_t words[2];
+        std::memcpy(words, at, sizeof(words));
+        const auto kind = ConsoleChunkKind(words[0]);
+        if (kind == ConsoleChunk::ControlFlags || kind == ConsoleChunk::RunFlags) {
+            if (flagsKind != ConsoleChunk::Job) return false;
+            flagsKind = kind;
+            out.header.flags = (std::uint64_t{ConsoleChunkPayload(words[0])} << 32) | words[1];
+            at += sizeof(words);
+            continue;
+        }
+        if (kind != ConsoleChunk::InputRunBuffer && kind != ConsoleChunk::InputControlBuffer && kind != ConsoleChunk::ReturnAddress && kind != ConsoleChunk::OutputRunBuffer && kind != ConsoleChunk::OutputControlBuffer) {
+            NotImplemented_nid_no_patch(("sceAjmBatchStartBuffer (job chunk kind " + std::to_string(static_cast<unsigned>(kind)) + ")").c_str());
+        }
+        if (end - at < 16) return false;
+        AjmBuffer buffer{nullptr, words[1]};
+        std::memcpy(&buffer.ptr, at + sizeof(words), sizeof(buffer.ptr));
+        at += 16;
+        if (kind == ConsoleChunk::ReturnAddress) {
+            refusal.returnAddress = buffer.ptr;
+            continue;
+        }
+        if (buffer.size == 0) continue;
+        if (!buffer.ptr) {
+            refusal.code = SCE_AJM_ERROR_INVALID_ADDRESS;
+            return false;
+        }
+        if (kind == ConsoleChunk::InputRunBuffer) inputs.push_back(buffer);
+        if (kind == ConsoleChunk::OutputRunBuffer) outputs.push_back(buffer);
+        if (kind == ConsoleChunk::InputControlBuffer) controlInput = buffer;
+        if (kind == ConsoleChunk::OutputControlBuffer) controlOutput = buffer;
+    }
+    refusal.offset = static_cast<std::uint32_t>(end - job);
+    if (flagsKind == ConsoleChunk::Job) return false;
+    JobHeader& header = out.header;
+    header.sideband = controlOutput.ptr;
+    header.sidebandSize = controlOutput.size;
+    if (instance == CONSOLE_STATISTICS_INSTANCE) {
+        header.kind = JobKind::GetStatistics;
+    } else if (flagsKind == ConsoleChunk::ControlFlags) {
+        constexpr std::uint64_t implemented = CONSOLE_FLAGS_VERSION_AND_CODEC | CONTROL_RESET | CONTROL_INITIALIZE | SIDEBAND_GAPLESS_DECODE;
+        if ((header.flags & ~implemented) != 0) NotImplemented_nid_no_patch("sceAjmBatchStartBuffer (control job flags other than RESET, INITIALIZE and SIDEBAND_GAPLESS_DECODE)");
+        if (!inputs.empty() || !outputs.empty()) NotImplemented_nid_no_patch("sceAjmBatchStartBuffer (control job with run buffers)");
+        header.kind = JobKind::Control;
+        if (controlInput.size) inputs.push_back(controlInput);
+    } else {
+        if (controlInput.size) NotImplemented_nid_no_patch("sceAjmBatchStartBuffer (run job with an input control buffer)");
+        header.kind = JobKind::Run;
+    }
+    header.inputCount = static_cast<std::uint32_t>(inputs.size());
+    header.outputCount = static_cast<std::uint32_t>(outputs.size());
+    AJM_TRACE("[ajm] console job: instance %u, %s flags 0x%llx, %u input and %u output buffers, control input %llu and output %llu bytes\n", instance, flagsKind == ConsoleChunk::ControlFlags ? "control" : "run", static_cast<unsigned long long>(header.flags), header.inputCount, header.outputCount, static_cast<unsigned long long>(controlInput.size), static_cast<unsigned long long>(controlOutput.size));
+    out.buffers = std::move(inputs);
+    out.buffers.insert(out.buffers.end(), outputs.begin(), outputs.end());
+    return true;
+}
 }
 
 extern "C" {
@@ -1893,14 +2078,19 @@ int APS5_VABI sceAjmBatchJobGetStatistics(AjmBatchInfo* info, float interval, vo
 int APS5_VABI sceAjmBatchStart(uint32_t context, const AjmBatchInfo* info, int priority, AjmBatchError* error, uint32_t* batch) {
     if (context == 0 || context >= g_nextContext.load(std::memory_order_relaxed)) return SCE_AJM_ERROR_INVALID_CONTEXT;
     (void)priority;
-    if (!info || !batch) return SCE_AJM_ERROR_INVALID_PARAMETER;
+    if (!info || !batch || !info->p_buffer || info->offset > info->size) return SCE_AJM_ERROR_INVALID_PARAMETER;
     AJM_TRACE("[ajm] batch start: context %u, priority %d, %llu of %llu buffer bytes used\n", context, priority, static_cast<unsigned long long>(info->offset), static_cast<unsigned long long>(info->size));
     const auto* cursor = static_cast<const std::uint8_t*>(info->p_buffer);
-    const auto* end = cursor + info->offset;
+    auto remaining = info->offset;
     std::vector<AjmBuffer> buffers;
-    while (cursor < end) {
+    while (remaining != 0) {
+        if (remaining < sizeof(PackedJob)) NotImplemented_nid_no_patch("AJM batch contains a truncated private job header");
         PackedJob record;
         std::memcpy(&record, cursor, sizeof(record));
+        const std::size_t bufferCount = static_cast<std::size_t>(record.inputCount) + record.outputCount;
+        const std::size_t parameterBytes = (static_cast<std::size_t>(record.parameterSize) + 7u) & ~std::size_t{7};
+        const std::size_t requiredBytes = sizeof(PackedJob) + bufferCount * sizeof(AjmBuffer) + parameterBytes;
+        if (record.parameterSize > sizeof(JobHeader::parameters) || record.bytes < requiredBytes || record.bytes > remaining) NotImplemented_nid_no_patch("AJM batch contains an invalid private job size");
         JobHeader job{};
         job.kind = static_cast<JobKind>(record.kind);
         job.bytes = record.bytes;
@@ -1915,16 +2105,10 @@ int APS5_VABI sceAjmBatchStart(uint32_t context, const AjmBatchInfo* info, int p
         if (!buffers.empty()) std::memcpy(buffers.data(), cursor + sizeof(record), buffers.size() * sizeof(AjmBuffer));
         if (record.parameterSize) std::memcpy(job.parameters, cursor + sizeof(record) + buffers.size() * sizeof(AjmBuffer), record.parameterSize);
         Execute(job, buffers.data(), buffers.data() + job.inputCount);
-        cursor += record.bytes;
+        remaining -= record.bytes;
+        if (remaining != 0) cursor += record.bytes;
     }
-    if (error) std::memset(error, 0, sizeof(*error));
-    const auto id = g_nextBatch.fetch_add(1, std::memory_order_relaxed);
-    {
-        std::lock_guard lock(g_batchLock);
-        g_batches.emplace(id, context);
-    }
-    *batch = id;
-    return 0;
+    return RegisterBatch(context, error, batch);
 }
 
 int APS5_VABI sceAjmBatchWait(uint32_t context, uint32_t batch, uint32_t timeout, AjmBatchError* error) {
@@ -1953,4 +2137,69 @@ int APS5_VABI sceAjmBatchErrorDump(const AjmBatchInfo* info, AjmBatchError* erro
     return 0;
 }
 
+void* APS5_VABI sceAjmBatchJobControlBufferRa(void* position, uint32_t instance, uint64_t flags, const void* sideband_input, size_t sideband_input_size, void* sideband_output, size_t sideband_output_size, void* return_address) {
+    auto* job = static_cast<std::uint8_t*>(position);
+    auto* at = BeginConsoleJob(job, return_address);
+    at = PutConsoleBuffer(at, ConsoleChunk::InputControlBuffer, sideband_input, sideband_input_size);
+    at = PutConsoleFlags(at, ConsoleChunk::ControlFlags, flags);
+    at = PutConsoleBuffer(at, ConsoleChunk::OutputControlBuffer, sideband_output, sideband_output_size);
+    return EndConsoleJob(job, at, instance);
+}
+
+void* APS5_VABI sceAjmBatchJobRunSplitBufferRa(void* position, uint32_t instance, uint64_t flags, const AjmBuffer* input_buffers, size_t input_buffers_num, const AjmBuffer* output_buffers, size_t output_buffers_num, void* sideband_output, size_t sideband_output_size, void* return_address) {
+    if ((input_buffers_num && !input_buffers) || (output_buffers_num && !output_buffers)) NotImplemented_nid_no_patch("AJM batch job with a null buffer list and a nonzero buffer count");
+    auto* job = static_cast<std::uint8_t*>(position);
+    auto* at = BeginConsoleJob(job, return_address);
+    for (std::size_t index = 0; index < input_buffers_num; ++index) at = PutConsoleBuffer(at, ConsoleChunk::InputRunBuffer, input_buffers[index].ptr, input_buffers[index].size);
+    at = PutConsoleFlags(at, ConsoleChunk::RunFlags, flags);
+    for (std::size_t index = 0; index < output_buffers_num; ++index) at = PutConsoleBuffer(at, ConsoleChunk::OutputRunBuffer, output_buffers[index].ptr, output_buffers[index].size);
+    at = PutConsoleBuffer(at, ConsoleChunk::OutputControlBuffer, sideband_output, sideband_output_size);
+    return EndConsoleJob(job, at, instance);
+}
+
+void* APS5_VABI sceAjmBatchJobRunBufferRa(void* position, uint32_t instance, uint64_t flags, const void* data_input, size_t data_input_size, void* data_output, size_t data_output_size, void* sideband_output, size_t sideband_output_size, void* return_address) {
+    const AjmBuffer input{const_cast<void*>(data_input), data_input_size};
+    const AjmBuffer output{data_output, data_output_size};
+    return sceAjmBatchJobRunSplitBufferRa(position, instance, flags, &input, 1, &output, 1, sideband_output, sideband_output_size, return_address);
+}
+
+int APS5_VABI sceAjmBatchStartBuffer(uint32_t context, const uint8_t* batch, uint32_t batch_size, int priority, AjmBatchError* error, uint32_t* batch_id) {
+    if (context == 0 || context >= g_nextContext.load(std::memory_order_relaxed)) return SCE_AJM_ERROR_INVALID_CONTEXT;
+    if (!batch_id || !batch) return SCE_AJM_ERROR_INVALID_PARAMETER;
+    AJM_TRACE("[ajm] batch start buffer: context %u, priority %d, %u bytes\n", context, priority, batch_size);
+    std::vector<ConsoleJob> jobs;
+    ConsoleRefusal refusal;
+    const std::uint8_t* at = batch;
+    const std::uint8_t* end = batch + batch_size;
+    bool accepted = batch_size % 8 == 0;
+    while (accepted && at < end) {
+        refusal = ConsoleRefusal{};
+        refusal.job = at;
+        if (end - at < 8) {
+            accepted = false;
+            break;
+        }
+        std::uint32_t words[2];
+        std::memcpy(words, at, sizeof(words));
+        const std::uint8_t* body = at + sizeof(words);
+        if (words[1] > static_cast<std::size_t>(end - body)) {
+            accepted = false;
+            break;
+        }
+        const auto kind = ConsoleChunkKind(words[0]);
+        if (kind == ConsoleChunk::Job) {
+            accepted = ReadConsoleJob(ConsoleChunkPayload(words[0]), at, body + words[1], jobs.emplace_back(), refusal);
+        } else if (kind != ConsoleChunk::InlineBuffer) {
+            NotImplemented_nid_no_patch(("sceAjmBatchStartBuffer (batch chunk kind " + std::to_string(static_cast<unsigned>(kind)) + ")").c_str());
+        }
+        at = body + words[1];
+    }
+    if (!accepted) {
+        if (error) *error = AjmBatchError{refusal.code, refusal.job, refusal.offset, refusal.returnAddress};
+        return SCE_AJM_ERROR_MALFORMED_BATCH;
+    }
+    for (const ConsoleJob& job : jobs) Execute(job.header, job.buffers.data(), job.buffers.data() + job.header.inputCount);
+    return RegisterBatch(context, error, batch_id);
+}
+
 }
diff --git a/core/libs/prx/libSceAjm/Export.cpp b/core/libs/prx/libSceAjm/Export.cpp
index 508f721ede..87830816c5 100644
--- a/core/libs/prx/libSceAjm/Export.cpp
+++ b/core/libs/prx/libSceAjm/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,19 +6,6 @@
 
 extern "C" {
 
-int APS5_VABI sceAjmBatchJobControlBufferRa() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAjmBatchJobRunSplitBufferRa() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAjmBatchStartBuffer() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
+APS5_DUMMY_FUN
 
 }
diff --git a/core/libs/prx/libSceAjm/include/Api.hpp b/core/libs/prx/libSceAjm/include/Api.hpp
new file mode 100644
index 0000000000..2cc01a795b
--- /dev/null
+++ b/core/libs/prx/libSceAjm/include/Api.hpp
@@ -0,0 +1,7 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+}
diff --git a/core/libs/prx/libSceAjm/libSceAjm.hpp b/core/libs/prx/libSceAjm/libSceAjm.hpp
new file mode 100644
index 0000000000..302a86a22a
--- /dev/null
+++ b/core/libs/prx/libSceAjm/libSceAjm.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAjm/include/Api.hpp"
diff --git a/core/libs/prx/libSceAjmi/Export.cpp b/core/libs/prx/libSceAjmi/Export.cpp
index 83e8ac5ffa..bdb3e1159d 100644
--- a/core/libs/prx/libSceAjmi/Export.cpp
+++ b/core/libs/prx/libSceAjmi/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjmi/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -12,8 +13,8 @@ int APS5_VABI sceAjmBatchJobInlineBuffer(void) {
     return 0;
 }
 
-int APS5_VABI sceAjmBatchJobRunBufferRa(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceAjmBatchJobRunBufferRa_nid_disambig1(void) {
+    NotImplemented_nid_no_patch("sceAjmBatchJobRunBufferRa");
     return 0;
 }
 
diff --git a/core/libs/prx/libSceAjmi/include/Api.hpp b/core/libs/prx/libSceAjmi/include/Api.hpp
new file mode 100644
index 0000000000..f12efb729c
--- /dev/null
+++ b/core/libs/prx/libSceAjmi/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAjmBatchJobInlineBuffer(void);
+int APS5_VABI sceAjmBatchJobRunBufferRa_nid_disambig1(void);
+
+}
diff --git a/core/libs/prx/libSceAjmi/libSceAjmi.hpp b/core/libs/prx/libSceAjmi/libSceAjmi.hpp
new file mode 100644
index 0000000000..739e63957f
--- /dev/null
+++ b/core/libs/prx/libSceAjmi/libSceAjmi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAjmi/include/Api.hpp"
diff --git a/core/libs/prx/libSceAmpr/Export.cpp b/core/libs/prx/libSceAmpr/Export.cpp
index ca51ae70f2..ab976c5ed3 100644
--- a/core/libs/prx/libSceAmpr/Export.cpp
+++ b/core/libs/prx/libSceAmpr/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <ctime>
@@ -226,22 +228,11 @@ static int RecordWriteAddressFromCounterPair(Apr::CommandBufferObject* buffer, v
 
 static std::atomic_flag sharedPtrSpinLock;
 
-struct AmmUsageStatsData {
-    std::uint64_t sizeInBytes;
-    std::uint16_t numPageTablePoolEntries;
-    std::uint16_t allocatedPageTablePoolEntries;
-    std::uint16_t highWatermarkAllocatedEntries;
-    std::uint16_t reserved;
-    std::uint32_t ringIdleFlags;
-};
 static_assert(sizeof(AmmUsageStatsData) == 0x18);
 static constexpr std::uint16_t AmmPageTablePoolEntries = 512;
 static constexpr std::uint32_t AmmRingIdleFlags = 0x7;
 
 extern "C" {
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-int APS5_VABI wcstombs_s_nid_postfix(std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit);
-[[noreturn]] void APS5_VABI __cxa_call_terminate_nid_postfix(void* exception);
 
 int APS5_VABI sceAmprCommandBufferWriteAddressOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t value) {
     if (!ValidWriteAddress(address)) return SCE_KERNEL_ERROR_EINVAL;
@@ -624,11 +615,6 @@ std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteKernelEventQueue_04_00(std
     return sizeof(Apr::WriteKernelEventQueueCommand);
 }
 
-struct AmmSubmitResult {
-    std::int32_t result;
-    std::uint32_t errorOffset;
-};
-
 int APS5_VABI sceAmprAmmCommandBufferConstructor(Apr::CommandBufferObject* buffer) {
     (void)buffer;
     return 0;
@@ -867,8 +853,8 @@ void APS5_VABI _Lock_shared_ptr_spin_lock_nid_postfix(void) {
     while (sharedPtrSpinLock.test_and_set(std::memory_order_acquire)) std::this_thread::yield();
 }
 
-
 [[noreturn]] void APS5_VABI __cxa_call_unexpected_nid_postfix(void* unwindException) {
+
     __cxa_call_terminate_nid_postfix(unwindException);
 }
 
diff --git a/core/libs/prx/libSceAmpr/include/Api.hpp b/core/libs/prx/libSceAmpr/include/Api.hpp
new file mode 100644
index 0000000000..8939494652
--- /dev/null
+++ b/core/libs/prx/libSceAmpr/include/Api.hpp
@@ -0,0 +1,159 @@
+#pragma once
+
+#include "prx/libkernel/Apr/include/AprCommandBuffer.hpp"
+#include "prx/libc/include/GuestTime.hpp"
+#include "SceTypes.hpp"
+
+struct AmmSubmitResult {
+    std::int32_t result;
+    std::uint32_t errorOffset;
+};
+
+struct AmmUsageStatsData {
+    std::uint64_t sizeInBytes;
+    std::uint16_t numPageTablePoolEntries;
+    std::uint16_t allocatedPageTablePoolEntries;
+    std::uint16_t highWatermarkAllocatedEntries;
+    std::uint16_t reserved;
+    std::uint32_t ringIdleFlags;
+};
+
+extern "C" {
+
+int APS5_VABI sceAmprCommandBufferWriteAddressOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t value);
+int APS5_VABI sceAmprCommandBufferWriteCounterOnCompletion(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint32_t value);
+int APS5_VABI sceAmprCommandBufferWaitOnAddress(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t reference, std::uint8_t compare, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWaitOnCounter(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint32_t reference, std::uint8_t compare, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWriteKernelEventQueueOnCompletion(Apr::CommandBufferObject* buffer, std::uint64_t equeue, std::int32_t ident, std::uint64_t data);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounterOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPairOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressOnCompletion();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteCounterOnCompletion();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnAddress();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnCounter();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteKernelEventQueueOnCompletion();
+int APS5_VABI sceAmprAprCommandBufferConstructor(Apr::CommandBufferObject* buffer, uint64_t* gatherState, uint64_t* scatterState);
+int APS5_VABI sceAmprAprCommandBufferDestructor(Apr::CommandBufferObject* buffer, uint64_t* gatherState, uint64_t* scatterState);
+int APS5_VABI sceAmprAprCommandBufferMapBegin(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAprCommandBufferMapDirectBegin(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAprCommandBufferMapEnd(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprAprCommandBufferReadFile(Apr::CommandBufferObject* buffer, uint64_t* gatherState, uint64_t* scatterState, uint32_t fileId, void* destination, uint64_t size, uint64_t offset);
+int APS5_VABI sceAmprAprCommandBufferReadFileGather(Apr::CommandBufferObject* buffer, std::uint64_t* mapState, std::uint64_t* scatterGatherState, std::uint64_t size, std::uint64_t offset);
+int APS5_VABI sceAmprAprCommandBufferReadFileGatherScatter(Apr::CommandBufferObject* buffer, std::uint64_t* mapState, std::uint64_t* scatterGatherState, void* destination, std::uint64_t size, std::uint64_t offset);
+int APS5_VABI sceAmprAprCommandBufferReadFileScatter(Apr::CommandBufferObject* buffer, std::uint64_t* mapState, std::uint64_t* scatterGatherState, void* destination, std::uint64_t size);
+int APS5_VABI sceAmprAprCommandBufferResetGatherScatterState(Apr::CommandBufferObject* buffer);
+void* APS5_VABI sceAmprCommandBufferClearBuffer(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferConstructMarker(Apr::CommandBufferObject* buffer, std::uint32_t type, const char* text, const std::uint32_t* color);
+int APS5_VABI sceAmprCommandBufferConstructNop(Apr::CommandBufferObject* buffer, std::int16_t type, const void* payload, std::uint32_t payloadBytes, const std::uint32_t* word);
+int APS5_VABI sceAmprCommandBufferConstructor(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferDestructor(Apr::CommandBufferObject* buffer);
+void* APS5_VABI sceAmprCommandBufferGetBufferBaseAddress(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetCurrentOffset(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetNumCommands(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetSize(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetType(const Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferNop(Apr::CommandBufferObject* buffer, std::uint32_t dwords);
+int APS5_VABI sceAmprCommandBufferNopWithData(Apr::CommandBufferObject* buffer, std::uint32_t dwords, const std::uint32_t* data);
+int APS5_VABI sceAmprCommandBufferPopMarker(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferPushMarker(Apr::CommandBufferObject* buffer, const char* text);
+int APS5_VABI sceAmprCommandBufferPushMarkerWithColor(Apr::CommandBufferObject* buffer, const char* text, std::uint32_t color);
+int APS5_VABI sceAmprCommandBufferReset(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferSetBuffer(Apr::CommandBufferObject* buffer, void* memory, uint32_t size);
+int APS5_VABI sceAmprCommandBufferSetMarker(Apr::CommandBufferObject* buffer, const char* text);
+int APS5_VABI sceAmprCommandBufferSetMarkerWithColor(Apr::CommandBufferObject* buffer, const char* text, const std::uint32_t* color);
+int APS5_VABI sceAmprCommandBufferWaitOnAddress_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t reference, std::uint8_t compare, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWaitOnCounter_04_00(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint8_t access, std::uint64_t reference, std::uint8_t compare, std::uint8_t maskOperation, std::uint64_t mask, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPair_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter, std::uint64_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounter_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter, std::uint64_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounter_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteAddress_04_00(Apr::CommandBufferObject* buffer, uint64_t* address, uint64_t value, uint32_t flags);
+int APS5_VABI sceAmprCommandBufferWriteCounter_04_00(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint8_t access, std::uint64_t value, std::uint8_t operation, std::uint8_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteKernelEventQueue_04_00(Apr::CommandBufferObject* buffer, std::uint64_t equeue, std::int32_t ident, std::uint64_t data, std::uint64_t atStart);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapBegin(std::uint64_t address, std::uint64_t size, std::uint32_t type, std::uint32_t protection);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapDirectBegin(std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::uint32_t type, std::uint32_t protection);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapEnd();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNop(std::uint32_t dwords);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNopWithData(std::uint32_t dwords);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizePopMarker();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarker(const char* text);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarkerWithColor(const char* text, std::uint32_t color);
+uint32_t APS5_VABI sceAmprMeasureCommandSizeReadFile(void);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGather(std::uint64_t size, std::uint64_t offset);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGatherScatter(void* destination, std::uint64_t size, std::uint64_t offset);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileScatter(void* destination, std::uint64_t size);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeResetGatherScatterState();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarker(const char* text);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarkerWithColor(const char* text, std::uint32_t color);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnAddress_04_00(volatile std::uint64_t* address, std::uint64_t, std::uint8_t compare, std::uint8_t flush);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnCounter_04_00(std::uint8_t, std::uint8_t access, std::uint64_t, std::uint8_t compare, std::uint8_t maskOperation, std::uint64_t, std::uint8_t flush);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounterPair_04_00(volatile std::uint64_t* address, std::uint8_t counter);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounter_04_00(volatile std::uint64_t* address, std::uint8_t counter);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromTimeCounter_04_00(volatile std::uint64_t* address);
+uint32_t APS5_VABI sceAmprMeasureCommandSizeWriteAddress_04_00(void);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteCounter_04_00(std::uint8_t counter, std::uint8_t access, std::uint64_t, std::uint8_t operation);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteKernelEventQueue_04_00(std::uint64_t, std::int32_t, std::uint64_t);
+int APS5_VABI sceAmprAmmCommandBufferConstructor(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprAmmCommandBufferDestructor(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprAmmCommandBufferMap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferMapWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferMapDirect(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferMapDirectWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferUnmap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMap(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapWithGpuMaskId(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirect(std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirectWithGpuMaskId(std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeUnmap(std::uint64_t address, std::uint64_t size);
+int APS5_VABI sceAmprAmmCommandBufferRemap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferRemapWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferMultiMap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferMultiMapWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferModifyProtect(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask);
+int APS5_VABI sceAmprAmmCommandBufferModifyProtectWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtect(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask);
+int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtectWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemap(std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemapWithGpuMaskId(std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMap(std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMapWithGpuMaskId(std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtect(std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtectWithGpuMaskId(std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtect(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtectWithGpuMaskId(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferMapAsPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size);
+int APS5_VABI sceAmprAmmCommandBufferAllocatePaForPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferRemapIntoPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection, std::uint32_t opcode);
+int APS5_VABI sceAmprAmmCommandBufferUnmapToPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapAsPrt(std::uint64_t address, std::uint64_t size);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeAllocatePaForPrt(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmGiveDirectMemory(std::int64_t searchStart, std::int64_t searchEnd, std::size_t size, std::size_t alignment, int usage, std::int64_t* offset);
+int APS5_VABI sceAmprAmmGetVirtualAddressRanges(std::uint64_t* start, std::uint64_t* end, std::uint64_t* multimapStart, std::uint64_t* multimapEnd);
+int APS5_VABI sceAmprAmmSetPageTablePoolOccupancyNotificationThreshold(void);
+int APS5_VABI sceAmprAmmSubmitCommandBuffer(void* base, std::uint32_t offset, std::uint32_t priority);
+int APS5_VABI sceAmprAmmSubmitCommandBuffer2(void* base, std::uint32_t offset, std::uint32_t priority, AmmSubmitResult* result, std::uint32_t* id);
+int APS5_VABI sceAmprAmmSubmitCommandBuffer3(void* base, std::uint32_t offset, std::uint32_t priority, std::uint32_t* id);
+int APS5_VABI sceAmprAmmWaitCommandBufferCompletion(std::uint32_t id);
+void APS5_VABI _Unlock_shared_ptr_spin_lock_nid_postfix(void);
+int APS5_VABI _Cnd_init_with_name_nid_postfix(void** handle, const char*);
+int APS5_VABI _ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE3getES3_S3_RSt8ios_baseRNSt5_IosbIiE8_IostateEP2tmPKcSE__nid_postfix(void);
+int APS5_VABI _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(void);
+void APS5_VABI _Lock_shared_ptr_spin_lock_nid_postfix(void);
+SonyLconv* APS5_VABI sceAmprLocaleconv(void);
+unsigned __int128 APS5_VABI sceAmprUdivti3(unsigned __int128 dividend, unsigned __int128 divisor);
+double APS5_VABI sceAmprSinh(double x, double y);
+char* APS5_VABI sceAmprStrtokS(char* str, const char* delim, char** context);
+int APS5_VABI sceAmprCtimeS(char* buffer, std::size_t size, const std::int64_t* time);
+int APS5_VABI sceAmprWcscpyS(std::uint16_t* dest, std::size_t size, const std::uint16_t* src);
+void* APS5_VABI sceAmprSetConstraintHandlerS(void* handler);
+int APS5_VABI sceAmprFltrounds(void);
+void APS5_VABI sceAmprIgnoreHandlerS(const char* message, void* pointer, int error);
+int APS5_VABI sceAmprWcstombsS(std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit);
+std::size_t APS5_VABI sceAmprMbstowcs(std::uint16_t* dest, const char* src, std::size_t size);
+int APS5_VABI sceAmprAsctimeS(char* buffer, std::size_t size, const GuestTm* time);
+int APS5_VABI sceAmprFpclassifyd(double value);
+int APS5_VABI sceAmprAmmGetUsageStatsData(AmmUsageStatsData* stats);
+
+[[noreturn]] void APS5_VABI __cxa_call_unexpected_nid_postfix(void* unwindException);
+
+}
diff --git a/core/libs/prx/libSceAmpr/libSceAmpr.hpp b/core/libs/prx/libSceAmpr/libSceAmpr.hpp
new file mode 100644
index 0000000000..de5e0e7862
--- /dev/null
+++ b/core/libs/prx/libSceAmpr/libSceAmpr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAmpr/include/Api.hpp"
diff --git a/core/libs/prx/libSceAppChecker/Export.cpp b/core/libs/prx/libSceAppChecker/Export.cpp
index b50753644e..1ed8f0345d 100644
--- a/core/libs/prx/libSceAppChecker/Export.cpp
+++ b/core/libs/prx/libSceAppChecker/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAppChecker/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAppChecker/include/Api.hpp b/core/libs/prx/libSceAppChecker/include/Api.hpp
new file mode 100644
index 0000000000..9c850dbc67
--- /dev/null
+++ b/core/libs/prx/libSceAppChecker/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAppCheckerAbort();
+int APS5_VABI sceAppCheckerExecute();
+int APS5_VABI sceAppCheckerExecuteEx();
+
+}
diff --git a/core/libs/prx/libSceAppChecker/libSceAppChecker.hpp b/core/libs/prx/libSceAppChecker/libSceAppChecker.hpp
new file mode 100644
index 0000000000..471d19be34
--- /dev/null
+++ b/core/libs/prx/libSceAppChecker/libSceAppChecker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAppChecker/include/Api.hpp"
diff --git a/core/libs/prx/libSceAppContent/Export.cpp b/core/libs/prx/libSceAppContent/Export.cpp
index 6854c950da..3485cd7b86 100644
--- a/core/libs/prx/libSceAppContent/Export.cpp
+++ b/core/libs/prx/libSceAppContent/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAppContent/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -26,11 +27,6 @@ static constexpr char TEMPORARY_MOUNT_POINT[] = "/temp0";
 static constexpr char DOWNLOAD_MOUNT_POINT[] = "/download0";
 static constexpr uint32_t TEMPORARY_DATA_OPTION_FORMAT = 1;
 
-struct AppContentAddcontInfo {
-    NpUnifiedEntitlementLabel entitlement_label;
-    uint32_t status;
-};
-
 namespace {
 
 std::atomic_bool initialized{false};
@@ -209,7 +205,6 @@ int APS5_VABI sceAppContentTemporaryDataUnmount(const AppContentMountPoint* moun
     return 0;
 }
 
-
 int APS5_VABI sceAppContentAddcontEnqueueDownload(uint32_t service_label, const NpUnifiedEntitlementLabel* entitlement_label) {
     if (!initialized.load()) return SCE_APP_CONTENT_ERROR_NOT_INITIALIZED;
     (void)service_label;
@@ -293,9 +288,12 @@ int APS5_VABI sceAppContentGetDownloadedStoreCountry(void) {
     return 0;
 }
 
-int APS5_VABI sceAppContentGetEntitlementKey(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAppContentGetEntitlementKey(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, AppContentEntitlementKey* key) {
+    if (!initialized.load()) return SCE_APP_CONTENT_ERROR_NOT_INITIALIZED;
+    (void)serviceLabel;
+    if (!entitlementLabel || !key) return SCE_APP_CONTENT_ERROR_PARAMETER;
+    if (!validEntitlementLabel(*entitlementLabel, 0x01500000)) return SCE_APP_CONTENT_ERROR_PARAMETER;
+    return SCE_APP_CONTENT_ERROR_DRM_NO_ENTITLEMENT;
 }
 
 int APS5_VABI sceAppContentGetPftFlag(void) {
diff --git a/core/libs/prx/libSceAppContent/include/Api.hpp b/core/libs/prx/libSceAppContent/include/Api.hpp
new file mode 100644
index 0000000000..cd0a799e37
--- /dev/null
+++ b/core/libs/prx/libSceAppContent/include/Api.hpp
@@ -0,0 +1,49 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct AppContentAddcontInfo {
+    NpUnifiedEntitlementLabel entitlement_label;
+    uint32_t status;
+};
+
+struct AppContentEntitlementKey {
+    char data[16];
+};
+
+extern "C" {
+
+int APS5_VABI sceAppContentAddcontMount(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentAddcontUnmount(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentGetAddcontInfo(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, AppContentAddcontInfo* info);
+int APS5_VABI sceAppContentGetAddcontInfoList(uint32_t serviceLabel, AppContentAddcontInfo* list, uint32_t listNum, uint32_t* hitNum);
+int APS5_VABI sceAppContentAppParamGetInt(uint32_t paramId, int32_t* value);
+int APS5_VABI sceAppContentDownloadDataFormat(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentDownloadDataGetAvailableSpaceKb(const AppContentMountPoint* mountPoint, size_t* availableSpaceKb);
+int APS5_VABI sceAppContentInitialize(const AppContentInitParam* initParam, AppContentBootParam* bootParam);
+int APS5_VABI sceAppContentTemporaryDataFormat(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentTemporaryDataGetAvailableSpaceKb(const AppContentMountPoint* mountPoint, size_t* availableSpaceKb);
+int APS5_VABI sceAppContentTemporaryDataMount2(uint32_t option, AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentTemporaryDataUnmount(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentAddcontEnqueueDownload(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel);
+int APS5_VABI sceAppContentAddcontDelete(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel);
+int APS5_VABI sceAppContentGetAddcontDownloadProgress(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, void* progress);
+int APS5_VABI sceAppContentAddcontEnqueueDownloadByEntitlemetId(void);
+int APS5_VABI sceAppContentAddcontEnqueueDownloadSp(void);
+int APS5_VABI sceAppContentAddcontMountByEntitlemetId(void);
+int APS5_VABI sceAppContentAddcontShrink(void);
+int APS5_VABI sceAppContentAppParamGetString(void);
+int APS5_VABI sceAppContentDownload0Expand(void);
+int APS5_VABI sceAppContentDownload0Shrink(void);
+int APS5_VABI sceAppContentDownload1Expand(void);
+int APS5_VABI sceAppContentDownload1Shrink(void);
+int APS5_VABI sceAppContentGetAddcontInfoByEntitlementId(void);
+int APS5_VABI sceAppContentGetAddcontInfoListByIroTag(void);
+int APS5_VABI sceAppContentGetDownloadedStoreCountry(void);
+int APS5_VABI sceAppContentGetEntitlementKey(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, AppContentEntitlementKey* key);
+int APS5_VABI sceAppContentGetPftFlag(void);
+int APS5_VABI sceAppContentGetRegion(void);
+int APS5_VABI sceAppContentRequestPatchInstall(void);
+int APS5_VABI sceAppContentTemporaryDataMount(AppContentMountPoint* mountPoint);
+
+}
diff --git a/core/libs/prx/libSceAppContent/libSceAppContent.hpp b/core/libs/prx/libSceAppContent/libSceAppContent.hpp
new file mode 100644
index 0000000000..d92b11cf65
--- /dev/null
+++ b/core/libs/prx/libSceAppContent/libSceAppContent.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAppContent/include/Api.hpp"
diff --git a/core/libs/prx/libSceAppDbShellCoreClient/libSceAppDbShellCoreClient.hpp b/core/libs/prx/libSceAppDbShellCoreClient/libSceAppDbShellCoreClient.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAppDbShellCoreClient/libSceAppDbShellCoreClient.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAppDbShellCoreClientForSystemService/libSceAppDbShellCoreClientForSystemService.hpp b/core/libs/prx/libSceAppDbShellCoreClientForSystemService/libSceAppDbShellCoreClientForSystemService.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAppDbShellCoreClientForSystemService/libSceAppDbShellCoreClientForSystemService.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAppInstUtil/Export.cpp b/core/libs/prx/libSceAppInstUtil/Export.cpp
index 5925f41ddd..51721067a8 100644
--- a/core/libs/prx/libSceAppInstUtil/Export.cpp
+++ b/core/libs/prx/libSceAppInstUtil/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceAppInstUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct AppInstallProgressInfo;
-
 extern "C" {
 
 int APS5_VABI sceAppInstUtilInitialize(void) {
@@ -84,4 +83,494 @@ int APS5_VABI sceAppInstUtilGetPrimaryAppSlot(const char* titleId, void* slot) {
     return 0;
 }
 
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatusByAppInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstall2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontListTotalSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontInfoByContentId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddcontInstalledStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUpdateStartTime(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLink(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLinkByUser(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontNum(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelUnInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppDestroyMetadata(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCheckAppSystemVer(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppConvertAppDownloadToDisc(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetMainAppTitleIdForSP(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetSubAppTitleIdForSP(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetMainAppTitleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetSubAppTitleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppDestroyPkg(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilJson(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInsertedDiscRoleType(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRequestInstallDiscGame(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRequestDataDiscCopy(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelDataDiscCopy(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetDataDiscCopyProgress(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilSetPrimaryAppSlot(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAppSlotInfoList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAppEmptySlot(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallGetLinkState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstallForMultiInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallPs4CloudGame(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppStoreCompilationDiscInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetCompilationDiscInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetStoreCompilationDiscInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleIdList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallRequestCompilationDiscApp(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetNoRelatedAddcontTitleList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetIrremovableAppList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppRequestMoveApps(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppProhibitDownloadInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppAllowDownloadInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAppMoveProgressInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelMoveApps(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetMoveErrorAppList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAllAppSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelGetAllAppSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscMasterDataId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAppOtherSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelGetAppOtherSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInsertedDiscTotal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppSetRemasterInstallType(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInstallProgressInfoForMultiDisc(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilMountBdEmu(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilUnmountBdEmu(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInstallStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilResumeInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilPauseInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRegisterDownload(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilStartInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstallPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetPatchInstallStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilResumePatchInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilPausePatchInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelInstallPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelInstallAddcont(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelForMultiInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstallByPackage(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilIsRestoreState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetRestoreState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddons(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInstallOptions(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetContentSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelGetInformation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetWorkspaceStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilDeleteWorkspace(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetParentalControlLevel(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCheckLatestPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelCheckPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallPsNowIcon(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddcontInfoList2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddcontInfoList3(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilClearAddcontInfoCache(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetContentSize2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallContentPush(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAvailableStorage(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilSwitchInstallLocation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetConfigList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilSwitchConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRestoreDataSource(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetNeededStorageSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetStorageDestType(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstallAddons(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceAppInstUtil/include/Api.hpp b/core/libs/prx/libSceAppInstUtil/include/Api.hpp
new file mode 100644
index 0000000000..eeb9b40a31
--- /dev/null
+++ b/core/libs/prx/libSceAppInstUtil/include/Api.hpp
@@ -0,0 +1,128 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct AppInstallProgressInfo;
+
+extern "C" {
+
+int APS5_VABI sceAppInstUtilInitialize(void);
+int APS5_VABI sceAppInstUtilTerminate(void);
+int APS5_VABI sceAppInstUtilAppInstallAll(void* reserved);
+int APS5_VABI sceAppInstUtilAppInstallTitleDir(const char* titleId, const char* titleDir, void* reserved);
+int APS5_VABI sceAppInstUtilAppIsInInstalling(int32_t* installing);
+int APS5_VABI sceAppInstUtilAppIsInUpdating(const char* titleId, bool* updating);
+int APS5_VABI sceAppInstUtilAppExists(const char* titleId, int32_t* exists);
+int APS5_VABI sceAppInstUtilAppGetSize(const char* titleId, std::uint64_t* size);
+int APS5_VABI sceAppInstUtilAppInstallPkg(const char* packagePath, std::uint64_t serviceArgument);
+int APS5_VABI sceAppInstUtilAppPrepareOverwritePkg();
+int APS5_VABI sceAppInstUtilAppRecoverApp();
+int APS5_VABI sceAppInstUtilAppUnInstall(const char* titleId);
+int APS5_VABI sceAppInstUtilAppUnInstallAddcont(const char* titleId, const char* contentLabel);
+int APS5_VABI sceAppInstUtilAppUnInstallPat(const char* titleId);
+int APS5_VABI sceAppInstUtilAppUnInstallTheme();
+int APS5_VABI sceAppInstUtilAppUnInstallTypes(const char* titleId, std::uint32_t types);
+int APS5_VABI sceAppInstUtilGetInstallProgressInfo(const char* titleId, AppInstallProgressInfo* info);
+int APS5_VABI sceAppInstUtilGetInstallProgress(const char* titleId, void* progress);
+int APS5_VABI sceAppInstUtilGetPrimaryAppSlot(const char* titleId, void* slot);
+
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatusByAppInfo(void);
+int APS5_VABI sceAppInstUtilAppUnInstall2(void);
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote(void);
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote2(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontListTotalSize(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontInfo(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontInfoByContentId(void);
+int APS5_VABI sceAppInstUtilGetAddcontInstalledStatus(void);
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleId(void);
+int APS5_VABI sceAppInstUtilAppUpdateStartTime(void);
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLink(void);
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLinkByUser(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontNum(void);
+int APS5_VABI sceAppInstUtilAppCancelUnInstall(void);
+int APS5_VABI sceAppInstUtilAppDestroyMetadata(void);
+int APS5_VABI sceAppInstUtilCheckAppSystemVer(void);
+int APS5_VABI sceAppInstUtilAppConvertAppDownloadToDisc(void);
+int APS5_VABI sceAppInstUtilGetMainAppTitleIdForSP(void);
+int APS5_VABI sceAppInstUtilGetSubAppTitleIdForSP(void);
+int APS5_VABI sceAppInstUtilGetMainAppTitleId(void);
+int APS5_VABI sceAppInstUtilGetSubAppTitleId(void);
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatus(void);
+int APS5_VABI sceAppInstUtilAppDestroyPkg(void);
+int APS5_VABI sceAppInstUtilJson(void);
+int APS5_VABI sceAppInstUtilGetInsertedDiscRoleType(void);
+int APS5_VABI sceAppInstUtilRequestInstallDiscGame(void);
+int APS5_VABI sceAppInstUtilRequestDataDiscCopy(void);
+int APS5_VABI sceAppInstUtilCancelDataDiscCopy(void);
+int APS5_VABI sceAppInstUtilGetDataDiscCopyProgress(void);
+int APS5_VABI sceAppInstUtilSetPrimaryAppSlot(void);
+int APS5_VABI sceAppInstUtilGetAppSlotInfoList(void);
+int APS5_VABI sceAppInstUtilGetAppEmptySlot(void);
+int APS5_VABI sceAppInstUtilAppInstallGetLinkState(void);
+int APS5_VABI sceAppInstUtilAppUnInstallForMultiInstall(void);
+int APS5_VABI sceAppInstUtilAppInstallPs4CloudGame(void);
+int APS5_VABI sceAppInstUtilAppStoreCompilationDiscInfo(void);
+int APS5_VABI sceAppInstUtilAppGetCompilationDiscInfo(void);
+int APS5_VABI sceAppInstUtilAppGetStoreCompilationDiscInfo(void);
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleIdList(void);
+int APS5_VABI sceAppInstUtilAppInstallRequestCompilationDiscApp(void);
+int APS5_VABI sceAppInstUtilAppGetNoRelatedAddcontTitleList(void);
+int APS5_VABI sceAppInstUtilAppGetIrremovableAppList(void);
+int APS5_VABI sceAppInstUtilAppRequestMoveApps(void);
+int APS5_VABI sceAppInstUtilAppProhibitDownloadInstall(void);
+int APS5_VABI sceAppInstUtilAppAllowDownloadInstall(void);
+int APS5_VABI sceAppInstUtilGetAppMoveProgressInfo(void);
+int APS5_VABI sceAppInstUtilAppCancelMoveApps(void);
+int APS5_VABI sceAppInstUtilAppGetMoveErrorAppList(void);
+int APS5_VABI sceAppInstUtilAppGetAllAppSize(void);
+int APS5_VABI sceAppInstUtilAppCancelGetAllAppSize(void);
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscMasterDataId(void);
+int APS5_VABI sceAppInstUtilAppGetAppOtherSize(void);
+int APS5_VABI sceAppInstUtilAppCancelGetAppOtherSize(void);
+int APS5_VABI sceAppInstUtilGetInsertedDiscTotal(void);
+int APS5_VABI sceAppInstUtilAppSetRemasterInstallType(void);
+int APS5_VABI sceAppInstUtilGetInstallProgressInfoForMultiDisc(void);
+int APS5_VABI sceAppInstUtilMountBdEmu(void);
+int APS5_VABI sceAppInstUtilUnmountBdEmu(void);
+int APS5_VABI sceAppInstUtilGetInstallStatus(void);
+int APS5_VABI sceAppInstUtilResumeInstall(void);
+int APS5_VABI sceAppInstUtilPauseInstall(void);
+int APS5_VABI sceAppInstUtilRegisterDownload(void);
+int APS5_VABI sceAppInstUtilInstall(void);
+int APS5_VABI sceAppInstUtilStartInstall(void);
+int APS5_VABI sceAppInstUtilInstallPatch(void);
+int APS5_VABI sceAppInstUtilGetPatchInstallStatus(void);
+int APS5_VABI sceAppInstUtilResumePatchInstall(void);
+int APS5_VABI sceAppInstUtilPausePatchInstall(void);
+int APS5_VABI sceAppInstUtilCancelInstallPatch(void);
+int APS5_VABI sceAppInstUtilCancelInstallAddcont(void);
+int APS5_VABI sceAppInstUtilCancelInstall(void);
+int APS5_VABI sceAppInstUtilCancelForMultiInstall(void);
+int APS5_VABI sceAppInstUtilInstallByPackage(void);
+int APS5_VABI sceAppInstUtilIsRestoreState(void);
+int APS5_VABI sceAppInstUtilGetRestoreState(void);
+int APS5_VABI sceAppInstUtilGetAddons(void);
+int APS5_VABI sceAppInstUtilGetInstallOptions(void);
+int APS5_VABI sceAppInstUtilGetContentSize(void);
+int APS5_VABI sceAppInstUtilCancelGetInformation(void);
+int APS5_VABI sceAppInstUtilGetWorkspaceStatus(void);
+int APS5_VABI sceAppInstUtilDeleteWorkspace(void);
+int APS5_VABI sceAppInstUtilGetParentalControlLevel(void);
+int APS5_VABI sceAppInstUtilCheckLatestPatch(void);
+int APS5_VABI sceAppInstUtilCancelCheckPatch(void);
+int APS5_VABI sceAppInstUtilAppInstallPsNowIcon(void);
+int APS5_VABI sceAppInstUtilGetAddcontInfoList2(void);
+int APS5_VABI sceAppInstUtilGetAddcontInfoList3(void);
+int APS5_VABI sceAppInstUtilClearAddcontInfoCache(void);
+int APS5_VABI sceAppInstUtilGetContentSize2(void);
+int APS5_VABI sceAppInstUtilAppInstallContentPush(void);
+int APS5_VABI sceAppInstUtilGetAvailableStorage(void);
+int APS5_VABI sceAppInstUtilSwitchInstallLocation(void);
+int APS5_VABI sceAppInstUtilGetConfigList(void);
+int APS5_VABI sceAppInstUtilSwitchConfig(void);
+int APS5_VABI sceAppInstUtilRestoreDataSource(void);
+int APS5_VABI sceAppInstUtilGetNeededStorageSize(void);
+int APS5_VABI sceAppInstUtilAppGetStorageDestType(void);
+int APS5_VABI sceAppInstUtilInstallAddons(void);
+
+}
diff --git a/core/libs/prx/libSceAppInstUtil/libSceAppInstUtil.hpp b/core/libs/prx/libSceAppInstUtil/libSceAppInstUtil.hpp
new file mode 100644
index 0000000000..8d20c5a6f2
--- /dev/null
+++ b/core/libs/prx/libSceAppInstUtil/libSceAppInstUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAppInstUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceAsyncStorageInternal/libSceAsyncStorageInternal.hpp b/core/libs/prx/libSceAsyncStorageInternal/libSceAsyncStorageInternal.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAsyncStorageInternal/libSceAsyncStorageInternal.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAt9Enc/Export.cpp b/core/libs/prx/libSceAt9Enc/Export.cpp
index 77fee077ec..09b53ddbc8 100644
--- a/core/libs/prx/libSceAt9Enc/Export.cpp
+++ b/core/libs/prx/libSceAt9Enc/Export.cpp
@@ -1,9 +1,9 @@
+#include "prx/libSceAt9Enc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-
 extern "C" {
 
 int32_t APS5_VABI sceAt9EncClearContext(void *pAt9EncWorkArea, int32_t *pInternalResult) {
diff --git a/core/libs/prx/libSceAt9Enc/include/Api.hpp b/core/libs/prx/libSceAt9Enc/include/Api.hpp
new file mode 100644
index 0000000000..e060d77e4b
--- /dev/null
+++ b/core/libs/prx/libSceAt9Enc/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceAt9EncClearContext(void *pAt9EncWorkArea, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncCreateEncoder(void *pAt9EncWorkArea, void *pAt9EncParam, int32_t memSize, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncEncode(void *pAt9EncWorkArea, const void *pInputBuf, void *pOutputBuf, uint32_t inputBufSize, uint32_t outputBufSize, uint32_t *pOutputDataByte, uint32_t *pUsedBufSize, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncFlush(void *pAt9EncWorkArea, void *pOutputBuf, uint32_t outputBufSize, uint32_t *pOutputDataByte, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncQueryMemSize(void *pAt9EncParam, int32_t *pMemSize, int32_t *pInternalResult);
+
+}
diff --git a/core/libs/prx/libSceAt9Enc/libSceAt9Enc.hpp b/core/libs/prx/libSceAt9Enc/libSceAt9Enc.hpp
new file mode 100644
index 0000000000..c0960da642
--- /dev/null
+++ b/core/libs/prx/libSceAt9Enc/libSceAt9Enc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAt9Enc/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudio/libSceAudio.hpp b/core/libs/prx/libSceAudio/libSceAudio.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudio/libSceAudio.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudio3d/Export.cpp b/core/libs/prx/libSceAudio3d/Export.cpp
index eed6da479e..0eddd25c80 100644
--- a/core/libs/prx/libSceAudio3d/Export.cpp
+++ b/core/libs/prx/libSceAudio3d/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
@@ -14,12 +17,6 @@
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int user_id, int type, int index, std::uint32_t len, std::uint32_t freq, std::uint32_t param);
-int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
-int APS5_VABI sceAudioOutClose(int handle);
-}
-
 namespace {
 
 constexpr int AUDIO3D_ERROR_INVALID_PORT = static_cast<int>(0x80EA0002);
@@ -472,19 +469,6 @@ int APS5_VABI sceAudio3dReportUnregisterHandler(void) {
     return 0;
 }
 
-size_t APS5_VABI sceAudioOut2GetSpeakerArrayMemorySize(uint32_t num_speakers, uint8_t is_3d, uint8_t is_ambisonics);
-int APS5_VABI sceAudioOut2SpeakerArrayCreate(AudioOut2SpeakerArrayHandle* handle, const void* vbap_params, const void* ambi_params);
-int APS5_VABI sceAudioOut2SpeakerArrayDestroy(AudioOut2SpeakerArrayHandle handle);
-int APS5_VABI sceAudioOut2GetSpeakerArrayCoefficients(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t num_coefficients, uint8_t height_aware, float downmix_spread_radius);
-
-struct Audio3dSpeakerArrayParameters {
-    const AudioOut2Position* positions;
-    std::uint32_t numSpeakers;
-    std::uint8_t is3d;
-    void* memory;
-    std::size_t memorySize;
-};
-
 static_assert(sizeof(Audio3dSpeakerArrayParameters) == 0x20);
 
 size_t APS5_VABI sceAudio3dGetSpeakerArrayMemorySize(uint32_t num_speakers, uint8_t is_3d) {
diff --git a/core/libs/prx/libSceAudio3d/include/Audio3d.hpp b/core/libs/prx/libSceAudio3d/include/Audio3d.hpp
new file mode 100644
index 0000000000..54c1e127b3
--- /dev/null
+++ b/core/libs/prx/libSceAudio3d/include/Audio3d.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct Audio3dSpeakerArrayParameters {
+    const AudioOut2Position* positions;
+    std::uint32_t numSpeakers;
+    std::uint8_t is3d;
+    void* memory;
+    std::size_t memorySize;
+};
+
+extern "C" {
+
+void APS5_VABI sceAudio3dGetDefaultOpenParameters(Audio3dOpenParameters* p);
+int APS5_VABI sceAudio3dInitialize(int64_t reserved);
+int APS5_VABI sceAudio3dTerminate();
+int APS5_VABI sceAudio3dPortAdvance(uint32_t portId);
+int APS5_VABI sceAudio3dPortClose(uint32_t portId);
+int APS5_VABI sceAudio3dPortGetQueueLevel(uint32_t portId, uint32_t* queueLevel, uint32_t* queueAvailable);
+int APS5_VABI sceAudio3dPortGetAttributesSupported(uint32_t portId, uint32_t* attributes, uint32_t* numAttributes);
+int APS5_VABI sceAudio3dPortOpen(int userId, const Audio3dOpenParameters* parameters, uint32_t* id);
+int APS5_VABI sceAudio3dPortPush(uint32_t portId, uint32_t blocking);
+int APS5_VABI sceAudio3dPortSetAttribute(uint32_t portId, uint32_t attributeId, const void* attribute, size_t attributeSize);
+int APS5_VABI sceAudio3dObjectReserve(uint32_t portId, uint32_t* objectId);
+int APS5_VABI sceAudio3dObjectUnreserve(uint32_t portId, uint32_t objectId);
+int APS5_VABI sceAudio3dObjectSetAttributes(uint32_t portId, uint32_t objectId, uint64_t numAttributes, const Audio3dAttribute* attributeArray);
+int APS5_VABI sceAudio3dPortFlush(uint32_t portId);
+int APS5_VABI sceAudio3dBedWrite2(uint32_t portId, uint32_t numChannels, uint32_t format, const void* buffer, uint32_t numSamples, uint32_t outputRoute, bool);
+int APS5_VABI sceAudio3dBedWrite(uint32_t portId, uint32_t numChannels, uint32_t format, const void* buffer, uint32_t numSamples);
+int APS5_VABI sceAudio3dAudioOutOpen(uint32_t portId, int userId, std::int32_t type, std::int32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int APS5_VABI sceAudio3dAudioOutClose(std::int32_t handle);
+int APS5_VABI sceAudio3dAudioOutOutput(std::int32_t handle, const void* ptr);
+int APS5_VABI sceAudio3dAudioOutOutputs(AudioOutOutputParam* param, uint32_t num);
+int APS5_VABI sceAudio3dStrError(void);
+int APS5_VABI sceAudio3dPortOpenEx(void);
+int APS5_VABI sceAudio3dPortCreate(void);
+int APS5_VABI sceAudio3dPortDestroy(void);
+int APS5_VABI sceAudio3dPortGetStatus(void);
+int APS5_VABI sceAudio3dReportRegisterHandler(void);
+int APS5_VABI sceAudio3dReportUnregisterHandler(void);
+size_t APS5_VABI sceAudio3dGetSpeakerArrayMemorySize(uint32_t numSpeakers, uint8_t is3d);
+int APS5_VABI sceAudio3dCreateSpeakerArray(AudioOut2SpeakerArrayHandle* handle, const Audio3dSpeakerArrayParameters* parameters);
+int APS5_VABI sceAudio3dDeleteSpeakerArray(AudioOut2SpeakerArrayHandle handle);
+int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t numCoefficients);
+int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients2(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t numCoefficients, uint8_t heightAware, float downmixSpreadRadius);
+
+}
diff --git a/core/libs/prx/libSceAudio3d/libSceAudio3d.hpp b/core/libs/prx/libSceAudio3d/libSceAudio3d.hpp
new file mode 100644
index 0000000000..dcdc650f61
--- /dev/null
+++ b/core/libs/prx/libSceAudio3d/libSceAudio3d.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
diff --git a/core/libs/prx/libSceAudioIn/Export.cpp b/core/libs/prx/libSceAudioIn/Export.cpp
index 0a1712b5da..b1d4089ca1 100644
--- a/core/libs/prx/libSceAudioIn/Export.cpp
+++ b/core/libs/prx/libSceAudioIn/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioIn/include/AudioIn.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudioIn/include/AudioIn.hpp b/core/libs/prx/libSceAudioIn/include/AudioIn.hpp
new file mode 100644
index 0000000000..f4d273aab6
--- /dev/null
+++ b/core/libs/prx/libSceAudioIn/include/AudioIn.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioInInit();
+int APS5_VABI sceAudioInGetSilentState(int handle);
+int APS5_VABI sceAudioInInput(int handle, void* dest);
+int APS5_VABI sceAudioInOpen(int userId, uint32_t type, uint32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int32_t APS5_VABI sceAudioInClose(int32_t handle);
+int32_t APS5_VABI sceAudioInHqOpen(int32_t userId, uint32_t type, uint32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int32_t APS5_VABI sceAudioInAsyncOpen(int32_t userId, uint32_t type, uint32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int32_t APS5_VABI sceAudioInIsPadEmbeddedMic(int32_t handle);
+int32_t APS5_VABI sceAudioInGetGain(int32_t handle, float* gain);
+int32_t APS5_VABI sceAudioInGetRerouteCount(int32_t handle);
+int APS5_VABI sceAudioInDeviceIdOpen(void);
+int APS5_VABI sceAudioInDeviceIdAsyncOpen(void);
+int APS5_VABI sceAudioInSetUsbGain(void);
+int APS5_VABI sceAudioInIsSharedDevice(void);
+int APS5_VABI sceAudioInDeviceIdHqOpen(void);
+int APS5_VABI sceAudioInDeviceHqOpen(void);
+int APS5_VABI sceAudioInSetConnections(void);
+int APS5_VABI sceAudioInSetPortConnections(void);
+int APS5_VABI sceAudioInSetPortStatuses(void);
+int APS5_VABI sceAudioInGetHandleStatusInfo(void);
+int APS5_VABI sceAudioInOpenEx(int userId, uint32_t type, uint32_t index, uint32_t extra, uint32_t len, uint32_t freq, uint32_t param);
+int APS5_VABI sceAudioInHqOpenEx(int userId, uint32_t type, uint32_t index, uint32_t extra, uint32_t len, uint32_t freq, uint32_t param);
+int APS5_VABI sceAudioInDeviceOpenEx(void);
+int APS5_VABI sceAudioInChangeAppModuleState(void);
+int APS5_VABI sceAudioInSetSparkParam(void);
+int APS5_VABI sceAudioInSetSparkSideTone(void);
+int APS5_VABI sceAudioInSetCompressorPreGain(void);
+int APS5_VABI sceAudioInSetNoiseGateThreshold(void);
+int APS5_VABI sceAudioInSetMicLevel(void);
+int APS5_VABI sceAudioInSetDeviceMuteStatus(void);
+int APS5_VABI sceAudioInSetDevConnection(void);
+int APS5_VABI sceAudioInCountPorts(void);
+int APS5_VABI sceAudioInSetUserMute(void);
+int APS5_VABI sceAudioInVmicCreate(void);
+int APS5_VABI sceAudioInVmicDestroy(void);
+int APS5_VABI sceAudioInVmicWrite(void);
+int APS5_VABI sceAudioInVmicGetStatus(void);
+int APS5_VABI sceAudioInVmicSetMute(void);
+int APS5_VABI sceAudioInSetMode(void);
+int APS5_VABI sceAudioInSetMode2(void);
+int APS5_VABI sceAudioInExtCtrl(void);
+int APS5_VABI sceAudioInInputs(void);
+
+}
diff --git a/core/libs/prx/libSceAudioIn/libSceAudioIn.hpp b/core/libs/prx/libSceAudioIn/libSceAudioIn.hpp
new file mode 100644
index 0000000000..6da8abb473
--- /dev/null
+++ b/core/libs/prx/libSceAudioIn/libSceAudioIn.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudioIn/include/AudioIn.hpp"
diff --git a/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp b/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp
index 71b2edeba4..566f101c98 100644
--- a/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp
+++ b/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioLatencyEstimation/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudioLatencyEstimation/include/Api.hpp b/core/libs/prx/libSceAudioLatencyEstimation/include/Api.hpp
new file mode 100644
index 0000000000..7d8dffbfc4
--- /dev/null
+++ b/core/libs/prx/libSceAudioLatencyEstimation/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioLatencyEstimationAddData();
+int APS5_VABI sceAudioLatencyEstimationGetDelayTime();
+int APS5_VABI sceAudioLatencyEstimationInitialize();
+int APS5_VABI sceAudioLatencyEstimationRelease();
+
+}
diff --git a/core/libs/prx/libSceAudioLatencyEstimation/libSceAudioLatencyEstimation.hpp b/core/libs/prx/libSceAudioLatencyEstimation/libSceAudioLatencyEstimation.hpp
new file mode 100644
index 0000000000..5df8b57860
--- /dev/null
+++ b/core/libs/prx/libSceAudioLatencyEstimation/libSceAudioLatencyEstimation.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudioLatencyEstimation/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudioOut/CMakeLists.txt b/core/libs/prx/libSceAudioOut/CMakeLists.txt
index ba5e91090b..7c97d07a55 100644
--- a/core/libs/prx/libSceAudioOut/CMakeLists.txt
+++ b/core/libs/prx/libSceAudioOut/CMakeLists.txt
@@ -245,4 +245,14 @@ if(BUILD_TESTING)
         set_tests_properties(audio_out2_shutdown audio_out2_waiting_push_shutdown audio_out2_advance_shutdown audio_out_shutdown PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudioOut>")
     endif()
+
+    add_test_executable(audio_out_system_state_tests tests/AudioOutSystemState.cpp)
+    target_include_directories(audio_out_system_state_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(audio_out_system_state_tests PRIVATE libSceAudioOut libc)
+    configure_windows_unwind(audio_out_system_state_tests)
+    add_test(NAME audio_out_system_state COMMAND audio_out_system_state_tests)
+    if(WIN32)
+        set_tests_properties(audio_out_system_state PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudioOut>")
+    endif()
 endif()
diff --git a/core/libs/prx/libSceAudioOut/include/AudioOut.hpp b/core/libs/prx/libSceAudioOut/include/AudioOut.hpp
new file mode 100644
index 0000000000..ba5e6b3e93
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/include/AudioOut.hpp
@@ -0,0 +1,80 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioOutInit();
+int APS5_VABI sceAudioOutOpen(int userId, int type, int index, std::uint32_t len, std::uint32_t freq, std::uint32_t param);
+int APS5_VABI sceAudioOutClose(int handle);
+int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
+int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam* param, std::uint32_t num);
+int APS5_VABI sceAudioOutSetVolume(int handle, std::uint32_t flag, int* vol);
+int APS5_VABI sceAudioOutGetLastOutputTime(int handle, std::uint64_t* outputTime);
+int APS5_VABI sceAudioOutGetPortState(int handle, AudioOutPortState* state);
+int APS5_VABI sceAudioOutDeviceIdOpen(std::uint64_t deviceId, std::int32_t type, std::int32_t index, std::uint32_t length, std::int32_t frequency, std::uint32_t parameter);
+int APS5_VABI sceAudioOutSysClose(int handle);
+int APS5_VABI sceAudioOutSysConfigureOutput(int type, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
+int APS5_VABI sceAudioOutSysGetHdmiMonitorInfo(int type, void* info, std::uint32_t size);
+int APS5_VABI sceAudioOutSysOpen(int userId, std::uint32_t mode);
+int APS5_VABI sceAudioOutSetMixLevelPadSpk(int handle, std::uint32_t mixLevel);
+int APS5_VABI sceAudioOutExClose(int handle);
+int APS5_VABI sceAudioOutExConfigureOutput(int control, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
+int APS5_VABI sceAudioOutExGetMonitorInfo(int type, int index, void* info, std::uint32_t size);
+int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode);
+int APS5_VABI sceAudioOutGetSystemState(AudioOutSystemState* state);
+int APS5_VABI sceAudioOutOpenEx(void);
+int APS5_VABI sceAudioOutSetSystemDebugState(void);
+int APS5_VABI sceAudioOutGetHandleStatusInfo(void);
+int APS5_VABI sceAudioOutGetSimulatedHandleStatusInfo2(void);
+int APS5_VABI sceAudioOutChangeAppModuleState(void);
+int APS5_VABI sceAudioOutGetSimulatedHandleStatusInfo(void);
+int APS5_VABI sceAudioOutGetSimulatedBusUsableStatusByBusType(void);
+int APS5_VABI sceAudioOutAttachToApplicationByPid(void);
+int APS5_VABI sceAudioOutDetachFromApplicationByPid(void);
+int APS5_VABI sceAudioOutPtOpen(void);
+int APS5_VABI sceAudioOutPtClose(void);
+int APS5_VABI sceAudioOutPtGetLastOutputTime(void);
+int APS5_VABI sceAudioOutExPtOpen(void);
+int APS5_VABI sceAudioOutExPtClose(void);
+int APS5_VABI sceAudioOutExPtGetLastOutputTime(void);
+int APS5_VABI sceAudioOutExGetLastOutputTime(void);
+int APS5_VABI sceAudioOutGetInfoOpenNum(void);
+int APS5_VABI sceAudioOutGetInfo(void);
+int APS5_VABI sceAudioOutMasteringInit(uint32_t flags);
+int APS5_VABI sceAudioOutMasteringSetParam(const AudioOut2MasteringParamsHeader* param, uint32_t flags);
+int APS5_VABI sceAudioOutMasteringGetState(AudioOut2MasteringStatesHeader* state);
+int APS5_VABI sceAudioOutMasteringTerm(void);
+int APS5_VABI sceAudioOutSetPadSpkVolume(void);
+int APS5_VABI sceAudioOutSetPadJackVolume(void);
+int APS5_VABI sceAudioOutSetUsbVolume(void);
+int APS5_VABI sceAudioOutSetCaesarVolume(void);
+int APS5_VABI sceAudioOutSetHeadphoneOutMode(void);
+int APS5_VABI sceAudioOutGetFocusEnablePid(void);
+int APS5_VABI sceAudioOutSetMainOutput(void);
+int APS5_VABI sceAudioOutSetVolumeDown(void);
+int APS5_VABI sceAudioOutSetChatBalance(void);
+int APS5_VABI sceAudioOutSetRecMode(void);
+int APS5_VABI sceAudioOutSetAllMute(void);
+int APS5_VABI sceAudioOutSetSparkEQ(void);
+int APS5_VABI sceAudioOutArbitrationInitialize(void);
+int APS5_VABI sceAudioOutEnable3DAudioByArbitration(void);
+int APS5_VABI sceAudioOutAssignHRTF(void);
+int APS5_VABI sceAudioOutEnable3DAudioForUser(void);
+int APS5_VABI sceAudioOutEnableMonoHpOutput(void);
+int APS5_VABI sceAudioOutEnableTVVirtual(void);
+int APS5_VABI sceAudioOutEnableTVCorrection(void);
+int APS5_VABI sceAudioOutEnableVrControllerLowPowerMode(void);
+int APS5_VABI sceAudioOutEnableCinematicVrRotation(void);
+int APS5_VABI sceAudioOutCustomHrtfIsExist(void);
+int APS5_VABI sceAudioOutExConfigureOutputMode(void);
+int APS5_VABI sceAudioOutExSystemInfoIsSupportedAudioOutExMode(void);
+int APS5_VABI sceAudioOutExGetSystemInfo(void);
+int APS5_VABI sceAudioOutExGetOutputInfo(void);
+int APS5_VABI sceAudioOutSysConfigureOutputMode(void);
+int APS5_VABI sceAudioOutSysGetMonitorInfo(void);
+int APS5_VABI sceAudioOutSysHdmiMonitorInfoIsSupportedAudioOutMode(void);
+int APS5_VABI sceAudioOutSysGetSystemInfo(void);
+int APS5_VABI sceAudioOutSysGetOutputInfo(void);
+
+}
diff --git a/core/libs/prx/libSceAudioOut/include/AudioOut2.hpp b/core/libs/prx/libSceAudioOut/include/AudioOut2.hpp
new file mode 100644
index 0000000000..d7212024f9
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/include/AudioOut2.hpp
@@ -0,0 +1,82 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam* params, void* buffer, size_t bufferSize, AudioOut2ContextHandle* ctx);
+int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle ctx, uint32_t* queueLevel, uint32_t* availableQueue);
+int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle ctx, uint32_t blocking);
+int APS5_VABI sceAudioOut2ContextQueryMemory(const AudioOut2ContextParam* params, size_t* memorySize);
+int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam* params);
+int APS5_VABI sceAudioOut2ContextSetAttributes(AudioOut2ContextHandle ctx, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2LoInit(void);
+int APS5_VABI sceAudioOut2LoTerminate(void);
+int APS5_VABI sceAudioOut2LoContextQueryMemory(const AudioOut2ContextParam* params, size_t* memorySize);
+int APS5_VABI sceAudioOut2LoContextCreate(const AudioOut2ContextParam* params, void* buffer, size_t bufferSize, AudioOut2ContextHandle* ctx);
+int APS5_VABI sceAudioOut2LoContextDestroy(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2LoContextSetAttributes(AudioOut2ContextHandle ctx, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2LoContextAdvance(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2LoContextPush(AudioOut2ContextHandle ctx, uint32_t blocking);
+int APS5_VABI sceAudioOut2LoContextGetQueueLevel(AudioOut2ContextHandle ctx, uint32_t* queueLevel, uint32_t* availableQueue);
+int APS5_VABI sceAudioOut2LoPortCreate(AudioOut2ContextHandle ctx, const AudioOut2PortParam* params, AudioOut2PortHandle* port);
+int APS5_VABI sceAudioOut2LoPortDestroy(AudioOut2PortHandle port);
+int APS5_VABI sceAudioOut2LoPortSetAttributes(AudioOut2PortHandle port, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2LoPortGetState(AudioOut2PortHandle port, AudioOut2PortState* state);
+int APS5_VABI sceAudioOut2MasteringInit(uint32_t flags);
+int APS5_VABI sceAudioOut2MasteringInitEx(uint32_t flags);
+int APS5_VABI sceAudioOut2MasteringTerm(void);
+int APS5_VABI sceAudioOut2MasteringGetState(AudioOut2MasteringStatesHeader* state, uint32_t output, AudioOut2UserHandle user);
+int APS5_VABI sceAudioOut2MasteringSetParam(const AudioOut2MasteringParamsHeader* param, uint32_t output, uint32_t flags);
+int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle ctx, const AudioOut2PortParam* params, AudioOut2PortHandle* port);
+int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle port);
+int APS5_VABI sceAudioOut2PortGetState(AudioOut2PortHandle port, AudioOut2PortState* state);
+int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle port, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2SpeakerArrayCreate(AudioOut2SpeakerArrayHandle* handle, const void* vbapParams, const void* ambiParams);
+int APS5_VABI sceAudioOut2SpeakerArrayDestroy(AudioOut2SpeakerArrayHandle handle);
+int APS5_VABI sceAudioOut2GetSpeakerArrayAmbisonicsCoefficients(AudioOut2SpeakerArrayHandle handle, uint32_t ambisonicsChannel, float* coefficients, uint32_t numCoefficients);
+int APS5_VABI sceAudioOut2GetSpeakerArrayCoefficients(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t numCoefficients, uint8_t heightAware, float downmixSpreadRadius);
+size_t APS5_VABI sceAudioOut2GetSpeakerArrayMemorySize(uint32_t numSpeakers, uint8_t is3d, uint8_t isAmbisonics);
+int APS5_VABI sceAudioOut2GetSpeakerInfo(AudioOut2SpeakerInfo* info, uint32_t flags);
+int APS5_VABI sceAudioOut2Initialize(void);
+int APS5_VABI sceAudioOut2InitializeEx(std::uint32_t param);
+int APS5_VABI sceAudioOut2Set3DLatency(int userId, std::uint32_t output);
+int APS5_VABI sceAudioOut2GetSystemState(AudioOut2SystemState* state);
+int APS5_VABI sceAudioOut2SetSystemDebugState(const AudioOut2SystemDebugStateParam* param);
+int APS5_VABI sceAudioOut2EnableChat(void);
+int APS5_VABI sceAudioOut2DisableChat(void);
+int APS5_VABI sceAudioOut2UserCreate(uint32_t userId, AudioOut2UserHandle* handle);
+int APS5_VABI sceAudioOut2UserDestroy(AudioOut2UserHandle handle);
+int APS5_VABI sceAudioOut2UserGetSupportedAttributes(AudioOut2UserHandle handle, uint32_t* contextAttributes, uint32_t* portAttributes);
+int APS5_VABI sceAudioOut2UserCreateEx(void);
+int APS5_VABI sceAudioOut2ArbitrationInitialize(void);
+int APS5_VABI sceAudioOut2MbusInit(void);
+int APS5_VABI sceAudioOut2MbusSetPortConnections(void);
+int APS5_VABI sceAudioOut2MbusSetConnections(void);
+int APS5_VABI sceAudioOut2MbusSetPortStatuses(void);
+int APS5_VABI sceAudioOut2MbusSetHeadphoneOutMode(void);
+int APS5_VABI sceAudioOut2MbusUserLoginFor3DAudio(void);
+int APS5_VABI sceAudioOut2MbusSetDeviceConnections(void);
+int APS5_VABI sceAudioOut2MbusSetMorpheusParam(void);
+int APS5_VABI sceAudioOut2MbusSetCaesarParam(void);
+int APS5_VABI sceAudioOut2MbusSetSparkParam(void);
+int APS5_VABI sceAudioOut2AllAudioMainToHeadphoneForDiag(void);
+int APS5_VABI sceAudioOut2LoPortGetStateEx(void);
+int APS5_VABI sceAudioOut2ReportRegisterHandler(void);
+int APS5_VABI sceAudioOut2ReportUnregisterHandler(void);
+int APS5_VABI sceAudioOut2GetTvCorrectionInfo(void);
+int APS5_VABI sceAudioOut2GetIpcHandle(void);
+int APS5_VABI sceAudioOut2GetSystemStateEx(void);
+int APS5_VABI sceAudioOut2SetDebugHeadphoneMode(void);
+int APS5_VABI sceAudioOut2DebugStateCtrl(void);
+int APS5_VABI sceAudioOut2ContextBedWrite(void);
+int APS5_VABI sceAudioOut2PortCreateEx(void);
+int APS5_VABI sceAudioOut2Terminate(void);
+int APS5_VABI sceAudioOut2PortRegister(void);
+int APS5_VABI sceAudioOut2PortUnregister(void);
+int APS5_VABI sceAudioOut2GetAmbisonicsEncodeCoefficients(void);
+int APS5_VABI sceAudioOut2GetHrtfIdForCronos(void);
+
+}
diff --git a/core/libs/prx/libSceAudioOut/libSceAudioOut.hpp b/core/libs/prx/libSceAudioOut/libSceAudioOut.hpp
new file mode 100644
index 0000000000..d092ed95af
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/libSceAudioOut.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
index 9faeaef957..44cb922956 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -401,12 +402,23 @@ static int allocatePort(int type, std::uint32_t len, std::uint32_t freq, Format
     return -2144993275;
 }
 
+static std::atomic<bool> g_audioOut2Initialized{false};
+
+bool AudioOut2IsInitialized_nid_no_patch() {
+    return g_audioOut2Initialized.load();
+}
+
 extern "C" {
 
-int APS5_VABI sceAudioOutInit() {
+int APS5_VABI sceAudioOut2Initialize(void) {
+    g_audioOut2Initialized.store(true);
     return 0;
 }
 
+int APS5_VABI sceAudioOutInit() {
+    return sceAudioOut2Initialize();
+}
+
 int APS5_VABI sceAudioOutOpen(int userId, int type, int index, std::uint32_t len,
     std::uint32_t freq, std::uint32_t param) {
     (void)userId;
@@ -651,6 +663,10 @@ int APS5_VABI sceAudioOutSysOpen(int userId, std::uint32_t mode) {
     return allocatePort(PORT_TYPE_SYS, SYS_PORT_SAMPLES, SYS_PORT_FRAME_RATE, Format::S16_8Ch);
 }
 
+int APS5_VABI sceAudioOutSetMainOutput() {
+    return 0;
+}
+
 int APS5_VABI sceAudioOutSetMixLevelPadSpk(int handle, std::uint32_t mixLevel) {
     std::lock_guard<std::mutex> lock(g_mutex);
     Port* port = getPort(handle);
@@ -714,4 +730,13 @@ int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode) {
     return allocatePort(PORT_TYPE_EX, highRate ? 1024 : 256, highRate ? 192000 : 48000, Format::S16Stereo);
 }
 
+int APS5_VABI sceAudioOutGetSystemState(AudioOutSystemState* state) {
+    if (state == nullptr) {
+        return -2144993276;
+    }
+    *state = {};
+    state->loudness = 0.0f;
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp
index e11ee633e5..905eaa42f5 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <algorithm>
 #include <chrono>
 #include <cmath>
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp
index c58bd4c542..42363a9998 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp
@@ -25,6 +25,7 @@
 bool AudioOut2TraceEnabled();
 // Seconds since the first AudioOut2 call, for the trace.
 double AudioOut2TraceSeconds();
+bool AudioOut2IsInitialized_nid_no_patch();
 
 #define AUDIOOUT2_TRACE(...) \
     do { \
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp
index eac5204b6d..e427f40302 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
@@ -5,19 +6,6 @@
 
 extern "C" {
 
-int APS5_VABI sceAudioOut2Initialize(void);
-int APS5_VABI sceAudioOut2ContextQueryMemory(const AudioOut2ContextParam* params, size_t* memory_size);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam* params, void* buffer, size_t buffer_size, AudioOut2ContextHandle* ctx);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle ctx);
-int APS5_VABI sceAudioOut2ContextSetAttributes(AudioOut2ContextHandle ctx, const AudioOut2Attribute* attributes, uint32_t num);
-int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle ctx);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle ctx, uint32_t blocking);
-int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle ctx, uint32_t* queue_level, uint32_t* available_queue);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle ctx, const AudioOut2PortParam* params, AudioOut2PortHandle* port);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle port);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle port, const AudioOut2Attribute* attributes, uint32_t num);
-int APS5_VABI sceAudioOut2PortGetState(AudioOut2PortHandle port, AudioOut2PortState* state);
-
 int APS5_VABI sceAudioOut2LoInit(void) {
     return sceAudioOut2Initialize();
 }
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp
index 8f7e6403dc..88e948e434 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include <cstddef>
 #include <cstdint>
 #include <cstring>
 #include <atomic>
@@ -29,10 +31,54 @@ constexpr std::uint32_t AUDIO_OUT2_MASTERING_STRUCT_ID_COMPRESSOR_DEFAULT = 0x01
 constexpr std::uint32_t AUDIO_OUT2_MASTERING_STRUCT_ID_COMPRESSOR_V2 = 0x01020001;
 constexpr std::uint32_t AUDIO_OUT2_MASTERING_STRUCT_ID_LIMITER_DEFAULT = 0x01010003;
 
+constexpr std::uint32_t AUDIO_OUT_MASTERING_PARAMS_ID_DEFAULT = 1;
+constexpr std::uint32_t AUDIO_OUT_MASTERING_STATES_ID_DEFAULT = 1;
+
+constexpr std::size_t AUDIO_OUT_MASTERING_COMPRESSOR_INPUT_RMS_OFFSET = 32;
+constexpr std::size_t AUDIO_OUT_MASTERING_COMPRESSOR_GAIN_OFFSET = 128;
+constexpr std::size_t AUDIO_OUT_MASTERING_LIMITER_INPUT_PEAK_OFFSET = 240;
+constexpr std::size_t AUDIO_OUT_MASTERING_LIMITER_OUTPUT_PEAK_OFFSET = 272;
+constexpr std::size_t AUDIO_OUT_MASTERING_LIMITER_GAIN_PEAK_OFFSET = 304;
+
+static_assert(sizeof(AudioOut2MasteringStates) == 336);
+static_assert(offsetof(AudioOut2MasteringStates, compressor_states) + offsetof(AudioOut2MasteringCompressorStates, input_rms) == AUDIO_OUT_MASTERING_COMPRESSOR_INPUT_RMS_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, compressor_states) + offsetof(AudioOut2MasteringCompressorStates, compression_coeff) == AUDIO_OUT_MASTERING_COMPRESSOR_GAIN_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, limiter_states) + offsetof(AudioOut2MasteringLimiterStates, input_peak) == AUDIO_OUT_MASTERING_LIMITER_INPUT_PEAK_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, limiter_states) + offsetof(AudioOut2MasteringLimiterStates, output_peak) == AUDIO_OUT_MASTERING_LIMITER_OUTPUT_PEAK_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, limiter_states) + offsetof(AudioOut2MasteringLimiterStates, gain_peak) == AUDIO_OUT_MASTERING_LIMITER_GAIN_PEAK_OFFSET);
+
 }
 
 extern "C" {
 
+int APS5_VABI sceAudioOutMasteringInit(uint32_t flags) {
+    if (flags != 0) NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAudioOutMasteringTerm(void) {
+    return 0;
+}
+
+int APS5_VABI sceAudioOutMasteringGetState(AudioOut2MasteringStatesHeader* state) {
+    if (state == nullptr) APS5_INVALID_ARG_EX;
+    if (state->states_id != AUDIO_OUT_MASTERING_STATES_ID_DEFAULT) NotImplemented_nid_no_patch(__func__);
+    auto* full = static_cast<AudioOut2MasteringStates*>(static_cast<void*>(state));
+    std::memset(full->compressor_states.input_rms, 0, sizeof(full->compressor_states.input_rms));
+    std::memset(full->compressor_states.compression_coeff, 0, sizeof(full->compressor_states.compression_coeff));
+    std::memset(full->limiter_states.input_peak, 0, sizeof(full->limiter_states.input_peak));
+    std::memset(full->limiter_states.output_peak, 0, sizeof(full->limiter_states.output_peak));
+    std::memset(full->limiter_states.gain_peak, 0, sizeof(full->limiter_states.gain_peak));
+    return 0;
+}
+
+int APS5_VABI sceAudioOutMasteringSetParam(const AudioOut2MasteringParamsHeader* param, uint32_t flags) {
+    if (param == nullptr) APS5_INVALID_ARG_EX;
+    if (flags != 0) NotImplemented_nid_no_patch(__func__);
+    if (param->params_id != AUDIO_OUT_MASTERING_PARAMS_ID_DEFAULT) NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 int APS5_VABI sceAudioOut2MasteringInit(uint32_t flags) {
     return InitializeMastering(flags, 0);
 }
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp
index 14c9bc2c63..e8a547fefc 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstring>
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp
index 7b6a07017e..36b6746149 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <algorithm>
 #include <cmath>
 #include <cstddef>
@@ -7,6 +8,7 @@
 #include <string>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "AudioOut2Internal.hpp"
 
 namespace {
 
@@ -120,8 +122,13 @@ size_t APS5_VABI sceAudioOut2GetSpeakerArrayMemorySize(uint32_t num_speakers, ui
 }
 
 int APS5_VABI sceAudioOut2GetSpeakerInfo(AudioOut2SpeakerInfo* info, uint32_t flags) {
-    (void)flags;
-    if (!info) return static_cast<int>(0x80260502);
+    constexpr int ErrorInvalidParam = static_cast<int>(0x80268001);
+    constexpr int ErrorNotInitialized = static_cast<int>(0x80268006);
+    constexpr int ErrorInvalidPointer = static_cast<int>(0x8026800C);
+    constexpr std::uint32_t MaxFlags = 1;
+    if (!AudioOut2IsInitialized_nid_no_patch()) return ErrorNotInitialized;
+    if (!info) return ErrorInvalidPointer;
+    if (flags > MaxFlags) return ErrorInvalidParam;
     constexpr std::uint8_t SpeakerTypeTelevision = 0;
     constexpr std::uint32_t FrontLeftAndRight = 0x3;
     constexpr AudioOut2SpeakerAngle NoSpeaker = {-360, -360};
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp
index 89c681ad9c..6723eb1371 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
@@ -12,10 +13,6 @@ static std::atomic<bool> g_chatEnabled{false};
 
 extern "C" {
 
-int APS5_VABI sceAudioOut2Initialize(void) {
-    return 0;
-}
-
 int APS5_VABI sceAudioOut2InitializeEx(std::uint32_t param) {
     (void)param;
     return sceAudioOut2Initialize();
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp
index 1a514be246..5a8bce8592 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp b/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
index 0f7cdd8540..55134a8ef6 100644
--- a/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
+++ b/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -97,26 +99,6 @@ int APS5_VABI sceAudioOutGetInfo(void) {
     return 0;
 }
 
-int APS5_VABI sceAudioOutMasteringInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioOutMasteringSetParam(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioOutMasteringGetState(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioOutMasteringTerm(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioOutSetPadSpkVolume(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -147,11 +129,6 @@ int APS5_VABI sceAudioOutGetFocusEnablePid(void) {
     return 0;
 }
 
-int APS5_VABI sceAudioOutSetMainOutput(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioOutSetVolumeDown(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp
index 404037d497..82e8464648 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/libSceAudioOut.hpp"
 #include "SceTypes.hpp"
 
 #include <cstddef>
@@ -8,23 +9,15 @@
 #include <random>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortGetState(AudioOut2PortHandle, AudioOut2PortState*);
-int APS5_VABI sceAudioOut2GetSpeakerInfo(AudioOut2SpeakerInfo*, std::uint32_t);
-int APS5_VABI sceAudioOut2GetSystemState(AudioOut2SystemState*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 namespace {
 
 constexpr int errorInvalidArgument = static_cast<int>(0x80260502);
 constexpr int errorInvalidHandle = static_cast<int>(0x80260503);
+constexpr int errorInvalidParam = static_cast<int>(0x80268001);
+constexpr int errorNotInitialized = static_cast<int>(0x80268006);
+constexpr int errorInvalidPointer = static_cast<int>(0x8026800C);
 constexpr std::uint16_t portTypeMain = 0;
 constexpr std::uint16_t outputMain = 1;
 constexpr std::int16_t volumeMax = 127;
@@ -101,7 +94,38 @@ void SpeakerInfoReportsTheFrontPair() {
     Require(info.speaker_angle[0].azimuth == 30 && info.speaker_angle[0].elevation == 0);
     Require(info.speaker_angle[1].azimuth == -30 && info.speaker_angle[1].elevation == 0);
     for (int index = 2; index < 16; index++) Require(info.speaker_angle[index].azimuth == -360 && info.speaker_angle[index].elevation == -360);
-    Require(sceAudioOut2GetSpeakerInfo(nullptr, 0) == errorInvalidArgument);
+    Require(sceAudioOut2GetSpeakerInfo(nullptr, 0) == errorInvalidPointer);
+}
+
+void SpeakerInfoRequiresInitialization() {
+    AudioOut2SpeakerInfo info;
+    std::memset(&info, 0xAB, sizeof(info));
+    const AudioOut2SpeakerInfo untouched = info;
+    Require(sceAudioOut2GetSpeakerInfo(&info, 0) == errorNotInitialized);
+    Require(sceAudioOut2GetSpeakerInfo(nullptr, 0) == errorNotInitialized);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 2) == errorNotInitialized);
+    Require(std::memcmp(&info, &untouched, sizeof(info)) == 0);
+}
+
+void SpeakerInfoAfterAudioOutInit() {
+    AudioOut2SpeakerInfo info;
+    std::memset(&info, 0xAB, sizeof(info));
+    Require(sceAudioOutInit() == 0);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 0) == 0);
+}
+
+void SpeakerInfoRejectsBadFlags() {
+    AudioOut2SpeakerInfo info;
+    std::memset(&info, 0xAB, sizeof(info));
+    const AudioOut2SpeakerInfo untouched = info;
+    Require(sceAudioOut2GetSpeakerInfo(&info, 2) == errorInvalidParam);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 0x80000000) == errorInvalidParam);
+    Require(sceAudioOut2GetSpeakerInfo(nullptr, 2) == errorInvalidPointer);
+    Require(std::memcmp(&info, &untouched, sizeof(info)) == 0);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 1) == 0);
+    Require(info.type == 0);
+    Require(info.available_bits == 0x3);
+    Require(info.speaker_angle[0].azimuth == 30 && info.speaker_angle[1].azimuth == -30);
 }
 
 void SystemStateIsSilentAndRejectsNull() {
@@ -119,6 +143,9 @@ int main() {
     std::filesystem::remove(path);
     SetEnvironment("SDL_DISKAUDIOFILE", path.string());
 
+    SpeakerInfoRequiresInitialization();
+    SpeakerInfoAfterAudioOutInit();
+
     AudioOut2ContextParam params{};
     Require(sceAudioOut2ContextResetParam(&params) == 0);
     params.num_grains = 256;
@@ -129,6 +156,7 @@ int main() {
     PortStateFollowsTheDataFormat(context);
     PortStateRejectsBadArguments(context);
     SpeakerInfoReportsTheFrontPair();
+    SpeakerInfoRejectsBadFlags();
     SystemStateIsSilentAndRejectsNull();
 
     Require(sceAudioOut2ContextDestroy(context) == 0);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp
index dd018acae0..cc08e950f6 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp
@@ -1,27 +1,15 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <stdexcept>
-
-extern "C" {
-int APS5_VABI sceAudioOut2Initialize();
-int APS5_VABI sceAudioOut2InitializeEx(std::uint32_t);
-int APS5_VABI sceAudioOut2LoInit();
-int APS5_VABI sceAudioOut2LoTerminate();
-int APS5_VABI sceAudioOut2Set3DLatency(int, std::uint32_t);
-int APS5_VABI sceAudioOut2MasteringInit(std::uint32_t);
-int APS5_VABI sceAudioOut2MasteringInitEx(std::uint32_t);
-int APS5_VABI sceAudioOut2MasteringTerm();
-int APS5_VABI sceAudioOut2MasteringSetParam(const void*, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOut2MasteringGetState(void*, std::uint32_t, std::uint64_t);
-int APS5_VABI sceAudioOut2SetSystemDebugState(const void*);
-int APS5_VABI sceAudioOut2EnableChat();
-int APS5_VABI sceAudioOut2DisableChat();
-}
+#include <utility>
 
 static void Require(bool value, const char* message) {
     if (value) return;
@@ -39,6 +27,16 @@ static bool ThrowsRuntimeError(TFunction function) {
     return false;
 }
 
+template<typename TFunction>
+static bool ThrowsException(TFunction function) {
+    try {
+        function();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
 namespace {
 
 static_assert(sizeof(AudioOut2MasteringCompressorStates) == 208);
@@ -70,12 +68,12 @@ void TestSet3DLatency() {
 }
 
 void TestMasteringInit() {
-    const std::uint32_t params[4] = {1u, 0u, 0u, 0u};
-    alignas(16) std::uint8_t storage[512] {};
+    const AudioOut2MasteringParamsHeader params{1u};
+    AudioOut2MasteringStates storage{};
     Require(sceAudioOut2MasteringTerm() == errorMasteringNotInitialized, "termination before initialization is refused");
-    Require(sceAudioOut2MasteringSetParam(params, 0, 0) == errorMasteringNotInitialized, "parameters before initialization are refused");
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 0) == errorMasteringNotInitialized, "parameters before initialization are refused");
     Require(sceAudioOut2MasteringGetState(nullptr, 0, 0) == errorMasteringNotInitialized, "the initialization check comes before the null check");
-    Require(sceAudioOut2MasteringGetState(storage, 0, 0) == errorMasteringNotInitialized, "states before initialization are refused");
+    Require(sceAudioOut2MasteringGetState(&storage.states_header, 0, 0) == errorMasteringNotInitialized, "states before initialization are refused");
     Require(sceAudioOut2MasteringInit(1) == errorMasteringInvalidApiParam, "flags 1 are refused");
     Require(sceAudioOut2MasteringInit(0x80000000u) == errorMasteringInvalidApiParam, "sceAudioOut2MasteringInit accepts no flag");
     Require(sceAudioOut2MasteringInit(0) == 0, "flags 0 must be accepted");
@@ -94,37 +92,98 @@ void TestMasteringTerm() {
 }
 
 void TestMasteringSetParam() {
-    const std::uint32_t params[4] = {1u, 0u, 0u, 0u};
-    Require(sceAudioOut2MasteringSetParam(params, 0, 0) == 0, "mastering parameters must be accepted");
-    Require(sceAudioOut2MasteringSetParam(params, 2, 0) == 0, "mastering parameters for output 2 must be accepted");
+    const AudioOut2MasteringParamsHeader params{1u};
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 0) == 0, "mastering parameters must be accepted");
+    Require(sceAudioOut2MasteringSetParam(&params, 2, 0) == 0, "mastering parameters for output 2 must be accepted");
     Require(sceAudioOut2MasteringSetParam(nullptr, 0, 0) == errorMasteringInvalidApiParam, "null mastering parameters return the invalid API parameter error");
     Require(sceAudioOut2MasteringSetParam(nullptr, 0, 2) == errorMasteringInvalidApiParam, "the null check comes before the flag check");
-    Require(sceAudioOut2MasteringSetParam(params, 0, 1) == 0, "flags 1 must be accepted");
-    Require(sceAudioOut2MasteringSetParam(params, 0, 2) == errorMasteringInvalidFlag, "flags above 1 are refused");
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 1) == 0, "flags 1 must be accepted");
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 2) == errorMasteringInvalidFlag, "flags above 1 are refused");
 }
 
 void TestMasteringGetState() {
     alignas(16) std::uint8_t storage[512];
     Require(sceAudioOut2MasteringGetState(nullptr, 0, 0) == errorInvalidPointer, "a null state returns the invalid pointer error");
-    auto* header = reinterpret_cast<std::uint32_t*>(storage);
+    auto* header = reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage);
     auto* words = reinterpret_cast<std::uint32_t*>(storage);
-    *header = 1u;
-    Require(sceAudioOut2MasteringGetState(storage, 0, 0) == 0, "states id 1 must be accepted");
-    Require(*header == 1u, "states id 1 is kept");
+    header->states_id = 1u;
+    Require(sceAudioOut2MasteringGetState(header, 0, 0) == 0, "states id 1 must be accepted");
+    Require(header->states_id == 1u, "states id 1 is kept");
     Require(words[4] == 0x01010001u && words[5] == 8u + 8u + 3u * 8u * 4u * 2u, "the compressor states descriptor is filled");
     Require(words[56] == 0x01010003u && words[57] == 8u + 8u + 8u * 4u * 3u, "the limiter states descriptor is filled");
     std::fill(storage, storage + sizeof(storage), 0xA5);
-    *header = 2u;
-    Require(sceAudioOut2MasteringGetState(storage, 2, 1) == 0, "states id 2 must be accepted");
-    Require(*header == 2u, "states id 2 is kept");
+    header->states_id = 2u;
+    Require(sceAudioOut2MasteringGetState(header, 2, 1) == 0, "states id 2 must be accepted");
+    Require(header->states_id == 2u, "states id 2 is kept");
     Require(words[4] == 0x01020001u && words[5] == 8u + 8u + 4u * 8u * 4u * 2u, "the V2 compressor states descriptor is filled");
     Require(words[72] == 0x01010003u && words[73] == 8u + 8u + 8u * 4u * 3u, "the V2 limiter states descriptor is filled");
     Require(std::all_of(storage + 8, storage + 16, [](std::uint8_t byte) { return byte == 0; }), "the reserved words are zeroed");
     Require(std::all_of(storage + 24, storage + 288, [](std::uint8_t byte) { return byte == 0; }), "the V2 compressor states are zeroed");
-    *header = 3u;
-    Require(sceAudioOut2MasteringGetState(storage, 0, 0) == errorMasteringInvalidStatesId, "an unknown states id is refused");
-    *header = 0u;
-    Require(sceAudioOut2MasteringGetState(storage, 0, 0) == errorMasteringInvalidStatesId, "states id 0 is refused");
+    header->states_id = 3u;
+    Require(sceAudioOut2MasteringGetState(header, 0, 0) == errorMasteringInvalidStatesId, "an unknown states id is refused");
+    header->states_id = 0u;
+    Require(sceAudioOut2MasteringGetState(header, 0, 0) == errorMasteringInvalidStatesId, "states id 0 is refused");
+}
+
+void TestLegacyMasteringInit() {
+    Require(sceAudioOutMasteringInit(0) == 0, "legacy flags 0 must be accepted");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(1); }), "legacy flags SwapEqCompressor must throw");
+    Require(sceAudioOutMasteringInit(0) == 0, "a repeated legacy initialization must be accepted");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(2); }), "legacy flags bit 1 must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(3); }), "legacy flags bits 0 and 1 must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(0x80000000u); }), "legacy flags bit 31 must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(0xFFFFFFFFu); }), "legacy flags 0xFFFFFFFF must throw");
+}
+
+void TestLegacyMasteringTerm() {
+    Require(sceAudioOutMasteringTerm() == 0, "legacy termination must be accepted");
+    Require(sceAudioOutMasteringTerm() == 0, "legacy termination must be accepted for each initialization");
+}
+
+void TestLegacyMasteringSetParam() {
+    alignas(16) std::uint32_t params[16];
+    std::fill(params, params + 16, 0xA5A5A5A5u);
+    params[0] = 1u;
+    Require(sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0) == 0, "legacy mastering parameters must be accepted");
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 1); }), "legacy parameters with SwapEqCompressor must throw");
+    Require(params[0] == 1u && params[1] == 0xA5A5A5A5u && params[15] == 0xA5A5A5A5u, "legacy mastering parameters are not modified");
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 2); }), "legacy parameters with flags bit 1 must throw");
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0xFFFFFFFFu); }), "legacy parameters with unknown flags must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringSetParam(nullptr, 0); }), "null legacy parameters must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringSetParam(nullptr, 2); }), "null legacy parameters with unknown flags must throw");
+    params[0] = 0u;
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0); }), "legacy params id 0 must throw");
+    params[0] = 2u;
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0); }), "legacy params id 2 must throw");
+    params[0] = 0x01010001u;
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0); }), "an unknown legacy params id must throw");
+}
+
+void TestLegacyMasteringGetState() {
+    constexpr std::size_t size = 512;
+    constexpr std::size_t statesSize = 336;
+    alignas(16) std::uint8_t storage[size];
+    auto* header = reinterpret_cast<std::uint32_t*>(storage);
+    std::fill(storage, storage + size, 0xA5);
+    *header = 1u;
+    Require(sceAudioOutMasteringGetState(reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage)) == 0, "legacy states id 1 must be accepted");
+    Require(*header == 1u, "legacy states id 1 is kept");
+    const std::pair<std::size_t, std::size_t> meters[] = {{32, 128}, {128, 224}, {240, 272}, {272, 304}, {304, 336}};
+    for (const auto& meter : meters) {
+        Require(std::all_of(storage + meter.first, storage + meter.second, [](std::uint8_t byte) { return byte == 0; }), "the legacy mastering meters are zeroed");
+    }
+    Require(std::all_of(storage + 4, storage + 32, [](std::uint8_t byte) { return byte == 0xA5; }), "the bytes before the compressor meters are not modified");
+    Require(std::all_of(storage + 224, storage + 240, [](std::uint8_t byte) { return byte == 0xA5; }), "the limiter descriptor bytes are not modified");
+    Require(std::all_of(storage + statesSize, storage + size, [](std::uint8_t byte) { return byte == 0xA5; }), "the bytes after the states are not modified");
+    Require(sceAudioOutMasteringGetState(reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage)) == 0, "legacy states id 1 must be accepted again");
+
+    for (std::uint32_t id : {0u, 2u, 3u, 0x01010001u, 0xFFFFFFFFu}) {
+        std::fill(storage, storage + size, 0xA5);
+        *header = id;
+        Require(ThrowsException([&] { sceAudioOutMasteringGetState(reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage)); }), "an unknown legacy states id must throw");
+        Require(*header == id && std::all_of(storage + 4, storage + size, [](std::uint8_t byte) { return byte == 0xA5; }), "a refused legacy states id leaves the buffer unmodified");
+    }
+    Require(ThrowsException([] { sceAudioOutMasteringGetState(nullptr); }), "a null legacy state must throw");
 }
 
 void TestSetSystemDebugState() {
@@ -174,6 +233,10 @@ int main() {
     TestMasteringTerm();
     TestMasteringSetParam();
     TestMasteringGetState();
+    TestLegacyMasteringInit();
+    TestLegacyMasteringTerm();
+    TestLegacyMasteringSetParam();
+    TestLegacyMasteringGetState();
     TestSetSystemDebugState();
     TestEnableChat();
     TestLowLatencyService();
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp
index b1d5725eca..fff06c8167 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 
 #include <algorithm>
@@ -17,18 +18,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp
index 7fcfa50334..dcdcb0268c 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 
 #include <cmath>
@@ -14,19 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2UserCreate(std::uint32_t, AudioOut2UserHandle*);
-int APS5_VABI sceAudioOut2UserDestroy(AudioOut2UserHandle);
-int APS5_VABI sceAudioOut2UserGetSupportedAttributes(AudioOut2UserHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp
index 36074daece..0dfd811378 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 
 #include <chrono>
@@ -14,29 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextQueryMemory(const AudioOut2ContextParam*, std::size_t*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOut2LoContextQueryMemory(const AudioOut2ContextParam*, std::size_t*);
-int APS5_VABI sceAudioOut2LoContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2LoContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2LoContextSetAttributes(AudioOut2ContextHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOut2LoContextAdvance(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2LoContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2LoContextGetQueueLevel(AudioOut2ContextHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2LoPortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2LoPortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2LoPortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOut2LoPortGetState(AudioOut2PortHandle, AudioOut2PortState*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutBufferSize.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutBufferSize.cpp
index d51eda399a..6b2eaaef4e 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutBufferSize.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutBufferSize.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SDL.h"
 #include "prx/libSceAudioOut/include/AudioOutSdl.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -8,12 +9,6 @@
 #include <string_view>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-}
-
 namespace {
 constexpr SDL_AudioDeviceID device = 7;
 int opened = 0;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp
index b96f9dd570..0242fe8839 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,13 +6,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode);
-int APS5_VABI sceAudioOutExConfigureOutput(int control, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
-int APS5_VABI sceAudioOutExClose(int handle);
-int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
-}
-
 static constexpr int SYSTEM_USER = 0xFF;
 static constexpr int ERROR_EX_INVALID_MODE = static_cast<int>(0x80260015u);
 static constexpr int ERROR_EX_INVALID_CONTROL = static_cast<int>(0x80268009u);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp
index 6fcced4ffb..6e6194c862 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,10 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceAudioOutExGetMonitorInfo(int, int, void*, std::uint32_t);
-}
-
 static void Require(bool value, const char* message) {
     if (value) return;
     std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutInfo.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutInfo.cpp
index 78d9fe32cb..f246625a21 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutInfo.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutInfo.cpp
@@ -1,14 +1,9 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceAudioOutGetSimulatedHandleStatusInfo();
-int APS5_VABI sceAudioOutGetInfoOpenNum();
-int APS5_VABI sceAudioOutGetInfo();
-}
-
 static void Require(bool value, const char* message) {
     if (value) return;
     std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp
index e6cdeed0d7..487624514e 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -9,16 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam*, std::uint32_t);
-int APS5_VABI sceAudioOutGetPortState(int, AudioOutPortState*);
-int APS5_VABI sceAudioOutGetLastOutputTime(int, std::uint64_t*);
-std::uint64_t APS5_VABI sceKernelGetProcessTime();
-}
-
 static void Require(bool value, const char* message) {
     if (value) return;
     std::fprintf(stderr, "%s\n", message);
@@ -231,6 +223,7 @@ int main() {
     setenv("SDL_AUDIODRIVER", "dummy", 1);
 #endif
     sceKernelGetProcessTime();
+
     TestOutput(portTypeMain);
     TestOutput(portTypeVibration);
     TestPortsAreIndependent();
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp
index ca25acb711..ae686bee18 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstddef>
@@ -11,14 +12,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutSetVolume(int, std::uint32_t, int*);
-int APS5_VABI sceAudioOutSetMixLevelPadSpk(int, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp
index 107a2ef2f5..15703d8ba8 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SDL.h"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -12,12 +13,6 @@
 #include <string_view>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutClose(int);
-}
-
 namespace {
 
 constexpr std::uint32_t Grain = 256;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp
index c56be14970..6b9577e91d 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SDL.h"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -7,12 +8,6 @@
 #include <cstdlib>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutClose(int);
-}
-
 namespace {
 
 constexpr std::uint32_t grain = 256;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp
index dd5390753d..fcadcec548 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -11,17 +13,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-}
-
 namespace {
 
 constexpr std::uint32_t grain = 256;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
index eb5878fc18..6c8f9561ee 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,14 +6,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutSysOpen(int userId, std::uint32_t mode);
-int APS5_VABI sceAudioOutSysConfigureOutput(int type, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
-int APS5_VABI sceAudioOutSysClose(int handle);
-int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode);
-int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
-}
-
 static constexpr int SYSTEM_USER = 0xFF;
 
 static bool failed = false;
@@ -53,6 +46,10 @@ int main() {
     Require(Throws([] { sceAudioOutSysConfigureOutput(1, 0, 4, 1, 0); }), "another mode throws");
     Require(Throws([] { sceAudioOutSysConfigureOutput(1, 0, 5, 2, 0); }), "another target throws");
 
+    int mainOutput = -1;
+    Require(!Throws([&mainOutput] { mainOutput = sceAudioOutSetMainOutput(); }), "sceAudioOutSetMainOutput does not throw");
+    Require(mainOutput == 0, "sceAudioOutSetMainOutput returns 0");
+
     Require(sceAudioOutSysClose(truehd) == 0, "close the first Sys port");
     Require(Throws([truehd] { sceAudioOutSysClose(truehd); }), "a closed Sys port throws");
     const int ex = sceAudioOutExOpen(SYSTEM_USER, 0);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp
index 7eb1547ce7..1ea013ca7d 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -8,10 +9,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceAudioOutSysGetHdmiMonitorInfo(int, void*, std::uint32_t);
-}
-
 static void Require(bool value, const char* message) {
     if (value) return;
     std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutSystemState.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutSystemState.cpp
new file mode 100644
index 0000000000..c925334fbd
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutSystemState.cpp
@@ -0,0 +1,39 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+static void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+namespace {
+
+constexpr int invalidPointer = static_cast<int>(0x80260004);
+
+void TestGetSystemState() {
+    AudioOutSystemState state{};
+    state.loudness = -1.0f;
+    state.reserved8[0] = 0xAA;
+    state.reserved[2] = ~0ull;
+    Require(sceAudioOutGetSystemState(&state) == 0, "sceAudioOutGetSystemState must succeed with valid pointer");
+    Require(state.loudness == 0.0f, "loudness must be reported as 0.0f");
+    Require(state.reserved8[0] == 0 && state.reserved[2] == 0, "reserved fields must be cleared");
+}
+
+void TestInvalidPointer() {
+    Require(sceAudioOutGetSystemState(nullptr) == invalidPointer, "null pointer must return SCE_AUDIO_OUT_ERROR_INVALID_POINTER");
+}
+
+}
+
+int main() {
+    TestGetSystemState();
+    TestInvalidPointer();
+    return 0;
+}
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp
index 4f27e0bf7d..6c01a3a317 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libScePad/include/PadState.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -7,15 +8,6 @@
 #include <string_view>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutExOpen(int, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam*, std::uint32_t);
-int APS5_VABI sceAudioOutSetVolume(int, std::uint32_t, int*);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) throw std::runtime_error(message);
 }
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp
index 6d0a7ca4f1..79681dff96 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SDL.h"
 #include "prx/libSceAudioOut/include/AudioOutSdl.hpp"
 #include "prx/libScePad/include/PadState.hpp"
@@ -13,15 +14,6 @@
 #include <string_view>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam*, std::uint32_t);
-int APS5_VABI sceAudioOutSetVolume(int, std::uint32_t, int*);
-int APS5_VABI sceAudioOutGetLastOutputTime(int, std::uint64_t*);
-}
-
 namespace {
 constexpr std::uint32_t frames = 256;
 bool available = true;
diff --git a/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp b/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp
index 8323b813c9..f00b2ea48a 100644
--- a/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp
+++ b/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp
@@ -1,6 +1,7 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAUDIOPROPAGATION_AUDIOPROPAGATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAUDIOPROPAGATION_AUDIOPROPAGATION_HPP
 
+#include <array>
 #include <cstddef>
 #include <cstdint>
 
@@ -128,6 +129,14 @@ static_assert(offsetof(ReportInfo, function) == 32);
 static_assert(offsetof(ReportInfo, format) == 40);
 static_assert(offsetof(ReportInfo, arguments) == 48);
 
+inline constexpr std::uint32_t MaxPaths = 36;
+inline constexpr std::uint32_t MaxPathPoints = 4;
+inline constexpr std::uint32_t PathId = 0x010107d3;
+inline constexpr std::uint32_t PathPointId = 0x010107d2;
+inline constexpr std::uint32_t PathInvalid = 1;
+inline constexpr std::uint32_t PathPortal = 2;
+
+
 struct Attribute {
     std::uint32_t id;
     std::uint32_t reserved0;
@@ -209,6 +218,7 @@ std::int32_t APS5_VABI sceAudioPropagationSourceDestroy(AudioPropagationHandle s
 std::int32_t APS5_VABI sceAudioPropagationSourceSetAttributes(AudioPropagationHandle source, const AudioPropagation::Attribute* attributes, std::uint32_t count);
 std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPathCount(AudioPropagationHandle source, std::uint32_t* count);
 std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPath(AudioPropagationHandle source, std::uint32_t index, AudioPropagationHandle* outPath);
+std::int32_t APS5_VABI sceAudioPropagationPathGetNumPoints(AudioPropagationHandle path, std::uint32_t* count);
 std::int32_t APS5_VABI sceAudioPropagationSourceGetRays(AudioPropagationHandle source, void* rays, std::uint32_t* count);
 std::int32_t APS5_VABI sceAudioPropagationSourceCalculateAudioPaths(AudioPropagationHandle source, const void* rays, std::uint32_t rayCount, std::uint32_t reflectionOrder, void* paths, std::uint32_t pathCount);
 std::int32_t APS5_VABI sceAudioPropagationSourceSetAudioPaths(AudioPropagationHandle source, const void* entries, std::uint32_t count);
diff --git a/core/libs/prx/libSceAudioPropagation/Export.cpp b/core/libs/prx/libSceAudioPropagation/Export.cpp
index 2b461aa9cc..2c257811bf 100644
--- a/core/libs/prx/libSceAudioPropagation/Export.cpp
+++ b/core/libs/prx/libSceAudioPropagation/Export.cpp
@@ -1,8 +1,10 @@
+#include "prx/libSceAudioPropagation/include/Api.hpp"
+#include "prx/libSceAudioPropagation/AudioPropagation.hpp"
 #include "AudioPropagation.hpp"
 #include "prx/libc/include/General.hpp"
 
-#include <cstdint>
 #include <cmath>
+#include <cstdint>
 #include <cstring>
 #include <mutex>
 #include <stdexcept>
@@ -27,18 +29,25 @@ struct SystemState {
     std::uint32_t maxSources;
 };
 
-enum class Kind { Room, Portal, Source, Material };
+enum class Kind { Room, Portal, Source, Material, Path };
 
 struct Object {
     Kind kind;
     AudioPropagationHandle system;
 };
 
+struct PathState {
+    AudioPath data{};
+    float gain = 0.0f;
+};
+
 struct Registry {
     std::mutex mutex;
     std::unordered_set<AudioPropagationHandle> systems;
     std::unordered_map<AudioPropagationHandle, Object> objects;
     std::unordered_map<AudioPropagationHandle, Object> orphans;
+    std::unordered_map<AudioPropagationHandle, std::array<AudioPropagationHandle, MaxPaths>> sourcePaths;
+    std::unordered_map<AudioPropagationHandle, PathState> paths;
     AudioPropagationHandle next = 1;
 };
 
@@ -101,6 +110,13 @@ void destroyObject(AudioPropagationHandle system, AudioPropagationHandle handle,
         return;
     }
     require(requireObject(state, handle, kind, function).system == system, function);
+    if (kind == Kind::Source) {
+        for (const auto path : state.sourcePaths.at(handle)) {
+            state.paths.erase(path);
+            state.objects.erase(path);
+        }
+        state.sourcePaths.erase(handle);
+    }
     state.objects.erase(handle);
 }
 
@@ -169,9 +185,11 @@ std::int32_t APS5_VABI sceAudioPropagationSystemDestroy(AudioPropagationHandle s
     auto& state = registry();
     std::lock_guard lock(state.mutex);
     requireSystem(state, system, __func__);
+    std::erase_if(state.paths, [&](const auto& entry) { return state.objects.at(entry.first).system == system; });
+    std::erase_if(state.sourcePaths, [&](const auto& entry) { return state.objects.at(entry.first).system == system; });
     std::erase_if(state.objects, [&](const auto& entry) {
         if (entry.second.system != system) return false;
-        state.orphans.insert(entry);
+        if (entry.second.kind != Kind::Path) state.orphans.insert(entry);
         return true;
     });
     reinterpret_cast<SystemState*>(system)->magic = 0;
@@ -257,7 +275,30 @@ std::int32_t APS5_VABI sceAudioPropagationPortalSetAttributes(AudioPropagationHa
 }
 
 std::int32_t APS5_VABI sceAudioPropagationSourceCreate(AudioPropagationHandle system, AudioPropagationHandle* outSource) {
-    createObject(system, Kind::Source, outSource, __func__);
+    require(outSource != nullptr, __func__);
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    AudioPropagationHandle source = 0;
+    createObjectLocked(state, system, Kind::Source, &source, __func__);
+    std::array<AudioPropagationHandle, MaxPaths> handles{};
+    try {
+        for (auto& handle : handles) {
+            createObjectLocked(state, system, Kind::Path, &handle, __func__);
+            PathState path{};
+            path.data.desc = {PathId, sizeof(AudioPath)};
+            path.data.flags = PathInvalid;
+            state.paths.emplace(handle, path);
+        }
+        state.sourcePaths.emplace(source, handles);
+    } catch (...) {
+        for (const auto handle : handles) {
+            state.paths.erase(handle);
+            state.objects.erase(handle);
+        }
+        state.objects.erase(source);
+        throw;
+    }
+    *outSource = source;
     return 0;
 }
 
@@ -279,7 +320,7 @@ std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPathCount(AudioPropagati
     std::lock_guard lock(state.mutex);
     requireObject(state, source, Kind::Source, __func__);
     require(count != nullptr, __func__);
-    *count = 0;
+    *count = MaxPaths;
     return 0;
 }
 
@@ -289,8 +330,18 @@ std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPath(AudioPropagationHan
     const auto found = state.objects.find(source);
     if (found == state.objects.end() || found->second.kind != Kind::Source || !liveSystem(state, found->second.system)) return ErrorInvalidHandle;
     if (!outPath) return ErrorNullPointer;
-    static_cast<void>(index);
-    return ErrorInvalidArgument;
+    if (index >= MaxPaths) return ErrorInvalidArgument;
+    *outPath = state.sourcePaths.at(source)[index];
+    return 0;
+}
+
+std::int32_t APS5_VABI sceAudioPropagationPathGetNumPoints(AudioPropagationHandle path, std::uint32_t* count) {
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    requireObject(state, path, Kind::Path, __func__);
+    require(count != nullptr, __func__);
+    *count = state.paths.at(path).data.pointCount;
+    return 0;
 }
 
 std::int32_t APS5_VABI sceAudioPropagationSourceGetRays(AudioPropagationHandle source, void* rays, std::uint32_t* count) {
@@ -322,10 +373,19 @@ std::int32_t APS5_VABI sceAudioPropagationSourceSetAudioPaths(AudioPropagationHa
 }
 
 std::int32_t APS5_VABI sceAudioPropagationSourceSetAudioPath(AudioPropagationHandle path, const AudioPath* data, float gain) {
-    static_cast<void>(path);
-    static_cast<void>(data);
-    static_cast<void>(gain);
-    NotImplemented_nid_no_patch(__func__);
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    const auto system = requireObject(state, path, Kind::Path, __func__).system;
+    requireDescriptor(data != nullptr ? &static_cast<const AudioPath*>(data)->desc : nullptr, PathId, sizeof(AudioPath), __func__);
+    const auto replacement = *static_cast<const AudioPath*>(data);
+    require(std::isfinite(gain) && gain >= 0.0f && replacement.pointCount <= MaxPathPoints && (replacement.flags & ~(PathInvalid | PathPortal)) == 0, __func__);
+    for (std::uint32_t index = 0; index < replacement.pointCount; ++index) {
+        const auto& point = replacement.points[index];
+        requireDescriptor(&point.desc, PathPointId, sizeof(PathPoint), __func__);
+        require(std::isfinite(point.gain) && point.gain >= 0.0f && std::isfinite(point.position[0]) && std::isfinite(point.position[1]) && std::isfinite(point.position[2]), __func__);
+        if (point.room != 0) require(requireObject(state, point.room, Kind::Room, __func__).system == system, __func__);
+    }
+    state.paths.at(path) = PathState{replacement, gain};
     return 0;
 }
 
@@ -336,13 +396,28 @@ std::int32_t APS5_VABI sceAudioPropagationSourceRender(AudioPropagationHandle sy
     requireSystem(state, system, __func__);
     const auto& configuration = *reinterpret_cast<const SystemState*>(system);
     require(count <= configuration.maxSources, __func__);
-    const auto requiredBytes = static_cast<std::size_t>(configuration.frameSamples) * 16 * sizeof(float);
     for (std::uint32_t index = 0; index < count; ++index) {
         const auto& info = infos[index];
         requireDescriptor(&info.desc, RenderInfoId, RenderInfoSize, __func__);
         require(requireObject(state, info.source, Kind::Source, __func__).system == system, __func__);
-        require(info.output != nullptr && info.outputSize >= requiredBytes, __func__);
-        if (info.format != RenderFormat) throw std::runtime_error(std::string(__func__) + ": render format " + std::to_string(info.format) + " is unknown");
+        require(info.output != nullptr && info.outputSize != 0, __func__);
+        std::uint32_t channels = 0;
+        switch (info.format) {
+        case 0: channels = 4; break;
+        case 1: channels = 9; break;
+        case 2: channels = 16; break;
+        case 4:
+        case 5: channels = 8; break;
+        default: throw std::runtime_error(std::string(__func__) + ": render format " + std::to_string(info.format) + " is unknown");
+        }
+        const auto requiredBytes = static_cast<std::size_t>(configuration.frameSamples) * channels * sizeof(float);
+        require(info.outputSize >= requiredBytes && info.outputSize % (channels * sizeof(float)) == 0, __func__);
+        for (const auto handle : state.sourcePaths.at(info.source)) {
+            const auto& path = state.paths.at(handle);
+            if (path.gain > 0.0f && path.data.pointCount != 0 && (path.data.flags & PathInvalid) == 0) {
+                throw std::runtime_error(std::string(__func__) + ": nonempty audio path rendering is not implemented");
+            }
+        }
     }
     for (std::uint32_t index = 0; index < count; ++index) {
         infos[index].channelCount = 0;
@@ -350,11 +425,6 @@ std::int32_t APS5_VABI sceAudioPropagationSourceRender(AudioPropagationHandle sy
     return 0;
 }
 
-int APS5_VABI sceAudioPropagationPathGetNumPoints(AudioPropagationHandle path, std::uint32_t* count) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioPropagationReportApi(std::uint32_t category, AudioPropagationHandle handle, std::int32_t result, std::int32_t operation, const char* function, const char* format, ...) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceAudioPropagation/include/Api.hpp b/core/libs/prx/libSceAudioPropagation/include/Api.hpp
new file mode 100644
index 0000000000..131fe6b5cc
--- /dev/null
+++ b/core/libs/prx/libSceAudioPropagation/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "prx/libSceAudioPropagation/AudioPropagation.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioPropagationReportApi(std::uint32_t category, AudioPropagationHandle handle, std::int32_t result, std::int32_t operation, const char* function, const char* format, ...);
+int APS5_VABI sceAudioPropagationResetAttributes(AudioPropagation::Attribute* attributes, std::uint32_t count);
+int APS5_VABI sceAudioPropagationSourceQueryInfo(AudioPropagationHandle source, AudioPropagation::SourceInfo* info);
+int APS5_VABI sceAudioPropagationSystemLock(AudioPropagationHandle system);
+int APS5_VABI sceAudioPropagationSystemQueryInfo(AudioPropagationHandle system, AudioPropagation::SystemInfo* info, std::size_t size);
+int APS5_VABI sceAudioPropagationReportRegisterHandler(std::uint32_t category, AudioPropagation::ReportHandler handler, void* userData, AudioPropagation::ReportRegistration** registration);
+int APS5_VABI sceAudioPropagationReportUnregisterHandler(AudioPropagation::ReportRegistration* registration);
+int APS5_VABI sceAudioPropagationSystemEnumHandles(AudioPropagationHandle* handles, std::uint32_t capacity);
+int APS5_VABI sceAudioPropagationSystemUnlock(AudioPropagationHandle system);
+
+}
diff --git a/core/libs/prx/libSceAudioPropagation/libSceAudioPropagation.hpp b/core/libs/prx/libSceAudioPropagation/libSceAudioPropagation.hpp
new file mode 100644
index 0000000000..6431f41cde
--- /dev/null
+++ b/core/libs/prx/libSceAudioPropagation/libSceAudioPropagation.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceAudioPropagation/AudioPropagation.hpp"
+#include "prx/libSceAudioPropagation/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudioSystem/Export.cpp b/core/libs/prx/libSceAudioSystem/Export.cpp
index d5c4291d01..de11eb33dd 100644
--- a/core/libs/prx/libSceAudioSystem/Export.cpp
+++ b/core/libs/prx/libSceAudioSystem/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioSystem/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudioSystem/include/Api.hpp b/core/libs/prx/libSceAudioSystem/include/Api.hpp
new file mode 100644
index 0000000000..c15ab7a627
--- /dev/null
+++ b/core/libs/prx/libSceAudioSystem/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioSystemSystemResume();
+int APS5_VABI sceAudioSystemSystemSuspend();
+
+}
diff --git a/core/libs/prx/libSceAudioSystem/libSceAudioSystem.hpp b/core/libs/prx/libSceAudioSystem/libSceAudioSystem.hpp
new file mode 100644
index 0000000000..092b35b31a
--- /dev/null
+++ b/core/libs/prx/libSceAudioSystem/libSceAudioSystem.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudioSystem/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodReport/libSceAudiodReport.hpp b/core/libs/prx/libSceAudiodReport/libSceAudiodReport.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodReport/libSceAudiodReport.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodec.native/Export.cpp b/core/libs/prx/libSceAudiodec.native/Export.cpp
index 4f00015020..96acf5c292 100644
--- a/core/libs/prx/libSceAudiodec.native/Export.cpp
+++ b/core/libs/prx/libSceAudiodec.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodec.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudiodec.native/include/Api.hpp b/core/libs/prx/libSceAudiodec.native/include/Api.hpp
new file mode 100644
index 0000000000..f5050e0019
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec.native/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudiodecClearContextEx(void);
+int APS5_VABI sceAudiodecCreateDecoderEx(void);
+int APS5_VABI sceAudiodecDecode2(void);
+int APS5_VABI sceAudiodecDecode2Ex(void);
+int APS5_VABI sceAudiodecDecode2WithPriority(void);
+int APS5_VABI sceAudiodecDecode2WithPriorityEx(void);
+int APS5_VABI sceAudiodecDecodeEx(void);
+int APS5_VABI sceAudiodecDecodeWithPriority(void);
+int APS5_VABI sceAudiodecDecodeWithPriorityEx(void);
+int APS5_VABI sceAudiodecDeleteDecoderEx(void);
+int APS5_VABI sceAudiodecGetContext(void);
+int APS5_VABI sceAudiodecInitialize(void);
+int APS5_VABI sceAudiodecRegisterCodec(void);
+int APS5_VABI sceAudiodecTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceAudiodec.native/libSceAudiodec.native.hpp b/core/libs/prx/libSceAudiodec.native/libSceAudiodec.native.hpp
new file mode 100644
index 0000000000..2f7cfa515f
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec.native/libSceAudiodec.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudiodec.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodec/Export.cpp b/core/libs/prx/libSceAudiodec/Export.cpp
index 5e2b911800..4840fde2d0 100644
--- a/core/libs/prx/libSceAudiodec/Export.cpp
+++ b/core/libs/prx/libSceAudiodec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <array>
diff --git a/core/libs/prx/libSceAudiodec/include/Api.hpp b/core/libs/prx/libSceAudiodec/include/Api.hpp
new file mode 100644
index 0000000000..e02050acef
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceAudiodecInitLibrary(uint32_t codecType);
+int32_t APS5_VABI sceAudiodecTermLibrary(uint32_t codecType);
+int32_t APS5_VABI sceAudiodecCreateDecoder(AudiodecCtrl* ctrl, uint32_t codecType);
+int32_t APS5_VABI sceAudiodecDeleteDecoder(int32_t handle);
+int32_t APS5_VABI sceAudiodecClearContext(int32_t handle);
+int32_t APS5_VABI sceAudiodecDecode(int32_t handle, AudiodecCtrl* ctrl);
+
+}
diff --git a/core/libs/prx/libSceAudiodec/libSceAudiodec.hpp b/core/libs/prx/libSceAudiodec/libSceAudiodec.hpp
new file mode 100644
index 0000000000..b8ec4f574f
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec/libSceAudiodec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudiodec/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodecCpu/Export.cpp b/core/libs/prx/libSceAudiodecCpu/Export.cpp
index c0c2f83744..e4ac1ea15b 100644
--- a/core/libs/prx/libSceAudiodecCpu/Export.cpp
+++ b/core/libs/prx/libSceAudiodecCpu/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodecCpu/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudiodecCpu/include/Api.hpp b/core/libs/prx/libSceAudiodecCpu/include/Api.hpp
new file mode 100644
index 0000000000..336933274e
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpu/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudiodecCpuClearContext(void);
+int APS5_VABI sceAudiodecCpuDecode(void);
+int APS5_VABI sceAudiodecCpuInitDecoder(void);
+int APS5_VABI sceAudiodecCpuInternalClearContext(void);
+int APS5_VABI sceAudiodecCpuInternalDecode(void);
+int APS5_VABI sceAudiodecCpuInternalInitDecoder(void);
+int APS5_VABI sceAudiodecCpuInternalQueryMemSize(void);
+int APS5_VABI sceAudiodecCpuQueryMemSize(void);
+
+}
diff --git a/core/libs/prx/libSceAudiodecCpu/libSceAudiodecCpu.hpp b/core/libs/prx/libSceAudiodecCpu/libSceAudiodecCpu.hpp
new file mode 100644
index 0000000000..e896a52007
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpu/libSceAudiodecCpu.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudiodecCpu/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodecCpuAlac/libSceAudiodecCpuAlac.hpp b/core/libs/prx/libSceAudiodecCpuAlac/libSceAudiodecCpuAlac.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuAlac/libSceAudiodecCpuAlac.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDdp/libSceAudiodecCpuDdp.hpp b/core/libs/prx/libSceAudiodecCpuDdp/libSceAudiodecCpuDdp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDdp/libSceAudiodecCpuDdp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDts/libSceAudiodecCpuDts.hpp b/core/libs/prx/libSceAudiodecCpuDts/libSceAudiodecCpuDts.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDts/libSceAudiodecCpuDts.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDtsHdLbr/libSceAudiodecCpuDtsHdLbr.hpp b/core/libs/prx/libSceAudiodecCpuDtsHdLbr/libSceAudiodecCpuDtsHdLbr.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDtsHdLbr/libSceAudiodecCpuDtsHdLbr.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDtsHdMa/libSceAudiodecCpuDtsHdMa.hpp b/core/libs/prx/libSceAudiodecCpuDtsHdMa/libSceAudiodecCpuDtsHdMa.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDtsHdMa/libSceAudiodecCpuDtsHdMa.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuFlac/libSceAudiodecCpuFlac.hpp b/core/libs/prx/libSceAudiodecCpuFlac/libSceAudiodecCpuFlac.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuFlac/libSceAudiodecCpuFlac.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuLpcm/libSceAudiodecCpuLpcm.hpp b/core/libs/prx/libSceAudiodecCpuLpcm/libSceAudiodecCpuLpcm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuLpcm/libSceAudiodecCpuLpcm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuM4aac/libSceAudiodecCpuM4aac.hpp b/core/libs/prx/libSceAudiodecCpuM4aac/libSceAudiodecCpuM4aac.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuM4aac/libSceAudiodecCpuM4aac.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuTrhd/libSceAudiodecCpuTrhd.hpp b/core/libs/prx/libSceAudiodecCpuTrhd/libSceAudiodecCpuTrhd.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuTrhd/libSceAudiodecCpuTrhd.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAutoMounterClient/Export.cpp b/core/libs/prx/libSceAutoMounterClient/Export.cpp
index 77af95c0ff..ab7eed9165 100644
--- a/core/libs/prx/libSceAutoMounterClient/Export.cpp
+++ b/core/libs/prx/libSceAutoMounterClient/Export.cpp
@@ -1,20 +1,9 @@
+#include "prx/libSceAutoMounterClient/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct AutoMounterUsbDeviceInfo {
-    char deviceName[128];
-    std::byte metadata[22];
-    std::byte data0[256];
-    std::byte padding[2];
-    std::uint64_t data0Size;
-    std::byte data1[256];
-    std::uint64_t data1Size;
-    std::byte data2[256];
-    std::uint64_t data2Size;
-};
-
 static_assert(sizeof(AutoMounterUsbDeviceInfo) == 944);
 static_assert(offsetof(AutoMounterUsbDeviceInfo, data0) == 150);
 static_assert(offsetof(AutoMounterUsbDeviceInfo, data0Size) == 408);
diff --git a/core/libs/prx/libSceAutoMounterClient/include/Api.hpp b/core/libs/prx/libSceAutoMounterClient/include/Api.hpp
new file mode 100644
index 0000000000..766f754f18
--- /dev/null
+++ b/core/libs/prx/libSceAutoMounterClient/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct AutoMounterUsbDeviceInfo {
+    char deviceName[128];
+    std::byte metadata[22];
+    std::byte data0[256];
+    std::byte padding[2];
+    std::uint64_t data0Size;
+    std::byte data1[256];
+    std::uint64_t data1Size;
+    std::byte data2[256];
+    std::uint64_t data2Size;
+};
+
+extern "C" {
+
+int APS5_VABI sceAutoMounterClientGetUsbDeviceInfo(const char* deviceName, AutoMounterUsbDeviceInfo* info);
+int APS5_VABI sceAutoMounterClientGetUsbDeviceList(char (*deviceNames)[64], std::int32_t* count);
+int APS5_VABI sceAutoMounterClientInit(PthreadAttr* threadAttr);
+int APS5_VABI sceAutoMounterClientRegisterCallback();
+int APS5_VABI sceAutoMounterClientTerm();
+int APS5_VABI sceAutoMounterClientUnregisterCallback();
+
+}
diff --git a/core/libs/prx/libSceAutoMounterClient/libSceAutoMounterClient.hpp b/core/libs/prx/libSceAutoMounterClient/libSceAutoMounterClient.hpp
new file mode 100644
index 0000000000..dd1e89097a
--- /dev/null
+++ b/core/libs/prx/libSceAutoMounterClient/libSceAutoMounterClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAutoMounterClient/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvPlayer.native/Export.cpp b/core/libs/prx/libSceAvPlayer.native/Export.cpp
index 2584dda091..3834e0cfb5 100644
--- a/core/libs/prx/libSceAvPlayer.native/Export.cpp
+++ b/core/libs/prx/libSceAvPlayer.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayer.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAvPlayer.native/include/Api.hpp b/core/libs/prx/libSceAvPlayer.native/include/Api.hpp
new file mode 100644
index 0000000000..bb1e1f40dc
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer.native/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAvPlayerPrintf(void);
+int APS5_VABI sceAvPlayerVprintf(void);
+
+}
diff --git a/core/libs/prx/libSceAvPlayer.native/libSceAvPlayer.native.hpp b/core/libs/prx/libSceAvPlayer.native/libSceAvPlayer.native.hpp
new file mode 100644
index 0000000000..589a07f273
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer.native/libSceAvPlayer.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvPlayer.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvPlayer/Export.cpp b/core/libs/prx/libSceAvPlayer/Export.cpp
index 93d3d8fb0f..be3c03f01e 100644
--- a/core/libs/prx/libSceAvPlayer/Export.cpp
+++ b/core/libs/prx/libSceAvPlayer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayer/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -151,7 +152,7 @@ int APS5_VABI sceAvPlayerSetAvailableBandwidth(AvPlayerInternal* h, uint32_t sta
     (void)minimum_bandwidth;
     (void)maximum_bandwidth;
     if (!h) return SCE_AVPLAYER_ERROR_INVALID_PARAMS;
-    return SCE_OK;
+    return ToPlayer(h)->SetAvailableBandwidth();
 }
 
 int APS5_VABI sceAvPlayerSetLogCallback(void* callback, void* user_data) {
@@ -198,5 +199,28 @@ void SetAvPlayerClockForTest_nid_no_patch(AvPlayerInternal* h, double millisecon
     if (h) ToPlayer(h)->SetClockTimeForTest(milliseconds);
 }
 
+void HoldAvPlayerAudioEofForTest_nid_no_patch(AvPlayerInternal* h, bool hold) {
+    if (h) ToPlayer(h)->SetHoldAudioEofForTest(hold);
+}
+
+bool AvPlayerAudioEofHeldForTest_nid_no_patch(AvPlayerInternal* h) {
+    return h && ToPlayer(h)->AudioEofHeldForTest();
+}
+
+bool AvPlayerAudioEndedForTest_nid_no_patch(AvPlayerInternal* h) {
+    return h && ToPlayer(h)->AudioEndedForTest();
+}
+
+int QueuedAvPlayerAudioForTest_nid_no_patch(AvPlayerInternal* h) {
+    return h ? ToPlayer(h)->QueuedAudioForTest() : 0;
+}
+
+bool NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(AvPlayerInternal* h, std::uint64_t* timestamp) {
+    std::uint64_t value = 0;
+    if (!h || !timestamp || !ToPlayer(h)->NextQueuedAudioTimestampForTest(value)) return false;
+    *timestamp = value;
+    return true;
+}
+
 }
 #pragma GCC visibility pop
diff --git a/core/libs/prx/libSceAvPlayer/include/Api.hpp b/core/libs/prx/libSceAvPlayer/include/Api.hpp
new file mode 100644
index 0000000000..ac8eb6cf31
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer/include/Api.hpp
@@ -0,0 +1,47 @@
+#pragma once
+
+#include "prx/libSceAvPlayer/include/AvPlayer.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <optional>
+#include <string_view>
+#include <vector>
+
+extern "C" {
+
+int APS5_VABI sceAvPlayerAddSource(AvPlayerInternal* h, const char* filename);
+int APS5_VABI sceAvPlayerAddSourceEx(AvPlayerInternal* h, uint32_t uriType, const AvPlayerSourceDetails* sourceDetails);
+int APS5_VABI sceAvPlayerChangeStream(AvPlayerInternal* h, uint32_t oldStreamId, uint32_t newStreamId);
+int APS5_VABI sceAvPlayerClose(AvPlayerInternal* h);
+uint64_t APS5_VABI sceAvPlayerCurrentTime(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerDisableStream(AvPlayerInternal* h, uint32_t streamId);
+int APS5_VABI sceAvPlayerEnableStream(AvPlayerInternal* h, uint32_t streamId);
+Bool APS5_VABI sceAvPlayerGetAudioData(AvPlayerInternal* h, AvPlayerFrameInfo* audioInfo);
+int APS5_VABI sceAvPlayerGetStreamInfo(AvPlayerInternal* h, uint32_t streamId, AvPlayerStreamInfo* info);
+int APS5_VABI sceAvPlayerGetStreamInfoEx(AvPlayerInternal* h, uint32_t streamId, AvPlayerStreamInfoEx* info);
+Bool APS5_VABI sceAvPlayerGetVideoData(AvPlayerInternal* h, AvPlayerFrameInfo* videoInfo);
+Bool APS5_VABI sceAvPlayerGetVideoDataEx(AvPlayerInternal* h, AvPlayerFrameInfoEx* videoInfo);
+AvPlayerInternal* APS5_VABI sceAvPlayerInit(AvPlayerInitData* init);
+int APS5_VABI sceAvPlayerInitEx(const AvPlayerInitDataEx* initEx, AvPlayerInternal** handle);
+Bool APS5_VABI sceAvPlayerIsActive(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerJumpToTime(AvPlayerInternal* h, uint64_t timeMs);
+int APS5_VABI sceAvPlayerPause(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerPostInit(AvPlayerInternal* h, const AvPlayerPostInitData* postInit);
+int APS5_VABI sceAvPlayerResume(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerSetAvSyncMode(AvPlayerInternal* h, uint32_t syncMode);
+int APS5_VABI sceAvPlayerSetAvailableBandwidth(AvPlayerInternal* h, uint32_t startBandwidth, uint32_t minimumBandwidth, uint32_t maximumBandwidth);
+int APS5_VABI sceAvPlayerSetLogCallback(void* callback, void* userData);
+int APS5_VABI sceAvPlayerSetLooping(AvPlayerInternal* h, Bool loop);
+int APS5_VABI sceAvPlayerSetTrickSpeed(AvPlayerInternal* h, int32_t trickSpeed);
+int APS5_VABI sceAvPlayerStart(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerStartEx(AvPlayerInternal* handle, const AvPlayer::StartInfo* startInfo);
+int APS5_VABI sceAvPlayerStop(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerStreamCount(AvPlayerInternal* h);
+
+}
diff --git a/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp b/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp
index 1c82453073..d81882a932 100644
--- a/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp
+++ b/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp
@@ -87,6 +87,11 @@ public:
     virtual std::uint64_t CurrentTime() = 0;
     virtual bool Finished() = 0;
     virtual void SetClockTimeForTest(double milliseconds) = 0;
+    virtual void SetHoldAudioEofForTest(bool hold) = 0;
+    virtual bool AudioEofHeldForTest() = 0;
+    virtual bool AudioEndedForTest() = 0;
+    virtual int QueuedAudioForTest() = 0;
+    virtual bool NextQueuedAudioTimestampForTest(std::uint64_t& timestamp) = 0;
 };
 
 std::unique_ptr<ISource> OpenSource(const SourceSettings& settings, const std::string& path, ISourceEvents& events);
@@ -94,6 +99,11 @@ std::unique_ptr<ISource> OpenSource(const SourceSettings& settings, const std::s
 std::uint32_t DetectSourceType(std::string_view path);
 
 void SetAvPlayerClockForTest_nid_no_patch(AvPlayerInternal* h, double milliseconds);
+void HoldAvPlayerAudioEofForTest_nid_no_patch(AvPlayerInternal* h, bool hold);
+bool AvPlayerAudioEofHeldForTest_nid_no_patch(AvPlayerInternal* h);
+bool AvPlayerAudioEndedForTest_nid_no_patch(AvPlayerInternal* h);
+int QueuedAvPlayerAudioForTest_nid_no_patch(AvPlayerInternal* h);
+bool NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(AvPlayerInternal* h, std::uint64_t* timestamp);
 
 class Player final : public AvPlayerInternal, private ISourceEvents {
 public:
@@ -117,6 +127,7 @@ public:
     int JumpToTime(std::uint64_t milliseconds);
     int SetLooping(bool enabled);
     int SetTrickSpeed(std::int32_t trickSpeed);
+    int SetAvailableBandwidth();
     int SetAvSyncMode(std::uint32_t mode);
     bool GetVideoData(AvPlayerFrameInfoEx& info);
     bool GetVideoData(AvPlayerFrameInfo& info);
@@ -124,6 +135,11 @@ public:
     bool IsActive();
     std::uint64_t CurrentTime();
     void SetClockTimeForTest(double milliseconds);
+    void SetHoldAudioEofForTest(bool hold);
+    bool AudioEofHeldForTest();
+    bool AudioEndedForTest();
+    int QueuedAudioForTest();
+    bool NextQueuedAudioTimestampForTest(std::uint64_t& timestamp);
 
 private:
     enum class State { Initial, Ready, Play, Pause, Stop, EndOfFile, Error };
diff --git a/core/libs/prx/libSceAvPlayer/libSceAvPlayer.hpp b/core/libs/prx/libSceAvPlayer/libSceAvPlayer.hpp
new file mode 100644
index 0000000000..9a78810578
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer/libSceAvPlayer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvPlayer/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvPlayer/src/Player.cpp b/core/libs/prx/libSceAvPlayer/src/Player.cpp
index 90c3b57dba..3f928b7ea8 100644
--- a/core/libs/prx/libSceAvPlayer/src/Player.cpp
+++ b/core/libs/prx/libSceAvPlayer/src/Player.cpp
@@ -334,14 +334,20 @@ int Player::SetLooping(bool enabled) {
 }
 
 int Player::SetTrickSpeed(std::int32_t trickSpeed) {
-    if (trickSpeed == 0) return SCE_AVPLAYER_ERROR_INVALID_PARAMS;
     std::lock_guard lock(mutex);
+    if (!source) return SCE_AVPLAYER_ERROR_OPERATION_FAILED;
+    if (trickSpeed == 0) return SCE_AVPLAYER_ERROR_INVALID_PARAMS;
     if (state == State::Stop || state == State::EndOfFile || state == State::Error) return SCE_AVPLAYER_ERROR_OPERATION_FAILED;
     speed = trickSpeed;
-    if (source) source->SetSpeed(trickSpeed);
+    source->SetSpeed(trickSpeed);
     return SCE_OK;
 }
 
+int Player::SetAvailableBandwidth() {
+    std::lock_guard lock(mutex);
+    return source ? SCE_AVPLAYER_ERROR_OPERATION_FAILED : SCE_OK;
+}
+
 int Player::SetAvSyncMode(std::uint32_t mode) {
     if (mode != SyncModeDefault && mode != SyncModeNone) return SCE_AVPLAYER_ERROR_INVALID_PARAMS;
     std::lock_guard lock(mutex);
@@ -391,4 +397,29 @@ void Player::SetClockTimeForTest(double milliseconds) {
     if (source) source->SetClockTimeForTest(milliseconds);
 }
 
+void Player::SetHoldAudioEofForTest(bool hold) {
+    std::lock_guard lock(mutex);
+    if (source) source->SetHoldAudioEofForTest(hold);
+}
+
+bool Player::AudioEofHeldForTest() {
+    std::lock_guard lock(mutex);
+    return source && source->AudioEofHeldForTest();
+}
+
+bool Player::AudioEndedForTest() {
+    std::lock_guard lock(mutex);
+    return source && source->AudioEndedForTest();
+}
+
+int Player::QueuedAudioForTest() {
+    std::lock_guard lock(mutex);
+    return source ? source->QueuedAudioForTest() : 0;
+}
+
+bool Player::NextQueuedAudioTimestampForTest(std::uint64_t& timestamp) {
+    std::lock_guard lock(mutex);
+    return source && source->NextQueuedAudioTimestampForTest(timestamp);
+}
+
 }
diff --git a/core/libs/prx/libSceAvPlayer/src/Source.cpp b/core/libs/prx/libSceAvPlayer/src/Source.cpp
index 4d31c38f1d..452e4a88c8 100644
--- a/core/libs/prx/libSceAvPlayer/src/Source.cpp
+++ b/core/libs/prx/libSceAvPlayer/src/Source.cpp
@@ -151,6 +151,7 @@ public:
         base = milliseconds;
         wall = std::chrono::steady_clock::now();
         running = true;
+        if (overrideTime >= 0.0) overrideTime = milliseconds;
     }
 
     void Reset(double milliseconds) {
@@ -354,6 +355,9 @@ public:
             audioDriving = false;
             presented = false;
             lastPresented = 0;
+            audioHasTimestamp = false;
+            lastAudioTimestamp = 0.0;
+            reconciledAudioClock = false;
             presentationClock.Reset(static_cast<double>(start));
             for (auto* decoder : {&video, &audio}) {
                 decoder->switchTo = -1;
@@ -444,6 +448,34 @@ public:
         presentationClock.SetOverrideForTest(milliseconds);
     }
 
+    void SetHoldAudioEofForTest(bool hold) override {
+        std::lock_guard lock(mutex);
+        holdAudioEof = hold;
+        condition.notify_all();
+    }
+
+    bool AudioEofHeldForTest() override {
+        std::lock_guard lock(mutex);
+        return audioEofHeld;
+    }
+
+    bool AudioEndedForTest() override {
+        std::lock_guard lock(mutex);
+        return audio.stream >= 0 && audio.ended;
+    }
+
+    int QueuedAudioForTest() override {
+        std::lock_guard lock(mutex);
+        return static_cast<int>(audio.frames.size());
+    }
+
+    bool NextQueuedAudioTimestampForTest(std::uint64_t& timestamp) override {
+        std::lock_guard lock(mutex);
+        if (audio.frames.empty()) return false;
+        timestamp = audio.frames.front().info.timestamp;
+        return true;
+    }
+
     bool GetVideoData(AvPlayerFrameInfoEx& info) override {
         bool taken = false;
         {
@@ -475,6 +507,7 @@ public:
 
     std::uint64_t CurrentTime() override {
         std::lock_guard lock(mutex);
+        reconcileExhaustedAudioClock();
         return clockMillis();
     }
 
@@ -510,6 +543,34 @@ private:
         return duration != 0 ? std::min(milliseconds, duration) : milliseconds;
     }
 
+    bool audioExhausted() const {
+        return audioHasTimestamp && demuxEnded && !reposition && audio.ended && audio.packets.empty() && audio.frames.empty();
+    }
+
+    bool audioClockReconciled() const {
+        return reconciledAudioClock && reconciledAudioEpoch == clockEpoch;
+    }
+
+    void markAudioClockReconciled() {
+        reconciledAudioClock = true;
+        reconciledAudioEpoch = clockEpoch;
+    }
+
+    void reconcileExhaustedAudioClock() {
+        if (!audioDriving || !audioExhausted() || audioClockReconciled()) return;
+        presentationClock.Rebase(lastAudioTimestamp);
+        markAudioClockReconciled();
+    }
+
+    void waitBeforeAudioEof() {
+        std::unique_lock lock(mutex);
+        if (!holdAudioEof || stopping) return;
+        audioEofHeld = true;
+        condition.notify_all();
+        condition.wait(lock, [&] { return stopping || !holdAudioEof; });
+        audioEofHeld = false;
+    }
+
     bool takeVideo(AvPlayerFrameInfoEx& info) {
         if (!started || video.stream < 0 || speed < 0) return false;
         if (speed != NormalSpeed) dropLateAudio();
@@ -542,12 +603,23 @@ private:
         if (!started || paused || audio.stream < 0 || speed != NormalSpeed) return false;
         auto& frames = audio.frames;
         while (!frames.empty() && frames.front().epoch < minEpoch) recycleFront(audio);
-        if (frames.empty()) return false;
+        if (frames.empty()) {
+            reconcileExhaustedAudioClock();
+            return false;
+        }
         const auto epoch = frames.front().epoch;
         present(audio, info);
+        const auto currentClock = presentationClock.Now();
+        const auto timestamp = static_cast<double>(info.timestamp);
+        lastAudioTimestamp = timestamp;
+        audioHasTimestamp = true;
+        const bool drifted = currentClock > timestamp + 50.0 || timestamp > currentClock + 50.0;
+        const bool exhausted = audioExhausted() && !audioClockReconciled();
+        const bool shouldRebase = !audioDriving || epoch > clockEpoch || drifted || exhausted;
         audioDriving = true;
         clockEpoch = std::max(clockEpoch, epoch);
-        presentationClock.Rebase(static_cast<double>(info.timestamp));
+        if (shouldRebase) presentationClock.Rebase(timestamp);
+        if (exhausted) markAudioClockReconciled();
         return true;
     }
 
@@ -795,6 +867,7 @@ private:
                     pushAll(PacketKind::Flush, demuxEpoch, requested->target);
                     demuxEnded = false;
                     audioDriving = false;
+                    reconciledAudioClock = false;
                 }
                 condition.notify_all();
                 if (requested->announce) events.OnWarning(SCE_AVPLAYER_ERROR_WAR_JUMP_COMPLETE);
@@ -889,9 +962,11 @@ private:
                     receiveFrames(decoder, frame);
                     avcodec_flush_buffers(decoder.context);
                 }
+                if (item.kind == PacketKind::End && !decoder.video) waitBeforeAudioEof();
                 std::lock_guard lock(mutex);
                 if (item.kind == PacketKind::End) {
                     decoder.ended = true;
+                    if (!decoder.video) reconcileExhaustedAudioClock();
                 } else {
                     decoder.epoch = item.epoch;
                     decoder.skipBefore = 0;
@@ -1098,6 +1173,12 @@ private:
     std::uint64_t clockEpoch = 0;
     std::deque<std::uint64_t> loopEpochs;
     bool audioDriving = false;
+    bool audioHasTimestamp = false;
+    double lastAudioTimestamp = 0.0;
+    bool reconciledAudioClock = false;
+    std::uint64_t reconciledAudioEpoch = 0;
+    bool holdAudioEof = false;
+    bool audioEofHeld = false;
     bool presented = false;
     std::uint64_t lastPresented = 0;
     Clock presentationClock;
diff --git a/core/libs/prx/libSceAvPlayerStreaming/Export.cpp b/core/libs/prx/libSceAvPlayerStreaming/Export.cpp
index b484bc1af2..ba81d51df8 100644
--- a/core/libs/prx/libSceAvPlayerStreaming/Export.cpp
+++ b/core/libs/prx/libSceAvPlayerStreaming/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayerStreaming/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAvPlayerStreaming/include/Api.hpp b/core/libs/prx/libSceAvPlayerStreaming/include/Api.hpp
new file mode 100644
index 0000000000..0fcaf246ad
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayerStreaming/include/Api.hpp
@@ -0,0 +1,41 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI MvpHttpAbort_nid_postfix(void);
+int APS5_VABI MvpHttpDeInit_nid_postfix(void);
+int APS5_VABI MvpHttpGet_nid_postfix(void);
+int APS5_VABI MvpHttpGetLastError_nid_postfix(void);
+int APS5_VABI MvpHttpHead_nid_postfix(void);
+int APS5_VABI MvpHttpHeadCleanup_nid_postfix(void);
+int APS5_VABI MvpHttpInit_nid_postfix(void);
+int APS5_VABI MvpHttpPost_nid_postfix(void);
+int APS5_VABI MvpHttpSetCert_nid_postfix(void);
+int APS5_VABI MvpHttpSetRecvTimeout_nid_postfix(void);
+int APS5_VABI MvpHttpSetRedirectCb_nid_postfix(void);
+int APS5_VABI sceTsCloseFile(void);
+int APS5_VABI sceTsDisableRepresentation(void);
+int APS5_VABI sceTsEnableRepresentation(void);
+int APS5_VABI sceTsEnableStream(void);
+int APS5_VABI sceTsGetAvailableBW(void);
+int APS5_VABI sceTsGetLiveStatus(void);
+int APS5_VABI sceTsGetNextAuInfo(void);
+int APS5_VABI sceTsGetNextUnitData(void);
+int APS5_VABI sceTsGetRepresentationCount(void);
+int APS5_VABI sceTsGetRepresentationInfo(void);
+int APS5_VABI sceTsGetSeekWindow(void);
+int APS5_VABI sceTsGetStreamInfo(void);
+int APS5_VABI sceTsGetUrlEncryptionType(void);
+int APS5_VABI sceTsJumpPTS(void);
+int APS5_VABI sceTsOpenFile(void);
+int APS5_VABI sceTsOpenFileEx(void);
+int APS5_VABI sceTsReleaseBuffer(void);
+int APS5_VABI sceTsRepresentationIsEnabled(void);
+int APS5_VABI sceTsSetAvailableBW(void);
+int APS5_VABI sceTsSetStartingBW(void);
+int APS5_VABI sceTsStartFileStreaming(void);
+int APS5_VABI sceTsStopFileStreaming(void);
+
+}
diff --git a/core/libs/prx/libSceAvPlayerStreaming/libSceAvPlayerStreaming.hpp b/core/libs/prx/libSceAvPlayerStreaming/libSceAvPlayerStreaming.hpp
new file mode 100644
index 0000000000..b6ecf8bfa3
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayerStreaming/libSceAvPlayerStreaming.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvPlayerStreaming/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvSetting/Export.cpp b/core/libs/prx/libSceAvSetting/Export.cpp
index e53788bea3..1861a92646 100644
--- a/core/libs/prx/libSceAvSetting/Export.cpp
+++ b/core/libs/prx/libSceAvSetting/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvSetting/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAvSetting/include/Api.hpp b/core/libs/prx/libSceAvSetting/include/Api.hpp
new file mode 100644
index 0000000000..6ce470cc12
--- /dev/null
+++ b/core/libs/prx/libSceAvSetting/include/Api.hpp
@@ -0,0 +1,32 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAvControlGetPuTypeByMonitorInfo(void);
+int APS5_VABI sceAvControlIsVideoOutModeSupportedByMonitorInfoWithOptions(void);
+int APS5_VABI sceAvControlSetDitherModeForDiag(void);
+int APS5_VABI sceAvControlSetLayoutModeForDiag(void);
+int APS5_VABI sceAvControlSetMonitorFakeMode(void);
+int APS5_VABI sceAvControlGetCurrentOutputSysMode(void);
+int APS5_VABI sceAvControlGetNativeHdmiMonitorInfo(void);
+int APS5_VABI sceAvControlGetRawMonitorInfo(void);
+int APS5_VABI sceAvControlGetKsvList(void);
+int APS5_VABI sceAvControlGetRawEdid(void);
+int APS5_VABI sceAvControlRemoveProcessOutputMode(void);
+int APS5_VABI sceAvControlUpdateDriverStatus(void);
+int APS5_VABI sceAvControlNotifyUmdEvent(void);
+int APS5_VABI sceAvControlAddCallbacksForLnc(void);
+int APS5_VABI sceAvControlAddCallbacksForResourceArbitrator(void);
+int APS5_VABI sceAvControlRemoveCallbacks(void);
+int APS5_VABI sceAvControlCheckCallback(void);
+int APS5_VABI sceAvControlWaitCallback(void);
+int APS5_VABI sceAvControlSetColorMode(void);
+int APS5_VABI sceAvControlCheckMonitorInfoCapability(void);
+int APS5_VABI sceAvControlCheckVideoOutMode(void);
+int APS5_VABI sceAvControlSetCheckoutputMode(void);
+int APS5_VABI sceAvControlSetSystemVideoMode(void);
+int APS5_VABI sceAvControlDebugAddCallbacks(void);
+
+}
diff --git a/core/libs/prx/libSceAvSetting/libSceAvSetting.hpp b/core/libs/prx/libSceAvSetting/libSceAvSetting.hpp
new file mode 100644
index 0000000000..76b2b29473
--- /dev/null
+++ b/core/libs/prx/libSceAvSetting/libSceAvSetting.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvSetting/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvcap2/libSceAvcap2.hpp b/core/libs/prx/libSceAvcap2/libSceAvcap2.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAvcap2/libSceAvcap2.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAvcap2mvr/libSceAvcap2mvr.hpp b/core/libs/prx/libSceAvcap2mvr/libSceAvcap2mvr.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAvcap2mvr/libSceAvcap2mvr.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceBackupRestoreUtil/Export.cpp b/core/libs/prx/libSceBackupRestoreUtil/Export.cpp
index 77695475b9..a737e30ad8 100644
--- a/core/libs/prx/libSceBackupRestoreUtil/Export.cpp
+++ b/core/libs/prx/libSceBackupRestoreUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBackupRestoreUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceBackupRestoreUtil/include/Api.hpp b/core/libs/prx/libSceBackupRestoreUtil/include/Api.hpp
new file mode 100644
index 0000000000..7851d2c315
--- /dev/null
+++ b/core/libs/prx/libSceBackupRestoreUtil/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceBackupRestoreUtilBackupData();
+int APS5_VABI sceBackupRestoreUtilCancelBackupData();
+int APS5_VABI sceBackupRestoreUtilCancelGetRequiredSize();
+int APS5_VABI sceBackupRestoreUtilCancelGetTitles();
+int APS5_VABI sceBackupRestoreUtilCancelRestoreData();
+int APS5_VABI sceBackupRestoreUtilDeleteBackupData();
+int APS5_VABI sceBackupRestoreUtilGetBackupDataInfo();
+int APS5_VABI sceBackupRestoreUtilGetBackupParam();
+int APS5_VABI sceBackupRestoreUtilGetBackupProgress();
+int APS5_VABI sceBackupRestoreUtilGetRequiredSize();
+int APS5_VABI sceBackupRestoreUtilGetRestoreProgress();
+int APS5_VABI sceBackupRestoreUtilGetTitles();
+int APS5_VABI sceBackupRestoreUtilInitialize();
+int APS5_VABI sceBackupRestoreUtilPrepareBackup();
+int APS5_VABI sceBackupRestoreUtilRestoreData();
+int APS5_VABI sceBackupRestoreUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceBackupRestoreUtil/libSceBackupRestoreUtil.hpp b/core/libs/prx/libSceBackupRestoreUtil/libSceBackupRestoreUtil.hpp
new file mode 100644
index 0000000000..357f0a92c0
--- /dev/null
+++ b/core/libs/prx/libSceBackupRestoreUtil/libSceBackupRestoreUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBackupRestoreUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceBeisobmf/Export.cpp b/core/libs/prx/libSceBeisobmf/Export.cpp
index a2eee1a93d..31c0e4b2fe 100644
--- a/core/libs/prx/libSceBeisobmf/Export.cpp
+++ b/core/libs/prx/libSceBeisobmf/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBeisobmf/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceBeisobmf/include/Api.hpp b/core/libs/prx/libSceBeisobmf/include/Api.hpp
new file mode 100644
index 0000000000..60bc60a75e
--- /dev/null
+++ b/core/libs/prx/libSceBeisobmf/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI isobmf_box_getchildbox_nid_postfix(void);
+int APS5_VABI isobmf_box_getdiskoffset_nid_postfix(void);
+int APS5_VABI isobmf_box_getflags32b_nid_postfix(void);
+int APS5_VABI isobmf_box_getmember_length_nid_postfix(void);
+int APS5_VABI isobmf_box_getmember_ptr_nid_postfix(void);
+int APS5_VABI isobmf_box_getmember_type_nid_postfix(void);
+int APS5_VABI isobmf_box_getnextbox_nid_postfix(void);
+int APS5_VABI isobmf_box_getstate_nid_postfix(void);
+int APS5_VABI isobmf_box_gettype_nid_postfix(void);
+int APS5_VABI isobmf_decoder_clear_nid_postfix(void);
+int APS5_VABI isobmf_decoder_create_nid_postfix(void);
+int APS5_VABI isobmf_decoder_decode_nid_postfix(void);
+int APS5_VABI isobmf_decoder_destroy_nid_postfix(void);
+int APS5_VABI isobmf_decoder_get_decoder_tree_nid_postfix(void);
+int APS5_VABI isobmf_decoder_getquerydata_nid_postfix(void);
+int APS5_VABI isobmf_decoder_next_disk_offset_nid_postfix(void);
+int APS5_VABI isobmf_decoder_query_nid_postfix(void);
+int APS5_VABI isobmf_memmanager_set_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceBeisobmf/libSceBeisobmf.hpp b/core/libs/prx/libSceBeisobmf/libSceBeisobmf.hpp
new file mode 100644
index 0000000000..7b7de4f4a4
--- /dev/null
+++ b/core/libs/prx/libSceBeisobmf/libSceBeisobmf.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBeisobmf/include/Api.hpp"
diff --git a/core/libs/prx/libSceBemp2sys/Export.cpp b/core/libs/prx/libSceBemp2sys/Export.cpp
index 3bf12ad835..94f4dd4563 100644
--- a/core/libs/prx/libSceBemp2sys/Export.cpp
+++ b/core/libs/prx/libSceBemp2sys/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBemp2sys/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceBemp2sys/include/Api.hpp b/core/libs/prx/libSceBemp2sys/include/Api.hpp
new file mode 100644
index 0000000000..82e55243e5
--- /dev/null
+++ b/core/libs/prx/libSceBemp2sys/include/Api.hpp
@@ -0,0 +1,39 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI bemp2sys_logprintf_getlevel_nid_postfix(void);
+int APS5_VABI bemp2sys_logprintf_setfunc_nid_postfix(void);
+int APS5_VABI bemp2sys_logprintf_setlevel_nid_postfix(void);
+int APS5_VABI bemp2sys_memmanager_set_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_create_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_init_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_release_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_create_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_init_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_parse_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_release_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_sendmessage_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_create_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_init_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_readpacket_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_release_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_sendmessage_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_create_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_init_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_readpacket_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_release_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_sendmessage_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_create_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_init_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_release_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_sendmessage_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceBemp2sys/libSceBemp2sys.hpp b/core/libs/prx/libSceBemp2sys/libSceBemp2sys.hpp
new file mode 100644
index 0000000000..23c390341f
--- /dev/null
+++ b/core/libs/prx/libSceBemp2sys/libSceBemp2sys.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBemp2sys/include/Api.hpp"
diff --git a/core/libs/prx/libSceBgft/Export.cpp b/core/libs/prx/libSceBgft/Export.cpp
index 483969400b..c94cfeb6b8 100644
--- a/core/libs/prx/libSceBgft/Export.cpp
+++ b/core/libs/prx/libSceBgft/Export.cpp
@@ -1,33 +1,9 @@
+#include "prx/libSceBgft/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct BgftInitParam {
-    void* heap;
-    uint64_t heapSize;
-};
-
-struct BgftProgress;
-struct BgftStorageTaskParam {
-    std::uint32_t value0;
-    std::uint32_t value4;
-    const char* contentId;
-    const char* text16;
-    std::byte unused24[8];
-    const char* text32;
-    const char* text40;
-    const char* text48;
-    std::uint32_t value56;
-    std::byte padding60[4];
-    const char* text64;
-    const char* text72;
-    const char* text80;
-    const char* text88;
-    std::uint64_t value96;
-    std::uint32_t value104;
-};
-
 static_assert(sizeof(BgftStorageTaskParam) == 112);
 static_assert(offsetof(BgftStorageTaskParam, contentId) == 8);
 static_assert(offsetof(BgftStorageTaskParam, text32) == 32);
@@ -109,7 +85,7 @@ int APS5_VABI sceBgftServiceIntDownloadGetGameAndGameAcProgress(const char* cont
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceBgftServiceIntDownloadGetPatchProgress() {
+int APS5_VABI sceBgftServiceIntDownloadGetPatchProgress(const char* contentId, BgftProgress* progress) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -121,7 +97,7 @@ int APS5_VABI sceBgftServiceIntDownloadGetProgress(int32_t taskId, BgftProgress*
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceBgftServiceIntDownloadGetTaskInfo() {
+int APS5_VABI sceBgftServiceIntDownloadGetTaskInfo(int32_t taskId, BgftTaskInfo* taskInfo) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -373,4 +349,73 @@ int APS5_VABI sceBgftServiceIntUploadUnregisterTaskAll(void) {
     return 0;
 }
 
+int APS5_VABI sceBgftServiceIntDebugPlayGoClearSetFreeZone() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDebugPlayGoIsSetFreeZone() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadCheckPatchUpdateState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadClearStats() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadGetApplicationDataSize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadGetPatchGoProgress() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadHideTask() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadSetResumeState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadSetStartState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntPlayGoCheckDiscIniChunksInstall() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntPlayGoStartDataDiscInstall() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntSetTaskVisible() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadGetAvailableTaskCount() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadGetTaskInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadHideTask() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadSetStartState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadSetUploadError() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceBgft/include/Api.hpp b/core/libs/prx/libSceBgft/include/Api.hpp
new file mode 100644
index 0000000000..9e39227e29
--- /dev/null
+++ b/core/libs/prx/libSceBgft/include/Api.hpp
@@ -0,0 +1,125 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct BgftInitParam {
+    void* heap;
+    uint64_t heapSize;
+};
+
+struct BgftProgress;
+struct BgftTaskInfo;
+
+struct BgftStorageTaskParam {
+    std::uint32_t value0;
+    std::uint32_t value4;
+    const char* contentId;
+    const char* text16;
+    std::byte unused24[8];
+    const char* text32;
+    const char* text40;
+    const char* text48;
+    std::uint32_t value56;
+    std::byte padding60[4];
+    const char* text64;
+    const char* text72;
+    const char* text80;
+    const char* text88;
+    std::uint64_t value96;
+    std::uint32_t value104;
+};
+
+extern "C" {
+
+int APS5_VABI sceBgftServiceInit(const BgftInitParam* params);
+int APS5_VABI sceBgftServiceTerm(void);
+int APS5_VABI sceBgftServiceDownloadPauseTaskAll();
+int APS5_VABI sceBgftServiceDownloadResumeTaskAll();
+int APS5_VABI sceBgftServiceDownloadStartTaskAll();
+int APS5_VABI sceBgftServiceDownloadStopTaskAll();
+int APS5_VABI sceBgftServiceDownloadFindActivePatchTask(const char* contentId, int32_t* taskId);
+int APS5_VABI sceBgftServiceDownloadFindActivePupTask(int32_t* taskId);
+int APS5_VABI sceBgftServiceDownloadFindTaskByContentId(const char* contentId, int32_t subType, int32_t* taskId);
+int APS5_VABI sceBgftServiceDownloadGetProgress(int32_t taskId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceDownloadPauseTask(int32_t taskId);
+int APS5_VABI sceBgftServiceDownloadResumeTask(int32_t taskId);
+int APS5_VABI sceBgftServiceDownloadStartTask(int32_t taskId);
+int APS5_VABI sceBgftServiceDownloadStopTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadFindActiveGameAndGameAcTask(const char* contentId, int32_t* taskId);
+int APS5_VABI sceBgftServiceIntDownloadFindActiveTask(const char* contentId, int32_t subType, int32_t* taskId);
+int APS5_VABI sceBgftServiceIntDownloadGetGameAndGameAcProgress(const char* contentId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceIntDownloadGetPatchProgress(const char* contentId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceIntDownloadGetPlayGoProgress(const char* contentId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceIntDownloadGetProgress(int32_t taskId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceIntDownloadGetTaskInfo(int32_t taskId, BgftTaskInfo* taskInfo);
+int APS5_VABI sceBgftServiceIntDownloadPauseTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadRegisterTaskByStorageEx(const BgftStorageTaskParam* params, int32_t* taskId);
+int APS5_VABI sceBgftServiceIntDownloadResumeTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadStopTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadStartTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadUnregisterTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntInit(const BgftInitParam* params);
+int APS5_VABI sceBgftServiceDownloadQueryTask(void);
+int APS5_VABI sceBgftServiceIntDebugDownloadCorruptPkg(void);
+int APS5_VABI sceBgftServiceIntDebugDownloadRequest(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoGetPlayGoStatusString(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoIsPaused(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoResume(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoRevertToFullState(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoRevertToInitialState(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoRevertToSnapshot(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoSnapshotByTitleId(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoSuspend(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugDeleteBgftEnvFile(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugDownloadBgftEnvFile(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugGetBgftEnvInfoString(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugGetStat(void);
+int APS5_VABI sceBgftServiceIntDownloadGetExtUsbUserStorageSize(void);
+int APS5_VABI sceBgftServiceIntDownloadGetUserStorageSize(void);
+int APS5_VABI sceBgftServiceIntDownloadPauseTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadQueryTask(void);
+int APS5_VABI sceBgftServiceIntDownloadRegisterTaskByStorage(void);
+int APS5_VABI sceBgftServiceIntDownloadRestartTask(void);
+int APS5_VABI sceBgftServiceIntDownloadResumeTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadStartTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadStopTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadUnregisterTaskAll(void);
+int APS5_VABI sceBgftServiceIntExtUsbCheckActiveDownloadTasks(void);
+int APS5_VABI sceBgftServiceIntGetTaskInfoValueInt(void);
+int APS5_VABI sceBgftServiceIntGetTaskInfoValueString(void);
+int APS5_VABI sceBgftServiceIntGetTaskInfoValueStringIndex(void);
+int APS5_VABI sceBgftServiceIntPlayGoFindTaskId(void);
+int APS5_VABI sceBgftServiceIntPlayGoGetDiscIniChunksInstallProgress(void);
+int APS5_VABI sceBgftServiceIntPlayGoIsPaused(void);
+int APS5_VABI sceBgftServiceIntPlayGoResume(void);
+int APS5_VABI sceBgftServiceIntTerm(void);
+int APS5_VABI sceBgftServiceIntUploadGetProgress(void);
+int APS5_VABI sceBgftServiceIntUploadQueryTask(void);
+int APS5_VABI sceBgftServiceIntUploadRegisterTask(void);
+int APS5_VABI sceBgftServiceIntUploadRestartTask(void);
+int APS5_VABI sceBgftServiceIntUploadStartTask(void);
+int APS5_VABI sceBgftServiceIntUploadStartTaskAll(void);
+int APS5_VABI sceBgftServiceIntUploadStopTask(void);
+int APS5_VABI sceBgftServiceIntUploadStopTaskAll(void);
+int APS5_VABI sceBgftServiceIntUploadUnregisterTask(void);
+int APS5_VABI sceBgftServiceIntUploadUnregisterTaskAll(void);
+
+int APS5_VABI sceBgftServiceIntDebugPlayGoClearSetFreeZone();
+int APS5_VABI sceBgftServiceIntDebugPlayGoIsSetFreeZone();
+int APS5_VABI sceBgftServiceIntDownloadCheckPatchUpdateState();
+int APS5_VABI sceBgftServiceIntDownloadClearStats();
+int APS5_VABI sceBgftServiceIntDownloadGetApplicationDataSize();
+int APS5_VABI sceBgftServiceIntDownloadGetPatchGoProgress();
+int APS5_VABI sceBgftServiceIntDownloadHideTask();
+int APS5_VABI sceBgftServiceIntDownloadSetResumeState();
+int APS5_VABI sceBgftServiceIntDownloadSetStartState();
+int APS5_VABI sceBgftServiceIntPlayGoCheckDiscIniChunksInstall();
+int APS5_VABI sceBgftServiceIntPlayGoStartDataDiscInstall();
+int APS5_VABI sceBgftServiceIntSetTaskVisible();
+int APS5_VABI sceBgftServiceIntUploadGetAvailableTaskCount();
+int APS5_VABI sceBgftServiceIntUploadGetTaskInfo();
+int APS5_VABI sceBgftServiceIntUploadHideTask();
+int APS5_VABI sceBgftServiceIntUploadSetStartState();
+int APS5_VABI sceBgftServiceIntUploadSetUploadError();
+
+}
diff --git a/core/libs/prx/libSceBgft/libSceBgft.hpp b/core/libs/prx/libSceBgft/libSceBgft.hpp
new file mode 100644
index 0000000000..27e9095851
--- /dev/null
+++ b/core/libs/prx/libSceBgft/libSceBgft.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBgft/include/Api.hpp"
diff --git a/core/libs/prx/libSceBgsStorage/libSceBgsStorage.hpp b/core/libs/prx/libSceBgsStorage/libSceBgsStorage.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceBgsStorage/libSceBgsStorage.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceBluetoothHid/Export.cpp b/core/libs/prx/libSceBluetoothHid/Export.cpp
index 63c76ddd55..e1e00be946 100644
--- a/core/libs/prx/libSceBluetoothHid/Export.cpp
+++ b/core/libs/prx/libSceBluetoothHid/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBluetoothHid/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -6,36 +7,6 @@
 #include <string>
 #include <mutex>
 
-struct BluetoothHidThreadParam {
-    std::int32_t priority;
-    std::uint32_t padding;
-    std::uint64_t affinityMask;
-    std::uint32_t reserved;
-    std::uint32_t tailPadding;
-};
-
-struct BluetoothHidParam {
-    const BluetoothHidThreadParam* threadParam;
-    std::uint32_t reserved;
-    std::uint32_t padding;
-};
-
-struct BluetoothHidEvent {
-    std::uint64_t deviceHandle;
-    std::uint16_t vendorId;
-    std::uint16_t productId;
-    std::uint8_t type;
-    std::uint8_t status;
-    std::uint16_t reportSize;
-    std::uint8_t reserved[8];
-    std::uint8_t report[78];
-    std::uint8_t padding[2];
-};
-
-struct BluetoothHidDeviceInfo;
-struct BluetoothHidDeviceName;
-using BluetoothHidCallback = void (APS5_VABI *)(const BluetoothHidEvent*, std::int32_t, void*);
-
 static_assert(sizeof(BluetoothHidThreadParam) == 24);
 static_assert(offsetof(BluetoothHidThreadParam, affinityMask) == 8);
 static_assert(offsetof(BluetoothHidThreadParam, reserved) == 16);
diff --git a/core/libs/prx/libSceBluetoothHid/include/Api.hpp b/core/libs/prx/libSceBluetoothHid/include/Api.hpp
new file mode 100644
index 0000000000..ff0741f33f
--- /dev/null
+++ b/core/libs/prx/libSceBluetoothHid/include/Api.hpp
@@ -0,0 +1,61 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <string>
+
+struct BluetoothHidThreadParam {
+    std::int32_t priority;
+    std::uint32_t padding;
+    std::uint64_t affinityMask;
+    std::uint32_t reserved;
+    std::uint32_t tailPadding;
+};
+
+struct BluetoothHidParam {
+    const BluetoothHidThreadParam* threadParam;
+    std::uint32_t reserved;
+    std::uint32_t padding;
+};
+
+struct BluetoothHidEvent {
+    std::uint64_t deviceHandle;
+    std::uint16_t vendorId;
+    std::uint16_t productId;
+    std::uint8_t type;
+    std::uint8_t status;
+    std::uint16_t reportSize;
+    std::uint8_t reserved[8];
+    std::uint8_t report[78];
+    std::uint8_t padding[2];
+};
+
+struct BluetoothHidDeviceInfo;
+
+struct BluetoothHidDeviceName;
+
+using BluetoothHidCallback = void (APS5_VABI *)(const BluetoothHidEvent*, std::int32_t, void*);
+
+extern "C" {
+
+std::int32_t APS5_VABI sceBluetoothHidInit();
+std::int32_t APS5_VABI sceBluetoothHidRegisterCallback(BluetoothHidCallback callback, void* userData, const BluetoothHidParam* param);
+std::int32_t APS5_VABI sceBluetoothHidUnregisterCallback();
+std::int32_t APS5_VABI sceBluetoothHidRegisterDevice(std::uint16_t vendorId, std::uint16_t productId);
+std::int32_t APS5_VABI sceBluetoothHidUnregisterDevice(std::uint16_t vendorId, std::uint16_t productId);
+int APS5_VABI sceBluetoothHidGetDeviceName(std::uint64_t deviceHandle, BluetoothHidDeviceName* name);
+int APS5_VABI sceBluetoothHidGetInputReport(std::uint64_t deviceHandle, std::uint8_t reportId);
+int APS5_VABI sceBluetoothHidSetOutputReport(std::uint64_t deviceHandle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI sceBluetoothHidDebugGetVersion();
+int APS5_VABI sceBluetoothHidDisconnectDevice(std::int32_t deviceId);
+int APS5_VABI sceBluetoothHidGetDeviceInfo(std::int32_t deviceId, BluetoothHidDeviceInfo* info);
+int APS5_VABI sceBluetoothHidGetFeatureReport(std::uint64_t deviceHandle, std::uint8_t reportId);
+int APS5_VABI sceBluetoothHidGetReportDescriptor(std::uint64_t deviceHandle, void* descriptor, std::size_t size);
+int APS5_VABI sceBluetoothHidInterruptOutput(std::uint64_t deviceHandle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI sceBluetoothHidParamInitialize(BluetoothHidParam* param, const BluetoothHidThreadParam* threadParam);
+int APS5_VABI sceBluetoothHidSetFeatureReport(std::uint64_t deviceHandle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI sceBluetoothHidThreadParamInitialize(BluetoothHidThreadParam* param, std::int32_t priority, std::uint64_t affinityMask);
+
+}
diff --git a/core/libs/prx/libSceBluetoothHid/libSceBluetoothHid.hpp b/core/libs/prx/libSceBluetoothHid/libSceBluetoothHid.hpp
new file mode 100644
index 0000000000..ee177d4896
--- /dev/null
+++ b/core/libs/prx/libSceBluetoothHid/libSceBluetoothHid.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBluetoothHid/include/Api.hpp"
diff --git a/core/libs/prx/libSceCamera/Export.cpp b/core/libs/prx/libSceCamera/Export.cpp
index 26319c1e6c..c4fa002d9d 100644
--- a/core/libs/prx/libSceCamera/Export.cpp
+++ b/core/libs/prx/libSceCamera/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCamera/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -62,4 +63,533 @@ int APS5_VABI sceCameraIsValidFrameData(void) {
     return 0;
 }
 
+int APS5_VABI sceCameraStopByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceIDWithoutOpen(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetAttribute(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraInitializeRegistryCalibData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Finalize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetConnectedDeviceAndDriverMode(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2IsAttached(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetTrackerMode(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibDataForEve(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibDataFromDevice(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraIsConnectedForSystem(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetRegister(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetVideoSyncInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetConfigInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAttributeInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetMmapConnectedCount(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioOpen(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibDataFromDeviceForEve(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetVrCaptureInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetCalibDataForEve(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetAttribute(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetLensCorrection(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetCalibData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetProcessFocusByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Initialize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAccGetData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetAttribute(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibrationData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Stop(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioClose(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetProductInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetLensCorrection(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraChangeAppModuleState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetFrameData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraStartByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Open(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Start(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetLensCorrectionInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraOpenByModuleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetCalibrationData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioGetData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraWaitForEveReady(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetRegistryInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioGetData2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAppModuleFocus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetDefectivePixelCancellation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceID(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetForceActivate(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetFieldOfView(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2IsValidFrameData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetProcessFocus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceConfigWithoutHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraDeviceOpen(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetUacModeInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetRegister(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraRemoveAppModuleFocus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDefectivePixelCancellation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Close(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetVideoSync(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraWaitForLukeReady(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetDefectivePixelCancellationInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetDebugStop(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraIsConfigChangeDone(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetVideoSync(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioReset(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraCloseByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 }
diff --git a/core/libs/prx/libSceCamera/include/Api.hpp b/core/libs/prx/libSceCamera/include/Api.hpp
new file mode 100644
index 0000000000..169844eb58
--- /dev/null
+++ b/core/libs/prx/libSceCamera/include/Api.hpp
@@ -0,0 +1,125 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCameraIsAttached(int32_t index);
+int APS5_VABI sceCameraOpen(void);
+int APS5_VABI sceCameraClose(void);
+int APS5_VABI sceCameraStart(void);
+int APS5_VABI sceCameraStop(void);
+int APS5_VABI sceCameraGetConfig(void);
+int APS5_VABI sceCameraSetConfig(void);
+int APS5_VABI sceCameraSetAttribute(void);
+int APS5_VABI sceCameraGetDeviceInfo(void);
+int APS5_VABI sceCameraGetFrameData(void);
+int APS5_VABI sceCameraIsValidFrameData(void);
+int APS5_VABI sceCameraStopByHandle(void);
+int APS5_VABI sceCameraGetDeviceIDWithoutOpen(void);
+int APS5_VABI sceCameraGetAttribute(void);
+int APS5_VABI sceCameraInitializeRegistryCalibData(void);
+int APS5_VABI sceCamera2GetContrast(void);
+int APS5_VABI sceCamera2Finalize(void);
+int APS5_VABI sceCameraGetConnectedDeviceAndDriverMode(void);
+int APS5_VABI sceCamera2IsAttached(void);
+int APS5_VABI sceCamera2SetSharpness(void);
+int APS5_VABI sceCameraSetTrackerMode(void);
+int APS5_VABI sceCameraSetContrast(void);
+int APS5_VABI sceCameraGetCalibDataForEve(void);
+int APS5_VABI sceCameraGetCalibDataFromDevice(void);
+int APS5_VABI sceCamera2SetContrast(void);
+int APS5_VABI sceCameraIsConnectedForSystem(void);
+int APS5_VABI sceCamera2SetExposureGain(void);
+int APS5_VABI sceCameraSetRegister(void);
+int APS5_VABI sceCameraSetVideoSyncInternal(void);
+int APS5_VABI sceCameraSetConfigInternal(void);
+int APS5_VABI sceCameraSetAttributeInternal(void);
+int APS5_VABI sceCamera2SetWhiteBalance(void);
+int APS5_VABI sceCameraGetMmapConnectedCount(void);
+int APS5_VABI sceCamera2GetSaturation(void);
+int APS5_VABI sceCameraGetDeviceConfig(void);
+int APS5_VABI sceCameraAudioOpen(void);
+int APS5_VABI sceCamera2GetAutoExposureGain(void);
+int APS5_VABI sceCameraGetCalibDataFromDeviceForEve(void);
+int APS5_VABI sceCameraGetWhiteBalance(void);
+int APS5_VABI sceCameraGetVrCaptureInfo(void);
+int APS5_VABI sceCameraSetCalibDataForEve(void);
+int APS5_VABI sceCamera2GetAttribute(void);
+int APS5_VABI sceCameraSetLensCorrection(void);
+int APS5_VABI sceCameraSetCalibData(void);
+int APS5_VABI sceCameraSetProcessFocusByHandle(void);
+int APS5_VABI sceCamera2SetConfig(void);
+int APS5_VABI sceCameraGetExposureGain(void);
+int APS5_VABI sceCameraSetSharpness(void);
+int APS5_VABI sceCamera2Initialize(void);
+int APS5_VABI sceCameraSetHue(void);
+int APS5_VABI sceCameraAccGetData(void);
+int APS5_VABI sceCamera2SetAttribute(void);
+int APS5_VABI sceCameraGetCalibrationData(void);
+int APS5_VABI sceCameraGetSaturation(void);
+int APS5_VABI sceCamera2GetHue(void);
+int APS5_VABI sceCamera2Stop(void);
+int APS5_VABI sceCamera2SetSaturation(void);
+int APS5_VABI sceCamera2GetAutoWhiteBalance(void);
+int APS5_VABI sceCameraAudioClose(void);
+int APS5_VABI sceCameraGetProductInfo(void);
+int APS5_VABI sceCameraGetGamma(void);
+int APS5_VABI sceCameraGetLensCorrection(void);
+int APS5_VABI sceCameraChangeAppModuleState(void);
+int APS5_VABI sceCamera2GetFrameData(void);
+int APS5_VABI sceCameraGetContrast(void);
+int APS5_VABI sceCameraSetSaturation(void);
+int APS5_VABI sceCameraGetSharpness(void);
+int APS5_VABI sceCamera2GetExposureGain(void);
+int APS5_VABI sceCameraStartByHandle(void);
+int APS5_VABI sceCamera2Open(void);
+int APS5_VABI sceCamera2Start(void);
+int APS5_VABI sceCameraSetLensCorrectionInternal(void);
+int APS5_VABI sceCameraOpenByModuleId(void);
+int APS5_VABI sceCamera2GetCalibrationData(void);
+int APS5_VABI sceCameraAudioGetData(void);
+int APS5_VABI sceCamera2SetHue(void);
+int APS5_VABI sceCamera2GetGamma(void);
+int APS5_VABI sceCameraGetCalibData(void);
+int APS5_VABI sceCameraWaitForEveReady(void);
+int APS5_VABI sceCameraGetRegistryInfo(void);
+int APS5_VABI sceCameraAudioGetData2(void);
+int APS5_VABI sceCameraSetAppModuleFocus(void);
+int APS5_VABI sceCameraSetDefectivePixelCancellation(void);
+int APS5_VABI sceCameraGetDeviceID(void);
+int APS5_VABI sceCameraSetForceActivate(void);
+int APS5_VABI sceCameraSetWhiteBalance(void);
+int APS5_VABI sceCamera2GetFieldOfView(void);
+int APS5_VABI sceCamera2IsValidFrameData(void);
+int APS5_VABI sceCameraSetProcessFocus(void);
+int APS5_VABI sceCameraSetGamma(void);
+int APS5_VABI sceCamera2GetConfig(void);
+int APS5_VABI sceCamera2GetWhiteBalance(void);
+int APS5_VABI sceCameraGetDeviceConfigWithoutHandle(void);
+int APS5_VABI sceCameraDeviceOpen(void);
+int APS5_VABI sceCameraSetUacModeInternal(void);
+int APS5_VABI sceCameraGetAutoExposureGain(void);
+int APS5_VABI sceCameraGetRegister(void);
+int APS5_VABI sceCamera2SetGamma(void);
+int APS5_VABI sceCameraRemoveAppModuleFocus(void);
+int APS5_VABI sceCameraGetAutoWhiteBalance(void);
+int APS5_VABI sceCameraGetDefectivePixelCancellation(void);
+int APS5_VABI sceCamera2Close(void);
+int APS5_VABI sceCamera2SetVideoSync(void);
+int APS5_VABI sceCameraWaitForLukeReady(void);
+int APS5_VABI sceCameraSetDefectivePixelCancellationInternal(void);
+int APS5_VABI sceCamera2GetSharpness(void);
+int APS5_VABI sceCamera2SetAutoWhiteBalance(void);
+int APS5_VABI sceCameraSetDebugStop(void);
+int APS5_VABI sceCamera2SetAutoExposureGain(void);
+int APS5_VABI sceCameraIsConfigChangeDone(void);
+int APS5_VABI sceCameraSetExposureGain(void);
+int APS5_VABI sceCameraSetVideoSync(void);
+int APS5_VABI sceCameraAudioReset(void);
+int APS5_VABI sceCameraSetAutoExposureGain(void);
+int APS5_VABI sceCameraSetAutoWhiteBalance(void);
+int APS5_VABI sceCameraGetHue(void);
+int APS5_VABI sceCameraCloseByHandle(void);
+
+}
diff --git a/core/libs/prx/libSceCamera/libSceCamera.hpp b/core/libs/prx/libSceCamera/libSceCamera.hpp
new file mode 100644
index 0000000000..f11c2f4973
--- /dev/null
+++ b/core/libs/prx/libSceCamera/libSceCamera.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCamera/include/Api.hpp"
diff --git a/core/libs/prx/libSceCdlgG2P/Export.cpp b/core/libs/prx/libSceCdlgG2P/Export.cpp
index 43abff189e..a6f7113420 100644
--- a/core/libs/prx/libSceCdlgG2P/Export.cpp
+++ b/core/libs/prx/libSceCdlgG2P/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceCdlgG2P/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
@@ -7,8 +9,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libSceCdlgG2P/include/Api.hpp b/core/libs/prx/libSceCdlgG2P/include/Api.hpp
new file mode 100644
index 0000000000..5233fb9246
--- /dev/null
+++ b/core/libs/prx/libSceCdlgG2P/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceG2PDialogInitialize(void);
+int APS5_VABI sceG2PDialogOpen(const G2PDialogParam* param);
+int APS5_VABI sceG2PDialogUpdateStatus(void);
+int APS5_VABI sceG2PDialogGetStatus(void);
+int APS5_VABI sceG2PDialogGetResult(CommonDialogResultPrefix* result);
+int APS5_VABI sceG2PDialogClose(void);
+int APS5_VABI sceG2PDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceCdlgG2P/libSceCdlgG2P.hpp b/core/libs/prx/libSceCdlgG2P/libSceCdlgG2P.hpp
new file mode 100644
index 0000000000..b01cc903f1
--- /dev/null
+++ b/core/libs/prx/libSceCdlgG2P/libSceCdlgG2P.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCdlgG2P/include/Api.hpp"
diff --git a/core/libs/prx/libSceCdlgPlayerReview/Export.cpp b/core/libs/prx/libSceCdlgPlayerReview/Export.cpp
index 4db4e1760e..75e23b282e 100644
--- a/core/libs/prx/libSceCdlgPlayerReview/Export.cpp
+++ b/core/libs/prx/libSceCdlgPlayerReview/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceCdlgPlayerReview/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
@@ -5,8 +7,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 std::atomic<int> g_status{0};
 
diff --git a/core/libs/prx/libSceCdlgPlayerReview/include/Api.hpp b/core/libs/prx/libSceCdlgPlayerReview/include/Api.hpp
new file mode 100644
index 0000000000..5951bb3d08
--- /dev/null
+++ b/core/libs/prx/libSceCdlgPlayerReview/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayerReviewDialogInitialize(void);
+int APS5_VABI scePlayerReviewDialogTerminate(void);
+int APS5_VABI scePlayerReviewDialogOpen(const PlayerReviewDialogParam* param);
+int APS5_VABI scePlayerReviewDialogClose(void);
+int APS5_VABI scePlayerReviewDialogGetStatus(void);
+int APS5_VABI scePlayerReviewDialogUpdateStatus(void);
+int APS5_VABI scePlayerReviewDialogGetResult(CommonDialogResultPrefix* result);
+
+}
diff --git a/core/libs/prx/libSceCdlgPlayerReview/libSceCdlgPlayerReview.hpp b/core/libs/prx/libSceCdlgPlayerReview/libSceCdlgPlayerReview.hpp
new file mode 100644
index 0000000000..a7037746d2
--- /dev/null
+++ b/core/libs/prx/libSceCdlgPlayerReview/libSceCdlgPlayerReview.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCdlgPlayerReview/include/Api.hpp"
diff --git a/core/libs/prx/libSceCdlgUtilServer/libSceCdlgUtilServer.hpp b/core/libs/prx/libSceCdlgUtilServer/libSceCdlgUtilServer.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCdlgUtilServer/libSceCdlgUtilServer.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceCesCs-module/libSceCesCs-module.hpp b/core/libs/prx/libSceCesCs-module/libSceCesCs-module.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCesCs-module/libSceCesCs-module.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceCesCs/CMakeLists.txt b/core/libs/prx/libSceCesCs/CMakeLists.txt
index c59a762ef5..991387c540 100644
--- a/core/libs/prx/libSceCesCs/CMakeLists.txt
+++ b/core/libs/prx/libSceCesCs/CMakeLists.txt
@@ -38,6 +38,7 @@ if(BUILD_TESTING)
             add_test_executable(guest_ces_${variant}_tests ${LIBS_INCLUDE_DIR}/tests/GuestCesUnicode.cpp)
         endif()
         target_include_directories(guest_ces_${variant}_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        configure_windows_unwind(guest_ces_${variant}_tests)
         if(variant MATCHES "_module$")
             target_link_libraries(guest_ces_${variant}_tests PRIVATE libSceCesCs-module)
         else()
diff --git a/core/libs/prx/libSceCesCs/Cp949.hpp b/core/libs/prx/libSceCesCs/Cp949.hpp
index ec0166ce13..54c8333dd4 100644
--- a/core/libs/prx/libSceCesCs/Cp949.hpp
+++ b/core/libs/prx/libSceCesCs/Cp949.hpp
@@ -38,7 +38,7 @@ inline constexpr uint16_t TO_UCS2[126 * 190] = {
     0xC6A8, 0xC6AA, 0xC6AB, 0xC6AC, 0xC6AD, 0xC6AE, 0xC6AF, 0xC6B2, 0xC6B3, 0xC6B5, 0xC6B6, 0xC6B7, 0xC6BB, 0xC6BC, 0xC6BD, 0xC6BE, 0xC6BF, 0xC6C2, 0xC6C4, 0xC6C6, 0xC6C7, 0xC6C8, 0xC6C9, 0xC6CA, 0xC6CB, 0xC6CE, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC6CF, 0xC6D1, 0xC6D2, 0xC6D3, 0xC6D5, 0xC6D6, 0xC6D7, 0xC6D8, 0xC6D9, 0xC6DA, 0xC6DB, 0xC6DE, 0xC6DF, 0xC6E2, 0xC6E3, 0xC6E4, 0xC6E5, 0xC6E6, 0xC6E7, 0xC6EA, 0xC6EB, 0xC6ED, 0xC6EE, 0xC6EF, 0xC6F1, 0xC6F2, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC6F3, 0xC6F4, 0xC6F5, 0xC6F6, 0xC6F7, 0xC6FA, 0xC6FB, 0xC6FC, 0xC6FE, 0xC6FF, 0xC700, 0xC701, 0xC702, 0xC703, 0xC706, 0xC707, 0xC709, 0xC70A, 0xC70B, 0xC70D, 0xC70E, 0xC70F, 0xC710, 0xC711, 0xC712, 0xC713, 0xC716, 0xC718, 0xC71A, 0xC71B, 0xC71C, 0xC71D, 0xC71E, 0xC71F, 0xC722, 0xC723, 0xC725, 0xC726, 0xC727, 0xC729, 0xC72A, 0xC72B, 0xC72C, 0xC72D, 0xC72E, 0xC72F, 0xC732, 0xC734, 0xC736, 0xC738, 0xC739, 0xC73A, 0xC73B, 0xC73E, 0xC73F, 0xC741, 0xC742, 0xC743, 0xC745, 0xC746, 0xC747, 0xC748, 0xC749, 0xC74B, 0xC74E, 0xC750, 0xC759, 0xC75A, 0xC75B, 0xC75D, 0xC75E, 0xC75F, 0xC761, 0xC762, 0xC763, 0xC764, 0xC765, 0xC766, 0xC767, 0xC769, 0xC76A, 0xC76C, 0xC76D, 0xC76E, 0xC76F, 0xC770, 0xC771, 0xC772, 0xC773, 0xC776, 0xC777, 0xC779, 0xC77A, 0xC77B, 0xC77F, 0xC780, 0xC781, 0xC782, 0xC786, 0xC78B, 0xC78C, 0xC78D, 0xC78F, 0xC792, 0xC793, 0xC795, 0xC799, 0xC79B, 0xC79C, 0xC79D, 0xC79E, 0xC79F, 0xC7A2, 0xC7A7, 0xC7A8, 0xC7A9, 0xC7AA, 0xC7AB, 0xC7AE, 0xC7AF, 0xC7B1, 0xC7B2, 0xC7B3, 0xC7B5, 0xC7B6, 0xC7B7,
     0xC7B8, 0xC7B9, 0xC7BA, 0xC7BB, 0xC7BE, 0xC7C2, 0xC7C3, 0xC7C4, 0xC7C5, 0xC7C6, 0xC7C7, 0xC7CA, 0xC7CB, 0xC7CD, 0xC7CF, 0xC7D1, 0xC7D2, 0xC7D3, 0xC7D4, 0xC7D5, 0xC7D6, 0xC7D7, 0xC7D9, 0xC7DA, 0xC7DB, 0xC7DC, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC7DE, 0xC7DF, 0xC7E0, 0xC7E1, 0xC7E2, 0xC7E3, 0xC7E5, 0xC7E6, 0xC7E7, 0xC7E9, 0xC7EA, 0xC7EB, 0xC7ED, 0xC7EE, 0xC7EF, 0xC7F0, 0xC7F1, 0xC7F2, 0xC7F3, 0xC7F4, 0xC7F5, 0xC7F6, 0xC7F7, 0xC7F8, 0xC7F9, 0xC7FA, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC7FB, 0xC7FC, 0xC7FD, 0xC7FE, 0xC7FF, 0xC802, 0xC803, 0xC805, 0xC806, 0xC807, 0xC809, 0xC80B, 0xC80C, 0xC80D, 0xC80E, 0xC80F, 0xC812, 0xC814, 0xC817, 0xC818, 0xC819, 0xC81A, 0xC81B, 0xC81E, 0xC81F, 0xC821, 0xC822, 0xC823, 0xC825, 0xC826, 0xC827, 0xC828, 0xC829, 0xC82A, 0xC82B, 0xC82E, 0xC830, 0xC832, 0xC833, 0xC834, 0xC835, 0xC836, 0xC837, 0xC839, 0xC83A, 0xC83B, 0xC83D, 0xC83E, 0xC83F, 0xC841, 0xC842, 0xC843, 0xC844, 0xC845, 0xC846, 0xC847, 0xC84A, 0xC84B, 0xC84E, 0xC84F, 0xC850, 0xC851, 0xC852, 0xC853, 0xC855, 0xC856, 0xC857, 0xC858, 0xC859, 0xC85A, 0xC85B, 0xC85C, 0xC85D, 0xC85E, 0xC85F, 0xC860, 0xC861, 0xC862, 0xC863, 0xC864, 0xC865, 0xC866, 0xC867, 0xC868, 0xC869, 0xC86A, 0xC86B, 0xC86C, 0xC86D, 0xC86E, 0xC86F, 0xC872, 0xC873, 0xC875, 0xC876, 0xC877, 0xC879, 0xC87B, 0xC87C, 0xC87D, 0xC87E, 0xC87F, 0xC882, 0xC884, 0xC888, 0xC889, 0xC88A, 0xC88E, 0xC88F, 0xC890, 0xC891, 0xC892, 0xC893, 0xC895, 0xC896, 0xC897, 0xC898, 0xC899, 0xC89A, 0xC89B, 0xC89C, 0xC89E, 0xC8A0, 0xC8A2, 0xC8A3, 0xC8A4,
     0xC8A5, 0xC8A6, 0xC8A7, 0xC8A9, 0xC8AA, 0xC8AB, 0xC8AC, 0xC8AD, 0xC8AE, 0xC8AF, 0xC8B0, 0xC8B1, 0xC8B2, 0xC8B3, 0xC8B4, 0xC8B5, 0xC8B6, 0xC8B7, 0xC8B8, 0xC8B9, 0xC8BA, 0xC8BB, 0xC8BE, 0xC8BF, 0xC8C0, 0xC8C1, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC8C2, 0xC8C3, 0xC8C5, 0xC8C6, 0xC8C7, 0xC8C9, 0xC8CA, 0xC8CB, 0xC8CD, 0xC8CE, 0xC8CF, 0xC8D0, 0xC8D1, 0xC8D2, 0xC8D3, 0xC8D6, 0xC8D8, 0xC8DA, 0xC8DB, 0xC8DC, 0xC8DD, 0xC8DE, 0xC8DF, 0xC8E2, 0xC8E3, 0xC8E5, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC8E6, 0xC8E7, 0xC8E8, 0xC8E9, 0xC8EA, 0xC8EB, 0xC8EC, 0xC8ED, 0xC8EE, 0xC8EF, 0xC8F0, 0xC8F1, 0xC8F2, 0xC8F3, 0xC8F4, 0xC8F6, 0xC8F7, 0xC8F8, 0xC8F9, 0xC8FA, 0xC8FB, 0xC8FE, 0xC8FF, 0xC901, 0xC902, 0xC903, 0xC907, 0xC908, 0xC909, 0xC90A, 0xC90B, 0xC90E, 0x3000, 0x3001, 0x3002, 0x00B7, 0x2025, 0x2026, 0x00A8, 0x3003, 0x00AD, 0x2015, 0x2225, 0xFF3C, 0x223C, 0x2018, 0x2019, 0x201C, 0x201D, 0x3014, 0x3015, 0x3008, 0x3009, 0x300A, 0x300B, 0x300C, 0x300D, 0x300E, 0x300F, 0x3010, 0x3011, 0x00B1, 0x00D7, 0x00F7, 0x2260, 0x2264, 0x2265, 0x221E, 0x2234, 0x00B0, 0x2032, 0x2033, 0x2103, 0x212B, 0xFFE0, 0xFFE1, 0xFFE5, 0x2642, 0x2640, 0x2220, 0x22A5, 0x2312, 0x2202, 0x2207, 0x2261, 0x2252, 0x00A7, 0x203B, 0x2606, 0x2605, 0x25CB, 0x25CF, 0x25CE, 0x25C7, 0x25C6, 0x25A1, 0x25A0, 0x25B3, 0x25B2, 0x25BD, 0x25BC, 0x2192, 0x2190, 0x2191, 0x2193, 0x2194, 0x3013, 0x226A, 0x226B, 0x221A, 0x223D, 0x221D, 0x2235, 0x222B, 0x222C, 0x2208, 0x220B, 0x2286, 0x2287, 0x2282, 0x2283, 0x222A, 0x2229, 0x2227, 0x2228, 0xFFE2,
-    0xC910, 0xC912, 0xC913, 0xC914, 0xC915, 0xC916, 0xC917, 0xC919, 0xC91A, 0xC91B, 0xC91C, 0xC91D, 0xC91E, 0xC91F, 0xC920, 0xC921, 0xC922, 0xC923, 0xC924, 0xC925, 0xC926, 0xC927, 0xC928, 0xC929, 0xC92A, 0xC92B, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC92D, 0xC92E, 0xC92F, 0xC930, 0xC931, 0xC932, 0xC933, 0xC935, 0xC936, 0xC937, 0xC938, 0xC939, 0xC93A, 0xC93B, 0xC93C, 0xC93D, 0xC93E, 0xC93F, 0xC940, 0xC941, 0xC942, 0xC943, 0xC944, 0xC945, 0xC946, 0xC947, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC948, 0xC949, 0xC94A, 0xC94B, 0xC94C, 0xC94D, 0xC94E, 0xC94F, 0xC952, 0xC953, 0xC955, 0xC956, 0xC957, 0xC959, 0xC95A, 0xC95B, 0xC95C, 0xC95D, 0xC95E, 0xC95F, 0xC962, 0xC964, 0xC965, 0xC966, 0xC967, 0xC968, 0xC969, 0xC96A, 0xC96B, 0xC96D, 0xC96E, 0xC96F, 0x21D2, 0x21D4, 0x2200, 0x2203, 0x00B4, 0xFF5E, 0x02C7, 0x02D8, 0x02DD, 0x02DA, 0x02D9, 0x00B8, 0x02DB, 0x00A1, 0x00BF, 0x02D0, 0x222E, 0x2211, 0x220F, 0x00A4, 0x2109, 0x2030, 0x25C1, 0x25C0, 0x25B7, 0x25B6, 0x2664, 0x2660, 0x2661, 0x2665, 0x2667, 0x2663, 0x2299, 0x25C8, 0x25A3, 0x25D0, 0x25D1, 0x2592, 0x25A4, 0x25A5, 0x25A8, 0x25A7, 0x25A6, 0x25A9, 0x2668, 0x260F, 0x260E, 0x261C, 0x261E, 0x00B6, 0x2020, 0x2021, 0x2195, 0x2197, 0x2199, 0x2196, 0x2198, 0x266D, 0x2669, 0x266A, 0x266C, 0x327F, 0x321C, 0x2116, 0x33C7, 0x2122, 0x33C2, 0x33D8, 0x2121, 0x20AC, 0x00AE, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0xC910, 0xC912, 0xC913, 0xC914, 0xC915, 0xC916, 0xC917, 0xC919, 0xC91A, 0xC91B, 0xC91C, 0xC91D, 0xC91E, 0xC91F, 0xC920, 0xC921, 0xC922, 0xC923, 0xC924, 0xC925, 0xC926, 0xC927, 0xC928, 0xC929, 0xC92A, 0xC92B, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC92D, 0xC92E, 0xC92F, 0xC930, 0xC931, 0xC932, 0xC933, 0xC935, 0xC936, 0xC937, 0xC938, 0xC939, 0xC93A, 0xC93B, 0xC93C, 0xC93D, 0xC93E, 0xC93F, 0xC940, 0xC941, 0xC942, 0xC943, 0xC944, 0xC945, 0xC946, 0xC947, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC948, 0xC949, 0xC94A, 0xC94B, 0xC94C, 0xC94D, 0xC94E, 0xC94F, 0xC952, 0xC953, 0xC955, 0xC956, 0xC957, 0xC959, 0xC95A, 0xC95B, 0xC95C, 0xC95D, 0xC95E, 0xC95F, 0xC962, 0xC964, 0xC965, 0xC966, 0xC967, 0xC968, 0xC969, 0xC96A, 0xC96B, 0xC96D, 0xC96E, 0xC96F, 0x21D2, 0x21D4, 0x2200, 0x2203, 0x00B4, 0xFF5E, 0x02C7, 0x02D8, 0x02DD, 0x02DA, 0x02D9, 0x00B8, 0x02DB, 0x00A1, 0x00BF, 0x02D0, 0x222E, 0x2211, 0x220F, 0x00A4, 0x2109, 0x2030, 0x25C1, 0x25C0, 0x25B7, 0x25B6, 0x2664, 0x2660, 0x2661, 0x2665, 0x2667, 0x2663, 0x2299, 0x25C8, 0x25A3, 0x25D0, 0x25D1, 0x2592, 0x25A4, 0x25A5, 0x25A8, 0x25A7, 0x25A6, 0x25A9, 0x2668, 0x260F, 0x260E, 0x261C, 0x261E, 0x00B6, 0x2020, 0x2021, 0x2195, 0x2197, 0x2199, 0x2196, 0x2198, 0x266D, 0x2669, 0x266A, 0x266C, 0x327F, 0x321C, 0x2116, 0x33C7, 0x2122, 0x33C2, 0x33D8, 0x2121, 0x20AC, 0x00AE, 0x327E, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
     0xC971, 0xC972, 0xC973, 0xC975, 0xC976, 0xC977, 0xC978, 0xC979, 0xC97A, 0xC97B, 0xC97D, 0xC97E, 0xC97F, 0xC980, 0xC981, 0xC982, 0xC983, 0xC984, 0xC985, 0xC986, 0xC987, 0xC98A, 0xC98B, 0xC98D, 0xC98E, 0xC98F, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC991, 0xC992, 0xC993, 0xC994, 0xC995, 0xC996, 0xC997, 0xC99A, 0xC99C, 0xC99E, 0xC99F, 0xC9A0, 0xC9A1, 0xC9A2, 0xC9A3, 0xC9A4, 0xC9A5, 0xC9A6, 0xC9A7, 0xC9A8, 0xC9A9, 0xC9AA, 0xC9AB, 0xC9AC, 0xC9AD, 0xC9AE, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xC9AF, 0xC9B0, 0xC9B1, 0xC9B2, 0xC9B3, 0xC9B4, 0xC9B5, 0xC9B6, 0xC9B7, 0xC9B8, 0xC9B9, 0xC9BA, 0xC9BB, 0xC9BC, 0xC9BD, 0xC9BE, 0xC9BF, 0xC9C2, 0xC9C3, 0xC9C5, 0xC9C6, 0xC9C9, 0xC9CB, 0xC9CC, 0xC9CD, 0xC9CE, 0xC9CF, 0xC9D2, 0xC9D4, 0xC9D7, 0xC9D8, 0xC9DB, 0xFF01, 0xFF02, 0xFF03, 0xFF04, 0xFF05, 0xFF06, 0xFF07, 0xFF08, 0xFF09, 0xFF0A, 0xFF0B, 0xFF0C, 0xFF0D, 0xFF0E, 0xFF0F, 0xFF10, 0xFF11, 0xFF12, 0xFF13, 0xFF14, 0xFF15, 0xFF16, 0xFF17, 0xFF18, 0xFF19, 0xFF1A, 0xFF1B, 0xFF1C, 0xFF1D, 0xFF1E, 0xFF1F, 0xFF20, 0xFF21, 0xFF22, 0xFF23, 0xFF24, 0xFF25, 0xFF26, 0xFF27, 0xFF28, 0xFF29, 0xFF2A, 0xFF2B, 0xFF2C, 0xFF2D, 0xFF2E, 0xFF2F, 0xFF30, 0xFF31, 0xFF32, 0xFF33, 0xFF34, 0xFF35, 0xFF36, 0xFF37, 0xFF38, 0xFF39, 0xFF3A, 0xFF3B, 0xFFE6, 0xFF3D, 0xFF3E, 0xFF3F, 0xFF40, 0xFF41, 0xFF42, 0xFF43, 0xFF44, 0xFF45, 0xFF46, 0xFF47, 0xFF48, 0xFF49, 0xFF4A, 0xFF4B, 0xFF4C, 0xFF4D, 0xFF4E, 0xFF4F, 0xFF50, 0xFF51, 0xFF52, 0xFF53, 0xFF54, 0xFF55, 0xFF56, 0xFF57, 0xFF58, 0xFF59, 0xFF5A, 0xFF5B, 0xFF5C, 0xFF5D, 0xFFE3,
     0xC9DE, 0xC9DF, 0xC9E1, 0xC9E3, 0xC9E5, 0xC9E6, 0xC9E8, 0xC9E9, 0xC9EA, 0xC9EB, 0xC9EE, 0xC9F2, 0xC9F3, 0xC9F4, 0xC9F5, 0xC9F6, 0xC9F7, 0xC9FA, 0xC9FB, 0xC9FD, 0xC9FE, 0xC9FF, 0xCA01, 0xCA02, 0xCA03, 0xCA04, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xCA05, 0xCA06, 0xCA07, 0xCA0A, 0xCA0E, 0xCA0F, 0xCA10, 0xCA11, 0xCA12, 0xCA13, 0xCA15, 0xCA16, 0xCA17, 0xCA19, 0xCA1A, 0xCA1B, 0xCA1C, 0xCA1D, 0xCA1E, 0xCA1F, 0xCA20, 0xCA21, 0xCA22, 0xCA23, 0xCA24, 0xCA25, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xCA26, 0xCA27, 0xCA28, 0xCA2A, 0xCA2B, 0xCA2C, 0xCA2D, 0xCA2E, 0xCA2F, 0xCA30, 0xCA31, 0xCA32, 0xCA33, 0xCA34, 0xCA35, 0xCA36, 0xCA37, 0xCA38, 0xCA39, 0xCA3A, 0xCA3B, 0xCA3C, 0xCA3D, 0xCA3E, 0xCA3F, 0xCA40, 0xCA41, 0xCA42, 0xCA43, 0xCA44, 0xCA45, 0xCA46, 0x3131, 0x3132, 0x3133, 0x3134, 0x3135, 0x3136, 0x3137, 0x3138, 0x3139, 0x313A, 0x313B, 0x313C, 0x313D, 0x313E, 0x313F, 0x3140, 0x3141, 0x3142, 0x3143, 0x3144, 0x3145, 0x3146, 0x3147, 0x3148, 0x3149, 0x314A, 0x314B, 0x314C, 0x314D, 0x314E, 0x314F, 0x3150, 0x3151, 0x3152, 0x3153, 0x3154, 0x3155, 0x3156, 0x3157, 0x3158, 0x3159, 0x315A, 0x315B, 0x315C, 0x315D, 0x315E, 0x315F, 0x3160, 0x3161, 0x3162, 0x3163, 0x3164, 0x3165, 0x3166, 0x3167, 0x3168, 0x3169, 0x316A, 0x316B, 0x316C, 0x316D, 0x316E, 0x316F, 0x3170, 0x3171, 0x3172, 0x3173, 0x3174, 0x3175, 0x3176, 0x3177, 0x3178, 0x3179, 0x317A, 0x317B, 0x317C, 0x317D, 0x317E, 0x317F, 0x3180, 0x3181, 0x3182, 0x3183, 0x3184, 0x3185, 0x3186, 0x3187, 0x3188, 0x3189, 0x318A, 0x318B, 0x318C, 0x318D, 0x318E,
     0xCA47, 0xCA48, 0xCA49, 0xCA4A, 0xCA4B, 0xCA4E, 0xCA4F, 0xCA51, 0xCA52, 0xCA53, 0xCA55, 0xCA56, 0xCA57, 0xCA58, 0xCA59, 0xCA5A, 0xCA5B, 0xCA5E, 0xCA62, 0xCA63, 0xCA64, 0xCA65, 0xCA66, 0xCA67, 0xCA69, 0xCA6A, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xCA6B, 0xCA6C, 0xCA6D, 0xCA6E, 0xCA6F, 0xCA70, 0xCA71, 0xCA72, 0xCA73, 0xCA74, 0xCA75, 0xCA76, 0xCA77, 0xCA78, 0xCA79, 0xCA7A, 0xCA7B, 0xCA7C, 0xCA7E, 0xCA7F, 0xCA80, 0xCA81, 0xCA82, 0xCA83, 0xCA85, 0xCA86, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xCA87, 0xCA88, 0xCA89, 0xCA8A, 0xCA8B, 0xCA8C, 0xCA8D, 0xCA8E, 0xCA8F, 0xCA90, 0xCA91, 0xCA92, 0xCA93, 0xCA94, 0xCA95, 0xCA96, 0xCA97, 0xCA99, 0xCA9A, 0xCA9B, 0xCA9C, 0xCA9D, 0xCA9E, 0xCA9F, 0xCAA0, 0xCAA1, 0xCAA2, 0xCAA3, 0xCAA4, 0xCAA5, 0xCAA6, 0xCAA7, 0x2170, 0x2171, 0x2172, 0x2173, 0x2174, 0x2175, 0x2176, 0x2177, 0x2178, 0x2179, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x2160, 0x2161, 0x2162, 0x2163, 0x2164, 0x2165, 0x2166, 0x2167, 0x2168, 0x2169, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0391, 0x0392, 0x0393, 0x0394, 0x0395, 0x0396, 0x0397, 0x0398, 0x0399, 0x039A, 0x039B, 0x039C, 0x039D, 0x039E, 0x039F, 0x03A0, 0x03A1, 0x03A3, 0x03A4, 0x03A5, 0x03A6, 0x03A7, 0x03A8, 0x03A9, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x03B1, 0x03B2, 0x03B3, 0x03B4, 0x03B5, 0x03B6, 0x03B7, 0x03B8, 0x03B9, 0x03BA, 0x03BB, 0x03BC, 0x03BD, 0x03BE, 0x03BF, 0x03C0, 0x03C1, 0x03C3, 0x03C4, 0x03C5, 0x03C6, 0x03C7, 0x03C8, 0x03C9, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
diff --git a/core/libs/prx/libSceCesCs/Export.cpp b/core/libs/prx/libSceCesCs/Export.cpp
index 37af4de435..e396f4a21d 100644
--- a/core/libs/prx/libSceCesCs/Export.cpp
+++ b/core/libs/prx/libSceCesCs/Export.cpp
@@ -1,9 +1,12 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <algorithm>
 #include <bit>
 #include <cstring>
 #include <iterator>
+#include <span>
+#include <stdexcept>
 #include <utility>
 #include <vector>
 #include "SceTypes.hpp"
@@ -11,6 +14,7 @@
 #include "JisX0208.hpp"
 #include "JisX0212.hpp"
 #include "Cp936.hpp"
+#include "Gb18030.hpp"
 #include "Cp949.hpp"
 #include "Cp950.hpp"
 #include "SingleByte.hpp"
@@ -18,10 +22,13 @@
 namespace {
 
 constexpr int CES_ERROR_INVALID_PARAMETER = static_cast<int>(0x805C0001);
+constexpr int CES_ERROR_INVALID_PROFILE = static_cast<int>(0x805C0004);
 constexpr int CES_ERROR_INVALID_SRC_BUFFER = static_cast<int>(0x805C0010);
 constexpr int CES_ERROR_SRC_BUFFER_END = static_cast<int>(0x805C0011);
 constexpr int CES_ERROR_INVALID_ENCODE = static_cast<int>(0x805C0014);
+constexpr int CES_ERROR_ILLEGAL_CODE = static_cast<int>(0x805C0015);
 constexpr int CES_ERROR_UNASSIGNED_CODE = static_cast<int>(0x805C0020);
+constexpr int CES_ERROR_UNSUPPORTED_CODE = static_cast<int>(0x805C0024);
 constexpr int CES_ERROR_INVALID_DST_BUFFER = static_cast<int>(0x805C0030);
 constexpr int CES_ERROR_DST_BUFFER_END = static_cast<int>(0x805C0031);
 
@@ -31,13 +38,13 @@ constexpr const uint8_t* CP1251_PROFILE = PROFILES[1];
 constexpr const uint8_t* CP1250_PROFILE = PROFILES[2];
 
 constexpr uint16_t CP1252_HIGH[32] = {
-    0x20AC, 0x0081, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, 0x02C6, 0x2030, 0x0160, 0x2039, 0x0152, 0x008D, 0x017D, 0x008F,
-    0x0090, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x02DC, 0x2122, 0x0161, 0x203A, 0x0153, 0x009D, 0x017E, 0x0178,
+    0x20AC, 0x0000, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, 0x02C6, 0x2030, 0x0160, 0x2039, 0x0152, 0x0000, 0x017D, 0x0000,
+    0x0000, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x02DC, 0x2122, 0x0161, 0x203A, 0x0153, 0x0000, 0x017E, 0x0178,
 };
 
 constexpr uint16_t CP1251_HIGH[128] = {
     0x0402, 0x0403, 0x201A, 0x0453, 0x201E, 0x2026, 0x2020, 0x2021, 0x20AC, 0x2030, 0x0409, 0x2039, 0x040A, 0x040C, 0x040B, 0x040F,
-    0x0452, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x0098, 0x2122, 0x0459, 0x203A, 0x045A, 0x045C, 0x045B, 0x045F,
+    0x0452, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x0000, 0x2122, 0x0459, 0x203A, 0x045A, 0x045C, 0x045B, 0x045F,
     0x00A0, 0x040E, 0x045E, 0x0408, 0x00A4, 0x0490, 0x00A6, 0x00A7, 0x0401, 0x00A9, 0x0404, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x0407,
     0x00B0, 0x00B1, 0x0406, 0x0456, 0x0491, 0x00B5, 0x00B6, 0x00B7, 0x0451, 0x2116, 0x0454, 0x00BB, 0x0458, 0x0405, 0x0455, 0x0457,
     0x0410, 0x0411, 0x0412, 0x0413, 0x0414, 0x0415, 0x0416, 0x0417, 0x0418, 0x0419, 0x041A, 0x041B, 0x041C, 0x041D, 0x041E, 0x041F,
@@ -47,8 +54,8 @@ constexpr uint16_t CP1251_HIGH[128] = {
 };
 
 constexpr uint16_t CP1250_HIGH[128] = {
-    0x20AC, 0x0081, 0x201A, 0x0083, 0x201E, 0x2026, 0x2020, 0x2021, 0x0088, 0x2030, 0x0160, 0x2039, 0x015A, 0x0164, 0x017D, 0x0179,
-    0x0090, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x0098, 0x2122, 0x0161, 0x203A, 0x015B, 0x0165, 0x017E, 0x017A,
+    0x20AC, 0x0000, 0x201A, 0x0000, 0x201E, 0x2026, 0x2020, 0x2021, 0x0000, 0x2030, 0x0160, 0x2039, 0x015A, 0x0164, 0x017D, 0x0179,
+    0x0000, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x0000, 0x2122, 0x0161, 0x203A, 0x015B, 0x0165, 0x017E, 0x017A,
     0x00A0, 0x02C7, 0x02D8, 0x0141, 0x00A4, 0x0104, 0x00A6, 0x00A7, 0x00A8, 0x00A9, 0x015E, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x017B,
     0x00B0, 0x00B1, 0x02DB, 0x0142, 0x00B4, 0x00B5, 0x00B6, 0x00B7, 0x00B8, 0x0105, 0x015F, 0x00BB, 0x013D, 0x02DD, 0x013E, 0x017C,
     0x0154, 0x00C1, 0x00C2, 0x0102, 0x00C4, 0x0139, 0x0106, 0x00C7, 0x010C, 0x00C9, 0x0118, 0x00CB, 0x011A, 0x00CD, 0x00CE, 0x010E,
@@ -76,9 +83,12 @@ const uint16_t* sbcHighTable(const void* profile) {
     return nullptr;
 }
 
-uint32_t sbcToUnicode(const uint8_t* profile, uint8_t sbc) {
-    if (const uint16_t* high = sbcHighTable(profile)) return sbc >= 0x80 ? high[sbc - 0x80] : sbc;
-    return sbc >= 0x80 && sbc < 0xA0 ? CP1252_HIGH[sbc - 0x80] : sbc;
+bool sbcToUnicode(const uint8_t* profile, uint8_t sbc, uint32_t& code) {
+    code = sbc;
+    if (sbc < 0x80) return true;
+    if (const uint16_t* high = sbcHighTable(profile)) code = high[sbc - 0x80];
+    else if (sbc < 0xA0) code = CP1252_HIGH[sbc - 0x80];
+    return code != 0;
 }
 
 bool unicodeToSbc(const uint8_t* profile, uint32_t code, uint8_t& sbc) {
@@ -108,25 +118,32 @@ bool unicodeToSbc(const uint8_t* profile, uint32_t code, uint8_t& sbc) {
     return false;
 }
 
-int decodeUtf8(const uint8_t* utf8, uint32_t utf8max, uint32_t& length, uint32_t& code) {
+int decodeScalarUtf8(const uint8_t* utf8, uint32_t utf8max, uint32_t& length, uint32_t& code) {
     const uint8_t lead = utf8[0];
+    length = 0;
     uint32_t minimum = 0;
     if (lead < 0x80) {
         length = 1;
         code = lead;
         return 0;
     }
-    if ((lead & 0xE0) == 0xC0) { length = 2; code = lead & 0x1F; minimum = 0x80; }
-    else if ((lead & 0xF0) == 0xE0) { length = 3; code = lead & 0x0F; minimum = 0x800; }
-    else if ((lead & 0xF8) == 0xF0) { length = 4; code = lead & 0x07; minimum = 0x10000; }
-    else return CES_ERROR_INVALID_ENCODE;
-
-    for (uint32_t i = 1; i < length; ++i) {
-        if (i >= utf8max) return CES_ERROR_SRC_BUFFER_END;
-        if ((utf8[i] & 0xC0) != 0x80) return CES_ERROR_INVALID_ENCODE;
+    if (lead < 0xC0 || lead >= 0xFE) return CES_ERROR_INVALID_ENCODE;
+    if (lead < 0xE0) { length = 2; code = lead & 0x1F; minimum = 0x80; }
+    else if (lead < 0xF0) { length = 3; code = lead & 0x0F; minimum = 0x800; }
+    else if (lead < 0xF8) { length = 4; code = lead & 0x07; minimum = 0x10000; }
+    else if (lead < 0xFC) { length = 5; code = lead & 0x03; minimum = 0x200000; }
+    else { length = 6; code = lead & 0x01; minimum = 0x4000000; }
+    const bool truncated = utf8max < length;
+    const uint32_t present = truncated ? utf8max : length;
+    for (uint32_t i = 1; i < present; ++i) {
+        if ((utf8[i] & 0xC0) != 0x80) {
+            length = truncated ? i + 1 : i;
+            return CES_ERROR_INVALID_ENCODE;
+        }
         code = code << 6 | (utf8[i] & 0x3F);
     }
-    if (code < minimum || code > 0x10FFFF || (code >= 0xD800 && code <= 0xDFFF)) return CES_ERROR_INVALID_ENCODE;
+    if (truncated) return CES_ERROR_SRC_BUFFER_END;
+    if (code < minimum || (code >= 0xD800 && code <= 0xDFFF)) return CES_ERROR_ILLEGAL_CODE;
     return 0;
 }
 
@@ -140,21 +157,88 @@ uint32_t encodeUtf8(uint32_t code, uint8_t* utf8) {
         utf8[1] = static_cast<uint8_t>(0x80 | (code & 0x3F));
         return 2;
     }
-    utf8[0] = static_cast<uint8_t>(0xE0 | code >> 12);
-    utf8[1] = static_cast<uint8_t>(0x80 | (code >> 6 & 0x3F));
-    utf8[2] = static_cast<uint8_t>(0x80 | (code & 0x3F));
-    return 3;
+    if (code < 0x10000) {
+        utf8[0] = static_cast<uint8_t>(0xE0 | code >> 12);
+        utf8[1] = static_cast<uint8_t>(0x80 | (code >> 6 & 0x3F));
+        utf8[2] = static_cast<uint8_t>(0x80 | (code & 0x3F));
+        return 3;
+    }
+    utf8[0] = static_cast<uint8_t>(0xF0 | code >> 18);
+    utf8[1] = static_cast<uint8_t>(0x80 | (code >> 12 & 0x3F));
+    utf8[2] = static_cast<uint8_t>(0x80 | (code >> 6 & 0x3F));
+    utf8[3] = static_cast<uint8_t>(0x80 | (code & 0x3F));
+    return 4;
 }
 
 constexpr uint8_t EUC_JP_TAG[8] = {'E', 'U', 'C', 'J', 'P', '9', '3', '2'};
+constexpr uint8_t EUC_JP_X0208_TAG[8] = {'E', 'U', 'C', 'J', 'X', '2', '0', '8'};
+constexpr uint8_t EUC_JP_X0208_SS2_TAG[8] = {'E', 'U', 'C', 'J', 'X', 'S', 'S', '2'};
+constexpr uint8_t EUC_JP_X0208_SS3_TAG[8] = {'E', 'U', 'C', 'J', 'X', 'S', 'S', '3'};
 constexpr uint8_t SJIS_TAG[8] = {'S', 'J', 'I', 'S', '1', '9', '9', '7'};
+constexpr uint8_t SJIS_X0208_TAG[8] = {'S', 'J', 'I', 'S', 'X', '2', '0', '8'};
+
+bool hasTag(const void* profile, const uint8_t (&tag)[8]) {
+    return profile != nullptr && std::memcmp(profile, tag, sizeof(tag)) == 0;
+}
+
+bool isEucJpX0208(const void* profile) {
+    return hasTag(profile, EUC_JP_X0208_TAG) || hasTag(profile, EUC_JP_X0208_SS2_TAG) || hasTag(profile, EUC_JP_X0208_SS3_TAG);
+}
 
 bool isEucJp(const void* profile) {
-    return profile != nullptr && std::memcmp(profile, EUC_JP_TAG, sizeof(EUC_JP_TAG)) == 0;
+    return hasTag(profile, EUC_JP_TAG) || isEucJpX0208(profile);
+}
+
+bool hasSs2(const void* profile) {
+    return !hasTag(profile, EUC_JP_X0208_TAG);
+}
+
+bool hasSs3(const void* profile) {
+    return hasTag(profile, EUC_JP_X0208_SS3_TAG);
+}
+
+bool isSjisX0208(const void* profile) {
+    return hasTag(profile, SJIS_X0208_TAG);
 }
 
 bool isSjis(const void* profile) {
-    return profile != nullptr && std::memcmp(profile, SJIS_TAG, sizeof(SJIS_TAG)) == 0;
+    return hasTag(profile, SJIS_TAG) || isSjisX0208(profile);
+}
+
+struct JisChange {
+    uint16_t jis;
+    uint16_t code;
+};
+
+constexpr JisChange JIS_X0208_CHANGES[7] = {{0x213D, 0x2014}, {0x2141, 0x301C}, {0x2142, 0x2016}, {0x215D, 0x2212}, {0x2171, 0x00A2}, {0x2172, 0x00A3}, {0x224C, 0x00AC}};
+constexpr uint16_t JIS_X0208_BACKSLASH_CELL = 0x2140;
+constexpr JisChange JIS_X0208_EUC_FALLBACKS[2] = {{0x216F, 0x00A5}, {0x2131, 0x203E}};
+
+enum class JisStrict { None, Sjis, Euc };
+
+constexpr uint32_t jisIndex(uint16_t jis) {
+    return ((jis >> 8) - 0x21) * 94 + (jis & 0xFF) - 0x21;
+}
+
+bool isCp932ExtensionRow(uint32_t row) {
+    return row == 13 || (row >= 89 && row <= 92);
+}
+
+uint16_t strictJisX0208(JisStrict strict, uint32_t index) {
+    if (isCp932ExtensionRow(index / 94 + 1)) return 0;
+    if (index == jisIndex(JIS_X0208_BACKSLASH_CELL)) return strict == JisStrict::Sjis ? 0x005C : 0xFF3C;
+    for (const JisChange& change : JIS_X0208_CHANGES) {
+        if (jisIndex(change.jis) == index) return change.code;
+    }
+    return JisX0208::TO_UCS2[index];
+}
+
+uint32_t jisX0208ToUnicode(JisStrict strict, uint32_t index) {
+    return strict == JisStrict::None ? JisX0208::TO_UCS2[index] : strictJisX0208(strict, index);
+}
+
+uint32_t sjisX0208Single(uint8_t byte) {
+    return byte == 0x5C ? 0x00A5 : byte == 0x7E ? 0x203E : byte;
 }
 
 constexpr uint8_t EUC_CN_TAG[8] = {'E', 'U', 'C', 'C', 'N', '9', '3', '6'};
@@ -172,6 +256,36 @@ bool isSbc(const void* profile) {
     return profile == CP1252_PROFILE || sbcHighTable(profile) != nullptr;
 }
 
+int rejectLead(uint32_t& length) {
+    length = 1;
+    return CES_ERROR_INVALID_ENCODE;
+}
+
+int needBytes(uint32_t size, uint32_t& length) {
+    length = size;
+    return CES_ERROR_SRC_BUFFER_END;
+}
+
+int rejectTrail(uint8_t trail, uint32_t size, uint32_t& length) {
+    length = trail == 0 ? 1 : size;
+    return CES_ERROR_INVALID_ENCODE;
+}
+
+bool stopsAtNul(const uint8_t* mbcs, uint32_t mbcsMax, uint32_t from, uint32_t size, uint32_t& length) {
+    for (uint32_t index = from; index < size && index < mbcsMax; ++index) {
+        if (mbcs[index] == 0) {
+            length = index;
+            return true;
+        }
+    }
+    return false;
+}
+
+int unassigned(uint32_t size, uint32_t& length) {
+    length = size;
+    return CES_ERROR_UNASSIGNED_CODE;
+}
+
 int decodeGb(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
     const uint8_t lead = mbcs[0];
     if (lead < 0x80) {
@@ -185,12 +299,12 @@ int decodeGb(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint32_
         code = 0x20AC;
         return 0;
     }
-    if (lead == 0xFF || (!gbk && lead < 0xA1)) return CES_ERROR_INVALID_ENCODE;
-    if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
+    if (lead == 0xFF || (!gbk && lead < 0xA1)) return rejectLead(length);
+    if (mbcsMax < 2) return needBytes(2, length);
     const uint8_t trail = mbcs[1];
-    if (trail == 0xFF || (gbk ? trail < 0x40 || trail == 0x7F : trail < 0xA1)) return CES_ERROR_INVALID_ENCODE;
+    if (trail == 0xFF || (gbk ? trail < 0x40 || trail == 0x7F : trail < 0xA1)) return rejectTrail(trail, 2, length);
     code = Cp936::TO_UCS2[(lead - 0x81) * 190 + (trail < 0x7F ? trail - 0x40 : trail - 0x41)];
-    if (code == 0) return CES_ERROR_UNASSIGNED_CODE;
+    if (code == 0) return unassigned(2, length);
     length = 2;
     return 0;
 }
@@ -235,6 +349,126 @@ int encodeGb(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& length
     return CES_ERROR_UNASSIGNED_CODE;
 }
 
+constexpr uint8_t GB18030_2000_TAG[8] = {'G', 'B', '1', '8', '2', '0', '0', '0'};
+constexpr uint8_t GB18030_2005_TAG[8] = {'G', 'B', '1', '8', '2', '0', '0', '5'};
+constexpr uint32_t GB_CELLS = 126 * 190;
+
+struct Gb18030Tables {
+    std::span<const uint32_t[3]> twoByte;
+    std::span<const uint32_t[3]> fourByte;
+    std::span<const uint32_t[2]> fallback;
+};
+
+constexpr Gb18030Tables GB18030_2000{Gb18030::TWO_BYTE_2000, Gb18030::FOUR_BYTE_2000, {}};
+constexpr Gb18030Tables GB18030_2005{Gb18030::TWO_BYTE_2005, Gb18030::FOUR_BYTE_2005, Gb18030::FALLBACK_2005};
+
+const Gb18030Tables* gb18030Tables(const void* profile) {
+    if (profile == nullptr) return nullptr;
+    if (std::memcmp(profile, GB18030_2000_TAG, sizeof(GB18030_2000_TAG)) == 0) return &GB18030_2000;
+    if (std::memcmp(profile, GB18030_2005_TAG, sizeof(GB18030_2005_TAG)) == 0) return &GB18030_2005;
+    return nullptr;
+}
+
+bool isGb18030(const void* profile) {
+    return gb18030Tables(profile) != nullptr;
+}
+
+bool isGb(const void* profile) {
+    return isGbk(profile) || isGb18030(profile);
+}
+
+const uint32_t* findRun(std::span<const uint32_t[3]> runs, uint32_t key) {
+    const auto next = std::upper_bound(runs.begin(), runs.end(), key, [](uint32_t value, const uint32_t (&run)[3]) { return value < run[0]; });
+    if (next == runs.begin()) return nullptr;
+    const uint32_t* run = *std::prev(next);
+    return key - run[0] < run[2] ? run : nullptr;
+}
+
+uint32_t gb18030Cell(const Gb18030Tables& tables, uint32_t cell) {
+    const uint32_t* run = findRun(tables.twoByte, cell);
+    return run ? run[1] + cell - run[0] : Cp936::TO_UCS2[cell];
+}
+
+void putGbCell(uint32_t cell, uint8_t* mbcs) {
+    const uint32_t column = cell % 190;
+    mbcs[0] = static_cast<uint8_t>(0x81 + cell / 190);
+    mbcs[1] = static_cast<uint8_t>(column < 0x3F ? 0x40 + column : 0x41 + column);
+}
+
+int decodeGb18030(const Gb18030Tables& tables, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
+    const uint8_t lead = mbcs[0];
+    if (lead < 0x80) {
+        length = 1;
+        code = lead;
+        return 0;
+    }
+    if (lead == 0x80 || lead == 0xFF) return rejectLead(length);
+    if (mbcsMax < 2) return needBytes(2, length);
+    const uint8_t second = mbcs[1];
+    if (second >= 0x30 && second <= 0x39) {
+        if (stopsAtNul(mbcs, mbcsMax, 2, 4, length)) return CES_ERROR_INVALID_ENCODE;
+        if (mbcsMax < 4) return needBytes(4, length);
+        if (mbcs[2] < 0x81 || mbcs[2] == 0xFF || mbcs[3] < 0x30 || mbcs[3] > 0x39) return rejectTrail(mbcs[2], 4, length);
+        const uint32_t linear = (((lead - 0x81) * 10 + (second - 0x30)) * 126 + (mbcs[2] - 0x81)) * 10 + (mbcs[3] - 0x30);
+        const uint32_t* run = findRun(tables.fourByte, linear);
+        if (!run) return unassigned(4, length);
+        length = 4;
+        code = run[1] + linear - run[0];
+        return 0;
+    }
+    if (second < 0x40 || second == 0x7F || second == 0xFF) return rejectTrail(second, 2, length);
+    length = 2;
+    code = gb18030Cell(tables, (lead - 0x81) * 190 + (second < 0x7F ? second - 0x40 : second - 0x41));
+    return 0;
+}
+
+const std::vector<std::pair<uint32_t, uint16_t>>& gb18030Reverse(const Gb18030Tables& tables) {
+    const auto build = [](const Gb18030Tables& source) {
+        std::vector<std::pair<uint32_t, uint16_t>> entries;
+        entries.reserve(GB_CELLS);
+        for (uint32_t cell = 0; cell < GB_CELLS; ++cell) entries.emplace_back(gb18030Cell(source, cell), static_cast<uint16_t>(cell));
+        std::sort(entries.begin(), entries.end());
+        return entries;
+    };
+    static const auto reverse2000 = build(GB18030_2000);
+    static const auto reverse2005 = build(GB18030_2005);
+    return &tables == &GB18030_2005 ? reverse2005 : reverse2000;
+}
+
+int encodeGb18030(const Gb18030Tables& tables, uint32_t code, uint8_t* mbcs, uint32_t& length) {
+    if (code < 0x80) {
+        length = 1;
+        mbcs[0] = static_cast<uint8_t>(code);
+        return 0;
+    }
+    const auto& reverse = gb18030Reverse(tables);
+    const auto found = std::lower_bound(reverse.begin(), reverse.end(), std::pair<uint32_t, uint16_t>(code, 0));
+    if (found != reverse.end() && found->first == code) {
+        putGbCell(found->second, mbcs);
+        length = 2;
+        return 0;
+    }
+    for (const auto& run : tables.fourByte) {
+        if (code - run[1] >= run[2]) continue;
+        uint32_t linear = run[0] + code - run[1];
+        mbcs[3] = static_cast<uint8_t>(0x30 + linear % 10);
+        linear /= 10;
+        mbcs[2] = static_cast<uint8_t>(0x81 + linear % 126);
+        linear /= 126;
+        mbcs[1] = static_cast<uint8_t>(0x30 + linear % 10);
+        mbcs[0] = static_cast<uint8_t>(0x81 + linear / 10);
+        length = 4;
+        return 0;
+    }
+    for (const auto& entry : tables.fallback) {
+        if (entry[0] != code) continue;
+        putGbCell(entry[1], mbcs);
+        length = 2;
+        return 0;
+    }
+    return CES_ERROR_UNASSIGNED_CODE;
+}
+
 bool sjisToJis(uint8_t lead, uint8_t trail, int& row, int& cell) {
     if (!((lead >= 0x81 && lead <= 0x9F) || (lead >= 0xE0 && lead <= 0xFC))) return false;
     if (trail < 0x40 || trail == 0x7F || trail > 0xFC) return false;
@@ -273,7 +507,7 @@ const void* contextProfile(const void* context) {
 constexpr uint8_t EUC_KR_TAG[8] = {'E', 'U', 'C', 'K', 'R', '9', '4', '9'};
 constexpr uint8_t UHC_TAG[8] = {'U', 'H', 'C', 'C', 'P', '9', '4', '9'};
 constexpr uint8_t BIG5_TAG[8] = {'B', 'I', 'G', '5', 'C', '9', '5', '0'};
-constexpr uint16_t BIG5_LAST_CELL[6] = {0x2550, 0x255E, 0x2561, 0x256A, 0x5341, 0x5345};
+constexpr uint16_t BIG5_LAST_CELL[2] = {0x5341, 0x5345};
 
 bool isEucKr(const void* profile) {
     return profile != nullptr && std::memcmp(profile, EUC_KR_TAG, sizeof(EUC_KR_TAG)) == 0;
@@ -288,7 +522,7 @@ bool isBig5(const void* profile) {
 }
 
 bool isMbcs(const void* profile) {
-    return isEucJp(profile) || isSjis(profile) || isSbc(profile) || isEucCn(profile) || isGbk(profile) || isEucKr(profile) || isUhc(profile) || isBig5(profile);
+    return isEucJp(profile) || isSjis(profile) || isSbc(profile) || isEucCn(profile) || isGb(profile) || isEucKr(profile) || isUhc(profile) || isBig5(profile);
 }
 
 int decodeCp949(bool unified, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
@@ -298,11 +532,11 @@ int decodeCp949(bool unified, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& l
         code = lead;
         return 0;
     }
-    if (lead < (unified ? 0x81 : 0xA1) || lead == 0xFF) return CES_ERROR_INVALID_ENCODE;
-    if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
+    if (lead < (unified ? 0x81 : 0xA1) || lead == 0xFF) return rejectLead(length);
+    if (mbcsMax < 2) return needBytes(2, length);
     const uint8_t trail = mbcs[1];
     const bool extended = unified && ((trail >= 0x41 && trail <= 0x5A) || (trail >= 0x61 && trail <= 0x7A) || (trail >= 0x81 && trail <= 0xA0));
-    if (!extended && (trail < 0xA1 || trail == 0xFF)) return CES_ERROR_INVALID_ENCODE;
+    if (!extended && (trail < 0xA1 || trail == 0xFF)) return rejectTrail(trail, 2, length);
     length = 2;
     code = Cp949::TO_UCS2[(lead - 0x81) * 190 + (trail - 0x41)];
     return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
@@ -315,11 +549,11 @@ int decodeCp950(const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_
         code = lead;
         return 0;
     }
-    if (lead == 0x80 || lead == 0xFF) return CES_ERROR_INVALID_ENCODE;
-    if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
+    if (lead == 0x80 || lead == 0xFF) return rejectLead(length);
+    if (mbcsMax < 2) return needBytes(2, length);
     const uint8_t trail = mbcs[1];
-    if (trail < 0x40 || (trail > 0x7E && trail < 0xA1) || trail == 0xFF) return CES_ERROR_INVALID_ENCODE;
-    if (lead < 0xA1 || lead > 0xF9) return CES_ERROR_UNASSIGNED_CODE;
+    if (trail < 0x40 || (trail > 0x7E && trail < 0xA1) || trail == 0xFF) return rejectTrail(trail, 2, length);
+    if (lead < 0xA1 || lead > 0xF9) return unassigned(2, length);
     length = 2;
     code = Cp950::TO_UCS2[(lead - 0xA1) * 157 + (trail < 0xA1 ? trail - 0x40 : trail - 0xA1 + 63)];
     return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
@@ -380,20 +614,95 @@ int encodeDbcs(const std::vector<DbcsCell>& reverse, bool euc, uint32_t code, ui
     return 0;
 }
 
+bool jisX0212RowEmpty(uint8_t row) {
+    for (uint32_t cell = 0; cell < 94; ++cell) {
+        if (JisX0212::TO_UCS2[(row - 0xA1) * 94 + cell] != 0) return false;
+    }
+    return true;
+}
+
+int decodeEucJpScalar(const uint8_t* euc, uint32_t eucMax, uint32_t& length, uint32_t& code) {
+    const uint8_t lead = euc[0];
+    length = 1;
+    if (lead == 0x0E || lead == 0xA0 || lead == 0xFF) return CES_ERROR_INVALID_ENCODE;
+    if (lead < 0xA0 && lead != 0x8E && lead != 0x8F) {
+        code = lead;
+        return 0;
+    }
+    const uint32_t needed = lead == 0x8F ? 3 : 2;
+    for (uint32_t i = 1; i < needed && i < eucMax; ++i) {
+        if (euc[i] == 0) {
+            length = i;
+            return CES_ERROR_INVALID_ENCODE;
+        }
+    }
+    length = needed;
+    if (eucMax < needed) return CES_ERROR_SRC_BUFFER_END;
+    const uint8_t trail = euc[1];
+    if (lead == 0x8E) {
+        if (trail >= 0xA1 && trail <= 0xDF) {
+            code = 0xFF61 + (trail - 0xA1);
+            return 0;
+        }
+        return trail >= 0xE0 && trail <= 0xFE ? CES_ERROR_UNASSIGNED_CODE : CES_ERROR_INVALID_ENCODE;
+    }
+    if (lead == 0x8F) {
+        if (trail < 0xA1 || trail > 0xFE || euc[2] < 0xA1 || euc[2] > 0xFE) return CES_ERROR_INVALID_ENCODE;
+        return jisX0212RowEmpty(trail) ? CES_ERROR_UNASSIGNED_CODE : CES_ERROR_INVALID_ENCODE;
+    }
+    if (trail < 0xA1 || trail > 0xFE) return CES_ERROR_INVALID_ENCODE;
+    code = JisX0208::TO_UCS2[(lead - 0xA1) * 94 + (trail - 0xA1)];
+    return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
+}
+
+int decodeEucJp(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
+    if (hasTag(profile, EUC_JP_TAG)) return decodeEucJpScalar(mbcs, mbcsMax, length, code);
+    const uint8_t lead = mbcs[0];
+    if (lead < 0x80) {
+        length = 1;
+        code = lead;
+        return 0;
+    }
+    if (lead == 0x8E && hasSs2(profile)) {
+        if (mbcsMax < 2) return needBytes(2, length);
+        if (mbcs[1] < 0xA1 || mbcs[1] > 0xDF) return rejectTrail(mbcs[1], 2, length);
+        length = 2;
+        code = 0xFF61 + (mbcs[1] - 0xA1);
+        return 0;
+    }
+    if (lead >= 0xA1 && lead <= 0xFE) {
+        if (mbcsMax < 2) return needBytes(2, length);
+        if (mbcs[1] < 0xA1 || mbcs[1] > 0xFE) return rejectTrail(mbcs[1], 2, length);
+        length = 2;
+        code = jisX0208ToUnicode(isEucJpX0208(profile) ? JisStrict::Euc : JisStrict::None, (lead - 0xA1) * 94 + (mbcs[1] - 0xA1));
+        return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
+    }
+    if (lead == 0x8F && hasSs3(profile)) {
+        if (stopsAtNul(mbcs, mbcsMax, 1, 3, length)) return CES_ERROR_INVALID_ENCODE;
+        if (mbcsMax < 3) return needBytes(3, length);
+        if (mbcs[1] < 0xA1 || mbcs[1] > 0xFE || mbcs[2] < 0xA1 || mbcs[2] > 0xFE) return rejectTrail(mbcs[1], 3, length);
+        length = 3;
+        code = JisX0212::TO_UCS2[(mbcs[1] - 0xA1) * 94 + (mbcs[2] - 0xA1)];
+        return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
+    }
+    return rejectLead(length);
+}
+
 int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
     if (isEucKr(profile) || isUhc(profile)) return decodeCp949(isUhc(profile), mbcs, mbcsMax, length, code);
     if (isBig5(profile)) return decodeCp950(mbcs, mbcsMax, length, code);
+    if (const Gb18030Tables* tables = gb18030Tables(profile)) return decodeGb18030(*tables, mbcs, mbcsMax, length, code);
     if (isEucCn(profile) || isGbk(profile)) return decodeGb(profile, mbcs, mbcsMax, length, code);
     const uint8_t lead = mbcs[0];
     if (isSbc(profile)) {
         length = 1;
-        code = sbcToUnicode(static_cast<const uint8_t*>(profile), lead);
-        return 0;
+        return sbcToUnicode(static_cast<const uint8_t*>(profile), lead, code) ? 0 : CES_ERROR_UNASSIGNED_CODE;
     }
     if (isSjis(profile)) {
+        const bool strict = isSjisX0208(profile);
         if (lead < 0x80) {
             length = 1;
-            code = lead;
+            code = strict ? sjisX0208Single(lead) : lead;
             return 0;
         }
         if (lead >= 0xA1 && lead <= 0xDF) {
@@ -402,10 +711,10 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
             return 0;
         }
         if ((lead >= 0x81 && lead <= 0x9F) || (lead >= 0xE0 && lead <= 0xFC)) {
-            if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
+            if (mbcsMax < 2) return needBytes(2, length);
             const uint8_t trail = mbcs[1];
-            if (trail < 0x40 || trail == 0x7F || trail > 0xFC) return CES_ERROR_INVALID_ENCODE;
-            if (lead >= 0xFA) {
+            if (trail < 0x40 || trail == 0x7F || trail > 0xFC) return rejectTrail(trail, 2, length);
+            if (lead >= 0xFA && !strict) {
                 const uint32_t trailIdx = trail < 0x7F ? trail - 0x40 : trail - 0x41;
                 const uint32_t offset = (lead - 0xFA) * 188 + trailIdx;
                 if (offset <= 387) {
@@ -418,50 +727,24 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
                     const int row = 89 + kanjiIdx / 94;
                     const int cell = 1 + kanjiIdx % 94;
                     code = JisX0208::TO_UCS2[(row - 1) * 94 + (cell - 1)];
-                    if (code == 0) return CES_ERROR_UNASSIGNED_CODE;
+                    if (code == 0) return unassigned(2, length);
                     length = 2;
                     return 0;
                 }
-                return CES_ERROR_UNASSIGNED_CODE;
+                return unassigned(2, length);
             }
             int row = 0;
             int cell = 0;
             sjisToJis(lead, trail, row, cell);
-            if (row < 1 || row > 94 || cell < 1 || cell > 94) return CES_ERROR_UNASSIGNED_CODE;
-            code = JisX0208::TO_UCS2[(row - 1) * 94 + (cell - 1)];
-            if (code == 0) return CES_ERROR_UNASSIGNED_CODE;
+            if (row < 1 || row > 94 || cell < 1 || cell > 94) return unassigned(2, length);
+            code = jisX0208ToUnicode(strict ? JisStrict::Sjis : JisStrict::None, (row - 1) * 94 + (cell - 1));
+            if (code == 0) return unassigned(2, length);
             length = 2;
             return 0;
         }
-        return CES_ERROR_INVALID_ENCODE;
+        return rejectLead(length);
     }
-    if (lead < 0x80) {
-        length = 1;
-        code = lead;
-        return 0;
-    }
-    if (lead == 0x8E) {
-        if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
-        if (mbcs[1] < 0xA1 || mbcs[1] > 0xDF) return CES_ERROR_INVALID_ENCODE;
-        length = 2;
-        code = 0xFF61 + (mbcs[1] - 0xA1);
-        return 0;
-    }
-    if (lead >= 0xA1 && lead <= 0xFE) {
-        if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
-        if (mbcs[1] < 0xA1 || mbcs[1] > 0xFE) return CES_ERROR_INVALID_ENCODE;
-        length = 2;
-        code = JisX0208::TO_UCS2[(lead - 0xA1) * 94 + (mbcs[1] - 0xA1)];
-        return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
-    }
-    if (lead == 0x8F) {
-        if (mbcsMax < 3) return CES_ERROR_SRC_BUFFER_END;
-        if (mbcs[1] < 0xA1 || mbcs[1] > 0xFE || mbcs[2] < 0xA1 || mbcs[2] > 0xFE) return CES_ERROR_INVALID_ENCODE;
-        length = 3;
-        code = JisX0212::TO_UCS2[(mbcs[1] - 0xA1) * 94 + (mbcs[2] - 0xA1)];
-        return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
-    }
-    return CES_ERROR_INVALID_ENCODE;
+    return decodeEucJp(profile, mbcs, mbcsMax, length, code);
 }
 
 struct JisCell {
@@ -470,65 +753,109 @@ struct JisCell {
     bool supplementary;
 };
 
-const std::vector<JisCell>& jisReverse() {
-    static const auto reverse = [] {
-        std::vector<JisCell> entries;
-        entries.reserve(2 * 94 * 94);
-        for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
-            if (JisX0208::TO_UCS2[cell] != 0) entries.push_back({JisX0208::TO_UCS2[cell], static_cast<uint16_t>(cell), false});
-        }
-        for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
-            if (JisX0212::TO_UCS2[cell] != 0) entries.push_back({JisX0212::TO_UCS2[cell], static_cast<uint16_t>(cell), true});
-        }
-        std::stable_sort(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code < right.code; });
-        entries.erase(std::unique(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code == right.code; }), entries.end());
-        return entries;
-    }();
-    return reverse;
+std::vector<JisCell> buildJisReverse(JisStrict strict) {
+    std::vector<JisCell> entries;
+    entries.reserve(2 * 94 * 94);
+    for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
+        const uint16_t code = static_cast<uint16_t>(jisX0208ToUnicode(strict, cell));
+        if (code != 0) entries.push_back({code, static_cast<uint16_t>(cell), false});
+    }
+    if (strict == JisStrict::Euc) {
+        for (const JisChange& fallback : JIS_X0208_EUC_FALLBACKS) entries.push_back({fallback.code, static_cast<uint16_t>(jisIndex(fallback.jis)), false});
+    }
+    for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
+        if (JisX0212::TO_UCS2[cell] != 0) entries.push_back({JisX0212::TO_UCS2[cell], static_cast<uint16_t>(cell), true});
+    }
+    std::stable_sort(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code < right.code; });
+    entries.erase(std::unique(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code == right.code; }), entries.end());
+    return entries;
+}
+
+const std::vector<JisCell>& jisReverse(JisStrict strict) {
+    static const auto reverse = buildJisReverse(JisStrict::None);
+    static const auto sjisReverse = buildJisReverse(JisStrict::Sjis);
+    static const auto eucReverse = buildJisReverse(JisStrict::Euc);
+    return strict == JisStrict::Sjis ? sjisReverse : strict == JisStrict::Euc ? eucReverse : reverse;
+}
+
+uint32_t jisAlias(uint32_t code) {
+    switch (code) {
+    case 0x00A2: return 0xFFE0;
+    case 0x00A3: return 0xFFE1;
+    case 0x00A5: return 0xFFE5;
+    case 0x00AC: return 0xFFE2;
+    case 0x2014: return 0x2015;
+    case 0x2016: return 0x2225;
+    case 0x203E: return 0xFFE3;
+    case 0x2212: return 0xFF0D;
+    case 0x301C: return 0xFF5E;
+    default: return code;
+    }
 }
 
 int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& length) {
     if (isEucKr(profile) || isUhc(profile)) return encodeDbcs(cp949Reverse(), isEucKr(profile), code, mbcs, length);
     if (isBig5(profile)) return encodeDbcs(cp950Reverse(), false, code, mbcs, length);
+    if (const Gb18030Tables* tables = gb18030Tables(profile)) return encodeGb18030(*tables, code, mbcs, length);
     if (isEucCn(profile) || isGbk(profile)) return encodeGb(profile, code, mbcs, length);
     if (isSbc(profile)) {
         length = 1;
         return unicodeToSbc(static_cast<const uint8_t*>(profile), code, mbcs[0]) ? 0 : CES_ERROR_UNASSIGNED_CODE;
     }
     if (isSjis(profile)) {
-        if (code < 0x80) {
+        const bool strict = isSjisX0208(profile);
+        if (strict && (code == 0x00A5 || code == 0x203E)) {
+            length = 1;
+            mbcs[0] = code == 0x00A5 ? 0x5C : 0x7E;
+            return 0;
+        }
+        if (code < 0x80 && !(strict && (code == 0x5C || code == 0x7E))) {
             length = 1;
             mbcs[0] = static_cast<uint8_t>(code);
             return 0;
         }
+        if (!strict && code <= 0x9F) return CES_ERROR_UNSUPPORTED_CODE;
+        if (!strict && code == 0xFEFF) {
+            length = 0;
+            return 0;
+        }
+        if (!strict) code = jisAlias(code);
         if (code >= 0xFF61 && code <= 0xFF9F) {
             length = 1;
             mbcs[0] = static_cast<uint8_t>(0xA1 + (code - 0xFF61));
             return 0;
         }
         if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
-        const auto& reverse = jisReverse();
+        const auto& reverse = jisReverse(strict ? JisStrict::Sjis : JisStrict::None);
         const auto found = std::lower_bound(reverse.begin(), reverse.end(), static_cast<uint16_t>(code), [](const JisCell& entry, uint16_t value) { return entry.code < value; });
         if (found == reverse.end() || found->code != code || found->supplementary) return CES_ERROR_UNASSIGNED_CODE;
         jisToSjis(found->cell / 94 + 1, found->cell % 94 + 1, mbcs[0], mbcs[1]);
         length = 2;
         return 0;
     }
-    if (code < 0x80) {
+    const bool strict = isEucJpX0208(profile);
+    if (!strict && code == 0x0E) return CES_ERROR_UNASSIGNED_CODE;
+    if (code < 0x80 || (!strict && code < 0xA0 && code != 0x8E && code != 0x8F)) {
         length = 1;
         mbcs[0] = static_cast<uint8_t>(code);
         return 0;
     }
+    if (!strict && code == 0xFEFF) {
+        length = 0;
+        return 0;
+    }
+    if (!strict) code = jisAlias(code);
     if (code >= 0xFF61 && code <= 0xFF9F) {
+        if (!hasSs2(profile)) return CES_ERROR_UNASSIGNED_CODE;
         length = 2;
         mbcs[0] = 0x8E;
         mbcs[1] = static_cast<uint8_t>(0xA1 + (code - 0xFF61));
         return 0;
     }
     if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
-    const auto& reverse = jisReverse();
+    const auto& reverse = jisReverse(strict ? JisStrict::Euc : JisStrict::None);
     const auto found = std::lower_bound(reverse.begin(), reverse.end(), static_cast<uint16_t>(code), [](const JisCell& entry, uint16_t value) { return entry.code < value; });
-    if (found == reverse.end() || found->code != code) return CES_ERROR_UNASSIGNED_CODE;
+    if (found == reverse.end() || found->code != code || (found->supplementary && !hasSs3(profile))) return CES_ERROR_UNASSIGNED_CODE;
     if (found->supplementary) {
         length = 3;
         mbcs[0] = 0x8F;
@@ -545,65 +872,69 @@ int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& leng
 int decodeUcs2(const uint16_t* ucs2, uint32_t, uint32_t& length, uint32_t& code) {
     length = 1;
     code = ucs2[0];
-    return code >= 0xD800 && code <= 0xDFFF ? CES_ERROR_INVALID_ENCODE : 0;
+    return code >= 0xD800 && code <= 0xDFFF ? CES_ERROR_ILLEGAL_CODE : 0;
 }
 
 uint32_t encodeUcs2(uint32_t code, uint16_t* ucs2) {
+    if (code > 0xFFFF) return 0;
     ucs2[0] = static_cast<uint16_t>(code);
     return 1;
 }
 
-template<typename Source, typename Decode>
-int toMbcs(const void* context, const Source* source, uint32_t sourceMax, uint32_t* sourceLen, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, Decode decode) {
+uint32_t encodeUtf16(uint32_t code, uint16_t* utf16) {
+    if (code < 0x10000) {
+        utf16[0] = static_cast<uint16_t>(code);
+        return 1;
+    }
+    utf16[0] = static_cast<uint16_t>(0xD800 | (code - 0x10000) >> 10);
+    utf16[1] = static_cast<uint16_t>(0xDC00 | (code & 0x3FF));
+    return 2;
+}
+
+template<typename Source, typename Target, typename Decode, typename Encode>
+int convertString(const void* context, const Source* source, uint32_t sourceMax, uint32_t* sourceLen, Target* target, uint32_t targetMax, uint32_t* targetLen, bool counting, Decode decode, Encode encode) {
+    if (sourceLen) *sourceLen = 0;
+    if (targetLen) *targetLen = 0;
+    if (target && targetMax > 0) target[0] = 0;
     if (!context) return CES_ERROR_INVALID_PARAMETER;
     const void* profile = contextProfile(context);
     if (!isMbcs(profile)) return CES_ERROR_INVALID_PARAMETER;
     if (!source) return CES_ERROR_INVALID_SRC_BUFFER;
+    if (!counting && !target) return CES_ERROR_INVALID_DST_BUFFER;
     uint32_t read = 0;
     uint32_t written = 0;
-    while (read < sourceMax && source[read] != 0) {
+    int result = 0;
+    while ((sourceMax == 0 || read < sourceMax) && source[read] != 0) {
         uint32_t length = 0;
         uint32_t code = 0;
-        if (const int result = decode(source + read, sourceMax - read, length, code); result != 0) return result;
-        uint8_t encoded[3];
-        uint32_t size = 0;
-        if (const int result = encodeMbcs(profile, code, encoded, size); result != 0) return result;
-        if (mbcs) {
-            if (written + size > mbcsMax) return CES_ERROR_DST_BUFFER_END;
-            std::memcpy(mbcs + written, encoded, size);
-        }
-        read += length;
-        written += size;
-    }
-    if (sourceLen) *sourceLen = read;
-    if (mbcsLen) *mbcsLen = written;
-    return 0;
-}
-
-template<typename Target, typename Encode>
-int fromMbcs(const void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, Target* target, uint32_t targetMax, uint32_t* targetLen, Encode encode) {
-    if (!context) return CES_ERROR_INVALID_PARAMETER;
-    const void* profile = contextProfile(context);
-    if (!isMbcs(profile)) return CES_ERROR_INVALID_PARAMETER;
-    if (!mbcs) return CES_ERROR_INVALID_SRC_BUFFER;
-    uint32_t read = 0;
-    uint32_t written = 0;
-    while (read < mbcsMax && mbcs[read] != 0) {
-        uint32_t length = 0;
-        uint32_t code = 0;
-        if (const int result = decodeMbcs(profile, mbcs + read, mbcsMax - read, length, code); result != 0) return result;
+        const uint32_t available = sourceMax == 0 ? UINT32_MAX - read : sourceMax - read;
+        if ((result = decode(profile, source + read, available, length, code)) != 0) break;
         Target encoded[4];
-        const uint32_t size = encode(code, encoded);
-        if (target) {
-            if (written + size > targetMax) return CES_ERROR_DST_BUFFER_END;
+        uint32_t size = 0;
+        if ((result = encode(profile, code, encoded, size)) != 0) break;
+        if (!counting) {
+            if (written + size >= targetMax) {
+                result = CES_ERROR_DST_BUFFER_END;
+                break;
+            }
             std::memcpy(target + written, encoded, size * sizeof(Target));
         }
         read += length;
         written += size;
     }
-    if (mbcsLen) *mbcsLen = read;
+    if (!counting && written < targetMax) target[written] = 0;
+    if (sourceLen) *sourceLen = read;
     if (targetLen) *targetLen = written;
-    return 0;
+    return result;
+}
+
+template<typename Unit>
+int rejected(int result, uint32_t length, uint32_t* sourceSize, Unit* character, uint32_t* produced) {
+    if (length == 0) return result;
+    if (sourceSize) *sourceSize = length;
+    if (character) *character = 0;
+    if (produced) *produced = 0;
+    return result;
 }
 
 int mbcsToUtf8(bool accepted, const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint8_t* utf8, uint32_t utf8Max, uint32_t* utf8Len) {
@@ -613,8 +944,8 @@ int mbcsToUtf8(bool accepted, const void* profile, const uint8_t* mbcs, uint32_t
     if (!utf8) return CES_ERROR_INVALID_DST_BUFFER;
     uint32_t consumed = 0;
     uint32_t code = 0;
-    if (const int result = decodeMbcs(profile, mbcs, mbcsMax, consumed, code); result != 0) return result;
-    uint8_t encoded[3];
+    if (const int result = decodeMbcs(profile, mbcs, mbcsMax, consumed, code); result != 0) return rejected<uint8_t>(result, consumed, mbcsLen, nullptr, utf8Len);
+    uint8_t encoded[4];
     const uint32_t produced = encodeUtf8(code, encoded);
     if (utf8Max < produced) return CES_ERROR_DST_BUFFER_END;
     std::memcpy(utf8, encoded, produced);
@@ -643,6 +974,11 @@ bool isScalar(uint32_t code) {
     return code <= 0x10FFFF && (code < 0xD800 || code > 0xDFFF);
 }
 
+int scalarError(uint32_t code) {
+    if (code > 0x10FFFF) return CES_ERROR_INVALID_ENCODE;
+    return code >= 0xD800 && code <= 0xDFFF ? CES_ERROR_ILLEGAL_CODE : 0;
+}
+
 template<bool BigEndian>
 int decodeUtf16(const uint16_t* utf16, uint32_t utf16max, uint32_t& length, uint32_t& code) {
     code = loadUnit<uint16_t, BigEndian>(utf16);
@@ -666,10 +1002,12 @@ int decodeProfiled(bool (*matches)(const void*), const void* profile, const uint
     return decodeMbcs(profile, source, sourceMax, length, code);
 }
 
+
 int profiledToUcs2(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint16_t* ucs2) {
     uint32_t length = 0;
     uint32_t code = 0;
-    if (const int result = decodeProfiled(matches, profile, source, sourceMax, ucs2, length, code); result != 0) return result;
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, ucs2, length, code); result != 0) return rejected(result, length, sourceSize, ucs2, nullptr);
+    if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
     *ucs2 = static_cast<uint16_t>(code);
     if (sourceSize) *sourceSize = length;
     return 0;
@@ -678,8 +1016,8 @@ int profiledToUcs2(bool (*matches)(const void*), const void* profile, const uint
 int profiledToUtf8(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len) {
     uint32_t length = 0;
     uint32_t code = 0;
-    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf8, length, code); result != 0) return result;
-    uint8_t encoded[3];
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf8, length, code); result != 0) return rejected<uint8_t>(result, length, sourceSize, nullptr, utf8Len);
+    uint8_t encoded[4];
     const uint32_t produced = encodeUtf8(code, encoded);
     if (utf8max < produced) return CES_ERROR_DST_BUFFER_END;
     std::memcpy(utf8, encoded, produced);
@@ -692,11 +1030,17 @@ template<bool BigEndian>
 int profiledToUtf16(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
     uint32_t length = 0;
     uint32_t code = 0;
-    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf16, length, code); result != 0) return result;
-    if (utf16max < 1) return CES_ERROR_DST_BUFFER_END;
-    storeUnit<uint16_t, BigEndian>(utf16, code);
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf16, length, code); result != 0) return rejected<uint16_t>(result, length, sourceSize, nullptr, utf16Len);
+    const uint32_t units = code < 0x10000 ? 1 : 2;
+    if (utf16max < units) return CES_ERROR_DST_BUFFER_END;
+    if (units == 1) {
+        storeUnit<uint16_t, BigEndian>(utf16, code);
+    } else {
+        storeUnit<uint16_t, BigEndian>(utf16, 0xD800 | (code - 0x10000) >> 10);
+        storeUnit<uint16_t, BigEndian>(utf16 + 1, 0xDC00 | (code & 0x3FF));
+    }
     if (sourceSize) *sourceSize = length;
-    if (utf16Len) *utf16Len = 1;
+    if (utf16Len) *utf16Len = units;
     return 0;
 }
 
@@ -704,14 +1048,14 @@ template<bool BigEndian>
 int profiledToUtf32(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint32_t* utf32) {
     uint32_t length = 0;
     uint32_t code = 0;
-    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf32, length, code); result != 0) return result;
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf32, length, code); result != 0) return rejected(result, length, sourceSize, utf32, nullptr);
     storeUnit<uint32_t, BigEndian>(utf32, code);
     if (sourceSize) *sourceSize = length;
     return 0;
 }
 
 int encodeProfiled(const void* profile, uint32_t code, uint8_t* target, uint32_t targetMax, uint32_t* targetSize) {
-    uint8_t encoded[3];
+    uint8_t encoded[4];
     uint32_t size = 0;
     if (const int result = encodeMbcs(profile, code, encoded, size); result != 0) return result;
     if (targetMax < size) return CES_ERROR_DST_BUFFER_END;
@@ -723,8 +1067,14 @@ int encodeProfiled(const void* profile, uint32_t code, uint8_t* target, uint32_t
 int scalarToProfiled(bool (*matches)(const void*), uint32_t code, const void* profile, uint8_t* target, uint32_t targetMax, uint32_t* targetSize) {
     if (!matches(profile)) return CES_ERROR_INVALID_PARAMETER;
     if (!target) return CES_ERROR_INVALID_DST_BUFFER;
-    if (!isScalar(code)) return CES_ERROR_INVALID_ENCODE;
-    return encodeProfiled(profile, code, target, targetMax, targetSize);
+    int result = scalarError(code);
+    uint8_t encoded[4];
+    uint32_t size = 0;
+    if (result == 0) result = encodeMbcs(profile, code, encoded, size);
+    if (result == 0 && targetMax < size) result = CES_ERROR_DST_BUFFER_END;
+    if (result == 0) std::memcpy(target, encoded, size);
+    if (targetSize) *targetSize = result == 0 || result == CES_ERROR_DST_BUFFER_END ? size : 0;
+    return result;
 }
 
 template<bool BigEndian>
@@ -759,11 +1109,21 @@ uint32_t encodeUtf32(uint32_t code, uint32_t* utf32) {
     return 1;
 }
 
+template<auto Decode, typename Unit>
+int unitSource(const void*, const Unit* source, uint32_t sourceMax, uint32_t& length, uint32_t& code) {
+    return Decode(source, sourceMax, length, code);
+}
+
+template<auto Encode, typename Unit>
+int unitTarget(const void*, uint32_t code, Unit* target, uint32_t& length) {
+    length = Encode(code, target);
+    return length != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
+}
+
 int sbcToUnit(const uint8_t* profile, uint8_t sbc, const void* target, uint32_t& code) {
     if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
     if (!target) return CES_ERROR_INVALID_DST_BUFFER;
-    code = sbcToUnicode(profile, sbc);
-    return 0;
+    return sbcToUnicode(profile, sbc, code) ? 0 : CES_ERROR_UNASSIGNED_CODE;
 }
 
 template<bool BigEndian>
@@ -942,8 +1302,14 @@ void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void* sheet) {
     return sheet;
 }
 
+void* APS5_VABI sceCesUcsProfileInitSJis1997X0208(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, SJIS_X0208_TAG, sizeof(SJIS_X0208_TAG));
+    return sheet;
+}
+
 int APS5_VABI sceCesMbcsUcsContextInit(void* context, const void* profile) {
-    if (!context) return CES_ERROR_INVALID_PARAMETER;
+    if (!context || !profile) return CES_ERROR_INVALID_PARAMETER;
     std::memcpy(context, &profile, sizeof(profile));
     return 0;
 }
@@ -961,6 +1327,24 @@ void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void* sheet) {
     return sheet;
 }
 
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, EUC_JP_X0208_TAG, sizeof(EUC_JP_X0208_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, EUC_JP_X0208_SS2_TAG, sizeof(EUC_JP_X0208_SS2_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2Ss3(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, EUC_JP_X0208_SS3_TAG, sizeof(EUC_JP_X0208_SS3_TAG));
+    return sheet;
+}
+
 void* APS5_VABI sceCesUcsProfileInitEucKr(void* sheet) {
     if (!sheet) return nullptr;
     std::memcpy(sheet, EUC_KR_TAG, sizeof(EUC_KR_TAG));
@@ -980,106 +1364,115 @@ void* APS5_VABI sceCesUcsProfileInitBig5Cp950(void* sheet) {
 }
 
 int APS5_VABI sceCesUtf8StrToMbcsStr(void* context, const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen) {
-    if (!mbcs) return CES_ERROR_INVALID_DST_BUFFER;
-    return toMbcs(context, utf8, utf8max, utf8Len, mbcs, mbcsMax, mbcsLen, decodeUtf8);
+    return convertString(context, utf8, utf8max, utf8Len, mbcs, mbcsMax, mbcsLen, false, unitSource<decodeScalarUtf8, uint8_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesUtf8StrGetMbcsLen(void* context, const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len, uint32_t* mbcsLen) {
-    return toMbcs(context, utf8, utf8max, utf8Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, decodeUtf8);
+    return convertString(context, utf8, utf8max, utf8Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, true, unitSource<decodeScalarUtf8, uint8_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesUcs2StrToMbcsStr(void* context, const uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen) {
-    if (!mbcs) return CES_ERROR_INVALID_DST_BUFFER;
-    return toMbcs(context, ucs2, ucs2max, ucs2Len, mbcs, mbcsMax, mbcsLen, decodeUcs2);
+    return convertString(context, ucs2, ucs2max, ucs2Len, mbcs, mbcsMax, mbcsLen, false, unitSource<decodeUcs2, uint16_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesUcs2StrGetMbcsLen(void* context, const uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len, uint32_t* mbcsLen) {
-    return toMbcs(context, ucs2, ucs2max, ucs2Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, decodeUcs2);
+    return convertString(context, ucs2, ucs2max, ucs2Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, true, unitSource<decodeUcs2, uint16_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesMbcsStrToUtf8Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len) {
-    if (!utf8) return CES_ERROR_INVALID_DST_BUFFER;
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, utf8, utf8max, utf8Len, encodeUtf8);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, utf8, utf8max, utf8Len, false, decodeMbcs, unitTarget<encodeUtf8, uint8_t>);
 }
 
 int APS5_VABI sceCesMbcsStrGetUtf8Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf8Len) {
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, static_cast<uint8_t*>(nullptr), 0, utf8Len, encodeUtf8);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, static_cast<uint8_t*>(nullptr), 0, utf8Len, true, decodeMbcs, unitTarget<encodeUtf8, uint8_t>);
 }
 
 int APS5_VABI sceCesMbcsStrToUcs2Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len) {
-    if (!ucs2) return CES_ERROR_INVALID_DST_BUFFER;
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, ucs2, ucs2max, ucs2Len, encodeUcs2);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, ucs2, ucs2max, ucs2Len, false, decodeMbcs, unitTarget<encodeUcs2, uint16_t>);
 }
 
 int APS5_VABI sceCesMbcsStrGetUcs2Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* ucs2Len) {
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, static_cast<uint16_t*>(nullptr), 0, ucs2Len, encodeUcs2);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, static_cast<uint16_t*>(nullptr), 0, ucs2Len, true, decodeMbcs, unitTarget<encodeUcs2, uint16_t>);
 }
 
 int APS5_VABI sceCesEucJpToUcs2(const void* profile, const uint8_t* euc, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2) {
+    if (eucSize) *eucSize = 0;
+    if (ucs2) *ucs2 = 0;
+    if (!profile) return CES_ERROR_INVALID_PROFILE;
     if (!isEucJp(profile)) return CES_ERROR_INVALID_PARAMETER;
-    if (!euc) return CES_ERROR_INVALID_SRC_BUFFER;
-    if (eucMax == 0) return CES_ERROR_SRC_BUFFER_END;
-    if (!ucs2) return CES_ERROR_INVALID_DST_BUFFER;
+    if (!euc || eucMax == 0) return CES_ERROR_INVALID_SRC_BUFFER;
     uint32_t length = 0;
     uint32_t code = 0;
-    if (const int result = decodeMbcs(profile, euc, eucMax, length, code); result != 0) return result;
-    *ucs2 = static_cast<uint16_t>(code);
+    const int decoded = decodeEucJp(profile, euc, eucMax, length, code);
     if (eucSize) *eucSize = length;
+    if (decoded != 0) return decoded;
+    if (!ucs2) return CES_ERROR_INVALID_DST_BUFFER;
+    *ucs2 = static_cast<uint16_t>(code);
     return 0;
 }
 
 int APS5_VABI sceCesSbcToUtf8(const uint8_t* profile, uint8_t sbc, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8_len) {
+    if (utf8_len) *utf8_len = 0;
+    if (!profile) return CES_ERROR_INVALID_PROFILE;
     if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
+    uint32_t code = 0;
+    if (!sbcToUnicode(profile, sbc, code)) return CES_ERROR_UNASSIGNED_CODE;
+    uint8_t encoded[4];
+    const uint32_t length = encodeUtf8(code, encoded);
+    if (utf8_len) *utf8_len = length;
     if (!utf8) return CES_ERROR_INVALID_DST_BUFFER;
-
-    uint8_t encoded[3];
-    const uint32_t length = encodeUtf8(sbcToUnicode(profile, sbc), encoded);
     if (utf8max < length) return CES_ERROR_DST_BUFFER_END;
     for (uint32_t i = 0; i < length; ++i) utf8[i] = encoded[i];
-    if (utf8_len) *utf8_len = length;
     return 0;
 }
 
 int APS5_VABI sceCesUtf8ToSbc(const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8_len, const uint8_t* profile, uint8_t* sbc) {
-    if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
-    if (!utf8) return CES_ERROR_INVALID_SRC_BUFFER;
-    if (utf8max == 0) return CES_ERROR_SRC_BUFFER_END;
-    if (!sbc) return CES_ERROR_INVALID_DST_BUFFER;
-
+    if (utf8_len) *utf8_len = 0;
+    if (sbc) *sbc = 0;
+    if (!utf8 || utf8max == 0) return CES_ERROR_INVALID_SRC_BUFFER;
     uint32_t length = 0;
     uint32_t code = 0;
-    if (const int result = decodeUtf8(utf8, utf8max, length, code); result != 0) return result;
-    if (!unicodeToSbc(profile, code, *sbc)) return CES_ERROR_UNASSIGNED_CODE;
+    const int decoded = decodeScalarUtf8(utf8, utf8max, length, code);
     if (utf8_len) *utf8_len = length;
+    if (decoded != 0) return decoded;
+    if (!profile) return CES_ERROR_INVALID_PROFILE;
+    if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
+    uint8_t value = 0;
+    if (!unicodeToSbc(profile, code, value)) return CES_ERROR_UNASSIGNED_CODE;
+    if (!sbc) return CES_ERROR_INVALID_DST_BUFFER;
+    *sbc = value;
     return 0;
 }
 
 int APS5_VABI sceCesEucJpToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+    if (eucLength) *eucLength = 0;
+    if (utf8Length) *utf8Length = 0;
+    if (!profile) return CES_ERROR_INVALID_PROFILE;
     if (!isEucJp(profile)) return CES_ERROR_INVALID_PARAMETER;
-    if (!eucBuffer) return CES_ERROR_INVALID_SRC_BUFFER;
-    if (eucMax == 0) return CES_ERROR_SRC_BUFFER_END;
-    if (!utf8Buffer) return CES_ERROR_INVALID_DST_BUFFER;
+    if (!eucBuffer || eucMax == 0) return CES_ERROR_INVALID_SRC_BUFFER;
     uint32_t consumed = 0;
     uint32_t code = 0;
-    if (const int result = decodeMbcs(profile, eucBuffer, eucMax, consumed, code); result != 0) return result;
-    uint8_t encoded[3];
+    const int decoded = decodeEucJp(profile, eucBuffer, eucMax, consumed, code);
+    if (eucLength) *eucLength = consumed;
+    if (decoded != 0) return decoded;
+    uint8_t encoded[4];
     const uint32_t produced = encodeUtf8(code, encoded);
+    if (utf8Length) *utf8Length = produced;
+    if (!utf8Buffer) return CES_ERROR_INVALID_DST_BUFFER;
     if (utf8Max < produced) return CES_ERROR_DST_BUFFER_END;
     std::memcpy(utf8Buffer, encoded, produced);
-    if (eucLength) *eucLength = consumed;
-    if (utf8Length) *utf8Length = produced;
     return 0;
 }
 
-int APS5_VABI sceCesEucKrToUtf8(void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+int APS5_VABI sceCesEucKrToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
     return mbcsToUtf8(isEucKr(profile), profile, eucBuffer, eucMax, eucLength, utf8Buffer, utf8Max, utf8Length);
 }
 
-int APS5_VABI sceCesBig5ToUtf8(void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Length, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+int APS5_VABI sceCesBig5ToUtf8(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Length, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
     return mbcsToUtf8(isBig5(profile), profile, big5Buffer, big5Max, big5Length, utf8Buffer, utf8Max, utf8Length);
 }
 
-int APS5_VABI sceCesUhcToUtf8(void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+int APS5_VABI sceCesUhcToUtf8(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
     return mbcsToUtf8(isUhc(profile), profile, uhcBuffer, uhcMax, uhcLength, utf8Buffer, utf8Max, utf8Length);
 }
 
@@ -1144,7 +1537,7 @@ int APS5_VABI sceCesUcs2ToSJis(uint16_t ucs2, const void* profile, uint8_t* sjis
 }
 
 int APS5_VABI sceCesUtf8ToSJis(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
-    return bufferToProfiled(isSjis, utf8Buffer, utf8Max, utf8Length, profile, sjisBuffer, sjisMax, sjisSize, decodeUtf8);
+    return bufferToProfiled(isSjis, utf8Buffer, utf8Max, utf8Length, profile, sjisBuffer, sjisMax, sjisSize, decodeScalarUtf8);
 }
 
 int APS5_VABI sceCesUtf16ToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
@@ -1176,7 +1569,7 @@ int APS5_VABI sceCesUcs2ToEucJp(uint16_t ucs2, const void* profile, uint8_t* euc
 }
 
 int APS5_VABI sceCesUtf8ToEucJp(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
-    return bufferToProfiled(isEucJp, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeUtf8);
+    return bufferToProfiled(isEucJp, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeScalarUtf8);
 }
 
 int APS5_VABI sceCesUtf16ToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
@@ -1317,6 +1710,38 @@ int APS5_VABI sceCesMbcToUtf32le(const void* profile, const uint8_t* mbcBuffer,
     return profiledToUtf32<false>(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf32);
 }
 
+int APS5_VABI sceCesUcs2ToMbc(uint16_t ucs2, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return scalarToProfiled(isMbcs, ucs2, profile, mbcBuffer, mbcMax, mbcLen);
+}
+
+int APS5_VABI sceCesUtf8ToMbc(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return bufferToProfiled(isMbcs, utf8Buffer, utf8Max, utf8Len, profile, mbcBuffer, mbcMax, mbcLen, decodeScalarUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToMbc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return bufferToProfiled(isMbcs, utf16Buffer, utf16Max, utf16Len, profile, mbcBuffer, mbcMax, mbcLen, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToMbc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return bufferToProfiled(isMbcs, utf16Buffer, utf16Max, utf16Len, profile, mbcBuffer, mbcMax, mbcLen, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToMbc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return bufferToProfiled(isMbcs, utf16Buffer, utf16Max, utf16Len, profile, mbcBuffer, mbcMax, mbcLen, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToMbc(uint32_t utf32, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return scalarToProfiled(isMbcs, utf32, profile, mbcBuffer, mbcMax, mbcLen);
+}
+
+int APS5_VABI sceCesUtf32beToMbc(const uint32_t* utf32, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return utf32ToProfiled<true>(isMbcs, utf32, profile, mbcBuffer, mbcMax, mbcLen);
+}
+
+int APS5_VABI sceCesUtf32leToMbc(const uint32_t* utf32, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen) {
+    return utf32ToProfiled<false>(isMbcs, utf32, profile, mbcBuffer, mbcMax, mbcLen);
+}
+
 int APS5_VABI sceCesSbcToUcs2(const uint8_t* profile, uint8_t sbc, uint16_t* ucs2) {
     uint32_t code = 0;
     if (const int result = sbcToUnit(profile, sbc, ucs2, code); result != 0) return result;
@@ -1377,39 +1802,35 @@ int APS5_VABI sceCesUtf32leToSbc(const uint32_t* utf32, const uint8_t* profile,
 }
 
 int APS5_VABI sceCesUtf16StrToMbcsStr(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen) {
-    if (!mbcs) return CES_ERROR_INVALID_DST_BUFFER;
-    return toMbcs(context, utf16, utf16max, utf16Len, mbcs, mbcsMax, mbcsLen, decodeUtf16<NATIVE_BIG_ENDIAN>);
+    return convertString(context, utf16, utf16max, utf16Len, mbcs, mbcsMax, mbcsLen, false, unitSource<decodeUtf16<NATIVE_BIG_ENDIAN>, uint16_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesUtf16StrGetMbcsLen(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint32_t* mbcsLen) {
-    return toMbcs(context, utf16, utf16max, utf16Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, decodeUtf16<NATIVE_BIG_ENDIAN>);
+    return convertString(context, utf16, utf16max, utf16Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, true, unitSource<decodeUtf16<NATIVE_BIG_ENDIAN>, uint16_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesMbcsStrToUtf16Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
-    if (!utf16) return CES_ERROR_INVALID_DST_BUFFER;
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, utf16, utf16max, utf16Len, encodeUcs2);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, utf16, utf16max, utf16Len, false, decodeMbcs, unitTarget<encodeUtf16, uint16_t>);
 }
 
 int APS5_VABI sceCesMbcsStrGetUtf16Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf16Len) {
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, static_cast<uint16_t*>(nullptr), 0, utf16Len, encodeUcs2);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, static_cast<uint16_t*>(nullptr), 0, utf16Len, true, decodeMbcs, unitTarget<encodeUtf16, uint16_t>);
 }
 
 int APS5_VABI sceCesUtf32StrToMbcsStr(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen) {
-    if (!mbcs) return CES_ERROR_INVALID_DST_BUFFER;
-    return toMbcs(context, utf32, utf32max, utf32Len, mbcs, mbcsMax, mbcsLen, decodeUtf32);
+    return convertString(context, utf32, utf32max, utf32Len, mbcs, mbcsMax, mbcsLen, false, unitSource<decodeUtf32, uint32_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesUtf32StrGetMbcsLen(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint32_t* mbcsLen) {
-    return toMbcs(context, utf32, utf32max, utf32Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, decodeUtf32);
+    return convertString(context, utf32, utf32max, utf32Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, true, unitSource<decodeUtf32, uint32_t>, encodeMbcs);
 }
 
 int APS5_VABI sceCesMbcsStrToUtf32Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len) {
-    if (!utf32) return CES_ERROR_INVALID_DST_BUFFER;
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, utf32, utf32max, utf32Len, encodeUtf32);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, utf32, utf32max, utf32Len, false, decodeMbcs, unitTarget<encodeUtf32, uint32_t>);
 }
 
 int APS5_VABI sceCesMbcsStrGetUtf32Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32Len) {
-    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, static_cast<uint32_t*>(nullptr), 0, utf32Len, encodeUtf32);
+    return convertString(context, mbcs, mbcsMax, mbcsLen, static_cast<uint32_t*>(nullptr), 0, utf32Len, true, decodeMbcs, unitTarget<encodeUtf32, uint32_t>);
 }
 
 void* APS5_VABI sceCesUcsProfileInitEucCnGb2312(void* sheet) {
@@ -1424,6 +1845,18 @@ void* APS5_VABI sceCesUcsProfileInitGbkCp936(void* sheet) {
     return sheet;
 }
 
+void* APS5_VABI sceCesUcsProfileInitGb18030_2000(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, GB18030_2000_TAG, sizeof(GB18030_2000_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitGb18030_2005(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, GB18030_2005_TAG, sizeof(GB18030_2005_TAG));
+    return sheet;
+}
+
 int APS5_VABI sceCesEucCnToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2) {
     return profiledToUcs2(isEucCn, profile, eucBuffer, eucMax, eucSize, ucs2);
 }
@@ -1461,7 +1894,7 @@ int APS5_VABI sceCesUcs2ToEucCn(uint16_t ucs2, const void* profile, uint8_t* euc
 }
 
 int APS5_VABI sceCesUtf8ToEucCn(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
-    return bufferToProfiled(isEucCn, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeUtf8);
+    return bufferToProfiled(isEucCn, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeScalarUtf8);
 }
 
 int APS5_VABI sceCesUtf16ToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
@@ -1489,67 +1922,247 @@ int APS5_VABI sceCesUtf32leToEucCn(const uint32_t* utf32, const void* profile, u
 }
 
 int APS5_VABI sceCesGbToUcs2(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* ucs2) {
-    return profiledToUcs2(isGbk, profile, gbBuffer, gbMax, gbSize, ucs2);
+    return profiledToUcs2(isGb, profile, gbBuffer, gbMax, gbSize, ucs2);
 }
 
 int APS5_VABI sceCesGbToUtf8(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
-    return profiledToUtf8(isGbk, profile, gbBuffer, gbMax, gbSize, utf8Buffer, utf8Max, utf8Length);
+    return profiledToUtf8(isGb, profile, gbBuffer, gbMax, gbSize, utf8Buffer, utf8Max, utf8Length);
 }
 
 int APS5_VABI sceCesGbToUtf16(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
-    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isGbk, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isGb, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
 }
 
 int APS5_VABI sceCesGbToUtf16be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
-    return profiledToUtf16<true>(isGbk, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
+    return profiledToUtf16<true>(isGb, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
 }
 
 int APS5_VABI sceCesGbToUtf16le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
-    return profiledToUtf16<false>(isGbk, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
+    return profiledToUtf16<false>(isGb, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
 }
 
 int APS5_VABI sceCesGbToUtf32(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32) {
-    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isGbk, profile, gbBuffer, gbMax, gbSize, utf32);
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isGb, profile, gbBuffer, gbMax, gbSize, utf32);
 }
 
 int APS5_VABI sceCesGbToUtf32be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32) {
-    return profiledToUtf32<true>(isGbk, profile, gbBuffer, gbMax, gbSize, utf32);
+    return profiledToUtf32<true>(isGb, profile, gbBuffer, gbMax, gbSize, utf32);
 }
 
 int APS5_VABI sceCesGbToUtf32le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32) {
-    return profiledToUtf32<false>(isGbk, profile, gbBuffer, gbMax, gbSize, utf32);
+    return profiledToUtf32<false>(isGb, profile, gbBuffer, gbMax, gbSize, utf32);
 }
 
 int APS5_VABI sceCesUcs2ToGb(uint16_t ucs2, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return scalarToProfiled(isGbk, ucs2, profile, gbBuffer, gbMax, gbSize);
+    return scalarToProfiled(isGb, ucs2, profile, gbBuffer, gbMax, gbSize);
 }
 
 int APS5_VABI sceCesUtf8ToGb(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return bufferToProfiled(isGbk, utf8Buffer, utf8Max, utf8Length, profile, gbBuffer, gbMax, gbSize, decodeUtf8);
+    return bufferToProfiled(isGb, utf8Buffer, utf8Max, utf8Length, profile, gbBuffer, gbMax, gbSize, decodeScalarUtf8);
 }
 
 int APS5_VABI sceCesUtf16ToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return bufferToProfiled(isGbk, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+    return bufferToProfiled(isGb, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
 }
 
 int APS5_VABI sceCesUtf16beToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return bufferToProfiled(isGbk, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<true>);
+    return bufferToProfiled(isGb, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<true>);
 }
 
 int APS5_VABI sceCesUtf16leToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return bufferToProfiled(isGbk, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<false>);
+    return bufferToProfiled(isGb, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<false>);
 }
 
 int APS5_VABI sceCesUtf32ToGb(uint32_t utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return scalarToProfiled(isGbk, utf32, profile, gbBuffer, gbMax, gbSize);
+    return scalarToProfiled(isGb, utf32, profile, gbBuffer, gbMax, gbSize);
 }
 
 int APS5_VABI sceCesUtf32beToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return utf32ToProfiled<true>(isGbk, utf32, profile, gbBuffer, gbMax, gbSize);
+    return utf32ToProfiled<true>(isGb, utf32, profile, gbBuffer, gbMax, gbSize);
 }
 
 int APS5_VABI sceCesUtf32leToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
-    return utf32ToProfiled<false>(isGbk, utf32, profile, gbBuffer, gbMax, gbSize);
+    return utf32ToProfiled<false>(isGb, utf32, profile, gbBuffer, gbMax, gbSize);
+}
+
+int APS5_VABI sceCesEucKrToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2) {
+    return profiledToUcs2(isEucKr, profile, eucBuffer, eucMax, eucSize, ucs2);
+}
+
+int APS5_VABI sceCesEucKrToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucKrToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucKrToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucKrToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucKrToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucKrToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesUhcToUcs2(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* ucs2) {
+    return profiledToUcs2(isUhc, profile, uhcBuffer, uhcMax, uhcSize, ucs2);
+}
+
+int APS5_VABI sceCesUhcToUtf16(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesUhcToUtf16be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesUhcToUtf16le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesUhcToUtf32(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf32);
+}
+
+int APS5_VABI sceCesUhcToUtf32be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf32);
+}
+
+int APS5_VABI sceCesUhcToUtf32le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf32);
+}
+
+int APS5_VABI sceCesBig5ToUcs2(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* ucs2) {
+    return profiledToUcs2(isBig5, profile, big5Buffer, big5Max, big5Size, ucs2);
+}
+
+int APS5_VABI sceCesBig5ToUtf16(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isBig5, profile, big5Buffer, big5Max, big5Size, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesBig5ToUtf16be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isBig5, profile, big5Buffer, big5Max, big5Size, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesBig5ToUtf16le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isBig5, profile, big5Buffer, big5Max, big5Size, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesBig5ToUtf32(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isBig5, profile, big5Buffer, big5Max, big5Size, utf32);
+}
+
+int APS5_VABI sceCesBig5ToUtf32be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32) {
+    return profiledToUtf32<true>(isBig5, profile, big5Buffer, big5Max, big5Size, utf32);
+}
+
+int APS5_VABI sceCesBig5ToUtf32le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32) {
+    return profiledToUtf32<false>(isBig5, profile, big5Buffer, big5Max, big5Size, utf32);
+}
+
+int APS5_VABI sceCesUcs2ToEucKr(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucKr, ucs2, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf8ToEucKr(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeScalarUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToEucKr(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucKr, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32beToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<true>(isEucKr, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32leToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<false>(isEucKr, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUcs2ToUhc(uint16_t ucs2, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return scalarToProfiled(isUhc, ucs2, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUtf8ToUhc(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf8Buffer, utf8Max, utf8Length, profile, uhcBuffer, uhcMax, uhcSize, decodeScalarUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf16Buffer, utf16Max, utf16Length, profile, uhcBuffer, uhcMax, uhcSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf16Buffer, utf16Max, utf16Length, profile, uhcBuffer, uhcMax, uhcSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf16Buffer, utf16Max, utf16Length, profile, uhcBuffer, uhcMax, uhcSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToUhc(uint32_t utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return scalarToProfiled(isUhc, utf32, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUtf32beToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return utf32ToProfiled<true>(isUhc, utf32, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUtf32leToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return utf32ToProfiled<false>(isUhc, utf32, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUcs2ToBig5(uint16_t ucs2, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return scalarToProfiled(isBig5, ucs2, profile, big5Buffer, big5Max, big5Size);
+}
+
+int APS5_VABI sceCesUtf8ToBig5(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf8Buffer, utf8Max, utf8Length, profile, big5Buffer, big5Max, big5Size, decodeScalarUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf16Buffer, utf16Max, utf16Length, profile, big5Buffer, big5Max, big5Size, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf16Buffer, utf16Max, utf16Length, profile, big5Buffer, big5Max, big5Size, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf16Buffer, utf16Max, utf16Length, profile, big5Buffer, big5Max, big5Size, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToBig5(uint32_t utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return scalarToProfiled(isBig5, utf32, profile, big5Buffer, big5Max, big5Size);
+}
+
+int APS5_VABI sceCesUtf32beToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return utf32ToProfiled<true>(isBig5, utf32, profile, big5Buffer, big5Max, big5Size);
+}
+
+int APS5_VABI sceCesUtf32leToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return utf32ToProfiled<false>(isBig5, utf32, profile, big5Buffer, big5Max, big5Size);
 }
 
 }
diff --git a/core/libs/prx/libSceCesCs/Gb18030.hpp b/core/libs/prx/libSceCesCs/Gb18030.hpp
new file mode 100644
index 0000000000..5f13d60813
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/Gb18030.hpp
@@ -0,0 +1,135 @@
+#pragma once
+
+#include <cstdint>
+
+namespace Gb18030 {
+
+inline constexpr uint32_t TWO_BYTE_2000[111][3] = {
+    {0x17C0, 0xE4C6, 0x60}, {0x187E, 0xE526, 0x60}, {0x18E8, 0xE766, 0x6}, {0x1920, 0x20AC, 0x1}, {0x1921, 0xE76D, 0x1}, {0x192C, 0xE76E, 0x2},
+    {0x193A, 0xE770, 0x2}, {0x193C, 0xE586, 0x60}, {0x19FA, 0xE5E6, 0x60}, {0x1AAD, 0xE772, 0xB}, {0x1AB8, 0xE646, 0x60}, {0x1B6E, 0xE77D, 0x8},
+    {0x1B76, 0xE6A6, 0x60}, {0x1BEE, 0xE785, 0x8}, {0x1C0E, 0xE78D, 0x7}, {0x1C21, 0xE794, 0x2}, {0x1C28, 0xE796, 0x1}, {0x1C2B, 0xE797, 0x9},
+    {0x1C34, 0xE706, 0x60}, {0x1CB5, 0xE7A0, 0xF}, {0x1CE5, 0xE7AF, 0xD}, {0x1D47, 0xE7BC, 0xB}, {0x1D6D, 0xE7C7, 0x1}, {0x1D70, 0x1F9, 0x1},
+    {0x1D72, 0xE7C9, 0x4}, {0x1D9B, 0xE7CD, 0x15}, {0x1DC8, 0xE7E2, 0x1}, {0x1DCB, 0xE7E3, 0x1}, {0x1DCD, 0xE7E4, 0x3}, {0x1DF8, 0x303E, 0x1},
+    {0x1DF9, 0x2FF0, 0xC}, {0x1E06, 0xE7F4, 0xD}, {0x1E5F, 0xE801, 0xF}, {0x1ECE, 0xE000, 0x5E}, {0x1F8C, 0xE05E, 0x5E}, {0x204A, 0xE0BC, 0x5E},
+    {0x2108, 0xE11A, 0x5E}, {0x21C6, 0xE178, 0x5E}, {0x2284, 0xE1D6, 0x5E}, {0x408D, 0xE810, 0x5}, {0x58B2, 0xE234, 0x5E}, {0x5970, 0xE292, 0x5E},
+    {0x5A2E, 0xE2F0, 0x5E}, {0x5AEC, 0xE34E, 0x5E}, {0x5BAA, 0xE3AC, 0x5E}, {0x5C68, 0xE40A, 0x5E}, {0x5CD6, 0x2E81, 0x1}, {0x5CD7, 0xE816, 0x3},
+    {0x5CDA, 0x2E84, 0x1}, {0x5CDB, 0x3473, 0x1}, {0x5CDC, 0x3447, 0x1}, {0x5CDD, 0x2E88, 0x1}, {0x5CDE, 0x2E8B, 0x1}, {0x5CDF, 0xE81E, 0x1},
+    {0x5CE0, 0x359E, 0x1}, {0x5CE1, 0x361A, 0x1}, {0x5CE2, 0x360E, 0x1}, {0x5CE3, 0x2E8C, 0x1}, {0x5CE4, 0x2E97, 0x1}, {0x5CE5, 0x396E, 0x1},
+    {0x5CE6, 0x3918, 0x1}, {0x5CE7, 0xE826, 0x1}, {0x5CE8, 0x39CF, 0x1}, {0x5CE9, 0x39DF, 0x1}, {0x5CEA, 0x3A73, 0x1}, {0x5CEB, 0x39D0, 0x1},
+    {0x5CEC, 0xE82B, 0x2}, {0x5CEE, 0x3B4E, 0x1}, {0x5CEF, 0x3C6E, 0x1}, {0x5CF0, 0x3CE0, 0x1}, {0x5CF1, 0x2EA7, 0x1}, {0x5CF2, 0xE831, 0x2},
+    {0x5CF4, 0x2EAA, 0x1}, {0x5CF5, 0x4056, 0x1}, {0x5CF6, 0x415F, 0x1}, {0x5CF7, 0x2EAE, 0x1}, {0x5CF8, 0x4337, 0x1}, {0x5CF9, 0x2EB3, 0x1},
+    {0x5CFA, 0x2EB6, 0x2}, {0x5CFC, 0xE83B, 0x1}, {0x5CFD, 0x43B1, 0x1}, {0x5CFE, 0x43AC, 0x1}, {0x5CFF, 0x2EBB, 0x1}, {0x5D00, 0x43DD, 0x1},
+    {0x5D01, 0x44D6, 0x1}, {0x5D02, 0x4661, 0x1}, {0x5D03, 0x464C, 0x1}, {0x5D04, 0xE843, 0x1}, {0x5D05, 0x4723, 0x1}, {0x5D06, 0x4729, 0x1},
+    {0x5D07, 0x477C, 0x1}, {0x5D08, 0x478D, 0x1}, {0x5D09, 0x2ECA, 0x1}, {0x5D0A, 0x4947, 0x1}, {0x5D0B, 0x497A, 0x1}, {0x5D0C, 0x497D, 0x1},
+    {0x5D0D, 0x4982, 0x2}, {0x5D0F, 0x4985, 0x2}, {0x5D11, 0x499F, 0x1}, {0x5D12, 0x499B, 0x1}, {0x5D13, 0x49B7, 0x1}, {0x5D14, 0x49B6, 0x1},
+    {0x5D15, 0xE854, 0x2}, {0x5D17, 0x4CA3, 0x1}, {0x5D18, 0x4C9F, 0x3}, {0x5D1B, 0x4C77, 0x1}, {0x5D1C, 0x4CA2, 0x1}, {0x5D1D, 0x4D13, 0x7},
+    {0x5D24, 0x4DAE, 0x1}, {0x5D25, 0xE864, 0x1}, {0x5D26, 0xE468, 0x5E},
+};
+
+inline constexpr uint32_t FOUR_BYTE_2000[207][3] = {
+    {0x0, 0x80, 0x24}, {0x24, 0xA5, 0x2}, {0x26, 0xA9, 0x7}, {0x2D, 0xB2, 0x5}, {0x32, 0xB8, 0x1F}, {0x51, 0xD8, 0x8},
+    {0x59, 0xE2, 0x6}, {0x5F, 0xEB, 0x1}, {0x60, 0xEE, 0x4}, {0x64, 0xF4, 0x3}, {0x67, 0xF8, 0x1}, {0x68, 0xFB, 0x1},
+    {0x69, 0xFD, 0x4}, {0x6D, 0x102, 0x11}, {0x7E, 0x114, 0x7}, {0x85, 0x11C, 0xF}, {0x94, 0x12C, 0x18}, {0xAC, 0x145, 0x3},
+    {0xAF, 0x149, 0x4}, {0xB3, 0x14E, 0x1D}, {0xD0, 0x16C, 0x62}, {0x132, 0x1CF, 0x1}, {0x133, 0x1D1, 0x1}, {0x134, 0x1D3, 0x1},
+    {0x135, 0x1D5, 0x1}, {0x136, 0x1D7, 0x1}, {0x137, 0x1D9, 0x1}, {0x138, 0x1DB, 0x1}, {0x139, 0x1DD, 0x1C}, {0x155, 0x1FA, 0x57},
+    {0x1AC, 0x252, 0xF}, {0x1BB, 0x262, 0x65}, {0x220, 0x2C8, 0x1}, {0x221, 0x2CC, 0xD}, {0x22E, 0x2DA, 0xB7}, {0x2E5, 0x3A2, 0x1},
+    {0x2E6, 0x3AA, 0x7}, {0x2ED, 0x3C2, 0x1}, {0x2EE, 0x3CA, 0x37}, {0x325, 0x402, 0xE}, {0x333, 0x450, 0x1}, {0x334, 0x452, 0x1BBE},
+    {0x1EF2, 0x2011, 0x2}, {0x1EF4, 0x2017, 0x1}, {0x1EF5, 0x201A, 0x2}, {0x1EF7, 0x201E, 0x7}, {0x1EFE, 0x2027, 0x9}, {0x1F07, 0x2031, 0x1},
+    {0x1F08, 0x2034, 0x1}, {0x1F09, 0x2036, 0x5}, {0x1F0E, 0x203C, 0x70}, {0x1F7E, 0x20AD, 0x56}, {0x1FD4, 0x2104, 0x1}, {0x1FD5, 0x2106, 0x3},
+    {0x1FD8, 0x210A, 0xC}, {0x1FE4, 0x2117, 0xA}, {0x1FEE, 0x2122, 0x3E}, {0x202C, 0x216C, 0x4}, {0x2030, 0x217A, 0x16}, {0x2046, 0x2194, 0x2},
+    {0x2048, 0x219A, 0x6E}, {0x20B6, 0x2209, 0x6}, {0x20BC, 0x2210, 0x1}, {0x20BD, 0x2212, 0x3}, {0x20C0, 0x2216, 0x4}, {0x20C4, 0x221B, 0x2},
+    {0x20C6, 0x2221, 0x2}, {0x20C8, 0x2224, 0x1}, {0x20C9, 0x2226, 0x1}, {0x20CA, 0x222C, 0x2}, {0x20CC, 0x222F, 0x5}, {0x20D1, 0x2238, 0x5},
+    {0x20D6, 0x223E, 0xA}, {0x20E0, 0x2249, 0x3}, {0x20E3, 0x224D, 0x5}, {0x20E8, 0x2253, 0xD}, {0x20F5, 0x2262, 0x2}, {0x20F7, 0x2268, 0x6},
+    {0x20FD, 0x2270, 0x25}, {0x2122, 0x2296, 0x3}, {0x2125, 0x229A, 0xB}, {0x2130, 0x22A6, 0x19}, {0x2149, 0x22C0, 0x52}, {0x219B, 0x2313, 0x14D},
+    {0x22E8, 0x246A, 0xA}, {0x22F2, 0x249C, 0x64}, {0x2356, 0x254C, 0x4}, {0x235A, 0x2574, 0xD}, {0x2367, 0x2590, 0x3}, {0x236A, 0x2596, 0xA},
+    {0x2374, 0x25A2, 0x10}, {0x2384, 0x25B4, 0x8}, {0x238C, 0x25BE, 0x8}, {0x2394, 0x25C8, 0x3}, {0x2397, 0x25CC, 0x2}, {0x2399, 0x25D0, 0x12},
+    {0x23AB, 0x25E6, 0x1F}, {0x23CA, 0x2607, 0x2}, {0x23CC, 0x260A, 0x36}, {0x2402, 0x2641, 0x1}, {0x2403, 0x2643, 0x83E}, {0x2C41, 0x2E82, 0x2},
+    {0x2C43, 0x2E85, 0x3}, {0x2C46, 0x2E89, 0x2}, {0x2C48, 0x2E8D, 0xA}, {0x2C52, 0x2E98, 0xF}, {0x2C61, 0x2EA8, 0x2}, {0x2C63, 0x2EAB, 0x3},
+    {0x2C66, 0x2EAF, 0x4}, {0x2C6A, 0x2EB4, 0x2}, {0x2C6C, 0x2EB8, 0x3}, {0x2C6F, 0x2EBC, 0xE}, {0x2C7D, 0x2ECB, 0x125}, {0x2DA2, 0x2FFC, 0x4},
+    {0x2DA6, 0x3004, 0x1}, {0x2DA7, 0x3018, 0x5}, {0x2DAC, 0x301F, 0x2}, {0x2DAE, 0x302A, 0x14}, {0x2DC2, 0x303F, 0x2}, {0x2DC4, 0x3094, 0x7},
+    {0x2DCB, 0x309F, 0x2}, {0x2DCD, 0x30F7, 0x5}, {0x2DD2, 0x30FF, 0x6}, {0x2DD8, 0x312A, 0xF6}, {0x2ECE, 0x322A, 0x7}, {0x2ED5, 0x3232, 0x71},
+    {0x2F46, 0x32A4, 0xEA}, {0x3030, 0x3390, 0xC}, {0x303C, 0x339F, 0x2}, {0x303E, 0x33A2, 0x22}, {0x3060, 0x33C5, 0x9}, {0x3069, 0x33CF, 0x2},
+    {0x306B, 0x33D3, 0x2}, {0x306D, 0x33D6, 0x71}, {0x30DE, 0x3448, 0x2B}, {0x3109, 0x3474, 0x12A}, {0x3233, 0x359F, 0x6F}, {0x32A2, 0x360F, 0xB},
+    {0x32AD, 0x361B, 0x2FD}, {0x35AA, 0x3919, 0x55}, {0x35FF, 0x396F, 0x60}, {0x365F, 0x39D1, 0xE}, {0x366D, 0x39E0, 0x93}, {0x3700, 0x3A74, 0xDA},
+    {0x37DA, 0x3B4F, 0x11F}, {0x38F9, 0x3C6F, 0x71}, {0x396A, 0x3CE1, 0x375}, {0x3CDF, 0x4057, 0x108}, {0x3DE7, 0x4160, 0x1D7}, {0x3FBE, 0x4338, 0x74},
+    {0x4032, 0x43AD, 0x4}, {0x4036, 0x43B2, 0x2B}, {0x4061, 0x43DE, 0xF8}, {0x4159, 0x44D7, 0x175}, {0x42CE, 0x464D, 0x14}, {0x42E2, 0x4662, 0xC1},
+    {0x43A3, 0x4724, 0x5}, {0x43A8, 0x472A, 0x52}, {0x43FA, 0x477D, 0x10}, {0x440A, 0x478E, 0x1B9}, {0x45C3, 0x4948, 0x32}, {0x45F5, 0x497B, 0x2},
+    {0x45F7, 0x497E, 0x4}, {0x45FB, 0x4984, 0x1}, {0x45FC, 0x4987, 0x14}, {0x4610, 0x499C, 0x3}, {0x4613, 0x49A0, 0x16}, {0x4629, 0x49B8, 0x2BF},
+    {0x48E8, 0x4C78, 0x27}, {0x490F, 0x4CA4, 0x6F}, {0x497E, 0x4D1A, 0x94}, {0x4A12, 0x4DAF, 0x51}, {0x4A63, 0x9FA6, 0x385A}, {0x82BD, 0xE76C, 0x1},
+    {0x82BE, 0xE7C8, 0x1}, {0x82BF, 0xE7E7, 0xD}, {0x82CC, 0xE815, 0x1}, {0x82CD, 0xE819, 0x5}, {0x82D2, 0xE81F, 0x7}, {0x82D9, 0xE827, 0x4},
+    {0x82DD, 0xE82D, 0x4}, {0x82E1, 0xE833, 0x8}, {0x82E9, 0xE83C, 0x7}, {0x82F0, 0xE844, 0x10}, {0x8300, 0xE856, 0xE}, {0x830E, 0xE865, 0x10C7},
+    {0x93D5, 0xF92D, 0x4C}, {0x9421, 0xF97A, 0x1B}, {0x943C, 0xF996, 0x51}, {0x948D, 0xF9E8, 0x9}, {0x9496, 0xF9F2, 0x1A}, {0x94B0, 0xFA10, 0x1},
+    {0x94B1, 0xFA12, 0x1}, {0x94B2, 0xFA15, 0x3}, {0x94B5, 0xFA19, 0x6}, {0x94BB, 0xFA22, 0x1}, {0x94BC, 0xFA25, 0x2}, {0x94BE, 0xFA2A, 0x406},
+    {0x98C4, 0xFE32, 0x1}, {0x98C5, 0xFE45, 0x4}, {0x98C9, 0xFE53, 0x1}, {0x98CA, 0xFE58, 0x1}, {0x98CB, 0xFE67, 0x1}, {0x98CC, 0xFE6C, 0x95},
+    {0x9961, 0xFF5F, 0x81}, {0x99E2, 0xFFE6, 0x1A}, {0x2E248, 0x10000, 0x100000},
+};
+
+inline constexpr uint32_t TWO_BYTE_2005[118][3] = {
+    {0x17C0, 0xE4C6, 0x60}, {0x187E, 0xE526, 0x60}, {0x18E8, 0xE766, 0x6}, {0x1920, 0x20AC, 0x1}, {0x1921, 0xE76D, 0x1}, {0x192C, 0xE76E, 0x2},
+    {0x193A, 0xE770, 0x2}, {0x193C, 0xE586, 0x60}, {0x19FA, 0xE5E6, 0x60}, {0x1AAD, 0xE772, 0xB}, {0x1AB8, 0xE646, 0x60}, {0x1B6E, 0xE77D, 0x8},
+    {0x1B76, 0xE6A6, 0x60}, {0x1BEE, 0xE785, 0x8}, {0x1C0E, 0xFE10, 0x1}, {0x1C0F, 0xFE12, 0x1}, {0x1C10, 0xFE11, 0x1}, {0x1C11, 0xFE13, 0x4},
+    {0x1C21, 0xFE17, 0x2}, {0x1C28, 0xFE19, 0x1}, {0x1C2B, 0xE797, 0x9}, {0x1C34, 0xE706, 0x60}, {0x1CB5, 0xE7A0, 0xF}, {0x1CE5, 0xE7AF, 0xD},
+    {0x1D47, 0xE7BC, 0xB}, {0x1D6D, 0x1E3F, 0x1}, {0x1D70, 0x1F9, 0x1}, {0x1D72, 0xE7C9, 0x4}, {0x1D9B, 0xE7CD, 0x15}, {0x1DC8, 0xE7E2, 0x1},
+    {0x1DCB, 0xE7E3, 0x1}, {0x1DCD, 0xE7E4, 0x3}, {0x1DF8, 0x303E, 0x1}, {0x1DF9, 0x2FF0, 0xC}, {0x1E06, 0xE7F4, 0xD}, {0x1E5F, 0xE801, 0xF},
+    {0x1ECE, 0xE000, 0x5E}, {0x1F8C, 0xE05E, 0x5E}, {0x204A, 0xE0BC, 0x5E}, {0x2108, 0xE11A, 0x5E}, {0x21C6, 0xE178, 0x5E}, {0x2284, 0xE1D6, 0x5E},
+    {0x408D, 0xE810, 0x5}, {0x58B2, 0xE234, 0x5E}, {0x5970, 0xE292, 0x5E}, {0x5A2E, 0xE2F0, 0x5E}, {0x5AEC, 0xE34E, 0x5E}, {0x5BAA, 0xE3AC, 0x5E},
+    {0x5C68, 0xE40A, 0x5E}, {0x5CD6, 0x2E81, 0x1}, {0x5CD7, 0x20087, 0x1}, {0x5CD8, 0x20089, 0x1}, {0x5CD9, 0x200CC, 0x1}, {0x5CDA, 0x2E84, 0x1},
+    {0x5CDB, 0x3473, 0x1}, {0x5CDC, 0x3447, 0x1}, {0x5CDD, 0x2E88, 0x1}, {0x5CDE, 0x2E8B, 0x1}, {0x5CDF, 0x9FB4, 0x1}, {0x5CE0, 0x359E, 0x1},
+    {0x5CE1, 0x361A, 0x1}, {0x5CE2, 0x360E, 0x1}, {0x5CE3, 0x2E8C, 0x1}, {0x5CE4, 0x2E97, 0x1}, {0x5CE5, 0x396E, 0x1}, {0x5CE6, 0x3918, 0x1},
+    {0x5CE7, 0x9FB5, 0x1}, {0x5CE8, 0x39CF, 0x1}, {0x5CE9, 0x39DF, 0x1}, {0x5CEA, 0x3A73, 0x1}, {0x5CEB, 0x39D0, 0x1}, {0x5CEC, 0x9FB6, 0x2},
+    {0x5CEE, 0x3B4E, 0x1}, {0x5CEF, 0x3C6E, 0x1}, {0x5CF0, 0x3CE0, 0x1}, {0x5CF1, 0x2EA7, 0x1}, {0x5CF2, 0x215D7, 0x1}, {0x5CF3, 0x9FB8, 0x1},
+    {0x5CF4, 0x2EAA, 0x1}, {0x5CF5, 0x4056, 0x1}, {0x5CF6, 0x415F, 0x1}, {0x5CF7, 0x2EAE, 0x1}, {0x5CF8, 0x4337, 0x1}, {0x5CF9, 0x2EB3, 0x1},
+    {0x5CFA, 0x2EB6, 0x2}, {0x5CFC, 0x2298F, 0x1}, {0x5CFD, 0x43B1, 0x1}, {0x5CFE, 0x43AC, 0x1}, {0x5CFF, 0x2EBB, 0x1}, {0x5D00, 0x43DD, 0x1},
+    {0x5D01, 0x44D6, 0x1}, {0x5D02, 0x4661, 0x1}, {0x5D03, 0x464C, 0x1}, {0x5D04, 0x9FB9, 0x1}, {0x5D05, 0x4723, 0x1}, {0x5D06, 0x4729, 0x1},
+    {0x5D07, 0x477C, 0x1}, {0x5D08, 0x478D, 0x1}, {0x5D09, 0x2ECA, 0x1}, {0x5D0A, 0x4947, 0x1}, {0x5D0B, 0x497A, 0x1}, {0x5D0C, 0x497D, 0x1},
+    {0x5D0D, 0x4982, 0x2}, {0x5D0F, 0x4985, 0x2}, {0x5D11, 0x499F, 0x1}, {0x5D12, 0x499B, 0x1}, {0x5D13, 0x49B7, 0x1}, {0x5D14, 0x49B6, 0x1},
+    {0x5D15, 0x9FBA, 0x1}, {0x5D16, 0x241FE, 0x1}, {0x5D17, 0x4CA3, 0x1}, {0x5D18, 0x4C9F, 0x3}, {0x5D1B, 0x4C77, 0x1}, {0x5D1C, 0x4CA2, 0x1},
+    {0x5D1D, 0x4D13, 0x7}, {0x5D24, 0x4DAE, 0x1}, {0x5D25, 0x9FBB, 0x1}, {0x5D26, 0xE468, 0x5E},
+};
+
+inline constexpr uint32_t FOUR_BYTE_2005[209][3] = {
+    {0x0, 0x80, 0x24}, {0x24, 0xA5, 0x2}, {0x26, 0xA9, 0x7}, {0x2D, 0xB2, 0x5}, {0x32, 0xB8, 0x1F}, {0x51, 0xD8, 0x8},
+    {0x59, 0xE2, 0x6}, {0x5F, 0xEB, 0x1}, {0x60, 0xEE, 0x4}, {0x64, 0xF4, 0x3}, {0x67, 0xF8, 0x1}, {0x68, 0xFB, 0x1},
+    {0x69, 0xFD, 0x4}, {0x6D, 0x102, 0x11}, {0x7E, 0x114, 0x7}, {0x85, 0x11C, 0xF}, {0x94, 0x12C, 0x18}, {0xAC, 0x145, 0x3},
+    {0xAF, 0x149, 0x4}, {0xB3, 0x14E, 0x1D}, {0xD0, 0x16C, 0x62}, {0x132, 0x1CF, 0x1}, {0x133, 0x1D1, 0x1}, {0x134, 0x1D3, 0x1},
+    {0x135, 0x1D5, 0x1}, {0x136, 0x1D7, 0x1}, {0x137, 0x1D9, 0x1}, {0x138, 0x1DB, 0x1}, {0x139, 0x1DD, 0x1C}, {0x155, 0x1FA, 0x57},
+    {0x1AC, 0x252, 0xF}, {0x1BB, 0x262, 0x65}, {0x220, 0x2C8, 0x1}, {0x221, 0x2CC, 0xD}, {0x22E, 0x2DA, 0xB7}, {0x2E5, 0x3A2, 0x1},
+    {0x2E6, 0x3AA, 0x7}, {0x2ED, 0x3C2, 0x1}, {0x2EE, 0x3CA, 0x37}, {0x325, 0x402, 0xE}, {0x333, 0x450, 0x1}, {0x334, 0x452, 0x19ED},
+    {0x1D21, 0xE7C7, 0x1}, {0x1D22, 0x1E40, 0x1D0}, {0x1EF2, 0x2011, 0x2}, {0x1EF4, 0x2017, 0x1}, {0x1EF5, 0x201A, 0x2}, {0x1EF7, 0x201E, 0x7},
+    {0x1EFE, 0x2027, 0x9}, {0x1F07, 0x2031, 0x1}, {0x1F08, 0x2034, 0x1}, {0x1F09, 0x2036, 0x5}, {0x1F0E, 0x203C, 0x70}, {0x1F7E, 0x20AD, 0x56},
+    {0x1FD4, 0x2104, 0x1}, {0x1FD5, 0x2106, 0x3}, {0x1FD8, 0x210A, 0xC}, {0x1FE4, 0x2117, 0xA}, {0x1FEE, 0x2122, 0x3E}, {0x202C, 0x216C, 0x4},
+    {0x2030, 0x217A, 0x16}, {0x2046, 0x2194, 0x2}, {0x2048, 0x219A, 0x6E}, {0x20B6, 0x2209, 0x6}, {0x20BC, 0x2210, 0x1}, {0x20BD, 0x2212, 0x3},
+    {0x20C0, 0x2216, 0x4}, {0x20C4, 0x221B, 0x2}, {0x20C6, 0x2221, 0x2}, {0x20C8, 0x2224, 0x1}, {0x20C9, 0x2226, 0x1}, {0x20CA, 0x222C, 0x2},
+    {0x20CC, 0x222F, 0x5}, {0x20D1, 0x2238, 0x5}, {0x20D6, 0x223E, 0xA}, {0x20E0, 0x2249, 0x3}, {0x20E3, 0x224D, 0x5}, {0x20E8, 0x2253, 0xD},
+    {0x20F5, 0x2262, 0x2}, {0x20F7, 0x2268, 0x6}, {0x20FD, 0x2270, 0x25}, {0x2122, 0x2296, 0x3}, {0x2125, 0x229A, 0xB}, {0x2130, 0x22A6, 0x19},
+    {0x2149, 0x22C0, 0x52}, {0x219B, 0x2313, 0x14D}, {0x22E8, 0x246A, 0xA}, {0x22F2, 0x249C, 0x64}, {0x2356, 0x254C, 0x4}, {0x235A, 0x2574, 0xD},
+    {0x2367, 0x2590, 0x3}, {0x236A, 0x2596, 0xA}, {0x2374, 0x25A2, 0x10}, {0x2384, 0x25B4, 0x8}, {0x238C, 0x25BE, 0x8}, {0x2394, 0x25C8, 0x3},
+    {0x2397, 0x25CC, 0x2}, {0x2399, 0x25D0, 0x12}, {0x23AB, 0x25E6, 0x1F}, {0x23CA, 0x2607, 0x2}, {0x23CC, 0x260A, 0x36}, {0x2402, 0x2641, 0x1},
+    {0x2403, 0x2643, 0x83E}, {0x2C41, 0x2E82, 0x2}, {0x2C43, 0x2E85, 0x3}, {0x2C46, 0x2E89, 0x2}, {0x2C48, 0x2E8D, 0xA}, {0x2C52, 0x2E98, 0xF},
+    {0x2C61, 0x2EA8, 0x2}, {0x2C63, 0x2EAB, 0x3}, {0x2C66, 0x2EAF, 0x4}, {0x2C6A, 0x2EB4, 0x2}, {0x2C6C, 0x2EB8, 0x3}, {0x2C6F, 0x2EBC, 0xE},
+    {0x2C7D, 0x2ECB, 0x125}, {0x2DA2, 0x2FFC, 0x4}, {0x2DA6, 0x3004, 0x1}, {0x2DA7, 0x3018, 0x5}, {0x2DAC, 0x301F, 0x2}, {0x2DAE, 0x302A, 0x14},
+    {0x2DC2, 0x303F, 0x2}, {0x2DC4, 0x3094, 0x7}, {0x2DCB, 0x309F, 0x2}, {0x2DCD, 0x30F7, 0x5}, {0x2DD2, 0x30FF, 0x6}, {0x2DD8, 0x312A, 0xF6},
+    {0x2ECE, 0x322A, 0x7}, {0x2ED5, 0x3232, 0x71}, {0x2F46, 0x32A4, 0xEA}, {0x3030, 0x3390, 0xC}, {0x303C, 0x339F, 0x2}, {0x303E, 0x33A2, 0x22},
+    {0x3060, 0x33C5, 0x9}, {0x3069, 0x33CF, 0x2}, {0x306B, 0x33D3, 0x2}, {0x306D, 0x33D6, 0x71}, {0x30DE, 0x3448, 0x2B}, {0x3109, 0x3474, 0x12A},
+    {0x3233, 0x359F, 0x6F}, {0x32A2, 0x360F, 0xB}, {0x32AD, 0x361B, 0x2FD}, {0x35AA, 0x3919, 0x55}, {0x35FF, 0x396F, 0x60}, {0x365F, 0x39D1, 0xE},
+    {0x366D, 0x39E0, 0x93}, {0x3700, 0x3A74, 0xDA}, {0x37DA, 0x3B4F, 0x11F}, {0x38F9, 0x3C6F, 0x71}, {0x396A, 0x3CE1, 0x375}, {0x3CDF, 0x4057, 0x108},
+    {0x3DE7, 0x4160, 0x1D7}, {0x3FBE, 0x4338, 0x74}, {0x4032, 0x43AD, 0x4}, {0x4036, 0x43B2, 0x2B}, {0x4061, 0x43DE, 0xF8}, {0x4159, 0x44D7, 0x175},
+    {0x42CE, 0x464D, 0x14}, {0x42E2, 0x4662, 0xC1}, {0x43A3, 0x4724, 0x5}, {0x43A8, 0x472A, 0x52}, {0x43FA, 0x477D, 0x10}, {0x440A, 0x478E, 0x1B9},
+    {0x45C3, 0x4948, 0x32}, {0x45F5, 0x497B, 0x2}, {0x45F7, 0x497E, 0x4}, {0x45FB, 0x4984, 0x1}, {0x45FC, 0x4987, 0x14}, {0x4610, 0x499C, 0x3},
+    {0x4613, 0x49A0, 0x16}, {0x4629, 0x49B8, 0x2BF}, {0x48E8, 0x4C78, 0x27}, {0x490F, 0x4CA4, 0x6F}, {0x497E, 0x4D1A, 0x94}, {0x4A12, 0x4DAF, 0x51},
+    {0x4A63, 0x9FA6, 0x385A}, {0x82BD, 0xE76C, 0x1}, {0x82BE, 0xE7C8, 0x1}, {0x82BF, 0xE7E7, 0xD}, {0x82CC, 0xE815, 0x1}, {0x82CD, 0xE819, 0x5},
+    {0x82D2, 0xE81F, 0x7}, {0x82D9, 0xE827, 0x4}, {0x82DD, 0xE82D, 0x4}, {0x82E1, 0xE833, 0x8}, {0x82E9, 0xE83C, 0x7}, {0x82F0, 0xE844, 0x10},
+    {0x8300, 0xE856, 0xE}, {0x830E, 0xE865, 0x10C7}, {0x93D5, 0xF92D, 0x4C}, {0x9421, 0xF97A, 0x1B}, {0x943C, 0xF996, 0x51}, {0x948D, 0xF9E8, 0x9},
+    {0x9496, 0xF9F2, 0x1A}, {0x94B0, 0xFA10, 0x1}, {0x94B1, 0xFA12, 0x1}, {0x94B2, 0xFA15, 0x3}, {0x94B5, 0xFA19, 0x6}, {0x94BB, 0xFA22, 0x1},
+    {0x94BC, 0xFA25, 0x2}, {0x94BE, 0xFA2A, 0x406}, {0x98C4, 0xFE32, 0x1}, {0x98C5, 0xFE45, 0x4}, {0x98C9, 0xFE53, 0x1}, {0x98CA, 0xFE58, 0x1},
+    {0x98CB, 0xFE67, 0x1}, {0x98CC, 0xFE6C, 0x95}, {0x9961, 0xFF5F, 0x81}, {0x99E2, 0xFFE6, 0x1A}, {0x2E248, 0x10000, 0x100000},
+};
+
+inline constexpr uint32_t FALLBACK_2005[24][2] = {
+    {0xE78D, 0x1C0E}, {0xE78E, 0x1C0F}, {0xE78F, 0x1C10}, {0xE790, 0x1C11}, {0xE791, 0x1C12}, {0xE792, 0x1C13},
+    {0xE793, 0x1C14}, {0xE794, 0x1C21}, {0xE795, 0x1C22}, {0xE796, 0x1C28}, {0xE816, 0x5CD7}, {0xE817, 0x5CD8},
+    {0xE818, 0x5CD9}, {0xE81E, 0x5CDF}, {0xE826, 0x5CE7}, {0xE82B, 0x5CEC}, {0xE82C, 0x5CED}, {0xE831, 0x5CF2},
+    {0xE832, 0x5CF3}, {0xE83B, 0x5CFC}, {0xE843, 0x5D04}, {0xE854, 0x5D15}, {0xE855, 0x5D16}, {0xE864, 0x5D25},
+};
+
+}
diff --git a/core/libs/prx/libSceCesCs/PendingExports.cpp b/core/libs/prx/libSceCesCs/PendingExports.cpp
index 2032dc8f49..ac98b0d50a 100644
--- a/core/libs/prx/libSceCesCs/PendingExports.cpp
+++ b/core/libs/prx/libSceCesCs/PendingExports.cpp
@@ -1,42 +1,8 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-int APS5_VABI sceCesBig5ToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesEucCnUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -47,41 +13,6 @@ int APS5_VABI sceCesEucJpUcsProfileSetSbcs(void) {
     return 0;
 }
 
-int APS5_VABI sceCesEucKrToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesEucKrUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -317,56 +248,11 @@ int APS5_VABI sceCesUcs2StrToIso2022Str(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUcs2ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcsProfileInitEucJis2004(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUcsProfileInitEucJpX0208(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2Ss3(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitGb18030_2000(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitGb18030_2005(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcsProfileInitIso2022JpCp50221(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -382,11 +268,6 @@ int APS5_VABI sceCesUcsProfileInitIso2022JpRfc1468(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUcsProfileInitSJis1997X0208(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcsProfileInitSJis2004X0213(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -397,41 +278,6 @@ int APS5_VABI sceCesUcsToJiscs(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUhcToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUhcUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -447,66 +293,6 @@ int APS5_VABI sceCesUtf16StrToIso2022Str(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUtf16ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf32StrGetIso2022Len(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -517,66 +303,6 @@ int APS5_VABI sceCesUtf32StrToIso2022Str(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUtf32ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf8StrGetIso2022Len(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -587,24 +313,4 @@ int APS5_VABI sceCesUtf8StrToIso2022Str(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUtf8ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToMbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 }
diff --git a/core/libs/prx/libSceCesCs/Unicode.cpp b/core/libs/prx/libSceCesCs/Unicode.cpp
index 5a4b10399b..45f36923ee 100644
--- a/core/libs/prx/libSceCesCs/Unicode.cpp
+++ b/core/libs/prx/libSceCesCs/Unicode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include <bit>
 #include <cstdint>
 #include <cstring>
diff --git a/core/libs/prx/libSceCesCs/include/Api.hpp b/core/libs/prx/libSceCesCs/include/Api.hpp
new file mode 100644
index 0000000000..de9d5746e4
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/include/Api.hpp
@@ -0,0 +1,295 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1252(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1251(void);
+const void* APS5_VABI sceCesRefersUcsProfileCp1250(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_1(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_2(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_4(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_5(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_9(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_10(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_13(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_14(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_15(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_16(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp437(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp737(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp775(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp850(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp852(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp855(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp860(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp861(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp862(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp863(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp865(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp866(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8R(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8U(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1254(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1256(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1258(void);
+void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitSJis1997X0208(void* sheet);
+int APS5_VABI sceCesMbcsUcsContextInit(void* context, const void* profile);
+int APS5_VABI sceCesMbcsUcsContextInitCopy(void* context, const void* source);
+void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2Ss3(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucKr(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitUhc(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitBig5Cp950(void* sheet);
+int APS5_VABI sceCesUtf8StrToMbcsStr(void* context, const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUtf8StrGetMbcsLen(void* context, const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesUcs2StrToMbcsStr(void* context, const uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUcs2StrGetMbcsLen(void* context, const uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesMbcsStrToUtf8Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len);
+int APS5_VABI sceCesMbcsStrGetUtf8Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf8Len);
+int APS5_VABI sceCesMbcsStrToUcs2Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len);
+int APS5_VABI sceCesMbcsStrGetUcs2Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* ucs2Len);
+int APS5_VABI sceCesEucJpToUcs2(const void* profile, const uint8_t* euc, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2);
+int APS5_VABI sceCesSbcToUtf8(const uint8_t* profile, uint8_t sbc, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8_len);
+int APS5_VABI sceCesUtf8ToSbc(const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8_len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesEucJpToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesEucKrToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesBig5ToUtf8(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Length, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesUhcToUtf8(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesSJisToUcs2(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* ucs2);
+int APS5_VABI sceCesSJisToUtf8(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesSJisToUtf16(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesSJisToUtf16be(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesSJisToUtf16le(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesSJisToUtf32(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32);
+int APS5_VABI sceCesSJisToUtf32be(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32);
+int APS5_VABI sceCesSJisToUtf32le(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32);
+int APS5_VABI sceCesEucJpToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucJpToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucJpToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucJpToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucJpToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucJpToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToSJis(uint16_t ucs2, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf8ToSJis(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf16ToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf16beToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf16leToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf32ToSJis(uint32_t utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf32beToSJis(const uint32_t* utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf32leToSJis(const uint32_t* utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUcs2ToEucJp(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf8ToEucJp(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16ToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16beToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16leToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32ToEucJp(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32beToEucJp(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32leToEucJp(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesSJisCodeToJisX0208(uint16_t sjisCode, uint8_t* ku, uint8_t* ten);
+int APS5_VABI sceCesJisX0208ToSJisCode(uint8_t ku, uint8_t ten, uint16_t* sjisCode);
+int APS5_VABI sceCesSJisCodeToJisX0213(uint16_t sjisCode, uint8_t* men, uint8_t* ku, uint8_t* ten);
+int APS5_VABI sceCesJisX0213ToSJisCode(uint8_t men, uint8_t ku, uint8_t ten, uint16_t* sjisCode);
+int APS5_VABI sceCesSJisGetCode(const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* sjisCode);
+int APS5_VABI sceCesSJisPutCode(uint16_t sjisCode, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesMbcToUcs2(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* ucs2);
+int APS5_VABI sceCesMbcToUtf8(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Len);
+int APS5_VABI sceCesMbcToUtf16(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcToUtf16be(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcToUtf16le(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcToUtf32(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32);
+int APS5_VABI sceCesMbcToUtf32be(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32);
+int APS5_VABI sceCesMbcToUtf32le(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32);
+int APS5_VABI sceCesSbcToUcs2(const uint8_t* profile, uint8_t sbc, uint16_t* ucs2);
+int APS5_VABI sceCesSbcToUtf16(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesSbcToUtf16be(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesSbcToUtf16le(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesSbcToUtf32(const uint8_t* profile, uint8_t sbc, uint32_t* utf32);
+int APS5_VABI sceCesSbcToUtf32be(const uint8_t* profile, uint8_t sbc, uint32_t* utf32);
+int APS5_VABI sceCesSbcToUtf32le(const uint8_t* profile, uint8_t sbc, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToSbc(uint16_t ucs2, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16ToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16beToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16leToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf32ToSbc(uint32_t utf32, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf32beToSbc(const uint32_t* utf32, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf32leToSbc(const uint32_t* utf32, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16StrToMbcsStr(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUtf16StrGetMbcsLen(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesMbcsStrToUtf16Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcsStrGetUtf16Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf16Len);
+int APS5_VABI sceCesUtf32StrToMbcsStr(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUtf32StrGetMbcsLen(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesMbcsStrToUtf32Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len);
+int APS5_VABI sceCesMbcsStrGetUtf32Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32Len);
+void* APS5_VABI sceCesUcsProfileInitEucCnGb2312(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitGbkCp936(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitGb18030_2000(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitGb18030_2005(void* sheet);
+int APS5_VABI sceCesEucCnToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2);
+int APS5_VABI sceCesEucCnToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesEucCnToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucCnToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucCnToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucCnToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucCnToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucCnToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToEucCn(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf8ToEucCn(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16ToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16beToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16leToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32ToEucCn(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32beToEucCn(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32leToEucCn(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesGbToUcs2(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* ucs2);
+int APS5_VABI sceCesGbToUtf8(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesGbToUtf16(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesGbToUtf16be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesGbToUtf16le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesGbToUtf32(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32);
+int APS5_VABI sceCesGbToUtf32be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32);
+int APS5_VABI sceCesGbToUtf32le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToGb(uint16_t ucs2, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf8ToGb(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf16ToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf16beToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf16leToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf32ToGb(uint32_t utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf32beToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf32leToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesEucKrToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2);
+int APS5_VABI sceCesEucKrToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucKrToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucKrToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucKrToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucKrToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucKrToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesUhcToUcs2(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* ucs2);
+int APS5_VABI sceCesUhcToUtf16(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesUhcToUtf16be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesUhcToUtf16le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesUhcToUtf32(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32);
+int APS5_VABI sceCesUhcToUtf32be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32);
+int APS5_VABI sceCesUhcToUtf32le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32);
+int APS5_VABI sceCesBig5ToUcs2(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* ucs2);
+int APS5_VABI sceCesBig5ToUtf16(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesBig5ToUtf16be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesBig5ToUtf16le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesBig5ToUtf32(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32);
+int APS5_VABI sceCesBig5ToUtf32be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32);
+int APS5_VABI sceCesBig5ToUtf32le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToEucKr(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf8ToEucKr(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16ToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16beToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16leToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32ToEucKr(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32beToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32leToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUcs2ToUhc(uint16_t ucs2, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf8ToUhc(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf16ToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf16beToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf16leToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf32ToUhc(uint32_t utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf32beToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf32leToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUcs2ToBig5(uint16_t ucs2, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf8ToBig5(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf16ToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf16beToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf16leToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf32ToBig5(uint32_t utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf32beToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf32leToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesEucCnUcsProfileSetSbcs(void);
+int APS5_VABI sceCesEucJpUcsProfileSetSbcs(void);
+int APS5_VABI sceCesEucKrUcsProfileSetSbcs(void);
+int APS5_VABI sceCesGbUcsProfileSet4ByteCharRange(void);
+int APS5_VABI sceCesGbUcsProfileSetSbcs(void);
+int APS5_VABI sceCesGbUcsProfileSetUdaMapping(void);
+int APS5_VABI sceCesIso2022JpUcsProfileSetSbcs(void);
+int APS5_VABI sceCesIso2022StrGetUcs2Len(void);
+int APS5_VABI sceCesIso2022StrGetUtf16Len(void);
+int APS5_VABI sceCesIso2022StrGetUtf32Len(void);
+int APS5_VABI sceCesIso2022StrGetUtf8Len(void);
+int APS5_VABI sceCesIso2022StrToUcs2Str(void);
+int APS5_VABI sceCesIso2022StrToUtf16Str(void);
+int APS5_VABI sceCesIso2022StrToUtf32Str(void);
+int APS5_VABI sceCesIso2022StrToUtf8Str(void);
+int APS5_VABI sceCesIso2022UcsContextInit(void);
+int APS5_VABI sceCesIso2022UcsContextInitCopy(void);
+int APS5_VABI sceCesJisGetLevel(void);
+int APS5_VABI sceCesJiscsToUcs(void);
+int APS5_VABI sceCesMbcsUcsSetMbcsReplacementCharCode(void);
+int APS5_VABI sceCesMbcsUcsSetMbcsReplacementCharUCode(void);
+int APS5_VABI sceCesRefersUcsProfileAscii(void);
+int APS5_VABI sceCesRefersUcsProfileAsciiWithKatakana(void);
+int APS5_VABI sceCesRefersUcsProfileBs4730(void);
+int APS5_VABI sceCesRefersUcsProfileCp1253(void);
+int APS5_VABI sceCesRefersUcsProfileCp1255(void);
+int APS5_VABI sceCesRefersUcsProfileCp1257(void);
+int APS5_VABI sceCesRefersUcsProfileCp857(void);
+int APS5_VABI sceCesRefersUcsProfileCp858(void);
+int APS5_VABI sceCesRefersUcsProfileCp864(void);
+int APS5_VABI sceCesRefersUcsProfileCp869(void);
+int APS5_VABI sceCesRefersUcsProfileCp874(void);
+int APS5_VABI sceCesRefersUcsProfileGbT1988(void);
+int APS5_VABI sceCesRefersUcsProfileGbT1988Tilde0x7e(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_11(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_3(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_6(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_7(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_8(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201Katakana(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201Roman(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201RomanTilde0x7e(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201Tilde0x7e(void);
+int APS5_VABI sceCesRefersUcsProfileKsX1003(void);
+int APS5_VABI sceCesRefersUcsProfileKsX1003Tilde0x7e(void);
+int APS5_VABI sceCesSJisUcsProfileSetSbcs(void);
+int APS5_VABI sceCesUcs2StrGetIso2022Len(void);
+int APS5_VABI sceCesUcs2StrToIso2022Str(void);
+int APS5_VABI sceCesUcs2ToMbc(uint16_t ucs2, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUcsProfileInitEucJis2004(void);
+int APS5_VABI sceCesUcsProfileInitIso2022JpCp50221(void);
+int APS5_VABI sceCesUcsProfileInitIso2022JpCp50222(void);
+int APS5_VABI sceCesUcsProfileInitIso2022JpRfc1468(void);
+int APS5_VABI sceCesUcsProfileInitSJis2004X0213(void);
+int APS5_VABI sceCesUcsToJiscs(void);
+int APS5_VABI sceCesUhcUcsProfileSetSbcs(void);
+int APS5_VABI sceCesUtf16StrGetIso2022Len(void);
+int APS5_VABI sceCesUtf16StrToIso2022Str(void);
+int APS5_VABI sceCesUtf16ToMbc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUtf16beToMbc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUtf16leToMbc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUtf32StrGetIso2022Len(void);
+int APS5_VABI sceCesUtf32StrToIso2022Str(void);
+int APS5_VABI sceCesUtf32ToMbc(uint32_t utf32, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUtf32beToMbc(const uint32_t* utf32, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUtf32leToMbc(const uint32_t* utf32, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUtf8StrGetIso2022Len(void);
+int APS5_VABI sceCesUtf8StrToIso2022Str(void);
+int APS5_VABI sceCesUtf8ToMbc(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Len, const void* profile, uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen);
+int APS5_VABI sceCesUcs2ToUtf8(uint16_t source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf8ToUcs2(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target);
+int APS5_VABI sceCesUtf8ToUtf32(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint32_t* target);
+int APS5_VABI sceCesUtf8ToUtf32be(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint32_t* target);
+int APS5_VABI sceCesUtf8ToUtf32le(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint32_t* target);
+int APS5_VABI sceCesUtf8ToUtf16(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf8ToUtf16be(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf8ToUtf16le(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf16ToUtf8(const uint16_t* source, uint32_t available, uint32_t* sourceLength, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf16beToUtf8(const uint16_t* source, uint32_t available, uint32_t* sourceLength, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf16leToUtf8(const uint16_t* source, uint32_t available, uint32_t* sourceLength, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf32ToUtf8(uint32_t source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf32beToUtf8(const uint32_t* source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf32leToUtf8(const uint32_t* source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+
+}
diff --git a/core/libs/prx/libSceCesCs/libSceCesCs.hpp b/core/libs/prx/libSceCesCs/libSceCesCs.hpp
new file mode 100644
index 0000000000..d1bff8e93d
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/libSceCesCs.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCesCs/include/Api.hpp"
diff --git a/core/libs/prx/libSceCommonDialog/Export.cpp b/core/libs/prx/libSceCommonDialog/Export.cpp
index 47f9a84bb1..8d090d7d35 100644
--- a/core/libs/prx/libSceCommonDialog/Export.cpp
+++ b/core/libs/prx/libSceCommonDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCommonDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceCommonDialog/include/Api.hpp b/core/libs/prx/libSceCommonDialog/include/Api.hpp
new file mode 100644
index 0000000000..50330e8aa4
--- /dev/null
+++ b/core/libs/prx/libSceCommonDialog/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCommonDialogInitialize(void);
+bool APS5_VABI sceCommonDialogIsUsed(void);
+
+}
diff --git a/core/libs/prx/libSceCommonDialog/libSceCommonDialog.hpp b/core/libs/prx/libSceCommonDialog/libSceCommonDialog.hpp
new file mode 100644
index 0000000000..2379b9c83f
--- /dev/null
+++ b/core/libs/prx/libSceCommonDialog/libSceCommonDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceCompanionHttpd/Export.cpp b/core/libs/prx/libSceCompanionHttpd/Export.cpp
index 8d3a814f50..7941374a21 100644
--- a/core/libs/prx/libSceCompanionHttpd/Export.cpp
+++ b/core/libs/prx/libSceCompanionHttpd/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCompanionHttpd/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -15,17 +16,8 @@ constexpr int CompanionHttpdErrorAlreadyStarted = static_cast<int>(0x80E4000Au);
 constexpr int CompanionHttpdErrorNotStarted = static_cast<int>(0x80E4000Bu);
 constexpr int CompanionHttpdErrorAlreadyRegistered = static_cast<int>(0x80E4000Cu);
 
-struct CompanionHttpdOptParam {
-    std::uint64_t reserved;
-    void* workMemory;
-    std::uint64_t workMemorySize;
-    std::uint8_t settings[0x40];
-    const void* temporaryMountPoint;
-};
 static_assert(sizeof(CompanionHttpdOptParam) == 0x60);
 
-using CompanionHttpdRequestCallback = int (*)(int, int, const void*, void*, void*);
-
 struct CompanionHttpdState {
     std::mutex mutex;
     bool initialized = false;
diff --git a/core/libs/prx/libSceCompanionHttpd/include/Api.hpp b/core/libs/prx/libSceCompanionHttpd/include/Api.hpp
new file mode 100644
index 0000000000..6a7e2d194d
--- /dev/null
+++ b/core/libs/prx/libSceCompanionHttpd/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct CompanionHttpdOptParam {
+    std::uint64_t reserved;
+    void* workMemory;
+    std::uint64_t workMemorySize;
+    std::uint8_t settings[0x40];
+    const void* temporaryMountPoint;
+};
+
+using CompanionHttpdRequestCallback = int (*)(int, int, const void*, void*, void*);
+
+extern "C" {
+
+int APS5_VABI sceCompanionHttpdOptParamInitialize(CompanionHttpdOptParam* param);
+int APS5_VABI sceCompanionHttpdInitialize(const CompanionHttpdOptParam* param);
+int APS5_VABI sceCompanionHttpdTerminate(void);
+int APS5_VABI sceCompanionHttpdRegisterRequestCallback(CompanionHttpdRequestCallback function, void* argument);
+int APS5_VABI sceCompanionHttpdUnregisterRequestCallback(void);
+int APS5_VABI sceCompanionHttpdStart(void);
+int APS5_VABI sceCompanionHttpdStop(void);
+int APS5_VABI sceCompanionHttpdGetEvent(void* event);
+int APS5_VABI sceCompanionHttpdAddHeader(const char* key, const char* value, void* response);
+int APS5_VABI sceCompanionHttpdSetStatus(int status, void* response);
+int APS5_VABI sceCompanionHttpdSetBody(const char* body, std::uint64_t size, void* response);
+int APS5_VABI sceCompanionHttpdGet2ndScreenStatus(void);
+int APS5_VABI sceCompanionHttpdGetUserId(void);
+int APS5_VABI sceCompanionHttpdInitialize2(void);
+int APS5_VABI sceCompanionHttpdRegisterRequestBodyReceptionCallback(void);
+int APS5_VABI sceCompanionHttpdRegisterRequestCallback2(void);
+int APS5_VABI sceCompanionHttpdUnregisterRequestBodyReceptionCallback(void);
+
+}
diff --git a/core/libs/prx/libSceCompanionHttpd/libSceCompanionHttpd.hpp b/core/libs/prx/libSceCompanionHttpd/libSceCompanionHttpd.hpp
new file mode 100644
index 0000000000..9626d1bfa7
--- /dev/null
+++ b/core/libs/prx/libSceCompanionHttpd/libSceCompanionHttpd.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCompanionHttpd/include/Api.hpp"
diff --git a/core/libs/prx/libSceCompanionUtil/Export.cpp b/core/libs/prx/libSceCompanionUtil/Export.cpp
index 7a208122da..810abefbdc 100644
--- a/core/libs/prx/libSceCompanionUtil/Export.cpp
+++ b/core/libs/prx/libSceCompanionUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCompanionUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,7 +6,7 @@
 
 extern "C" {
 
-int APS5_VABI sceCompanionUtilGetEvent() {
+int APS5_VABI sceCompanionUtilGetEvent(void* outEvent) {
     return static_cast<int>(0x80AD0008);
 }
 
diff --git a/core/libs/prx/libSceCompanionUtil/include/Api.hpp b/core/libs/prx/libSceCompanionUtil/include/Api.hpp
new file mode 100644
index 0000000000..c71bbbf72b
--- /dev/null
+++ b/core/libs/prx/libSceCompanionUtil/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCompanionUtilGetEvent(void* outEvent);
+int APS5_VABI sceCompanionUtilGetRemoteOskEvent();
+int APS5_VABI sceCompanionUtilInitialize();
+int APS5_VABI sceCompanionUtilOptParamInitialize();
+int APS5_VABI sceCompanionUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceCompanionUtil/libSceCompanionUtil.hpp b/core/libs/prx/libSceCompanionUtil/libSceCompanionUtil.hpp
new file mode 100644
index 0000000000..e49fee6a03
--- /dev/null
+++ b/core/libs/prx/libSceCompanionUtil/libSceCompanionUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCompanionUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceComposite/Export.cpp b/core/libs/prx/libSceComposite/Export.cpp
index ebf58fb725..96949e8e2f 100644
--- a/core/libs/prx/libSceComposite/Export.cpp
+++ b/core/libs/prx/libSceComposite/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceComposite/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -26,13 +27,11 @@ int APS5_VABI sceCompositorCommandGpuPerfEnd() {
 }
 
 int APS5_VABI sceCompositorCreateIndirectRenderTarget() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80d40006);
 }
 
 int APS5_VABI sceCompositorDeleteIndirectRenderTarget() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80d40006);
 }
 
 int APS5_VABI sceCompositorFlush() {
@@ -261,17 +260,14 @@ int APS5_VABI sceCompositorSetGnmContextCommand() {
 }
 
 int APS5_VABI sceCompositorSetIndirectCanvasCommand() {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceCompositorSetIndirectCompositionCommand() {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceCompositorSetIndirectRenderTargetConfigCommand() {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
diff --git a/core/libs/prx/libSceComposite/include/Api.hpp b/core/libs/prx/libSceComposite/include/Api.hpp
new file mode 100644
index 0000000000..0df26cb6bc
--- /dev/null
+++ b/core/libs/prx/libSceComposite/include/Api.hpp
@@ -0,0 +1,86 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCompositorAllocateIndex();
+int APS5_VABI sceCompositorCheckCrash();
+int APS5_VABI sceCompositorCommandGpuPerfBegin();
+int APS5_VABI sceCompositorCommandGpuPerfEnd();
+int APS5_VABI sceCompositorCreateIndirectRenderTarget();
+int APS5_VABI sceCompositorDeleteIndirectRenderTarget();
+int APS5_VABI sceCompositorFlush();
+int APS5_VABI sceCompositorFlushWithRepeat();
+int APS5_VABI sceCompositorGetAnotherProcessSystemAddress();
+int APS5_VABI sceCompositorGetAnotherProcessSystemSize();
+int APS5_VABI sceCompositorGetAnotherProcessVideoAddress();
+int APS5_VABI sceCompositorGetAnotherProcessVideoSize();
+int APS5_VABI sceCompositorGetCanvasHandle();
+int APS5_VABI sceCompositorGetClientList();
+int APS5_VABI sceCompositorGetDmemOffset();
+int APS5_VABI sceCompositorGetDummyAddress();
+int APS5_VABI sceCompositorGetDummySize();
+int APS5_VABI sceCompositorGetRemainedCommandNum();
+int APS5_VABI sceCompositorGetRenderTargetResolution();
+int APS5_VABI sceCompositorGetSystemAddress();
+int APS5_VABI sceCompositorGetSystemSize();
+int APS5_VABI sceCompositorGetVideoAddress();
+int APS5_VABI sceCompositorGetVideoSize();
+int APS5_VABI sceCompositorHandleProcessEvents();
+int APS5_VABI sceCompositorInit();
+int APS5_VABI sceCompositorInitWithProcessOrder();
+int APS5_VABI sceCompositorInsertThreadTraceMarker();
+int APS5_VABI sceCompositorIsDebugCaptureEnabled();
+int APS5_VABI sceCompositorIsReady4K();
+int APS5_VABI sceCompositorLockCommandBuffer();
+int APS5_VABI sceCompositorMakeCanvasHandle();
+int APS5_VABI sceCompositorMapAnotherProcess();
+int APS5_VABI sceCompositorMemoryPoolDecommit();
+int APS5_VABI sceCompositorPrivacyMaskPushArea();
+int APS5_VABI sceCompositorQuit();
+int APS5_VABI sceCompositorReleaseCommandBuffer();
+int APS5_VABI sceCompositorReleaseIndex();
+int APS5_VABI sceCompositorReleaseLocalStall();
+int APS5_VABI sceCompositorReserveCommandBuffer();
+int APS5_VABI sceCompositorResetZoomCommand();
+int APS5_VABI sceCompositorSetAgcCompositeCanvasCommand();
+int APS5_VABI sceCompositorSetAgcContextCommand();
+int APS5_VABI sceCompositorSetCompositeCanvasCommandInC();
+int APS5_VABI sceCompositorSetCursorImageAddress();
+int APS5_VABI sceCompositorSetDebugPositionCommand();
+int APS5_VABI sceCompositorSetEndOfFrameCommand();
+int APS5_VABI sceCompositorSetEventCommand();
+int APS5_VABI sceCompositorSetFilterType();
+int APS5_VABI sceCompositorSetFlipCommand2();
+int APS5_VABI sceCompositorSetGameSufaceControlCommand();
+int APS5_VABI sceCompositorSetGnmContextCommand();
+int APS5_VABI sceCompositorSetIndirectCanvasCommand();
+int APS5_VABI sceCompositorSetIndirectCompositionCommand();
+int APS5_VABI sceCompositorSetIndirectRenderTargetConfigCommand();
+int APS5_VABI sceCompositorSetInvisibleCanvasCommand();
+int APS5_VABI sceCompositorSetKeepDisplayBufferCommand();
+int APS5_VABI sceCompositorSetLocalStallCommand();
+int APS5_VABI sceCompositorSetMemoryCommand();
+int APS5_VABI sceCompositorSetPatchCommand();
+int APS5_VABI sceCompositorSetPostEventCommand();
+int APS5_VABI sceCompositorSetRepeatCommand();
+int APS5_VABI sceCompositorSetResolutionCommand();
+int APS5_VABI sceCompositorSetScalingLayoutInfo();
+int APS5_VABI sceCompositorSetSeparateContextCommand();
+int APS5_VABI sceCompositorSetSystemConfigWithMask();
+int APS5_VABI sceCompositorSetVideoOutMode();
+int APS5_VABI sceCompositorSetVirtualCanvasAgcContextCommand();
+int APS5_VABI sceCompositorSetVirtualCanvasCommandFooter();
+int APS5_VABI sceCompositorSetVirtualCanvasPatchCommand();
+int APS5_VABI sceCompositorSetVrMode();
+int APS5_VABI sceCompositorSetZoomCommand();
+int APS5_VABI sceCompositorSystemConfig();
+int APS5_VABI sceCompositorWaitEndOfRendering();
+int APS5_VABI sceCompositorWaitEvent();
+int APS5_VABI sceCompositorWaitPostEvent();
+int APS5_VABI sceCompsoitorGetGpuClock();
+int APS5_VABI sceCompsoitorGetProcessRenderingTime();
+int APS5_VABI sceCompsoitorGetRenderingTime();
+
+}
diff --git a/core/libs/prx/libSceComposite/libSceComposite.hpp b/core/libs/prx/libSceComposite/libSceComposite.hpp
new file mode 100644
index 0000000000..2829781c84
--- /dev/null
+++ b/core/libs/prx/libSceComposite/libSceComposite.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceComposite/include/Api.hpp"
diff --git a/core/libs/prx/libSceCompositeExt/libSceCompositeExt.hpp b/core/libs/prx/libSceCompositeExt/libSceCompositeExt.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCompositeExt/libSceCompositeExt.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceConnectAccountDialog/libSceConnectAccountDialog.hpp b/core/libs/prx/libSceConnectAccountDialog/libSceConnectAccountDialog.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceConnectAccountDialog/libSceConnectAccountDialog.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceContentDelete/Export.cpp b/core/libs/prx/libSceContentDelete/Export.cpp
index 5f886b22a4..ecd7c66372 100644
--- a/core/libs/prx/libSceContentDelete/Export.cpp
+++ b/core/libs/prx/libSceContentDelete/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceContentDelete/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceContentDelete/include/Api.hpp b/core/libs/prx/libSceContentDelete/include/Api.hpp
new file mode 100644
index 0000000000..cabb8b7ac2
--- /dev/null
+++ b/core/libs/prx/libSceContentDelete/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceContentDeleteInitialize(const ContentDeleteInitParam* initParam);
+int APS5_VABI sceContentDeleteByPath(const char* contentPath);
+int APS5_VABI sceContentDeleteById(std::int64_t contentId);
+int APS5_VABI sceContentDeleteByIdListForSf(const std::int64_t* contentIds, std::size_t count);
+int APS5_VABI sceContentDeleteGlobalMstat(void);
+int APS5_VABI sceContentDeleteMemoryInitialize(void);
+int APS5_VABI sceContentDeleteMemoryTerminate(void);
+int APS5_VABI sceContentDeleteTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceContentDelete/libSceContentDelete.hpp b/core/libs/prx/libSceContentDelete/libSceContentDelete.hpp
new file mode 100644
index 0000000000..5fc5f90294
--- /dev/null
+++ b/core/libs/prx/libSceContentDelete/libSceContentDelete.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceContentDelete/include/Api.hpp"
diff --git a/core/libs/prx/libSceContentExport/Export.cpp b/core/libs/prx/libSceContentExport/Export.cpp
index 0c5b205edf..975349f1e5 100644
--- a/core/libs/prx/libSceContentExport/Export.cpp
+++ b/core/libs/prx/libSceContentExport/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceContentExport/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceContentExport/include/Api.hpp b/core/libs/prx/libSceContentExport/include/Api.hpp
new file mode 100644
index 0000000000..97edfa3e73
--- /dev/null
+++ b/core/libs/prx/libSceContentExport/include/Api.hpp
@@ -0,0 +1,30 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceContentExportInit2(const ContentExportInitParam2* initParam);
+int APS5_VABI sceContentExportFinish(std::int32_t expId);
+int APS5_VABI sceContentExportFromData(std::int32_t expId, const ContentExportParam* param, std::size_t contentLength, ContentExportDataCallback callback, void* userData, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFile(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFileWithThumbnail(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportAddToFavorites(std::int64_t contentId);
+int APS5_VABI sceContentExportDataProvideFunction(void);
+int APS5_VABI sceContentExportFree(void);
+int APS5_VABI sceContentExportFrom(void);
+int APS5_VABI sceContentExportFromFileForSf(std::int32_t expId, const ContentExportParam* param, const ContentExportSfParam* sfParam, const char* sourcePath, const char* thumbnailPath, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFileWithContentIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const std::int64_t* contentIds, std::uint32_t contentCount, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFileWithTitleIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const char* titleIdList, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportInit(const ContentExportInitParam* param);
+int APS5_VABI sceContentExportMalloc(void);
+int APS5_VABI sceContentExportRemoveFromFavorites(std::int64_t contentId);
+int APS5_VABI sceContentExportRenameContent(std::int64_t contentId, const char* name);
+int APS5_VABI sceContentExportValidateContents(const std::int64_t* contentIds, std::uint32_t count);
+int APS5_VABI sceContentExportStart(void);
+int APS5_VABI sceContentExportGetProgress(std::int32_t expId);
+int APS5_VABI sceContentExportCancel(std::int32_t expId);
+int APS5_VABI sceContentExportFromDataWithThumbnail(std::int32_t expId, const ContentExportParam* param, const ContentExportCallbackParam* contentCallbackParam, const char* thumbnailType, const ContentExportCallbackParam* thumbnailCallbackParam, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportTerm(void);
+
+}
diff --git a/core/libs/prx/libSceContentExport/libSceContentExport.hpp b/core/libs/prx/libSceContentExport/libSceContentExport.hpp
new file mode 100644
index 0000000000..a7887a9290
--- /dev/null
+++ b/core/libs/prx/libSceContentExport/libSceContentExport.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceContentExport/include/Api.hpp"
diff --git a/core/libs/prx/libSceContentListController/libSceContentListController.hpp b/core/libs/prx/libSceContentListController/libSceContentListController.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceContentListController/libSceContentListController.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceContentSearch/Export.cpp b/core/libs/prx/libSceContentSearch/Export.cpp
index ac200672de..0fbd052c73 100644
--- a/core/libs/prx/libSceContentSearch/Export.cpp
+++ b/core/libs/prx/libSceContentSearch/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceContentSearch/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceContentSearch/include/Api.hpp b/core/libs/prx/libSceContentSearch/include/Api.hpp
new file mode 100644
index 0000000000..b54e8efb17
--- /dev/null
+++ b/core/libs/prx/libSceContentSearch/include/Api.hpp
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceContentSearchInit(const ContentSearchInitParam* initParam);
+int APS5_VABI sceContentSearchCloseMetadata(std::int32_t metadataId);
+int APS5_VABI sceContentSearchGetMetadataFieldInfo(std::int32_t metadataId, const char* field, std::int32_t* metadataType, std::int32_t* size);
+int APS5_VABI sceContentSearchGetMetadataValue(std::int32_t metadataId, const char* field, void* value);
+int APS5_VABI sceContentSearchOpenMetadata(const char* filePath, std::int32_t* metadataId);
+int APS5_VABI sceContentSearchSearchContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, const ContentSearchContentOrderByCondition* orderByConditions, std::uint32_t orderByConditionsLength, std::uint32_t offset, std::uint32_t limit, std::int64_t* numOfContent, void* infos, std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchGetContentLastUpdateId(std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchOpenMetadataByContentId(std::int64_t contentId, std::int32_t* metadataId);
+int APS5_VABI sceContentSearchGetTotalContentSize(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* size, std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchGetNumOfContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* numOfContent, std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchTerm(void);
+int APS5_VABI sceContentBinderEnd();
+int APS5_VABI sceContentBinderGetNumOfDifference();
+int APS5_VABI sceContentBinderInitialize();
+int APS5_VABI sceContentBinderIsUpdated();
+int APS5_VABI sceContentBinderReset();
+int APS5_VABI sceContentBinderSearchDifference();
+int APS5_VABI sceContentBinderStart();
+int APS5_VABI sceContentBinderTerminate();
+int APS5_VABI sceContentSearchGetApplicationLastUpdateId();
+int APS5_VABI sceContentSearchGetMyApplicationIndex();
+int APS5_VABI sceContentSearchGetNumOfApplication();
+int APS5_VABI sceContentSearchSearchApplication();
+
+}
diff --git a/core/libs/prx/libSceContentSearch/libSceContentSearch.hpp b/core/libs/prx/libSceContentSearch/libSceContentSearch.hpp
new file mode 100644
index 0000000000..79d8740064
--- /dev/null
+++ b/core/libs/prx/libSceContentSearch/libSceContentSearch.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceContentSearch/include/Api.hpp"
diff --git a/core/libs/prx/libSceConvertKeycode/Export.cpp b/core/libs/prx/libSceConvertKeycode/Export.cpp
index 0aa1387305..f96e2deca1 100644
--- a/core/libs/prx/libSceConvertKeycode/Export.cpp
+++ b/core/libs/prx/libSceConvertKeycode/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceConvertKeycode/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <array>
 #include <cstddef>
 #include <cstdint>
@@ -10,12 +12,6 @@
 #include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceUserServiceGetKeyboardType(int32_t userId, int32_t* type);
-int APS5_VABI sceUserServiceGetJapaneseInputType(int32_t userId, int32_t* type);
-int APS5_VABI sceUserServiceGetTraditionalChineseInputType(int32_t userId, int32_t* type);
-}
-
 namespace {
 constexpr int kErrInvalidAddress = static_cast<int>(0x80BC0031u);
 constexpr std::array<std::uint16_t, 256> BaseVirtualKeys = {
@@ -2306,7 +2302,6 @@ constexpr std::array<char16_t, 27> KoreanFinal = {
     12593, 12594, 12595, 12596, 12597, 12598, 12599, 12601, 12602, 12603, 12604, 12605, 12606, 12607, 12608, 12609, 12610, 12612, 12613, 12614, 12615, 12616, 12618, 12619, 12620, 12621, 12622
 };
 
-
 std::size_t CharacterLayout(std::uint32_t type, std::uint32_t state) {
     constexpr std::array<std::uint8_t, 39> layouts = {18, 7, 0, 1, 14, 8, 29, 17, 9, 25, 24, 23, 10, 11, 16, 26, 27, 12, 1, 19, 28, 3, 3, 1, 1, 1, 1, 1, 1, 1, 14, 32, 14, 34, 35, 36, 37, 1, 1};
     const bool imeMode = (state & 0x4000000u) != 0;
diff --git a/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp b/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
index 4ace3c252c..ec7e041937 100644
--- a/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
+++ b/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
@@ -35,7 +35,7 @@ constexpr std::uint32_t LookUp(std::int32_t keyboardType, std::int32_t japaneseV
         constexpr std::uint32_t traditionalChinese[] = {26, 27, 28, 29, 39};
         return traditionalChineseVariant >= 0 && traditionalChineseVariant < 5 ? traditionalChinese[traditionalChineseVariant] : 0;
     }
-    const std::int32_t index = keyboardType - kFirstMappedType;
+    const std::int64_t index = std::int64_t{keyboardType} - kFirstMappedType;
     return index >= 0 && index < kMappedTypeCount ? kImeTypeByKeyboardType[index] : 0;
 }
 
diff --git a/core/libs/prx/libSceConvertKeycode/include/Api.hpp b/core/libs/prx/libSceConvertKeycode/include/Api.hpp
new file mode 100644
index 0000000000..437b5117c5
--- /dev/null
+++ b/core/libs/prx/libSceConvertKeycode/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceConvertKeycodeGetImeKeyboardType(int32_t userId, uint32_t* type);
+int APS5_VABI sceConvertKeycodeGetVirtualKeycode(std::uint16_t keycode, std::uint32_t keyboardType, std::uint16_t* virtualKeycode);
+int APS5_VABI sceConvertKeycodeGetCharacterFromKeyboardData(const KeyboardData* keyData, std::int32_t index, std::uint32_t state, std::uint32_t keyboardType, char16_t* character);
+int APS5_VABI sceConvertKeycodeGetCharacter(std::uint16_t keycode, std::uint32_t state, std::uint32_t type, char16_t* character);
+
+}
diff --git a/core/libs/prx/libSceConvertKeycode/libSceConvertKeycode.hpp b/core/libs/prx/libSceConvertKeycode/libSceConvertKeycode.hpp
new file mode 100644
index 0000000000..45c6357f44
--- /dev/null
+++ b/core/libs/prx/libSceConvertKeycode/libSceConvertKeycode.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceConvertKeycode/include/Api.hpp"
diff --git a/core/libs/prx/libSceCtrlp/libSceCtrlp.hpp b/core/libs/prx/libSceCtrlp/libSceCtrlp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCtrlp/libSceCtrlp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp b/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp
index a383508620..04ed029ae6 100644
--- a/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp
+++ b/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCustomMusicAudioOut/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceCustomMusicAudioOut/include/Api.hpp b/core/libs/prx/libSceCustomMusicAudioOut/include/Api.hpp
new file mode 100644
index 0000000000..934f42befc
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicAudioOut/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCustomMusicAudioOutFinalize();
+int APS5_VABI sceCustomMusicAudioOutGetAllMusicVolume();
+int APS5_VABI sceCustomMusicAudioOutGetMuted();
+int APS5_VABI sceCustomMusicAudioOutGetVolume();
+int APS5_VABI sceCustomMusicAudioOutSetAllMusicVolume();
+
+}
diff --git a/core/libs/prx/libSceCustomMusicAudioOut/libSceCustomMusicAudioOut.hpp b/core/libs/prx/libSceCustomMusicAudioOut/libSceCustomMusicAudioOut.hpp
new file mode 100644
index 0000000000..387b464246
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicAudioOut/libSceCustomMusicAudioOut.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCustomMusicAudioOut/include/Api.hpp"
diff --git a/core/libs/prx/libSceCustomMusicCore/Export.cpp b/core/libs/prx/libSceCustomMusicCore/Export.cpp
index fa0c494e42..65b3aaccac 100644
--- a/core/libs/prx/libSceCustomMusicCore/Export.cpp
+++ b/core/libs/prx/libSceCustomMusicCore/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCustomMusicCore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceCustomMusicCore/include/Api.hpp b/core/libs/prx/libSceCustomMusicCore/include/Api.hpp
new file mode 100644
index 0000000000..478406741d
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicCore/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCustomMusicCoreBgmClose();
+int APS5_VABI sceCustomMusicCoreBgmOpen();
+int APS5_VABI sceCustomMusicCoreBgmOpen2();
+int APS5_VABI sceCustomMusicCoreBgmOutput();
+int APS5_VABI sceCustomMusicCoreBgmSetAudioVolume();
+int APS5_VABI sceCustomMusicCoreBgmStart();
+int APS5_VABI sceCustomMusicCoreBgmStop();
+int APS5_VABI sceCustomMusicCoreGetBgmAuthorityStatus();
+int APS5_VABI sceCustomMusicCoreGetHdcpStatus();
+int APS5_VABI sceCustomMusicCoreGetSystemAudioVolume();
+int APS5_VABI sceCustomMusicCorePostEvent();
+int APS5_VABI sceCustomMusicCoreSendEvent();
+int APS5_VABI sceCustomMusicCoreSendMulticastEvent();
+int APS5_VABI sceCustomMusicCoreSendSpMessage();
+int APS5_VABI sceCustomMusicCoreSetSystemAudioVolume();
+int APS5_VABI sceCustomMusicCoreStartOperation();
+int APS5_VABI sceCustomMusicCoreStartOperation2();
+int APS5_VABI sceCustomMusicCoreStopOperation();
+
+}
diff --git a/core/libs/prx/libSceCustomMusicCore/libSceCustomMusicCore.hpp b/core/libs/prx/libSceCustomMusicCore/libSceCustomMusicCore.hpp
new file mode 100644
index 0000000000..e7d4cf7206
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicCore/libSceCustomMusicCore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCustomMusicCore/include/Api.hpp"
diff --git a/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp b/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp
index ee9009496a..e64d1e4444 100644
--- a/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp
+++ b/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCustomMusicSysCallWrapper/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceCustomMusicSysCallWrapper/include/Api.hpp b/core/libs/prx/libSceCustomMusicSysCallWrapper/include/Api.hpp
new file mode 100644
index 0000000000..63ad57d532
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicSysCallWrapper/include/Api.hpp
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCustomMusicSelect();
+
+}
diff --git a/core/libs/prx/libSceCustomMusicSysCallWrapper/libSceCustomMusicSysCallWrapper.hpp b/core/libs/prx/libSceCustomMusicSysCallWrapper/libSceCustomMusicSysCallWrapper.hpp
new file mode 100644
index 0000000000..22ad944a67
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicSysCallWrapper/libSceCustomMusicSysCallWrapper.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCustomMusicSysCallWrapper/include/Api.hpp"
diff --git a/core/libs/prx/libSceDataTransfer/Export.cpp b/core/libs/prx/libSceDataTransfer/Export.cpp
index 43fb2a1574..5c993b6dfb 100644
--- a/core/libs/prx/libSceDataTransfer/Export.cpp
+++ b/core/libs/prx/libSceDataTransfer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDataTransfer/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDataTransfer/include/Api.hpp b/core/libs/prx/libSceDataTransfer/include/Api.hpp
new file mode 100644
index 0000000000..f04a12fef4
--- /dev/null
+++ b/core/libs/prx/libSceDataTransfer/include/Api.hpp
@@ -0,0 +1,68 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDataTransferAbortFgTransfer();
+int APS5_VABI sceDataTransferAbortRequest();
+int APS5_VABI sceDataTransferAbortSearchPS4();
+int APS5_VABI sceDataTransferCheckBgTransferRunning();
+int APS5_VABI sceDataTransferGetFgTransferProgress();
+int APS5_VABI sceDataTransferGetPrepareFgTransferProgress();
+int APS5_VABI sceDataTransferInitialize();
+int APS5_VABI sceDataTransferRequestGetAppInfoPS4();
+int APS5_VABI sceDataTransferRequestGetSavedataInfoPS4();
+int APS5_VABI sceDataTransferRequestGetUsersPS4();
+int APS5_VABI sceDataTransferRequestLaunchPS4();
+int APS5_VABI sceDataTransferRequestPrepareFgTransfer();
+int APS5_VABI sceDataTransferRequestRebootAuthPS4();
+int APS5_VABI sceDataTransferRequestSearchPS4();
+int APS5_VABI sceDataTransferRequestStartFgTransfer();
+int APS5_VABI sceDataTransferRequestTransferTimePS4();
+int APS5_VABI sceDataTransferTargetAbortBindSavedata();
+int APS5_VABI sceDataTransferTargetAbortDeactivate();
+int APS5_VABI sceDataTransferTargetAbortEth0();
+int APS5_VABI sceDataTransferTargetAbortGetDeviceInfo();
+int APS5_VABI sceDataTransferTargetAbortGetDeviceInfoApplication();
+int APS5_VABI sceDataTransferTargetAbortGetTitles();
+int APS5_VABI sceDataTransferTargetAbortGetUsers();
+int APS5_VABI sceDataTransferTargetAbortLaunch();
+int APS5_VABI sceDataTransferTargetAbortPrepareTransfer();
+int APS5_VABI sceDataTransferTargetAbortPwrReq();
+int APS5_VABI sceDataTransferTargetAbortReboot();
+int APS5_VABI sceDataTransferTargetAbortSendSsoNew2Old();
+int APS5_VABI sceDataTransferTargetAbortSendSsoOld2New();
+int APS5_VABI sceDataTransferTargetAbortTransfer();
+int APS5_VABI sceDataTransferTargetAbortTransferSpeed();
+int APS5_VABI sceDataTransferTargetEventIsAuthReady();
+int APS5_VABI sceDataTransferTargetEventIsIPv6Ready();
+int APS5_VABI sceDataTransferTargetEventIsPwrReqReady();
+int APS5_VABI sceDataTransferTargetGetFailedUsers();
+int APS5_VABI sceDataTransferTargetGetRebootData();
+int APS5_VABI sceDataTransferTargetGetTransferProgress();
+int APS5_VABI sceDataTransferTargetRequestAbortSearch();
+int APS5_VABI sceDataTransferTargetRequestActivate();
+int APS5_VABI sceDataTransferTargetRequestAuth();
+int APS5_VABI sceDataTransferTargetRequestBindSavedata();
+int APS5_VABI sceDataTransferTargetRequestComplete();
+int APS5_VABI sceDataTransferTargetRequestCreateRebootData();
+int APS5_VABI sceDataTransferTargetRequestDeactivate();
+int APS5_VABI sceDataTransferTargetRequestEndTransfer();
+int APS5_VABI sceDataTransferTargetRequestGetDeviceInfo();
+int APS5_VABI sceDataTransferTargetRequestGetDeviceInfoApplication();
+int APS5_VABI sceDataTransferTargetRequestGetTitles();
+int APS5_VABI sceDataTransferTargetRequestGetUsers();
+int APS5_VABI sceDataTransferTargetRequestLaunch();
+int APS5_VABI sceDataTransferTargetRequestPrepareTransfer();
+int APS5_VABI sceDataTransferTargetRequestPrepareTransferProgress();
+int APS5_VABI sceDataTransferTargetRequestPwrReq();
+int APS5_VABI sceDataTransferTargetRequestReboot();
+int APS5_VABI sceDataTransferTargetRequestSearch();
+int APS5_VABI sceDataTransferTargetRequestSendSsoNew2Old();
+int APS5_VABI sceDataTransferTargetRequestSendSsoOld2New();
+int APS5_VABI sceDataTransferTargetRequestStartTransfer();
+int APS5_VABI sceDataTransferTargetRequestTransferSpeed();
+int APS5_VABI sceDataTransferTerminate();
+
+}
diff --git a/core/libs/prx/libSceDataTransfer/libSceDataTransfer.hpp b/core/libs/prx/libSceDataTransfer/libSceDataTransfer.hpp
new file mode 100644
index 0000000000..dfa5f26f82
--- /dev/null
+++ b/core/libs/prx/libSceDataTransfer/libSceDataTransfer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDataTransfer/include/Api.hpp"
diff --git a/core/libs/prx/libSceDbg/libSceDbg.hpp b/core/libs/prx/libSceDbg/libSceDbg.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDbg/libSceDbg.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDbgAssist/libSceDbgAssist.hpp b/core/libs/prx/libSceDbgAssist/libSceDbgAssist.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDbgAssist/libSceDbgAssist.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp b/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp
index f2bbed9a32..dcd840a54c 100644
--- a/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp
+++ b/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDbgThreadSanitizer/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceDbgThreadSanitizer/include/Api.hpp b/core/libs/prx/libSceDbgThreadSanitizer/include/Api.hpp
new file mode 100644
index 0000000000..0e19a53fdc
--- /dev/null
+++ b/core/libs/prx/libSceDbgThreadSanitizer/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+void APS5_VABI __tsan_acquire(void*);
+void APS5_VABI __tsan_release(void*);
+
+}
diff --git a/core/libs/prx/libSceDbgThreadSanitizer/libSceDbgThreadSanitizer.hpp b/core/libs/prx/libSceDbgThreadSanitizer/libSceDbgThreadSanitizer.hpp
new file mode 100644
index 0000000000..e6ff7c3d4b
--- /dev/null
+++ b/core/libs/prx/libSceDbgThreadSanitizer/libSceDbgThreadSanitizer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDbgThreadSanitizer/include/Api.hpp"
diff --git a/core/libs/prx/libSceDeci5/libSceDeci5.hpp b/core/libs/prx/libSceDeci5/libSceDeci5.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5/libSceDeci5.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Appmp/libSceDeci5Appmp.hpp b/core/libs/prx/libSceDeci5Appmp/libSceDeci5Appmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Appmp/libSceDeci5Appmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5CpComm/libSceDeci5CpComm.hpp b/core/libs/prx/libSceDeci5CpComm/libSceDeci5CpComm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5CpComm/libSceDeci5CpComm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Ctrlp/libSceDeci5Ctrlp.hpp b/core/libs/prx/libSceDeci5Ctrlp/libSceDeci5Ctrlp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Ctrlp/libSceDeci5Ctrlp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Dbgp/libSceDeci5Dbgp.hpp b/core/libs/prx/libSceDeci5Dbgp/libSceDeci5Dbgp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Dbgp/libSceDeci5Dbgp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Drfp/libSceDeci5Drfp.hpp b/core/libs/prx/libSceDeci5Drfp/libSceDeci5Drfp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Drfp/libSceDeci5Drfp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Eventp/libSceDeci5Eventp.hpp b/core/libs/prx/libSceDeci5Eventp/libSceDeci5Eventp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Eventp/libSceDeci5Eventp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Fsmp/libSceDeci5Fsmp.hpp b/core/libs/prx/libSceDeci5Fsmp/libSceDeci5Fsmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Fsmp/libSceDeci5Fsmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Pgcmp/libSceDeci5Pgcmp.hpp b/core/libs/prx/libSceDeci5Pgcmp/libSceDeci5Pgcmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Pgcmp/libSceDeci5Pgcmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Rdrfp/libSceDeci5Rdrfp.hpp b/core/libs/prx/libSceDeci5Rdrfp/libSceDeci5Rdrfp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Rdrfp/libSceDeci5Rdrfp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Tsmp/libSceDeci5Tsmp.hpp b/core/libs/prx/libSceDeci5Tsmp/libSceDeci5Tsmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Tsmp/libSceDeci5Tsmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Ttyp/libSceDeci5Ttyp.hpp b/core/libs/prx/libSceDeci5Ttyp/libSceDeci5Ttyp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Ttyp/libSceDeci5Ttyp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5UlpCommon/libSceDeci5UlpCommon.hpp b/core/libs/prx/libSceDeci5UlpCommon/libSceDeci5UlpCommon.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5UlpCommon/libSceDeci5UlpCommon.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDepth/Export.cpp b/core/libs/prx/libSceDepth/Export.cpp
index edfa2e580e..58c40c04fd 100644
--- a/core/libs/prx/libSceDepth/Export.cpp
+++ b/core/libs/prx/libSceDepth/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDepth/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDepth/include/Api.hpp b/core/libs/prx/libSceDepth/include/Api.hpp
new file mode 100644
index 0000000000..fae208c300
--- /dev/null
+++ b/core/libs/prx/libSceDepth/include/Api.hpp
@@ -0,0 +1,46 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDepthCalculateRectificationInformation(void);
+int APS5_VABI sceDepthDisableHeteroMode(void);
+int APS5_VABI sceDepthEnableExtendedMode(void);
+int APS5_VABI sceDepthEnableHeteroMode(void);
+int APS5_VABI sceDepthEnableHeteroModeAndGenerateInformation(void);
+int APS5_VABI sceDepthGetCalibrationData(void);
+int APS5_VABI sceDepthGetImage(void);
+int APS5_VABI sceDepthGetRectificationInformation(void);
+int APS5_VABI sceDepthGetSrParameter(void);
+int APS5_VABI sceDepthHandCandidateTrackerGetResult(void);
+int APS5_VABI sceDepthHasCalibrationData(void);
+int APS5_VABI sceDepthHeadCandidateDetectorGetResults(void);
+int APS5_VABI sceDepthHeadCandidateTrackerGetResult(void);
+int APS5_VABI sceDepthHeadCandidateTrackerSetValidationInformation(void);
+int APS5_VABI sceDepthInitialize(void);
+int APS5_VABI sceDepthLoadCalibrationData(void);
+int APS5_VABI sceDepthQueryMemory(void);
+int APS5_VABI sceDepthSaveInternalBuffers(void);
+int APS5_VABI sceDepthSetCalibrationData(void);
+int APS5_VABI sceDepthSetCommands(void);
+int APS5_VABI sceDepthSetPostFilterParameter(void);
+int APS5_VABI sceDepthSetPreFilterParameter(void);
+int APS5_VABI sceDepthSetRectificationInformation(void);
+int APS5_VABI sceDepthSetRoi(void);
+int APS5_VABI sceDepthSetRoiset(void);
+int APS5_VABI sceDepthSetSrParameter(void);
+int APS5_VABI sceDepthSetSrTnrParameter(void);
+int APS5_VABI sceDepthSubmit(void);
+int APS5_VABI sceDepthTerminate(void);
+int APS5_VABI sceDepthUpdate(void);
+int APS5_VABI sceDepthValidateCurrentCalibrationData(void);
+int APS5_VABI sceDepthWaitAndExecutePostProcess(void);
+int APS5_VABI _sceDepthCalcHeteroAdjustParam();
+int APS5_VABI _sceDepthHeadCandidateTrackerGetInformation();
+int APS5_VABI _sceDepthHeadCandidateTrackerSetInformation();
+int APS5_VABI _sceDepthSetCameraFactoryCalibrationData();
+int APS5_VABI _sceDepthSetHeteroAdjustParam();
+int APS5_VABI _sceDepthSetHeteroMode();
+
+}
diff --git a/core/libs/prx/libSceDepth/libSceDepth.hpp b/core/libs/prx/libSceDepth/libSceDepth.hpp
new file mode 100644
index 0000000000..8899705618
--- /dev/null
+++ b/core/libs/prx/libSceDepth/libSceDepth.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDepth/include/Api.hpp"
diff --git a/core/libs/prx/libSceDepth2/Export.cpp b/core/libs/prx/libSceDepth2/Export.cpp
index d043a5728d..18a122f40c 100644
--- a/core/libs/prx/libSceDepth2/Export.cpp
+++ b/core/libs/prx/libSceDepth2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDepth2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDepth2/include/Api.hpp b/core/libs/prx/libSceDepth2/include/Api.hpp
new file mode 100644
index 0000000000..97193eee0c
--- /dev/null
+++ b/core/libs/prx/libSceDepth2/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDepth2GetImage(void);
+int APS5_VABI sceDepth2Initialize(void);
+int APS5_VABI sceDepth2QueryMemory(void);
+int APS5_VABI sceDepth2SaveInternalBuffers(void);
+int APS5_VABI sceDepth2SetCameraFactoryCalibrationData(void);
+int APS5_VABI sceDepth2SetCommand(void);
+int APS5_VABI sceDepth2SetRoi(void);
+int APS5_VABI sceDepth2Submit(void);
+int APS5_VABI sceDepth2Terminate(void);
+int APS5_VABI sceDepth2WaitAndExecutePostProcess(void);
+
+}
diff --git a/core/libs/prx/libSceDepth2/libSceDepth2.hpp b/core/libs/prx/libSceDepth2/libSceDepth2.hpp
new file mode 100644
index 0000000000..30a843bc1b
--- /dev/null
+++ b/core/libs/prx/libSceDepth2/libSceDepth2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDepth2/include/Api.hpp"
diff --git a/core/libs/prx/libSceDipsw/Export.cpp b/core/libs/prx/libSceDipsw/Export.cpp
index 3cddf792b2..a822968f7d 100644
--- a/core/libs/prx/libSceDipsw/Export.cpp
+++ b/core/libs/prx/libSceDipsw/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDipsw/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDipsw/include/Api.hpp b/core/libs/prx/libSceDipsw/include/Api.hpp
new file mode 100644
index 0000000000..655ebbc6de
--- /dev/null
+++ b/core/libs/prx/libSceDipsw/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceKernelCheckDipsw();
+int APS5_VABI sceKernelInitializeDipsw();
+int APS5_VABI sceKernelIsAssistMode();
+int APS5_VABI sceKernelIsDevelopmentMode();
+int APS5_VABI sceKernelIsDisableRazor();
+int APS5_VABI sceKernelReadDipswData();
+int APS5_VABI sceKernelSetDipsw();
+int APS5_VABI sceKernelUnsetDipsw();
+int APS5_VABI sceKernelWriteDipswData();
+
+}
diff --git a/core/libs/prx/libSceDipsw/libSceDipsw.hpp b/core/libs/prx/libSceDipsw/libSceDipsw.hpp
new file mode 100644
index 0000000000..6d1d472e8b
--- /dev/null
+++ b/core/libs/prx/libSceDipsw/libSceDipsw.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDipsw/include/Api.hpp"
diff --git a/core/libs/prx/libSceDiscId/CMakeLists.txt b/core/libs/prx/libSceDiscId/CMakeLists.txt
new file mode 100644
index 0000000000..a1a24f3c30
--- /dev/null
+++ b/core/libs/prx/libSceDiscId/CMakeLists.txt
@@ -0,0 +1,15 @@
+add_library(libSceDiscId SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceDiscId PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceDiscId)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_disc_id_tests ${LIBS_INCLUDE_DIR}/tests/GuestDiscId.cpp)
+    target_include_directories(guest_disc_id_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_disc_id_tests PRIVATE libSceDiscId libc)
+    configure_windows_unwind(guest_disc_id_tests)
+    add_test(NAME guest_disc_id COMMAND guest_disc_id_tests)
+    if(WIN32)
+        set_tests_properties(guest_disc_id PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceDiscId>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceDiscId/Export.cpp b/core/libs/prx/libSceDiscId/Export.cpp
index ef0373a67b..b3618df723 100644
--- a/core/libs/prx/libSceDiscId/Export.cpp
+++ b/core/libs/prx/libSceDiscId/Export.cpp
@@ -1,19 +1,20 @@
+#include "prx/libSceDiscId/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct DiscId;
-struct DiscId2;
-
 extern "C" {
 
 int APS5_VABI sceDiscIdGet(DiscId* discId) {
+    (void)discId;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceDiscIdGet2(DiscId2* discId, std::uint32_t flags) {
+    (void)discId;
+    (void)flags;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceDiscId/include/Api.hpp b/core/libs/prx/libSceDiscId/include/Api.hpp
new file mode 100644
index 0000000000..52b6039516
--- /dev/null
+++ b/core/libs/prx/libSceDiscId/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct DiscId;
+
+struct DiscId2;
+
+extern "C" {
+
+int APS5_VABI sceDiscIdGet(DiscId* discId);
+int APS5_VABI sceDiscIdGet2(DiscId2* discId, std::uint32_t flags);
+
+}
diff --git a/core/libs/prx/libSceDiscId/libSceDiscId.hpp b/core/libs/prx/libSceDiscId/libSceDiscId.hpp
new file mode 100644
index 0000000000..26273e4024
--- /dev/null
+++ b/core/libs/prx/libSceDiscId/libSceDiscId.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDiscId/include/Api.hpp"
diff --git a/core/libs/prx/libSceDiscMap/Export.cpp b/core/libs/prx/libSceDiscMap/Export.cpp
index 8fedde6365..7eea1e3999 100644
--- a/core/libs/prx/libSceDiscMap/Export.cpp
+++ b/core/libs/prx/libSceDiscMap/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDiscMap/include/Api.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libSceDiscMap/include/Api.hpp b/core/libs/prx/libSceDiscMap/include/Api.hpp
new file mode 100644
index 0000000000..392ba50981
--- /dev/null
+++ b/core/libs/prx/libSceDiscMap/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+std::int32_t APS5_VABI sceDiscMapIsRequestOnHDD(const char* path, std::int64_t offset, std::int64_t size, std::int32_t* result);
+std::int32_t APS5_VABI sceDiscMapUnknown_ioKMruft1ek(const char* path, std::int64_t offset, std::int64_t size, std::uint64_t* flags, std::uint64_t* out1, std::uint64_t* out2);
+int APS5_VABI sceDiscMapGetPackageSize(std::int64_t fflags, int* ret1, int* ret2);
+
+}
diff --git a/core/libs/prx/libSceDiscMap/libSceDiscMap.hpp b/core/libs/prx/libSceDiscMap/libSceDiscMap.hpp
new file mode 100644
index 0000000000..e380270d79
--- /dev/null
+++ b/core/libs/prx/libSceDiscMap/libSceDiscMap.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDiscMap/include/Api.hpp"
diff --git a/core/libs/prx/libSceDolbyVision/libSceDolbyVision.hpp b/core/libs/prx/libSceDolbyVision/libSceDolbyVision.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDolbyVision/libSceDolbyVision.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDseehx/Export.cpp b/core/libs/prx/libSceDseehx/Export.cpp
index 43fce06ef6..b54b261746 100644
--- a/core/libs/prx/libSceDseehx/Export.cpp
+++ b/core/libs/prx/libSceDseehx/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDseehx/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDseehx/include/Api.hpp b/core/libs/prx/libSceDseehx/include/Api.hpp
new file mode 100644
index 0000000000..de8de8649b
--- /dev/null
+++ b/core/libs/prx/libSceDseehx/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDseehxConvert();
+int APS5_VABI sceDseehxExtInit();
+int APS5_VABI sceDseehxFlush();
+int APS5_VABI sceDseehxInit();
+
+}
diff --git a/core/libs/prx/libSceDseehx/libSceDseehx.hpp b/core/libs/prx/libSceDseehx/libSceDseehx.hpp
new file mode 100644
index 0000000000..a70d9c176e
--- /dev/null
+++ b/core/libs/prx/libSceDseehx/libSceDseehx.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDseehx/include/Api.hpp"
diff --git a/core/libs/prx/libSceDtcpIp/libSceDtcpIp.hpp b/core/libs/prx/libSceDtcpIp/libSceDtcpIp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDtcpIp/libSceDtcpIp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDtsEnc/Export.cpp b/core/libs/prx/libSceDtsEnc/Export.cpp
index 06a9bc9f32..058fb9d21b 100644
--- a/core/libs/prx/libSceDtsEnc/Export.cpp
+++ b/core/libs/prx/libSceDtsEnc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDtsEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDtsEnc/include/Api.hpp b/core/libs/prx/libSceDtsEnc/include/Api.hpp
new file mode 100644
index 0000000000..c58f777bab
--- /dev/null
+++ b/core/libs/prx/libSceDtsEnc/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDtsEncCreateEncoder();
+int APS5_VABI sceDtsEncDeleteEncoder();
+int APS5_VABI sceDtsEncEncode();
+int APS5_VABI sceDtsEncEncodeAsync();
+int APS5_VABI sceDtsEncFlush();
+int APS5_VABI sceDtsEncIsEncoding();
+int APS5_VABI sceDtsEncWaitEncode();
+
+}
diff --git a/core/libs/prx/libSceDtsEnc/libSceDtsEnc.hpp b/core/libs/prx/libSceDtsEnc/libSceDtsEnc.hpp
new file mode 100644
index 0000000000..c8fe34a7d9
--- /dev/null
+++ b/core/libs/prx/libSceDtsEnc/libSceDtsEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDtsEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceEditMp4/Export.cpp b/core/libs/prx/libSceEditMp4/Export.cpp
index 9bafeb8142..cc4aed4a43 100644
--- a/core/libs/prx/libSceEditMp4/Export.cpp
+++ b/core/libs/prx/libSceEditMp4/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceEditMp4/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceEditMp4/include/Api.hpp b/core/libs/prx/libSceEditMp4/include/Api.hpp
new file mode 100644
index 0000000000..219759f5bf
--- /dev/null
+++ b/core/libs/prx/libSceEditMp4/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceEditMp4Abort();
+int APS5_VABI sceEditMp4Edit();
+int APS5_VABI sceEditMp4GetStatus();
+int APS5_VABI sceEditMp4Initialize();
+int APS5_VABI sceEditMp4InitializeParam();
+int APS5_VABI sceEditMp4QueryMemSize();
+int APS5_VABI sceEditMp4SetFinishCallback();
+int APS5_VABI sceEditMp4Terminate();
+int APS5_VABI sceEditMp4Unite();
+
+}
diff --git a/core/libs/prx/libSceEditMp4/libSceEditMp4.hpp b/core/libs/prx/libSceEditMp4/libSceEditMp4.hpp
new file mode 100644
index 0000000000..d19448ddb3
--- /dev/null
+++ b/core/libs/prx/libSceEditMp4/libSceEditMp4.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceEditMp4/include/Api.hpp"
diff --git a/core/libs/prx/libSceEmbeddedTts/libSceEmbeddedTts.hpp b/core/libs/prx/libSceEmbeddedTts/libSceEmbeddedTts.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceEmbeddedTts/libSceEmbeddedTts.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceEmbeddedTtsCoreG3/libSceEmbeddedTtsCoreG3.hpp b/core/libs/prx/libSceEmbeddedTtsCoreG3/libSceEmbeddedTtsCoreG3.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceEmbeddedTtsCoreG3/libSceEmbeddedTtsCoreG3.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceErrorDialog/Export.cpp b/core/libs/prx/libSceErrorDialog/Export.cpp
index d3c922f2b1..5d6ed9d85e 100644
--- a/core/libs/prx/libSceErrorDialog/Export.cpp
+++ b/core/libs/prx/libSceErrorDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceErrorDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
diff --git a/core/libs/prx/libSceErrorDialog/include/Api.hpp b/core/libs/prx/libSceErrorDialog/include/Api.hpp
new file mode 100644
index 0000000000..3b12339095
--- /dev/null
+++ b/core/libs/prx/libSceErrorDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceErrorDialogInitialize(void);
+int APS5_VABI sceErrorDialogOpen(const void* param);
+int APS5_VABI sceErrorDialogUpdateStatus(void);
+int APS5_VABI sceErrorDialogGetStatus(void);
+int APS5_VABI sceErrorDialogClose(void);
+int APS5_VABI sceErrorDialogTerminate(void);
+int APS5_VABI sceErrorDialogOpenDetail();
+int APS5_VABI sceErrorDialogOpenWithReport();
+
+}
diff --git a/core/libs/prx/libSceErrorDialog/libSceErrorDialog.hpp b/core/libs/prx/libSceErrorDialog/libSceErrorDialog.hpp
new file mode 100644
index 0000000000..9681a99ea5
--- /dev/null
+++ b/core/libs/prx/libSceErrorDialog/libSceErrorDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceErrorDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceEsvm/Export.cpp b/core/libs/prx/libSceEsvm/Export.cpp
index 54def11467..cbef694c99 100644
--- a/core/libs/prx/libSceEsvm/Export.cpp
+++ b/core/libs/prx/libSceEsvm/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceEsvm/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceEsvm/include/Api.hpp b/core/libs/prx/libSceEsvm/include/Api.hpp
new file mode 100644
index 0000000000..d11b339d0e
--- /dev/null
+++ b/core/libs/prx/libSceEsvm/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceEsvmAppAudioSyncCreateContext();
+int APS5_VABI sceEsvmAppAudioSyncFlush();
+int APS5_VABI sceEsvmSyncVideo();
+
+}
diff --git a/core/libs/prx/libSceEsvm/libSceEsvm.hpp b/core/libs/prx/libSceEsvm/libSceEsvm.hpp
new file mode 100644
index 0000000000..015c133208
--- /dev/null
+++ b/core/libs/prx/libSceEsvm/libSceEsvm.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceEsvm/include/Api.hpp"
diff --git a/core/libs/prx/libSceEsvmEngine/Export.cpp b/core/libs/prx/libSceEsvmEngine/Export.cpp
index 6667c6812b..1ffc3f6398 100644
--- a/core/libs/prx/libSceEsvmEngine/Export.cpp
+++ b/core/libs/prx/libSceEsvmEngine/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceEsvmEngine/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceEsvmEngine/include/Api.hpp b/core/libs/prx/libSceEsvmEngine/include/Api.hpp
new file mode 100644
index 0000000000..a99c298234
--- /dev/null
+++ b/core/libs/prx/libSceEsvmEngine/include/Api.hpp
@@ -0,0 +1,27 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceEsvmEngineDestroyMediaKeySystemAccess();
+int APS5_VABI sceEsvmEngineMediaKeySessionClose();
+int APS5_VABI sceEsvmEngineMediaKeySessionGenerateRequest();
+int APS5_VABI sceEsvmEngineMediaKeySessionGetExpiration();
+int APS5_VABI sceEsvmEngineMediaKeySessionGetKeyStatuses();
+int APS5_VABI sceEsvmEngineMediaKeySessionGetSessionId();
+int APS5_VABI sceEsvmEngineMediaKeySessionLoad();
+int APS5_VABI sceEsvmEngineMediaKeySessionRemove();
+int APS5_VABI sceEsvmEngineMediaKeySessionSetEventHandler();
+int APS5_VABI sceEsvmEngineMediaKeySessionUpdate();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessCreateMediaKeys();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessDestroyMediaKeys();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessGetConfiguration();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessSetCdmStorageConfig();
+int APS5_VABI sceEsvmEngineMediaKeysCreateSession();
+int APS5_VABI sceEsvmEngineMediaKeysDestroySession();
+int APS5_VABI sceEsvmEngineMediaKeysSetEventHandler();
+int APS5_VABI sceEsvmEngineMediaKeysSetServerCertificate();
+int APS5_VABI sceEsvmEngineRequestMediaKeySystemAccess();
+
+}
diff --git a/core/libs/prx/libSceEsvmEngine/libSceEsvmEngine.hpp b/core/libs/prx/libSceEsvmEngine/libSceEsvmEngine.hpp
new file mode 100644
index 0000000000..c8bc3ef97c
--- /dev/null
+++ b/core/libs/prx/libSceEsvmEngine/libSceEsvmEngine.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceEsvmEngine/include/Api.hpp"
diff --git a/core/libs/prx/libSceFiber/CMakeLists.txt b/core/libs/prx/libSceFiber/CMakeLists.txt
index 883b7fc154..ef08d950c5 100644
--- a/core/libs/prx/libSceFiber/CMakeLists.txt
+++ b/core/libs/prx/libSceFiber/CMakeLists.txt
@@ -8,9 +8,11 @@ if(BUILD_TESTING)
     target_include_directories(fiber_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(fiber_tests PRIVATE libSceFiber libc)
     add_test(NAME fiber COMMAND fiber_tests)
+    add_test(NAME fiber_contextless COMMAND fiber_tests --contextless)
     add_asan_test_options(fiber detect_stack_use_after_return=0)
+    add_asan_test_options(fiber_contextless detect_stack_use_after_return=0)
     if(WIN32)
-        set_tests_properties(fiber PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(fiber fiber_contextless PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFiber>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceFiber/Export.cpp b/core/libs/prx/libSceFiber/Export.cpp
index 54b0930521..616919690c 100644
--- a/core/libs/prx/libSceFiber/Export.cpp
+++ b/core/libs/prx/libSceFiber/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFiber/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -36,8 +37,11 @@ static constexpr std::size_t FIBER_MIN_CONTEXT_SIZE = 512;
 static constexpr std::uint64_t FIBER_CONTEXT_FILL = 0xdeadbeefdeadbeefull;
 static constexpr std::size_t FIBER_HOST_STACK_MARGIN = 1u << 20;
 static constexpr std::size_t FIBER_GUEST_STACK_MIN = 64u << 10;
-
-using GuestFiberEntry = FiberEntry;
+static constexpr std::uint32_t FIBER_FLAG_NO_ULOBJMGR = 0x1;
+static constexpr std::uint32_t FIBER_FLAG_CONTEXT_SIZE_CHECK = 0x10;
+static constexpr std::uint32_t FIBER_FLAG_SET_FPU_REGISTERS = 0x100;
+static constexpr std::uint32_t FIBER_DEFAULT_MXCSR = 0x9fc0;
+static constexpr std::uint16_t FIBER_DEFAULT_FPU_CONTROL = 0x037f;
 
 // A fiber that is switching away stays Suspending until its context is saved; whoever runs next
 // on that host thread publishes Suspended. Fibers migrate between threads, so a resumer must never
@@ -60,6 +64,7 @@ struct Fiber {
     void* savedStack;
     char name[FIBER_MAX_NAME_LENGTH + 1];
     bool contextSizeCheck;
+    bool setFpuRegisters;
     std::uint8_t* hostStack;
     std::uint64_t hostStackBytes;
 };
@@ -101,14 +106,17 @@ static bool TraceFibers() {
 static void CompletePendingSuspend() {
     auto& thread = ThreadState();
     if (thread.pendingSuspend) {
-        thread.pendingSuspend->state.store(FiberState::Suspended, std::memory_order_release);
+        auto* fiber = thread.pendingSuspend;
+        const auto state = fiber->context ? FiberState::Suspended : FiberState::Idle;
+        if (!fiber->context) fiber->savedStack = nullptr;
+        fiber->state.store(state, std::memory_order_release);
         thread.pendingSuspend = nullptr;
     }
 }
 
 #ifdef _WIN32
 
-extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void* load);
+extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void** load, Fiber* start);
 extern "C" void Aps5FiberTrampoline_nid_no_patch();
 
 asm(R"(
@@ -138,7 +146,12 @@ Aps5FiberSwitchStack_nid_no_patch:
     stmxcsr 0xa0(%rsp)
     fnstcw 0xa4(%rsp)
     mov %rsp, (%rcx)
-    mov %rdx, %rsp
+    mov (%rdx), %rsp
+    test %r8, %r8
+    jz 1f
+    mov %r8, %r12
+    jmp Aps5FiberTrampoline_nid_no_patch
+1:
     movaps 0x00(%rsp), %xmm6
     movaps 0x10(%rsp), %xmm7
     movaps 0x20(%rsp), %xmm8
@@ -209,7 +222,7 @@ static void UnpinStack(const void* context, std::uint64_t bytes) {
 
 #else
 
-extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void* load);
+extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void** load, Fiber* start);
 extern "C" void Aps5FiberTrampoline_nid_no_patch();
 
 asm(".text\n"
@@ -224,7 +237,12 @@ asm(".text\n"
     stmxcsr 0(%rsp)
     fnstcw 4(%rsp)
     mov %rsp, (%rdi)
-    mov %rsi, %rsp
+    mov (%rsi), %rsp
+    test %rdx, %rdx
+    jz 1f
+    mov %rdx, %r12
+    jmp )" APS5_ASM_SYMBOL("Aps5FiberTrampoline_nid_no_patch") R"(
+1:
     ldmxcsr 0(%rsp)
     fldcw 4(%rsp)
     add $8, %rsp
@@ -332,6 +350,7 @@ static std::uint8_t* StackTop(const Fiber* fiber) {
 }
 
 static std::uint64_t* SizedWindow(const Fiber* fiber) {
+    if (!fiber->context) return nullptr;
     return reinterpret_cast<std::uint64_t*>(StackTop(fiber) - fiber->contextSize);
 }
 
@@ -357,6 +376,10 @@ static Fiber* AsFiber(FiberObject* object) {
 
 extern "C" [[noreturn]] void Aps5FiberMain_nid_no_patch(Fiber* fiber) {
     CompletePendingSuspend();
+    if (!fiber->context && fiber->setFpuRegisters) {
+        _mm_setcsr(FIBER_DEFAULT_MXCSR);
+        asm volatile("fldcw %0" : : "m"(FIBER_DEFAULT_FPU_CONTROL));
+    }
     fiber->entry(fiber->argOnInitialize, ThreadState().transfer);
     throw std::runtime_error(std::string("sceFiber: entry function of fiber '") + fiber->name + "' returned");
 }
@@ -365,9 +388,13 @@ static void PrepareInitialStack(Fiber* fiber) {
     const auto top = reinterpret_cast<std::uintptr_t>(StackTop(fiber)) & ~static_cast<std::uintptr_t>(15);
     auto* frame = reinterpret_cast<InitialFrame*>(top - 256);
     std::memset(frame, 0, sizeof(*frame));
-    frame->mxcsr = _mm_getcsr();
-    std::uint16_t control = 0;
-    asm volatile("fnstcw %0" : "=m"(control));
+    std::uint16_t control = FIBER_DEFAULT_FPU_CONTROL;
+    if (fiber->setFpuRegisters) {
+        frame->mxcsr = FIBER_DEFAULT_MXCSR;
+    } else {
+        frame->mxcsr = _mm_getcsr();
+        asm volatile("fnstcw %0" : "=m"(control));
+    }
     frame->fpuControl = control;
     frame->r12 = reinterpret_cast<std::uint64_t>(fiber);
     frame->returnAddress = reinterpret_cast<std::uint64_t>(&Aps5FiberTrampoline_nid_no_patch);
@@ -383,15 +410,55 @@ static bool AcquireForResume(Fiber* target) {
         }
         if (state != FiberState::Idle && state != FiberState::Suspended) return false;
         if (target->state.compare_exchange_weak(state, FiberState::Running, std::memory_order_acq_rel)) {
-            if (state == FiberState::Idle) PrepareInitialStack(target);
+            if (state == FiberState::Idle && target->context) PrepareInitialStack(target);
             return true;
         }
     }
 }
 
+static int32_t ValidateContext(const void* addr_context, uint64_t size_context) {
+    if (addr_context == nullptr && size_context != 0) return SCE_FIBER_ERROR_INVALID;
+    if ((reinterpret_cast<std::uintptr_t>(addr_context) & 15) != 0 || (size_context & 15) != 0) return SCE_FIBER_ERROR_ALIGNMENT;
+    if (addr_context != nullptr && size_context < FIBER_MIN_CONTEXT_SIZE) return SCE_FIBER_ERROR_RANGE;
+    return SCE_OK;
+}
+
+static void AttachStack(Fiber* fiber, void* addr_context, uint64_t size_context) {
+    fiber->context = static_cast<std::uint8_t*>(addr_context);
+    fiber->contextSize = size_context;
+    if (size_context < FIBER_GUEST_STACK_MIN) AllocateHostStack(fiber);
+    if (fiber->contextSizeCheck) {
+        auto* words = SizedWindow(fiber);
+        std::fill(words, words + size_context / sizeof(std::uint64_t), FIBER_CONTEXT_FILL);
+    }
+    PinStack(addr_context, size_context);
+}
+
+static void DetachStack(Fiber* fiber) {
+    if (!fiber->context) return;
+    UnpinStack(fiber->context, fiber->contextSize);
+    ReleaseHostStack(fiber);
+}
+
+static int32_t AcquireWithContext(Fiber* target, void* addr_context, uint64_t size_context) {
+    if (addr_context == nullptr && size_context == 0) return AcquireForResume(target) ? SCE_OK : SCE_FIBER_ERROR_STATE;
+    if (addr_context == nullptr) return SCE_FIBER_ERROR_INVALID;
+    if (const auto valid = ValidateContext(addr_context, size_context); valid != SCE_OK) return valid;
+    auto expected = FiberState::Idle;
+    if (!target->state.compare_exchange_strong(expected, FiberState::Running, std::memory_order_acq_rel)) return SCE_FIBER_ERROR_INVALID;
+    if (target->context) {
+        target->state.store(FiberState::Idle, std::memory_order_release);
+        return SCE_FIBER_ERROR_INVALID;
+    }
+    AttachStack(target, addr_context, size_context);
+    if (TraceFibers()) std::fprintf(stderr, "[fiber] attach %s context=%p+0x%llx\n", target->name, addr_context, static_cast<unsigned long long>(size_context));
+    PrepareInitialStack(target);
+    return SCE_OK;
+}
+
 static void Resume(Fiber* target, void** save, std::uint64_t argOnRun) {
     const auto* frame = static_cast<const InitialFrame*>(target->savedStack);
-    if (frame->returnAddress == 0) {
+    if (target->context && frame->returnAddress == 0) {
         std::fprintf(stderr, "[fiber] resuming '%s' with a wiped context: saved=%p context=%p size=0x%llx\n", target->name, target->savedStack,
                      static_cast<void*>(target->context), static_cast<unsigned long long>(target->contextSize));
         const auto* words = static_cast<const std::uint64_t*>(target->savedStack);
@@ -401,62 +468,36 @@ static void Resume(Fiber* target, void** save, std::uint64_t argOnRun) {
     }
     ThreadState().current = target;
     ThreadState().transfer = argOnRun;
-    SetBounds(FiberBounds(target));
-    Aps5FiberSwitchStack_nid_no_patch(save, target->savedStack);
+    SetBounds(target->context ? FiberBounds(target) : ThreadState().threadBounds);
+    Aps5FiberSwitchStack_nid_no_patch(save, target->context ? &target->savedStack : &ThreadState().threadStack, target->context ? nullptr : target);
 }
 
-extern "C" {
-
-int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, const void* opt_param, uint32_t build_version) {
-    (void)opt_param;
-    (void)build_version;
+static int32_t InitializeFiber(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, uint32_t flags) {
     if (!object || !name || !entry) return SCE_FIBER_ERROR_NULL;
     if ((reinterpret_cast<std::uintptr_t>(object) & 7) != 0) return SCE_FIBER_ERROR_ALIGNMENT;
-    if (addr_context == nullptr && size_context != 0) return SCE_FIBER_ERROR_INVALID;
-    if ((reinterpret_cast<std::uintptr_t>(addr_context) & 15) != 0 || (size_context & 15) != 0) return SCE_FIBER_ERROR_ALIGNMENT;
-    if (addr_context == nullptr) return SCE_FIBER_ERROR_INVALID;
-    if (size_context < FIBER_MIN_CONTEXT_SIZE) return SCE_FIBER_ERROR_RANGE;
+    if (const auto valid = ValidateContext(addr_context, size_context); valid != SCE_OK) return valid;
+    if ((flags & ~(FIBER_FLAG_NO_ULOBJMGR | FIBER_FLAG_CONTEXT_SIZE_CHECK | FIBER_FLAG_SET_FPU_REGISTERS)) != 0) throw std::runtime_error("_sceFiberInitializeWithInternalOptionImpl: unsupported flags " + std::to_string(flags));
     auto* fiber = reinterpret_cast<Fiber*>(object);
-    if (fiber->magic == FIBER_MAGIC) {
-        UnpinStack(fiber->context, fiber->contextSize);
-        ReleaseHostStack(fiber);
-    }
+    if (fiber->magic == FIBER_MAGIC) DetachStack(fiber);
     std::memset(object, 0, FIBER_OBJECT_SIZE);
     fiber->magic = FIBER_MAGIC;
     fiber->state.store(FiberState::Idle, std::memory_order_relaxed);
     fiber->entry = entry;
     fiber->argOnInitialize = arg_on_initialize;
-    fiber->context = static_cast<std::uint8_t*>(addr_context);
-    fiber->contextSize = size_context;
     std::strncpy(fiber->name, name, FIBER_MAX_NAME_LENGTH);
-    if (size_context < FIBER_GUEST_STACK_MIN) AllocateHostStack(fiber);
-    fiber->contextSizeCheck = g_contextSizeCheck.load(std::memory_order_relaxed);
-    if (fiber->contextSizeCheck) {
-        auto* words = SizedWindow(fiber);
-        std::fill(words, words + size_context / sizeof(std::uint64_t), FIBER_CONTEXT_FILL);
-    }
-    PinStack(addr_context, size_context);
-    if (TraceFibers()) std::fprintf(stderr, "[fiber] init %s object=%p context=%p+0x%llx entry=%p\n", fiber->name, static_cast<void*>(object), addr_context, static_cast<unsigned long long>(size_context), reinterpret_cast<void*>(entry));
+    fiber->contextSizeCheck = g_contextSizeCheck.load(std::memory_order_relaxed) || (flags & FIBER_FLAG_CONTEXT_SIZE_CHECK) != 0;
+    fiber->setFpuRegisters = (flags & FIBER_FLAG_SET_FPU_REGISTERS) != 0;
+    if (addr_context) AttachStack(fiber, addr_context, size_context);
+    if (TraceFibers()) std::fprintf(stderr, "[fiber] init %s object=%p context=%p+0x%llx entry=%p flags=0x%x\n", fiber->name, static_cast<void*>(object), addr_context, static_cast<unsigned long long>(size_context), reinterpret_cast<void*>(entry), flags);
     return SCE_OK;
 }
 
-int32_t APS5_VABI sceFiberFinalize(FiberObject* object) {
-    auto* fiber = AsFiber(object);
-    if (!fiber) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
-    const auto state = fiber->state.load(std::memory_order_acquire);
-    if (state == FiberState::Running || state == FiberState::Suspending) return SCE_FIBER_ERROR_STATE;
-    fiber->magic = 0;
-    UnpinStack(fiber->context, fiber->contextSize);
-    ReleaseHostStack(fiber);
-    return SCE_OK;
-}
-
-int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_return) {
+static int32_t RunFiber(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_return, std::uint64_t threadFramePointer) {
     auto* fiber = AsFiber(object);
     if (!fiber) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
     if (ThreadState().current) return SCE_FIBER_ERROR_PERMISSION;
-    if (!AcquireForResume(fiber)) return SCE_FIBER_ERROR_STATE;
-    ThreadState().threadFramePointer = reinterpret_cast<std::uint64_t>(static_cast<void**>(__builtin_frame_address(0))[0]);
+    if (const auto acquired = AcquireWithContext(fiber, addr_context, size_context); acquired != SCE_OK) return acquired;
+    ThreadState().threadFramePointer = threadFramePointer;
     ThreadState().threadBounds = CurrentBounds();
     Resume(fiber, &ThreadState().threadStack, arg_on_run);
     CompletePendingSuspend();
@@ -465,12 +506,13 @@ int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t arg_on_r
     return SCE_OK;
 }
 
-int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
+static int32_t SwitchFiber(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
     auto* target = AsFiber(object);
     if (!target) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
     auto* self = ThreadState().current;
     if (!self) return SCE_FIBER_ERROR_PERMISSION;
-    if (target == self || !AcquireForResume(target)) return SCE_FIBER_ERROR_STATE;
+    if (target == self) return SCE_FIBER_ERROR_STATE;
+    if (const auto acquired = AcquireWithContext(target, addr_context, size_context); acquired != SCE_OK) return acquired;
     if (TraceFibers()) {
         auto** frame = static_cast<void**>(__builtin_frame_address(0));
         void* chain[6] = {};
@@ -489,6 +531,36 @@ int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t arg_on_run, uint6
     return SCE_OK;
 }
 
+static std::uint64_t CallerFramePointer(void* frame) {
+    return reinterpret_cast<std::uint64_t>(static_cast<void**>(frame)[0]);
+}
+
+extern "C" {
+
+int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, const void* opt_param, uint32_t build_version) {
+    (void)opt_param;
+    (void)build_version;
+    return InitializeFiber(object, name, entry, arg_on_initialize, addr_context, size_context, 0);
+}
+
+int32_t APS5_VABI sceFiberFinalize(FiberObject* object) {
+    auto* fiber = AsFiber(object);
+    if (!fiber) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
+    const auto state = fiber->state.load(std::memory_order_acquire);
+    if (state == FiberState::Running || state == FiberState::Suspending) return SCE_FIBER_ERROR_STATE;
+    fiber->magic = 0;
+    DetachStack(fiber);
+    return SCE_OK;
+}
+
+int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_return) {
+    return RunFiber(object, nullptr, 0, arg_on_run, arg_on_return, CallerFramePointer(__builtin_frame_address(0)));
+}
+
+int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
+    return SwitchFiber(object, nullptr, 0, arg_on_run, arg_on_run_out);
+}
+
 int32_t APS5_VABI sceFiberReturnToThread(uint64_t arg_on_return, uint64_t* arg_on_run) {
     auto* self = ThreadState().current;
     if (!self) return SCE_FIBER_ERROR_PERMISSION;
@@ -498,7 +570,7 @@ int32_t APS5_VABI sceFiberReturnToThread(uint64_t arg_on_return, uint64_t* arg_o
     ThreadState().current = nullptr;
     ThreadState().transfer = arg_on_return;
     SetBounds(ThreadState().threadBounds);
-    Aps5FiberSwitchStack_nid_no_patch(&self->savedStack, ThreadState().threadStack);
+    Aps5FiberSwitchStack_nid_no_patch(&self->savedStack, &ThreadState().threadStack, nullptr);
     CompletePendingSuspend();
     if (arg_on_run) *arg_on_run = ThreadState().transfer;
     return SCE_OK;
@@ -521,7 +593,7 @@ int32_t APS5_VABI sceFiberGetInfo(FiberObject* object, FiberInfo* fiber_info) {
     fiber_info->size_context = fiber->contextSize;
     std::memcpy(fiber_info->name, fiber->name, sizeof(fiber_info->name));
     fiber_info->size_context_margin = static_cast<uint64_t>(-1);
-    if (fiber->contextSizeCheck) {
+    if (fiber->contextSizeCheck && fiber->context) {
         const auto* words = SizedWindow(fiber);
         const auto* end = words + fiber->contextSize / sizeof(std::uint64_t);
         fiber_info->size_context_margin = static_cast<uint64_t>(std::find_if(words, end, [](std::uint64_t word) { return word != FIBER_CONTEXT_FILL; }) - words) * sizeof(std::uint64_t);
@@ -565,24 +637,18 @@ int32_t APS5_VABI sceFiberStopContextSizeCheck(void) {
     return g_contextSizeCheck.compare_exchange_strong(expected, false) ? SCE_OK : SCE_FIBER_ERROR_STATE;
 }
 
-int APS5_VABI _sceFiberAttachContextAndRun(FiberObject* fiber, void* addr_context, uint64_t size_context,
-                                          uint64_t arg_on_run, uint64_t* arg_on_return) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int32_t APS5_VABI _sceFiberAttachContextAndRun(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_return) {
+    return RunFiber(object, addr_context, size_context, arg_on_run, arg_on_return, CallerFramePointer(__builtin_frame_address(0)));
 }
 
-int APS5_VABI _sceFiberAttachContextAndSwitch(FiberObject* fiber, void* addr_context, uint64_t size_context,
-                                              uint64_t arg_on_run, uint64_t* arg_on_run_out) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int32_t APS5_VABI _sceFiberAttachContextAndSwitch(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
+    return SwitchFiber(object, addr_context, size_context, arg_on_run, arg_on_run_out);
 }
 
-int APS5_VABI _sceFiberInitializeWithInternalOptionImpl(FiberObject* fiber, const char* name, GuestFiberEntry entry,
-                                                        uint64_t arg_on_initialize, void* addr_context,
-                                                        uint64_t size_context, const FiberOptParam* opt_param,
-                                                        uint32_t flags, uint32_t build_version) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int32_t APS5_VABI _sceFiberInitializeWithInternalOptionImpl(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, const FiberOptParam* opt_param, uint32_t flags, uint32_t build_version) {
+    (void)opt_param;
+    (void)build_version;
+    return InitializeFiber(object, name, entry, arg_on_initialize, addr_context, size_context, flags);
 }
 
 }
diff --git a/core/libs/prx/libSceFiber/include/Api.hpp b/core/libs/prx/libSceFiber/include/Api.hpp
new file mode 100644
index 0000000000..e9cef9744c
--- /dev/null
+++ b/core/libs/prx/libSceFiber/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using GuestFiberEntry = FiberEntry;
+
+extern "C" {
+
+int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t argOnInitialize, void* addrContext, uint64_t sizeContext, const void* optParam, uint32_t buildVersion);
+int32_t APS5_VABI sceFiberFinalize(FiberObject* object);
+int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t argOnRun, uint64_t* argOnReturn);
+int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t argOnRun, uint64_t* argOnRunOut);
+int32_t APS5_VABI sceFiberReturnToThread(uint64_t argOnReturn, uint64_t* argOnRun);
+int32_t APS5_VABI sceFiberGetSelf(FiberObject** fiber);
+int32_t APS5_VABI sceFiberGetInfo(FiberObject* object, FiberInfo* fiberInfo);
+int32_t APS5_VABI sceFiberRename(FiberObject* object, const char* name);
+int32_t APS5_VABI sceFiberOptParamInitialize(FiberOptParam* optParam);
+int32_t APS5_VABI sceFiberGetThreadFramePointerAddress(uint64_t* addrFramePointer);
+int32_t APS5_VABI _sceFiberGetThreadFramePointerAddress(uint64_t* addrFramePointer);
+int32_t APS5_VABI sceFiberStartContextSizeCheck(uint32_t flags);
+int32_t APS5_VABI sceFiberStopContextSizeCheck(void);
+int32_t APS5_VABI _sceFiberAttachContextAndRun(FiberObject* object, void* addrContext, uint64_t sizeContext, uint64_t argOnRun, uint64_t* argOnReturn);
+int32_t APS5_VABI _sceFiberAttachContextAndSwitch(FiberObject* object, void* addrContext, uint64_t sizeContext, uint64_t argOnRun, uint64_t* argOnRunOut);
+int32_t APS5_VABI _sceFiberInitializeWithInternalOptionImpl(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t argOnInitialize, void* addrContext, uint64_t sizeContext, const FiberOptParam* optParam, uint32_t flags, uint32_t buildVersion);
+
+}
diff --git a/core/libs/prx/libSceFiber/libSceFiber.hpp b/core/libs/prx/libSceFiber/libSceFiber.hpp
new file mode 100644
index 0000000000..1a16c725b6
--- /dev/null
+++ b/core/libs/prx/libSceFiber/libSceFiber.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFiber/include/Api.hpp"
diff --git a/core/libs/prx/libSceFios2/Export.cpp b/core/libs/prx/libSceFios2/Export.cpp
index eeedc28190..b97176c204 100644
--- a/core/libs/prx/libSceFios2/Export.cpp
+++ b/core/libs/prx/libSceFios2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFios2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceFios2/include/Api.hpp b/core/libs/prx/libSceFios2/include/Api.hpp
new file mode 100644
index 0000000000..354858a01d
--- /dev/null
+++ b/core/libs/prx/libSceFios2/include/Api.hpp
@@ -0,0 +1,176 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceFiosArchiveGetDecompressorThreadCount();
+int APS5_VABI sceFiosArchiveGetMountBufferSize();
+int APS5_VABI sceFiosArchiveGetMountBufferSizeSync();
+int APS5_VABI sceFiosArchiveMount();
+int APS5_VABI sceFiosArchiveMountSync();
+int APS5_VABI sceFiosArchiveMountWithOrder();
+int APS5_VABI sceFiosArchiveMountWithOrderSync();
+int APS5_VABI sceFiosArchiveSetDecompressorThreadCount();
+int APS5_VABI sceFiosArchiveUnmount();
+int APS5_VABI sceFiosArchiveUnmountSync();
+int APS5_VABI sceFiosCacheContainsFileRangeSync();
+int APS5_VABI sceFiosCacheContainsFileSync();
+int APS5_VABI sceFiosCacheFlushFileRangeSync();
+int APS5_VABI sceFiosCacheFlushFileSync();
+int APS5_VABI sceFiosCacheFlushSync();
+int APS5_VABI sceFiosCachePrefetchFH();
+int APS5_VABI sceFiosCachePrefetchFHRange();
+int APS5_VABI sceFiosCachePrefetchFHRangeSync();
+int APS5_VABI sceFiosCachePrefetchFHSync();
+int APS5_VABI sceFiosCachePrefetchFile();
+int APS5_VABI sceFiosCachePrefetchFileRange();
+int APS5_VABI sceFiosCachePrefetchFileRangeSync();
+int APS5_VABI sceFiosCachePrefetchFileSync();
+int APS5_VABI sceFiosCancelAllOps();
+int APS5_VABI sceFiosClearTimeStamps();
+int APS5_VABI sceFiosCloseAllFiles();
+int APS5_VABI sceFiosDHClose();
+int APS5_VABI sceFiosDHCloseSync();
+int APS5_VABI sceFiosDHGetPath();
+int APS5_VABI sceFiosDHOpen();
+int APS5_VABI sceFiosDHOpenSync();
+int APS5_VABI sceFiosDHRead();
+int APS5_VABI sceFiosDHReadSync();
+int APS5_VABI sceFiosDLLInitialize();
+int APS5_VABI sceFiosDLLTerminate();
+int APS5_VABI sceFiosDateFromComponents();
+int APS5_VABI sceFiosDateGetCurrent();
+int APS5_VABI sceFiosDateToComponents();
+int APS5_VABI sceFiosDeallocatePassthruFH();
+int APS5_VABI sceFiosDebugDumpDH();
+int APS5_VABI sceFiosDebugDumpDate();
+int APS5_VABI sceFiosDebugDumpError();
+int APS5_VABI sceFiosDebugDumpFH();
+int APS5_VABI sceFiosDebugDumpOp();
+int APS5_VABI sceFiosDelete();
+int APS5_VABI sceFiosDeleteSync();
+int APS5_VABI sceFiosDirectoryCreate();
+int APS5_VABI sceFiosDirectoryCreateSync();
+int APS5_VABI sceFiosDirectoryCreateWithMode();
+int APS5_VABI sceFiosDirectoryCreateWithModeSync();
+int APS5_VABI sceFiosDirectoryDelete();
+int APS5_VABI sceFiosDirectoryDeleteSync();
+int APS5_VABI sceFiosDirectoryExists();
+int APS5_VABI sceFiosDirectoryExistsSync();
+int APS5_VABI sceFiosExists();
+int APS5_VABI sceFiosExistsSync();
+int APS5_VABI sceFiosFHClose();
+int APS5_VABI sceFiosFHCloseSync();
+int APS5_VABI sceFiosFHGetOpenParams();
+int APS5_VABI sceFiosFHGetPath();
+int APS5_VABI sceFiosFHGetSize();
+int APS5_VABI sceFiosFHOpen();
+int APS5_VABI sceFiosFHOpenSync();
+int APS5_VABI sceFiosFHOpenWithMode();
+int APS5_VABI sceFiosFHOpenWithModeSync();
+int APS5_VABI sceFiosFHPread();
+int APS5_VABI sceFiosFHPreadSync();
+int APS5_VABI sceFiosFHPreadv();
+int APS5_VABI sceFiosFHPreadvSync();
+int APS5_VABI sceFiosFHPwrite();
+int APS5_VABI sceFiosFHPwriteSync();
+int APS5_VABI sceFiosFHPwritev();
+int APS5_VABI sceFiosFHPwritevSync();
+int APS5_VABI sceFiosFHRead();
+int APS5_VABI sceFiosFHReadSync();
+int APS5_VABI sceFiosFHReadv();
+int APS5_VABI sceFiosFHReadvSync();
+int APS5_VABI sceFiosFHSeek();
+int APS5_VABI sceFiosFHStat();
+int APS5_VABI sceFiosFHStatSync();
+int APS5_VABI sceFiosFHSync();
+int APS5_VABI sceFiosFHSyncSync();
+int APS5_VABI sceFiosFHTell();
+int APS5_VABI sceFiosFHToFileno();
+int APS5_VABI sceFiosFHTruncate();
+int APS5_VABI sceFiosFHTruncateSync();
+int APS5_VABI sceFiosFHWrite();
+int APS5_VABI sceFiosFHWriteSync();
+int APS5_VABI sceFiosFHWritev();
+int APS5_VABI sceFiosFHWritevSync();
+int APS5_VABI sceFiosFileDelete();
+int APS5_VABI sceFiosFileDeleteSync();
+int APS5_VABI sceFiosFileExists();
+int APS5_VABI sceFiosFileExistsSync();
+int APS5_VABI sceFiosFileGetSize();
+int APS5_VABI sceFiosFileGetSizeSync();
+int APS5_VABI sceFiosFileRead();
+int APS5_VABI sceFiosFileReadSync();
+int APS5_VABI sceFiosFileTruncate();
+int APS5_VABI sceFiosFileTruncateSync();
+int APS5_VABI sceFiosFileWrite();
+int APS5_VABI sceFiosFileWriteSync();
+int APS5_VABI sceFiosFilenoToFH();
+int APS5_VABI sceFiosGetAllDHs();
+int APS5_VABI sceFiosGetAllFHs();
+int APS5_VABI sceFiosGetAllOps();
+int APS5_VABI sceFiosGetDefaultOpAttr();
+int APS5_VABI sceFiosGetGlobalDefaultOpAttr();
+int APS5_VABI sceFiosGetSuspendCount();
+int APS5_VABI sceFiosGetThreadDefaultOpAttr();
+int APS5_VABI sceFiosIOFilterAdd();
+int APS5_VABI sceFiosIOFilterCache();
+int APS5_VABI sceFiosIOFilterGetInfo();
+int APS5_VABI sceFiosIOFilterPsarcDearchiver();
+int APS5_VABI sceFiosIOFilterRemove();
+int APS5_VABI sceFiosInitialize();
+int APS5_VABI sceFiosIsIdle();
+int APS5_VABI sceFiosIsInitialized();
+int APS5_VABI sceFiosIsSuspended();
+int APS5_VABI sceFiosIsValidHandle();
+int APS5_VABI sceFiosOpCancel();
+int APS5_VABI sceFiosOpDelete();
+int APS5_VABI sceFiosOpGetActualCount();
+int APS5_VABI sceFiosOpGetAttr();
+int APS5_VABI sceFiosOpGetBuffer();
+int APS5_VABI sceFiosOpGetError();
+int APS5_VABI sceFiosOpGetOffset();
+int APS5_VABI sceFiosOpGetPath();
+int APS5_VABI sceFiosOpGetRequestCount();
+int APS5_VABI sceFiosOpIsCancelled();
+int APS5_VABI sceFiosOpIsDone();
+int APS5_VABI sceFiosOpReschedule();
+int APS5_VABI sceFiosOpRescheduleWithPriority();
+int APS5_VABI sceFiosOpSetBuffer();
+int APS5_VABI sceFiosOpSyncWait();
+int APS5_VABI sceFiosOpSyncWaitForIO();
+int APS5_VABI sceFiosOpWait();
+int APS5_VABI sceFiosOpWaitUntil();
+int APS5_VABI sceFiosOverlayAdd();
+int APS5_VABI sceFiosOverlayGetInfo();
+int APS5_VABI sceFiosOverlayGetList();
+int APS5_VABI sceFiosOverlayModify();
+int APS5_VABI sceFiosOverlayRemove();
+int APS5_VABI sceFiosOverlayResolveSync();
+int APS5_VABI sceFiosPathNormalize();
+int APS5_VABI sceFiosPathcmp();
+int APS5_VABI sceFiosPathncmp();
+int APS5_VABI sceFiosPrintTimeStamps();
+int APS5_VABI sceFiosPrintf();
+int APS5_VABI sceFiosRename();
+int APS5_VABI sceFiosRenameSync();
+int APS5_VABI sceFiosResolve();
+int APS5_VABI sceFiosResolveSync();
+int APS5_VABI sceFiosResume();
+int APS5_VABI sceFiosSaveTimeStamp();
+int APS5_VABI sceFiosSetGlobalDefaultOpAttr();
+int APS5_VABI sceFiosSetThreadDefaultOpAttr();
+int APS5_VABI sceFiosShutdownAndCancelOps();
+int APS5_VABI sceFiosStat();
+int APS5_VABI sceFiosStatSync();
+int APS5_VABI sceFiosSuspend();
+int APS5_VABI sceFiosTerminate();
+int APS5_VABI sceFiosTimeGetCurrent();
+int APS5_VABI sceFiosTimeIntervalFromNanoseconds();
+int APS5_VABI sceFiosTimeIntervalToNanoseconds();
+int APS5_VABI sceFiosTraceTimestamp();
+int APS5_VABI sceFiosUpdateParameters();
+int APS5_VABI sceFiosVprintf();
+
+}
diff --git a/core/libs/prx/libSceFios2/libSceFios2.hpp b/core/libs/prx/libSceFios2/libSceFios2.hpp
new file mode 100644
index 0000000000..5f164953f7
--- /dev/null
+++ b/core/libs/prx/libSceFios2/libSceFios2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFios2/include/Api.hpp"
diff --git a/core/libs/prx/libSceFont-module/libSceFont-module.hpp b/core/libs/prx/libSceFont-module/libSceFont-module.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFont-module/libSceFont-module.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFont.native/libSceFont.native.hpp b/core/libs/prx/libSceFont.native/libSceFont.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFont.native/libSceFont.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFont/CMakeLists.txt b/core/libs/prx/libSceFont/CMakeLists.txt
index cec16f879b..dfa37bf121 100644
--- a/core/libs/prx/libSceFont/CMakeLists.txt
+++ b/core/libs/prx/libSceFont/CMakeLists.txt
@@ -16,6 +16,33 @@ if(BUILD_TESTING)
         set_tests_properties(guest_font guest_system_font PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFont>")
     endif()
+    add_test_executable(guest_font_metrics_tests ${LIBS_INCLUDE_DIR}/tests/GuestFontMetrics.cpp)
+    target_include_directories(guest_font_metrics_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_font_metrics_tests PRIVATE libSceFont libSceFontFt libc)
+    configure_windows_unwind(guest_font_metrics_tests)
+    add_test(NAME guest_font_metrics COMMAND guest_font_metrics_tests)
+    if(WIN32)
+        set_tests_properties(guest_font_metrics PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFont>")
+    endif()
+    add_test_executable(guest_font_style_information_tests ${LIBS_INCLUDE_DIR}/tests/GuestFontStyleInformation.cpp)
+    target_include_directories(guest_font_style_information_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_font_style_information_tests PRIVATE libSceFont libSceFontFt libc)
+    configure_windows_unwind(guest_font_style_information_tests)
+    add_test(NAME guest_font_style_information COMMAND guest_font_style_information_tests)
+    if(WIN32)
+        set_tests_properties(guest_font_style_information PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFont>")
+    endif()
+    add_test_executable(guest_font_outline_profile_tests ${LIBS_INCLUDE_DIR}/tests/GuestFontOutlineProfile.cpp)
+    target_include_directories(guest_font_outline_profile_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_font_outline_profile_tests PRIVATE libSceFont libSceFontFt libc)
+    configure_windows_unwind(guest_font_outline_profile_tests)
+    add_test(NAME guest_font_outline_profile COMMAND guest_font_outline_profile_tests)
+    if(WIN32)
+        set_tests_properties(guest_font_outline_profile PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFont>")
+    endif()
     add_test_executable(guest_font_writing_line_tests ${LIBS_INCLUDE_DIR}/tests/GuestFontWritingLine.cpp)
     target_include_directories(guest_font_writing_line_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_font_writing_line_tests PRIVATE libSceFont libc)
@@ -25,6 +52,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_font_writing_line PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFont>")
     endif()
+    add_test_executable(guest_font_graphics_tests ${LIBS_INCLUDE_DIR}/tests/GuestFontGraphics.cpp)
+    target_include_directories(guest_font_graphics_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_font_graphics_tests PRIVATE libSceFont libc)
+    configure_windows_unwind(guest_font_graphics_tests)
+    add_test(NAME guest_font_graphics COMMAND guest_font_graphics_tests)
+    if(WIN32)
+        set_tests_properties(guest_font_graphics PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFont>")
+    endif()
     add_test_executable(font_face_lifetime_tests ${LIBS_INCLUDE_DIR}/tests/FontFaceLifetime.cpp
             ${CMAKE_CURRENT_SOURCE_DIR}/src/State.cpp)
     target_include_directories(font_face_lifetime_tests PRIVATE ${LIBS_INCLUDE_DIR})
@@ -38,4 +74,13 @@ if(BUILD_TESTING)
         set_tests_properties(font_face_lifetime font_face_lifetime_replace font_face_lifetime_churn PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_font_words_tests ${LIBS_INCLUDE_DIR}/tests/GuestFontWords.cpp)
+    target_include_directories(guest_font_words_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_font_words_tests PRIVATE libSceFont libc)
+    configure_windows_unwind(guest_font_words_tests)
+    add_test(NAME guest_font_words COMMAND guest_font_words_tests)
+    if(WIN32)
+        set_tests_properties(guest_font_words PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFont>")
+    endif()
 endif()
diff --git a/core/libs/prx/libSceFont/FontLibrary.cmake b/core/libs/prx/libSceFont/FontLibrary.cmake
index 47bf723165..0ae75346fe 100644
--- a/core/libs/prx/libSceFont/FontLibrary.cmake
+++ b/core/libs/prx/libSceFont/FontLibrary.cmake
@@ -1,6 +1,7 @@
 function(add_sce_font_library target)
     set(fontDir ${CMAKE_CURRENT_FUNCTION_LIST_DIR})
     add_library(${target} SHARED EXCLUDE_FROM_ALL
+            ${fontDir}/src/Graphics.cpp
             ${fontDir}/src/Layout.cpp
             ${fontDir}/src/Library.cpp
             ${fontDir}/src/Open.cpp
@@ -10,6 +11,7 @@ function(add_sce_font_library target)
             ${fontDir}/src/SystemFont.cpp
             ${fontDir}/src/Text.cpp
             ${fontDir}/src/Unimplemented.cpp
+            ${fontDir}/src/Words.cpp
             ${fontDir}/src/WritingLine.cpp
     )
     target_include_directories(${target} PRIVATE ${LIBS_INCLUDE_DIR})
diff --git a/core/libs/prx/libSceFont/include/Api.hpp b/core/libs/prx/libSceFont/include/Api.hpp
new file mode 100644
index 0000000000..2e7d3d5ca6
--- /dev/null
+++ b/core/libs/prx/libSceFont/include/Api.hpp
@@ -0,0 +1,336 @@
+#pragma once
+
+#include "prx/libSceFont/include/FontTypes.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <bit>
+#include <chrono>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <limits>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <new>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <system_error>
+#include <thread>
+#include <unordered_map>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+struct FontGraphicsDevice;
+
+struct FontGraphicsDeviceParam;
+
+struct FontGraphicsService;
+
+struct FontGraphicsServiceParam;
+
+struct FontWords;
+
+struct FontGlyphSupport;
+
+struct FontOutlineProfile;
+
+struct FontMetrics;
+
+struct FontStyleInformation;
+
+struct FontGlyphExpandBufferState;
+
+struct FontGraphicsResource;
+
+struct FontGraphicsFrame;
+
+struct FontGraphicsDesignResource;
+
+struct FontGraphicsDesign;
+
+struct FontGraphicsCanvas;
+
+struct FontGraphicsCanvasSequence;
+
+struct FontGraphicsSurface;
+
+struct FontGraphicsSurfaceTexture;
+
+struct FontGraphicsFill;
+
+struct FontGraphicsRegion {
+    float x;
+    float y;
+    float width;
+    float height;
+    std::uint32_t flags;
+    std::uint32_t tag;
+    float outerRadius;
+    float innerRadius;
+};
+
+struct FontGraphicsFillMethod {
+    std::int32_t mode;
+    std::int32_t type;
+    std::uint32_t flags;
+    std::uint32_t tag;
+    std::byte reserved[16];
+};
+
+struct FontGraphicsFillPlot {
+    float mapping[4];
+    const FontGraphicsRegion* region;
+    std::uint16_t tag;
+    std::uint16_t reserved26;
+    std::uint16_t layout;
+    std::uint8_t flags;
+    std::byte reserved[33];
+};
+
+struct FontGraphicsFillRates {
+    float mapping[4];
+    const FontGraphicsFill* fill;
+    std::uint16_t tag;
+    std::uint16_t effect;
+    std::uint16_t layout;
+    std::uint8_t flags;
+    std::byte reserved[33];
+};
+
+struct FontGraphicsPoolUsage {
+    std::uint32_t capacity;
+    std::uint32_t used;
+    std::uint32_t available;
+    std::uint32_t peak;
+    std::int32_t change;
+};
+
+struct FontGraphicsMemoryUsage {
+    FontGraphicsPoolUsage storage;
+    FontGraphicsPoolUsage allocations;
+    void* address;
+};
+
+struct FontGraphicsDeviceUsage {
+    FontGraphicsMemoryUsage first;
+    FontGraphicsMemoryUsage second;
+};
+
+namespace Font {
+
+using GraphicsErrorCallback = void (APS5_VABI*)(int error);
+
+}
+
+extern "C" {
+
+int APS5_VABI sceFontMemoryInit(FontMemory* memory, void* regionAddress, std::uint32_t regionSize, const FontMemoryInterface* iface, void* mspaceObject, FontMemoryDestroyFunction destroyCallback, void* destroyObject);
+int APS5_VABI sceFontMemoryTerm(FontMemory* memory);
+int APS5_VABI sceFontCreateLibraryWithEdition(const FontMemory* memory, const void* createParams, std::uint64_t edition, FontLibrary* pLibrary);
+int APS5_VABI sceFontCreateLibrary(const FontMemory* memory, const void* createParams, FontLibrary* pLibrary);
+int APS5_VABI sceFontDestroyLibrary(FontLibrary* pLibrary);
+int APS5_VABI sceFontCreateRendererWithEdition(const FontMemory* memory, const void* createParams, std::uint64_t edition, FontRenderer* pRenderer);
+int APS5_VABI sceFontCreateRenderer(const FontMemory* memory, const void* createParams, FontRenderer* pRenderer);
+int APS5_VABI sceFontDestroyRenderer(FontRenderer* pRenderer);
+int APS5_VABI sceFontRendererGetOutlineBufferSize(FontRenderer fontRenderer, std::uint32_t* size);
+int APS5_VABI sceFontRendererResetOutlineBuffer(FontRenderer fontRenderer);
+int APS5_VABI sceFontRendererSetOutlineBufferPolicy(FontRenderer fontRenderer, std::uint64_t bufferPolicy, std::uint32_t basalSize, std::uint32_t limitSize);
+int APS5_VABI sceFontGetPixelResolution(FontLibrary library, std::uint32_t* subPixelCount);
+int APS5_VABI sceFontAttachDeviceCacheBuffer(FontLibrary library, void* buffer, std::uint32_t size);
+int APS5_VABI sceFontClearDeviceCache(FontLibrary library);
+int APS5_VABI sceFontDettachDeviceCacheBuffer(FontLibrary library, void** buffer, std::uint32_t* size);
+int APS5_VABI sceFontSupportExternalFonts(FontLibrary library, std::uint32_t fontMax, std::uint32_t formats);
+int APS5_VABI sceFontSupportSystemFonts(FontLibrary library);
+void APS5_VABI sceFontSetGraphicsErrorCallback(Font::GraphicsErrorCallback callback);
+int APS5_VABI sceFontSetFontsOpenMode(FontLibrary library, std::uint32_t openMode);
+int APS5_VABI sceFontOpenFontMemory(FontLibrary library, const void* fontAddress, std::uint32_t fontSize, const FontOpenDetail* openDetail, FontHandle* pFontHandle);
+int APS5_VABI sceFontOpenFontFile(FontLibrary library, const char* path, std::uint32_t openMode, const FontOpenDetail* openDetail, FontHandle* pFontHandle);
+int APS5_VABI sceFontOpenFontInstance(FontHandle fontHandle, FontHandle setupFont, FontHandle* pFontHandle);
+int APS5_VABI sceFontOpenFontSet(FontLibrary library, std::uint32_t fontSetType, std::uint32_t openMode, const FontOpenDetail* openDetail, FontHandle* pFontHandle);
+int APS5_VABI sceFontCloseFont(FontHandle fontHandle);
+int APS5_VABI sceFontGetLibrary(FontHandle fontHandle, FontLibrary* pLibrary);
+int APS5_VABI sceFontGetFontGlyphsCount(FontHandle fontHandle, std::uint32_t* glyphsCount);
+int APS5_VABI sceFontGetCharGlyphCode(FontHandle fontHandle, std::uint32_t code, std::uint32_t* glyphCode);
+int APS5_VABI sceFontGetFontResolution(FontHandle fontHandle, std::uint32_t* pResolution, float* pScalePixel);
+int APS5_VABI sceFontBindRenderer(FontHandle fontHandle, FontRenderer renderer);
+int APS5_VABI sceFontRebindRenderer(FontHandle fontHandle);
+int APS5_VABI sceFontUnbindRenderer(FontHandle fontHandle);
+int APS5_VABI sceFontGetCharGlyphMetrics(FontHandle fontHandle, std::uint32_t code, FontGlyphMetrics* metrics);
+int APS5_VABI sceFontGetRenderCharGlyphMetrics(FontHandle fontHandle, std::uint32_t code, FontGlyphMetrics* metrics);
+int APS5_VABI sceFontGetHorizontalLayout(FontHandle fontHandle, FontHorizontalLayout* layout);
+int APS5_VABI sceFontGetVerticalLayout(FontHandle fontHandle, FontVerticalLayout* layout);
+int APS5_VABI sceFontGetKerning(FontHandle fontHandle, std::uint32_t preCode, std::uint32_t code, FontKerning* kerning);
+int APS5_VABI sceFontGetRenderScaledKerning(FontHandle fontHandle, std::uint32_t preCode, std::uint32_t code, FontKerning* kerning);
+int APS5_VABI sceFontRenderCharGlyphImage(FontHandle fontHandle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
+int APS5_VABI sceFontRenderCharGlyphImageHorizontal(FontHandle fontHandle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
+int APS5_VABI sceFontRenderCharGlyphImageVertical(FontHandle fontHandle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
+void APS5_VABI sceFontRenderSurfaceInit(FontRenderSurface* renderSurface, void* buffer, int bufWidthByte, int pixelSizeByte, int widthPixel, int heightPixel);
+void APS5_VABI sceFontRenderSurfaceSetScissor(FontRenderSurface* renderSurface, int x0, int y0, int w, int h);
+int APS5_VABI sceFontRenderSurfaceSetStyleFrame(FontRenderSurface* renderSurface, FontStyleFrame* styleFrame);
+int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code, const FontGenerateGlyphDetail* detail, FontGlyph* pGlyph);
+int APS5_VABI sceFontDeleteGlyph(const FontMemory* memory, FontGlyph* pGlyph);
+int APS5_VABI sceFontGlyphDefineAttribute(FontGlyph glyph, std::int32_t attribute, std::int32_t* previousAttribute);
+int APS5_VABI sceFontGlyphGetAttribute(FontGlyph glyph, int attribute, int* nowAttribute);
+int APS5_VABI sceFontGlyphGetGlyphForm(FontGlyph glyph);
+int APS5_VABI sceFontGlyphGetMetricsForm(FontGlyph glyph);
+int APS5_VABI sceFontGlyphGetScalePixel(FontGlyph glyph, float* w, float* h);
+const FontGlyphMetrics* APS5_VABI sceFontGlyphRefersMetrics(FontGlyph glyph);
+const FontGlyphMetricsHorizontal* APS5_VABI sceFontGlyphRefersMetricsHorizontal(FontGlyph glyph);
+const FontGlyphMetricsHorizontalAdvance* APS5_VABI sceFontGlyphRefersMetricsHorizontalAdvance(FontGlyph glyph);
+const FontGlyphMetricsHorizontalX* APS5_VABI sceFontGlyphRefersMetricsHorizontalX(FontGlyph glyph);
+FontGlyphOutline* APS5_VABI sceFontGlyphRefersOutline(FontGlyph glyph);
+int APS5_VABI sceFontDefineAttribute(FontHandle fontHandle, int attribute, int* oldAttribute);
+int APS5_VABI sceFontGetAttribute(FontHandle fontHandle, int attribute, int* nowAttribute);
+int APS5_VABI sceFontSetScriptLanguage(FontHandle fontHandle, int fontScript, int fontLanguage);
+int APS5_VABI sceFontGetScriptLanguage(FontHandle fontHandle, int fontScript, int* fontLanguage);
+int APS5_VABI sceFontSetTypographicDesign(FontHandle fontHandle, int typographic, int feature);
+int APS5_VABI sceFontGetTypographicDesign(FontHandle fontHandle, int typographic, int* feature);
+int APS5_VABI sceFontSetScalePixel(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetScalePoint(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetResolutionDpi(FontHandle fontHandle, std::uint32_t hDpi, std::uint32_t vDpi);
+int APS5_VABI sceFontSetEffectSlant(FontHandle fontHandle, float slantRatio);
+int APS5_VABI sceFontSetEffectWeight(FontHandle fontHandle, float weightXScale, float weightYScale, std::uint32_t mode);
+int APS5_VABI sceFontGetScalePixel(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetScalePoint(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetResolutionDpi(FontHandle fontHandle, std::uint32_t* hDpi, std::uint32_t* vDpi);
+int APS5_VABI sceFontGetEffectSlant(FontHandle fontHandle, float* slantRatio);
+int APS5_VABI sceFontGetEffectWeight(FontHandle fontHandle, float* weightXScale, float* weightYScale, std::uint32_t* mode);
+int APS5_VABI sceFontSetupRenderScalePixel(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetupRenderScalePoint(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetupRenderEffectSlant(FontHandle fontHandle, float slantRatio);
+int APS5_VABI sceFontSetupRenderEffectWeight(FontHandle fontHandle, float weightXScale, float weightYScale, std::uint32_t mode);
+int APS5_VABI sceFontGetRenderScalePixel(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetRenderScalePoint(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetRenderEffectSlant(FontHandle fontHandle, float* slantRatio);
+int APS5_VABI sceFontGetRenderEffectWeight(FontHandle fontHandle, float* weightXScale, float* weightYScale, std::uint32_t* mode);
+int APS5_VABI sceFontStyleFrameInit(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameSetScalePixel(FontStyleFrame* styleFrame, float w, float h);
+int APS5_VABI sceFontStyleFrameSetScalePoint(FontStyleFrame* styleFrame, float w, float h);
+int APS5_VABI sceFontStyleFrameSetResolutionDpi(FontStyleFrame* styleFrame, std::uint32_t hDpi, std::uint32_t vDpi);
+int APS5_VABI sceFontStyleFrameSetEffectSlant(FontStyleFrame* styleFrame, float slantRatio);
+int APS5_VABI sceFontStyleFrameSetEffectWeight(FontStyleFrame* styleFrame, float weightXScale, float weightYScale, std::uint32_t mode);
+int APS5_VABI sceFontStyleFrameUnsetScale(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameUnsetEffectSlant(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameUnsetEffectWeight(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameGetScalePixel(const FontStyleFrame* styleFrame, float* w, float* h);
+int APS5_VABI sceFontStyleFrameGetScalePoint(const FontStyleFrame* styleFrame, float* w, float* h);
+int APS5_VABI sceFontStyleFrameGetResolutionDpi(const FontStyleFrame* styleFrame, std::uint32_t* hDpi, std::uint32_t* vDpi);
+int APS5_VABI sceFontStyleFrameGetEffectSlant(const FontStyleFrame* styleFrame, float* slantRatio);
+int APS5_VABI sceFontStyleFrameGetEffectWeight(const FontStyleFrame* styleFrame, float* weightXScale, float* weightYScale, std::uint32_t* mode);
+int APS5_VABI sceFontTextSourceInit(FontTextSource* textSource, const void* textAddress, std::uint32_t textSizeByte, FontTextParseFunction textParser, void* textObject);
+int APS5_VABI sceFontTextSourceRewind(FontTextSource* textSource);
+int APS5_VABI sceFontTextSourceSetDefaultFont(FontTextSource* textSource, FontHandle defaultFont);
+int APS5_VABI sceFontTextSourceSetWritingForm(FontTextSource* textSource, std::int32_t writingForm);
+int APS5_VABI sceFontCreateString(const FontMemory* fontMemory, FontTextSource* textSource, const FontCreateStringDetail* detail, FontString* pFontString);
+int APS5_VABI sceFontDestroyString(FontString* pFontString);
+std::uint32_t APS5_VABI sceFontStringGetTerminateCode(FontString fontString);
+void* APS5_VABI sceFontStringGetTerminateOrder(FontString fontString);
+int APS5_VABI sceFontStringGetWritingForm(FontString fontString);
+FontTextCharacter* APS5_VABI sceFontStringRefersTextCharacters(FontString fontString, std::uint32_t* characterCount);
+const FontTextCharacter* APS5_VABI sceFontStringRefersRenderCharacters(FontString fontString, FontTextCharacter* startCharacter, FontTextCharacter* lastCharacter, std::uint32_t* characterCount);
+int APS5_VABI sceFontCharacterGetBidiLevel(const FontTextCharacter* textCharacter, int* bidiLevel);
+int APS5_VABI sceFontCharacterGetSyllableStringState(const FontTextCharacter* textCharacter, int* syllableStringState);
+int APS5_VABI sceFontCharacterGetTextFontCode(const FontTextCharacter* textCharacter, FontHandle* pFontHandle, std::uint32_t* textCode);
+int APS5_VABI sceFontCharacterGetTextOrder(const FontTextCharacter* textCharacter, void** pTextOrder);
+std::uint32_t APS5_VABI sceFontCharacterLooksFormatCharacters(const FontTextCharacter* textCharacter);
+std::uint32_t APS5_VABI sceFontCharacterLooksWhiteSpace(const FontTextCharacter* textCharacter);
+FontTextCharacter* APS5_VABI sceFontCharacterRefersTextBack(const FontTextCharacter* textCharacter);
+FontTextCharacter* APS5_VABI sceFontCharacterRefersTextNext(const FontTextCharacter* textCharacter);
+FontTextCodes* APS5_VABI sceFontCharactersRefersTextCodes(const FontTextCharacter* textCharacter, const FontTextCharacter* termCharacter, FontTextCodes* textCodes);
+FontTextCodes* APS5_VABI sceFontTextCodesStepNext(FontTextCodes* textCodesStep);
+FontTextCodes* APS5_VABI sceFontTextCodesStepBack(FontTextCodes* textCodesStep);
+int APS5_VABI sceFontWritingInit(FontWriting* fontWriting, FontString fontString, const FontTextCharacter* fontCharacter);
+int APS5_VABI sceFontWritingGetRenderMetrics(FontWriting* fontWriting, FontWritingMetrics* writingMetrics);
+const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting* fontWriting);
+FontTextCharacter* APS5_VABI sceFontWritingRefersRenderStepCharacter(FontWriting* fontWriting, const FontWritingLetterStep** pLetterStep);
+int APS5_VABI sceFontWritingSetMaskInvisible(FontWriting* fontWriting, std::int32_t mask);
+int APS5_VABI sceFontControl(std::int32_t command, void* object, std::uintptr_t argument);
+int APS5_VABI sceFontCreateGraphicsDevice(const FontMemory* memory, const FontGraphicsDeviceParam* param, FontGraphicsDevice** device);
+int APS5_VABI sceFontCreateGraphicsService(const FontMemory* memory, const FontGraphicsServiceParam* param, FontGraphicsService** service);
+int APS5_VABI sceFontCreateGraphicsServiceWithEdition(const FontMemory* memory, const FontGraphicsServiceParam* param, std::uint64_t unusedSlot, FontGraphicsService** service);
+int APS5_VABI sceFontCreateWords(const FontMemory* memory, FontTextSource* source, std::uint64_t unusedSlot, FontWords** words);
+int APS5_VABI sceFontDestroyGraphicsDevice(FontGraphicsDevice** device);
+int APS5_VABI sceFontDestroyGraphicsService(FontGraphicsService** service);
+int APS5_VABI sceFontDestroyWords(FontWords** words);
+int APS5_VABI sceFontGetFontGlyphsOutlineProfile(FontHandle font, FontOutlineProfile* profile);
+int APS5_VABI sceFontGetFontMetrics(FontHandle font, std::uint32_t mode, FontMetrics* metrics);
+int APS5_VABI sceFontGetFontStyleInformation(FontHandle font, FontStyleInformation* information);
+int APS5_VABI sceFontGetGlyphExpandBufferState(FontHandle font, FontGlyphExpandBufferState* state);
+int APS5_VABI sceFontGlyphRenderImage(FontGlyph glyph, const FontStyleFrame* styleFrame, FontRenderer renderer, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* output);
+int APS5_VABI sceFontGlyphRenderImageHorizontal(FontGlyph glyph, const FontStyleFrame* styleFrame, FontRenderer renderer, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* output);
+int APS5_VABI sceFontGlyphRenderImageVertical(FontGlyph glyph, const FontStyleFrame* styleFrame, FontRenderer renderer, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* output);
+int APS5_VABI sceFontGraphicsBeginFrame(FontGraphicsFrame* frame, std::uint64_t flags, FontGraphicsResource** resource);
+int APS5_VABI sceFontGraphicsDrawingCancel(FontGraphicsFrame** frame);
+int APS5_VABI sceFontGraphicsDrawingFinish(FontGraphicsFrame** frame, FontGraphicsDevice* device);
+int APS5_VABI sceFontGraphicsEndFrame(FontGraphicsFrame* frame);
+int APS5_VABI sceFontGraphicsExchangeResource(FontGraphicsResource* resource, FontGraphicsDesignResource* replacement, FontGraphicsDesignResource** previous);
+int APS5_VABI sceFontGraphicsFillMethodInit(FontGraphicsFillMethod* method, std::int32_t mode, std::int32_t type);
+int APS5_VABI sceFontGraphicsFillPlotInit(FontGraphicsFillPlot* plot, const FontGraphicsRegion* region);
+int APS5_VABI sceFontGraphicsFillPlotSetLayout(FontGraphicsFillPlot* plot, std::int32_t first, std::int32_t second);
+int APS5_VABI sceFontGraphicsFillPlotSetMapping(FontGraphicsFillPlot* plot, float first, float second, float third, float fourth);
+int APS5_VABI sceFontGraphicsFillRatesInit(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect);
+int APS5_VABI sceFontGraphicsFillRatesSetFillEffect(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect);
+int APS5_VABI sceFontGraphicsFillRatesSetLayout(FontGraphicsFillRates* rates, std::int32_t first, std::int32_t second);
+int APS5_VABI sceFontGraphicsFillRatesSetMapping(FontGraphicsFillRates* rates, float first, float second, float third, float fourth);
+int APS5_VABI sceFontGraphicsGetDeviceUsage(FontGraphicsDevice* device, FontGraphicsDeviceUsage* usage);
+int APS5_VABI sceFontGraphicsRegionInit(FontGraphicsRegion* region, float x, float y, float width, float height);
+int APS5_VABI sceFontGraphicsRegionInitCircular(FontGraphicsRegion* region, float centerX, float centerY, float outerRadius, float innerRadius);
+int APS5_VABI sceFontGraphicsRegionInitRoundish(FontGraphicsRegion* region, float x, float y, float width, float height, float outerRadius, float innerRadius, std::uint32_t flags);
+int APS5_VABI sceFontGraphicsRelease(void** object);
+int APS5_VABI sceFontGraphicsRenderResource(FontGraphicsFrame* frame, FontGraphicsDesignResource* design, float x, float y, FontGraphicsResource** resource);
+int APS5_VABI sceFontGraphicsSetFramePolicy(FontGraphicsResource* resource, std::int32_t policy, std::uint32_t value);
+int APS5_VABI sceFontGraphicsSetupClipping(FontGraphicsResource* resource, const FontGraphicsRegion* region);
+int APS5_VABI sceFontGraphicsSetupColorRates(FontGraphicsResource* resource, float red, float green, float blue, float alpha);
+int APS5_VABI sceFontGraphicsSetupFillMethod(FontGraphicsResource* resource, const FontGraphicsFillMethod* method);
+int APS5_VABI sceFontGraphicsSetupFillRates(FontGraphicsResource* resource, const FontGraphicsFillRates* rates);
+int APS5_VABI sceFontGraphicsSetupGlyphFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsSetupGlyphFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontGraphicsSetupHandleDefault(FontGraphicsResource* resource, std::uint64_t flags);
+int APS5_VABI sceFontGraphicsSetupLocation(FontGraphicsResource* resource, float x, float y);
+int APS5_VABI sceFontGraphicsSetupPositioning(FontGraphicsResource* resource, std::uint32_t flags, float x, float y);
+int APS5_VABI sceFontGraphicsSetupRotation(FontGraphicsResource* resource, float angle, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsSetupScaling(FontGraphicsResource* resource, float scaleX, float scaleY, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsSetupShapeFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsSetupShapeFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontGraphicsStructureCanvas(FontGraphicsDevice* device, std::uint32_t width, std::uint32_t height, std::int32_t format, FontGraphicsCanvas** canvas);
+int APS5_VABI sceFontGraphicsStructureCanvasSequence(FontGraphicsDevice* device, FontGraphicsCanvas* canvas, const FontGraphicsSurface* surface, std::uint64_t flags, FontGraphicsCanvasSequence** sequence);
+int APS5_VABI sceFontGraphicsStructureDesign(FontGraphicsDevice* device, std::int32_t format, FontGraphicsDesign** design);
+int APS5_VABI sceFontGraphicsStructureDesignResource(FontGraphicsDevice* device, FontGraphicsDesign* design, FontGraphicsDesignResource** resource);
+int APS5_VABI sceFontGraphicsStructureSurfaceTexture(FontGraphicsDevice* device, const FontGraphicsSurface* surface, FontGraphicsSurfaceTexture** texture);
+int APS5_VABI sceFontGraphicsUpdateClipping(FontGraphicsResource* resource, const FontGraphicsRegion* region);
+int APS5_VABI sceFontGraphicsUpdateColorRates(FontGraphicsResource* resource, float red, float green, float blue, float alpha);
+int APS5_VABI sceFontGraphicsUpdateFillMethod(FontGraphicsResource* resource, const FontGraphicsFillMethod* method);
+int APS5_VABI sceFontGraphicsUpdateFillRates(FontGraphicsResource* resource, const FontGraphicsFillRates* rates);
+int APS5_VABI sceFontGraphicsUpdateGlyphFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsUpdateGlyphFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontGraphicsUpdateLocation(FontGraphicsResource* resource, float x, float y);
+int APS5_VABI sceFontGraphicsUpdatePositioning(FontGraphicsResource* resource, std::uint32_t flags, float x, float y);
+int APS5_VABI sceFontGraphicsUpdateRotation(FontGraphicsResource* resource, float angle, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsUpdateScaling(FontGraphicsResource* resource, float scaleX, float scaleY, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsUpdateShapeFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsUpdateShapeFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontSupportGlyphs(const FontGlyphSupport* support);
+int APS5_VABI sceFontWordsFindWordCharacters(FontWords* words, FontTextCharacter* firstCharacter, FontTextCharacter* endCharacter, FontTextCharacter** lastCharacter, FontTextCharacter** nextCharacter);
+int APS5_VABI sceFontGraphicsDrawupFillTextureImageObject(FontGraphicsFrame* frame, const void* data, std::uint32_t dataSize, float x, float y, float width, float height, FontGraphicsFill** fill);
+int APS5_VABI sceFontGraphicsDrawupFillTexturePatternObject(FontGraphicsFrame* frame, const void* data, std::uint32_t dataSize, std::uint32_t firstMode, std::uint32_t secondMode, std::int32_t firstCount, std::int32_t firstLayout, std::int32_t secondLayout, std::int32_t secondCount, FontGraphicsFill** fill);
+int APS5_VABI sceFontCreateWritingLine(const FontMemory* memory, std::int32_t writingForm, const void* writingLineDetail, void** pWritingLine);
+int APS5_VABI sceFontDestroyWritingLine(void** pWritingLine);
+int APS5_VABI sceFontWritingLineClear(void* writingLine);
+int APS5_VABI sceFontWritingLineWritesOrder(void* writingLine, std::uint64_t writingAttribute, const FontWritingMetrics* writingMetrics, void* writingOrderer);
+const FontWritingLineStep* APS5_VABI sceFontWritingLineRefersRenderStep(void* writingLine);
+int APS5_VABI sceFontWritingLineGetRenderMetrics(void* writingLine, FontWritingMetrics* writingMetrics);
+int APS5_VABI sceFontWritingLineGetOrderingSpace(void* writingLine, float* advanceSpace, float* headSpace, float* inlineSpace, float* tailSpace);
+
+}
diff --git a/core/libs/prx/libSceFont/include/FontDriver.hpp b/core/libs/prx/libSceFont/include/FontDriver.hpp
index 35b8d3d533..70b562b215 100644
--- a/core/libs/prx/libSceFont/include/FontDriver.hpp
+++ b/core/libs/prx/libSceFont/include/FontDriver.hpp
@@ -208,6 +208,9 @@ using DriverGlyphsCountFunction = int (APS5_VABI*)(FontObj* fontObj, std::uint32
 using DriverGlyphIndexFunction = int (APS5_VABI*)(FontObj* fontObj, std::uint32_t codepoint, std::uint32_t* outGlyphIndex);
 using DriverSetCharWithDpiFunction = int (APS5_VABI*)(FontObj* fontObj, std::uint32_t dpiX, std::uint32_t dpiY, float scaleX, float scaleY, float* outScaleX, float* outScaleY);
 using DriverSetCharDefaultDpiFunction = int (APS5_VABI*)(FontObj* fontObj, float scaleX, float scaleY, float* outScaleX, float* outScaleY);
+using DriverFontMetricsFunction = int (APS5_VABI*)(FontObj* fontObj, std::uint32_t form, FontMetrics* outMetrics);
+using DriverOutlineProfileFunction = int (APS5_VABI*)(FontObj* fontObj, FontOutlineProfile* outProfile);
+using DriverStyleInformationFunction = int (APS5_VABI*)(FontObj* fontObj, FontStyleInformation* outInformation);
 using DriverComputeLayoutFunction = int (APS5_VABI*)(FontObj* fontObj, const StyleStateBlock* style, std::uint8_t* outWords);
 using DriverLoadGlyphCachedFunction = int (APS5_VABI*)(FontObj* fontObj, std::uint32_t glyphIndex, std::int32_t mode, std::uint64_t* outWords);
 using DriverGetGlyphMetricsFunction = int (APS5_VABI*)(FontObj* fontObj, std::uint32_t* optParam2, std::uint8_t mode, std::uint8_t* outParams, FontGlyphMetrics* outMetrics);
@@ -225,16 +228,17 @@ struct SysDriver {
     std::uint8_t reserved_0x30[0x08];
     DriverOpenFunction open;
     DriverCloseFunction close;
-    std::uint8_t reserved_0x48[0x08];
+    DriverStyleInformationFunction style_information;
     DriverScaleFunction scale;
     std::uint8_t reserved_0x58[0x08];
     DriverMetricFunction metric;
     DriverGlyphsCountFunction glyphs_count;
-    std::uint8_t reserved_0x70[0x08];
+    DriverOutlineProfileFunction outline_profile;
     DriverGlyphIndexFunction glyph_index;
     DriverSetCharWithDpiFunction set_char_with_dpi;
     DriverSetCharDefaultDpiFunction set_char_default_dpi;
-    std::uint8_t reserved_0x90[0x10];
+    std::uint8_t reserved_0x90[0x08];
+    DriverFontMetricsFunction font_metrics;
     DriverComputeLayoutFunction compute_layout;
     DriverLoadGlyphCachedFunction load_glyph_cached;
     std::uint8_t reserved_0xb0[0x08];
@@ -341,8 +345,11 @@ static_assert(offsetof(FontLibNative, list_head) == 0xE0);
 static_assert(sizeof(SysDriver) == 0x120);
 static_assert(offsetof(SysDriver, pixel_resolution) == 0x10);
 static_assert(offsetof(SysDriver, open) == 0x38);
+static_assert(offsetof(SysDriver, style_information) == 0x48);
 static_assert(offsetof(SysDriver, scale) == 0x50);
+static_assert(offsetof(SysDriver, outline_profile) == 0x70);
 static_assert(offsetof(SysDriver, glyph_index) == 0x78);
+static_assert(offsetof(SysDriver, font_metrics) == 0x98);
 static_assert(offsetof(SysDriver, compute_layout) == 0xA0);
 static_assert(offsetof(SysDriver, get_glyph_metrics) == 0xB8);
 static_assert(offsetof(SysDriver, apply_glyph_adjust) == 0xE0);
diff --git a/core/libs/prx/libSceFont/include/FontGraphics.hpp b/core/libs/prx/libSceFont/include/FontGraphics.hpp
new file mode 100644
index 0000000000..a5dbe25b02
--- /dev/null
+++ b/core/libs/prx/libSceFont/include/FontGraphics.hpp
@@ -0,0 +1,25 @@
+#ifndef CORE_LIBS_PRX_LIBSCEFONT_INCLUDE_FONTGRAPHICS_HPP
+#define CORE_LIBS_PRX_LIBSCEFONT_INCLUDE_FONTGRAPHICS_HPP
+
+#include <cstdint>
+
+#include "prx/libSceFont/include/Api.hpp"
+
+namespace Font {
+
+void SetGraphicsErrorCallback(GraphicsErrorCallback callback);
+int GraphicsRegionInit(FontGraphicsRegion* region, float x, float y, float width, float height);
+int GraphicsRegionInitCircular(FontGraphicsRegion* region, float centerX, float centerY, float outerRadius, float innerRadius);
+int GraphicsRegionInitRoundish(FontGraphicsRegion* region, float x, float y, float width, float height, float outerRadius, float innerRadius, std::uint32_t flags);
+int GraphicsFillMethodInit(FontGraphicsFillMethod* method, std::int32_t mode, std::int32_t type);
+int GraphicsFillPlotInit(FontGraphicsFillPlot* plot, const FontGraphicsRegion* region);
+int GraphicsFillPlotSetLayout(FontGraphicsFillPlot* plot, std::int32_t first, std::int32_t second);
+int GraphicsFillPlotSetMapping(FontGraphicsFillPlot* plot, float first, float second, float third, float fourth);
+int GraphicsFillRatesInit(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect);
+int GraphicsFillRatesSetFillEffect(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect);
+int GraphicsFillRatesSetLayout(FontGraphicsFillRates* rates, std::int32_t first, std::int32_t second);
+int GraphicsFillRatesSetMapping(FontGraphicsFillRates* rates, float first, float second, float third, float fourth);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceFont/include/FontInternal.hpp b/core/libs/prx/libSceFont/include/FontInternal.hpp
index 4e057a93e1..da4a70b28a 100644
--- a/core/libs/prx/libSceFont/include/FontInternal.hpp
+++ b/core/libs/prx/libSceFont/include/FontInternal.hpp
@@ -34,8 +34,6 @@ struct FontState {
     std::shared_ptr<const std::vector<unsigned char>> faceData;
     FT_Face face = nullptr;
     std::vector<FallbackFace> fallbacks;
-    float scaleW = 16.0f;
-    float scaleH = 16.0f;
     std::map<int, int> scriptLanguages;
     int attribute = 0;
 
@@ -133,8 +131,11 @@ void CachedStyleSetScalar(CachedStyle& style, float value);
 void ClearRenderOutputs(FontGlyphMetrics* metrics, FontRenderOutput* result);
 int ComputeHorizontalLayout(FontHandle handle, const StyleStateBlock* style, std::uint8_t* outWords);
 int ComputeVerticalLayout(FontHandle handle, const StyleStateBlock* style, std::uint8_t* outWords);
-int GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle);
+int GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle, float* usedScaleW = nullptr, float* usedScaleH = nullptr);
 int RenderCharGlyphImageCore(FontHandle handle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
+int ComputeFontMetrics(FontHandle handle, std::uint32_t form, FontMetrics* metrics);
+int ComputeFontStyleInformation(FontHandle handle, FontStyleInformation* information);
+int ComputeFontGlyphsOutlineProfile(FontHandle handle, FontOutlineProfile* profile);
 
 }
 
diff --git a/core/libs/prx/libSceFont/include/FontTypes.hpp b/core/libs/prx/libSceFont/include/FontTypes.hpp
index eb1a548bb4..6507485349 100644
--- a/core/libs/prx/libSceFont/include/FontTypes.hpp
+++ b/core/libs/prx/libSceFont/include/FontTypes.hpp
@@ -423,12 +423,55 @@ struct FontVerticalLayout {
     float decorationSpan;
 };
 
+struct FontMetrics {
+    std::uint32_t form;
+    float ascender;
+    float descender;
+    float lineGap;
+    float maxAdvance;
+    float verticalDescender;
+    float verticalAscender;
+    float xMin;
+    float yMin;
+    float xMax;
+    float yMax;
+    float emWidth;
+    float emHeight;
+    float effectWeightX;
+    float effectWeightY;
+    float slantRatio;
+};
+
+struct FontOutlineProfile {
+    std::uint32_t maxContours;
+    std::uint32_t maxPoints;
+    std::uint32_t maxCompositeContours;
+    std::uint32_t maxCompositePoints;
+};
+
+struct FontStyleInformation {
+    const char* familyName;
+    const char* styleName;
+    std::uint16_t styleFlags;
+    std::uint16_t weight;
+    std::uint16_t width;
+    std::uint16_t layoutFlags;
+};
+
 static_assert(sizeof(FontHandleOpaque) == 0x100);
 static_assert(sizeof(FontMemory) == 0x40);
 static_assert(sizeof(FontMemoryInterface) == 0x30);
 static_assert(sizeof(FontOpenDetail) == 0x20);
 static_assert(sizeof(FontGlyphMetrics) == 0x20);
 static_assert(sizeof(FontKerning) == 0x10);
+static_assert(sizeof(FontMetrics) == 0x40);
+static_assert(offsetof(FontMetrics, maxAdvance) == 0x10);
+static_assert(offsetof(FontMetrics, xMin) == 0x1C);
+static_assert(offsetof(FontMetrics, emWidth) == 0x2C);
+static_assert(offsetof(FontMetrics, effectWeightX) == 0x34);
+static_assert(sizeof(FontStyleInformation) == 0x18);
+static_assert(sizeof(FontOutlineProfile) == 0x10);
+static_assert(offsetof(FontStyleInformation, styleFlags) == 0x10);
 static_assert(sizeof(FontGlyphImageMetrics) == 0x18);
 static_assert(sizeof(FontGenerateGlyphDetail) == 0x20);
 static_assert(sizeof(FontResultStage) == 0x18);
diff --git a/core/libs/prx/libSceFont/include/FontWords.hpp b/core/libs/prx/libSceFont/include/FontWords.hpp
new file mode 100644
index 0000000000..d40842f3f8
--- /dev/null
+++ b/core/libs/prx/libSceFont/include/FontWords.hpp
@@ -0,0 +1,16 @@
+#ifndef CORE_LIBS_PRX_LIBSCEFONT_INCLUDE_FONTWORDS_HPP
+#define CORE_LIBS_PRX_LIBSCEFONT_INCLUDE_FONTWORDS_HPP
+
+#include "prx/libSceFont/include/FontTypes.hpp"
+
+struct FontWords;
+
+namespace Font {
+
+int CreateWords(const FontMemory* memory, FontTextSource* source, FontWords** words);
+int DestroyWords(FontWords** words);
+int WordsFindWordCharacters(FontWords* words, FontTextCharacter* firstCharacter, FontTextCharacter* endCharacter, FontTextCharacter** lastCharacter, FontTextCharacter** nextCharacter);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceFont/libSceFont.hpp b/core/libs/prx/libSceFont/libSceFont.hpp
new file mode 100644
index 0000000000..c39c48d023
--- /dev/null
+++ b/core/libs/prx/libSceFont/libSceFont.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFont/include/Api.hpp"
diff --git a/core/libs/prx/libSceFont/src/Graphics.cpp b/core/libs/prx/libSceFont/src/Graphics.cpp
new file mode 100644
index 0000000000..8a005d478a
--- /dev/null
+++ b/core/libs/prx/libSceFont/src/Graphics.cpp
@@ -0,0 +1,195 @@
+#include <atomic>
+#include <cstdint>
+
+#include "prx/libSceFont/include/FontGraphics.hpp"
+#include "prx/libSceFont/include/FontTypes.hpp"
+
+namespace {
+
+constexpr int FONT_GRAPHICS_ERROR_INVALID_FILL = static_cast<int>(0x80460086);
+constexpr int FONT_GRAPHICS_ERROR_INVALID_REGION = static_cast<int>(0x80460087);
+constexpr int FONT_GRAPHICS_ERROR_INVALID_FILL_PLOT = static_cast<int>(0x80460088);
+constexpr int FONT_GRAPHICS_ERROR_INVALID_FILL_RATES = static_cast<int>(0x80460089);
+
+constexpr std::uint32_t RegionTag = 0xf60;
+constexpr std::uint32_t RectangleRegionFlags = 0xf;
+constexpr std::uint32_t CircularRegionFlags = 0xff;
+constexpr std::uint32_t FillMethodTag = 0xf01b;
+constexpr std::uint32_t FillMethodFlags = 0xf;
+constexpr std::uint16_t FillPlotTag = 0xf01c;
+constexpr std::uint16_t FillRatesTag = 0xf01a;
+constexpr std::uint16_t DefaultLayout = 0xf77;
+constexpr std::uint32_t FillEffects = 0x1033f;
+
+std::atomic<Font::GraphicsErrorCallback> g_errorCallback{nullptr};
+
+int Fail(int error) {
+    if (const auto callback = g_errorCallback.load()) callback(error);
+    return error;
+}
+
+bool IsObject(const void* pointer) {
+    return reinterpret_cast<std::uintptr_t>(pointer) + 1 >= 2;
+}
+
+bool IsValidFill(const FontGraphicsFill* fill) {
+    const auto value = reinterpret_cast<std::intptr_t>(fill);
+    if (value >= -1 && value < 3) return true;
+    const std::uint8_t mode = *reinterpret_cast<const std::uint8_t*>(fill);
+    return (mode & 0xf) == 0 && mode >= 0x10 && mode <= 0x50;
+}
+
+bool IsValidEffect(std::uint32_t effect) {
+    return effect < 17 && ((FillEffects >> effect) & 1) != 0;
+}
+
+bool IsValidLayoutNibble(std::uint32_t nibble) {
+    return nibble <= 4 && nibble != 3;
+}
+
+bool IsValidLayout(std::int32_t first, std::int32_t second) {
+    const bool firstValid = first == 0 || first == 0x170 || first == 0x207 || first == 0x400 || first == 0x800 || first == 0xf77;
+    const auto bits = static_cast<std::uint32_t>(second);
+    return firstValid && IsValidLayoutNibble((bits >> 4) & 0xf) && IsValidLayoutNibble(bits & 0xf);
+}
+
+bool IsUsableRegion(const FontGraphicsRegion& region) {
+    if (region.tag != RegionTag) return false;
+    if (!(region.outerRadius >= 0.0f) || !(region.innerRadius >= 0.0f)) return false;
+    const float half = (region.width < region.height ? region.width : region.height) * 0.5f;
+    if (region.outerRadius == 0.0f) return half >= region.innerRadius;
+    return half >= region.outerRadius && region.outerRadius >= region.innerRadius;
+}
+
+std::uint8_t MappedFlags(std::uint8_t flags) {
+    return static_cast<std::uint8_t>((flags & 0xfc) | 1);
+}
+
+}
+
+namespace Font {
+
+void SetGraphicsErrorCallback(GraphicsErrorCallback callback) {
+    g_errorCallback.store(callback);
+}
+
+int GraphicsRegionInit(FontGraphicsRegion* region, float x, float y, float width, float height) {
+    if (!region || 0.0f > width || 0.0f > height) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    *region = {x, y, width, height, RectangleRegionFlags, RegionTag, 0.0f, 0.0f};
+    return SCE_FONT_OK;
+}
+
+int GraphicsRegionInitCircular(FontGraphicsRegion* region, float centerX, float centerY, float outerRadius, float innerRadius) {
+    if (innerRadius > outerRadius || !region || 0.0f >= outerRadius || 0.0f >= innerRadius) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    const float diameter = outerRadius + outerRadius;
+    *region = {centerX - outerRadius, centerY - outerRadius, diameter, diameter, CircularRegionFlags, RegionTag, outerRadius, innerRadius};
+    return SCE_FONT_OK;
+}
+
+int GraphicsRegionInitRoundish(FontGraphicsRegion* region, float x, float y, float width, float height, float outerRadius, float innerRadius, std::uint32_t flags) {
+    if (!region || 0.0f > innerRadius || 0.0f > outerRadius || 0.0f >= height || 0.0f >= width || flags > 0xff) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    if (outerRadius > height * 0.5f || outerRadius > width * 0.5f) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    if (outerRadius < innerRadius && outerRadius != 0.0f) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    *region = {x, y, width, height, flags, RegionTag, outerRadius, innerRadius};
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillMethodInit(FontGraphicsFillMethod* method, std::int32_t mode, std::int32_t type) {
+    const auto modeBits = static_cast<std::uint32_t>(mode);
+    const bool modeValid = (modeBits & 0xf) == 0 && (modeBits >> 4) < 6;
+    const bool typeValid = static_cast<std::uint32_t>(type) - 1 < 7 || type == 12;
+    if (!method || !modeValid || !typeValid) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    *method = {};
+    method->mode = mode;
+    method->type = type;
+    method->flags = FillMethodFlags;
+    method->tag = FillMethodTag;
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillPlotInit(FontGraphicsFillPlot* plot, const FontGraphicsRegion* region) {
+    if (!IsObject(plot)) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL_PLOT);
+    if (IsObject(region) && !IsUsableRegion(*region)) {
+        plot->tag = 0;
+        return Fail(FONT_GRAPHICS_ERROR_INVALID_REGION);
+    }
+    *plot = {};
+    if (!region) {
+        plot->flags = 2;
+    } else if (!IsObject(region)) {
+        plot->flags = 6;
+        plot->layout = DefaultLayout;
+    } else {
+        plot->mapping[0] = region->x;
+        plot->mapping[1] = region->y;
+        plot->mapping[2] = region->x + region->width;
+        plot->mapping[3] = region->y + region->height;
+        plot->flags = 1;
+        plot->layout = DefaultLayout;
+    }
+    plot->region = region;
+    plot->tag = FillPlotTag;
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillPlotSetLayout(FontGraphicsFillPlot* plot, std::int32_t first, std::int32_t second) {
+    if (!IsObject(plot) || plot->tag != FillPlotTag) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL_PLOT);
+    if (!IsValidLayout(first, second)) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    const auto combined = static_cast<std::uint32_t>(first) | static_cast<std::uint32_t>(second);
+    plot->layout = static_cast<std::uint16_t>(combined);
+    plot->flags = static_cast<std::uint8_t>((plot->flags & 0xf6) | (combined != 0 ? 1 : 0) | 8);
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillPlotSetMapping(FontGraphicsFillPlot* plot, float first, float second, float third, float fourth) {
+    if (!IsObject(plot) || plot->tag != FillPlotTag) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL_PLOT);
+    plot->mapping[0] = first;
+    plot->mapping[1] = second;
+    plot->mapping[2] = third;
+    plot->mapping[3] = fourth;
+    plot->flags = MappedFlags(plot->flags);
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillRatesInit(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect) {
+    if (!IsObject(rates)) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    *rates = {};
+    if (!IsValidFill(fill)) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL);
+    if (!IsValidEffect(effect)) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    rates->fill = fill;
+    rates->tag = FillRatesTag;
+    rates->effect = static_cast<std::uint16_t>(effect);
+    rates->layout = DefaultLayout;
+    rates->flags = 2;
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillRatesSetFillEffect(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect) {
+    if (!IsObject(rates) || rates->tag != FillRatesTag) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL_RATES);
+    if (!IsValidFill(fill)) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL);
+    if (!IsValidEffect(effect)) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    rates->effect = static_cast<std::uint16_t>(effect);
+    rates->fill = fill;
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillRatesSetLayout(FontGraphicsFillRates* rates, std::int32_t first, std::int32_t second) {
+    if (!IsObject(rates) || rates->tag != FillRatesTag) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL_RATES);
+    if (!IsValidLayout(first, second)) return Fail(SCE_FONT_ERROR_INVALID_PARAMETER);
+    const auto combined = static_cast<std::uint32_t>(first) | static_cast<std::uint32_t>(second);
+    rates->flags = static_cast<std::uint8_t>((rates->flags & 0xfe) | (combined != 0 ? 1 : 0));
+    rates->layout = 0;
+    return SCE_FONT_OK;
+}
+
+int GraphicsFillRatesSetMapping(FontGraphicsFillRates* rates, float first, float second, float third, float fourth) {
+    if (!IsObject(rates) || rates->tag != FillRatesTag) return Fail(FONT_GRAPHICS_ERROR_INVALID_FILL_RATES);
+    rates->mapping[0] = first;
+    rates->mapping[1] = second;
+    rates->mapping[2] = third;
+    rates->mapping[3] = fourth;
+    rates->flags = MappedFlags(rates->flags);
+    return SCE_FONT_OK;
+}
+
+}
diff --git a/core/libs/prx/libSceFont/src/Layout.cpp b/core/libs/prx/libSceFont/src/Layout.cpp
index a59a3b5f2f..d297840675 100644
--- a/core/libs/prx/libSceFont/src/Layout.cpp
+++ b/core/libs/prx/libSceFont/src/Layout.cpp
@@ -120,7 +120,8 @@ void FillImageMetrics(FontRenderOutput* result, const FontGlyphMetrics* metrics,
 
 int RenderGlyphIndexToSurface(FontObj& obj, std::uint32_t glyphIndex, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result) {
     ClearRenderOutputs(metrics, result);
-    if (!surface->buffer || surface->width <= 0 || surface->height <= 0 || surface->widthByte <= 0 || surface->pixelSizeByte <= 0) return SCE_FONT_ERROR_NO_SUPPORT_SURFACE;
+    const bool emptyExtent = surface->width == 0 || surface->height == 0;
+    if (!surface->buffer || surface->width < 0 || surface->height < 0 || surface->widthByte < 0 || (!emptyExtent && surface->widthByte == 0) || surface->pixelSizeByte <= 0) return SCE_FONT_ERROR_NO_SUPPORT_SURFACE;
     const int bytesPerPixel = surface->pixelSizeByte;
     if (bytesPerPixel != 1 && bytesPerPixel != 4) return SCE_FONT_ERROR_NO_SUPPORT_SURFACE;
     const auto face = static_cast<FT_Face>(obj.ft_face);
@@ -365,7 +366,7 @@ int Font::ComputeVerticalLayout(FontHandle handle, const StyleStateBlock* style,
     return SCE_FONT_OK;
 }
 
-int Font::GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle) {
+int Font::GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle, float* usedScaleW, float* usedScaleH) {
     const auto clearMetrics = [&] {
         if (metrics) *metrics = {};
     };
@@ -434,6 +435,8 @@ int Font::GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMe
     metrics->Vertical.bearingX = static_cast<float>(vertBearingX) / 64.0f * ratioX;
     metrics->Vertical.bearingY = static_cast<float>(vertBearingY) / 64.0f * ratioY;
     metrics->Vertical.advance = static_cast<float>(slot->metrics.vertAdvance) / 64.0f * ratioY;
+    if (usedScaleW) *usedScaleW = scaleW;
+    if (usedScaleH) *usedScaleH = scaleH;
     return finish(SCE_FONT_OK);
 }
 
@@ -527,3 +530,109 @@ bool Font::BuildTrueOutline(GeneratedGlyph& glyph) {
     glyph.outlineInitialized = true;
     return true;
 }
+
+int Font::ComputeFontMetrics(FontHandle handle, std::uint32_t form, FontMetrics* metrics) {
+    auto* font = GetNativeFont(handle);
+    auto* library = font ? static_cast<FontLibNative*>(font->library) : nullptr;
+    if (!library || !FontContext(library, font)) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    const SysDriver* driver = library->sys_driver;
+    if (!driver || !driver->set_char_with_dpi || !driver->set_char_default_dpi || !driver->font_metrics) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    const std::uint32_t fontId = font->open_info.ctx_entry_index;
+    if (static_cast<std::int32_t>(fontId) < 0) {
+        metrics->form = form;
+        metrics->ascender = 0.0f;
+        metrics->descender = 0.0f;
+        metrics->lineGap = 0.0f;
+        metrics->maxAdvance = 0.0f;
+        metrics->verticalDescender = 0.0f;
+        metrics->verticalAscender = 0.0f;
+        return SCE_FONT_OK;
+    }
+    const std::uint32_t modeLow = font->flags & 0x0Fu;
+    FontObj* head = nullptr;
+    std::uint32_t lockWord = 0;
+    auto* entry = AcquireFontCtxEntry(FontContext(library, font), fontId, modeLow, &head, &lockWord);
+    if (!entry) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    FontObj* match = FindSubFont(head, font->open_info.sub_font_index);
+    int rc = SCE_FONT_ERROR_FATAL;
+    if ((lockWord & OPEN_BIT) != 0 && (lockWord & COUNT_MASK) != 0 && match) {
+        float scaleX = font->style.scale_w;
+        float scaleY = font->style.scale_h;
+        match->font_handle = handle;
+        match->shift_units_x = 0;
+        match->shift_units_y = 0;
+        rc = SetDriverCharSize(driver, match, &font->style, scaleX, scaleY);
+        if (rc == SCE_FONT_OK) rc = driver->font_metrics(match, form, metrics);
+    }
+    ReleaseFontCtxEntryLock(entry, modeLow, lockWord);
+    return rc == SCE_FONT_OK ? rc : SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+}
+
+int Font::ComputeFontStyleInformation(FontHandle handle, FontStyleInformation* information) {
+    auto* font = GetNativeFont(handle);
+    auto* library = static_cast<FontLibNative*>(font->library);
+    if (!library) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    if (!information) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (const auto* record = static_cast<const std::uint8_t*>(font->open_info.fontset_record)) {
+        std::memcpy(&information->familyName, record + 8, sizeof(information->familyName));
+        std::memcpy(&information->styleName, record + 16, sizeof(information->styleName));
+        information->styleFlags = record[4];
+        information->weight = static_cast<std::uint16_t>(record[5] * 100);
+        information->width = record[6];
+        information->layoutFlags = record[7];
+        return SCE_FONT_OK;
+    }
+    const SysDriver* driver = library->sys_driver;
+    auto* context = FontContext(library, font);
+    if (!driver || !driver->style_information || !context) return SCE_FONT_ERROR_FATAL;
+    const std::uint32_t modeLow = font->flags & 0x0Fu;
+    FontObj* head = nullptr;
+    std::uint32_t lockWord = 0;
+    auto* entry = AcquireFontCtxEntry(context, font->open_info.ctx_entry_index, modeLow, &head, &lockWord);
+    if (!entry) return SCE_FONT_ERROR_FATAL;
+    FontObj* match = FindSubFont(head, font->open_info.sub_font_index);
+    int rc = SCE_FONT_ERROR_FATAL;
+    if ((lockWord & OPEN_BIT) != 0 && (lockWord & COUNT_MASK) != 0 && match) {
+        match->font_handle = handle;
+        rc = driver->style_information(match, information);
+        information->weight = static_cast<std::uint16_t>(information->weight * 100);
+    }
+    ReleaseFontCtxEntryLock(entry, modeLow, lockWord);
+    return rc;
+}
+
+int Font::ComputeFontGlyphsOutlineProfile(FontHandle handle, FontOutlineProfile* profile) {
+    auto* font = GetNativeFont(handle);
+    if (!font || font->magic != HANDLE_MAGIC) {
+        if (profile) *profile = {};
+        return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    }
+    if (!profile) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    *profile = {};
+    auto* library = static_cast<FontLibNative*>(font->library);
+    auto* context = library ? FontContext(library, font) : nullptr;
+    if (!context) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    const std::uint32_t fontId = font->open_info.ctx_entry_index;
+    if (static_cast<std::int32_t>(fontId) < 0) return SCE_FONT_OK;
+    const SysDriver* driver = library->sys_driver;
+    if (!driver || !driver->outline_profile) return SCE_FONT_ERROR_FATAL;
+    const std::uint32_t modeLow = font->flags & 0x0Fu;
+    FontObj* head = nullptr;
+    std::uint32_t lockWord = 0;
+    auto* entry = AcquireFontCtxEntry(context, fontId, modeLow, &head, &lockWord);
+    if (!entry) return SCE_FONT_ERROR_FATAL;
+    FontObj* match = FindSubFont(head, font->open_info.sub_font_index);
+    int rc = SCE_FONT_ERROR_FATAL;
+    FontOutlineProfile faceProfile{};
+    if ((lockWord & OPEN_BIT) != 0 && (lockWord & COUNT_MASK) != 0 && match) {
+        match->font_handle = handle;
+        rc = driver->outline_profile(match, &faceProfile);
+    }
+    ReleaseFontCtxEntryLock(entry, modeLow, lockWord);
+    if (rc != SCE_FONT_OK) return rc;
+    profile->maxContours = std::max(profile->maxContours, faceProfile.maxContours);
+    profile->maxPoints = std::max(profile->maxPoints, faceProfile.maxPoints);
+    profile->maxCompositeContours = std::max(profile->maxCompositeContours, faceProfile.maxCompositeContours);
+    profile->maxCompositePoints = std::max(profile->maxCompositePoints, faceProfile.maxCompositePoints);
+    return SCE_FONT_OK;
+}
diff --git a/core/libs/prx/libSceFont/src/Library.cpp b/core/libs/prx/libSceFont/src/Library.cpp
index 4d8adbac7e..54d3f48d0c 100644
--- a/core/libs/prx/libSceFont/src/Library.cpp
+++ b/core/libs/prx/libSceFont/src/Library.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
diff --git a/core/libs/prx/libSceFont/src/Open.cpp b/core/libs/prx/libSceFont/src/Open.cpp
index 36e7e2263d..62d33f609e 100644
--- a/core/libs/prx/libSceFont/src/Open.cpp
+++ b/core/libs/prx/libSceFont/src/Open.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -398,8 +399,6 @@ int APS5_VABI sceFontOpenFontInstance(FontHandle fontHandle, FontHandle setupFon
     ReleaseFontLock(source, sourceLock);
     FontState& targetState = ResetState(target);
     if (FontState* sourceState = TryGetState(fontHandle)) {
-        targetState.scaleW = sourceState->scaleW;
-        targetState.scaleH = sourceState->scaleH;
         if (sourceState->faceData && !sourceState->faceData->empty()) LoadStateFace(targetState, sourceState->faceData, subFontIndex);
         for (const FallbackFace& fallback : sourceState->fallbacks) AddStateFallbackFace(targetState, fallback.data, fallback.subFontIndex);
     }
diff --git a/core/libs/prx/libSceFont/src/Render.cpp b/core/libs/prx/libSceFont/src/Render.cpp
index 7ed1af5165..0647f2192e 100644
--- a/core/libs/prx/libSceFont/src/Render.cpp
+++ b/core/libs/prx/libSceFont/src/Render.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -158,6 +159,63 @@ int APS5_VABI sceFontGetHorizontalLayout(FontHandle fontHandle, FontHorizontalLa
     return SCE_FONT_OK;
 }
 
+int APS5_VABI sceFontGetFontMetrics(FontHandle fontHandle, std::uint32_t form, FontMetrics* metrics) {
+    auto* font = GetNativeFont(fontHandle);
+    std::uint32_t fontLock = 0;
+    if (font && font->magic == HANDLE_MAGIC && AcquireFontLock(font, fontLock)) {
+        if (!metrics) {
+            ReleaseFontLock(font, fontLock);
+            return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+        }
+        const int rc = ComputeFontMetrics(fontHandle, form, metrics);
+        ReleaseFontLock(font, fontLock);
+        if (rc == SCE_FONT_OK) return rc;
+    }
+    if (metrics) {
+        *metrics = {};
+        metrics->effectWeightX = 1.0f;
+        metrics->effectWeightY = 1.0f;
+    }
+    return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+}
+
+int APS5_VABI sceFontGetFontStyleInformation(FontHandle fontHandle, FontStyleInformation* information) {
+    auto* font = GetNativeFont(fontHandle);
+    std::uint32_t fontLock = 0;
+    int rc = SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    if (font && font->magic == HANDLE_MAGIC && AcquireFontLock(font, fontLock)) {
+        rc = ComputeFontStyleInformation(fontHandle, information);
+        ReleaseFontLock(font, fontLock);
+        if (rc == SCE_FONT_OK) return rc;
+    }
+    if (information) {
+        information->familyName = "";
+        information->styleName = "";
+        information->styleFlags = 0;
+        information->weight = 0;
+        information->width = 0;
+        information->layoutFlags = 0;
+    }
+    return rc;
+}
+
+int APS5_VABI sceFontGetFontGlyphsOutlineProfile(FontHandle fontHandle, FontOutlineProfile* profile) {
+    auto* font = GetNativeFont(fontHandle);
+    std::uint32_t fontLock = 0;
+    int rc = SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    if (font && font->magic == HANDLE_MAGIC) {
+        if (!profile) return SCE_FONT_ERROR_INVALID_PARAMETER;
+        if (font->open_info.fontset_record) NotImplemented_nid_no_patch(__func__);
+        if (AcquireFontLock(font, fontLock)) {
+            rc = ComputeFontGlyphsOutlineProfile(fontHandle, profile);
+            ReleaseFontLock(font, fontLock);
+            if (rc == SCE_FONT_OK) return rc;
+        }
+    }
+    if (profile) *profile = {};
+    return rc;
+}
+
 int APS5_VABI sceFontGetVerticalLayout(FontHandle fontHandle, FontVerticalLayout* layout) {
     int rc = SCE_FONT_ERROR_INVALID_FONT_HANDLE;
     auto* font = GetNativeFont(fontHandle);
@@ -188,7 +246,12 @@ int APS5_VABI sceFontGetKerning(FontHandle fontHandle, std::uint32_t preCode, st
     if (!font || font->magic != HANDLE_MAGIC || !AcquireFontLock(font, fontLock)) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
     *kerning = {};
     const FontState* state = TryGetState(fontHandle);
-    if (state) LoadKerning(*state, state->scaleW, state->scaleH, preCode, code, kerning);
+    if (state) {
+        float scaleW = 0.0f;
+        float scaleH = 0.0f;
+        StyleStateGetScalePixel(&font->style, &scaleW, &scaleH);
+        LoadKerning(*state, scaleW, scaleH, preCode, code, kerning);
+    }
     ReleaseFontLock(font, fontLock);
     return SCE_FONT_OK;
 }
@@ -373,8 +436,7 @@ int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code
     *pGlyph = nullptr;
     if (!fontHandle) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
     if (code == 0) return SCE_FONT_ERROR_NO_SUPPORT_CODE;
-    const FontState* state = TryGetState(fontHandle);
-    if (!state) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    if (!TryGetState(fontHandle)) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
     const std::uint8_t glyphForm = detail ? detail->glyph_form : 0;
     const std::uint8_t metricsForm = detail ? detail->metrics_form : 0;
     const std::uint16_t formOptions = detail ? detail->form_options : 0;
@@ -385,7 +447,9 @@ int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code
     if ((glyphForm != 0 && metricsForm == 0) || glyphForm > 1 || metricsForm > 4) return SCE_FONT_ERROR_INVALID_PARAMETER;
     if (glyphMemory && glyphMemory->mem_kind != MEMORY_MAGIC) return SCE_FONT_ERROR_INVALID_PARAMETER;
     FontGlyphMetrics metrics{};
-    const int rc = GetCharGlyphMetrics(fontHandle, code, &metrics, false);
+    float scaleW = 0.0f;
+    float scaleH = 0.0f;
+    const int rc = GetCharGlyphMetrics(fontHandle, code, &metrics, false, &scaleW, &scaleH);
     if (rc != SCE_FONT_OK) return rc;
     auto* generated = new (std::nothrow) GeneratedGlyph();
     if (!generated) return SCE_FONT_ERROR_ALLOCATION_FAILED;
@@ -395,13 +459,13 @@ int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code
     generated->glyph.flags = formOptions;
     generated->glyph.glyph_form = glyphForm;
     generated->glyph.metrics_form = metricsForm;
-    generated->glyph.em_size = ClampToU16(state->scaleH);
+    generated->glyph.em_size = ClampToU16(scaleH);
     generated->glyph.baseline = ClampToU16(metrics.Horizontal.bearingY);
     generated->glyph.height_px = ClampToU16(metrics.height);
     generated->glyph.origin_x = 0;
     generated->glyph.origin_y = generated->glyph.baseline;
-    generated->glyph.scale_x = state->scaleW;
-    generated->glyph.base_scale = state->scaleH;
+    generated->glyph.scale_x = scaleW;
+    generated->glyph.base_scale = scaleH;
     generated->glyph.memory = glyphMemory;
     generated->owner = fontHandle;
     generated->outline.outline_flags = generated->glyph.flags;
diff --git a/core/libs/prx/libSceFont/src/Style.cpp b/core/libs/prx/libSceFont/src/Style.cpp
index 01ae245867..fcb40847fe 100644
--- a/core/libs/prx/libSceFont/src/Style.cpp
+++ b/core/libs/prx/libSceFont/src/Style.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -199,14 +200,7 @@ int APS5_VABI sceFontGetTypographicDesign(FontHandle fontHandle, int typographic
 }
 
 int APS5_VABI sceFontSetScalePixel(FontHandle fontHandle, float w, float h) {
-    return UpdateFontStyle(fontHandle, [&](FontHandleNative* font) {
-        const int changed = StyleStateSetScalePixel(&font->style, w, h);
-        if (FontState* state = TryGetState(fontHandle)) {
-            state->scaleW = w;
-            state->scaleH = h;
-        }
-        return changed;
-    });
+    return UpdateFontStyle(fontHandle, [&](FontHandleNative* font) { return StyleStateSetScalePixel(&font->style, w, h); });
 }
 
 int APS5_VABI sceFontSetScalePoint(FontHandle fontHandle, float w, float h) {
diff --git a/core/libs/prx/libSceFont/src/SystemFont.cpp b/core/libs/prx/libSceFont/src/SystemFont.cpp
index c6e3d87339..12d39768c2 100644
--- a/core/libs/prx/libSceFont/src/SystemFont.cpp
+++ b/core/libs/prx/libSceFont/src/SystemFont.cpp
@@ -60,7 +60,7 @@ constexpr std::array<FamilyFiles, 9> FAMILY_FILES = {{
      {"NotoSansCJK-Light.ttc", "NotoSansCJK-Regular.ttc", "NotoSansCJK-Medium.ttc", "NotoSansCJK-Bold.ttc"}, 0},
     {{"DFHEI5-SONY.ttf", "DFHEI5-SONY.ttf", "DFHEI5-SONY.ttf", "DFHEI5-SONY.ttf"},
      {"NotoSansCJK-Light.ttc", "NotoSansCJK-Regular.ttc", "NotoSansCJK-Medium.ttc", "NotoSansCJK-Bold.ttc"}, 2},
-    {{"SCEPS4Yoongd-Medium.otf", "SCEPS4Yoongd-Medium.otf", "SCEPS4Yoongd-Medium.otf", "SCEPS4Yoongd-Bold.otf"},
+    {{"SCEPS4Yoongd-Light.otf", "SCEPS4Yoongd-Medium.otf", "SCEPS4Yoongd-Medium.otf", "SCEPS4Yoongd-Bold.otf"},
      {"NotoSansCJK-Light.ttc", "NotoSansCJK-Regular.ttc", "NotoSansCJK-Medium.ttc", "NotoSansCJK-Bold.ttc"}, 1},
     {{"SSTArabic-Light.otf", "SSTArabic-Roman.otf", "SSTArabic-Medium.otf", "SSTArabic-Bold.otf"},
      {"NotoSansArabic-Light.ttf", "NotoSansArabic-Regular.ttf", "NotoSansArabic-Medium.ttf", "NotoSansArabic-Bold.ttf"}, 0},
diff --git a/core/libs/prx/libSceFont/src/Text.cpp b/core/libs/prx/libSceFont/src/Text.cpp
index afc8a452f7..0b6823f3b3 100644
--- a/core/libs/prx/libSceFont/src/Text.cpp
+++ b/core/libs/prx/libSceFont/src/Text.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -20,6 +21,7 @@ constexpr std::uint16_t FONT_STRING_MAGIC = 0x0F05;
 constexpr std::uint16_t FONT_WRITING_MAGIC = 0x0F06;
 constexpr std::uint16_t CREATE_STRING_DETAIL_ID = 0x0FD4;
 constexpr std::uint32_t WRITING_FORM_HORIZONTAL = 0x10;
+constexpr std::uint32_t WRITING_FORM_HORIZONTAL_RTL = 0x11;
 constexpr std::uint32_t WRITING_FORM_HORIZONTAL_LTR = 0x12;
 constexpr std::int32_t PARSER_RESULT_ERROR = -1;
 constexpr std::int32_t PARSER_RESULT_TERMINATE = 0;
@@ -62,6 +64,7 @@ struct FontWritingData {
     float penY = 0.0f;
     bool hasAggregateMetrics = false;
     bool hasCurrentStep = false;
+    bool hasCurrentCharacter = false;
     bool maskFormatCharacters = true;
     bool ownsStorage = false;
     bool hasRawGlyphMetrics = false;
@@ -143,6 +146,37 @@ FontTextCharacter* TextCharacters(FontStringData* data) {
     return data && data->storage && !data->storage->characters.empty() ? data->storage->characters.data() : nullptr;
 }
 
+bool IsRightToLeftLetter(std::uint32_t code) {
+    if ((code >= 0x0660u && code <= 0x0669u) || (code >= 0x06F0u && code <= 0x06F9u)) return false;
+    return (code >= 0x0590u && code <= 0x08FFu) || (code >= 0xFB1Du && code <= 0xFDFFu) || (code >= 0xFE70u && code <= 0xFEFFu) ||
+           (code >= 0x10800u && code <= 0x10FFFu) || (code >= 0x1E800u && code <= 0x1EFFFu);
+}
+
+bool IsDirectionNeutral(std::uint32_t code) {
+    return code < 0x41u || (code >= 0x5Bu && code <= 0x60u) || (code >= 0x7Bu && code <= 0xBFu) || code == 0xD7u || code == 0xF7u ||
+           (code >= 0x2000u && code <= 0x2BFFu) || (code >= 0x3000u && code <= 0x3004u) || (code >= 0xFF00u && code <= 0xFF20u);
+}
+
+std::uint32_t DefaultStringForm(const std::vector<FontTextCharacter>& characters) {
+    std::uint32_t isolateDepth = 0;
+    for (const FontTextCharacter& character : characters) {
+        const std::uint32_t code = character.characterCode;
+        if (code >= 0x2066u && code <= 0x2068u) {
+            ++isolateDepth;
+            continue;
+        }
+        if (code == 0x2069u) {
+            if (isolateDepth != 0) --isolateDepth;
+            continue;
+        }
+        if (isolateDepth != 0) continue;
+        if (code == 0x200Eu) return WRITING_FORM_HORIZONTAL_LTR;
+        if (code == 0x200Fu || IsRightToLeftLetter(code)) return WRITING_FORM_HORIZONTAL_RTL;
+        if (!IsDirectionNeutral(code)) return WRITING_FORM_HORIZONTAL_LTR;
+    }
+    return WRITING_FORM_HORIZONTAL_LTR;
+}
+
 std::uint32_t LevelOf(const FontTextCharacter* character) {
     return static_cast<std::uint32_t>((character->flags >> 24) & 0xFFu);
 }
@@ -249,7 +283,8 @@ int APS5_VABI sceFontTextSourceInit(FontTextSource* textSource, const void* text
 }
 
 int APS5_VABI sceFontTextSourceRewind(FontTextSource* textSource) {
-    if (!textSource || TextSourceMagic(textSource) != TEXT_SOURCE_MAGIC) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (!textSource) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (TextSourceMagic(textSource) != TEXT_SOURCE_MAGIC) return SCE_FONT_ERROR_INVALID_TEXT_SOURCE;
     textSource->start = textSource->systemUse[0];
     textSource->end = textSource->systemUse[1];
     textSource->current = textSource->systemUse[0];
@@ -260,14 +295,16 @@ int APS5_VABI sceFontTextSourceRewind(FontTextSource* textSource) {
 }
 
 int APS5_VABI sceFontTextSourceSetDefaultFont(FontTextSource* textSource, FontHandle defaultFont) {
-    if (!textSource || TextSourceMagic(textSource) != TEXT_SOURCE_MAGIC) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (!textSource) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (TextSourceMagic(textSource) != TEXT_SOURCE_MAGIC) return SCE_FONT_ERROR_INVALID_TEXT_SOURCE;
     textSource->defaultFont = defaultFont;
     textSource->systemUse[4] = defaultFont;
     return SCE_FONT_OK;
 }
 
 int APS5_VABI sceFontTextSourceSetWritingForm(FontTextSource* textSource, std::int32_t writingForm) {
-    if (!textSource || TextSourceMagic(textSource) != TEXT_SOURCE_MAGIC) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (!textSource) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (TextSourceMagic(textSource) != TEXT_SOURCE_MAGIC) return SCE_FONT_ERROR_INVALID_TEXT_SOURCE;
     if (writingForm < static_cast<std::int32_t>(WRITING_FORM_HORIZONTAL) || writingForm > static_cast<std::int32_t>(WRITING_FORM_HORIZONTAL_LTR)) return SCE_FONT_ERROR_INVALID_PARAMETER;
     textSource->systemUse0 = (textSource->systemUse0 & 0xFFFFFFFFull) | (static_cast<std::uint64_t>(writingForm) << 32);
     return SCE_FONT_OK;
@@ -326,6 +363,7 @@ int APS5_VABI sceFontCreateString(const FontMemory* fontMemory, FontTextSource*
         fontMemory->iface->dealloc(fontMemory->mspace_handle, raw);
         return state;
     }
+    if (data->writingForm == WRITING_FORM_HORIZONTAL) data->writingForm = DefaultStringForm(data->storage->characters);
     LinkCharacters(data->storage->characters);
     data->textCount = static_cast<std::uint32_t>(data->storage->characters.size());
     data->renderCount = data->textCount;
@@ -650,6 +688,7 @@ const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting* fon
     if (!PopulateWritingStep(*writing, writing->nextIndex)) return nullptr;
     writing->currentIndex = writing->nextIndex;
     writing->hasCurrentStep = true;
+    writing->hasCurrentCharacter = true;
     AccumulateWritingMetrics(*writing);
     ++writing->nextIndex;
     return &writing->step;
@@ -658,7 +697,8 @@ const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting* fon
 FontTextCharacter* APS5_VABI sceFontWritingRefersRenderStepCharacter(FontWriting* fontWriting, const FontWritingLetterStep** pLetterStep) {
     if (pLetterStep) *pLetterStep = nullptr;
     auto* writing = GetWritingData(fontWriting);
-    if (!writing || !writing->hasCurrentStep || !writing->storage || writing->currentIndex >= writing->storage->characters.size()) return nullptr;
+    if (!writing || !writing->hasCurrentStep || !writing->hasCurrentCharacter || !writing->storage || writing->currentIndex >= writing->storage->characters.size()) return nullptr;
+    writing->hasCurrentCharacter = false;
     auto& letterStep = writing->letterStep;
     letterStep = {};
     letterStep.x = writing->step.x;
diff --git a/core/libs/prx/libSceFont/src/Unimplemented.cpp b/core/libs/prx/libSceFont/src/Unimplemented.cpp
index c98c47a93e..2ff7bd7da3 100644
--- a/core/libs/prx/libSceFont/src/Unimplemented.cpp
+++ b/core/libs/prx/libSceFont/src/Unimplemented.cpp
@@ -1,39 +1,11 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "prx/libc/include/General.hpp"
+#include "prx/libSceFont/include/FontGraphics.hpp"
 #include "prx/libSceFont/include/FontTypes.hpp"
-
-struct FontGraphicsDevice;
-struct FontGraphicsDeviceParam;
-struct FontGraphicsService;
-struct FontGraphicsServiceParam;
-struct FontWords;
-struct FontGlyphSupport;
-struct FontOutlineProfile;
-struct FontMetrics;
-struct FontStyleInformation;
-struct FontGlyphExpandBufferState;
-struct FontGraphicsResource;
-struct FontGraphicsFrame;
-struct FontGraphicsDesignResource;
-struct FontGraphicsDesign;
-struct FontGraphicsCanvas;
-struct FontGraphicsCanvasSequence;
-struct FontGraphicsSurface;
-struct FontGraphicsSurfaceTexture;
-struct FontGraphicsFill;
-
-struct FontGraphicsRegion {
-    float x;
-    float y;
-    float width;
-    float height;
-    std::uint32_t flags;
-    std::uint32_t tag;
-    float outerRadius;
-    float innerRadius;
-};
+#include "prx/libSceFont/include/FontWords.hpp"
 
 static_assert(sizeof(FontGraphicsRegion) == 32);
 static_assert(offsetof(FontGraphicsRegion, x) == 0);
@@ -45,14 +17,6 @@ static_assert(offsetof(FontGraphicsRegion, tag) == 20);
 static_assert(offsetof(FontGraphicsRegion, outerRadius) == 24);
 static_assert(offsetof(FontGraphicsRegion, innerRadius) == 28);
 
-struct FontGraphicsFillMethod {
-    std::int32_t mode;
-    std::int32_t type;
-    std::uint32_t flags;
-    std::uint32_t tag;
-    std::byte reserved[16];
-};
-
 static_assert(sizeof(FontGraphicsFillMethod) == 32);
 static_assert(offsetof(FontGraphicsFillMethod, mode) == 0);
 static_assert(offsetof(FontGraphicsFillMethod, type) == 4);
@@ -60,16 +24,6 @@ static_assert(offsetof(FontGraphicsFillMethod, flags) == 8);
 static_assert(offsetof(FontGraphicsFillMethod, tag) == 12);
 static_assert(offsetof(FontGraphicsFillMethod, reserved) == 16);
 
-struct FontGraphicsFillPlot {
-    float mapping[4];
-    const FontGraphicsRegion* region;
-    std::uint16_t tag;
-    std::uint16_t reserved26;
-    std::uint16_t layout;
-    std::uint8_t flags;
-    std::byte reserved[33];
-};
-
 static_assert(sizeof(FontGraphicsFillPlot) == 64);
 static_assert(offsetof(FontGraphicsFillPlot, mapping) == 0);
 static_assert(offsetof(FontGraphicsFillPlot, region) == 16);
@@ -79,16 +33,6 @@ static_assert(offsetof(FontGraphicsFillPlot, layout) == 28);
 static_assert(offsetof(FontGraphicsFillPlot, flags) == 30);
 static_assert(offsetof(FontGraphicsFillPlot, reserved) == 31);
 
-struct FontGraphicsFillRates {
-    float mapping[4];
-    const FontGraphicsFill* fill;
-    std::uint16_t tag;
-    std::uint16_t effect;
-    std::uint16_t layout;
-    std::uint8_t flags;
-    std::byte reserved[33];
-};
-
 static_assert(sizeof(FontGraphicsFillRates) == 64);
 static_assert(offsetof(FontGraphicsFillRates, mapping) == 0);
 static_assert(offsetof(FontGraphicsFillRates, fill) == 16);
@@ -98,14 +42,6 @@ static_assert(offsetof(FontGraphicsFillRates, layout) == 28);
 static_assert(offsetof(FontGraphicsFillRates, flags) == 30);
 static_assert(offsetof(FontGraphicsFillRates, reserved) == 31);
 
-struct FontGraphicsPoolUsage {
-    std::uint32_t capacity;
-    std::uint32_t used;
-    std::uint32_t available;
-    std::uint32_t peak;
-    std::int32_t change;
-};
-
 static_assert(sizeof(FontGraphicsPoolUsage) == 20);
 static_assert(offsetof(FontGraphicsPoolUsage, capacity) == 0);
 static_assert(offsetof(FontGraphicsPoolUsage, used) == 4);
@@ -113,27 +49,15 @@ static_assert(offsetof(FontGraphicsPoolUsage, available) == 8);
 static_assert(offsetof(FontGraphicsPoolUsage, peak) == 12);
 static_assert(offsetof(FontGraphicsPoolUsage, change) == 16);
 
-struct FontGraphicsMemoryUsage {
-    FontGraphicsPoolUsage storage;
-    FontGraphicsPoolUsage allocations;
-    void* address;
-};
-
 static_assert(sizeof(FontGraphicsMemoryUsage) == 48);
 static_assert(offsetof(FontGraphicsMemoryUsage, storage) == 0);
 static_assert(offsetof(FontGraphicsMemoryUsage, allocations) == 20);
 static_assert(offsetof(FontGraphicsMemoryUsage, address) == 40);
 
-struct FontGraphicsDeviceUsage {
-    FontGraphicsMemoryUsage first;
-    FontGraphicsMemoryUsage second;
-};
-
 static_assert(sizeof(FontGraphicsDeviceUsage) == 96);
 static_assert(offsetof(FontGraphicsDeviceUsage, first) == 0);
 static_assert(offsetof(FontGraphicsDeviceUsage, second) == 48);
 
-
 #pragma GCC visibility push(default)
 
 extern "C" {
@@ -159,8 +83,7 @@ int APS5_VABI sceFontCreateGraphicsServiceWithEdition(const FontMemory* memory,
 }
 
 int APS5_VABI sceFontCreateWords(const FontMemory* memory, FontTextSource* source, std::uint64_t unusedSlot, FontWords** words) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::CreateWords(memory, source, words);
 }
 
 int APS5_VABI sceFontDestroyGraphicsDevice(FontGraphicsDevice** device) {
@@ -174,26 +97,10 @@ int APS5_VABI sceFontDestroyGraphicsService(FontGraphicsService** service) {
 }
 
 int APS5_VABI sceFontDestroyWords(FontWords** words) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::DestroyWords(words);
 }
 
 
-int APS5_VABI sceFontGetFontGlyphsOutlineProfile(FontHandle font, FontOutlineProfile* profile) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceFontGetFontMetrics(FontHandle font, std::uint32_t mode, FontMetrics* metrics) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceFontGetFontStyleInformation(FontHandle font, FontStyleInformation* information) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceFontGetGlyphExpandBufferState(FontHandle font, FontGlyphExpandBufferState* state) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -240,43 +147,35 @@ int APS5_VABI sceFontGraphicsExchangeResource(FontGraphicsResource* resource, Fo
 }
 
 int APS5_VABI sceFontGraphicsFillMethodInit(FontGraphicsFillMethod* method, std::int32_t mode, std::int32_t type) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillMethodInit(method, mode, type);
 }
 
 int APS5_VABI sceFontGraphicsFillPlotInit(FontGraphicsFillPlot* plot, const FontGraphicsRegion* region) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillPlotInit(plot, region);
 }
 
 int APS5_VABI sceFontGraphicsFillPlotSetLayout(FontGraphicsFillPlot* plot, std::int32_t first, std::int32_t second) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillPlotSetLayout(plot, first, second);
 }
 
 int APS5_VABI sceFontGraphicsFillPlotSetMapping(FontGraphicsFillPlot* plot, float first, float second, float third, float fourth) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillPlotSetMapping(plot, first, second, third, fourth);
 }
 
 int APS5_VABI sceFontGraphicsFillRatesInit(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillRatesInit(rates, fill, effect);
 }
 
 int APS5_VABI sceFontGraphicsFillRatesSetFillEffect(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillRatesSetFillEffect(rates, fill, effect);
 }
 
 int APS5_VABI sceFontGraphicsFillRatesSetLayout(FontGraphicsFillRates* rates, std::int32_t first, std::int32_t second) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillRatesSetLayout(rates, first, second);
 }
 
 int APS5_VABI sceFontGraphicsFillRatesSetMapping(FontGraphicsFillRates* rates, float first, float second, float third, float fourth) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsFillRatesSetMapping(rates, first, second, third, fourth);
 }
 
 int APS5_VABI sceFontGraphicsGetDeviceUsage(FontGraphicsDevice* device, FontGraphicsDeviceUsage* usage) {
@@ -285,18 +184,15 @@ int APS5_VABI sceFontGraphicsGetDeviceUsage(FontGraphicsDevice* device, FontGrap
 }
 
 int APS5_VABI sceFontGraphicsRegionInit(FontGraphicsRegion* region, float x, float y, float width, float height) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsRegionInit(region, x, y, width, height);
 }
 
 int APS5_VABI sceFontGraphicsRegionInitCircular(FontGraphicsRegion* region, float centerX, float centerY, float outerRadius, float innerRadius) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsRegionInitCircular(region, centerX, centerY, outerRadius, innerRadius);
 }
 
 int APS5_VABI sceFontGraphicsRegionInitRoundish(FontGraphicsRegion* region, float x, float y, float width, float height, float outerRadius, float innerRadius, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::GraphicsRegionInitRoundish(region, x, y, width, height, outerRadius, innerRadius, flags);
 }
 
 int APS5_VABI sceFontGraphicsRelease(void** object) {
@@ -464,14 +360,17 @@ int APS5_VABI sceFontGraphicsUpdateShapeFillPlot(FontGraphicsResource* resource,
     return 0;
 }
 
+void APS5_VABI sceFontSetGraphicsErrorCallback(Font::GraphicsErrorCallback callback) {
+    Font::SetGraphicsErrorCallback(callback);
+}
+
 int APS5_VABI sceFontSupportGlyphs(const FontGlyphSupport* support) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceFontWordsFindWordCharacters(FontWords* words, FontTextCharacter* firstCharacter, FontTextCharacter* endCharacter, FontTextCharacter** lastCharacter, FontTextCharacter** nextCharacter) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Font::WordsFindWordCharacters(words, firstCharacter, endCharacter, lastCharacter, nextCharacter);
 }
 
 int APS5_VABI sceFontGraphicsDrawupFillTextureImageObject(FontGraphicsFrame* frame, const void* data, std::uint32_t dataSize, float x, float y, float width, float height, FontGraphicsFill** fill) {
diff --git a/core/libs/prx/libSceFont/src/Words.cpp b/core/libs/prx/libSceFont/src/Words.cpp
new file mode 100644
index 0000000000..ae61907c07
--- /dev/null
+++ b/core/libs/prx/libSceFont/src/Words.cpp
@@ -0,0 +1,296 @@
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <new>
+#include <vector>
+
+#include "prx/libSceFont/include/Api.hpp"
+#include "prx/libSceFont/include/FontDriver.hpp"
+#include "prx/libSceFont/include/FontWords.hpp"
+
+namespace {
+
+constexpr std::uint16_t WORDS_MAGIC = 0x0F0D;
+constexpr std::int32_t PARSER_RESULT_ERROR = -1;
+constexpr std::int32_t PARSER_RESULT_TERMINATE = 0;
+constexpr std::int32_t PARSER_RESULT_FONT_CODE = 1;
+constexpr std::size_t MAX_WORD_DEPTH = 128;
+constexpr std::size_t MAX_WORD_NODES = 0xFFFF;
+constexpr std::size_t MAX_MATCHES = 16;
+constexpr std::uint32_t WORD_END = 0x80000000u;
+constexpr std::uint32_t WORD_CODE_MASK = 0x7FFFFFFFu;
+constexpr std::uint64_t CHARACTER_SEGMENTED_SCRIPT_MASK = 0xFFull;
+constexpr std::uint64_t CHARACTER_BREAK_CLASS_MASK = 0x7ull << 43;
+constexpr std::uint64_t CHARACTER_BREAK_CLASS_JOINED = 0x1ull << 43;
+constexpr std::uint8_t CLUSTER_KIND_LEADING = 1;
+
+struct WordNode {
+    std::uint32_t code;
+    std::uint16_t childCount;
+    std::uint16_t firstChild;
+};
+
+static_assert(sizeof(WordNode) == 8);
+
+struct WordsData {
+    std::uint16_t magic = WORDS_MAGIC;
+    std::uint16_t reserved = 0;
+    std::uint32_t nodeCount = 0;
+    std::uint16_t rootCount = 0;
+    const FontMemory* memory = nullptr;
+    WordNode* nodes = nullptr;
+};
+
+struct BuildNode {
+    std::uint32_t code = 0;
+    bool end = false;
+    std::uint16_t childCount = 0;
+    std::size_t firstChild = 0;
+};
+
+using BuildLevels = std::vector<std::vector<BuildNode>>;
+
+struct WordMatch {
+    FontTextCharacter* last = nullptr;
+    std::uint32_t length = 0;
+};
+
+struct MatchRing {
+    std::array<WordMatch, MAX_MATCHES> entries{};
+    std::uint32_t count = 0;
+
+    const WordMatch& Longest() const { return entries[(count - 1) % MAX_MATCHES]; }
+};
+
+int ParseFailure(std::int32_t state, const FontTextParseResult& result) {
+    if (state == PARSER_RESULT_ERROR && result.Error.errorCode < 0) return result.Error.errorCode;
+    return SCE_FONT_ERROR_INVALID_TEXT_SOURCE;
+}
+
+int AddCode(BuildLevels& levels, std::size_t& depth, std::size_t& pathLength, std::uint32_t code) {
+    if (levels.size() <= depth) levels.emplace_back();
+    auto& level = levels[depth];
+    if (depth < pathLength) {
+        const std::uint32_t previous = level.back().code;
+        if (code == previous) {
+            ++depth;
+            return SCE_FONT_OK;
+        }
+        if (code < previous) return SCE_FONT_ERROR_NO_SUPPORT_CODE;
+        level.push_back({code});
+        if (depth > 0) ++levels[depth - 1].back().childCount;
+    } else {
+        level.push_back({code});
+        if (depth > 0) {
+            BuildNode& parent = levels[depth - 1].back();
+            parent.firstChild = level.size() - 1;
+            parent.childCount = 1;
+        }
+    }
+    pathLength = ++depth;
+    return SCE_FONT_OK;
+}
+
+int ReadWords(FontTextSource* source, BuildLevels& levels) {
+    std::size_t depth = 0;
+    std::size_t pathLength = 0;
+    void* order = nullptr;
+    for (;;) {
+        FontTextParseResult result{};
+        const std::int32_t state = source->textParser(source, &order, &result);
+        if (state == PARSER_RESULT_TERMINATE) {
+            if (depth > 0) levels[depth - 1].back().end = true;
+            if (result.Terminate.terminateCode == 0) return SCE_FONT_OK;
+            depth = 0;
+            continue;
+        }
+        if (state != PARSER_RESULT_FONT_CODE) return ParseFailure(state, result);
+        const std::uint32_t code = result.FontCode.code;
+        if (static_cast<std::int32_t>(code) <= 0) return SCE_FONT_ERROR_NO_SUPPORT_CODE;
+        if (depth >= MAX_WORD_DEPTH) return SCE_FONT_OK;
+        if (const int rc = AddCode(levels, depth, pathLength, code); rc != SCE_FONT_OK) return rc;
+    }
+}
+
+std::size_t CountNodes(const BuildLevels& levels) {
+    std::size_t count = 0;
+    for (const auto& level : levels) count += level.size();
+    return count;
+}
+
+void StoreNodes(const BuildLevels& levels, WordNode* nodes) {
+    std::size_t levelStart = 0;
+    for (std::size_t depth = 0; depth < levels.size(); ++depth) {
+        const std::size_t childStart = levelStart + levels[depth].size();
+        for (std::size_t i = 0; i < levels[depth].size(); ++i) {
+            const BuildNode& node = levels[depth][i];
+            WordNode& stored = nodes[levelStart + i];
+            stored.code = node.code | (node.end ? WORD_END : 0u);
+            stored.childCount = node.childCount;
+            stored.firstChild = node.childCount != 0 ? static_cast<std::uint16_t>(childStart + node.firstChild) : 0;
+        }
+        levelStart = childStart;
+    }
+}
+
+int BuildWords(const FontMemory* memory, FontTextSource* source, FontWords** words) {
+    if (const int rc = sceFontTextSourceRewind(source); rc != SCE_FONT_OK) return rc;
+    BuildLevels levels;
+    if (const int rc = ReadWords(source, levels); rc != SCE_FONT_OK) return rc;
+    const std::size_t nodeCount = CountNodes(levels);
+    if (nodeCount > MAX_WORD_NODES) return SCE_FONT_ERROR_FUNCTIONAL_LIMIT;
+    void* raw = memory->iface->alloc(memory->mspace_handle, sizeof(WordsData));
+    if (!raw) return SCE_FONT_ERROR_ALLOCATION_FAILED;
+    auto* data = new (raw) WordsData{};
+    auto* nodes = static_cast<WordNode*>(memory->iface->alloc(memory->mspace_handle, static_cast<std::uint32_t>(nodeCount * sizeof(WordNode))));
+    if (!nodes) {
+        memory->iface->dealloc(memory->mspace_handle, raw);
+        return SCE_FONT_ERROR_ALLOCATION_FAILED;
+    }
+    StoreNodes(levels, nodes);
+    data->nodeCount = static_cast<std::uint32_t>(nodeCount);
+    data->rootCount = levels.empty() ? 0 : static_cast<std::uint16_t>(levels[0].size());
+    data->memory = memory;
+    data->nodes = nodes;
+    *words = reinterpret_cast<FontWords*>(data);
+    return SCE_FONT_OK;
+}
+
+FontTextCharacter* NextVisible(FontTextCharacter* character) {
+    do {
+        character = character->next;
+    } while (character && character->synthetic != 0);
+    return character;
+}
+
+FontTextCharacter* NextRendered(FontTextCharacter* character) {
+    do {
+        character = character->next;
+    } while (character && (character->synthetic != 0 || character->clusterIndex != 0));
+    return character;
+}
+
+bool InSegmentedRun(const FontTextCharacter* character) {
+    return (character->flags & CHARACTER_SEGMENTED_SCRIPT_MASK) != 0;
+}
+
+bool EndsWordAfter(const FontTextCharacter* character, const FontTextCharacter* endCharacter) {
+    const FontTextCharacter* follower = character->next;
+    if (!follower) return true;
+    if (follower->synthetic > 0) return false;
+    if (follower->synthetic < 0 && follower->clusterKind != CLUSTER_KIND_LEADING) return false;
+    if (follower->synthetic == 0 && follower->clusterIndex != 0) return false;
+    while (follower && (follower->synthetic != 0 || follower->clusterIndex != 0)) follower = follower->next;
+    if (!follower || follower == endCharacter) return true;
+    return (follower->flags & CHARACTER_BREAK_CLASS_MASK) != CHARACTER_BREAK_CLASS_JOINED;
+}
+
+const WordNode* FindCode(const WordNode* group, std::uint32_t size, std::uint32_t code) {
+    const WordNode* end = group + size;
+    const WordNode* node = std::lower_bound(group, end, code, [](const WordNode& entry, std::uint32_t value) {
+        return (entry.code & WORD_CODE_MASK) < value;
+    });
+    return node != end && (node->code & WORD_CODE_MASK) == code ? node : nullptr;
+}
+
+MatchRing MatchWords(const WordsData& data, FontTextCharacter* first, const FontTextCharacter* endCharacter) {
+    MatchRing ring;
+    const WordNode* group = data.nodes;
+    std::uint32_t groupSize = data.rootCount;
+    FontTextCharacter* character = first;
+    FontTextCharacter* clusterStart = first;
+    std::uint32_t length = 1;
+    while (groupSize != 0) {
+        const WordNode* node = FindCode(group, groupSize, character->characterCode);
+        if (!node) break;
+        if ((node->code & WORD_END) != 0 && EndsWordAfter(character, endCharacter)) {
+            ring.entries[ring.count % MAX_MATCHES] = {clusterStart, length};
+            ++ring.count;
+        }
+        if (node->childCount == 0) break;
+        character = NextVisible(character);
+        if (!character || character == endCharacter) break;
+        if (character->clusterIndex == 0) clusterStart = character;
+        ++length;
+        group = data.nodes + node->firstChild;
+        groupSize = node->childCount;
+    }
+    return ring;
+}
+
+bool OverrunsNextWord(const WordsData& data, FontTextCharacter* first, const FontTextCharacter* endCharacter, const WordMatch& longest) {
+    FontTextCharacter* probe = first;
+    for (std::uint32_t remaining = longest.length; remaining-- > 0;) {
+        probe = NextVisible(probe);
+        if (!probe) return false;
+        if (!InSegmentedRun(probe)) continue;
+        const MatchRing overlap = MatchWords(data, probe, endCharacter);
+        return overlap.count != 0 && overlap.Longest().length > remaining;
+    }
+    return false;
+}
+
+FontTextCharacter* SelectWord(const WordsData& data, FontTextCharacter* first, const FontTextCharacter* endCharacter) {
+    const MatchRing matches = MatchWords(data, first, endCharacter);
+    if (matches.count == 0) return nullptr;
+    const WordMatch& longest = matches.Longest();
+    if (!InSegmentedRun(first) && InSegmentedRun(longest.last) && OverrunsNextWord(data, first, endCharacter, longest)) return nullptr;
+    const std::uint32_t candidates = std::min<std::uint32_t>(matches.count, MAX_MATCHES);
+    const WordMatch* fallback = nullptr;
+    for (std::uint32_t i = 0; i < candidates; ++i) {
+        const WordMatch& candidate = matches.entries[(matches.count - 1 - i) % MAX_MATCHES];
+        if (!candidate.last) break;
+        FontTextCharacter* follower = NextVisible(candidate.last);
+        if (!follower || !InSegmentedRun(follower)) return candidate.last;
+        if (MatchWords(data, follower, endCharacter).count != 0) return candidate.last;
+        if (!fallback) fallback = &candidate;
+    }
+    return fallback ? fallback->last : nullptr;
+}
+
+}
+
+int Font::CreateWords(const FontMemory* memory, FontTextSource* source, FontWords** words) {
+    int rc = SCE_FONT_ERROR_INVALID_PARAMETER;
+    if (memory && (memory->mem_kind != MEMORY_MAGIC || !memory->iface || !memory->iface->alloc || !memory->iface->dealloc)) {
+        rc = SCE_FONT_ERROR_INVALID_MEMORY;
+    } else if (memory && source && source->textParser && words) {
+        rc = BuildWords(memory, source, words);
+        if (rc == SCE_FONT_OK) {
+            sceFontTextSourceRewind(source);
+            return rc;
+        }
+    }
+    if (words) *words = nullptr;
+    if (source) sceFontTextSourceRewind(source);
+    return rc;
+}
+
+int Font::DestroyWords(FontWords** words) {
+    if (!words || !*words) return SCE_FONT_ERROR_INVALID_PARAMETER;
+    auto* data = reinterpret_cast<WordsData*>(*words);
+    if (data->magic != WORDS_MAGIC || !data->memory || !data->memory->iface || !data->memory->iface->dealloc) return SCE_FONT_ERROR_INVALID_WORDS;
+    const FontMemory* memory = data->memory;
+    data->magic = 0;
+    if (data->nodes) memory->iface->dealloc(memory->mspace_handle, data->nodes);
+    memory->iface->dealloc(memory->mspace_handle, data);
+    *words = nullptr;
+    return SCE_FONT_OK;
+}
+
+int Font::WordsFindWordCharacters(FontWords* words, FontTextCharacter* firstCharacter, FontTextCharacter* endCharacter, FontTextCharacter** lastCharacter, FontTextCharacter** nextCharacter) {
+    int rc = SCE_FONT_OK;
+    FontTextCharacter* found = nullptr;
+    const auto* data = reinterpret_cast<const WordsData*>(words);
+    if (!words || !firstCharacter || !lastCharacter) {
+        rc = SCE_FONT_ERROR_INVALID_PARAMETER;
+    } else if (data->magic != WORDS_MAGIC || !data->nodes) {
+        rc = SCE_FONT_ERROR_INVALID_WORDS;
+    } else {
+        found = SelectWord(*data, firstCharacter, endCharacter);
+    }
+    if (lastCharacter) *lastCharacter = found;
+    if (nextCharacter) *nextCharacter = found ? NextRendered(found) : nullptr;
+    return rc;
+}
diff --git a/core/libs/prx/libSceFont/src/WritingLine.cpp b/core/libs/prx/libSceFont/src/WritingLine.cpp
index 7365c1f418..95771489a0 100644
--- a/core/libs/prx/libSceFont/src/WritingLine.cpp
+++ b/core/libs/prx/libSceFont/src/WritingLine.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 #include <array>
 #include <cstddef>
 #include <cstdint>
diff --git a/core/libs/prx/libSceFontFt-module/libSceFontFt-module.hpp b/core/libs/prx/libSceFontFt-module/libSceFontFt-module.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFontFt-module/libSceFontFt-module.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFontFt/Export.cpp b/core/libs/prx/libSceFontFt/Export.cpp
index 628a572b94..c376b1c590 100644
--- a/core/libs/prx/libSceFontFt/Export.cpp
+++ b/core/libs/prx/libSceFontFt/Export.cpp
@@ -1,15 +1,12 @@
+#include "prx/libSceFontFt/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-
 #include "prx/libSceFontFt/include/FontFtDriver.hpp"
 #include "prx/libc/include/General.hpp"
 
 #pragma GCC visibility push(default)
 
-struct FontFtAliases;
-struct FontFtGlyphSelection;
-
 extern "C" {
 
 const Font::SysDriver* APS5_VABI sceFontSelectLibraryFt(int value) {
diff --git a/core/libs/prx/libSceFontFt/include/Api.hpp b/core/libs/prx/libSceFontFt/include/Api.hpp
new file mode 100644
index 0000000000..b31e84ae16
--- /dev/null
+++ b/core/libs/prx/libSceFontFt/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "prx/libSceFont/include/FontTypes.hpp"
+#include "prx/libSceFont/include/FontDriver.hpp"
+#include "SceTypes.hpp"
+
+struct FontFtAliases;
+
+struct FontFtGlyphSelection;
+
+extern "C" {
+
+const Font::SysDriver* APS5_VABI sceFontSelectLibraryFt(int value);
+const Font::RendererSelection* APS5_VABI sceFontSelectRendererFt(int value);
+int APS5_VABI sceFontFtInitAliases(FontFtAliases** aliases);
+int APS5_VABI sceFontFtSetAliasFont(const char* alias, std::uint32_t fontId);
+int APS5_VABI sceFontFtSetAliasPath(const char* alias, const char* path);
+int APS5_VABI sceFontFtSupportBdf(FontLibrary library);
+int APS5_VABI sceFontFtSupportCid(FontLibrary library);
+int APS5_VABI sceFontFtSupportFontFormats(FontLibrary library, std::uint32_t formats);
+int APS5_VABI sceFontFtSupportOpenType(FontLibrary library);
+int APS5_VABI sceFontFtSupportOpenTypeOtf(FontLibrary library);
+int APS5_VABI sceFontFtSupportOpenTypeTtf(FontLibrary library);
+int APS5_VABI sceFontFtSupportPcf(FontLibrary library);
+int APS5_VABI sceFontFtSupportPfr(FontLibrary library);
+int APS5_VABI sceFontFtSupportSystemFonts(FontLibrary library);
+int APS5_VABI sceFontFtSupportTrueType(FontLibrary library);
+int APS5_VABI sceFontFtSupportTrueTypeGx(FontLibrary library);
+int APS5_VABI sceFontFtSupportType1(FontLibrary library);
+int APS5_VABI sceFontFtSupportType42(FontLibrary library);
+int APS5_VABI sceFontFtSupportWinFonts(FontLibrary library);
+int APS5_VABI sceFontFtTermAliases(FontFtAliases** aliases);
+const FontFtGlyphSelection* APS5_VABI sceFontSelectGlyphsFt(std::int32_t selector);
+
+}
diff --git a/core/libs/prx/libSceFontFt/libSceFontFt.hpp b/core/libs/prx/libSceFontFt/libSceFontFt.hpp
new file mode 100644
index 0000000000..a14b5f23e0
--- /dev/null
+++ b/core/libs/prx/libSceFontFt/libSceFontFt.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFontFt/include/Api.hpp"
diff --git a/core/libs/prx/libSceFontFt/src/Driver.cpp b/core/libs/prx/libSceFontFt/src/Driver.cpp
index a4561830ea..7ac80488ea 100644
--- a/core/libs/prx/libSceFontFt/src/Driver.cpp
+++ b/core/libs/prx/libSceFontFt/src/Driver.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFontFt/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -777,6 +778,143 @@ std::uint64_t APS5_VABI RendererQuery(RendererNative* renderer, std::uint8_t* pa
     return 0;
 }
 
+float ScaledUnits(std::int64_t units, std::int64_t fixed16) {
+    return FromF26Dot6(RoundMulFixed(units, fixed16));
+}
+
+void StoreVerticalFontMetrics(FT_Face face, const TT_OS2* os2, std::int64_t xShift, std::int64_t yShift, FontMetrics* metrics) {
+    const auto xScale = static_cast<std::int64_t>(face->size->metrics.x_scale);
+    const auto yScale = static_cast<std::int64_t>(face->size->metrics.y_scale);
+    const auto unitsPerEm = static_cast<std::int64_t>(static_cast<std::uint16_t>(face->units_per_EM));
+    const auto* vhea = static_cast<const TT_VertHeader*>(FT_Get_Sfnt_Table(face, FT_SFNT_VHEA));
+    if (vhea) {
+        const std::int64_t minTop = vhea->min_Top_Side_Bearing;
+        metrics->ascender = ScaledUnits(minTop + yShift, yScale);
+        metrics->descender = ScaledUnits(static_cast<std::int64_t>(vhea->yMax_Extent) + yShift, yScale);
+        metrics->lineGap = 0.0f;
+        if (vhea->Version >= 0x110000 && vhea->Line_Gap != 0) {
+            metrics->lineGap = FromF26Dot6(RoundMulFixed(vhea->Line_Gap, xScale) - TruncFixed(unitsPerEm * xScale));
+        }
+        metrics->verticalDescender = ScaledUnits(static_cast<std::int64_t>(vhea->Descender) + xShift, xScale);
+        const std::int64_t ascender = os2 ? os2->sTypoAscender : static_cast<std::int32_t>(minTop + face->bbox.yMax);
+        metrics->verticalAscender = ScaledUnits(ascender + yShift, yScale);
+    } else {
+        std::int64_t ascender = 0;
+        if (os2) {
+            ascender = os2->sTypoAscender;
+            metrics->ascender = ScaledUnits(ascender - face->bbox.yMax, yScale);
+            metrics->descender = ScaledUnits(ascender - face->bbox.yMin, yScale);
+            metrics->lineGap = 0.0f;
+        } else {
+            const std::int32_t lineGap = face->height - face->ascender + face->descender;
+            const std::int32_t halfGap = lineGap / 2;
+            metrics->ascender = ScaledUnits(halfGap, yScale);
+            metrics->descender = ScaledUnits(face->ascender - face->descender + halfGap, yScale);
+            metrics->lineGap = ScaledUnits(lineGap, xScale);
+            ascender = face->ascender + halfGap;
+        }
+        metrics->verticalAscender = ScaledUnits(ascender + yShift, yScale);
+        metrics->verticalDescender = ScaledUnits(-static_cast<std::int64_t>(unitsPerEm / 2), xScale);
+    }
+    metrics->maxAdvance = ScaledUnits(face->max_advance_height, yScale);
+}
+
+std::uint32_t StoreHorizontalFontMetrics(FT_Face face, const TT_OS2* os2, std::uint32_t form, std::int64_t xShift, std::int64_t yShift, FontMetrics* metrics) {
+    const auto xScale = static_cast<std::int64_t>(face->size->metrics.x_scale);
+    const auto yScale = static_cast<std::int64_t>(face->size->metrics.y_scale);
+    const auto* hhea = static_cast<const TT_HoriHeader*>(FT_Get_Sfnt_Table(face, FT_SFNT_HHEA));
+    metrics->verticalDescender = 0.0f;
+    metrics->verticalAscender = 0.0f;
+    bool fromHorizontalHeader = form == 1 || ((form == 2 || form == 3) && !os2);
+    if (form == 2 && os2) {
+        metrics->ascender = ScaledUnits(static_cast<std::int64_t>(os2->sTypoAscender) + yShift, yScale);
+        metrics->descender = ScaledUnits(static_cast<std::int64_t>(os2->sTypoDescender) + yShift, yScale);
+        metrics->lineGap = ScaledUnits(os2->sTypoLineGap, yScale);
+        fromHorizontalHeader = metrics->ascender == 0.0f && metrics->descender == 0.0f;
+    } else if (form == 3 && os2) {
+        metrics->ascender = ScaledUnits(static_cast<std::int64_t>(os2->usWinAscent) + yShift, yScale);
+        metrics->descender = FromF26Dot6(-RoundMulFixed(static_cast<std::int64_t>(os2->usWinDescent) - yShift, yScale));
+        metrics->lineGap = hhea ? ScaledUnits(hhea->Line_Gap, yScale) : 0.0f;
+        fromHorizontalHeader = metrics->ascender == metrics->descender;
+    }
+    if (fromHorizontalHeader) {
+        form = 1;
+        if (hhea) {
+            metrics->ascender = ScaledUnits(static_cast<std::int64_t>(hhea->Ascender) + yShift, yScale);
+            metrics->descender = ScaledUnits(static_cast<std::int64_t>(hhea->Descender) + yShift, yScale);
+            metrics->lineGap = ScaledUnits(hhea->Line_Gap, yScale);
+        } else {
+            metrics->ascender = ScaledUnits(static_cast<std::int64_t>(face->ascender) + yShift, yScale);
+            metrics->descender = ScaledUnits(static_cast<std::int64_t>(face->descender) + yShift, yScale);
+            metrics->lineGap = 0.0f;
+        }
+    }
+    metrics->maxAdvance = ScaledUnits(static_cast<std::int64_t>(face->max_advance_width) + xShift, xScale);
+    return form;
+}
+
+int APS5_VABI LibraryGetFontMetrics(FontObj* obj, std::uint32_t form, FontMetrics* metrics) {
+    const FT_Face face = obj ? FaceOf(obj) : nullptr;
+    if (!face || !face->size || !metrics) return SCE_FONT_ERROR_FATAL;
+    const auto xScale = static_cast<std::int64_t>(face->size->metrics.x_scale);
+    const auto yScale = static_cast<std::int64_t>(face->size->metrics.y_scale);
+    const std::int64_t xShift = obj->shift_cache_x;
+    const std::int64_t yShift = obj->shift_cache_y;
+    const auto* os2 = static_cast<const TT_OS2*>(FT_Get_Sfnt_Table(face, FT_SFNT_OS2));
+    if (os2 && os2->version == 0xFFFF) os2 = nullptr;
+    if (form == 4) {
+        StoreVerticalFontMetrics(face, os2, xShift, yShift, metrics);
+    } else {
+        form = StoreHorizontalFontMetrics(face, os2, form, xShift, yShift, metrics);
+    }
+    metrics->xMin = ScaledUnits(static_cast<std::int64_t>(face->bbox.xMin) + xShift, xScale);
+    metrics->yMin = ScaledUnits(static_cast<std::int64_t>(face->bbox.yMin) + yShift, yScale);
+    metrics->xMax = ScaledUnits(static_cast<std::int64_t>(face->bbox.xMax) + xShift, xScale);
+    metrics->yMax = ScaledUnits(static_cast<std::int64_t>(face->bbox.yMax) + yShift, yScale);
+    const auto unitsPerEm = static_cast<std::int64_t>(static_cast<std::uint16_t>(face->units_per_EM));
+    metrics->emWidth = FromF26Dot6(TruncFixed(unitsPerEm * xScale));
+    metrics->emHeight = FromF26Dot6(TruncFixed(unitsPerEm * yScale));
+    const auto* handle = reinterpret_cast<const FontHandleNative*>(obj->font_handle);
+    metrics->effectWeightX = handle ? handle->style.effect_weight_x : 0.0f;
+    metrics->effectWeightY = handle ? handle->style.effect_weight_y : 0.0f;
+    metrics->slantRatio = handle ? handle->style.slant_ratio : 0.0f;
+    metrics->form = form;
+    return SCE_FONT_OK;
+}
+
+int APS5_VABI LibraryGetOutlineProfile(FontObj* obj, FontOutlineProfile* profile) {
+    const FT_Face face = obj ? FaceOf(obj) : nullptr;
+    if (!face) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    const auto* maxp = static_cast<const TT_MaxProfile*>(FT_Get_Sfnt_Table(face, FT_SFNT_MAXP));
+    if (!maxp) throw std::runtime_error("FontFt: outline profile of a face without a maxp table");
+    if (maxp->version < 0x10000) return SCE_FONT_ERROR_NO_SUPPORT_FUNCTION;
+    profile->maxContours = maxp->maxContours;
+    profile->maxPoints = maxp->maxPoints;
+    profile->maxCompositeContours = maxp->maxCompositeContours;
+    profile->maxCompositePoints = maxp->maxCompositePoints;
+    return SCE_FONT_OK;
+}
+
+std::uint16_t WeightClass(std::uint16_t weight) {
+    return weight >= 100 && weight <= 900 && weight % 100 == 0 ? static_cast<std::uint16_t>(weight / 100) : 0;
+}
+
+int APS5_VABI LibraryGetFontStyleInformation(FontObj* obj, FontStyleInformation* information) {
+    const FT_Face face = obj ? FaceOf(obj) : nullptr;
+    if (!face || !information) return SCE_FONT_ERROR_FATAL;
+    const auto* header = static_cast<const TT_Header*>(FT_Get_Sfnt_Table(face, FT_SFNT_HEAD));
+    if (!header) throw std::runtime_error("FontFt: style information of a face without a head table");
+    const auto* os2 = static_cast<const TT_OS2*>(FT_Get_Sfnt_Table(face, FT_SFNT_OS2));
+    if (os2 && os2->version == 0xFFFF) os2 = nullptr;
+    information->familyName = face->family_name;
+    information->styleName = face->style_name;
+    information->styleFlags = static_cast<std::uint16_t>(face->style_flags & (FT_STYLE_FLAG_ITALIC | FT_STYLE_FLAG_BOLD));
+    information->weight = os2 ? WeightClass(os2->usWeightClass) : 0;
+    information->width = os2 && os2->usWidthClass < 10 ? os2->usWidthClass : 0;
+    information->layoutFlags = static_cast<std::uint16_t>(1 + (header->Font_Direction < 0 ? 1 : 0) + (FT_HAS_VERTICAL(face) ? 0x80 : 0));
+    return SCE_FONT_OK;
+}
+
 SysDriver MakeDriverTable() {
     SysDriver driver{};
     driver.pixel_resolution = &LibraryGetPixelResolution;
@@ -791,6 +929,9 @@ SysDriver MakeDriverTable() {
     driver.glyph_index = &LibraryGetGlyphIndex;
     driver.set_char_with_dpi = &LibrarySetCharSizeWithDpi;
     driver.set_char_default_dpi = &LibrarySetCharSizeDefaultDpi;
+    driver.font_metrics = &LibraryGetFontMetrics;
+    driver.style_information = &LibraryGetFontStyleInformation;
+    driver.outline_profile = &LibraryGetOutlineProfile;
     driver.compute_layout = &LibraryComputeLayout;
     driver.compute_layout_alt = &LibraryComputeLayoutAlt;
     driver.load_glyph_cached = &LibraryLoadGlyphCached;
diff --git a/core/libs/prx/libSceFontGs/libSceFontGs.hpp b/core/libs/prx/libSceFontGs/libSceFontGs.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFontGs/libSceFontGs.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFreeType/CMakeLists.txt b/core/libs/prx/libSceFreeType/CMakeLists.txt
index 689682460c..fb0affb25c 100644
--- a/core/libs/prx/libSceFreeType/CMakeLists.txt
+++ b/core/libs/prx/libSceFreeType/CMakeLists.txt
@@ -1,10 +1,13 @@
 add_library(libSceFreeType SHARED EXCLUDE_FROM_ALL
         Export.cpp
+        src/Bitmap.cpp
         src/Outline.cpp
         src/Charmap.cpp
         src/FaceInfo.cpp
         src/GuestObjects.cpp
         src/Names.cpp
+        src/Trigonometry.cpp
+        src/OutlineDecompose.cpp
 )
 target_include_directories(libSceFreeType PRIVATE ${LIBS_INCLUDE_DIR})
 target_link_libraries(libSceFreeType PRIVATE freetype)
@@ -29,6 +32,16 @@ endif()
 configure_windows_unwind(libSceFreeType)
 
 if(BUILD_TESTING)
+    add_test_executable(guest_freetype_bitmap_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeBitmap.cpp)
+    target_include_directories(guest_freetype_bitmap_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_bitmap_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_bitmap_tests)
+    add_test(NAME guest_freetype_bitmap COMMAND guest_freetype_bitmap_tests)
+    if(WIN32)
+        set_tests_properties(guest_freetype_bitmap PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+    endif()
+
     add_test_executable(guest_freetype_outline_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeOutline.cpp)
     target_include_directories(guest_freetype_outline_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_freetype_outline_tests PRIVATE libSceFreeType freetype libc)
diff --git a/core/libs/prx/libSceFreeType/Export.cpp b/core/libs/prx/libSceFreeType/Export.cpp
index 1675df6a53..a8919bfb49 100644
--- a/core/libs/prx/libSceFreeType/Export.cpp
+++ b/core/libs/prx/libSceFreeType/Export.cpp
@@ -1,8 +1,13 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include FT_OUTLINE_H
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/General.hpp"
 
+#include FT_GASP_H
+#include FT_CID_H
+#include FT_SIZES_H
+
 #include <algorithm>
 #include <bit>
 #include <cstdint>
@@ -16,6 +21,8 @@
 
 using namespace FreeType;
 
+static_assert(sizeof(FT_Bool) == 1 && sizeof(FT_Int) == 4 && sizeof(FT_UInt) == 4);
+
 namespace {
 
 void FinalizeSlot(void* object) {
@@ -27,15 +34,19 @@ void FinalizeSlot(void* object) {
 
 void FinalizeSize(void* object) {
     auto* host = static_cast<FT_Size>(object);
-    auto* face = static_cast<GuestFace*>(host->generic.data);
-    if (face->size.generic.finalizer) face->size.generic.finalizer(&face->size);
-    face->rec.size = nullptr;
+    auto* rec = static_cast<GuestSizeRec*>(host->generic.data);
+    auto* face = static_cast<GuestFace*>(host->face->generic.data);
+    SyncSizeRecord_nid_no_patch(*face, *rec, host);
+    SyncSizePointer_nid_no_patch(*face);
+    if (rec->generic.finalizer) rec->generic.finalizer(rec);
 }
 
 void FinalizeFace(void* object) {
     auto* host = static_cast<FT_Face>(object);
     auto* face = static_cast<GuestFace*>(host->generic.data);
+    SyncSizePointer_nid_no_patch(*face);
     if (face->rec.generic.finalizer) face->rec.generic.finalizer(&face->rec);
+    face->finalized = true;
 }
 
 void PublishFace(GuestLibrary* library, std::unique_ptr<GuestFace> face, FT_Face host, GuestFaceRec** aface) {
@@ -47,7 +58,7 @@ void PublishFace(GuestLibrary* library, std::unique_ptr<GuestFace> face, FT_Face
     library->faces.push_back(std::move(face));
     host->generic = {owner, FinalizeFace};
     if (host->glyph) host->glyph->generic = {owner, FinalizeSlot};
-    if (host->size) host->size->generic = {owner, FinalizeSize};
+    if (host->size) host->size->generic = {&owner->size, FinalizeSize};
     *aface = &owner->rec;
     hostOwner.release();
 }
@@ -108,6 +119,13 @@ int APS5_VABI FT_Done_FreeType_nid_postfix(GuestLibrary* library) {
     return error;
 }
 
+int APS5_VABI FT_Select_Size_nid_postfix(GuestFaceRec* face, std::int32_t strikeIndex) {
+    GuestFace* owner = FaceOf(face);
+    const FT_Error error = FT_Select_Size(owner ? owner->host : nullptr, strikeIndex);
+    if (owner) SyncSize(*owner);
+    return error;
+}
+
 int APS5_VABI FT_New_Face_nid_postfix(GuestLibrary* library, const char* filepathname, std::int64_t face_index, GuestFaceRec** aface) {
     if (!filepathname) return FT_Err_Invalid_Argument;
     const std::int64_t faceIndex = OpenFaceIndex(face_index);
@@ -138,13 +156,72 @@ int APS5_VABI FT_New_Memory_Face_nid_postfix(GuestLibrary* library, const unsign
     return 0;
 }
 
+int APS5_VABI FT_Reference_Face_nid_postfix(GuestFaceRec* face) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Reference_Face(owner ? owner->host : nullptr);
+}
+
 int APS5_VABI FT_Done_Face_nid_postfix(GuestFaceRec* face) {
     GuestFace* owner = FaceOf(face);
     const FT_Error error = FT_Done_Face(owner ? owner->host : nullptr);
-    if (error == 0) owner->library->faces.remove_if([owner](const auto& entry) { return entry.get() == owner; });
+    if (error == 0 && owner->finalized) owner->library->faces.remove_if([owner](const auto& entry) { return entry.get() == owner; });
     return error;
 }
 
+int APS5_VABI FT_New_Size_nid_postfix(GuestFaceRec* face, GuestSizeRec** asize) {
+    GuestFace* owner = FaceOf(face);
+    FT_Face hostFace = owner ? owner->host : nullptr;
+    if (!hostFace || !asize || !hostFace->driver) {
+        FT_Size unused = nullptr;
+        return FT_New_Size(hostFace, asize ? &unused : nullptr);
+    }
+    const bool activates = asize == &owner->rec.size;
+    *asize = nullptr;
+    if (activates) hostFace->size = nullptr;
+    try {
+        owner->sizes.emplace_back();
+    } catch (const std::bad_alloc&) {
+        return FT_Err_Out_Of_Memory;
+    }
+    auto entry = std::prev(owner->sizes.end());
+    FT_Size host = nullptr;
+    const FT_Error error = FT_New_Size(hostFace, activates ? &hostFace->size : &host);
+    if (activates) host = hostFace->size;
+    if (error != 0) {
+        owner->sizes.erase(entry);
+        SyncSizePointer_nid_no_patch(*owner);
+        return error;
+    }
+    entry->host = host;
+    SyncSizeRecord_nid_no_patch(*owner, entry->rec, host);
+    host->generic = {&entry->rec, FinalizeSize};
+    *asize = &entry->rec;
+    SyncSizePointer_nid_no_patch(*owner);
+    return 0;
+}
+
+int APS5_VABI FT_Activate_Size_nid_postfix(GuestSizeRec* size) {
+    FT_Size host = size ? static_cast<FT_Size>(size->internal) : nullptr;
+    const FT_Error error = FT_Activate_Size(host);
+    if (error == 0) SyncSize(*static_cast<GuestFace*>(host->face->generic.data));
+    return error;
+}
+
+int APS5_VABI FT_Done_Size_nid_postfix(GuestSizeRec* size) {
+    FT_Size host = size ? static_cast<FT_Size>(size->internal) : nullptr;
+    auto* owner = host && host->face ? static_cast<GuestFace*>(host->face->generic.data) : nullptr;
+    const FT_Error error = FT_Done_Size(host);
+    if (error != 0) return error;
+    if (host == owner->initialSize) {
+        owner->initialSize = nullptr;
+        owner->size.internal = nullptr;
+    } else {
+        owner->sizes.remove_if([host](const auto& entry) { return entry.host == host; });
+    }
+    SyncSize(*owner);
+    return 0;
+}
+
 int APS5_VABI FT_Set_Pixel_Sizes_nid_postfix(GuestFaceRec* face, std::uint32_t pixel_width, std::uint32_t pixel_height) {
     GuestFace* owner = FaceOf(face);
     const FT_Error error = FT_Set_Pixel_Sizes(owner ? owner->host : nullptr, pixel_width, pixel_height);
@@ -199,6 +276,27 @@ int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec* face, std::uint32_t glyph_
     return error;
 }
 
+int APS5_VABI FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(GuestFaceRec* face, const char** registry,
+                                                               const char** ordering, std::int32_t* supplement) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_CID_Registry_Ordering_Supplement(owner ? owner->host : nullptr, registry, ordering, supplement);
+}
+
+int APS5_VABI FT_Get_CID_Is_Internally_CID_Keyed_nid_postfix(GuestFaceRec* face, std::uint8_t* isCid) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_CID_Is_Internally_CID_Keyed(owner ? owner->host : nullptr, isCid);
+}
+
+int APS5_VABI FT_Get_CID_From_Glyph_Index_nid_postfix(GuestFaceRec* face, std::uint32_t glyphIndex, std::uint32_t* cid) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_CID_From_Glyph_Index(owner ? owner->host : nullptr, glyphIndex, cid);
+}
+
+int APS5_VABI FT_Get_Gasp_nid_postfix(GuestFaceRec* face, std::uint32_t ppem) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_Gasp(owner ? owner->host : nullptr, ppem);
+}
+
 int APS5_VABI FT_Load_Char_nid_postfix(GuestFaceRec* face, std::uint64_t charCode, std::int32_t loadFlags) {
     GuestFace* owner = FaceOf(face);
     const FT_Error error = FT_Load_Char(owner ? owner->host : nullptr, static_cast<FT_ULong>(static_cast<std::uint32_t>(charCode)), loadFlags);
@@ -250,6 +348,19 @@ int APS5_VABI FT_Render_Glyph_nid_postfix(GuestGlyphSlotRec* slot, std::int32_t
     return error;
 }
 
+int APS5_VABI FT_Outline_Copy_nid_postfix(const GuestOutline* source, GuestOutline* target) {
+    if (!source || !target) return FT_Err_Invalid_Outline;
+    if (source->n_points != target->n_points || source->n_contours != target->n_contours) return FT_Err_Invalid_Argument;
+    if (source == target) return FT_Err_Ok;
+    if (source->n_points) {
+        std::memmove(target->points, source->points, source->n_points * sizeof(GuestVector));
+        std::memmove(target->tags, source->tags, source->n_points * sizeof(unsigned char));
+    }
+    if (source->n_contours) std::memmove(target->contours, source->contours, source->n_contours * sizeof(std::uint16_t));
+    target->flags = (source->flags & ~FT_OUTLINE_OWNER) | (target->flags & FT_OUTLINE_OWNER);
+    return FT_Err_Ok;
+}
+
 int APS5_VABI FT_Select_Charmap_nid_postfix(GuestFaceRec* face, std::int32_t encoding) {
     GuestFace* owner = FaceOf(face);
     const FT_Error error = FT_Select_Charmap(owner ? owner->host : nullptr, static_cast<FT_Encoding>(encoding));
diff --git a/core/libs/prx/libSceFreeType/include/Api.hpp b/core/libs/prx/libSceFreeType/include/Api.hpp
new file mode 100644
index 0000000000..926be2864a
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/include/Api.hpp
@@ -0,0 +1,77 @@
+#pragma once
+
+#include "prx/libSceFreeType/include/GuestList.hpp"
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+std::int32_t APS5_VABI FT_Outline_GetInsideBorder_nid_postfix(const FreeType::GuestOutline* outline);
+std::int32_t APS5_VABI FT_Outline_GetOutsideBorder_nid_postfix(const FreeType::GuestOutline* outline);
+
+int APS5_VABI FT_Init_FreeType_nid_postfix(FreeType::GuestLibrary** alibrary);
+int APS5_VABI FT_Done_FreeType_nid_postfix(FreeType::GuestLibrary* library);
+int APS5_VABI FT_New_Face_nid_postfix(FreeType::GuestLibrary* library, const char* filepathname, std::int64_t faceIndex, FreeType::GuestFaceRec** aface);
+int APS5_VABI FT_New_Memory_Face_nid_postfix(FreeType::GuestLibrary* library, const unsigned char* fileBase, std::int64_t fileSize, std::int64_t faceIndex, FreeType::GuestFaceRec** aface);
+int APS5_VABI FT_Reference_Face_nid_postfix(FreeType::GuestFaceRec* face);
+int APS5_VABI FT_Done_Face_nid_postfix(FreeType::GuestFaceRec* face);
+int APS5_VABI FT_Select_Size_nid_postfix(FreeType::GuestFaceRec* face, std::int32_t strikeIndex);
+int APS5_VABI FT_New_Size_nid_postfix(FreeType::GuestFaceRec* face, FreeType::GuestSizeRec** asize);
+int APS5_VABI FT_Activate_Size_nid_postfix(FreeType::GuestSizeRec* size);
+int APS5_VABI FT_Done_Size_nid_postfix(FreeType::GuestSizeRec* size);
+int APS5_VABI FT_Set_Pixel_Sizes_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t pixelWidth, std::uint32_t pixelHeight);
+int APS5_VABI FT_Set_Char_Size_nid_postfix(FreeType::GuestFaceRec* face, std::int64_t charWidth, std::int64_t charHeight, std::uint32_t horizontalResolution, std::uint32_t verticalResolution);
+std::uint32_t APS5_VABI FT_Get_Char_Index_nid_postfix(FreeType::GuestFaceRec* face, std::uint64_t charcode);
+int APS5_VABI FT_Get_Kerning_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t leftGlyph, std::uint32_t rightGlyph, std::uint32_t kernMode, FreeType::GuestVector* kerning);
+int APS5_VABI FT_Get_PFR_Advance_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t index, std::int64_t* advance);
+int APS5_VABI FT_Get_PFR_Kerning_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t left, std::uint32_t right, FreeType::GuestVector* vector);
+int APS5_VABI FT_Get_PFR_Metrics_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t* outline, std::uint32_t* metrics, std::int64_t* xScale, std::int64_t* yScale);
+int APS5_VABI FT_Load_Glyph_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t glyphIndex, std::int32_t loadFlags);
+int APS5_VABI FT_Get_Gasp_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t ppem);
+int APS5_VABI FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(FreeType::GuestFaceRec* face, const char** registry, const char** ordering, std::int32_t* supplement);
+int APS5_VABI FT_Get_CID_Is_Internally_CID_Keyed_nid_postfix(FreeType::GuestFaceRec* face, std::uint8_t* isCid);
+int APS5_VABI FT_Get_CID_From_Glyph_Index_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t glyphIndex, std::uint32_t* cid);
+int APS5_VABI FT_Load_Char_nid_postfix(FreeType::GuestFaceRec* face, std::uint64_t charCode, std::int32_t loadFlags);
+int APS5_VABI FT_Outline_Get_Orientation_nid_postfix(FreeType::GuestOutline* outline);
+int APS5_VABI FT_Outline_Copy_nid_postfix(const FreeType::GuestOutline* source, FreeType::GuestOutline* target);
+int APS5_VABI FT_Outline_Decompose_nid_postfix(FreeType::GuestOutline* outline, const FreeType::GuestOutlineFuncs* functions, void* user);
+int APS5_VABI FT_Render_Glyph_nid_postfix(FreeType::GuestGlyphSlotRec* slot, std::int32_t renderMode);
+int APS5_VABI FT_Select_Charmap_nid_postfix(FreeType::GuestFaceRec* face, std::int32_t encoding);
+int APS5_VABI FT_Set_Charmap_nid_postfix(FreeType::GuestFaceRec* face, FreeType::GuestCharMapRec* charmap);
+std::uint64_t APS5_VABI FT_Get_First_Char_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t* glyphIndex);
+std::uint64_t APS5_VABI FT_Get_Next_Char_nid_postfix(FreeType::GuestFaceRec* face, std::uint64_t charcode, std::uint32_t* glyphIndex);
+void APS5_VABI FT_Set_Transform_nid_postfix(FreeType::GuestFaceRec* face, const FreeType::GuestMatrix* matrix, const FreeType::GuestVector* delta);
+int APS5_VABI FT_Get_Charmap_Index_nid_postfix(FreeType::GuestCharMapRec* charmap);
+std::uint64_t APS5_VABI FT_Get_CMap_Language_ID_nid_postfix(FreeType::GuestCharMapRec* charmap);
+std::int64_t APS5_VABI FT_Get_CMap_Format_nid_postfix(FreeType::GuestCharMapRec* charmap);
+const char* APS5_VABI FT_Get_X11_Font_Format_nid_postfix(FreeType::GuestFaceRec* face);
+std::uint16_t APS5_VABI FT_Get_FSType_Flags_nid_postfix(FreeType::GuestFaceRec* face);
+FreeType::GuestListNodeRec* APS5_VABI FT_List_Find_nid_postfix(FreeType::GuestListRec* list, void* data);
+void APS5_VABI FT_List_Add_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+void APS5_VABI FT_List_Insert_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+void APS5_VABI FT_List_Remove_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+void APS5_VABI FT_List_Up_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+int APS5_VABI FT_List_Iterate_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListIterator iterator, void* user);
+void APS5_VABI FT_List_Finalize_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListDestructor destroy, FreeType::GuestMemoryRec* memory, void* user);
+int APS5_VABI FT_Get_Glyph_Name_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t glyphIndex, void* buffer, std::uint32_t bufferSize);
+std::uint32_t APS5_VABI FT_Get_Name_Index_nid_postfix(FreeType::GuestFaceRec* face, const char* glyphName);
+const char* APS5_VABI FT_Get_Postscript_Name_nid_postfix(FreeType::GuestFaceRec* face);
+std::uint32_t APS5_VABI FT_Get_Sfnt_Name_Count_nid_postfix(FreeType::GuestFaceRec* face);
+int APS5_VABI FT_Get_Sfnt_Name_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t index, FreeType::GuestSfntName* name);
+int APS5_VABI FT_Outline_Check_nid_postfix(FreeType::GuestOutline* outline);
+void APS5_VABI FT_Outline_Get_CBox_nid_postfix(const FreeType::GuestOutline* outline, FreeType::GuestBBox* box);
+void APS5_VABI FT_Outline_Translate_nid_postfix(const FreeType::GuestOutline* outline, std::int64_t xOffset, std::int64_t yOffset);
+void APS5_VABI FT_Outline_Reverse_nid_postfix(FreeType::GuestOutline* outline);
+int APS5_VABI FT_Request_Size_nid_postfix(FreeType::GuestFaceRec* face, const FreeType::GuestSizeRequestRec* request);
+
+void APS5_VABI FT_Bitmap_New_nid_postfix(FreeType::GuestBitmap* bitmap);
+int APS5_VABI FT_Bitmap_Copy_nid_postfix(FreeType::GuestLibrary* library, const FreeType::GuestBitmap* source, FreeType::GuestBitmap* target);
+int APS5_VABI FT_Bitmap_Convert_nid_postfix(FreeType::GuestLibrary* library, const FreeType::GuestBitmap* source, FreeType::GuestBitmap* target, std::int32_t alignment);
+int APS5_VABI FT_Bitmap_Done_nid_postfix(FreeType::GuestLibrary* library, FreeType::GuestBitmap* bitmap);
+std::int64_t APS5_VABI FT_Cos_nid_postfix(std::int64_t angle);
+std::int64_t APS5_VABI FT_Sin_nid_postfix(std::int64_t angle);
+std::int64_t APS5_VABI FT_Tan_nid_postfix(std::int64_t angle);
+void APS5_VABI FT_Vector_Unit_nid_postfix(FreeType::GuestVector* vector, std::int64_t angle);
+std::int64_t APS5_VABI FT_Angle_Diff_nid_postfix(std::int64_t first, std::int64_t second);
+
+}
diff --git a/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp b/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp
index bddbb33246..51acae2148 100644
--- a/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp
+++ b/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp
@@ -8,6 +8,8 @@
 
 namespace FreeType {
 
+struct GuestLibrary;
+
 struct GuestGeneric {
     void* data;
     void (APS5_VABI *finalizer)(void*);
@@ -113,6 +115,15 @@ struct GuestOutline {
     std::int32_t flags;
 };
 
+struct GuestOutlineFuncs {
+    int (APS5_VABI *move_to)(const GuestVector*, void*);
+    int (APS5_VABI *line_to)(const GuestVector*, void*);
+    int (APS5_VABI *conic_to)(const GuestVector*, const GuestVector*, void*);
+    int (APS5_VABI *cubic_to)(const GuestVector*, const GuestVector*, const GuestVector*, void*);
+    std::int32_t shift;
+    std::int64_t delta;
+};
+
 struct GuestGlyphSlotRec {
     void* library;
     void* face;
@@ -183,6 +194,7 @@ static_assert(sizeof(GuestSizeRec) == 88 && offsetof(GuestSizeRec, metrics) == 2
 static_assert(sizeof(GuestSizeRequestRec) == 32 && offsetof(GuestSizeRequestRec, width) == 8 && offsetof(GuestSizeRequestRec, height) == 16);
 static_assert(offsetof(GuestSizeRequestRec, horiResolution) == 24 && offsetof(GuestSizeRequestRec, vertResolution) == 28);
 static_assert(sizeof(GuestBitmap) == 40 && offsetof(GuestBitmap, buffer) == 16 && offsetof(GuestBitmap, palette) == 32);
+static_assert(sizeof(GuestOutlineFuncs) == 48 && offsetof(GuestOutlineFuncs, shift) == 32 && offsetof(GuestOutlineFuncs, delta) == 40);
 static_assert(sizeof(GuestOutline) == 40 && offsetof(GuestOutline, points) == 8 && offsetof(GuestOutline, flags) == 32);
 static_assert(offsetof(GuestGlyphSlotRec, glyph_index) == 0x18 && offsetof(GuestGlyphSlotRec, metrics) == 0x30);
 static_assert(offsetof(GuestGlyphSlotRec, advance) == 0x80 && offsetof(GuestGlyphSlotRec, format) == 0x90);
diff --git a/core/libs/prx/libSceFreeType/include/GuestList.hpp b/core/libs/prx/libSceFreeType/include/GuestList.hpp
index 67a8396b87..1e11a349c1 100644
--- a/core/libs/prx/libSceFreeType/include/GuestList.hpp
+++ b/core/libs/prx/libSceFreeType/include/GuestList.hpp
@@ -3,16 +3,21 @@
 
 #include "prx/libc/include/general/VabiMacros.hpp"
 
-#include <ft2build.h>
-#include FT_LIST_H
-
 #include <cstddef>
 #include <cstdint>
 
 namespace FreeType {
 
-using GuestListRec = FT_ListRec;
-using GuestListNodeRec = FT_ListNodeRec;
+struct GuestListNodeRec {
+    GuestListNodeRec* prev;
+    GuestListNodeRec* next;
+    void* data;
+};
+
+struct GuestListRec {
+    GuestListNodeRec* head;
+    GuestListNodeRec* tail;
+};
 
 struct GuestMemoryRec {
     void* user;
diff --git a/core/libs/prx/libSceFreeType/include/GuestObjects.hpp b/core/libs/prx/libSceFreeType/include/GuestObjects.hpp
index d237147b89..d47c3c1037 100644
--- a/core/libs/prx/libSceFreeType/include/GuestObjects.hpp
+++ b/core/libs/prx/libSceFreeType/include/GuestObjects.hpp
@@ -19,23 +19,40 @@ struct GuestLibrary {
     std::list<std::unique_ptr<GuestFace>> faces;
 };
 
+void UnregisterBitmap_nid_no_patch(const GuestBitmap* bitmap);
+
+struct GuestSize {
+    GuestSizeRec rec{};
+    FT_Size host = nullptr;
+};
+
 struct GuestFace {
     GuestFaceRec rec{};
     GuestGlyphSlotRec slot{};
     GuestSizeRec size{};
     GuestLibrary* library = nullptr;
     FT_Face host = nullptr;
+    bool finalized = false;
+    FT_Size initialSize = nullptr;
+    bool sizeInitialized = false;
+    std::list<GuestSize> sizes;
     std::vector<unsigned char> bytes;
     std::vector<GuestBitmapSize> fixedSizes;
     std::vector<GuestCharMapRec> charmaps;
     std::vector<GuestCharMapRec*> charmapPointers;
     std::vector<GuestVector> outlinePoints;
+
+    ~GuestFace() { UnregisterBitmap_nid_no_patch(&slot.bitmap); }
 };
 
+void RegisterBitmap_nid_no_patch(GuestFace& face);
+
 GuestFace* FaceOf(const GuestFaceRec* face);
 GuestFace* FaceOf(const GuestGlyphSlotRec* slot);
 void SyncFace(GuestFace& face);
 void SyncSize(GuestFace& face);
+void SyncSizePointer_nid_no_patch(GuestFace& face);
+void SyncSizeRecord_nid_no_patch(GuestFace& face, GuestSizeRec& rec, FT_Size host);
 void SyncSlot(GuestFace& face);
 
 }
diff --git a/core/libs/prx/libSceFreeType/include/GuestPfr.hpp b/core/libs/prx/libSceFreeType/include/GuestPfr.hpp
new file mode 100644
index 0000000000..deb4468530
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/include/GuestPfr.hpp
@@ -0,0 +1,14 @@
+#ifndef CORE_LIBS_PRX_LIBSCEFREETYPE_INCLUDE_GUESTPFR_HPP
+#define CORE_LIBS_PRX_LIBSCEFREETYPE_INCLUDE_GUESTPFR_HPP
+
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+
+extern "C" {
+
+int FreeTypePfrAdvance_nid_no_patch(FreeType::GuestFaceRec* face, std::uint32_t index, std::int64_t* advance);
+int FreeTypePfrKerning_nid_no_patch(FreeType::GuestFaceRec* face, std::uint32_t left, std::uint32_t right, FreeType::GuestVector* vector);
+int FreeTypePfrMetrics_nid_no_patch(FreeType::GuestFaceRec* face, std::uint32_t* outline, std::uint32_t* metrics, std::int64_t* xScale, std::int64_t* yScale);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceFreeType/libSceFreeType.hpp b/core/libs/prx/libSceFreeType/libSceFreeType.hpp
new file mode 100644
index 0000000000..e1970ef93b
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/libSceFreeType.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFreeType/include/Api.hpp"
diff --git a/core/libs/prx/libSceFreeType/src/Bitmap.cpp b/core/libs/prx/libSceFreeType/src/Bitmap.cpp
new file mode 100644
index 0000000000..2e8a5d750e
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Bitmap.cpp
@@ -0,0 +1,100 @@
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_BITMAP_H
+
+#include <cstdint>
+#include <mutex>
+#include <stdexcept>
+#include <unordered_map>
+
+using namespace FreeType;
+
+namespace {
+
+struct BitmapOwners {
+    std::mutex mutex;
+    std::unordered_map<const GuestBitmap*, FT_Bitmap*> bitmaps;
+};
+
+BitmapOwners& Owners() {
+    static BitmapOwners owners;
+    return owners;
+}
+
+FT_Bitmap NativeBitmap(const GuestBitmap& bitmap) {
+    return {bitmap.rows, bitmap.width, bitmap.pitch, bitmap.buffer, bitmap.num_grays, bitmap.pixel_mode, bitmap.palette_mode, bitmap.palette};
+}
+
+void SyncBitmap(GuestBitmap& guest, const FT_Bitmap& bitmap) {
+    guest = {bitmap.rows, bitmap.width, bitmap.pitch, bitmap.buffer, bitmap.num_grays, bitmap.pixel_mode, bitmap.palette_mode, bitmap.palette};
+    auto& owners = Owners();
+    std::lock_guard lock(owners.mutex);
+    const auto found = owners.bitmaps.find(&guest);
+    if (found != owners.bitmaps.end() && found->second) *found->second = bitmap;
+}
+
+}
+
+namespace FreeType {
+
+void RegisterBitmap_nid_no_patch(GuestFace& face) {
+    auto& owners = Owners();
+    std::lock_guard lock(owners.mutex);
+    owners.bitmaps.insert_or_assign(&face.slot.bitmap, face.host->glyph ? &face.host->glyph->bitmap : nullptr);
+}
+
+void UnregisterBitmap_nid_no_patch(const GuestBitmap* bitmap) {
+    auto& owners = Owners();
+    std::lock_guard lock(owners.mutex);
+    owners.bitmaps.erase(bitmap);
+}
+
+}
+
+extern "C" {
+
+void APS5_VABI FT_Bitmap_New_nid_postfix(GuestBitmap* bitmap) {
+    if (bitmap) SyncBitmap(*bitmap, {});
+}
+
+int APS5_VABI FT_Bitmap_Copy_nid_postfix(GuestLibrary* library, const GuestBitmap* source, GuestBitmap* target) {
+    if (!library) return FT_Err_Invalid_Library_Handle;
+    if (!source || !target) return FT_Err_Invalid_Argument;
+    if (source == target) {
+        SyncBitmap(*target, NativeBitmap(*target));
+        return 0;
+    }
+    if (source->buffer && source->buffer == target->buffer) {
+        throw std::runtime_error("FT_Bitmap_Copy: overlapping source and target buffers are not implemented");
+    }
+    const FT_Bitmap nativeSource = NativeBitmap(*source);
+    FT_Bitmap nativeTarget = NativeBitmap(*target);
+    const FT_Error error = FT_Bitmap_Copy(library->host, &nativeSource, &nativeTarget);
+    SyncBitmap(*target, nativeTarget);
+    return error;
+}
+
+int APS5_VABI FT_Bitmap_Convert_nid_postfix(GuestLibrary* library, const GuestBitmap* source, GuestBitmap* target, std::int32_t alignment) {
+    if (!library) return FT_Err_Invalid_Library_Handle;
+    if (!source || !target) return FT_Err_Invalid_Argument;
+    if (source == target || (source->buffer && source->buffer == target->buffer)) {
+        throw std::runtime_error("FT_Bitmap_Convert: overlapping source and target buffers are not implemented");
+    }
+    const FT_Bitmap nativeSource = NativeBitmap(*source);
+    FT_Bitmap nativeTarget = NativeBitmap(*target);
+    const FT_Error error = FT_Bitmap_Convert(library->host, &nativeSource, &nativeTarget, alignment);
+    SyncBitmap(*target, nativeTarget);
+    return error;
+}
+
+int APS5_VABI FT_Bitmap_Done_nid_postfix(GuestLibrary* library, GuestBitmap* bitmap) {
+    if (!library) return FT_Err_Invalid_Library_Handle;
+    if (!bitmap) return FT_Err_Invalid_Argument;
+    FT_Bitmap native = NativeBitmap(*bitmap);
+    const FT_Error error = FT_Bitmap_Done(library->host, &native);
+    SyncBitmap(*bitmap, native);
+    return error;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/Charmap.cpp b/core/libs/prx/libSceFreeType/src/Charmap.cpp
index c6a776664e..6f7ee76773 100644
--- a/core/libs/prx/libSceFreeType/src/Charmap.cpp
+++ b/core/libs/prx/libSceFreeType/src/Charmap.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
diff --git a/core/libs/prx/libSceFreeType/src/FaceInfo.cpp b/core/libs/prx/libSceFreeType/src/FaceInfo.cpp
index 6810256751..a5969dcbfa 100644
--- a/core/libs/prx/libSceFreeType/src/FaceInfo.cpp
+++ b/core/libs/prx/libSceFreeType/src/FaceInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
diff --git a/core/libs/prx/libSceFreeType/src/GuestObjects.cpp b/core/libs/prx/libSceFreeType/src/GuestObjects.cpp
index 79662344d2..1ecb345092 100644
--- a/core/libs/prx/libSceFreeType/src/GuestObjects.cpp
+++ b/core/libs/prx/libSceFreeType/src/GuestObjects.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 
 #include <cstddef>
+#include <stdexcept>
 
 namespace FreeType {
 
@@ -13,6 +14,7 @@ GuestFace* FaceOf(const GuestGlyphSlotRec* slot) {
 }
 
 void SyncFace(GuestFace& face) {
+    RegisterBitmap_nid_no_patch(face);
     const FT_Face host = face.host;
     auto& rec = face.rec;
     rec.num_faces = host->num_faces;
@@ -50,20 +52,48 @@ void SyncFace(GuestFace& face) {
     rec.underline_position = host->underline_position;
     rec.underline_thickness = host->underline_thickness;
     rec.glyph = host->glyph ? &face.slot : nullptr;
-    rec.size = host->size ? &face.size : nullptr;
     rec.internal = &face;
     SyncSize(face);
     SyncSlot(face);
 }
 
-void SyncSize(GuestFace& face) {
-    face.size.face = &face.rec;
-    if (!face.host->size) {
-        face.size.metrics = {};
+void SyncSizeRecord_nid_no_patch(GuestFace& face, GuestSizeRec& rec, FT_Size host) {
+    rec.face = &face.rec;
+    rec.internal = host;
+    if (!host) {
+        rec.metrics = {};
         return;
     }
-    const auto& metrics = face.host->size->metrics;
-    face.size.metrics = {metrics.x_ppem, metrics.y_ppem, metrics.x_scale, metrics.y_scale, metrics.ascender, metrics.descender, metrics.height, metrics.max_advance};
+    const auto& metrics = host->metrics;
+    rec.metrics = {metrics.x_ppem, metrics.y_ppem, metrics.x_scale, metrics.y_scale, metrics.ascender, metrics.descender, metrics.height, metrics.max_advance};
+}
+
+void SyncSizePointer_nid_no_patch(GuestFace& face) {
+    const FT_Size active = face.host->size;
+    if (!active) {
+        face.rec.size = nullptr;
+        return;
+    }
+    if (active == face.initialSize) {
+        face.rec.size = &face.size;
+        return;
+    }
+    for (auto& size : face.sizes) {
+        if (size.host != active) continue;
+        face.rec.size = &size.rec;
+        return;
+    }
+    throw std::runtime_error("FreeType: an active size created outside the guest bridge is not implemented");
+}
+
+void SyncSize(GuestFace& face) {
+    if (!face.sizeInitialized) {
+        face.initialSize = face.host->size;
+        face.sizeInitialized = true;
+        SyncSizeRecord_nid_no_patch(face, face.size, face.initialSize);
+    }
+    SyncSizePointer_nid_no_patch(face);
+    if (face.rec.size) SyncSizeRecord_nid_no_patch(face, *face.rec.size, face.host->size);
 }
 
 void SyncSlot(GuestFace& face) {
diff --git a/core/libs/prx/libSceFreeType/src/List.cpp b/core/libs/prx/libSceFreeType/src/List.cpp
index ff3deb8272..198f3207b6 100644
--- a/core/libs/prx/libSceFreeType/src/List.cpp
+++ b/core/libs/prx/libSceFreeType/src/List.cpp
@@ -1,8 +1,11 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestList.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 
 #include <array>
 #include <stdexcept>
+#include <ft2build.h>
+#include FT_LIST_H
 
 using namespace FreeType;
 
@@ -25,77 +28,89 @@ private:
     std::array<GuestArena::HostWrite, 5> writes;
 };
 
-struct Iteration {
-    GuestListIterator iterator;
-    void* user;
-};
-
-int Iterate(FT_ListNode node, void* user) {
-    auto& call = *static_cast<Iteration*>(user);
-    return call.iterator(node, call.user);
-}
-
-struct Finalization {
-    GuestMemoryRec* memory;
-    GuestListDestructor destroy;
-    void* user;
-};
-
-void Destroy(FT_Memory memory, void* data, void*) {
-    auto& call = *static_cast<Finalization*>(memory->user);
-    call.destroy(call.memory, data, call.user);
-}
-
-void FreeNode(FT_Memory memory, void* block) {
-    auto& call = *static_cast<Finalization*>(memory->user);
-    call.memory->free(call.memory, block);
-}
-
 }
 
 extern "C" {
 
 GuestListNodeRec* APS5_VABI FT_List_Find_nid_postfix(GuestListRec* list, void* data) {
-    return FT_List_Find(list, data);
+    if (!list) return nullptr;
+    for (auto* node = list->head; node; node = node->next) {
+        if (node->data == data) return node;
+    }
+    return nullptr;
 }
 
 void APS5_VABI FT_List_Add_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
     if (!list || !node) return;
     const ListWrite write(list, {node, list->tail});
-    FT_List_Add(list, node);
+    auto* tail = list->tail;
+    node->next = nullptr;
+    node->prev = tail;
+    if (tail) tail->next = node;
+    else list->head = node;
+    list->tail = node;
 }
 
 void APS5_VABI FT_List_Insert_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
     if (!list || !node) return;
     const ListWrite write(list, {node, list->head});
-    FT_List_Insert(list, node);
+    auto* head = list->head;
+    node->next = head;
+    node->prev = nullptr;
+    if (head) head->prev = node;
+    else list->tail = node;
+    list->head = node;
 }
 
 void APS5_VABI FT_List_Remove_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
     if (!list || !node) return;
     const ListWrite write(list, {node->prev, node->next});
-    FT_List_Remove(list, node);
+    auto* previous = node->prev;
+    auto* next = node->next;
+    if (previous) previous->next = next;
+    else list->head = next;
+    if (next) next->prev = previous;
+    else list->tail = previous;
 }
 
 void APS5_VABI FT_List_Up_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
     if (!list || !node || !node->prev) return;
     const ListWrite write(list, {node, node->prev, node->next, list->head});
-    FT_List_Up(list, node);
+    auto* previous = node->prev;
+    auto* next = node->next;
+    previous->next = next;
+    if (next) next->prev = previous;
+    else list->tail = previous;
+    node->prev = nullptr;
+    node->next = list->head;
+    list->head->prev = node;
+    list->head = node;
 }
 
 int APS5_VABI FT_List_Iterate_nid_postfix(GuestListRec* list, GuestListIterator iterator, void* user) {
-    Iteration call{iterator, user};
-    return FT_List_Iterate(list, iterator ? Iterate : nullptr, &call);
+    if (!list || !iterator) return FT_Err_Invalid_Argument;
+    auto* node = list->head;
+    while (node) {
+        auto* next = node->next;
+        const int error = iterator(node, user);
+        if (error) return error;
+        node = next;
+    }
+    return 0;
 }
 
 void APS5_VABI FT_List_Finalize_nid_postfix(GuestListRec* list, GuestListDestructor destroy, GuestMemoryRec* memory, void* user) {
     if (!list || !memory) return;
     const ListWrite write(list);
-    Finalization call{memory, destroy, user};
-    FT_MemoryRec_ native{};
-    native.user = &call;
-    native.free = FreeNode;
-    FT_List_Finalize(list, destroy ? Destroy : nullptr, &native, user);
+    auto* node = list->head;
+    while (node) {
+        auto* next = node->next;
+        if (destroy) destroy(memory, node->data, user);
+        memory->free(memory, node);
+        node = next;
+    }
+    list->head = nullptr;
+    list->tail = nullptr;
 }
 
 }
diff --git a/core/libs/prx/libSceFreeType/src/Names.cpp b/core/libs/prx/libSceFreeType/src/Names.cpp
index 23d3b8ad8f..02e1f9f39c 100644
--- a/core/libs/prx/libSceFreeType/src/Names.cpp
+++ b/core/libs/prx/libSceFreeType/src/Names.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
diff --git a/core/libs/prx/libSceFreeType/src/Outline.cpp b/core/libs/prx/libSceFreeType/src/Outline.cpp
index 1725531f3a..8c9892ad30 100644
--- a/core/libs/prx/libSceFreeType/src/Outline.cpp
+++ b/core/libs/prx/libSceFreeType/src/Outline.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestFreeType.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
diff --git a/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp b/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
new file mode 100644
index 0000000000..34d54d7c03
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
@@ -0,0 +1,68 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include <algorithm>
+#include <bit>
+#include <cstdint>
+#include <stdexcept>
+
+namespace {
+
+bool Clockwise(const FreeType::GuestOutline* outline) {
+    if (!outline || outline->n_points == 0) return true;
+    if (!outline->points) throw std::invalid_argument("FreeType outline border: null points");
+    auto minimum = outline->points[0];
+    auto maximum = minimum;
+    for (unsigned i = 1; i < outline->n_points; ++i) {
+        const auto point = outline->points[i];
+        minimum.x = std::min(minimum.x, point.x);
+        minimum.y = std::min(minimum.y, point.y);
+        maximum.x = std::max(maximum.x, point.x);
+        maximum.y = std::max(maximum.y, point.y);
+    }
+    if (minimum.x == maximum.x || minimum.y == maximum.y) return false;
+    constexpr std::int64_t limit = 0x1000000;
+    if (minimum.x < -limit || minimum.y < -limit || maximum.x > limit || maximum.y > limit) return false;
+    if (outline->n_contours == 0) return false;
+    if (!outline->contours) throw std::invalid_argument("FreeType outline border: null contours");
+    unsigned first = 0;
+    for (unsigned contour = 0; contour < outline->n_contours; ++contour) {
+        const unsigned last = outline->contours[contour];
+        if (last < first || last >= outline->n_points)
+            throw std::invalid_argument("FreeType outline border: invalid contour endpoint");
+        first = last + 1;
+    }
+    const auto magnitude = [](std::int64_t value) { return static_cast<std::uint32_t>(value < 0 ? -value : value); };
+    const auto shift = [](std::uint32_t value) { const auto bits = std::bit_width(value); return bits > 15 ? bits - 15 : 0; };
+    const auto xShift = shift(magnitude(maximum.x) | magnitude(minimum.x));
+    const auto yShift = shift(static_cast<std::uint32_t>(maximum.y - minimum.y));
+    std::int64_t area = 0;
+    first = 0;
+    for (unsigned contour = 0; contour < outline->n_contours; ++contour) {
+        const unsigned last = outline->contours[contour];
+        auto previous = outline->points[last];
+        previous.x >>= xShift;
+        previous.y >>= yShift;
+        for (unsigned i = first; i <= last; ++i) {
+            auto current = outline->points[i];
+            current.x >>= xShift;
+            current.y >>= yShift;
+            area += (current.y - previous.y) * (current.x + previous.x);
+            previous = current;
+        }
+        first = last + 1;
+    }
+    return area < 0;
+}
+
+}
+
+extern "C" {
+
+std::int32_t APS5_VABI FT_Outline_GetInsideBorder_nid_postfix(const FreeType::GuestOutline* outline) {
+    return Clockwise(outline) ? 1 : 0;
+}
+
+std::int32_t APS5_VABI FT_Outline_GetOutsideBorder_nid_postfix(const FreeType::GuestOutline* outline) {
+    return Clockwise(outline) ? 0 : 1;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/OutlineDecompose.cpp b/core/libs/prx/libSceFreeType/src/OutlineDecompose.cpp
new file mode 100644
index 0000000000..2304dc5a9b
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/OutlineDecompose.cpp
@@ -0,0 +1,130 @@
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+
+#include <ft2build.h>
+#include FT_FREETYPE_H
+
+#include <cstdint>
+#include <limits>
+#include <stdexcept>
+
+using namespace FreeType;
+
+namespace {
+
+std::int64_t Scale(std::int64_t value, std::int32_t shift, std::int64_t delta) {
+    if (shift < 0 || shift >= 63) {
+        throw std::runtime_error("FT_Outline_Decompose: a shift outside 0-62 is not implemented");
+    }
+    constexpr auto minimum = std::numeric_limits<std::int64_t>::min();
+    constexpr auto maximum = std::numeric_limits<std::int64_t>::max();
+    const std::int64_t factor = std::int64_t{1} << shift;
+    if (value < minimum / factor || value > maximum / factor) {
+        throw std::runtime_error("FT_Outline_Decompose: overflowing coordinate scaling is not implemented");
+    }
+    const std::int64_t scaled = value * factor;
+    if ((delta > 0 && scaled < minimum + delta) || (delta < 0 && scaled > maximum + delta)) {
+        throw std::runtime_error("FT_Outline_Decompose: overflowing coordinate translation is not implemented");
+    }
+    return scaled - delta;
+}
+
+GuestVector Scale(GuestVector point, std::int32_t shift, std::int64_t delta) {
+    return {Scale(point.x, shift, delta), Scale(point.y, shift, delta)};
+}
+
+std::int64_t Midpoint(std::int64_t first, std::int64_t second) {
+    if ((second > 0 && first > std::numeric_limits<std::int64_t>::max() - second) ||
+        (second < 0 && first < std::numeric_limits<std::int64_t>::min() - second)) {
+        throw std::runtime_error("FT_Outline_Decompose: overflowing midpoint arithmetic is not implemented");
+    }
+    return (first + second) / 2;
+}
+
+GuestVector Midpoint(GuestVector first, GuestVector second) {
+    return {Midpoint(first.x, second.x), Midpoint(first.y, second.y)};
+}
+
+}
+
+extern "C" int APS5_VABI FT_Outline_Decompose_nid_postfix(GuestOutline* outline, const GuestOutlineFuncs* functions, void* user) {
+    if (!outline) return FT_Err_Invalid_Outline;
+    if (!functions) return FT_Err_Invalid_Argument;
+    const std::int32_t shift = functions->shift;
+    const std::int64_t delta = functions->delta;
+    std::int32_t previousEnd = -1;
+    for (std::uint32_t contour = 0; contour < outline->n_contours; ++contour) {
+        const std::int32_t first = previousEnd + 1;
+        const std::int32_t last = outline->contours[contour];
+        if (last < first) return FT_Err_Invalid_Outline;
+        previousEnd = last;
+        auto* points = outline->points;
+        auto* tags = outline->tags;
+        std::int32_t limit = last;
+        std::int32_t point = first;
+        GuestVector start = Scale(points[first], shift, delta);
+        const GuestVector end = Scale(points[last], shift, delta);
+        const int firstTag = tags[first] & 3;
+        if (firstTag == FT_CURVE_TAG_CUBIC) return FT_Err_Invalid_Outline;
+        if (firstTag == FT_CURVE_TAG_CONIC) {
+            if ((tags[last] & 3) == FT_CURVE_TAG_ON) {
+                start = end;
+                --limit;
+            } else {
+                start = Midpoint(start, end);
+            }
+            --point;
+        }
+        int error = functions->move_to(&start, user);
+        if (error != 0) return error;
+        bool closed = false;
+        while (point < limit) {
+            ++point;
+            const int tag = tags[point] & 3;
+            if (tag == FT_CURVE_TAG_ON) {
+                const GuestVector to = Scale(points[point], shift, delta);
+                error = functions->line_to(&to, user);
+                if (error != 0) return error;
+            } else if (tag == FT_CURVE_TAG_CONIC) {
+                GuestVector control = Scale(points[point], shift, delta);
+                while (true) {
+                    if (point == limit) {
+                        error = functions->conic_to(&control, &start, user);
+                        closed = true;
+                        break;
+                    }
+                    ++point;
+                    const int nextTag = tags[point] & 3;
+                    const GuestVector next = Scale(points[point], shift, delta);
+                    if (nextTag == FT_CURVE_TAG_ON) {
+                        error = functions->conic_to(&control, &next, user);
+                        break;
+                    }
+                    if (nextTag != FT_CURVE_TAG_CONIC) return FT_Err_Invalid_Outline;
+                    const GuestVector middle = Midpoint(control, next);
+                    error = functions->conic_to(&control, &middle, user);
+                    if (error != 0) return error;
+                    control = next;
+                }
+                if (error != 0) return error;
+            } else {
+                if (point + 1 > limit || (tags[point + 1] & 3) != FT_CURVE_TAG_CUBIC) return FT_Err_Invalid_Outline;
+                const GuestVector control1 = Scale(points[point], shift, delta);
+                const GuestVector control2 = Scale(points[point + 1], shift, delta);
+                point += 2;
+                if (point <= limit) {
+                    const GuestVector to = Scale(points[point], shift, delta);
+                    error = functions->cubic_to(&control1, &control2, &to, user);
+                } else {
+                    error = functions->cubic_to(&control1, &control2, &start, user);
+                    closed = true;
+                }
+                if (error != 0) return error;
+            }
+        }
+        if (!closed) {
+            error = functions->line_to(&start, user);
+            if (error != 0) return error;
+        }
+    }
+    return 0;
+}
diff --git a/core/libs/prx/libSceFreeType/src/Pfr.cpp b/core/libs/prx/libSceFreeType/src/Pfr.cpp
new file mode 100644
index 0000000000..d6e56c56cd
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Pfr.cpp
@@ -0,0 +1,48 @@
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libSceFreeType/include/GuestPfr.hpp"
+#include FT_FONT_FORMATS_H
+#include FT_PFR_H
+#include <cstring>
+
+extern "C" {
+
+int FreeTypePfrAdvance_nid_no_patch(FreeType::GuestFaceRec* face, std::uint32_t index, std::int64_t* advance) {
+    if (!face) return FT_Err_Invalid_Argument;
+    const auto* owner = FreeType::FaceOf(face);
+    const FT_Face host = owner ? owner->host : nullptr;
+    if (!host || !advance) return FT_Get_PFR_Advance(host, index, nullptr);
+    FT_Pos value = 0;
+    const auto error = FT_Get_PFR_Advance(host, index, &value);
+    const char* format = FT_Get_Font_Format(host);
+    if (error == 0 || (format && std::strcmp(format, "PFR") == 0)) *advance = value;
+    return error;
+}
+
+int FreeTypePfrKerning_nid_no_patch(FreeType::GuestFaceRec* face, std::uint32_t left, std::uint32_t right, FreeType::GuestVector* vector) {
+    if (!face) return FT_Err_Invalid_Argument;
+    const auto* owner = FreeType::FaceOf(face);
+    const FT_Face host = owner ? owner->host : nullptr;
+    if (!host || !vector) return FT_Get_PFR_Kerning(host, left, right, nullptr);
+    FT_Vector value{};
+    const auto error = FT_Get_PFR_Kerning(host, left, right, &value);
+    *vector = {value.x, value.y};
+    return error;
+}
+
+int FreeTypePfrMetrics_nid_no_patch(FreeType::GuestFaceRec* face, std::uint32_t* outline, std::uint32_t* metrics, std::int64_t* xScale, std::int64_t* yScale) {
+    if (!face) return FT_Err_Invalid_Argument;
+    const auto* owner = FreeType::FaceOf(face);
+    const FT_Face host = owner ? owner->host : nullptr;
+    if (!host) return FT_Get_PFR_Metrics(nullptr, nullptr, nullptr, nullptr, nullptr);
+    FT_UInt hostOutline = 0, hostMetrics = 0;
+    FT_Fixed hostX = 0, hostY = 0;
+    const auto error = FT_Get_PFR_Metrics(host, outline ? &hostOutline : nullptr, metrics ? &hostMetrics : nullptr,
+                                          xScale ? &hostX : nullptr, yScale ? &hostY : nullptr);
+    if (outline) *outline = hostOutline;
+    if (metrics) *metrics = hostMetrics;
+    if (xScale) *xScale = hostX;
+    if (yScale) *yScale = hostY;
+    return error;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/SizeRequest.cpp b/core/libs/prx/libSceFreeType/src/SizeRequest.cpp
index 6ef487fa6a..e70ea25111 100644
--- a/core/libs/prx/libSceFreeType/src/SizeRequest.cpp
+++ b/core/libs/prx/libSceFreeType/src/SizeRequest.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceFreeType/src/Trigonometry.cpp b/core/libs/prx/libSceFreeType/src/Trigonometry.cpp
new file mode 100644
index 0000000000..a8f85d47fc
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Trigonometry.cpp
@@ -0,0 +1,81 @@
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+
+#include <ft2build.h>
+#include FT_TRIGONOMETRY_H
+
+#include <array>
+#include <cstdint>
+#include <limits>
+#include <stdexcept>
+
+using namespace FreeType;
+
+namespace {
+
+FT_Angle NormalizeAngle(std::int64_t angle) {
+    return static_cast<FT_Angle>(angle % (360ll << 16));
+}
+
+GuestVector TangentVector(std::int64_t angle) {
+    constexpr std::array<std::int64_t, 22> angles{
+        1740967, 919879, 466945, 234379, 117304, 58666, 29335, 14668, 7334, 3667, 1833,
+        917, 458, 229, 115, 57, 29, 14, 7, 4, 2, 1};
+    std::int64_t remaining = NormalizeAngle(angle);
+    GuestVector vector{1ll << 24, 0};
+    while (remaining < -(45ll << 16)) {
+        vector = {vector.y, -vector.x};
+        remaining += 90ll << 16;
+    }
+    while (remaining > (45ll << 16)) {
+        vector = {-vector.y, vector.x};
+        remaining -= 90ll << 16;
+    }
+    std::int64_t rounding = 1;
+    for (std::size_t iteration = 1; iteration <= angles.size(); ++iteration) {
+        const std::int64_t direction = remaining < 0 ? 1 : -1;
+        const GuestVector step{(vector.y + rounding) >> iteration, (vector.x + rounding) >> iteration};
+        vector.x += direction * step.x;
+        vector.y -= direction * step.y;
+        remaining += direction * angles[iteration - 1];
+        rounding <<= 1;
+    }
+    return vector;
+}
+
+}
+
+extern "C" {
+
+std::int64_t APS5_VABI FT_Cos_nid_postfix(std::int64_t angle) {
+    return FT_Cos(NormalizeAngle(angle));
+}
+
+std::int64_t APS5_VABI FT_Sin_nid_postfix(std::int64_t angle) {
+    return FT_Sin(NormalizeAngle(angle));
+}
+
+std::int64_t APS5_VABI FT_Tan_nid_postfix(std::int64_t angle) {
+    const GuestVector vector = TangentVector(angle);
+    const std::uint64_t x = static_cast<std::uint64_t>(vector.x < 0 ? -vector.x : vector.x);
+    const std::uint64_t y = static_cast<std::uint64_t>(vector.y < 0 ? -vector.y : vector.y);
+    const auto quotient = static_cast<std::int64_t>(x == 0 ? 0x7FFFFFFFull : ((y << 16) + (x >> 1)) / x);
+    return (vector.x < 0) != (vector.y < 0) ? -quotient : quotient;
+}
+
+void APS5_VABI FT_Vector_Unit_nid_postfix(GuestVector* vector, std::int64_t angle) {
+    if (!vector) return;
+    FT_Vector native{};
+    FT_Vector_Unit(&native, NormalizeAngle(angle));
+    vector->x = native.x;
+    vector->y = native.y;
+}
+
+std::int64_t APS5_VABI FT_Angle_Diff_nid_postfix(std::int64_t first, std::int64_t second) {
+    if ((first > 0 && second < std::numeric_limits<std::int64_t>::min() + first) ||
+        (first < 0 && second > std::numeric_limits<std::int64_t>::max() + first)) {
+        throw std::runtime_error("FT_Angle_Diff: overflowing signed angle subtraction is not implemented");
+    }
+    return FT_Angle_Diff(0, NormalizeAngle(second - first));
+}
+
+}
diff --git a/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
new file mode 100644
index 0000000000..e8f18eac97
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
@@ -0,0 +1,38 @@
+add_library(libSceFreeTypeOl SHARED EXCLUDE_FROM_ALL Export.cpp ../libSceFreeType/src/OutlineBorders.cpp)
+target_include_directories(libSceFreeTypeOl PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceFreeTypeOl)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_freetype_outline_border_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeOutlineBorder.cpp)
+    target_include_directories(guest_freetype_outline_border_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_outline_border_tests PRIVATE freetype ${CMAKE_DL_LIBS})
+    if(WIN32)
+        target_link_libraries(guest_freetype_outline_border_tests PRIVATE libc)
+    endif()
+    configure_windows_unwind(guest_freetype_outline_border_tests)
+    add_custom_target(freetype_outline_border_patched DEPENDS
+        ${PATCHED_DIR}/libSceFreeTypeOl.prx ${PATCHED_DIR}/libSceFreeTypeOt.prx ${PATCHED_DIR}/libkernel.prx ${LIBC_PATCHED})
+    add_dependencies(guest_freetype_outline_border_tests freetype_outline_border_patched)
+    add_test(NAME guest_freetype_outline_border_reference COMMAND guest_freetype_outline_border_tests reference)
+    foreach(module IN ITEMS Ol Ot)
+        foreach(border IN ITEMS inside outside)
+            add_test(NAME guest_freetype_outline_border_${module}_${border}
+                COMMAND guest_freetype_outline_border_tests $<TARGET_FILE:libSceFreeType${module}> ${border} raw)
+            add_test(NAME guest_freetype_outline_border_${module}_${border}_patched
+                COMMAND guest_freetype_outline_border_tests ${PATCHED_DIR}/libSceFreeType${module}.prx ${border} patched)
+            set_tests_properties(guest_freetype_outline_border_${module}_${border}
+                guest_freetype_outline_border_${module}_${border}_patched PROPERTIES TIMEOUT 20)
+            if(WIN32)
+                set_tests_properties(guest_freetype_outline_border_${module}_${border} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeTypeOl>")
+                set_tests_properties(guest_freetype_outline_border_${module}_${border}_patched PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:${PATCHED_DIR}")
+            endif()
+        endforeach()
+    endforeach()
+    set_tests_properties(guest_freetype_outline_border_reference PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_freetype_outline_border_reference PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeTypeOl>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp b/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp
new file mode 100644
index 0000000000..e1970ef93b
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFreeType/include/Api.hpp"
diff --git a/core/libs/prx/libSceFreeTypeOptOl/CMakeLists.txt b/core/libs/prx/libSceFreeTypeOptOl/CMakeLists.txt
new file mode 100644
index 0000000000..ed6ccae2b6
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOptOl/CMakeLists.txt
@@ -0,0 +1,48 @@
+target_sources(libSceFreeType PRIVATE ${LIBS_INCLUDE_DIR}/prx/libSceFreeType/src/Pfr.cpp)
+
+add_library(libSceFreeTypeOptOl SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceFreeTypeOptOl PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceFreeTypeOptOl PRIVATE libSceFreeType)
+configure_windows_unwind(libSceFreeTypeOptOl)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_freetype_pfr_null_face_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypePfrNull.cpp
+        ${LIBS_INCLUDE_DIR}/prx/libSceFreeType/src/Pfr.cpp ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp)
+    target_include_directories(guest_freetype_pfr_null_face_tests PRIVATE
+        ${LIBS_INCLUDE_DIR} $<TARGET_PROPERTY:freetype,INTERFACE_INCLUDE_DIRECTORIES>)
+    configure_windows_unwind(guest_freetype_pfr_null_face_tests)
+    add_test(NAME guest_freetype_pfr_null_face COMMAND guest_freetype_pfr_null_face_tests)
+    set_tests_properties(guest_freetype_pfr_null_face PROPERTIES TIMEOUT 10)
+    add_test_executable(guest_freetype_pfr_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypePfr.cpp
+        ${LIBS_INCLUDE_DIR}/nid/src/NidCompute.cpp ${LIBS_INCLUDE_DIR}/nid/src/Sha1.cpp)
+    target_include_directories(guest_freetype_pfr_tests PRIVATE ${LIBS_INCLUDE_DIR} ${LIBS_INCLUDE_DIR}/nid/include)
+    target_link_libraries(guest_freetype_pfr_tests PRIVATE freetype ${CMAKE_DL_LIBS})
+    if(WIN32)
+        target_link_libraries(guest_freetype_pfr_tests PRIVATE libc)
+    endif()
+    configure_windows_unwind(guest_freetype_pfr_tests)
+    add_custom_target(guest_freetype_pfr_libraries DEPENDS
+        ${PATCHED_DIR}/libSceFreeType.prx ${PATCHED_DIR}/libSceFreeTypeOptOl.prx ${PATCHED_DIR}/libkernel.prx ${LIBC_PATCHED})
+    add_dependencies(guest_freetype_pfr_tests guest_freetype_pfr_libraries)
+    add_test(NAME guest_freetype_pfr_reference COMMAND guest_freetype_pfr_tests reference)
+    set_tests_properties(guest_freetype_pfr_reference PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_freetype_pfr_reference PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:${UNPATCHED_DIR}")
+    endif()
+    foreach(operation IN ITEMS metrics advance kerning)
+        foreach(mode IN ITEMS raw patched)
+            if(mode STREQUAL "raw")
+                set(pfrDirectory ${UNPATCHED_DIR})
+            else()
+                set(pfrDirectory ${PATCHED_DIR})
+            endif()
+            add_test(NAME guest_freetype_pfr_${operation}_${mode} COMMAND guest_freetype_pfr_tests ${pfrDirectory} ${mode} ${operation})
+            set_tests_properties(guest_freetype_pfr_${operation}_${mode} PROPERTIES TIMEOUT 20)
+            if(WIN32)
+                set_tests_properties(guest_freetype_pfr_${operation}_${mode} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:${pfrDirectory}")
+            endif()
+        endforeach()
+    endforeach()
+endif()
diff --git a/core/libs/prx/libSceFreeTypeOptOl/Export.cpp b/core/libs/prx/libSceFreeTypeOptOl/Export.cpp
index d81f4a5e32..3670e92e25 100644
--- a/core/libs/prx/libSceFreeTypeOptOl/Export.cpp
+++ b/core/libs/prx/libSceFreeTypeOptOl/Export.cpp
@@ -1,10 +1,18 @@
-#include <cstddef>
-#include <cstdint>
-#include "SceTypes.hpp"
-#include "prx/libc/include/General.hpp"
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestPfr.hpp"
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI FT_Get_PFR_Advance_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t index, std::int64_t* advance) {
+    return FreeTypePfrAdvance_nid_no_patch(face, index, advance);
+}
+
+int APS5_VABI FT_Get_PFR_Kerning_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t left, std::uint32_t right, FreeType::GuestVector* vector) {
+    return FreeTypePfrKerning_nid_no_patch(face, left, right, vector);
+}
+
+int APS5_VABI FT_Get_PFR_Metrics_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t* outline, std::uint32_t* metrics, std::int64_t* xScale, std::int64_t* yScale) {
+    return FreeTypePfrMetrics_nid_no_patch(face, outline, metrics, xScale, yScale);
+}
 
 }
diff --git a/core/libs/prx/libSceFreeTypeOptOl/libSceFreeTypeOptOl.hpp b/core/libs/prx/libSceFreeTypeOptOl/libSceFreeTypeOptOl.hpp
new file mode 100644
index 0000000000..736d61af2e
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOptOl/libSceFreeTypeOptOl.hpp
@@ -0,0 +1,2 @@
+#pragma once
+#include "prx/libSceFreeType/include/Api.hpp"
diff --git a/core/libs/prx/libSceFreeTypeOt/CMakeLists.txt b/core/libs/prx/libSceFreeTypeOt/CMakeLists.txt
new file mode 100644
index 0000000000..aca3d5c0df
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOt/CMakeLists.txt
@@ -0,0 +1,3 @@
+add_library(libSceFreeTypeOt SHARED EXCLUDE_FROM_ALL Export.cpp ../libSceFreeType/src/OutlineBorders.cpp)
+target_include_directories(libSceFreeTypeOt PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceFreeTypeOt)
diff --git a/core/libs/prx/libSceFreeTypeOt/Export.cpp b/core/libs/prx/libSceFreeTypeOt/Export.cpp
index d81f4a5e32..c4ec1cd9ca 100644
--- a/core/libs/prx/libSceFreeTypeOt/Export.cpp
+++ b/core/libs/prx/libSceFreeTypeOt/Export.cpp
@@ -5,6 +5,745 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+
+int APS5_VABI sceFreeTypeOtUnknown_UD7IFu7ML2U_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("UD7IFu7ML2U", sceFreeTypeOtUnknown_UD7IFu7ML2U_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2T7lbS_CSzA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2T7lbS+CSzA", sceFreeTypeOtUnknown_2T7lbS_CSzA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_MGEIQsujKaY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("MGEIQsujKaY", sceFreeTypeOtUnknown_MGEIQsujKaY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_mkmgcRnAJog_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("mkmgcRnAJog", sceFreeTypeOtUnknown_mkmgcRnAJog_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_m18bTUNF_0g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("m18bTUNF-0g", sceFreeTypeOtUnknown_m18bTUNF_0g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_vTZ34rw1sfg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("vTZ34rw1sfg", sceFreeTypeOtUnknown_vTZ34rw1sfg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_PvCNusrp9xQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("PvCNusrp9xQ", sceFreeTypeOtUnknown_PvCNusrp9xQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_dlM4ASZdcjk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dlM4ASZdcjk", sceFreeTypeOtUnknown_dlM4ASZdcjk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Ev3BqJ_U1Fg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Ev3BqJ-U1Fg", sceFreeTypeOtUnknown_Ev3BqJ_U1Fg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_ZhtAXOoLNyo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("ZhtAXOoLNyo", sceFreeTypeOtUnknown_ZhtAXOoLNyo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_73vg_nRH68g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("73vg+nRH68g", sceFreeTypeOtUnknown_73vg_nRH68g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_wBKAYO7yEXw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("wBKAYO7yEXw", sceFreeTypeOtUnknown_wBKAYO7yEXw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_nSIux4OQyJM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("nSIux4OQyJM", sceFreeTypeOtUnknown_nSIux4OQyJM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Dr3F3qrSQ2c_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Dr3F3qrSQ2c", sceFreeTypeOtUnknown_Dr3F3qrSQ2c_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_avLzN0tTxLI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("avLzN0tTxLI", sceFreeTypeOtUnknown_avLzN0tTxLI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0rKmI1ZbMAc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0rKmI1ZbMAc", sceFreeTypeOtUnknown_0rKmI1ZbMAc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BBRhYfYBDgU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BBRhYfYBDgU", sceFreeTypeOtUnknown_BBRhYfYBDgU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_c1nbr8oSWlg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("c1nbr8oSWlg", sceFreeTypeOtUnknown_c1nbr8oSWlg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_AVEEb57HhUw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("AVEEb57HhUw", sceFreeTypeOtUnknown_AVEEb57HhUw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_x8y0qzLiYOU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("x8y0qzLiYOU", sceFreeTypeOtUnknown_x8y0qzLiYOU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_VW4GD_TaIUc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("VW4GD-TaIUc", sceFreeTypeOtUnknown_VW4GD_TaIUc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_GiuNQjoj4fs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("GiuNQjoj4fs", sceFreeTypeOtUnknown_GiuNQjoj4fs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_5qqbXOGlHw4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("5qqbXOGlHw4", sceFreeTypeOtUnknown_5qqbXOGlHw4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4LY5pyZ5IQk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4LY5pyZ5IQk", sceFreeTypeOtUnknown_4LY5pyZ5IQk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_zE0V_0aouZ4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("zE0V+0aouZ4", sceFreeTypeOtUnknown_zE0V_0aouZ4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_LsyswTUNTRs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("LsyswTUNTRs", sceFreeTypeOtUnknown_LsyswTUNTRs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_AfL_nqNC5fY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("AfL-nqNC5fY", sceFreeTypeOtUnknown_AfL_nqNC5fY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_WIvTHYs7ZQQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("WIvTHYs7ZQQ", sceFreeTypeOtUnknown_WIvTHYs7ZQQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_yrtsLmTfa48_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("yrtsLmTfa48", sceFreeTypeOtUnknown_yrtsLmTfa48_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_tCMhTh7h8D4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("tCMhTh7h8D4", sceFreeTypeOtUnknown_tCMhTh7h8D4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtNewSize_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("zyezaHweY3U", sceFreeTypeOtNewSize_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_C_PpdS5zris_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("C-PpdS5zris", sceFreeTypeOtUnknown_C_PpdS5zris_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_g8eLxL9VAhU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("g8eLxL9VAhU", sceFreeTypeOtUnknown_g8eLxL9VAhU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_OeNH41MA2Vs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("OeNH41MA2Vs", sceFreeTypeOtUnknown_OeNH41MA2Vs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtOutlineCopy_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Bhm8Injl0KA", sceFreeTypeOtOutlineCopy_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtOutlineDecompose_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++lgV9pRsO4", sceFreeTypeOtOutlineDecompose_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BqGJsJcFYaM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BqGJsJcFYaM", sceFreeTypeOtUnknown_BqGJsJcFYaM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_umIqupy8UU0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("umIqupy8UU0", sceFreeTypeOtUnknown_umIqupy8UU0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_l6Cf9rb9fZQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("l6Cf9rb9fZQ", sceFreeTypeOtUnknown_l6Cf9rb9fZQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BgUMBGvhATU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BgUMBGvhATU", sceFreeTypeOtUnknown_BgUMBGvhATU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0Aal_TIC4so_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0Aal-TIC4so", sceFreeTypeOtUnknown_0Aal_TIC4so_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4RRjK_Wd1lU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4RRjK-Wd1lU", sceFreeTypeOtUnknown_4RRjK_Wd1lU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtOutlineGetOrientation_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("weVsBCT+TTQ", sceFreeTypeOtOutlineGetOrientation_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_QH2emcgeFck_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("QH2emcgeFck", sceFreeTypeOtUnknown_QH2emcgeFck_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_NG7OgYsgcF8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("NG7OgYsgcF8", sceFreeTypeOtUnknown_NG7OgYsgcF8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_9km02mPqPJE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("9km02mPqPJE", sceFreeTypeOtUnknown_9km02mPqPJE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0Lv6K1d47jg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0Lv6K1d47jg", sceFreeTypeOtUnknown_0Lv6K1d47jg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8fAMdZCnewA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8fAMdZCnewA", sceFreeTypeOtUnknown_8fAMdZCnewA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_LsB538_IPrE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("LsB538+IPrE", sceFreeTypeOtUnknown_LsB538_IPrE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_hz_J3hohXW8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("hz-J3hohXW8", sceFreeTypeOtUnknown_hz_J3hohXW8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_KVbmKCGGowg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("KVbmKCGGowg", sceFreeTypeOtUnknown_KVbmKCGGowg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_hF3stKUWbWg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("hF3stKUWbWg", sceFreeTypeOtUnknown_hF3stKUWbWg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_p5GNJaXO2yE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("p5GNJaXO2yE", sceFreeTypeOtUnknown_p5GNJaXO2yE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8cnVx1yH9_I_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8cnVx1yH9-I", sceFreeTypeOtUnknown_8cnVx1yH9_I_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_HVSaZbxYi2s_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("HVSaZbxYi2s", sceFreeTypeOtUnknown_HVSaZbxYi2s_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_qAPXM5DN62Q_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("qAPXM5DN62Q", sceFreeTypeOtUnknown_qAPXM5DN62Q_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_5ipBcLYVc2k_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("5ipBcLYVc2k", sceFreeTypeOtUnknown_5ipBcLYVc2k_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8A0cAU4yBVY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8A0cAU4yBVY", sceFreeTypeOtUnknown_8A0cAU4yBVY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_z9Wsaf34JA4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("z9Wsaf34JA4", sceFreeTypeOtUnknown_z9Wsaf34JA4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtRequestSize_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("PaDk9bdmdhU", sceFreeTypeOtRequestSize_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Z8KG6700sw4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Z8KG6700sw4", sceFreeTypeOtUnknown_Z8KG6700sw4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_uK7vGxAQVxM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("uK7vGxAQVxM", sceFreeTypeOtUnknown_uK7vGxAQVxM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_zetC8Tp1S8w_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("zetC8Tp1S8w", sceFreeTypeOtUnknown_zetC8Tp1S8w_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_DAmwG6U7YIc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("DAmwG6U7YIc", sceFreeTypeOtUnknown_DAmwG6U7YIc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Yu9oXRVmTTo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Yu9oXRVmTTo", sceFreeTypeOtUnknown_Yu9oXRVmTTo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_ihIHD8BTNxI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("ihIHD8BTNxI", sceFreeTypeOtUnknown_ihIHD8BTNxI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_yCEJIsjIOO8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("yCEJIsjIOO8", sceFreeTypeOtUnknown_yCEJIsjIOO8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtSin_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("L1uHkWTazkI", sceFreeTypeOtSin_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_C7N2GuwqTA0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("C7N2GuwqTA0", sceFreeTypeOtUnknown_C7N2GuwqTA0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_JgtSc0g3G6E_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("JgtSc0g3G6E", sceFreeTypeOtUnknown_JgtSc0g3G6E_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_gVf7xRLdWm8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("gVf7xRLdWm8", sceFreeTypeOtUnknown_gVf7xRLdWm8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_FHdeCFVf_f8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("FHdeCFVf-f8", sceFreeTypeOtUnknown_FHdeCFVf_f8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Qmgc0XACzRg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Qmgc0XACzRg", sceFreeTypeOtUnknown_Qmgc0XACzRg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0rGx_oFMLyk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0rGx-oFMLyk", sceFreeTypeOtUnknown_0rGx_oFMLyk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_thA48N_0VwQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("thA48N-0VwQ", sceFreeTypeOtUnknown_thA48N_0VwQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_jl0VxYZb8_o_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("jl0VxYZb8-o", sceFreeTypeOtUnknown_jl0VxYZb8_o_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Er0Lin_u20o_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Er0Lin-u20o", sceFreeTypeOtUnknown_Er0Lin_u20o_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_KHj92a3WDn4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("KHj92a3WDn4", sceFreeTypeOtUnknown_KHj92a3WDn4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_tDssQCH2syY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("tDssQCH2syY", sceFreeTypeOtUnknown_tDssQCH2syY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_dXJK59vXRxs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dXJK59vXRxs", sceFreeTypeOtUnknown_dXJK59vXRxs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BB4gl7SgLdk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BB4gl7SgLdk", sceFreeTypeOtUnknown_BB4gl7SgLdk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Fv8MWCUH8k8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Fv8MWCUH8k8", sceFreeTypeOtUnknown_Fv8MWCUH8k8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_RzgDJTjQst4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("RzgDJTjQst4", sceFreeTypeOtUnknown_RzgDJTjQst4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4yt9cD1qcEI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4yt9cD1qcEI", sceFreeTypeOtUnknown_4yt9cD1qcEI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_u6Xquj1bFwc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("u6Xquj1bFwc", sceFreeTypeOtUnknown_u6Xquj1bFwc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown__Xm1cLEpBec_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("-Xm1cLEpBec", sceFreeTypeOtUnknown__Xm1cLEpBec_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_uDXTnGbAz44_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("uDXTnGbAz44", sceFreeTypeOtUnknown_uDXTnGbAz44_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_iruPsrXCN7U_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("iruPsrXCN7U", sceFreeTypeOtUnknown_iruPsrXCN7U_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_a7RlARfexoo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("a7RlARfexoo", sceFreeTypeOtUnknown_a7RlARfexoo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_jX1zq1i8KfI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("jX1zq1i8KfI", sceFreeTypeOtUnknown_jX1zq1i8KfI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_U_0WKVAePww_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("U+0WKVAePww", sceFreeTypeOtUnknown_U_0WKVAePww_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_dlbnv6Wass8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dlbnv6Wass8", sceFreeTypeOtUnknown_dlbnv6Wass8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_cmd41395g7Y_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("cmd41395g7Y", sceFreeTypeOtUnknown_cmd41395g7Y_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_SX5I_XzH8HI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("SX5I+XzH8HI", sceFreeTypeOtUnknown_SX5I_XzH8HI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Bmi8PdvsM3M_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Bmi8PdvsM3M", sceFreeTypeOtUnknown_Bmi8PdvsM3M_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_jJh4SMt8NFQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("jJh4SMt8NFQ", sceFreeTypeOtUnknown_jJh4SMt8NFQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_1z6bBg1qBfU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("1z6bBg1qBfU", sceFreeTypeOtUnknown_1z6bBg1qBfU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_mF0B64O954g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("mF0B64O954g", sceFreeTypeOtUnknown_mF0B64O954g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_c002A4zTOgA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("c002A4zTOgA", sceFreeTypeOtUnknown_c002A4zTOgA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_mcT796Qgj_g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("mcT796Qgj+g", sceFreeTypeOtUnknown_mcT796Qgj_g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_b5gZp_r3WWI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("b5gZp-r3WWI", sceFreeTypeOtUnknown_b5gZp_r3WWI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_S_n0Md8Rjfw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("S+n0Md8Rjfw", sceFreeTypeOtUnknown_S_n0Md8Rjfw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_6a1p3QgXvo0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("6a1p3QgXvo0", sceFreeTypeOtUnknown_6a1p3QgXvo0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_JFSCOXTEvfg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("JFSCOXTEvfg", sceFreeTypeOtUnknown_JFSCOXTEvfg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_xejRyEbsLcw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("xejRyEbsLcw", sceFreeTypeOtUnknown_xejRyEbsLcw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_R1mZutnlTiM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("R1mZutnlTiM", sceFreeTypeOtUnknown_R1mZutnlTiM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4J4Baf8ana8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4J4Baf8ana8", sceFreeTypeOtUnknown_4J4Baf8ana8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Az4H9FlfxCA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Az4H9FlfxCA", sceFreeTypeOtUnknown_Az4H9FlfxCA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_xj3tNJptfLI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("xj3tNJptfLI", sceFreeTypeOtUnknown_xj3tNJptfLI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_TPKhRt1QIeE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("TPKhRt1QIeE", sceFreeTypeOtUnknown_TPKhRt1QIeE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_6_yXRlVrjbc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("6+yXRlVrjbc", sceFreeTypeOtUnknown_6_yXRlVrjbc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown__RLa_6fbshA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+RLa-6fbshA", sceFreeTypeOtUnknown__RLa_6fbshA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_pBqh_Uh_gns_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("pBqh-Uh-gns", sceFreeTypeOtUnknown_pBqh_Uh_gns_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2rcvKZfm5rI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2rcvKZfm5rI", sceFreeTypeOtUnknown_2rcvKZfm5rI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_7cIS2cFG3PE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("7cIS2cFG3PE", sceFreeTypeOtUnknown_7cIS2cFG3PE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_LfyUi_LkdCk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("LfyUi-LkdCk", sceFreeTypeOtUnknown_LfyUi_LkdCk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_rzIWh7FJnmU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("rzIWh7FJnmU", sceFreeTypeOtUnknown_rzIWh7FJnmU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_cKndiZnt0EA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("cKndiZnt0EA", sceFreeTypeOtUnknown_cKndiZnt0EA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_eqGCaeizvWM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("eqGCaeizvWM", sceFreeTypeOtUnknown_eqGCaeizvWM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_RvFx7dv9ThU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("RvFx7dv9ThU", sceFreeTypeOtUnknown_RvFx7dv9ThU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Po8kyd3DlIw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Po8kyd3DlIw", sceFreeTypeOtUnknown_Po8kyd3DlIw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_B3uU5aDZn94_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("B3uU5aDZn94", sceFreeTypeOtUnknown_B3uU5aDZn94_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtTan_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dojyaLKzKN0", sceFreeTypeOtTan_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_08_mhD_AAds_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("08-mhD-AAds", sceFreeTypeOtUnknown_08_mhD_AAds_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_64XMq6sDxUo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("64XMq6sDxUo", sceFreeTypeOtUnknown_64XMq6sDxUo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4xG87W9dTSg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4xG87W9dTSg", sceFreeTypeOtUnknown_4xG87W9dTSg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4_SScYDT5Pg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4+SScYDT5Pg", sceFreeTypeOtUnknown_4_SScYDT5Pg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2rmvbvOCyjY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2rmvbvOCyjY", sceFreeTypeOtUnknown_2rmvbvOCyjY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_1jmC2QcpRl0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("1jmC2QcpRl0", sceFreeTypeOtUnknown_1jmC2QcpRl0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_HMcNe70D9TI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("HMcNe70D9TI", sceFreeTypeOtUnknown_HMcNe70D9TI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_6wJwUIVwAxg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("6wJwUIVwAxg", sceFreeTypeOtUnknown_6wJwUIVwAxg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_PrZtZyFwM6c_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("PrZtZyFwM6c", sceFreeTypeOtUnknown_PrZtZyFwM6c_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtVectorUnit_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("3WpTQrvGUcU", sceFreeTypeOtVectorUnit_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_P6WOAeb0lJ8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("P6WOAeb0lJ8", sceFreeTypeOtUnknown_P6WOAeb0lJ8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_XGVABnpNksQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("XGVABnpNksQ", sceFreeTypeOtUnknown_XGVABnpNksQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Ln9I6YfmYJU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Ln9I6YfmYJU", sceFreeTypeOtUnknown_Ln9I6YfmYJU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_7cVMwHmN308_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("7cVMwHmN308", sceFreeTypeOtUnknown_7cVMwHmN308_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_AEU2tkjdZ2w_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("AEU2tkjdZ2w", sceFreeTypeOtUnknown_AEU2tkjdZ2w_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2lSRg9FfIOY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2lSRg9FfIOY", sceFreeTypeOtUnknown_2lSRg9FfIOY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_fPrLu1YGOaw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("fPrLu1YGOaw", sceFreeTypeOtUnknown_fPrLu1YGOaw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_t3vCgnT5YL0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("t3vCgnT5YL0", sceFreeTypeOtUnknown_t3vCgnT5YL0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8bkQ_YRnpOE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8bkQ+YRnpOE", sceFreeTypeOtUnknown_8bkQ_YRnpOE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_q4qhGebYuGI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("q4qhGebYuGI", sceFreeTypeOtUnknown_q4qhGebYuGI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_ni_K_leoQNg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("ni-K-leoQNg", sceFreeTypeOtUnknown_ni_K_leoQNg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_XfcgJB6V2a0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("XfcgJB6V2a0", sceFreeTypeOtUnknown_XfcgJB6V2a0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_TWzf5iykiGw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("TWzf5iykiGw", sceFreeTypeOtUnknown_TWzf5iykiGw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown__b4iVKArt94_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("-b4iVKArt94", sceFreeTypeOtUnknown__b4iVKArt94_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_uSNqxrARpEQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("uSNqxrARpEQ", sceFreeTypeOtUnknown_uSNqxrARpEQ_nid_no_patch);
 
 }
diff --git a/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp b/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp
new file mode 100644
index 0000000000..e1970ef93b
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFreeType/include/Api.hpp"
diff --git a/core/libs/prx/libSceFsInternalForVsh/Export.cpp b/core/libs/prx/libSceFsInternalForVsh/Export.cpp
index 4a393cfbb7..e98aa4a828 100644
--- a/core/libs/prx/libSceFsInternalForVsh/Export.cpp
+++ b/core/libs/prx/libSceFsInternalForVsh/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFsInternalForVsh/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -211,13 +212,11 @@ int APS5_VABI sceFsDrfsResumeSocket() {
 }
 
 int APS5_VABI sceFsErriCtl() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x8002002d);
 }
 
 int APS5_VABI sceFsErriGetState() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x8002002d);
 }
 
 int APS5_VABI sceFsExfatMkfsExternalHdd() {
diff --git a/core/libs/prx/libSceFsInternalForVsh/include/Api.hpp b/core/libs/prx/libSceFsInternalForVsh/include/Api.hpp
new file mode 100644
index 0000000000..15f7c8533c
--- /dev/null
+++ b/core/libs/prx/libSceFsInternalForVsh/include/Api.hpp
@@ -0,0 +1,184 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceBdSchedCancelBackgroundCopyRequest();
+int APS5_VABI sceBdSchedCancelPrioritizedBackgroundCopyRequest();
+int APS5_VABI sceBdSchedConfigure();
+int APS5_VABI sceBdSchedConfigure2();
+int APS5_VABI sceBdSchedDeconfigure();
+int APS5_VABI sceBdSchedGetBackgroundCopyRequest();
+int APS5_VABI sceBdSchedGetExtentMap();
+int APS5_VABI sceBdSchedGetPrioritizedBackgroundCopyRequest();
+int APS5_VABI sceBdSchedGetState();
+int APS5_VABI sceBdSchedSetBackgroundCopyRequest();
+int APS5_VABI sceBdSchedSetDiscIdentity();
+int APS5_VABI sceBdSchedSetPrioritizedBackgroundCopyRequest();
+int APS5_VABI sceBdSchedStartGame();
+int APS5_VABI sceBdSchedStartRipping();
+int APS5_VABI sceBdSchedStopScheduling();
+int APS5_VABI sceFsBfsCheckCleanFlag();
+int APS5_VABI sceFsBindApplication();
+int APS5_VABI sceFsBindPackages();
+int APS5_VABI sceFsCheckFormat();
+int APS5_VABI sceFsCheckSingleUser();
+int APS5_VABI sceFsCreateExfatPartition();
+int APS5_VABI sceFsCreatePfsSaveDataImage();
+int APS5_VABI sceFsCreatePfsTrophyDataImage();
+int APS5_VABI sceFsCreatePprPfsTrophyDataImage();
+int APS5_VABI sceFsDeviceAlignedPread();
+int APS5_VABI sceFsDeviceAlignedPwrite();
+int APS5_VABI sceFsDevpfsA53IocGetBuildMetadataStatus();
+int APS5_VABI sceFsDevpfsCancelWaitEvent();
+int APS5_VABI sceFsDevpfsCreateForVSH();
+int APS5_VABI sceFsDevpfsDeleteForVSH();
+int APS5_VABI sceFsDevpfsDeregisterEvent();
+int APS5_VABI sceFsDevpfsEventComplete();
+int APS5_VABI sceFsDevpfsEventResponseComplete();
+int APS5_VABI sceFsDevpfsFetchMetaEntry();
+int APS5_VABI sceFsDevpfsFsck();
+int APS5_VABI sceFsDevpfsInitFetchMetaEntryCtx();
+int APS5_VABI sceFsDevpfsMountForFSMP();
+int APS5_VABI sceFsDevpfsRegisterEvent();
+int APS5_VABI sceFsDevpfsWaitEvent();
+int APS5_VABI sceFsDrfsRegisterSocket();
+int APS5_VABI sceFsDrfsResumeSocket();
+int APS5_VABI sceFsErriCtl();
+int APS5_VABI sceFsErriGetState();
+int APS5_VABI sceFsExfatMkfsExternalHdd();
+int APS5_VABI sceFsExfatfsMkfs();
+int APS5_VABI sceFsExtUSBSchedDestroy();
+int APS5_VABI sceFsExtUSBSchedInsert();
+int APS5_VABI sceFsExtUSBSchedInsertForHDD();
+int APS5_VABI sceFsExternalStorageDeconfigure();
+int APS5_VABI sceFsExternalStorageGetRawDevice();
+int APS5_VABI sceFsExternalStorageInitialize();
+int APS5_VABI sceFsExternalStorageVerifyMetadata();
+int APS5_VABI sceFsGetAttribute();
+int APS5_VABI sceFsGetClusterStatistics();
+int APS5_VABI sceFsGetDeviceSectorsize();
+int APS5_VABI sceFsGetFsMetadata();
+int APS5_VABI sceFsGetFsMetadataWithProgress();
+int APS5_VABI sceFsGetSmrInfo();
+int APS5_VABI sceFsGschedCtl();
+int APS5_VABI sceFsISSchedConfigCurrentThread();
+int APS5_VABI sceFsISSchedConfigDescriptor();
+int APS5_VABI sceFsISSchedConfigThread();
+int APS5_VABI sceFsISSchedMapStat();
+int APS5_VABI sceFsISSchedResultToPriority();
+int APS5_VABI sceFsISSchedResultToSlot();
+int APS5_VABI sceFsISSchedStatCurrentThread();
+int APS5_VABI sceFsISSchedStatDescriptor();
+int APS5_VABI sceFsISSchedStatThread();
+int APS5_VABI sceFsISSchedUnmapStat();
+int APS5_VABI sceFsInitCreatePfsSaveDataOpt();
+int APS5_VABI sceFsInitCreatePfsTrophyDataOpt();
+int APS5_VABI sceFsInitMountDownloadDataOpt();
+int APS5_VABI sceFsInitMountGamePkgOpt();
+int APS5_VABI sceFsInitMountLwfsCompatOpt();
+int APS5_VABI sceFsInitMountLwfsOpt();
+int APS5_VABI sceFsInitMountPprPkgOpt();
+int APS5_VABI sceFsInitMountSaveDataOpt();
+int APS5_VABI sceFsInitMountTrophyDataOpt();
+int APS5_VABI sceFsInitUmountDownloadDataOpt();
+int APS5_VABI sceFsInitUmountGamePkgOpt();
+int APS5_VABI sceFsInitUmountLwfsCompatOpt();
+int APS5_VABI sceFsInitUmountLwfsOpt();
+int APS5_VABI sceFsInitUmountPprPkgOpt();
+int APS5_VABI sceFsInitUmountSaveDataOpt();
+int APS5_VABI sceFsInitUmountTrophyDataOpt();
+int APS5_VABI sceFsInitWorkspaceFileMetadataParam();
+int APS5_VABI sceFsLvdAttach();
+int APS5_VABI sceFsLvdAttach2();
+int APS5_VABI sceFsLvdAttachPartiallyCryptedDownloadData();
+int APS5_VABI sceFsLvdAttachSingleDefaultImage();
+int APS5_VABI sceFsLvdAttachSingleImage();
+int APS5_VABI sceFsLvdDetach();
+int APS5_VABI sceFsLvdDisableLayer();
+int APS5_VABI sceFsLvdEnableLayer();
+int APS5_VABI sceFsLvdSetDiscIdentity();
+int APS5_VABI sceFsLvdWaitResumed();
+int APS5_VABI sceFsMlfsMount();
+int APS5_VABI sceFsMlfsMountWithFlags();
+int APS5_VABI sceFsMlfsUmount();
+int APS5_VABI sceFsMountDownloadData();
+int APS5_VABI sceFsMountGamePkg();
+int APS5_VABI sceFsMountLwfs();
+int APS5_VABI sceFsMountLwfsCompat();
+int APS5_VABI sceFsMountPartiallyCryptedDownloadData();
+int APS5_VABI sceFsMountPprPkg();
+int APS5_VABI sceFsMountSaveData();
+int APS5_VABI sceFsMountTrophyData();
+int APS5_VABI sceFsNsfsAddOverlayToNamespace();
+int APS5_VABI sceFsNsfsMountWithFlags();
+int APS5_VABI sceFsNsfsSetGlobalExclude();
+int APS5_VABI sceFsNsfsUmount();
+int APS5_VABI sceFsPartitionTrim();
+int APS5_VABI sceFsReserveCluster();
+int APS5_VABI sceFsSetAttribute();
+int APS5_VABI sceFsSetClusterCacheSize();
+int APS5_VABI sceFsSetFileReservedTotal();
+int APS5_VABI sceFsSetSystemReserveSize();
+int APS5_VABI sceFsSetWorkspaceFileHash();
+int APS5_VABI sceFsStatWorkspace();
+int APS5_VABI sceFsSysStorageGetStatus();
+int APS5_VABI sceFsTransactionCancel();
+int APS5_VABI sceFsTransactionSaveDataInitMountOpt();
+int APS5_VABI sceFsTransactionSaveDataMount();
+int APS5_VABI sceFsTransactionStart();
+int APS5_VABI sceFsTrophyImageError();
+int APS5_VABI sceFsUfsAllocateAdditionalContents();
+int APS5_VABI sceFsUfsAllocateAligned();
+int APS5_VABI sceFsUfsAllocateDownloadData();
+int APS5_VABI sceFsUfsAllocateGameImage();
+int APS5_VABI sceFsUfsAllocatePatchImage();
+int APS5_VABI sceFsUfsAllocateSaveData();
+int APS5_VABI sceFsUfsAllocateTrophyData();
+int APS5_VABI sceFsUfsCheckCleanFlag();
+int APS5_VABI sceFsUfsCheckFixedCylinderGroupSize();
+int APS5_VABI sceFsUfsCollectTelemetry();
+int APS5_VABI sceFsUfsCollectTelemetry2();
+int APS5_VABI sceFsUfsDirectWrite();
+int APS5_VABI sceFsUfsEstimateZoneCapacityForUser();
+int APS5_VABI sceFsUfsExtendFile();
+int APS5_VABI sceFsUfsFsck();
+int APS5_VABI sceFsUfsFsckWithMM();
+int APS5_VABI sceFsUfsGetExtentMap();
+int APS5_VABI sceFsUfsGrowLwfs();
+int APS5_VABI sceFsUfsGrowfs();
+int APS5_VABI sceFsUfsHideBlocksFromUser();
+int APS5_VABI sceFsUfsInitalizeSparseFile();
+int APS5_VABI sceFsUfsLargewriteFsck();
+int APS5_VABI sceFsUfsLargewriteFsckWithMM();
+int APS5_VABI sceFsUfsMkLwfs();
+int APS5_VABI sceFsUfsMkfs();
+int APS5_VABI sceFsUfsMkfsForExternalHDD();
+int APS5_VABI sceFsUfsMkfsForSystem();
+int APS5_VABI sceFsUfsMkfsWithFixedCylinderGroupSize();
+int APS5_VABI sceFsUfsReallocateSparseFile();
+int APS5_VABI sceFsUfsRecryptBlocks();
+int APS5_VABI sceFsUfsRecryptGetState();
+int APS5_VABI sceFsUfsRecryptIsUnfinished();
+int APS5_VABI sceFsUfsRecryptSyncMetadata();
+int APS5_VABI sceFsUfsSeekHoleInFile();
+int APS5_VABI sceFsUfsStopOperation();
+int APS5_VABI sceFsUmountDownloadData();
+int APS5_VABI sceFsUmountGamePkg();
+int APS5_VABI sceFsUmountLwfs();
+int APS5_VABI sceFsUmountLwfsCompat();
+int APS5_VABI sceFsUmountSaveData();
+int APS5_VABI sceFsUmountTrophyData();
+int APS5_VABI sceFsUmountWorkspace();
+int APS5_VABI sceFsUnbindApplication();
+int APS5_VABI sceFsUnbindPackages();
+int APS5_VABI sceFsWsCreate();
+int APS5_VABI sceFsWsDelete();
+int APS5_VABI sceFsWsFetchFileMetadata();
+int APS5_VABI sceFsWsFsck();
+int APS5_VABI sceFsWsGetStatus();
+int APS5_VABI sceFsWsMount();
+int APS5_VABI sceFsWsUmount();
+
+}
diff --git a/core/libs/prx/libSceFsInternalForVsh/libSceFsInternalForVsh.hpp b/core/libs/prx/libSceFsInternalForVsh/libSceFsInternalForVsh.hpp
new file mode 100644
index 0000000000..bba8925b6e
--- /dev/null
+++ b/core/libs/prx/libSceFsInternalForVsh/libSceFsInternalForVsh.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFsInternalForVsh/include/Api.hpp"
diff --git a/core/libs/prx/libSceGLSlimVSH/libSceGLSlimVSH.hpp b/core/libs/prx/libSceGLSlimVSH/libSceGLSlimVSH.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGLSlimVSH/libSceGLSlimVSH.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGameCustomDataDialog/Export.cpp b/core/libs/prx/libSceGameCustomDataDialog/Export.cpp
index 594d4adfac..48093e841d 100644
--- a/core/libs/prx/libSceGameCustomDataDialog/Export.cpp
+++ b/core/libs/prx/libSceGameCustomDataDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGameCustomDataDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceGameCustomDataDialog/include/Api.hpp b/core/libs/prx/libSceGameCustomDataDialog/include/Api.hpp
new file mode 100644
index 0000000000..20d28826e7
--- /dev/null
+++ b/core/libs/prx/libSceGameCustomDataDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGameCustomDataDialogInitialize(void);
+int APS5_VABI sceGameCustomDataDialogOpenA(const void* param);
+int APS5_VABI sceGameCustomDataDialogUpdateStatus(void);
+int APS5_VABI sceGameCustomDataDialogGetStatus(void);
+int APS5_VABI sceGameCustomDataDialogGetResultA(void* result);
+int APS5_VABI sceGameCustomDataDialogClose(void);
+int APS5_VABI sceGameCustomDataDialogTerminate(void);
+int APS5_VABI sceGameCustomDataDialogGetResult();
+int APS5_VABI sceGameCustomDataDialogOpen();
+
+}
diff --git a/core/libs/prx/libSceGameCustomDataDialog/libSceGameCustomDataDialog.hpp b/core/libs/prx/libSceGameCustomDataDialog/libSceGameCustomDataDialog.hpp
new file mode 100644
index 0000000000..c5267d6b1a
--- /dev/null
+++ b/core/libs/prx/libSceGameCustomDataDialog/libSceGameCustomDataDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGameCustomDataDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceGameLiveStreaming/Export.cpp b/core/libs/prx/libSceGameLiveStreaming/Export.cpp
index 891a864574..d9e1f9a227 100644
--- a/core/libs/prx/libSceGameLiveStreaming/Export.cpp
+++ b/core/libs/prx/libSceGameLiveStreaming/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGameLiveStreaming/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -15,18 +16,6 @@ static constexpr int ErrorAlreadyInitialized = static_cast<int>(0x80A00003);
 static constexpr int ErrorNotInitialized = static_cast<int>(0x80A00004);
 static constexpr std::size_t ProgramInfoSize = 0x134C;
 
-struct GameLiveStreamingProgramInfo;
-
-struct GameLiveStreamingStatus2 {
-    std::int32_t userId;
-    bool isOnAir;
-    std::uint8_t align[3];
-    std::uint32_t spectatorCounts;
-    std::uint32_t textMessageCounts;
-    std::uint32_t commandMessageCounts;
-    std::uint32_t broadcastVideoResolution;
-    std::uint8_t reserved[48];
-};
 static_assert(sizeof(GameLiveStreamingStatus2) == 72);
 
 extern "C" {
@@ -108,7 +97,7 @@ int APS5_VABI sceGameLiveStreamingSetMaxBitrate(void) {
     return 0;
 }
 
-int APS5_VABI sceGameLiveStreamingGetCurrentStatus(void) {
+int APS5_VABI sceGameLiveStreamingGetCurrentStatus(GameLiveStreamingStatus* status) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceGameLiveStreaming/include/Api.hpp b/core/libs/prx/libSceGameLiveStreaming/include/Api.hpp
new file mode 100644
index 0000000000..28b744e492
--- /dev/null
+++ b/core/libs/prx/libSceGameLiveStreaming/include/Api.hpp
@@ -0,0 +1,78 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+
+struct GameLiveStreamingProgramInfo;
+
+struct GameLiveStreamingStatus {
+    std::uint8_t opaque00[12];
+    std::uint8_t reserved[60];
+};
+
+static_assert(offsetof(GameLiveStreamingStatus, reserved) == 0x0C);
+static_assert(sizeof(GameLiveStreamingStatus) == 0x48);
+
+struct GameLiveStreamingStatus2 {
+    std::int32_t userId;
+    bool isOnAir;
+    std::uint8_t align[3];
+    std::uint32_t spectatorCounts;
+    std::uint32_t textMessageCounts;
+    std::uint32_t commandMessageCounts;
+    std::uint32_t broadcastVideoResolution;
+    std::uint8_t reserved[48];
+};
+
+extern "C" {
+
+int APS5_VABI sceGameLiveStreamingInitialize(size_t heapSize);
+int APS5_VABI sceGameLiveStreamingTerminate(void);
+int APS5_VABI sceGameLiveStreamingGetCurrentStatus2(GameLiveStreamingStatus2* status);
+int APS5_VABI sceGameLiveStreamingGetProgramInfo(GameLiveStreamingProgramInfo* info);
+int APS5_VABI sceGameLiveStreamingScreenInitialize(void);
+int APS5_VABI sceGameLiveStreamingScreenInitializeSeparateModeParameter(void);
+int APS5_VABI sceGameLiveStreamingScreenTerminate(void);
+int APS5_VABI sceGameLiveStreamingScreenCloseSeparateMode(void);
+int APS5_VABI sceGameLiveStreamingScreenConfigureSeparateMode(void);
+int APS5_VABI sceGameLiveStreamingScreenOpenSeparateMode(void);
+int APS5_VABI sceGameLiveStreamingScreenSetMode(void);
+int APS5_VABI sceGameLiveStreamingPermitLiveStreaming(void);
+int APS5_VABI sceGameLiveStreamingSetMaxBitrate(void);
+int APS5_VABI sceGameLiveStreamingGetCurrentStatus(GameLiveStreamingStatus* status);
+int APS5_VABI sceGameLiveStreamingEnableSocialFeedback(void);
+int APS5_VABI sceGameLiveStreamingGetSocialFeedbackMessagesCount(void);
+int APS5_VABI sceGameLiveStreamingGetSocialFeedbackMessages(void);
+int APS5_VABI sceGameLiveStreamingPermitServerSideRecording(void);
+int APS5_VABI sceGameLiveStreamingSetMetadata(void);
+int APS5_VABI sceGameLiveStreamingSetSpoilerTag(void);
+int APS5_VABI sceGameLiveStreamingClearSpoilerTag(void);
+int APS5_VABI sceGameLiveStreamingSetPresetSocialFeedbackCommands(void);
+int APS5_VABI sceGameLiveStreamingClearPresetSocialFeedbackCommands(void);
+int APS5_VABI sceGameLiveStreamingSetPresetSocialFeedbackCommandsDescription(void);
+int APS5_VABI sceGameLiveStreamingClearSocialFeedbackMessages(void);
+int APS5_VABI sceGameLiveStreamingPostSocialMessage(void);
+int APS5_VABI sceGameLiveStreamingSetCameraFrameSetting(void);
+int APS5_VABI sceGameLiveStreamingSetServiceProviderPermission(void);
+int APS5_VABI sceGameLiveStreamingSetDefaultServiceProviderPermission(void);
+int APS5_VABI sceGameLiveStreamingSetInvitationSessionId(void);
+int APS5_VABI sceGameLiveStreamingStartGenerateStandbyScreenResource(void);
+int APS5_VABI sceGameLiveStreamingStopGenerateStandbyScreenResource(void);
+int APS5_VABI sceGameLiveStreamingRegisterCallback(void);
+int APS5_VABI sceGameLiveStreamingUnregisterCallback(void);
+int APS5_VABI sceGameLiveStreamingCheckCallback(void);
+int APS5_VABI sceGameLiveStreamingSetStandbyScreenResource(void);
+int APS5_VABI sceGameLiveStreamingGetCurrentBroadcastScreenLayout(void);
+int APS5_VABI sceGameLiveStreamingLaunchLiveViewer(void);
+int APS5_VABI sceGameLiveStreamingLaunchLiveViewerA(void);
+int APS5_VABI sceGameLiveStreamingSetGuardAreas(void);
+int APS5_VABI sceGameLiveStreamingStartSocialFeedbackMessageFiltering(void);
+int APS5_VABI sceGameLiveStreamingStopSocialFeedbackMessageFiltering(void);
+int APS5_VABI sceGameLiveStreamingApplySocialFeedbackMessageFilter(void);
+int APS5_VABI sceGameLiveStreamingSetLinkCommentPreset(void);
+int APS5_VABI sceGameLiveStreamingStartDebugBroadcast(void);
+int APS5_VABI sceGameLiveStreamingStopDebugBroadcast(void);
+int APS5_VABI sceGameLiveStreamingEnableLiveStreaming(bool isEnableLiveStreaming);
+
+}
diff --git a/core/libs/prx/libSceGameLiveStreaming/libSceGameLiveStreaming.hpp b/core/libs/prx/libSceGameLiveStreaming/libSceGameLiveStreaming.hpp
new file mode 100644
index 0000000000..65b14e5bdf
--- /dev/null
+++ b/core/libs/prx/libSceGameLiveStreaming/libSceGameLiveStreaming.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGameLiveStreaming/include/Api.hpp"
diff --git a/core/libs/prx/libSceGameUpdate/Export.cpp b/core/libs/prx/libSceGameUpdate/Export.cpp
index f8527db000..0e3ef3835e 100644
--- a/core/libs/prx/libSceGameUpdate/Export.cpp
+++ b/core/libs/prx/libSceGameUpdate/Export.cpp
@@ -1,6 +1,9 @@
+#include "prx/libSceGameUpdate/include/Api.hpp"
+#include <array>
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <mutex>
 #include <stdexcept>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
@@ -10,20 +13,58 @@ static constexpr int SCE_GAME_UPDATE_ERROR_ALREADY_INITIALIZED = static_cast<int
 static constexpr int SCE_GAME_UPDATE_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80412803);
 static constexpr int SCE_GAME_UPDATE_ERROR_INVALID_SIZE = static_cast<int>(0x80412804);
 static constexpr int SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND = static_cast<int>(0x80412805);
+static constexpr int SCE_GAME_UPDATE_ERROR_TOO_MANY_REQUESTS = static_cast<int>(0x80412806);
+static constexpr int SCE_GAME_UPDATE_ERROR_ABORTED = static_cast<int>(0x80412807);
+static constexpr int FIRST_REQUEST_ID = 0x20000000;
+static constexpr int LAST_REQUEST_ID = 0x2FFFFFFF;
 
 static_assert(sizeof(GameUpdateCheckParam) == 0x30);
 static_assert(sizeof(GameUpdateCheckResult) == 0x30);
 
-static std::atomic<bool> initialized{false};
+struct Request {
+    int id;
+    bool aborted;
+};
 
-static int checkRequestId(int requestId) {
+static std::mutex stateMutex;
+static bool initialized = false;
+static int nextRequestId = FIRST_REQUEST_ID;
+static std::array<Request, 8> requests{};
+
+static Request* findRequest(int requestId) {
+    for (Request& request : requests) {
+        if (request.id != 0 && request.id == requestId) {
+            return &request;
+        }
+    }
+    return nullptr;
+}
+
+static int followingRequestId(int requestId) {
+    return requestId == LAST_REQUEST_ID ? FIRST_REQUEST_ID : requestId + 1;
+}
+
+static int takeRequestId() {
+    int requestId = nextRequestId;
+    while (findRequest(requestId) != nullptr) {
+        requestId = followingRequestId(requestId);
+    }
+    nextRequestId = followingRequestId(requestId);
+    return requestId;
+}
+
+static int checkRequestId(int requestId, Request** request) {
     if (requestId <= 0) {
         return SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND;
     }
-    if (!initialized.load()) {
+    if (!initialized) {
         return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
     }
-    return SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND;
+    *request = findRequest(requestId);
+    if (*request == nullptr) {
+        return SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND;
+    }
+    return 0;
 }
 
 static bool hasNonZeroReserved(const GameUpdateCheckParam* param) {
@@ -38,7 +79,13 @@ static bool hasNonZeroReserved(const GameUpdateCheckParam* param) {
 extern "C" {
 
 int APS5_VABI sceGameUpdateAbortRequest(int requestId) {
-    return checkRequestId(requestId);
+    std::lock_guard lock(stateMutex);
+    Request* request = nullptr;
+    if (int error = checkRequestId(requestId, &request); error != 0) {
+        return error;
+    }
+    request->aborted = true;
+    return 0;
 }
 
 int APS5_VABI sceGameUpdateCheck(int requestId, const GameUpdateCheckParam* param, GameUpdateCheckResult* result) {
@@ -54,18 +101,43 @@ int APS5_VABI sceGameUpdateCheck(int requestId, const GameUpdateCheckParam* para
     if (param->option != 0 || hasNonZeroReserved(param)) {
         return SCE_GAME_UPDATE_ERROR_INVALID_ARGUMENT;
     }
-    return checkRequestId(requestId);
+    std::lock_guard lock(stateMutex);
+    Request* request = nullptr;
+    if (int error = checkRequestId(requestId, &request); error != 0) {
+        return error;
+    }
+    if (request->aborted) {
+        return SCE_GAME_UPDATE_ERROR_ABORTED;
+    }
+    result->found = false;
+    result->addcont_found = false;
+    return 0;
 }
 
 int APS5_VABI sceGameUpdateCreateRequest(void) {
-    if (!initialized.load()) {
+    std::lock_guard lock(stateMutex);
+    if (!initialized) {
         return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
     }
-    throw std::runtime_error("sceGameUpdateCreateRequest: patch service request creation is not implemented");
+    for (Request& request : requests) {
+        if (request.id != 0) {
+            continue;
+        }
+        const int requestId = takeRequestId();
+        request = {requestId, false};
+        return requestId;
+    }
+    return SCE_GAME_UPDATE_ERROR_TOO_MANY_REQUESTS;
 }
 
 int APS5_VABI sceGameUpdateDeleteRequest(int requestId) {
-    return checkRequestId(requestId);
+    std::lock_guard lock(stateMutex);
+    Request* request = nullptr;
+    if (int error = checkRequestId(requestId, &request); error != 0) {
+        return error;
+    }
+    *request = {};
+    return 0;
 }
 
 int APS5_VABI sceGameUpdateGetAddcontLatestVersion(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, GameUpdateAddcontVersionInfo* info) {
@@ -76,23 +148,31 @@ int APS5_VABI sceGameUpdateGetAddcontLatestVersion(uint32_t serviceLabel, const
     if (entitlementLabel == nullptr) {
         return SCE_GAME_UPDATE_ERROR_INVALID_ARGUMENT;
     }
-    if (!initialized.load()) {
-        return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
+    {
+        std::lock_guard lock(stateMutex);
+        if (!initialized) {
+            return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
+        }
     }
     throw std::runtime_error("sceGameUpdateGetAddcontLatestVersion: entitlement version lookup is not implemented");
 }
 
 int APS5_VABI sceGameUpdateInitialize(void) {
-    if (initialized.exchange(true)) {
+    std::lock_guard lock(stateMutex);
+    if (initialized) {
         return SCE_GAME_UPDATE_ERROR_ALREADY_INITIALIZED;
     }
+    initialized = true;
     return 0;
 }
 
 int APS5_VABI sceGameUpdateTerminate(void) {
-    if (!initialized.exchange(false)) {
+    std::lock_guard lock(stateMutex);
+    if (!initialized) {
         return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
     }
+    initialized = false;
+    requests = {};
     return 0;
 }
 
diff --git a/core/libs/prx/libSceGameUpdate/include/Api.hpp b/core/libs/prx/libSceGameUpdate/include/Api.hpp
new file mode 100644
index 0000000000..2de12ef941
--- /dev/null
+++ b/core/libs/prx/libSceGameUpdate/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGameUpdateAbortRequest(int requestId);
+int APS5_VABI sceGameUpdateCheck(int requestId, const GameUpdateCheckParam* param, GameUpdateCheckResult* result);
+int APS5_VABI sceGameUpdateCreateRequest(void);
+int APS5_VABI sceGameUpdateDeleteRequest(int requestId);
+int APS5_VABI sceGameUpdateGetAddcontLatestVersion(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, GameUpdateAddcontVersionInfo* info);
+int APS5_VABI sceGameUpdateInitialize(void);
+int APS5_VABI sceGameUpdateTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceGameUpdate/libSceGameUpdate.hpp b/core/libs/prx/libSceGameUpdate/libSceGameUpdate.hpp
new file mode 100644
index 0000000000..9807085ba6
--- /dev/null
+++ b/core/libs/prx/libSceGameUpdate/libSceGameUpdate.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGameUpdate/include/Api.hpp"
diff --git a/core/libs/prx/libSceGic/Export.cpp b/core/libs/prx/libSceGic/Export.cpp
index 6fff8198ce..2c4656fad6 100644
--- a/core/libs/prx/libSceGic/Export.cpp
+++ b/core/libs/prx/libSceGic/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGic/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceGic/include/Api.hpp b/core/libs/prx/libSceGic/include/Api.hpp
new file mode 100644
index 0000000000..889405a588
--- /dev/null
+++ b/core/libs/prx/libSceGic/include/Api.hpp
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGicGetValue();
+
+}
diff --git a/core/libs/prx/libSceGic/libSceGic.hpp b/core/libs/prx/libSceGic/libSceGic.hpp
new file mode 100644
index 0000000000..1f60bb76a8
--- /dev/null
+++ b/core/libs/prx/libSceGic/libSceGic.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGic/include/Api.hpp"
diff --git a/core/libs/prx/libSceGifParser/libSceGifParser.hpp b/core/libs/prx/libSceGifParser/libSceGifParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGifParser/libSceGifParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGnmDriverCompat1/libSceGnmDriverCompat1.hpp b/core/libs/prx/libSceGnmDriverCompat1/libSceGnmDriverCompat1.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverCompat1/libSceGnmDriverCompat1.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp b/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp
index b817e55c45..b09d2a8a87 100644
--- a/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp
@@ -1,9 +1,12 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
 #include <cstdint>
 #include <algorithm>
 #include <cstddef>
+#include <initializer_list>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceGnmDriverForNeoMode/include/InitSequences.hpp"
+#include "prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp"
 
 namespace {
 
@@ -27,6 +30,23 @@ int WriteContextState(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t p
     return static_cast<int>(packetWords);
 }
 
+constexpr std::uint32_t OpSetContextReg = 0x69;
+constexpr std::uint32_t OpSetShReg = 0x76;
+
+std::uint32_t* EmitPacket(std::uint32_t* at, std::uint32_t opcode, std::initializer_list<std::uint32_t> body) {
+    *at++ = 0xc0000000u | ((static_cast<std::uint32_t>(body.size()) - 1) << 16) | (opcode << 8);
+    for (const auto word : body) *at++ = word;
+    return at;
+}
+
+std::uint32_t AddressLo(const void* code) {
+    return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(code) >> 8);
+}
+
+std::uint32_t AddressHi(const void* code) {
+    return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(code) >> 40);
+}
+
 constexpr int Failure = static_cast<int>(0x8EEE00FFu);
 constexpr int NoInterface = static_cast<int>(0x80000000u);
 constexpr int ValidationNotEnabled = static_cast<int>(0x80D13FFFu);
@@ -69,13 +89,25 @@ bool IndexedIndirectStage(std::uint32_t stage) {
 constexpr std::uint32_t OpSetUconfigReg = 0x79;
 constexpr std::uint32_t IaMultiVgtParam = 0x40000258u;
 
+std::uint32_t* UpdatePsRegisters(std::uint32_t* cmdbuf, const std::uint32_t* regs) {
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {10, regs[2], regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e01c4u, regs[4], regs[5]});
+    at = EmitPacket(at, OpNop, {0xc01e01b3u, regs[6], regs[7]});
+    at = EmitPacket(at, OpNop, {0xc01e01b6u, regs[8]});
+    at = EmitPacket(at, OpNop, {0xc01e01b8u, regs[9]});
+    at = EmitPacket(at, OpNop, {0xc01e0203u, regs[10]});
+    return EmitPacket(at, OpNop, {0xc01e008fu, regs[11]});
+}
+
 } // namespace
 
 extern "C" {
 
-int APS5_VABI sceGnmBeginWorkload(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmBeginWorkload(std::uint32_t stream, std::uint64_t* workload) {
+    if (!workload) return 3;
+    *workload = stream < 0x10 ? 1 : 0;
+    return stream < 0x10 ? 0 : 1;
 }
 
 int APS5_VABI sceGnmComputeWaitOnAddress(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t address, std::uint32_t mask, std::uint32_t compare, std::uint32_t reference) {
@@ -103,8 +135,9 @@ int APS5_VABI sceGnmComputeWaitSemaphore(std::uint32_t* cmdbuf, std::uint32_t si
     return 0;
 }
 
-int APS5_VABI sceGnmCreateWorkloadStream(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmCreateWorkloadStream(std::uint64_t name, std::uint32_t* stream) {
+    if (name == 0 || !stream) return 3;
+    *stream = 1;
     return 0;
 }
 
@@ -340,9 +373,9 @@ int APS5_VABI sceGnmDriverTraceInProgress(void) {
     return 0;
 }
 
-int APS5_VABI sceGnmEndWorkload(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmEndWorkload(std::uint64_t workload) {
+    if (workload == 0) return 2;
+    return ((workload >> 56) & 0xff) > 0xf ? 2 : 0;
 }
 
 int APS5_VABI sceGnmFindResources(void) {
@@ -378,8 +411,7 @@ int APS5_VABI sceGnmGetGpuBlockStatus(void) {
 }
 
 int APS5_VABI sceGnmGetGpuCoreClockFrequency(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 911000000;
 }
 
 int APS5_VABI sceGnmGetGpuInfoStatus(void) {
@@ -398,8 +430,7 @@ int APS5_VABI sceGnmGetNumTcaUnits(void) {
 }
 
 int APS5_VABI sceGnmGetOffChipTessellationBufferSize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 0x800000;
 }
 
 int APS5_VABI sceGnmGetOwnerName(void) {
@@ -578,23 +609,65 @@ int APS5_VABI sceGnmSdmaOpen(void) {
     return Failure;
 }
 
-int APS5_VABI sceGnmSetCsShaderWithModifier(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetCsShaderWithModifier(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier) {
+    if (!cmdbuf || size <= 0x18 || !regs || (modifier & 0xfffffc3fu) != 0 || regs[1] != 0) return CommandFailed;
+    const std::uint32_t rsrc1 = modifier == 0 ? regs[2] : (regs[2] & 0xfffffc3fu) | modifier;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x20c, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x212, rsrc1, regs[3]});
+    at = EmitPacket(at, OpSetShReg, {0x207, regs[4], regs[5], regs[6]});
+    Nop(at, 11);
     return 0;
 }
 
-int APS5_VABI sceGnmSetEmbeddedPsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetEmbeddedPsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t) {
+    if (shaderId > 1) return Failure;
+    const bool black = shaderId == 0;
+    const auto* code = black ? GnmNeo::BlackPs.data() : GnmNeo::DepthOnlyPs.data();
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, AddressLo(code), AddressHi(code)});
+    at = EmitPacket(at, OpSetShReg, {10, black ? 0xc0000u : 0x2000u, black ? 4u : 0u});
+    at = EmitPacket(at, OpSetContextReg, {0x1c4, 0, black ? 4u : 2u});
+    at = EmitPacket(at, OpSetContextReg, {0x1b3, 2, 2});
+    at = EmitPacket(at, OpSetContextReg, {0x1b6, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x1b8, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x203, 0x10});
+    at = EmitPacket(at, OpSetContextReg, {0x8f, black ? 0xfu : 3u});
+    at[0] = 0xc00a1000u;
+    at[1] = 0;
     return 0;
 }
 
-int APS5_VABI sceGnmSetEmbeddedVsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetEmbeddedVsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t) {
+    if (shaderId != 0) return Failure;
+    const auto* code = GnmNeo::FullscreenVs.data();
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x48, AddressLo(code), AddressHi(code)});
+    at = EmitPacket(at, OpSetShReg, {0x4a, 0xc0000, 4});
+    at = EmitPacket(at, OpSetContextReg, {0x207, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x1b1, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x1c3, 4});
+    at[0] = 0xc00a1000u;
+    at[1] = 0;
     return 0;
 }
 
-int APS5_VABI sceGnmSetPsShader350(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetPsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size <= 0x27) return CommandFailed;
+    if (!regs) {
+        auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, 0, 0});
+        at = EmitPacket(at, OpSetContextReg, {0x203, 0});
+        at = EmitPacket(at, OpSetContextReg, {0x8f, 0xf});
+        Nop(at, 0x1d);
+        return 0;
+    }
+    if (regs[1] != 0) return CommandFailed;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {10, regs[2], regs[3]});
+    at = EmitPacket(at, OpSetContextReg, {0x1c4, regs[4], regs[5]});
+    at = EmitPacket(at, OpSetContextReg, {0x1b3, regs[6], regs[7]});
+    at = EmitPacket(at, OpSetContextReg, {0x1b6, regs[8]});
+    at = EmitPacket(at, OpSetContextReg, {0x1b8, regs[9]});
+    at = EmitPacket(at, OpSetContextReg, {0x203, regs[10]});
+    at = EmitPacket(at, OpSetContextReg, {0x8f, regs[11]});
+    Nop(at, 11);
     return 0;
 }
 
@@ -659,28 +732,64 @@ int APS5_VABI sceGnmUnregisterResource(void) {
     return Failure;
 }
 
-int APS5_VABI sceGnmUpdateGsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdateGsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size < 0x1d || !regs || regs[1] != 0) return CommandFailed;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x88, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x8a, regs[2], regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e02e5u, regs[4]});
+    at = EmitPacket(at, OpNop, {0xc01e029bu, regs[5]});
+    at = EmitPacket(at, OpNop, {0xc01e02e4u, regs[6]});
+    Nop(at, 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdateHsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdateHsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t lsHsConfig) {
+    if (!cmdbuf || size <= 0x1c || !regs || regs[1] != 0) return CommandFailed;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x108, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x10a, regs[2], regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e0286u, regs[5], regs[6]});
+    at = EmitPacket(at, OpNop, {0xc01e02dbu, regs[4]});
+    at = EmitPacket(at, OpNop, {0xc01e02d6u, lsHsConfig});
+    Nop(at, 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdatePsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdatePsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size <= 0x27) return CommandFailed;
+    if (!regs) {
+        auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, 0, 0});
+        at = EmitPacket(at, OpNop, {0xc01e0203u, 0});
+        Nop(at, 0x20);
+        return 0;
+    }
+    if (regs[1] != 0) return CommandFailed;
+    Nop(UpdatePsRegisters(cmdbuf, regs), 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdatePsShader350(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdatePsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size <= 0x27) return CommandFailed;
+    if (!regs) {
+        auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, 0, 0});
+        at = EmitPacket(at, OpNop, {0xc01e0203u, 0});
+        at = EmitPacket(at, OpSetContextReg, {0x8f, 0xf});
+        Nop(at, 0x1d);
+        return 0;
+    }
+    if (regs[1] != 0) return CommandFailed;
+    Nop(UpdatePsRegisters(cmdbuf, regs), 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdateVsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdateVsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier) {
+    if (!cmdbuf || size <= 0x1c || !regs || (modifier & 0xfcfffc3fu) != 0 || regs[1] != 0) return CommandFailed;
+    const std::uint32_t rsrc1 = modifier == 0 ? regs[2] : (regs[2] & 0xfcfffc3fu) | modifier;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x48, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x4a, rsrc1, regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e0207u, regs[6]});
+    at = EmitPacket(at, OpNop, {0xc01e01b1u, regs[4]});
+    at = EmitPacket(at, OpNop, {0xc01e01c3u, regs[5]});
+    Nop(at, 11);
     return 0;
 }
 
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/include/Api.hpp b/core/libs/prx/libSceGnmDriverForNeoMode/include/Api.hpp
new file mode 100644
index 0000000000..f9ecf8db4c
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/include/Api.hpp
@@ -0,0 +1,126 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGnmBeginWorkload(std::uint32_t stream, std::uint64_t* workload);
+int APS5_VABI sceGnmComputeWaitOnAddress(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t address, std::uint32_t mask, std::uint32_t compare, std::uint32_t reference);
+int APS5_VABI sceGnmComputeWaitSemaphore(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t semaphoreAddress, std::uint32_t flags);
+int APS5_VABI sceGnmCreateWorkloadStream(std::uint64_t name, std::uint32_t* stream);
+int APS5_VABI sceGnmDebugModuleReset(void);
+int APS5_VABI sceGnmDebugReset(void);
+int APS5_VABI sceGnmDestroyWorkloadStream(void);
+int APS5_VABI sceGnmDingDongForWorkload(void);
+int APS5_VABI sceGnmDispatchDirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t threadsX, std::uint32_t threadsY, std::uint32_t threadsZ, std::uint32_t flags);
+int APS5_VABI sceGnmDispatchIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t flags);
+int APS5_VABI sceGnmDispatchIndirectOnMec(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t args, std::uint32_t modifier);
+int APS5_VABI sceGnmDrawIndex(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexCount, std::uint64_t indexAddress, std::uint32_t flags, std::uint32_t);
+int APS5_VABI sceGnmDrawIndexAuto(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexCount, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexIndirectCountMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint64_t countAddress, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexIndirectMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexMultiInstanced(void);
+int APS5_VABI sceGnmDrawIndexOffset(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexOffset, std::uint32_t indexCount, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndirectCountMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint64_t countAddress, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndirectMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawInitDefaultHardwareState(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitDefaultHardwareState200(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitDefaultHardwareState350(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitToDefaultContextState(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitToDefaultContextState400(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitToDefaultContextStateInternalCommand(void);
+int APS5_VABI sceGnmDrawInitToDefaultContextStateInternalSize(void);
+int APS5_VABI sceGnmDrawOpaqueAuto(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterface(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForGpuDebugger(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForReplay(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForResourceRegistration(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForValidation(void);
+int APS5_VABI sceGnmDriverInternalVirtualQuery(void);
+int APS5_VABI sceGnmDriverTraceInProgress(void);
+int APS5_VABI sceGnmEndWorkload(std::uint64_t workload);
+int APS5_VABI sceGnmFindResources(void);
+int APS5_VABI sceGnmFindResourcesPublic(void);
+int APS5_VABI sceGnmGetCoredumpAddress(void);
+int APS5_VABI sceGnmGetCoredumpMode(void);
+int APS5_VABI sceGnmGetCoredumpProtectionFaultTimestamp(void);
+int APS5_VABI sceGnmGetDbgGcHandle(void);
+int APS5_VABI sceGnmGetGpuBlockStatus(void);
+int APS5_VABI sceGnmGetGpuCoreClockFrequency(void);
+int APS5_VABI sceGnmGetGpuInfoStatus(void);
+int APS5_VABI sceGnmGetLastWaitedAddress(void);
+int APS5_VABI sceGnmGetNumTcaUnits(void);
+int APS5_VABI sceGnmGetOffChipTessellationBufferSize(void);
+int APS5_VABI sceGnmGetOwnerName(void);
+int APS5_VABI sceGnmGetPhysicalCounterFromVirtualized(void);
+int APS5_VABI sceGnmGetProtectionFaultTimeStamp(void);
+int APS5_VABI sceGnmGetResourceBaseAddressAndSizeInBytes(void);
+int APS5_VABI sceGnmGetResourceName(void);
+int APS5_VABI sceGnmGetResourceRegistrationBuffers(void);
+int APS5_VABI sceGnmGetResourceShaderGuid(void);
+int APS5_VABI sceGnmGetResourceType(void);
+int APS5_VABI sceGnmGetResourceUserData(void);
+int APS5_VABI sceGnmGetShaderProgramBaseAddress(void);
+int APS5_VABI sceGnmGetShaderStatus(void);
+int APS5_VABI sceGnmGpuPaDebugEnter(void);
+int APS5_VABI sceGnmGpuPaDebugLeave(void);
+int APS5_VABI sceGnmInsertDingDongMarker(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmInsertThreadTraceMarker(void);
+int APS5_VABI sceGnmIsCoredumpValid(void);
+int APS5_VABI sceGnmLogicalTcaUnitToPhysical(void);
+int APS5_VABI sceGnmMapComputeQueueWithPriority(void);
+int APS5_VABI sceGnmPaDisableFlipCallbacks(void);
+int APS5_VABI sceGnmPaEnableFlipCallbacks(void);
+int APS5_VABI sceGnmPaHeartbeat(void);
+int APS5_VABI sceGnmQueryResourceRegistrationUserMemoryRequirements(void);
+int APS5_VABI sceGnmRaiseUserExceptionEvent(void);
+int APS5_VABI sceGnmRegisterGdsResource(void);
+int APS5_VABI sceGnmRegisterGnmLiveCallbackConfig(void);
+int APS5_VABI sceGnmRegisterOwner(void);
+int APS5_VABI sceGnmRegisterOwnerForSystem(void);
+int APS5_VABI sceGnmRegisterResource(void);
+int APS5_VABI sceGnmRequestFlipAndSubmitDoneForWorkload(void);
+int APS5_VABI sceGnmResetVgtControl(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmSdmaClose(void);
+int APS5_VABI sceGnmSdmaConstFill(void);
+int APS5_VABI sceGnmSdmaCopyLinear(void);
+int APS5_VABI sceGnmSdmaCopyTiled(void);
+int APS5_VABI sceGnmSdmaCopyWindow(void);
+int APS5_VABI sceGnmSdmaFlush(void);
+int APS5_VABI sceGnmSdmaGetMinCmdSize(void);
+int APS5_VABI sceGnmSdmaOpen(void);
+int APS5_VABI sceGnmSetCsShaderWithModifier(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier);
+int APS5_VABI sceGnmSetEmbeddedPsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t);
+int APS5_VABI sceGnmSetEmbeddedVsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t);
+int APS5_VABI sceGnmSetPsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmSetResourceRegistrationUserMemory(void);
+int APS5_VABI sceGnmSetResourceUserData(void);
+int APS5_VABI sceGnmSetSpiEnableSqCounters(void);
+int APS5_VABI sceGnmSetSpiEnableSqCountersForUnitInstance(void);
+int APS5_VABI sceGnmSetVgtControl(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t primGroupSizeMinusOne, std::uint32_t partialVsWaveMode, std::uint32_t switchOnlyOnEop);
+int APS5_VABI sceGnmSetWaveLimitMultiplier(void);
+int APS5_VABI sceGnmSetWaveLimitMultipliers(void);
+int APS5_VABI sceGnmSubmitAndFlipCommandBuffersForWorkload(void);
+int APS5_VABI sceGnmSubmitCommandBuffersForWorkload(void);
+int APS5_VABI sceGnmUnregisterAllResourcesForOwner(void);
+int APS5_VABI sceGnmUnregisterOwnerAndResources(void);
+int APS5_VABI sceGnmUnregisterResource(void);
+int APS5_VABI sceGnmUpdateGsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmUpdateHsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t lsHsConfig);
+int APS5_VABI sceGnmUpdatePsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmUpdatePsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmUpdateVsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier);
+int APS5_VABI sceGnmValidateDisableDiagnostics(void);
+int APS5_VABI sceGnmValidateDisableDiagnostics2(void);
+int APS5_VABI sceGnmValidateDispatchCommandBuffers(void);
+int APS5_VABI sceGnmValidateDrawCommandBuffers(void);
+int APS5_VABI sceGnmValidateGetDiagnosticInfo(void);
+int APS5_VABI sceGnmValidateGetDiagnostics(void);
+int APS5_VABI sceGnmValidateGetVersion(void);
+int APS5_VABI sceGnmValidateOnSubmitEnabled(void);
+int APS5_VABI sceGnmValidateResetState(void);
+int APS5_VABI sceGnmValidationRegisterMemoryCheckCallback(void);
+
+}
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp b/core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp
new file mode 100644
index 0000000000..621e98ef3d
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp
@@ -0,0 +1,27 @@
+// SPDX-FileCopyrightText: Copyright 2024-2026 shadPS4 Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#ifndef CORE_LIBS_PRX_LIBSCEGNMDRIVERFORNEOMODE_INCLUDE_EMBEDDEDSHADERS_HPP
+#define CORE_LIBS_PRX_LIBSCEGNMDRIVERFORNEOMODE_INCLUDE_EMBEDDEDSHADERS_HPP
+
+#include <array>
+#include <cstdint>
+
+namespace GnmNeo {
+
+alignas(256) constexpr std::array<std::uint32_t, 15> FullscreenVs{
+    0xbeeb0387u, 0x36020081u, 0x34020281u, 0x360000c2u, 0x4a0202c1u, 0x4a0000c1u, 0x7e020b01u, 0x7e000b00u,
+    0x7e040280u, 0x7e0602f2u, 0xf80008cfu, 0x03020001u, 0xf800020fu, 0x03030303u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> BlackPs{
+    0xbeeb0383u, 0x7e000280u, 0x5e000100u, 0xbf800000u, 0xf8001c0fu, 0x00000000u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 5> DepthOnlyPs{
+    0xbeeb0383u, 0x7e040280u, 0xf8001803u, 0x00000202u, 0xbf810000u,
+};
+
+} // namespace GnmNeo
+
+#endif
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/libSceGnmDriverForNeoMode.hpp b/core/libs/prx/libSceGnmDriverForNeoMode/libSceGnmDriverForNeoMode.hpp
new file mode 100644
index 0000000000..ebeb3b8bad
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/libSceGnmDriverForNeoMode.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
diff --git a/core/libs/prx/libSceGpuCapture/libSceGpuCapture.hpp b/core/libs/prx/libSceGpuCapture/libSceGpuCapture.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGpuCapture/libSceGpuCapture.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGpuTrace/libSceGpuTrace.hpp b/core/libs/prx/libSceGpuTrace/libSceGpuTrace.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGpuTrace/libSceGpuTrace.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGvMp4Parser/libSceGvMp4Parser.hpp b/core/libs/prx/libSceGvMp4Parser/libSceGvMp4Parser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGvMp4Parser/libSceGvMp4Parser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHand/libSceHand.hpp b/core/libs/prx/libSceHand/libSceHand.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHand/libSceHand.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHandTracker/libSceHandTracker.hpp b/core/libs/prx/libSceHandTracker/libSceHandTracker.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHandTracker/libSceHandTracker.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHdrScopes/libSceHdrScopes.hpp b/core/libs/prx/libSceHdrScopes/libSceHdrScopes.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHdrScopes/libSceHdrScopes.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHeadTracker/libSceHeadTracker.hpp b/core/libs/prx/libSceHeadTracker/libSceHeadTracker.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHeadTracker/libSceHeadTracker.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHidControl/Export.cpp b/core/libs/prx/libSceHidControl/Export.cpp
index c3bfd0d3ed..bb7329027a 100644
--- a/core/libs/prx/libSceHidControl/Export.cpp
+++ b/core/libs/prx/libSceHidControl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHidControl/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceHidControl/include/Api.hpp b/core/libs/prx/libSceHidControl/include/Api.hpp
new file mode 100644
index 0000000000..ca9e12b806
--- /dev/null
+++ b/core/libs/prx/libSceHidControl/include/Api.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceHidControlEnableMicBeamForming(void);
+int APS5_VABI sceHidControlSetAllVibrationMute(void);
+int APS5_VABI sceHidControlSetVibrationTriggerEffectWeakForce(void);
+int APS5_VABI sceHidControlIsForceUpdateNeeded(void);
+int APS5_VABI sceHidControlSetRemoteMergeProcess(void);
+int APS5_VABI sceHidControlSetCollaboInputSettingOverrideProcess(void);
+int APS5_VABI sceHidControlSetForceAdvancedVibrationMode(void);
+int APS5_VABI sceHidControlPswUpdateIsUpdateNeeded(void);
+int APS5_VABI sceHidControlPswUpdateIsUpdateNeededForMultiDevice(void);
+int APS5_VABI sceHidControlPswUpdateIsReady(void);
+int APS5_VABI sceHidControlPswUpdateStart(void);
+int APS5_VABI sceHidControlPswUpdateGetStatus(void);
+int APS5_VABI sceHidControlPswUpdateSendData(void);
+int APS5_VABI sceHidControlPswUpdateSendAppendixData(void);
+int APS5_VABI sceHidControlPswUpdateGetReconnectStatus(void);
+int APS5_VABI sceHidControlPswUpdateGetDeviceFirmwareUpdateTelemetryData(void);
+int APS5_VABI sceHidControlGetPswState(void);
+int APS5_VABI sceHidControlGetPswBatteryState(void);
+int APS5_VABI sceHidControlSetPswDeviceName(void);
+int APS5_VABI sceHidControlGetPswDeviceName(void);
+int APS5_VABI sceHidControlSetPswConsoleMute(void);
+int APS5_VABI sceHidControlSetPswSpeakerVolume(void);
+int APS5_VABI sceHidControlSetPswSidetoneLevel(void);
+int APS5_VABI sceHidControlGetPswSidetoneLevel(void);
+int APS5_VABI sceHidControlSetPswEqPresetSelection(void);
+int APS5_VABI sceHidControlGetPswEqPresetSelection(void);
+int APS5_VABI sceHidControlSetPswEqPresetName(void);
+int APS5_VABI sceHidControlGetPswEqPresetName(void);
+int APS5_VABI sceHidControlSetPswEqBandValues(void);
+int APS5_VABI sceHidControlGetPswEqBandValues(void);
+int APS5_VABI sceHidControlGetPswAllEqBandValues(void);
+int APS5_VABI sceHidControlSetPswResetSettings(void);
+int APS5_VABI sceHidControlSetPswNetworkLocale(void);
+int APS5_VABI sceHidControlGetPswNetworkLocale(void);
+int APS5_VABI sceHidControlGetPswDeviceNameForNearby(void);
+int APS5_VABI sceHidControlConnectPswDeviceForNearby(void);
+int APS5_VABI sceHidControlGetPswDeviceInfo(void);
+int APS5_VABI sceHidControlSetPswCommand(void);
+int APS5_VABI sceHidControlGetPswCommand(void);
+int APS5_VABI sceHidControlGetPswDeviceIdFromIdxAdd(void);
+
+}
diff --git a/core/libs/prx/libSceHidControl/libSceHidControl.hpp b/core/libs/prx/libSceHidControl/libSceHidControl.hpp
new file mode 100644
index 0000000000..6a943525cb
--- /dev/null
+++ b/core/libs/prx/libSceHidControl/libSceHidControl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHidControl/include/Api.hpp"
diff --git a/core/libs/prx/libSceHmd/Export.cpp b/core/libs/prx/libSceHmd/Export.cpp
index d32073ea63..c859361ee4 100644
--- a/core/libs/prx/libSceHmd/Export.cpp
+++ b/core/libs/prx/libSceHmd/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHmd/include/Api.hpp"
 #include "Hmd.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
@@ -8,56 +9,12 @@
 #include <initializer_list>
 #include <string>
 
-struct HmdDistortionCommandParameter;
-struct HmdWideNearDistortionCommandParameter;
-struct Hmd2dVrCommandParameter;
-
-struct HmdCommandBuffer {
-    const std::uint32_t* commands;
-    std::uint32_t dwordCount;
-};
-
 static_assert(sizeof(HmdCommandBuffer) == 16);
 static_assert(offsetof(HmdCommandBuffer, dwordCount) == 8);
 
-struct HmdReprojectionFrameParameter;
-struct HmdReprojectionWideNearParameter;
-struct HmdReprojection2dVrParameter;
-struct HmdReprojectionPose;
-struct HmdReprojectionOverlayParameter;
-struct HmdReprojectionSubmissionParameter;
-struct HmdReprojectionInitializeParameter;
-struct HmdReprojectionMultilayerParameter;
-struct HmdDeviceInformation;
-struct HmdDistortionParameters;
-struct HmdInertialSensorData;
-struct HmdStatusReport;
-
-struct HmdFieldOfView {
-    float angles[4];
-};
-
-struct HmdAssemblyError {
-    float offsets[4];
-};
-
 static_assert(sizeof(HmdFieldOfView) == 16);
 static_assert(sizeof(HmdAssemblyError) == 16);
 
-struct HmdVr2dData;
-struct HmdPuPositionParameter;
-struct HmdOpticalParameter;
-struct HmdCrashDumpInfo;
-struct HmdScreenOutputParameter;
-struct HmdScreenFadeParameter;
-struct HmdScreenStatus;
-struct HmdCaptureInitializeParameter;
-struct HmdCaptureInfo;
-struct HmdLiveCaptureParameter;
-struct HmdReprojectionDebugInfo;
-struct HmdReprojectionMultilayerDebugInfo;
-struct HmdReprojectionCallbackParameter;
-
 namespace {
 
 std::atomic<bool> initialized{false};
@@ -101,60 +58,20 @@ std::int32_t Vr2dCommandArguments(const Hmd2dVrCommandParameter* parameter, cons
 
 }
 
-struct HmdEyeDistances {
-    std::uint32_t left;
-    std::uint32_t right;
-};
-
-struct HmdEyeOffset {
-    float x;
-    float y;
-    float z;
-};
-
-struct HmdMirroringAspect {
-    std::uint16_t reserved0;
-    std::int16_t aspect;
-    std::uint16_t reserved1;
-    std::uint16_t reserved2;
-};
-
-struct HmdMirroringAspectDebug {
-    std::uint16_t values[5];
-    std::uint8_t mode;
-};
-
 static_assert(sizeof(HmdMirroringAspectDebug) == 12);
 static_assert(offsetof(HmdMirroringAspectDebug, mode) == 10);
 static_assert(sizeof(HmdMirroringAspect) == 8);
 static_assert(offsetof(HmdMirroringAspect, aspect) == 2);
 
-using HmdEventCallback = void (APS5_VABI *)(std::uint32_t events);
-
-struct HmdDfuData {
-    const void* data;
-    std::uint32_t size;
-    std::uint32_t mode;
-};
-
 static_assert(sizeof(HmdDfuData) == 16);
 static_assert(offsetof(HmdDfuData, size) == 8);
 static_assert(offsetof(HmdDfuData, mode) == 12);
 
-struct HmdScreenData {
-    const void* data;
-    std::int32_t size;
-};
-
 static_assert(sizeof(HmdScreenData) == 16);
 static_assert(offsetof(HmdScreenData, size) == 8);
 static_assert(sizeof(HmdEyeDistances) == 8);
 static_assert(sizeof(HmdEyeOffset) == 12);
 
-struct HmdLedData {
-    std::uint8_t values[9];
-};
-
 static_assert(sizeof(HmdLedData) == 9);
 
 extern "C" {
diff --git a/core/libs/prx/libSceHmd/Hmd.hpp b/core/libs/prx/libSceHmd/Hmd.hpp
index 22f812c774..e535975c5e 100644
--- a/core/libs/prx/libSceHmd/Hmd.hpp
+++ b/core/libs/prx/libSceHmd/Hmd.hpp
@@ -52,14 +52,25 @@ static_assert(offsetof(DeviceInformation, hmuMount) == 24);
 
 }
 
-struct HmdFieldOfView;
-struct HmdEyeOffset;
+struct HmdFieldOfView {
+    float angles[4];
+};
+struct HmdEyeOffset {
+    float x;
+    float y;
+    float z;
+};
 struct HmdInertialSensorData;
-struct HmdAssemblyError;
+struct HmdAssemblyError {
+    float offsets[4];
+};
 struct HmdDistortionCommandParameter;
 struct HmdWideNearDistortionCommandParameter;
 struct Hmd2dVrCommandParameter;
-struct HmdCommandBuffer;
+struct HmdCommandBuffer {
+    const std::uint32_t* commands;
+    std::uint32_t dwordCount;
+};
 
 extern "C" {
 std::int32_t APS5_VABI sceHmdInitialize(const Hmd::InitializeParam* param);
diff --git a/core/libs/prx/libSceHmd/include/Api.hpp b/core/libs/prx/libSceHmd/include/Api.hpp
new file mode 100644
index 0000000000..3feeb6eb93
--- /dev/null
+++ b/core/libs/prx/libSceHmd/include/Api.hpp
@@ -0,0 +1,232 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "prx/libSceHmd/Hmd.hpp"
+
+struct HmdCaptureInfo;
+
+struct HmdCaptureInitializeParameter;
+
+struct HmdCrashDumpInfo;
+
+struct HmdDeviceInformation;
+
+struct HmdDfuData {
+    const void* data;
+    std::uint32_t size;
+    std::uint32_t mode;
+};
+
+struct HmdDistortionParameters;
+
+using HmdEventCallback = void (APS5_VABI *)(std::uint32_t events);
+
+struct HmdEyeDistances {
+    std::uint32_t left;
+    std::uint32_t right;
+};
+
+
+
+struct HmdLedData {
+    std::uint8_t values[9];
+};
+
+struct HmdLiveCaptureParameter;
+
+struct HmdMirroringAspect {
+    std::uint16_t reserved0;
+    std::int16_t aspect;
+    std::uint16_t reserved1;
+    std::uint16_t reserved2;
+};
+
+struct HmdMirroringAspectDebug {
+    std::uint16_t values[5];
+    std::uint8_t mode;
+};
+
+struct HmdOpticalParameter;
+
+struct HmdPuPositionParameter;
+
+struct HmdReprojection2dVrParameter;
+
+struct HmdReprojectionCallbackParameter;
+
+struct HmdReprojectionDebugInfo;
+
+struct HmdReprojectionFrameParameter;
+
+struct HmdReprojectionInitializeParameter;
+
+struct HmdReprojectionMultilayerDebugInfo;
+
+struct HmdReprojectionMultilayerParameter;
+
+struct HmdReprojectionOverlayParameter;
+
+struct HmdReprojectionPose;
+
+struct HmdReprojectionSubmissionParameter;
+
+struct HmdReprojectionWideNearParameter;
+
+struct HmdScreenData {
+    const void* data;
+    std::int32_t size;
+};
+
+struct HmdScreenFadeParameter;
+
+struct HmdScreenOutputParameter;
+
+struct HmdScreenStatus;
+
+struct HmdStatusReport;
+
+struct HmdVr2dData;
+
+extern "C" {
+
+int APS5_VABI sceHmdInternalGetPUVersion(std::uint32_t* version);
+int APS5_VABI sceHmdInternalEventInitialize(void);
+int APS5_VABI sceHmdInternalSetVirtualDisplaySize(std::uint8_t size);
+int APS5_VABI sceHmdInternalSocialScreenSetOutput(std::uint32_t output, const HmdScreenOutputParameter* parameter);
+int APS5_VABI sceHmdInternalGetVirtualDisplayDepth(std::uint8_t* depth);
+int APS5_VABI sceHmdInternalGetEyeStatus(std::int32_t handle, HmdEyeOffset* left, HmdEyeOffset* right);
+int APS5_VABI sceHmdInternalAnotherScreenOpen(void);
+int APS5_VABI sceHmdReprojectionUnsetCallback(void);
+int APS5_VABI sceHmdInternalSetCrashReportCommand(std::uint8_t command);
+int APS5_VABI sceHmdInternalGetDebugTextMode(std::uint8_t* mode);
+int APS5_VABI sceHmdInternalRegisterEventCallback(HmdEventCallback callback);
+int APS5_VABI sceHmdReprojectionStartWideNear(const HmdReprojectionWideNearParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalGetPUSerialNumber(char* serialNumber);
+int APS5_VABI sceHmdInternalGetDebugSocialScreenMode(std::uint8_t* mode);
+int APS5_VABI sceHmdInternalSetM2LedBrightness(std::int32_t handle, std::uint32_t ledMask, const std::uint8_t* brightness);
+int APS5_VABI sceHmdInternalSetIPD(std::int32_t mode, HmdEyeDistances distances);
+int APS5_VABI sceHmdInternalMirroringModeSetAspect(const HmdMirroringAspect* aspect);
+int APS5_VABI sceHmdInternalDfuGetStatus(std::uint64_t* status);
+int APS5_VABI sceHmdInternalAnotherScreenSendVideo(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalGetRequiredPUPVersion(std::uint32_t* firstVersion, std::uint32_t* secondVersion);
+int APS5_VABI sceHmdReprojectionSetCallback(const HmdReprojectionCallbackParameter* parameter);
+int APS5_VABI sceHmdInternalDfuCheckAfterPvt(std::uint8_t* afterPvt);
+int APS5_VABI sceHmdInternalResetInertialSensor(void);
+int APS5_VABI sceHmdReprojectionSetUserEventStart(std::int64_t eventQueue, std::int32_t eventId);
+int APS5_VABI sceHmdDistortionSetOutputMinColor(float red, float green, float blue);
+int APS5_VABI sceHmdInternalSetVirtualDisplayDepth(std::uint8_t depth);
+int APS5_VABI sceHmdGetDistortionWorkMemoryAlign(void);
+int APS5_VABI sceHmdReprojectionStartMultilayer(const HmdReprojectionMultilayerParameter* layers, std::uint32_t layerCount, const HmdReprojectionSubmissionParameter* submission, const HmdReprojectionPose* pose, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalPushVr2dData(const HmdVr2dData* data);
+int APS5_VABI sceHmdReprojectionClearUserEventEnd(void);
+int APS5_VABI sceHmdInternalGetIPD(HmdEyeDistances* distances);
+int APS5_VABI sceHmdInternalSetVRMode(std::int32_t enabled);
+int APS5_VABI sceHmdInternalCrashReportReadDataSize(std::uint32_t* dataSize);
+int APS5_VABI sceHmdInternalGetVr2dData(HmdVr2dData* data);
+int APS5_VABI sceHmdInternalAnotherScreenSendAudio(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalGetPuPositionParam(HmdPuPositionParameter* parameter);
+int APS5_VABI sceHmdReprojectionInitializeCapture(const HmdCaptureInitializeParameter* parameter);
+int APS5_VABI sceHmdInternalSetDebugSocialScreenMode(std::uint8_t mode);
+int APS5_VABI sceHmdInternalGetHmuPowerStatusForDebug(std::uint8_t* status);
+int APS5_VABI sceHmdGetDistortionWorkMemorySize(void);
+int APS5_VABI sceHmdReprojectionSetDisplayBuffers(std::int32_t videoOutHandle, std::int32_t firstBufferIndex, std::int32_t secondBufferIndex, const void* reserved);
+int APS5_VABI sceHmdInternalAnotherScreenSetFadeAndSwitch(const HmdScreenFadeParameter* parameter);
+int APS5_VABI sceHmdInternalCreateSharedMemory(void);
+int APS5_VABI sceHmdInternalMirroringModeSetAspectDebug(const HmdMirroringAspectDebug* aspect);
+int APS5_VABI sceHmdInternalGetPuBuildNumber(std::uint32_t* buildNumber);
+int APS5_VABI sceHmdDistortionGetCompoundEyeCorrectionCommand(void);
+int APS5_VABI sceHmdInternalSetS3dPassMode(std::uint8_t mode);
+int APS5_VABI sceHmdReprojectionStopCapture(HmdCaptureInfo* info);
+int APS5_VABI sceHmdInternalMmapGetSensorCalibrationData(void* buffer, std::uint32_t size);
+int APS5_VABI sceHmdInternalGetDebugMode(std::uint8_t* mode);
+int APS5_VABI sceHmdReprojectionSetOutputMinColor(float red, float green, float blue);
+int APS5_VABI sceHmdInternalSetPortConnection(std::uint64_t connection);
+int APS5_VABI sceHmdReprojectionDebugGetLastInfo(HmdReprojectionDebugInfo* info);
+int APS5_VABI sceHmdInternalSetM2LedOn(std::int32_t handle, std::uint32_t ledMask, std::uint32_t brightness);
+int APS5_VABI sceHmdReprojectionAddDisplayBuffer(std::int32_t bufferIndex, const void* reserved);
+int APS5_VABI sceHmdInternalSetIpdSettingEnableForSystemService(std::uint8_t enabled);
+int APS5_VABI sceHmdInternalSetLedOn(std::int32_t handle, std::uint32_t ledMask);
+int APS5_VABI sceHmdInternal3dAudioSendData(std::int32_t port, const void* data, std::int32_t size);
+int APS5_VABI sceHmdReprojectionInitialize(const HmdReprojectionInitializeParameter* parameter, std::uint32_t mode, const void* reserved);
+int APS5_VABI sceHmdInternalGetDeviceInformationByHandle(std::int32_t handle, HmdDeviceInformation* information);
+int APS5_VABI sceHmdReprojectionStopLiveCapture(void);
+int APS5_VABI sceHmdInternalAnotherScreenClose(void);
+int APS5_VABI sceHmdInternalCrashReportReadData(void* buffer, std::uint32_t* bytesRead, std::uint32_t bufferSize);
+int APS5_VABI sceHmdInternalGetDeviceInformation(HmdDeviceInformation* information);
+int APS5_VABI sceHmdReprojectionStartCapture(void);
+int APS5_VABI sceHmdInternalGetDefaultLedData(std::int32_t handle, std::uint32_t* mask, HmdLedData* data);
+int APS5_VABI sceHmdInternalDfuClose(void);
+int APS5_VABI sceHmdInternalSetHmuPowerControl(std::uint8_t control);
+int APS5_VABI sceHmdInternalBindDeviceWithUserId(std::int32_t handle, std::int32_t userId);
+int APS5_VABI sceHmdInternalGetHmuSerialNumber(std::uint8_t* serialNumber);
+int APS5_VABI sceHmdInternalCheckS3dPassModeAvailable(bool* available);
+int APS5_VABI sceHmdInternalAnotherScreenGetAudioStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdInternalSeparateModeGetAudioStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdReprojectionStartLiveCapture(const HmdLiveCaptureParameter* parameter);
+int APS5_VABI sceHmdReprojectionFinalize(void);
+int APS5_VABI sceHmdInternalSocialScreenSetFadeAndSwitch(const HmdScreenFadeParameter* parameter);
+int APS5_VABI sceHmdInternalDfuStart(void);
+int APS5_VABI sceHmdInternalSetVirtualDisplayHeight(std::uint8_t height);
+int APS5_VABI sceHmdDistortionInitialize(void* workMemory);
+int APS5_VABI sceHmdInternalDfuSetMode(std::uint32_t mode);
+int APS5_VABI sceHmdInternalSetForcedCrash(std::uint8_t mode);
+int APS5_VABI sceHmdInternalDfuCheckPartialUpdateAvailable(bool* available);
+int APS5_VABI sceHmdInternalSeparateModeClose(void);
+int APS5_VABI sceHmdInternalSetDebugTextMode(std::uint8_t mode);
+int APS5_VABI sceHmdInternalCrashReportClose(void);
+int APS5_VABI sceHmdInternalSetHmuPowerControlForDebug(std::uint8_t control);
+int APS5_VABI sceHmdInternalGetVirtualDisplayHeight(std::uint8_t* height);
+int APS5_VABI sceHmdReprojectionStart(const HmdReprojectionFrameParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalResetLedForVsh(void);
+int APS5_VABI sceHmdInternalDfuOpen(void);
+int APS5_VABI sceHmdInternalSetDebugMode(std::uint8_t mode);
+int APS5_VABI sceHmdInternalCrashReportCancel(void);
+int APS5_VABI sceHmdInternalSeparateModeGetVideoStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdInternalCheckDeviceModelMk3(bool* isMk3);
+int APS5_VABI sceHmdSetVr2dEnable(std::int32_t enabled);
+int APS5_VABI sceHmdInternalSetSidetone(std::uint8_t level);
+int APS5_VABI sceHmdInternalSeparateModeOpen(void);
+int APS5_VABI sceHmdInternalMmapGetModeId(std::uint32_t* modeId);
+int APS5_VABI sceHmdInternalDfuSendSize(std::int32_t size);
+int APS5_VABI sceHmdReprojectionStartMultilayer2(const HmdReprojectionMultilayerParameter* layers, std::uint32_t layerCount, const HmdReprojectionSubmissionParameter* submission, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalSetDeviceConnection(std::uint64_t connection);
+int APS5_VABI sceHmdInternalGetVirtualDisplaySize(std::uint8_t* size);
+int APS5_VABI sceHmdReprojectionUnsetDisplayBuffers(void);
+int APS5_VABI sceHmdInternalGetHmuOpticalParam(HmdOpticalParameter* parameter);
+int APS5_VABI sceHmdInternalSeparateModeSendVideo(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalResetLedForVrTracker(void);
+int APS5_VABI sceHmdReprojectionStartWithOverlay(const HmdReprojectionFrameParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const HmdReprojectionOverlayParameter* overlay, const void* reserved);
+int APS5_VABI sceHmdReprojectionSetUserEventEnd(std::int64_t eventQueue, std::int32_t eventId);
+int APS5_VABI sceHmdInternalCrashReportOpen(void);
+int APS5_VABI sceHmdInternalSetDemoMode(std::uint8_t mode);
+int APS5_VABI sceHmdReprojectionStartWideNearWithOverlay(const HmdReprojectionWideNearParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const HmdReprojectionOverlayParameter* overlay, const void* reserved);
+int APS5_VABI sceHmdGetDistortionParams(HmdDistortionParameters* parameters);
+int APS5_VABI sceHmdInternalDfuSend(const HmdDfuData* data);
+int APS5_VABI sceHmdReprojectionClearUserEventStart(void);
+int APS5_VABI sceHmdInternalSetUserType(std::uint8_t userType);
+int APS5_VABI sceHmdInternalGetDemoMode(std::uint8_t* mode);
+int APS5_VABI sceHmdInternalMapSharedMemory(void);
+int APS5_VABI sceHmdInternalGetCrashDumpInfo(HmdCrashDumpInfo* info);
+int APS5_VABI sceHmdInternalGetTv4kCapability(std::uint8_t* capability);
+int APS5_VABI sceHmdInternalDfuReset(void);
+int APS5_VABI sceHmdReprojectionStart2dVr(const HmdReprojection2dVrParameter* parameter, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalMmapGetCount(void);
+int APS5_VABI sceHmdInternalSetDefaultLedData(std::int32_t handle, std::uint32_t mask, const HmdLedData* data);
+int APS5_VABI sceHmdInternal3dAudioClose(std::int32_t port);
+int APS5_VABI sceHmdInternalSetBrightness(std::uint8_t brightness);
+int APS5_VABI sceHmdInternalSocialScreenGetFadeState(std::int32_t* state);
+int APS5_VABI sceHmdInternalSeparateModeSendAudio(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalGetStatusReport(std::int32_t handle, HmdStatusReport* report);
+int APS5_VABI sceHmdInternalGetBrightness(std::uint8_t* brightness);
+int APS5_VABI sceHmdReprojectionFinalizeCapture(void);
+int APS5_VABI sceHmdInternalSetPortStatus(std::uint64_t status);
+int APS5_VABI sceHmdReprojectionStop(void);
+int APS5_VABI sceHmdInternalAnotherScreenGetVideoStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdInternal3dAudioOpen(std::int32_t port);
+int APS5_VABI sceHmdInternalAnotherScreenGetFadeState(std::int32_t* state);
+int APS5_VABI sceHmdInternalSetDebugGpo(std::uint32_t value);
+int APS5_VABI sceHmdInternalGetIpdSettingEnableForSystemService(std::uint8_t* enabled);
+int APS5_VABI sceHmdReprojectionDebugGetLastInfoMultilayer(HmdReprojectionMultilayerDebugInfo* info);
+int APS5_VABI sceHmdInternalGetPuRevision(std::uint32_t* revision);
+
+}
diff --git a/core/libs/prx/libSceHmd/libSceHmd.hpp b/core/libs/prx/libSceHmd/libSceHmd.hpp
new file mode 100644
index 0000000000..fb3f263602
--- /dev/null
+++ b/core/libs/prx/libSceHmd/libSceHmd.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceHmd/Hmd.hpp"
+#include "prx/libSceHmd/include/Api.hpp"
diff --git a/core/libs/prx/libSceHmd2/Export.cpp b/core/libs/prx/libSceHmd2/Export.cpp
index d744bf2741..82c55782b7 100644
--- a/core/libs/prx/libSceHmd2/Export.cpp
+++ b/core/libs/prx/libSceHmd2/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceHmd2/include/Api.hpp"
+#include "prx/libSceHmd2/Hmd2.hpp"
 #include "Hmd2.hpp"
 #include "prx/libc/include/general/ExportMacros.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
@@ -13,25 +15,6 @@
 
 namespace Hmd2 {
 
-struct ReprojectionStatus;
-struct ReprojectionOutput {
-    std::uint32_t textureDescriptor[8];
-};
-
-struct ReprojectionInitializeParameter {
-    void* workMemory;
-    void* displayMemory;
-    std::int32_t threadPriority;
-    std::uint32_t threadAffinity;
-    std::uint32_t queueParameter24;
-    std::uint32_t queueParameter28;
-    std::uint32_t renderingMode;
-    std::uint32_t reserved36;
-    void* auxiliaryMemory;
-    std::uint32_t timingInterval;
-    std::uint32_t reserved52[5];
-};
-
 static_assert(sizeof(ReprojectionOutput) == 32);
 static_assert(sizeof(ReprojectionInitializeParameter) == 72);
 static_assert(offsetof(ReprojectionInitializeParameter, threadPriority) == 16);
@@ -39,28 +22,6 @@ static_assert(offsetof(ReprojectionInitializeParameter, threadAffinity) == 20);
 static_assert(offsetof(ReprojectionInitializeParameter, renderingMode) == 32);
 static_assert(offsetof(ReprojectionInitializeParameter, auxiliaryMemory) == 40);
 static_assert(offsetof(ReprojectionInitializeParameter, timingInterval) == 48);
-struct ReprojectionLayer;
-struct ReprojectionBufferedLayer;
-
-struct ReprojectionOption {
-    std::uint32_t size;
-    std::uint32_t flags;
-    std::uint32_t reserved[30];
-};
-
-struct ReprojectionParameter {
-    const ReprojectionLayer* layers;
-    std::int32_t layerCount;
-    std::uint8_t padding[4];
-    const ReprojectionOption* option;
-};
-
-struct ReprojectionBufferedParameter {
-    const ReprojectionBufferedLayer* layers;
-    std::int32_t layerCount;
-    std::uint8_t padding[4];
-    const ReprojectionOption* option;
-};
 
 static_assert(sizeof(ReprojectionOption) == 128);
 static_assert(sizeof(ReprojectionParameter) == 24);
@@ -68,88 +29,12 @@ static_assert(sizeof(ReprojectionBufferedParameter) == 24);
 static_assert(offsetof(ReprojectionParameter, option) == 16);
 static_assert(offsetof(ReprojectionBufferedParameter, option) == 16);
 
-
-struct MirroringParameter {
-    void* workMemory;
-    void* displayMemory;
-};
-
-struct MirroringOption {
-    std::uint32_t mode;
-    std::uint32_t reserved[7];
-};
-
 static_assert(sizeof(MirroringParameter) == 16);
 static_assert(sizeof(MirroringOption) == 32);
 
-struct GazeResultParameter {
-    std::uint32_t size;
-    std::int32_t handle;
-    std::uint8_t reserved[8];
-};
-struct GazeResult;
-struct FoveatedRenderingResult {
-    std::uint32_t size;
-    std::int32_t status;
-    float direction[3];
-    std::uint8_t reserved[4];
-};
-
 static_assert(sizeof(GazeResultParameter) == 16);
 static_assert(sizeof(FoveatedRenderingResult) == 24);
 static_assert(offsetof(FoveatedRenderingResult, direction) == 8);
-struct GazeCalibrationData {
-    void* data;
-    std::int32_t size;
-};
-struct GazeUserCalibrationData {
-    const void* data;
-    std::int32_t size;
-};
-struct GazeUserCalibrationStatus {
-    std::int32_t status;
-    std::int32_t eye;
-    float point[3];
-};
-struct GazeRawData;
-struct GazeObjectSelectionTransform {
-    float values[16];
-};
-
-struct GazeObjectSelectionObject {
-    std::uint64_t id;
-    std::uint32_t enabled;
-    std::uint32_t reserved12;
-    GazeObjectSelectionTransform transform;
-    const GazeObjectSelectionTransform* boundingBoxes;
-    std::uint32_t boundingBoxCount;
-    std::uint32_t reserved92;
-};
-
-struct GazeObjectSelectionParameter {
-    std::uint32_t size;
-    std::uint32_t reserved4;
-    std::uint64_t reserved8;
-    std::uint64_t gazeTimestamp;
-    GazeObjectSelectionTransform transform;
-    std::uint32_t selectionMode;
-    std::uint32_t filterMode;
-    std::uint64_t timestamp;
-    const GazeObjectSelectionObject* objects;
-    std::uint32_t objectCount;
-    std::uint32_t reserved116;
-};
-
-struct GazeObjectSelectionResult {
-    std::uint32_t size;
-    std::uint32_t selected;
-    std::uint64_t objectId;
-    std::uint64_t gazeTimestamp;
-    std::uint32_t gazeValid;
-    float origin[3];
-    float direction[3];
-    float distance;
-};
 
 static_assert(sizeof(GazeObjectSelectionTransform) == 64);
 static_assert(sizeof(GazeObjectSelectionObject) == 96);
@@ -168,28 +53,6 @@ static_assert(offsetof(GazeObjectSelectionResult, gazeTimestamp) == 16);
 static_assert(offsetof(GazeObjectSelectionResult, origin) == 28);
 static_assert(offsetof(GazeObjectSelectionResult, direction) == 40);
 static_assert(offsetof(GazeObjectSelectionResult, distance) == 52);
-struct GazeObjectSelectionInitializeParameter {
-    std::uint32_t size;
-    std::uint32_t maxObjects;
-    void* memory;
-    std::uint32_t memorySize;
-    std::uint32_t reserved;
-};
-struct GazeObjectSelectionMemoryParameter {
-    std::uint32_t size;
-    std::uint32_t maxObjects;
-};
-struct GazeObjectSelectionMemoryInfo {
-    std::uint32_t size;
-    std::uint32_t memorySize;
-    std::uint64_t alignment;
-};
-
-struct CalibrationPoint {
-    float x;
-    float y;
-    float z;
-};
 
 static_assert(sizeof(CalibrationPoint) == 12);
 static_assert(sizeof(GazeCalibrationData) == 16);
@@ -497,7 +360,6 @@ int APS5_VABI sceHmd2RpeorjectionSetParam() {
     return 0;
 }
 
-
 std::int32_t APS5_VABI Hmd2BeforeInitializeZero() {
     return BeforeInitialize(0, __func__);
 }
@@ -520,10 +382,6 @@ int APS5_VABI sceHmd2SetIpdOffset(std::uint8_t enabled, float offset) {
 }
 APS5_EXPORT("-kZT7X7OMg0", Hmd2BeforeInitializeZero);
 APS5_EXPORT("1ewLtng-SVk", Hmd2BeforeInitializeZero);
-APS5_EXPORT("B0b8DeIUGes", Hmd2BeforeInitializeZero);
-APS5_EXPORT("HclLg4Oj5yw", Hmd2BeforeInitializeZero);
-APS5_EXPORT("VbEvrQXsZyY", Hmd2BeforeInitializeZero);
-APS5_EXPORT("bB6MKZi5UCQ", Hmd2BeforeInitializeZero);
 APS5_EXPORT("OXQ1EDf02XU", Hmd2BeforeInitializeZero);
 APS5_EXPORT("IAxfMTvFm0M", Hmd2BeforeInitializeZero);
 APS5_EXPORT("qTJtAtaLeno", Hmd2BeforeInitializeZero);
@@ -680,10 +538,6 @@ std::int32_t APS5_VABI Hmd2BeforeInitializeMinusOne() {
 }
 APS5_EXPORT("EAkv8Mqt33E", Hmd2BeforeInitializeMinusOne);
 APS5_EXPORT("Rv7bkmKvmz0", Hmd2BeforeInitializeMinusOne);
-APS5_EXPORT("1oPZizn0SNA", Hmd2BeforeInitializeMinusOne);
-APS5_EXPORT("TwCpE-nNrlo", Hmd2BeforeInitializeMinusOne);
-APS5_EXPORT("jkqAeQfdtxw", Hmd2BeforeInitializeMinusOne);
-APS5_EXPORT("+l0RQph81Z8", Hmd2BeforeInitializeMinusOne);
 APS5_EXPORT("qsmAtGw1Ncc", Hmd2BeforeInitializeMinusOne);
 APS5_EXPORT("uKhwYoMsIsA", Hmd2BeforeInitializeMinusOne);
 APS5_EXPORT("WNdaigr94dI", Hmd2BeforeInitializeMinusOne);
@@ -691,6 +545,38 @@ APS5_EXPORT("P6S5ZVWf-H0", Hmd2BeforeInitializeMinusOne);
 APS5_EXPORT("sun6NWE1sdg", Hmd2BeforeInitializeMinusOne);
 APS5_EXPORT("--TFsJYXo04", Hmd2BeforeInitializeMinusOne);
 
+std::int32_t APS5_VABI sceHmd2InternalTrackingOpen() {
+    return BeforeInitialize(0, __func__);
+}
+
+std::int32_t APS5_VABI sceHmd2InternalTrackingClose() {
+    return BeforeInitialize(0, __func__);
+}
+
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorOpen() {
+    return BeforeInitialize(0, __func__);
+}
+
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorClose() {
+    return BeforeInitialize(0, __func__);
+}
+
+std::int32_t APS5_VABI sceHmd2InternalTrackingStart() {
+    return BeforeInitialize(-1, __func__);
+}
+
+std::int32_t APS5_VABI sceHmd2InternalTrackingStop() {
+    return BeforeInitialize(-1, __func__);
+}
+
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorStart() {
+    return BeforeInitialize(-1, __func__);
+}
+
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorStop() {
+    return BeforeInitialize(-1, __func__);
+}
+
 std::int32_t APS5_VABI Hmd2BeforeInitializeValue0400() {
     return BeforeInitialize(0x400, __func__);
 }
@@ -989,7 +875,6 @@ std::int32_t APS5_VABI Hmd2CheckSecondThenError1002(const void* a0, const void*
 }
 APS5_EXPORT("W-ZIlUXcrNA", Hmd2CheckSecondThenError1002);
 
-
 std::int32_t APS5_VABI Hmd2WriteStateTwo(void* a0) {
     if (a0 == nullptr) return Hmd2::ParameterNull;
     static constexpr std::uint8_t bytes[] = {0x02, 0x00, 0x00, 0x00, 0x00};
diff --git a/core/libs/prx/libSceHmd2/include/Api.hpp b/core/libs/prx/libSceHmd2/include/Api.hpp
new file mode 100644
index 0000000000..141cd26128
--- /dev/null
+++ b/core/libs/prx/libSceHmd2/include/Api.hpp
@@ -0,0 +1,384 @@
+#pragma once
+
+#include "prx/libSceHmd2/Hmd2.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstring>
+#include <mutex>
+#include <stdexcept>
+
+namespace Hmd2 {
+
+struct ReprojectionStatus;
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionOutput {
+    std::uint32_t textureDescriptor[8];
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionInitializeParameter {
+    void* workMemory;
+    void* displayMemory;
+    std::int32_t threadPriority;
+    std::uint32_t threadAffinity;
+    std::uint32_t queueParameter24;
+    std::uint32_t queueParameter28;
+    std::uint32_t renderingMode;
+    std::uint32_t reserved36;
+    void* auxiliaryMemory;
+    std::uint32_t timingInterval;
+    std::uint32_t reserved52[5];
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionLayer;
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionBufferedLayer;
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionOption {
+    std::uint32_t size;
+    std::uint32_t flags;
+    std::uint32_t reserved[30];
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionParameter {
+    const ReprojectionLayer* layers;
+    std::int32_t layerCount;
+    std::uint8_t padding[4];
+    const ReprojectionOption* option;
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionBufferedParameter {
+    const ReprojectionBufferedLayer* layers;
+    std::int32_t layerCount;
+    std::uint8_t padding[4];
+    const ReprojectionOption* option;
+};
+
+}
+
+namespace Hmd2 {
+
+struct MirroringParameter {
+    void* workMemory;
+    void* displayMemory;
+};
+
+}
+
+namespace Hmd2 {
+
+struct MirroringOption {
+    std::uint32_t mode;
+    std::uint32_t reserved[7];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeResultParameter {
+    std::uint32_t size;
+    std::int32_t handle;
+    std::uint8_t reserved[8];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeResult;
+
+}
+
+namespace Hmd2 {
+
+struct FoveatedRenderingResult {
+    std::uint32_t size;
+    std::int32_t status;
+    float direction[3];
+    std::uint8_t reserved[4];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeCalibrationData {
+    void* data;
+    std::int32_t size;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeUserCalibrationData {
+    const void* data;
+    std::int32_t size;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeUserCalibrationStatus {
+    std::int32_t status;
+    std::int32_t eye;
+    float point[3];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeRawData;
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionTransform {
+    float values[16];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionObject {
+    std::uint64_t id;
+    std::uint32_t enabled;
+    std::uint32_t reserved12;
+    GazeObjectSelectionTransform transform;
+    const GazeObjectSelectionTransform* boundingBoxes;
+    std::uint32_t boundingBoxCount;
+    std::uint32_t reserved92;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionParameter {
+    std::uint32_t size;
+    std::uint32_t reserved4;
+    std::uint64_t reserved8;
+    std::uint64_t gazeTimestamp;
+    GazeObjectSelectionTransform transform;
+    std::uint32_t selectionMode;
+    std::uint32_t filterMode;
+    std::uint64_t timestamp;
+    const GazeObjectSelectionObject* objects;
+    std::uint32_t objectCount;
+    std::uint32_t reserved116;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionResult {
+    std::uint32_t size;
+    std::uint32_t selected;
+    std::uint64_t objectId;
+    std::uint64_t gazeTimestamp;
+    std::uint32_t gazeValid;
+    float origin[3];
+    float direction[3];
+    float distance;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionInitializeParameter {
+    std::uint32_t size;
+    std::uint32_t maxObjects;
+    void* memory;
+    std::uint32_t memorySize;
+    std::uint32_t reserved;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionMemoryParameter {
+    std::uint32_t size;
+    std::uint32_t maxObjects;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionMemoryInfo {
+    std::uint32_t size;
+    std::uint32_t memorySize;
+    std::uint64_t alignment;
+};
+
+}
+
+namespace Hmd2 {
+
+struct CalibrationPoint {
+    float x;
+    float y;
+    float z;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceHmd2ReprojectionGetStatus(Hmd2::ReprojectionStatus* status);
+int APS5_VABI sceHmd2GazeGetResult(const Hmd2::GazeResultParameter* param, Hmd2::GazeResult* result);
+int APS5_VABI sceHmd2GazeGetResultForFoveatedRendering(const Hmd2::GazeResultParameter* param, Hmd2::FoveatedRenderingResult* result);
+int APS5_VABI sceHmd2ReprojectionBeginFrame(std::uint64_t frameId);
+int APS5_VABI sceHmd2ReprojectionDisableMirroring();
+int APS5_VABI sceHmd2ReprojectionDisableVrMode();
+int APS5_VABI sceHmd2ReprojectionEnableMirroring(const Hmd2::MirroringParameter* parameter);
+int APS5_VABI sceHmd2ReprojectionEnableVrMode(std::uint64_t mode);
+int APS5_VABI sceHmd2ReprojectionGetPredictedDisplayTime(std::uint64_t frameId, std::uint64_t* time);
+int APS5_VABI sceHmd2ReprojectionInitialize(const Hmd2::ReprojectionInitializeParameter* parameter, const void* reserved);
+int APS5_VABI sceHmd2ReprojectionSetAllowPositionalReprojection(std::uint8_t mode);
+int APS5_VABI sceHmd2ReprojectionSetMirroringOption(const Hmd2::MirroringOption* option);
+int APS5_VABI sceHmd2ReprojectionSetParam(std::uint32_t bufferSetId, std::uint64_t frameId, const Hmd2::ReprojectionParameter* parameter, std::uint64_t reserved);
+int APS5_VABI sceHmd2ReprojectionSetParamWithBuffer(std::uint32_t bufferSetId, std::uint64_t frameId, const Hmd2::ReprojectionBufferedParameter* parameter, std::uint64_t reserved);
+int APS5_VABI sceHmd2ReprojectionSetRenderConfig(std::uint64_t flags, std::uint64_t reserved, std::uint64_t reserved2);
+int APS5_VABI sceHmd2ReprojectionSetTiming(std::int32_t timing);
+int APS5_VABI sceHmd2ReprojectionTerminate();
+int APS5_VABI sceHmd2ReprojectionSeeThroughDraw();
+int APS5_VABI sceHmd2ReprojectionSeeThroughIC();
+int APS5_VABI sceHmd2ReprojectionVideoOutEq();
+int APS5_VABI sceHmd2ReprojectionWaitShader();
+int APS5_VABI sceHmd2SeeThroughCallbackGetPoseDataFunc();
+int APS5_VABI sceHmd2ReprojectionClear();
+int APS5_VABI sceHmd2ReprojectionSet();
+int APS5_VABI sceHmd2ReprojectionSetEventGpuEnd(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2ReprojectionSetEventGpuStart(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2RpeorjectionSetParam();
+std::int32_t APS5_VABI Hmd2BeforeInitializeZero();
+int APS5_VABI sceHmd2SetIpdOffset(std::uint8_t enabled, float offset);
+int APS5_VABI sceHmd2GazeActivateGazeTracking(std::int32_t mode);
+std::int32_t APS5_VABI Hmd2BeforeInitializeNotInitialized();
+std::int32_t APS5_VABI Hmd2BeforeInitializeError0004();
+int APS5_VABI sceHmd2GazeStartUserCalibration();
+int APS5_VABI sceHmd2GazeStopUserCalibration();
+int APS5_VABI sceHmd2GazeSetUserCalibrationPoint(Hmd2::CalibrationPoint point);
+int APS5_VABI sceHmd2GazeSetEnabledEye(std::int32_t eye);
+std::int32_t APS5_VABI Hmd2BeforeInitializeParameterNull();
+int APS5_VABI sceHmd2GazeGetCalibrationData(std::int32_t type, Hmd2::GazeCalibrationData* data);
+int APS5_VABI sceHmd2GazeSetUserCalibrationData(const Hmd2::GazeUserCalibrationData* data);
+int APS5_VABI sceHmd2GazeObjectSelectionInitialize(const Hmd2::GazeObjectSelectionInitializeParameter* parameter);
+std::int32_t APS5_VABI Hmd2BeforeInitializeParameterInvalid();
+std::int32_t APS5_VABI Hmd2BeforeInitializeReprojectionNotInitialized();
+int APS5_VABI sceHmd2ReprojectionSetUserEventStart(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2ReprojectionSetUserEventEnd(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2ReprojectionClearUserEventStart();
+int APS5_VABI sceHmd2ReprojectionClearUserEventEnd();
+int APS5_VABI sceHmd2ReprojectionGetCurrentOutput(Hmd2::ReprojectionOutput* output);
+std::int32_t APS5_VABI Hmd2BeforeInitializeError002C();
+int APS5_VABI sceHmd2GazeObjectSelectionTerminate();
+std::int32_t APS5_VABI Hmd2BeforeInitializeError1002();
+std::int32_t APS5_VABI Hmd2BeforeInitializeError1003();
+std::int32_t APS5_VABI Hmd2BeforeInitializeMinusOne();
+std::int32_t APS5_VABI Hmd2BeforeInitializeValue0400();
+std::int32_t APS5_VABI Hmd2BeforeInitializeValue20000();
+std::int32_t APS5_VABI sceHmd2InternalTrackingOpen();
+std::int32_t APS5_VABI sceHmd2InternalTrackingStart();
+std::int32_t APS5_VABI sceHmd2InternalTrackingStop();
+std::int32_t APS5_VABI sceHmd2InternalTrackingClose();
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorOpen();
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorStart();
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorStop();
+std::int32_t APS5_VABI sceHmd2InternalLedDetectorClose();
+int APS5_VABI sceHmd2InternalSetPortStatus(void);
+int APS5_VABI sceHmd2InternalLedDetectorStartBySlot(void);
+int APS5_VABI sceHmd2InternalImageStartBySlot(void);
+int APS5_VABI sceHmd2InternalSetPortConnection(void);
+int APS5_VABI sceHmd2InternalSetCameraSeeThroughMode(void);
+int APS5_VABI sceHmd2InternalSetFakeLensSeparationDistance(void);
+int APS5_VABI sceHmd2InternalDfuSend(void);
+int APS5_VABI sceHmd2InternalLedDetectorOpenBySlot(void);
+int APS5_VABI sceHmd2InternalImageOpenBySlot(void);
+int APS5_VABI sceHmd2InternalLedDetectorStopBySlot(void);
+int APS5_VABI sceHmd2InternalSetDeviceConnection(void);
+int APS5_VABI sceHmd2InternalLedDetectorCloseBySlot(void);
+int APS5_VABI sceHmd2InternalSetSidetone(void);
+int APS5_VABI sceHmd2InternalGetDeviceId(void);
+int APS5_VABI sceHmd2InternalSetBrightness(void);
+int APS5_VABI sceHmd2InternalImageStopBySlot(void);
+int APS5_VABI sceHmd2InternalSetVibrationMode(void);
+int APS5_VABI sceHmd2InternalGetVr2dData(void);
+int APS5_VABI sceHmd2InternalImageCloseBySlot(void);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError0004(const void* a0);
+int APS5_VABI sceHmd2GazeGetDeviceStatus(std::int32_t* status);
+int APS5_VABI sceHmd2GazeGetUserCalibrationStatus(Hmd2::GazeUserCalibrationStatus* status);
+std::int32_t APS5_VABI Hmd2CheckFirstThenZero(const void* a0);
+int APS5_VABI sceHmd2SetFieldOfView(const Hmd2::FieldOfView* fieldOfView);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError1002(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstThenMinusOne(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstTwoThenParameterInvalid(const void* a0, const void* a1);
+int APS5_VABI sceHmd2GazeObjectSelectionQueryMemory(const Hmd2::GazeObjectSelectionMemoryParameter* parameter, Hmd2::GazeObjectSelectionMemoryInfo* info);
+int APS5_VABI sceHmd2GazeObjectSelectionGetSelectedObject(const Hmd2::GazeObjectSelectionParameter* parameter, Hmd2::GazeObjectSelectionResult* result);
+std::int32_t APS5_VABI Hmd2CheckSecondThenError002C(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2CheckFirstThenParameterInvalid(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckAllSixThenZero(const void* a0, const void* a1, const void* a2, const void* a3, const void* a4, const void* a5);
+std::int32_t APS5_VABI Hmd2CheckSecondThenParameterInvalid(const void* a0, const void* a1);
+int APS5_VABI sceHmd2GazeGetCalibrationDataMaxSize(std::int32_t type, std::uint32_t* size);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError800d0203(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError1003(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError1010(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1002(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1003(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenZero(const void* a0, const void* a1, const void* a2);
+std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenError1003(const void* a0, const void* a1, const void* a2);
+std::int32_t APS5_VABI Hmd2CheckSecondThenInvalidHandle(const void* a0, const void* a1);
+int APS5_VABI sceHmd2GazeInsertRawDataWithHandle(std::int32_t handle, Hmd2::GazeRawData* data);
+std::int32_t APS5_VABI Hmd2CheckSecondThenError1002(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2WriteStateTwo(void* a0);
+std::int32_t APS5_VABI Hmd2WriteSize0x2000Align0x100(std::uint64_t* a0, std::uint64_t* a1);
+std::int32_t APS5_VABI Hmd2WriteFourConstants(void* a0);
+std::int32_t APS5_VABI Hmd2WriteSixHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
+std::int32_t APS5_VABI Hmd2WriteTwelveHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
+std::int32_t APS5_VABI Hmd2SlotUpTo3CheckSecondThirdThenZero(std::uint64_t a0, const void* a1, const void* a2);
+std::int32_t APS5_VABI Hmd2SlotUpTo1ThenError1002(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo1CheckSecondThenError1002(std::uint64_t a0, const void* a1);
+std::int32_t APS5_VABI Hmd2SlotUpTo1ThenMinusOne(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2ThenMinusOne(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1002(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1003(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2CheckSecondThenError002C(std::uint64_t a0, const void* a1);
+std::int32_t APS5_VABI Hmd2IndexZeroCheckSecondThenZero(std::uint64_t a0, const void* a1);
+
+}
diff --git a/core/libs/prx/libSceHmd2/libSceHmd2.hpp b/core/libs/prx/libSceHmd2/libSceHmd2.hpp
new file mode 100644
index 0000000000..0c3f869cc7
--- /dev/null
+++ b/core/libs/prx/libSceHmd2/libSceHmd2.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceHmd2/Hmd2.hpp"
+#include "prx/libSceHmd2/include/Api.hpp"
diff --git a/core/libs/prx/libSceHmdSetupDialog/Export.cpp b/core/libs/prx/libSceHmdSetupDialog/Export.cpp
index 571643bf02..156643bf24 100644
--- a/core/libs/prx/libSceHmdSetupDialog/Export.cpp
+++ b/core/libs/prx/libSceHmdSetupDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHmdSetupDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceHmdSetupDialog/include/Api.hpp b/core/libs/prx/libSceHmdSetupDialog/include/Api.hpp
new file mode 100644
index 0000000000..abe27b70aa
--- /dev/null
+++ b/core/libs/prx/libSceHmdSetupDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceHmdSetupDialogInitialize(void);
+int APS5_VABI sceHmdSetupDialogOpen(const void* param);
+int APS5_VABI sceHmdSetupDialogUpdateStatus(void);
+int APS5_VABI sceHmdSetupDialogGetStatus(void);
+int APS5_VABI sceHmdSetupDialogGetResult(void* result);
+int APS5_VABI sceHmdSetupDialogClose(void);
+int APS5_VABI sceHmdSetupDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceHmdSetupDialog/libSceHmdSetupDialog.hpp b/core/libs/prx/libSceHmdSetupDialog/libSceHmdSetupDialog.hpp
new file mode 100644
index 0000000000..4b5986bfa2
--- /dev/null
+++ b/core/libs/prx/libSceHmdSetupDialog/libSceHmdSetupDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHmdSetupDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceHttp/Export.cpp b/core/libs/prx/libSceHttp/Export.cpp
index e54397a282..b9a1bfa606 100644
--- a/core/libs/prx/libSceHttp/Export.cpp
+++ b/core/libs/prx/libSceHttp/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include <cstdint>
 #include <cstddef>
 #ifdef _WIN32
@@ -24,52 +25,23 @@
 // No network is emulated: contexts, templates and requests can be created, but any request
 // that would touch the network fails with the library's network error.
 static std::atomic<int> g_nextHandle{1};
-struct HttpConnectionStat;
-struct HttpRequestStat;
 
-using HttpCookieSendCallback = int (APS5_VABI *)(std::int32_t, const char*, const char*, void*);
-using HttpSocketCreationCallback = void (APS5_VABI *)(std::int32_t, std::int32_t, void*);
-using HttpRequestStatusCallback = void (APS5_VABI *)(int, int, void*);
 struct RequestStatusRegistration {
     HttpRequestStatusCallback callback;
     void* argument;
 };
 static std::mutex g_statusMutex;
 static std::map<int, RequestStatusRegistration> g_statusCallbacks;
-struct HttpCookieStats {
-    std::size_t usedBytes;
-    std::uint32_t cookieCount;
-    std::uint32_t reserved;
-    std::size_t peakUsedBytes;
-    std::uint32_t peakCookieCount;
-    std::uint32_t evictedCookieCount;
-};
 
 static_assert(sizeof(HttpCookieStats) == 32);
 static_assert(offsetof(HttpCookieStats, peakUsedBytes) == 16);
 
-struct HttpMemoryPoolStats {
-    std::size_t poolSize;
-    std::size_t peakUsedSize;
-    std::size_t usedSize;
-};
-
-struct HttpRequestHeader {
-    const char* name;
-    const char* value;
-};
-
 static_assert(sizeof(HttpMemoryPoolStats) == 24);
 static_assert(offsetof(HttpMemoryPoolStats, peakUsedSize) == 8);
 static_assert(offsetof(HttpMemoryPoolStats, usedSize) == 16);
 static_assert(sizeof(HttpRequestHeader) == 16);
 static_assert(offsetof(HttpRequestHeader, value) == 8);
 
-struct HttpsCaList {
-    void* certs;
-    int certsNum;
-};
-
 #ifdef _WIN32
 struct HostMutex {
     SRWLOCK native = SRWLOCK_INIT;
@@ -138,6 +110,8 @@ struct HttpEpoll {
 
 static std::mutex g_stateMutex;
 static std::unordered_set<int> g_contexts;
+static std::unordered_map<int, uint64_t> g_contextPoolSizes;
+static std::unordered_map<int, std::pair<int, int>> g_contextRegisteredIds;
 static std::unordered_map<HttpEpollHandle, std::shared_ptr<HttpEpoll>> g_epolls;
 
 static std::shared_ptr<HttpEpoll> FindEpoll(HttpEpollHandle eh) {
@@ -184,6 +158,16 @@ int APS5_VABI sceHttpCookieFlush(int httpCtxId) {
     return 0;
 }
 
+int APS5_VABI sceHttpGetMemoryPoolStats(int httpCtxId, HttpMemoryPoolStats* currentStat) {
+    if (!currentStat) APS5_INVALID_ARG_EX;
+    std::lock_guard lock(g_stateMutex);
+    if (g_contexts.empty()) return ERROR_BEFORE_INIT;
+    const auto pool = g_contextPoolSizes.find(httpCtxId);
+    if (pool == g_contextPoolSizes.end()) return ERROR_INVALID_ID;
+    *currentStat = {static_cast<std::size_t>(pool->second), 0, 0};
+    return 0;
+}
+
 int APS5_VABI sceHttpCreateConnection(int tmpl_id, const char* server_name, const char* scheme, uint16_t port, int enable_keep_alive) {
     (void)server_name;
     (void)scheme;
@@ -293,11 +277,10 @@ int APS5_VABI sceHttpGetStatusCode(int request_id, int* status_code) {
 }
 
 int APS5_VABI sceHttpInit_nid_postfix(int memid, int ssl_ctx_id, uint64_t pool_size) {
-    (void)memid;
-    (void)ssl_ctx_id;
-    (void)pool_size;
     const int id = g_nextHandle.fetch_add(1, std::memory_order_relaxed);
     std::lock_guard lock(g_stateMutex);
+    g_contextPoolSizes[id] = pool_size;
+    g_contextRegisteredIds[id] = {memid, ssl_ctx_id};
     g_contexts.insert(id);
     AddHttpContext(id);
     return id;
@@ -420,6 +403,8 @@ int APS5_VABI sceHttpTerm_nid_postfix(int http_ctx_id) {
     std::vector<std::shared_ptr<HttpEpoll>> epolls;
     {
         std::lock_guard lock(g_stateMutex);
+        g_contextPoolSizes.erase(http_ctx_id);
+        g_contextRegisteredIds.erase(http_ctx_id);
         if (g_contexts.empty()) return ERROR_BEFORE_INIT;
         if (g_contexts.erase(http_ctx_id) == 0) return ERROR_INVALID_ID;
         RemoveHttpContext(http_ctx_id);
@@ -483,7 +468,6 @@ int APS5_VABI sceHttpSetChunkedTransferEnabled(int id, int enable) {
     return 0;
 }
 
-
 int APS5_VABI sceHttpSetInflateGZIPEnabled(int id, int enable) {
     (void)id;
     if (static_cast<uint32_t>(enable) > 1) return ERROR_INVALID_VALUE;
@@ -689,11 +673,6 @@ int APS5_VABI sceHttpDbgShowStat(void) {
     return 0;
 }
 
-int APS5_VABI sceHttpGetMemoryPoolStats(int contextId, HttpMemoryPoolStats* stats) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceHttpDbgShowConnectionStat(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -846,7 +825,13 @@ int APS5_VABI sceHttpSetHttp09Enabled(int id, int enabled) {
 }
 
 int APS5_VABI sceHttpGetRegisteredCtxIds(int contextId, int* netPoolId, int* sslContextId) {
-    NotImplemented_nid_no_patch(__func__);
+    if (!netPoolId || !sslContextId) APS5_INVALID_ARG_EX;
+    std::lock_guard lock(g_stateMutex);
+    if (g_contexts.empty()) return ERROR_BEFORE_INIT;
+    const auto ids = g_contextRegisteredIds.find(contextId);
+    if (ids == g_contextRegisteredIds.end()) return ERROR_INVALID_ID;
+    *netPoolId = ids->second.first;
+    *sslContextId = ids->second.second;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceHttp/include/Http.hpp b/core/libs/prx/libSceHttp/include/Http.hpp
new file mode 100644
index 0000000000..505be14652
--- /dev/null
+++ b/core/libs/prx/libSceHttp/include/Http.hpp
@@ -0,0 +1,157 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct HttpConnectionStat;
+struct HttpRequestStat;
+
+struct HttpCookieStats {
+    std::size_t usedBytes;
+    std::uint32_t cookieCount;
+    std::uint32_t reserved;
+    std::size_t peakUsedBytes;
+    std::uint32_t peakCookieCount;
+    std::uint32_t evictedCookieCount;
+};
+
+struct HttpMemoryPoolStats {
+    std::size_t poolSize;
+    std::size_t peakUsedSize;
+    std::size_t usedSize;
+};
+
+struct HttpRequestHeader {
+    const char* name;
+    const char* value;
+};
+
+struct HttpsCaList {
+    void* certs;
+    int certsNum;
+};
+
+using HttpCookieSendCallback = int (APS5_VABI *)(std::int32_t, const char*, const char*, void*);
+
+using HttpSocketCreationCallback = void (APS5_VABI *)(std::int32_t, std::int32_t, void*);
+
+using HttpRequestStatusCallback = void (APS5_VABI *)(int, int, void*);
+
+extern "C" {
+
+int APS5_VABI sceHttpAbortRequest(int requestId);
+int APS5_VABI sceHttpAbortRequestForce(int requestId);
+int APS5_VABI sceHttpAddRequestHeader(int id, const char* name, const char* value, uint32_t mode);
+int APS5_VABI sceHttpAuthCacheFlush(int httpCtxId);
+int APS5_VABI sceHttpCookieFlush(int httpCtxId);
+int APS5_VABI sceHttpCreateConnection(int tmplId, const char* serverName, const char* scheme, uint16_t port, int enableKeepAlive);
+int APS5_VABI sceHttpCreateConnectionWithURL(int tmplId, const char* url, int enableKeepAlive);
+int APS5_VABI sceHttpCreateEpoll(int httpCtxId, HttpEpollHandle* eh);
+int APS5_VABI sceHttpCreateRequest(int connId, int method, const char* path, uint64_t contentLength);
+int APS5_VABI sceHttpCreateRequestWithURL2(int connId, const char* method, const char* url, uint64_t contentLength);
+int APS5_VABI sceHttpCreateTemplate(int httpCtxId, const char* userAgent, int httpVer, int isAutoProxyConf);
+int APS5_VABI sceHttpDeleteConnection(int connId);
+int APS5_VABI sceHttpDeleteRequest(int reqId);
+int APS5_VABI sceHttpDeleteTemplate(int tmplId);
+int APS5_VABI sceHttpDestroyEpoll(int httpCtxId, HttpEpollHandle eh);
+int APS5_VABI sceHttpGetAllResponseHeaders(int requestId, char** header, size_t* headerSize);
+int APS5_VABI sceHttpGetResponseContentLength(int requestId, int* result, uint64_t* contentLength);
+int APS5_VABI sceHttpGetStatusCode(int requestId, int* statusCode);
+int APS5_VABI sceHttpInit_nid_postfix(int memid, int sslCtxId, uint64_t poolSize);
+int APS5_VABI sceHttpsDisableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttpSendRequest(int requestId, const void* postData, size_t size);
+int APS5_VABI sceHttpSetAuthEnabled(int id, int enable);
+int APS5_VABI sceHttpSetAuthInfoCallback(int id, HttpAuthInfoCallback callback, void* userArg);
+int APS5_VABI sceHttpSetCookieEnabled(int id, int enable);
+int APS5_VABI sceHttpSetAutoRedirect(int id, int enable);
+int APS5_VABI sceHttpSetConnectTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpSetEpoll(int id, HttpEpollHandle eh, void* userArg);
+int APS5_VABI sceHttpSetNonblock(int id, int enable);
+int APS5_VABI sceHttpTrySetNonblock(int id, int enable);
+int APS5_VABI sceHttpSetRecvTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpSetRecvBlockSize(int id, uint32_t blockSize);
+int APS5_VABI sceHttpSetResponseHeaderMaxSize(int id, uint64_t headerSize);
+int APS5_VABI sceHttpSetRequestContentLength(int requestId, uint64_t contentLength);
+int APS5_VABI sceHttpSetResolveRetry(int id, int32_t retry);
+int APS5_VABI sceHttpSetResolveTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpSetSendTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpsSetMinSslVersion(int id, uint32_t sslVersion);
+int APS5_VABI sceHttpsSetSslCallback(int id, HttpsCallback cbfunc, void* userArg);
+int APS5_VABI sceHttpTerm_nid_postfix(int httpCtxId);
+int APS5_VABI sceHttpUnsetEpoll(int id);
+int APS5_VABI sceHttpWaitRequest(HttpEpollHandle eh, HttpNBEvent* nbev, int maxevents, int timeout);
+int APS5_VABI sceHttpCreateRequestWithURL(int connId, int method, const char* url, uint64_t contentLength);
+int APS5_VABI sceHttpReadData(int requestId, void* data, size_t size);
+int APS5_VABI sceHttpRedirectCacheFlush(int httpCtxId);
+int APS5_VABI sceHttpSetChunkedTransferEnabled(int id, int enable);
+int APS5_VABI sceHttpSetInflateGZIPEnabled(int id, int enable);
+int APS5_VABI sceHttpSetRequestStatusCallback(int id, HttpRequestStatusCallback callback, void* argument);
+int APS5_VABI sceHttpParseResponseHeader(const char* header, std::size_t headerLen, const char* fieldStr, const char** fieldValue, std::size_t* valueLen);
+int APS5_VABI sceHttpCreateRequest2(int connId, const char* method, const char* path, uint64_t contentLength);
+int APS5_VABI sceHttpsEnableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttpsLoadCert(int httpCtxId, int num, void* caList, void* cert, void* key);
+int APS5_VABI sceHttpsUnloadCert(int httpCtxId);
+int APS5_VABI sceHttpGetLastErrno(int requestId, int* errnoOut);
+int APS5_VABI sceHttpsGetSslError(int id, int* errNum, uint32_t* detail);
+int APS5_VABI sceHttpSetCookieRecvCallback(int id, HttpCookieRecvCallback cbfunc, void* userArg);
+int APS5_VABI sceHttpsSetSslVersion(int id, int sslVersion);
+int APS5_VABI sceHttpSetRedirectCallback(int id, HttpRedirectCallback cbfunc, void* userArg);
+int APS5_VABI sceHttpAbortWaitRequest(HttpEpollHandle eh);
+int APS5_VABI sceHttpsGetCaList(int httpCtxId, HttpsCaList* caList);
+int APS5_VABI sceHttpsFreeCaList(int httpCtxId, HttpsCaList* caList);
+int APS5_VABI sceHttpAuthCacheImport(int contextId, const void* buffer, std::size_t size);
+int APS5_VABI sceHttpAuthCacheExport(int contextId, void* buffer, std::size_t size, std::size_t* requiredSize);
+int APS5_VABI sceHttpDbgEnableProfile(void);
+int APS5_VABI sceHttpDbgSetPrintf(void);
+int APS5_VABI sceHttpDbgShowStat(void);
+int APS5_VABI sceHttpGetMemoryPoolStats(int contextId, HttpMemoryPoolStats* stats);
+int APS5_VABI sceHttpDbgShowConnectionStat(void);
+int APS5_VABI sceHttpDbgShowRequestStat(void);
+int APS5_VABI sceHttpDbgShowMemoryPoolStat(void);
+int APS5_VABI sceHttpDbgGetConnectionStat(std::int32_t connectionId, HttpConnectionStat* stat);
+int APS5_VABI sceHttpDbgGetRequestStat(std::int32_t requestId, HttpRequestStat* stat);
+int APS5_VABI sceHttpAddRequestHeaderRaw(int id, const char* header, int mode);
+int APS5_VABI sceHttpRemoveRequestHeader(int id, const char* name);
+int APS5_VABI sceHttpGetAuthEnabled(int id, int* enable);
+int APS5_VABI sceHttpSetEpollId(std::int32_t id, std::int32_t epollId, void* userArg);
+int APS5_VABI sceHttpGetEpollId(std::int32_t id, std::int32_t* epollId, void** userArg);
+int APS5_VABI sceHttpGetCookie(int contextId, const char* url, char* cookie, std::size_t* requiredSize, std::size_t size);
+int APS5_VABI sceHttpGetCookieEnabled(int id, int* enable);
+int APS5_VABI sceHttpAddCookie(int contextId, const char* url, const char* cookie, std::size_t size);
+int APS5_VABI sceHttpSetCookieSendCallback(std::int32_t id, HttpCookieSendCallback callback, void* userArg);
+int APS5_VABI sceHttpCookieExport(int contextId, void* buffer, std::size_t size, std::size_t* requiredSize);
+int APS5_VABI sceHttpCookieImport(int contextId, const void* buffer, std::size_t size);
+int APS5_VABI sceHttpSetCookieTotalMaxSize(int contextId, std::uint32_t size);
+int APS5_VABI sceHttpSetCookieMaxSize(int contextId, std::uint32_t size);
+int APS5_VABI sceHttpSetCookieMaxNum(int contextId, std::uint32_t count);
+int APS5_VABI sceHttpSetCookieMaxNumPerDomain(int contextId, std::uint32_t count);
+int APS5_VABI sceHttpGetCookieStats(int id, HttpCookieStats* stats);
+int APS5_VABI sceHttpSetPriorityOption(int id, int priority);
+int APS5_VABI sceHttpSetPolicyOption(int id, int policy);
+int APS5_VABI sceHttpRequestGetAllHeaders(int requestId, HttpRequestHeader* headers, std::uint32_t* headerCount, char* contentLength, std::size_t* contentLengthSize);
+int APS5_VABI sceHttpSetDefaultAcceptEncodingGZIPEnabled(int httpCtxId, int enable);
+int APS5_VABI sceHttpSetProxy(int id, int, int, const char* hostname, std::uint16_t);
+int APS5_VABI sceHttpSetSocketCreationCallback(std::int32_t id, HttpSocketCreationCallback callback, void* userArg);
+int APS5_VABI sceHttpSetHttp09Enabled(int id, int enabled);
+int APS5_VABI sceHttpGetRegisteredCtxIds(int contextId, int* netPoolId, int* sslContextId);
+int APS5_VABI sceHttpGetConnectionStat(std::int32_t connectionId, HttpConnectionStat* stat);
+int APS5_VABI sceHttpAddQuery(int id, const char* query);
+int APS5_VABI sceHttpSetDelayBuildRequestEnabled(int id, int enabled);
+int APS5_VABI sceHttpGetAutoRedirect(int id, int* enable);
+int APS5_VABI sceHttpGetNonblock(int id, int* enable);
+int APS5_VABI sceHttpTryGetNonblock(int id, int* enable);
+int APS5_VABI sceHttpGetAcceptEncodingGZIPEnabled(int id, int* enable);
+int APS5_VABI sceHttpSetAcceptEncodingGZIPEnabled(int id, int enable);
+int APS5_VABI sceHttpGetEpoll(int id, HttpEpollHandle* epoll, void** argument);
+int APS5_VABI sceHttpCacheRedirectedConnectionEnabled(int id, int enable);
+int APS5_VABI sceHttpsEnableOptionPrivate(int id, std::uint32_t sslFlags);
+int APS5_VABI sceHttpsDisableOptionPrivate(int id, std::uint32_t sslFlags);
+int APS5_VABI sceHttpParseStatusLine(const char* statusLine, size_t lineLen, int32_t* httpMajorVer, int32_t* httpMinorVer, int32_t* responseCode, const char** reasonPhrase, size_t* phraseLen);
+int APS5_VABI sceHttpUriBuild(char* out, size_t* requiredSize, size_t capacity, const SceHttpUriElement* element, uint32_t option);
+int APS5_VABI sceHttpUriEscape(char* out, size_t* require, size_t prepare, const char* in);
+int APS5_VABI sceHttpUriUnescape(char* out, size_t* requiredSize, size_t capacity, const char* input);
+int APS5_VABI sceHttpUriMerge(char* mergedUrl, const char* url, const char* relativeUri, size_t* require, size_t prepare, uint32_t option);
+int APS5_VABI sceHttpUriParse(SceHttpUriElement* out, const char* srcUrl, void* pool, size_t* require, size_t prepare);
+int APS5_VABI sceHttpUriCopy(SceHttpUriElement* out, const SceHttpUriElement* src, void* pool, size_t prepare, size_t* require);
+int APS5_VABI sceHttpUriSweepPath(char* dst, const char* src, size_t srcSize);
+
+}
diff --git a/core/libs/prx/libSceHttp/libSceHttp.hpp b/core/libs/prx/libSceHttp/libSceHttp.hpp
new file mode 100644
index 0000000000..69e0774038
--- /dev/null
+++ b/core/libs/prx/libSceHttp/libSceHttp.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHttp/include/Http.hpp"
diff --git a/core/libs/prx/libSceHttp/src/Options.cpp b/core/libs/prx/libSceHttp/src/Options.cpp
index 710b33311a..415c462ee4 100644
--- a/core/libs/prx/libSceHttp/src/Options.cpp
+++ b/core/libs/prx/libSceHttp/src/Options.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "prx/libSceHttp/src/Options.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceHttp/src/HttpErrors.hpp"
diff --git a/core/libs/prx/libSceHttp/src/Parse.cpp b/core/libs/prx/libSceHttp/src/Parse.cpp
index 409e18cf1b..1662a05f43 100644
--- a/core/libs/prx/libSceHttp/src/Parse.cpp
+++ b/core/libs/prx/libSceHttp/src/Parse.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
diff --git a/core/libs/prx/libSceHttp/src/Uri.cpp b/core/libs/prx/libSceHttp/src/Uri.cpp
index 2cf41f6f6b..f2c4f83d2d 100644
--- a/core/libs/prx/libSceHttp/src/Uri.cpp
+++ b/core/libs/prx/libSceHttp/src/Uri.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include <algorithm>
 #include <charconv>
 #include <cstdint>
@@ -10,8 +11,6 @@
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libSceHttp/src/HttpErrors.hpp"
 
-extern "C" int APS5_VABI sceHttpUriSweepPath(char* dst, const char* src, size_t srcSize);
-
 namespace {
 
 constexpr uint32_t URI_BUILD_WITH_SCHEME = 0x01;
diff --git a/core/libs/prx/libSceHttp2/Export.cpp b/core/libs/prx/libSceHttp2/Export.cpp
index d97f8d6c6d..7cb14fc27a 100644
--- a/core/libs/prx/libSceHttp2/Export.cpp
+++ b/core/libs/prx/libSceHttp2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp2/include/Http2.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -62,13 +63,6 @@ static bool HandleIsLive(int id) {
     return FindAnyHandle(id) != nullptr;
 }
 
-struct Http2MemoryPoolStats {
-    size_t pool_size;
-    size_t max_inuse_size;
-    size_t current_inuse_size;
-    int32_t reserved;
-};
-
 static std::mutex g_completionsMutex;
 static std::unordered_map<int, std::deque<Http2AsyncResult>> g_completions;
 
@@ -104,11 +98,6 @@ static int CompleteAsync(const char* function, int req_id, const Http2AsyncOptio
     return 0;
 }
 
-using Http2WebSocketTextCallback = void (APS5_VABI*)(std::int32_t requestId, const char* text, std::uint32_t flags, void* userData);
-using Http2WebSocketDataCallback = void (APS5_VABI*)(std::int32_t requestId, const void* data, std::size_t dataSize, std::uint32_t flags, void* userData);
-using Http2WebSocketCloseCallback = void (APS5_VABI*)(std::int32_t requestId, const std::uint16_t* status, const char* reason, std::uint32_t flags, void* userData);
-using Http2WebSocketErrorCallback = void (APS5_VABI*)(std::int32_t requestId, std::int32_t error, void* userData);
-
 extern "C" {
 
 int APS5_VABI sceHttp2AddRequestHeader(int id, const char* name, const char* value, uint32_t mode) {
@@ -385,7 +374,6 @@ int APS5_VABI sceHttp2SetRequestNoContentLength(int id) {
     return 0;
 }
 
-
 int APS5_VABI sceHttp2SetResolveRetry(int id, int32_t retry) {
     (void)id;
     (void)retry;
diff --git a/core/libs/prx/libSceHttp2/include/Http2.hpp b/core/libs/prx/libSceHttp2/include/Http2.hpp
new file mode 100644
index 0000000000..bf7b34e6a7
--- /dev/null
+++ b/core/libs/prx/libSceHttp2/include/Http2.hpp
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct Http2MemoryPoolStats {
+    size_t pool_size;
+    size_t max_inuse_size;
+    size_t current_inuse_size;
+    int32_t reserved;
+};
+
+using Http2WebSocketTextCallback = void (APS5_VABI*)(std::int32_t requestId, const char* text, std::uint32_t flags, void* userData);
+
+using Http2WebSocketDataCallback = void (APS5_VABI*)(std::int32_t requestId, const void* data, std::size_t dataSize, std::uint32_t flags, void* userData);
+
+using Http2WebSocketCloseCallback = void (APS5_VABI*)(std::int32_t requestId, const std::uint16_t* status, const char* reason, std::uint32_t flags, void* userData);
+
+using Http2WebSocketErrorCallback = void (APS5_VABI*)(std::int32_t requestId, std::int32_t error, void* userData);
+
+extern "C" {
+
+int APS5_VABI sceHttp2AddRequestHeader(int id, const char* name, const char* value, uint32_t mode);
+int APS5_VABI sceHttp2CreateRequestWithURL(int tmplId, const char* method, const char* url, uint64_t contentLength);
+int APS5_VABI sceHttp2CreateTemplate(int libHttp2CtxId, const char* userAgent, int httpVer, int isAutoProxyConf);
+int APS5_VABI sceHttp2DeleteRequest(int reqId);
+int APS5_VABI sceHttp2DeleteTemplate(int tmplId);
+int APS5_VABI sceHttp2GetAllResponseHeaders(int reqId, char** header, size_t* headerSize);
+int APS5_VABI sceHttp2GetResponseContentLength(int reqId, int* result, uint64_t* contentLength);
+int APS5_VABI sceHttp2GetStatusCode(int reqId, int* statusCode);
+int APS5_VABI sceHttp2Init(int libnetMemId, int libsslCtxId, size_t poolSize, int maxConcurrentRequest);
+int APS5_VABI sceHttp2ReadData(int reqId, void* data, size_t size);
+int APS5_VABI sceHttp2ReadDataAsync(int reqId, void* data, size_t size, void* kqueueOption, void* option);
+int APS5_VABI sceHttp2SendRequest(int reqId, const void* postData, size_t size);
+int APS5_VABI sceHttp2SendRequestAsync(int reqId, const void* postData, size_t size, Http2AsyncOption* kqueueOption, void* option);
+int APS5_VABI sceHttp2SetAuthEnabled(int id, int isEnable);
+int APS5_VABI sceHttp2SetAutoRedirect(int id, int enable);
+int APS5_VABI sceHttp2SetConnectionWaitTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetConnectTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetInflateGZIPEnabled(int id, int enable);
+int APS5_VABI sceHttp2SetRecvTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetRedirectCallback(int id, void* cbFunc, void* userArg);
+int APS5_VABI sceHttp2SetRequestContentLength(int id, uint64_t contentLength);
+int APS5_VABI sceHttp2SetResolveTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetSendTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetSslCallback(int id, void* cbFunc, void* userArg);
+int APS5_VABI sceHttp2SetTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SslDisableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttp2SslEnableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttp2SetMinSslVersion(int id, uint32_t sslVersion);
+int APS5_VABI sceHttp2Term(int libHttp2CtxId);
+int APS5_VABI sceHttp2WaitAsync(int reqId, Http2AsyncResult* result, uint32_t* timeout, void* option);
+int APS5_VABI sceHttp2AbortRequest(int reqId);
+int APS5_VABI sceHttp2GetMemoryPoolStats(int libHttp2CtxId, Http2MemoryPoolStats* stats);
+int APS5_VABI sceHttp2CookieFlush(int id);
+int APS5_VABI sceHttp2CreateCookieBox(std::size_t poolSize);
+int APS5_VABI sceHttp2DeleteCookieBox(int cookieBoxId);
+int APS5_VABI sceHttp2SetCookieBox(int id, int cookieBoxId);
+int APS5_VABI sceHttp2SetRequestNoContentLength(int id);
+int APS5_VABI sceHttp2SetResolveRetry(int id, int32_t retry);
+int APS5_VABI sceHttp2WebSocketCreateRequest(std::int32_t templateId, const char* url, Http2WebSocketTextCallback textCallback, Http2WebSocketDataCallback dataCallback, Http2WebSocketCloseCallback closeCallback, Http2WebSocketErrorCallback errorCallback, void* receiveBuffer, std::size_t receiveBufferSize, void* userData, const void* option);
+int APS5_VABI sceHttp2WebSocketCloseAsync(std::int32_t requestId, const std::uint16_t* status, const char* reason, std::uint8_t flags, const Http2AsyncOption* asyncOption, const void* option);
+int APS5_VABI sceHttp2WebSocketSendTextMessageAsync(std::int32_t requestId, const char* text, std::uint8_t flags, const Http2AsyncOption* asyncOption, const void* option);
+int APS5_VABI sceHttp2WebSocketSendDataMessageAsync(std::int32_t requestId, const void* data, std::size_t dataSize, std::uint8_t flags, const Http2AsyncOption* asyncOption, const void* option);
+int APS5_VABI sceHttp2WebSocketSetPingInterval(std::int32_t requestId, std::uint32_t intervalMicroseconds);
+int APS5_VABI sceHttp2WebSocketSetPingTimeout(std::int32_t requestId, std::uint32_t timeoutMicroseconds);
+int APS5_VABI sceHttp2AddCookie(void);
+int APS5_VABI sceHttp2AuthCacheFlush(void);
+int APS5_VABI sceHttp2CookieExport(void);
+int APS5_VABI sceHttp2CookieImport(void);
+int APS5_VABI sceHttp2GetAuthEnabled(void);
+int APS5_VABI sceHttp2GetAutoRedirect(void);
+int APS5_VABI sceHttp2GetCookie(void);
+int APS5_VABI sceHttp2GetCookieBox(void);
+int APS5_VABI sceHttp2GetCookieStats(void);
+int APS5_VABI sceHttp2RedirectCacheFlush(void);
+int APS5_VABI sceHttp2RemoveRequestHeader(void);
+int APS5_VABI sceHttp2SetAuthInfoCallback(void);
+int APS5_VABI sceHttp2SetCookieMaxNum(void);
+int APS5_VABI sceHttp2SetCookieMaxNumPerDomain(void);
+int APS5_VABI sceHttp2SetCookieMaxSize(void);
+int APS5_VABI sceHttp2SetCookieRecvCallback(void);
+int APS5_VABI sceHttp2SetCookieSendCallback(void);
+int APS5_VABI sceHttp2SetPreSendCallback(void);
+
+}
diff --git a/core/libs/prx/libSceHttp2/libSceHttp2.hpp b/core/libs/prx/libSceHttp2/libSceHttp2.hpp
new file mode 100644
index 0000000000..d6ec538a09
--- /dev/null
+++ b/core/libs/prx/libSceHttp2/libSceHttp2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHttp2/include/Http2.hpp"
diff --git a/core/libs/prx/libSceHttpCache/Export.cpp b/core/libs/prx/libSceHttpCache/Export.cpp
index 12a2497b87..b7f0f3ef35 100644
--- a/core/libs/prx/libSceHttpCache/Export.cpp
+++ b/core/libs/prx/libSceHttpCache/Export.cpp
@@ -1,46 +1,9 @@
+#include "prx/libSceHttpCache/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct HttpCacheHeader {
-    const char* name;
-    const char* value;
-};
-
-struct HttpCacheRequest {
-    std::uint32_t method;
-    std::uint32_t reserved;
-    const char* url;
-    std::size_t headerCount;
-    const HttpCacheHeader* headers;
-};
-
-struct HttpCacheResponseHeader {
-    std::uint32_t statusCode;
-    std::uint32_t reserved;
-    std::size_t headerCount;
-    const HttpCacheHeader* headers;
-};
-
-struct HttpCacheResponse {
-    std::uint32_t statusCode;
-    std::uint32_t reserved;
-    std::size_t headerCount;
-    const HttpCacheHeader* headers;
-    std::uint64_t contentLength;
-};
-
-struct HttpCacheQuotaEntry {
-    const char* name;
-    std::uint64_t size;
-};
-
-struct HttpCacheQuota {
-    std::size_t count;
-    const HttpCacheQuotaEntry* entries;
-};
-
 static_assert(sizeof(HttpCacheHeader) == 16);
 static_assert(sizeof(HttpCacheRequest) == 32);
 static_assert(offsetof(HttpCacheRequest, url) == 8);
@@ -162,7 +125,6 @@ int APS5_VABI sceHttpCacheTerm(std::int32_t cacheId) {
     return 0;
 }
 
-
 int APS5_VABI sceHttpCacheClearAllUserTags() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -174,7 +136,6 @@ int APS5_VABI sceHttpCacheClearCacheInfo() {
 }
 
 int APS5_VABI sceHttpCacheDebugSetUrl() {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
diff --git a/core/libs/prx/libSceHttpCache/include/Api.hpp b/core/libs/prx/libSceHttpCache/include/Api.hpp
new file mode 100644
index 0000000000..634bf42348
--- /dev/null
+++ b/core/libs/prx/libSceHttpCache/include/Api.hpp
@@ -0,0 +1,75 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+
+struct HttpCacheHeader {
+    const char* name;
+    const char* value;
+};
+
+struct HttpCacheRequest {
+    std::uint32_t method;
+    std::uint32_t reserved;
+    const char* url;
+    std::size_t headerCount;
+    const HttpCacheHeader* headers;
+};
+
+struct HttpCacheResponseHeader {
+    std::uint32_t statusCode;
+    std::uint32_t reserved;
+    std::size_t headerCount;
+    const HttpCacheHeader* headers;
+};
+
+struct HttpCacheResponse {
+    std::uint32_t statusCode;
+    std::uint32_t reserved;
+    std::size_t headerCount;
+    const HttpCacheHeader* headers;
+    std::uint64_t contentLength;
+};
+
+struct HttpCacheQuotaEntry {
+    const char* name;
+    std::uint64_t size;
+};
+
+struct HttpCacheQuota {
+    std::size_t count;
+    const HttpCacheQuotaEntry* entries;
+};
+
+extern "C" {
+
+int APS5_VABI sceHttpCacheClear(std::int32_t cacheId, std::int32_t userId, const char* tag);
+int APS5_VABI sceHttpCacheClearAll(std::int32_t cacheId, std::int32_t userId);
+int APS5_VABI sceHttpCacheCompleteRequest(std::int32_t requestId);
+int APS5_VABI sceHttpCacheCreateRequest(std::int32_t cacheId, std::int32_t userId);
+int APS5_VABI sceHttpCacheCreateRequestWithTag(std::int32_t cacheId, std::int32_t userId, const char* tag);
+int APS5_VABI sceHttpCacheDeleteRequest(std::int32_t requestId);
+int APS5_VABI sceHttpCacheInit(std::size_t poolSize);
+int APS5_VABI sceHttpCacheReadData(std::int32_t requestId, std::size_t size, void* data);
+int APS5_VABI sceHttpCacheRetrieve(std::int32_t requestId, const HttpCacheRequest* request, HttpCacheResponse* response, HttpCacheRequest* nextRequest, std::int32_t* result);
+int APS5_VABI sceHttpCacheRetrieveWithMemoryPool(std::int32_t requestId, const HttpCacheRequest* request, HttpCacheResponse* response, HttpCacheRequest* nextRequest, std::int32_t* result, void* pool, std::size_t* requiredSize, std::size_t poolSize);
+int APS5_VABI sceHttpCacheRevalidate(std::int32_t requestId, const HttpCacheResponseHeader* header, HttpCacheResponse* response, std::int32_t* result);
+int APS5_VABI sceHttpCacheRevalidateWithMemoryPool(std::int32_t requestId, const HttpCacheResponseHeader* header, HttpCacheResponse* response, std::int32_t* result, void* pool, std::size_t* requiredSize, std::size_t poolSize);
+int APS5_VABI sceHttpCacheSetCacheSharing(std::uint8_t enabled);
+int APS5_VABI sceHttpCacheSetData(std::int32_t requestId, const void* data, std::size_t size);
+int APS5_VABI sceHttpCacheSetQuota(std::int32_t cacheId, const HttpCacheQuota* quota);
+int APS5_VABI sceHttpCacheSetResponseHeader(std::int32_t requestId, const HttpCacheResponseHeader* header);
+int APS5_VABI sceHttpCacheSystemClearAll(const char* path);
+int APS5_VABI sceHttpCacheSystemInit(const char* path);
+int APS5_VABI sceHttpCacheSystemSendStatistics();
+int APS5_VABI sceHttpCacheSystemShutdown();
+int APS5_VABI sceHttpCacheSystemTerm();
+int APS5_VABI sceHttpCacheTerm(std::int32_t cacheId);
+int APS5_VABI sceHttpCacheClearAllUserTags();
+int APS5_VABI sceHttpCacheClearCacheInfo();
+int APS5_VABI sceHttpCacheDebugSetUrl();
+int APS5_VABI sceHttpCacheRegisterCacheInfoUrl();
+int APS5_VABI sceHttpCacheRemoveTag();
+
+}
diff --git a/core/libs/prx/libSceHttpCache/libSceHttpCache.hpp b/core/libs/prx/libSceHttpCache/libSceHttpCache.hpp
new file mode 100644
index 0000000000..1a210e0748
--- /dev/null
+++ b/core/libs/prx/libSceHttpCache/libSceHttpCache.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHttpCache/include/Api.hpp"
diff --git a/core/libs/prx/libSceHubAppUtil/Export.cpp b/core/libs/prx/libSceHubAppUtil/Export.cpp
index b4a5ae963d..2ed0d86fca 100644
--- a/core/libs/prx/libSceHubAppUtil/Export.cpp
+++ b/core/libs/prx/libSceHubAppUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHubAppUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceHubAppUtil/include/Api.hpp b/core/libs/prx/libSceHubAppUtil/include/Api.hpp
new file mode 100644
index 0000000000..721784ffcb
--- /dev/null
+++ b/core/libs/prx/libSceHubAppUtil/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceHubAppUtilDeeplinkToLiveDetailView();
+int APS5_VABI sceHubAppUtilDeeplinkToPSSubscriptions();
+int APS5_VABI sceHubAppUtilGetInstallationStatus();
+
+}
diff --git a/core/libs/prx/libSceHubAppUtil/libSceHubAppUtil.hpp b/core/libs/prx/libSceHubAppUtil/libSceHubAppUtil.hpp
new file mode 100644
index 0000000000..6636d9db00
--- /dev/null
+++ b/core/libs/prx/libSceHubAppUtil/libSceHubAppUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHubAppUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceIcu/libSceIcu.hpp b/core/libs/prx/libSceIcu/libSceIcu.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceIcu/libSceIcu.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceIdu/Export.cpp b/core/libs/prx/libSceIdu/Export.cpp
index def1b88f9a..753cc6aa8b 100644
--- a/core/libs/prx/libSceIdu/Export.cpp
+++ b/core/libs/prx/libSceIdu/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIdu/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceIdu/include/Api.hpp b/core/libs/prx/libSceIdu/include/Api.hpp
new file mode 100644
index 0000000000..4e9d5daaaa
--- /dev/null
+++ b/core/libs/prx/libSceIdu/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceIduGetEnv();
+int APS5_VABI sceIduInit();
+int APS5_VABI sceIduInstallPkg();
+int APS5_VABI sceIduIsAppInstalled();
+int APS5_VABI sceIduIsRifInstalled();
+int APS5_VABI sceIduIsStaffMode();
+int APS5_VABI sceIduReboot();
+int APS5_VABI sceIduTerm();
+
+}
diff --git a/core/libs/prx/libSceIdu/libSceIdu.hpp b/core/libs/prx/libSceIdu/libSceIdu.hpp
new file mode 100644
index 0000000000..b899940205
--- /dev/null
+++ b/core/libs/prx/libSceIdu/libSceIdu.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceIdu/include/Api.hpp"
diff --git a/core/libs/prx/libSceImageUtil/libSceImageUtil.hpp b/core/libs/prx/libSceImageUtil/libSceImageUtil.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceImageUtil/libSceImageUtil.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceIme/Export.cpp b/core/libs/prx/libSceIme/Export.cpp
index 9485063034..ff3fdeedde 100644
--- a/core/libs/prx/libSceIme/Export.cpp
+++ b/core/libs/prx/libSceIme/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include <atomic>
 #include <algorithm>
 #include <cstdint>
@@ -15,25 +16,6 @@
 #include "prx/libSceIme/include/ImeFilterText.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
 
-struct ImeVshContext;
-struct ImeVshParameter;
-struct ImePreeditMetaInfo;
-struct ImeDictionaryWord;
-
-struct ImeVshCaretGeometry {
-    std::int32_t x;
-    std::int32_t y;
-    std::uint32_t height;
-    std::uint32_t index;
-};
-
-struct ImeVshTextGeometry {
-    std::int32_t x;
-    std::int32_t y;
-    std::uint32_t width;
-    std::uint32_t height;
-};
-
 static_assert(sizeof(ImeEditText) == 64);
 static_assert(offsetof(ImeEvent, param) == 8);
 static_assert(sizeof(ImeVshCaretGeometry) == 16);
@@ -480,7 +462,7 @@ int APS5_VABI sceImeKeyboardGetResourceId(int32_t user_id, KeyboardResourceIdArr
 }
 
 int APS5_VABI sceImeKeyboardOpen(int32_t user_id, const KeyboardParam* param) {
- if (!param) APS5_INVALID_ARG_EX;
+ if (!param) return ErrorInvalidAddress;
  std::lock_guard lock(g_keyboardMutex);
  if (!g_openKeyboards.insert(user_id).second) return ErrorBusy;
  return 0;
@@ -548,7 +530,7 @@ int APS5_VABI sceImeSetTextGeometry(TextAreaMode mode, const TextGeometry* geome
 }
 
 int APS5_VABI sceImeUpdate(EventHandler handler) {
-    if (!handler) APS5_INVALID_ARG_EX;
+    if (!handler) return ErrorInvalidHandler;
     for (;;) {
         ImeEvent event{};
         void* arg = nullptr;
diff --git a/core/libs/prx/libSceIme/include/Api.hpp b/core/libs/prx/libSceIme/include/Api.hpp
new file mode 100644
index 0000000000..50ed144cfc
--- /dev/null
+++ b/core/libs/prx/libSceIme/include/Api.hpp
@@ -0,0 +1,93 @@
+#pragma once
+
+#include "prx/libSceIme/include/ImeFilterText.hpp"
+#include "SceTypes.hpp"
+
+struct ImeDictionaryWord;
+
+struct ImeVshContext;
+
+struct ImePreeditMetaInfo;
+
+struct ImeVshCaretGeometry {
+    std::int32_t x;
+    std::int32_t y;
+    std::uint32_t height;
+    std::uint32_t index;
+};
+
+struct ImeVshParameter;
+
+struct ImeVshTextGeometry {
+    std::int32_t x;
+    std::int32_t y;
+    std::uint32_t width;
+    std::uint32_t height;
+};
+
+extern "C" {
+
+int APS5_VABI sceImeOpen_nid_postfix(const Param* param, const ExtendedParam* extended);
+int APS5_VABI sceImeClose_nid_postfix(void);
+int APS5_VABI sceImeGetPanelPositionAndForm(PositionAndForm* form);
+int APS5_VABI sceImeGetPanelSize(const Param* param, uint32_t* width, uint32_t* height);
+int APS5_VABI sceImeKeyboardClose(int32_t userId);
+int APS5_VABI sceImeKeyboardGetInfo(uint32_t resourceId, KeyboardInfo* info);
+int APS5_VABI sceImeKeyboardGetResourceId(int32_t userId, KeyboardResourceIdArray* resourceIds);
+int APS5_VABI sceImeKeyboardOpen(int32_t userId, const KeyboardParam* param);
+int APS5_VABI sceImeKeyboardSetMode(int32_t userId, uint32_t mode);
+int APS5_VABI sceImeFilterText(char16_t* dst, int32_t* outLength, uint32_t capacity, const ime_filter::FilterParam* param, const char16_t* src, uint32_t srcLength);
+int APS5_VABI sceImeCheckFilterText(const void* param);
+void APS5_VABI sceImeParamInit(Param* param);
+int APS5_VABI sceImeSetCaret(const Caret* caret);
+int APS5_VABI sceImeSetConsecutiveClauseConversionEnabled(std::uint8_t enabled);
+int APS5_VABI sceImeSetText(const char16_t* text, uint32_t length);
+int APS5_VABI sceImeSetTextGeometry(TextAreaMode mode, const TextGeometry* geometry);
+int APS5_VABI sceImeUpdate(EventHandler handler);
+int APS5_VABI sceImeVshOpen(ImeVshContext** context, const ImeVshParameter* parameter, const char16_t* text);
+int APS5_VABI sceImeKeyboardUpdate(EventHandler handler);
+int APS5_VABI sceImeVshUpdate(ImeVshContext* context);
+int APS5_VABI sceImeVshUpdateContext(ImeVshContext* context, const char16_t* text, std::uint32_t caretIndex);
+int APS5_VABI sceImeVshClearPreedit(ImeVshContext* context);
+int APS5_VABI sceImeVshNotifySetText(ImeVshContext* context, const char16_t* text, std::uint32_t length);
+int APS5_VABI sceImeVshSetCaretGeometry(ImeVshContext* context, const ImeVshCaretGeometry* geometry);
+int APS5_VABI sceImeVshConfirmPreedit(ImeVshContext* context);
+int APS5_VABI sceImeVshSetCaretIndexInPreedit(ImeVshContext* context, std::int32_t index);
+int APS5_VABI sceImeVshSetPreeditGeometry(ImeVshContext* context, const ImeVshTextGeometry* geometry);
+int APS5_VABI sceImeVshSetSelectGeometry(ImeVshContext* context, const ImeVshTextGeometry* geometry);
+int APS5_VABI sceImeVshClose(ImeVshContext* context);
+int APS5_VABI sceImeVshGetPanelPositionAndForm(ImeVshContext* context, PositionAndForm* form);
+int APS5_VABI sceImeSetCandidateIndex(std::int32_t index);
+int APS5_VABI sceImeConfirmCandidate(std::int32_t index);
+int APS5_VABI sceImeDisableController(void);
+int APS5_VABI sceImeSetVoiceDictationEnabled(bool enabled);
+int APS5_VABI sceImeSetEditEventWithRemotePlayEnabled(bool enabled);
+int APS5_VABI sceImeForTestFunction(void);
+int APS5_VABI sceImeVshInformConfirmdString2(ImeVshContext* context, const char16_t* text, std::int32_t firstParameter, std::int32_t secondParameter, std::int32_t thirdParameter);
+int APS5_VABI sceImeVshSetSelectionText(ImeVshContext* context, const char16_t* text, std::uint32_t length);
+int APS5_VABI sceImeCheckUpdateTextInfo(ImeEditText* info, std::uint8_t repair);
+int APS5_VABI sceImeCheckRemoteEventParam(ImeEvent* event, std::uint8_t repair);
+int APS5_VABI sceImeKeyboardOpenInternal(std::int32_t userId, EventHandler handler, const KeyboardParam* param);
+int APS5_VABI sceImeVshSetParam(ImeVshContext* context, const ImeVshParameter* parameter);
+int APS5_VABI sceImeVshUpdateContext2(ImeVshContext* context, const char16_t* text, std::uint32_t caretIndex);
+int APS5_VABI sceImeVshSendTextInfo(ImeVshContext* context, const void* info, std::uint32_t size);
+int APS5_VABI sceImeVshInformConfirmdString(ImeVshContext* context, const char16_t* text, std::int32_t parameter);
+int APS5_VABI sceImeVshNotifyCurrentTextInfo(ImeVshContext* context, const char16_t* text, std::int32_t caretIndex, std::int32_t preeditFirst, std::int32_t preeditSecond, std::int32_t selectionFirst, std::int32_t selectionSecond);
+int APS5_VABI sceImeVshNotifyCurrentTextInfoForReconvertText(ImeVshContext* context, const char16_t* text, std::int32_t caretIndex, std::int32_t preeditFirst, std::int32_t preeditSecond, std::int32_t selectionFirst, std::int32_t selectionSecond, std::int32_t option);
+int APS5_VABI sceImeVshNotifyDeleteText(ImeVshContext* context, const char16_t* text, std::int32_t length, std::int32_t parameter);
+int APS5_VABI sceImeVshNotifyUpdateCaretText(ImeVshContext* context, const char16_t* text, std::int32_t length, std::int32_t parameter);
+int APS5_VABI sceImeVshCheckAutoReConvertingPreeditText(ImeVshContext* context, const char16_t* text);
+int APS5_VABI sceImeVshSetPanelPosition(ImeVshContext* context, float x, float y, std::int32_t horizontalAlignment, std::int32_t verticalAlignment);
+int APS5_VABI sceImeVshNotifyPreeditMetaInfo(ImeVshContext* context, const ImePreeditMetaInfo* info);
+int APS5_VABI sceImeConfigSet(std::uint64_t unusedArgument, std::uint64_t configuration, std::uint32_t key, std::uint32_t value);
+int APS5_VABI sceImeConfigGet(std::uint64_t unusedArgument, std::uint64_t configuration, std::uint32_t key);
+int APS5_VABI sceImeDicGetWords(std::int32_t userId, std::uint64_t dictionary, ImeDictionaryWord* words);
+int APS5_VABI sceImeDicAddWord(std::int32_t userId, std::uint64_t dictionary, const ImeDictionaryWord* word);
+int APS5_VABI sceImeDicDeleteWord(std::int32_t userId, std::uint64_t dictionary, const ImeDictionaryWord* word);
+int APS5_VABI sceImeDicReplaceWord(std::int32_t userId, std::uint64_t dictionary, const ImeDictionaryWord* oldWord, const ImeDictionaryWord* newWord);
+int APS5_VABI sceImeDicDeleteLearnDics(std::int32_t userId);
+int APS5_VABI sceImeDicDeleteUserDics(std::int32_t userId);
+int APS5_VABI FinalizeImeModule_nid_postfix(void);
+int APS5_VABI InitializeImeModule_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceIme/libSceIme.hpp b/core/libs/prx/libSceIme/libSceIme.hpp
new file mode 100644
index 0000000000..01b649be31
--- /dev/null
+++ b/core/libs/prx/libSceIme/libSceIme.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceIme/include/Api.hpp"
diff --git a/core/libs/prx/libSceImeBackend/libSceImeBackend.hpp b/core/libs/prx/libSceImeBackend/libSceImeBackend.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceImeBackend/libSceImeBackend.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceImeDialog/Export.cpp b/core/libs/prx/libSceImeDialog/Export.cpp
index c19acdd36a..94cdcf67c7 100644
--- a/core/libs/prx/libSceImeDialog/Export.cpp
+++ b/core/libs/prx/libSceImeDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceImeDialog/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
@@ -198,7 +199,7 @@ int APS5_VABI sceImeDialogGetCurrentStarState(int64_t state) {
     return 0;
 }
 
-int APS5_VABI sceImeDialogInitInternal(Param* param, ExtendedParam* extended) {
+int APS5_VABI sceImeDialogInitInternal(const Param* param, const ExtendedParam* extended) {
     return sceImeDialogInit(param, extended);
 }
 
@@ -207,7 +208,6 @@ int APS5_VABI sceImeDialogSetPanelPosition(int32_t, int32_t) {
     return g_dialog.status == StatusNone ? ErrorNotInUse : ErrorSuspending;
 }
 
-
 int APS5_VABI sceImeDialogInitInternalWithSubInfo() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceImeDialog/include/Api.hpp b/core/libs/prx/libSceImeDialog/include/Api.hpp
new file mode 100644
index 0000000000..70f28051e4
--- /dev/null
+++ b/core/libs/prx/libSceImeDialog/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceImeDialogAbort(void);
+int APS5_VABI sceImeDialogGetPanelPositionAndForm(PositionAndForm* form);
+int APS5_VABI sceImeDialogGetPanelSize(const Param* param, uint32_t* width, uint32_t* height);
+int APS5_VABI sceImeDialogGetPanelSizeExtended(const Param* param, const ExtendedParam* extended, uint32_t* width, uint32_t* height);
+int APS5_VABI sceImeDialogGetResult(Result* result);
+int APS5_VABI sceImeDialogGetStatus(void);
+int APS5_VABI sceImeDialogInit(const Param* param, const ExtendedParam* extended);
+int APS5_VABI sceImeDialogTerm(void);
+int APS5_VABI sceImeDialogForTestFunction();
+int APS5_VABI sceImeDialogForceClose(void);
+int APS5_VABI sceImeDialogGetCurrentStarState(int64_t state);
+int APS5_VABI sceImeDialogInitInternal(const Param* param, const ExtendedParam* extended);
+int APS5_VABI sceImeDialogSetPanelPosition(int32_t, int32_t);
+int APS5_VABI sceImeDialogInitInternalWithSubInfo();
+
+}
diff --git a/core/libs/prx/libSceImeDialog/libSceImeDialog.hpp b/core/libs/prx/libSceImeDialog/libSceImeDialog.hpp
new file mode 100644
index 0000000000..b9c6e0c899
--- /dev/null
+++ b/core/libs/prx/libSceImeDialog/libSceImeDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceImeDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceInvitationDialog/Export.cpp b/core/libs/prx/libSceInvitationDialog/Export.cpp
index 8ae801bc26..9053e853ee 100644
--- a/core/libs/prx/libSceInvitationDialog/Export.cpp
+++ b/core/libs/prx/libSceInvitationDialog/Export.cpp
@@ -1,9 +1,10 @@
+#include "prx/libSceInvitationDialog/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-int APS5_VABI sceInvitationDialogGetResult() {
+int APS5_VABI sceInvitationDialogGetResult(InvitationDialogResult* result) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -28,4 +29,9 @@ int APS5_VABI sceInvitationDialogUpdateStatus() {
     return 0;
 }
 
+int APS5_VABI sceInvitationDialogClose(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceInvitationDialog/include/Api.hpp b/core/libs/prx/libSceInvitationDialog/include/Api.hpp
new file mode 100644
index 0000000000..884ec82465
--- /dev/null
+++ b/core/libs/prx/libSceInvitationDialog/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+
+struct InvitationDialogRecipients {
+    std::uint32_t count;
+    NpOnlineId onlineIds[16];
+};
+
+struct InvitationDialogResult {
+    std::uint8_t opaque00[8];
+    std::int32_t errorCode;
+    std::uint32_t opaque0C;
+    InvitationDialogRecipients* recipients;
+    std::uint8_t reserved[32];
+};
+
+static_assert(sizeof(NpOnlineId) == 20);
+static_assert(offsetof(InvitationDialogRecipients, onlineIds) == 4);
+static_assert(sizeof(InvitationDialogRecipients) == 324);
+static_assert(offsetof(InvitationDialogResult, errorCode) == 0x08);
+static_assert(offsetof(InvitationDialogResult, opaque0C) == 0x0C);
+static_assert(offsetof(InvitationDialogResult, recipients) == 0x10);
+static_assert(offsetof(InvitationDialogResult, reserved) == 0x18);
+static_assert(sizeof(InvitationDialogResult) == 0x38);
+
+extern "C" {
+
+int APS5_VABI sceInvitationDialogGetResult(InvitationDialogResult* result);
+int APS5_VABI sceInvitationDialogInitialize();
+int APS5_VABI sceInvitationDialogOpen();
+int APS5_VABI sceInvitationDialogTerminate();
+int APS5_VABI sceInvitationDialogUpdateStatus();
+int APS5_VABI sceInvitationDialogClose(void);
+
+}
diff --git a/core/libs/prx/libSceInvitationDialog/libSceInvitationDialog.hpp b/core/libs/prx/libSceInvitationDialog/libSceInvitationDialog.hpp
new file mode 100644
index 0000000000..52cc7b951a
--- /dev/null
+++ b/core/libs/prx/libSceInvitationDialog/libSceInvitationDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceInvitationDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceIpmi/Export.cpp b/core/libs/prx/libSceIpmi/Export.cpp
index 238bb67ecf..993a1254b3 100644
--- a/core/libs/prx/libSceIpmi/Export.cpp
+++ b/core/libs/prx/libSceIpmi/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIpmi/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceIpmi/PendingExports.cpp b/core/libs/prx/libSceIpmi/PendingExports.cpp
index 62a504bc35..5970f64dd6 100644
--- a/core/libs/prx/libSceIpmi/PendingExports.cpp
+++ b/core/libs/prx/libSceIpmi/PendingExports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIpmi/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceIpmi/include/Api.hpp b/core/libs/prx/libSceIpmi/include/Api.hpp
new file mode 100644
index 0000000000..200ce258ea
--- /dev/null
+++ b/core/libs/prx/libSceIpmi/include/Api.hpp
@@ -0,0 +1,62 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceIpmiMgrGetIpcBlockerPid(void);
+int APS5_VABI sceIpmiMgrGetIpcBlockerPidByAppId(void);
+int APS5_VABI sceIpmiMgrPauseDump(void);
+int APS5_VABI sceIpmiMgrRaiseExceptionToPid(void);
+int APS5_VABI sceIpmiMgrStartDump(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplC1Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfig20estimateMsgQueueSizeEmj(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler21onAsyncMethodDispatchEPNS_7SessionEjjPvmS4_m(void);
+int APS5_VABI _ZN4IPMI6Client6Config26SyncMethodInvocationConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler20onSyncMethodDispatchEPNS_7SessionEjPvmmS4_m(void);
+int APS5_VABI _ZN4IPMI7SessionD1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl9tryGetMsgEjPvPmm(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler20onSyncMethodDispatchEPNS_7SessionEjPKNS_8DataInfoEjPNS_10BufferInfoEj(void);
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6ServerD2Ev(void);
+int APS5_VABI _ZN4IPMI6ServerD0Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config24estimateClientMemorySizeEv(void);
+int APS5_VABI _ZN4IPMI6Server6createEPPS0_PKNS0_6ConfigEPvS6_(void);
+int APS5_VABI _ZN4IPMI6Client6ConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler15onSessionKilledEPNS_7SessionE(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplD1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl27respondToAsyncMethodRequestEjiPKvm(void);
+int APS5_VABI _ZN4IPMI6Client6Config27AsyncMethodInvocationConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler21onAsyncMethodDispatchEPNS_7SessionEjjPKNS_8DataInfoEj(void);
+int APS5_VABI _ZN4IPMI6ClientD2Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl7sendMsgEjPKvmPj(void);
+int APS5_VABI _ZN4IPMI6ClientC2Ev(void);
+int APS5_VABI _ZN4IPMI7SessionD2Ev(void);
+int APS5_VABI _ZNK4IPMI4impl11SessionImpl16isPeerPrivilegedEv(void);
+int APS5_VABI _ZN4IPMI7SessionC2Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplD2Ev(void);
+int APS5_VABI _ZN4IPMI6ClientD1Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD0Ev(void);
+int APS5_VABI _ZN4IPMI7Session6Config25estimateSessionMemorySizeEv(void);
+int APS5_VABI _ZNK4IPMI6Server6Config29estimateTempWorkingMemorySizeEv(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplD0Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl7destroyEv(void);
+int APS5_VABI _ZN4IPMI6Client6Config27AsyncMethodInvocationConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl6getMsgEjPvPmmPj(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl27respondToAsyncMethodRequestEjjiPKNS_8DataInfoEj(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD2Ev(void);
+int APS5_VABI _ZN4IPMI6ClientD0Ev(void);
+int APS5_VABI _ZN4IPMI6Client6createEPPS0_PKNS0_6ConfigEPvS6_(void);
+int APS5_VABI _ZN4IPMI6ServerC2Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplC2Ev(void);
+int APS5_VABI _ZN4IPMI7SessionD0Ev(void);
+int APS5_VABI _ZN4IPMI6ServerD1Ev(void);
+int APS5_VABI _ZN4IPMI6Server6ConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl9getServerEv(void);
+int APS5_VABI _ZN4IPMI6Client6ConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config26SyncMethodInvocationConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Server6ConfigC2Ev(void);
+
+}
diff --git a/core/libs/prx/libSceIpmi/libSceIpmi.hpp b/core/libs/prx/libSceIpmi/libSceIpmi.hpp
new file mode 100644
index 0000000000..c7fc7c9a22
--- /dev/null
+++ b/core/libs/prx/libSceIpmi/libSceIpmi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceIpmi/include/Api.hpp"
diff --git a/core/libs/prx/libSceJemspace/Export.cpp b/core/libs/prx/libSceJemspace/Export.cpp
index 5dc318d1a1..c6a8018fa1 100644
--- a/core/libs/prx/libSceJemspace/Export.cpp
+++ b/core/libs/prx/libSceJemspace/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJemspace/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceJemspace/include/Api.hpp b/core/libs/prx/libSceJemspace/include/Api.hpp
new file mode 100644
index 0000000000..5f280f8dcb
--- /dev/null
+++ b/core/libs/prx/libSceJemspace/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceJemspaceCalloc();
+int APS5_VABI sceJemspaceCreate();
+int APS5_VABI sceJemspaceDestroy();
+int APS5_VABI sceJemspaceFree();
+int APS5_VABI sceJemspaceGetStats();
+int APS5_VABI sceJemspaceMalloc();
+int APS5_VABI sceJemspaceMallocUsableSize();
+int APS5_VABI sceJemspaceMemalign();
+int APS5_VABI sceJemspacePosixMemalign();
+int APS5_VABI sceJemspacePrintStats();
+int APS5_VABI sceJemspacePurge();
+int APS5_VABI sceJemspaceRealloc();
+int APS5_VABI sceJemspaceReallocalign();
+
+}
diff --git a/core/libs/prx/libSceJemspace/libSceJemspace.hpp b/core/libs/prx/libSceJemspace/libSceJemspace.hpp
new file mode 100644
index 0000000000..efe1e331fb
--- /dev/null
+++ b/core/libs/prx/libSceJemspace/libSceJemspace.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJemspace/include/Api.hpp"
diff --git a/core/libs/prx/libSceJitBridge/libSceJitBridge.hpp b/core/libs/prx/libSceJitBridge/libSceJitBridge.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJitBridge/libSceJitBridge.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJobManager/CMakeLists.txt b/core/libs/prx/libSceJobManager/CMakeLists.txt
index 8539bbd0c2..1364b0e64d 100644
--- a/core/libs/prx/libSceJobManager/CMakeLists.txt
+++ b/core/libs/prx/libSceJobManager/CMakeLists.txt
@@ -1,14 +1,71 @@
 add_library(libSceJobManager SHARED EXCLUDE_FROM_ALL Export.cpp)
 target_include_directories(libSceJobManager PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(libSceJobManager PRIVATE libSceAgc libSceAgcDriver)
+target_link_libraries(libSceJobManager PRIVATE libSceAgc libSceAgcDriver libSceRazorCpu ulobjmgr)
 configure_windows_unwind(libSceJobManager)
 
 if(BUILD_TESTING)
+    add_test_executable(guest_job_manager_profiler_tests ${LIBS_INCLUDE_DIR}/tests/JobManagerProfiler.cpp Export.cpp)
+    target_include_directories(guest_job_manager_profiler_tests PRIVATE ${LIBS_INCLUDE_DIR}
+        ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR} ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR}
+        $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+    target_compile_options(guest_job_manager_profiler_tests PRIVATE -msse4.2)
+    target_link_libraries(guest_job_manager_profiler_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc ulobjmgr)
+    configure_windows_unwind(guest_job_manager_profiler_tests)
+    add_test(NAME guest_job_manager_profiler COMMAND guest_job_manager_profiler_tests)
+    add_test(NAME guest_job_manager_profiler_gpu COMMAND guest_job_manager_profiler_tests gpu)
+    set_tests_properties(guest_job_manager_profiler guest_job_manager_profiler_gpu PROPERTIES TIMEOUT 20)
+    set_tests_properties(guest_job_manager_profiler_gpu PROPERTIES SKIP_RETURN_CODE 77 ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1")
+    if(WIN32)
+        set_tests_properties(guest_job_manager_profiler guest_job_manager_profiler_gpu PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgc>")
+    endif()
+    add_test_executable(job_manager_compute_progress_tests ${LIBS_INCLUDE_DIR}/tests/JobManagerComputeProgress.cpp)
+    target_include_directories(job_manager_compute_progress_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(job_manager_compute_progress_tests PRIVATE libc)
+    configure_windows_unwind(job_manager_compute_progress_tests)
+    add_test(NAME guest_job_manager_compute_progress COMMAND job_manager_compute_progress_tests)
+    set_tests_properties(guest_job_manager_compute_progress PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_job_manager_compute_progress PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test_executable(guest_job_manager_failure_tests ${LIBS_INCLUDE_DIR}/tests/JobManagerFailures.cpp Export.cpp)
+    target_include_directories(guest_job_manager_failure_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_job_manager_failure_tests PRIVATE libSceAgc libSceAgcDriver libSceRazorCpu libkernel libc ulobjmgr)
+    configure_windows_unwind(guest_job_manager_failure_tests)
+    add_test(NAME guest_job_manager_failures COMMAND guest_job_manager_failure_tests)
+    set_tests_properties(guest_job_manager_failures PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_job_manager_failures PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgc>")
+    endif()
+    add_test_executable(guest_job_manager_registration_tests ${LIBS_INCLUDE_DIR}/tests/JobManagerRegistration.cpp Export.cpp)
+    target_include_directories(guest_job_manager_registration_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_job_manager_registration_tests PRIVATE libSceAgc libSceAgcDriver libSceRazorCpu libkernel libc)
+    configure_windows_unwind(guest_job_manager_registration_tests)
+    add_test(NAME guest_job_manager_registration COMMAND guest_job_manager_registration_tests)
+    set_tests_properties(guest_job_manager_registration PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_job_manager_registration PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgc>")
+    endif()
     add_test_executable(guest_job_manager_tests ${LIBS_INCLUDE_DIR}/tests/GuestJobManager.cpp)
     target_include_directories(guest_job_manager_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_job_manager_tests PRIVATE libSceJobManager libSceAgc libSceAgcDriver libkernel libc)
     configure_windows_unwind(guest_job_manager_tests)
-    foreach(testCase IN ITEMS memory validation dispatch ordering nested limits priority shutdown)
+    if(WIN32 OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        add_library(job_manager_reference SHARED EXCLUDE_FROM_ALL
+            ${LIBS_INCLUDE_DIR}/tests/GuestJobManager.cpp
+            ${LIBS_INCLUDE_DIR}/tests/JobManagerReference.cpp)
+        target_include_directories(job_manager_reference PRIVATE ${LIBS_INCLUDE_DIR})
+        target_compile_definitions(job_manager_reference PRIVATE ANYPS5_JOB_MANAGER_REFERENCE)
+        target_link_libraries(job_manager_reference PRIVATE libkernel libc ${CMAKE_DL_LIBS})
+        set_target_properties(job_manager_reference PROPERTIES PREFIX "" SUFFIX .prx
+            RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests
+            LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests)
+        configure_windows_unwind(job_manager_reference)
+    endif()
+    foreach(testCase IN ITEMS memory owned_state validation dispatch ordering nested limits node_pool priority shutdown worker_policy worker_wake worker_wait worker_count worker_spin shutdown_running shutdown_waiter shutdown_queued shutdown_destroy shutdown_partial shutdown_cross_wait concurrent_wait)
         add_test(NAME guest_job_manager_${testCase} COMMAND guest_job_manager_tests ${testCase})
         set_tests_properties(guest_job_manager_${testCase} PROPERTIES TIMEOUT 20)
         if(WIN32)
@@ -16,4 +73,13 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJobManager>")
         endif()
     endforeach()
+    set_tests_properties(guest_job_manager_worker_spin PROPERTIES ENVIRONMENT "APS5_TIME_SCALE=1")
+    foreach(scale IN ITEMS 0.1 10)
+        add_test(NAME guest_job_manager_worker_spin_scale_${scale} COMMAND guest_job_manager_tests worker_spin)
+        set_tests_properties(guest_job_manager_worker_spin_scale_${scale} PROPERTIES TIMEOUT 20 ENVIRONMENT "APS5_TIME_SCALE=${scale}")
+        if(WIN32)
+            set_tests_properties(guest_job_manager_worker_spin_scale_${scale} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJobManager>")
+        endif()
+    endforeach()
 endif()
diff --git a/core/libs/prx/libSceJobManager/ComputeProgress.hpp b/core/libs/prx/libSceJobManager/ComputeProgress.hpp
new file mode 100644
index 0000000000..aadd732245
--- /dev/null
+++ b/core/libs/prx/libSceJobManager/ComputeProgress.hpp
@@ -0,0 +1,31 @@
+#ifndef CORE_LIBS_PRX_LIBSCEJOBMANAGER_COMPUTEPROGRESS_HPP
+#define CORE_LIBS_PRX_LIBSCEJOBMANAGER_COMPUTEPROGRESS_HPP
+
+#include <cstdint>
+#include <stdexcept>
+
+namespace JobManager {
+
+class ComputeProgress {
+public:
+    std::uint32_t Publish(std::uint32_t count) {
+        total += count;
+        return total;
+    }
+
+    std::uint32_t Collect(std::uint64_t value) {
+        const auto current = static_cast<std::uint32_t>(value);
+        const std::uint32_t finished = current - seen;
+        if (finished > std::uint32_t{total - seen}) throw std::runtime_error("libSceJobManager: a compute label advanced beyond its published work");
+        seen = current;
+        return finished;
+    }
+
+private:
+    std::uint32_t total = 0;
+    std::uint32_t seen = 0;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceJobManager/Export.cpp b/core/libs/prx/libSceJobManager/Export.cpp
index 155a95220d..0901e79c0f 100644
--- a/core/libs/prx/libSceJobManager/Export.cpp
+++ b/core/libs/prx/libSceJobManager/Export.cpp
@@ -1,47 +1,35 @@
+#include "prx/libSceRazorCpu/libSceRazorCpu.hpp"
+#include "prx/ulobjmgr/ulobjmgr.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceJobManager/include/Api.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include "prx/libSceAgcDriver/Eq/include/Event.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
+#include "prx/libSceAgc/Cb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include <algorithm>
 #include <array>
 #include <bit>
 #include <condition_variable>
 #include <cstddef>
 #include <cstdint>
+#include <cstdio>
 #include <cstring>
-#include <deque>
+#include <immintrin.h>
+#include <memory>
 #include <mutex>
+#include <span>
 #include <stdexcept>
-#include <string>
-#include <vector>
 
 #include "SceTypes.hpp"
+#include "ComputeProgress.hpp"
 #include "prx/libc/include/General.hpp"
-
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** result);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
-int APS5_VABI sceKernelTriggerUserEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceKernelGetEventFilter(const KernelEvent* ev);
-std::uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
-int APS5_VABI sceAgcDriverAddEqEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceAgcDriverDeleteEqEvent(KernelEqueue eq, int id);
-int APS5_VABI sceAgcDriverSubmitAcb(std::uint32_t queue, const Packet* packet);
-std::uint32_t* APS5_VABI sceAgcAcbAcquireMem(CommandBuffer* buf, std::uint32_t gcrControl, const volatile void* base, std::uint64_t sizeBytes, std::uint32_t pollCycles);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegistersDirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
-std::uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-std::uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf);
-std::uint32_t* APS5_VABI sceAgcCbDispatch(CommandBuffer* buf, std::uint32_t threadGroupX, std::uint32_t threadGroupY, std::uint32_t threadGroupZ, std::uint32_t modifier);
-std::uint32_t* APS5_VABI sceAgcAcbDispatchIndirect(CommandBuffer* buf, const volatile void* indirectArguments, std::uint32_t modifier);
-std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer* buf, std::uint8_t action, std::uint16_t gcrControl, std::uint8_t dst, std::uint8_t cachePolicy, const volatile Label* address, std::uint8_t dataSelect, std::uint64_t data, std::uint16_t gdsOffset, std::uint16_t gdsSize, std::uint8_t interrupt, std::uint32_t interruptContextId);
-}
+#include "prx/libc/include/GuestArena.hpp"
 
 namespace {
 
@@ -70,35 +58,10 @@ constexpr std::uint64_t ThreadRecordBytes = 0x48;
 constexpr std::uint64_t SequenceBytes = 0x240;
 constexpr std::uint64_t NodeBytes = 72;
 constexpr std::uint64_t ComputeContextBytes = 0x168;
-constexpr std::uint64_t ComputeCommandBytes = 0x3ff * 104 + 0xff * 148 + 0x3f * 32;
 constexpr std::uint32_t FirstComputeQueue = 0x20;
 constexpr std::uint32_t UserDataRegister = 0x240;
 constexpr int UserEventFilter = -11;
 
-struct MemorySizeQueryParams {
-    std::uint32_t version;
-    std::uint32_t workers;
-    std::uint32_t sequences;
-    std::uint32_t invocations;
-    std::uint32_t dispatches;
-    std::uint32_t syncPoints;
-    std::uint32_t waits;
-    std::uint32_t computeSequences;
-    std::uint64_t computeQueueMask;
-};
-
-struct ConfigParams {
-    std::uint32_t version;
-    std::uint32_t threadFlags;
-    std::uint32_t stackSize;
-    std::uint32_t priority;
-    const char* threadName;
-    std::uint32_t spinMicroseconds;
-    std::uint32_t computeAffinity;
-    std::uint32_t computePriority;
-    std::uint32_t reserved;
-};
-
 constexpr ConfigParams DefaultConfig{0, 0x00021fff, 0x00010000, 0x2bc, nullptr, 0, 0x1fff, 0x100, 0};
 
 struct BlockHeader {
@@ -109,31 +72,87 @@ struct BlockHeader {
     std::uint32_t reserved;
 };
 
-using JobEntry = void (APS5_VABI*)(void* argument, std::uint32_t index);
-
 std::uint64_t AlignUp(std::uint64_t value, std::uint64_t alignment) {
     return (value + alignment - 1) & ~(alignment - 1);
 }
 
+std::uint64_t ComputeCommandBudget() {
+    std::array<std::uint32_t, 256> words{};
+    CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+    const ShaderRegister shaderRegister{};
+    const std::array<std::uint32_t, 2> userData{};
+    bool encoded = sceAgcAcbAcquireMem(&buffer, 0x20380, nullptr, 0, 0x190) != nullptr;
+    encoded = encoded && sceAgcCbSetShRegistersDirect(&buffer, &shaderRegister, 1) != nullptr;
+    encoded = encoded && sceAgcCbSetShRegisterRangeDirect(&buffer, UserDataRegister, userData.data(), 2) != nullptr;
+    encoded = encoded && sceAgcAcbPushMarker(&buffer, "1234567890123456789012345678901", 0) != nullptr;
+    encoded = encoded && sceAgcCbDispatch(&buffer, 1, 1, 1, 0) != nullptr;
+    encoded = encoded && sceAgcAcbPopMarker(&buffer) != nullptr;
+    const auto dispatchBytes = static_cast<std::uint64_t>(buffer.cursor_up - words.data()) * 4;
+    buffer.cursor_up = words.data();
+    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0, 1, 3, nullptr, 1, 0, 0, 0, 0, 0) != nullptr;
+    encoded = encoded && sceAgcAcbWaitRegMem(&buffer, 0, 3, 3, nullptr, 0, ~std::uint64_t{0}, 0x190) != nullptr;
+    encoded = encoded && sceAgcAcbRewind(&buffer, 1) != nullptr;
+    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0x200, 1, 3, nullptr, 1, 0, 0, 0, 0, 0) != nullptr;
+    encoded = encoded && sceAgcAcbWriteData(&buffer, 2, 3, 0, userData.data(), 1, 1, 0) != nullptr;
+    const auto syncBytes = static_cast<std::uint64_t>(buffer.cursor_up - words.data()) * 4;
+    buffer.cursor_up = words.data();
+    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0x200, 1, 3, nullptr, 1, 0, 0, 0, 2, 0) != nullptr;
+    const auto waitBytes = static_cast<std::uint64_t>(buffer.cursor_up - words.data()) * 4;
+    if (!encoded || dispatchBytes > 255 || syncBytes > 255 || waitBytes > 255) throw std::runtime_error("libSceJobManager: compute command size measurement failed");
+    return MaxDispatches * dispatchBytes + MaxSyncPoints * syncBytes + MaxWaits * waitBytes;
+}
+
 struct Manager;
 class Sequence;
 
 enum class ItemType { Dispatch, SyncPoint, Wait, Compute, ComputeIndirect };
 
 struct Item {
-    ItemType type;
+    Item* next = nullptr;
+    Item* runnableNext = nullptr;
     Sequence* sequence;
-    JobEntry entry;
-    void* argument;
-    std::uint32_t count;
-    std::uint32_t handedOut;
-    std::uint32_t completed;
-    bool* passed;
-    const void* shader = nullptr;
-    std::array<std::uint32_t, 3> groups{};
-    const void* indirectArguments = nullptr;
-    std::string name;
-    bool named = false;
+    struct Cpu {
+        JobEntry entry;
+        void* argument;
+        std::uint32_t count;
+        std::uint32_t handedOut;
+        std::uint32_t completed;
+    };
+    struct Compute {
+        const void* shader;
+        void* userData;
+        union {
+            std::array<std::uint32_t, 3> groups;
+            const void* indirectArguments;
+        };
+    };
+    union {
+        Cpu cpu;
+        Compute gpu;
+        bool* passed;
+    };
+    const char* name = nullptr;
+    ItemType type;
+    bool encoded = false;
+};
+
+static_assert(sizeof(Item) == NodeBytes);
+
+struct RunQueue {
+    Item* first = nullptr;
+    Item* last = nullptr;
+
+    void Push(Item* item) {
+        item->runnableNext = nullptr;
+        if (last != nullptr) last->runnableNext = item;
+        else first = item;
+        last = item;
+    }
+
+    void Pop() {
+        first = first->runnableNext;
+        if (first == nullptr) last = nullptr;
+    }
 };
 
 struct Counters {
@@ -143,27 +162,6 @@ struct Counters {
     std::uint32_t waits = 0;
 };
 
-class ISequence {
-public:
-    APS5_VABI virtual int Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char* name) = 0;
-    APS5_VABI virtual int SyncPoint() = 0;
-    APS5_VABI virtual int Wait() = 0;
-    APS5_VABI virtual void CompleteDestructor() {}
-    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence was deleted by its caller"); }
-    APS5_VABI virtual int DispatchCompute(const void* shader, void* userData, std::int32_t x, std::int32_t y, std::int32_t z, const char* name) = 0;
-    APS5_VABI virtual int DispatchComputeIndirect(const void* shader, void* userData, const void* indirectArguments, const char* name) = 0;
-};
-
-class ISequenceFactory {
-public:
-    APS5_VABI virtual int Create(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
-    APS5_VABI virtual int Destroy(ISequence* sequence) = 0;
-    APS5_VABI virtual void CompleteDestructor() {}
-    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence factory was deleted by its caller"); }
-    APS5_VABI virtual int CreateCompute(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
-    APS5_VABI virtual int DestroyCompute(ISequence* sequence) = 0;
-};
-
 class Sequence final : public ISequence {
 public:
     APS5_VABI int Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char* name) override;
@@ -172,24 +170,32 @@ public:
     APS5_VABI int DispatchCompute(const void* shader, void* userData, std::int32_t x, std::int32_t y, std::int32_t z, const char* name) override;
     APS5_VABI int DispatchComputeIndirect(const void* shader, void* userData, const void* indirectArguments, const char* name) override;
 
-    bool Open(Manager* owner, const Counters& limit, std::uint32_t runQueue);
+    bool Open(Manager* owner, const Counters& limit, std::uint32_t runQueue, const char* name);
     int WaitAndClose(std::uint32_t index);
     void Advance();
     void DispatchCompleted(std::uint32_t invocations);
     void CollectCompute();
-    bool Busy() const { return outstanding != 0; }
+    void SetComputeStorage(std::uint32_t* commands, std::size_t words, Label* completion);
+    void CancelWaits();
 
     Manager* manager = nullptr;
     bool open = false;
     bool compute = false;
     std::uint32_t queue = 0;
+    std::uint16_t profileId = 0;
 
 private:
     int Latch(int code);
     void RequireOpen() const;
     int WaitLocked(std::unique_lock<std::mutex>& guard);
     int AppendCompute(Item item);
+    void Append(Item* item);
+    void RemoveWait(Item* item);
     void SubmitCompute(const Item& item);
+    void SubmitComputeAhead(Item* item);
+    void RetireCompute();
+    void FlushCompute();
+    void Profile(std::uint16_t event);
 
     Counters limits;
     Counters submitted;
@@ -197,16 +203,42 @@ private:
     std::uint32_t priority = 0;
     int error = 0;
     std::uint32_t outstanding = 0;
-    std::size_t cursor = 0;
-    std::deque<Item> items;
+    Item* reserved = nullptr;
+    Item* first = nullptr;
+    Item* last = nullptr;
+    Item* cursor = nullptr;
     std::condition_variable passed;
-    Label label{};
-    std::uint64_t labelSeen = 0;
-    std::uint64_t labelTotal = 0;
+    Label* label = nullptr;
+    JobManager::ComputeProgress progress;
+    std::uint32_t pendingCompute = 0;
+    std::uint32_t activeCompute = 0;
+    std::uint32_t availableCompute = 0;
     bool batchStarted = false;
-    std::deque<std::vector<std::uint32_t>> commands;
+    bool profileActive = false;
+    bool profileCpu = false;
+    bool profileGpuBarrier = false;
+    const char* profileName = nullptr;
+    std::uint32_t* commandBegin = nullptr;
+    std::size_t commandWords = 0;
+    std::size_t commandUsed = 0;
 };
 
+static_assert(sizeof(Sequence) < SequenceBytes);
+
+struct alignas(64) SequenceSlot {
+    Sequence value;
+    std::array<std::byte, SequenceBytes - sizeof(Sequence)> padding;
+};
+
+static_assert(sizeof(SequenceSlot) == SequenceBytes);
+
+struct WorkerSlot {
+    Pthread thread = nullptr;
+    std::array<std::byte, ThreadRecordBytes - sizeof(Pthread)> padding;
+};
+
+static_assert(sizeof(WorkerSlot) == ThreadRecordBytes);
+
 class Factory final : public ISequenceFactory {
 public:
     APS5_VABI int Create(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) override;
@@ -219,37 +251,63 @@ public:
 };
 
 struct Manager {
+    std::uint32_t objectId = 0;
+    std::uint16_t profileId = 0;
     std::mutex lock;
     std::condition_variable work;
+    std::condition_variable quiesced;
     bool running = false;
     std::uint32_t blockedWaiters = 0;
-    std::uint32_t freeNodes = 0;
+    Item* freeNodes = nullptr;
     std::uint32_t freeSequences = 0;
     std::uint32_t persistentThreads = 0;
-    std::array<std::deque<Item*>, 2> runQueues;
-    std::vector<Sequence> sequences;
-    std::deque<Sequence> computeSequences;
+    std::uint32_t workerCount = 0;
+    std::uint32_t sleepingWorkers = 0;
+    std::uint32_t wakeTokens = 0;
+    std::uint64_t pendingInvocations = 0;
+    std::uint64_t spinTicks = 0;
+    std::array<RunQueue, 2> runQueues;
+    std::span<SequenceSlot> sequences;
+    std::span<SequenceSlot> computeSequences;
     std::uint32_t freeComputeSequences = 0;
-    std::vector<std::uint32_t> computeQueues;
+    std::uint64_t computeQueues = 0;
     KernelEqueue computeEvents = 0;
     Pthread computeHandler = nullptr;
     std::array<Factory, 2> factories;
     std::array<Factory, 2> unifiedFactories;
-    std::vector<Pthread> workers;
+    std::span<WorkerSlot> workers;
+    std::uint32_t activeWorkers = 0;
+    void* stateBegin = nullptr;
+    std::size_t stateBytes = 0;
+    std::span<Item> nodes;
 };
 
+static_assert(sizeof(Manager) <= StateEnd - StateOffset);
+
+thread_local Manager* currentWorker = nullptr;
+
+void WakeWorkers(Manager& manager, std::uint32_t invocations, bool publisherCanRun = true) {
+    const std::uint32_t available = invocations - (publisherCanRun && currentWorker == &manager ? 1u : 0u);
+    manager.wakeTokens += std::min(available, manager.sleepingWorkers - manager.wakeTokens);
+    if (manager.wakeTokens != 0) manager.work.notify_all();
+}
+
 Manager*& Implementation(void* self) {
     return *static_cast<Manager**>(self);
 }
 
-bool TakeNode(Manager& manager) {
-    if (manager.freeNodes == 0) return false;
-    --manager.freeNodes;
-    return true;
+Item* TakeNode(Manager& manager) {
+    Item* item = manager.freeNodes;
+    if (item != nullptr) {
+        manager.freeNodes = item->next;
+        *item = {};
+    }
+    return item;
 }
 
-void ReturnNodes(Manager& manager, std::uint32_t count) {
-    manager.freeNodes += count;
+void ReturnNode(Manager& manager, Item* item) {
+    item->next = manager.freeNodes;
+    manager.freeNodes = item;
 }
 
 int Sequence::Latch(int code) {
@@ -257,7 +315,12 @@ int Sequence::Latch(int code) {
     return code;
 }
 
-bool Sequence::Open(Manager* owner, const Counters& limit, std::uint32_t runQueue) {
+void Sequence::Profile(std::uint16_t event) {
+    const auto id = static_cast<std::uint16_t>(profileId - (compute && event <= 2 ? manager->sequences.size() : 0));
+    static_cast<void>(sceRazorCpuJobManagerSequence(profileName, manager->profileId, id, event));
+}
+
+bool Sequence::Open(Manager* owner, const Counters& limit, std::uint32_t runQueue, const char* name) {
     manager = owner;
     limits = limit;
     submitted = {};
@@ -265,12 +328,21 @@ bool Sequence::Open(Manager* owner, const Counters& limit, std::uint32_t runQueu
     priority = runQueue;
     error = 0;
     outstanding = 0;
-    cursor = 0;
-    items.clear();
-    commands.clear();
+    cursor = nullptr;
+    first = nullptr;
+    last = nullptr;
+    commandUsed = 0;
     batchStarted = false;
-    if (!TakeNode(*owner)) return false;
+    activeCompute = 0;
+    availableCompute = 0;
+    profileActive = false;
+    profileCpu = false;
+    profileGpuBarrier = false;
+    profileName = name;
+    reserved = TakeNode(*owner);
+    if (reserved == nullptr) return false;
     open = true;
+    Profile(1);
     return true;
 }
 
@@ -278,33 +350,93 @@ void Sequence::RequireOpen() const {
     if (!open) throw std::runtime_error("libSceJobManager: a destroyed sequence was used");
 }
 
+void Sequence::Append(Item* item) {
+    item->next = nullptr;
+    if (last != nullptr) last->next = item;
+    else first = item;
+    last = item;
+    if (cursor == nullptr) cursor = item;
+}
+
+void Sequence::RemoveWait(Item* item) {
+    Item* previous = nullptr;
+    for (Item* current = first; current != nullptr; current = current->next) {
+        if (current == item) {
+            if (previous != nullptr) previous->next = item->next;
+            else first = item->next;
+            if (last == item) last = previous;
+            if (cursor == item) cursor = item->next;
+            return;
+        }
+        previous = current;
+    }
+}
+
 void Sequence::Advance() {
-    while (cursor < items.size()) {
-        Item& item = items[cursor];
+    while (cursor != nullptr) {
+        Item& item = *cursor;
         if (item.type == ItemType::Dispatch) {
+            if (profileGpuBarrier) {
+                Profile(4);
+                profileActive = false;
+                profileGpuBarrier = false;
+            }
+            if (!profileActive) Profile(3);
+            profileActive = true;
+            profileCpu = true;
+            if (!manager->running) return;
             ++outstanding;
-            ++cursor;
-            manager->runQueues[priority].push_back(&item);
-            manager->work.notify_all();
+            cursor = item.next;
+            manager->runQueues[priority].Push(&item);
+            manager->pendingInvocations -= item.cpu.count;
+            WakeWorkers(*manager, item.cpu.count);
             continue;
         }
         if (item.type == ItemType::Compute || item.type == ItemType::ComputeIndirect) {
+            if (!manager->running) return;
+            if (!profileActive) Profile(3);
+            profileActive = true;
+            profileGpuBarrier = false;
             ++outstanding;
-            ++cursor;
-            SubmitCompute(item);
+            ++activeCompute;
+            cursor = item.next;
+            if (!item.encoded) {
+                SubmitCompute(item);
+                item.encoded = true;
+            }
+            RetireCompute();
             continue;
         }
-        if (outstanding != 0) return;
+        FlushCompute();
+        if (outstanding != 0) {
+            if (item.type == ItemType::SyncPoint && !profileCpu && manager->running) SubmitComputeAhead(item.next);
+            return;
+        }
         if (item.type == ItemType::SyncPoint) {
+            if (profileCpu) {
+                Profile(4);
+                profileActive = false;
+                profileCpu = false;
+            }
+            profileGpuBarrier = profileActive;
             ++completed.syncPoints;
-            ++cursor;
+            cursor = item.next;
             continue;
         }
+        if (profileActive) Profile(4);
+        profileActive = false;
+        profileCpu = false;
+        profileGpuBarrier = false;
         bool* const waiter = item.passed;
-        const auto retired = static_cast<std::uint32_t>(cursor);
-        items.erase(items.begin(), items.begin() + static_cast<std::ptrdiff_t>(retired + 1));
-        cursor = 0;
-        commands.clear();
+        while (first != &item) {
+            Item* retired = first;
+            first = first->next;
+            ReturnNode(*manager, retired);
+        }
+        first = item.next;
+        if (last == &item) last = nullptr;
+        cursor = first;
+        commandUsed = 0;
         batchStarted = false;
         if (error == 0) {
             submitted.invocations -= completed.invocations;
@@ -313,7 +445,6 @@ void Sequence::Advance() {
             --submitted.waits;
             completed = {};
         }
-        ReturnNodes(*manager, retired);
         *waiter = true;
         passed.notify_all();
     }
@@ -326,7 +457,14 @@ void Sequence::DispatchCompleted(std::uint32_t invocations) {
     if (outstanding == 0) Advance();
 }
 
-int Sequence::Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char*) {
+void Sequence::CancelWaits() {
+    for (Item* item = first; item != nullptr; item = item->next) {
+        if (item->type == ItemType::Wait) *item->passed = true;
+    }
+    passed.notify_all();
+}
+
+int Sequence::Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char* name) {
     if (entry == nullptr) return SequenceNullArgument;
     if (count == 0 || count > MaxInvocations) return SequenceOutOfRange;
     const std::lock_guard guard(manager->lock);
@@ -336,14 +474,20 @@ int Sequence::Dispatch(JobEntry entry, void* argument, std::uint32_t count, cons
     submitted.invocations += count;
     ++submitted.dispatches;
     if (before.invocations + count > limits.invocations || before.dispatches >= limits.dispatches) return Latch(SequenceLimitExceeded);
-    if (!TakeNode(*manager)) return Latch(SequenceNoNodes);
-    items.push_back({ItemType::Dispatch, this, entry, argument, count, 0, 0, nullptr});
+    Item* item = TakeNode(*manager);
+    if (item == nullptr) return Latch(SequenceNoNodes);
+    item->type = ItemType::Dispatch;
+    item->sequence = this;
+    item->name = name;
+    item->cpu = {entry, argument, count, 0, 0};
+    Append(item);
+    manager->pendingInvocations += count;
     Advance();
     return 0;
 }
 
 void Sequence::SubmitCompute(const Item& item) {
-    const auto* bytes = static_cast<const std::uint8_t*>(item.shader);
+    const auto* bytes = static_cast<const std::uint8_t*>(item.gpu.shader);
     const ShaderRegister* registers = nullptr;
     const std::uint8_t* specials = nullptr;
     std::memcpy(&registers, bytes + 0x20, sizeof(registers));
@@ -351,36 +495,85 @@ void Sequence::SubmitCompute(const Item& item) {
     const std::uint32_t registerCount = bytes[0x5c];
     std::uint32_t modifier = 0;
     std::memcpy(&modifier, specials + 0x10, sizeof(modifier));
-    const auto userData = reinterpret_cast<std::uint64_t>(item.argument);
+    const auto userData = reinterpret_cast<std::uint64_t>(item.gpu.userData);
     const std::array<std::uint32_t, 2> userDataWords{static_cast<std::uint32_t>(userData), static_cast<std::uint32_t>(userData >> 32)};
-    auto& words = commands.emplace_back(64 + 3 * registerCount + item.name.size() / 4);
-    CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
-    bool encoded = sceAgcAcbAcquireMem(&buffer, 0x20380u | (batchStarted ? 0u : 1u), nullptr, 0, 0x190) != nullptr;
-    encoded = encoded && sceAgcCbSetShRegistersDirect(&buffer, registers, registerCount) != nullptr;
-    encoded = encoded && sceAgcCbSetShRegisterRangeDirect(&buffer, UserDataRegister, userDataWords.data(), 2) != nullptr;
-    if (item.named) encoded = encoded && sceAgcAcbPushMarker(&buffer, item.name.c_str(), 0) != nullptr;
-    if ((modifier & 1) != 0) {
+    const auto capacity = std::min(commandWords - commandUsed, 64 + 3 * registerCount + (item.name != nullptr ? std::strlen(item.name) / 4 : 0));
+    auto* const words = commandBegin + commandUsed;
+    CommandBuffer buffer{words, words + capacity, words, words + capacity, nullptr, nullptr, 0};
+    {
+        const GuestArena::HostWrite destination(words, capacity * 4);
+        bool encoded = sceAgcAcbAcquireMem(&buffer, 0x20380u | (batchStarted ? 0u : 1u), nullptr, 0, 0x190) != nullptr;
+        encoded = encoded && sceAgcCbSetShRegistersDirect(&buffer, registers, registerCount) != nullptr;
+        encoded = encoded && sceAgcCbSetShRegisterRangeDirect(&buffer, UserDataRegister, userDataWords.data(), 2) != nullptr;
+        if (item.name != nullptr) encoded = encoded && sceAgcAcbPushMarker(&buffer, item.name, 0) != nullptr;
         if (item.type == ItemType::Compute) {
-            encoded = encoded && sceAgcCbDispatch(&buffer, item.groups[0], item.groups[1], item.groups[2], modifier) != nullptr;
+            encoded = encoded && sceAgcCbDispatch(&buffer, item.gpu.groups[0], item.gpu.groups[1], item.gpu.groups[2], modifier) != nullptr;
         } else {
-            encoded = encoded && sceAgcAcbDispatchIndirect(&buffer, item.indirectArguments, modifier) != nullptr;
+            encoded = encoded && sceAgcAcbDispatchIndirect(&buffer, item.gpu.indirectArguments, modifier) != nullptr;
         }
+        if (item.name != nullptr) encoded = encoded && sceAgcAcbPopMarker(&buffer) != nullptr;
+        if (!encoded) throw std::runtime_error("libSceJobManager: a compute dispatch did not fit its command buffer");
     }
-    if (item.named) encoded = encoded && sceAgcAcbPopMarker(&buffer) != nullptr;
-    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0x620, 0, 0, &label, 1, ++labelTotal, 0, 0, 2, 0) != nullptr;
-    if (!encoded) throw std::runtime_error("libSceJobManager: a compute dispatch did not fit its command buffer");
     batchStarted = true;
-    const Packet packet{words.data(), static_cast<std::uint32_t>(buffer.cursor_up - words.data()), 0, {}};
+    ++pendingCompute;
+    const Packet packet{words, static_cast<std::uint32_t>(buffer.cursor_up - words), 0, {}};
+    commandUsed += packet.dw_num;
     if (sceAgcDriverSubmitAcb(queue, &packet) != 0) throw std::runtime_error("libSceJobManager: sceAgcDriverSubmitAcb failed");
 }
 
-void Sequence::CollectCompute() {
-    const std::uint64_t value = label.value;
-    const auto finished = static_cast<std::uint32_t>(value - labelSeen);
-    labelSeen = value;
-    if (finished == 0) return;
+void Sequence::SetComputeStorage(std::uint32_t* commands, std::size_t words, Label* completion) {
+    commandBegin = commands;
+    commandWords = words;
+    label = completion;
+    const GuestArena::HostWrite destination(label, sizeof(*label));
+    label->value = 0;
+}
+
+void Sequence::SubmitComputeAhead(Item* item) {
+    while (item != nullptr) {
+        if (item->type == ItemType::Compute || item->type == ItemType::ComputeIndirect) {
+            if (!item->encoded) {
+                SubmitCompute(*item);
+                item->encoded = true;
+            }
+        } else {
+            FlushCompute();
+            if (item->type != ItemType::SyncPoint) return;
+        }
+        item = item->next;
+    }
+}
+
+void Sequence::FlushCompute() {
+    if (pendingCompute == 0) return;
+    if (commandWords - commandUsed < 8) throw std::runtime_error("libSceJobManager: a compute completion did not fit its command buffer");
+    auto* const words = commandBegin + commandUsed;
+    CommandBuffer buffer{words, words + 8, words, words + 8, nullptr, nullptr, 0};
+    {
+        const GuestArena::HostWrite destination(words, 32);
+        if (sceAgcCbReleaseMem(&buffer, 0x2f, 0x200, 1, 3, label, 1, progress.Publish(pendingCompute), 0, 0, 2, 0) == nullptr) {
+            throw std::runtime_error("libSceJobManager: a compute completion could not be encoded");
+        }
+    }
+    pendingCompute = 0;
+    const Packet packet{words, static_cast<std::uint32_t>(buffer.cursor_up - words), 0, {}};
+    commandUsed += packet.dw_num;
+    if (sceAgcDriverSubmitAcb(queue, &packet) != 0) throw std::runtime_error("libSceJobManager: sceAgcDriverSubmitAcb failed for a completion");
+}
+
+void Sequence::RetireCompute() {
+    const auto finished = std::min(activeCompute, availableCompute);
+    activeCompute -= finished;
+    availableCompute -= finished;
     completed.dispatches += finished;
     outstanding -= finished;
+}
+
+void Sequence::CollectCompute() {
+    const auto finished = progress.Collect(label->value);
+    if (finished == 0) return;
+    availableCompute += finished;
+    RetireCompute();
     if (outstanding == 0) Advance();
 }
 
@@ -390,8 +583,10 @@ int Sequence::AppendCompute(Item item) {
     if (!compute) throw std::runtime_error("libSceJobManager: a compute dispatch was made on a CPU sequence");
     if (error != 0) return SequenceInvalid;
     if (submitted.dispatches++ >= limits.dispatches) return Latch(SequenceLimitExceeded);
-    if (!TakeNode(*manager)) return Latch(SequenceNoNodes);
-    items.push_back(std::move(item));
+    Item* stored = TakeNode(*manager);
+    if (stored == nullptr) return Latch(SequenceNoNodes);
+    *stored = item;
+    Append(stored);
     Advance();
     return 0;
 }
@@ -399,22 +594,26 @@ int Sequence::AppendCompute(Item item) {
 int Sequence::DispatchCompute(const void* shader, void* userData, std::int32_t x, std::int32_t y, std::int32_t z, const char* name) {
     if (shader == nullptr) return SequenceNullArgument;
     if (x <= 0 || y <= 0 || z <= 0) return SequenceOutOfRange;
-    Item item{ItemType::Compute, this, nullptr, userData, 0, 0, 0, nullptr};
-    item.shader = shader;
-    item.groups = {static_cast<std::uint32_t>(x), static_cast<std::uint32_t>(y), static_cast<std::uint32_t>(z)};
-    item.named = name != nullptr;
-    if (item.named) item.name = name;
-    return AppendCompute(std::move(item));
+    Item item{};
+    item.type = ItemType::Compute;
+    item.sequence = this;
+    item.gpu.shader = shader;
+    item.gpu.userData = userData;
+    item.gpu.groups = {static_cast<std::uint32_t>(x), static_cast<std::uint32_t>(y), static_cast<std::uint32_t>(z)};
+    item.name = name;
+    return AppendCompute(item);
 }
 
 int Sequence::DispatchComputeIndirect(const void* shader, void* userData, const void* indirectArguments, const char* name) {
     if (shader == nullptr || indirectArguments == nullptr || (reinterpret_cast<std::uint64_t>(indirectArguments) & 0x1f) != 0) return SequenceNullArgument;
-    Item item{ItemType::ComputeIndirect, this, nullptr, userData, 0, 0, 0, nullptr};
-    item.shader = shader;
-    item.indirectArguments = indirectArguments;
-    item.named = name != nullptr;
-    if (item.named) item.name = name;
-    return AppendCompute(std::move(item));
+    Item item{};
+    item.type = ItemType::ComputeIndirect;
+    item.sequence = this;
+    item.gpu.shader = shader;
+    item.gpu.userData = userData;
+    item.gpu.indirectArguments = indirectArguments;
+    item.name = name;
+    return AppendCompute(item);
 }
 
 int Sequence::SyncPoint() {
@@ -423,8 +622,11 @@ int Sequence::SyncPoint() {
     if (error != 0) return SequenceInvalid;
     const std::uint32_t before = submitted.syncPoints++;
     if (before >= limits.syncPoints) return Latch(SequenceLimitExceeded);
-    if (!TakeNode(*manager)) return Latch(SequenceNoNodes);
-    items.push_back({ItemType::SyncPoint, this, nullptr, nullptr, 0, 0, 0, nullptr});
+    Item* item = TakeNode(*manager);
+    if (item == nullptr) return Latch(SequenceNoNodes);
+    item->type = ItemType::SyncPoint;
+    item->sequence = this;
+    Append(item);
     Advance();
     return 0;
 }
@@ -437,13 +639,19 @@ int Sequence::Wait() {
 int Sequence::WaitAndClose(std::uint32_t index) {
     std::unique_lock guard(manager->lock);
     const int result = WaitLocked(guard);
-    const auto remaining = static_cast<std::uint32_t>(std::count_if(items.begin(), items.end(), [](const Item& item) { return item.type != ItemType::Wait; }));
-    ReturnNodes(*manager, remaining + 1);
-    items.clear();
-    commands.clear();
-    cursor = 0;
+    while (first != nullptr) {
+        Item* item = first;
+        first = item->next;
+        if (item->type != ItemType::Wait) ReturnNode(*manager, item);
+    }
+    ReturnNode(*manager, reserved);
+    reserved = nullptr;
+    last = nullptr;
+    commandUsed = 0;
+    cursor = nullptr;
     outstanding = 0;
     open = false;
+    Profile(2);
     (compute ? manager->freeComputeSequences : manager->freeSequences) |= std::uint32_t{1} << index;
     return result;
 }
@@ -458,10 +666,23 @@ int Sequence::WaitLocked(std::unique_lock<std::mutex>& guard) {
     }
     ++manager->blockedWaiters;
     bool done = false;
-    items.push_back({ItemType::Wait, this, nullptr, nullptr, 0, 0, 0, &done});
+    Item waiter{};
+    waiter.type = ItemType::Wait;
+    waiter.sequence = this;
+    waiter.passed = &done;
+    Append(&waiter);
     Advance();
+    if (!done && currentWorker == manager) {
+        std::uint64_t runnable = 0;
+        for (const auto& queue : manager->runQueues) {
+            for (const Item* item = queue.first; item != nullptr; item = item->runnableNext) runnable += item->cpu.count - item->cpu.handedOut;
+        }
+        WakeWorkers(*manager, static_cast<std::uint32_t>(std::min(runnable, std::uint64_t{manager->workerCount})), false);
+    }
     passed.wait(guard, [&done] { return done; });
+    RemoveWait(&waiter);
     --manager->blockedWaiters;
+    manager->quiesced.notify_all();
     return result;
 }
 
@@ -471,15 +692,15 @@ bool ValidLimits(std::uint32_t invocations, std::uint32_t dispatches, std::uint3
 }
 
 template <typename TSequences>
-int CreateIn(Manager* manager, TSequences& sequences, std::uint32_t& free, std::uint32_t priority, ISequence** out, const Counters& limits) {
+int CreateIn(Manager* manager, TSequences& sequences, std::uint32_t& free, std::uint32_t priority, ISequence** out, const Counters& limits, const char* name) {
     if (out == nullptr) return SequenceNullArgument;
     if (!ValidLimits(limits.invocations, limits.dispatches, limits.syncPoints, limits.waits)) return SequenceOutOfRange;
     const std::lock_guard guard(manager->lock);
     if (free == 0) return SequenceNoneFree;
     const int index = std::countr_zero(free);
     free &= ~(std::uint32_t{1} << index);
-    Sequence& sequence = sequences[static_cast<std::size_t>(index)];
-    if (!sequence.Open(manager, limits, priority)) return SequenceNoNodes;
+    Sequence& sequence = sequences[static_cast<std::size_t>(index)].value;
+    if (!sequence.Open(manager, limits, priority, name)) return SequenceNoNodes;
     *out = &sequence;
     return 0;
 }
@@ -491,25 +712,25 @@ int DestroyIn(Manager* manager, TSequences& sequences, const std::uint32_t& free
     {
         const std::lock_guard guard(manager->lock);
         for (; index < sequences.size(); ++index) {
-            if (&sequences[index] == sequence) break;
+            if (&sequences[index].value == sequence) break;
         }
         if (index == sequences.size() || (free & (std::uint32_t{1} << index)) != 0) return SequenceInvalid;
-        found = &sequences[index];
+        found = &sequences[index].value;
     }
     static_cast<void>(found->WaitAndClose(index));
     return 0;
 }
 
-int Factory::Create(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char*) {
-    return CreateIn(manager, manager->sequences, manager->freeSequences, priority, out, {invocations, dispatches, syncPoints, waits});
+int Factory::Create(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) {
+    return CreateIn(manager, manager->sequences, manager->freeSequences, priority, out, {invocations, dispatches, syncPoints, waits}, name);
 }
 
 int Factory::Destroy(ISequence* sequence) {
     return DestroyIn(manager, manager->sequences, manager->freeSequences, sequence);
 }
 
-int Factory::CreateCompute(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char*) {
-    return CreateIn(manager, manager->computeSequences, manager->freeComputeSequences, priority, out, {invocations, dispatches, syncPoints, waits});
+int Factory::CreateCompute(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) {
+    return CreateIn(manager, manager->computeSequences, manager->freeComputeSequences, priority, out, {invocations, dispatches, syncPoints, waits}, name);
 }
 
 int Factory::DestroyCompute(ISequence* sequence) {
@@ -525,7 +746,7 @@ void* APS5_VABI ComputeHandlerEntry(void* argument) {
         if (count <= 0) continue;
         if (sceKernelGetEventFilter(&event) == UserEventFilter && sceKernelGetEventId(&event) == 0) return nullptr;
         const std::lock_guard guard(manager.lock);
-        for (Sequence& sequence : manager.computeSequences) sequence.CollectCompute();
+        for (SequenceSlot& slot : manager.computeSequences) slot.value.CollectCompute();
     }
 }
 
@@ -533,44 +754,84 @@ bool RunOne(Manager& manager, std::unique_lock<std::mutex>& guard) {
     Item* item = nullptr;
     for (const std::size_t queue : {std::size_t{1}, std::size_t{0}}) {
         auto& pending = manager.runQueues[queue];
-        if (pending.empty()) continue;
-        item = pending.front();
-        if (item->handedOut + 1 == item->count) pending.pop_front();
+        if (pending.first == nullptr) continue;
+        item = pending.first;
+        if (item->cpu.handedOut + 1 == item->cpu.count) pending.Pop();
         break;
     }
     if (item == nullptr) return false;
-    const std::uint32_t index = item->handedOut++;
-    const JobEntry entry = item->entry;
-    void* const argument = item->argument;
+    const std::uint32_t index = item->cpu.handedOut++;
+    const JobEntry entry = item->cpu.entry;
+    void* const argument = item->cpu.argument;
+    const auto dispatchId = static_cast<std::uint16_t>(item - manager.nodes.data());
     guard.unlock();
+    static_cast<void>(sceRazorCpuJobManagerJob(manager.profileId, dispatchId, static_cast<std::uint16_t>(index), 16));
     entry(argument, index);
+    static_cast<void>(sceRazorCpuJobManagerJob(manager.profileId, dispatchId, static_cast<std::uint16_t>(index), 32));
     guard.lock();
-    if (++item->completed == item->count) item->sequence->DispatchCompleted(item->count);
+    if (++item->cpu.completed == item->cpu.count) {
+        static_cast<void>(sceRazorCpuJobManagerDispatch(item->name, manager.profileId, item->sequence->profileId, dispatchId, static_cast<std::uint16_t>(item->cpu.count), reinterpret_cast<std::uint64_t>(entry), reinterpret_cast<std::uint64_t>(argument)));
+        item->sequence->DispatchCompleted(item->cpu.count);
+    }
     return true;
 }
 
 void* APS5_VABI WorkerEntry(void* argument) {
     Manager& manager = *static_cast<Manager*>(argument);
+    currentWorker = &manager;
+    std::uint64_t lastWork = __rdtsc();
     std::unique_lock guard(manager.lock);
     while (manager.running) {
-        if (RunOne(manager, guard)) continue;
-        manager.work.wait(guard, [&manager] { return !manager.running || !manager.runQueues[0].empty() || !manager.runQueues[1].empty(); });
+        if (RunOne(manager, guard)) {
+            lastWork = __rdtsc();
+            continue;
+        }
+        const bool spinning = manager.pendingInvocations != 0 && __rdtsc() - lastWork < manager.spinTicks;
+        if (spinning || manager.sleepingWorkers >= manager.workerCount - manager.persistentThreads) {
+            guard.unlock();
+            _mm_pause();
+            guard.lock();
+            continue;
+        }
+        ++manager.sleepingWorkers;
+        manager.work.wait(guard, [&manager] { return !manager.running || manager.wakeTokens != 0; });
+        if (manager.wakeTokens != 0) --manager.wakeTokens;
+        --manager.sleepingWorkers;
     }
+    currentWorker = nullptr;
     return nullptr;
 }
 
-std::uint32_t NodeCount(std::uint64_t memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeQueues, bool* fits) {
+struct WorkLayout {
+    std::uint64_t workers = 0;
+    std::uint64_t sequences = 0;
+    std::uint64_t stateEnd = 0;
+    std::uint64_t pool = 0;
+    std::uint64_t commands = 0;
+    std::uint64_t commandBytes = 0;
+    std::uint64_t labels = 0;
+    std::uint32_t nodes = 0;
+};
+
+WorkLayout LayoutFor(std::uint64_t memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeQueues) {
+    WorkLayout layout;
     const std::uint64_t end = memory + size;
-    std::uint64_t address = AlignUp(memory + StateEnd, 8) + workers * ThreadRecordBytes;
+    layout.workers = AlignUp(memory + StateEnd, 8);
+    std::uint64_t address = layout.workers + workers * ThreadRecordBytes;
     for (const std::uint64_t bytes : {std::uint64_t{0x100}, std::uint64_t{0x80}, std::uint64_t{0x80}, std::uint64_t{0x80}}) address = AlignUp(address, 64) + bytes;
-    address = AlignUp(address, 64) + (sequences + computeQueues) * SequenceBytes;
+    layout.sequences = AlignUp(address, 64);
+    address = layout.sequences + (sequences + computeQueues) * SequenceBytes;
+    layout.stateEnd = address;
     if (computeQueues != 0) {
-        address = AlignUp(address + ComputeContextBytes, 0x100) + AlignUp(ComputeCommandBytes * computeQueues, 8);
-        address += AlignUp(4 * std::uint64_t{computeQueues}, 8) + 8 * std::uint64_t{computeQueues};
+        layout.commandBytes = ComputeCommandBudget();
+        layout.commands = AlignUp(address + ComputeContextBytes, 0x100);
+        layout.labels = AlignUp(layout.commands + layout.commandBytes * computeQueues + 4 * std::uint64_t{computeQueues}, 8);
+        address = layout.labels + 8 * std::uint64_t{computeQueues};
     }
     address = AlignUp(address, 64);
-    *fits = address <= end;
-    return *fits ? static_cast<std::uint32_t>(((end - address) / NodeBytes) & 0xffff) : 0;
+    layout.pool = address;
+    if (address <= end) layout.nodes = static_cast<std::uint32_t>(((end - address) / NodeBytes) & 0xffff);
+    return layout;
 }
 
 int ValidateWorkers(const ConfigParams& config, std::uint32_t workers) {
@@ -581,6 +842,17 @@ int ValidateWorkers(const ConfigParams& config, std::uint32_t workers) {
     return 0;
 }
 
+class ThreadAttributes {
+public:
+    ThreadAttributes() {
+        if (scePthreadAttrInit(&value) != 0) throw std::runtime_error("libSceJobManager: scePthreadAttrInit failed");
+    }
+    ~ThreadAttributes() { static_cast<void>(scePthreadAttrDestroy(&value)); }
+    ThreadAttributes(const ThreadAttributes&) = delete;
+    ThreadAttributes& operator=(const ThreadAttributes&) = delete;
+    PthreadAttr value = nullptr;
+};
+
 void StartWorkers(Manager& manager, const ConfigParams& config, std::uint32_t workers) {
     std::uint32_t remaining = config.threadFlags & 0x1fff;
     for (std::uint32_t index = 0; index < workers; ++index) {
@@ -589,46 +861,88 @@ void StartWorkers(Manager& manager, const ConfigParams& config, std::uint32_t wo
             affinity = remaining & (~remaining + 1);
             remaining &= remaining - 1;
         }
-        const std::string name = config.threadName != nullptr ? std::string(config.threadName).substr(0, 31) : "SceJobManagerWorker" + std::to_string(index);
+        std::array<char, 32> name{};
+        if (config.threadName != nullptr) std::snprintf(name.data(), name.size(), "%.31s", config.threadName);
+        else std::snprintf(name.data(), name.size(), "SceJobManagerWorker%u", index);
         const KernelSchedParam schedule{static_cast<int>(config.priority)};
-        PthreadAttr attributes = nullptr;
-        if (scePthreadAttrInit(&attributes) != 0) throw std::runtime_error("libSceJobManager: scePthreadAttrInit failed");
-        if (scePthreadAttrSetinheritsched(&attributes, 0) != 0 || scePthreadAttrSetschedparam(&attributes, &schedule) != 0 ||
-            scePthreadAttrSetstacksize(&attributes, config.stackSize) != 0 || scePthreadAttrSetaffinity(&attributes, affinity) != 0) {
+        ThreadAttributes attributes;
+        if (scePthreadAttrSetinheritsched(&attributes.value, 0) != 0 || scePthreadAttrSetschedparam(&attributes.value, &schedule) != 0 ||
+            scePthreadAttrSetstacksize(&attributes.value, config.stackSize) != 0 || scePthreadAttrSetaffinity(&attributes.value, affinity) != 0) {
             throw std::runtime_error("libSceJobManager: a worker thread attribute was rejected");
         }
         Pthread thread = nullptr;
-        const int created = scePthreadCreate(&thread, &attributes, WorkerEntry, &manager, name.c_str());
-        scePthreadAttrDestroy(&attributes);
+        const int created = scePthreadCreate(&thread, &attributes.value, WorkerEntry, &manager, name.data());
         if (created != 0) throw std::runtime_error("libSceJobManager: scePthreadCreate failed for a worker");
-        manager.workers.push_back(thread);
+        manager.workers[manager.activeWorkers++].thread = thread;
     }
 }
 
-void StartCompute(Manager& manager, std::uint32_t computeSequences, std::uint64_t computeQueueMask, std::uint32_t priority, std::uint32_t affinity) {
+void StartCompute(Manager& manager, const WorkLayout& layout, std::uint32_t computeSequences, std::uint64_t computeQueueMask, std::uint32_t priority, std::uint32_t affinity) {
     if (sceKernelCreateEqueue(&manager.computeEvents, "SceJobManagerComputeEventQueue") != 0) throw std::runtime_error("libSceJobManager: sceKernelCreateEqueue failed");
     for (std::uint64_t mask = computeQueueMask; mask != 0; mask &= mask - 1) {
         const std::uint32_t queue = FirstComputeQueue + static_cast<std::uint32_t>(std::countr_zero(mask));
         if (sceAgcDriverAddEqEvent(manager.computeEvents, static_cast<int>(queue), nullptr) != 0) throw std::runtime_error("libSceJobManager: sceAgcDriverAddEqEvent failed");
-        manager.computeQueues.push_back(queue);
+        manager.computeQueues |= std::uint64_t{1} << (queue - FirstComputeQueue);
     }
-    manager.computeSequences.resize(computeSequences);
+    std::uint64_t availableQueues = computeQueueMask;
     for (std::uint32_t index = 0; index < computeSequences; ++index) {
-        manager.computeSequences[index].compute = true;
-        manager.computeSequences[index].queue = manager.computeQueues[index];
+        Sequence& sequence = manager.computeSequences[index].value;
+        sequence.compute = true;
+        sequence.queue = FirstComputeQueue + static_cast<std::uint32_t>(std::countr_zero(availableQueues));
+        availableQueues &= availableQueues - 1;
+        sequence.SetComputeStorage(reinterpret_cast<std::uint32_t*>(layout.commands + index * layout.commandBytes),
+            static_cast<std::size_t>(layout.commandBytes / 4), reinterpret_cast<Label*>(layout.labels + index * sizeof(Label)));
     }
     manager.freeComputeSequences = computeSequences == MaxSequences ? ~std::uint32_t{0} : (std::uint32_t{1} << computeSequences) - 1;
     const KernelSchedParam schedule{static_cast<int>(priority)};
-    PthreadAttr attributes = nullptr;
-    if (scePthreadAttrInit(&attributes) != 0 || scePthreadAttrSetinheritsched(&attributes, 0) != 0 || scePthreadAttrSetschedparam(&attributes, &schedule) != 0 ||
-        scePthreadAttrSetstacksize(&attributes, 0x4000) != 0 || scePthreadAttrSetaffinity(&attributes, affinity) != 0) {
+    ThreadAttributes attributes;
+    if (scePthreadAttrSetinheritsched(&attributes.value, 0) != 0 || scePthreadAttrSetschedparam(&attributes.value, &schedule) != 0 ||
+        scePthreadAttrSetstacksize(&attributes.value, 0x4000) != 0 || scePthreadAttrSetaffinity(&attributes.value, affinity) != 0) {
         throw std::runtime_error("libSceJobManager: a compute handler thread attribute was rejected");
     }
-    const int created = scePthreadCreate(&manager.computeHandler, &attributes, ComputeHandlerEntry, &manager, "SceJobManagerComputeEventHdlr");
-    scePthreadAttrDestroy(&attributes);
+    const int created = scePthreadCreate(&manager.computeHandler, &attributes.value, ComputeHandlerEntry, &manager, "SceJobManagerComputeEventHdlr");
     if (created != 0) throw std::runtime_error("libSceJobManager: scePthreadCreate failed for the compute handler");
 }
 
+void StopManager(Manager& manager) {
+    {
+        const std::lock_guard guard(manager.lock);
+        manager.running = false;
+        manager.work.notify_all();
+    }
+    while (manager.activeWorkers != 0) {
+        if (scePthreadJoin(manager.workers[manager.activeWorkers - 1].thread, nullptr) != 0) throw std::runtime_error("sce::Job::JobManager::shutdown: scePthreadJoin failed");
+        manager.workers[--manager.activeWorkers].thread = nullptr;
+    }
+    if (manager.computeHandler != nullptr) {
+        if (sceKernelAddUserEventEdge(manager.computeEvents, 0) != 0 || sceKernelTriggerUserEvent(manager.computeEvents, 0, nullptr) != 0) {
+            throw std::runtime_error("sce::Job::JobManager::shutdown: the compute handler could not be signalled");
+        }
+        if (scePthreadJoin(manager.computeHandler, nullptr) != 0) throw std::runtime_error("sce::Job::JobManager::shutdown: scePthreadJoin failed");
+        manager.computeHandler = nullptr;
+    }
+    if (manager.computeEvents != 0) {
+        for (std::uint64_t mask = manager.computeQueues; mask != 0; mask &= mask - 1) {
+            const auto queue = FirstComputeQueue + static_cast<std::uint32_t>(std::countr_zero(mask));
+            static_cast<void>(sceAgcDriverDeleteEqEvent(manager.computeEvents, static_cast<int>(queue)));
+        }
+        if (sceKernelDeleteEqueue(manager.computeEvents) != 0) throw std::runtime_error("sce::Job::JobManager::shutdown: sceKernelDeleteEqueue failed");
+        manager.computeEvents = 0;
+        manager.computeQueues = 0;
+    }
+    std::unique_lock guard(manager.lock);
+    for (SequenceSlot& slot : manager.sequences) slot.value.CancelWaits();
+    for (SequenceSlot& slot : manager.computeSequences) slot.value.CancelWaits();
+    manager.quiesced.wait(guard, [&manager] { return manager.blockedWaiters == 0; });
+}
+
+void DestroyManager(Manager* manager) {
+    const GuestArena::HostWrite memory(manager->stateBegin, manager->stateBytes);
+    for (SequenceSlot& slot : manager->sequences) std::destroy_at(&slot);
+    for (SequenceSlot& slot : manager->computeSequences) std::destroy_at(&slot);
+    std::destroy_at(manager);
+}
+
 int Initialize(void* self, void* memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeSequences, std::uint64_t computeQueueMask, const ConfigParams* config, bool unified) {
     if (Implementation(self) != nullptr) return ManagerAlreadyInitialized;
     if (memory == nullptr) return ManagerNullMemory;
@@ -642,35 +956,76 @@ int Initialize(void* self, void* memory, std::uint64_t size, std::uint32_t worke
     }
     if (size < StateOffset) return ManagerMemoryTooSmall;
     if (size < StateEnd) throw std::runtime_error("sce::Job::JobManager::initialize: a memory block smaller than 0x2d8 bytes is not supported");
-    std::memset(static_cast<std::uint8_t*>(memory) + StateOffset, 0, StateEnd - StateOffset);
-    const BlockHeader header{0x4d4a, static_cast<std::uint16_t>(StateOffset), 0x05000001, static_cast<std::uint32_t>(size), 0};
-    std::memcpy(memory, &header, sizeof(header));
+    {
+        const GuestArena::HostWrite destination(memory, StateEnd);
+        std::memset(static_cast<std::uint8_t*>(memory) + StateOffset, 0, StateEnd - StateOffset);
+        const BlockHeader header{0x4d4a, static_cast<std::uint16_t>(StateOffset), 0x05000001, static_cast<std::uint32_t>(size), 0};
+        std::memcpy(memory, &header, sizeof(header));
+    }
     if (config != nullptr && config->version > 1) return ManagerInvalidArgument;
     const ConfigParams& settings = config != nullptr ? *config : DefaultConfig;
     const auto computeQueues = computeSequences != 0 ? static_cast<std::uint32_t>(std::popcount(computeQueueMask)) : 0;
-    bool fits = false;
-    const std::uint32_t nodes = NodeCount(base, size, workers, sequences, computeQueues, &fits);
-    if (!fits || nodes == 0) return ManagerMemoryTooSmall;
+    const auto layout = LayoutFor(base, size, workers, sequences, computeQueues);
+    if (layout.nodes == 0) return ManagerMemoryTooSmall;
     if (const int invalid = ValidateWorkers(settings, workers); invalid != 0) return invalid;
     const bool ownHandlerSettings = (settings.version & 1) != 0;
     const std::uint32_t handlerPriority = ownHandlerSettings ? settings.computePriority : 0x100;
     const std::uint32_t handlerAffinity = ownHandlerSettings ? settings.computeAffinity : 0x1fff;
     if (computeSequences != 0 && (handlerPriority < 0x100 || handlerPriority > 0x2ff || handlerAffinity == 0 || handlerAffinity > 0x1fff)) return ManagerInvalidArgument;
-    auto* manager = new Manager;
+    const GuestArena::HostWrite stateMemory(memory, static_cast<std::size_t>(layout.stateEnd - base));
+    const GuestArena::HostWrite nodeMemory(reinterpret_cast<void*>(layout.pool), layout.nodes * sizeof(Item));
+    Manager* manager = std::construct_at(reinterpret_cast<Manager*>(base + StateOffset));
+    manager->stateBegin = memory;
+    manager->stateBytes = static_cast<std::size_t>(layout.stateEnd - base);
+    manager->nodes = {reinterpret_cast<Item*>(layout.pool), layout.nodes};
+    std::unique_ptr<Manager, decltype(&DestroyManager)> owner(manager, DestroyManager);
     manager->running = true;
-    manager->freeNodes = nodes - 1;
+    manager->workerCount = workers;
+    manager->spinTicks = sceKernelGetTscFrequency() / 1000000 * settings.spinMicroseconds;
+    for (std::uint32_t index = 0; index < layout.nodes; ++index) std::construct_at(&manager->nodes[index]);
+    for (std::uint32_t index = layout.nodes; index > 1; --index) ReturnNode(*manager, &manager->nodes[index - 1]);
     manager->freeSequences = sequences == MaxSequences ? ~std::uint32_t{0} : (std::uint32_t{1} << sequences) - 1;
-    manager->sequences = std::vector<Sequence>(sequences);
+    manager->workers = {reinterpret_cast<WorkerSlot*>(layout.workers), workers};
+    for (WorkerSlot& worker : manager->workers) std::construct_at(&worker);
+    auto* cpuSlots = reinterpret_cast<SequenceSlot*>(layout.sequences);
+    auto* computeSlots = cpuSlots + sequences;
+    for (std::uint32_t index = 0; index < sequences; ++index) {
+        std::construct_at(cpuSlots + index);
+        cpuSlots[index].value.profileId = static_cast<std::uint16_t>(index);
+        manager->sequences = {cpuSlots, index + 1};
+    }
+    for (std::uint32_t index = 0; index < computeSequences; ++index) {
+        std::construct_at(computeSlots + index);
+        computeSlots[index].value.profileId = static_cast<std::uint16_t>(sequences + index);
+        manager->computeSequences = {computeSlots, index + 1};
+    }
     for (std::uint32_t priority = 0; priority < 2; ++priority) {
         manager->factories[priority].manager = manager;
         manager->factories[priority].priority = priority;
         manager->unifiedFactories[priority].manager = manager;
         manager->unifiedFactories[priority].priority = priority;
     }
-    if (computeSequences != 0) StartCompute(*manager, computeSequences, computeQueueMask, handlerPriority, handlerAffinity);
-    Implementation(self) = manager;
-    StartWorkers(*manager, settings, workers);
-    return 0;
+    try {
+        if (computeSequences != 0) StartCompute(*manager, layout, computeSequences, computeQueueMask, handlerPriority, handlerAffinity);
+        StartWorkers(*manager, settings, workers);
+    } catch (...) {
+        try {
+            StopManager(*manager);
+        } catch (...) {
+            Implementation(self) = owner.release();
+            throw;
+        }
+        throw;
+    }
+    Implementation(self) = owner.release();
+    const int result = _sceUlobjmgrRegisterObject_nid_postfix(base, 0x21, &manager->objectId);
+    std::uint32_t crc = 0;
+    for (std::uint32_t byte = 0; byte < sizeof(base); ++byte) {
+        crc ^= static_cast<std::uint8_t>(base >> (byte * 8));
+        for (std::uint32_t bit = 0; bit < 8; ++bit) crc = (crc >> 1) ^ (0x82f63b78u & (0u - (crc & 1)));
+    }
+    manager->profileId = static_cast<std::uint16_t>(crc >> 16);
+    return result;
 }
 
 ISequenceFactory* FactoryFor(void* self, std::uint32_t priority, bool unified) {
@@ -693,8 +1048,6 @@ void APS5_VABI _ZN3sce3Job10JobManagerC2Ev(void* self) {
     Implementation(self) = nullptr;
 }
 
-int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self);
-
 void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self) {
     if (Implementation(self) != nullptr) {
         static_cast<void>(_ZN3sce3Job10JobManager8shutdownEv(self));
@@ -703,6 +1056,7 @@ void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self) {
 
 void APS5_VABI _ZN3sce3Job10JobManagerD2Ev(void* self) {
     _ZN3sce3Job10JobManagerD1Ev(self);
+
 }
 
 std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams* params) {
@@ -724,7 +1078,7 @@ std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKN
     if (computeSequences != 0) {
         const auto queues = static_cast<std::uint64_t>(std::popcount(params->computeQueueMask));
         bytes = (bytes + (params->sequences + queues) * SequenceBytes + 0x267) & ~std::uint64_t{0xff};
-        bytes = (bytes + ComputeCommandBytes * queues + 3) & ~std::uint64_t{3};
+        bytes = (bytes + ComputeCommandBudget() * queues + 3) & ~std::uint64_t{3};
         bytes = (bytes + 4 * queues + 7) & ~std::uint64_t{7};
         bytes += 8 * queues;
     } else {
@@ -745,28 +1099,15 @@ int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(voi
 int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self) {
     Manager* manager = Implementation(self);
     if (manager == nullptr) return ManagerNotInitialized;
+    if (currentWorker == manager) throw std::runtime_error("sce::Job::JobManager::shutdown: a worker cannot join itself");
     {
         const std::lock_guard guard(manager->lock);
-        if (manager->blockedWaiters != 0) throw std::runtime_error("sce::Job::JobManager::shutdown: a thread is still blocked in a sequence wait");
-        for (const Sequence& sequence : manager->computeSequences) {
-            if (sequence.open && sequence.Busy()) throw std::runtime_error("sce::Job::JobManager::shutdown: a compute sequence still has work in flight");
-        }
         manager->running = false;
-        manager->work.notify_all();
-    }
-    for (const Pthread worker : manager->workers) {
-        if (scePthreadJoin(worker, nullptr) != 0) throw std::runtime_error("sce::Job::JobManager::shutdown: scePthreadJoin failed");
-    }
-    if (manager->computeHandler != nullptr) {
-        if (sceKernelAddUserEventEdge(manager->computeEvents, 0) != 0 || sceKernelTriggerUserEvent(manager->computeEvents, 0, nullptr) != 0) {
-            throw std::runtime_error("sce::Job::JobManager::shutdown: the compute handler could not be signalled");
-        }
-        if (scePthreadJoin(manager->computeHandler, nullptr) != 0) throw std::runtime_error("sce::Job::JobManager::shutdown: scePthreadJoin failed");
-        for (const std::uint32_t queue : manager->computeQueues) static_cast<void>(sceAgcDriverDeleteEqEvent(manager->computeEvents, static_cast<int>(queue)));
-        if (sceKernelDeleteEqueue(manager->computeEvents) != 0) throw std::runtime_error("sce::Job::JobManager::shutdown: sceKernelDeleteEqueue failed");
     }
+    StopManager(*manager);
+    static_cast<void>(_sceUlobjmgrUnregisterObject_nid_postfix(manager->objectId));
     Implementation(self) = nullptr;
-    delete manager;
+    DestroyManager(manager);
     return 0;
 }
 
@@ -781,7 +1122,7 @@ ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryIn
 int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count) {
     Manager* manager = Implementation(self);
     if (manager == nullptr) return ManagerNotInitialized;
-    if (count > manager->workers.size()) return ManagerInvalidArgument;
+    if (count > manager->workerCount) return ManagerInvalidArgument;
     const std::lock_guard guard(manager->lock);
     manager->persistentThreads = count;
     return 0;
diff --git a/core/libs/prx/libSceJobManager/include/Api.hpp b/core/libs/prx/libSceJobManager/include/Api.hpp
new file mode 100644
index 0000000000..f76c944d21
--- /dev/null
+++ b/core/libs/prx/libSceJobManager/include/Api.hpp
@@ -0,0 +1,78 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <deque>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+struct MemorySizeQueryParams {
+    std::uint32_t version;
+    std::uint32_t workers;
+    std::uint32_t sequences;
+    std::uint32_t invocations;
+    std::uint32_t dispatches;
+    std::uint32_t syncPoints;
+    std::uint32_t waits;
+    std::uint32_t computeSequences;
+    std::uint64_t computeQueueMask;
+};
+
+struct ConfigParams {
+    std::uint32_t version;
+    std::uint32_t threadFlags;
+    std::uint32_t stackSize;
+    std::uint32_t priority;
+    const char* threadName;
+    std::uint32_t spinMicroseconds;
+    std::uint32_t computeAffinity;
+    std::uint32_t computePriority;
+    std::uint32_t reserved;
+};
+
+using JobEntry = void (APS5_VABI*)(void* argument, std::uint32_t index);
+
+class ISequence {
+public:
+    APS5_VABI virtual int Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char* name) = 0;
+    APS5_VABI virtual int SyncPoint() = 0;
+    APS5_VABI virtual int Wait() = 0;
+    APS5_VABI virtual void CompleteDestructor() {}
+    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence was deleted by its caller"); }
+    APS5_VABI virtual int DispatchCompute(const void* shader, void* userData, std::int32_t x, std::int32_t y, std::int32_t z, const char* name) = 0;
+    APS5_VABI virtual int DispatchComputeIndirect(const void* shader, void* userData, const void* indirectArguments, const char* name) = 0;
+};
+
+class ISequenceFactory {
+public:
+    APS5_VABI virtual int Create(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
+    APS5_VABI virtual int Destroy(ISequence* sequence) = 0;
+    APS5_VABI virtual void CompleteDestructor() {}
+    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence factory was deleted by its caller"); }
+    APS5_VABI virtual int CreateCompute(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
+    APS5_VABI virtual int DestroyCompute(ISequence* sequence) = 0;
+};
+
+extern "C" {
+
+void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void* self);
+void APS5_VABI _ZN3sce3Job10JobManagerC2Ev(void* self);
+void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self);
+void APS5_VABI _ZN3sce3Job10JobManagerD2Ev(void* self);
+std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams* params);
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t memorySize, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeSequences, std::uint64_t computeQueueMask, const ConfigParams* config);
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t memorySize, std::uint32_t workers, std::uint32_t sequences, const ConfigParams* config);
+int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self);
+ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority);
+ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority);
+int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count);
+
+}
diff --git a/core/libs/prx/libSceJobManager/libSceJobManager.hpp b/core/libs/prx/libSceJobManager/libSceJobManager.hpp
new file mode 100644
index 0000000000..740c6ddc49
--- /dev/null
+++ b/core/libs/prx/libSceJobManager/libSceJobManager.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJobManager/include/Api.hpp"
diff --git a/core/libs/prx/libSceJpegDec/Export.cpp b/core/libs/prx/libSceJpegDec/Export.cpp
index aeddcbeb6c..d7d11c7277 100644
--- a/core/libs/prx/libSceJpegDec/Export.cpp
+++ b/core/libs/prx/libSceJpegDec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegDec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
diff --git a/core/libs/prx/libSceJpegDec/include/Api.hpp b/core/libs/prx/libSceJpegDec/include/Api.hpp
new file mode 100644
index 0000000000..0f0892be0a
--- /dev/null
+++ b/core/libs/prx/libSceJpegDec/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceJpegDecCreate(const JpegDecCreateParam* param, void* memoryAddress, uint32_t memorySize, void** handle);
+int32_t APS5_VABI sceJpegDecDecode(void* handle, const JpegDecDecodeParam* param, JpegDecImageInfo* imageInfo);
+int32_t APS5_VABI sceJpegDecDelete(void* handle);
+int32_t APS5_VABI sceJpegDecParseHeader(const JpegDecParseParam* param, JpegDecImageInfo* imageInfo);
+int32_t APS5_VABI sceJpegDecQueryMemorySize(const JpegDecCreateParam* param);
+int APS5_VABI sceJpegDecDecodeWithInputControl();
+
+}
diff --git a/core/libs/prx/libSceJpegDec/libSceJpegDec.hpp b/core/libs/prx/libSceJpegDec/libSceJpegDec.hpp
new file mode 100644
index 0000000000..e1581fb344
--- /dev/null
+++ b/core/libs/prx/libSceJpegDec/libSceJpegDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJpegDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceJpegEnc/Export.cpp b/core/libs/prx/libSceJpegEnc/Export.cpp
index a5801fcbeb..6a2407eebe 100644
--- a/core/libs/prx/libSceJpegEnc/Export.cpp
+++ b/core/libs/prx/libSceJpegEnc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegEnc/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceJpegEnc/include/Api.hpp b/core/libs/prx/libSceJpegEnc/include/Api.hpp
new file mode 100644
index 0000000000..25215e5d07
--- /dev/null
+++ b/core/libs/prx/libSceJpegEnc/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceJpegEncCreate(const JpegEncCreateParam* param, void* memory, uint32_t memorySize, void** handle);
+int32_t APS5_VABI sceJpegEncDelete(void* handle);
+int32_t APS5_VABI sceJpegEncEncode(void* handle, const JpegEncEncodeParam* param, JpegEncOutputInfo* outputInfo);
+int32_t APS5_VABI sceJpegEncQueryMemorySize(const JpegEncCreateParam* param);
+
+}
diff --git a/core/libs/prx/libSceJpegEnc/libSceJpegEnc.hpp b/core/libs/prx/libSceJpegEnc/libSceJpegEnc.hpp
new file mode 100644
index 0000000000..a5548622ca
--- /dev/null
+++ b/core/libs/prx/libSceJpegEnc/libSceJpegEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJpegEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceJpegParser/libSceJpegParser.hpp b/core/libs/prx/libSceJpegParser/libSceJpegParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJpegParser/libSceJpegParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJsc/libSceJsc.hpp b/core/libs/prx/libSceJsc/libSceJsc.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJsc/libSceJsc.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJscCompiler/libSceJscCompiler.hpp b/core/libs/prx/libSceJscCompiler/libSceJscCompiler.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJscCompiler/libSceJscCompiler.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJson/libSceJson.hpp b/core/libs/prx/libSceJson/libSceJson.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJson/libSceJson.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJson2/Export.cpp b/core/libs/prx/libSceJson2/Export.cpp
index a84b073cd9..477b3d020f 100644
--- a/core/libs/prx/libSceJson2/Export.cpp
+++ b/core/libs/prx/libSceJson2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJson2/include/Api.hpp"
 #include <algorithm>
 #include <bit>
 #include <cerrno>
@@ -14,76 +15,20 @@
 #include <sstream>
 #include <stdexcept>
 #include <string>
+#include <string_view>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 namespace {
 
-enum ValueType : std::int32_t {
-    TypeNull = 0,
-    TypeBoolean = 1,
-    TypeInteger = 2,
-    TypeUInteger = 3,
-    TypeReal = 4,
-    TypeString = 5,
-    TypeArray = 6,
-    TypeObject = 7,
-};
+using namespace SceJson2;
 
 constexpr int JsonErrorParse = static_cast<int>(0x80848101);
 
-struct Node;
-struct Value { Node* node; };
-struct String { std::string* text; };
-struct Array { std::list<Value>* items; };
-struct Pair;
-struct Object { std::list<Pair>* items; };
-struct ArrayIteratorState {
-    std::list<Value>::iterator position;
-    std::list<Value>::iterator end;
-};
-struct ArrayIterator { ArrayIteratorState* state; };
-struct ObjectIteratorState {
-    std::list<Pair>* owner = nullptr;
-    std::list<Pair>::iterator position{};
-};
-struct ObjectIterator { ObjectIteratorState* state; };
-struct Pair {
-    String key;
-    std::uint64_t reserved;
-    Value value;
-};
 static_assert(sizeof(Value) == 8 && sizeof(String) == 8 && sizeof(Array) == 8 && sizeof(Object) == 8);
 static_assert(sizeof(ArrayIterator) == 8 && sizeof(ObjectIterator) == 8);
 static_assert(offsetof(Pair, value) == 0x10);
 
-using TypeMismatchHandler = const Value& (APS5_VABI*)(ValueType, const Value*, const Value*, void*);
-using SpecialFloatHandler = Value* (APS5_VABI*)(Value*, std::int32_t, double, const Value*, void*, bool*);
-using ElementAccessFailureHandler = void (APS5_VABI*)(int, const String*, const std::size_t*, const Value*, const Value*, void*);
-
-struct Handlers {
-    TypeMismatchHandler typeMismatch = nullptr;
-    void* typeMismatchContext = nullptr;
-    SpecialFloatHandler specialFloat = nullptr;
-    void* specialFloatContext = nullptr;
-    ElementAccessFailureHandler elementAccessFailure = nullptr;
-    void* elementAccessFailureContext = nullptr;
-};
-
-struct Node {
-    ValueType type = TypeNull;
-    bool boolean = false;
-    std::int64_t integer = 0;
-    std::uint64_t uinteger = 0;
-    double real = 0;
-    String string{};
-    Array array{};
-    Object object{};
-    Handlers handlers{};
-};
-
-using NullAccessCallback = const Value& (APS5_VABI*)(ValueType, const Value*, void*);
-
 struct Globals {
     std::mutex mutex;
     NullAccessCallback callback = nullptr;
@@ -374,8 +319,6 @@ Value& ObjectEntry(Object& object, const std::string& key) {
     }
 }
 
-using ParserReadCallback = int (APS5_VABI*)(char&, void*);
-
 class Parser {
 public:
     Parser(const char* text, std::size_t size, const Handlers& handlers) : text(text), end(text + size), handlers(handlers) {}
@@ -549,10 +492,9 @@ private:
                 skip();
                 if (peek() >= 0 && peek() == ']') { take(); --depth; return true; }
                 for (;;) {
-                    Value item{};
+                    auto& item = out.array.items->emplace_back();
                     Construct(item);
                     item.node->handlers = handlers;
-                    out.array.items->push_back(item);
                     skip();
                     if (!value(*item.node)) return false;
                     skip();
@@ -622,7 +564,6 @@ void* const JsonMemAllocatorVtable[] = {
     reinterpret_cast<void*>(&JsonMemAllocatorPureVirtual), reinterpret_cast<void*>(&JsonMemAllocatorPureVirtual),
 };
 
-
 }
 
 extern "C" {
@@ -725,6 +666,34 @@ String* APS5_VABI _ZNK3sce4Json6String6substrEmm(String* result, const String* s
 }
 std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const String* self, char character, std::size_t position) { return self->text->find(character, position); }
 std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const String* self, char character, std::size_t position) { return self->text->rfind(character, position); }
+char APS5_VABI _ZNK3sce4Json6String2atEm(const String* self, std::size_t position) {
+    if (position >= self->text->size()) throw std::out_of_range("sce::Json::String::at: position past the end");
+    return (*self->text)[position];
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcm(const String* self, const char* text, std::size_t position) {
+    if (text == nullptr) throw std::invalid_argument("sce::Json::String::find: null text");
+    return self->text->find(text, position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcmm(const String* self, const char* text, std::size_t position, std::size_t length) {
+    if (text == nullptr && length > 0) throw std::invalid_argument("sce::Json::String::find: null text");
+    return self->text->find(std::string_view(text == nullptr ? "" : text, length), position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String4findERKS1_m(const String* self, const String* other, std::size_t position) {
+    if (other == nullptr || other->text == nullptr) throw std::invalid_argument("sce::Json::String::find: null other");
+    return self->text->find(*other->text, position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcm(const String* self, const char* text, std::size_t position) {
+    if (text == nullptr) throw std::invalid_argument("sce::Json::String::rfind: null text");
+    return self->text->rfind(text, position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcmm(const String* self, const char* text, std::size_t position, std::size_t length) {
+    if (text == nullptr && length > 0) throw std::invalid_argument("sce::Json::String::rfind: null text");
+    return self->text->rfind(std::string_view(text == nullptr ? "" : text, length), position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindERKS1_m(const String* self, const String* other, std::size_t position) {
+    if (other == nullptr || other->text == nullptr) throw std::invalid_argument("sce::Json::String::rfind: null other");
+    return self->text->rfind(*other->text, position);
+}
 int APS5_VABI _ZNK3sce4Json6String7compareEPKc(const String* self, const char* text) {
     if (text == nullptr) throw std::invalid_argument("sce::Json::String::compare: null text");
     return CompareText(self->text->c_str(), text);
@@ -737,6 +706,14 @@ int APS5_VABI _ZNK3sce4Json6String7compareERKS1_(const String* self, const Strin
 void APS5_VABI _ZN3sce4Json5ArrayC1Ev(Array* self) { Construct(*self); }
 void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(Array* self, const Array* other) { CopyArray(*self, *other); }
 void APS5_VABI _ZN3sce4Json5ArrayD1Ev(Array* self) { Destroy(*self); }
+Array* APS5_VABI _ZN3sce4Json5ArrayaSERKS1_(Array* self, const Array* other) {
+    if (self == other) return self;
+    Array copy{};
+    CopyArray(copy, *other);
+    Destroy(*self);
+    *self = copy;
+    return self;
+}
 void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(Array* self, const Value* value) {
     Value copy{};
     CopyInto(copy, *value);
@@ -851,6 +828,7 @@ ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iterator7advanceEm(ObjectIterator*
     if (self->state && self->state->owner) {
         while (count) {
             _ZN3sce4Json6Object8iteratorppEv(self);
+
             --count;
         }
     }
@@ -1061,7 +1039,6 @@ int APS5_VABI _ZNK3sce4Json5Value8toStringERNS0_6StringE(const Value* self, Stri
     return 0;
 }
 
-
 int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(Value* out, ParserReadCallback read, void* context) {
     if (read == nullptr) throw std::invalid_argument("sce::Json::Parser::parse: null read callback");
     Parser parser(read, context, NodeOf(*out).handlers);
@@ -1075,26 +1052,12 @@ int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(Value* out, const char*
     return ParseValue(out, parser);
 }
 
-
-struct InitParameterRtti {
-    void* allocParam;
-    void* userData;
-    std::size_t fileBufferSize;
-};
-
 void APS5_VABI _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(InitParameterRtti* self, void* allocParam, void* userData, std::size_t fileBufferSize) {
     self->allocParam = allocParam;
     self->userData = userData;
     self->fileBufferSize = fileBufferSize;
 }
 
-struct InitParameter2 {
-    void* allocator;
-    void* userData;
-    std::size_t fileBufferSize;
-    std::int32_t specialFloatFormatType;
-    std::uint32_t reserved[3];
-};
 static_assert(sizeof(InitParameter2) == 0x28 && offsetof(InitParameter2, specialFloatFormatType) == 0x18);
 
 void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(InitParameter2* self) {
@@ -1104,6 +1067,7 @@ void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(InitParameter2* self) {
 
 void APS5_VABI _ZN3sce4Json14InitParameter2C2Ev(InitParameter2* self) {
     _ZN3sce4Json14InitParameter2C1Ev(self);
+
 }
 
 void APS5_VABI _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(InitParameter2* self, void* allocator, void* userData) {
@@ -1231,6 +1195,7 @@ ObjectIterator* APS5_VABI _ZN3sce4Json6Object6insertERKNS1_4PairE(ObjectIterator
 ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEi(ArrayIterator* result, ArrayIterator* self, int) {
     _ZN3sce4Json5Array8iteratorC1ERKS2_(result, self);
     _ZN3sce4Json5Array8iteratorppEv(self);
+
     return result;
 }
 
@@ -1253,6 +1218,7 @@ void APS5_VABI _ZN3sce4Json5Array8iteratorC1Ev(ArrayIterator* self) {
 ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEi(ObjectIterator* result, ObjectIterator* self, int) {
     auto state = self->state ? std::make_unique<ObjectIteratorState>(*self->state) : nullptr;
     _ZN3sce4Json6Object8iteratorppEv(self);
+
     result->state = state.release();
     return result;
 }
diff --git a/core/libs/prx/libSceJson2/InventoryExports.cpp b/core/libs/prx/libSceJson2/InventoryExports.cpp
index 5c89743172..c509808eb3 100644
--- a/core/libs/prx/libSceJson2/InventoryExports.cpp
+++ b/core/libs/prx/libSceJson2/InventoryExports.cpp
@@ -167,12 +167,6 @@ int APS5_VABI sceJson2Unknown_027_nid_no_patch() {
 }
 APS5_EXPORT("_ZN3sce4Json5ArrayD2Ev", sceJson2Unknown_027_nid_no_patch);
 
-int APS5_VABI sceJson2Unknown_028_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZN3sce4Json5ArrayaSERKS1_", sceJson2Unknown_028_nid_no_patch);
-
 int APS5_VABI sceJson2Unknown_029_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -407,46 +401,4 @@ int APS5_VABI sceJson2Unknown_067_nid_no_patch() {
 }
 APS5_EXPORT("_ZNK3sce4Json5ValueixERKNS0_6StringE", sceJson2Unknown_067_nid_no_patch);
 
-int APS5_VABI sceJson2Unknown_068_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZNK3sce4Json6String2atEm", sceJson2Unknown_068_nid_no_patch);
-
-int APS5_VABI sceJson2Unknown_069_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZNK3sce4Json6String4findEPKcm", sceJson2Unknown_069_nid_no_patch);
-
-int APS5_VABI sceJson2Unknown_070_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZNK3sce4Json6String4findEPKcmm", sceJson2Unknown_070_nid_no_patch);
-
-int APS5_VABI sceJson2Unknown_071_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZNK3sce4Json6String4findERKS1_m", sceJson2Unknown_071_nid_no_patch);
-
-int APS5_VABI sceJson2Unknown_072_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZNK3sce4Json6String5rfindEPKcm", sceJson2Unknown_072_nid_no_patch);
-
-int APS5_VABI sceJson2Unknown_073_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZNK3sce4Json6String5rfindEPKcmm", sceJson2Unknown_073_nid_no_patch);
-
-int APS5_VABI sceJson2Unknown_074_nid_no_patch() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-APS5_EXPORT("_ZNK3sce4Json6String5rfindERKS1_m", sceJson2Unknown_074_nid_no_patch);
-
 }
diff --git a/core/libs/prx/libSceJson2/include/Api.hpp b/core/libs/prx/libSceJson2/include/Api.hpp
new file mode 100644
index 0000000000..630d23d193
--- /dev/null
+++ b/core/libs/prx/libSceJson2/include/Api.hpp
@@ -0,0 +1,347 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <bit>
+#include <cerrno>
+#include <charconv>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <list>
+#include <locale>
+#include <memory>
+#include <mutex>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+
+namespace SceJson2 {
+
+enum ValueType : std::int32_t {
+    TypeNull = 0,
+    TypeBoolean = 1,
+    TypeInteger = 2,
+    TypeUInteger = 3,
+    TypeReal = 4,
+    TypeString = 5,
+    TypeArray = 6,
+    TypeObject = 7,
+};
+
+}
+
+namespace SceJson2 {
+
+struct Node;
+
+}
+
+namespace SceJson2 {
+
+struct Value { Node* node; };
+
+}
+
+namespace SceJson2 {
+
+struct String { std::string* text; };
+
+}
+
+namespace SceJson2 {
+
+struct Array { std::list<Value>* items; };
+
+}
+
+namespace SceJson2 {
+
+struct Pair;
+
+}
+
+namespace SceJson2 {
+
+struct Object { std::list<Pair>* items; };
+
+}
+
+namespace SceJson2 {
+
+struct ArrayIteratorState {
+    std::list<Value>::iterator position;
+    std::list<Value>::iterator end;
+};
+
+}
+
+namespace SceJson2 {
+
+struct ArrayIterator { ArrayIteratorState* state; };
+
+}
+
+namespace SceJson2 {
+
+struct ObjectIteratorState {
+    std::list<Pair>* owner = nullptr;
+    std::list<Pair>::iterator position{};
+};
+
+}
+
+namespace SceJson2 {
+
+struct ObjectIterator { ObjectIteratorState* state; };
+
+}
+
+namespace SceJson2 {
+
+struct Pair {
+    String key;
+    std::uint64_t reserved;
+    Value value;
+};
+
+}
+
+namespace SceJson2 {
+
+using TypeMismatchHandler = const Value& (APS5_VABI*)(ValueType, const Value*, const Value*, void*);
+
+}
+
+namespace SceJson2 {
+
+using SpecialFloatHandler = Value* (APS5_VABI*)(Value*, std::int32_t, double, const Value*, void*, bool*);
+
+}
+
+namespace SceJson2 {
+
+using ElementAccessFailureHandler = void (APS5_VABI*)(int, const String*, const std::size_t*, const Value*, const Value*, void*);
+
+}
+
+namespace SceJson2 {
+
+struct Handlers {
+    TypeMismatchHandler typeMismatch = nullptr;
+    void* typeMismatchContext = nullptr;
+    SpecialFloatHandler specialFloat = nullptr;
+    void* specialFloatContext = nullptr;
+    ElementAccessFailureHandler elementAccessFailure = nullptr;
+    void* elementAccessFailureContext = nullptr;
+};
+
+}
+
+namespace SceJson2 {
+
+struct Node {
+    ValueType type = TypeNull;
+    bool boolean = false;
+    std::int64_t integer = 0;
+    std::uint64_t uinteger = 0;
+    double real = 0;
+    String string{};
+    Array array{};
+    Object object{};
+    Handlers handlers{};
+};
+
+}
+
+namespace SceJson2 {
+
+using NullAccessCallback = const Value& (APS5_VABI*)(ValueType, const Value*, void*);
+
+}
+
+namespace SceJson2 {
+
+using ParserReadCallback = int (APS5_VABI*)(char&, void*);
+
+}
+
+namespace SceJson2 {
+
+struct InitParameterRtti {
+    void* allocParam;
+    void* userData;
+    std::size_t fileBufferSize;
+};
+
+}
+
+namespace SceJson2 {
+
+struct InitParameter2 {
+    void* allocator;
+    void* userData;
+    std::size_t fileBufferSize;
+    std::int32_t specialFloatFormatType;
+    std::uint32_t reserved[3];
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI _ZN3sce4Json11InitializerC1Ev(void* self);
+int APS5_VABI _ZN3sce4Json11InitializerD1Ev(void* self);
+int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_13InitParameterE(void* self, const void* parameter);
+int APS5_VABI _ZN3sce4Json11Initializer9terminateEv(void* self);
+int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallBackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void* self, SceJson2::NullAccessCallback callback, void* context);
+int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallbackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void* self, SceJson2::NullAccessCallback callback, void* context);
+void APS5_VABI _ZN3sce4Json12MemAllocatorC2Ev(void* self);
+void APS5_VABI _ZN3sce4Json12MemAllocatorD2Ev(void* self);
+void APS5_VABI _ZN3sce4Json6StringC1Ev(SceJson2::String* self);
+void APS5_VABI _ZN3sce4Json6StringC1EPKc(SceJson2::String* self, const char* text);
+void APS5_VABI _ZN3sce4Json6StringC1ERKS1_(SceJson2::String* self, const SceJson2::String* other);
+void APS5_VABI _ZN3sce4Json6StringD1Ev(SceJson2::String* self);
+SceJson2::String* APS5_VABI _ZN3sce4Json6StringaSERKS1_(SceJson2::String* self, const SceJson2::String* other);
+const char* APS5_VABI _ZNK3sce4Json6String5c_strEv(const SceJson2::String* self);
+bool APS5_VABI _ZNK3sce4Json6String5emptyEv(const SceJson2::String* self);
+std::size_t APS5_VABI _ZNK3sce4Json6String6lengthEv(const SceJson2::String* self);
+std::size_t APS5_VABI _ZNK3sce4Json6String4sizeEv(const SceJson2::String* self);
+std::size_t APS5_VABI _ZNK3sce4Json6String8capacityEv(const SceJson2::String* self);
+bool APS5_VABI _ZNK3sce4Json6StringeqEPKc(const SceJson2::String* self, const char* text);
+bool APS5_VABI _ZNK3sce4Json6StringeqERKS1_(const SceJson2::String* self, const SceJson2::String* other);
+void APS5_VABI _ZN3sce4Json6String5clearEv(SceJson2::String* self);
+void APS5_VABI _ZN3sce4Json6String6resizeEm(SceJson2::String* self, std::size_t count);
+void APS5_VABI _ZN3sce4Json6String7reserveEm(SceJson2::String* self, std::size_t capacity);
+SceJson2::String* APS5_VABI _ZN3sce4Json6String6appendERKS1_(SceJson2::String* self, const SceJson2::String* other);
+SceJson2::String* APS5_VABI _ZN3sce4Json6String6appendEPKc(SceJson2::String* self, const char* text);
+SceJson2::String* APS5_VABI _ZN3sce4Json6String6appendEPKcm(SceJson2::String* self, const char* text, std::size_t length);
+SceJson2::String* APS5_VABI _ZN3sce4Json6StringpLEPKc(SceJson2::String* self, const char* text);
+SceJson2::String* APS5_VABI _ZN3sce4Json6StringpLEh(SceJson2::String* self, unsigned char ch);
+SceJson2::String* APS5_VABI _ZNK3sce4Json6String6substrEmm(SceJson2::String* result, const SceJson2::String* self, std::size_t position, std::size_t length);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const SceJson2::String* self, char character, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const SceJson2::String* self, char character, std::size_t position);
+char APS5_VABI _ZNK3sce4Json6String2atEm(const SceJson2::String* self, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcm(const SceJson2::String* self, const char* text, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcmm(const SceJson2::String* self, const char* text, std::size_t position, std::size_t length);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findERKS1_m(const SceJson2::String* self, const SceJson2::String* other, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcm(const SceJson2::String* self, const char* text, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcmm(const SceJson2::String* self, const char* text, std::size_t position, std::size_t length);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindERKS1_m(const SceJson2::String* self, const SceJson2::String* other, std::size_t position);
+int APS5_VABI _ZNK3sce4Json6String7compareEPKc(const SceJson2::String* self, const char* text);
+int APS5_VABI _ZNK3sce4Json6String7compareERKS1_(const SceJson2::String* self, const SceJson2::String* other);
+void APS5_VABI _ZN3sce4Json5ArrayC1Ev(SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(SceJson2::Array* self, const SceJson2::Array* other);
+void APS5_VABI _ZN3sce4Json5ArrayD1Ev(SceJson2::Array* self);
+SceJson2::Array* APS5_VABI _ZN3sce4Json5ArrayaSERKS1_(SceJson2::Array* self, const SceJson2::Array* other);
+void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(SceJson2::Array* self, const SceJson2::Value* value);
+SceJson2::ArrayIterator* APS5_VABI _ZNK3sce4Json5Array5beginEv(SceJson2::ArrayIterator* result, const SceJson2::Array* self);
+SceJson2::ArrayIterator* APS5_VABI _ZNK3sce4Json5Array3endEv(SceJson2::ArrayIterator* result, const SceJson2::Array* self);
+bool APS5_VABI _ZNK3sce4Json5Array5emptyEv(const SceJson2::Array* self);
+std::size_t APS5_VABI _ZNK3sce4Json5Array4sizeEv(const SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5Array5clearEv(SceJson2::Array* self);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array5frontEv(const SceJson2::Array* self);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array4backEv(const SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5Array9pop_frontEv(SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5Array8iteratorD1Ev(SceJson2::ArrayIterator* self);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEv(SceJson2::ArrayIterator* self);
+SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array8iteratordeEv(const SceJson2::ArrayIterator* self);
+SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array8iteratorptEv(const SceJson2::ArrayIterator* self);
+bool APS5_VABI _ZNK3sce4Json5Array8iteratorneERKS2_(const SceJson2::ArrayIterator* self, const SceJson2::ArrayIterator* other);
+void APS5_VABI _ZN3sce4Json5Array8iteratorC1ERKS2_(SceJson2::ArrayIterator* self, const SceJson2::ArrayIterator* other);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iterator7advanceEm(SceJson2::ArrayIterator* self, std::size_t count);
+void APS5_VABI _ZN3sce4Json6ObjectC1Ev(SceJson2::Object* self);
+void APS5_VABI _ZN3sce4Json6ObjectC1ERKS1_(SceJson2::Object* self, const SceJson2::Object* other);
+void APS5_VABI _ZN3sce4Json6ObjectD1Ev(SceJson2::Object* self);
+SceJson2::Object* APS5_VABI _ZN3sce4Json6ObjectaSERKS1_(SceJson2::Object* self, const SceJson2::Object* other);
+void APS5_VABI _ZN3sce4Json6Object5clearEv(SceJson2::Object* self);
+SceJson2::Value* APS5_VABI _ZN3sce4Json6ObjectixERKNS0_6StringE(SceJson2::Object* self, const SceJson2::String* key);
+SceJson2::ObjectIterator* APS5_VABI _ZNK3sce4Json6Object5beginEv(SceJson2::ObjectIterator* result, const SceJson2::Object* self);
+SceJson2::ObjectIterator* APS5_VABI _ZNK3sce4Json6Object3endEv(SceJson2::ObjectIterator* result, const SceJson2::Object* self);
+void APS5_VABI _ZN3sce4Json6Object8iteratorD1Ev(SceJson2::ObjectIterator* self);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEv(SceJson2::ObjectIterator* self);
+SceJson2::Pair* APS5_VABI _ZNK3sce4Json6Object8iteratordeEv(const SceJson2::ObjectIterator* self);
+SceJson2::Pair* APS5_VABI _ZNK3sce4Json6Object8iteratorptEv(const SceJson2::ObjectIterator* self);
+SceJson2::ObjectIterator* APS5_VABI _ZNK3sce4Json6Object4findERKNS0_6StringE(SceJson2::ObjectIterator* result, const SceJson2::Object* self, const SceJson2::String* key);
+bool APS5_VABI _ZNK3sce4Json6Object8iteratoreqERKS2_(const SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+bool APS5_VABI _ZNK3sce4Json6Object8iteratorneERKS2_(const SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+void APS5_VABI _ZN3sce4Json6Object8iteratorC1ERKS2_(SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iterator7advanceEm(SceJson2::ObjectIterator* self, std::size_t count);
+bool APS5_VABI _ZNK3sce4Json6Object5emptyEv(const SceJson2::Object* self);
+std::size_t APS5_VABI _ZNK3sce4Json6Object4sizeEv(const SceJson2::Object* self);
+void APS5_VABI _ZN3sce4Json6Object5eraseERKNS0_6StringE(SceJson2::Object* self, const SceJson2::String* key);
+void APS5_VABI _ZN3sce4Json5ValueC1Ev(SceJson2::Value* self);
+void APS5_VABI _ZN3sce4Json5ValueC1Eb(SceJson2::Value* self, bool value);
+void APS5_VABI _ZN3sce4Json5ValueC1El(SceJson2::Value* self, std::int64_t value);
+void APS5_VABI _ZN3sce4Json5ValueC1Em(SceJson2::Value* self, std::uint64_t value);
+void APS5_VABI _ZN3sce4Json5ValueC1Ed(SceJson2::Value* self, double value);
+void APS5_VABI _ZN3sce4Json5ValueC1EPKc(SceJson2::Value* self, const char* text);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6StringE(SceJson2::Value* self, const SceJson2::String* text);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_5ArrayE(SceJson2::Value* self, const SceJson2::Array* array);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(SceJson2::Value* self, const SceJson2::Object* object);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKS1_(SceJson2::Value* self, const SceJson2::Value* other);
+void APS5_VABI _ZN3sce4Json5ValueD1Ev(SceJson2::Value* self);
+SceJson2::Value* APS5_VABI _ZN3sce4Json5ValueaSERKS1_(SceJson2::Value* self, const SceJson2::Value* other);
+void APS5_VABI _ZN3sce4Json5Value4swapERS1_(SceJson2::Value* self, SceJson2::Value* other);
+int APS5_VABI _ZN3sce4Json5Value3setENS0_9ValueTypeE(SceJson2::Value* self, SceJson2::ValueType type);
+int APS5_VABI _ZN3sce4Json5Value3setEb(SceJson2::Value* self, bool value);
+int APS5_VABI _ZN3sce4Json5Value3setEl(SceJson2::Value* self, std::int64_t value);
+int APS5_VABI _ZN3sce4Json5Value3setEm(SceJson2::Value* self, std::uint64_t value);
+int APS5_VABI _ZN3sce4Json5Value3setEd(SceJson2::Value* self, double value);
+int APS5_VABI _ZN3sce4Json5Value3setEPKc(SceJson2::Value* self, const char* text);
+int APS5_VABI _ZN3sce4Json5Value3setERKNS0_6StringE(SceJson2::Value* self, const SceJson2::String* text);
+int APS5_VABI _ZN3sce4Json5Value3setERKNS0_5ArrayE(SceJson2::Value* self, const SceJson2::Array* array);
+int APS5_VABI _ZN3sce4Json5Value3setERKNS0_6ObjectE(SceJson2::Value* self, const SceJson2::Object* object);
+int APS5_VABI _ZN3sce4Json5Value3setERKS1_(SceJson2::Value* self, const SceJson2::Value* other);
+SceJson2::ValueType APS5_VABI _ZNK3sce4Json5Value7getTypeEv(const SceJson2::Value* self);
+const bool* APS5_VABI _ZNK3sce4Json5Value10getBooleanEv(const SceJson2::Value* self);
+const std::int64_t* APS5_VABI _ZNK3sce4Json5Value10getIntegerEv(const SceJson2::Value* self);
+const std::uint64_t* APS5_VABI _ZNK3sce4Json5Value11getUIntegerEv(const SceJson2::Value* self);
+const double* APS5_VABI _ZNK3sce4Json5Value7getRealEv(const SceJson2::Value* self);
+const SceJson2::String* APS5_VABI _ZNK3sce4Json5Value9getStringEv(const SceJson2::Value* self);
+const SceJson2::Array* APS5_VABI _ZNK3sce4Json5Value8getArrayEv(const SceJson2::Value* self);
+const SceJson2::Object* APS5_VABI _ZNK3sce4Json5Value9getObjectEv(const SceJson2::Value* self);
+std::size_t APS5_VABI _ZNK3sce4Json5Value5countEv(const SceJson2::Value* self);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5ValueixEPKc(const SceJson2::Value* self, const char* key);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5ValueixEm(const SceJson2::Value* self, std::size_t index);
+void APS5_VABI _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(SceJson2::Value* self, SceJson2::ValueType type);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Value8getValueEm(const SceJson2::Value* self, std::size_t index);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Value8getValueERKNS0_6StringE(const SceJson2::Value* self, const SceJson2::String* key);
+SceJson2::Value* APS5_VABI _ZN3sce4Json5Value10referValueEm(SceJson2::Value* self, std::size_t index);
+SceJson2::Value* APS5_VABI _ZN3sce4Json5Value10referValueERKNS0_6StringE(SceJson2::Value* self, const SceJson2::String* key);
+SceJson2::Array* APS5_VABI _ZN3sce4Json5Value10referArrayEv(SceJson2::Value* self);
+SceJson2::Object* APS5_VABI _ZN3sce4Json5Value11referObjectEv(SceJson2::Value* self);
+int APS5_VABI _ZN3sce4Json5Value9serializeERNS0_6StringE(SceJson2::Value* self, SceJson2::String* out);
+int APS5_VABI _ZNK3sce4Json5Value8toStringERNS0_6StringE(const SceJson2::Value* self, SceJson2::String* out);
+int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(SceJson2::Value* out, SceJson2::ParserReadCallback read, void* context);
+int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(SceJson2::Value* out, const char* text, std::size_t size);
+void APS5_VABI _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(SceJson2::InitParameterRtti* self, void* allocParam, void* userData, std::size_t fileBufferSize);
+void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(SceJson2::InitParameter2* self);
+void APS5_VABI _ZN3sce4Json14InitParameter2C2Ev(SceJson2::InitParameter2* self);
+void APS5_VABI _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(SceJson2::InitParameter2* self, void* allocator, void* userData);
+void APS5_VABI _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(SceJson2::InitParameter2* self, void* allocParam, void* userData);
+void APS5_VABI _ZN3sce4Json14InitParameter217setFileBufferSizeEm(SceJson2::InitParameter2* self, std::size_t size);
+void APS5_VABI _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(SceJson2::InitParameter2* self, std::int32_t type);
+int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(void* self, const SceJson2::InitParameter2* parameter);
+void APS5_VABI _ZN3sce4Json5Value5clearEv(SceJson2::Value* self);
+void APS5_VABI _ZN3sce4Json12MemAllocator11notifyErrorEimPv(void* self, int error, std::size_t size, void* userData);
+void APS5_VABI _ZN3sce4Json5Value21setNullAccessCallBackEPFRKS1_NS0_9ValueTypeEPS2_PvES6_(SceJson2::NullAccessCallback callback, void* context);
+int APS5_VABI _ZN3sce4Json5Value30setElementAccessFailureHandlerEPFviPKNS0_6StringEPKmPKS1_S8_PvES9_(SceJson2::Value* self, SceJson2::ElementAccessFailureHandler handler, void* context);
+int APS5_VABI _ZN3sce4Json5Value22setSpecialFloatHandlerEPFKS1_NS0_12FunctionTypeEdPS2_PvPbES5_(SceJson2::Value* self, SceJson2::SpecialFloatHandler handler, void* context);
+int APS5_VABI _ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(SceJson2::Value* self, SceJson2::TypeMismatchHandler handler, void* context);
+bool APS5_VABI _ZNK3sce4Json5ValuecvbEv(const SceJson2::Value* self);
+void APS5_VABI _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(SceJson2::Pair* self, const SceJson2::String* key, const SceJson2::Value* value);
+void APS5_VABI _ZN3sce4Json6Object4PairD1Ev(SceJson2::Pair* self);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object6insertERKNS1_4PairE(SceJson2::ObjectIterator* result, SceJson2::Object* self, const SceJson2::Pair* pair);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEi(SceJson2::ArrayIterator* result, SceJson2::ArrayIterator* self, int);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratoraSERKS2_(SceJson2::ArrayIterator* self, const SceJson2::ArrayIterator* other);
+void APS5_VABI _ZN3sce4Json5Array8iteratorC1Ev(SceJson2::ArrayIterator* self);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEi(SceJson2::ObjectIterator* result, SceJson2::ObjectIterator* self, int);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratoraSERKS2_(SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+void APS5_VABI _ZN3sce4Json6Object8iteratorC1Ev(SceJson2::ObjectIterator* self);
+void APS5_VABI _ZN3sce4Json6Object4PairC1Ev(SceJson2::Pair* self);
+
+}
diff --git a/core/libs/prx/libSceJson2/libSceJson2.hpp b/core/libs/prx/libSceJson2/libSceJson2.hpp
new file mode 100644
index 0000000000..1ff338c252
--- /dev/null
+++ b/core/libs/prx/libSceJson2/libSceJson2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJson2/include/Api.hpp"
diff --git a/core/libs/prx/libSceJxr/CMakeLists.txt b/core/libs/prx/libSceJxr/CMakeLists.txt
index 251402ba35..02202c7522 100644
--- a/core/libs/prx/libSceJxr/CMakeLists.txt
+++ b/core/libs/prx/libSceJxr/CMakeLists.txt
@@ -13,3 +13,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJxr>")
     endif()
 endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_jxr_stream_tests ${LIBS_INCLUDE_DIR}/tests/JxrStream.cpp)
+    target_include_directories(guest_jxr_stream_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_jxr_stream_tests PRIVATE libSceJxr libc libkernel)
+    configure_windows_unwind(guest_jxr_stream_tests)
+    add_test(NAME guest_jxr_stream COMMAND guest_jxr_stream_tests)
+    set_tests_properties(guest_jxr_stream PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_jxr_stream PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJxr>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceJxr/Export.cpp b/core/libs/prx/libSceJxr/Export.cpp
index de2c55aa4e..52c894fef6 100644
--- a/core/libs/prx/libSceJxr/Export.cpp
+++ b/core/libs/prx/libSceJxr/Export.cpp
@@ -1,5 +1,10 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceJxr/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
+#include <cstring>
+#include "Stream.hpp"
+#include "prx/libc/include/GuestArena.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
@@ -9,12 +14,11 @@ constexpr std::int64_t WmpErrSuccess = 0;
 
 extern "C" {
 
-void APS5_VABI free_nid_postfix(void* memory);
-
 APS5_DUMMY_FUN
 std::int64_t APS5_VABI PKFree_nid_postfix(void** memory) {
     if (memory != nullptr) {
         free_nid_postfix(*memory);
+
         *memory = nullptr;
     }
     return WmpErrSuccess;
@@ -25,14 +29,38 @@ int APS5_VABI PixelFormatLookup_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI readIS_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI readIS_nid_postfix(void*, Jxr::BitIo* io) {
+    if (!io) NotImplemented_nid_no_patch(__func__);
+    constexpr std::uintptr_t packetSize = 4096;
+    const auto start = reinterpret_cast<std::uintptr_t>(io->start);
+    if (((start ^ reinterpret_cast<std::uintptr_t>(io->current)) & packetSize) == 0) return WmpErrSuccess;
+    auto* stream = io->stream;
+    if (!stream || !stream->setPosition) NotImplemented_nid_no_patch(__func__);
+    stream->setPosition(stream, io->referenceOffset);
+    if (!io->start || !stream->read) NotImplemented_nid_no_patch(__func__);
+    {
+        GuestArena::HostWrite access(io->start, packetSize);
+        if (!access.Open()) NotImplemented_nid_no_patch(__func__);
+        stream->read(stream, io->start, packetSize);
+    }
+    io->referenceOffset += packetSize;
+    std::memcpy(&io->shadow, io->start, sizeof(io->shadow));
+    const auto mask = static_cast<std::uintptr_t>(static_cast<std::intptr_t>(io->mask));
+    io->start = reinterpret_cast<std::uint8_t*>((reinterpret_cast<std::uintptr_t>(io->start) + packetSize) & mask);
+    return WmpErrSuccess;
 }
 
-int APS5_VABI writeIS_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI writeIS_nid_postfix(void*, Jxr::BitIo* io) {
+    if (!io) NotImplemented_nid_no_patch(__func__);
+    constexpr std::uintptr_t packetSize = 4096;
+    const auto start = reinterpret_cast<std::uintptr_t>(io->start);
+    if (((start ^ reinterpret_cast<std::uintptr_t>(io->current)) & packetSize) == 0) return WmpErrSuccess;
+    if (!io->start || !io->stream || !io->stream->write) NotImplemented_nid_no_patch(__func__);
+    const auto result = io->stream->write(io->stream, io->start, packetSize);
+    if (result < 0) return result;
+    const auto mask = static_cast<std::uintptr_t>(static_cast<std::intptr_t>(io->mask));
+    io->start = reinterpret_cast<std::uint8_t*>((reinterpret_cast<std::uintptr_t>(io->start) + packetSize) & mask);
+    return result;
 }
 
 }
diff --git a/core/libs/prx/libSceJxr/Stream.hpp b/core/libs/prx/libSceJxr/Stream.hpp
new file mode 100644
index 0000000000..20af71092e
--- /dev/null
+++ b/core/libs/prx/libSceJxr/Stream.hpp
@@ -0,0 +1,38 @@
+#ifndef CORE_LIBS_PRX_LIBSCEJXR_STREAM_HPP
+#define CORE_LIBS_PRX_LIBSCEJXR_STREAM_HPP
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+namespace Jxr {
+
+struct Stream {
+    std::array<std::uintptr_t, 4> state;
+    std::int32_t memory;
+    std::int64_t (APS5_VABI* close)(Stream**);
+    std::int32_t (APS5_VABI* end)(Stream*);
+    std::int64_t (APS5_VABI* read)(Stream*, void*, std::size_t);
+    std::int64_t (APS5_VABI* write)(Stream*, const void*, std::size_t);
+    std::int64_t (APS5_VABI* setPosition)(Stream*, std::size_t);
+    std::int64_t (APS5_VABI* getPosition)(Stream*, std::size_t*);
+};
+
+struct BitIo {
+    std::uint32_t shadow;
+    std::uint32_t accumulator;
+    std::uint32_t bitsUsed;
+    std::int32_t mask;
+    std::uint8_t* start;
+    std::uint8_t* current;
+    Stream* stream;
+    std::size_t referenceOffset;
+};
+
+static_assert(sizeof(Stream) == 88 && offsetof(Stream, read) == 56 && offsetof(Stream, setPosition) == 72);
+static_assert(sizeof(BitIo) == 48 && offsetof(BitIo, start) == 16 && offsetof(BitIo, referenceOffset) == 40);
+
+} // namespace Jxr
+
+#endif
diff --git a/core/libs/prx/libSceJxr/include/Api.hpp b/core/libs/prx/libSceJxr/include/Api.hpp
new file mode 100644
index 0000000000..93c5a463df
--- /dev/null
+++ b/core/libs/prx/libSceJxr/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "prx/libSceJxr/Stream.hpp"
+
+extern "C" {
+
+std::int64_t APS5_VABI PKFree_nid_postfix(void** memory);
+int APS5_VABI PixelFormatLookup_nid_postfix(void);
+std::int64_t APS5_VABI readIS_nid_postfix(void* codec, Jxr::BitIo* io);
+std::int64_t APS5_VABI writeIS_nid_postfix(void* codec, Jxr::BitIo* io);
+
+}
diff --git a/core/libs/prx/libSceJxr/libSceJxr.hpp b/core/libs/prx/libSceJxr/libSceJxr.hpp
new file mode 100644
index 0000000000..e92de5c284
--- /dev/null
+++ b/core/libs/prx/libSceJxr/libSceJxr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJxr/include/Api.hpp"
diff --git a/core/libs/prx/libSceJxrParser/libSceJxrParser.hpp b/core/libs/prx/libSceJxrParser/libSceJxrParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJxrParser/libSceJxrParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceKbEmulate/libSceKbEmulate.hpp b/core/libs/prx/libSceKbEmulate/libSceKbEmulate.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceKbEmulate/libSceKbEmulate.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceKeyboard/Export.cpp b/core/libs/prx/libSceKeyboard/Export.cpp
index 9cbc7cd436..fce1492046 100644
--- a/core/libs/prx/libSceKeyboard/Export.cpp
+++ b/core/libs/prx/libSceKeyboard/Export.cpp
@@ -1,9 +1,7 @@
+#include "prx/libSceKeyboard/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceKeyboard/include/KeyboardState.hpp"
 
-struct KeyboardDeviceInfo;
-struct KeyboardProcessFocus;
-
 extern "C" {
 
 int APS5_VABI sceKeyboardInit(void) {
diff --git a/core/libs/prx/libSceKeyboard/include/Api.hpp b/core/libs/prx/libSceKeyboard/include/Api.hpp
new file mode 100644
index 0000000000..a44cb9ca83
--- /dev/null
+++ b/core/libs/prx/libSceKeyboard/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct KeyboardDeviceInfo;
+
+struct KeyboardProcessFocus;
+
+extern "C" {
+
+int APS5_VABI sceKeyboardInit(void);
+int APS5_VABI sceKeyboardOpen(int userId, int32_t type, int32_t index, const void* param);
+int APS5_VABI sceKeyboardClose(int32_t handle);
+int APS5_VABI sceKeyboardRead(int32_t handle, KeyboardData* data, int32_t num);
+int APS5_VABI sceKeyboardReadState(int32_t handle, KeyboardData* data);
+int APS5_VABI sceKeyboardGetConnection(std::int32_t handle, bool* connected);
+int APS5_VABI sceKeyboardGetKey2Char(std::int32_t handle, std::int32_t arrange, std::uint8_t led, std::uint8_t modifierKey, std::uint16_t keyCode, KeyboardCharData* charData);
+int APS5_VABI sceKeyboardConnectPort(std::int32_t first, std::int32_t second);
+int APS5_VABI sceKeyboardDebugGetDeviceId(std::int32_t handle, std::int32_t* deviceId);
+int APS5_VABI sceKeyboardDeviceOpen(std::uint64_t deviceId, std::int32_t index, std::uint32_t options);
+int APS5_VABI sceKeyboardDisconnectAll(void);
+int APS5_VABI sceKeyboardDisconnectDevice(std::int32_t deviceId);
+int APS5_VABI sceKeyboardDisconnectPort(std::int32_t first, std::int32_t second);
+int APS5_VABI sceKeyboardGetDeviceInfo(std::int32_t deviceId, KeyboardDeviceInfo* info);
+int APS5_VABI sceKeyboardGetHandle(std::int32_t userId, std::int32_t type, std::int32_t index);
+int APS5_VABI sceKeyboardMbusInit(void);
+int APS5_VABI sceKeyboardPadEmulateClose(void);
+int APS5_VABI sceKeyboardPadEmulateOpen(void);
+int APS5_VABI sceKeyboardSetProcessFocus(const KeyboardProcessFocus* focus);
+int APS5_VABI sceKeyboardSetProcessPrivilege(std::uint8_t privilege);
+int APS5_VABI sceDbgKeyboardClose();
+int APS5_VABI sceDbgKeyboardGetKey2Char();
+int APS5_VABI sceDbgKeyboardInit();
+int APS5_VABI sceDbgKeyboardOpen();
+int APS5_VABI sceDbgKeyboardRead();
+int APS5_VABI sceDbgKeyboardReadState();
+
+}
diff --git a/core/libs/prx/libSceKeyboard/libSceKeyboard.hpp b/core/libs/prx/libSceKeyboard/libSceKeyboard.hpp
new file mode 100644
index 0000000000..8ab2bf1b0d
--- /dev/null
+++ b/core/libs/prx/libSceKeyboard/libSceKeyboard.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceKeyboard/include/Api.hpp"
diff --git a/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp b/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
index 954040b147..ba9d9bfff8 100644
--- a/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
+++ b/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
@@ -175,17 +175,15 @@ int GetKey2Char(std::int32_t handle, std::int32_t arrange, std::uint32_t ledStat
     {
         std::lock_guard lock(keyboardMutex);
         if (!initialized) return KEYBOARD_ERROR_NOT_INITIALIZED;
+        if (keyCode < 4 || keyCode > 231) return KEYBOARD_ERROR_INVALID_ARG;
         if (handle != KEYBOARD_HANDLE || !opened) return KEYBOARD_ERROR_INVALID_HANDLE;
     }
     if (charData == nullptr) return KEYBOARD_ERROR_INVALID_ARG;
     if (arrange != KEYBOARD_ARRANGEMENT_101 && arrange != KEYBOARD_ARRANGEMENT_106) return KEYBOARD_ERROR_INVALID_ARG;
-    if (arrange == KEYBOARD_ARRANGEMENT_106 && (ledState & KEYBOARD_LED_KANA) != 0) {
-        NotImplemented_nid_no_patch(__func__);
-        return KEYBOARD_ERROR_INVALID_ARG;
-    }
     *charData = {};
-    charData->char_code = character(arrange == KEYBOARD_ARRANGEMENT_106, ledState, modifierKey, keyCode);
-    charData->processed = charData->char_code != 0;
+    const std::uint16_t converted = character(arrange == KEYBOARD_ARRANGEMENT_106, ledState, modifierKey, keyCode);
+    charData->char_code = converted != 0 ? converted : keyCode;
+    charData->processed = converted != 0;
     charData->length = charData->processed ? 1 : 0;
     return KEYBOARD_OK;
 }
diff --git a/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp b/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
index 0307b994df..e9856f2c1a 100644
--- a/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
+++ b/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
@@ -1,26 +1,23 @@
+#include "prx/libSceKeyboard/include/Api.hpp"
 #include "prx/libSceKeyboard/include/keyboard_structs.h"
 #include "prx/libSceKeyboard/include/KeyboardState.hpp"
 #include "prx/libSceVideoOut/include/KeyboardInput.hpp"
 #include "SDL_events.h"
 #include "SDL_keyboard.h"
 
+#include <cstdio>
 #include <cstdlib>
+#include <cstring>
+#include <initializer_list>
+#include <source_location>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceKeyboardInit(void);
-int APS5_VABI sceKeyboardOpen(int, std::int32_t, std::int32_t, const void*);
-int APS5_VABI sceKeyboardClose(std::int32_t);
-int APS5_VABI sceKeyboardRead(std::int32_t, KeyboardData*, std::int32_t);
-int APS5_VABI sceKeyboardReadState(std::int32_t, KeyboardData*);
-int APS5_VABI sceKeyboardGetConnection(std::int32_t, bool*);
-int APS5_VABI sceKeyboardGetKey2Char(std::int32_t, std::int32_t, std::uint8_t, std::uint8_t, std::uint16_t, KeyboardCharData*);
-int APS5_VABI sceKeyboardConnectPort(void);
-int APS5_VABI sceKeyboardDisconnectAll(void);
+static void Require(bool value, std::source_location location = std::source_location::current()) {
+    if (value) return;
+    std::fprintf(stderr, "%s:%u: keyboard assertion failed\n", location.file_name(), location.line());
+    std::abort();
 }
 
-static void Require(bool value) { if (!value) std::abort(); }
-
 static SDL_Event KeyEvent(Uint32 type, SDL_Scancode scancode, Uint16 mod = 0, Uint8 repeat = 0) {
     SDL_Event event{};
     event.type = type;
@@ -34,14 +31,63 @@ static SDL_Event KeyEvent(Uint32 type, SDL_Scancode scancode, Uint16 mod = 0, Ui
 static std::uint16_t Char(std::uint32_t led, std::uint32_t modifierKey, std::uint16_t keyCode, std::int32_t arrange = KEYBOARD_ARRANGEMENT_101) {
     KeyboardCharData data{};
     Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, led, modifierKey, keyCode, &data) == KEYBOARD_OK);
-    Require(data.processed == (data.char_code != 0) && data.length == (data.processed ? 1 : 0));
-    return data.char_code;
+    Require(data.processed ? data.char_code != 0 : data.char_code == keyCode);
+    Require(data.length == (data.processed ? 1 : 0));
+    return data.processed ? data.char_code : 0;
 }
 
 static std::uint16_t Jis(std::uint32_t modifierKey, std::uint16_t keyCode, std::uint32_t led = 0) {
     return Char(led, modifierKey, keyCode, KEYBOARD_ARRANGEMENT_106);
 }
 
+static void CheckInvalidKeys(bool opened) {
+    constexpr std::uint16_t invalidKeys[] = {0, 1, 2, 3, 232, 255, 256, 65535};
+    for (const auto key : invalidKeys) {
+        for (const auto handle : {KEYBOARD_HANDLE, 42}) {
+            KeyboardCharData data;
+            std::memset(&data, 0xa5, sizeof(data));
+            unsigned char before[sizeof(data)];
+            std::memcpy(before, &data, sizeof(data));
+            Require(sceKeyboardGetKey2Char(handle, KEYBOARD_ARRANGEMENT_101, 0, 0, key, &data) == KEYBOARD_ERROR_INVALID_ARG);
+            Require(std::memcmp(&data, before, sizeof(data)) == 0);
+            Require(sceKeyboardGetKey2Char(handle, KEYBOARD_ARRANGEMENT_106, KEYBOARD_LED_KANA, 0, key, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
+        }
+    }
+    for (const auto key : {std::uint16_t{4}, std::uint16_t{231}}) {
+        KeyboardCharData data{};
+        const auto expected = opened ? KEYBOARD_OK : KEYBOARD_ERROR_INVALID_HANDLE;
+        Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, KEYBOARD_ARRANGEMENT_101, 0, 0, key, &data) == expected);
+    }
+}
+
+static void CheckUnconvertedKeys() {
+    constexpr std::uint16_t unconvertedKeys[] = {0x29, 0x39, 0x3a, 0x4f, 0x59, 0x88, 0xe0, 0xe7};
+    for (const auto arrange : {KEYBOARD_ARRANGEMENT_101, KEYBOARD_ARRANGEMENT_106}) {
+        for (const auto key : unconvertedKeys) {
+            KeyboardCharData data{};
+            Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, 0, 0, key, &data) == KEYBOARD_OK);
+            Require(!data.processed && data.char_code == key);
+        }
+    }
+}
+
+static void CheckKanaLed() {
+    for (const auto arrange : {KEYBOARD_ARRANGEMENT_101, KEYBOARD_ARRANGEMENT_106}) {
+        for (const auto modifier : {std::uint8_t{0}, std::uint8_t{KEYBOARD_MOD_LEFT_SHIFT}, std::uint8_t{KEYBOARD_MOD_RIGHT_SHIFT}}) {
+            for (const auto led : {std::uint8_t{0}, std::uint8_t{KEYBOARD_LED_NUM_LOCK | KEYBOARD_LED_CAPS_LOCK}}) {
+                for (std::uint16_t key = 4; key <= 231; ++key) {
+                    KeyboardCharData withoutKana{};
+                    KeyboardCharData withKana{};
+                    Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, led, modifier, key, &withoutKana) == KEYBOARD_OK);
+                    Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, led | KEYBOARD_LED_KANA, modifier, key, &withKana) == KEYBOARD_OK);
+                    Require(withKana.processed == withoutKana.processed);
+                    Require(withKana.length == withoutKana.length && withKana.char_code == withoutKana.char_code);
+                }
+            }
+        }
+    }
+}
+
 int main() {
     KeyboardData data[16]{};
     KeyboardCharData charData{};
@@ -50,11 +96,15 @@ int main() {
     Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_ERROR_NOT_INITIALIZED);
     Require(sceKeyboardInit() == KEYBOARD_OK);
     Require(sceKeyboardInit() == KEYBOARD_OK);
+    CheckInvalidKeys(false);
     Require(sceKeyboardOpen(1, 0, 1, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
     Require(sceKeyboardOpen(1, 1, 0, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
     Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, KEYBOARD_ARRANGEMENT_101, 0, 0, 0x04, &charData) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_HANDLE);
+    CheckInvalidKeys(true);
+    CheckUnconvertedKeys();
+    CheckKanaLed();
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_ERROR_ALREADY_OPENED);
     Require(sceKeyboardGetConnection(42, &connected) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
@@ -181,7 +231,8 @@ int main() {
 
     bool threwConnect = false;
     try {
-        sceKeyboardConnectPort();
+        sceKeyboardConnectPort(0, 0);
+
     } catch (const std::runtime_error&) {
         threwConnect = true;
     }
diff --git a/core/libs/prx/libSceLibcInternal/CMakeLists.txt b/core/libs/prx/libSceLibcInternal/CMakeLists.txt
index 1297f6abcf..f17760d179 100644
--- a/core/libs/prx/libSceLibcInternal/CMakeLists.txt
+++ b/core/libs/prx/libSceLibcInternal/CMakeLists.txt
@@ -3,10 +3,24 @@ target_include_directories(libSceLibcInternal PRIVATE ${LIBS_INCLUDE_DIR})
 set_source_files_properties(UserContext.cpp PROPERTIES COMPILE_OPTIONS -fno-omit-frame-pointer)
 target_link_libraries(libSceLibcInternal PRIVATE ${CMAKE_DL_LIBS})
 target_sources(libSceLibcInternal PRIVATE Directory.cpp)
+target_sources(libSceLibcInternal PRIVATE InitOnce.cpp)
+if(BUILD_TESTING)
+    add_test_executable(guest_init_once_tests ${LIBS_INCLUDE_DIR}/tests/GuestInitOnce.cpp)
+    target_include_directories(guest_init_once_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_init_once_tests PRIVATE libSceLibcInternal libkernel libc)
+    configure_windows_unwind(guest_init_once_tests)
+    add_test(NAME guest_init_once COMMAND guest_init_once_tests)
+    set_tests_properties(guest_init_once PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_init_once PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")
+    endif()
+endif()
 target_sources(libSceLibcInternal PRIVATE Err.cpp)
 configure_windows_unwind(libSceLibcInternal)
 target_sources(libSceLibcInternal PRIVATE FilesystemStatistics.cpp PathStatistics.cpp)
 target_sources(libSceLibcInternal PRIVATE Inet.cpp)
+target_sources(libSceLibcInternal PRIVATE Filesystem.cpp)
 
 if(BUILD_TESTING)
     add_test_executable(guest_statvfs_tests ${LIBS_INCLUDE_DIR}/tests/GuestStatvfs.cpp)
@@ -60,10 +74,11 @@ if(BUILD_TESTING)
     endif()
     add_test_executable(guest_posix_spawn_tests ${LIBS_INCLUDE_DIR}/tests/GuestPosixSpawn.cpp)
     target_include_directories(guest_posix_spawn_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_posix_spawn_tests PRIVATE libSceLibcInternal libc)
+    target_link_libraries(guest_posix_spawn_tests PRIVATE libSceLibcInternal libc libkernel)
     configure_windows_unwind(guest_posix_spawn_tests)
     add_test(NAME guest_posix_spawn COMMAND guest_posix_spawn_tests)
     set_tests_properties(guest_posix_spawn PROPERTIES TIMEOUT 20)
+    add_asan_test_options(guest_posix_spawn handle_sigbus=0)
     if(WIN32)
         set_tests_properties(guest_posix_spawn PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")
@@ -149,3 +164,15 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")
     endif()
 endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_libc_filesystem_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibcFilesystem.cpp)
+    target_include_directories(guest_libc_filesystem_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libc_filesystem_tests PRIVATE libSceLibcInternal libkernel libc)
+    configure_windows_unwind(guest_libc_filesystem_tests)
+    add_test(NAME guest_libc_filesystem COMMAND guest_libc_filesystem_tests)
+    if(WIN32)
+        set_tests_properties(guest_libc_filesystem PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceLibcInternal/Directory.cpp b/core/libs/prx/libSceLibcInternal/Directory.cpp
index 48a1614e85..3870c9cd6b 100644
--- a/core/libs/prx/libSceLibcInternal/Directory.cpp
+++ b/core/libs/prx/libSceLibcInternal/Directory.cpp
@@ -1,12 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include <cerrno>
 #include <cstdint>
 
-extern "C" int APS5_VABI close_nid_postfix(int d);
-extern "C" int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 extern "C" void* APS5_VABI fdopendir_nid_postfix(int fd) {
     constexpr int SetDescriptorFlags = 2;
     constexpr int CloseOnExec = 1;
@@ -17,5 +16,8 @@ extern "C" void* APS5_VABI fdopendir_nid_postfix(int fd) {
         *__error_nid_postfix() = error == EBADF ? 9 : 20;
         return nullptr;
     }
-    return OpenDescriptorDirectory_nid_no_patch(path, fd, close_nid_postfix, GetDirectoryDescriptorPosition_nid_no_patch(fd));
+    const bool virtualDirectory = IsDirectoryDescriptor_nid_no_patch(fd) != 0;
+    return OpenDescriptorDirectory_nid_no_patch(path, fd, close_nid_postfix, GetDirectoryDescriptorPosition_nid_no_patch(fd),
+        virtualDirectory ? ReadDirectoryDescriptorCallback_nid_no_patch : nullptr,
+        virtualDirectory ? SeekDirectoryDescriptorCallback_nid_no_patch : nullptr);
 }
diff --git a/core/libs/prx/libSceLibcInternal/Err.cpp b/core/libs/prx/libSceLibcInternal/Err.cpp
index f16dd24ca1..3e67760ef9 100644
--- a/core/libs/prx/libSceLibcInternal/Err.cpp
+++ b/core/libs/prx/libSceLibcInternal/Err.cpp
@@ -1,18 +1,14 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdarg>
 
-using ErrExit = void (APS5_VABI*)(int);
-
 extern "C" {
 extern const char* __progname_nid_postfix;
-int APS5_VABI vfprintf_nid_postfix(FileStream* stream, const char* format, VaList* args);
-int APS5_VABI fprintf_nid_postfix(FileStream* stream, const char* format, ...);
-int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
-char* APS5_VABI strerror_nid_postfix(int error);
-int* APS5_VABI __error_nid_postfix();
+
 }
 
 namespace {
@@ -32,8 +28,10 @@ const char* ProgramName() {
 void Report(const char* format, VaList* args, const int* code) {
     FileStream* const stream = ErrFile();
     fprintf_nid_postfix(stream, "%s: ", ProgramName());
+
     if (format != nullptr) {
         vfprintf_nid_postfix(stream, format, args);
+
         if (code != nullptr) fputs_nid_postfix(": ", stream);
     }
     if (code != nullptr) fprintf_nid_postfix(stream, "%s\n", strerror_nid_postfix(*code));
@@ -73,6 +71,7 @@ void APS5_VABI vwarnc_nid_postfix(int code, const char* format, VaList* args) {
 
 void APS5_VABI vwarn_nid_postfix(const char* format, VaList* args) {
     vwarnc_nid_postfix(*__error_nid_postfix(), format, args);
+
 }
 
 void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args) {
@@ -86,6 +85,7 @@ void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args) {
 
 [[noreturn]] void APS5_VABI verr_nid_postfix(int status, const char* format, VaList* args) {
     verrc_nid_postfix(status, *__error_nid_postfix(), format, args);
+
 }
 
 [[noreturn]] void APS5_VABI verrx_nid_postfix(int status, const char* format, VaList* args) {
@@ -97,6 +97,7 @@ void APS5_VABI warnc_nid_postfix(int code, const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     vwarnc_nid_postfix(code, format, reinterpret_cast<VaList*>(args));
+
     APS5_ERR_VA_END(args);
 }
 
@@ -105,6 +106,15 @@ void APS5_VABI warn_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     vwarnc_nid_postfix(code, format, reinterpret_cast<VaList*>(args));
+
+    APS5_ERR_VA_END(args);
+}
+
+void APS5_VABI _warn_nid_postfix(const char* format, ...) {
+    APS5_ERR_VA_LIST args;
+    APS5_ERR_VA_START(args, format);
+    vwarn_nid_postfix(format, reinterpret_cast<VaList*>(args));
+
     APS5_ERR_VA_END(args);
 }
 
@@ -112,6 +122,7 @@ void APS5_VABI warnx_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     vwarnx_nid_postfix(format, reinterpret_cast<VaList*>(args));
+
     APS5_ERR_VA_END(args);
 }
 
@@ -119,6 +130,7 @@ void APS5_VABI warnx_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     verrc_nid_postfix(status, code, format, reinterpret_cast<VaList*>(args));
+
 }
 
 [[noreturn]] void APS5_VABI err_nid_postfix(int status, const char* format, ...) {
@@ -126,12 +138,21 @@ void APS5_VABI warnx_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     verrc_nid_postfix(status, code, format, reinterpret_cast<VaList*>(args));
+
+}
+
+[[noreturn]] void APS5_VABI _err_nid_postfix(int status, const char* format, ...) {
+    APS5_ERR_VA_LIST args;
+    APS5_ERR_VA_START(args, format);
+    verr_nid_postfix(status, format, reinterpret_cast<VaList*>(args));
+
 }
 
 [[noreturn]] void APS5_VABI errx_nid_postfix(int status, const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     verrx_nid_postfix(status, format, reinterpret_cast<VaList*>(args));
+
 }
 
 }
diff --git a/core/libs/prx/libSceLibcInternal/Export.cpp b/core/libs/prx/libSceLibcInternal/Export.cpp
index 7ca113639e..d018c80566 100644
--- a/core/libs/prx/libSceLibcInternal/Export.cpp
+++ b/core/libs/prx/libSceLibcInternal/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/HeapDiagnostics.hpp"
@@ -13,14 +15,10 @@
 #include <dlfcn.h>
 #endif
 
-extern "C" void APS5_VABI sceKernelSetThreadDtors(thread_dtors_func_t dtors);
-extern "C" int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
 extern "C" const char* __progname_nid_postfix;
 
 namespace {
 
-using ThreadDestructorFunction = void (APS5_VABI*)(void*);
-
 struct ThreadDestructor {
     ThreadDestructorFunction function;
     void* object;
@@ -67,7 +65,7 @@ void APS5_VABI RunThreadDestructors_nid_no_patch() {
 bool FindDsoModule(const void* dsoSymbol, KernelModule& handle) {
     ModuleInfoEx info{};
     info.st_size = sizeof(ModuleInfoEx);
-    if (sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(dsoSymbol), 2, &info) != 0) {
+    if (sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(dsoSymbol), 1, &info) != 0) {
         handle = 0;
         return false;
     }
@@ -95,6 +93,7 @@ bool ForceThreadDestructorPass(KernelModule handle) {
 void RegisterThreadExitHook() {
     [[maybe_unused]] static const bool registered = [] {
         sceKernelSetThreadDtors(RunThreadDestructors_nid_no_patch);
+
         return true;
     }();
 }
@@ -109,6 +108,10 @@ const char* APS5_VABI getprogname_nid_postfix() {
     return __progname_nid_postfix;
 }
 
+const char* APS5_VABI _getprogname_nid_postfix() {
+    return getprogname_nid_postfix();
+}
+
 void APS5_VABI __cxa_finalize_nid_postfix(void* dsoHandle) {
     CxaFinalize_nid_no_patch(dsoHandle);
 }
diff --git a/core/libs/prx/libSceLibcInternal/FileTime.cpp b/core/libs/prx/libSceLibcInternal/FileTime.cpp
index a3bbfe8edc..5b98207e49 100644
--- a/core/libs/prx/libSceLibcInternal/FileTime.cpp
+++ b/core/libs/prx/libSceLibcInternal/FileTime.cpp
@@ -1,16 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 
-struct LibcUtimbuf {
-    std::int64_t actime;
-    std::int64_t modtime;
-};
 static_assert(sizeof(LibcUtimbuf) == 16);
 
-extern "C" int APS5_VABI utimes_nid_postfix(const char*, const KernelTimeval*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 extern "C" int APS5_VABI utime_nid_postfix(const char* path, const LibcUtimbuf* times) {
     int* const error = __error_nid_postfix();
     const int saved = *error;
diff --git a/core/libs/prx/libSceLibcInternal/Filesystem.cpp b/core/libs/prx/libSceLibcInternal/Filesystem.cpp
new file mode 100644
index 0000000000..36341ff483
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/Filesystem.cpp
@@ -0,0 +1,183 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/GuestDirectory.hpp"
+#include "prx/libc/include/General.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+namespace {
+
+constexpr std::size_t NameCapacity = 260;
+constexpr std::size_t CurrentCapacity = 256;
+constexpr int NoSuchFile = 2;
+constexpr int Exists = 17;
+constexpr int NotDirectory = 20;
+constexpr int Invalid = 22;
+constexpr int NameTooLong = 63;
+constexpr std::uint16_t DefaultDirectoryMode = 0777;
+constexpr std::uint16_t PermissionBits = 07777;
+
+enum FileType : int {
+    TypeNotFound = -1,
+    TypeNone = 0,
+    TypeRegular = 1,
+    TypeDirectory = 2,
+    TypeSymlink = 3,
+    TypeBlock = 4,
+    TypeCharacter = 5,
+    TypeFifo = 6,
+    TypeSocket = 7,
+    TypeUnknown = 8,
+};
+
+int& GuestErrno() {
+    return *__error_nid_postfix();
+}
+
+int TypeOfMode(std::uint16_t mode) {
+    switch (mode & 0170000) {
+        case 0010000: return TypeFifo;
+        case 0020000: return TypeCharacter;
+        case 0040000: return TypeDirectory;
+        case 0060000: return TypeBlock;
+        case 0100000: return TypeRegular;
+        case 0120000: return TypeSymlink;
+        case 0140000: return TypeSocket;
+        default: return TypeUnknown;
+    }
+}
+
+int StatType(const char* path, int* perms, int* error) {
+    GuestErrno() = 0;
+    FileStat status{};
+    int type;
+    if (stat_nid_postfix(path, &status) == 0) {
+        GuestErrno() = 0;
+        if (perms) *perms = status.st_mode & PermissionBits;
+        type = TypeOfMode(status.st_mode);
+    } else {
+        const int code = GuestErrno();
+        type = code == NoSuchFile || code == NotDirectory || code == Invalid || code == NameTooLong ? TypeNotFound : TypeNone;
+    }
+    if (error) *error = GuestErrno();
+    return type;
+}
+
+void CopyName(char* target, const char* source) {
+    std::size_t length = 0;
+    while (length < NameCapacity - 1 && source[length] != '\0') {
+        target[length] = source[length];
+        ++length;
+    }
+    target[length] = '\0';
+}
+
+bool IsDotEntry(const char* name) {
+    return name[0] == '.' && (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI _ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error) {
+    return StatType(path, perms, error);
+}
+
+int APS5_VABI _ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error) {
+    return StatType(path, perms, error);
+}
+
+std::uint64_t APS5_VABI _ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(const char* path, int* error) {
+    FileStat status{};
+    if (stat_nid_postfix(path, &status) != 0) {
+        if (error) *error = GuestErrno();
+        return UINT64_MAX;
+    }
+    return static_cast<std::uint64_t>(status.st_size);
+}
+
+int APS5_VABI _ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(const char* path, std::int64_t* seconds, std::int64_t* nanoseconds) {
+    FileStat status{};
+    if (stat_nid_postfix(path, &status) != 0) return GuestErrno();
+    *seconds = status.st_mtim.tv_sec;
+    *nanoseconds = status.st_mtim.tv_nsec;
+    return 0;
+}
+
+int APS5_VABI _ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(const char* path, const char* existing) {
+    GuestErrno() = 0;
+    std::uint16_t mode = DefaultDirectoryMode;
+    if (existing) {
+        FileStat status{};
+        if (stat_nid_postfix(existing, &status) != 0) return -GuestErrno();
+        mode = status.st_mode;
+    }
+    if (mkdir_nid_postfix(path, mode) == 0) return 1;
+    if (GuestErrno() == Exists) return 0;
+    return -GuestErrno();
+}
+
+bool APS5_VABI _ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(const char* path) {
+    return rmdir_nid_postfix(path) == 0;
+}
+
+int APS5_VABI _ZNSt10filesystem7_UnlinkEPKc_nid_postfix(const char* path) {
+    GuestErrno() = 0;
+    return unlink_nid_postfix(path) == 0 ? 0 : GuestErrno();
+}
+
+int APS5_VABI _ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(const char* path, int perms) {
+    return chmod_nid_postfix(path, static_cast<std::uint16_t>(perms));
+}
+
+bool APS5_VABI _ZNSt10filesystem12_Current_getERA260_c_nid_postfix(char* target) {
+    char current[CurrentCapacity];
+    const bool found = getcwd_nid_postfix(current, sizeof(current)) != nullptr;
+    if (found) CopyName(target, current);
+    else target[0] = '\0';
+    return found;
+}
+
+char* APS5_VABI _ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(char* target, void* handle, int* type) {
+    *type = TypeUnknown;
+    GuestDirectoryEntry entry{};
+    GuestDirectoryEntry* result = nullptr;
+    while (readdir_r_nid_postfix(handle, &entry, &result) == 0 && result) {
+        if (IsDotEntry(entry.name)) continue;
+        CopyName(target, entry.name);
+        return target;
+    }
+    target[0] = '\0';
+    return target;
+}
+
+void* APS5_VABI _ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(char* target, const char* path, int* error, int* type) {
+    GuestErrno() = 0;
+    void* handle = opendir_nid_postfix(path);
+    if (!handle) {
+        *error = GuestErrno();
+        return nullptr;
+    }
+    *error = 0;
+    _ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(target, handle, type);
+    if (target[0] != '\0') return handle;
+    closedir_nid_postfix(handle);
+    return nullptr;
+}
+
+int APS5_VABI _ZNSt10filesystem10_Close_dirEPv_nid_postfix(void* handle) {
+    return closedir_nid_postfix(handle);
+}
+
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcSt10error_code_nid_postfix() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcRKNS_4pathESt10error_code_nid_postfix() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+}
diff --git a/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp b/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp
index 8cb50f1eca..998c338235 100644
--- a/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp
+++ b/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp
@@ -1,10 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceLibcInternal/include/Statvfs.hpp"
 #include <cstring>
 
-extern "C" int APS5_VABI _fstatfs_nid_postfix(int, KernelStatfs*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 extern "C" int APS5_VABI fstatvfs_nid_postfix(int descriptor, LibcStatvfs* output) {
     int* const error = __error_nid_postfix();
     const int saved = *error;
diff --git a/core/libs/prx/libSceLibcInternal/Getopt.cpp b/core/libs/prx/libSceLibcInternal/Getopt.cpp
index 80645072b4..43248491d9 100644
--- a/core/libs/prx/libSceLibcInternal/Getopt.cpp
+++ b/core/libs/prx/libSceLibcInternal/Getopt.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -7,12 +9,6 @@
 #include <string>
 #include <string_view>
 
-struct GuestOption {
-    const char* name;
-    int hasArgument;
-    int* flag;
-    int value;
-};
 static_assert(sizeof(GuestOption) == 32);
 static_assert(offsetof(GuestOption, hasArgument) == 8);
 static_assert(offsetof(GuestOption, flag) == 16);
@@ -21,7 +17,6 @@ static_assert(offsetof(GuestOption, value) == 24);
 extern "C" {
 extern const char* __progname_nid_postfix;
 extern FileStream* __stderrp_nid_postfix;
-char* APS5_VABI getenv_nid_postfix(const char* name);
 
 int opterr_nid_postfix = 1;
 int optind_nid_postfix = 1;
diff --git a/core/libs/prx/libSceLibcInternal/Inet.cpp b/core/libs/prx/libSceLibcInternal/Inet.cpp
index 90996aacf6..1dd8ad853d 100644
--- a/core/libs/prx/libSceLibcInternal/Inet.cpp
+++ b/core/libs/prx/libSceLibcInternal/Inet.cpp
@@ -1,12 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-const char* APS5_VABI __inet_ntop_nid_postfix(int family, const void* source, char* destination, std::uint32_t capacity);
-}
-
 namespace {
 
 constexpr int AddressFamilyInet = 2;
@@ -94,12 +92,18 @@ std::uint32_t APS5_VABI inet_addr_nid_postfix(const char* text) {
 
 char* APS5_VABI inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size) {
     __inet_ntop_nid_postfix(AddressFamilyInet, &address, buffer, size);
+
     return buffer;
 }
 
+char* APS5_VABI __inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size) {
+    return inet_ntoa_r_nid_postfix(address, buffer, size);
+}
+
 char* APS5_VABI inet_ntoa_nid_postfix(std::uint32_t address) {
     std::memcpy(g_ntoaBuffer, "[inet_ntoa error]", sizeof(g_ntoaBuffer));
     __inet_ntop_nid_postfix(AddressFamilyInet, &address, g_ntoaBuffer, sizeof(g_ntoaBuffer));
+
     return g_ntoaBuffer;
 }
 
diff --git a/core/libs/prx/libSceLibcInternal/InitOnce.cpp b/core/libs/prx/libSceLibcInternal/InitOnce.cpp
new file mode 100644
index 0000000000..94d59b1ce7
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/InitOnce.cpp
@@ -0,0 +1,56 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <atomic>
+#include <climits>
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+constexpr std::uintptr_t OnceIdle = 0;
+constexpr std::uintptr_t OnceRunning = 1;
+constexpr std::uintptr_t OnceDone = 2;
+constexpr unsigned long InitFailed = 4;
+
+std::atomic<std::uintptr_t>& OnceState(void** once) {
+    return *reinterpret_cast<std::atomic<std::uintptr_t>*>(once);
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI __std_init_once_begin_initialize_clr_nid_postfix(void** once, unsigned long flags, int* pending, void** context) {
+    (void)flags;
+    (void)context;
+    auto& state = OnceState(once);
+    for (;;) {
+        std::uintptr_t current = state.load(std::memory_order_acquire);
+        if (current == OnceIdle) {
+            if (state.compare_exchange_weak(current, OnceRunning, std::memory_order_acq_rel)) {
+                *pending = 1;
+                return 1;
+            }
+            continue;
+        }
+        if (current == OnceDone) {
+            *pending = 0;
+            return 1;
+        }
+        sceKernelSyncOnAddressWait(reinterpret_cast<std::uint32_t*>(once), static_cast<std::uint32_t>(OnceRunning), nullptr, nullptr);
+    }
+}
+
+int APS5_VABI __std_init_once_complete_clr_nid_postfix(void** once, unsigned long flags, void* context) {
+    (void)context;
+    OnceState(once).store(flags == InitFailed ? OnceIdle : OnceDone, std::memory_order_release);
+    sceKernelSyncOnAddressWake(once, INT_MAX);
+    return 1;
+}
+
+[[noreturn]] void APS5_VABI __std_init_once_link_alternate_names_and_abort_nid_postfix() {
+    std::abort();
+}
+
+}
diff --git a/core/libs/prx/libSceLibcInternal/PathStatistics.cpp b/core/libs/prx/libSceLibcInternal/PathStatistics.cpp
index c66f3dcc3b..bca817dd44 100644
--- a/core/libs/prx/libSceLibcInternal/PathStatistics.cpp
+++ b/core/libs/prx/libSceLibcInternal/PathStatistics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include <cerrno>
 #include <cstdint>
@@ -18,7 +19,6 @@
 #endif
 
 struct LibcStatvfs;
-extern "C" int APS5_VABI fstatvfs_nid_postfix(int, LibcStatvfs*);
 
 namespace {
 int Fail(int error) {
diff --git a/core/libs/prx/libSceLibcInternal/SignalList.cpp b/core/libs/prx/libSceLibcInternal/SignalList.cpp
index d27a5531c4..e33acb01fe 100644
--- a/core/libs/prx/libSceLibcInternal/SignalList.cpp
+++ b/core/libs/prx/libSceLibcInternal/SignalList.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -77,16 +79,16 @@ extern const char* const sys_signame_nid_postfix[32] = {
     "USR2",
 };
 
-std::int64_t APS5_VABI _write_nid_postfix(int descriptor, const void* buffer, std::size_t count);
-
 void APS5_VABI psignal_nid_postfix(unsigned int signal, const char* prefix) {
     const char* const message = signal < 32 ? sys_siglist_nid_postfix[signal] : "Unknown signal";
     if (prefix != nullptr && prefix[0] != 0) {
         _write_nid_postfix(2, prefix, std::strlen(prefix));
         _write_nid_postfix(2, ": ", 2);
+
     }
     _write_nid_postfix(2, message, std::strlen(message));
     _write_nid_postfix(2, "\n", 1);
+
 }
 
 }
diff --git a/core/libs/prx/libSceLibcInternal/Spawn.cpp b/core/libs/prx/libSceLibcInternal/Spawn.cpp
index b40cbc9d10..4c7bd815b2 100644
--- a/core/libs/prx/libSceLibcInternal/Spawn.cpp
+++ b/core/libs/prx/libSceLibcInternal/Spawn.cpp
@@ -1,7 +1,16 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libSceLibcInternal/include/Spawn.hpp"
+#include "prx/libc/include/ChildProcesses.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/General.hpp"
+#ifdef _WIN32
+#include "prx/libc/include/WindowsDescriptor.hpp"
+#endif
+#include "prx/libkernel/File/include/FileFlags.hpp"
+#include <algorithm>
 #include <cstdint>
+#include <fcntl.h>
 #include <filesystem>
 #include <new>
 #include <stdexcept>
@@ -9,15 +18,42 @@
 #include <string_view>
 #include <system_error>
 #include <utility>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <spawn.h>
+#endif
+#if defined(__linux__)
+#include <unistd.h>
+#elif defined(__APPLE__)
+#include <crt_externs.h>
+#include <mach-o/dyld.h>
+#include <unistd.h>
+#endif
 
-extern "C" char* APS5_VABI getenv_nid_postfix(const char* name);
+#if defined(__linux__)
+extern char** environ;
+#endif
 
 namespace {
 
 constexpr int NoSuchFile = 2;
 constexpr int BadDescriptor = 9;
 constexpr int OutOfMemory = 12;
+constexpr int Fault = 14;
+constexpr int InvalidArgument = 22;
 constexpr std::string_view DefaultSearchPath = "/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin";
+constexpr std::string_view ApplicationRoot = "/app0/";
+constexpr std::string_view MainExecutable = "/app0/eboot.bin";
+#ifdef _WIN32
+constexpr wchar_t LoadExecParentVariable[] = L"ANYPS5_LOADEXEC_PARENT";
+constexpr wchar_t LoadExecSkipVariable[] = L"ANYPS5_LOADEXEC_ARGV_SKIP=";
+#else
+constexpr std::uint32_t SpawnFlagsImplemented = 0x03;
+#endif
+constexpr std::uint32_t SpawnFlagResetIds = 0x01;
+constexpr std::uint32_t SpawnFlagSetGroup = 0x02;
 
 PosixSpawnAttributes& Attributes(PosixSpawnAttributes* const* attributes, const char* function) {
     if (attributes == nullptr || *attributes == nullptr) throw std::invalid_argument(std::string(function) + ": uninitialized attributes");
@@ -29,36 +65,6 @@ PosixSpawnFileActions& FileActions(PosixSpawnFileActions* const* actions, const
     return **actions;
 }
 
-bool GuestPathExists(const std::string& path) {
-    std::filesystem::path native;
-    if (ResolvePathError_nid_no_patch(path.c_str(), native) != 0) return false;
-    std::error_code error;
-    return std::filesystem::exists(native, error);
-}
-
-bool ProgramFound(std::string_view name, bool searchesPath) {
-    if (name.empty()) return false;
-    if (!searchesPath || name.find('/') != std::string_view::npos) return GuestPathExists(std::string(name));
-    const char* variable = getenv_nid_postfix("PATH");
-    std::string_view directories = variable != nullptr ? std::string_view(variable) : DefaultSearchPath;
-    while (true) {
-        const auto separator = directories.find(':');
-        const auto directory = directories.substr(0, separator);
-        if (GuestPathExists((directory.empty() ? std::string(".") : std::string(directory)) + '/' + std::string(name))) return true;
-        if (separator == std::string_view::npos) return false;
-        directories.remove_prefix(separator + 1);
-    }
-}
-
-int Spawn(const char* function, const char* file, bool searchesPath, PosixSpawnFileActions* const* actions, PosixSpawnAttributes* const* attributes) {
-    if (file == nullptr) throw std::invalid_argument(std::string(function) + ": null path");
-    if (actions != nullptr) FileActions(actions, function);
-    if (attributes != nullptr) Attributes(attributes, function);
-    if (!ProgramFound(file, searchesPath)) return NoSuchFile;
-    NotImplemented_nid_no_patch((std::string(function) + ": process creation").c_str());
-    return -1;
-}
-
 int Append(PosixSpawnFileActions& actions, PosixSpawnFileAction action) {
     try {
         actions.actions.push_back(std::move(action));
@@ -68,6 +74,382 @@ int Append(PosixSpawnFileActions& actions, PosixSpawnFileAction action) {
     return 0;
 }
 
+bool GuestPathExists(const std::string& path) {
+    std::filesystem::path native;
+    if (ResolvePathError_nid_no_patch(path.c_str(), native) != 0) return false;
+    std::error_code error;
+    return std::filesystem::exists(native, error);
+}
+
+bool ProgramFound(std::string_view name, bool searchesPath, std::string& found) {
+    if (name.empty()) return false;
+    if (!searchesPath || name.find('/') != std::string_view::npos) {
+        found = std::string(name);
+        return GuestPathExists(found);
+    }
+    const char* variable = getenv_nid_postfix("PATH");
+    std::string_view directories = variable != nullptr ? std::string_view(variable) : DefaultSearchPath;
+    while (true) {
+        const auto separator = directories.find(':');
+        const auto directory = directories.substr(0, separator);
+        found = (directory.empty() ? std::string(".") : std::string(directory)) + '/' + std::string(name);
+        if (GuestPathExists(found)) return true;
+        if (separator == std::string_view::npos) return false;
+        directories.remove_prefix(separator + 1);
+    }
+}
+
+std::string FlattenedExecutableName(const std::string& guest, const char* function) {
+    std::string_view relative(guest);
+    if (!relative.starts_with(ApplicationRoot)) NotImplemented_nid_no_patch((std::string(function) + ": executables outside /app0 (" + guest + ")").c_str());
+    relative.remove_prefix(ApplicationRoot.size());
+    std::string name;
+    while (true) {
+        const std::size_t separator = relative.find('/');
+        const std::string_view component = relative.substr(0, separator);
+        if (component.empty() || component == "." || component == "..") NotImplemented_nid_no_patch((std::string(function) + ": a path with an empty, . or .. component (" + guest + ")").c_str());
+        name += (name.empty() ? "" : ".") + std::string(component);
+        if (separator == std::string_view::npos) return name;
+        relative.remove_prefix(separator + 1);
+    }
+}
+
+std::filesystem::path OwnExecutable() {
+#if defined(_WIN32)
+    std::wstring own(32768, L'\0');
+    const DWORD length = GetModuleFileNameW(nullptr, own.data(), static_cast<DWORD>(own.size()));
+    if (length == 0 || length >= own.size()) throw std::system_error(GetLastError(), std::system_category(), "posix_spawn: GetModuleFileNameW");
+    own.resize(length);
+    return std::filesystem::path(own);
+#elif defined(__APPLE__)
+    std::uint32_t size = 0;
+    _NSGetExecutablePath(nullptr, &size);
+    std::vector<char> executable(size);
+    std::error_code error;
+    if (_NSGetExecutablePath(executable.data(), &size) == 0) return std::filesystem::canonical(executable.data(), error);
+    throw std::runtime_error("posix_spawn: cannot locate the executable");
+#else
+    std::error_code error;
+    const auto own = std::filesystem::read_symlink("/proc/self/exe", error);
+    if (error) throw std::system_error(error, "posix_spawn: cannot read /proc/self/exe");
+    return own;
+#endif
+}
+
+std::filesystem::path ConvertedExecutableTarget(const char* function, const std::string& guest) {
+    const auto own = OwnExecutable();
+    if (guest == MainExecutable) return own;
+    std::error_code error;
+    const auto name = std::filesystem::path(reinterpret_cast<const char8_t*>((FlattenedExecutableName(guest, function) + own.extension().string()).c_str()));
+    const auto target = own.parent_path() / name;
+    if (!std::filesystem::is_regular_file(target, error))
+        NotImplemented_nid_no_patch((std::string(function) + ": " + guest + " without its converted executable; relink with --executable " + std::string(guest.substr(ApplicationRoot.size()))).c_str());
+    return target;
+}
+
+int HostOpenFlags(std::int32_t sceFlags) {
+    int f = 0;
+    const int acc = sceFlags & SCE_KERNEL_O_ACCMODE;
+    if (acc == SCE_KERNEL_O_RDONLY) f |= 0;
+    else if (acc == SCE_KERNEL_O_WRONLY) f |= 1;
+    else if (acc == SCE_KERNEL_O_RDWR) f |= 2;
+    else throw std::invalid_argument("posix_spawn_file_actions_addopen: invalid access mode");
+#ifdef _WIN32
+    if (sceFlags & SCE_KERNEL_O_APPEND) f |= _O_APPEND;
+    if (sceFlags & SCE_KERNEL_O_CREAT) f |= _O_CREAT;
+    if (sceFlags & SCE_KERNEL_O_TRUNC) f |= _O_TRUNC;
+    if (sceFlags & SCE_KERNEL_O_EXCL) f |= _O_EXCL;
+    f |= _O_BINARY;
+#else
+    if (sceFlags & SCE_KERNEL_O_APPEND) f |= O_APPEND;
+    if (sceFlags & SCE_KERNEL_O_CREAT) f |= O_CREAT;
+    if (sceFlags & SCE_KERNEL_O_TRUNC) f |= O_TRUNC;
+    if (sceFlags & SCE_KERNEL_O_EXCL) f |= O_EXCL;
+#endif
+    return f;
+}
+
+#ifdef _WIN32
+std::wstring Utf16(const std::string& text) {
+    if (text.empty()) return {};
+    const int size = MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, text.data(), static_cast<int>(text.size()), nullptr, 0);
+    if (size <= 0) throw std::runtime_error("posix_spawn: argument is not valid UTF-8");
+    std::wstring wide(static_cast<std::size_t>(size), L'\0');
+    MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS, text.data(), static_cast<int>(text.size()), wide.data(), size);
+    return wide;
+}
+
+std::wstring QuotedArgument(const std::wstring& argument) {
+    if (!argument.empty() && argument.find_first_of(L" \t\n\v\"") == std::wstring::npos) return argument;
+    std::wstring quoted = L"\"";
+    for (std::size_t index = 0;; ++index) {
+        std::size_t backslashes = 0;
+        while (index < argument.size() && argument[index] == L'\\') {
+            ++backslashes;
+            ++index;
+        }
+        if (index == argument.size()) {
+            quoted.append(backslashes * 2, L'\\');
+            break;
+        }
+        quoted.append(argument[index] == L'"' ? backslashes * 2 + 1 : backslashes, L'\\');
+        quoted.push_back(argument[index]);
+    }
+    quoted.push_back(L'"');
+    return quoted;
+}
+#endif
+
+std::string HexFlag(std::uint32_t value) {
+    constexpr char digits[] = "0123456789abcdef";
+    std::string text;
+    if (value == 0) text.push_back('0');
+    while (value > 0) {
+        text.insert(text.begin(), digits[value & 0xfu]);
+        value >>= 4;
+    }
+    return "0x" + text;
+}
+
+std::uint32_t SpawnAttributeFlags(PosixSpawnAttributes* const* attributes) {
+    return attributes != nullptr && *attributes != nullptr ? static_cast<std::uint32_t>(static_cast<std::uint16_t>((*attributes)->flags)) : 0;
+}
+
+#ifdef _WIN32
+struct ChildStreams {
+    HANDLE handles[3] = {INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE, INVALID_HANDLE_VALUE};
+};
+
+HANDLE DuplicateInheritable(HANDLE source) {
+    HANDLE handle = nullptr;
+    if (!DuplicateHandle(GetCurrentProcess(), source, GetCurrentProcess(), &handle, 0, TRUE, DUPLICATE_SAME_ACCESS))
+        throw std::system_error(GetLastError(), std::system_category(), "posix_spawn: duplicating a descriptor");
+    return handle;
+}
+
+void CloseRedirectedStreams(ChildStreams& streams) {
+    for (HANDLE handle : streams.handles)
+        if (handle != INVALID_HANDLE_VALUE) CloseHandle(handle);
+}
+
+void ReplaceChildStream(ChildStreams& streams, int descriptor, HANDLE source) {
+    HANDLE previous = streams.handles[descriptor];
+    streams.handles[descriptor] = source == INVALID_HANDLE_VALUE ? INVALID_HANDLE_VALUE : DuplicateInheritable(source);
+    if (previous != INVALID_HANDLE_VALUE) CloseHandle(previous);
+}
+
+int ApplyChildRedirection(ChildStreams& streams, const PosixSpawnFileAction& action) {
+    switch (action.kind) {
+    case PosixSpawnFileActionKind::Close:
+        if (action.descriptor >= 0 && action.descriptor < 3) ReplaceChildStream(streams, action.descriptor, INVALID_HANDLE_VALUE);
+        return 0;
+    case PosixSpawnFileActionKind::Duplicate:
+        if (action.descriptor < 0 || action.newDescriptor < 0) return BadDescriptor;
+        if (action.newDescriptor > 2)
+            NotImplemented_nid_no_patch(("posix_spawn: a child descriptor " + std::to_string(action.newDescriptor) + " beyond the standard streams").c_str());
+        {
+            const HANDLE source = WindowsDescriptorHandle_nid_no_patch(action.descriptor);
+            if (source == INVALID_HANDLE_VALUE) return BadDescriptor;
+            ReplaceChildStream(streams, action.newDescriptor, source);
+        }
+        return 0;
+    case PosixSpawnFileActionKind::Open: {
+        if (action.descriptor < 0) return BadDescriptor;
+        if (action.descriptor > 2)
+            NotImplemented_nid_no_patch(("posix_spawn: a child descriptor " + std::to_string(action.descriptor) + " beyond the standard streams").c_str());
+        std::filesystem::path native;
+        if (const int error = ResolvePathError_nid_no_patch(action.path.c_str(), native)) return error;
+        try {
+            const int fd = ::_wopen(native.c_str(), HostOpenFlags(action.openFlags), action.mode);
+            if (fd < 0) return errno;
+            const HANDLE source = WindowsDescriptorHandle_nid_no_patch(fd);
+            ReplaceChildStream(streams, action.descriptor, source);
+            ::_close(fd);
+        } catch (const std::invalid_argument&) {
+            return InvalidArgument;
+        }
+        return 0;
+    }
+    }
+    return 0;
+}
+
+std::vector<wchar_t> ChildEnvironment(char* const* environment) {
+    std::vector<std::wstring> entries;
+    const auto missesMarkers = [](const std::wstring& entry) {
+        return entry.compare(0, std::size(LoadExecParentVariable) - 1, LoadExecParentVariable) != 0 &&
+            entry.compare(0, std::size(LoadExecSkipVariable) - 1, LoadExecSkipVariable) != 0;
+    };
+    if (environment != nullptr)
+        for (std::size_t index = 0; environment[index] != nullptr; ++index) {
+            const std::wstring entry = Utf16(environment[index]);
+            if (missesMarkers(entry))
+                entries.push_back(entry);
+        }
+    else {
+        const LPWCH block = GetEnvironmentStringsW();
+        for (const wchar_t* text = block; *text != L'\0'; ) {
+            std::size_t length = 0;
+            while (text[length] != L'\0') ++length;
+            if (length > 0) {
+                const std::wstring entry(text, length);
+                if (missesMarkers(entry))
+                    entries.push_back(entry);
+            }
+            text += length + 1;
+        }
+        FreeEnvironmentStringsW(block);
+    }
+    entries.push_back(std::wstring(LoadExecSkipVariable) + L"1");
+    std::sort(entries.begin(), entries.end(), [](const auto& left, const auto& right) { return _wcsicmp(left.c_str(), right.c_str()) < 0; });
+    std::vector<wchar_t> block;
+    for (const auto& entry : entries) {
+        block.insert(block.end(), entry.begin(), entry.end());
+        block.push_back(0);
+    }
+    block.push_back(0);
+    return block;
+}
+
+int SpawnChild(const char* function, const std::string& guest, PosixSpawnFileActions* const* actions,
+    PosixSpawnAttributes* const* attributes, std::int32_t* processId, char* const* arguments, char* const* environment) {
+    const auto target = ConvertedExecutableTarget(function, guest);
+    if (const std::uint32_t attributes_flags = SpawnAttributeFlags(attributes); attributes_flags != 0)
+        NotImplemented_nid_no_patch(("posix_spawn: the attribute flags " + HexFlag(attributes_flags) + " on this host").c_str());
+    ChildStreams streams;
+    const DWORD identifiers[] = {STD_INPUT_HANDLE, STD_OUTPUT_HANDLE, STD_ERROR_HANDLE};
+    bool redirected = false;
+    for (std::size_t index = 0; index < 3; ++index) {
+        const HANDLE source = GetStdHandle(identifiers[index]);
+        if (source == nullptr || source == INVALID_HANDLE_VALUE) continue;
+        streams.handles[index] = DuplicateInheritable(source);
+        redirected = true;
+    }
+    if (actions != nullptr) {
+        for (const auto& action : (*actions)->actions) {
+            if (action.kind != PosixSpawnFileActionKind::Close || (action.descriptor >= 0 && action.descriptor < 3)) redirected = true;
+            const int error = ApplyChildRedirection(streams, action);
+            if (error != 0) {
+                CloseRedirectedStreams(streams);
+                return error;
+            }
+        }
+    }
+    std::wstring command = L"\"" + target.wstring() + L"\"";
+    for (std::size_t index = 0; arguments[index] != nullptr; ++index)
+        command += L" " + QuotedArgument(Utf16(arguments[index]));
+    if (command.size() >= 32767) throw std::runtime_error("posix_spawn: command line is too long");
+    auto environmentBlock = ChildEnvironment(environment);
+    PROCESS_INFORMATION process{};
+    const BOOL created = [&] {
+        if (!redirected || (streams.handles[0] == INVALID_HANDLE_VALUE && streams.handles[1] == INVALID_HANDLE_VALUE && streams.handles[2] == INVALID_HANDLE_VALUE)) {
+            STARTUPINFOW plain{};
+            plain.cb = sizeof(plain);
+            return CreateProcessW(const_cast<wchar_t*>(target.c_str()), command.data(), nullptr, nullptr, FALSE,
+                environmentBlock.empty() ? 0u : CREATE_UNICODE_ENVIRONMENT, environmentBlock.empty() ? nullptr : environmentBlock.data(),
+                nullptr, &plain, &process);
+        }
+        STARTUPINFOEXW startup{};
+        startup.StartupInfo.cb = sizeof(startup);
+        startup.StartupInfo.dwFlags = STARTF_USESTDHANDLES;
+        startup.StartupInfo.hStdInput = streams.handles[0];
+        startup.StartupInfo.hStdOutput = streams.handles[1];
+        startup.StartupInfo.hStdError = streams.handles[2];
+        std::vector<HANDLE> inherited;
+        for (HANDLE handle : streams.handles)
+            if (handle != INVALID_HANDLE_VALUE) inherited.push_back(handle);
+        SIZE_T bytes = 0;
+        InitializeProcThreadAttributeList(nullptr, 1, 0, &bytes);
+        std::vector<std::max_align_t> storage((bytes + sizeof(std::max_align_t) - 1) / sizeof(std::max_align_t));
+        auto* list = reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(storage.data());
+        if (!InitializeProcThreadAttributeList(list, 1, 0, &bytes) ||
+            !UpdateProcThreadAttribute(list, 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST, inherited.data(), inherited.size() * sizeof(HANDLE), nullptr, nullptr))
+            throw std::system_error(GetLastError(), std::system_category(), "posix_spawn: selecting inherited handles");
+        const std::unique_ptr<_PROC_THREAD_ATTRIBUTE_LIST, void (*)(_PROC_THREAD_ATTRIBUTE_LIST*)> cleanup(list, DeleteProcThreadAttributeList);
+        return CreateProcessW(const_cast<wchar_t*>(target.c_str()), command.data(), nullptr, nullptr, TRUE,
+            EXTENDED_STARTUPINFO_PRESENT | (environmentBlock.empty() ? 0u : CREATE_UNICODE_ENVIRONMENT),
+            environmentBlock.empty() ? nullptr : environmentBlock.data(), nullptr, &startup.StartupInfo, &process);
+    }();
+    if (!created) {
+        const DWORD error = GetLastError();
+        CloseRedirectedStreams(streams);
+        throw std::system_error(error, std::system_category(), "posix_spawn: creating the converted executable");
+    }
+    CloseRedirectedStreams(streams);
+    CloseHandle(process.hThread);
+    RegisterChildProcess_nid_no_patch(process.dwProcessId, static_cast<std::int64_t>(reinterpret_cast<std::uintptr_t>(process.hProcess)));
+    *processId = static_cast<std::int32_t>(process.dwProcessId);
+    return 0;
+}
+#else
+int SpawnChild(const char* function, const std::string& guest, PosixSpawnFileActions* const* actions,
+    PosixSpawnAttributes* const* attributes, std::int32_t* processId, char* const* arguments, char* const* environment) {
+    const auto target = ConvertedExecutableTarget(function, guest);
+    posix_spawnattr_t hostAttributes;
+    posix_spawnattr_t* usedAttributes = nullptr;
+    const std::uint32_t flags = SpawnAttributeFlags(attributes);
+    if ((flags & ~SpawnFlagsImplemented) != 0)
+        NotImplemented_nid_no_patch(("posix_spawn: the attribute flags " + HexFlag(flags)).c_str());
+    if (flags != 0) {
+        if (posix_spawnattr_init(&hostAttributes) != 0) return Fault;
+        usedAttributes = &hostAttributes;
+        if ((flags & SpawnFlagResetIds) != 0) posix_spawnattr_setflags(usedAttributes, POSIX_SPAWN_RESETIDS);
+        if ((flags & SpawnFlagSetGroup) != 0) {
+            posix_spawnattr_setflags(usedAttributes, POSIX_SPAWN_SETPGROUP);
+            posix_spawnattr_setpgroup(usedAttributes, (*attributes)->processGroup);
+        }
+    }
+    posix_spawn_file_actions_t hostActions;
+    posix_spawn_file_actions_t* usedActions = nullptr;
+    if (actions != nullptr && !(*actions)->actions.empty()) {
+        if (posix_spawn_file_actions_init(&hostActions) != 0) {
+            if (usedAttributes != nullptr) posix_spawnattr_destroy(usedAttributes);
+            return Fault;
+        }
+        usedActions = &hostActions;
+    }
+    int result = 0;
+    if (actions != nullptr && usedActions != nullptr)
+        for (const auto& action : (*actions)->actions) {
+            switch (action.kind) {
+            case PosixSpawnFileActionKind::Close:
+                result = posix_spawn_file_actions_addclose(usedActions, action.descriptor);
+                break;
+            case PosixSpawnFileActionKind::Duplicate:
+                result = posix_spawn_file_actions_adddup2(usedActions, action.descriptor, action.newDescriptor);
+                break;
+            case PosixSpawnFileActionKind::Open: {
+                std::filesystem::path native;
+                if (const int error = ResolvePathError_nid_no_patch(action.path.c_str(), native)) result = error;
+                else {
+                    try {
+                        result = posix_spawn_file_actions_addopen(usedActions, action.descriptor, native.c_str(), HostOpenFlags(action.openFlags), action.mode);
+                    } catch (const std::invalid_argument&) {
+                        result = InvalidArgument;
+                    }
+                }
+                break;
+            }
+            }
+            if (result != 0) break;
+        }
+    if (result == 0) {
+        char* const* hostEnvironment = environment;
+#if defined(__linux__)
+        if (hostEnvironment == nullptr) hostEnvironment = environ;
+#elif defined(__APPLE__)
+        if (hostEnvironment == nullptr) hostEnvironment = *_NSGetEnviron();
+#endif
+        pid_t childPid = -1;
+        result = posix_spawn(&childPid, target.c_str(), usedActions, usedAttributes, arguments, hostEnvironment);
+        if (result == 0) *processId = static_cast<std::int32_t>(childPid);
+    }
+    if (usedActions != nullptr) posix_spawn_file_actions_destroy(usedActions);
+    if (usedAttributes != nullptr) posix_spawnattr_destroy(usedAttributes);
+    return result;
+}
+#endif
+
 }
 
 extern "C" {
@@ -198,18 +580,23 @@ int APS5_VABI posix_spawn_file_actions_addclose_nid_postfix(PosixSpawnFileAction
     return Append(FileActions(actions, "posix_spawn_file_actions_addclose"), {PosixSpawnFileActionKind::Close, descriptor, {}, 0, 0, 0});
 }
 
+int SpawnProgram(const char* function, const char* file, bool searchesPath, PosixSpawnFileActions* const* actions,
+    PosixSpawnAttributes* const* attributes, std::int32_t* processId, char* const* arguments, char* const* environment) {
+    if (file == nullptr) throw std::invalid_argument(std::string(function) + ": null path");
+    if (actions != nullptr) FileActions(actions, function);
+    if (attributes != nullptr) Attributes(attributes, function);
+    std::string found;
+    if (!ProgramFound(file, searchesPath, found)) return NoSuchFile;
+    if (arguments == nullptr) return Fault;
+    return SpawnChild(function, found, actions, attributes, processId, arguments, environment);
+}
+
 int APS5_VABI posix_spawn_nid_postfix(std::int32_t* processId, const char* path, PosixSpawnFileActions* const* actions, PosixSpawnAttributes* const* attributes, char* const* arguments, char* const* environment) {
-    (void)processId;
-    (void)arguments;
-    (void)environment;
-    return Spawn("posix_spawn", path, false, actions, attributes);
+    return SpawnProgram("posix_spawn", path, false, actions, attributes, processId, arguments, environment);
 }
 
 int APS5_VABI posix_spawnp_nid_postfix(std::int32_t* processId, const char* file, PosixSpawnFileActions* const* actions, PosixSpawnAttributes* const* attributes, char* const* arguments, char* const* environment) {
-    (void)processId;
-    (void)arguments;
-    (void)environment;
-    return Spawn("posix_spawnp", file, true, actions, attributes);
+    return SpawnProgram("posix_spawnp", file, true, actions, attributes, processId, arguments, environment);
 }
 
 }
diff --git a/core/libs/prx/libSceLibcInternal/UserContext.cpp b/core/libs/prx/libSceLibcInternal/UserContext.cpp
index 3f743af8f4..9ef01bd612 100644
--- a/core/libs/prx/libSceLibcInternal/UserContext.cpp
+++ b/core/libs/prx/libSceLibcInternal/UserContext.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/GuestStacks.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -7,8 +9,6 @@
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" int APS5_VABI setcontext_nid_postfix(const UserUcontext* context);
-
 namespace {
 
 using ContextFunction = void (APS5_VABI*)(std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t);
@@ -26,6 +26,7 @@ extern "C" {
 [[noreturn]] void APS5_VABI Aps5MakecontextFinish_nid_no_patch(UserUcontext* context) {
     if (context->link == nullptr) LibcExit_nid_no_patch(0);
     setcontext_nid_postfix(context->link);
+
     std::abort();
 }
 
@@ -62,6 +63,7 @@ Aps5MakecontextStart_nid_no_patch:
     function(arguments[0], arguments[1], arguments[2], arguments[3], arguments[4], arguments[5]);
     if (context->link == nullptr) LibcExit_nid_no_patch(0);
     setcontext_nid_postfix(context->link);
+
     std::abort();
 }
 #endif
diff --git a/core/libs/prx/libSceLibcInternal/include/Api.hpp b/core/libs/prx/libSceLibcInternal/include/Api.hpp
new file mode 100644
index 0000000000..d10e3f958b
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/include/Api.hpp
@@ -0,0 +1,106 @@
+#pragma once
+
+#include "prx/libSceLibcInternal/include/Statvfs.hpp"
+#include "prx/libSceLibcInternal/include/Spawn.hpp"
+#include "prx/libkernel/System/include/UserContext.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "SceTypes.hpp"
+
+using ErrExit = void (APS5_VABI*)(int);
+
+struct GuestOption {
+    const char* name;
+    int hasArgument;
+    int* flag;
+    int value;
+};
+
+struct LibcUtimbuf {
+    std::int64_t actime;
+    std::int64_t modtime;
+};
+
+using ThreadDestructorFunction = void (APS5_VABI*)(void*);
+
+extern "C" {
+
+void* APS5_VABI fdopendir_nid_postfix(int fd);
+void APS5_VABI err_set_file_nid_postfix(FileStream* stream);
+void APS5_VABI err_set_exit_nid_postfix(ErrExit function);
+void APS5_VABI vwarnc_nid_postfix(int code, const char* format, VaList* args);
+void APS5_VABI vwarn_nid_postfix(const char* format, VaList* args);
+void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args);
+void APS5_VABI warnc_nid_postfix(int code, const char* format, ...);
+void APS5_VABI warn_nid_postfix(const char* format, ...);
+void APS5_VABI _warn_nid_postfix(const char* format, ...);
+void APS5_VABI warnx_nid_postfix(const char* format, ...);
+const char* APS5_VABI getprogname_nid_postfix();
+const char* APS5_VABI _getprogname_nid_postfix();
+void APS5_VABI __cxa_finalize_nid_postfix(void* dsoHandle);
+void APS5_VABI sceLibcHeapGetTraceInfo_nid_postfix(Info* info);
+int APS5_VABI _sceLibcInternalThreadAtexit_nid_postfix(ThreadDestructorFunction destructor, void* object, void* dsoSymbol);
+void APS5_VABI _sceLibcInternalThreadDtors_nid_postfix();
+int APS5_VABI _sceLibcInternalForceTlsDestructor_nid_postfix(KernelModule handle);
+unsigned int APS5_VABI alarm_nid_postfix(unsigned int seconds);
+int APS5_VABI fstatvfs_nid_postfix(int descriptor, LibcStatvfs* output);
+int APS5_VABI utime_nid_postfix(const char* path, const LibcUtimbuf* times);
+int APS5_VABI getopt_nid_postfix(int count, char* const* arguments, const char* options);
+int APS5_VABI getopt_long_nid_postfix(int count, char* const* arguments, const char* options, const GuestOption* longOptions, int* index);
+int APS5_VABI getopt_long_only_nid_postfix(int count, char* const* arguments, const char* options, const GuestOption* longOptions, int* index);
+int APS5_VABI inet_aton_nid_postfix(const char* text, std::uint32_t* address);
+std::uint32_t APS5_VABI inet_addr_nid_postfix(const char* text);
+char* APS5_VABI inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size);
+char* APS5_VABI __inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size);
+char* APS5_VABI inet_ntoa_nid_postfix(std::uint32_t address);
+int APS5_VABI statvfs_nid_postfix(const char* path, LibcStatvfs* output);
+void APS5_VABI psignal_nid_postfix(unsigned int signal, const char* prefix);
+int APS5_VABI posix_spawnattr_init_nid_postfix(PosixSpawnAttributes** attributes);
+int APS5_VABI posix_spawnattr_destroy_nid_postfix(PosixSpawnAttributes** attributes);
+int APS5_VABI posix_spawnattr_setflags_nid_postfix(PosixSpawnAttributes** attributes, std::int16_t flags);
+int APS5_VABI posix_spawnattr_setsigdefault_nid_postfix(PosixSpawnAttributes** attributes, const GuestSignalSet* signalDefault);
+int APS5_VABI posix_spawnattr_getflags_nid_postfix(PosixSpawnAttributes* const* attributes, std::int16_t* flags);
+int APS5_VABI posix_spawnattr_getpgroup_nid_postfix(PosixSpawnAttributes* const* attributes, std::int32_t* processGroup);
+int APS5_VABI posix_spawnattr_getschedparam_nid_postfix(PosixSpawnAttributes* const* attributes, std::int32_t* schedulingParameter);
+int APS5_VABI posix_spawnattr_getschedpolicy_nid_postfix(PosixSpawnAttributes* const* attributes, std::int32_t* schedulingPolicy);
+int APS5_VABI posix_spawnattr_getsigdefault_nid_postfix(PosixSpawnAttributes* const* attributes, GuestSignalSet* signalDefault);
+int APS5_VABI posix_spawnattr_getsigmask_nid_postfix(PosixSpawnAttributes* const* attributes, GuestSignalSet* signalMask);
+int APS5_VABI posix_spawnattr_setpgroup_nid_postfix(PosixSpawnAttributes** attributes, std::int32_t processGroup);
+int APS5_VABI posix_spawnattr_setschedparam_nid_postfix(PosixSpawnAttributes** attributes, const std::int32_t* schedulingParameter);
+int APS5_VABI posix_spawnattr_setschedpolicy_nid_postfix(PosixSpawnAttributes** attributes, std::int32_t schedulingPolicy);
+int APS5_VABI posix_spawnattr_setsigmask_nid_postfix(PosixSpawnAttributes** attributes, const GuestSignalSet* signalMask);
+int APS5_VABI posix_spawn_file_actions_init_nid_postfix(PosixSpawnFileActions** actions);
+int APS5_VABI posix_spawn_file_actions_destroy_nid_postfix(PosixSpawnFileActions** actions);
+int APS5_VABI posix_spawn_file_actions_addopen_nid_postfix(PosixSpawnFileActions** actions, int descriptor, const char* path, int openFlags, std::uint16_t mode);
+int APS5_VABI posix_spawn_file_actions_adddup2_nid_postfix(PosixSpawnFileActions** actions, int descriptor, int newDescriptor);
+int APS5_VABI posix_spawn_file_actions_addclose_nid_postfix(PosixSpawnFileActions** actions, int descriptor);
+int APS5_VABI posix_spawn_nid_postfix(std::int32_t* processId, const char* path, PosixSpawnFileActions* const* actions, PosixSpawnAttributes* const* attributes, char* const* arguments, char* const* environment);
+int APS5_VABI posix_spawnp_nid_postfix(std::int32_t* processId, const char* file, PosixSpawnFileActions* const* actions, PosixSpawnAttributes* const* attributes, char* const* arguments, char* const* environment);
+void APS5_VABI makecontext_nid_postfix(UserUcontext* context, void (APS5_VABI* start)(), int count, ...);
+
+[[noreturn]] void APS5_VABI verrc_nid_postfix(int status, int code, const char* format, VaList* args);
+[[noreturn]] void APS5_VABI verr_nid_postfix(int status, const char* format, VaList* args);
+[[noreturn]] void APS5_VABI verrx_nid_postfix(int status, const char* format, VaList* args);
+[[noreturn]] void APS5_VABI errc_nid_postfix(int status, int code, const char* format, ...);
+[[noreturn]] void APS5_VABI err_nid_postfix(int status, const char* format, ...);
+[[noreturn]] void APS5_VABI _err_nid_postfix(int status, const char* format, ...);
+[[noreturn]] void APS5_VABI errx_nid_postfix(int status, const char* format, ...);
+
+int APS5_VABI _ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error);
+int APS5_VABI _ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error);
+std::uint64_t APS5_VABI _ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(const char* path, int* error);
+int APS5_VABI _ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(const char* path, std::int64_t* seconds, std::int64_t* nanoseconds);
+int APS5_VABI _ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(const char* path, const char* existing);
+bool APS5_VABI _ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(const char* path);
+int APS5_VABI _ZNSt10filesystem7_UnlinkEPKc_nid_postfix(const char* path);
+int APS5_VABI _ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(const char* path, int perms);
+bool APS5_VABI _ZNSt10filesystem12_Current_getERA260_c_nid_postfix(char* target);
+char* APS5_VABI _ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(char* target, void* handle, int* type);
+void* APS5_VABI _ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(char* target, const char* path, int* error, int* type);
+int APS5_VABI _ZNSt10filesystem10_Close_dirEPv_nid_postfix(void* handle);
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcSt10error_code_nid_postfix();
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcRKNS_4pathESt10error_code_nid_postfix();
+int APS5_VABI __std_init_once_begin_initialize_clr_nid_postfix(void** once, unsigned long flags, int* pending, void** context);
+int APS5_VABI __std_init_once_complete_clr_nid_postfix(void** once, unsigned long flags, void* context);
+[[noreturn]] void APS5_VABI __std_init_once_link_alternate_names_and_abort_nid_postfix();
+
+}
diff --git a/core/libs/prx/libSceLibcInternal/libSceLibcInternal.hpp b/core/libs/prx/libSceLibcInternal/libSceLibcInternal.hpp
new file mode 100644
index 0000000000..7da0381b01
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/libSceLibcInternal.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLibcInternal/include/Api.hpp"
diff --git a/core/libs/prx/libSceLibreSsl/Alert.cpp b/core/libs/prx/libSceLibreSsl/Alert.cpp
new file mode 100644
index 0000000000..f0783dd6b0
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/Alert.cpp
@@ -0,0 +1,45 @@
+#include "prx/libSceLibreSsl/libSceLibreSsl.hpp"
+
+extern "C" const char* APS5_VABI SSL_alert_desc_string_long_nid_postfix(int value) {
+    struct Description {
+        unsigned int code;
+        const char* text;
+    };
+    static constexpr Description descriptions[] = {
+        {0, "close notify"},
+        {10, "unexpected_message"},
+        {20, "bad record mac"},
+        {21, "decryption failed"},
+        {22, "record overflow"},
+        {30, "decompression failure"},
+        {40, "handshake failure"},
+        {41, "no certificate"},
+        {42, "bad certificate"},
+        {43, "unsupported certificate"},
+        {44, "certificate revoked"},
+        {45, "certificate expired"},
+        {46, "certificate unknown"},
+        {47, "illegal parameter"},
+        {48, "unknown CA"},
+        {49, "access denied"},
+        {50, "decode error"},
+        {51, "decrypt error"},
+        {60, "export restriction"},
+        {70, "protocol version"},
+        {71, "insufficient security"},
+        {80, "internal error"},
+        {90, "user canceled"},
+        {100, "no renegotiation"},
+        {110, "unsupported extension"},
+        {111, "certificate unobtainable"},
+        {112, "unrecognized name"},
+        {113, "bad certificate status response"},
+        {114, "bad certificate hash value"},
+        {115, "unknown PSK identity"},
+    };
+    const auto code = static_cast<unsigned int>(value) & 0xffu;
+    for (const auto& description : descriptions) {
+        if (description.code == code) return description.text;
+    }
+    return "unknown";
+}
diff --git a/core/libs/prx/libSceLibreSsl/CMakeLists.txt b/core/libs/prx/libSceLibreSsl/CMakeLists.txt
index 78e8a9adec..0eae0a5d98 100644
--- a/core/libs/prx/libSceLibreSsl/CMakeLists.txt
+++ b/core/libs/prx/libSceLibreSsl/CMakeLists.txt
@@ -1,7 +1,8 @@
-add_library(libSceLibreSsl SHARED EXCLUDE_FROM_ALL ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Digest.cpp)
+add_library(libSceLibreSsl SHARED EXCLUDE_FROM_ALL ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Digest.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Runtime.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Aes.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Error.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Ocsp.cpp)
 target_include_directories(libSceLibreSsl PRIVATE ${LIBS_INCLUDE_DIR})
 target_link_libraries(libSceLibreSsl PRIVATE mbedcrypto)
 configure_windows_unwind(libSceLibreSsl)
+target_sources(libSceLibreSsl PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src/Asn1.cpp)
 
 if(BUILD_TESTING)
     add_test_executable(guest_libressl_x509_errors_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslX509Errors.cpp)
@@ -21,8 +22,15 @@ if(BUILD_TESTING)
     configure_windows_unwind(guest_libressl_digest_tests)
     add_test(NAME guest_libressl_digest COMMAND guest_libressl_digest_tests)
     set_tests_properties(guest_libressl_digest PROPERTIES TIMEOUT 30)
+    add_test_executable(guest_libressl_asn1_tests ${CMAKE_CURRENT_SOURCE_DIR}/tests/Asn1.cpp)
+    target_include_directories(guest_libressl_asn1_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_asn1_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_asn1_tests)
+    add_test(NAME guest_libressl_asn1 COMMAND guest_libressl_asn1_tests)
+    add_test(NAME guest_libressl_asn1_allocator COMMAND guest_libressl_asn1_tests allocator)
+    set_tests_properties(guest_libressl_asn1 guest_libressl_asn1_allocator PROPERTIES TIMEOUT 30)
     if(WIN32)
-        set_tests_properties(guest_libressl_digest PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_libressl_digest guest_libressl_asn1 guest_libressl_asn1_allocator PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
     endif()
 
@@ -36,4 +44,91 @@ if(BUILD_TESTING)
         set_tests_properties(guest_libressl_des PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
     endif()
+
+    add_test_executable(guest_libressl_runtime_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslRuntime.cpp)
+    target_include_directories(guest_libressl_runtime_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_runtime_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_runtime_tests)
+    add_test(NAME guest_libressl_runtime COMMAND guest_libressl_runtime_tests)
+    set_tests_properties(guest_libressl_runtime PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_runtime PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+
+    add_test_executable(guest_libressl_aes_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslAes.cpp)
+    target_include_directories(guest_libressl_aes_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_aes_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_aes_tests)
+    add_test(NAME guest_libressl_aes COMMAND guest_libressl_aes_tests)
+    set_tests_properties(guest_libressl_aes PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_aes PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+
+    add_test_executable(guest_libressl_error_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslError.cpp)
+    target_include_directories(guest_libressl_error_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_error_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_error_tests)
+    add_test(NAME guest_libressl_error COMMAND guest_libressl_error_tests)
+    set_tests_properties(guest_libressl_error PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_error PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+
+    add_test_executable(guest_libressl_ocsp_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslOcsp.cpp)
+    target_include_directories(guest_libressl_ocsp_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_ocsp_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_ocsp_tests)
+    add_test(NAME guest_libressl_ocsp COMMAND guest_libressl_ocsp_tests)
+    set_tests_properties(guest_libressl_ocsp PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_ocsp PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+endif()
+
+target_sources(libSceLibreSsl PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src/Cipher.cpp)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_libressl_cipher_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslCipher.cpp)
+    target_include_directories(guest_libressl_cipher_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_cipher_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_cipher_tests)
+    add_test(NAME guest_libressl_cipher COMMAND guest_libressl_cipher_tests)
+    set_tests_properties(guest_libressl_cipher PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_cipher PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+endif()
+
+target_sources(libSceLibreSsl PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/Alert.cpp)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_libressl_alert_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslAlert.cpp)
+    target_include_directories(guest_libressl_alert_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_alert_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_alert_tests)
+    add_test(NAME guest_libressl_alert COMMAND guest_libressl_alert_tests)
+    set_tests_properties(guest_libressl_alert PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_alert PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_libressl_version_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslVersion.cpp)
+    target_include_directories(guest_libressl_version_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_version_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_version_tests)
+    add_test(NAME guest_libressl_version COMMAND guest_libressl_version_tests)
+    set_tests_properties(guest_libressl_version PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_version PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
 endif()
diff --git a/core/libs/prx/libSceLibreSsl/Export.cpp b/core/libs/prx/libSceLibreSsl/Export.cpp
index 1e2c3c9caa..cee8b3e31f 100644
--- a/core/libs/prx/libSceLibreSsl/Export.cpp
+++ b/core/libs/prx/libSceLibreSsl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
 #include <cinttypes>
 #include <cstdio>
 #include <cstddef>
@@ -18,76 +19,11 @@ constexpr std::size_t DesScheduleBytes = 128;
 extern "C" {
 
 APS5_DUMMY_FUN
-int APS5_VABI AES_cbc_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_cfb128_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_ctr128_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_decrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_ecb_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_set_decrypt_key_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_set_encrypt_key_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ASN1_INTEGER_get_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ASN1_STRING_data_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ASN1_STRING_length_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI ASN1_STRING_print_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI ASN1_STRING_to_UTF8_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ASN1_STRING_type_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI ASN1_TIME_print_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -283,16 +219,6 @@ int APS5_VABI CRYPTO_cleanup_all_ex_data_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI CRYPTO_free_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI CRYPTO_malloc_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI CRYPTO_num_locks_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -308,11 +234,6 @@ int APS5_VABI CRYPTO_set_locking_callback_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI CRYPTO_set_mem_functions_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 void APS5_VABI DES_ecb_encrypt_nid_postfix(const unsigned char* input, unsigned char* output, const unsigned char* schedule, int enc) {
     if (input == nullptr || output == nullptr || schedule == nullptr) APS5_INVALID_ARG_EX;
     mbedtls_des_context context;
@@ -527,11 +448,6 @@ int APS5_VABI ENGINE_set_default_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI ERR_clear_error_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI ERR_error_string_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -547,21 +463,6 @@ int APS5_VABI ERR_free_strings_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI ERR_get_error_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ERR_peek_error_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ERR_remove_thread_state_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI EVP_CIPHER_CTX_cleanup_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -912,21 +813,11 @@ int APS5_VABI OCSP_basic_verify_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI OCSP_cert_status_str_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI OCSP_check_validity_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI OCSP_crl_reason_str_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI OCSP_resp_count_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -947,11 +838,6 @@ int APS5_VABI OCSP_response_status_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI OCSP_response_status_str_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI OCSP_single_get0_status_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1017,31 +903,6 @@ int APS5_VABI PKCS12_parse_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI RAND_add_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_bytes_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_file_name_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_load_file_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_status_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI RSA_flags_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1107,21 +968,6 @@ int APS5_VABI RSA_verify_PKCS1_PSS_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI SSL_CIPHER_get_bits_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SSL_CIPHER_get_name_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SSL_CIPHER_get_version_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI SSL_CTX_add_client_CA_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1312,11 +1158,6 @@ int APS5_VABI SSL_accept_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI SSL_alert_desc_string_long_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI SSL_check_private_key_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1537,9 +1378,8 @@ int APS5_VABI SSL_write_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI SSLeay_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::uint64_t APS5_VABI SSLeay_nid_postfix(void) {
+    return 0x20000000;
 }
 
 int APS5_VABI SSLv23_client_method_nid_postfix(void) {
diff --git a/core/libs/prx/libSceLibreSsl/include/Api.hpp b/core/libs/prx/libSceLibreSsl/include/Api.hpp
new file mode 100644
index 0000000000..cfee7755af
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/include/Api.hpp
@@ -0,0 +1,456 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct Asn1String {
+    std::int32_t length;
+    std::int32_t type;
+    unsigned char* data;
+    std::int64_t flags;
+};
+
+inline constexpr int MaxRounds = 14;
+
+struct AesKey {
+    std::uint32_t roundKeys[4 * (MaxRounds + 1)];
+    std::int32_t rounds;
+};
+
+struct Md4Context {
+    std::uint32_t A, B, C, D;
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num;
+};
+
+struct Md5Context {
+    std::uint32_t A, B, C, D;
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num;
+};
+
+struct Sha1Context {
+    std::uint32_t h[5];
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num;
+};
+
+struct Sha256Context {
+    std::uint32_t h[8];
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num, mdLength;
+};
+
+struct Sha512Context {
+    std::uint64_t h[8];
+    std::uint64_t Nl, Nh;
+    std::uint64_t data[16];
+    std::uint32_t num, mdLength;
+};
+
+extern "C" {
+
+std::int64_t APS5_VABI ASN1_INTEGER_get_nid_postfix(const Asn1String* value);
+unsigned char* APS5_VABI ASN1_STRING_data_nid_postfix(Asn1String* value);
+int APS5_VABI ASN1_STRING_length_nid_postfix(const Asn1String* value);
+int APS5_VABI ASN1_STRING_print_nid_postfix(void);
+int APS5_VABI ASN1_STRING_to_UTF8_nid_postfix(unsigned char** output, Asn1String* value);
+int APS5_VABI ASN1_STRING_type_nid_postfix(Asn1String* value);
+int APS5_VABI ASN1_TIME_print_nid_postfix(void);
+int APS5_VABI BIO_ctrl_nid_postfix(void);
+int APS5_VABI BIO_f_ssl_nid_postfix(void);
+int APS5_VABI BIO_free_nid_postfix(void);
+int APS5_VABI BIO_new_nid_postfix(void);
+int APS5_VABI BIO_new_fp_nid_postfix(void);
+int APS5_VABI BIO_new_mem_buf_nid_postfix(void);
+int APS5_VABI BIO_new_socket_nid_postfix(void);
+int APS5_VABI BIO_printf_nid_postfix(void);
+int APS5_VABI BIO_puts_nid_postfix(void);
+int APS5_VABI BIO_s_file_nid_postfix(void);
+int APS5_VABI BIO_s_mem_nid_postfix(void);
+int APS5_VABI BIO_write_nid_postfix(void);
+int APS5_VABI BN_CTX_end_nid_postfix(void);
+int APS5_VABI BN_CTX_free_nid_postfix(void);
+int APS5_VABI BN_CTX_new_nid_postfix(void);
+int APS5_VABI BN_CTX_start_nid_postfix(void);
+int APS5_VABI BN_add_word_nid_postfix(void);
+int APS5_VABI BN_bin2bn_nid_postfix(void);
+int APS5_VABI BN_bn2bin_nid_postfix(void);
+int APS5_VABI BN_free_nid_postfix(void);
+int APS5_VABI BN_hex2bn_nid_postfix(void);
+int APS5_VABI BN_mod_inverse_nid_postfix(void);
+int APS5_VABI BN_mul_nid_postfix(void);
+int APS5_VABI BN_new_nid_postfix(void);
+int APS5_VABI BN_num_bits_nid_postfix(void);
+int APS5_VABI BN_print_nid_postfix(void);
+int APS5_VABI BN_set_word_nid_postfix(void);
+int APS5_VABI BN_sub_word_nid_postfix(void);
+int APS5_VABI CMAC_CTX_free_nid_postfix(void);
+int APS5_VABI CMAC_CTX_new_nid_postfix(void);
+int APS5_VABI CMAC_Final_nid_postfix(void);
+int APS5_VABI CMAC_Init_nid_postfix(void);
+int APS5_VABI CMAC_Update_nid_postfix(void);
+int APS5_VABI CONF_modules_free_nid_postfix(void);
+int APS5_VABI CONF_modules_load_file_nid_postfix(void);
+int APS5_VABI CRYPTO_THREADID_set_callback_nid_postfix(void);
+int APS5_VABI CRYPTO_THREADID_set_numeric_nid_postfix(void);
+int APS5_VABI CRYPTO_cleanup_all_ex_data_nid_postfix(void);
+int APS5_VABI CRYPTO_num_locks_nid_postfix(void);
+int APS5_VABI CRYPTO_set_add_lock_callback_nid_postfix(void);
+int APS5_VABI CRYPTO_set_locking_callback_nid_postfix(void);
+void APS5_VABI DES_ecb_encrypt_nid_postfix(const unsigned char* input, unsigned char* output, const unsigned char* schedule, int enc);
+int APS5_VABI DES_set_key_nid_postfix(const unsigned char* key, unsigned char* schedule);
+void APS5_VABI DES_set_odd_parity_nid_postfix(unsigned char* key);
+int APS5_VABI DTLSv1_client_method_nid_postfix(void);
+int APS5_VABI DTLSv1_server_method_nid_postfix(void);
+int APS5_VABI ECDH_compute_key_nid_postfix(void);
+int APS5_VABI ECDSA_sign_nid_postfix(void);
+int APS5_VABI ECDSA_size_nid_postfix(void);
+int APS5_VABI ECDSA_verify_nid_postfix(void);
+int APS5_VABI EC_GROUP_free_nid_postfix(void);
+int APS5_VABI EC_GROUP_get_degree_nid_postfix(void);
+int APS5_VABI EC_GROUP_new_by_curve_name_nid_postfix(void);
+int APS5_VABI EC_KEY_check_key_nid_postfix(void);
+int APS5_VABI EC_KEY_free_nid_postfix(void);
+int APS5_VABI EC_KEY_generate_key_nid_postfix(void);
+int APS5_VABI EC_KEY_get0_group_nid_postfix(void);
+int APS5_VABI EC_KEY_get0_private_key_nid_postfix(void);
+int APS5_VABI EC_KEY_get0_public_key_nid_postfix(void);
+int APS5_VABI EC_KEY_new_nid_postfix(void);
+int APS5_VABI EC_KEY_new_by_curve_name_nid_postfix(void);
+int APS5_VABI EC_KEY_set_group_nid_postfix(void);
+int APS5_VABI EC_KEY_set_private_key_nid_postfix(void);
+int APS5_VABI EC_KEY_set_public_key_nid_postfix(void);
+int APS5_VABI EC_POINT_free_nid_postfix(void);
+int APS5_VABI EC_POINT_mul_nid_postfix(void);
+int APS5_VABI EC_POINT_new_nid_postfix(void);
+int APS5_VABI EC_POINT_oct2point_nid_postfix(void);
+int APS5_VABI EC_POINT_point2oct_nid_postfix(void);
+int APS5_VABI ENGINE_by_id_nid_postfix(void);
+int APS5_VABI ENGINE_cleanup_nid_postfix(void);
+int APS5_VABI ENGINE_ctrl_nid_postfix(void);
+int APS5_VABI ENGINE_ctrl_cmd_nid_postfix(void);
+int APS5_VABI ENGINE_finish_nid_postfix(void);
+int APS5_VABI ENGINE_free_nid_postfix(void);
+int APS5_VABI ENGINE_get_first_nid_postfix(void);
+int APS5_VABI ENGINE_get_id_nid_postfix(void);
+int APS5_VABI ENGINE_get_next_nid_postfix(void);
+int APS5_VABI ENGINE_init_nid_postfix(void);
+int APS5_VABI ENGINE_load_builtin_engines_nid_postfix(void);
+int APS5_VABI ENGINE_load_private_key_nid_postfix(void);
+int APS5_VABI ENGINE_set_default_nid_postfix(void);
+void APS5_VABI ERR_clear_error_nid_postfix(void);
+int APS5_VABI ERR_error_string_nid_postfix(void);
+int APS5_VABI ERR_error_string_n_nid_postfix(void);
+int APS5_VABI ERR_free_strings_nid_postfix(void);
+std::uint64_t APS5_VABI ERR_get_error_nid_postfix(void);
+std::uint64_t APS5_VABI ERR_peek_error_nid_postfix(void);
+void APS5_VABI ERR_remove_thread_state_nid_postfix(const void* threadId);
+int APS5_VABI EVP_CIPHER_CTX_cleanup_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_ctrl_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_free_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_init_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_new_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_set_padding_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_block_size_nid_postfix(void);
+int APS5_VABI EVP_CipherFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_CipherInit_ex_nid_postfix(void);
+int APS5_VABI EVP_CipherUpdate_nid_postfix(void);
+int APS5_VABI EVP_DecryptFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_DecryptInit_ex_nid_postfix(void);
+int APS5_VABI EVP_DecryptUpdate_nid_postfix(void);
+int APS5_VABI EVP_Digest_nid_postfix(void);
+int APS5_VABI EVP_DigestFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_DigestInit_ex_nid_postfix(void);
+int APS5_VABI EVP_DigestUpdate_nid_postfix(void);
+int APS5_VABI EVP_DigestVerifyFinal_nid_postfix(void);
+int APS5_VABI EVP_DigestVerifyInit_nid_postfix(void);
+int APS5_VABI EVP_EncryptFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_EncryptInit_ex_nid_postfix(void);
+int APS5_VABI EVP_EncryptUpdate_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_cleanup_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_create_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_destroy_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_init_nid_postfix(void);
+int APS5_VABI EVP_MD_size_nid_postfix(void);
+int APS5_VABI EVP_PKEY_copy_parameters_nid_postfix(void);
+int APS5_VABI EVP_PKEY_free_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get1_EC_KEY_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get1_RSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_id_nid_postfix(void);
+int APS5_VABI EVP_PKEY_new_nid_postfix(void);
+int APS5_VABI EVP_PKEY_set1_RSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_type_nid_postfix(void);
+int APS5_VABI EVP_aes_128_cbc_nid_postfix(void);
+int APS5_VABI EVP_aes_128_cfb8_nid_postfix(void);
+int APS5_VABI EVP_aes_128_ctr_nid_postfix(void);
+int APS5_VABI EVP_aes_128_gcm_nid_postfix(void);
+int APS5_VABI EVP_aes_192_cbc_nid_postfix(void);
+int APS5_VABI EVP_aes_192_cfb8_nid_postfix(void);
+int APS5_VABI EVP_aes_192_ctr_nid_postfix(void);
+int APS5_VABI EVP_aes_192_gcm_nid_postfix(void);
+int APS5_VABI EVP_aes_256_cbc_nid_postfix(void);
+int APS5_VABI EVP_aes_256_cfb8_nid_postfix(void);
+int APS5_VABI EVP_aes_256_ctr_nid_postfix(void);
+int APS5_VABI EVP_aes_256_gcm_nid_postfix(void);
+int APS5_VABI EVP_cleanup_nid_postfix(void);
+int APS5_VABI EVP_md5_nid_postfix(void);
+int APS5_VABI EVP_sha256_nid_postfix(void);
+int APS5_VABI EVP_sha384_nid_postfix(void);
+int APS5_VABI EVP_sha512_nid_postfix(void);
+int APS5_VABI GENERAL_NAMES_free_nid_postfix(void);
+int APS5_VABI GENERAL_NAME_free_nid_postfix(void);
+int APS5_VABI HMAC_nid_postfix(void);
+int APS5_VABI HMAC_CTX_cleanup_nid_postfix(void);
+int APS5_VABI HMAC_CTX_init_nid_postfix(void);
+int APS5_VABI HMAC_Final_nid_postfix(void);
+int APS5_VABI HMAC_Init_nid_postfix(void);
+int APS5_VABI HMAC_Init_ex_nid_postfix(void);
+int APS5_VABI HMAC_Update_nid_postfix(void);
+int APS5_VABI OBJ_cleanup_nid_postfix(void);
+int APS5_VABI OBJ_create_nid_postfix(void);
+int APS5_VABI OBJ_nid2sn_nid_postfix(void);
+int APS5_VABI OBJ_obj2nid_nid_postfix(void);
+int APS5_VABI OBJ_sn2nid_nid_postfix(void);
+int APS5_VABI OCSP_BASICRESP_free_nid_postfix(void);
+int APS5_VABI OCSP_RESPONSE_free_nid_postfix(void);
+int APS5_VABI OCSP_basic_add1_cert_nid_postfix(void);
+int APS5_VABI OCSP_basic_verify_nid_postfix(void);
+const char* APS5_VABI OCSP_cert_status_str_nid_postfix(std::int64_t status);
+int APS5_VABI OCSP_check_validity_nid_postfix(void);
+const char* APS5_VABI OCSP_crl_reason_str_nid_postfix(std::int64_t reason);
+int APS5_VABI OCSP_resp_count_nid_postfix(void);
+int APS5_VABI OCSP_resp_get0_nid_postfix(void);
+int APS5_VABI OCSP_response_get1_basic_nid_postfix(void);
+int APS5_VABI OCSP_response_status_nid_postfix(void);
+const char* APS5_VABI OCSP_response_status_str_nid_postfix(std::int64_t status);
+int APS5_VABI OCSP_single_get0_status_nid_postfix(void);
+int APS5_VABI OPENSSL_add_all_algorithms_noconf_nid_postfix(void);
+int APS5_VABI OPENSSL_load_builtin_modules_nid_postfix(void);
+int APS5_VABI PEM_X509_INFO_read_bio_nid_postfix(void);
+int APS5_VABI PEM_read_RSAPrivateKey_nid_postfix(void);
+int APS5_VABI PEM_read_X509_nid_postfix(void);
+int APS5_VABI PEM_read_bio_PrivateKey_nid_postfix(void);
+int APS5_VABI PEM_read_bio_X509_nid_postfix(void);
+int APS5_VABI PEM_read_bio_X509_AUX_nid_postfix(void);
+int APS5_VABI PEM_write_bio_X509_nid_postfix(void);
+int APS5_VABI PKCS12_PBE_add_nid_postfix(void);
+int APS5_VABI PKCS12_free_nid_postfix(void);
+int APS5_VABI PKCS12_parse_nid_postfix(void);
+int APS5_VABI RSA_flags_nid_postfix(void);
+int APS5_VABI RSA_free_nid_postfix(void);
+int APS5_VABI RSA_generate_key_ex_nid_postfix(void);
+int APS5_VABI RSA_new_nid_postfix(void);
+int APS5_VABI RSA_padding_add_PKCS1_PSS_nid_postfix(void);
+int APS5_VABI RSA_private_decrypt_nid_postfix(void);
+int APS5_VABI RSA_private_encrypt_nid_postfix(void);
+int APS5_VABI RSA_public_decrypt_nid_postfix(void);
+int APS5_VABI RSA_public_encrypt_nid_postfix(void);
+int APS5_VABI RSA_sign_nid_postfix(void);
+int APS5_VABI RSA_size_nid_postfix(void);
+int APS5_VABI RSA_verify_nid_postfix(void);
+int APS5_VABI RSA_verify_PKCS1_PSS_nid_postfix(void);
+int APS5_VABI SSL_CIPHER_get_bits_nid_postfix(const void* cipher, std::int32_t* algorithmBits);
+const char* APS5_VABI SSL_CIPHER_get_name_nid_postfix(const void* cipher);
+char* APS5_VABI SSL_CIPHER_get_version_nid_postfix(const void* cipher);
+int APS5_VABI SSL_CTX_add_client_CA_nid_postfix(void);
+int APS5_VABI SSL_CTX_callback_ctrl_nid_postfix(void);
+int APS5_VABI SSL_CTX_check_private_key_nid_postfix(void);
+int APS5_VABI SSL_CTX_ctrl_nid_postfix(void);
+int APS5_VABI SSL_CTX_free_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_cert_store_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_ex_data_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_ex_new_index_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_verify_mode_nid_postfix(void);
+int APS5_VABI SSL_CTX_load_verify_locations_nid_postfix(void);
+int APS5_VABI SSL_CTX_load_verify_mem_nid_postfix(void);
+int APS5_VABI SSL_CTX_new_nid_postfix(void);
+int APS5_VABI SSL_CTX_sess_set_new_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set1_groups_list_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_alpn_protos_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_alpn_select_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_cert_store_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_cert_verify_callback_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_cipher_list_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_client_cert_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_default_passwd_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_default_passwd_cb_userdata_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_ex_data_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_info_callback_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_msg_callback_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_next_proto_select_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_quiet_shutdown_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_session_id_context_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_verify_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_PrivateKey_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_PrivateKey_ASN1_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_PrivateKey_file_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_ASN1_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_chain_file_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_file_nid_postfix(void);
+int APS5_VABI SSL_SESSION_free_nid_postfix(void);
+int APS5_VABI SSL_accept_nid_postfix(void);
+const char* APS5_VABI SSL_alert_desc_string_long_nid_postfix(int value);
+int APS5_VABI SSL_check_private_key_nid_postfix(void);
+int APS5_VABI SSL_connect_nid_postfix(void);
+int APS5_VABI SSL_ctrl_nid_postfix(void);
+int APS5_VABI SSL_free_nid_postfix(void);
+int APS5_VABI SSL_get0_alpn_selected_nid_postfix(void);
+int APS5_VABI SSL_get0_param_nid_postfix(void);
+int APS5_VABI SSL_get1_session_nid_postfix(void);
+int APS5_VABI SSL_get_SSL_CTX_nid_postfix(void);
+int APS5_VABI SSL_get_certificate_nid_postfix(void);
+int APS5_VABI SSL_get_current_cipher_nid_postfix(void);
+int APS5_VABI SSL_get_error_nid_postfix(void);
+int APS5_VABI SSL_get_ex_data_nid_postfix(void);
+int APS5_VABI SSL_get_ex_data_X509_STORE_CTX_idx_nid_postfix(void);
+int APS5_VABI SSL_get_ex_new_index_nid_postfix(void);
+int APS5_VABI SSL_get_fd_nid_postfix(void);
+int APS5_VABI SSL_get_peer_cert_chain_nid_postfix(void);
+int APS5_VABI SSL_get_peer_certificate_nid_postfix(void);
+int APS5_VABI SSL_get_privatekey_nid_postfix(void);
+int APS5_VABI SSL_get_rbio_nid_postfix(void);
+int APS5_VABI SSL_get_servername_nid_postfix(void);
+int APS5_VABI SSL_get_session_nid_postfix(void);
+int APS5_VABI SSL_get_shutdown_nid_postfix(void);
+int APS5_VABI SSL_get_verify_result_nid_postfix(void);
+int APS5_VABI SSL_get_wbio_nid_postfix(void);
+int APS5_VABI SSL_library_init_nid_postfix(void);
+int APS5_VABI SSL_load_error_strings_nid_postfix(void);
+int APS5_VABI SSL_new_nid_postfix(void);
+int APS5_VABI SSL_peek_nid_postfix(void);
+int APS5_VABI SSL_pending_nid_postfix(void);
+int APS5_VABI SSL_read_nid_postfix(void);
+int APS5_VABI SSL_select_next_proto_nid_postfix(void);
+int APS5_VABI SSL_set_SSL_CTX_nid_postfix(void);
+int APS5_VABI SSL_set_bio_nid_postfix(void);
+int APS5_VABI SSL_set_connect_state_nid_postfix(void);
+int APS5_VABI SSL_set_ex_data_nid_postfix(void);
+int APS5_VABI SSL_set_fd_nid_postfix(void);
+int APS5_VABI SSL_set_session_nid_postfix(void);
+int APS5_VABI SSL_set_verify_nid_postfix(void);
+int APS5_VABI SSL_shutdown_nid_postfix(void);
+int APS5_VABI SSL_use_PrivateKey_ASN1_nid_postfix(void);
+int APS5_VABI SSL_use_certificate_ASN1_nid_postfix(void);
+int APS5_VABI SSL_version_nid_postfix(void);
+int APS5_VABI SSL_want_nid_postfix(void);
+int APS5_VABI SSL_write_nid_postfix(void);
+std::uint64_t APS5_VABI SSLeay_nid_postfix(void);
+int APS5_VABI SSLv23_client_method_nid_postfix(void);
+int APS5_VABI SSLv23_server_method_nid_postfix(void);
+int APS5_VABI TLS_client_method_nid_postfix(void);
+int APS5_VABI UI_OpenSSL_nid_postfix(void);
+int APS5_VABI UI_create_method_nid_postfix(void);
+int APS5_VABI UI_destroy_method_nid_postfix(void);
+int APS5_VABI UI_get0_user_data_nid_postfix(void);
+int APS5_VABI UI_get_input_flags_nid_postfix(void);
+int APS5_VABI UI_get_string_type_nid_postfix(void);
+int APS5_VABI UI_method_get_closer_nid_postfix(void);
+int APS5_VABI UI_method_get_opener_nid_postfix(void);
+int APS5_VABI UI_method_get_reader_nid_postfix(void);
+int APS5_VABI UI_method_get_writer_nid_postfix(void);
+int APS5_VABI UI_method_set_closer_nid_postfix(void);
+int APS5_VABI UI_method_set_opener_nid_postfix(void);
+int APS5_VABI UI_method_set_reader_nid_postfix(void);
+int APS5_VABI UI_method_set_writer_nid_postfix(void);
+int APS5_VABI UI_set_result_nid_postfix(void);
+int APS5_VABI X509V3_EXT_print_nid_postfix(void);
+int APS5_VABI X509_EXTENSION_get_critical_nid_postfix(void);
+int APS5_VABI X509_EXTENSION_get_data_nid_postfix(void);
+int APS5_VABI X509_EXTENSION_get_object_nid_postfix(void);
+int APS5_VABI X509_INFO_free_nid_postfix(void);
+int APS5_VABI X509_LOOKUP_file_nid_postfix(void);
+int APS5_VABI X509_NAME_ENTRY_get_data_nid_postfix(void);
+int APS5_VABI X509_NAME_get_entry_nid_postfix(void);
+int APS5_VABI X509_NAME_get_index_by_NID_nid_postfix(void);
+int APS5_VABI X509_NAME_get_text_by_NID_nid_postfix(void);
+int APS5_VABI X509_NAME_oneline_nid_postfix(void);
+int APS5_VABI X509_NAME_print_ex_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get1_chain_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_chain_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_current_cert_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_error_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_error_depth_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_ex_data_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_set_error_nid_postfix(void);
+int APS5_VABI X509_STORE_add_cert_nid_postfix(void);
+int APS5_VABI X509_STORE_add_crl_nid_postfix(void);
+int APS5_VABI X509_STORE_add_lookup_nid_postfix(void);
+int APS5_VABI X509_STORE_free_nid_postfix(void);
+int APS5_VABI X509_STORE_new_nid_postfix(void);
+int APS5_VABI X509_STORE_set_flags_nid_postfix(void);
+int APS5_VABI X509_VERIFY_PARAM_set1_host_nid_postfix(void);
+int APS5_VABI X509_VERIFY_PARAM_set1_ip_asc_nid_postfix(void);
+int APS5_VABI X509_VERIFY_PARAM_set_hostflags_nid_postfix(void);
+int APS5_VABI X509_check_issued_nid_postfix(void);
+int APS5_VABI X509_free_nid_postfix(void);
+int APS5_VABI X509_get_ext_d2i_nid_postfix(void);
+int APS5_VABI X509_get_issuer_name_nid_postfix(void);
+int APS5_VABI X509_get_pubkey_nid_postfix(void);
+int APS5_VABI X509_get_serialNumber_nid_postfix(void);
+int APS5_VABI X509_get_subject_name_nid_postfix(void);
+int APS5_VABI X509_load_crl_file_nid_postfix(void);
+int APS5_VABI X509_print_ex_nid_postfix(void);
+int APS5_VABI X509_verify_cert_nid_postfix(void);
+const char* APS5_VABI X509_verify_cert_error_string_nid_postfix(std::int64_t error);
+int APS5_VABI d2i_OCSP_RESPONSE_nid_postfix(void);
+int APS5_VABI d2i_PKCS12_bio_nid_postfix(void);
+int APS5_VABI d2i_PKCS12_fp_nid_postfix(void);
+int APS5_VABI d2i_RSA_PUBKEY_nid_postfix(void);
+int APS5_VABI d2i_X509_nid_postfix(void);
+int APS5_VABI i2a_ASN1_OBJECT_nid_postfix(void);
+int APS5_VABI i2d_X509_PUBKEY_nid_postfix(void);
+int APS5_VABI i2t_ASN1_OBJECT_nid_postfix(void);
+int APS5_VABI sceLibreSslGetMemoryPoolStats(void);
+int APS5_VABI sceLibreSslInit(void);
+int APS5_VABI sceLibreSslInitEx(void);
+int APS5_VABI sceLibreSslInitEx2(void);
+int APS5_VABI sceLibreSslTerm(void);
+int APS5_VABI sk_num_nid_postfix(void);
+int APS5_VABI sk_pop_nid_postfix(void);
+int APS5_VABI sk_pop_free_nid_postfix(void);
+int APS5_VABI sk_value_nid_postfix(void);
+int APS5_VABI AES_set_encrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key);
+int APS5_VABI AES_set_decrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key);
+void APS5_VABI AES_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key);
+void APS5_VABI AES_decrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key);
+void APS5_VABI AES_ecb_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key, int encrypt);
+void APS5_VABI AES_cbc_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int encrypt);
+void APS5_VABI AES_cfb128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int* num, int encrypt);
+void APS5_VABI AES_ctr128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, unsigned char* ecountBuffer, unsigned* num);
+int APS5_VABI MD4_Init_nid_postfix(Md4Context* context);
+int APS5_VABI MD4_Update_nid_postfix(Md4Context* context, const void* data, std::size_t length);
+int APS5_VABI MD4_Final_nid_postfix(unsigned char* digest, Md4Context* context);
+int APS5_VABI MD5_Init_nid_postfix(Md5Context* context);
+int APS5_VABI MD5_Update_nid_postfix(Md5Context* context, const void* data, std::size_t length);
+int APS5_VABI MD5_Final_nid_postfix(unsigned char* digest, Md5Context* context);
+int APS5_VABI SHA1_Init_nid_postfix(Sha1Context* context);
+int APS5_VABI SHA1_Update_nid_postfix(Sha1Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA1_Final_nid_postfix(unsigned char* digest, Sha1Context* context);
+int APS5_VABI SHA224_Init_nid_postfix(Sha256Context* context);
+int APS5_VABI SHA256_Init_nid_postfix(Sha256Context* context);
+int APS5_VABI SHA256_Update_nid_postfix(Sha256Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA224_Update_nid_postfix(Sha256Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA256_Final_nid_postfix(unsigned char* digest, Sha256Context* context);
+int APS5_VABI SHA224_Final_nid_postfix(unsigned char* digest, Sha256Context* context);
+unsigned char* APS5_VABI SHA256_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest);
+int APS5_VABI SHA384_Init_nid_postfix(Sha512Context* context);
+int APS5_VABI SHA512_Init_nid_postfix(Sha512Context* context);
+int APS5_VABI SHA512_Update_nid_postfix(Sha512Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA384_Update_nid_postfix(Sha512Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA512_Final_nid_postfix(unsigned char* digest, Sha512Context* context);
+int APS5_VABI SHA384_Final_nid_postfix(unsigned char* digest, Sha512Context* context);
+void APS5_VABI RAND_add_nid_postfix(const void*, int, double);
+int APS5_VABI RAND_status_nid_postfix(void);
+int APS5_VABI RAND_bytes_nid_postfix(unsigned char* buffer, int count);
+int APS5_VABI RAND_load_file_nid_postfix(const char*, std::int64_t bytes);
+const char* APS5_VABI RAND_file_name_nid_postfix(char* buffer, std::size_t size);
+void* APS5_VABI CRYPTO_malloc_nid_postfix(int count, const char*, int);
+void APS5_VABI CRYPTO_free_nid_postfix(void* pointer);
+int APS5_VABI CRYPTO_set_mem_functions_nid_postfix(void*, void*, void*);
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/include/Error.hpp b/core/libs/prx/libSceLibreSsl/include/Error.hpp
new file mode 100644
index 0000000000..0c7a23712f
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/include/Error.hpp
@@ -0,0 +1,10 @@
+#ifndef CORE_LIBS_PRX_LIBSCELIBRESSL_INCLUDE_ERROR_HPP
+#define CORE_LIBS_PRX_LIBSCELIBRESSL_INCLUDE_ERROR_HPP
+
+extern "C" {
+
+void LibreSslPutError_nid_no_patch(int library, int function, int reason);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceLibreSsl/libSceLibreSsl.hpp b/core/libs/prx/libSceLibreSsl/libSceLibreSsl.hpp
new file mode 100644
index 0000000000..7b25337c40
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/libSceLibreSsl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLibreSsl/include/Api.hpp"
diff --git a/core/libs/prx/libSceLibreSsl/src/Aes.cpp b/core/libs/prx/libSceLibreSsl/src/Aes.cpp
new file mode 100644
index 0000000000..ddbdbe61db
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Aes.cpp
@@ -0,0 +1,288 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include "prx/libc/include/General.hpp"
+
+namespace {
+
+constexpr std::size_t BlockSize = 16;
+
+static_assert(sizeof(AesKey) == 244);
+
+constexpr std::uint8_t Multiply(std::uint8_t a, std::uint8_t b) {
+    std::uint8_t product = 0;
+    while (b) {
+        if (b & 1) product ^= a;
+        a = static_cast<std::uint8_t>((a << 1) ^ ((a & 0x80) ? 0x1b : 0));
+        b >>= 1;
+    }
+    return product;
+}
+
+constexpr std::array<std::uint8_t, 256> MakeSubstitution() {
+    std::array<std::uint8_t, 256> box {};
+    for (int value = 0; value < 256; ++value) {
+        const auto element = static_cast<std::uint8_t>(value);
+        std::uint8_t inverse = element;
+        for (int step = 0; step < 6; ++step) inverse = Multiply(Multiply(inverse, inverse), element);
+        inverse = Multiply(inverse, inverse);
+        std::uint8_t result = 0x63;
+        for (int shift = 0; shift < 5; ++shift)
+            result ^= static_cast<std::uint8_t>((inverse << shift) | (inverse >> ((8 - shift) & 7)));
+        box[value] = result;
+    }
+    return box;
+}
+
+constexpr std::array<std::uint8_t, 256> MakeInverse(const std::array<std::uint8_t, 256>& box) {
+    std::array<std::uint8_t, 256> inverse {};
+    for (int value = 0; value < 256; ++value) inverse[box[value]] = static_cast<std::uint8_t>(value);
+    return inverse;
+}
+
+constexpr auto Substitution = MakeSubstitution();
+constexpr auto InverseSubstitution = MakeInverse(Substitution);
+static_assert(Substitution[0x00] == 0x63 && Substitution[0x53] == 0xed && Substitution[0xff] == 0x16);
+
+std::uint32_t LoadBig32(const unsigned char* p) {
+    return std::uint32_t(p[0]) << 24 | std::uint32_t(p[1]) << 16 | std::uint32_t(p[2]) << 8 | std::uint32_t(p[3]);
+}
+
+void StoreBig32(unsigned char* p, std::uint32_t value) {
+    for (int i = 0; i < 4; ++i) p[i] = static_cast<unsigned char>(value >> (24 - 8 * i));
+}
+
+std::uint32_t SubstituteWord(std::uint32_t word) {
+    return std::uint32_t(Substitution[word >> 24]) << 24 | std::uint32_t(Substitution[(word >> 16) & 0xff]) << 16 |
+        std::uint32_t(Substitution[(word >> 8) & 0xff]) << 8 | Substitution[word & 0xff];
+}
+
+std::uint32_t InverseMixWord(std::uint32_t word) {
+    const std::uint8_t a[4] {std::uint8_t(word >> 24), std::uint8_t(word >> 16), std::uint8_t(word >> 8), std::uint8_t(word)};
+    std::uint32_t result = 0;
+    for (int row = 0; row < 4; ++row) {
+        const std::uint8_t value = Multiply(a[row], 14) ^ Multiply(a[(row + 1) % 4], 11) ^ Multiply(a[(row + 2) % 4], 13) ^ Multiply(a[(row + 3) % 4], 9);
+        result |= std::uint32_t(value) << (24 - 8 * row);
+    }
+    return result;
+}
+
+int RoundsForBits(int bits) {
+    if (bits == 128) return 10;
+    if (bits == 192) return 12;
+    if (bits == 256) return 14;
+    return 0;
+}
+
+void ExpandKey(const unsigned char* userKey, int bits, AesKey& key) {
+    const int words = bits / 32;
+    const int total = 4 * (key.rounds + 1);
+    auto* w = key.roundKeys;
+    for (int i = 0; i < words; ++i) w[i] = LoadBig32(userKey + 4 * i);
+    std::uint8_t roundConstant = 1;
+    for (int i = words; i < total; ++i) {
+        std::uint32_t temp = w[i - 1];
+        if (i % words == 0) {
+            temp = SubstituteWord(temp << 8 | temp >> 24) ^ (std::uint32_t(roundConstant) << 24);
+            roundConstant = Multiply(roundConstant, 2);
+        } else if (words > 6 && i % words == 4) {
+            temp = SubstituteWord(temp);
+        }
+        w[i] = w[i - words] ^ temp;
+    }
+}
+
+const AesKey& RequireKey(const AesKey* key, const char* function) {
+    if (!key) throw std::invalid_argument(std::string(function) + ": null key");
+    if (key->rounds != 10 && key->rounds != 12 && key->rounds != 14)
+        throw std::invalid_argument(std::string(function) + ": key schedule with " + std::to_string(key->rounds) + " rounds");
+    return *key;
+}
+
+void RequireBlocks(const void* in, const void* out, std::size_t length, const char* function) {
+    if (length && (!in || !out)) throw std::invalid_argument(std::string(function) + ": null input or output");
+}
+
+void LoadState(std::uint8_t (&state)[16], const unsigned char* in, const std::uint32_t* roundKey) {
+    for (int column = 0; column < 4; ++column)
+        for (int row = 0; row < 4; ++row)
+            state[4 * column + row] = in[4 * column + row] ^ std::uint8_t(roundKey[column] >> (24 - 8 * row));
+}
+
+void AddRoundKey(std::uint8_t (&state)[16], const std::uint32_t* roundKey) {
+    for (int column = 0; column < 4; ++column)
+        for (int row = 0; row < 4; ++row) state[4 * column + row] ^= std::uint8_t(roundKey[column] >> (24 - 8 * row));
+}
+
+void EncryptBlock(const unsigned char* in, unsigned char* out, const AesKey& key) {
+    std::uint8_t state[16];
+    LoadState(state, in, key.roundKeys);
+    for (int round = 1; round <= key.rounds; ++round) {
+        std::uint8_t shifted[16];
+        for (int column = 0; column < 4; ++column)
+            for (int row = 0; row < 4; ++row) shifted[4 * column + row] = Substitution[state[4 * ((column + row) % 4) + row]];
+        if (round != key.rounds) {
+            for (int column = 0; column < 4; ++column) {
+                const std::uint8_t* a = shifted + 4 * column;
+                const std::uint8_t mixed[4] {
+                    std::uint8_t(Multiply(a[0], 2) ^ Multiply(a[1], 3) ^ a[2] ^ a[3]),
+                    std::uint8_t(a[0] ^ Multiply(a[1], 2) ^ Multiply(a[2], 3) ^ a[3]),
+                    std::uint8_t(a[0] ^ a[1] ^ Multiply(a[2], 2) ^ Multiply(a[3], 3)),
+                    std::uint8_t(Multiply(a[0], 3) ^ a[1] ^ a[2] ^ Multiply(a[3], 2)),
+                };
+                std::memcpy(state + 4 * column, mixed, 4);
+            }
+        } else {
+            std::memcpy(state, shifted, sizeof(state));
+        }
+        AddRoundKey(state, key.roundKeys + 4 * round);
+    }
+    std::memcpy(out, state, sizeof(state));
+}
+
+void DecryptBlock(const unsigned char* in, unsigned char* out, const AesKey& key) {
+    std::uint8_t state[16];
+    LoadState(state, in, key.roundKeys);
+    for (int round = 1; round <= key.rounds; ++round) {
+        std::uint8_t shifted[16];
+        for (int column = 0; column < 4; ++column)
+            for (int row = 0; row < 4; ++row) shifted[4 * column + row] = InverseSubstitution[state[4 * ((column + 4 - row) % 4) + row]];
+        if (round != key.rounds) {
+            for (int column = 0; column < 4; ++column) {
+                const std::uint8_t* a = shifted + 4 * column;
+                const std::uint8_t mixed[4] {
+                    std::uint8_t(Multiply(a[0], 14) ^ Multiply(a[1], 11) ^ Multiply(a[2], 13) ^ Multiply(a[3], 9)),
+                    std::uint8_t(Multiply(a[0], 9) ^ Multiply(a[1], 14) ^ Multiply(a[2], 11) ^ Multiply(a[3], 13)),
+                    std::uint8_t(Multiply(a[0], 13) ^ Multiply(a[1], 9) ^ Multiply(a[2], 14) ^ Multiply(a[3], 11)),
+                    std::uint8_t(Multiply(a[0], 11) ^ Multiply(a[1], 13) ^ Multiply(a[2], 9) ^ Multiply(a[3], 14)),
+                };
+                std::memcpy(state + 4 * column, mixed, 4);
+            }
+        } else {
+            std::memcpy(state, shifted, sizeof(state));
+        }
+        AddRoundKey(state, key.roundKeys + 4 * round);
+    }
+    std::memcpy(out, state, sizeof(state));
+}
+
+unsigned RequirePosition(int position, const char* function) {
+    if (position < 0 || position >= static_cast<int>(BlockSize))
+        throw std::invalid_argument(std::string(function) + ": block position " + std::to_string(position) + " is outside 0-15");
+    return static_cast<unsigned>(position);
+}
+
+void IncrementCounter(unsigned char* counter) {
+    for (int i = 15; i >= 0; --i)
+        if (++counter[i]) return;
+}
+}
+
+extern "C" {
+
+int APS5_VABI AES_set_encrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key) {
+    if (!userKey || !key) return -1;
+    const int rounds = RoundsForBits(bits);
+    if (!rounds) return -2;
+    key->rounds = rounds;
+    ExpandKey(userKey, bits, *key);
+    return 0;
+}
+
+int APS5_VABI AES_set_decrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key) {
+    const int result = AES_set_encrypt_key_nid_postfix(userKey, bits, key);
+    if (result) return result;
+    auto* w = key->roundKeys;
+    for (int i = 0, j = 4 * key->rounds; i < j; i += 4, j -= 4)
+        for (int k = 0; k < 4; ++k) std::swap(w[i + k], w[j + k]);
+    for (int i = 4; i < 4 * key->rounds; ++i) w[i] = InverseMixWord(w[i]);
+    return 0;
+}
+
+void APS5_VABI AES_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, BlockSize, __func__);
+    EncryptBlock(in, out, k);
+}
+
+void APS5_VABI AES_decrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, BlockSize, __func__);
+    DecryptBlock(in, out, k);
+}
+
+void APS5_VABI AES_ecb_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key, int encrypt) {
+    if (encrypt == 1) AES_encrypt_nid_postfix(in, out, key);
+    else AES_decrypt_nid_postfix(in, out, key);
+}
+
+void APS5_VABI AES_cbc_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int encrypt) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, length, __func__);
+    if (!ivec) throw std::invalid_argument(std::string(__func__) + ": null iv");
+    std::uint8_t block[BlockSize];
+    if (encrypt) {
+        while (length) {
+            const std::size_t count = length < BlockSize ? length : BlockSize;
+            for (std::size_t n = 0; n < BlockSize; ++n) block[n] = n < count ? in[n] ^ ivec[n] : ivec[n];
+            EncryptBlock(block, out, k);
+            std::memcpy(ivec, out, BlockSize);
+            if (length <= BlockSize) break;
+            length -= BlockSize;
+            in += BlockSize;
+            out += BlockSize;
+        }
+        return;
+    }
+    while (length) {
+        const std::size_t count = length < BlockSize ? length : BlockSize;
+        std::uint8_t cipher[BlockSize];
+        std::memcpy(cipher, in, BlockSize);
+        DecryptBlock(cipher, block, k);
+        for (std::size_t n = 0; n < count; ++n) out[n] = block[n] ^ ivec[n];
+        std::memcpy(ivec, cipher, BlockSize);
+        if (length <= BlockSize) break;
+        length -= BlockSize;
+        in += BlockSize;
+        out += BlockSize;
+    }
+}
+
+void APS5_VABI AES_cfb128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int* num, int encrypt) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, length, __func__);
+    if (!ivec || !num) throw std::invalid_argument(std::string(__func__) + ": null iv or position");
+    unsigned n = RequirePosition(*num, __func__);
+    for (std::size_t i = 0; i < length; ++i) {
+        if (!n) EncryptBlock(ivec, ivec, k);
+        const auto c = in[i];
+        out[i] = ivec[n] ^ c;
+        ivec[n] = encrypt ? out[i] : c;
+        n = (n + 1) % BlockSize;
+    }
+    *num = static_cast<int>(n);
+}
+
+void APS5_VABI AES_ctr128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, unsigned char* ecountBuffer, unsigned* num) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, length, __func__);
+    if (!ivec || !ecountBuffer || !num) throw std::invalid_argument(std::string(__func__) + ": null counter, keystream or position");
+    if (*num >= BlockSize) throw std::invalid_argument(std::string(__func__) + ": block position " + std::to_string(*num) + " is outside 0-15");
+    unsigned n = *num;
+    for (std::size_t i = 0; i < length; ++i) {
+        if (!n) {
+            EncryptBlock(ivec, ecountBuffer, k);
+            IncrementCounter(ivec);
+        }
+        out[i] = in[i] ^ ecountBuffer[n];
+        n = (n + 1) % BlockSize;
+    }
+    *num = n;
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/src/Asn1.cpp b/core/libs/prx/libSceLibreSsl/src/Asn1.cpp
new file mode 100644
index 0000000000..409df8adac
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Asn1.cpp
@@ -0,0 +1,128 @@
+#include "prx/libSceLibreSsl/libSceLibreSsl.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/General.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <span>
+#include <vector>
+
+namespace {
+
+static_assert(sizeof(Asn1String) == 24);
+static_assert(offsetof(Asn1String, data) == 8);
+static_assert(offsetof(Asn1String, flags) == 16);
+
+int CharacterWidth(int type) {
+    switch (type) {
+    case 12: return 0;
+    case 19:
+    case 20:
+    case 22:
+    case 23:
+    case 24:
+    case 26: return 1;
+    case 28: return 4;
+    case 30: return 2;
+    default: return -1;
+    }
+}
+
+bool ReadCharacter(std::span<const unsigned char>& input, int width, std::uint32_t& value) {
+    value = 0;
+    if (width != 0) {
+        if (input.size() < static_cast<std::size_t>(width)) return false;
+        for (int index = 0; index < width; ++index) value = (value << 8) | input[index];
+        input = input.subspan(width);
+    } else {
+        const unsigned char lead = input.front();
+        const int bytes = lead < 0x80 ? 1 : lead >= 0xc2 && lead <= 0xdf ? 2
+            : lead >= 0xe0 && lead <= 0xef ? 3 : lead >= 0xf0 && lead <= 0xf4 ? 4 : 0;
+        if (bytes == 0 || input.size() < static_cast<std::size_t>(bytes)) return false;
+        value = lead & (0x7f >> (bytes == 1 ? 0 : bytes));
+        for (int index = 1; index < bytes; ++index) {
+            if ((input[index] & 0xc0) != 0x80) return false;
+            value = (value << 6) | (input[index] & 0x3f);
+        }
+        constexpr std::uint32_t minimum[] = {0, 0, 0x80, 0x800, 0x10000};
+        if (value < minimum[bytes]) return false;
+        input = input.subspan(bytes);
+    }
+    return value <= 0x10ffff && (value < 0xd800 || value > 0xdfff);
+}
+
+void AppendCharacter(std::vector<unsigned char>& output, std::uint32_t value) {
+    const int bytes = value < 0x80 ? 1 : value < 0x800 ? 2 : value < 0x10000 ? 3 : 4;
+    if (output.size() >= static_cast<std::size_t>(std::numeric_limits<int>::max() - bytes))
+        NotImplemented_nid_no_patch("ASN1_STRING_to_UTF8: output length overflow");
+    if (bytes == 1) {
+        output.push_back(static_cast<unsigned char>(value));
+        return;
+    }
+    constexpr unsigned char prefix[] = {0, 0, 0xc0, 0xe0, 0xf0};
+    output.push_back(static_cast<unsigned char>(prefix[bytes] | (value >> (6 * (bytes - 1)))));
+    for (int index = bytes - 2; index >= 0; --index)
+        output.push_back(static_cast<unsigned char>(0x80 | ((value >> (6 * index)) & 0x3f)));
+}
+
+} // namespace
+
+extern "C" {
+
+std::int64_t APS5_VABI ASN1_INTEGER_get_nid_postfix(const Asn1String* value) {
+    if (!value) return 0;
+    const auto& integer = *value;
+    if (integer.type != 2 && integer.type != 0x102) return -1;
+    if (integer.length > 8) return -1;
+    if (integer.length <= 0 || !integer.data) return 0;
+    std::uint64_t magnitude = 0;
+    for (int index = 0; index < integer.length; ++index) magnitude = (magnitude << 8) | integer.data[index];
+    const bool negative = integer.type == 0x102;
+    const auto limit = static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max()) + negative;
+    if (magnitude > limit)
+        NotImplemented_nid_no_patch(__func__);
+    if (negative && magnitude != 0) return -static_cast<std::int64_t>(magnitude - 1) - 1;
+    return static_cast<std::int64_t>(magnitude);
+}
+
+unsigned char* APS5_VABI ASN1_STRING_data_nid_postfix(Asn1String* value) {
+    if (!value) APS5_INVALID_ARG_EX;
+    return value->data;
+}
+
+int APS5_VABI ASN1_STRING_length_nid_postfix(const Asn1String* value) {
+    if (!value) APS5_INVALID_ARG_EX;
+    return value->length;
+}
+
+int APS5_VABI ASN1_STRING_type_nid_postfix(Asn1String* value) {
+    if (!value) APS5_INVALID_ARG_EX;
+    return value->type;
+}
+
+int APS5_VABI ASN1_STRING_to_UTF8_nid_postfix(unsigned char** output, Asn1String* value) {
+    if (!value) return -1;
+    const auto& string = *value;
+    const int width = CharacterWidth(string.type);
+    if (width < 0) return -1;
+    if (!output || (!string.data && string.length != 0)) NotImplemented_nid_no_patch(__func__);
+    std::size_t length = string.length < 0 ? std::strlen(reinterpret_cast<const char*>(string.data))
+        : static_cast<std::size_t>(string.length);
+    if (length > static_cast<std::size_t>(std::numeric_limits<int>::max())) NotImplemented_nid_no_patch(__func__);
+    std::span<const unsigned char> input(string.data, length);
+    std::vector<unsigned char> converted;
+    while (!input.empty()) {
+        std::uint32_t character;
+        if (!ReadCharacter(input, width, character)) NotImplemented_nid_no_patch(__func__);
+        AppendCharacter(converted, character);
+    }
+    auto* result = static_cast<unsigned char*>(malloc_nid_postfix(converted.size() + 1));
+    if (!result) NotImplemented_nid_no_patch(__func__);
+    if (!converted.empty()) std::memcpy(result, converted.data(), converted.size());
+    result[converted.size()] = 0;
+    *output = result;
+    return static_cast<int>(converted.size());
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/src/Cipher.cpp b/core/libs/prx/libSceLibreSsl/src/Cipher.cpp
new file mode 100644
index 0000000000..bf213e3cbd
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Cipher.cpp
@@ -0,0 +1,60 @@
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include "prx/libSceLibreSsl/libSceLibreSsl.hpp"
+
+namespace {
+
+struct Cipher {
+    std::int32_t valid;
+    const char* name;
+    std::uint64_t id;
+    std::uint64_t keyExchange;
+    std::uint64_t authentication;
+    std::uint64_t encryption;
+    std::uint64_t mac;
+    std::uint64_t protocol;
+    std::uint64_t strengthFlags;
+    std::uint64_t extraFlags;
+    std::int32_t strengthBits;
+    std::int32_t algorithmBits;
+};
+
+static_assert(sizeof(Cipher) == 88);
+static_assert(offsetof(Cipher, name) == 8);
+static_assert(offsetof(Cipher, id) == 16);
+static_assert(offsetof(Cipher, strengthBits) == 80);
+static_assert(offsetof(Cipher, algorithmBits) == 84);
+
+} // namespace
+
+extern "C" {
+
+int APS5_VABI SSL_CIPHER_get_bits_nid_postfix(const void* cipher, std::int32_t* algorithmBits) {
+    if (!cipher) return 0;
+    const auto* bytes = static_cast<const std::byte*>(cipher);
+    if (algorithmBits) {
+        std::int32_t bits;
+        std::memcpy(&bits, bytes + offsetof(Cipher, algorithmBits), sizeof(bits));
+        *algorithmBits = bits;
+    }
+    std::int32_t strength;
+    std::memcpy(&strength, bytes + offsetof(Cipher, strengthBits), sizeof(strength));
+    return strength;
+}
+
+const char* APS5_VABI SSL_CIPHER_get_name_nid_postfix(const void* cipher) {
+    if (!cipher) return "(NONE)";
+    const char* name;
+    std::memcpy(&name, static_cast<const std::byte*>(cipher) + offsetof(Cipher, name), sizeof(name));
+    return name;
+}
+
+char* APS5_VABI SSL_CIPHER_get_version_nid_postfix(const void* cipher) {
+    if (!cipher) return const_cast<char*>("(NONE)");
+    std::uint64_t id;
+    std::memcpy(&id, static_cast<const std::byte*>(cipher) + offsetof(Cipher, id), sizeof(id));
+    return const_cast<char*>((id >> 24) == 3 ? "TLSv1/SSLv3" : "unknown");
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/src/Digest.cpp b/core/libs/prx/libSceLibreSsl/src/Digest.cpp
index e58974597e..521c9dbaa6 100644
--- a/core/libs/prx/libSceLibreSsl/src/Digest.cpp
+++ b/core/libs/prx/libSceLibreSsl/src/Digest.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
 #include <bit>
 #include <cstddef>
 #include <cstdint>
@@ -7,40 +8,6 @@
 #include "prx/libc/include/General.hpp"
 
 namespace {
-struct Md4Context {
-    std::uint32_t A, B, C, D;
-    std::uint32_t Nl, Nh;
-    std::uint32_t data[16];
-    std::uint32_t num;
-};
-
-struct Md5Context {
-    std::uint32_t A, B, C, D;
-    std::uint32_t Nl, Nh;
-    std::uint32_t data[16];
-    std::uint32_t num;
-};
-
-struct Sha1Context {
-    std::uint32_t h[5];
-    std::uint32_t Nl, Nh;
-    std::uint32_t data[16];
-    std::uint32_t num;
-};
-
-struct Sha256Context {
-    std::uint32_t h[8];
-    std::uint32_t Nl, Nh;
-    std::uint32_t data[16];
-    std::uint32_t num, mdLength;
-};
-
-struct Sha512Context {
-    std::uint64_t h[8];
-    std::uint64_t Nl, Nh;
-    std::uint64_t data[16];
-    std::uint32_t num, mdLength;
-};
 
 static_assert(sizeof(Md4Context) == 92);
 static_assert(sizeof(Md5Context) == 92);
@@ -340,8 +307,6 @@ int Sha512Final(unsigned char* digest, Sha512Context& c) {
     StoreBig64(buffer + 120, c.Nl);
     Sha512Block(c, buffer);
     if (!digest) return 0;
-    if (c.mdLength == Sha224Length || c.mdLength == Sha256Length)
-        NotImplemented_nid_no_patch("SHA512_Final: SHA-512/224 and SHA-512/256 digest lengths");
     if (c.mdLength != Sha384Length && c.mdLength != Sha512Length) return 0;
     for (std::size_t i = 0; i < c.mdLength / 8; ++i) StoreBig64(digest + 8 * i, c.h[i]);
     return 1;
@@ -490,10 +455,12 @@ int APS5_VABI SHA224_Final_nid_postfix(unsigned char* digest, Sha256Context* con
 }
 
 unsigned char* APS5_VABI SHA256_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest) {
+    static unsigned char buffer[Sha256Length];
     RequireInput(data, length, __func__);
-    if (!digest) NotImplemented_nid_no_patch("SHA256: null digest buffer");
+    if (!digest) digest = buffer;
     Sha256Context c;
     SHA256_Init_nid_postfix(&c);
+
     if (length) Update32(c, data, length, Sha256Block);
     Sha256Final(digest, c, __func__);
     return digest;
diff --git a/core/libs/prx/libSceLibreSsl/src/Error.cpp b/core/libs/prx/libSceLibreSsl/src/Error.cpp
new file mode 100644
index 0000000000..bad0374dbb
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Error.cpp
@@ -0,0 +1,64 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <array>
+#include <cstdint>
+#include <type_traits>
+#include "prx/libSceLibreSsl/include/Error.hpp"
+#include "prx/libc/include/General.hpp"
+
+namespace {
+constexpr int QueueSize = 16;
+
+struct ErrorQueue {
+    std::array<std::uint64_t, QueueSize> codes;
+    int top;
+    int bottom;
+};
+
+static_assert(std::is_trivially_destructible_v<ErrorQueue>);
+
+thread_local ErrorQueue queue{};
+
+std::uint64_t Oldest(bool remove) {
+    if (queue.bottom == queue.top) return 0;
+    const int index = (queue.bottom + 1) % QueueSize;
+    const std::uint64_t code = queue.codes[index];
+    if (remove) {
+        queue.bottom = index;
+        queue.codes[index] = 0;
+    }
+    return code;
+}
+
+void Clear() {
+    queue = {};
+}
+}
+
+extern "C" {
+
+void LibreSslPutError_nid_no_patch(int library, int function, int reason) {
+    queue.top = (queue.top + 1) % QueueSize;
+    if (queue.top == queue.bottom) queue.bottom = (queue.bottom + 1) % QueueSize;
+    queue.codes[queue.top] = (static_cast<std::uint64_t>(library) & 0xff) << 24 |
+                             (static_cast<std::uint64_t>(function) & 0xfff) << 12 |
+                             (static_cast<std::uint64_t>(reason) & 0xfff);
+}
+
+std::uint64_t APS5_VABI ERR_get_error_nid_postfix() {
+    return Oldest(true);
+}
+
+std::uint64_t APS5_VABI ERR_peek_error_nid_postfix() {
+    return Oldest(false);
+}
+
+void APS5_VABI ERR_clear_error_nid_postfix() {
+    Clear();
+}
+
+void APS5_VABI ERR_remove_thread_state_nid_postfix(const void* threadId) {
+    if (threadId != nullptr) NotImplemented_nid_no_patch("ERR_remove_thread_state of a CRYPTO_THREADID");
+    Clear();
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/src/Ocsp.cpp b/core/libs/prx/libSceLibreSsl/src/Ocsp.cpp
new file mode 100644
index 0000000000..e64c504978
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Ocsp.cpp
@@ -0,0 +1,57 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+
+namespace {
+struct OcspString {
+    std::int64_t code;
+    const char* text;
+};
+
+template <std::size_t Count>
+const char* TableToString(std::int64_t code, const OcspString (&table)[Count]) {
+    for (const auto& entry : table) {
+        if (entry.code == code) return entry.text;
+    }
+    return "(UNKNOWN)";
+}
+}
+
+extern "C" {
+
+const char* APS5_VABI OCSP_response_status_str_nid_postfix(std::int64_t status) {
+    static constexpr OcspString table[] {
+        {0, "successful"},
+        {1, "malformedrequest"},
+        {2, "internalerror"},
+        {3, "trylater"},
+        {5, "sigrequired"},
+        {6, "unauthorized"},
+    };
+    return TableToString(status, table);
+}
+
+const char* APS5_VABI OCSP_cert_status_str_nid_postfix(std::int64_t status) {
+    static constexpr OcspString table[] {
+        {0, "good"},
+        {1, "revoked"},
+        {2, "unknown"},
+    };
+    return TableToString(status, table);
+}
+
+const char* APS5_VABI OCSP_crl_reason_str_nid_postfix(std::int64_t reason) {
+    static constexpr OcspString table[] {
+        {0, "unspecified"},
+        {1, "keyCompromise"},
+        {2, "cACompromise"},
+        {3, "affiliationChanged"},
+        {4, "superseded"},
+        {5, "cessationOfOperation"},
+        {6, "certificateHold"},
+        {8, "removeFromCRL"},
+    };
+    return TableToString(reason, table);
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/src/Runtime.cpp b/core/libs/prx/libSceLibreSsl/src/Runtime.cpp
new file mode 100644
index 0000000000..b3ea2389a0
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Runtime.cpp
@@ -0,0 +1,57 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include "prx/libc/include/General.hpp"
+#include "prx/libc/include/HostEntropy.hpp"
+
+extern "C" {
+
+void APS5_VABI RAND_add_nid_postfix(const void*, int, double) {
+}
+
+int APS5_VABI RAND_status_nid_postfix(void) {
+    return 1;
+}
+
+int APS5_VABI RAND_bytes_nid_postfix(unsigned char* buffer, int count) {
+    if (count > 0) {
+        if (!buffer) throw std::invalid_argument(std::string(__func__) + ": null buffer");
+        HostEntropy_nid_no_patch(buffer, static_cast<std::size_t>(count));
+    }
+    return 1;
+}
+
+int APS5_VABI RAND_load_file_nid_postfix(const char*, std::int64_t bytes) {
+    return bytes == -1 ? 123456 : static_cast<int>(bytes);
+}
+
+const char* APS5_VABI RAND_file_name_nid_postfix(char* buffer, std::size_t size) {
+    static constexpr char path[] = "/dev/urandom";
+    if (size) {
+        if (!buffer) throw std::invalid_argument(std::string(__func__) + ": null buffer");
+        const std::size_t copied = size - 1 < sizeof(path) - 1 ? size - 1 : sizeof(path) - 1;
+        std::memcpy(buffer, path, copied);
+        buffer[copied] = '\0';
+    }
+    return sizeof(path) - 1 >= size ? nullptr : buffer;
+}
+
+void* APS5_VABI CRYPTO_malloc_nid_postfix(int count, const char*, int) {
+    if (count <= 0) return nullptr;
+    return malloc_nid_postfix(static_cast<std::size_t>(count));
+}
+
+void APS5_VABI CRYPTO_free_nid_postfix(void* pointer) {
+    free_nid_postfix(pointer);
+
+}
+
+int APS5_VABI CRYPTO_set_mem_functions_nid_postfix(void*, void*, void*) {
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/tests/Asn1.cpp b/core/libs/prx/libSceLibreSsl/tests/Asn1.cpp
new file mode 100644
index 0000000000..e99142e9ad
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/tests/Asn1.cpp
@@ -0,0 +1,231 @@
+#include "prx/libSceLibreSsl/libSceLibreSsl.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <limits>
+#include <span>
+#include <stdexcept>
+#include <vector>
+
+namespace {
+
+static_assert(sizeof(Asn1String) == 24);
+static_assert(offsetof(Asn1String, data) == 8);
+static_assert(offsetof(Asn1String, flags) == 16);
+
+void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "failed: %s\n", message);
+    std::abort();
+}
+
+template<typename TAction>
+void RequireThrows(TAction action, const char* message) {
+    try {
+        action();
+    } catch (const std::exception&) {
+        return;
+    }
+    Require(false, message);
+}
+
+template<typename TAction>
+void RequireInvalidArgument(TAction action, const char* message) {
+    try {
+        action();
+    } catch (const std::invalid_argument&) {
+        return;
+    }
+    Require(false, message);
+}
+
+void CheckConversion(int type, std::span<const unsigned char> input, std::span<const unsigned char> expected, int length = -2) {
+    std::vector<unsigned char> storage(input.begin(), input.end());
+    storage.push_back(0);
+    Asn1String value{length == -2 ? static_cast<int>(input.size()) : length, type, storage.data(), 0x123456789abcdef};
+    const Asn1String original = value;
+    unsigned char sentinel = 0xab;
+    unsigned char* result = &sentinel;
+    Require(ASN1_STRING_to_UTF8_nid_postfix(&result, &value) == static_cast<int>(expected.size()), "UTF-8 byte length");
+    Require(result && result != &sentinel && result != storage.data(), "conversion owns a new buffer");
+    Require(expected.empty() || std::memcmp(result, expected.data(), expected.size()) == 0, "converted UTF-8 bytes");
+    Require(result[expected.size()] == 0, "conversion terminator");
+    Require(value.length == original.length && value.type == original.type && value.data == original.data
+        && value.flags == original.flags, "conversion preserves the input object");
+    Require(std::equal(input.begin(), input.end(), storage.begin()), "conversion preserves the input bytes");
+    free_nid_postfix(result);
+}
+
+void Accessors() {
+    unsigned char data[] = {'a', 0, 'b'};
+    Asn1String value{3, 12, data, std::numeric_limits<std::int64_t>::max()};
+    Require(ASN1_STRING_data_nid_postfix(&value) == data, "data accessor preserves pointer identity");
+    ASN1_STRING_data_nid_postfix(&value)[2] = 'c';
+    Require(data[2] == 'c', "data accessor permits writes");
+    Require(ASN1_STRING_length_nid_postfix(&value) == 3, "length includes embedded NUL");
+    Require(ASN1_STRING_type_nid_postfix(&value) == 12, "type accessor");
+    value = {-9, 0x7fffffff, nullptr, -1};
+    Require(ASN1_STRING_data_nid_postfix(&value) == nullptr, "null data is preserved");
+    Require(ASN1_STRING_length_nid_postfix(&value) == -9, "length is returned without normalization");
+    Require(ASN1_STRING_type_nid_postfix(&value) == 0x7fffffff, "type is returned without normalization");
+    RequireInvalidArgument([] { ASN1_STRING_data_nid_postfix(nullptr); }, "null data accessor input");
+    RequireInvalidArgument([] { ASN1_STRING_length_nid_postfix(nullptr); }, "null length accessor input");
+    RequireInvalidArgument([] { ASN1_STRING_type_nid_postfix(nullptr); }, "null type accessor input");
+}
+
+void Integers() {
+    Require(ASN1_INTEGER_get_nid_postfix(nullptr) == 0, "null integer");
+    unsigned char data[] = {0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0};
+    constexpr std::array<std::int64_t, 9> expected{
+        0, 0x01, 0x0123, 0x012345, 0x01234567, 0x0123456789, 0x0123456789ab,
+        0x0123456789abcd, 0x0123456789abcdef};
+    for (int length = 0; length <= 8; ++length) {
+        Asn1String value{length, 2, data, -1};
+        Require(ASN1_INTEGER_get_nid_postfix(&value) == expected[length], "positive integer and 64-bit guest long");
+        value.type = 0x102;
+        Require(ASN1_INTEGER_get_nid_postfix(&value) == -expected[length], "negative integer magnitude");
+    }
+    Asn1String value{9, 2, nullptr, 0};
+    Require(ASN1_INTEGER_get_nid_postfix(&value) == -1, "overlength is rejected before null data");
+    value.length = 8;
+    Require(ASN1_INTEGER_get_nid_postfix(&value) == 0, "integer with null data");
+    for (int length : {std::numeric_limits<std::int32_t>::min(), -8, -1, 0}) {
+        for (int type : {2, 0x102}) {
+            for (auto* bytes : {data, static_cast<unsigned char*>(nullptr), reinterpret_cast<unsigned char*>(1)}) {
+                value = {length, type, bytes, -1};
+                const Asn1String original = value;
+                Require(ASN1_INTEGER_get_nid_postfix(&value) == 0, "LibreSSL 2.5.4 nonpositive integer length");
+                Require(value.length == original.length && value.type == original.type && value.data == original.data
+                    && value.flags == original.flags, "nonpositive integer length preserves input");
+            }
+        }
+    }
+    value = {-1, 2, data, 0};
+    for (int type : {-1, 0, 1, 3, 12, 0x100, 0x202, 0x302}) {
+        value.type = type;
+        Require(ASN1_INTEGER_get_nid_postfix(&value) == -1, "only integer types are accepted");
+    }
+    std::array<unsigned char, 8> maximum{0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+    value = {8, 2, maximum.data(), 0};
+    Require(ASN1_INTEGER_get_nid_postfix(&value) == std::numeric_limits<std::int64_t>::max(), "maximum signed integer");
+    value.type = 0x102;
+    Require(ASN1_INTEGER_get_nid_postfix(&value) == -std::numeric_limits<std::int64_t>::max(), "negative maximum magnitude");
+    std::array<unsigned char, 8> minimum{0x80, 0, 0, 0, 0, 0, 0, 0};
+    value = {8, 0x102, minimum.data(), -1};
+    const Asn1String original = value;
+    Require(ASN1_INTEGER_get_nid_postfix(&value) == std::numeric_limits<std::int64_t>::min(), "minimum signed integer");
+    Require(value.length == original.length && value.type == original.type && value.data == original.data
+        && value.flags == original.flags && minimum == std::array<unsigned char, 8>{0x80, 0, 0, 0, 0, 0, 0, 0}, "minimum integer preserves input");
+    value.type = 2;
+    RequireThrows([&] { ASN1_INTEGER_get_nid_postfix(&value); }, "positive magnitude above signed maximum");
+    value.type = 0x102;
+    minimum.back() = 1;
+    RequireThrows([&] { ASN1_INTEGER_get_nid_postfix(&value); }, "negative magnitude below signed minimum");
+    value.data = maximum.data();
+    maximum[0] = 0x80;
+    for (int type : {2, 0x102}) {
+        value.type = type;
+        RequireThrows([&] { ASN1_INTEGER_get_nid_postfix(&value); }, "source signed-overflow path throws");
+    }
+    std::array<unsigned char, 9> zero{};
+    value = {9, 2, zero.data(), 0};
+    Require(ASN1_INTEGER_get_nid_postfix(&value) == -1, "overlength leading zeros are not trimmed");
+}
+
+void Strings() {
+    constexpr unsigned char latin[] = {0, 0x41, 0x7f, 0x80, 0xa3, 0xff};
+    constexpr unsigned char latinUtf8[] = {0, 0x41, 0x7f, 0xc2, 0x80, 0xc2, 0xa3, 0xc3, 0xbf};
+    constexpr unsigned char bmp[] = {0, 0, 0, 0x7f, 0, 0x80, 7, 0xff, 8, 0, 0x20, 0xac, 0xd7, 0xff, 0xe0, 0, 0xff, 0xff};
+    constexpr unsigned char bmpUtf8[] = {0, 0x7f, 0xc2, 0x80, 0xdf, 0xbf, 0xe0, 0xa0, 0x80, 0xe2, 0x82, 0xac,
+        0xed, 0x9f, 0xbf, 0xee, 0x80, 0x80, 0xef, 0xbf, 0xbf};
+    constexpr unsigned char universal[] = {0, 0, 0, 0x41, 0, 1, 0, 0, 0, 1, 0xf6, 0, 0, 0x10, 0xff, 0xff};
+    constexpr unsigned char universalUtf8[] = {0x41, 0xf0, 0x90, 0x80, 0x80, 0xf0, 0x9f, 0x98, 0x80, 0xf4, 0x8f, 0xbf, 0xbf};
+    for (int type : {19, 20, 22, 23, 24, 26}) CheckConversion(type, latin, latinUtf8);
+    CheckConversion(30, bmp, bmpUtf8);
+    CheckConversion(28, universal, universalUtf8);
+    CheckConversion(12, bmpUtf8, bmpUtf8);
+    CheckConversion(12, universalUtf8, universalUtf8);
+    for (int type : {12, 19, 20, 22, 23, 24, 26, 28, 30}) {
+        CheckConversion(type, {}, {});
+        Asn1String empty{0, type, nullptr, 0};
+        unsigned char* result = nullptr;
+        Require(ASN1_STRING_to_UTF8_nid_postfix(&result, &empty) == 0 && result && *result == 0, "empty null-data string");
+        free_nid_postfix(result);
+    }
+    constexpr unsigned char terminated[] = {'A', 0xc2, 0xa3, 0, 'X'};
+    CheckConversion(12, terminated, std::span(terminated).first(3), -1);
+    CheckConversion(12, terminated, std::span(terminated).first(3), -7);
+    constexpr unsigned char ascii[] = {'A', 'B', 'C'};
+    CheckConversion(19, ascii, ascii, -1);
+
+    unsigned char sentinel = 0xab;
+    unsigned char* result = &sentinel;
+    Require(ASN1_STRING_to_UTF8_nid_postfix(&result, nullptr) == -1 && result == &sentinel, "null conversion input");
+    Require(ASN1_STRING_to_UTF8_nid_postfix(nullptr, nullptr) == -1, "null input checked before output");
+    for (int type = -1; type <= 32; ++type) {
+        if (type == 12 || type == 19 || type == 20 || type == 22 || type == 23 || type == 24 || type == 26 || type == 28 || type == 30) continue;
+        Asn1String value{0, type, nullptr, 0};
+        Require(ASN1_STRING_to_UTF8_nid_postfix(&result, &value) == -1 && result == &sentinel, "unsupported string tag");
+        Require(ASN1_STRING_to_UTF8_nid_postfix(nullptr, &value) == -1, "tag checked before output");
+    }
+    Asn1String value{0, 12, nullptr, 0};
+    RequireThrows([&] { ASN1_STRING_to_UTF8_nid_postfix(nullptr, &value); }, "null conversion output");
+    value.length = 1;
+    RequireThrows([&] { ASN1_STRING_to_UTF8_nid_postfix(&result, &value); }, "null nonempty string data");
+    value.length = -1;
+    RequireThrows([&] { ASN1_STRING_to_UTF8_nid_postfix(&result, &value); }, "null terminated-string data");
+}
+
+std::size_t lastAllocationSize = 0;
+int allocationCount = 0;
+int freeCount = 0;
+
+void* APS5_VABI Allocate_nid_no_patch(std::size_t size) {
+    lastAllocationSize = size;
+    ++allocationCount;
+    return std::malloc(size);
+}
+
+void APS5_VABI Free_nid_no_patch(void* pointer) {
+    ++freeCount;
+    std::free(pointer);
+}
+
+void* APS5_VABI Calloc_nid_no_patch(std::size_t, std::size_t) { throw std::runtime_error("unexpected calloc"); }
+void* APS5_VABI Reallocate_nid_no_patch(void*, std::size_t) { throw std::runtime_error("unexpected realloc"); }
+void* APS5_VABI Align_nid_no_patch(std::size_t, std::size_t) { throw std::runtime_error("unexpected aligned allocation"); }
+void* APS5_VABI Realign_nid_no_patch(void*, std::size_t, std::size_t) { throw std::runtime_error("unexpected aligned reallocation"); }
+int APS5_VABI PosixAlign_nid_no_patch(void**, std::size_t, std::size_t) { throw std::runtime_error("unexpected posix_memalign"); }
+
+void Allocator() {
+    std::array<void*, 10> api{
+        reinterpret_cast<void*>(Allocate_nid_no_patch), reinterpret_cast<void*>(Free_nid_no_patch), reinterpret_cast<void*>(Calloc_nid_no_patch),
+        reinterpret_cast<void*>(Reallocate_nid_no_patch), reinterpret_cast<void*>(Align_nid_no_patch), reinterpret_cast<void*>(Realign_nid_no_patch),
+        reinterpret_cast<void*>(PosixAlign_nid_no_patch)};
+    ApplicationHeapRegister_nid_no_patch(api.data());
+    constexpr unsigned char input[] = {0xff};
+    constexpr unsigned char expected[] = {0xc3, 0xbf};
+    CheckConversion(20, input, expected);
+    Require(allocationCount == 1 && lastAllocationSize == 3 && freeCount == 1, "conversion uses the application allocator");
+}
+
+} // namespace
+
+int main(int argc, char**) {
+    if (argc > 1) {
+        Allocator();
+        return 0;
+    }
+    std::array<void*, 10> api{};
+    ApplicationHeapRegister_nid_no_patch(api.data());
+    Accessors();
+    Integers();
+    Strings();
+}
diff --git a/core/libs/prx/libSceLibreSsl3/Export.cpp b/core/libs/prx/libSceLibreSsl3/Export.cpp
index 623b05d144..dfd0b1b483 100644
--- a/core/libs/prx/libSceLibreSsl3/Export.cpp
+++ b/core/libs/prx/libSceLibreSsl3/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceLibreSsl3/include/Api.hpp b/core/libs/prx/libSceLibreSsl3/include/Api.hpp
new file mode 100644
index 0000000000..ff2a535fd7
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl3/include/Api.hpp
@@ -0,0 +1,95 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI ASN1_INTEGER_free_nid_postfix(void);
+int APS5_VABI ASN1_OBJECT_free_nid_postfix(void);
+int APS5_VABI ASN1_STRING_get0_data_nid_postfix(void);
+int APS5_VABI BIO_up_ref_nid_postfix(void);
+int APS5_VABI BIO_vfree_nid_postfix(void);
+int APS5_VABI CRYPTO_memcmp_nid_postfix(const void* first, const void* second, std::size_t length);
+int APS5_VABI DH_get0_key_nid_postfix(void);
+int APS5_VABI DH_get0_pqg_nid_postfix(void);
+int APS5_VABI DSA_get0_key_nid_postfix(void);
+int APS5_VABI DSA_get0_pqg_nid_postfix(void);
+int APS5_VABI EC_KEY_up_ref_nid_postfix(void);
+int APS5_VABI ERR_load_crypto_strings_nid_postfix(void);
+int APS5_VABI ERR_peek_last_error_nid_postfix(void);
+int APS5_VABI ERR_print_errors_cb_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_set_flags_nid_postfix(void);
+int APS5_VABI EVP_DigestInit_nid_postfix(void);
+int APS5_VABI EVP_DigestSignFinal_nid_postfix(void);
+int APS5_VABI EVP_DigestSignInit_nid_postfix(void);
+int APS5_VABI EVP_EncryptInit_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_free_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_new_nid_postfix(void);
+int APS5_VABI EVP_PKCS82PKEY_nid_postfix(void);
+int APS5_VABI EVP_PKEY_CTX_ctrl_nid_postfix(void);
+int APS5_VABI EVP_PKEY_CTX_new_nid_postfix(void);
+int APS5_VABI EVP_PKEY_decrypt_nid_postfix(void);
+int APS5_VABI EVP_PKEY_decrypt_init_nid_postfix(void);
+int APS5_VABI EVP_PKEY_encrypt_nid_postfix(void);
+int APS5_VABI EVP_PKEY_encrypt_init_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get0_DH_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get0_DSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get0_RSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_new_mac_key_nid_postfix(void);
+int APS5_VABI EVP_PKEY_set1_EC_KEY_nid_postfix(void);
+int APS5_VABI EVP_PKEY_size_nid_postfix(void);
+int APS5_VABI EVP_PKEY_up_ref_nid_postfix(void);
+int APS5_VABI EVP_SignFinal_nid_postfix(void);
+int APS5_VABI EVP_VerifyFinal_nid_postfix(void);
+int APS5_VABI EVP_aes_128_wrap_nid_postfix(void);
+int APS5_VABI EVP_aes_192_wrap_nid_postfix(void);
+int APS5_VABI EVP_aes_256_wrap_nid_postfix(void);
+int APS5_VABI EVP_sha1_nid_postfix(void);
+int APS5_VABI EVP_sha224_nid_postfix(void);
+int APS5_VABI OBJ_cmp_nid_postfix(void);
+int APS5_VABI OBJ_txt2obj_nid_postfix(void);
+int APS5_VABI OCSP_CERTID_free_nid_postfix(void);
+int APS5_VABI OCSP_cert_to_id_nid_postfix(void);
+int APS5_VABI OCSP_resp_find_status_nid_postfix(void);
+int APS5_VABI OpenSSL_version_nid_postfix(void);
+int APS5_VABI PKCS7_free_nid_postfix(void);
+int APS5_VABI PKCS8_PRIV_KEY_INFO_free_nid_postfix(void);
+int APS5_VABI RSA_check_key_nid_postfix(void);
+int APS5_VABI RSA_get0_key_nid_postfix(void);
+int APS5_VABI RSA_padding_add_PKCS1_PSS_mgf1_nid_postfix(void);
+int APS5_VABI RSA_up_ref_nid_postfix(void);
+int APS5_VABI SSL_CTX_add0_chain_cert_nid_postfix(void);
+int APS5_VABI SSL_CTX_clear_chain_certs_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_max_proto_version_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_min_proto_version_nid_postfix(void);
+int APS5_VABI SSL_CTX_up_ref_nid_postfix(void);
+int APS5_VABI SSL_SESSION_up_ref_nid_postfix(void);
+int APS5_VABI SSL_get_client_random_nid_postfix(void);
+int APS5_VABI SSL_up_ref_nid_postfix(void);
+int APS5_VABI X509_PUBKEY_get0_param_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_free_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_init_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_new_nid_postfix(void);
+int APS5_VABI X509_STORE_up_ref_nid_postfix(void);
+int APS5_VABI X509_get0_extensions_nid_postfix(void);
+int APS5_VABI X509_get0_notAfter_nid_postfix(void);
+int APS5_VABI X509_get0_notBefore_nid_postfix(void);
+int APS5_VABI X509_get0_signature_nid_postfix(void);
+int APS5_VABI X509_get_ext_nid_postfix(void);
+int APS5_VABI X509_get_ext_count_nid_postfix(void);
+int APS5_VABI X509_get_version_nid_postfix(void);
+int APS5_VABI X509_getm_notAfter_nid_postfix(void);
+int APS5_VABI X509_getm_notBefore_nid_postfix(void);
+int APS5_VABI X509_up_ref_nid_postfix(void);
+int APS5_VABI d2i_ASN1_INTEGER_nid_postfix(void);
+int APS5_VABI d2i_ECParameters_nid_postfix(void);
+int APS5_VABI d2i_PKCS7_nid_postfix(void);
+int APS5_VABI d2i_PKCS8_PRIV_KEY_INFO_bio_nid_postfix(void);
+int APS5_VABI d2i_PrivateKey_bio_nid_postfix(void);
+int APS5_VABI d2i_RSAPublicKey_bio_nid_postfix(void);
+int APS5_VABI d2i_X509_bio_nid_postfix(void);
+int APS5_VABI o2i_ECPublicKey_nid_postfix(void);
+unsigned char* APS5_VABI MD5_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest);
+unsigned char* APS5_VABI SHA1_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest);
+
+}
diff --git a/core/libs/prx/libSceLibreSsl3/libSceLibreSsl3.hpp b/core/libs/prx/libSceLibreSsl3/libSceLibreSsl3.hpp
new file mode 100644
index 0000000000..e9b09745c0
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl3/libSceLibreSsl3.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLibreSsl3/include/Api.hpp"
diff --git a/core/libs/prx/libSceLibreSsl3/src/Digest.cpp b/core/libs/prx/libSceLibreSsl3/src/Digest.cpp
index 373654f3d5..0df5d8b0b4 100644
--- a/core/libs/prx/libSceLibreSsl3/src/Digest.cpp
+++ b/core/libs/prx/libSceLibreSsl3/src/Digest.cpp
@@ -1,29 +1,28 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
+#include "prx/libSceLibreSsl/include/Api.hpp"
 #include <cstddef>
+#include <stdexcept>
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
-int APS5_VABI MD5_Init_nid_postfix(void* context);
-int APS5_VABI MD5_Update_nid_postfix(void* context, const void* data, std::size_t length);
-int APS5_VABI MD5_Final_nid_postfix(unsigned char* digest, void* context);
-int APS5_VABI SHA1_Init_nid_postfix(void* context);
-int APS5_VABI SHA1_Update_nid_postfix(void* context, const void* data, std::size_t length);
-int APS5_VABI SHA1_Final_nid_postfix(unsigned char* digest, void* context);
 
 unsigned char* APS5_VABI MD5_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest) {
-    if (!digest) NotImplemented_nid_no_patch("MD5: null digest buffer");
-    alignas(8) unsigned char context[92];
-    MD5_Init_nid_postfix(context);
-    MD5_Update_nid_postfix(context, data, length);
-    MD5_Final_nid_postfix(digest, context);
+    if (!digest) throw std::invalid_argument("MD5: null digest buffer");
+    Md5Context context;
+    MD5_Init_nid_postfix(&context);
+    MD5_Update_nid_postfix(&context, data, length);
+    MD5_Final_nid_postfix(digest, &context);
+
     return digest;
 }
 
 unsigned char* APS5_VABI SHA1_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest) {
-    if (!digest) NotImplemented_nid_no_patch("SHA1: null digest buffer");
-    alignas(8) unsigned char context[96];
-    SHA1_Init_nid_postfix(context);
-    SHA1_Update_nid_postfix(context, data, length);
-    SHA1_Final_nid_postfix(digest, context);
+    if (!digest) throw std::invalid_argument("SHA1: null digest buffer");
+    Sha1Context context;
+    SHA1_Init_nid_postfix(&context);
+    SHA1_Update_nid_postfix(&context, data, length);
+    SHA1_Final_nid_postfix(digest, &context);
+
     return digest;
 }
 
diff --git a/core/libs/prx/libSceLoginDialog/Export.cpp b/core/libs/prx/libSceLoginDialog/Export.cpp
index 8fcd0f4daf..1f652d35fb 100644
--- a/core/libs/prx/libSceLoginDialog/Export.cpp
+++ b/core/libs/prx/libSceLoginDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLoginDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceLoginDialog/include/Api.hpp b/core/libs/prx/libSceLoginDialog/include/Api.hpp
new file mode 100644
index 0000000000..51bca2f699
--- /dev/null
+++ b/core/libs/prx/libSceLoginDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceLoginDialogInitialize(void);
+int APS5_VABI sceLoginDialogOpen(const LoginDialogParam* param);
+int APS5_VABI sceLoginDialogUpdateStatus(void);
+int APS5_VABI sceLoginDialogGetStatus(void);
+int APS5_VABI sceLoginDialogGetResult(LoginDialogResult* result);
+int APS5_VABI sceLoginDialogClose(void);
+int APS5_VABI sceLoginDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceLoginDialog/libSceLoginDialog.hpp b/core/libs/prx/libSceLoginDialog/libSceLoginDialog.hpp
new file mode 100644
index 0000000000..eed4b0aa93
--- /dev/null
+++ b/core/libs/prx/libSceLoginDialog/libSceLoginDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLoginDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceLoginMgrServer/Export.cpp b/core/libs/prx/libSceLoginMgrServer/Export.cpp
index c0497cf3de..8c56379312 100644
--- a/core/libs/prx/libSceLoginMgrServer/Export.cpp
+++ b/core/libs/prx/libSceLoginMgrServer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLoginMgrServer/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceLoginMgrServer/include/Api.hpp b/core/libs/prx/libSceLoginMgrServer/include/Api.hpp
new file mode 100644
index 0000000000..de64daf5d9
--- /dev/null
+++ b/core/libs/prx/libSceLoginMgrServer/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceLoginMgrServerCheckSafetyNoticeShown();
+int APS5_VABI sceLoginMgrServerClearMorpheusRequiredUserId();
+int APS5_VABI sceLoginMgrServerConvertToUserId();
+int APS5_VABI sceLoginMgrServerCreateUser();
+int APS5_VABI sceLoginMgrServerDestroyUser();
+int APS5_VABI sceLoginMgrServerDialogGetAppId();
+int APS5_VABI sceLoginMgrServerDialogGetOpenParam();
+int APS5_VABI sceLoginMgrServerDialogNotifyCloseFinished();
+int APS5_VABI sceLoginMgrServerDialogNotifyOpenFinished();
+int APS5_VABI sceLoginMgrServerDialogSetResult();
+int APS5_VABI sceLoginMgrServerGetLogoutInfo();
+int APS5_VABI sceLoginMgrServerGetMorpheusRequiredUserId();
+int APS5_VABI sceLoginMgrServerGetSharePlayAllowPadOperation();
+int APS5_VABI sceLoginMgrServerInitialize();
+int APS5_VABI sceLoginMgrServerInitializeSharePlayAllowPadOperation();
+int APS5_VABI sceLoginMgrServerIsRequestedCdlgClose();
+int APS5_VABI sceLoginMgrServerLoginServiceGetRequestParam();
+int APS5_VABI sceLoginMgrServerLoginServiceNotifyRequestFinished();
+int APS5_VABI sceLoginMgrServerNotifyEasySignInFinished();
+int APS5_VABI sceLoginMgrServerNotifyEasySignInUserCode();
+int APS5_VABI sceLoginMgrServerNotifyHmdConnectInfo();
+int APS5_VABI sceLoginMgrServerNotifySafetyNoticeShown();
+int APS5_VABI sceLoginMgrServerNotifyShellUIState();
+int APS5_VABI sceLoginMgrServerSetLoginFlag();
+int APS5_VABI sceLoginMgrServerSetMorpheusAssignEnabledFlag();
+int APS5_VABI sceLoginMgrServerSetMorpheusRequiredUserId();
+int APS5_VABI sceLoginMgrServerSetSharePlayMode();
+int APS5_VABI sceLoginMgrServerSetUserStatus();
+int APS5_VABI sceLoginMgrServerTerminate();
+int APS5_VABI sceLoginMgrServerUpdateUserIdRalatedToPadUniqueId();
+
+}
diff --git a/core/libs/prx/libSceLoginMgrServer/libSceLoginMgrServer.hpp b/core/libs/prx/libSceLoginMgrServer/libSceLoginMgrServer.hpp
new file mode 100644
index 0000000000..244b5b6a16
--- /dev/null
+++ b/core/libs/prx/libSceLoginMgrServer/libSceLoginMgrServer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLoginMgrServer/include/Api.hpp"
diff --git a/core/libs/prx/libSceLoginService/Export.cpp b/core/libs/prx/libSceLoginService/Export.cpp
index 71262ec59b..e3a24fd796 100644
--- a/core/libs/prx/libSceLoginService/Export.cpp
+++ b/core/libs/prx/libSceLoginService/Export.cpp
@@ -1,9 +1,8 @@
+#include "prx/libSceLoginService/include/Api.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct LoginServiceDeviceRequest;
-
 extern "C" {
 
 int APS5_VABI sceLoginServiceInitialize(void) {
diff --git a/core/libs/prx/libSceLoginService/include/Api.hpp b/core/libs/prx/libSceLoginService/include/Api.hpp
new file mode 100644
index 0000000000..853ce09844
--- /dev/null
+++ b/core/libs/prx/libSceLoginService/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct LoginServiceDeviceRequest;
+
+extern "C" {
+
+int APS5_VABI sceLoginServiceInitialize(void);
+int APS5_VABI sceLoginServiceTerminate(void);
+int APS5_VABI sceLoginServiceRequestDevices(const LoginServiceDeviceRequest* param);
+
+}
diff --git a/core/libs/prx/libSceLoginService/libSceLoginService.hpp b/core/libs/prx/libSceLoginService/libSceLoginService.hpp
new file mode 100644
index 0000000000..7de7ce0c1e
--- /dev/null
+++ b/core/libs/prx/libSceLoginService/libSceLoginService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLoginService/include/Api.hpp"
diff --git a/core/libs/prx/libSceM4aacEnc/Export.cpp b/core/libs/prx/libSceM4aacEnc/Export.cpp
index e71f829cca..64de066d07 100644
--- a/core/libs/prx/libSceM4aacEnc/Export.cpp
+++ b/core/libs/prx/libSceM4aacEnc/Export.cpp
@@ -1,9 +1,9 @@
+#include "prx/libSceM4aacEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-
 extern "C" {
 
 int32_t APS5_VABI sceM4aacEncClearContext(int32_t m4aacEncHandle) {
diff --git a/core/libs/prx/libSceM4aacEnc/include/Api.hpp b/core/libs/prx/libSceM4aacEnc/include/Api.hpp
new file mode 100644
index 0000000000..a981414104
--- /dev/null
+++ b/core/libs/prx/libSceM4aacEnc/include/Api.hpp
@@ -0,0 +1,25 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceM4aacEncClearContext(int32_t m4aacEncHandle);
+int APS5_VABI sceM4aacEncClearContextEx();
+int32_t APS5_VABI sceM4aacEncCreateEncoder(int32_t channels, int32_t samplingRate, int32_t bitRate, int32_t inputFormat, int32_t outputFormat, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncCreateEncoderEx();
+int32_t APS5_VABI sceM4aacEncDeleteEncoder(int32_t m4aacEncHandle, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncDeleteEncoderEx();
+int32_t APS5_VABI sceM4aacEncEncode(int32_t m4aacEncHandle, void *pInput, uint32_t inputByte, void *pOutput, uint32_t *pOutputByte, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncEncodeEx();
+int APS5_VABI sceM4aacEncEncodeWithPriority();
+int APS5_VABI sceM4aacEncEncodeWithPriorityEx();
+int32_t APS5_VABI sceM4aacEncFlush(int32_t m4aacEncHandle, void *pOutput, uint32_t *pOutputByte, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncFlushEx();
+int APS5_VABI sceM4aacEncFlushWithPriority();
+int APS5_VABI sceM4aacEncFlushWithPriorityEx();
+int APS5_VABI sceM4aacEncGetContext();
+int APS5_VABI sceM4aacEncInitialize();
+int APS5_VABI sceM4aacEncTerminate();
+
+}
diff --git a/core/libs/prx/libSceM4aacEnc/libSceM4aacEnc.hpp b/core/libs/prx/libSceM4aacEnc/libSceM4aacEnc.hpp
new file mode 100644
index 0000000000..23842cc39b
--- /dev/null
+++ b/core/libs/prx/libSceM4aacEnc/libSceM4aacEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceM4aacEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceMarlin/libSceMarlin.hpp b/core/libs/prx/libSceMarlin/libSceMarlin.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMarlin/libSceMarlin.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMat/libSceMat.hpp b/core/libs/prx/libSceMat/libSceMat.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMat/libSceMat.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMbus/Export.cpp b/core/libs/prx/libSceMbus/Export.cpp
index ca49b545be..5212afd405 100644
--- a/core/libs/prx/libSceMbus/Export.cpp
+++ b/core/libs/prx/libSceMbus/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMbus/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,24 +6,6 @@
 
 #include <string>
 
-struct DeviceServiceThreadParam {
-    std::uint64_t affinityMask;
-    std::int32_t priority;
-    std::uint32_t reserved;
-};
-
-struct DeviceServiceInitParam {
-    std::uint32_t size;
-    std::uint32_t reserved;
-    const DeviceServiceThreadParam* threadParam;
-};
-
-struct DeviceServiceUsageFilter {
-    std::uint16_t usagePage;
-    std::uint16_t minimumUsage;
-    std::uint16_t maximumUsage;
-};
-
 static_assert(sizeof(DeviceServiceThreadParam) == 16);
 static_assert(offsetof(DeviceServiceThreadParam, priority) == 8);
 static_assert(sizeof(DeviceServiceInitParam) == 16);
diff --git a/core/libs/prx/libSceMbus/PendingExports.cpp b/core/libs/prx/libSceMbus/PendingExports.cpp
index 76313b1a67..d5f6a7f050 100644
--- a/core/libs/prx/libSceMbus/PendingExports.cpp
+++ b/core/libs/prx/libSceMbus/PendingExports.cpp
@@ -1,38 +1,13 @@
+#include "prx/libSceMbus/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <cstddef>
 
-struct MbusDeviceFunctionState {
-    std::byte data[180];
-};
-
 static_assert(sizeof(MbusDeviceFunctionState) == 180);
-struct MbusDeviceDescription;
-struct MbusDeviceInfo;
-struct MbusSimulatedHandleStatus;
-struct MbusSparkState;
-struct MbusDriverCallbacks;
-struct MbusUsbPowerEntry;
-struct MbusEvent;
-struct alignas(8) MbusDeviceCondition {
-    std::byte data[256];
-};
 
 static_assert(sizeof(MbusDeviceCondition) == 256);
-struct MbusDeviceServiceInfo;
-struct MbusEventCallbacks {
-    void (APS5_VABI *onOverflow)(std::int32_t eventHandle, void* userData);
-    void (APS5_VABI *onEvent)(std::int32_t eventHandle, void* userData, const MbusEvent* event);
-};
 
 static_assert(sizeof(MbusEventCallbacks) == 16);
-struct MbusProcessInfo;
-struct MbusStartupInfo;
-struct MbusStartupParam;
-struct MbusControlStatus;
-struct MbusDebugDeviceInfo;
-struct MbusInternalInfo;
-struct MbusPriorityInfo;
 
 extern "C" {
 
diff --git a/core/libs/prx/libSceMbus/include/Api.hpp b/core/libs/prx/libSceMbus/include/Api.hpp
new file mode 100644
index 0000000000..d31c99a8aa
--- /dev/null
+++ b/core/libs/prx/libSceMbus/include/Api.hpp
@@ -0,0 +1,192 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+struct DeviceServiceThreadParam {
+    std::uint64_t affinityMask;
+    std::int32_t priority;
+    std::uint32_t reserved;
+};
+
+struct DeviceServiceInitParam {
+    std::uint32_t size;
+    std::uint32_t reserved;
+    const DeviceServiceThreadParam* threadParam;
+};
+
+struct DeviceServiceUsageFilter {
+    std::uint16_t usagePage;
+    std::uint16_t minimumUsage;
+    std::uint16_t maximumUsage;
+};
+
+struct MbusDeviceFunctionState {
+    std::byte data[180];
+};
+
+struct MbusDeviceDescription;
+
+struct MbusDeviceInfo;
+
+struct MbusSimulatedHandleStatus;
+
+struct MbusSparkState;
+
+struct MbusDriverCallbacks;
+
+struct MbusUsbPowerEntry;
+
+struct MbusEvent;
+
+struct alignas(8) MbusDeviceCondition {
+    std::byte data[256];
+};
+
+struct MbusDeviceServiceInfo;
+
+struct MbusEventCallbacks {
+    void (APS5_VABI *onOverflow)(std::int32_t eventHandle, void* userData);
+    void (APS5_VABI *onEvent)(std::int32_t eventHandle, void* userData, const MbusEvent* event);
+};
+
+struct MbusProcessInfo;
+
+struct MbusStartupInfo;
+
+struct MbusStartupParam;
+
+struct MbusControlStatus;
+
+struct MbusDebugDeviceInfo;
+
+struct MbusInternalInfo;
+
+struct MbusPriorityInfo;
+
+extern "C" {
+
+std::int32_t APS5_VABI sceDeviceServiceInitialize(std::int32_t mode, const DeviceServiceInitParam* param);
+std::int32_t APS5_VABI sceDeviceServiceTerminate();
+std::int32_t APS5_VABI sceDeviceServiceGetEventState(std::int32_t clear);
+std::int32_t APS5_VABI sceDeviceServiceQueryDeviceInfo_(std::int32_t deviceClass, const DeviceServiceUsageFilter* filter, std::int32_t arg2, void* infos, std::int32_t maxInfos, std::int32_t* count, std::int32_t* reserved, std::uint32_t infoSize);
+std::int32_t APS5_VABI sceDeviceServiceGetGeneration(void);
+int APS5_VABI sceMbusAcquireControl(std::uint64_t control, std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusAcquireControlList();
+int APS5_VABI sceMbusAcquireControlWithState(std::uint32_t deviceClass, std::int32_t state);
+int APS5_VABI sceMbusAcquireControlWithState2(std::uint32_t deviceClass, std::int32_t moduleId, std::int32_t state);
+int APS5_VABI sceMbusAcquireControlWithStateFlag(std::uint32_t deviceClass, std::uint32_t moduleId, std::uint32_t state, std::uint32_t flags);
+int APS5_VABI sceMbusAddHandle(std::uint32_t deviceClass, std::int32_t handle, std::uint32_t flags);
+int APS5_VABI sceMbusAddHandleByDeviceId(std::uint32_t deviceClass, std::int32_t handle, std::uint64_t deviceId, std::uint32_t first, std::uint32_t second, std::uint32_t third);
+int APS5_VABI sceMbusAddHandleByUserId(std::uint32_t deviceClass, std::int32_t handle, std::int32_t userId, std::int32_t first, std::int32_t second, std::int32_t third);
+int APS5_VABI sceMbusAddHandleByVidPid(std::uint32_t deviceClass, std::int32_t handle, std::int32_t first, std::uint16_t vendorId, std::uint16_t productId, std::int32_t second, std::int32_t third);
+int APS5_VABI sceMbusAddHandleWithModuleId(std::uint32_t deviceClass, std::int32_t handle, std::uint32_t flags, std::uint32_t moduleId);
+int APS5_VABI sceMbusAttachToApplicationByPid(std::int32_t processId, std::int32_t deviceClass, std::int32_t flags);
+int APS5_VABI sceMbusBindDeviceWithUserId(std::uint64_t deviceId, std::int32_t userId);
+int APS5_VABI sceMbusChangeAppModuleState(std::uint32_t deviceClass, std::int32_t moduleId, std::uint32_t state);
+int APS5_VABI sceMbusCheckDriverCallback();
+int APS5_VABI sceMbusConvertToLocalDeviceId(std::uint64_t deviceId, std::uint32_t* localId, std::uint32_t* deviceClass);
+int APS5_VABI sceMbusConvertToLocalDeviceId2(std::uint64_t deviceId, std::uint32_t deviceClass, std::uint64_t* localId);
+int APS5_VABI sceMbusConvertToMbusDeviceId(std::uint64_t localId, std::uint32_t deviceClass, std::uint64_t* deviceId);
+int APS5_VABI sceMbusDebugAcquireControl(std::uint64_t control, std::int32_t first, std::int32_t second, std::int32_t processId);
+int APS5_VABI sceMbusDebugAcquireControlWithState(std::uint32_t deviceClass, std::int32_t state, std::int32_t processId);
+int APS5_VABI sceMbusDebugAcquireControlWithState2(std::uint32_t deviceClass, std::int32_t moduleId, std::int32_t state, std::int32_t processId);
+int APS5_VABI sceMbusDebugAcquireControlWithStateFlag(std::uint32_t deviceClass, std::uint32_t moduleId, std::uint32_t state, std::uint32_t flags, std::int32_t processId);
+int APS5_VABI sceMbusDebugAddProcess(std::int32_t processId, std::int32_t flags, const MbusProcessInfo* info);
+int APS5_VABI sceMbusDebugCheckProcessResume(MbusProcessInfo* info, std::uint32_t flags);
+int APS5_VABI sceMbusDebugDisableBgmForShellUi(std::int32_t processId);
+int APS5_VABI sceMbusDebugGetApplicationStartupInfo(std::uint32_t appId, const MbusProcessInfo* info, MbusStartupInfo* startupInfo);
+int APS5_VABI sceMbusDebugGetControlStatus(std::int32_t deviceClass, std::int32_t processId, MbusControlStatus* status);
+int APS5_VABI sceMbusDebugGetDeviceInfo(std::uint64_t deviceClass, MbusDebugDeviceInfo* info);
+int APS5_VABI sceMbusDebugGetInternalInfo(MbusInternalInfo* info);
+int APS5_VABI sceMbusDebugGetPriorityInfo(std::uint32_t deviceClass, MbusPriorityInfo* info);
+int APS5_VABI sceMbusDebugReenableBgmForShellUi(std::int32_t processId);
+int APS5_VABI sceMbusDebugReleaseControl(std::uint64_t control, std::int32_t processId);
+int APS5_VABI sceMbusDebugRemoveCameraAppModuleFocus(std::int32_t processId);
+int APS5_VABI sceMbusDebugResumeApplication(std::int32_t appId, std::uint8_t firstFlag, std::uint8_t secondFlag, MbusProcessInfo* info);
+int APS5_VABI sceMbusDebugSetApplicationFocusByAppId(std::uint32_t appId);
+int APS5_VABI sceMbusDebugSetCameraAppModuleFocus(std::int32_t processId, std::int32_t moduleId);
+int APS5_VABI sceMbusDebugSetControllerFocusByAppId(std::uint32_t appId);
+int APS5_VABI sceMbusDebugSetOtherProcessExcludedAction(std::uint64_t control, std::uint32_t action, std::int32_t processId);
+int APS5_VABI sceMbusDebugSetPriority(std::uint64_t control, std::uint32_t priority, std::int32_t processId);
+int APS5_VABI sceMbusDebugStartApplication(std::int32_t appId, std::int32_t first, std::int32_t second, std::uint8_t firstFlag, std::uint8_t secondFlag, const MbusStartupParam* param);
+int APS5_VABI sceMbusDebugStartApplication2(std::int32_t appId, std::int32_t first, std::int32_t second, std::uint8_t firstFlag, std::uint8_t secondFlag, const MbusStartupParam* param);
+int APS5_VABI sceMbusDebugStartApplicationNull(std::int32_t appId, std::int32_t first, std::int32_t second, std::uint8_t firstFlag, std::uint8_t secondFlag);
+int APS5_VABI sceMbusDebugSuspendApplication(std::uint32_t appId);
+int APS5_VABI sceMbusDebugTerminateApplication(std::uint32_t appId);
+int APS5_VABI sceMbusDebugTerminateProcess(std::int32_t processId);
+int APS5_VABI sceMbusDetachFromApplicationByPid(std::int32_t processId, std::int32_t deviceClass);
+int APS5_VABI sceMbusDisableBgmForShellUi();
+int APS5_VABI sceMbusDisableChat(std::uint32_t deviceClass);
+int APS5_VABI sceMbusDisconnectDevice(std::uint64_t deviceId);
+int APS5_VABI sceMbusDumpAppInfo();
+int APS5_VABI sceMbusDumpDeviceInfo();
+int APS5_VABI sceMbusDumpHandleStatusInfo(std::uint64_t control, std::int32_t processId);
+int APS5_VABI sceMbusDumpHandleStatusInfoAll(std::uint32_t flags);
+int APS5_VABI sceMbusDumpModuleStateInfo(std::uint64_t control);
+int APS5_VABI sceMbusDumpModuleStateInfoAll();
+int APS5_VABI sceMbusDumpPlayerInfo();
+int APS5_VABI sceMbusDumpPortHandleInfo();
+int APS5_VABI sceMbusDumpProcMediaInfo(std::uint64_t control);
+int APS5_VABI sceMbusDumpProcMediaInfoAll();
+int APS5_VABI sceMbusDumpUserMediaInfo();
+int APS5_VABI sceMbusEnableChat(std::uint32_t deviceClass);
+int APS5_VABI sceMbusEnterAudioOutAutoAttenuation(std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusEventBusStatusChangeSubscribe(std::int32_t eventHandle, std::uint32_t first, std::uint32_t second, std::uint64_t firstValue, std::uint64_t secondValue);
+int APS5_VABI sceMbusEventBusStatusChangeUnsubscribe(std::uint64_t unusedSlot, std::int32_t subscription);
+int APS5_VABI sceMbusEventCallbackFuncsInit_(MbusEventCallbacks* callbacks, std::uint32_t size);
+int APS5_VABI sceMbusEventCreate_(std::uint32_t flags, MbusEvent* buffer, std::uint32_t capacity, const MbusEventCallbacks* callbacks, void* userData);
+int APS5_VABI sceMbusEventDestroy(std::int32_t eventHandle);
+int APS5_VABI sceMbusEventReceive(std::int32_t eventHandle, MbusEvent* events, std::int32_t capacity, std::int32_t wait);
+int APS5_VABI sceMbusGetControlStatus(std::uint64_t control, MbusControlStatus* status);
+int APS5_VABI sceMbusGetDeviceDescription(std::uint64_t deviceId, std::uint32_t selector, MbusDeviceDescription* description);
+int APS5_VABI sceMbusGetDeviceInfoByBusId_(std::int32_t busId, MbusDeviceInfo* info, std::uint32_t size);
+int APS5_VABI sceMbusGetDeviceInfoByConditionForDeviceService(std::int32_t flags, MbusDeviceServiceInfo* infos, std::int32_t capacity, std::int32_t* first, std::int32_t* second, MbusDeviceCondition condition);
+int APS5_VABI sceMbusGetDeviceInfoByCondition_(const MbusDeviceCondition* condition, std::int32_t flags, MbusDeviceInfo* infos, std::int32_t capacity, std::int32_t* first, std::int32_t* second, std::uint32_t infoSize);
+int APS5_VABI sceMbusGetDeviceInfo_(std::uint64_t deviceId, MbusDeviceInfo* info, std::uint32_t size);
+int APS5_VABI sceMbusGetSimulatedBusUsableStatusByBusType(std::uint32_t busType, std::int32_t first, std::uint64_t deviceId, std::uint32_t second, std::uint32_t third);
+int APS5_VABI sceMbusGetSimulatedHandleStatusInfo(std::int32_t deviceClass, std::int32_t first, std::int32_t second, MbusSimulatedHandleStatus* status);
+int APS5_VABI sceMbusGetSimulatedHandleStatusInfo2(std::uint32_t deviceClass, std::uint32_t first, std::uint32_t second, std::uint32_t third, MbusSimulatedHandleStatus* status);
+int APS5_VABI sceMbusGetSparkState(std::uint64_t deviceId, MbusSparkState* state);
+int APS5_VABI sceMbusInit();
+int APS5_VABI sceMbusIsBgmProhibited();
+int APS5_VABI sceMbusIsUsingDevice(std::int32_t deviceClass, std::int32_t handle);
+int APS5_VABI sceMbusLeaveAudioOutAutoAttenuation(std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusNotifyBtDisconnection(std::uint64_t deviceId);
+int APS5_VABI sceMbusNotifyDriverEvent(std::int32_t driverId, std::int32_t eventId, std::uint64_t firstValue, std::int32_t flags, std::uint64_t secondValue);
+int APS5_VABI sceMbusReenableBgmForShellUi();
+int APS5_VABI sceMbusRegisterDriver(std::int32_t driverId, const MbusDriverCallbacks* callbacks, void* userData);
+int APS5_VABI sceMbusReleaseControl(std::uint64_t control);
+int APS5_VABI sceMbusRemoveCameraAppModuleFocus();
+int APS5_VABI sceMbusRemoveHandle(std::int32_t deviceClass, std::int32_t handle);
+int APS5_VABI sceMbusRemoveProxy(std::int32_t processId, std::uint32_t deviceClass, std::uint64_t deviceId);
+int APS5_VABI sceMbusResolveByDeviceId(std::int32_t deviceClass, std::uint64_t deviceId, std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceMbusResolveByHandle(std::int32_t deviceClass, std::int32_t handle, std::int32_t flags);
+int APS5_VABI sceMbusResolveByPlayerId(std::uint32_t deviceClass, std::uint32_t playerId, std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceMbusResolveByUserId(std::uint32_t deviceClass, std::int32_t userId, std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceMbusSetAutoLoginMode(std::uint32_t mode);
+int APS5_VABI sceMbusSetCameraAppModuleFocus(std::int32_t moduleId);
+int APS5_VABI sceMbusSetDeviceFunctionState(std::uint64_t deviceId, MbusDeviceFunctionState state);
+int APS5_VABI sceMbusSetDuckingSetting(std::int32_t setting);
+int APS5_VABI sceMbusSetProxy(std::int32_t processId, std::int32_t first, std::int32_t second, std::int32_t third, std::uint64_t deviceId);
+int APS5_VABI sceMbusSetRoutingMode(std::int32_t mode);
+int APS5_VABI sceMbusSetScratchData(std::uint64_t deviceId, std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusSetScratchDataUpdatedEventMask(std::uint32_t mask);
+int APS5_VABI sceMbusSetSocialScreenAudioMode(std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusSetTestFlag(std::uint32_t flags);
+int APS5_VABI sceMbusSetThreadParam(std::int32_t priority, std::uint64_t affinityMask, std::uint64_t reserved);
+int APS5_VABI sceMbusSetUsbPowerBlackList(std::int32_t first, std::uint8_t count, const MbusUsbPowerEntry* entries);
+int APS5_VABI sceMbusSetUserMuteStatus(std::int32_t userId, std::int32_t status);
+int APS5_VABI sceMbusSetVolumeDown(std::uint32_t deviceClass, std::uint8_t volume);
+int APS5_VABI sceMbusStartAudioOutAuxBroadcast();
+int APS5_VABI sceMbusStartAudioOutSharePlay(std::int32_t mode);
+int APS5_VABI sceMbusStopAudioOutAuxBroadcast();
+int APS5_VABI sceMbusStopAudioOutSharePlay();
+int APS5_VABI sceMbusTerm();
+int APS5_VABI sceMbusUnregisterDriver(std::int32_t driverId);
+int APS5_VABI sceMbusUserLogin(std::int32_t userId);
+int APS5_VABI sceMbusUserLogout(std::int32_t userId);
+
+}
diff --git a/core/libs/prx/libSceMbus/libSceMbus.hpp b/core/libs/prx/libSceMbus/libSceMbus.hpp
new file mode 100644
index 0000000000..e6b42950e3
--- /dev/null
+++ b/core/libs/prx/libSceMbus/libSceMbus.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMbus/include/Api.hpp"
diff --git a/core/libs/prx/libSceMediaAppSharedStorage/libSceMediaAppSharedStorage.hpp b/core/libs/prx/libSceMediaAppSharedStorage/libSceMediaAppSharedStorage.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMediaAppSharedStorage/libSceMediaAppSharedStorage.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMediaFrameworkInterface/libSceMediaFrameworkInterface.hpp b/core/libs/prx/libSceMediaFrameworkInterface/libSceMediaFrameworkInterface.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMediaFrameworkInterface/libSceMediaFrameworkInterface.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMediaFrameworkUtil/libSceMediaFrameworkUtil.hpp b/core/libs/prx/libSceMediaFrameworkUtil/libSceMediaFrameworkUtil.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMediaFrameworkUtil/libSceMediaFrameworkUtil.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMetadataReaderWriter/libSceMetadataReaderWriter.hpp b/core/libs/prx/libSceMetadataReaderWriter/libSceMetadataReaderWriter.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMetadataReaderWriter/libSceMetadataReaderWriter.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMouse/Export.cpp b/core/libs/prx/libSceMouse/Export.cpp
index 121b9d2e6a..1b1cd0f317 100644
--- a/core/libs/prx/libSceMouse/Export.cpp
+++ b/core/libs/prx/libSceMouse/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMouse/include/Api.hpp"
 #include "prx/libSceMouse/include/MouseState.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceMouse/include/Api.hpp b/core/libs/prx/libSceMouse/include/Api.hpp
new file mode 100644
index 0000000000..e37913bd10
--- /dev/null
+++ b/core/libs/prx/libSceMouse/include/Api.hpp
@@ -0,0 +1,23 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMouseInit();
+int APS5_VABI sceMouseOpen(int userId, std::int32_t type, std::int32_t index, const void* param);
+int APS5_VABI sceMouseClose(std::int32_t handle);
+int APS5_VABI sceMouseRead(std::int32_t handle, MouseData* data, std::int32_t num);
+int APS5_VABI sceMouseResetAbsolutePosition(std::int32_t handle, std::uint16_t x, std::uint16_t y);
+int APS5_VABI sceMouseConnectPort();
+int APS5_VABI sceMouseDebugGetDeviceId();
+int APS5_VABI sceMouseDeviceOpen();
+int APS5_VABI sceMouseDisconnectDevice();
+int APS5_VABI sceMouseDisconnectPort();
+int APS5_VABI sceMouseGetDeviceInfo();
+int APS5_VABI sceMouseMbusInit();
+int APS5_VABI sceMouseSetHandType();
+int APS5_VABI sceMouseSetPointerSpeed();
+int APS5_VABI sceMouseSetProcessPrivilege();
+
+}
diff --git a/core/libs/prx/libSceMouse/libSceMouse.hpp b/core/libs/prx/libSceMouse/libSceMouse.hpp
new file mode 100644
index 0000000000..512051b814
--- /dev/null
+++ b/core/libs/prx/libSceMouse/libSceMouse.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMouse/include/Api.hpp"
diff --git a/core/libs/prx/libSceMouse/tests/Mouse.cpp b/core/libs/prx/libSceMouse/tests/Mouse.cpp
index 7e7b1fcf13..27c99cc622 100644
--- a/core/libs/prx/libSceMouse/tests/Mouse.cpp
+++ b/core/libs/prx/libSceMouse/tests/Mouse.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMouse/include/Api.hpp"
 #include "prx/libSceMouse/include/mouse_structs.h"
 #include "prx/libSceMouse/include/MouseState.hpp"
 #include "prx/libSceVideoOut/include/MouseInput.hpp"
@@ -8,11 +9,7 @@
 
 extern "C" {
 bool MouseIsOpen_nid_no_patch();
-int APS5_VABI sceMouseInit();
-int APS5_VABI sceMouseOpen(int, std::int32_t, std::int32_t, const void*);
-int APS5_VABI sceMouseClose(std::int32_t);
-int APS5_VABI sceMouseRead(std::int32_t, MouseData*, std::int32_t);
-int APS5_VABI sceMouseResetAbsolutePosition(std::int32_t, std::uint16_t, std::uint16_t);
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/prx/libSceMove/Export.cpp b/core/libs/prx/libSceMove/Export.cpp
index effeda1e5c..b69438284d 100644
--- a/core/libs/prx/libSceMove/Export.cpp
+++ b/core/libs/prx/libSceMove/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMove/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <mutex>
diff --git a/core/libs/prx/libSceMove/include/Api.hpp b/core/libs/prx/libSceMove/include/Api.hpp
new file mode 100644
index 0000000000..5461d6d775
--- /dev/null
+++ b/core/libs/prx/libSceMove/include/Api.hpp
@@ -0,0 +1,29 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMoveInit(void);
+int APS5_VABI sceMoveTerm(void);
+int APS5_VABI sceMoveOpen(int32_t userId, int32_t type, int32_t index);
+int APS5_VABI sceMoveClose(int32_t handle);
+int APS5_VABI sceMoveGetDeviceInfo(int32_t handle, void* info);
+int APS5_VABI sceMoveGetExtensionPortInfo(int32_t handle, void* data);
+int APS5_VABI sceMoveReadStateLatest(int32_t handle, void* data);
+int APS5_VABI sceMoveReadStateRecent(int32_t handle, int64_t timestamp, void* data, int32_t* outCount);
+int APS5_VABI sceMoveSetVibration(int32_t handle, uint8_t motor);
+int APS5_VABI sceMoveSetLightSphere(int32_t handle, uint8_t red, uint8_t green, uint8_t blue);
+int APS5_VABI sceMoveResetLightSphere(int32_t handle);
+int APS5_VABI sceMoveGetBluetoothAddress(void);
+int APS5_VABI sceMoveGetCalibrationInfo(void);
+int APS5_VABI sceMoveGetDeviceId(void);
+int APS5_VABI sceMoveIsReproductionModel(void);
+int APS5_VABI sceMoveIsValidHandle(void);
+int APS5_VABI sceMoveReadStateRecentForTracker(void);
+int APS5_VABI sceMoveSetCalibrationMode(void);
+int APS5_VABI sceMoveSetExtensionPortOutput(void);
+int APS5_VABI sceMoveSetLightSphereForTracker(void);
+int APS5_VABI sceMoveWriteCalibrationInfo(void);
+
+}
diff --git a/core/libs/prx/libSceMove/libSceMove.hpp b/core/libs/prx/libSceMove/libSceMove.hpp
new file mode 100644
index 0000000000..522d39cc61
--- /dev/null
+++ b/core/libs/prx/libSceMove/libSceMove.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMove/include/Api.hpp"
diff --git a/core/libs/prx/libSceMoveTracker/Export.cpp b/core/libs/prx/libSceMoveTracker/Export.cpp
index ef780c7000..e1c32fd781 100644
--- a/core/libs/prx/libSceMoveTracker/Export.cpp
+++ b/core/libs/prx/libSceMoveTracker/Export.cpp
@@ -1,13 +1,9 @@
+#include "prx/libSceMoveTracker/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct MoveTrackerCameraFrame;
-struct MoveTrackerControllerInput;
-struct MoveTrackerState;
-struct MoveTrackerPlaybackInfo;
-
 extern "C" {
 
 int APS5_VABI sceMoveTrackerCalibrateReset() {
diff --git a/core/libs/prx/libSceMoveTracker/include/Api.hpp b/core/libs/prx/libSceMoveTracker/include/Api.hpp
new file mode 100644
index 0000000000..bfe72f92fd
--- /dev/null
+++ b/core/libs/prx/libSceMoveTracker/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct MoveTrackerCameraFrame;
+
+struct MoveTrackerControllerInput;
+
+struct MoveTrackerPlaybackInfo;
+
+struct MoveTrackerState;
+
+extern "C" {
+
+int APS5_VABI sceMoveTrackerCalibrateReset();
+int APS5_VABI sceMoveTrackerCalibrateYaw(std::int32_t handle, const float* direction);
+int APS5_VABI sceMoveTrackerCameraUpdate(const MoveTrackerCameraFrame* frames);
+int APS5_VABI sceMoveTrackerCaptureInit(void* imageMemory, std::int32_t capacity, std::int32_t interval, const char* path, std::int32_t mode);
+int APS5_VABI sceMoveTrackerCaptureTerm();
+int APS5_VABI sceMoveTrackerControllersUpdate(const MoveTrackerControllerInput* controllers);
+int APS5_VABI sceMoveTrackerGetState(std::int32_t handle, std::uint64_t timestamp, MoveTrackerState* state);
+int APS5_VABI sceMoveTrackerGetVersion();
+int APS5_VABI sceMoveTrackerGetWorkingMemorySize(std::uint32_t* totalSize, std::uint32_t* processingSize);
+int APS5_VABI sceMoveTrackerInit(void* workMemory, std::uint64_t requiredArgument, std::uint32_t pipeId, std::uint32_t queueId);
+int APS5_VABI sceMoveTrackerPlayGetImages(MoveTrackerCameraFrame* frames);
+int APS5_VABI sceMoveTrackerPlayGetStates(MoveTrackerPlaybackInfo* info, MoveTrackerState* states);
+int APS5_VABI sceMoveTrackerPlayStart();
+int APS5_VABI sceMoveTrackerPlayStep();
+int APS5_VABI sceMoveTrackerRecordSave();
+int APS5_VABI sceMoveTrackerRecordStart();
+int APS5_VABI sceMoveTrackerRecordStop();
+int APS5_VABI sceMoveTrackerTerm();
+
+}
diff --git a/core/libs/prx/libSceMoveTracker/libSceMoveTracker.hpp b/core/libs/prx/libSceMoveTracker/libSceMoveTracker.hpp
new file mode 100644
index 0000000000..02c0750675
--- /dev/null
+++ b/core/libs/prx/libSceMoveTracker/libSceMoveTracker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMoveTracker/include/Api.hpp"
diff --git a/core/libs/prx/libSceMsgDialog.native/Export.cpp b/core/libs/prx/libSceMsgDialog.native/Export.cpp
index 339bf0049a..52d1a12279 100644
--- a/core/libs/prx/libSceMsgDialog.native/Export.cpp
+++ b/core/libs/prx/libSceMsgDialog.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp b/core/libs/prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp
new file mode 100644
index 0000000000..ec8e5c89ab
--- /dev/null
+++ b/core/libs/prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp
@@ -0,0 +1,5 @@
+#pragma once
+
+#include "prx/libSceMsgDialog/include/Api.hpp"
+
+extern "C" int APS5_VABI sceMsgDialogGetResult(MsgDialogResult* result);
diff --git a/core/libs/prx/libSceMsgDialog/Export.cpp b/core/libs/prx/libSceMsgDialog/Export.cpp
index 1e02b26eab..c9462f47b7 100644
--- a/core/libs/prx/libSceMsgDialog/Export.cpp
+++ b/core/libs/prx/libSceMsgDialog/Export.cpp
@@ -1,6 +1,4 @@
-// libSceMsgDialog: message dialog state machine (NONE -> INITIALIZED -> RUNNING -> FINISHED) without a visible dialog.
-// The dialog "closes" with the affirmative button after a couple of status polls, so a title waiting for the user
-// never blocks. The message text is logged for the first calls.
+#include "prx/libSceMsgDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdio>
@@ -25,7 +23,6 @@ constexpr int kStatusFinished = 3;
 
 constexpr int kErrOk = 0;
 constexpr int kErrNotInitialized = static_cast<int>(0x80B80003u);
-constexpr int kErrNotFinished = static_cast<int>(0x80B80005u);
 constexpr int kErrBusy = static_cast<int>(0x80B80007u);
 constexpr int kErrNotRunning = static_cast<int>(0x80B8000Bu);
 constexpr int kErrArgNull = static_cast<int>(0x80B8000Du);
@@ -40,9 +37,8 @@ constexpr int kButtonTypeNone = 2;
 constexpr int kButtonTypeOkCancel = 3;
 constexpr int kButtonTypeYesNoFocusNo = 4;
 
-constexpr int kButtonIdOk = 1;   // OK / YES / BUTTON1
-constexpr int kButtonIdNo = 2;   // NO / BUTTON2
-constexpr int kResultOk = 0;
+constexpr int kButtonIdOk = 1;
+constexpr int kButtonIdNo = 2;
 
 std::mutex g_lock;
 int g_status = kStatusNone;
@@ -64,8 +60,6 @@ bool Readable(const void* p, std::size_t n) {
 #endif
 }
 
-// Best-effort inspection of SceMsgDialogParam: { SceCommonDialogBaseParam base (0x30); size_t size; int mode (0x38);
-// UserMessageParam* userMsg (0x40); ProgressBarParam* progress (0x48); SystemMessageParam* system (0x50); ... }.
 void Inspect(const void* param) {
     const std::uint8_t* bytes = static_cast<const std::uint8_t*>(param);
     g_mode = kModeUserMsg;
@@ -95,7 +89,6 @@ int Poll() {
     if (g_status == kStatusRunning) {
         bool done = false;
         if (g_mode == kModeProgressBar) {
-            // Progress dialogs are ended by the title (sceMsgDialogClose); the cap only prevents a wait without end.
             done = std::chrono::steady_clock::now() - g_openedAt > std::chrono::seconds(30);
         } else {
             done = --g_pollsLeft <= 0;
@@ -104,7 +97,7 @@ int Poll() {
     }
     return g_status;
 }
-}  // namespace
+}
 
 extern "C" {
 
@@ -124,7 +117,6 @@ int APS5_VABI sceMsgDialogOpen(const void* param) {
  if (param == nullptr) return kErrArgNull;
  std::lock_guard g(g_lock);
  if (g_status == kStatusRunning) return kErrBusy;
- // A title that skipped sceMsgDialogInitialize still gets its dialog (and its FINISHED status).
  Inspect(param);
  g_pollsLeft = 2;
  g_openedAt = std::chrono::steady_clock::now();
@@ -137,15 +129,6 @@ int APS5_VABI sceMsgDialogGetStatus(void) {
 int APS5_VABI sceMsgDialogUpdateStatus(void) {
  return Poll();
 }
-// SceMsgDialogResult: { int32 mode; int32 result; int32 buttonId; uint8 reserved[32] }.
-int APS5_VABI sceMsgDialogGetResult(void* result) {
- if (result == nullptr) return kErrArgNull;
- std::lock_guard g(g_lock);
- if (g_status != kStatusFinished) return kErrNotFinished;
- std::int32_t out[3] = {g_mode, kResultOk, g_buttonId};
- std::memcpy(result, out, sizeof(out));
- return kErrOk;
-}
 int APS5_VABI sceMsgDialogClose(void) {
  std::lock_guard g(g_lock);
  if (g_status != kStatusRunning) return kErrNotRunning;
diff --git a/core/libs/prx/libSceMsgDialog/include/Api.hpp b/core/libs/prx/libSceMsgDialog/include/Api.hpp
new file mode 100644
index 0000000000..44ceec5270
--- /dev/null
+++ b/core/libs/prx/libSceMsgDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMsgDialogInitialize(void);
+int APS5_VABI sceMsgDialogTerminate(void);
+int APS5_VABI sceMsgDialogOpen(const void* param);
+int APS5_VABI sceMsgDialogGetStatus(void);
+int APS5_VABI sceMsgDialogUpdateStatus(void);
+int APS5_VABI sceMsgDialogClose(void);
+int APS5_VABI sceMsgDialogProgressBarInc(int target, std::uint32_t delta);
+int APS5_VABI sceMsgDialogProgressBarSetMsg(int target, const char* msg);
+int APS5_VABI sceMsgDialogProgressBarSetValue(int target, std::uint32_t rate);
+
+}
diff --git a/core/libs/prx/libSceMsgDialog/libSceMsgDialog.hpp b/core/libs/prx/libSceMsgDialog/libSceMsgDialog.hpp
new file mode 100644
index 0000000000..f25195526f
--- /dev/null
+++ b/core/libs/prx/libSceMsgDialog/libSceMsgDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMsgDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceMusicCoreInterface/libSceMusicCoreInterface.hpp b/core/libs/prx/libSceMusicCoreInterface/libSceMusicCoreInterface.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMusicCoreInterface/libSceMusicCoreInterface.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp b/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp
index dc0e9adc97..9053d6ba40 100644
--- a/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp
+++ b/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMusicFrameworkInterface/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceMusicFrameworkInterface/include/Api.hpp b/core/libs/prx/libSceMusicFrameworkInterface/include/Api.hpp
new file mode 100644
index 0000000000..8164b75a7d
--- /dev/null
+++ b/core/libs/prx/libSceMusicFrameworkInterface/include/Api.hpp
@@ -0,0 +1,25 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMusicFwGetCurrentTime();
+int APS5_VABI sceMusicFwGetLoop();
+int APS5_VABI sceMusicFwGetMuted();
+int APS5_VABI sceMusicFwGetNetworkState();
+int APS5_VABI sceMusicFwGetVolume();
+int APS5_VABI sceMusicFwIsEnded();
+int APS5_VABI sceMusicFwIsPlaying();
+int APS5_VABI sceMusicFwIsStopped();
+int APS5_VABI sceMusicFwRemoveSrc();
+int APS5_VABI sceMusicFwSendMessageAsynchronously();
+int APS5_VABI sceMusicFwSendMessageSynchronously();
+int APS5_VABI sceMusicFwSetCurrentTime();
+int APS5_VABI sceMusicFwSetLoop();
+int APS5_VABI sceMusicFwSetShuffle();
+int APS5_VABI sceMusicFwSetVolume();
+int APS5_VABI sceMusicFwSkipNext();
+int APS5_VABI sceMusicFwSkipPrevious();
+
+}
diff --git a/core/libs/prx/libSceMusicFrameworkInterface/libSceMusicFrameworkInterface.hpp b/core/libs/prx/libSceMusicFrameworkInterface/libSceMusicFrameworkInterface.hpp
new file mode 100644
index 0000000000..83fbfaf531
--- /dev/null
+++ b/core/libs/prx/libSceMusicFrameworkInterface/libSceMusicFrameworkInterface.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMusicFrameworkInterface/include/Api.hpp"
diff --git a/core/libs/prx/libSceNKWeb/Export.cpp b/core/libs/prx/libSceNKWeb/Export.cpp
index 81401ab485..fdef9184da 100644
--- a/core/libs/prx/libSceNKWeb/Export.cpp
+++ b/core/libs/prx/libSceNKWeb/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNKWeb/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNKWeb/include/Api.hpp b/core/libs/prx/libSceNKWeb/include/Api.hpp
new file mode 100644
index 0000000000..57b480c9e7
--- /dev/null
+++ b/core/libs/prx/libSceNKWeb/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNKWebInitialize();
+int APS5_VABI sceNKWebTerminate();
+
+}
diff --git a/core/libs/prx/libSceNKWeb/libSceNKWeb.hpp b/core/libs/prx/libSceNKWeb/libSceNKWeb.hpp
new file mode 100644
index 0000000000..d65e494889
--- /dev/null
+++ b/core/libs/prx/libSceNKWeb/libSceNKWeb.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNKWeb/include/Api.hpp"
diff --git a/core/libs/prx/libSceNKWebCdlgInjectedBundle/libSceNKWebCdlgInjectedBundle.hpp b/core/libs/prx/libSceNKWebCdlgInjectedBundle/libSceNKWebCdlgInjectedBundle.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNKWebCdlgInjectedBundle/libSceNKWebCdlgInjectedBundle.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNKWebKit/Export.cpp b/core/libs/prx/libSceNKWebKit/Export.cpp
index a6caa403e8..43ccd2eeb3 100644
--- a/core/libs/prx/libSceNKWebKit/Export.cpp
+++ b/core/libs/prx/libSceNKWebKit/Export.cpp
@@ -1,3 +1,153 @@
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNKWebKit/include/Api.hpp b/core/libs/prx/libSceNKWebKit/include/Api.hpp
new file mode 100644
index 0000000000..9312101ad1
--- /dev/null
+++ b/core/libs/prx/libSceNKWebKit/include/Api.hpp
@@ -0,0 +1,158 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNKWebKitUnknown____URPJNZ18_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___67uYkhqBU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___8RYr2gjrw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___BntMcao1o_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___R8IXi10PI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___j2h_QO22w_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown____7XwmYLnI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___wmVyLhgm0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0QEt8ZQWgg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0YNxcA_duk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0ZZzGYxx_I_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0rdnkSicqk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1Ex5GCP8Xs_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1FfZ_0sxvQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1ObAtzCrYE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1n_h4FUu9E_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__26aZpK535w_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__2XuBaAXb_4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__2rTX2KM7Ms_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__31dbB3S_6Y_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__3p6wRzzzlQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__4_GNOUIBt0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__45BiDnCTxw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__4lVmXsIwqM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__5E2YZZIstM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__5V_UOk8zS4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__63IB3UdMOY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__6boXsT6XFA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__79w68212vg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__7HpqmfJz48_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__8T1y8Y_lgQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__8VuTEFp13s_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__9TKACifR2g_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__9ZBRWNf4og_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__9us0nrDaCU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__AIEKk6K05M_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Abk7CfTivU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__AnsPWo12m8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__BDqCDede1o_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__BSUP6XSeAw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__BZCJi3OIiQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ByVxWl1pW8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__CgSI_4D534_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__CpPA9_CKUA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__DcUw5YwkSY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__DpDBrSZWUc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__E3D_W4kpl8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__EN6MgNmVv4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ErgockOJwc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FKudG3uS8A_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FWUl_T8yG8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Fca5Eyr4BU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FcvpbbdrZM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FvUhrQaiJQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__GOwQvxqztE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Gp0M0sPj9I_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__H_bnpXdWtk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__H5PTMieXNE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__HuPyGuX_jY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__IMGO_dXHis_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ImJ026_DAw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__IoqHgIw0PM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__JnngM7WyHI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Kb7j57jDzs_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Kx_IV_21hk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LUabdo811U_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LiOmqon2ZI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LoAenYdWlM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LrmM3KN3N8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__MzGFuNN348_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__N_GwpCV4yk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__N6UhRaLrJE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__NGrXdCa0q8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__NiLTGGKF_E_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Nqfy8HVG84_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__NuhuZH75ak_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__OCxbaKiBUo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__OOjOkuWL6g_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__OkTn3_PBxM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__PDx3sfB_l4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__POsWAWjXo8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__PeIrQMgYpw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Q7xLvpc0PA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__QL3zQ6ZNy4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__QqzEnc5c80_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__R0GXLrsPM0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__R2eXISeSvw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__RkwSDm5kGU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__RtBREW92M0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__S72K_fa2_8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__S7ftAAWhoQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__SHzgUiuQDE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Sgy63JgEgQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Sozphy1Wa8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__TPntL1OK80_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__TT_AplhQWA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__TjNmuhxdBQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__U_nxwdrnDY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__UKI_MUuiCU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__VvktcfIouQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__WS2yRv5aBI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__XZfnHByVO0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YBfWz5udq4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YPwmEWTZwE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YYEOsi3IMk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YyqQTUIQJQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ZgGbFykhls_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ZwjLJ74Y38_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__b1xwU7aUwU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__b5TfVQ3_4s_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__bDb7iby5NI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__baqz7ahOng_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__bvtn3pCtek_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__byORTSkWQo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__dAwquupevQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__dTlroLZao8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__eVN0UdRT8c_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__fTKZiGqo8E_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__feeFP8Y2_c_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__iLBOBrdx5A_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__iLdIVuhDhY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__jG4wqqA8yg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__jLvgfDA97c_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ji7IBGwnCM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__k3JGU_UUXo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__kX_CdbguB0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__keSg8ay8cE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__lI9zCCS_HQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__lwLqZJLo3g_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__mS029ncrbo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__mYy22Ucg7Y_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nHWcLWOmb4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nSg5kHtXkg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nc3IouJMEA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ndmq8LhAjA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nrEMsyYHiw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__oJHrfcyJJM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ovAafdG0O8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__pWGccNXto8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__q0GELad_mY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__qXuNlEFSRQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__qsTbJFS86A_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__r_TJDA2yIM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__r0UH41I1dI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__r8OGkuL4dc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__rFA8ZR_qaI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__rPvFDsPbXM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__sUvE9LF80k_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__suuwfNT5Oc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__t_MaTLADe4_nid_no_patch();
+
+}
diff --git a/core/libs/prx/libSceNKWebKit/libSceNKWebKit.hpp b/core/libs/prx/libSceNKWebKit/libSceNKWebKit.hpp
new file mode 100644
index 0000000000..f291edcd57
--- /dev/null
+++ b/core/libs/prx/libSceNKWebKit/libSceNKWebKit.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNKWebKit/include/Api.hpp"
diff --git a/core/libs/prx/libSceNKWebKitRequirements/libSceNKWebKitRequirements.hpp b/core/libs/prx/libSceNKWebKitRequirements/libSceNKWebKitRequirements.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNKWebKitRequirements/libSceNKWebKitRequirements.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNet/CMakeLists.txt b/core/libs/prx/libSceNet/CMakeLists.txt
index 9ecb525065..90129eac83 100644
--- a/core/libs/prx/libSceNet/CMakeLists.txt
+++ b/core/libs/prx/libSceNet/CMakeLists.txt
@@ -4,6 +4,26 @@ target_link_libraries(libSceNet PRIVATE libSceNetCtl)
 configure_windows_unwind(libSceNet)
 
 if(BUILD_TESTING)
+    add_test_executable(guest_net_socket_state_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetSocketState.cpp)
+    target_include_directories(guest_net_socket_state_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_socket_state_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_socket_state_tests)
+    add_test(NAME guest_net_socket_state COMMAND guest_net_socket_state_tests)
+    set_tests_properties(guest_net_socket_state PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_net_socket_state PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
+    add_test_executable(guest_net_protocol_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetProtocol.cpp)
+    target_include_directories(guest_net_protocol_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_protocol_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_protocol_tests)
+    add_test(NAME guest_net_protocol COMMAND guest_net_protocol_tests)
+    set_tests_properties(guest_net_protocol PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_net_protocol PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
     add_test_executable(net_dontwait_tests ${LIBS_INCLUDE_DIR}/tests/NetDontWait.cpp)
     target_include_directories(net_dontwait_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(net_dontwait_tests PRIVATE libSceNet libkernel libc)
@@ -27,6 +47,17 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
         endif()
     endforeach()
+    add_test_executable(guest_net_boolean_readback_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetBooleanReadback.cpp)
+    target_include_directories(guest_net_boolean_readback_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_boolean_readback_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_boolean_readback_tests)
+    add_test(NAME guest_net_boolean_readback COMMAND guest_net_boolean_readback_tests)
+    set_tests_properties(guest_net_boolean_readback PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        target_link_libraries(guest_net_boolean_readback_tests PRIVATE ws2_32)
+        set_tests_properties(guest_net_boolean_readback PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
     add_test_executable(net_blocking_send_tests ${LIBS_INCLUDE_DIR}/tests/NetBlockingSend.cpp)
     target_include_directories(net_blocking_send_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(net_blocking_send_tests PRIVATE libkernel libc libSceNetCtl)
@@ -42,6 +73,17 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
         endif()
     endforeach()
+    add_test_executable(guest_net_keepalive_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetKeepalive.cpp)
+    target_include_directories(guest_net_keepalive_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_keepalive_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_keepalive_tests)
+    add_test(NAME guest_sce_net_keepalive COMMAND guest_net_keepalive_tests)
+    set_tests_properties(guest_sce_net_keepalive PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        target_link_libraries(guest_net_keepalive_tests PRIVATE ws2_32)
+        set_tests_properties(guest_sce_net_keepalive PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
     add_test_executable(guest_datagram_receive_tests ${LIBS_INCLUDE_DIR}/tests/GuestDatagramReceive.cpp)
     target_include_directories(guest_datagram_receive_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_datagram_receive_tests PRIVATE libSceNet libkernel libc)
@@ -54,6 +96,16 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
         endif()
     endforeach()
+    add_test_executable(guest_net_dns_info_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetDnsInfo.cpp)
+    target_include_directories(guest_net_dns_info_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_dns_info_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_dns_info_tests)
+    add_test(NAME guest_net_dns_info COMMAND guest_net_dns_info_tests)
+    set_tests_properties(guest_net_dns_info PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_net_dns_info PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
     add_test_executable(guest_refused_connect_tests ${LIBS_INCLUDE_DIR}/tests/GuestRefusedConnect.cpp)
     target_include_directories(guest_refused_connect_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_refused_connect_tests PRIVATE libSceNet libkernel libc)
@@ -64,6 +116,17 @@ if(BUILD_TESTING)
         set_tests_properties(guest_refused_connect PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
     endif()
+    add_test_executable(guest_net_oob_inline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetOobInline.cpp)
+    target_include_directories(guest_net_oob_inline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_oob_inline_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_oob_inline_tests)
+    add_test(NAME guest_net_oob_inline COMMAND guest_net_oob_inline_tests)
+    set_tests_properties(guest_net_oob_inline PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        target_link_libraries(guest_net_oob_inline_tests PRIVATE ws2_32)
+        set_tests_properties(guest_net_oob_inline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
     if(WIN32)
         add_test_executable(guest_socket_host_write_tests ${LIBS_INCLUDE_DIR}/tests/GuestSocketHostWrite.cpp)
         target_include_directories(guest_socket_host_write_tests PRIVATE ${LIBS_INCLUDE_DIR})
@@ -77,15 +140,45 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
         endforeach()
     endif()
+    if(WIN32)
+        add_test_executable(net_empty_stream_tests ${LIBS_INCLUDE_DIR}/tests/NetEmptyStream.cpp)
+        target_include_directories(net_empty_stream_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(net_empty_stream_tests PRIVATE libSceNet libkernel libc)
+        configure_windows_unwind(net_empty_stream_tests)
+        foreach(api IN ITEMS recv recvfrom recvmsg)
+            foreach(mode IN ITEMS empty dontwait peek nonblocking queued nullbuf errors datagram)
+                add_test(NAME net_empty_stream_${api}_${mode} COMMAND net_empty_stream_tests ${api} ${mode})
+                set_tests_properties(net_empty_stream_${api}_${mode} PROPERTIES TIMEOUT 20
+                    ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+            endforeach()
+        endforeach()
+    endif()
     add_test_executable(guest_sce_net_tests ${LIBS_INCLUDE_DIR}/tests/GuestSceNet.cpp)
     target_include_directories(guest_sce_net_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_sce_net_tests PRIVATE libSceNet libSceNetCtl libkernel libc)
     configure_windows_unwind(guest_sce_net_tests)
     add_test(NAME guest_sce_net COMMAND guest_sce_net_tests)
+    add_test_executable(guest_net_thread_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetThread.cpp)
+    target_include_directories(guest_net_thread_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_thread_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_thread_tests)
+    add_test(NAME guest_net_thread COMMAND guest_net_thread_tests)
+    set_tests_properties(guest_net_thread PROPERTIES TIMEOUT 20)
     set_tests_properties(guest_sce_net PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77)
     if(WIN32)
         target_link_libraries(guest_sce_net_tests PRIVATE ws2_32)
-        set_tests_properties(guest_sce_net PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_sce_net guest_net_thread PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
+    add_test_executable(guest_net_nodelay_readback_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetNodelayReadback.cpp)
+    target_include_directories(guest_net_nodelay_readback_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_nodelay_readback_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_nodelay_readback_tests)
+    add_test(NAME guest_net_nodelay_readback COMMAND guest_net_nodelay_readback_tests)
+    set_tests_properties(guest_net_nodelay_readback PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        target_link_libraries(guest_net_nodelay_readback_tests PRIVATE ws2_32)
+        set_tests_properties(guest_net_nodelay_readback PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
     endif()
     add_test_executable(net_epoll_lifetime_tests ${LIBS_INCLUDE_DIR}/tests/NetEpollLifetime.cpp)
diff --git a/core/libs/prx/libSceNet/Export.cpp b/core/libs/prx/libSceNet/Export.cpp
index f56153435c..ad5ab932d3 100644
--- a/core/libs/prx/libSceNet/Export.cpp
+++ b/core/libs/prx/libSceNet/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -44,107 +47,16 @@
 #include "prx/libkernel/Socket/include/SocketPoll.hpp"
 #include "prx/libkernel/Socket/include/SocketRuntime.hpp"
 #include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
 #include "src/ResolverTestHooks.hpp"
 
 // Guest socket descriptors retain PS5 semantics while their transport is backed by host sockets.
 
-struct NetWlanInformationElement;
-struct NetWlanWakeParameter;
-struct NetWlanScanParameter;
-struct NetWlanScanResult;
-struct NetWlanAdhocScanParameter;
-struct NetWlanInfraScanParameter;
-struct NetWlanJoinResult;
-struct NetDumpFilterParameter;
-
-struct NetWlanAdhocParameter;
-struct NetWlanWakeInfo;
-struct NetWlanPspWakeInfo;
-struct NetWlanPspWakeParameter;
-struct NetWlanApParameter;
-struct NetWlanDeviceInfo;
-struct NetWlanAntennaParameter;
-struct NetWlanRateParameter;
-struct NetWlanDeviceConfiguration;
-struct NetWlanRssiInfo;
-struct NetDhcpInfo;
-struct NetAutoIpInfo;
-struct NetAddress6Info;
-
-struct NetDhcpOptionInfo {
-    std::uint32_t option;
-    std::uint32_t capacity;
-    void* data;
-    std::uint32_t size;
-    std::uint32_t reserved;
-};
-
 static_assert(sizeof(NetDhcpOptionInfo) == 24);
 static_assert(offsetof(NetDhcpOptionInfo, capacity) == 4);
 static_assert(offsetof(NetDhcpOptionInfo, data) == 8);
 static_assert(offsetof(NetDhcpOptionInfo, size) == 16);
 
-struct NetSockInfo6;
-struct NetStatisticsInfo;
-struct NetInterfaceStats;
-struct NetRouteInfo;
-struct NetDebugParameter;
-struct NetArpInfo;
-struct NetAppMemoryInfo;
-struct NetSystemMemoryInfo;
-struct NetBandwidthParameter;
-struct NetDataTraffic;
-struct NetEmulationParameter;
-
-struct NetResolverConnection;
-struct NetThreadParameter;
-struct NetIpv4InterfaceAddress;
-struct NetStatisticsInfoInternal;
-struct NetInitializeParameter;
-struct NetDhcpStartParameter;
-struct NetAddress6StartParameter;
-
-using NetAddressCallback = void (APS5_VABI *)(void* userArg, std::int32_t event, std::int32_t error);
-
-struct NetDhcpdStartParameter {
-    std::uint32_t addresses[5];
-    std::uint32_t maxClients;
-};
-
-struct NetPppoeStartParameter {
-    std::uint32_t dnsAddresses[2];
-    char userName[128];
-    char password[128];
-    std::int32_t mtu;
-    std::uint32_t flags;
-};
-
-struct NetRoutingAddressParameter {
-    std::uint32_t address;
-    std::uint32_t mask;
-};
-
-struct NetRoutingServerParameter {
-    std::int32_t count;
-    std::uint32_t localAddresses[2];
-    std::uint32_t remoteAddresses[2];
-};
-
-struct NetRoutingRule {
-    std::int32_t protocol;
-    std::uint32_t firstAddress;
-    std::uint16_t firstPort;
-    std::uint16_t reserved;
-    std::uint32_t secondAddress;
-    std::uint16_t secondPort;
-    std::uint16_t flags;
-};
-
-struct NetRoutingRuleParameter {
-    std::int32_t count;
-    const NetRoutingRule* rules;
-};
-
 static_assert(sizeof(NetRoutingAddressParameter) == 8);
 static_assert(sizeof(NetRoutingServerParameter) == 20);
 static_assert(offsetof(NetRoutingServerParameter, remoteAddresses) == 12);
@@ -163,66 +75,21 @@ static_assert(offsetof(NetPppoeStartParameter, password) == 136);
 static_assert(offsetof(NetPppoeStartParameter, mtu) == 264);
 static_assert(offsetof(NetPppoeStartParameter, flags) == 268);
 
-struct NetInfoDumpParameter {
-    std::uint32_t flags;
-    std::uint32_t intervalSeconds;
-    char path[64];
-};
-
 static_assert(sizeof(NetInfoDumpParameter) == 72);
 static_assert(offsetof(NetInfoDumpParameter, path) == 8);
 
-struct NetInterfaceInfo;
-struct NetInterfaceStatistics;
-
-struct NetResolverConnectOption {
-    std::int32_t connectionTimeout;
-    std::int32_t resolverTimeout;
-    std::int32_t resolverRetryCount;
-    std::uint32_t reserved;
-};
-
 static_assert(sizeof(NetResolverConnectOption) == 16);
 static_assert(offsetof(NetResolverConnectOption, resolverTimeout) == 4);
 static_assert(offsetof(NetResolverConnectOption, resolverRetryCount) == 8);
 static_assert(offsetof(NetResolverConnectOption, reserved) == 12);
 
-struct NetSyncObject {
-    void* mutex;
-    void* condition;
-    std::uint32_t signals;
-    std::uint32_t reserved;
-};
-
 static_assert(sizeof(NetSyncObject) == 24);
 
-using NetEventCallback = std::uint64_t (APS5_VABI*)(std::uint32_t interfaceId, std::uint64_t events, void* userData, void* waitData);
-
-struct NetIpv6Address {
-    std::uint8_t bytes[16];
-};
-
 static_assert(sizeof(NetIpv6Address) == 16);
 
-struct NetDnsInfo {
-    std::uint32_t primaryAddress;
-    std::uint32_t secondaryAddress;
-};
-
-struct NetDns6Info {
-    NetIpv6Address primaryAddress;
-    NetIpv6Address secondaryAddress;
-};
-
 static_assert(sizeof(NetDnsInfo) == 8);
 static_assert(sizeof(NetDns6Info) == 32);
 
-struct NetIpv6InterfaceAddress {
-    NetIpv6Address address;
-    std::uint8_t prefixLength;
-    std::uint8_t reserved[3];
-};
-
 static_assert(sizeof(NetIpv6InterfaceAddress) == 20);
 
 namespace {
@@ -276,14 +143,19 @@ constexpr int NET_TF_NODELAY = 4;
 constexpr int NET_SO_SNDTIMEO = 0x1005;
 constexpr int NET_SO_RCVTIMEO = 0x1006;
 constexpr int NET_SO_ERROR = 0x1007;
+constexpr int NET_SO_PROTOCOL = 0x1016;
 constexpr int NET_SO_NBIO = 0x1200;
 constexpr int NET_SO_REUSEADDR = 0x4;
+constexpr int NET_SO_KEEPALIVE = 0x8;
 constexpr int NET_SO_BROADCAST = 0x20;
 constexpr int NET_SO_ONESBCAST = 0x10000;
+constexpr int NET_SO_OOBINLINE = 0x100;
 constexpr int NET_SO_SNDBUF = 0x1001;
 constexpr int NET_SO_RCVBUF = 0x1002;
 constexpr int NET_SO_SCE_SNDTIMEO = 0x1105;
 constexpr int NET_SO_SCE_RCVTIMEO = 0x1106;
+constexpr int NET_SO_TYPE = 0x1008;
+constexpr int NET_SO_ACCEPTCONN = 0x2;
 constexpr int NET_MSG_PEEK = 0x2;
 constexpr int NET_MSG_TRUNC = 0x10;
 constexpr int NET_MSG_DONTWAIT = 0x80;
@@ -393,15 +265,20 @@ bool native_to_guest_address(const sockaddr_storage& native, void* address, std:
 struct Sock {
     int family = 0;
     int type = 0;
+    int protocol = 0;
     std::shared_ptr<NativeSocketHandle> native;
     bool bound = false;
     bool listening = false;
+    bool connectAttempted = false;
     bool aborted = false;
+    bool sending_shut = false;
     bool read_shut = false;
+    bool oobInline = false;
     int reported_error = 0;
     int snd_buffer = 0;
     int rcv_buffer = 0;
     int onesbcast = 0;
+    int keepalive = 0;
 };
 
 #ifdef _WIN32
@@ -463,11 +340,6 @@ std::map<int, EpollRegistrations> g_epoll_socks;
 std::set<int> g_epoll_aborted;
 std::map<int, std::size_t> g_pools;
 
-struct NetMemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-};
 struct Resolver {
     int error = 0;
     int running = 0;
@@ -488,9 +360,17 @@ int* errno_slot() {
     return &e;
 }
 
-extern "C" int* APS5_VABI __error_nid_postfix();
 extern "C" std::size_t NetCtlHostDnsServers_nid_no_patch(std::uint32_t* servers, std::size_t capacity);
 
+std::mutex g_dnsLock;
+bool g_dnsOverridden = false;
+NetDnsInfo g_dnsOverride{};
+NetDns6Info g_dns6Override{};
+
+bool IsZeroAddress(const NetIpv6Address& address) {
+    return std::all_of(std::begin(address.bytes), std::end(address.bytes), [](std::uint8_t byte) { return byte == 0; });
+}
+
 void set_errno(int err) {
     *errno_slot() = err;
     *__error_nid_postfix() = err;
@@ -501,6 +381,12 @@ int fail(int err) {
     return NET_ERROR_BASE | err;
 }
 
+void* APS5_VABI RunNetThread(void* param) {
+    const auto* thread = static_cast<const NetThreadParameter*>(param);
+    thread->entry(thread->arg);
+    return nullptr;
+}
+
 int set_native_timeout(NativeSocket native, int optname, std::int64_t microseconds) {
     const int native_option = optname == NET_SO_RCVTIMEO ? SO_RCVTIMEO : SO_SNDTIMEO;
 #ifdef _WIN32
@@ -584,20 +470,6 @@ std::uint64_t swap64(std::uint64_t v) {
         ((v >> 8) & 0xFF000000u) | ((v >> 24) & 0xFF0000u) | ((v >> 40) & 0xFF00u) | (v >> 56);
 }
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t name_length;
-    NetIovec* iov;
-    int iov_length;
-    void* control;
-    std::uint32_t control_length;
-    int flags;
-};
 static_assert(sizeof(NetMsghdr) == 48 && offsetof(NetMsghdr, iov) == 16 && offsetof(NetMsghdr, control) == 32 &&
     offsetof(NetMsghdr, flags) == 44);
 
@@ -607,6 +479,14 @@ int timeout_option(int optname) {
     return optname;
 }
 
+#ifdef _WIN32
+short closed_stream_events(const Sock& socket, short native, short requested) {
+    if (socket.type != NET_SOCK_STREAM || (native & (POLLHUP | POLLERR)) != POLLHUP) return native;
+    native = static_cast<short>(native | (requested & POLLRDNORM));
+    return socket.sending_shut ? native : static_cast<short>(native & ~POLLHUP);
+}
+#endif
+
 std::int64_t message_length(const NetMsghdr* message) {
     if (!message) return fail(NET_EFAULT);
     if (message->iov_length < 0 || message->iov_length > NET_UIO_MAXIOV) return fail(NET_EMSGSIZE);
@@ -669,6 +549,24 @@ auto native_transfer(const NativeSocketHandle& socket, int flags, bool send, TOp
 #endif
 }
 
+#ifdef __APPLE__
+template <typename TSend>
+std::int64_t send_stream_in_chunks(const NativeSocketHandle& socket, int flags, const char* data, std::size_t length, TSend sendChunk) {
+    if (!socket.stream || (flags & NET_MSG_DONTWAIT) != 0 || socket.nonblock.load()) return sendChunk(data, length);
+    if (length == 0) return sendChunk(data, 0);
+    constexpr std::size_t Chunk = 65536;
+    std::size_t transferred = 0;
+    do {
+        const auto request = std::min(Chunk, length - transferred);
+        const auto result = sendChunk(data + transferred, request);
+        if (result < 0) return transferred > 0 ? static_cast<std::int64_t>(transferred) : -1;
+        transferred += static_cast<std::size_t>(result);
+        if (static_cast<std::size_t>(result) < request) break;
+    } while (transferred < length);
+    return static_cast<std::int64_t>(transferred);
+}
+#endif
+
 #ifdef _WIN32
 int TransferSocketForKernel(KernelSocketPoll::NativeOwner* owner, bool send, void* buffer, int length) {
     const auto* socket = static_cast<NativeSocketHandle*>(owner);
@@ -683,6 +581,10 @@ int native_message_flags(int flags) {
     int native = (flags & NET_MSG_PEEK) ? MSG_PEEK : 0;
 #ifndef _WIN32
     if (flags & NET_MSG_DONTWAIT) native |= MSG_DONTWAIT;
+#endif
+#ifdef __APPLE__
+    constexpr int XnuMessageNonblocking = 0x20000;
+    if (flags & NET_MSG_DONTWAIT) native |= XnuMessageNonblocking;
 #endif
     return native;
 }
@@ -734,7 +636,24 @@ int wait_for_datagram(const Sock& socket, std::chrono::steady_clock::time_point
 }
 
 int wait_for_local_address(int s, const Sock& socket, bool empty, int flags) {
-    if (socket.type == NET_SOCK_STREAM || socket.bound) return 0;
+    if (socket.type == NET_SOCK_STREAM) {
+#ifdef _WIN32
+        if (!empty) return 0;
+        sockaddr_storage peer{};
+        NativeLength length = sizeof(peer);
+        if (::getpeername(socket.native->value, reinterpret_cast<sockaddr*>(&peer), &length) != 0) {
+            const int error = native_error();
+            return !socket.connectAttempted && !socket.aborted && !socket.read_shut && error == NET_ENOTCONN ? error : 0;
+        }
+        WSAPOLLFD state{};
+        state.fd = socket.native->value;
+        state.events = POLLRDNORM;
+        return WSAPoll(&state, 1, 0) >= 0 && (state.revents & (POLLERR | POLLHUP | POLLNVAL)) == 0 ? RECEIVE_NOTHING : 0;
+#else
+        return 0;
+#endif
+    }
+    if (socket.bound) return 0;
     const bool named = has_local_address(socket.native->value);
     if (!named && (socket.read_shut || empty)) return RECEIVE_NOTHING;
     if (!named && (socket.native->nonblock || (flags & NET_MSG_DONTWAIT) != 0)) return NET_EAGAIN;
@@ -879,8 +798,6 @@ int PollSockets(KernelSocketPoll::Entry* entries, int count, int timeoutMillisec
 
 const bool g_socketPollerRegistered = (KernelSetSocketPoller_nid_no_patch(&PollSockets), true);
 
-extern "C" int APS5_VABI sceNetSocketClose(int s);
-
 bool CloseSocketForKernel(int descriptor, int* error) {
     {
         std::lock_guard lk(g_mutex);
@@ -892,8 +809,6 @@ bool CloseSocketForKernel(int descriptor, int* error) {
 
 const bool g_socketCloserRegistered = (KernelSetSocketCloser_nid_no_patch(&CloseSocketForKernel), true);
 
-extern "C" int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval, uint32_t optlen);
-
 bool SetSocketOptionForKernel(int descriptor, int level, int option, const void* value, std::uint32_t length, int* error) {
     {
         std::lock_guard lk(g_mutex);
@@ -1024,13 +939,14 @@ int APS5_VABI sceNetSocket(const char* name, int family, int type, int protocol)
     Sock s;
     s.family = family;
     s.type = type;
+    s.protocol = protocol;
+    if (protocol == 0 && type == NET_SOCK_STREAM) s.protocol = IPPROTO_TCP;
+    if (protocol == 0 && type == NET_SOCK_DGRAM) s.protocol = IPPROTO_UDP;
     s.native = std::move(handle);
     g_socks[fd] = s;
     return fd;
 }
 
-extern "C" int APS5_VABI close_nid_postfix(int d);
-
 int APS5_VABI sceNetSocketClose(int s) {
     std::shared_ptr<NativeSocketHandle> native;
     bool found = false;
@@ -1148,6 +1064,8 @@ int APS5_VABI sceNetAccept(int s, void* addr, uint32_t* addrlen) {
     Sock connection;
     connection.family = listener.family;
     connection.type = NET_SOCK_STREAM;
+    connection.protocol = listener.protocol;
+    connection.connectAttempted = true;
     connection.native = std::move(handle);
 #ifdef _WIN32
     connection.native->receiveTimeout = listener.native->receiveTimeout.load();
@@ -1230,6 +1148,11 @@ int APS5_VABI sceNetConnect(int s, const void* addr, uint32_t addrlen) {
     if (socket.type == NET_SOCK_STREAM) RefuseClosedLoopbackAtOnce_nid_no_patch(socket.native->value, reinterpret_cast<const sockaddr*>(&native));
 #endif
     if (native.ss_family != (socket.family == NET_AF_INET ? AF_INET : AF_INET6)) return fail(NET_EAFNOSUPPORT);
+    if (socket.type == NET_SOCK_STREAM) {
+        std::lock_guard lock(g_mutex);
+        const auto current = g_socks.find(s);
+        if (current != g_socks.end() && current->second.native == socket.native) current->second.connectAttempted = true;
+    }
     if (::connect(socket.native->value, reinterpret_cast<const sockaddr*>(&native), native_length) == 0) {
 #if defined(_WIN32) || defined(__APPLE__)
         note_local_address(s, socket);
@@ -1282,6 +1205,10 @@ int64_t APS5_VABI sceNetRecv(int s, void* buf, size_t len, int flags) {
     return result >= 0 ? result : fail(native_error());
 }
 
+int64_t APS5_VABI GuestNetRecv_nid_no_patch(int s, void* buf, size_t len, int flags) {
+    return sceNetRecv(s, buf, len, flags);
+}
+
 int64_t APS5_VABI sceNetRecvfrom(int s, void* buf, size_t len, int flags, void* from, uint32_t* fromlen) {
     if (!message_flags_supported(flags, NET_MSG_PEEK | NET_MSG_DONTWAIT)) return fail(NET_EOPNOTSUPP);
     if (!buf && len) return fail(NET_EINVAL);
@@ -1336,12 +1263,22 @@ int64_t APS5_VABI sceNetSend(int s, const void* buf, size_t len, int flags) {
         if (it == g_socks.end()) return fail(NET_EBADF);
         socket = it->second;
     }
+#ifdef __APPLE__
+    const auto result = send_stream_in_chunks(*socket.native, flags, static_cast<const char*>(buf), len, [&](const char* data, std::size_t size) {
+        return ::send(socket.native->value, data, size, NATIVE_SEND_FLAGS | native_message_flags(flags));
+    });
+#else
     const int result = native_transfer(*socket.native, flags, true, [&](int offset) {
         return ::send(socket.native->value, offset ? static_cast<const char*>(buf) + offset : static_cast<const char*>(buf), static_cast<int>(len) - offset, NATIVE_SEND_FLAGS | native_message_flags(flags));
     }, true, static_cast<int>(len));
+#endif
     return result >= 0 ? result : fail(native_error());
 }
 
+int64_t APS5_VABI GuestNetSend_nid_no_patch(int s, const void* buf, size_t len, int flags) {
+    return sceNetSend(s, buf, len, flags);
+}
+
 int64_t APS5_VABI sceNetSendto(int s, const void* buf, size_t len, int flags, const void* to, uint32_t tolen) {
     if (!message_flags_supported(flags, NET_MSG_DONTWAIT)) return fail(NET_EOPNOTSUPP);
     if (!buf && len) return fail(NET_EINVAL);
@@ -1353,21 +1290,38 @@ int64_t APS5_VABI sceNetSendto(int s, const void* buf, size_t len, int flags, co
         if (it == g_socks.end()) return fail(NET_EBADF);
         socket = it->second;
     }
+#ifdef __APPLE__
+    std::int64_t result;
+#else
     int result;
+#endif
     if (!to) {
         if (tolen != 0) return fail(NET_EINVAL);
+#ifdef __APPLE__
+        result = send_stream_in_chunks(*socket.native, flags, static_cast<const char*>(buf), len, [&](const char* data, std::size_t size) {
+            return ::send(socket.native->value, data, size, NATIVE_SEND_FLAGS | native_message_flags(flags));
+        });
+#else
         result = native_transfer(*socket.native, flags, true, [&](int offset) {
             return ::send(socket.native->value, offset ? static_cast<const char*>(buf) + offset : static_cast<const char*>(buf), static_cast<int>(len) - offset, NATIVE_SEND_FLAGS | native_message_flags(flags));
         }, true, static_cast<int>(len));
+#endif
     } else {
         sockaddr_storage destination{};
         NativeLength destination_length = 0;
         if (!guest_to_native_address(to, tolen, destination, destination_length)) return fail(NET_EINVAL);
         if (destination.ss_family != (socket.family == NET_AF_INET ? AF_INET : AF_INET6)) return fail(NET_EAFNOSUPPORT);
+#ifdef __APPLE__
+        result = send_stream_in_chunks(*socket.native, flags, static_cast<const char*>(buf), len, [&](const char* data, std::size_t size) {
+            return ::sendto(socket.native->value, data, size, NATIVE_SEND_FLAGS | native_message_flags(flags),
+                reinterpret_cast<const sockaddr*>(&destination), destination_length);
+        });
+#else
         result = native_transfer(*socket.native, flags, true, [&](int offset) {
             return ::sendto(socket.native->value, offset ? static_cast<const char*>(buf) + offset : static_cast<const char*>(buf), static_cast<int>(len) - offset, NATIVE_SEND_FLAGS | native_message_flags(flags),
                 reinterpret_cast<const sockaddr*>(&destination), destination_length);
         }, true, static_cast<int>(len));
+#endif
     }
     if (result < 0) return fail(native_error());
 #if defined(_WIN32) || defined(__APPLE__)
@@ -1476,11 +1430,15 @@ int APS5_VABI sceNetShutdown(int s, int how) {
         if (it != g_socks.end() && it->second.native == socket.native) it->second.read_shut = true;
         g_cv.NotifyAll();
     }
-    return error == 0 ? 0 : fail(error);
+    if (error != 0) return fail(error);
+    if (how != 0) {
+        std::lock_guard lk(g_mutex);
+        const auto it = g_socks.find(s);
+        if (it != g_socks.end() && it->second.native == socket.native) it->second.sending_shut = true;
+    }
+    return 0;
 }
 
-extern "C" int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length);
-
 int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval, uint32_t optlen) {
     Sock socket;
     bool found = false;
@@ -1516,7 +1474,12 @@ int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval
     if (!optval || optlen < sizeof(int)) return fail(NET_EINVAL);
     int value = 0;
     std::memcpy(&value, optval, sizeof(value));
-    if (optname == NET_SO_NBIO) {
+    if (optname == NET_SO_OOBINLINE) {
+        const int enabled = value != 0;
+        if (socket.type == NET_SOCK_STREAM &&
+            ::setsockopt(socket.native->value, SOL_SOCKET, SO_OOBINLINE, reinterpret_cast<const char*>(&enabled), sizeof(enabled)) != 0)
+            return fail(native_error());
+    } else if (optname == NET_SO_NBIO) {
 #ifndef _WIN32
         const int old_flags = fcntl(socket.native->value, F_GETFL, 0);
         if (old_flags < 0 || fcntl(socket.native->value, F_SETFL,
@@ -1530,6 +1493,11 @@ int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval
         const int native_option = optname == NET_SO_REUSEADDR ? SO_REUSEADDR : optname == NET_SO_BROADCAST ? SO_BROADCAST : optname == NET_SO_SNDBUF ? SO_SNDBUF : SO_RCVBUF;
         if (::setsockopt(socket.native->value, SOL_SOCKET, native_option, reinterpret_cast<const char*>(&value), sizeof(value)) != 0)
             return fail(native_error());
+    } else if (optname == NET_SO_KEEPALIVE) {
+        const int enabled = value != 0;
+        if (socket.type == NET_SOCK_STREAM &&
+            ::setsockopt(socket.native->value, SOL_SOCKET, SO_KEEPALIVE, reinterpret_cast<const char*>(&enabled), sizeof(enabled)) != 0)
+            return fail(native_error());
     } else if (optname == NET_SO_ONESBCAST) {
     } else {
         return fail(NET_EOPNOTSUPP);
@@ -1537,12 +1505,14 @@ int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval
     std::lock_guard lk(g_mutex);
     auto it = g_socks.find(s);
     if (it != g_socks.end()) {
+        if (optname == NET_SO_OOBINLINE && it->second.native == socket.native) it->second.oobInline = value != 0;
         if (optname == NET_SO_NBIO) it->second.native->nonblock = value != 0;
         if (optname == NET_SO_RCVTIMEO) it->second.native->receiveTimeout = value;
         if (optname == NET_SO_SNDTIMEO) it->second.native->sendTimeout = value;
         if (optname == NET_SO_SNDBUF) it->second.snd_buffer = value;
         if (optname == NET_SO_RCVBUF) it->second.rcv_buffer = value;
         if (optname == NET_SO_ONESBCAST) it->second.onesbcast = value;
+        if (optname == NET_SO_KEEPALIVE) it->second.keepalive = value != 0 ? NET_SO_KEEPALIVE : 0;
     }
     return 0;
 }
@@ -1556,6 +1526,32 @@ int APS5_VABI sceNetGetsockopt(int s, int level, int optname, void* optval, uint
         socket = it->second;
     }
     if (optval == nullptr || optlen == nullptr) return fail(NET_EINVAL);
+    if (level == NET_SOL_SOCKET && (optname == NET_SO_TYPE || optname == NET_SO_ACCEPTCONN)) {
+        const int value = optname == NET_SO_TYPE ? socket.type : socket.listening ? NET_SO_ACCEPTCONN : 0;
+        *optlen = std::min(*optlen, static_cast<std::uint32_t>(sizeof(value)));
+        std::memcpy(optval, &value, *optlen);
+        return 0;
+    }
+    if (level == NET_SOL_SOCKET && optname == NET_SO_OOBINLINE) {
+        int enabled = 0;
+        if (socket.type == NET_SOCK_STREAM) {
+            NativeLength size = sizeof(enabled);
+            if (::getsockopt(socket.native->value, SOL_SOCKET, SO_OOBINLINE, reinterpret_cast<char*>(&enabled), &size) != 0)
+                return fail(native_error());
+        } else {
+            enabled = socket.oobInline;
+        }
+        const int value = enabled != 0 ? NET_SO_OOBINLINE : 0;
+        *optlen = std::min(*optlen, static_cast<std::uint32_t>(sizeof(value)));
+        std::memcpy(optval, &value, *optlen);
+        return 0;
+    }
+    if (level == NET_SOL_SOCKET && optname == NET_SO_PROTOCOL) {
+        if (socket.type == NET_SOCK_RAW) NotImplemented_nid_no_patch(__func__);
+        *optlen = std::min(*optlen, static_cast<std::uint32_t>(sizeof(socket.protocol)));
+        std::memcpy(optval, &socket.protocol, *optlen);
+        return 0;
+    }
     if (level == NET_SOL_SOCKET && (optname == NET_SO_RCVTIMEO || optname == NET_SO_SNDTIMEO)) {
         const int microseconds = optname == NET_SO_RCVTIMEO ? socket.native->receiveTimeout.load() : socket.native->sendTimeout.load();
         const KernelTimeval timeout{microseconds / 1000000, microseconds % 1000000};
@@ -1563,7 +1559,18 @@ int APS5_VABI sceNetGetsockopt(int s, int level, int optname, void* optval, uint
         std::memcpy(optval, &timeout, *optlen);
         return 0;
     }
-    if (*optlen < sizeof(int)) return fail(NET_EINVAL);
+    if (level == NET_SOL_SOCKET && optname == NET_SO_KEEPALIVE) {
+        int enabled = socket.keepalive;
+        if (socket.type == NET_SOCK_STREAM) {
+            NativeLength size = sizeof(enabled);
+            if (::getsockopt(socket.native->value, SOL_SOCKET, SO_KEEPALIVE, reinterpret_cast<char*>(&enabled), &size) != 0)
+                return fail(native_error());
+        }
+        const int value = enabled != 0 ? NET_SO_KEEPALIVE : 0;
+        *optlen = std::min(*optlen, static_cast<std::uint32_t>(sizeof(value)));
+        std::memcpy(optval, &value, *optlen);
+        return 0;
+    }
     if (level == NET_IPPROTO_TCP && socket.type != NET_SOCK_STREAM) return fail(NET_EINVAL);
     if (level == NET_IPPROTO_TCP && optname == NET_TCP_NODELAY) {
         int enabled = 0;
@@ -1571,14 +1578,26 @@ int APS5_VABI sceNetGetsockopt(int s, int level, int optname, void* optval, uint
         if (::getsockopt(socket.native->value, IPPROTO_TCP, TCP_NODELAY, reinterpret_cast<char*>(&enabled), &size) != 0)
             return fail(native_error());
         const int value = enabled != 0 ? NET_TF_NODELAY : 0;
-        std::memcpy(optval, &value, sizeof(value));
-        *optlen = sizeof(value);
+        *optlen = std::min(*optlen, static_cast<std::uint32_t>(sizeof(value)));
+        std::memcpy(optval, &value, *optlen);
         return 0;
     }
+    if (*optlen < sizeof(int) &&
+        !(level == NET_SOL_SOCKET && (optname == NET_SO_REUSEADDR || optname == NET_SO_BROADCAST))) return fail(NET_EINVAL);
     if (level == NET_IPPROTO_TCP) return fail(NET_ENOPROTOOPT);
     if (level != NET_SOL_SOCKET) return fail(NET_EOPNOTSUPP);
     int value = 0;
     switch (timeout_option(optname)) {
+        case NET_SO_REUSEADDR:
+        case NET_SO_BROADCAST: {
+            int enabled = 0;
+            NativeLength size = sizeof(enabled);
+            const int nativeOption = optname == NET_SO_REUSEADDR ? SO_REUSEADDR : SO_BROADCAST;
+            if (::getsockopt(socket.native->value, SOL_SOCKET, nativeOption, reinterpret_cast<char*>(&enabled), &size) != 0)
+                return fail(native_error());
+            value = enabled != 0 ? optname : 0;
+            break;
+        }
         case NET_SO_NBIO: value = socket.native->nonblock ? 1 : 0; break;
         case NET_SO_RCVTIMEO: value = socket.native->receiveTimeout; break;
         case NET_SO_SNDTIMEO: value = socket.native->sendTimeout; break;
@@ -1610,8 +1629,8 @@ int APS5_VABI sceNetGetsockopt(int s, int level, int optname, void* optval, uint
         }
         default: return fail(NET_EOPNOTSUPP);
     }
-    std::memcpy(optval, &value, sizeof(value));
-    *optlen = sizeof(value);
+    *optlen = std::min(*optlen, static_cast<std::uint32_t>(sizeof(value)));
+    std::memcpy(optval, &value, *optlen);
     return 0;
 }
 
@@ -1656,7 +1675,9 @@ int APS5_VABI sceNetGetpeername(int s, void* addr, uint32_t* addrlen) {
 
 constexpr int NET_SOCKINFO_F_SELF = 0x1;
 constexpr int NET_SOCKINFO_F_NONBLOCK = 0x200000;
+constexpr int NET_SOCKINFO_F_IPV6 = 0x400000;
 constexpr int NET_SOCKINFO_TIME_WAIT = 0x40;
+constexpr int NET_SOCKINFO6_IPV46 = 0x1000;
 
 struct NetSockInfo {
     char name[32];
@@ -1693,6 +1714,11 @@ struct NetSockInfo {
 static_assert(sizeof(NetSockInfo) == 0xA0 && offsetof(NetSockInfo, s) == 0x24 && offsetof(NetSockInfo, local_adr) == 0x34 &&
     offsetof(NetSockInfo, local_port) == 0x3C && offsetof(NetSockInfo, recv_buffer_size) == 0x64);
 
+static_assert(sizeof(NetSockInfo6) == sizeof(NetSockInfo) && offsetof(NetSockInfo6, s) == offsetof(NetSockInfo, s) &&
+    offsetof(NetSockInfo6, local_port) == offsetof(NetSockInfo, local_port) && offsetof(NetSockInfo6, flags) == offsetof(NetSockInfo, flags) &&
+    offsetof(NetSockInfo6, recv_buffer_size) == offsetof(NetSockInfo, recv_buffer_size) && offsetof(NetSockInfo6, local_adr6) == 0x6C &&
+    offsetof(NetSockInfo6, remote_adr6) == 0x7C && offsetof(NetSockInfo6, tx_drops) == offsetof(NetSockInfo, tx_drops));
+
 static int sock_buffer_size(const Sock& socket, bool send, std::int32_t& value) {
     value = send ? socket.snd_buffer : socket.rcv_buffer;
     if (value != 0) return 0;
@@ -1766,9 +1792,88 @@ int APS5_VABI sceNetGetSockInfo(int s, void* info, int n, int flags) {
     return written;
 }
 
+static int fill_sock_info6(int s, NetSockInfo6& record, bool includeIpv4) {
+    Sock socket;
+    {
+        std::lock_guard lk(g_mutex);
+        const auto it = g_socks.find(s);
+        if (it == g_socks.end()) return NET_EBADF;
+        socket = it->second;
+    }
+    const bool ipv6 = socket.family == NET_AF_INET6;
+    if (!ipv6 && !(includeIpv4 && socket.family == NET_AF_INET)) return NET_EAFNOSUPPORT;
+    sockaddr_storage local{};
+    NativeLength length = sizeof(local);
+    if (::getsockname(socket.native->value, reinterpret_cast<sockaddr*>(&local), &length) != 0) {
+#ifdef _WIN32
+        if (WSAGetLastError() != WSAEINVAL) return native_error();
+#else
+        return native_error();
+#endif
+    }
+    sockaddr_storage remote{};
+    length = sizeof(remote);
+    if (::getpeername(socket.native->value, reinterpret_cast<sockaddr*>(&remote), &length) != 0) {
+        const int error = native_error();
+        if (error != NET_ENOTCONN) return error;
+    }
+    record = {};
+    if (const int error = sock_buffer_size(socket, false, record.recv_buffer_size)) return error;
+    if (const int error = sock_buffer_size(socket, true, record.send_buffer_size)) return error;
+    record.s = s;
+    record.socket_type = static_cast<std::int8_t>(socket.type);
+    record.flags = NET_SOCKINFO_F_SELF | (socket.native->nonblock ? NET_SOCKINFO_F_NONBLOCK : 0);
+    if (ipv6) {
+        const auto& local6 = reinterpret_cast<const sockaddr_in6&>(local);
+        const auto& remote6 = reinterpret_cast<const sockaddr_in6&>(remote);
+        std::memcpy(record.local_adr6, &local6.sin6_addr, sizeof(record.local_adr6));
+        std::memcpy(record.remote_adr6, &remote6.sin6_addr, sizeof(record.remote_adr6));
+        record.local_port = local6.sin6_port;
+        record.remote_port = remote6.sin6_port;
+        record.flags |= NET_SOCKINFO_F_IPV6;
+    } else {
+        const auto& local4 = reinterpret_cast<const sockaddr_in&>(local);
+        const auto& remote4 = reinterpret_cast<const sockaddr_in&>(remote);
+        record.local_adr = local4.sin_addr.s_addr;
+        record.remote_adr = remote4.sin_addr.s_addr;
+        record.local_port = local4.sin_port;
+        record.remote_port = remote4.sin_port;
+    }
+    return 0;
+}
+
+int APS5_VABI sceNetGetSockInfo6(std::int32_t s, NetSockInfo6* info, std::uint32_t capacity, std::uint32_t flags) {
+    if ((flags & ~(NET_SOCKINFO_TIME_WAIT | NET_SOCKINFO6_IPV46)) != 0) return fail(NET_EINVAL);
+    const bool includeIpv4 = (flags & NET_SOCKINFO6_IPV46) != 0;
+    std::vector<int> listed;
+    if (s < 0) {
+        std::lock_guard lk(g_mutex);
+        for (const auto& [descriptor, socket] : g_socks) {
+            if (socket.family == NET_AF_INET6 || (includeIpv4 && socket.family == NET_AF_INET)) listed.push_back(descriptor);
+        }
+    }
+    if (!info) return s < 0 ? static_cast<int>(listed.size()) : fail(NET_EINVAL);
+    if (static_cast<std::int32_t>(capacity) < 1) return fail(NET_EINVAL);
+    NetSockInfo6 record;
+    if (s >= 0) {
+        if (const int error = fill_sock_info6(s, record, includeIpv4)) return fail(error);
+        *info = record;
+        return 1;
+    }
+    int written = 0;
+    for (const int descriptor : listed) {
+        if (written == static_cast<std::int32_t>(capacity)) break;
+        const int error = fill_sock_info6(descriptor, record, includeIpv4);
+        if (error == NET_EBADF || error == NET_EAFNOSUPPORT) continue;
+        if (error != 0) return fail(error);
+        info[written] = record;
+        ++written;
+    }
+    return written;
+}
+
 int APS5_VABI sceNetEpollCreate(const char* name, int flags) {
-    (void)name;
-    (void)flags;
+    if (!name || flags != 0) return fail(NET_EINVAL);
     std::lock_guard lk(g_mutex);
     const int id = g_next_epoll++;
     g_epolls.insert(id);
@@ -1858,7 +1963,7 @@ int APS5_VABI sceNetEpollWait(int eid, NetEpollEvent* events, int maxevents, int
     struct Watch {
         int descriptor;
         std::shared_ptr<const NetEpollEvent> registration;
-        std::shared_ptr<NativeSocketHandle> native;
+        Sock socket;
     };
     const auto deadline = timeout > 0
         ? std::chrono::steady_clock::now() + std::chrono::microseconds(timeout)
@@ -1874,7 +1979,7 @@ int APS5_VABI sceNetEpollWait(int eid, NetEpollEvent* events, int maxevents, int
                 for (const auto& entry : registration->second) {
                     const auto socket = g_socks.find(entry.first);
                     if (socket == g_socks.end()) continue;
-                    watches.push_back({entry.first, entry.second, socket->second.native});
+                    watches.push_back({entry.first, entry.second, socket->second});
                 }
             }
         }
@@ -1892,14 +1997,14 @@ int APS5_VABI sceNetEpollWait(int eid, NetEpollEvent* events, int maxevents, int
 #ifdef _WIN32
         std::vector<WSAPOLLFD> descriptors(watches.size());
         for (std::size_t index = 0; index < descriptors.size(); ++index) {
-            descriptors[index].fd = watches[index].native->value;
+            descriptors[index].fd = watches[index].socket.native->value;
             if (watches[index].registration->events & 1) descriptors[index].events |= POLLRDNORM;
             if (watches[index].registration->events & 2) descriptors[index].events |= POLLWRNORM;
         }
 #else
         std::vector<pollfd> descriptors(watches.size());
         for (std::size_t index = 0; index < descriptors.size(); ++index) {
-            descriptors[index].fd = watches[index].native->value;
+            descriptors[index].fd = watches[index].socket.native->value;
             if (watches[index].registration->events & 1) descriptors[index].events |= POLLIN;
             if (watches[index].registration->events & 2) descriptors[index].events |= POLLOUT;
         }
@@ -1914,6 +2019,8 @@ int APS5_VABI sceNetEpollWait(int eid, NetEpollEvent* events, int maxevents, int
         }
 #ifdef _WIN32
         const int ready_count = WSAPoll(descriptors.data(), static_cast<ULONG>(descriptors.size()), wait_ms);
+        for (std::size_t index = 0; index < descriptors.size(); ++index)
+            descriptors[index].revents = closed_stream_events(watches[index].socket, descriptors[index].revents, descriptors[index].events);
 #else
         const int ready_count = ::poll(descriptors.data(), descriptors.size(), wait_ms);
 #endif
@@ -1962,20 +2069,32 @@ uint32_t APS5_VABI sceNetNtohl_nid_postfix(uint32_t net32) { return swap32(net32
 uint16_t APS5_VABI sceNetNtohs_nid_postfix(uint16_t net16) { return swap16(net16); }
 
 int APS5_VABI sceNetInetPton(int af, const char* src, void* dst) {
-    if (src == nullptr || dst == nullptr) {
+    if (src == nullptr) {
         return fail(NET_EINVAL);
     }
     if (af != NET_AF_INET && af != NET_AF_INET6) {
         return fail(NET_EAFNOSUPPORT);
     }
-    const std::string text = af == NET_AF_INET ? std::string(src, std::strcspn(src, " \t\n\v\f\r")) : std::string(src);
-    std::array<unsigned char, 16> address{};
+    if (dst == nullptr && af == NET_AF_INET6) {
+        return fail(NET_EINVAL);
+    }
+    const auto convert = [](int family, const std::string& text, unsigned char* address) {
 #ifdef _WIN32
-    const int converted = InetPtonA(af == NET_AF_INET ? AF_INET : AF_INET6, text.c_str(), address.data());
+        return InetPtonA(family, text.c_str(), address);
 #else
-    const int converted = ::inet_pton(af == NET_AF_INET ? AF_INET : AF_INET6, text.c_str(), address.data());
+        return ::inet_pton(family, text.c_str(), address);
 #endif
-    if (converted == 1) {
+    };
+    const std::string head(src, std::strcspn(src, " \t\n\v\f\r"));
+    const auto colon = head.rfind(':');
+    const bool dottedTail = af == NET_AF_INET6 && colon != std::string::npos && head.find('.', colon) != std::string::npos;
+    std::array<unsigned char, 16> address{};
+    if (dottedTail && convert(AF_INET, head.substr(colon + 1), address.data()) != 1) {
+        return 0;
+    }
+    const std::string text = af == NET_AF_INET || dottedTail ? head : std::string(src);
+    const int converted = af == NET_AF_INET6 ? __inet_pton_nid_postfix(af, text.c_str(), address.data()) : convert(AF_INET, text, address.data());
+    if (converted == 1 && dst != nullptr) {
         std::memcpy(dst, address.data(), af == NET_AF_INET ? 4 : 16);
     }
     return converted;
@@ -1992,9 +2111,9 @@ const char* APS5_VABI sceNetInetNtop(int af, const void* src, char* dst, uint32_
     }
     char text[INET6_ADDRSTRLEN];
 #ifdef _WIN32
-    const auto* result = InetNtopA(af == NET_AF_INET ? AF_INET : AF_INET6, const_cast<void*>(src), text, sizeof(text));
+    const auto* result = af == NET_AF_INET6 ? __inet_ntop_nid_postfix(af, src, text, sizeof(text)) : InetNtopA(AF_INET, const_cast<void*>(src), text, sizeof(text));
 #else
-    const auto* result = ::inet_ntop(af == NET_AF_INET ? AF_INET : AF_INET6, src, text, sizeof(text));
+    const auto* result = af == NET_AF_INET6 ? __inet_ntop_nid_postfix(af, src, text, sizeof(text)) : ::inet_ntop(AF_INET, src, text, sizeof(text));
 #endif
     if (!result) {
         set_errno(native_error());
@@ -2040,8 +2159,7 @@ int APS5_VABI sceNetEtherStrton(const char* text, NetEtherAddr* address) {
 }
 
 int APS5_VABI sceNetGetMacAddress(NetEtherAddr* addr, int flags) {
-    (void)flags;
-    if (addr == nullptr) {
+    if (addr == nullptr || flags != 0) {
         return fail(NET_EINVAL);
     }
     // Keep guest identity stable without exposing the host adapter address.
@@ -2054,7 +2172,7 @@ int APS5_VABI sceNetGetMacAddress(NetEtherAddr* addr, int flags) {
 int APS5_VABI sceNetResolverCreate(const char* name, int memid, int flags) {
     (void)name;
     (void)memid;
-    (void)flags;
+    if (flags != 0) return fail(NET_EINVAL);
     std::lock_guard lk(g_mutex);
     const int id = g_next_resolver++;
     g_resolvers[id] = {};
@@ -2114,9 +2232,7 @@ int lookup_ipv4(int rid, const char* hostname, const char* func, std::vector<std
 }
 
 int APS5_VABI sceNetResolverStartNtoa(int rid, const char* hostname, void* addr, int timeout, int retry, int flags) {
-    (void)timeout;
-    (void)retry;
-    (void)flags;
+    if (timeout < 0 || retry < 0 || (static_cast<unsigned>(flags) & 0xfffefffeu) != 0) return fail(NET_EINVAL);
     if (!hostname || !addr) return fail(NET_EINVAL);
     std::vector<std::uint32_t> addresses;
     if (const int error = lookup_ipv4(rid, hostname, __func__, addresses)) return error;
@@ -2135,19 +2251,6 @@ int APS5_VABI sceNetResolverStartNtoa6(int rid, const char* hostname, void* addr
     return 0;
 }
 
-struct NetResolverRecord {
-    std::uint32_t address;
-    std::uint8_t address6[12];
-    std::int32_t family;
-    std::int32_t reserved[3];
-};
-
-struct NetResolverInfo {
-    NetResolverRecord records[10];
-    std::int32_t count;
-    std::int32_t count4;
-    std::int32_t reserved[14];
-};
 static_assert(sizeof(NetResolverRecord) == 32 && offsetof(NetResolverRecord, family) == 16);
 static_assert(sizeof(NetResolverInfo) == 384 && offsetof(NetResolverInfo, count) == 320 && offsetof(NetResolverInfo, count4) == 324);
 
@@ -2270,7 +2373,14 @@ int APS5_VABI sceNetGetInterfaceStats(NetInterfaceStats* stats, std::uint32_t fl
 }
 
 int APS5_VABI sceNetSetDnsInfo(const NetDnsInfo* info, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
+    if (!g_net_inited) return fail(NET_ENOTINIT);
+    if (flags != 0) return fail(NET_EINVAL);
+    NetDnsInfo servers{};
+    if (info && !GuestSocketReadGuest_nid_no_patch(&servers, info, sizeof(servers))) return fail(NET_EFAULT);
+    if (info && servers.primaryAddress == 0) return fail(NET_EINVAL);
+    std::lock_guard lock(g_dnsLock);
+    g_dnsOverridden = info != nullptr;
+    g_dnsOverride = servers;
     return 0;
 }
 
@@ -2280,7 +2390,6 @@ int APS5_VABI sceNetShowIfconfigWithMemory(std::int32_t poolId) {
 }
 
 int APS5_VABI sceNetShowPolicy(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -2294,7 +2403,8 @@ int APS5_VABI sceNetShowRoute(void) {
 }
 
 int APS5_VABI sceNetShowRouteWithMemory(std::int32_t poolId) {
-    NotImplemented_nid_no_patch(__func__);
+    std::lock_guard lk(g_mutex);
+    if (g_pools.find(poolId) == g_pools.end()) return fail(NET_EBADF);
     return 0;
 }
 
@@ -2318,13 +2428,14 @@ int APS5_VABI sceNetResolverConnectDestroy(NetResolverConnection* connection) {
     return 0;
 }
 
-int APS5_VABI sceNetGetSockInfo6(std::int32_t socket, NetSockInfo6* info, std::uint32_t capacity, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNetSetDns6Info(const NetDns6Info* info, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
+    if (!g_net_inited) return fail(NET_ENOTINIT);
+    if (flags != 0) return fail(NET_EINVAL);
+    NetDns6Info servers{};
+    if (info && !GuestSocketReadGuest_nid_no_patch(&servers, info, sizeof(servers))) return fail(NET_EFAULT);
+    if (info && IsZeroAddress(servers.primaryAddress)) return fail(NET_EINVAL);
+    std::lock_guard lock(g_dnsLock);
+    g_dns6Override = servers;
     return 0;
 }
 
@@ -2393,8 +2504,15 @@ int APS5_VABI sceNetGetAppMemInfo(NetAppMemoryInfo* info, std::uint32_t flags) {
 }
 
 int APS5_VABI sceNetGetDnsInfo(NetDnsInfo* info, std::uint32_t flags) {
-    if (flags != 0) throw std::runtime_error("sceNetGetDnsInfo: flags " + std::to_string(flags) + " are not supported");
-    if (!info) throw std::runtime_error("sceNetGetDnsInfo: a null info is not supported");
+    if (!g_net_inited) return fail(NET_ENOTINIT);
+    if (flags != 0 || !info) return fail(NET_EINVAL);
+    {
+        std::lock_guard lock(g_dnsLock);
+        if (g_dnsOverridden) {
+            *info = g_dnsOverride;
+            return info->secondaryAddress == 0 ? 1 : 2;
+        }
+    }
     std::array<std::uint32_t, 2> servers{};
     const std::size_t count = std::min(NetCtlHostDnsServers_nid_no_patch(servers.data(), servers.size()), servers.size());
     std::memcpy(info, servers.data(), sizeof(servers));
@@ -2474,21 +2592,22 @@ int APS5_VABI sceNetInetPtonEx(int af, const char* src, void* dst, int) {
     if (af != NET_AF_INET) {
         return sceNetInetPton(af, src, dst);
     }
-    if (src == nullptr || dst == nullptr) {
+    if (src == nullptr) {
         return fail(NET_EINVAL);
     }
     std::uint32_t address = 0;
     if (!parse_ipv4_parts(src, address)) {
         return 0;
     }
+    if (dst == nullptr) {
+        return 1;
+    }
     const std::array<unsigned char, 4> bytes{static_cast<unsigned char>(address >> 24), static_cast<unsigned char>(address >> 16),
                                              static_cast<unsigned char>(address >> 8), static_cast<unsigned char>(address)};
     std::memcpy(dst, bytes.data(), bytes.size());
     return 1;
 }
 
-extern "C" int APS5_VABI ioctl_nid_postfix(int descriptor, std::uint64_t request, void* argument);
-
 int APS5_VABI sceNetIoctl(int socketId, std::uint32_t command, void* argument) {
     constexpr std::uint32_t nonblockingRequest = 0x8004667e;
     constexpr std::uint32_t readableRequest = 0x4004667f;
@@ -2585,23 +2704,29 @@ int APS5_VABI sceNetSysctl(const int* name, std::uint32_t nameLength, void* oldV
 }
 
 int APS5_VABI sceNetThreadCreate(Pthread* thread, const NetThreadParameter* parameter, const char* name) {
-    NotImplemented_nid_no_patch(__func__);
+    if (!parameter) return fail(NET_EINVAL);
+    Pthread created = nullptr;
+    const int result = scePthreadCreate(&created, nullptr, RunNetThread, const_cast<NetThreadParameter*>(parameter), name != nullptr ? name : "");
+    if (result != 0) return result;
+    if (thread) *thread = created;
     return 0;
 }
 
-int APS5_VABI sceNetThreadExit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI sceNetThreadExit() {
+    scePthreadExit(nullptr);
 }
 
 int APS5_VABI sceNetThreadJoin(void* thread) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return scePthreadJoin(static_cast<Pthread>(thread), nullptr);
 }
 
 int APS5_VABI sceNetUsleep(int microseconds) {
     if (!g_net_inited) return fail(NET_ENOTINIT);
-    if (microseconds < 0) return fail(NET_EINVAL);
+    if (microseconds < 0) {
+        std::fprintf(stdout, "[LIBNET] usleep %d\n", microseconds);
+        std::fflush(stdout);
+        return fail(NET_EINVAL);
+    }
     const int result = sceKernelUsleep_nid_postfix(static_cast<KernelUseconds>(microseconds));
     if (result < 0) set_errno((result & 0xFF00) == 0x100 ? result & 0xFF : 205);
     return result;
@@ -2623,7 +2748,7 @@ int APS5_VABI sceNetShowNetstatForBuffer(char* buffer, std::int32_t bufferSize,
 }
 
 int APS5_VABI sceNetShowNetstatEx(std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
+    (void)flags;
     return 0;
 }
 
@@ -2643,8 +2768,12 @@ int APS5_VABI sceNetInetPtonWithScopeId(std::int32_t family, const char* text, v
 }
 
 int APS5_VABI sceNetGetDns6Info(NetDns6Info* info, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (!g_net_inited) return fail(NET_ENOTINIT);
+    if (flags != 0 || !info) return fail(NET_EINVAL);
+    std::lock_guard lock(g_dnsLock);
+    *info = g_dns6Override;
+    if (IsZeroAddress(info->primaryAddress)) return 0;
+    return IsZeroAddress(info->secondaryAddress) ? 1 : 2;
 }
 
 int APS5_VABI sceNetSetDns6InfoToKernel(const NetDns6Info* info, std::uint32_t flags) {
@@ -3152,14 +3281,12 @@ int APS5_VABI sceNetEmulationDebugSettingsGet(NetEmulationParameter* parameter,
     return 0;
 }
 
-int APS5_VABI sceNetEmulationSet(const NetEmulationParameter* parameter, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNetEmulationSet(const NetEmulationParameter*, std::uint32_t) {
+    return fail(NET_EOPNOTSUPP);
 }
 
-int APS5_VABI sceNetEmulationGet(NetEmulationParameter* parameter, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNetEmulationGet(NetEmulationParameter*, std::uint32_t) {
+    return fail(NET_EOPNOTSUPP);
 }
 
 }
diff --git a/core/libs/prx/libSceNet/include/Net.hpp b/core/libs/prx/libSceNet/include/Net.hpp
new file mode 100644
index 0000000000..deffa39409
--- /dev/null
+++ b/core/libs/prx/libSceNet/include/Net.hpp
@@ -0,0 +1,438 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NetRoutingRule {
+    std::int32_t protocol;
+    std::uint32_t firstAddress;
+    std::uint16_t firstPort;
+    std::uint16_t reserved;
+    std::uint32_t secondAddress;
+    std::uint16_t secondPort;
+    std::uint16_t flags;
+};
+
+struct NetIovec {
+    void* base;
+    std::uint64_t length;
+};
+
+struct NetResolverRecord {
+    std::uint32_t address;
+    std::uint8_t address6[12];
+    std::int32_t family;
+    std::int32_t reserved[3];
+};
+
+struct NetWlanInformationElement;
+struct NetWlanWakeParameter;
+struct NetWlanScanParameter;
+struct NetWlanScanResult;
+struct NetWlanAdhocScanParameter;
+struct NetWlanInfraScanParameter;
+struct NetWlanJoinResult;
+struct NetDumpFilterParameter;
+struct NetWlanAdhocParameter;
+struct NetWlanWakeInfo;
+struct NetWlanPspWakeInfo;
+struct NetWlanPspWakeParameter;
+struct NetWlanApParameter;
+struct NetWlanDeviceInfo;
+struct NetWlanAntennaParameter;
+struct NetWlanRateParameter;
+struct NetWlanDeviceConfiguration;
+struct NetWlanRssiInfo;
+struct NetDhcpInfo;
+struct NetAutoIpInfo;
+struct NetAddress6Info;
+
+struct NetDhcpOptionInfo {
+    std::uint32_t option;
+    std::uint32_t capacity;
+    void* data;
+    std::uint32_t size;
+    std::uint32_t reserved;
+};
+
+struct NetSockInfo6 {
+    char name[32];
+    std::int32_t pid;
+    std::int32_t s;
+    std::int8_t socket_type;
+    std::int8_t policy;
+    std::int8_t priority;
+    std::int8_t reserved8;
+    std::int32_t recv_queue_length;
+    std::int32_t send_queue_length;
+    std::uint32_t local_adr;
+    std::uint32_t remote_adr;
+    std::uint16_t local_port;
+    std::uint16_t remote_port;
+    std::uint16_t local_vport;
+    std::uint16_t remote_vport;
+    std::int32_t state;
+    std::int32_t flags;
+    std::int32_t tx_bps;
+    std::int32_t rx_bps;
+    std::int32_t max_tx_bps;
+    std::int32_t max_rx_bps;
+    std::int32_t tx_vbps;
+    std::int32_t rx_vbps;
+    std::int32_t recv_buffer_size;
+    std::int32_t send_buffer_size;
+    std::uint8_t local_adr6[16];
+    std::uint8_t remote_adr6[16];
+    std::int32_t tx_drops;
+    std::int32_t rx_drops;
+    std::int32_t tx_wait;
+    std::int32_t reserved[2];
+};
+struct NetStatisticsInfo;
+struct NetInterfaceStats;
+struct NetRouteInfo;
+struct NetDebugParameter;
+struct NetArpInfo;
+struct NetAppMemoryInfo;
+struct NetSystemMemoryInfo;
+struct NetBandwidthParameter;
+struct NetDataTraffic;
+struct NetEmulationParameter;
+struct NetResolverConnection;
+struct NetThreadParameter {
+    void (APS5_VABI *entry)(void*);
+    void* arg;
+    std::uint64_t reserved;
+    std::uint32_t flags;
+};
+struct NetIpv4InterfaceAddress;
+struct NetStatisticsInfoInternal;
+struct NetInitializeParameter;
+struct NetDhcpStartParameter;
+struct NetAddress6StartParameter;
+
+struct NetDhcpdStartParameter {
+    std::uint32_t addresses[5];
+    std::uint32_t maxClients;
+};
+
+struct NetPppoeStartParameter {
+    std::uint32_t dnsAddresses[2];
+    char userName[128];
+    char password[128];
+    std::int32_t mtu;
+    std::uint32_t flags;
+};
+
+struct NetRoutingAddressParameter {
+    std::uint32_t address;
+    std::uint32_t mask;
+};
+
+struct NetRoutingServerParameter {
+    std::int32_t count;
+    std::uint32_t localAddresses[2];
+    std::uint32_t remoteAddresses[2];
+};
+
+struct NetRoutingRuleParameter {
+    std::int32_t count;
+    const NetRoutingRule* rules;
+};
+
+struct NetInfoDumpParameter {
+    std::uint32_t flags;
+    std::uint32_t intervalSeconds;
+    char path[64];
+};
+
+struct NetInterfaceInfo;
+struct NetInterfaceStatistics;
+
+struct NetResolverConnectOption {
+    std::int32_t connectionTimeout;
+    std::int32_t resolverTimeout;
+    std::int32_t resolverRetryCount;
+    std::uint32_t reserved;
+};
+
+struct NetSyncObject {
+    void* mutex;
+    void* condition;
+    std::uint32_t signals;
+    std::uint32_t reserved;
+};
+
+struct NetIpv6Address {
+    std::uint8_t bytes[16];
+};
+
+struct NetDnsInfo {
+    std::uint32_t primaryAddress;
+    std::uint32_t secondaryAddress;
+};
+
+struct NetDns6Info {
+    NetIpv6Address primaryAddress;
+    NetIpv6Address secondaryAddress;
+};
+
+struct NetIpv6InterfaceAddress {
+    NetIpv6Address address;
+    std::uint8_t prefixLength;
+    std::uint8_t reserved[3];
+};
+
+struct NetMemoryPoolStats {
+    std::size_t pool_size;
+    std::size_t max_inuse_size;
+    std::size_t current_inuse_size;
+};
+
+struct NetMsghdr {
+    void* name;
+    std::uint32_t name_length;
+    NetIovec* iov;
+    int iov_length;
+    void* control;
+    std::uint32_t control_length;
+    int flags;
+};
+
+struct NetResolverInfo {
+    NetResolverRecord records[10];
+    std::int32_t count;
+    std::int32_t count4;
+    std::int32_t reserved[14];
+};
+
+using NetAddressCallback = void (APS5_VABI *)(void* userArg, std::int32_t event, std::int32_t error);
+
+using NetEventCallback = std::uint64_t (APS5_VABI*)(std::uint32_t interfaceId, std::uint64_t events, void* userData, void* waitData);
+
+extern "C" {
+
+int* APS5_VABI sceNetErrnoLoc(void);
+int APS5_VABI sceNetShowNetstat(void);
+int APS5_VABI sceNetInit_nid_postfix(void);
+int APS5_VABI sceNetTerm(void);
+int APS5_VABI sceNetPoolCreate(const char* name, int size, int flags);
+int APS5_VABI sceNetPoolDestroy(int memid);
+int APS5_VABI sceNetSocket(const char* name, int family, int type, int protocol);
+int APS5_VABI sceNetSocketClose(int s);
+int APS5_VABI sceNetSocketAbort(int s, int flags);
+int APS5_VABI sceNetBind_nid_postfix(int s, const void* addr, uint32_t addrlen);
+int APS5_VABI sceNetListen(int s, int backlog);
+int APS5_VABI sceNetAccept(int s, void* addr, uint32_t* addrlen);
+int APS5_VABI sceNetConnect(int s, const void* addr, uint32_t addrlen);
+int64_t APS5_VABI sceNetRecv(int s, void* buf, size_t len, int flags);
+int64_t APS5_VABI sceNetRecvfrom(int s, void* buf, size_t len, int flags, void* from, uint32_t* fromlen);
+int64_t APS5_VABI sceNetSend(int s, const void* buf, size_t len, int flags);
+int64_t APS5_VABI sceNetSendto(int s, const void* buf, size_t len, int flags, const void* to, uint32_t tolen);
+int64_t APS5_VABI sceNetSendmsg(int s, const NetMsghdr* msg, int flags);
+int64_t APS5_VABI sceNetRecvmsg(int s, NetMsghdr* msg, int flags);
+int APS5_VABI sceNetShutdown(int s, int how);
+int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval, uint32_t optlen);
+int APS5_VABI sceNetGetsockopt(int s, int level, int optname, void* optval, uint32_t* optlen);
+int APS5_VABI sceNetGetsockname(int s, void* addr, uint32_t* addrlen);
+int APS5_VABI sceNetGetpeername(int s, void* addr, uint32_t* addrlen);
+int APS5_VABI sceNetGetSockInfo(int s, void* info, int n, int flags);
+int APS5_VABI sceNetEpollCreate(const char* name, int flags);
+int APS5_VABI sceNetShowNetstatWithMemory(int memid);
+int APS5_VABI sceNetGetMemoryPoolStats(int memid, NetMemoryPoolStats* stats);
+int APS5_VABI sceNetEpollDestroy(int eid);
+int APS5_VABI sceNetEpollAbort(int eid, int flags);
+int APS5_VABI sceNetEpollControl(int eid, int op, int id, const NetEpollEvent* event);
+int APS5_VABI sceNetEpollWait(int eid, NetEpollEvent* events, int maxevents, int timeout);
+uint32_t APS5_VABI sceNetHtonl_nid_postfix(uint32_t host32);
+uint16_t APS5_VABI sceNetHtons_nid_postfix(uint16_t host16);
+uint64_t APS5_VABI sceNetHtonll(std::uint64_t host64);
+uint64_t APS5_VABI sceNetNtohll(std::uint64_t net64);
+uint32_t APS5_VABI sceNetNtohl_nid_postfix(uint32_t net32);
+uint16_t APS5_VABI sceNetNtohs_nid_postfix(uint16_t net16);
+int APS5_VABI sceNetInetPton(int af, const char* src, void* dst);
+const char* APS5_VABI sceNetInetNtop(int af, const void* src, char* dst, uint32_t size);
+int APS5_VABI sceNetEtherNtostr(const NetEtherAddr* n, char* str, size_t len);
+int APS5_VABI sceNetEtherStrton(const char* text, NetEtherAddr* address);
+int APS5_VABI sceNetGetMacAddress(NetEtherAddr* addr, int flags);
+int APS5_VABI sceNetResolverCreate(const char* name, int memid, int flags);
+int APS5_VABI sceNetResolverDestroy(int rid);
+int APS5_VABI sceNetResolverStartNtoa(int rid, const char* hostname, void* addr, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartNtoa6(int rid, const char* hostname, void* addr, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartNtoaMultipleRecords(int rid, const char* hostname, NetResolverInfo* info, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartNtoaMultipleRecordsEx(int rid, const char* hostname, NetResolverInfo* info, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartAton(int rid, const void* addr, char* hostname, int len, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartAton6(int rid, const void* addr, char* hostname, int len, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverGetError(int rid, int* status);
+int APS5_VABI sceNetResolverAbort(int rid, int flags);
+int APS5_VABI sceNetShowIfconfig();
+int APS5_VABI sceNetClearDnsCache(int flags);
+int APS5_VABI sceNetGetStatisticsInfo(NetStatisticsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetInterfaceStats(NetInterfaceStats* stats, std::uint32_t flags);
+int APS5_VABI sceNetSetDnsInfo(const NetDnsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetShowIfconfigWithMemory(std::int32_t poolId);
+int APS5_VABI sceNetShowPolicy(void);
+int APS5_VABI sceNetShowPolicyWithMemory(std::int32_t poolId);
+int APS5_VABI sceNetShowRoute(void);
+int APS5_VABI sceNetShowRouteWithMemory(std::int32_t poolId);
+int APS5_VABI sceNetResolverConnectAbort(NetResolverConnection* connection, std::uint32_t flags);
+int APS5_VABI sceNetResolverConnectCreate(const char* name, std::int32_t socketType, NetResolverConnection* connection, std::uint32_t flags);
+int APS5_VABI sceNetResolverConnect(NetResolverConnection* connection, const char* hostname, std::uint16_t port, const NetResolverConnectOption* option);
+int APS5_VABI sceNetResolverConnectDestroy(NetResolverConnection* connection);
+int APS5_VABI sceNetGetSockInfo6(std::int32_t socket, NetSockInfo6* info, std::uint32_t capacity, std::uint32_t flags);
+int APS5_VABI sceNetSetDns6Info(const NetDns6Info* info, std::uint32_t flags);
+int APS5_VABI sceNetShowRoute6(void);
+int APS5_VABI sceNetShowRoute6WithMemory(std::int32_t poolId);
+NetRouteInfo* APS5_VABI sceNetAllocateAllRouteInfo(std::int32_t interfaceId, std::int32_t* count);
+NetRouteInfo* APS5_VABI sceNetAllocateAllRouteInfo6(std::int32_t interfaceId, std::int32_t* count);
+int APS5_VABI sceNetControl(std::uint32_t interfaceId, std::int32_t interfaceIndex, std::uint32_t command, void* data, std::uint32_t dataSize);
+int APS5_VABI sceNetDbgInit(NetDebugParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackCreate(std::uint32_t interfaceId, NetEventCallback callback, void* userData, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackDestroy(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackGetError(std::uint32_t interfaceId, std::int32_t* error, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackWaitCB(std::int32_t timeout, void* waitData, std::uint32_t flags);
+int APS5_VABI sceNetFreeAllRouteInfo(void* routes);
+int APS5_VABI sceNetGetArpInfo(NetArpInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetAppMemInfo(NetAppMemoryInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetDnsInfo(NetDnsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetIfList(std::int32_t interfaceId, NetInterfaceInfo* interfaces, std::uint32_t capacity);
+int APS5_VABI sceNetGetIfListEx(std::int32_t interfaceId, NetInterfaceInfo* interfaces, std::uint32_t capacity, std::uint32_t flags);
+int APS5_VABI sceNetGetIfListOnce(std::int32_t interfaceId, NetInterfaceStatistics* statistics, std::uint32_t count);
+const char* APS5_VABI sceNetGetIfName(std::uint32_t index);
+int APS5_VABI sceNetGetIfnameNumList(std::uint32_t* interfaceIds, std::int32_t capacity, std::uint32_t flags);
+int APS5_VABI sceNetGetNameToIndex(std::uint32_t interfaceId);
+int APS5_VABI sceNetGetRandom(std::uint32_t* output);
+int APS5_VABI sceNetGetRouteInfo(std::int32_t family, NetRouteInfo* routes, std::int32_t capacity, std::uint8_t flags);
+int APS5_VABI sceNetGetsockoptEx(int socketId, int level, int option, void* value, std::uint32_t* valueSize);
+void APS5_VABI sceNetGetSystemTime(std::uint64_t* output);
+int APS5_VABI sceNetGetSystemMemInfo(NetSystemMemoryInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetInitParam(const NetInitializeParameter* parameter);
+int APS5_VABI sceNetInetPtonEx(int af, const char* src, void* dst, int);
+int APS5_VABI sceNetIoctl(int socketId, std::uint32_t command, void* argument);
+void* APS5_VABI sceNetMemoryAllocate(std::int32_t size, int flags);
+void APS5_VABI sceNetMemoryFree(void* memory);
+int APS5_VABI sceNetSetDnsInfoToKernel(const NetDnsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetSetsockoptEx(int socketId, int level, int option, const void* value, std::uint32_t valueSize);
+int APS5_VABI sceNetSocketInternal(const char* name, int domain, int type, int protocol);
+int APS5_VABI sceNetSyncCreate(NetSyncObject* sync, std::uint32_t signals, const char* name);
+int APS5_VABI sceNetSyncDestroy(NetSyncObject* sync);
+NetSyncObject* APS5_VABI sceNetSyncGet(std::uint32_t index);
+int APS5_VABI sceNetSyncSignal(NetSyncObject* sync, std::uint32_t signals);
+int APS5_VABI sceNetSyncWait(NetSyncObject* sync, std::uint32_t* timeout);
+int APS5_VABI sceNetSysctl(const int* name, std::uint32_t nameLength, void* oldValue, std::size_t* oldSize, const void* newValue, std::size_t newSize);
+int APS5_VABI sceNetThreadCreate(Pthread* thread, const NetThreadParameter* parameter, const char* name);
+void APS5_VABI sceNetThreadExit();
+int APS5_VABI sceNetThreadJoin(void* thread);
+int APS5_VABI sceNetUsleep(int microseconds);
+int APS5_VABI sceNetShowIfconfigForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetShowRouteForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetShowNetstatForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetShowNetstatEx(std::uint32_t flags);
+int APS5_VABI sceNetShowNetstatExForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId, std::uint32_t flags);
+const char* APS5_VABI sceNetInetNtopWithScopeId(std::int32_t family, const void* address, char* text, std::uint32_t size, std::uint32_t scopeId);
+int APS5_VABI sceNetInetPtonWithScopeId(std::int32_t family, const char* text, void* address, std::uint32_t* scopeId);
+int APS5_VABI sceNetGetDns6Info(NetDns6Info* info, std::uint32_t flags);
+int APS5_VABI sceNetSetDns6InfoToKernel(const NetDns6Info* info, std::uint32_t flags);
+int APS5_VABI sceNetShowRoute6ForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetConfigGetIfFlags(std::uint32_t interfaceId, std::uint32_t* flags);
+int APS5_VABI sceNetConfigSetIfFlags(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetConfigUnsetIfFlags(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetConfigDelIfaddr(int interfaceId);
+int APS5_VABI sceNetConfigDownInterface(int interfaceId);
+int APS5_VABI sceNetConfigSetDefaultRoute(const std::uint32_t* gateway);
+int APS5_VABI sceNetConfigSetDefaultRouteDev(const std::uint32_t* gateway);
+int APS5_VABI sceNetConfigSetIfaddr(int interfaceId, const std::uint32_t* address, const std::uint32_t* broadcastAddress, const std::uint32_t* netmask);
+int APS5_VABI sceNetConfigSetIfLinkLocalAddr6(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigUpInterface(int interfaceId);
+int APS5_VABI sceNetConfigUpInterfaceWithFlags(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetConfigCleanUpAllInterfaces(void);
+int APS5_VABI sceNetConfigFlushRoute(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigFlushRoute6(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigAddIfaddr(int interfaceId, const std::uint32_t* address, const std::uint32_t* broadcastAddress, const std::uint32_t* netmask);
+int APS5_VABI sceNetConfigGetIfaddr(std::int32_t interfaceId, NetIpv4InterfaceAddress* addresses, std::int32_t capacity);
+int APS5_VABI sceNetConfigSetIfmtu(std::uint32_t interfaceId, int mtu);
+int APS5_VABI sceNetConfigAddArp(const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigAddArpWithInterface(int interfaceId, const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigAddMRoute(const std::uint32_t* address);
+int APS5_VABI sceNetConfigAddRoute(const std::uint32_t* destination, const std::uint32_t* gateway, const std::uint32_t* netmask, int hostRoute);
+int APS5_VABI sceNetConfigAddRouteWithInterface(int interfaceId, const std::uint32_t* destination, const std::uint32_t* gateway, const std::uint32_t* netmask, int hostRoute);
+int APS5_VABI sceNetConfigDelArp(const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigDelArpWithInterface(int interfaceId, const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigDelDefaultRoute(void);
+int APS5_VABI sceNetConfigDelDefaultRouteDev(void);
+int APS5_VABI sceNetConfigDelMRoute(const std::uint32_t* address);
+int APS5_VABI sceNetConfigDelRoute(const std::uint32_t* destination, const std::uint32_t* gateway, const std::uint32_t* netmask);
+int APS5_VABI sceNetConfigGetDefaultRoute(std::uint32_t* gateway);
+int APS5_VABI sceNetDhcpGetAutoipInfo(std::int32_t interfaceId, NetAutoIpInfo* parameter);
+int APS5_VABI sceNetDhcpGetInfo(std::int32_t interfaceId, NetDhcpInfo* parameter);
+int APS5_VABI sceNetDhcpGetInfoEx(std::int32_t interfaceId, std::int32_t type, NetDhcpOptionInfo* info, std::uint32_t size);
+int APS5_VABI sceNetDhcpStart(std::uint32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, NetDhcpStartParameter* parameter);
+int APS5_VABI sceNetDhcpStop(int interfaceId);
+int APS5_VABI sceNetConfigAddIfaddr6(int interfaceId, const NetIpv6Address* address, std::uint8_t prefixLength);
+int APS5_VABI sceNetConfigDelIfaddr6(int interfaceId, const NetIpv6Address* address);
+int APS5_VABI sceNetConfigDelDefaultRoute6(void);
+int APS5_VABI sceNetConfigSetIfaddr6(int interfaceId, const NetIpv6Address* address, std::uint8_t prefixLength);
+int APS5_VABI sceNetConfigSetIfaddr6WithFlags(int interfaceId, const NetIpv6Address* address, std::uint8_t prefixLength, std::uint32_t flags);
+int APS5_VABI sceNetConfigSetDefaultRoute6(int interfaceId, const NetIpv6Address* gateway);
+int APS5_VABI sceNetConfigGetIfaddr6(int interfaceId, NetIpv6InterfaceAddress* addresses, std::uint32_t count);
+int APS5_VABI sceNetConfigGetDefaultRoute6(NetIpv6Address* gateway);
+int APS5_VABI sceNetConfigDelRoute6(const NetIpv6Address* destination, std::uint8_t prefixLength);
+int APS5_VABI sceNetConfigAddRoute6(const NetIpv6Address* destination, const NetIpv6Address* gateway, std::uint8_t prefixLength);
+int APS5_VABI sceNetAddrConfig6Start(std::uint32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, const NetAddress6StartParameter* parameter);
+int APS5_VABI sceNetAddrConfig6Stop(int interfaceId);
+int APS5_VABI sceNetAddrConfig6GetInfo(std::int32_t interfaceId, NetAddress6Info* parameter);
+int APS5_VABI sceNetInfoDumpStart(std::int32_t threadParameter1, std::int32_t threadParameter2, const NetInfoDumpParameter* parameter);
+int APS5_VABI sceNetInfoDumpStop(void);
+int APS5_VABI sceNetDhcpdStart(std::uint32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, const NetDhcpdStartParameter* parameter);
+int APS5_VABI sceNetDhcpdStop(int interfaceId);
+int APS5_VABI sceNetDuplicateIpStart(std::int32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2);
+int APS5_VABI sceNetDuplicateIpStop(int interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocClearWakeOnWlan(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocCreate(std::int32_t interfaceId, NetWlanAdhocParameter* parameter);
+int APS5_VABI sceNetConfigWlanAdhocGetWakeOnWlanInfo(std::int32_t interfaceId, NetWlanWakeInfo* parameter);
+int APS5_VABI sceNetConfigWlanAdhocJoin(std::int32_t interfaceId, NetWlanAdhocParameter* parameter);
+int APS5_VABI sceNetConfigWlanAdhocLeave(int interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocPspEmuClearWakeOnWlan(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocPspEmuGetWakeOnWlanInfo(std::int32_t interfaceId, NetWlanPspWakeInfo* parameter);
+int APS5_VABI sceNetConfigWlanAdhocPspEmuSetWakeOnWlan(std::int32_t interfaceId, NetWlanPspWakeParameter* parameter);
+int APS5_VABI sceNetConfigWlanAdhocScanJoin(std::int32_t interfaceId, const NetWlanAdhocScanParameter* parameter, void* buffer, std::size_t bufferSize, NetWlanJoinResult** result);
+int APS5_VABI sceNetConfigWlanAdhocSetExtInfoElement(std::int32_t interfaceId, NetWlanInformationElement* parameter, std::int32_t size);
+int APS5_VABI sceNetConfigWlanAdhocSetWakeOnWlan(std::int32_t interfaceId, NetWlanWakeParameter* parameter, std::size_t size);
+int APS5_VABI sceNetConfigWlanApStart(std::int32_t interfaceId, NetWlanApParameter* parameter);
+int APS5_VABI sceNetConfigWlanApStop(int interfaceId);
+int APS5_VABI sceNetConfigWlanBackgroundScanQuery(std::int32_t interfaceId, void* buffer, std::int32_t size, NetWlanScanResult** results, std::size_t* count);
+int APS5_VABI sceNetConfigWlanBackgroundScanStart(std::int32_t interfaceId, NetWlanScanParameter* parameter, std::uint32_t size);
+int APS5_VABI sceNetConfigWlanBackgroundScanStop(int interfaceId);
+int APS5_VABI sceNetConfigWlanDiagGetDeviceInfo(std::int32_t interfaceId, NetWlanDeviceInfo* parameter);
+int APS5_VABI sceNetConfigWlanDiagSetAntenna(std::int32_t interfaceId, NetWlanAntennaParameter* parameter);
+int APS5_VABI sceNetConfigWlanDiagSetTxFixedRate(std::int32_t interfaceId, NetWlanRateParameter* parameter);
+int APS5_VABI sceNetConfigWlanGetDeviceConfig(std::int32_t interfaceId, NetWlanDeviceConfiguration* parameter);
+int APS5_VABI sceNetConfigWlanInfraGetRssiInfo(std::int32_t interfaceId, NetWlanRssiInfo* parameter);
+int APS5_VABI sceNetConfigWlanInfraLeave(int interfaceId);
+int APS5_VABI sceNetConfigWlanInfraScanJoin(std::int32_t interfaceId, const NetWlanInfraScanParameter* parameter, void* buffer, std::size_t bufferSize, NetWlanJoinResult** result);
+int APS5_VABI sceNetConfigWlanScan(std::int32_t interfaceId, const NetWlanScanParameter* parameter, std::size_t parameterSize, void* buffer, std::size_t bufferSize, NetWlanScanResult** results, std::size_t* count);
+int APS5_VABI sceNetConfigWlanSetDeviceConfig(std::int32_t interfaceId, NetWlanDeviceConfiguration* parameter);
+int APS5_VABI sceNetConfigEtherGetLinkMode(std::uint32_t interfaceId, int* mode);
+int APS5_VABI sceNetConfigEtherPostPlugInOutEvent(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigEtherSetLinkMode(std::uint32_t interfaceId, int mode);
+int APS5_VABI sceNetPppoeStart(std::uint32_t interfaceId, std::int32_t pppoeInterfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, const NetPppoeStartParameter* parameter);
+int APS5_VABI sceNetPppoeStop(void);
+int APS5_VABI sceNetBandwidthControlSetDefaultParam(const NetBandwidthParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetBandwidthControlGetDefaultParam(NetBandwidthParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetBandwidthControlGetDataTraffic(std::int32_t interfaceId, NetDataTraffic* traffic, std::uint32_t flags);
+int APS5_VABI sceNetConfigSetDefaultScope(std::uint32_t interfaceId, const char* interfaceName, std::int32_t scopeId);
+int APS5_VABI sceNetConfigRoutingStart(std::uint32_t firstInterfaceId, std::uint32_t secondInterfaceId, const NetRoutingAddressParameter* addressParameter, NetRoutingServerParameter* serverParameter, const NetRoutingRuleParameter* ruleParameter);
+int APS5_VABI sceNetConfigRoutingStop(void);
+int APS5_VABI sceNetConfigRoutingShowRoutingConfig(void);
+int APS5_VABI sceNetConfigRoutingShowtCtlVar(const char* name);
+int APS5_VABI sceNetGetStatisticsInfoInternal(NetStatisticsInfoInternal* info);
+int APS5_VABI sceNetDumpAbort(std::int32_t dumpId, std::uint32_t flags);
+int APS5_VABI sceNetDumpCreate(const char* name, std::int32_t bufferSize, std::uint32_t flags);
+int APS5_VABI sceNetDumpSetFilterParam(std::int32_t socket, const NetDumpFilterParameter* parameter);
+int APS5_VABI sceNetDumpDestroy(std::int32_t dumpId);
+int APS5_VABI sceNetDumpRead(std::int32_t dumpId, void* buffer, std::int32_t bufferSize, std::uint32_t* flags);
+int APS5_VABI sceNetEmulationDebugSettingsSet(const NetEmulationParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEmulationDebugSettingsGet(NetEmulationParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEmulationSet(const NetEmulationParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEmulationGet(NetEmulationParameter* parameter, std::uint32_t flags);
+
+}
diff --git a/core/libs/prx/libSceNet/libSceNet.hpp b/core/libs/prx/libSceNet/libSceNet.hpp
new file mode 100644
index 0000000000..9f4c162ed2
--- /dev/null
+++ b/core/libs/prx/libSceNet/libSceNet.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNet/include/Net.hpp"
diff --git a/core/libs/prx/libSceNetCtl/Export.cpp b/core/libs/prx/libSceNetCtl/Export.cpp
index 54c9d941fe..a5e469dfdd 100644
--- a/core/libs/prx/libSceNetCtl/Export.cpp
+++ b/core/libs/prx/libSceNetCtl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -35,16 +36,6 @@
 #include <vector>
 
 // Network-control state reflects host interface addressing, not PSN sign-in status.
-union NetCtlInfoV6;
-struct NetCtlConnectionConfiguration;
-struct NetCtlScanOptions;
-struct NetCtlScanBssidList;
-struct NetCtlScanInfo;
-struct NetCtlNatInfoInternal;
-struct NetCtlBandwidthInfo;
-struct NetCtlNetEvConfiguration;
-struct NetBweInfo;
-struct NetCtlWifiInfo;
 
 static constexpr int SCE_NET_CTL_ERROR_NOT_INITIALIZED = static_cast<int>(0x80412101);
 static constexpr int SCE_NET_CTL_ERROR_ID_NOT_FOUND = static_cast<int>(0x80412104);
@@ -99,6 +90,7 @@ static std::atomic_bool g_initialized{true};
 static std::mutex g_callbackLock;
 static CallbackSlot g_callbacks[MAX_CALLBACKS] = {};
 static CallbackSlot g_callbacksV6[MAX_CALLBACKS] = {};
+static CallbackSlot g_callbacksNpToolkit[MAX_CALLBACKS] = {};
 
 static int RegisterCallback(CallbackSlot (&callbacks)[MAX_CALLBACKS], NetCtlCallback func, void* arg, int* cid) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
@@ -123,9 +115,9 @@ static int UnregisterCallback(CallbackSlot (&callbacks)[MAX_CALLBACKS], int cid)
     return 0;
 }
 
-static bool HasIpv4Callback() {
+static bool HasCallback(const CallbackSlot (&callbacks)[MAX_CALLBACKS]) {
     std::lock_guard lock(g_callbackLock);
-    for (const auto& slot : g_callbacks) {
+    for (const auto& slot : callbacks) {
         if (slot.func) return true;
     }
     return false;
@@ -512,17 +504,15 @@ static void HostTraffic(std::uint64_t& sent, std::uint64_t& received) {
 #endif
 }
 
-extern "C" {
-
-int APS5_VABI sceNetCtlCheckCallback(void) {
+static int CheckCallbacks(CallbackSlot (&callbacks)[MAX_CALLBACKS]) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
-    if (!HasIpv4Callback()) return 0;
+    if (!HasCallback(callbacks)) return 0;
     const int event = HostHasAddress(AF_UNSPEC) ? NET_CTL_EVENT_IPOBTAINED : NET_CTL_EVENT_DISCONNECTED;
     CallbackSlot due[MAX_CALLBACKS];
     int count = 0;
     {
         std::lock_guard lock(g_callbackLock);
-        for (auto& slot : g_callbacks) {
+        for (auto& slot : callbacks) {
             if (!slot.func || slot.lastEvent == event) continue;
             slot.lastEvent = event;
             due[count++] = slot;
@@ -532,6 +522,12 @@ int APS5_VABI sceNetCtlCheckCallback(void) {
     return 0;
 }
 
+extern "C" {
+
+int APS5_VABI sceNetCtlCheckCallback(void) {
+    return CheckCallbacks(g_callbacks);
+}
+
 int APS5_VABI sceNetCtlGetIfStat(NetCtlIfStat* stat) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
     if (!stat) return SCE_NET_CTL_ERROR_INVALID_ADDR;
@@ -584,7 +580,11 @@ int APS5_VABI sceNetCtlGetNatInfo(NetCtlNatInfo* info) {
 int APS5_VABI sceNetCtlGetResult(int event, int* result) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
     if (!result) return SCE_NET_CTL_ERROR_INVALID_ADDR;
-    throw std::logic_error("sceNetCtlGetResult: service event results are not implemented");
+    if (event < NET_CTL_EVENT_DISCONNECTED || event > NET_CTL_EVENT_IPOBTAINED) {
+        throw std::runtime_error("sceNetCtlGetResult: event type " + std::to_string(event) + " is not implemented");
+    }
+    *result = 0;
+    return 0;
 }
 
 int APS5_VABI sceNetCtlGetState(int* state) {
@@ -633,13 +633,11 @@ int APS5_VABI sceNetCtlUnregisterCallbackV6(int cid) {
 }
 
 int APS5_VABI sceNetCtlRegisterCallbackForNpToolkit(NetCtlCallback callback, void* argument, int* callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return RegisterCallback(g_callbacksNpToolkit, callback, argument, callbackId);
 }
 
 int APS5_VABI sceNetCtlRegisterCallbackIpcInt(NetCtlCallback callback, void* argument, int* callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlRegisterCallback(callback, argument, callbackId);
 }
 
 int APS5_VABI sceNetCtlRegisterCallbackForLibIpcInt(NetCtlCallback callback, void* argument, int* callbackId) {
@@ -648,13 +646,11 @@ int APS5_VABI sceNetCtlRegisterCallbackForLibIpcInt(NetCtlCallback callback, voi
 }
 
 int APS5_VABI sceNetCtlUnregisterCallbackForNpToolkit(int callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return UnregisterCallback(g_callbacksNpToolkit, callbackId);
 }
 
 int APS5_VABI sceNetCtlUnregisterCallbackIpcInt(int callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlUnregisterCallback(callbackId);
 }
 
 int APS5_VABI sceNetCtlUnregisterCallbackForLibIpcInt(int callbackId) {
@@ -663,8 +659,7 @@ int APS5_VABI sceNetCtlUnregisterCallbackForLibIpcInt(int callbackId) {
 }
 
 int APS5_VABI sceNetCtlCheckCallbackForNpToolkit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return CheckCallbacks(g_callbacksNpToolkit);
 }
 
 int APS5_VABI sceNetCtlCheckCallbackForLibIpcInt(void) {
@@ -688,13 +683,11 @@ int APS5_VABI sceNetCtlClearEventForLibIpcInt(int event) {
 }
 
 int APS5_VABI sceNetCtlGetResultIpcInt(int event, int* result) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlGetResult(event, result);
 }
 
 int APS5_VABI sceNetCtlGetStateIpcInt(int* state) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlGetState(state);
 }
 
 int APS5_VABI sceNetCtlGetState2IpcInt(int* state) {
@@ -703,8 +696,7 @@ int APS5_VABI sceNetCtlGetState2IpcInt(int* state) {
 }
 
 int APS5_VABI sceNetCtlGetInfoIpcInt(std::uint32_t code, NetCtlInfo* info) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlGetInfo(static_cast<int>(code), info);
 }
 
 int APS5_VABI sceNetCtlGetEtherLinkMode(int* mode) {
@@ -773,13 +765,11 @@ int APS5_VABI sceNetCtlSetErrorNotificationEnabledIpcInt(int enabled) {
 }
 
 int APS5_VABI sceNetCtlRegisterCallbackV6IpcInt(NetCtlCallback callback, void* argument, int* callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlRegisterCallbackV6(callback, argument, callbackId);
 }
 
 int APS5_VABI sceNetCtlUnregisterCallbackV6IpcInt(int callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlUnregisterCallbackV6(callbackId);
 }
 
 int APS5_VABI sceNetCtlGetResultV6(int event_type, int* error_code) {
@@ -792,18 +782,15 @@ int APS5_VABI sceNetCtlGetResultV6(int event_type, int* error_code) {
 }
 
 int APS5_VABI sceNetCtlGetResultV6IpcInt(int event, int* result) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlGetResultV6(event, result);
 }
 
 int APS5_VABI sceNetCtlGetStateV6IpcInt(int* state) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlGetStateV6(state);
 }
 
 int APS5_VABI sceNetCtlGetInfoV6IpcInt(std::uint32_t code, NetCtlInfoV6* info) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNetCtlGetInfoV6(code, info);
 }
 
 int APS5_VABI sceNetCtlGetNatInfoIpcInt(NetCtlNatInfoInternal* info) {
diff --git a/core/libs/prx/libSceNetCtl/include/NetCtl.hpp b/core/libs/prx/libSceNetCtl/include/NetCtl.hpp
new file mode 100644
index 0000000000..f2fa735b00
--- /dev/null
+++ b/core/libs/prx/libSceNetCtl/include/NetCtl.hpp
@@ -0,0 +1,104 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+union NetCtlInfoV6;
+struct NetCtlConnectionConfiguration;
+struct NetCtlScanOptions;
+struct NetCtlScanBssidList;
+struct NetCtlScanInfo;
+struct NetCtlNatInfoInternal;
+struct NetCtlBandwidthInfo;
+struct NetCtlNetEvConfiguration;
+struct NetBweInfo;
+struct NetCtlWifiInfo;
+
+extern "C" {
+
+int APS5_VABI sceNetCtlCheckCallback(void);
+int APS5_VABI sceNetCtlGetIfStat(NetCtlIfStat* stat);
+int APS5_VABI sceNetCtlGetInfo(int code, NetCtlInfo* info);
+int APS5_VABI sceNetCtlGetNatInfo(NetCtlNatInfo* info);
+int APS5_VABI sceNetCtlGetResult(int event, int* result);
+int APS5_VABI sceNetCtlGetState(int* state);
+int APS5_VABI sceNetCtlGetStateV6(int* state);
+int APS5_VABI sceNetCtlInit(void);
+int APS5_VABI sceNetCtlRegisterCallback(NetCtlCallback func, void* arg, int* cid);
+int APS5_VABI sceNetCtlRegisterCallbackV6(NetCtlCallback func, void* arg, int* cid);
+int APS5_VABI sceNetCtlGetInfoV6(std::uint32_t code, NetCtlInfoV6* info);
+void APS5_VABI sceNetCtlTerm(void);
+int APS5_VABI sceNetCtlUnregisterCallback(int cid);
+int APS5_VABI sceNetCtlUnregisterCallbackV6(int cid);
+int APS5_VABI sceNetCtlRegisterCallbackForNpToolkit(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlRegisterCallbackIpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlRegisterCallbackForLibIpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackForNpToolkit(int callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackIpcInt(int callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackForLibIpcInt(int callbackId);
+int APS5_VABI sceNetCtlCheckCallbackForNpToolkit(void);
+int APS5_VABI sceNetCtlCheckCallbackForLibIpcInt(void);
+int APS5_VABI sceNetCtlClearEventIpcInt(int event);
+int APS5_VABI sceNetCtlClearEventForNpToolkit(int event);
+int APS5_VABI sceNetCtlClearEventForLibIpcInt(int event);
+int APS5_VABI sceNetCtlGetResultIpcInt(int event, int* result);
+int APS5_VABI sceNetCtlGetStateIpcInt(int* state);
+int APS5_VABI sceNetCtlGetState2IpcInt(int* state);
+int APS5_VABI sceNetCtlGetInfoIpcInt(std::uint32_t code, NetCtlInfo* info);
+int APS5_VABI sceNetCtlGetEtherLinkMode(int* mode);
+int APS5_VABI sceNetCtlGetWifiType(int* type);
+int APS5_VABI sceNetCtlConnectIpcInt(void);
+int APS5_VABI sceNetCtlConnectWithRetryIpcInt(void);
+int APS5_VABI sceNetCtlConnectConfIpcInt(const NetCtlConnectionConfiguration* configuration);
+int APS5_VABI sceNetCtlDisconnectIpcInt(void);
+int APS5_VABI sceNetCtlScanIpcInt(const char* const* ssids, std::uint32_t count, const NetCtlScanOptions* options);
+int APS5_VABI sceNetCtlGetScanInfoBssidIpcInt(NetCtlScanBssidList* bssids, std::uint32_t capacity);
+int APS5_VABI sceNetCtlGetScanInfoByBssidIpcInt(const std::uint8_t* bssid, NetCtlScanInfo* info, void* buffer, std::size_t* size);
+int APS5_VABI sceNetCtlGetScanInfoForSsidScanIpcInt(NetCtlScanInfo* info, void* buffer, std::size_t* size);
+int APS5_VABI sceNetCtlGetScanInfoBssidForSsidListScanIpcInt(NetCtlScanBssidList* bssids, std::uint32_t capacity);
+int APS5_VABI sceNetCtlGetScanInfoForSsidListScanIpcInt(const std::uint8_t* bssid, NetCtlScanInfo* info, void* buffer, std::size_t* size);
+int APS5_VABI sceNetCtlSetErrorNotificationEnabledIpcInt(int enabled);
+int APS5_VABI sceNetCtlRegisterCallbackV6IpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackV6IpcInt(int callbackId);
+int APS5_VABI sceNetCtlGetResultV6(int eventType, int* errorCode);
+int APS5_VABI sceNetCtlGetResultV6IpcInt(int event, int* result);
+int APS5_VABI sceNetCtlGetStateV6IpcInt(int* state);
+int APS5_VABI sceNetCtlGetInfoV6IpcInt(std::uint32_t code, NetCtlInfoV6* info);
+int APS5_VABI sceNetCtlGetNatInfoIpcInt(NetCtlNatInfoInternal* info);
+int APS5_VABI sceNetCtlSetStunWithPaddingFlagIpcInt(void);
+int APS5_VABI sceNetCtlUnsetStunWithPaddingFlagIpcInt(void);
+int APS5_VABI sceNetCtlIsBandwidthManagementEnabledIpcInt(void);
+int APS5_VABI sceNetCtlDisableBandwidthManagementIpcInt(void);
+int APS5_VABI sceNetCtlEnableBandwidthManagementIpcInt(void);
+int APS5_VABI sceNetCtlGetBandwidthInfoIpcInt(NetCtlBandwidthInfo* info);
+int APS5_VABI sceNetCtlGetNetEvConfigInfoIpcInt(NetCtlNetEvConfiguration* configuration);
+int APS5_VABI sceNetCtlGetConnectionElapsedTimeIpcInt(std::uint64_t* elapsedTime);
+int APS5_VABI sceNetCtlApRpCheckCallback(void);
+int APS5_VABI sceNetCtlApRpClearEvent(void);
+int APS5_VABI sceNetCtlApRpRegisterCallback(void);
+int APS5_VABI sceNetCtlApRpUnregisterCallback(void);
+int APS5_VABI sceNetCtlApRpGetResult(void);
+int APS5_VABI sceNetCtlApRpGetState(void);
+int APS5_VABI sceNetCtlApRpGetInfo(void);
+int APS5_VABI sceNetCtlApRpStart(void);
+int APS5_VABI sceNetCtlApCpStart(void);
+int APS5_VABI sceNetCtlApAppStartWithRetryPid(std::int32_t processId, const char* passcode);
+int APS5_VABI sceNetCtlApAppStartWithRetry(const char* passcode);
+int APS5_VABI sceNetCtlApRpStartWithRetry(void);
+int APS5_VABI sceNetCtlApRpStartConf(void);
+int APS5_VABI sceNetCtlApRpStop(void);
+int APS5_VABI sceNetCtlApCpStop(void);
+int APS5_VABI sceNetCtlApAppInitWpaKey(void);
+int APS5_VABI sceNetCtlApAppInitWpaKeyForQa(std::uint8_t mode);
+int APS5_VABI sceNetCtlApRestart(void);
+int APS5_VABI sceNetBweCheckCallbackIpcInt(void);
+int APS5_VABI sceNetBweClearEventIpcInt(int event);
+int APS5_VABI sceNetBweRegisterCallbackIpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetBweUnregisterCallbackIpcInt(int callbackId);
+int APS5_VABI sceNetBweGetInfoIpcInt(NetBweInfo* info);
+int APS5_VABI sceNetBweStartInternetConnectionTestIpcInt(void);
+int APS5_VABI sceNetBweFinishInternetConnectionTestIpcInt(void);
+int APS5_VABI sceNetBweStartInternetConnectionTestBandwidthTestIpcInt(void);
+int APS5_VABI sceNetBweSetInternetConnectionTestResultIpcInt(std::int32_t firstResult, std::int32_t secondResult);
+int APS5_VABI sceNetCtlGetWifiInfoIpcInt(NetCtlWifiInfo* info);
+
+}
diff --git a/core/libs/prx/libSceNetCtl/libSceNetCtl.hpp b/core/libs/prx/libSceNetCtl/libSceNetCtl.hpp
new file mode 100644
index 0000000000..d60a79d958
--- /dev/null
+++ b/core/libs/prx/libSceNetCtl/libSceNetCtl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
diff --git a/core/libs/prx/libSceNetCtlAp/Export.cpp b/core/libs/prx/libSceNetCtlAp/Export.cpp
index 9da3953097..8eafcd5e4f 100644
--- a/core/libs/prx/libSceNetCtlAp/Export.cpp
+++ b/core/libs/prx/libSceNetCtlAp/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtlAp/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <mutex>
@@ -23,8 +24,6 @@ constexpr std::size_t NET_CTL_AP_INFO_SIZE = 152;
 constexpr std::size_t NET_CTL_AP_CONNECT_INFO_SIZE = 184;
 constexpr int MAX_CALLBACKS = 8;
 
-using NetCtlApCallback = void(APS5_VABI*)(int, void*);
-
 struct CallbackSlot {
     NetCtlApCallback func = nullptr;
     void* arg = nullptr;
@@ -77,6 +76,7 @@ int APS5_VABI sceNetCtlApRegisterCallback(NetCtlApCallback func, void* arg, int*
             return 0;
         }
     }
+    *cid = -1;
     return NET_CTL_AP_ERROR_CALLBACK_MAX;
 }
 
diff --git a/core/libs/prx/libSceNetCtlAp/include/Api.hpp b/core/libs/prx/libSceNetCtlAp/include/Api.hpp
new file mode 100644
index 0000000000..31649a048f
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlAp/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using NetCtlApCallback = void(APS5_VABI*)(int, void*);
+
+extern "C" {
+
+int APS5_VABI sceNetCtlApInit();
+void APS5_VABI sceNetCtlApTerm();
+int APS5_VABI sceNetCtlApCheckCallback();
+int APS5_VABI sceNetCtlApClearEvent(int eventType);
+int APS5_VABI sceNetCtlApRegisterCallback(NetCtlApCallback func, void* arg, int* cid);
+int APS5_VABI sceNetCtlApUnregisterCallback(int cid);
+int APS5_VABI sceNetCtlApGetResult(int eventType, int* errorCode);
+int APS5_VABI sceNetCtlApGetInfo(void* info);
+int APS5_VABI sceNetCtlApGetState(int* state);
+int APS5_VABI sceNetCtlApStop();
+int APS5_VABI sceNetCtlApGetConnectInfo(const char* optStr, void* connectInfo);
+
+}
diff --git a/core/libs/prx/libSceNetCtlAp/libSceNetCtlAp.hpp b/core/libs/prx/libSceNetCtlAp/libSceNetCtlAp.hpp
new file mode 100644
index 0000000000..1f1138e728
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlAp/libSceNetCtlAp.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNetCtlAp/include/Api.hpp"
diff --git a/core/libs/prx/libSceNetCtlApDialog/Export.cpp b/core/libs/prx/libSceNetCtlApDialog/Export.cpp
index 64a0d3086e..d6c67ca827 100644
--- a/core/libs/prx/libSceNetCtlApDialog/Export.cpp
+++ b/core/libs/prx/libSceNetCtlApDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtlApDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceNetCtlApDialog/include/Api.hpp b/core/libs/prx/libSceNetCtlApDialog/include/Api.hpp
new file mode 100644
index 0000000000..ec8df01ad0
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlApDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNetCtlApDialogInitialize(void);
+int APS5_VABI sceNetCtlApDialogTerminate(void);
+int APS5_VABI sceNetCtlApDialogOpen(const NetCtlApDialogParam* param);
+int APS5_VABI sceNetCtlApDialogClose(void);
+int APS5_VABI sceNetCtlApDialogUpdateStatus(void);
+int APS5_VABI sceNetCtlApDialogGetStatus(void);
+int APS5_VABI sceNetCtlApDialogGetResult(NetCtlApDialogResult* result);
+
+}
diff --git a/core/libs/prx/libSceNetCtlApDialog/libSceNetCtlApDialog.hpp b/core/libs/prx/libSceNetCtlApDialog/libSceNetCtlApDialog.hpp
new file mode 100644
index 0000000000..b62243d95c
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlApDialog/libSceNetCtlApDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNetCtlApDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNgs2.native/CMakeLists.txt b/core/libs/prx/libSceNgs2.native/CMakeLists.txt
index 93bb6c445e..885da1168b 100644
--- a/core/libs/prx/libSceNgs2.native/CMakeLists.txt
+++ b/core/libs/prx/libSceNgs2.native/CMakeLists.txt
@@ -2,7 +2,7 @@ include(${CMAKE_CURRENT_SOURCE_DIR}/Ngs2Library.cmake)
 add_sce_ngs2_library(libSceNgs2.native)
 
 if(BUILD_TESTING)
-    foreach(ngs2Test IN ITEMS Render Atrac9 Filter Custom Parse Stream UserFx Report Geom VoiceIndex HandleErrors VoiceHandles)
+    foreach(ngs2Test IN ITEMS Render Atrac9 Filter Custom Parse Stream UserFx Report Geom VoiceIndex HandleErrors VoiceHandles VoiceEvents)
         string(TOLOWER ${ngs2Test} testName)
         add_test_executable(ngs2_${testName}_tests ${CMAKE_CURRENT_SOURCE_DIR}/tests/Ngs2${ngs2Test}.cpp)
         target_include_directories(ngs2_${testName}_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/3rdparty/LibAtrac9/C/src)
@@ -14,4 +14,5 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNgs2.native>")
         endif()
     endforeach()
+    add_sce_ngs2_test(libSceNgs2.native ngs2_pcm Ngs2Pcm.cpp)
 endif()
diff --git a/core/libs/prx/libSceNgs2.native/Export.cpp b/core/libs/prx/libSceNgs2.native/Export.cpp
index 984f3782fe..6f5160436e 100644
--- a/core/libs/prx/libSceNgs2.native/Export.cpp
+++ b/core/libs/prx/libSceNgs2.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNgs2.native/Ngs2Library.cmake b/core/libs/prx/libSceNgs2.native/Ngs2Library.cmake
index b89226f992..27dde605fe 100644
--- a/core/libs/prx/libSceNgs2.native/Ngs2Library.cmake
+++ b/core/libs/prx/libSceNgs2.native/Ngs2Library.cmake
@@ -5,6 +5,7 @@ function(add_sce_ngs2_library target)
             ${ngs2Dir}/src/Custom.cpp
             ${ngs2Dir}/src/Geom.cpp
             ${ngs2Dir}/src/Pan.cpp
+            ${ngs2Dir}/src/Pcm.cpp
             ${ngs2Dir}/src/Rack.cpp
             ${ngs2Dir}/src/Render.cpp
             ${ngs2Dir}/src/Reverb.cpp
@@ -23,3 +24,15 @@ function(add_sce_ngs2_library target)
     )
     configure_windows_unwind(${target})
 endfunction()
+
+function(add_sce_ngs2_test library name source)
+    add_test_executable(${name}_tests ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/tests/${source})
+    target_include_directories(${name}_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/3rdparty/LibAtrac9/C/src)
+    target_link_libraries(${name}_tests PRIVATE ${library} atrac9 libkernel libc)
+    configure_windows_unwind(${name}_tests)
+    add_test(NAME ${name} COMMAND ${name}_tests)
+    if(WIN32)
+        set_tests_properties(${name} PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:${library}>")
+    endif()
+endfunction()
diff --git a/core/libs/prx/libSceNgs2.native/include/Api.hpp b/core/libs/prx/libSceNgs2.native/include/Api.hpp
new file mode 100644
index 0000000000..7bc7c26ad3
--- /dev/null
+++ b/core/libs/prx/libSceNgs2.native/include/Api.hpp
@@ -0,0 +1,23 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNgs2JobSchedulerResetOption(void);
+int APS5_VABI sceNgs2ModuleArrayEnumItems(void);
+int APS5_VABI sceNgs2ModuleEnumConfigs(void);
+int APS5_VABI sceNgs2ModuleQueueEnumItems(void);
+int APS5_VABI sceNgs2RackQueryInfo(void);
+int APS5_VABI sceNgs2RackRunCommands(void);
+int APS5_VABI sceNgs2StreamCreate(void);
+int APS5_VABI sceNgs2StreamCreateWithAllocator(void);
+int APS5_VABI sceNgs2StreamDestroy(void);
+int APS5_VABI sceNgs2StreamQueryBufferSize(void);
+int APS5_VABI sceNgs2StreamQueryInfo(void);
+int APS5_VABI sceNgs2StreamResetOption(void);
+int APS5_VABI sceNgs2StreamRunCommands(void);
+int APS5_VABI sceNgs2SystemQueryInfo(void);
+int APS5_VABI sceNgs2SystemRunCommands(void);
+
+}
diff --git a/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp b/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp
index 54093115a2..9f0abe430f 100644
--- a/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp
+++ b/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp
@@ -25,7 +25,11 @@ static constexpr int SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT = static_cast<int>(0
 static constexpr int SCE_NGS2_ERROR_UNKNOWN_WAVEFORM_FORMAT = static_cast<int>(0x804A8432);
 static constexpr int SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE = static_cast<int>(0x804A8450);
 static constexpr int SCE_NGS2_ERROR_INVALID_PAN_SPEAKER = static_cast<int>(0x804A8451);
+static constexpr int SCE_NGS2_ERROR_INVALID_PAN_MATRIX_FORMAT = static_cast<int>(0x804A8452);
+static constexpr int SCE_NGS2_ERROR_INVALID_PAN_WORK = static_cast<int>(0x804A8453);
+static constexpr int SCE_NGS2_ERROR_INVALID_PAN_PARAM = static_cast<int>(0x804A8454);
 static constexpr int SCE_NGS2_ERROR_INVALID_VOICE_HANDLE = static_cast<int>(0x804A8203);
+static constexpr int SCE_NGS2_ERROR_INVALID_VOICE_ACCESS = static_cast<int>(0x804A8351);
 static constexpr int SCE_NGS2_ERROR_NULL_PARAM_LIST = static_cast<int>(0x804A8360);
 static constexpr int SCE_NGS2_ERROR_INVALID_GEOM_LISTENER_ADDRESS = static_cast<int>(0x804A8461);
 static constexpr int SCE_NGS2_ERROR_INVALID_GEOM_FLAG = static_cast<int>(0x804A8463);
@@ -43,11 +47,16 @@ static constexpr std::uint32_t SCE_NGS2_RACK_ID_REVERB = 0x2001;
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_MASTERING = 0x3000;
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_SAMPLER = 0x4001;
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER = 0x4002;
+static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_MASTERING = 0x4003;
 
+static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_U8 = 0x11;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I16L = 0x12;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I16B = 0x13;
+static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I24L = 0x14;
+static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I32L = 0x16;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_F32L = 0x18;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_F32B = 0x19;
+static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_F64L = 0x1a;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_ATRAC9 = 0x40;
 
 static constexpr std::uint32_t SCE_NGS2_VOICE_EVENT_PLAY = 1;
@@ -87,6 +96,9 @@ static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_ADD_WAVEFORM_
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_EXIT_LOOP = 0x40010004;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_PITCH = 0x40010005;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP = 0x40020000;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP = 0x40030000;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN = 0x40030004;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT = 0x40030005;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_FILTER = 0x40001300;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN = 0x40001500;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX = 0x40001900;
@@ -360,6 +372,8 @@ struct Ngs2CustomSubmixerRackOption {
 };
 static_assert(sizeof(Ngs2CustomSubmixerRackOption) == 1288);
 
+using Ngs2CustomMasteringRackOption = Ngs2CustomSubmixerRackOption;
+
 struct Ngs2RackInfo {
     char name[64];
     Ngs2Handle rack_handle;
diff --git a/core/libs/prx/libSceNgs2.native/libSceNgs2.native.hpp b/core/libs/prx/libSceNgs2.native/libSceNgs2.native.hpp
new file mode 100644
index 0000000000..1ca6a1c884
--- /dev/null
+++ b/core/libs/prx/libSceNgs2.native/libSceNgs2.native.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceNgs2.native/include/Api.hpp"
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
diff --git a/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp b/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp
index 3a85bb761c..dda42ea297 100644
--- a/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
@@ -16,8 +17,10 @@
 #include "Ngs2Internal.hpp"
 
 static constexpr std::uint16_t WAVE_FORMAT_PCM = 0x1;
+static constexpr std::uint16_t WAVE_FORMAT_IEEE_FLOAT = 0x3;
 static constexpr std::uint16_t WAVE_FORMAT_EXTENSIBLE = 0xfffe;
 static constexpr std::uint8_t ATRAC9_GUID[16] = {0xd2, 0x42, 0xe1, 0x47, 0xba, 0x36, 0x8d, 0x4d, 0x88, 0xfc, 0x61, 0x65, 0x4f, 0x8c, 0x83, 0x6c};
+static constexpr std::uint8_t PCM_GUID[16] = {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71};
 static constexpr std::size_t FMT_ATRAC9_SIZE = 52;
 static constexpr std::size_t FMT_GUID_OFFSET = 24;
 static constexpr std::size_t FMT_CONFIG_OFFSET = 44;
@@ -362,19 +365,27 @@ static int ParseAtrac9(const RiffChunks& chunks, Ngs2WaveformInfo& info) {
     return ParseAtrac9Loop(chunks, info);
 }
 
-static int ParsePcm16(const RiffChunks& chunks, std::size_t size, Ngs2WaveformInfo& info) {
+static std::uint32_t PcmWaveformType(std::uint32_t bits, bool floating) {
+    if (floating) return bits == 32 ? 0x18 : bits == 64 ? 0x1a : 0;
+    return bits == 8 ? 0x11 : bits == 16 ? SCE_NGS2_WAVEFORM_TYPE_PCM_I16L : bits == 24 ? 0x14 : bits == 32 ? 0x16 : 0;
+}
+
+static int ParsePcm(const RiffChunks& chunks, std::size_t size, Ngs2WaveformInfo& info, bool floating) {
     const auto* format = chunks.format;
     if (chunks.formatSize < 16) return SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT;
+    const std::uint32_t bits = ReadLe16(format + 14);
+    const std::uint32_t type = PcmWaveformType(bits, floating);
+    if (type == 0) return SCE_NGS2_ERROR_UNKNOWN_WAVEFORM_FORMAT;
     const std::uint32_t channels = ReadLe16(format + 2);
     const std::uint32_t sampleRate = ReadLe32(format + 4);
-    const std::uint32_t bytesPerFrame = channels * sizeof(std::int16_t);
-    if (ReadLe16(format + 14) != 16 || channels == 0 || channels > NGS2_MAX_CHANNELS || sampleRate == 0 || sampleRate > MAX_SAMPLE_RATE || ReadLe16(format + 12) != bytesPerFrame) {
+    const std::uint32_t bytesPerFrame = channels * (bits / 8);
+    if (channels == 0 || channels > NGS2_MAX_CHANNELS || sampleRate == 0 || sampleRate > MAX_SAMPLE_RATE || ReadLe16(format + 12) != bytesPerFrame) {
         return SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT;
     }
     if (chunks.sampler != nullptr && chunks.samplerSize >= 32 && ReadLe32(chunks.sampler + 28) != 0) throw std::runtime_error("NGS2: parsing looped waveforms is not implemented");
     if (chunks.dataSize > size - chunks.dataOffset || chunks.dataSize % bytesPerFrame != 0) return SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA;
     const std::size_t dataSize = chunks.dataSize;
-    info.format = {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, channels, sampleRate, 0, 0, 0};
+    info.format = {type, channels, sampleRate, 0, 0, 0};
     info.data_offset = static_cast<std::uint32_t>(chunks.dataOffset);
     info.data_size = static_cast<std::uint32_t>(dataSize);
     info.num_samples = static_cast<std::uint32_t>(dataSize / bytesPerFrame);
@@ -397,7 +408,12 @@ static int ParseWaveform(const RiffChunks& chunks, std::size_t size, Ngs2Wavefor
         std::memcmp(chunks.format + FMT_GUID_OFFSET, ATRAC9_GUID, sizeof(ATRAC9_GUID)) == 0) {
         return ParseAtrac9(chunks, info);
     }
-    if (tag == WAVE_FORMAT_PCM) return ParsePcm16(chunks, size, info);
+    if (tag == WAVE_FORMAT_EXTENSIBLE && chunks.formatSize >= FMT_GUID_OFFSET + sizeof(PCM_GUID) &&
+        std::memcmp(chunks.format + FMT_GUID_OFFSET, PCM_GUID, sizeof(PCM_GUID)) == 0) {
+        return ParsePcm(chunks, size, info, false);
+    }
+    if (tag == WAVE_FORMAT_PCM) return ParsePcm(chunks, size, info, false);
+    if (tag == WAVE_FORMAT_IEEE_FLOAT) return ParsePcm(chunks, size, info, true);
     throw std::runtime_error("NGS2: parsing waveform format tag " + Ngs2Hex(tag) + " is not implemented");
 }
 
diff --git a/core/libs/prx/libSceNgs2.native/src/Custom.cpp b/core/libs/prx/libSceNgs2.native/src/Custom.cpp
index e87845360e..5d066d889a 100644
--- a/core/libs/prx/libSceNgs2.native/src/Custom.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Custom.cpp
@@ -61,6 +61,9 @@ static void CheckDelayModule(std::uint32_t rackId, const Ngs2CustomRackModuleInf
 }
 
 int Ngs2CheckCustomRack(std::uint32_t rackId, const Ngs2CustomRackOption& option, std::uint32_t maxInputs) {
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING && option.num_modules != 0) {
+        throw std::runtime_error("NGS2: custom mastering racks with modules are not implemented");
+    }
     if (option.num_buffers == 0 || option.num_buffers > SCE_NGS2_CUSTOM_MAX_BUFFERS || option.num_buffers < maxInputs) {
         return SCE_NGS2_ERROR_INVALID_NUM_BUFFERS;
     }
diff --git a/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp b/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp
index ac5ec0321a..b5a9935162 100644
--- a/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp
+++ b/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp
@@ -118,6 +118,7 @@ struct Ngs2Voice {
     Ngs2PlayState state = Ngs2PlayState::Empty;
     std::uint32_t stateFlags = 0;
     std::uint32_t channels = 0;
+    std::uint32_t inputChannels = 0;
     std::uint32_t sampleRate = 0;
     std::uint32_t waveformType = 0;
     Ngs2Atrac9 atrac9;
@@ -153,6 +154,7 @@ struct Ngs2Voice {
     void SetEvent(std::uint32_t eventId);
     void ResetSetup();
     const std::uint8_t* WaveformData() const;
+    std::uint32_t InputChannels() const { return inputChannels != 0 ? inputChannels : channels; }
 };
 
 struct Ngs2Rack {
@@ -189,6 +191,8 @@ struct Ngs2System {
 };
 
 std::string Ngs2Hex(std::uint32_t value);
+std::size_t Ngs2PcmSampleBytes(std::uint32_t waveformType);
+void Ngs2ReadPcmFrame(std::uint32_t waveformType, std::uint32_t channels, const std::uint8_t* frame, float* output);
 const std::uint8_t* Ngs2StreamEnd(const Ngs2Voice& voice, const Ngs2Block& block);
 std::recursive_mutex& Ngs2Mutex();
 
diff --git a/core/libs/prx/libSceNgs2.native/src/Pan.cpp b/core/libs/prx/libSceNgs2.native/src/Pan.cpp
index e1a4d70548..f59c436bc9 100644
--- a/core/libs/prx/libSceNgs2.native/src/Pan.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Pan.cpp
@@ -1,11 +1,9 @@
-#include <algorithm>
 #include <cmath>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
 #include <numbers>
 #include <stdexcept>
-#include <string>
 
 #include "prx/libc/include/General.hpp"
 #include "Ngs2Internal.hpp"
@@ -57,14 +55,16 @@ static void AddBetweenSpeakers(const Ngs2PanWork& work, std::uint32_t speaker, f
 int Ngs2PanInit(Ngs2PanWork* work, const float* speaker_angles, float unit_angle, uint32_t num_speakers) {
     if (work == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
     if (speaker_angles != nullptr && !IsUnitAngle(unit_angle)) return SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE;
-    const auto* layout = LayoutFor(num_speakers);
-    if (layout == nullptr) {
-        if (speaker_angles == nullptr && num_speakers == 0) APS5_INVALID_ARG_EX;
-        return SCE_NGS2_ERROR_INVALID_PAN_SPEAKER;
+    if (speaker_angles == nullptr && num_speakers == 0) {
+        Ngs2PanInit(work, nullptr, DEGREES, 7);
+        work->unit_angle = unit_angle == RADIANS ? RADIANS : DEGREES;
+        return SCE_NGS2_OK;
     }
-    *work = {};
-    work->num_speakers = num_speakers;
+    const auto* layout = LayoutFor(num_speakers);
+    if (layout == nullptr) return SCE_NGS2_ERROR_INVALID_PAN_SPEAKER;
     if (speaker_angles == nullptr) {
+        *work = {};
+        work->num_speakers = num_speakers;
         for (std::uint32_t i = 0; i < num_speakers; i++) work->speaker_angles[i] = layout->defaultDegrees[i];
         work->speaker_angles[num_speakers] = layout->defaultDegrees[0] + DEGREES;
         work->unit_angle = DEGREES;
@@ -76,39 +76,39 @@ int Ngs2PanInit(Ngs2PanWork* work, const float* speaker_angles, float unit_angle
     }
     for (std::uint32_t i = 0; i < num_speakers; i++) {
         float angle = speaker_angles[layout->inputOrder[i]];
-        if (!std::isfinite(angle)) APS5_INVALID_ARG_EX;
         while (angle < 0.0f) {
-            if (angle + unit_angle == angle) throw std::runtime_error("NGS2: pan angles too large to wrap are not implemented");
+            if (angle + unit_angle == angle) throw std::runtime_error("NGS2: pan speaker angles too large to wrap are not implemented (the PS5 library did not return for them within 60 s)");
             angle += unit_angle;
         }
         while (angle >= unit_angle) {
-            if (!(unit_angle < angle)) APS5_INVALID_ARG_EX;
-            if (angle - unit_angle == angle) throw std::runtime_error("NGS2: pan angles too large to wrap are not implemented");
+            if (!(unit_angle < angle)) throw std::runtime_error("NGS2: a pan speaker angle that wraps to the unit angle is not implemented (the PS5 library did not return for it within 60 s)");
+            if (angle - unit_angle == angle) throw std::runtime_error("NGS2: pan speaker angles too large to wrap are not implemented (the PS5 library did not return for them within 60 s)");
             angle -= unit_angle;
         }
         work->speaker_angles[i] = angle;
     }
     work->speaker_angles[num_speakers] = work->speaker_angles[0] + unit_angle;
     work->unit_angle = unit_angle;
+    work->num_speakers = num_speakers;
     return SCE_NGS2_OK;
 }
 
 int Ngs2PanGetVolumeMatrix(Ngs2PanWork* work, const Ngs2PanParam* params, uint32_t num_params, uint32_t matrix_format, float* out_volume_matrix) {
-    if (work == nullptr || params == nullptr) APS5_INVALID_ARG_EX;
+    if (work == nullptr) return SCE_NGS2_ERROR_INVALID_PAN_WORK;
+    if (params == nullptr) return SCE_NGS2_ERROR_INVALID_PAN_PARAM;
     if (out_volume_matrix == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    if (matrix_format != 1 && matrix_format != 2 && matrix_format != 6 && matrix_format != 8) APS5_INVALID_ARG_EX;
+    if (matrix_format != 1 && matrix_format != 2 && matrix_format != 6 && matrix_format != 8) return SCE_NGS2_ERROR_INVALID_PAN_MATRIX_FORMAT;
     const auto* layout = LayoutFor(work->num_speakers);
-    if (layout == nullptr || !IsUnitAngle(work->unit_angle) || !std::isfinite(work->speaker_angles[0]) || num_params > MAX_PAN_PARAMS) APS5_INVALID_ARG_EX;
-    for (std::uint32_t p = 0; p < num_params; p++) {
-        if (!std::isfinite(params[p].angle) || std::isnan(params[p].distance)) APS5_INVALID_ARG_EX;
-    }
+    if (layout == nullptr) return SCE_NGS2_ERROR_INVALID_PAN_SPEAKER;
+    if (!IsUnitAngle(work->unit_angle)) return SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE;
+    if (num_params > MAX_PAN_PARAMS) return SCE_NGS2_ERROR_INVALID_NUM_CHANNELS;
     std::memset(out_volume_matrix, 0, static_cast<std::size_t>(num_params) * matrix_format * sizeof(float));
     const std::uint32_t numSpeakers = work->num_speakers;
     const float unit = work->unit_angle;
     const float first = work->speaker_angles[0];
     for (std::uint32_t p = 0; p < num_params; p++) {
         const auto& param = params[p];
-        const float distance = std::max(-1.0f, std::min(1.0f, param.distance));
+        const float distance = param.distance > 1.0f ? 1.0f : param.distance < -1.0f ? -1.0f : param.distance;
         const float towardWeight = std::sin((distance + 1.0f) * 0.5f * std::numbers::pi_v<float> * 0.5f);
         const float oppositeWeight = std::sin((1.0f - distance) * 0.5f * std::numbers::pi_v<float> * 0.5f);
         float angle = param.angle;
@@ -116,7 +116,7 @@ int Ngs2PanGetVolumeMatrix(Ngs2PanWork* work, const Ngs2PanParam* params, uint32
             const float before = angle;
             if (angle >= first + unit) angle -= unit;
             if (angle < first) angle += unit;
-            if (angle == before) throw std::runtime_error("NGS2: pan angles too large to wrap are not implemented");
+            if (angle == before) throw std::runtime_error("NGS2: pan angles that do not wrap into one turn are not implemented (the PS5 library did not return for them within 60 s)");
         }
         float opposite = angle + unit * 0.5f;
         if (!(opposite < first + unit)) opposite -= unit;
diff --git a/core/libs/prx/libSceNgs2.native/src/Pcm.cpp b/core/libs/prx/libSceNgs2.native/src/Pcm.cpp
new file mode 100644
index 0000000000..49b8611046
--- /dev/null
+++ b/core/libs/prx/libSceNgs2.native/src/Pcm.cpp
@@ -0,0 +1,57 @@
+#include <bit>
+#include <cstdint>
+#include <stdexcept>
+
+#include "Ngs2Internal.hpp"
+
+std::size_t Ngs2PcmSampleBytes(std::uint32_t waveformType) {
+    switch (waveformType) {
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_U8: return 1;
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_I16L: return 2;
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_I24L: return 3;
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_I32L:
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_F32L: return 4;
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_F64L: return 8;
+        default: throw std::runtime_error("NGS2: PCM waveform type " + Ngs2Hex(waveformType) + " is not implemented");
+    }
+}
+
+static std::uint64_t ReadLittleEndian(const std::uint8_t* data, std::size_t bytes) {
+    std::uint64_t value = 0;
+    for (std::size_t i = 0; i < bytes; i++) value |= static_cast<std::uint64_t>(data[i]) << (i * 8);
+    return value;
+}
+
+static void CheckFloatRange(std::uint64_t magnitude, std::uint64_t minimum, std::uint64_t maximum) {
+    if (magnitude > maximum || (magnitude != 0 && magnitude < minimum)) {
+        throw std::runtime_error("NGS2: nonfinite, subnormal or out-of-range floating-point PCM is not implemented");
+    }
+}
+
+static float ReadSample(std::uint32_t waveformType, const std::uint8_t* sample, std::size_t bytes) {
+    const auto value = ReadLittleEndian(sample, bytes);
+    switch (waveformType) {
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_U8:
+            return (static_cast<int>(value) - 128) / 128.0f;
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_I16L:
+            return std::bit_cast<std::int16_t>(static_cast<std::uint16_t>(value)) / 32768.0f;
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_I24L:
+            return (static_cast<std::int32_t>(value ^ 0x800000) - 0x800000) / 8388608.0f;
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_I32L:
+            return static_cast<float>(std::bit_cast<std::int32_t>(static_cast<std::uint32_t>(value)) / 2147483648.0);
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_F32L:
+            CheckFloatRange(value & 0x7fffffff, 0x00800000, 0x3f800000);
+            return std::bit_cast<float>(static_cast<std::uint32_t>(value));
+        case SCE_NGS2_WAVEFORM_TYPE_PCM_F64L:
+            CheckFloatRange(value & 0x7fffffffffffffff, 0x3810000000000000, 0x3ff0000000000000);
+            return static_cast<float>(std::bit_cast<double>(value));
+        default: throw std::runtime_error("NGS2: PCM sample conversion is not implemented");
+    }
+}
+
+void Ngs2ReadPcmFrame(std::uint32_t waveformType, std::uint32_t channels, const std::uint8_t* frame, float* output) {
+    const auto bytes = Ngs2PcmSampleBytes(waveformType);
+    for (std::uint32_t channel = 0; channel < channels; channel++) {
+        output[channel] = frame == nullptr ? 0.0f : ReadSample(waveformType, frame + channel * bytes, bytes);
+    }
+}
diff --git a/core/libs/prx/libSceNgs2.native/src/Rack.cpp b/core/libs/prx/libSceNgs2.native/src/Rack.cpp
index 21d0cb17ba..13277128e3 100644
--- a/core/libs/prx/libSceNgs2.native/src/Rack.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Rack.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
@@ -19,6 +20,7 @@ union RackOptions {
     Ngs2ReverbRackOption reverb;
     Ngs2CustomSamplerRackOption customSampler;
     Ngs2CustomSubmixerRackOption customSubmixer;
+    Ngs2CustomMasteringRackOption customMastering;
 };
 
 static std::size_t RackOptionSize(std::uint32_t rackId) {
@@ -29,12 +31,13 @@ static std::size_t RackOptionSize(std::uint32_t rackId) {
         case SCE_NGS2_RACK_ID_REVERB: return sizeof(Ngs2ReverbRackOption);
         case SCE_NGS2_RACK_ID_CUSTOM_SAMPLER: return sizeof(Ngs2CustomSamplerRackOption);
         case SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER: return sizeof(Ngs2CustomSubmixerRackOption);
+        case SCE_NGS2_RACK_ID_CUSTOM_MASTERING: return sizeof(Ngs2CustomMasteringRackOption);
         default: throw std::runtime_error("NGS2: rack id " + Ngs2Hex(rackId) + " is not implemented");
     }
 }
 
 static RackOptions DefaultRackOption(std::uint32_t rackId) {
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER || rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) {
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER || rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) {
         throw std::runtime_error("NGS2: default custom rack options are not implemented");
     }
     RackOptions options{};
@@ -83,7 +86,7 @@ static std::uint32_t RackMaxChannels(std::uint32_t rackId, const RackOptions& op
     if (rackId == SCE_NGS2_RACK_ID_SUBMIXER) return options.submixer.max_channels;
     if (rackId == SCE_NGS2_RACK_ID_MASTERING) return options.mastering.max_channels;
     if (rackId == SCE_NGS2_RACK_ID_REVERB) return options.reverb.max_channels;
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) return options.customSubmixer.max_channels;
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) return options.customSubmixer.max_channels;
     return NGS2_MAX_CHANNELS;
 }
 
@@ -97,17 +100,17 @@ static int CheckedRackOption(std::uint32_t rackId, const Ngs2RackOption* option,
     options = {};
     std::memcpy(&options, option, size);
     const auto maxChannels = RackMaxChannels(rackId, options);
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER && maxChannels > SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS) return SCE_NGS2_ERROR_INVALID_NUM_CHANNELS;
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER && (options.customSubmixer.max_inputs == 0 || options.customSubmixer.max_inputs > SCE_NGS2_CUSTOM_SUBMIXER_MAX_INPUTS)) {
+    if ((rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) && maxChannels > SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS) return SCE_NGS2_ERROR_INVALID_NUM_CHANNELS;
+    if ((rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) && (options.customSubmixer.max_inputs == 0 || options.customSubmixer.max_inputs > SCE_NGS2_CUSTOM_SUBMIXER_MAX_INPUTS)) {
         throw std::runtime_error("NGS2: custom submixer racks with " + std::to_string(options.customSubmixer.max_inputs) + " inputs are not implemented");
     }
     if (options.common.max_voices == 0 || maxChannels == 0) throw std::invalid_argument("NGS2: invalid rack voice or channel count");
     int result = SCE_NGS2_OK;
     if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) result = Ngs2CheckCustomRack(rackId, options.customSampler.custom_rack_option, 0);
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) result = Ngs2CheckCustomRack(rackId, options.customSubmixer.custom_rack_option, options.customSubmixer.max_inputs);
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) result = Ngs2CheckCustomRack(rackId, options.customSubmixer.custom_rack_option, options.customSubmixer.max_inputs);
     if (result != SCE_NGS2_OK) return result;
     if (maxChannels > NGS2_MAX_CHANNELS) {
-        if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) {
+        if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) {
             throw std::runtime_error("NGS2: custom submixer racks with " + std::to_string(maxChannels) + " channels are not implemented");
         }
         throw std::invalid_argument("NGS2: invalid rack voice or channel count");
@@ -129,7 +132,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO
     rack->maxChannels = RackMaxChannels(rackId, options);
     rack->maxFilters = rackId == SCE_NGS2_RACK_ID_SAMPLER ? options.sampler.max_filters
                       : rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER ? options.customSampler.custom_rack_option.num_modules
-                      : rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER ? options.customSubmixer.custom_rack_option.num_modules : 0;
+                      : (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) ? options.customSubmixer.custom_rack_option.num_modules : 0;
     rack->uid = nextUid++;
     std::memcpy(rack->name, options.common.name, sizeof(rack->name));
     rack->name[sizeof(rack->name) - 1] = '\0';
@@ -137,7 +140,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO
     if (rackId == SCE_NGS2_RACK_ID_SAMPLER) rack->maxChannelWorks = options.sampler.max_channel_works;
     if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) rack->maxChannelWorks = options.customSampler.max_channel_works;
     if (rackId == SCE_NGS2_RACK_ID_SUBMIXER) rack->maxInputs = options.submixer.max_inputs;
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) rack->maxInputs = options.customSubmixer.max_inputs;
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) rack->maxInputs = options.customSubmixer.max_inputs;
     rack->bufferInfo = bufferInfo;
     rack->allocator = allocator;
     rack->voices.resize(options.common.max_voices);
@@ -147,7 +150,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO
         voice.matrices.resize(options.common.max_matrices);
     }
     if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) Ngs2SetupUserFx(*rack, options.customSampler.custom_rack_option);
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) Ngs2SetupUserFx(*rack, options.customSubmixer.custom_rack_option);
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) Ngs2SetupUserFx(*rack, options.customSubmixer.custom_rack_option);
     system->racks.push_back(rack);
     *handle = reinterpret_cast<Ngs2Handle>(rack);
     return SCE_NGS2_OK;
diff --git a/core/libs/prx/libSceNgs2.native/src/Render.cpp b/core/libs/prx/libSceNgs2.native/src/Render.cpp
index fa764d375a..a56dc7072b 100644
--- a/core/libs/prx/libSceNgs2.native/src/Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Render.cpp
@@ -15,7 +15,7 @@ static constexpr double PHASE_ONE = 4294967296.0;
 static constexpr std::uint64_t PHASE_FRACTION = 0xffffffff;
 
 static const std::uint8_t* FrameAt(const Ngs2Voice& voice, const Ngs2Block& block, std::uint32_t frame) {
-    const std::size_t frameBytes = voice.channels * sizeof(std::int16_t);
+    const std::size_t frameBytes = voice.channels * Ngs2PcmSampleBytes(voice.waveformType);
     if (block.data == nullptr) return nullptr;
     if (block.streaming) {
         for (const auto& piece : block.pieces) {
@@ -27,15 +27,7 @@ static const std::uint8_t* FrameAt(const Ngs2Voice& voice, const Ngs2Block& bloc
 }
 
 static void ReadPcm(const Ngs2Voice& voice, const std::uint8_t* frame, float* out) {
-    if (frame == nullptr) {
-        for (std::uint32_t channel = 0; channel < voice.channels; channel++) out[channel] = 0.0f;
-        return;
-    }
-    for (std::uint32_t channel = 0; channel < voice.channels; channel++) {
-        std::int16_t sample;
-        std::memcpy(&sample, frame + channel * sizeof(sample), sizeof(sample));
-        out[channel] = sample / 32768.0f;
-    }
+    Ngs2ReadPcmFrame(voice.waveformType, voice.channels, frame, out);
 }
 
 static void ReadFrames(Ngs2Voice& voice, float* current, float* next) {
@@ -93,7 +85,7 @@ static void Advance(Ngs2Voice& voice, std::uint64_t frames) {
         const auto step = std::min<std::uint64_t>(frames, limit - block.cursor);
         block.cursor += static_cast<std::uint32_t>(step);
         voice.decodedSamples += step;
-        if (voice.waveformType != SCE_NGS2_WAVEFORM_TYPE_ATRAC9) voice.decodedBytes += step * voice.channels * sizeof(std::int16_t);
+        if (voice.waveformType != SCE_NGS2_WAVEFORM_TYPE_ATRAC9) voice.decodedBytes += step * voice.channels * Ngs2PcmSampleBytes(voice.waveformType);
         frames -= step;
         if (block.streaming) {
             while (block.pieces.size() > 1 && block.cursor >= block.pieces.front().firstFrame + block.pieces.front().frames) block.pieces.erase(block.pieces.begin());
@@ -221,10 +213,11 @@ float Ngs2DefaultLevel(std::uint32_t sourceChannels, std::uint32_t source, std::
 
 static void MixPort(Ngs2Voice& voice, const Ngs2Voice& source, const Ngs2Port& port, std::uint32_t grain) {
     const auto* matrix = port.matrix < 0 || source.matrices[port.matrix].empty() ? nullptr : &source.matrices[port.matrix];
-    const std::size_t outputs = matrix == nullptr ? voice.channels : std::min<std::size_t>(voice.channels, matrix->size() / source.channels);
+    const auto channels = voice.InputChannels();
+    const std::size_t outputs = matrix == nullptr ? channels : std::min<std::size_t>(channels, matrix->size() / source.channels);
     for (std::size_t dst = 0; dst < outputs; dst++) {
         for (std::uint32_t src = 0; src < source.channels; src++) {
-            const float level = port.volume * (matrix == nullptr ? Ngs2DefaultLevel(source.channels, src, voice.channels, static_cast<std::uint32_t>(dst)) : (*matrix)[dst * source.channels + src]);
+            const float level = port.volume * (matrix == nullptr ? Ngs2DefaultLevel(source.channels, src, channels, static_cast<std::uint32_t>(dst)) : (*matrix)[dst * source.channels + src]);
             if (level == 0.0f) continue;
             for (std::uint32_t i = 0; i < grain; i++) voice.samples[dst * grain + i] += source.samples[src * grain + i] * level;
         }
@@ -251,7 +244,7 @@ static void RenderVoice(Ngs2Voice& voice, const std::vector<Ngs2Voice*>& voices,
         bool& active;
         ~RenderingScope() { active = false; }
     } renderingScope{voice.rendering};
-    voice.samples.assign(static_cast<std::size_t>(grain) * voice.channels, 0.0f);
+    voice.samples.assign(static_cast<std::size_t>(grain) * voice.InputChannels(), 0.0f);
     voice.hasSamples = false;
     if (voice.state == Ngs2PlayState::Playing && voice.channels != 0) {
         if (voice.rack->rackId == SCE_NGS2_RACK_ID_SAMPLER || voice.rack->rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) {
@@ -263,6 +256,7 @@ static void RenderVoice(Ngs2Voice& voice, const std::vector<Ngs2Voice*>& voices,
         Ngs2ProcessLegacyUserFx(voice, grain, systemRate);
         Ngs2ProcessUserFx(voice, grain, systemRate);
     }
+    if (voice.samples.size() != static_cast<std::size_t>(grain) * voice.channels) voice.samples.assign(static_cast<std::size_t>(grain) * voice.channels, 0.0f);
     voice.rendered = true;
 }
 
@@ -297,6 +291,7 @@ static void WriteOutput(const Ngs2RenderBufferInfo& output, const std::vector<fl
     }
     auto* pcm = static_cast<std::int16_t*>(output.buffer);
     for (std::size_t i = 0; i < mix.size(); i++) {
+        if (std::isnan(mix[i])) throw std::runtime_error("NGS2: a NaN sample in a PCM_I16L render buffer is not implemented");
         pcm[i] = static_cast<std::int16_t>(std::min(std::lrint(std::clamp(mix[i], -1.0f, 1.0f) * 32768.0f), 32767L));
     }
 }
@@ -336,7 +331,7 @@ void Ngs2RenderSystem(Ngs2System& system, const Ngs2RenderBufferInfo* bufferInfo
     std::vector<std::vector<float>> mixes(numBufferInfo);
     for (auto* voice : voices) {
         RenderVoice(*voice, voices, grain, system.option.sample_rate);
-        if (voice->rack->rackId != SCE_NGS2_RACK_ID_MASTERING || !voice->hasSamples) continue;
+        if ((voice->rack->rackId != SCE_NGS2_RACK_ID_MASTERING && voice->rack->rackId != SCE_NGS2_RACK_ID_CUSTOM_MASTERING) || !voice->hasSamples) continue;
         auto& mix = OutputMix(mixes, bufferInfo, numBufferInfo, *voice, grain);
         const std::uint32_t outputChannels = bufferInfo[voice->outputId].num_channels;
         for (std::uint32_t channel = 0; channel < voice->channels; channel++) {
diff --git a/core/libs/prx/libSceNgs2.native/src/Reverb.cpp b/core/libs/prx/libSceNgs2.native/src/Reverb.cpp
index 131fb321f7..ab3849fbdd 100644
--- a/core/libs/prx/libSceNgs2.native/src/Reverb.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Reverb.cpp
@@ -292,9 +292,23 @@ bool Ngs2ProcessReverb(Ngs2Voice& voice, std::uint32_t grain, std::uint32_t samp
         Reset(reverb);
         reverb.changed = true;
     }
+    const std::uint32_t inputChannels = voice.InputChannels();
     const std::vector<float> input = voice.samples;
     std::vector<float> mono(grain), early(grain), late(grain);
-    MixDown(input.data(), channels, grain, mono.data());
+    MixDown(input.data(), inputChannels, grain, mono.data());
+    std::vector<float> mapped;
+    if (inputChannels != channels) {
+        mapped.assign(static_cast<std::size_t>(grain) * channels, 0.0f);
+        for (std::uint32_t dst = 0; dst < channels; dst++) {
+            for (std::uint32_t src = 0; src < inputChannels; src++) {
+                const float level = Ngs2DefaultLevel(inputChannels, src, channels, dst);
+                if (level == 0.0f) continue;
+                for (std::uint32_t i = 0; i < grain; i++) mapped[static_cast<std::size_t>(dst) * grain + i] += input[static_cast<std::size_t>(src) * grain + i] * level;
+            }
+        }
+        voice.samples.assign(static_cast<std::size_t>(grain) * channels, 0.0f);
+    }
+    const std::vector<float>& direct = inputChannels != channels ? mapped : input;
     if (reverb.changed) {
         std::vector<float> oldEarly(grain), oldLate(grain);
         RunTaps(reverb, reverb.taps, mono.data(), grain, oldEarly.data(), oldLate.data());
@@ -319,7 +333,7 @@ bool Ngs2ProcessReverb(Ngs2Voice& voice, std::uint32_t grain, std::uint32_t samp
     for (std::uint32_t channel = 0; channel < channels; channel++) {
         auto& state = reverb.channels[channel];
         float* out = voice.samples.data() + static_cast<std::size_t>(channel) * grain;
-        const float* in = input.data() + static_cast<std::size_t>(channel) * grain;
+        const float* in = direct.data() + static_cast<std::size_t>(channel) * grain;
         if (channel == LFE_CHANNEL) {
             std::copy(in, in + grain, out);
         } else {
diff --git a/core/libs/prx/libSceNgs2.native/src/System.cpp b/core/libs/prx/libSceNgs2.native/src/System.cpp
index 1f6dd14d90..28a7828f36 100644
--- a/core/libs/prx/libSceNgs2.native/src/System.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/System.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <condition_variable>
 #include <cstddef>
@@ -18,7 +19,6 @@
 #include "prx/libc/include/General.hpp"
 #include "Ngs2Internal.hpp"
 
-
 static std::vector<Ngs2System*>& Systems() {
     static auto* const systems = new std::vector<Ngs2System*>();
     return *systems;
diff --git a/core/libs/prx/libSceNgs2.native/src/Voice.cpp b/core/libs/prx/libSceNgs2.native/src/Voice.cpp
index 8f9c3fabc4..0efa7461ca 100644
--- a/core/libs/prx/libSceNgs2.native/src/Voice.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Voice.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <cmath>
 #include <cstddef>
@@ -19,6 +20,16 @@ static constexpr std::uint8_t COMMAND_TYPE_INT = 3;
 static constexpr std::uint8_t COMMAND_TYPE_UINT = 4;
 static constexpr std::uint8_t COMMAND_TYPE_FLOAT_ARRAY = 0x11;
 static constexpr float MAX_MATRIX_LEVEL = 4.0f;
+static constexpr float MAX_MASTERING_GAIN = 32.0f;
+
+struct Ngs2ReturnCode {
+    int code;
+};
+
+static void SendEvent(Ngs2Voice& voice, std::uint32_t eventId) {
+    if (eventId == SCE_NGS2_VOICE_EVENT_PLAY && voice.channels == 0) throw Ngs2ReturnCode{SCE_NGS2_ERROR_INVALID_VOICE_ACCESS};
+    voice.SetEvent(eventId);
+}
 
 void Ngs2Voice::SetEvent(std::uint32_t eventId) {
     switch (eventId) {
@@ -56,6 +67,7 @@ void Ngs2Voice::ResetSetup() {
     fbwLevel = 1.0f;
     lfeLevel = 1.0f;
     channels = 0;
+    inputChannels = 0;
     sampleRate = 0;
     waveformType = 0;
     atrac9 = {};
@@ -76,7 +88,7 @@ void Ngs2Voice::ResetSetup() {
 
 const std::uint8_t* Ngs2StreamEnd(const Ngs2Voice& voice, const Ngs2Block& block) {
     const auto& last = block.pieces.back();
-    return last.data + last.frames * voice.channels * sizeof(std::int16_t);
+    return last.data + last.frames * voice.channels * Ngs2PcmSampleBytes(voice.waveformType);
 }
 
 const std::uint8_t* Ngs2Voice::WaveformData() const {
@@ -85,11 +97,12 @@ const std::uint8_t* Ngs2Voice::WaveformData() const {
     if (waveformType == SCE_NGS2_WAVEFORM_TYPE_ATRAC9) return block.data + block.dataCursor;
     if (block.streaming) {
         for (const auto& piece : block.pieces) {
-            if (block.cursor >= piece.firstFrame && block.cursor - piece.firstFrame < piece.frames) return piece.data + (block.cursor - piece.firstFrame) * channels * sizeof(std::int16_t);
+            if (block.cursor >= piece.firstFrame && block.cursor - piece.firstFrame < piece.frames) return piece.data + (block.cursor - piece.firstFrame) * channels * Ngs2PcmSampleBytes(waveformType);
         }
         return Ngs2StreamEnd(*this, block);
     }
-    return block.data + (static_cast<std::size_t>(block.info.num_skip_samples) + block.cursor) * channels * sizeof(std::int16_t);
+    if (block.data == nullptr) return nullptr;
+    return block.data + (static_cast<std::size_t>(block.info.num_skip_samples) + block.cursor) * channels * Ngs2PcmSampleBytes(waveformType);
 }
 
 static Ngs2Port& PortAt(Ngs2Voice& voice, std::uint32_t port) {
@@ -158,7 +171,7 @@ static void ApplyCommonParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param
             break;
         }
         case SCE_NGS2_VOICE_PARAM_PATCH: Patch(voice, ParamAs<Ngs2VoicePatchParam>(param)); break;
-        case SCE_NGS2_VOICE_PARAM_EVENT: voice.SetEvent(ParamAs<Ngs2VoiceEventParam>(param).event_id); break;
+        case SCE_NGS2_VOICE_PARAM_EVENT: SendEvent(voice, ParamAs<Ngs2VoiceEventParam>(param).event_id); break;
         case SCE_NGS2_VOICE_PARAM_CALLBACK: {
             const auto& callback = ParamAs<Ngs2VoiceCallbackParam>(param);
             voice.callback = callback.callback;
@@ -171,10 +184,14 @@ static void ApplyCommonParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param
 }
 
 static void SetupSampler(Ngs2Voice& voice, const Ngs2WaveformFormat& format) {
+    if (format.waveform_type == 0 && format.num_channels == 0 && format.sample_rate == 0) {
+        if (voice.channels == 0) voice.ResetSetup();
+        return;
+    }
     voice.ResetSetup();
-    if (format.waveform_type == 0 && format.num_channels == 0 && format.sample_rate == 0) return;
-    if (format.waveform_type != SCE_NGS2_WAVEFORM_TYPE_PCM_I16L && format.waveform_type != SCE_NGS2_WAVEFORM_TYPE_ATRAC9) {
-        throw std::runtime_error("NGS2: waveform type " + Ngs2Hex(format.waveform_type) + " is not implemented");
+    if (format.waveform_type != SCE_NGS2_WAVEFORM_TYPE_ATRAC9) Ngs2PcmSampleBytes(format.waveform_type);
+    if (format.waveform_type != SCE_NGS2_WAVEFORM_TYPE_PCM_I16L && format.waveform_type != SCE_NGS2_WAVEFORM_TYPE_ATRAC9 && format.config_data != 0) {
+        throw std::runtime_error("NGS2: configured PCM waveforms are not implemented");
     }
     if (format.frame_offset != 0 || format.frame_margin != 0) throw std::runtime_error("NGS2: waveform frame offset and margin are not implemented");
     if (format.num_channels == 0 || format.num_channels > NGS2_MAX_CHANNELS || format.sample_rate == 0) APS5_INVALID_ARG_EX;
@@ -225,7 +242,7 @@ static void AddWaveformBlocks(Ngs2Voice& voice, const Ngs2SamplerVoiceWaveformBl
         voice.waveformEnd = nullptr;
         if (voice.waveformType == SCE_NGS2_WAVEFORM_TYPE_ATRAC9) Ngs2RestartAtrac9(voice);
     }
-    const std::size_t frameBytes = voice.channels * sizeof(std::int16_t);
+    const std::size_t frameBytes = voice.channels == 0 || voice.waveformType == SCE_NGS2_WAVEFORM_TYPE_ATRAC9 ? 0 : voice.channels * Ngs2PcmSampleBytes(voice.waveformType);
     if ((param.flags & SCE_NGS2_WAVEFORM_BLOCKS_FLAG_APPEND) != 0) {
         AppendStreamData(voice, param, frameBytes);
         voice.acceptsBlocks = (param.flags & SCE_NGS2_WAVEFORM_BLOCKS_FLAG_CONTINUE) != 0;
@@ -237,7 +254,7 @@ static void AddWaveformBlocks(Ngs2Voice& voice, const Ngs2SamplerVoiceWaveformBl
         const auto& block = param.blocks[i];
         if (block.num_samples == 0 && block.data_size == 0) continue;
         if (allowsSilence && block.data_size == 0) {
-            if (voice.waveformType == SCE_NGS2_WAVEFORM_TYPE_ATRAC9) throw std::runtime_error("NGS2: a dataless waveform block under the silence flag is not implemented for ATRAC9 voices");
+            if (voice.waveformType != SCE_NGS2_WAVEFORM_TYPE_PCM_I16L) throw std::runtime_error("NGS2: a dataless waveform block under the silence flag is not implemented for this format");
             voice.blocks.push_back({nullptr, block});
             continue;
         }
@@ -357,9 +374,11 @@ static void ApplyParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) {
             if (param.id == SCE_NGS2_REVERB_VOICE_PARAM_SETUP) {
                 const auto& setup = ParamAs<Ngs2ReverbVoiceSetupParam>(param);
                 if (setup.flags != 0) throw std::runtime_error("NGS2: reverb setup flags are not implemented");
-                if (setup.num_input_channels != setup.num_output_channels) throw std::runtime_error("NGS2: reverb channel conversion is not implemented");
-                if (setup.num_output_channels != 1 && setup.num_output_channels != 2 && setup.num_output_channels != 6 && setup.num_output_channels != 8) APS5_INVALID_ARG_EX;
+                for (const auto count : {setup.num_input_channels, setup.num_output_channels}) {
+                    if ((count != 1 && count != 2 && count != 6 && count != 8) || count > voice.rack->maxChannels) APS5_INVALID_ARG_EX;
+                }
                 SetupMixer(voice, setup.num_output_channels);
+                voice.inputChannels = setup.num_input_channels;
                 Ngs2SetupReverb(voice);
                 return;
             }
@@ -369,18 +388,18 @@ static void ApplyParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) {
             }
             break;
         case SCE_NGS2_RACK_ID_MASTERING:
-            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_SETUP) {
+        case SCE_NGS2_RACK_ID_CUSTOM_MASTERING:
+            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_SETUP || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP) {
                 SetupMixer(voice, ParamAs<Ngs2MasteringVoiceSetupParam>(param).num_io_channels);
                 return;
             }
-            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_GAIN) {
+            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_GAIN || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN) {
                 const auto& gain = ParamAs<Ngs2MasteringVoiceGainParam>(param);
-                if (!std::isfinite(gain.fbw_level) || !std::isfinite(gain.lfe_level)) APS5_INVALID_ARG_EX;
-                voice.fbwLevel = gain.fbw_level;
-                voice.lfeLevel = gain.lfe_level;
+                voice.fbwLevel = std::clamp(gain.fbw_level, -MAX_MASTERING_GAIN, MAX_MASTERING_GAIN);
+                voice.lfeLevel = std::clamp(gain.lfe_level, -MAX_MASTERING_GAIN, MAX_MASTERING_GAIN);
                 return;
             }
-            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_OUTPUT) {
+            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_OUTPUT || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT) {
                 voice.outputId = ParamAs<Ngs2MasteringVoiceOutputParam>(param).output_id;
                 return;
             }
@@ -400,9 +419,13 @@ int APS5_VABI sceNgs2VoiceControl(uintptr_t voice_handle, const Ngs2VoiceParamHe
     auto* found = Ngs2FindVoice(voice_handle);
     if (found == nullptr) return SCE_NGS2_ERROR_INVALID_VOICE_HANDLE;
     auto& voice = *found;
-    for (const auto* param = param_list;; param = reinterpret_cast<const Ngs2VoiceParamHeader*>(reinterpret_cast<const std::uint8_t*>(param) + param->next)) {
-        ApplyParam(voice, *param);
-        if (param->next == 0) break;
+    try {
+        for (const auto* param = param_list;; param = reinterpret_cast<const Ngs2VoiceParamHeader*>(reinterpret_cast<const std::uint8_t*>(param) + param->next)) {
+            ApplyParam(voice, *param);
+            if (param->next == 0) break;
+        }
+    } catch (const Ngs2ReturnCode& result) {
+        return result.code;
     }
     return SCE_NGS2_OK;
 }
@@ -413,20 +436,24 @@ int APS5_VABI sceNgs2VoiceRunCommands(uintptr_t voice_handle, const Ngs2VoiceCom
     if (found == nullptr) return SCE_NGS2_ERROR_INVALID_VOICE_HANDLE;
     auto& voice = *found;
     if (commands == nullptr && num_commands != 0) APS5_INVALID_ARG_EX;
-    for (std::size_t i = 0; i < num_commands; i++) {
-        const auto& command = commands[i];
-        const std::uint32_t index = command.id >> 24;
-        const std::uint32_t id = command.id & 0xffffff;
-        const std::uint8_t expectedType = id == COMMAND_EVENT ? COMMAND_TYPE_UINT
-                                        : id == COMMAND_MATRIX_LEVELS ? COMMAND_TYPE_FLOAT_ARRAY
-                                        : id == COMMAND_PORT_VOLUME ? COMMAND_TYPE_FLOAT
-                                        : id == COMMAND_PORT_MATRIX ? COMMAND_TYPE_INT : 0;
-        if (expectedType == 0) throw std::runtime_error("NGS2: voice command " + Ngs2Hex(command.id) + " is not implemented");
-        if (command.type != expectedType) throw std::invalid_argument("NGS2: voice command " + Ngs2Hex(command.id) + " has value type " + Ngs2Hex(command.type));
-        if (id == COMMAND_EVENT) voice.SetEvent(command.value.u);
-        else if (id == COMMAND_MATRIX_LEVELS) SetMatrixLevels(voice, index, command.value.levels, command.count);
-        else if (id == COMMAND_PORT_VOLUME) PortAt(voice, index).volume = command.value.f;
-        else SetPortMatrix(voice, index, command.value.i);
+    try {
+        for (std::size_t i = 0; i < num_commands; i++) {
+            const auto& command = commands[i];
+            const std::uint32_t index = command.id >> 24;
+            const std::uint32_t id = command.id & 0xffffff;
+            const std::uint8_t expectedType = id == COMMAND_EVENT ? COMMAND_TYPE_UINT
+                                            : id == COMMAND_MATRIX_LEVELS ? COMMAND_TYPE_FLOAT_ARRAY
+                                            : id == COMMAND_PORT_VOLUME ? COMMAND_TYPE_FLOAT
+                                            : id == COMMAND_PORT_MATRIX ? COMMAND_TYPE_INT : 0;
+            if (expectedType == 0) throw std::runtime_error("NGS2: voice command " + Ngs2Hex(command.id) + " is not implemented");
+            if (command.type != expectedType) throw std::invalid_argument("NGS2: voice command " + Ngs2Hex(command.id) + " has value type " + Ngs2Hex(command.type));
+            if (id == COMMAND_EVENT) SendEvent(voice, command.value.u);
+            else if (id == COMMAND_MATRIX_LEVELS) SetMatrixLevels(voice, index, command.value.levels, command.count);
+            else if (id == COMMAND_PORT_VOLUME) PortAt(voice, index).volume = command.value.f;
+            else SetPortMatrix(voice, index, command.value.i);
+        }
+    } catch (const Ngs2ReturnCode& result) {
+        return result.code;
     }
     return SCE_NGS2_OK;
 }
@@ -472,6 +499,12 @@ int APS5_VABI sceNgs2VoiceGetState(uintptr_t voice_handle, Ngs2VoiceState* state
             sampler.num_decoded_samples = voice.decodedSamples;
             return SCE_NGS2_OK;
         }
+        case SCE_NGS2_RACK_ID_CUSTOM_MASTERING: {
+            if (state_size != sizeof(Ngs2VoiceState)) return SCE_NGS2_ERROR_INVALID_OUT_SIZE;
+            *state = {};
+            state->state_flags = voice.stateFlags;
+            return SCE_NGS2_OK;
+        }
         default: throw std::runtime_error("NGS2: voice state of rack " + Ngs2Hex(voice.rack->rackId) + " is not implemented");
     }
 }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp
index c8260d8bb2..1c72ffa8d4 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include "libatrac9.h"
@@ -396,6 +397,7 @@ static bool ParseThrows(const std::vector<std::uint8_t>& file) {
     Ngs2WaveformInfo info{};
     try {
         sceNgs2ParseWaveformData(file.data(), file.size(), &info);
+
     } catch (const std::runtime_error&) {
         return true;
     }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp
index 1e30889e34..47a189ed42 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <cstdint>
@@ -86,6 +87,7 @@ static bool CreateThrows(const Ngs2CustomSubmixerRackOption& option) {
     Ngs2ContextBufferInfo query{};
     try {
         sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, &option.custom_rack_option.rack_option, &query);
+
     } catch (const TException&) {
         return true;
     }
@@ -97,17 +99,34 @@ static bool CreateSamplerThrows(const Ngs2CustomSamplerRackOption& option) {
     Ngs2ContextBufferInfo query{};
     try {
         sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &option.custom_rack_option.rack_option, &query);
+
     } catch (const TException&) {
         return true;
     }
     return false;
 }
 
+static Ngs2CustomMasteringRackOption MasteringRackOption(std::uint32_t channels, std::uint32_t inputs) {
+    Ngs2CustomMasteringRackOption option{};
+    auto& common = option.custom_rack_option.rack_option;
+    common.size = sizeof(option);
+    common.max_grain_samples = 512;
+    common.max_voices = 2;
+    common.max_matrices = 1;
+    common.max_ports = 1;
+    option.custom_rack_option.num_buffers = 1;
+    option.custom_rack_option.num_modules = 0;
+    option.max_channels = channels;
+    option.max_inputs = inputs;
+    return option;
+}
+
 template <typename TException, typename TParam>
 static bool ControlThrows(uintptr_t voice, std::uint32_t id, TParam param) {
     param.header = {static_cast<std::uint16_t>(sizeof(TParam)), 0, id};
     try {
         sceNgs2VoiceControl(voice, &param.header);
+
     } catch (const TException&) {
         return true;
     }
@@ -223,6 +242,7 @@ static void TestRackOptions() {
     bool failed = false;
     try {
         sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, nullptr, &query);
+
     } catch (const std::runtime_error&) {
         failed = true;
     }
@@ -357,7 +377,6 @@ static void TestCustomFilter() {
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 }
 
-
 struct ModuleOptionWords {
     std::uint32_t size;
     std::uint32_t words[15];
@@ -479,6 +498,7 @@ static void TestCustomRackChecks() {
     uintptr_t rack = 0;
     try {
         sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, &option.custom_rack_option.rack_option, nullptr, &rack);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -517,8 +537,10 @@ static void TestCustomRackChecks() {
             try {
                 if (useAllocator) {
                     sceNgs2RackCreateWithAllocator(system, SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &sampler.custom_rack_option.rack_option, &allocator, &rack);
+
                 } else {
                     sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &sampler.custom_rack_option.rack_option, &info, &rack);
+
                 }
             } catch (const std::runtime_error&) {
                 rejected = true;
@@ -686,6 +708,7 @@ static void TestCustomDelay(std::uint32_t count, const DelayOption& delay) {
         bool rejected = false;
         try {
             sceNgs2VoiceControl(custom, &param.header);
+
         } catch (const std::runtime_error& error) {
             const std::string message = error.what();
             rejected = message.find("Delay") != std::string::npos && message.find("not implemented") != std::string::npos;
@@ -776,6 +799,7 @@ static bool ModuleInfoThrows(uintptr_t rack, std::uint32_t moduleIndex, std::siz
     bool threw = false;
     try {
         sceNgs2CustomRackGetModuleInfo(rack, moduleIndex, &info, infoSize);
+
     } catch (const TException&) {
         threw = true;
     }
@@ -825,6 +849,52 @@ static void TestCustomModuleInfo() {
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 }
 
+static void TestCustomMastering() {
+    const auto system = CreateSystem();
+    const auto good = MasteringRackOption(2, 1);
+
+    Ngs2ContextBufferInfo query{};
+    Require(sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &good.custom_rack_option.rack_option, &query) == SCE_NGS2_OK);
+    const auto info = Buffer(query);
+    uintptr_t rack = 0;
+    Require(sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &good.custom_rack_option.rack_option, &info, &rack) == SCE_NGS2_OK);
+    const auto voice = Voice(rack);
+
+    Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP, Ngs2MasteringVoiceSetupParam{{}, 2, 0});
+    Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, 1.0f, 1.0f});
+    Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT, Ngs2MasteringVoiceOutputParam{{}, 0, 0});
+    Event(voice, SCE_NGS2_VOICE_EVENT_PLAY);
+
+    Ngs2VoiceState state{};
+    Require(sceNgs2VoiceGetState(voice, &state, sizeof(state)) == SCE_NGS2_OK);
+    Require((state.state_flags & SCE_NGS2_VOICE_STATE_FLAG_INUSE) != 0);
+    Require(sceNgs2VoiceGetState(voice, &state, sizeof(state) - 1) == SCE_NGS2_ERROR_INVALID_OUT_SIZE);
+
+    std::vector<std::int16_t> pcm(Grain * 2 * 8, 16384);
+    const auto sampler = Sampler(system, pcm);
+    Patch(sampler, voice);
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+
+    auto out = Render(system);
+    Require(out.size() == Grain * 2);
+    Require(out[0] != 0.0f);
+
+    Require(sceNgs2VoiceGetState(voice, &state, sizeof(state)) == SCE_NGS2_OK);
+    Require((state.state_flags & SCE_NGS2_VOICE_STATE_FLAG_PLAYING) != 0);
+
+    auto createMastering = [&](const Ngs2CustomMasteringRackOption& opt) {
+        uintptr_t r = 0;
+        return sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &opt.custom_rack_option.rack_option, &info, &r);
+    };
+
+    auto invalidChannels = good;
+    invalidChannels.max_channels = SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS + 1;
+    Require(createMastering(invalidChannels) == SCE_NGS2_ERROR_INVALID_NUM_CHANNELS);
+
+    Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
 int main() {
     for (const auto count : {1u, 2u, 24u}) {
         for (const auto delay : {DelayOption{}, DelayOption{20, 1, 1, 1.0f, 0}, DelayOption{20, 1, 8, 20000.0f, 0}}) {
@@ -839,5 +909,6 @@ int main() {
     for (const auto moduleIndex : {0u, 1u, 23u}) TestCustomLegacyUserFx(moduleIndex);
     TestCustomGain();
     TestCustomModuleInfo();
+    TestCustomMastering();
     return 0;
 }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp
index cf47e314b2..f6dd4600d1 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <cmath>
@@ -151,6 +152,7 @@ static void RequireRejected(uintptr_t voice, const Ngs2SamplerVoiceFilterParam&
     bool rejected = false;
     try {
         sceNgs2VoiceControl(voice, &param.header);
+
     } catch (const TError&) {
         rejected = true;
     }
@@ -181,6 +183,7 @@ static void TestRateChangeUnderFilter() {
     bool rejected = false;
     try {
         sceNgs2SystemSetSampleRate(system, 96000);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp
index ae95253a90..b456ed0cd0 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <cstdint>
@@ -105,6 +106,7 @@ static void RejectListener(const Ngs2GeomListenerParam* param, std::uint32_t fla
     bool rejected = false;
     try {
         sceNgs2GeomCalcListener(param, &work, flags);
+
     } catch (const std::exception&) {
         rejected = true;
     }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp
index 6a0c74f5b3..b72cc16451 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp
@@ -22,20 +22,28 @@ static void PutTag(std::vector<std::uint8_t>& out, const char* tag) {
     out.insert(out.end(), tag, tag + 4);
 }
 
-static std::vector<std::uint8_t> PcmFile(std::uint32_t channels, std::uint32_t sampleRate, std::uint32_t bits, std::uint32_t frames) {
+static std::vector<std::uint8_t> PcmFile(std::uint32_t channels, std::uint32_t sampleRate, std::uint32_t bits, std::uint32_t frames, std::uint32_t tag = 1) {
     const std::uint32_t frameBytes = channels * bits / 8;
+    const std::uint32_t formatSize = tag == 0xfffe ? 40 : 16;
     std::vector<std::uint8_t> file;
     PutTag(file, "RIFF");
-    Put32(file, 36 + frames * frameBytes);
+    Put32(file, 20 + formatSize + frames * frameBytes);
     PutTag(file, "WAVE");
     PutTag(file, "fmt ");
-    Put32(file, 16);
-    Put16(file, 1);
+    Put32(file, formatSize);
+    Put16(file, tag);
     Put16(file, channels);
     Put32(file, sampleRate);
     Put32(file, sampleRate * frameBytes);
     Put16(file, frameBytes);
     Put16(file, bits);
+    if (tag == 0xfffe) {
+        Put16(file, 22);
+        Put16(file, bits);
+        Put32(file, 0);
+        const std::uint8_t pcm[16] = {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71};
+        file.insert(file.end(), pcm, pcm + sizeof(pcm));
+    }
     PutTag(file, "data");
     Put32(file, frames * frameBytes);
     file.resize(file.size() + frames * frameBytes, 0x11);
@@ -60,8 +68,24 @@ static void TestParsePcm() {
     std::memcpy(partialFrame.data() + 40, &partialSize, sizeof(partialSize));
     Require(sceNgs2ParseWaveformData(partialFrame.data(), partialFrame.size(), &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA);
 
-    const auto eightBit = PcmFile(1, 44100, 8, 10);
-    Require(sceNgs2ParseWaveformData(eightBit.data(), eightBit.size(), &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
+    struct Depth { std::uint32_t tag, bits, type; };
+    for (const auto depth : {Depth{1, 8, 0x11}, Depth{1, 16, 0x12}, Depth{1, 24, 0x14}, Depth{1, 32, 0x16}, Depth{3, 32, 0x18}, Depth{3, 64, 0x1a},
+                             Depth{0xfffe, 8, 0x11}, Depth{0xfffe, 24, 0x14}}) {
+        const auto wave = PcmFile(3, 48000, depth.bits, 10, depth.tag);
+        const std::uint32_t frameBytes = 3 * depth.bits / 8;
+        const std::uint32_t dataOffset = static_cast<std::uint32_t>(wave.size() - 10 * frameBytes);
+        Ngs2WaveformInfo parsed{};
+        Require(sceNgs2ParseWaveformData(wave.data(), wave.size(), &parsed) == SCE_NGS2_OK);
+        Require(parsed.format.waveform_type == depth.type && parsed.format.num_channels == 3 && parsed.format.sample_rate == 48000);
+        Require(parsed.data_offset == dataOffset && parsed.data_size == 10 * frameBytes && parsed.num_samples == 10);
+        Require(parsed.audio_unit_size == frameBytes && parsed.num_audio_unit_samples == 1 && parsed.audio_frame_size == frameBytes && parsed.num_audio_frame_samples == 1);
+        Require(parsed.num_blocks == 1 && parsed.block[0].data_offset == dataOffset && parsed.block[0].data_size == 10 * frameBytes && parsed.block[0].num_samples == 10);
+    }
+    for (const auto depth : {Depth{1, 12, 0}, Depth{1, 64, 0}, Depth{3, 16, 0}, Depth{3, 24, 0}, Depth{0xfffe, 12, 0}}) {
+        const auto wave = PcmFile(1, 44100, depth.bits, 8, depth.tag);
+        Ngs2WaveformInfo parsed{};
+        Require(sceNgs2ParseWaveformData(wave.data(), wave.size(), &parsed) == SCE_NGS2_ERROR_UNKNOWN_WAVEFORM_FORMAT);
+    }
     const auto noChannels = PcmFile(0, 44100, 16, 10);
     Require(sceNgs2ParseWaveformData(noChannels.data(), noChannels.size(), &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
 }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Pcm.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Pcm.cpp
new file mode 100644
index 0000000000..a22a766f56
--- /dev/null
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Pcm.cpp
@@ -0,0 +1,221 @@
+#include "Ngs2Test.hpp"
+
+#include <array>
+#include <cmath>
+#include <cstdint>
+#include <vector>
+
+struct PcmFixture {
+    std::uint32_t type;
+    std::uint32_t bytes;
+    std::vector<std::uint8_t> data;
+    std::array<float, 8> samples;
+};
+
+static const PcmFixture Fixtures[] = {
+    {SCE_NGS2_WAVEFORM_TYPE_PCM_U8, 1,
+     {0x00, 0x40, 0x60, 0x80, 0xa0, 0xc0, 0xe0, 0xff},
+     {-1, -0.5f, -0.25f, 0, 0.25f, 0.5f, 0.75f, 127.0f / 128}},
+    {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 2,
+     {0x00, 0x80, 0x00, 0xc0, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x20, 0x00, 0x40, 0x00, 0x60, 0xff, 0x7f},
+     {-1, -0.5f, -0.25f, 0, 0.25f, 0.5f, 0.75f, 32767.0f / 32768}},
+    {SCE_NGS2_WAVEFORM_TYPE_PCM_I24L, 3,
+     {0x00, 0x00, 0x80, 0x00, 0x00, 0xc0, 0x00, 0x00, 0xe0, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x20, 0x00, 0x00, 0x40, 0x00, 0x00, 0x60, 0xff, 0xff, 0x7f},
+     {-1, -0.5f, -0.25f, 0, 0.25f, 0.5f, 0.75f, 8388607.0f / 8388608}},
+    {SCE_NGS2_WAVEFORM_TYPE_PCM_I32L, 4,
+     {0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x60, 0xff, 0xff, 0xff, 0x7f},
+     {-1, -0.5f, -0.25f, 0, 0.25f, 0.5f, 0.75f, 1}},
+    {SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, 4,
+     {0x00, 0x00, 0x80, 0xbf, 0x00, 0x00, 0x00, 0xbf, 0x00, 0x00, 0x80, 0xbe, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x80, 0x3e, 0x00, 0x00, 0x00, 0x3f, 0x00, 0x00, 0x40, 0x3f, 0x00, 0x00, 0x80, 0x3f},
+     {-1, -0.5f, -0.25f, 0, 0.25f, 0.5f, 0.75f, 1}},
+    {SCE_NGS2_WAVEFORM_TYPE_PCM_F64L, 8,
+     {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0xbf, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, 0xbf,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0xbf, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x3f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, 0x3f,
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x3f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f},
+     {-1, -0.5f, -0.25f, 0, 0.25f, 0.5f, 0.75f, 1}},
+};
+
+class Playback {
+public:
+    Playback(std::uint32_t type, std::uint32_t channels = 1, std::uint32_t rate = 48000)
+        : firstBuffer(usedBuffers), system(CreateSystem()), channels(channels), voice(Voice(CreateRack(system, SCE_NGS2_RACK_ID_SAMPLER))) {
+        Control(voice, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, Ngs2SamplerVoiceSetupParam{{}, {type, channels, rate, 0, 0, 0}});
+        Patch(voice, Mastering(system, channels));
+        Event(voice, SCE_NGS2_VOICE_EVENT_PLAY);
+    }
+
+    ~Playback() {
+        Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+        usedBuffers = firstBuffer;
+    }
+
+    void Add(const void* data, const Ngs2WaveformBlock* blocks, std::uint32_t count, std::uint32_t flags = 0) {
+        Control(voice, SCE_NGS2_SAMPLER_VOICE_PARAM_ADD_WAVEFORM_BLOCKS, Ngs2SamplerVoiceWaveformBlocksParam{{}, data, flags, count, blocks});
+    }
+
+    std::vector<float> Render() {
+        std::vector<float> output(Grain * channels, 123);
+        const Ngs2RenderBufferInfo info{output.data(), output.size() * sizeof(float), SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, channels};
+        Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_OK);
+        return output;
+    }
+
+    Ngs2SamplerVoiceState State() {
+        Ngs2SamplerVoiceState state{};
+        Require(sceNgs2VoiceGetState(voice, &state.voice_state, sizeof(state)) == SCE_NGS2_OK);
+        return state;
+    }
+
+    const std::size_t firstBuffer;
+    const std::uintptr_t system;
+    const std::uint32_t channels;
+    const std::uintptr_t voice;
+};
+
+template <typename TFunction>
+static void RequireThrows(TFunction function) {
+    bool threw = false;
+    try { function(); } catch (const std::exception&) { threw = true; }
+    Require(threw);
+}
+
+static void TestFramesAndPositions(const PcmFixture& fixture, std::uint32_t channels) {
+    Playback playback(fixture.type, channels);
+    std::vector<std::uint8_t> data(3, 0xa5);
+    constexpr std::uint32_t skip = 3;
+    for (std::uint32_t frame = 0; frame < skip + Grain * 2; frame++) {
+        for (std::uint32_t channel = 0; channel < channels; channel++) {
+            const auto sample = (frame + channel) % fixture.samples.size();
+            const auto first = fixture.data.begin() + sample * fixture.bytes;
+            data.insert(data.end(), first, first + fixture.bytes);
+        }
+    }
+    const auto frameBytes = channels * fixture.bytes;
+    const Ngs2WaveformBlock block{2, data.size() - 3, 0, skip, Grain * 2, 0, 0};
+    playback.Add(data.data() + 1, &block, 1);
+    Control(playback.voice, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, Ngs2SamplerVoiceSetupParam{});
+    Require(playback.State().waveform_data == data.data() + 3 + skip * frameBytes);
+    for (std::uint32_t pass = 0; pass < 2; pass++) {
+        const auto output = playback.Render();
+        for (std::uint32_t frame = 0; frame < Grain; frame++) {
+            for (std::uint32_t channel = 0; channel < channels; channel++) {
+                const auto actual = output[frame * channels + channel];
+                const auto expected = fixture.samples[(skip + pass * Grain + frame + channel) % 8];
+                if (actual != expected) {
+                    std::fprintf(stderr, "PCM type %#x frame %u channel %u: got %a, expected %a\n", fixture.type, pass * Grain + frame, channel, actual, expected);
+                }
+                Require(actual == expected);
+            }
+        }
+        const auto state = playback.State();
+        Require(state.num_decoded_samples == (pass + 1) * Grain);
+        Require(state.decoded_data_size == (pass + 1) * Grain * frameBytes);
+        Require(state.waveform_data == data.data() + 3 + (skip + (pass + 1) * Grain) * frameBytes);
+    }
+    Require(Flags(playback.voice) == 0);
+}
+
+static std::vector<Ngs2VoiceCallbackInfo> callbacks;
+
+static void APS5_VABI OnBlock(const Ngs2VoiceCallbackInfo* info) {
+    callbacks.push_back(*info);
+}
+
+static void TestRepeatAndTransition(const PcmFixture& fixture) {
+    Playback playback(fixture.type);
+    callbacks.clear();
+    Control(playback.voice, SCE_NGS2_VOICE_PARAM_CALLBACK,
+            Ngs2VoiceCallbackParam{{}, OnBlock, 7, SCE_NGS2_VOICE_CALLBACK_FLAG_BLOCK_REPEAT | SCE_NGS2_VOICE_CALLBACK_FLAG_BLOCK_END, 0});
+    const Ngs2WaveformBlock blocks[] = {{0, fixture.bytes * 4, 1, 1, 3, 0, 101}, {fixture.bytes * 4, fixture.bytes * 4, 0, 0, 4, 0, 202}};
+    playback.Add(fixture.data.data(), blocks, 2);
+    const auto first = playback.Render();
+    constexpr std::uint32_t indices[] = {1, 2, 3, 1, 2, 3, 4, 5};
+    for (std::uint32_t i = 0; i < Grain; i++) Require(first[i] == fixture.samples[indices[i]]);
+    auto state = playback.State();
+    Require(state.num_decoded_samples == 8 && state.decoded_data_size == 8 * fixture.bytes);
+    Require(state.waveform_data == fixture.data.data() + 6 * fixture.bytes);
+    const auto last = playback.Render();
+    Require(last[0] == fixture.samples[6] && last[1] == fixture.samples[7]);
+    for (std::uint32_t i = 2; i < Grain; i++) Require(last[i] == 0);
+    state = playback.State();
+    Require(state.num_decoded_samples == 10 && state.decoded_data_size == 10 * fixture.bytes);
+    Require(state.waveform_data == fixture.data.data() + fixture.data.size());
+    Require(callbacks.size() == 3);
+    Require(callbacks[0].flag == SCE_NGS2_VOICE_CALLBACK_FLAG_BLOCK_REPEAT && callbacks[0].user_data == 101 && callbacks[0].num_repeated == 1);
+    Require(callbacks[1].flag == SCE_NGS2_VOICE_CALLBACK_FLAG_BLOCK_END && callbacks[1].user_data == 101);
+    Require(callbacks[2].flag == SCE_NGS2_VOICE_CALLBACK_FLAG_BLOCK_END && callbacks[2].user_data == 202);
+    Require(callbacks[0].block_data == fixture.data.data() && callbacks[2].block_data == fixture.data.data() + fixture.bytes * 4);
+}
+
+static void TestResampling(const PcmFixture& fixture) {
+    Playback playback(fixture.type, 1, 24000);
+    const Ngs2WaveformBlock blocks[] = {{0, fixture.bytes * 3, 0, 0, 3, 0, 0}, {fixture.bytes * 3, fixture.bytes * 5, 0, 0, 5, 0, 0}};
+    playback.Add(fixture.data.data(), blocks, 2);
+    for (std::uint32_t pass = 0; pass < 2; pass++) {
+        const auto output = playback.Render();
+        for (std::uint32_t i = 0; i < Grain; i++) {
+            const auto sample = (pass * Grain + i) / 2;
+            const auto next = sample < 7 ? sample + 1 : sample;
+            const auto expected = i % 2 == 0 ? fixture.samples[sample] : std::lerp(fixture.samples[sample], fixture.samples[next], 0.5f);
+            Require(output[i] == expected);
+        }
+        Require(playback.State().decoded_data_size == (pass + 1) * 4 * fixture.bytes);
+    }
+    Require(playback.State().num_decoded_samples == 8);
+}
+
+static void TestPitch(const PcmFixture& fixture) {
+    Playback playback(fixture.type);
+    Control(playback.voice, SCE_NGS2_SAMPLER_VOICE_PARAM_PITCH, Ngs2SamplerVoicePitchParam{{}, 2});
+    const Ngs2WaveformBlock block{0, fixture.data.size(), 1, 0, 8, 0, 0};
+    playback.Add(fixture.data.data(), &block, 1);
+    const auto output = playback.Render();
+    for (std::uint32_t i = 0; i < Grain; i++) Require(output[i] == fixture.samples[(i * 2) % 8]);
+    Require(playback.State().num_decoded_samples == 16 && playback.State().decoded_data_size == 16 * fixture.bytes);
+    Require(Flags(playback.voice) == 0);
+}
+
+static void TestBounds(const PcmFixture& fixture) {
+    Playback playback(fixture.type, 2);
+    const Ngs2WaveformBlock shortBlock{0, fixture.data.size() - 1, 1, 0, 4, 0, 0};
+    RequireThrows([&] { playback.Add(fixture.data.data(), &shortBlock, 1); });
+    const Ngs2WaveformBlock overflow{0, fixture.data.size(), 0, UINT32_MAX, UINT32_MAX, 0, 0};
+    RequireThrows([&] { playback.Add(fixture.data.data(), &overflow, 1, SCE_NGS2_WAVEFORM_BLOCKS_FLAG_RESET); });
+}
+
+static void TestNumericEdges() {
+    const PcmFixture signed24{SCE_NGS2_WAVEFORM_TYPE_PCM_I24L, 3,
+        {0x01, 0x00, 0x00, 0xff, 0xff, 0xff, 0x01, 0x00, 0x80, 0xfe, 0xff, 0x7f,
+         0x56, 0x34, 0x12, 0xaa, 0xcb, 0xed, 0x80, 0x00, 0x00, 0x80, 0xff, 0xff},
+        {0x1p-23f, -0x1p-23f, -8388607.0f / 8388608, 8388606.0f / 8388608,
+         1193046.0f / 8388608, -1193046.0f / 8388608, 0x1p-16f, -0x1p-16f}};
+    TestFramesAndPositions(signed24, 1);
+    const PcmFixture signed32{SCE_NGS2_WAVEFORM_TYPE_PCM_I32L, 4,
+        {0x01, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0x80, 0xfe, 0xff, 0xff, 0x7f,
+         0x01, 0x00, 0x00, 0x01, 0x02, 0x00, 0x00, 0x01, 0x03, 0x00, 0x00, 0x01, 0xfd, 0xff, 0xff, 0xfe},
+        {0x1p-31f, -0x1p-31f, -1, 1, 0x1p-7f, 0x1.000002p-7f, 0x1.000004p-7f, -0x1.000004p-7f}};
+    TestFramesAndPositions(signed32, 1);
+    const PcmFixture floating64{SCE_NGS2_WAVEFORM_TYPE_PCM_F64L, 8,
+        {0x9a, 0x99, 0x99, 0x99, 0x99, 0x99, 0xb9, 0x3f, 0x9a, 0x99, 0x99, 0x99, 0x99, 0x99, 0xb9, 0xbf,
+         0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0xe0, 0x3f, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0xe0, 0x3f,
+         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x38, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0xb8,
+         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
+        {0.1f, -0.1f, 0.5f, 0x1.000004p-1f, 0x1p-126f, -0x1p-126f, 0, 0}};
+    TestFramesAndPositions(floating64, 1);
+}
+
+int main() {
+    for (const auto& fixture : Fixtures) {
+        for (const auto channels : {1u, 2u, 6u, 8u}) TestFramesAndPositions(fixture, channels);
+        TestRepeatAndTransition(fixture);
+        TestResampling(fixture);
+        TestPitch(fixture);
+        TestBounds(fixture);
+    }
+    TestNumericEdges();
+    return 0;
+}
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
index c9f7cd7fcb..f053141be3 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
@@ -1,12 +1,15 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <algorithm>
+#include <array>
 #include <atomic>
 #include <chrono>
 #include <cmath>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <deque>
 #include <iterator>
 #include <numbers>
 #include <stdexcept>
@@ -239,21 +242,58 @@ static void TestPan() {
     }
 
     const Ngs2PanParam front{0.0f, 1.0f, 1.0f, 0.0f};
-    float out[2] = {};
+    float out[2] = {-1.0f, -1.0f};
     Require(sceNgs2PanInit(&work, nullptr, 360.0f, 2) == SCE_NGS2_OK);
     Require(sceNgs2PanGetVolumeMatrix(&work, &front, 1, 2, nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
-    Require(sceNgs2PanGetVolumeMatrix(&work, &front, 0, 2, out) == SCE_NGS2_OK);
-    Require(PanThrows(nullptr, &front, 1, 2) && PanThrows(&work, nullptr, 0, 2));
-    Require(PanThrows(&work, &front, 1, 4) && PanThrows(&work, &front, 1, 3) && !PanThrows(&work, &front, 1, 8));
+    Require(sceNgs2PanGetVolumeMatrix(&work, &front, 0, 2, out) == SCE_NGS2_OK && out[0] == -1.0f && out[1] == -1.0f);
+    Require(SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE == static_cast<int>(0x804A8450) && SCE_NGS2_ERROR_INVALID_PAN_SPEAKER == static_cast<int>(0x804A8451));
+    Require(SCE_NGS2_ERROR_INVALID_PAN_MATRIX_FORMAT == static_cast<int>(0x804A8452) && SCE_NGS2_ERROR_INVALID_PAN_WORK == static_cast<int>(0x804A8453));
+    Require(SCE_NGS2_ERROR_INVALID_PAN_PARAM == static_cast<int>(0x804A8454));
+    float guard[32];
+    const auto panResult = [&](Ngs2PanWork* panWork, const Ngs2PanParam* params, std::uint32_t numParams, std::uint32_t format) {
+        std::fill(std::begin(guard), std::end(guard), -1.0f);
+        const int result = sceNgs2PanGetVolumeMatrix(panWork, params, numParams, format, guard);
+        Require(result == SCE_NGS2_OK || std::all_of(std::begin(guard), std::end(guard), [](float level) { return level == -1.0f; }));
+        return result;
+    };
     const Ngs2PanParam many[9] = {};
-    Require(PanThrows(&work, many, 9, 2) && !PanThrows(&work, many, 8, 2));
+    Require(panResult(nullptr, &front, 1, 2) == SCE_NGS2_ERROR_INVALID_PAN_WORK && panResult(nullptr, nullptr, 1, 2) == SCE_NGS2_ERROR_INVALID_PAN_WORK);
+    Require(sceNgs2PanGetVolumeMatrix(nullptr, &front, 1, 2, nullptr) == SCE_NGS2_ERROR_INVALID_PAN_WORK);
+    Require(panResult(&work, nullptr, 0, 2) == SCE_NGS2_ERROR_INVALID_PAN_PARAM && panResult(&work, nullptr, 1, 3) == SCE_NGS2_ERROR_INVALID_PAN_PARAM);
+    Require(sceNgs2PanGetVolumeMatrix(&work, nullptr, 1, 2, nullptr) == SCE_NGS2_ERROR_INVALID_PAN_PARAM);
+    Require(sceNgs2PanGetVolumeMatrix(&work, &front, 1, 3, nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(panResult(&work, &front, 1, 4) == SCE_NGS2_ERROR_INVALID_PAN_MATRIX_FORMAT && panResult(&work, &front, 1, 3) == SCE_NGS2_ERROR_INVALID_PAN_MATRIX_FORMAT);
+    Require(panResult(&work, many, 9, 3) == SCE_NGS2_ERROR_INVALID_PAN_MATRIX_FORMAT && panResult(&work, &front, 1, 8) == SCE_NGS2_OK);
+    Require(panResult(&work, many, 9, 2) == SCE_NGS2_ERROR_INVALID_NUM_CHANNELS && panResult(&work, many, 8, 2) == SCE_NGS2_OK);
+    Ngs2PanWork badWork = work;
+    badWork.num_speakers = 3;
+    Require(panResult(&badWork, &front, 1, 2) == SCE_NGS2_ERROR_INVALID_PAN_SPEAKER && panResult(&badWork, &front, 1, 3) == SCE_NGS2_ERROR_INVALID_PAN_MATRIX_FORMAT);
+    Require(panResult(&badWork, many, 9, 2) == SCE_NGS2_ERROR_INVALID_PAN_SPEAKER);
+    badWork.unit_angle = 100.0f;
+    Require(panResult(&badWork, &front, 1, 2) == SCE_NGS2_ERROR_INVALID_PAN_SPEAKER);
+    badWork.num_speakers = 2;
+    Require(panResult(&badWork, &front, 1, 2) == SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE && panResult(&badWork, many, 9, 2) == SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE);
+    Require(sceNgs2PanGetVolumeMatrix(&badWork, &front, 1, 2, nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
     const Ngs2PanParam nanAngle{NAN, 1.0f, 1.0f, 0.0f};
-    Require(PanThrows(&work, &nanAngle, 1, 2));
+    Require(panResult(&work, &nanAngle, 1, 2) == SCE_NGS2_OK && guard[0] == 0.0f && guard[1] == 0.0f);
     const Ngs2PanParam laterNan[2] = {front, nanAngle};
-    float untouched[4] = {-1.0f, -1.0f, -1.0f, -1.0f};
-    bool rejected = false;
-    try { sceNgs2PanGetVolumeMatrix(&work, laterNan, 2, 2, untouched); } catch (const std::invalid_argument&) { rejected = true; }
-    Require(rejected && std::all_of(std::begin(untouched), std::end(untouched), [](float level) { return level == -1.0f; }));
+    Require(panResult(&work, laterNan, 2, 2) == SCE_NGS2_OK);
+    Require(std::fabs(guard[0] - 0.707106769f) < 1e-6f && guard[1] == 0.0f && std::fabs(guard[2] - 0.707106769f) < 1e-6f && guard[3] == 0.0f);
+    Ngs2PanWork sevenWork{};
+    Require(sceNgs2PanInit(&sevenWork, nullptr, 360.0f, 7) == SCE_NGS2_OK);
+    const Ngs2PanParam nanEach[4] = {{NAN, 1.0f, 1.0f, 0.5f}, {30.0f, NAN, 1.0f, 0.5f}, {30.0f, 1.0f, NAN, 0.5f}, {30.0f, 1.0f, 1.0f, NAN}};
+    Require(panResult(&sevenWork, nanEach, 4, 8) == SCE_NGS2_OK);
+    for (std::uint32_t channel = 0; channel < 8; channel++) {
+        Require(guard[channel * 4] == (channel == 3 ? 0.5f : 0.0f));
+        for (std::uint32_t p = 1; p < 4; p++) Require(std::isnan(guard[channel * 4 + p]));
+    }
+    Ngs2PanWork radianWork{};
+    const float radianPair[] = {-0.52359879f, 0.52359879f};
+    Require(sceNgs2PanInit(&radianWork, radianPair, 2.0f * pi, 2) == SCE_NGS2_OK && radianWork.speaker_angles[0] == 0.52359879f);
+    const Ngs2PanParam belowFirst{0.523598731f, 1.0f, 1.0f, 0.0f};
+    const Ngs2PanParam aboveFirst{0.52359885f, 1.0f, 1.0f, 0.0f};
+    Require(std::nextafter(0.52359879f, 0.0f) == belowFirst.angle && PanThrows(&radianWork, &belowFirst, 1, 1));
+    Require(panResult(&radianWork, &aboveFirst, 1, 1) == SCE_NGS2_OK && std::fabs(guard[0] - 0.707106769f) < 1e-6f);
     const Ngs2PanParam huge{1e30f, 1.0f, 1.0f, 0.0f};
     Require(PanThrows(&work, &huge, 1, 2));
     const float hugeSpeaker[] = {1e30f, 30.0f};
@@ -262,6 +302,9 @@ static void TestPan() {
     Require(sceNgs2PanInit(&work, nullptr, 360.0f, 2) == SCE_NGS2_OK);
     work.speaker_angles[0] = -INFINITY;
     Require(PanThrows(&work, &front, 1, 2));
+    work.speaker_angles[0] = NAN;
+    const Ngs2PanParam right{30.0f, 1.0f, 1.0f, 0.0f};
+    Require(panResult(&work, &right, 1, 2) == SCE_NGS2_OK && guard[0] == 0.0f && guard[1] == 0.0f);
     Require(sceNgs2PanInit(&work, nullptr, 360.0f, 2) == SCE_NGS2_OK);
     Ngs2PanWork marked;
     std::memset(&marked, 0x5a, sizeof(marked));
@@ -276,8 +319,14 @@ static void TestPan() {
         Require(sceNgs2PanInit(&marked, nullptr, 360.0f, count) == static_cast<int>(0x804A8451));
         Require(unchanged());
     }
-    Require(PanInitThrows(&marked, nullptr, 360.0f, 0));
-    Require(unchanged());
+    const float sevenDegrees[] = {0.0f, 40.0f, 110.0f, 150.0f, 210.0f, 250.0f, 320.0f, 360.0f};
+    for (const float unitAngle : {360.0f, 2.0f * pi, 180.0f, NAN}) {
+        Ngs2PanWork seven;
+        std::memset(&seven, 0x5a, sizeof(seven));
+        Require(sceNgs2PanInit(&seven, nullptr, unitAngle, 0) == SCE_NGS2_OK && seven.num_speakers == 7);
+        Require(seven.unit_angle == (unitAngle == 2.0f * pi ? 2.0f * pi : 360.0f));
+        for (std::uint32_t i = 0; i < 8; i++) Require(seven.speaker_angles[i] == sevenDegrees[i]);
+    }
     for (std::uint32_t count : {0u, 1u, 3u, 6u, 8u, 255u}) {
         Require(sceNgs2PanInit(&marked, pair, 360.0f, count) == static_cast<int>(0x804A8451));
         Require(sceNgs2PanInit(&marked, pair, 2.0f * pi, count) == static_cast<int>(0x804A8451));
@@ -289,13 +338,31 @@ static void TestPan() {
         Require(unchanged());
     }
     Require(sceNgs2PanInit(&work, pair, 2.0f * pi, 2) == SCE_NGS2_OK);
-    const float invalid[] = {0.0f, NAN};
-    Require(PanInitThrows(&work, invalid, 360.0f, 2));
+    const float nanSpeaker[] = {0.0f, NAN};
+    Require(sceNgs2PanInit(&work, nanSpeaker, 360.0f, 2) == SCE_NGS2_OK && work.num_speakers == 2 && work.unit_angle == 360.0f);
+    Require(std::isnan(work.speaker_angles[0]) && work.speaker_angles[1] == 0.0f && std::isnan(work.speaker_angles[2]));
     const float onUnit[] = {720.0f, 30.0f};
     const float belowZero[] = {-360.0f, 30.0f};
     Require(PanInitThrows(&work, onUnit, 360.0f, 2) && !PanInitThrows(&work, belowZero, 360.0f, 2));
     work.unit_angle = 100.0f;
-    Require(PanThrows(&work, &front, 1, 2));
+    Require(panResult(&work, &front, 1, 2) == SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE);
+}
+
+static void TestPanExplicitAnglesAndNanDistance() {
+    Ngs2PanWork work;
+    std::memset(&work, 0x5a, sizeof(work));
+    Ngs2PanWork filled;
+    std::memcpy(&filled, &work, sizeof(work));
+    const float pair[] = {-30.0f, 30.0f};
+    Require(sceNgs2PanInit(&work, pair, 360.0f, 2) == SCE_NGS2_OK && work.num_speakers == 2 && work.unit_angle == 360.0f);
+    Require(work.speaker_angles[0] == 30.0f && work.speaker_angles[1] == 330.0f && work.speaker_angles[2] == 390.0f);
+    Require(std::memcmp(&work.speaker_angles[3], &filled.speaker_angles[3], 5 * sizeof(float)) == 0);
+    Require(sceNgs2PanInit(&work, nullptr, 360.0f, 2) == SCE_NGS2_OK);
+    for (std::uint32_t i = 3; i < 8; i++) Require(work.speaker_angles[i] == 0.0f);
+    const Ngs2PanParam params[2] = {{0.0f, 1.0f, 1.0f, 0.0f}, {30.0f, NAN, 1.0f, 0.0f}};
+    float out[4] = {};
+    Require(sceNgs2PanGetVolumeMatrix(&work, params, 2, 2, out) == SCE_NGS2_OK);
+    Require(std::fabs(out[0] - 0.707106769f) < 1e-6f && std::isnan(out[1]) && std::fabs(out[2] - 0.707106769f) < 1e-6f && std::isnan(out[3]));
 }
 
 static void TestPitchAndRepeat() {
@@ -686,6 +753,73 @@ static void TestReverb() {
     }
 }
 
+static std::vector<float> RenderReverbChannels(std::uint32_t inputs, std::uint32_t outputs, const Ngs2ReverbI3DL2Param& params, const std::vector<std::int16_t>& pcm, std::uint32_t frames) {
+    const auto firstBuffer = usedBuffers;
+    const auto system = CreateSystem();
+    Require(sceNgs2SystemSetGrainSamples(system, 256) == SCE_NGS2_OK);
+    const auto master = Mastering(system, outputs);
+    const auto reverb = Voice(CreateRack(system, SCE_NGS2_RACK_ID_REVERB));
+    Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, inputs, outputs, 0, 0});
+    Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_I3DL2, Ngs2ReverbVoiceI3DL2Param{{}, params});
+    Patch(reverb, master);
+    Event(reverb, SCE_NGS2_VOICE_EVENT_PLAY);
+    const auto sampler = Voice(CreateRack(system, SCE_NGS2_RACK_ID_SAMPLER));
+    Control(sampler, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, Ngs2SamplerVoiceSetupParam{{}, {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, inputs, 48000, 0, 0, 0}});
+    const Ngs2WaveformBlock block{0, pcm.size() * sizeof(std::int16_t), 0, 0, static_cast<std::uint32_t>(pcm.size() / inputs), 0, 0};
+    Control(sampler, SCE_NGS2_SAMPLER_VOICE_PARAM_ADD_WAVEFORM_BLOCKS, Ngs2SamplerVoiceWaveformBlocksParam{{}, pcm.data(), 0, 1, &block});
+    Patch(sampler, reverb);
+    std::vector<float> identity(inputs * inputs, 0.0f);
+    for (std::uint32_t c = 0; c < inputs; c++) identity[c * inputs + c] = 1.0f;
+    Control(sampler, SCE_NGS2_VOICE_PARAM_MATRIX_LEVELS, Ngs2VoiceMatrixLevelsParam{{}, 0, inputs * inputs, identity.data()});
+    Control(sampler, SCE_NGS2_VOICE_PARAM_PORT_MATRIX, Ngs2VoicePortMatrixParam{{}, 0, 0});
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+    std::vector<float> all;
+    std::vector<float> out(256 * outputs);
+    for (std::uint32_t grain = 0; grain * 256 < frames; grain++) {
+        const Ngs2RenderBufferInfo info{out.data(), out.size() * sizeof(float), SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, outputs};
+        Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_OK);
+        all.insert(all.end(), out.begin(), out.end());
+    }
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+    usedBuffers = firstBuffer;
+    return all;
+}
+
+static void TestReverbConversion() {
+    Ngs2ReverbI3DL2Param mixed{1.0f, 1.0f, -1000, 0, 0, 2.91f, 1.3f, -602, 0.015f, -302, 0.022f, 100.0f, 100.0f, 5000.0f, {}};
+    std::vector<std::int16_t> stereo(4096 * 2, 0);
+    std::uint32_t seed = 1;
+    for (std::uint32_t i = 0; i < 3000 * 2; i++) {
+        seed = seed * 1664525u + 1013904223u;
+        stereo[i] = static_cast<std::int16_t>(static_cast<std::int32_t>((seed >> 16) & 0x3fff) - 0x2000);
+    }
+    const auto same = RenderReverbChannels(2, 2, mixed, stereo, 8192);
+    for (std::uint32_t outputs : {6u, 8u}) {
+        const auto surround = RenderReverbChannels(2, outputs, mixed, stereo, 8192);
+        float sides = 0.0f;
+        float lfe = 0.0f;
+        for (std::uint32_t frame = 0; frame < 8192; frame++) {
+            for (std::uint32_t c = 0; c < 2; c++) Require(std::fabs(surround[frame * outputs + c] - same[frame * 2 + c]) <= 1e-7f + std::fabs(same[frame * 2 + c]) * 1e-5f);
+            for (std::uint32_t c = 2; c < outputs; c++) {
+                if (c != 3) sides = std::max(sides, std::fabs(surround[frame * outputs + c]));
+            }
+            lfe = std::max(lfe, std::fabs(surround[frame * outputs + 3]));
+        }
+        Require(sides > 1e-4f && lfe == 0.0f);
+    }
+
+    auto dry = mixed;
+    dry.wet = 0.0f;
+    const std::int16_t levels[6] = {8192, 4096, 2048, 1024, 512, 256};
+    std::vector<std::int16_t> six(4096 * 6);
+    for (std::size_t i = 0; i < six.size(); i++) six[i] = levels[i % 6];
+    const auto down = RenderReverbChannels(6, 2, dry, six, 2048);
+    const float half = std::numbers::sqrt2_v<float> / 2.0f;
+    const float left = (8192.0f + 2048.0f * half + 512.0f * 0.5f) / 32768.0f;
+    const float right = (4096.0f + 2048.0f * half + 256.0f * 0.5f) / 32768.0f;
+    Require(std::fabs(down[1024 * 2] - left) <= left * 1e-5f && std::fabs(down[1024 * 2 + 1] - right) <= right * 1e-5f);
+}
+
 static void TestReverbSetup() {
     const auto system = CreateSystem();
     const auto master = Mastering(system, 2);
@@ -695,12 +829,12 @@ static void TestReverbSetup() {
         try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, channels, channels, 0, 0}); } catch (const std::invalid_argument&) { rejected = true; }
         Require(rejected);
     }
-    bool conversion = false;
-    try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 1, 2, 0, 0}); } catch (const std::runtime_error&) { conversion = true; }
-    Require(conversion);
-    bool flags = false;
-    try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 2, 2, 1, 0}); } catch (const std::runtime_error&) { flags = true; }
-    Require(flags);
+    for (const auto& counts : {std::array<std::uint32_t, 2>{3, 2}, std::array<std::uint32_t, 2>{2, 7}}) {
+        bool rejected = false;
+        try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, counts[0], counts[1], 0, 0}); } catch (const std::invalid_argument&) { rejected = true; }
+        Require(rejected);
+    }
+    Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 1, 2, 0, 0});
     Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 2, 2, 0, 0});
     Ngs2ReverbI3DL2Param invalid{1.0f, 0.0f, 0, 0, 0, 1.0f, 1.0f, 0, 0.0f, 0, 0.0f, 100.0f, 100.0f, 5000.0f, {}};
     invalid.decay_time = NAN;
@@ -768,6 +902,7 @@ static bool SystemOptionThrows(const Ngs2SystemOption& option) {
     Ngs2ContextBufferInfo query{};
     try {
         sceNgs2SystemQueryBufferSize(&option, &query);
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -810,6 +945,7 @@ static void TestUserData() {
     bool threw = false;
     try {
         sceNgs2SystemGetUserData(system, nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -833,6 +969,7 @@ static void TestUserData() {
     threw = false;
     try {
         sceNgs2RackGetUserData(rack, nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -872,9 +1009,6 @@ static void TestMasteringGain() {
     Control(toQuad, SCE_NGS2_VOICE_PARAM_PORT_MATRIX, Ngs2VoicePortMatrixParam{{}, 0, 0});
     Patch(toQuad, quad);
     Event(toQuad, SCE_NGS2_VOICE_EVENT_PLAY);
-    bool rejected = false;
-    try { Control(stereo, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, NAN, 1.0f}); } catch (const std::exception&) { rejected = true; }
-    Require(rejected);
 
     std::vector<float> outStereo(Grain * 2, -1.0f);
     std::vector<float> outSurround(Grain * 6, -1.0f);
@@ -908,6 +1042,80 @@ static void TestMasteringGain() {
     Require(sceNgs2SystemDestroy(loudSystem, nullptr) == SCE_NGS2_OK);
 }
 
+static void TestMasteringGainClampedLikePs5() {
+    std::deque<std::vector<std::int16_t>> waveforms;
+    const auto chain = [&waveforms](std::uint32_t channels, std::uint32_t grains, uintptr_t& master) {
+        const auto system = CreateSystem();
+        master = Mastering(system, channels);
+        const auto& pcm = waveforms.emplace_back(Grain * grains, 16384);
+        const auto source = Sampler(system, pcm, 0);
+        const std::vector<float> levels(channels, 1.0f);
+        Control(source, SCE_NGS2_VOICE_PARAM_MATRIX_LEVELS, Ngs2VoiceMatrixLevelsParam{{}, 0, channels, levels.data()});
+        Control(source, SCE_NGS2_VOICE_PARAM_PORT_MATRIX, Ngs2VoicePortMatrixParam{{}, 0, 0});
+        Patch(source, master);
+        Event(source, SCE_NGS2_VOICE_EVENT_PLAY);
+        return system;
+    };
+    const auto render = [](uintptr_t system, std::uint32_t channels) {
+        std::vector<float> out(Grain * channels, -1.0f);
+        const Ngs2RenderBufferInfo info{out.data(), out.size() * sizeof(float), SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, channels};
+        Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_OK);
+        return out;
+    };
+    const auto expect = [](const std::vector<float>& out, std::uint32_t channels, float fbwOut, float lfeOut) {
+        for (std::uint32_t i = 0; i < Grain; i++) {
+            for (std::uint32_t channel = 0; channel < channels; channel++) {
+                const float level = channel == 3 && channels >= 6 ? lfeOut : fbwOut;
+                const float sample = out[i * channels + channel];
+                Require(std::isnan(level) ? std::isnan(sample) : sample == 0.5f * level);
+            }
+        }
+    };
+    const auto gain = [&](std::uint32_t channels, float fbw, float lfe, float fbwOut, float lfeOut) {
+        uintptr_t master = 0;
+        const auto system = chain(channels, 1, master);
+        Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, fbw, lfe});
+        expect(render(system, channels), channels, fbwOut, lfeOut);
+        Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+    };
+    const float inf = INFINITY;
+    for (const std::uint32_t channels : {6u, 8u}) {
+        gain(channels, 32.0f, 1.0f, 32.0f, 1.0f);
+        gain(channels, 33.0f, 1.0f, 32.0f, 1.0f);
+        gain(channels, 64.0f, 1.0f, 32.0f, 1.0f);
+        gain(channels, 1e30f, 1.0f, 32.0f, 1.0f);
+        gain(channels, inf, 1.0f, 32.0f, 1.0f);
+        gain(channels, -32.0f, 1.0f, -32.0f, 1.0f);
+        gain(channels, -33.0f, 1.0f, -32.0f, 1.0f);
+        gain(channels, -inf, 1.0f, -32.0f, 1.0f);
+        gain(channels, NAN, 1.0f, NAN, 1.0f);
+        gain(channels, 1.0f, 32.0f, 1.0f, 32.0f);
+        gain(channels, 1.0f, 33.0f, 1.0f, 32.0f);
+        gain(channels, 1.0f, 1e30f, 1.0f, 32.0f);
+        gain(channels, 1.0f, inf, 1.0f, 32.0f);
+        gain(channels, 1.0f, -33.0f, 1.0f, -32.0f);
+        gain(channels, 1.0f, -inf, 1.0f, -32.0f);
+        gain(channels, 1.0f, NAN, 1.0f, NAN);
+    }
+    gain(1, 0.5f, 2.0f, 0.5f, 0.5f);
+    gain(1, inf, NAN, 32.0f, 32.0f);
+    gain(2, -inf, 1e30f, -32.0f, -32.0f);
+    gain(2, 2.0f, 0.5f, 2.0f, 2.0f);
+
+    uintptr_t master = 0;
+    const auto system = chain(6, 4, master);
+    expect(render(system, 6), 6, 1.0f, 1.0f);
+    Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, 0.5f, 0.25f});
+    expect(render(system, 6), 6, 0.5f, 0.25f);
+    Event(master, SCE_NGS2_VOICE_EVENT_STOP_IMM);
+    Event(master, SCE_NGS2_VOICE_EVENT_PLAY);
+    expect(render(system, 6), 6, 0.5f, 0.25f);
+    Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_SETUP, Ngs2MasteringVoiceSetupParam{{}, 6, 0});
+    Event(master, SCE_NGS2_VOICE_EVENT_PLAY);
+    expect(render(system, 6), 6, 1.0f, 1.0f);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
 static uintptr_t RackVoice(uintptr_t rack, std::uint32_t index) {
     uintptr_t voice = 0;
     Require(sceNgs2RackGetVoiceHandle(rack, index, &voice) == SCE_NGS2_OK && voice != 0);
@@ -980,6 +1188,7 @@ static void TestStereoIntoSurround() {
     bool threw = false;
     try {
         sceNgs2SystemRender(system, info, 3);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -1585,11 +1794,16 @@ int main() {
     TestPcmBlockEnd();
     TestPatchToRackHandle();
     TestPan();
+    TestPanExplicitAnglesAndNanDistance();
     TestPitchAndRepeat();
     TestSubmixerMatrix();
     TestReverb();
     TestReverbSetup();
+    TestReverbConversion();
     TestSampleRate();
+
+    TestMasteringGainClampedLikePs5();
+
     TestSystemOptionFlags();
     TestUserData();
     TestPcmCallbackReset();
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceEvents.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceEvents.cpp
new file mode 100644
index 0000000000..da4b91132b
--- /dev/null
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceEvents.cpp
@@ -0,0 +1,103 @@
+#include "Ngs2Test.hpp"
+
+#include <cstdint>
+#include <vector>
+
+static const Ngs2SamplerVoiceSetupParam SamplerSetup{{}, {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 1, 48000, 0, 0, 0}};
+
+static Ngs2VoiceEventParam PlayParam() {
+    return {{sizeof(Ngs2VoiceEventParam), 0, SCE_NGS2_VOICE_PARAM_EVENT}, SCE_NGS2_VOICE_EVENT_PLAY};
+}
+
+static uintptr_t Sampler(uintptr_t system) {
+    const auto master = Mastering(system, 1);
+    const auto voice = Voice(CreateRack(system, SCE_NGS2_RACK_ID_SAMPLER));
+    Patch(voice, master);
+    return voice;
+}
+
+static void TestPlayWithoutSetup() {
+    const auto system = CreateSystem();
+    const auto voice = Sampler(system);
+    const auto play = PlayParam();
+    const Ngs2VoiceCommand playCommand{2, 0, 4, 0, {.u = SCE_NGS2_VOICE_EVENT_PLAY}};
+    Event(voice, SCE_NGS2_VOICE_EVENT_STOP_IMM);
+    Control(voice, SCE_NGS2_SAMPLER_VOICE_PARAM_ADD_WAVEFORM_BLOCKS, Ngs2SamplerVoiceWaveformBlocksParam{{}, nullptr, 0, 0, nullptr});
+    Require(sceNgs2VoiceControl(voice, &play.header) == SCE_NGS2_ERROR_INVALID_VOICE_ACCESS);
+    Require(sceNgs2VoiceRunCommands(voice, &playCommand, 1) == SCE_NGS2_ERROR_INVALID_VOICE_ACCESS);
+
+    std::vector<float> out(Grain, -1.0f);
+    const Ngs2RenderBufferInfo info{out.data(), out.size() * sizeof(float), SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, 1};
+    for (int grain = 0; grain < 3; grain++) {
+        Require(Flags(voice) == 0);
+        Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_OK);
+        for (float sample : out) Require(sample == 0.0f);
+    }
+    Require(Flags(voice) == 0);
+
+    Control(voice, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, SamplerSetup);
+    Require(sceNgs2VoiceRunCommands(voice, &playCommand, 1) == SCE_NGS2_OK);
+    Require(Flags(voice) == SCE_NGS2_VOICE_STATE_FLAG_INUSE);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestEmptyFormatKeepsTheSetup() {
+    const auto system = CreateSystem();
+    const auto voice = Sampler(system);
+    Control(voice, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, SamplerSetup);
+    Control(voice, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, Ngs2SamplerVoiceSetupParam{});
+    Event(voice, SCE_NGS2_VOICE_EVENT_PLAY);
+    Require(Flags(voice) == SCE_NGS2_VOICE_STATE_FLAG_INUSE);
+
+    const auto bare = Sampler(system);
+    Control(bare, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, Ngs2SamplerVoiceSetupParam{});
+    const auto play = PlayParam();
+    Require(sceNgs2VoiceControl(bare, &play.header) == SCE_NGS2_ERROR_INVALID_VOICE_ACCESS);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestPlayAfterSetupInOneList() {
+    const auto system = CreateSystem();
+    const auto voice = Sampler(system);
+    struct List {
+        Ngs2SamplerVoiceSetupParam setup;
+        Ngs2VoiceEventParam play;
+    };
+    List list{SamplerSetup, PlayParam()};
+    list.setup.header = {sizeof(list.setup), static_cast<std::int16_t>(sizeof(list.setup)), SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP};
+    Require(sceNgs2VoiceControl(voice, &list.setup.header) == SCE_NGS2_OK);
+    Require(Flags(voice) == SCE_NGS2_VOICE_STATE_FLAG_INUSE);
+
+    const auto other = Sampler(system);
+    struct Reversed {
+        Ngs2VoiceEventParam play;
+        Ngs2SamplerVoiceSetupParam setup;
+    };
+    Reversed reversed{PlayParam(), SamplerSetup};
+    reversed.play.header = {sizeof(reversed.play), static_cast<std::int16_t>(sizeof(reversed.play)), SCE_NGS2_VOICE_PARAM_EVENT};
+    reversed.setup.header = {sizeof(reversed.setup), 0, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP};
+    Require(sceNgs2VoiceControl(other, &reversed.play.header) == SCE_NGS2_ERROR_INVALID_VOICE_ACCESS);
+    Require(Flags(other) == 0);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestNeverSetUpVoicesOfOtherRacks() {
+    const auto system = CreateSystem();
+    const auto play = PlayParam();
+    for (const auto rackId : {SCE_NGS2_RACK_ID_SUBMIXER, SCE_NGS2_RACK_ID_REVERB, SCE_NGS2_RACK_ID_MASTERING}) {
+        const auto voice = Voice(CreateRack(system, rackId));
+        Require(sceNgs2VoiceControl(voice, &play.header) == SCE_NGS2_ERROR_INVALID_VOICE_ACCESS);
+        Require(Flags(voice) == 0);
+    }
+    const auto master = Mastering(system, 1);
+    Require(Flags(master) == SCE_NGS2_VOICE_STATE_FLAG_INUSE);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+int main() {
+    TestPlayWithoutSetup();
+    TestEmptyFormatKeepsTheSetup();
+    TestPlayAfterSetupInOneList();
+    TestNeverSetUpVoicesOfOtherRacks();
+    return 0;
+}
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp
index 043e02c96d..7d525001c1 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <algorithm>
@@ -42,6 +43,7 @@ static bool MatrixInfoThrows(uintptr_t voice, std::uint32_t matrixId) {
     bool threw = false;
     try {
         sceNgs2VoiceGetMatrixInfo(voice, matrixId, &info, sizeof(info));
+
     } catch (const TException&) {
         threw = true;
     }
diff --git a/core/libs/prx/libSceNgs2/CMakeLists.txt b/core/libs/prx/libSceNgs2/CMakeLists.txt
index 41b6cfe96a..116315109b 100644
--- a/core/libs/prx/libSceNgs2/CMakeLists.txt
+++ b/core/libs/prx/libSceNgs2/CMakeLists.txt
@@ -12,4 +12,5 @@ if(BUILD_TESTING)
         set_tests_properties(ngs2_core_render PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNgs2>")
     endif()
+    add_sce_ngs2_test(libSceNgs2 ngs2_core_pcm Ngs2Pcm.cpp)
 endif()
diff --git a/core/libs/prx/libSceNgs2/PendingExports.cpp b/core/libs/prx/libSceNgs2/PendingExports.cpp
index ec4b3cad95..e1942c4923 100644
--- a/core/libs/prx/libSceNgs2/PendingExports.cpp
+++ b/core/libs/prx/libSceNgs2/PendingExports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNgs2/include/Api.hpp b/core/libs/prx/libSceNgs2/include/Api.hpp
new file mode 100644
index 0000000000..3398761ed6
--- /dev/null
+++ b/core/libs/prx/libSceNgs2/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNgs2FftInit();
+int APS5_VABI sceNgs2FftProcess();
+int APS5_VABI sceNgs2FftQuerySize();
+int APS5_VABI sceNgs2ParseWaveformUser(std::uintptr_t handler, std::uintptr_t userData, void* outInfo);
+int APS5_VABI sceNgs2SystemEnumHandles(std::uintptr_t* outHandles, std::uint32_t maxHandles);
+int APS5_VABI sceNgs2SystemEnumRackHandles(std::uintptr_t systemHandle, std::uintptr_t* outHandles, std::uint32_t maxHandles);
+
+}
diff --git a/core/libs/prx/libSceNgs2/libSceNgs2.hpp b/core/libs/prx/libSceNgs2/libSceNgs2.hpp
new file mode 100644
index 0000000000..db4f270ed6
--- /dev/null
+++ b/core/libs/prx/libSceNgs2/libSceNgs2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNgs2/include/Api.hpp"
diff --git a/core/libs/prx/libSceNotification/Export.cpp b/core/libs/prx/libSceNotification/Export.cpp
index 90362f2991..8d6772d02d 100644
--- a/core/libs/prx/libSceNotification/Export.cpp
+++ b/core/libs/prx/libSceNotification/Export.cpp
@@ -1,13 +1,14 @@
+#include "prx/libSceNotification/include/Api.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-int APS5_VABI sceNotificationSend(int type, std::uint8_t flag, std::uint8_t* message) {
-    (void)type;
-    (void)flag;
-    (void)message;
+int APS5_VABI sceNotificationSend(int userId, bool logged, const char* payload) {
+    (void)userId;
+    (void)logged;
+    (void)payload;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceNotification/include/Api.hpp b/core/libs/prx/libSceNotification/include/Api.hpp
new file mode 100644
index 0000000000..7174c3528a
--- /dev/null
+++ b/core/libs/prx/libSceNotification/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNotificationSend(int userId, bool logged, const char* payload);
+int APS5_VABI sceNotificationSendById(int type, std::uint8_t flag, std::uint8_t* id, std::uint8_t* jsonData);
+int APS5_VABI sceNotificationShowPsButtonPersistentBanner(std::uint8_t* jsonParam);
+void APS5_VABI sceNotificationHidePsButtonPersistentBanner();
+
+}
diff --git a/core/libs/prx/libSceNotification/libSceNotification.hpp b/core/libs/prx/libSceNotification/libSceNotification.hpp
new file mode 100644
index 0000000000..780084c485
--- /dev/null
+++ b/core/libs/prx/libSceNotification/libSceNotification.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNotification/include/Api.hpp"
diff --git a/core/libs/prx/libSceNotificationClient/libSceNotificationClient.hpp b/core/libs/prx/libSceNotificationClient/libSceNotificationClient.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNotificationClient/libSceNotificationClient.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNpAuth/Export.cpp b/core/libs/prx/libSceNpAuth/Export.cpp
index 3289f920f0..2d2b89ec9d 100644
--- a/core/libs/prx/libSceNpAuth/Export.cpp
+++ b/core/libs/prx/libSceNpAuth/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpAuth/include/Api.hpp"
 #include <atomic>
 #include <array>
 #include <cstddef>
diff --git a/core/libs/prx/libSceNpAuth/include/Api.hpp b/core/libs/prx/libSceNpAuth/include/Api.hpp
new file mode 100644
index 0000000000..cb003d3a93
--- /dev/null
+++ b/core/libs/prx/libSceNpAuth/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpAuthAbortRequest(int reqId);
+int APS5_VABI sceNpAuthCreateAsyncRequest(const void* param);
+int APS5_VABI sceNpAuthCreateRequest(void);
+int APS5_VABI sceNpAuthDeleteRequest(int reqId);
+int APS5_VABI sceNpAuthGetAuthorizedAppCode(std::int32_t requestId, const NpAuthAuthorizedAppCodeParameter* parameter, char* code, std::int32_t* issuerId, bool* authorizationRequired);
+int APS5_VABI sceNpAuthGetAuthorizationCodeV3(int reqId, const void* param, void* authCode, int* issuerId);
+int APS5_VABI sceNpAuthGetIdTokenV3(int reqId, const void* param, void* idToken);
+int APS5_VABI sceNpAuthGetAuthorizationCode(int reqId, const void* param, void* authCode);
+int APS5_VABI sceNpAuthGetIdToken(int reqId, const void* param, void* idToken);
+int APS5_VABI sceNpAuthPollAsync(int reqId, int* result);
+int APS5_VABI sceNpAuthSetTimeout(std::int32_t requestId, std::int32_t resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connectTimeout, std::uint32_t sendTimeout, std::uint32_t receiveTimeout);
+int APS5_VABI sceNpAuthWaitAsync(int reqId, int* result);
+int APS5_VABI sceNpAuthGetAuthorizationCodeA(int reqId, const void* param, void* authCode, int* issuerId);
+int APS5_VABI sceNpAuthGetIdTokenA(int reqId, const void* param, void* token);
+
+}
diff --git a/core/libs/prx/libSceNpAuth/libSceNpAuth.hpp b/core/libs/prx/libSceNpAuth/libSceNpAuth.hpp
new file mode 100644
index 0000000000..1f4aaf4f77
--- /dev/null
+++ b/core/libs/prx/libSceNpAuth/libSceNpAuth.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpAuth/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp
index 9244dedeea..e483fc0a9d 100644
--- a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp
+++ b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -6,8 +8,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp
new file mode 100644
index 0000000000..c2514b916f
--- /dev/null
+++ b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpAuthAuthorizedAppDialogInitialize(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogOpen(const NpAuthAuthorizedAppDialogParam* param);
+int APS5_VABI sceNpAuthAuthorizedAppDialogUpdateStatus(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogGetStatus(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogGetResult(std::int32_t* result);
+int APS5_VABI sceNpAuthAuthorizedAppDialogClose(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/libSceNpAuthAuthorizedAppDialog.hpp b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/libSceNpAuthAuthorizedAppDialog.hpp
new file mode 100644
index 0000000000..c091f6db11
--- /dev/null
+++ b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/libSceNpAuthAuthorizedAppDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpCommerce/Export.cpp b/core/libs/prx/libSceNpCommerce/Export.cpp
index 3a8ee95c0d..a94c5c9e82 100644
--- a/core/libs/prx/libSceNpCommerce/Export.cpp
+++ b/core/libs/prx/libSceNpCommerce/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpCommerce/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -7,8 +9,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libSceNpCommerce/include/Api.hpp b/core/libs/prx/libSceNpCommerce/include/Api.hpp
new file mode 100644
index 0000000000..ddb745fc4a
--- /dev/null
+++ b/core/libs/prx/libSceNpCommerce/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpCommerceDialogInitialize();
+int APS5_VABI sceNpCommerceDialogOpen(const NpCommerceDialogParam* param);
+int APS5_VABI sceNpCommerceDialogUpdateStatus(void);
+int APS5_VABI sceNpCommerceDialogGetStatus(void);
+int APS5_VABI sceNpCommerceDialogGetResult(NpCommerceDialogResult* result);
+int APS5_VABI sceNpCommerceDialogClose(void);
+int APS5_VABI sceNpCommerceDialogTerminate();
+int APS5_VABI sceNpCommerceHidePsStoreIcon(void);
+int APS5_VABI sceNpCommerceShowPsStoreIcon(int pos);
+int APS5_VABI sceNpCommerceSetPsStoreIconLayout(int layout);
+int APS5_VABI sceNpCommerceDialogOpen2(const NpCommerceDialogParam2* param);
+int APS5_VABI sceNpCommerceDialogInitializeInternal();
+
+}
diff --git a/core/libs/prx/libSceNpCommerce/libSceNpCommerce.hpp b/core/libs/prx/libSceNpCommerce/libSceNpCommerce.hpp
new file mode 100644
index 0000000000..240d2d12fe
--- /dev/null
+++ b/core/libs/prx/libSceNpCommerce/libSceNpCommerce.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpCommerce/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpCommon/CMakeLists.txt b/core/libs/prx/libSceNpCommon/CMakeLists.txt
index f85817c30e..bab2481853 100644
--- a/core/libs/prx/libSceNpCommon/CMakeLists.txt
+++ b/core/libs/prx/libSceNpCommon/CMakeLists.txt
@@ -2,5 +2,7 @@ add_library(libSceNpCommon SHARED EXCLUDE_FROM_ALL PendingExports.cpp)
 if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp")
     target_sources(libSceNpCommon PRIVATE Export.cpp)
 endif()
+target_sources(libSceNpCommon PRIVATE Runtime.cpp Strings.cpp)
 target_include_directories(libSceNpCommon PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceNpCommon PRIVATE libc libkernel libSceRtc libSceUserService)
 configure_windows_unwind(libSceNpCommon)
diff --git a/core/libs/prx/libSceNpCommon/Export.cpp b/core/libs/prx/libSceNpCommon/Export.cpp
index f10b45437e..77a7b33fc9 100644
--- a/core/libs/prx/libSceNpCommon/Export.cpp
+++ b/core/libs/prx/libSceNpCommon/Export.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceNpCommon/include/Api.hpp"
 #include <cctype>
 #include <cstdint>
 #include <cstdio>
@@ -18,19 +22,9 @@ constexpr std::size_t ONLINE_ID_MAX_LENGTH = 16;
 constexpr int MUTEX_TYPE_RECURSIVE = 2;
 constexpr KernelClockid CLOCK_MONOTONIC_ID = 4;
 
-struct NpIdFull {
-    NpOnlineId handle;
-    std::uint8_t opt[8];
-    std::uint8_t reserved[8];
-};
 static_assert(sizeof(NpIdFull) == 36);
 
-struct SystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
-static_assert(sizeof(SystemSwVersion) == 0x28);
+static_assert(sizeof(SceKernelSystemSwVersion) == 0x28);
 
 int compareBytes(const std::uint8_t* lhs, const std::uint8_t* rhs, std::size_t count) {
     for (std::size_t i = 0; i < count; ++i) {
@@ -41,25 +35,6 @@ int compareBytes(const std::uint8_t* lhs, const std::uint8_t* rhs, std::size_t c
 
 }
 
-extern "C" int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-extern "C" int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-extern "C" int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-extern "C" int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-extern "C" int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-extern "C" int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-extern "C" int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-extern "C" int APS5_VABI scePthreadMutexTrylock(PthreadMutex* mutex);
-extern "C" int APS5_VABI scePthreadCondattrInit(PthreadCondattr* attr);
-extern "C" int APS5_VABI scePthreadCondattrDestroy(PthreadCondattr* attr);
-extern "C" int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-extern "C" int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-extern "C" int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-extern "C" int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-extern "C" int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, KernelUseconds usec);
-extern "C" int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-extern "C" int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-extern "C" int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SystemSwVersion* version);
-
 extern "C" {
 
 int APS5_VABI sceNpCmpOnlineId(const NpOnlineId* onlineId1, const NpOnlineId* onlineId2) {
@@ -112,6 +87,7 @@ int APS5_VABI sceNpMutexInit(PthreadMutex* mutex, const char* name, std::uint64_
     if (flags & 1) result = scePthreadMutexattrSettype(&attr, MUTEX_TYPE_RECURSIVE);
     if (result == 0) result = scePthreadMutexInit(mutex, &attr, name);
     scePthreadMutexattrDestroy(&attr);
+
     return result;
 }
 
@@ -158,6 +134,7 @@ int APS5_VABI sceNpCondInit(PthreadCond* cond, const char* name, std::uint64_t)
     if (result != 0) return result;
     result = scePthreadCondInit(cond, &attr, name);
     scePthreadCondattrDestroy(&attr);
+
     return result;
 }
 
@@ -187,9 +164,10 @@ int APS5_VABI sceNpGetSystemClockUsec(std::int64_t* usec) {
 }
 
 void APS5_VABI sceNpGetSdkVersion(char* version) {
-    SystemSwVersion swVersion{};
+    SceKernelSystemSwVersion swVersion{};
     swVersion.size = sizeof(swVersion);
     sceKernelGetSystemSwVersion_nid_postfix(&swVersion);
+
     const std::uint32_t hex = swVersion.version;
     std::snprintf(version, 8, "%u.%02u", ((hex >> 24) & 0xF) + (hex >> 28) * 10, ((hex >> 16) & 0xF) + ((hex >> 20) & 0xF) * 10);
 }
diff --git a/core/libs/prx/libSceNpCommon/PendingExports.cpp b/core/libs/prx/libSceNpCommon/PendingExports.cpp
index 9d6ef0f8b0..b6479f111b 100644
--- a/core/libs/prx/libSceNpCommon/PendingExports.cpp
+++ b/core/libs/prx/libSceNpCommon/PendingExports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCommon/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,291 +6,26 @@
 
 extern "C" {
 
-int APS5_VABI sceNpAllocateKernelMemoryNoAlignment(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAllocateKernelMemoryWithAlignment(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpArchInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpArchTerm(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAtomicCas32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAtomicDec32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAtomicInc32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64Decoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64Encoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64GetDecodeSize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64UrlDecoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64UrlEncoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64UrlGetDecodeSize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutInitCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutStartOnCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutStartOnCtx64(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutStopOnCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutTermCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCancelEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpClearEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCloseEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpCloseSema(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpCmpNpId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondSignalAll(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondSignalTo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondWait(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCreateEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCreateSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCreateThread(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDbgAssignDebugId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDbgDumpBinary(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDbgDumpText(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDeleteEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDeleteSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpFreeKernelMemory(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpGetNavSdkVersion(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpGetProcessId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGetRandom(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGetSdkVersionUInt(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocator(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocatorEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocatorExPtr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocatorPtr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapGetAllocator(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapGetStat(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapShowStat(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHexToInt(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpInt32ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpInt64ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpIntGetPlatformType(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpIntIsOnlineIdString(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpIntSetPlatformType(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpIntToHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpIpc2ClientInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpIpc2ClientTerm(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpJsonParse(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -320,96 +56,11 @@ int APS5_VABI sceNpJsonParseInit(void) {
     return 0;
 }
 
-int APS5_VABI sceNpLwCondDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondSignal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondSignalAll(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondSignalTo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondWait(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapGetAllocator(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapGetAllocatorEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpOpenEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpOpenSema(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpPanic(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpPollEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpPollSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpRtcConvertToPosixTime(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpRtcFormatRFC3339(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpRtcParseRFC3339(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpServerErrorJsonGetErrorCode(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -435,91 +86,11 @@ int APS5_VABI sceNpServerErrorJsonParseMultiInit(void) {
     return 0;
 }
 
-int APS5_VABI sceNpSetEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpSetPlatformType(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpSignalSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrBuildHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrParseHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToInt32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToInt64(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToUInt32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToUInt64(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrcpyToBuf(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrnParseHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrncpyToBuf(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpThreadGetId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUInt32ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUInt64ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUserGetUserIdList(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilBuildTitleId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilCanonicalizeNpIdForPs4(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -530,11 +101,6 @@ int APS5_VABI sceNpUtilCanonicalizeNpIdForPsp2(void) {
     return 0;
 }
 
-int APS5_VABI sceNpUtilCmpAccountId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilGetDateSetAuto(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -570,36 +136,11 @@ int APS5_VABI sceNpUtilGetNpDebug(void) {
     return 0;
 }
 
-int APS5_VABI sceNpUtilGetNpLanguageCode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilGetNpLanguageCode2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilGetNpLanguageCode2Str(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilGetNpLanguageCodeStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilGetNpTestPatch(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpUtilGetNthChar(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilGetShareTitleCheck(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -630,29 +171,9 @@ int APS5_VABI sceNpUtilGetWebTraceSetting(void) {
     return 0;
 }
 
-int APS5_VABI sceNpUtilHttpUrlEncode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilJidToNpId(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpUtilJsonEscape(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilJsonGetOneChar(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-}
-
-int APS5_VABI sceNpUtilJsonUnescape(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
 }
diff --git a/core/libs/prx/libSceNpCommon/Runtime.cpp b/core/libs/prx/libSceNpCommon/Runtime.cpp
new file mode 100644
index 0000000000..510328687f
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/Runtime.cpp
@@ -0,0 +1,775 @@
+#include "prx/libSceSaveData/SaveDataCore.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
+#include "prx/libSceRtc/include/Rtc.hpp"
+#include <algorithm>
+#include <atomic>
+#include <iterator>
+#include <mutex>
+#include <random>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include "SceTypes.hpp"
+#include "prx/libc/include/MallocManagedSize.hpp"
+#include "prx/libc/include/General.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+
+static_assert(sizeof(NpCallout) == 0x28);
+
+static_assert(sizeof(NpCalloutContext) == 0x28);
+
+static_assert(sizeof(NpKernelMemory) == 0x18);
+
+static_assert(sizeof(NpMemoryHeap) == 0x20);
+
+namespace {
+
+constexpr int NP_ERROR_NULL_ARGUMENT = static_cast<int>(0x80550003);
+constexpr int NP_ERROR_IPC_ALREADY_INITIALIZED = static_cast<int>(0x80559D00);
+constexpr int NP_ERROR_IPC_NOT_INITIALIZED = static_cast<int>(0x80559D01);
+constexpr int NP_ERROR_ONLINE_ID_MISMATCH = static_cast<int>(0x80550609);
+constexpr int NP_ERROR_INVALID_NP_ID = static_cast<int>(0x80550605);
+constexpr std::size_t NP_ID_OPT_OFFSET = 0x14;
+constexpr std::size_t NP_ID_PLATFORM_OFFSET = 0x18;
+constexpr std::size_t NP_ID_TERMINATOR_FLAG_OFFSET = 0x1C;
+
+std::uint32_t NpIdWord(const std::uint8_t* npId, std::size_t offset) {
+    std::uint32_t value;
+    std::memcpy(&value, npId + offset, sizeof(value));
+    return value;
+}
+constexpr std::size_t NP_ONLINE_ID_MAX = 16;
+constexpr std::size_t NP_ONLINE_ID_MIN = 3;
+constexpr int NP_ERROR_INVALID_ARGUMENT_UTIL = static_cast<int>(0x80550601);
+constexpr std::size_t NP_LANGUAGE_CODE_SIZE = 6;
+constexpr std::size_t NP_LANGUAGE_CODE2_SIZE = 0x24;
+
+struct NpLanguageCodes {
+    const char* code;
+    const char* tag;
+};
+
+constexpr NpLanguageCodes NP_LANGUAGE_CODES[] {
+    {"ja", "ja-JP"}, {"en", "en-US"}, {"fr", "fr-FR"}, {"es", "es-ES"}, {"de", "de-DE"}, {"it", "it-IT"},
+    {"nl", "nl-NL"}, {"pt", "pt-PT"}, {"ru", "ru-RU"}, {"ko", "ko-KR"}, {"zh-TW", "zh-Hant"}, {"zh-CN", "zh-Hans"},
+    {"fi", "fi-FI"}, {"sv", "sv-SE"}, {"da", "da-DK"}, {"no", "no-NO"}, {"pl", "pl-PL"}, {"pt-BR", "pt-BR"},
+    {"en-GB", "en-GB"}, {"tr", "tr-TR"}, {"es-MX", "es-419"}, {"ar", "ar-AE"}, {"fr-CA", "fr-CA"}, {"cs", "cs-CZ"},
+    {"hu", "hu-HU"}, {"el", "el-GR"}, {"ro", "ro-RO"}, {"th", "th-TH"}, {"vi", "vi-VN"}, {"id", "id-ID"},
+    {"uk", "uk-UA"},
+};
+
+const NpLanguageCodes* FindLanguageCodes(int language) {
+    if (language < 0 || static_cast<std::size_t>(language) >= std::size(NP_LANGUAGE_CODES)) return nullptr;
+    return &NP_LANGUAGE_CODES[language];
+}
+
+void CopyText(char* out, const char* text, std::size_t size) {
+    std::strncpy(out, text, size - 1);
+    out[size - 1] = '\0';
+}
+
+std::atomic<std::uint32_t> g_debugIds {0};
+
+constexpr int NP_UTIL_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80550602);
+constexpr int NP_UTIL_ERROR_OUT_OF_RANGE = static_cast<int>(0x8055060A);
+constexpr std::size_t NP_TITLE_ID_SIZE = 13;
+constexpr std::uint8_t NP_TITLE_ID_INDEX_MAX = 99;
+constexpr std::size_t NP_DUMP_LINE_BYTES = 16;
+
+bool IsAsciiLetter(char c) {
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
+}
+
+bool IsOnlineIdText(const char* text) {
+    const std::size_t length = std::strlen(text);
+    if (length < NP_ONLINE_ID_MIN || length > NP_ONLINE_ID_MAX || !IsAsciiLetter(text[0])) return false;
+    return std::all_of(text + 1, text + length, [](char c) {
+        return IsAsciiLetter(c) || (c >= '0' && c <= '9') || c == '_' || c == '-';
+    });
+}
+
+constexpr int NP_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80558008);
+constexpr std::size_t NP_SDK_VERSION_SIZE = 8;
+constexpr std::size_t NP_RFC3339_BUFFER_MIN = 0x80;
+constexpr std::size_t NP_USER_ID_LIST_SIZE = 20;
+constexpr int USER_ID_INVALID = -1;
+constexpr KernelClockid NP_SYSTEM_CLOCK = 4;
+
+static_assert(sizeof(SceKernelSystemSwVersion) == 0x28);
+
+std::uint32_t SystemVersion() {
+    SceKernelSystemSwVersion version {};
+    version.size = sizeof(version);
+    sceKernelGetSystemSwVersion_nid_postfix(&version);
+
+    return version.version;
+}
+
+int BcdPair(std::uint32_t value, int shift) {
+    return static_cast<int>((value >> (shift + 4)) & 0xF) * 10 + static_cast<int>((value >> shift) & 0xF);
+}
+
+constexpr int NP_ERROR_OUT_OF_MEMORY = static_cast<int>(0x80550005);
+constexpr int NP_ERROR_NULL_OBJECT = static_cast<int>(0x80558005);
+constexpr int NP_ERROR_HEAP_CREATE = static_cast<int>(0x8055800A);
+constexpr std::uint64_t NP_KERNEL_MEMORY_ALIGNMENT = 0x4000;
+constexpr int NP_KERNEL_MEMORY_PROTECTION = 3;
+constexpr std::size_t NP_GLOBAL_HEAP_SIZE = 0x80000;
+constexpr char NP_GLOBAL_HEAP_NAME[] = "NpCommonGlobalHeap";
+constexpr std::size_t NP_IPC_CLIENT_HEAP_SIZE = 0x10000;
+constexpr char NP_IPC_CLIENT_HEAP_NAME[] = "NpCommonIpcClientHeap";
+
+void* APS5_VABI HeapAllocate(std::size_t size, void* context) {
+    auto* heap = static_cast<NpHeap*>(context);
+    return heap->mspace != nullptr ? sceLibcMspaceMalloc_nid_postfix(heap->mspace, size) : nullptr;
+}
+
+void* APS5_VABI HeapReallocate(void* pointer, std::size_t size, void* context) {
+    auto* heap = static_cast<NpHeap*>(context);
+    return heap->mspace != nullptr ? sceLibcMspaceRealloc_nid_postfix(heap->mspace, pointer, size) : nullptr;
+}
+
+void APS5_VABI HeapRelease(void* pointer, void* context) {
+    auto* heap = static_cast<NpHeap*>(context);
+    if (heap->mspace != nullptr && pointer != nullptr) sceLibcMspaceFree_nid_postfix(heap->mspace, pointer);
+}
+
+void* APS5_VABI MemoryHeapAllocate(std::size_t size, void* context) {
+    return HeapAllocate(size, &static_cast<NpMemoryHeap*>(context)->heap);
+}
+
+void* APS5_VABI MemoryHeapReallocate(void* pointer, std::size_t size, void* context) {
+    return HeapReallocate(pointer, size, &static_cast<NpMemoryHeap*>(context)->heap);
+}
+
+void APS5_VABI MemoryHeapRelease(void* pointer, void* context) {
+    HeapRelease(pointer, &static_cast<NpMemoryHeap*>(context)->heap);
+}
+
+std::uint64_t AlignKernelMemory(std::uint64_t size) {
+    const std::uint64_t remainder = size & (NP_KERNEL_MEMORY_ALIGNMENT - 1);
+    return remainder == 0 ? size : size + NP_KERNEL_MEMORY_ALIGNMENT - remainder;
+}
+
+int MapKernelMemory(NpKernelMemory* memory, std::uint64_t size, const char* name) {
+    memory->reserved = 0;
+    memory->size = size;
+    return sceKernelMapNamedFlexibleMemory(&memory->address, size, NP_KERNEL_MEMORY_PROTECTION, 0, name);
+}
+
+void UnmapKernelMemory(NpKernelMemory* memory) {
+    if (memory->address != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory->address), memory->size);
+    memory->address = nullptr;
+}
+
+int InitHeap(NpHeap* heap, void* base, std::size_t size, const char* name) {
+    heap->mspace = sceLibcMspaceCreate_nid_postfix(name, base, size, 0);
+    return heap->mspace != nullptr ? 0 : NP_ERROR_HEAP_CREATE;
+}
+
+void DestroyHeap(NpHeap* heap) {
+    if (heap->mspace == nullptr) return;
+    sceLibcMspaceDestroy_nid_postfix(heap->mspace);
+
+    heap->mspace = nullptr;
+}
+
+int InitMemoryHeap(NpMemoryHeap* heap, std::uint64_t size, const char* name) {
+    if (heap == nullptr) return NP_ERROR_NULL_OBJECT;
+    int result = MapKernelMemory(&heap->memory, AlignKernelMemory(size), name);
+    if (result < 0) return result;
+    result = InitHeap(&heap->heap, heap->memory.address, heap->memory.size, name);
+    if (result >= 0) return result;
+    UnmapKernelMemory(&heap->memory);
+    *heap = {};
+    return result;
+}
+
+void DestroyMemoryHeap(NpMemoryHeap* heap) {
+    DestroyHeap(&heap->heap);
+    UnmapKernelMemory(&heap->memory);
+}
+
+NpAllocator MemoryHeapAllocator(NpMemoryHeap* heap) {
+    return {MemoryHeapAllocate, MemoryHeapReallocate, MemoryHeapRelease, heap};
+}
+
+constexpr int NP_ERROR_NOT_INITIALIZED = static_cast<int>(0x80558001);
+constexpr int NP_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80558002);
+constexpr int NP_ERROR_ALREADY_QUEUED = static_cast<int>(0x80558006);
+constexpr std::uint64_t NP_CALLOUT_MAX_WAIT = 0xFFFFFFFF;
+
+std::mutex g_randomMutex;
+std::mt19937 g_random {std::random_device {}()};
+
+NpMemoryHeap g_globalHeap {};
+NpAllocator g_globalAllocator {};
+NpAllocatorEx g_globalAllocatorEx {};
+int g_archReferences = 0;
+std::mutex g_archMutex;
+std::mutex g_ipcClientMutex;
+bool g_ipcClientInitialized = false;
+NpMemoryHeap g_ipcClientHeap {};
+
+constexpr int KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
+constexpr int KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
+constexpr int NP_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80558009);
+constexpr int NP_ERROR_TIMEOUT = static_cast<int>(0x8055800B);
+constexpr int NP_ERROR_EVENT_FLAG_BUSY = static_cast<int>(0x8055800C);
+constexpr int NP_ERROR_SEMA_BUSY = static_cast<int>(0x8055800D);
+constexpr int NP_ERROR_MUTEX_BUSY = static_cast<int>(0x8055800F);
+constexpr std::uint32_t NP_MUTEX_FLAG_RECURSIVE = 1;
+constexpr int PTHREAD_MUTEX_TYPE_RECURSIVE = 2;
+constexpr std::uint32_t NP_SEMA_FLAG_PRIORITY = 1;
+constexpr std::uint32_t KERNEL_SEMA_ATTR_FIFO = 1;
+constexpr std::uint32_t KERNEL_SEMA_ATTR_PRIORITY_SHIFT = 8;
+constexpr int NP_THREAD_EXPLICIT_SCHED = 0;
+constexpr int NP_THREAD_SCHED_POLICY = 1;
+
+int NpResult(int result) {
+    return result < 0 ? result : 0;
+}
+
+int NpBusyResult(int result, int busy) {
+    return result == KERNEL_ERROR_EBUSY ? busy : NpResult(result);
+}
+
+int InitMutex(PthreadMutex* mutex, const char* name, std::uint32_t flags) {
+    PthreadMutexattr attr {};
+    int result = scePthreadMutexattrInit(&attr);
+    if (result < 0) return result;
+    if ((flags & NP_MUTEX_FLAG_RECURSIVE) != 0) result = scePthreadMutexattrSettype(&attr, PTHREAD_MUTEX_TYPE_RECURSIVE);
+    if (result >= 0) result = scePthreadMutexInit(mutex, &attr, name);
+    scePthreadMutexattrDestroy(&attr);
+
+    return NpResult(result);
+}
+
+int InitCond(PthreadCond* cond, const char* name) {
+    PthreadCondattr attr {};
+    const int result = scePthreadCondattrInit(&attr);
+    if (result < 0) return result;
+    const int created = scePthreadCondInit(cond, &attr, name);
+    scePthreadCondattrDestroy(&attr);
+
+    return created;
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI sceNpAtomicCas32(std::int32_t* value, std::int32_t expected, std::int32_t desired) {
+    std::atomic_ref<std::int32_t>(*value).compare_exchange_strong(expected, desired);
+    return expected;
+}
+
+int APS5_VABI sceNpAtomicInc32(std::int32_t* value) {
+    return std::atomic_ref<std::int32_t>(*value).fetch_add(1);
+}
+
+int APS5_VABI sceNpAtomicDec32(std::int32_t* value) {
+    return std::atomic_ref<std::int32_t>(*value).fetch_sub(1);
+}
+
+int APS5_VABI sceNpCondSignalAll(PthreadCond* cond) {
+    return scePthreadCondBroadcast(cond);
+}
+
+int APS5_VABI sceNpCondSignalTo(PthreadCond* cond, Pthread thread) {
+    return scePthreadCondSignalto(cond, thread);
+}
+
+int APS5_VABI sceNpCondWait(PthreadCond* cond, PthreadMutex* mutex) {
+    return scePthreadCondWait(cond, mutex);
+}
+
+int APS5_VABI sceNpLwCondInit(PthreadCond* cond, const char* name) {
+    return InitCond(cond, name);
+}
+
+int APS5_VABI sceNpLwCondDestroy(PthreadCond* cond) {
+    return scePthreadCondDestroy(cond);
+}
+
+int APS5_VABI sceNpLwCondSignal(PthreadCond* cond) {
+    return scePthreadCondSignal(cond);
+}
+
+int APS5_VABI sceNpLwCondSignalAll(PthreadCond* cond) {
+    return scePthreadCondBroadcast(cond);
+}
+
+int APS5_VABI sceNpLwCondSignalTo(PthreadCond* cond, Pthread thread) {
+    return scePthreadCondSignalto(cond, thread);
+}
+
+int APS5_VABI sceNpLwCondWait(PthreadCond* cond, PthreadMutex* mutex) {
+    return scePthreadCondWait(cond, mutex);
+}
+
+int APS5_VABI sceNpCreateEventFlag(KernelEventFlag* flag, const char* name, std::uint32_t attr, std::uint64_t pattern) {
+    return NpResult(sceKernelCreateEventFlag(flag, name, attr, pattern, nullptr));
+}
+
+int APS5_VABI sceNpDeleteEventFlag(KernelEventFlag flag) {
+    return NpResult(sceKernelDeleteEventFlag(flag));
+}
+
+int APS5_VABI sceNpOpenEventFlag(KernelEventFlag* flag, const char* name) {
+    return NpResult(sceKernelOpenEventFlag(flag, name));
+}
+
+int APS5_VABI sceNpCloseEventFlag(KernelEventFlag flag) {
+    return NpResult(sceKernelCloseEventFlag(flag));
+}
+
+int APS5_VABI sceNpSetEventFlag(KernelEventFlag flag, std::uint64_t pattern) {
+    return NpResult(sceKernelSetEventFlag(flag, pattern));
+}
+
+int APS5_VABI sceNpClearEventFlag(KernelEventFlag flag, std::uint64_t pattern) {
+    return NpResult(sceKernelClearEventFlag(flag, pattern));
+}
+
+int APS5_VABI sceNpPollEventFlag(KernelEventFlag flag, std::uint64_t pattern, std::uint32_t mode, std::uint64_t* result) {
+    return NpBusyResult(sceKernelPollEventFlag(flag, pattern, mode, result), NP_ERROR_EVENT_FLAG_BUSY);
+}
+
+int APS5_VABI sceNpCancelEventFlag(KernelEventFlag flag, std::uint64_t pattern, int* waiting) {
+    return NpResult(sceKernelCancelEventFlag(flag, pattern, waiting));
+}
+
+int APS5_VABI sceNpCreateSema(KernelSema* sema, std::uint32_t flags, int initial, int maximum, const char* name) {
+    const std::uint32_t attr = KERNEL_SEMA_ATTR_FIFO + ((flags & NP_SEMA_FLAG_PRIORITY) << KERNEL_SEMA_ATTR_PRIORITY_SHIFT);
+    return NpResult(sceKernelCreateSema(sema, name, attr, initial, maximum, nullptr));
+}
+
+int APS5_VABI sceNpDeleteSema(KernelSema sema) {
+    return NpResult(sceKernelDeleteSema(sema));
+}
+
+int APS5_VABI sceNpPollSema(KernelSema sema) {
+    return NpBusyResult(sceKernelPollSema(sema, 1), NP_ERROR_SEMA_BUSY);
+}
+
+int APS5_VABI sceNpSignalSema(KernelSema sema) {
+    return NpResult(sceKernelSignalSema(sema, 1));
+}
+
+int APS5_VABI sceNpCreateThread(Pthread* thread, PthreadEntry entry, void* arg, int priority, std::size_t stackSize, KernelCpumask affinity, const char* name) {
+    PthreadAttr attr {};
+    int result = scePthreadAttrInit(&attr);
+    if (result < 0) return result;
+    result = scePthreadAttrSetstacksize(&attr, stackSize);
+    if (result < 0) {
+        scePthreadAttrDestroy(&attr);
+
+        return result;
+    }
+    if (priority != 0) {
+        result = scePthreadAttrSetinheritsched(&attr, NP_THREAD_EXPLICIT_SCHED);
+        if (result >= 0) result = scePthreadAttrSetschedpolicy(&attr, NP_THREAD_SCHED_POLICY);
+        if (result >= 0) {
+            KernelSchedParam param {};
+            param.sched_priority = priority;
+            result = scePthreadAttrSetschedparam(&attr, &param);
+        }
+    }
+    if (result >= 0 && affinity != 0) result = scePthreadAttrSetaffinity(&attr, affinity);
+    if (result >= 0) result = scePthreadCreate(thread, &attr, entry, arg, name);
+    scePthreadAttrDestroy(&attr);
+
+    return result;
+}
+
+int APS5_VABI sceNpThreadGetId(Pthread* thread) {
+    if (thread == nullptr) return NP_ERROR_INVALID_ARGUMENT;
+    *thread = scePthreadSelf();
+    return 0;
+}
+
+int APS5_VABI sceNpGetProcessId(void) {
+    return getpid_nid_postfix();
+}
+
+[[noreturn]] void APS5_VABI sceNpPanic(void) {
+    std::abort();
+}
+
+int APS5_VABI sceNpDbgDumpText(const char* text, int length) {
+    return std::printf("%.*s", length, text);
+}
+
+int APS5_VABI sceNpIpc2ClientInit(void) {
+    std::lock_guard lock(g_ipcClientMutex);
+    if (g_ipcClientInitialized) return NP_ERROR_IPC_ALREADY_INITIALIZED;
+    const int result = InitMemoryHeap(&g_ipcClientHeap, NP_IPC_CLIENT_HEAP_SIZE, NP_IPC_CLIENT_HEAP_NAME);
+    if (result < 0) return result;
+    g_ipcClientInitialized = true;
+    return 0;
+}
+
+int APS5_VABI sceNpIpc2ClientTerm(void) {
+    std::lock_guard lock(g_ipcClientMutex);
+    if (!g_ipcClientInitialized) return NP_ERROR_IPC_NOT_INITIALIZED;
+    DestroyMemoryHeap(&g_ipcClientHeap);
+    g_ipcClientInitialized = false;
+    return 0;
+}
+
+int APS5_VABI sceNpArchInit(void) {
+    std::lock_guard lock(g_archMutex);
+    if (g_archReferences != 0) {
+        ++g_archReferences;
+        return 0;
+    }
+    const int result = InitMemoryHeap(&g_globalHeap, NP_GLOBAL_HEAP_SIZE, NP_GLOBAL_HEAP_NAME);
+    if (result < 0) return result;
+    g_archReferences = 1;
+    return 0;
+}
+
+void APS5_VABI sceNpArchTerm(void) {
+    std::lock_guard lock(g_archMutex);
+    if (g_archReferences == 0) return;
+    if (--g_archReferences == 0) DestroyMemoryHeap(&g_globalHeap);
+}
+
+int APS5_VABI sceNpHeapInit(NpHeap* heap, void* base, std::size_t size, const char* name) {
+    return InitHeap(heap, base, size, name);
+}
+
+void APS5_VABI sceNpHeapDestroy(NpHeap* heap) {
+    DestroyHeap(heap);
+}
+
+void APS5_VABI sceNpHeapGetAllocator(NpHeap* heap, NpAllocator* allocator) {
+    *allocator = {HeapAllocate, HeapReallocate, HeapRelease, heap};
+}
+
+int APS5_VABI sceNpHeapGetStat(const NpHeap* heap, NpHeapStat* stat) {
+    MallocManagedSize stats {};
+    stats.size = sizeof(stats);
+    stats.version = 1;
+    const int result = sceLibcMspaceMallocStats_nid_postfix(heap->mspace, &stats);
+    if (result == 0) *stat = {stats.maxSystemSize, stats.maxInuseSize, stats.currentInuseSize};
+    return result;
+}
+
+void APS5_VABI sceNpHeapShowStat(const NpHeap* heap) {
+    NpHeapStat stat {};
+    if (sceNpHeapGetStat(heap, &stat) != 0) {
+        std::printf("[NpCommon] heap statistics unavailable\n");
+        return;
+    }
+    std::printf("[NpCommon] heap: system %llu bytes, peak in use %llu bytes, in use %llu bytes\n",
+        static_cast<unsigned long long>(stat.maxSystemSize), static_cast<unsigned long long>(stat.maxInuseSize),
+        static_cast<unsigned long long>(stat.currentInuseSize));
+}
+
+int APS5_VABI sceNpMemoryHeapInit(NpMemoryHeap* heap, std::uint64_t size, const char* name) {
+    return InitMemoryHeap(heap, size, name);
+}
+
+void APS5_VABI sceNpMemoryHeapDestroy(NpMemoryHeap* heap) {
+    DestroyMemoryHeap(heap);
+}
+
+void APS5_VABI sceNpMemoryHeapGetAllocator(NpMemoryHeap* heap, NpAllocator* allocator) {
+    *allocator = MemoryHeapAllocator(heap);
+}
+
+void APS5_VABI sceNpMemoryHeapGetAllocatorEx(NpMemoryHeap* heap, int outOfMemoryError, NpAllocatorEx* allocator) {
+    *allocator = {MemoryHeapAllocator(heap), outOfMemoryError};
+}
+
+void APS5_VABI sceNpGlobalHeapGetAllocator(NpAllocator* allocator) {
+    *allocator = MemoryHeapAllocator(&g_globalHeap);
+}
+
+void APS5_VABI sceNpGlobalHeapGetAllocatorEx(NpAllocatorEx* allocator) {
+    *allocator = {MemoryHeapAllocator(&g_globalHeap), NP_ERROR_OUT_OF_MEMORY};
+}
+
+NpAllocator* APS5_VABI sceNpGlobalHeapGetAllocatorPtr(void) {
+    g_globalAllocator = MemoryHeapAllocator(&g_globalHeap);
+    return &g_globalAllocator;
+}
+
+NpAllocatorEx* APS5_VABI sceNpGlobalHeapGetAllocatorExPtr(void) {
+    g_globalAllocatorEx = {MemoryHeapAllocator(&g_globalHeap), NP_ERROR_OUT_OF_MEMORY};
+    return &g_globalAllocatorEx;
+}
+
+int APS5_VABI sceNpAllocateKernelMemoryNoAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory) {
+    if (memory == nullptr) return NP_ERROR_NULL_OBJECT;
+    const int result = MapKernelMemory(memory, size, name);
+    if (result >= 0 && address != nullptr) *address = memory->address;
+    return result;
+}
+
+int APS5_VABI sceNpAllocateKernelMemoryWithAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory) {
+    return sceNpAllocateKernelMemoryNoAlignment(AlignKernelMemory(size), name, address, memory);
+}
+
+int APS5_VABI sceNpFreeKernelMemory(NpKernelMemory* memory) {
+    if (memory == nullptr) return NP_ERROR_NULL_OBJECT;
+    UnmapKernelMemory(memory);
+    return 0;
+}
+
+void APS5_VABI sceNpGetSdkVersionUInt(std::uint32_t* version) {
+    const std::uint32_t value = SystemVersion();
+    if (version != nullptr) *version = value;
+}
+
+int APS5_VABI sceNpRtcConvertToPosixTime(const RtcTick* tick, std::int64_t* seconds) {
+    if (tick->tick == 0) return NP_ERROR_INVALID_ARGUMENT;
+    RtcDateTime time {};
+    const int result = sceRtcSetTick(&time, tick);
+    if (result < 0) return result;
+    return NpResult(sceRtcGetTime_t(&time, seconds));
+}
+
+int APS5_VABI sceNpRtcFormatRFC3339(char* text, std::size_t size, const RtcTick* utc, int timeZoneMinutes) {
+    if (size < NP_RFC3339_BUFFER_MIN) return NP_ERROR_BUFFER_TOO_SMALL;
+    const int result = sceRtcFormatRFC3339(text, utc, timeZoneMinutes);
+    if (result < 0) return result;
+    text[size - 1] = 0;
+    return 0;
+}
+
+int APS5_VABI sceNpUserGetUserIdList(int* users, std::size_t capacity, int* count) {
+    if (capacity < NP_USER_ID_LIST_SIZE) return NP_ERROR_INVALID_ARGUMENT;
+    int registered[NP_USER_ID_LIST_SIZE];
+    std::fill(std::begin(registered), std::end(registered), USER_ID_INVALID);
+    static_assert(sizeof(UserServiceRegisteredUserIdList) <= sizeof(registered));
+    const int result = sceUserServiceGetRegisteredUserIdList(reinterpret_cast<UserServiceRegisteredUserIdList*>(registered));
+    if (result < 0) return result;
+    int found = 0;
+    for (const int user : registered)
+        if (user != USER_ID_INVALID) users[found++] = user;
+    *count = found;
+    return 0;
+}
+
+int APS5_VABI sceNpRtcParseRFC3339(RtcTick* utc, const char* text) {
+    return sceRtcParseRFC3339(utc, text);
+}
+
+static std::uint64_t ClockUsec() {
+    std::int64_t usec = 0;
+    sceNpGetSystemClockUsec(&usec);
+
+    return static_cast<std::uint64_t>(usec);
+}
+
+static void* APS5_VABI CalloutThread(void* arg) {
+    auto* context = static_cast<NpCalloutContext*>(arg);
+    sceNpMutexLock(&context->mutex);
+
+    for (;;) {
+        const std::uint64_t now = ClockUsec();
+        NpCallout* head = context->pending;
+        if (head != nullptr && head->deadline <= now) {
+            context->pending = head->next;
+            sceNpMutexUnlock(&context->mutex);
+
+            head->handler(head->arg);
+            sceNpMutexLock(&context->mutex);
+
+            continue;
+        }
+        if (context->stopping > 0) break;
+        const std::uint64_t wait = head != nullptr ? std::min(head->deadline - now, NP_CALLOUT_MAX_WAIT) : 0;
+        sceNpCondTimedwait(&context->cond, &context->mutex, static_cast<std::uint32_t>(wait));
+
+        if (context->stopping > 0) break;
+    }
+    sceNpMutexUnlock(&context->mutex);
+
+    return nullptr;
+}
+
+int APS5_VABI sceNpCalloutInitCtx(NpCalloutContext* context, const char* name, std::size_t stackSize, int priority,
+    KernelCpumask affinity) {
+    if (context->initialized > 0) return NP_ERROR_ALREADY_INITIALIZED;
+    context->stopping = 0;
+    context->pending = nullptr;
+    int result = sceNpMutexInit(&context->mutex, name, 1);
+    if (result < 0) return result;
+    result = sceNpCondInit(&context->cond, name, 0);
+    if (result >= 0) {
+        result = sceNpCreateThread(&context->thread, CalloutThread, context, priority, stackSize, affinity, name);
+        if (result >= 0) {
+            context->initialized = 1;
+            return 0;
+        }
+        sceNpCondDestroy(&context->cond);
+
+    }
+    sceNpMutexDestroy(&context->mutex);
+
+    return result;
+}
+
+void APS5_VABI sceNpCalloutTermCtx(NpCalloutContext* context) {
+    if (context->initialized == 0) return;
+    sceNpMutexLock(&context->mutex);
+
+    context->stopping = 1;
+    sceNpCondSignal(&context->cond);
+    sceNpMutexUnlock(&context->mutex);
+    sceNpJoinThread(context->thread, nullptr);
+    sceNpCondDestroy(&context->cond);
+    sceNpMutexDestroy(&context->mutex);
+
+    context->initialized = 0;
+}
+
+int APS5_VABI sceNpCalloutStartOnCtx64(NpCalloutContext* context, NpCallout* callout, std::uint64_t usec,
+    void (APS5_VABI *handler)(void* arg), void* arg) {
+    if (context->initialized == 0) return NP_ERROR_NOT_INITIALIZED;
+    const std::uint64_t deadline = ClockUsec() + usec;
+    sceNpMutexLock(&context->mutex);
+
+    for (NpCallout* entry = context->pending; entry != nullptr; entry = entry->next) {
+        if (entry == callout) {
+            sceNpMutexUnlock(&context->mutex);
+
+            return NP_ERROR_ALREADY_QUEUED;
+        }
+    }
+    *callout = {};
+    callout->deadline = deadline;
+    callout->handler = handler;
+    callout->arg = arg;
+    NpCallout** link = &context->pending;
+    while (*link != nullptr && callout->deadline > (*link)->deadline) link = &(*link)->next;
+    callout->next = *link;
+    *link = callout;
+    sceNpCondSignal(&context->cond);
+    sceNpMutexUnlock(&context->mutex);
+
+    return 0;
+}
+
+int APS5_VABI sceNpCalloutStartOnCtx(NpCalloutContext* context, NpCallout* callout, std::uint32_t usec,
+    void (APS5_VABI *handler)(void* arg), void* arg) {
+    return sceNpCalloutStartOnCtx64(context, callout, usec, handler, arg);
+}
+
+int APS5_VABI sceNpCalloutStopOnCtx(NpCalloutContext* context, NpCallout* callout, int* wasPending) {
+    if (context->initialized == 0) return NP_ERROR_NOT_INITIALIZED;
+    sceNpMutexLock(&context->mutex);
+
+    int removed = 0;
+    for (NpCallout** link = &context->pending; *link != nullptr; link = &(*link)->next) {
+        if (*link != callout) continue;
+        *link = callout->next;
+        removed = 1;
+        break;
+    }
+    if (wasPending != nullptr) *wasPending = removed;
+    sceNpMutexUnlock(&context->mutex);
+
+    return 0;
+}
+
+std::uint32_t APS5_VABI sceNpGetRandom(void) {
+    std::lock_guard lock(g_randomMutex);
+    return static_cast<std::uint32_t>(g_random());
+}
+
+int APS5_VABI sceNpUtilCmpAccountId(std::uint64_t left, std::uint64_t right) {
+    return left != right ? 1 : 0;
+}
+
+int APS5_VABI sceNpCmpNpId(const void* npId1, const void* npId2) {
+    if (!npId1 || !npId2) return NP_ERROR_NULL_ARGUMENT;
+    const auto* left = static_cast<const std::uint8_t*>(npId1);
+    const auto* right = static_cast<const std::uint8_t*>(npId2);
+    if (left[NP_ID_TERMINATOR_FLAG_OFFSET] != 1 || right[NP_ID_TERMINATOR_FLAG_OFFSET] != 1) return NP_ERROR_INVALID_NP_ID;
+    if (std::strncmp(static_cast<const char*>(npId1), static_cast<const char*>(npId2), NP_ONLINE_ID_MAX) != 0) return NP_ERROR_ONLINE_ID_MISMATCH;
+    if (NpIdWord(left, NP_ID_OPT_OFFSET) != NpIdWord(right, NP_ID_OPT_OFFSET)) return NP_ERROR_ONLINE_ID_MISMATCH;
+    if (NpIdWord(left, NP_ID_PLATFORM_OFFSET) == NpIdWord(right, NP_ID_PLATFORM_OFFSET)) return 0;
+    if (left[NP_ID_PLATFORM_OFFSET] == 0 || right[NP_ID_PLATFORM_OFFSET] == 0) return 0;
+    return NP_ERROR_ONLINE_ID_MISMATCH;
+}
+
+bool APS5_VABI sceNpIntIsOnlineIdString(const char* text) {
+    return text != nullptr && IsOnlineIdText(text);
+}
+
+int APS5_VABI sceNpUtilGetNpLanguageCode(int language, char* code) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    if (codes == nullptr || code == nullptr) return NP_ERROR_INVALID_ARGUMENT_UTIL;
+    CopyText(code, codes->code, NP_LANGUAGE_CODE_SIZE);
+    return 0;
+}
+
+int APS5_VABI sceNpUtilGetNpLanguageCode2(int language, char* tag) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    if (codes == nullptr || tag == nullptr) return NP_ERROR_INVALID_ARGUMENT_UTIL;
+    CopyText(tag, codes->tag, NP_LANGUAGE_CODE2_SIZE);
+    return 0;
+}
+
+const char* APS5_VABI sceNpUtilGetNpLanguageCodeStr(int language) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    return codes != nullptr ? codes->code : nullptr;
+}
+
+const char* APS5_VABI sceNpUtilGetNpLanguageCode2Str(int language) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    return codes != nullptr ? codes->tag : nullptr;
+}
+
+std::uint32_t APS5_VABI sceNpDbgAssignDebugId(void) {
+    std::uint32_t id = g_debugIds.fetch_add(1) + 1;
+    if (id == 0) id = g_debugIds.fetch_add(1) + 1;
+    return id;
+}
+
+int APS5_VABI sceNpUtilBuildTitleId(const NpTitleIdParts* parts, char* titleId, std::size_t size) {
+    if (parts == nullptr || titleId == nullptr) return NP_ERROR_INVALID_ARGUMENT_UTIL;
+    if (size < NP_TITLE_ID_SIZE) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (parts->index > NP_TITLE_ID_INDEX_MAX) return NP_UTIL_ERROR_OUT_OF_RANGE;
+    std::memcpy(titleId, parts->id, sizeof(parts->id));
+    titleId[9] = '_';
+    titleId[10] = static_cast<char>('0' + parts->index / 10);
+    titleId[11] = static_cast<char>('0' + parts->index % 10);
+    titleId[12] = '\0';
+    return 0;
+}
+
+void APS5_VABI sceNpDbgDumpBinary(const void* data, std::size_t size) {
+    const auto* bytes = static_cast<const std::uint8_t*>(data);
+    for (std::size_t line = 0; line < size; line += NP_DUMP_LINE_BYTES) {
+        const std::size_t count = std::min(NP_DUMP_LINE_BYTES, size - line);
+        for (std::size_t i = 0; i < NP_DUMP_LINE_BYTES; ++i) {
+            if (i < count) {
+                std::printf("%02x", bytes[line + i]);
+            } else {
+                std::printf("  ");
+            }
+            if ((i & 1) != 0) std::putchar(' ');
+        }
+        std::putchar(' ');
+        for (std::size_t i = 0; i < count; ++i) {
+            const std::uint8_t c = bytes[line + i];
+            std::putchar(c >= 0x20 && c <= 0x7E ? c : '.');
+        }
+        std::putchar('\n');
+    }
+    std::putchar('\n');
+}
+
+}
diff --git a/core/libs/prx/libSceNpCommon/Strings.cpp b/core/libs/prx/libSceNpCommon/Strings.cpp
new file mode 100644
index 0000000000..08125a4c0f
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/Strings.cpp
@@ -0,0 +1,630 @@
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include <cerrno>
+#include <climits>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include "SceTypes.hpp"
+
+namespace {
+
+constexpr int NP_ERROR_INVALID_FORMAT = static_cast<int>(0x80558003);
+constexpr int NP_ERROR_INVALID_CHARACTER = static_cast<int>(0x80558004);
+constexpr int NP_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80558008);
+constexpr int NP_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80558009);
+constexpr int NP_ERROR_OUT_OF_RANGE = static_cast<int>(0x8055800E);
+
+constexpr std::uint32_t NP_FORMAT_UPPERCASE = 1;
+constexpr std::uint32_t NP_FORMAT_PREFIX = 2;
+constexpr std::uint32_t NP_FORMAT_SIGN = 4;
+constexpr std::uint32_t NP_RADIX_MAX = 36;
+
+constexpr char BASE64_ALPHABET[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+constexpr char BASE64URL_ALPHABET[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+constexpr char BASE64_PAD = '=';
+
+int Base64Value(char c, const char* alphabet) {
+    if (c == '\0') return -1;
+    const char* found = std::strchr(alphabet, c);
+    return found != nullptr ? static_cast<int>(found - alphabet) : -1;
+}
+
+struct Base64Block {
+    std::uint32_t bits;
+    int bytes;
+};
+
+int DecodeLastBlock(const char* src, std::size_t length, const char* alphabet, Base64Block* block) {
+    char c[4] = {BASE64_PAD, BASE64_PAD, BASE64_PAD, BASE64_PAD};
+    std::memcpy(c, src, length);
+    const int v0 = Base64Value(c[0], alphabet);
+    const int v1 = Base64Value(c[1], alphabet);
+    if (v0 < 0 || v1 < 0) return NP_ERROR_INVALID_CHARACTER;
+    block->bits = (static_cast<std::uint32_t>(v0) << 18) | (static_cast<std::uint32_t>(v1) << 12);
+    if (c[2] == BASE64_PAD) {
+        if (c[3] != BASE64_PAD) return NP_ERROR_INVALID_CHARACTER;
+        block->bytes = 1;
+        return 0;
+    }
+    const int v2 = Base64Value(c[2], alphabet);
+    if (v2 < 0) return NP_ERROR_INVALID_CHARACTER;
+    block->bits |= static_cast<std::uint32_t>(v2) << 6;
+    if (c[3] == BASE64_PAD) {
+        block->bytes = 2;
+        return 0;
+    }
+    const int v3 = Base64Value(c[3], alphabet);
+    if (v3 < 0) return NP_ERROR_INVALID_CHARACTER;
+    block->bits |= static_cast<std::uint32_t>(v3);
+    block->bytes = 3;
+    return 0;
+}
+
+int Base64Decode(const char* src, std::size_t length, std::uint8_t* dst, std::size_t capacity, const char* alphabet,
+    bool padded) {
+    if (padded && (length & 3) != 0) return NP_ERROR_INVALID_FORMAT;
+    int decoded = 0;
+    while (length > 4) {
+        std::uint32_t bits = 0;
+        for (int i = 0; i < 4; ++i) {
+            const int value = Base64Value(src[i], alphabet);
+            if (value < 0) return NP_ERROR_INVALID_CHARACTER;
+            bits = (bits << 6) | static_cast<std::uint32_t>(value);
+        }
+        if (dst != nullptr) {
+            if (capacity < 3) return NP_ERROR_INVALID_FORMAT;
+            capacity -= 3;
+            *dst++ = static_cast<std::uint8_t>(bits >> 16);
+            *dst++ = static_cast<std::uint8_t>(bits >> 8);
+            *dst++ = static_cast<std::uint8_t>(bits);
+        }
+        decoded += 3;
+        src += 4;
+        length -= 4;
+    }
+    if (padded && length != 4) return NP_ERROR_INVALID_FORMAT;
+    Base64Block block {};
+    const int result = DecodeLastBlock(src, length, alphabet, &block);
+    if (result < 0) return result;
+    if (dst != nullptr) {
+        if (capacity < static_cast<std::size_t>(block.bytes)) return NP_ERROR_INVALID_FORMAT;
+        for (int i = 0; i < block.bytes; ++i) dst[i] = static_cast<std::uint8_t>(block.bits >> (16 - 8 * i));
+    }
+    return decoded + block.bytes;
+}
+
+int Base64Encode(const std::uint8_t* src, char* dst, std::size_t length, const char* alphabet, bool padded) {
+    char* out = dst;
+    for (; length >= 3; length -= 3, src += 3) {
+        const std::uint32_t bits = (src[0] << 16) | (src[1] << 8) | src[2];
+        for (int shift = 18; shift >= 0; shift -= 6) *out++ = alphabet[(bits >> shift) & 0x3F];
+    }
+    if (length != 0) {
+        const std::uint32_t bits = (src[0] << 16) | (length == 2 ? src[1] << 8 : 0);
+        *out++ = alphabet[(bits >> 18) & 0x3F];
+        *out++ = alphabet[(bits >> 12) & 0x3F];
+        if (length == 2) *out++ = alphabet[(bits >> 6) & 0x3F];
+        if (padded) {
+            if (length == 1) *out++ = BASE64_PAD;
+            *out++ = BASE64_PAD;
+        }
+    }
+    return static_cast<int>(out - dst);
+}
+
+int HexValue(char c) {
+    if (c >= '0' && c <= '9') return c - '0';
+    if (c >= 'a' && c <= 'f') return c - 'a' + 10;
+    if (c >= 'A' && c <= 'F') return c - 'A' + 10;
+    return -1;
+}
+
+char HexDigit(std::uint32_t value, bool uppercase) {
+    if (value < 10) return static_cast<char>('0' + value);
+    return static_cast<char>((uppercase ? 'A' : 'a') + value - 10);
+}
+
+int ParseHex(const char* hex, std::size_t length, std::uint8_t* out, std::size_t capacity) {
+    if ((length & 1) != 0) return NP_ERROR_INVALID_ARGUMENT;
+    if (capacity < length / 2) return NP_ERROR_BUFFER_TOO_SMALL;
+    for (std::size_t i = 0; i < length; i += 2) {
+        const int high = HexValue(hex[i]);
+        const int low = HexValue(hex[i + 1]);
+        if (high < 0 || low < 0) return NP_ERROR_INVALID_ARGUMENT;
+        out[i / 2] = static_cast<std::uint8_t>((high << 4) | low);
+    }
+    return 0;
+}
+
+int FormatInteger(char* buf, std::size_t size, std::uint64_t magnitude, char sign, std::uint32_t radix,
+    std::uint32_t flags, std::size_t* length) {
+    if (radix < 1 || radix > NP_RADIX_MAX) return NP_ERROR_INVALID_ARGUMENT;
+    char prefix[3] = {};
+    std::size_t prefixLength = 0;
+    if (sign != '\0') prefix[prefixLength++] = sign;
+    if ((flags & NP_FORMAT_PREFIX) != 0 && (radix == 8 || radix == 16)) {
+        prefix[prefixLength++] = '0';
+        if (radix == 16) prefix[prefixLength++] = (flags & NP_FORMAT_UPPERCASE) != 0 ? 'X' : 'x';
+    }
+    std::size_t digits = 1;
+    if (radix > 1) {
+        for (std::uint64_t rest = magnitude; rest >= radix; rest /= radix) ++digits;
+    }
+    if (buf != nullptr) {
+        if (size < prefixLength + digits + 1) return NP_ERROR_BUFFER_TOO_SMALL;
+        std::memcpy(buf, prefix, prefixLength);
+        char* end = buf + prefixLength + digits;
+        *end = '\0';
+        std::uint64_t rest = magnitude;
+        for (std::size_t i = 0; i < digits; ++i) {
+            *--end = HexDigit(static_cast<std::uint32_t>(rest % radix), (flags & NP_FORMAT_UPPERCASE) != 0);
+            rest /= radix;
+        }
+    }
+    if (length != nullptr) *length = prefixLength + digits;
+    return 0;
+}
+
+std::uint64_t Magnitude(std::int64_t value) {
+    return value < 0 ? 0 - static_cast<std::uint64_t>(value) : static_cast<std::uint64_t>(value);
+}
+
+char PlusSign(bool positive, std::uint32_t flags) {
+    return positive && (flags & NP_FORMAT_SIGN) != 0 ? '+' : '\0';
+}
+
+template <typename Parse>
+int ParseInteger(const char* str, std::size_t* parsedLength, Parse parse, bool* saturated) {
+    char* end = nullptr;
+    errno = 0;
+    parse(str, &end);
+    if (end == str) return NP_ERROR_OUT_OF_RANGE;
+    if (*saturated && errno == ERANGE) return NP_ERROR_OUT_OF_RANGE;
+    if (parsedLength != nullptr) *parsedLength = static_cast<std::size_t>(end - str);
+    return 0;
+}
+
+int CopyToBuffer(char* dst, std::size_t size, const char* src, std::size_t length) {
+    if (size < length + 1) return NP_ERROR_BUFFER_TOO_SMALL;
+    std::strncpy(dst, src, size - 1);
+    dst[size - 1] = '\0';
+    return 0;
+}
+
+constexpr int NP_UTIL_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550601);
+constexpr int NP_UTIL_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80550602);
+constexpr int NP_UTIL_ERROR_INVALID_CHARACTER = static_cast<int>(0x80550608);
+constexpr std::size_t JSON_ESCAPE_MARGIN = 7;
+constexpr std::size_t JSON_UNICODE_ESCAPE_LENGTH = 6;
+constexpr std::size_t JSON_SURROGATE_PAIR_LENGTH = 12;
+constexpr std::uint32_t SURROGATE_MASK = 0xFC00;
+constexpr std::uint32_t HIGH_SURROGATE = 0xD800;
+constexpr std::uint32_t LOW_SURROGATE = 0xDC00;
+constexpr char URL_HEX_DIGITS[] = "0123456789ABCDEF";
+
+const char* JsonShortEscape(unsigned char c) {
+    switch (c) {
+    case '\b': return "\\b";
+    case '\t': return "\\t";
+    case '\n': return "\\n";
+    case '\f': return "\\f";
+    case '\r': return "\\r";
+    case '"': return "\\\"";
+    case '/': return "\\/";
+    case '\\': return "\\\\";
+    default: return nullptr;
+    }
+}
+
+char JsonShortUnescape(char c) {
+    switch (c) {
+    case '"': return '"';
+    case '\\': return '\\';
+    case '/': return '/';
+    case 'b': return '\b';
+    case 'f': return '\f';
+    case 'n': return '\n';
+    case 'r': return '\r';
+    case 't': return '\t';
+    default: return '\0';
+    }
+}
+
+int ParseUtf16Unit(const char* text, std::uint32_t* unit) {
+    *unit = 0;
+    for (int i = 0; i < 4; ++i) {
+        const int value = HexValue(text[i]);
+        if (value < 0) {
+            *unit = 0;
+            return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        }
+        *unit = (*unit << 4) | static_cast<std::uint32_t>(value);
+    }
+    return 0;
+}
+
+std::size_t EncodeUtf8(std::uint32_t codePoint, char* out) {
+    if (codePoint <= 0x7F) {
+        out[0] = static_cast<char>(codePoint);
+        return 1;
+    }
+    if (codePoint <= 0x7FF) {
+        out[0] = static_cast<char>(0xC0 | (codePoint >> 6));
+        out[1] = static_cast<char>(0x80 | (codePoint & 0x3F));
+        return 2;
+    }
+    if (codePoint <= 0xFFFF) {
+        out[0] = static_cast<char>(0xE0 | (codePoint >> 12));
+        out[1] = static_cast<char>(0x80 | ((codePoint >> 6) & 0x3F));
+        out[2] = static_cast<char>(0x80 | (codePoint & 0x3F));
+        return 3;
+    }
+    out[0] = static_cast<char>(0xF0 | (codePoint >> 18));
+    out[1] = static_cast<char>(0x80 | ((codePoint >> 12) & 0x3F));
+    out[2] = static_cast<char>(0x80 | ((codePoint >> 6) & 0x3F));
+    out[3] = static_cast<char>(0x80 | (codePoint & 0x3F));
+    return 4;
+}
+
+std::uint32_t CombineSurrogates(std::uint32_t high, std::uint32_t low) {
+    return 0x10000 + (((high & 0x3FF) << 10) | (low & 0x3FF));
+}
+
+bool IsContinuation(char c) {
+    return (static_cast<unsigned char>(c) & 0xC0) == 0x80;
+}
+
+std::size_t Utf8SequenceLength(unsigned char lead) {
+    if (lead >= 0xC2 && lead <= 0xDF) return 2;
+    if ((lead & 0xF0) == 0xE0) return 3;
+    if ((lead & 0xF8) == 0xF0) return 4;
+    return 0;
+}
+
+bool IsValidSequence(const char* text, std::size_t length) {
+    for (std::size_t i = 1; i < length; ++i) {
+        if (!IsContinuation(text[i])) return false;
+    }
+    return true;
+}
+
+bool IsAllowedTextByte(unsigned char c) {
+    return (c >= 0x20 && c != 0x7F) || c == '\t' || c == '\n' || c == '\r';
+}
+
+bool IsUrlSafe(unsigned char c) {
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.'
+        || c == '*';
+}
+
+} // namespace
+
+extern "C" {
+
+int APS5_VABI sceNpBase64GetDecodeSize(const char* src, std::size_t length) {
+    return Base64Decode(src, length, nullptr, 0, BASE64_ALPHABET, true);
+}
+
+int APS5_VABI sceNpBase64Decoder(const char* src, std::size_t length, void* dst, std::size_t capacity) {
+    return Base64Decode(src, length, static_cast<std::uint8_t*>(dst), capacity, BASE64_ALPHABET, true);
+}
+
+int APS5_VABI sceNpBase64Encoder(const void* src, char* dst, std::size_t length) {
+    return Base64Encode(static_cast<const std::uint8_t*>(src), dst, length, BASE64_ALPHABET, true);
+}
+
+int APS5_VABI sceNpBase64UrlGetDecodeSize(const char* src, std::size_t length) {
+    return Base64Decode(src, length, nullptr, 0, BASE64URL_ALPHABET, false);
+}
+
+int APS5_VABI sceNpBase64UrlDecoder(const char* src, std::size_t length, void* dst, std::size_t capacity) {
+    return Base64Decode(src, length, static_cast<std::uint8_t*>(dst), capacity, BASE64URL_ALPHABET, false);
+}
+
+int APS5_VABI sceNpBase64UrlEncoder(const void* src, char* dst, std::size_t length) {
+    return Base64Encode(static_cast<const std::uint8_t*>(src), dst, length, BASE64URL_ALPHABET, false);
+}
+
+int APS5_VABI sceNpHexToInt(int c) {
+    return HexValue(static_cast<char>(c));
+}
+
+int APS5_VABI sceNpIntToHex(std::uint32_t value, bool uppercase) {
+    return HexDigit(value, uppercase);
+}
+
+int APS5_VABI sceNpUInt32ToStr(char* buf, std::size_t size, std::uint32_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    return FormatInteger(buf, size, value, PlusSign(value != 0, flags), radix, flags, length);
+}
+
+int APS5_VABI sceNpUInt64ToStr(char* buf, std::size_t size, std::uint64_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    return FormatInteger(buf, size, value, PlusSign(value != 0, flags), radix, flags, length);
+}
+
+int APS5_VABI sceNpInt32ToStr(char* buf, std::size_t size, std::int32_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    const char sign = value < 0 ? '-' : PlusSign(value > 0, flags);
+    return FormatInteger(buf, size, Magnitude(value), sign, radix, flags, length);
+}
+
+int APS5_VABI sceNpInt64ToStr(char* buf, std::size_t size, std::int64_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    const char sign = (flags & NP_FORMAT_SIGN) == 0 ? '\0' : value < 0 ? '-' : PlusSign(value > 0, flags);
+    return FormatInteger(buf, size, Magnitude(value), sign, radix, flags, length);
+}
+
+int APS5_VABI sceNpStrToInt32(const char* str, std::int32_t* value, int base, std::size_t* parsedLength) {
+    long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoll(s, end, base);
+        saturated = parsed == LLONG_MIN || parsed == LLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    if (parsed != static_cast<std::int32_t>(parsed)) return NP_ERROR_OUT_OF_RANGE;
+    *value = static_cast<std::int32_t>(parsed);
+    return 0;
+}
+
+int APS5_VABI sceNpStrToInt64(const char* str, std::int64_t* value, int base, std::size_t* parsedLength) {
+    long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoll(s, end, base);
+        saturated = parsed == LLONG_MIN || parsed == LLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    *value = parsed;
+    return 0;
+}
+
+int APS5_VABI sceNpStrToUInt32(const char* str, std::uint32_t* value, int base, std::size_t* parsedLength) {
+    unsigned long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoull(s, end, base);
+        saturated = parsed == ULLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    if ((parsed >> 32) != 0) return NP_ERROR_OUT_OF_RANGE;
+    *value = static_cast<std::uint32_t>(parsed);
+    return 0;
+}
+
+int APS5_VABI sceNpStrToUInt64(const char* str, std::uint64_t* value, int base, std::size_t* parsedLength) {
+    unsigned long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoull(s, end, base);
+        saturated = parsed == ULLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    *value = parsed;
+    return 0;
+}
+
+int APS5_VABI sceNpStrBuildHex(char* dst, std::size_t size, const void* src, std::size_t length, bool uppercase) {
+    if (size <= length * 2) return NP_ERROR_BUFFER_TOO_SMALL;
+    const auto* bytes = static_cast<const std::uint8_t*>(src);
+    for (std::size_t i = 0; i < length; ++i) {
+        dst[i * 2] = HexDigit(bytes[i] >> 4, uppercase);
+        dst[i * 2 + 1] = HexDigit(bytes[i] & 0xF, uppercase);
+    }
+    dst[length * 2] = '\0';
+    return 0;
+}
+
+int APS5_VABI sceNpStrParseHex(const char* hex, void* out, std::size_t capacity) {
+    return ParseHex(hex, std::strlen(hex), static_cast<std::uint8_t*>(out), capacity);
+}
+
+int APS5_VABI sceNpStrnParseHex(const char* hex, std::size_t length, void* out, std::size_t capacity) {
+    return ParseHex(hex, length, static_cast<std::uint8_t*>(out), capacity);
+}
+
+int APS5_VABI sceNpStrcpyToBuf(char* dst, std::size_t size, const char* src) {
+    return CopyToBuffer(dst, size, src, std::strlen(src));
+}
+
+int APS5_VABI sceNpStrncpyToBuf(char* dst, std::size_t size, const char* src, std::size_t maxLength) {
+    return CopyToBuffer(dst, size, src, strnlen(src, maxLength));
+}
+
+int APS5_VABI sceNpUtilJsonEscape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength) {
+    if (dst == nullptr || dstSize == 0 || src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dstSize < JSON_ESCAPE_MARGIN) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    std::size_t written = 0;
+    for (std::size_t i = 0; i < srcLength; ++i) {
+        if (written > dstSize - JSON_ESCAPE_MARGIN) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        const auto c = static_cast<unsigned char>(src[i]);
+        if (c == 0) return 0;
+        char piece[JSON_ESCAPE_MARGIN] = {};
+        if (const char* escape = JsonShortEscape(c)) {
+            std::strcpy(piece, escape);
+        } else if (c >= 0x20 && c != 0x7F) {
+            piece[0] = static_cast<char>(c);
+        } else {
+            std::snprintf(piece, sizeof(piece), "\\u%04x", c);
+        }
+        std::strcat(dst, piece);
+        written += std::strlen(piece);
+    }
+    return 0;
+}
+
+int APS5_VABI sceNpUtilJsonUnescape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength,
+    std::size_t* dstLength) {
+    if (src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dst == nullptr && dstLength == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    const char* end = src + srcLength;
+    std::size_t count = 0;
+    int status = 0;
+    char* out = dst;
+    auto emit = [&](const char* bytes, std::size_t length, std::size_t consumed) {
+        if (out != nullptr) {
+            std::memcpy(out, bytes, length);
+            out += length;
+        }
+        count += length;
+        src += consumed;
+    };
+    while (src < end) {
+        if (dst != nullptr && count + 1 > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        const std::size_t remaining = static_cast<std::size_t>(end - src);
+        if (src[0] != '\\' || remaining < 2) {
+            emit(src, 1, 1);
+            continue;
+        }
+        if (const char simple = JsonShortUnescape(src[1])) {
+            emit(&simple, 1, 2);
+            continue;
+        }
+        if (src[1] != 'u' || remaining < JSON_UNICODE_ESCAPE_LENGTH) {
+            emit(src, 1, 1);
+            continue;
+        }
+        std::uint32_t unit = 0;
+        int result = ParseUtf16Unit(src + 2, &unit);
+        if (result < 0) {
+            status = result;
+            emit(src, 1, 1);
+            continue;
+        }
+        status = 0;
+        char encoded[4] = {};
+        if ((unit & SURROGATE_MASK) != HIGH_SURROGATE) {
+            const std::size_t length = EncodeUtf8(unit, encoded);
+            if (dst != nullptr && count + length > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+            emit(encoded, length, JSON_UNICODE_ESCAPE_LENGTH);
+            continue;
+        }
+        std::uint32_t low = 0;
+        if (remaining < JSON_SURROGATE_PAIR_LENGTH || src[6] != '\\' || src[7] != 'u') {
+            emit(src, 1, 1);
+            continue;
+        }
+        result = ParseUtf16Unit(src + 8, &low);
+        if (result < 0) {
+            status = result;
+            emit(src, 1, 1);
+            continue;
+        }
+        if ((low & SURROGATE_MASK) != LOW_SURROGATE) {
+            emit(src, 1, 1);
+            continue;
+        }
+        const std::size_t length = EncodeUtf8(CombineSurrogates(unit, low), encoded);
+        if (dst != nullptr && count + length > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        emit(encoded, length, JSON_SURROGATE_PAIR_LENGTH);
+    }
+    ++count;
+    if (count > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (dstLength != nullptr) *dstLength = count;
+    if (out != nullptr) *out = '\0';
+    return status;
+}
+
+int APS5_VABI sceNpUtilJsonGetOneChar(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength,
+    std::size_t* dstLength, std::size_t* consumed) {
+    if (src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dst == nullptr && dstLength == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    std::size_t decoded = 1;
+    std::size_t used = 1;
+    int status = 0;
+    char encoded[4] = {};
+    const auto lead = static_cast<unsigned char>(src[0]);
+    if (lead == '\\') {
+        used = 2;
+        if (srcLength < 2) {
+            status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        } else if (const char simple = JsonShortUnescape(src[1])) {
+            encoded[0] = simple;
+        } else if (src[1] != 'u') {
+            used = 1;
+            encoded[0] = '\\';
+        } else {
+            used = JSON_UNICODE_ESCAPE_LENGTH;
+            std::uint32_t unit = 0;
+            if (srcLength < JSON_UNICODE_ESCAPE_LENGTH || ParseUtf16Unit(src + 2, &unit) < 0) {
+                status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+            } else if ((unit & SURROGATE_MASK) != HIGH_SURROGATE) {
+                decoded = EncodeUtf8(unit, encoded);
+            } else {
+                used = JSON_SURROGATE_PAIR_LENGTH;
+                std::uint32_t low = 0;
+                if (srcLength < JSON_SURROGATE_PAIR_LENGTH || ParseUtf16Unit(src + 8, &low) < 0
+                    || (low & SURROGATE_MASK) != LOW_SURROGATE) {
+                    status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+                } else {
+                    decoded = EncodeUtf8(CombineSurrogates(unit, low), encoded);
+                }
+            }
+        }
+    } else if (const std::size_t length = Utf8SequenceLength(lead); length != 0 && srcLength < length) {
+        decoded = 0;
+        used = length;
+        status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    } else if (length != 0 && IsValidSequence(src, length)) {
+        decoded = length;
+        used = length;
+        std::memcpy(encoded, src, length);
+    } else {
+        encoded[0] = src[0];
+    }
+    if (status == 0 && dst != nullptr && dstSize < decoded) status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (status == 0 && dst != nullptr) std::memcpy(dst, encoded, decoded);
+    if (dstLength != nullptr) *dstLength = decoded;
+    if (consumed != nullptr) *consumed = used;
+    return status;
+}
+
+int APS5_VABI sceNpUtilGetNthChar(std::size_t index, const char* text, const char** character) {
+    if (text == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    const char* position = text;
+    for (std::size_t i = 0; i < index && *position != '\0'; ++i) {
+        const auto lead = static_cast<unsigned char>(*position);
+        std::size_t length = 1;
+        if (lead < 0x80) {
+            if (!IsAllowedTextByte(lead)) return NP_UTIL_ERROR_INVALID_CHARACTER;
+        } else {
+            length = Utf8SequenceLength(lead);
+            if (length == 0 || !IsValidSequence(position, length)) return NP_UTIL_ERROR_INVALID_CHARACTER;
+        }
+        position += length;
+    }
+    *character = position;
+    return 0;
+}
+
+int APS5_VABI sceNpUtilHttpUrlEncode(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength,
+    std::size_t* dstLength) {
+    if (src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dst == nullptr && dstLength == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    std::size_t count = 0;
+    for (std::size_t i = 0; i < srcLength; ++i) {
+        const auto c = static_cast<unsigned char>(src[i]);
+        const bool escaped = c != ' ' && !IsUrlSafe(c);
+        const std::size_t length = escaped ? 3 : 1;
+        if (dst != nullptr && count + length > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        if (dst != nullptr) {
+            if (escaped) {
+                dst[count] = '%';
+                dst[count + 1] = URL_HEX_DIGITS[c >> 4];
+                dst[count + 2] = URL_HEX_DIGITS[c & 0xF];
+            } else {
+                dst[count] = c == ' ' ? '+' : static_cast<char>(c);
+            }
+        }
+        count += length;
+    }
+    if (dst != nullptr && count + 1 > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (dst != nullptr) dst[count] = '\0';
+    if (dstLength != nullptr) *dstLength = count + 1;
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libSceNpCommon/include/Api.hpp b/core/libs/prx/libSceNpCommon/include/Api.hpp
new file mode 100644
index 0000000000..d4c373e182
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/include/Api.hpp
@@ -0,0 +1,222 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpAllocator {
+    void* (APS5_VABI *allocate)(std::size_t size, void* context);
+    void* (APS5_VABI *reallocate)(void* pointer, std::size_t size, void* context);
+    void (APS5_VABI *release)(void* pointer, void* context);
+    void* context;
+};
+
+struct NpAllocatorEx {
+    NpAllocator allocator;
+    int outOfMemoryError;
+};
+
+struct NpCallout {
+    NpCallout* next;
+    void (APS5_VABI *handler)(void* arg);
+    std::uint64_t deadline;
+    void* arg;
+    std::uint64_t reserved;
+};
+
+struct NpCalloutContext {
+    Pthread thread;
+    PthreadMutex mutex;
+    PthreadCond cond;
+    int initialized;
+    int stopping;
+    NpCallout* pending;
+};
+
+struct NpHeap {
+    void* mspace;
+};
+
+struct NpHeapStat {
+    std::uint64_t maxSystemSize;
+    std::uint64_t maxInuseSize;
+    std::uint64_t currentInuseSize;
+};
+
+struct NpIdFull {
+    NpOnlineId handle;
+    std::uint8_t opt[8];
+    std::uint8_t reserved[8];
+};
+
+struct NpKernelMemory {
+    std::uint64_t size;
+    std::uint64_t reserved;
+    void* address;
+};
+
+struct NpMemoryHeap {
+    NpKernelMemory memory;
+    NpHeap heap;
+};
+
+struct NpTitleIdParts {
+    char id[9];
+    char reserved;
+    std::uint8_t index;
+};
+
+extern "C" {
+
+int APS5_VABI sceNpCmpOnlineId(const NpOnlineId* onlineId1, const NpOnlineId* onlineId2);
+int APS5_VABI sceNpCmpNpIdInOrder(const NpIdFull* npId1, const NpIdFull* npId2, std::int32_t* order);
+int APS5_VABI sceNpGetPlatformType(const NpIdFull* npId);
+int APS5_VABI sceNpIntIsValidOnlineId(const NpOnlineId* onlineId);
+int APS5_VABI sceNpMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags);
+int APS5_VABI sceNpMutexDestroy(PthreadMutex* mutex);
+int APS5_VABI sceNpMutexLock(PthreadMutex* mutex);
+int APS5_VABI sceNpMutexTryLock(PthreadMutex* mutex);
+int APS5_VABI sceNpMutexUnlock(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags);
+int APS5_VABI sceNpLwMutexDestroy(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexLock(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexTryLock(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexUnlock(PthreadMutex* mutex);
+int APS5_VABI sceNpCondInit(PthreadCond* cond, const char* name, std::uint64_t);
+int APS5_VABI sceNpCondDestroy(PthreadCond* cond);
+int APS5_VABI sceNpCondSignal(PthreadCond* cond);
+int APS5_VABI sceNpCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, std::uint32_t usec);
+int APS5_VABI sceNpJoinThread(Pthread thread, void** retval);
+int APS5_VABI sceNpGetSystemClockUsec(std::int64_t* usec);
+void APS5_VABI sceNpGetSdkVersion(char* version);
+int APS5_VABI sceNpCloseSema(void);
+int APS5_VABI sceNpGetNavSdkVersion(void);
+int APS5_VABI sceNpIntGetPlatformType(void);
+int APS5_VABI sceNpIntSetPlatformType(void);
+int APS5_VABI sceNpJsonParse(void);
+int APS5_VABI sceNpJsonParseBuf(void);
+int APS5_VABI sceNpJsonParseBufInit(void);
+int APS5_VABI sceNpJsonParseEx(void);
+int APS5_VABI sceNpJsonParseExInit(void);
+int APS5_VABI sceNpJsonParseInit(void);
+int APS5_VABI sceNpOpenSema(void);
+int APS5_VABI sceNpServerErrorJsonGetErrorCode(void);
+int APS5_VABI sceNpServerErrorJsonMultiGetErrorCode(void);
+int APS5_VABI sceNpServerErrorJsonParse(void);
+int APS5_VABI sceNpServerErrorJsonParseInit(void);
+int APS5_VABI sceNpServerErrorJsonParseMultiInit(void);
+int APS5_VABI sceNpSetPlatformType(void);
+int APS5_VABI sceNpUtilCanonicalizeNpIdForPs4(void);
+int APS5_VABI sceNpUtilCanonicalizeNpIdForPsp2(void);
+int APS5_VABI sceNpUtilGetDateSetAuto(void);
+int APS5_VABI sceNpUtilGetDbgCommerce(void);
+int APS5_VABI sceNpUtilGetEnv(void);
+int APS5_VABI sceNpUtilGetFakeDisplayNameMode(void);
+int APS5_VABI sceNpUtilGetFakeRateLimit(void);
+int APS5_VABI sceNpUtilGetIgnoreNpTitleId(void);
+int APS5_VABI sceNpUtilGetNpDebug(void);
+int APS5_VABI sceNpUtilGetNpTestPatch(void);
+int APS5_VABI sceNpUtilGetShareTitleCheck(void);
+int APS5_VABI sceNpUtilGetSystemLanguage(void);
+int APS5_VABI sceNpUtilGetTrcNotify(void);
+int APS5_VABI sceNpUtilGetWebApi2FakeRateLimit(void);
+int APS5_VABI sceNpUtilGetWebApi2FakeRateLimitTarget(void);
+int APS5_VABI sceNpUtilGetWebTraceSetting(void);
+int APS5_VABI sceNpUtilJidToNpId(void);
+int APS5_VABI sceNpAtomicCas32(std::int32_t* value, std::int32_t expected, std::int32_t desired);
+int APS5_VABI sceNpAtomicInc32(std::int32_t* value);
+int APS5_VABI sceNpAtomicDec32(std::int32_t* value);
+int APS5_VABI sceNpCondSignalAll(PthreadCond* cond);
+int APS5_VABI sceNpCondSignalTo(PthreadCond* cond, Pthread thread);
+int APS5_VABI sceNpCondWait(PthreadCond* cond, PthreadMutex* mutex);
+int APS5_VABI sceNpLwCondInit(PthreadCond* cond, const char* name);
+int APS5_VABI sceNpLwCondDestroy(PthreadCond* cond);
+int APS5_VABI sceNpLwCondSignal(PthreadCond* cond);
+int APS5_VABI sceNpLwCondSignalAll(PthreadCond* cond);
+int APS5_VABI sceNpLwCondSignalTo(PthreadCond* cond, Pthread thread);
+int APS5_VABI sceNpLwCondWait(PthreadCond* cond, PthreadMutex* mutex);
+int APS5_VABI sceNpCreateEventFlag(KernelEventFlag* flag, const char* name, std::uint32_t attr, std::uint64_t pattern);
+int APS5_VABI sceNpDeleteEventFlag(KernelEventFlag flag);
+int APS5_VABI sceNpOpenEventFlag(KernelEventFlag* flag, const char* name);
+int APS5_VABI sceNpCloseEventFlag(KernelEventFlag flag);
+int APS5_VABI sceNpSetEventFlag(KernelEventFlag flag, std::uint64_t pattern);
+int APS5_VABI sceNpClearEventFlag(KernelEventFlag flag, std::uint64_t pattern);
+int APS5_VABI sceNpPollEventFlag(KernelEventFlag flag, std::uint64_t pattern, std::uint32_t mode, std::uint64_t* result);
+int APS5_VABI sceNpCancelEventFlag(KernelEventFlag flag, std::uint64_t pattern, int* waiting);
+int APS5_VABI sceNpCreateSema(KernelSema* sema, std::uint32_t flags, int initial, int maximum, const char* name);
+int APS5_VABI sceNpDeleteSema(KernelSema sema);
+int APS5_VABI sceNpPollSema(KernelSema sema);
+int APS5_VABI sceNpSignalSema(KernelSema sema);
+int APS5_VABI sceNpCreateThread(Pthread* thread, PthreadEntry entry, void* arg, int priority, std::size_t stackSize, KernelCpumask affinity, const char* name);
+int APS5_VABI sceNpThreadGetId(Pthread* thread);
+int APS5_VABI sceNpGetProcessId(void);
+int APS5_VABI sceNpDbgDumpText(const char* text, int length);
+int APS5_VABI sceNpIpc2ClientInit(void);
+int APS5_VABI sceNpIpc2ClientTerm(void);
+int APS5_VABI sceNpArchInit(void);
+void APS5_VABI sceNpArchTerm(void);
+int APS5_VABI sceNpHeapInit(NpHeap* heap, void* base, std::size_t size, const char* name);
+void APS5_VABI sceNpHeapDestroy(NpHeap* heap);
+void APS5_VABI sceNpHeapGetAllocator(NpHeap* heap, NpAllocator* allocator);
+int APS5_VABI sceNpHeapGetStat(const NpHeap* heap, NpHeapStat* stat);
+void APS5_VABI sceNpHeapShowStat(const NpHeap* heap);
+int APS5_VABI sceNpMemoryHeapInit(NpMemoryHeap* heap, std::uint64_t size, const char* name);
+void APS5_VABI sceNpMemoryHeapDestroy(NpMemoryHeap* heap);
+void APS5_VABI sceNpMemoryHeapGetAllocator(NpMemoryHeap* heap, NpAllocator* allocator);
+void APS5_VABI sceNpMemoryHeapGetAllocatorEx(NpMemoryHeap* heap, int outOfMemoryError, NpAllocatorEx* allocator);
+void APS5_VABI sceNpGlobalHeapGetAllocator(NpAllocator* allocator);
+void APS5_VABI sceNpGlobalHeapGetAllocatorEx(NpAllocatorEx* allocator);
+NpAllocator* APS5_VABI sceNpGlobalHeapGetAllocatorPtr(void);
+NpAllocatorEx* APS5_VABI sceNpGlobalHeapGetAllocatorExPtr(void);
+int APS5_VABI sceNpAllocateKernelMemoryNoAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory);
+int APS5_VABI sceNpAllocateKernelMemoryWithAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory);
+int APS5_VABI sceNpFreeKernelMemory(NpKernelMemory* memory);
+void APS5_VABI sceNpGetSdkVersionUInt(std::uint32_t* version);
+int APS5_VABI sceNpRtcConvertToPosixTime(const RtcTick* tick, std::int64_t* seconds);
+int APS5_VABI sceNpRtcFormatRFC3339(char* text, std::size_t size, const RtcTick* utc, int timeZoneMinutes);
+int APS5_VABI sceNpUserGetUserIdList(int* users, std::size_t capacity, int* count);
+int APS5_VABI sceNpRtcParseRFC3339(RtcTick* utc, const char* text);
+int APS5_VABI sceNpCalloutInitCtx(NpCalloutContext* context, const char* name, std::size_t stackSize, int priority, KernelCpumask affinity);
+void APS5_VABI sceNpCalloutTermCtx(NpCalloutContext* context);
+int APS5_VABI sceNpCalloutStartOnCtx64(NpCalloutContext* context, NpCallout* callout, std::uint64_t usec, void (APS5_VABI *handler)(void* arg), void* arg);
+int APS5_VABI sceNpCalloutStartOnCtx(NpCalloutContext* context, NpCallout* callout, std::uint32_t usec, void (APS5_VABI *handler)(void* arg), void* arg);
+int APS5_VABI sceNpCalloutStopOnCtx(NpCalloutContext* context, NpCallout* callout, int* wasPending);
+std::uint32_t APS5_VABI sceNpGetRandom(void);
+int APS5_VABI sceNpUtilCmpAccountId(std::uint64_t left, std::uint64_t right);
+int APS5_VABI sceNpCmpNpId(const void* npId1, const void* npId2);
+bool APS5_VABI sceNpIntIsOnlineIdString(const char* text);
+int APS5_VABI sceNpUtilGetNpLanguageCode(int language, char* code);
+int APS5_VABI sceNpUtilGetNpLanguageCode2(int language, char* tag);
+const char* APS5_VABI sceNpUtilGetNpLanguageCodeStr(int language);
+const char* APS5_VABI sceNpUtilGetNpLanguageCode2Str(int language);
+std::uint32_t APS5_VABI sceNpDbgAssignDebugId(void);
+int APS5_VABI sceNpUtilBuildTitleId(const NpTitleIdParts* parts, char* titleId, std::size_t size);
+void APS5_VABI sceNpDbgDumpBinary(const void* data, std::size_t size);
+int APS5_VABI sceNpBase64GetDecodeSize(const char* src, std::size_t length);
+int APS5_VABI sceNpBase64Decoder(const char* src, std::size_t length, void* dst, std::size_t capacity);
+int APS5_VABI sceNpBase64Encoder(const void* src, char* dst, std::size_t length);
+int APS5_VABI sceNpBase64UrlGetDecodeSize(const char* src, std::size_t length);
+int APS5_VABI sceNpBase64UrlDecoder(const char* src, std::size_t length, void* dst, std::size_t capacity);
+int APS5_VABI sceNpBase64UrlEncoder(const void* src, char* dst, std::size_t length);
+int APS5_VABI sceNpHexToInt(int c);
+int APS5_VABI sceNpIntToHex(std::uint32_t value, bool uppercase);
+int APS5_VABI sceNpUInt32ToStr(char* buf, std::size_t size, std::uint32_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpUInt64ToStr(char* buf, std::size_t size, std::uint64_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpInt32ToStr(char* buf, std::size_t size, std::int32_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpInt64ToStr(char* buf, std::size_t size, std::int64_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpStrToInt32(const char* str, std::int32_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrToInt64(const char* str, std::int64_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrToUInt32(const char* str, std::uint32_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrToUInt64(const char* str, std::uint64_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrBuildHex(char* dst, std::size_t size, const void* src, std::size_t length, bool uppercase);
+int APS5_VABI sceNpStrParseHex(const char* hex, void* out, std::size_t capacity);
+int APS5_VABI sceNpStrnParseHex(const char* hex, std::size_t length, void* out, std::size_t capacity);
+int APS5_VABI sceNpStrcpyToBuf(char* dst, std::size_t size, const char* src);
+int APS5_VABI sceNpStrncpyToBuf(char* dst, std::size_t size, const char* src, std::size_t maxLength);
+int APS5_VABI sceNpUtilJsonEscape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength);
+int APS5_VABI sceNpUtilJsonUnescape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength, std::size_t* dstLength);
+int APS5_VABI sceNpUtilJsonGetOneChar(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength, std::size_t* dstLength, std::size_t* consumed);
+int APS5_VABI sceNpUtilGetNthChar(std::size_t index, const char* text, const char** character);
+int APS5_VABI sceNpUtilHttpUrlEncode(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength, std::size_t* dstLength);
+
+[[noreturn]] void APS5_VABI sceNpPanic(void);
+
+}
diff --git a/core/libs/prx/libSceNpCommon/libSceNpCommon.hpp b/core/libs/prx/libSceNpCommon/libSceNpCommon.hpp
new file mode 100644
index 0000000000..baf8782fd4
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/libSceNpCommon.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpCommon/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpCppWebApi/Export.cpp b/core/libs/prx/libSceNpCppWebApi/Export.cpp
index c8eec1ea1a..bf1e1383dc 100644
--- a/core/libs/prx/libSceNpCppWebApi/Export.cpp
+++ b/core/libs/prx/libSceNpCppWebApi/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -202,16 +203,55 @@ int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi12downloadDataEi
  return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData10initializeEPNS1_6Common10LibContextEPKci() {
- return 0;
+static constexpr int ParameterNotInitialized = static_cast<int>(0x80553502);
+static constexpr int ParameterInvalidArgument = static_cast<int>(0x80553503);
+static constexpr int ParameterAlreadyInitialized = static_cast<int>(0x8055350f);
+static constexpr int ParameterTerminatedUninitialized = static_cast<int>(0x80553510);
+
+struct ParameterObject {
+    void* base;
+    const void* implementation;
+};
+
+static constexpr unsigned char ParameterImplementation = 0;
+
+static void ConstructParameter(void* self) {
+    *static_cast<ParameterObject*>(self) = {};
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData9terminateEv() {
- return 0;
+static int InitializeParameter(void* self, const std::uint64_t* context, const bool argumentsPresent) {
+    if (context == nullptr) return ParameterInvalidArgument;
+    if (*context == 0) return ParameterNotInitialized;
+    auto* parameter = static_cast<ParameterObject*>(self);
+    if (parameter->implementation != nullptr) return ParameterAlreadyInitialized;
+    if (!argumentsPresent) return ParameterInvalidArgument;
+    parameter->implementation = &ParameterImplementation;
+    return 0;
+}
+
+static int SetParameterText(const void* self, const char* text) {
+    if (static_cast<const ParameterObject*>(self)->implementation == nullptr) return ParameterNotInitialized;
+    return text == nullptr ? ParameterInvalidArgument : 0;
+}
+
+static int TerminateParameter(void* self) {
+    auto* parameter = static_cast<ParameterObject*>(self);
+    if (parameter->implementation == nullptr) return ParameterTerminatedUninitialized;
+    parameter->implementation = nullptr;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData10initializeEPNS1_6Common10LibContextEPKci(void* self, const std::uint64_t* context, const char* text, int value) {
+    (void)value;
+    return InitializeParameter(self, context, text != nullptr);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData9terminateEv(void* self) {
+    return TerminateParameter(self);
 }
 
 int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadDataC1Ev(void* self) {
-    (void)self;
+    ConstructParameter(self);
     return 0;
 }
 
@@ -272,11 +312,6 @@ int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12
     return 0;
 }
 
-struct IntrusivePtr {
-    void* object;
-    void (APS5_VABI* deleter)(void*);
-    void* libContext;
-};
 static_assert(sizeof(IntrusivePtr) == 0x18);
 
 static constexpr std::size_t ReferenceCountOffset = 0;
@@ -463,12 +498,6 @@ int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12Intrusive
     return 0;
 }
 
-struct CommonString {
-    std::int32_t referenceCount;
-    char* buffer;
-    std::uint64_t bufferSize;
-    void* libContext;
-};
 static_assert(sizeof(CommonString) == 0x20 && offsetof(CommonString, buffer) == 0x08);
 static_assert(offsetof(CommonString, bufferSize) == 0x10 && offsetof(CommonString, libContext) == 0x18);
 
@@ -896,7 +925,6 @@ static int VectorPushBackString(IntrusivePtr* self, const CommonString* element)
 // libSceNpCppWebApi.prx.
 // --------------------------------------------------------------------------
 
-
 void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
     CopyIntrusivePtr(self, source, 0x00);
 }
@@ -1487,124 +1515,102 @@ int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev(void* self) {
+    (void)self;
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev(void* self) {
+    (void)self;
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev(IntrusivePtr* self) {
+    *self = {};
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
 bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEneERKS9_(const void* self, const void* other) {
@@ -1754,28 +1760,27 @@ void* APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V59Container11getChildrenEv(
     return nullptr;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerC1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerC1Ev(void* self) {
+    ConstructParameter(self);
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer10initializeEPNS1_6Common10LibContextE() {
-    return 0;
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer10initializeEPNS1_6Common10LibContextE(void* self, const std::uint64_t* context) {
+    return InitializeParameter(self, context, true);
 }
 
 bool APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer13isInitializedEv(const void* self) {
+    return static_cast<const ParameterObject*>(self)->implementation != nullptr;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setserviceLabelEi(void* self, int serviceLabel) {
     (void)self;
-    NotImplemented_nid_no_patch(__func__);
-    return false;
-}
-
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setserviceLabelEi(void) {
-    NotImplemented_nid_no_patch(__func__);
+    (void)serviceLabel;
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9terminateEv() {
-    return 0;
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9terminateEv(void* self) {
+    return TerminateParameter(self);
 }
 
 int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerD1Ev(void* self) {
@@ -1811,33 +1816,29 @@ bool APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product9skusIsSetEv(const
     return false;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData11setobjectIdEPKc(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData11setobjectIdEPKc(void* self, const char* objectId) {
+    return SetParameterText(self, objectId);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserC1Ev(void* self) {
+    ConstructParameter(self);
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserC1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser10initializeEPNS1_6Common10LibContextEPKcSA_(void* self, const std::uint64_t* context, const char* first, const char* second) {
+    return InitializeParameter(self, context, first != nullptr && second != nullptr);
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser10initializeEPNS1_6Common10LibContextEPKcSA_(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9setfieldsEPKc(void* self, const char* fields) {
+    return SetParameterText(self, fields);
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9setfieldsEPKc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9terminateEv(void* self) {
+    return TerminateParameter(self);
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9terminateEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserD1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserD1Ev(void* self) {
+    (void)self;
     return 0;
 }
 
@@ -3047,8 +3048,8 @@ int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product16releaseDateIsSetE
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setcontainerIdsEPKc() {
-    return 0;
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setcontainerIdsEPKc(void* self, const char* containerIds) {
+    return SetParameterText(self, containerIds);
 }
 
 int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer8setlimitEi() {
diff --git a/core/libs/prx/libSceNpCppWebApi/include/Api.hpp b/core/libs/prx/libSceNpCppWebApi/include/Api.hpp
new file mode 100644
index 0000000000..6e537ea7dd
--- /dev/null
+++ b/core/libs/prx/libSceNpCppWebApi/include/Api.hpp
@@ -0,0 +1,684 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct CommonString {
+    std::int32_t referenceCount;
+    char* buffer;
+    std::uint64_t bufferSize;
+    void* libContext;
+};
+
+struct IntrusivePtr {
+    void* object;
+    void (APS5_VABI* deleter)(void*);
+    void* libContext;
+};
+
+extern "C" {
+
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V111UserFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_4UserEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody18setStartSerialRankERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody8setGroupERKNS3_5GroupE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody8setLimitERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody8setUsersERKNS1_6Common6VectorINS5_12IntrusivePtrINS3_4UserEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody9setOffsetERKi();
+void* APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122GetRankingResponseBody10getEntriesEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody10setCommentEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody12setSmallDataEPKvm();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody15setNeedsTmpRankERKb();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody19setComparedDateTimeERK10SceRtcTick();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody7setPcIdERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V128GetRankingRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_21GetRankingRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V129RecordScoreRequestBodyFactory6createEPNS1_6Common10LibContextElPNS5_12IntrusivePtrINS3_22RecordScoreRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V14User12setAccountIdERKm();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V14User7setPcIdERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi10getRankingEiRKNS4_21ParameterToGetRankingERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_22GetRankingResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRanking10initializeEPNS1_6Common10LibContextEi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRanking24setgetRankingRequestBodyENS1_6Common12IntrusivePtrINS3_21GetRankingRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRanking9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRankingC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRankingD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi22getLargeDataByObjectIdEiRKNS4_33ParameterToGetLargeDataByObjectIdERNS1_6Common21DownStreamTransactionINS8_12IntrusivePtrINS4_37GetLargeDataByObjectIdResponseHeadersEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectId10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectId9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectIdC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectIdD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi18getBoardDefinitionEiRKNS4_29ParameterToGetBoardDefinitionERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_30GetBoardDefinitionResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinition10initializeEPNS1_6Common10LibContextEi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinition9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinitionC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinitionD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi11recordScoreEiRKNS4_22ParameterToRecordScoreERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_23RecordScoreResponseBodyEEENSA_INS4_26RecordScoreResponseHeadersEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi15recordLargeDataEiRKNS4_26ParameterToRecordLargeDataERNS1_6Common19UpStreamTransactionINS8_12IntrusivePtrINS3_27RecordLargeDataResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScore10initializeEPNS1_6Common10LibContextEiNS6_12IntrusivePtrINS3_22RecordScoreRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScore22setxPsnAtomicOperationENS5_19XPsnAtomicOperationE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScore9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScoreC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScoreD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeData10initializeEPNS1_6Common10LibContextEiNS5_19XPsnAtomicOperationEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeData9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeDataC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeDataD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi12downloadDataEiRKNS4_23ParameterToDownloadDataERNS1_6Common21DownStreamTransactionINS8_12IntrusivePtrINS4_27DownloadDataResponseHeadersEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData10initializeEPNS1_6Common10LibContextEPKci(void* self, const std::uint64_t* context, const char* text, int value);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData9terminateEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadDataC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadDataD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10InitParamsC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10InitParamsD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10LibContextC1Ev(uint64_t* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10initializeERKNS2_10InitParamsERNS2_10LibContextE(const void* params, uint64_t* context);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextEm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE8sendDataEPKvm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEE8readDataEPcm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEE8readDataEPcm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(CommonString* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringD1Ev(CommonString* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V14UserEEEE8pushBackERKS8_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V14UserEEEEC1EPNS2_10LibContextE(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V14UserEEEED1Ev(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEE3endEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEE5beginEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEEppEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common9terminateERNS2_10LibContextE(uint64_t* context);
+const void* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V122GetRankingResponseBody22getLastUpdatedDateTimeEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V123RecordScoreResponseBody10getTmpRankEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V123RecordScoreResponseBody16getTmpSerialRankEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody11getSortModeEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody13getEntryLimitEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody13getUpdateModeEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody13sortModeIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody15entryLimitIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody15updateModeIsSetEv(const void* self);
+std::int64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody16getMaxScoreLimitEv(const void* self);
+std::int64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody16getMinScoreLimitEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody18maxScoreLimitIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody18minScoreLimitIsSetEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody20getLargeDataNumLimitEv(const void* self);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody21getLargeDataSizeLimitEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody22largeDataNumLimitIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody23largeDataSizeLimitIsSetEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry10getCommentEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry11getObjectIdEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry11getOnlineIdEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry12commentIsSetEv(const void* self);
+std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry12getAccountIdEv(const void* self);
+const void* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry12getSmallDataEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry13getSerialRankEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry13objectIdIsSetEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry14getHighestRankEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry14smallDataIsSetEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry20getHighestSerialRankEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry7getPcIdEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry7getRankEv(const void* self);
+std::int64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry8getScoreEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V19RecordApi26RecordScoreResponseHeaders24getXPsnAtomicOperationIdEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE11getResponseERS8_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V15EntryEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6BinaryEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEEdeEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE18getResponseHeadersERSB_();
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6Binary4sizeEv(const void* self);
+const void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common6Binary9getBinaryEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(const CommonString* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEEdeEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEEneERKS9_(const void* self, const void* other);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession16setMaxSpectatorsERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139RequestPlayerSessionMemberPlayerFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_32RequestCreatePlayerSessionPlayerEEEEEPNS9_INS3_32RequestPlayerSessionMemberPlayerEEE();
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEE3endEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayerD1Ev();
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V110FromMember11getOnlineIdEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitations26setinvitationInvalidFilterEPKc();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V151PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSessionD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V122LocalizedStringFactory6createEPNS1_6Common10LibContextEPKcNS_4Json6ObjectEPNS5_12IntrusivePtrINS3_15LocalizedStringEEE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V151PostPlayerSessionsSessionIdMemberPlayersRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEED2Ev(void* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession20setInvitableUserTypeERKNS3_17InvitableUserTypeE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEE5beginEv(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129PostPlayerSessionsRequestBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEEEdeEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V151PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi25joinPlayerSessionAsPlayerEiRKNS4_36ParameterToJoinPlayerSessionAsPlayerERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_52PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6String6appendEPKc(CommonString* self, const char* text);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15DefaultResponseC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayer9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessions10initializeEPNS1_6Common10LibContextENS6_12IntrusivePtrINS3_29PostPlayerSessionsRequestBodyEEE();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V110FromMemberEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestPlayerSessionMemberPlayerEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSessionC1Ev();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEC1Ev(IntrusivePtr* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead12getSessionIdEv(const void* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead7getFromEv(const void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129PostPlayerSessionsRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V130PostPlayerSessionsResponseBody17getPlayerSessionsEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi18leavePlayerSessionEiRKNS4_29ParameterToLeavePlayerSessionERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessionsD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi27getPlayerSessionInvitationsEiRKNS4_38ParameterToGetPlayerSessionInvitationsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_54GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestPlayerSessionMemberPlayerEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEdeEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V110FromMemberEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitationsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEppEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession19setJoinableUserTypeERKNS3_16JoinableUserTypeE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitationsD1Ev();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestPlayerSessionMemberPlayerEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead14sessionIdIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead17invitationIdIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessionsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayer10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_51PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEE();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBody16invitationsIsSetEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEEEixEm(void* self, std::uint64_t index);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSession10initializeEPNS1_6Common10LibContextEPKcSA_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEdeEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitations9setfieldsENS1_6Common12IntrusivePtrINS6_6VectorINS6_6StringEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15DefaultResponseD1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1EPS6_PFvS8_EPNS2_10LibContextE(IntrusivePtr* self, void* body, void (APS5_VABI* deleter)(void*), void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V133RequestPlayerSessionPlayerFactory6createEPNS1_6Common10LibContextEPKcS9_PNS5_12IntrusivePtrINS3_26RequestPlayerSessionPlayerEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi20createPlayerSessionsEiRKNS4_31ParameterToCreatePlayerSessionsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_30PostPlayerSessionsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayerC1Ev();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead9fromIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V126RequestPlayerSessionPlayer15setPushContextsERKNS1_6Common6VectorINS5_12IntrusivePtrINS3_24PlayerSessionPushContextEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V127RequestPlayerSessionFactory6createEPNS1_6Common10LibContextEiNS5_12IntrusivePtrINS3_32RequestPlayerSessionMemberPlayerEEERKNS5_6VectorINS5_6StringEEENS8_INS3_15LocalizedStringEEEPNS8_INS3_20RequestPlayerSessionEEE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V131PlayerSessionPushContextFactory6createEPNS1_6Common10LibContextEPKcPNS5_12IntrusivePtrINS3_24PlayerSessionPushContextEEE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129PostPlayerSessionsRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(IntrusivePtr* self, const void* element);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEneERKS9_(const void* self, const void* other);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitations10initializeEPNS1_6Common10LibContextEPKc();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBody14getInvitationsEv(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE6finishEv();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead22receivedTimestampIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE11getResponseERS4_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139RequestCreatePlayerSessionPlayerFactory6createEPNS1_6Common10LibContextEPKcS9_RKNS5_6VectorINS5_12IntrusivePtrINS3_24PlayerSessionPushContextEEEEEPNSB_INS3_32RequestCreatePlayerSessionPlayerEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEC1Ev(IntrusivePtr* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V113PlayerSession12getSessionIdEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V158PostPlayerSessionsSessionIdMemberPlayersRequestBodyFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_26RequestPlayerSessionPlayerEEEEEPNS9_INS3_51PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V136PostPlayerSessionsRequestBodyFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_20RequestPlayerSessionEEEEEPNS9_INS3_29PostPlayerSessionsRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession28setExclusiveLeaderPrivilegesERKNS1_6Common6VectorINS5_6StringEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev(IntrusivePtr* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEneERKS9_(const void* self, const void* other);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEdeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEppEv(void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEEneERKS9_(const void* self, const void* other);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEEdeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEEppEv(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERSB_(const void* self, void* response);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_(const void* self, void* response);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE(void* self, void* context);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE(void* self, void* context);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEixEm(void* self, std::uint64_t index);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE4sizeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEE5beginEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEE3endEv(void* self);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE4sizeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEE5beginEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEE3endEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V59Container11getChildrenEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer10initializeEPNS1_6Common10LibContextE(void* self, const std::uint64_t* context);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer13isInitializedEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setserviceLabelEi(void* self, int serviceLabel);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9terminateEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi12getContainerEiRKNS4_23ParameterToGetContainerERNS1_6Common11TransactionINS8_12IntrusivePtrINS8_6VectorINSA_INS3_9ContainerEEEEEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product8getLabelEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V57Product7getSkusEv(void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product7getTypeEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product9skusIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData11setobjectIdEPKc(void* self, const char* objectId);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser10initializeEPNS1_6Common10LibContextEPKcSA_(void* self, const std::uint64_t* context, const char* first, const char* second);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9setfieldsEPKc(void* self, const char* fields);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9terminateEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi26getMultiDataStatusesByUserEiRKNS4_37ParameterToGetMultiDataStatusesByUserERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_32GetMultiDataStatusesResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE(void);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus11getDataSizeEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus11getObjectIdEv(const void* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus8getOwnerEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus9getSlotIdEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V132GetMultiDataStatusesResponseBody17getDataStatusListEv(void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V132GetMultiDataStatusesResponseBody23getTotalDataStatusCountEv(const void* self);
+std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V15Owner12getAccountIdEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi10getFriendsEiRKNS4_21ParameterToGetFriendsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_18GetFriendsResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi17getBasicPresencesEiRKNS4_28ParameterToGetBasicPresencesERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_25GetBasicPresencesResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V118GetFriendsResponse10getFriendsEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBody14setInvitationsERKNS1_6Common6VectorINS5_12IntrusivePtrINS3_30RequestPlayerSessionInvitationEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28sendPlayerSessionInvitationsEiRKNS4_39ParameterToSendPlayerSessionInvitationsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_50PostPlayerSessionsSessionIdInvitationsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi17getPlayerSessionsEiRKNS4_28ParameterToGetPlayerSessionsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_29GetPlayerSessionsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession14setCustomData2EPKvm();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsers10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_60PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionProperties10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_39PatchPlayerSessionsSessionIdRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeader9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionPropertiesC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsers9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession14setCustomData1EPKvm();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead16customData2IsSetEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V124GetBlockingUsersResponse9getBlocksEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionPropertiesD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitations10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_49PostPlayerSessionsSessionIdInvitationsRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V146PatchPlayerSessionsSessionIdRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_39PatchPlayerSessionsSessionIdRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V137RequestPlayerSessionInvitationFactory6createEPNS1_6Common10LibContextENS5_12IntrusivePtrINS3_2ToEEEPNS8_INS3_30RequestPlayerSessionInvitationEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody19setJoinableUserTypeERKNS3_22CustomJoinableUserTypeE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V127ResponsePlayerSessionPlayer11getPlatformEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V125GetBasicPresencesResponse17getBasicPresencesEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions9setfieldsENS1_6Common12IntrusivePtrINS6_6VectorINS6_6StringEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSession9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitationsD1Ev();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead14getCustomData1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi16getBlockingUsersEiRKNS4_27ParameterToGetBlockingUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_24GetBlockingUsersResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers10initializeEPNS1_6Common10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessions9terminateEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead16customData1IsSetEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38addPlayerSessionJoinableSpecifiedUsersEiRKNS4_49ParameterToAddPlayerSessionJoinableSpecifiedUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_61PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead9getLeaderEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitationsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessionsD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead28getExclusiveLeaderPrivilegesEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi26setPlayerSessionPropertiesEiRKNS4_37ParameterToSetPlayerSessionPropertiesERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi25changePlayerSessionLeaderEiRKNS4_36ParameterToChangePlayerSessionLeaderERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V150PutPlayerSessionsSessionIdLeaderRequestBodyFactory6createEPNS1_6Common10LibContextERKNS_4Json5ValueEPNS5_12IntrusivePtrINS3_43PutPlayerSessionsSessionIdLeaderRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V119JoinableUserFactory6createEPNS1_6Common10LibContextERKmPNS5_12IntrusivePtrINS3_12JoinableUserEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeaderD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V156PostPlayerSessionsSessionIdInvitationsRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_49PostPlayerSessionsSessionIdInvitationsRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitations9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessionsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V133ResponsePlayerSessionMemberPlayer10getPlayersEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody28setExclusiveLeaderPrivilegesERKNS1_6Common6VectorINS5_6StringEEE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V113PlayerSession9getMemberEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V19ToFactory6createEPNS1_6Common10LibContextERKmPNS5_12IntrusivePtrINS3_2ToEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsersD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeader10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_43PutPlayerSessionsSessionIdLeaderRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V167PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_12JoinableUserEEEEEPNS9_INS3_60PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeaderC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionProperties9terminateEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V118LeaderWithOnlineId12getAccountIdEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody20setInvitableUserTypeERKNS3_23CustomInvitableUserTypeE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V129GetPlayerSessionsResponseBody17getPlayerSessionsEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsersC1Ev();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead14getCustomData2Ev();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V127ResponsePlayerSessionPlayer12getAccountIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V112JoinableUserEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi15filterProfanityEiRKNS4_26ParameterToFilterProfanityERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_23FilterProfanityResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity10initializeEPNS1_6Common10LibContextEPKcSA_NS6_12IntrusivePtrINS3_19WebApiFilterRequestEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V226WebApiFilterRequestFactory6createEPNS1_6Common10LibContextEPKcPNS5_12IntrusivePtrINS3_19WebApiFilterRequestEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi33getCommunicationRestrictionStatusEiRKNS4_44ParameterToGetCommunicationRestrictionStatusERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_38CommunicationRestrictionStatusResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus10initializeEPNS1_6Common10LibContextEm();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEED2Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEEdeEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V118LeaderWithOnlineIdEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorImED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEaSERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V120PlayerSessionForReadEEEEEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common18ResponseHeaderBase14getHeaderValueEPKcRNS2_12IntrusivePtrINS2_6StringEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE3endEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorImE3endEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorImE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEppEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorImEppEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence12getAccountIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence12getInContextEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence15getOnlineStatusEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi15ProfanityFilter2V223FilterProfanityResponse10getMessageEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponse13getRestrictedEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEE3getEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEE3getEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE4sizeEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEE5emptyEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEaSERKSA_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEE3getEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEEE3getEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorImE4sizeEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEdeEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEixEm(IntrusivePtr* self, unsigned long index);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEneERKS9_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEE3getEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V133ResponsePlayerSessionMemberPlayerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V133ResponsePlayerSessionMemberPlayerEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorImEdeEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V118LeaderWithOnlineIdEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorImEneERKS4_();
+std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEE4sizeEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V120PlayerSessionForReadEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEE8copyFromERKS9_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku10labelIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku10priceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku8getPriceEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku15getDisplayPriceEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer7setsortENS5_4SortE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku18originalPriceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getDescriptionEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getReleaseDateEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku23getDisplayOriginalPriceEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getDisplayNameEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku16getOriginalPriceEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku25displayOriginalPriceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku8getLabelEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9setoffsetEi();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product16releaseDateIsSetEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setcontainerIdsEPKc(void* self, const char* containerIds);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer8setlimitEi();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku17displayPriceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEaSERKSE_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEppEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEE5emptyEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEneERKS9_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE5beginEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEneERKS9_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V53SkuEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE3endEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEdeEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEdeEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1ERKSA_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEC1ERKSE_(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE3endEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEdeEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEppEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE5emptyEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEaSERKSA_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEppEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_6StringEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8copyFromERKS5_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEE3getEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEneERKS5_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE3endEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringeqEPKc(const CommonString* self, const char* other);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5getIdEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEaSERS6_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE5beginEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5emptyEv(const CommonString* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEE3getEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEdeEv();
+
+}
diff --git a/core/libs/prx/libSceNpCppWebApi/libSceNpCppWebApi.hpp b/core/libs/prx/libSceNpCppWebApi/libSceNpCppWebApi.hpp
new file mode 100644
index 0000000000..450f928feb
--- /dev/null
+++ b/core/libs/prx/libSceNpCppWebApi/libSceNpCppWebApi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpEntitlementAccess/Export.cpp b/core/libs/prx/libSceNpEntitlementAccess/Export.cpp
index 683dde7c84..e0593d4afb 100644
--- a/core/libs/prx/libSceNpEntitlementAccess/Export.cpp
+++ b/core/libs/prx/libSceNpEntitlementAccess/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -145,12 +146,10 @@ int APS5_VABI sceNpEntitlementAccessRequestConsumeUnifiedEntitlement(std::int32_
  return SCE_NP_ERROR_SIGNED_OUT;
 }
 
-
 int APS5_VABI sceNpEntitlementAccessRequestConsumeServiceEntitlement(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, const NpEntitlementAccessTransactionId* transactionId, std::int32_t count, std::int64_t* requestId) {
  return SCE_NP_ERROR_SIGNED_OUT;
 }
 
-
 int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* info) {
     return SCE_NP_ERROR_SIGNED_OUT;
 }
diff --git a/core/libs/prx/libSceNpEntitlementAccess/include/Api.hpp b/core/libs/prx/libSceNpEntitlementAccess/include/Api.hpp
new file mode 100644
index 0000000000..d68d483b87
--- /dev/null
+++ b/core/libs/prx/libSceNpEntitlementAccess/include/Api.hpp
@@ -0,0 +1,33 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfo(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, NpEntitlementAccessAddcontEntitlementInfo* info);
+int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfoList(uint32_t serviceLabel, NpEntitlementAccessAddcontEntitlementInfo* list, uint32_t listNum, uint32_t* hitNum);
+int APS5_VABI sceNpEntitlementAccessGetSkuFlag(uint32_t* skuFlag);
+int APS5_VABI sceNpEntitlementAccessGetEntitlementKey( uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, NpEntitlementAccessEntitlementKey* key);
+int APS5_VABI sceNpEntitlementAccessInitialize(const NpEntitlementAccessInitParam* initParam, NpEntitlementAccessBootParam* bootParam);
+int APS5_VABI sceNpEntitlementAccessAbortRequest(std::int64_t requestId);
+int APS5_VABI sceNpEntitlementAccessDeleteRequest(std::int64_t requestId);
+int APS5_VABI sceNpEntitlementAccessGenerateTransactionId(NpEntitlementAccessTransactionId* transactionId);
+int APS5_VABI sceNpEntitlementAccessPollConsumeEntitlement(std::int64_t requestId, std::int32_t* result, std::int32_t* countResult);
+int APS5_VABI sceNpEntitlementAccessRequestConsumeUnifiedEntitlement(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, const NpEntitlementAccessTransactionId* transactionId, std::int32_t count, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessRequestConsumeServiceEntitlement(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, const NpEntitlementAccessTransactionId* transactionId, std::int32_t count, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* info);
+int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* info);
+int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessGetPftFlag(uint32_t* flag);
+int APS5_VABI sceNpEntitlementAccessGetGameTrialsFlag(uint32_t* flag);
+int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
+int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
+int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfoIndividual();
+int APS5_VABI sceNpEntitlementAccessPollConsumableEntitlementInfo();
+int APS5_VABI sceNpEntitlementAccessRequestConsumableEntitlementInfo();
+int APS5_VABI sceNpEntitlementAccessRequestConsumeEntitlement();
+
+}
diff --git a/core/libs/prx/libSceNpEntitlementAccess/libSceNpEntitlementAccess.hpp b/core/libs/prx/libSceNpEntitlementAccess/libSceNpEntitlementAccess.hpp
new file mode 100644
index 0000000000..e8590281af
--- /dev/null
+++ b/core/libs/prx/libSceNpEntitlementAccess/libSceNpEntitlementAccess.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpEulaDialog/Export.cpp b/core/libs/prx/libSceNpEulaDialog/Export.cpp
index 1b666cc199..99b4499d54 100644
--- a/core/libs/prx/libSceNpEulaDialog/Export.cpp
+++ b/core/libs/prx/libSceNpEulaDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpEulaDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpEulaDialog/include/Api.hpp b/core/libs/prx/libSceNpEulaDialog/include/Api.hpp
new file mode 100644
index 0000000000..fc29d6fa96
--- /dev/null
+++ b/core/libs/prx/libSceNpEulaDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpEulaDialogCheckVersion();
+int APS5_VABI sceNpEulaDialogCheckVersionAbort();
+int APS5_VABI sceNpEulaDialogClose();
+int APS5_VABI sceNpEulaDialogGetResult();
+int APS5_VABI sceNpEulaDialogGetStatus();
+int APS5_VABI sceNpEulaDialogInitialize();
+int APS5_VABI sceNpEulaDialogOpen();
+int APS5_VABI sceNpEulaDialogTerminate();
+int APS5_VABI sceNpEulaDialogUpdateStatus();
+
+}
diff --git a/core/libs/prx/libSceNpEulaDialog/libSceNpEulaDialog.hpp b/core/libs/prx/libSceNpEulaDialog/libSceNpEulaDialog.hpp
new file mode 100644
index 0000000000..6f2a34108c
--- /dev/null
+++ b/core/libs/prx/libSceNpEulaDialog/libSceNpEulaDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpEulaDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpFriendListDialog/Export.cpp b/core/libs/prx/libSceNpFriendListDialog/Export.cpp
index 4ca7288353..aee6fb1edf 100644
--- a/core/libs/prx/libSceNpFriendListDialog/Export.cpp
+++ b/core/libs/prx/libSceNpFriendListDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpFriendListDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceNpFriendListDialog/include/Api.hpp b/core/libs/prx/libSceNpFriendListDialog/include/Api.hpp
new file mode 100644
index 0000000000..2bdd0742ab
--- /dev/null
+++ b/core/libs/prx/libSceNpFriendListDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpFriendListDialogInitialize(void);
+int APS5_VABI sceNpFriendListDialogOpenA(const void* param);
+int APS5_VABI sceNpFriendListDialogUpdateStatus(void);
+int APS5_VABI sceNpFriendListDialogGetStatus(void);
+int APS5_VABI sceNpFriendListDialogGetResultA(void* result);
+int APS5_VABI sceNpFriendListDialogClose(void);
+int APS5_VABI sceNpFriendListDialogTerminate(void);
+int APS5_VABI sceNpFriendListDialogGetResult();
+int APS5_VABI sceNpFriendListDialogOpen();
+
+}
diff --git a/core/libs/prx/libSceNpFriendListDialog/libSceNpFriendListDialog.hpp b/core/libs/prx/libSceNpFriendListDialog/libSceNpFriendListDialog.hpp
new file mode 100644
index 0000000000..d1b45137ee
--- /dev/null
+++ b/core/libs/prx/libSceNpFriendListDialog/libSceNpFriendListDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpFriendListDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpGameIntent/Export.cpp b/core/libs/prx/libSceNpGameIntent/Export.cpp
index c8be4b9f09..dfea590bc3 100644
--- a/core/libs/prx/libSceNpGameIntent/Export.cpp
+++ b/core/libs/prx/libSceNpGameIntent/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpGameIntent/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -7,44 +9,57 @@
 
 namespace {
 
+constexpr int NpGameIntentErrorNotInitialized = -2141898750;
 constexpr int NpGameIntentErrorInvalidArgument = -2141898748;
 constexpr int NpGameIntentErrorIntentNotFound = -2141898746;
 constexpr int NpGameIntentErrorValueNotFound = -2141898745;
 constexpr int NpGameIntentUserIdInvalid = -1;
 
+std::atomic_bool& NpGameIntentInitialized() {
+    static std::atomic_bool initialized{false};
+    return initialized;
+}
 
 }
 
 extern "C" {
 
 int APS5_VABI sceNpGameIntentGetPropertyValueString(const NpGameIntentData* intentData, const char* key, char* valueBuf, size_t bufSize) {
- if (intentData == nullptr || key == nullptr || valueBuf == nullptr || bufSize == 0) {
-  APS5_INVALID_ARG_EX;
- }
+	if (!NpGameIntentInitialized()) {
+		return NpGameIntentErrorNotInitialized;
+	}
+	if (intentData == nullptr || key == nullptr || key[0] == '\0' || valueBuf == nullptr || bufSize == 0) {
+		return NpGameIntentErrorInvalidArgument;
+	}
 
- valueBuf[0] = '\0';
- return NpGameIntentErrorValueNotFound;
+	valueBuf[0] = '\0';
+	return NpGameIntentErrorValueNotFound;
 }
 
 int APS5_VABI sceNpGameIntentInitialize(const void* initParam) {
- (void)initParam;
- return 0;
+	(void)initParam;
+	NpGameIntentInitialized() = true;
+	return 0;
 }
 
 int APS5_VABI sceNpGameIntentReceiveIntent(NpGameIntentInfo* intentInfo) {
- if (intentInfo == nullptr) {
-  APS5_INVALID_ARG_EX;
- }
+	if (!NpGameIntentInitialized()) {
+		return NpGameIntentErrorNotInitialized;
+	}
+	if (intentInfo == nullptr || intentInfo->size != 0x4140) {
+		return NpGameIntentErrorInvalidArgument;
+	}
 
- intentInfo->user_id = NpGameIntentUserIdInvalid;
- std::memset(intentInfo->intent_type, 0, sizeof(intentInfo->intent_type));
- std::memset(&intentInfo->intent_data, 0, sizeof(intentInfo->intent_data));
+	intentInfo->user_id = NpGameIntentUserIdInvalid;
+	std::memset(intentInfo->intent_type, 0, sizeof(intentInfo->intent_type));
+	std::memset(&intentInfo->intent_data, 0, sizeof(intentInfo->intent_data));
 
- return NpGameIntentErrorIntentNotFound;
+	return NpGameIntentErrorIntentNotFound;
 }
 
 int APS5_VABI sceNpGameIntentTerminate(void) {
- return 0;
+	NpGameIntentInitialized() = false;
+	return 0;
 }
 
 int APS5_VABI sceNpGameIntentInitParamInit(NpGameIntentInitParam* param) {
diff --git a/core/libs/prx/libSceNpGameIntent/include/Api.hpp b/core/libs/prx/libSceNpGameIntent/include/Api.hpp
new file mode 100644
index 0000000000..abd369f817
--- /dev/null
+++ b/core/libs/prx/libSceNpGameIntent/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpGameIntentGetPropertyValueString(const NpGameIntentData* intentData, const char* key, char* valueBuf, size_t bufSize);
+int APS5_VABI sceNpGameIntentInitialize(const void* initParam);
+int APS5_VABI sceNpGameIntentReceiveIntent(NpGameIntentInfo* intentInfo);
+int APS5_VABI sceNpGameIntentTerminate(void);
+int APS5_VABI sceNpGameIntentInitParamInit(NpGameIntentInitParam* param);
+int APS5_VABI sceNpGameIntentInfoInit(NpGameIntentInfo* info);
+int APS5_VABI sceNpGameIntentVshInitialize(void);
+int APS5_VABI sceNpGameIntentVshTerminate(void);
+int APS5_VABI sceNpAppLauncherInitialize(const void* initParam);
+int APS5_VABI sceNpAppLauncherLaunchApp();
+int APS5_VABI sceNpAppLauncherTerminate();
+int APS5_VABI sceNpGameIntentGetUdsNpComId();
+int APS5_VABI sceNpGameIntentLaunchApp();
+int APS5_VABI sceNpGameIntentLaunchApp2();
+int APS5_VABI sceNpGameIntentNotifyAppLaunched();
+int APS5_VABI sceNpSessionServiceGetJoinedPartySession();
+int APS5_VABI sceNpSessionServiceGetRunningGamePlayerSession();
+int APS5_VABI sceNpSessionServiceSendPlayerSessionInvitations();
+
+}
diff --git a/core/libs/prx/libSceNpGameIntent/libSceNpGameIntent.hpp b/core/libs/prx/libSceNpGameIntent/libSceNpGameIntent.hpp
new file mode 100644
index 0000000000..7c0f3b8b2e
--- /dev/null
+++ b/core/libs/prx/libSceNpGameIntent/libSceNpGameIntent.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpGameIntent/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpManager/Export.cpp b/core/libs/prx/libSceNpManager/Export.cpp
index 15fd862b97..1abe3a9f3a 100644
--- a/core/libs/prx/libSceNpManager/Export.cpp
+++ b/core/libs/prx/libSceNpManager/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpManager/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -16,6 +17,7 @@ static constexpr int SCE_NP_ERROR_CALLBACK_ALREADY_REGISTERED = static_cast<int>
 static constexpr int SCE_NP_ERROR_CALLBACK_NOT_REGISTERED = static_cast<int>(0x80550009);
 static constexpr int SCE_NP_ERROR_INVALID_SIZE = static_cast<int>(0x80550011);
 static constexpr int SCE_NP_ERROR_REQUEST_NOT_FOUND = static_cast<int>(0x80550014);
+static constexpr int SCE_NP_ERROR_INVALID_ID = static_cast<int>(0x80550015);
 static constexpr int SCE_NP_ERROR_CALLBACK_MAX = static_cast<int>(0x8055001D);
 static constexpr uint32_t NP_STATE_SIGNED_OUT = 1;
 static constexpr int NP_POLL_ASYNC_FINISHED = 0;
@@ -44,9 +46,6 @@ int SignedOutRequest(int reqId) {
     return liveRequests.count(reqId) ? SCE_NP_ERROR_SIGNED_OUT : SCE_NP_ERROR_REQUEST_NOT_FOUND;
 }
 
-using NpStateCallbackA = void (APS5_VABI *)(int userId, uint32_t state, void* userdata);
-using NpStateCallback = void (APS5_VABI *)(int userId, uint32_t state, NpId* npId, void* userdata);
-
 constexpr int NP_STATE_CALLBACK_MAX = 8;
 
 struct StateCallbackA {
@@ -673,8 +672,8 @@ int APS5_VABI sceNpManagerIntLoginGetAccessToken(void) {
 }
 
 int APS5_VABI sceNpAbortRequest(int req_id) {
-    (void)req_id;
-    return 0;
+    std::lock_guard lock(requestMutex);
+    return liveRequests.count(req_id) ? 0 : SCE_NP_ERROR_REQUEST_NOT_FOUND;
 }
 
 int APS5_VABI sceNpCheckCallback(void) {
@@ -724,6 +723,7 @@ int APS5_VABI sceNpCreateRequest(void) {
 
 int APS5_VABI sceNpDeleteRequest(int req_id) {
     std::lock_guard lock(requestMutex);
+    if (!liveRequests.count(req_id)) return SCE_NP_ERROR_REQUEST_NOT_FOUND;
     liveRequests.erase(req_id);
     return 0;
 }
@@ -834,8 +834,10 @@ int APS5_VABI sceNpHasSignedUp(int user_id, bool* has_signed_up) {
 }
 
 int APS5_VABI sceNpPollAsync(int req_id, int* result) {
-    (void)req_id;
-    if (result) *result = SCE_NP_ERROR_SIGNED_OUT;
+    if (!result) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(requestMutex);
+    if (!liveRequests.count(req_id)) return SCE_NP_ERROR_REQUEST_NOT_FOUND;
+    *result = SCE_NP_ERROR_SIGNED_OUT;
     return NP_POLL_ASYNC_FINISHED;
 }
 
@@ -954,7 +956,7 @@ int APS5_VABI sceNpRegisterStateCallbackA(NpStateCallbackA callback, void* userd
 }
 
 int APS5_VABI sceNpUnregisterStateCallbackA(int callbackId) {
-    if (callbackId < 1 || callbackId > NP_STATE_CALLBACK_MAX) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    if (static_cast<uint32_t>(callbackId) - 1u >= static_cast<uint32_t>(NP_STATE_CALLBACK_MAX)) return SCE_NP_ERROR_INVALID_ID;
     std::lock_guard lock(stateMutex);
     auto& entry = stateCallbacksA[callbackId - 1];
     if (!entry.callback) return SCE_NP_ERROR_CALLBACK_NOT_REGISTERED;
@@ -995,7 +997,6 @@ int APS5_VABI sceNpUnknown_WxLcN76q19o(void) {
     return 0;
 }
 
-
 int APS5_VABI sceNpCheckCallbackForLib() {
     return sceNpCheckCallback();
 }
diff --git a/core/libs/prx/libSceNpManager/include/Api.hpp b/core/libs/prx/libSceNpManager/include/Api.hpp
new file mode 100644
index 0000000000..11a6828eb8
--- /dev/null
+++ b/core/libs/prx/libSceNpManager/include/Api.hpp
@@ -0,0 +1,218 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using NpStateCallback = void (APS5_VABI *)(int userId, uint32_t state, NpId* npId, void* userdata);
+
+using NpStateCallbackA = void (APS5_VABI *)(int userId, uint32_t state, void* userdata);
+
+extern "C" {
+
+int APS5_VABI sceNpAsmAbort(void);
+int APS5_VABI sceNpAsmClientAbortRequest(void);
+int APS5_VABI sceNpAsmClientClearNpTitleToken(void);
+int APS5_VABI sceNpAsmClientClearNpTitleTokenA(void);
+int APS5_VABI sceNpAsmClientCreateRequest2(void);
+int APS5_VABI sceNpAsmClientCreateResourceContext(void);
+int APS5_VABI sceNpAsmClientCreateResourceContext2(void);
+int APS5_VABI sceNpAsmClientDeleteRequest(void);
+int APS5_VABI sceNpAsmClientDeleteResourceContext(void);
+int APS5_VABI sceNpAsmClientDeleteResourceContext2(void);
+int APS5_VABI sceNpAsmClientGetAppId(void);
+int APS5_VABI sceNpAsmClientGetCacheControlMaxAge(void);
+int APS5_VABI sceNpAsmClientGetGameNpTitleInfo(void);
+int APS5_VABI sceNpAsmClientGetGameNpTitleToken(void);
+int APS5_VABI sceNpAsmClientGetGameTitleBanInfo(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo2(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo2A(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo3(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo4(void);
+int APS5_VABI sceNpAsmClientGetNpTitleId(void);
+int APS5_VABI sceNpAsmClientGetNpTitleToken(void);
+int APS5_VABI sceNpAsmClientGetNpTitleToken2(void);
+int APS5_VABI sceNpAsmClientGetNpTitleTokenA(void);
+int APS5_VABI sceNpAsmClientGetRelatedGameNpTitleIds(void);
+int APS5_VABI sceNpAsmClientGetRelatedGameNpTitleIdsA(void);
+int APS5_VABI sceNpAsmClientGetRelatedGameNpTitleIdsResult(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrl(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrlA(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrlWithNpTitleId(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrlWithNpTitleIdA(void);
+int APS5_VABI sceNpAsmClientGetServiceIdInfo(void);
+int APS5_VABI sceNpAsmClientGetServiceIdInfoA(void);
+int APS5_VABI sceNpAsmClientInitialize(void);
+int APS5_VABI sceNpAsmClientSetNpTitleId(void);
+int APS5_VABI sceNpAsmClientTerminate(void);
+int APS5_VABI sceNpAsmCreateConnection(void);
+int APS5_VABI sceNpAsmCreateRequest(void);
+int APS5_VABI sceNpAsmDeleteConnection(void);
+int APS5_VABI sceNpAsmDeleteRequest(void);
+int APS5_VABI sceNpAsmGenerateNpTitleToken(void);
+int APS5_VABI sceNpAsmGenerateNpTitleToken2(void);
+int APS5_VABI sceNpAsmGetNpCommInfo(void);
+int APS5_VABI sceNpAsmGetNpCommInfo2(void);
+int APS5_VABI sceNpAsmGetRelatedGameNpTitleIds(void);
+int APS5_VABI sceNpAsmGetServiceBaseUrl(void);
+int APS5_VABI sceNpAsmGetServiceIdInfo(void);
+int APS5_VABI sceNpAsmInitialize(void);
+int APS5_VABI sceNpAsmTerminate(void);
+int APS5_VABI sceNpCheckNpAvailabilityA(int reqId, int userId);
+int APS5_VABI sceNpGetAccountDateOfBirthA(int userId, void* dateOfBirth);
+int APS5_VABI sceNpGetAccountLanguageA(int reqId, int userId, void* language);
+int APS5_VABI sceNpGetGamePresenceStatus(const NpOnlineId* onlineId, uint32_t* status);
+int APS5_VABI sceNpGetGamePresenceStatusA(int userId, uint32_t* status);
+int APS5_VABI sceNpGetParentalControlInfoA(int reqId, int userId, int8_t* age, void* info);
+int APS5_VABI sceNpIdMapperAbortRequest(void);
+int APS5_VABI sceNpIdMapperAccountIdToNpId(void);
+int APS5_VABI sceNpIdMapperAccountIdToOnlineId(void);
+int APS5_VABI sceNpIdMapperCreateRequest(void);
+int APS5_VABI sceNpIdMapperDeleteRequest(void);
+int APS5_VABI sceNpIdMapperNpIdToAccountId(void);
+int APS5_VABI sceNpIdMapperOnlineIdToAccountId(void);
+int APS5_VABI sceNpInGameMessageAbortHandle(void);
+int APS5_VABI sceNpInGameMessageCheckCallback(void);
+int APS5_VABI sceNpInGameMessageGetMemoryPoolStatistics(void);
+int APS5_VABI sceNpInGameMessagePrepareA(void);
+int APS5_VABI sceNpInGameMessageSendDataA(void);
+int APS5_VABI sceNpIntGetAppType(void);
+int APS5_VABI sceNpIntGetGamePresenceStatus(void);
+int APS5_VABI sceNpIntGetNpTitleId(void);
+int APS5_VABI sceNpIntGetNpTitleIdSecret(void);
+int APS5_VABI sceNpIntRegisterCheckCallback(void);
+int APS5_VABI sceNpIntRegisterGamePresenceCallback(void);
+int APS5_VABI sceNpIsPlusMember(int, bool* isMember);
+int APS5_VABI sceNpManagerIntAbortRequest(void);
+int APS5_VABI sceNpManagerIntAddActiveSigninStateCallback(void);
+int APS5_VABI sceNpManagerIntAddOnlineIdChangeCallback(void);
+int APS5_VABI sceNpManagerIntAddPlusMemberTypeCallback(void);
+int APS5_VABI sceNpManagerIntAddSigninStateCallback(void);
+int APS5_VABI sceNpManagerIntAuthGetAuthorizationCode(void);
+int APS5_VABI sceNpManagerIntAuthGetIdToken(void);
+int APS5_VABI sceNpManagerIntCheckNpAvailability(void);
+int APS5_VABI sceNpManagerIntCheckNpAvailabilityByPid(void);
+int APS5_VABI sceNpManagerIntCheckNpState(void);
+int APS5_VABI sceNpManagerIntCheckNpStateA(void);
+int APS5_VABI sceNpManagerIntClearGameAccessToken(void);
+int APS5_VABI sceNpManagerIntClearOnlineIdChangeFlag(void);
+int APS5_VABI sceNpManagerIntClearTicket(void);
+int APS5_VABI sceNpManagerIntClearUsedFlag(void);
+int APS5_VABI sceNpManagerIntClearVshAccessToken(void);
+int APS5_VABI sceNpManagerIntCreateAuthenticationTicket(void);
+int APS5_VABI sceNpManagerIntCreateLoginContext(void);
+int APS5_VABI sceNpManagerIntCreateLoginRequest(void);
+int APS5_VABI sceNpManagerIntCreateRequest(void);
+int APS5_VABI sceNpManagerIntDeleteLoginContext(void);
+int APS5_VABI sceNpManagerIntDeleteRequest(void);
+int APS5_VABI sceNpManagerIntGetAccessTokenViaImplicitFlow(void);
+int APS5_VABI sceNpManagerIntGetAccountAge(void);
+int APS5_VABI sceNpManagerIntGetAccountCountry(void);
+int APS5_VABI sceNpManagerIntGetAccountCountryA(void);
+int APS5_VABI sceNpManagerIntGetAccountCountrySdk(void);
+int APS5_VABI sceNpManagerIntGetAccountDateOfBirthSdk(void);
+int APS5_VABI sceNpManagerIntGetAccountId(void);
+int APS5_VABI sceNpManagerIntGetAccountIdSdk(void);
+int APS5_VABI sceNpManagerIntGetAccountLanguage(void);
+int APS5_VABI sceNpManagerIntGetAccountLanguageA(void);
+int APS5_VABI sceNpManagerIntGetAccountNpEnv(void);
+int APS5_VABI sceNpManagerIntGetAccountType(void);
+int APS5_VABI sceNpManagerIntGetActiveSigninState(void);
+int APS5_VABI sceNpManagerIntGetAuthServerErrorFlag(void);
+int APS5_VABI sceNpManagerIntGetAuthorizationCode(void);
+int APS5_VABI sceNpManagerIntGetAuthorizationCodeWithPsnoUri(void);
+int APS5_VABI sceNpManagerIntGetClientCredentialAccessToken(void);
+int APS5_VABI sceNpManagerIntGetCommunicationRestrictionStatus(void);
+int APS5_VABI sceNpManagerIntGetGameAccessToken(void);
+int APS5_VABI sceNpManagerIntGetIssuerId(void);
+int APS5_VABI sceNpManagerIntGetNpEnv(void);
+int APS5_VABI sceNpManagerIntGetNpId(void);
+int APS5_VABI sceNpManagerIntGetNpIdByOnlineId(void);
+int APS5_VABI sceNpManagerIntGetNpIdSdk(void);
+int APS5_VABI sceNpManagerIntGetOfflineAccountId(void);
+int APS5_VABI sceNpManagerIntGetOnlineId(void);
+int APS5_VABI sceNpManagerIntGetOnlineIdChangeFlag(void);
+int APS5_VABI sceNpManagerIntGetOnlineIdSdk(void);
+int APS5_VABI sceNpManagerIntGetParentalControlFlag(void);
+int APS5_VABI sceNpManagerIntGetParentalControlInfo(void);
+int APS5_VABI sceNpManagerIntGetPlusMemberType(void);
+int APS5_VABI sceNpManagerIntGetPlusMemberTypeNB(void);
+int APS5_VABI sceNpManagerIntGetServerError(void);
+int APS5_VABI sceNpManagerIntGetSigninState(void);
+int APS5_VABI sceNpManagerIntGetSigninTelemetryInfo(void);
+int APS5_VABI sceNpManagerIntGetTicket(void);
+int APS5_VABI sceNpManagerIntGetTicketA(void);
+int APS5_VABI sceNpManagerIntGetTitleToken(void);
+int APS5_VABI sceNpManagerIntGetTitleTokenWithCheck(void);
+int APS5_VABI sceNpManagerIntGetUserIdByAccountId(void);
+int APS5_VABI sceNpManagerIntGetUserIdByNpId(void);
+int APS5_VABI sceNpManagerIntGetUserIdByOnlineId(void);
+int APS5_VABI sceNpManagerIntGetUserIdByOnlineIdSdk(void);
+int APS5_VABI sceNpManagerIntGetUserList(void);
+int APS5_VABI sceNpManagerIntGetUserNum(void);
+int APS5_VABI sceNpManagerIntGetVshAccessToken(void);
+int APS5_VABI sceNpManagerIntGetVshAccessTokenWithCheck(void);
+int APS5_VABI sceNpManagerIntGetVshClientId(void);
+int APS5_VABI sceNpManagerIntIsSubAccount(void);
+int APS5_VABI sceNpManagerIntIsTemporarySignout(void);
+int APS5_VABI sceNpManagerIntIsUnregisteredClientError(void);
+int APS5_VABI sceNpManagerIntLoginAuthenticate(void);
+int APS5_VABI sceNpManagerIntLoginBind(void);
+int APS5_VABI sceNpManagerIntLoginCreateAuthenticationTicket(void);
+int APS5_VABI sceNpManagerIntLoginGetAccessToken(void);
+int APS5_VABI sceNpAbortRequest(int reqId);
+int APS5_VABI sceNpCheckCallback(void);
+int APS5_VABI sceNpCheckNpAvailability(std::int32_t requestId, const NpOnlineId* onlineId, std::uint8_t* available);
+int APS5_VABI sceNpCheckNpReachability(int reqId, int userId);
+int APS5_VABI sceNpCheckPremium(int reqId, const NpCheckPremiumParameter* param, NpCheckPremiumResult* result);
+int APS5_VABI sceNpCreateAsyncRequest(const NpCreateAsyncRequestParameter* param);
+int APS5_VABI sceNpCreateRequest(void);
+int APS5_VABI sceNpDeleteRequest(int reqId);
+int APS5_VABI sceNpGetAccountAge(int reqId, int userId, uint8_t* age);
+int APS5_VABI sceNpGetAccountCountry(const NpOnlineId* onlineId, void* countryCode);
+int APS5_VABI sceNpGetAccountDateOfBirth(const NpOnlineId* onlineId, void* dateOfBirth);
+int APS5_VABI sceNpGetAccountLanguage(int reqId, const NpOnlineId* onlineId, void* language);
+int APS5_VABI sceNpGetParentalControlInfo(int reqId, const NpOnlineId* onlineId, int8_t* age, void* info);
+int APS5_VABI sceNpGetUserIdByOnlineId(const NpOnlineId* onlineId, int* userId);
+int APS5_VABI sceNpCheckPlus(int reqId, const void* param, void* result);
+int APS5_VABI sceNpNotifyPlusFeature(const void* param);
+int APS5_VABI sceNpGetAccountId(const NpOnlineId* onlineId, uint64_t* accountId);
+int APS5_VABI sceNpSetGamePresenceOnline(int reqId, const NpOnlineId* onlineId, uint32_t presence);
+int APS5_VABI sceNpGetAccountCountryA(int userId, void* countryCode);
+int APS5_VABI sceNpGetAccountIdA(int userId, uint64_t* accountId);
+int APS5_VABI sceNpGetNpId(int userId, NpId* npId);
+int APS5_VABI sceNpGetNpReachabilityState(int userId, uint32_t* state);
+int APS5_VABI sceNpGetOnlineId(int userId, NpOnlineId* onlineId);
+int APS5_VABI sceNpGetState(int userId, uint32_t* state);
+int APS5_VABI sceNpHasSignedUp(int userId, bool* hasSignedUp);
+int APS5_VABI sceNpPollAsync(int reqId, int* result);
+void APS5_VABI sceNpRegisterGamePresenceCallback(void* callback, void* userdata);
+int APS5_VABI sceNpRegisterNpReachabilityStateCallback(void* callback, void* userdata);
+int APS5_VABI sceNpUnregisterNpReachabilityStateCallback(void);
+int APS5_VABI sceNpRegisterPlusEventCallback(void* callback, void* userdata);
+int APS5_VABI sceNpRegisterPremiumEventCallback(void* callback, void* userdata);
+int APS5_VABI sceNpRegisterStateCallback(NpStateCallback callback, void* userdata);
+int APS5_VABI sceNpSetContentRestriction(const NpContentRestriction* restriction);
+int APS5_VABI sceNpSetNpTitleId(const NpTitleId* titleId, const NpTitleSecret* titleSecret);
+int APS5_VABI sceNpSetTimeout(int reqId, int32_t resolveRetry, uint32_t resolveTimeout, uint32_t connTimeout, uint32_t sendTimeout, uint32_t recvTimeout);
+int APS5_VABI sceNpUnregisterStateCallback(void);
+int APS5_VABI sceNpGetAccountLanguage2(int reqId, int userId, void* language);
+int APS5_VABI sceNpNotifyPremiumFeature(const void* param);
+int APS5_VABI sceNpRegisterStateCallbackA(NpStateCallbackA callback, void* userdata);
+int APS5_VABI sceNpUnregisterStateCallbackA(int callbackId);
+int APS5_VABI sceNpUnregisterPremiumEventCallback(void);
+int APS5_VABI sceNpUnregisterPlusEventCallback(void);
+int APS5_VABI sceNpGetUserIdByAccountId(uint64_t accountId, int* userId);
+int APS5_VABI sceNpGetSandboxInfo(void* sandboxInfo);
+int APS5_VABI sceNpUnknown_8weiQyIdI3A(int userId, const NpOnlineId* buffer);
+int APS5_VABI sceNpUnknown_WxLcN76q19o(void);
+int APS5_VABI sceNpCheckCallbackForLib();
+int APS5_VABI sceNpInGameMessageCreateHandle();
+int APS5_VABI sceNpInGameMessageDeleteHandle();
+int APS5_VABI sceNpInGameMessageInitialize();
+int APS5_VABI sceNpInGameMessagePrepare();
+int APS5_VABI sceNpInGameMessageSendData();
+int APS5_VABI sceNpInGameMessageTerminate();
+int APS5_VABI sceNpSnsFacebookCreateRequest();
+int APS5_VABI sceNpSnsFacebookDeleteRequest();
+int APS5_VABI sceNpSnsFacebookGetAccessToken();
+
+}
diff --git a/core/libs/prx/libSceNpManager/libSceNpManager.hpp b/core/libs/prx/libSceNpManager/libSceNpManager.hpp
new file mode 100644
index 0000000000..5fa5fa4390
--- /dev/null
+++ b/core/libs/prx/libSceNpManager/libSceNpManager.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpManager/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpMatching2/CMakeLists.txt b/core/libs/prx/libSceNpMatching2/CMakeLists.txt
new file mode 100644
index 0000000000..06978af7ad
--- /dev/null
+++ b/core/libs/prx/libSceNpMatching2/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceNpMatching2 SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpMatching2 PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpMatching2)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_matching2_offline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpMatching2Offline.cpp)
+    target_include_directories(guest_np_matching2_offline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_matching2_offline_tests PRIVATE libSceNpMatching2)
+    configure_windows_unwind(guest_np_matching2_offline_tests)
+    add_test(NAME guest_np_matching2_offline COMMAND guest_np_matching2_offline_tests)
+    set_tests_properties(guest_np_matching2_offline PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_matching2_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpMatching2>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpMatching2/Export.cpp b/core/libs/prx/libSceNpMatching2/Export.cpp
index 2746971c77..3797bf7136 100644
--- a/core/libs/prx/libSceNpMatching2/Export.cpp
+++ b/core/libs/prx/libSceNpMatching2/Export.cpp
@@ -1,21 +1,69 @@
+#include "prx/libSceNpMatching2/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <unordered_set>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+static constexpr int SCE_NP_MATCHING2_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80550C02);
+static constexpr int SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED = static_cast<int>(0x80550C03);
+static constexpr int SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550C0A);
+static constexpr int SCE_NP_MATCHING2_ERROR_CONTEXT_MAX = static_cast<int>(0x80550C04);
+static constexpr int SCE_NP_MATCHING2_ERROR_CONTEXT_NOT_STARTED = static_cast<int>(0x80550C08);
+static constexpr int SCE_NP_MATCHING2_ERROR_INVALID_CONTEXT_ID = static_cast<int>(0x80550C0B);
+static constexpr int SCE_NET_ERROR_RESOLVER_ETIMEDOUT = static_cast<int>(0x804101E2);
+static constexpr int MAX_CONTEXTS = 10;
+static constexpr std::uint64_t CREATE_CONTEXT_PARAMETER_SIZE = 0x28;
+
+namespace {
+
+static_assert(offsetof(NpMatching2InitializeParameter, size) == 0x20);
+static_assert(sizeof(NpMatching2InitializeParameter) == 0x30);
+
+static_assert(sizeof(NpMatching2CreateContextParameter) == CREATE_CONTEXT_PARAMETER_SIZE);
+
+std::mutex matching2Mutex;
+bool matching2Initialized = false;
+std::unordered_set<std::uint16_t> contexts;
+int nextContextId = 1;
+
+int CheckContext(std::uint16_t ctxId) {
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    return contexts.contains(ctxId) ? 0 : SCE_NP_MATCHING2_ERROR_INVALID_CONTEXT_ID;
+}
+
+}
+
 extern "C" {
 
-int APS5_VABI sceNpMatching2ContextStart() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2ContextStart(std::uint16_t ctxId, std::uint64_t timeout) {
+    (void)ctxId;
+    (void)timeout;
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    return SCE_NET_ERROR_RESOLVER_ETIMEDOUT;
 }
 
-int APS5_VABI sceNpMatching2ContextStop() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2ContextStop(std::uint16_t ctxId) {
+    std::lock_guard lock(matching2Mutex);
+    if (const int error = CheckContext(ctxId)) return error;
+    return SCE_NP_MATCHING2_ERROR_CONTEXT_NOT_STARTED;
 }
 
-int APS5_VABI sceNpMatching2CreateContext() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2CreateContext(const NpMatching2CreateContextParameter* param, std::uint16_t* ctxId) {
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    if (!param || param->size != CREATE_CONTEXT_PARAMETER_SIZE || !ctxId) return SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT;
+    for (int tried = 0; tried < MAX_CONTEXTS; ++tried) {
+        const auto candidate = static_cast<std::uint16_t>((nextContextId - 1 + tried) % MAX_CONTEXTS + 1);
+        if (contexts.contains(candidate)) continue;
+        contexts.insert(candidate);
+        nextContextId = candidate % MAX_CONTEXTS + 1;
+        *ctxId = candidate;
+        return 0;
+    }
+    return SCE_NP_MATCHING2_ERROR_CONTEXT_MAX;
 }
 
 int APS5_VABI sceNpMatching2CreateJoinRoom() {
@@ -23,8 +71,10 @@ int APS5_VABI sceNpMatching2CreateJoinRoom() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2DestroyContext() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpMatching2DestroyContext(std::uint16_t ctxId) {
+    std::lock_guard lock(matching2Mutex);
+    if (const int error = CheckContext(ctxId)) return error;
+    contexts.erase(ctxId);
     return 0;
 }
 
@@ -58,8 +108,11 @@ int APS5_VABI sceNpMatching2GetWorldInfoList() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2Initialize() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpMatching2Initialize(const NpMatching2InitializeParameter* param) {
+    std::lock_guard lock(matching2Mutex);
+    if (matching2Initialized) return SCE_NP_MATCHING2_ERROR_ALREADY_INITIALIZED;
+    if (!param || (param->size != offsetof(NpMatching2InitializeParameter, sslPoolSize) && param->size != sizeof(NpMatching2InitializeParameter))) return SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT;
+    matching2Initialized = true;
     return 0;
 }
 
@@ -78,24 +131,32 @@ int APS5_VABI sceNpMatching2LeaveRoom() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2RegisterContextCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterContextCallback(void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return matching2Initialized ? 0 : SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
 }
 
-int APS5_VABI sceNpMatching2RegisterRoomEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterRoomEventCallback(std::uint16_t ctxId, void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return CheckContext(ctxId);
 }
 
-int APS5_VABI sceNpMatching2RegisterRoomMessageCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterRoomMessageCallback(std::uint16_t ctxId, void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return CheckContext(ctxId);
 }
 
-int APS5_VABI sceNpMatching2RegisterSignalingCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterSignalingCallback(std::uint16_t ctxId, void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return CheckContext(ctxId);
 }
 
 int APS5_VABI sceNpMatching2SearchRoom() {
@@ -113,9 +174,11 @@ int APS5_VABI sceNpMatching2SendRoomMessage() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2SetDefaultRequestOptParam() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2SetDefaultRequestOptParam(std::uint16_t ctxId, const void* requestOpt) {
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    if (!requestOpt) return SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT;
+    return CheckContext(ctxId);
 }
 
 int APS5_VABI sceNpMatching2SetRoomDataExternal() {
@@ -143,8 +206,12 @@ int APS5_VABI sceNpMatching2SignalingGetConnectionInfo() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2Terminate() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpMatching2Terminate(void) {
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    matching2Initialized = false;
+    contexts.clear();
+    nextContextId = 1;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceNpMatching2/include/Api.hpp b/core/libs/prx/libSceNpMatching2/include/Api.hpp
new file mode 100644
index 0000000000..e7aca1bb5d
--- /dev/null
+++ b/core/libs/prx/libSceNpMatching2/include/Api.hpp
@@ -0,0 +1,55 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpMatching2InitializeParameter {
+    std::uint64_t poolSize;
+    std::uint64_t cpuAffinityMask;
+    std::int32_t threadPriority;
+    std::uint8_t padding[4];
+    std::uint64_t threadStackSize;
+    std::uint64_t size;
+    std::uint64_t sslPoolSize;
+};
+
+struct NpMatching2CreateContextParameter {
+    const void* npId;
+    const void* npCommunicationId;
+    const void* npPassphrase;
+    std::uint32_t serviceLabel;
+    std::uint64_t size;
+};
+
+extern "C" {
+
+int APS5_VABI sceNpMatching2ContextStart(std::uint16_t ctxId, std::uint64_t timeout);
+int APS5_VABI sceNpMatching2ContextStop(std::uint16_t ctxId);
+int APS5_VABI sceNpMatching2CreateContext(const NpMatching2CreateContextParameter* param, std::uint16_t* ctxId);
+int APS5_VABI sceNpMatching2CreateJoinRoom();
+int APS5_VABI sceNpMatching2DestroyContext(std::uint16_t ctxId);
+int APS5_VABI sceNpMatching2GetRoomDataExternalList();
+int APS5_VABI sceNpMatching2GetRoomDataInternal();
+int APS5_VABI sceNpMatching2GetRoomMemberDataInternal();
+int APS5_VABI sceNpMatching2GetServerId();
+int APS5_VABI sceNpMatching2GetUserInfoList();
+int APS5_VABI sceNpMatching2GetWorldInfoList();
+int APS5_VABI sceNpMatching2Initialize(const NpMatching2InitializeParameter* param);
+int APS5_VABI sceNpMatching2JoinRoom();
+int APS5_VABI sceNpMatching2KickoutRoomMember();
+int APS5_VABI sceNpMatching2LeaveRoom();
+int APS5_VABI sceNpMatching2RegisterContextCallback(void* callback, void* userdata);
+int APS5_VABI sceNpMatching2RegisterRoomEventCallback(std::uint16_t ctxId, void* callback, void* userdata);
+int APS5_VABI sceNpMatching2RegisterRoomMessageCallback(std::uint16_t ctxId, void* callback, void* userdata);
+int APS5_VABI sceNpMatching2RegisterSignalingCallback(std::uint16_t ctxId, void* callback, void* userdata);
+int APS5_VABI sceNpMatching2SearchRoom();
+int APS5_VABI sceNpMatching2SendRoomChatMessage();
+int APS5_VABI sceNpMatching2SendRoomMessage();
+int APS5_VABI sceNpMatching2SetDefaultRequestOptParam(std::uint16_t ctxId, const void* requestOpt);
+int APS5_VABI sceNpMatching2SetRoomDataExternal();
+int APS5_VABI sceNpMatching2SetRoomDataInternal();
+int APS5_VABI sceNpMatching2SetRoomMemberDataInternal();
+int APS5_VABI sceNpMatching2SetUserInfo();
+int APS5_VABI sceNpMatching2SignalingGetConnectionInfo();
+int APS5_VABI sceNpMatching2Terminate(void);
+
+}
diff --git a/core/libs/prx/libSceNpMatching2/libSceNpMatching2.hpp b/core/libs/prx/libSceNpMatching2/libSceNpMatching2.hpp
new file mode 100644
index 0000000000..9819896e2b
--- /dev/null
+++ b/core/libs/prx/libSceNpMatching2/libSceNpMatching2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpMatching2/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpPartner001/Export.cpp b/core/libs/prx/libSceNpPartner001/Export.cpp
index d4dbeeefd9..2a4635c7c8 100644
--- a/core/libs/prx/libSceNpPartner001/Export.cpp
+++ b/core/libs/prx/libSceNpPartner001/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpPartner001/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <atomic>
 #include <stdexcept>
diff --git a/core/libs/prx/libSceNpPartner001/include/Api.hpp b/core/libs/prx/libSceNpPartner001/include/Api.hpp
new file mode 100644
index 0000000000..7254f21010
--- /dev/null
+++ b/core/libs/prx/libSceNpPartner001/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpEAAccessInitialize(void);
+int APS5_VABI sceNpEAAccessTerminate(void);
+int APS5_VABI sceNpHasEAAccessSubscription(int userId, bool* result);
+
+}
diff --git a/core/libs/prx/libSceNpPartner001/libSceNpPartner001.hpp b/core/libs/prx/libSceNpPartner001/libSceNpPartner001.hpp
new file mode 100644
index 0000000000..83c567edd0
--- /dev/null
+++ b/core/libs/prx/libSceNpPartner001/libSceNpPartner001.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpPartner001/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpParty/Export.cpp b/core/libs/prx/libSceNpParty/Export.cpp
index 305da3f6cc..971b894470 100644
--- a/core/libs/prx/libSceNpParty/Export.cpp
+++ b/core/libs/prx/libSceNpParty/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpParty/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -48,9 +49,8 @@ int APS5_VABI sceNpPartyGetId(void* id) {
     return notInParty(id);
 }
 
-int APS5_VABI sceNpPartyGetMemberInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMemberInfo(std::uint16_t, void* memberInfo) {
+    return notInParty(memberInfo);
 }
 
 int APS5_VABI sceNpPartyGetMemberInfoA(std::uint16_t, void* memberInfo) {
@@ -65,9 +65,8 @@ int APS5_VABI sceNpPartyGetMemberVoiceInfo(std::uint16_t, std::uint16_t, std::ui
     return notInParty(memberVoiceState);
 }
 
-int APS5_VABI sceNpPartyGetMembers(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMembers(void* memberList) {
+    return notInParty(memberList);
 }
 
 int APS5_VABI sceNpPartyGetMembersA(void* memberList) {
@@ -105,17 +104,16 @@ int APS5_VABI sceNpPartyLeave(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyRegisterHandler(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpPartyRegisterHandlerA(const void* handlers, void*) {
     if (!g_initialized) return NP_PARTY_ERROR_NOT_INITIALIZED;
     if (!handlers) return NP_PARTY_ERROR_INVALID_ARGUMENT;
     return 0;
 }
 
+int APS5_VABI sceNpPartyRegisterHandler(const void* handlers, void* userdata) {
+    return sceNpPartyRegisterHandlerA(handlers, userdata);
+}
+
 int APS5_VABI sceNpPartyRegisterPrivateHandler(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceNpParty/include/Api.hpp b/core/libs/prx/libSceNpParty/include/Api.hpp
new file mode 100644
index 0000000000..8c8f33c8eb
--- /dev/null
+++ b/core/libs/prx/libSceNpParty/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpPartyGetState(std::uint16_t* state);
+int APS5_VABI sceNpPartyCheckCallback(void);
+int APS5_VABI sceNpPartyCreate(void);
+int APS5_VABI sceNpPartyCreateA(void);
+int APS5_VABI sceNpPartyGetId(void* id);
+int APS5_VABI sceNpPartyGetMemberInfo(std::uint16_t, void* memberInfo);
+int APS5_VABI sceNpPartyGetMemberInfoA(std::uint16_t, void* memberInfo);
+int APS5_VABI sceNpPartyGetMemberSessionInfo(std::uint16_t, void* memberGameSessionInfo);
+int APS5_VABI sceNpPartyGetMemberVoiceInfo(std::uint16_t, std::uint16_t, std::uint8_t* memberVoiceState);
+int APS5_VABI sceNpPartyGetMembers(void* memberList);
+int APS5_VABI sceNpPartyGetMembersA(void* memberList);
+int APS5_VABI sceNpPartyGetStateAsUser(void);
+int APS5_VABI sceNpPartyGetStateAsUserA(std::int32_t, std::uint16_t* state);
+int APS5_VABI sceNpPartyGetVoiceChatPriority(void);
+int APS5_VABI sceNpPartyInitialize(const void* param);
+int APS5_VABI sceNpPartyJoin(void);
+int APS5_VABI sceNpPartyLeave(void);
+int APS5_VABI sceNpPartyRegisterHandler(const void* handlers, void* userdata);
+int APS5_VABI sceNpPartyRegisterHandlerA(const void* handlers, void*);
+int APS5_VABI sceNpPartyRegisterPrivateHandler(void);
+int APS5_VABI sceNpPartySendBinaryMessage(const void* sendParams);
+int APS5_VABI sceNpPartySetVoiceChatPriority(void);
+int APS5_VABI sceNpPartyShowInvitationList(void);
+int APS5_VABI sceNpPartyShowInvitationListA(void);
+int APS5_VABI sceNpPartyTerminate(void);
+int APS5_VABI sceNpPartyUnregisterPrivateHandler(void);
+
+}
diff --git a/core/libs/prx/libSceNpParty/libSceNpParty.hpp b/core/libs/prx/libSceNpParty/libSceNpParty.hpp
new file mode 100644
index 0000000000..0b7c65e697
--- /dev/null
+++ b/core/libs/prx/libSceNpParty/libSceNpParty.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpParty/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpProfileDialog/Export.cpp b/core/libs/prx/libSceNpProfileDialog/Export.cpp
index a9112db530..3ece49618f 100644
--- a/core/libs/prx/libSceNpProfileDialog/Export.cpp
+++ b/core/libs/prx/libSceNpProfileDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpProfileDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <mutex>
@@ -20,24 +21,9 @@ constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
 constexpr std::uint32_t NP_PROFILE_DIALOG_MODE_NORMAL = 1;
 constexpr std::uint32_t NP_PROFILE_DIALOG_MODE_GRIEF_REPORT = 4;
 
-struct SceCommonDialogBaseParam {
-    std::uint64_t size;
-    std::uint8_t reserved[36];
-    std::uint32_t magic;
-};
 static_assert(offsetof(SceCommonDialogBaseParam, magic) == 44);
 static_assert(sizeof(SceCommonDialogBaseParam) == 48);
 
-struct SceNpProfileDialogParam {
-    SceCommonDialogBaseParam baseParam;
-    std::uint64_t size;
-    std::uint32_t mode;
-    std::int32_t userId;
-    NpOnlineId targetOnlineId;
-    std::uint8_t padding[4];
-    void* userData;
-    std::uint8_t reserved[32];
-};
 static_assert(offsetof(SceNpProfileDialogParam, size) == 48);
 static_assert(offsetof(SceNpProfileDialogParam, mode) == 56);
 static_assert(offsetof(SceNpProfileDialogParam, userId) == 60);
@@ -45,16 +31,6 @@ static_assert(offsetof(SceNpProfileDialogParam, targetOnlineId) == 64);
 static_assert(offsetof(SceNpProfileDialogParam, userData) == 88);
 static_assert(sizeof(SceNpProfileDialogParam) == 128);
 
-struct SceNpProfileDialogParamA {
-    SceCommonDialogBaseParam baseParam;
-    std::uint64_t size;
-    std::uint32_t mode;
-    std::int32_t userId;
-    std::uint64_t targetAccountId;
-    std::uint8_t padding[8];
-    void* userData;
-    std::uint8_t reserved[32];
-};
 static_assert(offsetof(SceNpProfileDialogParamA, size) == 48);
 static_assert(offsetof(SceNpProfileDialogParamA, mode) == 56);
 static_assert(offsetof(SceNpProfileDialogParamA, userId) == 60);
@@ -62,12 +38,6 @@ static_assert(offsetof(SceNpProfileDialogParamA, targetAccountId) == 64);
 static_assert(offsetof(SceNpProfileDialogParamA, userData) == 80);
 static_assert(sizeof(SceNpProfileDialogParamA) == 120);
 
-struct SceNpProfileDialogResult {
-    std::int32_t result;
-    std::int32_t userAction;
-    void* userData;
-    std::uint8_t reserved[32];
-};
 static_assert(offsetof(SceNpProfileDialogResult, userAction) == 4);
 static_assert(offsetof(SceNpProfileDialogResult, userData) == 8);
 static_assert(offsetof(SceNpProfileDialogResult, reserved) == 16);
diff --git a/core/libs/prx/libSceNpProfileDialog/include/Api.hpp b/core/libs/prx/libSceNpProfileDialog/include/Api.hpp
new file mode 100644
index 0000000000..b505733fc0
--- /dev/null
+++ b/core/libs/prx/libSceNpProfileDialog/include/Api.hpp
@@ -0,0 +1,56 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+
+struct SceCommonDialogBaseParam {
+    std::uint64_t size;
+    std::uint8_t reserved[36];
+    std::uint32_t magic;
+};
+
+struct SceNpProfileDialogParam {
+    SceCommonDialogBaseParam baseParam;
+    std::uint64_t size;
+    std::uint32_t mode;
+    std::int32_t userId;
+    NpOnlineId targetOnlineId;
+    std::uint8_t padding[4];
+    void* userData;
+    std::uint8_t reserved[32];
+};
+
+struct SceNpProfileDialogParamA {
+    SceCommonDialogBaseParam baseParam;
+    std::uint64_t size;
+    std::uint32_t mode;
+    std::int32_t userId;
+    std::uint64_t targetAccountId;
+    std::uint8_t padding[8];
+    void* userData;
+    std::uint8_t reserved[32];
+};
+
+struct SceNpProfileDialogResult {
+    std::int32_t result;
+    std::int32_t userAction;
+    void* userData;
+    std::uint8_t reserved[32];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpProfileDialogInitialize(void);
+int APS5_VABI sceNpProfileDialogTerminate(void);
+int APS5_VABI sceNpProfileDialogUpdateStatus(void);
+int APS5_VABI sceNpProfileDialogGetStatus(void);
+int APS5_VABI sceNpProfileDialogOpen(const SceNpProfileDialogParam* param);
+int APS5_VABI sceNpProfileDialogOpenA(const SceNpProfileDialogParamA* param);
+int APS5_VABI sceNpProfileDialogClose(void);
+int APS5_VABI sceNpProfileDialogGetResult(SceNpProfileDialogResult* result);
+
+}
diff --git a/core/libs/prx/libSceNpProfileDialog/libSceNpProfileDialog.hpp b/core/libs/prx/libSceNpProfileDialog/libSceNpProfileDialog.hpp
new file mode 100644
index 0000000000..8cfbbcbcd4
--- /dev/null
+++ b/core/libs/prx/libSceNpProfileDialog/libSceNpProfileDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpProfileDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp b/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp
index 766da74191..a0f12e3e85 100644
--- a/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp
+++ b/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp b/core/libs/prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp
new file mode 100644
index 0000000000..9aeae0ac11
--- /dev/null
+++ b/core/libs/prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpRemotePlaySessionSignalingCreateJoinSession();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetConnectionStatus();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetCustomProperty();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetLocalNetInfo();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetMemoryInfo();
+int APS5_VABI sceNpRemotePlaySessionSignalingInitialize();
+int APS5_VABI sceNpRemotePlaySessionSignalingJoinSession();
+int APS5_VABI sceNpRemotePlaySessionSignalingLeaveSession();
+int APS5_VABI sceNpRemotePlaySessionSignalingSetCustomProperty();
+int APS5_VABI sceNpRemotePlaySessionSignalingTerminate();
+
+}
diff --git a/core/libs/prx/libSceNpRemotePlaySessionSignaling/libSceNpRemotePlaySessionSignaling.hpp b/core/libs/prx/libSceNpRemotePlaySessionSignaling/libSceNpRemotePlaySessionSignaling.hpp
new file mode 100644
index 0000000000..4c78dfe8e5
--- /dev/null
+++ b/core/libs/prx/libSceNpRemotePlaySessionSignaling/libSceNpRemotePlaySessionSignaling.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt b/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt
new file mode 100644
index 0000000000..d73264a441
--- /dev/null
+++ b/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceNpScoreRanking SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpScoreRanking PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpScoreRanking)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_score_offline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpScoreOffline.cpp)
+    target_include_directories(guest_np_score_offline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_score_offline_tests PRIVATE libSceNpScoreRanking)
+    configure_windows_unwind(guest_np_score_offline_tests)
+    add_test(NAME guest_np_score_offline COMMAND guest_np_score_offline_tests)
+    set_tests_properties(guest_np_score_offline PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_score_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpScoreRanking>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpScoreRanking/Export.cpp b/core/libs/prx/libSceNpScoreRanking/Export.cpp
index 1bb8bc6df6..1edb9c64ca 100644
--- a/core/libs/prx/libSceNpScoreRanking/Export.cpp
+++ b/core/libs/prx/libSceNpScoreRanking/Export.cpp
@@ -1,81 +1,225 @@
+#include "prx/libSceNpScoreRanking/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <unordered_map>
+#include <unordered_set>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+static constexpr int SCE_NP_ERROR_SIGNED_OUT = static_cast<int>(0x80550006);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550704);
+static constexpr int SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS = static_cast<int>(0x80550706);
+static constexpr int SCE_NP_COMMUNITY_ERROR_ABORTED = static_cast<int>(0x80550707);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT = static_cast<int>(0x8055070C);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ID = static_cast<int>(0x8055070E);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT = static_cast<int>(0x80550714);
+static constexpr int SCE_NP_COMMUNITY_ERROR_TOO_MANY_NPID = static_cast<int>(0x80550719);
+static constexpr std::uint32_t INVALID_SERVICE_LABEL = 0xFFFFFFFF;
+static constexpr std::size_t MAX_OBJECTS = 32;
+static constexpr std::uint64_t MAX_RANGE_PER_REQUEST = 100;
+static constexpr std::uint64_t MAX_NPID_PER_REQUEST = 101;
+static constexpr std::uint64_t GAME_INFO_MAX_SIZE = 189;
+static constexpr std::uint64_t NP_ID_SIZE = 36;
+static constexpr std::uint64_t RANK_DATA_SIZE = 0x80;
+static constexpr std::uint64_t PLAYER_RANK_DATA_SIZE = 0x88;
+static constexpr std::uint64_t COMMENT_SIZE = 64;
+static constexpr std::uint64_t GAME_INFO_SIZE = 200;
+static constexpr std::uint64_t FRIEND_RANKING_OPTION_SIZE = 24;
+static constexpr int POLL_FINISHED = 0;
+static constexpr int POLL_RUNNING = 1;
+
+static_assert(sizeof(NpScoreGameInfo) == GAME_INFO_SIZE);
+
+static_assert(sizeof(NpScoreFriendRankingOption) == FRIEND_RANKING_OPTION_SIZE);
+
+namespace {
+struct Request {
+    int titleCtxId = 0;
+    std::optional<int> result;
+};
+
+std::mutex scoreMutex;
+std::unordered_set<int> titleContexts;
+std::unordered_map<int, Request> requests;
+int nextTitleContext = 1;
+int nextRequest = 1;
+
+int CheckArrays(std::uint64_t arrayNum, const void* commentArray, std::uint64_t commentArraySize, const void* infoArray, std::uint64_t infoArraySize) {
+    if (commentArray && commentArraySize != arrayNum * COMMENT_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    if (infoArray && infoArraySize != arrayNum * GAME_INFO_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    return 0;
+}
+
+int Offline(int reqId) {
+    std::lock_guard lock(scoreMutex);
+    const auto request = requests.find(reqId);
+    if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (request->second.result == SCE_NP_COMMUNITY_ERROR_ABORTED) return SCE_NP_COMMUNITY_ERROR_ABORTED;
+    if (!request->second.result) request->second.result = SCE_NP_ERROR_SIGNED_OUT;
+    return SCE_NP_ERROR_SIGNED_OUT;
+}
+
+int RecordScore(int reqId, const NpScoreGameInfo* gameInfo, void* option) {
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (gameInfo && gameInfo->infoSize > GAME_INFO_MAX_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    return Offline(reqId);
+}
+
+int GetRankingByRange(int reqId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* option) {
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (arrayNum > MAX_RANGE_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (startSerialRank == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!rankArray || arrayNum == 0) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (rankArraySize != arrayNum * RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error;
+    return Offline(reqId);
+}
+
+int GetRankingByNpId(int reqId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* option) {
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (arrayNum > MAX_NPID_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_NPID;
+    if (!npIdArray || !rankArray) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (npIdArraySize != arrayNum * NP_ID_SIZE || rankArraySize != arrayNum * PLAYER_RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error;
+    return Offline(reqId);
+}
+
+int GetFriendsRanking(int reqId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, const NpScoreFriendRankingOption* option) {
+    if (!rankArray) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (rankArraySize != arrayNum * RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    std::uint32_t startSerialRank = 1;
+    if (includeSelf == 0) {
+        if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    } else if (option) {
+        if (option->size != FRIEND_RANKING_OPTION_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+        if (option->startSerialRank) startSerialRank = *option->startSerialRank;
+    }
+    if (arrayNum > MAX_RANGE_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (startSerialRank == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (arrayNum == 0) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error;
+    return Offline(reqId);
+}
+}
+
 extern "C" {
 
-int APS5_VABI sceNpScoreAbortRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpScoreAbortRequest(int reqId) {
+    std::lock_guard lock(scoreMutex);
+    const auto request = requests.find(reqId);
+    if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.result) request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED;
     return 0;
 }
 
-int APS5_VABI sceNpScoreCreateNpTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpScoreCreateNpTitleCtx(std::uint32_t serviceLabel, const void* selfNpId) {
+    if (serviceLabel == INVALID_SERVICE_LABEL) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!selfNpId) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    std::lock_guard lock(scoreMutex);
+    if (titleContexts.size() >= MAX_OBJECTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
+    const int titleCtxId = nextTitleContext++;
+    titleContexts.insert(titleCtxId);
+    return titleCtxId;
+}
+
+int APS5_VABI sceNpScoreCreateRequest(int titleCtxId) {
+    std::lock_guard lock(scoreMutex);
+    if (!titleContexts.contains(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (requests.size() >= MAX_OBJECTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
+    const int reqId = nextRequest++;
+    requests.emplace(reqId, Request{titleCtxId});
+    return reqId;
+}
+
+int APS5_VABI sceNpScoreDeleteNpTitleCtx(int titleCtxId) {
+    std::lock_guard lock(scoreMutex);
+    if (!titleContexts.erase(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    std::erase_if(requests, [titleCtxId](const auto& entry) { return entry.second.titleCtxId == titleCtxId; });
     return 0;
 }
 
-int APS5_VABI sceNpScoreCreateRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreDeleteRequest(int reqId) {
+    std::lock_guard lock(scoreMutex);
+    return requests.erase(reqId) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID;
 }
 
-int APS5_VABI sceNpScoreDeleteNpTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetBoardInfo(int reqId, std::uint32_t boardId, void* boardInfo, void* option) {
+    (void)boardId;
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!boardInfo) throw std::runtime_error("sceNpScoreGetBoardInfo: the answer for a null board info depends on the title's SDK version");
+    return Offline(reqId);
 }
 
-int APS5_VABI sceNpScoreDeleteRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetFriendsRanking(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetFriendsRanking(reqId, includeSelf, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetBoardInfo() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetFriendsRankingAsync(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetFriendsRanking(reqId, includeSelf, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetFriendsRanking() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByNpId(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByNpId(reqId, npIdArray, npIdArraySize, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetFriendsRankingAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByNpIdAsync(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByNpId(reqId, npIdArray, npIdArraySize, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetRankingByNpId() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByRange(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByRange(reqId, startSerialRank, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetRankingByNpIdAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByRangeAsync(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByRange(reqId, startSerialRank, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetRankingByRange() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScorePollAsync(int reqId, int* result) {
+    std::lock_guard lock(scoreMutex);
+    const auto request = requests.find(reqId);
+    if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.result) return POLL_RUNNING;
+    if (result) *result = *request->second.result;
+    return POLL_FINISHED;
 }
 
-int APS5_VABI sceNpScoreGetRankingByRangeAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreRecordScore(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option) {
+    (void)boardId;
+    (void)score;
+    (void)scoreComment;
+    (void)tmpRank;
+    (void)compareDate;
+    return RecordScore(reqId, gameInfo, option);
 }
 
-int APS5_VABI sceNpScorePollAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpScoreRecordScore() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpScoreRecordScoreAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreRecordScoreAsync(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option) {
+    (void)boardId;
+    (void)score;
+    (void)scoreComment;
+    (void)tmpRank;
+    (void)compareDate;
+    return RecordScore(reqId, gameInfo, option);
 }
 
 }
diff --git a/core/libs/prx/libSceNpScoreRanking/include/Api.hpp b/core/libs/prx/libSceNpScoreRanking/include/Api.hpp
new file mode 100644
index 0000000000..3a665215ec
--- /dev/null
+++ b/core/libs/prx/libSceNpScoreRanking/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpScoreFriendRankingOption {
+    std::uint64_t size;
+    const std::uint32_t* startSerialRank;
+    const std::uint32_t* hits;
+};
+
+struct NpScoreGameInfo {
+    std::uint64_t infoSize;
+    std::uint8_t data[189];
+    std::uint8_t pad[3];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpScoreAbortRequest(int reqId);
+int APS5_VABI sceNpScoreCreateNpTitleCtx(std::uint32_t serviceLabel, const void* selfNpId);
+int APS5_VABI sceNpScoreCreateRequest(int titleCtxId);
+int APS5_VABI sceNpScoreDeleteNpTitleCtx(int titleCtxId);
+int APS5_VABI sceNpScoreDeleteRequest(int reqId);
+int APS5_VABI sceNpScoreGetBoardInfo(int reqId, std::uint32_t boardId, void* boardInfo, void* option);
+int APS5_VABI sceNpScoreGetFriendsRanking(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option);
+int APS5_VABI sceNpScoreGetFriendsRankingAsync(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option);
+int APS5_VABI sceNpScoreGetRankingByNpId(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScoreGetRankingByNpIdAsync(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScoreGetRankingByRange(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScoreGetRankingByRangeAsync(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScorePollAsync(int reqId, int* result);
+int APS5_VABI sceNpScoreRecordScore(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option);
+int APS5_VABI sceNpScoreRecordScoreAsync(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option);
+
+}
diff --git a/core/libs/prx/libSceNpScoreRanking/libSceNpScoreRanking.hpp b/core/libs/prx/libSceNpScoreRanking/libSceNpScoreRanking.hpp
new file mode 100644
index 0000000000..312ac2276e
--- /dev/null
+++ b/core/libs/prx/libSceNpScoreRanking/libSceNpScoreRanking.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpScoreRanking/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSessionSignaling/Export.cpp b/core/libs/prx/libSceNpSessionSignaling/Export.cpp
index 3e6da147ed..1123e55333 100644
--- a/core/libs/prx/libSceNpSessionSignaling/Export.cpp
+++ b/core/libs/prx/libSceNpSessionSignaling/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSessionSignaling/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -25,79 +26,6 @@ static std::mutex g_mutex;
 static bool g_initialized = false;
 static std::array<SessionSignalingContext, 10> g_contexts{};
 
-struct SessionSignalingInitParam {
-    std::int32_t userId;
-    std::uint64_t poolSize;
-    std::uint64_t affinityMask;
-    std::int32_t threadPriority;
-    std::uint64_t stackSize;
-};
-
-struct SessionSignalingMemoryInfo {
-    std::uint64_t poolSize;
-    std::uint64_t usedSize;
-    std::uint64_t peakUsedSize;
-};
-
-struct SessionSignalingPeerAddress {
-    std::uint64_t accountId;
-    std::uint32_t platform;
-};
-
-struct SessionSignalingSessionParam {
-    std::uint32_t mode;
-    std::uint32_t option;
-};
-
-struct SessionSignalingNetAddress {
-    std::uint32_t address;
-    std::uint16_t port;
-};
-
-union SessionSignalingConnectionInfo {
-    std::uint32_t value;
-    SessionSignalingNetAddress netAddress;
-    SessionSignalingPeerAddress peerAddress;
-};
-
-struct SessionSignalingLocalNetInfo {
-    std::uint32_t localAddress;
-    std::uint32_t mappedAddress;
-    std::uint32_t mappedPort;
-    std::uint32_t mappingStatus;
-};
-
-using SessionSignalingEventCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, const SessionSignalingPeerAddress*, std::int32_t, void*);
-using SessionSignalingConnectionCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
-using SessionSignalingConnectionCallback2 = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
-
-template<typename TConnectionCallback>
-struct SessionSignalingContextParam {
-    std::int32_t userId;
-    std::uint32_t serviceLabel;
-    SessionSignalingEventCallback prepareCallback;
-    void* prepareUserData;
-    SessionSignalingEventCallback sessionCallback;
-    void* sessionUserData;
-    TConnectionCallback connectionCallback;
-    void* connectionUserData;
-};
-
-using SessionSignalingContextParam1 = SessionSignalingContextParam<SessionSignalingConnectionCallback>;
-using SessionSignalingContextParam2 = SessionSignalingContextParam<SessionSignalingConnectionCallback2>;
-
-struct SessionSignalingConnectionStatistics {
-    std::uint32_t peakConnectionCount;
-    std::uint32_t connectionCount;
-    std::uint32_t connectingCount;
-    std::uint32_t connectedCount;
-};
-
-struct SessionSignalingGroupInfo {
-    std::uint32_t connectionIds[64];
-    std::uint64_t connectionCount;
-};
-
 static_assert(sizeof(SessionSignalingMemoryInfo) == 24);
 static_assert(sizeof(SessionSignalingInitParam) == 40);
 static_assert(offsetof(SessionSignalingInitParam, poolSize) == 8);
diff --git a/core/libs/prx/libSceNpSessionSignaling/include/Api.hpp b/core/libs/prx/libSceNpSessionSignaling/include/Api.hpp
new file mode 100644
index 0000000000..948b313253
--- /dev/null
+++ b/core/libs/prx/libSceNpSessionSignaling/include/Api.hpp
@@ -0,0 +1,114 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+
+struct SessionSignalingInitParam {
+    std::int32_t userId;
+    std::uint64_t poolSize;
+    std::uint64_t affinityMask;
+    std::int32_t threadPriority;
+    std::uint64_t stackSize;
+};
+
+struct SessionSignalingMemoryInfo {
+    std::uint64_t poolSize;
+    std::uint64_t usedSize;
+    std::uint64_t peakUsedSize;
+};
+
+struct SessionSignalingPeerAddress {
+    std::uint64_t accountId;
+    std::uint32_t platform;
+};
+
+struct SessionSignalingSessionParam {
+    std::uint32_t mode;
+    std::uint32_t option;
+};
+
+struct SessionSignalingNetAddress {
+    std::uint32_t address;
+    std::uint16_t port;
+};
+
+union SessionSignalingConnectionInfo {
+    std::uint32_t value;
+    SessionSignalingNetAddress netAddress;
+    SessionSignalingPeerAddress peerAddress;
+};
+
+struct SessionSignalingLocalNetInfo {
+    std::uint32_t localAddress;
+    std::uint32_t mappedAddress;
+    std::uint32_t mappedPort;
+    std::uint32_t mappingStatus;
+};
+
+using SessionSignalingEventCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, const SessionSignalingPeerAddress*, std::int32_t, void*);
+
+using SessionSignalingConnectionCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
+
+using SessionSignalingConnectionCallback2 = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
+
+template<typename TConnectionCallback>
+struct SessionSignalingContextParam {
+    std::int32_t userId;
+    std::uint32_t serviceLabel;
+    SessionSignalingEventCallback prepareCallback;
+    void* prepareUserData;
+    SessionSignalingEventCallback sessionCallback;
+    void* sessionUserData;
+    TConnectionCallback connectionCallback;
+    void* connectionUserData;
+};
+
+using SessionSignalingContextParam1 = SessionSignalingContextParam<SessionSignalingConnectionCallback>;
+
+using SessionSignalingContextParam2 = SessionSignalingContextParam<SessionSignalingConnectionCallback2>;
+
+struct SessionSignalingConnectionStatistics {
+    std::uint32_t peakConnectionCount;
+    std::uint32_t connectionCount;
+    std::uint32_t connectingCount;
+    std::uint32_t connectedCount;
+};
+
+struct SessionSignalingGroupInfo {
+    std::uint32_t connectionIds[64];
+    std::uint64_t connectionCount;
+};
+
+extern "C" {
+
+int APS5_VABI sceNpSessionSignalingInitialize(const SessionSignalingInitParam* param);
+int APS5_VABI sceNpSessionSignalingActivateSession(std::uint32_t contextId, const char* sessionId, std::uint32_t sessionType, const SessionSignalingSessionParam* param, std::uint32_t* groupId);
+int APS5_VABI sceNpSessionSignalingCreateContext2(const SessionSignalingContextParam2* param, std::uint32_t* contextId);
+int APS5_VABI sceNpSessionSignalingCreateContext(const SessionSignalingContextParam1* param, std::uint32_t* contextId);
+int APS5_VABI sceNpSessionSignalingDeactivate(std::uint32_t contextId, std::uint32_t connectionId);
+int APS5_VABI sceNpSessionSignalingDestroyContext(std::uint32_t contextId);
+int APS5_VABI sceNpSessionSignalingGetConnectionInfo(std::uint32_t contextId, std::uint32_t connectionId, std::uint32_t code, SessionSignalingConnectionInfo* info);
+int APS5_VABI sceNpSessionSignalingActivateUser(std::uint32_t contextId, const SessionSignalingPeerAddress* peerAddress, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingGetConnectionFromPeerAddress2(std::uint32_t contextId, std::uint32_t groupId, const SessionSignalingPeerAddress* peerAddress, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingTerminate(void);
+int32_t APS5_VABI sceNpSessionSignalingGetConnectionStatus(std::uint32_t contextId, std::uint32_t connectionId, std::int32_t* status, std::uint32_t* peerAddress, std::uint16_t* peerPort);
+int32_t APS5_VABI sceNpSessionSignalingGetLocalNetInfo(std::uint32_t contextId, SessionSignalingLocalNetInfo* info);
+int APS5_VABI sceNpSessionSignalingRequestPrepare(uint32_t contextId, uint32_t* requestId);
+int APS5_VABI sceNpSessionSignalingGetMemoryInfo(SessionSignalingMemoryInfo* memoryInfo);
+int APS5_VABI sceNpSessionSignalingGetConnectionStatistics(SessionSignalingConnectionStatistics* statistics);
+int APS5_VABI sceNpSessionSignalingGetConnectionFromPeerAddress(std::uint32_t contextId, const SessionSignalingPeerAddress* peerAddress, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingGetGroupFromSessionId(std::uint32_t contextId, const char* sessionId, std::uint32_t* groupId);
+int APS5_VABI sceNpSessionSignalingGetGroupInfo(std::uint32_t contextId, std::uint32_t groupId, SessionSignalingGroupInfo* groupInfo);
+int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress2(std::uint32_t contextId, std::uint32_t groupId, std::uint32_t address, std::uint16_t port, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingCreateJoinActivate();
+int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress(std::uint32_t contextId, std::uint32_t address, std::uint16_t port, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingGetCustomProperty();
+int APS5_VABI sceNpSessionSignalingGetGroupFromPeerAddress();
+int APS5_VABI sceNpSessionSignalingInitializeWithPort();
+int APS5_VABI sceNpSessionSignalingJoinActivate();
+int APS5_VABI sceNpSessionSignalingSetCustomProperty();
+
+}
diff --git a/core/libs/prx/libSceNpSessionSignaling/libSceNpSessionSignaling.hpp b/core/libs/prx/libSceNpSessionSignaling/libSceNpSessionSignaling.hpp
new file mode 100644
index 0000000000..8cdf796fb6
--- /dev/null
+++ b/core/libs/prx/libSceNpSessionSignaling/libSceNpSessionSignaling.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSessionSignaling/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSignaling/Export.cpp b/core/libs/prx/libSceNpSignaling/Export.cpp
index 77fb201139..00f307beb5 100644
--- a/core/libs/prx/libSceNpSignaling/Export.cpp
+++ b/core/libs/prx/libSceNpSignaling/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSignaling/include/Api.hpp"
 #include <cstdint>
 #include <cstring>
 #include <mutex>
@@ -161,4 +162,12 @@ int APS5_VABI sceNpSignalingTerminateConnection(int ctxId, int connId) {
     return SCE_NP_SIGNALING_ERROR_CONN_NOT_FOUND;
 }
 
+int APS5_VABI sceNpSignalingDeactivateConnection(int ctxId, int connId) {
+    (void)connId;
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!FindContext(ctxId)) return SCE_NP_SIGNALING_ERROR_CTX_NOT_FOUND;
+    return SCE_NP_SIGNALING_ERROR_CONN_NOT_FOUND;
+}
+
 }
diff --git a/core/libs/prx/libSceNpSignaling/include/Api.hpp b/core/libs/prx/libSceNpSignaling/include/Api.hpp
new file mode 100644
index 0000000000..d11753e6d8
--- /dev/null
+++ b/core/libs/prx/libSceNpSignaling/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSignalingActivateConnection(int ctxId, const void* peerNpId, int* outConnId);
+int APS5_VABI sceNpSignalingCreateContext(const void* npId, void* callback, void* callbackArg, int* outContextId);
+int APS5_VABI sceNpSignalingDeleteContext(int ctxId);
+int APS5_VABI sceNpSignalingGetConnectionInfo(int ctxId, int connId, int infoCode, void* outInfo);
+int APS5_VABI sceNpSignalingInitialize(std::int64_t memorySize, int threadPriority, int cpuAffinityMask, std::int64_t threadStackSize);
+int APS5_VABI sceNpSignalingSetContextOption(int ctxId, int optionId, int optionValue);
+int APS5_VABI sceNpSignalingTerminate();
+int APS5_VABI sceNpSignalingTerminateConnection(int ctxId, int connId);
+int APS5_VABI sceNpSignalingDeactivateConnection(int ctxId, int connId);
+
+}
diff --git a/core/libs/prx/libSceNpSignaling/libSceNpSignaling.hpp b/core/libs/prx/libSceNpSignaling/libSceNpSignaling.hpp
new file mode 100644
index 0000000000..4ab0459137
--- /dev/null
+++ b/core/libs/prx/libSceNpSignaling/libSceNpSignaling.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSignaling/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSns/Export.cpp b/core/libs/prx/libSceNpSns/Export.cpp
index c6647c709c..8fe590490d 100644
--- a/core/libs/prx/libSceNpSns/Export.cpp
+++ b/core/libs/prx/libSceNpSns/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSns/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpSns/include/Api.hpp b/core/libs/prx/libSceNpSns/include/Api.hpp
new file mode 100644
index 0000000000..201afcfef4
--- /dev/null
+++ b/core/libs/prx/libSceNpSns/include/Api.hpp
@@ -0,0 +1,29 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSnsFacebookAbortRequest();
+int APS5_VABI sceNpSnsIntAbortRequest();
+int APS5_VABI sceNpSnsIntCreateRequest();
+int APS5_VABI sceNpSnsIntDeleteRequest();
+int APS5_VABI sceNpSnsIntFbGetGameAccessToken();
+int APS5_VABI sceNpSnsIntFbGetGameAccessTokenAllowed();
+int APS5_VABI sceNpSnsIntFbGetSystemAccessToken();
+int APS5_VABI sceNpSnsIntFbGetTitleInfo();
+int APS5_VABI sceNpSnsIntLinkedStatus();
+int APS5_VABI sceNpSnsIntTwGetSystemAccessToken();
+int APS5_VABI sceNpSnsIntUnlink();
+int APS5_VABI sceNpSnsIntYtGetAccessToken();
+int APS5_VABI sceNpSnsIntYtRefreshMasterToken();
+int APS5_VABI sceNpSnsTwitchAbortRequest();
+int APS5_VABI sceNpSnsTwitchCreateRequest();
+int APS5_VABI sceNpSnsTwitchDeleteRequest();
+int APS5_VABI sceNpSnsTwitchGetAccessToken();
+int APS5_VABI sceNpSnsYouTubeAbortRequest();
+int APS5_VABI sceNpSnsYouTubeCreateRequest();
+int APS5_VABI sceNpSnsYouTubeDeleteRequest();
+int APS5_VABI sceNpSnsYouTubeGetAccessToken();
+
+}
diff --git a/core/libs/prx/libSceNpSns/libSceNpSns.hpp b/core/libs/prx/libSceNpSns/libSceNpSns.hpp
new file mode 100644
index 0000000000..24cb3940ad
--- /dev/null
+++ b/core/libs/prx/libSceNpSns/libSceNpSns.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSns/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp b/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp
index e61b490597..ebad76b2f2 100644
--- a/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp
+++ b/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSnsFacebookDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceNpSnsFacebookDialog/include/Api.hpp b/core/libs/prx/libSceNpSnsFacebookDialog/include/Api.hpp
new file mode 100644
index 0000000000..e201d488c8
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsFacebookDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSnsFacebookDialogInitialize(void);
+int APS5_VABI sceNpSnsFacebookDialogOpen(const void* param);
+int APS5_VABI sceNpSnsFacebookDialogUpdateStatus(void);
+int APS5_VABI sceNpSnsFacebookDialogGetStatus(void);
+int APS5_VABI sceNpSnsFacebookDialogGetResult(void* result);
+int APS5_VABI sceNpSnsFacebookDialogClose(void);
+int APS5_VABI sceNpSnsFacebookDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceNpSnsFacebookDialog/libSceNpSnsFacebookDialog.hpp b/core/libs/prx/libSceNpSnsFacebookDialog/libSceNpSnsFacebookDialog.hpp
new file mode 100644
index 0000000000..0401a2b8be
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsFacebookDialog/libSceNpSnsFacebookDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSnsFacebookDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp b/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp
index e1b07d4bfc..8aacd8784b 100644
--- a/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp
+++ b/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSnsYouTubeDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpSnsYouTubeDialog/include/Api.hpp b/core/libs/prx/libSceNpSnsYouTubeDialog/include/Api.hpp
new file mode 100644
index 0000000000..f2283cb2cf
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsYouTubeDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSnsYouTubeDialogClose();
+int APS5_VABI sceNpSnsYouTubeDialogGetResult();
+int APS5_VABI sceNpSnsYouTubeDialogGetStatus();
+int APS5_VABI sceNpSnsYouTubeDialogInitialize();
+int APS5_VABI sceNpSnsYouTubeDialogOpen();
+int APS5_VABI sceNpSnsYouTubeDialogTerminate();
+int APS5_VABI sceNpSnsYouTubeDialogUpdateStatus();
+
+}
diff --git a/core/libs/prx/libSceNpSnsYouTubeDialog/libSceNpSnsYouTubeDialog.hpp b/core/libs/prx/libSceNpSnsYouTubeDialog/libSceNpSnsYouTubeDialog.hpp
new file mode 100644
index 0000000000..138afadcec
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsYouTubeDialog/libSceNpSnsYouTubeDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSnsYouTubeDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSpeechToText/libSceNpSpeechToText.hpp b/core/libs/prx/libSceNpSpeechToText/libSceNpSpeechToText.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNpSpeechToText/libSceNpSpeechToText.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNpTcs/Export.cpp b/core/libs/prx/libSceNpTcs/Export.cpp
index 483b8fa844..f496f8ffbf 100644
--- a/core/libs/prx/libSceNpTcs/Export.cpp
+++ b/core/libs/prx/libSceNpTcs/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTcs/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpTcs/include/Api.hpp b/core/libs/prx/libSceNpTcs/include/Api.hpp
new file mode 100644
index 0000000000..656b047bae
--- /dev/null
+++ b/core/libs/prx/libSceNpTcs/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpTcsIntDownloadData();
+int APS5_VABI sceNpTcsIntUploadDataToNewSlotAbort();
+int APS5_VABI sceNpTcsIntUploadDataToNewSlotBegin();
+
+}
diff --git a/core/libs/prx/libSceNpTcs/libSceNpTcs.hpp b/core/libs/prx/libSceNpTcs/libSceNpTcs.hpp
new file mode 100644
index 0000000000..cf84369ec2
--- /dev/null
+++ b/core/libs/prx/libSceNpTcs/libSceNpTcs.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTcs/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpTextToSpeech/libSceNpTextToSpeech.hpp b/core/libs/prx/libSceNpTextToSpeech/libSceNpTextToSpeech.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNpTextToSpeech/libSceNpTextToSpeech.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNpTrophy/Export.cpp b/core/libs/prx/libSceNpTrophy/Export.cpp
index aad30b5af0..85960c527c 100644
--- a/core/libs/prx/libSceNpTrophy/Export.cpp
+++ b/core/libs/prx/libSceNpTrophy/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy/include/Api.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
@@ -17,6 +18,7 @@ namespace {
 
 constexpr int NP_TROPHY_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80551604u);
 constexpr int NP_TROPHY_ERROR_INSUFFICIENT_BUFFER = static_cast<int>(0x80551605u);
+constexpr int NP_TROPHY_ERROR_ABORT = static_cast<int>(0x80551607u);
 constexpr int NP_TROPHY_ERROR_INVALID_HANDLE = static_cast<int>(0x80551608u);
 constexpr int NP_TROPHY_ERROR_INVALID_CONTEXT = static_cast<int>(0x80551609u);
 constexpr int NP_TROPHY_ERROR_INVALID_TROPHY_ID = static_cast<int>(0x8055160au);
@@ -30,14 +32,24 @@ constexpr int NP_TROPHY_ERROR_INVALID_TRP_FILE_FORMAT = static_cast<int>(0x80551
 constexpr int NP_TROPHY_ERROR_TROPHY_NOT_UNLOCKED = static_cast<int>(0x8055161au);
 constexpr int NP_TROPHY_ERROR_TITLE_CONF_NOT_INSTALLED = static_cast<int>(0x80551626u);
 constexpr int NP_TROPHY_INVALID_ID = -1;
-constexpr int NP_TROPHY_NUM_MAX = 128;
+
+constexpr int NP_TROPHY_GRADE_UNKNOWN = 0;
+constexpr int NP_TROPHY_BASE_GAME_GROUP_ID = -1;
 constexpr std::uint32_t TrpMagic = 0xdca24d00u;
 constexpr std::size_t TrpHeaderBytes = 0x60;
 constexpr std::size_t TrpEntryBytes = 0x40;
 
-struct TrophyFlagArray {
-    std::uint32_t bits[NP_TROPHY_NUM_MAX / 32];
-};
+static_assert(sizeof(GameDetails) == 0x4a0);
+
+static_assert(sizeof(GameData) == 0x20);
+
+static_assert(sizeof(GroupDetails) == 0x4a0);
+
+static_assert(sizeof(GroupData) == 0x28);
+
+static_assert(sizeof(TrophyDetails) == 0x498);
+
+static_assert(sizeof(TrophyData) == 0x18);
 
 struct TrpEntry {
     std::uint64_t offset;
@@ -58,6 +70,7 @@ struct Context {
 std::mutex g_mutex;
 std::map<int, Context> g_contexts;
 std::set<int> g_handles;
+std::set<int> g_abortedHandles;
 int g_nextContext = 1;
 int g_nextHandle = 1;
 
@@ -114,6 +127,26 @@ int Lookup(int contextId, int handle, Context*& context) {
     return 0;
 }
 
+int LookupLive(int contextId, int handle, Context*& context) {
+    if (const int error = Lookup(contextId, handle, context)) return error;
+    return g_abortedHandles.contains(handle) ? NP_TROPHY_ERROR_ABORT : 0;
+}
+
+int Groups(const Context& context) {
+    int groups = 0;
+    for (int id = 0; id < NP_TROPHY_NUM_MAX; ++id) {
+        char icon[16];
+        std::snprintf(icon, sizeof(icon), "GR%03d.PNG", id);
+        if (!context.entries.contains(icon)) break;
+        groups = id + 1;
+    }
+    return groups;
+}
+
+std::uint32_t Progress(const Context& context) {
+    return context.trophies == 0 ? 0u : static_cast<std::uint32_t>(context.unlocked.size() * 100 / static_cast<std::size_t>(context.trophies));
+}
+
 int CopyIcon(const Context& context, const std::string& name, void* buffer, std::uint64_t* size) {
     const auto entry = context.entries.find(name);
     if (entry == context.entries.end()) return NP_TROPHY_ERROR_ICON_FILE_NOT_FOUND;
@@ -161,14 +194,22 @@ int APS5_VABI sceNpTrophyCreateHandle(int* handle) {
 
 int APS5_VABI sceNpTrophyDestroyHandle(int handle) {
     std::lock_guard lock(g_mutex);
+    g_abortedHandles.erase(handle);
     return g_handles.erase(handle) == 1 ? 0 : NP_TROPHY_ERROR_INVALID_HANDLE;
 }
 
+int APS5_VABI sceNpTrophyAbortHandle(int handle) {
+    std::lock_guard lock(g_mutex);
+    if (!g_handles.contains(handle)) return NP_TROPHY_ERROR_INVALID_HANDLE;
+    g_abortedHandles.insert(handle);
+    return 0;
+}
+
 int APS5_VABI sceNpTrophyRegisterContext(int contextId, int handle, std::uint64_t options) {
     if (options != 0) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(g_mutex);
     Context* context = nullptr;
-    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
     if (context->registered) return NP_TROPHY_ERROR_ALREADY_REGISTERED;
     char name[32];
     std::snprintf(name, sizeof(name), "trophy%02u.trp", context->serviceLabel);
@@ -194,7 +235,7 @@ int APS5_VABI sceNpTrophyGetTrophyUnlockState(int contextId, int handle, TrophyF
     if (!flags || !count) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(g_mutex);
     Context* context = nullptr;
-    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
     if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
     std::memset(flags, 0, sizeof(*flags));
     for (const auto id : context->unlocked) flags->bits[id >> 5] |= 1u << (id & 31);
@@ -206,7 +247,7 @@ int APS5_VABI sceNpTrophyUnlockTrophy(int contextId, int handle, int trophyId, i
     if (!platinumId) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(g_mutex);
     Context* context = nullptr;
-    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
     if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
     if (trophyId < 0 || trophyId >= context->trophies) return NP_TROPHY_ERROR_INVALID_TROPHY_ID;
     if (context->unlocked.contains(trophyId)) return NP_TROPHY_ERROR_TROPHY_ALREADY_UNLOCKED;
@@ -220,7 +261,7 @@ int APS5_VABI sceNpTrophyGetGameIcon(int contextId, int handle, void* buffer, st
     if (!size) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(g_mutex);
     Context* context = nullptr;
-    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
     if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
     return CopyIcon(*context, "ICON0.PNG", buffer, size);
 }
@@ -229,7 +270,7 @@ int APS5_VABI sceNpTrophyGetGroupIcon(int contextId, int handle, int groupId, vo
     if (!size) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(g_mutex);
     Context* context = nullptr;
-    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
     if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
     if (groupId < 0) return NP_TROPHY_ERROR_INVALID_GROUP_ID;
     char icon[16];
@@ -241,7 +282,7 @@ int APS5_VABI sceNpTrophyGetTrophyIcon(int contextId, int handle, int trophyId,
     if (!size) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(g_mutex);
     Context* context = nullptr;
-    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
     if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
     if (trophyId < 0 || trophyId >= context->trophies) return NP_TROPHY_ERROR_INVALID_TROPHY_ID;
     if (!context->unlocked.contains(trophyId)) return NP_TROPHY_ERROR_TROPHY_NOT_UNLOCKED;
@@ -250,18 +291,71 @@ int APS5_VABI sceNpTrophyGetTrophyIcon(int contextId, int handle, int trophyId,
     return CopyIcon(*context, icon, buffer, size);
 }
 
-int APS5_VABI sceNpTrophyGetGameInfo() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpTrophyGetGameInfo(int contextId, int handle, GameDetails* details, GameData* data) {
+    if (!details && !data) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    if ((details && details->size != sizeof(GameDetails)) || (data && data->size != sizeof(GameData))) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(g_mutex);
+    Context* context = nullptr;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
+    if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
+    if (details) {
+        std::memset(reinterpret_cast<std::uint8_t*>(details) + sizeof(details->size), 0, sizeof(GameDetails) - sizeof(details->size));
+        details->numGroups = static_cast<std::uint32_t>(Groups(*context));
+        details->numTrophies = static_cast<std::uint32_t>(context->trophies);
+    }
+    if (data) {
+        std::memset(reinterpret_cast<std::uint8_t*>(data) + sizeof(data->size), 0, sizeof(GameData) - sizeof(data->size));
+        data->unlockedTrophies = static_cast<std::uint32_t>(context->unlocked.size());
+        data->progressPercentage = Progress(*context);
+    }
     return 0;
 }
 
-int APS5_VABI sceNpTrophyGetGroupInfo() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpTrophyGetGroupInfo(int contextId, int handle, int groupId, GroupDetails* details, GroupData* data) {
+    if (!details && !data) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    if ((details && details->size != sizeof(GroupDetails)) || (data && data->size != sizeof(GroupData))) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(g_mutex);
+    Context* context = nullptr;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
+    if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
+    if (groupId != NP_TROPHY_BASE_GAME_GROUP_ID) {
+        if (groupId < 0 || groupId >= Groups(*context)) return NP_TROPHY_ERROR_INVALID_GROUP_ID;
+        NotImplemented_nid_no_patch(__func__);
+    }
+    if (details) {
+        std::memset(reinterpret_cast<std::uint8_t*>(details) + sizeof(details->size), 0, sizeof(GroupDetails) - sizeof(details->size));
+        details->groupId = groupId;
+        details->numTrophies = static_cast<std::uint32_t>(context->trophies);
+    }
+    if (data) {
+        std::memset(reinterpret_cast<std::uint8_t*>(data) + sizeof(data->size), 0, sizeof(GroupData) - sizeof(data->size));
+        data->groupId = groupId;
+        data->unlockedTrophies = static_cast<std::uint32_t>(context->unlocked.size());
+        data->progressPercentage = Progress(*context);
+    }
     return 0;
 }
 
-int APS5_VABI sceNpTrophyGetTrophyInfo() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpTrophyGetTrophyInfo(int contextId, int handle, int trophyId, TrophyDetails* details, TrophyData* data) {
+    if (!details && !data) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    if ((details && details->size != sizeof(TrophyDetails)) || (data && data->size != sizeof(TrophyData))) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(g_mutex);
+    Context* context = nullptr;
+    if (const int error = LookupLive(contextId, handle, context)) return error;
+    if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
+    if (trophyId < 0 || trophyId >= context->trophies) return NP_TROPHY_ERROR_INVALID_TROPHY_ID;
+    if (Groups(*context) != 0) NotImplemented_nid_no_patch(__func__);
+    if (details) {
+        std::memset(reinterpret_cast<std::uint8_t*>(details) + sizeof(details->size), 0, sizeof(TrophyDetails) - sizeof(details->size));
+        details->trophyId = trophyId;
+        details->trophyGrade = NP_TROPHY_GRADE_UNKNOWN;
+        details->groupId = NP_TROPHY_BASE_GAME_GROUP_ID;
+    }
+    if (data) {
+        std::memset(reinterpret_cast<std::uint8_t*>(data) + sizeof(data->size), 0, sizeof(TrophyData) - sizeof(data->size));
+        data->trophyId = trophyId;
+        data->unlocked = context->unlocked.contains(trophyId);
+    }
     return 0;
 }
 
diff --git a/core/libs/prx/libSceNpTrophy/include/Api.hpp b/core/libs/prx/libSceNpTrophy/include/Api.hpp
new file mode 100644
index 0000000000..19339aa673
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy/include/Api.hpp
@@ -0,0 +1,93 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+inline constexpr int NP_TROPHY_NUM_MAX = 128;
+
+struct GameData {
+    std::uint64_t size;
+    std::uint32_t unlockedTrophies;
+    std::uint32_t unlockedPlatinum;
+    std::uint32_t unlockedGold;
+    std::uint32_t unlockedSilver;
+    std::uint32_t unlockedBronze;
+    std::uint32_t progressPercentage;
+};
+
+struct GameDetails {
+    std::uint64_t size;
+    std::uint32_t numGroups;
+    std::uint32_t numTrophies;
+    std::uint32_t numPlatinum;
+    std::uint32_t numGold;
+    std::uint32_t numSilver;
+    std::uint32_t numBronze;
+    char title[128];
+    char description[1024];
+};
+
+struct GroupData {
+    std::uint64_t size;
+    std::int32_t groupId;
+    std::uint32_t unlockedTrophies;
+    std::uint32_t unlockedPlatinum;
+    std::uint32_t unlockedGold;
+    std::uint32_t unlockedSilver;
+    std::uint32_t unlockedBronze;
+    std::uint32_t progressPercentage;
+    std::uint8_t reserved[4];
+};
+
+struct GroupDetails {
+    std::uint64_t size;
+    std::int32_t groupId;
+    std::uint32_t numTrophies;
+    std::uint32_t numPlatinum;
+    std::uint32_t numGold;
+    std::uint32_t numSilver;
+    std::uint32_t numBronze;
+    char title[128];
+    char description[1024];
+};
+
+struct TrophyData {
+    std::uint64_t size;
+    std::int32_t trophyId;
+    bool unlocked;
+    std::uint8_t reserved[3];
+    std::uint64_t timestamp;
+};
+
+struct TrophyDetails {
+    std::uint64_t size;
+    std::int32_t trophyId;
+    std::int32_t trophyGrade;
+    std::int32_t groupId;
+    bool hidden;
+    std::uint8_t reserved[3];
+    char name[128];
+    char description[1024];
+};
+
+struct TrophyFlagArray {
+    std::uint32_t bits[NP_TROPHY_NUM_MAX / 32];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpTrophyCreateContext(int* context, int userId, std::uint32_t serviceLabel, std::uint64_t options);
+int APS5_VABI sceNpTrophyDestroyContext(int context);
+int APS5_VABI sceNpTrophyCreateHandle(int* handle);
+int APS5_VABI sceNpTrophyDestroyHandle(int handle);
+int APS5_VABI sceNpTrophyAbortHandle(int handle);
+int APS5_VABI sceNpTrophyRegisterContext(int contextId, int handle, std::uint64_t options);
+int APS5_VABI sceNpTrophyGetTrophyUnlockState(int contextId, int handle, TrophyFlagArray* flags, std::uint32_t* count);
+int APS5_VABI sceNpTrophyUnlockTrophy(int contextId, int handle, int trophyId, int* platinumId);
+int APS5_VABI sceNpTrophyGetGameIcon(int contextId, int handle, void* buffer, std::uint64_t* size);
+int APS5_VABI sceNpTrophyGetGroupIcon(int contextId, int handle, int groupId, void* buffer, std::uint64_t* size);
+int APS5_VABI sceNpTrophyGetTrophyIcon(int contextId, int handle, int trophyId, void* buffer, std::uint64_t* size);
+int APS5_VABI sceNpTrophyGetGameInfo(int contextId, int handle, GameDetails* details, GameData* data);
+int APS5_VABI sceNpTrophyGetGroupInfo(int contextId, int handle, int groupId, GroupDetails* details, GroupData* data);
+int APS5_VABI sceNpTrophyGetTrophyInfo(int contextId, int handle, int trophyId, TrophyDetails* details, TrophyData* data);
+
+}
diff --git a/core/libs/prx/libSceNpTrophy/libSceNpTrophy.hpp b/core/libs/prx/libSceNpTrophy/libSceNpTrophy.hpp
new file mode 100644
index 0000000000..f808efbd11
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy/libSceNpTrophy.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTrophy/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpTrophy2/Export.cpp b/core/libs/prx/libSceNpTrophy2/Export.cpp
index 9befeb73c9..8a46b8a803 100644
--- a/core/libs/prx/libSceNpTrophy2/Export.cpp
+++ b/core/libs/prx/libSceNpTrophy2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpTrophy2/include/Api.hpp b/core/libs/prx/libSceNpTrophy2/include/Api.hpp
new file mode 100644
index 0000000000..052446ff82
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy2/include/Api.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpTrophy2SystemAbortHandle(void);
+int APS5_VABI sceNpTrophy2SystemBuildGroupIconUri(void);
+int APS5_VABI sceNpTrophy2SystemBuildRewardIconUri(void);
+int APS5_VABI sceNpTrophy2SystemBuildTrophyIconUri(void);
+int APS5_VABI sceNpTrophy2SystemCheckCallback(void);
+int APS5_VABI sceNpTrophy2SystemCheckNetSyncTitles(void);
+int APS5_VABI sceNpTrophy2SystemCreateContext(void);
+int APS5_VABI sceNpTrophy2SystemCreateHandle(void);
+int APS5_VABI sceNpTrophy2SystemDebugLockTrophy(void);
+int APS5_VABI sceNpTrophy2SystemDebugUnlockTrophy(void);
+int APS5_VABI sceNpTrophy2SystemDestroyContext(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyDetails(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyGroupConf(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophySetArray(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyTitleConf(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyTitleDetails(void);
+int APS5_VABI sceNpTrophy2SystemGetTrpIconByUri(void);
+int APS5_VABI sceNpTrophy2SystemIsServerAvailable(void);
+int APS5_VABI sceNpTrophy2SystemRegisterTitleSyncedCallback(void);
+int APS5_VABI sceNpTrophy2SystemRegisterTitleUpdateCallback(void);
+int APS5_VABI sceNpTrophy2SystemRemoveAll(void);
+int APS5_VABI sceNpTrophy2SystemRemoveTitleData(void);
+int APS5_VABI sceNpTrophy2SystemRemoveUserData(void);
+int APS5_VABI sceNpTrophy2CreateContext(int* context, int userId, uint32_t serviceLabel, uint64_t options);
+int APS5_VABI sceNpTrophy2DestroyContext(int context);
+int APS5_VABI sceNpTrophy2RegisterContext(int context, int handle, uint64_t options);
+int APS5_VABI sceNpTrophy2UnregisterUnlockCallback();
+int APS5_VABI sceNpTrophy2GetRewardIcon(int context, int handle, int rewardId, void* buffer, size_t* size);
+int APS5_VABI sceNpTrophy2ShowTrophyList(int context);
+int APS5_VABI sceNpTrophy2GetGameInfo(int context, int handle, NpTrophy2GameDetails* details, NpTrophy2GameData* data);
+int APS5_VABI sceNpTrophy2GetGameIcon(int context, int handle, void* buffer, size_t* size);
+int APS5_VABI sceNpTrophy2RegisterUnlockCallback(void* callback, void* userdata);
+int APS5_VABI sceNpTrophy2GetGroupInfo(int context, int handle, int groupId, NpTrophy2GroupDetails* details, NpTrophy2GroupData* data);
+int APS5_VABI sceNpTrophy2GetGroupInfoArray(int context, int handle, uint32_t offset, uint32_t limit, NpTrophy2GroupDetails* detailsArray, NpTrophy2GroupData* dataArray, uint32_t* count);
+int APS5_VABI sceNpTrophy2GetGroupIcon(int context, int handle, int groupId, void* buffer, size_t* size);
+int APS5_VABI sceNpTrophy2CreateHandle(int* handle);
+int APS5_VABI sceNpTrophy2DestroyHandle(int handle);
+int APS5_VABI sceNpTrophy2AbortHandle(int handle);
+int APS5_VABI sceNpTrophy2GetTrophyInfo(int context, int handle, int trophyId, NpTrophy2Details* details, NpTrophy2Data* data);
+int APS5_VABI sceNpTrophy2GetTrophyInfoArray(int context, int handle, uint32_t offset, uint32_t limit, NpTrophy2Details* detailsArray, NpTrophy2Data* dataArray, uint32_t* count);
+int APS5_VABI sceNpTrophy2GetTrophyIcon(int context, int handle, int trophyId, void* buffer, size_t* size);
+
+}
diff --git a/core/libs/prx/libSceNpTrophy2/include/TrophyPackage.hpp b/core/libs/prx/libSceNpTrophy2/include/TrophyPackage.hpp
index 4be4238929..f493e67ea1 100644
--- a/core/libs/prx/libSceNpTrophy2/include/TrophyPackage.hpp
+++ b/core/libs/prx/libSceNpTrophy2/include/TrophyPackage.hpp
@@ -89,17 +89,27 @@ struct TrophyPackage {
 
 TrophyPackage ParseTrophyPackage(std::string_view ucp, std::string_view language);
 
-enum class StatType { UInt32, UInt64 };
+enum class StatType { UInt32, UInt64, Int32 };
+
+enum class StatAggregation { Latest, Max };
 
 struct StatDefinition {
     StatType type = StatType::UInt64;
+    StatAggregation aggregation = StatAggregation::Latest;
     std::uint64_t minimum = 0;
     std::uint64_t maximum = UINT64_MAX;
+    std::uint64_t initial = 0;
+};
+
+struct StatFilter {
+    std::string path;
+    std::uint64_t value = 0;
 };
 
 struct StatRule {
     std::string input;
     std::uint64_t statId = 0;
+    std::optional<StatFilter> filter;
 };
 
 struct StatRules {
diff --git a/core/libs/prx/libSceNpTrophy2/include/TrophyStore.hpp b/core/libs/prx/libSceNpTrophy2/include/TrophyStore.hpp
index d9ab341ae0..c69e678ba3 100644
--- a/core/libs/prx/libSceNpTrophy2/include/TrophyStore.hpp
+++ b/core/libs/prx/libSceNpTrophy2/include/TrophyStore.hpp
@@ -67,6 +67,7 @@ public:
     explicit StatStore(std::filesystem::path directory);
 
     void Set(std::int32_t userId, std::uint32_t serviceLabel, std::uint64_t statId, std::uint64_t value);
+    std::uint64_t Raise(std::int32_t userId, std::uint32_t serviceLabel, std::uint64_t statId, std::uint64_t value);
     std::optional<std::uint64_t> Value(std::int32_t userId, std::uint32_t serviceLabel, std::uint64_t statId);
     std::map<std::uint64_t, std::uint64_t> Values(std::int32_t userId, std::uint32_t serviceLabel);
     std::filesystem::path RecordPath(std::int32_t userId, std::uint32_t serviceLabel) const;
diff --git a/core/libs/prx/libSceNpTrophy2/libSceNpTrophy2.hpp b/core/libs/prx/libSceNpTrophy2/libSceNpTrophy2.hpp
new file mode 100644
index 0000000000..09c653d06d
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy2/libSceNpTrophy2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTrophy2/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpTrophy2/src/Context.cpp b/core/libs/prx/libSceNpTrophy2/src/Context.cpp
index ef3a23e905..8e623d8c36 100644
--- a/core/libs/prx/libSceNpTrophy2/src/Context.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/Context.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <map>
@@ -77,15 +78,15 @@ int APS5_VABI sceNpTrophy2UnregisterUnlockCallback() {
     return SCE_NP_TROPHY2_OK;
 }
 
-
 int APS5_VABI sceNpTrophy2GetRewardIcon(int context, int handle, int reward_id, void* buffer, size_t* size) {
     (void)context;
     (void)handle;
     (void)reward_id;
     (void)buffer;
-    (void)size;
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (size != nullptr) {
+        *size = NP_TROPHY2_ICON_SIZE_NONE;
+    }
+    return SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND;
 }
 
 int APS5_VABI sceNpTrophy2ShowTrophyList(int context) {
diff --git a/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp b/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp
index dc11f536ef..4e7c771003 100644
--- a/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <cstddef>
 #include <cstring>
 #include <optional>
diff --git a/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp b/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp
index 887423ddc8..d06dc60177 100644
--- a/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
diff --git a/core/libs/prx/libSceNpTrophy2/src/Handle.cpp b/core/libs/prx/libSceNpTrophy2/src/Handle.cpp
index 3f65f5887e..64013be3d6 100644
--- a/core/libs/prx/libSceNpTrophy2/src/Handle.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/Handle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <stdexcept>
 #include <string>
 
diff --git a/core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp b/core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp
index 813fa576f7..91fb5e816e 100644
--- a/core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp
@@ -139,6 +139,10 @@ StatChanges ApplyStatRules(const StatRules& rules, const NpTrophy2Event& event,
     const auto matching = rules.events.find(event.name);
     if (matching == rules.events.end()) return changes;
     for (const auto& rule : matching->second) {
+        if (rule.filter) {
+            const auto filtered = std::find_if(event.properties.begin(), event.properties.end(), [&rule](const NpTrophy2EventProperty& candidate) { return candidate.path == rule.filter->path; });
+            if (filtered == event.properties.end() || filtered->value != rule.filter->value) continue;
+        }
         const auto& definition = rules.stats.at(rule.statId);
         const auto property = std::find_if(event.properties.begin(), event.properties.end(), [&rule](const NpTrophy2EventProperty& candidate) { return candidate.path == rule.input; });
         const auto where = event.name + " $." + rule.input + " for stat " + std::to_string(rule.statId);
@@ -148,6 +152,8 @@ StatChanges ApplyStatRules(const StatRules& rules, const NpTrophy2Event& event,
             changes.problems.push_back({where, property->text + " is not an unsigned integer"});
         } else if (*property->value < definition.minimum || *property->value > definition.maximum) {
             changes.problems.push_back({where, property->text + " is not from " + std::to_string(definition.minimum) + " to " + std::to_string(definition.maximum)});
+        } else if (definition.aggregation == StatAggregation::Max) {
+            changes.updates.push_back({rule.statId, stats.Raise(userId, serviceLabel, rule.statId, std::max(*property->value, definition.initial)), rule.input});
         } else {
             stats.Set(userId, serviceLabel, rule.statId, *property->value);
             changes.updates.push_back({rule.statId, *property->value, rule.input});
diff --git a/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp b/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp
index cc32a75483..1cabae19e7 100644
--- a/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
diff --git a/core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp b/core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp
index 5da39d1cb4..91140de5cf 100644
--- a/core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp
@@ -363,26 +363,34 @@ void readStat(const Json& definition, std::size_t index, StatRules& rules) {
     }
     const auto name = "stat " + std::to_string(*statId);
     const auto* aggregation = definition.Find("aggregation");
-    if (aggregation == nullptr || aggregation->kind != Json::Kind::String || aggregation->text != "latest") {
-        rules.skipped.push_back(name + " has aggregation " + (aggregation != nullptr ? describe(*aggregation) : std::string("none")) + "; only \"latest\" is supported");
+    const auto named = [](const Json* value, std::string_view text) { return value != nullptr && value->kind == Json::Kind::String && value->text == text; };
+    StatDefinition stat;
+    if (named(aggregation, "latest")) {
+        stat.aggregation = StatAggregation::Latest;
+    } else if (named(aggregation, "max")) {
+        stat.aggregation = StatAggregation::Max;
+    } else {
+        rules.skipped.push_back(name + " has aggregation " + (aggregation != nullptr ? describe(*aggregation) : std::string("none")) + "; only \"latest\" and \"max\" are supported");
         return;
     }
     const auto* type = definition.Find("dataType");
-    StatDefinition stat;
-    if (type != nullptr && type->kind == Json::Kind::String && type->text == "uint32") {
+    if (named(type, "uint32")) {
         stat.type = StatType::UInt32;
         stat.maximum = UINT32_MAX;
-    } else if (type != nullptr && type->kind == Json::Kind::String && type->text == "uint64") {
+    } else if (named(type, "uint64")) {
         stat.type = StatType::UInt64;
         stat.maximum = UINT64_MAX;
+    } else if (named(type, "int32")) {
+        stat.type = StatType::Int32;
+        stat.maximum = INT32_MAX;
     } else {
-        rules.skipped.push_back(name + " has dataType " + (type != nullptr ? describe(*type) : std::string("none")) + "; only \"uint32\" and \"uint64\" are supported");
+        rules.skipped.push_back(name + " has dataType " + (type != nullptr ? describe(*type) : std::string("none")) + "; only \"uint32\", \"uint64\" and \"int32\" are supported");
         return;
     }
     if (const auto* minimum = definition.Find("minValue")) {
         const auto value = minimum->Unsigned();
         if (!value || *value > stat.maximum) {
-            rules.skipped.push_back(name + " has minValue " + describe(*minimum) + ", which its " + type->text + " type cannot hold");
+            rules.skipped.push_back(name + " has minValue " + describe(*minimum) + (stat.type == StatType::Int32 ? ", which is not from 0 to its int32 limit" : ", which its " + type->text + " type cannot hold"));
             return;
         }
         stat.minimum = *value;
@@ -395,6 +403,15 @@ void readStat(const Json& definition, std::size_t index, StatRules& rules) {
         }
         stat.maximum = *value;
     }
+    stat.initial = stat.minimum;
+    if (const auto* initial = definition.Find("initialValue"); initial != nullptr && stat.aggregation == StatAggregation::Max) {
+        const auto value = initial->Unsigned();
+        if (!value || *value < stat.minimum || *value > stat.maximum) {
+            rules.skipped.push_back(name + " has initialValue " + describe(*initial) + ", which is not from its minValue to its maxValue");
+            return;
+        }
+        stat.initial = *value;
+    }
     if (!rules.stats.emplace(*statId, stat).second) rules.skipped.push_back(name + " is defined twice; the first definition is used");
 }
 
@@ -411,9 +428,20 @@ void readRule(const Json& rule, std::size_t index, StatRules& rules) {
         rules.skipped.push_back(where + " has no eventName");
         return;
     }
+    std::optional<StatFilter> filter;
     if (condition->members.size() != 1) {
-        rules.skipped.push_back(where + " filters " + event->text + " by more than its eventName; only eventName conditions are supported");
-        return;
+        const auto* property = condition->Find("property");
+        const auto* path = property != nullptr && property->kind == Json::Kind::Object ? property->Find("path") : nullptr;
+        const auto* comparator = property != nullptr && property->kind == Json::Kind::Object ? property->Find("comparator") : nullptr;
+        const auto* value = property != nullptr && property->kind == Json::Kind::Object ? property->Find("value") : nullptr;
+        const auto filterPath = path != nullptr && path->kind == Json::Kind::String ? propertyPath(path->text) : std::nullopt;
+        const auto filterValue = value != nullptr ? value->Unsigned() : std::nullopt;
+        const bool equal = comparator != nullptr && comparator->kind == Json::Kind::String && comparator->text == "==";
+        if (condition->members.size() != 2 || property == nullptr || property->kind != Json::Kind::Object || property->members.size() != 3 || !filterPath || !equal || !filterValue) {
+            rules.skipped.push_back(where + " filters " + event->text + " by more than its eventName; only an eventName with one \"$.name\" property equal to an unsigned integer is supported");
+            return;
+        }
+        filter = StatFilter{*filterPath, *filterValue};
     }
     const auto* output = action->Find("output");
     const auto* id = output != nullptr ? output->Find("statId") : nullptr;
@@ -432,7 +460,7 @@ void readRule(const Json& rule, std::size_t index, StatRules& rules) {
         rules.skipped.push_back(where + " for " + event->text + " reads " + (input != nullptr ? describe(*input) : std::string("no input")) + "; only \"$.name\" property paths are supported");
         return;
     }
-    rules.events[event->text].push_back({*path, *statId});
+    rules.events[event->text].push_back({*path, *statId, std::move(filter)});
 }
 
 }
diff --git a/core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp b/core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp
index b19804fe10..5091aad105 100644
--- a/core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp
@@ -177,6 +177,18 @@ void StatStore::Set(std::int32_t userId, std::uint32_t serviceLabel, std::uint64
     stats = std::move(updated);
 }
 
+std::uint64_t StatStore::Raise(std::int32_t userId, std::uint32_t serviceLabel, std::uint64_t statId, std::uint64_t value) {
+    std::lock_guard lock(mutex);
+    const Key key{userId, serviceLabel};
+    auto& stats = record(key);
+    if (const auto found = stats.find(statId); found != stats.end() && found->second >= value) return found->second;
+    auto updated = stats;
+    updated[statId] = value;
+    writeRecord(directory, RecordPath(userId, serviceLabel), updated, "stat record");
+    stats = std::move(updated);
+    return value;
+}
+
 std::optional<std::uint64_t> StatStore::Value(std::int32_t userId, std::uint32_t serviceLabel, std::uint64_t statId) {
     std::lock_guard lock(mutex);
     const auto& stats = record({userId, serviceLabel});
diff --git a/core/libs/prx/libSceNpTrophy2/tests/TrophyPackage.cpp b/core/libs/prx/libSceNpTrophy2/tests/TrophyPackage.cpp
index d1dcdba734..0e7b0e4364 100644
--- a/core/libs/prx/libSceNpTrophy2/tests/TrophyPackage.cpp
+++ b/core/libs/prx/libSceNpTrophy2/tests/TrophyPackage.cpp
@@ -94,7 +94,11 @@ const char StatsDefinition[] = R"({"statDefinitionArray":[
     {"statId":50,"dataType":"uint64","aggregation":"sum"},
     {"statId":60,"dataType":"int32","aggregation":"latest"},
     {"statId":70,"dataType":"uint32","aggregation":"latest","maxValue":"5000000000"},
-    {"dataType":"uint32","aggregation":"latest"}
+    {"dataType":"uint32","aggregation":"latest"},
+    {"statId":80,"dataType":"int32","aggregation":"max","minValue":"0","initialValue":"0"},
+    {"statId":90,"dataType":"uint32","aggregation":"max","initialValue":"3"},
+    {"statId":100,"dataType":"int32","aggregation":"max","initialValue":"-1"},
+    {"statId":110,"dataType":"int32","aggregation":"latest","minValue":"-5"}
 ]})";
 
 const char StatsExtraction[] = R"({"statsExtractionRuleArray":[
@@ -106,7 +110,12 @@ const char StatsExtraction[] = R"({"statsExtractionRuleArray":[
     {"condition":{"eventName":"FILTERED","property":{"path":"$.level"}},"action":{"input":"$.counter","output":{"statId":10}}},
     {"condition":{"eventName":"COUNT"},"action":{"output":{"statId":10}}},
     {"condition":{"eventName":"BRACKETS"},"action":{"input":"$['counter']","output":{"statId":10}}},
-    {"bad":1}
+    {"bad":1},
+    {"condition":{"eventName":"PROGRESS","property":{"path":"$._trophy_id","comparator":"==","value":"5"}},"action":{"input":"$._trophy_progress","output":{"statId":80}}},
+    {"condition":{"eventName":"PROGRESS","property":{"path":"$._trophy_id","comparator":"==","value":6}},"action":{"input":"$._trophy_progress","output":{"statId":90}}},
+    {"condition":{"eventName":"RANGED","property":{"path":"$._trophy_id","comparator":">=","value":"5"}},"action":{"input":"$._trophy_progress","output":{"statId":80}}},
+    {"condition":{"eventName":"NAMED","property":{"path":"$.mode","comparator":"==","value":"delta"}},"action":{"input":"$._trophy_progress","output":{"statId":80}}},
+    {"condition":{"eventName":"EXTRA","property":{"path":"$._trophy_id","comparator":"==","value":"5"},"other":1},"action":{"input":"$._trophy_progress","output":{"statId":80}}}
 ]})";
 
 std::string trophyPackage() {
@@ -310,10 +319,13 @@ void testProgressAndPlatinum() {
 
 void testStatRules() {
     const auto rules = NpTrophy2::ParseStatRules(statPackage());
-    check(rules.stats.size() == 4 && rules.stats.at(10).type == NpTrophy2::StatType::UInt64 && rules.stats.at(30).type == NpTrophy2::StatType::UInt32 && rules.stats.at(30).maximum == UINT32_MAX &&
-              rules.stats.at(40).maximum == 50 && rules.stats.at(10).minimum == 0,
+    check(rules.stats.size() == 7 && rules.stats.at(10).type == NpTrophy2::StatType::UInt64 && rules.stats.at(30).type == NpTrophy2::StatType::UInt32 && rules.stats.at(30).maximum == UINT32_MAX &&
+              rules.stats.at(40).maximum == 50 && rules.stats.at(10).minimum == 0 && rules.stats.at(10).aggregation == NpTrophy2::StatAggregation::Latest,
           "stat definitions were not read");
-    check(rules.events.size() == 3 && rules.events.at("COLLECT").size() == 2 && rules.events.at("COLLECT")[1].input == "total" && rules.events.at("COLLECT")[1].statId == 20 &&
+    check(rules.stats.at(60).type == NpTrophy2::StatType::Int32 && rules.stats.at(60).maximum == INT32_MAX && rules.stats.at(80).aggregation == NpTrophy2::StatAggregation::Max &&
+              rules.stats.at(80).type == NpTrophy2::StatType::Int32 && rules.stats.at(80).initial == 0 && rules.stats.at(90).aggregation == NpTrophy2::StatAggregation::Max && rules.stats.at(90).initial == 3,
+          "int32 and max stat definitions were not read");
+    check(rules.events.size() == 4 && rules.events.at("COLLECT").size() == 2 && rules.events.at("COLLECT")[1].input == "total" && rules.events.at("COLLECT")[1].statId == 20 &&
               rules.events.at("STEPS")[0].input == "player.steps" && rules.events.at("TIME")[0].statId == 30,
           "extraction rules were not read");
     std::set<std::string> skipped(rules.skipped.begin(), rules.skipped.end());
@@ -323,11 +335,17 @@ void testStatRules() {
         }
         return false;
     };
-    check(rules.skipped.size() == 9, "unsupported definitions and rules were not all reported");
-    check(reported("stat 50 has aggregation \"sum\"") && reported("stat 60 has dataType \"int32\"") && reported("stat 70 has maxValue \"5000000000\"") && reported("statDefinitionArray[7] has no unsigned statId"),
+    check(rules.skipped.size() == 13, "unsupported definitions and rules were not all reported");
+    check(reported("stat 50 has aggregation \"sum\"; only \"latest\" and \"max\" are supported") && reported("stat 70 has maxValue \"5000000000\"") && reported("statDefinitionArray[7] has no unsigned statId") &&
+              reported("stat 100 has initialValue \"-1\"") && reported("stat 110 has minValue \"-5\", which is not from 0 to its int32 limit"),
           "unsupported definitions were not reported");
-    check(reported("for SUM writes stat 50") && reported("filters FILTERED") && reported("for COUNT reads no input") && reported("for BRACKETS reads \"$['counter']\"") && reported("[8] has no condition"),
+    check(reported("for SUM writes stat 50") && reported("filters FILTERED") && reported("for COUNT reads no input") && reported("for BRACKETS reads \"$['counter']\"") && reported("[8] has no condition") &&
+              reported("filters RANGED") && reported("filters NAMED") && reported("filters EXTRA"),
           "unsupported rules were not reported");
+    const auto& progress = rules.events.at("PROGRESS");
+    check(progress.size() == 2 && progress[0].filter && progress[0].filter->path == "_trophy_id" && progress[0].filter->value == 5 && progress[0].input == "_trophy_progress" && progress[0].statId == 80 &&
+              progress[1].filter && progress[1].filter->value == 6 && progress[1].statId == 90 && !rules.events.at("COLLECT")[0].filter,
+          "property filters were not read");
     for (const char* input : {"$", "$.", "$..a", "$.a.", "$.a-b", "counter", "$.a b"}) {
         const std::string extraction = std::string(R"({"statsExtractionRuleArray":[{"condition":{"eventName":"E"},"action":{"input":")") + input + R"(","output":{"statId":10}}}]})";
         check(NpTrophy2::ParseStatRules(ucp({{"stats_definition.json", StatsDefinition}, {"stats_extraction.json", extraction}})).events.empty(), "an unsupported input path was accepted");
@@ -412,6 +430,37 @@ void testApplyStatRules() {
     check(latest.updates.size() == 2 && stats.Value(InitialUser, 0, 10) == std::optional<std::uint64_t>(2), "a stat did not keep the latest value");
 }
 
+void testProgressRules() {
+    const auto rules = NpTrophy2::ParseStatRules(statPackage());
+    NpTrophy2::StatStore stats("progress");
+    const auto posted = [&](std::vector<NpTrophy2EventProperty> properties) { return NpTrophy2::ApplyStatRules(rules, event("PROGRESS", std::move(properties)), stats, InitialUser, 0); };
+    const auto progress = [&](std::uint64_t trophy, std::uint64_t value) { return posted({{"_trophy_id", trophy, std::to_string(trophy)}, {"_trophy_progress", value, std::to_string(value)}}); };
+    const auto first = progress(5, 4);
+    check(first.problems.empty() && first.updates.size() == 1 && first.updates[0].statId == 80 && first.updates[0].value == 4 && stats.Value(InitialUser, 0, 80) == std::optional<std::uint64_t>(4) &&
+              !stats.Value(InitialUser, 0, 90),
+          "a filtered rule did not take its trophy's progress, or another trophy's rule did");
+    const auto lower = progress(5, 2);
+    check(lower.updates.size() == 1 && lower.updates[0].value == 4 && stats.Value(InitialUser, 0, 80) == std::optional<std::uint64_t>(4), "a max stat went down");
+    const auto higher = progress(5, 7);
+    check(higher.updates.size() == 1 && higher.updates[0].value == 7 && stats.Value(InitialUser, 0, 80) == std::optional<std::uint64_t>(7), "a max stat did not rise");
+    const auto floor = progress(6, 1);
+    check(floor.updates.size() == 1 && floor.updates[0].statId == 90 && floor.updates[0].value == 3 && stats.Value(InitialUser, 0, 90) == std::optional<std::uint64_t>(3), "a max stat started below its initialValue");
+    const auto signedMax = progress(5, 2147483648ull);
+    check(signedMax.updates.empty() && signedMax.problems.size() == 1 && signedMax.problems[0].reason == "2147483648 is not from 0 to 2147483647", "an int32 stat took a value it cannot hold");
+    const auto other = progress(7, 9);
+    const auto unnamed = posted({{"_trophy_progress", 9, "9"}});
+    const auto negative = posted({{"_trophy_id", std::nullopt, "-5"}, {"_trophy_progress", 9, "9"}});
+    check(other.updates.empty() && other.problems.empty() && unnamed.updates.empty() && unnamed.problems.empty() && negative.updates.empty() && negative.problems.empty() &&
+              stats.Value(InitialUser, 0, 80) == std::optional<std::uint64_t>(7) && stats.Value(InitialUser, 0, 90) == std::optional<std::uint64_t>(3),
+          "a filtered rule took an event for another trophy, or without its trophy id");
+    const auto missing = posted({{"_trophy_id", 5, "5"}});
+    check(missing.updates.empty() && missing.problems.size() == 1 && missing.problems[0].rule == "PROGRESS $._trophy_progress for stat 80", "a matching event without its input was not reported");
+    NpTrophy2::StatStore restarted("progress");
+    check(restarted.Raise(InitialUser, 0, 80, 6) == 7 && restarted.Raise(InitialUser, 0, 80, 8) == 8 && restarted.Raise(InitialUser, 0, 120, 1) == 1, "a raise did not keep the larger value");
+    NpTrophy2::StatStore reread("progress");
+    check(reread.Value(InitialUser, 0, 80) == std::optional<std::uint64_t>(8) && reread.Value(InitialUser, 0, 120) == std::optional<std::uint64_t>(1), "a raised stat was not stored");
+}
+
 }
 
 int main() {
@@ -427,6 +476,7 @@ int main() {
     testConditions();
     testStatStore();
     testApplyStatRules();
+    testProgressRules();
     std::filesystem::current_path(previous);
     std::filesystem::remove_all(root);
     std::puts("Trophy package tests passed");
diff --git a/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp b/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp
index 10352c9edf..5a70852cc0 100644
--- a/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp
+++ b/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 #include "prx/libSceNpTrophy2/include/TitleTrophies.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
@@ -23,14 +24,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2DestroyContext(int);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-int APS5_VABI sceNpTrophy2GetTrophyInfoArray(int, int, uint32_t, uint32_t, NpTrophy2Details*, NpTrophy2Data*, uint32_t*);
-}
-
 namespace {
 
 constexpr std::int32_t InitialUser = 0x10000000;
@@ -246,7 +239,6 @@ void testQueries() {
     check(sceNpTrophy2DestroyContext(context) == 0 && sceNpTrophy2DestroyContext(other) == 0, "contexts were not destroyed");
 }
 
-
 void testPostedUnlockRules() {
     std::filesystem::create_directories("app0/sce_sys/trophy2");
     std::filesystem::create_directories("app0/sce_sys/uds");
diff --git a/core/libs/prx/libSceNpTus/Export.cpp b/core/libs/prx/libSceNpTus/Export.cpp
index da02e06801..2f632e6d18 100644
--- a/core/libs/prx/libSceNpTus/Export.cpp
+++ b/core/libs/prx/libSceNpTus/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTus/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <mutex>
@@ -346,11 +347,6 @@ int APS5_VABI sceNpTusGetDataForCrossSaveVUserAsync(void) {
     return 0;
 }
 
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpTusGetFriendsVariableA(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -693,6 +689,10 @@ int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveAsync(int reqId, const std
     return StartOffline(reqId);
 }
 
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusGetMultiUserVariableForCrossSaveAsync(reqId, targetAccountIdArray, slotId, variableArray, variableArraySize, arrayLen, option));
+}
+
 int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
     (void)variableArraySize;
     if (!targetVirtualUserIdArray || !variableArray) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
@@ -1006,44 +1006,36 @@ int APS5_VABI sceNpTusCreateNpTitleCtx() {
     return 0;
 }
 
-int APS5_VABI sceNpTusGetData() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetData(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option) {
+    return Complete(reqId, sceNpTusGetDataAsync(reqId, targetNpId, slotId, dataStatus, dataStatusSize, data, recvSize, option));
 }
 
-int APS5_VABI sceNpTusGetDataVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option) {
+    return Complete(reqId, sceNpTusGetDataVUserAsync(reqId, targetVirtualUserId, slotId, dataStatus, dataStatusSize, data, recvSize, option));
 }
 
-int APS5_VABI sceNpTusGetMultiSlotVariable() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusGetMultiSlotVariableAsync(reqId, targetNpId, slotIds, variableArray, variableArraySize, arrayLen, option));
 }
 
-int APS5_VABI sceNpTusGetMultiSlotVariableVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusGetMultiSlotVariableVUserAsync(reqId, targetVirtualUserId, slotIds, variableArray, variableArraySize, arrayLen, option));
 }
 
-int APS5_VABI sceNpTusSetData() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetData(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option) {
+    return Complete(reqId, sceNpTusSetDataAsync(reqId, targetNpId, slotId, totalSize, sendSize, data, info, infoStructSize, isLastChangedAuthor, isLastChangedDate, option));
 }
 
-int APS5_VABI sceNpTusSetDataVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option) {
+    return Complete(reqId, sceNpTusSetDataVUserAsync(reqId, targetVirtualUserId, slotId, totalSize, sendSize, data, info, infoStructSize, isLastChangedAuthor, isLastChangedDate, option));
 }
 
-int APS5_VABI sceNpTusSetMultiSlotVariable() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusSetMultiSlotVariableAsync(reqId, targetNpId, slotIds, variableArray, arrayLen, option));
 }
 
-int APS5_VABI sceNpTusSetMultiSlotVariableVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusSetMultiSlotVariableVUserAsync(reqId, targetVirtualUserId, slotIds, variableArray, arrayLen, option));
 }
 
 }
diff --git a/core/libs/prx/libSceNpTus/include/Api.hpp b/core/libs/prx/libSceNpTus/include/Api.hpp
new file mode 100644
index 0000000000..eacd0fe74a
--- /dev/null
+++ b/core/libs/prx/libSceNpTus/include/Api.hpp
@@ -0,0 +1,150 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpTusCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId);
+int APS5_VABI sceNpTusCreateRequest(int titleCtxId);
+int APS5_VABI sceNpTusDeleteNpTitleCtx(int titleCtxId);
+int APS5_VABI sceNpTusDeleteRequest(int reqId);
+int APS5_VABI sceNpTusAbortRequest(int reqId);
+int APS5_VABI sceNpTusPollAsync(int reqId, int* result);
+int APS5_VABI sceNpTusGetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusSetThreadParam(void);
+int APS5_VABI sceNpTssCreateNpTitleCtx(std::uint32_t serviceLabel, const NpId* npId);
+int APS5_VABI sceNpTssCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId);
+int APS5_VABI sceNpTusCreateTitleCtx(void);
+int APS5_VABI sceNpTusSetTimeout(void);
+int APS5_VABI sceNpTusChangeModeForOtherSaveDataOwners(void);
+int APS5_VABI sceNpTusWaitAsync(int reqId, int* result);
+int APS5_VABI sceNpTusGetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataVUser(void);
+int APS5_VABI sceNpTusDeleteMultiSlotDataVUserAsync(void);
+int APS5_VABI sceNpTssGetStorage(void);
+int APS5_VABI sceNpTssGetStorageAsync(void);
+int APS5_VABI sceNpTssGetDataAsync(void);
+int APS5_VABI sceNpTusGetDataForCrossSaveVUser(void);
+int APS5_VABI sceNpTusGetDataForCrossSaveVUserAsync(void);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetFriendsVariableA(void);
+int APS5_VABI sceNpTusGetFriendsVariableAAsync(void);
+int APS5_VABI sceNpTusGetFriendsVariableForCrossSave(void);
+int APS5_VABI sceNpTusGetFriendsVariableForCrossSaveAsync(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusA(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusAAsync(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusForCrossSave(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusForCrossSaveAsync(void);
+int APS5_VABI sceNpTssGetSmallStorageAsync(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetFriendsDataStatusAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetFriendsVariableAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTssGetSmallStorage(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
+int APS5_VABI sceNpTusAddAndGetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotData(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetFriendsDataStatus(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetFriendsVariable(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatus(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatus(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariable(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusTryAndSetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTssGetData();
+int APS5_VABI sceNpTusCreateNpTitleCtx();
+int APS5_VABI sceNpTusGetData(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetData(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+
+}
diff --git a/core/libs/prx/libSceNpTus/libSceNpTus.hpp b/core/libs/prx/libSceNpTus/libSceNpTus.hpp
new file mode 100644
index 0000000000..5cf1eba7a1
--- /dev/null
+++ b/core/libs/prx/libSceNpTus/libSceNpTus.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTus/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt b/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt
index d9163d1dc7..62016d6a55 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt
+++ b/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt
@@ -1,4 +1,5 @@
 add_library(libSceNpUniversalDataSystem SHARED EXCLUDE_FROM_ALL
+        ${CMAKE_CURRENT_SOURCE_DIR}/PendingExports.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/System.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/Context.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/Handle.cpp
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp b/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp
index 0231b0cf03..28b17e212b 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp b/core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp
new file mode 100644
index 0000000000..b19e95eb61
--- /dev/null
+++ b/core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp
@@ -0,0 +1,137 @@
+#include <cstdint>
+#include <cstddef>
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordData() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDeleteAllRecord() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordData() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntGetMemoryStat() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntPostRecordData() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBinary() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBool() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetString() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordDataEstimateSize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBinary() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBool() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetString() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/include/Api.hpp b/core/libs/prx/libSceNpUniversalDataSystem/include/Api.hpp
new file mode 100644
index 0000000000..c0d1ad66ea
--- /dev/null
+++ b/core/libs/prx/libSceNpUniversalDataSystem/include/Api.hpp
@@ -0,0 +1,94 @@
+#pragma once
+
+#include "prx/libSceNpUniversalDataSystem/include/UdsEvent.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpUniversalDataSystemIntAbortHandle(void);
+int APS5_VABI sceNpUniversalDataSystemIntCheckNetSyncTitles(void);
+int APS5_VABI sceNpUniversalDataSystemIntCreateContext(void);
+int APS5_VABI sceNpUniversalDataSystemIntCreateHandle(void);
+int APS5_VABI sceNpUniversalDataSystemIntDeleteAllData(void);
+int APS5_VABI sceNpUniversalDataSystemIntDeleteUserDataWithServerData(void);
+int APS5_VABI sceNpUniversalDataSystemIntDestroyContext(void);
+int APS5_VABI sceNpUniversalDataSystemIntDestroyHandle(void);
+int APS5_VABI sceNpUniversalDataSystemIntInitialize(void);
+int APS5_VABI sceNpUniversalDataSystemIntNetSyncTitles(void);
+int APS5_VABI sceNpUniversalDataSystemIntTerminate(void);
+int APS5_VABI sceNpUniversalDataSystemCreateContext(int* context, int userId, uint32_t serviceLabel, uint64_t options);
+int APS5_VABI sceNpUniversalDataSystemDestroyContext(int context);
+int APS5_VABI sceNpUniversalDataSystemRegisterContext(int context, int handle, uint64_t options);
+int APS5_VABI sceNpUniversalDataSystemCreateEvent( const char* eventName, const NpUniversalDataSystemEventPropertyObject* prop, NpUniversalDataSystemEvent** newEvent, NpUniversalDataSystemEventPropertyObject** propPtr);
+int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent* event);
+int APS5_VABI sceNpUniversalDataSystemPostEvent(int context, int handle, const void* event, uint64_t options);
+int APS5_VABI sceNpUniversalDataSystemEventEstimateSize(const NpUniversalDataSystemEvent* event, size_t* size);
+int APS5_VABI sceNpUniversalDataSystemEventToString( const NpUniversalDataSystemEvent* event, char* buf, size_t bufSize, size_t* stringSize);
+int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyArray(NpUniversalDataSystemEventPropertyArray** newArray);
+int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyArray(NpUniversalDataSystemEventPropertyArray* array);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetString( NpUniversalDataSystemEventPropertyArray* array, const char* value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt32( NpUniversalDataSystemEventPropertyArray* array, int32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt32( NpUniversalDataSystemEventPropertyArray* array, uint32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt64( NpUniversalDataSystemEventPropertyArray* array, int64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt64( NpUniversalDataSystemEventPropertyArray* array, uint64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat32( NpUniversalDataSystemEventPropertyArray* array, float value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat64( NpUniversalDataSystemEventPropertyArray* array, double value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBool( NpUniversalDataSystemEventPropertyArray* array, bool value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBinary( NpUniversalDataSystemEventPropertyArray* array, const void* value, size_t valueSize);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetObject( NpUniversalDataSystemEventPropertyArray* array, const NpUniversalDataSystemEventPropertyObject* value, NpUniversalDataSystemEventPropertyObject** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetArray( NpUniversalDataSystemEventPropertyArray* array, const NpUniversalDataSystemEventPropertyArray* value, NpUniversalDataSystemEventPropertyArray** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject** newObject);
+int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject* object);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetString( NpUniversalDataSystemEventPropertyObject* object, const char* key, const char* value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32( NpUniversalDataSystemEventPropertyObject* object, const char* key, int32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt32( NpUniversalDataSystemEventPropertyObject* object, const char* key, uint32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt64( NpUniversalDataSystemEventPropertyObject* object, const char* key, int64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt64( NpUniversalDataSystemEventPropertyObject* object, const char* key, uint64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat32( NpUniversalDataSystemEventPropertyObject* object, const char* key, float value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat64( NpUniversalDataSystemEventPropertyObject* object, const char* key, double value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBool( NpUniversalDataSystemEventPropertyObject* object, const char* key, bool value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBinary( NpUniversalDataSystemEventPropertyObject* object, const char* key, const void* value, size_t valueSize);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetObject( NpUniversalDataSystemEventPropertyObject* object, const char* key, const NpUniversalDataSystemEventPropertyObject* value, NpUniversalDataSystemEventPropertyObject** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetArray( NpUniversalDataSystemEventPropertyObject* object, const char* key, const NpUniversalDataSystemEventPropertyArray* value, NpUniversalDataSystemEventPropertyArray** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemCreateHandle(int* handle);
+int APS5_VABI sceNpUniversalDataSystemDestroyHandle(int handle);
+int APS5_VABI sceNpUniversalDataSystemAbortHandle(int handle);
+int APS5_VABI sceNpUniversalDataSystemInitialize(const NpUniversalDataSystemInitParam* param);
+int APS5_VABI sceNpUniversalDataSystemTerminate(void);
+int APS5_VABI sceNpUniversalDataSystemGetMemoryStat(NpUniversalDataSystemMemoryStat* stat);
+int APS5_VABI sceNpUniversalDataSystemGetStorageStat(int context, NpUniversalDataSystemStorageStat* stat);
+
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordArray();
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordData();
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordObject();
+int APS5_VABI sceNpUniversalDataSystemIntDeleteAllRecord();
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordArray();
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordData();
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordObject();
+int APS5_VABI sceNpUniversalDataSystemIntGetMemoryStat();
+int APS5_VABI sceNpUniversalDataSystemIntPostRecordData();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetArray();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBinary();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBool();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetObject();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetString();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordDataEstimateSize();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetArray();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBinary();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBool();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetObject();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetString();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt64();
+
+}
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/libSceNpUniversalDataSystem.hpp b/core/libs/prx/libSceNpUniversalDataSystem/libSceNpUniversalDataSystem.hpp
new file mode 100644
index 0000000000..e72fd1c696
--- /dev/null
+++ b/core/libs/prx/libSceNpUniversalDataSystem/libSceNpUniversalDataSystem.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp
index f73c4a2cb2..e6f9c0a4c2 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstdint>
 #include <map>
 #include <mutex>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp
index be7df0ae46..12bcbd69c4 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp
@@ -1,11 +1,10 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <memory>
-#include <mutex>
-#include <set>
 #include <stdexcept>
 #include <string>
 
@@ -21,13 +20,6 @@ Uds::Owned<NpUniversalDataSystemEvent>& events() {
     return registry;
 }
 
-bool firstProgress(std::int32_t trophyId) {
-    static std::mutex mutex;
-    static std::set<std::int32_t> logged;
-    std::lock_guard lock(mutex);
-    return logged.insert(trophyId).second;
-}
-
 void ignore(const NpUniversalDataSystemEvent& event, int context, const std::string& reason) {
     std::fprintf(stderr, "[trophy] ignored %s posted to context %d: %s\n", Uds::Describe(event).c_str(), context, reason.c_str());
 }
@@ -38,14 +30,12 @@ void post(const NpUniversalDataSystemEvent& event, int context) {
     const auto trophy = Uds::RecognizeTrophyEvent(event);
     switch (trophy.kind) {
     case Uds::TrophyEventKind::None:
+    case Uds::TrophyEventKind::Progress:
         if (const auto owner = Uds::FindContext(context)) NpTrophy2ApplyEvent_nid_no_patch(owner->userId, owner->serviceLabel, Uds::StatEvent(event));
         return;
     case Uds::TrophyEventKind::Malformed:
         ignore(event, context, trophy.problem);
         return;
-    case Uds::TrophyEventKind::Progress:
-        if (firstProgress(trophy.trophyId)) ignore(event, context, "trophy progress is not recorded");
-        return;
     case Uds::TrophyEventKind::Unlock:
         if (const auto owner = Uds::FindContext(context)) NpTrophy2RecordUnlock_nid_no_patch(owner->userId, owner->serviceLabel, trophy.trophyId);
         else ignore(event, context, "the context does not exist");
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp
index 57e985ba8f..c7552e6a4b 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <memory>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp
index d316c1ea30..20fd5f38e1 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <memory>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp
index b2aa8ce9fd..331873010e 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include "NpUniversalDataSystem.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp
index 92f91ceedf..6bc49f4f07 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cinttypes>
 #include <cstddef>
 #include <cstdint>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp b/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp
index 73128d5ff0..992af0fe45 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include "NpUniversalDataSystem.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -13,40 +14,6 @@
 #include <tuple>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemDestroyContext(int);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetString(NpUniversalDataSystemEventPropertyObject*, const char*, const char*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt32(NpUniversalDataSystemEventPropertyObject*, const char*, uint32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt64(NpUniversalDataSystemEventPropertyObject*, const char*, int64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt64(NpUniversalDataSystemEventPropertyObject*, const char*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat32(NpUniversalDataSystemEventPropertyObject*, const char*, float);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat64(NpUniversalDataSystemEventPropertyObject*, const char*, double);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBool(NpUniversalDataSystemEventPropertyObject*, const char*, bool);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBinary(NpUniversalDataSystemEventPropertyObject*, const char*, const void*, size_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetObject(NpUniversalDataSystemEventPropertyObject*, const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetArray(NpUniversalDataSystemEventPropertyObject*, const char*, const NpUniversalDataSystemEventPropertyArray*, NpUniversalDataSystemEventPropertyArray**);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyArray(NpUniversalDataSystemEventPropertyArray**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyArray(NpUniversalDataSystemEventPropertyArray*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetString(NpUniversalDataSystemEventPropertyArray*, const char*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt32(NpUniversalDataSystemEventPropertyArray*, int32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt32(NpUniversalDataSystemEventPropertyArray*, uint32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt64(NpUniversalDataSystemEventPropertyArray*, int64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt64(NpUniversalDataSystemEventPropertyArray*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat32(NpUniversalDataSystemEventPropertyArray*, float);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat64(NpUniversalDataSystemEventPropertyArray*, double);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBool(NpUniversalDataSystemEventPropertyArray*, bool);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBinary(NpUniversalDataSystemEventPropertyArray*, const void*, size_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetObject(NpUniversalDataSystemEventPropertyArray*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetArray(NpUniversalDataSystemEventPropertyArray*, const NpUniversalDataSystemEventPropertyArray*, NpUniversalDataSystemEventPropertyArray**);
-}
-
 namespace {
 
 constexpr int InitialUser = 0x10000000;
@@ -172,6 +139,7 @@ void testEvents() {
     check(throwsInvalidArgument([] {
         NpUniversalDataSystemEvent* unnamed = nullptr;
         sceNpUniversalDataSystemCreateEvent(nullptr, nullptr, &unnamed, nullptr);
+
     }), "an event without a name was created");
 }
 
diff --git a/core/libs/prx/libSceNpUtility/Export.cpp b/core/libs/prx/libSceNpUtility/Export.cpp
index f2f1a6a84a..364f0db20c 100644
--- a/core/libs/prx/libSceNpUtility/Export.cpp
+++ b/core/libs/prx/libSceNpUtility/Export.cpp
@@ -1,5 +1,7 @@
+#include "prx/libSceNpUtility/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
+#include <condition_variable>
 #include <cstring>
 #include <mutex>
 #include <unordered_map>
@@ -15,6 +17,7 @@ static constexpr int SCE_NP_COMMUNITY_ERROR_ABORTED = static_cast<int>(0x8055070
 static constexpr int SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT = static_cast<int>(0x8055070C);
 static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ID = static_cast<int>(0x8055070E);
 static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_TYPE = static_cast<int>(0x80550711);
+static constexpr int SCE_NP_LOOKUP_ERROR_SYNCHRONOUS_REQUEST = static_cast<int>(0x80550307);
 static constexpr int POLL_FINISHED = 0;
 static constexpr int POLL_RUNNING = 1;
 static constexpr std::size_t MAX_TITLE_CONTEXTS = 32;
@@ -22,7 +25,9 @@ static constexpr std::size_t MAX_REQUESTS = 32;
 static constexpr int WORD_FILTER_TITLE_CTX_ID_OFFSET = 0x01000000;
 static constexpr int WORD_FILTER_REQUEST_ID_OFFSET = 0x02000000;
 static constexpr std::size_t WORD_FILTER_COMMENT_MAX_LENGTH = 0x400;
-static constexpr std::uint64_t WORD_FILTER_ASYNC_PARAMETER_SIZE = 0x18;
+static constexpr std::uint64_t ASYNC_REQUEST_PARAMETER_SIZE = 0x18;
+static constexpr std::uint32_t RESOLVE_TIMEOUT_MIN = 1000000;
+static constexpr std::uint32_t TRANSFER_TIMEOUT_MIN = 10000000;
 
 namespace {
 struct Request {
@@ -37,6 +42,7 @@ struct Request {
 struct Service {
     Service(int firstTitleContext, int firstRequest) : nextTitleContext(firstTitleContext), nextRequest(firstRequest) {}
     std::mutex mutex;
+    std::condition_variable finished;
     std::unordered_set<int> titleContexts;
     std::unordered_map<int, Request> requests;
     int nextTitleContext;
@@ -59,6 +65,7 @@ int DeleteTitleContext(Service& service, int titleCtxId) {
     std::lock_guard lock(service.mutex);
     if (!service.titleContexts.erase(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
     std::erase_if(service.requests, [titleCtxId](const auto& entry) { return entry.second.titleCtxId == titleCtxId; });
+    service.finished.notify_all();
     return 0;
 }
 
@@ -73,7 +80,9 @@ int CreateRequest(Service& service, int titleCtxId, bool async) {
 
 int DeleteRequest(Service& service, int reqId) {
     std::lock_guard lock(service.mutex);
-    return service.requests.erase(reqId) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!service.requests.erase(reqId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    service.finished.notify_all();
+    return 0;
 }
 
 int StartOffline(Service& service, int reqId) {
@@ -85,9 +94,62 @@ int StartOffline(Service& service, int reqId) {
     request->second.used = true;
     request->second.finished = true;
     request->second.result = SCE_NP_ERROR_SIGNED_OUT;
+    service.finished.notify_all();
     return request->second.async ? 0 : SCE_NP_ERROR_SIGNED_OUT;
 }
 
+int AbortRequest(Service& service, int reqId) {
+    std::lock_guard lock(service.mutex);
+    const auto request = service.requests.find(reqId);
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    request->second.aborted = true;
+    if (!request->second.finished) {
+        request->second.finished = true;
+        request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED;
+        service.finished.notify_all();
+    }
+    return 0;
+}
+
+int PollAsync(Service& service, int reqId, int* result, int synchronousError) {
+    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(service.mutex);
+    const auto request = service.requests.find(reqId);
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.async) return synchronousError;
+    if (!request->second.finished) return POLL_RUNNING;
+    *result = request->second.result;
+    return POLL_FINISHED;
+}
+
+int WaitAsync(Service& service, int reqId, int* result, int synchronousError) {
+    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    std::unique_lock lock(service.mutex);
+    auto request = service.requests.find(reqId);
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.async) return synchronousError;
+    service.finished.wait(lock, [&] {
+        request = service.requests.find(reqId);
+        return request == service.requests.end() || request->second.finished;
+    });
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    *result = request->second.result;
+    return 0;
+}
+
+bool ValidTimeout(std::uint32_t timeout, std::uint32_t minimum) {
+    return timeout == 0 || timeout >= minimum;
+}
+
+int SetTimeout(Service& service, int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout) {
+    if (resolveRetry < 0 || !ValidTimeout(resolveTimeout, RESOLVE_TIMEOUT_MIN) || !ValidTimeout(connTimeout, TRANSFER_TIMEOUT_MIN) ||
+        !ValidTimeout(sendTimeout, TRANSFER_TIMEOUT_MIN) || !ValidTimeout(recvTimeout, TRANSFER_TIMEOUT_MIN))
+        return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (resolveRetry == 0 && resolveTimeout == 0 && connTimeout == 0 && sendTimeout == 0 && recvTimeout == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(service.mutex);
+    return service.titleContexts.contains(id) || service.requests.contains(id) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+}
+
 int CheckComment(const char* comment) {
     return strnlen(comment, WORD_FILTER_COMMENT_MAX_LENGTH + 1) > WORD_FILTER_COMMENT_MAX_LENGTH ? SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT : 0;
 }
@@ -124,13 +186,296 @@ int APS5_VABI sceNpBandwidthTestShutdown(int context_id, void* result) {
     return SCE_NP_ERROR_INVALID_ARGUMENT;
 }
 
+int APS5_VABI sceNpAppInfoIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAll() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAllA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAll() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAllA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdNum() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdNum() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpBandwidthTestShutdownWithDetailedInfo() {
+    return SCE_NP_ERROR_INVALID_ARGUMENT;
+}
+int APS5_VABI sceNpLookupCreateTitleCtxA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetCensorComment() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetConvertJidToNpId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetConvertNpIdToJid() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetCreateTitleCtx() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetDeleteRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetDeleteTitleCtx() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetInit() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetInitWithFunctionPointer() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetInitWithMemoryPool() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetIsInit() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetNpId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetSanitizeComment() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetSetTimeout() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetTerm() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailabilityA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntIsSetServiceType() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntGetAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntGetAvailabilityList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntIsCached() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntDeleteRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntGetInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntGetNpTitleId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUtilityInit() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUtilityTerm() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpWordFilterCreateTitleCtxA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 }
 
 extern "C" {
 
 int APS5_VABI sceNpBandwidthTestInitStart() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return SCE_NP_ERROR_SIGNED_OUT;
+}
+
+int APS5_VABI sceNpLookupAbortRequest(int reqId) {
+    return AbortRequest(lookup, reqId);
+}
+
+int APS5_VABI sceNpLookupCreateAsyncRequest(int titleCtxId, const std::uint64_t* param) {
+    if (!param || *param != ASYNC_REQUEST_PARAMETER_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    return CreateRequest(lookup, titleCtxId, true);
 }
 
 int APS5_VABI sceNpLookupCreateRequest(int titleCtxId) {
@@ -155,16 +500,20 @@ int APS5_VABI sceNpLookupNpId(int reqId, const NpOnlineId* onlineId, void* npId,
     return StartOffline(lookup, reqId);
 }
 
+int APS5_VABI sceNpLookupPollAsync(int reqId, int* result) {
+    return PollAsync(lookup, reqId, result, SCE_NP_LOOKUP_ERROR_SYNCHRONOUS_REQUEST);
+}
+
+int APS5_VABI sceNpLookupSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout) {
+    return SetTimeout(lookup, id, resolveRetry, resolveTimeout, connTimeout, sendTimeout, recvTimeout);
+}
+
+int APS5_VABI sceNpLookupWaitAsync(int reqId, int* result) {
+    return WaitAsync(lookup, reqId, result, SCE_NP_LOOKUP_ERROR_SYNCHRONOUS_REQUEST);
+}
+
 int APS5_VABI sceNpWordFilterAbortRequest(int reqId) {
-    std::lock_guard lock(wordFilter.mutex);
-    const auto request = wordFilter.requests.find(reqId);
-    if (request == wordFilter.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
-    request->second.aborted = true;
-    if (!request->second.finished) {
-        request->second.finished = true;
-        request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED;
-    }
-    return 0;
+    return AbortRequest(wordFilter, reqId);
 }
 
 int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void* option) {
@@ -175,7 +524,7 @@ int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void*
 }
 
 int APS5_VABI sceNpWordFilterCreateAsyncRequest(int titleCtxId, const std::uint64_t* param) {
-    if (!param || *param != WORD_FILTER_ASYNC_PARAMETER_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!param || *param != ASYNC_REQUEST_PARAMETER_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
     return CreateRequest(wordFilter, titleCtxId, true);
 }
 
@@ -196,13 +545,7 @@ int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId) {
 }
 
 int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result) {
-    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
-    std::lock_guard lock(wordFilter.mutex);
-    const auto request = wordFilter.requests.find(reqId);
-    if (request == wordFilter.requests.end() || !request->second.async) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
-    if (!request->second.finished) return POLL_RUNNING;
-    *result = request->second.result;
-    return POLL_FINISHED;
+    return PollAsync(wordFilter, reqId, result, SCE_NP_COMMUNITY_ERROR_INVALID_ID);
 }
 
 int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option) {
@@ -212,4 +555,12 @@ int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, cha
     return StartOffline(wordFilter, reqId);
 }
 
+int APS5_VABI sceNpWordFilterSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout) {
+    return SetTimeout(wordFilter, id, resolveRetry, resolveTimeout, connTimeout, sendTimeout, recvTimeout);
+}
+
+int APS5_VABI sceNpWordFilterWaitAsync(int reqId, int* result) {
+    return WaitAsync(wordFilter, reqId, result, SCE_NP_COMMUNITY_ERROR_INVALID_ID);
+}
+
 }
diff --git a/core/libs/prx/libSceNpUtility/include/Api.hpp b/core/libs/prx/libSceNpUtility/include/Api.hpp
new file mode 100644
index 0000000000..0fe054556f
--- /dev/null
+++ b/core/libs/prx/libSceNpUtility/include/Api.hpp
@@ -0,0 +1,105 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpBandwidthTestAbort(int contextId);
+int APS5_VABI sceNpBandwidthTestGetStatus(int contextId, int* status);
+int APS5_VABI sceNpBandwidthTestInitStartDownload(const void* param);
+int APS5_VABI sceNpBandwidthTestInitStartUpload(const void* param);
+int APS5_VABI sceNpBandwidthTestShutdown(int contextId, void* result);
+int APS5_VABI sceNpBandwidthTestInitStart();
+int APS5_VABI sceNpLookupCreateRequest(int titleCtxId);
+int APS5_VABI sceNpLookupCreateTitleCtx(const void* selfNpId);
+int APS5_VABI sceNpLookupDeleteRequest(int reqId);
+int APS5_VABI sceNpLookupDeleteTitleCtx(int titleCtxId);
+int APS5_VABI sceNpLookupNpId(int reqId, const NpOnlineId* onlineId, void* npId, void* option);
+int APS5_VABI sceNpWordFilterAbortRequest(int reqId);
+int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void* option);
+int APS5_VABI sceNpWordFilterCreateAsyncRequest(int titleCtxId, const std::uint64_t* param);
+int APS5_VABI sceNpWordFilterCreateRequest(int titleCtxId);
+int APS5_VABI sceNpWordFilterCreateTitleCtx(const void* selfNpId);
+int APS5_VABI sceNpWordFilterDeleteRequest(int reqId);
+int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId);
+int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result);
+int APS5_VABI sceNpLookupAbortRequest(int reqId);
+int APS5_VABI sceNpLookupCreateAsyncRequest(int titleCtxId, const std::uint64_t* param);
+int APS5_VABI sceNpLookupPollAsync(int reqId, int* result);
+int APS5_VABI sceNpLookupSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout);
+int APS5_VABI sceNpLookupWaitAsync(int reqId, int* result);
+int APS5_VABI sceNpWordFilterSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout);
+int APS5_VABI sceNpWordFilterWaitAsync(int reqId, int* result);
+int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option);
+
+int APS5_VABI sceNpAppInfoIntAbortRequest();
+int APS5_VABI sceNpAppInfoIntCheckAvailability();
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityA();
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAll();
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAllA();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailability();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityA();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAll();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAllA();
+int APS5_VABI sceNpAppInfoIntCreateRequest();
+int APS5_VABI sceNpAppInfoIntDestroyRequest();
+int APS5_VABI sceNpAppInfoIntFinalize();
+int APS5_VABI sceNpAppInfoIntInitialize();
+int APS5_VABI sceNpAppLaunchLink2IntAbortRequest();
+int APS5_VABI sceNpAppLaunchLink2IntCreateRequest();
+int APS5_VABI sceNpAppLaunchLink2IntDestroyRequest();
+int APS5_VABI sceNpAppLaunchLink2IntFinalize();
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdList();
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdNum();
+int APS5_VABI sceNpAppLaunchLink2IntInitialize();
+int APS5_VABI sceNpAppLaunchLinkIntAbortRequest();
+int APS5_VABI sceNpAppLaunchLinkIntCreateRequest();
+int APS5_VABI sceNpAppLaunchLinkIntDestroyRequest();
+int APS5_VABI sceNpAppLaunchLinkIntFinalize();
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdList();
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdNum();
+int APS5_VABI sceNpAppLaunchLinkIntInitialize();
+int APS5_VABI sceNpBandwidthTestShutdownWithDetailedInfo();
+int APS5_VABI sceNpLookupCreateTitleCtxA();
+int APS5_VABI sceNpLookupNetAbortRequest();
+int APS5_VABI sceNpLookupNetCensorComment();
+int APS5_VABI sceNpLookupNetConvertJidToNpId();
+int APS5_VABI sceNpLookupNetConvertNpIdToJid();
+int APS5_VABI sceNpLookupNetCreateRequest();
+int APS5_VABI sceNpLookupNetCreateTitleCtx();
+int APS5_VABI sceNpLookupNetDeleteRequest();
+int APS5_VABI sceNpLookupNetDeleteTitleCtx();
+int APS5_VABI sceNpLookupNetInit();
+int APS5_VABI sceNpLookupNetInitWithFunctionPointer();
+int APS5_VABI sceNpLookupNetInitWithMemoryPool();
+int APS5_VABI sceNpLookupNetIsInit();
+int APS5_VABI sceNpLookupNetNpId();
+int APS5_VABI sceNpLookupNetSanitizeComment();
+int APS5_VABI sceNpLookupNetSetTimeout();
+int APS5_VABI sceNpLookupNetTerm();
+int APS5_VABI sceNpServiceChecker2IntAbortRequest();
+int APS5_VABI sceNpServiceChecker2IntCreateRequest();
+int APS5_VABI sceNpServiceChecker2IntDestroyRequest();
+int APS5_VABI sceNpServiceChecker2IntFinalize();
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailability();
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailabilityA();
+int APS5_VABI sceNpServiceChecker2IntInitialize();
+int APS5_VABI sceNpServiceChecker2IntIsSetServiceType();
+int APS5_VABI sceNpServiceCheckerIntAbortRequest();
+int APS5_VABI sceNpServiceCheckerIntCreateRequest();
+int APS5_VABI sceNpServiceCheckerIntDestroyRequest();
+int APS5_VABI sceNpServiceCheckerIntFinalize();
+int APS5_VABI sceNpServiceCheckerIntGetAvailability();
+int APS5_VABI sceNpServiceCheckerIntGetAvailabilityList();
+int APS5_VABI sceNpServiceCheckerIntInitialize();
+int APS5_VABI sceNpServiceCheckerIntIsCached();
+int APS5_VABI sceNpTitleMetadataIntAbortRequest();
+int APS5_VABI sceNpTitleMetadataIntCreateRequest();
+int APS5_VABI sceNpTitleMetadataIntDeleteRequest();
+int APS5_VABI sceNpTitleMetadataIntGetInfo();
+int APS5_VABI sceNpTitleMetadataIntGetNpTitleId();
+int APS5_VABI sceNpUtilityInit();
+int APS5_VABI sceNpUtilityTerm();
+int APS5_VABI sceNpWordFilterCreateTitleCtxA();
+
+}
diff --git a/core/libs/prx/libSceNpUtility/libSceNpUtility.hpp b/core/libs/prx/libSceNpUtility/libSceNpUtility.hpp
new file mode 100644
index 0000000000..01af5539aa
--- /dev/null
+++ b/core/libs/prx/libSceNpUtility/libSceNpUtility.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpUtility/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpWebApi/Export.cpp b/core/libs/prx/libSceNpWebApi/Export.cpp
index 1aece4e185..269bbec537 100644
--- a/core/libs/prx/libSceNpWebApi/Export.cpp
+++ b/core/libs/prx/libSceNpWebApi/Export.cpp
@@ -1,50 +1,133 @@
+#include "prx/libSceNpWebApi/include/Api.hpp"
 #include "SceTypes.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <cstddef>
 #include <cstdint>
+#include <cstring>
 #include <mutex>
+#include <stdexcept>
 #include <unordered_map>
 #include <unordered_set>
 
 static constexpr int SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80552902);
+static constexpr int SCE_NP_WEBAPI_ERROR_INVALID_LIB_CONTEXT_ID = static_cast<int>(0x80552903);
 static constexpr int SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND = static_cast<int>(0x80552904);
+static constexpr int SCE_NP_WEBAPI_ERROR_USER_CONTEXT_NOT_FOUND = static_cast<int>(0x80552905);
+static constexpr int SCE_NP_WEBAPI_ERROR_REQUEST_NOT_FOUND = static_cast<int>(0x80552906);
+static constexpr int SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN = static_cast<int>(0x80552907);
+static constexpr int SCE_NP_WEBAPI_ERROR_INVALID_CONTENT_PARAMETER = static_cast<int>(0x80552908);
+static constexpr int SCE_NP_WEBAPI_ERROR_ABORTED = static_cast<int>(0x80552909);
+static constexpr int SCE_NP_WEBAPI_ERROR_USER_CONTEXT_ALREADY_EXIST = static_cast<int>(0x8055290A);
 static constexpr int SCE_NP_WEBAPI_ERROR_PUSH_EVENT_FILTER_NOT_FOUND = static_cast<int>(0x8055290B);
+static constexpr int SCE_NP_WEBAPI_ERROR_PUSH_EVENT_CALLBACK_NOT_FOUND = static_cast<int>(0x8055290C);
 static constexpr int SCE_NP_WEBAPI_ERROR_HANDLE_NOT_FOUND = static_cast<int>(0x8055290D);
 static constexpr int SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_FILTER_NOT_FOUND = static_cast<int>(0x8055290E);
+static constexpr int SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_CALLBACK_NOT_FOUND = static_cast<int>(0x8055290F);
 static constexpr int SCE_NP_WEBAPI_ERROR_SIGNED_IN_USER_NOT_FOUND = static_cast<int>(0x80552910);
 static constexpr int SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_MAX = static_cast<int>(0x8055291A);
 
+static constexpr int SCE_NP_WEBAPI_HTTP_METHOD_DELETE = 3;
+static constexpr std::uint32_t SCE_NP_INVALID_SERVICE_LABEL = 0xFFFFFFFF;
+static constexpr std::uint32_t SDK_VERSION_1_00 = 0x01000000;
+static constexpr std::uint32_t SDK_VERSION_2_00 = 0x02000000;
+static constexpr std::uint32_t SDK_VERSION_2_50 = 0x02500000;
+
 namespace {
 
+struct Request {
+    bool aborted;
+};
+
+struct UserContext {
+    int userId;
+    std::unordered_map<std::int64_t, Request> requests;
+    std::unordered_set<int> pushEventCallbacks;
+    std::unordered_set<int> servicePushEventCallbacks;
+};
+
 struct LibraryContext {
     int libHttpCtxId;
     std::size_t poolSize;
     std::unordered_set<int> handles;
     std::unordered_set<int> pushEventFilters;
+    std::unordered_map<int, UserContext> userContexts;
+};
+
+struct UserContextLookup {
+    int error;
+    LibraryContext* library;
+    UserContext* user;
+};
+
+struct RequestLookup {
+    int error;
+    UserContext* user;
+    Request* request;
 };
 
 std::mutex contextsMutex;
 std::unordered_map<int, LibraryContext> contexts;
 int lastContext = 0;
 int lastObject = 0;
+int lastUserContext = 0;
+std::int64_t lastRequest = 0;
 
 int nextObject() {
     lastObject = lastObject % 0xefffffff + 1;
     return lastObject;
 }
 
+std::uint32_t compiledSdkVersion() {
+    const auto* process = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t version;
+    std::memcpy(&version, process + 16, sizeof(version));
+    return version;
+}
+
+UserContextLookup findUserContext(int titleUserCtxId) {
+    const auto library = contexts.find(titleUserCtxId >> 16);
+    if (library == contexts.end()) return {SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND, nullptr, nullptr};
+    const auto user = library->second.userContexts.find(titleUserCtxId);
+    if (user == library->second.userContexts.end()) return {SCE_NP_WEBAPI_ERROR_USER_CONTEXT_NOT_FOUND, &library->second, nullptr};
+    return {0, &library->second, &user->second};
+}
+
+RequestLookup findRequest(std::int64_t requestId) {
+    const auto lookup = findUserContext(static_cast<int>(requestId >> 32));
+    if (lookup.error != 0) return {lookup.error, nullptr, nullptr};
+    const auto request = lookup.user->requests.find(requestId);
+    if (request == lookup.user->requests.end()) return {SCE_NP_WEBAPI_ERROR_REQUEST_NOT_FOUND, lookup.user, nullptr};
+    return {0, lookup.user, &request->second};
+}
+
 }
 
 extern "C" {
 
-int APS5_VABI sceNpWebApiAbortRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiAbortRequest(std::int64_t requestId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findRequest(requestId);
+    if (lookup.error != 0) return lookup.error;
+    lookup.request->aborted = true;
     return 0;
 }
 
-int APS5_VABI sceNpWebApiCreateContext() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiCreateContext(int libCtxId, const void* onlineId) {
+    if (libCtxId >= 0x8000) return SCE_NP_WEBAPI_ERROR_INVALID_LIB_CONTEXT_ID;
+    if (!onlineId) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto context = contexts.find(libCtxId);
+    if (context == contexts.end()) return SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND;
+    auto& userContexts = context->second.userContexts;
+    for (const auto& [id, user] : userContexts) {
+        if (user.userId == USER_SERVICE_INITIAL_USER_ID) return SCE_NP_WEBAPI_ERROR_USER_CONTEXT_ALREADY_EXIST;
+    }
+    lastUserContext = lastUserContext % 0xffff + 1;
+    const int titleUserCtxId = (libCtxId << 16) | lastUserContext;
+    userContexts.emplace(titleUserCtxId, UserContext{USER_SERVICE_INITIAL_USER_ID, {}, {}, {}});
+    return titleUserCtxId;
 }
 
 int APS5_VABI sceNpWebApiCreateHandle(int libCtxId) {
@@ -66,14 +149,26 @@ int APS5_VABI sceNpWebApiCreatePushEventFilter(int libCtxId, const void* filterP
     return filter;
 }
 
-int APS5_VABI sceNpWebApiCreateRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiCreateRequest(int titleUserCtxId, const char* apiGroup, const char* path, int method, const NpWebApiContentParameter* contentParameter, std::int64_t* requestId) {
+    if (!apiGroup || !path) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    if (contentParameter && contentParameter->contentLength != 0 && !contentParameter->contentType) return SCE_NP_WEBAPI_ERROR_INVALID_CONTENT_PARAMETER;
+    if (method > SCE_NP_WEBAPI_HTTP_METHOD_DELETE && compiledSdkVersion() >= SDK_VERSION_2_50) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    lastRequest = lastRequest % 0xffffffff + 1;
+    const std::int64_t base = static_cast<std::int64_t>(titleUserCtxId) << 32;
+    std::int64_t id = base | lastRequest;
+    while (lookup.user->requests.contains(id)) --id;
+    if (id <= base) throw std::runtime_error("sceNpWebApiCreateRequest: every request id of the user context is in use");
+    lookup.user->requests.emplace(id, Request{false});
+    if (requestId) *requestId = id;
     return 0;
 }
 
 int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId, const char* npServiceName, std::uint32_t npServiceLabel, const void* filterParam, std::size_t filterParamNum) {
-    (void)npServiceLabel;
     if (!npServiceName || !filterParam || filterParamNum == 0) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    if (npServiceLabel == SCE_NP_INVALID_SERVICE_LABEL && compiledSdkVersion() >= SDK_VERSION_2_00) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(contextsMutex);
     const auto context = contexts.find(libCtxId);
     if (context == contexts.end()) return SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND;
@@ -81,8 +176,11 @@ int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId
     return SCE_NP_WEBAPI_ERROR_SIGNED_IN_USER_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiDeleteContext() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiDeleteContext(int titleUserCtxId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    lookup.library->userContexts.erase(titleUserCtxId);
     return 0;
 }
 
@@ -100,8 +198,11 @@ int APS5_VABI sceNpWebApiDeletePushEventFilter(int libCtxId, int filterId) {
     return context->second.pushEventFilters.erase(filterId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_PUSH_EVENT_FILTER_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiDeleteRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiDeleteRequest(std::int64_t requestId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findRequest(requestId);
+    if (lookup.error != 0) return lookup.error;
+    lookup.user->requests.erase(requestId);
     return 0;
 }
 
@@ -132,7 +233,7 @@ int APS5_VABI sceNpWebApiInitialize(int libHttpCtxId, std::size_t poolSize) {
     for (int attempt = 0; attempt < 0x7fff; ++attempt) {
         lastContext = lastContext % 0x7fff + 1;
         if (contexts.contains(lastContext)) continue;
-        contexts[lastContext] = {libHttpCtxId, poolSize, {}, {}};
+        contexts[lastContext] = {libHttpCtxId, poolSize, {}, {}, {}};
         return lastContext;
     }
     return SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_MAX;
@@ -143,19 +244,40 @@ int APS5_VABI sceNpWebApiReadData() {
     return 0;
 }
 
-int APS5_VABI sceNpWebApiRegisterPushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiRegisterPushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg) {
+    (void)userArg;
+    if (!callback && compiledSdkVersion() >= SDK_VERSION_1_00) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    if (!lookup.library->pushEventFilters.contains(filterId) && compiledSdkVersion() >= SDK_VERSION_2_50) return SCE_NP_WEBAPI_ERROR_PUSH_EVENT_FILTER_NOT_FOUND;
+    const auto callbackId = nextObject();
+    lookup.user->pushEventCallbacks.insert(callbackId);
+    return callbackId;
 }
 
-int APS5_VABI sceNpWebApiRegisterServicePushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiRegisterServicePushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg) {
+    (void)filterId;
+    (void)userArg;
+    if (!callback && compiledSdkVersion() >= SDK_VERSION_1_00) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    if (compiledSdkVersion() >= SDK_VERSION_2_50) return SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_FILTER_NOT_FOUND;
+    if (!callback) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    const auto callbackId = nextObject();
+    lookup.user->servicePushEventCallbacks.insert(callbackId);
+    return callbackId;
 }
 
-int APS5_VABI sceNpWebApiSendRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiSendRequest(std::int64_t requestId, const void* data, std::size_t dataSize) {
+    (void)data;
+    (void)dataSize;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findRequest(requestId);
+    if (lookup.error != 0) return lookup.error;
+    if (lookup.request->aborted) return SCE_NP_WEBAPI_ERROR_ABORTED;
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
 }
 
 int APS5_VABI sceNpWebApiTerminate(int libCtxId) {
@@ -163,14 +285,18 @@ int APS5_VABI sceNpWebApiTerminate(int libCtxId) {
     return contexts.erase(libCtxId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiUnregisterPushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiUnregisterPushEventCallback(int titleUserCtxId, int callbackId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    return lookup.user->pushEventCallbacks.erase(callbackId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_PUSH_EVENT_CALLBACK_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback(int titleUserCtxId, int callbackId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    return lookup.user->servicePushEventCallbacks.erase(callbackId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_CALLBACK_NOT_FOUND;
 }
 
 int APS5_VABI sceNpWebApiUtilityParseNpId() {
diff --git a/core/libs/prx/libSceNpWebApi/include/Api.hpp b/core/libs/prx/libSceNpWebApi/include/Api.hpp
new file mode 100644
index 0000000000..ec9ce3c836
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi/include/Api.hpp
@@ -0,0 +1,39 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpWebApiContentParameter {
+    std::uint64_t contentLength;
+    const char* contentType;
+    std::uint8_t reserved[16];
+};
+
+static_assert(sizeof(NpWebApiContentParameter) == 32);
+
+extern "C" {
+
+int APS5_VABI sceNpWebApiAbortRequest(std::int64_t requestId);
+int APS5_VABI sceNpWebApiCreateContext(int libCtxId, const void* onlineId);
+int APS5_VABI sceNpWebApiCreateHandle(int libCtxId);
+int APS5_VABI sceNpWebApiCreatePushEventFilter(int libCtxId, const void* filterParam, std::size_t filterParamNum);
+int APS5_VABI sceNpWebApiCreateRequest(int titleUserCtxId, const char* apiGroup, const char* path, int method, const NpWebApiContentParameter* contentParameter, std::int64_t* requestId);
+int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId, const char* npServiceName, std::uint32_t npServiceLabel, const void* filterParam, std::size_t filterParamNum);
+int APS5_VABI sceNpWebApiDeleteContext(int titleUserCtxId);
+int APS5_VABI sceNpWebApiDeleteHandle(int libCtxId, int handleId);
+int APS5_VABI sceNpWebApiDeletePushEventFilter(int libCtxId, int filterId);
+int APS5_VABI sceNpWebApiDeleteRequest(std::int64_t requestId);
+int APS5_VABI sceNpWebApiDeleteServicePushEventFilter(int libCtxId, int filterId);
+int APS5_VABI sceNpWebApiGetHttpResponseHeaderValue();
+int APS5_VABI sceNpWebApiGetHttpResponseHeaderValueLength();
+int APS5_VABI sceNpWebApiGetHttpStatusCode();
+int APS5_VABI sceNpWebApiInitialize(int libHttpCtxId, std::size_t poolSize);
+int APS5_VABI sceNpWebApiReadData();
+int APS5_VABI sceNpWebApiRegisterPushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg);
+int APS5_VABI sceNpWebApiRegisterServicePushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg);
+int APS5_VABI sceNpWebApiSendRequest(std::int64_t requestId, const void* data, std::size_t dataSize);
+int APS5_VABI sceNpWebApiTerminate(int libCtxId);
+int APS5_VABI sceNpWebApiUnregisterPushEventCallback(int titleUserCtxId, int callbackId);
+int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback(int titleUserCtxId, int callbackId);
+int APS5_VABI sceNpWebApiUtilityParseNpId();
+
+}
diff --git a/core/libs/prx/libSceNpWebApi/libSceNpWebApi.hpp b/core/libs/prx/libSceNpWebApi/libSceNpWebApi.hpp
new file mode 100644
index 0000000000..3688862c87
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi/libSceNpWebApi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpWebApi/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpWebApi2/Export.cpp b/core/libs/prx/libSceNpWebApi2/Export.cpp
index daef37aa53..66a26fe70b 100644
--- a/core/libs/prx/libSceNpWebApi2/Export.cpp
+++ b/core/libs/prx/libSceNpWebApi2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpWebApi2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -15,19 +16,8 @@ static constexpr int SCE_NP_WEBAPI2_ERROR_INVALID_CONTEXT = static_cast<int>(0x8
 static constexpr int SCE_NP_WEBAPI2_ERROR_INVALID_HANDLE = static_cast<int>(0x8055340D);
 static std::atomic<int> g_nextHandle{1};
 
-struct NpWebApi2PushContextId {
-    char value[37];
-};
-
 static_assert(sizeof(NpWebApi2PushContextId) == 37);
 
-struct NpWebApi2MemoryPoolStats {
-    size_t pool_size;
-    size_t max_inuse_size;
-    size_t current_inuse_size;
-    int32_t reserved;
-};
-
 static_assert(sizeof(NpWebApi2MemoryPoolStats) == 32);
 
 static std::mutex g_poolsMutex;
diff --git a/core/libs/prx/libSceNpWebApi2/include/Api.hpp b/core/libs/prx/libSceNpWebApi2/include/Api.hpp
new file mode 100644
index 0000000000..c528b23c20
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi2/include/Api.hpp
@@ -0,0 +1,58 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpWebApi2MemoryPoolStats {
+    size_t pool_size;
+    size_t max_inuse_size;
+    size_t current_inuse_size;
+    int32_t reserved;
+};
+
+struct NpWebApi2PushContextId {
+    char value[37];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpWebApi2AbortRequest(int64_t requestId);
+int APS5_VABI sceNpWebApi2AddHttpRequestHeader(int64_t requestId, const char* fieldName, const char* value);
+int APS5_VABI sceNpWebApi2AddWebTraceTag(std::int64_t requestId, const char* value);
+void APS5_VABI sceNpWebApi2CheckTimeout(void);
+int APS5_VABI sceNpWebApi2CreateRequest(int userContextId, const char* apiGroup, const char* path, const char* method, const void* contentParameter, int64_t* requestId);
+int APS5_VABI sceNpWebApi2CreateUserContext(int libCtxId, int userId);
+int APS5_VABI sceNpWebApi2DeleteRequest(int64_t requestId);
+int APS5_VABI sceNpWebApi2DeleteUserContext(int userContextId);
+int APS5_VABI sceNpWebApi2GetHttpResponseHeaderValue(int64_t requestId, const char* fieldName, char* value, size_t valueSize);
+int APS5_VABI sceNpWebApi2GetHttpResponseHeaderValueLength(int64_t requestId, const char* fieldName, size_t* valueLength);
+int APS5_VABI sceNpWebApi2Initialize(int libHttpCtxId, size_t poolSize);
+int APS5_VABI sceNpWebApi2GetMemoryPoolStats(int libraryContextId, NpWebApi2MemoryPoolStats* stats);
+int APS5_VABI sceNpWebApi2PushEventCreateFilter(int libCtxId, int handleId, const char* npServiceName, uint32_t npServiceLabel, const void* filterParam, size_t filterParamNum);
+int APS5_VABI sceNpWebApi2PushEventCreateHandle(int libraryContextId);
+int APS5_VABI sceNpWebApi2PushEventAbortHandle(int libraryContextId, int handleId);
+int APS5_VABI sceNpWebApi2PushEventDeleteHandle(int libraryContextId, int handleId);
+int APS5_VABI sceNpWebApi2PushEventDeletePushContext(int userContextId, const void* pushContextId);
+int APS5_VABI sceNpWebApi2PushEventRegisterCallback(int userContextId, int filterId, void* callback, void* userArg);
+int APS5_VABI sceNpWebApi2ReadData(int64_t requestId, void* data, size_t size);
+int APS5_VABI sceNpWebApi2SendRequest(int64_t requestId, const void* data, size_t dataSize, NpWebApi2ResponseInformationOption* responseInfoOption);
+int APS5_VABI sceNpWebApi2Terminate(int libCtxId);
+int APS5_VABI sceNpWebApi2PushEventCreatePushContext(std::int32_t userContextId, NpWebApi2PushContextId* pushContextId);
+int APS5_VABI sceNpWebApi2PushEventDeleteFilter(std::int32_t libraryContextId, std::int32_t filterId);
+int APS5_VABI sceNpWebApi2PushEventSetHandleTimeout(int libraryContextId, int handleId, std::uint32_t timeout);
+int APS5_VABI sceNpWebApi2PushEventRegisterPushContextCallback();
+int APS5_VABI sceNpWebApi2PushEventStartPushContextCallback(std::int32_t userContextId, const NpWebApi2PushContextId* pushContextId);
+int APS5_VABI sceNpWebApi2PushEventUnregisterCallback(std::int32_t userContextId, std::int32_t callbackId);
+int APS5_VABI sceNpWebApi2PushEventUnregisterPushContextCallback(std::int32_t userContextId, std::int32_t callbackId);
+int APS5_VABI sceNpWebApi2SetRequestTimeout(int64_t requestId, uint32_t timeout);
+int APS5_VABI sceNpWebApi2AddMultipartPart();
+int APS5_VABI sceNpWebApi2CreateMultipartRequest(int userCtxId, const char* apiGroup, const char* path, const char* method, int64_t* requestId);
+int APS5_VABI sceNpWebApi2InitializeForPresence(int libHttpCtxId, uint64_t poolSize);
+int APS5_VABI sceNpWebApi2IntCreateRequest();
+int APS5_VABI sceNpWebApi2IntInitialize(const NpWebApi2IntInitializeArgs* args);
+int APS5_VABI sceNpWebApi2IntInitialize2(const NpWebApi2IntInitialize2Args* args);
+int APS5_VABI sceNpWebApi2IntPushEventCreateCtxIndFilter();
+int APS5_VABI sceNpWebApi2IntPushEventCreateDestPs4CtxIndFilter();
+int APS5_VABI sceNpWebApi2SendMultipartRequest(int64_t requestId, int partIndex, void* data, uint64_t dataSize, void* respInfoOption);
+int APS5_VABI sceNpWebApi2SetMultipartContentType();
+
+}
diff --git a/core/libs/prx/libSceNpWebApi2/libSceNpWebApi2.hpp b/core/libs/prx/libSceNpWebApi2/libSceNpWebApi2.hpp
new file mode 100644
index 0000000000..6c299c3731
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi2/libSceNpWebApi2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpWebApi2/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusCeltDec/Export.cpp b/core/libs/prx/libSceOpusCeltDec/Export.cpp
index 5f40c01b3c..664483dd5d 100644
--- a/core/libs/prx/libSceOpusCeltDec/Export.cpp
+++ b/core/libs/prx/libSceOpusCeltDec/Export.cpp
@@ -1,5 +1,7 @@
+#include "prx/libSceOpusCeltDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceOpusDec/include/OpusDecoder.hpp"
+#include "prx/libSceOpusDec/include/OpusDecodeVariants.hpp"
 #include <cstdint>
 #include "prx/libc/include/General.hpp"
 
@@ -7,6 +9,8 @@ namespace {
 
 OpusDecoderLibrary library("OpusCeltDec", true);
 
+constexpr std::uint32_t ErrorBase = 0x81400000u;
+
 } // namespace
 
 extern "C" {
@@ -37,19 +41,16 @@ int APS5_VABI sceOpusCeltDecCtl() {
     return 0;
 }
 
-int APS5_VABI sceOpusCeltDecDecodeFloat() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusCeltDecDecodeFloat(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity) {
+    return OpusDecodeVariant(library, ErrorBase, state, data, bytes, pcm, capacity, OpusDefaultDecodePriority, true);
 }
 
-int APS5_VABI sceOpusCeltDecDecodeFloatWithPriority() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusCeltDecDecodeFloatWithPriority(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity, int priority) {
+    return OpusDecodeVariant(library, ErrorBase, state, data, bytes, pcm, capacity, priority, true);
 }
 
-int APS5_VABI sceOpusCeltDecDecodeWithPriority() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusCeltDecDecodeWithPriority(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity, int priority) {
+    return OpusDecodeVariant(library, ErrorBase, state, data, bytes, pcm, capacity, priority, false);
 }
 
 }
diff --git a/core/libs/prx/libSceOpusCeltDec/include/Api.hpp b/core/libs/prx/libSceOpusCeltDec/include/Api.hpp
new file mode 100644
index 0000000000..1ba7cb6be1
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltDec/include/Api.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceOpusCeltDecInitialize(std::uint32_t* context);
+int APS5_VABI sceOpusCeltDecTerminate(const std::uint32_t* context);
+int APS5_VABI sceOpusCeltDecGetSize(int channels);
+int APS5_VABI sceOpusCeltDecCreateEx(const std::uint32_t* context, void* state, int sampleRate, int channels);
+int APS5_VABI sceOpusCeltDecDecode(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity);
+int APS5_VABI sceOpusCeltDecDestroy(void* state);
+int APS5_VABI sceOpusCeltDecCreate();
+int APS5_VABI sceOpusCeltDecCtl();
+int APS5_VABI sceOpusCeltDecDecodeFloat(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity);
+int APS5_VABI sceOpusCeltDecDecodeFloatWithPriority(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity, int priority);
+int APS5_VABI sceOpusCeltDecDecodeWithPriority(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity, int priority);
+
+}
diff --git a/core/libs/prx/libSceOpusCeltDec/libSceOpusCeltDec.hpp b/core/libs/prx/libSceOpusCeltDec/libSceOpusCeltDec.hpp
new file mode 100644
index 0000000000..47b7b5511c
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltDec/libSceOpusCeltDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusCeltDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusCeltEnc/Export.cpp b/core/libs/prx/libSceOpusCeltEnc/Export.cpp
index bcbe6e9029..5f837e73e4 100644
--- a/core/libs/prx/libSceOpusCeltEnc/Export.cpp
+++ b/core/libs/prx/libSceOpusCeltEnc/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceOpusCeltEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct OpusCeltEncoder;
-
 extern "C" {
 
 int APS5_VABI sceOpusCeltEncCreate(OpusCeltEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application) {
diff --git a/core/libs/prx/libSceOpusCeltEnc/include/Api.hpp b/core/libs/prx/libSceOpusCeltEnc/include/Api.hpp
new file mode 100644
index 0000000000..5a38483d1d
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltEnc/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct OpusCeltEncoder;
+
+extern "C" {
+
+int APS5_VABI sceOpusCeltEncCreate(OpusCeltEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusCeltEncCreateEx(const std::uint32_t* contextId, OpusCeltEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusCeltEncCtl(OpusCeltEncoder* encoder, std::int32_t request, ...);
+int APS5_VABI sceOpusCeltEncDestroy(OpusCeltEncoder* encoder);
+int APS5_VABI sceOpusCeltEncEncode(OpusCeltEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusCeltEncEncodeFloat(OpusCeltEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusCeltEncEncodeFloatWithPriority(OpusCeltEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusCeltEncEncodeWithPriority(OpusCeltEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusCeltEncGetSize(std::int32_t channels);
+int APS5_VABI sceOpusCeltEncInitialize(std::uint32_t* contextId);
+int APS5_VABI sceOpusCeltEncTerminate(const std::uint32_t* contextId);
+
+}
diff --git a/core/libs/prx/libSceOpusCeltEnc/libSceOpusCeltEnc.hpp b/core/libs/prx/libSceOpusCeltEnc/libSceOpusCeltEnc.hpp
new file mode 100644
index 0000000000..9a54c5f490
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltEnc/libSceOpusCeltEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusCeltEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusDec/CMakeLists.txt b/core/libs/prx/libSceOpusDec/CMakeLists.txt
index 01bf008dd3..4356e19cab 100644
--- a/core/libs/prx/libSceOpusDec/CMakeLists.txt
+++ b/core/libs/prx/libSceOpusDec/CMakeLists.txt
@@ -14,3 +14,15 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceOpusDec>")
     endif()
 endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_opus_dec_variants_tests ${LIBS_INCLUDE_DIR}/tests/GuestOpusDecVariants.cpp)
+    target_include_directories(guest_opus_dec_variants_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_opus_dec_variants_tests PRIVATE libSceOpusDec libSceOpusCeltDec libc)
+    configure_windows_unwind(guest_opus_dec_variants_tests)
+    add_test(NAME guest_opus_dec_variants COMMAND guest_opus_dec_variants_tests)
+    if(WIN32)
+        set_tests_properties(guest_opus_dec_variants PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceOpusDec>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceOpusCeltDec>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceOpusDec/Export.cpp b/core/libs/prx/libSceOpusDec/Export.cpp
index ebf78206f4..138675d8f7 100644
--- a/core/libs/prx/libSceOpusDec/Export.cpp
+++ b/core/libs/prx/libSceOpusDec/Export.cpp
@@ -1,5 +1,7 @@
+#include "prx/libSceOpusDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceOpusDec/include/OpusDecoder.hpp"
+#include "prx/libSceOpusDec/include/OpusDecodeVariants.hpp"
 #include <cstdint>
 #include "prx/libc/include/General.hpp"
 
@@ -7,6 +9,8 @@ namespace {
 
 OpusDecoderLibrary library("OpusDec", false);
 
+constexpr std::uint32_t ErrorBase = 0x81740000u;
+
 } // namespace
 
 extern "C" {
@@ -42,29 +46,26 @@ int APS5_VABI sceOpusDecCtl() {
     return 0;
 }
 
-int APS5_VABI sceOpusDecDecodeFloat() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusDecDecodeFloat(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity) {
+    return OpusDecodeVariant(library, ErrorBase, state, data, bytes, pcm, capacity, OpusDefaultDecodePriority, true);
 }
 
-int APS5_VABI sceOpusDecDecodeFloatWithPriority() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusDecDecodeFloatWithPriority(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity, int priority) {
+    return OpusDecodeVariant(library, ErrorBase, state, data, bytes, pcm, capacity, priority, true);
 }
 
-int APS5_VABI sceOpusDecDecodeFloatWithPriorityAndTimeout() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusDecDecodeFloatWithPriorityAndTimeout(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity, int priority,
+                                                         std::uint32_t timeout, std::uint32_t*) {
+    return OpusDecodeVariantWithTimeout(library, ErrorBase, state, data, bytes, pcm, capacity, priority, true, timeout, __func__);
 }
 
-int APS5_VABI sceOpusDecDecodeWithPriority() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusDecDecodeWithPriority(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity, int priority) {
+    return OpusDecodeVariant(library, ErrorBase, state, data, bytes, pcm, capacity, priority, false);
 }
 
-int APS5_VABI sceOpusDecDecodeWithPriorityAndTimeout() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceOpusDecDecodeWithPriorityAndTimeout(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity, int priority,
+                                                    std::uint32_t timeout, std::uint32_t*) {
+    return OpusDecodeVariantWithTimeout(library, ErrorBase, state, data, bytes, pcm, capacity, priority, false, timeout, __func__);
 }
 
 }
diff --git a/core/libs/prx/libSceOpusDec/include/Api.hpp b/core/libs/prx/libSceOpusDec/include/Api.hpp
new file mode 100644
index 0000000000..492ffce7c0
--- /dev/null
+++ b/core/libs/prx/libSceOpusDec/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceOpusDecInitialize(std::uint32_t* context);
+int APS5_VABI sceOpusDecTerminate(const std::uint32_t* context);
+int APS5_VABI sceOpusDecGetSize(int channels);
+int APS5_VABI sceOpusDecCreateEx(const std::uint32_t* context, void* state, int sampleRate, int channels);
+int APS5_VABI sceOpusDecDecode(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity);
+int APS5_VABI sceOpusDecDestroy(void* state);
+int APS5_VABI sceOpusDecCancel();
+int APS5_VABI sceOpusDecCreate();
+int APS5_VABI sceOpusDecCtl();
+int APS5_VABI sceOpusDecDecodeFloat(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity);
+int APS5_VABI sceOpusDecDecodeFloatWithPriority(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity, int priority);
+int APS5_VABI sceOpusDecDecodeFloatWithPriorityAndTimeout(void* state, const std::uint8_t* data, int bytes, float* pcm, int capacity, int priority,
+                                                         std::uint32_t timeout, std::uint32_t* result);
+int APS5_VABI sceOpusDecDecodeWithPriority(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity, int priority);
+int APS5_VABI sceOpusDecDecodeWithPriorityAndTimeout(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity, int priority,
+                                                    std::uint32_t timeout, std::uint32_t* result);
+
+}
diff --git a/core/libs/prx/libSceOpusDec/include/OpusDecodeVariants.hpp b/core/libs/prx/libSceOpusDec/include/OpusDecodeVariants.hpp
new file mode 100644
index 0000000000..b6bc7a3c33
--- /dev/null
+++ b/core/libs/prx/libSceOpusDec/include/OpusDecodeVariants.hpp
@@ -0,0 +1,58 @@
+#ifndef CORE_LIBS_PRX_LIBSCEOPUSDEC_INCLUDE_OPUSDECODEVARIANTS_HPP
+#define CORE_LIBS_PRX_LIBSCEOPUSDEC_INCLUDE_OPUSDECODEVARIANTS_HPP
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <vector>
+#include "prx/libc/include/General.hpp"
+
+namespace {
+
+constexpr int OpusDefaultDecodePriority = 40;
+constexpr std::uint32_t OpusInfiniteTimeout = 0xFFFFFFFFu;
+
+inline int OpusCheckVariant(std::uint32_t errorBase, const void* state, const std::uint8_t* data, int bytes, const void* pcm, int capacity, int priority) {
+    const auto error = [errorBase](std::uint32_t offset) { return static_cast<int>(errorBase + offset); };
+    if (!state) return error(0);
+    if (bytes != 0 && !data) return error(6);
+    if (bytes < 0) return error(7);
+    if (!pcm) return error(8);
+    if (capacity < 0) return error(9);
+    if (priority < 20 || priority > 100) return error(10);
+    return 0;
+}
+
+template <typename TLibrary>
+int OpusDecodeVariant(TLibrary& library, std::uint32_t errorBase, void* state, const std::uint8_t* data, int bytes, void* pcm,
+                      int capacity, int priority, bool asFloat) {
+    if (const int check = OpusCheckVariant(errorBase, state, data, bytes, pcm, capacity, priority)) return check;
+    auto* samples = static_cast<std::int16_t*>(pcm);
+    if (!asFloat) return library.Decode(state, data, bytes, samples, capacity);
+    const int result = library.Decode(state, data, bytes, samples, capacity / 4 * 2);
+    if (result < 0) return result;
+    const auto count = static_cast<std::size_t>(result / 2);
+    std::vector<std::int16_t> decoded(count);
+    std::memcpy(decoded.data(), pcm, count * 2);
+    auto* output = static_cast<std::uint8_t*>(pcm);
+    for (std::size_t index = 0; index < count; ++index) {
+        const float value = decoded[index] > 0 ? decoded[index] / 32767.0f : decoded[index] / 32768.0f;
+        std::memcpy(output + index * 4, &value, 4);
+    }
+    return result * 2;
+}
+
+template <typename TLibrary>
+int OpusDecodeVariantWithTimeout(TLibrary& library, std::uint32_t errorBase, void* state, const std::uint8_t* data, int bytes, void* pcm,
+                                 int capacity, int priority, bool asFloat, std::uint32_t timeout, const char* name) {
+    if (timeout != OpusInfiniteTimeout) {
+        if (const int check = OpusCheckVariant(errorBase, state, data, bytes, pcm, capacity, priority)) return check;
+        NotImplemented_nid_no_patch(name);
+        return 0;
+    }
+    return OpusDecodeVariant(library, errorBase, state, data, bytes, pcm, capacity, priority, asFloat);
+}
+
+} // namespace
+
+#endif
diff --git a/core/libs/prx/libSceOpusDec/libSceOpusDec.hpp b/core/libs/prx/libSceOpusDec/libSceOpusDec.hpp
new file mode 100644
index 0000000000..fd17892819
--- /dev/null
+++ b/core/libs/prx/libSceOpusDec/libSceOpusDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusSilkEnc/Export.cpp b/core/libs/prx/libSceOpusSilkEnc/Export.cpp
index 4e741a3bf9..71bb17fe68 100644
--- a/core/libs/prx/libSceOpusSilkEnc/Export.cpp
+++ b/core/libs/prx/libSceOpusSilkEnc/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceOpusSilkEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct OpusSilkEncoder;
-
 extern "C" {
 
 int APS5_VABI sceOpusSilkEncCancel(OpusSilkEncoder* encoder, std::uint32_t batchId) {
diff --git a/core/libs/prx/libSceOpusSilkEnc/include/Api.hpp b/core/libs/prx/libSceOpusSilkEnc/include/Api.hpp
new file mode 100644
index 0000000000..01202c6ad9
--- /dev/null
+++ b/core/libs/prx/libSceOpusSilkEnc/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct OpusSilkEncoder;
+
+extern "C" {
+
+int APS5_VABI sceOpusSilkEncCancel(OpusSilkEncoder* encoder, std::uint32_t batchId);
+int APS5_VABI sceOpusSilkEncCreate(OpusSilkEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusSilkEncCreateEx(const std::uint32_t* contextId, OpusSilkEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusSilkEncCtl(OpusSilkEncoder* encoder, std::int32_t request, ...);
+int APS5_VABI sceOpusSilkEncDestroy(OpusSilkEncoder* encoder);
+int APS5_VABI sceOpusSilkEncEncode(OpusSilkEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusSilkEncEncodeFloat(OpusSilkEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusSilkEncEncodeFloatWithPriority(OpusSilkEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusSilkEncEncodeFloatWithPriorityAndTimeout(OpusSilkEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority, std::uint32_t timeout, std::uint32_t* batchId);
+int APS5_VABI sceOpusSilkEncEncodeWithPriority(OpusSilkEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusSilkEncEncodeWithPriorityAndTimeout(OpusSilkEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority, std::uint32_t timeout, std::uint32_t* batchId);
+int APS5_VABI sceOpusSilkEncGetSize(std::int32_t channels);
+int APS5_VABI sceOpusSilkEncInitialize(std::uint32_t* contextId);
+int APS5_VABI sceOpusSilkEncTerminate(const std::uint32_t* contextId);
+
+}
diff --git a/core/libs/prx/libSceOpusSilkEnc/libSceOpusSilkEnc.hpp b/core/libs/prx/libSceOpusSilkEnc/libSceOpusSilkEnc.hpp
new file mode 100644
index 0000000000..c11f4f27cd
--- /dev/null
+++ b/core/libs/prx/libSceOpusSilkEnc/libSceOpusSilkEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusSilkEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceOrbisCompat/libSceOrbisCompat.hpp b/core/libs/prx/libSceOrbisCompat/libSceOrbisCompat.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceOrbisCompat/libSceOrbisCompat.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePad/Export.cpp b/core/libs/prx/libScePad/Export.cpp
index 73c30094ed..0787a07dbf 100644
--- a/core/libs/prx/libScePad/Export.cpp
+++ b/core/libs/prx/libScePad/Export.cpp
@@ -12,40 +12,6 @@
 #include "prx/libScePad/include/Pad.hpp"
 #include "prx/libScePad/include/PadState.hpp"
 
-struct PadStickTuningParameter;
-struct PadTriggerTuningParameter;
-struct PadHuntProfile;
-struct PadLeonardoProfile;
-struct PadProfileInfo;
-struct PadActiveProfileInfo;
-struct PadSavedSettingInfo;
-struct PadUsbDetectionState;
-struct PadVrUsbConnectionStatus;
-struct PadDeviceInfo;
-struct PadLicenseControllerInformation;
-struct PadRemoteSetting;
-struct PadVirtualTriggerSetting;
-struct PadProcessFocusParameter;
-struct PadDataExtended;
-struct PadVrControllerData {
-    std::uint32_t buttons;
-    std::uint8_t stick[2];
-    std::uint8_t unused6[2];
-    std::uint8_t triggers[2];
-    std::uint8_t unused10[2];
-    std::uint32_t touchButtons;
-    std::uint8_t touchValues[4];
-    float acceleration[3];
-    float angularVelocity[3];
-    float orientation[4];
-    std::uint8_t unused60[4];
-    std::uint8_t connected;
-    std::uint8_t connectedCount;
-    std::uint8_t unused66[6];
-    std::uint64_t timestamp;
-    std::uint8_t unused80[24];
-};
-
 static_assert(sizeof(PadVrControllerData) == 104);
 static_assert(offsetof(PadVrControllerData, triggers) == 8);
 static_assert(offsetof(PadVrControllerData, touchButtons) == 12);
@@ -54,51 +20,11 @@ static_assert(offsetof(PadVrControllerData, angularVelocity) == 32);
 static_assert(offsetof(PadVrControllerData, orientation) == 44);
 static_assert(offsetof(PadVrControllerData, connected) == 64);
 static_assert(offsetof(PadVrControllerData, timestamp) == 72);
-struct PadVrControllerDeviceInformation;
-struct PadVrTriggerEffect;
-struct PadVrTriggerEffects;
-struct PadTriggerEffectExtended;
-struct PadExtensionReport;
-struct PadExtensionUnitInfo;
-struct PadTriggerInternalState;
-struct PadTrackerData;
-struct PadBlasterTrackerData;
-struct PadAstonTrackerData;
-struct PadUiData;
-struct PadUiTuningData;
-struct PadLotusButtonData;
-struct PadVersionInfo;
-struct PadTelemetryInfo;
-struct PadPortInfo;
-struct PadVrControllerCombinedState;
-struct PadLeonardoData;
-struct PadLeonardoUniqueData;
-struct PadHistoryData;
-struct PadUpdateParameter;
-struct PadVirtualDeviceParameter;
-struct PadVirtualDeviceId;
-struct PadVirtualDeviceComponentInformation;
-
-struct PadVirtualTriggerInternalState {
-    std::uint32_t states[2];
-    std::uint8_t mode;
-    std::uint8_t flags[2];
-};
 
 static_assert(sizeof(PadVirtualTriggerInternalState) == 12);
 static_assert(offsetof(PadVirtualTriggerInternalState, mode) == 8);
 static_assert(offsetof(PadVirtualTriggerInternalState, flags) == 9);
 
-struct PadLightBarBlinkingParameter {
-    std::uint8_t values[3];
-};
-
-struct PadButtonRemappingInfo {
-    std::uint8_t mapping[14];
-    std::uint8_t reserved;
-    std::uint8_t mode;
-};
-
 static_assert(sizeof(PadLightBarBlinkingParameter) == 3);
 static_assert(sizeof(PadButtonRemappingInfo) == 16);
 static_assert(offsetof(PadButtonRemappingInfo, mode) == 15);
@@ -109,8 +35,13 @@ constexpr int PAD_ERROR_DEVICE_NOT_CONNECTED = static_cast<int>(0x80920007);
 constexpr int PAD_ERROR_DEVICE_NO_HANDLE = static_cast<int>(0x80920008);
 constexpr int PAD_ERROR_ALREADY_OPENED = static_cast<int>(0x80920004);
 constexpr int PAD_ERROR_UNKNOWN_USER = static_cast<int>(0x809b0081);
+constexpr int PAD_ERROR_INVALID_USER_ID = static_cast<int>(0x809b0001);
+constexpr int PAD_ERROR_INVALID_PORT_INDEX = static_cast<int>(0x809b0003);
+constexpr int PAD_USER_ID_INVALID = -1;
 
-bool g_opened = false;
+std::array<bool, PAD_MAX_CONTROLLERS> g_opened{false};
+std::array<bool, PAD_MAX_CONTROLLERS> g_everOpened{false};
+bool g_remoteOpened = false;
 std::array<int, PAD_SPECIAL_HANDLE_COUNT> g_specialUsers{};
 std::atomic_bool g_initialized{false};
 
@@ -126,8 +57,14 @@ int SpecialHandleOf(int userId) {
     return PAD_ERROR_DEVICE_NO_HANDLE;
 }
 
+int PortOf(int handle) {
+    const int port = handle - PAD_HANDLE_BASE;
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS || !g_everOpened[port]) return -1;
+    return port;
+}
+
 bool KnownHandle(int handle) {
-    return handle == PAD_HANDLE || SpecialHandle(handle);
+    return PortOf(handle) >= 0 || SpecialHandle(handle);
 }
 
 PadData SpecialData() {
@@ -138,41 +75,50 @@ PadData SpecialData() {
     return data;
 }
 
+bool SystemRemote(int userId, int type) {
+    return userId == PAD_USER_ID_SYSTEM && type == PAD_PORT_TYPE_REMOTE;
+}
+
+bool RemoteHandle(int handle) {
+    return g_remoteOpened && handle == PAD_REMOTE_HANDLE;
+}
+
+int PortForUser(int userId, int type, int index) {
+    if (index != 0) return -1;
+    if (type == PAD_PORT_TYPE_STANDARD) {
+        const int port = userId - 0x10000000;
+        if (port >= 0 && port < PAD_MAX_CONTROLLERS) return port;
+    }
+    return -1;
+}
+
 bool ValidPort(int userId, int type, int index) {
-    const bool personalPort = type == PAD_PORT_TYPE_STANDARD || type == PAD_PORT_TYPE_SPECIAL;
-    const bool systemRemote = userId == PAD_USER_ID_SYSTEM && type == PAD_PORT_TYPE_REMOTE;
-    return index == 0 && (personalPort || systemRemote);
+    if (index != 0) return false;
+    if (type == PAD_PORT_TYPE_SPECIAL || SystemRemote(userId, type)) return true;
+    return PortForUser(userId, type, index) >= 0;
 }
 
 }
 
-struct PadUpdateData {
-    std::size_t size;
-    std::uint8_t data[32768];
-};
-
 static_assert(sizeof(PadUpdateData) == 32776);
 static_assert(offsetof(PadUpdateData, data) == 8);
 
-struct PadMotionSensorPosition {
-    float x;
-    float y;
-    float z;
-};
-
 static_assert(sizeof(PadMotionSensorPosition) == 12);
 
 extern "C" {
 
 int APS5_VABI scePadClose_nid_postfix(int handle) {
+ if (RemoteHandle(handle)) {
+  g_remoteOpened = false;
+  return PAD_OK;
+ }
  if (SpecialHandle(handle)) {
   g_specialUsers[handle - PAD_SPECIAL_HANDLE] = 0;
   return PAD_OK;
  }
- if (handle != PAD_HANDLE) {
-  return PAD_ERROR_INVALID_HANDLE;
- }
- g_opened = false;
+ const int port = PortOf(handle);
+ if (port < 0) return PAD_ERROR_INVALID_HANDLE;
+ g_opened[port] = false;
  return PAD_OK;
 }
 
@@ -233,22 +179,42 @@ int APS5_VABI scePadGetControllerInformation(int handle, PadControllerInformatio
 int APS5_VABI scePadGetHandle(int user_id, int type, int index) {
  if (!ValidPort(user_id, type, index)) return PAD_ERROR_DEVICE_NO_HANDLE;
  if (type == PAD_PORT_TYPE_SPECIAL) return SpecialHandleOf(user_id);
- if (!g_opened) return PAD_ERROR_DEVICE_NO_HANDLE;
- return PAD_HANDLE;
+ if (SystemRemote(user_id, type)) return g_remoteOpened ? PAD_REMOTE_HANDLE : PAD_ERROR_DEVICE_NO_HANDLE;
+ const int port = PortForUser(user_id, type, index);
+ if (port < 0 || !g_opened[port]) return PAD_ERROR_DEVICE_NO_HANDLE;
+ return PAD_HANDLE_BASE + port;
 }
 
 int APS5_VABI scePadGetInfo_nid_postfix(PadInfo* info) {
  if (info == nullptr) return PAD_ERROR_INVALID_ARG;
  std::memset(info, 0, sizeof(*info));
- info->maxConnectCount = 4;
- info->connectedCount[0] = 1;
+ info->maxConnectCount = PAD_MAX_CONTROLLERS;
+ std::uint8_t count = 0;
+ for (int port = 0; port < PAD_MAX_CONTROLLERS; ++port) {
+  if (Pad::IsConnected(port)) {
+   PadInfo::PadTypeInfo& slot = info->padTypeInfo[count];
+   slot.connectPort = static_cast<std::uint8_t>(port);
+   slot.status = 1;
+   slot.deviceType = PAD_DEVICE_TYPE_DUAL_SENSE;
+   slot.connectType = PAD_CONNECT_TYPE_BLUETOOTH;
+   std::uint8_t mac[6];
+   std::memcpy(mac, PAD_BD_ADDRESS, sizeof(mac));
+   mac[5] = static_cast<std::uint8_t>(mac[5] + port);
+   std::memcpy(slot.bluetoothMacAddress, mac, sizeof(slot.bluetoothMacAddress));
+   ++count;
+  }
+ }
+ if (count == 0) {
+  PadInfo::PadTypeInfo& slot = info->padTypeInfo[0];
+  slot.connectPort = 0;
+  slot.status = 1;
+  slot.deviceType = PAD_DEVICE_TYPE_DUAL_SENSE;
+  slot.connectType = PAD_CONNECT_TYPE_BLUETOOTH;
+  std::memcpy(slot.bluetoothMacAddress, PAD_BD_ADDRESS, sizeof(slot.bluetoothMacAddress));
+  count = 1;
+ }
+ info->connectedCount[0] = count;
  info->connectedCount[1] = 0;
- PadInfo::PadTypeInfo& slot = info->padTypeInfo[0];
- slot.connectPort = 0;
- slot.status = 1;
- slot.deviceType = PAD_DEVICE_TYPE_DUAL_SENSE;
- slot.connectType = PAD_CONNECT_TYPE_BLUETOOTH;
- std::memcpy(slot.bluetoothMacAddress, PAD_BD_ADDRESS, sizeof(slot.bluetoothMacAddress));
  return PAD_OK;
 }
 
@@ -295,9 +261,12 @@ int APS5_VABI scePadInit_nid_postfix(void) {
 
 int APS5_VABI scePadOpen_nid_postfix(int userId, int type, int index, const void* param) {
  (void)param;
- if (!ValidPort(userId, type, index)) {
-  return PAD_ERROR_INVALID_ARG;
- }
+ const bool unknownType = type == 3 || type == 4;
+ const bool knownType = type == PAD_PORT_TYPE_STANDARD || type == PAD_PORT_TYPE_SPECIAL || SystemRemote(userId, type);
+ if (!unknownType && !knownType) return PAD_ERROR_INVALID_ARG;
+ if (userId == PAD_USER_ID_INVALID) return PAD_ERROR_INVALID_USER_ID;
+ if (unknownType) NotImplemented_nid_no_patch(__func__);
+ if (index != 0) return PAD_ERROR_INVALID_PORT_INDEX;
  if (type == PAD_PORT_TYPE_SPECIAL) {
   if (SpecialHandleOf(userId) != PAD_ERROR_DEVICE_NO_HANDLE) return PAD_ERROR_ALREADY_OPENED;
   for (int slot = 0; slot < PAD_SPECIAL_HANDLE_COUNT; ++slot) {
@@ -308,8 +277,17 @@ int APS5_VABI scePadOpen_nid_postfix(int userId, int type, int index, const void
   }
   return PAD_ERROR_UNKNOWN_USER;
  }
- g_opened = true;
- return PAD_HANDLE;
+ if (SystemRemote(userId, type)) {
+  g_remoteOpened = true;
+  return PAD_REMOTE_HANDLE;
+ }
+ const int port = PortForUser(userId, type, index);
+ if (port < 0) {
+  return PAD_ERROR_INVALID_ARG;
+ }
+ g_opened[port] = true;
+ g_everOpened[port] = true;
+ return PAD_HANDLE_BASE + port;
 }
 
 int APS5_VABI scePadOpenExt(int userId, int type, int index, const void* param) {
@@ -329,20 +307,24 @@ int APS5_VABI scePadSetFeatureReport(std::int32_t handle, std::uint8_t reportId,
 int APS5_VABI scePadOutputReport(std::int32_t handle, std::uint8_t reportId, const void* data, std::uint64_t size) { NotImplemented_nid_no_patch(__func__); return 0; }
 
 int APS5_VABI scePadRead_nid_postfix(int handle, PadData* data, int num) {
- if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle) && !RemoteHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (data == nullptr || num <= 0) return PAD_ERROR_INVALID_ARG;
+ if (RemoteHandle(handle)) {
+  data[0] = PadData{};
+  return 1;
+ }
  if (SpecialHandle(handle)) {
   data[0] = SpecialData();
   return 1;
  }
- return Pad::Read(data, num);
+ return Pad::Read(data, num, PortOf(handle));
 }
 
 int APS5_VABI scePadReadState(int handle, PadData* data) {
- if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle) && !RemoteHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (data == nullptr) return PAD_ERROR_INVALID_ARG;
 
- *data = SpecialHandle(handle) ? SpecialData() : Pad::ReadState();
+ *data = RemoteHandle(handle) ? PadData{} : SpecialHandle(handle) ? SpecialData() : Pad::ReadState(PortOf(handle));
 
  return 0;
 }
@@ -350,21 +332,21 @@ int APS5_VABI scePadReadState(int handle, PadData* data) {
 int APS5_VABI scePadResetLightBar(int handle) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::SetLightBar(false, 0, 0, 0);
+ Pad::SetLightBar(PortOf(handle), false, 0, 0, 0);
  return PAD_OK;
 }
 
 int APS5_VABI scePadResetOrientation(int handle) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::ResetOrientation();
+ Pad::ResetOrientation(PortOf(handle));
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetAngularVelocityDeadbandState(int handle, bool enable) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::SetAngularVelocityDeadband(enable);
+ Pad::SetAngularVelocityDeadband(PortOf(handle), enable);
  return PAD_OK;
 }
 
@@ -372,21 +354,21 @@ int APS5_VABI scePadSetLightBar(int handle, const PadLightBarParam* param) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (param == nullptr) return PAD_ERROR_INVALID_ARG;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::SetLightBar(true, param->r, param->g, param->b);
+ Pad::SetLightBar(PortOf(handle), true, param->r, param->g, param->b);
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetMotionSensorState(int handle, bool enable) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::SetMotionEnabled(enable);
+ Pad::SetMotionEnabled(PortOf(handle), enable);
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetTiltCorrectionState(int handle, bool enabled) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::SetTiltCorrection(enabled);
+ Pad::SetTiltCorrection(PortOf(handle), enabled);
  return PAD_OK;
 }
 
@@ -404,8 +386,9 @@ int APS5_VABI scePadSetTriggerEffect(int handle, const void* param) {
  if (mode[0] > 6 || mode[1] > 6) {
   return PAD_ERROR_INVALID_ARG;
  }
+ const int port = PortOf(handle);
  for (int trigger = 0; trigger < 2; ++trigger) {
-  if ((mask & (1u << trigger)) != 0) Pad::SetTriggerCommand(trigger, bytes + 8 + 56 * trigger);
+  if ((mask & (1u << trigger)) != 0) Pad::SetTriggerCommand(port, trigger, bytes + 8 + 56 * trigger);
  }
  return PAD_OK;
 }
@@ -414,7 +397,7 @@ int APS5_VABI scePadSetVibration(int handle, const PadVibrationParam* param) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (param == nullptr) return PAD_ERROR_INVALID_ARG;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::SetVibration(param->large_motor, param->small_motor);
+ Pad::SetVibration(PortOf(handle), param->large_motor, param->small_motor);
  return PAD_OK;
 }
 
@@ -424,7 +407,7 @@ int APS5_VABI scePadSetVibrationMode(int handle, int mode) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (mode > 3 && mode != 5) return PAD_ERROR_INVALID_ARG;
  if (SpecialHandle(handle)) return PAD_OK;
- Pad::SetVibrationMode(mode);
+ Pad::SetVibrationMode(PortOf(handle), mode);
  return PAD_OK;
 }
 
@@ -472,7 +455,6 @@ int APS5_VABI scePadIsRemoteController(int handle, bool* remote) {
  return 0;
 }
 
-
 int APS5_VABI scePadSetAngularVelocityBiasCorrectionState(int handle, bool enabled) {
  if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (enabled) NotImplemented_nid_no_patch(__func__);
@@ -642,8 +624,11 @@ int APS5_VABI scePadGetVersionInfo(std::int32_t handle, PadVersionInfo* info) {
 }
 
 int APS5_VABI scePadGetControllerType(std::int32_t handle, std::int32_t* type) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (!Pad::IsInitialized()) return PAD_ERROR_NOT_INITIALIZED;
+    if (type == nullptr) return PAD_ERROR_INVALID_ARG;
+    if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+    *type = SpecialHandle(handle) ? PAD_CONTROLLER_TYPE_UNKNOWN : PAD_CONTROLLER_TYPE_DUAL_SENSE;
+    return PAD_OK;
 }
 
 int APS5_VABI scePadDisableDataConversion(std::int32_t handle, bool disabled) {
@@ -722,11 +707,13 @@ int APS5_VABI scePadGetLotusIrCodeSetResult(std::int32_t handle, std::int32_t* r
 }
 
 int APS5_VABI scePadSetLotusEnableIrKey(std::int32_t handle) {
+    (void)handle;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI scePadSetLotusDisableIrKey(std::int32_t handle) {
+    (void)handle;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -1077,6 +1064,8 @@ int APS5_VABI scePadVirtualDeviceInsertTriggerInternalState(std::int32_t deviceI
 }
 
 int APS5_VABI scePadVirtualDeviceGetRemoteSetting(std::int32_t deviceId, PadRemoteSetting* setting) {
+    (void)deviceId;
+    (void)setting;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -1087,6 +1076,7 @@ int APS5_VABI scePadVirtualDeviceSetTriggerEffectSetting(std::int32_t handle, co
 }
 
 int APS5_VABI scePadVirtualDeviceDisableButtonRemapping(bool disabled) {
+    (void)disabled;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libScePad/include/Pad.hpp b/core/libs/prx/libScePad/include/Pad.hpp
index 135bd54b59..49154aa264 100644
--- a/core/libs/prx/libScePad/include/Pad.hpp
+++ b/core/libs/prx/libScePad/include/Pad.hpp
@@ -2,6 +2,7 @@
 #define CORE_LIBS_PRX_LIBSCEPAD_PAD_HPP
 
 #include <cstdint>
+#include "SceTypes.hpp"
 
 constexpr int PAD_OK = 0;
 constexpr int PAD_ERROR_INVALID_ARG = -2137915391;
@@ -12,7 +13,10 @@ constexpr int PAD_PORT_TYPE_STANDARD = 0;
 constexpr int PAD_PORT_TYPE_SPECIAL = 2;
 constexpr int PAD_PORT_TYPE_REMOTE = 16;
 constexpr int PAD_USER_ID_SYSTEM = 0xff;
+constexpr int PAD_MAX_CONTROLLERS = 4;
+constexpr int PAD_HANDLE_BASE = 1;
 constexpr int PAD_HANDLE = 1;
+constexpr int PAD_REMOTE_HANDLE = 0x10;
 constexpr int PAD_SPECIAL_HANDLE = 0x20;
 constexpr int PAD_SPECIAL_HANDLE_COUNT = 16;
 
@@ -25,6 +29,9 @@ constexpr int PAD_DEVICE_TYPE_DUAL_SHOCK_4 = 2;
 constexpr int PAD_DEVICE_TYPE_DUAL_SENSE = 3;
 constexpr int PAD_DEVICE_TYPE_DUAL_SENSE_EDGE = 4;
 
+constexpr int PAD_CONTROLLER_TYPE_UNKNOWN = 0;
+constexpr int PAD_CONTROLLER_TYPE_DUAL_SENSE = 2;
+
 constexpr int PAD_CONNECT_TYPE_UNREGISTERED = 0;
 constexpr int PAD_CONNECT_TYPE_USB = 1;
 constexpr int PAD_CONNECT_TYPE_BLUETOOTH = 2;
@@ -46,4 +53,288 @@ struct PadInfo {
 };
 static_assert(sizeof(PadInfo) == 0x59);
 
+struct PadStickTuningParameter;
+struct PadTriggerTuningParameter;
+struct PadHuntProfile;
+struct PadLeonardoProfile;
+struct PadProfileInfo;
+struct PadActiveProfileInfo;
+struct PadSavedSettingInfo;
+struct PadUsbDetectionState;
+struct PadVrUsbConnectionStatus;
+struct PadDeviceInfo;
+struct PadLicenseControllerInformation;
+struct PadRemoteSetting;
+struct PadVirtualTriggerSetting;
+struct PadProcessFocusParameter;
+struct PadDataExtended;
+
+struct PadVrControllerData {
+    std::uint32_t buttons;
+    std::uint8_t stick[2];
+    std::uint8_t unused6[2];
+    std::uint8_t triggers[2];
+    std::uint8_t unused10[2];
+    std::uint32_t touchButtons;
+    std::uint8_t touchValues[4];
+    float acceleration[3];
+    float angularVelocity[3];
+    float orientation[4];
+    std::uint8_t unused60[4];
+    std::uint8_t connected;
+    std::uint8_t connectedCount;
+    std::uint8_t unused66[6];
+    std::uint64_t timestamp;
+    std::uint8_t unused80[24];
+};
+
+struct PadVrControllerDeviceInformation;
+struct PadVrTriggerEffect;
+struct PadVrTriggerEffects;
+struct PadTriggerEffectExtended;
+struct PadExtensionReport;
+struct PadExtensionUnitInfo;
+struct PadTriggerInternalState;
+struct PadTrackerData;
+struct PadBlasterTrackerData;
+struct PadAstonTrackerData;
+struct PadUiData;
+struct PadUiTuningData;
+struct PadLotusButtonData;
+struct PadVersionInfo;
+struct PadTelemetryInfo;
+struct PadPortInfo;
+struct PadVrControllerCombinedState;
+struct PadLeonardoData;
+struct PadLeonardoUniqueData;
+struct PadHistoryData;
+struct PadUpdateParameter;
+struct PadVirtualDeviceParameter;
+struct PadVirtualDeviceId;
+struct PadVirtualDeviceComponentInformation;
+
+struct PadVirtualTriggerInternalState {
+    std::uint32_t states[2];
+    std::uint8_t mode;
+    std::uint8_t flags[2];
+};
+
+struct PadLightBarBlinkingParameter {
+    std::uint8_t values[3];
+};
+
+struct PadButtonRemappingInfo {
+    std::uint8_t mapping[14];
+    std::uint8_t reserved;
+    std::uint8_t mode;
+};
+
+struct PadUpdateData {
+    std::size_t size;
+    std::uint8_t data[32768];
+};
+
+struct PadMotionSensorPosition {
+    float x;
+    float y;
+    float z;
+};
+
+extern "C" {
+
+int APS5_VABI scePadClose_nid_postfix(int handle);
+int APS5_VABI scePadVrControllerSetVibration(std::int32_t handle, std::uint8_t intensity);
+int APS5_VABI scePadVrControllerSetVibrationMode(std::int32_t handle, std::uint32_t mode);
+int APS5_VABI scePadVrControllerReadCombinedState(std::int32_t leftHandle, std::int32_t rightHandle, PadVrControllerCombinedState* state);
+int APS5_VABI scePadDeviceClassGetExtendedInformation(int handle, PadDeviceClassExtendedInformation* info);
+int APS5_VABI scePadDeviceClassParseData(int handle, const PadData* data, PadDeviceClassData* classData);
+int APS5_VABI scePadGetControllerInformation(int handle, PadControllerInformation* info);
+int APS5_VABI scePadGetHandle(int userId, int type, int index);
+int APS5_VABI scePadGetInfo_nid_postfix(PadInfo* info);
+int APS5_VABI scePadGetTriggerEffectState(int handle, PadTriggerEffectStateInformation* info);
+int APS5_VABI scePadGetExtControllerInformation(int handle, void* info);
+int APS5_VABI scePadSetProcessPrivilege(int privilege);
+int APS5_VABI scePadSetParticularMode(bool mode);
+int APS5_VABI scePadInit_nid_postfix(void);
+int APS5_VABI scePadOpen_nid_postfix(int userId, int type, int index, const void* param);
+int APS5_VABI scePadOpenExt(int userId, int type, int index, const void* param);
+int APS5_VABI scePadReadExt(std::int32_t handle, PadDataExtended* data, std::int32_t count);
+int APS5_VABI scePadGetFeatureReport(std::int32_t handle, std::uint8_t reportId, void* data, std::size_t size);
+int APS5_VABI scePadSetFeatureReport(std::int32_t handle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI scePadOutputReport(std::int32_t handle, std::uint8_t reportId, const void* data, std::uint64_t size);
+int APS5_VABI scePadRead_nid_postfix(int handle, PadData* data, int num);
+int APS5_VABI scePadReadState(int handle, PadData* data);
+int APS5_VABI scePadResetLightBar(int handle);
+int APS5_VABI scePadResetOrientation(int handle);
+int APS5_VABI scePadSetAngularVelocityDeadbandState(int handle, bool enable);
+int APS5_VABI scePadSetLightBar(int handle, const PadLightBarParam* param);
+int APS5_VABI scePadSetMotionSensorState(int handle, bool enable);
+int APS5_VABI scePadSetTiltCorrectionState(int handle, bool enabled);
+int APS5_VABI scePadSetTriggerEffect(int handle, const void* param);
+int APS5_VABI scePadSetVibration(int handle, const PadVibrationParam* param);
+int APS5_VABI scePadSetVibrationMode(int handle, int mode);
+int APS5_VABI scePadSetVibrationTriggerEffectWeakWhileEmbeddedMicInUse(bool enabled);
+int APS5_VABI scePadVrControllerGetDeviceInformation(std::int32_t handle, PadVrControllerDeviceInformation* info);
+int APS5_VABI scePadVrControllerRead(std::int32_t handle, PadVrControllerData* data, std::int32_t count);
+int APS5_VABI scePadVrControllerGetTriggerEffectState(std::int32_t leftHandle, std::int32_t rightHandle, PadTriggerEffectStateInformation* states);
+int APS5_VABI scePadVrControllerReadState(int handle, PadVrControllerData* state);
+int APS5_VABI scePadVrControllerSetTriggerEffect(std::int32_t handle, const PadVrTriggerEffect* effect);
+int APS5_VABI scePadVrControllerSetTriggerEffects(std::int32_t leftHandle, std::int32_t rightHandle, const PadVrTriggerEffects* effects);
+int APS5_VABI scePadIsRemoteController(int handle, bool* remote);
+int APS5_VABI scePadSetAngularVelocityBiasCorrectionState(int handle, bool enabled);
+int APS5_VABI scePadUnknown_n3kSX62fgNo();
+int APS5_VABI scePadVrControllerGetTriggerEffectStates(std::int32_t leftHandle, std::int32_t rightHandle, PadTriggerEffectStateInformation* states);
+int APS5_VABI scePadGetAccessibilityControllerState(int handle, std::uint32_t* state);
+int APS5_VABI scePadSetTriggerEffectExt(std::int32_t handle, const PadTriggerEffectExtended* effect);
+int APS5_VABI scePadLastLotusButtonData(std::int32_t handle, std::uint32_t parameter, PadLotusButtonData* data);
+int APS5_VABI scePadReadStateExt(std::int32_t handle, PadDataExtended* data);
+int APS5_VABI scePadSetExtensionReport(std::int32_t handle, const PadExtensionReport* report);
+int APS5_VABI scePadGetExtensionUnitInfo(std::int32_t handle, PadExtensionUnitInfo* info);
+int APS5_VABI scePadEnableExtensionPort(bool enabled);
+int APS5_VABI scePadEnableSpecificDeviceClass(std::int32_t deviceClass);
+int APS5_VABI scePadOpenExt2(std::uint64_t deviceId, std::int32_t type, const void* reserved);
+int APS5_VABI scePadDeviceOpen(std::uint64_t deviceId, std::int32_t type, std::int32_t index);
+int APS5_VABI scePadGetDataInternal(std::uint8_t port, PadData* data);
+int APS5_VABI scePadSetUserColor(std::int32_t handle, std::uint32_t color);
+int APS5_VABI scePadDisableVibration(std::int32_t handle, bool disabled);
+int APS5_VABI scePadSetVibrationStrength(std::int32_t handle, std::uint32_t strength);
+int APS5_VABI scePadSetLightBarBaseBrightness(std::int32_t handle, std::uint32_t brightness);
+int APS5_VABI scePadSetLightBarBlinking(std::int32_t handle, const PadLightBarBlinkingParameter* parameter);
+std::uint64_t APS5_VABI scePadGetIdleCount(std::int32_t userId);
+int APS5_VABI scePadGetControllerIdleCount(std::int32_t handle, std::uint64_t* count);
+int APS5_VABI scePadSetPowerSavingState(std::int32_t handle, std::uint8_t state);
+int APS5_VABI scePadSetAutoPowerOffCount(std::int32_t count);
+int APS5_VABI scePadEnableUsbConnection(bool enabled);
+int APS5_VABI scePadEnableAutoDetect(bool enabled);
+int APS5_VABI scePadEnablePlayPauseEmulation(bool enabled);
+int APS5_VABI scePadDisableTrackingLedBatterySaver(bool disabled);
+int APS5_VABI scePadSetLoginUserNumber(std::int32_t number);
+int APS5_VABI scePadGetCapability(std::int32_t deviceId, std::uint32_t* capability);
+int APS5_VABI scePadShareOutputData(std::int32_t source, std::int32_t destination);
+int APS5_VABI scePadShareOutputDataWithFunctionType(std::int32_t source, std::int32_t destination, std::uint32_t functionType);
+int APS5_VABI scePadSetVibrationForce(std::int32_t handle, const PadVibrationParam* param);
+int APS5_VABI scePadGetVersionInfo(std::int32_t handle, PadVersionInfo* info);
+int APS5_VABI scePadGetControllerType(std::int32_t handle, std::int32_t* type);
+int APS5_VABI scePadDisableDataConversion(std::int32_t handle, bool disabled);
+int APS5_VABI scePadSetButtonRemappingInfo(std::int32_t handle, const PadButtonRemappingInfo* info);
+int APS5_VABI scePadSetProcessPrivilegeOfButtonRemapping(bool enabled);
+int APS5_VABI scePadSetForceIntercepted(bool enabled);
+int APS5_VABI scePadIsLightBarBaseBrightnessControllable(std::int32_t handle);
+int APS5_VABI scePadSwitchConnection(std::int32_t handle, std::uint32_t flags);
+int APS5_VABI scePadDisableTriggerEffect(std::int32_t handle, bool disabled);
+int APS5_VABI scePadSetTriggerEffectStrength(std::int32_t handle, std::uint32_t strength);
+int APS5_VABI scePadGetTriggerEffectInternalState(std::int32_t handle, PadTriggerInternalState* state);
+int APS5_VABI scePadSetUserNumber(std::int32_t handle, std::int32_t number);
+int APS5_VABI scePadDisableTransportButtons(bool disabled);
+int APS5_VABI scePadSetLotusIrCodeSetStart(std::int32_t handle, std::uint8_t codeSet, std::uint16_t code, std::size_t dataSize);
+int APS5_VABI scePadSetLotusIrCodeSetData(std::int32_t handle, std::uint8_t packetIndex, const void* data, std::size_t dataSize);
+int APS5_VABI scePadSetLotusIrCodeSetEnd(std::int32_t handle);
+int APS5_VABI scePadGetLotusIrCodeSetResult(std::int32_t handle, std::int32_t* result, std::uint8_t* deviceResult);
+int APS5_VABI scePadSetLotusEnableIrKey(std::int32_t handle);
+int APS5_VABI scePadSetLotusDisableIrKey(std::int32_t handle);
+int APS5_VABI scePadGetUsbDetectionState(std::int32_t deviceId, PadUsbDetectionState* state);
+int APS5_VABI scePadUiReadState(std::int32_t handle, PadUiData* data);
+int APS5_VABI scePadUiReadStateForTuning(std::int32_t handle, PadUiTuningData* data);
+int APS5_VABI scePadSetStickTriggerTuningMode(std::int32_t handle, std::uint32_t mode);
+int APS5_VABI scePadSetStickTuningParam(std::int32_t handle, std::uint32_t stick, const PadStickTuningParameter* parameter);
+int APS5_VABI scePadSetTriggerTuningParam(std::int32_t handle, const PadTriggerTuningParameter* parameter);
+int APS5_VABI scePadGetProfileHunt(std::int32_t handle, std::int32_t profileId, PadHuntProfile* profile);
+int APS5_VABI scePadSetProfileHunt(std::int32_t handle, std::int32_t profileId, PadHuntProfile* profile, std::uint32_t* result);
+int APS5_VABI scePadResetHunt(std::int32_t handle);
+int APS5_VABI scePadGetProfileInfo(std::int32_t deviceId, std::int32_t profileId, PadProfileInfo* info);
+int APS5_VABI scePadGetActiveProfileInfo(std::int32_t handle, PadActiveProfileInfo* info);
+int APS5_VABI scePadDisableActiveProfileChange(std::int32_t handle, bool disabled);
+int APS5_VABI scePadDisableActiveProfileChangeByDeviceId(std::int32_t deviceId, bool disabled);
+int APS5_VABI scePadSetActiveProfileSlot(std::int32_t deviceId, std::uint32_t slot);
+int APS5_VABI scePadGetSavedSettingInfo(std::int32_t handle, PadSavedSettingInfo* info);
+int APS5_VABI scePadSetSavedSettingInfo(std::int32_t handle, const PadSavedSettingInfo* info);
+int APS5_VABI scePadVrControllerGetPhysicalUsbConnectionStatus(PadVrUsbConnectionStatus* status);
+int APS5_VABI scePadParseUniqueDataLeonardo(std::int32_t handle, const PadLeonardoData* data, PadLeonardoUniqueData* uniqueData);
+int APS5_VABI scePadGetControllerTypeLeonardo(std::int32_t deviceId, std::int32_t* controllerType);
+int APS5_VABI scePadSetControllerTypeLeonardo(std::int32_t deviceId, std::int32_t controllerType);
+int APS5_VABI scePadGetProfileLeonardo(std::int32_t handle, std::int32_t profileId, PadLeonardoProfile* profile);
+int APS5_VABI scePadSetProfileLeonardo(std::int32_t handle, std::int32_t profileId, PadLeonardoProfile* profile, std::uint32_t* result);
+int APS5_VABI scePadResetLeonardo(std::int32_t handle);
+int APS5_VABI scePadSetProfileEditMode(std::int32_t handle, bool enabled, std::uint32_t profile);
+int APS5_VABI scePadGetProfileEditMode(std::int32_t handle, std::int32_t* mode);
+int APS5_VABI scePadGetProfileEditModeLeonardo(std::int32_t handle);
+int APS5_VABI scePadSetSelectButtonCustomizeMode(std::int32_t handle, bool enabled);
+int APS5_VABI scePadGetSelectButtonCustomizeMode(std::int32_t handle);
+int APS5_VABI scePadSetToggleAllReleaseLeonardo(std::int32_t handle);
+int APS5_VABI scePadEnableControllerIndicator(std::int32_t handle);
+int APS5_VABI scePadEnableProfileIndicator(std::int32_t handle);
+int APS5_VABI scePadSetProfileIndicatorAnimation(std::int32_t handle, std::uint8_t animation);
+int APS5_VABI scePadIsCoPilot(std::int32_t handle);
+int APS5_VABI scePadSetIsCoPilot(std::int32_t handle, bool enabled);
+int APS5_VABI scePadRegisterCollaboInputMgrProcess(void);
+int APS5_VABI scePadGetTelemetryInfo(std::int32_t handle, PadTelemetryInfo* info);
+int APS5_VABI scePadGetActiveTime(std::int32_t handle, std::int32_t type, std::uint64_t* activeTime);
+int APS5_VABI scePadGetDeviceId(std::int32_t handle, std::int32_t* deviceId);
+int APS5_VABI scePadGetInfoByPortType(std::int32_t type, PadPortInfo* info);
+int APS5_VABI scePadResetLightBarAll(void);
+int APS5_VABI scePadResetLightBarAllByPortType(std::uint32_t portType);
+int APS5_VABI scePadSetLightBarForTracker(std::int32_t handle, const PadLightBarParam* color);
+int APS5_VABI scePadReadForTracker(std::int32_t handle, PadTrackerData* data, std::int32_t count);
+int APS5_VABI scePadReadBlasterForTracker(std::int32_t handle, PadBlasterTrackerData* data, std::int32_t count);
+int APS5_VABI scePadResetOrientationForTracker(std::int32_t handle);
+int APS5_VABI scePadGetMotionTimerUnit(std::int32_t handle, float* unit);
+int APS5_VABI scePadSetVrTrackingMode(std::uint8_t mode);
+int APS5_VABI scePadGetMotionSensorPosition(std::int32_t handle, PadMotionSensorPosition* position);
+int APS5_VABI scePadGetSphereRadius(std::int32_t handle, float* radius);
+bool APS5_VABI scePadIsValidHandle(std::int32_t handle, std::int32_t portType);
+bool APS5_VABI scePadIsDS4Connected(std::int32_t handle);
+bool APS5_VABI scePadIsBlasterConnected(std::int32_t handle);
+bool APS5_VABI scePadIsMoveConnected(std::int32_t handle);
+int APS5_VABI scePadGetBluetoothAddress(std::int32_t handle, std::uint64_t* address);
+int APS5_VABI scePadIsMoveReproductionModel(std::int32_t handle);
+int APS5_VABI scePadReadAstonForTracker(std::int32_t handle, PadAstonTrackerData* data, std::int32_t count);
+int APS5_VABI scePadGetAstonModel(std::int32_t handle);
+int APS5_VABI scePadMbusInit(void);
+int APS5_VABI scePadMbusTerm(void);
+int APS5_VABI scePadConnectPort(std::int32_t userId, std::int32_t portType);
+int APS5_VABI scePadDisconnectPort(std::int32_t userId, std::int32_t portType);
+int APS5_VABI scePadDisconnectDevice(std::int32_t deviceId);
+int APS5_VABI scePadGetDeviceInfo(std::int32_t deviceId, PadDeviceInfo* info);
+int APS5_VABI scePadSetProcessFocus(const PadProcessFocusParameter* parameter);
+int APS5_VABI scePadVertualDeviceAddDevice(const PadVirtualDeviceParameter* parameter, PadVirtualDeviceId* deviceId);
+int APS5_VABI scePadVirtualDeviceAddDevice(const PadVirtualDeviceParameter* parameter, PadVirtualDeviceId* deviceId);
+int APS5_VABI scePadVirtualDeviceDeleteDevice(std::int32_t deviceId);
+int APS5_VABI scePadVirtualDeviceInsertData(std::int32_t deviceId, const PadData* data);
+int APS5_VABI scePadVirtualDeviceInsertTriggerInternalState(std::int32_t deviceId, const PadVirtualTriggerInternalState* state);
+int APS5_VABI scePadVirtualDeviceGetRemoteSetting(std::int32_t deviceId, PadRemoteSetting* setting);
+int APS5_VABI scePadVirtualDeviceSetTriggerEffectSetting(std::int32_t handle, const PadVirtualTriggerSetting* setting);
+int APS5_VABI scePadVirtualDeviceDisableButtonRemapping(bool disabled);
+int APS5_VABI scePadSetShareButtonMaskForRemotePlay(std::uint8_t mask);
+int APS5_VABI scePadSetPS4BcVibrationMode(std::uint8_t mode);
+int APS5_VABI scePadSetVirtualDeviceComponentInformation(std::int32_t deviceId, const PadVirtualDeviceComponentInformation* info);
+int APS5_VABI scePadEnablePs4CompatibleMode(std::int32_t handle, bool enabled);
+int APS5_VABI scePadGetLicenseControllerInformation(std::int32_t handle, PadLicenseControllerInformation* info);
+int APS5_VABI scePadReadHistory(std::int32_t handle, PadHistoryData* data, std::int32_t count);
+int APS5_VABI scePadStartRecording(void);
+int APS5_VABI scePadStopRecording(void);
+int APS5_VABI scePadRemoteControlInsertData(const std::uint8_t* data);
+int APS5_VABI scePadRemoteControlInsertDataForAston(const std::uint8_t* data);
+int APS5_VABI scePadGetFeatureReport2(std::int32_t handle, std::uint8_t reportId, void* data, std::size_t size);
+int APS5_VABI scePadSetFeatureReport2(std::int32_t handle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI scePadSetMuteLed(std::int32_t handle, std::uint32_t mode);
+int APS5_VABI scePadBondUpdateInit(void);
+int APS5_VABI scePadBondUpdateIsReady(std::int32_t deviceId, std::int32_t* ready);
+int APS5_VABI scePadBondUpdateStart(std::int32_t handle, const PadUpdateParameter* parameter);
+int APS5_VABI scePadBondUpdateGetStatus(std::int32_t deviceId, std::int32_t* status);
+int APS5_VABI scePadBondUpdateSendData(std::int32_t deviceId, const PadUpdateData* data);
+int APS5_VABI scePadBondUpdateResetBond(std::int32_t deviceId);
+int APS5_VABI scePadBondUpdateGetReconnectStatus(std::int32_t* status);
+int APS5_VABI scePadBondUpdateTerm(void);
+int APS5_VABI scePadControllerUpdateInit(void);
+int APS5_VABI scePadControllerUpdateIsUpdateNeeded2(std::int32_t deviceId, const std::uint32_t* version, std::uint16_t* status);
+int APS5_VABI scePadControllerUpdateIsReady(std::int32_t deviceId, std::int32_t* ready);
+int APS5_VABI scePadControllerUpdateStart(std::int32_t handle, const PadUpdateParameter* parameter);
+int APS5_VABI scePadControllerUpdateGetStatus(std::int32_t deviceId, std::int32_t* status);
+int APS5_VABI scePadControllerUpdateSendData(std::int32_t deviceId, const PadUpdateData* data);
+int APS5_VABI scePadControllerUpdateResetController(std::int32_t deviceId);
+int APS5_VABI scePadControllerUpdateGetReconnectStatus(std::int32_t* status);
+int APS5_VABI scePadControllerUpdateTerm(void);
+
+}
+
 #endif
diff --git a/core/libs/prx/libScePad/include/PadState.hpp b/core/libs/prx/libScePad/include/PadState.hpp
index fb621171ee..aee2c05569 100644
--- a/core/libs/prx/libScePad/include/PadState.hpp
+++ b/core/libs/prx/libScePad/include/PadState.hpp
@@ -56,23 +56,36 @@ struct PadOutputState {
 namespace Pad {
 void Initialize();
 bool IsInitialized();
-PadData ReadState();
-int Read(PadData* data, int num);
+PadData ReadState(int port = 0);
+int Read(PadData* data, int num, int port = 0);
+void SetVibration(int port, std::uint8_t large, std::uint8_t small);
 void SetVibration(std::uint8_t large, std::uint8_t small);
+void SetVibrationMode(int port, int mode);
 void SetVibrationMode(int mode);
+void SetLightBar(int port, bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b);
 void SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b);
+void SetTriggerCommand(int port, int trigger, const std::uint8_t* command);
 void SetTriggerCommand(int trigger, const std::uint8_t* command);
-void ResetOrientation();
+void ResetOrientation(int port = 0);
+void SetMotionEnabled(int port, bool enabled);
 void SetMotionEnabled(bool enabled);
+void SetTiltCorrection(int port, bool enabled);
 void SetTiltCorrection(bool enabled);
+void SetAngularVelocityDeadband(int port, bool enabled);
 void SetAngularVelocityDeadband(bool enabled);
+void SetConnected(int port, bool connected);
+bool IsConnected(int port);
 }
 
 extern "C" void PadPublishInput_nid_postfix(const PadInputState& input);
+extern "C" void PadPublishInputForPort_nid_postfix(int port, const PadInputState& input);
 extern "C" void PadReportInputFailure_nid_postfix(std::exception_ptr error);
 extern "C" bool PadFetchOutput_nid_postfix(std::uint32_t* seenSequence, PadOutputState* out);
+extern "C" bool PadFetchOutputForPort_nid_postfix(int port, std::uint32_t* seenSequence, PadOutputState* out);
 extern "C" void PadSubmitAudioHaptics_nid_postfix(std::uint8_t large, std::uint8_t small);
 extern "C" void PadQueueLegacyAudioHaptics_nid_postfix(int source, std::uint64_t begin, std::uint64_t end, std::uint8_t large, std::uint8_t small);
 extern "C" void PadClearLegacyAudioHaptics_nid_postfix(int source);
+extern "C" void PadSubmitAudioHapticsForPort_nid_postfix(int port, std::uint8_t large, std::uint8_t small);
+extern "C" void PadSetPortConnected_nid_postfix(int port, bool connected);
 
 #endif
diff --git a/core/libs/prx/libScePad/libScePad.hpp b/core/libs/prx/libScePad/libScePad.hpp
new file mode 100644
index 0000000000..12aecdf76c
--- /dev/null
+++ b/core/libs/prx/libScePad/libScePad.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePad/include/Pad.hpp"
diff --git a/core/libs/prx/libScePad/src/PadState.cpp b/core/libs/prx/libScePad/src/PadState.cpp
index 5a6795f32e..c7eec141e9 100644
--- a/core/libs/prx/libScePad/src/PadState.cpp
+++ b/core/libs/prx/libScePad/src/PadState.cpp
@@ -13,47 +13,60 @@
 #include <stdexcept>
 
 namespace {
-    std::mutex stateMutex;
-    PadInputState state;
-    std::uint32_t pressedSinceRead = 0;
-    std::uint8_t pressedAnalogL2 = 0;
-    std::uint8_t pressedAnalogR2 = 0;
-    std::uint64_t pressedAt = 0;
+    struct Quat { float w = 1.0f, x = 0.0f, y = 0.0f, z = 0.0f; };
     constexpr std::uint64_t kLatchExpiry = 100000;
-    PadOutputState output;
-    std::chrono::steady_clock::time_point audioHapticEnd;
-    std::array<std::uint8_t, 2> audioHapticRumble{};
-    PadAudioHapticQueue legacyHaptics;
-    std::uint64_t timestamp = 0;
+    constexpr std::uint64_t kLatchExpiryLimit = 500000;
+    std::uint64_t injectedTimestamp = 0;
 
     struct QueuedInput {
         PadInputState input;
         std::uint64_t timestamp = 0;
     };
     constexpr std::size_t kQueueCapacity = 64;
-    std::deque<QueuedInput> queue;
+
+    struct PadSlot {
+        PadInputState state;
+        PadOutputState output;
+        std::deque<QueuedInput> queue;
+        Quat orientation;
+        std::uint64_t lastFuseTime = 0;
+        float biasIntegral[3] = {0.0f, 0.0f, 0.0f};
+        bool tiltCorrection = true;
+        bool angularVelocityDeadband = false;
+        std::uint8_t nextTouchId = 0;
+        bool prevTouchActive[2] = {false, false};
+        std::uint8_t touchIds[2] = {0, 0};
+        std::chrono::steady_clock::time_point audioHapticEnd{};
+        std::array<std::uint8_t, 2> audioHapticRumble{};
+        PadAudioHapticQueue legacyHaptics;
+        std::uint64_t timestamp = 0;
+        std::uint32_t pressedSinceRead = 0;
+        std::uint8_t pressedAnalogL2 = 0;
+        std::uint8_t pressedAnalogR2 = 0;
+        std::uint64_t pressedAt = 0;
+        std::uint64_t lastReadAt = 0;
+        std::uint64_t readInterval = 0;
+        bool connected = false;
+    };
+
+    std::mutex stateMutex;
+    std::array<PadSlot, PAD_MAX_CONTROLLERS> slots = [] {
+        std::array<PadSlot, PAD_MAX_CONTROLLERS> initialSlots{};
+        initialSlots[0].connected = true;
+        return initialSlots;
+    }();
     std::exception_ptr failure;
     bool initialized = false;
-
-    struct Quat { float w = 1.0f, x = 0.0f, y = 0.0f, z = 0.0f; };
-    Quat orientation;
-    std::uint64_t lastFuseTime = 0;
-    float biasIntegral[3] = {0.0f, 0.0f, 0.0f};
-    bool tiltCorrection = true;
-    bool angularVelocityDeadband = false;
     constexpr float kAngularVelocityDeadband = 0.017453292f;
-    std::uint8_t nextTouchId = 0;
-    bool prevTouchActive[2] = {false, false};
-    std::uint8_t touchIds[2] = {0, 0};
 
-    bool RefreshAudioHaptics() {
-        if (std::chrono::steady_clock::now() >= audioHapticEnd) audioHapticRumble = {};
-        const auto legacy = legacyHaptics.Read(sceKernelGetProcessTime());
-        const auto large = std::max(audioHapticRumble[0], legacy[0]);
-        const auto small = std::max(audioHapticRumble[1], legacy[1]);
-        if (output.audioVibrationLarge == large && output.audioVibrationSmall == small) return false;
-        output.audioVibrationLarge = large;
-        output.audioVibrationSmall = small;
+    bool RefreshAudioHaptics(PadSlot& slot) {
+        if (std::chrono::steady_clock::now() >= slot.audioHapticEnd) slot.audioHapticRumble = {};
+        const auto legacy = slot.legacyHaptics.Read(sceKernelGetProcessTime());
+        const auto large = std::max(slot.audioHapticRumble[0], legacy[0]);
+        const auto small = std::max(slot.audioHapticRumble[1], legacy[1]);
+        if (slot.output.audioVibrationLarge == large && slot.output.audioVibrationSmall == small) return false;
+        slot.output.audioVibrationLarge = large;
+        slot.output.audioVibrationSmall = small;
         return true;
     }
 
@@ -63,33 +76,33 @@ namespace {
         q.w /= n; q.x /= n; q.y /= n; q.z /= n;
     }
 
-    void fuse(float dt, const std::array<float, 3>& accel, const std::array<float, 3>& gyro) {
+    void fuse(PadSlot& slot, float dt, const std::array<float, 3>& accel, const std::array<float, 3>& gyro) {
         float gx = gyro[0], gy = gyro[1], gz = gyro[2];
         const float an = std::sqrt(accel[0] * accel[0] + accel[1] * accel[1] + accel[2] * accel[2]);
-        if (tiltCorrection && an > 1.0f) {
+        if (slot.tiltCorrection && an > 1.0f) {
             const float ax = accel[0] / an, ay = accel[1] / an, az = accel[2] / an;
-            const float vx = 2.0f * (orientation.x * orientation.y + orientation.w * orientation.z);
-            const float vy = orientation.w * orientation.w - orientation.x * orientation.x + orientation.y * orientation.y - orientation.z * orientation.z;
-            const float vz = 2.0f * (orientation.y * orientation.z - orientation.w * orientation.x);
+            const float vx = 2.0f * (slot.orientation.x * slot.orientation.y + slot.orientation.w * slot.orientation.z);
+            const float vy = slot.orientation.w * slot.orientation.w - slot.orientation.x * slot.orientation.x + slot.orientation.y * slot.orientation.y - slot.orientation.z * slot.orientation.z;
+            const float vz = 2.0f * (slot.orientation.y * slot.orientation.z - slot.orientation.w * slot.orientation.x);
             const float ex = ay * vz - az * vy;
             const float ey = az * vx - ax * vz;
             const float ez = ax * vy - ay * vx;
             constexpr float kp = 1.5f;
             constexpr float ki = 0.02f;
-            biasIntegral[0] += ki * ex * dt;
-            biasIntegral[1] += ki * ey * dt;
-            biasIntegral[2] += ki * ez * dt;
-            gx += kp * ex + biasIntegral[0];
-            gy += kp * ey + biasIntegral[1];
-            gz += kp * ez + biasIntegral[2];
+            slot.biasIntegral[0] += ki * ex * dt;
+            slot.biasIntegral[1] += ki * ey * dt;
+            slot.biasIntegral[2] += ki * ez * dt;
+            gx += kp * ex + slot.biasIntegral[0];
+            gy += kp * ey + slot.biasIntegral[1];
+            gz += kp * ez + slot.biasIntegral[2];
         }
         const float hx = 0.5f * gx * dt, hy = 0.5f * gy * dt, hz = 0.5f * gz * dt;
-        const Quat q = orientation;
-        orientation.w = q.w - q.x * hx - q.y * hy - q.z * hz;
-        orientation.x = q.x + q.w * hx + q.y * hz - q.z * hy;
-        orientation.y = q.y + q.w * hy - q.x * hz + q.z * hx;
-        orientation.z = q.z + q.w * hz + q.x * hy - q.y * hx;
-        normalize(orientation);
+        const Quat q = slot.orientation;
+        slot.orientation.w = q.w - q.x * hx - q.y * hy - q.z * hz;
+        slot.orientation.x = q.x + q.w * hx + q.y * hz - q.z * hy;
+        slot.orientation.y = q.y + q.w * hy - q.x * hz + q.z * hx;
+        slot.orientation.z = q.z + q.w * hz + q.x * hy - q.y * hx;
+        normalize(slot.orientation);
     }
 
     void encodeZones(std::uint8_t* dst, std::uint8_t mode, const std::uint8_t* strengths, int count, std::uint8_t frequency) {
@@ -124,10 +137,15 @@ void Pad::Initialize() {
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
     if (!initialized) {
-        timestamp = sceKernelGetProcessTime();
-        lastFuseTime = timestamp;
-        queue.clear();
-        pressedSinceRead = 0;
+        const std::uint64_t now = sceKernelGetProcessTime();
+        for (std::size_t i = 0; i < slots.size(); ++i) {
+            slots[i].timestamp = now;
+            slots[i].lastFuseTime = now;
+            slots[i].queue.clear();
+            slots[i].pressedSinceRead = 0;
+            slots[i].lastReadAt = 0;
+            slots[i].readInterval = 0;
+        }
     }
     initialized = true;
 }
@@ -138,7 +156,7 @@ bool Pad::IsInitialized() {
 }
 
 namespace {
-PadData BuildData(const PadInputState& state, std::uint64_t changeTime, std::uint64_t now, const Pad::InputCommandFile::Input& injected) {
+PadData BuildData(PadSlot& slot, const PadInputState& state, std::uint64_t changeTime, std::uint64_t now, const Pad::InputCommandFile::Input& injected, int port) {
     PadData data{};
     data.buttons = state.buttons | injected.buttons;
     const auto& sticks = injected.hasSticks ? injected.sticks : state.sticks;
@@ -152,28 +170,28 @@ PadData BuildData(const PadInputState& state, std::uint64_t changeTime, std::uin
     data.analog_buttons_l2 = trigger(state.analogButtonsL2, 0x100);
     data.analog_buttons_r2 = trigger(state.analogButtonsR2, 0x200);
 
-    const bool live = state.hasMotion && output.motionEnabled;
+    const bool live = state.hasMotion && slot.output.motionEnabled;
     const std::array<float, 3> rest{0.0f, 9.80665f, 0.0f};
     const std::array<float, 3>& accel = live ? state.accel : rest;
     std::array<float, 3> gyro = live ? state.gyro : std::array<float, 3>{0.0f, 0.0f, 0.0f};
-    if (angularVelocityDeadband) {
+    if (slot.angularVelocityDeadband) {
         for (float& axis : gyro) {
             if (axis < kAngularVelocityDeadband && axis > -kAngularVelocityDeadband) axis = 0.0f;
         }
     }
     if (live) {
-        float dt = lastFuseTime != 0 && now > lastFuseTime ? static_cast<float>(now - lastFuseTime) * 1e-6f : 0.0f;
+        float dt = slot.lastFuseTime != 0 && now > slot.lastFuseTime ? static_cast<float>(now - slot.lastFuseTime) * 1e-6f : 0.0f;
         dt = std::min(dt, 0.1f);
-        fuse(dt, accel, gyro);
+        fuse(slot, dt, accel, gyro);
     } else {
-        orientation = Quat{};
-        biasIntegral[0] = biasIntegral[1] = biasIntegral[2] = 0.0f;
+        slot.orientation = Quat{};
+        slot.biasIntegral[0] = slot.biasIntegral[1] = slot.biasIntegral[2] = 0.0f;
     }
-    lastFuseTime = now;
-    data.orientation_x = orientation.x;
-    data.orientation_y = orientation.y;
-    data.orientation_z = orientation.z;
-    data.orientation_w = orientation.w;
+    slot.lastFuseTime = now;
+    data.orientation_x = slot.orientation.x;
+    data.orientation_y = slot.orientation.y;
+    data.orientation_z = slot.orientation.z;
+    data.orientation_w = slot.orientation.w;
     constexpr float kGravity = 9.80665f;
     data.acceleration_x = accel[0] / kGravity;
     data.acceleration_y = accel[1] / kGravity;
@@ -182,20 +200,24 @@ PadData BuildData(const PadInputState& state, std::uint64_t changeTime, std::uin
     data.angular_velocity_y = gyro[1];
     data.angular_velocity_z = gyro[2];
 
-    data.connected = true;
-    data.connected_count = 1;
+    std::uint8_t connectedCount = 0;
+    for (const auto& s : slots) {
+        if (s.connected) ++connectedCount;
+    }
+    data.connected = slot.connected;
+    data.connected_count = connectedCount > 0 ? connectedCount : 1;
     data.timestamp = changeTime;
 
     std::uint8_t touchNum = 0;
     for (int i = 0; i < 2; ++i) {
         const PadTouchPoint& tp = state.touch[i];
-        if (!tp.active) { prevTouchActive[i] = false; continue; }
-        if (!prevTouchActive[i]) touchIds[i] = static_cast<std::uint8_t>(nextTouchId++ & 0x7F);
-        prevTouchActive[i] = true;
+        if (!tp.active) { slot.prevTouchActive[i] = false; continue; }
+        if (!slot.prevTouchActive[i]) slot.touchIds[i] = static_cast<std::uint8_t>(slot.nextTouchId++ & 0x7F);
+        slot.prevTouchActive[i] = true;
         if (touchNum == 0) {
-            data.touch_data_touch0_x = tp.x; data.touch_data_touch0_y = tp.y; data.touch_data_touch0_id = touchIds[i];
+            data.touch_data_touch0_x = tp.x; data.touch_data_touch0_y = tp.y; data.touch_data_touch0_id = slot.touchIds[i];
         } else {
-            data.touch_data_touch1_x = tp.x; data.touch_data_touch1_y = tp.y; data.touch_data_touch1_id = touchIds[i];
+            data.touch_data_touch1_x = tp.x; data.touch_data_touch1_y = tp.y; data.touch_data_touch1_id = slot.touchIds[i];
         }
         ++touchNum;
     }
@@ -223,66 +245,91 @@ Pad::InputCommandFile::Input InjectedInput(std::uint64_t now) {
     const auto injected = commands.Poll(now);
     if (injected != lastInjected) {
         lastInjected = injected;
-        timestamp = now;
+        slots[0].timestamp = now;
+        injectedTimestamp = now;
     }
     return injected;
 }
+
+std::uint64_t LatchExpiry(const PadSlot& slot) {
+    return std::clamp(slot.readInterval + slot.readInterval / 2, kLatchExpiry, kLatchExpiryLimit);
+}
 }
 
-PadData Pad::ReadState() {
+PadData Pad::ReadState(int port) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) throw std::invalid_argument("Pad: invalid port");
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
     if (!initialized) throw std::runtime_error("Pad: read before initialization");
     const std::uint64_t now = sceKernelGetProcessTime();
-    const auto injected = InjectedInput(now);
-    PadData data = BuildData(state, timestamp, now, injected);
-    if (pressedSinceRead != 0 && now - pressedAt <= kLatchExpiry) {
-        data.buttons |= pressedSinceRead;
-        if (pressedSinceRead & 0x100u) data.analog_buttons_l2 = std::max(data.analog_buttons_l2, pressedAnalogL2);
-        if (pressedSinceRead & 0x200u) data.analog_buttons_r2 = std::max(data.analog_buttons_r2, pressedAnalogR2);
+    const auto injected = port == 0 ? InjectedInput(now) : Pad::InputCommandFile::Input{};
+    auto& slot = slots[port];
+    PadData data = BuildData(slot, slot.state, slot.timestamp, now, injected, port);
+    if (slot.pressedSinceRead != 0 && now - slot.pressedAt <= LatchExpiry(slot)) {
+        data.buttons |= slot.pressedSinceRead;
+        if (slot.pressedSinceRead & 0x100u) data.analog_buttons_l2 = std::max(data.analog_buttons_l2, slot.pressedAnalogL2);
+        if (slot.pressedSinceRead & 0x200u) data.analog_buttons_r2 = std::max(data.analog_buttons_r2, slot.pressedAnalogR2);
     }
-    pressedSinceRead = 0;
+    slot.pressedSinceRead = 0;
+    if (slot.lastReadAt != 0) slot.readInterval = now - slot.lastReadAt;
+    slot.lastReadAt = now;
     return data;
 }
 
-int Pad::Read(PadData* data, int num) {
+int Pad::Read(PadData* data, int num, int port) {
     if (data == nullptr || num <= 0) throw std::invalid_argument("Pad: invalid read buffer");
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) throw std::invalid_argument("Pad: invalid port");
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
     if (!initialized) throw std::runtime_error("Pad: read before initialization");
-    pressedSinceRead = 0;
+    auto& slot = slots[port];
+    slot.pressedSinceRead = 0;
     const std::uint64_t now = sceKernelGetProcessTime();
-    const auto injected = InjectedInput(now);
-    if (queue.empty()) {
-        data[0] = BuildData(state, timestamp, now, injected);
+    const auto injected = port == 0 ? InjectedInput(now) : Pad::InputCommandFile::Input{};
+    if (slot.queue.empty()) {
+        data[0] = BuildData(slot, slot.state, slot.timestamp, now, injected, port);
         return 1;
     }
     int count = 0;
-    while (count < num && !queue.empty()) {
-        const QueuedInput& entry = queue.front();
-        data[count++] = BuildData(entry.input, entry.timestamp, now, injected);
-        queue.pop_front();
+    while (count < num && !slot.queue.empty()) {
+        const QueuedInput& entry = slot.queue.front();
+        data[count++] = BuildData(slot, entry.input, port == 0 ? std::max(entry.timestamp, injectedTimestamp) : entry.timestamp, now, injected, port);
+        slot.queue.pop_front();
     }
     return count;
 }
 
-void Pad::SetVibration(std::uint8_t large, std::uint8_t small) {
+void Pad::SetVibration(int port, std::uint8_t large, std::uint8_t small) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     if (output.vibrationLarge == large && output.vibrationSmall == small) return;
     output.vibrationLarge = large;
     output.vibrationSmall = small;
     ++output.sequence;
 }
 
-void Pad::SetVibrationMode(int mode) {
+void Pad::SetVibration(std::uint8_t large, std::uint8_t small) {
+    SetVibration(0, large, small);
+}
+
+void Pad::SetVibrationMode(int port, int mode) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     if (output.vibrationMode == mode) return;
     output.vibrationMode = mode;
     ++output.sequence;
 }
 
-void Pad::SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b) {
+void Pad::SetVibrationMode(int mode) {
+    SetVibrationMode(0, mode);
+}
+
+void Pad::SetLightBar(int port, bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     output.lightBarValid = valid;
     output.lightBar[0] = r;
     output.lightBar[1] = g;
@@ -290,8 +337,12 @@ void Pad::SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b
     ++output.sequence;
 }
 
-void Pad::SetTriggerCommand(int trigger, const std::uint8_t* command) {
-    if (trigger < 0 || trigger > 1 || command == nullptr) return;
+void Pad::SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b) {
+    SetLightBar(0, valid, r, g, b);
+}
+
+void Pad::SetTriggerCommand(int port, int trigger, const std::uint8_t* command) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS || trigger < 0 || trigger > 1 || command == nullptr) return;
     std::uint32_t mode = 0;
     std::memcpy(&mode, command, 4);
     const std::uint8_t* p = command + 8;
@@ -348,55 +399,95 @@ void Pad::SetTriggerCommand(int trigger, const std::uint8_t* command) {
     req.valid = req.effect[0] != 0x05;
     if (!req.valid) req.fallback = 0;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     output.trigger[trigger] = req;
     output.triggerTouched = true;
     ++output.sequence;
 }
 
-void Pad::ResetOrientation() {
+void Pad::SetTriggerCommand(int trigger, const std::uint8_t* command) {
+    SetTriggerCommand(0, trigger, command);
+}
+
+void Pad::ResetOrientation(int port) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
-    orientation = Quat{};
-    biasIntegral[0] = biasIntegral[1] = biasIntegral[2] = 0.0f;
+    slots[port].orientation = Quat{};
+    slots[port].biasIntegral[0] = slots[port].biasIntegral[1] = slots[port].biasIntegral[2] = 0.0f;
+}
+
+void Pad::SetTiltCorrection(int port, bool enabled) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
+    std::lock_guard lock(stateMutex);
+    slots[port].tiltCorrection = enabled;
+    slots[port].biasIntegral[0] = slots[port].biasIntegral[1] = slots[port].biasIntegral[2] = 0.0f;
 }
 
 void Pad::SetTiltCorrection(bool enabled) {
+    SetTiltCorrection(0, enabled);
+}
+
+void Pad::SetAngularVelocityDeadband(int port, bool enabled) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
-    tiltCorrection = enabled;
-    biasIntegral[0] = biasIntegral[1] = biasIntegral[2] = 0.0f;
+    slots[port].angularVelocityDeadband = enabled;
 }
 
 void Pad::SetAngularVelocityDeadband(bool enabled) {
-    std::lock_guard lock(stateMutex);
-    angularVelocityDeadband = enabled;
+    SetAngularVelocityDeadband(0, enabled);
 }
 
-void Pad::SetMotionEnabled(bool enabled) {
+void Pad::SetMotionEnabled(int port, bool enabled) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     if (output.motionEnabled == enabled) return;
     output.motionEnabled = enabled;
     ++output.sequence;
 }
 
-extern "C" void PadPublishInput_nid_postfix(const PadInputState& input) {
+void Pad::SetMotionEnabled(bool enabled) {
+    SetMotionEnabled(0, enabled);
+}
+
+void Pad::SetConnected(int port, bool connected) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
+    std::lock_guard lock(stateMutex);
+    slots[port].connected = connected;
+}
+
+bool Pad::IsConnected(int port) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return false;
+    std::lock_guard lock(stateMutex);
+    return slots[port].connected;
+}
+
+extern "C" void PadPublishInputForPort_nid_postfix(int port, const PadInputState& input) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
-    if (state.buttons == input.buttons && state.sticks == input.sticks &&
-        state.analogButtonsL2 == input.analogButtonsL2 && state.analogButtonsR2 == input.analogButtonsR2 &&
-        state.touchLeft == input.touchLeft && state.touchRight == input.touchRight &&
-        state.hasMotion == input.hasMotion && state.accel == input.accel && state.gyro == input.gyro &&
-        state.touch == input.touch && state.deviceKind == input.deviceKind) return;
-    const std::uint32_t pressed = input.buttons & ~state.buttons;
-    timestamp = sceKernelGetProcessTime();
+    auto& slot = slots[port];
+    if (slot.state.buttons == input.buttons && slot.state.sticks == input.sticks &&
+        slot.state.analogButtonsL2 == input.analogButtonsL2 && slot.state.analogButtonsR2 == input.analogButtonsR2 &&
+        slot.state.touchLeft == input.touchLeft && slot.state.touchRight == input.touchRight &&
+        slot.state.hasMotion == input.hasMotion && slot.state.accel == input.accel && slot.state.gyro == input.gyro &&
+        slot.state.touch == input.touch && slot.state.deviceKind == input.deviceKind) return;
+    const std::uint32_t pressed = input.buttons & ~slot.state.buttons;
+    slot.timestamp = sceKernelGetProcessTime();
     if (pressed != 0) {
-        if (pressedSinceRead != 0 && timestamp - pressedAt > kLatchExpiry) pressedSinceRead = 0;
-        pressedSinceRead |= pressed;
-        pressedAt = timestamp;
-        if (pressed & 0x100u) pressedAnalogL2 = input.analogButtonsL2;
-        if (pressed & 0x200u) pressedAnalogR2 = input.analogButtonsR2;
+        if (slot.pressedSinceRead != 0 && slot.timestamp - slot.pressedAt > LatchExpiry(slot)) slot.pressedSinceRead = 0;
+        slot.pressedSinceRead |= pressed;
+        slot.pressedAt = slot.timestamp;
+        if (pressed & 0x100u) slot.pressedAnalogL2 = input.analogButtonsL2;
+        if (pressed & 0x200u) slot.pressedAnalogR2 = input.analogButtonsR2;
     }
-    state = input;
-    if (queue.size() == kQueueCapacity) queue.pop_front();
-    queue.push_back({input, timestamp});
+    slot.state = input;
+    if (slot.queue.size() == kQueueCapacity) slot.queue.pop_front();
+    slot.queue.push_back({input, slot.timestamp});
+}
+
+extern "C" void PadPublishInput_nid_postfix(const PadInputState& input) {
+    PadPublishInputForPort_nid_postfix(0, input);
 }
 
 extern "C" void PadReportInputFailure_nid_postfix(std::exception_ptr error) {
@@ -405,35 +496,51 @@ extern "C" void PadReportInputFailure_nid_postfix(std::exception_ptr error) {
     if (!failure) failure = error;
 }
 
-extern "C" bool PadFetchOutput_nid_postfix(std::uint32_t* seenSequence, PadOutputState* out) {
+extern "C" bool PadFetchOutputForPort_nid_postfix(int port, std::uint32_t* seenSequence, PadOutputState* out) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return false;
     std::lock_guard lock(stateMutex);
-    if (RefreshAudioHaptics()) ++output.sequence;
-    if (seenSequence == nullptr || out == nullptr || *seenSequence == output.sequence) return false;
-    *seenSequence = output.sequence;
-    *out = output;
+    auto& slot = slots[port];
+    if (RefreshAudioHaptics(slot)) ++slot.output.sequence;
+    if (seenSequence == nullptr || out == nullptr || *seenSequence == slot.output.sequence) return false;
+    *seenSequence = slot.output.sequence;
+    *out = slot.output;
     return true;
 }
 
-extern "C" void PadSubmitAudioHaptics_nid_postfix(std::uint8_t large, std::uint8_t small) {
+extern "C" bool PadFetchOutput_nid_postfix(std::uint32_t* seenSequence, PadOutputState* out) {
+    return PadFetchOutputForPort_nid_postfix(0, seenSequence, out);
+}
+
+extern "C" void PadSubmitAudioHapticsForPort_nid_postfix(int port, std::uint8_t large, std::uint8_t small) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
     if (large == 0 && small == 0) return;
     const auto now = std::chrono::steady_clock::now();
-    if (now >= audioHapticEnd) audioHapticRumble = {};
-    audioHapticRumble[0] = std::max(audioHapticRumble[0], large);
-    audioHapticRumble[1] = std::max(audioHapticRumble[1], small);
-    audioHapticEnd = now + std::chrono::milliseconds(80);
-    static_cast<void>(RefreshAudioHaptics());
-    ++output.sequence;
+    auto& slot = slots[port];
+    if (now >= slot.audioHapticEnd) slot.audioHapticRumble = {};
+    slot.audioHapticRumble[0] = std::max(slot.audioHapticRumble[0], large);
+    slot.audioHapticRumble[1] = std::max(slot.audioHapticRumble[1], small);
+    slot.audioHapticEnd = now + std::chrono::milliseconds(80);
+    static_cast<void>(RefreshAudioHaptics(slot));
+    ++slot.output.sequence;
 }
 
 extern "C" void PadQueueLegacyAudioHaptics_nid_postfix(int source, std::uint64_t begin, std::uint64_t end, std::uint8_t large, std::uint8_t small) {
     std::lock_guard lock(stateMutex);
-    legacyHaptics.Queue(source, begin, end, large, small);
-    if (RefreshAudioHaptics()) ++output.sequence;
+    slots[0].legacyHaptics.Queue(source, begin, end, large, small);
+    if (RefreshAudioHaptics(slots[0])) ++slots[0].output.sequence;
 }
 
 extern "C" void PadClearLegacyAudioHaptics_nid_postfix(int source) {
     std::lock_guard lock(stateMutex);
-    legacyHaptics.Clear(source);
-    if (RefreshAudioHaptics()) ++output.sequence;
+    slots[0].legacyHaptics.Clear(source);
+    if (RefreshAudioHaptics(slots[0])) ++slots[0].output.sequence;
+}
+
+extern "C" void PadSubmitAudioHaptics_nid_postfix(std::uint8_t large, std::uint8_t small) {
+    PadSubmitAudioHapticsForPort_nid_postfix(0, large, small);
+}
+
+extern "C" void PadSetPortConnected_nid_postfix(int port, bool connected) {
+    Pad::SetConnected(port, connected);
 }
diff --git a/core/libs/prx/libScePadTracker/Export.cpp b/core/libs/prx/libScePadTracker/Export.cpp
index e43ebed776..e48d78bdda 100644
--- a/core/libs/prx/libScePadTracker/Export.cpp
+++ b/core/libs/prx/libScePadTracker/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePadTracker/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePadTracker/include/Api.hpp b/core/libs/prx/libScePadTracker/include/Api.hpp
new file mode 100644
index 0000000000..825991c114
--- /dev/null
+++ b/core/libs/prx/libScePadTracker/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePadTrackerCalibrate();
+int APS5_VABI scePadTrackerGetWorkingMemorySize();
+int APS5_VABI scePadTrackerInit();
+int APS5_VABI scePadTrackerReadState();
+int APS5_VABI scePadTrackerTerm();
+int APS5_VABI scePadTrackerUpdate();
+
+}
diff --git a/core/libs/prx/libScePadTracker/libScePadTracker.hpp b/core/libs/prx/libScePadTracker/libScePadTracker.hpp
new file mode 100644
index 0000000000..18b6ca49c9
--- /dev/null
+++ b/core/libs/prx/libScePadTracker/libScePadTracker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePadTracker/include/Api.hpp"
diff --git a/core/libs/prx/libScePatchCheckerClient/Export.cpp b/core/libs/prx/libScePatchCheckerClient/Export.cpp
index 3cce60d2e7..e10db5258f 100644
--- a/core/libs/prx/libScePatchCheckerClient/Export.cpp
+++ b/core/libs/prx/libScePatchCheckerClient/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePatchCheckerClient/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePatchCheckerClient/include/Api.hpp b/core/libs/prx/libScePatchCheckerClient/include/Api.hpp
new file mode 100644
index 0000000000..25f7bdc95a
--- /dev/null
+++ b/core/libs/prx/libScePatchCheckerClient/include/Api.hpp
@@ -0,0 +1,20 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePatchCheckerCancel();
+int APS5_VABI scePatchCheckerCheckPatch();
+int APS5_VABI scePatchCheckerCreateHandler();
+int APS5_VABI scePatchCheckerDestroyHandler();
+int APS5_VABI scePatchCheckerDisableAutoDownload();
+int APS5_VABI scePatchCheckerEnableAutoDownload();
+int APS5_VABI scePatchCheckerGetApplicableTick();
+int APS5_VABI scePatchCheckerGetPackageInfo();
+int APS5_VABI scePatchCheckerInitialize();
+int APS5_VABI scePatchCheckerRequestCheckPatch();
+int APS5_VABI scePatchCheckerRequestCheckPatchByType();
+int APS5_VABI scePatchCheckerTerminate();
+
+}
diff --git a/core/libs/prx/libScePatchCheckerClient/libScePatchCheckerClient.hpp b/core/libs/prx/libScePatchCheckerClient/libScePatchCheckerClient.hpp
new file mode 100644
index 0000000000..dab24e28c7
--- /dev/null
+++ b/core/libs/prx/libScePatchCheckerClient/libScePatchCheckerClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePatchCheckerClient/include/Api.hpp"
diff --git a/core/libs/prx/libScePerf/libScePerf.hpp b/core/libs/prx/libScePerf/libScePerf.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePerf/libScePerf.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePlayGo/Export.cpp b/core/libs/prx/libScePlayGo/Export.cpp
index 9fae1d940e..f03bd2e343 100644
--- a/core/libs/prx/libScePlayGo/Export.cpp
+++ b/core/libs/prx/libScePlayGo/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayGo/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -106,13 +107,15 @@ static UnlistedChunkAnswer UnlistedChunks() {
 
 static bool IsKnownChunk(uint16_t id) {
     const auto& chunks = Chunks();
-    if (chunks.defined) return chunks.ids.contains(id);
-    if (chunks.scenario || id == 0) return true;
+    if (chunks.ids.contains(id)) return true;
+    if (chunks.defined) return false;
     switch (UnlistedChunks()) {
     case UnlistedChunkAnswer::Installed: return true;
     case UnlistedChunkAnswer::Absent: return false;
     case UnlistedChunkAnswer::Stop: break;
     }
+    if (chunks.scenario)
+        throw std::runtime_error("scePlayGo: sce_sys/playgo-chunk.dat is missing and sce_sys/playgo-scenario.json lists no chunks, so chunk ID " + std::to_string(id) + " outside the listed ids 0 to " + std::to_string(PLAYGO_SCENARIO_CHUNK_COUNT - 1) + " cannot be checked; set APS5_PLAYGO_UNLISTED_CHUNKS=installed or =absent to answer for this dump");
     throw std::runtime_error("scePlayGo: sce_sys/playgo-chunk.dat and sce_sys/playgo-scenario.json are missing, so chunk ID " + std::to_string(id) + " cannot be checked; set APS5_PLAYGO_UNLISTED_CHUNKS=installed or =absent to answer for this dump");
 }
 
diff --git a/core/libs/prx/libScePlayGo/include/Api.hpp b/core/libs/prx/libScePlayGo/include/Api.hpp
new file mode 100644
index 0000000000..e7f2e0a879
--- /dev/null
+++ b/core/libs/prx/libScePlayGo/include/Api.hpp
@@ -0,0 +1,29 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayGoClose(int handle);
+int APS5_VABI scePlayGoGetChunkId(int handle, uint16_t* outChunkIdList, uint32_t numberOfEntries, uint32_t* outEntries);
+int APS5_VABI scePlayGoGetEta(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, int64_t* outEta);
+int APS5_VABI scePlayGoGetInstallChunkId(int handle, uint16_t* outChunkIdList, uint32_t numberOfEntries, uint32_t* outEntries);
+int APS5_VABI scePlayGoGetInstallSpeed(int handle, int32_t* outSpeed);
+int APS5_VABI scePlayGoGetLanguageMask(int handle, uint64_t* outLanguageMask);
+int APS5_VABI scePlayGoGetLocus(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, int8_t* outLoci);
+int APS5_VABI scePlayGoGetOptionalChunk(int handle, std::uint32_t type, PlayGoOptionalChunk* option);
+int APS5_VABI scePlayGoGetProgress(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, PlayGoProgress* outProgress);
+int APS5_VABI scePlayGoGetSupportedOptionalChunk(int handle, std::uint32_t type, PlayGoOptionalChunk* option);
+int APS5_VABI scePlayGoGetToDoList(int handle, PlayGoToDo* outTodoList, uint32_t numberOfEntries, uint32_t* outEntries);
+int APS5_VABI scePlayGoInitialize(const PlayGoInitParams* init);
+int APS5_VABI scePlayGoOpen(int* outHandle, const void* param);
+int APS5_VABI scePlayGoPrefetch(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, int8_t minimumLocus);
+int APS5_VABI scePlayGoPrefetchOptionalChunk(int handle, int32_t type, const PlayGoOptionalChunk* option);
+int APS5_VABI scePlayGoSetInstallSpeed(int handle, int32_t speed);
+int APS5_VABI scePlayGoSetToDoList(int handle, const PlayGoToDo* todoList, uint32_t numberOfEntries);
+int APS5_VABI scePlayGoTerminate(void);
+int APS5_VABI scePlayGoRequestNextChunk();
+int APS5_VABI scePlayGoSetLanguageMask(int handle, uint64_t languageMask);
+int APS5_VABI scePlayGoSnapshot();
+
+}
diff --git a/core/libs/prx/libScePlayGo/libScePlayGo.hpp b/core/libs/prx/libScePlayGo/libScePlayGo.hpp
new file mode 100644
index 0000000000..be60245c2e
--- /dev/null
+++ b/core/libs/prx/libScePlayGo/libScePlayGo.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayGo/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayGoDialog/Export.cpp b/core/libs/prx/libScePlayGoDialog/Export.cpp
index e341d17b84..084d94c5b3 100644
--- a/core/libs/prx/libScePlayGoDialog/Export.cpp
+++ b/core/libs/prx/libScePlayGoDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayGoDialog/include/Api.hpp"
 #include <atomic>
 #include <algorithm>
 #include <iterator>
diff --git a/core/libs/prx/libScePlayGoDialog/include/Api.hpp b/core/libs/prx/libScePlayGoDialog/include/Api.hpp
new file mode 100644
index 0000000000..99f0428e67
--- /dev/null
+++ b/core/libs/prx/libScePlayGoDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayGoDialogInitialize(void);
+int APS5_VABI scePlayGoDialogTerminate(void);
+int APS5_VABI scePlayGoDialogOpen(const void* param);
+int APS5_VABI scePlayGoDialogClose(void);
+int APS5_VABI scePlayGoDialogUpdateStatus(void);
+int APS5_VABI scePlayGoDialogGetResult(PlayGoDialogResult* result);
+int APS5_VABI scePlayGoDialogGetStatus(void);
+
+}
diff --git a/core/libs/prx/libScePlayGoDialog/libScePlayGoDialog.hpp b/core/libs/prx/libScePlayGoDialog/libScePlayGoDialog.hpp
new file mode 100644
index 0000000000..3b805577f0
--- /dev/null
+++ b/core/libs/prx/libScePlayGoDialog/libScePlayGoDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayGoDialog/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayReady/Export.cpp b/core/libs/prx/libScePlayReady/Export.cpp
index 59330d9d35..4c7e5fe395 100644
--- a/core/libs/prx/libScePlayReady/Export.cpp
+++ b/core/libs/prx/libScePlayReady/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayReady/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -216,8 +217,7 @@ int APS5_VABI scePlayReadyMemFree() {
 }
 
 int APS5_VABI scePlayReadyMemGetStats() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80004001);
 }
 
 int APS5_VABI scePlayReadyMemRealloc() {
diff --git a/core/libs/prx/libScePlayReady/include/Api.hpp b/core/libs/prx/libScePlayReady/include/Api.hpp
new file mode 100644
index 0000000000..6fb478bbda
--- /dev/null
+++ b/core/libs/prx/libScePlayReady/include/Api.hpp
@@ -0,0 +1,58 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceBufferAlloc();
+int APS5_VABI sceBufferDup();
+int APS5_VABI sceBufferFree();
+int APS5_VABI sceBufferInit();
+int APS5_VABI sceBufferRealloc();
+int APS5_VABI scePlayReadyApiInitializeInitParams();
+int APS5_VABI scePlayReadyApiIsStarted();
+int APS5_VABI scePlayReadyApiStart();
+int APS5_VABI scePlayReadyApiStop();
+int APS5_VABI scePlayReadyApiVersion();
+int APS5_VABI scePlayReadyApiVersionString();
+int APS5_VABI scePlayReadyBufferFree();
+int APS5_VABI scePlayReadyBufferInit();
+int APS5_VABI scePlayReadyBufferMalloc();
+int APS5_VABI scePlayReadyBufferRealloc();
+int APS5_VABI scePlayReadyContentGetProperty();
+int APS5_VABI scePlayReadyContentSetProperty();
+int APS5_VABI scePlayReadyDomainCertEnumFini();
+int APS5_VABI scePlayReadyDomainCertEnumInit();
+int APS5_VABI scePlayReadyDomainCertEnumNext();
+int APS5_VABI scePlayReadyDomainCertFind();
+int APS5_VABI scePlayReadyDomainJoinGenerateChallenge();
+int APS5_VABI scePlayReadyDomainJoinProcessResponse();
+int APS5_VABI scePlayReadyDomainLeaveGenerateChallenge();
+int APS5_VABI scePlayReadyDomainLeaveProcessResponse();
+int APS5_VABI scePlayReadyEnvelopeClose();
+int APS5_VABI scePlayReadyEnvelopeGetSize();
+int APS5_VABI scePlayReadyEnvelopeInitializeRead();
+int APS5_VABI scePlayReadyEnvelopeOpen();
+int APS5_VABI scePlayReadyEnvelopeRead();
+int APS5_VABI scePlayReadyEnvelopeSeek();
+int APS5_VABI scePlayReadyFinalize();
+int APS5_VABI scePlayReadyFreeDecryptContext();
+int APS5_VABI scePlayReadyInitialize();
+int APS5_VABI scePlayReadyInitializeInitParams();
+int APS5_VABI scePlayReadyLicenseAcqGenerateAck();
+int APS5_VABI scePlayReadyLicenseAcqGenerateChallenge();
+int APS5_VABI scePlayReadyLicenseAcqGetAdditionalResponseData();
+int APS5_VABI scePlayReadyLicenseAcqProcessAckResponse();
+int APS5_VABI scePlayReadyLicenseAcqProcessResponse();
+int APS5_VABI scePlayReadyMemAlloc();
+int APS5_VABI scePlayReadyMemFree();
+int APS5_VABI scePlayReadyMemGetStats();
+int APS5_VABI scePlayReadyMemRealloc();
+int APS5_VABI scePlayReadyNewDecryptContext();
+int APS5_VABI scePlayReadyReaderBind();
+int APS5_VABI scePlayReadyReaderCommit();
+int APS5_VABI scePlayReadyReaderDecrypt();
+int APS5_VABI scePlayReadyReset();
+int APS5_VABI scePlayReadyStoreCleanup();
+
+}
diff --git a/core/libs/prx/libScePlayReady/libScePlayReady.hpp b/core/libs/prx/libScePlayReady/libScePlayReady.hpp
new file mode 100644
index 0000000000..3138b60f6b
--- /dev/null
+++ b/core/libs/prx/libScePlayReady/libScePlayReady.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayReady/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayReady2/Export.cpp b/core/libs/prx/libScePlayReady2/Export.cpp
index 2b08a30037..0ad7e3f73d 100644
--- a/core/libs/prx/libScePlayReady2/Export.cpp
+++ b/core/libs/prx/libScePlayReady2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayReady2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayReady2/include/Api.hpp b/core/libs/prx/libScePlayReady2/include/Api.hpp
new file mode 100644
index 0000000000..3e388e5dc6
--- /dev/null
+++ b/core/libs/prx/libScePlayReady2/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayReadyBufferInitWithData();
+int APS5_VABI scePlayReadyCloneDecryptContext();
+int APS5_VABI scePlayReadyDebugPrintf();
+int APS5_VABI scePlayReadyDebugSetLevel();
+int APS5_VABI scePlayReadyLicenseDelete();
+int APS5_VABI scePlayReadyLicenseDeleteInMemory();
+int APS5_VABI scePlayReadyLicenseGetExpirationTime();
+int APS5_VABI scePlayReadyLicenseGetProperty();
+int APS5_VABI scePlayReadyReaderClose();
+int APS5_VABI scePlayReadyReaderDecryptMultiple();
+int APS5_VABI scePlayReadyReaderDecryptMultipleOpaque();
+int APS5_VABI scePlayReadyReaderDecryptOpaque();
+int APS5_VABI scePlayReadyReaderDecrypt_Legacy();
+int APS5_VABI scePlayReadyReaderFreeOpaqueContent();
+int APS5_VABI scePlayReadyReaderRetrieveOpaqueContent();
+int APS5_VABI scePlayReadyReinitialize();
+
+}
diff --git a/core/libs/prx/libScePlayReady2/libScePlayReady2.hpp b/core/libs/prx/libScePlayReady2/libScePlayReady2.hpp
new file mode 100644
index 0000000000..48fc0e9766
--- /dev/null
+++ b/core/libs/prx/libScePlayReady2/libScePlayReady2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayReady2/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayReady4/Export.cpp b/core/libs/prx/libScePlayReady4/Export.cpp
index 0454139571..9d4bbeea93 100644
--- a/core/libs/prx/libScePlayReady4/Export.cpp
+++ b/core/libs/prx/libScePlayReady4/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayReady4/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayReady4/include/Api.hpp b/core/libs/prx/libScePlayReady4/include/Api.hpp
new file mode 100644
index 0000000000..cef37c1859
--- /dev/null
+++ b/core/libs/prx/libScePlayReady4/include/Api.hpp
@@ -0,0 +1,43 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayReadyApiPlatform();
+int APS5_VABI scePlayReadyCdmiClose();
+int APS5_VABI scePlayReadyCdmiCreateMediaKeySession();
+int APS5_VABI scePlayReadyCdmiCreateMediaKeySystemAccess();
+int APS5_VABI scePlayReadyCdmiCreateMediaKeys();
+int APS5_VABI scePlayReadyCdmiDecryptMultipleOpaque();
+int APS5_VABI scePlayReadyCdmiDecryptOpaque();
+int APS5_VABI scePlayReadyCdmiDecryptOpaque2();
+int APS5_VABI scePlayReadyCdmiDestroyMediaKeySession();
+int APS5_VABI scePlayReadyCdmiDestroyMediaKeySystemAccess();
+int APS5_VABI scePlayReadyCdmiDestroyMediaKeys();
+int APS5_VABI scePlayReadyCdmiFreeOpaqueDecryptedContent();
+int APS5_VABI scePlayReadyCdmiGenerateRequest();
+int APS5_VABI scePlayReadyCdmiGetConfiguration();
+int APS5_VABI scePlayReadyCdmiGetExpiration();
+int APS5_VABI scePlayReadyCdmiGetKeySystem();
+int APS5_VABI scePlayReadyCdmiGetMediaKeyCount();
+int APS5_VABI scePlayReadyCdmiGetMediaKeyStatus();
+int APS5_VABI scePlayReadyCdmiGetSessionAppContext();
+int APS5_VABI scePlayReadyCdmiGetSessionId();
+int APS5_VABI scePlayReadyCdmiIsLicenseAckRequired();
+int APS5_VABI scePlayReadyCdmiLoad();
+int APS5_VABI scePlayReadyCdmiRemove();
+int APS5_VABI scePlayReadyCdmiRetrieveOpaqueDecryptedContent();
+int APS5_VABI scePlayReadyCdmiSetServerCertificate();
+int APS5_VABI scePlayReadyCdmiSetSessionCallbacks();
+int APS5_VABI scePlayReadyCdmiUpdate();
+int APS5_VABI scePlayReadyLicenseCount();
+int APS5_VABI scePlayReadyProfileClear();
+int APS5_VABI scePlayReadyProfileEnter();
+int APS5_VABI scePlayReadyProfileLeave();
+int APS5_VABI scePlayReadyProfilePause();
+int APS5_VABI scePlayReadyProfileResume();
+int APS5_VABI scePlayReadyProfileStart();
+int APS5_VABI scePlayReadyProfileStop();
+
+}
diff --git a/core/libs/prx/libScePlayReady4/libScePlayReady4.hpp b/core/libs/prx/libScePlayReady4/libScePlayReady4.hpp
new file mode 100644
index 0000000000..97c4cdd3e7
--- /dev/null
+++ b/core/libs/prx/libScePlayReady4/libScePlayReady4.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayReady4/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayerInvitationDialog/Export.cpp b/core/libs/prx/libScePlayerInvitationDialog/Export.cpp
index 86095da370..0f78112135 100644
--- a/core/libs/prx/libScePlayerInvitationDialog/Export.cpp
+++ b/core/libs/prx/libScePlayerInvitationDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.h"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.hpp b/core/libs/prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.hpp
new file mode 100644
index 0000000000..be74cdea73
--- /dev/null
+++ b/core/libs/prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.h"
diff --git a/core/libs/prx/libScePlayerSelectionDialog/Export.cpp b/core/libs/prx/libScePlayerSelectionDialog/Export.cpp
index 06df01e1c8..52b3363adb 100644
--- a/core/libs/prx/libScePlayerSelectionDialog/Export.cpp
+++ b/core/libs/prx/libScePlayerSelectionDialog/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libScePlayerSelectionDialog/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -6,8 +8,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libScePlayerSelectionDialog/include/Api.hpp b/core/libs/prx/libScePlayerSelectionDialog/include/Api.hpp
new file mode 100644
index 0000000000..baf1617f53
--- /dev/null
+++ b/core/libs/prx/libScePlayerSelectionDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayerSelectionDialogInitialize(void);
+int APS5_VABI scePlayerSelectionDialogOpen(const PlayerSelectionDialogParam* param);
+int APS5_VABI scePlayerSelectionDialogClose(void);
+int APS5_VABI scePlayerSelectionDialogUpdateStatus(void);
+int APS5_VABI scePlayerSelectionDialogGetStatus(void);
+int APS5_VABI scePlayerSelectionDialogGetResult(PlayerSelectionDialogResult* result);
+int APS5_VABI scePlayerSelectionDialogParamInitialize(void* param);
+int APS5_VABI scePlayerSelectionDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libScePlayerSelectionDialog/libScePlayerSelectionDialog.hpp b/core/libs/prx/libScePlayerSelectionDialog/libScePlayerSelectionDialog.hpp
new file mode 100644
index 0000000000..2e72898b93
--- /dev/null
+++ b/core/libs/prx/libScePlayerSelectionDialog/libScePlayerSelectionDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayerSelectionDialog/include/Api.hpp"
diff --git a/core/libs/prx/libScePngDec/Export.cpp b/core/libs/prx/libScePngDec/Export.cpp
index 8ff5827de0..c4404f2e40 100644
--- a/core/libs/prx/libScePngDec/Export.cpp
+++ b/core/libs/prx/libScePngDec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePngDec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -144,10 +145,8 @@ int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param,
     const std::optional<Decoder::Png::Header> header = Decoder::Png::ParseHeader(png);
     if (!header) return SCE_PNG_DEC_ERROR_INVALID_DATA;
     if (imageInfo) fillImageInfo(*header, imageInfo);
-    if (header->bitDepth == 16 && context->attribute == ATTRIBUTE_BIT_DEPTH_16) {
-        throw std::runtime_error("scePngDecDecode: 16-bit output is not implemented");
-    }
-
+    const bool packedDimensions = header->width <= MAX_PACKED_DIMENSION && header->height <= MAX_PACKED_DIMENSION;
+    if (!imageInfo && !packedDimensions) return SCE_PNG_DEC_ERROR_INVALID_ADDR;
     const std::uint64_t rowSize = static_cast<std::uint64_t>(header->width) * BYTES_PER_PIXEL;
     const std::uint64_t pitch = param->image_pitch == 0 ? rowSize : param->image_pitch;
     if (param->image_pitch != 0 && (pitch < rowSize || (pitch & 3u) != 0)) return SCE_PNG_DEC_ERROR_INVALID_PARAM;
@@ -159,6 +158,7 @@ int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param,
     const std::uint64_t alignedWidth = (static_cast<std::uint64_t>(header->width) + 7u) & ~std::uint64_t{7u};
     const std::uint64_t alignedMaxWidth = (static_cast<std::uint64_t>(context->maxImageWidth) + 7u) & ~std::uint64_t{7u};
     if (alignedWidth > alignedMaxWidth) return SCE_PNG_DEC_ERROR_INVALID_WORK_MEMORY;
+    if (header->bitDepth > (8u << (context->attribute & 31u))) return SCE_PNG_DEC_ERROR_INVALID_WORK_MEMORY;
 
     const std::optional<Decoder::Png::Image> image = Decoder::Png::Decode(png);
     if (!image || image->width != header->width || image->height != header->height) return SCE_PNG_DEC_ERROR_DECODE_ERROR;
@@ -178,7 +178,7 @@ int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param,
         }
     }
 
-    if (header->width > MAX_PACKED_DIMENSION || header->height > MAX_PACKED_DIMENSION) return 0;
+    if (!packedDimensions) return 0;
     return static_cast<std::int32_t>(header->width << 16 | header->height);
 }
 
diff --git a/core/libs/prx/libScePngDec/include/Api.hpp b/core/libs/prx/libScePngDec/include/Api.hpp
new file mode 100644
index 0000000000..1440fbcf5a
--- /dev/null
+++ b/core/libs/prx/libScePngDec/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI scePngDecCreate(const PngDecCreateParam* param, void* memoryAddress, uint32_t memorySize, void** handle);
+int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param, PngDecImageInfo* imageInfo);
+int32_t APS5_VABI scePngDecDelete(void* handle);
+int32_t APS5_VABI scePngDecParseHeader(const PngDecParseParam* param, PngDecImageInfo* imageInfo);
+int32_t APS5_VABI scePngDecQueryMemorySize(const PngDecCreateParam* param);
+int APS5_VABI scePngDecDecodeWithInputControl();
+
+}
diff --git a/core/libs/prx/libScePngDec/libScePngDec.hpp b/core/libs/prx/libScePngDec/libScePngDec.hpp
new file mode 100644
index 0000000000..27bf3452a2
--- /dev/null
+++ b/core/libs/prx/libScePngDec/libScePngDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePngDec/include/Api.hpp"
diff --git a/core/libs/prx/libScePngEnc/Export.cpp b/core/libs/prx/libScePngEnc/Export.cpp
index c6e3c9532a..75f4ad13f1 100644
--- a/core/libs/prx/libScePngEnc/Export.cpp
+++ b/core/libs/prx/libScePngEnc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePngEnc/include/Api.hpp"
 #include <algorithm>
 #include <bit>
 #include <new>
diff --git a/core/libs/prx/libScePngEnc/include/Api.hpp b/core/libs/prx/libScePngEnc/include/Api.hpp
new file mode 100644
index 0000000000..b279f174e8
--- /dev/null
+++ b/core/libs/prx/libScePngEnc/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePngEncQueryMemorySize(const PngEncCreateParam* param);
+int APS5_VABI scePngEncCreate(const PngEncCreateParam* param, void* memoryAddress, uint32_t memorySize, void** handle);
+int APS5_VABI scePngEncDelete(void* handle);
+int APS5_VABI scePngEncEncode(void* handle, const PngEncEncodeParam* param, PngEncOutputInfo* outputInfo);
+
+}
diff --git a/core/libs/prx/libScePngEnc/libScePngEnc.hpp b/core/libs/prx/libScePngEnc/libScePngEnc.hpp
new file mode 100644
index 0000000000..2355570756
--- /dev/null
+++ b/core/libs/prx/libScePngEnc/libScePngEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePngEnc/include/Api.hpp"
diff --git a/core/libs/prx/libScePngParser/libScePngParser.hpp b/core/libs/prx/libScePngParser/libScePngParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePngParser/libScePngParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePosixForWebKit/CMakeLists.txt b/core/libs/prx/libScePosixForWebKit/CMakeLists.txt
index 036eb0577d..5b79f2a4f6 100644
--- a/core/libs/prx/libScePosixForWebKit/CMakeLists.txt
+++ b/core/libs/prx/libScePosixForWebKit/CMakeLists.txt
@@ -1,6 +1,6 @@
-add_library(libScePosixForWebKit SHARED EXCLUDE_FROM_ALL Export.cpp Resolver.cpp Filesystem.cpp)
+add_library(libScePosixForWebKit SHARED EXCLUDE_FROM_ALL Export.cpp Resolver.cpp Filesystem.cpp Wrap.cpp)
 target_include_directories(libScePosixForWebKit PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(libScePosixForWebKit PRIVATE libSceNet)
+target_link_libraries(libScePosixForWebKit PRIVATE libSceNet libkernel_sys libSceLibcInternal)
 if(WIN32)
     target_link_libraries(libScePosixForWebKit PRIVATE ws2_32)
 endif()
@@ -17,6 +17,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_posix_filesystem PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libScePosixForWebKit>")
     endif()
+    add_test_executable(guest_posix_wrap_tests ${LIBS_INCLUDE_DIR}/tests/GuestPosixWrap.cpp)
+    target_include_directories(guest_posix_wrap_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_posix_wrap_tests PRIVATE libScePosixForWebKit libkernel_sys libSceLibcInternal libkernel libc)
+    configure_windows_unwind(guest_posix_wrap_tests)
+    add_test(NAME guest_posix_wrap COMMAND guest_posix_wrap_tests)
+    set_tests_properties(guest_posix_wrap PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_posix_wrap PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libScePosixForWebKit>")
+    endif()
     add_test_executable(guest_fnmatch_tests ${LIBS_INCLUDE_DIR}/tests/GuestFnmatch.cpp)
     target_include_directories(guest_fnmatch_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_fnmatch_tests PRIVATE libScePosixForWebKit libc)
@@ -45,4 +55,14 @@ if(BUILD_TESTING)
         set_tests_properties(guest_service_database PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libScePosixForWebKit>")
     endif()
+    add_test_executable(guest_posix_thread_name_tests ${LIBS_INCLUDE_DIR}/tests/GuestPosixThreadName.cpp)
+    target_include_directories(guest_posix_thread_name_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_posix_thread_name_tests PRIVATE libScePosixForWebKit libkernel libc)
+    configure_windows_unwind(guest_posix_thread_name_tests)
+    add_test(NAME guest_posix_thread_name COMMAND guest_posix_thread_name_tests)
+    set_tests_properties(guest_posix_thread_name PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_posix_thread_name PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libScePosixForWebKit>")
+    endif()
 endif()
diff --git a/core/libs/prx/libScePosixForWebKit/Export.cpp b/core/libs/prx/libScePosixForWebKit/Export.cpp
index c02c94fd7a..14675b52d3 100644
--- a/core/libs/prx/libScePosixForWebKit/Export.cpp
+++ b/core/libs/prx/libScePosixForWebKit/Export.cpp
@@ -1,24 +1,25 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/HostEntropy.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <cctype>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
+#include <mutex>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI clock_gettime_nid_postfix(int, KernelTimespec*);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-char* APS5_VABI getenv_nid_postfix(const char*);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-}
-
 namespace {
 
+constexpr int ThreadNameInvalid = 22;
+constexpr int ThreadNameTooLong = 63;
+constexpr std::size_t ThreadNameCapacity = 32;
+
 constexpr int FnmNomatch = 1;
 constexpr int FnmNoescape = 0x01;
 constexpr int FnmPathname = 0x02;
@@ -171,8 +172,8 @@ char* APS5_VABI strcasestr_nid_postfix(const char* text, const char* needle) {
         const char* candidate = text;
         const char* match = needle;
         while (*candidate != '\0' && *match != '\0' &&
-               std::tolower(static_cast<unsigned char>(*candidate)) ==
-               std::tolower(static_cast<unsigned char>(*match))) {
+               FoldCase(static_cast<unsigned char>(*candidate), FnmCasefold) ==
+               FoldCase(static_cast<unsigned char>(*match), FnmCasefold)) {
             ++candidate;
             ++match;
         }
@@ -188,6 +189,7 @@ void APS5_VABI arc4random_buf_nid_postfix(void* buffer, std::size_t size) {
 std::uint32_t APS5_VABI arc4random_nid_postfix() {
     std::uint32_t value;
     arc4random_buf_nid_postfix(&value, sizeof(value));
+
     return value;
 }
 
@@ -199,10 +201,6 @@ int APS5_VABI __wrap_clock_gettime(int clockId, KernelTimespec* tp) {
     return clock_gettime_nid_postfix(clockId, tp);
 }
 
-int APS5_VABI __wrap_fchown() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 char* APS5_VABI __wrap_getcwd(char* buffer, std::size_t size) {
     return getcwd_nid_postfix(buffer, size);
@@ -212,10 +210,6 @@ char* APS5_VABI __wrap_getenv(const char* name) {
     return getenv_nid_postfix(name);
 }
 
-int APS5_VABI __wrap_link() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 int APS5_VABI __wrap_lstat(const char* path, FileStat* sb) {
     return lstat_nid_postfix(path, sb);
@@ -225,20 +219,8 @@ void* APS5_VABI __wrap_mmap(void* address, std::size_t length, int protection, i
     return mmap_nid_postfix(address, length, protection, flags, descriptor, offset);
 }
 
-int APS5_VABI __wrap_readlink() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
-int APS5_VABI __wrap_statvfs() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
-int APS5_VABI __wrap_symlink() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 int APS5_VABI clock_gettime_np() {
     NotImplemented_nid_no_patch(__func__);
@@ -282,4 +264,12 @@ int APS5_VABI scePosixForWebKit_sysinfo() {
     return 0;
 }
 
+int APS5_VABI pthread_setname_np_nid_postfix(Pthread thread, const char* name) {
+    if (thread == nullptr || name == nullptr) return ThreadNameInvalid;
+    if (std::strlen(name) >= ThreadNameCapacity) return ThreadNameTooLong;
+    std::lock_guard lock(thread->nameLock);
+    thread->name = name;
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libScePosixForWebKit/Filesystem.cpp b/core/libs/prx/libScePosixForWebKit/Filesystem.cpp
index a7e6f01754..10dfa7eed6 100644
--- a/core/libs/prx/libScePosixForWebKit/Filesystem.cpp
+++ b/core/libs/prx/libScePosixForWebKit/Filesystem.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -14,11 +17,6 @@ extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handle
 #include <unistd.h>
 #endif
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI open_nid_postfix(const char*, int, int);
-}
-
 namespace {
 constexpr char Characters[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 
diff --git a/core/libs/prx/libScePosixForWebKit/Resolver.cpp b/core/libs/prx/libScePosixForWebKit/Resolver.cpp
index f9b8a2acc2..6b0007a4b9 100644
--- a/core/libs/prx/libScePosixForWebKit/Resolver.cpp
+++ b/core/libs/prx/libScePosixForWebKit/Resolver.cpp
@@ -1,3 +1,5 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -21,8 +23,6 @@
 #include <vector>
 #include "GuestResolver.hpp"
 
-extern "C" int* APS5_VABI sceNetErrnoLoc();
-
 namespace {
 struct HostLookup {
     GuestResolver::HostEntry entry{};
diff --git a/core/libs/prx/libScePosixForWebKit/Wrap.cpp b/core/libs/prx/libScePosixForWebKit/Wrap.cpp
new file mode 100644
index 0000000000..f57bf16f66
--- /dev/null
+++ b/core/libs/prx/libScePosixForWebKit/Wrap.cpp
@@ -0,0 +1,27 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
+
+extern "C" {
+
+int APS5_VABI __wrap_fchown(int descriptor, std::uint32_t owner, std::uint32_t group) {
+    return fchown_nid_postfix(descriptor, owner, group);
+}
+
+int APS5_VABI __wrap_link(const char* existing, const char* created) {
+    return link_nid_postfix(existing, created);
+}
+
+std::int64_t APS5_VABI __wrap_readlink(const char* path, char* buffer, std::size_t size) {
+    return readlink_nid_postfix(path, buffer, size);
+}
+
+int APS5_VABI __wrap_statvfs(const char* path, LibcStatvfs* status) {
+    return statvfs_nid_postfix(path, status);
+}
+
+int APS5_VABI __wrap_symlink(const char* target, const char* created) {
+    return symlink_nid_postfix(target, created);
+}
+
+}
diff --git a/core/libs/prx/libScePosixForWebKit/include/Api.hpp b/core/libs/prx/libScePosixForWebKit/include/Api.hpp
new file mode 100644
index 0000000000..96834f0ad7
--- /dev/null
+++ b/core/libs/prx/libScePosixForWebKit/include/Api.hpp
@@ -0,0 +1,42 @@
+#pragma once
+
+#include "prx/libScePosixForWebKit/GuestResolver.hpp"
+#include "prx/libSceLibcInternal/include/Statvfs.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI fnmatch_nid_postfix(const char* pattern, const char* string, int flags);
+char* APS5_VABI strcasestr_nid_postfix(const char* text, const char* needle);
+void APS5_VABI arc4random_buf_nid_postfix(void* buffer, std::size_t size);
+std::uint32_t APS5_VABI arc4random_nid_postfix();
+int APS5_VABI __wrap_access(const char* path, int mode);
+int APS5_VABI __wrap_clock_gettime(int clockId, KernelTimespec* tp);
+int APS5_VABI __wrap_fchown(int descriptor, std::uint32_t owner, std::uint32_t group);
+char* APS5_VABI __wrap_getcwd(char* buffer, std::size_t size);
+char* APS5_VABI __wrap_getenv(const char* name);
+int APS5_VABI __wrap_link(const char* existing, const char* created);
+int APS5_VABI __wrap_lstat(const char* path, FileStat* sb);
+void* APS5_VABI __wrap_mmap(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset);
+std::int64_t APS5_VABI __wrap_readlink(const char* path, char* buffer, std::size_t size);
+int APS5_VABI __wrap_statvfs(const char* path, LibcStatvfs* status);
+int APS5_VABI __wrap_symlink(const char* target, const char* created);
+int APS5_VABI clock_gettime_np();
+int APS5_VABI getenv_np();
+int APS5_VABI scePosixForWebKit_gethostbyname_r();
+int APS5_VABI pthread_setname_np_nid_postfix(Pthread thread, const char* name);
+int APS5_VABI mmap_np();
+int APS5_VABI msetname();
+int APS5_VABI pthread_setschedparam_np();
+int APS5_VABI setenv_np();
+int APS5_VABI scePosixForWebKit_sysinfo();
+int APS5_VABI mkstemp_nid_postfix(char* pattern);
+int APS5_VABI isatty_nid_postfix(int descriptor);
+GuestResolver::HostEntry* APS5_VABI gethostbyname_nid_postfix(const char* name);
+GuestResolver::ServiceEntry* APS5_VABI getservbyname_nid_postfix(const char* name, const char* protocol);
+void APS5_VABI freeaddrinfo_nid_postfix(GuestResolver::AddressInfo* first);
+int APS5_VABI getaddrinfo_nid_postfix(const char* node, const char* service, const GuestResolver::AddressInfo* hints, GuestResolver::AddressInfo** output);
+int APS5_VABI getnameinfo_nid_postfix(const void* address, std::uint32_t length, char* host, std::uint32_t hostLength, char* service, std::uint32_t serviceLength, int flags);
+const char* APS5_VABI gai_strerror_nid_postfix(int error);
+
+}
diff --git a/core/libs/prx/libScePosixForWebKit/libScePosixForWebKit.hpp b/core/libs/prx/libScePosixForWebKit/libScePosixForWebKit.hpp
new file mode 100644
index 0000000000..0f4456a5e2
--- /dev/null
+++ b/core/libs/prx/libScePosixForWebKit/libScePosixForWebKit.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePosixForWebKit/include/Api.hpp"
diff --git a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp
index d1c11f4133..45c16b6916 100644
--- a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp
+++ b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp"
 #include <mutex>
 #include <stdexcept>
 #include <string>
diff --git a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp
new file mode 100644
index 0000000000..991a8ea2d2
--- /dev/null
+++ b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceProprietaryVoiceChatHelperInitialize(void);
+int APS5_VABI sceProprietaryVoiceChatHelperTerminate(void);
+int APS5_VABI sceProprietaryVoiceChatHelperSetVoiceChatState(void);
+int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChatUsageState(void);
+int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChat(void);
+
+}
diff --git a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/libSceProprietaryVoiceChatHelperPrx.hpp b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/libSceProprietaryVoiceChatHelperPrx.hpp
new file mode 100644
index 0000000000..9302848829
--- /dev/null
+++ b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/libSceProprietaryVoiceChatHelperPrx.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp"
diff --git a/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp b/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp
index 99db1f489a..a27fb265fc 100644
--- a/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp
+++ b/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePs2EmuMenuDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePs2EmuMenuDialog/include/Api.hpp b/core/libs/prx/libScePs2EmuMenuDialog/include/Api.hpp
new file mode 100644
index 0000000000..de66779d90
--- /dev/null
+++ b/core/libs/prx/libScePs2EmuMenuDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePs2EmuMenuDialogClose();
+int APS5_VABI scePs2EmuMenuDialogGetResult();
+int APS5_VABI scePs2EmuMenuDialogGetStatus();
+int APS5_VABI scePs2EmuMenuDialogInitialize();
+int APS5_VABI scePs2EmuMenuDialogOpen();
+int APS5_VABI scePs2EmuMenuDialogTerminate();
+int APS5_VABI scePs2EmuMenuDialogUpdateStatus();
+
+}
diff --git a/core/libs/prx/libScePs2EmuMenuDialog/libScePs2EmuMenuDialog.hpp b/core/libs/prx/libScePs2EmuMenuDialog/libScePs2EmuMenuDialog.hpp
new file mode 100644
index 0000000000..f09948b438
--- /dev/null
+++ b/core/libs/prx/libScePs2EmuMenuDialog/libScePs2EmuMenuDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePs2EmuMenuDialog/include/Api.hpp"
diff --git a/core/libs/prx/libScePsm/libScePsm.hpp b/core/libs/prx/libScePsm/libScePsm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePsm/libScePsm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePsmUtil/Export.cpp b/core/libs/prx/libScePsmUtil/Export.cpp
index 0a7d7939be..422f3863b3 100644
--- a/core/libs/prx/libScePsmUtil/Export.cpp
+++ b/core/libs/prx/libScePsmUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePsmUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePsmUtil/include/Api.hpp b/core/libs/prx/libScePsmUtil/include/Api.hpp
new file mode 100644
index 0000000000..15c45087d9
--- /dev/null
+++ b/core/libs/prx/libScePsmUtil/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePsmUtilFinalize();
+int APS5_VABI scePsmUtilGetPsmIniFile();
+int APS5_VABI scePsmUtilInitialize();
+int APS5_VABI scePsmUtilRegisterCallbacks();
+
+}
diff --git a/core/libs/prx/libScePsmUtil/libScePsmUtil.hpp b/core/libs/prx/libScePsmUtil/libScePsmUtil.hpp
new file mode 100644
index 0000000000..5c21b12f80
--- /dev/null
+++ b/core/libs/prx/libScePsmUtil/libScePsmUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePsmUtil/include/Api.hpp"
diff --git a/core/libs/prx/libScePsml/libScePsml.hpp b/core/libs/prx/libScePsml/libScePsml.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePsml/libScePsml.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePsml_debug/Export.cpp b/core/libs/prx/libScePsml_debug/Export.cpp
index 44021762c2..02677de85c 100644
--- a/core/libs/prx/libScePsml_debug/Export.cpp
+++ b/core/libs/prx/libScePsml_debug/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libScePsml_debug/include/Api.hpp"
+#include "prx/libkernel/libkernel.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <atomic>
@@ -16,89 +18,19 @@ namespace {
 constexpr std::int32_t SCE_PSML_ERROR_NOT_INITIALIZED = static_cast<std::int32_t>(0x8A810001);
 constexpr std::int32_t SCE_PSML_ERROR_INVALID_ARGUMENT = static_cast<std::int32_t>(0x8A810005);
 constexpr std::int32_t SCE_PSML_ERROR_NULL_OUTPUT = static_cast<std::int32_t>(0x8A810009);
+constexpr std::int32_t Mfsr2ErrorNotInitialized = static_cast<std::int32_t>(0x8A8A0001);
+constexpr std::int32_t Mfsr2ErrorUnsupportedConsole = static_cast<std::int32_t>(0x8A8A0012);
 constexpr std::uint64_t MfsrBlockBytes = 0x200000;
 constexpr std::uint64_t MfsrBlockCount = 4;
 constexpr std::uint32_t MfsrDispatchPacketDwords = 0x600;
 constexpr std::uint64_t MfsrSharedBlockCount = 52;
 
-struct MfsrRequirement {
- std::uint64_t blockBytes;
- std::uint64_t alignment;
- std::uint64_t blockCount;
-};
-
-struct MfsrBlock {
- std::uint64_t address;
- std::uint64_t bytes;
-};
-
-struct MfsrSharedResourcesParam {
- std::uint32_t type;
- std::uint32_t reserved;
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint64_t reserved2;
-};
-
-struct Mfsr2SharedResourcesParam {
- std::uint32_t type;
- std::uint32_t reserved0;
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint16_t width;
- std::uint16_t height;
- std::uint32_t reserved1;
-};
-
 static_assert(sizeof(Mfsr2SharedResourcesParam) == 32);
 static_assert(offsetof(Mfsr2SharedResourcesParam, blocks) == 8);
 static_assert(offsetof(Mfsr2SharedResourcesParam, blockCount) == 16);
 static_assert(offsetof(Mfsr2SharedResourcesParam, width) == 24);
 static_assert(offsetof(Mfsr2SharedResourcesParam, reserved1) == 28);
 
-struct Mfsr2ContextParam {
- std::uint32_t profile;
- std::uint32_t reserved0;
- void* sharedResources;
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint64_t reserved1;
- std::uint16_t outputWidth;
- std::uint16_t outputHeight;
- std::uint32_t inputColorSpace;
-};
-
-struct MfsrCommandBuffer {
- std::uint32_t* cursor;
- std::uint32_t sizeInDwords;
-};
-
-struct MfsrTextureDescriptor {
- std::uint32_t words[8];
-};
-
-struct Mfsr2DispatchParam {
- const MfsrTextureDescriptor* outputColor;
- const MfsrTextureDescriptor* color;
- const MfsrTextureDescriptor* motionVectors;
- const MfsrTextureDescriptor* depth;
- const MfsrTextureDescriptor* exposure;
- std::uint64_t reserved0;
- float preExposure;
- std::uint32_t renderX;
- std::uint32_t renderY;
- std::uint32_t renderWidth;
- std::uint32_t renderHeight;
- float jitter[2];
- float motionVectorScale[2];
- float motionVectorOffset[2];
- float depthRange[2];
- std::uint8_t resetHistory;
- std::uint8_t reserved1[3];
- std::uint32_t optionFlags;
- float sharpness;
-};
-
 static_assert(sizeof(Mfsr2ContextParam) == 48);
 static_assert(offsetof(Mfsr2ContextParam, sharedResources) == 8);
 static_assert(offsetof(Mfsr2ContextParam, blocks) == 16);
@@ -117,19 +49,6 @@ static_assert(offsetof(Mfsr2DispatchParam, resetHistory) == 100);
 static_assert(offsetof(Mfsr2DispatchParam, optionFlags) == 104);
 static_assert(offsetof(Mfsr2DispatchParam, sharpness) == 108);
 
-struct MfsrContextParam {
- std::uint32_t reserved0[2];
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint16_t inputWidth;
- std::uint16_t inputHeight;
- std::uint32_t reserved1;
- const void* descriptor0;
- const void* descriptor1;
- std::uint32_t reserved2[2];
- void* sharedResources;
-};
-
 static_assert(sizeof(MfsrRequirement) == 0x18);
 static_assert(sizeof(MfsrSharedResourcesParam) == 0x20);
 static_assert(offsetof(MfsrContextParam, blocks) == 0x08);
@@ -352,49 +271,57 @@ std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket900(void* context, void*
  return SCE_PSML_ERROR_NOT_INITIALIZED;
 }
 
-int APS5_VABI scePsmlMfsr2ReleaseSharedResources(void* sharedResources) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2ReleaseSharedResources(void* sharedResources) {
+ (void)sharedResources;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2GetSharedResourcesInitRequirement(MfsrRequirement* requirement, const Mfsr2SharedResourcesParam* param) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2GetSharedResourcesInitRequirement(MfsrRequirement* requirement, const Mfsr2SharedResourcesParam* param) {
+ (void)requirement;
+ (void)param;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2GetContextInitRequirement(MfsrRequirement* requirement, const Mfsr2ContextParam* param) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2GetContextInitRequirement(MfsrRequirement* requirement, const Mfsr2ContextParam* param) {
+ (void)requirement;
+ (void)param;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2ReleaseContext(void* context) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2ReleaseContext(void* context) {
+ (void)context;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2GetDispatchPacketsSizeInDwords() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2GetDispatchPacketsSizeInDwords(void* context, std::uint32_t* packetSizeInDwords) {
+ (void)context;
+ (void)packetSizeInDwords;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2CreateSharedResources(void** sharedResources, const Mfsr2SharedResourcesParam* param) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2CreateSharedResources(void** sharedResources, const Mfsr2SharedResourcesParam* param) {
+ (void)sharedResources;
+ (void)param;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2GetDispatchPackets(void* context, const MfsrCommandBuffer* commandBuffer, const Mfsr2DispatchParam* param) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2GetDispatchPackets(void* context, const MfsrCommandBuffer* commandBuffer, const Mfsr2DispatchParam* param) {
+ (void)context;
+ (void)commandBuffer;
+ (void)param;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2CreateContext(void** context, const Mfsr2ContextParam* param) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2CreateContext(void** context, const Mfsr2ContextParam* param) {
+ (void)context;
+ (void)param;
+ return Mfsr2ErrorNotInitialized;
 }
 
-int APS5_VABI scePsmlMfsr2Init() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI scePsmlMfsr2Init() {
+ if (sceKernelIsTrinityMode() == 0) return Mfsr2ErrorUnsupportedConsole;
+ NotImplemented_nid_no_patch(__func__);
+ return 0;
 }
 
 int APS5_VABI scePsmlMfsrEnableSpecularAA() {
diff --git a/core/libs/prx/libScePsml_debug/include/Api.hpp b/core/libs/prx/libScePsml_debug/include/Api.hpp
new file mode 100644
index 0000000000..4a79a346d5
--- /dev/null
+++ b/core/libs/prx/libScePsml_debug/include/Api.hpp
@@ -0,0 +1,133 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <atomic>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <utility>
+
+struct MfsrRequirement {
+ std::uint64_t blockBytes;
+ std::uint64_t alignment;
+ std::uint64_t blockCount;
+};
+
+struct MfsrBlock {
+ std::uint64_t address;
+ std::uint64_t bytes;
+};
+
+struct MfsrSharedResourcesParam {
+ std::uint32_t type;
+ std::uint32_t reserved;
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint64_t reserved2;
+};
+
+struct Mfsr2SharedResourcesParam {
+ std::uint32_t type;
+ std::uint32_t reserved0;
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint16_t width;
+ std::uint16_t height;
+ std::uint32_t reserved1;
+};
+
+struct Mfsr2ContextParam {
+ std::uint32_t profile;
+ std::uint32_t reserved0;
+ void* sharedResources;
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint64_t reserved1;
+ std::uint16_t outputWidth;
+ std::uint16_t outputHeight;
+ std::uint32_t inputColorSpace;
+};
+
+struct MfsrCommandBuffer {
+ std::uint32_t* cursor;
+ std::uint32_t sizeInDwords;
+};
+
+struct MfsrTextureDescriptor {
+ std::uint32_t words[8];
+};
+
+struct Mfsr2DispatchParam {
+ const MfsrTextureDescriptor* outputColor;
+ const MfsrTextureDescriptor* color;
+ const MfsrTextureDescriptor* motionVectors;
+ const MfsrTextureDescriptor* depth;
+ const MfsrTextureDescriptor* exposure;
+ std::uint64_t reserved0;
+ float preExposure;
+ std::uint32_t renderX;
+ std::uint32_t renderY;
+ std::uint32_t renderWidth;
+ std::uint32_t renderHeight;
+ float jitter[2];
+ float motionVectorScale[2];
+ float motionVectorOffset[2];
+ float depthRange[2];
+ std::uint8_t resetHistory;
+ std::uint8_t reserved1[3];
+ std::uint32_t optionFlags;
+ float sharpness;
+};
+
+struct MfsrContextParam {
+ std::uint32_t reserved0[2];
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint16_t inputWidth;
+ std::uint16_t inputHeight;
+ std::uint32_t reserved1;
+ const void* descriptor0;
+ const void* descriptor1;
+ std::uint32_t reserved2[2];
+ void* sharedResources;
+};
+
+extern "C" {
+
+std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement1100(void* requirement, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrCreateContext1100(void** context, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1100(void* context, void* commandBuffer, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrInit();
+std::int32_t APS5_VABI scePsmlMfsrGetSharedResourcesInitRequirement(MfsrRequirement* requirement, const MfsrSharedResourcesParam* param);
+std::int32_t APS5_VABI scePsmlMfsrCreateSharedResources(void** sharedResources, const MfsrSharedResourcesParam* param);
+std::int32_t APS5_VABI scePsmlMfsrReleaseSharedResources(void* sharedResources);
+std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement800M3_2(MfsrRequirement* requirement, const MfsrContextParam* param);
+std::int32_t APS5_VABI scePsmlMfsrCreateContext800M3_2(void** context, const MfsrContextParam* param);
+std::int32_t APS5_VABI scePsmlMfsrReleaseContext(void* context);
+std::int32_t APS5_VABI scePsmlMfsrCreateContext1300(void** context, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1300(void* context, void* commandBuffer, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacketSizeInDwords(void* context, std::uint32_t* packetSizeInDwords);
+std::int32_t APS5_VABI scePsmlMfsrSelectConfig(void* config);
+std::int32_t APS5_VABI scePsmlMfsrGetMipmapBias(void* context, float* bias, std::uint32_t dimension);
+std::int32_t APS5_VABI scePsmlMfsrRequestCapture(void* context);
+std::int32_t APS5_VABI scePsmlMfsrIsCaptureInProgress(void* context);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1000(void* context, void* commandBuffer, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket900(void* context, void* commandBuffer, const void* param);
+std::int32_t APS5_VABI scePsmlMfsr2ReleaseSharedResources(void* sharedResources);
+std::int32_t APS5_VABI scePsmlMfsr2GetSharedResourcesInitRequirement(MfsrRequirement* requirement, const Mfsr2SharedResourcesParam* param);
+std::int32_t APS5_VABI scePsmlMfsr2GetContextInitRequirement(MfsrRequirement* requirement, const Mfsr2ContextParam* param);
+std::int32_t APS5_VABI scePsmlMfsr2ReleaseContext(void* context);
+std::int32_t APS5_VABI scePsmlMfsr2GetDispatchPacketsSizeInDwords(void* context, std::uint32_t* packetSizeInDwords);
+std::int32_t APS5_VABI scePsmlMfsr2CreateSharedResources(void** sharedResources, const Mfsr2SharedResourcesParam* param);
+std::int32_t APS5_VABI scePsmlMfsr2GetDispatchPackets(void* context, const MfsrCommandBuffer* commandBuffer, const Mfsr2DispatchParam* param);
+std::int32_t APS5_VABI scePsmlMfsr2CreateContext(void** context, const Mfsr2ContextParam* param);
+std::int32_t APS5_VABI scePsmlMfsr2Init();
+int APS5_VABI scePsmlMfsrEnableSpecularAA();
+int APS5_VABI scePsmlMfsrEnableQuality8K();
+
+}
diff --git a/core/libs/prx/libScePsml_debug/libScePsml_debug.hpp b/core/libs/prx/libScePsml_debug/libScePsml_debug.hpp
new file mode 100644
index 0000000000..fc5eb2ba99
--- /dev/null
+++ b/core/libs/prx/libScePsml_debug/libScePsml_debug.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePsml_debug/include/Api.hpp"
diff --git a/core/libs/prx/libSceRandom/Export.cpp b/core/libs/prx/libSceRandom/Export.cpp
index c61ffc4d53..2fcda9cfb5 100644
--- a/core/libs/prx/libSceRandom/Export.cpp
+++ b/core/libs/prx/libSceRandom/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRandom/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceRandom/include/Api.hpp b/core/libs/prx/libSceRandom/include/Api.hpp
new file mode 100644
index 0000000000..ac26ff0d3b
--- /dev/null
+++ b/core/libs/prx/libSceRandom/include/Api.hpp
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRandomGetRandomNumber(void* buf, size_t size);
+
+}
diff --git a/core/libs/prx/libSceRandom/libSceRandom.hpp b/core/libs/prx/libSceRandom/libSceRandom.hpp
new file mode 100644
index 0000000000..1697eb1bee
--- /dev/null
+++ b/core/libs/prx/libSceRandom/libSceRandom.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRandom/include/Api.hpp"
diff --git a/core/libs/prx/libSceRazorCpu/Export.cpp b/core/libs/prx/libSceRazorCpu/Export.cpp
index defd9d798b..5c8e4f8df9 100644
--- a/core/libs/prx/libSceRazorCpu/Export.cpp
+++ b/core/libs/prx/libSceRazorCpu/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRazorCpu/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceRazorCpu/include/Api.hpp b/core/libs/prx/libSceRazorCpu/include/Api.hpp
new file mode 100644
index 0000000000..1e6b94daff
--- /dev/null
+++ b/core/libs/prx/libSceRazorCpu/include/Api.hpp
@@ -0,0 +1,43 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceRazorCpuIsCapturing(void);
+int APS5_VABI sceRazorCpuJobManagerDispatch(const char* label, uint16_t firstId, uint16_t secondId, uint16_t firstCount, uint16_t secondCount, uint64_t firstValue, uint64_t secondValue);
+int APS5_VABI sceRazorCpuJobManagerJob(uint16_t firstId, uint16_t secondId, uint16_t thirdId, uint16_t event);
+int APS5_VABI sceRazorCpuJobManagerSequence(const char* label, uint16_t firstId, uint16_t secondId, uint16_t event);
+int APS5_VABI sceRazorCpuPushMarker(const char* label, uint32_t color, uint32_t flags);
+int APS5_VABI sceRazorCpuNamedSync(const char* label);
+int APS5_VABI sceRazorCpuPushMarkerStatic(const char* name, uint32_t color, uint32_t flags);
+int APS5_VABI sceRazorCpuPopMarker(void);
+bool APS5_VABI sceRazorCpuFlushOccurred(uint64_t* timeSpentInFlush);
+int APS5_VABI sceRazorCpuPlotValue(const char* series, float value);
+int APS5_VABI sceRazorCpuWriteBookmark(const char* label, const char* description);
+int APS5_VABI sceRazorCpuSync(void);
+void APS5_VABI sceRazorCpuDisableFiberUserMarkers(void);
+int APS5_VABI sceRazorCpuInitDataTags(void* buffer, size_t size);
+int APS5_VABI sceRazorCpuShutdownDataTags(void);
+size_t APS5_VABI sceRazorCpuGetDataTagStorageSize(uint32_t tagCount);
+int APS5_VABI sceRazorCpuTagArray(const char* label, uint32_t category, void* array, size_t bufferSize, size_t elementSize);
+int APS5_VABI sceRazorCpuTagBuffer(const char* label, uint32_t category, void* buffer, size_t bufferSize);
+int APS5_VABI sceRazorCpuResizeTaggedBuffer(uint32_t category, void* buffer, size_t newBufferSize);
+int APS5_VABI sceRazorCpuUnTagBuffer(uint32_t category, void* buffer);
+int APS5_VABI sceRazorCpuBeginLogicalFileAccess(const char* filename, uint64_t tag, uint64_t size, uint8_t operation);
+int APS5_VABI sceRazorCpuEndLogicalFileAccess(void);
+int APS5_VABI sceRazorCpuFiberLogNameChange(void);
+int APS5_VABI sceRazorCpuFiberSwitch(void);
+int APS5_VABI sceRazorCpuGpuMarkerSync(void);
+int APS5_VABI sceRazorCpuInitializeGpuMarkerContext(void);
+int APS5_VABI sceRazorCpuInitializeInternal(void);
+int APS5_VABI sceRazorCpuSetPopMarkerCallback(void);
+int APS5_VABI sceRazorCpuSetPushMarkerCallback(void);
+int APS5_VABI sceRazorCpuSetPushMarkerStaticCallback(void);
+int APS5_VABI sceRazorCpuStartCaptureInternal(void);
+int APS5_VABI sceRazorCpuStopCaptureInternal(void);
+int APS5_VABI sceRazorCpuWorkloadRunBegin(void);
+int APS5_VABI sceRazorCpuWorkloadRunEnd(void);
+int APS5_VABI sceRazorCpuWorkloadSubmit(void);
+
+}
diff --git a/core/libs/prx/libSceRazorCpu/libSceRazorCpu.hpp b/core/libs/prx/libSceRazorCpu/libSceRazorCpu.hpp
new file mode 100644
index 0000000000..a734b0b85a
--- /dev/null
+++ b/core/libs/prx/libSceRazorCpu/libSceRazorCpu.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRazorCpu/include/Api.hpp"
diff --git a/core/libs/prx/libSceRazorCpu_debug/libSceRazorCpu_debug.hpp b/core/libs/prx/libSceRazorCpu_debug/libSceRazorCpu_debug.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceRazorCpu_debug/libSceRazorCpu_debug.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRegMgr/Export.cpp b/core/libs/prx/libSceRegMgr/Export.cpp
index 9d71463de6..84326f6c25 100644
--- a/core/libs/prx/libSceRegMgr/Export.cpp
+++ b/core/libs/prx/libSceRegMgr/Export.cpp
@@ -1,21 +1,93 @@
+#include "prx/libSceRegMgr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
+#include <mutex>
+#include <string>
+#include <unordered_map>
+#include <vector>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int SCE_REG_MGR_ERROR_INVALID_PARAM = static_cast<int>(0x80820001);
+constexpr int SCE_REG_MGR_ERROR_NOT_FOUND = static_cast<int>(0x80820002);
+constexpr int SCE_REG_MGR_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80820004);
+constexpr int SCE_REG_MGR_ERROR_INVALID_TYPE = static_cast<int>(0x80820006);
+
+enum EntryType {
+    TypeInt = 0,
+    TypeStr = 1,
+    TypeBin = 2,
+};
+
+struct RegEntry {
+    EntryType type;
+    int32_t intVal = 0;
+    std::string strVal;
+    std::vector<uint8_t> binVal;
+};
+
+class RegistryStore {
+public:
+    RegistryStore() = default;
+
+    int getInt(int64_t key, int32_t* out) {
+        if (out == nullptr) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        std::lock_guard<std::mutex> lock(mutex_);
+        auto it = entries_.find(key);
+        if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
+        if (it->second.type != TypeInt) return SCE_REG_MGR_ERROR_INVALID_TYPE;
+        *out = it->second.intVal;
+        return 0;
+    }
+
+    int getStr(int64_t key, char* out, int len) {
+        if (len == 0) NotImplemented_nid_no_patch(__func__);
+        if (out == nullptr || len < 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        std::lock_guard<std::mutex> lock(mutex_);
+        auto it = entries_.find(key);
+        if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
+        if (it->second.type != TypeStr) return SCE_REG_MGR_ERROR_INVALID_TYPE;
+        if (static_cast<size_t>(len) <= it->second.strVal.size()) return SCE_REG_MGR_ERROR_BUFFER_TOO_SMALL;
+        std::memcpy(out, it->second.strVal.c_str(), it->second.strVal.size() + 1);
+        return 0;
+    }
+
+    int getBin(int64_t key, void* out, int size) {
+        if (size == 0) NotImplemented_nid_no_patch(__func__);
+        if (out == nullptr || size < 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        std::lock_guard<std::mutex> lock(mutex_);
+        auto it = entries_.find(key);
+        if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
+        if (it->second.type != TypeBin) return SCE_REG_MGR_ERROR_INVALID_TYPE;
+        if (static_cast<size_t>(size) < it->second.binVal.size()) return SCE_REG_MGR_ERROR_BUFFER_TOO_SMALL;
+        std::memcpy(out, it->second.binVal.data(), it->second.binVal.size());
+        return 0;
+    }
+
+private:
+    std::mutex mutex_;
+    std::unordered_map<int64_t, RegEntry> entries_;
+};
+
+RegistryStore gStore;
+
+} // namespace
+
 extern "C" {
 
-int APS5_VABI sceRegMgrGetBin(std::uint32_t optionId, void* data, std::size_t size) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceRegMgrGetBin(std::int64_t optionId, void* data, int size) {
+    return gStore.getBin(optionId, data, size);
 }
-int APS5_VABI sceRegMgrGetInt(int32_t optionId, int32_t* outInt) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+int APS5_VABI sceRegMgrGetInt(std::int64_t optionId, int32_t* outInt) {
+    return gStore.getInt(optionId, outInt);
 }
-int APS5_VABI sceRegMgrGetStr(int32_t optionId, char* outString, std::size_t stringLength) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+int APS5_VABI sceRegMgrGetStr(std::int64_t optionId, char* outString, int stringLength) {
+    return gStore.getStr(optionId, outString, stringLength);
 }
 int APS5_VABI sceRegMgrSetBin(std::uint32_t optionId, const void* data, std::size_t size) {
     NotImplemented_nid_no_patch(__func__);
diff --git a/core/libs/prx/libSceRegMgr/include/Api.hpp b/core/libs/prx/libSceRegMgr/include/Api.hpp
new file mode 100644
index 0000000000..8d062d5377
--- /dev/null
+++ b/core/libs/prx/libSceRegMgr/include/Api.hpp
@@ -0,0 +1,75 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRegMgrGetBin(std::int64_t optionId, void* data, int size);
+int APS5_VABI sceRegMgrGetInt(std::int64_t optionId, int32_t* outInt);
+int APS5_VABI sceRegMgrGetStr(std::int64_t optionId, char* outString, int stringLength);
+int APS5_VABI sceRegMgrSetBin(std::uint32_t optionId, const void* data, std::size_t size);
+int APS5_VABI sceRegMgrSetInt(int32_t optionId, int32_t inInt);
+int APS5_VABI sceRegMgrSetStr(int32_t optionId, const char* inStirng, std::size_t stringLength);
+std::int32_t APS5_VABI sceRegMgrNonSysGetInt(std::int64_t key, std::int32_t unk, std::int32_t* data);
+int APS5_VABI sceRegMgrCheckError(void);
+int APS5_VABI sceRegMgrCheckIntVal(void);
+int APS5_VABI sceRegMgrGetBinInitVal(void);
+int APS5_VABI sceRegMgrGetIntInitVal(void);
+int APS5_VABI sceRegMgrGetStrInitVal(void);
+int APS5_VABI sceRegMgrGetVersion(void);
+int APS5_VABI sceRegMgrIsChange(void);
+int APS5_VABI sceRegMgrEvtGetCnt(void);
+int APS5_VABI sceRegMgrEvtGetRegId(void);
+int APS5_VABI sceRegMgrResetVal(void);
+int APS5_VABI sceRegMgrSetInitLevel(void);
+int APS5_VABI sceRegMgrSrvCnvRegionInt(void);
+int APS5_VABI sceRegMgrSrvCnvRegionStr(void);
+int APS5_VABI sceRegMgrSrvGetMachineType(void);
+int APS5_VABI sceRegMgrSrvGetQAFforReg(void);
+int APS5_VABI sceRegMgrSrvGetRealMachineType(void);
+int APS5_VABI sceRegMgrSrvGetRegion(void);
+int APS5_VABI sceRegMgrSrvGetRegionStr(void);
+int APS5_VABI sceRegMgrBackupNeedMem(void);
+int APS5_VABI sceRegMgrBackupPullData(void);
+int APS5_VABI sceRegMgrBackupPushData(void);
+int APS5_VABI sceRegMgrBackupPullDataGkp(void);
+int APS5_VABI sceRegMgrBackupPushDataGkp(void);
+int APS5_VABI sceRegMgrCntlStart(void);
+int APS5_VABI sceRegMgrCntlDeleteReg(void);
+int APS5_VABI sceRegMgrCntlGetFilesCount(void);
+int APS5_VABI sceRegMgrCntlGetFileName(void);
+int APS5_VABI sceRegMgrCntSetInitReinst(void);
+int APS5_VABI sceRegMgrIsInitOK(void);
+int APS5_VABI sceRegMgrGetInitError(void);
+int APS5_VABI sceRegMgrRecoverRegNvs(void);
+int APS5_VABI sceRegMgrNonSysCheckError(void);
+int APS5_VABI sceRegMgrNonSysGetBin(void);
+int APS5_VABI sceRegMgrNonSysGetStr(void);
+int APS5_VABI sceRegMgrNonSysSetBin(void);
+int APS5_VABI sceRegMgrNonSysSetInt(void);
+int APS5_VABI sceRegMgrNonSysSetStr(void);
+int APS5_VABI sceRegMgrGetVersionForPS4(void);
+int APS5_VABI sceRegMgrBackupNeedMemForPS4(void);
+int APS5_VABI sceRegMgrBackupPullDataForPS4(void);
+int APS5_VABI sceRegMgrBackupPushDataForPS4(void);
+int APS5_VABI sceRegMgrEvtGetCntForPS4(void);
+int APS5_VABI sceRegMgrEvtGetRegIdForPS4(void);
+int APS5_VABI sceRegMgrStrncpy(void);
+int APS5_VABI sceRegMgrMemset(void);
+int APS5_VABI sceRegMgrSetbin(void);
+int APS5_VABI sceRegMgrToolGetUpdateCnt(void);
+int APS5_VABI sceRegMgrToolGetEntryCnt(void);
+int APS5_VABI sceRegMgrToolDataCheckGet(void);
+int APS5_VABI sceRegMgrDrvGetUpdateCnt(void);
+int APS5_VABI sceRegMgrDrvGetEntCnt(void);
+int APS5_VABI sceRegMgrDrvDataOpen(void);
+int APS5_VABI sceRegMgrDrvDataCheckGet(void);
+int APS5_VABI sceRegMgrDrvDataClose(void);
+int APS5_VABI sceRegMgrToolGetInfo(void);
+int APS5_VABI sceRegMgrLogPull(void);
+int APS5_VABI sceRegMgrCntlStopHdd(void);
+int APS5_VABI sceRegMgrPrintInfo(void);
+
+}
diff --git a/core/libs/prx/libSceRegMgr/libSceRegMgr.hpp b/core/libs/prx/libSceRegMgr/libSceRegMgr.hpp
new file mode 100644
index 0000000000..28b2427f86
--- /dev/null
+++ b/core/libs/prx/libSceRegMgr/libSceRegMgr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRegMgr/include/Api.hpp"
diff --git a/core/libs/prx/libSceRemotePlayClientIpc/libSceRemotePlayClientIpc.hpp b/core/libs/prx/libSceRemotePlayClientIpc/libSceRemotePlayClientIpc.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceRemotePlayClientIpc/libSceRemotePlayClientIpc.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRemoteplay/Export.cpp b/core/libs/prx/libSceRemoteplay/Export.cpp
index bc653c840f..c398ec2033 100644
--- a/core/libs/prx/libSceRemoteplay/Export.cpp
+++ b/core/libs/prx/libSceRemoteplay/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRemoteplay/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <stdexcept>
diff --git a/core/libs/prx/libSceRemoteplay/include/Api.hpp b/core/libs/prx/libSceRemoteplay/include/Api.hpp
new file mode 100644
index 0000000000..a36c070176
--- /dev/null
+++ b/core/libs/prx/libSceRemoteplay/include/Api.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRemoteplayGetConnectionStatus(int userId, int* status);
+int APS5_VABI sceRemoteplayInitialize(void* heap, size_t heapSize);
+int APS5_VABI sceRemoteplayTerminate(void);
+int APS5_VABI sceRemoteplayApprove(void);
+int APS5_VABI sceRemoteplayClearAllRegistData(void);
+int APS5_VABI sceRemoteplayClearConnectHistory(void);
+int APS5_VABI sceRemoteplayConfirmDeviceRegist(void);
+int APS5_VABI sceRemoteplayDisconnect(void);
+int APS5_VABI sceRemoteplayGeneratePinCode(void);
+int APS5_VABI sceRemoteplayGetApMode(void);
+int APS5_VABI sceRemoteplayGetConnectHistory(void);
+int APS5_VABI sceRemoteplayGetConnectUserId(void);
+int APS5_VABI sceRemoteplayGetMbusDeviceInfo(void);
+int APS5_VABI sceRemoteplayGetOperationStatus(void);
+int APS5_VABI sceRemoteplayGetPrimaryUserId(void);
+int APS5_VABI sceRemoteplayGetRemoteplayStatus(void);
+int APS5_VABI sceRemoteplayGetRpMode(void);
+int APS5_VABI sceRemoteplayImeClose(void);
+int APS5_VABI sceRemoteplayImeFilterResult(void);
+int APS5_VABI sceRemoteplayImeGetEvent(void);
+int APS5_VABI sceRemoteplayImeNotify(void);
+int APS5_VABI sceRemoteplayImeNotifyEventResult(void);
+int APS5_VABI sceRemoteplayImeOpen(void);
+int APS5_VABI sceRemoteplayImeSetCaret(void);
+int APS5_VABI sceRemoteplayImeSetText(void);
+int APS5_VABI sceRemoteplayIsRemoteOskReady(void);
+int APS5_VABI sceRemoteplayIsRemotePlaying(void);
+int APS5_VABI sceRemoteplayNotifyMbusDeviceRegistComplete(void);
+int APS5_VABI sceRemoteplayNotifyNpPushWakeup(void);
+int APS5_VABI sceRemoteplayNotifyPinCodeError(void);
+int APS5_VABI sceRemoteplayNotifySubmitCode(void);
+int APS5_VABI sceRemoteplayNotifyUserDelete(void);
+int APS5_VABI sceRemoteplayPrintAllRegistData(void);
+int APS5_VABI sceRemoteplayProhibit(void);
+int APS5_VABI sceRemoteplayProhibitStreaming(void);
+int APS5_VABI sceRemoteplayServerLock(void);
+int APS5_VABI sceRemoteplayServerUnLock(void);
+int APS5_VABI sceRemoteplaySetApMode(void);
+int APS5_VABI sceRemoteplaySetLogLevel(void);
+int APS5_VABI sceRemoteplaySetProhibition(void);
+int APS5_VABI sceRemoteplaySetProhibitionForVsh(void);
+int APS5_VABI sceRemoteplaySetRpMode(void);
+
+}
diff --git a/core/libs/prx/libSceRemoteplay/libSceRemoteplay.hpp b/core/libs/prx/libSceRemoteplay/libSceRemoteplay.hpp
new file mode 100644
index 0000000000..a04f3f394f
--- /dev/null
+++ b/core/libs/prx/libSceRemoteplay/libSceRemoteplay.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRemoteplay/include/Api.hpp"
diff --git a/core/libs/prx/libSceResourceArbitrator/libSceResourceArbitrator.hpp b/core/libs/prx/libSceResourceArbitrator/libSceResourceArbitrator.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceResourceArbitrator/libSceResourceArbitrator.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRnpsAppMgr/Export.cpp b/core/libs/prx/libSceRnpsAppMgr/Export.cpp
index a2fdcbc15d..389f33546a 100644
--- a/core/libs/prx/libSceRnpsAppMgr/Export.cpp
+++ b/core/libs/prx/libSceRnpsAppMgr/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRnpsAppMgr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceRnpsAppMgr/include/Api.hpp b/core/libs/prx/libSceRnpsAppMgr/include/Api.hpp
new file mode 100644
index 0000000000..95fc2a3856
--- /dev/null
+++ b/core/libs/prx/libSceRnpsAppMgr/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRnpsAppMgrBlockAppInstall();
+int APS5_VABI sceRnpsAppMgrCreateUpdateRequest();
+int APS5_VABI sceRnpsAppMgrCreateUrlRequest();
+int APS5_VABI sceRnpsAppMgrDestroyBundle();
+int APS5_VABI sceRnpsAppMgrDestroyUpdateRequest();
+int APS5_VABI sceRnpsAppMgrFinishUrlRequest();
+int APS5_VABI sceRnpsAppMgrGetAppInfo();
+int APS5_VABI sceRnpsAppMgrGetAppInfoDebugString();
+int APS5_VABI sceRnpsAppMgrGetAppInfoList();
+int APS5_VABI sceRnpsAppMgrGetEventForShellUI();
+int APS5_VABI sceRnpsAppMgrGetUpdateProgress();
+int APS5_VABI sceRnpsAppMgrHasEventForShellUI();
+int APS5_VABI sceRnpsAppMgrInitialize();
+int APS5_VABI sceRnpsAppMgrPushEventForShellUI();
+int APS5_VABI sceRnpsAppMgrRecoverUfsImage();
+int APS5_VABI sceRnpsAppMgrRegisterShellUI();
+int APS5_VABI sceRnpsAppMgrRemoveApp();
+int APS5_VABI sceRnpsAppMgrRemoveAppOnSystemShutdown();
+int APS5_VABI sceRnpsAppMgrRemoveUfsImageOnSystemShutdown();
+int APS5_VABI sceRnpsAppMgrRequestUpdateCheck();
+int APS5_VABI sceRnpsAppMgrSetCrlUrl();
+int APS5_VABI sceRnpsAppMgrSetEventFlagForClients();
+int APS5_VABI sceRnpsAppMgrSetUpdateUrl();
+int APS5_VABI sceRnpsAppMgrStartService();
+int APS5_VABI sceRnpsAppMgrTerminate();
+int APS5_VABI sceRnpsAppMgrUnblockAppInstall();
+int APS5_VABI sceRnpsAppMgrUnregisterShellUI();
+
+}
diff --git a/core/libs/prx/libSceRnpsAppMgr/libSceRnpsAppMgr.hpp b/core/libs/prx/libSceRnpsAppMgr/libSceRnpsAppMgr.hpp
new file mode 100644
index 0000000000..9fc9484de9
--- /dev/null
+++ b/core/libs/prx/libSceRnpsAppMgr/libSceRnpsAppMgr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRnpsAppMgr/include/Api.hpp"
diff --git a/core/libs/prx/libSceRnpsNKInjectedBundle/libSceRnpsNKInjectedBundle.hpp b/core/libs/prx/libSceRnpsNKInjectedBundle/libSceRnpsNKInjectedBundle.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceRnpsNKInjectedBundle/libSceRnpsNKInjectedBundle.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRtc/CMakeLists.txt b/core/libs/prx/libSceRtc/CMakeLists.txt
index e0b93b163e..1411d4f936 100644
--- a/core/libs/prx/libSceRtc/CMakeLists.txt
+++ b/core/libs/prx/libSceRtc/CMakeLists.txt
@@ -1,4 +1,5 @@
 add_library(libSceRtc SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_link_libraries(libSceRtc PRIVATE libkernel libc)
 target_include_directories(libSceRtc PRIVATE ${LIBS_INCLUDE_DIR})
 configure_windows_unwind(libSceRtc)
 
@@ -8,8 +9,9 @@ if(BUILD_TESTING)
     target_link_libraries(guest_rtc_tests PRIVATE libSceRtc libc)
     configure_windows_unwind(guest_rtc_tests)
     add_test(NAME guest_rtc COMMAND guest_rtc_tests)
+    add_test(NAME guest_rtc_ps5_title COMMAND guest_rtc_tests ps5-title)
     if(WIN32)
-        set_tests_properties(guest_rtc PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_rtc guest_rtc_ps5_title PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceRtc>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceRtc/Export.cpp b/core/libs/prx/libSceRtc/Export.cpp
index 3cc3b045de..91c6591395 100644
--- a/core/libs/prx/libSceRtc/Export.cpp
+++ b/core/libs/prx/libSceRtc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRtc/include/Rtc.hpp"
 #include <chrono>
 #include <cstdint>
 #include <cstddef>
@@ -6,8 +7,12 @@
 #include <ctime>
 #include <limits>
 #include <mutex>
+#include <stdexcept>
+#include <string_view>
 #include "SceTypes.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 
 namespace {
 
@@ -31,6 +36,7 @@ constexpr std::int64_t WIN32_EPOCH_DAYS = 584388;
 constexpr std::uint64_t UNIX_EPOCH_TICK = UNIX_EPOCH_DAYS * TICKS_PER_DAY;
 constexpr std::uint64_t WIN32_EPOCH_TICK = WIN32_EPOCH_DAYS * TICKS_PER_DAY;
 constexpr std::uint64_t MAX_TICK = 3652059ull * TICKS_PER_DAY - 1;
+constexpr std::uint32_t RANGE_CHECKED_SDK_VERSION = 0x03000000;
 
 struct ClockState {
     std::uint64_t tick = 0;
@@ -100,6 +106,26 @@ RtcDateTime fromTick(std::uint64_t tick) {
         static_cast<std::uint16_t>(timeOfDay % TICKS_PER_MINUTE / TICKS_PER_SECOND), static_cast<std::uint32_t>(timeOfDay % TICKS_PER_SECOND)};
 }
 
+bool ps4Title() {
+    try {
+        const auto titleId = GetAppTitleId_nid_postfix();
+        return std::string_view(titleId.value, strnlen(titleId.value, sizeof(titleId.value))).substr(0, 4) == "CUSA";
+    } catch (const std::runtime_error&) {
+        return false;
+    } catch (const std::length_error&) {
+        return false;
+    }
+}
+
+bool rangeChecked() {
+    static const bool ps4 = ps4Title();
+    if (!ps4) return true;
+    const auto* process = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t version;
+    std::memcpy(&version, process + 16, sizeof(version));
+    return version >= RANGE_CHECKED_SDK_VERSION;
+}
+
 std::uint64_t currentTick(std::size_t clock = 0) {
     ClockState state;
     {
@@ -370,8 +396,13 @@ int APS5_VABI sceRtcGetDaysInMonth(int year, int month) {
 }
 
 int APS5_VABI sceRtcGetDayOfWeek(int year, int month, int day) {
-    if (year < 1 || year > 9999) return SCE_RTC_ERROR_INVALID_YEAR;
-    if (month < 1 || month > 12) return SCE_RTC_ERROR_INVALID_MONTH;
+    if (rangeChecked()) {
+        if (month < 1 || month > 12) return SCE_RTC_ERROR_INVALID_MONTH;
+        if (year < 1 || year > 9999) return SCE_RTC_ERROR_INVALID_YEAR;
+    } else {
+        if (year < 1) return SCE_RTC_ERROR_INVALID_YEAR;
+        if (month < 1 || month > 12) return SCE_RTC_ERROR_INVALID_MONTH;
+    }
     if (day < 1 || day > daysInMonth(year, month)) return SCE_RTC_ERROR_INVALID_DAY;
     return static_cast<int>((daysFromCivil(year, static_cast<unsigned>(month), static_cast<unsigned>(day)) + 1) % 7);
 }
@@ -389,7 +420,6 @@ int APS5_VABI sceRtcGetTick(const RtcDateTime* time, RtcTick* tick) {
 
 int APS5_VABI sceRtcSetTick(RtcDateTime* time, const RtcTick* tick) {
     if (!time || !tick) return SCE_RTC_ERROR_INVALID_POINTER;
-    if (tick->tick > MAX_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
     *time = fromTick(tick->tick);
     return 0;
 }
@@ -442,15 +472,22 @@ int APS5_VABI sceRtcGetTime_t(const RtcDateTime* time, int64_t* seconds) {
     if (!seconds) return SCE_RTC_ERROR_INVALID_POINTER;
     if (const int result = validate(time); result != 0) return result;
     const std::uint64_t tick = toTick(*time);
-    if (tick < UNIX_EPOCH_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
+    if (tick < UNIX_EPOCH_TICK) {
+        *seconds = 0;
+        return SCE_RTC_ERROR_INVALID_YEAR;
+    }
     *seconds = static_cast<int64_t>((tick - UNIX_EPOCH_TICK) / TICKS_PER_SECOND);
     return 0;
 }
 
 int APS5_VABI sceRtcSetTime_t(RtcDateTime* time, int64_t seconds) {
     if (!time) return SCE_RTC_ERROR_INVALID_POINTER;
-    if (seconds < 0 || static_cast<std::uint64_t>(seconds) > (MAX_TICK - UNIX_EPOCH_TICK) / TICKS_PER_SECOND) return SCE_RTC_ERROR_INVALID_VALUE;
-    *time = fromTick(UNIX_EPOCH_TICK + static_cast<std::uint64_t>(seconds) * TICKS_PER_SECOND);
+    if (rangeChecked()) {
+        if (seconds < 0) return SCE_RTC_ERROR_INVALID_VALUE;
+        *time = fromTick(UNIX_EPOCH_TICK + static_cast<std::uint64_t>(seconds) * TICKS_PER_SECOND);
+        return 0;
+    }
+    *time = fromTick(UNIX_EPOCH_TICK + static_cast<std::uint64_t>(static_cast<std::uint32_t>(seconds)) * TICKS_PER_SECOND);
     return 0;
 }
 
@@ -458,14 +495,16 @@ int APS5_VABI sceRtcGetWin32FileTime(const RtcDateTime* time, uint64_t* win32_ti
     if (!win32_time) return SCE_RTC_ERROR_INVALID_POINTER;
     if (const int result = validate(time); result != 0) return result;
     const std::uint64_t tick = toTick(*time);
-    if (tick < WIN32_EPOCH_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
+    if (tick < WIN32_EPOCH_TICK) {
+        *win32_time = 0;
+        return SCE_RTC_ERROR_INVALID_YEAR;
+    }
     *win32_time = (tick - WIN32_EPOCH_TICK) * 10;
     return 0;
 }
 
 int APS5_VABI sceRtcSetWin32FileTime(RtcDateTime* time, uint64_t win32_time) {
     if (!time) return SCE_RTC_ERROR_INVALID_POINTER;
-    if (win32_time / 10 > MAX_TICK - WIN32_EPOCH_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
     *time = fromTick(WIN32_EPOCH_TICK + win32_time / 10);
     return 0;
 }
@@ -587,8 +626,10 @@ int APS5_VABI sceRtcFormatRFC3339(char* dateTime, const RtcTick* utc, int timeZo
         utc = &now;
     }
     if (timeZoneMinutes < -1439 || timeZoneMinutes > 1439) return SCE_RTC_ERROR_INVALID_VALUE;
-    RtcTick local{};
-    if (const int result = addTicks(&local, utc, timeZoneMinutes, TICKS_PER_MINUTE); result != 0) return result;
+    const auto shift = static_cast<std::int64_t>(timeZoneMinutes) * TICKS_PER_MINUTE;
+    if (rangeChecked() && (shift < 0 ? utc->tick < static_cast<std::uint64_t>(-shift) : utc->tick > std::numeric_limits<std::uint64_t>::max() - static_cast<std::uint64_t>(shift))) return SCE_RTC_ERROR_INVALID_VALUE;
+    const RtcTick local{utc->tick + static_cast<std::uint64_t>(shift)};
+    if (local.tick > MAX_TICK) return SCE_RTC_ERROR_INVALID_YEAR;
     const RtcDateTime time = fromTick(local.tick);
     int written = std::snprintf(dateTime, 23, "%04u-%02u-%02uT%02u:%02u:%02u.%02u", time.year, time.month, time.day, time.hour, time.minute, time.second, time.microsecond / 10000);
     if (timeZoneMinutes == 0) {
@@ -619,8 +660,9 @@ int APS5_VABI sceRtcFormatRFC2822(char* dateTime, const RtcTick* utc, int timeZo
         utc = &now;
     }
     if (timeZoneMinutes < -1439 || timeZoneMinutes > 1439) return SCE_RTC_ERROR_INVALID_VALUE;
-    RtcTick local{};
-    if (const int result = addTicks(&local, utc, timeZoneMinutes, TICKS_PER_MINUTE); result != 0) return result;
+    const RtcTick local{utc->tick + static_cast<std::uint64_t>(static_cast<std::int64_t>(timeZoneMinutes) * TICKS_PER_MINUTE)};
+    if (static_cast<std::int64_t>(local.tick) > static_cast<std::int64_t>(MAX_TICK)) return SCE_RTC_ERROR_INVALID_YEAR;
+    if (static_cast<std::int64_t>(utc->tick) < 0 || static_cast<std::int64_t>(local.tick) < 0) return SCE_RTC_ERROR_INVALID_VALUE;
     const RtcDateTime time = fromTick(local.tick);
     const int offset = timeZoneMinutes < 0 ? -timeZoneMinutes : timeZoneMinutes;
     std::snprintf(dateTime, 32, "%s, %02u %s %04u %02u:%02u:%02u %c%02d%02d", WEEKDAY_NAMES[(local.tick / TICKS_PER_DAY + 1) % 7], time.day,
diff --git a/core/libs/prx/libSceRtc/include/Rtc.hpp b/core/libs/prx/libSceRtc/include/Rtc.hpp
new file mode 100644
index 0000000000..7e84acf6b7
--- /dev/null
+++ b/core/libs/prx/libSceRtc/include/Rtc.hpp
@@ -0,0 +1,69 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRtcCheckValid(const RtcDateTime* time);
+int APS5_VABI sceRtcIsLeapYear(int year);
+int APS5_VABI sceRtcGetDaysInMonth(int year, int month);
+int APS5_VABI sceRtcGetDayOfWeek(int year, int month, int day);
+int APS5_VABI sceRtcGetTickResolution(void);
+int APS5_VABI sceRtcGetTick(const RtcDateTime* time, RtcTick* tick);
+int APS5_VABI sceRtcSetTick(RtcDateTime* time, const RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentClock(RtcDateTime* time, int timeZoneMinutes);
+int APS5_VABI sceRtcGetCurrentClockLocalTime(RtcDateTime* time);
+int APS5_VABI sceRtcConvertUtcToLocalTime(const RtcTick* utc, RtcTick* localTime);
+int APS5_VABI sceRtcConvertLocalTimeToUtc(const RtcTick* localTime, RtcTick* utc);
+int APS5_VABI sceRtcGetTime_t(const RtcDateTime* time, int64_t* seconds);
+int APS5_VABI sceRtcSetTime_t(RtcDateTime* time, int64_t seconds);
+int APS5_VABI sceRtcGetWin32FileTime(const RtcDateTime* time, uint64_t* win32Time);
+int APS5_VABI sceRtcSetWin32FileTime(RtcDateTime* time, uint64_t win32Time);
+int APS5_VABI sceRtcGetDosTime(const RtcDateTime* time, uint32_t* dosTime);
+int APS5_VABI sceRtcSetDosTime(RtcDateTime* time, uint32_t dosTime);
+int APS5_VABI sceRtcGetYear(const RtcDateTime* time);
+int APS5_VABI sceRtcSetYear(RtcDateTime* time, int year);
+int APS5_VABI sceRtcGetMonth(const RtcDateTime* time);
+int APS5_VABI sceRtcSetMonth(RtcDateTime* time, int month);
+int APS5_VABI sceRtcGetDay(const RtcDateTime* time);
+int APS5_VABI sceRtcSetDay(RtcDateTime* time, int day);
+int APS5_VABI sceRtcGetHour(const RtcDateTime* time);
+int APS5_VABI sceRtcSetHour(RtcDateTime* time, int hour);
+int APS5_VABI sceRtcGetMinute(const RtcDateTime* time);
+int APS5_VABI sceRtcSetMinute(RtcDateTime* time, int minute);
+int APS5_VABI sceRtcGetSecond(const RtcDateTime* time);
+int APS5_VABI sceRtcSetSecond(RtcDateTime* time, int second);
+int APS5_VABI sceRtcGetMicrosecond(const RtcDateTime* time);
+int APS5_VABI sceRtcSetMicrosecond(RtcDateTime* time, int microsecond);
+int APS5_VABI sceRtcFormatRFC3339(char* dateTime, const RtcTick* utc, int timeZoneMinutes);
+int APS5_VABI sceRtcFormatRFC3339LocalTime(char* dateTime, const RtcTick* utc);
+int APS5_VABI sceRtcFormatRFC2822(char* dateTime, const RtcTick* utc, int timeZoneMinutes);
+int APS5_VABI sceRtcFormatRFC2822LocalTime(char* dateTime, const RtcTick* utc);
+int APS5_VABI sceRtcParseRFC3339(RtcTick* utc, const char* dateTime);
+int APS5_VABI sceRtcParseDateTime(RtcTick* utc, const char* dateTime);
+int APS5_VABI sceRtcTickAddTicks(RtcTick* dst, const RtcTick* src, int64_t ticks);
+int APS5_VABI sceRtcTickAddMicroseconds(RtcTick* dst, const RtcTick* src, int64_t usec);
+int APS5_VABI sceRtcTickAddSeconds(RtcTick* dst, const RtcTick* src, int64_t seconds);
+int APS5_VABI sceRtcTickAddMinutes(RtcTick* dst, const RtcTick* src, int64_t minutes);
+int APS5_VABI sceRtcTickAddHours(RtcTick* dst, const RtcTick* src, int32_t hours);
+int APS5_VABI sceRtcTickAddDays(RtcTick* dst, const RtcTick* src, int32_t days);
+int APS5_VABI sceRtcTickAddWeeks(RtcTick* dst, const RtcTick* src, int32_t weeks);
+int APS5_VABI sceRtcTickAddMonths(RtcTick* dst, const RtcTick* src, int32_t months);
+int APS5_VABI sceRtcTickAddYears(RtcTick* dst, const RtcTick* src, int16_t years);
+int APS5_VABI sceRtcInit(void);
+int APS5_VABI sceRtcEnd(void);
+int APS5_VABI sceRtcCompareTick(const RtcTick* first, const RtcTick* second);
+int APS5_VABI sceRtcGetCurrentRawNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentAdNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentDebugNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentNetworkTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentAdNetworkTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentDebugNetworkTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetConf(int first, int second, int third, int fourth);
+int APS5_VABI sceRtcFormatRFC3339Precise(char* dateTime, const RtcTick* utc, int timeZoneMinutes, int precision);
+int APS5_VABI sceRtcFormatRFC3339PreciseLocalTime(char* dateTime, const RtcTick* utc, int precision);
+
+}
diff --git a/core/libs/prx/libSceRtc/libSceRtc.hpp b/core/libs/prx/libSceRtc/libSceRtc.hpp
new file mode 100644
index 0000000000..6301e155c4
--- /dev/null
+++ b/core/libs/prx/libSceRtc/libSceRtc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRtc/include/Rtc.hpp"
diff --git a/core/libs/prx/libSceRudp/CMakeLists.txt b/core/libs/prx/libSceRudp/CMakeLists.txt
new file mode 100644
index 0000000000..962bd86e42
--- /dev/null
+++ b/core/libs/prx/libSceRudp/CMakeLists.txt
@@ -0,0 +1,6 @@
+add_library(libSceRudp SHARED EXCLUDE_FROM_ALL
+        ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libkernel/Time/TimedWait.cpp
+)
+target_include_directories(libSceRudp PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceRudp)
diff --git a/core/libs/prx/libSceRudp/Export.cpp b/core/libs/prx/libSceRudp/Export.cpp
index dcfb2c25be..dd4dd2c260 100644
--- a/core/libs/prx/libSceRudp/Export.cpp
+++ b/core/libs/prx/libSceRudp/Export.cpp
@@ -1,6 +1,5 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include <atomic>
-#include <chrono>
-#include <condition_variable>
 #include <cstdint>
 #include <cstdio>
 #include <cstddef>
@@ -11,6 +10,7 @@
 #include <stdexcept>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/Time/include/TimedWait.hpp"
 
 // Offline reliable-UDP: the library initialises and contexts can be created and bound, but no connection can
 // ever be established because there is no network.
@@ -58,8 +58,6 @@ enum RudpOption {
     RUDP_OPTION_KEEP_ALIVE_TIMEOUT = 19,
 };
 
-using GuestRudpEventHandler = RudpEventHandler;
-
 std::mutex g_mutex;
 bool g_inited = false;
 int g_next_ctx = 0;
@@ -93,10 +91,9 @@ struct RudpPoll {
     std::map<int, uint16_t> entries;
 };
 
-
 int g_next_poll = 1;
 std::map<int, RudpPoll> g_polls;
-std::condition_variable g_polls_changed;
+TimedWait::Condition g_polls_changed;
 
 bool valid_ctx(int ctx) {
     return g_ctx.count(ctx) != 0;
@@ -157,7 +154,7 @@ int APS5_VABI sceRudpEnd(void) {
     g_inited = false;
     g_ctx.clear();
     g_polls.clear();
-    g_polls_changed.notify_all();
+    g_polls_changed.NotifyAll();
     return 0;
 }
 
@@ -451,8 +448,8 @@ int APS5_VABI sceRudpPollWait(int pollId, RudpPollEvent* events, std::size_t eve
     }
     const auto closed = [pollId] { return !g_inited || g_polls.count(pollId) == 0; };
     if (timeout > RUDP_POLL_WAIT_MAX_USEC) {
-        g_polls_changed.wait(lk, closed);
-    } else if (!g_polls_changed.wait_for(lk, std::chrono::microseconds(timeout), closed)) {
+        g_polls_changed.Wait(lk, closed);
+    } else if (!g_polls_changed.WaitUntil(lk, TimedWait::DeadlineNanos(timeout), closed)) {
         return 0;
     }
     return g_inited ? RUDP_ERROR_INVALID_POLL_ID : RUDP_ERROR_NOT_INITIALIZED;
@@ -469,7 +466,7 @@ int APS5_VABI sceRudpPollDestroy(int pollId) {
     if (g_polls.erase(pollId) == 0) {
         return RUDP_ERROR_INVALID_POLL_ID;
     }
-    g_polls_changed.notify_all();
+    g_polls_changed.NotifyAll();
     return 0;
 }
 
diff --git a/core/libs/prx/libSceRudp/include/Api.hpp b/core/libs/prx/libSceRudp/include/Api.hpp
new file mode 100644
index 0000000000..44b6881d58
--- /dev/null
+++ b/core/libs/prx/libSceRudp/include/Api.hpp
@@ -0,0 +1,44 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using GuestRudpEventHandler = RudpEventHandler;
+
+extern "C" {
+
+int APS5_VABI sceRudpInit_nid_postfix(void* memPool, int memPoolSize);
+int APS5_VABI sceRudpActivate(std::int32_t contextId, const void* address, std::uint32_t addressLength);
+int APS5_VABI sceRudpGetStatus(void* status, std::size_t size);
+int APS5_VABI sceRudpEnd(void);
+int APS5_VABI sceRudpTerminate(int ctxId);
+int APS5_VABI sceRudpEnableInternalIOThread(uint32_t stackSize, uint32_t priority);
+int APS5_VABI sceRudpEnableInternalIOThread2(uint32_t stackSize, uint32_t priority, uint64_t affinity);
+int APS5_VABI sceRudpSetEventHandler(GuestRudpEventHandler handler, void* arg);
+int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler handler, void* arg, int* ctxId);
+int APS5_VABI sceRudpBind(int ctxId, uint16_t vport, int transport, uint16_t port);
+int APS5_VABI sceRudpSetOption(int ctxId, int option, const void* value, uint32_t len);
+int APS5_VABI sceRudpGetOption(int ctxId, int option, void* value, uint32_t len);
+int APS5_VABI sceRudpInitiate(int ctxId, const void* to, uint32_t tolen, uint16_t vport);
+int APS5_VABI sceRudpGetContextStatus(int ctxId, void* status, uint32_t size);
+int APS5_VABI sceRudpGetRemoteInfo(int contextId, void* address, std::uint32_t* addressSize, std::uint16_t* virtualPort);
+int APS5_VABI sceRudpGetNumberOfPacketsToRead(int ctxId);
+int APS5_VABI sceRudpGetSizeWritable(int ctxId);
+int APS5_VABI sceRudpGetSizeReadable(int ctxId);
+int APS5_VABI sceRudpWrite(int ctxId, const void* data, uint32_t len, int flags);
+int APS5_VABI sceRudpRead(int ctxId, void* data, uint32_t len, int flags, void* status);
+int APS5_VABI sceRudpNetFlush(void);
+int APS5_VABI sceRudpProcessEvents(std::uint64_t timeout);
+int APS5_VABI sceRudpNetReceived(int socketId, const void* data, std::size_t dataSize, const void* sourceAddress, std::uint32_t sourceAddressSize);
+int APS5_VABI sceRudpGetMaxSegmentSize(uint16_t* size);
+int APS5_VABI sceRudpPollCreate(std::size_t size);
+int APS5_VABI sceRudpPollControl(int pollId, int op, int ctxId, uint16_t events);
+int APS5_VABI sceRudpPollWait(int pollId, RudpPollEvent* events, std::size_t eventLen, uint64_t timeout);
+int APS5_VABI sceRudpPollDestroy(int pollId);
+int APS5_VABI sceRudpAccept();
+int APS5_VABI sceRudpFlush();
+int APS5_VABI sceRudpGetLocalInfo();
+int APS5_VABI sceRudpListen();
+int APS5_VABI sceRudpPollCancel();
+int APS5_VABI sceRudpSetMaxSegmentSize();
+
+}
diff --git a/core/libs/prx/libSceRudp/libSceRudp.hpp b/core/libs/prx/libSceRudp/libSceRudp.hpp
new file mode 100644
index 0000000000..934f85cb3c
--- /dev/null
+++ b/core/libs/prx/libSceRudp/libSceRudp.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRudp/include/Api.hpp"
diff --git a/core/libs/prx/libSceS3DConversion/libSceS3DConversion.hpp b/core/libs/prx/libSceS3DConversion/libSceS3DConversion.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceS3DConversion/libSceS3DConversion.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceS3da/Export.cpp b/core/libs/prx/libSceS3da/Export.cpp
index 79ca9b7758..fcf0f1f9af 100644
--- a/core/libs/prx/libSceS3da/Export.cpp
+++ b/core/libs/prx/libSceS3da/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceS3da/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct S3daInfo;
-
 extern "C" {
 
 int APS5_VABI sceS3daClose(std::uint32_t port) {
diff --git a/core/libs/prx/libSceS3da/include/Api.hpp b/core/libs/prx/libSceS3da/include/Api.hpp
new file mode 100644
index 0000000000..d89f3a8dbb
--- /dev/null
+++ b/core/libs/prx/libSceS3da/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct S3daInfo;
+
+extern "C" {
+
+int APS5_VABI sceS3daClose(std::uint32_t port);
+int APS5_VABI sceS3daGetInfo(std::uint32_t port, S3daInfo* info);
+int APS5_VABI sceS3daOpen(std::uint32_t port);
+int APS5_VABI sceS3daSendData(std::uint32_t port, const void* data, std::uint32_t size);
+
+}
diff --git a/core/libs/prx/libSceS3da/libSceS3da.hpp b/core/libs/prx/libSceS3da/libSceS3da.hpp
new file mode 100644
index 0000000000..56ae159b9d
--- /dev/null
+++ b/core/libs/prx/libSceS3da/libSceS3da.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceS3da/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveData.native/CMakeLists.txt b/core/libs/prx/libSceSaveData.native/CMakeLists.txt
index 6b03a2c86c..5236fba466 100644
--- a/core/libs/prx/libSceSaveData.native/CMakeLists.txt
+++ b/core/libs/prx/libSceSaveData.native/CMakeLists.txt
@@ -16,6 +16,7 @@ if(BUILD_TESTING)
     add_test_executable(guest_savedata_delete_tests ${LIBS_INCLUDE_DIR}/tests/GuestSaveDataDelete.cpp)
     target_include_directories(guest_savedata_delete_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_savedata_delete_tests PRIVATE libSceSaveData.native libc)
+    configure_windows_unwind(guest_savedata_delete_tests)
     add_test(NAME guest_savedata_delete COMMAND guest_savedata_delete_tests)
     if(WIN32)
         set_tests_properties(guest_savedata_delete PROPERTIES ENVIRONMENT_MODIFICATION
@@ -25,6 +26,7 @@ if(BUILD_TESTING)
     add_test_executable(guest_savedata_convert_tests ${LIBS_INCLUDE_DIR}/tests/GuestSaveDataConvert.cpp)
     target_include_directories(guest_savedata_convert_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_savedata_convert_tests PRIVATE libSceSaveData.native libc)
+    configure_windows_unwind(guest_savedata_convert_tests)
     add_test(NAME guest_savedata_convert COMMAND guest_savedata_convert_tests)
     if(WIN32)
         set_tests_properties(guest_savedata_convert PROPERTIES ENVIRONMENT_MODIFICATION
diff --git a/core/libs/prx/libSceSaveData.native/Export.cpp b/core/libs/prx/libSceSaveData.native/Export.cpp
index c49454241b..0627767b30 100644
--- a/core/libs/prx/libSceSaveData.native/Export.cpp
+++ b/core/libs/prx/libSceSaveData.native/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData.native/include/Api.hpp"
+#include "prx/libSceSaveData/include/Api.hpp"
 #include <algorithm>
 #include <atomic>
 #include <cstddef>
@@ -328,7 +330,7 @@ static bool isMountedDirectory(const std::string& path) {
 
 static int deleteSave(const SaveDataDelete* del) {
     if (del == nullptr || del->dir_name == nullptr) {
-        throw std::runtime_error("sceSaveDataDelete: null argument");
+        return SAVE_DATA_ERROR_PARAMETER;
     }
     const auto* nameEnd = static_cast<const char*>(std::memchr(del->dir_name->data, '\0', sizeof(del->dir_name->data)));
     if (nameEnd == nullptr) {
@@ -403,7 +405,7 @@ static SaveDataSearchInfo search_info(const std::string& real_path) {
 
 static int dirNameSearch(const SaveDataDirNameSearchCond* cond, SaveDataDirNameSearchResult* result) {
     if (cond == nullptr || result == nullptr) {
-        throw std::runtime_error("sceSaveDataDirNameSearch: null argument");
+        return SAVE_DATA_ERROR_PARAMETER;
     }
     result->hit_num = 0;
     result->set_num = 0;
@@ -606,7 +608,7 @@ int APS5_VABI sceSaveDataLoadIcon(const SaveDataMountPoint* mount_point, SaveDat
 
 static int mount3(const SaveDataMount3* mount, SaveDataMountResult* mount_result) {
     if (mount == nullptr || mount_result == nullptr || mount->dir_name == nullptr) {
-        throw std::runtime_error("sceSaveDataMount3: null argument");
+        return SAVE_DATA_ERROR_PARAMETER;
     }
     const bool create = (mount->mount_mode & SAVE_DATA_MOUNT_MODE_CREATE) != 0;
     const bool create2 = (mount->mount_mode & SAVE_DATA_MOUNT_MODE_CREATE2) != 0;
@@ -1042,17 +1044,6 @@ int APS5_VABI sceSaveDataDebugTarget() {
 
 namespace {
 
-struct SaveDataMountPs4 {
-    std::int32_t user_id;
-    std::int32_t pad;
-    const void* title_id;
-    const SceSaveDataDirName* dir_name;
-    const void* fingerprint;
-    std::uint64_t blocks;
-    std::uint32_t mount_mode;
-    std::uint8_t reserved[32];
-};
-
 }
 
 extern "C" {
diff --git a/core/libs/prx/libSceSaveData.native/include/Api.hpp b/core/libs/prx/libSceSaveData.native/include/Api.hpp
new file mode 100644
index 0000000000..00283d8bfd
--- /dev/null
+++ b/core/libs/prx/libSceSaveData.native/include/Api.hpp
@@ -0,0 +1,55 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct SaveDataMountPs4 {
+    std::int32_t user_id;
+    std::int32_t pad;
+    const void* title_id;
+    const SceSaveDataDirName* dir_name;
+    const void* fingerprint;
+    std::uint64_t blocks;
+    std::uint32_t mount_mode;
+    std::uint8_t reserved[32];
+};
+
+extern "C" {
+
+int APS5_VABI sceSaveDataCommit(const SaveDataCommitParam* param);
+int APS5_VABI sceSaveDataCreateTransactionResource(uint32_t size);
+int APS5_VABI sceSaveDataDelete(const SaveDataDelete* del);
+int APS5_VABI sceSaveDataDeleteTransactionResource(int32_t resource);
+int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond* cond, SaveDataDirNameSearchResult* result);
+int APS5_VABI sceSaveDataGetMountInfo(const SaveDataMountPoint* mountPoint, SaveDataMountInfo* info);
+int APS5_VABI sceSaveDataGetParam(const SaveDataMountPoint* mountPoint, uint32_t paramType, void* paramBuf, size_t paramBufSize, size_t* gotSize);
+int APS5_VABI sceSaveDataLoadIcon(const SaveDataMountPoint* mountPoint, SaveDataIcon* icon);
+int APS5_VABI sceSaveDataMount3(const SaveDataMount3* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataPrepare(const SaveDataMountPoint* mountPoint, const SaveDataPrepareParam* param);
+int APS5_VABI sceSaveDataSaveIcon(const SaveDataMountPoint* mountPoint, const SaveDataIcon* icon);
+int APS5_VABI sceSaveDataSaveIconByPath(const SaveDataMountPoint* mountPoint, const char* path);
+int APS5_VABI sceSaveDataSetParam(const SaveDataMountPoint* mountPoint, uint32_t paramType, const void* paramBuf, size_t paramBufSize);
+int APS5_VABI sceSaveDataUmount2(uint32_t mode, const SaveDataMountPoint* mountPoint);
+int APS5_VABI sceSaveDataTransferringMountPs4(const SaveDataTransferringMount* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataDirNameSearchPs4(const SaveDataDirNameSearchCond* cond, SaveDataDirNameSearchResult* result);
+int APS5_VABI sceSaveDataConvert(const SaveDataConvert* param);
+int APS5_VABI sceSaveDataGetConvertProgress(float* progress);
+int APS5_VABI sceSaveDataCancel(std::uint32_t cancelArgument);
+int APS5_VABI sceSaveDataDirNameSearch2(const SaveDataDirNameSearchCond* cond, SaveDataDirNameSearchResult* result);
+int APS5_VABI sceSaveDataPrepareForTransferring(const SaveDataMountPoint* mountPoint, const SaveDataPrepareParam* param);
+int APS5_VABI sceSaveDataCheckIpmiIfSize();
+int APS5_VABI sceSaveDataDebug();
+int APS5_VABI sceSaveDataDebugCheckBackupData();
+int APS5_VABI sceSaveDataDebugCleanMount();
+int APS5_VABI sceSaveDataDebugCompiledSdkVersion();
+int APS5_VABI sceSaveDataDebugCreateSaveDataRoot();
+int APS5_VABI sceSaveDataDebugProspero();
+int APS5_VABI sceSaveDataDebugRemoveSaveDataRoot();
+int APS5_VABI sceSaveDataDebugTarget();
+int APS5_VABI sceSaveDataInitialize(const void* init);
+int APS5_VABI sceSaveDataMount(const SaveDataMountPs4* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataUmount(const SaveDataMountPoint* mountPoint);
+int APS5_VABI sceSaveDataSetupSaveDataMemory(std::int32_t userId, std::size_t memorySize, const SaveDataParam* param);
+int APS5_VABI sceSaveDataGetSaveDataMemory(std::int32_t userId, void* buf, std::size_t bufSize, std::int64_t offset);
+int APS5_VABI sceSaveDataSetSaveDataMemory(std::int32_t userId, void* buf, std::size_t bufSize, std::int64_t offset);
+
+}
diff --git a/core/libs/prx/libSceSaveData.native/libSceSaveData.native.hpp b/core/libs/prx/libSceSaveData.native/libSceSaveData.native.hpp
new file mode 100644
index 0000000000..6cb55f8ca0
--- /dev/null
+++ b/core/libs/prx/libSceSaveData.native/libSceSaveData.native.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveData/Export.cpp b/core/libs/prx/libSceSaveData/Export.cpp
index f2a68ec989..6fbc7bb184 100644
--- a/core/libs/prx/libSceSaveData/Export.cpp
+++ b/core/libs/prx/libSceSaveData/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdio>
diff --git a/core/libs/prx/libSceSaveData/SaveDataCore.hpp b/core/libs/prx/libSceSaveData/SaveDataCore.hpp
index 58afdfa721..1da806ac51 100644
--- a/core/libs/prx/libSceSaveData/SaveDataCore.hpp
+++ b/core/libs/prx/libSceSaveData/SaveDataCore.hpp
@@ -21,20 +21,13 @@
 #include <vector>
 
 #include "SceTypes.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/RemoveTree.hpp"
 #include "prx/libSceSaveData/SaveDataFile.hpp"
 
 namespace savedata {
 
-extern "C" {
-int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, std::uint32_t attr,
-                                       std::uint64_t init_pattern, const void* param);
-int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef);
-int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern);
-int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, std::uint64_t set_pattern, int* num_wait_threads);
-}
-
 namespace {
 
 constexpr std::uint32_t SD_FACILITY = 0x809F0000u;
diff --git a/core/libs/prx/libSceSaveData/include/Api.hpp b/core/libs/prx/libSceSaveData/include/Api.hpp
new file mode 100644
index 0000000000..88067a68e5
--- /dev/null
+++ b/core/libs/prx/libSceSaveData/include/Api.hpp
@@ -0,0 +1,83 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSaveDataInitialize3(const void* init);
+int APS5_VABI sceSaveDataTerminate(void);
+int APS5_VABI sceSaveDataBackup(const SaveDataBackup* backup);
+int APS5_VABI sceSaveDataGetEventResult(const void* eventParam, SaveDataEvent* event);
+int APS5_VABI sceSaveDataGetSaveDataMemory2(SaveDataMemoryGet2* getParam);
+int APS5_VABI sceSaveDataSetSaveDataMemory2(const SaveDataMemorySet2* setParam);
+int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2* setupParam, SaveDataMemorySetupResult* result);
+int APS5_VABI sceSaveDataSyncSaveDataMemory(const void* syncParam);
+int APS5_VABI sceSaveDataTransferringMount(const SaveDataTransferringMount* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataAbort();
+int APS5_VABI sceSaveDataBindPsnAccount(void);
+int APS5_VABI sceSaveDataBindPsnAccountForSystemBackup(void);
+int APS5_VABI sceSaveDataChangeDatabase(void);
+int APS5_VABI sceSaveDataChangeInternal(void);
+int APS5_VABI sceSaveDataCheckBackupData(void);
+int APS5_VABI sceSaveDataCheckBackupDataForCdlg(void);
+int APS5_VABI sceSaveDataCheckBackupDataInternal(void);
+int APS5_VABI sceSaveDataCheckBackupDataLight(void);
+int APS5_VABI sceSaveDataCheckCloudData(void);
+int APS5_VABI sceSaveDataCheckSaveDataBroken(void);
+int APS5_VABI sceSaveDataCheckSaveDataVersion(void);
+int APS5_VABI sceSaveDataCheckSaveDataVersionLatest(void);
+int APS5_VABI sceSaveDataClearProgress();
+int APS5_VABI sceSaveDataCreateUploadData(void);
+int APS5_VABI sceSaveDataDebugGetThreadId(void);
+int APS5_VABI sceSaveDataDeleteAllUser(void);
+int APS5_VABI sceSaveDataDeleteBackupData(void);
+int APS5_VABI sceSaveDataDeleteCloudData(void);
+int APS5_VABI sceSaveDataDeleteProspero(void);
+int APS5_VABI sceSaveDataDeleteTitle(void);
+int APS5_VABI sceSaveDataDeleteUser(void);
+int APS5_VABI sceSaveDataDirNameSearchInternal(void);
+int APS5_VABI sceSaveDataDownload(void);
+int APS5_VABI sceSaveDataGetAllSize();
+int APS5_VABI sceSaveDataGetAppLaunchedUser(void);
+int APS5_VABI sceSaveDataGetAutoUploadConditions(void);
+int APS5_VABI sceSaveDataGetAutoUploadRequestInfo(void);
+int APS5_VABI sceSaveDataGetAutoUploadSetting(void);
+int APS5_VABI sceSaveDataGetBoundPsnAccountCount(void);
+int APS5_VABI sceSaveDataGetClientThreadPriority(void);
+int APS5_VABI sceSaveDataGetCloudQuotaInfo(void);
+int APS5_VABI sceSaveDataGetEventInfo();
+int APS5_VABI sceSaveDataGetMountedSaveDataCount();
+int APS5_VABI sceSaveDataGetProgress();
+int APS5_VABI sceSaveDataGetSaveDataCount();
+int APS5_VABI sceSaveDataGetSaveDataRootDir(void);
+int APS5_VABI sceSaveDataGetSaveDataRootPath(void);
+int APS5_VABI sceSaveDataGetSaveDataRootUsbPath(void);
+int APS5_VABI sceSaveDataGetSavePoint(void);
+int APS5_VABI sceSaveDataGetUpdatedDataCount(void);
+int APS5_VABI sceSaveDataInitialize2();
+int APS5_VABI sceSaveDataInitializeForCdlg(void);
+int APS5_VABI sceSaveDataIsDeletingUsbDb(void);
+int APS5_VABI sceSaveDataIsMounted();
+int APS5_VABI sceSaveDataManualDelete(void);
+int APS5_VABI sceSaveDataManualDownload(void);
+int APS5_VABI sceSaveDataManualUpload(void);
+int APS5_VABI sceSaveDataMount5();
+int APS5_VABI sceSaveDataMountInternal(void);
+int APS5_VABI sceSaveDataMountSys(void);
+int APS5_VABI sceSaveDataRebuildDatabase(void);
+int APS5_VABI sceSaveDataRegisterEventCallback();
+int APS5_VABI sceSaveDataRestoreBackupData(void);
+int APS5_VABI sceSaveDataRestoreBackupDataForCdlg(void);
+int APS5_VABI sceSaveDataRestoreLoadSaveDataMemory(void);
+int APS5_VABI sceSaveDataSetAutoUploadSetting(void);
+int APS5_VABI sceSaveDataSetEventInfo();
+int APS5_VABI sceSaveDataSetSaveDataLibraryUser(void);
+int APS5_VABI sceSaveDataShutdownStart(void);
+int APS5_VABI sceSaveDataSupportedFakeBrokenStatus(void);
+int APS5_VABI sceSaveDataSyncCloudList(void);
+int APS5_VABI sceSaveDataUmountSys(void);
+int APS5_VABI sceSaveDataUmountWithBackup(void);
+int APS5_VABI sceSaveDataUnregisterEventCallback();
+int APS5_VABI sceSaveDataUpload(void);
+
+}
diff --git a/core/libs/prx/libSceSaveData/libSceSaveData.hpp b/core/libs/prx/libSceSaveData/libSceSaveData.hpp
new file mode 100644
index 0000000000..72713a0e1f
--- /dev/null
+++ b/core/libs/prx/libSceSaveData/libSceSaveData.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSaveData/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveDataDialog.native/Export.cpp b/core/libs/prx/libSceSaveDataDialog.native/Export.cpp
index 54c4fd0926..4e173f20c5 100644
--- a/core/libs/prx/libSceSaveDataDialog.native/Export.cpp
+++ b/core/libs/prx/libSceSaveDataDialog.native/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveDataDialog.native/include/Api.hpp"
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -44,7 +46,7 @@ int APS5_VABI sceSaveDataDialogGetResult(void* result) {
  r->result = SAVE_DATA_DIALOG_RESULT_OK;
  r->button_id = SAVE_DATA_DIALOG_BUTTON_ID_OK;
  r->user_data = g_user_data;
- if (r->dir_name != nullptr && g_dir_name[0] != '\0') {
+ if (r->dir_name != nullptr) {
   std::snprintf(static_cast<SaveDataDirName*>(r->dir_name)->data,
    sizeof(SaveDataDirName::data), "%s", g_dir_name);
  }
diff --git a/core/libs/prx/libSceSaveDataDialog.native/include/Api.hpp b/core/libs/prx/libSceSaveDataDialog.native/include/Api.hpp
new file mode 100644
index 0000000000..838a41d62b
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog.native/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSaveDataDialogGetStatus(void);
+int APS5_VABI sceSaveDataDialogUpdateStatus(void);
+
+}
diff --git a/core/libs/prx/libSceSaveDataDialog.native/libSceSaveDataDialog.native.hpp b/core/libs/prx/libSceSaveDataDialog.native/libSceSaveDataDialog.native.hpp
new file mode 100644
index 0000000000..483cb011af
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog.native/libSceSaveDataDialog.native.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
+#include "prx/libSceSaveDataDialog.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveDataDialog/Export.cpp b/core/libs/prx/libSceSaveDataDialog/Export.cpp
index 068c96f145..1ad8a50883 100644
--- a/core/libs/prx/libSceSaveDataDialog/Export.cpp
+++ b/core/libs/prx/libSceSaveDataDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstddef>
@@ -6,7 +7,6 @@
 #include "prx/libSceSaveDataDialog.native/SaveDataDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-
 namespace {
 // Throwing from these reaches std::terminate and aborts the game process.
 int SoftFailNp(const char* func) {
diff --git a/core/libs/prx/libSceSaveDataDialog/include/Api.hpp b/core/libs/prx/libSceSaveDataDialog/include/Api.hpp
new file mode 100644
index 0000000000..40baa8c043
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSaveDataDialogClose(const void* closeParam);
+int APS5_VABI sceSaveDataDialogGetResult(void* result);
+int APS5_VABI sceSaveDataDialogInitialize(void);
+int APS5_VABI sceSaveDataDialogIsReadyToDisplay(void);
+int APS5_VABI sceSaveDataDialogOpen(const void* param);
+int APS5_VABI sceSaveDataDialogProgressBarInc(int target, uint32_t delta);
+int APS5_VABI sceSaveDataDialogProgressBarSetValue(int target, uint32_t rate);
+int APS5_VABI sceSaveDataDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceSaveDataDialog/libSceSaveDataDialog.hpp b/core/libs/prx/libSceSaveDataDialog/libSceSaveDataDialog.hpp
new file mode 100644
index 0000000000..06b3b4f0f0
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog/libSceSaveDataDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceScm/libSceScm.hpp b/core/libs/prx/libSceScm/libSceScm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceScm/libSceScm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceScreenShot/Export.cpp b/core/libs/prx/libSceScreenShot/Export.cpp
index dbc4cf09af..b9335af525 100644
--- a/core/libs/prx/libSceScreenShot/Export.cpp
+++ b/core/libs/prx/libSceScreenShot/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceScreenShot/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -7,8 +9,6 @@
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 
-extern "C" int APS5_VABI sceKernelFstat(int d, FileStat* sb);
-
 namespace {
 
 constexpr int ErrorArgument = static_cast<int>(0x80BE0001);
@@ -43,6 +43,7 @@ int SetOverlayImage(const char* path, int offsetX, int offsetY) {
         result = stat.st_size > 0 && stat.st_size <= maxSize ? 0 : ErrorOverlaySize;
     }
     sceKernelClose(descriptor);
+
     return result;
 }
 
diff --git a/core/libs/prx/libSceScreenShot/include/Api.hpp b/core/libs/prx/libSceScreenShot/include/Api.hpp
new file mode 100644
index 0000000000..98d5829a2c
--- /dev/null
+++ b/core/libs/prx/libSceScreenShot/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceScreenShotSetOverlayImage(const char* path, int offsetX, int offsetY);
+int APS5_VABI sceScreenShotSetOverlayImageWithOrigin(const char* path, int offsetX, int offsetY, int origin);
+int APS5_VABI sceScreenShotDisable();
+int APS5_VABI sceScreenShotEnable();
+int APS5_VABI sceScreenShotIsDisabled(int id, int* isDisabled);
+int APS5_VABI sceScreenShotDisableNotification();
+int APS5_VABI sceScreenShotEnableNotification();
+int APS5_VABI sceScreenShotCapture();
+int APS5_VABI sceScreenShotGetAppInfo();
+int APS5_VABI sceScreenShotGetDrcParam();
+int APS5_VABI sceScreenShotIsVshScreenCaptureDisabled();
+int APS5_VABI sceScreenShotSetDrcParam();
+int APS5_VABI sceScreenShotSetParam();
+
+}
diff --git a/core/libs/prx/libSceScreenShot/libSceScreenShot.hpp b/core/libs/prx/libSceScreenShot/libSceScreenShot.hpp
new file mode 100644
index 0000000000..4deaf512f2
--- /dev/null
+++ b/core/libs/prx/libSceScreenShot/libSceScreenShot.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceScreenShot/include/Api.hpp"
diff --git a/core/libs/prx/libSceSdma/Export.cpp b/core/libs/prx/libSceSdma/Export.cpp
index 97a2ea23cc..45a5fcc447 100644
--- a/core/libs/prx/libSceSdma/Export.cpp
+++ b/core/libs/prx/libSceSdma/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSdma/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
@@ -92,7 +93,6 @@ int APS5_VABI sceSdmaFenceNonBlocking(void) {
 }
 
 int APS5_VABI sceSdmaFinalize(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -102,12 +102,10 @@ int APS5_VABI sceSdmaFlushAll(void) {
 }
 
 int APS5_VABI sceSdmaFlushAllWithEvent(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x809900c9);
 }
 
 int APS5_VABI sceSdmaInitialize(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -122,8 +120,7 @@ int APS5_VABI sceSdmaOpen(void) {
 }
 
 int APS5_VABI sceSdmaQueryWorkingBufferSize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 0x8000;
 }
 
 int APS5_VABI sceSdmaTryFlush(void) {
@@ -132,8 +129,7 @@ int APS5_VABI sceSdmaTryFlush(void) {
 }
 
 int APS5_VABI sceSdmaWaitForEvent(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x809900c9);
 }
 
 }
diff --git a/core/libs/prx/libSceSdma/include/Api.hpp b/core/libs/prx/libSceSdma/include/Api.hpp
new file mode 100644
index 0000000000..1245319f43
--- /dev/null
+++ b/core/libs/prx/libSceSdma/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdmaBeginQueueMode(void);
+int APS5_VABI sceSdmaCancelQueue(void);
+int APS5_VABI sceSdmaClose(void);
+int APS5_VABI sceSdmaConstantFill(void);
+int APS5_VABI sceSdmaConstantFillNonBlocking(void);
+int APS5_VABI sceSdmaCopyLinear(void);
+int APS5_VABI sceSdmaCopyLinearNonBlocking(void);
+int APS5_VABI sceSdmaCopyTiled(void);
+int APS5_VABI sceSdmaCopyTiledNonBlocking(void);
+int APS5_VABI sceSdmaCopyWindowL2L(void);
+int APS5_VABI sceSdmaCopyWindowL2LNonBlocking(void);
+int APS5_VABI sceSdmaCopyWindowT2T(void);
+int APS5_VABI sceSdmaCopyWindowT2TNonBlocking(void);
+int APS5_VABI sceSdmaCopyWindowTiled(void);
+int APS5_VABI sceSdmaCopyWindowTiledNonBlocking(void);
+int APS5_VABI sceSdmaEndQueueMode(void);
+int APS5_VABI sceSdmaFenceNonBlocking(void);
+int APS5_VABI sceSdmaFinalize(void);
+int APS5_VABI sceSdmaFlushAll(void);
+int APS5_VABI sceSdmaFlushAllWithEvent(void);
+int APS5_VABI sceSdmaInitialize(void);
+int APS5_VABI sceSdmaKickQueue(void);
+int APS5_VABI sceSdmaOpen(void);
+int APS5_VABI sceSdmaQueryWorkingBufferSize(void);
+int APS5_VABI sceSdmaTryFlush(void);
+int APS5_VABI sceSdmaWaitForEvent(void);
+
+}
diff --git a/core/libs/prx/libSceSdma/libSceSdma.hpp b/core/libs/prx/libSceSdma/libSceSdma.hpp
new file mode 100644
index 0000000000..fdaa4a04c9
--- /dev/null
+++ b/core/libs/prx/libSceSdma/libSceSdma.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSdma/include/Api.hpp"
diff --git a/core/libs/prx/libSceShare.native/libSceShare.native.hpp b/core/libs/prx/libSceShare.native/libSceShare.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceShare.native/libSceShare.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceShare/Export.cpp b/core/libs/prx/libSceShare/Export.cpp
index 375682887e..e2f486e7f1 100644
--- a/core/libs/prx/libSceShare/Export.cpp
+++ b/core/libs/prx/libSceShare/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShare/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -6,22 +7,6 @@
 
 // Capture and sharing are not emulated; policy and parameter calls are accepted.
 
-struct ShareScreenshotParamExtended {
-    std::uint64_t size;
-    std::uint32_t source;
-    std::uint32_t mode;
-    const char* text;
-};
-
-struct ShareVideoClipParamExtended {
-    std::uint64_t size;
-    std::uint64_t value8;
-    std::uint64_t value16;
-    std::uint32_t mode;
-    std::uint32_t reserved;
-    const char* text;
-};
-
 static_assert(sizeof(ShareScreenshotParamExtended) == 24);
 static_assert(offsetof(ShareScreenshotParamExtended, text) == 16);
 static_assert(sizeof(ShareVideoClipParamExtended) == 40);
diff --git a/core/libs/prx/libSceShare/include/Api.hpp b/core/libs/prx/libSceShare/include/Api.hpp
new file mode 100644
index 0000000000..bb612024b1
--- /dev/null
+++ b/core/libs/prx/libSceShare/include/Api.hpp
@@ -0,0 +1,41 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct ShareScreenshotParamExtended {
+    std::uint64_t size;
+    std::uint32_t source;
+    std::uint32_t mode;
+    const char* text;
+};
+
+struct ShareVideoClipParamExtended {
+    std::uint64_t size;
+    std::uint64_t value8;
+    std::uint64_t value16;
+    std::uint32_t mode;
+    std::uint32_t reserved;
+    const char* text;
+};
+
+extern "C" {
+
+int APS5_VABI sceShareCaptureScreenshot(const void* param, int32_t* reqId);
+int APS5_VABI sceShareCaptureVideoClip(const void* param, int32_t* reqId);
+int APS5_VABI sceShareFeaturePermit(uint32_t featureFlags);
+int APS5_VABI sceShareFeatureProhibit(uint32_t featureFlags);
+int APS5_VABI sceShareGetCurrentStatus(uint32_t featureFlag, ShareCurrentStatus* status);
+int APS5_VABI sceShareInitialize(size_t heapSize, int threadPriority, uint64_t affinityMask);
+int APS5_VABI sceShareOpenMenuForContent(const void* contentId);
+int APS5_VABI sceShareRegisterContentEventCallback(void* callback, void* userData);
+int APS5_VABI sceShareSetCaptureSource(uint32_t featureFlags, const void* tapPoint);
+int APS5_VABI sceShareSetContentParam(const char* contentParam);
+int APS5_VABI sceShareSetScreenshotOverlayImage(const char* filePath, int32_t marginX, int32_t marginY, int32_t origin);
+int APS5_VABI sceShareTerminate(void);
+int APS5_VABI sceShareUnregisterContentEventCallback(void* callback);
+int APS5_VABI sceShareCaptureScreenshotExtended(const ShareScreenshotParamExtended* param, std::int32_t* requestId);
+int APS5_VABI sceShareCaptureVideoClipExtended(const ShareVideoClipParamExtended* param, std::int32_t* requestId);
+int APS5_VABI sceShareGetRunningStatus(uint32_t* status);
+int APS5_VABI sceShareSetContentParamForApplicationTitle(const char* applicationTitle);
+
+}
diff --git a/core/libs/prx/libSceShare/libSceShare.hpp b/core/libs/prx/libSceShare/libSceShare.hpp
new file mode 100644
index 0000000000..ee79c2f96a
--- /dev/null
+++ b/core/libs/prx/libSceShare/libSceShare.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShare/include/Api.hpp"
diff --git a/core/libs/prx/libSceShareFactoryUtil/Export.cpp b/core/libs/prx/libSceShareFactoryUtil/Export.cpp
index ca9e3680ad..e4b1de17d3 100644
--- a/core/libs/prx/libSceShareFactoryUtil/Export.cpp
+++ b/core/libs/prx/libSceShareFactoryUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShareFactoryUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceShareFactoryUtil/include/Api.hpp b/core/libs/prx/libSceShareFactoryUtil/include/Api.hpp
new file mode 100644
index 0000000000..23f6bad23e
--- /dev/null
+++ b/core/libs/prx/libSceShareFactoryUtil/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceShareFactoryUtilBackToGameFromShareFactory();
+int APS5_VABI sceShareFactoryUtilGetLaunchStatus();
+int APS5_VABI sceShareFactoryUtilGetLaunchStatusOfShareFactory();
+int APS5_VABI sceShareFactoryUtilInitialize();
+int APS5_VABI sceShareFactoryUtilLaunchShareFactory();
+int APS5_VABI sceShareFactoryUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceShareFactoryUtil/libSceShareFactoryUtil.hpp b/core/libs/prx/libSceShareFactoryUtil/libSceShareFactoryUtil.hpp
new file mode 100644
index 0000000000..7d666fde94
--- /dev/null
+++ b/core/libs/prx/libSceShareFactoryUtil/libSceShareFactoryUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShareFactoryUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceShareInternal.native/libSceShareInternal.native.hpp b/core/libs/prx/libSceShareInternal.native/libSceShareInternal.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceShareInternal.native/libSceShareInternal.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSharePlay/Export.cpp b/core/libs/prx/libSceSharePlay/Export.cpp
index 848b32427a..a19d94eb98 100644
--- a/core/libs/prx/libSceSharePlay/Export.cpp
+++ b/core/libs/prx/libSceSharePlay/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSharePlay/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <mutex>
@@ -50,8 +51,13 @@ int APS5_VABI sceSharePlayCrashDaemon(void) {
     return 0;
 }
 
-int APS5_VABI sceSharePlayGetCurrentConnectionInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceSharePlayGetCurrentConnectionInfo(SharePlayConnectionInfo* info) {
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) return SCE_SHARE_PLAY_ERROR_NOT_INITIALIZED;
+    if (info == nullptr) return SCE_SHARE_PLAY_ERROR_INVALID_ARGS;
+    *info = {};
+    info->hostUserId = SCE_USER_SERVICE_USER_ID_INVALID;
+    info->visitorUserId = SCE_USER_SERVICE_USER_ID_INVALID;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceSharePlay/include/Api.hpp b/core/libs/prx/libSceSharePlay/include/Api.hpp
new file mode 100644
index 0000000000..317c0dc43c
--- /dev/null
+++ b/core/libs/prx/libSceSharePlay/include/Api.hpp
@@ -0,0 +1,28 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSharePlayInitialize(void* heap, size_t heapSize);
+int APS5_VABI sceSharePlayTerminate(void);
+int APS5_VABI sceSharePlayGetCurrentConnectionInfoA(SharePlayConnectionInfoA* info);
+int APS5_VABI sceSharePlayProhibitController(std::uint8_t prohibited);
+int APS5_VABI sceSharePlayCrashDaemon(void);
+int APS5_VABI sceSharePlayGetCurrentConnectionInfo(SharePlayConnectionInfo* info);
+int APS5_VABI sceSharePlayGetCurrentInfo(void);
+int APS5_VABI sceSharePlayGetEvent(void);
+int APS5_VABI sceSharePlayNotifyDialogOpen(void);
+int APS5_VABI sceSharePlayNotifyForceCloseForCdlg(void);
+int APS5_VABI sceSharePlayResumeScreenForCdlg(void);
+int APS5_VABI sceSharePlayServerLock(void);
+int APS5_VABI sceSharePlayServerUnLock(void);
+int APS5_VABI sceSharePlaySetMode(void);
+int APS5_VABI sceSharePlaySetProhibition(void);
+int APS5_VABI sceSharePlaySetProhibitionModeWithAppId(void);
+int APS5_VABI sceSharePlayStartStandby(void);
+int APS5_VABI sceSharePlayStartStreaming(void);
+int APS5_VABI sceSharePlayStopStandby(void);
+int APS5_VABI sceSharePlayStopStreaming(void);
+
+}
diff --git a/core/libs/prx/libSceSharePlay/libSceSharePlay.hpp b/core/libs/prx/libSceSharePlay/libSceSharePlay.hpp
new file mode 100644
index 0000000000..c68e519720
--- /dev/null
+++ b/core/libs/prx/libSceSharePlay/libSceSharePlay.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSharePlay/include/Api.hpp"
diff --git a/core/libs/prx/libSceShareUtility/Export.cpp b/core/libs/prx/libSceShareUtility/Export.cpp
index b8d35a3625..a6cf891afd 100644
--- a/core/libs/prx/libSceShareUtility/Export.cpp
+++ b/core/libs/prx/libSceShareUtility/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShareUtility/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceShareUtility/include/Api.hpp b/core/libs/prx/libSceShareUtility/include/Api.hpp
new file mode 100644
index 0000000000..9ea97606cc
--- /dev/null
+++ b/core/libs/prx/libSceShareUtility/include/Api.hpp
@@ -0,0 +1,30 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceShareUtilityAdvanceFromFileWithContentIdList();
+int APS5_VABI sceShareUtilityAdvanceFromFileWithTitleIdList();
+int APS5_VABI sceShareUtilityAdvanceGetServiceInfo();
+int APS5_VABI sceShareUtilityAdvanceInitialize();
+int APS5_VABI sceShareUtilityAdvanceQueryServiceInfo();
+int APS5_VABI sceShareUtilityAdvanceQueryServiceInfoA();
+int APS5_VABI sceShareUtilityAdvanceResetPlayingContent();
+int APS5_VABI sceShareUtilityAdvanceSetPlayingContent();
+int APS5_VABI sceShareUtilityAdvanceSetUploadContentData();
+int APS5_VABI sceShareUtilityAdvanceTerminate();
+int APS5_VABI sceShareUtilityAdvanceValidateContents();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenu();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuBroadcast();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuDefault();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuForShareContent();
+int APS5_VABI sceShareUtilityInitialize();
+int APS5_VABI sceShareUtilityInitializeEx2();
+int APS5_VABI sceShareUtilityOpenShareMenu();
+int APS5_VABI sceShareUtilityOpenShareMenuBroadcast();
+int APS5_VABI sceShareUtilityOpenShareMenuDefault();
+int APS5_VABI sceShareUtilityOpenShareMenuForShareContent();
+int APS5_VABI sceShareUtilityTerminate();
+
+}
diff --git a/core/libs/prx/libSceShareUtility/libSceShareUtility.hpp b/core/libs/prx/libSceShareUtility/libSceShareUtility.hpp
new file mode 100644
index 0000000000..90968950c3
--- /dev/null
+++ b/core/libs/prx/libSceShareUtility/libSceShareUtility.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShareUtility/include/Api.hpp"
diff --git a/core/libs/prx/libSceShellUIUtil/Export.cpp b/core/libs/prx/libSceShellUIUtil/Export.cpp
index 2837093a4f..3381c8bd7f 100644
--- a/core/libs/prx/libSceShellUIUtil/Export.cpp
+++ b/core/libs/prx/libSceShellUIUtil/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceShellUIUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct ShellUIUtilLaunchParameter;
-
 extern "C" {
 
 int APS5_VABI sceShellUIUtilCreateTaskToken() {
diff --git a/core/libs/prx/libSceShellUIUtil/include/Api.hpp b/core/libs/prx/libSceShellUIUtil/include/Api.hpp
new file mode 100644
index 0000000000..fe2e641916
--- /dev/null
+++ b/core/libs/prx/libSceShellUIUtil/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct ShellUIUtilLaunchParameter;
+
+extern "C" {
+
+int APS5_VABI sceShellUIUtilCreateTaskToken();
+int APS5_VABI sceShellUIUtilGetAppUrl(const char* application, const char* parameter, char* output, std::uint32_t capacity, std::uint32_t* outputSize);
+int APS5_VABI sceShellUIUtilInitialize();
+int APS5_VABI sceShellUIUtilLaunchByUri(const char* uri, const ShellUIUtilLaunchParameter* parameter);
+int APS5_VABI sceShellUIUtilLaunchTask(std::int32_t taskToken, const char* uri, char* output, std::uint32_t capacity);
+int APS5_VABI sceShellUIUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceShellUIUtil/libSceShellUIUtil.hpp b/core/libs/prx/libSceShellUIUtil/libSceShellUIUtil.hpp
new file mode 100644
index 0000000000..0b7294088c
--- /dev/null
+++ b/core/libs/prx/libSceShellUIUtil/libSceShellUIUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShellUIUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceSigninDialog/Export.cpp b/core/libs/prx/libSceSigninDialog/Export.cpp
index 761bf33308..cd55802e70 100644
--- a/core/libs/prx/libSceSigninDialog/Export.cpp
+++ b/core/libs/prx/libSceSigninDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSigninDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceSigninDialog/include/Api.hpp b/core/libs/prx/libSceSigninDialog/include/Api.hpp
new file mode 100644
index 0000000000..5d9a45ed41
--- /dev/null
+++ b/core/libs/prx/libSceSigninDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSigninDialogClose(void);
+int APS5_VABI sceSigninDialogGetResult(void* result);
+int APS5_VABI sceSigninDialogGetStatus(void);
+int APS5_VABI sceSigninDialogInitialize(void);
+int APS5_VABI sceSigninDialogOpen(const void* param);
+int APS5_VABI sceSigninDialogTerminate(void);
+int APS5_VABI sceSigninDialogUpdateStatus(void);
+
+}
diff --git a/core/libs/prx/libSceSigninDialog/libSceSigninDialog.hpp b/core/libs/prx/libSceSigninDialog/libSceSigninDialog.hpp
new file mode 100644
index 0000000000..5791aba9bb
--- /dev/null
+++ b/core/libs/prx/libSceSigninDialog/libSceSigninDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSigninDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceSmart/libSceSmart.hpp b/core/libs/prx/libSceSmart/libSceSmart.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceSmart/libSceSmart.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSocialScreen/Export.cpp b/core/libs/prx/libSceSocialScreen/Export.cpp
index ebaf31823a..31e90003c8 100644
--- a/core/libs/prx/libSceSocialScreen/Export.cpp
+++ b/core/libs/prx/libSceSocialScreen/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSocialScreen/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSocialScreen/include/Api.hpp b/core/libs/prx/libSceSocialScreen/include/Api.hpp
new file mode 100644
index 0000000000..77d98b1b85
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreen/include/Api.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSocialScreenCloseSeparateMode();
+int APS5_VABI sceSocialScreenConfigureSeparateMode();
+int APS5_VABI sceSocialScreenCrashDaemon();
+int APS5_VABI sceSocialScreenGetIgnoreSeparateMode();
+int APS5_VABI sceSocialScreenInitialize();
+int APS5_VABI sceSocialScreenInitializeSeparateModeParameter();
+int APS5_VABI sceSocialScreenOpenSeparateMode();
+int APS5_VABI sceSocialScreenReserveHighFrameRateVideoCaptureRequest();
+int APS5_VABI sceSocialScreenSetIgnoreSeparateMode();
+int APS5_VABI sceSocialScreenSetMode();
+int APS5_VABI sceSocialScreenTerminate();
+
+}
diff --git a/core/libs/prx/libSceSocialScreen/libSceSocialScreen.hpp b/core/libs/prx/libSceSocialScreen/libSceSocialScreen.hpp
new file mode 100644
index 0000000000..c3678800c1
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreen/libSceSocialScreen.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSocialScreen/include/Api.hpp"
diff --git a/core/libs/prx/libSceSocialScreenDialog/Export.cpp b/core/libs/prx/libSceSocialScreenDialog/Export.cpp
index c3c5849381..b12bb6631e 100644
--- a/core/libs/prx/libSceSocialScreenDialog/Export.cpp
+++ b/core/libs/prx/libSceSocialScreenDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSocialScreenDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceSocialScreenDialog/include/Api.hpp b/core/libs/prx/libSceSocialScreenDialog/include/Api.hpp
new file mode 100644
index 0000000000..1c02a641d8
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreenDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSocialScreenDialogInitialize(void);
+int APS5_VABI sceSocialScreenDialogOpen(const void* param);
+int APS5_VABI sceSocialScreenDialogUpdateStatus(void);
+int APS5_VABI sceSocialScreenDialogGetStatus(void);
+int APS5_VABI sceSocialScreenDialogGetResult(void* result);
+int APS5_VABI sceSocialScreenDialogClose(void);
+int APS5_VABI sceSocialScreenDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceSocialScreenDialog/libSceSocialScreenDialog.hpp b/core/libs/prx/libSceSocialScreenDialog/libSceSocialScreenDialog.hpp
new file mode 100644
index 0000000000..91b1893527
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreenDialog/libSceSocialScreenDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSocialScreenDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceSpSysCallWrapper/CMakeLists.txt b/core/libs/prx/libSceSpSysCallWrapper/CMakeLists.txt
new file mode 100644
index 0000000000..5e407e9a37
--- /dev/null
+++ b/core/libs/prx/libSceSpSysCallWrapper/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceSpSysCallWrapper SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceSpSysCallWrapper PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceSpSysCallWrapper PRIVATE libSceNet)
+configure_windows_unwind(libSceSpSysCallWrapper)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_sp_syscall_wrapper_tests ${LIBS_INCLUDE_DIR}/tests/GuestSpSysCallWrapper.cpp)
+    target_include_directories(guest_sp_syscall_wrapper_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_sp_syscall_wrapper_tests PRIVATE libSceSpSysCallWrapper libSceNet libkernel libc)
+    configure_windows_unwind(guest_sp_syscall_wrapper_tests)
+    add_test(NAME guest_sp_syscall_wrapper COMMAND guest_sp_syscall_wrapper_tests)
+    if(WIN32)
+        set_tests_properties(guest_sp_syscall_wrapper PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceSpSysCallWrapper>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceSpSysCallWrapper/Export.cpp b/core/libs/prx/libSceSpSysCallWrapper/Export.cpp
index e15c0a9054..f0db9348f5 100644
--- a/core/libs/prx/libSceSpSysCallWrapper/Export.cpp
+++ b/core/libs/prx/libSceSpSysCallWrapper/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp"
+#include "prx/libSceNet/libSceNet.hpp"
+#include "prx/libkernel/libkernel.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,219 +8,179 @@
 
 extern "C" {
 
+std::int64_t APS5_VABI GuestNetRecv_nid_no_patch(int s, void* buf, std::size_t len, int flags);
+std::int64_t APS5_VABI GuestNetSend_nid_no_patch(int s, const void* buf, std::size_t len, int flags);
+
 int APS5_VABI sceSpGetPid() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return getpid_nid_postfix();
 }
 
-int APS5_VABI sceSpKernelGettimeofday() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpKernelGettimeofday(KernelTimeval* tp) {
+    return sceKernelGettimeofday(tp);
 }
 
-int APS5_VABI sceSpKernelNanosleep() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpKernelNanosleep(const KernelTimespec* rqtp, KernelTimespec* rmtp) {
+    return sceKernelNanosleep(rqtp, rmtp);
 }
 
-int APS5_VABI sceSpNetConnect() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetConnect(int s, const void* addr, std::uint32_t addrlen) {
+    return sceNetConnect(s, addr, addrlen);
 }
 
-int APS5_VABI sceSpNetEpollAbort() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetEpollAbort(int eid, int flags) {
+    return sceNetEpollAbort(eid, flags);
 }
 
-int APS5_VABI sceSpNetEpollControl() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetEpollControl(int eid, int op, int id, const void* event) {
+    return sceNetEpollControl(eid, op, id, static_cast<const NetEpollEvent*>(event));
 }
 
-int APS5_VABI sceSpNetEpollCreate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetEpollCreate(const char* name, int flags) {
+    return sceNetEpollCreate(name, flags);
 }
 
-int APS5_VABI sceSpNetEpollDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetEpollDestroy(int eid) {
+    return sceNetEpollDestroy(eid);
 }
 
-int APS5_VABI sceSpNetEpollWait() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetEpollWait(int eid, void* events, int maxevents, int timeout) {
+    return sceNetEpollWait(eid, static_cast<NetEpollEvent*>(events), maxevents, timeout);
 }
 
-int APS5_VABI sceSpNetErrnoLoc() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int* APS5_VABI sceSpNetErrnoLoc() {
+    return sceNetErrnoLoc();
 }
 
-int APS5_VABI sceSpNetPoolCreate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetPoolCreate(const char* name, int size, int flags) {
+    return sceNetPoolCreate(name, size, flags);
 }
 
-int APS5_VABI sceSpNetPoolDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetPoolDestroy(int memid) {
+    return sceNetPoolDestroy(memid);
 }
 
-int APS5_VABI sceSpNetRecv() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceSpNetRecv(int s, void* buf, std::size_t len, int flags) {
+    return GuestNetRecv_nid_no_patch(s, buf, len, flags);
 }
 
-int APS5_VABI sceSpNetResolverAbort() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetResolverAbort(int rid, int flags) {
+    return sceNetResolverAbort(rid, flags);
 }
 
-int APS5_VABI sceSpNetResolverCreate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetResolverCreate(const char* name, int memid, int flags) {
+    return sceNetResolverCreate(name, memid, flags);
 }
 
-int APS5_VABI sceSpNetResolverDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetResolverDestroy(int rid) {
+    return sceNetResolverDestroy(rid);
 }
 
-int APS5_VABI sceSpNetResolverGetError() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetResolverGetError(int rid, int* status) {
+    return sceNetResolverGetError(rid, status);
 }
 
-int APS5_VABI sceSpNetResolverStartNtoa() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetResolverStartNtoa(int rid, const char* hostname, void* addr, int timeout, int retry, int flags) {
+    return sceNetResolverStartNtoa(rid, hostname, addr, timeout, retry, flags);
 }
 
-int APS5_VABI sceSpNetSend() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceSpNetSend(int s, const void* buf, std::size_t len, int flags) {
+    return GuestNetSend_nid_no_patch(s, buf, len, flags);
 }
 
-int APS5_VABI sceSpNetSetsockopt() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetSetsockopt(int s, int level, int optname, const void* optval, std::uint32_t optlen) {
+    return sceNetSetsockopt(s, level, optname, optval, optlen);
 }
 
-int APS5_VABI sceSpNetSocket() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetSocket(const char* name, int family, int type, int protocol) {
+    return sceNetSocket(name, family, type, protocol);
 }
 
-int APS5_VABI sceSpNetSocketClose() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpNetSocketClose(int s) {
+    return sceNetSocketClose(s);
 }
 
-int APS5_VABI sceSpPthreadAttrDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadAttrDestroy(PthreadAttr* attr) {
+    return scePthreadAttrDestroy(attr);
 }
 
-int APS5_VABI sceSpPthreadAttrInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadAttrInit(PthreadAttr* attr) {
+    return scePthreadAttrInit(attr);
 }
 
-int APS5_VABI sceSpPthreadAttrSetinheritsched() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched) {
+    return scePthreadAttrSetinheritsched(attr, inheritSched);
 }
 
-int APS5_VABI sceSpPthreadAttrSetschedparam() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param) {
+    return scePthreadAttrSetschedparam(attr, param);
 }
 
-int APS5_VABI sceSpPthreadAttrSetstacksize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize) {
+    return scePthreadAttrSetstacksize(attr, stackSize);
 }
 
-int APS5_VABI sceSpPthreadCondDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadCondDestroy(PthreadCond* cond) {
+    return scePthreadCondDestroy(cond);
 }
 
-int APS5_VABI sceSpPthreadCondInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name) {
+    return scePthreadCondInit(cond, attr, name);
 }
 
-int APS5_VABI sceSpPthreadCondSignal() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadCondSignal(PthreadCond* cond) {
+    return scePthreadCondSignal(cond);
 }
 
-int APS5_VABI sceSpPthreadCondWait() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadCondWait(PthreadCond* cond, PthreadMutex* mutex) {
+    return scePthreadCondWait(cond, mutex);
 }
 
-int APS5_VABI sceSpPthreadCondattrDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadCondattrDestroy(PthreadCondattr* attr) {
+    return scePthreadCondattrDestroy(attr);
 }
 
-int APS5_VABI sceSpPthreadCondattrInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadCondattrInit(PthreadCondattr* attr) {
+    return scePthreadCondattrInit(attr);
 }
 
-int APS5_VABI sceSpPthreadCreate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name) {
+    return scePthreadCreate(thread, attr, entry, arg, name);
 }
 
-int APS5_VABI sceSpPthreadDetach() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadDetach(Pthread thread) {
+    return scePthreadDetach(thread);
 }
 
-int APS5_VABI sceSpPthreadExit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI sceSpPthreadExit(void* retval) {
+    scePthreadExit(retval);
 }
 
-int APS5_VABI sceSpPthreadJoin() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadJoin(Pthread thread, void** retval) {
+    return scePthreadJoin(thread, retval);
 }
 
-int APS5_VABI sceSpPthreadMutexDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexDestroy(PthreadMutex* mutex) {
+    return scePthreadMutexDestroy(mutex);
 }
 
-int APS5_VABI sceSpPthreadMutexInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name) {
+    return scePthreadMutexInit(mutex, attr, name);
 }
 
-int APS5_VABI sceSpPthreadMutexLock() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexLock(PthreadMutex* mutex) {
+    return scePthreadMutexLock(mutex);
 }
 
-int APS5_VABI sceSpPthreadMutexUnlock() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexUnlock(PthreadMutex* mutex) {
+    return scePthreadMutexUnlock(mutex);
 }
 
-int APS5_VABI sceSpPthreadMutexattrDestroy() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexattrDestroy(PthreadMutexattr* attr) {
+    return scePthreadMutexattrDestroy(attr);
 }
 
-int APS5_VABI sceSpPthreadMutexattrInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexattrInit(PthreadMutexattr* attr) {
+    return scePthreadMutexattrInit(attr);
 }
 
 int APS5_VABI sceSpPthreadMutexattrSetprioceiling() {
@@ -225,24 +188,20 @@ int APS5_VABI sceSpPthreadMutexattrSetprioceiling() {
     return 0;
 }
 
-int APS5_VABI sceSpPthreadMutexattrSetprotocol() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol) {
+    return scePthreadMutexattrSetprotocol(attr, protocol);
 }
 
-int APS5_VABI sceSpPthreadMutexattrSettype() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadMutexattrSettype(PthreadMutexattr* attr, int type) {
+    return scePthreadMutexattrSettype(attr, type);
 }
 
-int APS5_VABI sceSpPthreadSetprio() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpPthreadSetprio(Pthread thread, int prio) {
+    return scePthreadSetprio(thread, prio);
 }
 
-int APS5_VABI sceSpSelect() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceSpSelect(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout) {
+    return select_nid_postfix(nfds, readfds, writefds, exceptfds, timeout);
 }
 
 }
diff --git a/core/libs/prx/libSceSpSysCallWrapper/include/Api.hpp b/core/libs/prx/libSceSpSysCallWrapper/include/Api.hpp
new file mode 100644
index 0000000000..10979d9d31
--- /dev/null
+++ b/core/libs/prx/libSceSpSysCallWrapper/include/Api.hpp
@@ -0,0 +1,58 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSpGetPid();
+int APS5_VABI sceSpKernelGettimeofday(KernelTimeval* tp);
+int APS5_VABI sceSpKernelNanosleep(const KernelTimespec* rqtp, KernelTimespec* rmtp);
+int APS5_VABI sceSpNetConnect(int s, const void* addr, std::uint32_t addrlen);
+int APS5_VABI sceSpNetEpollAbort(int eid, int flags);
+int APS5_VABI sceSpNetEpollControl(int eid, int op, int id, const void* event);
+int APS5_VABI sceSpNetEpollCreate(const char* name, int flags);
+int APS5_VABI sceSpNetEpollDestroy(int eid);
+int APS5_VABI sceSpNetEpollWait(int eid, void* events, int maxevents, int timeout);
+int* APS5_VABI sceSpNetErrnoLoc();
+int APS5_VABI sceSpNetPoolCreate(const char* name, int size, int flags);
+int APS5_VABI sceSpNetPoolDestroy(int memid);
+std::int64_t APS5_VABI sceSpNetRecv(int s, void* buf, std::size_t len, int flags);
+int APS5_VABI sceSpNetResolverAbort(int rid, int flags);
+int APS5_VABI sceSpNetResolverCreate(const char* name, int memid, int flags);
+int APS5_VABI sceSpNetResolverDestroy(int rid);
+int APS5_VABI sceSpNetResolverGetError(int rid, int* status);
+int APS5_VABI sceSpNetResolverStartNtoa(int rid, const char* hostname, void* addr, int timeout, int retry, int flags);
+std::int64_t APS5_VABI sceSpNetSend(int s, const void* buf, std::size_t len, int flags);
+int APS5_VABI sceSpNetSetsockopt(int s, int level, int optname, const void* optval, std::uint32_t optlen);
+int APS5_VABI sceSpNetSocket(const char* name, int family, int type, int protocol);
+int APS5_VABI sceSpNetSocketClose(int s);
+int APS5_VABI sceSpPthreadAttrDestroy(PthreadAttr* attr);
+int APS5_VABI sceSpPthreadAttrInit(PthreadAttr* attr);
+int APS5_VABI sceSpPthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
+int APS5_VABI sceSpPthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
+int APS5_VABI sceSpPthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
+int APS5_VABI sceSpPthreadCondDestroy(PthreadCond* cond);
+int APS5_VABI sceSpPthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
+int APS5_VABI sceSpPthreadCondSignal(PthreadCond* cond);
+int APS5_VABI sceSpPthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
+int APS5_VABI sceSpPthreadCondattrDestroy(PthreadCondattr* attr);
+int APS5_VABI sceSpPthreadCondattrInit(PthreadCondattr* attr);
+int APS5_VABI sceSpPthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
+int APS5_VABI sceSpPthreadDetach(Pthread thread);
+void APS5_VABI sceSpPthreadExit(void* retval);
+int APS5_VABI sceSpPthreadJoin(Pthread thread, void** retval);
+int APS5_VABI sceSpPthreadMutexDestroy(PthreadMutex* mutex);
+int APS5_VABI sceSpPthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
+int APS5_VABI sceSpPthreadMutexLock(PthreadMutex* mutex);
+int APS5_VABI sceSpPthreadMutexUnlock(PthreadMutex* mutex);
+int APS5_VABI sceSpPthreadMutexattrDestroy(PthreadMutexattr* attr);
+int APS5_VABI sceSpPthreadMutexattrInit(PthreadMutexattr* attr);
+int APS5_VABI sceSpPthreadMutexattrSetprioceiling();
+int APS5_VABI sceSpPthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol);
+int APS5_VABI sceSpPthreadMutexattrSettype(PthreadMutexattr* attr, int type);
+int APS5_VABI sceSpPthreadSetprio(Pthread thread, int prio);
+int APS5_VABI sceSpSelect(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout);
+
+}
diff --git a/core/libs/prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp b/core/libs/prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp
new file mode 100644
index 0000000000..452ed7469c
--- /dev/null
+++ b/core/libs/prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSpSysCallWrapper/include/Api.hpp"
diff --git a/core/libs/prx/libSceSrcUtl/Export.cpp b/core/libs/prx/libSceSrcUtl/Export.cpp
index fac2eada51..3494cee76b 100644
--- a/core/libs/prx/libSceSrcUtl/Export.cpp
+++ b/core/libs/prx/libSceSrcUtl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSrcUtl/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSrcUtl/include/Api.hpp b/core/libs/prx/libSceSrcUtl/include/Api.hpp
new file mode 100644
index 0000000000..b4db4c7c48
--- /dev/null
+++ b/core/libs/prx/libSceSrcUtl/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSrcUtilityFinalize();
+int APS5_VABI sceSrcUtilityFlush();
+int APS5_VABI sceSrcUtilityGetDelaySamples();
+int APS5_VABI sceSrcUtilityGetHandleSize();
+int APS5_VABI sceSrcUtilityGetPriority();
+int APS5_VABI sceSrcUtilityInitialize();
+int APS5_VABI sceSrcUtilityInitializeEx();
+int APS5_VABI sceSrcUtilityResample();
+int APS5_VABI sceSrcUtilitySetPriority();
+
+}
diff --git a/core/libs/prx/libSceSrcUtl/libSceSrcUtl.hpp b/core/libs/prx/libSceSrcUtl/libSceSrcUtl.hpp
new file mode 100644
index 0000000000..cf118c2ada
--- /dev/null
+++ b/core/libs/prx/libSceSrcUtl/libSceSrcUtl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSrcUtl/include/Api.hpp"
diff --git a/core/libs/prx/libSceSsl/CMakeLists.txt b/core/libs/prx/libSceSsl/CMakeLists.txt
index cb39ff0e4c..8296a60735 100644
--- a/core/libs/prx/libSceSsl/CMakeLists.txt
+++ b/core/libs/prx/libSceSsl/CMakeLists.txt
@@ -90,9 +90,16 @@ if(BUILD_TESTING)
     target_link_libraries(guest_ssl_ps5_readers_tests PRIVATE libSceSsl libc)
     configure_windows_unwind(guest_ssl_ps5_readers_tests)
     add_test(NAME guest_ssl_ps5_readers COMMAND guest_ssl_ps5_readers_tests)
+    add_test_executable(guest_ssl_context_lifetime_tests ${LIBS_INCLUDE_DIR}/tests/SslContextLifetime.cpp)
+    target_include_directories(guest_ssl_context_lifetime_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_ssl_context_lifetime_tests PRIVATE libc mbedtls mbedx509 mbedcrypto)
+    configure_windows_unwind(guest_ssl_context_lifetime_tests)
+    add_test(NAME guest_ssl_context_lifetime COMMAND guest_ssl_context_lifetime_tests)
+    set_tests_properties(guest_ssl_context_lifetime PROPERTIES TIMEOUT 30)
     if(WIN32)
         target_link_libraries(guest_ssl_transport_tests PRIVATE bcrypt ws2_32)
-        set_tests_properties(guest_ssl guest_ssl_load guest_ssl_ps5_readers guest_ssl_transport_kernel guest_ssl_transport_net PROPERTIES ENVIRONMENT_MODIFICATION
+        target_link_libraries(guest_ssl_context_lifetime_tests PRIVATE bcrypt ws2_32)
+        set_tests_properties(guest_ssl guest_ssl_load guest_ssl_ps5_readers guest_ssl_context_lifetime guest_ssl_transport_kernel guest_ssl_transport_net PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceSsl>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceSsl/Export.cpp b/core/libs/prx/libSceSsl/Export.cpp
index ceb7654ba3..a3ae4afcec 100644
--- a/core/libs/prx/libSceSsl/Export.cpp
+++ b/core/libs/prx/libSceSsl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #ifdef _WIN32
 #include <winsock2.h>
 #else
@@ -466,8 +467,6 @@ struct Session {
     }
 };
 
-using SslVerifyCallback = int (APS5_VABI *)(int, unsigned int, void**, int, void*);
-
 constexpr int SslVersionSsl30 = 2;
 constexpr int SslVersionTls12 = 5;
 
@@ -657,7 +656,9 @@ int APS5_VABI sceSslInit_nid_postfix(std::uint64_t poolSize) {
 int APS5_VABI sceSslTerm_nid_postfix(int sslCtxId) {
     auto& state = State();
     std::lock_guard lock(state.mutex);
-    if (!state.contexts.erase(sslCtxId)) return ErrorInvalidId;
+    if (!state.contexts.contains(sslCtxId)) return ErrorInvalidId;
+    std::erase_if(state.connections, [sslCtxId](const auto& entry) { return entry.second.context == sslCtxId; });
+    state.contexts.erase(sslCtxId);
     return 0;
 }
 
@@ -1262,7 +1263,6 @@ int APS5_VABI CRYPTO_initAsymmetricKey() {
 }
 
 int APS5_VABI CRYPTO_uninitAsymmetricKey() {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -1272,7 +1272,6 @@ int APS5_VABI RSA_verifySignature() {
 }
 
 int APS5_VABI VLONG_freeVlongQueue() {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -1354,4 +1353,9 @@ int APS5_VABI sceSslSetSslVersion() {
     return 0;
 }
 
+int APS5_VABI sceSslSetServerName() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceSsl/include/Ssl.hpp b/core/libs/prx/libSceSsl/include/Ssl.hpp
new file mode 100644
index 0000000000..5de6ba4c60
--- /dev/null
+++ b/core/libs/prx/libSceSsl/include/Ssl.hpp
@@ -0,0 +1,66 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "prx/libSceSsl/SslTypes.hpp"
+
+using SslVerifyCallback = int (APS5_VABI *)(int, unsigned int, void**, int, void*);
+
+extern "C" {
+
+int APS5_VABI sceSslInit_nid_postfix(std::uint64_t poolSize);
+int APS5_VABI sceSslTerm_nid_postfix(int sslCtxId);
+int APS5_VABI sceSslGetMemoryPoolStats(int sslCtxId, SceSsl::MemoryPoolStats* stats);
+int APS5_VABI sceSslLoadCert(int sslCtxId, int caCertNum, SceSsl::Data** caList, SceSsl::Data* cert, SceSsl::Data* privateKey);
+int APS5_VABI sceSslUnloadCert(int sslCtxId);
+int APS5_VABI sceSslGetCaList(int sslCtxId, SceSsl::CaList* output);
+int APS5_VABI sceSslFreeCaList(int sslCtxId, SceSsl::CaList* list);
+int APS5_VABI sceSslGetCaCerts(int sslCtxId, SceSsl::CaCerts* output);
+int APS5_VABI sceSslFreeCaCerts(int sslCtxId, SceSsl::CaCerts* certificates);
+int APS5_VABI sceSslCreateConnection(int sslCtxId, int sockId, const char* host);
+int APS5_VABI sceSslDeleteConnection(int sslConnectionId);
+int APS5_VABI sceSslSetVerifyCallback(int sslConnectionId, SslVerifyCallback cbfunc, void* userArg);
+int APS5_VABI sceSslConnect(int sslConnectionId);
+int APS5_VABI sceSslRead(int sslConnectionId, void* buf, size_t len, int flags);
+int APS5_VABI sceSslWrite(int sslConnectionId, void* buf, size_t len, int flags);
+int APS5_VABI sceSslClose(int sslConnectionId);
+int APS5_VABI sceSslGetSerialNumber(int sslCtxId, void* sslCert, unsigned char* sboData, std::size_t* sboLen);
+int APS5_VABI sceSslFreeSslCertName(int sslCtxId, void* certName);
+int APS5_VABI sceSslEnableVerifyOption(int sslConnectionId, std::uint32_t option);
+int APS5_VABI sceSslDisableVerifyOption(int sslConnectionId, std::uint32_t option);
+const char* APS5_VABI sceSslGetAlpnSelected(int sslConnectionId);
+int APS5_VABI sceSslSetAlpn(int sslConnectionId, const char* proto);
+int APS5_VABI sceSslSetMinSslVersion(int sslConnectionId, int version);
+void* APS5_VABI sceSslGetIssuerName(int sslCtxId, void* sslCert);
+int APS5_VABI sceSslGetNameEntryCount(int sslCtxId, void* certName);
+int APS5_VABI sceSslGetNameEntryInfo(int sslCtxId, void* certName, int entryNum, char* oidname, std::size_t maxOidnameLen, char* value, std::size_t maxValueLen, std::size_t* valueLen);
+int APS5_VABI sceSslGetNotBefore(int sslCtxId, void* sslCert, SceSsl::RtcTick* begin);
+int APS5_VABI sceSslGetNotAfter(int sslCtxId, void* sslCert, SceSsl::RtcTick* limit);
+int APS5_VABI sceSslGetFingerprint(int sslCtxId, void* sslCert, int hashType, unsigned char* fingerprint);
+int APS5_VABI sceSslGetPem(int sslCtxId, void* sslCert, char* buf, std::size_t* bufLen);
+void* APS5_VABI sceSslGetSubjectName(int sslCtxId, void* sslCert);
+int APS5_VABI CA_MGMT_extractKeyBlobEx();
+int APS5_VABI CA_MGMT_extractPublicKeyInfo();
+int APS5_VABI CA_MGMT_freeKeyBlob();
+int APS5_VABI CRYPTO_initAsymmetricKey();
+int APS5_VABI CRYPTO_uninitAsymmetricKey();
+int APS5_VABI RSA_verifySignature();
+int APS5_VABI VLONG_freeVlongQueue();
+int APS5_VABI sceSslCheckRecvPending();
+int APS5_VABI sceSslCreateSslConnection();
+int APS5_VABI sceSslDeleteSslConnection();
+int APS5_VABI sceSslDisableOption();
+int APS5_VABI sceSslDisableOptionInternal();
+int APS5_VABI sceSslDisableOptionInternalInsecure();
+int APS5_VABI sceSslEnableOption();
+int APS5_VABI sceSslEnableOptionInternal();
+int APS5_VABI sceSslGetNanoSSLModuleId();
+int APS5_VABI sceSslGetPeerCert();
+int APS5_VABI sceSslGetSslError();
+int APS5_VABI sceSslLoadRootCACert();
+int APS5_VABI sceSslRecv(int sslConnectionId, void* buf, std::size_t fulllen);
+int APS5_VABI sceSslReuseConnection(int sslConnectionId, int sockId);
+int APS5_VABI sceSslSend(int sslConnectionId, void* msg, std::size_t fulllen);
+int APS5_VABI sceSslSetSslVersion();
+int APS5_VABI sceSslSetServerName();
+
+}
diff --git a/core/libs/prx/libSceSsl/libSceSsl.hpp b/core/libs/prx/libSceSsl/libSceSsl.hpp
new file mode 100644
index 0000000000..731f181cb2
--- /dev/null
+++ b/core/libs/prx/libSceSsl/libSceSsl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSsl/include/Ssl.hpp"
diff --git a/core/libs/prx/libSceSulphaDrv/CMakeLists.txt b/core/libs/prx/libSceSulphaDrv/CMakeLists.txt
new file mode 100644
index 0000000000..649d75c4d0
--- /dev/null
+++ b/core/libs/prx/libSceSulphaDrv/CMakeLists.txt
@@ -0,0 +1,15 @@
+add_library(libSceSulphaDrv SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceSulphaDrv PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceSulphaDrv)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_sulpha_config_tests ${LIBS_INCLUDE_DIR}/tests/GuestSulphaConfig.cpp)
+    target_include_directories(guest_sulpha_config_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_sulpha_config_tests PRIVATE libSceSulphaDrv libc)
+    configure_windows_unwind(guest_sulpha_config_tests)
+    add_test(NAME guest_sulpha_config COMMAND guest_sulpha_config_tests)
+    if(WIN32)
+        set_tests_properties(guest_sulpha_config PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceSulphaDrv>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceSulphaDrv/Export.cpp b/core/libs/prx/libSceSulphaDrv/Export.cpp
index b956051655..a40021ac2d 100644
--- a/core/libs/prx/libSceSulphaDrv/Export.cpp
+++ b/core/libs/prx/libSceSulphaDrv/Export.cpp
@@ -1,5 +1,7 @@
+#include "prx/libSceSulphaDrv/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
@@ -16,8 +18,10 @@ int APS5_VABI sceSulphaGetConnectedClientCount(void) {
     return 0;
 }
 
-int APS5_VABI sceSulphaGetDefaultConfig(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceSulphaGetDefaultConfig(void* config) {
+    if (config == nullptr) return static_cast<int>(0x804D0003u);
+    static constexpr std::uint64_t defaults[]{24, 0x400000, 0xFA100000003};
+    std::memcpy(config, defaults, sizeof(defaults));
     return 0;
 }
 
diff --git a/core/libs/prx/libSceSulphaDrv/include/Api.hpp b/core/libs/prx/libSceSulphaDrv/include/Api.hpp
new file mode 100644
index 0000000000..86b1f74a4a
--- /dev/null
+++ b/core/libs/prx/libSceSulphaDrv/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSulphaGetClientInfo(void);
+int APS5_VABI sceSulphaGetConnectedClientCount(void);
+int APS5_VABI sceSulphaGetDefaultConfig(void* config);
+int APS5_VABI sceSulphaGetNeededMemory(void);
+int APS5_VABI sceSulphaInit(void);
+int APS5_VABI sceSulphaMessage(void);
+int APS5_VABI sceSulphaSetBookmark(void);
+int APS5_VABI sceSulphaShutdown(void);
+
+}
diff --git a/core/libs/prx/libSceSulphaDrv/libSceSulphaDrv.hpp b/core/libs/prx/libSceSulphaDrv/libSceSulphaDrv.hpp
new file mode 100644
index 0000000000..1f85062b91
--- /dev/null
+++ b/core/libs/prx/libSceSulphaDrv/libSceSulphaDrv.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSulphaDrv/include/Api.hpp"
diff --git a/core/libs/prx/libSceSysBridge/libSceSysBridge.hpp b/core/libs/prx/libSceSysBridge/libSceSysBridge.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceSysBridge/libSceSysBridge.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSysCore/Export.cpp b/core/libs/prx/libSceSysCore/Export.cpp
index f06a188fd8..7758a11ed7 100644
--- a/core/libs/prx/libSceSysCore/Export.cpp
+++ b/core/libs/prx/libSceSysCore/Export.cpp
@@ -1,12 +1,9 @@
+#include "prx/libSceSysCore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct ApplicationInfo {
-    std::byte data[152];
-};
-
 static_assert(sizeof(ApplicationInfo) == 152);
 
 extern "C" {
@@ -16,4 +13,288 @@ int APS5_VABI sceApplicationGetAppInfoByAppId(std::uint32_t applicationId, Appli
     return 0;
 }
 
+int APS5_VABI _sceApplicationGetAppId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationAddProcess2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationBeginSclkChange() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationBlockingKill2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationBlockingKill3() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationContinue() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationCrashSyscore() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationCrashSystemProcess() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationEndSclkChange() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationExitSpawn() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationExitSpawn2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetAppPackageInfoForCoredump() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCompiledSdkVersionByAppId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCoredumpDirAndFileName() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCoredumpState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCpuUsage() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCpuUsage2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetDbgExecutablePath() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetProcs() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetShellCoreAppId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetStateForDebugger() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationInitializeForShellCore() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsCrashReportBeingProcessed() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsPrimaryProcess() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsResumable() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsSuspendable() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationKickCoredump() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationKickCoredump2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationKill() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessKill() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessKill2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessResume() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessSuspend() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyCoredumpRequestEnd() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyCoredumpRequestProgress() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyVshMainOnStandby() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyVshReady() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationOnAllResourceReleased() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRaiseException() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRaiseExceptionToLocalPid() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRaiseExceptionToPid() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRequestToChangeRenderingMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRestore() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationResume() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSave() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendDebugSpawnResult2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerKillRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerResumeRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerSuspendRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerTitleIdLaunchRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetApplicationFocus() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetControllerFocus() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetControllerFocusPermissionToSubProcess() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetMemoryPstate() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSignalShellCoreHeartBeat() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSpawn2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSuspend() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSuspendSystemForDebugger() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSwitchToBaseMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSwitchToNeoMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSwitchToNeoMode2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemReboot() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemShutdown2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemSuspend() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemSuspend2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplictionGetStateForDebugger() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceSysCoreGetEventCount() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceSysCoreReceiveEvent() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 }
diff --git a/core/libs/prx/libSceSysCore/include/Api.hpp b/core/libs/prx/libSceSysCore/include/Api.hpp
new file mode 100644
index 0000000000..8f3529042c
--- /dev/null
+++ b/core/libs/prx/libSceSysCore/include/Api.hpp
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct ApplicationInfo {
+    std::byte data[152];
+};
+
+extern "C" {
+
+int APS5_VABI sceApplicationGetAppInfoByAppId(std::uint32_t applicationId, ApplicationInfo* info);
+
+int APS5_VABI _sceApplicationGetAppId();
+int APS5_VABI sceApplicationAddProcess2();
+int APS5_VABI sceApplicationBeginSclkChange();
+int APS5_VABI sceApplicationBlockingKill2();
+int APS5_VABI sceApplicationBlockingKill3();
+int APS5_VABI sceApplicationContinue();
+int APS5_VABI sceApplicationCrashSyscore();
+int APS5_VABI sceApplicationCrashSystemProcess();
+int APS5_VABI sceApplicationEndSclkChange();
+int APS5_VABI sceApplicationExitSpawn();
+int APS5_VABI sceApplicationExitSpawn2();
+int APS5_VABI sceApplicationFinalize();
+int APS5_VABI sceApplicationGetAppPackageInfoForCoredump();
+int APS5_VABI sceApplicationGetCompiledSdkVersionByAppId();
+int APS5_VABI sceApplicationGetCoredumpDirAndFileName();
+int APS5_VABI sceApplicationGetCoredumpState();
+int APS5_VABI sceApplicationGetCpuUsage();
+int APS5_VABI sceApplicationGetCpuUsage2();
+int APS5_VABI sceApplicationGetDbgExecutablePath();
+int APS5_VABI sceApplicationGetMode();
+int APS5_VABI sceApplicationGetProcs();
+int APS5_VABI sceApplicationGetShellCoreAppId();
+int APS5_VABI sceApplicationGetStateForDebugger();
+int APS5_VABI sceApplicationInitialize();
+int APS5_VABI sceApplicationInitializeForShellCore();
+int APS5_VABI sceApplicationIsCrashReportBeingProcessed();
+int APS5_VABI sceApplicationIsPrimaryProcess();
+int APS5_VABI sceApplicationIsResumable();
+int APS5_VABI sceApplicationIsSuspendable();
+int APS5_VABI sceApplicationKickCoredump();
+int APS5_VABI sceApplicationKickCoredump2();
+int APS5_VABI sceApplicationKill();
+int APS5_VABI sceApplicationLocalProcessKill();
+int APS5_VABI sceApplicationLocalProcessKill2();
+int APS5_VABI sceApplicationLocalProcessResume();
+int APS5_VABI sceApplicationLocalProcessSuspend();
+int APS5_VABI sceApplicationNotifyCoredumpRequestEnd();
+int APS5_VABI sceApplicationNotifyCoredumpRequestProgress();
+int APS5_VABI sceApplicationNotifyVshMainOnStandby();
+int APS5_VABI sceApplicationNotifyVshReady();
+int APS5_VABI sceApplicationOnAllResourceReleased();
+int APS5_VABI sceApplicationRaiseException();
+int APS5_VABI sceApplicationRaiseExceptionToLocalPid();
+int APS5_VABI sceApplicationRaiseExceptionToPid();
+int APS5_VABI sceApplicationRequestToChangeRenderingMode();
+int APS5_VABI sceApplicationRestore();
+int APS5_VABI sceApplicationResume();
+int APS5_VABI sceApplicationSave();
+int APS5_VABI sceApplicationSendDebugSpawnResult2();
+int APS5_VABI sceApplicationSendResultOfDebuggerKillRequest();
+int APS5_VABI sceApplicationSendResultOfDebuggerResumeRequest();
+int APS5_VABI sceApplicationSendResultOfDebuggerSuspendRequest();
+int APS5_VABI sceApplicationSendResultOfDebuggerTitleIdLaunchRequest();
+int APS5_VABI sceApplicationSetApplicationFocus();
+int APS5_VABI sceApplicationSetControllerFocus();
+int APS5_VABI sceApplicationSetControllerFocusPermissionToSubProcess();
+int APS5_VABI sceApplicationSetMemoryPstate();
+int APS5_VABI sceApplicationSignalShellCoreHeartBeat();
+int APS5_VABI sceApplicationSpawn2();
+int APS5_VABI sceApplicationSuspend();
+int APS5_VABI sceApplicationSuspendSystemForDebugger();
+int APS5_VABI sceApplicationSwitchToBaseMode();
+int APS5_VABI sceApplicationSwitchToNeoMode();
+int APS5_VABI sceApplicationSwitchToNeoMode2();
+int APS5_VABI sceApplicationSystemReboot();
+int APS5_VABI sceApplicationSystemShutdown2();
+int APS5_VABI sceApplicationSystemSuspend();
+int APS5_VABI sceApplicationSystemSuspend2();
+int APS5_VABI sceApplictionGetStateForDebugger();
+int APS5_VABI sceSysCoreGetEventCount();
+int APS5_VABI sceSysCoreReceiveEvent();
+
+}
diff --git a/core/libs/prx/libSceSysCore/libSceSysCore.hpp b/core/libs/prx/libSceSysCore/libSceSysCore.hpp
new file mode 100644
index 0000000000..c0d6d0db48
--- /dev/null
+++ b/core/libs/prx/libSceSysCore/libSceSysCore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSysCore/include/Api.hpp"
diff --git a/core/libs/prx/libSceSysUtil/Export.cpp b/core/libs/prx/libSceSysUtil/Export.cpp
index 6ff461210b..a6f707cd6e 100644
--- a/core/libs/prx/libSceSysUtil/Export.cpp
+++ b/core/libs/prx/libSceSysUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSysUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSysUtil/include/Api.hpp b/core/libs/prx/libSceSysUtil/include/Api.hpp
new file mode 100644
index 0000000000..f07cd4a9b9
--- /dev/null
+++ b/core/libs/prx/libSceSysUtil/include/Api.hpp
@@ -0,0 +1,32 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSysUtilSendSystemNotificationWithText(int32_t type, const char* message);
+int APS5_VABI sceSysUtilSendAddressingSystemNotification();
+int APS5_VABI sceSysUtilSendAddressingSystemNotificationWithDeviceId();
+int APS5_VABI sceSysUtilSendAddressingSystemNotificationWithUserId();
+int APS5_VABI sceSysUtilSendAddressingSystemNotificationWithUserName();
+int APS5_VABI sceSysUtilSendNotificationRequest();
+int APS5_VABI sceSysUtilSendNpDebugNotificationRequest();
+int APS5_VABI sceSysUtilSendSystemNotification();
+int APS5_VABI sceSysUtilSendSystemNotification2();
+int APS5_VABI sceSysUtilSendSystemNotificationParamInit();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppId();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppInfo();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppName();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppNameRelatedToUser();
+int APS5_VABI sceSysUtilSendSystemNotificationWithDeviceId();
+int APS5_VABI sceSysUtilSendSystemNotificationWithDeviceIdRelatedToUser();
+int APS5_VABI sceSysUtilSendSystemNotificationWithErrorCode();
+int APS5_VABI sceSysUtilSendSystemNotificationWithParams();
+int APS5_VABI sceSysUtilSendSystemNotificationWithTextRelatedToUser();
+int APS5_VABI sceSysUtilSendSystemNotificationWithUserId();
+int APS5_VABI sceSysUtilSendSystemNotificationWithUserName();
+int APS5_VABI sceSysUtilSendSystemNotificationWithUserNameInfo();
+int APS5_VABI sceSysUtilSendTrcCheckNotificationRequest();
+int APS5_VABI sceSysUtilSendWebDebugNotificationRequest();
+
+}
diff --git a/core/libs/prx/libSceSysUtil/libSceSysUtil.hpp b/core/libs/prx/libSceSysUtil/libSceSysUtil.hpp
new file mode 100644
index 0000000000..15c98b717c
--- /dev/null
+++ b/core/libs/prx/libSceSysUtil/libSceSysUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSysUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceSysmodule/Export.cpp b/core/libs/prx/libSceSysmodule/Export.cpp
index 0c1662bd25..6855f1f6af 100644
--- a/core/libs/prx/libSceSysmodule/Export.cpp
+++ b/core/libs/prx/libSceSysmodule/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSysmodule/include/Api.hpp"
 #include <cstdint>
 #include <cstring>
 #include <map>
@@ -19,8 +21,6 @@
 #include "ModuleTable.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
-
 namespace {
 
 constexpr int SCE_SYSMODULE_ERROR_INVALID_VALUE = static_cast<int>(0x805A1000);
diff --git a/core/libs/prx/libSceSysmodule/include/Api.hpp b/core/libs/prx/libSceSysmodule/include/Api.hpp
new file mode 100644
index 0000000000..db439f37b3
--- /dev/null
+++ b/core/libs/prx/libSceSysmodule/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSysmoduleGetModuleInfoForUnwind(std::uint64_t addr, int flags, ModuleInfoForUnwind* info);
+int APS5_VABI sceSysmoduleGetModuleHandleInternal(std::uint32_t id, std::int32_t* handle);
+int APS5_VABI sceSysmoduleIsLoaded(std::uint16_t id);
+int APS5_VABI sceSysmoduleLoadModule(std::uint16_t id);
+int APS5_VABI sceSysmoduleLoadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
+int APS5_VABI sceSysmoduleUnloadModule(std::uint16_t id);
+int APS5_VABI sceSysmoduleLoadModuleInternal(std::uint32_t id);
+int APS5_VABI sceSysmoduleUnloadModuleInternal(std::uint32_t id);
+int APS5_VABI sceSysmoduleUnloadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
+int APS5_VABI sceSysmoduleIsLoadedInternal(std::uint32_t id);
+int APS5_VABI sceSysmoduleIsCalledFromSysModule();
+int APS5_VABI sceSysmoduleIsCameraPreloaded();
+int APS5_VABI sceSysmoduleLoadModuleByNameInternal(std::uint8_t* fname, std::uint64_t a1, std::uint64_t a2, std::uint64_t a3, std::uint64_t a4, std::uint64_t a5);
+int APS5_VABI sceSysmoduleMapLibcForLibkernel();
+int APS5_VABI sceSysmodulePreloadModuleForLibkernel();
+int APS5_VABI sceSysmoduleUnloadModuleByNameInternal();
+
+}
diff --git a/core/libs/prx/libSceSysmodule/libSceSysmodule.hpp b/core/libs/prx/libSceSysmodule/libSceSysmodule.hpp
new file mode 100644
index 0000000000..235f65eecc
--- /dev/null
+++ b/core/libs/prx/libSceSysmodule/libSceSysmodule.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSysmodule/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemGesture/Export.cpp b/core/libs/prx/libSceSystemGesture/Export.cpp
index 5e1fb249e6..056318a3a4 100644
--- a/core/libs/prx/libSceSystemGesture/Export.cpp
+++ b/core/libs/prx/libSceSystemGesture/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemGesture/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemGesture/include/Api.hpp b/core/libs/prx/libSceSystemGesture/include/Api.hpp
new file mode 100644
index 0000000000..ef1667c91e
--- /dev/null
+++ b/core/libs/prx/libSceSystemGesture/include/Api.hpp
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemGestureAppendTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureClose(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureCreateTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer, int32_t type, const SystemGestureRectangle* rectangle, const void* param);
+int APS5_VABI sceSystemGestureFinalizePrimitiveTouchRecognizer(void);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByIndex(int32_t gestureHandle, uint32_t index, SystemGesturePrimitiveTouchEvent* event);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByPrimitiveID(int32_t gestureHandle, uint16_t primitiveId, SystemGesturePrimitiveTouchEvent* event);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEvents(int32_t gestureHandle, SystemGesturePrimitiveTouchEvent* eventBuffer, uint32_t capacityOfBuffer, uint32_t* numberOfEvent);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEventsCount(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureGetTouchEventByEventID(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, uint32_t eventId, SystemGestureTouchEvent* event);
+int APS5_VABI sceSystemGestureGetTouchEventByIndex(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, uint32_t index, SystemGestureTouchEvent* event);
+int APS5_VABI sceSystemGestureGetTouchEvents(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, SystemGestureTouchEvent* eventBuffer, uint32_t capacityOfBuffer, uint32_t* numberOfEvent);
+int APS5_VABI sceSystemGestureGetTouchEventsCount(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureGetTouchRecognizerInformation(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, SystemGestureTouchRecognizerInformation* information);
+int APS5_VABI sceSystemGestureInitializePrimitiveTouchRecognizer();
+int32_t APS5_VABI sceSystemGestureOpen(int32_t inputType, const void* param);
+int APS5_VABI sceSystemGestureRemoveTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureResetPrimitiveTouchRecognizer(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureResetTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureUpdateAllTouchRecognizer(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureUpdatePrimitiveTouchRecognizer(int32_t gestureHandle, const SystemGestureTouchPadData* input);
+int APS5_VABI sceSystemGestureUpdateTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureUpdateTouchRecognizerRectangle(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer, const SystemGestureRectangle* rectangle);
+int APS5_VABI sceSystemGestureDebugGetVersion();
+
+}
diff --git a/core/libs/prx/libSceSystemGesture/libSceSystemGesture.hpp b/core/libs/prx/libSceSystemGesture/libSceSystemGesture.hpp
new file mode 100644
index 0000000000..1e6ac94f6a
--- /dev/null
+++ b/core/libs/prx/libSceSystemGesture/libSceSystemGesture.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemGesture/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger/Export.cpp b/core/libs/prx/libSceSystemLogger/Export.cpp
index 0b82cdf1e0..ebad08c6b3 100644
--- a/core/libs/prx/libSceSystemLogger/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemLogger/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemLogger/include/Api.hpp b/core/libs/prx/libSceSystemLogger/include/Api.hpp
new file mode 100644
index 0000000000..d5e47a68e5
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLoggerInitialize();
+int APS5_VABI sceSystemLoggerSetLogData();
+int APS5_VABI sceSystemLoggerTerminate();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger/libSceSystemLogger.hpp b/core/libs/prx/libSceSystemLogger/libSceSystemLogger.hpp
new file mode 100644
index 0000000000..e47ab854c6
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger/libSceSystemLogger.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2/Export.cpp b/core/libs/prx/libSceSystemLogger2/Export.cpp
index 82a408b187..860ef63046 100644
--- a/core/libs/prx/libSceSystemLogger2/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemLogger2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2/include/Api.hpp b/core/libs/prx/libSceSystemLogger2/include/Api.hpp
new file mode 100644
index 0000000000..4b8e19eaf0
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLogger2GetTimestamp();
+int APS5_VABI sceSystemLogger2Initialize();
+int APS5_VABI sceSystemLogger2SetEventAsync();
+int APS5_VABI sceSystemLogger2SetEventAsyncEx();
+int APS5_VABI sceSystemLogger2Terminate();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger2/libSceSystemLogger2.hpp b/core/libs/prx/libSceSystemLogger2/libSceSystemLogger2.hpp
new file mode 100644
index 0000000000..931a124f24
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2/libSceSystemLogger2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger2/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp b/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp
index a071ef1bed..c01af333e1 100644
--- a/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemLogger2Delivery/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2Delivery/include/Api.hpp b/core/libs/prx/libSceSystemLogger2Delivery/include/Api.hpp
new file mode 100644
index 0000000000..c0263701f7
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2Delivery/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLogger2DeliveryGetBatchResult();
+int APS5_VABI sceSystemLogger2DeliveryGetResult();
+int APS5_VABI sceSystemLogger2DeliverySetBatchDeliveryEvent();
+int APS5_VABI sceSystemLogger2DeliveryTerminate();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger2Delivery/libSceSystemLogger2Delivery.hpp b/core/libs/prx/libSceSystemLogger2Delivery/libSceSystemLogger2Delivery.hpp
new file mode 100644
index 0000000000..e91f676c51
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2Delivery/libSceSystemLogger2Delivery.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger2Delivery/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2Game/libSceSystemLogger2Game.hpp b/core/libs/prx/libSceSystemLogger2Game/libSceSystemLogger2Game.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2Game/libSceSystemLogger2Game.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp b/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp
index 1087fa235d..ae54608dbe 100644
--- a/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp b/core/libs/prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp
new file mode 100644
index 0000000000..3631a92feb
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLogger2NativeQueueClientCheckAndMaskData();
+int APS5_VABI sceSystemLogger2NativeQueueClientGetEvent();
+int APS5_VABI sceSystemLogger2NativeQueueClientSetDeliveryEnable();
+int APS5_VABI sceSystemLogger2NativeQueueClientSetDeliveryResult();
+int APS5_VABI sceSystemLogger2NativeQueueClientSetNativeQueueConfig();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger2NativeQueueClient/libSceSystemLogger2NativeQueueClient.hpp b/core/libs/prx/libSceSystemLogger2NativeQueueClient/libSceSystemLogger2NativeQueueClient.hpp
new file mode 100644
index 0000000000..50e859ed9d
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2NativeQueueClient/libSceSystemLogger2NativeQueueClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemService/CMakeLists.txt b/core/libs/prx/libSceSystemService/CMakeLists.txt
index 20a06f0cd9..02c5161b32 100644
--- a/core/libs/prx/libSceSystemService/CMakeLists.txt
+++ b/core/libs/prx/libSceSystemService/CMakeLists.txt
@@ -98,6 +98,29 @@ if(BUILD_TESTING)
         set_tests_properties(guest_system_service_time_zone PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_system_service_app_title_id_tests ${LIBS_INCLUDE_DIR}/tests/GuestSystemServiceAppTitleId.cpp)
+    target_include_directories(guest_system_service_app_title_id_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_system_service_app_title_id_tests PRIVATE libSceSystemService libkernel libc)
+    configure_windows_unwind(guest_system_service_app_title_id_tests)
+    foreach(appTitleIdCase IN ITEMS known:PPSA00000 long:PPSA000000 missing:none)
+        string(REPLACE ":" ";" appTitleIdCase ${appTitleIdCase})
+        list(GET appTitleIdCase 0 appTitleIdName)
+        list(GET appTitleIdCase 1 appTitleIdValue)
+        set(appTitleIdRun ${CMAKE_CURRENT_BINARY_DIR}/guest_system_service_app_title_id_${appTitleIdName})
+        if(appTitleIdName STREQUAL "missing")
+            file(MAKE_DIRECTORY ${appTitleIdRun})
+        else()
+            file(WRITE ${appTitleIdRun}/app0/sce_sys/param.json
+                "{\"titleId\":\"${appTitleIdValue}\",\"localizedParameters\":{\"en-US\":{\"titleName\":\"Example\"}}}")
+        endif()
+        add_test(NAME guest_system_service_app_title_id_${appTitleIdName} COMMAND guest_system_service_app_title_id_tests ${appTitleIdName}
+            WORKING_DIRECTORY ${appTitleIdRun})
+        set_tests_properties(guest_system_service_app_title_id_${appTitleIdName} PROPERTIES TIMEOUT 20)
+        if(WIN32)
+            set_tests_properties(guest_system_service_app_title_id_${appTitleIdName} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        endif()
+    endforeach()
     add_test_executable(guest_system_kill_app_tests ${LIBS_INCLUDE_DIR}/tests/GuestSystemKillApp.cpp)
     target_include_directories(guest_system_kill_app_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_system_kill_app_tests PRIVATE libSceSystemService libc)
diff --git a/core/libs/prx/libSceSystemService/Export.cpp b/core/libs/prx/libSceSystemService/Export.cpp
index ad7c9d9937..0b9e30b645 100644
--- a/core/libs/prx/libSceSystemService/Export.cpp
+++ b/core/libs/prx/libSceSystemService/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include <algorithm>
 #include <cerrno>
 #include <chrono>
@@ -26,6 +27,7 @@
 #include "LoadExec.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include "prx/libSceAgcDriver/Execution/include/HostHdr.hpp"
 
@@ -243,6 +245,21 @@ HostLaunch PrepareLaunch(const char*, const char* const*) {
 void StartHostExecutable(HostLaunch&) {}
 #endif
 
+constexpr std::size_t TitleIdBufferSize = 10;
+
+std::string RunningTitleId() {
+    const AppTitleId titleId = GetAppTitleId_nid_postfix();
+    return std::string(titleId.value);
+}
+
+void CopyRunningTitleId(const std::string& caller, bool running, char* destination) {
+    if (!running) NotImplemented_nid_no_patch((caller + ": application other than the running title").c_str());
+    if (destination == nullptr) NotImplemented_nid_no_patch((caller + ": null title ID buffer").c_str());
+    const std::string titleId = RunningTitleId();
+    if (titleId.size() >= TitleIdBufferSize) NotImplemented_nid_no_patch((caller + ": title ID that does not fit 10 bytes").c_str());
+    std::memcpy(destination, titleId.c_str(), titleId.size() + 1);
+}
+
 }
 
 extern "C" {
@@ -406,14 +423,6 @@ int APS5_VABI sceSystemServiceOpenChallengeActivity(void) {
  return SYSTEM_SERVICE_OK;
 }
 
-struct SystemServiceTournamentOccurrenceParam {
-    std::uint64_t size;
-    const char* occurrenceId;
-    std::int32_t userId;
-    std::uint32_t padding;
-    const char* context;
-};
-
 static_assert(sizeof(SystemServiceTournamentOccurrenceParam) == 32);
 static_assert(offsetof(SystemServiceTournamentOccurrenceParam, occurrenceId) == 8);
 static_assert(offsetof(SystemServiceTournamentOccurrenceParam, userId) == 16);
@@ -445,6 +454,26 @@ int APS5_VABI sceSystemServiceGetAppIdOfRunningBigApp(void) {
  return SYSTEM_SERVICE_RUNNING_APP_ID;
 }
 
+int APS5_VABI sceSystemServiceGetAppId(const char* titleId) {
+ if (titleId == nullptr) {
+  NotImplemented_nid_no_patch("sceSystemServiceGetAppId: null title ID");
+ }
+ if (RunningTitleId() != titleId) {
+  NotImplemented_nid_no_patch("sceSystemServiceGetAppId: title other than the running title");
+ }
+ return SYSTEM_SERVICE_RUNNING_APP_ID;
+}
+
+int APS5_VABI sceSystemServiceGetAppTitleId(int appId, char* titleId) {
+ CopyRunningTitleId("sceSystemServiceGetAppTitleId", appId == SYSTEM_SERVICE_RUNNING_APP_ID, titleId);
+ return SYSTEM_SERVICE_OK;
+}
+
+int APS5_VABI sceLncUtilGetAppTitleId(std::int32_t appId, char* titleId) {
+ CopyRunningTitleId("sceLncUtilGetAppTitleId", appId == SYSTEM_SERVICE_RUNNING_APP_ID, titleId);
+ return SYSTEM_SERVICE_OK;
+}
+
 int APS5_VABI sceSystemServiceKillApp(int appId, int how, int reason, int coreDump) {
  if (appId != SYSTEM_SERVICE_RUNNING_APP_ID) {
   NotImplemented_nid_no_patch("sceSystemServiceKillApp: application other than the running title");
diff --git a/core/libs/prx/libSceSystemService/PendingExports.cpp b/core/libs/prx/libSceSystemService/PendingExports.cpp
index 9fbb45de38..d2b7fca08e 100644
--- a/core/libs/prx/libSceSystemService/PendingExports.cpp
+++ b/core/libs/prx/libSceSystemService/PendingExports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/General.hpp"
 
 namespace {
@@ -7,72 +8,22 @@ constexpr int SystemServiceRejected = static_cast<int>(0x80A10005);
 
 }
 
-struct ShellCoreErrorDialogParam {
-    const char* message;
-    const char* const* formatArgs;
-    std::uint8_t flag;
-};
-
 static_assert(sizeof(ShellCoreErrorDialogParam) == 24);
 static_assert(offsetof(ShellCoreErrorDialogParam, message) == 0);
 static_assert(offsetof(ShellCoreErrorDialogParam, formatArgs) == 8);
 static_assert(offsetof(ShellCoreErrorDialogParam, flag) == 16);
 
-struct SystemServiceDaemonEvent;
-struct SystemServiceLocalProcessStatus;
 struct SystemServiceEvent;
-struct SystemServicePSButtonEvent;
-struct SystemServicePrivacyDefinitionData;
-struct SystemServicePrivacyDefinitionVersion;
-struct SystemServiceTitleWorkaroundInfo;
-struct SystemServiceStoreParam {
-    std::uint32_t size;
-};
 
 static_assert(sizeof(SystemServiceStoreParam) == 4);
 
-struct SystemServiceCpuPstateParam;
-struct SystemServiceLocalProcessParam;
-struct SystemServiceJvmProcessParam;
-struct SystemServicePs2ProcessParam;
-struct SystemServiceAppInstallStatus;
-struct SystemServiceAppStatus;
-struct ShellCoreLaunchByUriParam {
-    std::uint32_t option;
-    std::int32_t userId;
-};
-
 static_assert(sizeof(ShellCoreLaunchByUriParam) == 8);
 static_assert(offsetof(ShellCoreLaunchByUriParam, option) == 0);
 static_assert(offsetof(ShellCoreLaunchByUriParam, userId) == 4);
-struct ShellCoreTelemetryToken;
-struct ShellCoreUmmStatus {
-    std::int32_t state;
-    std::int32_t inDeviceMuteState;
-};
 
 static_assert(sizeof(ShellCoreUmmStatus) == 8);
 static_assert(offsetof(ShellCoreUmmStatus, state) == 0);
 static_assert(offsetof(ShellCoreUmmStatus, inDeviceMuteState) == 4);
-struct ShellCorePbtcUserInfoList;
-struct ShellCorePrivacyEventData;
-struct ShellCorePsnAccountInfoFirst;
-struct ShellCorePsnAccountInfoSecond;
-struct ShellCorePsnAccountInfoThird;
-struct ShellCorePsnAccountInfoFourth;
-struct ShellCorePsnAccountInfoFifth;
-struct ShellCoreAppLaunchTypeInfo;
-struct LncGpuCrashAppStatus {
-    char titleId[16];
-    std::int32_t appId;
-    std::int32_t appLocalPid;
-    char path[1024];
-    std::int32_t appType;
-    std::int32_t coredumpReason;
-    char corefileName[256];
-    std::uint32_t exceptionCode;
-    std::uint32_t appCategoryType;
-};
 
 static_assert(sizeof(LncGpuCrashAppStatus) == 1320);
 static_assert(offsetof(LncGpuCrashAppStatus, titleId) == 0);
@@ -84,15 +35,6 @@ static_assert(offsetof(LncGpuCrashAppStatus, coredumpReason) == 1052);
 static_assert(offsetof(LncGpuCrashAppStatus, corefileName) == 1056);
 static_assert(offsetof(LncGpuCrashAppStatus, exceptionCode) == 1312);
 static_assert(offsetof(LncGpuCrashAppStatus, appCategoryType) == 1316);
-struct LncLaunchParam {
-    std::uint32_t size;
-    std::int32_t userId;
-    std::int32_t appAttr;
-    std::int32_t enableCrashReport;
-    std::uint64_t checkFlag;
-    std::uint64_t contextId;
-    bool isSpeculativeLaunch;
-};
 
 static_assert(sizeof(LncLaunchParam) == 40);
 static_assert(offsetof(LncLaunchParam, size) == 0);
@@ -102,49 +44,19 @@ static_assert(offsetof(LncLaunchParam, enableCrashReport) == 12);
 static_assert(offsetof(LncLaunchParam, checkFlag) == 16);
 static_assert(offsetof(LncLaunchParam, contextId) == 24);
 static_assert(offsetof(LncLaunchParam, isSpeculativeLaunch) == 32);
-struct LncDaemonEvent;
-struct LncShellUiEvent;
-struct LncLocalProcessStatus {
-    std::int32_t appLocalPid;
-    std::uint8_t reserved[32];
-};
 
 static_assert(sizeof(LncLocalProcessStatus) == 36);
 static_assert(offsetof(LncLocalProcessStatus, appLocalPid) == 0);
 static_assert(offsetof(LncLocalProcessStatus, reserved) == 4);
-struct LncCoredumpState {
-    std::uint32_t progress;
-    std::uint32_t isFinished;
-    std::int32_t result;
-};
 
 static_assert(sizeof(LncCoredumpState) == 12);
 static_assert(offsetof(LncCoredumpState, progress) == 0);
 static_assert(offsetof(LncCoredumpState, isFinished) == 4);
 static_assert(offsetof(LncCoredumpState, result) == 8);
-struct LncVideoFinalizeState {
-    std::uint32_t progress;
-    std::int32_t result;
-};
 
 static_assert(sizeof(LncVideoFinalizeState) == 8);
 static_assert(offsetof(LncVideoFinalizeState, progress) == 0);
 static_assert(offsetof(LncVideoFinalizeState, result) == 4);
-struct LncLocalProcessParam;
-struct LncAppStatus {
-    std::int32_t appId;
-    std::int32_t launchRequestAppId;
-    std::int32_t appType;
-    std::int32_t appAttr;
-    char titleId[16];
-    std::uint32_t appCategoryType;
-    std::int32_t appBootMode;
-    std::int32_t appBootSubMode;
-    char appVer[6];
-    char contentVersion[11];
-    bool isSystemExApp;
-    bool isCdlgInitialized;
-};
 
 static_assert(sizeof(LncAppStatus) == 64);
 static_assert(offsetof(LncAppStatus, appId) == 0);
@@ -159,24 +71,6 @@ static_assert(offsetof(LncAppStatus, appVer) == 44);
 static_assert(offsetof(LncAppStatus, contentVersion) == 50);
 static_assert(offsetof(LncAppStatus, isSystemExApp) == 61);
 static_assert(offsetof(LncAppStatus, isCdlgInitialized) == 62);
-struct LncShellUiAppStatus {
-    std::int32_t appId;
-    std::int32_t appType;
-    std::int32_t appAttr;
-    std::int32_t launchRequestAppId;
-    std::int32_t userId;
-    std::int32_t isActiveCdlg;
-    char path[1024];
-    char sceSysDir[256];
-    std::int32_t isCoredumped;
-    std::int32_t isPrxModuleLoadFailed;
-    std::int32_t appLocalPid;
-    std::int32_t crashReportMode;
-    char category[4];
-    std::uint32_t appCategoryType;
-    std::int32_t appBootMode;
-    std::int32_t appBootSubMode;
-};
 
 static_assert(sizeof(LncShellUiAppStatus) == 1336);
 static_assert(offsetof(LncShellUiAppStatus, appId) == 0);
@@ -195,13 +89,6 @@ static_assert(offsetof(LncShellUiAppStatus, category) == 1320);
 static_assert(offsetof(LncShellUiAppStatus, appCategoryType) == 1324);
 static_assert(offsetof(LncShellUiAppStatus, appBootMode) == 1328);
 static_assert(offsetof(LncShellUiAppStatus, appBootSubMode) == 1332);
-struct AppMessagingMessage {
-    std::int32_t sender;
-    std::uint32_t messageType;
-    std::uint8_t payload[8192];
-    std::uint32_t payloadSize;
-    std::uint64_t timestamp;
-};
 
 static_assert(sizeof(AppMessagingMessage) == 8216);
 static_assert(offsetof(AppMessagingMessage, sender) == 0);
@@ -210,10 +97,6 @@ static_assert(offsetof(AppMessagingMessage, payload) == 8);
 static_assert(offsetof(AppMessagingMessage, payloadSize) == 8200);
 static_assert(offsetof(AppMessagingMessage, timestamp) == 8208);
 
-struct UsbStorageEvent;
-struct UsbStorageDeviceInfo;
-using UsbStorageCallback = void (APS5_VABI *)(const UsbStorageEvent* event, void* userData);
-
 extern "C" {
 
 int APS5_VABI sceAppMessagingClearEventFlag(std::int32_t appId, std::uint64_t flags) {
@@ -386,11 +269,6 @@ int APS5_VABI sceLncUtilGetAppStatusListForShellUIReboot(LncShellUiAppStatus* st
     return 0;
 }
 
-int APS5_VABI sceLncUtilGetAppTitleId(std::int32_t appId, char* titleId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceLncUtilGetAppType(std::int32_t appId, std::uint32_t* type) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1957,11 +1835,6 @@ int APS5_VABI sceSystemServiceGetAppFocusedAppStatus(SystemServiceAppStatus* sta
     return 0;
 }
 
-int APS5_VABI sceSystemServiceGetAppId(const char* titleId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceSystemServiceGetAppIdListOfBigApp(std::int32_t* appIds, std::uint32_t capacity, std::uint32_t* count) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1977,11 +1850,6 @@ int APS5_VABI sceSystemServiceGetAppStatus(SystemServiceAppStatus* status) {
     return 0;
 }
 
-int APS5_VABI sceSystemServiceGetAppTitleId(std::int32_t appId, char* titleId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceSystemServiceGetAppType(std::int32_t appId, std::int32_t* type) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceSystemService/include/SystemService.hpp b/core/libs/prx/libSceSystemService/include/SystemService.hpp
new file mode 100644
index 0000000000..6c0120e66b
--- /dev/null
+++ b/core/libs/prx/libSceSystemService/include/SystemService.hpp
@@ -0,0 +1,732 @@
+#pragma once
+
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
+
+#include "SceTypes.hpp"
+
+struct SystemServiceTournamentOccurrenceParam {
+    std::uint64_t size;
+    const char* occurrenceId;
+    std::int32_t userId;
+    std::uint32_t padding;
+    const char* context;
+};
+
+struct ShellCoreErrorDialogParam {
+    const char* message;
+    const char* const* formatArgs;
+    std::uint8_t flag;
+};
+
+struct SystemServiceDaemonEvent;
+struct SystemServiceLocalProcessStatus;
+struct SystemServicePSButtonEvent;
+struct SystemServicePrivacyDefinitionData;
+struct SystemServicePrivacyDefinitionVersion;
+struct SystemServiceTitleWorkaroundInfo;
+
+struct SystemServiceStoreParam {
+    std::uint32_t size;
+};
+
+struct SystemServiceCpuPstateParam;
+struct SystemServiceLocalProcessParam;
+struct SystemServiceJvmProcessParam;
+struct SystemServicePs2ProcessParam;
+struct SystemServiceAppInstallStatus;
+struct SystemServiceAppStatus;
+
+struct ShellCoreLaunchByUriParam {
+    std::uint32_t option;
+    std::int32_t userId;
+};
+
+struct ShellCoreTelemetryToken;
+
+struct ShellCoreUmmStatus {
+    std::int32_t state;
+    std::int32_t inDeviceMuteState;
+};
+
+struct ShellCorePbtcUserInfoList;
+struct ShellCorePrivacyEventData;
+struct ShellCorePsnAccountInfoFirst;
+struct ShellCorePsnAccountInfoSecond;
+struct ShellCorePsnAccountInfoThird;
+struct ShellCorePsnAccountInfoFourth;
+struct ShellCorePsnAccountInfoFifth;
+struct ShellCoreAppLaunchTypeInfo;
+
+struct LncGpuCrashAppStatus {
+    char titleId[16];
+    std::int32_t appId;
+    std::int32_t appLocalPid;
+    char path[1024];
+    std::int32_t appType;
+    std::int32_t coredumpReason;
+    char corefileName[256];
+    std::uint32_t exceptionCode;
+    std::uint32_t appCategoryType;
+};
+
+struct LncLaunchParam {
+    std::uint32_t size;
+    std::int32_t userId;
+    std::int32_t appAttr;
+    std::int32_t enableCrashReport;
+    std::uint64_t checkFlag;
+    std::uint64_t contextId;
+    bool isSpeculativeLaunch;
+};
+
+struct LncDaemonEvent;
+struct LncShellUiEvent;
+
+struct LncLocalProcessStatus {
+    std::int32_t appLocalPid;
+    std::uint8_t reserved[32];
+};
+
+struct LncCoredumpState {
+    std::uint32_t progress;
+    std::uint32_t isFinished;
+    std::int32_t result;
+};
+
+struct LncVideoFinalizeState {
+    std::uint32_t progress;
+    std::int32_t result;
+};
+
+struct LncLocalProcessParam;
+
+struct LncAppStatus {
+    std::int32_t appId;
+    std::int32_t launchRequestAppId;
+    std::int32_t appType;
+    std::int32_t appAttr;
+    char titleId[16];
+    std::uint32_t appCategoryType;
+    std::int32_t appBootMode;
+    std::int32_t appBootSubMode;
+    char appVer[6];
+    char contentVersion[11];
+    bool isSystemExApp;
+    bool isCdlgInitialized;
+};
+
+struct LncShellUiAppStatus {
+    std::int32_t appId;
+    std::int32_t appType;
+    std::int32_t appAttr;
+    std::int32_t launchRequestAppId;
+    std::int32_t userId;
+    std::int32_t isActiveCdlg;
+    char path[1024];
+    char sceSysDir[256];
+    std::int32_t isCoredumped;
+    std::int32_t isPrxModuleLoadFailed;
+    std::int32_t appLocalPid;
+    std::int32_t crashReportMode;
+    char category[4];
+    std::uint32_t appCategoryType;
+    std::int32_t appBootMode;
+    std::int32_t appBootSubMode;
+};
+
+struct AppMessagingMessage {
+    std::int32_t sender;
+    std::uint32_t messageType;
+    std::uint8_t payload[8192];
+    std::uint32_t payloadSize;
+    std::uint64_t timestamp;
+};
+
+extern "C" {
+
+int APS5_VABI sceSystemServiceLoadExec(const char* path, const char* const* arguments);
+int APS5_VABI sceSystemServiceDisableNoticeScreenSkipFlagAutoSet(void);
+int APS5_VABI sceSystemServiceGetDisplaySafeAreaInfo(SystemServiceDisplaySafeAreaInfo* info);
+int APS5_VABI sceSystemServiceShowDisplaySafeAreaSettings(void);
+int APS5_VABI sceSystemServiceGetHdrToneMapLuminance(SystemServiceHdrToneMapLuminance* luminance);
+int APS5_VABI sceSystemServiceGetNoticeScreenSkipFlag(bool* value);
+int APS5_VABI sceSystemServiceGetStatus(SystemServiceStatus* status);
+int APS5_VABI sceSystemServiceHideSplashScreen(void);
+int APS5_VABI sceSystemServiceParamGetInt(int paramId, int* value);
+int APS5_VABI sceSystemServiceParamGetString(int paramId, char* buf, size_t bufSize);
+int APS5_VABI sceSystemServicePowerTick(void);
+int APS5_VABI sceSystemServiceReceiveEvent(SystemServiceEvent* event);
+int APS5_VABI sceSystemServiceReportAbnormalTermination(const void* info);
+int APS5_VABI sceSystemServiceSetNoticeScreenSkipFlag(void);
+void APS5_VABI sceSystemServiceInitializePlayerDialogParam(SystemServicePlayerDialogParam* param);
+int APS5_VABI sceSystemServiceDisableMediaPlay();
+int APS5_VABI sceSystemServiceReenableMediaPlay();
+int APS5_VABI sceSystemServiceLaunchPlayerDialog(const void* param);
+int APS5_VABI sceSystemServiceLaunchWebBrowser(const char* uri);
+int APS5_VABI sceSystemServiceLaunchApp(const char* titleId, const char* const* arguments, const void* param);
+int APS5_VABI sceSystemServiceDisableMusicPlayer(void);
+int APS5_VABI sceSystemServiceOpenChallengeActivity(void);
+int APS5_VABI sceSystemServiceOpenTournamentOccurrence(const SystemServiceTournamentOccurrenceParam* param);
+int APS5_VABI sceSystemServiceAddLocalProcessForPsmKit(const char*, const char* const*, const void*);
+int APS5_VABI sceSystemServiceKillLocalProcessForPsmKit(int);
+int APS5_VABI sceSystemServiceReenableMusicPlayer(void);
+int APS5_VABI sceSystemServiceShowControllerSettings(void);
+int APS5_VABI sceSystemServiceGetAppIdOfRunningBigApp(void);
+int APS5_VABI sceSystemServiceKillApp(int appId, int how, int reason, int coreDump);
+int APS5_VABI sceLncUtilKillApp(uint32_t appId);
+int APS5_VABI sceLncUtilKillAppWithReason(uint32_t appId, int reason);
+int APS5_VABI sceSystemServiceLaunchSystemDeeplink(void);
+int APS5_VABI sceShellCoreUtilLaunchByUriParamInit(void);
+int APS5_VABI sceSystemStateMgrTickVideoPlayback(void);
+int APS5_VABI sceSystemServiceTelemetrySetData2WithUserId(void);
+int APS5_VABI sceShellCoreUtilStartUmmDictation(void);
+int APS5_VABI sceSystemServiceGetSpotifyTitleId(void);
+int APS5_VABI sceSystemServiceGetAppStatusListContainsDaemon(void);
+int APS5_VABI sceSystemServiceSwitchToVRApp(void);
+int APS5_VABI sceSystemServiceSwitchToNonVRApp(void);
+int APS5_VABI sceLncUtilGetSpmemAllocatorConfigValue(void);
+int APS5_VABI sceCsbMgrInitialize(void);
+int APS5_VABI sceCsbMgrTerminate(void);
+int APS5_VABI sceCsbMgrCreateLocalSandbox(void);
+int APS5_VABI sceCsbMgrDestroyLocalSandbox(void);
+int APS5_VABI sceCsbMgrSwitchLocalSandbox(void);
+int APS5_VABI sceCsbMgrGetCurrentLocalSandboxId(void);
+int APS5_VABI sceCsbMgrGetLocalSandboxIdList(void);
+int APS5_VABI sceCsbMgrGetLocalSandboxInfo(void);
+int APS5_VABI sceCsbMgrSetLocalSandboxInfo(void);
+int APS5_VABI sceCsbMgrIssueStreamingSandboxInfo(void);
+int APS5_VABI sceReportSequenceHandlerRequestReport(void);
+int APS5_VABI sceReportSequenceHandlerCancelReport(void);
+int APS5_VABI sceReportSequenceHandlerExistsEvent(void);
+int APS5_VABI sceReportSequenceHandlerUpdateEventCache(void);
+int APS5_VABI sceReportSequenceHandlerGetEventCache(void);
+int APS5_VABI sceLncUtilRegisterCallEntries(void);
+int APS5_VABI sceLncUtilGetSpmemConfigJson(void);
+int APS5_VABI sceLncUtilExportSpmemConfigJson(void);
+int APS5_VABI sceLncUtilImportSpmemConfigJson(void);
+int APS5_VABI sceShellCoreUtilExitAppWithValue(void);
+int APS5_VABI sceShellCoreUtilNpDebugSpecialNotification(void);
+int APS5_VABI sceShellCoreUtilIsDddTemperatureDanger(void);
+int APS5_VABI sceShellCoreUtilIsM2StorageTemperatureDanger(void);
+int APS5_VABI sceShellCoreUtilGetAvailableSizeM2(void);
+int APS5_VABI sceShellCoreUtilNotifyConnectAccountStatusChanged(void);
+int APS5_VABI sceShellCoreUtilIsInternalCronosUser(void);
+int APS5_VABI sceShellCoreUtilChangePbtcMode(void);
+int APS5_VABI sceShellCoreUtilTelemetryCacheData(void);
+int APS5_VABI sceShellCoreUtilMicMuteKeyPressed(void);
+int APS5_VABI sceShellCoreUtilSwitchMicMute(void);
+int APS5_VABI sceShellCoreUtilNotifyStartEventToUniversalMicMute(void);
+int APS5_VABI sceShellCoreUtilIsLotusMicActivated(void);
+int APS5_VABI sceShellCoreUtilResetAllNoticeScreenSkipFlag(void);
+int APS5_VABI sceShellCoreUtilResetNoticeScreenSkipFlag(void);
+int APS5_VABI sceShellCoreUtilGetNoticeScreenSkipFlagByAppId(void);
+int APS5_VABI sceShellCoreUtilGetPasscodeInputType(void);
+int APS5_VABI sceShellCoreUtilGetPasscodeDisplayInfo(void);
+int APS5_VABI sceShellCoreUtilNotifySystemResumeTelemetryInfo(void);
+int APS5_VABI sceShellCoreUtilUpdateTelemetryToken(void);
+int APS5_VABI sceShellCoreUtilGetVRBaseMatRectangles(void);
+int APS5_VABI sceShellCoreUtilSetVRBaseMatRectangles(void);
+int APS5_VABI sceShellCoreUtilIsLaunchBlockDialog(void);
+int APS5_VABI sceShellCoreUtilGetConsoleToken(void);
+int APS5_VABI sceShellCoreUtilGetDeviceIdByDeviceUniqueId(void);
+int APS5_VABI sceShellCoreUtilGetDeviceUniqueIdByDeviceId(void);
+int APS5_VABI sceShellCoreUtilGetStreamingClientInfo(void);
+int APS5_VABI sceShellCoreUtilRequestCffUpdate(void);
+int APS5_VABI sceShellCoreUtilGetCffConfig(void);
+int APS5_VABI sceShellCoreUtilRemoveCffConfigFile(void);
+int APS5_VABI sceShellCoreUtilDebugGetNumberOfCffItems(void);
+int APS5_VABI sceShellCoreUtilDebugGetCffInfo(void);
+int APS5_VABI sceShellCoreUtilDebugSetCffStatus(void);
+int APS5_VABI sceShellCoreUtilGetPeripheralConnectionSessionId(void);
+int APS5_VABI sceShellCoreUtilGetCdlgEnabledFreezeRendering(void);
+int APS5_VABI sceShellCoreUtilGetNpTitleId(void);
+int APS5_VABI sceShellCoreUtilIsCronosInGameCommerceEnabled(void);
+int APS5_VABI sceShellCoreUtilLemSettingGet(void);
+int APS5_VABI sceShellCoreUtilLemSettingSet(void);
+int APS5_VABI sceShellCoreUtilLemSettingGetList(void);
+int APS5_VABI sceShellCoreUtilLemSettingReset(void);
+int APS5_VABI sceShellCoreUtilIsEChassisVariant(void);
+int APS5_VABI sceSystemStateMgrGetRebootCause(void);
+int APS5_VABI sceCoredumpSequenceHandlerUpdateEventCache(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetEventCache(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetWorkingEventSummary(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetCoredumpStatus(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetCoredumpStatusByAppId(void);
+int APS5_VABI sceCoredumpSequenceHandlerCancelCoredump(void);
+int APS5_VABI sceSystemServiceIsBgmPlaying(void);
+int APS5_VABI sceShellCoreUtilIsBgmPlaying(void);
+int APS5_VABI sceAppMessagingClearEventFlag(std::int32_t appId, std::uint64_t flags);
+int APS5_VABI sceAppMessagingReceiveMsg(AppMessagingMessage* message);
+int APS5_VABI sceAppMessagingSendMsg(std::uint32_t appId, std::uint32_t messageId, const void* data, std::size_t size, std::uint32_t flags);
+int APS5_VABI sceAppMessagingSendMsgToShellCore(std::uint32_t messageId, const void* data, std::size_t size, std::uint32_t flags);
+int APS5_VABI sceAppMessagingSendMsgToShellUI(std::uint32_t messageId, const void* data, std::size_t size, std::uint32_t flags);
+int APS5_VABI sceAppMessagingSetEventFlag(std::int32_t appId, std::uint64_t flags);
+int APS5_VABI sceAppMessagingTryGetEventFlag(std::uint64_t mask, std::uint64_t* flags, std::uint8_t clear);
+int APS5_VABI sceAppMessagingTryReceiveMsg(AppMessagingMessage* message);
+int APS5_VABI sceLncUtilAcquireCpuBudgetOfExtraAudioDevices();
+int APS5_VABI sceLncUtilAcquireCpuBudgetOfImeForBigApp();
+int APS5_VABI sceLncUtilAcquireCpuBudgetOfInGameStore();
+int APS5_VABI sceLncUtilActivateCdlg();
+int APS5_VABI sceLncUtilAddLocalProcess(std::int32_t appId, const char* path, const char* const* argv, const LncLocalProcessParam* param);
+int APS5_VABI sceLncUtilBlockAppSuspend(const char* reason);
+int APS5_VABI sceLncUtilBlockingGetEventForDaemon(LncDaemonEvent* event, std::uint64_t receiveArgument);
+int APS5_VABI sceLncUtilContinueApp(std::int32_t appId);
+int APS5_VABI sceLncUtilCrashSyscore();
+int APS5_VABI sceLncUtilDeactivateCdlg();
+int APS5_VABI sceLncUtilDeclareReadyForSuspend();
+int APS5_VABI sceLncUtilDisableSuspendNotification();
+int APS5_VABI sceLncUtilEnableSuspendNotification();
+int APS5_VABI sceLncUtilFinishSpecialResume();
+int APS5_VABI sceLncUtilForceKillApp(std::int32_t appId);
+int APS5_VABI sceLncUtilForceKillLocalProcess(std::int32_t appId, std::int32_t processId);
+int APS5_VABI sceLncUtilGetAppCategory(std::int32_t appId, char* category);
+int APS5_VABI sceLncUtilGetAppCategoryType(std::int32_t appId, std::uint32_t* categoryType);
+int APS5_VABI sceLncUtilGetAppFocusedAppStatus(LncAppStatus* status);
+int APS5_VABI sceLncUtilGetAppId(const char* titleId);
+int APS5_VABI sceLncUtilGetAppIdListOfBigApp(std::int32_t* appIds, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetAppIdOfRunningBigApp();
+int APS5_VABI sceLncUtilGetAppLaunchedUser(std::int32_t appId, std::int32_t* userId);
+int APS5_VABI sceLncUtilGetAppStatus(LncAppStatus* status);
+int APS5_VABI sceLncUtilGetAppStatusList(LncAppStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetAppStatusListForShellUIReboot(LncShellUiAppStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetAppTitleId(std::int32_t appId, char* titleId);
+int APS5_VABI sceLncUtilGetAppType(std::int32_t appId, std::uint32_t* type);
+int APS5_VABI sceLncUtilGetCdlgExec(std::int32_t appId, bool* executing);
+int APS5_VABI sceLncUtilGetCdlgType(std::int32_t appId, std::uint32_t* type);
+int APS5_VABI sceLncUtilGetCoredumpState(std::int32_t appId, std::int32_t processId, LncCoredumpState* state);
+int APS5_VABI sceLncUtilGetDbgExecutablePath(char* path, std::uint64_t selector);
+int APS5_VABI sceLncUtilGetEventForDaemon(LncDaemonEvent* event);
+int APS5_VABI sceLncUtilGetEventForShellUI(LncShellUiEvent* event);
+int APS5_VABI sceLncUtilGetGpuCrashFullDumpAppStatus(LncGpuCrashAppStatus* status);
+int APS5_VABI sceLncUtilGetLocalProcessStatusList(LncLocalProcessStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetParentSocket();
+int APS5_VABI sceLncUtilGetResultKillApp(std::uint32_t requestId);
+int APS5_VABI sceLncUtilGetResultLaunchAppByTitleId(std::uint32_t requestId);
+int APS5_VABI sceLncUtilGetVideoFinalizeState(std::int32_t appId, std::int32_t processId, LncVideoFinalizeState* state);
+int APS5_VABI sceLncUtilInitialize();
+int APS5_VABI sceLncUtilIsActiveCdlg(bool* active);
+int APS5_VABI sceLncUtilIsAppLaunched(const char* titleId, bool* launched);
+int APS5_VABI sceLncUtilIsAppSuspended(std::int32_t appId, bool* suspended);
+int APS5_VABI sceLncUtilIsCdlgActivated(std::uint8_t* activated);
+bool APS5_VABI sceLncUtilIsCpuBudgetOfExtraAudioDevicesAvailable();
+int APS5_VABI sceLncUtilIsHostBoot(std::int32_t appId, bool* hostBoot);
+int APS5_VABI sceLncUtilIsPs2Emu(bool* emulated);
+bool APS5_VABI sceLncUtilIsShellUiFgAndGameBgCpuMode();
+int APS5_VABI sceLncUtilIsSpeculativeLaunch(std::int32_t appId, bool* speculative);
+int APS5_VABI sceLncUtilKickCoredumpOnlyProcMem(std::int32_t appId, std::int32_t processId, const char* first, const char* second);
+int APS5_VABI sceLncUtilKillLocalProcess(std::int32_t appId, std::int32_t processId);
+int APS5_VABI sceLncUtilLaunchApp(const char* titleId, const char* const* argv, const LncLaunchParam* param);
+int APS5_VABI sceLncUtilLoadExec(const char* path, const char* const* argv);
+int APS5_VABI sceLncUtilNotifyCoredumpRequestEnd(std::int32_t appId, std::int32_t processId, std::int32_t result);
+int APS5_VABI sceLncUtilNotifyCoredumpRequestProgress(std::int32_t appId, std::int32_t processId, std::int32_t progress);
+int APS5_VABI sceLncUtilNotifyVshReady(std::uint32_t errorCode);
+int APS5_VABI sceLncUtilRaiseException(std::int32_t appId, std::uint64_t exception);
+int APS5_VABI sceLncUtilRaiseExceptionLocalProcess(std::int32_t appId, std::int32_t processId, std::uint64_t exception);
+int APS5_VABI sceLncUtilRegisterCdlgSharedMemoryName(const char* name);
+int APS5_VABI sceLncUtilRegisterDaemon();
+int APS5_VABI sceLncUtilRegisterShellUI();
+int APS5_VABI sceLncUtilReleaseCpuBudgetOfExtraAudioDevices();
+int APS5_VABI sceLncUtilReleaseCpuBudgetOfImeForBigApp();
+int APS5_VABI sceLncUtilReleaseCpuBudgetOfInGameStore();
+int APS5_VABI sceLncUtilResumeApp(std::int32_t appId, std::uint64_t flags);
+int APS5_VABI sceLncUtilResumeLocalProcess(std::int32_t processId);
+int APS5_VABI sceLncUtilSetAppFocus(std::int32_t appId, std::uint64_t flags, std::uint64_t contextId);
+int APS5_VABI sceLncUtilSetCdlgExec(std::int32_t appId, std::uint8_t executing);
+int APS5_VABI sceLncUtilSetControllerFocus(std::int32_t appId);
+int APS5_VABI sceLncUtilSetControllerFocusPermission(std::uint8_t permission);
+int APS5_VABI sceLncUtilStartKillApp(std::int32_t appId, std::uint32_t* requestId);
+int APS5_VABI sceLncUtilStartLaunchAppByTitleId(const char* titleId, const char* const* argv, const LncLaunchParam* param, std::uint32_t* requestId);
+int APS5_VABI sceLncUtilSuspendApp(std::int32_t appId, std::uint64_t flags, std::int32_t reason);
+int APS5_VABI sceLncUtilSuspendBackgroundApp(std::int32_t first, std::int32_t second);
+int APS5_VABI sceLncUtilSuspendLocalProcess(std::int32_t processId);
+int APS5_VABI sceLncUtilTerminate();
+int APS5_VABI sceLncUtilTryBlockAppSuspend(const char* reason);
+int APS5_VABI sceLncUtilUnblockAppSuspend(const char* reason);
+int APS5_VABI sceLncUtilUnregisterCdlgSharedMemoryName(const char* name);
+int APS5_VABI sceLncUtilUnregisterDaemon();
+int APS5_VABI sceLncUtilUnregisterShellUI();
+int APS5_VABI sceShellCoreUtilAccessibilityZoomLock();
+int APS5_VABI sceShellCoreUtilAccessibilityZoomUnlock();
+int APS5_VABI sceShellCoreUtilAcquireBgmCpuBudget();
+int APS5_VABI sceShellCoreUtilAcquireRemotePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilAcquireSharePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilActivateAbort(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilActivateGetStatus(std::intptr_t handle, std::int32_t* status, std::int32_t* result);
+int APS5_VABI sceShellCoreUtilActivateInit(std::int32_t type, std::intptr_t* handle);
+int APS5_VABI sceShellCoreUtilActivateIsActivated(std::intptr_t handle, bool* activated);
+int APS5_VABI sceShellCoreUtilActivateRecordActivation();
+int APS5_VABI sceShellCoreUtilActivateStart(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilActivateStartAsync(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilActivateTerm(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilChangeRunLevel(std::int32_t runLevel);
+int APS5_VABI sceShellCoreUtilChangeToStaffModeForIDU();
+int APS5_VABI sceShellCoreUtilCheckerAbort();
+int APS5_VABI sceShellCoreUtilCleanupCrashReport();
+int APS5_VABI sceShellCoreUtilClearAppData();
+int APS5_VABI sceShellCoreUtilClearPs4AppCategoryDefaultsListUpdate();
+int APS5_VABI sceShellCoreUtilClearPsnAccountInfo();
+int APS5_VABI sceShellCoreUtilCrashReportRequestCancel();
+int APS5_VABI sceShellCoreUtilDeclareBeginOfExternalStorageAppMove();
+int APS5_VABI sceShellCoreUtilDeclareEndOfExternalStorageAppMove();
+int APS5_VABI sceShellCoreUtilDeleteDiscInstalledTitleWorkaroundFile();
+int APS5_VABI sceShellCoreUtilDeleteDownloadedHidConfigFile(std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilDeleteDownloadedNetEvConfigFile();
+int APS5_VABI sceShellCoreUtilDeleteDownloadedTitleWorkaroundFile();
+int APS5_VABI sceShellCoreUtilDoFsck(const char* path);
+int APS5_VABI sceShellCoreUtilDownloadHidConfigFileFromServer(std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilDownloadNetEvConfigFileFromServer();
+int APS5_VABI sceShellCoreUtilDownloadTitleWorkaroundFileFromServer();
+int APS5_VABI sceShellCoreUtilEndUmmDictation();
+int APS5_VABI sceShellCoreUtilEnterPowerLockSection();
+int APS5_VABI sceShellCoreUtilExecuteCrashReport();
+int APS5_VABI sceShellCoreUtilExfatFormatExternalHdd(const char* path);
+int APS5_VABI sceShellCoreUtilExitApp();
+int APS5_VABI sceShellCoreUtilExitMiniApp();
+int APS5_VABI sceShellCoreUtilExitMiniAppWithValue(const char* value);
+int APS5_VABI sceShellCoreUtilFormatExternalHdd(const char* path);
+int APS5_VABI sceShellCoreUtilFormatHddForRestore();
+int APS5_VABI sceShellCoreUtilGetAppData(const char* key, void* data, std::int32_t capacity, std::int32_t* size);
+int APS5_VABI sceShellCoreUtilGetAppEnableTTS(std::int32_t appId, bool* enabled);
+int APS5_VABI sceShellCoreUtilGetAppEnterButtonAssign(std::int32_t appId, std::int32_t* assignment);
+int APS5_VABI sceShellCoreUtilGetAppLaunchTypeInfo(std::int32_t appId, ShellCoreAppLaunchTypeInfo* info);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamInt(std::int32_t appId, const char* key, std::int32_t* value);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamIntByBudgetType(std::int32_t budgetType, const char* key, std::int32_t* value);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamString(std::int32_t appId, const char* key, char* value, std::int32_t capacity);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamStringByBudgetType(std::int32_t budgetType, const char* key, char* value, std::int32_t capacity);
+int APS5_VABI sceShellCoreUtilGetAutoPowerDownRemainingSeconds();
+int APS5_VABI sceShellCoreUtilGetBasicProductShape();
+int APS5_VABI sceShellCoreUtilGetCheckerString(const char* key, char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetCheckerStringEx(const char* firstKey, const char* secondKey, char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetCloudClientStatus(std::uint32_t* status);
+int APS5_VABI sceShellCoreUtilGetCrashReportCoreFileSetSize();
+int APS5_VABI sceShellCoreUtilGetCrashReportFilterInfoStart();
+int APS5_VABI sceShellCoreUtilGetCrashReportInfoForBoot();
+int APS5_VABI sceShellCoreUtilGetCrashReportInfoForBootStart();
+int APS5_VABI sceShellCoreUtilGetCrashReportInfoStart();
+int APS5_VABI sceShellCoreUtilGetCrashReportResult();
+int APS5_VABI sceShellCoreUtilGetCrashReportStatus();
+int APS5_VABI sceShellCoreUtilGetCrashReportUploadStatus();
+int APS5_VABI sceShellCoreUtilGetDeviceIndexBehavior(std::uint32_t* behavior, std::int32_t* userId, std::uint32_t* scene);
+int APS5_VABI sceShellCoreUtilGetDeviceIndexBehaviorWithTimeout(std::uint32_t* behavior, std::int32_t* userId, std::uint32_t* scene, std::uint8_t timeout);
+int APS5_VABI sceShellCoreUtilGetEffectiveTotalSizeOfUserPartition(std::uint64_t* size);
+std::uint64_t APS5_VABI sceShellCoreUtilGetFreeSizeOfAvContentsTmp();
+int APS5_VABI sceShellCoreUtilGetFreeSizeOfUserPartition(std::uint64_t* freeSize, std::uint64_t* totalSize);
+int APS5_VABI sceShellCoreUtilGetFsckProgress(const char* titleId, std::uint32_t* progress);
+int APS5_VABI sceShellCoreUtilGetGameLiveStreamingStatus(bool* active);
+bool APS5_VABI sceShellCoreUtilGetGnmCompositorOnScreenProfilerFlag();
+int APS5_VABI sceShellCoreUtilGetGpuLoadEmulationMode();
+int APS5_VABI sceShellCoreUtilGetGpuLoadEmulationModeByAppId(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetHidConfigFileInfoString(char* value, std::size_t capacity, std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilGetHidConfigFileString(char* value, std::size_t capacity, std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilGetHidConfigName(char* value, std::size_t capacity, std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilGetHidConfigNum(std::int32_t* configNum);
+int APS5_VABI sceShellCoreUtilGetIDUMode(std::uint8_t* mode);
+bool APS5_VABI sceShellCoreUtilGetImposeMenuFlagForPs2Emu(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetManifestFileStatus();
+int APS5_VABI sceShellCoreUtilGetNeedSizeOfAppContent(std::uint64_t* size);
+int APS5_VABI sceShellCoreUtilGetNetEvConfigFileInfoString(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetOutOfVrPlayZoneWarning();
+int APS5_VABI sceShellCoreUtilGetPapcGamePcl();
+int APS5_VABI sceShellCoreUtilGetPbtcUserInfoList(ShellCorePbtcUserInfoList* info);
+int APS5_VABI sceShellCoreUtilGetPlatformPrivacyDefinitionEventData(const char* firstKey, const char* secondKey, ShellCorePrivacyEventData* data);
+float APS5_VABI sceShellCoreUtilGetProgressOfFormatExternalHdd();
+float APS5_VABI sceShellCoreUtilGetProgressOfFsck();
+int APS5_VABI sceShellCoreUtilGetPs4AppCategoryDefaultsListId(void* data, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetPs4AppCategoryForTitleId(const char* titleId);
+int APS5_VABI sceShellCoreUtilGetPsStoreIconLayout(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetPsStoreIconState(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetPsnAccountInfo(ShellCorePsnAccountInfoFirst* first, ShellCorePsnAccountInfoSecond* second, ShellCorePsnAccountInfoThird* third, ShellCorePsnAccountInfoFourth* fourth, ShellCorePsnAccountInfoFifth* fifth);
+int APS5_VABI sceShellCoreUtilGetRemotePlayStatus(bool* active);
+int APS5_VABI sceShellCoreUtilGetRunLevel();
+int APS5_VABI sceShellCoreUtilGetSharePlayStatus(bool* active);
+int APS5_VABI sceShellCoreUtilGetSocialScreenStatus(bool* active);
+int APS5_VABI sceShellCoreUtilGetSplashScreenState(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetSupportSiteURL(std::uint32_t first, std::uint32_t second, char* value, std::size_t capacity);
+bool APS5_VABI sceShellCoreUtilGetSuspendConfirmationDialogFlag(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetSystemBGState(std::int32_t appId, std::uint32_t* state);
+int APS5_VABI sceShellCoreUtilGetSystemBGWaveColor(std::int32_t appId, std::uint32_t* color);
+int APS5_VABI sceShellCoreUtilGetSystemBGWaveState(std::int32_t appId, std::uint32_t* state);
+int APS5_VABI sceShellCoreUtilGetTelemetryToken(ShellCoreTelemetryToken* token);
+int APS5_VABI sceShellCoreUtilGetTitleWorkaroundFileInfoString(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetTitleWorkaroundFileString(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetUIStatus(std::uint64_t* status);
+int APS5_VABI sceShellCoreUtilGetUmmStatus(std::int32_t userId, ShellCoreUmmStatus* status);
+int APS5_VABI sceShellCoreUtilGetUserFocus(std::int32_t appId, std::int32_t* userId);
+int APS5_VABI sceShellCoreUtilGetUserIdOfMorpheusUser();
+int APS5_VABI sceShellCoreUtilGetVMStatsForTelemetry(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetVersionNumberOfCameraCalibrationData();
+int APS5_VABI sceShellCoreUtilGoBackToKratosCurrentSessionGame();
+int APS5_VABI sceShellCoreUtilHideBlocksFromUser(std::int64_t bytes, std::int32_t flags);
+int APS5_VABI sceShellCoreUtilIncrementVersionNumberOfCameraCalibrationData();
+bool APS5_VABI sceShellCoreUtilIsAccessibilityZoomLocked(std::int32_t appId);
+bool APS5_VABI sceShellCoreUtilIsBgmCpuBudgetAcquired();
+bool APS5_VABI sceShellCoreUtilIsBgmCpuBudgetAvailable();
+bool APS5_VABI sceShellCoreUtilIsExternalStorageAppMoveInProgress();
+int APS5_VABI sceShellCoreUtilIsEyeToEyeDistanceAdjusted(std::uint32_t userId, std::uint8_t* adjusted);
+bool APS5_VABI sceShellCoreUtilIsGameLiveStreamingOnAir();
+int APS5_VABI sceShellCoreUtilIsIDUState();
+bool APS5_VABI sceShellCoreUtilIsImposeScreenOverlaid();
+bool APS5_VABI sceShellCoreUtilIsInSystemSuspendBlackList(std::uint32_t appId);
+int APS5_VABI sceShellCoreUtilIsInternalKratosUser();
+int APS5_VABI sceShellCoreUtilIsKilledOrSuspendedByLogout(std::int32_t first, std::int32_t second, std::uint8_t* result);
+int APS5_VABI sceShellCoreUtilIsNeededCrashReport();
+bool APS5_VABI sceShellCoreUtilIsPowerSaveAlertRequested();
+bool APS5_VABI sceShellCoreUtilIsRemotePlayCpuBudgetAcquired();
+bool APS5_VABI sceShellCoreUtilIsScreenSaverOn();
+bool APS5_VABI sceShellCoreUtilIsSharePlayCpuBudgetAcquired();
+int APS5_VABI sceShellCoreUtilIsShowCrashReport();
+int APS5_VABI sceShellCoreUtilIsTemperatureDanger();
+int APS5_VABI sceShellCoreUtilIsTitleWorkaroundEnabled(std::int32_t selector, const char* key);
+bool APS5_VABI sceShellCoreUtilIsUsbMassStorageMounted(std::uint32_t deviceIndex);
+int APS5_VABI sceShellCoreUtilLaunchByUri(const char* uri, const ShellCoreLaunchByUriParam* param);
+int APS5_VABI sceShellCoreUtilLeavePowerLockSection();
+int APS5_VABI sceShellCoreUtilMakeManifestFile();
+int APS5_VABI sceShellCoreUtilMountAppRight(const char* key);
+int APS5_VABI sceShellCoreUtilMountDownloadDataForShellUI(const char* key);
+int APS5_VABI sceShellCoreUtilMountHddForBackup();
+int APS5_VABI sceShellCoreUtilMountHddForRestore();
+int APS5_VABI sceShellCoreUtilNavigateToAnotherApp(std::uint32_t target);
+int APS5_VABI sceShellCoreUtilNavigateToGoHome(std::uint32_t target);
+int APS5_VABI sceShellCoreUtilNavigateToLaunchedApp(std::uint32_t target);
+int APS5_VABI sceShellCoreUtilNotificationCancelForIDU(std::int64_t notificationId);
+int APS5_VABI sceShellCoreUtilNotificationRequestedForIDU(std::int64_t notificationId, const char* text, std::uint32_t type);
+int APS5_VABI sceShellCoreUtilNotifyBgmCoreTermination();
+int APS5_VABI sceShellCoreUtilNotifyFsReadError(std::int32_t first, std::int32_t second, std::int32_t third, const char* detail);
+int APS5_VABI sceShellCoreUtilNotifyImeStatusChanged(std::int32_t imeStatus, std::uint8_t isCalledFromGame);
+int APS5_VABI sceShellCoreUtilNotifyPsnAccountInfoReceived();
+int APS5_VABI sceShellCoreUtilNotifySystemSuspendTelemetryInfo(std::uint32_t info);
+int APS5_VABI sceShellCoreUtilPfAuthClientConsoleTokenClearCache();
+int APS5_VABI sceShellCoreUtilPostActivityForPsNow(std::int32_t type, const char* activity);
+int APS5_VABI sceShellCoreUtilPostErrorLog(const char* titleId, std::int32_t internalErrorCode, const char* shortError, const char* messageBuffer, std::int32_t suggestionType, const char* logReport);
+int APS5_VABI sceShellCoreUtilPostLaunchConfirmResult(std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceShellCoreUtilPostPsmEventToShellUI(std::int32_t eventId, const char* data);
+int APS5_VABI sceShellCoreUtilPreNotifyOfGameLiveStreaming();
+int APS5_VABI sceShellCoreUtilPreNotifyOfRemotePlay();
+int APS5_VABI sceShellCoreUtilPreNotifyOfSharePlay();
+int APS5_VABI sceShellCoreUtilReleaseBgmCpuBudget();
+int APS5_VABI sceShellCoreUtilReleaseRemotePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilReleaseSharePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilReportSessionErrorToGaikaiController(std::int32_t error, const char* detail);
+int APS5_VABI sceShellCoreUtilReportUnexpectedFatalErrorToSystemTelemetry(std::int32_t error, const char* detail);
+int APS5_VABI sceShellCoreUtilRequestCameraCalibration();
+int APS5_VABI sceShellCoreUtilRequestEjectDevice(const char* path);
+int APS5_VABI sceShellCoreUtilRequestRebootApp(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilRequestShutdown(std::int32_t reason);
+int APS5_VABI sceShellCoreUtilResetAutoPowerDownTimer();
+int APS5_VABI sceShellCoreUtilResetBgdcConfig();
+int APS5_VABI sceShellCoreUtilSetAppData(const char* key, const char* value);
+int APS5_VABI sceShellCoreUtilSetBgmProhibition(std::uint32_t value);
+int APS5_VABI sceShellCoreUtilSetDeviceIndexBehavior(std::uint32_t behavior, std::int32_t userId, std::uint8_t scene);
+int APS5_VABI sceShellCoreUtilSetGameLiveStreamingOnAirFlag(std::int32_t enabled);
+int APS5_VABI sceShellCoreUtilSetGameLiveStreamingStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetGnmCompositorOnScreenProfilerFlag(std::int32_t enabled);
+int APS5_VABI sceShellCoreUtilSetGpuLoadEmulationMode(std::uint32_t mode);
+int APS5_VABI sceShellCoreUtilSetGpuLoadEmulationModeByAppId(std::int32_t appId, std::uint32_t mode);
+int APS5_VABI sceShellCoreUtilSetIDUMode(std::uint8_t mode);
+int APS5_VABI sceShellCoreUtilSetImposeStatusFlag(std::int32_t enabled);
+int APS5_VABI sceShellCoreUtilSetPsStoreIconLayout(std::uint32_t layout);
+int APS5_VABI sceShellCoreUtilSetPsStoreIconState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetRemotePlayStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetSharePlayStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetSkipUpdateCheck(std::uint8_t skip);
+int APS5_VABI sceShellCoreUtilSetSocialScreenStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetSplashScreenState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetSystemBGState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetSystemBGWaveColor(std::uint32_t color);
+int APS5_VABI sceShellCoreUtilSetSystemBGWaveState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetUIStatus(std::uint64_t status, std::uint64_t mask);
+int APS5_VABI sceShellCoreUtilSetUserFocus(std::int32_t userId);
+int APS5_VABI sceShellCoreUtilShowCriticalErrorDialog(std::uint32_t error, const char* message);
+int APS5_VABI sceShellCoreUtilShowErrorDialog(std::uint32_t error, const char* message);
+int APS5_VABI sceShellCoreUtilShowErrorDialogWithFormatArgs(std::uint32_t error, const char* message, const char* const* formatArgs);
+int APS5_VABI sceShellCoreUtilShowErrorDialogWithParam(std::uint32_t error, const ShellCoreErrorDialogParam* param);
+int APS5_VABI sceShellCoreUtilShowPsUnderLockIndicator();
+int APS5_VABI sceShellCoreUtilSignalUserInput();
+int APS5_VABI sceShellCoreUtilStartPsNowGame(const char* data);
+int APS5_VABI sceShellCoreUtilStopPsNowGame(const char* data);
+int APS5_VABI sceShellCoreUtilTalkKeyEventReceived(std::int64_t deviceId, std::int32_t userId, std::int32_t keyEventType);
+int APS5_VABI sceShellCoreUtilTestBusTransferSpeed(const char* path, std::uint8_t* result);
+int APS5_VABI sceShellCoreUtilTickHeartBeat();
+int APS5_VABI sceShellCoreUtilTriggerPapcUpdate(std::uint32_t value);
+int APS5_VABI sceShellCoreUtilTurnOffScreenSaver();
+int APS5_VABI sceShellCoreUtilUnmountAppRight(const char* key);
+int APS5_VABI sceShellCoreUtilUnmountDownloadDataForShellUI(const char* key);
+int APS5_VABI sceShellCoreUtilUnmountHddForBackup();
+int APS5_VABI sceShellCoreUtilUnmountHddForRestore();
+int APS5_VABI sceShellCoreutilGetCrashReportProcessInformation();
+int APS5_VABI sceSystemModalDialogClose(std::uint32_t dialogId);
+int APS5_VABI sceSystemModalDialogOpen(const char* message);
+int APS5_VABI sceSystemServiceAcquireBgmCpuBudget();
+int APS5_VABI sceSystemServiceAcquireFb0();
+int APS5_VABI sceSystemServiceActivateHevc();
+int APS5_VABI sceSystemServiceActivateHevcAbort(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcGetStatus(std::uintptr_t handle, std::uint32_t* status, std::int32_t* result);
+int APS5_VABI sceSystemServiceActivateHevcInit(std::uintptr_t* handle);
+int APS5_VABI sceSystemServiceActivateHevcIsActivated(std::uint8_t* activated);
+int APS5_VABI sceSystemServiceActivateHevcSoft();
+int APS5_VABI sceSystemServiceActivateHevcSoftAbort(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcSoftGetStatus(std::uintptr_t handle, std::uint32_t* status, std::int32_t* result);
+int APS5_VABI sceSystemServiceActivateHevcSoftInit(std::uintptr_t* handle);
+int APS5_VABI sceSystemServiceActivateHevcSoftIsActivated(std::uint8_t* activated);
+int APS5_VABI sceSystemServiceActivateHevcSoftStart(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcSoftTerm(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcStart(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcTerm(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateMpeg2Abort(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateMpeg2GetStatus(std::uintptr_t handle, std::uint32_t* status, std::int32_t* result);
+int APS5_VABI sceSystemServiceActivateMpeg2Init(std::uintptr_t* handle);
+int APS5_VABI sceSystemServiceActivateMpeg2IsActivated(std::uint8_t* activated);
+int APS5_VABI sceSystemServiceActivateMpeg2Start(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateMpeg2Term(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceAddLocalProcess(std::int32_t appId, const char* path, const char* const* argv, const SystemServiceLocalProcessParam* param);
+int APS5_VABI sceSystemServiceAddLocalProcessForJvm(const char* path, const char* const* argv, const SystemServiceJvmProcessParam* param);
+int APS5_VABI sceSystemServiceAddLocalProcessForPs2Emu(const char* path, const char* const* argv, const SystemServicePs2ProcessParam* param);
+int APS5_VABI sceSystemServiceAppGetAppInstallStatus(const char* titleId, SystemServiceAppInstallStatus* status);
+int APS5_VABI sceSystemServiceChangeAcpClock();
+int APS5_VABI sceSystemServiceChangeClock(const char* clock, std::uint32_t value);
+int APS5_VABI sceSystemServiceChangeCpuClock();
+int APS5_VABI sceSystemServiceChangeCpuPstate(const SystemServiceCpuPstateParam* param);
+int APS5_VABI sceSystemServiceChangeGpuClock();
+int APS5_VABI sceSystemServiceChangeMemPstate(std::uint32_t state);
+int APS5_VABI sceSystemServiceChangeMemoryClock();
+int APS5_VABI sceSystemServiceChangeMemoryClockToBaseMode();
+int APS5_VABI sceSystemServiceChangeMemoryClockToDefault();
+int APS5_VABI sceSystemServiceChangeMemoryClockToMultiMediaMode();
+int APS5_VABI sceSystemServiceChangeNumberOfGpuCu();
+int APS5_VABI sceSystemServiceChangeSamuClock();
+int APS5_VABI sceSystemServiceChangeUvdClock();
+int APS5_VABI sceSystemServiceChangeVceClock();
+int APS5_VABI sceSystemServiceDeclareReadyForSuspend();
+int APS5_VABI sceSystemServiceDisablePartyVoice();
+int APS5_VABI sceSystemServiceDisablePersonalEyeToEyeDistanceSetting();
+int APS5_VABI sceSystemServiceDisableSuspendConfirmationDialog();
+int APS5_VABI sceSystemServiceDisableSuspendNotification();
+int APS5_VABI sceSystemServiceDisableVoiceRecognition();
+int APS5_VABI sceSystemServiceEnablePersonalEyeToEyeDistanceSetting();
+int APS5_VABI sceSystemServiceEnableSuspendConfirmationDialog();
+int APS5_VABI sceSystemServiceEnableSuspendNotification();
+int APS5_VABI sceSystemServiceGetAppCategoryType(std::int32_t appId, std::uint32_t* categoryType);
+int APS5_VABI sceSystemServiceGetAppFocusedAppStatus(SystemServiceAppStatus* status);
+int APS5_VABI sceSystemServiceGetAppId(const char* titleId);
+int APS5_VABI sceSystemServiceGetAppIdListOfBigApp(std::int32_t* appIds, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceSystemServiceGetAppLaunchedUser(std::int32_t appId, std::int32_t* userId);
+int APS5_VABI sceSystemServiceGetAppStatus(SystemServiceAppStatus* status);
+int APS5_VABI sceSystemServiceGetAppTitleId(std::int32_t appId, char* titleId);
+int APS5_VABI sceSystemServiceGetAppType(std::int32_t appId, std::int32_t* type);
+int APS5_VABI sceSystemServiceGetDbgExecutablePath(char* path, std::uint64_t selector);
+int APS5_VABI sceSystemServiceGetEventForDaemon(SystemServiceDaemonEvent* event);
+int APS5_VABI sceSystemServiceGetGpuLoadEmulationMode();
+int APS5_VABI sceSystemServiceGetLocalProcessStatusList(SystemServiceLocalProcessStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceSystemServiceGetMainAppTitleId();
+int APS5_VABI sceSystemServiceGetPSButtonEvent(const SystemServiceEvent* event, SystemServicePSButtonEvent* buttonEvent);
+int APS5_VABI sceSystemServiceGetParentSocket();
+int APS5_VABI sceSystemServiceGetParentSocketForJvm();
+int APS5_VABI sceSystemServiceGetParentSocketForPs2Emu();
+int APS5_VABI sceSystemServiceGetParentSocketForPsmKit();
+int APS5_VABI sceSystemServiceGetPlatformPrivacyDefinitionData(const char* key, SystemServicePrivacyDefinitionData* data);
+int APS5_VABI sceSystemServiceGetPlatformPrivacyDefinitionVersion(const char* key, SystemServicePrivacyDefinitionVersion* version);
+int APS5_VABI sceSystemServiceGetPlatformPrivacySetting(std::uint32_t* setting);
+int APS5_VABI sceSystemServiceGetRecentLotusPushedButton(std::uint32_t timeout, std::int32_t* deviceId, std::uint32_t* buttons);
+int APS5_VABI sceSystemServiceGetRemoteplayStatus(bool* active);
+int APS5_VABI sceSystemServiceGetRenderingMode();
+int APS5_VABI sceSystemServiceGetSubAppTitleId();
+int APS5_VABI sceSystemServiceGetSubAppTitleIdForSP();
+int APS5_VABI sceSystemServiceGetTitleWorkaroundInfo(SystemServiceTitleWorkaroundInfo* info);
+int APS5_VABI sceSystemServiceGetUIStatus(std::uint64_t* status);
+int APS5_VABI sceSystemServiceGetVersionNumberOfCameraCalibrationData();
+int APS5_VABI sceSystemServiceInitializeForShellCore();
+int APS5_VABI sceSystemServiceInvokeAppLaunchLink(const char* uri);
+int APS5_VABI sceSystemServiceIsAppSuspended(std::int32_t appId, bool* suspended);
+bool APS5_VABI sceSystemServiceIsBgmCpuBudgetAvailable();
+int APS5_VABI sceSystemServiceIsEyeToEyeDistanceAdjusted(std::uint32_t userId, std::uint8_t* adjusted);
+bool APS5_VABI sceSystemServiceIsGameLiveStreamingOnAir();
+bool APS5_VABI sceSystemServiceIsScreenSaverOn();
+bool APS5_VABI sceSystemServiceIsShellUiFgAndGameBgCpuMode();
+int APS5_VABI sceSystemServiceKillLocalProcess(std::int32_t appId, std::int32_t processId);
+int APS5_VABI sceSystemServiceKillLocalProcessForJvm(std::int32_t processId);
+int APS5_VABI sceSystemServiceKillLocalProcessForPs2Emu(std::int32_t processId);
+int APS5_VABI sceSystemServiceLaunchEventDetails(std::uint64_t unusedSlot, const char* eventId);
+int APS5_VABI sceSystemServiceLaunchStore(const char* uri, const SystemServiceStoreParam* param);
+int APS5_VABI sceSystemServiceLaunchTournamentList();
+int APS5_VABI sceSystemServiceLaunchTournamentsTeamProfile(std::uint64_t unusedSlot, const char* profile, const char* tournament, const char* context);
+int APS5_VABI sceSystemServiceLaunchUdsApp();
+int APS5_VABI sceSystemServiceLaunchWebApp(const char* argument);
+int APS5_VABI sceSystemServiceLoadExecVideoServiceWebApp();
+int APS5_VABI sceSystemServiceNavigateToAnotherApp(std::uint32_t target);
+int APS5_VABI sceSystemServiceNavigateToGoBack();
+int APS5_VABI sceSystemServiceNavigateToGoBackWithValue(const char* value);
+int APS5_VABI sceSystemServiceNavigateToGoHome(std::uint32_t target);
+int APS5_VABI sceSystemServiceNotifyBgmCoreTermination();
+int APS5_VABI sceSystemServiceRaiseExceptionLocalProcess(std::int32_t appId, std::int32_t processId, std::uint64_t exception);
+int APS5_VABI sceSystemServiceReenablePartyVoice();
+int APS5_VABI sceSystemServiceReenableVoiceRecognition();
+int APS5_VABI sceSystemServiceRegisterDaemon();
+int APS5_VABI sceSystemServiceReleaseBgmCpuBudget();
+int APS5_VABI sceSystemServiceReleaseFb0();
+int APS5_VABI sceSystemServiceRequestCameraCalibration();
+int APS5_VABI sceSystemServiceRequestPowerOff();
+int APS5_VABI sceSystemServiceRequestReboot();
+int APS5_VABI sceSystemServiceRequestToChangeRenderingMode();
+int APS5_VABI sceSystemServiceResumeLocalProcess(std::int32_t processId);
+int APS5_VABI sceSystemServiceSaveVideoToken(std::int32_t userId, const char* token);
+int APS5_VABI sceSystemServiceSetControllerFocusPermission(std::uint8_t permission);
+int APS5_VABI sceSystemServiceSetGpuLoadEmulationMode(std::uint32_t mode);
+int APS5_VABI sceSystemServiceSetOutOfVrPlayAreaFlag(std::uint8_t flag);
+int APS5_VABI sceSystemServiceSetOutOfVrPlayZoneWarning();
+int APS5_VABI sceSystemServiceSetPowerSaveLevel(std::uint32_t level);
+int APS5_VABI sceSystemServiceShowClosedCaptionAdvancedSettings();
+int APS5_VABI sceSystemServiceShowClosedCaptionSettings();
+int APS5_VABI sceSystemServiceShowErrorDialog(std::uint32_t error, const char* message);
+int APS5_VABI sceSystemServiceShowEyeToEyeDistanceSetting();
+int APS5_VABI sceSystemServiceShowImposeMenuForPs2Emu(std::uint8_t enabled, std::uint64_t reserved);
+int APS5_VABI sceSystemServiceSuspendBackgroundApp(std::int32_t first, std::int32_t second);
+int APS5_VABI sceSystemServiceSuspendLocalProcess(std::int32_t processId);
+int APS5_VABI sceSystemServiceTelemetrySetData(const char* key, const void* data, std::size_t size);
+int APS5_VABI sceSystemServiceTelemetrySetData2(const char* key, const char* data);
+int APS5_VABI sceSystemServiceTickVideoPlayback();
+int APS5_VABI sceSystemServiceTurnOffScreenSaver();
+int APS5_VABI sceSystemServiceUsbStorageGetDeviceInfo(std::uint32_t device, UsbStorageDeviceInfo* info);
+int APS5_VABI sceSystemServiceUsbStorageGetDeviceList(std::uint32_t* devices, std::int32_t* count);
+int APS5_VABI sceSystemServiceUsbStorageGetdentsClose(std::int32_t fd);
+int APS5_VABI sceSystemServiceUsbStorageGetdentsOpen(std::uint32_t device, std::int32_t* fd, std::uint64_t* bufferSize);
+int APS5_VABI sceSystemServiceUsbStorageGetdentsRead(std::int32_t fd, void* buffer, std::uint64_t bufferSize, std::uint64_t* bytesRead);
+int APS5_VABI sceSystemServiceUsbStorageInit(void* attr);
+bool APS5_VABI sceSystemServiceUsbStorageIsExist(std::uint32_t device, const char* directory, std::uint8_t* exists);
+int APS5_VABI sceSystemServiceUsbStorageRegisterCallback(std::int32_t eventType, UsbStorageCallback callback, void* arg);
+int APS5_VABI sceSystemServiceUsbStorageRegisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+int APS5_VABI sceSystemServiceUsbStorageRegisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+int APS5_VABI sceSystemServiceUsbStorageRequestMap(std::uint32_t device, const char* directory, std::int32_t flags, std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId);
+int APS5_VABI sceSystemServiceUsbStorageRequestMapWSB(std::uint32_t device, const char* directory, std::int32_t flags, std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId);
+int APS5_VABI sceSystemServiceUsbStorageRequestUnmap(std::uint32_t device, const char* directory);
+int APS5_VABI sceSystemServiceUsbStorageTerm();
+int APS5_VABI sceSystemServiceUsbStorageUnregisterCallback(std::int32_t eventType, UsbStorageCallback callback);
+int APS5_VABI sceSystemServiceUsbStorageUnregisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+int APS5_VABI sceSystemServiceUsbStorageUnregisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+int APS5_VABI sceSystemStateMgrCancelShutdownTimer();
+int APS5_VABI sceSystemStateMgrEnterMediaPlaybackMode();
+int APS5_VABI sceSystemStateMgrEnterStandby();
+int APS5_VABI sceSystemStateMgrExtendShutdownTimer();
+int APS5_VABI sceSystemStateMgrExtendShutdownTimerForPostAutoUpdateProcess();
+int APS5_VABI sceSystemStateMgrGetCurrentState();
+int APS5_VABI sceSystemStateMgrGetTriggerCode();
+bool APS5_VABI sceSystemStateMgrIsBdDriveReady();
+int APS5_VABI sceSystemStateMgrIsGpuPerformanceNormal();
+bool APS5_VABI sceSystemStateMgrIsShellUIShutdownInProgress();
+bool APS5_VABI sceSystemStateMgrIsStandbyModeEnabled();
+int APS5_VABI sceSystemStateMgrLeaveMediaPlaybackMode();
+int APS5_VABI sceSystemStateMgrNotifySystemSuspendResumeProgress(const char* progress);
+int APS5_VABI sceSystemStateMgrReboot();
+int APS5_VABI sceSystemStateMgrRequestToKeepMainOnStandby(const char* reason);
+int APS5_VABI sceSystemStateMgrSendCecOneTouchPlayCommand();
+int APS5_VABI sceSystemStateMgrStartRebootTimer(std::int32_t mode);
+int APS5_VABI sceSystemStateMgrStartShutdownTimer();
+int APS5_VABI sceSystemStateMgrStartStadbyTimer();
+int APS5_VABI sceSystemStateMgrStartVshAutoUpdateTimer();
+int APS5_VABI sceSystemStateMgrTickMusicPlayback();
+int APS5_VABI sceSystemStateMgrTickPartyChat();
+int APS5_VABI sceSystemStateMgrTurnOff();
+int APS5_VABI sceSystemStateMgrVshAutoUpdate();
+int APS5_VABI sceSystemStateMgrWaitVshAutoUpdateVerifyDone();
+int APS5_VABI sceSystemStateMgrWakeUp(std::uint16_t trigger);
+
+}
diff --git a/core/libs/prx/libSceSystemService/libSceSystemService.hpp b/core/libs/prx/libSceSystemService/libSceSystemService.hpp
new file mode 100644
index 0000000000..e3ff176277
--- /dev/null
+++ b/core/libs/prx/libSceSystemService/libSceSystemService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemService/include/SystemService.hpp"
diff --git a/core/libs/prx/libSceSystemTts/Export.cpp b/core/libs/prx/libSceSystemTts/Export.cpp
index d895b270e8..dc975b9b4a 100644
--- a/core/libs/prx/libSceSystemTts/Export.cpp
+++ b/core/libs/prx/libSceSystemTts/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemTts/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemTts/include/Api.hpp b/core/libs/prx/libSceSystemTts/include/Api.hpp
new file mode 100644
index 0000000000..d0942cfe30
--- /dev/null
+++ b/core/libs/prx/libSceSystemTts/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemTtsCancel();
+int APS5_VABI sceSystemTtsIsAccessibilityAvailable();
+int APS5_VABI sceSystemTtsRegisterCallback();
+int APS5_VABI sceSystemTtsSpeakRequest();
+int APS5_VABI sceSystemTtsUnregisterCallback();
+
+}
diff --git a/core/libs/prx/libSceSystemTts/libSceSystemTts.hpp b/core/libs/prx/libSceSystemTts/libSceSystemTts.hpp
new file mode 100644
index 0000000000..f2c384d4c4
--- /dev/null
+++ b/core/libs/prx/libSceSystemTts/libSceSystemTts.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemTts/include/Api.hpp"
diff --git a/core/libs/prx/libSceTEEClient/Export.cpp b/core/libs/prx/libSceTEEClient/Export.cpp
index 58c703695b..71faf0cb5f 100644
--- a/core/libs/prx/libSceTEEClient/Export.cpp
+++ b/core/libs/prx/libSceTEEClient/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceTEEClient/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceTEEClient/include/Api.hpp b/core/libs/prx/libSceTEEClient/include/Api.hpp
new file mode 100644
index 0000000000..2c38c96684
--- /dev/null
+++ b/core/libs/prx/libSceTEEClient/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI AMDTEE_DLM_FetchDebugStrings_nid_postfix(void);
+int APS5_VABI AMDTEE_DLM_GetDebugToken_nid_postfix(void);
+int APS5_VABI AMDTEE_DLM_StopTADebug_nid_postfix(void);
+int APS5_VABI TEECI_InitASD_nid_postfix(void);
+int APS5_VABI TEECI_SetTimeout_nid_postfix(void);
+int APS5_VABI TEEC_CloseSession_nid_postfix(void);
+int APS5_VABI TEEC_InvokeCommand_nid_postfix(void);
+int APS5_VABI TEEC_OpenSession_nid_postfix(void);
+int APS5_VABI TEEC_ReleaseSharedMemory_nid_postfix(void);
+int APS5_VABI TEEC_RequestCancellation_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceTEEClient/libSceTEEClient.hpp b/core/libs/prx/libSceTEEClient/libSceTEEClient.hpp
new file mode 100644
index 0000000000..7b3b5682b7
--- /dev/null
+++ b/core/libs/prx/libSceTEEClient/libSceTEEClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceTEEClient/include/Api.hpp"
diff --git a/core/libs/prx/libSceTextToSpeech/Export.cpp b/core/libs/prx/libSceTextToSpeech/Export.cpp
index 05c84e9df9..cd4a31d3f6 100644
--- a/core/libs/prx/libSceTextToSpeech/Export.cpp
+++ b/core/libs/prx/libSceTextToSpeech/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceTextToSpeech/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceTextToSpeech/include/Api.hpp b/core/libs/prx/libSceTextToSpeech/include/Api.hpp
new file mode 100644
index 0000000000..6f8845b245
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceTextToSpeechCancelImpl();
+int APS5_VABI sceTextToSpeechCloseImpl();
+int APS5_VABI sceTextToSpeechGetStatusImpl();
+int APS5_VABI sceTextToSpeechInitImpl();
+int APS5_VABI sceTextToSpeechOpenImpl();
+int APS5_VABI sceTextToSpeechPauseImpl();
+int APS5_VABI sceTextToSpeechResumeImpl();
+int APS5_VABI sceTextToSpeechSpeakContinuousImpl();
+int APS5_VABI sceTextToSpeechSpeakImpl();
+int APS5_VABI sceTextToSpeechTermImpl();
+
+}
diff --git a/core/libs/prx/libSceTextToSpeech/libSceTextToSpeech.hpp b/core/libs/prx/libSceTextToSpeech/libSceTextToSpeech.hpp
new file mode 100644
index 0000000000..0238da246a
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech/libSceTextToSpeech.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceTextToSpeech/include/Api.hpp"
diff --git a/core/libs/prx/libSceTextToSpeech2/Export.cpp b/core/libs/prx/libSceTextToSpeech2/Export.cpp
index 375bf561f4..02aaefeadf 100644
--- a/core/libs/prx/libSceTextToSpeech2/Export.cpp
+++ b/core/libs/prx/libSceTextToSpeech2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceTextToSpeech2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -9,28 +10,6 @@ constexpr std::int32_t SCE_KERNEL_ERROR_EOPNOTSUPP = static_cast<std::int32_t>(0
 
 }
 
-struct TextToSpeechInitParameter {
-    std::uint32_t version;
-    std::int32_t threadPriority;
-    std::uint64_t cpuAffinity;
-    std::uint8_t reserved[48];
-};
-
-struct TextToSpeechOpenParameter {
-    std::uint32_t language;
-    std::uint32_t voiceType;
-    std::uint8_t reserved[56];
-};
-
-struct TextToSpeechSpeakParameter {
-    const char16_t* text;
-    std::uint32_t length;
-    std::uint32_t mode;
-    std::uint32_t volume;
-    std::int32_t speed;
-    std::uint8_t reserved[40];
-};
-
 static_assert(sizeof(TextToSpeechInitParameter) == 64);
 static_assert(sizeof(TextToSpeechOpenParameter) == 64);
 static_assert(sizeof(TextToSpeechSpeakParameter) == 64);
diff --git a/core/libs/prx/libSceTextToSpeech2/include/Api.hpp b/core/libs/prx/libSceTextToSpeech2/include/Api.hpp
new file mode 100644
index 0000000000..23340118f7
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech2/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct TextToSpeechInitParameter {
+    std::uint32_t version;
+    std::int32_t threadPriority;
+    std::uint64_t cpuAffinity;
+    std::uint8_t reserved[48];
+};
+
+struct TextToSpeechOpenParameter {
+    std::uint32_t language;
+    std::uint32_t voiceType;
+    std::uint8_t reserved[56];
+};
+
+struct TextToSpeechSpeakParameter {
+    const char16_t* text;
+    std::uint32_t length;
+    std::uint32_t mode;
+    std::uint32_t volume;
+    std::int32_t speed;
+    std::uint8_t reserved[40];
+};
+
+extern "C" {
+
+int APS5_VABI sceTextToSpeech2GetSystemStatus(std::int32_t* status);
+std::int32_t APS5_VABI sceTextToSpeech2Initialize(const TextToSpeechInitParameter* param);
+int APS5_VABI sceTextToSpeech2Cancel();
+int APS5_VABI sceTextToSpeech2Close();
+int APS5_VABI sceTextToSpeech2GetSpeechStatus(std::int32_t* status);
+int APS5_VABI sceTextToSpeech2Open(const TextToSpeechOpenParameter* parameter);
+int APS5_VABI sceTextToSpeech2Speak(const TextToSpeechSpeakParameter* parameter);
+int APS5_VABI sceTextToSpeech2Terminate();
+
+}
diff --git a/core/libs/prx/libSceTextToSpeech2/libSceTextToSpeech2.hpp b/core/libs/prx/libSceTextToSpeech2/libSceTextToSpeech2.hpp
new file mode 100644
index 0000000000..998b2dca7a
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech2/libSceTextToSpeech2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceTextToSpeech2/include/Api.hpp"
diff --git a/core/libs/prx/libSceTtsCoreG3Bc/libSceTtsCoreG3Bc.hpp b/core/libs/prx/libSceTtsCoreG3Bc/libSceTtsCoreG3Bc.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceTtsCoreG3Bc/libSceTtsCoreG3Bc.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceUlt/CMakeLists.txt b/core/libs/prx/libSceUlt/CMakeLists.txt
index ea7e2f4a31..5736205384 100644
--- a/core/libs/prx/libSceUlt/CMakeLists.txt
+++ b/core/libs/prx/libSceUlt/CMakeLists.txt
@@ -41,11 +41,22 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceUlt>")
         endif()
     endforeach()
+    add_test_executable(guest_ult_finalize_allocation_tests ${LIBS_INCLUDE_DIR}/tests/UltFinalizeAllocation.cpp Export.cpp src/ReaderWriterLock.cpp)
+    target_include_directories(guest_ult_finalize_allocation_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_ult_finalize_allocation_tests PRIVATE libc libkernel)
+    configure_windows_unwind(guest_ult_finalize_allocation_tests)
+    add_test(NAME guest_ult_finalize_allocation COMMAND guest_ult_finalize_allocation_tests)
+    set_tests_properties(guest_ult_finalize_allocation PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_ult_finalize_allocation PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+
     add_test_executable(guest_ult_sync_tests ${LIBS_INCLUDE_DIR}/tests/GuestUltSync.cpp)
     target_include_directories(guest_ult_sync_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_ult_sync_tests PRIVATE libSceUlt libc)
+    target_link_libraries(guest_ult_sync_tests PRIVATE libSceUlt libc libkernel)
     configure_windows_unwind(guest_ult_sync_tests)
-    foreach(testCase IN ITEMS mutex-trylock opt-params rwlock-validation rwlock-readers rwlock-writer rwlock-pool rwlock-finalize ulthreads)
+    foreach(testCase IN ITEMS mutex-trylock opt-params rwlock-validation rwlock-readers rwlock-writer rwlock-pool rwlock-finalize ulthreads get-info queue-waiters info-waiters)
         add_test(NAME guest_ult_sync_${testCase} COMMAND guest_ult_sync_tests ${testCase})
         set_tests_properties(guest_ult_sync_${testCase} PROPERTIES TIMEOUT 20)
         if(WIN32)
diff --git a/core/libs/prx/libSceUlt/Export.cpp b/core/libs/prx/libSceUlt/Export.cpp
index f876cfba21..3b55ed03e2 100644
--- a/core/libs/prx/libSceUlt/Export.cpp
+++ b/core/libs/prx/libSceUlt/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceUlt/include/Api.hpp"
 #include <algorithm>
 #include <atomic>
 #include <bit>
@@ -10,6 +13,7 @@
 #include <memory>
 #include <mutex>
 #include <stdexcept>
+#include <string>
 #include <unordered_map>
 #include <vector>
 
@@ -18,14 +22,8 @@
 #include "SceUltTypes.hpp"
 #include "prx/libSceUlt/src/ReaderWriterLock.hpp"
 
-extern "C" int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-extern "C" int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-extern "C" void APS5_VABI scePthreadExit(void* retval);
-extern "C" void APS5_VABI scePthreadYield();
-
 namespace {
 
-
 std::mutex gMutex;
 std::unordered_map<void*, std::shared_ptr<UltMutexState>> gMutexes;
 std::unordered_map<void*, std::shared_ptr<UltConditionState>> gConditions;
@@ -36,7 +34,6 @@ std::unordered_map<void*, std::shared_ptr<UltQueueState>> gQueues;
 std::unordered_map<void*, UltRuntimeState> gRuntimes;
 std::unordered_map<void*, std::shared_ptr<UltUlthreadState>> gUlthreads;
 
-
 int validateCommonOptParam(const void* optParam) {
     if (optParam == nullptr) return ULT_OK;
     if ((reinterpret_cast<std::uintptr_t>(optParam) & 7u) != 0) return ULT_ERROR_ALIGNMENT;
@@ -77,14 +74,15 @@ int QueueTransfer(void* queue, void* data, const void* source, bool push, bool b
     const auto ready = [&] { return !state->_alive || (push ? pool._free : state->_head) != UINT32_MAX; };
     if (!ready()) {
         if (!blocking) return ULT_ERROR_AGAIN;
-        ++state->_waiters;
+        auto& waiters = push ? state->_waitingPushers : state->_waitingPoppers;
+        ++waiters;
         try {
             (push ? pool._spaceAvailable : state->_dataAvailable).wait(lock, ready);
         } catch (...) {
-            --state->_waiters;
+            --waiters;
             throw;
         }
-        --state->_waiters;
+        --waiters;
         if (!state->_alive) return ULT_ERROR_STATE;
     }
     if (push) {
@@ -95,6 +93,7 @@ int QueueTransfer(void* queue, void* data, const void* source, bool push, bool b
         if (state->_tail == UINT32_MAX) state->_head = slot;
         else pool._next[state->_tail] = slot;
         state->_tail = slot;
+        ++state->_queuedItems;
     } else {
         const auto slot = state->_head;
         std::memcpy(data, pool._data.data() + slot * pool._dataSize, state->_dataSize);
@@ -102,6 +101,7 @@ int QueueTransfer(void* queue, void* data, const void* source, bool push, bool b
         if (state->_head == UINT32_MAX) state->_tail = UINT32_MAX;
         pool._next[slot] = pool._free;
         pool._free = slot;
+        --state->_queuedItems;
     }
     lock.unlock();
     if (push) state->_dataAvailable.notify_one();
@@ -116,6 +116,7 @@ void ReleaseQueue(UltQueueState& state) {
         pool._free = state._head;
     }
     state._head = state._tail = UINT32_MAX;
+    state._queuedItems = 0;
     state._alive = false;
     --pool._queues;
 }
@@ -132,6 +133,14 @@ void* APS5_VABI ulthreadRunner(void* arg) {
 
 }
 
+UltThreadIdentity UltCurrentThreadIdentity_nid_no_patch() {
+    if (gCurrentUlthread != nullptr) return {};
+    const auto self = scePthreadSelf();
+    std::uintptr_t thread;
+    std::memcpy(&thread, self, sizeof(thread));
+    return {reinterpret_cast<void*>(thread), 1};
+}
+
 bool UltWaitingPoolExists(void* pool) {
     std::lock_guard<std::mutex> lock(gMutex);
     return gResourcePools.contains(pool);
@@ -152,6 +161,7 @@ int APS5_VABI sceUltFinalize() {
             return ULT_ERROR_BUSY;
         }
         semaphores.reserve(gSemaphores.size());
+        mutexes.reserve(gMutexes.size());
         for (auto& entry : gSemaphores) {
             auto& state = entry.second;
             std::lock_guard<std::mutex> stateLock(state->_mutex);
@@ -159,7 +169,6 @@ int APS5_VABI sceUltFinalize() {
             semaphores.push_back(state);
         }
         gSemaphores.clear();
-        mutexes.reserve(gMutexes.size());
         for (auto& entry : gMutexes) {
             auto& state = entry.second;
             std::lock_guard<std::mutex> stateLock(state->_mutex);
@@ -246,7 +255,6 @@ int APS5_VABI _sceUltConditionVariableOptParamInitialize(UltOptParam* optParam,
 }
 
 int APS5_VABI sceUltMutexCreate(void* mutex, const char* name, void* waitingQueueResourcePool, const UltMutexOptParam* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)buildVersion;
     if (mutex == nullptr) {
         return ULT_ERROR_NULL;
@@ -254,6 +262,9 @@ int APS5_VABI sceUltMutexCreate(void* mutex, const char* name, void* waitingQueu
     auto state = std::make_shared<UltMutexState>();
     state->_attribute = optParam != nullptr ? optParam->attribute : 0;
     state->_waitingPool = waitingQueueResourcePool;
+    if (name != nullptr) {
+        std::strncpy(state->_name, name, sizeof(state->_name) - 1);
+    }
     std::lock_guard<std::mutex> lock(gMutex);
     if (waitingQueueResourcePool != nullptr && gResourcePools.find(waitingQueueResourcePool) == gResourcePools.end()) {
         return ULT_ERROR_INVALID;
@@ -320,6 +331,7 @@ int APS5_VABI sceUltMutexLock(void* mutex) {
     if (!state->_alive) {
         return ULT_ERROR_STATE;
     }
+    state->_ownerIdentity = UltCurrentThreadIdentity_nid_no_patch();
     state->_owner = self;
     state->_lockCount = 1;
     return ULT_OK;
@@ -347,6 +359,7 @@ int APS5_VABI sceUltMutexTryLock(void* mutex) {
     if (state->_lockCount != 0) {
         return ULT_ERROR_BUSY;
     }
+    state->_ownerIdentity = UltCurrentThreadIdentity_nid_no_patch();
     state->_owner = self;
     state->_lockCount = 1;
     return ULT_OK;
@@ -373,13 +386,13 @@ int APS5_VABI sceUltMutexUnlock(void* mutex) {
     --state->_lockCount;
     if (state->_lockCount == 0) {
         state->_owner = {};
+        state->_ownerIdentity = {};
         state->_available.notify_one();
     }
     return ULT_OK;
 }
 
 int APS5_VABI sceUltConditionVariableCreate(void* condition, const char* name, void* mutex, const void* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)buildVersion;
     if (condition == nullptr || mutex == nullptr) return ULT_ERROR_NULL;
     if (optParam != nullptr) throw std::runtime_error("ULT condition variable options are not implemented");
@@ -389,6 +402,10 @@ int APS5_VABI sceUltConditionVariableCreate(void* condition, const char* name, v
     if (gConditions.contains(condition)) return ULT_ERROR_STATE;
     auto state = std::make_shared<UltConditionState>();
     state->_mutex = mutexIt->second;
+    state->_mutexObject = mutex;
+    if (name != nullptr) {
+        std::strncpy(state->_name, name, sizeof(state->_name) - 1);
+    }
     std::lock_guard stateLock(state->_mutex->_mutex);
     if (!state->_mutex->_alive) return ULT_ERROR_STATE;
     gConditions.emplace(condition, state);
@@ -445,12 +462,14 @@ int APS5_VABI sceUltConditionVariableWait(void* condition) {
     std::unique_lock lock(held->_mutex);
     if (!state->_alive || !held->_alive || held->_owner != owner || held->_lockCount == 0) return ULT_ERROR_STATE;
     if (held->_lockCount != 1) throw std::runtime_error("ULT condition wait with a recursively held mutex is not implemented");
+    const auto ownerIdentity = held->_ownerIdentity;
     UltConditionWaiter waiter;
     state->_queue.push_back(&waiter);
     ++state->_waiters;
     ++held->_conditionWaiters;
     held->_lockCount = 0;
     held->_owner = {};
+    held->_ownerIdentity = {};
     held->_available.notify_one();
     try {
         waiter._available.wait(lock, [&] { return waiter._signaled || !state->_alive || !held->_alive; });
@@ -475,6 +494,7 @@ int APS5_VABI sceUltConditionVariableWait(void* condition) {
     --held->_conditionWaiters;
     if (!held->_alive || !state->_alive) return ULT_ERROR_STATE;
     held->_owner = owner;
+    held->_ownerIdentity = ownerIdentity;
     held->_lockCount = 1;
     return ULT_OK;
 }
@@ -484,15 +504,18 @@ std::uint64_t APS5_VABI sceUltWaitingQueueResourcePoolGetWorkAreaSize(std::uint3
 }
 
 int APS5_VABI sceUltWaitingQueueResourcePoolCreate(void* pool, const char* name, std::uint32_t numThreads, std::uint32_t numSyncObjects, void* workArea, const void* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)optParam;
     (void)buildVersion;
     if (pool == nullptr) {
         return ULT_ERROR_NULL;
     }
     std::memset(pool, 0, 256);
+    UltResourcePoolState state{numThreads, numSyncObjects, workArea};
+    if (name != nullptr) {
+        std::strncpy(state._name, name, sizeof(state._name) - 1);
+    }
     std::lock_guard<std::mutex> lock(gMutex);
-    gResourcePools[pool] = {numThreads, numSyncObjects, workArea};
+    gResourcePools[pool] = state;
     return ULT_OK;
 }
 
@@ -524,7 +547,7 @@ int APS5_VABI sceUltWaitingQueueResourcePoolDestroy(void* pool) {
     for (const auto& entry : gQueues) {
         if (entry.second->_pool && entry.second->_pool->_waitingPool == pool) {
             std::lock_guard<std::mutex> poolLock(entry.second->_pool->_mutex);
-            if (entry.second->_waiters != 0) {
+            if (entry.second->_waitingPushers != 0 || entry.second->_waitingPoppers != 0) {
                 return ULT_ERROR_STATE;
             }
         }
@@ -545,7 +568,6 @@ std::uint64_t APS5_VABI sceUltQueueDataResourcePoolGetWorkAreaSize(std::uint32_t
 }
 
 int APS5_VABI sceUltQueueDataResourcePoolCreate(void* pool, const char* name, std::uint32_t numData, std::uint64_t dataSize, std::uint32_t numQueueObject, void* waitingQueueResourcePool, void* workArea, const void* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)optParam;
     (void)buildVersion;
     if (pool == nullptr) {
@@ -565,6 +587,9 @@ int APS5_VABI sceUltQueueDataResourcePoolCreate(void* pool, const char* name, st
     state->_numQueueObject = numQueueObject;
     state->_waitingPool = waitingQueueResourcePool;
     state->_workArea = workArea;
+    if (name != nullptr) {
+        std::strncpy(state->_name, name, sizeof(state->_name) - 1);
+    }
     state->_data.resize(numData * dataSize);
     state->_next.resize(numData);
     for (std::uint32_t slot = 0; slot < numData; ++slot) {
@@ -589,7 +614,6 @@ int APS5_VABI sceUltQueueDataResourcePoolDestroy(void* pool) {
 }
 
 int APS5_VABI sceUltQueueCreate(void* queue, const char* name, std::uint64_t dataSize, void* waitingQueueResourcePool, void* queueDataResourcePool, const void* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)optParam;
     (void)buildVersion;
     if (queue == nullptr) {
@@ -599,6 +623,11 @@ int APS5_VABI sceUltQueueCreate(void* queue, const char* name, std::uint64_t dat
     if (dataSize == 0) return ULT_ERROR_RANGE;
     auto state = std::make_shared<UltQueueState>();
     state->_dataSize = dataSize;
+    state->_waitingPool = waitingQueueResourcePool;
+    state->_dataPool = queueDataResourcePool;
+    if (name != nullptr) {
+        std::strncpy(state->_name, name, sizeof(state->_name) - 1);
+    }
     std::lock_guard<std::mutex> lock(gMutex);
     auto dataPoolIt = gQueueDataPools.find(queueDataResourcePool);
     if (dataPoolIt == gQueueDataPools.end()) {
@@ -644,7 +673,7 @@ int APS5_VABI sceUltQueueDestroy(void* queue) {
     auto& pool = *state->_pool;
     {
         std::lock_guard stateLock(pool._mutex);
-        if (state->_waiters != 0) return ULT_ERROR_STATE;
+        if (state->_waitingPushers != 0 || state->_waitingPoppers != 0) return ULT_ERROR_STATE;
         ReleaseQueue(*state);
         gQueues.erase(it);
     }
@@ -653,7 +682,6 @@ int APS5_VABI sceUltQueueDestroy(void* queue) {
 }
 
 int APS5_VABI sceUltSemaphoreCreate(void* semaphore, const char* name, std::uint32_t numInitialResource, void* waitingQueueResourcePool, const void* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)optParam;
     (void)buildVersion;
     if (semaphore == nullptr) {
@@ -665,6 +693,9 @@ int APS5_VABI sceUltSemaphoreCreate(void* semaphore, const char* name, std::uint
     auto state = std::make_shared<UltSemaphoreState>();
     state->_resources = std::bit_cast<std::int32_t>(numInitialResource);
     state->_waitingPool = waitingQueueResourcePool;
+    if (name != nullptr) {
+        std::strncpy(state->_name, name, sizeof(state->_name) - 1);
+    }
     std::lock_guard<std::mutex> lock(gMutex);
     if (waitingQueueResourcePool != nullptr && gResourcePools.find(waitingQueueResourcePool) == gResourcePools.end()) {
         return ULT_ERROR_INVALID;
@@ -782,15 +813,18 @@ std::uint64_t APS5_VABI sceUltUlthreadRuntimeGetWorkAreaSize(std::uint32_t maxNu
 }
 
 int APS5_VABI sceUltUlthreadRuntimeCreate(void* runtime, const char* name, std::uint32_t maxNumUlthread, std::uint32_t numWorkerThread, void* workArea, const void* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)optParam;
     (void)buildVersion;
     if (runtime == nullptr) {
         return ULT_ERROR_NULL;
     }
     std::memset(runtime, 0, 4096);
+    UltRuntimeState state{maxNumUlthread, numWorkerThread, workArea};
+    if (name != nullptr) {
+        std::strncpy(state._name, name, sizeof(state._name) - 1);
+    }
     std::lock_guard<std::mutex> lock(gMutex);
-    gRuntimes[runtime] = {maxNumUlthread, numWorkerThread, workArea};
+    gRuntimes[runtime] = state;
     return ULT_OK;
 }
 
@@ -807,6 +841,9 @@ int APS5_VABI sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthread
     state->_arg = arg;
     state->_object = ulthread;
     state->_runtime = runtime;
+    if (name != nullptr) {
+        std::strncpy(state->_name, name, sizeof(state->_name) - 1);
+    }
     {
         std::lock_guard<std::mutex> lock(gMutex);
         if (gRuntimes.find(runtime) == gRuntimes.end()) {
@@ -818,7 +855,8 @@ int APS5_VABI sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthread
         std::memset(ulthread, 0, 512);
         gUlthreads[ulthread] = state;
     }
-    const int result = scePthreadCreate(&state->_thread, nullptr, ulthreadRunner, state.get(), name != nullptr ? name : "");
+    const std::string threadName = name != nullptr ? std::string(name).substr(0, 31) : std::string();
+    const int result = scePthreadCreate(&state->_thread, nullptr, ulthreadRunner, state.get(), threadName.c_str());
     if (result != 0) {
         std::lock_guard<std::mutex> lock(gMutex);
         gUlthreads.erase(ulthread);
@@ -885,6 +923,7 @@ int APS5_VABI sceUltUlthreadYield() {
         return ULT_ERROR_STATE;
     }
     scePthreadYield();
+
     return ULT_OK;
 }
 
@@ -894,6 +933,7 @@ int APS5_VABI sceUltUlthreadExit(std::int32_t status) {
     }
     gCurrentUlthread->_exited.store(true, std::memory_order_release);
     scePthreadExit(reinterpret_cast<void*>(static_cast<std::intptr_t>(status)));
+
     return ULT_OK;
 }
 
@@ -992,48 +1032,194 @@ int APS5_VABI sceUltConditionVariableSignalAll(void* conditionVariable) {
 }
 
 int APS5_VABI sceUltGetConditionVariableInfo(void* object, UltConditionVariableInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    if (waitingThreads == nullptr && capacity != 0) return ULT_ERROR_NULL;
+    std::shared_ptr<UltConditionState> state;
+    {
+        std::lock_guard lock(gMutex);
+        const auto it = gConditions.find(object);
+        if (it == gConditions.end()) return ULT_ERROR_STATE;
+        state = it->second;
+    }
+    std::lock_guard stateLock(state->_mutex->_mutex);
+    if (!state->_alive) return ULT_ERROR_STATE;
+    if (capacity != 0 && !state->_queue.empty()) NotImplemented_nid_no_patch(__func__);
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltConditionVariableInfo);
+    info->object = object;
+    std::memcpy(info->name, state->_name, sizeof(info->name));
+    info->mutex = state->_mutexObject;
+    info->waitingThreads = static_cast<std::uint32_t>(state->_queue.size());
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltGetMutexInfo(void* object, UltMutexInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    if (waitingThreads == nullptr && capacity != 0) return ULT_ERROR_NULL;
+    std::shared_ptr<UltMutexState> state;
+    {
+        std::lock_guard lock(gMutex);
+        const auto it = gMutexes.find(object);
+        if (it == gMutexes.end()) return ULT_ERROR_STATE;
+        state = it->second;
+    }
+    std::lock_guard stateLock(state->_mutex);
+    if (!state->_alive) return ULT_ERROR_STATE;
+    for (std::uint32_t index = 0; index < capacity; ++index) {
+        if (waitingThreads[index].size != sizeof(UltWaitingThreadInfo)) return ULT_ERROR_INVALID;
+    }
+    if (capacity != 0 && state->_waiters != 0) NotImplemented_nid_no_patch(__func__);
+    if (state->_lockCount != 0 && (state->_attribute != 0 || state->_lockCount > 1 || state->_ownerIdentity.type != 1)) NotImplemented_nid_no_patch(__func__);
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltMutexInfo);
+    info->object = object;
+    std::memcpy(info->name, state->_name, sizeof(info->name));
+    info->waitingQueuePool = state->_waitingPool;
+    info->owner = state->_ownerIdentity.thread;
+    info->ownerType = state->_ownerIdentity.type;
+    info->attributes = state->_attribute;
+    info->waitingThreads = state->_waiters;
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltGetQueueDataResourcePoolInfo(void* object, UltQueueDataResourcePoolInfo* info) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    std::shared_ptr<UltQueueDataPoolState> state;
+    {
+        std::lock_guard lock(gMutex);
+        const auto it = gQueueDataPools.find(object);
+        if (it == gQueueDataPools.end()) return ULT_ERROR_STATE;
+        state = it->second;
+    }
+    std::lock_guard poolLock(state->_mutex);
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltQueueDataResourcePoolInfo);
+    info->object = object;
+    std::memcpy(info->name, state->_name, sizeof(info->name));
+    info->waitingQueuePool = state->_waitingPool;
+    info->dataSize = state->_dataSize;
+    info->maxItems = state->_numData;
+    info->maxQueues = state->_numQueueObject;
+    info->availableQueues = state->_numQueueObject > state->_queues ? state->_numQueueObject - state->_queues : 0;
+    std::uint32_t freeCount = 0;
+    for (auto next = state->_free; next != UINT32_MAX; next = state->_next[next]) {
+        ++freeCount;
+    }
+    info->availableItems = freeCount;
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltGetQueueInfo(void* object, UltQueueInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceUltGetReaderWriterLockInfo(void* object, UltReaderWriterLockInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    if (waitingThreads == nullptr && capacity != 0) return ULT_ERROR_NULL;
+    std::shared_ptr<UltQueueState> state;
+    {
+        std::lock_guard lock(gMutex);
+        const auto it = gQueues.find(object);
+        if (it == gQueues.end()) return ULT_ERROR_STATE;
+        state = it->second;
+    }
+    auto& pool = *state->_pool;
+    std::lock_guard poolLock(pool._mutex);
+    if (!state->_alive) return ULT_ERROR_STATE;
+    if (capacity != 0 && (state->_waitingPushers != 0 || state->_waitingPoppers != 0)) NotImplemented_nid_no_patch(__func__);
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltQueueInfo);
+    info->object = object;
+    std::memcpy(info->name, state->_name, sizeof(info->name));
+    info->waitingQueuePool = state->_waitingPool;
+    info->dataPool = state->_dataPool;
+    info->dataSize = state->_dataSize;
+    info->queuedItems = state->_queuedItems;
+    info->waitingPushers = state->_waitingPushers;
+    info->waitingPoppers = state->_waitingPoppers;
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltGetSemaphoreInfo(void* object, UltSemaphoreInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    if (waitingThreads == nullptr && capacity != 0) return ULT_ERROR_NULL;
+    std::shared_ptr<UltSemaphoreState> state;
+    {
+        std::lock_guard lock(gMutex);
+        const auto it = gSemaphores.find(object);
+        if (it == gSemaphores.end()) return ULT_ERROR_STATE;
+        state = it->second;
+    }
+    std::lock_guard stateLock(state->_mutex);
+    if (!state->_alive) return ULT_ERROR_STATE;
+    if (capacity != 0 && state->_waiters != 0) NotImplemented_nid_no_patch(__func__);
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltSemaphoreInfo);
+    info->object = object;
+    std::memcpy(info->name, state->_name, sizeof(info->name));
+    info->waitingQueuePool = state->_waitingPool;
+    info->resources = static_cast<std::uint32_t>(state->_resources);
+    info->waitingThreads = state->_waiters;
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltGetUlthreadInfo(void* object, UltUlthreadInfo* info) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    std::shared_ptr<UltUlthreadState> state;
+    {
+        std::lock_guard lock(gMutex);
+        const auto it = gUlthreads.find(object);
+        if (it == gUlthreads.end()) return ULT_ERROR_STATE;
+        state = it->second;
+    }
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltUlthreadInfo);
+    info->object = object;
+    std::memcpy(info->name, state->_name, sizeof(info->name));
+    info->runtime = state->_runtime;
+    info->contextAttribute = state->_contextAttribute;
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltGetUlthreadRuntimeInfo(void* runtime, UltUlthreadRuntimeInfo* info, void** ulthreads, std::uint32_t ulthreadCapacity, Pthread* workerThreads, std::uint32_t workerCapacity) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (runtime == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    if (ulthreads == nullptr && ulthreadCapacity != 0) return ULT_ERROR_NULL;
+    if (workerThreads == nullptr && workerCapacity != 0) return ULT_ERROR_NULL;
+    if (workerThreads != nullptr && workerCapacity != 0) throw std::runtime_error("ULT ulthread runtime worker thread handles are not implemented");
+    std::lock_guard lock(gMutex);
+    const auto it = gRuntimes.find(runtime);
+    if (it == gRuntimes.end()) return ULT_ERROR_STATE;
+    const auto& state = it->second;
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltUlthreadRuntimeInfo);
+    info->object = runtime;
+    std::memcpy(info->name, state._name, sizeof(info->name));
+    info->maxUlthreads = state._maxNumUlthread;
+    info->workerThreads = state._numWorkerThread;
+    std::uint32_t count = 0;
+    for (const auto& [obj, ulthread] : gUlthreads) {
+        if (ulthread->_runtime == runtime && !ulthread->_exited.load(std::memory_order_acquire)) {
+            if (ulthreads != nullptr && count < ulthreadCapacity) {
+                ulthreads[count] = obj;
+            }
+            ++count;
+        }
+    }
+    info->activeUlthreads = count;
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltGetWaitingQueueResourcePoolInfo(void* object, UltWaitingQueueResourcePoolInfo* info) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    std::lock_guard lock(gMutex);
+    const auto it = gResourcePools.find(object);
+    if (it == gResourcePools.end()) return ULT_ERROR_STATE;
+    const auto& state = it->second;
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltWaitingQueueResourcePoolInfo);
+    info->object = object;
+    std::memcpy(info->name, state._name, sizeof(info->name));
+    info->maxThreads = state._numThreads;
+    info->availableThreads = state._numThreads;
+    info->maxSyncObjects = state._numSyncObjects;
+    info->availableSyncObjects = state._numSyncObjects;
+    return ULT_OK;
 }
 
 int APS5_VABI sceUltAbstractThreadFactoryCreateThread() {
@@ -1096,5 +1282,4 @@ int APS5_VABI sceUltUlthreadFactoryInitialize() {
     return 0;
 }
 
-
 }
diff --git a/core/libs/prx/libSceUlt/SceUltTypes.hpp b/core/libs/prx/libSceUlt/SceUltTypes.hpp
index 4c77af1649..f218503bbc 100644
--- a/core/libs/prx/libSceUlt/SceUltTypes.hpp
+++ b/core/libs/prx/libSceUlt/SceUltTypes.hpp
@@ -265,10 +265,16 @@ static_assert(offsetof(UltUlthreadInfo, runtime) == 56);
 static_assert(offsetof(UltUlthreadInfo, fiber) == 64);
 static_assert(offsetof(UltUlthreadInfo, reserved) == 192);
 
+struct UltThreadIdentity {
+    void* thread = nullptr;
+    std::uint32_t type = 0;
+};
+
 struct UltMutexState {
     std::mutex _mutex;
     std::condition_variable _available;
     std::thread::id _owner{};
+    UltThreadIdentity _ownerIdentity;
     std::uint32_t _lockCount = 0;
     std::uint32_t _waiters = 0;
     std::uint32_t _conditions = 0;
@@ -276,6 +282,7 @@ struct UltMutexState {
     bool _alive = true;
     std::uint32_t _attribute = 0;
     void* _waitingPool = nullptr;
+    char _name[32]{};
 };
 
 struct UltConditionWaiter {
@@ -288,6 +295,8 @@ struct UltConditionState {
     std::list<UltConditionWaiter*> _queue;
     std::uint32_t _waiters = 0;
     bool _alive = true;
+    void* _mutexObject = nullptr;
+    char _name[32]{};
 };
 
 struct UltSemaphoreState {
@@ -297,12 +306,14 @@ struct UltSemaphoreState {
     std::uint32_t _waiters = 0;
     bool _alive = true;
     void* _waitingPool = nullptr;
+    char _name[32]{};
 };
 
 struct UltResourcePoolState {
     std::uint32_t _numThreads = 0;
     std::uint32_t _numSyncObjects = 0;
     void* _workArea = nullptr;
+    char _name[32]{};
 };
 
 struct UltQueueDataPoolState {
@@ -317,6 +328,7 @@ struct UltQueueDataPoolState {
     std::uint32_t _numQueueObject = 0;
     void* _waitingPool = nullptr;
     void* _workArea = nullptr;
+    char _name[32]{};
 };
 
 struct UltQueueState {
@@ -324,15 +336,21 @@ struct UltQueueState {
     std::condition_variable _dataAvailable;
     std::uint32_t _head = UINT32_MAX;
     std::uint32_t _tail = UINT32_MAX;
-    std::uint32_t _waiters = 0;
+    std::uint32_t _waitingPushers = 0;
+    std::uint32_t _waitingPoppers = 0;
     bool _alive = true;
     std::uint64_t _dataSize = 0;
+    void* _waitingPool = nullptr;
+    void* _dataPool = nullptr;
+    std::uint32_t _queuedItems = 0;
+    char _name[32]{};
 };
 
 struct UltRuntimeState {
     std::uint32_t _maxNumUlthread = 0;
     std::uint32_t _numWorkerThread = 0;
     void* _workArea = nullptr;
+    char _name[32]{};
 };
 
 struct UltUlthreadState {
@@ -342,6 +360,8 @@ struct UltUlthreadState {
     Pthread _thread = nullptr;
     void* _runtime = nullptr;
     std::atomic<bool> _exited{false};
+    char _name[32]{};
+    std::uint32_t _contextAttribute = 0;
 };
 
 #endif
diff --git a/core/libs/prx/libSceUlt/include/Api.hpp b/core/libs/prx/libSceUlt/include/Api.hpp
new file mode 100644
index 0000000000..c4c3213f0a
--- /dev/null
+++ b/core/libs/prx/libSceUlt/include/Api.hpp
@@ -0,0 +1,96 @@
+#pragma once
+
+#include "prx/libSceUlt/SceUltTypes.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUltInitialize();
+int APS5_VABI sceUltFinalize();
+int APS5_VABI sceUltMutexOptParamInitialize(UltMutexOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltSemaphoreOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueueOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueueDataResourcePoolOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltWaitingQueueResourcePoolOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltUlthreadOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltConditionVariableOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltConditionVariableOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltMutexCreate(void* mutex, const char* name, void* waitingQueueResourcePool, const UltMutexOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltMutexDestroy(void* mutex);
+int APS5_VABI sceUltMutexLock(void* mutex);
+int APS5_VABI sceUltMutexTryLock(void* mutex);
+int APS5_VABI sceUltMutexUnlock(void* mutex);
+int APS5_VABI sceUltConditionVariableCreate(void* condition, const char* name, void* mutex, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltConditionVariableCreate(void* condition, const char* name, void* mutex, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltConditionVariableDestroy(void* condition);
+int APS5_VABI sceUltConditionVariableSignal(void* condition);
+int APS5_VABI sceUltConditionVariableWait(void* condition);
+std::uint64_t APS5_VABI sceUltWaitingQueueResourcePoolGetWorkAreaSize(std::uint32_t numThreads, std::uint32_t numSyncObjects);
+int APS5_VABI sceUltWaitingQueueResourcePoolCreate(void* pool, const char* name, std::uint32_t numThreads, std::uint32_t numSyncObjects, void* workArea, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltWaitingQueueResourcePoolDestroy(void* pool);
+std::uint64_t APS5_VABI sceUltQueueDataResourcePoolGetWorkAreaSize(std::uint32_t numData, std::uint64_t dataSize, std::uint32_t numQueueObject);
+int APS5_VABI sceUltQueueDataResourcePoolCreate(void* pool, const char* name, std::uint32_t numData, std::uint64_t dataSize, std::uint32_t numQueueObject, void* waitingQueueResourcePool, void* workArea, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueueDataResourcePoolDestroy(void* pool);
+int APS5_VABI sceUltQueueCreate(void* queue, const char* name, std::uint64_t dataSize, void* waitingQueueResourcePool, void* queueDataResourcePool, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueuePush(void* queue, const void* data);
+int APS5_VABI sceUltQueueTryPush(void* queue, const void* data);
+int APS5_VABI sceUltQueuePop(void* queue, void* data);
+int APS5_VABI sceUltQueueTryPop(void* queue, void* data);
+int APS5_VABI sceUltQueueDestroy(void* queue);
+int APS5_VABI sceUltSemaphoreCreate(void* semaphore, const char* name, std::uint32_t numInitialResource, void* waitingQueueResourcePool, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltSemaphoreAcquire(void* semaphore, std::int32_t numResource);
+int APS5_VABI sceUltSemaphoreTryAcquire(void* semaphore, std::int32_t numResource);
+int APS5_VABI sceUltSemaphoreRelease(void* semaphore, std::int32_t numResource);
+int APS5_VABI sceUltSemaphoreDestroy(void* semaphore);
+int APS5_VABI sceUltUlthreadRuntimeOptParamInitialize(UltUlthreadRuntimeOptParam* optParam, std::uint32_t buildVersion);
+std::uint64_t APS5_VABI sceUltUlthreadRuntimeGetWorkAreaSize(std::uint32_t maxNumUlthread, std::uint32_t numWorkerThread);
+int APS5_VABI sceUltUlthreadRuntimeCreate(void* runtime, const char* name, std::uint32_t maxNumUlthread, std::uint32_t numWorkerThread, void* workArea, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthreadEntry entry, std::uint64_t arg, void* context, std::uint64_t sizeContext, void* runtime, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltUlthreadJoin(void* ulthread, std::int32_t* status);
+int APS5_VABI sceUltUlthreadTryJoin(void* ulthread, std::int32_t* status);
+int APS5_VABI sceUltUlthreadGetSelf(void** ulthread);
+int APS5_VABI sceUltUlthreadYield();
+int APS5_VABI sceUltUlthreadExit(std::int32_t status);
+int APS5_VABI sceUltUlthreadRuntimeDestroy(void* runtime);
+int APS5_VABI _sceUltWaitingQueueResourcePoolCreate(void* pool, const char* name, std::uint32_t numThreads, std::uint32_t numSyncObjects, void* workArea, const void* optParam);
+int APS5_VABI _sceUltSemaphoreCreate(void* semaphore, const char* name, std::uint32_t numInitialResource, void* waitingQueueResourcePool, const void* optParam);
+int APS5_VABI _sceUltMutexOptParamInitialize(UltMutexOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltMutexCreate(void* mutex, const char* name, void* waitingQueueResourcePool, const UltMutexOptParam* optParam);
+int APS5_VABI _sceUltQueueDataResourcePoolCreate(void* pool, const char* name, std::uint32_t numData, std::uint64_t dataSize, std::uint32_t numQueueObject, void* waitingQueueResourcePool, void* workArea, const void* optParam);
+int APS5_VABI _sceUltQueueCreate(void* queue, const char* name, std::uint64_t dataSize, void* waitingQueueResourcePool, void* queueDataResourcePool, const void* optParam);
+int APS5_VABI _sceUltUlthreadRuntimeOptParamInitialize(UltUlthreadRuntimeOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltUlthreadRuntimeCreate(void* runtime, const char* name, std::uint32_t maxNumUlthread, std::uint32_t numWorkerThread, void* workArea, const void* optParam);
+int APS5_VABI _sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthreadEntry entry, std::uint64_t arg, void* context, std::uint64_t sizeContext, void* runtime, const void* optParam);
+int APS5_VABI sceUltConditionVariableSignalAll(void* conditionVariable);
+int APS5_VABI sceUltGetConditionVariableInfo(void* object, UltConditionVariableInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetMutexInfo(void* object, UltMutexInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetQueueDataResourcePoolInfo(void* object, UltQueueDataResourcePoolInfo* info);
+int APS5_VABI sceUltGetQueueInfo(void* object, UltQueueInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetReaderWriterLockInfo(void* object, UltReaderWriterLockInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetSemaphoreInfo(void* object, UltSemaphoreInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetUlthreadInfo(void* object, UltUlthreadInfo* info);
+int APS5_VABI sceUltGetUlthreadRuntimeInfo(void* runtime, UltUlthreadRuntimeInfo* info, void** ulthreads, std::uint32_t ulthreadCapacity, Pthread* workerThreads, std::uint32_t workerCapacity);
+int APS5_VABI sceUltGetWaitingQueueResourcePoolInfo(void* object, UltWaitingQueueResourcePoolInfo* info);
+int APS5_VABI sceUltAbstractThreadFactoryCreateThread();
+int APS5_VABI sceUltAbstractThreadFactoryGetNumMaxThreads();
+int APS5_VABI sceUltAbstractThreadFactoryJoinThread();
+int APS5_VABI sceUltKernelThreadFactoryFinalize();
+int APS5_VABI sceUltKernelThreadFactoryGetFactoryPointer();
+int APS5_VABI sceUltKernelThreadFactoryInitialize();
+int APS5_VABI sceUltModuleFinalize();
+int APS5_VABI sceUltModuleInitialize();
+int APS5_VABI sceUltUlthreadFactoryFinalize();
+int APS5_VABI sceUltUlthreadFactoryGetFactoryPointer();
+int APS5_VABI sceUltUlthreadFactoryGetWorkAreaSize();
+int APS5_VABI sceUltUlthreadFactoryInitialize();
+int APS5_VABI sceUltReaderWriterLockOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltReaderWriterLockCreate(void* rwlock, const char* name, void* waitingQueueResourcePool, const UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltReaderWriterLockDestroy(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockLockRead(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockTryLockRead(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockUnlockRead(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockLockWrite(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockTryLockWrite(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockUnlockWrite(void* rwlock);
+
+}
diff --git a/core/libs/prx/libSceUlt/libSceUlt.hpp b/core/libs/prx/libSceUlt/libSceUlt.hpp
new file mode 100644
index 0000000000..260a68efda
--- /dev/null
+++ b/core/libs/prx/libSceUlt/libSceUlt.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUlt/include/Api.hpp"
diff --git a/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp b/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp
index c947260041..489f3587ea 100644
--- a/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp
+++ b/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp
@@ -1,5 +1,8 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "prx/libSceUlt/src/ReaderWriterLock.hpp"
 #include "prx/libSceUlt/SceUltTypes.hpp"
+#include "prx/libc/include/General.hpp"
+#include <algorithm>
 #include <condition_variable>
 #include <cstdint>
 #include <cstring>
@@ -16,9 +19,11 @@ struct UltReaderWriterLockState {
     std::uint32_t _readers = 0;
     bool _writing = false;
     std::thread::id _writer{};
+    UltThreadIdentity _ownerIdentity;
     std::uint32_t _waiters = 0;
     bool _alive = true;
     void* _waitingPool = nullptr;
+    char _name[32]{};
 };
 
 std::mutex gLocksMutex;
@@ -78,7 +83,6 @@ int APS5_VABI sceUltReaderWriterLockOptParamInitialize(UltOptParam* optParam, st
 }
 
 int APS5_VABI sceUltReaderWriterLockCreate(void* rwlock, const char* name, void* waitingQueueResourcePool, const UltOptParam* optParam, std::uint32_t buildVersion) {
-    (void)name;
     (void)optParam;
     (void)buildVersion;
     if (rwlock == nullptr) {
@@ -89,6 +93,9 @@ int APS5_VABI sceUltReaderWriterLockCreate(void* rwlock, const char* name, void*
     }
     auto state = std::make_shared<UltReaderWriterLockState>();
     state->_waitingPool = waitingQueueResourcePool;
+    if (name != nullptr) {
+        std::strncpy(state->_name, name, sizeof(state->_name) - 1);
+    }
     std::lock_guard<std::mutex> lock(gLocksMutex);
     if (gLocks.contains(rwlock)) {
         return ULT_ERROR_STATE;
@@ -165,6 +172,7 @@ int APS5_VABI sceUltReaderWriterLockLockWrite(void* rwlock) {
         return ULT_ERROR_STATE;
     }
     if (const int waited = Wait(*state, lock, true); waited != ULT_OK) return waited;
+    state->_ownerIdentity = UltCurrentThreadIdentity_nid_no_patch();
     state->_writing = true;
     state->_writer = std::this_thread::get_id();
     return ULT_OK;
@@ -180,6 +188,7 @@ int APS5_VABI sceUltReaderWriterLockTryLockWrite(void* rwlock) {
     if (state->_writing || state->_readers != 0) {
         return ULT_ERROR_BUSY;
     }
+    state->_ownerIdentity = UltCurrentThreadIdentity_nid_no_patch();
     state->_writing = true;
     state->_writer = std::this_thread::get_id();
     return ULT_OK;
@@ -194,8 +203,34 @@ int APS5_VABI sceUltReaderWriterLockUnlockWrite(void* rwlock) {
     }
     state->_writing = false;
     state->_writer = {};
+    state->_ownerIdentity = {};
     state->_released.notify_all();
     return ULT_OK;
 }
 
+int APS5_VABI sceUltGetReaderWriterLockInfo(void* object, UltReaderWriterLockInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity) {
+    if (object == nullptr || info == nullptr) return ULT_ERROR_NULL;
+    if (waitingThreads == nullptr && capacity != 0) return ULT_ERROR_NULL;
+    std::shared_ptr<UltReaderWriterLockState> state;
+    if (const int found = FindLock(object, state); found != ULT_OK) return found;
+    std::lock_guard<std::mutex> lock(state->_mutex);
+    if (!state->_alive) return ULT_ERROR_STATE;
+    for (std::uint32_t index = 0; index < capacity; ++index) {
+        if (waitingThreads[index].size != sizeof(UltWaitingThreadInfo)) return ULT_ERROR_INVALID;
+    }
+    if (capacity != 0 && state->_waiters != 0) NotImplemented_nid_no_patch(__func__);
+    if (state->_writing && state->_ownerIdentity.type != 1) NotImplemented_nid_no_patch(__func__);
+    std::memset(info, 0, sizeof(*info));
+    info->size = sizeof(UltReaderWriterLockInfo);
+    info->object = object;
+    std::memcpy(info->name, state->_name, sizeof(info->name));
+    info->waitingQueuePool = state->_waitingPool;
+    info->readers = state->_readers;
+    info->waitingThreads = state->_waiters;
+    info->lockType = state->_writing ? 2 : (state->_readers > 0 ? 1 : 0);
+    info->owner = state->_ownerIdentity.thread;
+    info->ownerType = state->_ownerIdentity.type;
+    return ULT_OK;
+}
+
 }
diff --git a/core/libs/prx/libSceUlt/src/ReaderWriterLock.hpp b/core/libs/prx/libSceUlt/src/ReaderWriterLock.hpp
index df98dcd077..b8c0b7d704 100644
--- a/core/libs/prx/libSceUlt/src/ReaderWriterLock.hpp
+++ b/core/libs/prx/libSceUlt/src/ReaderWriterLock.hpp
@@ -1,6 +1,9 @@
 #ifndef CORE_LIBS_PRX_LIBSCEULT_SRC_READERWRITERLOCK_HPP
 #define CORE_LIBS_PRX_LIBSCEULT_SRC_READERWRITERLOCK_HPP
 
+struct UltThreadIdentity;
+
+UltThreadIdentity UltCurrentThreadIdentity_nid_no_patch();
 bool UltWaitingPoolExists(void* pool);
 bool UltReaderWriterLocksWaitOn(void* pool);
 void UltFinalizeReaderWriterLocks();
diff --git a/core/libs/prx/libSceUpdateService/Export.cpp b/core/libs/prx/libSceUpdateService/Export.cpp
index 7fc0488786..d434762726 100644
--- a/core/libs/prx/libSceUpdateService/Export.cpp
+++ b/core/libs/prx/libSceUpdateService/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUpdateService/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceUpdateService/include/Api.hpp b/core/libs/prx/libSceUpdateService/include/Api.hpp
new file mode 100644
index 0000000000..9dce013b86
--- /dev/null
+++ b/core/libs/prx/libSceUpdateService/include/Api.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUpsrvGetCompletedTaskId();
+int APS5_VABI sceUpsrvGetRebootFlag();
+int APS5_VABI sceUpsrvGetSystemExUpdateTaskState();
+int APS5_VABI sceUpsrvInitialize();
+int APS5_VABI sceUpsrvPostErrorLog();
+int APS5_VABI sceUpsrvResumePausedTask();
+int APS5_VABI sceUpsrvSetFakeVersion();
+int APS5_VABI sceUpsrvStartUpdateSession();
+int APS5_VABI sceUpsrvSwitchSystemExBank();
+int APS5_VABI sceUpsrvSwitchSystemExBankWithoutVerify();
+int APS5_VABI sceUpsrvTerminate();
+int APS5_VABI sceUpsrvUpdateCancelBDUpdate();
+int APS5_VABI sceUpsrvUpdateCheckCancel();
+int APS5_VABI sceUpsrvUpdateCheckCreateHandler();
+int APS5_VABI sceUpsrvUpdateCheckDestroyHandler();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystem();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystemForDevKit();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystemForSettings();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystemWithPupInfo();
+int APS5_VABI sceUpsrvUpdateCreateUpdateTask();
+int APS5_VABI sceUpsrvUpdateDestroyUpdateTask();
+int APS5_VABI sceUpsrvUpdateDoCheckBootUpdate();
+int APS5_VABI sceUpsrvUpdateDoUpdateSystemEx();
+int APS5_VABI sceUpsrvUpdateDoUpdateWithEntitlement();
+int APS5_VABI sceUpsrvUpdateDoUpdateWithPupInfo();
+int APS5_VABI sceUpsrvUpdateDoUpdateWithPupPath2();
+int APS5_VABI sceUpsrvUpdateGetBetaAgreementUrl();
+int APS5_VABI sceUpsrvUpdateGetEulaDisplay();
+int APS5_VABI sceUpsrvUpdateGetEulaStr();
+int APS5_VABI sceUpsrvUpdateGetEulaStrLen();
+int APS5_VABI sceUpsrvUpdateGetFeatureListUrl();
+int APS5_VABI sceUpsrvUpdateGetFeatureListUrlForSystemExUpdate();
+int APS5_VABI sceUpsrvUpdateGetFeatureListUrlForUpdate();
+int APS5_VABI sceUpsrvUpdateGetImageWritingProgress();
+int APS5_VABI sceUpsrvUpdateGetProgress();
+int APS5_VABI sceUpsrvUpdateGetUpdateTaskInfo();
+int APS5_VABI sceUpsrvUpdateGetUpdateTaskMgrInfo();
+int APS5_VABI sceUpsrvUpdateSetEulaAccept();
+int APS5_VABI sceUpsrvUpdateStartUpdateTask();
+int APS5_VABI sceUpsrvVerifySystemExBank();
+
+}
diff --git a/core/libs/prx/libSceUpdateService/libSceUpdateService.hpp b/core/libs/prx/libSceUpdateService/libSceUpdateService.hpp
new file mode 100644
index 0000000000..87a15733f7
--- /dev/null
+++ b/core/libs/prx/libSceUpdateService/libSceUpdateService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUpdateService/include/Api.hpp"
diff --git a/core/libs/prx/libSceUrlConfigResolver/Export.cpp b/core/libs/prx/libSceUrlConfigResolver/Export.cpp
index 60d243d931..85b45cd6ad 100644
--- a/core/libs/prx/libSceUrlConfigResolver/Export.cpp
+++ b/core/libs/prx/libSceUrlConfigResolver/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUrlConfigResolver/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -25,7 +26,6 @@ int APS5_VABI sceUrlConfigResolverGetJscHeapSizeSoftLimit() {
     return 0;
 }
 
-
 int APS5_VABI sceUrlConfigResolverGetReleaseVersion() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceUrlConfigResolver/include/Api.hpp b/core/libs/prx/libSceUrlConfigResolver/include/Api.hpp
new file mode 100644
index 0000000000..e5eb270f75
--- /dev/null
+++ b/core/libs/prx/libSceUrlConfigResolver/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUrlConfigResolverGetAppConfig();
+int APS5_VABI sceUrlConfigResolverGetDefaultQueryParameter();
+int APS5_VABI sceUrlConfigResolverGetDeviceId();
+int APS5_VABI sceUrlConfigResolverGetJscHeapSizeSoftLimit();
+int APS5_VABI sceUrlConfigResolverGetReleaseVersion();
+int APS5_VABI sceUrlConfigResolverGetSysVer();
+int APS5_VABI sceUrlConfigResolverIsUpdated();
+int APS5_VABI sceUrlConfigResolverUpdate();
+
+}
diff --git a/core/libs/prx/libSceUrlConfigResolver/libSceUrlConfigResolver.hpp b/core/libs/prx/libSceUrlConfigResolver/libSceUrlConfigResolver.hpp
new file mode 100644
index 0000000000..cd604928ca
--- /dev/null
+++ b/core/libs/prx/libSceUrlConfigResolver/libSceUrlConfigResolver.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUrlConfigResolver/include/Api.hpp"
diff --git a/core/libs/prx/libSceUsbStorage/CMakeLists.txt b/core/libs/prx/libSceUsbStorage/CMakeLists.txt
new file mode 100644
index 0000000000..a4280361de
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorage/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceUsbStorage SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceUsbStorage PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceUsbStorage PRIVATE libc)
+configure_windows_unwind(libSceUsbStorage)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_usb_storage_tests ${LIBS_INCLUDE_DIR}/tests/GuestUsbStorage.cpp)
+    target_include_directories(guest_usb_storage_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_usb_storage_tests PRIVATE libSceUsbStorage libc)
+    configure_windows_unwind(guest_usb_storage_tests)
+    add_test(NAME guest_usb_storage COMMAND guest_usb_storage_tests)
+    if(WIN32)
+        set_tests_properties(guest_usb_storage PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceUsbStorage>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceUsbStorage/Export.cpp b/core/libs/prx/libSceUsbStorage/Export.cpp
index 96c447c943..978a9dc386 100644
--- a/core/libs/prx/libSceUsbStorage/Export.cpp
+++ b/core/libs/prx/libSceUsbStorage/Export.cpp
@@ -1,79 +1,153 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct UsbStorageEvent;
-struct UsbStorageDeviceInfo;
-using UsbStorageCallback = void (APS5_VABI *)(const UsbStorageEvent* event, void* userData);
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
 
 extern "C" {
 
-int APS5_VABI sceUsbStorageInit(void* attr) {
+std::int32_t APS5_VABI sceUsbStorageInit(void* attr) {
+    (void)attr;
+    return 0;
+}
+
+std::int32_t APS5_VABI sceUsbStorageTerm(void) {
+    return 0;
+}
+
+std::int32_t APS5_VABI sceUsbStorageRegisterCallback(std::int32_t eventType, UsbStorageCallback callback, void* arg) {
+    (void)arg;
+    if (callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    if (eventType < UsbStorage::CallbackEventTypeFirst || eventType > UsbStorage::CallbackEventTypeLast) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageTerm(void) {
+
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallback(std::int32_t eventType, UsbStorageCallback callback) {
+    if (callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    if (eventType < UsbStorage::CallbackEventTypeFirst || eventType > UsbStorage::CallbackEventTypeLast) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRegisterCallback(int32_t eventType, UsbStorageCallback callback, void* arg) {
+
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
+    (void)device;
+    (void)arg;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageUnregisterCallback(int32_t eventType, UsbStorageCallback callback) {
+
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback) {
+    (void)device;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRegisterCallbackForMapAvailable(uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
+
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
+    (void)device;
+    (void)arg;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageUnregisterCallbackForMapAvailable(uint32_t device, const char* directory, UsbStorageCallback callback) {
+
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback) {
+    (void)device;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRegisterCallbackForMapUnavailable(uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+std::int32_t APS5_VABI sceUsbStorageGetDeviceInfo(std::uint32_t device, UsbStorageDeviceInfo* info) {
+    (void)device;
+    if (info == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    return UsbStorage::DeviceNotFound;
 }
-int APS5_VABI sceUsbStorageUnregisterCallbackForMapUnavailable(uint32_t device, const char* directory, UsbStorageCallback callback) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetDeviceInfo(uint32_t device, UsbStorageDeviceInfo* info) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetDeviceList(uint32_t* devices, int32_t* count) {
-    NotImplemented_nid_no_patch(__func__);
+
+std::int32_t APS5_VABI sceUsbStorageGetDeviceList(std::uint32_t* devices, std::int32_t* count) {
+    if (devices == nullptr || count == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    *count = 0;
     return 0;
 }
+
 int APS5_VABI sceUsbStorageGetMountPointOfShellCore(uint32_t device, char* mountPoint) {
+    (void)device;
+    (void)mountPoint;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-bool APS5_VABI sceUsbStorageIsExist(uint32_t device, const char* directory, std::uint8_t* exists) {
+
+bool APS5_VABI sceUsbStorageIsExist(std::uint32_t device, const char* directory, std::uint8_t* exists) {
+    (void)device;
+    (void)directory;
+    *exists = 0;
+    return true;
+}
+
+std::int32_t APS5_VABI sceUsbStorageRequestMap(std::uint32_t device, const char* directory, std::int32_t flags,
+                                               std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId) {
+    (void)device;
+    (void)directory;
+    (void)flags;
+    (void)volumeSize;
+    (void)mountPoint;
+    (void)mountId;
+    return UsbStorage::DeviceNotFound;
+}
+
+std::int32_t APS5_VABI sceUsbStorageRequestUnmap(std::uint32_t device, const char* directory) {
+    (void)device;
+    if (directory == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRequestMap(uint32_t device, const char* directory, int32_t flags, uint64_t volumeSize, char* mountPoint, uint64_t* mountId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+std::int32_t APS5_VABI sceUsbStorageGetdentsOpen(std::uint32_t device, std::int32_t* fd, std::uint64_t* bufferSize) {
+    (void)device;
+    if (fd == nullptr || bufferSize == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    return UsbStorage::DeviceNotFound;
 }
-int APS5_VABI sceUsbStorageRequestUnmap(uint32_t device, const char* directory) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+std::int32_t APS5_VABI sceUsbStorageGetdentsRead(std::int32_t fd, void* buffer, std::uint64_t bufferSize, std::uint64_t* bytesRead) {
+    (void)fd;
+    (void)bufferSize;
+    if (buffer == nullptr || bytesRead == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    *bytesRead = 0;
+    return UsbStorage::NotSupported;
 }
-int APS5_VABI sceUsbStorageGetdentsOpen(uint32_t device, int32_t* fd, uint64_t* bufferSize) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetdentsRead(int32_t fd, void* buffer, uint64_t bufferSize, uint64_t* bytesRead) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetdentsClose(int32_t fd) {
+
+std::int32_t APS5_VABI sceUsbStorageGetdentsClose(std::int32_t fd) {
+    (void)fd;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -83,10 +157,15 @@ int APS5_VABI sceUsbStorageClearFakeWriteProtection() {
     return 0;
 }
 
-int APS5_VABI sceUsbStorageRequestMapWSB(uint32_t device_id, const char* subpath, int32_t flags,
-                                        int32_t unknown, char* out_mount_path, int32_t* out_status) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI sceUsbStorageRequestMapWSB(std::uint32_t device, const char* subpath, std::int32_t flags,
+                                                  std::int32_t unknown, char* mountPath, std::int32_t* status) {
+    (void)device;
+    (void)subpath;
+    (void)flags;
+    (void)unknown;
+    (void)mountPath;
+    (void)status;
+    return UsbStorage::DeviceNotFound;
 }
 
 int APS5_VABI sceUsbStorageSetFakeMapLockForDebug() {
diff --git a/core/libs/prx/libSceUsbStorage/UsbStorage.hpp b/core/libs/prx/libSceUsbStorage/UsbStorage.hpp
new file mode 100644
index 0000000000..b3bc2d24ab
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorage/UsbStorage.hpp
@@ -0,0 +1,50 @@
+#ifndef CORE_LIBS_PRX_LIBSCEUSBSTORAGE_USBSTORAGE_HPP
+#define CORE_LIBS_PRX_LIBSCEUSBSTORAGE_USBSTORAGE_HPP
+
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <cstddef>
+#include <cstdint>
+
+namespace UsbStorage {
+
+inline constexpr std::int32_t InvalidArgument = static_cast<std::int32_t>(0x80f40002);
+inline constexpr std::int32_t DeviceNotFound = static_cast<std::int32_t>(0x80f40004);
+inline constexpr std::int32_t NotSupported = static_cast<std::int32_t>(0x80f40005);
+
+inline constexpr std::int32_t CallbackEventTypeFirst = 1;
+inline constexpr std::int32_t CallbackEventTypeLast = 2;
+
+}
+
+struct UsbStorageEvent;
+struct UsbStorageDeviceInfo;
+using UsbStorageCallback = void (APS5_VABI *)(const UsbStorageEvent* event, void* userData);
+
+extern "C" {
+std::int32_t APS5_VABI sceUsbStorageInit(void* attr);
+std::int32_t APS5_VABI sceUsbStorageTerm(void);
+std::int32_t APS5_VABI sceUsbStorageRegisterCallback(std::int32_t eventType, UsbStorageCallback callback, void* arg);
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallback(std::int32_t eventType, UsbStorageCallback callback);
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+std::int32_t APS5_VABI sceUsbStorageGetDeviceInfo(std::uint32_t device, UsbStorageDeviceInfo* info);
+std::int32_t APS5_VABI sceUsbStorageGetDeviceList(std::uint32_t* devices, std::int32_t* count);
+std::int32_t APS5_VABI sceUsbStorageGetMountPointOfShellCore(std::uint32_t device, char* mountPoint);
+bool APS5_VABI sceUsbStorageIsExist(std::uint32_t device, const char* directory, std::uint8_t* exists);
+std::int32_t APS5_VABI sceUsbStorageRequestMap(std::uint32_t device, const char* directory, std::int32_t flags,
+                                               std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId);
+std::int32_t APS5_VABI sceUsbStorageRequestUnmap(std::uint32_t device, const char* directory);
+std::int32_t APS5_VABI sceUsbStorageGetdentsOpen(std::uint32_t device, std::int32_t* fd, std::uint64_t* bufferSize);
+std::int32_t APS5_VABI sceUsbStorageGetdentsRead(std::int32_t fd, void* buffer, std::uint64_t bufferSize, std::uint64_t* bytesRead);
+std::int32_t APS5_VABI sceUsbStorageGetdentsClose(std::int32_t fd);
+std::int32_t APS5_VABI sceUsbStorageRequestMapWSB(std::uint32_t device, const char* subpath, std::int32_t flags,
+                                                  std::int32_t unknown, char* mountPath, std::int32_t* status);
+std::int32_t APS5_VABI sceUsbStorageClearFakeWriteProtection();
+std::int32_t APS5_VABI sceUsbStorageSetFakeMapLockForDebug();
+std::int32_t APS5_VABI sceUsbStorageSetFakeWriteProtection();
+}
+
+#endif
diff --git a/core/libs/prx/libSceUsbStorage/libSceUsbStorage.hpp b/core/libs/prx/libSceUsbStorage/libSceUsbStorage.hpp
new file mode 100644
index 0000000000..bf34865160
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorage/libSceUsbStorage.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
diff --git a/core/libs/prx/libSceUsbStorageDialog/Export.cpp b/core/libs/prx/libSceUsbStorageDialog/Export.cpp
index 612ac95a57..290ab47eca 100644
--- a/core/libs/prx/libSceUsbStorageDialog/Export.cpp
+++ b/core/libs/prx/libSceUsbStorageDialog/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceUsbStorageDialog/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -7,8 +9,6 @@
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libSceUsbStorageDialog/include/Api.hpp b/core/libs/prx/libSceUsbStorageDialog/include/Api.hpp
new file mode 100644
index 0000000000..636ddf50f5
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorageDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUsbStorageDialogInitialize(void);
+int APS5_VABI sceUsbStorageDialogOpen(const UsbStorageDialogParam* param);
+int APS5_VABI sceUsbStorageDialogGetStatus(void);
+int APS5_VABI sceUsbStorageDialogUpdateStatus(void);
+int APS5_VABI sceUsbStorageDialogGetResult(UsbStorageDialogResult* result);
+int APS5_VABI sceUsbStorageDialogClose(void);
+int APS5_VABI sceUsbStorageDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceUsbStorageDialog/libSceUsbStorageDialog.hpp b/core/libs/prx/libSceUsbStorageDialog/libSceUsbStorageDialog.hpp
new file mode 100644
index 0000000000..fdc47497d7
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorageDialog/libSceUsbStorageDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUsbStorageDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceUsbd/Export.cpp b/core/libs/prx/libSceUsbd/Export.cpp
index 6d791a3166..edc6a19de0 100644
--- a/core/libs/prx/libSceUsbd/Export.cpp
+++ b/core/libs/prx/libSceUsbd/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUsbd/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,6 +6,7 @@
 
 #include <libusb.h>
 
+#include <algorithm>
 #include <chrono>
 #include <climits>
 #include <cstdlib>
@@ -28,35 +30,8 @@ constexpr std::uint8_t TRANSFER_TYPE_BULK = 2;
 constexpr std::uint8_t TRANSFER_TYPE_INTERRUPT = 3;
 constexpr std::int32_t CONTROL_SETUP_SIZE = 8;
 constexpr std::uint8_t SUPPORTED_TRANSFER_FLAGS = LIBUSB_TRANSFER_SHORT_NOT_OK | LIBUSB_TRANSFER_ADD_ZERO_PACKET;
-
-struct UsbdTimeval {
-    std::int64_t seconds;
-    std::int64_t microseconds;
-};
-
-struct UsbdIsoPacketDescriptor {
-    std::uint32_t length;
-    std::uint32_t actualLength;
-    std::int32_t status;
-};
-
-using UsbdTransferCallback = void (APS5_VABI*)(struct UsbdTransfer*);
-
-struct UsbdTransfer {
-    void* deviceHandle;
-    std::uint8_t flags;
-    std::uint8_t endpoint;
-    std::uint8_t type;
-    std::uint32_t timeout;
-    std::int32_t status;
-    std::int32_t length;
-    std::int32_t actualLength;
-    UsbdTransferCallback callback;
-    void* userData;
-    std::uint8_t* buffer;
-    std::int32_t numIsoPackets;
-    UsbdIsoPacketDescriptor isoPacketDescriptors[1];
-};
+constexpr std::uint16_t STRING_DESCRIPTOR_SIZE = 255;
+constexpr std::uint32_t STRING_DESCRIPTOR_TIMEOUT = 1000;
 
 static_assert(offsetof(UsbdTransfer, timeout) == 12 && offsetof(UsbdTransfer, callback) == 32 && offsetof(UsbdTransfer, numIsoPackets) == 56 && offsetof(UsbdTransfer, isoPacketDescriptors) == 60);
 static_assert(sizeof(libusb_device_descriptor) == 18);
@@ -73,6 +48,7 @@ struct UsbdState {
     std::unordered_map<libusb_device*, std::uint32_t> devices;
     std::unordered_set<libusb_device**> lists;
     std::unordered_set<libusb_device_handle*> handles;
+    std::unordered_map<libusb_device_handle*, std::uint32_t> claimed;
     std::unordered_set<libusb_config_descriptor*> configs;
     std::unordered_map<UsbdTransfer*, libusb_transfer*> inFlight;
 };
@@ -98,11 +74,15 @@ std::int32_t ToGuestError(int result) {
     return static_cast<std::int32_t>(0x80240000u - static_cast<std::uint32_t>(result));
 }
 
+bool IsKnownDevice(const UsbdState& state, libusb_device* device) {
+    return state.devices.contains(device) || std::any_of(state.handles.begin(), state.handles.end(), [device](libusb_device_handle* handle) { return libusb_get_device(handle) == device; });
+}
+
 libusb_device* KnownDevice(void* device, const char* function) {
     auto& state = State();
     std::lock_guard lock(state.mutex);
     auto* host = static_cast<libusb_device*>(device);
-    if (!state.devices.contains(host)) throw std::runtime_error(AbsentDevice(function));
+    if (!IsKnownDevice(state, host)) throw std::runtime_error(AbsentDevice(function));
     return host;
 }
 
@@ -141,6 +121,34 @@ void LIBUSB_CALL CompleteTransfer(libusb_transfer* host) {
     if (guest->callback != nullptr) guest->callback(guest);
 }
 
+int MaxPacketSize(libusb_device* device, std::uint8_t endpoint) {
+    libusb_config_descriptor* config = nullptr;
+    const int result = libusb_get_active_config_descriptor(device, &config);
+    if (result < 0) return result;
+    int size = LIBUSB_ERROR_NOT_FOUND;
+    for (int index = 0; index < config->bNumInterfaces && size == LIBUSB_ERROR_NOT_FOUND; ++index) {
+        const auto& entry = config->interface[index];
+        for (int alternate = 0; alternate < entry.num_altsetting && size == LIBUSB_ERROR_NOT_FOUND; ++alternate) {
+            const auto& setting = entry.altsetting[alternate];
+            for (int item = 0; item < setting.bNumEndpoints; ++item) {
+                if (setting.endpoint[item].bEndpointAddress == endpoint) {
+                    size = setting.endpoint[item].wMaxPacketSize;
+                    break;
+                }
+            }
+        }
+    }
+    libusb_free_config_descriptor(config);
+    return size;
+}
+
+bool RequestStringDescriptor(libusb_device_handle* handle, std::uint8_t descriptorIndex, std::uint16_t languageId, std::uint8_t* descriptor) {
+    std::memset(descriptor, 0, STRING_DESCRIPTOR_SIZE);
+    const auto value = static_cast<std::uint16_t>(LIBUSB_DT_STRING << 8 | descriptorIndex);
+    const int result = libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN, LIBUSB_REQUEST_GET_DESCRIPTOR, value, languageId, descriptor, STRING_DESCRIPTOR_SIZE, STRING_DESCRIPTOR_TIMEOUT);
+    return result >= 0 && descriptor[1] == LIBUSB_DT_STRING;
+}
+
 }
 
 extern "C" {
@@ -162,6 +170,7 @@ void APS5_VABI sceUsbdExit() {
     if (state.initCount == 0 || --state.initCount != 0) return;
     if (!state.inFlight.empty()) throw std::runtime_error(std::string(__func__) + ": transfers are still in flight");
     for (auto* handle : state.handles) libusb_close(handle);
+    state.claimed.clear();
     for (auto* config : state.configs) libusb_free_config_descriptor(config);
     for (auto* list : state.lists) libusb_free_device_list(list, 0);
     for (const auto& [device, references] : state.devices) {
@@ -377,7 +386,14 @@ std::int32_t APS5_VABI sceUsbdCheckConnected(void* deviceHandle) {
 
 std::int32_t APS5_VABI sceUsbdClaimInterface(void* deviceHandle, std::int32_t interfaceNumber) {
     if (deviceHandle == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
-    return ToGuestError(libusb_claim_interface(KnownHandle(deviceHandle, __func__), interfaceNumber));
+    auto* handle = KnownHandle(deviceHandle, __func__);
+    const int result = libusb_claim_interface(handle, interfaceNumber);
+    if (result == 0) {
+        auto& state = State();
+        std::lock_guard lock(state.mutex);
+        state.claimed[handle] |= 1u << interfaceNumber;
+    }
+    return ToGuestError(result);
 }
 
 void APS5_VABI sceUsbdClose(void* deviceHandle) {
@@ -386,6 +402,7 @@ void APS5_VABI sceUsbdClose(void* deviceHandle) {
     std::lock_guard lock(state.mutex);
     auto* host = static_cast<libusb_device_handle*>(deviceHandle);
     if (state.handles.erase(host) == 0) throw std::runtime_error(UnopenedHandle(__func__));
+    state.claimed.erase(host);
     libusb_close(host);
 }
 
@@ -468,14 +485,21 @@ void* APS5_VABI sceUsbdRefDevice(void* device) {
     auto& state = State();
     std::lock_guard lock(state.mutex);
     auto* host = static_cast<libusb_device*>(device);
-    if (!state.devices.contains(host)) throw std::runtime_error(AbsentDevice(__func__));
+    if (!IsKnownDevice(state, host)) throw std::runtime_error(AbsentDevice(__func__));
     AddDeviceReference(state, host);
     return libusb_ref_device(host);
 }
 
 std::int32_t APS5_VABI sceUsbdReleaseInterface(void* deviceHandle, std::int32_t interfaceNumber) {
     if (deviceHandle == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
-    return ToGuestError(libusb_release_interface(KnownHandle(deviceHandle, __func__), interfaceNumber));
+    auto* handle = KnownHandle(deviceHandle, __func__);
+    const int result = libusb_release_interface(handle, interfaceNumber);
+    if (result == 0) {
+        auto& state = State();
+        std::lock_guard lock(state.mutex);
+        state.claimed[handle] &= ~(1u << interfaceNumber);
+    }
+    return ToGuestError(result);
 }
 
 std::int32_t APS5_VABI sceUsbdResetDevice(void* deviceHandle) {
@@ -535,13 +559,16 @@ void APS5_VABI sceUsbdUnrefDevice(void* device) {
 }
 
 std::int32_t APS5_VABI sceUsbdClearHalt(void* deviceHandle, std::uint8_t endpoint) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr) throw std::runtime_error(std::string(__func__) + ": null handle");
+    const int result = libusb_clear_halt(KnownHandle(deviceHandle, __func__), endpoint);
+    if (result == 0) return 0;
+    if (result == LIBUSB_ERROR_NOT_FOUND) return SCE_USBD_ERROR_OTHER;
+    throw std::runtime_error(std::string(__func__) + ": libusb error " + std::to_string(result) + " has no known console result");
 }
 
 std::int32_t APS5_VABI sceUsbdDetachKernelDriver(void* deviceHandle, int interfaceNumber) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
+    return libusb_detach_kernel_driver(KnownHandle(deviceHandle, __func__), static_cast<std::uint8_t>(interfaceNumber)) == 0 ? 0 : SCE_USBD_ERROR_OTHER;
 }
 
 std::int32_t APS5_VABI sceUsbdEventHandlerActive() {
@@ -550,43 +577,87 @@ std::int32_t APS5_VABI sceUsbdEventHandlerActive() {
 }
 
 std::int32_t APS5_VABI sceUsbdGetConfigDescriptorByValue(void* device, std::uint8_t configurationValue, void** config) {
-    NotImplemented_nid_no_patch(__func__);
+    if (device == nullptr || config == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
+    libusb_config_descriptor* host = nullptr;
+    const int result = libusb_get_config_descriptor_by_value(KnownDevice(device, __func__), configurationValue, &host);
+    *config = nullptr;
+    if (result != 0) return ToGuestError(result);
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    state.configs.insert(host);
+    *config = host;
     return 0;
 }
 
 std::int32_t APS5_VABI sceUsbdGetConfiguration(void* deviceHandle, std::int32_t* configuration) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr || configuration == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
+    int host = 0;
+    const int result = libusb_get_configuration(KnownHandle(deviceHandle, __func__), &host);
+    if (result == 0) *configuration = host;
+    return ToGuestError(result);
 }
 
 std::int32_t APS5_VABI sceUsbdGetDescriptor(void* deviceHandle, std::uint8_t descriptorType, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr || data == nullptr || length < 1) return SCE_USBD_ERROR_INVALID_ARG;
+    auto* handle = KnownHandle(deviceHandle, __func__);
+    if (length > 65535) length = 65535;
+    return ToGuestError(libusb_get_descriptor(handle, descriptorType, descriptorIndex, data, length));
 }
 
 void* APS5_VABI sceUsbdGetDevice(void* deviceHandle) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr) return nullptr;
+    return libusb_get_device(KnownHandle(deviceHandle, __func__));
 }
 
 int APS5_VABI sceUsbdGetDeviceSpeed(void* device) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (device == nullptr) return LIBUSB_SPEED_UNKNOWN;
+    return std::min(libusb_get_device_speed(KnownDevice(device, __func__)), static_cast<int>(LIBUSB_SPEED_SUPER));
 }
 
 std::int32_t APS5_VABI sceUsbdGetMaxIsoPacketSize(void* device, std::uint8_t endpoint) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (device == nullptr) throw std::runtime_error(std::string(__func__) + ": null device");
+    auto* host = KnownDevice(device, __func__);
+    int size = MaxPacketSize(host, endpoint);
+    const int speed = libusb_get_device_speed(host);
+    if (speed != LIBUSB_SPEED_LOW && speed != LIBUSB_SPEED_FULL && size >= 0) size = (size & 0x7FF) * std::min(1 + ((size >> 11) & 3), 3);
+    return ToGuestError(size);
 }
 
 std::int32_t APS5_VABI sceUsbdGetMaxPacketSize(void* device, std::uint8_t endpoint) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (device == nullptr) return ToGuestError(LIBUSB_ERROR_NO_DEVICE);
+    return ToGuestError(MaxPacketSize(KnownDevice(device, __func__), endpoint));
 }
 
 std::int32_t APS5_VABI sceUsbdGetStringDescriptorAscii(void* deviceHandle, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr || data == nullptr || length < 1) return SCE_USBD_ERROR_INVALID_ARG;
+    auto* handle = KnownHandle(deviceHandle, __func__);
+    if (length > 65535) length = 65535;
+    data[0] = 0;
+    std::uint8_t descriptor[STRING_DESCRIPTOR_SIZE];
+    if (!RequestStringDescriptor(handle, 0, 0, descriptor)) return SCE_USBD_ERROR_OTHER;
+    const auto languageId = static_cast<std::uint16_t>(descriptor[2] | descriptor[3] << 8);
+    if (!RequestStringDescriptor(handle, descriptorIndex, languageId, descriptor) || descriptor[0] < 2) return SCE_USBD_ERROR_OTHER;
+    std::int32_t units = descriptor[0] / 2 - 1;
+    if (units > length - 1) units = length - 1;
+    std::uint8_t byteOrder = 3;
+    std::int32_t written = 0;
+    for (std::int32_t unit = 0; unit < units; ++unit) {
+        const auto code = static_cast<std::uint16_t>(descriptor[2 * unit + 2] | descriptor[2 * unit + 3] << 8);
+        std::uint8_t character;
+        if ((code & 0xFF00) == 0 && (byteOrder & 1) != 0) {
+            character = static_cast<std::uint8_t>(code);
+            byteOrder = 1;
+        } else if ((code & 0x00FF) == 0 && (byteOrder & 2) != 0) {
+            character = static_cast<std::uint8_t>(code >> 8);
+            byteOrder = 2;
+        } else {
+            continue;
+        }
+        if (character < 0x20 || character > 0x7E || character == '<' || character == '>') continue;
+        data[written++] = character;
+    }
+    data[written] = 0;
+    return written;
 }
 
 std::int32_t APS5_VABI sceUsbdHandleEvents() {
@@ -608,13 +679,39 @@ void APS5_VABI sceUsbdLockEvents() {
 }
 
 void* APS5_VABI sceUsbdOpenDeviceWithVidPid(std::uint16_t vendorId, std::uint16_t productId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (state.context == nullptr) return nullptr;
+    libusb_device** devices = nullptr;
+    const ssize_t count = libusb_get_device_list(state.context, &devices);
+    if (count < 0) return nullptr;
+    libusb_device_handle* handle = nullptr;
+    for (ssize_t index = 0; index < count; ++index) {
+        libusb_device_descriptor descriptor{};
+        if (libusb_get_device_descriptor(devices[index], &descriptor) == 0 && descriptor.idVendor == vendorId && descriptor.idProduct == productId) {
+            if (libusb_open(devices[index], &handle) != 0) handle = nullptr;
+            break;
+        }
+    }
+    libusb_free_device_list(devices, 1);
+    if (handle != nullptr) state.handles.insert(handle);
+    return handle;
 }
 
 std::int32_t APS5_VABI sceUsbdSetInterfaceAltSetting(void* deviceHandle, int interfaceNumber, int alternateSetting) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
+    auto* handle = KnownHandle(deviceHandle, __func__);
+    if (interfaceNumber < 0 || interfaceNumber > 31) return SCE_USBD_ERROR_INVALID_ARG;
+    {
+        auto& state = State();
+        std::lock_guard lock(state.mutex);
+        const auto claimed = state.claimed.find(handle);
+        if (claimed == state.claimed.end() || (claimed->second & (1u << interfaceNumber)) == 0) return ToGuestError(LIBUSB_ERROR_NOT_FOUND);
+        for (const auto& [guest, host] : state.inFlight) {
+            if (host->dev_handle == handle) throw std::runtime_error(std::string(__func__) + ": the device has transfers in flight, which FreeBSD libusb cancels first");
+        }
+    }
+    return libusb_set_interface_alt_setting(handle, interfaceNumber, static_cast<std::uint8_t>(alternateSetting)) == 0 ? 0 : SCE_USBD_ERROR_OTHER;
 }
 
 std::int32_t APS5_VABI sceUsbdTryLockEvents() {
diff --git a/core/libs/prx/libSceUsbd/include/Api.hpp b/core/libs/prx/libSceUsbd/include/Api.hpp
new file mode 100644
index 0000000000..5b5aa49a05
--- /dev/null
+++ b/core/libs/prx/libSceUsbd/include/Api.hpp
@@ -0,0 +1,111 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <chrono>
+#include <climits>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <mutex>
+#include <new>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <unordered_map>
+#include <unordered_set>
+
+struct UsbdTimeval {
+    std::int64_t seconds;
+    std::int64_t microseconds;
+};
+
+struct UsbdIsoPacketDescriptor {
+    std::uint32_t length;
+    std::uint32_t actualLength;
+    std::int32_t status;
+};
+
+using UsbdTransferCallback = void (APS5_VABI*)(struct UsbdTransfer*);
+
+struct UsbdTransfer {
+    void* deviceHandle;
+    std::uint8_t flags;
+    std::uint8_t endpoint;
+    std::uint8_t type;
+    std::uint32_t timeout;
+    std::int32_t status;
+    std::int32_t length;
+    std::int32_t actualLength;
+    UsbdTransferCallback callback;
+    void* userData;
+    std::uint8_t* buffer;
+    std::int32_t numIsoPackets;
+    UsbdIsoPacketDescriptor isoPacketDescriptors[1];
+};
+
+extern "C" {
+
+std::int32_t APS5_VABI sceUsbdInit();
+void APS5_VABI sceUsbdExit();
+std::int64_t APS5_VABI sceUsbdGetDeviceList(void*** list);
+void APS5_VABI sceUsbdFreeDeviceList(void** list, std::int32_t unrefDevices);
+std::int32_t APS5_VABI sceUsbdHandleEventsTimeout(const UsbdTimeval* timeout);
+UsbdTransfer* APS5_VABI sceUsbdAllocTransfer(std::int32_t isoPackets);
+void APS5_VABI sceUsbdFreeTransfer(UsbdTransfer* transfer);
+void APS5_VABI sceUsbdFillInterruptTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+void APS5_VABI sceUsbdFillBulkTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+void APS5_VABI sceUsbdFillIsoTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, std::int32_t numIsoPackets, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+void APS5_VABI sceUsbdFillControlSetup(std::uint8_t* buffer, std::uint8_t requestType, std::uint8_t request, std::uint16_t value, std::uint16_t index, std::uint16_t length);
+void APS5_VABI sceUsbdFillControlTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t* buffer, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+std::uint8_t* APS5_VABI sceUsbdControlTransferGetData(UsbdTransfer* transfer);
+std::uint8_t* APS5_VABI sceUsbdControlTransferGetSetup(UsbdTransfer* transfer);
+void APS5_VABI sceUsbdSetIsoPacketLengths(UsbdTransfer* transfer, std::uint32_t length);
+std::uint8_t* APS5_VABI sceUsbdGetIsoPacketBuffer(UsbdTransfer* transfer, std::uint32_t packet);
+std::int32_t APS5_VABI sceUsbdBulkTransfer(void* deviceHandle, std::uint8_t endpoint, std::uint8_t* data, std::int32_t length, std::int32_t* transferred, std::uint32_t timeout);
+std::int32_t APS5_VABI sceUsbdInterruptTransfer(void* deviceHandle, std::uint8_t endpoint, std::uint8_t* data, std::int32_t length, std::int32_t* transferred, std::uint32_t timeout);
+std::int32_t APS5_VABI sceUsbdCancelTransfer(UsbdTransfer* transfer);
+std::int32_t APS5_VABI sceUsbdEventHandlingOk();
+void APS5_VABI sceUsbdFreeConfigDescriptor(void* config);
+std::int32_t APS5_VABI sceUsbdAttachKernelDriver(void* deviceHandle, std::int32_t interfaceNumber);
+std::int32_t APS5_VABI sceUsbdCheckConnected(void* deviceHandle);
+std::int32_t APS5_VABI sceUsbdClaimInterface(void* deviceHandle, std::int32_t interfaceNumber);
+void APS5_VABI sceUsbdClose(void* deviceHandle);
+std::int32_t APS5_VABI sceUsbdControlTransfer(void* deviceHandle, std::uint8_t requestType, std::uint8_t request, std::uint16_t value, std::uint16_t index, std::uint8_t* data, std::uint16_t length, std::uint32_t timeout);
+std::int32_t APS5_VABI sceUsbdGetActiveConfigDescriptor(void* device, void** config);
+std::uint8_t APS5_VABI sceUsbdGetBusNumber(void* device);
+std::int32_t APS5_VABI sceUsbdGetConfigDescriptor(void* device, std::uint8_t configIndex, void** config);
+std::uint8_t APS5_VABI sceUsbdGetDeviceAddress(void* device);
+std::int32_t APS5_VABI sceUsbdGetDeviceDescriptor(void* device, void* descriptor);
+std::int32_t APS5_VABI sceUsbdGetStringDescriptor(void* deviceHandle, std::uint8_t descriptorIndex, std::uint16_t languageId, std::uint8_t* data, std::int32_t length);
+std::int32_t APS5_VABI sceUsbdKernelDriverActive(void* deviceHandle, std::int32_t interfaceNumber);
+std::int32_t APS5_VABI sceUsbdOpen(void* device, void** deviceHandle);
+void* APS5_VABI sceUsbdRefDevice(void* device);
+std::int32_t APS5_VABI sceUsbdReleaseInterface(void* deviceHandle, std::int32_t interfaceNumber);
+std::int32_t APS5_VABI sceUsbdResetDevice(void* deviceHandle);
+std::int32_t APS5_VABI sceUsbdSetConfiguration(void* deviceHandle, std::int32_t configuration);
+std::int32_t APS5_VABI sceUsbdSubmitTransfer(UsbdTransfer* transfer);
+void APS5_VABI sceUsbdUnrefDevice(void* device);
+std::int32_t APS5_VABI sceUsbdClearHalt(void* deviceHandle, std::uint8_t endpoint);
+std::int32_t APS5_VABI sceUsbdDetachKernelDriver(void* deviceHandle, int interfaceNumber);
+std::int32_t APS5_VABI sceUsbdEventHandlerActive();
+std::int32_t APS5_VABI sceUsbdGetConfigDescriptorByValue(void* device, std::uint8_t configurationValue, void** config);
+std::int32_t APS5_VABI sceUsbdGetConfiguration(void* deviceHandle, std::int32_t* configuration);
+std::int32_t APS5_VABI sceUsbdGetDescriptor(void* deviceHandle, std::uint8_t descriptorType, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length);
+void* APS5_VABI sceUsbdGetDevice(void* deviceHandle);
+int APS5_VABI sceUsbdGetDeviceSpeed(void* device);
+std::int32_t APS5_VABI sceUsbdGetMaxIsoPacketSize(void* device, std::uint8_t endpoint);
+std::int32_t APS5_VABI sceUsbdGetMaxPacketSize(void* device, std::uint8_t endpoint);
+std::int32_t APS5_VABI sceUsbdGetStringDescriptorAscii(void* deviceHandle, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length);
+std::int32_t APS5_VABI sceUsbdHandleEvents();
+std::int32_t APS5_VABI sceUsbdHandleEventsLocked(UsbdTimeval* timeout);
+void APS5_VABI sceUsbdLockEventWaiters();
+void APS5_VABI sceUsbdLockEvents();
+void* APS5_VABI sceUsbdOpenDeviceWithVidPid(std::uint16_t vendorId, std::uint16_t productId);
+std::int32_t APS5_VABI sceUsbdSetInterfaceAltSetting(void* deviceHandle, int interfaceNumber, int alternateSetting);
+std::int32_t APS5_VABI sceUsbdTryLockEvents();
+void APS5_VABI sceUsbdUnlockEventWaiters();
+void APS5_VABI sceUsbdUnlockEvents();
+std::int32_t APS5_VABI sceUsbdWaitForEvent(UsbdTimeval* timeout);
+
+}
diff --git a/core/libs/prx/libSceUsbd/libSceUsbd.hpp b/core/libs/prx/libSceUsbd/libSceUsbd.hpp
new file mode 100644
index 0000000000..6e1c2333f9
--- /dev/null
+++ b/core/libs/prx/libSceUsbd/libSceUsbd.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUsbd/include/Api.hpp"
diff --git a/core/libs/prx/libSceUserService/Export.cpp b/core/libs/prx/libSceUserService/Export.cpp
index 513d813d46..fa8edb8b62 100644
--- a/core/libs/prx/libSceUserService/Export.cpp
+++ b/core/libs/prx/libSceUserService/Export.cpp
@@ -1,16 +1,46 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include <atomic>
+#include <array>
 #include <cstring>
+#include <deque>
+#include <mutex>
 #include "prx/libSceUserService/UserService.hpp"
 
-static std::atomic<bool> initialized{false};
-static std::atomic<bool> loginReported{false};
+namespace {
 
-static int ReportAccessibilitySetting(int user_id, int32_t* setting, int32_t value) {
- if (user_id != USER_SERVICE_INITIAL_USER_ID) {
+std::atomic<bool> initialized{false};
+std::mutex userMutex;
+
+struct UserEvent {
+    std::uint32_t eventType;
+    int userId;
+};
+
+std::deque<UserEvent> eventQueue;
+std::array<bool, USER_SERVICE_MAX_USERS> userConnected{true, false, false, false};
+
+int UserIndex(int userId) {
+    if (userId >= USER_SERVICE_INITIAL_USER_ID && userId < USER_SERVICE_INITIAL_USER_ID + USER_SERVICE_MAX_USERS) {
+        return userId - USER_SERVICE_INITIAL_USER_ID;
+    }
+    return -1;
+}
+
+bool IsUserLoggedIn(int userId) {
+ const int index = UserIndex(userId);
+ if (index < 0) {
+  return false;
+ }
+ std::lock_guard lock(userMutex);
+ return userConnected[index];
+}
+
+int ReportAccessibilitySetting(int user_id, int32_t* setting, int32_t value) {
+ if (!IsUserLoggedIn(user_id)) {
   return USER_SERVICE_ERROR_NOT_LOGGED_IN;
  }
  if (setting == nullptr) {
@@ -20,8 +50,18 @@ static int ReportAccessibilitySetting(int user_id, int32_t* setting, int32_t val
  return USER_SERVICE_OK;
 }
 
+void PopulateInitialLoginEvents() {
+ std::lock_guard lock(userMutex);
+ eventQueue.clear();
+ constexpr std::uint32_t EventTypeLogin = 0;
+ eventQueue.push_back({EventTypeLogin, USER_SERVICE_INITIAL_USER_ID});
+ for (int i = 1; i < USER_SERVICE_MAX_USERS; ++i) {
+  if (userConnected[i]) {
+   eventQueue.push_back({EventTypeLogin, USER_SERVICE_INITIAL_USER_ID + i});
+  }
+ }
+}
 
-extern "C" int APS5_VABI sceSystemServiceParamGetInt(int param_id, int* value);
 
 // Per-user keyboard settings. Nothing in AnyPS5 stores a keyboard type or input variant, so every known user reports
 // the keyboard type of the configured system language and 0 for the input variants (see
@@ -47,15 +87,43 @@ static int ReportKeyboardSetting(int user_id, int32_t* type, int32_t (*value)())
  if (type == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- if (user_id != USER_SERVICE_INITIAL_USER_ID) {
+ if (UserIndex(user_id) < 0) {
   return USER_SERVICE_ERROR_UNKNOWN_USER;
  }
  *type = value();
  return USER_SERVICE_OK;
 }
+}
 
 extern "C" {
 
+void UserServiceSetUserConnected_nid_postfix(int userIndex, bool connected) {
+    if (userIndex <= 0 || userIndex >= USER_SERVICE_MAX_USERS) return;
+    std::lock_guard lock(userMutex);
+    if (userConnected[userIndex] != connected) {
+        userConnected[userIndex] = connected;
+        if (initialized.load()) {
+            constexpr std::uint32_t EventTypeLogin = 0;
+            constexpr std::uint32_t EventTypeLogout = 1;
+            const std::uint32_t eventType = connected ? EventTypeLogin : EventTypeLogout;
+            const int userId = USER_SERVICE_INITIAL_USER_ID + userIndex;
+            bool collapsed = false;
+            for (auto it = eventQueue.begin(); it != eventQueue.end(); ++it) {
+                if (it->userId == userId) {
+                    if (it->eventType != eventType) {
+                        eventQueue.erase(it);
+                    }
+                    collapsed = true;
+                    break;
+                }
+            }
+            if (!collapsed) {
+                eventQueue.push_back({eventType, userId});
+            }
+        }
+    }
+}
+
 int APS5_VABI sceUserServiceGetAccessibilityChatTranscription(int user_id, int32_t* chat_transcription) {
  return ReportAccessibilitySetting(user_id, chat_transcription, 0);
 }
@@ -91,7 +159,7 @@ int APS5_VABI sceUserServiceGetAccessibilityZoomFollowFocus(int user_id, int32_t
 }
 
 int APS5_VABI sceUserServiceGetAgeLevel(int user_id, uint32_t* age_level) {
- if (user_id != USER_SERVICE_INITIAL_USER_ID) {
+ if (!IsUserLoggedIn(user_id)) {
   return USER_SERVICE_ERROR_NOT_LOGGED_IN;
  }
  if (age_level == nullptr) {
@@ -110,12 +178,14 @@ int APS5_VABI sceUserServiceGetEvent(SceUserServiceEvent* event) {
  if (event == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- if (loginReported.exchange(true)) {
+ std::lock_guard lock(userMutex);
+ if (eventQueue.empty()) {
   return USER_SERVICE_ERROR_NO_EVENT;
  }
- constexpr std::uint32_t EventTypeLogin = 0;
- event->event_type = EventTypeLogin;
- event->user_id = USER_SERVICE_INITIAL_USER_ID;
+ const auto item = eventQueue.front();
+ eventQueue.pop_front();
+ event->event_type = item.eventType;
+ event->user_id = item.userId;
  return USER_SERVICE_OK;
 }
 
@@ -123,7 +193,8 @@ int APS5_VABI sceUserServiceGetGamePresets(int user_id, UserServiceGamePresets*
  // System-wide game presets (difficulty, view inversion, subtitles, audio language) of the user's
  // profile. A fresh console has none set: every field is 0, "not specified", and the title falls
  // back to its own defaults. this_size is the caller's.
- if (presets == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (presets == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
  presets->difficulty = 0;
@@ -152,10 +223,14 @@ int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* user_
  if (user_id_list == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- user_id_list->user_id[0] = USER_SERVICE_INITIAL_USER_ID;
- user_id_list->user_id[1] = USER_SERVICE_USER_ID_INVALID;
- user_id_list->user_id[2] = USER_SERVICE_USER_ID_INVALID;
- user_id_list->user_id[3] = USER_SERVICE_USER_ID_INVALID;
+ std::lock_guard lock(userMutex);
+ for (int i = 0; i < 4; ++i) {
+  if (i < USER_SERVICE_MAX_USERS && userConnected[i]) {
+   user_id_list->user_id[i] = USER_SERVICE_INITIAL_USER_ID + i;
+  } else {
+   user_id_list->user_id[i] = USER_SERVICE_USER_ID_INVALID;
+  }
+ }
  return USER_SERVICE_OK;
 }
 
@@ -163,22 +238,24 @@ int APS5_VABI sceUserServiceGetUserName(int user_id, char* name, size_t size) {
  if (name == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- if (user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (index < 0) {
   return USER_SERVICE_ERROR_UNKNOWN_USER;
  }
  if (size < USER_SERVICE_MAX_USER_NAME_LENGTH + 1) {
   std::memset(name, 0, size);
   return USER_SERVICE_ERROR_BUFFER_TOO_SHORT;
  }
- std::strncpy(name, USER_SERVICE_INITIAL_USER_NAME, size);
+ std::strncpy(name, USER_SERVICE_USER_NAMES[index], size);
  return USER_SERVICE_OK;
 }
 
 int APS5_VABI sceUserServiceGetUserNumber(int user_id, int32_t* number) {
- if (number == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (number == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- *number = 1;
+ *number = index + 1;
  return USER_SERVICE_OK;
 }
 
@@ -190,7 +267,7 @@ static int MarkInitialized() {
  if (initialized.exchange(true)) {
   return USER_SERVICE_ERROR_ALREADY_INITIALIZED;
  }
- loginReported.store(false);
+ PopulateInitialLoginEvents();
  return USER_SERVICE_OK;
 }
 
@@ -214,6 +291,8 @@ int APS5_VABI sceUserServiceTerminate(void) {
  if (!initialized.exchange(false)) {
   return USER_SERVICE_ERROR_NOT_INITIALIZED;
  }
+ std::lock_guard lock(userMutex);
+ eventQueue.clear();
  return USER_SERVICE_OK;
 }
 
@@ -237,18 +316,23 @@ int APS5_VABI sceUserServiceGetRegisteredUserIdList(UserServiceRegisteredUserIdL
  if (user_id_list == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- user_id_list->user_id[0] = USER_SERVICE_INITIAL_USER_ID;
- for (int i = 1; i < 16; ++i) {
-  user_id_list->user_id[i] = USER_SERVICE_USER_ID_INVALID;
+ std::lock_guard lock(userMutex);
+ for (int i = 0; i < 16; ++i) {
+  if (i < USER_SERVICE_MAX_USERS && userConnected[i]) {
+   user_id_list->user_id[i] = USER_SERVICE_INITIAL_USER_ID + i;
+  } else {
+   user_id_list->user_id[i] = USER_SERVICE_USER_ID_INVALID;
+  }
  }
  return USER_SERVICE_OK;
 }
 
 int APS5_VABI sceUserServiceGetUserColor(int user_id, int* color) {
- if (color == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (color == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- *color = 0;
+ *color = index;
  return USER_SERVICE_OK;
 }
 
@@ -265,7 +349,8 @@ int APS5_VABI sceUserServiceGetTraditionalChineseInputType(int user_id, int32_t*
 }
 
 int APS5_VABI sceUserServiceGetNpAccountId(int user_id, uint64_t* account_id) {
- if (account_id == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (account_id == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
  *account_id = 0;
diff --git a/core/libs/prx/libSceUserService/UserService.hpp b/core/libs/prx/libSceUserService/UserService.hpp
index eeb192f8aa..3169ed503c 100644
--- a/core/libs/prx/libSceUserService/UserService.hpp
+++ b/core/libs/prx/libSceUserService/UserService.hpp
@@ -3,6 +3,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include "SceTypes.hpp"
 
 struct UserServiceInitParam {
  std::int32_t priority;
@@ -24,5 +25,42 @@ constexpr int USER_SERVICE_ERROR_BUFFER_TOO_SHORT = -2137653238;
 constexpr int USER_SERVICE_ERROR_UNKNOWN_USER = static_cast<int>(0x80960105u);
 constexpr std::size_t USER_SERVICE_MAX_USER_NAME_LENGTH = 16;
 constexpr const char* USER_SERVICE_INITIAL_USER_NAME = "Player";
+constexpr int USER_SERVICE_MAX_USERS = 4;
+constexpr const char* USER_SERVICE_USER_NAMES[USER_SERVICE_MAX_USERS] = {
+    "Player", "Player2", "Player3", "Player4"
+};
+
+extern "C" void UserServiceSetUserConnected_nid_postfix(int userIndex, bool connected);
+
+extern "C" {
+
+int APS5_VABI sceUserServiceGetAccessibilityChatTranscription(int userId, int32_t* chatTranscription);
+int APS5_VABI sceUserServiceGetAccessibilityKeyremapEnable(std::int32_t userId, std::int32_t* enabled);
+int APS5_VABI sceUserServiceGetAccessibilityPressAndHoldDelay(int userId, int32_t* pressAndHoldDelay);
+int APS5_VABI sceUserServiceGetAccessibilityTriggerEffect(int userId, int32_t* triggerEffect);
+int APS5_VABI sceUserServiceGetAccessibilityVibration(int userId, int32_t* vibration);
+int APS5_VABI sceUserServiceGetAccessibilityZoom(std::int32_t userId, std::int32_t* zoom);
+int APS5_VABI sceUserServiceGetAccessibilityZoomEnabled(int userId, int32_t* zoomEnabled);
+int APS5_VABI sceUserServiceGetAccessibilityZoomFollowFocus(int userId, int32_t* zoomFollowFocus);
+int APS5_VABI sceUserServiceGetAgeLevel(int userId, uint32_t* ageLevel);
+int APS5_VABI sceUserServiceGetEvent(SceUserServiceEvent* event);
+int APS5_VABI sceUserServiceGetGamePresets(int userId, UserServiceGamePresets* presets);
+int APS5_VABI sceUserServiceGetInitialUser(int* userId);
+int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* userIdList);
+int APS5_VABI sceUserServiceGetUserName(int userId, char* name, size_t size);
+int APS5_VABI sceUserServiceGetUserNumber(int userId, int32_t* number);
+int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* params);
+int APS5_VABI sceUserServiceInitialize2(std::int32_t priority, KernelCpumask affinityMask);
+int APS5_VABI sceUserServiceTerminate(void);
+int APS5_VABI sceUserServiceGetPlatformPrivacyWs1(int32_t userId, int32_t* value);
+int APS5_VABI sceUserServiceGetForegroundUser(int* userId);
+int APS5_VABI sceUserServiceGetRegisteredUserIdList(UserServiceRegisteredUserIdList* userIdList);
+int APS5_VABI sceUserServiceGetUserColor(int userId, int* color);
+int APS5_VABI sceUserServiceGetKeyboardType(int userId, int32_t* type);
+int APS5_VABI sceUserServiceGetJapaneseInputType(int userId, int32_t* type);
+int APS5_VABI sceUserServiceGetTraditionalChineseInputType(int userId, int32_t* type);
+int APS5_VABI sceUserServiceGetNpAccountId(int userId, uint64_t* accountId);
+
+}
 
 #endif
diff --git a/core/libs/prx/libSceUserService/libSceUserService.hpp b/core/libs/prx/libSceUserService/libSceUserService.hpp
new file mode 100644
index 0000000000..32a9d2d7ae
--- /dev/null
+++ b/core/libs/prx/libSceUserService/libSceUserService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUserService/UserService.hpp"
diff --git a/core/libs/prx/libSceVcodec/libSceVcodec.hpp b/core/libs/prx/libSceVcodec/libSceVcodec.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVcodec/libSceVcodec.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecCore.native/Export.cpp b/core/libs/prx/libSceVdecCore.native/Export.cpp
index f619cb820b..3ee8802672 100644
--- a/core/libs/prx/libSceVdecCore.native/Export.cpp
+++ b/core/libs/prx/libSceVdecCore.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecCore.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecCore.native/include/Api.hpp b/core/libs/prx/libSceVdecCore.native/include/Api.hpp
new file mode 100644
index 0000000000..e7166aa853
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore.native/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVdecCoreCreateDecoderBid();
+int APS5_VABI sceVdecCoreCreateDecoderSvp();
+int APS5_VABI sceVdecCoreMapMemory();
+int APS5_VABI sceVdecCoreSetDecodeInputSvp();
+
+}
diff --git a/core/libs/prx/libSceVdecCore.native/libSceVdecCore.native.hpp b/core/libs/prx/libSceVdecCore.native/libSceVdecCore.native.hpp
new file mode 100644
index 0000000000..ad02da52c4
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore.native/libSceVdecCore.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecCore.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecCore/Export.cpp b/core/libs/prx/libSceVdecCore/Export.cpp
index 343d1ec6a6..0c25b209ec 100644
--- a/core/libs/prx/libSceVdecCore/Export.cpp
+++ b/core/libs/prx/libSceVdecCore/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecCore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecCore/include/Api.hpp b/core/libs/prx/libSceVdecCore/include/Api.hpp
new file mode 100644
index 0000000000..9b1aaeed6c
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore/include/Api.hpp
@@ -0,0 +1,28 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVdecCoreAnalyzeStream();
+int APS5_VABI sceVdecCoreCreateDecoder();
+int APS5_VABI sceVdecCoreDeleteDecoder();
+int APS5_VABI sceVdecCoreFinalizeComputeResource();
+int APS5_VABI sceVdecCoreFlushDecodeOutput();
+int APS5_VABI sceVdecCoreGetDecodeOutput();
+int APS5_VABI sceVdecCoreInitializeComputeResource();
+int APS5_VABI sceVdecCoreMapMemoryBlock();
+int APS5_VABI sceVdecCoreQueryComputeResourceInfo();
+int APS5_VABI sceVdecCoreQueryFrameBufferInfo();
+int APS5_VABI sceVdecCoreQueryInstanceSize();
+int APS5_VABI sceVdecCoreResetDecoder();
+int APS5_VABI sceVdecCoreSetDecodeInput();
+int APS5_VABI sceVdecCoreSetDecodeOutputSw();
+int APS5_VABI sceVdecCoreSyncDecode();
+int APS5_VABI sceVdecCoreSyncDecodeOutputSw();
+int APS5_VABI sceVdecCoreSyncDecodeWptr();
+int APS5_VABI sceVdecCoreTrySyncDecode();
+int APS5_VABI sceVdecCoreTrySyncDecodeOutputSw();
+int APS5_VABI sceVdecCoreTrySyncDecodeWptr();
+
+}
diff --git a/core/libs/prx/libSceVdecCore/libSceVdecCore.hpp b/core/libs/prx/libSceVdecCore/libSceVdecCore.hpp
new file mode 100644
index 0000000000..347e124988
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore/libSceVdecCore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecCore/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecSavc/Export.cpp b/core/libs/prx/libSceVdecSavc/Export.cpp
index c30e4f9c37..72330582cd 100644
--- a/core/libs/prx/libSceVdecSavc/Export.cpp
+++ b/core/libs/prx/libSceVdecSavc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecSavc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecSavc/include/Api.hpp b/core/libs/prx/libSceVdecSavc/include/Api.hpp
new file mode 100644
index 0000000000..cd352d8c30
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdecCreateSw();
+int APS5_VABI sceSdecDestroySw();
+int APS5_VABI sceSdecGetVersionSw();
+int APS5_VABI sceSdecQueryMemorySw();
+
+}
diff --git a/core/libs/prx/libSceVdecSavc/libSceVdecSavc.hpp b/core/libs/prx/libSceVdecSavc/libSceVdecSavc.hpp
new file mode 100644
index 0000000000..658d88c565
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc/libSceVdecSavc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecSavc/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecSavc2.native/libSceVdecSavc2.native.hpp b/core/libs/prx/libSceVdecSavc2.native/libSceVdecSavc2.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc2.native/libSceVdecSavc2.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecSavc2/Export.cpp b/core/libs/prx/libSceVdecSavc2/Export.cpp
index 6f217fc959..6ca11f6ef7 100644
--- a/core/libs/prx/libSceVdecSavc2/Export.cpp
+++ b/core/libs/prx/libSceVdecSavc2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecSavc2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecSavc2/include/Api.hpp b/core/libs/prx/libSceVdecSavc2/include/Api.hpp
new file mode 100644
index 0000000000..985cdcd141
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc2/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdecCreateSw2();
+int APS5_VABI sceSdecDestroySw2();
+int APS5_VABI sceSdecGetVersionSw2();
+int APS5_VABI sceSdecQueryMemorySw2();
+
+}
diff --git a/core/libs/prx/libSceVdecSavc2/libSceVdecSavc2.hpp b/core/libs/prx/libSceVdecSavc2/libSceVdecSavc2.hpp
new file mode 100644
index 0000000000..10fff4393c
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc2/libSceVdecSavc2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecSavc2/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecShevc.native/libSceVdecShevc.native.hpp b/core/libs/prx/libSceVdecShevc.native/libSceVdecShevc.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVdecShevc.native/libSceVdecShevc.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecShevc/Export.cpp b/core/libs/prx/libSceVdecShevc/Export.cpp
index 8f63aa61a9..43e4936066 100644
--- a/core/libs/prx/libSceVdecShevc/Export.cpp
+++ b/core/libs/prx/libSceVdecShevc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecShevc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecShevc/include/Api.hpp b/core/libs/prx/libSceVdecShevc/include/Api.hpp
new file mode 100644
index 0000000000..f6685c6a64
--- /dev/null
+++ b/core/libs/prx/libSceVdecShevc/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdecCreateSwHevc();
+int APS5_VABI sceSdecDestroySwHevc();
+int APS5_VABI sceSdecExecuteSwHevc();
+int APS5_VABI sceSdecGetFrameSwHevc();
+int APS5_VABI sceSdecGetVersionSwHevc();
+int APS5_VABI sceSdecQueryMemorySwHevc();
+int APS5_VABI sceSdecResetSwHevc();
+
+}
diff --git a/core/libs/prx/libSceVdecShevc/libSceVdecShevc.hpp b/core/libs/prx/libSceVdecShevc/libSceVdecShevc.hpp
new file mode 100644
index 0000000000..e6f868789a
--- /dev/null
+++ b/core/libs/prx/libSceVdecShevc/libSceVdecShevc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecShevc/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecSvp9.native/libSceVdecSvp9.native.hpp b/core/libs/prx/libSceVdecSvp9.native/libSceVdecSvp9.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVdecSvp9.native/libSceVdecSvp9.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecsw/Export.cpp b/core/libs/prx/libSceVdecsw/Export.cpp
index d6fa384070..d15ec5c2fa 100644
--- a/core/libs/prx/libSceVdecsw/Export.cpp
+++ b/core/libs/prx/libSceVdecsw/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#include "prx/libSceVdecsw/include/Api.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
@@ -15,6 +17,8 @@
 
 namespace {
 
+using namespace SceVdecsw;
+
 constexpr int VdecswErrorOutputPending = static_cast<int>(0x81510115u);
 constexpr int VdecswErrorInputQueueEmpty = static_cast<int>(0x81510116u);
 constexpr int VdecswErrorDecodePending = static_cast<int>(0x81510117u);
@@ -23,157 +27,12 @@ constexpr std::size_t MaxQueuedPictures = 4;
 constexpr std::uint32_t CodecAvc = 1;
 constexpr std::uint32_t CodecHevc = 974921;
 
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct InputResult {
-    std::uint64_t thisSize;
-    const void* decodedAu;
-    std::uint32_t outputFrameCount;
-    std::uint32_t reserved;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isLastFrame;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    bool isDiscardedFrame;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInMbsMinus1;
-    std::uint32_t picHeightInMapUnitsMinus1;
-    std::uint8_t frameMbsOnlyFlag;
-    std::uint8_t frameCroppingFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-    std::uint8_t vui[44];
-};
-
-struct HevcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-    std::uint8_t bitDepthLumaMinus8;
-    std::uint8_t bitDepthChromaMinus8;
-    std::uint8_t timingInfoPresentFlag;
-    std::uint32_t numUnitsInTick;
-    std::uint32_t timeScale;
-    std::uint32_t aspectRatioInfoPresentFlag;
-    std::uint8_t aspectRatioIdc;
-    std::uint16_t sarWidth;
-    std::uint16_t sarHeight;
-    std::uint8_t videoSignal[8];
-    std::uint32_t picStruct;
-    std::uint32_t sourceScanType;
-    std::uint32_t duplicateFlag;
-    std::uint32_t conformanceWindowFlag;
-    std::uint32_t confWinLeftOffset;
-    std::uint32_t confWinRightOffset;
-    std::uint32_t confWinTopOffset;
-    std::uint32_t confWinBottomOffset;
-    std::uint32_t defaultDisplayWindow[5];
-    std::uint8_t chromaLocation[4];
-    std::uint8_t presentFlags[11];
-    std::uint8_t idrPictureFlag;
-    std::uint8_t irapPictureFlag;
-    std::uint8_t generalProfileSpace;
-    std::uint8_t generalTierFlag;
-    std::uint8_t generalProfileIdc;
-    std::uint8_t generalSourceFlags[3];
-    std::uint8_t generalLevelIdc;
-    std::uint8_t subLayer[9];
-    std::uint8_t frameCroppingFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-};
-
-static_assert(sizeof(InputData) == 0x30 && sizeof(InputResult) == 0x18 && sizeof(FrameBuffer) == 0x18);
-static_assert(sizeof(Vp9PictureInfo) == 0x58 && offsetof(Vp9PictureInfo, ptsData) == 0x10 && offsetof(Vp9PictureInfo, profile) == 0x28 && offsetof(Vp9PictureInfo, bitDepth) == 0x38 && offsetof(Vp9PictureInfo, colorSpace) == 0x3c && offsetof(Vp9PictureInfo, renderHeight) == 0x50);
+static_assert(sizeof(SceVideodec2::InputData) == 0x30 && sizeof(InputResult) == 0x18 && sizeof(FrameBuffer) == 0x18);
+static_assert(sizeof(SceVideodec2::Vp9PictureInfo) == 0x58 && offsetof(SceVideodec2::Vp9PictureInfo, ptsData) == 0x10 && offsetof(SceVideodec2::Vp9PictureInfo, profile) == 0x28 && offsetof(SceVideodec2::Vp9PictureInfo, bitDepth) == 0x38 && offsetof(SceVideodec2::Vp9PictureInfo, colorSpace) == 0x3c && offsetof(SceVideodec2::Vp9PictureInfo, renderHeight) == 0x50);
 static_assert(sizeof(OutputInfo) == 0x38 && offsetof(OutputInfo, isLastFrame) == 9 && offsetof(OutputInfo, pictureCount) == 0xb && offsetof(OutputInfo, isDiscardedFrame) == 0x1c);
 static_assert(sizeof(AvcPictureInfo) == 0x78 && offsetof(AvcPictureInfo, picWidthInMbsMinus1) == 0x2c && offsetof(AvcPictureInfo, frameCropBottomOffset) == 0x44);
 static_assert(sizeof(HevcPictureInfo) == 0xb8 && offsetof(HevcPictureInfo, picWidthInLumaSamples) == 0x28 && offsetof(HevcPictureInfo, sarWidth) == 0x42 && offsetof(HevcPictureInfo, picStruct) == 0x50 && offsetof(HevcPictureInfo, conformanceWindowFlag) == 0x5c && offsetof(HevcPictureInfo, idrPictureFlag) == 0x93 && offsetof(HevcPictureInfo, generalProfileIdc) == 0x97 && offsetof(HevcPictureInfo, generalLevelIdc) == 0x9b && offsetof(HevcPictureInfo, frameCroppingFlag) == 0xa5 && offsetof(HevcPictureInfo, frameCropBottomOffset) == 0xb4);
 
-struct Videodec2FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct Videodec2OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
 struct Videodec2Crop {
     std::uint32_t left;
     std::uint32_t right;
@@ -193,38 +52,17 @@ struct Videodec2PictureHeader {
     std::uint8_t bitDepthMinus8;
 };
 
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
 }
 
 extern "C" {
-int APS5_VABI sceVideodec2QueryComputeMemoryInfo_nid_postfix(void* info);
-int APS5_VABI sceVideodec2AllocateComputeQueue_nid_postfix(const void* config, const void* memory, std::uint64_t* queue);
-int APS5_VABI sceVideodec2ReleaseComputeQueue_nid_postfix(std::uint64_t queue);
-int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const void* config, void* memory);
-int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const void* config, const void* memory, std::uint64_t* handle);
-int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t handle);
-int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t handle, const InputData* input, Videodec2FrameBuffer* frame, Videodec2OutputInfo* output);
-int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t handle, Videodec2FrameBuffer* frame, Videodec2OutputInfo* output);
-int APS5_VABI sceVideodec2GetVp9PictureInfo_nid_postfix(const Videodec2OutputInfo* output, Vp9PictureInfo* info);
-int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t handle);
+
 void Videodec2PictureHeader_nid_no_patch(std::uint64_t handle, const void* frameBuffer, Videodec2PictureHeader* header);
 }
 
 namespace {
 
 struct PendingInput {
-    InputData input;
+    SceVideodec2::InputData input;
     std::vector<std::uint8_t> data;
 };
 
@@ -237,7 +75,7 @@ using PictureInfo = std::variant<AvcPictureInfo, HevcPictureInfo>;
 
 struct Picture {
     std::vector<std::uint8_t> pixels;
-    Videodec2OutputInfo output;
+    SceVideodec2::OutputInfo output;
     PictureInfo info;
 };
 
@@ -251,7 +89,7 @@ struct Decoder {
     std::map<const void*, PictureInfo> delivered;
     bool finalized = false;
     bool drained = false;
-    std::map<const void*, Vp9PictureInfo> deliveredVp9;
+    std::map<const void*, SceVideodec2::Vp9PictureInfo> deliveredVp9;
 };
 
 std::mutex decodersMutex;
@@ -264,7 +102,7 @@ std::shared_ptr<Decoder> findDecoder(std::uint64_t handle) {
     return found->second;
 }
 
-PictureInfo pictureInfo(std::uint64_t handle, const Videodec2OutputInfo& output) {
+PictureInfo pictureInfo(std::uint64_t handle, const SceVideodec2::OutputInfo& output) {
     Videodec2PictureHeader header{};
     Videodec2PictureHeader_nid_no_patch(handle, output.frameBuffer, &header);
     const auto& crop = header.crop;
@@ -319,9 +157,10 @@ PictureInfo pictureInfo(std::uint64_t handle, const Videodec2OutputInfo& output)
     return info;
 }
 
-Vp9PictureInfo vp9PictureInfo(const Videodec2OutputInfo& output) {
-    Vp9PictureInfo info{sizeof(Vp9PictureInfo)};
+SceVideodec2::Vp9PictureInfo vp9PictureInfo(const SceVideodec2::OutputInfo& output) {
+    SceVideodec2::Vp9PictureInfo info{sizeof(SceVideodec2::Vp9PictureInfo)};
     sceVideodec2GetVp9PictureInfo_nid_postfix(&output, &info);
+
     if (!info.isValid) throw std::runtime_error("Vdecsw: decoded picture has no VP9 picture info");
     return info;
 }
@@ -352,17 +191,19 @@ int deliveredPictureInfo(const OutputInfo* output, TInfo* info) {
 void advance(std::uint64_t handle, Decoder& decoder) {
     while (decoder.pictures.size() < MaxQueuedPictures) {
         std::vector<std::uint8_t> pixels(decoder.frameBytes);
-        Videodec2FrameBuffer frame{sizeof(Videodec2FrameBuffer), pixels.data(), pixels.size(), false};
-        Videodec2OutputInfo output{sizeof(Videodec2OutputInfo)};
+        SceVideodec2::FrameBuffer frame{sizeof(SceVideodec2::FrameBuffer), pixels.data(), pixels.size(), false};
+        SceVideodec2::OutputInfo output{sizeof(SceVideodec2::OutputInfo)};
         if (!decoder.inputs.empty()) {
             const auto* au = static_cast<const void*>(decoder.inputs.front().input.auData);
             auto input = decoder.inputs.front().input;
             input.auData = decoder.inputs.front().data.data();
             sceVideodec2Decode_nid_postfix(handle, &input, &frame, &output);
+
             decoder.inputs.pop_front();
             decoder.consumed.push_back({au, output.isValid ? 1u : 0u});
         } else if (decoder.finalized && !decoder.drained) {
             sceVideodec2Flush_nid_postfix(handle, &frame, &output);
+
             decoder.drained = !output.isValid;
         } else {
             return;
@@ -378,11 +219,11 @@ void advance(std::uint64_t handle, Decoder& decoder) {
 
 extern "C" {
 
-int APS5_VABI sceVdecswQueryComputeMemoryInfo(void* info) {
+int APS5_VABI sceVdecswQueryComputeMemoryInfo(SceVideodec2::ComputeMemoryInfo* info) {
     return sceVideodec2QueryComputeMemoryInfo_nid_postfix(info);
 }
 
-int APS5_VABI sceVdecswAllocateComputeQueue(const void* config, const void* memory, std::uint64_t* queue) {
+int APS5_VABI sceVdecswAllocateComputeQueue(const SceVideodec2::ComputeConfigInfo* config, const SceVideodec2::ComputeMemoryInfo* memory, std::uint64_t* queue) {
     return sceVideodec2AllocateComputeQueue_nid_postfix(config, memory, queue);
 }
 
@@ -390,13 +231,13 @@ int APS5_VABI sceVdecswReleaseComputeQueue(std::uint64_t queue) {
     return sceVideodec2ReleaseComputeQueue_nid_postfix(queue);
 }
 
-int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const void* config, void* memory) {
-    return sceVideodec2QueryDecoderMemoryInfo_nid_postfix(config, memory);
+int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const void* config, SceVideodec2::DecoderMemoryInfo* memory) {
+    return sceVideodec2QueryDecoderMemoryInfo_nid_postfix(static_cast<const SceVideodec2::DecoderConfigInfo*>(config), memory);
 }
 
-int APS5_VABI sceVdecswCreateDecoder(const void* config, const DecoderMemoryInfo* memory, std::uint64_t* handle) {
-    if (handle == nullptr || memory == nullptr || memory->thisSize < sizeof(DecoderMemoryInfo) || memory->maxFrameBufferSize == 0) throw std::runtime_error("Vdecsw: invalid decoder creation arguments");
-    const auto result = sceVideodec2CreateDecoder_nid_postfix(config, memory, handle);
+int APS5_VABI sceVdecswCreateDecoder(const void* config, const SceVideodec2::DecoderMemoryInfo* memory, std::uint64_t* handle) {
+    if (handle == nullptr || memory == nullptr || memory->thisSize < sizeof(SceVideodec2::DecoderMemoryInfo) || memory->maxFrameBufferSize == 0) throw std::runtime_error("Vdecsw: invalid decoder creation arguments");
+    const auto result = sceVideodec2CreateDecoder_nid_postfix(static_cast<const SceVideodec2::DecoderConfigInfo*>(config), memory, handle);
     if (result != 0) return result;
     auto decoder = std::make_shared<Decoder>();
     decoder->frameBytes = memory->maxFrameBufferSize;
@@ -413,8 +254,8 @@ int APS5_VABI sceVdecswDeleteDecoder(std::uint64_t handle) {
     return sceVideodec2DeleteDecoder_nid_postfix(handle);
 }
 
-int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t handle, const InputData* input) {
-    if (input == nullptr || input->thisSize < sizeof(InputData)) throw std::runtime_error("Vdecsw: invalid decode input");
+int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t handle, const SceVideodec2::InputData* input) {
+    if (input == nullptr || input->thisSize < sizeof(SceVideodec2::InputData)) throw std::runtime_error("Vdecsw: invalid decode input");
     const auto decoder = findDecoder(handle);
     std::lock_guard lock(decoder->mutex);
     if (decoder->finalized) throw std::runtime_error("Vdecsw: decode input after the sequence was finalized");
@@ -504,11 +345,35 @@ int APS5_VABI sceVdecswSyncDecodeOutput(std::uint64_t handle, OutputInfo* output
 }
 
 int APS5_VABI sceVdecswGetPictureInfo(const OutputInfo* output, void* first, void* second) {
-    (void)output;
-    (void)first;
-    (void)second;
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    static_cast<void>(second);
+    if (output == nullptr || (output->thisSize | 8u) != sizeof(OutputInfo)) throw std::runtime_error("Vdecsw: invalid output info");
+    if (output->pictureCount == 0) return 0;
+    if (output->pictureCount > 1) NotImplemented_nid_no_patch(__func__);
+    if (first == nullptr) return 0;
+    std::uint64_t size;
+    std::memcpy(&size, first, sizeof(size));
+    if (size < sizeof(size)) throw std::runtime_error("Vdecsw: picture info is smaller than its size field");
+    const auto copy = [first, size](const auto& source) {
+        const auto bytes = std::min<std::uint64_t>(size, sizeof(source)) - sizeof(size);
+        std::memcpy(static_cast<std::uint8_t*>(first) + sizeof(size), reinterpret_cast<const std::uint8_t*>(&source) + sizeof(size), bytes);
+    };
+    std::vector<std::shared_ptr<Decoder>> all;
+    {
+        std::lock_guard lock(decodersMutex);
+        for (const auto& [handle, decoder] : decoders) all.push_back(decoder);
+    }
+    for (const auto& decoder : all) {
+        std::lock_guard lock(decoder->mutex);
+        if (const auto found = decoder->delivered.find(output->frameBuffer); found != decoder->delivered.end()) {
+            std::visit(copy, found->second);
+            return 0;
+        }
+        if (const auto found = decoder->deliveredVp9.find(output->frameBuffer); found != decoder->deliveredVp9.end()) {
+            copy(found->second);
+            return 0;
+        }
+    }
+    throw std::runtime_error("Vdecsw: picture info requested for a frame buffer no decoder returned");
 }
 
 int APS5_VABI sceVdecswGetAvcPictureInfo(const OutputInfo* output, AvcPictureInfo* first, AvcPictureInfo* second) {
@@ -520,7 +385,7 @@ int APS5_VABI sceVdecswGetHevcPictureInfo(const OutputInfo* output, HevcPictureI
     return deliveredPictureInfo(output, picture);
 }
 
-int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo* output, Vp9PictureInfo* picture) {
+int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo* output, SceVideodec2::Vp9PictureInfo* picture) {
     if (output == nullptr || picture == nullptr || picture->thisSize < sizeof(std::uint64_t)) throw std::runtime_error("Vdecsw: invalid argument pointer");
     if (output->pictureCount > 1) throw std::runtime_error("Vdecsw: more than one VP9 picture info is not implemented");
     if (output->pictureCount == 0) return 0;
@@ -533,7 +398,7 @@ int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo* output, Vp9PictureInf
         std::lock_guard lock(decoder->mutex);
         const auto found = decoder->deliveredVp9.find(output->frameBuffer);
         if (found == decoder->deliveredVp9.end()) continue;
-        const auto bytes = std::min<std::uint64_t>(picture->thisSize, sizeof(Vp9PictureInfo)) - sizeof(std::uint64_t);
+        const auto bytes = std::min<std::uint64_t>(picture->thisSize, sizeof(SceVideodec2::Vp9PictureInfo)) - sizeof(std::uint64_t);
         std::memcpy(reinterpret_cast<std::uint8_t*>(picture) + sizeof(std::uint64_t), reinterpret_cast<const std::uint8_t*>(&found->second) + sizeof(std::uint64_t), bytes);
         return 0;
     }
diff --git a/core/libs/prx/libSceVdecsw/include/Api.hpp b/core/libs/prx/libSceVdecsw/include/Api.hpp
new file mode 100644
index 0000000000..7b5fdf595a
--- /dev/null
+++ b/core/libs/prx/libSceVdecsw/include/Api.hpp
@@ -0,0 +1,162 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#pragma once
+
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <deque>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <stdexcept>
+#include <thread>
+#include <variant>
+#include <vector>
+
+namespace SceVdecsw {
+
+struct DecoderConfigInfo {
+    SceVideodec2::DecoderConfigInfo decoder;
+    std::uint64_t computeQueue;
+    std::uint64_t cpuAffinityMask;
+    std::int32_t cpuThreadPriority;
+    bool optimizeProgressiveVideo;
+    std::uint8_t reserved[19];
+};
+
+struct InputResult {
+    std::uint64_t thisSize;
+    const void* decodedAu;
+    std::uint32_t outputFrameCount;
+    std::uint32_t reserved;
+};
+
+}
+
+namespace SceVdecsw {
+
+struct FrameBuffer {
+    std::uint64_t thisSize;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+};
+
+}
+
+namespace SceVdecsw {
+
+struct OutputInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    bool isLastFrame;
+    bool isErrorFrame;
+    std::uint8_t pictureCount;
+    std::uint32_t codecType;
+    std::uint32_t frameWidth;
+    std::uint32_t framePitch;
+    std::uint32_t frameHeight;
+    bool isDiscardedFrame;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+    std::uint32_t frameFormat;
+    std::uint32_t framePitchInBytes;
+};
+
+}
+
+namespace SceVdecsw {
+
+struct AvcPictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint8_t idrPictureFlag;
+    std::uint8_t profileIdc;
+    std::uint8_t levelIdc;
+    std::uint32_t picWidthInMbsMinus1;
+    std::uint32_t picHeightInMapUnitsMinus1;
+    std::uint8_t frameMbsOnlyFlag;
+    std::uint8_t frameCroppingFlag;
+    std::uint32_t frameCropLeftOffset;
+    std::uint32_t frameCropRightOffset;
+    std::uint32_t frameCropTopOffset;
+    std::uint32_t frameCropBottomOffset;
+    std::uint8_t vui[44];
+};
+
+}
+
+namespace SceVdecsw {
+
+struct HevcPictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint32_t picWidthInLumaSamples;
+    std::uint32_t picHeightInLumaSamples;
+    std::uint8_t bitDepthLumaMinus8;
+    std::uint8_t bitDepthChromaMinus8;
+    std::uint8_t timingInfoPresentFlag;
+    std::uint32_t numUnitsInTick;
+    std::uint32_t timeScale;
+    std::uint32_t aspectRatioInfoPresentFlag;
+    std::uint8_t aspectRatioIdc;
+    std::uint16_t sarWidth;
+    std::uint16_t sarHeight;
+    std::uint8_t videoSignal[8];
+    std::uint32_t picStruct;
+    std::uint32_t sourceScanType;
+    std::uint32_t duplicateFlag;
+    std::uint32_t conformanceWindowFlag;
+    std::uint32_t confWinLeftOffset;
+    std::uint32_t confWinRightOffset;
+    std::uint32_t confWinTopOffset;
+    std::uint32_t confWinBottomOffset;
+    std::uint32_t defaultDisplayWindow[5];
+    std::uint8_t chromaLocation[4];
+    std::uint8_t presentFlags[11];
+    std::uint8_t idrPictureFlag;
+    std::uint8_t irapPictureFlag;
+    std::uint8_t generalProfileSpace;
+    std::uint8_t generalTierFlag;
+    std::uint8_t generalProfileIdc;
+    std::uint8_t generalSourceFlags[3];
+    std::uint8_t generalLevelIdc;
+    std::uint8_t subLayer[9];
+    std::uint8_t frameCroppingFlag;
+    std::uint32_t frameCropLeftOffset;
+    std::uint32_t frameCropRightOffset;
+    std::uint32_t frameCropTopOffset;
+    std::uint32_t frameCropBottomOffset;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVdecswQueryComputeMemoryInfo(SceVideodec2::ComputeMemoryInfo* info);
+int APS5_VABI sceVdecswAllocateComputeQueue(const SceVideodec2::ComputeConfigInfo* config, const SceVideodec2::ComputeMemoryInfo* memory, std::uint64_t* queue);
+int APS5_VABI sceVdecswReleaseComputeQueue(std::uint64_t queue);
+int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const void* config, SceVideodec2::DecoderMemoryInfo* memory);
+int APS5_VABI sceVdecswCreateDecoder(const void* config, const SceVideodec2::DecoderMemoryInfo* memory, std::uint64_t* handle);
+int APS5_VABI sceVdecswDeleteDecoder(std::uint64_t handle);
+int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t handle, const SceVideodec2::InputData* input);
+int APS5_VABI sceVdecswTrySyncDecodeInput(std::uint64_t handle, SceVdecsw::InputResult* result);
+int APS5_VABI sceVdecswSyncDecodeInput(std::uint64_t handle, SceVdecsw::InputResult* result);
+int APS5_VABI sceVdecswSetDecodeOutput(std::uint64_t handle, const SceVdecsw::FrameBuffer* frame);
+int APS5_VABI sceVdecswTrySyncDecodeOutput(std::uint64_t handle, SceVdecsw::OutputInfo* output);
+int APS5_VABI sceVdecswSyncDecodeOutput(std::uint64_t handle, SceVdecsw::OutputInfo* output);
+int APS5_VABI sceVdecswGetPictureInfo(const SceVdecsw::OutputInfo* output, void* first, void* second);
+int APS5_VABI sceVdecswGetAvcPictureInfo(const SceVdecsw::OutputInfo* output, SceVdecsw::AvcPictureInfo* first, SceVdecsw::AvcPictureInfo* second);
+int APS5_VABI sceVdecswGetHevcPictureInfo(const SceVdecsw::OutputInfo* output, SceVdecsw::HevcPictureInfo* picture);
+int APS5_VABI sceVdecswGetVp9PictureInfo(const SceVdecsw::OutputInfo* output, SceVideodec2::Vp9PictureInfo* picture);
+int APS5_VABI sceVdecswFinalizeDecodeSequence(std::uint64_t handle);
+int APS5_VABI sceVdecswResetDecoder(std::uint64_t handle);
+
+}
diff --git a/core/libs/prx/libSceVdecsw/libSceVdecsw.hpp b/core/libs/prx/libSceVdecsw/libSceVdecsw.hpp
new file mode 100644
index 0000000000..c080ab901a
--- /dev/null
+++ b/core/libs/prx/libSceVdecsw/libSceVdecsw.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecsw/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecwrap/Export.cpp b/core/libs/prx/libSceVdecwrap/Export.cpp
index ae14644219..923c85002b 100644
--- a/core/libs/prx/libSceVdecwrap/Export.cpp
+++ b/core/libs/prx/libSceVdecwrap/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecwrap/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecwrap/include/Api.hpp b/core/libs/prx/libSceVdecwrap/include/Api.hpp
new file mode 100644
index 0000000000..44f275d760
--- /dev/null
+++ b/core/libs/prx/libSceVdecwrap/include/Api.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVdecwrapCreateDecoder();
+int APS5_VABI sceVdecwrapDeleteDecoder();
+int APS5_VABI sceVdecwrapFlushDecodeOutput();
+int APS5_VABI sceVdecwrapGetDecodeOutput();
+int APS5_VABI sceVdecwrapMapDirectMemory();
+int APS5_VABI sceVdecwrapMapMemory();
+int APS5_VABI sceVdecwrapQueryDecoderMemoryInfo();
+int APS5_VABI sceVdecwrapQueryFrameBufferInfo();
+int APS5_VABI sceVdecwrapResetDecoder();
+int APS5_VABI sceVdecwrapSetDecodeInput();
+int APS5_VABI sceVdecwrapSyncDecode();
+
+}
diff --git a/core/libs/prx/libSceVdecwrap/libSceVdecwrap.hpp b/core/libs/prx/libSceVdecwrap/libSceVdecwrap.hpp
new file mode 100644
index 0000000000..65c7e47394
--- /dev/null
+++ b/core/libs/prx/libSceVdecwrap/libSceVdecwrap.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecwrap/include/Api.hpp"
diff --git a/core/libs/prx/libSceVenc/Export.cpp b/core/libs/prx/libSceVenc/Export.cpp
index 8d8de5aa65..c423ca85fb 100644
--- a/core/libs/prx/libSceVenc/Export.cpp
+++ b/core/libs/prx/libSceVenc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVenc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVenc/include/Api.hpp b/core/libs/prx/libSceVenc/include/Api.hpp
new file mode 100644
index 0000000000..26d25b4a07
--- /dev/null
+++ b/core/libs/prx/libSceVenc/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVencCreateEncoder();
+int APS5_VABI sceVencDeleteEncoder();
+int APS5_VABI sceVencGetConfig();
+int APS5_VABI sceVencMapMemory();
+int APS5_VABI sceVencQueryHeader();
+int APS5_VABI sceVencQueryMemorySize();
+int APS5_VABI sceVencQueryPreset();
+int APS5_VABI sceVencSetConfig();
+int APS5_VABI sceVencSetDecodedFrame();
+int APS5_VABI sceVencSetPictureConfig();
+int APS5_VABI sceVencSetRateControlConfig();
+int APS5_VABI sceVencSetReferenceFrameInvalidationConfig();
+int APS5_VABI sceVencStartEncode();
+int APS5_VABI sceVencStopEncode();
+
+}
diff --git a/core/libs/prx/libSceVenc/libSceVenc.hpp b/core/libs/prx/libSceVenc/libSceVenc.hpp
new file mode 100644
index 0000000000..cae676b0b2
--- /dev/null
+++ b/core/libs/prx/libSceVenc/libSceVenc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVenc/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoArbitration/Export.cpp b/core/libs/prx/libSceVideoArbitration/Export.cpp
index 2825147db8..23b1eaa853 100644
--- a/core/libs/prx/libSceVideoArbitration/Export.cpp
+++ b/core/libs/prx/libSceVideoArbitration/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoArbitration/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoArbitration/include/Api.hpp b/core/libs/prx/libSceVideoArbitration/include/Api.hpp
new file mode 100644
index 0000000000..126dfd0696
--- /dev/null
+++ b/core/libs/prx/libSceVideoArbitration/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoArbitrationAcceptEvent();
+int APS5_VABI sceVideoArbitrationEnable();
+int APS5_VABI sceVideoArbitrationInitialize();
+
+}
diff --git a/core/libs/prx/libSceVideoArbitration/libSceVideoArbitration.hpp b/core/libs/prx/libSceVideoArbitration/libSceVideoArbitration.hpp
new file mode 100644
index 0000000000..46377c3aca
--- /dev/null
+++ b/core/libs/prx/libSceVideoArbitration/libSceVideoArbitration.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoArbitration/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoCoreInterface/Export.cpp b/core/libs/prx/libSceVideoCoreInterface/Export.cpp
index 69f5eb3f02..d81f5a18e0 100644
--- a/core/libs/prx/libSceVideoCoreInterface/Export.cpp
+++ b/core/libs/prx/libSceVideoCoreInterface/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoCoreInterface/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -10,7 +11,6 @@ int APS5_VABI sceVideoCoreIfSetFunctionTableUnlimited() {
     return 0;
 }
 
-
 int APS5_VABI sceVideoCoreIfInitializeInterface() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceVideoCoreInterface/include/Api.hpp b/core/libs/prx/libSceVideoCoreInterface/include/Api.hpp
new file mode 100644
index 0000000000..7b01f1539c
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreInterface/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoCoreIfSetFunctionTableUnlimited();
+int APS5_VABI sceVideoCoreIfInitializeInterface();
+int APS5_VABI sceVideoCoreIfMainLoop();
+int APS5_VABI sceVideoCoreIfSetFunctionTable();
+
+}
diff --git a/core/libs/prx/libSceVideoCoreInterface/libSceVideoCoreInterface.hpp b/core/libs/prx/libSceVideoCoreInterface/libSceVideoCoreInterface.hpp
new file mode 100644
index 0000000000..0a1d280f24
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreInterface/libSceVideoCoreInterface.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoCoreInterface/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp b/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp
index 37c16803eb..0c92606c7e 100644
--- a/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp
+++ b/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoCoreServerInterface/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoCoreServerInterface/include/Api.hpp b/core/libs/prx/libSceVideoCoreServerInterface/include/Api.hpp
new file mode 100644
index 0000000000..1b44bc62ac
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreServerInterface/include/Api.hpp
@@ -0,0 +1,55 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoCoreAbortRequest();
+int APS5_VABI sceVideoCoreAcquireDecoderResource();
+int APS5_VABI sceVideoCoreAcquireDecoderResourceForBeWrapper();
+int APS5_VABI sceVideoCoreAddStream();
+int APS5_VABI sceVideoCoreAsyncAddStream();
+int APS5_VABI sceVideoCoreAsyncSendRequest();
+int APS5_VABI sceVideoCoreCancelThumbnail();
+int APS5_VABI sceVideoCoreChangeActiveStatus();
+int APS5_VABI sceVideoCoreChangeAudioStream();
+int APS5_VABI sceVideoCoreChangeDisplaySize();
+int APS5_VABI sceVideoCoreChangeHdcpSetting();
+int APS5_VABI sceVideoCoreChangeSubtitle();
+int APS5_VABI sceVideoCoreDeleteStream();
+int APS5_VABI sceVideoCoreGenerateThumbnail();
+int APS5_VABI sceVideoCoreGenerateThumbnail2();
+int APS5_VABI sceVideoCoreGetCanvasHandle();
+int APS5_VABI sceVideoCoreGetPlayStatus();
+int APS5_VABI sceVideoCoreGetPlayStatus2();
+int APS5_VABI sceVideoCoreGetStreamUid();
+int APS5_VABI sceVideoCoreGetThumbnail();
+int APS5_VABI sceVideoCoreGetThumbnail2();
+int APS5_VABI sceVideoCoreLaunchVideoCore();
+int APS5_VABI sceVideoCoreMediaSourceAbortSourceBuffer();
+int APS5_VABI sceVideoCoreMediaSourceAddSourceBuffer();
+int APS5_VABI sceVideoCoreMediaSourceAppendData();
+int APS5_VABI sceVideoCoreMediaSourceEndOfStream();
+int APS5_VABI sceVideoCoreMediaSourceGetBufferedTimeRanges();
+int APS5_VABI sceVideoCoreMediaSourceGetInputBufferEmptySize();
+int APS5_VABI sceVideoCoreMediaSourceGetPlaybackQuality();
+int APS5_VABI sceVideoCoreMediaSourceGetSourceBufferEvent();
+int APS5_VABI sceVideoCoreMediaSourceRemoveSourceBuffer();
+int APS5_VABI sceVideoCoreMediaSourceSetDuration();
+int APS5_VABI sceVideoCoreMediaSourceSetTimestampOffset();
+int APS5_VABI sceVideoCorePlayControl();
+int APS5_VABI sceVideoCoreRegistEventCallback();
+int APS5_VABI sceVideoCoreReleaseDecoderResource();
+int APS5_VABI sceVideoCoreReleaseDecoderResourceForBeWrapper();
+int APS5_VABI sceVideoCoreSetAudioMute();
+int APS5_VABI sceVideoCoreSetAudioVolume();
+int APS5_VABI sceVideoCoreSetFullScreen();
+int APS5_VABI sceVideoCoreSetInitialInfo();
+int APS5_VABI sceVideoCoreSetInitializeInfo();
+int APS5_VABI sceVideoCoreSetPlaybackRange();
+int APS5_VABI sceVideoCoreSetThumbnailInfo();
+int APS5_VABI sceVideoCoreSyncAddStream();
+int APS5_VABI sceVideoCoreSyncSendRequest();
+int APS5_VABI sceVideoCoreUnregistEventCallback();
+
+}
diff --git a/core/libs/prx/libSceVideoCoreServerInterface/libSceVideoCoreServerInterface.hpp b/core/libs/prx/libSceVideoCoreServerInterface/libSceVideoCoreServerInterface.hpp
new file mode 100644
index 0000000000..5a97dc597f
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreServerInterface/libSceVideoCoreServerInterface.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoCoreServerInterface/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp b/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp
index 4e2ab88329..3dc080db54 100644
--- a/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp
+++ b/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoDecoderArbitration/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoDecoderArbitration/include/Api.hpp b/core/libs/prx/libSceVideoDecoderArbitration/include/Api.hpp
new file mode 100644
index 0000000000..0029460ffa
--- /dev/null
+++ b/core/libs/prx/libSceVideoDecoderArbitration/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoDecoderArbitrationAcceptEvent();
+int APS5_VABI sceVideoDecoderArbitrationEnable();
+int APS5_VABI sceVideoDecoderArbitrationEnableSuspendMode();
+int APS5_VABI sceVideoDecoderArbitrationInitialize();
+
+}
diff --git a/core/libs/prx/libSceVideoDecoderArbitration/libSceVideoDecoderArbitration.hpp b/core/libs/prx/libSceVideoDecoderArbitration/libSceVideoDecoderArbitration.hpp
new file mode 100644
index 0000000000..93ab58e19f
--- /dev/null
+++ b/core/libs/prx/libSceVideoDecoderArbitration/libSceVideoDecoderArbitration.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoDecoderArbitration/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp b/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp
index 2c3047328f..83c4dda32a 100644
--- a/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp
+++ b/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoNativeExtEssential/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoNativeExtEssential/include/Api.hpp b/core/libs/prx/libSceVideoNativeExtEssential/include/Api.hpp
new file mode 100644
index 0000000000..0801f28d5d
--- /dev/null
+++ b/core/libs/prx/libSceVideoNativeExtEssential/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoNativeExtEssential_CreateDecInstance();
+int APS5_VABI sceVideoNativeExtEssential_DestroyDecInstance();
+int APS5_VABI sceVideoNativeExtEssential_Finalize();
+int APS5_VABI sceVideoNativeExtEssential_Initialize();
+int APS5_VABI sceVideoNativeExtEssential_IsInit();
+
+}
diff --git a/core/libs/prx/libSceVideoNativeExtEssential/libSceVideoNativeExtEssential.hpp b/core/libs/prx/libSceVideoNativeExtEssential/libSceVideoNativeExtEssential.hpp
new file mode 100644
index 0000000000..07fbad2f88
--- /dev/null
+++ b/core/libs/prx/libSceVideoNativeExtEssential/libSceVideoNativeExtEssential.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoNativeExtEssential/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoOut/CMakeLists.txt b/core/libs/prx/libSceVideoOut/CMakeLists.txt
index dee987ce6e..14b0d27a7e 100644
--- a/core/libs/prx/libSceVideoOut/CMakeLists.txt
+++ b/core/libs/prx/libSceVideoOut/CMakeLists.txt
@@ -23,7 +23,7 @@ target_include_directories(libSceVideoOut PRIVATE
         ${CMAKE_BINARY_DIR}/core/libs/prx/libSceAgcDriver/generated
 )
 add_dependencies(libSceVideoOut agc_trace_revision)
-target_link_libraries(libSceVideoOut PRIVATE libSceAgcDriver libScePad libSceMouse libSceKeyboard libSceIme libc libkernel decoder_png SDL2-static)
+target_link_libraries(libSceVideoOut PRIVATE libSceAgcDriver libScePad libSceUserService libSceMouse libSceKeyboard libSceIme libc libkernel decoder_png SDL2-static)
 if(WIN32)
     target_link_libraries(libSceVideoOut PRIVATE comctl32 dxgi)
 endif()
@@ -102,7 +102,7 @@ if(BUILD_TESTING)
     endforeach()
 
     set_target_properties(video_out_flip_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
-    foreach(flipMode IN ITEMS lifetime reopen decode controls overlay unopened ps4)
+    foreach(flipMode IN ITEMS lifetime reopen decode controls overlay unopened ps4 resolution resolution_override)
         if(flipMode STREQUAL "lifetime")
             add_test(NAME video_out_flip_${flipMode} COMMAND video_out_flip_tests)
         else()
@@ -145,8 +145,14 @@ endif()
 
 if(BUILD_TESTING)
     add_test_executable(pad_sdl_tests tests/PadSdl.cpp)
-    target_link_libraries(pad_sdl_tests PRIVATE SDL2-static)
+    target_include_directories(pad_sdl_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(pad_sdl_tests PRIVATE libSceVideoOut libScePad libSceUserService libc SDL2-static)
+    configure_windows_unwind(pad_sdl_tests)
     add_test(NAME pad_sdl COMMAND pad_sdl_tests)
+    if(WIN32)
+        set_tests_properties(pad_sdl PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVideoOut>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libScePad>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceUserService>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(pad_input_mapping_tests tests/InputMapping.cpp src/InputMapping.cpp)
     target_include_directories(pad_input_mapping_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/3rdparty/SDL2/include)
     target_link_libraries(pad_input_mapping_tests PRIVATE SDL2-static libc)
@@ -285,13 +291,18 @@ if(BUILD_TESTING)
     endif()
 endif()
 
-if(BUILD_TESTING AND NOT WIN32)
+if(BUILD_TESTING)
     add_test_executable(video_out_telemetry_tests tests/Telemetry.cpp)
     target_include_directories(video_out_telemetry_tests PRIVATE ${LIBS_INCLUDE_DIR} ${ANYPS5_SDL2_INCLUDE_DIR})
     target_link_libraries(video_out_telemetry_tests PRIVATE libSceVideoOut libSceAgcDriver libkernel libc SDL2-static)
     set_target_properties(video_out_telemetry_tests PROPERTIES CXX_EXTENSIONS OFF)
+    configure_windows_unwind(video_out_telemetry_tests)
     add_test(NAME video_out_telemetry COMMAND video_out_telemetry_tests)
     add_test(NAME video_out_telemetry_caption COMMAND video_out_telemetry_tests caption)
     set_tests_properties(video_out_telemetry PROPERTIES TIMEOUT 30)
     set_tests_properties(video_out_telemetry_caption PROPERTIES TIMEOUT 30 SKIP_RETURN_CODE 77 RESOURCE_LOCK videoout_app0 ENVIRONMENT "SDL_VIDEODRIVER=${ANYPS5_VIDEO_OUT_TEST_DRIVER}")
+    if(WIN32)
+        set_tests_properties(video_out_telemetry video_out_telemetry_caption PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
 endif()
diff --git a/core/libs/prx/libSceVideoOut/Unimplemented.cpp b/core/libs/prx/libSceVideoOut/Unimplemented.cpp
index 91b75fbb31..bd6d217e9f 100644
--- a/core/libs/prx/libSceVideoOut/Unimplemented.cpp
+++ b/core/libs/prx/libSceVideoOut/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -37,35 +38,8 @@ int APS5_VABI sceVideoOutCursorSetPosition(int32_t, int32_t, uint32_t, uint32_t)
     return 0;
 }
 
-int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutAdjustColor_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutAdjustColor(handle, settings);
-}
-
-int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutColorSettingsSetGamma_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutColorSettingsSetGamma(settings, gamma);
-}
-
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(settings);
-}
-
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(settings, lumaScale, option);
-}
-
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutAdjustColorSpaceConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutAdjustColorSpaceConversion(handle, settings);
-}
-
-
 int APS5_VABI sceDbgVideoOutAddOutputModeVr60Privilege() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-
 }
diff --git a/core/libs/prx/libSceVideoOut/include/Buffer.hpp b/core/libs/prx/libSceVideoOut/include/Buffer.hpp
index 5ae8013ae6..112e9cc682 100644
--- a/core/libs/prx/libSceVideoOut/include/Buffer.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Buffer.hpp
@@ -3,23 +3,22 @@
 
 #include <cstdint>
 
-#include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
 extern "C" {
 
-int APS5_VABI sceVideoOutRegisterBuffers(int handle, int buffer_index_start, void* const* addresses, int buffer_num, const VideoOutBufferAttribute* attribute);
-void APS5_VABI sceVideoOutSetBufferAttribute(VideoOutBufferAttribute* attribute, uint32_t pixel_format, uint32_t tiling_mode, uint32_t aspect_ratio, uint32_t width, uint32_t height, uint32_t pitch_in_pixel);
-int APS5_VABI sceVideoOutRegisterBuffers2(int handle, int set_index, int buffer_index_start, const VideoOutBuffers* buffers, int buffer_num, const VideoOutBufferAttribute2* attribute, int category, void* option);
-void APS5_VABI sceVideoOutSetBufferAttribute2(VideoOutBufferAttribute2* attribute, uint64_t pixel_format, uint32_t tiling_mode, uint32_t width, uint32_t height, uint64_t option, uint32_t dcc_control, uint64_t dcc_cb_register_clear_color);
+int APS5_VABI sceVideoOutRegisterBuffers(int handle, int bufferIndexStart, void* const* addresses, int bufferNum, const VideoOutBufferAttribute* attribute);
+void APS5_VABI sceVideoOutSetBufferAttribute(VideoOutBufferAttribute* attribute, uint32_t pixelFormat, uint32_t tilingMode, uint32_t aspectRatio, uint32_t width, uint32_t height, uint32_t pitchInPixel);
+int APS5_VABI sceVideoOutRegisterBuffers2(int handle, int setIndex, int bufferIndexStart, const VideoOutBuffers* buffers, int bufferNum, const VideoOutBufferAttribute2* attribute, int category, void* option);
+void APS5_VABI sceVideoOutSetBufferAttribute2(VideoOutBufferAttribute2* attribute, uint64_t pixelFormat, uint32_t tilingMode, uint32_t width, uint32_t height, uint64_t option, uint32_t dccControl, uint64_t dccCbRegisterClearColor);
 void APS5_VABI sceVideoOutAddBufferAttributeOption(VideoOutBufferAttribute2* attribute, uint64_t option);
 void APS5_VABI sceVideoOutRemoveBufferAttributeOption(VideoOutBufferAttribute2* attribute, uint64_t option);
-int APS5_VABI sceVideoOutSubmitChangeBufferAttribute2(int handle, int set_index, const VideoOutBufferAttribute2* attribute, void* option);
-int APS5_VABI sceVideoOutSubmitEopFlip(int handle, int index, int flip_mode, int64_t flip_arg, std::uint32_t* token);
-int APS5_VABI sceVideoOutSubmitFlip(int handle, int index, int flip_mode, int64_t flip_arg);
-int APS5_VABI sceVideoOutUnregisterBuffers(int handle, int set_index);
+int APS5_VABI sceVideoOutSubmitChangeBufferAttribute2(int handle, int setIndex, const VideoOutBufferAttribute2* attribute, void* option);
+int APS5_VABI sceVideoOutSubmitEopFlip(int handle, int index, int flipMode, int64_t flipArg, std::uint32_t* token);
+int APS5_VABI sceVideoOutSubmitFlip(int handle, int index, int flipMode, int64_t flipArg);
+int APS5_VABI sceVideoOutUnregisterBuffers(int handle, int setIndex);
 int APS5_VABI sceVideoOutGetBufferLabelAddress(int handle, uintptr_t* address);
 
-#endif
-
 }
+
+#endif
diff --git a/core/libs/prx/libSceVideoOut/include/Event.hpp b/core/libs/prx/libSceVideoOut/include/Event.hpp
index ca5e4f09f7..aea9cf2186 100644
--- a/core/libs/prx/libSceVideoOut/include/Event.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Event.hpp
@@ -3,7 +3,6 @@
 
 #include <cstdint>
 
-#include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
 extern "C" {
@@ -24,6 +23,6 @@ int APS5_VABI sceVideoOutGetEventCount(const KernelEvent* ev);
 int APS5_VABI sceVideoOutGetEventData(const KernelEvent* ev, int64_t* data);
 int APS5_VABI sceVideoOutGetEventId(const KernelEvent* ev);
 
-#endif
-
 }
+
+#endif
diff --git a/core/libs/prx/libSceVideoOut/include/Output.hpp b/core/libs/prx/libSceVideoOut/include/Output.hpp
index 569e97ee77..caebc2514a 100644
--- a/core/libs/prx/libSceVideoOut/include/Output.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Output.hpp
@@ -2,17 +2,16 @@
 #define CORE_LIBS_PRX_LIBSCEVIDEOUOUT_INCLUDE_OUTPUT_HPP
 
 #include <cstdint>
-#include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
 int ValidateVideoOutOutputMode_nid_no_patch(uint64_t mode, const VideoOutOutputOptions* options, int displayRefreshRate);
 
 extern "C" {
 
-int APS5_VABI sceVideoOutOpen(int user_id, int bus_type, int index, const void* param);
+int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
 int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutConfigureOutput(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reserved_ptr, uint64_t reserved);
-int APS5_VABI sceVideoOutIsOutputSupported(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reserved_ptr, uint64_t reserved);
+int APS5_VABI sceVideoOutConfigureOutput(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, uint64_t reserved);
+int APS5_VABI sceVideoOutIsOutputSupported(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, uint64_t reserved);
 int APS5_VABI sceVideoOutInitializeOutputOptions(VideoOutOutputOptions* options);
 int APS5_VABI sceVideoOutAllowOutputResolutionWqhdDetection(int handle);
 int APS5_VABI sceVideoOutSetFlipRate(int handle, int rate);
@@ -31,9 +30,9 @@ int APS5_VABI sceVideoOutAdjustColor(int handle, const VideoOutColorSettings* se
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings);
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option);
 int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutColorSpaceConversionSettings* settings);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size);
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settingsSize);
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settingsSize);
+int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settingsSize);
 int APS5_VABI sceVideoOutSetGlobalBlendSpace(int handle, uint32_t space, uint32_t option);
 int APS5_VABI sceVideoOutVrrPegToFixedRate(int handle, uint64_t arg1, uint64_t arg2);
 int APS5_VABI sceVideoOutVrrUnpegFromFixedRate(int handle);
diff --git a/core/libs/prx/libSceVideoOut/include/PadInput.hpp b/core/libs/prx/libSceVideoOut/include/PadInput.hpp
index dfa068d16d..2f5eddb56c 100644
--- a/core/libs/prx/libSceVideoOut/include/PadInput.hpp
+++ b/core/libs/prx/libSceVideoOut/include/PadInput.hpp
@@ -5,7 +5,9 @@
 #include "SDL_gamecontroller.h"
 #include "prx/libScePad/include/KeyboardMouse.hpp"
 #include "prx/libScePad/include/PadState.hpp"
+#include "prx/libScePad/include/Pad.hpp"
 #include "prx/libSceVideoOut/include/PadOutputPacing.hpp"
+#include <array>
 #include <chrono>
 #include "prx/libSceVideoOut/include/Telemetry.hpp"
 
@@ -18,28 +20,37 @@ public:
     void HandleEvent(const SDL_Event& event, DisplayWindow& window);
     void Update(const DisplayWindow& window);
     bool MouseModeEnabled() const { return keyboardMouse.MouseMode(); }
+    bool SlotOccupied(int slot) const {
+        return slot >= 0 && slot < PAD_MAX_CONTROLLERS && slots[slot].controller != nullptr;
+    }
 
 private:
+    struct ControllerSlot {
+        SDL_GameController* controller = nullptr;
+        SDL_JoystickID instanceId = -1;
+        PadInputState state{};
+        std::uint32_t outputSequence = 0;
+        PadOutputState outputState{};
+        bool outputPending = false;
+        std::chrono::steady_clock::time_point nextRumbleRefresh{};
+        LightBarPacer lightBar;
+        TriggerEffectCache triggerEffect;
+    };
+
     explicit PadInput(Pad::InputConfiguration configuration);
     void publish(std::uint64_t frame);
+    void publish(std::uint64_t frame, int slot);
     void setMouseMode(bool enabled);
-    void openFirstAvailableController();
+    void openAvailableControllers();
     void openController(int deviceIndex);
-    void closeController();
-    PadInputState sampleController() const;
+    void closeController(int slot);
+    PadInputState sampleController(int slot) const;
     void applyOutput();
-    void enableSensors();
+    void enableSensors(int slot);
 
     Pad::KeyboardMouse keyboardMouse;
-    SDL_GameController* controller = nullptr;
-    PadInputState controllerState{};
-    std::uint32_t outputSequence = 0;
-    PadOutputState outputState{};
-    bool outputPending = false;
+    std::array<ControllerSlot, PAD_MAX_CONTROLLERS> slots{};
     VideoOutTelemetry::PadChangeFilter telemetryFilter;
-    std::chrono::steady_clock::time_point nextRumbleRefresh{};
-    LightBarPacer lightBar;
-    TriggerEffectCache triggerEffect;
 };
 
 #endif
diff --git a/core/libs/prx/libSceVideoOut/include/VideoOut.hpp b/core/libs/prx/libSceVideoOut/include/VideoOut.hpp
new file mode 100644
index 0000000000..8f86fea2b9
--- /dev/null
+++ b/core/libs/prx/libSceVideoOut/include/VideoOut.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoOutSetFlipMaster(std::int32_t handle, std::int32_t masterHandle);
+int APS5_VABI sceVideoOutClearFlipMaster(std::int32_t handle);
+int APS5_VABI sceVideoOutCursorEnable(int32_t, int32_t, const void*);
+int APS5_VABI sceVideoOutCursorDisable(int32_t, int32_t);
+int APS5_VABI sceVideoOutCursorSetImageAddress(int32_t, int32_t, const void*);
+int APS5_VABI sceVideoOutCursorSetPosition(int32_t, int32_t, uint32_t, uint32_t);
+int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settingsSize);
+int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settingsSize);
+int APS5_VABI sceDbgVideoOutAddOutputModeVr60Privilege();
+int APS5_VABI sceVideoOutAddVrrStatusFlagsPrivilege();
+
+}
diff --git a/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp b/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp
index 7c868f3ce2..156e03c66d 100644
--- a/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp
+++ b/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp
@@ -96,6 +96,9 @@ static constexpr std::uint64_t VIDEO_OUT_OUTPUT_STATUS_FLAG_HDR = 1;
 static constexpr uint64_t VIDEO_OUT_REFRESH_RATE_59_94HZ = 3;
 static constexpr uint64_t VIDEO_OUT_REFRESH_RATE_119_88HZ = 13;
 
+static constexpr std::uint32_t VIDEO_OUT_RESOLUTION_1080P = 1;
+static constexpr std::uint32_t VIDEO_OUT_RESOLUTION_2160P = 2;
+
 struct VideoOutBuffer {
     int groupIndex = -1;
     uint64_t dataAddress = 0;
@@ -226,6 +229,7 @@ public:
     bool HasConfig(int handle);
     bool SupportsHighFrameRate();
     int GetDisplayRefreshRate();
+    std::uint32_t GetDisplayResolution();
 
     // 0, or VIDEO_OUT_ERROR_FLIP_QUEUE_FULL when the title has VIDEO_OUT_FLIP_QUEUE_CAPACITY flips pending.
     int SubmitFlip(int handle, int index, int flipMode, int64_t flipArg);
@@ -252,6 +256,7 @@ private:
     HostHdrProbe hdrProbe;
     std::uint64_t hdrGeneration = 0;
     std::atomic<int> displayRefreshRate{0};
+    std::atomic<std::uint32_t> displayResolution{VIDEO_OUT_RESOLUTION_1080P};
 
     std::jthread presentThread;
     std::jthread vblankThread;
diff --git a/core/libs/prx/libSceVideoOut/libSceVideoOut.hpp b/core/libs/prx/libSceVideoOut/libSceVideoOut.hpp
new file mode 100644
index 0000000000..d3328b1410
--- /dev/null
+++ b/core/libs/prx/libSceVideoOut/libSceVideoOut.hpp
@@ -0,0 +1,6 @@
+#pragma once
+
+#include "prx/libSceVideoOut/include/Buffer.hpp"
+#include "prx/libSceVideoOut/include/Event.hpp"
+#include "prx/libSceVideoOut/include/Output.hpp"
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
diff --git a/core/libs/prx/libSceVideoOut/src/Buffer.cpp b/core/libs/prx/libSceVideoOut/src/Buffer.cpp
index 7197986ca7..75c4e8a067 100644
--- a/core/libs/prx/libSceVideoOut/src/Buffer.cpp
+++ b/core/libs/prx/libSceVideoOut/src/Buffer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Buffer.hpp"
 #include <cstdio>
 #include <cstring>
 #include <mutex>
diff --git a/core/libs/prx/libSceVideoOut/src/Event.cpp b/core/libs/prx/libSceVideoOut/src/Event.cpp
index d13e6494fb..dde7b34821 100644
--- a/core/libs/prx/libSceVideoOut/src/Event.cpp
+++ b/core/libs/prx/libSceVideoOut/src/Event.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Event.hpp"
 #include <algorithm>
 #include <chrono>
 #include <mutex>
diff --git a/core/libs/prx/libSceVideoOut/src/Output.cpp b/core/libs/prx/libSceVideoOut/src/Output.cpp
index 24f9b6f15c..0ad46a4ed8 100644
--- a/core/libs/prx/libSceVideoOut/src/Output.cpp
+++ b/core/libs/prx/libSceVideoOut/src/Output.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include <algorithm>
 #include <array>
 #include <cstddef>
@@ -19,7 +20,7 @@ static constexpr std::size_t VIDEO_OUT_OUTPUT_OPTIONS_FREE_WORD = 3;
 
 static VideoOutOutputStatus outputStatus(const auto& cfg) {
     VideoOutOutputStatus status{};
-    status.resolution = (cfg.width >= 3840 || cfg.height >= 2160) ? 2u : 1u;
+    status.resolution = VideoOutDriver::Get().GetDisplayResolution();
     const bool hdr = AgcDriver::CurrentHostHdr().available;
     status.dynamicRange = hdr ? VIDEO_OUT_DYNAMIC_RANGE_HDR : VIDEO_OUT_DYNAMIC_RANGE_SDR;
     status.refreshRate = (cfg.outputMode == VIDEO_OUT_OUTPUT_MODE_119_88HZ) ? VIDEO_OUT_REFRESH_RATE_119_88HZ : VIDEO_OUT_REFRESH_RATE_59_94HZ;
@@ -370,6 +371,31 @@ int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutCo
     LibcAwaitExit_nid_postfix();
 }
 
+int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutAdjustColor_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutAdjustColor(handle, settings);
+}
+
+int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutColorSettingsSetGamma_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutColorSettingsSetGamma(settings, gamma);
+}
+
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(settings);
+}
+
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(settings, lumaScale, option);
+}
+
+int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutAdjustColorSpaceConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutAdjustColorSpaceConversion(handle, settings);
+}
+
 int APS5_VABI sceVideoOutSetGlobalBlendSpace(int handle, uint32_t space, uint32_t option) try {
     auto cfg = VideoOutDriver::Get().GetConfig(handle);
     if (cfg == nullptr) {
diff --git a/core/libs/prx/libSceVideoOut/src/PadInput.cpp b/core/libs/prx/libSceVideoOut/src/PadInput.cpp
index d9abeeb048..5e9ac3fcf7 100644
--- a/core/libs/prx/libSceVideoOut/src/PadInput.cpp
+++ b/core/libs/prx/libSceVideoOut/src/PadInput.cpp
@@ -14,7 +14,9 @@
 #include "prx/libSceAgcDriver/Execution/include/Presentation.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libScePad/include/PadState.hpp"
+#include "prx/libScePad/include/Pad.hpp"
 #include "prx/libScePad/include/PadInputTypes.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
 
@@ -22,15 +24,16 @@ PadInput::PadInput() : PadInput(Pad::LoadInputMapping()) {
 }
 
 PadInput::PadInput(Pad::InputConfiguration configuration) : keyboardMouse(std::move(configuration)) {
-    openFirstAvailableController();
+    openAvailableControllers();
 }
 
 PadInput::~PadInput() {
-    closeController();
+    for (int i = 0; i < PAD_MAX_CONTROLLERS; ++i) {
+        closeController(i);
+    }
 }
 
-void PadInput::openFirstAvailableController() {
-    if (controller != nullptr) return;
+void PadInput::openAvailableControllers() {
     SDL_SetHint(SDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTS, "1");
     SDL_SetHint(SDL_HINT_JOYSTICK_HIDAPI_PS5_RUMBLE, "1");
     if ((SDL_WasInit(SDL_INIT_GAMECONTROLLER) & SDL_INIT_GAMECONTROLLER) == 0) {
@@ -42,82 +45,122 @@ void PadInput::openFirstAvailableController() {
     for (int deviceIndex = 0; deviceIndex < SDL_NumJoysticks(); ++deviceIndex) {
         if (!SDL_IsGameController(deviceIndex)) continue;
         openController(deviceIndex);
-        if (controller != nullptr) return;
     }
 }
 
 void PadInput::openController(int deviceIndex) {
-    if (controller != nullptr || !SDL_IsGameController(deviceIndex)) return;
-    controller = SDL_GameControllerOpen(deviceIndex);
-    if (controller == nullptr) {
+    if (!SDL_IsGameController(deviceIndex)) return;
+    const auto instanceId = SDL_JoystickGetDeviceInstanceID(deviceIndex);
+    for (int i = 0; i < PAD_MAX_CONTROLLERS; ++i) {
+        if (slots[i].controller != nullptr && slots[i].instanceId == instanceId) return;
+    }
+    int slot = -1;
+    for (int i = 0; i < PAD_MAX_CONTROLLERS; ++i) {
+        if (slots[i].controller == nullptr) {
+            slot = i;
+            break;
+        }
+    }
+    if (slot == -1) return;
+    SDL_GameController* gc = SDL_GameControllerOpen(deviceIndex);
+    if (gc == nullptr) {
         APS5_LOG_ERR("Pad: could not open game controller %d: %s", deviceIndex, SDL_GetError());
         return;
     }
-    const char* name = SDL_GameControllerName(controller);
-    APS5_LOG_OUT("Pad: connected game controller: %s (type %d, sensors accel=%d gyro=%d, touchpads=%d, led=%d, trigger rumble=%d)",
-        name != nullptr ? name : "unknown", static_cast<int>(SDL_GameControllerGetType(controller)),
-        SDL_GameControllerHasSensor(controller, SDL_SENSOR_ACCEL) == SDL_TRUE, SDL_GameControllerHasSensor(controller, SDL_SENSOR_GYRO) == SDL_TRUE,
-        SDL_GameControllerGetNumTouchpads(controller), SDL_GameControllerHasLED(controller) == SDL_TRUE, SDL_GameControllerHasRumbleTriggers(controller) == SDL_TRUE);
-    enableSensors();
-    outputPending = true;
-    lightBar.Reset();
-    triggerEffect.Reset();
+    slots[slot].controller = gc;
+    slots[slot].instanceId = SDL_JoystickInstanceID(SDL_GameControllerGetJoystick(gc));
+    slots[slot].state = {};
+    slots[slot].outputSequence = 0;
+    slots[slot].outputState = {};
+    slots[slot].outputPending = true;
+    slots[slot].nextRumbleRefresh = {};
+    slots[slot].lightBar.Reset();
+    slots[slot].triggerEffect.Reset();
+    const char* name = SDL_GameControllerName(gc);
+    APS5_LOG_OUT("Pad: connected game controller (slot %d): %s (type %d, sensors accel=%d gyro=%d, touchpads=%d, led=%d, trigger rumble=%d)",
+        slot, name != nullptr ? name : "unknown", static_cast<int>(SDL_GameControllerGetType(gc)),
+        SDL_GameControllerHasSensor(gc, SDL_SENSOR_ACCEL) == SDL_TRUE, SDL_GameControllerHasSensor(gc, SDL_SENSOR_GYRO) == SDL_TRUE,
+        SDL_GameControllerGetNumTouchpads(gc), SDL_GameControllerHasLED(gc) == SDL_TRUE, SDL_GameControllerHasRumbleTriggers(gc) == SDL_TRUE);
+    enableSensors(slot);
+    PadSetPortConnected_nid_postfix(slot, true);
+    UserServiceSetUserConnected_nid_postfix(slot, true);
 }
 
-void PadInput::enableSensors() {
+void PadInput::enableSensors(int slot) {
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return;
+    SDL_GameController* controller = slots[slot].controller;
     if (controller == nullptr) return;
-    const SDL_bool wanted = outputState.motionEnabled ? SDL_TRUE : SDL_FALSE;
+    const SDL_bool wanted = slots[slot].outputState.motionEnabled ? SDL_TRUE : SDL_FALSE;
     if (SDL_GameControllerHasSensor(controller, SDL_SENSOR_ACCEL) == SDL_TRUE) SDL_GameControllerSetSensorEnabled(controller, SDL_SENSOR_ACCEL, wanted);
     if (SDL_GameControllerHasSensor(controller, SDL_SENSOR_GYRO) == SDL_TRUE) SDL_GameControllerSetSensorEnabled(controller, SDL_SENSOR_GYRO, wanted);
 }
 
-void PadInput::closeController() {
-    if (controller == nullptr) return;
-    SDL_GameControllerClose(controller);
-    controller = nullptr;
-    controllerState = {};
+void PadInput::closeController(int slot) {
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return;
+    if (slots[slot].controller == nullptr) return;
+    SDL_GameControllerClose(slots[slot].controller);
+    slots[slot].controller = nullptr;
+    slots[slot].instanceId = -1;
+    slots[slot].state = {};
+    slots[slot].outputState = {};
+    slots[slot].outputPending = false;
+    if (slot > 0) {
+        PadSetPortConnected_nid_postfix(slot, false);
+        UserServiceSetUserConnected_nid_postfix(slot, false);
+    }
 }
 
 void PadInput::applyOutput() {
-    PadOutputState fetched;
-    if (PadFetchOutput_nid_postfix(&outputSequence, &fetched)) {
-        const bool motionChanged = fetched.motionEnabled != outputState.motionEnabled;
-        outputState = fetched;
-        outputPending = true;
-        if (motionChanged) enableSensors();
-    }
-    if (controller == nullptr) return;
-    const auto now = std::chrono::steady_clock::now();
-    const bool isPs5 = SDL_GameControllerGetType(controller) == SDL_CONTROLLER_TYPE_PS5;
-    const auto large = std::max(outputState.vibrationLarge, outputState.audioVibrationLarge);
-    const auto small = std::max(outputState.vibrationSmall, outputState.audioVibrationSmall);
-    const bool rumbling = large != 0 || small != 0;
-    const bool triggerRumble = outputState.trigger[0].fallback != 0 || outputState.trigger[1].fallback != 0;
-    if (SDL_GameControllerHasLED(controller) == SDL_TRUE) {
-        const LightBarPacer::Color color = outputState.lightBarValid
-            ? LightBarPacer::Color{outputState.lightBar[0], outputState.lightBar[1], outputState.lightBar[2]}
-            : LightBarPacer::Color{0, 64, 255};
-        if (lightBar.Due(color, now)) lightBar.Result(color, now, SDL_GameControllerSetLED(controller, color[0], color[1], color[2]) == 0);
-    }
-    if (!outputPending) {
-        if ((rumbling || (triggerRumble && !isPs5)) && now >= nextRumbleRefresh) outputPending = true;
-        else return;
-    }
-    outputPending = false;
-    nextRumbleRefresh = now + std::chrono::milliseconds(700);
-    constexpr Uint32 rumbleMs = 2000;
-    SDL_GameControllerRumble(controller, static_cast<Uint16>(large * 257), static_cast<Uint16>(small * 257), rumbling ? rumbleMs : 0);
-    if (outputState.triggerTouched) {
-        if (isPs5) {
-            TriggerEffectCache::Effect effect{};
-            effect[0] = 0x04 | 0x08;
-            std::memcpy(effect.data() + 10, outputState.trigger[1].effect, 11);
-            std::memcpy(effect.data() + 21, outputState.trigger[0].effect, 11);
-            if (triggerEffect.NeedsSend(effect)) {
-                triggerEffect.Result(effect, SDL_GameControllerSendEffect(controller, effect.data(), static_cast<int>(effect.size())) == 0);
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        PadOutputState fetched;
+        if (PadFetchOutputForPort_nid_postfix(slot, &slots[slot].outputSequence, &fetched)) {
+            const bool motionChanged = fetched.motionEnabled != slots[slot].outputState.motionEnabled;
+            slots[slot].outputState = fetched;
+            slots[slot].outputPending = true;
+            if (motionChanged) enableSensors(slot);
+        }
+        SDL_GameController* controller = slots[slot].controller;
+        if (controller == nullptr) continue;
+        const auto now = std::chrono::steady_clock::now();
+        const bool isPs5 = SDL_GameControllerGetType(controller) == SDL_CONTROLLER_TYPE_PS5;
+        const auto large = std::max(slots[slot].outputState.vibrationLarge, slots[slot].outputState.audioVibrationLarge);
+        const auto small = std::max(slots[slot].outputState.vibrationSmall, slots[slot].outputState.audioVibrationSmall);
+        const bool rumbling = large != 0 || small != 0;
+        const bool triggerRumble = slots[slot].outputState.trigger[0].fallback != 0 || slots[slot].outputState.trigger[1].fallback != 0;
+        if (SDL_GameControllerHasLED(controller) == SDL_TRUE) {
+            struct PlayerLedColor { Uint8 r, g, b; };
+            static constexpr PlayerLedColor defaultColors[4] = {
+                {0, 64, 255},
+                {255, 0, 0},
+                {0, 255, 0},
+                {255, 0, 128}
+            };
+            const auto& def = defaultColors[slot % 4];
+            const LightBarPacer::Color color = slots[slot].outputState.lightBarValid
+                ? LightBarPacer::Color{slots[slot].outputState.lightBar[0], slots[slot].outputState.lightBar[1], slots[slot].outputState.lightBar[2]}
+                : LightBarPacer::Color{def.r, def.g, def.b};
+            if (slots[slot].lightBar.Due(color, now)) slots[slot].lightBar.Result(color, now, SDL_GameControllerSetLED(controller, color[0], color[1], color[2]) == 0);
+        }
+        if (!slots[slot].outputPending) {
+            if ((rumbling || (triggerRumble && !isPs5)) && now >= slots[slot].nextRumbleRefresh) slots[slot].outputPending = true;
+            else continue;
+        }
+        slots[slot].outputPending = false;
+        slots[slot].nextRumbleRefresh = now + std::chrono::milliseconds(700);
+        constexpr Uint32 rumbleMs = 2000;
+        SDL_GameControllerRumble(controller, static_cast<Uint16>(large * 257), static_cast<Uint16>(small * 257), rumbling ? rumbleMs : 0);
+        if (slots[slot].outputState.triggerTouched) {
+            if (isPs5) {
+                TriggerEffectCache::Effect effect{};
+                effect[0] = 0x04 | 0x08;
+                std::memcpy(effect.data() + 10, slots[slot].outputState.trigger[1].effect, 11);
+                std::memcpy(effect.data() + 21, slots[slot].outputState.trigger[0].effect, 11);
+                if (slots[slot].triggerEffect.NeedsSend(effect)) {
+                    slots[slot].triggerEffect.Result(effect, SDL_GameControllerSendEffect(controller, effect.data(), static_cast<int>(effect.size())) == 0);
+                }
+            } else if (SDL_GameControllerHasRumbleTriggers(controller) == SDL_TRUE) {
+                SDL_GameControllerRumbleTriggers(controller, static_cast<Uint16>(slots[slot].outputState.trigger[0].fallback * 257), static_cast<Uint16>(slots[slot].outputState.trigger[1].fallback * 257), triggerRumble ? rumbleMs : 0);
             }
-        } else if (SDL_GameControllerHasRumbleTriggers(controller) == SDL_TRUE) {
-            SDL_GameControllerRumbleTriggers(controller, static_cast<Uint16>(outputState.trigger[0].fallback * 257), static_cast<Uint16>(outputState.trigger[1].fallback * 257), triggerRumble ? rumbleMs : 0);
         }
     }
 }
@@ -129,10 +172,12 @@ void PadInput::setMouseMode(bool enabled) {
     keyboardMouse.SetMouseMode(enabled);
 }
 
-PadInputState PadInput::sampleController() const {
+PadInputState PadInput::sampleController(int slot) const {
     PadInputState result;
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return result;
+    SDL_GameController* controller = slots[slot].controller;
     if (controller == nullptr) return result;
-    const auto readButton = [this](SDL_GameControllerButton button) {
+    const auto readButton = [controller](SDL_GameControllerButton button) {
         return SDL_GameControllerGetButton(controller, button) != 0;
     };
     const auto addButton = [&result, &readButton](SDL_GameControllerButton source, Pad::PadButton button) {
@@ -156,7 +201,7 @@ PadInputState PadInput::sampleController() const {
     addButton(SDL_CONTROLLER_BUTTON_DPAD_LEFT, Pad::PadButton::Left);
     addButton(SDL_CONTROLLER_BUTTON_TOUCHPAD, Pad::PadButton::TouchPad);
 
-    const auto triggerValue = [this](SDL_GameControllerAxis axis) {
+    const auto triggerValue = [controller](SDL_GameControllerAxis axis) {
         const auto value = std::clamp<int>(SDL_GameControllerGetAxis(controller, axis), 0, 32767);
         return static_cast<std::uint8_t>((value * 255 + 16383) / 32767);
     };
@@ -165,7 +210,7 @@ PadInputState PadInput::sampleController() const {
     if (result.analogButtonsL2 != 0) result.buttons |= static_cast<std::uint32_t>(Pad::PadButton::L2);
     if (result.analogButtonsR2 != 0) result.buttons |= static_cast<std::uint32_t>(Pad::PadButton::R2);
 
-    const auto stick = [this](SDL_GameControllerAxis xAxis, SDL_GameControllerAxis yAxis, int deadzonePercent) {
+    const auto stick = [this, controller](SDL_GameControllerAxis xAxis, SDL_GameControllerAxis yAxis, int deadzonePercent) {
         return Pad::StickWithDeadzone(SDL_GameControllerGetAxis(controller, xAxis), SDL_GameControllerGetAxis(controller, yAxis), deadzonePercent);
     };
     const auto left = stick(SDL_CONTROLLER_AXIS_LEFTX, SDL_CONTROLLER_AXIS_LEFTY, keyboardMouse.Configuration().settings.leftStickDeadzonePercent);
@@ -207,23 +252,34 @@ void PadInput::HandleEvent(const SDL_Event& event, DisplayWindow& window) {
         openController(event.cdevice.which);
         return;
     }
-    if (event.type == SDL_CONTROLLERDEVICEREMOVED && controller != nullptr) {
-        const auto instanceId = SDL_JoystickInstanceID(SDL_GameControllerGetJoystick(controller));
-        if (instanceId == event.cdevice.which) {
-            closeController();
-            openFirstAvailableController();
-            publish(window.FrameNumber());
+    if (event.type == SDL_CONTROLLERDEVICEREMOVED) {
+        for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+            if (slots[slot].controller != nullptr && slots[slot].instanceId == event.cdevice.which) {
+                closeController(slot);
+                publish(window.FrameNumber(), slot);
+                break;
+            }
         }
         return;
     }
     if (event.type == SDL_CONTROLLERBUTTONDOWN || event.type == SDL_CONTROLLERBUTTONUP ||
         event.type == SDL_CONTROLLERAXISMOTION || event.type == SDL_CONTROLLERDEVICEREMAPPED) {
-        publish(window.FrameNumber());
+        SDL_JoystickID which = -1;
+        if (event.type == SDL_CONTROLLERBUTTONDOWN || event.type == SDL_CONTROLLERBUTTONUP) which = event.cbutton.which;
+        else if (event.type == SDL_CONTROLLERAXISMOTION) which = event.caxis.which;
+        else if (event.type == SDL_CONTROLLERDEVICEREMAPPED) which = event.cdevice.which;
+        for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+            if (slots[slot].controller != nullptr && slots[slot].instanceId == which) {
+                slots[slot].state = sampleController(slot);
+                publish(window.FrameNumber(), slot);
+                return;
+            }
+        }
         return;
     }
     if (event.type == SDL_WINDOWEVENT) {
         if (keyboardMouse.HandleEvent(event, std::chrono::steady_clock::now()).releaseMouse) setMouseMode(false);
-        publish(window.FrameNumber());
+        publish(window.FrameNumber(), 0);
         return;
     }
     // APS5_NO_PAD_INPUT=1 keeps a measurement run from reacting to keys or mouse buttons that reach
@@ -239,25 +295,54 @@ void PadInput::HandleEvent(const SDL_Event& event, DisplayWindow& window) {
     if (requests.togglePerformanceOverlay && window.Handle() != nullptr && event.key.windowID == SDL_GetWindowID(window.Handle())) AgcDriverTogglePerformanceOverlay_nid_postfix();
     if (requests.screenshot && window.Handle() != nullptr && event.key.windowID == SDL_GetWindowID(window.Handle())) AgcDriverRequestScreenshot_nid_postfix();
     if (requests.toggleMouse) setMouseMode(!keyboardMouse.MouseMode());
-    if (event.type != SDL_MOUSEMOTION) publish(window.FrameNumber());
+    if (event.type != SDL_MOUSEMOTION) publish(window.FrameNumber(), 0);
 }
 
 void PadInput::Update(const DisplayWindow& window) {
-    if (controller != nullptr) SDL_GameControllerUpdate();
+    bool anyController = false;
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        if (slots[slot].controller != nullptr) {
+            anyController = true;
+            break;
+        }
+    }
+    if (anyController) SDL_GameControllerUpdate();
     applyOutput();
-    if (controller != nullptr) controllerState = sampleController();
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        if (slots[slot].controller != nullptr) {
+            slots[slot].state = sampleController(slot);
+        }
+    }
     if (keyboardMouse.MouseMode() && SDL_GetKeyboardFocus() == nullptr) {
         keyboardMouse.Release();
         setMouseMode(false);
-        publish(window.FrameNumber());
+        publish(window.FrameNumber(), 0);
         return;
     }
     const bool changed = keyboardMouse.Advance(std::chrono::steady_clock::now());
-    if (controller != nullptr || keyboardMouse.MouseMode() || changed) publish(window.FrameNumber());
+    if (slots[0].controller != nullptr || keyboardMouse.MouseMode() || changed) {
+        publish(window.FrameNumber(), 0);
+    }
+    for (int slot = 1; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        if (slots[slot].controller != nullptr) {
+            publish(window.FrameNumber(), slot);
+        }
+    }
 }
 
 void PadInput::publish(std::uint64_t frame) {
-    const auto state = keyboardMouse.Compose(controllerState);
-    PadPublishInput_nid_postfix(state);
-    if (auto* telemetry = VideoOutTelemetry::Instance(); telemetry != nullptr) VideoOutTelemetry::EmitPadIfChanged(*telemetry, telemetryFilter, frame, state);
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        publish(frame, slot);
+    }
+}
+
+void PadInput::publish(std::uint64_t frame, int slot) {
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return;
+    if (slot == 0) {
+        const auto state = keyboardMouse.Compose(slots[0].state);
+        PadPublishInput_nid_postfix(state);
+        if (auto* telemetry = VideoOutTelemetry::Instance(); telemetry != nullptr) VideoOutTelemetry::EmitPadIfChanged(*telemetry, telemetryFilter, frame, state);
+    } else {
+        PadPublishInputForPort_nid_postfix(slot, slots[slot].state);
+    }
 }
diff --git a/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp b/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp
index f308f42739..377fb3548b 100644
--- a/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp
+++ b/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp
@@ -1,4 +1,5 @@
 #include <bit>
+#include <charconv>
 #include <chrono>
 #include <cstdlib>
 #include <cstring>
@@ -6,6 +7,7 @@
 #include <exception>
 #include <thread>
 #include <limits>
+#include <optional>
 #include <stdexcept>
 #include <string>
 
@@ -41,6 +43,26 @@ void require(bool condition, const char* reason) {
     if (!condition) throw std::runtime_error(std::string("VideoOut: ") + reason);
 }
 
+std::uint32_t resolutionIndex(std::uint32_t width, std::uint32_t height) {
+    return (width >= 3840 || height >= 2160) ? VIDEO_OUT_RESOLUTION_2160P : VIDEO_OUT_RESOLUTION_1080P;
+}
+
+std::optional<std::uint32_t> configuredResolution() {
+    const char* value = std::getenv("APS5_OUTPUT_RESOLUTION");
+    if (value == nullptr || *value == '\0') return std::nullopt;
+    const std::string text(value);
+    const char* end = text.data() + text.size();
+    std::uint32_t width = 0;
+    std::uint32_t height = 0;
+    const auto widthResult = std::from_chars(text.data(), end, width);
+    const bool separated = widthResult.ec == std::errc{} && widthResult.ptr != end && (*widthResult.ptr == 'x' || *widthResult.ptr == 'X');
+    const auto heightResult = separated ? std::from_chars(widthResult.ptr + 1, end, height) : std::from_chars_result{end, std::errc::invalid_argument};
+    if (!separated || heightResult.ec != std::errc{} || heightResult.ptr != end || width == 0 || height == 0) {
+        throw std::runtime_error("VideoOut: APS5_OUTPUT_RESOLUTION must be <width>x<height> with positive integers, got \"" + text + "\"");
+    }
+    return resolutionIndex(width, height);
+}
+
 std::vector<const char*> windowExtensions(SDL_Window* window) {
     unsigned extensionCount = 0;
     if (!SDL_Vulkan_GetInstanceExtensions(window, &extensionCount, nullptr)) throw std::runtime_error(std::string("SDL_Vulkan_GetInstanceExtensions failed: ") + SDL_GetError());
@@ -489,12 +511,18 @@ int VideoOutDriver::GetDisplayRefreshRate() {
     return displayRefreshRate.load();
 }
 
+std::uint32_t VideoOutDriver::GetDisplayResolution() {
+    if (const auto configured = configuredResolution()) return *configured;
+    return displayResolution.load();
+}
+
 void VideoOutDriver::updateDisplayRefreshRate() {
     const int display = SDL_GetWindowDisplayIndex(window.Handle());
     if (display < 0) throw std::runtime_error(std::string("SDL_GetWindowDisplayIndex failed: ") + SDL_GetError());
     SDL_DisplayMode mode{};
     if (SDL_GetCurrentDisplayMode(display, &mode) != 0) throw std::runtime_error(std::string("SDL_GetCurrentDisplayMode failed: ") + SDL_GetError());
     displayRefreshRate.store(mode.refresh_rate);
+    displayResolution.store(resolutionIndex(mode.w, mode.h));
 }
 
 void VideoOutDriver::pollHostHdr() {
diff --git a/core/libs/prx/libSceVideoOut/tests/Flip.cpp b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
index 365eddf412..e7ce91e7b8 100644
--- a/core/libs/prx/libSceVideoOut/tests/Flip.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
@@ -1,6 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceVideoOut/include/VideoOutDriver.hpp"
 #include "prx/libSceVideoOut/include/Buffer.hpp"
 #include "prx/libSceVideoOut/include/Output.hpp"
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include "prx/libSceVideoOut/include/Event.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -25,11 +27,6 @@
 
 #undef main
 
-extern "C" int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-extern "C" int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-extern "C" int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-extern "C" int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-
 namespace {
 
 void check(bool condition, const char* reason) {
@@ -449,6 +446,22 @@ void testControls() {
     }
     VideoOutColorSettings settings{};
     expectFailure([&] { sceVideoOutColorSettingsSetGamma(&settings, std::numeric_limits<float>::quiet_NaN()); });
+    expectFailure([&] { sceVideoOutColorSettingsSetGamma_(&settings, 1.0f, sizeof(VideoOutColorSettings) - 1); });
+    check(sceVideoOutColorSettingsSetGamma_(&settings, 1.2f, sizeof(VideoOutColorSettings)) == 0, "gamma wrapper rejected valid size");
+    check(settings.gamma == 1.2f, "gamma wrapper failed to forward value");
+
+    expectFailure([&] { sceVideoOutAdjustColor_(handle, &settings, sizeof(VideoOutColorSettings) - 1); });
+    check(sceVideoOutAdjustColor_(handle, &settings, sizeof(VideoOutColorSettings)) == 0, "adjust color wrapper rejected valid size");
+
+    VideoOutColorSpaceConversionSettings cscSettings{};
+    expectFailure([&] { sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(&cscSettings, sizeof(VideoOutColorSpaceConversionSettings) - 1); });
+    check(sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(&cscSettings, sizeof(VideoOutColorSpaceConversionSettings)) == 0, "default SDR to HDR wrapper rejected valid size");
+
+    expectFailure([&] { sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(&cscSettings, 1.0f, 0, sizeof(VideoOutColorSpaceConversionSettings) - 1); });
+    check(sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(&cscSettings, 1.0f, 0, sizeof(VideoOutColorSpaceConversionSettings)) == 0, "SDR to HDR conversion wrapper rejected valid size");
+
+    expectFailure([&] { sceVideoOutAdjustColorSpaceConversion_(handle, &cscSettings, sizeof(VideoOutColorSpaceConversionSettings) - 1); });
+    check(sceVideoOutAdjustColorSpaceConversion_(handle, &cscSettings, sizeof(VideoOutColorSpaceConversionSettings)) == 0, "adjust color space conversion wrapper rejected valid size");
     KernelEqueue queue = 0;
     check(sceKernelCreateEqueue(&queue, "VideoOut test") == 0, "event queue creation failed");
     auto owner = EqueuePin_nid_postfix(queue);
@@ -1022,6 +1035,81 @@ void testOneDevice() {
     check(next.Serial() == 2, "the GPU work and the flip used more than one device");
 }
 
+void testOutputResolution() {
+    const int handle = sceVideoOutOpen(255, 0, 0, nullptr);
+    auto cfg = VideoOutDriver::Get().GetConfig(handle);
+    SDL_DisplayMode mode{};
+    check(SDL_GetCurrentDisplayMode(0, &mode) == 0, "the display mode could not be read");
+    const std::uint32_t expected = (mode.w >= 3840 || mode.h >= 2160) ? 2u : 1u;
+    VideoOutOutputStatus status{};
+    check(sceVideoOutGetOutputStatus(handle, &status) == 0 && status.resolution == expected, "a port without buffers did not report the display's resolution");
+    const std::uint32_t width = expected == 2u ? 1920u : 3840u;
+    const std::uint32_t height = expected == 2u ? 1080u : 2160u;
+    std::vector<std::byte> allocation(static_cast<std::size_t>(width) * height * 4 + 65535);
+    const auto storage = alignedBuffer(allocation);
+    VideoOutBuffers buffer{storage.data(), nullptr, {nullptr, nullptr}};
+    VideoOutBufferAttribute2 attribute{};
+    attribute.width = width;
+    attribute.height = height;
+    attribute.tiling_mode = 1;
+    attribute.pitch_in_pixel = width;
+    attribute.pixel_format = 0x8000000000000000ull;
+    sceVideoOutRegisterBuffers2(handle, 0, 0, &buffer, 1, &attribute, 0, nullptr);
+    check(sceVideoOutSubmitFlip(handle, 0, 1, 1) == 0, "the flip was not accepted");
+    {
+        std::unique_lock lock(cfg->mutex);
+        const bool done = cfg->vblankCond.wait_for(lock, std::chrono::seconds(15), [&] { return cfg->failure || cfg->flipStatus.count == 1; });
+        if (cfg->failure) std::rethrow_exception(cfg->failure);
+        check(done, "the flip did not complete");
+        check(cfg->width == width && cfg->height == height, "the port did not record the buffer size");
+    }
+    check(sceVideoOutGetOutputStatus(handle, &status) == 0 && status.resolution == expected, "the flipped buffer's size changed the reported resolution");
+    sceVideoOutUnregisterBuffers(handle, 0);
+    sceVideoOutClose(handle);
+    LibcRunShutdown_nid_postfix();
+}
+
+void setOutputResolution(const char* value) {
+#ifdef _WIN32
+    check(_putenv_s("APS5_OUTPUT_RESOLUTION", value) == 0, "APS5_OUTPUT_RESOLUTION was not set");
+#else
+    check((*value != '\0' ? setenv("APS5_OUTPUT_RESOLUTION", value, 1) : unsetenv("APS5_OUTPUT_RESOLUTION")) == 0, "APS5_OUTPUT_RESOLUTION was not set");
+#endif
+}
+
+void testOutputResolutionOverride() {
+    const int handle = sceVideoOutOpen(255, 0, 0, nullptr);
+    SDL_DisplayMode mode{};
+    check(SDL_GetCurrentDisplayMode(0, &mode) == 0, "the display mode could not be read");
+    const std::uint32_t following = (mode.w >= 3840 || mode.h >= 2160) ? 2u : 1u;
+    const auto reported = [&] {
+        VideoOutOutputStatus status{};
+        check(sceVideoOutGetOutputStatus(handle, &status) == 0, "the output status was not returned");
+        return status.resolution;
+    };
+    setOutputResolution("");
+    check(reported() == following, "an unset override changed the display's resolution");
+    const std::pair<const char*, std::uint32_t> overrides[] = {{"1920x1080", 1u}, {"1280x720", 1u}, {"3840x2160", 2u}, {"2560x2160", 2u}, {"3840X1", 2u}};
+    for (const auto& [value, expected] : overrides) {
+        setOutputResolution(value);
+        check(reported() == expected, (std::string("the override ") + value + " did not set the reported resolution").c_str());
+        std::array<std::byte, 80> raw{};
+        VideoOutOutputStatus withVrr{};
+        check(sceVideoOutGetOutputStatusWithVrr(handle, raw.data()) == 0, "the VRR status was not returned");
+        std::memcpy(&withVrr, raw.data(), sizeof(withVrr));
+        check(withVrr.resolution == expected,(std::string("the override ") + value + " did not reach the VRR status").c_str());
+    }
+    for (const char* value : {"1920", "1920x", "x1080", "0x1080", "1920x0", "1920x1080x2", " 1920x1080", "1920x1080 ", "-1920x1080", "1920*1080", "4294967296x1080", "high"}) {
+        setOutputResolution(value);
+        const auto message = expectFailure([&] { reported(); });
+        check(message.find("APS5_OUTPUT_RESOLUTION") != std::string::npos && message.find(value) != std::string::npos, (std::string("the malformed value ") + value + " was not rejected by name").c_str());
+    }
+    setOutputResolution("");
+    check(reported() == following, "clearing the override did not restore the display's resolution");
+    sceVideoOutClose(handle);
+    LibcRunShutdown_nid_postfix();
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -1047,6 +1135,8 @@ int main(int argc, char** argv) {
         else if (argc == 2 && std::string(argv[1]) == "unregistered") testUnregisteredBuffer();
         else if (argc == 2 && std::string(argv[1]) == "ps4") testPs4Buffers();
         else if (argc == 2 && std::string(argv[1]) == "cpuflip") testCpuFlipOrder();
+        else if (argc == 2 && std::string(argv[1]) == "resolution") testOutputResolution();
+        else if (argc == 2 && std::string(argv[1]) == "resolution_override") testOutputResolutionOverride();
         else testLifetime(argc == 2 && std::string(argv[1]) == "reopen");
         std::puts("VideoOut flip tests passed");
         return 0;
diff --git a/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp b/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp
index 759c9708e7..12c9119998 100644
--- a/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMouse/include/Api.hpp"
 #include "prx/libSceVideoOut/include/MouseInput.hpp"
 #include "prx/libSceMouse/include/mouse_structs.h"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -9,13 +10,6 @@
 #include <cstdlib>
 #undef main
 
-extern "C" {
-int APS5_VABI sceMouseInit();
-int APS5_VABI sceMouseOpen(int userId, std::int32_t type, std::int32_t index, const void* param);
-int APS5_VABI sceMouseRead(std::int32_t handle, MouseData* data, std::int32_t num);
-int APS5_VABI sceMouseClose(std::int32_t handle);
-}
-
 namespace {
 
 void Require(bool condition, const char* reason) {
diff --git a/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp b/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp
index 5a4a600944..59fafc5235 100644
--- a/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceVideoOut/include/Output.hpp"
 #include <cstdio>
 #include <cstdlib>
+#include <initializer_list>
 #include <stdexcept>
 
 static void Require(bool value, const char* reason) {
diff --git a/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp b/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp
index cec6638fbd..3bdec619d1 100644
--- a/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp
@@ -1,13 +1,99 @@
 #include "SDL_config.h"
-
+#include "SDL.h"
+#include "SDL_joystick.h"
+#include "SDL_gamecontroller.h"
+#include "prx/libSceVideoOut/include/PadInput.hpp"
+#include "prx/libSceVideoOut/include/DisplayWindow.hpp"
+#include "prx/libScePad/include/PadState.hpp"
 #include <cstdio>
+#include <cstdlib>
+#undef main
+
+namespace {
+
+static void Require(bool condition) {
+    if (!condition) {
+        std::abort();
+    }
+}
+
+}
 
 int main() {
 #ifdef SDL_JOYSTICK_HIDAPI
     std::puts("pad_sdl: SDL drives controllers through HIDAPI");
-    return 0;
 #else
     std::fputs("pad_sdl: SDL is built without HIDAPI, so a DualSense gets no light bar, touchpad or trigger effects\n", stderr);
     return 1;
 #endif
+
+    Require(SDL_Init(SDL_INIT_GAMECONTROLLER | SDL_INIT_JOYSTICK) == 0);
+
+    SDL_VirtualJoystickDesc desc{};
+    desc.version = SDL_VIRTUAL_JOYSTICK_DESC_VERSION;
+    desc.type = SDL_JOYSTICK_TYPE_GAMECONTROLLER;
+    desc.naxes = 6;
+    desc.nbuttons = 16;
+    desc.name = "Virtual Controller 0";
+    const int dev0 = SDL_JoystickAttachVirtualEx(&desc);
+    Require(dev0 >= 0);
+    Require(SDL_IsGameController(dev0));
+
+    DisplayWindow window;
+    PadInput padInput;
+    Require(padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+
+    SDL_Event add0{};
+    add0.type = SDL_CONTROLLERDEVICEADDED;
+    add0.cdevice.which = dev0;
+    padInput.HandleEvent(add0, window);
+    Require(padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+
+    desc.name = "Virtual Controller 1";
+    const int dev1 = SDL_JoystickAttachVirtualEx(&desc);
+    Require(dev1 >= 0);
+    Require(SDL_IsGameController(dev1));
+
+    SDL_Event add1{};
+    add1.type = SDL_CONTROLLERDEVICEADDED;
+    add1.cdevice.which = dev1;
+    padInput.HandleEvent(add1, window);
+    Require(padInput.SlotOccupied(0));
+    Require(padInput.SlotOccupied(1));
+    Require(!padInput.SlotOccupied(2));
+    Require(Pad::IsConnected(1));
+
+    const SDL_JoystickID id0 = SDL_JoystickGetDeviceInstanceID(dev0);
+    SDL_Event rem0{};
+    rem0.type = SDL_CONTROLLERDEVICEREMOVED;
+    rem0.cdevice.which = id0;
+    padInput.HandleEvent(rem0, window);
+    Require(!padInput.SlotOccupied(0));
+    Require(padInput.SlotOccupied(1));
+    Require(Pad::IsConnected(1));
+
+    padInput.HandleEvent(add0, window);
+    Require(padInput.SlotOccupied(0));
+    Require(padInput.SlotOccupied(1));
+
+    const SDL_JoystickID id1 = SDL_JoystickGetDeviceInstanceID(dev1);
+    SDL_Event rem1{};
+    rem1.type = SDL_CONTROLLERDEVICEREMOVED;
+    rem1.cdevice.which = id1;
+    padInput.HandleEvent(rem1, window);
+    Require(padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+    Require(!Pad::IsConnected(1));
+
+    padInput.HandleEvent(rem0, window);
+    Require(!padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+
+    Require(SDL_JoystickDetachVirtual(dev1) == 0);
+    Require(SDL_JoystickDetachVirtual(dev0) == 0);
+    SDL_QuitSubSystem(SDL_INIT_GAMECONTROLLER | SDL_INIT_JOYSTICK);
+
+    return 0;
 }
diff --git a/core/libs/prx/libSceVideoOut/tests/Telemetry.cpp b/core/libs/prx/libSceVideoOut/tests/Telemetry.cpp
index d3fc3ce183..ba808eb7ba 100644
--- a/core/libs/prx/libSceVideoOut/tests/Telemetry.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/Telemetry.cpp
@@ -3,7 +3,12 @@
 
 #include <chrono>
 #include <cstdio>
+#ifdef _WIN32
+#include <process.h>
+#define getpid _getpid
+#else
 #include <unistd.h>
+#endif
 #include <filesystem>
 #include <fstream>
 #include <iostream>
@@ -109,7 +114,7 @@ void queueOverflowIsCounted() {
 void contractPadAndPresentLines() {
     const auto directory = freshDirectory("contract");
     {
-        auto writer = VideoOutTelemetry::OpenFromEnvironment(directory.c_str(), "abc123");
+        auto writer = VideoOutTelemetry::OpenFromEnvironment(directory.string().c_str(), "abc123");
         check(writer != nullptr, "variable must open a writer");
         PadInputState state;
         state.buttons = 0x4000;
diff --git a/core/libs/prx/libSceVideoOutSecondary/libSceVideoOutSecondary.hpp b/core/libs/prx/libSceVideoOutSecondary/libSceVideoOutSecondary.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoOutSecondary/libSceVideoOutSecondary.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideoRecording.native/libSceVideoRecording.native.hpp b/core/libs/prx/libSceVideoRecording.native/libSceVideoRecording.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecording.native/libSceVideoRecording.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideoRecording/libSceVideoRecording.hpp b/core/libs/prx/libSceVideoRecording/libSceVideoRecording.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecording/libSceVideoRecording.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideoRecordingP/Export.cpp b/core/libs/prx/libSceVideoRecordingP/Export.cpp
index c3b67583f6..6166139756 100644
--- a/core/libs/prx/libSceVideoRecordingP/Export.cpp
+++ b/core/libs/prx/libSceVideoRecordingP/Export.cpp
@@ -1,51 +1,15 @@
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct VideoRecordingContext;
-
-struct VideoRecordingQueryParam {
-    std::uint64_t size;
-    std::uint32_t reserved8;
-    std::int32_t mode;
-    std::uint8_t reserved16[12];
-    std::uint32_t option;
-    std::uint8_t reserved32[32];
-};
-
 static_assert(sizeof(VideoRecordingQueryParam) == 64);
 static_assert(offsetof(VideoRecordingQueryParam, mode) == 12);
 static_assert(offsetof(VideoRecordingQueryParam, option) == 28);
 
-
-struct VideoRecordingSupportInfo {
-    std::uint8_t data[18];
-};
-
 static_assert(sizeof(VideoRecordingSupportInfo) == 18);
 
-struct VideoRecordingParam {
-    std::uint64_t size;
-    std::int32_t threadPriority;
-    std::uint32_t duration;
-    std::uint32_t mode;
-    std::int32_t outputMode;
-    std::uint32_t option;
-    std::uint32_t format;
-};
-
-struct VideoRecordingParam2 {
-    std::uint64_t size;
-    std::uint64_t affinityMask;
-    std::int32_t threadPriority;
-    std::uint32_t duration;
-    std::uint32_t mode;
-    std::int32_t outputMode;
-    std::uint32_t option;
-    std::uint32_t format;
-};
-
 static_assert(sizeof(VideoRecordingParam) == 32);
 static_assert(offsetof(VideoRecordingParam, duration) == 12);
 static_assert(offsetof(VideoRecordingParam, format) == 28);
diff --git a/core/libs/prx/libSceVideoRecordingP/include/Api.hpp b/core/libs/prx/libSceVideoRecordingP/include/Api.hpp
new file mode 100644
index 0000000000..2f831a0c7e
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecordingP/include/Api.hpp
@@ -0,0 +1,68 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct VideoRecordingContext;
+
+struct VideoRecordingParam {
+    std::uint64_t size;
+    std::int32_t threadPriority;
+    std::uint32_t duration;
+    std::uint32_t mode;
+    std::int32_t outputMode;
+    std::uint32_t option;
+    std::uint32_t format;
+};
+
+struct VideoRecordingParam2 {
+    std::uint64_t size;
+    std::uint64_t affinityMask;
+    std::int32_t threadPriority;
+    std::uint32_t duration;
+    std::uint32_t mode;
+    std::int32_t outputMode;
+    std::uint32_t option;
+    std::uint32_t format;
+};
+
+struct VideoRecordingQueryParam {
+    std::uint64_t size;
+    std::uint32_t reserved8;
+    std::int32_t mode;
+    std::uint8_t reserved16[12];
+    std::uint32_t option;
+    std::uint8_t reserved32[32];
+};
+
+struct VideoRecordingSupportInfo {
+    std::uint8_t data[18];
+};
+
+extern "C" {
+
+void APS5_VABI _sceVideoRecordingQueryParam_nid_postfix(VideoRecordingQueryParam* param);
+int APS5_VABI sceVideoRecordingClose(int discard);
+int APS5_VABI sceVideoRecordingCloseByHandle(VideoRecordingContext* handle, int discard);
+int APS5_VABI sceVideoRecordingCopyBGRAtoNV12(void* dst, const void* src, uint32_t width, uint32_t height);
+int APS5_VABI sceVideoRecordingGetInfo(std::int32_t info, void*, std::size_t);
+int APS5_VABI sceVideoRecordingGetInfoByHandle(VideoRecordingContext* handle, int32_t info, void* data, size_t size);
+int APS5_VABI sceVideoRecordingGetStatus(void);
+int APS5_VABI sceVideoRecordingGetSupportInfo(VideoRecordingSupportInfo* info);
+int APS5_VABI sceVideoRecordingGetVideoOutMode(std::uint32_t* mode);
+int APS5_VABI sceVideoRecordingInit(void);
+int APS5_VABI sceVideoRecordingInitialize(void* param);
+int APS5_VABI sceVideoRecordingOpen(const char* path, const VideoRecordingParam* param, void* heap, int heapSize);
+int APS5_VABI sceVideoRecordingOpen2(const char* path, const VideoRecordingParam2* param, void* heap, int heapSize);
+std::int64_t APS5_VABI sceVideoRecordingQueryHddSize2(const VideoRecordingParam2* param);
+int APS5_VABI sceVideoRecordingQueryMemSize(const VideoRecordingParam* param);
+int APS5_VABI sceVideoRecordingQueryMemSize2(const VideoRecordingParam2* param);
+int APS5_VABI sceVideoRecordingRestModeProcessGetStatus(void* status);
+int APS5_VABI sceVideoRecordingRestModeProcessStart(void* param);
+int APS5_VABI sceVideoRecordingSendCommand(int cmd, const void* param);
+int APS5_VABI sceVideoRecordingSetInfo(std::int32_t info, const void* data, std::size_t size);
+int APS5_VABI sceVideoRecordingStart(void);
+int APS5_VABI sceVideoRecordingStop(void);
+int APS5_VABI sceVideoRecordingTerm(void);
+int APS5_VABI videoRecordingUnknown_iQS6DUtLybE(void);
+
+}
diff --git a/core/libs/prx/libSceVideoRecordingP/libSceVideoRecordingP.hpp b/core/libs/prx/libSceVideoRecordingP/libSceVideoRecordingP.hpp
new file mode 100644
index 0000000000..33ebd6f0fc
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecordingP/libSceVideoRecordingP.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoStreamingEngine/Export.cpp b/core/libs/prx/libSceVideoStreamingEngine/Export.cpp
index 1a09e3b9df..f773806a45 100644
--- a/core/libs/prx/libSceVideoStreamingEngine/Export.cpp
+++ b/core/libs/prx/libSceVideoStreamingEngine/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoStreamingEngine/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoStreamingEngine/include/Api.hpp b/core/libs/prx/libSceVideoStreamingEngine/include/Api.hpp
new file mode 100644
index 0000000000..2b807d7c25
--- /dev/null
+++ b/core/libs/prx/libSceVideoStreamingEngine/include/Api.hpp
@@ -0,0 +1,20 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoStreamingEngineDestroyMediaKeySystemAccess();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGenerateRequest();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGetExpiration();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGetKeyStatuses();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGetSessionId();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionLoad();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionSetEventHandler();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessCreateMediaKeys();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessDestroyMediaKeys();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessGetKeySystem();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessSetCdmStorageConfig();
+int APS5_VABI sceVideoStreamingEngineMediaKeysCreateSession();
+
+}
diff --git a/core/libs/prx/libSceVideoStreamingEngine/libSceVideoStreamingEngine.hpp b/core/libs/prx/libSceVideoStreamingEngine/libSceVideoStreamingEngine.hpp
new file mode 100644
index 0000000000..f0f435d15e
--- /dev/null
+++ b/core/libs/prx/libSceVideoStreamingEngine/libSceVideoStreamingEngine.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoStreamingEngine/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoStreamingEngine_sys/libSceVideoStreamingEngine_sys.hpp b/core/libs/prx/libSceVideoStreamingEngine_sys/libSceVideoStreamingEngine_sys.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoStreamingEngine_sys/libSceVideoStreamingEngine_sys.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideodec/Export.cpp b/core/libs/prx/libSceVideodec/Export.cpp
index 56ae352fcf..efb762dbfe 100644
--- a/core/libs/prx/libSceVideodec/Export.cpp
+++ b/core/libs/prx/libSceVideodec/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#include "prx/libSceVideodec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -10,6 +12,8 @@
 
 namespace {
 
+using namespace SceVideodec;
+
 constexpr int VideodecErrorApiFail = static_cast<int>(0x80C10000);
 constexpr int VideodecErrorStructSize = static_cast<int>(0x80C10002);
 constexpr int VideodecErrorHandle = static_cast<int>(0x80C10003);
@@ -24,142 +28,6 @@ constexpr int VideodecErrorDecodeAu = static_cast<int>(0x80C10011);
 constexpr std::uint32_t CodecAvc = 1;
 constexpr std::uint32_t PitchAlignment = 64;
 
-struct ConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint64_t videodecFlags;
-};
-
-struct ResourceInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct Ctrl {
-    std::uint64_t thisSize;
-    void* handle;
-    std::uint64_t version;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct AvcInfo {
-    std::uint32_t numUnitsInTick;
-    std::uint32_t timeScale;
-    std::uint8_t fixedFrameRateFlag;
-    std::uint8_t aspectRatioIdc;
-    std::uint16_t sarWidth;
-    std::uint16_t sarHeight;
-    std::uint8_t colourPrimaries;
-    std::uint8_t transferCharacteristics;
-    std::uint8_t matrixCoefficients;
-    std::uint8_t videoFullRangeFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-};
-
-union CodecInfo {
-    std::uint8_t reserved[64];
-    AvcInfo avc;
-};
-
-struct PictureInfo {
-    std::uint64_t thisSize;
-    std::uint32_t isValid;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    std::uint32_t isErrorPic;
-    std::uint64_t ptsData;
-    std::uint64_t attachedData;
-    CodecInfo codec;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct Decoder2ConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-};
-
-struct Decoder2MemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct Decoder2FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct Decoder2OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct Decoder2AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-};
-
 struct Decoder2Crop {
     std::uint32_t left;
     std::uint32_t right;
@@ -171,8 +39,8 @@ static_assert(sizeof(ConfigInfo) == 40 && sizeof(ResourceInfo) == 56 && sizeof(C
 static_assert(offsetof(ConfigInfo, maxFrameWidth) == 20 && offsetof(ConfigInfo, videodecFlags) == 32);
 static_assert(offsetof(ResourceInfo, cpuGpuMemorySize) == 24 && offsetof(ResourceInfo, maxFrameBufferSize) == 40);
 static_assert(offsetof(ResourceInfo, frameBufferAlignment) == 48);
-static_assert(sizeof(Decoder2ConfigInfo) == 40 && sizeof(Decoder2MemoryInfo) == 72);
-static_assert(sizeof(FrameBuffer) == 24 && sizeof(InputData) == 48 && sizeof(PictureInfo) == 112);
+static_assert(sizeof(SceVideodec2::DecoderConfigInfo) == 40 && sizeof(SceVideodec2::DecoderMemoryInfo) == 72);
+static_assert(sizeof(FrameBuffer) == 24 && sizeof(SceVideodec2::InputData) == 48 && sizeof(PictureInfo) == 112);
 static_assert(sizeof(CodecInfo) == 64 && offsetof(PictureInfo, codec) == 48);
 
 struct Decoder {
@@ -197,13 +65,7 @@ std::uint32_t AlignUp(std::uint32_t value, std::uint32_t alignment) {
 }
 
 extern "C" {
-int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const Decoder2ConfigInfo*, Decoder2MemoryInfo*);
-int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const Decoder2ConfigInfo*, const Decoder2MemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t, const InputData*, Decoder2FrameBuffer*, Decoder2OutputInfo*);
-int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t, Decoder2FrameBuffer*, Decoder2OutputInfo*);
-int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2GetAvcPictureInfo_nid_postfix(const Decoder2OutputInfo*, Decoder2AvcPictureInfo*, Decoder2AvcPictureInfo*);
+
 void Videodec2PictureCrop_nid_no_patch(std::uint64_t, const void*, Decoder2Crop*);
 }
 
@@ -216,9 +78,9 @@ struct Geometry {
     Decoder2Crop crop{};
 };
 
-Decoder2ConfigInfo MapConfig(const ConfigInfo& config) {
-    Decoder2ConfigInfo decoderConfig{};
-    decoderConfig.thisSize = sizeof(Decoder2ConfigInfo);
+SceVideodec2::DecoderConfigInfo MapConfig(const ConfigInfo& config) {
+    SceVideodec2::DecoderConfigInfo decoderConfig{};
+    decoderConfig.thisSize = sizeof(SceVideodec2::DecoderConfigInfo);
     decoderConfig.resourceType = 1;
     decoderConfig.codecType = CodecAvc;
     decoderConfig.profile = config.profile;
@@ -230,7 +92,7 @@ Decoder2ConfigInfo MapConfig(const ConfigInfo& config) {
     return decoderConfig;
 }
 
-Geometry Measure(const Decoder2OutputInfo& output, const Decoder2Crop& crop) {
+Geometry Measure(const SceVideodec2::OutputInfo& output, const Decoder2Crop& crop) {
     Geometry geometry;
     geometry.width = output.frameWidth;
     geometry.height = output.frameHeight;
@@ -239,7 +101,7 @@ Geometry Measure(const Decoder2OutputInfo& output, const Decoder2Crop& crop) {
     return geometry;
 }
 
-void FillPictureInfo(const Geometry& geometry, const Decoder2OutputInfo& output, PictureInfo* picture) {
+void FillPictureInfo(const Geometry& geometry, const SceVideodec2::OutputInfo& output, PictureInfo* picture) {
     picture->isValid = 0;
     picture->codecType = 0;
     picture->frameWidth = 0;
@@ -261,7 +123,7 @@ void FillPictureInfo(const Geometry& geometry, const Decoder2OutputInfo& output,
     picture->codec.avc.frameCropBottomOffset = geometry.crop.bottom / 2;
 }
 
-int CopyPicture(const Decoder2OutputInfo& output, const Geometry& geometry, const FrameBuffer* frameBuffer) {
+int CopyPicture(const SceVideodec2::OutputInfo& output, const Geometry& geometry, const FrameBuffer* frameBuffer) {
     const auto bytes = static_cast<std::uint64_t>(geometry.pitch) * geometry.height * 3 / 2;
     if (frameBuffer->frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
     if (frameBuffer->frameBufferSize < bytes) return VideodecErrorFrameBufferSize;
@@ -285,8 +147,8 @@ int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo* config, const ResourceI
     if (config == nullptr || resource == nullptr || ctrl == nullptr) return VideodecErrorArgumentPointer;
     if (config->thisSize < sizeof(ConfigInfo) || resource->thisSize < sizeof(ResourceInfo)) return VideodecErrorStructSize;
     const auto decoderConfig = MapConfig(*config);
-    Decoder2MemoryInfo decoderMemory{};
-    decoderMemory.thisSize = sizeof(Decoder2MemoryInfo);
+    SceVideodec2::DecoderMemoryInfo decoderMemory{};
+    decoderMemory.thisSize = sizeof(SceVideodec2::DecoderMemoryInfo);
     decoderMemory.cpuMemorySize = resource->cpuMemorySize;
     decoderMemory.cpuMemory = resource->cpuMemory;
     decoderMemory.cpuGpuMemorySize = resource->cpuGpuMemorySize;
@@ -295,6 +157,7 @@ int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo* config, const ResourceI
     decoderMemory.frameBufferAlignment = resource->frameBufferAlignment;
     try {
         sceVideodec2QueryDecoderMemoryInfo_nid_postfix(&decoderConfig, &decoderMemory);
+
     } catch (const std::exception&) {
         return VideodecErrorConfigInfo;
     }
@@ -313,11 +176,11 @@ int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo* config, const ResourceI
     return 0;
 }
 
-int APS5_VABI sceVideodecDecode(Ctrl* ctrl, const InputData* input, FrameBuffer* frameBuffer, PictureInfo* picture) {
+int APS5_VABI sceVideodecDecode(Ctrl* ctrl, const SceVideodec2::InputData* input, FrameBuffer* frameBuffer, PictureInfo* picture) {
     if (ctrl == nullptr || input == nullptr || picture == nullptr) return VideodecErrorArgumentPointer;
     if (frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
     if (ctrl->thisSize < sizeof(Ctrl)) return VideodecErrorStructSize;
-    if (input->thisSize < sizeof(InputData)) return VideodecErrorStructSize;
+    if (input->thisSize < sizeof(SceVideodec2::InputData)) return VideodecErrorStructSize;
     if (picture->thisSize < sizeof(PictureInfo)) return VideodecErrorStructSize;
     if (frameBuffer->thisSize < sizeof(FrameBuffer)) return VideodecErrorStructSize;
     auto* decoder = FindDecoder(ctrl->handle);
@@ -325,20 +188,21 @@ int APS5_VABI sceVideodecDecode(Ctrl* ctrl, const InputData* input, FrameBuffer*
     if (input->auData == nullptr) return VideodecErrorAuPointer;
     if (input->auSize == 0) return VideodecErrorAuSize;
     if (frameBuffer->frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
-    Decoder2FrameBuffer target{};
-    target.thisSize = sizeof(Decoder2FrameBuffer);
+    SceVideodec2::FrameBuffer target{};
+    target.thisSize = sizeof(SceVideodec2::FrameBuffer);
     target.frameBuffer = decoder->picture.data();
     target.frameBufferSize = decoder->picture.size();
-    Decoder2OutputInfo output{sizeof(Decoder2OutputInfo)};
+    SceVideodec2::OutputInfo output{sizeof(SceVideodec2::OutputInfo)};
     try {
         sceVideodec2Decode_nid_postfix(decoder->handle, input, &target, &output);
+
     } catch (const std::exception&) {
         return VideodecErrorDecodeAu;
     }
     Decoder2Crop crop{};
     if (output.isValid) Videodec2PictureCrop_nid_no_patch(decoder->handle, output.frameBuffer, &crop);
     const auto geometry = Measure(output, crop);
-    Decoder2AvcPictureInfo avc{sizeof(Decoder2AvcPictureInfo)};
+    SceVideodec2::AvcPictureInfo avc{sizeof(SceVideodec2::AvcPictureInfo)};
     if (output.isValid) sceVideodec2GetAvcPictureInfo_nid_postfix(&output, &avc, nullptr);
     FillPictureInfo(geometry, output, picture);
     picture->ptsData = avc.ptsData;
@@ -362,6 +226,7 @@ int APS5_VABI sceVideodecDeleteDecoder(Ctrl* ctrl) {
     delete decoder;
     try {
         sceVideodec2DeleteDecoder_nid_postfix(handle);
+
     } catch (const std::exception&) {
         return VideodecErrorApiFail;
     }
@@ -377,20 +242,21 @@ int APS5_VABI sceVideodecFlush(Ctrl* ctrl, FrameBuffer* frameBuffer, PictureInfo
     auto* decoder = FindDecoder(ctrl->handle);
     if (decoder == nullptr) return VideodecErrorHandle;
     if (frameBuffer->frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
-    Decoder2FrameBuffer target{};
-    target.thisSize = sizeof(Decoder2FrameBuffer);
+    SceVideodec2::FrameBuffer target{};
+    target.thisSize = sizeof(SceVideodec2::FrameBuffer);
     target.frameBuffer = decoder->picture.data();
     target.frameBufferSize = decoder->picture.size();
-    Decoder2OutputInfo output{sizeof(Decoder2OutputInfo)};
+    SceVideodec2::OutputInfo output{sizeof(SceVideodec2::OutputInfo)};
     try {
         sceVideodec2Flush_nid_postfix(decoder->handle, &target, &output);
+
     } catch (const std::exception&) {
         return VideodecErrorDecodeAu;
     }
     Decoder2Crop crop{};
     if (output.isValid) Videodec2PictureCrop_nid_no_patch(decoder->handle, output.frameBuffer, &crop);
     const auto geometry = Measure(output, crop);
-    Decoder2AvcPictureInfo avc{sizeof(Decoder2AvcPictureInfo)};
+    SceVideodec2::AvcPictureInfo avc{sizeof(SceVideodec2::AvcPictureInfo)};
     if (output.isValid) sceVideodec2GetAvcPictureInfo_nid_postfix(&output, &avc, nullptr);
     FillPictureInfo(geometry, output, picture);
     picture->ptsData = avc.ptsData;
@@ -406,6 +272,7 @@ int APS5_VABI sceVideodecReset(Ctrl* ctrl) {
     if (decoder == nullptr) return VideodecErrorHandle;
     try {
         sceVideodec2Reset_nid_postfix(decoder->handle);
+
     } catch (const std::exception&) {
         return VideodecErrorApiFail;
     }
@@ -420,10 +287,11 @@ int APS5_VABI sceVideodecQueryResourceInfo(const ConfigInfo* config, ResourceInf
     if (config == nullptr || resource == nullptr) return VideodecErrorArgumentPointer;
     if (config->thisSize < sizeof(ConfigInfo) || resource->thisSize < sizeof(ResourceInfo)) return VideodecErrorStructSize;
     const auto decoderConfig = MapConfig(*config);
-    Decoder2MemoryInfo decoderMemory{};
-    decoderMemory.thisSize = sizeof(Decoder2MemoryInfo);
+    SceVideodec2::DecoderMemoryInfo decoderMemory{};
+    decoderMemory.thisSize = sizeof(SceVideodec2::DecoderMemoryInfo);
     try {
         sceVideodec2QueryDecoderMemoryInfo_nid_postfix(&decoderConfig, &decoderMemory);
+
     } catch (const std::exception&) {
         return VideodecErrorConfigInfo;
     }
diff --git a/core/libs/prx/libSceVideodec/include/Api.hpp b/core/libs/prx/libSceVideodec/include/Api.hpp
new file mode 100644
index 0000000000..46fd7ef835
--- /dev/null
+++ b/core/libs/prx/libSceVideodec/include/Api.hpp
@@ -0,0 +1,119 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <map>
+#include <mutex>
+#include <stdexcept>
+#include <vector>
+
+namespace SceVideodec {
+
+struct ConfigInfo {
+    std::uint64_t thisSize;
+    std::uint32_t codecType;
+    std::uint32_t profile;
+    std::uint32_t maxLevel;
+    std::int32_t maxFrameWidth;
+    std::int32_t maxFrameHeight;
+    std::int32_t maxDpbFrameCount;
+    std::uint64_t videodecFlags;
+};
+
+}
+
+namespace SceVideodec {
+
+struct ResourceInfo {
+    std::uint64_t thisSize;
+    std::uint64_t cpuMemorySize;
+    void* cpuMemory;
+    std::uint64_t cpuGpuMemorySize;
+    void* cpuGpuMemory;
+    std::uint64_t maxFrameBufferSize;
+    std::uint32_t frameBufferAlignment;
+};
+
+}
+
+namespace SceVideodec {
+
+struct Ctrl {
+    std::uint64_t thisSize;
+    void* handle;
+    std::uint64_t version;
+};
+
+}
+
+namespace SceVideodec {
+
+struct FrameBuffer {
+    std::uint64_t thisSize;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+};
+
+}
+
+namespace SceVideodec {
+
+struct AvcInfo {
+    std::uint32_t numUnitsInTick;
+    std::uint32_t timeScale;
+    std::uint8_t fixedFrameRateFlag;
+    std::uint8_t aspectRatioIdc;
+    std::uint16_t sarWidth;
+    std::uint16_t sarHeight;
+    std::uint8_t colourPrimaries;
+    std::uint8_t transferCharacteristics;
+    std::uint8_t matrixCoefficients;
+    std::uint8_t videoFullRangeFlag;
+    std::uint32_t frameCropLeftOffset;
+    std::uint32_t frameCropRightOffset;
+    std::uint32_t frameCropTopOffset;
+    std::uint32_t frameCropBottomOffset;
+};
+
+}
+
+namespace SceVideodec {
+
+union CodecInfo {
+    std::uint8_t reserved[64];
+    AvcInfo avc;
+};
+
+}
+
+namespace SceVideodec {
+
+struct PictureInfo {
+    std::uint64_t thisSize;
+    std::uint32_t isValid;
+    std::uint32_t codecType;
+    std::uint32_t frameWidth;
+    std::uint32_t framePitch;
+    std::uint32_t frameHeight;
+    std::uint32_t isErrorPic;
+    std::uint64_t ptsData;
+    std::uint64_t attachedData;
+    CodecInfo codec;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVideodecCreateDecoder(const SceVideodec::ConfigInfo* config, const SceVideodec::ResourceInfo* resource, SceVideodec::Ctrl* ctrl);
+int APS5_VABI sceVideodecDecode(SceVideodec::Ctrl* ctrl, const SceVideodec2::InputData* input, SceVideodec::FrameBuffer* frameBuffer, SceVideodec::PictureInfo* picture);
+int APS5_VABI sceVideodecDeleteDecoder(SceVideodec::Ctrl* ctrl);
+int APS5_VABI sceVideodecFlush(SceVideodec::Ctrl* ctrl, SceVideodec::FrameBuffer* frameBuffer, SceVideodec::PictureInfo* picture);
+int APS5_VABI sceVideodecReset(SceVideodec::Ctrl* ctrl);
+int APS5_VABI sceVideodecMapMemory(void);
+int APS5_VABI sceVideodecQueryResourceInfo(const SceVideodec::ConfigInfo* config, SceVideodec::ResourceInfo* resource);
+
+}
diff --git a/core/libs/prx/libSceVideodec/libSceVideodec.hpp b/core/libs/prx/libSceVideodec/libSceVideodec.hpp
new file mode 100644
index 0000000000..8fa57dc2dd
--- /dev/null
+++ b/core/libs/prx/libSceVideodec/libSceVideodec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideodec/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideodec2/Export.cpp b/core/libs/prx/libSceVideodec2/Export.cpp
index 583b18c0ff..de23de7b72 100644
--- a/core/libs/prx/libSceVideodec2/Export.cpp
+++ b/core/libs/prx/libSceVideodec2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include <array>
 #include <span>
 #include <cstdint>
@@ -24,6 +25,8 @@ extern "C" {
 
 namespace {
 
+using namespace SceVideodec2;
+
 constexpr std::uint64_t WorkMemoryBytes = 1u << 20u;
 constexpr std::uint32_t PitchAlignment = 256;
 constexpr std::uint32_t HeightAlignment = 32;
@@ -33,107 +36,6 @@ constexpr std::uint32_t CodecVp9 = 2382845;
 constexpr int Videodec2ErrorAccessUnitSize = static_cast<int>(0x811D010Du);
 constexpr int Videodec2ErrorAccessUnitPointer = static_cast<int>(0x811D010Eu);
 
-struct ComputeMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-};
-
-struct ComputeConfigInfo {
-    std::uint64_t thisSize;
-    std::uint16_t computePipeId;
-    std::uint16_t computeQueueId;
-    bool checkMemoryType;
-};
-
-struct DecoderConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-};
-
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
-
 static_assert(sizeof(Vp9PictureInfo) == 88);
 static_assert(offsetof(Vp9PictureInfo, colorSpace) == 60);
 
diff --git a/core/libs/prx/libSceVideodec2/Unimplemented.cpp b/core/libs/prx/libSceVideodec2/Unimplemented.cpp
index b427d652ac..62a9691332 100644
--- a/core/libs/prx/libSceVideodec2/Unimplemented.cpp
+++ b/core/libs/prx/libSceVideodec2/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceVideodec2/include/Api.hpp b/core/libs/prx/libSceVideodec2/include/Api.hpp
new file mode 100644
index 0000000000..ff71178c8c
--- /dev/null
+++ b/core/libs/prx/libSceVideodec2/include/Api.hpp
@@ -0,0 +1,186 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <array>
+#include <cerrno>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <limits>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <stdexcept>
+#include <vector>
+
+namespace SceVideodec2 {
+
+struct ComputeMemoryInfo {
+    std::uint64_t thisSize;
+    std::uint64_t cpuGpuMemorySize;
+    void* cpuGpuMemory;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct ComputeConfigInfo {
+    std::uint64_t thisSize;
+    std::uint16_t computePipeId;
+    std::uint16_t computeQueueId;
+    bool checkMemoryType;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct DecoderConfigInfo {
+    std::uint64_t thisSize;
+    std::uint32_t resourceType;
+    std::uint32_t codecType;
+    std::uint32_t profile;
+    std::uint32_t maxLevel;
+    std::int32_t maxFrameWidth;
+    std::int32_t maxFrameHeight;
+    std::int32_t maxDpbFrameCount;
+    std::uint32_t decodePipelineDepth;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct DecoderMemoryInfo {
+    std::uint64_t thisSize;
+    std::uint64_t cpuMemorySize;
+    void* cpuMemory;
+    std::uint64_t gpuMemorySize;
+    void* gpuMemory;
+    std::uint64_t cpuGpuMemorySize;
+    void* cpuGpuMemory;
+    std::uint64_t maxFrameBufferSize;
+    std::uint32_t frameBufferAlignment;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct InputData {
+    std::uint64_t thisSize;
+    const std::uint8_t* auData;
+    std::uint64_t auSize;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct FrameBuffer {
+    std::uint64_t thisSize;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+    bool isAccepted;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct OutputInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    bool isErrorFrame;
+    std::uint8_t pictureCount;
+    std::uint32_t codecType;
+    std::uint32_t frameWidth;
+    std::uint32_t framePitch;
+    std::uint32_t frameHeight;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+    std::uint32_t frameFormat;
+    std::uint32_t framePitchInBytes;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct AvcPictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint8_t idrPictureFlag;
+    std::uint8_t profileIdc;
+    std::uint8_t levelIdc;
+    std::uint32_t picWidthInLumaSamples;
+    std::uint32_t picHeightInLumaSamples;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct Vp9PictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint32_t profile;
+    std::uint32_t level;
+    std::uint32_t keyFrameFlag;
+    std::uint32_t intraOnly;
+    std::uint8_t bitDepth;
+    std::uint8_t colorRange;
+    std::uint32_t colorSpace;
+    std::uint32_t numFrames;
+    std::uint32_t frameWidth;
+    std::uint32_t frameHeight;
+    std::uint32_t renderWidth;
+    std::uint32_t renderHeight;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVideodec2QueryComputeMemoryInfo_nid_postfix(SceVideodec2::ComputeMemoryInfo* info);
+int APS5_VABI sceVideodec2AllocateComputeQueue_nid_postfix(const SceVideodec2::ComputeConfigInfo* config, const SceVideodec2::ComputeMemoryInfo* memory, std::uint64_t* queue);
+int APS5_VABI sceVideodec2ReleaseComputeQueue_nid_postfix(std::uint64_t queue);
+int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const SceVideodec2::DecoderConfigInfo* config, SceVideodec2::DecoderMemoryInfo* memory);
+int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const SceVideodec2::DecoderConfigInfo* config, const SceVideodec2::DecoderMemoryInfo* memory, std::uint64_t* handle);
+int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t handle);
+int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t handle, const SceVideodec2::InputData* input, SceVideodec2::FrameBuffer* frame, SceVideodec2::OutputInfo* output);
+int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t handle, SceVideodec2::FrameBuffer* frame, SceVideodec2::OutputInfo* output);
+int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t handle);
+int APS5_VABI sceVideodec2GetPictureInfo_nid_postfix(const SceVideodec2::OutputInfo* output, SceVideodec2::AvcPictureInfo* first, void* second);
+int APS5_VABI sceVideodec2GetAvcPictureInfo_nid_postfix(const SceVideodec2::OutputInfo* output, SceVideodec2::AvcPictureInfo* first, SceVideodec2::AvcPictureInfo* second);
+int APS5_VABI sceVideodec2GetVp9PictureInfo_nid_postfix(const SceVideodec2::OutputInfo* output, SceVideodec2::Vp9PictureInfo* info);
+int APS5_VABI sceVideodec2TermLibrary();
+int APS5_VABI sceVideodec2QueryLibraryInfo();
+int APS5_VABI sceVideodec2QueryDecoderInfo();
+int APS5_VABI sceVideodec2MapMemory();
+int APS5_VABI sceVideodec2MapDirectMemory(void*, const void*);
+int APS5_VABI sceVideodec2PresetDecoderConfigInfo();
+int APS5_VABI sceVideodec2PresetDecoderConfigInfoAvc();
+int APS5_VABI sceVideodec2PresetDecoderConfigInfoHevc();
+int APS5_VABI sceVideodec2PresetDecoderConfigInfoVp9();
+int APS5_VABI sceVideodec2CreateDecoderBid();
+int APS5_VABI sceVideodec2CreateHevcDecoder();
+int APS5_VABI sceVideodec2QueryHevcDecoderMemoryInfo();
+int APS5_VABI sceVideodec2GetHevcPictureInfo();
+int APS5_VABI sceVideodec2InitLibrary();
+
+}
diff --git a/core/libs/prx/libSceVideodec2/libSceVideodec2.hpp b/core/libs/prx/libSceVideodec2/libSceVideodec2.hpp
new file mode 100644
index 0000000000..85a17c3882
--- /dev/null
+++ b/core/libs/prx/libSceVideodec2/libSceVideodec2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideodec2/include/Api.hpp"
diff --git a/core/libs/prx/libSceVisionManager/Export.cpp b/core/libs/prx/libSceVisionManager/Export.cpp
index 91dd5c2463..e329980232 100644
--- a/core/libs/prx/libSceVisionManager/Export.cpp
+++ b/core/libs/prx/libSceVisionManager/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVisionManager/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -16,8 +17,7 @@ int APS5_VABI sceVisionManagerCancelRequest() {
 }
 
 int APS5_VABI sceVisionManagerClose() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerFinalize() {
@@ -106,23 +106,19 @@ int APS5_VABI sceVisionManagerGetResultOfFindPadCorrespondRegion() {
 }
 
 int APS5_VABI sceVisionManagerGetResultOfFindUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerGetResultOfFindUserInRegion() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerGetResultOfFindUserWithoutIdentify() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerGetResultOfRegisterUserInRegion() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerGetStoreCameraImgYPtr() {
@@ -141,13 +137,11 @@ int APS5_VABI sceVisionManagerInitialize() {
 }
 
 int APS5_VABI sceVisionManagerLoadSettings() {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceVisionManagerOpen() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerRegistryClear() {
@@ -191,18 +185,15 @@ int APS5_VABI sceVisionManagerRequestFindPadCorrespondRegion() {
 }
 
 int APS5_VABI sceVisionManagerRequestFindUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerRequestFindUserInRegion() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerRequestFindUserWithoutIdentify() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerRequestHeadDetection() {
@@ -231,8 +222,7 @@ int APS5_VABI sceVisionManagerRequestRecogUtility() {
 }
 
 int APS5_VABI sceVisionManagerRequestRegisterUserInRegion() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80e70004);
 }
 
 int APS5_VABI sceVisionManagerRequestStoreCameraImgY() {
diff --git a/core/libs/prx/libSceVisionManager/include/Api.hpp b/core/libs/prx/libSceVisionManager/include/Api.hpp
new file mode 100644
index 0000000000..95c8fb3a85
--- /dev/null
+++ b/core/libs/prx/libSceVisionManager/include/Api.hpp
@@ -0,0 +1,64 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVisionManagerApplyCalibrateHmdResult();
+int APS5_VABI sceVisionManagerCancelRequest();
+int APS5_VABI sceVisionManagerClose();
+int APS5_VABI sceVisionManagerFinalize();
+int APS5_VABI sceVisionManagerGenerateRegisterUserData();
+int APS5_VABI sceVisionManagerGenerateRegisterUserDataFinalize();
+int APS5_VABI sceVisionManagerGenerateRegisterUserDataInitialize();
+int APS5_VABI sceVisionManagerGetCalibrateTrackingLedInfo();
+int APS5_VABI sceVisionManagerGetCalibrateTrackingLedNecessity();
+int APS5_VABI sceVisionManagerGetHitCountOfRegisterUserData();
+int APS5_VABI sceVisionManagerGetLibraryVersion();
+int APS5_VABI sceVisionManagerGetNumOfRegisterUserDataSlot();
+int APS5_VABI sceVisionManagerGetRegisterUserDataSize();
+int APS5_VABI sceVisionManagerGetRegisterUserDataVersion();
+int APS5_VABI sceVisionManagerGetResultOfCalibrateHmd();
+int APS5_VABI sceVisionManagerGetResultOfCalibrateStereoCamera();
+int APS5_VABI sceVisionManagerGetResultOfCalibrateTrackingLed();
+int APS5_VABI sceVisionManagerGetResultOfFindFace();
+int APS5_VABI sceVisionManagerGetResultOfFindPad();
+int APS5_VABI sceVisionManagerGetResultOfFindPadCorrespondRegion();
+int APS5_VABI sceVisionManagerGetResultOfFindUser();
+int APS5_VABI sceVisionManagerGetResultOfFindUserInRegion();
+int APS5_VABI sceVisionManagerGetResultOfFindUserWithoutIdentify();
+int APS5_VABI sceVisionManagerGetResultOfRegisterUserInRegion();
+int APS5_VABI sceVisionManagerGetStoreCameraImgYPtr();
+int APS5_VABI sceVisionManagerGetWorkingMemorySize();
+int APS5_VABI sceVisionManagerInitialize();
+int APS5_VABI sceVisionManagerLoadSettings();
+int APS5_VABI sceVisionManagerOpen();
+int APS5_VABI sceVisionManagerRegistryClear();
+int APS5_VABI sceVisionManagerRequestCalibrateHmd();
+int APS5_VABI sceVisionManagerRequestCalibrateStereoCamera();
+int APS5_VABI sceVisionManagerRequestCalibrateTrackingLed();
+int APS5_VABI sceVisionManagerRequestClose();
+int APS5_VABI sceVisionManagerRequestFindFace();
+int APS5_VABI sceVisionManagerRequestFindPad();
+int APS5_VABI sceVisionManagerRequestFindPadCorrespondRegion();
+int APS5_VABI sceVisionManagerRequestFindUser();
+int APS5_VABI sceVisionManagerRequestFindUserInRegion();
+int APS5_VABI sceVisionManagerRequestFindUserWithoutIdentify();
+int APS5_VABI sceVisionManagerRequestHeadDetection();
+int APS5_VABI sceVisionManagerRequestInitializeRegisterUserData();
+int APS5_VABI sceVisionManagerRequestOpen();
+int APS5_VABI sceVisionManagerRequestPadTracking();
+int APS5_VABI sceVisionManagerRequestRecogUtility();
+int APS5_VABI sceVisionManagerRequestRegisterUserInRegion();
+int APS5_VABI sceVisionManagerRequestStoreCameraImgY();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCalibrateHmdResult();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCalibrateStereoCameraResult();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCalibrateTrackingLedResult();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCameraFrame();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCtrlCore();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateRecog();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateRunningStatus();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateStoreFrame();
+int APS5_VABI sceVisionManagerWaitResponse();
+
+}
diff --git a/core/libs/prx/libSceVisionManager/libSceVisionManager.hpp b/core/libs/prx/libSceVisionManager/libSceVisionManager.hpp
new file mode 100644
index 0000000000..e2529647b8
--- /dev/null
+++ b/core/libs/prx/libSceVisionManager/libSceVisionManager.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVisionManager/include/Api.hpp"
diff --git a/core/libs/prx/libSceVnaInternal/libSceVnaInternal.hpp b/core/libs/prx/libSceVnaInternal/libSceVnaInternal.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVnaInternal/libSceVnaInternal.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVnaWebsocket/libSceVnaWebsocket.hpp b/core/libs/prx/libSceVnaWebsocket/libSceVnaWebsocket.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVnaWebsocket/libSceVnaWebsocket.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVoice/Export.cpp b/core/libs/prx/libSceVoice/Export.cpp
index 3357ee67ea..18c75c1db4 100644
--- a/core/libs/prx/libSceVoice/Export.cpp
+++ b/core/libs/prx/libSceVoice/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoice/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -446,7 +447,7 @@ int APS5_VABI sceVoiceQAEnableRecording(void) {
     return 0;
 }
 
-int APS5_VABI sceVoiceVADAdjustment(void) {
+int APS5_VABI sceVoiceVADAdjustment(float, float) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceVoice/include/Api.hpp b/core/libs/prx/libSceVoice/include/Api.hpp
new file mode 100644
index 0000000000..4ac2972a27
--- /dev/null
+++ b/core/libs/prx/libSceVoice/include/Api.hpp
@@ -0,0 +1,44 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVoiceInit(const VoiceInitParam* param, std::int32_t version);
+int APS5_VABI sceVoiceSetThreadsParams(const VoiceThreadsParams* params);
+int APS5_VABI sceVoiceStart(const VoiceStartParam* param);
+int APS5_VABI sceVoiceStop(void);
+int APS5_VABI sceVoiceEnd_nid_postfix(void);
+int APS5_VABI sceVoiceCreatePort(std::uint32_t* portId, const VoicePortParam* param);
+int APS5_VABI sceVoiceDeletePort(uint32_t portId);
+int APS5_VABI sceVoiceConnectIPortToOPort(uint32_t inputPortId, uint32_t outputPortId);
+int APS5_VABI sceVoiceDisconnectIPortFromOPort(uint32_t inputPortId, uint32_t outputPortId);
+int APS5_VABI sceVoiceGetBitRate(std::uint32_t portId, std::uint32_t* bitrate);
+int APS5_VABI sceVoiceSetVolume(std::uint32_t portId, float volume);
+int APS5_VABI sceVoiceGetVolume(std::uint32_t portId, float* volume);
+int APS5_VABI sceVoiceGetPortInfo(uint32_t portId, VoicePortInfo* info);
+int APS5_VABI sceVoiceGetPortAttr(std::uint32_t portId, std::int32_t attr, void* value, std::int32_t size);
+int APS5_VABI sceVoiceReadFromOPort(uint32_t outputPortId, void* data, uint32_t* size);
+int APS5_VABI sceVoiceWriteToIPort(uint32_t inputPortId, const void* data, uint32_t* size, int16_t frameGaps);
+int APS5_VABI sceVoiceSetMuteFlag(std::uint32_t portId, std::uint8_t muted);
+int APS5_VABI sceVoiceGetMuteFlag(std::uint32_t portId, bool* muted);
+int APS5_VABI sceVoiceGetResourceInfo(VoiceResourceInfo* info);
+int APS5_VABI sceVoiceEnableChat(void);
+int APS5_VABI sceVoiceResetPort(std::uint32_t portId);
+int APS5_VABI sceVoicePausePort(std::uint32_t portId);
+int APS5_VABI sceVoiceResumePort(std::uint32_t portId);
+int APS5_VABI sceVoiceDisableChat(void);
+int APS5_VABI sceVoiceInitHQ(const VoiceInitParam* param, std::int32_t version);
+int APS5_VABI sceVoiceGetMemorySize(void);
+int APS5_VABI sceVoiceDeviceInCustomerData(void);
+int APS5_VABI sceVoiceQAEnableRecording(void);
+int APS5_VABI sceVoiceVADAdjustment(float param1, float param2);
+int APS5_VABI sceVoiceVADPVTAdjustment(void);
+int APS5_VABI sceVoiceVADSetVersion(std::int32_t version);
+int APS5_VABI sceVoiceSetMuteFlagAll(bool muted);
+int APS5_VABI sceVoiceSetBitRate(std::uint32_t portId, std::uint32_t bitrate);
+int APS5_VABI sceVoiceUpdatePort(std::uint32_t portId, const VoicePortParam* param);
+int APS5_VABI sceVoicePausePortAll(void);
+int APS5_VABI sceVoiceResumePortAll(void);
+
+}
diff --git a/core/libs/prx/libSceVoice/libSceVoice.hpp b/core/libs/prx/libSceVoice/libSceVoice.hpp
new file mode 100644
index 0000000000..5892fc763a
--- /dev/null
+++ b/core/libs/prx/libSceVoice/libSceVoice.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVoice/include/Api.hpp"
diff --git a/core/libs/prx/libSceVoiceChat/Export.cpp b/core/libs/prx/libSceVoiceChat/Export.cpp
index 49e582df5f..b1fde4c767 100644
--- a/core/libs/prx/libSceVoiceChat/Export.cpp
+++ b/core/libs/prx/libSceVoiceChat/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoiceChat/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdio>
diff --git a/core/libs/prx/libSceVoiceChat/include/Api.hpp b/core/libs/prx/libSceVoiceChat/include/Api.hpp
new file mode 100644
index 0000000000..5d5676dff3
--- /dev/null
+++ b/core/libs/prx/libSceVoiceChat/include/Api.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVoiceChatInitialize(void* param);
+int APS5_VABI sceVoiceChatTerminate(void);
+int APS5_VABI sceVoiceChatRegisterHandlers(void* a);
+int APS5_VABI sceVoiceChatRegisterMicEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatProcessEvent(void);
+int APS5_VABI sceVoiceChatDeleteRequest(int requestId);
+int APS5_VABI sceVoiceChatCreateRequest(void* a, void* b);
+int APS5_VABI NAME(int requestId, void* a, void* b);
+int APS5_VABI sceVoiceChatAbortRequest(int requestId);
+int APS5_VABI sceVoiceChatGetActiveChannel(void* channel);
+int APS5_VABI sceVoiceChatGetChannelMemberActiveChannelMatchingState(void* a, void* b);
+int APS5_VABI sceVoiceChatGetChannelMemberVoiceConnectionState(void* a, void* b);
+int APS5_VABI sceVoiceChatGetChatChannelMemberInfoList(void* a, void* b);
+int APS5_VABI sceVoiceChatGetChatGroupMemberInfoList(void* a, void* b);
+int APS5_VABI sceVoiceChatGetMicState(void* state);
+int APS5_VABI sceVoiceChatGetUserVoiceVolumeGain(void* a, void* gain);
+int APS5_VABI sceVoiceChatSetUserVoiceVolumeGain(void* a, int32_t gain);
+int APS5_VABI sceVoiceChatRegisterChannelEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterDaemonEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterMemberEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterPartyUserStateChangedHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterVoiceEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatStartAccessibilityEvent(void* a);
+int APS5_VABI sceVoiceChatStartChannelEvent(void* a);
+int APS5_VABI sceVoiceChatStartDaemonEvent(void* a);
+int APS5_VABI sceVoiceChatStartMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStartRangedMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStartVoiceEvent(void* a);
+int APS5_VABI sceVoiceChatStopAccessibilityEvent(void* a);
+int APS5_VABI sceVoiceChatStopChannelEvent(void* a);
+int APS5_VABI sceVoiceChatStopDaemonEvent(void* a);
+int APS5_VABI sceVoiceChatStopMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStopRangedMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStopVoiceEvent(void* a);
+int APS5_VABI sceVoiceChatUnregisterAccessibilityEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterChannelEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterDaemonEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterMemberEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterMicEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterPartyUserStateChangedHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterRangedMemberEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterVoiceEventHandler(void* a);
+
+}
diff --git a/core/libs/prx/libSceVoiceChat/libSceVoiceChat.hpp b/core/libs/prx/libSceVoiceChat/libSceVoiceChat.hpp
new file mode 100644
index 0000000000..81d8245cc3
--- /dev/null
+++ b/core/libs/prx/libSceVoiceChat/libSceVoiceChat.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVoiceChat/include/Api.hpp"
diff --git a/core/libs/prx/libSceVoiceCommand/libSceVoiceCommand.hpp b/core/libs/prx/libSceVoiceCommand/libSceVoiceCommand.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVoiceCommand/libSceVoiceCommand.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVoiceQoS/Export.cpp b/core/libs/prx/libSceVoiceQoS/Export.cpp
index 6c52605b5e..7781cd7ec8 100644
--- a/core/libs/prx/libSceVoiceQoS/Export.cpp
+++ b/core/libs/prx/libSceVoiceQoS/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoiceQoS/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceVoiceQoS/include/Api.hpp b/core/libs/prx/libSceVoiceQoS/include/Api.hpp
new file mode 100644
index 0000000000..a37b2d9239
--- /dev/null
+++ b/core/libs/prx/libSceVoiceQoS/include/Api.hpp
@@ -0,0 +1,33 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVoiceQoSInit(void* memBlock, uint32_t memSize, int32_t appType);
+int APS5_VABI sceVoiceQoSEnd();
+int APS5_VABI sceVoiceQoSCreateLocalEndpoint(int32_t* localId, int32_t userId, int32_t deviceInId, int32_t deviceOutId);
+int APS5_VABI sceVoiceQoSDeleteLocalEndpoint(int32_t localId);
+int APS5_VABI sceVoiceQoSCreateRemoteEndpoint(int32_t* remoteId);
+int APS5_VABI sceVoiceQoSDeleteRemoteEndpoint(int32_t remoteId);
+int APS5_VABI sceVoiceQoSConnect(int32_t* connectionId, int32_t localId, int32_t remoteId);
+int APS5_VABI sceVoiceQoSDisconnect(int32_t connectionId);
+int APS5_VABI sceVoiceQoSSetConnectionAttribute(std::int32_t connectionId, std::int32_t attributeId, const void* value, std::int32_t size);
+int APS5_VABI sceVoiceQoSSetLocalEndpointAttribute(int32_t localId, int32_t attributeId, const void* value, int32_t size);
+int APS5_VABI sceVoiceQoSSetRemoteEndpointAttribute(int32_t remoteId, int32_t attributeId, const void* value, int32_t size);
+int APS5_VABI sceVoiceQoSReadPacket(int32_t connectionId, void* buffer, uint32_t* size);
+int APS5_VABI sceVoiceQoSWritePacket(int32_t connectionId, const void* buffer, uint32_t* size);
+int APS5_VABI sceVoiceQoSGetLocalEndpointAttribute(int32_t localId, int32_t attributeId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSGetRemoteEndpointAttribute(int32_t remoteId, int32_t attributeId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSGetConnectionAttribute(int32_t connectionId, int32_t attributeId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSGetLocalEndpoint(int32_t connectionId, int32_t* localId);
+int APS5_VABI sceVoiceQoSGetRemoteEndpoint(int32_t connectionId, int32_t* remoteId);
+int APS5_VABI sceVoiceQoSEnableChat();
+int APS5_VABI sceVoiceQoSDisableChat();
+int APS5_VABI sceVoiceQoSGetStatus(int32_t connectionId, int32_t statusId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSDebugGetStatus(std::int32_t connectionId, std::int32_t statusId, void* value, std::int32_t size);
+int APS5_VABI sceVoiceQoSInitHQ(void* memory, std::uint32_t memorySize, std::int32_t appType);
+int APS5_VABI sceVoiceQoSSetMode();
+int APS5_VABI sceVoiceQoSTerminate();
+
+}
diff --git a/core/libs/prx/libSceVoiceQoS/libSceVoiceQoS.hpp b/core/libs/prx/libSceVoiceQoS/libSceVoiceQoS.hpp
new file mode 100644
index 0000000000..e6e7967b46
--- /dev/null
+++ b/core/libs/prx/libSceVoiceQoS/libSceVoiceQoS.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVoiceQoS/include/Api.hpp"
diff --git a/core/libs/prx/libSceVorbisDec/Export.cpp b/core/libs/prx/libSceVorbisDec/Export.cpp
index b6b60cadf5..44b39a6c58 100644
--- a/core/libs/prx/libSceVorbisDec/Export.cpp
+++ b/core/libs/prx/libSceVorbisDec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVorbisDec/include/Api.hpp"
 #include "prx/libSceVorbisDec/include/GuestVorbisFile.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceVorbisDec/include/Api.hpp b/core/libs/prx/libSceVorbisDec/include/Api.hpp
new file mode 100644
index 0000000000..7f0e484c62
--- /dev/null
+++ b/core/libs/prx/libSceVorbisDec/include/Api.hpp
@@ -0,0 +1,53 @@
+#pragma once
+
+#include "prx/libSceVorbisDec/include/GuestVorbisFile.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <limits>
+#include <memory>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+extern "C" {
+
+int APS5_VABI sceVorbisDecOpenCallbacks(void* datasource, void* vf, const char* initial, std::int64_t ibytes, VorbisDec::GuestCallbacks callbacks);
+int APS5_VABI sceVorbisDecClear(void* vf);
+std::int64_t APS5_VABI sceVorbisDecBitrate(void* vf, int link);
+std::int64_t APS5_VABI sceVorbisDecBitrateInstant(void* vf);
+VorbisDec::GuestComment* APS5_VABI sceVorbisDecComment(void* vf, int link);
+int APS5_VABI sceVorbisDecCrossLap(void* first, void* second);
+int APS5_VABI sceVorbisDecGetDecodePriority(void);
+int APS5_VABI sceVorbisDecGetLastDecodeError(void);
+int APS5_VABI sceVorbisDecHalfrate(void* vf, int flag);
+int APS5_VABI sceVorbisDecHalfrateP(void* vf);
+VorbisDec::GuestInfo* APS5_VABI sceVorbisDecInfo(void* vf, int link);
+int APS5_VABI sceVorbisDecPcmSeek(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecPcmSeekLap(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecPcmSeekPage(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecPcmSeekPageLap(void* vf, std::int64_t position);
+std::int64_t APS5_VABI sceVorbisDecPcmTell(void* vf);
+std::int64_t APS5_VABI sceVorbisDecPcmTotal(void* vf, int link);
+int APS5_VABI sceVorbisDecRawSeek(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecRawSeekLap(void* vf, std::int64_t position);
+std::int64_t APS5_VABI sceVorbisDecRawTell(void* vf);
+std::int64_t APS5_VABI sceVorbisDecRawTotal(void* vf, int link);
+std::int64_t APS5_VABI sceVorbisDecRead(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream);
+std::int64_t APS5_VABI sceVorbisDecReadFilter(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream, VorbisDec::GuestFilter filter, void* filterParam);
+std::int64_t APS5_VABI sceVorbisDecReadFloat(void* vf, float*** pcmChannels, int samples, int* bitstream);
+std::int64_t APS5_VABI sceVorbisDecSeekable(void* vf);
+std::int64_t APS5_VABI sceVorbisDecSerialNumber(void* vf, int link);
+int APS5_VABI sceVorbisDecSetDecodePriority(void);
+std::int64_t APS5_VABI sceVorbisDecStreams(void* vf);
+int APS5_VABI sceVorbisDecTimeSeek(void* vf, double position);
+int APS5_VABI sceVorbisDecTimeSeekLap(void* vf, double position);
+int APS5_VABI sceVorbisDecTimeSeekPage(void* vf, double position);
+int APS5_VABI sceVorbisDecTimeSeekPageLap(void* vf, double position);
+double APS5_VABI sceVorbisDecTimeTell(void* vf);
+double APS5_VABI sceVorbisDecTimeTotal(void* vf, int link);
+
+}
diff --git a/core/libs/prx/libSceVorbisDec/libSceVorbisDec.hpp b/core/libs/prx/libSceVorbisDec/libSceVorbisDec.hpp
new file mode 100644
index 0000000000..4e737bab8b
--- /dev/null
+++ b/core/libs/prx/libSceVorbisDec/libSceVorbisDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVorbisDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrServiceDialog/Export.cpp b/core/libs/prx/libSceVrServiceDialog/Export.cpp
index a4c1d1f62e..961e74e397 100644
--- a/core/libs/prx/libSceVrServiceDialog/Export.cpp
+++ b/core/libs/prx/libSceVrServiceDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVrServiceDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceVrServiceDialog/include/Api.hpp b/core/libs/prx/libSceVrServiceDialog/include/Api.hpp
new file mode 100644
index 0000000000..a68e4b7059
--- /dev/null
+++ b/core/libs/prx/libSceVrServiceDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVrServiceDialogInitialize(void);
+int APS5_VABI sceVrServiceDialogOpen(const void* param);
+int APS5_VABI sceVrServiceDialogUpdateStatus(void);
+int APS5_VABI sceVrServiceDialogGetStatus(void);
+int APS5_VABI sceVrServiceDialogGetResult(void* result);
+int APS5_VABI sceVrServiceDialogClose(void);
+int APS5_VABI sceVrServiceDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceVrServiceDialog/libSceVrServiceDialog.hpp b/core/libs/prx/libSceVrServiceDialog/libSceVrServiceDialog.hpp
new file mode 100644
index 0000000000..b0f8e5c411
--- /dev/null
+++ b/core/libs/prx/libSceVrServiceDialog/libSceVrServiceDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrServiceDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrSetupDialog/Export.cpp b/core/libs/prx/libSceVrSetupDialog/Export.cpp
index 2aa6aad360..f9196d0109 100644
--- a/core/libs/prx/libSceVrSetupDialog/Export.cpp
+++ b/core/libs/prx/libSceVrSetupDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVrSetupDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceVrSetupDialog/include/Api.hpp b/core/libs/prx/libSceVrSetupDialog/include/Api.hpp
new file mode 100644
index 0000000000..0ee132a7e1
--- /dev/null
+++ b/core/libs/prx/libSceVrSetupDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVrSetupDialogInitialize(void);
+int APS5_VABI sceVrSetupDialogOpen(const VrSetupDialogParam* param);
+int APS5_VABI sceVrSetupDialogUpdateStatus(void);
+int APS5_VABI sceVrSetupDialogGetStatus(void);
+int APS5_VABI sceVrSetupDialogGetResult(std::int32_t* result);
+int APS5_VABI sceVrSetupDialogClose(void);
+int APS5_VABI sceVrSetupDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceVrSetupDialog/libSceVrSetupDialog.hpp b/core/libs/prx/libSceVrSetupDialog/libSceVrSetupDialog.hpp
new file mode 100644
index 0000000000..85cdf54080
--- /dev/null
+++ b/core/libs/prx/libSceVrSetupDialog/libSceVrSetupDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrSetupDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrTracker/Export.cpp b/core/libs/prx/libSceVrTracker/Export.cpp
index cc4a5d1778..7e66fd197e 100644
--- a/core/libs/prx/libSceVrTracker/Export.cpp
+++ b/core/libs/prx/libSceVrTracker/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVrTracker/include/Api.hpp"
 #include <atomic>
 #include <mutex>
 #include <cstdint>
@@ -5,66 +6,12 @@
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct VrTrackerMemoryBlock {
-    void* address;
-    std::uint32_t size;
-    std::uint32_t alignment;
-};
-
-struct VrTrackerInitConfig {
-    std::uint32_t type;
-    std::uint32_t option;
-    std::uint32_t mode;
-    std::uint32_t parameter;
-    std::uint32_t reserved[4];
-};
-
-struct VrTrackerInitParam {
-    std::uint32_t size;
-    std::int32_t mode;
-    std::uint32_t reserved[6];
-    VrTrackerInitConfig config;
-    VrTrackerMemoryBlock memory[3];
-    std::uint32_t option112;
-    std::uint32_t option116;
-    std::uint32_t reservedTail[6];
-};
-
 static_assert(sizeof(VrTrackerMemoryBlock) == 16);
 static_assert(sizeof(VrTrackerInitConfig) == 32);
 static_assert(sizeof(VrTrackerInitParam) == 144);
 static_assert(offsetof(VrTrackerInitParam, config) == 32);
 static_assert(offsetof(VrTrackerInitParam, memory) == 64);
 static_assert(offsetof(VrTrackerInitParam, option112) == 112);
-struct VrTrackerGpuSubmitParam;
-struct VrTrackerResult;
-
-struct VrTrackerCpuProcessParam {
-    std::uint32_t size;
-    std::uint32_t mode;
-    std::uint32_t argument;
-    std::uint32_t reserved[5];
-};
-
-struct VrTrackerGpuWaitParam {
-    std::uint32_t size;
-    std::byte payload[28];
-};
-
-struct VrTrackerGetResultParam {
-    std::uint32_t size;
-    std::int32_t handle;
-    std::uint32_t mode;
-    std::uint32_t extendedResult;
-    std::uint64_t time;
-    std::uint32_t statusMode;
-    std::uint32_t reserved0;
-    std::uint32_t option32;
-    std::byte outputValue[4];
-    std::uint32_t option40;
-    std::uint32_t reserved1[2];
-    std::byte unused[4];
-};
 
 static_assert(sizeof(VrTrackerCpuProcessParam) == 32);
 static_assert(offsetof(VrTrackerCpuProcessParam, mode) == 4);
@@ -78,6 +25,8 @@ static_assert(offsetof(VrTrackerGetResultParam, reserved1) == 44);
 
 namespace {
 
+using namespace VrTrackerLegacy;
+
 constexpr int NotInit = static_cast<int>(0x81260801u);
 constexpr int AlreadyInitialized = static_cast<int>(0x81260802u);
 constexpr int DeviceNotRegistered = static_cast<int>(0x81260803u);
@@ -92,33 +41,8 @@ constexpr std::uint32_t WorkSize = 0x1000000;
 constexpr std::uint32_t CalibrationManual = 0;
 constexpr std::uint32_t CalibrationAuto = 1;
 
-struct CalibrationSettings {
-    std::uint32_t hmd_position;
-    std::uint32_t pad_position;
-    std::uint32_t move_position;
-    std::uint32_t gun_position;
-    std::uint32_t reserved[4];
-};
-
-struct QueryMemoryParam {
-    std::uint32_t size;
-    std::uint32_t profile;
-    std::uint32_t reserved[6];
-    CalibrationSettings calibration_settings;
-};
 static_assert(sizeof(QueryMemoryParam) == 0x40);
 
-struct QueryMemoryResult {
-    std::uint32_t size;
-    std::uint32_t direct_memory_onion_size;
-    std::uint32_t direct_memory_onion_alignment;
-    std::uint32_t direct_memory_garlic_size;
-    std::uint32_t direct_memory_garlic_alignment;
-    std::uint32_t work_memory_size;
-    std::uint32_t work_memory_alignment;
-    std::uint32_t reserved[9];
-};
-
 bool ValidCalibration(const CalibrationSettings& settings) {
     return settings.pad_position <= CalibrationAuto && settings.hmd_position <= CalibrationManual &&
         settings.move_position <= CalibrationAuto && settings.gun_position <= CalibrationAuto;
@@ -131,29 +55,6 @@ std::uint32_t OnionSize(const CalibrationSettings& settings) {
 constexpr std::int32_t ComputePipes = 7;
 constexpr std::int32_t QueuesPerPipe = 8;
 
-struct InitParam {
-    std::uint32_t size;
-    std::uint32_t profile;
-    std::uint32_t execution_mode;
-    std::int32_t hmd_thread_priority;
-    std::int32_t pad_thread_priority;
-    std::int32_t move_thread_priority;
-    std::int32_t gun_thread_priority;
-    std::int32_t reserved;
-    std::uint64_t cpu_mask;
-    CalibrationSettings calibration_settings;
-    void* direct_memory_onion;
-    std::uint32_t direct_memory_onion_size;
-    std::uint32_t direct_memory_onion_alignment;
-    void* direct_memory_garlic;
-    std::uint32_t direct_memory_garlic_size;
-    std::uint32_t direct_memory_garlic_alignment;
-    void* work_memory;
-    std::uint32_t work_memory_size;
-    std::uint32_t work_memory_alignment;
-    std::int32_t gpu_pipe_id;
-    std::int32_t gpu_queue_id;
-};
 static_assert(sizeof(InitParam) == 0x80);
 
 std::atomic<bool> g_initialized{false};
@@ -164,19 +65,10 @@ constexpr std::uint32_t DeviceGun = 3;
 std::mutex g_devicesMutex;
 std::int32_t g_deviceHandles[DeviceGun + 1] = {-1, -1, -1, -1};
 
-struct RecalibrateParam {
-    std::uint32_t size;
-    std::uint32_t device_type;
-    std::uint32_t calibration_type;
-    std::uint32_t reserved[5];
-};
-
 } // namespace
 
 extern "C" {
 
-int APS5_VABI sceVrTrackerRegisterDeviceInternal(int device_type, int handle, int unk0, int);
-
 int APS5_VABI sceVrTrackerCpuProcess(const VrTrackerCpuProcessParam* param) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceVrTracker/include/Api.hpp b/core/libs/prx/libSceVrTracker/include/Api.hpp
new file mode 100644
index 0000000000..0481e61d60
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker/include/Api.hpp
@@ -0,0 +1,159 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+
+struct VrTrackerMemoryBlock {
+    void* address;
+    std::uint32_t size;
+    std::uint32_t alignment;
+};
+
+struct VrTrackerInitConfig {
+    std::uint32_t type;
+    std::uint32_t option;
+    std::uint32_t mode;
+    std::uint32_t parameter;
+    std::uint32_t reserved[4];
+};
+
+struct VrTrackerInitParam {
+    std::uint32_t size;
+    std::int32_t mode;
+    std::uint32_t reserved[6];
+    VrTrackerInitConfig config;
+    VrTrackerMemoryBlock memory[3];
+    std::uint32_t option112;
+    std::uint32_t option116;
+    std::uint32_t reservedTail[6];
+};
+
+struct VrTrackerGpuSubmitParam;
+
+struct VrTrackerResult;
+
+struct VrTrackerCpuProcessParam {
+    std::uint32_t size;
+    std::uint32_t mode;
+    std::uint32_t argument;
+    std::uint32_t reserved[5];
+};
+
+struct VrTrackerGpuWaitParam {
+    std::uint32_t size;
+    std::byte payload[28];
+};
+
+struct VrTrackerGetResultParam {
+    std::uint32_t size;
+    std::int32_t handle;
+    std::uint32_t mode;
+    std::uint32_t extendedResult;
+    std::uint64_t time;
+    std::uint32_t statusMode;
+    std::uint32_t reserved0;
+    std::uint32_t option32;
+    std::byte outputValue[4];
+    std::uint32_t option40;
+    std::uint32_t reserved1[2];
+    std::byte unused[4];
+};
+
+namespace VrTrackerLegacy {
+
+struct CalibrationSettings {
+    std::uint32_t hmd_position;
+    std::uint32_t pad_position;
+    std::uint32_t move_position;
+    std::uint32_t gun_position;
+    std::uint32_t reserved[4];
+};
+
+struct QueryMemoryParam {
+    std::uint32_t size;
+    std::uint32_t profile;
+    std::uint32_t reserved[6];
+    CalibrationSettings calibration_settings;
+};
+
+struct QueryMemoryResult {
+    std::uint32_t size;
+    std::uint32_t direct_memory_onion_size;
+    std::uint32_t direct_memory_onion_alignment;
+    std::uint32_t direct_memory_garlic_size;
+    std::uint32_t direct_memory_garlic_alignment;
+    std::uint32_t work_memory_size;
+    std::uint32_t work_memory_alignment;
+    std::uint32_t reserved[9];
+};
+
+struct InitParam {
+    std::uint32_t size;
+    std::uint32_t profile;
+    std::uint32_t execution_mode;
+    std::int32_t hmd_thread_priority;
+    std::int32_t pad_thread_priority;
+    std::int32_t move_thread_priority;
+    std::int32_t gun_thread_priority;
+    std::int32_t reserved;
+    std::uint64_t cpu_mask;
+    CalibrationSettings calibration_settings;
+    void* direct_memory_onion;
+    std::uint32_t direct_memory_onion_size;
+    std::uint32_t direct_memory_onion_alignment;
+    void* direct_memory_garlic;
+    std::uint32_t direct_memory_garlic_size;
+    std::uint32_t direct_memory_garlic_alignment;
+    void* work_memory;
+    std::uint32_t work_memory_size;
+    std::uint32_t work_memory_alignment;
+    std::int32_t gpu_pipe_id;
+    std::int32_t gpu_queue_id;
+};
+
+struct RecalibrateParam {
+    std::uint32_t size;
+    std::uint32_t device_type;
+    std::uint32_t calibration_type;
+    std::uint32_t reserved[5];
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVrTrackerCpuProcess(const VrTrackerCpuProcessParam* param);
+int APS5_VABI sceVrTrackerGetResult(const VrTrackerGetResultParam* param, VrTrackerResult* result);
+int APS5_VABI sceVrTrackerGetTime(std::uint64_t* time);
+int APS5_VABI sceVrTrackerGpuSubmit(const VrTrackerGpuSubmitParam* param);
+int APS5_VABI sceVrTrackerGpuWait(const VrTrackerGpuWaitParam* param);
+int APS5_VABI sceVrTrackerInit(const VrTrackerInitParam* param);
+int APS5_VABI sceVrTrackerCpuPopMarker();
+int APS5_VABI sceVrTrackerCpuPushMarker();
+int APS5_VABI sceVrTrackerGetLiveCaptureId();
+int APS5_VABI sceVrTrackerGetPlayAreaWarningInfo(void* info);
+int APS5_VABI sceVrTrackerGpuWaitAndCpuProcess();
+int APS5_VABI sceVrTrackerNotifyEndOfCpuProcess(const void* param);
+int APS5_VABI sceVrTrackerQueryMemory(const void* param, void* result);
+int APS5_VABI sceVrTrackerRecalibrate(const void* param);
+int APS5_VABI sceVrTrackerRegisterDevice(int deviceType, int handle);
+int APS5_VABI sceVrTrackerRegisterDevice2(int deviceType, int handle);
+int APS5_VABI sceVrTrackerRegisterDeviceInternal(int deviceType, int handle, int unk0, int);
+int APS5_VABI sceVrTrackerResetAll();
+int APS5_VABI sceVrTrackerResetOrientationRelative(int deviceType, int handle);
+int APS5_VABI sceVrTrackerSaveInternalBuffers();
+int APS5_VABI sceVrTrackerSetDeviceRejection();
+int APS5_VABI sceVrTrackerSetDurationUntilStatusNotTracking(int deviceType, std::uint32_t);
+int APS5_VABI sceVrTrackerSetExtendedMode();
+int APS5_VABI sceVrTrackerSetLEDBrightness();
+int APS5_VABI sceVrTrackerSetRestingMode();
+int APS5_VABI sceVrTrackerStartLiveCapture();
+int APS5_VABI sceVrTrackerStopLiveCapture();
+int APS5_VABI sceVrTrackerTerm();
+int APS5_VABI sceVrTrackerUnregisterDevice(int handle);
+int APS5_VABI sceVrTrackerUpdateMotionSensorData(const void* param);
+
+}
diff --git a/core/libs/prx/libSceVrTracker/libSceVrTracker.hpp b/core/libs/prx/libSceVrTracker/libSceVrTracker.hpp
new file mode 100644
index 0000000000..81621f7084
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker/libSceVrTracker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrTracker/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrTracker2/CMakeLists.txt b/core/libs/prx/libSceVrTracker2/CMakeLists.txt
index aaf8e867d1..cccd8e8455 100644
--- a/core/libs/prx/libSceVrTracker2/CMakeLists.txt
+++ b/core/libs/prx/libSceVrTracker2/CMakeLists.txt
@@ -1,12 +1,12 @@
 add_library(libSceVrTracker2 SHARED EXCLUDE_FROM_ALL Export.cpp)
 target_include_directories(libSceVrTracker2 PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(libSceVrTracker2 PRIVATE libc)
+target_link_libraries(libSceVrTracker2 PRIVATE libSceHmd2 libc)
 configure_windows_unwind(libSceVrTracker2)
 
 if(BUILD_TESTING)
     add_test_executable(guest_vr_tracker2_tests ${LIBS_INCLUDE_DIR}/tests/GuestVrTracker2.cpp)
     target_include_directories(guest_vr_tracker2_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_vr_tracker2_tests PRIVATE libSceVrTracker2 libc)
+    target_link_libraries(guest_vr_tracker2_tests PRIVATE libSceVrTracker2 libkernel libc)
     configure_windows_unwind(guest_vr_tracker2_tests)
     add_test(NAME guest_vr_tracker2 COMMAND guest_vr_tracker2_tests)
     if(WIN32)
diff --git a/core/libs/prx/libSceVrTracker2/Export.cpp b/core/libs/prx/libSceVrTracker2/Export.cpp
index 2e521f452e..f9246da310 100644
--- a/core/libs/prx/libSceVrTracker2/Export.cpp
+++ b/core/libs/prx/libSceVrTracker2/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceVrTracker2/include/Api.hpp"
+#include "prx/libSceHmd2/libSceHmd2.hpp"
+#include <atomic>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -6,34 +9,6 @@
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 
-struct VrTracker2InitializeParameter {
-    std::uint32_t size;
-    std::uint32_t mode;
-    std::int32_t threadPriorities[2];
-    std::uint64_t threadAffinityMasks[2];
-    void* workMemory;
-    std::uint32_t workMemorySize;
-    std::uint32_t workMemoryAlignment;
-    std::uint32_t option;
-    std::uint32_t coordinateSystem;
-    std::uint8_t disableOption;
-    std::int8_t optionMode;
-    std::uint8_t reserved[14];
-};
-
-struct VrTracker2MemoryParameter {
-    std::uint32_t size;
-    std::uint32_t mode;
-    std::uint8_t reserved[24];
-};
-
-struct VrTracker2MemoryRequirement {
-    std::uint32_t size;
-    std::uint32_t memorySize;
-    std::uint32_t memoryAlignment;
-    std::uint8_t reserved[20];
-};
-
 static_assert(sizeof(VrTracker2InitializeParameter) == 72);
 static_assert(offsetof(VrTracker2InitializeParameter, threadAffinityMasks) == 16);
 static_assert(offsetof(VrTracker2InitializeParameter, workMemory) == 32);
@@ -41,55 +16,14 @@ static_assert(offsetof(VrTracker2InitializeParameter, coordinateSystem) == 52);
 static_assert(offsetof(VrTracker2InitializeParameter, reserved) == 58);
 static_assert(sizeof(VrTracker2MemoryParameter) == 32);
 static_assert(sizeof(VrTracker2MemoryRequirement) == 32);
-struct VrTracker2LegacyParameter12 {
-    std::uint32_t size;
-    std::uint8_t opaque[8];
-};
-
-struct VrTracker2LegacyParameter20 {
-    std::uint32_t size;
-    std::uint8_t opaque[16];
-};
-
-struct VrTracker2UnsupportedCoordinateParameter;
 
 static_assert(sizeof(VrTracker2LegacyParameter12) == 12);
 static_assert(sizeof(VrTracker2LegacyParameter20) == 20);
 
-struct VrTracker2CalibrationResult;
-struct VrTracker2TelemetryData;
-struct VrTracker2PoseParameter;
-struct VrTracker2PoseResult;
-
-struct VrTracker2MeshRequirement {
-    std::uint32_t vertexCount;
-    std::uint32_t indexCount;
-    std::uint32_t vertexDataSize;
-    std::uint32_t indexDataSize;
-};
-
-struct VrTracker2Pose {
-    float position[3];
-    std::uint8_t padding[4];
-    float orientation[4];
-};
-
 static_assert(sizeof(VrTracker2MeshRequirement) == 16);
 static_assert(sizeof(VrTracker2Pose) == 32);
 static_assert(offsetof(VrTracker2Pose, orientation) == 16);
 
-struct VrTracker2ResultParameter {
-    std::uint32_t size;
-    std::int32_t deviceHandle;
-    std::uint32_t reserved;
-    std::uint8_t padding[4];
-    std::uint64_t timestamp;
-    std::uint32_t reserved2;
-    std::uint8_t padding2[4];
-    std::uint64_t userTag;
-    std::uint32_t reserved3[2];
-};
-
 struct VrTracker2LegacyResultParameter {
     std::uint32_t size;
     std::int32_t deviceHandle;
@@ -105,20 +39,6 @@ static_assert(offsetof(VrTracker2ResultParameter, timestamp) == 16);
 static_assert(offsetof(VrTracker2ResultParameter, userTag) == 32);
 static_assert(sizeof(VrTracker2LegacyResultParameter) == 32);
 static_assert(offsetof(VrTracker2LegacyResultParameter, userTag) == 24);
-struct VrTracker2Result;
-struct VrTracker2CoordinateLocation;
-
-struct VrTracker2BoundaryGeometry {
-    std::uint32_t size;
-    std::uint32_t pointCount;
-    float points[256][3];
-};
-
-struct VrTracker2OrientedBoundingBox {
-    std::uint32_t size;
-    float transform[16];
-    float extents[3];
-};
 
 static_assert(sizeof(VrTracker2BoundaryGeometry) == 3080);
 static_assert(offsetof(VrTracker2BoundaryGeometry, points) == 8);
@@ -130,8 +50,96 @@ namespace {
 
 constexpr std::int32_t SCE_OK = 0;
 constexpr std::int32_t VR_TRACKER2_ERROR_NOT_INITIALIZED = static_cast<std::int32_t>(0x8A740001u);
+constexpr std::int32_t VR_TRACKER2_ERROR_ALREADY_INITIALIZED = static_cast<std::int32_t>(0x8A740002u);
 constexpr std::int32_t VR_TRACKER2_ERROR_INVALID_ARGUMENT = static_cast<std::int32_t>(0x8A740006u);
 
+constexpr std::uint32_t TrackerMode = 0;
+constexpr std::uint32_t SystemTrackingMode = 1000;
+constexpr std::uint32_t SystemClientMode = 1001;
+constexpr std::uint32_t MinimumWorkMemoryAlignment = 0x10000;
+constexpr std::int32_t MinimumThreadPriority = 256;
+constexpr std::int32_t MaximumThreadPriority = 767;
+constexpr std::uint64_t TrackerAffinityLimit = 0x2000;
+constexpr std::uint64_t SystemAffinityMask = 0xEA00;
+constexpr std::uint32_t OptionModeSdkVersion = 0x7000000;
+
+std::atomic<std::uint32_t> state{0};
+
+std::uint32_t WorkMemorySize(std::uint32_t mode) {
+    if (mode == SystemTrackingMode) return 7u << 20;
+    if (mode == SystemClientMode) return 3u << 20;
+    return 32u << 20;
+}
+
+std::uint32_t CompiledSdkVersion() {
+    const auto* process = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t sdkVersion;
+    std::memcpy(&sdkVersion, process + 0x10, sizeof(sdkVersion));
+    return sdkVersion;
+}
+
+std::int32_t ValidateMode(std::uint32_t mode) {
+    if (mode == SystemTrackingMode || mode == SystemClientMode) NotImplemented_nid_no_patch("sceVrTracker2Initialize: application category of a system mode");
+    return mode == TrackerMode ? SCE_OK : VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+}
+
+bool PriorityAllowed(std::int32_t priority) {
+    return priority >= MinimumThreadPriority && priority <= MaximumThreadPriority;
+}
+
+bool AffinityAllowed(std::uint32_t mode, std::uint64_t mask) {
+    if (mode == TrackerMode) return mask < TrackerAffinityLimit;
+    return (mask & ~SystemAffinityMask) == 0;
+}
+
+bool OptionModeAllowed(std::int8_t optionMode) {
+    if (optionMode == -1 || optionMode == 0) return true;
+    return optionMode == 1 && CompiledSdkVersion() >= OptionModeSdkVersion;
+}
+
+class InitializeSession {
+public:
+    std::int32_t OpenTracking() {
+        return track(sceHmd2InternalTrackingOpen(), trackingOpened);
+    }
+
+    std::int32_t StartTracking() {
+        return track(sceHmd2InternalTrackingStart(), trackingStarted);
+    }
+
+    std::int32_t OpenLedDetector() {
+        return track(sceHmd2InternalLedDetectorOpen(), ledDetectorOpened);
+    }
+
+    std::int32_t StartLedDetector() {
+        return track(sceHmd2InternalLedDetectorStart(), ledDetectorStarted);
+    }
+
+    void Rollback() {
+        if (ledDetectorStarted) sceHmd2InternalLedDetectorStop();
+        if (ledDetectorOpened) sceHmd2InternalLedDetectorClose();
+        if (trackingStarted) sceHmd2InternalTrackingStop();
+        if (trackingOpened) sceHmd2InternalTrackingClose();
+        state.store(0);
+    }
+
+    std::int32_t Abort(std::int32_t result) {
+        Rollback();
+        return result;
+    }
+
+private:
+    static std::int32_t track(std::int32_t result, bool& done) {
+        done = result == SCE_OK;
+        return result;
+    }
+
+    bool trackingOpened = false;
+    bool trackingStarted = false;
+    bool ledDetectorOpened = false;
+    bool ledDetectorStarted = false;
+};
+
 std::int32_t ClearThenReportNotInitialized(void* output, std::size_t size) {
     if (output == nullptr) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
     std::memset(output, 0, size);
@@ -140,130 +148,30 @@ std::int32_t ClearThenReportNotInitialized(void* output, std::size_t size) {
 
 }
 
-struct VrTracker2RelativePoseResult {
-    VrTracker2Pose pose;
-    std::uint8_t reserved[32];
-};
-
 static_assert(sizeof(VrTracker2RelativePoseResult) == 64);
 
-struct VrTracker2ScalarResult {
-    std::uint32_t size;
-    float value;
-};
-
-struct VrTracker2TrackingOptions {
-    std::int32_t options[3];
-    std::uint8_t reset;
-    std::uint8_t reserved[3];
-    float vector[3];
-};
-
-struct VrTracker2TrackingOptionsResult {
-    VrTracker2TrackingOptions options;
-    float position[3];
-};
-
-struct VrTracker2DiagnosticResult;
-struct VrTracker2ExtendedResult;
-struct VrTracker2TrackingConfiguration;
-
 static_assert(sizeof(VrTracker2ScalarResult) == 8);
 static_assert(sizeof(VrTracker2TrackingOptions) == 28);
 static_assert(offsetof(VrTracker2TrackingOptions, vector) == 16);
 static_assert(sizeof(VrTracker2TrackingOptionsResult) == 40);
 static_assert(offsetof(VrTracker2TrackingOptionsResult, position) == 28);
 
-struct VrTracker2ModeParameter {
-    std::uint32_t size;
-    std::uint32_t mode;
-    float value;
-};
-
-struct VrTracker2DiagnosticText {
-    char sections[6][512];
-};
-
-struct VrTracker2CompositePoseResult;
-struct VrTracker2CameraImages;
-struct VrTracker2SensorFrame;
-struct VrTracker2TrackingStatus;
-struct VrTracker2BoundaryParameter;
-
 static_assert(sizeof(VrTracker2ModeParameter) == 12);
 static_assert(sizeof(VrTracker2DiagnosticText) == 3072);
 
-struct VrTracker2CameraFrame {
-    std::uint32_t selector;
-    std::uint32_t identifiers[2];
-    std::uint32_t width;
-    std::uint32_t height;
-    std::uint32_t pitch;
-    const void* pixels;
-    std::int32_t bufferIndex;
-};
-
-struct VrTracker2CameraFrameMetadata;
-
 static_assert(offsetof(VrTracker2CameraFrame, pixels) == 24);
 static_assert(offsetof(VrTracker2CameraFrame, bufferIndex) == 32);
 static_assert(sizeof(VrTracker2CameraFrame) == 40);
 
-struct VrTracker2SpatialQueryResult {
-    std::uint32_t size;
-    std::int32_t status;
-    float vectors[2][3];
-    float value;
-};
-
-struct VrTracker2DeviceCalibrationStatus;
-struct VrTracker2DeviceBoundaryParameter;
-struct VrTracker2ResetPoseParameter;
-
 static_assert(sizeof(VrTracker2SpatialQueryResult) == 36);
 static_assert(offsetof(VrTracker2SpatialQueryResult, vectors) == 8);
 static_assert(offsetof(VrTracker2SpatialQueryResult, value) == 32);
 
-struct VrTracker2MapData;
-struct VrTracker2MapStatus;
-
-struct VrTracker2RuntimeStatus;
-struct VrTracker2DiagnosticState;
-struct VrTracker2ExtendedDiagnosticState;
-struct VrTracker2SensorDiagnostics;
-struct VrTracker2DeviceDiagnostics;
-struct VrTracker2TimingDiagnostics;
-struct VrTracker2MapConfiguration;
-struct VrTracker2SensorSummary;
-
-struct VrTracker2CoordinateResultParameter {
-    std::uint32_t coordinateSystem;
-    std::uint32_t reserved;
-    VrTracker2ResultParameter parameter;
-};
-
-struct VrTracker2BoundaryFitResult {
-    std::uint8_t flags[4];
-    float dimensions[4];
-};
-
-struct VrTracker2VectorResult {
-    std::uint32_t size;
-    float value[3];
-};
-
-struct VrTracker2ExtendedTrackingResult;
-
 static_assert(sizeof(VrTracker2CoordinateResultParameter) == 56);
 static_assert(offsetof(VrTracker2CoordinateResultParameter, parameter) == 8);
 static_assert(sizeof(VrTracker2BoundaryFitResult) == 20);
 static_assert(sizeof(VrTracker2VectorResult) == 16);
 
-struct VrTracker2MeshVertex;
-struct VrTracker2TimedPoseResult;
-struct VrTracker2ImagePoseResult;
-struct VrTracker2ImageFrame;
-
 extern "C" {
 
 std::int32_t APS5_VABI sceVrTracker2Finalize() {
@@ -309,16 +217,12 @@ std::int32_t APS5_VABI sceVrTracker2UnregisterDevice(std::int32_t deviceHandle)
 std::int32_t APS5_VABI sceVrTracker2QueryMemory(const VrTracker2MemoryParameter* parameter, VrTracker2MemoryRequirement* requirement) {
     if (parameter == nullptr || requirement == nullptr) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
     if (parameter->size != sizeof(VrTracker2MemoryParameter)) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
-    std::uint32_t memorySize = 32u << 20;
-    if (parameter->mode == 1000 || parameter->mode == 1001) {
-        const auto* process = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
-        std::uint32_t sdkVersion;
-        std::memcpy(&sdkVersion, process + 0x10, sizeof(sdkVersion));
-        if (sdkVersion < 0x1000000) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
-        memorySize = parameter->mode == 1000 ? 7u << 20 : 3u << 20;
-    } else if (parameter->mode != 0) {
+    if (parameter->mode == SystemTrackingMode || parameter->mode == SystemClientMode) {
+        if (CompiledSdkVersion() < 0x1000000) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    } else if (parameter->mode != TrackerMode) {
         return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
     }
+    const std::uint32_t memorySize = WorkMemorySize(parameter->mode);
     for (const auto value : parameter->reserved)
         if (value != 0) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
     *requirement = {sizeof(VrTracker2MemoryRequirement), memorySize, 64u << 10, {}};
@@ -326,6 +230,30 @@ std::int32_t APS5_VABI sceVrTracker2QueryMemory(const VrTracker2MemoryParameter*
 }
 
 std::int32_t APS5_VABI sceVrTracker2Initialize(const VrTracker2InitializeParameter* parameter) {
+    if (parameter == nullptr || parameter->size != sizeof(VrTracker2InitializeParameter)) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    const std::uint32_t mode = parameter->mode;
+    if (const std::int32_t result = ValidateMode(mode); result != SCE_OK) return result;
+    if (parameter->workMemory == nullptr) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    if (parameter->workMemorySize < WorkMemorySize(mode)) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    if (parameter->workMemoryAlignment < MinimumWorkMemoryAlignment) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    for (const auto value : parameter->reserved)
+        if (value != 0) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    for (const auto priority : parameter->threadPriorities)
+        if (!PriorityAllowed(priority)) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    for (const auto mask : parameter->threadAffinityMasks)
+        if (!AffinityAllowed(mode, mask)) return VR_TRACKER2_ERROR_INVALID_ARGUMENT;
+    std::uint32_t expected = 0;
+    if (!state.compare_exchange_strong(expected, 1)) return VR_TRACKER2_ERROR_ALREADY_INITIALIZED;
+    InitializeSession session;
+    if (mode == TrackerMode) std::memset(parameter->workMemory, 0, WorkMemorySize(mode));
+    if (mode != SystemClientMode) {
+        if (!OptionModeAllowed(parameter->optionMode)) return session.Abort(VR_TRACKER2_ERROR_INVALID_ARGUMENT);
+        if (const std::int32_t result = session.OpenTracking(); result != SCE_OK) return session.Abort(result);
+        if (const std::int32_t result = session.StartTracking(); result != SCE_OK) return session.Abort(result);
+        if (const std::int32_t result = session.OpenLedDetector(); result != SCE_OK) return session.Abort(result);
+        if (const std::int32_t result = session.StartLedDetector(); result != SCE_OK) return session.Abort(result);
+    }
+    session.Rollback();
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceVrTracker2/include/Api.hpp b/core/libs/prx/libSceVrTracker2/include/Api.hpp
new file mode 100644
index 0000000000..871f89b821
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker2/include/Api.hpp
@@ -0,0 +1,310 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+
+struct VrTracker2InitializeParameter {
+    std::uint32_t size;
+    std::uint32_t mode;
+    std::int32_t threadPriorities[2];
+    std::uint64_t threadAffinityMasks[2];
+    void* workMemory;
+    std::uint32_t workMemorySize;
+    std::uint32_t workMemoryAlignment;
+    std::uint32_t option;
+    std::uint32_t coordinateSystem;
+    std::uint8_t disableOption;
+    std::int8_t optionMode;
+    std::uint8_t reserved[14];
+};
+
+struct VrTracker2MemoryParameter {
+    std::uint32_t size;
+    std::uint32_t mode;
+    std::uint8_t reserved[24];
+};
+
+struct VrTracker2MemoryRequirement {
+    std::uint32_t size;
+    std::uint32_t memorySize;
+    std::uint32_t memoryAlignment;
+    std::uint8_t reserved[20];
+};
+
+struct VrTracker2LegacyParameter12 {
+    std::uint32_t size;
+    std::uint8_t opaque[8];
+};
+
+struct VrTracker2LegacyParameter20 {
+    std::uint32_t size;
+    std::uint8_t opaque[16];
+};
+
+struct VrTracker2UnsupportedCoordinateParameter;
+
+struct VrTracker2CalibrationResult;
+
+struct VrTracker2TelemetryData;
+
+struct VrTracker2PoseParameter;
+
+struct VrTracker2PoseResult;
+
+struct VrTracker2MeshRequirement {
+    std::uint32_t vertexCount;
+    std::uint32_t indexCount;
+    std::uint32_t vertexDataSize;
+    std::uint32_t indexDataSize;
+};
+
+struct VrTracker2Pose {
+    float position[3];
+    std::uint8_t padding[4];
+    float orientation[4];
+};
+
+struct VrTracker2ResultParameter {
+    std::uint32_t size;
+    std::int32_t deviceHandle;
+    std::uint32_t reserved;
+    std::uint8_t padding[4];
+    std::uint64_t timestamp;
+    std::uint32_t reserved2;
+    std::uint8_t padding2[4];
+    std::uint64_t userTag;
+    std::uint32_t reserved3[2];
+};
+
+struct VrTracker2Result;
+
+struct VrTracker2CoordinateLocation;
+
+struct VrTracker2BoundaryGeometry {
+    std::uint32_t size;
+    std::uint32_t pointCount;
+    float points[256][3];
+};
+
+struct VrTracker2OrientedBoundingBox {
+    std::uint32_t size;
+    float transform[16];
+    float extents[3];
+};
+
+struct VrTracker2RelativePoseResult {
+    VrTracker2Pose pose;
+    std::uint8_t reserved[32];
+};
+
+struct VrTracker2ScalarResult {
+    std::uint32_t size;
+    float value;
+};
+
+struct VrTracker2TrackingOptions {
+    std::int32_t options[3];
+    std::uint8_t reset;
+    std::uint8_t reserved[3];
+    float vector[3];
+};
+
+struct VrTracker2TrackingOptionsResult {
+    VrTracker2TrackingOptions options;
+    float position[3];
+};
+
+struct VrTracker2DiagnosticResult;
+
+struct VrTracker2ExtendedResult;
+
+struct VrTracker2TrackingConfiguration;
+
+struct VrTracker2ModeParameter {
+    std::uint32_t size;
+    std::uint32_t mode;
+    float value;
+};
+
+struct VrTracker2DiagnosticText {
+    char sections[6][512];
+};
+
+struct VrTracker2CompositePoseResult;
+
+struct VrTracker2CameraImages;
+
+struct VrTracker2SensorFrame;
+
+struct VrTracker2TrackingStatus;
+
+struct VrTracker2BoundaryParameter;
+
+struct VrTracker2CameraFrame {
+    std::uint32_t selector;
+    std::uint32_t identifiers[2];
+    std::uint32_t width;
+    std::uint32_t height;
+    std::uint32_t pitch;
+    const void* pixels;
+    std::int32_t bufferIndex;
+};
+
+struct VrTracker2CameraFrameMetadata;
+
+struct VrTracker2SpatialQueryResult {
+    std::uint32_t size;
+    std::int32_t status;
+    float vectors[2][3];
+    float value;
+};
+
+struct VrTracker2DeviceCalibrationStatus;
+
+struct VrTracker2DeviceBoundaryParameter;
+
+struct VrTracker2ResetPoseParameter;
+
+struct VrTracker2MapData;
+
+struct VrTracker2MapStatus;
+
+struct VrTracker2RuntimeStatus;
+
+struct VrTracker2DiagnosticState;
+
+struct VrTracker2ExtendedDiagnosticState;
+
+struct VrTracker2SensorDiagnostics;
+
+struct VrTracker2DeviceDiagnostics;
+
+struct VrTracker2TimingDiagnostics;
+
+struct VrTracker2MapConfiguration;
+
+struct VrTracker2SensorSummary;
+
+struct VrTracker2CoordinateResultParameter {
+    std::uint32_t coordinateSystem;
+    std::uint32_t reserved;
+    VrTracker2ResultParameter parameter;
+};
+
+struct VrTracker2BoundaryFitResult {
+    std::uint8_t flags[4];
+    float dimensions[4];
+};
+
+struct VrTracker2VectorResult {
+    std::uint32_t size;
+    float value[3];
+};
+
+struct VrTracker2ExtendedTrackingResult;
+
+struct VrTracker2MeshVertex;
+
+struct VrTracker2TimedPoseResult;
+
+struct VrTracker2ImagePoseResult;
+
+struct VrTracker2ImageFrame;
+
+extern "C" {
+
+std::int32_t APS5_VABI sceVrTracker2Finalize();
+std::int32_t APS5_VABI sceVrTracker2GetCoordinateSystem(std::uint32_t* coordinateSystem);
+std::int32_t APS5_VABI sceVrTracker2GetPlayAreaBoundaryGeometry(VrTracker2BoundaryGeometry* geometry);
+std::int32_t APS5_VABI sceVrTracker2GetPlayAreaOrientedBoundingBox(VrTracker2OrientedBoundingBox* box);
+std::int32_t APS5_VABI sceVrTracker2GetResult(const VrTracker2ResultParameter* parameter, VrTracker2Result* result);
+std::int32_t APS5_VABI sceVrTracker2LocateCoordinateSystem(std::uint32_t coordinateSystem, VrTracker2CoordinateLocation* location);
+std::int32_t APS5_VABI sceVrTracker2RegisterDevice(std::uint32_t deviceType, std::int32_t deviceHandle);
+std::int32_t APS5_VABI sceVrTracker2ResetLocalCoordinate(std::int32_t deviceHandle);
+std::int32_t APS5_VABI sceVrTracker2SetCoordinateSystem(std::uint32_t coordinateSystem);
+std::int32_t APS5_VABI sceVrTracker2UnregisterDevice(std::int32_t deviceHandle);
+std::int32_t APS5_VABI sceVrTracker2QueryMemory(const VrTracker2MemoryParameter* parameter, VrTracker2MemoryRequirement* requirement);
+std::int32_t APS5_VABI sceVrTracker2Initialize(const VrTracker2InitializeParameter* parameter);
+std::int32_t APS5_VABI VrTracker2GetRelativePose(std::uint32_t firstCoordinateSystem, std::uint32_t secondCoordinateSystem, VrTracker2RelativePoseResult* result);
+std::int32_t APS5_VABI VrTracker2GetDiagnosticResult(VrTracker2DiagnosticResult* result);
+std::int32_t APS5_VABI VrTracker2SetTrackingOptions(const VrTracker2TrackingOptions* options);
+std::int32_t APS5_VABI VrTracker2GetTrackingOptions(VrTracker2TrackingOptionsResult* result);
+std::int32_t APS5_VABI VrTracker2GetExtendedResult(VrTracker2ExtendedResult* result);
+std::int32_t APS5_VABI VrTracker2GetCompositePose(const VrTracker2ResultParameter* parameter, VrTracker2CompositePoseResult* result);
+std::int32_t APS5_VABI VrTracker2GetCounter(std::uint64_t* counter, std::uint32_t selector);
+std::int32_t APS5_VABI VrTracker2SetTrackingConfiguration(const VrTracker2TrackingConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2GetTrackingConfiguration(VrTracker2TrackingConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2GetCameraImages(VrTracker2CameraImages* images);
+std::int32_t APS5_VABI VrTracker2GetCameraImage(void* image, std::uint32_t size, std::uint32_t* frameId);
+std::int32_t APS5_VABI VrTracker2GetDiagnosticText(VrTracker2DiagnosticText* text);
+std::int32_t APS5_VABI VrTracker2GetSensorFrame(VrTracker2SensorFrame* frame);
+std::int32_t APS5_VABI VrTracker2GetTrackingStatus(VrTracker2TrackingStatus* status);
+std::int32_t APS5_VABI VrTracker2GetBoundaryParameter(VrTracker2BoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2SetBoundaryParameter(const VrTracker2BoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2SetMode(const VrTracker2ModeParameter* parameter);
+std::int32_t APS5_VABI VrTracker2GetScalarResult(VrTracker2ScalarResult* result);
+std::int32_t APS5_VABI VrTracker2LegacyQuery12(const VrTracker2LegacyParameter12* parameter);
+std::int32_t APS5_VABI VrTracker2LegacyQuery20(const VrTracker2LegacyParameter20* parameter);
+std::int32_t APS5_VABI VrTracker2UnsupportedCoordinateOperation(const VrTracker2UnsupportedCoordinateParameter* parameter);
+std::int32_t APS5_VABI VrTracker2AcquireCameraFrame(std::uint32_t selector, VrTracker2CameraFrame* frame);
+std::int32_t APS5_VABI VrTracker2AcquireCameraFrameWithMetadata(std::uint32_t selector, VrTracker2CameraFrame* frame, VrTracker2CameraFrameMetadata* metadata);
+std::int32_t APS5_VABI VrTracker2ReleaseCameraFrame(const VrTracker2CameraFrame* frame);
+std::int32_t APS5_VABI VrTracker2SetScalarOption(float value);
+std::int32_t APS5_VABI VrTracker2GetScalarOption(float* value);
+std::int32_t APS5_VABI VrTracker2SelectCoordinateSystem(std::uint32_t coordinateSystem);
+std::int32_t APS5_VABI VrTracker2GetSelectedCoordinateSystem(std::uint32_t* coordinateSystem);
+std::int32_t APS5_VABI VrTracker2ResetDevicePose(std::int32_t deviceHandle);
+std::int32_t APS5_VABI VrTracker2ResetPose(const VrTracker2ResetPoseParameter* parameter);
+std::int32_t APS5_VABI VrTracker2QueryPosition(const float* position, VrTracker2SpatialQueryResult* result);
+std::int32_t APS5_VABI VrTracker2QueryDevicePosition(std::int32_t deviceHandle, VrTracker2SpatialQueryResult* result);
+std::int32_t APS5_VABI VrTracker2GetTrackingBounds(VrTracker2OrientedBoundingBox* bounds);
+std::int32_t APS5_VABI VrTracker2GetDeviceState(std::int32_t deviceHandle, std::int32_t* state);
+std::int32_t APS5_VABI VrTracker2GetDeviceCalibrationStatus(std::int32_t deviceHandle, VrTracker2DeviceCalibrationStatus* status);
+std::int32_t APS5_VABI VrTracker2SetDeviceBoundary(std::int32_t deviceHandle, std::int32_t selector, const VrTracker2DeviceBoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2GetDeviceBoundary(std::int32_t deviceHandle, std::int32_t selector, VrTracker2DeviceBoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2ApplyDeviceBoundary(std::int32_t deviceHandle, std::int32_t selector);
+std::int32_t APS5_VABI VrTracker2GetDeviceMapState(std::int32_t deviceHandle, std::int32_t* state);
+std::int32_t APS5_VABI VrTracker2InitializeMap(std::int32_t deviceHandle, const float* parameter);
+std::int32_t APS5_VABI VrTracker2GetCoordinateTrackingResult(const VrTracker2CoordinateResultParameter* parameter, VrTracker2ExtendedTrackingResult* result);
+std::int32_t APS5_VABI VrTracker2GetExtendedTrackingResult(const VrTracker2ResultParameter* parameter, VrTracker2ExtendedTrackingResult* result);
+std::int32_t APS5_VABI VrTracker2FitBoundary(const VrTracker2BoundaryGeometry* boundary, VrTracker2BoundaryFitResult* result);
+std::int32_t APS5_VABI VrTracker2FitBoundaryWithBounds(const VrTracker2BoundaryGeometry* boundary, VrTracker2OrientedBoundingBox* firstBounds, VrTracker2OrientedBoundingBox* secondBounds, VrTracker2BoundaryFitResult* result);
+std::int32_t APS5_VABI VrTracker2GetDeviceCenter(std::int32_t deviceHandle, VrTracker2VectorResult* result);
+std::int32_t APS5_VABI VrTracker2GetRuntimeStatus(VrTracker2RuntimeStatus* status);
+std::int32_t APS5_VABI VrTracker2GetTrackingFlags(bool* active, std::uint8_t* flags);
+std::int32_t APS5_VABI VrTracker2GetDiagnosticState(VrTracker2DiagnosticState* state);
+std::int32_t APS5_VABI VrTracker2GetExtendedDiagnosticState(VrTracker2ExtendedDiagnosticState* state);
+std::int32_t APS5_VABI VrTracker2GetSensorDiagnostics(VrTracker2SensorDiagnostics* diagnostics);
+std::int32_t APS5_VABI VrTracker2GetDeviceDiagnostics(VrTracker2DeviceDiagnostics* diagnostics);
+std::int32_t APS5_VABI VrTracker2GetTimingDiagnostics(VrTracker2TimingDiagnostics* diagnostics);
+std::int32_t APS5_VABI VrTracker2GetMapConfiguration(VrTracker2MapConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2SetMapConfiguration(const VrTracker2MapConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2GetMapStatus(VrTracker2MapStatus* status);
+std::int32_t APS5_VABI VrTracker2BuildMesh(VrTracker2MeshVertex* vertices, std::uint16_t* indices, std::uint32_t format);
+std::int32_t APS5_VABI VrTracker2GetMapScalar(float* value, const VrTracker2MapData* data);
+std::int32_t APS5_VABI VrTracker2GetTimedPose(VrTracker2TimedPoseResult* result, std::uint64_t timestamp, std::uint64_t userTag);
+std::int32_t APS5_VABI VrTracker2GetMapData(VrTracker2MapData* data, std::uint32_t size);
+std::int32_t APS5_VABI VrTracker2GetPoseScalar(float* value);
+std::int32_t APS5_VABI VrTracker2SubmitImageFrame(const VrTracker2ImageFrame* frame);
+std::int32_t APS5_VABI VrTracker2GetImagePose(VrTracker2ImagePoseResult* result);
+std::int32_t APS5_VABI VrTracker2GetSensorSummary(VrTracker2SensorSummary* summary);
+std::int32_t APS5_VABI VrTracker2NotInitialized();
+std::int32_t APS5_VABI VrTracker2ClearWideResult(void* result);
+std::int32_t APS5_VABI VrTracker2ClearNarrowResult(void* result);
+std::int32_t APS5_VABI VrTracker2CheckSecondThenReportNotInitialized(const void* first, const void* second);
+std::int32_t APS5_VABI VrTracker2Accept();
+std::int32_t APS5_VABI VrTracker2FillDefaults(void* output);
+std::int32_t APS5_VABI VrTracker2ClearWord(void* output);
+std::int32_t APS5_VABI VrTracker2Unknown01(VrTracker2CalibrationResult* result, std::uint32_t capacity);
+std::int32_t APS5_VABI VrTracker2Unknown02(VrTracker2MeshRequirement* requirement, std::uint32_t format);
+std::int32_t APS5_VABI VrTracker2Unknown03(std::uint32_t mode, void* output, std::size_t capacity, std::size_t* writtenSize);
+std::int32_t APS5_VABI VrTracker2Unknown04(const VrTracker2ResultParameter* parameter, VrTracker2Result* result);
+std::int32_t APS5_VABI VrTracker2Unknown05(VrTracker2Pose* pose, std::uint64_t coordinateId);
+std::int32_t APS5_VABI VrTracker2Unknown06(const VrTracker2TelemetryData* data);
+std::int32_t APS5_VABI VrTracker2Unknown07(const VrTracker2PoseParameter* parameter, VrTracker2PoseResult* result);
+
+}
diff --git a/core/libs/prx/libSceVrTracker2/libSceVrTracker2.hpp b/core/libs/prx/libSceVrTracker2/libSceVrTracker2.hpp
new file mode 100644
index 0000000000..667a8cf90f
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker2/libSceVrTracker2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrTracker2/include/Api.hpp"
diff --git a/core/libs/prx/libSceWeb/libSceWeb.hpp b/core/libs/prx/libSceWeb/libSceWeb.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWeb/libSceWeb.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWebBrowserDialog/Export.cpp b/core/libs/prx/libSceWebBrowserDialog/Export.cpp
index 3b8080508c..d5961d6211 100644
--- a/core/libs/prx/libSceWebBrowserDialog/Export.cpp
+++ b/core/libs/prx/libSceWebBrowserDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -6,18 +7,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct WebBrowserDialogCookieParam {
-    std::uint64_t size;
-    const char* address;
-    const char* cookie;
-    std::uint8_t reserved[256];
-};
-
-struct WebBrowserDialogResetCookieParam {
-    std::uint64_t size;
-    std::uint8_t reserved[256];
-};
-
 static_assert(sizeof(WebBrowserDialogCookieParam) == 280);
 static_assert(offsetof(WebBrowserDialogCookieParam, address) == 8);
 static_assert(offsetof(WebBrowserDialogCookieParam, cookie) == 16);
@@ -120,7 +109,6 @@ int APS5_VABI sceWebBrowserDialogUpdateStatus(void) {
     return status;
 }
 
-
 int APS5_VABI sceWebBrowserDialogSetCookie(const WebBrowserDialogCookieParam* param) {
     if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     if (g_open.load()) return COMMON_DIALOG_ERROR_INVALID_STATE;
diff --git a/core/libs/prx/libSceWebBrowserDialog/include/Api.hpp b/core/libs/prx/libSceWebBrowserDialog/include/Api.hpp
new file mode 100644
index 0000000000..e291592e7f
--- /dev/null
+++ b/core/libs/prx/libSceWebBrowserDialog/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+struct WebBrowserDialogCookieParam {
+    std::uint64_t size;
+    const char* address;
+    const char* cookie;
+    std::uint8_t reserved[256];
+};
+
+struct WebBrowserDialogResetCookieParam {
+    std::uint64_t size;
+    std::uint8_t reserved[256];
+};
+
+extern "C" {
+
+int APS5_VABI sceWebBrowserDialogInitialize(void);
+int APS5_VABI sceWebBrowserDialogTerminate(void);
+int APS5_VABI sceWebBrowserDialogClose(void);
+int APS5_VABI sceWebBrowserDialogGetResult(WebBrowserDialogResult* result);
+int APS5_VABI sceWebBrowserDialogGetStatus(void);
+int APS5_VABI sceWebBrowserDialogOpen(const void* param);
+int APS5_VABI sceWebBrowserDialogUpdateStatus(void);
+int APS5_VABI sceWebBrowserDialogSetCookie(const WebBrowserDialogCookieParam* param);
+int APS5_VABI sceWebBrowserDialogOpenForPredeterminedContent(const void* param, const WebBrowserDialogAllowList* allowList);
+int APS5_VABI sceWebBrowserDialogResetCookie(const WebBrowserDialogResetCookieParam* param);
+int APS5_VABI sceWebBrowserDialogGetEvent();
+int APS5_VABI sceWebBrowserDialogNavigate();
+int APS5_VABI sceWebBrowserDialogSetZoom();
+
+}
diff --git a/core/libs/prx/libSceWebBrowserDialog/libSceWebBrowserDialog.hpp b/core/libs/prx/libSceWebBrowserDialog/libSceWebBrowserDialog.hpp
new file mode 100644
index 0000000000..d9b740e440
--- /dev/null
+++ b/core/libs/prx/libSceWebBrowserDialog/libSceWebBrowserDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceWebKit2/libSceWebKit2.hpp b/core/libs/prx/libSceWebKit2/libSceWebKit2.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWebKit2/libSceWebKit2.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWebKit2Secure/libSceWebKit2Secure.hpp b/core/libs/prx/libSceWebKit2Secure/libSceWebKit2Secure.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWebKit2Secure/libSceWebKit2Secure.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWebmParserMdrw/libSceWebmParserMdrw.hpp b/core/libs/prx/libSceWebmParserMdrw/libSceWebmParserMdrw.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWebmParserMdrw/libSceWebmParserMdrw.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWkFontConfig/Export.cpp b/core/libs/prx/libSceWkFontConfig/Export.cpp
index 08ae01f5ec..7257bc7ef7 100644
--- a/core/libs/prx/libSceWkFontConfig/Export.cpp
+++ b/core/libs/prx/libSceWkFontConfig/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceWkFontConfig/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceWkFontConfig/include/Api.hpp b/core/libs/prx/libSceWkFontConfig/include/Api.hpp
new file mode 100644
index 0000000000..94402813b4
--- /dev/null
+++ b/core/libs/prx/libSceWkFontConfig/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceWkFontConfigGetAttr(void);
+int APS5_VABI sceWkFontConfigGetFont(void);
+int APS5_VABI sceWkFontConfigGetFontFromFontName(void);
+int APS5_VABI sceWkFontConfigGetFontName(void);
+int APS5_VABI sceWkFontConfigGetFontPath(void);
+
+}
diff --git a/core/libs/prx/libSceWkFontConfig/libSceWkFontConfig.hpp b/core/libs/prx/libSceWkFontConfig/libSceWkFontConfig.hpp
new file mode 100644
index 0000000000..0d45867b73
--- /dev/null
+++ b/core/libs/prx/libSceWkFontConfig/libSceWkFontConfig.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceWkFontConfig/include/Api.hpp"
diff --git a/core/libs/prx/libSceWorkspace/libSceWorkspace.hpp b/core/libs/prx/libSceWorkspace/libSceWorkspace.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWorkspace/libSceWorkspace.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceXml/libSceXml.hpp b/core/libs/prx/libSceXml/libSceXml.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceXml/libSceXml.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceZlib/Export.cpp b/core/libs/prx/libSceZlib/Export.cpp
index 093a5401d2..f908068b6b 100644
--- a/core/libs/prx/libSceZlib/Export.cpp
+++ b/core/libs/prx/libSceZlib/Export.cpp
@@ -1,33 +1,39 @@
+#include "prx/libSceZlib/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "zlib.h"
+#include <chrono>
+#include <condition_variable>
 #include <cstdint>
+#include <deque>
 #include <limits>
 #include <mutex>
-#include <optional>
 #include <stdexcept>
+#include <unordered_map>
 
 namespace {
 
 static_assert(sizeof(std::uint32_t) == 4 && sizeof(std::uint64_t) == 8 && sizeof(std::int32_t) == 4);
 
+constexpr std::int32_t NOT_FOUND = static_cast<std::int32_t>(0x81120002);
 constexpr std::int32_t NOT_INITIALIZED = static_cast<std::int32_t>(0x81120032);
 constexpr std::int32_t ALREADY_INITIALIZED = static_cast<std::int32_t>(0x81120033);
+constexpr std::int32_t TIMED_OUT = static_cast<std::int32_t>(0x81120027);
 constexpr std::int32_t NO_SPACE = static_cast<std::int32_t>(0x8112001C);
 constexpr std::int32_t INVALID_ARGUMENT = static_cast<std::int32_t>(0x81120016);
-constexpr std::int32_t NOT_FOUND = static_cast<std::int32_t>(0x81120002);
 constexpr std::int32_t FATAL = static_cast<std::int32_t>(0x811200FF);
 
-struct Result {
-    std::uint64_t id;
+struct InflateResult {
     std::uint32_t produced;
     std::int32_t status;
-    bool retrieved = false;
 };
 
 std::mutex serviceMutex;
 bool initialized = false;
 std::uint64_t nextId = 1;
-std::optional<Result> result;
+std::uint64_t session = 0;
+std::unordered_map<std::uint64_t, InflateResult> results;
+std::deque<std::uint64_t> completed;
+std::condition_variable completion;
 
 } // namespace
 
@@ -45,8 +51,11 @@ std::int32_t APS5_VABI sceZlibInitialize(const void* buffer, std::uint64_t lengt
 std::int32_t APS5_VABI sceZlibFinalize() {
     std::lock_guard lock(serviceMutex);
     if (!initialized) return NOT_INITIALIZED;
-    result.reset();
+    results.clear();
+    completed.clear();
     initialized = false;
+    ++session;
+    completion.notify_all();
     return 0;
 }
 
@@ -57,7 +66,6 @@ std::int32_t APS5_VABI sceZlibInflate(const void* source, std::uint32_t sourceLe
         destinationLength > 65536 || destinationLength % 2048 != 0) return INVALID_ARGUMENT;
     if (reinterpret_cast<std::uintptr_t>(destination) % 2048 != 0)
         throw std::runtime_error("sceZlibInflate: unaligned destination driver behavior is not implemented");
-    if (result && !result->retrieved) throw std::runtime_error("sceZlibInflate: multiple outstanding requests unsupported");
     if (nextId == std::numeric_limits<std::uint64_t>::max()) throw std::runtime_error("sceZlibInflate: request IDs exhausted");
     z_stream stream{};
     stream.next_in = const_cast<Bytef*>(static_cast<const Bytef*>(source));
@@ -71,18 +79,25 @@ std::int32_t APS5_VABI sceZlibInflate(const void* source, std::uint32_t sourceLe
         (decoded == Z_BUF_ERROR && stream.avail_out == 0 && stream.avail_in != 0 ? NO_SPACE : FATAL);
     const int ended = inflateEnd(&stream);
     if (ended != Z_OK) throw std::runtime_error("sceZlibInflate: decoder cleanup failed");
-    result = Result{nextId++, produced, status};
-    *requestId = result->id;
+    const std::uint64_t id = nextId++;
+    results[id] = InflateResult{produced, status};
+    completed.push_back(id);
+    completion.notify_one();
+    *requestId = id;
     return 0;
 }
 
 std::int32_t APS5_VABI sceZlibWaitForDone(std::uint64_t* requestId, std::uint32_t* timeout) {
-    std::lock_guard lock(serviceMutex);
+    std::unique_lock lock(serviceMutex);
     if (!initialized) return NOT_INITIALIZED;
     if (!requestId) return INVALID_ARGUMENT;
-    if (timeout) throw std::runtime_error("sceZlibWaitForDone: timeout semantics unknown");
-    if (!result || result->retrieved) throw std::runtime_error("sceZlibWaitForDone: no outstanding request");
-    *requestId = result->id;
+    const std::uint64_t waitSession = session;
+    const auto finished = [waitSession] { return !completed.empty() || session != waitSession; };
+    if (!timeout) completion.wait(lock, finished);
+    else if (!completion.wait_for(lock, std::chrono::microseconds(*timeout), finished)) return TIMED_OUT;
+    if (session != waitSession) throw std::runtime_error("sceZlibWaitForDone: finalization during a wait semantics unknown");
+    *requestId = completed.front();
+    completed.pop_front();
     return 0;
 }
 
@@ -90,11 +105,10 @@ std::int32_t APS5_VABI sceZlibGetResult(std::uint64_t requestId, std::uint32_t*
     std::lock_guard lock(serviceMutex);
     if (!initialized) return NOT_INITIALIZED;
     if (!destinationLength || !status) return INVALID_ARGUMENT;
-    if (!result || result->id != requestId) return NOT_FOUND;
-    if (result->retrieved) throw std::runtime_error("sceZlibGetResult: repeated retrieval semantics unknown");
-    *destinationLength = result->produced;
-    *status = result->status;
-    result->retrieved = true;
+    const auto found = results.find(requestId);
+    if (found == results.end()) return NOT_FOUND;
+    *destinationLength = found->second.produced;
+    *status = found->second.status;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceZlib/include/Api.hpp b/core/libs/prx/libSceZlib/include/Api.hpp
new file mode 100644
index 0000000000..ec57e94915
--- /dev/null
+++ b/core/libs/prx/libSceZlib/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+std::int32_t APS5_VABI sceZlibInitialize(const void* buffer, std::uint64_t length);
+std::int32_t APS5_VABI sceZlibFinalize();
+std::int32_t APS5_VABI sceZlibInflate(const void* source, std::uint32_t sourceLength, void* destination, std::uint32_t destinationLength, std::uint64_t* requestId);
+std::int32_t APS5_VABI sceZlibWaitForDone(std::uint64_t* requestId, std::uint32_t* timeout);
+std::int32_t APS5_VABI sceZlibGetResult(std::uint64_t requestId, std::uint32_t* destinationLength, std::int32_t* status);
+
+}
diff --git a/core/libs/prx/libSceZlib/libSceZlib.hpp b/core/libs/prx/libSceZlib/libSceZlib.hpp
new file mode 100644
index 0000000000..2740f392a8
--- /dev/null
+++ b/core/libs/prx/libSceZlib/libSceZlib.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceZlib/include/Api.hpp"
diff --git a/core/libs/prx/libc/CMakeLists.txt b/core/libs/prx/libc/CMakeLists.txt
index 64732c9cf2..2fb827e104 100644
--- a/core/libs/prx/libc/CMakeLists.txt
+++ b/core/libs/prx/libc/CMakeLists.txt
@@ -115,19 +115,56 @@ target_include_directories(libc PRIVATE
 
 target_link_libraries(libc PRIVATE zarchive)
 
+if(BUILD_TESTING)
+    add_test_executable(guest_update_env_tests ${LIBS_INCLUDE_DIR}/tests/GuestUpdateEnv.cpp)
+    target_include_directories(guest_update_env_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_update_env_tests PRIVATE libc ${CMAKE_DL_LIBS})
+    configure_windows_unwind(guest_update_env_tests)
+    add_test(NAME guest_update_env COMMAND guest_update_env_tests $<TARGET_FILE:libc>)
+    foreach(bit RANGE 0 5)
+        foreach(source RANGE 0 2)
+            add_test(NAME guest_update_env_pending_${bit}_${source} COMMAND guest_update_env_tests $<TARGET_FILE:libc> ${bit} ${source})
+            set_tests_properties(guest_update_env_pending_${bit}_${source} PROPERTIES TIMEOUT 10)
+            if(WIN32)
+                set_tests_properties(guest_update_env_pending_${bit}_${source} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+            endif()
+        endforeach()
+    endforeach()
+    if(WIN32)
+        set_tests_properties(guest_update_env PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 target_sources(libc PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src/FloatingPoint.cpp)
 
 if(BUILD_TESTING)
     add_test_executable(guest_floating_point_tests ${LIBS_INCLUDE_DIR}/tests/GuestFloatingPoint.cpp)
     target_include_directories(guest_floating_point_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_floating_point_tests PRIVATE libc)
+    target_link_libraries(guest_floating_point_tests PRIVATE libc ${CMAKE_DL_LIBS})
     configure_windows_unwind(guest_floating_point_tests)
-    add_test(NAME guest_floating_point COMMAND guest_floating_point_tests)
+    add_test(NAME guest_floating_point COMMAND guest_floating_point_tests $<TARGET_FILE:libc>)
     set_tests_properties(guest_floating_point PROPERTIES TIMEOUT 10)
     if(WIN32)
         set_tests_properties(guest_floating_point PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    if(MINGW OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        enable_language(ASM)
+        add_test_executable(guest_sce_v2_exceptions_tests
+            ${LIBS_INCLUDE_DIR}/tests/GuestSceV2Exceptions.cpp
+            ${LIBS_INCLUDE_DIR}/tests/GuestSceV2Exceptions.S)
+        target_include_directories(guest_sce_v2_exceptions_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_sce_v2_exceptions_tests PRIVATE libc)
+        configure_windows_unwind(guest_sce_v2_exceptions_tests)
+        add_test(NAME guest_sce_v2_exceptions COMMAND guest_sce_v2_exceptions_tests)
+        set_tests_properties(guest_sce_v2_exceptions PROPERTIES TIMEOUT 10)
+        if(WIN32)
+            set_tests_properties(guest_sce_v2_exceptions PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endif()
 endif()
 
 if(WIN32)
@@ -135,12 +172,14 @@ if(WIN32)
 endif()
 
 if(BUILD_TESTING)
-    if(UNIX)
-        add_test_executable(guest_fopen_errors_tests ${LIBS_INCLUDE_DIR}/tests/GuestFopenErrors.cpp)
-        target_include_directories(guest_fopen_errors_tests PRIVATE ${LIBS_INCLUDE_DIR})
-        target_link_libraries(guest_fopen_errors_tests PRIVATE libc)
-        add_test(NAME guest_fopen_errors COMMAND guest_fopen_errors_tests)
-        set_tests_properties(guest_fopen_errors PROPERTIES TIMEOUT 20)
+    add_test_executable(guest_fopen_errors_tests ${LIBS_INCLUDE_DIR}/tests/GuestFopenErrors.cpp)
+    target_include_directories(guest_fopen_errors_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_fopen_errors_tests PRIVATE libc)
+    add_test(NAME guest_fopen_errors COMMAND guest_fopen_errors_tests)
+    set_tests_properties(guest_fopen_errors PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77)
+    if(WIN32)
+        set_tests_properties(guest_fopen_errors PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 
     add_test_executable(guest_index_tests ${LIBS_INCLUDE_DIR}/tests/GuestIndex.cpp)
@@ -364,6 +403,24 @@ if(BUILD_TESTING)
         set_tests_properties(guest_random_state PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_libc_random_seeding_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibcRandomSeeding.cpp)
+    target_include_directories(guest_libc_random_seeding_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libc_random_seeding_tests PRIVATE libc)
+    configure_windows_unwind(guest_libc_random_seeding_tests)
+    add_test(NAME guest_libc-random-seeding COMMAND guest_libc_random_seeding_tests)
+    if(WIN32)
+        set_tests_properties(guest_libc-random-seeding PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test_executable(guest_random_device_seed_tests ${LIBS_INCLUDE_DIR}/tests/GuestRandomDeviceSeed.cpp src/Random.cpp)
+    target_include_directories(guest_random_device_seed_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_random_device_seed_tests PRIVATE libc)
+    configure_windows_unwind(guest_random_device_seed_tests)
+    add_test(NAME guest_random_device_seed COMMAND guest_random_device_seed_tests)
+    if(WIN32)
+        set_tests_properties(guest_random_device_seed PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_integer_builtins_tests ${LIBS_INCLUDE_DIR}/tests/GuestIntegerBuiltins.cpp)
     target_include_directories(guest_integer_builtins_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_integer_builtins_tests PRIVATE libc)
@@ -451,6 +508,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_libc_threads PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_std_thread_hardware_concurrency_tests ${LIBS_INCLUDE_DIR}/tests/GuestStdThreadHardwareConcurrency.cpp)
+    target_include_directories(guest_std_thread_hardware_concurrency_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_std_thread_hardware_concurrency_tests PRIVATE libc)
+    configure_windows_unwind(guest_std_thread_hardware_concurrency_tests)
+    add_test(NAME guest_std_thread_hardware_concurrency COMMAND guest_std_thread_hardware_concurrency_tests)
+    set_tests_properties(guest_std_thread_hardware_concurrency PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_std_thread_hardware_concurrency PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_libc_static_imports_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibcStaticImports.cpp)
     target_include_directories(guest_libc_static_imports_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_libc_static_imports_tests PRIVATE libc)
@@ -573,6 +640,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_memrchr PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_string_compare_tests ${LIBS_INCLUDE_DIR}/tests/GuestStringCompare.cpp)
+    target_include_directories(guest_string_compare_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_string_compare_tests PRIVATE libc)
+    configure_windows_unwind(guest_string_compare_tests)
+    add_test(NAME guest_string_compare COMMAND guest_string_compare_tests)
+    if(WIN32)
+        set_tests_properties(guest_string_compare PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_daemon_tests ${LIBS_INCLUDE_DIR}/tests/GuestDaemon.cpp)
     target_include_directories(guest_daemon_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_daemon_tests PRIVATE libc)
@@ -661,6 +737,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_standard_streams guest_standard_streams_closed_stdout guest_standard_streams_exclusive_stdout PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_gets_tests ${LIBS_INCLUDE_DIR}/tests/GuestGets.cpp)
+    target_include_directories(guest_gets_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_gets_tests PRIVATE libc ${CMAKE_DL_LIBS})
+    configure_windows_unwind(guest_gets_tests)
+    add_test(NAME guest_gets COMMAND guest_gets_tests $<TARGET_FILE:libc> guest_gets_error.tmp)
+    set_tests_properties(guest_gets PROPERTIES TIMEOUT 10)
+    if(WIN32)
+        set_tests_properties(guest_gets PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(file_streams_tests ${LIBS_INCLUDE_DIR}/tests/FileStreams.cpp)
     target_include_directories(file_streams_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(file_streams_tests PRIVATE libc)
@@ -671,6 +757,16 @@ if(BUILD_TESTING)
         set_tests_properties(file_streams PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_freopen_host_standard_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreopenHostStandard.cpp)
+    target_include_directories(guest_freopen_host_standard_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freopen_host_standard_tests PRIVATE libc)
+    configure_windows_unwind(guest_freopen_host_standard_tests)
+    add_test(NAME guest_freopen_host_standard COMMAND guest_freopen_host_standard_tests)
+    set_tests_properties(guest_freopen_host_standard PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_freopen_host_standard PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_error_tests ${LIBS_INCLUDE_DIR}/tests/GuestErrors.cpp)
     target_include_directories(guest_error_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_error_tests PRIVATE libc)
@@ -835,11 +931,25 @@ if(BUILD_TESTING)
         set_tests_properties(guest_bad_optional_access PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_underflow_error_tests ${LIBS_INCLUDE_DIR}/tests/GuestUnderflowError.cpp)
+    target_include_directories(guest_underflow_error_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_underflow_error_tests PRIVATE libc)
+    configure_windows_unwind(guest_underflow_error_tests)
+    add_test(NAME guest_underflow_error COMMAND guest_underflow_error_tests)
+    if(WIN32)
+        set_tests_properties(guest_underflow_error PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    if(WIN32)
+        add_test_executable(exception_personality_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionPersonality.cpp)
+        target_include_directories(exception_personality_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(exception_personality_tests PRIVATE libc)
+        configure_windows_unwind(exception_personality_tests)
+        add_test(NAME exception_personality COMMAND exception_personality_tests)
+        set_tests_properties(exception_personality PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     if(UNIX)
-        add_test_executable(exception_runtime_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionRuntime.cpp)
-        target_include_directories(exception_runtime_tests PRIVATE ${LIBS_INCLUDE_DIR})
-        target_link_libraries(exception_runtime_tests PRIVATE libc)
-        add_test(NAME exception_runtime COMMAND exception_runtime_tests)
         add_test_executable(exception_personality_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionPersonality.cpp)
         target_include_directories(exception_personality_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(exception_personality_tests PRIVATE libc)
@@ -854,8 +964,13 @@ if(BUILD_TESTING)
         add_test(NAME guest_path_lifetime COMMAND guest_path_lifetime_tests)
         set_tests_properties(guest_path_lifetime PROPERTIES TIMEOUT 20)
         if(NOT APPLE)
+            add_test_executable(exception_runtime_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionRuntime.cpp)
+            target_include_directories(exception_runtime_tests PRIVATE ${LIBS_INCLUDE_DIR})
+            target_link_libraries(exception_runtime_tests PRIVATE libc)
+            add_test(NAME exception_runtime COMMAND exception_runtime_tests)
             enable_language(C)
             add_test_executable(exception_c_cleanup_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionCCleanup.cpp ${LIBS_INCLUDE_DIR}/tests/ExceptionCCleanup.c)
+            target_include_directories(exception_c_cleanup_tests PRIVATE ${LIBS_INCLUDE_DIR})
             set_source_files_properties(${LIBS_INCLUDE_DIR}/tests/ExceptionCCleanup.c PROPERTIES COMPILE_OPTIONS -fexceptions)
             target_link_libraries(exception_c_cleanup_tests PRIVATE libc)
             add_test(NAME exception_c_cleanup COMMAND exception_c_cleanup_tests)
@@ -1102,6 +1217,7 @@ if(MINGW)
         set_tests_properties(windows_exceptions PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         add_test_executable(windows_backtrace_report_tests ${LIBS_INCLUDE_DIR}/tests/WindowsBacktraceReport.cpp)
         target_link_libraries(windows_backtrace_report_tests PRIVATE libc)
+        target_include_directories(windows_backtrace_report_tests PRIVATE ${LIBS_INCLUDE_DIR})
         add_test(NAME windows_backtrace_report COMMAND windows_backtrace_report_tests)
         set_tests_properties(windows_backtrace_report PROPERTIES TIMEOUT 20
             ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>"
diff --git a/core/libs/prx/libc/Export.cpp b/core/libs/prx/libc/Export.cpp
index 6056428c98..cb7055cfd5 100644
--- a/core/libs/prx/libc/Export.cpp
+++ b/core/libs/prx/libc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -8,8 +9,6 @@ uint32_t Need_sceLibc = 1;
 
 extern "C" {
 
-    int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(int*, int (APS5_VABI *)(void*, void*, void**), void*);
-
     int APS5_VABI std_execute_once_nid_postfix(int* flag, int (APS5_VABI *func)(void*, void*, void**), void* arg) {
         return _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(flag, func, arg);
     }
@@ -25,7 +24,6 @@ int APS5_VABI _ZSt14_Atomic_assertPKcS0__nid_postfix() {
  return 0;
 }
 
-
 APS5_EXPORT("H2e8t5ScQGc", libc___cxa_finalize);
 void APS5_VABI libc___cxa_finalize(void* dsoHandle) {
     CxaFinalize_nid_no_patch(dsoHandle);
diff --git a/core/libs/prx/libc/include/Api.hpp b/core/libs/prx/libc/include/Api.hpp
new file mode 100644
index 0000000000..4373c3455a
--- /dev/null
+++ b/core/libs/prx/libc/include/Api.hpp
@@ -0,0 +1,1429 @@
+#pragma once
+
+#include "prx/libc/include/specifics/linux/ElfTypes.hpp"
+#include "prx/libc/include/specifics/itanium/UnwindAbi.hpp"
+#include "prx/libc/include/MallocManagedSize.hpp"
+#include "prx/libc/include/GuestTime.hpp"
+#include "prx/libc/include/GuestLocale.hpp"
+#include "prx/libc/include/GuestDirectory.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/exceptions/Unwind.hpp"
+#include "prx/libc/include/exceptions/Runtime.hpp"
+#include "SceTypes.hpp"
+#include <future>
+#include <regex>
+
+#ifdef _LIBCPP_VERSION
+struct GuestExceptionPointer {
+    void* object {};
+    explicit GuestExceptionPointer(void* primary) noexcept : object(primary) {}
+    GuestExceptionPointer(const GuestExceptionPointer&) = delete;
+    ~GuestExceptionPointer() {}
+};
+using GuestExceptionPointerArgument = GuestExceptionPointer&;
+#else
+using GuestExceptionPointer = std::exception_ptr;
+using GuestExceptionPointerArgument = GuestExceptionPointer;
+#endif
+
+using GuestCompare = int (APS5_VABI *)(const void*, const void*);
+
+using GuestContextCompare = int (APS5_VABI*)(const void*, const void*, void*);
+
+using GuestExitCallback = void (APS5_VABI*)();
+
+struct GuestFloatingPointEnvironment {
+    std::uint32_t control;
+    std::uint32_t status;
+    std::uint32_t tag;
+    unsigned char other[16];
+    std::uint32_t mxcsr;
+};
+
+struct GuestInterfaceAddress {
+    GuestInterfaceAddress* next;
+    char* name;
+    std::uint32_t flags;
+    void* address;
+    void* netmask;
+    void* destination;
+    void* data;
+};
+
+struct GuestLocaleFacade {
+    GuestLocale::Implementation* implementation;
+};
+
+using GuestNewHandler = void (APS5_VABI*)();
+
+struct GuestPad {
+    unsigned (APS5_VABI* const* vtable)(GuestPad*);
+    void* condition;
+    void* mutex;
+    bool started;
+};
+
+using Int128 = __int128;
+
+using LibcTerminateHandler = void(*)();
+
+struct MinMaxPointers {
+    const void* minimum;
+    const void* maximum;
+};
+
+struct StreamManipulator {
+    GuestLocale::IosBase* (APS5_VABI* function)(GuestLocale::IosBase*, std::int32_t);
+    std::int32_t argument;
+};
+
+using Uint128 = unsigned __int128;
+
+struct Xtime {
+    std::int64_t sec;
+    std::int64_t nsec;
+};
+
+namespace LibcException {
+
+}
+
+namespace LibcException {
+
+struct CategoryObject { const void* vtable; };
+
+struct ExceptionObject { const void* vtable; const char* message; };
+
+struct ErrorCode { int reserved; int value; const CategoryObject* category; };
+
+struct SystemErrorObject { ExceptionObject base; ErrorCode code; };
+
+}
+
+extern "C" {
+
+int APS5_VABI std_execute_once_nid_postfix(int* flag, int (APS5_VABI *func)(void*, void*, void**), void* arg);
+void APS5_VABI LibcHeapGetTraceInfo_nid_postfix(LibcHeapInfo* info);
+int APS5_VABI _ZSt14_Atomic_assertPKcS0__nid_postfix();
+void APS5_VABI libc___cxa_finalize(void* dsoHandle);
+char* APS5_VABI strndup_nid_postfix(const char* source, std::size_t limit);
+char* APS5_VABI strdup_nid_postfix(const char* source);
+int APS5_VABI asprintf_nid_postfix(char** destination, const char* format, ...);
+void* APS5_VABI scriptingGetMem_nid_postfix(std::size_t alignment, std::size_t bytes);
+void APS5_VABI scriptingFreeMem_nid_postfix(void* pointer);
+void APS5_VABI __atomic_load_nid_postfix(std::size_t, void*, void*, int);
+void APS5_VABI __atomic_store_nid_postfix(std::size_t, void*, void*, int);
+void APS5_VABI __atomic_exchange_nid_postfix(std::size_t, void*, void*, void*, int);
+bool APS5_VABI __atomic_compare_exchange_nid_postfix(std::size_t, void*, void*, void*, int, int);
+bool APS5_VABI __atomic_is_lock_free_nid_postfix(std::size_t size, const void* pointer);
+Uint128 APS5_VABI __sync_fetch_and_add_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_sub_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_and_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_or_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_xor_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_lock_test_and_set_16_nid_postfix(Uint128* target, Uint128 value);
+int APS5_VABI sceLibcBacktraceGetBufferSize_nid_postfix(int limit, int* count, std::size_t* size);
+int APS5_VABI sceLibcBacktraceSelf_nid_postfix(int limit, void* buffer, std::size_t size, int* count);
+double APS5_VABI j0_nid_postfix(double x);
+double APS5_VABI y0_nid_postfix(double x);
+double APS5_VABI j1_nid_postfix(double x);
+double APS5_VABI y1_nid_postfix(double x);
+double APS5_VABI jn_nid_postfix(int order, double x);
+double APS5_VABI yn_nid_postfix(int order, double x);
+int APS5_VABI getw_nid_postfix(FileStream* stream);
+int APS5_VABI putw_nid_postfix(int value, FileStream* stream);
+void APS5_VABI abort_handler_s_nid_postfix(const char* message, void*, int);
+void* APS5_VABI bsearch_s_nid_postfix(const void* key, const void* base, std::size_t count, std::size_t size, GuestContextCompare compare, void* context);
+std::uint16_t* APS5_VABI wcstok_s_nid_postfix(std::uint16_t* str, std::size_t* remaining, const std::uint16_t* delimiters, std::uint16_t** context);
+int APS5_VABI wctomb_s_nid_postfix(int* status, char* destination, std::size_t capacity, std::uint16_t wide);
+int APS5_VABI wcrtomb_s_nid_postfix(std::size_t* result, char* destination, std::size_t capacity, std::uint16_t wide, void* state);
+int APS5_VABI mbstowcs_s_nid_postfix(std::size_t* result, std::uint16_t* destination, std::size_t capacity, const char* source, std::size_t limit);
+int APS5_VABI mbsrtowcs_s_nid_postfix(std::size_t* result, std::uint16_t* destination, std::size_t capacity, const char** source, std::size_t limit, void* state);
+char* APS5_VABI gets_s_nid_postfix(char* buffer, std::size_t size);
+void* APS5_VABI __cxa_demangle_nid_postfix(const char* mangled, char* buf, std::size_t* len, int* status);
+int APS5_VABI __cxa_thread_atexit_impl_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dso);
+int APS5_VABI __cxa_thread_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dso);
+int APS5_VABI LibcInternalExtCxaThreadAtexit_nid_postfix(void (APS5_VABI *destructor)(void*), void* object, void* moduleId);
+int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix( int* flag, int (APS5_VABI *callback)(void*, void*, void**), void* arg );
+void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+void APS5_VABI _Atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+void APS5_VABI _Atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+void APS5_VABI _Atomic_store_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI _Atomic_load_1_nid_postfix(volatile std::uint8_t* target, int);
+std::uint16_t APS5_VABI _Atomic_load_2_nid_postfix(volatile std::uint16_t* target, int);
+std::uint64_t APS5_VABI _Atomic_load_8_nid_postfix(volatile std::uint64_t* target, int order);
+std::uint8_t APS5_VABI _Atomic_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+int APS5_VABI _Atomic_compare_exchange_strong_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t* expected, std::uint32_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int);
+std::uint8_t APS5_VABI _Fetch_and_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value);
+std::uint16_t APS5_VABI _Fetch_and_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value);
+std::uint32_t APS5_VABI _Fetch_and_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value);
+std::uint8_t APS5_VABI _Fetch_or_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value);
+std::uint16_t APS5_VABI _Fetch_or_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value);
+std::uint32_t APS5_VABI _Fetch_or_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value);
+std::uint8_t APS5_VABI _Fetch_xor_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value);
+std::uint16_t APS5_VABI _Fetch_xor_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value);
+std::uint32_t APS5_VABI _Fetch_xor_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value);
+std::uint8_t APS5_VABI _Atomic_fetch_add_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_add_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_add_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_sub_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_sub_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_and_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_and_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_fetch_and_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_and_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_or_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_or_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_fetch_or_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_or_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_xor_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_xor_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_fetch_xor_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+int APS5_VABI _Atomic_is_lock_free_1_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_2_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_4_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_8_nid_postfix();
+int APS5_VABI _Atomic_flag_test_and_set_nid_postfix(volatile unsigned char* flag, int);
+void APS5_VABI _Atomic_flag_clear_nid_postfix(volatile unsigned char* flag, int);
+void APS5_VABI _Atomic_thread_fence_nid_postfix(int order);
+void APS5_VABI _Atomic_signal_fence_nid_postfix(int);
+void APS5_VABI _Atomic_copy_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, const volatile void* source, int);
+void APS5_VABI _Atomic_exchange_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, volatile void* value, int);
+int APS5_VABI _Atomic_compare_exchange_strong_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, void* expected, const void* desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, void* expected, const void* desired, int, int);
+double APS5_VABI _Stod_nid_postfix(const char* text, char** end, std::int64_t pten);
+long long APS5_VABI _Stoll_nid_postfix(const char* text, char** end, int base);
+double APS5_VABI _Sin_nid_postfix(double x, unsigned int quadrant);
+float APS5_VABI _FSin_nid_postfix(float x, unsigned int quadrant);
+long double APS5_VABI _LSin_nid_postfix(long double x, unsigned int quadrant);
+double APS5_VABI _Log_nid_postfix(double x, int base);
+float APS5_VABI _FLog_nid_postfix(float x, int base);
+long double APS5_VABI _LLog_nid_postfix(long double x, int base);
+long double APS5_VABI _LDivide_nid_postfix(long double x, long double y);
+long double APS5_VABI _LRecip_nid_postfix(long double x);
+void* APS5_VABI opendir_nid_postfix(const char* path);
+GuestDirectoryEntry* APS5_VABI readdir_nid_postfix(void* handle);
+int APS5_VABI readdir_r_nid_postfix(void* handle, GuestDirectoryEntry* entry, GuestDirectoryEntry** result);
+int APS5_VABI closedir_nid_postfix(void* handle);
+void APS5_VABI rewinddir_nid_postfix(void* handle);
+std::int64_t APS5_VABI telldir_nid_postfix(void* handle);
+void APS5_VABI seekdir_nid_postfix(void* handle, std::int64_t location);
+char* APS5_VABI getenv_nid_postfix(const char* name);
+int APS5_VABI setenv_nid_postfix(const char* name, const char* value, int overwrite);
+int APS5_VABI unsetenv_nid_postfix(const char* name);
+int APS5_VABI putenv_nid_postfix(char* text);
+char* APS5_VABI strerror_nid_postfix(int error);
+int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t length);
+void APS5_VABI perror_nid_postfix(const char* prefix);
+FileStream* APS5_VABI fdopen_nid_postfix(int descriptor, const char* mode);
+FileStream* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode, FileStream* stream);
+int APS5_VABI freopen_s_nid_postfix(FileStream** result, const char* filename, const char* mode, FileStream* stream);
+FileStream* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
+int APS5_VABI fopen_s_nid_postfix(FileStream** result, const char* filename, const char* mode);
+int APS5_VABI fclose_nid_postfix(FileStream* stream);
+FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char* filename, int mode, int protection);
+size_t APS5_VABI fread_nid_postfix(void* buffer, size_t size, size_t count, FileStream* stream);
+size_t APS5_VABI fwrite_nid_postfix(const void* buffer, size_t size, size_t count, FileStream* stream);
+int APS5_VABI fseeko_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
+std::int64_t APS5_VABI ftello_nid_postfix(FileStream* stream);
+int APS5_VABI fseek_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
+std::int64_t APS5_VABI ftell_nid_postfix(FileStream* stream);
+int APS5_VABI fgetpos_nid_postfix(FileStream* stream, std::int64_t* position);
+int APS5_VABI fsetpos_nid_postfix(FileStream* stream, const std::int64_t* position);
+void APS5_VABI rewind_nid_postfix(FileStream* stream);
+int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
+int APS5_VABI fflush_nid_postfix(FileStream* stream);
+int APS5_VABI malloc_stats_fast_nid_postfix(void* stats);
+size_t APS5_VABI malloc_usable_size_nid_postfix(void* pointer);
+void* APS5_VABI malloc_nid_postfix(size_t size);
+void APS5_VABI free_nid_postfix(void* ptr);
+void* APS5_VABI realloc_nid_postfix(void* ptr, size_t newSize);
+void* APS5_VABI reallocf_nid_postfix(void* ptr, size_t newSize);
+void* APS5_VABI memalign_nid_postfix(size_t alignment, size_t size);
+void* APS5_VABI aligned_alloc_nid_postfix(size_t alignment, size_t size);
+void* APS5_VABI reallocalign_nid_postfix(void* ptr, size_t size, size_t alignment);
+void* APS5_VABI calloc_nid_postfix(size_t count, size_t size);
+int APS5_VABI posix_memalign_nid_postfix(void** pointer, size_t alignment, size_t size);
+void* APS5_VABI bsearch_nid_postfix(const void* key, const void* base, size_t count, size_t size, int (APS5_VABI *compare)(const void*, const void*));
+int APS5_VABI mergesort_nid_postfix(void* base, size_t count, size_t size, GuestCompare compare);
+void APS5_VABI qsort_nid_postfix(void* base, size_t count, size_t size, int (APS5_VABI *compare)(const void*, const void*));
+int APS5_VABI qsort_s_nid_postfix(void* base, size_t count, size_t size, GuestContextCompare compare, void* context);
+int APS5_VABI access_nid_postfix(const char* path, int mode);
+int APS5_VABI remove_nid_postfix(const char* path);
+double APS5_VABI __adddf3_nid_postfix(double a, double b);
+float APS5_VABI __addsf3_nid_postfix(float a, float b);
+double APS5_VABI __subdf3_nid_postfix(double a, double b);
+float APS5_VABI __subsf3_nid_postfix(float a, float b);
+double APS5_VABI __muldf3_nid_postfix(double a, double b);
+float APS5_VABI __mulsf3_nid_postfix(float a, float b);
+double APS5_VABI __divdf3_nid_postfix(double a, double b);
+float APS5_VABI __divsf3_nid_postfix(float a, float b);
+double APS5_VABI __negdf2_nid_postfix(double a);
+float APS5_VABI __negsf2_nid_postfix(float a);
+int APS5_VABI __eqdf2_nid_postfix(double a, double b);
+int APS5_VABI __nedf2_nid_postfix(double a, double b);
+int APS5_VABI __ltdf2_nid_postfix(double a, double b);
+int APS5_VABI __ledf2_nid_postfix(double a, double b);
+int APS5_VABI __gtdf2_nid_postfix(double a, double b);
+int APS5_VABI __gedf2_nid_postfix(double a, double b);
+int APS5_VABI __unorddf2_nid_postfix(double a, double b);
+int APS5_VABI __eqsf2_nid_postfix(float a, float b);
+int APS5_VABI __nesf2_nid_postfix(float a, float b);
+int APS5_VABI __ltsf2_nid_postfix(float a, float b);
+int APS5_VABI __lesf2_nid_postfix(float a, float b);
+int APS5_VABI __gtsf2_nid_postfix(float a, float b);
+int APS5_VABI __gesf2_nid_postfix(float a, float b);
+int APS5_VABI __unordsf2_nid_postfix(float a, float b);
+double APS5_VABI __extendsfdf2_nid_postfix(float a);
+float APS5_VABI __truncdfsf2_nid_postfix(double a);
+std::int32_t APS5_VABI __fixsfsi_nid_postfix(float a);
+std::int64_t APS5_VABI __fixsfdi_nid_postfix(float a);
+Int128 APS5_VABI __fixsfti_nid_postfix(float a);
+std::int32_t APS5_VABI __fixdfsi_nid_postfix(double a);
+std::int64_t APS5_VABI __fixdfdi_nid_postfix(double a);
+Int128 APS5_VABI __fixdfti_nid_postfix(double a);
+std::uint32_t APS5_VABI __fixunssfsi_nid_postfix(float a);
+std::uint64_t APS5_VABI __fixunssfdi_nid_postfix(float a);
+Uint128 APS5_VABI __fixunssfti_nid_postfix(float a);
+std::uint32_t APS5_VABI __fixunsdfsi_nid_postfix(double a);
+std::uint64_t APS5_VABI __fixunsdfdi_nid_postfix(double a);
+Uint128 APS5_VABI __fixunsdfti_nid_postfix(double a);
+std::int64_t APS5_VABI __fixxfdi_nid_postfix(long double a);
+Int128 APS5_VABI __fixxfti_nid_postfix(long double a);
+std::uint32_t APS5_VABI __fixunsxfsi_nid_postfix(long double a);
+std::uint64_t APS5_VABI __fixunsxfdi_nid_postfix(long double a);
+Uint128 APS5_VABI __fixunsxfti_nid_postfix(long double a);
+double APS5_VABI __floatsidf_nid_postfix(std::int32_t a);
+double APS5_VABI __floatunsidf_nid_postfix(std::uint32_t a);
+float APS5_VABI __floatsisf_nid_postfix(std::int32_t a);
+float APS5_VABI __floatunsisf_nid_postfix(std::uint32_t a);
+double APS5_VABI __floatdidf_nid_postfix(std::int64_t a);
+float APS5_VABI __floatdisf_nid_postfix(std::int64_t a);
+long double APS5_VABI __floatdixf_nid_postfix(std::int64_t a);
+double APS5_VABI __floatundidf_nid_postfix(std::uint64_t a);
+float APS5_VABI __floatundisf_nid_postfix(std::uint64_t a);
+long double APS5_VABI __floatundixf_nid_postfix(std::uint64_t a);
+double APS5_VABI __floattidf_nid_postfix(Int128 a);
+float APS5_VABI __floattisf_nid_postfix(Int128 a);
+long double APS5_VABI __floattixf_nid_postfix(Int128 a);
+double APS5_VABI __floatuntidf_nid_postfix(Uint128 a);
+float APS5_VABI __floatuntisf_nid_postfix(Uint128 a);
+long double APS5_VABI __floatuntixf_nid_postfix(Uint128 a);
+__complex__ float APS5_VABI __mulsc3_nid_postfix(float a, float b, float c, float d);
+__complex__ double APS5_VABI __muldc3_nid_postfix(double a, double b, double c, double d);
+__complex__ long double APS5_VABI __mulxc3_nid_postfix(long double a, long double b, long double c, long double d);
+__complex__ float APS5_VABI __divsc3_nid_postfix(float a, float b, float c, float d);
+__complex__ double APS5_VABI __divdc3_nid_postfix(double a, double b, double c, double d);
+__complex__ long double APS5_VABI __divxc3_nid_postfix(long double a, long double b, long double c, long double d);
+long double APS5_VABI __powixf2_nid_postfix(long double base, int exponent);
+int APS5_VABI fegetround_nid_postfix();
+int APS5_VABI fesetround_nid_postfix(int rounding);
+int APS5_VABI fetestexcept_nid_postfix(int exceptions);
+int APS5_VABI fegetexceptflag_nid_postfix(std::uint16_t* flags, int exceptions);
+void APS5_VABI _Feraise_nid_postfix(int exceptions);
+int APS5_VABI fesetexceptflag_nid_postfix(const std::uint16_t* flags, int exceptions);
+int APS5_VABI feclearexcept_nid_postfix(int exceptions);
+int APS5_VABI feenableexcept_nid_postfix(int exceptions);
+int APS5_VABI fedisableexcept_nid_postfix(int exceptions);
+int APS5_VABI __feenableexcept_nid_postfix(int exceptions);
+int APS5_VABI __fedisableexcept_nid_postfix(int exceptions);
+int APS5_VABI fegettrapenable_nid_postfix();
+int APS5_VABI fegetexcept_nid_postfix();
+int APS5_VABI fesettrapenable_nid_postfix(int exceptions);
+int APS5_VABI vasprintf_nid_postfix(char** destination, const char* format, VaList* args);
+int APS5_VABI vfprintf_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI fprintf_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI fscanf_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI printf_nid_postfix(const char* format, ...);
+int APS5_VABI libc_printf_nid_postfix(const char* format, ...);
+int APS5_VABI snprintf_nid_postfix(char* buffer, size_t size, const char* format, ...);
+int APS5_VABI sprintf_nid_postfix(char* buffer, const char* format, ...);
+int APS5_VABI vsscanf_nid_postfix(const char* input, const char* format, VaList* args);
+int APS5_VABI sscanf_nid_postfix(const char* input, const char* format, ...);
+int APS5_VABI sscanf_s_nid_postfix(const char* buffer, const char* format, ...);
+int APS5_VABI vprintf_nid_postfix(const char* str, VaList* c);
+int APS5_VABI vsprintf_nid_postfix(char* str, const char* format, VaList* args);
+int APS5_VABI vsnprintf_nid_postfix(char* str, size_t size, const char* format, VaList* c);
+int APS5_VABI vsnprintf_s_nid_postfix(char* buffer, size_t size, const char* format, VaList* args);
+int APS5_VABI vsscanf_s_nid_postfix(const char* buffer, const char* format, VaList* args);
+int APS5_VABI snprintf_s_nid_postfix(char* buffer, size_t size, const char* format, ...);
+int APS5_VABI printf_s_nid_postfix(const char* format, ...);
+int APS5_VABI vsprintf_s_nid_postfix(char* buffer, size_t size, const char* format, VaList* args);
+int APS5_VABI sprintf_s_nid_postfix(char* buffer, size_t size, const char* format, ...);
+int APS5_VABI puts_nid_postfix(const char* s);
+int APS5_VABI vfscanf_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI vscanf_nid_postfix(const char* format, VaList* args);
+int APS5_VABI scanf_nid_postfix(const char* format, ...);
+int APS5_VABI vfprintf_s_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI vprintf_s_nid_postfix(const char* format, VaList* args);
+int APS5_VABI fprintf_s_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI vfscanf_s_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI vscanf_s_nid_postfix(const char* format, VaList* args);
+int APS5_VABI fscanf_s_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI scanf_s_nid_postfix(const char* format, ...);
+int APS5_VABI vswprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args);
+int APS5_VABI swprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
+int APS5_VABI snwprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
+int APS5_VABI vswprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args);
+int APS5_VABI swprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
+int APS5_VABI vsnwprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args);
+int APS5_VABI wprintf_nid_postfix(const char16_t* format, ...);
+int APS5_VABI vfwprintf_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI fwprintf_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI vfwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI vwprintf_s_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI fwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI wprintf_s_nid_postfix(const char16_t* format, ...);
+int APS5_VABI vwprintf_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI fputwc_nid_postfix(char16_t value, FileStream* stream);
+int APS5_VABI fputws_nid_postfix(const char16_t* str, FileStream* stream);
+int APS5_VABI putwc_nid_postfix(char16_t value, FileStream* stream);
+int APS5_VABI putwchar_nid_postfix(char16_t value);
+char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* stream);
+int APS5_VABI chdir_nid_postfix(const char* path);
+char* APS5_VABI getcwd_nid_postfix(char* buffer, std::size_t size);
+void APS5_VABI sceLibcInternalBacktraceForGame_nid_postfix(const char* heapName);
+void APS5_VABI sceLibcInternalHeapErrorReportForGame_nid_postfix(void* heap, void* block, std::uint32_t error);
+int APS5_VABI gethostname_nid_postfix(char* name, std::size_t length);
+std::int64_t APS5_VABI __ashldi3_nid_postfix(std::int64_t value, int shift);
+std::int64_t APS5_VABI __ashrdi3_nid_postfix(std::int64_t value, int shift);
+std::int64_t APS5_VABI __lshrdi3_nid_postfix(std::int64_t value, int shift);
+Int128 APS5_VABI __ashlti3_nid_postfix(Int128 value, int shift);
+Int128 APS5_VABI __ashrti3_nid_postfix(Int128 value, int shift);
+Int128 APS5_VABI __lshrti3_nid_postfix(Int128 value, int shift);
+int APS5_VABI __clzsi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __clzdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __clzti2_nid_postfix(Uint128 value);
+int APS5_VABI __ctzsi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __ctzdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __ctzti2_nid_postfix(Uint128 value);
+int APS5_VABI __ffsdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __ffsti2_nid_postfix(Uint128 value);
+int APS5_VABI __paritysi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __paritydi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __parityti2_nid_postfix(Uint128 value);
+int APS5_VABI __popcountsi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __popcountdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __popcountti2_nid_postfix(Uint128 value);
+int APS5_VABI __cmpdi2_nid_postfix(std::int64_t a, std::int64_t b);
+int APS5_VABI __cmpti2_nid_postfix(Int128 a, Int128 b);
+int APS5_VABI __ucmpdi2_nid_postfix(std::uint64_t a, std::uint64_t b);
+int APS5_VABI __ucmpti2_nid_postfix(Uint128 a, Uint128 b);
+std::int64_t APS5_VABI __negdi2_nid_postfix(std::int64_t value);
+Int128 APS5_VABI __negti2_nid_postfix(Int128 value);
+std::int64_t APS5_VABI __muldi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __multi3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __divsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __divdi3_nid_postfix(std::int64_t a, std::int64_t b);
+std::int32_t APS5_VABI __modsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __moddi3_nid_postfix(std::int64_t a, std::int64_t b);
+std::uint32_t APS5_VABI __udivsi3_nid_postfix(std::uint32_t a, std::uint32_t b);
+std::uint64_t APS5_VABI __udivdi3_nid_postfix(std::uint64_t a, std::uint64_t b);
+std::uint32_t APS5_VABI __umodsi3_nid_postfix(std::uint32_t a, std::uint32_t b);
+std::uint64_t APS5_VABI __umoddi3_nid_postfix(std::uint64_t a, std::uint64_t b);
+std::int32_t APS5_VABI __divmodsi4_nid_postfix(std::int32_t a, std::int32_t b, std::int32_t* remainder);
+std::int64_t APS5_VABI __divmoddi4_nid_postfix(std::int64_t a, std::int64_t b, std::int64_t* remainder);
+std::uint32_t APS5_VABI __udivmodsi4_nid_postfix(std::uint32_t a, std::uint32_t b, std::uint32_t* remainder);
+std::uint64_t APS5_VABI __udivmoddi4_nid_postfix(std::uint64_t a, std::uint64_t b, std::uint64_t* remainder);
+Uint128 APS5_VABI __udivmodti4_nid_postfix(Uint128 a, Uint128 b, Uint128* remainder);
+std::int32_t APS5_VABI __mulosi4_nid_postfix(std::int32_t a, std::int32_t b, int* overflow);
+std::int64_t APS5_VABI __mulodi4_nid_postfix(std::int64_t a, std::int64_t b, int* overflow);
+Int128 APS5_VABI __muloti4_nid_postfix(Int128 a, Int128 b, int* overflow);
+std::int32_t APS5_VABI __mulvsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __mulvdi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __mulvti3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __addvsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __addvdi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __addvti3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __subvsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __subvdi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __subvti3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __negvsi2_nid_postfix(std::int32_t value);
+std::int64_t APS5_VABI __negvdi2_nid_postfix(std::int64_t value);
+Int128 APS5_VABI __negvti2_nid_postfix(Int128 value);
+std::int32_t APS5_VABI __absvsi2_nid_postfix(std::int32_t value);
+std::int64_t APS5_VABI __absvdi2_nid_postfix(std::int64_t value);
+Int128 APS5_VABI __absvti2_nid_postfix(Int128 value);
+int APS5_VABI getifaddrs_nid_postfix(GuestInterfaceAddress** list);
+void APS5_VABI freeifaddrs_nid_postfix(GuestInterfaceAddress* list);
+int APS5_VABI isupper_nid_postfix(int c);
+int APS5_VABI islower_nid_postfix(int c);
+int APS5_VABI isalpha_nid_postfix(int c);
+int APS5_VABI isdigit_nid_postfix(int c);
+int APS5_VABI isalnum_nid_postfix(int c);
+int APS5_VABI isspace_nid_postfix(int c);
+int APS5_VABI isblank_nid_postfix(int c);
+int APS5_VABI iscntrl_nid_postfix(int c);
+int APS5_VABI isprint_nid_postfix(int c);
+int APS5_VABI isgraph_nid_postfix(int c);
+int APS5_VABI ispunct_nid_postfix(int c);
+int APS5_VABI isxdigit_nid_postfix(int c);
+int APS5_VABI isascii_nid_postfix(int c);
+int APS5_VABI toascii_nid_postfix(int c);
+int APS5_VABI toupper_nid_postfix(int c);
+int APS5_VABI tolower_nid_postfix(int c);
+void APS5_VABI _ZNSt8ios_baseD2Ev_nid_postfix(GuestLocale::IosBase* self);
+GuestLocale::IosBase* APS5_VABI SetStreamWidth(GuestLocale::IosBase* stream, std::int32_t width);
+StreamManipulator APS5_VABI _ZSt4setwi_nid_postfix(std::int32_t width);
+void APS5_VABI _ZNSt8ios_base7_AddstdEPS__nid_postfix(GuestLocale::IosBase* self);
+GuestLocale::Implementation* APS5_VABI _ZNSt6locale5_InitEv_nid_postfix();
+void APS5_VABI _ZNSt6locale5facet9_RegisterEv_nid_postfix(GuestLocale::Facet* self);
+GuestLocale::Implementation* APS5_VABI _ZNSt6locale16_GetgloballocaleEv_nid_postfix();
+GuestLocaleFacade* APS5_VABI _ZNSt6locale7classicEv_nid_postfix();
+std::size_t APS5_VABI _ZNSt7collateIwE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
+std::size_t APS5_VABI _ZNSt7collateIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
+void APS5_VABI _ZNSt8_LocinfoC1EPKc_nid_postfix(GuestLocale::LocinfoStorage* self, const char* localeName);
+void APS5_VABI _ZNSt8_LocinfoD1Ev_nid_postfix(GuestLocale::LocinfoStorage* self);
+int APS5_VABI _Mbtowcx_nid_postfix(std::uint16_t* dst, const char* src, std::size_t count, mbstate_t* st);
+int APS5_VABI _Wctombx_nid_postfix(char* dst, std::uint16_t src, mbstate_t* st);
+const short* APS5_VABI _Getpctype_nid_postfix();
+const short* APS5_VABI _Getptolower_nid_postfix();
+const short* APS5_VABI _Getptoupper_nid_postfix();
+mbstate_t* APS5_VABI _Getpmbstate_nid_postfix();
+mbstate_t* APS5_VABI _Getpwcstate_nid_postfix();
+std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t c, std::uint64_t desc);
+void APS5_VABI _ZNSt6locale7_LocimpC1ERKS0__nid_postfix(GuestLocale::Implementation* self, const GuestLocale::Implementation* source);
+void APS5_VABI _ZNSt6locale7_Locimp7_AddfacEPNS_5facetEm_nid_postfix(GuestLocale::Implementation* self, GuestLocale::Facet* facet, std::size_t id);
+void APS5_VABI _init_env_nid_postfix();
+void APS5_VABI init_env_nid_postfix(const InitEnvParams* params);
+SonyLconv* APS5_VABI localeconv_nid_postfix(void);
+std::lldiv_t APS5_VABI lldiv_nid_postfix(long long numerator, long long denominator);
+std::lldiv_t APS5_VABI ldiv_nid_postfix(std::int64_t numerator, std::int64_t denominator);
+std::lldiv_t APS5_VABI imaxdiv_nid_postfix(std::int64_t numerator, std::int64_t denominator);
+std::int64_t APS5_VABI labs_nid_postfix(std::int64_t x);
+std::int64_t APS5_VABI llabs_nid_postfix(std::int64_t x);
+std::int64_t APS5_VABI imaxabs_nid_postfix(std::int64_t x);
+float APS5_VABI fmodf_nid_postfix(float x, float y);
+float APS5_VABI asinf_nid_postfix(float x);
+float APS5_VABI acosf_nid_postfix(float x);
+float APS5_VABI atan2f_nid_postfix(float y, float x);
+float APS5_VABI hypotf_nid_postfix(float x, float y);
+double APS5_VABI hypot_nid_postfix(double x, double y);
+float APS5_VABI log10f_nid_postfix(float x);
+float APS5_VABI logbf_nid_postfix(float x);
+double APS5_VABI exp2_nid_postfix(double x);
+double APS5_VABI ldexp_nid_postfix(double x, int exponent);
+double APS5_VABI scalbn_nid_postfix(double x, int exponent);
+float APS5_VABI scalbnf_nid_postfix(float x, int exponent);
+long double APS5_VABI scalbnl_nid_postfix(long double x, int exponent);
+float APS5_VABI significandf_nid_postfix(float x);
+double APS5_VABI significand_nid_postfix(double x);
+double APS5_VABI frexp_nid_postfix(double x, int* exponent);
+float APS5_VABI frexpf_nid_postfix(float x, int* exponent);
+std::int64_t APS5_VABI lround_nid_postfix(double x);
+std::int64_t APS5_VABI lroundf_nid_postfix(float x);
+std::int64_t APS5_VABI llround_nid_postfix(double x);
+std::int64_t APS5_VABI llroundf_nid_postfix(float x);
+std::int64_t APS5_VABI llroundl_nid_postfix(long double x);
+int APS5_VABI __isfinitef_nid_postfix(float x);
+int APS5_VABI __isnormal_nid_postfix(double x);
+int APS5_VABI __isnormalf_nid_postfix(float x);
+int APS5_VABI __isinff_nid_postfix(float x);
+float APS5_VABI nearbyintf_nid_postfix(float x);
+long double APS5_VABI nearbyintl_nid_postfix(long double x);
+double APS5_VABI nearbyint_nid_postfix(double x);
+double APS5_VABI cbrt_nid_postfix(double x);
+double APS5_VABI asin_nid_postfix(double x);
+double APS5_VABI acos_nid_postfix(double x);
+double APS5_VABI sqrt_nid_postfix(double x);
+float APS5_VABI sqrtf_nid_postfix(float x);
+double APS5_VABI fabs_nid_postfix(double x);
+float APS5_VABI fabsf_nid_postfix(float x);
+long double APS5_VABI fabsl_nid_postfix(long double x);
+double APS5_VABI copysign_nid_postfix(double x, double y);
+float APS5_VABI copysignf_nid_postfix(float x, float y);
+int APS5_VABI abs_nid_postfix(int x);
+double APS5_VABI trunc_nid_postfix(double x);
+double APS5_VABI ceil_nid_postfix(double x);
+double APS5_VABI floor_nid_postfix(double x);
+float APS5_VABI truncf_nid_postfix(float x);
+float APS5_VABI ceilf_nid_postfix(float x);
+float APS5_VABI floorf_nid_postfix(float x);
+double APS5_VABI fma_nid_postfix(double x, double y, double z);
+float APS5_VABI fmaf_nid_postfix(float x, float y, float z);
+double APS5_VABI fmin_nid_postfix(double x, double y);
+float APS5_VABI fminf_nid_postfix(float x, float y);
+long double APS5_VABI fminl_nid_postfix(long double x, long double y);
+double APS5_VABI fmax_nid_postfix(double x, double y);
+float APS5_VABI fmaxf_nid_postfix(float x, float y);
+long double APS5_VABI fmaxl_nid_postfix(long double x, long double y);
+double APS5_VABI fdim_nid_postfix(double x, double y);
+float APS5_VABI fdimf_nid_postfix(float x, float y);
+long double APS5_VABI acosl_nid_postfix(long double x);
+long double APS5_VABI acoshl_nid_postfix(long double x);
+long double APS5_VABI asinhl_nid_postfix(long double x);
+long double APS5_VABI atanhl_nid_postfix(long double x);
+long double APS5_VABI atan2l_nid_postfix(long double y, long double x);
+long double APS5_VABI cbrtl_nid_postfix(long double x);
+long double APS5_VABI erfl_nid_postfix(long double x);
+long double APS5_VABI erfcl_nid_postfix(long double x);
+long double APS5_VABI expm1l_nid_postfix(long double x);
+long double APS5_VABI log1pl_nid_postfix(long double x);
+long double APS5_VABI log2l_nid_postfix(long double x);
+long double APS5_VABI lgammal_nid_postfix(long double x);
+long double APS5_VABI tgammal_nid_postfix(long double x);
+float APS5_VABI tgammaf_nid_postfix(float x);
+long double APS5_VABI hypotl_nid_postfix(long double x, long double y);
+float APS5_VABI hypot3f_nid_postfix(float x, float y, float z);
+double APS5_VABI hypot3_nid_postfix(double x, double y, double z);
+long double APS5_VABI hypot3l_nid_postfix(long double x, long double y, long double z);
+float APS5_VABI j0f_nid_postfix(float x);
+float APS5_VABI j1f_nid_postfix(float x);
+float APS5_VABI jnf_nid_postfix(int order, float x);
+float APS5_VABI y0f_nid_postfix(float x);
+float APS5_VABI y1f_nid_postfix(float x);
+float APS5_VABI ynf_nid_postfix(int order, float x);
+long double APS5_VABI asinl_nid_postfix(long double x);
+long double APS5_VABI frexpl_nid_postfix(long double x, int* exponent);
+double APS5_VABI exp_nid_postfix(double x);
+double APS5_VABI atan_nid_postfix(double x);
+double APS5_VABI tan_nid_postfix(double x);
+double APS5_VABI log2_nid_postfix(double x);
+double APS5_VABI log_nid_postfix(double x);
+double APS5_VABI log1p_nid_postfix(double x);
+float APS5_VABI log1pf_nid_postfix(float x);
+double APS5_VABI expm1_nid_postfix(double x);
+float APS5_VABI expm1f_nid_postfix(float x);
+float APS5_VABI erff_nid_postfix(float x);
+double APS5_VABI erf_nid_postfix(double x);
+double APS5_VABI erfc_nid_postfix(double x);
+float APS5_VABI erfcf_nid_postfix(float x);
+double APS5_VABI lgamma_nid_postfix(double x);
+float APS5_VABI sinf_nid_postfix(float x);
+float APS5_VABI cosf_nid_postfix(float x);
+float APS5_VABI tanf_nid_postfix(float x);
+void APS5_VABI sincosf_nid_postfix(float x, float* sinp, float* cosp);
+double APS5_VABI sin_nid_postfix(double x);
+double APS5_VABI cos_nid_postfix(double x);
+double APS5_VABI sinh_nid_postfix(double x);
+double APS5_VABI cosh_nid_postfix(double x);
+float APS5_VABI coshf_nid_postfix(float x);
+float APS5_VABI sinhf_nid_postfix(float x);
+double APS5_VABI asinh_nid_postfix(double x);
+float APS5_VABI asinhf_nid_postfix(float x);
+double APS5_VABI acosh_nid_postfix(double x);
+float APS5_VABI acoshf_nid_postfix(float x);
+double APS5_VABI atanh_nid_postfix(double x);
+float APS5_VABI atanhf_nid_postfix(float x);
+void APS5_VABI sincos_nid_postfix(double x, double* sinp, double* cosp);
+float APS5_VABI atanf_nid_postfix(float x);
+double APS5_VABI atan2_nid_postfix(double y, double x);
+float APS5_VABI powf_nid_postfix(float base, float exp);
+double APS5_VABI pow_nid_postfix(double base, double exp);
+float APS5_VABI __powisf2_nid_postfix(float base, int exponent);
+double APS5_VABI __powidf2_nid_postfix(double base, int exponent);
+float APS5_VABI expf_nid_postfix(float x);
+float APS5_VABI exp2f_nid_postfix(float x);
+short APS5_VABI _Exp_nid_postfix(double* value, double y, short offset);
+short APS5_VABI _FExp_nid_postfix(float* value, float y, short offset);
+float APS5_VABI logf_nid_postfix(float x);
+float APS5_VABI log2f_nid_postfix(float x);
+double APS5_VABI log10_nid_postfix(double x);
+float APS5_VABI ldexpf_nid_postfix(float x, int exp);
+double APS5_VABI fmod_nid_postfix(double x, double y);
+float APS5_VABI roundf_nid_postfix(float x);
+double APS5_VABI round_nid_postfix(double x);
+float APS5_VABI cbrtf_nid_postfix(float x);
+float APS5_VABI remainderf_nid_postfix(float x, float y);
+double APS5_VABI _Divide_nid_postfix(double x, double y);
+float APS5_VABI _FDivide_nid_postfix(float x, float y);
+double APS5_VABI _Recip_nid_postfix(double x);
+float APS5_VABI _FRecip_nid_postfix(float x);
+float APS5_VABI nextafterf_nid_postfix(float x, float y);
+double APS5_VABI nextafter_nid_postfix(double x, double y);
+int APS5_VABI __isfinite_nid_postfix(double x);
+int APS5_VABI __isnan_nid_postfix(double x);
+int APS5_VABI __isinf_nid_postfix(double x);
+int APS5_VABI __signbit_nid_postfix(double x);
+float APS5_VABI nanf_nid_postfix(const char* tagp);
+double APS5_VABI nan_nid_postfix(const char* tagp);
+double APS5_VABI modf_nid_postfix(double x, double* integral);
+float APS5_VABI modff_nid_postfix(float x, float* integral);
+double APS5_VABI tanh_nid_postfix(double x);
+float APS5_VABI tanhf_nid_postfix(float x);
+long double APS5_VABI atanl_nid_postfix(long double x);
+long double APS5_VABI sinl_nid_postfix(long double x);
+long double APS5_VABI cosl_nid_postfix(long double x);
+long double APS5_VABI tanl_nid_postfix(long double x);
+long double APS5_VABI sinhl_nid_postfix(long double x);
+long double APS5_VABI coshl_nid_postfix(long double x);
+long double APS5_VABI tanhl_nid_postfix(long double x);
+long double APS5_VABI expl_nid_postfix(long double x);
+long double APS5_VABI exp2l_nid_postfix(long double x);
+long double APS5_VABI logl_nid_postfix(long double x);
+long double APS5_VABI log10l_nid_postfix(long double x);
+long double APS5_VABI powl_nid_postfix(long double base, long double exp);
+long double APS5_VABI ldexpl_nid_postfix(long double x, int exp);
+long double APS5_VABI truncl_nid_postfix(long double x);
+long double APS5_VABI ceill_nid_postfix(long double x);
+long double APS5_VABI floorl_nid_postfix(long double x);
+double APS5_VABI logb_nid_postfix(double x);
+int APS5_VABI ilogb_nid_postfix(double x);
+int APS5_VABI ilogbf_nid_postfix(float x);
+double APS5_VABI remainder_nid_postfix(double x, double y);
+double APS5_VABI remquo_nid_postfix(double x, double y, int* quo);
+float APS5_VABI remquof_nid_postfix(float x, float y, int* quo);
+float APS5_VABI _FSinh_nid_postfix(float x, float y);
+float APS5_VABI _FCosh_nid_postfix(float x, float y);
+short APS5_VABI _FDtest_nid_postfix(const float* value);
+short APS5_VABI _Dtest_nid_postfix(const double* value);
+int APS5_VABI __isnanf_nid_postfix(float x);
+int APS5_VABI isnanf_nid_postfix(float x);
+int APS5_VABI isnan_nid_postfix(double x);
+int APS5_VABI isinf_nid_postfix(double x);
+int APS5_VABI __fpclassifyf_nid_postfix(float x);
+int APS5_VABI __signbitf_nid_postfix(float x);
+int APS5_VABI __signbitl_nid_postfix(long double x);
+int APS5_VABI __isfinitel_nid_postfix(long double x);
+int APS5_VABI rand_nid_postfix();
+int APS5_VABI rand_r_nid_postfix(unsigned int* state);
+void APS5_VABI srand_nid_postfix(unsigned int seed);
+int APS5_VABI __fpclassifyd_nid_postfix(double value);
+double APS5_VABI _Sinh_nid_postfix(double x, double y);
+double APS5_VABI _Cosh_nid_postfix(double x, double y);
+long double APS5_VABI _LCosh_nid_postfix(long double x, long double y);
+long double APS5_VABI _LSinh_nid_postfix(long double x, long double y);
+int APS5_VABI _Fltrounds_nid_postfix(void);
+int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment* environment);
+long double APS5_VABI copysignl_nid_postfix(long double x, long double y);
+long double APS5_VABI fdiml_nid_postfix(long double x, long double y);
+long double APS5_VABI fmodl_nid_postfix(long double x, long double y);
+long double APS5_VABI remainderl_nid_postfix(long double x, long double y);
+long double APS5_VABI remquol_nid_postfix(long double x, long double y, int* quotient);
+long double APS5_VABI logbl_nid_postfix(long double x);
+int APS5_VABI ilogbl_nid_postfix(long double x);
+long double APS5_VABI rintl_nid_postfix(long double x);
+long double APS5_VABI roundl_nid_postfix(long double x);
+std::int64_t APS5_VABI lroundl_nid_postfix(long double x);
+std::int64_t APS5_VABI lrintl_nid_postfix(long double x);
+long long APS5_VABI llrintl_nid_postfix(long double x);
+long double APS5_VABI sqrtl_nid_postfix(long double x);
+long double APS5_VABI modfl_nid_postfix(long double x, long double* integral);
+long double APS5_VABI nanl_nid_postfix(const char*);
+long double APS5_VABI scalblnl_nid_postfix(long double x, std::int64_t exponent);
+long double APS5_VABI fmal_nid_postfix(long double x, long double y, long double z);
+double APS5_VABI rint_nid_postfix(double x);
+float APS5_VABI rintf_nid_postfix(float x);
+std::int64_t APS5_VABI lrint_nid_postfix(double x);
+std::int64_t APS5_VABI lrintf_nid_postfix(float x);
+long long APS5_VABI llrint_nid_postfix(double x);
+long long APS5_VABI llrintf_nid_postfix(float x);
+double APS5_VABI drem_nid_postfix(double x, double y);
+float APS5_VABI dremf_nid_postfix(float x, float y);
+double APS5_VABI scalbln_nid_postfix(double x, std::int64_t exponent);
+float APS5_VABI scalblnf_nid_postfix(float x, std::int64_t exponent);
+double APS5_VABI scalb_nid_postfix(double x, double exponent);
+float APS5_VABI scalbf_nid_postfix(float x, float exponent);
+int APS5_VABI finite_nid_postfix(double x);
+int APS5_VABI finitef_nid_postfix(float x);
+int APS5_VABI __fpclassifyl_nid_postfix(long double x);
+int APS5_VABI __isinfl_nid_postfix(long double x);
+int APS5_VABI __isnanl_nid_postfix(long double x);
+int APS5_VABI __isnormall_nid_postfix(long double x);
+short APS5_VABI _LDtest_nid_postfix(const long double* value);
+int APS5_VABI _Dclass_nid_postfix(double x);
+int APS5_VABI _FDclass_nid_postfix(float x);
+int APS5_VABI _LDclass_nid_postfix(long double x);
+short APS5_VABI _LDsign_nid_postfix(long double x);
+void* APS5_VABI sceLibcMspaceCreate_nid_postfix(const char* name, void* base, std::size_t size, unsigned flags);
+int APS5_VABI sceLibcMspaceDestroy_nid_postfix(void* handle);
+void* APS5_VABI sceLibcMspaceMalloc_nid_postfix(void* handle, std::size_t size);
+void APS5_VABI sceLibcMspaceFree_nid_postfix(void* handle, void* pointer);
+void* APS5_VABI sceLibcMspaceCalloc_nid_postfix(void* handle, std::size_t count, std::size_t size);
+void* APS5_VABI sceLibcMspaceRealloc_nid_postfix(void* handle, void* pointer, std::size_t size);
+int APS5_VABI sceLibcMspacePosixMemalign_nid_postfix(void* handle, void** result, std::size_t alignment, std::size_t size);
+void* APS5_VABI sceLibcMspaceMemalign_nid_postfix(void* handle, std::size_t alignment, std::size_t size);
+void* APS5_VABI sceLibcMspaceAlignedAlloc_nid_postfix(void* handle, std::size_t alignment, std::size_t size);
+void* APS5_VABI sceLibcMspaceReallocalign_nid_postfix(void* handle, void* pointer, std::size_t alignment, std::size_t size);
+int APS5_VABI sceLibcMspaceMallocStats_nid_postfix(void* handle, MallocManagedSize* stats);
+int APS5_VABI sceLibcMspaceMallocStatsFast_nid_postfix(void* handle, MallocManagedSize* stats);
+std::size_t APS5_VABI sceLibcMspaceMallocUsableSize_nid_postfix(const void* pointer);
+void* APS5_VABI sceLibcPafMspaceCreate_nid_postfix(const char* name, void* base, std::size_t size, unsigned flags, const void* options);
+int APS5_VABI sceLibcPafMspaceDestroy_nid_postfix(void* handle);
+void* APS5_VABI sceLibcPafMspaceMalloc_nid_postfix(void* handle, std::size_t size, const void* owner);
+void* APS5_VABI sceLibcPafMspaceMemalign_nid_postfix(void* handle, std::size_t alignment, std::size_t size, const void* owner);
+void APS5_VABI sceLibcPafMspaceFree_nid_postfix(void* handle, void* pointer, const void* owner);
+void* APS5_VABI sceLibcPafMspaceCalloc_nid_postfix(void* handle, std::size_t count, std::size_t size, const void* owner);
+void* APS5_VABI sceLibcPafMspaceRealloc_nid_postfix(void* handle, void* pointer, std::size_t size, const void* owner);
+void* APS5_VABI sceLibcPafMspaceReallocalign_nid_postfix(void* handle, void* pointer, std::size_t alignment, std::size_t size, const void* owner);
+int APS5_VABI sceLibcPafMspacePosixMemalign_nid_postfix(void* handle, void** result, std::size_t alignment, std::size_t size, const void* owner);
+int APS5_VABI sceLibcPafMspaceMallocStats_nid_postfix(void* handle, MallocManagedSize* stats);
+int APS5_VABI sceLibcPafMspaceMallocStatsFast_nid_postfix(void* handle, MallocManagedSize* stats);
+int APS5_VABI ___mb_cur_max_nid_postfix();
+int APS5_VABI _Getmbcurmax_nid_postfix();
+int APS5_VABI mbsinit_nid_postfix(const void* state);
+std::size_t APS5_VABI mbrtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
+std::size_t APS5_VABI mbrlen_nid_postfix(const char* source, std::size_t count, void* state);
+int APS5_VABI mbtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count);
+std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void*);
+int APS5_VABI mblen_nid_postfix(const char* source, std::size_t count);
+int APS5_VABI wctomb_nid_postfix(char* destination, std::uint16_t value);
+std::size_t APS5_VABI c32rtomb_nid_postfix(char* destination, std::uint32_t value, void*);
+std::size_t APS5_VABI c16rtomb_nid_postfix(char* destination, std::uint16_t unit, void* state);
+std::size_t APS5_VABI mbrtoc32_nid_postfix(std::uint32_t* destination, const char* source, std::size_t count, void* state);
+std::size_t APS5_VABI mbrtoc16_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
+std::size_t APS5_VABI wcsrtombs_nid_postfix(char* destination, const std::uint16_t** source, std::size_t capacity, void*);
+int APS5_VABI wcsrtombs_s_nid_postfix( std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t** source, std::size_t limit, void* state );
+int APS5_VABI wcstombs_s_nid_postfix( std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit );
+std::size_t APS5_VABI mbsrtowcs_nid_postfix(std::uint16_t* destination, const char** source, std::size_t capacity, void* state);
+std::size_t APS5_VABI mbstowcs_nid_postfix(std::uint16_t* dest, const char* src, std::size_t size);
+void APS5_VABI exit_nid_postfix(int code);
+int* APS5_VABI libc_error_nid_postfix();
+int* APS5_VABI __error_nid_postfix();
+int APS5_VABI atexit_nid_postfix(GuestExitCallback func);
+int APS5_VABI at_quick_exit_nid_postfix(GuestExitCallback func);
+int APS5_VABI daemon_nid_postfix(int noChdir, int noClose);
+double APS5_VABI erand48_nid_postfix(std::uint16_t* seed);
+std::int64_t APS5_VABI nrand48_nid_postfix(std::uint16_t* seed);
+std::int64_t APS5_VABI jrand48_nid_postfix(std::uint16_t* seed);
+double APS5_VABI drand48_nid_postfix();
+std::int64_t APS5_VABI lrand48_nid_postfix();
+std::int64_t APS5_VABI mrand48_nid_postfix();
+void APS5_VABI srand48_nid_postfix(std::int64_t seedval);
+std::uint16_t* APS5_VABI seed48_nid_postfix(const std::uint16_t* seed);
+void APS5_VABI lcong48_nid_postfix(const std::uint16_t* parameters);
+std::int64_t APS5_VABI random_nid_postfix();
+void APS5_VABI srandom_nid_postfix(std::uint64_t seed);
+char* APS5_VABI initstate_nid_postfix(std::uint64_t seed, char* state, std::int64_t size);
+char* APS5_VABI setstate_nid_postfix(char* state);
+char* APS5_VABI realpath_nid_postfix(const char* path, char* resolved);
+int APS5_VABI rename_nid_postfix(const char* from, const char* to);
+int APS5_VABI iswalnum_nid_postfix(std::uint32_t c);
+int APS5_VABI iswalpha_nid_postfix(std::uint32_t c);
+int APS5_VABI iswblank_nid_postfix(std::uint32_t c);
+int APS5_VABI iswcntrl_nid_postfix(std::uint32_t c);
+int APS5_VABI iswdigit_nid_postfix(std::uint32_t c);
+int APS5_VABI iswgraph_nid_postfix(std::uint32_t c);
+int APS5_VABI iswlower_nid_postfix(std::uint32_t c);
+int APS5_VABI iswprint_nid_postfix(std::uint32_t c);
+int APS5_VABI iswpunct_nid_postfix(std::uint32_t c);
+int APS5_VABI iswspace_nid_postfix(std::uint32_t c);
+int APS5_VABI iswupper_nid_postfix(std::uint32_t c);
+int APS5_VABI iswxdigit_nid_postfix(std::uint32_t c);
+int APS5_VABI iswascii_nid_postfix(std::uint32_t c);
+int APS5_VABI iswctype_nid_postfix(std::uint32_t c, std::uint64_t mask);
+int APS5_VABI _Iswctype_nid_postfix(std::uint32_t c, std::uint64_t type);
+std::uint64_t APS5_VABI wctype_nid_postfix(const char* property);
+std::uint32_t APS5_VABI towlower_nid_postfix(std::uint32_t c);
+std::uint32_t APS5_VABI towupper_nid_postfix(std::uint32_t c);
+std::uint32_t APS5_VABI btowc_nid_postfix(int c);
+int APS5_VABI wctob_nid_postfix(std::uint32_t c);
+std::uint64_t APS5_VABI wctrans_nid_postfix(const char* property);
+std::uint32_t APS5_VABI towctrans_nid_postfix(std::uint32_t c, std::uint64_t desc);
+std::uint32_t APS5_VABI _Towlower_nid_postfix(std::uint32_t c, const void*);
+std::uint32_t APS5_VABI _Towupper_nid_postfix(std::uint32_t c, const void*);
+int APS5_VABI _Tolower_nid_postfix(int c, const void*);
+int APS5_VABI _Toupper_nid_postfix(int c, const void*);
+int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
+int APS5_VABI cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
+void APS5_VABI cxa_finalize_nid_postfix(void* dsoHandle);
+void APS5_VABI _Vacopy_nid_postfix(unsigned char* destination, const unsigned char* source);
+unsigned int APS5_VABI _Atomic_fetch_add_4_nid_postfix(volatile unsigned int* target, unsigned int value, int memoryOrder);
+unsigned int APS5_VABI _Atomic_fetch_sub_4_nid_postfix(volatile unsigned int* target, unsigned int value, int memoryOrder);
+int APS5_VABI _Atomic_compare_exchange_weak_4_nid_postfix(volatile unsigned int* target, unsigned int* expected, unsigned int desired, int successOrder, int failureOrder);
+unsigned int APS5_VABI _Atomic_load_4_nid_postfix(volatile unsigned int* target, int memoryOrder);
+std::intmax_t APS5_VABI strtoimax_nid_postfix(const char* str, char** endptr, int base);
+std::uintmax_t APS5_VABI strtoumax_nid_postfix(const char* str, char** endptr, int base);
+unsigned int APS5_VABI _ZSt14_Random_devicev_nid_postfix();
+void APS5_VABI _Lockfilelock_nid_postfix(FileStream* stream);
+void APS5_VABI _Unlockfilelock_nid_postfix(FileStream* stream);
+void APS5_VABI flockfile_nid_postfix(FileStream* stream);
+void APS5_VABI funlockfile_nid_postfix(FileStream* stream);
+int APS5_VABI ftrylockfile_nid_postfix(FileStream* stream);
+std::uint64_t APS5_VABI _Stoul_nid_postfix(const char* str, char** endptr, int base);
+void APS5_VABI _Locksyslock_nid_postfix();
+void APS5_VABI _Unlocksyslock_nid_postfix();
+__int128 APS5_VABI __divti3_nid_postfix(__int128 dividend, __int128 divisor);
+unsigned __int128 APS5_VABI __udivti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
+unsigned __int128 APS5_VABI __umodti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
+__int128 APS5_VABI __modti3_nid_postfix(__int128 dividend, __int128 divisor);
+int APS5_VABI swscanf_nid_postfix(const char16_t* buffer, const char16_t* format, ...);
+int APS5_VABI swscanf_s_nid_postfix(const char16_t* buffer, const char16_t* format, ...);
+int APS5_VABI vswscanf_nid_postfix(const char16_t* buffer, const char16_t* format, VaList* args);
+int APS5_VABI vswscanf_s_nid_postfix(const char16_t* buffer, const char16_t* format, VaList* args);
+int APS5_VABI vfwscanf_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI vfwscanf_s_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI vwscanf_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI vwscanf_s_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI fwscanf_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI fwscanf_s_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI wscanf_nid_postfix(const char16_t* format, ...);
+int APS5_VABI wscanf_s_nid_postfix(const char16_t* format, ...);
+int APS5_VABI fgetc_nid_postfix(FileStream* stream);
+std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream);
+std::int32_t APS5_VABI ungetwc_nid_postfix(std::int32_t value, FileStream* stream);
+int APS5_VABI getc_nid_postfix(FileStream* stream);
+int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI __srget_nid_postfix(FileStream* stream);
+int APS5_VABI getchar_nid_postfix();
+char* APS5_VABI gets_nid_postfix(char* buffer);
+std::int32_t APS5_VABI getwc_nid_postfix(FileStream* stream);
+std::int32_t APS5_VABI getwchar_nid_postfix();
+int APS5_VABI getchar_unlocked_nid_postfix();
+int APS5_VABI fputc_nid_postfix(int value, FileStream* stream);
+int APS5_VABI putc_nid_postfix(int value, FileStream* stream);
+int APS5_VABI putc_unlocked_nid_postfix(int value, FileStream* stream);
+int APS5_VABI __swbuf_nid_postfix(int value, FileStream* stream);
+int APS5_VABI putchar_nid_postfix(int value);
+int APS5_VABI putchar_unlocked_nid_postfix(int value);
+int APS5_VABI ungetc_nid_postfix(int value, FileStream* stream);
+char* APS5_VABI fgets_nid_postfix(char* buffer, int size, FileStream* stream);
+int APS5_VABI feof_nid_postfix(FileStream* stream);
+int APS5_VABI ferror_nid_postfix(FileStream* stream);
+int APS5_VABI feof_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI ferror_unlocked_nid_postfix(FileStream* stream);
+void APS5_VABI clearerr_nid_postfix(FileStream* stream);
+int APS5_VABI fileno_nid_postfix(FileStream* stream);
+void APS5_VABI clearerr_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI fileno_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI setvbuf_nid_postfix(FileStream* stream, char* buffer, int mode, std::size_t size);
+void APS5_VABI setbuf_nid_postfix(FileStream* stream, char* buffer);
+const char* APS5_VABI setlocale_nid_postfix(int, const char* locale);
+GuestNewHandler APS5_VABI _ZSt15set_new_handlerPFvvE_nid_postfix(GuestNewHandler handler);
+GuestNewHandler APS5_VABI _ZSt15get_new_handlerv_nid_postfix();
+void* APS5_VABI _Znwm_nid_postfix(std::size_t size);
+void* APS5_VABI _Znam_nid_postfix(std::size_t size);
+void* APS5_VABI _ZnwmSt11align_val_t_nid_postfix(std::size_t size, std::size_t alignment);
+void* APS5_VABI _ZnwmRKSt9nothrow_t_nid_postfix(std::size_t size, const void*) noexcept;
+void* APS5_VABI _ZnamRKSt9nothrow_t_nid_postfix(std::size_t size, const void*) noexcept;
+void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
+void APS5_VABI _ZdlPvRKSt9nothrow_t_nid_postfix(void* pointer, const void*) noexcept;
+void APS5_VABI _ZdaPv_nid_postfix(void* pointer);
+void APS5_VABI _ZdlPvm_nid_postfix(void* pointer, std::size_t);
+void APS5_VABI _ZdaPvm_nid_postfix(void* pointer, std::size_t);
+void APS5_VABI _ZdlPvSt11align_val_t_nid_postfix(void* pointer, std::size_t alignment);
+void APS5_VABI _ZdlPvmSt11align_val_t_nid_postfix(void* pointer, std::size_t, std::size_t alignment);
+long long APS5_VABI strtonum_nid_postfix(const char* text, long long minimum, long long maximum, const char** error);
+char* APS5_VABI basename_r_nid_postfix(const char* path, char* buffer);
+char* APS5_VABI basename_nid_postfix(const char* path);
+char* APS5_VABI __inet_ntoa_nid_postfix(unsigned int address);
+char* APS5_VABI dirname_nid_postfix(const char* path);
+std::size_t APS5_VABI strnlen_nid_postfix(const char* text, std::size_t limit);
+std::size_t APS5_VABI strnlen_s_nid_postfix(const char* text, std::size_t limit);
+char* APS5_VABI strsep_nid_postfix(char** text, const char* delimiters);
+char* APS5_VABI strncat_nid_postfix(char* destination, const char* source, std::size_t limit);
+char* APS5_VABI strpbrk_nid_postfix(const char* text, const char* accept);
+std::size_t APS5_VABI strcspn_nid_postfix(const char* text, const char* reject);
+std::size_t APS5_VABI strlcat_nid_postfix(char* destination, const char* source, std::size_t capacity);
+char* APS5_VABI stpcpy_nid_postfix(char* destination, const char* source);
+char* APS5_VABI strtok_r_nid_postfix(char* text, const char* delimiters, char** state);
+char* APS5_VABI strtok_nid_postfix(char* text, const char* delimiters);
+int APS5_VABI __inet_aton_nid_postfix(const char* text, void* address);
+std::uint32_t APS5_VABI __inet_addr_nid_postfix(const char* text);
+void* APS5_VABI memset_nid_postfix(void* s, int c, size_t n);
+void APS5_VABI bzero_nid_postfix(void* destination, size_t count);
+void APS5_VABI bcopy_nid_postfix(const void* source, void* destination, size_t count);
+void* APS5_VABI memcpy_nid_postfix(void* dest, const void* src, size_t n);
+void* APS5_VABI memmove_nid_postfix(void* dest, const void* src, size_t n);
+int APS5_VABI memcmp_nid_postfix(const void* s1, const void* s2, size_t n);
+const void* APS5_VABI memchr_nid_postfix(const void* s, int c, size_t n);
+void* APS5_VABI memrchr_nid_postfix(const void* s, int c, size_t n);
+void* APS5_VABI memccpy_nid_postfix(void* dest, const void* src, int c, size_t n);
+void* APS5_VABI memmem_nid_postfix(const void* haystack, size_t haystacklen, const void* needle, size_t needlelen);
+int APS5_VABI strcmp_nid_postfix(const char* s1, const char* s2);
+int APS5_VABI strncmp_nid_postfix(const char* s1, const char* s2, size_t n);
+size_t APS5_VABI strlen_nid_postfix(const char* s);
+char* APS5_VABI strcpy_nid_postfix(char* dest, const char* src);
+char* APS5_VABI strncpy_nid_postfix(char* dest, const char* src, size_t count);
+char* APS5_VABI strcat_nid_postfix(char* dest, const char* src);
+const char* APS5_VABI strchr_nid_postfix(const char* s, int c);
+char* APS5_VABI index_nid_postfix(const char* s, int c);
+char* APS5_VABI strrchr_nid_postfix(const char* s, int c);
+char* APS5_VABI rindex_nid_postfix(const char* s, int c);
+int APS5_VABI flsl_nid_postfix(std::int64_t mask);
+char* APS5_VABI strstr_nid_postfix(const char* haystack, const char* needle);
+size_t APS5_VABI strlcpy_nid_postfix(char* dest, const char* src, size_t size);
+std::int64_t APS5_VABI strtol_nid_postfix(const char* str, char** endptr, int base);
+std::uint64_t APS5_VABI strtoul_nid_postfix(const char* str, char** endptr, int base);
+long long APS5_VABI strtoll_nid_postfix(const char* str, char** endptr, int base);
+unsigned long long APS5_VABI strtoull_nid_postfix(const char* str, char** endptr, int base);
+unsigned long long APS5_VABI strtouq_nid_postfix(const char* str, char** endptr, int base);
+double APS5_VABI strtod_nid_postfix(const char* str, char** endptr);
+double APS5_VABI atof_nid_postfix(const char* str);
+float APS5_VABI strtof_nid_postfix(const char* str, char** endptr);
+long double APS5_VABI strtold_nid_postfix(const char* str, char** endptr);
+int APS5_VABI atoi_nid_postfix(const char* str);
+std::int64_t APS5_VABI atol_nid_postfix(const char* str);
+long long APS5_VABI atoll_nid_postfix(const char* str);
+std::div_t APS5_VABI div_nid_postfix(int numerator, int denominator);
+const char16_t* APS5_VABI wmemchr_nid_postfix(const char16_t* s, char16_t c, size_t n);
+int APS5_VABI wmemcmp_nid_postfix(const char16_t* s1, const char16_t* s2, size_t n);
+char16_t* APS5_VABI wmemcpy_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+char16_t* APS5_VABI wmemmove_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+int APS5_VABI strcasecmp_nid_postfix(const char* s1, const char* s2);
+int APS5_VABI strncasecmp_nid_postfix(const char* s1, const char* s2, size_t n);
+int APS5_VABI bcmp_nid_postfix(const void* s1, const void* s2, size_t n);
+size_t APS5_VABI strspn_nid_postfix(const char* s, const char* accept);
+int APS5_VABI strcoll_nid_postfix(const char* s1, const char* s2);
+int APS5_VABI strncpy_s_nid_postfix(char* dest, size_t destsz, const char* src, size_t count);
+int APS5_VABI strcpy_s_nid_postfix(char* dest, size_t destsz, const char* src);
+int APS5_VABI strncat_s_nid_postfix(char* dest, size_t destsz, const char* src, size_t count);
+int APS5_VABI strcat_s_nid_postfix(char* dest, size_t destsz, const char* src);
+int APS5_VABI memcpy_s_nid_postfix(void* dest, size_t destsz, const void* src, size_t count);
+int APS5_VABI memmove_s_nid_postfix(void* dest, size_t destsz, const void* src, size_t count);
+int APS5_VABI memset_s_nid_postfix(void* dest, size_t destsz, int value, size_t count);
+char* APS5_VABI strnstr_nid_postfix(const char* haystack, const char* needle, size_t length);
+unsigned long long APS5_VABI _Stoull_nid_postfix(const char* str, char** endptr, int base);
+size_t APS5_VABI wcslen_nid_postfix(const char16_t* s);
+size_t APS5_VABI wcsnlen_s_nid_postfix(const char16_t* s, size_t maxlen);
+int APS5_VABI wcscmp_nid_postfix(const char16_t* s1, const char16_t* s2);
+int APS5_VABI wcsncmp_nid_postfix(const char16_t* s1, const char16_t* s2, size_t n);
+char16_t* APS5_VABI wcscpy_nid_postfix(char16_t* dest, const char16_t* src);
+char16_t* APS5_VABI wcscat_nid_postfix(char16_t* dest, const char16_t* src);
+char16_t* APS5_VABI wcsncpy_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+const char16_t* APS5_VABI wcschr_nid_postfix(const char16_t* s, char16_t c);
+const char16_t* APS5_VABI wcsrchr_nid_postfix(const char16_t* s, char16_t c);
+const char16_t* APS5_VABI wcsstr_nid_postfix(const char16_t* haystack, const char16_t* needle);
+const char16_t* APS5_VABI wcspbrk_nid_postfix(const char16_t* s, const char16_t* accept);
+size_t APS5_VABI wcsspn_nid_postfix(const char16_t* s, const char16_t* accept);
+size_t APS5_VABI wcscspn_nid_postfix(const char16_t* s, const char16_t* reject);
+char16_t* APS5_VABI wcstok_nid_postfix(char16_t* text, const char16_t* delimiters, char16_t** last);
+char16_t* APS5_VABI wmemset_nid_postfix(char16_t* s, char16_t c, size_t n);
+double APS5_VABI wcstod_nid_postfix(const char16_t* str, char16_t** endptr);
+float APS5_VABI wcstof_nid_postfix(const char16_t* str, char16_t** endptr);
+long double APS5_VABI wcstold_nid_postfix(const char16_t* str, char16_t** endptr);
+unsigned long long APS5_VABI wcstoul_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+unsigned long long APS5_VABI wcstoull_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+long long APS5_VABI wcstoll_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+long long APS5_VABI wcstol_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+long long APS5_VABI wcstoimax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+unsigned long long APS5_VABI wcstoumax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+std::uint64_t APS5_VABI _WStoul_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+int APS5_VABI wcscoll_nid_postfix(const char16_t* first, const char16_t* second);
+size_t APS5_VABI wcsxfrm_nid_postfix(char16_t* destination, const char16_t* source, size_t count);
+size_t APS5_VABI strxfrm_nid_postfix(char* destination, const char* source, size_t count);
+char* APS5_VABI strtok_s_nid_postfix(char* str, const char* delim, char** context);
+int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+int APS5_VABI wmemmove_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+int APS5_VABI wcsncpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+char16_t* APS5_VABI wcsncat_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+int APS5_VABI wcsncat_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+int APS5_VABI wcscat_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src);
+void APS5_VABI openlog_nid_postfix(const char* identity, int options, int facility);
+void APS5_VABI closelog_nid_postfix();
+int APS5_VABI setlogmask_nid_postfix(int mask);
+void APS5_VABI vsyslog_nid_postfix(int priority, const char* format, VaList* args);
+void APS5_VABI syslog_nid_postfix(int priority, const char* format, ...);
+int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
+int APS5_VABI _Mtx_init_with_name_nid_postfix(void** handle, int type, const char*);
+void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
+int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
+int APS5_VABI _Mtx_trylock_nid_postfix(void** handle);
+int APS5_VABI _Mtx_timedlock_nid_postfix(void** handle, const Xtime* target);
+int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
+int APS5_VABI _Cnd_init_nid_postfix(void** handle);
+int APS5_VABI _Cnd_init_with_default_name_override_nid_postfix(void** handle, const char*);
+void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
+int APS5_VABI _Cnd_wait_nid_postfix(void** conditionHandle, void** mutexHandle);
+int APS5_VABI _Cnd_timedwait_nid_postfix(void** conditionHandle, void** mutexHandle, const Xtime* target);
+int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
+unsigned APS5_VABI _ZNSt6thread20hardware_concurrencyEv_nid_postfix();
+int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime*);
+int APS5_VABI _Thrd_yield_nid_postfix();
+int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
+void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad);
+void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(GuestPad* pad);
+void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(GuestPad* pad);
+void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(GuestPad* pad, void** thread);
+void APS5_VABI _ZNSt4_Pad7_LaunchEPP12pthread_attrPP7pthread_nid_postfix(GuestPad* pad, void** attrSlot, void** thread);
+int APS5_VABI _Thrd_join_nid_postfix(void* thread, int* code);
+int APS5_VABI _Thrd_detach_nid_postfix(void* thread);
+void* APS5_VABI _Thrd_id_nid_postfix(void);
+void APS5_VABI _Call_once_nid_postfix(std::int32_t* flag, void (APS5_VABI* function)(void));
+int APS5_VABI _Tss_create_nid_postfix(int* key, void (APS5_VABI* destructor)(void*));
+int APS5_VABI _Tss_delete_nid_postfix(int key);
+void* APS5_VABI _Tss_get_nid_postfix(int key);
+int APS5_VABI _Tss_set_nid_postfix(int key, void* value);
+int APS5_VABI _Thrd_equal_nid_postfix(void* first, void* second);
+void* APS5_VABI _Thrd_current_nid_postfix(void);
+int APS5_VABI _Mtx_current_owns_nid_postfix(void**);
+int APS5_VABI _ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(void** mutex, int type, const char* name);
+int APS5_VABI _ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(void** mutex, int type);
+int APS5_VABI _ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v219_Cnd_init_with_nameEPP12pthread_condPKc_nid_postfix(void** condition, const char* name);
+int APS5_VABI _ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(void** condition, void** mutex);
+int APS5_VABI _ZNSt8__sce_v211_Cnd_signalEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v214_Cnd_broadcastEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(void* thread);
+int APS5_VABI _ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(void* thread, int* code);
+void APS5_VABI _ZNSt8__sce_v211_Thrd_yieldEv_nid_postfix();
+void* APS5_VABI _ZNSt8__sce_v28_Thrd_idEv_nid_postfix();
+void APS5_VABI tzset_nid_postfix(void);
+int64_t APS5_VABI libc_time_nid_postfix(int64_t* timer);
+int64_t APS5_VABI time_nid_postfix(int64_t* timer);
+int64_t APS5_VABI _Xtime_get_ticks_nid_postfix();
+double APS5_VABI libc_difftime_nid_postfix(int64_t time1, int64_t time0);
+double APS5_VABI difftime_nid_postfix(int64_t time1, int64_t time0);
+GuestTm* APS5_VABI libc_gmtime_nid_postfix(const int64_t* timer);
+GuestTm* APS5_VABI libc_localtime_nid_postfix(const int64_t* timer);
+GuestTm* APS5_VABI localtime_nid_postfix(const int64_t* timer);
+GuestTm* APS5_VABI gmtime_s_nid_postfix(const int64_t* timer, GuestTm* result);
+GuestTm* APS5_VABI gmtime_nid_postfix(const int64_t* timer);
+int64_t APS5_VABI libc_mktime_nid_postfix(GuestTm* timeptr);
+int64_t APS5_VABI mktime_nid_postfix(GuestTm* timeptr);
+size_t APS5_VABI libc_strftime_nid_postfix(char* str, size_t count, const char* format, const GuestTm* timeptr);
+char* APS5_VABI asctime_nid_postfix(const GuestTm* timeptr);
+char* APS5_VABI ctime_nid_postfix(const int64_t* timer);
+size_t APS5_VABI strftime_nid_postfix(char* str, size_t count, const char* format, const GuestTm* timeptr);
+size_t APS5_VABI wcsftime_nid_postfix(std::uint16_t* str, size_t count, const std::uint16_t* format, const GuestTm* timeptr);
+int64_t APS5_VABI clock_nid_postfix();
+int APS5_VABI ctime_s_nid_postfix(char* buffer, std::size_t size, const std::int64_t* time);
+int APS5_VABI asctime_s_nid_postfix(char* buffer, std::size_t size, const GuestTm* time);
+GuestTm* APS5_VABI gmtime_r_nid_postfix(const std::int64_t* timer, GuestTm* result);
+GuestTm* APS5_VABI localtime_r_nid_postfix(const std::int64_t* timer, GuestTm* result);
+std::int64_t APS5_VABI timegm_nid_postfix(GuestTm* time);
+int APS5_VABI xtime_get_nid_postfix(Xtime* time, int base);
+Xtime APS5_VABI _Xtime_to_ts_nid_postfix(const Xtime* time);
+Xtime APS5_VABI _Xtime_diff_to_ts_nid_postfix(const Xtime* target);
+const void* APS5_VABI __std_find_trivial_1_nid_postfix(const void* first, const void* last, std::uint8_t value);
+const void* APS5_VABI __std_find_trivial_2_nid_postfix(const void* first, const void* last, std::uint16_t value);
+const void* APS5_VABI __std_find_trivial_4_nid_postfix(const void* first, const void* last, std::uint32_t value);
+const void* APS5_VABI __std_find_trivial_8_nid_postfix(const void* first, const void* last, std::uint64_t value);
+const void* APS5_VABI __std_find_trivial_unsized_1_nid_postfix(const void* first, std::uint8_t value);
+const void* APS5_VABI __std_find_trivial_unsized_2_nid_postfix(const void* first, std::uint16_t value);
+const void* APS5_VABI __std_find_trivial_unsized_4_nid_postfix(const void* first, std::uint32_t value);
+const void* APS5_VABI __std_find_trivial_unsized_8_nid_postfix(const void* first, std::uint64_t value);
+std::size_t APS5_VABI __std_count_trivial_1_nid_postfix(const void* first, const void* last, std::uint8_t value);
+std::size_t APS5_VABI __std_count_trivial_2_nid_postfix(const void* first, const void* last, std::uint16_t value);
+std::size_t APS5_VABI __std_count_trivial_4_nid_postfix(const void* first, const void* last, std::uint32_t value);
+std::size_t APS5_VABI __std_count_trivial_8_nid_postfix(const void* first, const void* last, std::uint64_t value);
+const void* APS5_VABI __std_min_element_1_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_min_element_2_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_min_element_4_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_min_element_8_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_1_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_2_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_4_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_8_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_1_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_2_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_4_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_8_nid_postfix(const void* first, const void* last, bool isSigned);
+void APS5_VABI __std_reverse_trivially_swappable_1_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_trivially_swappable_2_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_trivially_swappable_4_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_trivially_swappable_8_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_copy_trivially_copyable_1_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_reverse_copy_trivially_copyable_2_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_reverse_copy_trivially_copyable_4_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_reverse_copy_trivially_copyable_8_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_swap_ranges_trivially_swappable_noalias_nid_postfix(void* first1, void* last1, void* first2);
+void APS5_VABI ignore_handler_s_nid_postfix(const char* message, void* pointer, int error);
+void* APS5_VABI set_constraint_handler_s_nid_postfix(void* handler);
+std::size_t APS5_VABI wcstombs_nid_postfix(char* destination, const std::uint16_t* source, std::size_t capacity);
+int APS5_VABI wcscpy_s_nid_postfix(std::uint16_t* dest, std::size_t size, const std::uint16_t* src);
+std::size_t APS5_VABI strerrorlen_s_nid_postfix(int error);
+int APS5_VABI strerror_s_nid_postfix(char* buffer, std::size_t capacity, int error);
+void APS5_VABI __cxa_vec_cleanup_nid_postfix(void* array, std::size_t count, std::size_t size, void (APS5_VABI *destroy)(void*));
+void APS5_VABI __cxa_vec_ctor_nid_postfix(void* array, std::size_t count, std::size_t size, void (APS5_VABI *construct)(void*), void (APS5_VABI *destroy)(void*));
+void APS5_VABI __cxa_vec_cctor_nid_postfix(void* destination, void* source, std::size_t count, std::size_t size, void (APS5_VABI *copy)(void*, void*), void (APS5_VABI *destroy)(void*));
+void APS5_VABI __cxa_vec_dtor_nid_postfix(void* array, std::size_t count, std::size_t size, void (APS5_VABI *destroy)(void*));
+void* APS5_VABI __cxa_vec_new_nid_postfix(std::size_t n, std::size_t s, std::size_t p, void (APS5_VABI *ctor)(void*), void (APS5_VABI *dtor)(void*));
+void* APS5_VABI __cxa_vec_new2_nid_postfix(std::size_t n, std::size_t s, std::size_t p, void (APS5_VABI *ctor)(void*), void (APS5_VABI *dtor)(void*), void* (APS5_VABI *alloc)(std::size_t), void (APS5_VABI *dealloc)(void*));
+void* APS5_VABI __cxa_vec_new3_nid_postfix(std::size_t n, std::size_t s, std::size_t p, void (APS5_VABI *ctor)(void*), void (APS5_VABI *dtor)(void*), void* (APS5_VABI *alloc)(std::size_t), void (APS5_VABI *dealloc)(void*, std::size_t));
+void APS5_VABI __cxa_vec_delete_nid_postfix(void* array, std::size_t s, std::size_t p, void (APS5_VABI *dtor)(void*));
+void APS5_VABI __cxa_vec_delete2_nid_postfix(void* array, std::size_t s, std::size_t p, void (APS5_VABI *dtor)(void*), void (APS5_VABI *dealloc)(void*));
+void APS5_VABI __cxa_vec_delete3_nid_postfix(void* array, std::size_t s, std::size_t p, void (APS5_VABI *dtor)(void*), void (APS5_VABI *dealloc)(void*, std::size_t));
+#ifndef _LIBCPP_VERSION
+void APS5_VABI _ZNSt13__future_base12_Result_baseD2Ev_nid_postfix(std::__future_base::_Result_base* self) noexcept;
+#endif
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptr9_M_addrefEv_nid_postfix(GuestExceptionPointer* self) noexcept;
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptr10_M_releaseEv_nid_postfix(GuestExceptionPointer* self) noexcept;
+void* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr6_M_getEv_nid_postfix(const GuestExceptionPointer* self) noexcept;
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC1EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept;
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC2EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept;
+const std::type_info* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr20__cxa_exception_typeEv_nid_postfix(const GuestExceptionPointer* self) noexcept;
+GuestExceptionPointer APS5_VABI _ZSt17current_exceptionv_nid_postfix() noexcept;
+int APS5_VABI __cxa_guard_acquire_nid_postfix(std::uint64_t* guardObject);
+void APS5_VABI __cxa_guard_release_nid_postfix(std::uint64_t* guardObject);
+void APS5_VABI __cxa_guard_abort_nid_postfix(std::uint64_t* guardObject);
+LibcException::Header* APS5_VABI __cxa_init_primary_exception_nid_postfix(void* object, std::type_info* type, void (*destructor)(void*));
+void* APS5_VABI __cxa_get_exception_ptr_nid_postfix(void* exception);
+std::type_info* APS5_VABI __cxa_current_exception_type_nid_postfix();
+void* APS5_VABI __cxa_get_globals_nid_postfix();
+void* APS5_VABI __cxa_get_globals_fast_nid_postfix();
+bool APS5_VABI __cxa_uncaught_exception_nid_postfix();
+unsigned APS5_VABI __cxa_uncaught_exceptions_nid_postfix();
+bool APS5_VABI _ZSt18uncaught_exceptionv_nid_postfix();
+int APS5_VABI _ZSt19uncaught_exceptionsv_nid_postfix();
+LibcTerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(LibcTerminateHandler handler);
+LibcTerminateHandler APS5_VABI _ZSt13get_terminatev_nid_postfix();
+void APS5_VABI __cxa_increment_exception_refcount_nid_postfix(void* object);
+void APS5_VABI __cxa_decrement_exception_refcount_nid_postfix(void* object);
+void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
+void* APS5_VABI __cxa_allocate_dependent_exception_nid_postfix();
+void APS5_VABI __cxa_free_dependent_exception_nid_postfix(void* storage);
+void APS5_VABI __cxa_rethrow_primary_exception_nid_postfix(void* object);
+void* APS5_VABI __dynamic_cast_nid_postfix(const void* source, const __cxxabiv1::__class_type_info* sourceType, const __cxxabiv1::__class_type_info* destinationType, std::ptrdiff_t);
+const char* APS5_VABI _ZSt13_Syserror_mapi_nid_postfix(int value);
+const LibcException::CategoryObject* APS5_VABI _ZSt16generic_categoryv_nid_postfix();
+const LibcException::CategoryObject* APS5_VABI _ZSt15system_categoryv_nid_postfix();
+GuestLocale::String* APS5_VABI _ZNKSt23_Generic_error_category7messageEi_nid_postfix( GuestLocale::String* result, const LibcException::CategoryObject* self, int value);
+void APS5_VABI _ZNSt9exceptionD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt9exception4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt8bad_cast4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt10bad_typeid4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt9bad_alloc4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt20bad_array_new_length4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt17bad_function_call4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12bad_weak_ptrD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12bad_weak_ptrD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12bad_weak_ptrD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12bad_weak_ptr4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt19bad_optional_access4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt11logic_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt11logic_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt11logic_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt11logic_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt11logic_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13runtime_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13runtime_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13runtime_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt13runtime_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13runtime_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13runtime_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13runtime_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13runtime_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt13runtime_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt16invalid_argumentD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt16invalid_argumentD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt16invalid_argumentD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt16invalid_argument4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt16invalid_argumentC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt16invalid_argumentC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt16invalid_argumentC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt16invalid_argumentC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt16invalid_argumentaSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12out_of_rangeD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12out_of_rangeD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12out_of_rangeD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12out_of_range4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12out_of_rangeC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12out_of_rangeC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12out_of_rangeC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12out_of_rangeC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt12out_of_rangeaSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12domain_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12domain_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12domain_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12domain_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12domain_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12domain_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12domain_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12domain_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt12domain_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12length_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12length_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12length_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12length_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12length_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12length_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12length_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12length_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt12length_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12system_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12system_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12system_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12system_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12system_errorC1ERKS__nid_postfix(LibcException::SystemErrorObject* self, const LibcException::SystemErrorObject* source);
+void APS5_VABI _ZNSt12system_errorC2ERKS__nid_postfix(LibcException::SystemErrorObject* self, const LibcException::SystemErrorObject* source);
+LibcException::SystemErrorObject* APS5_VABI _ZNSt12system_erroraSERKS__nid_postfix(LibcException::SystemErrorObject* self, const LibcException::SystemErrorObject* source);
+void APS5_VABI _ZNSt11regex_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11regex_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11regex_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt11regex_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11regex_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt11regex_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt11regex_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt11range_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11range_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11range_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt14overflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt15underflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8ios_base7failureD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8ios_base7failureD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8ios_base7failureD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt8ios_base7failure4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+_Unwind_Word APS5_VABI _Unwind_GetGR_nid_postfix(_Unwind_Context* context, int index);
+void APS5_VABI _Unwind_SetGR_nid_postfix(_Unwind_Context* context, int index, _Unwind_Word value);
+_Unwind_Ptr APS5_VABI _Unwind_GetIP_nid_postfix(_Unwind_Context* context);
+void APS5_VABI _Unwind_SetIP_nid_postfix(_Unwind_Context* context, _Unwind_Ptr value);
+_Unwind_Ptr APS5_VABI _Unwind_GetIPInfo_nid_postfix(_Unwind_Context* context, int* before);
+_Unwind_Word APS5_VABI _Unwind_GetCFA_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetLanguageSpecificData_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetRegionStart_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetDataRelBase_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetTextRelBase_nid_postfix(_Unwind_Context* context);
+_Unwind_Reason_Code APS5_VABI _Unwind_ForcedUnwind_nid_postfix(_Unwind_Exception* exception, _Unwind_Stop_Fn stop, void* argument);
+_Unwind_Reason_Code APS5_VABI _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn trace, void* argument);
+int APS5_VABI dl_iterate_phdr_nid_postfix(int (*callback)(dl_phdr_info*, std::size_t, void*), void* data);
+
+[[noreturn]] void APS5_VABI _Exit_nid_postfix(int code);
+[[noreturn]] void APS5_VABI catchReturnFromMain_nid_postfix(int status);
+[[noreturn]] void APS5_VABI quick_exit_nid_postfix(int status);
+[[noreturn]] void APS5_VABI _ZSt14_Throw_C_errori_nid_postfix(int code);
+[[noreturn]] char* APS5_VABI fgetln_nid_postfix(FileStream*, std::size_t*);
+[[noreturn]] void APS5_VABI _Assert_nid_postfix(const char* message, const char* location);
+[[noreturn]] void APS5_VABI _ZSt16_Throw_Cpp_errori_nid_postfix(int code);
+[[noreturn]] void APS5_VABI _Thrd_exit_nid_postfix(int code);
+[[noreturn]] void APS5_VABI _ZSt17rethrow_exceptionNSt15__exception_ptr13exception_ptrE_nid_postfix(GuestExceptionPointerArgument exception);
+[[noreturn]] void APS5_VABI _ZSt9terminatev_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_call_terminate_nid_postfix(void* exception);
+[[noreturn]] void APS5_VABI __cxa_pure_virtual_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_deleted_virtual_nid_postfix();
+[[noreturn]] void APS5_VABI _ZNKSt9exception8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNKSt9exception6_RaiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNKSt11logic_error8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI __cxa_bad_cast_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_bad_typeid_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_throw_bad_array_new_length_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt11_Xbad_allocv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt14_Xout_of_rangePKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt14_Xlength_errorPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt18_Xinvalid_argumentPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt15_Xruntime_errorPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt13_Xrange_errorPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt19_Xbad_function_callv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt19_Throw_bad_weak_ptrv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt26__throw_bad_variant_accessv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt26_Throw_bad_optional_accessv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt13_Xregex_errorNSt15regex_constants10error_typeE_nid_postfix(std::regex_constants::error_type code);
+
+[[gnu::returns_twice]] int APS5_VABI setjmp_nid_postfix(std::uint64_t* buffer);
+[[noreturn]] void APS5_VABI longjmp_nid_postfix(std::uint64_t* buffer, int value);
+
+std::uint8_t APS5_VABI __atomic_load_1_nid_postfix(const volatile std::uint8_t* target, int);
+std::uint16_t APS5_VABI __atomic_load_2_nid_postfix(const volatile std::uint16_t* target, int);
+std::uint32_t APS5_VABI __atomic_load_4_nid_postfix(const volatile std::uint32_t* target, int);
+std::uint64_t APS5_VABI __atomic_load_8_nid_postfix(const volatile std::uint64_t* target, int);
+void APS5_VABI __atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+void APS5_VABI __atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+void APS5_VABI __atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+void APS5_VABI __atomic_store_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+int APS5_VABI __atomic_compare_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int);
+int APS5_VABI __atomic_compare_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int);
+int APS5_VABI __atomic_compare_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t* expected, std::uint32_t desired, int, int);
+int APS5_VABI __atomic_compare_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int);
+std::uint8_t APS5_VABI __atomic_fetch_add_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_add_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_add_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_add_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_sub_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_sub_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_sub_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_and_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_and_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_and_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_and_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_or_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_or_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_or_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_or_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_xor_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_xor_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_xor_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xout_of_rangeEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v218_Xinvalid_argumentEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v215_Xruntime_errorEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Xoverflow_errorEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v211_Xbad_allocEv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_19bad_optional_accessE_nid_postfix(const LibcException::ExceptionObject*);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12bad_weak_ptrE_nid_postfix(const LibcException::ExceptionObject*);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_18bad_variant_accessE_nid_postfix(const LibcException::ExceptionObject*);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_11range_errorE_nid_postfix(const LibcException::ExceptionObject* error);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12system_errorE_nid_postfix(const LibcException::SystemErrorObject* error);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v28ios_base6_ThrowERKNS0_7failureE_nid_postfix(const LibcException::SystemErrorObject* failure);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Throw_Cpp_errorEi_nid_postfix(int code);
+std::int64_t APS5_VABI _ZNSt8__sce_v216_Xtime_get_ticksEv_nid_postfix();
+const char* APS5_VABI _ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(int value);
+int APS5_VABI feupdateenv_nid_postfix(const GuestFloatingPointEnvironment* environment);
+int APS5_VABI feholdexcept_nid_postfix(GuestFloatingPointEnvironment* environment);
+void APS5_VABI srandomdev_nid_postfix();
+
+double APS5_VABI _Stodx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error);
+float APS5_VABI _Stofx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error);
+long double APS5_VABI _Stoldx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error);
+float APS5_VABI _Stof_nid_postfix(const char* text, char** end, std::int64_t pten);
+long double APS5_VABI _Stold_nid_postfix(const char* text, char** end, std::int64_t pten);
+long long APS5_VABI _Stollx_nid_postfix(const char* text, char** end, int base, int* error);
+unsigned long long APS5_VABI _Stoullx_nid_postfix(const char* text, char** end, int base, int* error);
+std::uint64_t APS5_VABI _Stoulx_nid_postfix(const char* text, char** end, int base, int* error);
+std::int64_t APS5_VABI _Stolx_nid_postfix(const char* text, char** end, int base, int* error);
+std::size_t APS5_VABI _ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+std::size_t APS5_VABI _ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+std::size_t APS5_VABI _ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+std::size_t APS5_VABI _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+int APS5_VABI siginterrupt_nid_postfix(int guest, int flag);
+
+}
diff --git a/core/libs/prx/libc/include/AppArchive.hpp b/core/libs/prx/libc/include/AppArchive.hpp
index 13d25f34c3..23a1497885 100644
--- a/core/libs/prx/libc/include/AppArchive.hpp
+++ b/core/libs/prx/libc/include/AppArchive.hpp
@@ -21,6 +21,8 @@ struct AppArchiveBuffer {
 struct AppArchiveDirectoryEntry {
     std::string Name;
     bool Directory;
+    std::uint32_t Handle;
+    std::uint64_t Size;
 };
 
 extern "C" {
@@ -28,6 +30,9 @@ extern "C" {
 bool AppArchiveLookup_nid_no_patch(const std::filesystem::path& hostPath, AppArchiveNode* node);
 std::uint64_t AppArchiveRead_nid_no_patch(std::uint32_t handle, std::uint64_t offset, void* buffer, std::uint64_t length);
 std::vector<AppArchiveDirectoryEntry> AppArchiveList_nid_no_patch(std::uint32_t handle);
+std::vector<AppArchiveDirectoryEntry> AppArchiveListDirectory_nid_no_patch(const std::filesystem::path& hostPath);
+std::vector<AppArchiveDirectoryEntry> AppArchiveListUnshadowedDirectory_nid_no_patch(const std::filesystem::path& hostPath, const std::vector<std::string>& hostNames);
+bool AppArchiveNameMatches_nid_no_patch(const std::string& left, const std::string& right);
 void AppArchiveReady_nid_no_patch();
 void AppArchiveRefuseOnly_nid_no_patch(const std::filesystem::path& hostPath, const char* guestPath, const char* operation);
 void AppArchiveRefuseMergedListing_nid_no_patch(const std::filesystem::path& hostPath, const char* guestPath);
diff --git a/core/libs/prx/libc/include/ApplicationHeap.hpp b/core/libs/prx/libc/include/ApplicationHeap.hpp
index 00033a1d59..bd604dd95a 100644
--- a/core/libs/prx/libc/include/ApplicationHeap.hpp
+++ b/core/libs/prx/libc/include/ApplicationHeap.hpp
@@ -9,6 +9,7 @@ const void* ApplicationProcessParameters_nid_no_patch();
 bool ApplicationGuestHeapApi_nid_no_patch(void** api);
 void ApplicationHeapInitialize_nid_no_patch(const void* processParameters);
 void ApplicationHeapRegister_nid_no_patch(void* const* api);
+bool ApplicationHeapDefault_nid_no_patch();
 void* ApplicationHeapAllocate_nid_no_patch(std::size_t bytes);
 void ApplicationHeapFree_nid_no_patch(void* pointer);
 void* ApplicationHeapReallocate_nid_no_patch(void* pointer, std::size_t bytes);
diff --git a/core/libs/prx/libc/include/CallTrace.hpp b/core/libs/prx/libc/include/CallTrace.hpp
index b53c1ba96e..430700f0b5 100644
--- a/core/libs/prx/libc/include/CallTrace.hpp
+++ b/core/libs/prx/libc/include/CallTrace.hpp
@@ -23,6 +23,7 @@ void* TraceImport_nid_no_patch(void* target, const char* name, const char* libra
 std::size_t CopyCallTrace_nid_no_patch(CallTraceEntry* entries, std::size_t capacity);
 std::size_t CopyThreadCallTrace_nid_no_patch(std::uint64_t thread, CallTraceEntry* entries, std::size_t capacity);
 std::size_t CopyCallCounts_nid_no_patch(CallTraceCount* entries, std::size_t capacity, std::uint64_t* total);
+bool WriteCallCounts_nid_no_patch(const char* path);
 }
 
 #endif
diff --git a/core/libs/prx/libc/include/ChildProcesses.hpp b/core/libs/prx/libc/include/ChildProcesses.hpp
new file mode 100644
index 0000000000..9554bfb475
--- /dev/null
+++ b/core/libs/prx/libc/include/ChildProcesses.hpp
@@ -0,0 +1,11 @@
+#ifndef CORE_LIBS_PRX_LIBC_INCLUDE_CHILDPROCESSES_HPP
+#define CORE_LIBS_PRX_LIBC_INCLUDE_CHILDPROCESSES_HPP
+
+#ifdef _WIN32
+#include <cstdint>
+
+extern "C" void RegisterChildProcess_nid_no_patch(std::int32_t processId, std::int64_t processHandle);
+extern "C" std::int64_t WaitChildProcess_nid_no_patch(std::int32_t processId, unsigned options, int* status);
+#endif
+
+#endif
diff --git a/core/libs/prx/libc/include/FileStream.hpp b/core/libs/prx/libc/include/FileStream.hpp
index 3f1d90eb88..a97f626f49 100644
--- a/core/libs/prx/libc/include/FileStream.hpp
+++ b/core/libs/prx/libc/include/FileStream.hpp
@@ -17,6 +17,7 @@
 #include "prx/libc/include/FileLock.hpp"
 extern "C" void* HostStandardHandle_nid_no_patch(int descriptor);
 extern "C" void KeepStandardHandle_nid_no_patch(int descriptor, void* handle);
+extern "C" void PrepareStandardStreams_nid_no_patch();
 struct UcrtStreamState {
     char* pointer;
     char* base;
@@ -73,6 +74,9 @@ class FileStream {
 public:
     explicit FileStream(std::FILE* handle, bool dynamic = false) : _handle(handle), _dynamic(dynamic) {
         if (!_handle) throw std::runtime_error("FileStream: null handle");
+#ifdef _WIN32
+        PrepareStandardStreams_nid_no_patch();
+#endif
         _guest.flags = handle == stdin ? 4 : handle == stdout || handle == stderr ? 8 : 0x10;
 #ifdef _WIN32
         const int descriptor = _fileno(handle);
@@ -230,9 +234,12 @@ public:
 #ifdef _WIN32
         const bool endOfFile = std::feof(GetHandle()) != 0;
         const bool error = std::ferror(GetHandle()) != 0;
+#elif defined(__APPLE__)
+        const bool endOfFile = feof_unlocked(GetHandle()) != 0;
+        const bool error = ferror_unlocked(GetHandle()) != 0;
 #else
-        const bool endOfFile = ::feof_unlocked(GetHandle()) != 0;
-        const bool error = ::ferror_unlocked(GetHandle()) != 0;
+        const bool endOfFile = feof_unlocked(GetHandle()) != 0;
+        const bool error = ferror_unlocked(GetHandle()) != 0;
 #endif
         PublishStatus(endOfFile, error || guestError);
     }
diff --git a/core/libs/prx/libc/include/General.hpp b/core/libs/prx/libc/include/General.hpp
index f22c2e8556..7596a572a2 100644
--- a/core/libs/prx/libc/include/General.hpp
+++ b/core/libs/prx/libc/include/General.hpp
@@ -16,10 +16,10 @@ extern "C" [[noreturn]] void NotImplemented_nid_no_patch(const char* funcName);
 extern "C" void CxaFinalize_nid_no_patch(void* dsoHandle);
 extern "C" bool StopAtPrefixLetter_nid_no_patch(const char* str, char** endptr, int base);
 extern "C" bool RejectIntegerBase_nid_no_patch(const char* str, char** endptr, int base, bool setError);
-#ifndef _WIN32
 extern "C" int KeepHostStandardError_nid_no_patch();
-extern "C" int HostStandardError_nid_no_patch();
 extern "C" int KeepHostStandardOutput_nid_no_patch();
+#ifndef _WIN32
+extern "C" int HostStandardError_nid_no_patch();
 #else
 extern "C" bool AdoptHostStandardStream_nid_no_patch(int standard, int saved);
 extern "C" std::FILE* HostStandardOutputFile_nid_no_patch();
@@ -27,8 +27,11 @@ extern "C" std::FILE* HostStandardErrorFile_nid_no_patch();
 #endif
 
 extern "C" bool CopyGuestEnvironment_nid_no_patch(const char* name, std::string& value);
+extern "C" int CopyGuestString_nid_no_patch(const char* source, std::size_t maximum, std::string& destination);
+extern "C" int CopyGuestPath_nid_no_patch(const char* source, std::string& destination);
 
 extern "C" std::filesystem::path ResolvePath_nid_no_patch(const char* path);
+extern "C" bool GuestCopyOut_nid_no_patch(void* destination, const void* source, std::size_t bytes);
 extern "C" std::filesystem::path ResolvePathOrRelinkedModule_nid_no_patch(const char* path);
 extern "C" std::filesystem::path ResolveArchivedPath_nid_no_patch(const char* path, bool module = false);
 extern "C" std::filesystem::path ResolveDiskPath_nid_no_patch(const char* path);
@@ -70,6 +73,28 @@ struct ThreadForwards_nid_no_patch {
     void (APS5_VABI* exit)(void*);
 };
 extern "C" void RegisterThreadForwards_nid_no_patch(const ThreadForwards_nid_no_patch* forwards);
+struct PthreadSyncForwards_nid_no_patch {
+    int (APS5_VABI* mutexattrInit)(void**);
+    int (APS5_VABI* mutexattrSettype)(void**, int);
+    int (APS5_VABI* mutexattrDestroy)(void**);
+    int (APS5_VABI* mutexInit)(void**, void* const*, const char*);
+    int (APS5_VABI* mutexDestroy)(void**);
+    int (APS5_VABI* mutexLock)(void**);
+    int (APS5_VABI* mutexTrylock)(void**);
+    int (APS5_VABI* mutexUnlock)(void**);
+    int (APS5_VABI* condInit)(void**, void* const*, const char*);
+    int (APS5_VABI* condDestroy)(void**);
+    int (APS5_VABI* condWait)(void**, void**);
+    int (APS5_VABI* condSignal)(void**);
+    int (APS5_VABI* condBroadcast)(void**);
+    int (APS5_VABI* detach)(void*);
+    int (APS5_VABI* join)(void*, void**);
+    void (APS5_VABI* yield)();
+};
+extern "C" void RegisterPthreadSyncForwards_nid_no_patch(const PthreadSyncForwards_nid_no_patch* forwards);
+
+using SigactionFn_nid_no_patch = int (APS5_VABI*)(int, const void*, void*);
+extern "C" void RegisterSigaction_nid_no_patch(SigactionFn_nid_no_patch fn, std::uint32_t* interruptSet);
 
 #define APS5_INVALID_ARG_EX throw std::invalid_argument(std::string(__func__) + ": invalid argument")
 
diff --git a/core/libs/prx/libc/include/GuestArena.hpp b/core/libs/prx/libc/include/GuestArena.hpp
index bf0d756d40..49719e365b 100644
--- a/core/libs/prx/libc/include/GuestArena.hpp
+++ b/core/libs/prx/libc/include/GuestArena.hpp
@@ -55,6 +55,10 @@ void GuestArenaMapFile_nid_postfix(void* pointer, std::size_t bytes, void* secti
 void* GuestArenaMapAlias_nid_postfix(std::uintptr_t address, std::size_t bytes);
 void GuestArenaUnmapAlias_nid_postfix(void* alias);
 bool GuestArenaResidentSpan_nid_postfix(std::uintptr_t address, std::size_t bytes, std::uintptr_t* start, std::uintptr_t* end);
+void GuestArenaCompareWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes);
+void GuestArenaCompareResidentWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes);
+void GuestArenaComparedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count);
+void GuestArenaTakeUnreportedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count);
 void GuestArenaForgetSection_nid_postfix(void* section);
 bool GuestArenaBeginHostImport_nid_no_patch(void* pointer, std::size_t bytes);
 void GuestArenaEndHostImport_nid_no_patch(void* pointer, std::size_t bytes);
diff --git a/core/libs/prx/libc/include/GuestDirectory.hpp b/core/libs/prx/libc/include/GuestDirectory.hpp
index 3f83ab1a18..775ca51c4f 100644
--- a/core/libs/prx/libc/include/GuestDirectory.hpp
+++ b/core/libs/prx/libc/include/GuestDirectory.hpp
@@ -14,4 +14,5 @@ struct GuestDirectoryEntry {
 static_assert(offsetof(GuestDirectoryEntry, name) == 8);
 static_assert(sizeof(GuestDirectoryEntry) == 264);
 
-extern "C" void* APS5_VABI OpenDescriptorDirectory_nid_no_patch(const char* hostPath, int descriptor, int (APS5_VABI* closeDescriptor)(int), std::uint64_t position);
+extern "C" void* APS5_VABI OpenDescriptorDirectory_nid_no_patch(const char* hostPath, int descriptor, int (APS5_VABI* closeDescriptor)(int), std::uint64_t position,
+    int (APS5_VABI* readDescriptor)(int, char*, int), std::int64_t (APS5_VABI* seekDescriptor)(int, std::int64_t, int));
diff --git a/core/libs/prx/libc/include/GuestFileNumber.hpp b/core/libs/prx/libc/include/GuestFileNumber.hpp
new file mode 100644
index 0000000000..58512f9b14
--- /dev/null
+++ b/core/libs/prx/libc/include/GuestFileNumber.hpp
@@ -0,0 +1,11 @@
+#ifndef CORE_LIBS_PRX_LIBC_INCLUDE_GUESTFILENUMBER_HPP
+#define CORE_LIBS_PRX_LIBC_INCLUDE_GUESTFILENUMBER_HPP
+
+#include <cstdint>
+
+inline constexpr std::uint32_t GuestFileNumber_nid_no_patch(std::uint64_t identity) noexcept {
+    const auto folded = static_cast<std::uint32_t>(identity) ^ (static_cast<std::uint32_t>(identity >> 32) * 0x9E3779B1u);
+    return folded == 0 ? 1 : folded;
+}
+
+#endif
diff --git a/core/libs/prx/libc/include/GuestLocale.hpp b/core/libs/prx/libc/include/GuestLocale.hpp
index 45e29df3f1..92ca9f13b8 100644
--- a/core/libs/prx/libc/include/GuestLocale.hpp
+++ b/core/libs/prx/libc/include/GuestLocale.hpp
@@ -58,6 +58,40 @@ struct CollateVtable {
     std::int64_t (APS5_VABI *hash)(const CollateFacet* self, const char* first, const char* last);
 };
 
+struct CodecvtVtable {
+    FacetVtable facet;
+    bool (APS5_VABI *alwaysNoconv)(const Facet* self);
+    int (APS5_VABI *maxLength)(const Facet* self);
+    int (APS5_VABI *encoding)(const Facet* self);
+    int (APS5_VABI *in)(Facet* self, std::uint64_t* state, const char* first1, const char* last1, const char** next1, char* first3, char* last3, char** next3);
+    int (APS5_VABI *out)(Facet* self, std::uint64_t* state, const char* first1, const char* last1, const char** next1, char* first3, char* last3, char** next3);
+    int (APS5_VABI *unshift)(Facet* self, std::uint64_t* state, char* first3, char* last3, char** next3);
+    std::size_t (APS5_VABI *length)(Facet* self, std::uint64_t* state, const char* first1, const char* last1, std::size_t count);
+};
+
+struct NumpunctFacet {
+    Facet base;
+    const char* grouping;
+    char decimalPoint;
+    char thousandsSep;
+    const char* falsename;
+    const char* truename;
+};
+
+struct NumpunctVtable {
+    FacetVtable facet;
+    char (APS5_VABI *decimalPoint)(const NumpunctFacet* self);
+    char (APS5_VABI *thousandsSep)(const NumpunctFacet* self);
+    String* (APS5_VABI *grouping)(String* result, const NumpunctFacet* self);
+    String* (APS5_VABI *falsename)(String* result, const NumpunctFacet* self);
+    String* (APS5_VABI *truename)(String* result, const NumpunctFacet* self);
+};
+
+struct UnsupportedMethodsVtable {
+    FacetVtable facet;
+    void (APS5_VABI *methods[8])();
+};
+
 struct IosBase {
     const void* vtable;
     std::int64_t standardStream;
@@ -89,6 +123,16 @@ static_assert(offsetof(CollateFacet, collation) == 0x10);
 static_assert(sizeof(CollateFacet) == 0x20);
 static_assert(offsetof(CollateVtable, compare) == 0x20);
 static_assert(offsetof(CollateVtable, hash) == 0x30);
+static_assert(offsetof(CodecvtVtable, alwaysNoconv) == 0x20);
+static_assert(offsetof(CodecvtVtable, in) == 0x38);
+static_assert(offsetof(CodecvtVtable, length) == 0x50);
+static_assert(sizeof(NumpunctFacet) == 0x30);
+static_assert(offsetof(NumpunctFacet, grouping) == 0x10);
+static_assert(offsetof(NumpunctFacet, decimalPoint) == 0x18);
+static_assert(offsetof(NumpunctFacet, falsename) == 0x20);
+static_assert(offsetof(NumpunctFacet, truename) == 0x28);
+static_assert(offsetof(NumpunctVtable, decimalPoint) == 0x20);
+static_assert(offsetof(NumpunctVtable, truename) == 0x40);
 static_assert(alignof(LocinfoStorage) == 8);
 
 }
diff --git a/core/libs/prx/libc/include/JumpBuffer.hpp b/core/libs/prx/libc/include/JumpBuffer.hpp
new file mode 100644
index 0000000000..07e272b61e
--- /dev/null
+++ b/core/libs/prx/libc/include/JumpBuffer.hpp
@@ -0,0 +1,18 @@
+#ifndef CORE_LIBS_PRX_LIBC_INCLUDE_JUMPBUFFER_HPP
+#define CORE_LIBS_PRX_LIBC_INCLUDE_JUMPBUFFER_HPP
+
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+namespace JumpBuffer {
+
+using Sigprocmask = int (APS5_VABI*)(int how, const void* set, void* previousSet);
+
+extern "C" {
+
+void GuestSigprocmaskRegister_nid_no_patch(Sigprocmask sigprocmask);
+
+}
+
+}
+
+#endif
diff --git a/core/libs/prx/libc/include/SonyCrt.hpp b/core/libs/prx/libc/include/SonyCrt.hpp
index db53cd3d54..fc97c753f1 100644
--- a/core/libs/prx/libc/include/SonyCrt.hpp
+++ b/core/libs/prx/libc/include/SonyCrt.hpp
@@ -88,7 +88,7 @@ inline int SonyFormatAsctime(char* buffer, std::size_t size, const GuestTm& time
     static const char* const days[] = {"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"};
     static const char* const months[] = {"Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"};
     if (!buffer || size < 26) return EINVAL;
-    const int year = 1900 + time.tm_year;
+    const std::int64_t year = std::int64_t{time.tm_year} + 1900;
     if (time.tm_wday < 0 || time.tm_wday > 6 || time.tm_mon < 0 || time.tm_mon > 11 ||
         time.tm_mday < 1 || time.tm_mday > 31 || time.tm_hour < 0 || time.tm_hour > 23 ||
         time.tm_min < 0 || time.tm_min > 59 || time.tm_sec < 0 || time.tm_sec > 60 ||
@@ -97,7 +97,7 @@ inline int SonyFormatAsctime(char* buffer, std::size_t size, const GuestTm& time
         return EINVAL;
     }
     std::snprintf(buffer, size, "%.3s %.3s %2d %.2d:%.2d:%.2d %4d\n", days[time.tm_wday], months[time.tm_mon],
-        time.tm_mday, time.tm_hour, time.tm_min, time.tm_sec, year);
+        time.tm_mday, time.tm_hour, time.tm_min, time.tm_sec, static_cast<int>(year));
     return 0;
 }
 
diff --git a/core/libs/prx/libc/include/WindowsDescriptor.hpp b/core/libs/prx/libc/include/WindowsDescriptor.hpp
index 66ebc1d9ac..772a28f086 100644
--- a/core/libs/prx/libc/include/WindowsDescriptor.hpp
+++ b/core/libs/prx/libc/include/WindowsDescriptor.hpp
@@ -1,6 +1,7 @@
 #ifndef CORE_LIBS_PRX_LIBC_INCLUDE_WINDOWSDESCRIPTOR_HPP
 #define CORE_LIBS_PRX_LIBC_INCLUDE_WINDOWSDESCRIPTOR_HPP
 
+#include "GuestFileNumber.hpp"
 #include <cstdint>
 #include <io.h>
 #include <stdexcept>
@@ -29,8 +30,7 @@ static inline ACCESS_MASK WindowsHandleAccess_nid_no_patch(HANDLE handle, int de
 }
 
 static inline std::uint32_t WindowsFileNumber_nid_no_patch(std::uint64_t fileId) {
-    const std::uint32_t folded = static_cast<std::uint32_t>(fileId) ^ (static_cast<std::uint32_t>(fileId >> 32) * 0x9E3779B1u);
-    return folded == 0 ? 1 : folded;
+    return GuestFileNumber_nid_no_patch(fileId);
 }
 
 static inline std::uint32_t WindowsFileNumber_nid_no_patch(const BY_HANDLE_FILE_INFORMATION& identity) {
diff --git a/core/libs/prx/libc/include/WindowsFormatting.hpp b/core/libs/prx/libc/include/WindowsFormatting.hpp
index 0c8dd2861f..2023452e25 100644
--- a/core/libs/prx/libc/include/WindowsFormatting.hpp
+++ b/core/libs/prx/libc/include/WindowsFormatting.hpp
@@ -2,7 +2,9 @@
 #define CORE_LIBS_PRX_LIBC_INCLUDE_WINDOWSFORMATTING_HPP
 
 #include "SceTypes.hpp"
+#include <algorithm>
 #include <array>
+#include <bit>
 #include <cerrno>
 #include <cmath>
 #include <cstdint>
@@ -15,7 +17,6 @@
 #include <vector>
 #include <type_traits>
 
-extern "C" int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t length);
 extern "C" std::FILE* GuestStandardOutputFile_nid_no_patch();
 
 namespace LibcDetail {
@@ -161,7 +162,279 @@ inline void AppendUtf8(std::string& utf8, char32_t code) {
     }
 }
 
-inline std::string NanSpec(const std::string& spec) {
+struct FloatSpec {
+    bool left = false;
+    bool plus = false;
+    bool space = false;
+    bool alternate = false;
+    bool zero = false;
+    std::size_t width = 0;
+    int precision = -1;
+};
+
+inline FloatSpec ParseFloatSpec(const std::string& spec) {
+    FloatSpec result;
+    std::size_t index = 1;
+    for (; index < spec.size() && std::strchr("-+ #0", spec[index]); ++index) {
+        result.left |= spec[index] == '-';
+        result.plus |= spec[index] == '+';
+        result.space |= spec[index] == ' ';
+        result.alternate |= spec[index] == '#';
+        result.zero |= spec[index] == '0';
+    }
+    for (; index < spec.size() && spec[index] >= '0' && spec[index] <= '9'; ++index) {
+        const auto digit = static_cast<std::size_t>(spec[index] - '0');
+        if (result.width > (static_cast<std::size_t>(INT_MAX) - digit) / 10)
+            throw std::overflow_error("Formatted output exceeds INT_MAX");
+        result.width = result.width * 10 + digit;
+    }
+    if (index < spec.size() && spec[index] == '.') {
+        result.precision = 0;
+        for (++index; index < spec.size(); ++index) {
+            const int digit = spec[index] - '0';
+            if (result.precision > (INT_MAX - digit) / 10)
+                throw std::overflow_error("Floating precision exceeds int range");
+            result.precision = result.precision * 10 + digit;
+        }
+    }
+    return result;
+}
+
+inline std::string PadFloat(const FloatSpec& spec, const std::string& prefix, const std::string& body) {
+    const std::size_t length = prefix.size() + body.size();
+    if (length >= spec.width) return prefix + body;
+    const std::string padding(spec.width - length, spec.left || !spec.zero ? ' ' : '0');
+    if (spec.left) return prefix + body + padding;
+    return spec.zero ? prefix + padding + body : padding + prefix + body;
+}
+
+inline std::string HexFloat(const std::string& spec, char conversion, double value, std::size_t maximumLength = INT_MAX) {
+    const FloatSpec parsed = ParseFloatSpec(spec);
+    const bool plus = parsed.plus, space = parsed.space, alternate = parsed.alternate;
+    const std::size_t width = parsed.width;
+    const int precision = parsed.precision;
+    const bool upper = conversion == 'A';
+    const std::uint64_t bits = std::bit_cast<std::uint64_t>(value);
+    int exponent = static_cast<int>((bits >> 52) & 0x7ff);
+    std::uint64_t fraction = bits & ((std::uint64_t{1} << 52) - 1);
+    std::uint64_t lead = 1;
+    if (exponent != 0) {
+        exponent -= 1023;
+    } else if (fraction == 0) {
+        lead = 0;
+    } else {
+        exponent = -1022;
+        while ((fraction & (std::uint64_t{1} << 52)) == 0) {
+            fraction <<= 1;
+            --exponent;
+        }
+        fraction &= (std::uint64_t{1} << 52) - 1;
+    }
+    int digits = 13;
+    if (precision >= 0 && precision < 13) {
+        const int dropped = (13 - precision) * 4;
+        const std::uint64_t remainder = fraction & ((std::uint64_t{1} << dropped) - 1);
+        fraction >>= dropped;
+        if (remainder >= std::uint64_t{1} << (dropped - 1) && ++fraction >> (precision * 4)) {
+            fraction &= (std::uint64_t{1} << (precision * 4)) - 1;
+            ++lead;
+        }
+        digits = precision;
+    } else if (precision < 0) {
+        for (; digits > 0 && (fraction & 0xf) == 0; --digits) fraction >>= 4;
+    }
+    const char* hex = upper ? "0123456789ABCDEF" : "0123456789abcdef";
+    std::string suffix = upper ? "P" : "p";
+    suffix += exponent < 0 ? '-' : '+';
+    suffix += std::to_string(exponent < 0 ? -exponent : exponent);
+    std::string prefix = (bits >> 63) != 0 ? "-" : plus ? "+" : space ? " " : "";
+    prefix += upper ? "0X" : "0x";
+    const auto fractionalDigits = static_cast<std::size_t>(precision > 13 ? precision : digits);
+    const bool point = fractionalDigits != 0 || alternate;
+    const std::size_t length = prefix.size() + 1 + point + fractionalDigits + suffix.size();
+    if (length > maximumLength || width > maximumLength)
+        throw std::overflow_error("Formatted output exceeds INT_MAX");
+    std::string body(1, hex[lead]);
+    if (point) body += '.';
+    for (int digit = digits - 1; digit >= 0; --digit) body += hex[(fraction >> (digit * 4)) & 0xf];
+    if (precision > 13) body.append(static_cast<std::size_t>(precision - 13), '0');
+    body += suffix;
+    return PadFloat(parsed, prefix, body);
+}
+
+struct DecimalDigits {
+    std::string digits;
+    long long exponent = 0;
+    bool truncated = false;
+    bool tiesDown = false;
+};
+
+inline std::string DecimalChunks(std::vector<std::uint32_t> words) {
+    std::string text;
+    while (!words.empty()) {
+        std::uint64_t remainder = 0;
+        for (std::size_t index = words.size(); index-- > 0;) {
+            const std::uint64_t current = (remainder << 32) | words[index];
+            words[index] = static_cast<std::uint32_t>(current / 1000000000u);
+            remainder = current % 1000000000u;
+        }
+        while (!words.empty() && words.back() == 0) words.pop_back();
+        std::string chunk = std::to_string(remainder);
+        if (!words.empty()) chunk.insert(0, 9 - chunk.size(), '0');
+        text.insert(0, chunk);
+    }
+    return text;
+}
+
+inline DecimalDigits ConsoleDecimalDigits(long double value) {
+    DecimalDigits result;
+    if (value == 0) return result;
+    int binary = 0;
+    const auto mantissa = static_cast<std::uint64_t>(std::ldexp(std::frexp(std::fabs(value), &binary), 64));
+    const long long estimate = static_cast<long long>(binary) * 30103 / 100000;
+    const long long last = (estimate >= 0 ? estimate / 4 : -((3 - estimate) / 4)) * 4 - 20;
+    result.tiesDown = estimate >= 8;
+    binary -= 64;
+    std::string integer;
+    std::string fraction;
+    bool remaining = false;
+    if (binary >= 0) {
+        const auto word = static_cast<std::size_t>(binary) / 32;
+        const auto bit = static_cast<unsigned>(binary) % 32;
+        std::vector<std::uint32_t> words(word + 3, 0);
+        for (std::size_t part = 0; part < 2; ++part) {
+            const std::uint64_t shifted = ((mantissa >> (32 * part)) & 0xffffffffu) << bit;
+            words[word + part] |= static_cast<std::uint32_t>(shifted);
+            words[word + part + 1] |= static_cast<std::uint32_t>(shifted >> 32);
+        }
+        while (!words.empty() && words.back() == 0) words.pop_back();
+        integer = DecimalChunks(std::move(words));
+    } else {
+        const auto shift = static_cast<std::size_t>(-static_cast<long long>(binary));
+        const std::uint64_t whole = shift >= 64 ? 0 : mantissa >> shift;
+        if (whole != 0) integer = std::to_string(whole);
+        std::vector<std::uint32_t> words(shift / 32 + 2, 0);
+        const std::uint64_t remainder = shift >= 64 ? mantissa : mantissa & ((std::uint64_t{1} << shift) - 1);
+        words[0] = static_cast<std::uint32_t>(remainder);
+        words[1] = static_cast<std::uint32_t>(remainder >> 32);
+        const std::size_t top = shift / 32;
+        const auto bit = static_cast<unsigned>(shift % 32);
+        const auto significant = [&] {
+            const std::size_t leading = fraction.find_first_not_of('0');
+            return integer.size() + (leading == std::string::npos ? 0 : fraction.size() - leading);
+        };
+        remaining = remainder != 0;
+        while (remaining && significant() < 30) {
+            std::uint64_t carry = 0;
+            for (auto& word : words) {
+                const std::uint64_t product = static_cast<std::uint64_t>(word) * 1000000000u + carry;
+                word = static_cast<std::uint32_t>(product);
+                carry = product >> 32;
+            }
+            const std::uint64_t window = (static_cast<std::uint64_t>(words[top + 1]) << 32) | words[top];
+            const std::string chunk = std::to_string(static_cast<std::uint32_t>(window >> bit));
+            words[top + 1] = 0;
+            words[top] &= bit == 0 ? 0 : (std::uint32_t{1} << bit) - 1;
+            fraction += std::string(9 - chunk.size(), '0') + chunk;
+            remaining = std::any_of(words.begin(), words.end(), [](std::uint32_t word) { return word != 0; });
+        }
+    }
+    if (!integer.empty()) {
+        result.exponent = static_cast<long long>(integer.size()) - 1;
+        result.digits = integer + fraction;
+    } else {
+        const std::size_t leading = fraction.find_first_not_of('0');
+        result.exponent = -static_cast<long long>(leading) - 1;
+        result.digits = fraction.substr(leading);
+    }
+    const long long kept = result.exponent - last + 1;
+    if (static_cast<long long>(result.digits.size()) > kept) {
+        result.truncated = result.digits.find_first_not_of('0', static_cast<std::size_t>(kept)) != std::string::npos;
+        result.digits.resize(static_cast<std::size_t>(kept));
+    }
+    result.truncated |= remaining;
+    return result;
+}
+
+inline DecimalDigits RoundDecimal(const DecimalDigits& value, long long count) {
+    if (value.digits.empty()) return value;
+    if (count <= 0) {
+        if (count == 0 && value.digits[0] >= '5') return {"1", value.exponent + 1};
+        return {};
+    }
+    if (count >= static_cast<long long>(value.digits.size())) return value;
+    DecimalDigits result{value.digits.substr(0, static_cast<std::size_t>(count)), value.exponent};
+    const auto next = static_cast<std::size_t>(count);
+    if (value.digits[next] < '5') return result;
+    if (value.digits[next] == '5' && value.tiesDown && !value.truncated && value.digits.find_first_not_of('0', next + 1) == std::string::npos)
+        return result;
+    for (std::size_t index = result.digits.size(); index-- > 0;) {
+        if (result.digits[index] != '9') {
+            ++result.digits[index];
+            return result;
+        }
+        result.digits[index] = '0';
+    }
+    result.digits.insert(result.digits.begin(), '1');
+    result.digits.pop_back();
+    ++result.exponent;
+    return result;
+}
+
+inline char DigitAt(const DecimalDigits& value, long long position) {
+    const long long index = value.exponent - position;
+    if (value.digits.empty() || index < 0 || index >= static_cast<long long>(value.digits.size())) return '0';
+    return value.digits[static_cast<std::size_t>(index)];
+}
+
+inline std::string DecimalFloat(const std::string& spec, char conversion, long double value, std::size_t maximumLength = INT_MAX) {
+    const FloatSpec parsed = ParseFloatSpec(spec);
+    const DecimalDigits exact = ConsoleDecimalDigits(value);
+    const bool upper = conversion == 'E' || conversion == 'G';
+    const char lower = static_cast<char>(conversion | 0x20);
+    long long precision = parsed.precision < 0 ? 6 : parsed.precision;
+    bool exponential = lower == 'e';
+    bool strip = false;
+    if (lower == 'g') {
+        if (precision == 0) precision = 1;
+        const long long exponent = exact.digits.empty() ? 0 : RoundDecimal(exact, precision).exponent;
+        exponential = !(precision > exponent && exponent >= -4);
+        precision = exponential ? precision - 1 : precision - 1 - exponent;
+        strip = !parsed.alternate;
+    }
+    const DecimalDigits rounded = RoundDecimal(exact, exponential ? precision + 1 : exact.exponent + 1 + precision);
+    const long long exponent = rounded.digits.empty() ? 0 : rounded.exponent;
+    if (strip) {
+        const long long last = rounded.digits.empty() ? 0 : rounded.exponent - static_cast<long long>(rounded.digits.size()) + 1;
+        long long needed = exponential ? exponent - last : -last;
+        while (needed > 0 && DigitAt(rounded, (exponential ? exponent : 0) - needed) == '0') --needed;
+        precision = std::max(0LL, std::min(precision, needed));
+    }
+    const std::string prefix = std::signbit(value) ? "-" : parsed.plus ? "+" : parsed.space ? " " : "";
+    const bool point = precision > 0 || parsed.alternate;
+    const std::string magnitude = std::to_string(exponent < 0 ? -exponent : exponent);
+    const long long whole = exponential || exponent < 0 ? 1 : exponent + 1;
+    const long long exponentLength = exponential ? 2 + static_cast<long long>(std::max<std::size_t>(magnitude.size(), 2)) : 0;
+    const long long length = static_cast<long long>(prefix.size()) + whole + point + precision + exponentLength;
+    if (length > static_cast<long long>(maximumLength) || parsed.width > maximumLength)
+        throw std::overflow_error("Formatted output exceeds INT_MAX");
+    std::string body;
+    body.reserve(static_cast<std::size_t>(length));
+    const long long first = exponential ? exponent : std::max(exponent, 0LL);
+    for (long long position = first; position >= (exponential ? exponent : 0); --position) body += DigitAt(rounded, position);
+    if (point) body += '.';
+    const long long start = exponential ? exponent - 1 : -1;
+    for (long long position = start; position > start - precision; --position) body += DigitAt(rounded, position);
+    if (exponential) {
+        body += upper ? 'E' : 'e';
+        body += exponent < 0 ? '-' : '+';
+        if (magnitude.size() < 2) body += '0';
+        body += magnitude;
+    }
+    return PadFloat(parsed, prefix, body);
+}
+
+inline std::string PaddedStringSpec(const std::string& spec) {
     std::string result = "%";
     std::size_t index = 1;
     for (; index < spec.size() && std::strchr("-+ #0", spec[index]); ++index)
@@ -170,6 +443,14 @@ inline std::string NanSpec(const std::string& spec) {
     return result + 's';
 }
 
+inline std::string NanText(const std::string& spec, bool negative, bool upper) {
+    std::string sign;
+    if (negative) sign = "-";
+    else if (spec.find('+') != std::string::npos) sign = "+";
+    else if (spec.find(' ') != std::string::npos) sign = " ";
+    return sign + (upper ? "NAN" : "nan");
+}
+
 inline std::string FormatPointer(const std::string& spec, const void* pointer) {
     std::size_t index = 1;
     bool left = false;
@@ -205,7 +486,8 @@ inline std::string FormatPointer(const std::string& spec, const void* pointer) {
     return std::string(padding, ' ') + digits;
 }
 
-constexpr size_t maximumArgumentPosition = 99;
+inline constexpr char KnownConversions[] = "diouxXeEfFgGaAcCsSpn";
+constexpr size_t maximumArgumentPosition = 65535;
 
 inline size_t ArgumentPosition(const char*& format) {
     const char* end = format;
@@ -214,7 +496,8 @@ inline size_t ArgumentPosition(const char*& format) {
     size_t position = 0;
     for (const char* digit = format; digit != end && position <= maximumArgumentPosition; ++digit)
         position = position * 10 + static_cast<size_t>(*digit - '0');
-    if (position == 0 || position > maximumArgumentPosition) throw std::invalid_argument("Format argument position out of range");
+    if (position == 0) return 0;
+    if (position > maximumArgumentPosition) throw std::invalid_argument("Format argument position out of range");
     format = end + 1;
     return position;
 }
@@ -258,7 +541,6 @@ inline std::vector<ArgumentClass> NumberedArgumentClasses(const char* format) {
 
 inline int FormatWindows(char* buffer, size_t size, const char* format, const void* source, std::string* complete = nullptr, bool secure = false) {
     if (!format || !source) throw std::invalid_argument("Null formatting argument");
-    const int savedError = errno;
     const char* const formatStart = format;
     FormatArguments args(source);
     args.Number(NumberedArgumentClasses(format));
@@ -279,16 +561,24 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
         }
         if (const size_t position = ArgumentPosition(format)) args.Seek(position);
         std::string spec = "%";
-        for (; *format && std::strchr("-+ #0'", *format); ++format)
+        bool unmeasuredUnknownFlag = false;
+        bool zeroFlag = false;
+        for (; *format && std::strchr("-+ #0'", *format); ++format) {
             if (*format != '\'') spec += *format;
+            if (std::strchr("+ '", *format)) unmeasuredUnknownFlag = true;
+            if (*format == '0') zeroFlag = true;
+        }
+        bool widthGiven = false;
         if (*format == '*') {
             ++format;
             const int width = star();
             if (width < 0) spec += '-';
             spec += std::to_string(width < 0 ? -static_cast<long long>(width) : width);
+            widthGiven = true;
         } else {
-            while (*format >= '0' && *format <= '9') spec += *format++;
+            for (; *format >= '0' && *format <= '9'; widthGiven = true) spec += *format++;
         }
+        if (zeroFlag && widthGiven) unmeasuredUnknownFlag = true;
         size_t precisionLimit = std::numeric_limits<size_t>::max();
         if (*format == '.') {
             ++format;
@@ -319,6 +609,13 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
         const char conversion = *format;
         if (!conversion) throw std::invalid_argument("Incomplete format conversion");
         ++format;
+        if (!std::strchr(KnownConversions, conversion)) {
+            if (secure || unmeasuredUnknownFlag)
+                throw std::invalid_argument("Unsupported format conversion '" + spec + length + conversion + "' in \"" + std::string(formatStart).substr(0, 160) + "\"");
+            const char text[] = {'%', conversion, '\0'};
+            output.Value(PaddedStringSpec(spec), conversion == '%' ? "%" : text);
+            continue;
+        }
         const bool integerLength = length.empty() || length == "h" || length == "hh" ||
             length == "l" || length == "ll" || length == "j" || length == "z" || length == "t";
         if (conversion == 'd' || conversion == 'i') {
@@ -346,18 +643,32 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
                 spec = spec.substr(0, spec.find('.')) + ".1";
             output.Value(spec + "ll" + conversion, value);
         } else if (std::strchr("aAeEfFgG", conversion)) {
-            const char* nan = conversion >= 'a' ? "nan" : "NAN";
             if (length == "L") {
                 static_assert(sizeof(long double) == 16);
                 static_assert(std::numeric_limits<long double>::digits == 64);
                 const long double value = args.Next<long double>();
-                if (std::isnan(value)) output.Value(NanSpec(spec), nan);
-                else output.Value(spec + "L" + conversion, value);
+                if (std::isnan(value)) {
+                    output.Value(PaddedStringSpec(spec), NanText(spec, std::signbit(value), conversion < 'a').c_str());
+                } else if (conversion != 'a' && conversion != 'A' && std::isfinite(value)) {
+                    const std::string text = DecimalFloat(spec, conversion, value, static_cast<std::size_t>(INT_MAX - output.Count()));
+                    output.Append(text.data(), text.size());
+                } else {
+                    output.Value(spec + "L" + conversion, value);
+                }
             } else {
                 if (!length.empty() && length != "l") throw std::invalid_argument("Invalid floating length");
                 const double value = args.Next<double>();
-                if (std::isnan(value)) output.Value(NanSpec(spec), nan);
-                else output.Value(spec + conversion, value);
+                if (std::isnan(value)) {
+                    output.Value(PaddedStringSpec(spec), NanText(spec, std::signbit(value), conversion < 'a').c_str());
+                } else if ((conversion == 'a' || conversion == 'A') && std::isfinite(value)) {
+                    const std::string text = HexFloat(spec, conversion, value, static_cast<std::size_t>(INT_MAX - output.Count()));
+                    output.Append(text.data(), text.size());
+                } else if (std::isfinite(value)) {
+                    const std::string text = DecimalFloat(spec, conversion, value, static_cast<std::size_t>(INT_MAX - output.Count()));
+                    output.Append(text.data(), text.size());
+                } else {
+                    output.Value(spec + conversion, value);
+                }
             }
         } else if (conversion == 'c' && (length.empty() || length == "h")) {
             output.Value(spec + conversion, args.Next<int>());
@@ -377,8 +688,7 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
             if (!value) value = u"(null)";
             std::string utf8;
             while (utf8.size() < precisionLimit && *value) {
-                char32_t code = *value++;
-                if (code >= 0xd800 && code < 0xdc00 && *value >= 0xdc00 && *value < 0xe000) code = 0x10000 + ((code - 0xd800) << 10) + (*value++ - 0xdc00);
+                const char32_t code = *value++;
                 const auto previousSize = utf8.size();
                 AppendUtf8(utf8, code);
                 if (utf8.size() > precisionLimit) {
@@ -390,10 +700,6 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
         } else if (conversion == 'p' && (length.empty() || length == "l")) {
             const std::string text = FormatPointer(spec, args.Next<void*>());
             output.Append(text.data(), text.size());
-        } else if (conversion == 'm') {
-            char message[128];
-            strerror_r_nid_postfix(savedError, message, sizeof(message));
-            output.Value(spec + 's', static_cast<const char*>(message));
         } else if (conversion == 'n' && secure) {
             throw FormatConstraintViolation("Format count conversion");
         } else if (conversion == 'n' && integerLength && spec == "%") {
diff --git a/core/libs/prx/libc/include/WindowsMappings.hpp b/core/libs/prx/libc/include/WindowsMappings.hpp
index 624685e8a9..7a7a3f7869 100644
--- a/core/libs/prx/libc/include/WindowsMappings.hpp
+++ b/core/libs/prx/libc/include/WindowsMappings.hpp
@@ -5,6 +5,9 @@
 #include <windows.h>
 #include <algorithm>
 #include <array>
+#ifdef APS5_COUNT_MAPPING_QUERIES
+#include <atomic>
+#endif
 #include <cstdio>
 #include <cstddef>
 #include <cstdint>
@@ -28,18 +31,48 @@ public:
         return *mappings;
     }
 
+#ifdef APS5_COUNT_MAPPING_QUERIES
+    static std::uint64_t MemoryQueries() {
+        return queries.load(std::memory_order_relaxed);
+    }
+#endif
+
     void* Reserve(void* address, std::size_t bytes) {
         return allocate(GetCurrentProcess(), address, bytes, MEM_RESERVE | MEM_RESERVE_PLACEHOLDER, PAGE_NOACCESS, nullptr, 0);
     }
 
     std::vector<std::pair<std::uintptr_t, std::size_t>> Commit(void* address, std::size_t bytes, DWORD protection, std::size_t granule, bool watched) {
+        if (granule == 0) throw std::invalid_argument("guest memory commit granule is zero");
         std::vector<std::pair<std::uintptr_t, std::size_t>> created;
         std::lock_guard lock(mutex);
         collectableRanges.clear();
+        const DWORD flags = MEM_RESERVE | MEM_COMMIT | MEM_REPLACE_PLACEHOLDER | (watched ? MEM_WRITE_WATCH : 0);
+        const auto cut = [](std::uintptr_t at, std::size_t size, const char* operation) {
+            if (!VirtualFree(reinterpret_cast<void*>(at), size, MEM_RELEASE | MEM_PRESERVE_PLACEHOLDER)) fail(operation);
+        };
+        const auto replace = [&](std::uintptr_t at, std::size_t size) {
+            if (!allocate(GetCurrentProcess(), reinterpret_cast<void*>(at), size, flags, protection, nullptr, 0)) fail("replace guest placeholder with private memory");
+            if (!created.empty() && created.back().first + created.back().second == at) created.back().second += size;
+            else created.emplace_back(at, size);
+        };
         const auto end = reinterpret_cast<std::uintptr_t>(address) + bytes;
         for (auto cursor = reinterpret_cast<std::uintptr_t>(address); cursor < end;) {
             const auto memory = query(cursor);
-            const auto stop = std::min(end, reinterpret_cast<std::uintptr_t>(memory.BaseAddress) + memory.RegionSize);
+            const auto regionEnd = reinterpret_cast<std::uintptr_t>(memory.BaseAddress) + memory.RegionSize;
+            const auto stop = std::min(end, regionEnd);
+            if (memory.State == MEM_RESERVE && std::min(end, cursor + granule) <= regionEnd) {
+                forgetClean(cursor, stop);
+                const auto holder = reinterpret_cast<std::uintptr_t>(memory.AllocationBase);
+                if (holder != cursor) cut(holder, cursor - holder, "split guest placeholder prefix");
+                if (stop != regionEnd) cut(cursor, stop - cursor, "split guest placeholder suffix");
+                while (cursor < stop && std::min(end, cursor + granule) <= stop) {
+                    const auto size = std::min(end, cursor + granule) - cursor;
+                    if (cursor + size != stop) cut(cursor, size, "split guest placeholder suffix");
+                    replace(cursor, size);
+                    cursor += size;
+                }
+                continue;
+            }
             if (memory.State == MEM_RESERVE) {
                 const auto limit = std::min(end, cursor + granule);
                 auto placeholderEnd = stop;
@@ -50,10 +83,7 @@ public:
                 }
                 const auto size = std::min(limit, placeholderEnd) - cursor;
                 reset(cursor, size);
-                const DWORD flags = MEM_RESERVE | MEM_COMMIT | MEM_REPLACE_PLACEHOLDER | (watched ? MEM_WRITE_WATCH : 0);
-                if (!allocate(GetCurrentProcess(), reinterpret_cast<void*>(cursor), size, flags, protection, nullptr, 0)) fail("replace guest placeholder with private memory");
-                if (!created.empty() && created.back().first + created.back().second == cursor) created.back().second += size;
-                else created.emplace_back(cursor, size);
+                replace(cursor, size);
                 cursor += size;
             } else {
                 if (memory.State != MEM_COMMIT) throw std::runtime_error("guest memory is not committed");
@@ -96,6 +126,7 @@ public:
             auto shared = slot.page.lock();
             if (!shared) {
                 shared = std::make_shared<SharedPage>();
+                shared->comparedWhenShared = slot.comparedWhenShared;
                 slot.page = shared;
             }
             return shared;
@@ -105,6 +136,8 @@ public:
             const auto shared = slot.page.lock();
             return resident && !slot.stored && (!shared || shared->aliases.empty());
         };
+        const bool perPage = !resident && sectionBytes == SIZE_MAX;
+        if (perPage) commitSection(section, offset, bytes);
         for (std::size_t done = 0; done < bytes;) {
             const auto base = cursor + done;
             if (single(done)) {
@@ -134,21 +167,56 @@ public:
                 done += runBytes;
                 continue;
             }
-            const auto slot = slotOf(done);
-            const auto shared = pageOf(*slot);
-            const auto aliases = shared->aliases;
-            for (const auto alias : aliases) {
-                if (views.at(alias).resident) demote(alias);
+            if (sectionBytes != SIZE_MAX) {
+                const auto slot = slotOf(done);
+                const auto shared = pageOf(*slot);
+                const auto aliases = shared->aliases;
+                for (const auto alias : aliases) {
+                    if (views.at(alias).resident) demote(alias);
+                    views.at(alias).aliasDemoted = false;
+                }
+                const auto viewBytes = std::min(pageBytes, sectionBytes - done);
+                split(base, pageBytes);
+                mapShared(base, section, offset + done, protection, viewProtection, viewBytes);
+                slot->stored = true;
+                shared->aliases.push_back(base);
+                const auto created = views.emplace(base, View{shared, protection, {}, 0, owned, offset + done, 0, 0, false, slot, hostPages(viewBytes)}).first;
+                if (shared->comparedWhenShared) created->second.unreported = allSubpages;
+                remember(freshRanges, base, base + pageBytes);
+                invalidate(*shared);
+                done += pageBytes;
+                continue;
             }
-            const auto viewBytes = std::min(pageBytes, sectionBytes - done);
-            split(base, pageBytes);
-            mapShared(base, section, offset + done, protection, viewProtection, viewBytes);
-            slot->stored = true;
-            shared->aliases.push_back(base);
-            views.emplace(base, View{shared, protection, {}, 0, owned, offset + done, 0, 0, false, slot, hostPages(viewBytes)});
-            remember(freshRanges, base, base + pageBytes);
-            invalidate(*shared);
-            done += pageBytes;
+            std::vector<std::pair<std::shared_ptr<Physical>, std::shared_ptr<SharedPage>>> pages;
+            pages.reserve((bytes - done) / pageBytes);
+            auto runBytes = std::size_t{0};
+            do {
+                const auto slot = slotOf(done + runBytes);
+                const auto shared = pageOf(*slot);
+                const auto aliases = shared->aliases;
+                for (const auto alias : aliases) {
+                    if (views.at(alias).resident) demote(alias);
+                    views.at(alias).aliasDemoted = false;
+                }
+                pages.emplace_back(slot, shared);
+                runBytes += pageBytes;
+            } while (done + runBytes < bytes && !single(done + runBytes));
+            if (!perPage) commitSection(section, offset + done, runBytes);
+            split(base, runBytes);
+            mapRun(base, runBytes, section, offset + done);
+            DWORD previous;
+            if (!VirtualProtect(reinterpret_cast<void*>(base), runBytes, protection, &previous)) fail("protect shared guest pages");
+            collectableRanges.clear();
+            for (std::size_t at = 0; at < runBytes; at += pageBytes) {
+                auto& [slot, shared] = pages[at / pageBytes];
+                slot->stored = true;
+                shared->aliases.push_back(base + at);
+                invalidate(*shared);
+                const auto created = views.emplace(base + at, View{std::move(shared), protection, {}, 0, owned, offset + done + at, 0, 0, false, std::move(slot)}).first;
+                if (created->second.page->comparedWhenShared) created->second.unreported = allSubpages;
+            }
+            remember(freshRanges, base, base + runBytes);
+            done += runBytes;
         }
     }
 
@@ -186,21 +254,56 @@ public:
         }
     }
 
+    void CompareWhenShared(std::uintptr_t address, std::size_t bytes, bool residentOnly = false) {
+        std::lock_guard lock(mutex);
+        collectableRanges.clear();
+        for (auto it = views.lower_bound(address & ~(pageBytes - 1)); it != views.end() && it->first < address + bytes; ++it) {
+            if (residentOnly && !it->second.resident && !it->second.aliasDemoted) continue;
+            auto& page = *it->second.page;
+            const bool marked = page.comparedWhenShared;
+            page.comparedWhenShared = true;
+            it->second.slot->comparedWhenShared = true;
+            for (const auto alias : page.aliases) {
+                auto& view = views.at(alias);
+                if (view.resident) continue;
+                if (!marked) view.unreported = allSubpages;
+                if (view.armed == 0) continue;
+                protectSubpages(alias, view.armed, view.protection, "stop arming a compared shared page", view.viewBytes);
+                view.armed = 0;
+            }
+        }
+    }
+
+    void ComparedPages(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count, bool unreported) {
+        std::lock_guard lock(mutex);
+        const auto capacity = *count;
+        *count = 0;
+        const auto end = address + bytes;
+        for (auto it = views.lower_bound(address & ~(pageBytes - 1)); it != views.end() && it->first < end; ++it) {
+            auto& view = it->second;
+            if (view.resident || !view.page->comparedWhenShared) continue;
+            const auto listed = static_cast<std::uint8_t>(subpagesOf(it->first, address, end) & (unreported ? view.unreported : allSubpages));
+            for (std::size_t sub = 0; sub < subpages; ++sub) {
+                const auto bit = static_cast<std::uint8_t>(1u << sub);
+                if ((listed & bit) == 0) continue;
+                if (*count == capacity) return;
+                pages[(*count)++] = reinterpret_cast<void*>(it->first + sub * subpageBytes);
+                if (unreported) view.unreported &= static_cast<std::uint8_t>(~bit);
+            }
+        }
+    }
+
     bool HandleWrite(std::uintptr_t address) {
         std::lock_guard lock(mutex);
         const auto base = address & ~(pageBytes - 1);
         const auto found = views.find(base);
         if (found == views.end() || !writable(found->second.protection)) return false;
         auto& view = found->second;
-        const auto written = subpagesOf(base, address, address + 1);
-        if (view.resident && (view.armed & written) == 0) {
+        if (view.resident) {
             const auto memory = query(address);
             return memory.State == MEM_COMMIT && writable(memory.Protect & 0xffu);
         }
-        if (view.resident) {
-            resumeResidentWrites(base);
-            return true;
-        }
+        const auto written = subpagesOf(base, address, address + 1);
         invalidate(*view.page, written);
         protectSubpages(base, written, view.protection, "resume shared memory write", view.viewBytes);
         view.armed &= static_cast<std::uint8_t>(~written);
@@ -286,7 +389,7 @@ public:
         }
         for (std::size_t done = 0; done < bytes; done += pageBytes) {
             const auto found = views.find(address + done);
-            if (found != views.end() && found->second.resident) demote(address + done);
+            if (found != views.end() && found->second.resident) demote(address + done, true);
         }
         auto view = views.find(address);
         if (view == views.end()) throw refuse("the range does not start at a shared view");
@@ -350,6 +453,7 @@ public:
                     if (!watchResident) return false;
                     continue;
                 }
+                if (it->second.page->comparedWhenShared) return false;
                 if (it->second.protection != PAGE_NOACCESS) continue;
                 for (auto at = std::max(address, it->first); at < std::min(end, it->first + pageBytes); at += 4096) {
                     if ((it->second.collected & (1u << ((at - it->first) / 4096))) == 0) return false;
@@ -496,7 +600,7 @@ private:
         for (auto cursor = address; cursor < end;) {
             const auto base = cursor & ~(pageBytes - 1);
             if (const auto found = viewAt(base, position); found != views.end()) {
-                if (found->second.protection == PAGE_NOACCESS || (found->second.resident && !watchResident)) return false;
+                if (found->second.protection == PAGE_NOACCESS || (found->second.resident ? !watchResident : found->second.page->comparedWhenShared)) return false;
                 cursor = std::min(end, base + pageBytes);
                 continue;
             }
@@ -522,6 +626,7 @@ private:
         }();
         std::vector<std::uintptr_t> aliases;
         std::uint32_t pins = 0;
+        bool comparedWhenShared = false;
     };
     struct Section {
         HANDLE handle;
@@ -553,6 +658,7 @@ private:
     struct Physical {
         std::weak_ptr<SharedPage> page;
         bool stored = false;
+        bool comparedWhenShared = false;
         std::shared_ptr<Saved> saved;
         std::size_t savedOffset = 0;
     };
@@ -569,12 +675,13 @@ private:
         std::shared_ptr<Physical> slot;
         std::size_t viewBytes = pageBytes;
         std::uint32_t hostImports = 0;
+        bool aliasDemoted = false;
+        std::uint8_t unreported = 0;
     };
     struct Run {
         std::uintptr_t end;
         std::array<std::uint64_t, 8> collected;
         std::uint32_t fresh;
-        bool writeObserved = false;
     };
     struct Window {
         void* view = nullptr;
@@ -588,14 +695,12 @@ private:
 
     void collectResident(std::uintptr_t start, Run& run, std::uintptr_t from, std::uintptr_t stop, void** pages, std::size_t* count, bool clear, Collection collection) {
         const auto first = from & ~std::uintptr_t{4095};
-        const bool armed = clear && run.fresh == 0 && !run.writeObserved && collection != Collection::Fresh && run.end - start >= 0x40000 && armResident(first, stop);
         if (run.fresh == 0 && collection != Collection::Fresh) {
             ULONG_PTR reported = (stop - first + 4095) / 4096;
             DWORD granularity = 0;
             if (GetWriteWatch(clear ? WRITE_WATCH_FLAG_RESET : 0, reinterpret_cast<void*>(first), stop - first, pages + *count, &reported, &granularity) != 0) fail("collect resident guest writes");
             for (ULONG_PTR index = 0; index < reported; ++index) pages[*count + index] = reinterpret_cast<void*>(std::max(from, reinterpret_cast<std::uintptr_t>(pages[*count + index])));
             *count += reported;
-            if (armed) rememberClean(from, stop);
             return;
         }
         std::vector<std::uintptr_t> written;
@@ -633,44 +738,6 @@ private:
         if (collection == Collection::Fresh) flushReset(stop);
     }
 
-    void resumeResidentWrites(std::uintptr_t address) {
-        const auto run = std::prev(residentRuns.upper_bound(address));
-        run->second.writeObserved = true;
-        forgetClean(run->first, run->second.end);
-        auto first = views.lower_bound(run->first);
-        while (first != views.end() && first->first < run->second.end) {
-            const auto begin = first->first;
-            auto end = begin;
-            const auto protection = first->second.protection;
-            auto next = first;
-            bool armed = false;
-            do {
-                armed = armed || next->second.armed != 0;
-                end = next->first + pageBytes;
-                ++next;
-            } while (next != views.end() && next->first == end && end < run->second.end && next->second.protection == protection);
-            if (armed) {
-                DWORD previous;
-                if (!VirtualProtect(reinterpret_cast<void*>(begin), end - begin, protection, &previous)) fail("resume resident guest writes");
-            }
-            for (; first != next; ++first) first->second.armed = 0;
-        }
-    }
-
-    bool armResident(std::uintptr_t from, std::uintptr_t stop) {
-        const auto first = views.lower_bound(from & ~(pageBytes - 1));
-        if (first == views.end() || !writable(first->second.protection)) return false;
-        const auto protection = first->second.protection;
-        for (auto it = first; it != views.end() && it->first < stop; ++it) {
-            if (!it->second.resident || it->second.protection != protection || it->second.hostWrites != 0 || it->second.hostImports != 0 || it->second.page->pins != 0) return false;
-        }
-        DWORD previous;
-        const auto readOnly = protection == PAGE_EXECUTE_READWRITE ? PAGE_EXECUTE_READ : PAGE_READONLY;
-        if (!VirtualProtect(reinterpret_cast<void*>(from), stop - from, readOnly, &previous)) fail("arm resident memory write tracking");
-        for (auto it = first; it != views.end() && it->first < stop; ++it) it->second.armed |= subpagesOf(it->first, from, stop);
-        return true;
-    }
-
     Window open(HANDLE section, std::uint64_t offset, std::size_t bytes) {
         const auto lead = offset % granularity;
         Window window;
@@ -694,12 +761,23 @@ private:
         return (bytes + subpageBytes - 1) & ~(subpageBytes - 1);
     }
 
-    void mapShared(std::uintptr_t base, HANDLE section, std::uint64_t offset, DWORD protection, DWORD viewProtection = PAGE_EXECUTE_READWRITE, std::size_t sectionBytes = pageBytes) {
+    void commitSection(HANDLE section, std::uint64_t offset, std::size_t bytes) {
+        auto window = open(section, offset, bytes);
+        const auto memory = query(reinterpret_cast<std::uintptr_t>(window.bytes));
+        if ((memory.State != MEM_COMMIT || memory.RegionSize < bytes) && !VirtualAlloc(window.bytes, bytes, MEM_COMMIT, PAGE_READWRITE)) {
+            const auto error = GetLastError();
+            close(window);
+            throw std::system_error(static_cast<int>(error), std::system_category(), "commit direct memory pages");
+        }
+        close(window);
+    }
+
+    void mapShared(std::uintptr_t base, HANDLE section, std::uint64_t offset, DWORD protection, DWORD viewProtection = PAGE_EXECUTE_READWRITE, std::size_t sectionBytes = pageBytes, bool committed = false) {
         void* page = reinterpret_cast<void*>(base);
         const auto viewBytes = hostPages(sectionBytes);
         if (viewBytes != pageBytes) split(base, viewBytes);
         if (!map(section, GetCurrentProcess(), page, offset, sectionBytes, MEM_REPLACE_PLACEHOLDER, viewProtection, nullptr, 0)) fail("map shared guest page");
-        if (query(base).State == MEM_RESERVE && !VirtualAlloc(page, viewBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE)) fail("commit shared guest page");
+        if (!committed && query(base).State == MEM_RESERVE && !VirtualAlloc(page, viewBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE)) fail("commit shared guest page");
         DWORD previous;
         if (!VirtualProtect(page, viewBytes, protection, &previous)) fail("protect shared guest page");
         if (viewBytes == pageBytes) return;
@@ -708,6 +786,47 @@ private:
         if (!VirtualProtect(zeros, pageBytes - viewBytes, protection, &previous)) fail("protect guest pages past the end of a file");
     }
 
+    void mapRun(std::uintptr_t base, std::size_t bytes, HANDLE section, std::uint64_t offset) {
+        if (!map(section, GetCurrentProcess(), reinterpret_cast<void*>(base), offset, bytes, MEM_REPLACE_PLACEHOLDER, PAGE_EXECUTE_READWRITE, nullptr, 0)) fail("map a run of shared guest pages");
+    }
+
+    void breakView(std::uintptr_t at) {
+        const auto memory = query(at);
+        if (memory.State == MEM_FREE || memory.Type != MEM_MAPPED) return;
+        const auto start = reinterpret_cast<std::uintptr_t>(memory.AllocationBase);
+        if (start == at) return;
+        const auto first = views.find(start);
+        if (first == views.end()) return;
+        struct Part {
+            std::uintptr_t base;
+            std::uintptr_t end;
+            DWORD protection;
+            bool committed;
+        };
+        std::vector<Part> parts;
+        auto stop = start;
+        for (;;) {
+            const auto part = query(stop);
+            if (part.AllocationBase != memory.AllocationBase) break;
+            const auto partEnd = reinterpret_cast<std::uintptr_t>(part.BaseAddress) + part.RegionSize;
+            parts.push_back({stop, partEnd, part.Protect, part.State == MEM_COMMIT});
+            stop = partEnd;
+        }
+        const auto section = first->second.section;
+        const auto offset = first->second.offset;
+        if (!unmap(GetCurrentProcess(), reinterpret_cast<void*>(start), MEM_PRESERVE_PLACEHOLDER)) fail("unmap a run of shared guest pages to split it");
+        split(start, at - start);
+        mapRun(start, at - start, section->handle, offset);
+        mapRun(at, stop - at, section->handle, offset + (at - start));
+        for (const auto& part : parts) {
+            if (!part.committed) continue;
+            for (const auto [from, to] : {std::pair{part.base, std::min(part.end, at)}, std::pair{std::max(part.base, at), part.end}}) {
+                DWORD previous;
+                if (from < to && !VirtualProtect(reinterpret_cast<void*>(from), to - from, part.protection, &previous)) fail("protect a split run of shared guest pages");
+            }
+        }
+    }
+
     static bool blank(std::uintptr_t page) {
         const auto* words = reinterpret_cast<const std::uint64_t*>(page);
         for (std::size_t i = 0; i < pageBytes / sizeof(std::uint64_t); ++i) {
@@ -716,7 +835,7 @@ private:
         return true;
     }
 
-    void demote(std::uintptr_t address) {
+    void demote(std::uintptr_t address, bool alias = false) {
         const auto run = std::prev(residentRuns.upper_bound(address));
         const auto start = run->first;
         const auto stop = run->second.end;
@@ -734,6 +853,8 @@ private:
             mapShared(page, view.section->handle, view.offset, view.protection);
             view.slot->stored = true;
             view.resident = false;
+            view.aliasDemoted = alias;
+            view.unreported = view.page->comparedWhenShared ? allSubpages : std::uint8_t{0};
             view.seen.fill(0);
             view.armed = 0;
             view.collected = 0;
@@ -890,11 +1011,14 @@ private:
 
     static MEMORY_BASIC_INFORMATION query(std::uintptr_t address) {
         MEMORY_BASIC_INFORMATION memory{};
+#ifdef APS5_COUNT_MAPPING_QUERIES
+        queries.fetch_add(1, std::memory_order_relaxed);
+#endif
         if (VirtualQuery(reinterpret_cast<void*>(address), &memory, sizeof(memory)) != sizeof(memory)) fail("query guest memory");
         return memory;
     }
 
-    static void split(std::uintptr_t address, std::size_t bytes) {
+    static std::uintptr_t split(std::uintptr_t address, std::size_t bytes) {
         auto memory = query(address);
         memory = query(reinterpret_cast<std::uintptr_t>(memory.AllocationBase));
         if (memory.State != MEM_RESERVE) throw std::runtime_error("guest mapping requires a placeholder");
@@ -905,6 +1029,7 @@ private:
         }
         if (memory.RegionSize < bytes) throw std::runtime_error("guest placeholder is too small");
         if (memory.RegionSize != bytes && !VirtualFree(reinterpret_cast<void*>(address), bytes, MEM_RELEASE | MEM_PRESERVE_PLACEHOLDER)) fail("split guest placeholder suffix");
+        return address + memory.RegionSize;
     }
 
     void reset(std::uintptr_t address, std::size_t bytes) {
@@ -913,6 +1038,8 @@ private:
         forgetClean(address, end);
         breakRun(address);
         breakRun(end);
+        breakView(address);
+        breakView(end);
         if (const auto run = residentRuns.find(address); run != residentRuns.end() && run->second.end == end) {
             const auto memory = query(address);
             if (reinterpret_cast<std::uintptr_t>(memory.AllocationBase) != address) throw std::runtime_error("cannot release part of a host allocation");
@@ -944,12 +1071,11 @@ private:
             if (allocationEnd > end || query(allocationEnd).AllocationBase == memory.AllocationBase) throw std::runtime_error("guest release truncates a host allocation");
             if (memory.Type == MEM_MAPPED) {
                 if (!unmap(GetCurrentProcess(), reinterpret_cast<void*>(cursor), MEM_PRESERVE_PLACEHOLDER)) fail("unmap shared guest page");
-                const auto found = views.find(cursor);
-                if (found != views.end()) {
-                    std::erase(found->second.page->aliases, cursor);
-                    views.erase(found);
-                    forget(freshRanges, cursor, cursor + pageBytes);
+                for (auto found = views.lower_bound(cursor); found != views.end() && found->first < allocationEnd;) {
+                    std::erase(found->second.page->aliases, found->first);
+                    found = views.erase(found);
                 }
+                forget(freshRanges, cursor, allocationEnd);
             } else if (memory.Type == MEM_PRIVATE) {
                 if (const auto run = residentRuns.find(cursor); run != residentRuns.end()) evict(run);
                 if (!VirtualFree(reinterpret_cast<void*>(cursor), allocationEnd - cursor, MEM_RELEASE | MEM_PRESERVE_PLACEHOLDER)) fail("release private guest memory");
@@ -1023,6 +1149,9 @@ private:
     std::map<std::uintptr_t, std::size_t> splitAliases;
     std::size_t granularity = 0x10000;
     bool watchResident = false;
+#ifdef APS5_COUNT_MAPPING_QUERIES
+    static inline std::atomic<std::uint64_t> queries{0};
+#endif
     std::mutex mutex;
     AllocateFunction allocate = nullptr;
     MapFunction map = nullptr;
diff --git a/core/libs/prx/libc/include/WindowsScanning.hpp b/core/libs/prx/libc/include/WindowsScanning.hpp
index 77bbf1541e..ab3f6ef625 100644
--- a/core/libs/prx/libc/include/WindowsScanning.hpp
+++ b/core/libs/prx/libc/include/WindowsScanning.hpp
@@ -16,15 +16,30 @@ inline int ScanWindowsArguments_nid_no_patch(const char* format, const void* sou
     std::vector<void*> pointers;
     std::vector<int> suppressedEnds(static_cast<size_t>(std::count(format, format + std::strlen(format), '%')), -1);
     size_t suppressedCount = 0;
+    struct NarrowInteger {
+        void* destination;
+        size_t size;
+        bool isUnsigned;
+        long long value;
+        unsigned long long unsignedValue;
+        int end;
+    };
+    std::vector<NarrowInteger> narrowIntegers;
+    narrowIntegers.reserve(suppressedEnds.size());
     FormatArguments args(source);
     while (*format) {
         const char value = *format++;
         translated += value;
         if (value != '%') continue;
         if (*format == '%') { translated += *format++; continue; }
+        const size_t directive = translated.size() - 1;
         const bool suppressed = *format == '*';
         if (suppressed) translated += *format++;
         while (*format >= '0' && *format <= '9') translated += *format++;
+        if (*format == 'q') {
+            translated.resize(directive);
+            break;
+        }
         std::string length;
         if (*format && std::strchr("hljztL", *format)) {
             length += *format++;
@@ -37,7 +52,8 @@ inline int ScanWindowsArguments_nid_no_patch(const char* format, const void* sou
             return EOF;
         }
         ++format;
-        if (std::strchr("diouxXn", conversion) && (length == "l" || length == "j" || length == "z" || length == "t"))
+        const bool narrow = !suppressed && std::strchr("diouxX", conversion) && (length.empty() || length == "h" || length == "hh");
+        if (narrow || (std::strchr("diouxXn", conversion) && (length == "l" || length == "j" || length == "z" || length == "t")))
             translated += "ll";
         else translated += length;
         translated += conversion;
@@ -48,13 +64,30 @@ inline int ScanWindowsArguments_nid_no_patch(const char* format, const void* sou
             if (*format != ']') { errno = 22; return EOF; }
             translated += *format++;
         }
-        if (!suppressed) pointers.push_back(args.Next<void*>());
+        if (narrow) {
+            const bool isUnsigned = std::strchr("ouxX", conversion) != nullptr;
+            narrowIntegers.push_back({args.Next<void*>(), length.empty() ? sizeof(int) : length == "h" ? sizeof(short) : sizeof(char), isUnsigned, 0, 0, -1});
+            translated += "%n";
+            auto& integer = narrowIntegers.back();
+            pointers.push_back(isUnsigned ? static_cast<void*>(&integer.unsignedValue) : static_cast<void*>(&integer.value));
+            pointers.push_back(&integer.end);
+        } else if (!suppressed) pointers.push_back(args.Next<void*>());
         else if (conversion != 'n') {
             translated += "%n";
             pointers.push_back(&suppressedEnds[suppressedCount++]);
         }
     }
     const int result = scan(translated.c_str(), reinterpret_cast<char*>(pointers.data()));
+    for (const auto& integer : narrowIntegers) {
+        if (integer.end < 0) continue;
+        if (integer.isUnsigned) {
+            if (integer.size == sizeof(char)) *static_cast<unsigned char*>(integer.destination) = static_cast<unsigned char>(integer.unsignedValue);
+            else if (integer.size == sizeof(short)) *static_cast<unsigned short*>(integer.destination) = static_cast<unsigned short>(integer.unsignedValue);
+            else *static_cast<unsigned int*>(integer.destination) = static_cast<unsigned int>(integer.unsignedValue);
+        } else if (integer.size == sizeof(char)) *static_cast<signed char*>(integer.destination) = static_cast<signed char>(integer.value);
+        else if (integer.size == sizeof(short)) *static_cast<short*>(integer.destination) = static_cast<short>(integer.value);
+        else *static_cast<int*>(integer.destination) = static_cast<int>(integer.value);
+    }
     if (result == EOF && std::any_of(suppressedEnds.begin(), suppressedEnds.begin() + suppressedCount, [](int end) { return end >= 0; }))
         return 0;
     return result;
diff --git a/core/libs/prx/libc/include/general/ExportMacros.hpp b/core/libs/prx/libc/include/general/ExportMacros.hpp
index 49ab7fbf8c..c175c74f2b 100644
--- a/core/libs/prx/libc/include/general/ExportMacros.hpp
+++ b/core/libs/prx/libc/include/general/ExportMacros.hpp
@@ -1,7 +1,11 @@
 #ifndef CORE_LIBS_PRX_LIBC_INCLUDE_GENERAL_EXPORTMACROS_HPP
 #define CORE_LIBS_PRX_LIBC_INCLUDE_GENERAL_EXPORTMACROS_HPP
 
-#if defined(__GNUC__) || defined(__clang__)
+#if defined(__APPLE__)
+    #define APS5_EXPORT(exportName, funcName) \
+    __asm__(".globl \"_" exportName "_nid_no_patch_cut\"\n\t" \
+    ".set \"_" exportName "_nid_no_patch_cut\", _" #funcName)
+#elif defined(__GNUC__) || defined(__clang__)
     #define APS5_EXPORT(exportName, funcName) \
     __asm__(".globl \"" exportName "_nid_no_patch_cut\"\n\t" \
     ".set \"" exportName "_nid_no_patch_cut\", " #funcName)
diff --git a/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp b/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp
index 89dd7d3bcd..d61f017608 100644
--- a/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp
+++ b/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp
@@ -1,6 +1,10 @@
 #ifndef PRX_LIBC_INCLUDE_SPECIFICS_LINUX_ELFTYPES_HPP
 #define PRX_LIBC_INCLUDE_SPECIFICS_LINUX_ELFTYPES_HPP
 
+#ifdef __linux__
+#include <link.h>
+#else
+
 #include <cstdint>
 #include <cstddef>
 
@@ -34,3 +38,5 @@ extern "C" int dl_iterate_phdr(int (*callback)(dl_phdr_info*, std::size_t, void*
 #endif
 
 #endif
+
+#endif
diff --git a/core/libs/prx/libc/libc.hpp b/core/libs/prx/libc/libc.hpp
new file mode 100644
index 0000000000..f5bfb1510b
--- /dev/null
+++ b/core/libs/prx/libc/libc.hpp
@@ -0,0 +1,7 @@
+#pragma once
+
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/exceptions/Runtime.hpp"
+#include "prx/libc/include/exceptions/Unwind.hpp"
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/WindowsFormatting.hpp"
diff --git a/core/libs/prx/libc/src/AllocatingStrings.cpp b/core/libs/prx/libc/src/AllocatingStrings.cpp
index 1605fbd125..9f346a90f3 100644
--- a/core/libs/prx/libc/src/AllocatingStrings.cpp
+++ b/core/libs/prx/libc/src/AllocatingStrings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
@@ -8,8 +9,6 @@
 
 extern "C" {
 
-int APS5_VABI vasprintf_nid_postfix(char** destination, const char* format, VaList* args);
-
 char* APS5_VABI strndup_nid_postfix(const char* source, std::size_t limit) {
     if (!source) { errno = 22; return nullptr; }
     std::size_t length = 0;
diff --git a/core/libs/prx/libc/src/AppArchive.cpp b/core/libs/prx/libc/src/AppArchive.cpp
index ba32feae07..8195fed12f 100644
--- a/core/libs/prx/libc/src/AppArchive.cpp
+++ b/core/libs/prx/libc/src/AppArchive.cpp
@@ -129,17 +129,50 @@ std::vector<AppArchiveDirectoryEntry> AppArchiveList_nid_no_patch(std::uint32_t
     for (std::uint32_t index = 0; index < count; ++index) {
         ZArchiveReader::DirEntry entry{};
         if (!reader.GetDirEntry(handle, index, entry)) throw std::runtime_error("app0.zar is damaged: directory entry " + std::to_string(index) + " cannot be read");
-        entries.push_back({std::string(entry.name), entry.isDirectory});
+        entries.push_back({std::string(entry.name), entry.isDirectory, 0, entry.size});
     }
     return entries;
 }
 
+std::vector<AppArchiveDirectoryEntry> AppArchiveListDirectory_nid_no_patch(const std::filesystem::path& hostPath) {
+    AppArchiveNode directory{};
+    if (!AppArchiveLookup_nid_no_patch(hostPath, &directory) || !directory.Directory)
+        throw std::invalid_argument("AppArchiveListDirectory: path is not an app0.zar directory");
+    auto entries = AppArchiveList_nid_no_patch(directory.Handle);
+    for (auto& entry : entries) {
+        AppArchiveNode node{};
+        std::u8string name;
+        name.reserve(entry.Name.size());
+        for (const unsigned char value : entry.Name) name.push_back(static_cast<char8_t>(value));
+        if (!AppArchiveLookup_nid_no_patch(hostPath / std::filesystem::path(name), &node))
+            throw std::runtime_error("app0.zar is damaged: directory child " + entry.Name + " cannot be looked up");
+        entry.Handle = node.Handle;
+        entry.Size = node.Size;
+    }
+    return entries;
+}
+
+std::vector<AppArchiveDirectoryEntry> AppArchiveListUnshadowedDirectory_nid_no_patch(const std::filesystem::path& hostPath, const std::vector<std::string>& hostNames) {
+    auto entries = AppArchiveListDirectory_nid_no_patch(hostPath);
+    entries.erase(std::remove_if(entries.begin(), entries.end(), [&hostNames](const AppArchiveDirectoryEntry& entry) {
+        return std::any_of(hostNames.begin(), hostNames.end(), [&entry](const std::string& name) {
+            return SameComponent(name, entry.Name);
+        });
+    }), entries.end());
+    return entries;
+}
+
+bool AppArchiveNameMatches_nid_no_patch(const std::string& left, const std::string& right) {
+    return SameComponent(left, right);
+}
+
 void AppArchiveReady_nid_no_patch() {
     (void)Opened();
 }
 
 void AppArchiveRefuseOnly_nid_no_patch(const std::filesystem::path& hostPath, const char* guestPath, const char* operation) {
-    if (AppArchiveOnly_nid_no_patch(hostPath)) NotImplemented_nid_no_patch((std::string(operation) + " " + guestPath + " in app0.zar").c_str());
+    if (!AppArchiveOnly_nid_no_patch(hostPath)) return;
+    NotImplemented_nid_no_patch((std::string(operation) + " " + guestPath + " in app0.zar").c_str());
 }
 
 void AppArchiveRefuseMergedListing_nid_no_patch(const std::filesystem::path& hostPath, const char* guestPath) {
diff --git a/core/libs/prx/libc/src/ApplicationHeap.cpp b/core/libs/prx/libc/src/ApplicationHeap.cpp
index 84a8f46eb7..af64afc313 100644
--- a/core/libs/prx/libc/src/ApplicationHeap.cpp
+++ b/core/libs/prx/libc/src/ApplicationHeap.cpp
@@ -1,7 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
+#include <atomic>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
@@ -27,6 +29,7 @@ using UsableSize = std::size_t (APS5_VABI *)(void*);
 
 std::mutex heapMutex;
 std::array<void*, 10> heapApi{};
+std::atomic<int> heapKind{0};
 std::once_flag heapInitialization;
 std::exception_ptr heapFailure;
 Initialize heapFinalize = nullptr;
@@ -145,6 +148,18 @@ void ApplicationHeapRegister_nid_no_patch(void* const* api) {
     if (heapFinalized) throw std::runtime_error("application heap: allocator has been finalized");
     if (heapApi[0] != nullptr && heapApi != replacement) throw std::runtime_error("application heap: cannot replace an active allocator");
     heapApi = replacement;
+    heapKind.store(replacement == defaultApi() ? 1 : 2, std::memory_order_release);
+}
+
+bool ApplicationHeapDefault_nid_no_patch() {
+    int kind = heapKind.load(std::memory_order_acquire);
+    if (kind == 0) {
+        std::unique_lock lock(heapMutex);
+        ensureInitialized(lock);
+        if (heapFailure) std::rethrow_exception(heapFailure);
+        kind = heapKind.load(std::memory_order_acquire);
+    }
+    return kind == 1;
 }
 
 void ApplicationHeapInitialize_nid_no_patch(const void* processParameters) {
@@ -192,7 +207,7 @@ void ApplicationHeapFree_nid_no_patch(void* pointer) {
 }
 
 void* ApplicationHeapReallocate_nid_no_patch(void* pointer, std::size_t bytes) {
-    if (bytes == 0 && pointer != nullptr) {
+    if (bytes == 0 && pointer != nullptr && !ApplicationHeapDefault_nid_no_patch()) {
         ApplicationHeapFree_nid_no_patch(pointer);
         return nullptr;
     }
@@ -227,7 +242,7 @@ extern "C" void APS5_VABI scriptingFreeMem_nid_postfix(void* pointer) {
 }
 
 void* ApplicationHeapRealign_nid_no_patch(void* pointer, std::size_t bytes, std::size_t alignment) {
-    if (bytes == 0) {
+    if (bytes == 0 && !ApplicationHeapDefault_nid_no_patch()) {
         ApplicationHeapFree_nid_no_patch(pointer);
         return nullptr;
     }
diff --git a/core/libs/prx/libc/src/AtomicBuiltins.cpp b/core/libs/prx/libc/src/AtomicBuiltins.cpp
index 93df860262..bca7b11a4d 100644
--- a/core/libs/prx/libc/src/AtomicBuiltins.cpp
+++ b/core/libs/prx/libc/src/AtomicBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <stdexcept>
@@ -7,8 +8,6 @@
 
 namespace {
 
-using Uint128 = unsigned __int128;
-
 [[noreturn]] void ConsoleTrap(const char* function) {
     throw std::runtime_error(std::string(function) + ": the console implementation traps (ud2)");
 }
diff --git a/core/libs/prx/libc/src/Backtrace.cpp b/core/libs/prx/libc/src/Backtrace.cpp
index a07a476b4a..ad454b77cc 100644
--- a/core/libs/prx/libc/src/Backtrace.cpp
+++ b/core/libs/prx/libc/src/Backtrace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -14,8 +15,7 @@
 #include <windows.h>
 #include "prx/libc/include/exceptions/Unwind.hpp"
 extern "C" {
-_Unwind_Reason_Code APS5_VABI _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn, void*);
-_Unwind_Ptr APS5_VABI _Unwind_GetIP_nid_postfix(_Unwind_Context*);
+
 std::string BacktraceModulePath_nid_no_patch(HMODULE handle, std::size_t initialCapacity) {
     std::string module;
     std::size_t capacity = initialCapacity == 0 ? 1 : initialCapacity;
@@ -74,6 +74,7 @@ static_assert(sizeof(FrameRecord) == NameOffset);
     };
     TraceState state{addresses, MaxFrames, 0};
     _Unwind_Backtrace_nid_postfix(traceCallback, &state);
+
     const int captured = state.count;
 #endif
     std::vector<Frame> frames;
diff --git a/core/libs/prx/libc/src/Bessel.cpp b/core/libs/prx/libc/src/Bessel.cpp
index 7ba3585ad3..3ef4643d2a 100644
--- a/core/libs/prx/libc/src/Bessel.cpp
+++ b/core/libs/prx/libc/src/Bessel.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cmath>
 #include <cstddef>
diff --git a/core/libs/prx/libc/src/BinaryWordIo.cpp b/core/libs/prx/libc/src/BinaryWordIo.cpp
index 733aadff22..c3e3be0748 100644
--- a/core/libs/prx/libc/src/BinaryWordIo.cpp
+++ b/core/libs/prx/libc/src/BinaryWordIo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
@@ -7,13 +8,6 @@
 
 static_assert(sizeof(int) == 4 && std::endian::native == std::endian::little);
 
-extern "C" {
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI putc_unlocked_nid_postfix(int, FileStream*);
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-}
-
 namespace {
 
 class LockedStream {
diff --git a/core/libs/prx/libc/src/BoundsChecking.cpp b/core/libs/prx/libc/src/BoundsChecking.cpp
index 2acc1aa95c..634f860c06 100644
--- a/core/libs/prx/libc/src/BoundsChecking.cpp
+++ b/core/libs/prx/libc/src/BoundsChecking.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <climits>
 #include <cstddef>
 #include <cstdint>
@@ -8,13 +9,7 @@
 #include "prx/libc/include/SonyCrt.hpp"
 
 extern "C" {
-std::size_t APS5_VABI mbrtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
-std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void* state);
-int APS5_VABI wctomb_nid_postfix(char* destination, std::uint16_t value);
-int APS5_VABI _Getmbcurmax_nid_postfix();
-int APS5_VABI getchar_nid_postfix();
-int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
-int APS5_VABI fputc_nid_postfix(int value, FileStream* stream);
+
 extern FileStream* __stderrp_nid_postfix;
 [[noreturn]] void abort_nid_postfix(std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t);
 }
@@ -29,8 +24,6 @@ constexpr std::size_t failed = static_cast<std::size_t>(-1);
 constexpr std::size_t rsizeMax = (std::size_t{1} << 61) - 1;
 constexpr std::size_t guestStateSize = 128;
 
-using GuestContextCompare = int (APS5_VABI*)(const void*, const void*, void*);
-
 bool usableSize(std::size_t size) {
     return size != 0 && size <= rsizeMax;
 }
@@ -51,6 +44,7 @@ extern "C" {
 void APS5_VABI abort_handler_s_nid_postfix(const char* message, void*, int) {
     fputs_nid_postfix(message, __stderrp_nid_postfix);
     fputc_nid_postfix('\n', __stderrp_nid_postfix);
+
     abort_nid_postfix(0, 0, 0, 0, 0, 0);
 }
 
diff --git a/core/libs/prx/libc/src/CxxAbiSupport.cpp b/core/libs/prx/libc/src/CxxAbiSupport.cpp
index 1cbe9c38cd..c8fa3ef0de 100644
--- a/core/libs/prx/libc/src/CxxAbiSupport.cpp
+++ b/core/libs/prx/libc/src/CxxAbiSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <cstddef>
 #ifndef _UNWIND_H
@@ -74,18 +75,22 @@ int APS5_VABI __cxa_thread_atexit_impl_nid_postfix(void (APS5_VABI *func)(void*)
     auto* context = new (std::nothrow) ThreadAtexitContext{func, arg};
     if (context == nullptr)
         return -1;
-    const int result = __cxxabiv1::__cxa_thread_atexit(
-        [](void* opaque) {
-            auto* context = static_cast<ThreadAtexitContext*>(opaque);
-            const auto destructor = context->destructor;
-            void* object = context->object;
-            delete context;
-            destructor(object);
-        },
-        context, dso);
+    const auto run = [](void* opaque) {
+        auto* context = static_cast<ThreadAtexitContext*>(opaque);
+        const auto destructor = context->destructor;
+        void* object = context->object;
+        delete context;
+        destructor(object);
+    };
+#ifdef __APPLE__
+    __cxxabiv1::__cxa_thread_atexit(run, context, dso);
+    return 0;
+#else
+    const int result = __cxxabiv1::__cxa_thread_atexit(run, context, dso);
     if (result != 0)
         delete context;
     return result;
+#endif
 }
 
 int APS5_VABI __cxa_thread_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dso) {
diff --git a/core/libs/prx/libc/src/DinkumwareAtomics.cpp b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
index f8aecb774e..fc480d7c02 100644
--- a/core/libs/prx/libc/src/DinkumwareAtomics.cpp
+++ b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -62,6 +63,18 @@ int LockedCompareExchange(volatile unsigned char* flag, std::size_t size, volati
 
 extern "C" {
 
+std::uint8_t APS5_VABI _Fetch_and_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI _Fetch_and_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI _Fetch_and_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI _Fetch_or_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI _Fetch_or_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI _Fetch_or_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI _Fetch_xor_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI _Fetch_xor_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI _Fetch_xor_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+
 void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { Store(target, value); }
 void APS5_VABI _Atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { Store(target, value); }
 void APS5_VABI _Atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { Store(target, value); }
@@ -172,4 +185,61 @@ int APS5_VABI _Atomic_compare_exchange_weak_nid_postfix(volatile unsigned char*
     return LockedCompareExchange(flag, size, target, expected, desired);
 }
 
+
+std::uint8_t APS5_VABI __atomic_load_1_nid_postfix(const volatile std::uint8_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_load_2_nid_postfix(const volatile std::uint16_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_load_4_nid_postfix(const volatile std::uint32_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_load_8_nid_postfix(const volatile std::uint64_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+
+void APS5_VABI __atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { Store(target, value); }
+void APS5_VABI __atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { Store(target, value); }
+void APS5_VABI __atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { Store(target, value); }
+void APS5_VABI __atomic_store_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { Store(target, value); }
+
+std::uint8_t APS5_VABI __atomic_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return Exchange(target, value); }
+std::uint16_t APS5_VABI __atomic_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return Exchange(target, value); }
+std::uint32_t APS5_VABI __atomic_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return Exchange(target, value); }
+std::uint64_t APS5_VABI __atomic_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return Exchange(target, value); }
+
+int APS5_VABI __atomic_compare_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+int APS5_VABI __atomic_compare_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+int APS5_VABI __atomic_compare_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t* expected, std::uint32_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+int APS5_VABI __atomic_compare_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+std::uint8_t APS5_VABI __atomic_fetch_add_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_add_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_add_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_add_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_sub_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_sub_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_sub_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_and_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_and_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_and_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_and_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_or_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_or_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_or_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_or_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_xor_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_xor_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_xor_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+
 }
diff --git a/core/libs/prx/libc/src/DinkumwareInternals.cpp b/core/libs/prx/libc/src/DinkumwareInternals.cpp
index 163a7362fa..dc45984759 100644
--- a/core/libs/prx/libc/src/DinkumwareInternals.cpp
+++ b/core/libs/prx/libc/src/DinkumwareInternals.cpp
@@ -1,33 +1,21 @@
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cctype>
+#include <cerrno>
+#include <cfenv>
 #include <cmath>
 #include <cstdint>
 #include <cstdlib>
+#include <limits>
+#include <stdexcept>
 #include <string>
 
 #include "prx/libc/include/General.hpp"
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-double APS5_VABI strtod_nid_postfix(const char* str, char** endptr);
-long long APS5_VABI strtoll_nid_postfix(const char* str, char** endptr, int base);
-double APS5_VABI sin_nid_postfix(double x);
-double APS5_VABI cos_nid_postfix(double x);
-float APS5_VABI sinf_nid_postfix(float x);
-float APS5_VABI cosf_nid_postfix(float x);
-long double APS5_VABI sinl_nid_postfix(long double x);
-long double APS5_VABI cosl_nid_postfix(long double x);
-double APS5_VABI log_nid_postfix(double x);
-double APS5_VABI log10_nid_postfix(double x);
-double APS5_VABI log2_nid_postfix(double x);
-float APS5_VABI logf_nid_postfix(float x);
-float APS5_VABI log10f_nid_postfix(float x);
-float APS5_VABI log2f_nid_postfix(float x);
-}
-
 namespace {
 
 constexpr long long ExponentLimit = 1000000000;
+constexpr int InvalidArgument = 22;
 constexpr int RangeError = 34;
 
 bool Hexadecimal(const char* text) {
@@ -36,39 +24,370 @@ bool Hexadecimal(const char* text) {
     return text[0] == '0' && (text[1] == 'x' || text[1] == 'X');
 }
 
+template<typename TFloat>
+TFloat ScaledFloat(const char* text, char** end, std::int64_t pten, int* error, TFloat (APS5_VABI *parse)(const char*, char**), const char* function) {
+    int& guestErrno = *__error_nid_postfix();
+    const int saved = guestErrno;
+    if (error != nullptr) *error = 0;
+    guestErrno = 0;
+    char* stop = nullptr;
+    TFloat value = parse(text, &stop);
+    if (end != nullptr) *end = stop;
+    const bool overflowed = std::isinf(value) && guestErrno == RangeError;
+    if (pten != 0 && stop != text && (std::isfinite(value) || overflowed)) {
+        if (Hexadecimal(text)) NotImplemented_nid_no_patch(function);
+        std::string number(text, static_cast<const char*>(stop));
+        long long exponent = 0;
+        const auto marker = number.find_first_of("eE");
+        if (marker != std::string::npos) {
+            exponent = std::strtoll(number.c_str() + marker + 1, nullptr, 10);
+            number.resize(marker);
+        }
+        exponent = std::clamp(exponent, -ExponentLimit, ExponentLimit) + std::clamp<std::int64_t>(pten, -ExponentLimit, ExponentLimit);
+        number += 'e';
+        number += std::to_string(exponent);
+        guestErrno = 0;
+        value = parse(number.c_str(), nullptr);
+    }
+    if (guestErrno == RangeError && (value == 0 || std::isinf(value))) {
+        if (error != nullptr) *error = 1;
+    } else if (guestErrno == 0 || guestErrno == RangeError) {
+        guestErrno = saved;
+    }
+    return value;
+}
+
+bool InvalidBase(const char* text, char** end, int base, int* error) {
+    if (base >= 0 && base != 1 && base <= 36) return false;
+    if (end != nullptr) *end = const_cast<char*>(text);
+    if (error != nullptr) *error = InvalidArgument;
+    return true;
+}
+
+template<typename TInteger>
+TInteger ParsedInteger(const char* text, char** end, int base, int* error, TInteger (APS5_VABI *parse)(const char*, char**, int)) {
+    if (error != nullptr) *error = 0;
+    if (InvalidBase(text, end, base, error)) return 0;
+    int& guestErrno = *__error_nid_postfix();
+    const int saved = guestErrno;
+    guestErrno = 0;
+    const TInteger value = parse(text, end, base);
+    if (error != nullptr) *error = guestErrno;
+    if (guestErrno == 0) guestErrno = saved;
+    return value;
+}
+
+constexpr short Denormal = -2, Finite = -1, Zero = 0, Infinite = 1, NotANumber = 2;
+
+void RaiseLibcError(int exceptions) {
+    if ((exceptions & (FE_OVERFLOW | FE_UNDERFLOW)) != 0) exceptions |= FE_INEXACT;
+    std::feraiseexcept(exceptions);
+    const bool range = (exceptions & FE_INVALID) == 0 &&
+        (exceptions & (FE_DIVBYZERO | FE_OVERFLOW | FE_UNDERFLOW)) != 0;
+    errno = range ? ERANGE : EDOM;
+}
+
+template<typename TFloat>
+short ClassifyValue(TFloat value) {
+    switch (std::fpclassify(value)) {
+    case FP_NAN:
+        return NotANumber;
+    case FP_INFINITE:
+        return Infinite;
+    case FP_ZERO:
+        return Zero;
+    case FP_SUBNORMAL:
+        return Denormal;
+    default:
+        return Finite;
+    }
+}
+
+template<typename TFloat>
+short ScaleProduct(TFloat& value, TFloat factor, TFloat multiplier, long exponent) {
+    std::fexcept_t saved;
+    std::fegetexceptflag(&saved, FE_ALL_EXCEPT);
+    const int savedErrno = errno;
+    TFloat result = factor * multiplier;
+    if (!std::isfinite(result) || result == static_cast<TFloat>(0)) {
+        int factorExponent = 0;
+        int multiplierExponent = 0;
+        const TFloat factorMantissa = std::frexp(factor, &factorExponent);
+        const TFloat multiplierMantissa = std::frexp(multiplier, &multiplierExponent);
+        const long long combinedExponent = static_cast<long long>(factorExponent) + multiplierExponent + exponent;
+        result = std::scalbn(factorMantissa * multiplierMantissa, static_cast<int>(combinedExponent));
+    } else {
+        result = std::scalbn(result, static_cast<int>(exponent));
+    }
+    value = result;
+    const short kind = ClassifyValue(result);
+    const int raised = std::fetestexcept(FE_ALL_EXCEPT) & ~static_cast<int>(saved) & FE_ALL_EXCEPT;
+    std::fesetexceptflag(&saved, FE_ALL_EXCEPT);
+    errno = savedErrno;
+    if (kind == Infinite) {
+        RaiseLibcError(FE_OVERFLOW);
+        return Infinite;
+    }
+    if (kind == Zero) {
+        RaiseLibcError(FE_UNDERFLOW);
+        return Zero;
+    }
+    if (kind == Denormal) return Finite;
+    if (kind == NotANumber) return NotANumber;
+    if ((raised & FE_INEXACT) != 0) std::feraiseexcept(FE_INEXACT);
+    return Finite;
+}
+
 }
 
 extern "C" {
 
+double APS5_VABI _Stodx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error) {
+    return ScaledFloat<double>(text, end, pten, error, strtod_nid_postfix, "_Stodx (hexadecimal text with a power-of-ten scale)");
+}
+
+float APS5_VABI _Stofx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error) {
+    return ScaledFloat<float>(text, end, pten, error, strtof_nid_postfix, "_Stofx (hexadecimal text with a power-of-ten scale)");
+}
+
+long double APS5_VABI _Stoldx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error) {
+    return ScaledFloat<long double>(text, end, pten, error, strtold_nid_postfix, "_Stoldx (hexadecimal text with a power-of-ten scale)");
+}
+
 double APS5_VABI _Stod_nid_postfix(const char* text, char** end, std::int64_t pten) {
+    return _Stodx_nid_postfix(text, end, pten, nullptr);
+}
+
+float APS5_VABI _Stof_nid_postfix(const char* text, char** end, std::int64_t pten) {
+    return _Stofx_nid_postfix(text, end, pten, nullptr);
+}
+
+long double APS5_VABI _Stold_nid_postfix(const char* text, char** end, std::int64_t pten) {
+    return _Stoldx_nid_postfix(text, end, pten, nullptr);
+}
+
+long long APS5_VABI _Stollx_nid_postfix(const char* text, char** end, int base, int* error) {
+    return ParsedInteger<long long>(text, end, base, error, strtoll_nid_postfix);
+}
+
+unsigned long long APS5_VABI _Stoullx_nid_postfix(const char* text, char** end, int base, int* error) {
+    return ParsedInteger<unsigned long long>(text, end, base, error, strtoull_nid_postfix);
+}
+
+std::uint64_t APS5_VABI _Stoulx_nid_postfix(const char* text, char** end, int base, int* error) {
+    return _Stoullx_nid_postfix(text, end, base, error);
+}
+
+std::int64_t APS5_VABI _Stolx_nid_postfix(const char* text, char** end, int base, int* error) {
+    if (error != nullptr) *error = 0;
+    if (InvalidBase(text, end, base, error)) return 0;
     int& guestErrno = *__error_nid_postfix();
     const int saved = guestErrno;
     guestErrno = 0;
-    char* stop = nullptr;
-    const double value = strtod_nid_postfix(text, &stop);
-    if (end != nullptr) *end = stop;
-    const bool overflowed = std::isinf(value) && guestErrno == RangeError;
-    if (pten == 0 || stop == text || !(std::isfinite(value) || overflowed)) {
-        if (guestErrno == 0) guestErrno = saved;
-        return value;
-    }
-    if (Hexadecimal(text)) NotImplemented_nid_no_patch("_Stod (hexadecimal text with a power-of-ten scale)");
-    std::string number(text, static_cast<const char*>(stop));
-    long long exponent = 0;
-    const auto marker = number.find_first_of("eE");
-    if (marker != std::string::npos) {
-        exponent = std::strtoll(number.c_str() + marker + 1, nullptr, 10);
-        number.resize(marker);
-    }
-    exponent = std::clamp(exponent, -ExponentLimit, ExponentLimit) + std::clamp<std::int64_t>(pten, -ExponentLimit, ExponentLimit);
-    number += 'e';
-    number += std::to_string(exponent);
-    guestErrno = saved;
-    return strtod_nid_postfix(number.c_str(), nullptr);
+    const long long value = strtoll_nid_postfix(text, end, base);
+    if (error != nullptr) *error = guestErrno;
+    guestErrno = 0;
+    static_cast<void>(strtoull_nid_postfix(text, nullptr, base));
+    if (guestErrno == 0) guestErrno = saved;
+    return value;
 }
 
 long long APS5_VABI _Stoll_nid_postfix(const char* text, char** end, int base) {
-    return strtoll_nid_postfix(text, end, base);
+    return _Stollx_nid_postfix(text, end, base, nullptr);
+}
+
+short APS5_VABI _Exp_nid_postfix(double* value, double y, short offset) {
+    if (value == nullptr) throw std::invalid_argument("_Exp: null value");
+    std::fexcept_t entryFlags;
+    std::fegetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+    const int entryErrno = errno;
+    const double x = *value;
+    constexpr double HugeExp = 1842.0;
+    constexpr double Eps = std::numeric_limits<double>::epsilon();
+    constexpr double InverseLn2 = 1.4426950408889634073599246810018921;
+    constexpr double Ln2High = 22713.0 / 32768.0;
+    constexpr double Ln2Low = 1.4286068203094172321214581765680755e-6;
+    constexpr double P1 = 420.30235984910635;
+    constexpr double P2 = 15132.70094680474802;
+    constexpr double Q0 = 30.01511290683317;
+    constexpr double Q1 = 3362.72154416553028;
+    constexpr double Q2 = 30265.40189360949691;
+    constexpr double E = 0x1.5bf0a8b145769p+1;
+    const short xKind = ClassifyValue(x);
+    const short yKind = ClassifyValue(y);
+    if (xKind == NotANumber) return NotANumber;
+    if (yKind == NotANumber) return NotANumber;
+    if (xKind == Infinite) {
+        if (x > 0.0) {
+            if (yKind == Zero) {
+                *value = std::numeric_limits<double>::quiet_NaN();
+                RaiseLibcError(FE_INVALID);
+                return NotANumber;
+            }
+            if (yKind == Infinite) {
+                *value = y;
+            } else {
+                *value = std::copysign(std::numeric_limits<double>::infinity(), y);
+            }
+            return Infinite;
+        }
+        if (yKind == Infinite) {
+            *value = std::numeric_limits<double>::quiet_NaN();
+            RaiseLibcError(FE_INVALID);
+            return NotANumber;
+        }
+        *value = std::copysign(0.0, y);
+        return Zero;
+    }
+    if (yKind == Zero) {
+        *value = y;
+        return Zero;
+    }
+    if (yKind == Infinite) {
+        *value = y;
+        return Infinite;
+    }
+    if (xKind == Zero) {
+        if (offset == 0) {
+            *value = y;
+            return Finite;
+        }
+        const short result = ScaleProduct(*value, 1.0, y, offset);
+        if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+            std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+            errno = entryErrno;
+        }
+        return result;
+    }
+    if (offset == 0 && x == 1.0 && y == 1.0) {
+        *value = E;
+        return Finite;
+    }
+    if (x < -HugeExp) {
+        *value = std::copysign(0.0, y);
+        return Zero;
+    }
+    if (x > HugeExp) {
+        *value = std::copysign(std::numeric_limits<double>::infinity(), y);
+        RaiseLibcError(FE_OVERFLOW);
+        return Infinite;
+    }
+    double g = x * InverseLn2;
+    long exponent = static_cast<long>(g + (g < 0.0 ? -0.5 : 0.5));
+    g = static_cast<double>(exponent);
+    g = (x - g * Ln2High) - g * Ln2Low;
+    double factor;
+    if (-Eps < g && g < Eps) {
+        factor = 1.0;
+    } else {
+        const double z = g * g;
+        const double w = (Q0 * z + Q1) * z + Q2;
+        g *= (z + P1) * z + P2;
+        factor = (w + g) / (w - g) * 2.0;
+        --exponent;
+    }
+    const short result = ScaleProduct(*value, factor, y, exponent + offset);
+    if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+        std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+        errno = entryErrno;
+    }
+    return result;
+}
+
+short APS5_VABI _FExp_nid_postfix(float* value, float y, short offset) {
+    if (value == nullptr) throw std::invalid_argument("_FExp: null value");
+    std::fexcept_t entryFlags;
+    std::fegetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+    const int entryErrno = errno;
+    const float x = *value;
+    constexpr float HugeExp = 229.0f;
+    constexpr float Eps = std::numeric_limits<float>::epsilon();
+    constexpr float InverseLn2 = 1.4426950216f;
+    constexpr float Ln2High = 0.69287109375f;
+    constexpr float Ln2Low = 0.00027608682f;
+    constexpr float Q = 0.09997485578f;
+    constexpr float P0 = 0.5f;
+    constexpr float P1 = 0.0083208261f;
+    constexpr float E = 0x1.5bf0a8p+1f;
+    const short xKind = ClassifyValue(x);
+    const short yKind = ClassifyValue(y);
+    if (xKind == NotANumber) return NotANumber;
+    if (yKind == NotANumber) return NotANumber;
+    if (xKind == Infinite) {
+        if (x > 0.0f) {
+            if (yKind == Zero) {
+                *value = std::numeric_limits<float>::quiet_NaN();
+                RaiseLibcError(FE_INVALID);
+                return NotANumber;
+            }
+            if (yKind == Infinite) {
+                *value = y;
+            } else {
+                *value = std::copysign(std::numeric_limits<float>::infinity(), y);
+            }
+            return Infinite;
+        }
+        if (yKind == Infinite) {
+            *value = std::numeric_limits<float>::quiet_NaN();
+            RaiseLibcError(FE_INVALID);
+            return NotANumber;
+        }
+        *value = std::copysign(0.0f, y);
+        return Zero;
+    }
+    if (yKind == Zero) {
+        *value = y;
+        return Zero;
+    }
+    if (yKind == Infinite) {
+        *value = y;
+        return Infinite;
+    }
+    if (xKind == Zero) {
+        if (offset == 0) {
+            *value = y;
+            return Finite;
+        }
+        const short result = ScaleProduct(*value, 1.0f, y, offset);
+        if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+            std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+            errno = entryErrno;
+        }
+        return result;
+    }
+    if (offset == 0 && x == 1.0f && y == 1.0f) {
+        *value = E;
+        return Finite;
+    }
+    if (x < -HugeExp) {
+        *value = std::copysign(0.0f, y);
+        return Zero;
+    }
+    if (x > HugeExp) {
+        *value = std::copysign(std::numeric_limits<float>::infinity(), y);
+        RaiseLibcError(FE_OVERFLOW);
+        return Infinite;
+    }
+    float g = x * InverseLn2;
+    long exponent = static_cast<long>(g + (g < 0.0f ? -0.5f : 0.5f));
+    g = static_cast<float>(exponent);
+    g = (x - g * Ln2High) - g * Ln2Low;
+    float factor;
+    if (-Eps < g && g < Eps) {
+        factor = 1.0f;
+    } else {
+        const float z = g * g;
+        const float w = Q * z + 1.0f;
+        g *= P0 + P1 * z;
+        factor = (w + g) / (w - g) * 2.0f;
+        --exponent;
+    }
+    const short result = ScaleProduct(*value, factor, y, exponent + offset);
+    if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+        std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+        errno = entryErrno;
+    }
+    return result;
 }
 
 double APS5_VABI _Sin_nid_postfix(double x, unsigned int quadrant) {
@@ -83,6 +402,22 @@ long double APS5_VABI _LSin_nid_postfix(long double x, unsigned int quadrant) {
     return quadrant != 0 ? cosl_nid_postfix(x) : sinl_nid_postfix(x);
 }
 
+double APS5_VABI _Divide_nid_postfix(double x, double y) {
+    return x / y;
+}
+
+float APS5_VABI _FDivide_nid_postfix(float x, float y) {
+    return x / y;
+}
+
+double APS5_VABI _Recip_nid_postfix(double x) {
+    return 1.0 / x;
+}
+
+float APS5_VABI _FRecip_nid_postfix(float x) {
+    return 1.0f / x;
+}
+
 double APS5_VABI _Log_nid_postfix(double x, int base) {
     if (base > 0) return log10_nid_postfix(x);
     return base == 0 ? log_nid_postfix(x) : log2_nid_postfix(x);
@@ -93,4 +428,17 @@ float APS5_VABI _FLog_nid_postfix(float x, int base) {
     return base == 0 ? logf_nid_postfix(x) : log2f_nid_postfix(x);
 }
 
+long double APS5_VABI _LLog_nid_postfix(long double x, int base) {
+    if (base > 0) return log10l_nid_postfix(x);
+    return base == 0 ? logl_nid_postfix(x) : log2l_nid_postfix(x);
+}
+
+long double APS5_VABI _LDivide_nid_postfix(long double x, long double y) {
+    return x / y;
+}
+
+long double APS5_VABI _LRecip_nid_postfix(long double x) {
+    return 1.0L / x;
+}
+
 }
diff --git a/core/libs/prx/libc/src/Directory.cpp b/core/libs/prx/libc/src/Directory.cpp
index 425669cdcf..63848ea167 100644
--- a/core/libs/prx/libc/src/Directory.cpp
+++ b/core/libs/prx/libc/src/Directory.cpp
@@ -1,14 +1,19 @@
+#include "prx/libc/include/GuestFileNumber.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/AppArchive.hpp"
 #include <dirent.h>
 #include <unistd.h>
+#include <algorithm>
+#include <array>
 #include <cerrno>
 #include <cstring>
 #include <memory>
 #include <mutex>
 #include <stdexcept>
+#include <vector>
 #include <string>
 #ifdef _WIN32
 #include "prx/libc/include/WindowsDescriptor.hpp"
@@ -33,6 +38,13 @@ int DirectoryError(int error) {
     default: return 5;
     }
 }
+int DirectoryError(const std::error_code& error) {
+#ifdef _WIN32
+    if (error.category() == std::system_category())
+        return FilesystemError(std::error_code(WindowsOpenError_nid_no_patch(static_cast<unsigned long>(error.value())), std::generic_category()));
+#endif
+    return FilesystemError(error);
+}
 #ifdef _WIN32
 struct NativeDirectory {
     HANDLE handle = INVALID_HANDLE_VALUE;
@@ -53,7 +65,16 @@ int NativeOpenError(DWORD error) {
 NativeDirectory* OpenNative(const std::filesystem::path& path) {
     const DWORD attributes = GetFileAttributesW(path.c_str());
     if (attributes == INVALID_FILE_ATTRIBUTES) { errno = NativeOpenError(GetLastError()); return nullptr; }
-    if ((attributes & FILE_ATTRIBUTE_DIRECTORY) == 0) { errno = ENOTDIR; return nullptr; }
+    if ((attributes & FILE_ATTRIBUTE_DIRECTORY) == 0) {
+        errno = ENOTDIR;
+        if ((attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
+            const HANDLE followed = CreateFileW(path.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+            if (followed != INVALID_HANDLE_VALUE) CloseHandle(followed);
+            else if (GetLastError() == ERROR_CANT_RESOLVE_FILENAME) errno = ELOOP;
+        }
+        return nullptr;
+    }
     auto native = std::make_unique_for_overwrite<NativeDirectory>();
     native->handle = CreateFileW(path.c_str(), FILE_LIST_DIRECTORY | SYNCHRONIZE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
         nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
@@ -152,9 +173,17 @@ struct Directory {
     NativeDirectory* native = nullptr;
     std::filesystem::path path;
     GuestDirectoryEntry entry{};
+    std::vector<GuestDirectoryEntry> entries;
+    std::vector<GuestDirectoryEntry> pending;
+    std::size_t cursor = 0;
+    std::size_t pendingCursor = 0;
+    bool indexed = false;
+    bool descriptorDirectory = false;
     std::mutex mutex;
     int descriptor = -1;
     int (APS5_VABI* closeDescriptor)(int) = nullptr;
+    int (APS5_VABI* readDescriptor)(int, char*, int) = nullptr;
+    std::int64_t (APS5_VABI* seekDescriptor)(int, std::int64_t, int) = nullptr;
     ~Directory() { if (native) CloseNative(native); }
 };
 std::uint8_t DirectoryType(const std::filesystem::path& path) {
@@ -172,6 +201,37 @@ std::uint8_t DirectoryType(const std::filesystem::path& path) {
 }
 GuestDirectoryEntry* ReadEntry(Directory& directory) {
     const int savedError = errno;
+    if (directory.descriptorDirectory) {
+        if (directory.pendingCursor >= directory.pending.size()) {
+            directory.pending.clear();
+            directory.pendingCursor = 0;
+            std::array<char, sizeof(GuestDirectoryEntry)> bytes{};
+            const int read = directory.readDescriptor(directory.descriptor, bytes.data(), static_cast<int>(bytes.size()));
+            if (read < 0) {
+                errno = static_cast<int>(static_cast<std::uint32_t>(read) & 0xffffu);
+                return nullptr;
+            }
+            if (read == 0) { errno = savedError; return nullptr; }
+            for (int offset = 0; offset < read;) {
+                GuestDirectoryEntry entry{};
+                std::uint16_t recordLength = 0;
+                std::memcpy(&recordLength, bytes.data() + offset + 4, sizeof(recordLength));
+                if (recordLength < 12 || offset + recordLength > read || recordLength > sizeof(entry)) { errno = 5; return nullptr; }
+                std::memcpy(&entry, bytes.data() + offset, recordLength);
+                directory.pending.push_back(entry);
+                offset += recordLength;
+            }
+        }
+        directory.entry = directory.pending[directory.pendingCursor++];
+        errno = savedError;
+        return &directory.entry;
+    }
+    if (directory.indexed) {
+        if (directory.cursor >= directory.entries.size()) { errno = savedError; return nullptr; }
+        directory.entry = directory.entries[directory.cursor++];
+        errno = savedError;
+        return &directory.entry;
+    }
     errno = 0;
     std::filesystem::path component;
     std::string name;
@@ -194,7 +254,67 @@ GuestDirectoryEntry* ReadEntry(Directory& directory) {
         errno = savedError;
         return &directory.entry;
     } catch (const std::bad_alloc&) { errno = 12; return nullptr; }
-      catch (const std::filesystem::filesystem_error&) { errno = 5; return nullptr; }
+      catch (const std::system_error& error) { errno = DirectoryError(error.code()); return nullptr; }
+      catch (const std::exception&) { errno = 5; return nullptr; }
+}
+
+GuestDirectoryEntry MakeEntry(const std::string& name, std::uint64_t inode, std::uint8_t type) {
+    if (name.size() > 255) throw std::system_error(ENAMETOOLONG, std::generic_category(), "directory entry name");
+    GuestDirectoryEntry entry{};
+    entry.fileNumber = GuestFileNumber_nid_no_patch(inode);
+    entry.recordLength = static_cast<std::uint16_t>(8 + ((name.size() + 1 + 3) & ~std::size_t{3}));
+    entry.nameLength = static_cast<std::uint8_t>(name.size());
+    entry.type = type;
+    std::memcpy(entry.name, name.c_str(), name.size() + 1);
+    return entry;
+}
+
+void OpenIndexed(Directory& directory) {
+    directory.indexed = true;
+    std::vector<std::string> names;
+    const auto archiveOnly = AppArchiveOnly_nid_no_patch(directory.path);
+    if (!archiveOnly) {
+        directory.native = OpenNative(directory.path);
+        if (!directory.native) throw std::system_error(errno, std::generic_category(), "open merged directory");
+        for (;;) {
+            errno = 0;
+            std::filesystem::path component;
+            std::string name;
+            std::uint64_t inode = 0;
+            if (!ReadNative(directory.native, component, name, inode)) {
+                if (errno != 0) throw std::system_error(errno, std::generic_category(), "read merged directory");
+                break;
+            }
+            names.push_back(name);
+            directory.entries.push_back(MakeEntry(name, inode, DirectoryType(directory.path / component)));
+        }
+        CloseNative(directory.native);
+        directory.native = nullptr;
+    }
+    AppArchiveNode node{};
+    if (!AppArchiveLookup_nid_no_patch(directory.path, &node) || !node.Directory)
+        throw std::logic_error("OpenIndexed: app0.zar directory disappeared");
+    const auto hasName = [&names](const std::string& name) {
+        return std::any_of(names.begin(), names.end(), [&name](const std::string& existing) {
+            return AppArchiveNameMatches_nid_no_patch(existing, name);
+        });
+    };
+    if (!hasName(".")) {
+        const auto dotNumber = archiveOnly ? static_cast<std::uint64_t>(node.Handle) + 1 : 0;
+        directory.entries.push_back(MakeEntry(".", dotNumber, 4));
+        names.push_back(".");
+    }
+    if (!hasName("..")) {
+        AppArchiveNode parent{};
+        const auto parentPath = directory.path.parent_path();
+        const auto parentNumber = AppArchiveLookup_nid_no_patch(parentPath, &parent) && parent.Directory ? static_cast<std::uint64_t>(parent.Handle) + 1 : 0;
+        directory.entries.push_back(MakeEntry("..", parentNumber, 4));
+        names.push_back("..");
+    }
+    const auto archiveEntries = archiveOnly ? AppArchiveListDirectory_nid_no_patch(directory.path)
+        : AppArchiveListUnshadowedDirectory_nid_no_patch(directory.path, names);
+    for (const auto& entry : archiveEntries)
+        directory.entries.push_back(MakeEntry(entry.Name, static_cast<std::uint64_t>(entry.Handle) + 1, entry.Directory ? 4 : 8));
 }
 }
 
@@ -204,17 +324,21 @@ void* APS5_VABI opendir_nid_postfix(const char* path) {
     if (!*path) { errno = 2; return nullptr; }
     try {
         auto directory = std::make_unique<Directory>();
-        if (const int error = ResolvePathError_nid_no_patch(path, directory->path)) { errno = error; return nullptr; }
-        AppArchiveRefuseMergedListing_nid_no_patch(directory->path, path);
-        directory->native = OpenNative(directory->path);
-        if (!directory->native) {
-            errno = DirectoryError(errno);
-            if (errno == 2) errno = NotFoundError_nid_no_patch(directory->path);
-            return nullptr;
+        if (const int error = ResolvePathError_nid_no_patch(path, directory->path, false, true)) { errno = error; return nullptr; }
+        if (AppArchiveHasDirectory_nid_no_patch(directory->path)) {
+            OpenIndexed(*directory);
+        } else {
+            directory->native = OpenNative(directory->path);
+            if (!directory->native) {
+                errno = DirectoryError(errno);
+                if (errno == 2) errno = NotFoundError_nid_no_patch(directory->path);
+                return nullptr;
+            }
         }
         return directory.release();
     } catch (const std::bad_alloc&) { errno = 12; return nullptr; }
-      catch (const std::filesystem::filesystem_error&) { errno = 5; return nullptr; }
+      catch (const std::system_error& error) { errno = DirectoryError(error.code()); return nullptr; }
+      catch (const std::exception&) { errno = 5; return nullptr; }
 }
 
 GuestDirectoryEntry* APS5_VABI readdir_nid_postfix(void* handle) {
@@ -245,7 +369,7 @@ int APS5_VABI readdir_r_nid_postfix(void* handle, GuestDirectoryEntry* entry, Gu
 int APS5_VABI closedir_nid_postfix(void* handle) {
     if (!handle) { errno = 9; return -1; }
     std::unique_ptr<Directory> directory(static_cast<Directory*>(handle));
-    int result = CloseNative(directory->native);
+    int result = directory->native ? CloseNative(directory->native) : 0;
     directory->native = nullptr;
     if (result) errno = DirectoryError(errno);
     if (directory->closeDescriptor && directory->closeDescriptor(directory->descriptor) != 0) result = -1;
@@ -256,27 +380,76 @@ void APS5_VABI rewinddir_nid_postfix(void* handle) {
     if (!handle) { errno = 9; return; }
     auto& directory = *static_cast<Directory*>(handle);
     std::lock_guard lock(directory.mutex);
-    RewindNative(directory.native);
+    if (directory.descriptorDirectory) {
+        if (directory.seekDescriptor(directory.descriptor, 0, 0) >= 0) {
+            directory.pending.clear();
+            directory.pendingCursor = 0;
+        }
+    } else if (directory.indexed) {
+        auto entries = std::move(directory.entries);
+        const auto cursor = directory.cursor;
+        const auto indexed = directory.indexed;
+        directory.entries.clear();
+        directory.cursor = 0;
+        directory.indexed = false;
+        const auto restore = [&directory, &entries, cursor, indexed] {
+            if (directory.native) {
+                CloseNative(directory.native);
+                directory.native = nullptr;
+            }
+            directory.entries = std::move(entries);
+            directory.cursor = cursor;
+            directory.indexed = indexed;
+        };
+        try { OpenIndexed(directory); }
+        catch (const std::bad_alloc&) { restore(); errno = 12; }
+        catch (const std::system_error& error) { restore(); errno = DirectoryError(error.code()); }
+        catch (const std::exception&) { restore(); errno = 5; }
+    }
+    else RewindNative(directory.native);
 }
 
 std::int64_t APS5_VABI telldir_nid_postfix(void* handle) {
     if (!handle) { errno = 9; return -1; }
     auto& directory = *static_cast<Directory*>(handle);
     std::lock_guard lock(directory.mutex);
-    return TellNative(directory.native);
+    if (directory.descriptorDirectory) {
+        const auto position = directory.seekDescriptor(directory.descriptor, 0, 1);
+        if (position < 0) return position;
+        const auto unread = directory.pending.size() - directory.pendingCursor;
+        return position >= static_cast<std::int64_t>(unread) ? position - static_cast<std::int64_t>(unread) : 0;
+    }
+    return directory.indexed ? static_cast<std::int64_t>(directory.cursor) : TellNative(directory.native);
 }
 
 void APS5_VABI seekdir_nid_postfix(void* handle, std::int64_t location) {
     if (!handle) { errno = 9; return; }
     auto& directory = *static_cast<Directory*>(handle);
     std::lock_guard lock(directory.mutex);
-    SeekNative(directory.native, static_cast<long>(location));
+    if (directory.descriptorDirectory) {
+        if (directory.seekDescriptor(directory.descriptor, location, 0) >= 0) {
+            directory.pending.clear();
+            directory.pendingCursor = 0;
+        }
+    } else if (directory.indexed) {
+        if (location >= 0 && static_cast<std::uint64_t>(location) <= directory.entries.size()) directory.cursor = static_cast<std::size_t>(location);
+        else errno = 22;
+    } else SeekNative(directory.native, static_cast<long>(location));
 }
 
-void* APS5_VABI OpenDescriptorDirectory_nid_no_patch(const char* hostPath, int descriptor, int (APS5_VABI* closeDescriptor)(int), std::uint64_t position) {
+void* APS5_VABI OpenDescriptorDirectory_nid_no_patch(const char* hostPath, int descriptor, int (APS5_VABI* closeDescriptor)(int), std::uint64_t position,
+    int (APS5_VABI* readDescriptor)(int, char*, int), std::int64_t (APS5_VABI* seekDescriptor)(int, std::int64_t, int)) {
     try {
         auto directory = std::make_unique<Directory>();
         directory->path = std::filesystem::path(reinterpret_cast<const char8_t*>(hostPath));
+        if (readDescriptor && seekDescriptor) {
+            directory->descriptor = descriptor;
+            directory->closeDescriptor = closeDescriptor;
+            directory->readDescriptor = readDescriptor;
+            directory->seekDescriptor = seekDescriptor;
+            directory->descriptorDirectory = true;
+            return directory.release();
+        }
 #ifdef _WIN32
         directory->native = OpenNative(directory->path);
         if (!directory->native) { errno = DirectoryError(errno); return nullptr; }
@@ -297,6 +470,6 @@ void* APS5_VABI OpenDescriptorDirectory_nid_no_patch(const char* hostPath, int d
         directory->closeDescriptor = closeDescriptor;
         return directory.release();
     } catch (const std::bad_alloc&) { errno = 12; return nullptr; }
-      catch (const std::filesystem::filesystem_error&) { errno = 5; return nullptr; }
+      catch (const std::system_error& error) { errno = DirectoryError(error.code()); return nullptr; }
 }
 }
diff --git a/core/libs/prx/libc/src/Environment.cpp b/core/libs/prx/libc/src/Environment.cpp
index f77b8727f9..a04c872b46 100644
--- a/core/libs/prx/libc/src/Environment.cpp
+++ b/core/libs/prx/libc/src/Environment.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdlib>
 #include <cerrno>
 #include <cstring>
diff --git a/core/libs/prx/libc/src/Errors.cpp b/core/libs/prx/libc/src/Errors.cpp
index 4e2d3f08bb..04d0187df9 100644
--- a/core/libs/prx/libc/src/Errors.cpp
+++ b/core/libs/prx/libc/src/Errors.cpp
@@ -1,10 +1,10 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstring>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 // Guest FreeBSD errno numbering, not the host CRT's numbering.
 constexpr const char* messages[] = {
@@ -18,7 +18,7 @@ constexpr const char* messages[] = {
     "Is a directory", "Invalid argument", "Too many open files in system",
     "Too many open files", "Inappropriate ioctl for device", "Text file busy",
     "File too large", "No space left on device", "Illegal seek",
-    "Read-only file system", "Too many links", "Broken pipe",
+    "Read-only filesystem", "Too many links", "Broken pipe",
     "Numerical argument out of domain", "Result too large", "Resource temporarily unavailable",
     "Operation now in progress", "Operation already in progress", "Socket operation on non-socket",
     "Destination address required", "Message too long", "Protocol wrong type for socket",
@@ -44,15 +44,15 @@ constexpr const char* messages[] = {
 };
 static_assert(sizeof(messages) / sizeof(messages[0]) == 97);
 bool Known(int error) { return error >= 0 && error < 97; }
+bool NamedByStrerror(int error) { return error > 0 && error < 95; }
 }
 
 extern "C" {
 char* APS5_VABI strerror_nid_postfix(int error) {
     thread_local char buffer[128];
-    const int saved = *__error_nid_postfix();
-    if (Known(error)) std::snprintf(buffer, sizeof(buffer), "%s", messages[error]);
-    else std::snprintf(buffer, sizeof(buffer), "Unknown error: %d", error);
-    *__error_nid_postfix() = Known(error) ? saved : 22;
+    if (error == 0) std::snprintf(buffer, sizeof(buffer), "No error");
+    else if (NamedByStrerror(error)) std::snprintf(buffer, sizeof(buffer), "%s", messages[error]);
+    else std::snprintf(buffer, sizeof(buffer), "error_code=0x%08x", static_cast<unsigned>(error));
     return buffer;
 }
 
@@ -77,6 +77,7 @@ void APS5_VABI perror_nid_postfix(const char* prefix) {
     const int saved = *__error_nid_postfix();
     char message[128];
     strerror_r_nid_postfix(saved, message, sizeof(message));
+
     auto* stream = GetNativeStream(&_Stderr_nid_postfix);
     if (prefix && *prefix) std::fprintf(stream, "%s: %s\n", prefix, message);
     else std::fprintf(stream, "%s\n", message);
diff --git a/core/libs/prx/libc/src/FileAndHeap.cpp b/core/libs/prx/libc/src/FileAndHeap.cpp
index 6187b36c04..51550e1dac 100644
--- a/core/libs/prx/libc/src/FileAndHeap.cpp
+++ b/core/libs/prx/libc/src/FileAndHeap.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
+#include <bit>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
@@ -157,9 +159,6 @@ static bool IsPipeStream(std::FILE* native) {
 }
 #endif
 
-using GuestCompare = int (APS5_VABI *)(const void*, const void*);
-using GuestContextCompare = int (APS5_VABI *)(const void*, const void*, void*);
-
 static void SwapElements(unsigned char* left, unsigned char* right, size_t size) {
     for (size_t index = 0; index < size; ++index) std::swap(left[index], right[index]);
 }
@@ -258,13 +257,13 @@ static void SortElements(unsigned char* base, size_t count, size_t size, Compare
 namespace {
 
 template<typename TAllocate>
-void* allocationOrNull(TAllocate allocate) {
+void* allocationOrNull(TAllocate allocate, int error = 12) {
     try {
         return allocate();
     } catch (const std::bad_alloc&) {
     } catch (const std::length_error&) {
     }
-    errno = 12;
+    errno = error;
     return nullptr;
 }
 
@@ -272,12 +271,36 @@ bool validAlignment(std::size_t alignment) {
     return alignment != 0 && (alignment & (alignment - 1)) == 0;
 }
 
+constexpr std::size_t DefaultHeapAlignment = 32;
+constexpr std::size_t DefaultHeapAlignmentLimit = std::size_t{1} << 63;
+constexpr std::size_t DefaultHeapOverhead = 0x1008f;
+constexpr std::size_t DefaultHeapAlignedOverhead = 0x100af;
+
+std::size_t defaultHeapAlignment(std::size_t alignment) {
+    return std::bit_ceil(std::max(alignment, DefaultHeapAlignment));
+}
+
+bool defaultHeapRequestOverflows(std::size_t bytes, std::size_t alignment) {
+    const std::size_t overhead = alignment <= DefaultHeapAlignment ? DefaultHeapOverhead : defaultHeapAlignment(alignment) + DefaultHeapAlignedOverhead;
+    return bytes > std::numeric_limits<std::size_t>::max() - overhead;
+}
+
+template<typename TAllocate>
+void* defaultHeapAllocation(std::size_t bytes, std::size_t alignment, TAllocate allocate) {
+    if (defaultHeapRequestOverflows(bytes, alignment)) return nullptr;
+    return allocationOrNull(allocate, 22);
+}
+
+template<typename TAllocate>
+void* heapAllocation(std::size_t bytes, TAllocate allocate) {
+    if (!ApplicationHeapDefault_nid_no_patch()) return allocationOrNull(allocate);
+    return defaultHeapAllocation(bytes, 0, allocate);
+}
+
 }
 
 extern "C" {
 
-[[noreturn]] void APS5_VABI _ZSt11_Xbad_allocv_nid_postfix();
-
 FileStream* APS5_VABI fdopen_nid_postfix(int descriptor, const char* mode) {
     if (descriptor < 0) { errno = 9; return nullptr; }
     if (!mode) { errno = 22; return nullptr; }
@@ -361,14 +384,12 @@ FileStream* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode
     if (!parsed) { errno = 22; return nullptr; }
     try {
         std::filesystem::path path;
-        if (*filename) {
-            if (const int error = ResolvePathError_nid_no_patch(filename, path)) {
-                if (stream->IsHostStandard()) stream->Detach();
-                else stream->Close();
-                if (stream->IsDynamic()) delete stream;
-                errno = error;
-                return nullptr;
-            }
+        if (const int error = *filename ? ResolvePathError_nid_no_patch(filename, path) : 2) {
+            if (stream->IsHostStandard()) stream->Detach();
+            else stream->Close();
+            if (stream->IsDynamic()) delete stream;
+            errno = error;
+            return nullptr;
         }
         if (stream->Reopen(path, parsed->native.c_str(), OpenNative)) {
 #ifdef _WIN32
@@ -444,6 +465,15 @@ int APS5_VABI fopen_s_nid_postfix(FileStream** result, const char* filename, con
     return *result ? 0 : errno;
 }
 
+int APS5_VABI freopen_s_nid_postfix(FileStream** result, const char* filename, const char* mode, FileStream* stream) {
+    constexpr int GuestEinval = 22;
+    if (!result) return GuestEinval;
+    *result = nullptr;
+    if (!mode || !stream) return GuestEinval;
+    *result = freopen_nid_postfix(filename, mode, stream);
+    return *result ? 0 : errno;
+}
+
 int APS5_VABI fclose_nid_postfix(FileStream* stream) {
     if (stream && !stream->IsOpen()) {
         std::unique_ptr<FileStream> owner(stream->IsDynamic() ? stream : nullptr);
@@ -455,8 +485,6 @@ int APS5_VABI fclose_nid_postfix(FileStream* stream) {
     return stream->Close();
 }
 
-int APS5_VABI fseek_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
-
 FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char* filename, int mode, int protection) {
     static_cast<void>(protection);
     constexpr int In = 0x01, Out = 0x02, Ate = 0x04, App = 0x08, Trunc = 0x10, Nocreate = 0x20, Noreplace = 0x40,
@@ -477,6 +505,7 @@ FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const
     auto* stream = fopen_nid_postfix(filename, openMode);
     if (!stream || !(mode & Ate) || fseek_nid_postfix(stream, 0, SEEK_END) == 0) return stream;
     fclose_nid_postfix(stream);
+
     return nullptr;
 }
 
@@ -586,6 +615,8 @@ int APS5_VABI fflush_nid_postfix(FileStream* stream) {
     if (stream && (stream->IsRandomDevice() || stream->IsDirectory())) return 0;
 #ifdef __linux__
     if (native && !__fwriting(native)) return 0;
+#elif defined(__APPLE__)
+    if (native && !(native->_flags & __SWR)) return 0;
 #endif
     const int result = std::fflush(native);
     if (stream) stream->SyncStatus();
@@ -601,7 +632,7 @@ size_t APS5_VABI malloc_usable_size_nid_postfix(void* pointer) {
 }
 
 void* APS5_VABI malloc_nid_postfix(size_t size) {
-    return allocationOrNull([size] { return ApplicationHeapAllocate_nid_no_patch(size); });
+    return heapAllocation(size, [size] { return ApplicationHeapAllocate_nid_no_patch(size); });
 }
 
 void APS5_VABI free_nid_postfix(void* ptr) {
@@ -609,49 +640,60 @@ void APS5_VABI free_nid_postfix(void* ptr) {
 }
 
 void* APS5_VABI realloc_nid_postfix(void* ptr, size_t newSize) {
-    return allocationOrNull([ptr, newSize] { return ApplicationHeapReallocate_nid_no_patch(ptr, newSize); });
+    return heapAllocation(newSize, [ptr, newSize] { return ApplicationHeapReallocate_nid_no_patch(ptr, newSize); });
 }
 
 void* APS5_VABI reallocf_nid_postfix(void* ptr, size_t newSize) {
-    try {
-        return ApplicationHeapReallocate_nid_no_patch(ptr, newSize);
-    } catch (const std::bad_alloc&) {
-    } catch (const std::length_error&) {
-    }
-    ApplicationHeapFree_nid_no_patch(ptr);
-    errno = 12;
-    return nullptr;
+    void* result = realloc_nid_postfix(ptr, newSize);
+    if (result == nullptr && ptr != nullptr && newSize != 0) ApplicationHeapFree_nid_no_patch(ptr);
+    return result;
 }
 
 void* APS5_VABI memalign_nid_postfix(size_t alignment, size_t size) {
-    if (!validAlignment(alignment)) {
-        errno = 22;
-        return nullptr;
+    if (!ApplicationHeapDefault_nid_no_patch()) {
+        if (!validAlignment(alignment)) {
+            errno = 22;
+            return nullptr;
+        }
+        return allocationOrNull([alignment, size] { return ApplicationHeapAlign_nid_no_patch(alignment, size); });
     }
-    return allocationOrNull([alignment, size] { return ApplicationHeapAlign_nid_no_patch(alignment, size); });
+    if (alignment >= DefaultHeapAlignmentLimit) return nullptr;
+    const std::size_t rounded = defaultHeapAlignment(alignment);
+    return defaultHeapAllocation(size, alignment, [rounded, size] { return ApplicationHeapAlign_nid_no_patch(rounded, size); });
 }
 
 void* APS5_VABI aligned_alloc_nid_postfix(size_t alignment, size_t size) {
+    if (ApplicationHeapDefault_nid_no_patch() && !validAlignment(alignment)) return nullptr;
     return memalign_nid_postfix(alignment, size);
 }
 
 void* APS5_VABI reallocalign_nid_postfix(void* ptr, size_t size, size_t alignment) {
-    if (size != 0 && !validAlignment(alignment)) {
-        errno = 22;
-        return nullptr;
+    if (!ApplicationHeapDefault_nid_no_patch()) {
+        if (size != 0 && !validAlignment(alignment)) {
+            errno = 22;
+            return nullptr;
+        }
+        return allocationOrNull([ptr, size, alignment] { return ApplicationHeapRealign_nid_no_patch(ptr, size, alignment); });
     }
-    return allocationOrNull([ptr, size, alignment] { return ApplicationHeapRealign_nid_no_patch(ptr, size, alignment); });
+    if (alignment >= DefaultHeapAlignmentLimit) return nullptr;
+    const std::size_t rounded = defaultHeapAlignment(alignment);
+    return defaultHeapAllocation(size, alignment, [ptr, size, rounded] { return ApplicationHeapRealign_nid_no_patch(ptr, size, rounded); });
 }
 
 void* APS5_VABI calloc_nid_postfix(size_t count, size_t size) {
-    return allocationOrNull([count, size] { return ApplicationHeapCalloc_nid_no_patch(count, size); });
+    const auto allocate = [count, size] { return ApplicationHeapCalloc_nid_no_patch(count, size); };
+    if (!ApplicationHeapDefault_nid_no_patch()) return allocationOrNull(allocate);
+    if (size != 0 && count > std::numeric_limits<size_t>::max() / size) return nullptr;
+    return defaultHeapAllocation(count * size, 0, allocate);
 }
 
 int APS5_VABI posix_memalign_nid_postfix(void** pointer, size_t alignment, size_t size) {
     if (!pointer || alignment < sizeof(void*) || (alignment & (alignment - 1)) != 0) return 22;
     const int savedError = errno;
     const int result = ApplicationHeapPosixAlign_nid_no_patch(pointer, alignment, size);
-    errno = savedError;
+    const bool failureSetsError = result != 0 && ApplicationHeapDefault_nid_no_patch() && alignment < DefaultHeapAlignmentLimit &&
+        !defaultHeapRequestOverflows(size, alignment);
+    errno = failureSetsError ? 22 : savedError;
     return result;
 }
 
@@ -706,6 +748,7 @@ int APS5_VABI mergesort_nid_postfix(void* base, size_t count, size_t size, Guest
     }
     if (source != base) std::memcpy(base, source, count * size);
     free_nid_postfix(scratch);
+
     return 0;
 }
 
diff --git a/core/libs/prx/libc/src/Filesystem.cpp b/core/libs/prx/libc/src/Filesystem.cpp
index 510477eb7a..053d0a8b7f 100644
--- a/core/libs/prx/libc/src/Filesystem.cpp
+++ b/core/libs/prx/libc/src/Filesystem.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/General.hpp"
 #include <cerrno>
@@ -11,6 +12,30 @@
 #include <unistd.h>
 #endif
 
+#ifdef _WIN32
+static std::filesystem::path FollowedPath(const std::filesystem::path& path) {
+    const DWORD attributes = GetFileAttributesW(path.c_str());
+    if (attributes == INVALID_FILE_ATTRIBUTES || (attributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0) return path;
+    const HANDLE handle = CreateFileW(path.c_str(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr,
+        OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) return {};
+    std::wstring target(MAX_PATH, L'\0');
+    DWORD length = GetFinalPathNameByHandleW(handle, target.data(), static_cast<DWORD>(target.size()), FILE_NAME_NORMALIZED);
+    if (length >= target.size()) {
+        target.resize(length);
+        length = GetFinalPathNameByHandleW(handle, target.data(), length, FILE_NAME_NORMALIZED);
+    }
+    const DWORD error = GetLastError();
+    CloseHandle(handle);
+    if (length == 0 || length >= target.size()) {
+        SetLastError(length == 0 ? error : ERROR_FILENAME_EXCED_RANGE);
+        return {};
+    }
+    target.resize(length);
+    return target;
+}
+#endif
+
 extern "C" int APS5_VABI access_nid_postfix(const char* path, int mode) {
     if (mode < 0 || (mode & ~7)) { errno = 22; return -1; }
     if (!path) { errno = 14; return -1; }
@@ -18,9 +43,11 @@ extern "C" int APS5_VABI access_nid_postfix(const char* path, int mode) {
     try {
         const auto resolved = ResolvePath_nid_no_patch(path);
 #ifdef _WIN32
-        const DWORD attributes = GetFileAttributesW(resolved.c_str());
+        const auto target = FollowedPath(resolved);
+        const DWORD attributes = target.empty() ? INVALID_FILE_ATTRIBUTES : GetFileAttributesW(target.c_str());
         if (attributes == INVALID_FILE_ATTRIBUTES) {
-            errno = FilesystemError(std::error_code(static_cast<int>(GetLastError()), std::system_category()));
+            const DWORD failure = GetLastError();
+            errno = failure == ERROR_CANT_RESOLVE_FILENAME ? 62 : FilesystemError(std::error_code(static_cast<int>(failure), std::system_category()));
             if (errno == 2) errno = NotFoundError_nid_no_patch(resolved);
             return -1;
         }
@@ -30,10 +57,10 @@ extern "C" int APS5_VABI access_nid_postfix(const char* path, int mode) {
         }
         DWORD size = 0;
         constexpr auto information = OWNER_SECURITY_INFORMATION | GROUP_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION;
-        GetFileSecurityW(resolved.c_str(), information, nullptr, 0, &size);
+        GetFileSecurityW(target.c_str(), information, nullptr, 0, &size);
         if (!size) { errno = 13; return -1; }
         std::vector<unsigned char> descriptor(size);
-        if (!GetFileSecurityW(resolved.c_str(), information, descriptor.data(), size, &size)) {
+        if (!GetFileSecurityW(target.c_str(), information, descriptor.data(), size, &size)) {
             errno = 13; return -1;
         }
         struct Token {
diff --git a/core/libs/prx/libc/src/FloatBuiltins.cpp b/core/libs/prx/libc/src/FloatBuiltins.cpp
index b059652259..235c74f27a 100644
--- a/core/libs/prx/libc/src/FloatBuiltins.cpp
+++ b/core/libs/prx/libc/src/FloatBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cmath>
 #include <cstdint>
@@ -8,9 +9,6 @@
 
 namespace {
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
 constexpr std::uint32_t DefaultMxcsr = 0x1f80;
 
 template<typename TFloat>
diff --git a/core/libs/prx/libc/src/FloatingPoint.cpp b/core/libs/prx/libc/src/FloatingPoint.cpp
index e3717ef61b..ea910f0f3b 100644
--- a/core/libs/prx/libc/src/FloatingPoint.cpp
+++ b/core/libs/prx/libc/src/FloatingPoint.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -61,8 +62,6 @@ int APS5_VABI fegetexceptflag_nid_postfix(std::uint16_t* flags, int exceptions)
     return 0;
 }
 
-int* APS5_VABI __error_nid_postfix();
-
 void APS5_VABI _Feraise_nid_postfix(int exceptions) {
     constexpr unsigned Invalid = 0x01, Ranges = 0x1c, Overflows = 0x18, Inexact = 0x20;
     constexpr int GuestEdom = 33, GuestErange = 34;
@@ -96,7 +95,6 @@ int APS5_VABI feclearexcept_nid_postfix(int exceptions) {
     return 0;
 }
 
-
 int APS5_VABI feenableexcept_nid_postfix(int exceptions) {
     return ChangeTraps(exceptions, true);
 }
@@ -119,6 +117,10 @@ int APS5_VABI fegettrapenable_nid_postfix() {
     return ~control & Exceptions;
 }
 
+int APS5_VABI fegetexcept_nid_postfix() {
+    return fegettrapenable_nid_postfix();
+}
+
 int APS5_VABI fesettrapenable_nid_postfix(int exceptions) {
     const auto mask = static_cast<std::uint16_t>(exceptions);
     if (mask > Exceptions) return 1;
diff --git a/core/libs/prx/libc/src/Formatting.cpp b/core/libs/prx/libc/src/Formatting.cpp
index 5a35df68eb..a67a0b877e 100644
--- a/core/libs/prx/libc/src/Formatting.cpp
+++ b/core/libs/prx/libc/src/Formatting.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstdio>
@@ -40,13 +41,20 @@ bool RequiresGuestFormatting(const char* format) {
         ++format;
         if (*format == '%') { ++format; continue; }
         while (*format && std::strchr("-+ #0'0123456789.*$", *format)) ++format;
-        if (*format == 'S' || *format == 'C' || *format == 'm' || *format == 'p' ||
+        if (*format == 'S' || *format == 'C' || *format == 'p' ||
             (*format == 'l' && (format[1] == 's' || format[1] == 'c' || format[1] == 'p'))) return true;
+        while (*format && std::strchr("hljztL", *format)) ++format;
+        if (*format && !std::strchr(LibcDetail::KnownConversions, *format)) return true;
+        if (*format && std::strchr("aAeEfFgG", *format)) return true;
         if (*format) ++format;
     }
     return false;
 }
 
+std::size_t HostFormatSize(std::size_t size) {
+    return std::min(size, static_cast<std::size_t>(INT_MAX) + 1);
+}
+
 bool HasGuestWideScan(const char* format) {
     if (format == nullptr) return false;
     while ((format = std::strchr(format, '%')) != nullptr) {
@@ -80,7 +88,6 @@ bool IsWideScan(const std::string& length, char conversion) {
     return conversion == 'S' || conversion == 'C' || (length == "l" && (conversion == 's' || conversion == 'c' || conversion == '['));
 }
 
-
 #endif
 
 std::string HostLength(const std::string& length, char conversion) {
@@ -118,10 +125,69 @@ int HostVfscanf(std::FILE* stream, const char* format, std::va_list args) {
 }
 #endif
 
-template <typename NextPointer, typename NextCapacity>
-int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer nextPointer, NextCapacity nextCapacity) {
-    if (buffer == nullptr || format == nullptr) return EOF;
-    const char* input = buffer;
+int HostFscanf(std::FILE* stream, const char* format, ...) {
+    std::va_list args;
+    va_start(args, format);
+#ifdef _WIN32
+    const int result = std::vfscanf(stream, format, args);
+#else
+    const int result = HostVfscanf(stream, format, args);
+#endif
+    va_end(args);
+    return result;
+}
+
+class StringSource {
+    const char* const start;
+    const char* position;
+
+public:
+    static constexpr bool Contiguous = true;
+
+    explicit StringSource(const char* text) : start(text), position(text) {}
+
+    int Peek() const { return *position == '\0' ? EOF : static_cast<unsigned char>(*position); }
+    void Skip() { ++position; }
+    void Advance(std::ptrdiff_t count) { position += count; }
+    std::ptrdiff_t Consumed() const { return position - start; }
+    const char* Remaining() const { return position; }
+
+    int Scan(const char* directive, bool suppress, void* target, int* consumed) const {
+        return suppress ? HostSscanf(position, directive, consumed) : HostSscanf(position, directive, target, consumed);
+    }
+};
+
+class StreamSource {
+    std::FILE* const file;
+    std::ptrdiff_t consumed = 0;
+
+public:
+    static constexpr bool Contiguous = false;
+
+    explicit StreamSource(std::FILE* native) : file(native) {}
+
+    int Peek() const {
+        const int next = std::fgetc(file);
+        if (next != EOF) std::ungetc(next, file);
+        return next;
+    }
+
+    void Skip() {
+        std::fgetc(file);
+        ++consumed;
+    }
+
+    void Advance(std::ptrdiff_t count) { consumed += count; }
+    std::ptrdiff_t Consumed() const { return consumed; }
+
+    int Scan(const char* directive, bool suppress, void* target, int* count) const {
+        return suppress ? HostFscanf(file, directive, count) : HostFscanf(file, directive, target, count);
+    }
+};
+
+template <typename TSource, typename NextPointer, typename NextCapacity>
+int ScanSource(TSource source, const char* format, bool secure, NextPointer nextPointer, NextCapacity nextCapacity) {
+    if (format == nullptr) return EOF;
     int assigned = 0;
     bool converted = false;
     const char* cursor = format;
@@ -129,15 +195,15 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
     while (*cursor != '\0') {
         if (std::isspace(static_cast<unsigned char>(*cursor))) {
             while (std::isspace(static_cast<unsigned char>(*cursor))) ++cursor;
-            while (std::isspace(static_cast<unsigned char>(*input))) ++input;
+            while (std::isspace(source.Peek())) source.Skip();
             continue;
         }
         if (*cursor != '%' || cursor[1] == '%') {
             const char expected = *cursor == '%' ? '%' : *cursor;
             cursor += *cursor == '%' ? 2 : 1;
-            if (expected == '%') while (std::isspace(static_cast<unsigned char>(*input))) ++input;
-            if (*input != expected) return finish(!converted && *input == '\0' ? EOF : assigned);
-            ++input;
+            if (expected == '%') while (std::isspace(source.Peek())) source.Skip();
+            if (source.Peek() != static_cast<unsigned char>(expected)) return finish(!converted && source.Peek() == EOF ? EOF : assigned);
+            source.Skip();
             continue;
         }
         ++cursor;
@@ -164,7 +230,7 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
             if (!suppress) {
                 void* target = nextPointer();
                 if (target == nullptr) return EOF;
-                const auto count = input - buffer;
+                const auto count = source.Consumed();
                 if (length == "hh") *static_cast<signed char*>(target) = static_cast<signed char>(count);
                 else if (length == "h") *static_cast<short*>(target) = static_cast<short>(count);
                 else if (length.empty()) *static_cast<int*>(target) = static_cast<int>(count);
@@ -176,7 +242,8 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
             continue;
         }
 #ifndef _WIN32
-        if (IsWideScan(length, conversion)) {
+        if constexpr (TSource::Contiguous) if (IsWideScan(length, conversion)) {
+            const char* const input = source.Remaining();
             const char kind = conversion == 'S' ? 's' : conversion == 'C' ? 'c' : conversion;
             const char* field = input;
             if (kind == 's') {
@@ -222,15 +289,14 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
                 if (kind != 'c') target[text.size()] = u'\0';
                 ++assigned;
             }
-            input = field;
+            source.Advance(field - input);
             converted = true;
             continue;
         }
 #endif
         if (conversion != 'c' && conversion != '[') {
-            const char* probe = input;
-            while (std::isspace(static_cast<unsigned char>(*probe))) ++probe;
-            if (*probe == '\0') return finish(converted ? assigned : EOF);
+            while (std::isspace(source.Peek())) source.Skip();
+            if (source.Peek() == EOF) return finish(converted ? assigned : EOF);
         }
         const bool sized = secure && (conversion == 's' || conversion == 'c' || conversion == '[');
         bool capped = false;
@@ -257,29 +323,50 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
         directive += specifier;
         directive += "%n";
         int consumed = -1;
-        const int matched = suppress ? HostSscanf(input, directive.c_str(), &consumed) : HostSscanf(input, directive.c_str(), target, &consumed);
-        if (consumed < 0 || (!suppress && matched != 1)) return finish(!converted && *input == '\0' ? EOF : assigned);
+        const int matched = source.Scan(directive.c_str(), suppress, target, &consumed);
+        if (consumed < 0 || (!suppress && matched != 1)) return finish(!converted && source.Peek() == EOF ? EOF : assigned);
+        source.Advance(consumed);
         if (capped && conversion != 'c') {
-            const char next = input[consumed];
+            const int next = source.Peek();
             bool overflow = false;
-            if (conversion == 's') overflow = next != '\0' && !std::isspace(static_cast<unsigned char>(next));
-            else if (next != '\0') {
+            if (conversion == 's') overflow = next != EOF && !std::isspace(next);
+            else if (next != EOF) {
                 char probe[2];
+                const char text[2] = {static_cast<char>(next), '\0'};
                 const std::string test = "%1" + specifier;
-                overflow = std::sscanf(input + consumed, test.c_str(), probe) == 1;
+                overflow = std::sscanf(text, test.c_str(), probe) == 1;
             }
             if (overflow) {
                 static_cast<char*>(target)[0] = '\0';
                 return finish(assigned);
             }
         }
-        input += consumed;
         converted = true;
         if (!suppress) ++assigned;
     }
     return finish(assigned);
 }
 
+template <typename NextPointer, typename NextCapacity>
+int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer nextPointer, NextCapacity nextCapacity) {
+    if (buffer == nullptr) return EOF;
+    return ScanSource(StringSource(buffer), format, secure, nextPointer, nextCapacity);
+}
+
+template <typename NextPointer, typename NextCapacity>
+int ScanGuestStream(FileStream* stream, const char* format, NextPointer nextPointer, NextCapacity nextCapacity) {
+    if (stream == nullptr || format == nullptr) return EOF;
+    if (!stream->IsOpen()) { errno = 9; return EOF; }
+    auto* native = GetNativeStream(stream);
+    if (!stream->SwitchToReading()) return EOF;
+#ifndef _WIN32
+    RejectGuestWideScan(format);
+#endif
+    const int result = ScanSource(StreamSource(native), format, true, nextPointer, nextCapacity);
+    stream->SyncStatus();
+    return result;
+}
+
 }
 
 extern "C" {
@@ -361,13 +448,6 @@ int APS5_VABI fprintf_nid_postfix(FileStream* stream, const char* format, ...) {
     return result;
 }
 
-static bool SizeOverflowsInt(char* buffer, size_t size) {
-    if (size == 0 || size - 1 <= static_cast<size_t>(INT_MAX)) return false;
-    errno = 84;
-    if (buffer != nullptr) *buffer = '\0';
-    return true;
-}
-
 int APS5_VABI fscanf_nid_postfix(FileStream* stream, const char* format, ...) {
     if (stream && !stream->IsOpen()) { errno = 9; return -1; }
     auto* native = GetNativeStream(stream);
@@ -410,7 +490,6 @@ int APS5_VABI libc_printf_nid_postfix(const char* format, ...) {
 }
 
 int APS5_VABI snprintf_nid_postfix(char* buffer, size_t size, const char* format, ...) {
-    if (SizeOverflowsInt(buffer, size)) return -1;
     __builtin_sysv_va_list args;
     __builtin_sysv_va_start(args, format);
     const int result = LibcDetail::FormatWindows(buffer, size, format, args);
@@ -447,10 +526,9 @@ int APS5_VABI libc_printf_nid_postfix(const char* format, ...) {
 }
 
 int APS5_VABI snprintf_nid_postfix(char* buffer, size_t size, const char* format, ...) {
-    if (SizeOverflowsInt(buffer, size)) return -1;
     std::va_list args;
     va_start(args, format);
-    const int result = RequiresGuestFormatting(format) ? LibcDetail::FormatWindows(buffer, size, format, args) : std::vsnprintf(buffer, size, format, args);
+    const int result = RequiresGuestFormatting(format) ? LibcDetail::FormatWindows(buffer, size, format, args) : std::vsnprintf(buffer, HostFormatSize(size), format, args);
     va_end(args);
     return result;
 }
@@ -550,14 +628,13 @@ int APS5_VABI vsprintf_nid_postfix(char* str, const char* format, VaList* args)
 }
 
 int APS5_VABI vsnprintf_nid_postfix(char* str, size_t size, const char* format, VaList* c) {
-    if (SizeOverflowsInt(str, size)) return -1;
 #ifdef _WIN32
     return LibcDetail::FormatWindows(str, size, format, c);
 #else
     if (RequiresGuestFormatting(format)) return LibcDetail::FormatWindows(str, size, format, c);
     std::va_list copy;
     va_copy(copy, *reinterpret_cast<std::va_list*>(c));
-    const int result = std::vsnprintf(str, size, format, copy);
+    const int result = std::vsnprintf(str, HostFormatSize(size), format, copy);
     va_end(copy);
     return result;
 #endif
@@ -580,6 +657,47 @@ int APS5_VABI vsnprintf_s_nid_postfix(char* buffer, size_t size, const char* for
     return FormatSecure(buffer, size, format, args);
 }
 
+static int WriteSecure(FileStream* stream, const char* format, const void* args) {
+    if (stream == nullptr || format == nullptr || args == nullptr) return -1;
+    if (!stream->IsOpen()) { errno = 9; return -1; }
+    auto* native = GetNativeStream(stream);
+    std::string text;
+    int count;
+    try {
+        count = LibcDetail::FormatWindows(nullptr, 0, format, args, &text, true);
+    } catch (const LibcDetail::FormatConstraintViolation&) {
+        return -1;
+    }
+    const int result = std::fwrite(text.data(), 1, static_cast<size_t>(count), native) == static_cast<size_t>(count) ? count : -1;
+    stream->SyncStatus();
+    return result;
+}
+
+int APS5_VABI vfprintf_s_nid_postfix(FileStream* stream, const char* format, VaList* args) {
+    return WriteSecure(stream, format, args);
+}
+
+int APS5_VABI vprintf_s_nid_postfix(const char* format, VaList* args) {
+    return WriteSecure(&_Stdout_nid_postfix, format, args);
+}
+
+int APS5_VABI fprintf_s_nid_postfix(FileStream* stream, const char* format, ...) {
+#ifdef _WIN32
+    __builtin_sysv_va_list args;
+    __builtin_sysv_va_start(args, format);
+#else
+    std::va_list args;
+    va_start(args, format);
+#endif
+    const int result = vfprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+#ifdef _WIN32
+    __builtin_sysv_va_end(args);
+#else
+    va_end(args);
+#endif
+    return result;
+}
+
 #ifdef _WIN32
 
 int APS5_VABI vsscanf_s_nid_postfix(const char* buffer, const char* format, VaList* args) {
@@ -657,6 +775,7 @@ extern FileStream* __stdinp_nid_postfix;
 int APS5_VABI vfscanf_nid_postfix(FileStream* stream, const char* format, VaList* args) {
     if (stream && !stream->IsOpen()) { errno = 9; return -1; }
     auto* native = GetNativeStream(stream);
+    if (!stream->SwitchToReading()) return EOF;
 #ifdef _WIN32
     const int result = LibcDetail::ScanFileWindows_nid_no_patch(native, format, args);
 #else
@@ -692,4 +811,47 @@ int APS5_VABI scanf_nid_postfix(const char* format, ...) {
     return result;
 }
 
+int APS5_VABI vfscanf_s_nid_postfix(FileStream* stream, const char* format, VaList* args) {
+    LibcDetail::FormatArguments arguments(args);
+    return ScanGuestStream(stream, format, [&] { return arguments.Next<void*>(); }, [&] { return arguments.Next<unsigned int>(); });
+}
+
+int APS5_VABI vscanf_s_nid_postfix(const char* format, VaList* args) {
+    return vfscanf_s_nid_postfix(__stdinp_nid_postfix, format, args);
+}
+
+int APS5_VABI fscanf_s_nid_postfix(FileStream* stream, const char* format, ...) {
+#ifdef _WIN32
+    __builtin_sysv_va_list args;
+    __builtin_sysv_va_start(args, format);
+#else
+    std::va_list args;
+    va_start(args, format);
+#endif
+    const int result = vfscanf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+#ifdef _WIN32
+    __builtin_sysv_va_end(args);
+#else
+    va_end(args);
+#endif
+    return result;
+}
+
+int APS5_VABI scanf_s_nid_postfix(const char* format, ...) {
+#ifdef _WIN32
+    __builtin_sysv_va_list args;
+    __builtin_sysv_va_start(args, format);
+#else
+    std::va_list args;
+    va_start(args, format);
+#endif
+    const int result = vfscanf_s_nid_postfix(__stdinp_nid_postfix, format, reinterpret_cast<VaList*>(args));
+#ifdef _WIN32
+    __builtin_sysv_va_end(args);
+#else
+    va_end(args);
+#endif
+    return result;
+}
+
 }
diff --git a/core/libs/prx/libc/src/FormattingWide.cpp b/core/libs/prx/libc/src/FormattingWide.cpp
index a2b3d0fe7d..2c4ddb67bd 100644
--- a/core/libs/prx/libc/src/FormattingWide.cpp
+++ b/core/libs/prx/libc/src/FormattingWide.cpp
@@ -1,5 +1,7 @@
+#include "prx/libc/include/Api.hpp"
 #include <cerrno>
 #include <climits>
+#include <cmath>
 #include <cstdint>
 #include <cstddef>
 #include <cstdio>
@@ -171,10 +173,25 @@ std::u16string FormatWide(const char16_t* format, VaList* source, bool secure =
                 spec = spec.substr(0, spec.find('.')) + ".1";
             AppendNumber(out, spec + "ll" + static_cast<char>(conversion), value);
         } else if (In(conversion, "aAeEfFgG")) {
-            if (length == "L") AppendNumber(out, spec + "L" + static_cast<char>(conversion), args.Next<long double>());
-            else {
+            const char narrow = static_cast<char>(conversion);
+            const bool hexadecimal = narrow == 'a' || narrow == 'A';
+            if (length == "L") {
+                const long double value = args.Next<long double>();
+                if (!hexadecimal && std::isfinite(value)) {
+                    const std::string text = LibcDetail::DecimalFloat(spec, narrow, value);
+                    out.append(text.begin(), text.end());
+                } else {
+                    AppendNumber(out, spec + "L" + narrow, value);
+                }
+            } else {
                 if (!length.empty() && length != "l") throw std::invalid_argument("Invalid floating length");
-                AppendNumber(out, spec + static_cast<char>(conversion), args.Next<double>());
+                const double value = args.Next<double>();
+                if (std::isfinite(value)) {
+                    const std::string text = hexadecimal ? LibcDetail::HexFloat(spec, narrow, value) : LibcDetail::DecimalFloat(spec, narrow, value);
+                    out.append(text.begin(), text.end());
+                } else {
+                    AppendNumber(out, spec + narrow, value);
+                }
             }
         } else if (conversion == u'p' && length.empty()) {
             const std::string text = LibcDetail::FormatPointer(spec, args.Next<void*>());
@@ -218,8 +235,6 @@ std::u16string FormatWide(const char16_t* format, VaList* source, bool secure =
 
 extern "C" {
 extern FileStream* __stdoutp_nid_postfix;
-std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream);
-int APS5_VABI ferror_nid_postfix(FileStream* stream);
 
 int APS5_VABI vswprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args) {
     if (buffer == nullptr || size == 0) { errno = 22; return -1; }
@@ -322,6 +337,7 @@ int APS5_VABI vsnwprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const
 }
 
 int APS5_VABI wprintf_nid_postfix(const char16_t* format, ...) {
+    if (!__stdoutp_nid_postfix->IsOpen()) { errno = 9; return -1; }
     APS5_VA_BEGIN(format);
     int result = -1;
     try {
@@ -361,8 +377,42 @@ int APS5_VABI vwprintf_nid_postfix(const char16_t* format, VaList* args) {
     return vfwprintf_nid_postfix(__stdoutp_nid_postfix, format, args);
 }
 
+int APS5_VABI vfwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, VaList* args) {
+    if (stream == nullptr || format == nullptr || args == nullptr) return -1;
+    if (!stream->IsOpen()) { errno = 9; return -1; }
+    int result = -1;
+    try {
+        const std::u16string text = FormatWide(format, args, true);
+        const std::string bytes = ToUtf8(text);
+        if (text.size() <= static_cast<std::size_t>(INT_MAX) &&
+            std::fwrite(bytes.data(), 1, bytes.size(), GetNativeStream(stream)) == bytes.size()) result = static_cast<int>(text.size());
+    } catch (const std::invalid_argument&) {
+    }
+    stream->SyncStatus();
+    return result;
+}
+
+int APS5_VABI vwprintf_s_nid_postfix(const char16_t* format, VaList* args) {
+    return vfwprintf_s_nid_postfix(__stdoutp_nid_postfix, format, args);
+}
+
+int APS5_VABI fwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfwprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+int APS5_VABI wprintf_s_nid_postfix(const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfwprintf_s_nid_postfix(__stdoutp_nid_postfix, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
 int APS5_VABI fputwc_nid_postfix(char16_t value, FileStream* stream) {
     if (stream == nullptr) { errno = 22; return -1; }
+    if (!stream->IsOpen()) { errno = 9; return -1; }
     try {
         const std::string bytes = ToUtf8(std::u16string(1, value));
         auto* native = GetNativeStream(stream);
@@ -377,6 +427,7 @@ int APS5_VABI fputwc_nid_postfix(char16_t value, FileStream* stream) {
 
 int APS5_VABI fputws_nid_postfix(const char16_t* str, FileStream* stream) {
     if (str == nullptr || stream == nullptr) { errno = 22; return -1; }
+    if (!stream->IsOpen()) { errno = 9; return -1; }
     try {
         const std::u16string text(str);
         const std::string bytes = ToUtf8(text);
@@ -399,7 +450,8 @@ int APS5_VABI putwchar_nid_postfix(char16_t value) {
 }
 
 char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* stream) {
-    if (buffer == nullptr || stream == nullptr || size <= 0) {
+    if (size < 2) return nullptr;
+    if (buffer == nullptr || stream == nullptr) {
         if (stream != nullptr) stream->SetError();
         errno = 22;
         return nullptr;
@@ -407,14 +459,11 @@ char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* s
     int count = 0;
     while (count < size - 1) {
         const std::int32_t character = fgetwc_nid_postfix(stream);
-        if (character == -1) {
-            if (count == 0) return nullptr;
-            break;
-        }
+        if (character == -1) break;
         buffer[count++] = static_cast<char16_t>(character);
         if (character == static_cast<std::int32_t>(u'\n')) break;
     }
-    if (ferror_nid_postfix(stream) != 0) return nullptr;
+    if (count == 0) return nullptr;
     buffer[count] = 0;
     return buffer;
 }
diff --git a/core/libs/prx/libc/src/General.cpp b/core/libs/prx/libc/src/General.cpp
index 26c1935c5a..ecd6abc0c9 100644
--- a/core/libs/prx/libc/src/General.cpp
+++ b/core/libs/prx/libc/src/General.cpp
@@ -1,4 +1,7 @@
+#include "prx/libc/include/Api.hpp"
+#include <algorithm>
 #include <atomic>
+#include <array>
 #include <cstdio>
 #include <mutex>
 #include <stdexcept>
@@ -7,6 +10,7 @@
 #include <utility>
 #include <vector>
 #include <filesystem>
+#include <limits>
 #include <optional>
 #include <cerrno>
 #include <cstring>
@@ -28,12 +32,26 @@
 #include <ctime>
 #include <fcntl.h>
 #include <sys/stat.h>
+#ifdef __linux__
+#include <sys/uio.h>
+#elif defined(__APPLE__)
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#endif
 #include <unistd.h>
+#ifdef __linux__
+#include <sys/uio.h>
+#elif defined(__APPLE__)
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#endif
 #endif
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/AppArchive.hpp"
+#include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
+#include "prx/libc/include/GuestArena.hpp"
 
 namespace {
 // Guest prefixes (without leading slashes) mapped to host directories, e.g. save-data mount points:
@@ -50,6 +68,41 @@ PathAliases& Aliases() {
     return *aliases;
 }
 
+std::size_t HostPageSize() {
+    static const std::size_t size = [] {
+#ifdef _WIN32
+        SYSTEM_INFO info{};
+        GetSystemInfo(&info);
+        return static_cast<std::size_t>(info.dwPageSize);
+#else
+        const long value = sysconf(_SC_PAGESIZE);
+        if (value <= 0) throw std::runtime_error("cannot query the host page size");
+        return static_cast<std::size_t>(value);
+#endif
+    }();
+    return size;
+}
+
+bool CopyGuestBytes(void* destination, const void* source, std::size_t bytes) {
+    GuestArena::GuestArenaPrepareHostRead_nid_no_patch(source, bytes);
+#ifdef _WIN32
+    SIZE_T copied = 0;
+    return ReadProcessMemory(GetCurrentProcess(), source, destination, bytes, &copied) != 0 && copied == bytes;
+#elif defined(__linux__)
+    iovec local{destination, bytes};
+    iovec remote{const_cast<void*>(source), bytes};
+    const auto copied = process_vm_readv(getpid(), &local, 1, &remote, 1, 0);
+    if (copied < 0 && errno != EFAULT) throw std::runtime_error("guest path: process_vm_readv failed with errno " + std::to_string(errno));
+    return copied >= 0 && static_cast<std::size_t>(copied) == bytes;
+#elif defined(__APPLE__)
+    mach_vm_size_t copied = 0;
+    return mach_vm_read_overwrite(mach_task_self(), reinterpret_cast<mach_vm_address_t>(source), bytes,
+               reinterpret_cast<mach_vm_address_t>(destination), &copied) == KERN_SUCCESS && copied == bytes;
+#else
+    throw std::runtime_error("checked guest path copies are not implemented on this host");
+#endif
+}
+
 std::string TrimSlashes(const char* path) {
     std::string s(path);
     std::size_t start = 0;
@@ -255,13 +308,11 @@ std::optional<std::filesystem::path> ResolveAlias(const std::string& guestPath,
             const auto result = std::filesystem::path(host).make_preferred();
             return module ? PathOrRelinkedModule(result) : result;
         }
-#ifndef _WIN32
         if (guestPath.back() == '/') {
-            auto result = ResolveHostPath(host, SplitNames(std::string_view(relative).substr(prefix.size() + 1)));
+            auto result = ResolveHostPath(host, SplitNames(std::string_view(relative).substr(prefix.size() + 1))).make_preferred();
             result /= "";
             return module ? PathOrRelinkedModule(result) : result;
         }
-#endif
         return ResolveHostPath(host, SplitNames(std::string_view(relative).substr(prefix.size() + 1)), module).make_preferred();
     }
     return std::nullopt;
@@ -318,6 +369,14 @@ void RequireHostDirectory(WorkingDirectory& state, const std::vector<std::string
 #endif
     throw std::filesystem::filesystem_error("Guest path component is not a directory", host, error);
 }
+void RejectNonDirectory(const std::filesystem::path& host) {
+    auto target = host;
+    while (!target.has_filename() && target.has_relative_path()) target = target.parent_path();
+    std::error_code error;
+    const auto status = std::filesystem::status(target, error);
+    if (std::filesystem::exists(status) && !std::filesystem::is_directory(status))
+        throw std::filesystem::filesystem_error("Guest path with a trailing slash is not a directory", host, std::make_error_code(std::errc::not_a_directory));
+}
 std::vector<std::string> WithTrailingSeparator(std::vector<std::string> names, bool trailing) {
     if (trailing && !names.empty()) names.emplace_back();
     return names;
@@ -360,7 +419,10 @@ std::filesystem::path Resolve(WorkingDirectory& state, const char* path, bool mo
         if (!trailing) names.push_back(name);
     }
     if (endsWithDot && !names.empty() && !(archived && AppArchiveHasDirectory_nid_no_patch(HostPath(state, names)))) RequireHostDirectory(state, names);
-    return HostPath(state, WithTrailingSeparator(std::move(names), trailing), module);
+    const bool directory = trailing && !names.empty();
+    auto resolved = HostPath(state, WithTrailingSeparator(std::move(names), trailing), module);
+    if (directory) RejectNonDirectory(resolved);
+    return resolved;
 }
 #ifdef _WIN32
 using WriteMark = FILETIME;
@@ -376,7 +438,11 @@ bool NotBefore(const WriteMark& time, const WriteMark& mark) {
 using WriteMark = timespec;
 WriteMark Now() {
     timespec now;
+#ifdef __APPLE__
+    clock_gettime(CLOCK_REALTIME, &now);
+#else
     clock_gettime(CLOCK_REALTIME_COARSE, &now);
+#endif
     return now;
 }
 bool NotBefore(const WriteMark& time, const WriteMark& mark) {
@@ -415,7 +481,11 @@ void FlushPath(const std::filesystem::path& path) {
 #else
 std::optional<WriteMark> WriteTime(const std::filesystem::path& path) {
     struct stat data;
+#ifdef __APPLE__
+    if (::stat(path.c_str(), &data) == 0) return data.st_mtimespec;
+#else
     if (::stat(path.c_str(), &data) == 0) return data.st_mtim;
+#endif
     if (errno == ENOENT || errno == ENOTDIR) return std::nullopt;
     throw std::system_error(errno, std::generic_category(), "Reading the write time of " + path.string());
 }
@@ -471,6 +541,39 @@ int SetWorkingDirectory(WorkingDirectory& state, const std::filesystem::path& re
 }
 }
 
+extern "C" int CopyGuestString_nid_no_patch(const char* source, std::size_t maximum, std::string& destination) {
+    if (source == nullptr) return 14;
+    const auto address = reinterpret_cast<std::uintptr_t>(source);
+    std::vector<char> bytes;
+    try {
+        bytes.resize(maximum);
+    } catch (const std::bad_alloc&) {
+        return 12;
+    }
+    std::size_t offset = 0;
+    while (offset < bytes.size()) {
+        if (address > std::numeric_limits<std::uintptr_t>::max() - offset) return 14;
+        const auto current = address + offset;
+        const auto pageRemaining = HostPageSize() - current % HostPageSize();
+        const auto count = std::min(pageRemaining, bytes.size() - offset);
+        if (!CopyGuestBytes(bytes.data() + offset, reinterpret_cast<const void*>(current), count)) return 14;
+        if (const auto* end = static_cast<const char*>(std::memchr(bytes.data() + offset, 0, count))) {
+            try {
+                destination.assign(bytes.data(), static_cast<std::size_t>(end - bytes.data()));
+            } catch (const std::bad_alloc&) {
+                return 12;
+            }
+            return 0;
+        }
+        offset += count;
+    }
+    return 63;
+}
+
+extern "C" int CopyGuestPath_nid_no_patch(const char* source, std::string& destination) {
+    return CopyGuestString_nid_no_patch(source, 1024, destination);
+}
+
 #ifndef _WIN32
 namespace {
 std::mutex g_hostStandardErrorMutex;
@@ -557,6 +660,36 @@ extern "C" std::FILE* HostStandardErrorFile_nid_no_patch() {
     if (std::FILE* kept = g_hostStandardErrorFile.load(std::memory_order_acquire)) return kept;
     return __acrt_iob_func(2);
 }
+
+namespace {
+std::mutex g_hostStandardStreamMutex;
+
+int keepHostStandardStream(int standard) {
+    auto& slot = standard == 1 ? g_hostStandardOutputFile : g_hostStandardErrorFile;
+    if (auto* stream = slot.load(std::memory_order_acquire)) return ::_fileno(stream);
+    const std::unique_ptr<std::FILE, decltype(&::_unlock_file)> unlock(__acrt_iob_func(standard), ::_unlock_file);
+    ::_lock_file(unlock.get());
+    const std::lock_guard lock(g_hostStandardStreamMutex);
+    if (auto* stream = slot.load(std::memory_order_acquire)) return ::_fileno(stream);
+    const int saved = DuplicateHostDescriptor_nid_no_patch(standard);
+    if (saved < 0) return -1;
+    if (!AdoptHostStandardStream_nid_no_patch(standard, saved)) {
+        const int error = errno;
+        ::_close(saved);
+        errno = error;
+        return -1;
+    }
+    return saved;
+}
+}
+
+extern "C" int KeepHostStandardError_nid_no_patch() {
+    return keepHostStandardStream(2);
+}
+
+extern "C" int KeepHostStandardOutput_nid_no_patch() {
+    return keepHostStandardStream(1);
+}
 #endif
 
 extern "C" void AddPathAlias_nid_no_patch(const char* guestPrefix, const char* hostPath) {
@@ -679,6 +812,39 @@ extern "C" std::filesystem::path ResolveArchivedPath_nid_no_patch(const char* pa
     return ResolveLocked(path, module, true);
 }
 
+extern "C" bool GuestCopyOut_nid_no_patch(void* destination, const void* source, std::size_t bytes) {
+    if (bytes == 0) return true;
+    const auto start = reinterpret_cast<std::uintptr_t>(destination);
+    if (start == 0 || bytes > UINTPTR_MAX - start) return false;
+    const GuestArena::HostWrite guard(destination, bytes);
+    if (!guard.Open()) return false;
+#ifdef _WIN32
+    for (auto address = start; address < start + bytes;) {
+        MEMORY_BASIC_INFORMATION memory{};
+        if (VirtualQuery(reinterpret_cast<LPCVOID>(address), &memory, sizeof(memory)) != sizeof(memory) || memory.State != MEM_COMMIT ||
+            (memory.Protect & PAGE_GUARD) != 0 ||
+            (memory.Protect & (PAGE_READWRITE | PAGE_WRITECOPY | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY)) == 0) return false;
+        address = reinterpret_cast<std::uintptr_t>(memory.BaseAddress) + memory.RegionSize;
+    }
+    std::memcpy(destination, source, bytes);
+    return true;
+#elif defined(__linux__)
+    iovec local{const_cast<void*>(source), bytes};
+    iovec remote{destination, bytes};
+    const ssize_t copied = ::process_vm_writev(::getpid(), &local, 1, &remote, 1, 0);
+    if (copied < 0) {
+        if (errno == EFAULT) return false;
+        throw std::runtime_error("GuestCopyOut: process_vm_writev failed with errno " + std::to_string(errno));
+    }
+    return static_cast<std::size_t>(copied) == bytes;
+#elif defined(__APPLE__)
+    return ::mach_vm_write(::mach_task_self(), reinterpret_cast<mach_vm_address_t>(destination),
+        reinterpret_cast<vm_offset_t>(source), static_cast<mach_msg_type_number_t>(bytes)) == KERN_SUCCESS;
+#else
+    throw std::runtime_error("GuestCopyOut: no checked write is available on this host");
+#endif
+}
+
 extern "C" std::filesystem::path ResolvePath_nid_no_patch(const char* path) {
     auto resolved = ResolveLocked(path, false, true);
     AppArchiveRefuseOnly_nid_no_patch(resolved, path, "reading");
@@ -695,9 +861,15 @@ extern "C" std::filesystem::path RelinkedModulePath_nid_no_patch(const std::file
     const auto relinked = RelinkedModuleName(path);
     std::error_code error;
     if (std::filesystem::is_regular_file(relinked, error)) return relinked;
+    const auto parent = relinked.parent_path().empty() ? std::filesystem::path(".") : relinked.parent_path();
     NameMatch names[] = {{relinked.filename().string()}, {path.filename().string(), std::nullopt, false, true}};
-    MatchNames(relinked.parent_path().empty() ? "." : relinked.parent_path(), names);
+    MatchNames(parent, names);
     if (names[0].ambiguous || names[0].path) return MatchedModuleOrPath(path, relinked, names[0]);
+    for (const char* directory : {"prx", "sce_module", "sce_modules"}) {
+        NameMatch nested[] = {{relinked.filename().string()}};
+        MatchNames(parent / directory, nested);
+        if (nested[0].ambiguous || nested[0].path) return MatchedModuleOrPath(path, relinked, nested[0]);
+    }
     return names[1].path ? *names[1].path : path;
 }
 
diff --git a/core/libs/prx/libc/src/GuestArena.cpp b/core/libs/prx/libc/src/GuestArena.cpp
index 20cdbc1820..65f574aded 100644
--- a/core/libs/prx/libc/src/GuestArena.cpp
+++ b/core/libs/prx/libc/src/GuestArena.cpp
@@ -46,7 +46,12 @@ void noteAccess(const void* pointer, std::size_t bytes) {
 }
 
 constexpr std::uintptr_t GuestArenaOffset = GuestArena::GuestAddressOffset;
-constexpr std::uintptr_t ArenaStart = 0x0000000200000000ull + GuestArenaOffset;
+constexpr std::uintptr_t DefaultAllocationStart = 0x0000000200000000ull + GuestArenaOffset;
+#ifdef __APPLE__
+constexpr std::uintptr_t ArenaStart = DefaultAllocationStart;
+#else
+constexpr std::uintptr_t ArenaStart = GuestArenaOffset == 0 ? 0x10000ull : DefaultAllocationStart;
+#endif
 constexpr std::uintptr_t SystemReservedStart = 0x00000007FFFFC000ull + GuestArenaOffset;
 constexpr std::uintptr_t SystemReservedEnd = 0x0000001000000000ull + GuestArenaOffset;
 constexpr std::uintptr_t ApplicationAreaEnd = 0x000000FC00000000ull + GuestArenaOffset;
@@ -86,7 +91,7 @@ public:
         RequireAllocatable(alignment);
         std::lock_guard lock(_lock);
         auto candidate = hint < _end ? FindAtOrAbove(hint, bytes, alignment) : 0;
-        if (candidate == 0 && hint > _base) candidate = FindAtOrAbove(_base, bytes, alignment);
+        if (candidate == 0 && hint > _base) candidate = FindAtOrAbove(hint < DefaultAllocationStart ? _base : DefaultAllocationStart, bytes, alignment);
         return Claim(candidate, bytes);
     }
 
@@ -273,6 +278,10 @@ private:
             const int failed = ReserveNoReplace(cursor, end - cursor);
             if (failed == 0) continue;
             if (failed != EEXIST) {
+                if (cursor < DefaultAllocationStart && (failed == EACCES || failed == EPERM)) {
+                    occupied.emplace_back(cursor, end);
+                    continue;
+                }
                 char message[128];
                 std::snprintf(message, sizeof(message), "guest arena: cannot reserve 0x%llx+0x%llx",
                     static_cast<unsigned long long>(cursor), static_cast<unsigned long long>(end - cursor));
@@ -309,7 +318,7 @@ private:
     }
 
     std::uintptr_t FindAtOrAbove(std::uintptr_t hint, std::size_t bytes, std::size_t alignment) const {
-        std::uintptr_t candidate = alignUp(std::max(_base, hint), alignment);
+        std::uintptr_t candidate = alignUp(hint == 0 ? DefaultAllocationStart : std::max(_base, hint), alignment);
         auto it = _used.upper_bound(candidate);
         if (it != _used.begin() && std::prev(it)->second > candidate) --it;
         for (; it != _used.end(); ++it) {
@@ -510,6 +519,22 @@ bool GuestArenaResidentSpan_nid_postfix(std::uintptr_t address, std::size_t byte
     return WindowsMappings::Get().ResidentSpan(address, bytes, start, end);
 }
 
+void GuestArenaCompareWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes) {
+    WindowsMappings::Get().CompareWhenShared(address, bytes);
+}
+
+void GuestArenaCompareResidentWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes) {
+    WindowsMappings::Get().CompareWhenShared(address, bytes, true);
+}
+
+void GuestArenaComparedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count) {
+    WindowsMappings::Get().ComparedPages(address, bytes, pages, count, false);
+}
+
+void GuestArenaTakeUnreportedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count) {
+    WindowsMappings::Get().ComparedPages(address, bytes, pages, count, true);
+}
+
 void GuestArenaForgetSection_nid_postfix(void* section) {
     WindowsMappings::Get().ForgetSection(section);
 }
diff --git a/core/libs/prx/libc/src/GuestHeap.cpp b/core/libs/prx/libc/src/GuestHeap.cpp
index 96c95d1063..6277174a21 100644
--- a/core/libs/prx/libc/src/GuestHeap.cpp
+++ b/core/libs/prx/libc/src/GuestHeap.cpp
@@ -280,6 +280,12 @@ void* allocate(GuestAllocations::Mutation& mutation, std::size_t alignment, std:
     return pointer;
 }
 
+void* emptyInPlace(GuestAllocations::Mutation& mutation, void* pointer, bool gpu) {
+    mutation.Remove(pointer);
+    mutation.Add(pointer, 0, true, true, gpu);
+    return pointer;
+}
+
 void free(GuestAllocations::Mutation& mutation, void* pointer) {
     mutation.Remove(pointer);
     const auto blockBytes = reinterpret_cast<std::size_t*>(pointer)[-1];
@@ -307,10 +313,7 @@ void* GuestHeapReallocate_nid_postfix(void* pointer, std::size_t bytes) {
     GuestAllocations::Mutation mutation;
     const auto range = mutation.Find(pointer);
     mutation.RequireUnpinned(pointer, range.bytes);
-    if (bytes == 0) {
-        free(mutation, pointer);
-        return nullptr;
-    }
+    if (bytes == 0) return emptyInPlace(mutation, pointer, range.gpu);
     void* result = allocate(mutation, MinimumAlignment, bytes, range.gpu);
     std::memcpy(result, pointer, std::min(bytes, range.bytes));
     free(mutation, pointer);
@@ -323,8 +326,10 @@ void* GuestHeapRealign_nid_postfix(void* pointer, std::size_t bytes, std::size_t
     const auto range = mutation.Find(pointer);
     mutation.RequireUnpinned(pointer, range.bytes);
     if (bytes == 0) {
-        free(mutation, pointer);
-        return nullptr;
+        if (alignment == 0 || (alignment & (alignment - 1)) != 0) throw std::invalid_argument("invalid guest heap alignment");
+        if (reinterpret_cast<std::uintptr_t>(pointer) % alignment != 0)
+            throw std::invalid_argument("reallocalign to 0 bytes with an alignment the block does not have is not measured on the console");
+        return emptyInPlace(mutation, pointer, range.gpu);
     }
     void* result = allocate(mutation, alignment, bytes, range.gpu);
     std::memcpy(result, pointer, std::min(bytes, range.bytes));
diff --git a/core/libs/prx/libc/src/HeapDiagnostics.cpp b/core/libs/prx/libc/src/HeapDiagnostics.cpp
index 04324b8d39..15f420f9c7 100644
--- a/core/libs/prx/libc/src/HeapDiagnostics.cpp
+++ b/core/libs/prx/libc/src/HeapDiagnostics.cpp
@@ -1,11 +1,26 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/HeapDiagnostics.hpp"
 #include <array>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
+#include <cstring>
 #include <stdexcept>
 
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/syscall.h>
+#include <unistd.h>
+#endif
+
+extern "C" std::FILE* GuestStandardOutputFile_nid_no_patch();
+
 namespace {
 
 std::uint64_t mspaceAtomicIdMask = 0;
@@ -19,6 +34,26 @@ static_assert(sizeof(LibcHeapInfo) == 32);
 static_assert(offsetof(LibcHeapInfo, mspace_atomic_id_mask) == 16);
 static_assert(offsetof(LibcHeapInfo, mstate_table) == 24);
 
+constexpr std::size_t MspaceNameOffset = 0x3B0;
+constexpr std::size_t MspaceNumberOffset = 0x3F4;
+constexpr std::uint32_t SegmentOutOfRange = 1;
+
+unsigned long CurrentProcessId() {
+#ifdef _WIN32
+    return GetCurrentProcessId();
+#else
+    return static_cast<unsigned long>(::getpid());
+#endif
+}
+
+unsigned long CurrentThreadId() {
+#ifdef _WIN32
+    return GetCurrentThreadId();
+#else
+    return static_cast<unsigned long>(::syscall(SYS_gettid));
+#endif
+}
+
 }
 
 extern "C" {
@@ -39,6 +74,19 @@ void APS5_VABI sceLibcInternalBacktraceForGame_nid_postfix(const char* heapName)
 }
 
 void APS5_VABI sceLibcInternalHeapErrorReportForGame_nid_postfix(void* heap, void* block, std::uint32_t error) {
+    if (heap == nullptr) throw std::invalid_argument("sceLibcInternalHeapErrorReportForGame: null heap");
+    const auto* state = static_cast<const char*>(heap);
+    std::uint32_t number = 0;
+    std::memcpy(&number, state + MspaceNumberOffset, sizeof(number));
+    if (_Stdout_nid_postfix.IsOpen()) {
+        std::FILE* output = GuestStandardOutputFile_nid_no_patch();
+        std::fprintf(output, "[SceLibc] A heap error is detected.\n[SceLibc] -- Mspace Name --\n[SceLibc] %s", state + MspaceNameOffset);
+        if (number != 0) std::fprintf(output, " (%2u)", number);
+        std::fputc('\n', output);
+        if (error == SegmentOutOfRange) std::fprintf(output, "[SceLibc] -- Error reason --\n[SceLibc] segment out of range.\n");
+        std::fprintf(output, "[SceLibc] pid:<0x%lx> tid:<0x%lx>\n", CurrentProcessId(), CurrentThreadId());
+        std::fflush(output);
+    }
     std::fprintf(stderr, "[libc] heap error 0x%x: heap %p, block %p, reported from guest 0x%llx\n", error, heap, block,
         static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(__builtin_return_address(0))));
 }
diff --git a/core/libs/prx/libc/src/Hostname.cpp b/core/libs/prx/libc/src/Hostname.cpp
index 7b205e3659..b2e7999984 100644
--- a/core/libs/prx/libc/src/Hostname.cpp
+++ b/core/libs/prx/libc/src/Hostname.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <cerrno>
@@ -5,7 +6,7 @@
 #include <cstring>
 
 extern "C" int APS5_VABI gethostname_nid_postfix(char* name, std::size_t length) {
-    constexpr char hostname[] = "AnyPS5";
+    constexpr char hostname[] = "";
     if (name == nullptr) return 0;
     const int savedError = errno;
     const auto count = std::min(length, sizeof(hostname));
diff --git a/core/libs/prx/libc/src/IntegerBuiltins.cpp b/core/libs/prx/libc/src/IntegerBuiltins.cpp
index 2df42c3913..44a6e6df13 100644
--- a/core/libs/prx/libc/src/IntegerBuiltins.cpp
+++ b/core/libs/prx/libc/src/IntegerBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cstdint>
 #include <stdexcept>
@@ -8,9 +9,6 @@
 
 namespace {
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
 constexpr Uint128 Int128SignBit = static_cast<Uint128>(1) << 127;
 constexpr Int128 Int128Max = static_cast<Int128>(~Int128SignBit);
 constexpr Int128 Int128Min = static_cast<Int128>(Int128SignBit);
diff --git a/core/libs/prx/libc/src/Interfaces.cpp b/core/libs/prx/libc/src/Interfaces.cpp
index 8e39cfa29b..f9ec682ec7 100644
--- a/core/libs/prx/libc/src/Interfaces.cpp
+++ b/core/libs/prx/libc/src/Interfaces.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -5,11 +6,13 @@
 #include <iphlpapi.h>
 #else
 #include <ifaddrs.h>
-#include <linux/if_link.h>
 #include <net/if.h>
-#include <net/if_arp.h>
 #include <netinet/in.h>
+#ifdef __linux__
+#include <linux/if_link.h>
+#include <net/if_arp.h>
 #include <netpacket/packet.h>
+#endif
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <unistd.h>
@@ -29,17 +32,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
-struct GuestInterfaceAddress {
-    GuestInterfaceAddress* next;
-    char* name;
-    std::uint32_t flags;
-    void* address;
-    void* netmask;
-    void* destination;
-    void* data;
-};
 static_assert(sizeof(GuestInterfaceAddress) == 56);
 static_assert(offsetof(GuestInterfaceAddress, flags) == 16);
 static_assert(offsetof(GuestInterfaceAddress, address) == 24);
@@ -88,6 +80,22 @@ std::vector<std::uint8_t> GuestAddress(const sockaddr* address) {
     return GuestIpv6(reinterpret_cast<const std::uint8_t*>(&v6->sin6_addr), v6->sin6_scope_id);
 }
 
+#ifndef _WIN32
+std::vector<std::uint8_t> GuestNetmask(const sockaddr* netmask, int family) {
+    sockaddr_storage mask{};
+    const std::size_t size = family == AF_INET ? sizeof(sockaddr_in) : sizeof(sockaddr_in6);
+#ifdef __APPLE__
+    const std::size_t length = std::min<std::size_t>(netmask->sa_len, size);
+#else
+    const std::size_t length = size;
+#endif
+    if (length > offsetof(sockaddr, sa_data))
+        std::memcpy(reinterpret_cast<char*>(&mask) + offsetof(sockaddr, sa_data), netmask->sa_data, length - offsetof(sockaddr, sa_data));
+    mask.ss_family = static_cast<sa_family_t>(family);
+    return GuestAddress(reinterpret_cast<const sockaddr*>(&mask));
+}
+#endif
+
 std::string CheckedName(const char* name) {
     const std::string checked(name);
     if (checked.empty() || checked.size() >= guestNameCapacity)
@@ -160,6 +168,7 @@ int HostEntries(std::vector<Entry>& entries) {
     return 0;
 }
 #else
+#ifdef __linux__
 constexpr std::uint8_t guestLinkFamily = 18;
 constexpr std::size_t guestLinkNameArea = 8 + 16;
 constexpr std::size_t guestLinkMinimum = 54;
@@ -171,6 +180,7 @@ constexpr std::uint8_t guestLinkStateDown = 1;
 constexpr std::uint8_t guestLinkStateUp = 2;
 constexpr std::size_t guestInterfaceDataSize = 152;
 constexpr unsigned int hostLowerUp = 0x10000;
+#endif
 
 struct HostInterface {
     std::string name;
@@ -179,6 +189,7 @@ struct HostInterface {
     std::vector<Entry> addresses;
 };
 
+#ifdef __linux__
 template<typename TValue>
 void Store(std::vector<std::uint8_t>& bytes, std::size_t offset, TValue value) {
     std::memcpy(bytes.data() + offset, &value, sizeof(value));
@@ -253,6 +264,7 @@ std::vector<std::uint8_t> GuestInterfaceData(const std::string& name, unsigned i
     }
     return data;
 }
+#endif
 
 std::uint32_t InterfaceFlags(unsigned int host) {
     constexpr std::pair<unsigned int, std::uint32_t> flags[] = {
@@ -288,6 +300,7 @@ int HostEntries(std::vector<Entry>& entries) {
     try {
         for (auto* item = host; item; item = item->ifa_next) {
             if (!item->ifa_addr) continue;
+#ifdef __linux__
             if (item->ifa_addr->sa_family == AF_PACKET) {
                 const auto& link = *reinterpret_cast<const sockaddr_ll*>(item->ifa_addr);
                 HostInterface& owner = interfaceFor(CheckedName(item->ifa_name));
@@ -302,9 +315,10 @@ int HostEntries(std::vector<Entry>& entries) {
                 owner.linked = true;
                 continue;
             }
+#endif
             if (item->ifa_addr->sa_family != AF_INET && item->ifa_addr->sa_family != AF_INET6) continue;
             if (!item->ifa_netmask) throw std::runtime_error(std::string("getifaddrs: host address without a netmask on ") + item->ifa_name);
-            Entry entry{CheckedName(item->ifa_name), InterfaceFlags(item->ifa_flags), GuestAddress(item->ifa_addr), GuestAddress(item->ifa_netmask), {}};
+            Entry entry{CheckedName(item->ifa_name), InterfaceFlags(item->ifa_flags), GuestAddress(item->ifa_addr), GuestNetmask(item->ifa_netmask, item->ifa_addr->sa_family), {}};
             const int family = item->ifa_addr->sa_family;
             if (item->ifa_flags & IFF_POINTOPOINT) {
                 if (item->ifa_dstaddr && item->ifa_dstaddr->sa_family == family) entry.destination = GuestAddress(item->ifa_dstaddr);
diff --git a/core/libs/prx/libc/src/JumpBuffer.cpp b/core/libs/prx/libc/src/JumpBuffer.cpp
index 77dca484e4..17c34cf9d0 100644
--- a/core/libs/prx/libc/src/JumpBuffer.cpp
+++ b/core/libs/prx/libc/src/JumpBuffer.cpp
@@ -1,12 +1,62 @@
+#include "prx/libc/include/JumpBuffer.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+namespace JumpBuffer {
+namespace {
+
+constexpr std::size_t MaskOffset = 72;
+constexpr std::size_t MaskSavedOffset = 88;
+constexpr int SigBlock = 1;
+constexpr int SigSetmask = 3;
+
+std::atomic<Sigprocmask> guestSigprocmask{nullptr};
+
+}
+
+extern "C" {
+
+void GuestSigprocmaskRegister_nid_no_patch(Sigprocmask sigprocmask) {
+    guestSigprocmask.store(sigprocmask);
+}
+
+void APS5_VABI JumpBufferSaveMask_nid_no_patch(unsigned char* buffer) {
+    const auto sigprocmask = guestSigprocmask.load();
+    const std::int32_t saved = sigprocmask != nullptr && sigprocmask(SigBlock, nullptr, buffer + MaskOffset) == 0;
+    std::memcpy(buffer + MaskSavedOffset, &saved, sizeof(saved));
+}
+
+void APS5_VABI JumpBufferRestoreMask_nid_no_patch(const unsigned char* buffer) {
+    std::int32_t saved = 0;
+    std::memcpy(&saved, buffer + MaskSavedOffset, sizeof(saved));
+    const auto sigprocmask = guestSigprocmask.load();
+    if (saved != 0 && sigprocmask != nullptr) sigprocmask(SigSetmask, buffer + MaskOffset, nullptr);
+}
+
+}
+
+}
 
 // setjmp/longjmp must capture the guest's own frame, so they are written directly in assembly with
 // the guest (System V) calling convention. The saved state fits the guest's 96-byte jmp_buf:
-// return address, rbx, rsp, rbp, r12-r15, MXCSR and the x87 control word.
+// return address, rbx, rsp, rbp, r12-r15, MXCSR, the x87 control word and, as FreeBSD's do, the
+// signal mask at 72 with the flag sigsetjmp keeps at 88, once libkernel has registered sigprocmask.
+
+#if defined(_WIN32) || defined(__APPLE__)
+#define APS5_JUMP_ASM_CALL(name) "    call " APS5_ASM_SYMBOL(name) "\n"
+#else
+#define APS5_JUMP_ASM_CALL(name) "    call " name "@PLT\n"
+#endif
 
 asm(".text\n"
     APS5_ASM_FUNCTION("setjmp_nid_postfix")
+    "    push %rdi\n"
+    APS5_JUMP_ASM_CALL("JumpBufferSaveMask_nid_no_patch")
+    "    pop %rdi\n"
     "    mov (%rsp), %rax\n"
     "    mov %rax, 0(%rdi)\n"
     "    mov %rbx, 8(%rdi)\n"
@@ -22,15 +72,16 @@ asm(".text\n"
     "    xor %eax, %eax\n"
     "    ret\n"
     APS5_ASM_FUNCTION("longjmp_nid_postfix")
-#ifdef _WIN32
     "    mov %rdi, %rbx\n"
     "    mov %esi, %r12d\n"
-    "    mov 16(%rdi), %rdi\n"
     "    and $-16, %rsp\n"
+    APS5_JUMP_ASM_CALL("JumpBufferRestoreMask_nid_no_patch")
+#ifdef _WIN32
+    "    mov 16(%rbx), %rdi\n"
     "    call GuestStackSwitch_nid_no_patch\n"
+#endif
     "    mov %rbx, %rdi\n"
     "    mov %r12d, %esi\n"
-#endif
     "    mov %esi, %eax\n"
     "    test %eax, %eax\n"
     "    jnz 1f\n"
diff --git a/core/libs/prx/libc/src/LocaleSupport.cpp b/core/libs/prx/libc/src/LocaleSupport.cpp
index fb1f8042ab..075be23d4b 100644
--- a/core/libs/prx/libc/src/LocaleSupport.cpp
+++ b/core/libs/prx/libc/src/LocaleSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <climits>
 #include <clocale>
 #include <cstddef>
@@ -24,11 +25,6 @@
 #include "prx/libc/include/GuestLocale.hpp"
 #include "SceTypes.hpp"
 
-extern "C" {
-void* APS5_VABI _Znwm_nid_postfix(std::size_t size);
-void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
-}
-
 namespace {
 
 std::mutex g_localeInitMutex;
@@ -110,6 +106,7 @@ void APS5_VABI DestroyCollate(GuestLocale::Facet*) {}
 void APS5_VABI DeleteCollate(GuestLocale::Facet* self) {
     if (self == nullptr) throw std::invalid_argument("collate delete: null facet");
     _ZdlPv_nid_postfix(self);
+
 }
 
 void APS5_VABI RetainFacet(GuestLocale::Facet* self) {
@@ -220,6 +217,83 @@ std::int64_t APS5_VABI WideCollateHash(const GuestLocale::CollateFacet*, const c
 
 const GuestLocale::CollateVtable g_wideCollateVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, WideCollateCompare, WideCollateTransform, WideCollateHash};
 
+bool APS5_VABI CodecvtAlwaysNoconv(const GuestLocale::Facet*) {
+    return true;
+}
+
+int APS5_VABI CodecvtConstantOne(const GuestLocale::Facet*) {
+    return 1;
+}
+
+int APS5_VABI CodecvtNoConversion(GuestLocale::Facet*, std::uint64_t*, const char* first1, const char*, const char** next1, char* first3, char*, char** next3) {
+    *next1 = first1;
+    *next3 = first3;
+    return 3;
+}
+
+int APS5_VABI CodecvtUnshift(GuestLocale::Facet*, std::uint64_t*, char* first3, char*, char** next3) {
+    *next3 = first3;
+    return 0;
+}
+
+std::size_t APS5_VABI CodecvtLength(GuestLocale::Facet*, std::uint64_t*, const char* first1, const char* last1, std::size_t count) {
+    return std::min(static_cast<std::size_t>(last1 - first1), count);
+}
+
+const GuestLocale::CodecvtVtable g_codecvtVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, CodecvtAlwaysNoconv, CodecvtConstantOne, CodecvtConstantOne, CodecvtNoConversion, CodecvtNoConversion, CodecvtUnshift, CodecvtLength};
+
+GuestLocale::String* APS5_VABI AssignCString(GuestLocale::String* result, const char* source) {
+    if (result == nullptr || source == nullptr) throw std::invalid_argument("numpunct string: null argument");
+    const std::size_t length = std::strlen(source);
+    char* data = result->buffer;
+    std::size_t capacity = GuestStringInlineCapacity;
+    if (length > GuestStringInlineCapacity) {
+        capacity = length | GuestStringCapacityMask;
+        data = static_cast<char*>(AllocateStringStorage(capacity + 1));
+    }
+    if (length != 0) std::memcpy(data, source, length);
+    data[length] = 0;
+    if (data != result->buffer) result->pointer = data;
+    result->size = length;
+    result->capacity = capacity;
+    return result;
+}
+
+char APS5_VABI NumpunctDecimalPoint(const GuestLocale::NumpunctFacet* self) {
+    return self->decimalPoint;
+}
+
+char APS5_VABI NumpunctThousandsSep(const GuestLocale::NumpunctFacet* self) {
+    return self->thousandsSep;
+}
+
+GuestLocale::String* APS5_VABI NumpunctGrouping(GuestLocale::String* result, const GuestLocale::NumpunctFacet* self) {
+    return AssignCString(result, self->grouping);
+}
+
+GuestLocale::String* APS5_VABI NumpunctFalsename(GuestLocale::String* result, const GuestLocale::NumpunctFacet* self) {
+    return AssignCString(result, self->falsename);
+}
+
+GuestLocale::String* APS5_VABI NumpunctTruename(GuestLocale::String* result, const GuestLocale::NumpunctFacet* self) {
+    return AssignCString(result, self->truename);
+}
+
+const GuestLocale::NumpunctVtable g_numpunctVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, NumpunctDecimalPoint, NumpunctThousandsSep, NumpunctGrouping, NumpunctFalsename, NumpunctTruename};
+
+void APS5_VABI NumPutMethodUnsupported() {
+    NotImplemented_nid_no_patch("num_put<char>::do_put");
+}
+
+void APS5_VABI TimePutMethodUnsupported() {
+    NotImplemented_nid_no_patch("time_put<char>::do_put");
+}
+
+const GuestLocale::UnsupportedMethodsVtable g_numPutVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, {NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported}};
+const GuestLocale::UnsupportedMethodsVtable g_timePutVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, {TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported}};
+
+constexpr std::size_t GuestTimePutFacetSize = 0xb8;
+
 constexpr std::array<short, 257> MakeClassificationTable() {
     std::array<short, 257> table{};
     for (unsigned int value = 0; value < 256; ++value) {
@@ -227,6 +301,7 @@ constexpr std::array<short, 257> MakeClassificationTable() {
         if (value < 32 || value == 127) mask |= 0x80;
         if (value == ' ') mask |= 0x04;
         if (value >= '\t' && value <= '\r') mask |= 0x40;
+        if (value == '\t') mask |= 0x400;
         if (value >= 'A' && value <= 'Z') mask |= 0x02;
         if (value >= 'a' && value <= 'z') mask |= 0x10;
         if (value >= '0' && value <= '9') mask |= 0x20;
@@ -254,18 +329,18 @@ constexpr auto g_lowerTable = MakeCaseTable(false);
 constexpr auto g_upperTable = MakeCaseTable(true);
 
 void ValidateCharacter(int value) {
-    if (value != EOF && (value < 0 || value > UCHAR_MAX)) throw std::invalid_argument("Invalid character value");
+    if (value < SCHAR_MIN || value > UCHAR_MAX) throw std::invalid_argument("Invalid character value");
 }
 
-int ClassifyCharacter(int value, std::ctype_base::mask mask) {
+int ClassifyCharacter(int value, short mask) {
     ValidateCharacter(value);
     if (value == EOF) return 0;
-    return std::use_facet<std::ctype<char>>(std::locale::classic()).is(mask, static_cast<char>(value));
+    return g_classificationTable[static_cast<std::size_t>(value < 0 ? value + UCHAR_MAX + 1 : value) + 1] & mask;
 }
 
 int ConvertCharacter(int value, bool upper) {
     ValidateCharacter(value);
-    if (value == EOF) return EOF;
+    if (value < 0) return value;
     const auto& facet = std::use_facet<std::ctype<char>>(std::locale::classic());
     const auto character = static_cast<char>(value);
     return static_cast<unsigned char>(upper ? facet.toupper(character) : facet.tolower(character));
@@ -275,18 +350,20 @@ int ConvertCharacter(int value, bool upper) {
 
 extern "C" {
 
-int APS5_VABI isupper_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::upper); }
-int APS5_VABI islower_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::lower); }
-int APS5_VABI isalpha_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::alpha); }
-int APS5_VABI isdigit_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::digit); }
-int APS5_VABI isalnum_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::alnum); }
-int APS5_VABI isspace_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::space); }
-int APS5_VABI isblank_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::blank); }
-int APS5_VABI iscntrl_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::cntrl); }
-int APS5_VABI isprint_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::print); }
-int APS5_VABI isgraph_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::graph); }
-int APS5_VABI ispunct_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::punct); }
-int APS5_VABI isxdigit_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::xdigit); }
+int APS5_VABI isupper_nid_postfix(int c) { return ClassifyCharacter(c, 0x02); }
+int APS5_VABI islower_nid_postfix(int c) { return ClassifyCharacter(c, 0x10); }
+int APS5_VABI isalpha_nid_postfix(int c) { return ClassifyCharacter(c, 0x12); }
+int APS5_VABI isdigit_nid_postfix(int c) { return ClassifyCharacter(c, 0x20); }
+int APS5_VABI isalnum_nid_postfix(int c) { return ClassifyCharacter(c, 0x32); }
+int APS5_VABI isspace_nid_postfix(int c) { return ClassifyCharacter(c, 0x44); }
+int APS5_VABI isblank_nid_postfix(int c) { return ClassifyCharacter(c, 0x404); }
+int APS5_VABI iscntrl_nid_postfix(int c) { return ClassifyCharacter(c, 0x80); }
+int APS5_VABI isprint_nid_postfix(int c) { return ClassifyCharacter(c, 0x3e); }
+int APS5_VABI isgraph_nid_postfix(int c) { return ClassifyCharacter(c, 0x3a); }
+int APS5_VABI ispunct_nid_postfix(int c) { return ClassifyCharacter(c, 0x08); }
+int APS5_VABI isxdigit_nid_postfix(int c) { return ClassifyCharacter(c, 0x01); }
+int APS5_VABI isascii_nid_postfix(int c) { return (c & ~0x7F) == 0; }
+int APS5_VABI toascii_nid_postfix(int c) { return c & 0x7F; }
 int APS5_VABI toupper_nid_postfix(int c) { return ConvertCharacter(c, true); }
 int APS5_VABI tolower_nid_postfix(int c) { return ConvertCharacter(c, false); }
 
@@ -294,13 +371,22 @@ std::uint64_t _ZNSt5ctypeIcE2idE_nid_postfix = 0;
 std::uint64_t _ZNSt5ctypeIwE2idE_nid_postfix = 0;
 std::uint64_t _ZNSt7collateIwE2idE_nid_postfix = 0;
 std::uint64_t _ZNSt7collateIcE2idE_nid_postfix = 0;
+std::uintptr_t _ZTVSt7collateIcE_nid_postfix[9] {};
 std::uint64_t _ZNSt7codecvtIcc9_MbstatetE2idE_nid_postfix = 0;
 std::uintptr_t _ZTVSt7codecvtIcc9_MbstatetE_nid_postfix[16] {};
+std::uintptr_t _ZTVSt7codecvtIwc9_MbstatetE_nid_postfix[13] {};
 std::uint64_t _ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
 std::uintptr_t _ZTVSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[12] {};
 std::uint64_t _ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
 std::uintptr_t _ZTVSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[17] {};
 std::uint64_t _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+std::uint64_t _ZNSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE2idE_nid_postfix = 0;
+std::uintptr_t _ZTVSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[14] {};
+std::uint64_t _ZNSt8numpunctIcE2idE_nid_postfix = 0;
+std::uint64_t _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+std::uintptr_t _ZTVSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[13] {};
+std::uintptr_t _ZTVSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[13] {};
+std::uintptr_t _ZTVSt7num_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[17] {};
 
 std::streamoff _ZSt7_BADOFF_nid_postfix = -1;
 std::fpos_t _ZSt4_Fpz_nid_postfix {};
@@ -326,11 +412,6 @@ GuestLocale::IosBase* APS5_VABI SetStreamWidth(GuestLocale::IosBase* stream, std
     return stream;
 }
 
-struct StreamManipulator {
-    GuestLocale::IosBase* (APS5_VABI* function)(GuestLocale::IosBase*, std::int32_t);
-    std::int32_t argument;
-};
-
 static_assert(sizeof(StreamManipulator) == 0x10);
 
 StreamManipulator APS5_VABI _ZSt4setwi_nid_postfix(std::int32_t width) {
@@ -370,9 +451,7 @@ GuestLocale::Implementation* APS5_VABI _ZNSt6locale16_GetgloballocaleEv_nid_post
 }
 
 namespace {
-struct GuestLocaleFacade {
-    GuestLocale::Implementation* implementation;
-};
+
 GuestLocaleFacade g_classicLocaleFacade{&g_classicLocale};
 }
 
@@ -400,6 +479,43 @@ std::size_t APS5_VABI _ZNSt7collateIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_pos
     return 1;
 }
 
+std::size_t APS5_VABI _ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* object = static_cast<GuestLocale::Facet*>(_Znwm_nid_postfix(sizeof(GuestLocale::Facet)));
+        *object = {&g_codecvtVtable.facet, 0, 0};
+        *facet = object;
+    }
+    return 2;
+}
+
+std::size_t APS5_VABI _ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* punct = static_cast<GuestLocale::NumpunctFacet*>(_Znwm_nid_postfix(sizeof(GuestLocale::NumpunctFacet)));
+        *punct = {{&g_numpunctVtable.facet, 0, 0}, "", '.', ',', "false", "true"};
+        *facet = &punct->base;
+    }
+    return 4;
+}
+
+std::size_t APS5_VABI _ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* object = static_cast<GuestLocale::Facet*>(_Znwm_nid_postfix(sizeof(GuestLocale::Facet)));
+        *object = {&g_numPutVtable.facet, 0, 0};
+        *facet = object;
+    }
+    return 4;
+}
+
+std::size_t APS5_VABI _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* object = static_cast<GuestLocale::Facet*>(_Znwm_nid_postfix(GuestTimePutFacetSize));
+        std::memset(object, 0, GuestTimePutFacetSize);
+        object->vtable = &g_timePutVtable.facet;
+        *facet = object;
+    }
+    return 5;
+}
+
 void APS5_VABI _ZNSt8_LocinfoC1EPKc_nid_postfix(GuestLocale::LocinfoStorage* self, const char* localeName) {
     if (self == nullptr || localeName == nullptr || std::strcmp(localeName, "C") != 0) throw std::invalid_argument("_Locinfo: only the C locale is supported");
     new (self) GuestLocale::LocinfoStorage{};
@@ -467,9 +583,11 @@ std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t c, std::uint64_t de
 std::uint64_t _ZNSt7codecvtIwc9_MbstatetE2idE_nid_postfix = 0;
 alignas(16) unsigned char _ZSt4cout_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt4cerr_nid_postfix[0x400] {};
+alignas(16) unsigned char _ZSt4clog_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt3cin_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt5wcout_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt5wcerr_nid_postfix[0x400] {};
+alignas(16) unsigned char _ZSt5wclog_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt4wcin_nid_postfix[0x400] {};
 
 // Facet vectors are read by inlined guest code, so they come from the guest application heap.
@@ -514,6 +632,7 @@ void APS5_VABI _init_env_nid_postfix() {
 void APS5_VABI init_env_nid_postfix(const InitEnvParams* params) {
     (void)params;
     _init_env_nid_postfix();
+
 }
 
 SonyLconv* APS5_VABI localeconv_nid_postfix(void) {
diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp
index 37616b7be3..d04aed2822 100644
--- a/core/libs/prx/libc/src/Math.cpp
+++ b/core/libs/prx/libc/src/Math.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include <mutex>
+#include <array>
 #include <bit>
 #include <cstddef>
 #include <cstdint>
@@ -67,6 +69,13 @@ float SinhfExpm1(float x) {
     return (oneMinusTwoPowMinusK - (e - x)) * twoPowK;
 }
 
+volatile float AcosfPio2Low = 7.5497894159e-08f;
+
+float AcosfRational(float z) {
+    constexpr float P0 = 1.6666586697e-01f, P1 = -4.2743422091e-02f, P2 = -8.6563630030e-03f, Q1 = -7.0662963390e-01f;
+    return z * (P0 + z * (P1 + z * P2)) / (1.0f + z * Q1);
+}
+
 float SinhfExp(float x) {
     constexpr float Ln2High = 6.9314575195e-01f, Ln2Low = 1.4286067653e-06f, InverseLn2 = 1.4426950216e+00f;
     constexpr float P1 = 1.6666625440e-1f, P2 = -2.7667332906e-3f;
@@ -226,7 +235,6 @@ T GuestFmax(T x, T y) {
 }
 
 float GuestBesselSecondKindZero() {
-    std::feraiseexcept(FE_DIVBYZERO);
     return -std::numeric_limits<float>::infinity();
 }
 
@@ -290,7 +298,12 @@ std::int64_t APS5_VABI imaxabs_nid_postfix(std::int64_t x) {
     return labs_nid_postfix(x);
 }
 
-float APS5_VABI fmodf_nid_postfix(float x, float y) { return std::fmod(x, y); }
+float APS5_VABI fmodf_nid_postfix(float x, float y) {
+    const int saved_errno = errno;
+    const float result = std::fmod(x, y);
+    errno = saved_errno;
+    return result;
+}
 float APS5_VABI asinf_nid_postfix(float x) {
     const int saved_errno = errno;
     const float result = std::asin(x);
@@ -304,10 +317,23 @@ float APS5_VABI acosf_nid_postfix(float x) {
     if (std::fabs(x) > 1.0f) {
         return std::bit_cast<float>(0xffc00000u);
     }
-    const int saved_errno = errno;
-    const float result = std::acos(x);
-    errno = saved_errno;
-    return result;
+    constexpr float Pi = 3.1415925026e+00f, Pio2High = 1.5707962513e+00f;
+    const std::uint32_t magnitude = std::bit_cast<std::uint32_t>(x) & 0x7fffffffu;
+    if (magnitude == 0x3f800000u) return std::signbit(x) ? Pi + 2.0f * AcosfPio2Low : 0.0f;
+    if (magnitude < 0x3f000000u) {
+        if (magnitude <= 0x32800000u) return Pio2High + AcosfPio2Low;
+        return Pio2High - (x - (AcosfPio2Low - x * AcosfRational(x * x)));
+    }
+    if (std::signbit(x)) {
+        const float z = (1.0f + x) * 0.5f;
+        const float s = std::sqrt(z);
+        return Pi - 2.0f * (s + (AcosfRational(z) * s - AcosfPio2Low));
+    }
+    const float z = (1.0f - x) * 0.5f;
+    const float s = std::sqrt(z);
+    const float high = std::bit_cast<float>(std::bit_cast<std::uint32_t>(s) & 0xfffff000u);
+    const float correction = (z - high * high) / (s + high);
+    return 2.0f * (high + (AcosfRational(z) * s + correction));
 }
 float APS5_VABI atan2f_nid_postfix(float y, float x) { return std::atan2(y, x); }
 float APS5_VABI hypotf_nid_postfix(float x, float y) { return static_cast<float>(std::hypot(static_cast<double>(x), static_cast<double>(y))); }
@@ -321,9 +347,51 @@ double APS5_VABI hypot_nid_postfix(double x, double y) {
     }
     return std::hypot(x, y);
 }
-float APS5_VABI tanf_nid_postfix(float x) { return std::tan(x); }
 float APS5_VABI log10f_nid_postfix(float x) { return std::log10(x); }
 float APS5_VABI logbf_nid_postfix(float x) { return std::logb(x); }
+float APS5_VABI exp2f_nid_postfix(float x) {
+    static constexpr double exp2ft[16] = {
+        0x1.6a09e667f3bcdp-1, 0x1.7a11473eb0187p-1, 0x1.8ace5422aa0dbp-1, 0x1.9c49182a3f090p-1,
+        0x1.ae89f995ad3adp-1, 0x1.c199bdd85529cp-1, 0x1.d5818dcfba487p-1, 0x1.ea4afa2a490dap-1,
+        0x1.0000000000000p+0, 0x1.0b5586cf9890fp+0, 0x1.172b83c7d517bp+0, 0x1.2387a6e756238p+0,
+        0x1.306fe0a31b715p+0, 0x1.3dea64c123422p+0, 0x1.4bfdad5362a27p+0, 0x1.5ab07dd485429p+0,
+    };
+    static volatile float huge = 0x1p100f;
+    static volatile float twom100 = 0x1p-100f;
+    const float redux = 0x1.8p23f / 16;
+    const float P1 = 0x1.62e430p-1f;
+    const float P2 = 0x1.ebfbe0p-3f;
+    const float P3 = 0x1.c6b348p-5f;
+    const float P4 = 0x1.3b2c9cp-7f;
+    const std::uint32_t hx = std::bit_cast<std::uint32_t>(x);
+    const std::uint32_t ix = hx & 0x7fffffff;
+    if (ix >= 0x43000000) {
+        if (ix >= 0x7f800000) {
+            return (ix & 0x7fffff) != 0 || (hx & 0x80000000) == 0 ? x + x : 0.0f;
+        }
+        if (x >= 0x1.0p7f) {
+            errno = ERANGE;
+            return huge * huge;
+        }
+        if (x <= -0x1.2cp7f) {
+            errno = ERANGE;
+            return twom100 * twom100;
+        }
+    } else if (ix <= 0x33000000) {
+        return 1.0f + x;
+    }
+    volatile float rounded = x + redux;
+    float t = rounded;
+    std::uint32_t i0 = std::bit_cast<std::uint32_t>(t) + 8;
+    const std::int32_t k = static_cast<std::int32_t>(i0 >> 4) << 20;
+    i0 &= 15;
+    t -= redux;
+    const double z = x - t;
+    const double twopk = std::bit_cast<double>(static_cast<std::uint64_t>(static_cast<std::uint32_t>(0x3ff00000 + k)) << 32);
+    const double u = exp2ft[i0] * z;
+    const double tv = exp2ft[i0] + u * (P1 + z * P2) + u * (z * z) * (P3 + z * P4);
+    return static_cast<float>(tv * twopk);
+}
 double APS5_VABI exp2_nid_postfix(double x) {
     int saved_errno = errno;
     double result = std::exp2(x);
@@ -348,9 +416,9 @@ int APS5_VABI __isfinitef_nid_postfix(float x) { return std::isfinite(x) ? 1 : 0
 int APS5_VABI __isnormal_nid_postfix(double x) { return std::isnormal(x) ? 1 : 0; }
 int APS5_VABI __isnormalf_nid_postfix(float x) { return std::isnormal(x) ? 1 : 0; }
 int APS5_VABI __isinff_nid_postfix(float x) { return std::isinf(x) ? 1 : 0; }
-float APS5_VABI nearbyintf_nid_postfix(float x) { return std::nearbyintf(x); }
+float APS5_VABI nearbyintf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::nearbyintf(x); }
 long double APS5_VABI nearbyintl_nid_postfix(long double x) { return std::nearbyint(x); }
-double APS5_VABI nearbyint_nid_postfix(double x) { return std::nearbyint(x); }
+double APS5_VABI nearbyint_nid_postfix(double x) { return std::isnan(x) ? x + x : std::nearbyint(x); }
 
 double APS5_VABI cbrt_nid_postfix(double x) { return std::cbrt(x); }
 double APS5_VABI asin_nid_postfix(double x) {
@@ -373,12 +441,12 @@ float APS5_VABI copysignf_nid_postfix(float x, float y) {
     return std::copysign(x, y);
 }
 int APS5_VABI abs_nid_postfix(int x) { return x < 0 ? static_cast<int>(0u - static_cast<unsigned>(x)) : x; }
-double APS5_VABI trunc_nid_postfix(double x) { return std::trunc(x); }
-double APS5_VABI ceil_nid_postfix(double x) { return std::ceil(x); }
-double APS5_VABI floor_nid_postfix(double x) { return std::floor(x); }
-float APS5_VABI truncf_nid_postfix(float x) { return std::trunc(x); }
-float APS5_VABI ceilf_nid_postfix(float x) { return std::ceil(x); }
-float APS5_VABI floorf_nid_postfix(float x) { return std::floor(x); }
+double APS5_VABI trunc_nid_postfix(double x) { return std::isnan(x) ? x + x : std::trunc(x); }
+double APS5_VABI ceil_nid_postfix(double x) { return std::isnan(x) ? x + x : std::ceil(x); }
+double APS5_VABI floor_nid_postfix(double x) { return std::isnan(x) ? x + x : std::floor(x); }
+float APS5_VABI truncf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::trunc(x); }
+float APS5_VABI ceilf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::ceil(x); }
+float APS5_VABI floorf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::floor(x); }
 double APS5_VABI fma_nid_postfix(double x, double y, double z) { return std::fma(x, y, z); }
 float APS5_VABI fmaf_nid_postfix(float x, float y, float z) { return std::fma(x, y, z); }
 double APS5_VABI fmin_nid_postfix(double x, double y) { return GuestFmin(x, y); }
@@ -456,9 +524,195 @@ double APS5_VABI atan_nid_postfix(double x) { return std::atan(x); }
 double APS5_VABI tan_nid_postfix(double x) { return std::tan(x); }
 double APS5_VABI log2_nid_postfix(double x) { return std::log2(x); }
 double APS5_VABI log_nid_postfix(double x) { return std::log(x); }
-double APS5_VABI log1p_nid_postfix(double x) { return std::log1p(x); }
+double APS5_VABI log1p_nid_postfix(double x) {
+    const double ln2_hi = 6.93147180369123816490e-01;
+    const double ln2_lo = 1.90821492927058770002e-10;
+    const double two54 = 1.80143985094819840000e+16;
+    const double Lp1 = 6.666666666666735130e-01;
+    const double Lp2 = 3.999999999940941908e-01;
+    const double Lp3 = 2.857142874366239149e-01;
+    const double Lp4 = 2.222219843214978396e-01;
+    const double Lp5 = 1.818357216161805012e-01;
+    const double Lp6 = 1.531383769920937332e-01;
+    const double Lp7 = 1.479819860511658591e-01;
+    static volatile double vzero = 0.0;
+    const std::int32_t hx = static_cast<std::int32_t>(std::bit_cast<std::uint64_t>(x) >> 32);
+    const std::int32_t ax = hx & 0x7fffffff;
+    std::int32_t k = 1;
+    std::int32_t hu = 0;
+    double f = 0.0;
+    double c = 0.0;
+    if (hx < 0x3fda827a) {
+        if (ax >= 0x3ff00000) {
+            if (x == -1.0) {
+                return -two54 / vzero;
+            }
+            errno = EDOM;
+            return (x - x) / (x - x);
+        }
+        if (ax < 0x3e200000) {
+            if (two54 + x > 0.0 && ax < 0x3c900000) {
+                return x;
+            }
+            return x - x * x * 0.5;
+        }
+        if (hx > 0 || hx <= static_cast<std::int32_t>(0xbfd2bec4)) {
+            k = 0;
+            f = x;
+            hu = 1;
+        }
+    }
+    if (hx >= 0x7ff00000) {
+        return x + x;
+    }
+    if (k != 0) {
+        double u;
+        if (hx < 0x43400000) {
+            u = 1.0 + x;
+            hu = static_cast<std::int32_t>(std::bit_cast<std::uint64_t>(u) >> 32);
+            k = (hu >> 20) - 1023;
+            c = k > 0 ? 1.0 - (u - x) : x - (u - 1.0);
+            c /= u;
+        } else {
+            u = x;
+            hu = static_cast<std::int32_t>(std::bit_cast<std::uint64_t>(u) >> 32);
+            k = (hu >> 20) - 1023;
+            c = 0;
+        }
+        hu &= 0x000fffff;
+        const std::uint64_t ulow = std::bit_cast<std::uint64_t>(u) & 0xffffffffull;
+        if (hu < 0x6a09e) {
+            u = std::bit_cast<double>((static_cast<std::uint64_t>(static_cast<std::uint32_t>(hu | 0x3ff00000)) << 32) | ulow);
+        } else {
+            k += 1;
+            u = std::bit_cast<double>((static_cast<std::uint64_t>(static_cast<std::uint32_t>(hu | 0x3fe00000)) << 32) | ulow);
+            hu = (0x00100000 - hu) >> 2;
+        }
+        f = u - 1.0;
+    }
+    const double hfsq = 0.5 * f * f;
+    if (hu == 0) {
+        if (f == 0.0) {
+            if (k == 0) {
+                return 0.0;
+            }
+            c += k * ln2_lo;
+            return k * ln2_hi + c;
+        }
+        const double R = hfsq * (1.0 - 0.66666666666666666 * f);
+        if (k == 0) {
+            return f - R;
+        }
+        return k * ln2_hi - ((R - (k * ln2_lo + c)) - f);
+    }
+    const double s = f / (2.0 + f);
+    const double z = s * s;
+    const double R = z * (Lp1 + z * (Lp2 + z * (Lp3 + z * (Lp4 + z * (Lp5 + z * (Lp6 + z * Lp7))))));
+    if (k == 0) {
+        return f - (hfsq - s * (hfsq + R));
+    }
+    return k * ln2_hi - ((hfsq - (s * (hfsq + R) + (k * ln2_lo + c))) - f);
+}
 float APS5_VABI log1pf_nid_postfix(float x) { return std::log1p(x); }
-double APS5_VABI expm1_nid_postfix(double x) { return std::expm1(x); }
+static double Expm1(double x) {
+    const double tiny = 1.0e-300;
+    const double o_threshold = 7.09782712893383973096e+02;
+    const double ln2_hi = 6.93147180369123816490e-01;
+    const double ln2_lo = 1.90821492927058770002e-10;
+    const double invln2 = 1.44269504088896338700e+00;
+    const double Q1 = -3.33333333333331316428e-02;
+    const double Q2 = 1.58730158725481460165e-03;
+    const double Q3 = -7.93650757867487942473e-05;
+    const double Q4 = 4.00821782732936239552e-06;
+    const double Q5 = -2.01099218183624371326e-07;
+    static volatile double huge = 1.0e+300;
+    const std::uint64_t bits = std::bit_cast<std::uint64_t>(x);
+    std::uint32_t hx = static_cast<std::uint32_t>(bits >> 32);
+    const std::uint32_t xsb = hx & 0x80000000u;
+    hx &= 0x7fffffff;
+    if (hx >= 0x4043687a) {
+        if (hx >= 0x40862e42) {
+            if (hx >= 0x7ff00000) {
+                if (((hx & 0xfffff) | static_cast<std::uint32_t>(bits)) != 0) return x + x;
+                return xsb == 0 ? x : -1.0;
+            }
+            if (x > o_threshold) return huge * huge;
+        }
+        if (xsb != 0 && x + tiny < 0.0) return tiny - 1.0;
+    }
+    double c = 0.0;
+    std::int32_t k;
+    if (hx > 0x3fd62e42) {
+        double hi;
+        double lo;
+        if (hx < 0x3ff0a2b2) {
+            if (xsb == 0) {
+                hi = x - ln2_hi;
+                lo = ln2_lo;
+                k = 1;
+            } else {
+                hi = x + ln2_hi;
+                lo = -ln2_lo;
+                k = -1;
+            }
+        } else {
+            k = static_cast<std::int32_t>(invln2 * x + (xsb == 0 ? 0.5 : -0.5));
+            const double t = k;
+            hi = x - t * ln2_hi;
+            lo = t * ln2_lo;
+        }
+        x = hi - lo;
+        c = (hi - x) - lo;
+    } else if (hx < 0x3c900000) {
+        const double t = huge + x;
+        return x - (t - (huge + x));
+    } else {
+        k = 0;
+    }
+    const double hfx = 0.5 * x;
+    const double hxs = x * hfx;
+    const double r1 = 1.0 + hxs * (Q1 + hxs * (Q2 + hxs * (Q3 + hxs * (Q4 + hxs * Q5))));
+    double t = 3.0 - r1 * hfx;
+    double e = hxs * ((r1 - t) / (6.0 - x * t));
+    if (k == 0) return x - (x * e - hxs);
+    const double twopk = std::bit_cast<double>(static_cast<std::uint64_t>(static_cast<std::uint32_t>(0x3ff + k) << 20) << 32);
+    e = (x * (e - c) - c);
+    e -= hxs;
+    if (k == -1) return 0.5 * (x - e) - 0.5;
+    if (k == 1) {
+        if (x < -0.25) return -2.0 * (e - (x + 0.5));
+        return 1.0 + 2.0 * (x - e);
+    }
+    double y;
+    if (k <= -2 || k > 56) {
+        y = 1.0 - (e - x);
+        if (k == 1024) {
+            y = y * 2.0 * 0x1p1023;
+        } else {
+            y = y * twopk;
+        }
+        return y - 1.0;
+    }
+    if (k < 20) {
+        t = std::bit_cast<double>(static_cast<std::uint64_t>(0x3ff00000u - (0x200000u >> k)) << 32);
+        y = t - (e - x);
+        y = y * twopk;
+    } else {
+        t = std::bit_cast<double>(static_cast<std::uint64_t>(static_cast<std::uint32_t>((0x3ff - k) << 20)) << 32);
+        y = x - (e + t);
+        y += 1.0;
+        y = y * twopk;
+    }
+    return y;
+}
+
+double APS5_VABI expm1_nid_postfix(double x) {
+    const double result = Expm1(x);
+    if (std::isinf(result) && std::isfinite(x)) {
+        errno = ERANGE;
+    }
+    return result;
+}
 float APS5_VABI expm1f_nid_postfix(float x) { return std::expm1(x); }
 float APS5_VABI erff_nid_postfix(float x) { return std::erf(x); }
 double APS5_VABI erf_nid_postfix(double x) { return std::erf(x); }
@@ -475,19 +729,311 @@ double APS5_VABI lgamma_nid_postfix(double x) {
     return std::lgamma(x);
 }
 
-float APS5_VABI sinf_nid_postfix(float x) { return std::sin(x); }
-float APS5_VABI cosf_nid_postfix(float x) { return std::cos(x); }
+static const std::int32_t TrigfIpio2[] = {
+    0xA2F983, 0x6E4E44, 0x1529FC, 0x2757D1, 0xF534DD, 0xC0DB62, 0x95993C, 0x439041, 0xFE5163, 0xABDEBB, 0xC561B7, 0x246E3A,
+    0x424DD2, 0xE00649, 0x2EEA09, 0xD1921C, 0xFE1DEB, 0x1CB129, 0xA73EE8, 0x8235F5, 0x2EBB44, 0x84E99C, 0x7026B4, 0x5F7E41,
+    0x3991D6, 0x398353, 0x39F49C, 0x845F8B, 0xBDF928, 0x3B1FF8, 0x97FFDE, 0x05980F, 0xEF2F11, 0x8B5A0A, 0x6D1F6D, 0x367ECF,
+    0x27CB09, 0xB74F46, 0x3F669E, 0x5FEA2D, 0x7527BA, 0xC7EBE5, 0xF17B3D, 0x0739F7, 0x8A5292, 0xEA6BFB, 0x5FB11F, 0x8D5D08,
+    0x560330, 0x46FC7B, 0x6BABF0, 0xCFBC20, 0x9AF436, 0x1DA9E3, 0x91615E, 0xE61B08, 0x659985, 0x5F14A0, 0x68408D, 0xFFD880,
+    0x4D7327, 0x310606, 0x1556CA, 0x73A8C9, 0x60E27B, 0xC08C6B,
+};
+
+static const double TrigfPio2Parts[] = {
+    1.57079625129699707031e+00, 7.54978941586159635335e-08, 5.39030252995776476554e-15, 3.28200341580791294123e-22,
+    1.27065575308067607349e-29, 1.22933308981111328932e-36, 2.73370053816464559624e-44, 2.16741683877804819444e-51,
+};
+
+static int TrigfKernelRemPio2(const double* x, double* y, int e0) {
+    const double two24 = 1.67772160000000000000e+07, twon24 = 5.96046447753906250000e-08;
+    std::int32_t jz, jv, jp, jk, carry, n, iq[20], i, j, k, m, q0, ih;
+    double z, fw, f[20], fq[20], q[20];
+    const std::int32_t jx = 0;
+    jk = 3;
+    jp = jk;
+    jv = (e0 - 3) / 24;
+    if (jv < 0) jv = 0;
+    q0 = e0 - 24 * (jv + 1);
+    j = jv - jx;
+    m = jx + jk;
+    for (i = 0; i <= m; i++, j++) f[i] = j < 0 ? 0.0 : static_cast<double>(TrigfIpio2[j]);
+    for (i = 0; i <= jk; i++) {
+        for (j = 0, fw = 0.0; j <= jx; j++) fw += x[j] * f[jx + i - j];
+        q[i] = fw;
+    }
+    jz = jk;
+recompute:
+    for (i = 0, j = jz, z = q[jz]; j > 0; i++, j--) {
+        fw = static_cast<double>(static_cast<std::int32_t>(twon24 * z));
+        iq[i] = static_cast<std::int32_t>(z - two24 * fw);
+        z = q[j - 1] + fw;
+    }
+    z = std::scalbn(z, q0);
+    z -= 8.0 * std::floor(z * 0.125);
+    n = static_cast<std::int32_t>(z);
+    z -= static_cast<double>(n);
+    ih = 0;
+    if (q0 > 0) {
+        i = iq[jz - 1] >> (24 - q0);
+        n += i;
+        iq[jz - 1] -= i << (24 - q0);
+        ih = iq[jz - 1] >> (23 - q0);
+    } else if (q0 == 0) {
+        ih = iq[jz - 1] >> 23;
+    } else if (z >= 0.5) {
+        ih = 2;
+    }
+    if (ih > 0) {
+        n += 1;
+        carry = 0;
+        for (i = 0; i < jz; i++) {
+            j = iq[i];
+            if (carry == 0) {
+                if (j != 0) {
+                    carry = 1;
+                    iq[i] = 0x1000000 - j;
+                }
+            } else {
+                iq[i] = 0xffffff - j;
+            }
+        }
+        if (q0 > 0) {
+            switch (q0) {
+                case 1: iq[jz - 1] &= 0x7fffff; break;
+                case 2: iq[jz - 1] &= 0x3fffff; break;
+            }
+        }
+        if (ih == 2) {
+            z = 1.0 - z;
+            if (carry != 0) z -= std::scalbn(1.0, q0);
+        }
+    }
+    if (z == 0.0) {
+        j = 0;
+        for (i = jz - 1; i >= jk; i--) j |= iq[i];
+        if (j == 0) {
+            for (k = 1; iq[jk - k] == 0; k++) {
+            }
+            for (i = jz + 1; i <= jz + k; i++) {
+                f[jx + i] = static_cast<double>(TrigfIpio2[jv + i]);
+                for (j = 0, fw = 0.0; j <= jx; j++) fw += x[j] * f[jx + i - j];
+                q[i] = fw;
+            }
+            jz += k;
+            goto recompute;
+        }
+    }
+    if (z == 0.0) {
+        jz -= 1;
+        q0 -= 24;
+        while (iq[jz] == 0) {
+            jz--;
+            q0 -= 24;
+        }
+    } else {
+        z = std::scalbn(z, -q0);
+        if (z >= two24) {
+            fw = static_cast<double>(static_cast<std::int32_t>(twon24 * z));
+            iq[jz] = static_cast<std::int32_t>(z - two24 * fw);
+            jz += 1;
+            q0 += 24;
+            iq[jz] = static_cast<std::int32_t>(fw);
+        } else {
+            iq[jz] = static_cast<std::int32_t>(z);
+        }
+    }
+    fw = std::scalbn(1.0, q0);
+    for (i = jz; i >= 0; i--) {
+        q[i] = fw * static_cast<double>(iq[i]);
+        fw *= twon24;
+    }
+    for (i = jz; i >= 0; i--) {
+        for (fw = 0.0, k = 0; k <= jp && k <= jz - i; k++) fw += TrigfPio2Parts[k] * q[i + k];
+        fq[jz - i] = fw;
+    }
+    fw = 0.0;
+    for (i = jz; i >= 0; i--) fw += fq[i];
+    y[0] = ih == 0 ? fw : -fw;
+    return n & 7;
+}
+
+static int TrigfRemPio2(float x, double* y) {
+    const double invpio2 = 6.36619772367581382433e-01, pio2_1 = 1.57079631090164184570e+00, pio2_1t = 1.58932547735281966916e-08;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix < 0x4dc90fdb) {
+        volatile double rounded = x * invpio2 + 0x1.8p52;
+        double fn = rounded;
+        fn = fn - 0x1.8p52;
+        const std::int32_t n = static_cast<std::int32_t>(fn);
+        const double r = x - fn * pio2_1;
+        const double w = fn * pio2_1t;
+        *y = r - w;
+        return n;
+    }
+    if (ix >= 0x7f800000) {
+        *y = x - x;
+        return 0;
+    }
+    const std::int32_t e0 = (ix >> 23) - 150;
+    const float z = std::bit_cast<float>(ix - static_cast<std::int32_t>(static_cast<std::uint32_t>(e0) << 23));
+    double tx[1] = {z}, ty[1];
+    const int n = TrigfKernelRemPio2(tx, ty, e0);
+    if (hx < 0) {
+        *y = -ty[0];
+        return -n;
+    }
+    *y = ty[0];
+    return n;
+}
+
+static float TrigfKernelSin(double x) {
+    const double S1 = -0x15555554cbac77.0p-55, S2 = 0x111110896efbb2.0p-59, S3 = -0x1a00f9e2cae774.0p-65, S4 = 0x16cd878c3b46a7.0p-71;
+    const double z = x * x, w = z * z, r = S3 + z * S4, s = z * x;
+    return static_cast<float>((x + s * (S1 + z * S2)) + s * w * r);
+}
+
+static float TrigfKernelCos(double x) {
+    const double C0 = -0x1ffffffd0c5e81.0p-54, C1 = 0x155553e1053a42.0p-57, C2 = -0x16c087e80f1e27.0p-62, C3 = 0x199342e0ee5069.0p-68;
+    const double z = x * x, w = z * z, r = C2 + z * C3;
+    return static_cast<float>(((1.0 + z * C0) + w * C1) + (w * z) * r);
+}
+
+float APS5_VABI sinf_nid_postfix(float x) {
+    const double s1pio2 = std::bit_cast<double>(0x3FF921FB54442D18ull), s2pio2 = std::bit_cast<double>(0x400921FB54442D18ull);
+    const double s3pio2 = std::bit_cast<double>(0x4012D97C7F3321D2ull), s4pio2 = std::bit_cast<double>(0x401921FB54442D18ull);
+    double y;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix <= 0x3f490fda) {
+        if (ix < 0x39800000)
+            if (static_cast<int>(x) == 0) return x;
+        return TrigfKernelSin(x);
+    }
+    if (ix <= 0x407b53d1) {
+        if (ix <= 0x4016cbe3) return hx > 0 ? TrigfKernelCos(x - s1pio2) : -TrigfKernelCos(x + s1pio2);
+        return TrigfKernelSin((hx > 0 ? s2pio2 : -s2pio2) - x);
+    }
+    if (ix <= 0x40e231d5) {
+        if (ix <= 0x40afeddf) return hx > 0 ? -TrigfKernelCos(x - s3pio2) : TrigfKernelCos(x + s3pio2);
+        return TrigfKernelSin(x + (hx > 0 ? -s4pio2 : s4pio2));
+    }
+    if (ix >= 0x7f800000) {
+        if (ix == 0x7f800000) errno = EDOM;
+        return x - x;
+    }
+    const int n = TrigfRemPio2(x, &y);
+    switch (n & 3) {
+        case 0: return TrigfKernelSin(y);
+        case 1: return TrigfKernelCos(y);
+        case 2: return TrigfKernelSin(-y);
+        default: return -TrigfKernelCos(y);
+    }
+}
+
+static const double TrigfPio2[5] = {0.0, std::bit_cast<double>(0x3FF921FB54442D18ull), std::bit_cast<double>(0x400921FB54442D18ull),
+                                std::bit_cast<double>(0x4012D97C7F3321D2ull), std::bit_cast<double>(0x401921FB54442D18ull)};
+
+float APS5_VABI cosf_nid_postfix(float x) {
+    double y;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix <= 0x3f490fda) {
+        if (ix < 0x39800000)
+            if (static_cast<int>(x) == 0) return 1.0f;
+        return TrigfKernelCos(x);
+    }
+    if (ix <= 0x407b53d1) {
+        if (ix > 0x4016cbe3) return -TrigfKernelCos(x + (hx > 0 ? -TrigfPio2[2] : TrigfPio2[2]));
+        return hx > 0 ? TrigfKernelSin(TrigfPio2[1] - x) : TrigfKernelSin(x + TrigfPio2[1]);
+    }
+    if (ix <= 0x40e231d5) {
+        if (ix > 0x40afeddf) return TrigfKernelCos(x + (hx > 0 ? -TrigfPio2[4] : TrigfPio2[4]));
+        return hx > 0 ? TrigfKernelSin(x - TrigfPio2[3]) : TrigfKernelSin(-TrigfPio2[3] - x);
+    }
+    if (ix >= 0x7f800000) {
+        if (ix == 0x7f800000) errno = EDOM;
+        return x - x;
+    }
+    const int n = TrigfRemPio2(x, &y);
+    switch (n & 3) {
+        case 0: return TrigfKernelCos(y);
+        case 1: return TrigfKernelSin(-y);
+        case 2: return -TrigfKernelCos(y);
+        default: return TrigfKernelSin(y);
+    }
+}
+
+static float TrigfKernelTan(double x, int iy) {
+    static const double T[] = {0x15554d3418c99f.0p-54, 0x1112fd38999f72.0p-55, 0x1b54c91d865afe.0p-57,
+                               0x191df3908c33ce.0p-58, 0x185dadfcecf44e.0p-61, 0x1362b9bf971bcd.0p-59};
+    const double z = x * x;
+    double r = T[4] + z * T[5];
+    const double t = T[2] + z * T[3];
+    const double w = z * z;
+    const double s = z * x;
+    const double u = T[0] + z * T[1];
+    r = (x + s * u) + (s * w) * (t + w * r);
+    if (iy == 1) return static_cast<float>(r);
+    return static_cast<float>(-1.0 / r);
+}
+
+float APS5_VABI tanf_nid_postfix(float x) {
+    double y;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix <= 0x3f490fda) {
+        if (ix < 0x39800000)
+            if (static_cast<int>(x) == 0) return x;
+        return TrigfKernelTan(x, 1);
+    }
+    if (ix <= 0x407b53d1) {
+        if (ix <= 0x4016cbe3) return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[1] : TrigfPio2[1]), -1);
+        return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[2] : TrigfPio2[2]), 1);
+    }
+    if (ix <= 0x40e231d5) {
+        if (ix <= 0x40afeddf) return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[3] : TrigfPio2[3]), -1);
+        return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[4] : TrigfPio2[4]), 1);
+    }
+    if (ix >= 0x7f800000) {
+        if (ix == 0x7f800000) errno = EDOM;
+        return x - x;
+    }
+    const int n = TrigfRemPio2(x, &y);
+    return TrigfKernelTan(y, 1 - ((n & 1) << 1));
+}
 
 void APS5_VABI sincosf_nid_postfix(float x, float* sinp, float* cosp) {
-    *sinp = std::sin(x);
-    *cosp = std::cos(x);
+    *sinp = sinf_nid_postfix(x);
+    *cosp = cosf_nid_postfix(x);
 }
 
 double APS5_VABI sin_nid_postfix(double x) { return std::sin(x); }
 double APS5_VABI cos_nid_postfix(double x) { return std::cos(x); }
 double APS5_VABI sinh_nid_postfix(double x) { return std::sinh(x); }
 double APS5_VABI cosh_nid_postfix(double x) { return std::cosh(x); }
-float APS5_VABI coshf_nid_postfix(float x) { return std::cosh(x); }
+float APS5_VABI coshf_nid_postfix(float x) {
+    const std::uint32_t magnitude = std::bit_cast<std::uint32_t>(x) & 0x7fffffffu;
+    if (magnitude >= 0x7f800000u) return x * x;
+    const float absolute = std::fabs(x);
+    if (magnitude < 0x3eb17218u) {
+        const float t = SinhfExpm1(absolute);
+        const float w = 1.0f + t;
+        if (magnitude < 0x39800000u) return 1.0f;
+        return 1.0f + (t * t) / (w + w);
+    }
+    if (magnitude < 0x41100000u) {
+        const float t = SinhfExp(absolute);
+        return 0.5f * t + 0.5f / t;
+    }
+    if (magnitude < 0x42b17217u) return 0.5f * SinhfExp(absolute);
+    if (magnitude <= 0x42b2d4fcu) {
+        const float w = SinhfExp(0.5f * absolute);
+        const float t = 0.5f * w;
+        return t * w;
+    }
+    volatile float huge = 1.0e30f;
+    return huge * huge;
+}
 
 float APS5_VABI sinhf_nid_postfix(float x) {
     const std::uint32_t magnitude = std::bit_cast<std::uint32_t>(x) & 0x7fffffffu;
@@ -512,7 +1058,25 @@ float APS5_VABI sinhf_nid_postfix(float x) {
 double APS5_VABI asinh_nid_postfix(double x) { return std::asinh(x); }
 float APS5_VABI asinhf_nid_postfix(float x) { return std::asinh(x); }
 double APS5_VABI acosh_nid_postfix(double x) { return std::acosh(x); }
-float APS5_VABI acoshf_nid_postfix(float x) { return std::acosh(x); }
+float APS5_VABI acoshf_nid_postfix(float x) {
+    constexpr float ln2 = 6.9314718246e-01f;
+    const std::uint32_t bits = std::bit_cast<std::uint32_t>(x);
+    const std::uint32_t magnitude = bits & 0x7fffffffu;
+    if ((bits & 0x80000000u) != 0 || magnitude < 0x3f800000u) {
+        _Feraise_nid_postfix(0x01);
+        errno = EDOM;
+        return (x - x) / (x - x);
+    }
+    if (magnitude >= 0x7f800000u) return x + x;
+    if (magnitude == 0x3f800000u) return 0.0f;
+    if (magnitude >= 0x4d800000u) return logf_nid_postfix(x) + ln2;
+    if (magnitude > 0x40000000u) {
+        const float square = x * x;
+        return logf_nid_postfix(2.0f * x + (-1.0f / (x + std::sqrt(square - 1.0f))));
+    }
+    const float t = x - 1.0f;
+    return AtanhfLog1p(t + std::sqrt(2.0f * t + t * t));
+}
 double APS5_VABI atanh_nid_postfix(double x) { return std::atanh(x); }
 
 float APS5_VABI atanhf_nid_postfix(float x) {
@@ -539,7 +1103,50 @@ void APS5_VABI sincos_nid_postfix(double x, double* sinp, double* cosp) {
     *cosp = std::cos(x);
 }
 
-float APS5_VABI atanf_nid_postfix(float x) { return std::atan(x); }
+float APS5_VABI atanf_nid_postfix(float x) {
+    static constexpr float atanhi[] = {static_cast<float>(4.6364760399e-01), static_cast<float>(7.8539812565e-01), static_cast<float>(9.8279368877e-01), static_cast<float>(1.5707962513e+00)};
+    static constexpr float atanlo[] = {static_cast<float>(5.0121582440e-09), static_cast<float>(3.7748947079e-08), static_cast<float>(3.4473217170e-08), static_cast<float>(7.5497894159e-08)};
+    static constexpr float aT[] = {static_cast<float>(3.3333328366e-01), static_cast<float>(-1.9999158382e-01), static_cast<float>(1.4253635705e-01), static_cast<float>(-1.0648017377e-01), static_cast<float>(6.1687607318e-02)};
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix >= 0x4c800000) {
+        if (ix > 0x7f800000) {
+            return x + x;
+        }
+        const volatile float lo = atanlo[3];
+        return hx > 0 ? atanhi[3] + lo : -atanhi[3] - lo;
+    }
+    int id = -1;
+    if (ix < 0x3ee00000) {
+        if (ix < 0x39800000) {
+            return x;
+        }
+    } else {
+        x = std::fabs(x);
+        if (ix < 0x3f300000) {
+            id = 0;
+            x = (2.0f * x - 1.0f) / (2.0f + x);
+        } else if (ix < 0x3f980000) {
+            id = 1;
+            x = (x - 1.0f) / (x + 1.0f);
+        } else if (ix < 0x401c0000) {
+            id = 2;
+            x = (x - 1.5f) / (1.0f + 1.5f * x);
+        } else {
+            id = 3;
+            x = -1.0f / x;
+        }
+    }
+    const float z = x * x;
+    const float w = z * z;
+    const float s1 = z * (aT[0] + w * (aT[2] + w * aT[4]));
+    const float s2 = w * (aT[1] + w * aT[3]);
+    if (id < 0) {
+        return x - x * (s1 + s2);
+    }
+    const float result = atanhi[id] - ((x * (s1 + s2) - atanlo[id]) - x);
+    return hx < 0 ? -result : result;
+}
 double APS5_VABI atan2_nid_postfix(double y, double x) { return std::atan2(y, x); }
 float APS5_VABI powf_nid_postfix(float base, float exp) {
     if (base == 1.0f) return 1.0f;
@@ -571,8 +1178,62 @@ double APS5_VABI __powidf2_nid_postfix(double base, int exponent) {
     return reciprocal ? 1.0 / result : result;
 }
 float APS5_VABI expf_nid_postfix(float x) { return std::exp(x); }
-float APS5_VABI exp2f_nid_postfix(float x) { return std::exp2(x); }
-float APS5_VABI logf_nid_postfix(float x) { return std::log(x); }
+float APS5_VABI logf_nid_postfix(float x) {
+    const float ln2_hi = static_cast<float>(6.9313812256e-01);
+    const float ln2_lo = static_cast<float>(9.0580006145e-06);
+    const float two25 = static_cast<float>(3.355443200e+07);
+    const float Lg1 = 0xaaaaaa.0p-24f;
+    const float Lg2 = 0xccce13.0p-25f;
+    const float Lg3 = 0x91e9ee.0p-25f;
+    const float Lg4 = 0xf89e26.0p-26f;
+    static volatile float vzero = 0.0f;
+    std::int32_t k = 0;
+    std::int32_t ix = std::bit_cast<std::int32_t>(x);
+    if (ix < 0x00800000) {
+        if ((ix & 0x7fffffff) == 0) {
+            errno = ERANGE;
+            return -two25 / vzero;
+        }
+        if (ix < 0) {
+            errno = EDOM;
+            return (x - x) / 0.0f;
+        }
+        k -= 25;
+        x *= two25;
+        ix = std::bit_cast<std::int32_t>(x);
+    }
+    if (ix >= 0x7f800000) {
+        return x + x;
+    }
+    k += (ix >> 23) - 127;
+    ix &= 0x007fffff;
+    std::int32_t i = (ix + (0x95f64 << 3)) & 0x800000;
+    x = std::bit_cast<float>(ix | (i ^ 0x3f800000));
+    k += i >> 23;
+    const float f = x - 1.0f;
+    const float dk = static_cast<float>(k);
+    if ((0x007fffff & (0x8000 + ix)) < 0xc000) {
+        if (f == 0.0f) {
+            return k == 0 ? 0.0f : dk * ln2_hi + dk * ln2_lo;
+        }
+        const float R = f * f * (0.5f - static_cast<float>(0.33333333333333333) * f);
+        return k == 0 ? f - R : dk * ln2_hi - ((R - dk * ln2_lo) - f);
+    }
+    const float s = f / (2.0f + f);
+    const float z = s * s;
+    i = ix - (0x6147a << 3);
+    const float w = z * z;
+    const std::int32_t j = (0x6b851 << 3) - ix;
+    const float t1 = w * (Lg2 + w * Lg4);
+    const float t2 = z * (Lg1 + w * Lg3);
+    i |= j;
+    const float R = t2 + t1;
+    if (i > 0) {
+        const float hfsq = 0.5f * f * f;
+        return k == 0 ? f - (hfsq - s * (hfsq + R)) : dk * ln2_hi - ((hfsq - (s * (hfsq + R) + dk * ln2_lo)) - f);
+    }
+    return k == 0 ? f - s * (f - R) : dk * ln2_hi - ((s * (f - R) - dk * ln2_lo) - f);
+}
 float APS5_VABI log2f_nid_postfix(float x) { return std::log2(x); }
 double APS5_VABI log10_nid_postfix(double x) { return std::log10(x); }
 float APS5_VABI ldexpf_nid_postfix(float x, int exp) { return std::ldexp(x, exp); }
@@ -584,10 +1245,86 @@ double APS5_VABI fmod_nid_postfix(double x, double y) {
 }
 float APS5_VABI roundf_nid_postfix(float x) { return std::round(x); }
 double APS5_VABI round_nid_postfix(double x) { return std::round(x); }
-float APS5_VABI cbrtf_nid_postfix(float x) { return std::cbrt(x); }
+float APS5_VABI cbrtf_nid_postfix(float x) {
+    const std::uint32_t B1 = 709958130;
+    const std::uint32_t B2 = 642849266;
+    std::uint32_t hx = std::bit_cast<std::uint32_t>(x);
+    const std::uint32_t sign = hx & 0x80000000u;
+    hx ^= sign;
+    if (hx >= 0x7f800000u) {
+        return x + x;
+    }
+    float t;
+    if (hx < 0x00800000u) {
+        if (hx == 0) {
+            return x;
+        }
+        t = 0x1p24f * x;
+        const std::uint32_t high = std::bit_cast<std::uint32_t>(t);
+        t = std::bit_cast<float>(sign | ((high & 0x7fffffffu) / 3 + B2));
+    } else {
+        t = std::bit_cast<float>(sign | (hx / 3 + B1));
+    }
+    double T = t;
+    double r = T * T * T;
+    T = T * (static_cast<double>(x) + x + r) / (x + r + r);
+    r = T * T * T;
+    T = T * (static_cast<double>(x) + x + r) / (x + r + r);
+    return static_cast<float>(T);
+}
 float APS5_VABI remainderf_nid_postfix(float x, float y) { return std::remainder(x, y); }
-float APS5_VABI nextafterf_nid_postfix(float x, float y) { return std::nextafter(x, y); }
-double APS5_VABI nextafter_nid_postfix(double x, double y) { return std::nextafter(x, y); }
+float APS5_VABI nextafterf_nid_postfix(float x, float y) {
+    const std::uint32_t ux = std::bit_cast<std::uint32_t>(x);
+    const std::uint32_t uy = std::bit_cast<std::uint32_t>(y);
+    if ((ux & 0x7fffffffu) > 0x7f800000u || (uy & 0x7fffffffu) > 0x7f800000u) {
+        volatile float sum = x + y;
+        (void)sum;
+        return std::bit_cast<float>(((ux & 0x7fffffffu) > 0x7f800000u ? ux : uy) | 0x00400000u);
+    }
+    if (x == y) {
+        return y;
+    }
+    if ((ux & 0x7fffffffu) == 0) {
+        return std::bit_cast<float>((uy & 0x80000000u) | 1u);
+    }
+    const bool towardZero = (x > 0.0f) == (x > y);
+    const std::uint32_t next = towardZero ? ux - 1 : ux + 1;
+    const std::uint32_t exponent = next & 0x7f800000u;
+    if (exponent == 0x7f800000u) {
+        errno = ERANGE;
+        return x + x;
+    }
+    if (exponent == 0) {
+        errno = ERANGE;
+    }
+    return std::bit_cast<float>(next);
+}
+double APS5_VABI nextafter_nid_postfix(double x, double y) {
+    const std::uint64_t ux = std::bit_cast<std::uint64_t>(x);
+    const std::uint64_t uy = std::bit_cast<std::uint64_t>(y);
+    if ((ux & 0x7fffffffffffffffull) > 0x7ff0000000000000ull || (uy & 0x7fffffffffffffffull) > 0x7ff0000000000000ull) {
+        volatile double sum = x + y;
+        (void)sum;
+        return std::bit_cast<double>(((ux & 0x7fffffffffffffffull) > 0x7ff0000000000000ull ? ux : uy) | 0x0008000000000000ull);
+    }
+    if (x == y) {
+        return y;
+    }
+    if ((ux & 0x7fffffffffffffffull) == 0) {
+        return std::bit_cast<double>((uy & 0x8000000000000000ull) | 1u);
+    }
+    const bool towardZero = (x > 0.0) == (x > y);
+    const std::uint64_t next = towardZero ? ux - 1 : ux + 1;
+    const std::uint64_t exponent = next & 0x7ff0000000000000ull;
+    if (exponent == 0x7ff0000000000000ull) {
+        errno = ERANGE;
+        return x + x;
+    }
+    if (exponent == 0) {
+        errno = ERANGE;
+    }
+    return std::bit_cast<double>(next);
+}
 int APS5_VABI __isfinite_nid_postfix(double x) { return std::isfinite(x) ? 1 : 0; }
 int APS5_VABI __isnan_nid_postfix(double x) { return std::isnan(x) ? 1 : 0; }
 int APS5_VABI __isinf_nid_postfix(double x) { return std::isinf(x) ? 1 : 0; }
@@ -603,7 +1340,31 @@ double APS5_VABI nan_nid_postfix(const char* tagp) {
 
 double APS5_VABI modf_nid_postfix(double x, double* integral) { return std::modf(x, integral); }
 float APS5_VABI modff_nid_postfix(float x, float* integral) { return std::modf(x, integral); }
-double APS5_VABI tanh_nid_postfix(double x) { return std::tanh(x); }
+double APS5_VABI tanh_nid_postfix(double x) {
+    static volatile double tiny = 1.0e-300;
+    const double huge = 1.0e300;
+    const std::int32_t jx = static_cast<std::int32_t>(std::bit_cast<std::uint64_t>(x) >> 32);
+    const std::int32_t ix = jx & 0x7fffffff;
+    if (ix >= 0x7ff00000) {
+        return jx >= 0 ? 1.0 / x + 1.0 : 1.0 / x - 1.0;
+    }
+    double z;
+    if (ix < 0x40360000) {
+        if (ix < 0x3e300000 && huge + x > 1.0) {
+            return x;
+        }
+        if (ix >= 0x3ff00000) {
+            const double t = Expm1(2.0 * std::fabs(x));
+            z = 1.0 - 2.0 / (t + 2.0);
+        } else {
+            const double t = Expm1(-2.0 * std::fabs(x));
+            z = -t / (t + 2.0);
+        }
+    } else {
+        z = 1.0 - tiny;
+    }
+    return jx >= 0 ? z : -z;
+}
 float APS5_VABI tanhf_nid_postfix(float x) { return std::tanh(x); }
 long double APS5_VABI atanl_nid_postfix(long double x) { return std::atan(x); }
 long double APS5_VABI sinl_nid_postfix(long double x) { return std::sin(x); }
@@ -770,18 +1531,77 @@ double APS5_VABI _Cosh_nid_postfix(double x, double y) {
     return std::scalbn(scale * (0.5 * std::exp(reduced)), scaleExponent + exponent);
 }
 
+long double APS5_VABI _LCosh_nid_postfix(long double x, long double y) {
+    if (!std::isfinite(x) || !std::isfinite(y)) return y * std::cosh(x);
+    if (y == 0.0L) return std::copysign(0.0L, y);
+    constexpr long double Ln2High = 0x1.62e42fefa0000p-1L;
+    constexpr long double Ln2Low = 0x1.cf79abc9e3b398p-40L;
+    constexpr long double InverseLn2 = 0x1.71547652b82fe178p+0L;
+    const long double magnitude = std::abs(x);
+    if (magnitude <= (std::numeric_limits<long double>::max_exponent - 1) * (Ln2High + Ln2Low))
+        return y * std::cosh(x);
+    int scaleExponent;
+    const long double scale = std::frexp(y, &scaleExponent);
+    constexpr int MaximumExponentSpan = std::numeric_limits<long double>::max_exponent -
+        std::numeric_limits<long double>::min_exponent + std::numeric_limits<long double>::digits + 4;
+    if (magnitude > MaximumExponentSpan * (Ln2High + Ln2Low))
+        return std::scalbn(scale, INT_MAX);
+    const int exponent = static_cast<int>(magnitude * InverseLn2);
+    const long double reduced = std::fma(-exponent, Ln2Low, std::fma(-exponent, Ln2High, magnitude));
+    return std::scalbn(scale * (0.5L * std::exp(reduced)), scaleExponent + exponent);
+}
+
+long double APS5_VABI _LSinh_nid_postfix(long double x, long double y) {
+    if (!std::isfinite(x) || !std::isfinite(y)) return y * std::sinh(x);
+    if (y == 0.0L) {
+        const bool negative = std::signbit(x) != std::signbit(y);
+        return std::copysign(0.0L, negative ? -1.0L : 1.0L);
+    }
+    constexpr long double Ln2High = 0x1.62e42fefa0000p-1L;
+    constexpr long double Ln2Low = 0x1.cf79abc9e3b398p-40L;
+    constexpr long double InverseLn2 = 0x1.71547652b82fe178p+0L;
+    const long double magnitude = std::abs(x);
+    if (magnitude <= (std::numeric_limits<long double>::max_exponent - 1) * (Ln2High + Ln2Low))
+        return y * std::sinh(x);
+    int scaleExponent;
+    const long double scale = std::frexp(y, &scaleExponent);
+    constexpr int MaximumExponentSpan = std::numeric_limits<long double>::max_exponent -
+        std::numeric_limits<long double>::min_exponent + std::numeric_limits<long double>::digits + 4;
+    const long double sign = std::copysign(1.0L, x);
+    if (magnitude > MaximumExponentSpan * (Ln2High + Ln2Low))
+        return sign * std::scalbn(scale, INT_MAX);
+    const int exponent = static_cast<int>(magnitude * InverseLn2);
+    const long double reduced = std::fma(-exponent, Ln2Low, std::fma(-exponent, Ln2High, magnitude));
+    return sign * std::scalbn(scale * (0.5L * std::exp(reduced)), scaleExponent + exponent);
+}
+
 int APS5_VABI _Fltrounds_nid_postfix(void) {
     return SonyFltrounds();
 }
 
-struct GuestFloatingPointEnvironment {
-    std::uint32_t control;
-    std::uint32_t status;
-    std::uint32_t tag;
-    unsigned char other[16];
-    std::uint32_t mxcsr;
-};
-static_assert(sizeof(GuestFloatingPointEnvironment) == 32 && offsetof(GuestFloatingPointEnvironment, mxcsr) == 28);
+static_assert(sizeof(GuestFloatingPointEnvironment) == 32 && alignof(GuestFloatingPointEnvironment) == 4 && offsetof(GuestFloatingPointEnvironment, mxcsr) == 28);
+
+int APS5_VABI feupdateenv_nid_postfix(const GuestFloatingPointEnvironment* environment) {
+    if (environment == nullptr) throw std::invalid_argument("feupdateenv: null environment");
+    const auto saved = *environment;
+    alignas(16) std::array<std::uint32_t, 128> state;
+    asm volatile("fxsave %0" : "=m"(state));
+    const auto supported = state[7] != 0 ? state[7] : 0xffbfu;
+    if ((saved.mxcsr & ~supported) != 0) throw std::invalid_argument("feupdateenv: unsupported MXCSR bits");
+    std::uint16_t status;
+    asm volatile("fnstsw %0" : "=am"(status));
+    const auto pending = (status | _mm_getcsr()) & 0x3f;
+    asm volatile("fldenv %0" : : "m"(saved) : "st", "st(1)", "st(2)", "st(3)", "st(4)", "st(5)", "st(6)", "st(7)");
+    _mm_setcsr(saved.mxcsr);
+    GuestFloatingPointEnvironment raised;
+    asm volatile("fnstenv %0" : "=m"(raised));
+    raised.status |= pending;
+    const auto mxcsr = _mm_getcsr() | pending;
+    asm volatile("fldenv %0" : : "m"(raised) : "st", "st(1)", "st(2)", "st(3)", "st(4)", "st(5)", "st(6)", "st(7)");
+    _mm_setcsr(mxcsr);
+    asm volatile("fwait");
+    return 0;
+}
 
 int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment* environment) {
     if (environment == nullptr) throw std::invalid_argument("fegetenv: null environment");
@@ -790,6 +1610,15 @@ int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment* environment) {
     return 0;
 }
 
+int APS5_VABI feholdexcept_nid_postfix(GuestFloatingPointEnvironment* environment) {
+    if (environment == nullptr) throw std::invalid_argument("feholdexcept: null environment");
+    const auto csr = _mm_getcsr();
+    asm volatile("fnstenv %0\n\tfnclex" : "=m"(*environment));
+    environment->mxcsr = csr;
+    _mm_setcsr((csr & ~0x3fu) | 0x1f80u);
+    return 0;
+}
+
 union SonyDconst {
     unsigned short _Word[8];
     float _Float;
diff --git a/core/libs/prx/libc/src/MathExact.cpp b/core/libs/prx/libc/src/MathExact.cpp
index 1217ca4a4c..bbfe5114ef 100644
--- a/core/libs/prx/libc/src/MathExact.cpp
+++ b/core/libs/prx/libc/src/MathExact.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cerrno>
 #include <climits>
diff --git a/core/libs/prx/libc/src/Mspace.cpp b/core/libs/prx/libc/src/Mspace.cpp
index 8830e5c75c..53e55f6199 100644
--- a/core/libs/prx/libc/src/Mspace.cpp
+++ b/core/libs/prx/libc/src/Mspace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/MallocManagedSize.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -13,8 +14,6 @@
 #include <stdexcept>
 #include <utility>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 constexpr unsigned MspaceThreadUnsafe = 1;
@@ -322,6 +321,7 @@ void* APS5_VABI sceLibcPafMspaceMemalign_nid_postfix(void* handle, std::size_t a
 void APS5_VABI sceLibcPafMspaceFree_nid_postfix(void* handle, void* pointer, const void* owner) {
     (void)owner;
     sceLibcMspaceFree_nid_postfix(handle, pointer);
+
 }
 
 void* APS5_VABI sceLibcPafMspaceCalloc_nid_postfix(void* handle, std::size_t count, std::size_t size, const void* owner) {
diff --git a/core/libs/prx/libc/src/Multibyte.cpp b/core/libs/prx/libc/src/Multibyte.cpp
index a1dc52cb4b..330701624b 100644
--- a/core/libs/prx/libc/src/Multibyte.cpp
+++ b/core/libs/prx/libc/src/Multibyte.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/SonyCrt.hpp"
 #include <array>
diff --git a/core/libs/prx/libc/src/Process.cpp b/core/libs/prx/libc/src/Process.cpp
index 9d2f6909b0..8d7c88c0d9 100644
--- a/core/libs/prx/libc/src/Process.cpp
+++ b/core/libs/prx/libc/src/Process.cpp
@@ -1,9 +1,12 @@
+#include "prx/libc/include/Api.hpp"
 #include <csignal>
+#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <cerrno>
+#include <algorithm>
 #include <condition_variable>
 #include <exception>
 #include <future>
@@ -20,8 +23,6 @@
 #include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
-
 namespace {
 
 std::mutex shutdownMutex;
@@ -34,7 +35,7 @@ std::exception_ptr shutdownFailure;
 std::stop_source shutdownSource;
 std::atomic<bool> exitRequested{false};
 std::atomic<bool> exitStarted{false};
-using GuestExitCallback = void (APS5_VABI*)();
+
 thread_local bool runningExit = false;
 
 void APS5_VABI RunGuestExitCallback(void* callback) {
@@ -271,6 +272,7 @@ int APS5_VABI at_quick_exit_nid_postfix(GuestExitCallback func) {
     }
     for (auto it = callbacks.rbegin(); it != callbacks.rend(); ++it) (*it)();
     _Exit_nid_postfix(status);
+
 }
 
 int APS5_VABI daemon_nid_postfix(int noChdir, int noClose) {
@@ -280,4 +282,127 @@ int APS5_VABI daemon_nid_postfix(int noChdir, int noClose) {
     return -1;
 }
 
+#ifdef _WIN32
+namespace {
+struct ChildProcess {
+    std::int32_t processId;
+    std::int64_t processHandle;
+};
+
+std::mutex childProcessMutex;
+std::vector<ChildProcess> childProcesses;
+
+int ChildProcessWaitStatus(DWORD code) {
+    switch (code) {
+    case 0xC0000005u:
+    case 0xC00000FDu: return 11;
+    case 0xC000001Du:
+    case 0xC0000096u: return 4;
+    case 0x80000003u: return 5;
+    case 0xC0000094u:
+    case 0xC0000095u: return 8;
+    case 0xC0000409u:
+    case 0xC0000374u: return 6;
+    default: return static_cast<int>(code & 0xffu) << 8;
+    }
+}
+}
+
+extern "C" void RegisterChildProcess_nid_no_patch(std::int32_t processId, std::int64_t processHandle) {
+    std::lock_guard lock(childProcessMutex);
+    childProcesses.push_back({processId, processHandle});
+}
+
+extern "C" std::int64_t WaitChildProcess_nid_no_patch(std::int32_t processId, unsigned options, int* status) {
+    const bool noWait = (options & 1u) != 0;
+    const auto matches = [&](const ChildProcess& child) { return processId <= 0 || child.processId == processId; };
+    {
+        std::lock_guard lock(childProcessMutex);
+        if (std::none_of(childProcesses.begin(), childProcesses.end(), matches)) return -2;
+    }
+    int encoded = 0;
+    while (true) {
+        std::int32_t reaped = 0;
+        {
+            std::lock_guard lock(childProcessMutex);
+            for (std::size_t index = 0; index < childProcesses.size(); ++index) {
+                auto& child = childProcesses[index];
+                if (!matches(child)) continue;
+                const HANDLE handle = reinterpret_cast<HANDLE>(child.processHandle);
+                if (WaitForSingleObject(handle, 0) != WAIT_OBJECT_0) continue;
+                DWORD code = 0;
+                if (!GetExitCodeProcess(handle, &code)) {
+                    *__error_nid_postfix() = 14;
+                    return -1;
+                }
+                encoded = ChildProcessWaitStatus(code);
+                CloseHandle(handle);
+                reaped = child.processId;
+                childProcesses.erase(childProcesses.begin() + static_cast<std::ptrdiff_t>(index));
+                break;
+            }
+        }
+        if (reaped != 0) {
+            if (status != nullptr) *status = encoded;
+            return reaped;
+        }
+        std::vector<HANDLE> handles;
+        {
+            const std::lock_guard lock(childProcessMutex);
+            for (const auto& child : childProcesses) {
+                if (!matches(child)) continue;
+                handles.push_back(reinterpret_cast<HANDLE>(child.processHandle));
+            }
+        }
+        if (handles.empty()) return -2;
+        if (noWait) return 0;
+        constexpr std::size_t groupSize = MAXIMUM_WAIT_OBJECTS;
+        bool timedOut = true;
+        for (std::size_t start = 0; start < handles.size() && timedOut; start += groupSize) {
+            const std::size_t count = std::min(handles.size() - start, groupSize);
+            timedOut = WaitForMultipleObjects(static_cast<DWORD>(count), handles.data() + start, FALSE, 250) == WAIT_TIMEOUT;
+        }
+    }
+}
+#endif
+
+}
+
+namespace {
+constexpr int SaRestart = 0x2;
+std::atomic<SigactionFn_nid_no_patch> registeredSigaction{nullptr};
+std::atomic<std::uint32_t*> registeredInterruptSet{nullptr};
+
+struct InterruptSigaction {
+    std::uintptr_t handler;
+    int flags;
+    std::uint32_t mask[4];
+};
+static_assert(sizeof(InterruptSigaction) == 32 && offsetof(InterruptSigaction, flags) == 8 && offsetof(InterruptSigaction, mask) == 12);
+}
+
+extern "C" {
+
+void RegisterSigaction_nid_no_patch(SigactionFn_nid_no_patch fn, std::uint32_t* interruptSet) {
+    registeredInterruptSet.store(interruptSet, std::memory_order_release);
+    registeredSigaction.store(fn, std::memory_order_release);
+}
+
+int APS5_VABI siginterrupt_nid_postfix(int guest, int flag) {
+    const auto sigaction = registeredSigaction.load(std::memory_order_acquire);
+    auto* const interruptSet = registeredInterruptSet.load(std::memory_order_acquire);
+    if (sigaction == nullptr || interruptSet == nullptr) throw std::runtime_error("siginterrupt: libkernel has not registered sigaction");
+    InterruptSigaction action{};
+    if (sigaction(guest, nullptr, &action) != 0) return -1;
+    const auto index = static_cast<std::uint32_t>(guest - 1);
+    if (flag) {
+        interruptSet[index >> 5] |= 1u << (index & 31);
+        action.flags &= ~SaRestart;
+    } else {
+        interruptSet[index >> 5] &= ~(1u << (index & 31));
+        action.flags |= SaRestart;
+    }
+    return sigaction(guest, &action, nullptr);
+}
+
 }
diff --git a/core/libs/prx/libc/src/Random.cpp b/core/libs/prx/libc/src/Random.cpp
index 06cf1d789d..67bd066466 100644
--- a/core/libs/prx/libc/src/Random.cpp
+++ b/core/libs/prx/libc/src/Random.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libc/include/HostEntropy.hpp"
 #include <array>
 #include <cmath>
 #include <cstddef>
@@ -17,15 +19,7 @@ constexpr std::array<std::int64_t, MaxTypes> MinimumStateBytes {8, 32, 64, 128,
 constexpr std::array<int, MaxTypes> Degrees {0, 7, 15, 31, 63};
 constexpr std::array<int, MaxTypes> Separations {0, 3, 1, 3, 1};
 
-std::uint32_t g_defaultTable[] {
-    3,
-    0x2cf41758, 0x27bb3711, 0x4916d4d1, 0x7b02f59f, 0x9b8e28eb, 0xc0e80269,
-    0x696f5c16, 0x878f1ff5, 0x52d9c07f, 0x916a06cd, 0xb50b3a20, 0x2776970a,
-    0xee4eb2a6, 0xe94640ec, 0xb1d65612, 0x9d1ed968, 0x1043f6b7, 0xa3432a76,
-    0x17eacbb9, 0x3c09e2eb, 0x04f8c2b3, 0x708a1f57, 0xee341814, 0x95d0e4d2,
-    0xb06f216c, 0x8bd2e72e, 0x8f7c38d7, 0xcfc6a8fc, 0x02a59495, 0xa20d2a69,
-    0xe29d12d1
-};
+std::uint32_t g_defaultTable[32]{};
 
 struct AdditiveFeedbackState {
     char* table;
@@ -50,12 +44,13 @@ void StoreWord(char* table, int index, std::uint32_t value) {
 }
 
 std::uint32_t GoodRand(std::uint32_t context) {
-    std::int32_t x = static_cast<std::int32_t>(context % 0x7ffffffeu) + 1;
-    const std::int32_t high = x / 127773;
-    const std::int32_t low = x % 127773;
+    std::int64_t x = static_cast<std::int32_t>(context);
+    if (x == 0) x = 123459876;
+    const std::int64_t high = x / 127773;
+    const std::int64_t low = x % 127773;
     x = 16807 * low - 2836 * high;
     if (x < 0) x += 0x7fffffff;
-    return static_cast<std::uint32_t>(x - 1);
+    return static_cast<std::uint32_t>(x);
 }
 
 std::uint32_t NextLocked() {
@@ -95,6 +90,14 @@ void SaveTypeWordLocked() {
     StoreWord(state.table, 0, static_cast<std::uint32_t>(word));
 }
 
+bool SeedDefaultState() {
+    SeedLocked(1);
+    SaveTypeWordLocked();
+    return true;
+}
+
+[[maybe_unused]] const bool g_defaultStateSeeded = SeedDefaultState();
+
 std::uint16_t g_rand48Seed[3]{0x330e, 0xabcd, 0x1234};
 constexpr std::uint64_t DefaultRand48Multiplier = 0x5deece66dull;
 constexpr std::uint16_t DefaultRand48Addend = 0xb;
@@ -118,7 +121,7 @@ std::uint64_t NextRand48(std::uint16_t* seed, const char* function) {
 extern "C" {
 
 double APS5_VABI erand48_nid_postfix(std::uint16_t* seed) {
-    return std::ldexp(static_cast<double>(NextRand48(seed, __func__)), -48);
+    return std::ldexp(static_cast<double>(NextRand48(seed, __func__) >> 16), -32);
 }
 
 std::int64_t APS5_VABI nrand48_nid_postfix(std::uint16_t* seed) {
@@ -131,7 +134,7 @@ std::int64_t APS5_VABI jrand48_nid_postfix(std::uint16_t* seed) {
 
 double APS5_VABI drand48_nid_postfix() {
     std::lock_guard lock(g_randomLock);
-    return std::ldexp(static_cast<double>(NextRand48(g_rand48Seed, __func__)), -48);
+    return std::ldexp(static_cast<double>(NextRand48(g_rand48Seed, __func__) >> 16), -32);
 }
 
 std::int64_t APS5_VABI lrand48_nid_postfix() {
@@ -180,6 +183,16 @@ void APS5_VABI srandom_nid_postfix(std::uint64_t seed) {
     SeedLocked(static_cast<std::uint32_t>(seed));
 }
 
+void APS5_VABI srandomdev_nid_postfix() {
+    std::lock_guard lock(g_randomLock);
+    const auto words = g_random.type == LinearCongruentialType ? 1 : g_random.degree;
+    HostEntropy_nid_no_patch(g_random.table + sizeof(std::uint32_t), static_cast<std::size_t>(words) * sizeof(std::uint32_t));
+    if (g_random.type != LinearCongruentialType) {
+        g_random.front = g_random.separation;
+        g_random.rear = 0;
+    }
+}
+
 char* APS5_VABI initstate_nid_postfix(std::uint64_t seed, char* state, std::int64_t size) {
     if (size < MinimumStateBytes[0]) return nullptr;
     if (state == nullptr) throw std::invalid_argument("initstate: null state");
diff --git a/core/libs/prx/libc/src/RealPath.cpp b/core/libs/prx/libc/src/RealPath.cpp
index 10a0193b94..92c58204d9 100644
--- a/core/libs/prx/libc/src/RealPath.cpp
+++ b/core/libs/prx/libc/src/RealPath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -10,8 +11,6 @@
 #include <string_view>
 #include <system_error>
 
-extern "C" char* APS5_VABI getcwd_nid_postfix(char* buffer, std::size_t size);
-
 namespace {
 constexpr std::size_t PathMax = 1024;
 constexpr std::string_view Separators = "/\\";
diff --git a/core/libs/prx/libc/src/Rename.cpp b/core/libs/prx/libc/src/Rename.cpp
index 973c142ff6..cdad0eff61 100644
--- a/core/libs/prx/libc/src/Rename.cpp
+++ b/core/libs/prx/libc/src/Rename.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/RenameDot.hpp"
 #include "prx/libc/include/General.hpp"
@@ -41,6 +42,16 @@ std::error_code RenameNative_nid_no_patch(const std::filesystem::path& source, c
     return error;
 }
 
+#ifdef _WIN32
+static bool BelowSymbolicLinkLoop(const std::filesystem::path& directory) {
+    const auto handle = CreateFileW(directory.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) return GetLastError() == ERROR_CANT_RESOLVE_FILENAME;
+    CloseHandle(handle);
+    return false;
+}
+#endif
+
 static int RenamePath_nid_no_patch(const std::filesystem::path& source, const std::filesystem::path& destination) {
     constexpr int GuestEnoent = 2;
     constexpr int GuestEnotdir = 20;
@@ -71,6 +82,9 @@ static int RenamePath_nid_no_patch(const std::filesystem::path& source, const st
         error.clear();
         sameFile = fs::equivalent(source, destination, error);
         if (error == std::errc::no_such_file_or_directory) error.clear();
+#ifdef __APPLE__
+        if (error == std::errc::not_supported) error.clear();
+#endif
         if (error) return FilesystemError(error);
         if (!sameFile && sourceIsDirectory && !destinationIsDirectory) return GuestEnotdir;
         if (!sameFile && !sourceIsDirectory && destinationIsDirectory) return GuestEisdir;
@@ -103,10 +117,17 @@ static int SourceLookupError_nid_no_patch(const std::filesystem::path& source) {
 }
 
 extern "C" int RenameGuestPath_nid_no_patch(const char* from, const char* to) {
-    if (!from) { errno = 14; return -1; }
-    if (!*from) { errno = 2; return -1; }
+    std::string fromCopy;
+    if (const int error = CopyGuestPath_nid_no_patch(from, fromCopy)) { errno = error; return -1; }
+    from = fromCopy.c_str();
+    if (fromCopy.empty()) { errno = 2; return -1; }
     if (const int dot = RenameDotError_nid_no_patch(from)) { errno = dot; return -1; }
-    const int destinationError = !to ? 14 : !*to ? 2 : RenameDotError_nid_no_patch(to);
+    std::string toCopy;
+    int destinationError = CopyGuestPath_nid_no_patch(to, toCopy);
+    if (destinationError == 0) {
+        to = toCopy.c_str();
+        destinationError = toCopy.empty() ? 2 : RenameDotError_nid_no_patch(to);
+    }
     try {
         const auto source = ResolvePath_nid_no_patch(from);
         if (destinationError) {
@@ -120,6 +141,13 @@ extern "C" int RenameGuestPath_nid_no_patch(const char* from, const char* to) {
             std::error_code status;
             if (HasNonDirectoryPrefix_nid_no_patch(source) || (std::filesystem::exists(source, status) && HasNonDirectoryPrefix_nid_no_patch(destination))) error = 20;
         }
+#ifdef _WIN32
+        constexpr int GuestEloop = 62;
+        if (error == 2 || error == 20) {
+            if (BelowSymbolicLinkLoop(source.parent_path())) error = GuestEloop;
+            else if (SourceLookupError_nid_no_patch(source) == 0 && BelowSymbolicLinkLoop(destination.parent_path())) error = GuestEloop;
+        }
+#endif
         if (error) { errno = error; return -1; }
         RecordWrittenPath_nid_no_patch(source);
         RecordWrittenPath_nid_no_patch(destination);
diff --git a/core/libs/prx/libc/src/RuneLocale.cpp b/core/libs/prx/libc/src/RuneLocale.cpp
index da1e4ace53..f038c5cd42 100644
--- a/core/libs/prx/libc/src/RuneLocale.cpp
+++ b/core/libs/prx/libc/src/RuneLocale.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
 #include <cstddef>
@@ -109,6 +110,7 @@ int APS5_VABI iswpunct_nid_postfix(std::uint32_t c) { return GuestRune::Is(c, Gu
 int APS5_VABI iswspace_nid_postfix(std::uint32_t c) { return GuestRune::Is(c, GuestRune::Space); }
 int APS5_VABI iswupper_nid_postfix(std::uint32_t c) { return GuestRune::Is(c, GuestRune::Upper); }
 int APS5_VABI iswxdigit_nid_postfix(std::uint32_t c) { return GuestRune::Is(c, GuestRune::Hex); }
+int APS5_VABI iswascii_nid_postfix(std::uint32_t c) { return (c & ~0x7Fu) == 0; }
 int APS5_VABI iswctype_nid_postfix(std::uint32_t c, std::uint64_t mask) { return GuestRune::Is(c, mask); }
 
 int APS5_VABI _Iswctype_nid_postfix(std::uint32_t c, std::uint64_t type) {
@@ -160,10 +162,6 @@ int APS5_VABI wctob_nid_postfix(std::uint32_t c) {
     return unit < 0x80 ? static_cast<int>(unit) : -1;
 }
 
-std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t c, std::uint64_t desc);
-const short* APS5_VABI _Getptolower_nid_postfix();
-const short* APS5_VABI _Getptoupper_nid_postfix();
-
 std::uint64_t APS5_VABI wctrans_nid_postfix(const char* property) {
     if (std::strcmp(property, "tolower") == 0) return 1;
     if (std::strcmp(property, "toupper") == 0) return 2;
diff --git a/core/libs/prx/libc/src/RuntimeSupport.cpp b/core/libs/prx/libc/src/RuntimeSupport.cpp
index f7204ea7f1..dbaf710627 100644
--- a/core/libs/prx/libc/src/RuntimeSupport.cpp
+++ b/core/libs/prx/libc/src/RuntimeSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cstdio>
 #include <cstdint>
@@ -95,6 +96,15 @@ void APS5_VABI cxa_finalize_nid_postfix(void* dsoHandle) {
     CxaFinalize_nid_no_patch(dsoHandle);
 }
 
+void APS5_VABI _Vacopy_nid_postfix(unsigned char* destination, const unsigned char* source) {
+    std::uint64_t overflowArea;
+    std::memcpy(&overflowArea, source + 16, sizeof(overflowArea));
+    std::memcpy(destination + 16, &overflowArea, sizeof(overflowArea));
+    unsigned char offsets[16];
+    std::memcpy(offsets, source, sizeof(offsets));
+    std::memcpy(destination, offsets, sizeof(offsets));
+}
+
 unsigned int APS5_VABI _Atomic_fetch_add_4_nid_postfix(volatile unsigned int* target, unsigned int value, int memoryOrder) {
     (void)memoryOrder;
     return GccAtomicFetchAdd(target, value);
@@ -156,10 +166,12 @@ void APS5_VABI _Unlockfilelock_nid_postfix(FileStream* stream) {
 
 void APS5_VABI flockfile_nid_postfix(FileStream* stream) {
     _Lockfilelock_nid_postfix(stream);
+
 }
 
 void APS5_VABI funlockfile_nid_postfix(FileStream* stream) {
     _Unlockfilelock_nid_postfix(stream);
+
 }
 
 int APS5_VABI ftrylockfile_nid_postfix(FileStream* stream) {
diff --git a/core/libs/prx/libc/src/ScanningWide.cpp b/core/libs/prx/libc/src/ScanningWide.cpp
index 759e475c90..0390ecd6cb 100644
--- a/core/libs/prx/libc/src/ScanningWide.cpp
+++ b/core/libs/prx/libc/src/ScanningWide.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdarg>
 #include <cstddef>
 #include <cstdint>
@@ -22,13 +23,6 @@
 #define APS5_VA_END() va_end(args)
 #endif
 
-extern "C" int APS5_VABI iswspace_nid_postfix(std::uint32_t c);
-extern "C" std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void* state);
-extern "C" std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream);
-extern "C" int APS5_VABI ungetc_nid_postfix(int value, FileStream* stream);
-extern "C" void APS5_VABI flockfile_nid_postfix(FileStream* stream);
-extern "C" void APS5_VABI funlockfile_nid_postfix(FileStream* stream);
-
 namespace {
 
 enum class Fit { Invalid, Prefix, Valid };
@@ -321,6 +315,8 @@ private:
         case u's':
         case u'c':
         case u'[': return Text(directive);
+        case u'S':
+        case u'C': return Outcome::Matching;
         case u'n': return Count(directive);
         default: Fail("unsupported conversion " + std::to_string(directive.conversion));
         }
diff --git a/core/libs/prx/libc/src/StandardStreams.cpp b/core/libs/prx/libc/src/StandardStreams.cpp
index 2cd656f01f..b40f822753 100644
--- a/core/libs/prx/libc/src/StandardStreams.cpp
+++ b/core/libs/prx/libc/src/StandardStreams.cpp
@@ -1,18 +1,71 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
 #include <cstddef>
 #include <cstdint>
 #include <stdexcept>
 #ifdef _WIN32
+#include <fcntl.h>
 #include <io.h>
+#include <stdlib.h>
 #else
 #include <fcntl.h>
 #include <unistd.h>
 #endif
 
+#ifdef _WIN32
+extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
+#endif
+
 namespace {
-#ifndef _WIN32
+#ifdef _WIN32
+constexpr std::intptr_t NoStreamHandle = -2;
+
+std::intptr_t StandardHandle(int descriptor) {
+    const auto previous = _set_thread_local_invalid_parameter_handler([](const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {});
+    const std::intptr_t handle = ::_get_osfhandle(descriptor);
+    _set_thread_local_invalid_parameter_handler(previous);
+    return handle;
+}
+
+}
+
+extern "C" void PrepareStandardStreams_nid_no_patch() {
+    static const bool ready = [] {
+        for (int descriptor = 0; descriptor <= 2; ++descriptor) {
+            const std::intptr_t handle = StandardHandle(descriptor);
+            if (handle != -1 && handle != NoStreamHandle) continue;
+            auto* const stream = __acrt_iob_func(descriptor);
+            const int existing = ::_fileno(stream);
+            if (existing >= 0) {
+                const std::intptr_t existingHandle = StandardHandle(existing);
+                if (existingHandle != -1 && existingHandle != NoStreamHandle) {
+                    if (::_dup2(existing, descriptor) != 0)
+                        throw std::runtime_error("cannot restore a standard descriptor from its stream");
+                    continue;
+                }
+            }
+            const int opened = ::_open("NUL", (descriptor == 0 ? _O_RDONLY : _O_WRONLY) | _O_BINARY);
+            if (opened < 0) throw std::runtime_error("cannot open NUL for a missing standard descriptor");
+            if (opened > descriptor) {
+                const int moved = ::_dup2(opened, descriptor);
+                ::_close(opened);
+                if (moved != 0) throw std::runtime_error("cannot restore a missing standard descriptor");
+            }
+            if (::_fileno(stream) != descriptor && ::_close(descriptor) != 0)
+                throw std::runtime_error("cannot release a restored standard descriptor");
+            if (::_wfreopen(L"NUL", descriptor == 0 ? L"rb" : L"wb", stream) != stream || ::_fileno(stream) != descriptor)
+                throw std::runtime_error("cannot attach a standard stream to its NUL descriptor");
+        }
+        return true;
+    }();
+    static_cast<void>(ready);
+}
+
+namespace {
+#else
 const bool standardDescriptorsOpen = [] {
     for (int descriptor = 0; descriptor <= 2; ++descriptor) {
         if (::fcntl(descriptor, F_GETFD) != -1 || errno != EBADF) continue;
@@ -28,6 +81,7 @@ const bool standardDescriptorsOpen = [] {
 FileStream input{stdin};
 }
 extern "C" {
+
 FileStream* __stdinp_nid_postfix = &input;
 FileStream* __stdoutp_nid_postfix = &_Stdout_nid_postfix;
 FileStream* __stderrp_nid_postfix = &_Stderr_nid_postfix;
@@ -70,8 +124,8 @@ std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream) {
     return static_cast<std::int32_t>(code);
 }
 
-
 std::int32_t APS5_VABI ungetwc_nid_postfix(std::int32_t value, FileStream* stream) {
+    if (stream && !stream->IsOpen()) { errno = 9; return -1; }
     if (value == -1) return -1;
     if (value < 0 || value > 255) {
         errno = 86;
@@ -92,7 +146,7 @@ int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream) {
 #ifdef _WIN32
     const int result = _fgetc_nolock(native);
 #else
-    const int result = ::getc_unlocked(native);
+    const int result = getc_unlocked(native);
 #endif
     stream->SyncUnlockedStatus();
     stream->KeepDirectoryReadError(result == -1);
@@ -100,6 +154,31 @@ int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream) {
 }
 int APS5_VABI __srget_nid_postfix(FileStream* stream) { return fgetc_nid_postfix(stream); }
 int APS5_VABI getchar_nid_postfix() { return fgetc_nid_postfix(__stdinp_nid_postfix); }
+char* APS5_VABI gets_nid_postfix(char* buffer) {
+    if (buffer == nullptr) throw std::invalid_argument("gets: null buffer");
+    auto* stream = __stdinp_nid_postfix;
+    if (stream && !stream->IsOpen()) { errno = 9; return nullptr; }
+    flockfile_nid_postfix(stream);
+
+    struct Unlock {
+        FileStream* stream;
+        ~Unlock() { funlockfile_nid_postfix(stream); }
+    } unlock{stream};
+    char* cursor = buffer;
+    for (;;) {
+        const int value = fgetc_nid_postfix(stream);
+        if (value == EOF) {
+            if (cursor == buffer) return nullptr;
+            *cursor = 0;
+            return buffer;
+        }
+        if (value == '\n') {
+            *cursor = 0;
+            return buffer;
+        }
+        *cursor++ = static_cast<char>(value);
+    }
+}
 std::int32_t APS5_VABI getwc_nid_postfix(FileStream* stream) { return fgetwc_nid_postfix(stream); }
 std::int32_t APS5_VABI getwchar_nid_postfix() { return fgetwc_nid_postfix(__stdinp_nid_postfix); }
 int APS5_VABI getchar_unlocked_nid_postfix() { return getc_unlocked_nid_postfix(__stdinp_nid_postfix); }
@@ -115,7 +194,7 @@ int APS5_VABI putc_unlocked_nid_postfix(int value, FileStream* stream) {
 #ifdef _WIN32
     const int result = _fputc_nolock(value, GetNativeStream(stream));
 #else
-    const int result = ::putc_unlocked(value, GetNativeStream(stream));
+    const int result = putc_unlocked(value, GetNativeStream(stream));
 #endif
     stream->SyncUnlockedStatus();
     return result;
@@ -194,9 +273,15 @@ int APS5_VABI setvbuf_nid_postfix(FileStream* stream, char* buffer, int mode, st
         buffer = nullptr;
         size = BUFSIZ;
     }
-    return std::setvbuf(GetStreamHandle(stream), buffer, native, size);
+    auto* handle = GetStreamHandle(stream);
+#ifdef _WIN32
+    if (handle == __acrt_iob_func(1) && KeepHostStandardOutput_nid_no_patch() < 0) return -1;
+    if (handle == __acrt_iob_func(2) && KeepHostStandardError_nid_no_patch() < 0) return -1;
+#endif
+    return std::setvbuf(handle, buffer, native, size);
 }
 void APS5_VABI setbuf_nid_postfix(FileStream* stream, char* buffer) {
     setvbuf_nid_postfix(stream, buffer, buffer ? 0 : 2, buffer ? 1024 : 0);
+
 }
 }
diff --git a/core/libs/prx/libc/src/StdioExtras.cpp b/core/libs/prx/libc/src/StdioExtras.cpp
index 28b5f7b33b..f6ebcc9784 100644
--- a/core/libs/prx/libc/src/StdioExtras.cpp
+++ b/core/libs/prx/libc/src/StdioExtras.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
@@ -18,8 +19,6 @@
 
 namespace {
 
-using GuestNewHandler = void (APS5_VABI*)();
-
 std::atomic<GuestNewHandler> g_newHandler{nullptr};
 
 void* Allocate(std::size_t size) {
@@ -83,9 +82,8 @@ int APS5_VABI sprintf_s_nid_postfix(char* buffer, size_t size, const char* forma
 }
 
 // Only the "C" locale exists.
-const char* APS5_VABI setlocale_nid_postfix(int category, const char* locale) {
-    if (category < 0 || category > 6) return nullptr;
-    if (locale == nullptr || locale[0] == 0 || std::strcmp(locale, "C") == 0 || std::strcmp(locale, "POSIX") == 0) return "C";
+const char* APS5_VABI setlocale_nid_postfix(int, const char* locale) {
+    if (locale == nullptr || locale[0] == 0 || std::strcmp(locale, "C") == 0) return "C";
     return nullptr;
 }
 
@@ -131,6 +129,11 @@ void APS5_VABI _ZdlPv_nid_postfix(void* pointer) {
     if (pointer != nullptr) ApplicationHeapFree_nid_no_patch(pointer);
 }
 
+void APS5_VABI _ZdlPvRKSt9nothrow_t_nid_postfix(void* pointer, const void*) noexcept {
+    _ZdlPv_nid_postfix(pointer);
+
+}
+
 void APS5_VABI _ZdaPv_nid_postfix(void* pointer) {
     if (pointer != nullptr) ApplicationHeapFree_nid_no_patch(pointer);
 }
diff --git a/core/libs/prx/libc/src/StringExtensions.cpp b/core/libs/prx/libc/src/StringExtensions.cpp
index 18b9cb6f18..35eed9a5f4 100644
--- a/core/libs/prx/libc/src/StringExtensions.cpp
+++ b/core/libs/prx/libc/src/StringExtensions.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -169,7 +170,6 @@ char* APS5_VABI strtok_nid_postfix(char* text, const char* delimiters) {
     return strtok_r_nid_postfix(text, delimiters, &state);
 }
 
-
 int APS5_VABI __inet_aton_nid_postfix(const char* text, void* address) {
     std::uint8_t parts[3];
     std::size_t count = 0;
diff --git a/core/libs/prx/libc/src/Strings.cpp b/core/libs/prx/libc/src/Strings.cpp
index b3d173267a..508da2aa04 100644
--- a/core/libs/prx/libc/src/Strings.cpp
+++ b/core/libs/prx/libc/src/Strings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cstddef>
 #include <cstdint>
@@ -20,6 +21,16 @@ int CompareUnits(char16_t left, char16_t right) {
     return left < right ? -1 : 1;
 }
 
+int ByteDifference(const void* s1, const void* s2, size_t n, bool stopAtNul) {
+    const auto* left = static_cast<const unsigned char*>(s1);
+    const auto* right = static_cast<const unsigned char*>(s2);
+    for (size_t index = 0; index < n; ++index) {
+        if (left[index] != right[index]) return left[index] - right[index];
+        if (stopAtNul && left[index] == 0) return 0;
+    }
+    return 0;
+}
+
 bool Contains(const char16_t* set, char16_t character) {
     for (; *set != 0; ++set) {
         if (*set == character) return true;
@@ -153,7 +164,7 @@ TFloat NanValue(const NanSubject& subject, const char*& end) {
         return std::bit_cast<double>((subject.negative ? 0x8000000000000000ull : 0) | 0x7ff8000000000000ull | payload);
     } else if constexpr (std::is_same_v<TFloat, float>) {
         end = NanSequenceEnd(subject.tail);
-        return std::bit_cast<float>(0x7fc00000u);
+        return std::bit_cast<float>((subject.negative ? 0x80000000u : 0) | 0x7fc00000u);
     } else {
         end = NanSequenceEnd(subject.tail);
         TFloat value{};
@@ -187,7 +198,36 @@ TFloat ParseFloat(const char* text, char** end, TFloat (*parse)(const char*, cha
     const TFloat value = parse(text, &parsedEnd);
     if (errno == ERANGE && value != 0 && (value < 0 ? -value : value) < std::numeric_limits<TFloat>::min()) errno = saved;
     if (end != nullptr) *end = parsedEnd;
-    return parsedEnd == text ? TFloat{0} : value;
+    const char* subject = text;
+    while (std::isspace(static_cast<unsigned char>(*subject))) ++subject;
+    if (parsedEnd == text) {
+        if (subject[0] != '-') return TFloat{0};
+        if constexpr (std::is_same_v<TFloat, float>) return subject[1] == '\0' ? TFloat{0} : -TFloat{0};
+        const bool special = std::strchr("iInN", subject[1]) != nullptr && subject[1] != '\0';
+        return std::is_same_v<TFloat, long double> && !special ? -TFloat{0} : TFloat{0};
+    }
+    if (*subject == '+' || *subject == '-') ++subject;
+    const bool hexadecimal = subject[0] == '0' && (subject[1] == 'x' || subject[1] == 'X') && parsedEnd > subject + 2;
+    if constexpr (std::is_same_v<TFloat, float>) {
+        const float magnitude = value < 0 ? -value : value;
+        if (value != 0 && magnitude < std::numeric_limits<float>::min()) {
+            const long double exact = std::strtold(text, nullptr);
+            const bool roundedUp = magnitude == std::numeric_limits<float>::denorm_min() && (exact < 0 ? -exact : exact) < magnitude;
+            errno = hexadecimal ? (roundedUp ? ERANGE : saved) : (static_cast<long double>(value) != exact ? ERANGE : saved);
+        }
+        return value;
+    }
+    if (!hexadecimal) return value;
+    if constexpr (std::is_same_v<TFloat, double>) {
+        constexpr double smallest = std::numeric_limits<double>::denorm_min();
+        if ((value < 0 ? -value : value) == smallest) {
+            const long double exact = std::strtold(text, nullptr);
+            if ((exact < 0 ? -exact : exact) < smallest) errno = ERANGE;
+        }
+    } else if (errno == ERANGE) {
+        errno = saved;
+    }
+    return value;
 }
 
 }
@@ -216,7 +256,7 @@ void* APS5_VABI memmove_nid_postfix(void* dest, const void* src, size_t n) {
 }
 
 int APS5_VABI memcmp_nid_postfix(const void* s1, const void* s2, size_t n) {
-    return std::memcmp(s1, s2, n);
+    return std::memcmp(s1, s2, n) == 0 ? 0 : ByteDifference(s1, s2, n, false);
 }
 
 const void* APS5_VABI memchr_nid_postfix(const void* s, int c, size_t n) {
@@ -260,11 +300,11 @@ void* APS5_VABI memmem_nid_postfix(const void* haystack, size_t haystacklen, con
 }
 
 int APS5_VABI strcmp_nid_postfix(const char* s1, const char* s2) {
-    return std::strcmp(s1, s2);
+    return std::strcmp(s1, s2) == 0 ? 0 : ByteDifference(s1, s2, std::numeric_limits<size_t>::max(), true);
 }
 
 int APS5_VABI strncmp_nid_postfix(const char* s1, const char* s2, size_t n) {
-    return std::strncmp(s1, s2, n);
+    return std::strncmp(s1, s2, n) == 0 ? 0 : ByteDifference(s1, s2, n, true);
 }
 
 size_t APS5_VABI strlen_nid_postfix(const char* s) {
@@ -418,22 +458,21 @@ char16_t* APS5_VABI wmemmove_nid_postfix(char16_t* dest, const char16_t* src, si
 
 }
 
-
 extern "C" {
 
 int APS5_VABI strcasecmp_nid_postfix(const char* s1, const char* s2) {
     for (;; ++s1, ++s2) {
-        const int a = std::tolower(static_cast<unsigned char>(*s1));
-        const int b = std::tolower(static_cast<unsigned char>(*s2));
-        if (a != b || *s1 == 0) return a - b;
+        const int a = tolower_nid_postfix(static_cast<unsigned char>(*s1));
+        const int b = tolower_nid_postfix(static_cast<unsigned char>(*s2));
+        if (a != b || *s1 == 0) return (a > b) - (a < b);
     }
 }
 
 int APS5_VABI strncasecmp_nid_postfix(const char* s1, const char* s2, size_t n) {
     for (; n != 0; ++s1, ++s2, --n) {
-        const int a = std::tolower(static_cast<unsigned char>(*s1));
-        const int b = std::tolower(static_cast<unsigned char>(*s2));
-        if (a != b) return a - b;
+        const int a = tolower_nid_postfix(static_cast<unsigned char>(*s1));
+        const int b = tolower_nid_postfix(static_cast<unsigned char>(*s2));
+        if (a != b) return a < b ? -1 : 1;
         if (*s1 == 0) break;
     }
     return 0;
@@ -448,7 +487,11 @@ size_t APS5_VABI strspn_nid_postfix(const char* s, const char* accept) {
 }
 
 int APS5_VABI strcoll_nid_postfix(const char* s1, const char* s2) {
-    return std::strcmp(s1, s2);
+    for (;; ++s1, ++s2) {
+        const int a = static_cast<unsigned char>(*s1);
+        const int b = static_cast<unsigned char>(*s2);
+        if (a != b || a == 0) return a - b;
+    }
 }
 
 int APS5_VABI strncpy_s_nid_postfix(char* dest, size_t destsz, const char* src, size_t count) {
@@ -780,6 +823,7 @@ int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_
     if (destsz > RsizeMax) return GuestErange;
     if (!src || count > destsz) {
         wmemset_nid_postfix(dest, 0, destsz);
+
         return src ? GuestErange : GuestEinval;
     }
     const auto destination = reinterpret_cast<std::uintptr_t>(dest);
@@ -787,6 +831,7 @@ int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_
     const auto distance = destination < source ? source - destination : destination - source;
     if (count != 0 && distance < count * sizeof(char16_t)) {
         wmemset_nid_postfix(dest, 0, destsz);
+
         return GuestEinval;
     }
     if (count != 0) std::memcpy(dest, src, count * sizeof(char16_t));
@@ -801,6 +846,7 @@ int APS5_VABI wmemmove_s_nid_postfix(char16_t* dest, size_t destsz, const char16
     if (destsz > RsizeMax) return GuestErange;
     if (!src || count > destsz) {
         wmemset_nid_postfix(dest, 0, destsz);
+
         return src ? GuestErange : GuestEinval;
     }
     if (count != 0) std::memmove(dest, src, count * sizeof(char16_t));
@@ -863,8 +909,8 @@ int APS5_VABI wcsncat_s_nid_postfix(char16_t* dest, size_t destsz, const char16_
     }
     const auto destination = reinterpret_cast<std::uintptr_t>(dest + used);
     const auto source = reinterpret_cast<std::uintptr_t>(src);
-    const auto distance = destination < source ? source - destination : destination - source;
-    if (length != 0 && distance < (length + 1) * sizeof(char16_t)) {
+    const auto bytes = length * sizeof(char16_t);
+    if (destination < source + bytes && source < destination + bytes) {
         dest[0] = 0;
         return GuestEinval;
     }
diff --git a/core/libs/prx/libc/src/Syslog.cpp b/core/libs/prx/libc/src/Syslog.cpp
index a94f34e141..137566b52f 100644
--- a/core/libs/prx/libc/src/Syslog.cpp
+++ b/core/libs/prx/libc/src/Syslog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdarg>
@@ -13,12 +14,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t length);
-int APS5_VABI vsnprintf_nid_postfix(char* buffer, std::size_t size, const char* format, VaList* args);
-}
-
 namespace {
 constexpr int priorityMask = 0x07;
 constexpr int facilityMask = 0x3f8;
@@ -57,6 +52,7 @@ std::string ExpandErrorText(const char* format, int error) {
         if (cursor[0] == '%' && cursor[1] == 'm') {
             char text[128];
             strerror_r_nid_postfix(error, text, sizeof(text));
+
             for (const char* character = text; *character; ++character) {
                 expanded += *character;
                 if (*character == '%') expanded += '%';
@@ -82,6 +78,7 @@ std::string Format(const char* format, VaList* args) {
     if (size <= 0) return {};
     std::string buffer(static_cast<std::size_t>(size) + 1, '\0');
     vsnprintf_nid_postfix(buffer.data(), buffer.size(), format, args);
+
     buffer.resize(static_cast<std::size_t>(size));
     return buffer;
 #endif
@@ -135,6 +132,7 @@ void APS5_VABI syslog_nid_postfix(int priority, const char* format, ...) {
     va_start(args, format);
 #endif
     vsyslog_nid_postfix(priority, format, reinterpret_cast<VaList*>(args));
+
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
diff --git a/core/libs/prx/libc/src/Threads.cpp b/core/libs/prx/libc/src/Threads.cpp
index a00ba39463..7b67acbcdb 100644
--- a/core/libs/prx/libc/src/Threads.cpp
+++ b/core/libs/prx/libc/src/Threads.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/General.hpp"
 #ifdef _WIN32
@@ -26,11 +27,6 @@
 
 namespace {
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
 constexpr std::int64_t nanosPerSecond = 1000000000;
 constexpr std::int64_t longestSleepSeconds = 86400;
 
@@ -52,11 +48,27 @@ timespec XtimeDeadline(const Xtime& time, const char* function) {
     return {static_cast<time_t>(seconds), static_cast<long>(nanos)};
 }
 
+std::chrono::system_clock::time_point XtimePoint(const Xtime& time, const char* function) {
+    const auto deadline = XtimeDeadline(time, function);
+    constexpr auto maxDuration = std::chrono::system_clock::duration::max();
+    constexpr auto minDuration = std::chrono::system_clock::duration::min();
+    constexpr auto maxSeconds = std::chrono::duration_cast<std::chrono::seconds>(maxDuration).count();
+    constexpr auto minSeconds = std::chrono::duration_cast<std::chrono::seconds>(minDuration).count();
+    constexpr auto maxNanos = std::chrono::duration_cast<std::chrono::nanoseconds>(maxDuration - std::chrono::seconds(maxSeconds)).count();
+    if (deadline.tv_sec > maxSeconds || (deadline.tv_sec == maxSeconds && deadline.tv_nsec > maxNanos) ||
+        deadline.tv_sec < minSeconds)
+        throw std::overflow_error(std::string(function) + ": xtime seconds overflow");
+    return std::chrono::system_clock::time_point(
+        std::chrono::seconds(deadline.tv_sec) +
+        std::chrono::ceil<std::chrono::system_clock::duration>(std::chrono::nanoseconds(deadline.tv_nsec)));
+}
+
 constexpr int threadSuccess = 0;
 constexpr int threadNomem = 1;
 constexpr int threadTimedout = 2;
 constexpr int threadBusy = 3;
 constexpr int threadError = 4;
+constexpr int threadTimedlockError = 5;
 
 constexpr int mutexRecursive = 0x100;
 
@@ -76,14 +88,61 @@ struct DinkumwareNativeMutex {
     void lock() { EnterCriticalSection(&value); }
     void unlock() { LeaveCriticalSection(&value); }
     bool try_lock() { return TryEnterCriticalSection(&value) != FALSE; }
+
+    template<class Clock, class Duration>
+    bool try_lock_until(const std::chrono::time_point<Clock, Duration>& deadline) {
+        if (try_lock())
+            return true;
+        for (;;) {
+            const auto now = Clock::now();
+            if (now >= deadline)
+                return false;
+            const auto remaining = std::chrono::ceil<std::chrono::milliseconds>(deadline - now).count();
+            Sleep(static_cast<DWORD>(std::min<std::int64_t>(remaining, 1)));
+            if (try_lock()) {
+                if (Clock::now() <= deadline)
+                    return true;
+                unlock();
+                return false;
+            }
+        }
+    }
 };
 
 struct DinkumwareNativeCondition {
     CONDITION_VARIABLE value = CONDITION_VARIABLE_INIT;
+
+    void notify_one() { WakeConditionVariable(&value); }
+    void notify_all() { WakeAllConditionVariable(&value); }
+
+    void wait(std::unique_lock<DinkumwareNativeMutex>& lock) {
+        if (SleepConditionVariableCS(&value, &lock.mutex()->value, INFINITE) == FALSE)
+            throw std::system_error(static_cast<int>(GetLastError()), std::system_category(), "_Cnd_wait: condition wait failed");
+    }
+
+    template<class Clock, class Duration>
+    std::cv_status wait_until(std::unique_lock<DinkumwareNativeMutex>& lock,
+                              const std::chrono::time_point<Clock, Duration>& deadline) {
+        for (;;) {
+            const auto now = Clock::now();
+            if (now >= deadline)
+                return std::cv_status::timeout;
+            const auto remaining = std::chrono::ceil<std::chrono::milliseconds>(deadline - now).count();
+            const auto largest = static_cast<std::int64_t>(std::numeric_limits<DWORD>::max() - 1U);
+            const auto milliseconds = static_cast<DWORD>(std::min<std::int64_t>(remaining, largest));
+            if (SleepConditionVariableCS(&value, &lock.mutex()->value, milliseconds) != FALSE)
+                return std::cv_status::no_timeout;
+            const DWORD error = GetLastError();
+            if (error != ERROR_TIMEOUT)
+                throw std::system_error(static_cast<int>(error), std::system_category(), "_Cnd_timedwait: condition wait failed");
+            if (Clock::now() >= deadline)
+                return std::cv_status::timeout;
+        }
+    }
 };
 #else
-using DinkumwareNativeMutex = std::mutex;
-using DinkumwareNativeCondition = std::condition_variable;
+using DinkumwareNativeMutex = std::timed_mutex;
+using DinkumwareNativeCondition = std::condition_variable_any;
 #endif
 
 struct DinkumwareMutex {
@@ -99,32 +158,6 @@ struct DinkumwareCondition {
     DinkumwareNativeCondition native;
 };
 
-#ifdef _WIN32
-DWORD WaitMillisecondsUntil(std::chrono::system_clock::time_point deadline) {
-    const auto now = std::chrono::system_clock::now();
-    if (now >= deadline)
-        return 0;
-    const auto remaining = std::chrono::ceil<std::chrono::milliseconds>(deadline - now).count();
-    constexpr auto largest = static_cast<std::int64_t>(std::numeric_limits<DWORD>::max() - 1U);
-    return static_cast<DWORD>(std::min<std::int64_t>(remaining, largest));
-}
-
-bool WaitUntil(DinkumwareCondition* condition, DinkumwareMutex* mutex, std::chrono::system_clock::time_point deadline) {
-    for (;;) {
-        const DWORD milliseconds = WaitMillisecondsUntil(deadline);
-        if (milliseconds == 0)
-            return false;
-        if (SleepConditionVariableCS(&condition->native.value, &mutex->native.value, milliseconds) != FALSE)
-            return true;
-        const DWORD error = GetLastError();
-        if (error != ERROR_TIMEOUT)
-            throw std::system_error(static_cast<int>(error), std::system_category(), "_Cnd_timedwait: condition wait failed");
-        if (std::chrono::system_clock::now() >= deadline)
-            return false;
-    }
-}
-#endif
-
 DinkumwareMutex* ResolveMutex(void** handle, const char* function) {
     if (!handle)
         throw std::invalid_argument(std::string(function) + ": null mutex handle pointer");
@@ -223,6 +256,31 @@ int APS5_VABI _Mtx_trylock_nid_postfix(void** handle) {
     return threadSuccess;
 }
 
+int APS5_VABI _Mtx_timedlock_nid_postfix(void** handle, const Xtime* target) {
+    if (!target)
+        APS5_INVALID_ARG_EX;
+    const auto deadline = XtimePoint(*target, "_Mtx_timedlock");
+    auto* mutex = ResolveMutex(handle, "_Mtx_timedlock");
+    const auto self = std::this_thread::get_id();
+    if (mutex->owner.load(std::memory_order_acquire) == self) {
+        if ((mutex->type & mutexRecursive) == 0)
+            return threadBusy;
+        if (mutex->count == std::numeric_limits<int>::max())
+            throw std::overflow_error("_Mtx_timedlock: recursive lock count overflow");
+        ++mutex->count;
+        return threadSuccess;
+    }
+    try {
+        if (!mutex->native.try_lock_until(deadline))
+            return threadTimedout;
+    } catch (const std::system_error&) {
+        return threadTimedlockError;
+    }
+    mutex->owner.store(self, std::memory_order_release);
+    mutex->count = 1;
+    return threadSuccess;
+}
+
 int APS5_VABI _Mtx_unlock_nid_postfix(void** handle) {
     auto* mutex = ResolveMutex(handle, "_Mtx_unlock");
     if (!IsOwnedByCaller(mutex))
@@ -271,12 +329,7 @@ int APS5_VABI _Cnd_wait_nid_postfix(void** conditionHandle, void** mutexHandle)
     mutex->owner.store(std::thread::id{}, std::memory_order_release);
     std::unique_lock lock(mutex->native, std::adopt_lock);
     try {
-#ifdef _WIN32
-        if (SleepConditionVariableCS(&condition->native.value, &mutex->native.value, INFINITE) == FALSE)
-            throw std::system_error(static_cast<int>(GetLastError()), std::system_category(), "_Cnd_wait: condition wait failed");
-#else
         condition->native.wait(lock);
-#endif
     } catch (const std::system_error&) {
         lock.release();
         mutex->owner.store(std::this_thread::get_id(), std::memory_order_release);
@@ -292,15 +345,7 @@ int APS5_VABI _Cnd_wait_nid_postfix(void** conditionHandle, void** mutexHandle)
 int APS5_VABI _Cnd_timedwait_nid_postfix(void** conditionHandle, void** mutexHandle, const Xtime* target) {
     if (!target)
         APS5_INVALID_ARG_EX;
-    const auto deadline = XtimeDeadline(*target, "_Cnd_timedwait");
-    constexpr auto maxDuration = std::chrono::system_clock::duration::max();
-    constexpr auto minDuration = std::chrono::system_clock::duration::min();
-    constexpr auto maxSeconds = std::chrono::duration_cast<std::chrono::seconds>(maxDuration).count();
-    constexpr auto minSeconds = std::chrono::duration_cast<std::chrono::seconds>(minDuration).count();
-    constexpr auto maxNanos = std::chrono::duration_cast<std::chrono::nanoseconds>(maxDuration - std::chrono::seconds(maxSeconds)).count();
-    if (deadline.tv_sec > maxSeconds || (deadline.tv_sec == maxSeconds && deadline.tv_nsec > maxNanos) ||
-        deadline.tv_sec < minSeconds)
-        throw std::overflow_error("_Cnd_timedwait: xtime seconds overflow");
+    const auto deadlineTime = XtimePoint(*target, "_Cnd_timedwait");
     auto* condition = ResolveCondition(conditionHandle, "_Cnd_timedwait");
     auto* mutex = ResolveMutex(mutexHandle, "_Cnd_timedwait");
     if (!IsOwnedByCaller(mutex))
@@ -312,14 +357,7 @@ int APS5_VABI _Cnd_timedwait_nid_postfix(void** conditionHandle, void** mutexHan
     std::unique_lock lock(mutex->native, std::adopt_lock);
     bool timeout = false;
     try {
-        const auto deadlineTime = std::chrono::system_clock::time_point(
-            std::chrono::seconds(deadline.tv_sec) +
-            std::chrono::ceil<std::chrono::system_clock::duration>(std::chrono::nanoseconds(deadline.tv_nsec)));
-#ifdef _WIN32
-        timeout = !WaitUntil(condition, mutex, deadlineTime);
-#else
         timeout = (condition->native.wait_until(lock, deadlineTime) == std::cv_status::timeout);
-#endif
     } catch (const std::system_error&) {
         lock.release();
         mutex->owner.store(std::this_thread::get_id(), std::memory_order_release);
@@ -333,23 +371,19 @@ int APS5_VABI _Cnd_timedwait_nid_postfix(void** conditionHandle, void** mutexHan
 }
 
 int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle) {
-#ifdef _WIN32
-    WakeAllConditionVariable(&ResolveCondition(handle, "_Cnd_broadcast")->native.value);
-#else
     ResolveCondition(handle, "_Cnd_broadcast")->native.notify_all();
-#endif
     return threadSuccess;
 }
 
 int SignalCondition_nid_no_patch(void** handle) {
-#ifdef _WIN32
-    WakeConditionVariable(&ResolveCondition(handle, "_Cnd_signal")->native.value);
-#else
     ResolveCondition(handle, "_Cnd_signal")->native.notify_one();
-#endif
     return threadSuccess;
 }
 
+unsigned APS5_VABI _ZNSt6thread20hardware_concurrencyEv_nid_postfix() {
+    return std::thread::hardware_concurrency();
+}
+
 int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime*) {
     if (!target)
         APS5_INVALID_ARG_EX;
@@ -379,18 +413,15 @@ int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime*) {
     }
 }
 
+int APS5_VABI _Thrd_yield_nid_postfix() {
+    std::this_thread::yield();
+    return threadSuccess;
+}
 
 int APS5_VABI _Cnd_signal_nid_postfix(void** handle) {
     return SignalCondition_nid_no_patch(handle);
 }
 
-struct GuestPad {
-    unsigned (APS5_VABI* const* vtable)(GuestPad*);
-    void* condition;
-    void* mutex;
-    bool started;
-};
-
 static_assert(offsetof(GuestPad, condition) == 0x8 && offsetof(GuestPad, mutex) == 0x10 && offsetof(GuestPad, started) == 0x18 && sizeof(GuestPad) == 0x20);
 
 [[noreturn]] void ThrowCppError_nid_no_patch(int code);
@@ -438,6 +469,7 @@ void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad) {
     const int created = _Mtx_init_nid_postfix(&pad->mutex, 1);
     if (created != threadSuccess) {
         _Cnd_destroy_nid_postfix(&pad->condition);
+
         RequireThrd(created, "_Pad::_Pad: _Mtx_init");
     }
     pad->started = false;
@@ -445,6 +477,7 @@ void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad) {
     if (locked != threadSuccess) {
         _Mtx_destroy_nid_postfix(&pad->mutex);
         _Cnd_destroy_nid_postfix(&pad->condition);
+
         RequireThrd(locked, "_Pad::_Pad: _Mtx_lock");
     }
 }
@@ -454,6 +487,7 @@ void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(GuestPad* pad) {
     RequireThrd(_Mtx_unlock_nid_postfix(&pad->mutex), "_Pad::~_Pad: _Mtx_unlock");
     _Mtx_destroy_nid_postfix(&pad->mutex);
     _Cnd_destroy_nid_postfix(&pad->condition);
+
 }
 
 void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(GuestPad* pad) {
@@ -464,15 +498,23 @@ void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(GuestPad* pad) {
     RequireThrd(_Mtx_unlock_nid_postfix(&pad->mutex), "_Pad::_Release: _Mtx_unlock");
 }
 
-void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(GuestPad* pad, void** thread) {
+static void LaunchPad_nid_no_patch(GuestPad* pad, void** attrSlot, void** thread) {
     if (!pad || !thread) APS5_INVALID_ARG_EX;
     const auto create = registeredPthreadCreate.load(std::memory_order_acquire);
     if (!create) throw std::runtime_error("_Pad::_Launch: pthread_create is not registered");
-    const int created = create(thread, nullptr, PadEntry_nid_no_patch, pad);
+    const int created = create(thread, attrSlot, PadEntry_nid_no_patch, pad);
     if (created != 0) ThrowCppError_nid_no_patch(6);
     while (!pad->started) RequireThrd(_Cnd_wait_nid_postfix(&pad->condition, &pad->mutex), "_Pad::_Launch: _Cnd_wait");
 }
 
+void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(GuestPad* pad, void** thread) {
+    LaunchPad_nid_no_patch(pad, nullptr, thread);
+}
+
+void APS5_VABI _ZNSt4_Pad7_LaunchEPP12pthread_attrPP7pthread_nid_postfix(GuestPad* pad, void** attrSlot, void** thread) {
+    LaunchPad_nid_no_patch(pad, attrSlot, thread);
+}
+
 int APS5_VABI _Thrd_join_nid_postfix(void* thread, int* code) {
     const auto join = registeredPthreadJoin.load(std::memory_order_acquire);
     if (!join) throw std::runtime_error("_Thrd_join: pthread_join is not registered");
@@ -488,11 +530,6 @@ int APS5_VABI _Thrd_detach_nid_postfix(void* thread) {
     return detach(thread) == 0 ? threadSuccess : threadError;
 }
 
-int APS5_VABI _Thrd_id_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 [[noreturn]] void APS5_VABI _ZSt16_Throw_Cpp_errori_nid_postfix(int code) {
     ThrowCppError_nid_no_patch(code);
 }
@@ -537,6 +574,10 @@ void* APS5_VABI _Thrd_current_nid_postfix(void) {
     return ThreadForwards(__func__).self();
 }
 
+void* APS5_VABI _Thrd_id_nid_postfix(void) {
+    return ThreadForwards(__func__).self();
+}
+
 [[noreturn]] void APS5_VABI _Thrd_exit_nid_postfix(int code) {
     ThreadForwards(__func__).exit(reinterpret_cast<void*>(static_cast<std::uintptr_t>(static_cast<unsigned int>(code))));
     std::abort();
@@ -546,5 +587,122 @@ int APS5_VABI _Mtx_current_owns_nid_postfix(void**) {
     return 1;
 }
 
+static std::atomic<const PthreadSyncForwards_nid_no_patch*> registeredPthreadSyncForwards{nullptr};
+
+void RegisterPthreadSyncForwards_nid_no_patch(const PthreadSyncForwards_nid_no_patch* forwards) {
+    registeredPthreadSyncForwards.store(forwards, std::memory_order_release);
 }
 
+static const PthreadSyncForwards_nid_no_patch& PthreadSync(const char* function) {
+    const auto* forwards = registeredPthreadSyncForwards.load(std::memory_order_acquire);
+    if (!forwards) throw std::runtime_error(std::string(function) + ": libkernel synchronization is not registered");
+    return *forwards;
+}
+
+constexpr int KernelDeadlock = static_cast<int>(0x8002000b);
+constexpr int KernelNoMemory = static_cast<int>(0x8002000c);
+constexpr int KernelBusy = static_cast<int>(0x80020010);
+constexpr int RecursiveMutexType = 0x100;
+constexpr int KernelRecursiveMutex = 2;
+
+static int CreateResult(int result) {
+    if (result == 0) return threadSuccess;
+    return result == KernelNoMemory ? threadNomem : threadError;
+}
+
+static const char* SyncObjectName(const char* name) {
+    return name != nullptr && name[0] != '\0' ? name : nullptr;
+}
+
+int APS5_VABI _ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(void** mutex, int type, const char* name) {
+    const auto& sync = PthreadSync(__func__);
+    *mutex = nullptr;
+    void* attr = nullptr;
+    const int created = sync.mutexattrInit(&attr);
+    if (created != 0) return CreateResult(created);
+    if ((type & RecursiveMutexType) != 0 && sync.mutexattrSettype(&attr, KernelRecursiveMutex) != 0) {
+        sync.mutexattrDestroy(&attr);
+        return threadError;
+    }
+    const int initialized = sync.mutexInit(mutex, &attr, SyncObjectName(name));
+    const int released = sync.mutexattrDestroy(&attr);
+    if (initialized != 0) return CreateResult(initialized);
+    if (released != 0) {
+        sync.mutexDestroy(mutex);
+        return threadError;
+    }
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(void** mutex, int type) {
+    return _ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(mutex, type, "SceLibcI_Mtx");
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(void** mutex) {
+    return PthreadSync(__func__).mutexDestroy(mutex);
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(void** mutex) {
+    const int result = PthreadSync(__func__).mutexLock(mutex);
+    if (result == 0) return threadSuccess;
+    return result == KernelDeadlock ? threadBusy : threadError;
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(void** mutex) {
+    const int result = PthreadSync(__func__).mutexTrylock(mutex);
+    if (result == 0) return threadSuccess;
+    return result == KernelBusy ? threadBusy : threadError;
+}
+
+int APS5_VABI _ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(void** mutex) {
+    PthreadSync(__func__).mutexUnlock(mutex);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v219_Cnd_init_with_nameEPP12pthread_condPKc_nid_postfix(void** condition, const char* name) {
+    return CreateResult(PthreadSync(__func__).condInit(condition, nullptr, SyncObjectName(name)));
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(void** condition) {
+    return CreateResult(PthreadSync(__func__).condInit(condition, nullptr, "SceLibcI_Cnd"));
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(void** condition) {
+    return PthreadSync(__func__).condDestroy(condition);
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(void** condition, void** mutex) {
+    PthreadSync(__func__).condWait(condition, mutex);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v211_Cnd_signalEPP12pthread_cond_nid_postfix(void** condition) {
+    PthreadSync(__func__).condSignal(condition);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v214_Cnd_broadcastEPP12pthread_cond_nid_postfix(void** condition) {
+    PthreadSync(__func__).condBroadcast(condition);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(void* thread) {
+    return PthreadSync(__func__).detach(thread) == 0 ? threadSuccess : threadError;
+}
+
+int APS5_VABI _ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(void* thread, int* code) {
+    void* result = nullptr;
+    if (PthreadSync(__func__).join(thread, &result) != 0) return threadError;
+    if (code) *code = static_cast<int>(reinterpret_cast<std::intptr_t>(result));
+    return threadSuccess;
+}
+
+void APS5_VABI _ZNSt8__sce_v211_Thrd_yieldEv_nid_postfix() {
+    PthreadSync(__func__).yield();
+}
+
+void* APS5_VABI _ZNSt8__sce_v28_Thrd_idEv_nid_postfix() {
+    return _Thrd_current_nid_postfix();
+}
+
+}
diff --git a/core/libs/prx/libc/src/Time.cpp b/core/libs/prx/libc/src/Time.cpp
index a864b55fa2..14a1b8bc68 100644
--- a/core/libs/prx/libc/src/Time.cpp
+++ b/core/libs/prx/libc/src/Time.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cerrno>
@@ -20,6 +21,7 @@
 #include "prx/libc/include/SonyCrt.hpp"
 
 extern "C" char* tzname_nid_postfix[2];
+extern "C" int64_t timezone_nid_postfix;
 
 namespace {
 
@@ -101,7 +103,11 @@ std::tm toHostTm(const GuestTm& guest) {
     host.tm_isdst = guest.tm_isdst;
 #ifndef _WIN32
     host.tm_gmtoff = static_cast<long>(guest.tm_gmtoff);
+#ifdef __APPLE__
+    host.tm_zone = const_cast<char*>(guest.tm_zone);
+#else
     host.tm_zone = guest.tm_zone;
+#endif
 #endif
     return host;
 }
@@ -157,8 +163,6 @@ const bool timeZoneFixed = [] {
 }  // namespace
 #endif
 
-extern "C" int64_t APS5_VABI libc_mktime_nid_postfix(GuestTm* timeptr);
-
 namespace {
 
 bool setHostZone(const char* zone) {
@@ -183,6 +187,7 @@ std::recursive_mutex& zoneMutex() {
 }
 
 char** HostZoneNames();
+char* GuestZoneName(int index);
 
 void applyGuestZone() {
     static bool initialized = false;
@@ -205,9 +210,8 @@ void applyGuestZone() {
 #else
     ::tzset();
 #endif
-    char** names = HostZoneNames();
-    tzname_nid_postfix[0] = names[0];
-    tzname_nid_postfix[1] = names[1];
+    tzname_nid_postfix[0] = GuestZoneName(0);
+    tzname_nid_postfix[1] = GuestZoneName(1);
 }
 
 int& zoneDepth() {
@@ -240,19 +244,6 @@ constexpr const char* MONTH_FULL_NAMES[] = {"January", "February", "March", "Apr
     "October", "November", "December"};
 constexpr int YEAR_BASE = 1900;
 
-enum class Padding { Default, Less, Space, Zero };
-
-const char* paddingFormat(int width, Padding padding, bool spaced) {
-    static constexpr const char* formats[][4] = {
-        {"%02d", "%d", "%2d", "%02d"},
-        {"%2d", "%d", "%2d", "%02d"},
-        {"%03d", "%d", "%3d", "%03d"},
-        {"%04d", "%d", "%4d", "%04d"},
-    };
-    const int row = width == 2 ? (spaced ? 1 : 0) : width == 3 ? 2 : 3;
-    return formats[row][static_cast<int>(padding)];
-}
-
 bool isLeapYearSum(int year, int base) {
     return isLeapYear(year % 400 + base % 400);
 }
@@ -260,248 +251,151 @@ bool isLeapYearSum(int year, int base) {
 struct FormatBuffer {
     char* cursor;
     char* limit;
+    bool full;
 };
 
-void addText(FormatBuffer& buffer, const char* text) {
-    while (buffer.cursor < buffer.limit && (*buffer.cursor = *text++) != '\0') ++buffer.cursor;
+void addPiece(FormatBuffer& buffer, const char* text, std::size_t length) {
+    if (buffer.full) return;
+    if (length > static_cast<std::size_t>(buffer.limit - buffer.cursor)) {
+        buffer.full = true;
+        return;
+    }
+    std::memcpy(buffer.cursor, text, length);
+    buffer.cursor += length;
 }
 
-void addNumber(FormatBuffer& buffer, int value, const char* format) {
+void addText(FormatBuffer& buffer, const char* text) {
+    addPiece(buffer, text, std::strlen(text));
+}
+
+int clampedField(std::int64_t value, int modulus) {
+    return value < 0 ? 0 : static_cast<int>(value % modulus);
+}
+
+void addNumber(FormatBuffer& buffer, std::int64_t value, int modulus, const char* format) {
     char text[16];
-    std::snprintf(text, sizeof(text), format, value);
+    std::snprintf(text, sizeof(text), format, clampedField(value, modulus));
     addText(buffer, text);
 }
 
-void addYear(FormatBuffer& buffer, int year, int base, bool century, bool lastDigits) {
-    int trail = year % 100 + base % 100;
-    int lead = year / 100 + base / 100 + trail / 100;
-    trail %= 100;
-    if (trail < 0 && lead > 0) {
-        trail += 100;
-        --lead;
-    } else if (lead < 0 && trail > 0) {
-        trail -= 100;
-        ++lead;
-    }
-    if (century) {
-        if (lead == 0 && trail < 0) addText(buffer, "-0");
-        else addNumber(buffer, lead, "%02d");
-    }
-    if (lastDigits) addNumber(buffer, trail < 0 ? -trail : trail, "%02d");
+const char* tableName(int index, const char* const* names, const char* const* shortNames, int count) {
+    if (index < 0) return shortNames[0];
+    return index < count ? names[index] : "";
 }
 
-const char* guestZoneName(const GuestTm& guest) {
-    if (guest.tm_zone != nullptr) return guest.tm_zone;
-    if (guest.tm_isdst < 0) return "";
-#ifdef _WIN32
-    return _tzname[guest.tm_isdst != 0 ? 1 : 0];
-#else
-    return tzname[guest.tm_isdst != 0 ? 1 : 0];
-#endif
+int twoDigitYear(std::int64_t year) {
+    return static_cast<int>((year % 100 + 100) % 100);
 }
 
-void addIsoWeek(FormatBuffer& buffer, char conversion, Padding padding, const GuestTm& time) {
+std::int64_t weekOfYear(const GuestTm& time, int shift) {
+    return (static_cast<std::int64_t>(time.tm_yday) + 7 - (static_cast<std::int64_t>(time.tm_wday) + shift) % 7) / 7;
+}
+
+struct IsoWeek {
+    std::int64_t year;
+    int week;
+};
+
+IsoWeek isoWeek(const GuestTm& time) {
+    if (time.tm_yday < 0) NotImplemented_nid_no_patch("strftime: ISO week of a negative tm_yday");
+    if (time.tm_yday >= (isLeapYearSum(time.tm_year, YEAR_BASE) ? 366 : 365)) NotImplemented_nid_no_patch("strftime: ISO week of a tm_yday past the year");
+    if (time.tm_wday < -6) NotImplemented_nid_no_patch("strftime: ISO week of a tm_wday below -6");
     int base = YEAR_BASE;
-    int yday = time.tm_yday;
-    int week = 0;
+    std::int64_t yday = time.tm_yday;
     for (;;) {
         const int length = isLeapYearSum(time.tm_year, base) ? 366 : 365;
-        const int bottom = (yday + 11 - time.tm_wday) % 7 - 3;
-        int top = bottom - length % 7;
+        const std::int64_t bottom = (yday + 11 - time.tm_wday) % 7 - 3;
+        std::int64_t top = bottom - length % 7;
         if (top < -3) top += 7;
         top += length;
-        if (yday >= top) {
-            ++base;
-            week = 1;
-            break;
-        }
-        if (yday >= bottom) {
-            week = 1 + (yday - bottom) / 7;
-            break;
-        }
+        if (yday >= top) return {static_cast<std::int64_t>(time.tm_year) + base + 1, 1};
+        if (yday >= bottom) return {static_cast<std::int64_t>(time.tm_year) + base, static_cast<int>(1 + (yday - bottom) / 7)};
         --base;
         yday += isLeapYearSum(time.tm_year, base) ? 366 : 365;
     }
-    if (conversion == 'V') addNumber(buffer, week, paddingFormat(2, padding, false));
-    else addYear(buffer, time.tm_year, base, conversion == 'G', true);
+}
+
+void formatTime(FormatBuffer& buffer, const char* format, const GuestTm& time);
+
+void addZoneOffset(FormatBuffer& buffer, const GuestTm& time) {
+    std::int64_t east = -timezone_nid_postfix + (time.tm_isdst > 0 ? 3600 : 0);
+    const char sign = east < 0 ? '-' : '+';
+    if (east < 0) east = -east;
+    char text[32];
+    std::snprintf(text, sizeof(text), "%c%02lld%02lld", sign, static_cast<long long>(east / 3600), static_cast<long long>(east / 60 % 60));
+    addText(buffer, text);
+}
+
+bool addConversion(FormatBuffer& buffer, char conversion, const GuestTm& time) {
+    const std::int64_t year = static_cast<std::int64_t>(time.tm_year) + YEAR_BASE;
+    switch (conversion) {
+    case 'a': addText(buffer, tableName(time.tm_wday, WEEKDAY_NAMES, WEEKDAY_NAMES, 7)); return true;
+    case 'A': addText(buffer, tableName(time.tm_wday, WEEKDAY_FULL_NAMES, WEEKDAY_NAMES, 7)); return true;
+    case 'b':
+    case 'h': addText(buffer, tableName(time.tm_mon, MONTH_NAMES, MONTH_NAMES, 12)); return true;
+    case 'B': addText(buffer, tableName(time.tm_mon, MONTH_FULL_NAMES, MONTH_NAMES, 12)); return true;
+    case 'c': formatTime(buffer, "%a %b %e %H:%M:%S %Y", time); return true;
+    case 'C': addNumber(buffer, time.tm_year / 100 + YEAR_BASE / 100, 100, "%02d"); return true;
+    case 'd': addNumber(buffer, time.tm_mday, 100, "%02d"); return true;
+    case 'D':
+    case 'x': formatTime(buffer, "%m/%d/%y", time); return true;
+    case 'e': addNumber(buffer, time.tm_mday, 100, "%2d"); return true;
+    case 'F': formatTime(buffer, "%Y-%m-%d", time); return true;
+    case 'g': addNumber(buffer, twoDigitYear(isoWeek(time).year), 100, "%02d"); return true;
+    case 'G': addNumber(buffer, isoWeek(time).year, 10000, "%04d"); return true;
+    case 'H': addNumber(buffer, time.tm_hour, 100, "%02d"); return true;
+    case 'I': addNumber(buffer, (static_cast<std::int64_t>(time.tm_hour) + 11) % 12 + 1, 100, "%02d"); return true;
+    case 'j': addNumber(buffer, static_cast<std::int64_t>(time.tm_yday) + 1, 1000, "%03d"); return true;
+    case 'm': addNumber(buffer, static_cast<std::int64_t>(time.tm_mon) + 1, 100, "%02d"); return true;
+    case 'M': addNumber(buffer, time.tm_min, 100, "%02d"); return true;
+    case 'n': addText(buffer, "\n"); return true;
+    case 'p': addText(buffer, time.tm_hour < 12 ? "AM" : "PM"); return true;
+    case 'r': formatTime(buffer, "%I:%M:%S %p", time); return true;
+    case 'R': formatTime(buffer, "%H:%M", time); return true;
+    case 'S': addNumber(buffer, time.tm_sec, 100, "%02d"); return true;
+    case 't': addText(buffer, "\t"); return true;
+    case 'T':
+    case 'X': formatTime(buffer, "%H:%M:%S", time); return true;
+    case 'u': addNumber(buffer, time.tm_wday == 0 ? 7 : time.tm_wday, 10, "%d"); return true;
+    case 'U': addNumber(buffer, weekOfYear(time, 7), 100, "%02d"); return true;
+    case 'V': addNumber(buffer, isoWeek(time).week, 100, "%02d"); return true;
+    case 'w': addNumber(buffer, time.tm_wday, 10, "%d"); return true;
+    case 'W': addNumber(buffer, weekOfYear(time, 6), 100, "%02d"); return true;
+    case 'y': addNumber(buffer, twoDigitYear(year), 100, "%02d"); return true;
+    case 'Y': addNumber(buffer, year, 10000, "%04d"); return true;
+    case 'z': addZoneOffset(buffer, time); return true;
+    case 'Z': {
+        const char* name = tzname_nid_postfix[time.tm_isdst > 0 ? 1 : 0];
+        addText(buffer, name != nullptr ? name : "");
+        return true;
+    }
+    case '%': addText(buffer, "%"); return true;
+    default: return false;
+    }
 }
 
 void formatTime(FormatBuffer& buffer, const char* format, const GuestTm& time) {
-    for (; *format != '\0'; ++format) {
-        if (*format == '%') {
-            bool alternative = false;
-            Padding padding = Padding::Default;
-            bool handled = true;
-            for (bool modifier = true; modifier;) {
-                modifier = false;
-                switch (*++format) {
-                case '\0':
-                    --format;
-                    handled = false;
-                    break;
-                case 'A':
-                    addText(buffer, time.tm_wday < 0 || time.tm_wday >= 7 ? "?" : WEEKDAY_FULL_NAMES[time.tm_wday]);
-                    break;
-                case 'a':
-                    addText(buffer, time.tm_wday < 0 || time.tm_wday >= 7 ? "?" : WEEKDAY_NAMES[time.tm_wday]);
-                    break;
-                case 'B':
-                    addText(buffer, time.tm_mon < 0 || time.tm_mon >= 12 ? "?" : MONTH_FULL_NAMES[time.tm_mon]);
-                    break;
-                case 'b':
-                case 'h':
-                    addText(buffer, time.tm_mon < 0 || time.tm_mon >= 12 ? "?" : MONTH_NAMES[time.tm_mon]);
-                    break;
-                case 'C':
-                    addYear(buffer, time.tm_year, YEAR_BASE, true, false);
-                    break;
-                case 'c':
-                    formatTime(buffer, "%a %b %e %H:%M:%S %Y", time);
-                    break;
-                case 'D':
-                    formatTime(buffer, "%m/%d/%y", time);
-                    break;
-                case 'd':
-                    addNumber(buffer, time.tm_mday, paddingFormat(2, padding, false));
-                    break;
-                case 'E':
-                case 'O':
-                    if (alternative) {
-                        handled = false;
-                        break;
-                    }
-                    alternative = true;
-                    modifier = true;
-                    break;
-                case 'e':
-                    addNumber(buffer, time.tm_mday, paddingFormat(2, padding, true));
-                    break;
-                case 'F':
-                    formatTime(buffer, "%Y-%m-%d", time);
-                    break;
-                case 'H':
-                    addNumber(buffer, time.tm_hour, paddingFormat(2, padding, false));
-                    break;
-                case 'I':
-                    addNumber(buffer, time.tm_hour % 12 != 0 ? time.tm_hour % 12 : 12, paddingFormat(2, padding, false));
-                    break;
-                case 'j':
-                    addNumber(buffer, time.tm_yday + 1, paddingFormat(3, padding, false));
-                    break;
-                case 'k':
-                    addNumber(buffer, time.tm_hour, paddingFormat(2, padding, true));
-                    break;
-                case 'l':
-                    addNumber(buffer, time.tm_hour % 12 != 0 ? time.tm_hour % 12 : 12, paddingFormat(2, padding, true));
-                    break;
-                case 'M':
-                    addNumber(buffer, time.tm_min, paddingFormat(2, padding, false));
-                    break;
-                case 'm':
-                    addNumber(buffer, time.tm_mon + 1, paddingFormat(2, padding, false));
-                    break;
-                case 'n':
-                    addText(buffer, "\n");
-                    break;
-                case 'p':
-                    addText(buffer, time.tm_hour >= 12 ? "PM" : "AM");
-                    break;
-                case 'R':
-                    formatTime(buffer, "%H:%M", time);
-                    break;
-                case 'r':
-                    formatTime(buffer, "%I:%M:%S %p", time);
-                    break;
-                case 'S':
-                    addNumber(buffer, time.tm_sec, paddingFormat(2, padding, false));
-                    break;
-                case 's': {
-                    GuestTm copy = time;
-                    char text[24];
-                    std::snprintf(text, sizeof(text), "%lld", static_cast<long long>(libc_mktime_nid_postfix(&copy)));
-                    addText(buffer, text);
-                    break;
-                }
-                case 'T':
-                    formatTime(buffer, "%H:%M:%S", time);
-                    break;
-                case 't':
-                    addText(buffer, "\t");
-                    break;
-                case 'U':
-                    addNumber(buffer, (time.tm_yday + 7 - time.tm_wday) / 7, paddingFormat(2, padding, false));
-                    break;
-                case 'u':
-                    addNumber(buffer, time.tm_wday == 0 ? 7 : time.tm_wday, "%d");
-                    break;
-                case 'V':
-                case 'G':
-                case 'g':
-                    addIsoWeek(buffer, *format, padding, time);
-                    break;
-                case 'v':
-                    formatTime(buffer, "%e-%b-%Y", time);
-                    break;
-                case 'W':
-                    addNumber(buffer, (time.tm_yday + 7 - (time.tm_wday != 0 ? time.tm_wday - 1 : 6)) / 7,
-                        paddingFormat(2, padding, false));
-                    break;
-                case 'w':
-                    addNumber(buffer, time.tm_wday, "%d");
-                    break;
-                case 'X':
-                    formatTime(buffer, "%H:%M:%S", time);
-                    break;
-                case 'x':
-                    formatTime(buffer, "%m/%d/%y", time);
-                    break;
-                case 'y':
-                    addYear(buffer, time.tm_year, YEAR_BASE, false, true);
-                    break;
-                case 'Y':
-                    addYear(buffer, time.tm_year, YEAR_BASE, true, true);
-                    break;
-                case 'Z':
-                    addText(buffer, guestZoneName(time));
-                    break;
-                case 'z': {
-                    if (time.tm_isdst < 0) break;
-                    int difference = static_cast<int>(time.tm_gmtoff);
-                    addText(buffer, difference < 0 ? "-" : "+");
-                    if (difference < 0) difference = -difference;
-                    difference /= 60;
-                    addNumber(buffer, difference / 60 * 100 + difference % 60, paddingFormat(4, padding, false));
-                    break;
-                }
-                case '+':
-                    formatTime(buffer, "%a %b %e %H:%M:%S %Z %Y", time);
-                    break;
-                case '-':
-                case '_':
-                case '0':
-                    if (padding != Padding::Default) {
-                        handled = false;
-                        break;
-                    }
-                    padding = *format == '-' ? Padding::Less : *format == '_' ? Padding::Space : Padding::Zero;
-                    modifier = true;
-                    break;
-                default:
-                    handled = false;
-                    break;
-                }
-            }
-            if (handled) continue;
+    for (; *format != '\0' && !buffer.full; ++format) {
+        if (*format != '%' || format[1] == '\0') {
+            addPiece(buffer, format, 1);
+            continue;
+        }
+        ++format;
+        if (*format == 'E' || *format == 'O') {
+            if (format[1] == '\0') throw std::invalid_argument("strftime: the format ends after an E or O modifier");
+            ++format;
+        }
+        if (!addConversion(buffer, *format, time)) {
+            const char unknown[] = {'%', *format};
+            addPiece(buffer, unknown, sizeof(unknown));
         }
-        if (buffer.cursor == buffer.limit) break;
-        *buffer.cursor++ = *format;
     }
 }
 
 std::size_t formatGuestTime(char* destination, std::size_t size, const char* format, const GuestTm& time) {
-    FormatBuffer buffer{destination, destination + size};
+    FormatBuffer buffer{destination, destination + size, false};
     formatTime(buffer, format == nullptr ? "%c" : format, time);
-    if (buffer.cursor == buffer.limit) return 0;
+    if (buffer.full || buffer.cursor == buffer.limit) return 0;
     *buffer.cursor = '\0';
     return static_cast<std::size_t>(buffer.cursor - destination);
 }
@@ -515,32 +409,35 @@ char** HostZoneNames() {
     return ::tzname;
 #endif
 }
+
+char* GuestZoneName(int index) {
+    static char unnamed[] = "   ";
+    char** names = HostZoneNames();
+#ifdef _WIN32
+    const bool daylightSaving = _daylight != 0;
+#else
+    const bool daylightSaving = ::daylight != 0;
+#endif
+    return index == 1 && !daylightSaving ? unnamed : names[index];
+}
 }
 
 extern "C" {
 
-char* tzname_nid_postfix[2] = {HostZoneNames()[0], HostZoneNames()[1]};
+char* tzname_nid_postfix[2] = {GuestZoneName(0), GuestZoneName(1)};
 int64_t timezone_nid_postfix = 0;
 int daylight_nid_postfix = 0;
 
-GuestTm* APS5_VABI localtime_s_nid_postfix(const int64_t* timer, GuestTm* result);
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const int64_t* timer, GuestTm* result);
-int64_t APS5_VABI libc_time_nid_postfix(int64_t* timer);
-double APS5_VABI libc_difftime_nid_postfix(int64_t time1, int64_t time0);
-std::size_t APS5_VABI wcsrtombs_nid_postfix(char* destination, const std::uint16_t** source, std::size_t capacity, void* state);
-std::size_t APS5_VABI mbsrtowcs_nid_postfix(std::uint16_t* destination, const char** source, std::size_t capacity, void* state);
-int APS5_VABI _Getmbcurmax_nid_postfix();
-
 void APS5_VABI tzset_nid_postfix(void) {
     const ZoneScope zone;
-    char** names = HostZoneNames();
-    tzname_nid_postfix[0] = names[0];
-    tzname_nid_postfix[1] = names[1];
+    tzname_nid_postfix[0] = GuestZoneName(0);
+    tzname_nid_postfix[1] = GuestZoneName(1);
     const int64_t now = libc_time_nid_postfix(nullptr);
     GuestTm universal{};
     GuestTm local{};
     gmtime_s_nid_postfix(&now, &universal);
     localtime_s_nid_postfix(&now, &local);
+
     daylight_nid_postfix = local.tm_isdst >= 0 ? 1 : 0;
     timezone_nid_postfix = static_cast<int64_t>(libc_difftime_nid_postfix(libc_mktime_nid_postfix(&universal), libc_mktime_nid_postfix(&local)));
 }
@@ -688,6 +585,7 @@ int64_t APS5_VABI mktime_nid_postfix(GuestTm* timeptr) {
 size_t APS5_VABI libc_strftime_nid_postfix(char* str, size_t count, const char* format, const GuestTm* timeptr) {
     const ZoneScope zone;
     tzset_nid_postfix();
+
     return formatGuestTime(str, count, format, *timeptr);
 }
 
@@ -698,12 +596,9 @@ char* APS5_VABI asctime_nid_postfix(const GuestTm* timeptr) {
         std::memcpy(result, "??? ??? ?? ??:??:?? ????\n", sizeof("??? ??? ?? ??:??:?? ????\n"));
         return result;
     }
-    const char* weekday = timeptr->tm_wday >= 0 && timeptr->tm_wday < 7 ? WEEKDAY_NAMES[timeptr->tm_wday] : "???";
-    const char* month = timeptr->tm_mon >= 0 && timeptr->tm_mon < 12 ? MONTH_NAMES[timeptr->tm_mon] : "???";
-    char year[16];
-    formatGuestTime(year, sizeof(year), "%Y", *timeptr);
-    std::snprintf(result, sizeof(result), std::strlen(year) <= 4 ? "%s %s%3d %.2d:%.2d:%.2d %-4s\n" : "%s %s%3d %.2d:%.2d:%.2d     %s\n",
-        weekday, month, timeptr->tm_mday, timeptr->tm_hour, timeptr->tm_min, timeptr->tm_sec, year);
+    const std::int64_t year = static_cast<std::int64_t>(timeptr->tm_year) + YEAR_BASE;
+    std::snprintf(result, sizeof(result), "%s %s%3d %02d:%02d:%02d %04d\n", tableName(timeptr->tm_wday, WEEKDAY_NAMES, WEEKDAY_NAMES, 7), tableName(timeptr->tm_mon, MONTH_NAMES, MONTH_NAMES, 12),
+        clampedField(timeptr->tm_mday, 100), clampedField(timeptr->tm_hour, 100), clampedField(timeptr->tm_min, 100), clampedField(timeptr->tm_sec, 100), clampedField(year, 10000));
     return result;
 }
 
@@ -735,6 +630,7 @@ size_t APS5_VABI wcsftime_nid_postfix(std::uint16_t* str, size_t count, const st
         return 0;
     }
     wcsrtombs_nid_postfix(narrowFormat.get(), &formatCursor, formatLength + 1, nullptr);
+
     const auto maxCharacterBytes = static_cast<std::size_t>(_Getmbcurmax_nid_postfix());
     if (std::numeric_limits<std::size_t>::max() / maxCharacterBytes <= count) {
         errno = GuestEinval;
@@ -754,6 +650,7 @@ size_t APS5_VABI wcsftime_nid_postfix(std::uint16_t* str, size_t count, const st
     const std::size_t length = mbsrtowcs_nid_postfix(nullptr, &narrowCursor, 0, nullptr);
     if (length == Failed || length >= count) return 0;
     mbsrtowcs_nid_postfix(str, &narrowCursor, count, nullptr);
+
     return length;
 }
 
diff --git a/core/libs/prx/libc/src/TimeExtras.cpp b/core/libs/prx/libc/src/TimeExtras.cpp
index ee2a225b25..8b4baa0823 100644
--- a/core/libs/prx/libc/src/TimeExtras.cpp
+++ b/core/libs/prx/libc/src/TimeExtras.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 
 #include "prx/libc/include/General.hpp"
@@ -5,11 +7,6 @@
 
 namespace {
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
 constexpr int timeUtc = 1;
 constexpr std::int64_t nanosPerSecond = 1000000000;
 constexpr std::int64_t secondsPerDay = 86400;
@@ -35,10 +32,6 @@ std::int64_t wrappingAdd(std::int64_t left, std::int64_t right) {
 
 extern "C" {
 
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const std::int64_t* timer, GuestTm* result);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t* timer, GuestTm* result);
-std::int64_t APS5_VABI _Xtime_get_ticks_nid_postfix();
-
 GuestTm* APS5_VABI gmtime_r_nid_postfix(const std::int64_t* timer, GuestTm* result) {
     return gmtime_s_nid_postfix(timer, result);
 }
@@ -74,6 +67,7 @@ Xtime APS5_VABI _Xtime_to_ts_nid_postfix(const Xtime* time) {
 Xtime APS5_VABI _Xtime_diff_to_ts_nid_postfix(const Xtime* target) {
     Xtime now{};
     xtime_get_nid_postfix(&now, timeUtc);
+
     std::int64_t seconds = wrappingAdd(target->sec, target->nsec / nanosPerSecond);
     std::int64_t nanos = target->nsec % nanosPerSecond;
     if (nanos < 0) {
diff --git a/core/libs/prx/libc/src/VectorAlgorithms.cpp b/core/libs/prx/libc/src/VectorAlgorithms.cpp
index 169c0a23d8..80b1a8f99c 100644
--- a/core/libs/prx/libc/src/VectorAlgorithms.cpp
+++ b/core/libs/prx/libc/src/VectorAlgorithms.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -7,11 +8,6 @@
 
 namespace {
 
-struct MinMaxPointers {
-    const void* minimum;
-    const void* maximum;
-};
-
 template<typename TValue>
 TValue Read(const unsigned char* address) {
     TValue value;
diff --git a/core/libs/prx/libc/src/WideConversion.cpp b/core/libs/prx/libc/src/WideConversion.cpp
index 640effd1de..109dae7f16 100644
--- a/core/libs/prx/libc/src/WideConversion.cpp
+++ b/core/libs/prx/libc/src/WideConversion.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/SonyCrt.hpp"
 #include <cerrno>
@@ -18,8 +20,6 @@ extern "C" void* APS5_VABI set_constraint_handler_s_nid_postfix(void* handler) {
     return SonySetConstraintHandlerS(handler);
 }
 
-extern "C" std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void* state);
-
 extern "C" std::size_t APS5_VABI wcstombs_nid_postfix(char* destination, const std::uint16_t* source, std::size_t capacity) {
     std::size_t count = 0;
     for (;; ++source) {
@@ -38,8 +38,6 @@ extern "C" int APS5_VABI wcscpy_s_nid_postfix(std::uint16_t* dest, std::size_t s
     return SonyWcscpyS(dest, size, src);
 }
 
-extern "C" int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t capacity);
-
 namespace {
 
 std::size_t ReadErrorMessage(int error, char (&message)[128]) {
diff --git a/core/libs/prx/libc/src/exception/ArraySupport.cpp b/core/libs/prx/libc/src/exception/ArraySupport.cpp
index 6b5302ac9e..961f834282 100644
--- a/core/libs/prx/libc/src/exception/ArraySupport.cpp
+++ b/core/libs/prx/libc/src/exception/ArraySupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <limits>
 
@@ -15,6 +16,7 @@ void APS5_VABI __cxa_vec_ctor_nid_postfix(void* array, std::size_t count, std::s
         for (; complete < count; ++complete) construct(static_cast<unsigned char*>(array) + complete * size);
     } catch (...) {
         __cxa_vec_cleanup_nid_postfix(array, complete, size, destroy);
+
         throw;
     }
 }
@@ -26,6 +28,7 @@ void APS5_VABI __cxa_vec_cctor_nid_postfix(void* destination, void* source, std:
             copy(static_cast<unsigned char*>(destination) + complete * size, static_cast<unsigned char*>(source) + complete * size);
     } catch (...) {
         __cxa_vec_cleanup_nid_postfix(destination, complete, size, destroy);
+
         throw;
     }
 }
@@ -37,6 +40,7 @@ void APS5_VABI __cxa_vec_dtor_nid_postfix(void* array, std::size_t count, std::s
     } catch (...) {
         if (unwinding) LibcException::Terminate();
         __cxa_vec_cleanup_nid_postfix(array, count, size, destroy);
+
         throw;
     }
 }
diff --git a/core/libs/prx/libc/src/exception/ExceptionPointer.cpp b/core/libs/prx/libc/src/exception/ExceptionPointer.cpp
index 447d85ac45..6b808a870c 100644
--- a/core/libs/prx/libc/src/exception/ExceptionPointer.cpp
+++ b/core/libs/prx/libc/src/exception/ExceptionPointer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <exception>
 
 #ifndef _LIBCPP_VERSION
@@ -62,6 +63,7 @@ exception_ptr current_exception() noexcept {
 
 void rethrow_exception(exception_ptr exception) {
     __cxa_rethrow_primary_exception_nid_postfix(exception._M_exception_object);
+
     LibcException::Terminate();
 }
 
@@ -73,10 +75,12 @@ exception_ptr::exception_ptr(void* exception) noexcept : _M_exception_object(exc
 
 void exception_ptr::_M_addref() noexcept {
     __cxa_increment_exception_refcount_nid_postfix(_M_exception_object);
+
 }
 
 void exception_ptr::_M_release() noexcept {
     __cxa_decrement_exception_refcount_nid_postfix(_M_exception_object);
+
     _M_exception_object = nullptr;
 }
 
@@ -94,22 +98,15 @@ const type_info* exception_ptr::__cxa_exception_type() const noexcept {
 
 #else
 
-namespace {
-struct GuestExceptionPointer {
-    void* object {};
-    explicit GuestExceptionPointer(void* primary) noexcept : object(primary) {}
-    GuestExceptionPointer(const GuestExceptionPointer&) = delete;
-    ~GuestExceptionPointer() {}
-};
-}
-
 extern "C" {
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptr9_M_addrefEv_nid_postfix(GuestExceptionPointer* self) noexcept {
     __cxa_increment_exception_refcount_nid_postfix(self->object);
+
 }
 
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptr10_M_releaseEv_nid_postfix(GuestExceptionPointer* self) noexcept {
     __cxa_decrement_exception_refcount_nid_postfix(self->object);
+
     self->object = nullptr;
 }
 
@@ -120,10 +117,12 @@ void* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr6_M_getEv_nid_postfix(cons
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC1EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept {
     self->object = exception;
     __cxa_increment_exception_refcount_nid_postfix(exception);
+
 }
 
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC2EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept {
     _ZNSt15__exception_ptr13exception_ptrC1EPv_nid_postfix(self, exception);
+
 }
 
 const std::type_info* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr20__cxa_exception_typeEv_nid_postfix(const GuestExceptionPointer* self) noexcept {
@@ -136,6 +135,7 @@ GuestExceptionPointer APS5_VABI _ZSt17current_exceptionv_nid_postfix() noexcept
 
 [[noreturn]] void APS5_VABI _ZSt17rethrow_exceptionNSt15__exception_ptr13exception_ptrE_nid_postfix(GuestExceptionPointer& exception) {
     __cxa_rethrow_primary_exception_nid_postfix(exception.object);
+
     LibcException::Terminate();
 }
 }
diff --git a/core/libs/prx/libc/src/exception/GuardSupport.cpp b/core/libs/prx/libc/src/exception/GuardSupport.cpp
index 7eaab8684f..09f9cbf02d 100644
--- a/core/libs/prx/libc/src/exception/GuardSupport.cpp
+++ b/core/libs/prx/libc/src/exception/GuardSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <thread>
 
diff --git a/core/libs/prx/libc/src/exception/Personality.cpp b/core/libs/prx/libc/src/exception/Personality.cpp
index 87826a2dc8..d4ed0a681f 100644
--- a/core/libs/prx/libc/src/exception/Personality.cpp
+++ b/core/libs/prx/libc/src/exception/Personality.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/exceptions/Unwind.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 
 extern "C" _Unwind_Reason_Code APS5_VABI __gxx_personality_v0_nid_postfix(
diff --git a/core/libs/prx/libc/src/exception/Runtime.cpp b/core/libs/prx/libc/src/exception/Runtime.cpp
index e790d1a2db..faba094aaf 100644
--- a/core/libs/prx/libc/src/exception/Runtime.cpp
+++ b/core/libs/prx/libc/src/exception/Runtime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/exceptions/Unwind.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <algorithm>
 #include <cstdarg>
@@ -117,7 +119,7 @@ void Release(void* object) {
     }
 }
 
-void APS5_VABI Cleanup(_Unwind_Reason_Code reason, _Unwind_Exception* exception) {
+static void APS5_VABI Cleanup(_Unwind_Reason_Code reason, _Unwind_Exception* exception) {
     if (reason != _URC_FOREIGN_EXCEPTION_CAUGHT) Terminate();
     auto* header = FromUnwind(exception);
     if (exception->exception_class == DependentClass) {
@@ -200,12 +202,15 @@ void VisitBases(const std::type_info* type, BaseLocation location, bool publicPa
 
 void Bases(const std::type_info* type, void* object, Search& search) {
     std::uintptr_t identity = 0;
+    bool reachedPublicly = false;
     auto visitor = [&](const std::type_info* candidate, BaseLocation location, bool publicPath) {
-        if (!publicPath || !Equal(candidate, search.wanted)) return;
-        if (!search.count) { search.found = location.object; identity = location.identity; search.count = 1; }
+        if (!Equal(candidate, search.wanted)) return;
+        if (!search.count) { search.found = location.object; identity = location.identity; search.count = 1; reachedPublicly = publicPath; }
         else if (search.found != location.object || identity != location.identity) search.count = 2;
+        else if (publicPath) reachedPublicly = true;
     };
     VisitBases(type, {object, 0}, true, visitor);
+    if (search.count == 1 && !reachedPublicly) search.count = 0;
 }
 
 bool PointerMatch(const __cxxabiv1::__pbase_type_info* caught, const __cxxabiv1::__pbase_type_info* thrown,
@@ -285,8 +290,10 @@ void APS5_VABI __cxa_free_exception_nid_postfix(void* object) {
     header->unwind.exception_cleanup = Cleanup;
     ++globals.uncaught;
     _Unwind_RaiseException_nid_postfix(&header->unwind);
+
     RawLog("[libc] unhandled exception '%s' thrown from %p\n", type ? type->name() : "?", throwSite);
     __cxa_begin_catch_nid_postfix(&header->unwind);
+
     InvokeTerminate(header->terminate);
 }
 
@@ -343,6 +350,7 @@ void APS5_VABI __cxa_end_catch_nid_postfix() {
         globals.caught = header->next;
         bool foreign = !Native(header->unwind.exception_class);
         _Unwind_DeleteException_nid_postfix(UnwindOf(header));
+
         if (foreign) DeleteForeignHeader(header);
     }
 }
@@ -355,6 +363,7 @@ void APS5_VABI __cxa_end_catch_nid_postfix() {
     if (Native(header->unwind.exception_class)) ++globals.uncaught;
     _Unwind_RaiseException_nid_postfix(UnwindOf(header));
     __cxa_begin_catch_nid_postfix(UnwindOf(header));
+
     InvokeTerminate(header->terminate ? header->terminate : terminateHandler.load());
 }
 
@@ -373,7 +382,7 @@ unsigned APS5_VABI __cxa_uncaught_exceptions_nid_postfix() { return LibcExceptio
 bool APS5_VABI _ZSt18uncaught_exceptionv_nid_postfix() { return __cxa_uncaught_exception_nid_postfix(); }
 int APS5_VABI _ZSt19uncaught_exceptionsv_nid_postfix() { return static_cast<int>(__cxa_uncaught_exceptions_nid_postfix()); }
 [[noreturn]] void APS5_VABI _ZSt9terminatev_nid_postfix() { LibcException::Terminate(); }
-using LibcTerminateHandler = void(*)();
+
 LibcTerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(LibcTerminateHandler handler) {
     return LibcException::terminateHandler.exchange(handler ? handler : std::abort);
 }
@@ -388,6 +397,7 @@ void* APS5_VABI __cxa_current_primary_exception_nid_postfix() {
     if (!globals.caught || !Native(globals.caught->unwind.exception_class)) return nullptr;
     void* object = Primary(globals.caught) + 1;
     __cxa_increment_exception_refcount_nid_postfix(object);
+
     return object;
 }
 void* APS5_VABI __cxa_allocate_dependent_exception_nid_postfix() {
@@ -410,9 +420,11 @@ void APS5_VABI __cxa_rethrow_primary_exception_nid_postfix(void* object) {
     header->unwind.exception_class = DependentClass;
     header->unwind.exception_cleanup = Cleanup;
     __cxa_increment_exception_refcount_nid_postfix(object);
+
     ++globals.uncaught;
     _Unwind_RaiseException_nid_postfix(&header->unwind);
     __cxa_begin_catch_nid_postfix(&header->unwind);
+
     InvokeTerminate(header->terminate);
 }
 
@@ -450,6 +462,7 @@ void* APS5_VABI __dynamic_cast_nid_postfix(const void* source, const __cxxabiv1:
 
 [[noreturn]] void APS5_VABI __cxa_call_terminate_nid_postfix(void* exception) {
     __cxa_begin_catch_nid_postfix(exception);
+
     LibcException::Terminate();
 }
 [[noreturn]] void APS5_VABI __cxa_pure_virtual_nid_postfix() { LibcException::Terminate(); }
diff --git a/core/libs/prx/libc/src/exception/StandardExceptions.cpp b/core/libs/prx/libc/src/exception/StandardExceptions.cpp
index 31feeb3d8e..83ffdb0b78 100644
--- a/core/libs/prx/libc/src/exception/StandardExceptions.cpp
+++ b/core/libs/prx/libc/src/exception/StandardExceptions.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include <cstdio>
@@ -7,11 +8,9 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" void* APS5_VABI _Znwm_nid_postfix(std::size_t size);
-
 namespace LibcException {
 struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
-struct ExceptionObject { const void* vtable; const char* message; };
+
 struct ExceptionVtable {
     std::ptrdiff_t offset;
     const TypeRecord* type;
@@ -128,10 +127,8 @@ ExceptionObject* Assign(ExceptionObject* object, const ExceptionObject* source)
     __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)), [](void* p) { DestroyPlain(static_cast<ExceptionObject*>(p)); });
 }
 
-struct CategoryObject { const void* vtable; };
-struct ErrorCode { int value; const CategoryObject* category; };
-struct SystemErrorObject { ExceptionObject base; ErrorCode code; };
-static_assert(sizeof(ErrorCode) == 16 && sizeof(SystemErrorObject) == 32 && offsetof(SystemErrorObject, code) == 16);
+static_assert(sizeof(ErrorCode) == 16 && offsetof(ErrorCode, value) == 4 && offsetof(ErrorCode, category) == 8);
+static_assert(sizeof(SystemErrorObject) == 32 && offsetof(SystemErrorObject, code) == 16);
 struct CppError { int value; const char* message; };
 
 static const char* GenericErrorMessage(int value) {
@@ -216,13 +213,15 @@ static const char* GenericErrorMessage(int value) {
 
 const TypeRecord ErrorCategoryType {ClassTypeVtable + 2, "St14error_category", nullptr};
 const TypeRecord GenericCategoryType {SingleTypeVtable + 2, "St23_Generic_error_category", &ErrorCategoryType};
-static void APS5_VABI GenericCategoryDestroy_nid_no_patch(CategoryObject*) {}
-static void APS5_VABI GenericCategoryDelete_nid_no_patch(CategoryObject*) {
-    throw std::invalid_argument("std::_Generic_error_category: the generic category object is not heap allocated");
+const TypeRecord SystemCategoryType {SingleTypeVtable + 2, "St22_System_error_category", &ErrorCategoryType};
+static void APS5_VABI CategoryDestroy_nid_no_patch(CategoryObject*) {}
+static void APS5_VABI CategoryDelete_nid_no_patch(CategoryObject*) {
+    throw std::invalid_argument("std::error_category: the generic and system category objects are not heap allocated");
 }
 static const char* APS5_VABI GenericCategoryName_nid_no_patch(const CategoryObject*) { return "generic"; }
-static GuestLocale::String* APS5_VABI GenericCategoryMessage_nid_no_patch(GuestLocale::String* result, const CategoryObject*, int value) {
-    if (!result) throw std::invalid_argument("std::_Generic_error_category::message: null result");
+static const char* APS5_VABI SystemCategoryName_nid_no_patch(const CategoryObject*) { return "system"; }
+static GuestLocale::String* APS5_VABI CategoryMessage_nid_no_patch(GuestLocale::String* result, const CategoryObject*, int value) {
+    if (!result) throw std::invalid_argument("std::error_category::message: null result");
     const char* message = GenericErrorMessage(value);
     if (!message) message = "unknown error";
     const auto length = std::strlen(message);
@@ -235,22 +234,61 @@ static GuestLocale::String* APS5_VABI GenericCategoryMessage_nid_no_patch(GuestL
     result->capacity = capacity;
     return result;
 }
-static ErrorCode APS5_VABI GenericCategoryCondition_nid_no_patch(const CategoryObject* self, int value) { return {value, self}; }
-static bool APS5_VABI GenericCategoryEquivalentCondition_nid_no_patch(const CategoryObject* self, int value, const ErrorCode* condition) {
-    return condition->category == self && condition->value == value;
+static ErrorCode APS5_VABI CategoryCondition_nid_no_patch(const CategoryObject* self, int value) { return {0, value, self}; }
+static bool APS5_VABI CategoryEquivalentCondition_nid_no_patch(const CategoryObject* self, int value, const ErrorCode* condition) {
+    using Condition = ErrorCode (APS5_VABI *)(const CategoryObject*, int);
+#ifdef __APPLE__
+    const auto mapped = reinterpret_cast<Condition>(const_cast<void*>(static_cast<const void* const*>(self->vtable)[4]))(self, value);
+#else
+    const auto mapped = reinterpret_cast<Condition>(static_cast<const void* const*>(self->vtable)[4])(self, value);
+#endif
+    return condition->category == mapped.category && condition->value == mapped.value;
 }
-static bool APS5_VABI GenericCategoryEquivalentCode_nid_no_patch(const CategoryObject* self, const ErrorCode* code, int value) {
+static bool APS5_VABI CategoryEquivalentCode_nid_no_patch(const CategoryObject* self, const ErrorCode* code, int value) {
     return code->category == self && code->value == value;
 }
 const void* const GenericCategoryVtable[] {
     nullptr, &GenericCategoryType,
-    reinterpret_cast<const void*>(GenericCategoryDestroy_nid_no_patch), reinterpret_cast<const void*>(GenericCategoryDelete_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryName_nid_no_patch), reinterpret_cast<const void*>(GenericCategoryMessage_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryCondition_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryEquivalentCondition_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryEquivalentCode_nid_no_patch)
+    reinterpret_cast<const void*>(CategoryDestroy_nid_no_patch), reinterpret_cast<const void*>(CategoryDelete_nid_no_patch),
+    reinterpret_cast<const void*>(GenericCategoryName_nid_no_patch), reinterpret_cast<const void*>(CategoryMessage_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCode_nid_no_patch)
 };
 const CategoryObject GenericCategory {GenericCategoryVtable + 2};
+static ErrorCode APS5_VABI SystemCategoryCondition_nid_no_patch(const CategoryObject* self, int value) {
+    return {0, value, GenericErrorMessage(value) ? &GenericCategory : self};
+}
+const void* const SystemCategoryVtable[] {
+    nullptr, &SystemCategoryType,
+    reinterpret_cast<const void*>(CategoryDestroy_nid_no_patch), reinterpret_cast<const void*>(CategoryDelete_nid_no_patch),
+    reinterpret_cast<const void*>(SystemCategoryName_nid_no_patch), reinterpret_cast<const void*>(CategoryMessage_nid_no_patch),
+    reinterpret_cast<const void*>(SystemCategoryCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCode_nid_no_patch)
+};
+const CategoryObject SystemCategory {SystemCategoryVtable + 2};
+[[noreturn]] void ThrowCppError(int code, const ExceptionVtable& table) {
+    static constexpr CppError errors[] {
+        {16, "device or resource busy"},
+        {22, "invalid argument"},
+        {3, "no such process"},
+        {12, "not enough memory"},
+        {1, "operation not permitted"},
+        {11, "resource deadlock would occur"},
+        {35, "resource unavailable try again"}
+    };
+    if (code < 0 || code >= static_cast<int>(std::size(errors)))
+        throw std::out_of_range("_Throw_Cpp_error: " + std::to_string(code) + " is not a _Cpp_error code");
+    const auto& error = errors[code];
+    char message[128];
+    std::snprintf(message, sizeof(message), "%s: %s", error.message, GenericErrorMessage(error.value));
+    auto* object = static_cast<SystemErrorObject*>(__cxa_allocate_exception_nid_postfix(sizeof(SystemErrorObject)));
+    Construct(&object->base, table, message);
+    object->code = {0, error.value, &GenericCategory};
+    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)),
+        reinterpret_cast<decltype(Header::destructor)>(DestroyGuestMessage_nid_no_patch));
+}
 }
 
 extern "C" {
@@ -260,9 +298,12 @@ const char* APS5_VABI _ZSt13_Syserror_mapi_nid_postfix(int value) {
 const LibcException::CategoryObject* APS5_VABI _ZSt16generic_categoryv_nid_postfix() {
     return &LibcException::GenericCategory;
 }
+const LibcException::CategoryObject* APS5_VABI _ZSt15system_categoryv_nid_postfix() {
+    return &LibcException::SystemCategory;
+}
 GuestLocale::String* APS5_VABI _ZNKSt23_Generic_error_category7messageEi_nid_postfix(
     GuestLocale::String* result, const LibcException::CategoryObject* self, int value) {
-    return LibcException::GenericCategoryMessage_nid_no_patch(result, self, value);
+    return LibcException::CategoryMessage_nid_no_patch(result, self, value);
 }
 LibcException::TypeRecord _ZTISt8ios_base_nid_postfix {LibcException::ClassTypeVtable + 2, "St8ios_base", nullptr};
 LibcException::TypeRecord _ZTISt9exception_nid_postfix {LibcException::ClassTypeVtable + 2, "St9exception", nullptr};
@@ -291,6 +332,10 @@ void APS5_VABI _ZNSt8bad_castD0Ev_nid_postfix(LibcException::ExceptionObject* se
 const char* APS5_VABI _ZNKSt8bad_cast4whatEv_nid_postfix(const LibcException::ExceptionObject* self) { return LibcException::PlainWhat(self); }
 void APS5_VABI _ZNSt8bad_castC1Ev_nid_postfix(LibcException::ExceptionObject* self) { self->vtable = &_ZTVSt8bad_cast_nid_postfix.destroy; }
 void APS5_VABI _ZNSt8bad_castC2Ev_nid_postfix(LibcException::ExceptionObject* self) { self->vtable = &_ZTVSt8bad_cast_nid_postfix.destroy; }
+[[noreturn]] void APS5_VABI _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self) {
+    if (!self) throw std::invalid_argument("exception object is null");
+    LibcException::ThrowPlain(_ZTVSt8bad_cast_nid_postfix);
+}
 
 LibcException::TypeRecord _ZTISt10bad_typeid_nid_postfix {LibcException::SingleTypeVtable + 2, "St10bad_typeid", &_ZTISt9exception_nid_postfix};
 LibcException::ExceptionVtable _ZTVSt10bad_typeid_nid_postfix {0, &_ZTISt10bad_typeid_nid_postfix, LibcException::GuestDestroyPlain_nid_no_patch, LibcException::GuestDeletePlain_nid_no_patch, LibcException::GuestPlainWhat_nid_no_patch};
@@ -463,6 +508,10 @@ LibcException::TypeRecord _ZTISt14overflow_error_nid_postfix {LibcException::Sin
 LibcException::ExceptionVtable _ZTVSt14overflow_error_nid_postfix {0, &_ZTISt14overflow_error_nid_postfix, LibcException::GuestDestroyMessage_nid_no_patch, LibcException::GuestDeleteMessage_nid_no_patch, LibcException::GuestMessageWhat_nid_no_patch};
 void APS5_VABI _ZNSt14overflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
 
+LibcException::TypeRecord _ZTISt15underflow_error_nid_postfix {LibcException::SingleTypeVtable + 2, "St15underflow_error", &_ZTISt13runtime_error_nid_postfix};
+LibcException::ExceptionVtable _ZTVSt15underflow_error_nid_postfix {0, &_ZTISt15underflow_error_nid_postfix, LibcException::GuestDestroyMessage_nid_no_patch, LibcException::GuestDeleteMessage_nid_no_patch, LibcException::GuestMessageWhat_nid_no_patch};
+void APS5_VABI _ZNSt15underflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
+
 LibcException::TypeRecord _ZTINSt8ios_base7failureE_nid_postfix {LibcException::SingleTypeVtable + 2, "NSt8ios_base7failureE", &_ZTISt12system_error_nid_postfix};
 LibcException::ExceptionVtable _ZTVNSt8ios_base7failureE_nid_postfix {0, &_ZTINSt8ios_base7failureE_nid_postfix, LibcException::GuestDestroyMessage_nid_no_patch, LibcException::GuestDeleteMessage_nid_no_patch, LibcException::GuestMessageWhat_nid_no_patch};
 void APS5_VABI _ZNSt8ios_base7failureD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
@@ -480,7 +529,6 @@ const char* APS5_VABI _ZNKSt8ios_base7failure4whatEv_nid_postfix(const LibcExcep
 [[noreturn]] void APS5_VABI _ZSt15_Xruntime_errorPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(_ZTVSt13runtime_error_nid_postfix, message); }
 [[noreturn]] void APS5_VABI _ZSt13_Xrange_errorPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(_ZTVSt11range_error_nid_postfix, message); }
 [[noreturn]] void APS5_VABI _ZSt19_Xbad_function_callv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt17bad_function_call_nid_postfix); }
-[[noreturn]] void APS5_VABI _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt17bad_function_call_nid_postfix); }
 [[noreturn]] void APS5_VABI _ZSt19_Throw_bad_weak_ptrv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt12bad_weak_ptr_nid_postfix); }
 [[noreturn]] void APS5_VABI _ZSt26__throw_bad_variant_accessv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt18bad_variant_access_nid_postfix); }
 [[noreturn]] void APS5_VABI _ZSt26_Throw_bad_optional_accessv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt19bad_optional_access_nid_postfix); }
@@ -493,24 +541,100 @@ const char* APS5_VABI _ZNKSt8ios_base7failure4whatEv_nid_postfix(const LibcExcep
         reinterpret_cast<decltype(LibcException::Header::destructor)>(LibcException::DestroyGuestMessage_nid_no_patch));
 }
 [[noreturn]] void ThrowCppError_nid_no_patch(int code) {
-    static constexpr LibcException::CppError errors[] {
-        {16, "device or resource busy"},
-        {22, "invalid argument"},
-        {3, "no such process"},
-        {12, "not enough memory"},
-        {1, "operation not permitted"},
-        {11, "resource deadlock would occur"},
-        {35, "resource unavailable try again"}
-    };
-    if (code < 0 || code >= static_cast<int>(std::size(errors)))
-        throw std::out_of_range("_Throw_Cpp_error: " + std::to_string(code) + " is not a _Cpp_error code");
-    const auto& error = errors[code];
-    char message[128];
-    std::snprintf(message, sizeof(message), "%s: %s", error.message, LibcException::GenericErrorMessage(error.value));
-    auto* object = static_cast<LibcException::SystemErrorObject*>(__cxa_allocate_exception_nid_postfix(sizeof(LibcException::SystemErrorObject)));
-    LibcException::Construct(&object->base, _ZTVSt12system_error_nid_postfix, message);
-    object->code = {error.value, &LibcException::GenericCategory};
-    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(&_ZTISt12system_error_nid_postfix),
-        reinterpret_cast<decltype(LibcException::Header::destructor)>(LibcException::DestroyGuestMessage_nid_no_patch));
+    LibcException::ThrowCppError(code, _ZTVSt12system_error_nid_postfix);
+}
+}
+
+namespace LibcException::SceV2 {
+static const char* APS5_VABI BadOptionalAccessWhat_nid_no_patch(const ExceptionObject*) { return "Bad optional access"; }
+static const char* APS5_VABI BadWeakPtrWhat_nid_no_patch(const ExceptionObject*) { return "bad_weak_ptr"; }
+static const char* APS5_VABI BadVariantAccessWhat_nid_no_patch(const ExceptionObject*) { return "bad variant access"; }
+static const char* APS5_VABI BadFunctionCallWhat_nid_no_patch(const ExceptionObject*) { return "bad function call"; }
+}
+
+extern "C" {
+LibcException::TypeRecord _ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix {LibcException::SingleTypeVtable + 2, "NSt13__sce_cxxvers16_Error_exceptionE", &_ZTISt9exception_nid_postfix};
+}
+
+namespace LibcException::SceV2 {
+constexpr ExceptionVtable MessageTable(const TypeRecord& type) {
+    return {0, &type, GuestDestroyMessage_nid_no_patch, GuestDeleteMessage_nid_no_patch, GuestMessageWhat_nid_no_patch};
+}
+constexpr ExceptionVtable PlainTable(const TypeRecord& type, const char* (APS5_VABI *what)(const ExceptionObject*)) {
+    return {0, &type, GuestDestroyPlain_nid_no_patch, GuestDeletePlain_nid_no_patch, what};
+}
+const ExceptionVtable ErrorException = MessageTable(_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix);
+const TypeRecord LogicErrorType {SingleTypeVtable + 2, "NSt8__sce_v211logic_errorE", &_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix};
+const TypeRecord LengthErrorType {SingleTypeVtable + 2, "NSt8__sce_v212length_errorE", &LogicErrorType};
+const TypeRecord OutOfRangeType {SingleTypeVtable + 2, "NSt8__sce_v212out_of_rangeE", &LogicErrorType};
+const TypeRecord InvalidArgumentType {SingleTypeVtable + 2, "NSt8__sce_v216invalid_argumentE", &LogicErrorType};
+const TypeRecord RuntimeErrorType {SingleTypeVtable + 2, "NSt8__sce_v213runtime_errorE", &_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix};
+const TypeRecord OverflowErrorType {SingleTypeVtable + 2, "NSt8__sce_v214overflow_errorE", &RuntimeErrorType};
+const TypeRecord RangeErrorType {SingleTypeVtable + 2, "NSt8__sce_v211range_errorE", &RuntimeErrorType};
+const TypeRecord SystemErrorBaseType {SingleTypeVtable + 2, "NSt8__sce_v213_System_errorE", &RuntimeErrorType};
+const TypeRecord SystemErrorType {SingleTypeVtable + 2, "NSt8__sce_v212system_errorE", &SystemErrorBaseType};
+const TypeRecord IosFailureType {SingleTypeVtable + 2, "NSt8__sce_v28ios_base7failureE", &SystemErrorType};
+const TypeRecord BadOptionalAccessType {SingleTypeVtable + 2, "NSt8__sce_v219bad_optional_accessE", &_ZTISt9exception_nid_postfix};
+const TypeRecord BadWeakPtrType {SingleTypeVtable + 2, "NSt8__sce_v212bad_weak_ptrE", &_ZTISt9exception_nid_postfix};
+const TypeRecord BadVariantAccessType {SingleTypeVtable + 2, "NSt8__sce_v218bad_variant_accessE", &_ZTISt9exception_nid_postfix};
+const TypeRecord BadFunctionCallType {SingleTypeVtable + 2, "NSt8__sce_v217bad_function_callE", &_ZTISt9exception_nid_postfix};
+const ExceptionVtable LengthError = MessageTable(LengthErrorType);
+const ExceptionVtable OutOfRange = MessageTable(OutOfRangeType);
+const ExceptionVtable InvalidArgument = MessageTable(InvalidArgumentType);
+const ExceptionVtable RuntimeError = MessageTable(RuntimeErrorType);
+const ExceptionVtable OverflowError = MessageTable(OverflowErrorType);
+const ExceptionVtable RangeError = MessageTable(RangeErrorType);
+const ExceptionVtable SystemError = MessageTable(SystemErrorType);
+const ExceptionVtable IosFailure = MessageTable(IosFailureType);
+const ExceptionVtable BadOptionalAccess = PlainTable(BadOptionalAccessType, BadOptionalAccessWhat_nid_no_patch);
+const ExceptionVtable BadWeakPtr = PlainTable(BadWeakPtrType, BadWeakPtrWhat_nid_no_patch);
+const ExceptionVtable BadVariantAccess = PlainTable(BadVariantAccessType, BadVariantAccessWhat_nid_no_patch);
+const ExceptionVtable BadFunctionCall = PlainTable(BadFunctionCallType, BadFunctionCallWhat_nid_no_patch);
+
+[[noreturn]] void ThrowCopy(const ExceptionObject* source, const ExceptionVtable& table) {
+    auto* object = static_cast<ExceptionObject*>(__cxa_allocate_exception_nid_postfix(sizeof(ExceptionObject)));
+    Copy(object, source, table);
+    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)),
+        reinterpret_cast<decltype(Header::destructor)>(DestroyGuestMessage_nid_no_patch));
+}
+[[noreturn]] void ThrowSystemCopy(const SystemErrorObject* source, const ExceptionVtable& table) {
+    auto* object = static_cast<SystemErrorObject*>(__cxa_allocate_exception_nid_postfix(sizeof(SystemErrorObject)));
+    Copy(&object->base, &source->base, table);
+    object->code = source->code;
+    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)),
+        reinterpret_cast<decltype(Header::destructor)>(DestroyGuestMessage_nid_no_patch));
+}
+}
+
+extern "C" {
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message) { LibcException::Construct(self, LibcException::SceV2::ErrorException, message); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message) { LibcException::Construct(self, LibcException::SceV2::ErrorException, message); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source) { LibcException::Copy(self, source, LibcException::SceV2::ErrorException); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source) { LibcException::Copy(self, source, LibcException::SceV2::ErrorException); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD0Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DeleteMessage(self); }
+const char* APS5_VABI _ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(const LibcException::ExceptionObject* self) { return LibcException::MessageWhat(self); }
+
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::LengthError, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xout_of_rangeEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::OutOfRange, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v218_Xinvalid_argumentEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::InvalidArgument, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v215_Xruntime_errorEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::RuntimeError, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Xoverflow_errorEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::OverflowError, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v211_Xbad_allocEv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt9bad_alloc_nid_postfix); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix() { LibcException::ThrowPlain(LibcException::SceV2::BadFunctionCall); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_19bad_optional_accessE_nid_postfix(const LibcException::ExceptionObject*) { LibcException::ThrowPlain(LibcException::SceV2::BadOptionalAccess); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12bad_weak_ptrE_nid_postfix(const LibcException::ExceptionObject*) { LibcException::ThrowPlain(LibcException::SceV2::BadWeakPtr); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_18bad_variant_accessE_nid_postfix(const LibcException::ExceptionObject*) { LibcException::ThrowPlain(LibcException::SceV2::BadVariantAccess); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_11range_errorE_nid_postfix(const LibcException::ExceptionObject* error) { LibcException::SceV2::ThrowCopy(error, LibcException::SceV2::RangeError); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12system_errorE_nid_postfix(const LibcException::SystemErrorObject* error) { LibcException::SceV2::ThrowSystemCopy(error, LibcException::SceV2::SystemError); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v28ios_base6_ThrowERKNS0_7failureE_nid_postfix(const LibcException::SystemErrorObject* failure) { LibcException::SceV2::ThrowSystemCopy(failure, LibcException::SceV2::IosFailure); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Throw_Cpp_errorEi_nid_postfix(int code) { LibcException::ThrowCppError(code, LibcException::SceV2::SystemError); }
+
+std::int64_t APS5_VABI _ZNSt8__sce_v216_Xtime_get_ticksEv_nid_postfix() { return _Xtime_get_ticks_nid_postfix(); }
+const char* APS5_VABI _ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(int value) {
+    if (value == 0) return "success";
+    const char* message = LibcException::GenericErrorMessage(value);
+    return message ? message : "unknown error";
 }
 }
diff --git a/core/libs/prx/libc/src/exception/TypeInfo.cpp b/core/libs/prx/libc/src/exception/TypeInfo.cpp
index 49ba0e47ee..a1d58f019b 100644
--- a/core/libs/prx/libc/src/exception/TypeInfo.cpp
+++ b/core/libs/prx/libc/src/exception/TypeInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <stdexcept>
 
diff --git a/core/libs/prx/libc/src/exception/Unwind.cpp b/core/libs/prx/libc/src/exception/Unwind.cpp
index 94226226e0..973b21dbcf 100644
--- a/core/libs/prx/libc/src/exception/Unwind.cpp
+++ b/core/libs/prx/libc/src/exception/Unwind.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Unwind.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include "prx/libc/include/specifics/linux/ElfTypes.hpp"
@@ -106,12 +107,23 @@ extern "C" void _Unwind_DeleteException(_Unwind_Exception*);
 
 namespace LibcUnwind {
 #ifdef _WIN32
+static bool Readable(Word address, std::size_t size) {
+    for (Word cursor = address; cursor - address < size;) {
+        MEMORY_BASIC_INFORMATION memory{};
+        if (VirtualQuery(reinterpret_cast<const void*>(cursor), &memory, sizeof(memory)) != sizeof(memory)) return false;
+        if (memory.RegionSize == 0 || memory.State != MEM_COMMIT || (memory.Protect & (PAGE_NOACCESS | PAGE_GUARD)) != 0 || (memory.Protect & 0xff) == PAGE_EXECUTE) return false;
+        cursor = reinterpret_cast<Word>(memory.BaseAddress) + memory.RegionSize;
+    }
+    return true;
+}
+
 static Word ResolveImport(Word address) {
     const auto* code = reinterpret_cast<const Byte*>(address);
-    if (code[0] == 0xff && code[1] == 0x25) {
+    if (Readable(address, 6) && code[0] == 0xff && code[1] == 0x25) {
         std::int32_t displacement;
         std::memcpy(&displacement, code + 2, sizeof(displacement));
-        std::memcpy(&address, code + 6 + displacement, sizeof(address));
+        const Word slot = address + 6 + displacement;
+        if (Readable(slot, sizeof(address))) std::memcpy(&address, reinterpret_cast<const void*>(slot), sizeof(address));
     }
     return address;
 }
diff --git a/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp b/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp
index bae022e001..a18ff70dc9 100644
--- a/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp
+++ b/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp
@@ -1,4 +1,8 @@
 #include <cstdint>
 #include <cstdlib>
 
+#ifdef __APPLE__
+extern "C" std::uintptr_t __stack_chk_guard_nid_postfix = 0xDEADBEEFCAFEBABEull;
+#else
 std::uintptr_t __stack_chk_guard = 0xDEADBEEFCAFEBABEull;
+#endif
diff --git a/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp b/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp
index cc2ff7b9e3..516a53933a 100644
--- a/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp
+++ b/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <stdexcept>
 
diff --git a/core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp b/core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp
index c81b91a39a..0c33a3ef77 100644
--- a/core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp
+++ b/core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp
@@ -1,6 +1,17 @@
-#if defined(_WIN32) || defined(__linux__)
+#if defined(_WIN32) || defined(__linux__) || (defined(__APPLE__) && defined(__x86_64__))
 #ifdef _WIN32
 #include <windows.h>
+#elif defined(__APPLE__)
+#include <cerrno>
+#include <csignal>
+#include <ctime>
+#include <mach-o/dyld.h>
+#include <mach-o/loader.h>
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#include <pthread.h>
+#include <sys/mman.h>
+#include <unistd.h>
 #else
 #include <cerrno>
 #include <csignal>
@@ -14,15 +25,21 @@
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <atomic>
+#include <chrono>
 #include <cstdlib>
 #include <cstring>
+#include <filesystem>
+#include <fstream>
 #include <limits>
 #include <mutex>
 #include <stdexcept>
 #include <string>
 #include <string_view>
 #include <system_error>
+#include <thread>
 #include <unordered_map>
+#include <utility>
+#include <vector>
 
 extern "C" void CallTraceEnter_nid_no_patch();
 
@@ -71,9 +88,46 @@ bool Selected(std::string_view library) {
     return false;
 }
 
+bool WriteCallCounts(const std::filesystem::path& path) {
+    const std::size_t recorded = g_recordCount.load(std::memory_order_acquire);
+    const ImportRecord* records = g_records.load(std::memory_order_acquire);
+    std::vector<std::pair<std::uint64_t, const ImportRecord*>> called;
+    for (std::size_t index = 0; index < recorded; ++index) {
+        const std::uint64_t calls = records[index].calls.load(std::memory_order_relaxed);
+        if (calls != 0) called.emplace_back(calls, &records[index]);
+    }
+    std::stable_sort(called.begin(), called.end(), [](const auto& left, const auto& right) { return left.first > right.first; });
+    std::ofstream file(path, std::ios::binary | std::ios::trunc);
+    for (const auto& [calls, record] : called) file << calls << ' ' << record->library << ' ' << record->name << '\n';
+    file.flush();
+    return static_cast<bool>(file);
+}
+
+void StartCallCountWriter() {
+#ifdef _WIN32
+    const wchar_t* value = _wgetenv(L"APS5_TRACE_CALLS_FILE");
+    if (value == nullptr || *value == L'\0') return;
+    std::filesystem::path path(value);
+#else
+    const char* value = std::getenv("APS5_TRACE_CALLS_FILE");
+    if (value == nullptr || *value == '\0') return;
+    std::filesystem::path path(value);
+#endif
+    std::thread([path = std::move(path)] {
+        for (;;) {
+            std::this_thread::sleep_for(std::chrono::seconds(10));
+            WriteCallCounts(path);
+        }
+    }).detach();
+}
+
 std::uint64_t CurrentThread() {
 #ifdef _WIN32
     return GetCurrentThreadId();
+#elif defined(__APPLE__)
+    std::uint64_t thread = 0;
+    pthread_threadid_np(nullptr, &thread);
+    return thread;
 #else
     return static_cast<std::uint64_t>(gettid());
 #endif
@@ -89,6 +143,22 @@ void MapThunkArea() {
     CloseHandle(section);
     if (g_writable == nullptr || g_executable == nullptr) throw std::system_error(static_cast<int>(code), std::system_category(), "call trace: MapViewOfFile");
 }
+#elif defined(__APPLE__)
+void MapThunkArea() {
+    void* writable = mmap(nullptr, ThunkAreaBytes, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);
+    if (writable == MAP_FAILED) throw std::system_error(errno, std::generic_category(), "call trace: mmap");
+    mach_vm_address_t executable = 0;
+    vm_prot_t current = VM_PROT_NONE;
+    vm_prot_t maximum = VM_PROT_NONE;
+    const kern_return_t remapped = mach_vm_remap(mach_task_self(), &executable, ThunkAreaBytes, 0, VM_FLAGS_ANYWHERE, mach_task_self(), reinterpret_cast<mach_vm_address_t>(writable), false, &current, &maximum, VM_INHERIT_NONE);
+    if (remapped != KERN_SUCCESS || mach_vm_protect(mach_task_self(), executable, ThunkAreaBytes, false, VM_PROT_READ | VM_PROT_EXECUTE) != KERN_SUCCESS) {
+        if (remapped == KERN_SUCCESS) mach_vm_deallocate(mach_task_self(), executable, ThunkAreaBytes);
+        munmap(writable, ThunkAreaBytes);
+        throw std::system_error(remapped == KERN_SUCCESS ? KERN_PROTECTION_FAILURE : remapped, std::system_category(), "call trace: mach_vm_remap");
+    }
+    g_writable = static_cast<std::uint8_t*>(writable);
+    g_executable = reinterpret_cast<std::uint8_t*>(executable);
+}
 #else
 void MapThunkArea() {
     const int file = memfd_create("aps5-call-trace", MFD_CLOEXEC);
@@ -108,7 +178,9 @@ void MapThunkArea() {
     g_writable = static_cast<std::uint8_t*>(writable);
     g_executable = static_cast<std::uint8_t*>(executable);
 }
+#endif
 
+#ifndef _WIN32
 struct ModuleSegment {
     std::uint64_t start;
     std::uint64_t end;
@@ -128,6 +200,42 @@ std::atomic<bool> g_reporting{false};
 std::atomic<bool> g_reported{false};
 unsigned long long g_moduleChanges = ~0ull;
 
+#if defined(__APPLE__)
+void SnapshotModules() {
+    const auto images = _dyld_image_count();
+    unsigned long long changes = images;
+    for (std::uint32_t index = 0; index < images; ++index)
+        changes = changes * 131u + reinterpret_cast<unsigned long long>(_dyld_get_image_header(index));
+    if (changes == g_moduleChanges) return;
+    g_moduleChanges = changes;
+    auto* map = new ModuleMap{};
+    for (std::uint32_t index = 0; index < images && map->count < std::size(map->segments); ++index) {
+        const auto* header = reinterpret_cast<const mach_header_64*>(_dyld_get_image_header(index));
+        if (header == nullptr || header->magic != MH_MAGIC_64) continue;
+        const char* path = _dyld_get_image_name(index);
+        if (path == nullptr || *path == '\0') path = getprogname();
+        const char* slash = std::strrchr(path, '/');
+        const char* name = slash == nullptr ? path : slash + 1;
+        const auto slide = static_cast<std::uint64_t>(_dyld_get_image_vmaddr_slide(index));
+        const auto base = reinterpret_cast<std::uint64_t>(header);
+        auto* command = reinterpret_cast<const load_command*>(header + 1);
+        for (std::uint32_t commandIndex = 0; commandIndex < header->ncmds && map->count < std::size(map->segments); ++commandIndex) {
+            if (command->cmd == LC_SEGMENT_64) {
+                const auto* segment = reinterpret_cast<const segment_command_64*>(command);
+                if (segment->vmsize != 0 && (segment->initprot & VM_PROT_EXECUTE) != 0) {
+                    auto& recorded = map->segments[map->count++];
+                    recorded.base = base;
+                    recorded.start = segment->vmaddr + slide;
+                    recorded.end = recorded.start + segment->vmsize;
+                    std::strncpy(recorded.name, name, sizeof(recorded.name) - 1);
+                }
+            }
+            command = reinterpret_cast<const load_command*>(reinterpret_cast<const std::uint8_t*>(command) + command->cmdsize);
+        }
+    }
+    g_modules.store(map, std::memory_order_release);
+}
+#else
 void SnapshotModules() {
     unsigned long long changes = 0;
     dl_iterate_phdr([](dl_phdr_info* info, std::size_t, void* data) {
@@ -159,6 +267,7 @@ void SnapshotModules() {
     }, map);
     g_modules.store(map, std::memory_order_release);
 }
+#endif
 
 class ReportLine {
 public:
@@ -331,11 +440,12 @@ void* TraceImport_nid_no_patch(void* target, const char* name, const char* libra
         MapThunkArea();
         g_records.store(new ImportRecord[RecordCapacity], std::memory_order_release);
         g_ring.store(new RingSlot[RingCapacity], std::memory_order_release);
-#ifdef __linux__
+#if defined(__linux__) || defined(__APPLE__)
         InstallAbortReport();
 #endif
+        StartCallCountWriter();
     }
-#ifdef __linux__
+#if defined(__linux__) || defined(__APPLE__)
     SnapshotModules();
 #endif
     if (const auto existing = g_thunkByTarget.find(target); existing != g_thunkByTarget.end()) return existing->second;
@@ -386,6 +496,11 @@ std::size_t CopyThreadCallTrace_nid_no_patch(std::uint64_t thread, CallTraceEntr
     return count;
 }
 
+bool WriteCallCounts_nid_no_patch(const char* path) {
+    if (path == nullptr || *path == '\0') return false;
+    return WriteCallCounts(std::filesystem::path(reinterpret_cast<const char8_t*>(path)));
+}
+
 std::size_t CopyCallCounts_nid_no_patch(CallTraceCount* entries, std::size_t capacity, std::uint64_t* total) {
     if (total != nullptr) *total = g_sequence.load(std::memory_order_acquire);
     if (entries == nullptr || capacity == 0) return 0;
@@ -430,7 +545,7 @@ asm(".text\n"
     "    movdqu %xmm7, 112(%rsp)\n"
     "    mov %r11, %rdi\n"
     "    mov 200(%rsp), %rsi\n"
-    "    call CallTraceRecord_nid_no_patch\n"
+    "    call " APS5_ASM_SYMBOL("CallTraceRecord_nid_no_patch") "\n"
     "    movdqu 0(%rsp), %xmm0\n"
     "    movdqu 16(%rsp), %xmm1\n"
     "    movdqu 32(%rsp), %xmm2\n"
diff --git a/core/libs/prx/libkernel/Aio/src/Aio.cpp b/core/libs/prx/libkernel/Aio/src/Aio.cpp
index 9926ac1dd6..556649a58b 100644
--- a/core/libs/prx/libkernel/Aio/src/Aio.cpp
+++ b/core/libs/prx/libkernel/Aio/src/Aio.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <array>
 #include <cerrno>
 #include <chrono>
@@ -5,12 +6,12 @@
 #include <cstdint>
 #include <mutex>
 #include <stdexcept>
-#include <string>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/PreciseWait.hpp"
 #include "prx/libkernel/File/include/ArchivedFile.hpp"
+#include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include "prx/libkernel/File/include/SharedMemory.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -25,6 +26,7 @@ namespace {
 constexpr std::int32_t AioProcessing = 2;
 constexpr std::int32_t AioCompleted = 3;
 constexpr std::int32_t AioAborted = 4;
+constexpr std::int32_t AioReported = 0x10000;
 constexpr std::int32_t AioMaxQueues = 512;
 constexpr std::int32_t AioRequestNumMax = 128;
 constexpr std::int32_t AioIdNumMax = 128;
@@ -34,6 +36,11 @@ constexpr std::int32_t AioSchedulingWindowMax = 128;
 constexpr std::int32_t AioDelayedCountMax = 128;
 constexpr std::uint32_t AioSplitSizeMax = 0x1000000;
 constexpr std::uint32_t AioSplitChunkSizeMax = 0x1000000;
+constexpr std::int32_t AioPriorityLow = 1;
+constexpr std::int32_t AioPriorityHigh = 3;
+constexpr std::int32_t AioDefaultSchedulingWindow = 32;
+constexpr std::int32_t AioDefaultDelayedCountLimit = 32;
+constexpr std::uint32_t AioDefaultSplitSize = 0x100000;
 
 std::mutex g_mutex;
 std::array<std::int32_t, AioMaxQueues> g_states{};
@@ -57,7 +64,32 @@ void SetState(std::int32_t id, std::int32_t state) {
     g_states[id] = state;
 }
 
+std::int32_t StateLocked(std::int32_t id) {
+    return ValidId(id) && g_states[id] != 0 ? g_states[id] : SCE_KERNEL_ERROR_ESRCH;
+}
+
+std::int32_t ReportLocked(std::int32_t id) {
+    const std::int32_t state = StateLocked(id);
+    if (state != SCE_KERNEL_ERROR_ESRCH && state != AioProcessing) g_states[id] |= AioReported;
+    return state;
+}
+
+std::int32_t CancelLocked(std::int32_t id) {
+    const std::int32_t state = StateLocked(id);
+    if (state == SCE_KERNEL_ERROR_ESRCH) return state;
+    if (state != AioProcessing) return state & ~AioReported;
+    g_states[id] = AioAborted;
+    return AioAborted;
+}
+
+std::int32_t DeleteLocked(std::int32_t id) {
+    if (StateLocked(id) == SCE_KERNEL_ERROR_ESRCH) return SCE_KERNEL_ERROR_ESRCH;
+    g_states[id] = 0;
+    return 0;
+}
+
 std::int64_t NativePread(std::int32_t fd, void* buf, std::size_t nbyte, std::int64_t offset) {
+    if (File::IsVirtualDirectoryDescriptor(fd)) { errno = EISDIR; return -1; }
     const GuestArena::HostWrite destination(buf, nbyte);
     if (!destination.Open()) {
         errno = EFAULT;
@@ -80,6 +112,7 @@ std::int64_t NativePread(std::int32_t fd, void* buf, std::size_t nbyte, std::int
 }
 
 std::int64_t NativePwrite(std::int32_t fd, const void* buf, std::size_t nbyte, std::int64_t offset) {
+    if (File::IsVirtualDirectoryDescriptor(fd)) { errno = EISDIR; return -1; }
     if (offset < 0) {
         errno = EINVAL;
         return -1;
@@ -93,7 +126,7 @@ std::int64_t NativePwrite(std::int32_t fd, const void* buf, std::size_t nbyte, s
 #endif
 }
 
-bool RunRequest(KernelAioRwRequest& req, bool write) {
+void RunRequest(KernelAioRwRequest& req, bool write) {
     const std::int64_t done = write
         ? NativePwrite(req.fd, req.buf, req.nbyte, req.offset)
         : NativePread(req.fd, req.buf, req.nbyte, req.offset);
@@ -103,55 +136,48 @@ bool RunRequest(KernelAioRwRequest& req, bool write) {
         if (error == EBADF) req.result->return_value = static_cast<std::int64_t>(SCE_KERNEL_ERROR_EBADF);
         if (error == EFAULT) req.result->return_value = static_cast<std::int64_t>(SCE_KERNEL_ERROR_EFAULT);
         if (error == EINVAL) req.result->return_value = static_cast<std::int64_t>(SCE_KERNEL_ERROR_EINVAL);
-        req.result->state = AioAborted;
-        return false;
+        if (error == EISDIR) req.result->return_value = static_cast<std::int64_t>(SCE_KERNEL_ERROR_EISDIR);
+        req.result->state = AioCompleted;
+        return;
     }
     req.result->return_value = done;
     req.result->state = AioCompleted;
-    return true;
 }
 
-int ValidateRequests(KernelAioRwRequest* req, std::int32_t size, const void* id) {
+int ValidateRequests(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, const void* id) {
     if (req == nullptr || id == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (size <= 0) return SCE_KERNEL_ERROR_EINVAL;
+    if (size <= 0 || size > AioRequestNumMax || prio < AioPriorityLow || prio > AioPriorityHigh) return SCE_KERNEL_ERROR_EINVAL;
     for (std::int32_t i = 0; i < size; ++i) {
         if (req[i].result == nullptr) return SCE_KERNEL_ERROR_EFAULT;
     }
     return 0;
 }
 
-int SubmitCommands(KernelAioRwRequest* req, std::int32_t size, bool write, std::int32_t* id) {
-    const int error = ValidateRequests(req, size, id);
+int SubmitCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, bool write, std::int32_t* id) {
+    const int error = ValidateRequests(req, size, prio, id);
     if (error != 0) return error;
     const std::int32_t queue = AllocateId();
-    bool aborted = false;
-    for (std::int32_t i = 0; i < size; ++i) {
-        if (!RunRequest(req[i], write)) aborted = true;
-    }
-    SetState(queue, aborted ? AioAborted : AioCompleted);
+    for (std::int32_t i = 0; i < size; ++i) RunRequest(req[i], write);
+    SetState(queue, AioCompleted);
     *id = queue;
     return 0;
 }
 
-int SubmitCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, bool write, std::int32_t* id, const char* name) {
-    if (req != nullptr && id != nullptr && size > AioRequestNumMax) throw std::runtime_error(std::string(name) + ": more than 128 requests per batch is not modelled");
-    const int error = ValidateRequests(req, size, id);
+int SubmitCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, bool write, std::int32_t* id) {
+    const int error = ValidateRequests(req, size, prio, id);
     if (error != 0) return error;
     for (std::int32_t i = 0; i < size; ++i) {
         const std::int32_t queue = AllocateId();
-        SetState(queue, RunRequest(req[i], write) ? AioCompleted : AioAborted);
+        RunRequest(req[i], write);
+        SetState(queue, AioCompleted);
         id[i] = queue;
     }
     return 0;
 }
 
-int ValidateIds(const std::int32_t* id, std::int32_t num, const void* out, const char* name) {
+int ValidateIds(const std::int32_t* id, std::int32_t num, const void* out) {
     if (id == nullptr || out == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (num < 0) return SCE_KERNEL_ERROR_EINVAL;
-    if (num > AioIdNumMax) throw std::runtime_error(std::string(name) + ": more than 128 ids per batch is not modelled");
-    for (std::int32_t i = 0; i < num; ++i) {
-        if (!ValidId(id[i])) return SCE_KERNEL_ERROR_EINVAL;
-    }
+    if (num <= 0 || num > AioIdNumMax) return SCE_KERNEL_ERROR_EINVAL;
     return 0;
 }
 
@@ -161,49 +187,31 @@ extern "C" {
 
 int APS5_VABI sceKernelAioDeleteRequest(int32_t id, int32_t* ret) {
     if (ret == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
-    SetState(id, AioAborted);
-    *ret = 0;
+    std::lock_guard<std::mutex> lock(g_mutex);
+    *ret = DeleteLocked(id);
     return 0;
 }
 
 int APS5_VABI sceKernelAioDeleteRequests(int32_t* id, int32_t num, int32_t* ret) {
-    const int error = ValidateIds(id, num, ret, "sceKernelAioDeleteRequests");
+    const int error = ValidateIds(id, num, ret);
     if (error != 0) return error;
-    for (int32_t i = 0; i < num; ++i) {
-        SetState(id[i], AioAborted);
-        ret[i] = 0;
-    }
+    std::lock_guard<std::mutex> lock(g_mutex);
+    for (int32_t i = 0; i < num; ++i) ret[i] = DeleteLocked(id[i]);
     return 0;
 }
 
 int APS5_VABI sceKernelAioCancelRequest(int32_t id, int32_t* state) {
     if (state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (id == 0) {
-        *state = AioProcessing;
-        return 0;
-    }
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
-    SetState(id, AioAborted);
-    *state = AioAborted;
+    std::lock_guard<std::mutex> lock(g_mutex);
+    *state = CancelLocked(id);
     return 0;
 }
 
 int APS5_VABI sceKernelAioCancelRequests(int32_t* id, int32_t num, int32_t* state) {
-    if (id == nullptr || state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (num < 0) return SCE_KERNEL_ERROR_EINVAL;
-    if (num > AioIdNumMax) throw std::runtime_error("sceKernelAioCancelRequests: more than 128 ids per batch is not modelled");
-    for (int32_t i = 0; i < num; ++i) {
-        if (id[i] != 0 && !ValidId(id[i])) return SCE_KERNEL_ERROR_EINVAL;
-    }
-    for (int32_t i = 0; i < num; ++i) {
-        if (id[i] == 0) {
-            state[i] = AioProcessing;
-            continue;
-        }
-        SetState(id[i], AioAborted);
-        state[i] = AioAborted;
-    }
+    const int error = ValidateIds(id, num, state);
+    if (error != 0) return error;
+    std::lock_guard<std::mutex> lock(g_mutex);
+    for (int32_t i = 0; i < num; ++i) state[i] = CancelLocked(id[i]);
     return 0;
 }
 
@@ -215,14 +223,18 @@ int APS5_VABI sceKernelAioInitializeImpl(void* param, int32_t size) {
 
 void APS5_VABI sceKernelAioInitializeParam(void* param) {
     if (param == nullptr) throw std::invalid_argument("sceKernelAioInitializeParam: param is null");
+    auto* scheduling = static_cast<KernelAioSchedulingParam*>(param);
+    for (int index = 0; index < 3; ++index) {
+        const bool split = index < 2;
+        scheduling[index] = {AioDefaultSchedulingWindow, AioDefaultDelayedCountLimit, split ? 1u : 0u, split ? AioDefaultSplitSize : 0u, split ? AioDefaultSplitSize : 0u};
+    }
 }
 
 int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, int32_t schedulingWindowSize, int32_t delayedCountLimit, uint32_t enableSplit, uint32_t splitSize, uint32_t splitChunkSize) {
     if (param == nullptr) throw std::invalid_argument("sceKernelAioSetParam: param is null");
-    if (schedulingWindowSize < 0 || schedulingWindowSize > AioSchedulingWindowMax) throw std::runtime_error("sceKernelAioSetParam: a scheduling window outside 0..128 is not modelled");
-    if (delayedCountLimit < 0 || delayedCountLimit > AioDelayedCountMax) throw std::runtime_error("sceKernelAioSetParam: a delayed count limit outside 0..128 is not modelled");
-    if (enableSplit > 1) throw std::runtime_error("sceKernelAioSetParam: a split flag other than 0 or 1 is not modelled");
-    if (splitSize > AioSplitSizeMax || splitChunkSize > AioSplitChunkSizeMax) throw std::runtime_error("sceKernelAioSetParam: a split size above 0x1000000 is not modelled");
+    if (schedulingWindowSize < 0 || schedulingWindowSize > AioSchedulingWindowMax || delayedCountLimit < 0 || delayedCountLimit > AioDelayedCountMax || enableSplit > 1)
+        return SCE_KERNEL_ERROR_EINVAL;
+    if (enableSplit == 1 && (splitSize == 0 || splitSize > AioSplitSizeMax || splitChunkSize == 0 || splitChunkSize > AioSplitChunkSizeMax)) return SCE_KERNEL_ERROR_EINVAL;
     param->schedulingWindowSize = schedulingWindowSize;
     param->delayedCountLimit = delayedCountLimit;
     param->enableSplit = enableSplit;
@@ -232,37 +244,32 @@ int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, int32_t sche
 }
 
 int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommands(req, size, false, id);
+    return SubmitCommands(req, size, prio, false, id);
 }
 
 int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommands(req, size, true, id);
+    return SubmitCommands(req, size, prio, true, id);
 }
 
 int APS5_VABI sceKernelAioSubmitReadCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommandsMultiple(req, size, false, id, "sceKernelAioSubmitReadCommandsMultiple");
+    return SubmitCommandsMultiple(req, size, prio, false, id);
 }
 
 int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommandsMultiple(req, size, true, id, "sceKernelAioSubmitWriteCommandsMultiple");
+    return SubmitCommandsMultiple(req, size, prio, true, id);
 }
 
 int APS5_VABI sceKernelAioPollRequest(int32_t id, int32_t* state) {
     if (state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
     std::lock_guard<std::mutex> lock(g_mutex);
-    *state = g_states[id];
+    *state = ReportLocked(id);
     return 0;
 }
 
 int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state, uint32_t mode, uint32_t* usec) {
-    const int error = ValidateIds(id, num, state, "sceKernelAioWaitRequests");
+    const int error = ValidateIds(id, num, state);
     if (error != 0) return error;
-    if (mode != AioWaitAnd && mode != AioWaitOr) throw std::runtime_error("sceKernelAioWaitRequests: unsupported wait mode");
+    if (mode != AioWaitAnd && mode != AioWaitOr) return SCE_KERNEL_ERROR_EINVAL;
     const auto start = std::chrono::steady_clock::now();
     for (;;) {
         bool allDone = true;
@@ -270,15 +277,22 @@ int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state,
         {
             std::lock_guard<std::mutex> lock(g_mutex);
             for (int32_t i = 0; i < num; ++i) {
-                state[i] = g_states[id[i]];
-                if (state[i] == AioProcessing) allDone = false;
-                if (state[i] == AioCompleted) anyCompleted = true;
+                const std::int32_t current = StateLocked(id[i]);
+                if (current == AioProcessing) allDone = false;
+                if ((current & ~AioReported) == AioCompleted) anyCompleted = true;
+            }
+            if (allDone || (mode == AioWaitOr && anyCompleted)) {
+                for (int32_t i = 0; i < num; ++i) state[i] = ReportLocked(id[i]);
+                return 0;
             }
         }
-        if (allDone || (mode == AioWaitOr && anyCompleted)) return 0;
         if (usec != nullptr && *usec != 0) {
             const auto elapsed = std::chrono::duration_cast<std::chrono::microseconds>(std::chrono::steady_clock::now() - start).count();
-            if (elapsed > static_cast<std::int64_t>(*usec)) return SCE_KERNEL_ERROR_ETIMEDOUT;
+            if (elapsed > static_cast<std::int64_t>(*usec)) {
+                std::lock_guard<std::mutex> lock(g_mutex);
+                for (int32_t i = 0; i < num; ++i) state[i] = ReportLocked(id[i]);
+                return SCE_KERNEL_ERROR_ETIMEDOUT;
+            }
         }
         PreciseSleepUs(10);
     }
@@ -286,13 +300,12 @@ int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state,
 
 int APS5_VABI sceKernelAioWaitRequest(int32_t id, int32_t* state, uint32_t* usec) {
     if (state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
     const auto start = std::chrono::steady_clock::now();
     for (;;) {
         std::int32_t current;
         {
             std::lock_guard<std::mutex> lock(g_mutex);
-            current = g_states[id];
+            current = ReportLocked(id);
         }
         if (current != AioProcessing) {
             *state = current;
@@ -310,10 +323,10 @@ int APS5_VABI sceKernelAioWaitRequest(int32_t id, int32_t* state, uint32_t* usec
 }
 
 int APS5_VABI sceKernelAioPollRequests(int32_t* id, int32_t num, int32_t* state) {
-    const int error = ValidateIds(id, num, state, "sceKernelAioPollRequests");
+    const int error = ValidateIds(id, num, state);
     if (error != 0) return error;
     std::lock_guard<std::mutex> lock(g_mutex);
-    for (int32_t i = 0; i < num; ++i) state[i] = g_states[id[i]];
+    for (int32_t i = 0; i < num; ++i) state[i] = ReportLocked(id[i]);
     return 0;
 }
 
diff --git a/core/libs/prx/libkernel/Apr/src/Apr.cpp b/core/libs/prx/libkernel/Apr/src/Apr.cpp
index 42e4274d9e..49676567f6 100644
--- a/core/libs/prx/libkernel/Apr/src/Apr.cpp
+++ b/core/libs/prx/libkernel/Apr/src/Apr.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <optional>
 #include <deque>
@@ -35,8 +37,6 @@
 #include <windows.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 constexpr int GUEST_ENOENT = 2;
@@ -674,6 +674,7 @@ std::optional<Deferred> _execute(const Apr::CommandBufferObject& buffer, std::ui
         case Apr::Opcode::WriteKernelEventQueue: {
             const auto command = _read<Apr::WriteKernelEventQueueCommand>(buffer, cursor);
             EqueueTriggerEvent_nid_postfix(static_cast<KernelEqueue>(command.equeue), static_cast<uintptr_t>(command.ident), EVFILT_AMPR, reinterpret_cast<void*>(command.data));
+
             break;
         }
         case Apr::Opcode::WriteAddressFromTimeCounter: {
@@ -701,8 +702,6 @@ std::optional<Deferred> _execute(const Apr::CommandBufferObject& buffer, std::ui
 
 extern "C" {
 
-int APS5_VABI sceKernelAllocateDirectMemory(int64_t searchStart, int64_t searchEnd, size_t length, size_t alignment, int memoryType, int64_t* offset);
-
 int AmmGiveDirectMemory_nid_no_patch(std::int64_t searchStart, std::int64_t searchEnd, std::size_t size, std::size_t alignment, int usage, std::int64_t* offset) {
     if (!offset || (usage != 0 && usage != 1)) return SCE_KERNEL_ERROR_EINVAL;
     const int result = sceKernelAllocateDirectMemory(searchStart, searchEnd, size, alignment, 0, offset);
@@ -826,7 +825,6 @@ bool AmmSubmitted_nid_no_patch(std::uint32_t id) {
     return true;
 }
 
-
 int APS5_VABI sceKernelAprResolveFilepathsToIds(const char** paths, uint32_t count, uint32_t* ids, uint32_t* error_index) {
     if (!paths || !ids) return _fail(GUEST_EINVAL);
     for (uint32_t index = 0; index < count; ++index) {
diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt
index 2f39251297..cd243bc51c 100644
--- a/core/libs/prx/libkernel/CMakeLists.txt
+++ b/core/libs/prx/libkernel/CMakeLists.txt
@@ -46,6 +46,7 @@ add_library(libkernel SHARED EXCLUDE_FROM_ALL
         ${CMAKE_CURRENT_SOURCE_DIR}/Pthread/Posix/Tsd.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Pthread/Posix/Sem.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Pthread/Posix/Spinlock.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/Pselect.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/Socket.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/Udp.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/SocketOptions.cpp
@@ -55,6 +56,7 @@ add_library(libkernel SHARED EXCLUDE_FROM_ALL
         ${CMAKE_CURRENT_SOURCE_DIR}/Module/src/Module.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Module/src/DynamicLoader.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Module/src/ModuleInfo.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Module/src/Tls.cpp
         ${LIBS_INCLUDE_DIR}/nid/src/NidCompute.cpp
         ${LIBS_INCLUDE_DIR}/nid/src/Sha1.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Aio/src/Aio.cpp
@@ -67,6 +69,7 @@ add_library(libkernel SHARED EXCLUDE_FROM_ALL
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/HostCpu.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/SystemConfiguration.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/Login.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/System/src/Getlogin.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/SoftwareVersion.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/Error.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/ThermalSensors.cpp
@@ -187,6 +190,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_posix_sem_init guest_posix_sem_post PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_posix_named_sem_tests ${LIBS_INCLUDE_DIR}/tests/GuestPosixNamedSem.cpp)
+    target_include_directories(guest_posix_named_sem_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_posix_named_sem_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_posix_named_sem_tests)
+    add_test(NAME guest_posix_named_sem COMMAND guest_posix_named_sem_tests)
+    set_tests_properties(guest_posix_named_sem PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_posix_named_sem PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_process_time_tests ${LIBS_INCLUDE_DIR}/tests/GuestProcessTime.cpp)
     target_include_directories(guest_process_time_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_process_time_tests PRIVATE libkernel libc)
@@ -213,6 +226,17 @@ if(BUILD_TESTING)
         set_tests_properties(guest_process_arguments PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    find_package(Python3 QUIET COMPONENTS Interpreter)
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND Python3_Interpreter_FOUND)
+        add_test_executable(guest_runtime_lifecycle_tests ${LIBS_INCLUDE_DIR}/tests/GuestRuntimeLifecycle.cpp)
+        target_include_directories(guest_runtime_lifecycle_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_runtime_lifecycle_tests PRIVATE libkernel libc ${CMAKE_DL_LIBS})
+        set_target_properties(guest_runtime_lifecycle_tests PROPERTIES ENABLE_EXPORTS ON)
+        add_dependencies(guest_runtime_lifecycle_tests relinker)
+        add_test(NAME guest_runtime_lifecycle COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_SOURCE_DIR}/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py
+            $<TARGET_FILE:relinker> $<TARGET_FILE:guest_runtime_lifecycle_tests> $<TARGET_FILE_DIR:libkernel>)
+    endif()
     add_library(guest_module_fixture SHARED ${LIBS_INCLUDE_DIR}/tests/GuestModuleFixture.cpp)
     target_include_directories(guest_module_fixture PRIVATE ${LIBS_INCLUDE_DIR})
     add_custom_command(TARGET guest_module_fixture POST_BUILD
@@ -221,11 +245,12 @@ if(BUILD_TESTING)
     add_dependencies(guest_module_fixture nid_patcher)
     configure_windows_unwind(guest_module_fixture)
     set_target_properties(guest_module_fixture PROPERTIES BUILD_WITH_INSTALL_RPATH ON INSTALL_RPATH "$ORIGIN")
-    find_package(Python3 QUIET COMPONENTS Interpreter)
-    if(Python3_Interpreter_FOUND AND NOT WIN32)
-        target_link_options(guest_module_fixture PRIVATE -Wl,--no-as-needed)
-        add_test(NAME nid_patcher_dynamic_strings COMMAND ${Python3_EXECUTABLE}
-            ${LIBS_INCLUDE_DIR}/nid/tests/test_dynamic_strings.py $<TARGET_FILE:guest_module_fixture>)
+    if(Python3_Interpreter_FOUND)
+        if(NOT WIN32)
+            target_link_options(guest_module_fixture PRIVATE -Wl,--no-as-needed)
+            add_test(NAME nid_patcher_dynamic_strings COMMAND ${Python3_EXECUTABLE}
+                ${LIBS_INCLUDE_DIR}/nid/tests/test_dynamic_strings.py $<TARGET_FILE:guest_module_fixture>)
+        endif()
         add_test(NAME nid_patcher_symbol_versions COMMAND ${Python3_EXECUTABLE}
             ${LIBS_INCLUDE_DIR}/nid/tests/test_symbol_versions.py $<TARGET_FILE:nid_patcher>)
     endif()
@@ -358,8 +383,27 @@ if(BUILD_TESTING)
         target_link_libraries(guest_host_standard_error_windows_tests PRIVATE libkernel libc)
         configure_windows_unwind(guest_host_standard_error_windows_tests)
         add_test(NAME guest_host_standard_error_windows COMMAND guest_host_standard_error_windows_tests)
-        set_tests_properties(guest_host_standard_error_windows PROPERTIES TIMEOUT 10 ENVIRONMENT_MODIFICATION
+        add_test(NAME guest_host_standard_buffering_windows COMMAND guest_host_standard_error_windows_tests --buffering)
+        set_tests_properties(guest_host_standard_error_windows guest_host_standard_buffering_windows PROPERTIES TIMEOUT 10 ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test_executable(guest_closed_standard_descriptors_windows_tests ${LIBS_INCLUDE_DIR}/tests/GuestClosedStandardDescriptorsWindows.cpp)
+        target_include_directories(guest_closed_standard_descriptors_windows_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_closed_standard_descriptors_windows_tests PRIVATE libkernel libc)
+        configure_windows_unwind(guest_closed_standard_descriptors_windows_tests)
+        add_test(NAME guest_closed_standard_descriptors_windows COMMAND guest_closed_standard_descriptors_windows_tests)
+        set_tests_properties(guest_closed_standard_descriptors_windows PROPERTIES TIMEOUT 30 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test_executable(guest_closed_standard_streams_load_windows_tests ${LIBS_INCLUDE_DIR}/tests/GuestClosedStandardStreamsLoadWindows.cpp)
+        target_include_directories(guest_closed_standard_streams_load_windows_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_closed_standard_streams_load_windows_tests PRIVATE shell32)
+        if(MINGW)
+            target_compile_options(guest_closed_standard_streams_load_windows_tests PRIVATE -fasynchronous-unwind-tables)
+        endif()
+        add_dependencies(guest_closed_standard_streams_load_windows_tests libc)
+        configure_windows_unwind(guest_closed_standard_streams_load_windows_tests)
+        add_test(NAME guest_closed_standard_streams_load_windows COMMAND guest_closed_standard_streams_load_windows_tests "$<TARGET_FILE:libc>")
+        set_tests_properties(guest_closed_standard_streams_load_windows PROPERTIES TIMEOUT 10
+            ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test_executable(guest_truncate_tests ${LIBS_INCLUDE_DIR}/tests/GuestTruncate.cpp)
     target_include_directories(guest_truncate_tests PRIVATE ${LIBS_INCLUDE_DIR})
@@ -522,6 +566,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_kernel_stack_protect PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_tls_get_addr_tests ${LIBS_INCLUDE_DIR}/tests/GuestTlsGetAddr.cpp)
+    target_include_directories(guest_tls_get_addr_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_tls_get_addr_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_tls_get_addr_tests)
+    add_test(NAME guest_tls_get_addr COMMAND guest_tls_get_addr_tests)
+    set_tests_properties(guest_tls_get_addr PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_tls_get_addr PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_thread_self_tests ${LIBS_INCLUDE_DIR}/tests/GuestThreadSelf.cpp)
     target_include_directories(guest_thread_self_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_thread_self_tests PRIVATE libkernel libc)
@@ -689,6 +743,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_pthread_condattr PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_pthread_cond_setname_tests ${LIBS_INCLUDE_DIR}/tests/GuestPthreadCondSetname.cpp)
+    target_include_directories(guest_pthread_cond_setname_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_pthread_cond_setname_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_pthread_cond_setname_tests)
+    add_test(NAME guest_pthread_cond_setname COMMAND guest_pthread_cond_setname_tests)
+    set_tests_properties(guest_pthread_cond_setname PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_pthread_cond_setname PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_cond_recursive_mutex_tests ${LIBS_INCLUDE_DIR}/tests/GuestCondRecursiveMutex.cpp)
     target_include_directories(guest_cond_recursive_mutex_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_cond_recursive_mutex_tests PRIVATE libkernel libc)
@@ -948,10 +1012,30 @@ if(BUILD_TESTING)
     target_link_libraries(guest_signal_tests PRIVATE libkernel libc)
     configure_windows_unwind(guest_signal_tests)
     add_test(NAME guest_signals COMMAND guest_signal_tests)
+    add_test_executable(guest_signal_interrupt_tests ${LIBS_INCLUDE_DIR}/tests/GuestSignalInterrupt.cpp)
+    target_include_directories(guest_signal_interrupt_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_signal_interrupt_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_signal_interrupt_tests)
+    add_test(NAME guest_signal_interrupt COMMAND guest_signal_interrupt_tests)
+    set_tests_properties(guest_signal_interrupt PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_signal_interrupt PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     if(WIN32)
         set_tests_properties(guest_signals PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_signal_handler_mask_tests ${LIBS_INCLUDE_DIR}/tests/GuestSignalHandlerMask.cpp)
+    target_include_directories(guest_signal_handler_mask_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_signal_handler_mask_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_signal_handler_mask_tests)
+    add_test(NAME guest_signal_handler_mask COMMAND guest_signal_handler_mask_tests)
+    set_tests_properties(guest_signal_handler_mask PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_signal_handler_mask PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_sigtimedwait_tests ${LIBS_INCLUDE_DIR}/tests/GuestSigtimedwait.cpp)
     target_include_directories(guest_sigtimedwait_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_sigtimedwait_tests PRIVATE libkernel libc)
@@ -1141,7 +1225,7 @@ if(BUILD_TESTING)
     endif()
     add_test_executable(guest_getlogin_tests ${LIBS_INCLUDE_DIR}/tests/GuestGetlogin.cpp)
     target_include_directories(guest_getlogin_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_getlogin_tests PRIVATE libkernel libc)
+    target_link_libraries(guest_getlogin_tests PRIVATE libkernel libkernel_sys libc)
     configure_windows_unwind(guest_getlogin_tests)
     add_test(NAME guest_getlogin COMMAND guest_getlogin_tests)
     set_tests_properties(guest_getlogin PROPERTIES TIMEOUT 20)
@@ -1168,6 +1252,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_sched_priority PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_rtprio_thread_tests ${LIBS_INCLUDE_DIR}/tests/GuestRtprioThread.cpp)
+    target_include_directories(guest_rtprio_thread_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_rtprio_thread_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_rtprio_thread_tests)
+    add_test(NAME guest_rtprio_thread COMMAND guest_rtprio_thread_tests)
+    set_tests_properties(guest_rtprio_thread PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_rtprio_thread PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_operation_mode_tests ${LIBS_INCLUDE_DIR}/tests/GuestOperationMode.cpp)
     target_include_directories(guest_operation_mode_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_operation_mode_tests PRIVATE libkernel libc)
@@ -1294,6 +1388,19 @@ if(BUILD_TESTING)
         set_tests_properties(guest_named_shm_concurrency PROPERTIES TIMEOUT 20)
     endif()
     if(WIN32)
+        add_test_executable(guest_named_shm_windows_tests ${LIBS_INCLUDE_DIR}/tests/GuestNamedShmWindows.cpp)
+        target_include_directories(guest_named_shm_windows_tests PRIVATE ${LIBS_INCLUDE_DIR} ${LIBS_INCLUDE_DIR}/nid/include)
+        target_link_libraries(guest_named_shm_windows_tests PRIVATE libkernel libc advapi32)
+        configure_windows_unwind(guest_named_shm_windows_tests)
+        add_test(NAME guest_named_shm_windows COMMAND guest_named_shm_windows_tests)
+        set_tests_properties(guest_named_shm_windows PROPERTIES TIMEOUT 20 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test(NAME guest_named_shm_windows_short_temp COMMAND guest_named_shm_windows_tests --short-temp)
+        set_tests_properties(guest_named_shm_windows_short_temp PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test(NAME guest_named_shm_windows_long_short_temp COMMAND guest_named_shm_windows_tests --long-short-temp)
+        set_tests_properties(guest_named_shm_windows_long_short_temp PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
         set_tests_properties(guest_shm_open PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
@@ -1360,9 +1467,10 @@ if(BUILD_TESTING)
     target_link_libraries(guest_socket_options_tests PRIVATE libkernel libc)
     configure_windows_unwind(guest_socket_options_tests)
     add_test(NAME guest_socket_options COMMAND guest_socket_options_tests)
-    set_tests_properties(guest_socket_options PROPERTIES TIMEOUT 30)
+    add_test(NAME guest_socket_options_multicast COMMAND guest_socket_options_tests multicast)
+    set_tests_properties(guest_socket_options guest_socket_options_multicast PROPERTIES TIMEOUT 30)
     if(WIN32)
-        set_tests_properties(guest_socket_options PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_socket_options guest_socket_options_multicast PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
     add_test_executable(guest_socket_stream_options_tests ${LIBS_INCLUDE_DIR}/tests/GuestSocketStreamOptions.cpp)
@@ -1479,7 +1587,7 @@ if(BUILD_TESTING)
     endif()
     add_test_executable(guest_kernel_app_archive_tests ${LIBS_INCLUDE_DIR}/tests/GuestKernelAppArchive.cpp)
     target_include_directories(guest_kernel_app_archive_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_kernel_app_archive_tests PRIVATE libkernel libc zarchive)
+    target_link_libraries(guest_kernel_app_archive_tests PRIVATE libSceLibcInternal libkernel libc zarchive)
     configure_windows_unwind(guest_kernel_app_archive_tests)
     foreach(mode archive plain mmap)
         add_test(NAME guest_kernel_app_archive_${mode} COMMAND guest_kernel_app_archive_tests ${mode})
@@ -1621,6 +1729,18 @@ if(BUILD_TESTING)
         set_tests_properties(guest_memory guest_mmap_fixed_anonymous PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    if(NOT ANYPS5_ENABLE_ASAN AND (WIN32 OR CMAKE_SYSTEM_NAME STREQUAL "Linux"))
+        add_test_executable(guest_low_address_memory_tests ${LIBS_INCLUDE_DIR}/tests/GuestLowAddressMemory.cpp)
+        target_include_directories(guest_low_address_memory_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_low_address_memory_tests PRIVATE libkernel libc)
+        configure_windows_unwind(guest_low_address_memory_tests)
+        add_test(NAME guest_low_address_memory COMMAND guest_low_address_memory_tests)
+        set_tests_properties(guest_low_address_memory PROPERTIES TIMEOUT 20)
+        if(WIN32)
+            set_tests_properties(guest_low_address_memory PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        endif()
+    endif()
     add_test_executable(guest_mprotect_unmapped_tests ${LIBS_INCLUDE_DIR}/tests/GuestMprotectUnmapped.cpp)
     target_include_directories(guest_mprotect_unmapped_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_mprotect_unmapped_tests PRIVATE libkernel libc)
@@ -1646,6 +1766,7 @@ if(BUILD_TESTING)
     target_link_libraries(guest_flexible_memory_budget_tests PRIVATE libkernel libc)
     configure_windows_unwind(guest_flexible_memory_budget_tests)
     add_library(guest_flexible_memory_module SHARED ${LIBS_INCLUDE_DIR}/tests/GuestFlexibleMemoryModule.cpp)
+    target_include_directories(guest_flexible_memory_module PRIVATE ${LIBS_INCLUDE_DIR})
     set_target_properties(guest_flexible_memory_module PROPERTIES PREFIX "" SUFFIX ".guest.prx")
     add_dependencies(guest_flexible_memory_budget_tests guest_flexible_memory_module)
     target_compile_definitions(guest_flexible_memory_budget_tests PRIVATE GUEST_FLEXIBLE_MEMORY_MODULE="$<TARGET_FILE:guest_flexible_memory_module>")
@@ -1700,6 +1821,13 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
     if(WIN32)
+        add_test_executable(guest_windows_directory_link_types_tests ${LIBS_INCLUDE_DIR}/tests/GuestWindowsDirectoryLinkTypes.cpp)
+        target_include_directories(guest_windows_directory_link_types_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_windows_directory_link_types_tests PRIVATE libkernel libc)
+        configure_windows_unwind(guest_windows_directory_link_types_tests)
+        add_test(NAME guest_windows_directory_link_types COMMAND guest_windows_directory_link_types_tests)
+        set_tests_properties(guest_windows_directory_link_types PROPERTIES TIMEOUT 15 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
         add_test_executable(guest_directory_buffer_tests ${LIBS_INCLUDE_DIR}/tests/GuestDirectoryBuffer.cpp)
         target_include_directories(guest_directory_buffer_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(guest_directory_buffer_tests PRIVATE libkernel libc)
@@ -1847,6 +1975,16 @@ if(BUILD_TESTING)
     configure_windows_unwind(guest_append_writes_tests)
     add_test(NAME guest_append_writes COMMAND guest_append_writes_tests)
     set_tests_properties(guest_append_writes PROPERTIES TIMEOUT 20)
+    add_test_executable(guest_kernel_fcntl_sync_tests ${LIBS_INCLUDE_DIR}/tests/GuestKernelFcntlSync.cpp)
+    target_include_directories(guest_kernel_fcntl_sync_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_kernel_fcntl_sync_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_kernel_fcntl_sync_tests)
+    add_test(NAME guest_kernel_fcntl_sync COMMAND guest_kernel_fcntl_sync_tests)
+    set_tests_properties(guest_kernel_fcntl_sync PROPERTIES TIMEOUT 15)
+    if(WIN32)
+        set_tests_properties(guest_kernel_fcntl_sync PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     if(WIN32)
         set_tests_properties(guest_kernel_fcntl guest_append_writes PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
@@ -1883,6 +2021,11 @@ if(BUILD_TESTING)
         add_test(NAME guest_raise_in_system_call COMMAND guest_raise_in_system_call_tests)
         set_tests_properties(guest_raise_in_system_call PROPERTIES TIMEOUT 30 ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        foreach(delay IN ITEMS raise return)
+            add_test(NAME guest_raise_in_system_call_delay_${delay} COMMAND guest_raise_in_system_call_tests --delay-${delay})
+            set_tests_properties(guest_raise_in_system_call_delay_${delay} PROPERTIES TIMEOUT 30 ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        endforeach()
         add_test_executable(guest_raise_in_host_code_tests ${LIBS_INCLUDE_DIR}/tests/GuestRaiseInHostCode.cpp)
         target_include_directories(guest_raise_in_host_code_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(guest_raise_in_host_code_tests PRIVATE libkernel libc)
@@ -1935,6 +2078,15 @@ if(BUILD_TESTING)
     target_include_directories(guest_timed_join_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_timed_join_tests PRIVATE libkernel libc ${CMAKE_DL_LIBS})
     configure_windows_unwind(guest_timed_join_tests)
+    if(WIN32 AND Python3_Interpreter_FOUND)
+        foreach(joinProvider IN ITEMS libkernel_sys libkernel_web)
+            add_test(NAME guest_timed_join_import_${joinProvider} COMMAND ${Python3_EXECUTABLE}
+                ${LIBS_INCLUDE_DIR}/tests/test_windows_timed_join_imports.py $<TARGET_FILE:relinker> ${PATCHED_DIR}
+                ${joinProvider}.prx $<TARGET_FILE_DIR:guest_timed_join_tests>)
+            set_tests_properties(guest_timed_join_import_${joinProvider} PROPERTIES TIMEOUT 25
+                ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:guest_timed_join_tests>")
+        endforeach()
+    endif()
     foreach(joinMode IN ITEMS normal coarse)
         add_test(NAME guest_timed_join_${joinMode} COMMAND guest_timed_join_tests $<TARGET_FILE:libkernel>)
         set_tests_properties(guest_timed_join_${joinMode} PROPERTIES TIMEOUT 15)
diff --git a/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp b/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp
index 82e570403e..4247868360 100644
--- a/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp
@@ -1216,6 +1216,9 @@ int DoMapShared(void** addr, size_t len, int prot, HostSharedMemory object) {
     try {
 #ifdef _WIN32
         GuestArena::GuestArenaMap_nid_postfix(mapped, len, object, 0, WinProtFromPosix(nativeProtection));
+#elif defined(__APPLE__)
+        if (::mmap(mapped, len, nativeProtection & ~PROT_EXEC, MAP_SHARED | MAP_FIXED, object, 0) == MAP_FAILED) throw std::system_error(errno, std::generic_category(), "map shared memory");
+        if ((nativeProtection & PROT_EXEC) != 0 && ::mprotect(mapped, len, nativeProtection) != 0) throw std::system_error(errno, std::generic_category(), "make shared memory executable");
 #else
         if (::mmap(mapped, len, nativeProtection, MAP_SHARED | MAP_FIXED, object, 0) == MAP_FAILED) throw std::system_error(errno, std::generic_category(), "map shared memory");
 #endif
diff --git a/core/libs/prx/libkernel/DirectMemory/Export.cpp b/core/libs/prx/libkernel/DirectMemory/Export.cpp
index bd93f135d1..93101cb207 100644
--- a/core/libs/prx/libkernel/DirectMemory/Export.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -32,8 +34,6 @@
 #include <mutex>
 
 extern "C" std::uint64_t GuestImageSegmentBytes_nid_no_patch();
-extern "C" void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-extern "C" int* APS5_VABI __error_nid_postfix();
 
 namespace {
 
@@ -218,13 +218,12 @@ int APS5_VABI sceKernelAllocateMainDirectMemory(size_t len, size_t alignment, in
 }
 
 int APS5_VABI sceKernelAvailableDirectMemorySize(int64_t search_start, int64_t search_end, size_t alignment, int64_t* phys_addr_out, size_t* size_out) {
- if (!phys_addr_out || !size_out) return SCE_KERNEL_ERROR_EINVAL;
  int64_t start = 0;
  size_t size = 0;
  const int result = DirectMemoryLargestFree(search_start, search_end, alignment, &start, &size);
- if (result != 0) { *phys_addr_out = 0; *size_out = 0; return result; }
- *phys_addr_out = start;
- *size_out = size;
+ if (result != 0) return result;
+ if (phys_addr_out) *phys_addr_out = start;
+ if (size_out) *size_out = size;
  return 0;
 }
 
@@ -277,8 +276,6 @@ int APS5_VABI sceKernelMapFlexibleMemory(void** addr_in_out, size_t len, int pro
  return _mapFlexible(addr_in_out, len, prot, flags & ~IgnoredHeapFlag);
 }
 
-int APS5_VABI sceKernelSetVirtualRangeName(const void* addr, uint64_t len, const char* name);
-
 int APS5_VABI sceKernelMapNamedDirectMemory(void** addr, size_t len, int prot, int flags, int64_t direct_memory_start, size_t alignment, const char* name) {
  const int result = DoMapDirect(addr, len, prot, flags, direct_memory_start, alignment);
  if (result == 0) _releaseFlexible(reinterpret_cast<uintptr_t>(*addr), len);
@@ -320,7 +317,11 @@ int APS5_VABI sceKernelMmap(void* addr, size_t len, int prot, int flags, int fd,
 }
 
 int APS5_VABI sceKernelReleaseFlexibleMemory(void* addr, size_t len) {
- return sceKernelMunmap(reinterpret_cast<uint64_t>(addr), len);
+ const auto start = reinterpret_cast<uintptr_t>(addr);
+ if (start == 0 || (start & (PS5_PAGE_SIZE - 1)) != 0 || (len & (PS5_PAGE_SIZE - 1)) != 0 || len > std::numeric_limits<uintptr_t>::max() - start)
+  return SCE_KERNEL_ERROR_EINVAL;
+ if (len != 0) _releaseFlexible(start, len);
+ return 0;
 }
 
 int APS5_VABI sceKernelReleaseDirectMemory(int64_t start, size_t len) {
@@ -501,6 +502,12 @@ int APS5_VABI sceKernelGetPageTableStats(int* cpu_total, int* cpu_available, int
  return 0;
 }
 
+int APS5_VABI sceKernelGetTraceMemoryStats(std::uint64_t* first, std::uint64_t* second) {
+ if (first) *first = 0;
+ if (second) *second = 0;
+ return 0;
+}
+
 int APS5_VABI sceKernelGetPrtAperture(int index, void** addr, size_t* len) {
  if (index < 0 || index >= PRT_APERTURE_COUNT || !addr || !len) return SCE_KERNEL_ERROR_EINVAL;
  std::lock_guard lock(g_prtLock);
@@ -516,8 +523,6 @@ int APS5_VABI sceKernelSetPrtAperture(int index, void* addr, size_t len) {
  return 0;
 }
 
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry* entries, int num_entries, int* num_entries_out, int flags);
-
 int APS5_VABI sceKernelBatchMap(KernelBatchMapEntry* entries, int num_entries, int* num_entries_out) {
  constexpr int MapFixed = 0x10;
  return sceKernelBatchMap2(entries, num_entries, num_entries_out, MapFixed);
diff --git a/core/libs/prx/libkernel/DirectMemory/Jit.cpp b/core/libs/prx/libkernel/DirectMemory/Jit.cpp
index fb3ad0405c..60e266a543 100644
--- a/core/libs/prx/libkernel/DirectMemory/Jit.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/Jit.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
@@ -26,6 +27,9 @@
 #include <fcntl.h>
 #include <sys/mman.h>
 #include <unistd.h>
+#ifdef __APPLE__
+#include <filesystem>
+#endif
 #endif
 
 namespace {
@@ -140,8 +144,19 @@ int DuplicateDescriptor(int descriptor) {
 }
 #else
 int CreateBacking(std::size_t bytes, int* descriptor, std::shared_ptr<JitObject>* object) {
+#ifdef __APPLE__
+    auto path = (std::filesystem::temp_directory_path() / "anyps5-jit-XXXXXX").string();
+    const int file = mkstemp(path.data());
+    if (file < 0) return HostFailure("create JIT shared memory", errno);
+    if (unlink(path.c_str()) != 0 || fcntl(file, F_SETFD, FD_CLOEXEC) != 0) {
+        const int error = errno;
+        ::close(file);
+        return HostFailure("create JIT shared memory", error);
+    }
+#else
     const int file = memfd_create("anyps5 jit shared memory", MFD_CLOEXEC);
     if (file < 0) return HostFailure("create JIT shared memory", errno);
+#endif
     const bool representable = bytes <= static_cast<std::uint64_t>(std::numeric_limits<off_t>::max());
     if (!representable || ftruncate(file, static_cast<off_t>(bytes)) != 0) {
         const int error = !representable || errno == EFBIG ? ENOMEM : errno;
diff --git a/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp b/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp
index 54cdbaf12d..44a02c7f12 100644
--- a/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp
@@ -154,14 +154,10 @@ struct PhysicalMemoryPool {
     }
 
     int LargestFree(int64_t searchStart, int64_t searchEnd, size_t alignment, int64_t* startOut, size_t* sizeOut) {
-        if (!startOut || !sizeOut) return SCE_KERNEL_ERROR_EINVAL;
-        if (searchStart < 0 || searchEnd <= searchStart) return SCE_KERNEL_ERROR_EAGAIN;
-        uint64_t align;
-        if (!NormalizeAlignment(alignment, align)) return SCE_KERNEL_ERROR_EAGAIN;
-
-        uint64_t cur;
-        if (!RoundUp(static_cast<uint64_t>(searchStart), kPage, cur)) return SCE_KERNEL_ERROR_EAGAIN;
-        const uint64_t limit = std::min<uint64_t>(static_cast<uint64_t>(searchEnd), kPoolBytes) & ~(kPage - 1);
+        if ((alignment & (alignment - 1)) != 0) return SCE_KERNEL_ERROR_EINVAL;
+        const uint64_t alignMask = std::max<uint64_t>(alignment, kPage) - 1;
+        uint64_t cur = searchStart > 0 ? std::min<uint64_t>(static_cast<uint64_t>(searchStart) & ~(kPage - 1), kPoolBytes) : 0;
+        const uint64_t limit = searchEnd > 0 ? std::min<uint64_t>((static_cast<uint64_t>(searchEnd) + kPage - 1) & ~(kPage - 1), kPoolBytes) : 0;
 
         std::lock_guard<std::mutex> lock(_mutex);
         uint64_t bestStart = 0;
@@ -175,11 +171,13 @@ struct PhysicalMemoryPool {
             uint64_t runEnd = cur;
             while (runEnd < limit && !_used[runEnd / kPage]) runEnd += kPage;
 
-            uint64_t alignedStart;
-            if (!RoundUp(cur, align, alignedStart)) break;
-            if (alignedStart < runEnd && runEnd - alignedStart > bestSize) {
-                bestStart = alignedStart;
-                bestSize = runEnd - alignedStart;
+            const int64_t low = std::max(static_cast<int64_t>(cur), searchStart);
+            const int64_t high = std::min(static_cast<int64_t>(runEnd), searchEnd);
+            const int64_t alignedStart = static_cast<int64_t>((static_cast<uint64_t>(low) + alignMask) & ~alignMask);
+            const uint64_t size = static_cast<uint64_t>(high) - static_cast<uint64_t>(alignedStart);
+            if (low < high && alignedStart < high && size > bestSize) {
+                bestStart = static_cast<uint64_t>(alignedStart);
+                bestSize = size;
             }
             cur = runEnd;
         }
@@ -267,7 +265,15 @@ private:
         bool splitHi = false;
         try {
             splitHi = _splitAt(hi);
-            ForgetDirectMemory(static_cast<int64_t>(lo), static_cast<size_t>(hi - lo));
+            for (size_t page = first; page < first + count;) {
+                if (!_used[page]) {
+                    ++page;
+                    continue;
+                }
+                const size_t runStart = page;
+                while (page < first + count && _used[page]) ++page;
+                ForgetDirectMemory(static_cast<int64_t>(runStart * kPage), static_cast<size_t>((page - runStart) * kPage));
+            }
         } catch (...) {
             if (splitHi) _unsplitAt(hi);
             if (splitLo) _unsplitAt(lo);
diff --git a/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp b/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp
index 7f15f884a1..d20fb3c364 100644
--- a/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <exception>
diff --git a/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp b/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp
index c540f34c99..2f5476c77c 100644
--- a/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp
@@ -1,9 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "DirectMemory.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libkernel/File/include/ArchivedFile.hpp"
+#include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/SharedMemory.hpp"
 #include <algorithm>
 #include <limits>
@@ -17,20 +20,9 @@
 #include <unistd.h>
 #elif defined(_WIN32)
 #include "prx/libc/include/WindowsDescriptor.hpp"
-#include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/RandomDevice.hpp"
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI sceKernelMunmap(std::uint64_t address, std::size_t length);
-extern "C" int APS5_VABI sceKernelMlock_nid_postfix(void* address, std::uint64_t length);
-extern "C" int APS5_VABI sceKernelMunlock_nid_postfix(void* address, std::uint64_t length);
-extern "C" int APS5_VABI sceKernelMunlockall_nid_postfix();
-extern "C" int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, uint64_t info_size);
-extern "C" std::int64_t APS5_VABI sceKernelPread(int descriptor, void* buffer, std::size_t length, std::int64_t offset);
-extern "C" int APS5_VABI munmap_nid_postfix(void* address, std::size_t length) noexcept;
-extern "C" int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
-
 namespace {
 // FreeBSD/PS5 ABI values, independent of the host's errno and mmap constants.
 constexpr int GuestInvalid = 22;
@@ -38,6 +30,7 @@ constexpr int GuestNoMemory = 12;
 constexpr int GuestBadDescriptor = 9;
 constexpr int GuestAccess = 13;
 constexpr int GuestFault = 14;
+constexpr int GuestBusy = 16;
 constexpr int GuestIoError = 5;
 constexpr int GuestNotSupported = 45;
 constexpr int GuestShared = 0x1;
@@ -130,6 +123,7 @@ void* MapPrivateFileCopy(void* address, std::size_t rounded, int protection, int
         const auto read = sceKernelPread(descriptor, static_cast<unsigned char*>(mapped) + done, static_cast<std::size_t>(copied - done), static_cast<std::int64_t>(start + done));
         if (read <= 0) {
             munmap_nid_postfix(mapped, rounded);
+
             return failed(read < 0 ? static_cast<int>(read & 0xffff) : GuestIoError);
         }
         done += static_cast<std::uint64_t>(read);
@@ -137,6 +131,7 @@ void* MapPrivateFileCopy(void* address, std::size_t rounded, int protection, int
     if (protection != 3 && mprotect_nid_postfix(mapped, rounded, protection) != 0) {
         const int error = *__error_nid_postfix();
         munmap_nid_postfix(mapped, rounded);
+
         return failed(error);
     }
     return mapped;
@@ -171,7 +166,7 @@ void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protecti
 #endif
         const bool exclusive = fixedAnonymous && (mappingFlags & GuestMapExclusive) != 0;
         const int placement = fixedAnonymous ? GuestMapFixed | (exclusive ? GuestMapNoOverwrite : 0) : 0;
-        void* mapped = fixedAnonymous ? address : nullptr;
+        void* mapped = address;
         const auto alignment = !fixedAnonymous && (flags & GuestAlignedSuper) != 0 ? SuperpageSize : PS5_PAGE_SIZE;
         try {
             const auto result = DoMapAnon(&mapped, rounded, protection, placement, alignment, exclusive, fixedAnonymous);
@@ -193,6 +188,7 @@ void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protecti
         (mappingFlags & ~(GuestShared | GuestPrivate | GuestMapFixed | GuestMapNoOverwrite | GuestMapNoCoalesce)) != 0)
         return failed(GuestNotSupported);
     if (descriptor < 0) return failed(GuestBadDescriptor);
+    if (File::IsVirtualDirectoryDescriptor(descriptor)) return failed(GuestNotSupported);
     File::RefuseArchivedFile(descriptor, "mmap");
     if (offset < 0 || (static_cast<std::uint64_t>(offset) & (PS5_PAGE_SIZE - 1)) != 0 ||
         rounded > static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max()) ||
@@ -337,7 +333,7 @@ int APS5_VABI msync_nid_postfix(void* address, std::size_t length, int flags) {
     if (end < start) return failed(GuestInvalid);
     if ((flags & (GuestSyncAsync | GuestSyncInvalidate)) == (GuestSyncAsync | GuestSyncInvalidate)) return failed(GuestInvalid);
     if (start == end ? !Mapped(start) : !GuestRangeMapped(start, end)) return failed(GuestNoMemory);
-    if ((flags & GuestSyncInvalidate) != 0) throw std::runtime_error("msync: MS_INVALIDATE is not implemented");
+    if ((flags & GuestSyncInvalidate) != 0) return failed(GuestBusy);
     return 0;
 }
 
@@ -368,6 +364,7 @@ int APS5_VABI mincore_nid_postfix(const void* address, std::size_t length, char*
     for (auto cursor = first; cursor < end;) {
         VirtualQueryInfo info{};
         sceKernelVirtualQuery(reinterpret_cast<const void*>(cursor), 0, &info, sizeof(info));
+
         const auto extentEnd = std::min<std::uintptr_t>(info.end, end);
         std::fill_n(vec + (cursor - first) / PS5_PAGE_SIZE, (extentEnd - cursor) / PS5_PAGE_SIZE, static_cast<char>(info.is_committed != 0 ? 1 : 0));
         cursor = extentEnd;
diff --git a/core/libs/prx/libkernel/Equeue/Equeue.cpp b/core/libs/prx/libkernel/Equeue/Equeue.cpp
index 1256cc9391..059f00798c 100644
--- a/core/libs/prx/libkernel/Equeue/Equeue.cpp
+++ b/core/libs/prx/libkernel/Equeue/Equeue.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Equeue/Equeue.hpp"
 #include "Equeue.hpp"
 #include "prx/libkernel/Time/include/Time.hpp"
 #include "prx/libc/include/General.hpp"
@@ -12,6 +14,62 @@
 #include <stdexcept>
 #include <unordered_map>
 
+static constexpr std::uint64_t FileRepollNs = 1000000;
+
+struct UnreadFile {
+    bool measured = false;
+    std::int64_t bytes = 0;
+};
+
+static UnreadFile UnreadFileBytes(int file) {
+    FileStat status{};
+    if (sceKernelFstat(file, &status) != 0) {
+        return {};
+    }
+    const std::int64_t offset = sceKernelLseek(file, 0, 1);
+    if (offset < 0) {
+        return {};
+    }
+    return {true, status.st_size - offset};
+}
+
+static bool RegularFile(int descriptor) {
+    if (File::IsHostStream(descriptor)) {
+        return false;
+    }
+    FileStat status{};
+    return sceKernelFstat(descriptor, &status) == 0 && (status.st_mode & 0170000) == 0100000;
+}
+
+static KernelEqueueEvent FileEvent(int descriptor, int16_t filter, uint16_t flags, void* udata) {
+    KernelEqueueEvent event{};
+    event.event.ident = static_cast<uintptr_t>(descriptor);
+    event.event.filter = filter;
+    event.event.flags = flags;
+    event.event.udata = udata;
+    event.filter.repoll = true;
+    if (filter == EVFILT_WRITE) {
+        event.filter.pollFunc = [](KernelEqueueEvent* e) {
+            e->event.data = 0;
+            return true;
+        };
+    } else {
+        event.filter.owner = std::make_shared<UnreadFile>();
+        event.filter.pollFunc = [](KernelEqueueEvent* e) {
+            const auto* unread = static_cast<const UnreadFile*>(e->filter.owner.get());
+            if (!unread->measured || unread->bytes == 0) {
+                return false;
+            }
+            e->event.data = static_cast<intptr_t>(unread->bytes);
+            return true;
+        };
+    }
+    event.filter.resetFunc = [](KernelEqueueEvent* e) {
+        e->triggered = false;
+    };
+    return event;
+}
+
 static std::unordered_map<KernelEqueue, KernelEqueueRef> g_equeues;
 static std::mutex g_equeueMutex;
 static uint64_t g_nextEqueue = 1;
@@ -21,6 +79,7 @@ struct KernelEqueuePrivate::WaitSet {
     std::vector<std::shared_ptr<void>> held;
     std::vector<std::shared_ptr<KernelEqueuePrivate>> queues;
     uint64_t nearestTimerNs = std::numeric_limits<uint64_t>::max();
+    bool repoll = false;
 };
 
 extern "C" {
@@ -98,6 +157,28 @@ bool KernelEqueuePrivate::PollEvents() {
     return polled;
 }
 
+void KernelEqueuePrivate::MeasureFiles(std::unique_lock<std::mutex>& lock) {
+    std::vector<std::pair<int, std::shared_ptr<void>>> files;
+    for (const auto& e : m_events) {
+        if (e.enabled && e.filter.repoll && e.event.filter == EVFILT_READ) {
+            files.emplace_back(static_cast<int>(e.event.ident), e.filter.owner);
+        }
+    }
+    if (files.empty()) {
+        return;
+    }
+    lock.unlock();
+    std::vector<UnreadFile> measured;
+    measured.reserve(files.size());
+    for (const auto& [file, owner] : files) {
+        measured.push_back(UnreadFileBytes(file));
+    }
+    lock.lock();
+    for (std::size_t i = 0; i < files.size(); ++i) {
+        *static_cast<UnreadFile*>(files[i].second.get()) = measured[i];
+    }
+}
+
 void KernelEqueuePrivate::WakePollers() {
     for (const auto waker : m_pollers) {
         GuestSockets::Wake(waker);
@@ -117,6 +198,8 @@ void KernelEqueuePrivate::GatherInterests(WaitSet& wait, std::uintptr_t waker, b
         }
         if (e.filter.watched) {
             GatherWatched(wait, e.filter.watched, waker);
+        } else if (e.filter.repoll) {
+            wait.repoll = true;
         } else if (e.filter.waitDescriptor >= 0) {
             wait.interests.push_back({e.filter.waitDescriptor, false});
             wait.held.push_back(e.filter.owner);
@@ -151,6 +234,12 @@ void KernelEqueuePrivate::WaitForDescriptors(std::unique_lock<std::mutex>& lock,
     const auto waker = GuestSockets::CurrentWaker();
     WaitSet wait;
     GatherInterests(wait, waker, false);
+    if (wait.repoll) {
+        const std::uint64_t soon = TimedWait::NowNanos() + FileRepollNs;
+        if (deadlineNanos == 0 || deadlineNanos > soon) {
+            deadlineNanos = soon;
+        }
+    }
     m_pollers.push_back(waker);
     if (!wait.queues.empty()) {
         PollEvents();
@@ -187,9 +276,10 @@ int KernelEqueuePrivate::CollectTriggered(KernelEvent* ev, int num) {
         return CollectOncePerWait(ev, num);
     }
     int ret = 0;
+    std::list<KernelEqueueEvent> requeued;
     for (auto it = m_events.begin(); it != m_events.end() && ret < num;) {
         auto& e = *it;
-        if (!e.enabled) {
+        if (!e.triggered || !e.enabled) {
             ++it;
             continue;
         }
@@ -197,6 +287,10 @@ int KernelEqueuePrivate::CollectTriggered(KernelEvent* ev, int num) {
         while (e.triggered && ret < num) {
             ev[ret++] = e.event;
             if ((e.event.flags & EV_ONESHOT) != 0) {
+                if (e.filter.deleteEventFunc != nullptr) {
+                    auto owner = e.filter.owner;
+                    e.filter.deleteEventFunc(m_handle, &e);
+                }
                 erase = true;
                 break;
             }
@@ -221,8 +315,15 @@ int KernelEqueuePrivate::CollectTriggered(KernelEvent* ev, int num) {
             e.pendingEvents.pop_front();
             e.triggered = true;
         }
-        it = erase ? m_events.erase(it) : std::next(it);
+        const auto next = std::next(it);
+        if (erase) {
+            m_events.erase(it);
+        } else {
+            requeued.splice(requeued.end(), m_events, it);
+        }
+        it = next;
     }
+    m_events.splice(m_events.end(), requeued);
     return ret;
 }
 
@@ -257,9 +358,7 @@ int KernelEqueuePrivate::CollectOncePerWait(KernelEvent* ev, int num) {
             e.event.data = 0;
         }
         const auto next = std::next(it);
-        if (e.triggered) {
-            requeued.splice(requeued.end(), m_events, it);
-        }
+        requeued.splice(requeued.end(), m_events, it);
         it = next;
     }
     m_events.splice(m_events.end(), requeued);
@@ -271,6 +370,10 @@ int KernelEqueuePrivate::GetTriggeredEvents(KernelEvent* ev, int num) {
     if (m_closed) {
         return SCE_KERNEL_ERROR_EBADF;
     }
+    MeasureFiles(lock);
+    if (m_closed) {
+        return SCE_KERNEL_ERROR_EBADF;
+    }
     TriggerExpiredTimers(MonotonicNs());
     PollEvents();
     return CollectTriggered(ev, num);
@@ -285,6 +388,10 @@ std::size_t KernelEqueuePrivate::CountTriggeredEvents() {
     if (m_closed) {
         return 0;
     }
+    MeasureFiles(lock);
+    if (m_closed) {
+        return 0;
+    }
     TriggerExpiredTimers(MonotonicNs());
     PollEvents();
     return static_cast<std::size_t>(std::count_if(m_events.begin(), m_events.end(), [](const KernelEqueueEvent& event) { return event.enabled && event.triggered; }));
@@ -311,6 +418,10 @@ int KernelEqueuePrivate::WaitForEventsUntil(KernelEvent* ev, int num, std::uint6
         return SCE_KERNEL_ERROR_EBADF;
     }
     for (;;) {
+        MeasureFiles(lock);
+        if (m_closed) {
+            return SCE_KERNEL_ERROR_EBADF;
+        }
         TriggerExpiredTimers(MonotonicNs());
         const bool polling = PollEvents();
         const int ret = CollectTriggered(ev, num);
@@ -414,6 +525,9 @@ int KernelEqueuePrivate::EditEvent(uintptr_t ident, int16_t filter, const std::f
     if (m_closed) {
         return SCE_KERNEL_ERROR_EBADF;
     }
+    if (filter == EVFILT_TIMER) {
+        TriggerExpiredTimers(MonotonicNs());
+    }
     auto it = std::find_if(m_events.begin(), m_events.end(),
         [ident, filter](const auto& e) {
             return e.event.ident == ident && e.event.filter == filter;
@@ -503,7 +617,6 @@ int APS5_VABI EqueueDeleteEvent_nid_postfix(KernelEqueue eq, uintptr_t ident, in
     return owner->DeleteEvent(ident, filter);
 }
 
-
 int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name) {
     if (eq == nullptr || name == nullptr) {
         return SCE_KERNEL_ERROR_EINVAL;
@@ -685,6 +798,7 @@ int APS5_VABI sceKernelAddAmprEvent(KernelEqueue eq, int id, void* udata) {
         }
     };
     EqueueAddEvent_nid_postfix(eq, event);
+
     return EQUEUE_OK;
 }
 
@@ -697,6 +811,7 @@ int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue eq, int id) {
         return EQUEUE_OK;
     }
     EqueueDeleteEvent_nid_postfix(eq, static_cast<uintptr_t>(id), EVFILT_AMPR);
+
     return EQUEUE_OK;
 }
 
@@ -709,15 +824,19 @@ static int AddDescriptorEvent(KernelEqueue eq, int fd, std::size_t size, void* u
     std::int64_t available = 0;
     bool eof = false;
     const bool isPipe = !isSocket && filter == EVFILT_READ && !File::IsHostStream(fd) && GuestSockets::PipeReadState(fd, &available, &eof);
-    if (!isSocket && !isPipe && DescriptorIsOpen_nid_no_patch(fd)) {
-        NotImplemented_nid_no_patch(filter == EVFILT_READ ? "sceKernelAddReadEvent: descriptor that is neither a socket nor the read end of a pipe" : "sceKernelAddWriteEvent: non-socket descriptor");
+    const bool isFile = !isSocket && !isPipe && RegularFile(fd);
+    if (!isSocket && !isPipe && !isFile && DescriptorIsOpen_nid_no_patch(fd)) {
+        NotImplemented_nid_no_patch(filter == EVFILT_READ ? "sceKernelAddReadEvent: descriptor that is neither a socket, the read end of a pipe nor a regular file" : "sceKernelAddWriteEvent: descriptor that is neither a socket nor a regular file");
     }
     if (size > 1 && !isPipe) {
         NotImplemented_nid_no_patch(filter == EVFILT_READ ? "sceKernelAddReadEvent: low watermark" : "sceKernelAddWriteEvent: low watermark");
     }
-    if (!isSocket && !isPipe) {
+    if (!isSocket && !isPipe && !isFile) {
         return SCE_KERNEL_ERROR_EBADF;
     }
+    if (isFile) {
+        return EqueueAddEvent_nid_postfix(eq, FileEvent(fd, filter, EV_ADD, udata));
+    }
     return EqueueAddEvent_nid_postfix(eq, EqueueDescriptorEvent(fd, filter, EV_ADD, udata));
 }
 
diff --git a/core/libs/prx/libkernel/Equeue/Equeue.hpp b/core/libs/prx/libkernel/Equeue/Equeue.hpp
index ef217632d6..6b9194be56 100644
--- a/core/libs/prx/libkernel/Equeue/Equeue.hpp
+++ b/core/libs/prx/libkernel/Equeue/Equeue.hpp
@@ -57,6 +57,7 @@ struct KernelFilter {
     EqueueDeleteFunc deleteEventFunc = nullptr;
     EqueuePollFunc pollFunc = nullptr;
     int waitDescriptor = -1;
+    bool repoll = false;
     std::shared_ptr<KernelEqueuePrivate> watched;
 };
 
@@ -104,6 +105,7 @@ private:
     int CollectTriggered(KernelEvent* ev, int num);
     int CollectOncePerWait(KernelEvent* ev, int num);
     bool PollEvents();
+    void MeasureFiles(std::unique_lock<std::mutex>& lock);
     void WakePollers();
     void WaitForDescriptors(std::unique_lock<std::mutex>& lock, std::uint64_t deadlineNanos);
     void GatherInterests(WaitSet& wait, std::uintptr_t waker, bool nested);
diff --git a/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp b/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp
index fb42c6e073..9065ffd156 100644
--- a/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp
+++ b/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <stdexcept>
diff --git a/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp b/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
index cd24ff30d0..a0b5e49fd3 100644
--- a/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
+++ b/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/File.hpp"
@@ -192,7 +193,7 @@ bool TakeSnapshot(HANDLE handle, Snapshot& snapshot) {
 }
 
 bool IsDeleted(const Snapshot& snapshot) {
-    return snapshot.deletePending || snapshot.links == 0;
+    return snapshot.deletePending || snapshot.links == 0 || snapshot.path.find(L"\\$Extend\\$Deleted\\") != std::wstring::npos;
 }
 
 std::vector<std::uint32_t> SnapshotHints(const Snapshot& before, const Snapshot& after, bool directory) {
@@ -212,7 +213,7 @@ std::vector<std::uint32_t> SnapshotHints(const Snapshot& before, const Snapshot&
     } else if (!directory && hints.empty() && after.change != before.change) {
         hints.push_back(NOTE_ATTRIB);
     }
-    if ((after.deletePending && !before.deletePending) || after.links < before.links) {
+    if ((after.deletePending && !before.deletePending) || after.links < before.links || (!IsDeleted(before) && IsDeleted(after))) {
         hints.push_back(NOTE_DELETE);
     }
     if (!after.path.empty() && after.path != before.path && !IsDeleted(after)) {
diff --git a/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp b/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp
index 917bc4a8f8..cbddf855ce 100644
--- a/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp
+++ b/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp
@@ -1,8 +1,14 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
 #include "prx/libkernel/Equeue/include/EdgeWatch.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/File/include/ArchivedFile.hpp"
+#include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include "prx/libkernel/File/include/HostStreams.hpp"
+#include "prx/libkernel/File/include/RandomDevice.hpp"
+#include "prx/libkernel/Socket/include/SocketPoll.hpp"
 #include "prx/libkernel/Socket/include/SocketRuntime.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 
@@ -19,17 +25,18 @@
 #include <vector>
 
 #ifdef _WIN32
+#include "prx/libc/include/WindowsDescriptor.hpp"
 #include <fcntl.h>
 #include <io.h>
 #else
 #include <fcntl.h>
+#include <sys/stat.h>
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
+constexpr int GUEST_EPERM = 1;
 constexpr int GUEST_ENOENT = 2;
 constexpr int GUEST_EBADF = 9;
 constexpr int GUEST_EFAULT = 14;
@@ -39,6 +46,10 @@ constexpr int GUEST_EMFILE = 24;
 constexpr int GUEST_EPIPE = 32;
 
 constexpr int KQ_NEVENTS = 8;
+constexpr std::int16_t EVFILT_AIO = -3;
+constexpr std::int16_t EVFILT_PROCDESC = -8;
+constexpr std::int16_t EVFILT_LIO = -10;
+constexpr std::int16_t EVFILT_SENDFILE = -12;
 constexpr std::uint32_t NOTE_FFCTRLMASK = 0xc0000000;
 constexpr std::uint32_t NOTE_FFLAGSMASK = 0x00ffffff;
 constexpr std::uint32_t NOTE_FFAND = 0x40000000;
@@ -128,6 +139,27 @@ int DescriptorFilterError(int kqueueDescriptor, std::uintptr_t ident) {
     return descriptor == kqueueDescriptor ? GUEST_EINVAL : 0;
 }
 
+bool MeasuredProcdescDescriptor(int descriptor) {
+    std::shared_ptr<void> owner;
+    std::uintptr_t native = 0;
+    if (GuestSockets::IsOpen(descriptor) || KernelLookupSocketNative_nid_no_patch(descriptor, &owner, &native) || FindKqueue(descriptor)) {
+        return true;
+    }
+    if (descriptor < 3 || File::IsRandomDevice(descriptor)) {
+        return false;
+    }
+    if (File::IsArchivedFile(descriptor) || File::DirectoryDescriptorPath(descriptor)) {
+        return true;
+    }
+#ifdef _WIN32
+    const DWORD type = ::GetFileType(WindowsDescriptorHandle_nid_no_patch(descriptor));
+    return type == FILE_TYPE_DISK || type == FILE_TYPE_PIPE;
+#else
+    struct stat status{};
+    return ::fstat(descriptor, &status) == 0 && (S_ISREG(status.st_mode) || S_ISDIR(status.st_mode) || S_ISFIFO(status.st_mode) || S_ISSOCK(status.st_mode));
+#endif
+}
+
 std::int64_t DescriptorLowWater(const KernelEvent& change) {
     if ((change.fflags & NOTE_LOWAT) == 0 || !GuestSockets::IsOpen(static_cast<int>(change.ident))) {
         return 0;
@@ -327,8 +359,49 @@ void TouchUserKnote(KernelEqueueEvent& event, KernelEvent& change) {
     }
 }
 
+int ModifyTimerKnote(const KernelEqueueRef& queue, KernelEvent& change) {
+    if ((change.flags & ~(EV_ADD | EV_ONESHOT)) != 0) {
+        NotImplemented_nid_no_patch("kevent: re-adding an EVFILT_TIMER with flags other than EV_ONESHOT");
+    }
+    if (change.data <= 0 || change.fflags != 0) {
+        NotImplemented_nid_no_patch("kevent: re-adding an EVFILT_TIMER with nonzero fflags or a period of 0 or less");
+    }
+    const auto periodNs = TimerPeriodNanos(change.data, change.fflags);
+    bool oneShot = false;
+    bool disabled = false;
+    bool overflow = false;
+    const int error = GuestErrno(queue->EditEvent(change.ident, change.filter, [&change, &oneShot, &disabled, &overflow, periodNs](KernelEqueueEvent& event) {
+        if (event.intervalNs == 0) {
+            oneShot = true;
+            return;
+        }
+        if (!event.enabled) {
+            disabled = true;
+            return;
+        }
+        if (*periodNs > std::numeric_limits<std::uint64_t>::max() - event.deadlineNs) {
+            overflow = true;
+            return;
+        }
+        event.intervalNs = *periodNs;
+        event.event.udata = change.udata;
+    }));
+    if (oneShot) {
+        NotImplemented_nid_no_patch("kevent: re-adding a one-shot EVFILT_TIMER");
+    }
+    if (disabled) {
+        NotImplemented_nid_no_patch("kevent: re-adding a disabled EVFILT_TIMER");
+    }
+    if (overflow) {
+        NotImplemented_nid_no_patch("kevent: re-adding an EVFILT_TIMER with a period that overflows the armed expiry");
+    }
+    change.fflags = 0;
+    change.data = 0;
+    return error;
+}
+
 int ModifyKnote(const KernelEqueueRef& queue, KernelEvent& change) {
-    if (change.filter == EVFILT_TIMER) {
+    if (change.filter == EVFILT_TIMER && ((change.flags & EV_ADD) != 0 || change.data != 0 || change.fflags != 0)) {
         NotImplemented_nid_no_patch("kevent: changing an existing EVFILT_TIMER");
     }
     const bool descriptor = change.filter == EVFILT_READ || change.filter == EVFILT_WRITE;
@@ -369,6 +442,28 @@ int Register(const KernelEqueueRef& queue, int kqueueDescriptor, KernelEvent& ch
     if (change.filter > 0) {
         return GUEST_EINVAL;
     }
+    if (change.filter == EVFILT_AIO || change.filter == EVFILT_LIO || change.filter == EVFILT_SENDFILE) {
+        if ((change.flags & EV_ADD) == 0) {
+            return GUEST_ENOENT;
+        }
+        change.fflags = 0;
+        change.data = 0;
+        return GUEST_EPERM;
+    }
+    if (change.filter == EVFILT_PROCDESC) {
+        if (const int error = DescriptorFilterError(kqueueDescriptor, change.ident)) {
+            return error;
+        }
+        if ((change.flags & EV_ADD) == 0) {
+            return GUEST_ENOENT;
+        }
+        if (!MeasuredProcdescDescriptor(static_cast<int>(change.ident))) {
+            NotImplemented_nid_no_patch("kevent: EVFILT_PROCDESC on a kind of descriptor that was not measured");
+        }
+        change.fflags = 0;
+        change.data = 0;
+        return GUEST_EINVAL;
+    }
     if (change.filter != EVFILT_READ && change.filter != EVFILT_WRITE && change.filter != EVFILT_VNODE && change.filter != EVFILT_TIMER && change.filter != EVFILT_USER) {
         NotImplemented_nid_no_patch(("kevent: filter " + std::to_string(change.filter)).c_str());
     }
@@ -403,6 +498,9 @@ int Register(const KernelEqueueRef& queue, int kqueueDescriptor, KernelEvent& ch
     if ((change.flags & EV_DELETE) != 0) {
         return GuestErrno(queue->DeleteEvent(change.ident, change.filter));
     }
+    if (change.filter == EVFILT_TIMER && (change.flags & EV_ADD) != 0) {
+        return ModifyTimerKnote(queue, change);
+    }
     return ModifyKnote(queue, change);
 }
 
diff --git a/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp b/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp
index a6403ce990..29f13e6df2 100644
--- a/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp
+++ b/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/SaveDataCore.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <atomic>
@@ -14,21 +16,27 @@
 #include <thread>
 #include <unordered_map>
 #include <cstdio>
+#include <cstring>
 #include <cstdlib>
 
 static constexpr int SCE_OK = 0;
 static constexpr int SCE_KERNEL_ERROR_EPERM = 0x80020001;
-static constexpr int SCE_KERNEL_ERROR_ENOENT = 0x80020002;
 static constexpr int SCE_KERNEL_ERROR_ESRCH = 0x80020003;
 static constexpr int SCE_KERNEL_ERROR_ENOMEM = 0x8002000C;
 static constexpr int SCE_KERNEL_ERROR_EACCES = 0x8002000D;
 static constexpr int SCE_KERNEL_ERROR_EBUSY = 0x80020010;
 static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
 static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = 0x8002003C;
+static constexpr int SCE_KERNEL_ERROR_EFAULT = 0x8002000E;
+static constexpr int SCE_KERNEL_ERROR_ENAMETOOLONG = 0x8002003F;
 static constexpr int SCE_KERNEL_ERROR_ECANCELED = 0x80020055;
 
+static constexpr uint32_t EVF_ATTR_TH_FIFO = 0x01;
+static constexpr uint32_t EVF_ATTR_TH_PRIO = 0x02;
 static constexpr uint32_t EVF_ATTR_SINGLE = 0x10;
 static constexpr uint32_t EVF_ATTR_MULTI = 0x20;
+static constexpr uint32_t EVF_ATTR_SHARED = 0x100;
+static constexpr size_t EVF_NAME_CAPACITY = 32;
 static constexpr uint32_t EVF_WAITMODE_AND = 0x01;
 static constexpr uint32_t EVF_WAITMODE_OR = 0x02;
 static constexpr uint32_t EVF_WAITMODE_CLEAR_ALL = 0x10;
@@ -49,6 +57,7 @@ struct KernelEventFlagPrivate {
     std::string _name;
     uint64_t _pattern = 0;
     bool _multipleWaiters = false;
+    bool _shared = false;
     bool _deleted = false;
     int _waiters = 0;
     uint64_t _cancelGeneration = 0;
@@ -84,20 +93,33 @@ struct KernelEventFlagPrivate {
 
 namespace {
 
-std::shared_mutex eventFlagRegistryMutex;
-std::unordered_map<KernelEventFlag, std::shared_ptr<KernelEventFlagPrivate>> eventFlagRegistry;
+struct EventFlagHandle {
+    std::shared_ptr<KernelEventFlagPrivate> flag;
+    bool opened = false;
+};
 
-std::shared_ptr<KernelEventFlagPrivate> ResolveEventFlag(KernelEventFlag handle) {
+std::shared_mutex eventFlagRegistryMutex;
+std::unordered_map<KernelEventFlag, std::shared_ptr<EventFlagHandle>> eventFlagRegistry;
+
+std::shared_ptr<EventFlagHandle> ResolveEventFlag(KernelEventFlag handle) {
     if (!handle) return {};
     std::shared_lock lock(eventFlagRegistryMutex);
     const auto it = eventFlagRegistry.find(handle);
-    return it == eventFlagRegistry.end() ? std::shared_ptr<KernelEventFlagPrivate>{} : it->second;
+    return it == eventFlagRegistry.end() ? std::shared_ptr<EventFlagHandle>{} : it->second;
 }
 
-void RetireEventFlag(KernelEventFlag handle, const std::shared_ptr<KernelEventFlagPrivate>& owner) {
+KernelEventFlag RegisterEventFlag(const std::shared_ptr<EventFlagHandle>& entry) {
+    const auto handle = reinterpret_cast<KernelEventFlag>(entry.get());
+    eventFlagRegistry.emplace(handle, entry);
+    return handle;
+}
+
+bool RetireEventFlag(KernelEventFlag handle, const std::shared_ptr<EventFlagHandle>& owner) {
     std::unique_lock lock(eventFlagRegistryMutex);
     const auto it = eventFlagRegistry.find(handle);
-    if (it != eventFlagRegistry.end() && it->second == owner) eventFlagRegistry.erase(it);
+    if (it == eventFlagRegistry.end() || it->second != owner) return false;
+    eventFlagRegistry.erase(it);
+    return true;
 }
 
 }
@@ -110,7 +132,6 @@ static bool TraceSync() {
 static bool IsValidWaitMode(uint32_t waitMode) {
     const uint32_t match = waitMode & (EVF_WAITMODE_AND | EVF_WAITMODE_OR);
     const uint32_t clear = waitMode & (EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT);
-    if ((waitMode & ~(EVF_WAITMODE_AND | EVF_WAITMODE_OR | EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT)) != 0) return false;
     return (match == EVF_WAITMODE_AND || match == EVF_WAITMODE_OR) && clear != (EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT);
 }
 
@@ -130,130 +151,178 @@ int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, ui
     (void)param;
     if (!ef || !name) return SCE_KERNEL_ERROR_EINVAL;
     if ((attr & EVF_ATTR_SINGLE) && (attr & EVF_ATTR_MULTI)) return SCE_KERNEL_ERROR_EINVAL;
-    if ((attr & ~0x33u) != 0) return SCE_KERNEL_ERROR_EINVAL;
+    if ((attr & EVF_ATTR_TH_FIFO) && (attr & EVF_ATTR_TH_PRIO)) return SCE_KERNEL_ERROR_EINVAL;
+    if ((attr & ~(EVF_ATTR_TH_FIFO | EVF_ATTR_TH_PRIO | EVF_ATTR_SINGLE | EVF_ATTR_MULTI | EVF_ATTR_SHARED)) != 0) return SCE_KERNEL_ERROR_EINVAL;
+    if (std::strlen(name) >= EVF_NAME_CAPACITY) return SCE_KERNEL_ERROR_ENAMETOOLONG;
+    KernelEventFlag handle = nullptr;
     std::shared_ptr<KernelEventFlagPrivate> flag;
     try {
         flag = std::make_shared<KernelEventFlagPrivate>();
         flag->_name = name;
         flag->_pattern = init_pattern;
         flag->_multipleWaiters = (attr & EVF_ATTR_MULTI) != 0;
+        flag->_shared = (attr & EVF_ATTR_SHARED) != 0;
+        auto entry = std::make_shared<EventFlagHandle>(EventFlagHandle{flag, false});
         std::unique_lock lock(eventFlagRegistryMutex);
-        eventFlagRegistry.emplace(flag.get(), flag);
+        if (flag->_shared) {
+            for (const auto& [other, otherEntry] : eventFlagRegistry) {
+                if (otherEntry->opened || !otherEntry->flag->_shared) continue;
+                std::lock_guard flagLock(otherEntry->flag->_mutex);
+                if (!otherEntry->flag->_deleted && otherEntry->flag->_name == flag->_name) return SCE_KERNEL_ERROR_EPERM;
+            }
+        }
+        handle = RegisterEventFlag(entry);
     } catch (const std::bad_alloc&) {
         return SCE_KERNEL_ERROR_ENOMEM;
     }
-    *ef = flag.get();
-    if (TraceSync()) std::fprintf(stderr, "[evf] create %p '%s' attr=0x%x init=0x%llx\n", static_cast<void*>(flag.get()), name, attr, static_cast<unsigned long long>(init_pattern));
+    *ef = handle;
+    if (TraceSync()) std::fprintf(stderr, "[evf] create %p '%s' attr=0x%x init=0x%llx\n", static_cast<void*>(handle), name, attr, static_cast<unsigned long long>(init_pattern));
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelOpenEventFlag(KernelEventFlag* ef, const char* name) {
-    if (!ef || !name) return SCE_KERNEL_ERROR_EINVAL;
-    std::shared_lock lock(eventFlagRegistryMutex);
-    for (const auto& [handle, flag] : eventFlagRegistry) {
-        std::lock_guard flagLock(flag->_mutex);
-        if (flag->_deleted || flag->_name != name) continue;
-        *ef = handle;
-        return SCE_OK;
+    if (!name) return SCE_KERNEL_ERROR_EFAULT;
+    if (std::strlen(name) >= EVF_NAME_CAPACITY) return SCE_KERNEL_ERROR_ENAMETOOLONG;
+    try {
+        std::unique_lock lock(eventFlagRegistryMutex);
+        std::shared_ptr<KernelEventFlagPrivate> target;
+        for (const auto& [handle, entry] : eventFlagRegistry) {
+            if (entry->opened || !entry->flag->_shared) continue;
+            std::lock_guard flagLock(entry->flag->_mutex);
+            if (entry->flag->_deleted || entry->flag->_name != name) continue;
+            target = entry->flag;
+            break;
+        }
+        if (!target) return SCE_KERNEL_ERROR_ESRCH;
+        if (!ef) return SCE_KERNEL_ERROR_EFAULT;
+        *ef = RegisterEventFlag(std::make_shared<EventFlagHandle>(EventFlagHandle{std::move(target), true}));
+    } catch (const std::bad_alloc&) {
+        return SCE_KERNEL_ERROR_ENOMEM;
     }
-    return SCE_KERNEL_ERROR_ENOENT;
+    return SCE_OK;
+}
+
+int APS5_VABI sceKernelCloseEventFlag(KernelEventFlag ef) {
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    if (!entry->opened) return SCE_KERNEL_ERROR_EPERM;
+    return RetireEventFlag(ef, entry) ? SCE_OK : SCE_KERNEL_ERROR_ESRCH;
 }
 
 int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::unique_lock lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    ef->_deleted = true;
-    ef->_changed.NotifyAll();
-    ef->_changed.Wait(lock, [&] { return ef->_waiters == 0; });
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    if (entry->opened) return SCE_KERNEL_ERROR_EPERM;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::unique_lock lock(flag->_mutex);
+    if (flag->_deleted) return SCE_KERNEL_ERROR_ESRCH;
+    flag->_deleted = true;
+    flag->_changed.NotifyAll();
+    flag->_changed.Wait(lock, [&] { return flag->_waiters == 0; });
     lock.unlock();
-    RetireEventFlag(ef, keepAlive);
+    RetireEventFlag(ef, entry);
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, uint64_t bit_pattern) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    ef->_pattern |= bit_pattern;
-    if (TraceSync()) std::fprintf(stderr, "[evf] set %p '%s' |=0x%llx -> 0x%llx\n", static_cast<void*>(ef), ef->_name.c_str(), static_cast<unsigned long long>(bit_pattern), static_cast<unsigned long long>(ef->_pattern));
-    for (auto* waiter = ef->_waiterHead; waiter != nullptr; waiter = waiter->next) {
-        if (!waiter->satisfied && IsSatisfied(ef->_pattern, waiter->bitPattern, waiter->waitMode)) {
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) return entry->opened ? SCE_OK : SCE_KERNEL_ERROR_ESRCH;
+    flag->_pattern |= bit_pattern;
+    if (TraceSync()) std::fprintf(stderr, "[evf] set %p '%s' |=0x%llx -> 0x%llx\n", static_cast<void*>(ef), flag->_name.c_str(), static_cast<unsigned long long>(bit_pattern), static_cast<unsigned long long>(flag->_pattern));
+    for (auto* waiter = flag->_waiterHead; waiter != nullptr; waiter = waiter->next) {
+        if (!waiter->satisfied && IsSatisfied(flag->_pattern, waiter->bitPattern, waiter->waitMode)) {
             waiter->satisfied = true;
-            waiter->resultPattern = ef->_pattern;
+            waiter->resultPattern = flag->_pattern;
             if (waiter->waitMode & EVF_WAITMODE_CLEAR_ALL) {
-                ef->_pattern = 0;
+                flag->_pattern = 0;
             } else if (waiter->waitMode & EVF_WAITMODE_CLEAR_PAT) {
-                ef->_pattern &= ~waiter->bitPattern;
+                flag->_pattern &= ~waiter->bitPattern;
             }
         }
     }
-    ef->_changed.NotifyAll();
+    flag->_changed.NotifyAll();
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelClearEventFlag(KernelEventFlag ef, uint64_t bit_pattern) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    ef->_pattern &= bit_pattern;
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) return entry->opened ? SCE_OK : SCE_KERNEL_ERROR_ESRCH;
+    flag->_pattern &= bit_pattern;
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, uint64_t set_pattern, int* num_wait_threads) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    if (num_wait_threads) *num_wait_threads = ef->_waiters;
-    ef->_pattern = set_pattern;
-    ++ef->_cancelGeneration;
-    ef->_changed.NotifyAll();
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) {
+        if (!entry->opened) return SCE_KERNEL_ERROR_ESRCH;
+        if (num_wait_threads) *num_wait_threads = 0;
+        return SCE_OK;
+    }
+    if (num_wait_threads) *num_wait_threads = flag->_waiters;
+    flag->_pattern = set_pattern;
+    ++flag->_cancelGeneration;
+    flag->_changed.NotifyAll();
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelPollEventFlag(KernelEventFlag ef, uint64_t bit_pattern, uint32_t wait_mode, uint64_t* result_pat) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
     if (bit_pattern == 0 || !IsValidWaitMode(wait_mode)) return SCE_KERNEL_ERROR_EINVAL;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    if (!ef->_multipleWaiters && ef->_waiters != 0) return SCE_KERNEL_ERROR_EPERM;
-    if (!IsSatisfied(ef->_pattern, bit_pattern, wait_mode)) {
-        if (result_pat) *result_pat = ef->_pattern;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) {
+        if (!entry->opened) return SCE_KERNEL_ERROR_ESRCH;
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EACCES;
+    }
+    if (!flag->_multipleWaiters && flag->_waiters != 0) {
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EPERM;
+    }
+    if (!IsSatisfied(flag->_pattern, bit_pattern, wait_mode)) {
+        if (result_pat) *result_pat = flag->_pattern;
         return SCE_KERNEL_ERROR_EBUSY;
     }
-    Consume(ef, bit_pattern, wait_mode, result_pat);
+    Consume(flag, bit_pattern, wait_mode, result_pat);
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bit_pattern, uint32_t wait_mode, uint64_t* result_pat, KernelUseconds* timeout) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
     if (bit_pattern == 0 || !IsValidWaitMode(wait_mode)) return SCE_KERNEL_ERROR_EINVAL;
-    std::unique_lock lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    if (!ef->_multipleWaiters && ef->_waiters != 0) return SCE_KERNEL_ERROR_EPERM;
-    if (IsSatisfied(ef->_pattern, bit_pattern, wait_mode)) {
-        Consume(ef, bit_pattern, wait_mode, result_pat);
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::unique_lock lock(flag->_mutex);
+    if (flag->_deleted) {
+        if (!entry->opened) return SCE_KERNEL_ERROR_ESRCH;
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EACCES;
+    }
+    if (!flag->_multipleWaiters && flag->_waiters != 0) {
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EPERM;
+    }
+    if (IsSatisfied(flag->_pattern, bit_pattern, wait_mode)) {
+        Consume(flag, bit_pattern, wait_mode, result_pat);
         return SCE_OK;
     }
-    const uint64_t generation = ef->_cancelGeneration;
-    if (TraceSync()) std::fprintf(stderr, "[evf] wait %p '%s' want=0x%llx mode=0x%x have=0x%llx timeout=%d caller=%p outer=%p\n", static_cast<void*>(ef), ef->_name.c_str(), static_cast<unsigned long long>(bit_pattern), wait_mode, static_cast<unsigned long long>(ef->_pattern), timeout ? static_cast<int>(*timeout) : -1, __builtin_return_address(0), static_cast<void**>(static_cast<void**>(__builtin_frame_address(0))[0])[1]);
-    ++ef->_waiters;
+    const uint64_t generation = flag->_cancelGeneration;
+    if (TraceSync()) std::fprintf(stderr, "[evf] wait %p '%s' want=0x%llx mode=0x%x have=0x%llx timeout=%d caller=%p outer=%p\n", static_cast<void*>(ef), flag->_name.c_str(), static_cast<unsigned long long>(bit_pattern), wait_mode, static_cast<unsigned long long>(flag->_pattern), timeout ? static_cast<int>(*timeout) : -1, __builtin_return_address(0), static_cast<void**>(static_cast<void**>(__builtin_frame_address(0))[0])[1]);
+    ++flag->_waiters;
     WaiterNode waiter;
     waiter.bitPattern = bit_pattern;
     waiter.waitMode = wait_mode;
-    ef->pushWaiter(&waiter);
+    flag->pushWaiter(&waiter);
     struct WaiterGuard {
         KernelEventFlagPrivate* flag;
         WaiterNode* node;
@@ -262,27 +331,28 @@ int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bit_pattern, u
             --flag->_waiters;
             flag->_changed.NotifyAll();
         }
-    } waiterGuard{ef, &waiter};
-    const auto released = [&] { return ef->_deleted || ef->_cancelGeneration != generation || waiter.satisfied; };
+    } waiterGuard{flag, &waiter};
+    const auto released = [&] { return flag->_deleted || flag->_cancelGeneration != generation || waiter.satisfied; };
     bool timedOut = false;
     const auto waitStart = std::chrono::steady_clock::now();
     if (timeout) {
         const std::uint64_t deadline = TimedWait::DeadlineNanos(*timeout);
-        timedOut = !ef->_changed.WaitUntil(lock, deadline, released);
+        timedOut = !flag->_changed.WaitUntil(lock, deadline, released);
         *timeout = static_cast<KernelUseconds>(TimedWait::RemainingMicros(deadline));
     } else {
-        ef->_changed.Wait(lock, released);
+        flag->_changed.Wait(lock, released);
     }
     KernelTraceWait_nid_postfix("evf", __builtin_return_address(0), static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - waitStart).count()), timedOut);
-    if (ef->_deleted) {
+    if (flag->_deleted) {
+        if (result_pat) *result_pat = 0;
         return SCE_KERNEL_ERROR_EACCES;
     }
-    if (ef->_cancelGeneration != generation) {
-        if (result_pat) *result_pat = ef->_pattern;
+    if (flag->_cancelGeneration != generation) {
+        if (result_pat) *result_pat = 0;
         return SCE_KERNEL_ERROR_ECANCELED;
     }
     if (timedOut && !waiter.satisfied) {
-        if (result_pat) *result_pat = ef->_pattern;
+        if (result_pat) *result_pat = flag->_pattern;
         return SCE_KERNEL_ERROR_ETIMEDOUT;
     }
     if (result_pat) *result_pat = waiter.resultPattern;
@@ -292,8 +362,8 @@ int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bit_pattern, u
 }
 
 extern "C" int APS5_Test_GetEventFlagWaiterCount(KernelEventFlag handle) {
-    const auto keepAlive = ResolveEventFlag(handle);
-    if (!keepAlive) return -1;
-    std::lock_guard lock(keepAlive->_mutex);
-    return keepAlive->_waiters;
+    const auto entry = ResolveEventFlag(handle);
+    if (!entry) return -1;
+    std::lock_guard lock(entry->flag->_mutex);
+    return entry->flag->_waiters;
 }
diff --git a/core/libs/prx/libkernel/File/include/ArchivedFile.hpp b/core/libs/prx/libkernel/File/include/ArchivedFile.hpp
index 73f84c1cca..fa0f089d47 100644
--- a/core/libs/prx/libkernel/File/include/ArchivedFile.hpp
+++ b/core/libs/prx/libkernel/File/include/ArchivedFile.hpp
@@ -11,7 +11,6 @@
 namespace File {
 
 std::optional<int> OpenArchivedFile(const std::filesystem::path& native, int flags);
-void RefuseMergedDirectory(const std::filesystem::path& native);
 bool IsArchivedFile(int fd);
 void RefuseArchivedFile(int fd, const char* operation);
 std::optional<std::int64_t> ReadArchivedFile(int fd, void* buf, std::size_t nbytes, const std::int64_t* offset);
diff --git a/core/libs/prx/libkernel/File/include/DescriptorControl.hpp b/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
index 4358f8e67d..f2555a2dae 100644
--- a/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
+++ b/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
@@ -2,6 +2,7 @@
 #define CORE_LIBS_PRX_LIBKERNEL_FILE_DESCRIPTORCONTROL_HPP
 
 #include <cstdint>
+#include <exception>
 
 namespace File {
 
@@ -13,11 +14,26 @@ bool IoctlRequestMalformed(std::uint64_t request);
 int Ioctl(int fd, std::uint64_t request, void* argument);
 int DuplicateFrom(int fd, int start);
 void RememberDescriptor(int fd, int openFlags);
+void RememberPipe(int fd);
 void ShareDescriptor(int from, int to);
 void ForgetDescriptor(int fd);
 bool Appends(int fd);
+void SyncWrites(int fd);
+
+class WriteSync {
+public:
+    explicit WriteSync(int fd) : _fd(fd), _exceptions(std::uncaught_exceptions()) {}
+    ~WriteSync() noexcept(false) {
+        if (std::uncaught_exceptions() == _exceptions) SyncWrites(_fd);
+    }
+
+private:
+    int _fd;
+    int _exceptions;
+};
 bool IsVnode(int fd);
 bool IsCharacterDevice(int fd);
+bool GrantsAccess(int fd, bool write);
 
 }
 
diff --git a/core/libs/prx/libkernel/File/include/DirectoryDescriptor.hpp b/core/libs/prx/libkernel/File/include/DirectoryDescriptor.hpp
index 6978a7998a..f3f16f750b 100644
--- a/core/libs/prx/libkernel/File/include/DirectoryDescriptor.hpp
+++ b/core/libs/prx/libkernel/File/include/DirectoryDescriptor.hpp
@@ -4,11 +4,17 @@
 #include <cstdint>
 #include <filesystem>
 #include <optional>
+#include "prx/libc/include/general/VabiMacros.hpp"
 
 struct FileStat;
 
 extern "C" const char* GetDirectoryDescriptorPath_nid_no_patch(int fd, int* error);
 extern "C" std::uint64_t GetDirectoryDescriptorPosition_nid_no_patch(int fd);
+extern "C" int IsDirectoryDescriptor_nid_no_patch(int fd);
+extern "C" int ReadDirectoryDescriptor_nid_no_patch(int fd, char* buf, int nbytes);
+extern "C" std::int64_t SeekDirectoryDescriptor_nid_no_patch(int fd, std::int64_t offset, int whence);
+extern "C" int APS5_VABI ReadDirectoryDescriptorCallback_nid_no_patch(int fd, char* buf, int nbytes);
+extern "C" std::int64_t APS5_VABI SeekDirectoryDescriptorCallback_nid_no_patch(int fd, std::int64_t offset, int whence);
 extern "C" int OpenInDirectory_nid_no_patch(int directory, const char* path, int flags, std::uint16_t mode);
 extern "C" int StatInDirectory_nid_no_patch(int directory, const char* path, FileStat* sb, bool follow);
 
@@ -16,6 +22,8 @@ namespace File {
 
 int OpenDirectoryDescriptor(const std::filesystem::path& path);
 bool IsDirectoryDescriptor(int fd);
+bool IsVirtualDirectoryDescriptor(int fd);
+bool IsNativeDirectoryDescriptor(int fd);
 std::optional<std::filesystem::path> DirectoryDescriptorPath(int fd);
 void ForgetDirectoryDescriptor(int fd);
 void DuplicateDirectoryDescriptor(int from, int to);
diff --git a/core/libs/prx/libkernel/File/include/SharedMemory.hpp b/core/libs/prx/libkernel/File/include/SharedMemory.hpp
index 5c9ffc9f47..7d9be97385 100644
--- a/core/libs/prx/libkernel/File/include/SharedMemory.hpp
+++ b/core/libs/prx/libkernel/File/include/SharedMemory.hpp
@@ -14,6 +14,15 @@ std::int64_t WriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
 std::int64_t PwriteSharedMemory_nid_no_patch(int descriptor, const void* buffer, std::size_t size, std::int64_t offset);
 std::int64_t SeekSharedMemory_nid_no_patch(int descriptor, std::int64_t offset, int whence);
 int TruncateSharedMemory_nid_no_patch(int descriptor, std::int64_t length);
+#ifdef _WIN32
+int SetSharedMemoryMode_nid_no_patch(int descriptor, int mode);
+int SharedMemoryDescriptorWritable_nid_no_patch(int descriptor);
+void TrackSharedMemoryDescriptor_nid_no_patch(int descriptor, bool writable);
+void ForgetSharedMemoryDescriptor_nid_no_patch(int descriptor);
+void DuplicateSharedMemoryDescriptor_nid_no_patch(int source, int destination);
+int CloseSharedMemoryDescriptor_nid_no_patch(int descriptor);
+int ReplaceSharedMemoryDescriptor_nid_no_patch(int source, int destination);
+#endif
 #ifndef _WIN32
 std::int64_t WritevSharedMemory_nid_no_patch(int descriptor, const struct iovec* vectors, int count);
 std::int64_t PwritevSharedMemory_nid_no_patch(int descriptor, const struct iovec* vectors, int count, std::int64_t offset);
diff --git a/core/libs/prx/libkernel/File/src/ArchivedFile.cpp b/core/libs/prx/libkernel/File/src/ArchivedFile.cpp
index df3a8548b4..2f1a17cc66 100644
--- a/core/libs/prx/libkernel/File/src/ArchivedFile.cpp
+++ b/core/libs/prx/libkernel/File/src/ArchivedFile.cpp
@@ -55,12 +55,6 @@ std::optional<int> OpenArchivedFile(const std::filesystem::path& native, int fla
     return fd;
 }
 
-void RefuseMergedDirectory(const std::filesystem::path& native) {
-    if (!AppArchiveHasDirectory_nid_no_patch(native)) return;
-    std::error_code error;
-    if (std::filesystem::is_directory(native, error)) NotImplemented_nid_no_patch(("opening " + native.string() + " merged with app0.zar").c_str());
-}
-
 bool IsArchivedFile(int fd) {
     return AppArchiveDescriptor_nid_no_patch(fd, nullptr, nullptr);
 }
diff --git a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
index d9cf12e8bc..7894f301c2 100644
--- a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
+++ b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/File/include/DescriptorControl.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/File.hpp"
@@ -22,8 +24,10 @@
 #include <string>
 
 #ifdef _WIN32
+#include <fcntl.h>
 #include <io.h>
 #include <windows.h>
+#include "prx/libc/include/General.hpp"
 #include "prx/libc/include/WindowsDescriptor.hpp"
 #else
 #include <fcntl.h>
@@ -32,9 +36,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI dup2_nid_postfix(int from, int to);
-
 namespace {
 
 constexpr int GuestEintr = 4;
@@ -115,6 +116,7 @@ enum class Kind { File, Directory, Pipe, Socket, Device, RandomDevice, ArchivedF
 struct Entry {
     bool closeOnExec = false;
     std::shared_ptr<int> status;
+    bool pipe = false;
 };
 
 std::mutex g_mutex;
@@ -179,8 +181,33 @@ Entry InitialEntry(int fd) {
     return {false, std::make_shared<int>(status)};
 }
 
+void SetHostAppend(int fd, bool append, const char* function) {
+    const int translation = ::_setmode(fd, _O_BINARY);
+    if (translation == -1 || ::_setmode(fd, translation) == -1)
+        throw std::runtime_error(std::string(function) + ": cannot read the translation mode of descriptor " + std::to_string(fd) + ", errno=" + std::to_string(errno));
+    HANDLE copy = nullptr;
+    if (!::DuplicateHandle(::GetCurrentProcess(), WindowsDescriptorHandle_nid_no_patch(fd), ::GetCurrentProcess(), &copy, 0, TRUE, DUPLICATE_SAME_ACCESS))
+        throw std::runtime_error(std::string(function) + ": cannot duplicate the handle of descriptor " + std::to_string(fd) + ", error=" + std::to_string(::GetLastError()));
+    const int replacement = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(copy), (append ? _O_APPEND : 0) | translation);
+    if (replacement < 0) {
+        ::CloseHandle(copy);
+        throw std::runtime_error(std::string(function) + ": cannot open a replacement for descriptor " + std::to_string(fd) + ", errno=" + std::to_string(errno));
+    }
+    auto* const standard = HostStandardHandle_nid_no_patch(fd);
+    const int moved = ::_dup2(replacement, fd);
+    const int error = errno;
+    ::_close(replacement);
+    KeepStandardHandle_nid_no_patch(fd, standard);
+    if (moved != 0)
+        throw std::runtime_error(std::string(function) + ": cannot replace descriptor " + std::to_string(fd) + ", errno=" + std::to_string(error));
+}
+
 void ApplyHostStatus(int fd, Kind kind, int changed, int next, const char* function) {
-    if ((changed & Append) && kind == Kind::File) Unsupported(function, "changing O_APPEND", kind, fd);
+    if ((changed & Append) && kind == Kind::File) {
+        const auto status = g_entries.at(fd).status;
+        for (const auto& [descriptor, entry] : g_entries)
+            if (entry.status == status && DescriptorIsOpen_nid_no_patch(descriptor)) SetHostAppend(descriptor, (next & Append) != 0, function);
+    }
     if ((changed & Nonblocking) && kind == Kind::Device) Unsupported(function, "changing O_NONBLOCK", kind, fd);
     if ((changed & Nonblocking) && kind == Kind::Pipe) SetPipeNonblocking(fd, (next & Nonblocking) != 0, function);
 }
@@ -351,7 +378,6 @@ int ChangeStatus(int fd, Kind kind, int mask, int value, const char* function) {
     const int next = (status & ~mask) | (value & mask);
     const int changed = status ^ next;
     if ((changed & Asynchronous) && (kind == Kind::Pipe || kind == Kind::Socket || kind == Kind::Device)) Unsupported(function, "O_ASYNC", kind, fd);
-    if ((changed & Synchronous) && kind == Kind::File) Unsupported(function, "changing O_FSYNC", kind, fd);
     ApplyHostStatus(fd, kind, changed, next, function);
     status = next;
     return 0;
@@ -362,12 +388,19 @@ int CurrentStatus(int fd) {
     return *Materialize(fd).status;
 }
 
+bool CreatedByPipe(int fd) {
+    std::lock_guard lock(g_mutex);
+    const auto found = g_entries.find(fd);
+    return found != g_entries.end() && found->second.pipe;
+}
+
 void SetCloseOnExec(int fd, bool value) {
     std::lock_guard lock(g_mutex);
     Materialize(fd).closeOnExec = value;
 }
 
 int RecordLock(int fd, int command, std::intptr_t argument) {
+    if (File::IsVirtualDirectoryDescriptor(fd)) return Fail(GuestEinval);
     const bool old = command <= OldSetLockWait;
     const int current = old ? command + (GetLock - OldGetLock) : command;
     const std::size_t size = old ? OldGuestLockSize : sizeof(GuestLock);
@@ -482,7 +515,7 @@ int Fcntl(int fd, int command, std::intptr_t argument) {
             return 0;
         case GetStatusFlags: {
             if (!Classify(fd, "fcntl")) return Fail(GuestEbadf);
-            const int access = AccessMode(fd, "fcntl");
+            const int access = CreatedByPipe(fd) ? ReadWrite : AccessMode(fd, "fcntl");
             return access | CurrentStatus(fd);
         }
         case SetStatusFlags: {
@@ -523,6 +556,7 @@ bool IoctlRequestMalformed(std::uint64_t request) {
 
 int Ioctl(int fd, std::uint64_t request, void* argument) {
     if (IoctlRequestMalformed(request)) return Fail(GuestEnotty);
+    if (File::IsVirtualDirectoryDescriptor(fd)) return Fail(GuestEinval);
     const auto command = static_cast<std::uint32_t>(request);
     const std::uint32_t length = (command >> 16) & 0x1fff;
     if ((command & RequestIn) && length != 0 && argument == nullptr) return Fail(GuestEfault);
@@ -561,11 +595,17 @@ void RememberDescriptor(int fd, int openFlags) {
 #endif
 }
 
+void RememberPipe(int fd) {
+    RememberDescriptor(fd, 0);
+    std::lock_guard lock(g_mutex);
+    g_entries[fd].pipe = true;
+}
+
 void ShareDescriptor(int from, int to) {
     File::ShareArchivedFile(from, to);
     std::lock_guard lock(g_mutex);
-    auto status = Materialize(from).status;
-    g_entries[to] = Entry{false, std::move(status)};
+    const auto& source = Materialize(from);
+    g_entries[to] = Entry{false, source.status, source.pipe};
 #ifdef _WIN32
     File::SharePositionedTransfer(from, to);
     GuestFileLockShare_nid_no_patch(from, to);
@@ -578,6 +618,21 @@ void ForgetDescriptor(int fd) {
     g_entries.erase(fd);
 }
 
+std::uint64_t g_synchronousWrites = 0;
+
+void SyncWrites(int fd) {
+    {
+        std::lock_guard lock(g_mutex);
+        const auto found = g_entries.find(fd);
+        if (found == g_entries.end() || !found->second.status || (*found->second.status & Synchronous) == 0) return;
+    }
+    if (Classify(fd, "write") != Kind::File) return;
+    if (const int result = sceKernelFsync(fd); result != 0)
+        throw std::runtime_error("write: syncing an O_FSYNC file failed, fd=" + std::to_string(fd) + ", error=" + std::to_string(result & 0xffff));
+    std::lock_guard lock(g_mutex);
+    ++g_synchronousWrites;
+}
+
 bool Appends(int fd) {
     std::lock_guard lock(g_mutex);
     const auto found = g_entries.find(fd);
@@ -594,6 +649,11 @@ bool IsCharacterDevice(int fd) {
 #endif
 }
 
+bool GrantsAccess(int fd, bool write) {
+    const int access = AccessMode(fd, write ? "pwrite" : "pread");
+    return access == ReadWrite || access == (write ? WriteOnly : ReadOnly);
+}
+
 bool IsVnode(int fd) {
     if (fd < 0 || File::IsRandomDevice(fd)) return false;
     if (File::IsArchivedFile(fd)) return true;
@@ -611,3 +671,8 @@ bool IsVnode(int fd) {
 extern "C" bool DescriptorHasNoVnode_nid_no_patch(int fd) {
     return !File::IsVnode(fd) && !File::IsCharacterDevice(fd) && !File::IsRandomDevice(fd);
 }
+
+extern "C" std::uint64_t FileSynchronousWritesForTest_nid_no_patch() {
+    std::lock_guard lock(g_mutex);
+    return File::g_synchronousWrites;
+}
diff --git a/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp b/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp
index e140a6b0f4..11002b4f93 100644
--- a/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp
+++ b/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp
@@ -1,41 +1,62 @@
+#include "prx/libc/include/GuestFileNumber.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/File.hpp"
+#include "prx/libkernel/File/include/NativeStat.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libc/include/AppArchive.hpp"
+#include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
 
-#include <cerrno>
-#include <string>
-
-#ifdef _WIN32
-
-#include "prx/libc/include/FileStream.hpp"
-#include "prx/libc/include/General.hpp"
-
-#include <cerrno>
-#include <cstdint>
+#include <algorithm>
 #include <atomic>
+#include <cerrno>
 #include <cstring>
 #include <limits>
-#include <fcntl.h>
-#include <io.h>
-#include <windows.h>
 #include <map>
 #include <memory>
 #include <mutex>
 #include <stdexcept>
-#include <system_error>
 #include <string>
+#include <system_error>
 #include <utility>
 #include <vector>
 
+#ifdef _WIN32
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/General.hpp"
+#include <fcntl.h>
+#include <io.h>
+#include <windows.h>
+#else
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#endif
+
 namespace {
 
+constexpr std::uint8_t GuestUnknownType = 0;
 constexpr std::uint8_t GuestDirectoryType = 4;
 constexpr std::uint8_t GuestRegularType = 8;
+constexpr std::uint8_t GuestSymbolicLinkType = 10;
+
+struct DirectoryEntry {
+    std::string name;
+    std::uint32_t fileNumber;
+    std::uint8_t type;
+};
+
+class DirectoryEntryNameTooLong : public std::runtime_error {
+public:
+    DirectoryEntryNameTooLong() : std::runtime_error("Directory entry name exceeds the guest 255-byte limit") {}
+};
 
 struct DirectoryState {
     std::mutex mutex;
-    std::vector<std::pair<std::string, std::uint8_t>> entries;
+    std::filesystem::path path;
+    bool virtualNamespace = false;
+    bool nativeBacked = false;
+    std::vector<DirectoryEntry> entries;
     std::size_t cursor = 0;
     bool loaded = false;
 };
@@ -44,26 +65,172 @@ std::mutex g_mutex;
 std::map<int, std::shared_ptr<DirectoryState>> g_directories;
 std::atomic<std::size_t> g_directoryCount{0};
 
+int DirectoryError(const std::error_code& code) {
+#ifdef _WIN32
+    if (code.category() == std::system_category())
+        return FilesystemError(std::error_code(WindowsOpenError_nid_no_patch(static_cast<unsigned long>(code.value())), std::generic_category()));
+#endif
+    return FilesystemError(code);
+}
+
 std::shared_ptr<DirectoryState> Find(int fd) {
+    if (g_directoryCount.load(std::memory_order_relaxed) == 0) return nullptr;
     std::lock_guard lock(g_mutex);
     const auto found = g_directories.find(fd);
     return found == g_directories.end() ? nullptr : found->second;
 }
 
-void Load(DirectoryState& state, int fd) {
-    if (state.loaded) return;
-    const auto path = File::WindowsDescriptorPath_nid_no_patch(fd);
-    if (!path) throw std::system_error(errno, std::generic_category(), "directory descriptor path");
-    state.loaded = true;
-    state.entries.emplace_back(".", GuestDirectoryType);
-    state.entries.emplace_back("..", GuestDirectoryType);
-    std::error_code error;
-    for (const auto& entry : std::filesystem::directory_iterator(*path, error)) {
-        std::error_code typeError;
-        state.entries.emplace_back(entry.path().filename().string(), entry.is_directory(typeError) ? GuestDirectoryType : GuestRegularType);
+#ifndef _WIN32
+std::uint8_t DirectoryEntryType(const std::filesystem::file_status& status) {
+    switch (status.type()) {
+    case std::filesystem::file_type::regular: return GuestRegularType;
+    case std::filesystem::file_type::directory: return GuestDirectoryType;
+    case std::filesystem::file_type::symlink: return GuestSymbolicLinkType;
+    case std::filesystem::file_type::block: return 6;
+    case std::filesystem::file_type::character: return 2;
+    case std::filesystem::file_type::fifo: return 1;
+    case std::filesystem::file_type::socket: return 12;
+    default: return 0;
     }
 }
+#else
+bool InsideApp0(const std::filesystem::path& directory) {
+    const auto root = ResolveDiskPath_nid_no_patch("/app0");
+    const auto handle = CreateFileW(root.c_str(), FILE_READ_ATTRIBUTES,
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+        FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) return false;
+    const int descriptor = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), _O_RDONLY | _O_BINARY);
+    if (descriptor < 0) {
+        CloseHandle(handle);
+        return false;
+    }
+    const auto app0 = File::WindowsDescriptorPath_nid_no_patch(descriptor);
+    ::_close(descriptor);
+    if (!app0) return false;
+    auto entry = directory.begin();
+    for (const auto& component : *app0) {
+        if (entry == directory.end()) return false;
+        const auto& left = entry->native();
+        const auto& right = component.native();
+        if (CompareStringOrdinal(left.c_str(), static_cast<int>(left.size()),
+                right.c_str(), static_cast<int>(right.size()), TRUE) != CSTR_EQUAL) return false;
+        ++entry;
+    }
+    return true;
+}
 
+std::uint8_t EntryType(const std::filesystem::path& path, bool followLinks) {
+    FileStat status{};
+    if (!File::FillLinkStat(path, &status))
+        return GuestUnknownType;
+    if (followLinks && (status.st_mode & 0170000) == 0120000) {
+        FileStat target{};
+        const int savedErrno = errno;
+        const bool found = File::TryFillFileStat(path, &target);
+        errno = savedErrno;
+        if (found && ((target.st_mode & 0170000) == 0040000 || (target.st_mode & 0170000) == 0100000))
+            status = target;
+    }
+    switch (status.st_mode & 0170000) {
+        case 0040000: return GuestDirectoryType;
+        case 0100000: return GuestRegularType;
+        case 0120000: return GuestSymbolicLinkType;
+        default: NotImplemented_nid_no_patch("getdents of a Windows file type other than a directory, regular file or symbolic link");
+    }
+}
+#endif
+
+void Add(DirectoryState& state, const std::string& name, std::uint64_t fileNumber, std::uint8_t type) {
+    if (name.size() > 255) throw DirectoryEntryNameTooLong();
+    state.entries.push_back({name, GuestFileNumber_nid_no_patch(fileNumber), type});
+}
+
+void Load(DirectoryState& state, int fd) {
+    if (state.loaded) return;
+    state.entries.clear();
+    const auto directoryPath = state.nativeBacked ? File::DirectoryDescriptorPath(fd).value_or(state.path) : state.path;
+    AppArchiveNode node{};
+    const bool hasArchiveDirectory = AppArchiveLookup_nid_no_patch(directoryPath, &node) && node.Directory;
+    std::error_code hostError;
+    const auto hostPathStatus = std::filesystem::status(directoryPath, hostError);
+    if (hostError && hostError != std::errc::no_such_file_or_directory)
+        throw std::system_error(hostError, "stat directory descriptor path");
+    const bool hostPathExists = !hostError && std::filesystem::exists(hostPathStatus);
+    const bool hasHostDirectory = hostPathExists && std::filesystem::is_directory(hostPathStatus);
+    FileStat directoryStatus{};
+    if (hasHostDirectory && !File::TryFillFileStat(directoryPath, &directoryStatus))
+        throw std::system_error(errno, std::generic_category(), "stat directory descriptor identity");
+    if (!hasHostDirectory && !hasArchiveDirectory) throw std::system_error(ENOTDIR, std::generic_category(), "directory descriptor path");
+    std::uint64_t currentNumber = hasArchiveDirectory ? static_cast<std::uint64_t>(node.Handle) + 1 : 0;
+    if (hasHostDirectory) currentNumber = static_cast<std::uint64_t>(directoryStatus.st_ino);
+    Add(state, ".", currentNumber, GuestDirectoryType);
+    std::uint64_t parentNumber = 0;
+    FileStat parentStatus{};
+    const bool hasHostParent = File::TryFillFileStat(directoryPath.parent_path(), &parentStatus);
+    if (hasHostParent) parentNumber = static_cast<std::uint64_t>(parentStatus.st_ino);
+    AppArchiveNode parentNode{};
+    if (!hasHostParent && AppArchiveLookup_nid_no_patch(directoryPath.parent_path(), &parentNode) && parentNode.Directory)
+        parentNumber = static_cast<std::uint64_t>(parentNode.Handle) + 1;
+    Add(state, "..", parentNumber, GuestDirectoryType);
+    if (hasHostDirectory) {
+        std::error_code error;
+#ifdef _WIN32
+        const int savedErrno = errno;
+        const bool followLinks = InsideApp0(directoryPath);
+        errno = savedErrno;
+#endif
+        for (std::filesystem::directory_iterator it(directoryPath, error), end; it != end; it.increment(error)) {
+            if (error) throw std::system_error(error, "read directory descriptor");
+            const auto utf8Name = it->path().filename().u8string();
+            const std::string name(reinterpret_cast<const char*>(utf8Name.data()), utf8Name.size());
+            FileStat entryStatus{};
+            if (!File::FillLinkStat(it->path(), &entryStatus)) throw std::system_error(errno, std::generic_category(), "stat directory entry");
+#ifdef _WIN32
+            Add(state, name, static_cast<std::uint64_t>(entryStatus.st_ino), EntryType(it->path(), followLinks));
+#else
+            Add(state, name, static_cast<std::uint64_t>(entryStatus.st_ino), DirectoryEntryType(it->symlink_status(error)));
+#endif
+            if (error) throw std::system_error(error, "stat directory entry");
+        }
+        if (error) throw std::system_error(error, "read directory descriptor");
+    }
+    if (hasArchiveDirectory) {
+        std::vector<std::string> hostNames;
+        hostNames.reserve(state.entries.size());
+        for (const auto& entry : state.entries) hostNames.push_back(entry.name);
+        for (const auto& entry : AppArchiveListUnshadowedDirectory_nid_no_patch(directoryPath, hostNames)) {
+            Add(state, entry.Name, static_cast<std::uint64_t>(entry.Handle) + 1, entry.Directory ? GuestDirectoryType : GuestRegularType);
+        }
+    }
+    state.loaded = true;
+}
+
+#ifdef _WIN32
+int OpenPlaceholder(const std::filesystem::path& path) {
+    std::error_code error;
+    if (std::filesystem::is_directory(path, error)) {
+        SECURITY_ATTRIBUTES security{sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE};
+        const auto handle = CreateFileW(path.c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+            &security, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+        if (handle == INVALID_HANDLE_VALUE) {
+            errno = WindowsOpenError_nid_no_patch(GetLastError());
+            return -1;
+        }
+        const int fd = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), _O_RDONLY | _O_BINARY);
+        if (fd < 0) CloseHandle(handle);
+        return fd;
+    }
+    return ::_open("NUL", _O_RDONLY | _O_BINARY);
+}
+#else
+int OpenPlaceholder(const std::filesystem::path& path) {
+    if (AppArchiveHasDirectory_nid_no_patch(path)) return ::open("/dev/null", O_RDONLY | O_CLOEXEC);
+    return ::open(path.c_str(), O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+}
+#endif
+
+#ifdef _WIN32
 int OpenStreamDirectory(const wchar_t* path) {
     return File::OpenDirectoryDescriptor(path);
 }
@@ -76,76 +243,116 @@ struct StreamRegistration {
 };
 
 const StreamRegistration g_streamRegistration;
+#endif
 
 }
 
 namespace File {
 
 int OpenDirectoryDescriptor(const std::filesystem::path& path) {
-    const auto state = std::make_shared<DirectoryState>();
-    SECURITY_ATTRIBUTES security{sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE};
-    const auto handle = CreateFileW(path.c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
-        &security, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
-    if (handle == INVALID_HANDLE_VALUE) {
-        errno = WindowsOpenError_nid_no_patch(GetLastError());
-        return -1;
-    }
-    const int fd = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), _O_RDONLY | _O_BINARY);
-    if (fd < 0) {
-        CloseHandle(handle);
-        return -1;
-    }
+    auto state = std::make_shared<DirectoryState>();
+    state->path = path;
+    std::error_code statusError;
+    const bool hostDirectory = std::filesystem::is_directory(path, statusError);
+    AppArchiveNode archiveNode{};
+    const bool archiveDirectory = AppArchiveLookup_nid_no_patch(path, &archiveNode) && archiveNode.Directory;
+    state->virtualNamespace = archiveDirectory;
+#ifdef _WIN32
+    state->nativeBacked = hostDirectory;
+#else
+    state->nativeBacked = hostDirectory && !AppArchiveHasDirectory_nid_no_patch(path);
+#endif
+    const int fd = OpenPlaceholder(path);
+    if (fd < 0) return -1;
     try {
         std::lock_guard lock(g_mutex);
         g_directories[fd] = state;
-        g_directoryCount = g_directories.size();
+        g_directoryCount.store(g_directories.size(), std::memory_order_relaxed);
     } catch (...) {
+#ifdef _WIN32
         ::_close(fd);
+#else
+        ::close(fd);
+#endif
         throw;
     }
     return fd;
 }
 
 bool IsDirectoryDescriptor(int fd) {
-    return g_directoryCount != 0 && Find(fd) != nullptr;
+    return Find(fd) != nullptr;
+}
+
+bool IsVirtualDirectoryDescriptor(int fd) {
+    const auto state = Find(fd);
+    return state && state->virtualNamespace;
+}
+
+bool IsNativeDirectoryDescriptor(int fd) {
+    const auto state = Find(fd);
+    return state && state->nativeBacked;
 }
 
 std::optional<std::filesystem::path> DirectoryDescriptorPath(int fd) {
-    if (!IsDirectoryDescriptor(fd)) return std::nullopt;
-    return WindowsDescriptorPath_nid_no_patch(fd);
+    if (const auto state = Find(fd)) {
+        if (!state->nativeBacked) return state->path;
+#ifdef _WIN32
+        return WindowsDescriptorPath_nid_no_patch(fd);
+#else
+        if (fd < 0) return std::nullopt;
+        std::error_code error;
+        const auto link = std::filesystem::path("/proc/self/fd") / std::to_string(fd);
+        const auto target = std::filesystem::read_symlink(link, error);
+        if (error) return std::nullopt;
+        return target;
+#endif
+    }
+#ifdef _WIN32
+    return std::nullopt;
+#else
+    if (fd < 0) return std::nullopt;
+    std::error_code error;
+    const auto link = std::filesystem::path("/proc/self/fd") / std::to_string(fd);
+    const auto target = std::filesystem::read_symlink(link, error);
+    if (error) return std::nullopt;
+    if (!std::filesystem::is_directory(target, error)) return std::nullopt;
+    return target;
+#endif
 }
 
 void ForgetDirectoryDescriptor(int fd) {
-    if (g_directoryCount == 0) return;
+    if (g_directoryCount.load(std::memory_order_relaxed) == 0) return;
     std::lock_guard lock(g_mutex);
     g_directories.erase(fd);
-    g_directoryCount = g_directories.size();
+    g_directoryCount.store(g_directories.size(), std::memory_order_relaxed);
 }
 
 void DuplicateDirectoryDescriptor(int from, int to) {
-    if (g_directoryCount == 0) return;
+    if (g_directoryCount.load(std::memory_order_relaxed) == 0) return;
     std::lock_guard lock(g_mutex);
     const auto found = g_directories.find(from);
-    if (found == g_directories.end()) return;
-    g_directories[to] = found->second;
-    g_directoryCount = g_directories.size();
+    if (found == g_directories.end()) g_directories.erase(to);
+    else g_directories[to] = found->second;
+    g_directoryCount.store(g_directories.size(), std::memory_order_relaxed);
 }
 
 std::optional<std::int64_t> SeekDirectoryDescriptor(int fd, std::int64_t offset, int whence) {
+    const auto state = Find(fd);
+    if (!state) return std::nullopt;
+    std::lock_guard lock(state->mutex);
     constexpr int SeekSet = 0;
     constexpr int SeekCurrent = 1;
     constexpr int SeekEnd = 2;
-    if (g_directoryCount == 0) return std::nullopt;
-    const auto found = Find(fd);
-    if (!found) return std::nullopt;
-    auto& state = *found;
-    std::lock_guard lock(state.mutex);
     if (whence != SeekSet && whence != SeekCurrent && whence != SeekEnd) {
         errno = EINVAL;
         return std::int64_t{-1};
     }
-    if (whence == SeekEnd) Load(state, fd);
-    const auto cursor = static_cast<std::int64_t>(whence == SeekEnd ? state.entries.size() : state.cursor);
+    if (whence == SeekEnd) {
+        try { Load(*state, fd); }
+        catch (const std::system_error& error) { errno = DirectoryError(error.code()); return std::int64_t{-1}; }
+        catch (const std::exception&) { errno = EIO; return std::int64_t{-1}; }
+    }
+    const auto cursor = static_cast<std::int64_t>(whence == SeekEnd ? state->entries.size() : state->cursor);
     if (whence == SeekCurrent && offset == 0) return cursor;
     if ((whence == SeekCurrent || whence == SeekEnd) && offset > std::numeric_limits<std::int64_t>::max() - cursor) {
         errno = EOVERFLOW;
@@ -157,69 +364,55 @@ std::optional<std::int64_t> SeekDirectoryDescriptor(int fd, std::int64_t offset,
         return std::int64_t{-1};
     }
     if (target == 0) {
-        state.entries.clear();
-        state.loaded = false;
-        state.cursor = 0;
+        state->entries.clear();
+        state->loaded = false;
+        state->cursor = 0;
         return std::int64_t{0};
     }
-    Load(state, fd);
-    state.cursor = static_cast<std::size_t>(target);
+    try { Load(*state, fd); }
+    catch (const std::system_error& error) { errno = DirectoryError(error.code()); return std::int64_t{-1}; }
+    state->cursor = static_cast<std::size_t>(target);
     return target;
 }
 
 int ReadDirectoryDescriptor(int fd, char* buf, int nbytes, std::int64_t* base) {
-    const auto found = Find(fd);
-    if (!found) return SCE_KERNEL_ERROR_ENOTDIR;
-    auto& state = *found;
-    std::lock_guard lock(state.mutex);
-    Load(state, fd);
-    if (base != nullptr) *base = static_cast<std::int64_t>(state.cursor);
+    const auto state = Find(fd);
+    if (!state) return SCE_KERNEL_ERROR_ENOTDIR;
+    if (buf == nullptr) return SCE_KERNEL_ERROR_EFAULT;
+    if (nbytes <= 0) return SCE_KERNEL_ERROR_EINVAL;
+    std::lock_guard lock(state->mutex);
+    try { Load(*state, fd); }
+    catch (const std::system_error& error) {
+        return SceKernelError(DirectoryError(error.code()));
+    }
+    catch (const DirectoryEntryNameTooLong&) { throw; }
+    catch (const std::exception&) { return SCE_KERNEL_ERROR_EIO; }
+    if (base != nullptr) *base = static_cast<std::int64_t>(state->cursor);
     std::size_t used = 0;
-    while (state.cursor < state.entries.size()) {
-        const auto& [name, type] = state.entries[state.cursor];
-        if (name.size() > 255) {
-            throw std::runtime_error("Directory entry name exceeds the guest 255-byte limit");
-        }
-        const std::size_t record = (8 + name.size() + 1 + 3) & ~std::size_t{3};
+    while (state->cursor < state->entries.size()) {
+        const auto& entry = state->entries[state->cursor];
+        const std::size_t record = (8 + entry.name.size() + 1 + 3) & ~std::size_t{3};
         if (used + record > static_cast<std::size_t>(nbytes)) {
             if (used == 0) return SCE_KERNEL_ERROR_EINVAL;
             break;
         }
         char* out = buf + used;
         std::memset(out, 0, record);
-        const auto fileNumber = static_cast<std::uint32_t>(state.cursor + 1);
         const auto recordLength = static_cast<std::uint16_t>(record);
-        std::memcpy(out, &fileNumber, sizeof(fileNumber));
+        const auto nameLength = static_cast<std::uint8_t>(entry.name.size());
+        std::memcpy(out, &entry.fileNumber, sizeof(entry.fileNumber));
         std::memcpy(out + 4, &recordLength, sizeof(recordLength));
-        out[6] = static_cast<char>(type);
-        out[7] = static_cast<char>(name.size());
-        std::memcpy(out + 8, name.c_str(), name.size() + 1);
+        out[6] = static_cast<char>(entry.type);
+        out[7] = static_cast<char>(nameLength);
+        std::memcpy(out + 8, entry.name.c_str(), entry.name.size() + 1);
         used += record;
-        ++state.cursor;
+        ++state->cursor;
     }
     return static_cast<int>(used);
 }
 
 }
 
-#else
-
-namespace File {
-
-std::optional<std::filesystem::path> DirectoryDescriptorPath(int fd) {
-    if (fd < 0) return std::nullopt;
-    std::error_code error;
-    const auto link = std::filesystem::path("/proc/self/fd") / std::to_string(fd);
-    const auto target = std::filesystem::read_symlink(link, error);
-    if (error) return std::nullopt;
-    if (!std::filesystem::is_directory(target, error)) return std::nullopt;
-    return target;
-}
-
-}
-
-#endif
-
 extern "C" const char* GetDirectoryDescriptorPath_nid_no_patch(int fd, int* error) {
     if (error == nullptr) return nullptr;
     if (!DescriptorIsOpen_nid_no_patch(fd)) {
@@ -244,11 +437,28 @@ extern "C" const char* GetDirectoryDescriptorPath_nid_no_patch(int fd, int* erro
 }
 
 extern "C" std::uint64_t GetDirectoryDescriptorPosition_nid_no_patch(int fd) {
-#ifdef _WIN32
     const auto position = File::SeekDirectoryDescriptor(fd, 0, 1);
     return position && *position > 0 ? static_cast<std::uint64_t>(*position) : 0;
-#else
-    (void)fd;
-    return 0;
-#endif
+}
+
+extern "C" int IsDirectoryDescriptor_nid_no_patch(int fd) {
+    return File::IsDirectoryDescriptor(fd) ? 1 : 0;
+}
+
+extern "C" int ReadDirectoryDescriptor_nid_no_patch(int fd, char* buf, int nbytes) {
+    return File::ReadDirectoryDescriptor(fd, buf, nbytes);
+}
+
+extern "C" std::int64_t SeekDirectoryDescriptor_nid_no_patch(int fd, std::int64_t offset, int whence) {
+    const auto position = File::SeekDirectoryDescriptor(fd, offset, whence);
+    return position ? *position : -1;
+}
+
+extern "C" int APS5_VABI ReadDirectoryDescriptorCallback_nid_no_patch(int fd, char* buf, int nbytes) {
+    return File::ReadDirectoryDescriptor(fd, buf, nbytes);
+}
+
+extern "C" std::int64_t APS5_VABI SeekDirectoryDescriptorCallback_nid_no_patch(int fd, std::int64_t offset, int whence) {
+    const auto position = File::SeekDirectoryDescriptor(fd, offset, whence);
+    return position ? *position : -1;
 }
diff --git a/core/libs/prx/libkernel/File/src/NativeStat.cpp b/core/libs/prx/libkernel/File/src/NativeStat.cpp
index 1fda5aabf7..2902da1152 100644
--- a/core/libs/prx/libkernel/File/src/NativeStat.cpp
+++ b/core/libs/prx/libkernel/File/src/NativeStat.cpp
@@ -1,5 +1,6 @@
 #include "prx/libkernel/File/include/NativeStat.hpp"
 #include "prx/libkernel/File/include/ArchivedFile.hpp"
+#include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <algorithm>
@@ -171,6 +172,14 @@ void FillFileStat(int nativeDescriptor, FileStat* sb) {
 
 bool FillFileStatFromDescriptor(int fd, FileStat* sb) {
     if (FillArchivedStatFromDescriptor(fd, sb)) return true;
+    if (File::IsDirectoryDescriptor(fd) && !File::IsNativeDirectoryDescriptor(fd)) {
+        const auto directory = DirectoryDescriptorPath(fd);
+        if (!directory) { errno = ENOENT; return false; }
+        if (FillArchivedStat(*directory, sb)) return true;
+        if (TryFillFileStat(*directory, sb)) return true;
+        errno = ENOENT;
+        return false;
+    }
     NativeStat st{};
     if (DoFstat(fd, &st) != 0) return false;
     CopyNativeStat(st, sb);
diff --git a/core/libs/prx/libkernel/File/src/Open.cpp b/core/libs/prx/libkernel/File/src/Open.cpp
index 9b79078010..7609a30cf4 100644
--- a/core/libs/prx/libkernel/File/src/Open.cpp
+++ b/core/libs/prx/libkernel/File/src/Open.cpp
@@ -1,9 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include "prx/libkernel/File/include/NativeStat.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/RenameDot.hpp"
 #include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/AppArchive.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include "prx/libkernel/File/include/SharedMemory.hpp"
@@ -87,6 +90,8 @@ static int NativeWrite(int fd, const void* buf, std::size_t n) {
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 static void IgnoreInvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {}
 static int NativeClose(int fd) {
+    const int shared = File::CloseSharedMemoryDescriptor_nid_no_patch(fd);
+    if (shared != -2) return shared;
     const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreInvalidParameter);
     const int result = ::_close(fd);
     _set_thread_local_invalid_parameter_handler(previous);
@@ -169,9 +174,6 @@ static int MapFlags(int sceFlags) {
 }
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-
 static int SceErrorFromErrno(int error) {
     const int guest = error > 0 && error <= 34 ? error : FilesystemError(std::error_code(error, std::generic_category()));
     return static_cast<int>(0x80020000u | static_cast<unsigned>(guest));
@@ -200,18 +202,34 @@ static int SceIoErrorFromErrno(int error) {
 }
 
 static int OpenNative(const std::filesystem::path& native, int flags, std::uint16_t mode) {
+    if (AppArchiveHasDirectory_nid_no_patch(native)) {
+        std::error_code error;
+        const auto status = std::filesystem::status(native, error);
+        const bool hostDirectory = !error && std::filesystem::is_directory(status);
+        if (hostDirectory || AppArchiveOnly_nid_no_patch(native)) {
+            if ((flags & SCE_KERNEL_O_ACCMODE) != SCE_KERNEL_O_RDONLY ||
+                (flags & (SCE_KERNEL_O_CREAT | SCE_KERNEL_O_TRUNC)) != 0) return SceErrorFromErrno(EISDIR);
+            const int fd = File::OpenDirectoryDescriptor(native);
+            if (fd < 0) return SceErrorFromErrno(errno);
+            File::RememberDescriptor(fd, flags);
+            return fd;
+        }
+    }
     if (const auto archived = File::OpenArchivedFile(native, flags)) {
         if (*archived < 0) return SceErrorFromErrno(-*archived);
         File::RememberDescriptor(*archived, flags);
         return *archived;
     }
-    File::RefuseMergedDirectory(native);
 #ifdef _WIN32
     if ((flags & (SCE_KERNEL_O_DIRECTORY | SCE_KERNEL_O_CREAT)) == SCE_KERNEL_O_DIRECTORY) {
         std::error_code error;
         const auto status = std::filesystem::status(native, error);
         if (std::filesystem::exists(status) && !std::filesystem::is_directory(status)) return SceErrorFromErrno(ENOTDIR);
     }
+    if ((flags & (SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL)) == (SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL) && native.has_filename()) {
+        const DWORD attributes = GetFileAttributesW(native.c_str());
+        if (attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) return SceErrorFromErrno(EEXIST);
+    }
 #endif
     if ((flags & SCE_KERNEL_O_NOFOLLOW) != 0 && (flags & (SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL)) != (SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL)) {
         constexpr int GuestEmlink = 31;
@@ -261,7 +279,10 @@ extern "C" {
 
 int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode) {
     if (File::InvalidOpenFlags(flags)) return SCE_KERNEL_ERROR_EINVAL;
-    if (path != nullptr && *path == '\0') return SCE_KERNEL_ERROR_ENOENT;
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceKernelError(error);
+    path = copy.c_str();
+    if (copy.empty()) return SCE_KERNEL_ERROR_ENOENT;
     APS5_LOG_OUT("path=%s flags=0x%X nativeFlags=0x%X mode=0%o", path, flags, MapFlags(flags), mode);
     if (path != nullptr && File::IsRandomDevicePath(path)) {
         if ((flags & SCE_KERNEL_O_ACCMODE) != SCE_KERNEL_O_RDONLY) throw std::runtime_error(std::string(__func__) + ": writing to " + path + " is not implemented");
@@ -294,19 +315,19 @@ int OpenInDirectory_nid_no_patch(int directory, const char* path, int flags, std
 }
 
 int APS5_VABI sceKernelClose(int d) {
-    if (File::IsHostStream(d)) return SCE_KERNEL_ERROR_EBADF;
+    if (File::IsHostStream(d)) return SCE_KERNEL_ERROR_EPERM;
     if (GuestSockets::IsOpen(d)) return GuestSockets::Close(d) == 0 ? 0 : SceKernelError(*__error_nid_postfix());
+    EqueueDescriptorClosed(d);
 #ifdef _WIN32
     const auto positioned = File::LockPositionedTransfer(d);
 #endif
-    EqueueDescriptorClosed(d);
     File::ForgetRandomDevice(d);
     File::ForgetDescriptor(d);
     ForgetJitSharedMemory(d);
 #ifdef _WIN32
-    File::ForgetDirectoryDescriptor(d);
     File::ForgetFileLock(d);
 #endif
+    File::ForgetDirectoryDescriptor(d);
     if (NativeClose(d) != 0) {
         if (errno == EBADF) return SCE_KERNEL_ERROR_EBADF;
         throw std::runtime_error(std::string(__func__) + ": close failed, fd=" + std::to_string(d) + ", errno=" + std::to_string(errno));
@@ -315,6 +336,7 @@ int APS5_VABI sceKernelClose(int d) {
 }
 
 std::int64_t APS5_VABI sceKernelRead(int d, void* buf, std::size_t nbytes) {
+    if (File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(EISDIR);
     if (GuestSockets::IsOpen(d)) {
         const auto n = GuestSockets::Read(d, buf, nbytes);
         return n < 0 ? SceKernelError(*__error_nid_postfix()) : n;
@@ -334,6 +356,7 @@ std::int64_t APS5_VABI sceKernelRead(int d, void* buf, std::size_t nbytes) {
 }
 
 std::int64_t APS5_VABI sceKernelWrite(int d, const void* buf, std::size_t nbytes) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(EISDIR);
     if (GuestSockets::IsOpen(d)) {
         const auto n = GuestSockets::Write(d, buf, nbytes);
         return n < 0 ? SceKernelError(*__error_nid_postfix()) : n;
@@ -343,6 +366,7 @@ std::int64_t APS5_VABI sceKernelWrite(int d, const void* buf, std::size_t nbytes
         const char empty = 0;
         return sceKernelWrite(d, &empty, 0);
     }
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     auto n = NativeWrite(d, buf, nbytes);
     if (n < 0) return SceIoErrorFromErrno(errno);
@@ -367,12 +391,10 @@ std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence) {
         throw std::invalid_argument(std::string(__func__) + ": invalid whence=" + std::to_string(whence));
     }
     if (const auto archived = File::SeekArchivedFile(d, offset, whence)) return *archived < 0 ? SceIoErrorFromErrno(-*archived) : *archived;
-#ifdef _WIN32
     if (const auto directory = File::SeekDirectoryDescriptor(d, offset, whence)) {
         if (*directory < 0) return SceIoErrorFromErrno(errno);
         return *directory;
     }
-#endif
     std::int64_t result = NativeLseek(d, offset, whence);
     if (result < 0) {
         const int error = errno;
@@ -410,13 +432,17 @@ static int StatNative(const std::filesystem::path& native, bool directory, FileS
     }
     if (directory && !std::filesystem::is_directory(status)) return SceErrorFromErrno(GuestEnotdir);
     if (sb == nullptr) return SceErrorFromErrno(GuestEfault);
-    if (!File::TryFillFileStat(metadataPath, sb)) return SceStatErrorFromErrno(errno);
+    FileStat result{};
+    if (!File::TryFillFileStat(metadataPath, &result)) return SceStatErrorFromErrno(errno);
+    if (!GuestCopyOut_nid_no_patch(sb, &result, sizeof(result))) return SceErrorFromErrno(GuestEfault);
     return 0;
 }
 
 int APS5_VABI sceKernelStat(const char* path, FileStat* sb) {
-    if (path == nullptr) return SceErrorFromErrno(GuestEfault);
-    if (*path == '\0') return SceErrorFromErrno(2);
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceErrorFromErrno(error);
+    path = copy.c_str();
+    if (copy.empty()) return SceErrorFromErrno(2);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native, true, true)) return SceKernelError(error);
     return StatNative(native, std::string_view(path).back() == '/', sb);
@@ -434,8 +460,10 @@ int StatInDirectory_nid_no_patch(int directory, const char* path, FileStat* sb,
 }
 
 int APS5_VABI sceKernelUnlink(const char* path) {
-    if (path == nullptr) return SceErrorFromErrno(GuestEfault);
-    if (*path == '\0') return SceErrorFromErrno(2);
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceErrorFromErrno(error);
+    path = copy.c_str();
+    if (copy.empty()) return SceErrorFromErrno(2);
     if (const int dot = RenameDotError_nid_no_patch(path)) return SceKernelError(dot);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
diff --git a/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp b/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp
index a5af2341a3..40ed2effdb 100644
--- a/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp
+++ b/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <array>
@@ -21,8 +22,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-
 namespace {
 constexpr char CertificateBegin[] = "-----BEGIN CERTIFICATE-----";
 constexpr char CertificateEnd[] = "-----END CERTIFICATE-----";
diff --git a/core/libs/prx/libkernel/File/src/SharedMemory.cpp b/core/libs/prx/libkernel/File/src/SharedMemory.cpp
index c5b133d941..8e18c4bcb6 100644
--- a/core/libs/prx/libkernel/File/src/SharedMemory.cpp
+++ b/core/libs/prx/libkernel/File/src/SharedMemory.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include "prx/libkernel/File/include/SharedMemory.hpp"
@@ -14,6 +16,8 @@
 #include <limits>
 #include <optional>
 #include <atomic>
+#include <mutex>
+#include <unordered_map>
 
 #ifdef _WIN32
 #include <fcntl.h>
@@ -22,6 +26,11 @@
 #include <sys/stat.h>
 #include <filesystem>
 #include <random>
+#include <windows.h>
+#include <aclapi.h>
+#include <sddl.h>
+#include "nid/Sha1.hpp"
+extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 #else
 #include "nid/Sha1.hpp"
 #include <fcntl.h>
@@ -33,10 +42,34 @@
 #include <cstdio>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
+#ifdef _WIN32
+std::mutex sharedDescriptorAccessMutex;
+std::unordered_map<int, bool> sharedDescriptorAccess;
+
+const std::wstring& WindowsNamedRoot() {
+    static const std::wstring root = [] {
+        const auto directory = std::filesystem::temp_directory_path();
+        std::vector<wchar_t> pathBuffer(32768);
+        const HANDLE handle = ::CreateFileW(directory.c_str(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+            nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+        if (handle == INVALID_HANDLE_VALUE)
+            throw std::system_error(static_cast<int>(::GetLastError()), std::system_category(), "opening the named shared-memory temporary root");
+        const DWORD length = ::GetFinalPathNameByHandleW(handle, pathBuffer.data(), static_cast<DWORD>(pathBuffer.size()),
+            FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+        const DWORD error = length == 0 ? ::GetLastError() : length >= pathBuffer.size() ? ERROR_FILENAME_EXCED_RANGE : ERROR_SUCCESS;
+        ::CloseHandle(handle);
+        if (error != ERROR_SUCCESS)
+            throw std::system_error(static_cast<int>(error), std::system_category(), "resolving the named shared-memory temporary root");
+        return (std::filesystem::path(std::wstring(pathBuffer.data(), length)) / L"AnyPS5" / L"shm").wstring();
+    }();
+    return root;
+}
+
+void IgnoreDescriptorParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {}
+#endif
+
 bool IsHostSharedMemoryDescriptor(int descriptor) {
 #ifdef __linux__
     char descriptorPath[64];
@@ -47,6 +80,44 @@ bool IsHostSharedMemoryDescriptor(int descriptor) {
     objectPath[length] = '\0';
     return std::string_view(objectPath).starts_with("/dev/shm/anyps5-shm-") ||
         std::string_view(objectPath).starts_with("/memfd:anyps5 shm_open");
+#elif defined(_WIN32)
+    {
+        std::lock_guard lock(sharedDescriptorAccessMutex);
+        if (!sharedDescriptorAccess.contains(descriptor)) return false;
+    }
+    const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreDescriptorParameter);
+    const auto handleValue = ::_get_osfhandle(descriptor);
+    _set_thread_local_invalid_parameter_handler(previous);
+    if (handleValue == -1) return false;
+    const auto handle = reinterpret_cast<HANDLE>(handleValue);
+    std::vector<wchar_t> pathBuffer(32768);
+    const DWORD length = ::GetFinalPathNameByHandleW(handle, pathBuffer.data(), static_cast<DWORD>(pathBuffer.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+    if (length == 0 || length >= pathBuffer.size()) return false;
+    std::wstring objectPath(pathBuffer.data(), length);
+    std::wstring_view root;
+    try {
+        root = WindowsNamedRoot();
+    } catch (...) {
+        return false;
+    }
+    if (objectPath.size() <= root.size() || objectPath[root.size()] != L'\\') return false;
+    if (::CompareStringOrdinal(objectPath.data(), static_cast<int>(root.size()), root.data(), static_cast<int>(root.size()), TRUE) != CSTR_EQUAL) return false;
+    const std::wstring_view relative(objectPath.data() + root.size() + 1, objectPath.size() - root.size() - 1);
+    if (relative.find_first_of(L"\\/") != std::wstring_view::npos) return false;
+    const auto validHex = [](wchar_t character) {
+        return (character >= L'0' && character <= L'9') || (character >= L'a' && character <= L'f');
+    };
+    if (relative.size() < 44 || !std::all_of(relative.begin(), relative.begin() + 40, validHex)) return false;
+    if (relative.substr(40) == L".dat") return true;
+    constexpr std::wstring_view marker = L"-unlinked-";
+    if (!relative.substr(40).starts_with(marker) || !relative.ends_with(L".dat")) return false;
+    const auto suffix = relative.substr(40 + marker.size(), relative.size() - 40 - marker.size() - 4);
+    const auto separator = suffix.find(L'-');
+    if (separator == std::wstring_view::npos || separator == 0 || separator + 1 == suffix.size()) return false;
+    const auto decimal = [](std::wstring_view value) {
+        return std::all_of(value.begin(), value.end(), [](wchar_t character) { return character >= L'0' && character <= L'9'; });
+    };
+    return decimal(suffix.substr(0, separator)) && decimal(suffix.substr(separator + 1));
 #else
     (void)descriptor;
     return false;
@@ -107,7 +178,6 @@ int GuestError(int error) {
     }
 }
 
-#ifndef _WIN32
 int NamedGuestError(int error) {
     switch (error) {
     case ENOENT:
@@ -133,14 +203,17 @@ int NamedGuestError(int error) {
     }
 }
 
-std::string NamedHostPath(const char* path, int& error) {
+std::string NamedHostName(const char* path, int& error) {
     if (path == nullptr) { error = EFAULT; return {}; }
     std::size_t length = 0;
     while (length < 1024 && path[length] != '\0') ++length;
     if (length == 1024) { error = ENAMETOOLONG; return {}; }
     if (length == 0 || path[0] != '/') { error = EINVAL; return {}; }
     const auto digest = Nid::Sha1(std::vector<std::uint8_t>(path, path + length));
-    std::string hostName = "/anyps5-shm-";
+    std::string hostName;
+#ifndef _WIN32
+    hostName = "/anyps5-shm-";
+#endif
     for (const auto byte : digest) {
         hostName += "0123456789abcdef"[byte >> 4];
         hostName += "0123456789abcdef"[byte & 15];
@@ -149,9 +222,384 @@ std::string NamedHostPath(const char* path, int& error) {
     return hostName;
 }
 
+#ifdef _WIN32
+int WindowsNamedError(DWORD error) {
+    switch (error) {
+    case ERROR_FILE_NOT_FOUND:
+    case ERROR_PATH_NOT_FOUND: return ENOENT;
+    case ERROR_ACCESS_DENIED:
+    case ERROR_SHARING_VIOLATION: return EACCES;
+    case ERROR_FILE_EXISTS:
+    case ERROR_ALREADY_EXISTS: return EEXIST;
+    case ERROR_INVALID_NAME: return EINVAL;
+    case ERROR_TOO_MANY_OPEN_FILES: return EMFILE;
+    case ERROR_DISK_FULL: return ENOSPC;
+    case ERROR_NOT_ENOUGH_MEMORY:
+    case ERROR_OUTOFMEMORY: return ENOMEM;
+    default: return 0;
+    }
+}
+
+std::filesystem::path WindowsNamedPath(const std::string& name) {
+    return std::filesystem::path(WindowsNamedRoot()) / std::filesystem::path(name + ".dat");
+}
+
+void EnsurePrivateWindowsDirectory(const std::filesystem::path& path, bool objectDirectory = false) {
+    const std::wstring ownerRights = objectDirectory ? L"0x001701ff" : L"FA";
+    const std::wstring policy = L"D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;" + ownerRights + L";;;OW)";
+    PSECURITY_DESCRIPTOR descriptor = nullptr;
+    if (!::ConvertStringSecurityDescriptorToSecurityDescriptorW(
+            policy.c_str(), SDDL_REVISION_1, &descriptor, nullptr))
+        throw std::system_error(static_cast<int>(::GetLastError()), std::system_category(), "creating the named shared-memory access policy");
+    PACL dacl = nullptr;
+    BOOL present = FALSE;
+    BOOL defaulted = FALSE;
+    if (!::GetSecurityDescriptorDacl(descriptor, &present, &dacl, &defaulted) || !present || dacl == nullptr) {
+        const DWORD error = ::GetLastError();
+        ::LocalFree(descriptor);
+        throw std::system_error(static_cast<int>(error == ERROR_SUCCESS ? ERROR_INVALID_SECURITY_DESCR : error),
+                                std::system_category(), "reading the named shared-memory access policy");
+    }
+
+    SECURITY_ATTRIBUTES security{sizeof(SECURITY_ATTRIBUTES), descriptor, FALSE};
+    if (!::CreateDirectoryW(path.c_str(), &security) && ::GetLastError() != ERROR_ALREADY_EXISTS) {
+        const DWORD error = ::GetLastError();
+        ::LocalFree(descriptor);
+        throw std::system_error(static_cast<int>(error), std::system_category(), "creating the named shared-memory directory");
+    }
+    const DWORD attributes = ::GetFileAttributesW(path.c_str());
+    if (attributes == INVALID_FILE_ATTRIBUTES || (attributes & FILE_ATTRIBUTE_DIRECTORY) == 0 ||
+        (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
+        const DWORD error = attributes == INVALID_FILE_ATTRIBUTES ? ::GetLastError() : ERROR_ACCESS_DENIED;
+        ::LocalFree(descriptor);
+        throw std::system_error(static_cast<int>(error), std::system_category(), "validating the named shared-memory directory");
+    }
+    const DWORD result = ::SetNamedSecurityInfoW(const_cast<LPWSTR>(path.c_str()), SE_FILE_OBJECT,
+                                                  DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,
+                                                  nullptr, nullptr, dacl, nullptr);
+    ::LocalFree(descriptor);
+    if (result != ERROR_SUCCESS) throw std::system_error(static_cast<int>(result), std::system_category(), "securing the named shared-memory directory");
+}
+
+DWORD SetWindowsNamedPermissions(HANDLE handle, int mode) {
+    std::wstring policy = L"D:P(A;OICI;FA;;;SY)(A;;WD;;;OW)";
+    if ((mode & 0400) != 0) policy += L"(A;;GRWD;;;OW)";
+    if ((mode & 0200) != 0) policy += L"(A;;GWSDWD;;;OW)";
+    PSECURITY_DESCRIPTOR descriptor = nullptr;
+    if (!::ConvertStringSecurityDescriptorToSecurityDescriptorW(policy.c_str(), SDDL_REVISION_1, &descriptor, nullptr))
+        return ::GetLastError();
+    PACL dacl = nullptr;
+    BOOL present = FALSE;
+    BOOL defaulted = FALSE;
+    if (!::GetSecurityDescriptorDacl(descriptor, &present, &dacl, &defaulted) || !present || dacl == nullptr) {
+        const DWORD error = ::GetLastError();
+        ::LocalFree(descriptor);
+        return error == ERROR_SUCCESS ? ERROR_INVALID_SECURITY_DESCR : error;
+    }
+    const DWORD result = ::SetSecurityInfo(handle, SE_FILE_OBJECT,
+        DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION, nullptr, nullptr, dacl, nullptr);
+    ::LocalFree(descriptor);
+    return result;
+}
+
+void CleanupUnlinkedWindowsObjects(const std::filesystem::path& objectPath, const std::string& name) {
+    const auto pattern = objectPath.parent_path() / (std::wstring(name.begin(), name.end()) + L"-unlinked-*.dat");
+    WIN32_FIND_DATAW data{};
+    const HANDLE search = ::FindFirstFileW(pattern.c_str(), &data);
+    if (search == INVALID_HANDLE_VALUE) return;
+    do {
+        if ((data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0) {
+            const auto orphanPath = objectPath.parent_path() / data.cFileName;
+            HANDLE orphan = ::CreateFileW(orphanPath.c_str(), DELETE, 0, nullptr, OPEN_EXISTING,
+                FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+            if (orphan != INVALID_HANDLE_VALUE) {
+                FILE_DISPOSITION_INFO deletion{TRUE};
+                ::SetFileInformationByHandle(orphan, FileDispositionInfo, &deletion, sizeof(deletion));
+                ::CloseHandle(orphan);
+            }
+        }
+    } while (::FindNextFileW(search, &data));
+    ::FindClose(search);
+}
+
+void ReapUnlinkedWindowsObject(const std::filesystem::path& orphanPath) {
+    HANDLE orphan = ::CreateFileW(orphanPath.c_str(), DELETE, 0, nullptr, OPEN_EXISTING,
+        FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+    if (orphan == INVALID_HANDLE_VALUE) return;
+    FILE_DISPOSITION_INFO deletion{TRUE};
+    ::SetFileInformationByHandle(orphan, FileDispositionInfo, &deletion, sizeof(deletion));
+    ::CloseHandle(orphan);
+}
+
+class WindowsNamedLock {
+public:
+    explicit WindowsNamedLock(const std::string& name) {
+        Initialize(WindowsNamedPath(name).wstring());
+    }
+
+    explicit WindowsNamedLock(HANDLE object) {
+        BY_HANDLE_FILE_INFORMATION status{};
+        if (!::GetFileInformationByHandle(object, &status)) { error = ::GetLastError(); return; }
+        Initialize(L"object-" + std::to_wstring(status.dwVolumeSerialNumber) + L"-" +
+                   std::to_wstring(status.nFileIndexHigh) + L"-" + std::to_wstring(status.nFileIndexLow));
+    }
+
+    ~WindowsNamedLock() {
+        if (locked) ::ReleaseMutex(handle);
+        if (handle != nullptr) ::CloseHandle(handle);
+    }
+
+    DWORD Error() const { return error; }
+
+private:
+    void Initialize(const std::wstring& identity) {
+        const auto bytes = std::vector<std::uint8_t>(reinterpret_cast<const std::uint8_t*>(identity.data()),
+                                                     reinterpret_cast<const std::uint8_t*>(identity.data() + identity.size()));
+        const auto digest = Nid::Sha1(bytes);
+        std::wstring lockName = L"Global\\AnyPS5NamedShm-";
+        for (const auto byte : digest) {
+            lockName += L"0123456789abcdef"[byte >> 4];
+            lockName += L"0123456789abcdef"[byte & 15];
+        }
+        handle = ::CreateMutexW(nullptr, FALSE, lockName.c_str());
+        if (handle == nullptr) { error = ::GetLastError(); return; }
+        const DWORD result = ::WaitForSingleObject(handle, INFINITE);
+        if (result == WAIT_OBJECT_0 || result == WAIT_ABANDONED) locked = true;
+        else error = result == WAIT_FAILED ? ::GetLastError() : ERROR_GEN_FAILURE;
+    }
+    HANDLE handle = nullptr;
+    DWORD error = ERROR_SUCCESS;
+    bool locked = false;
+};
+
+int OpenNamedFile(const char* path, int flags, int mode) {
+    const int savedError = errno;
+    int validationError = 0;
+    const auto hostName = NamedHostName(path, validationError);
+    if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
+
+    WindowsNamedLock namespaceLock(hostName);
+    if (namespaceLock.Error() != ERROR_SUCCESS) {
+        if (const int guest = WindowsNamedError(namespaceLock.Error())) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: locking the host named-object namespace failed, error=" + std::to_string(namespaceLock.Error()));
+    }
+
+    std::filesystem::path objectPath;
+    try {
+        objectPath = WindowsNamedPath(hostName);
+        EnsurePrivateWindowsDirectory(objectPath.parent_path().parent_path());
+        EnsurePrivateWindowsDirectory(objectPath.parent_path(), true);
+        CleanupUnlinkedWindowsObjects(objectPath, hostName);
+    } catch (const std::system_error& error) {
+        const auto nativeError = static_cast<DWORD>(error.code().value());
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: preparing the host named-object namespace failed: " + std::string(error.what()));
+    }
+
+    const bool readWrite = (flags & SCE_KERNEL_O_ACCMODE) == SCE_KERNEL_O_RDWR;
+    const DWORD access = GENERIC_READ | (readWrite ? GENERIC_WRITE : 0) | WRITE_DAC;
+    const bool create = (flags & SCE_KERNEL_O_CREAT) != 0;
+    const DWORD creationAccess = access | (create ? WRITE_DAC | DELETE : 0);
+    ::SetLastError(ERROR_SUCCESS);
+    HANDLE handle = ::CreateFileW(objectPath.c_str(), creationAccess, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                                  nullptr, create ? CREATE_NEW : OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+    DWORD createResult = ::GetLastError();
+    bool created = handle != INVALID_HANDLE_VALUE && create;
+    if (handle == INVALID_HANDLE_VALUE && create && createResult == ERROR_FILE_EXISTS && !(flags & SCE_KERNEL_O_EXCL)) {
+        handle = ::CreateFileW(objectPath.c_str(), access, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                               nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+        createResult = ::GetLastError();
+    }
+    if (handle == INVALID_HANDLE_VALUE) {
+        const DWORD nativeError = createResult;
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: opening the host named object failed, error=" + std::to_string(nativeError));
+    }
+
+    BY_HANDLE_FILE_INFORMATION status{};
+    if (!::GetFileInformationByHandle(handle, &status) || (status.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
+        const DWORD lastError = ::GetLastError();
+        const DWORD nativeError = lastError == ERROR_SUCCESS ? ERROR_INVALID_NAME : lastError;
+        if (created) {
+            FILE_DISPOSITION_INFO deletion{TRUE};
+            ::SetFileInformationByHandle(handle, FileDispositionInfo, &deletion, sizeof(deletion));
+        }
+        ::CloseHandle(handle);
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: refusing a reparse-point named object, error=" + std::to_string(nativeError));
+    }
+
+    if (created) {
+        const int permissions = (mode & 0777) & ~File::GetCreationMask_nid_no_patch();
+        const DWORD nativeError = SetWindowsNamedPermissions(handle, permissions);
+        if (nativeError != ERROR_SUCCESS) {
+            FILE_DISPOSITION_INFO deletion{TRUE};
+            ::SetFileInformationByHandle(handle, FileDispositionInfo, &deletion, sizeof(deletion));
+            ::CloseHandle(handle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_open: setting guest creation permissions failed, error=" + std::to_string(nativeError));
+        }
+    }
+
+    if ((flags & SCE_KERNEL_O_TRUNC) && readWrite) {
+        WindowsNamedLock objectLock(handle);
+        if (objectLock.Error() != ERROR_SUCCESS) {
+            const DWORD nativeError = objectLock.Error();
+            ::CloseHandle(handle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_open: locking the host named object for truncation failed, error=" + std::to_string(nativeError));
+        }
+        LARGE_INTEGER zero{};
+        if (!::SetFilePointerEx(handle, zero, nullptr, FILE_BEGIN) || !::SetEndOfFile(handle)) {
+            const DWORD nativeError = ::GetLastError();
+            ::CloseHandle(handle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_open: truncating the host named object failed, error=" + std::to_string(nativeError));
+        }
+    }
+
+    const int nativeFlags = _O_BINARY | (readWrite ? _O_RDWR : _O_RDONLY);
+    const int descriptor = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), nativeFlags);
+    if (descriptor >= 0) {
+        File::TrackSharedMemoryDescriptor_nid_no_patch(descriptor, readWrite);
+        errno = savedError;
+        return descriptor;
+    }
+    const int nativeError = errno;
+    ::CloseHandle(handle);
+    if (const int guest = GuestError(nativeError)) return Fail(guest);
+    throw std::runtime_error("shm_open: converting the host named object to a descriptor failed, errno=" + std::to_string(nativeError));
+}
+
+int UnlinkNamedFile(const char* path) {
+    const int savedError = errno;
+    int validationError = 0;
+    const auto hostName = NamedHostName(path, validationError);
+    if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
+    WindowsNamedLock namespaceLock(hostName);
+    if (namespaceLock.Error() != ERROR_SUCCESS) {
+        if (const int guest = WindowsNamedError(namespaceLock.Error())) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: locking the host named-object namespace failed, error=" + std::to_string(namespaceLock.Error()));
+    }
+
+    std::filesystem::path objectPath;
+    try {
+        objectPath = WindowsNamedPath(hostName);
+    } catch (const std::filesystem::filesystem_error& error) {
+        const auto nativeError = static_cast<DWORD>(error.code().value());
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: locating the host named object failed: " + std::string(error.what()));
+    }
+
+    HANDLE objectHandle = ::CreateFileW(objectPath.c_str(), FILE_READ_ATTRIBUTES | GENERIC_WRITE,
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+        FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+    if (objectHandle == INVALID_HANDLE_VALUE) {
+        const DWORD nativeError = ::GetLastError();
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: opening the host named object failed, error=" + std::to_string(nativeError));
+    }
+    BY_HANDLE_FILE_INFORMATION status{};
+    if (!::GetFileInformationByHandle(objectHandle, &status) ||
+        (status.dwFileAttributes & (FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_REPARSE_POINT)) != 0) {
+        const DWORD lastError = ::GetLastError();
+        const DWORD nativeError = lastError == ERROR_SUCCESS ? ERROR_INVALID_NAME : lastError;
+        ::CloseHandle(objectHandle);
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: refusing an invalid host named object, error=" + std::to_string(nativeError));
+    }
+
+    static std::atomic<unsigned> sequence{0};
+    for (unsigned attempt = 0; attempt < 64; ++attempt) {
+        const auto orphanPath = objectPath.parent_path() /
+            (objectPath.stem().wstring() + L"-unlinked-" + std::to_wstring(::GetCurrentProcessId()) +
+             L"-" + std::to_wstring(sequence.fetch_add(1, std::memory_order_relaxed)) + objectPath.extension().wstring());
+        if (!::MoveFileExW(objectPath.c_str(), orphanPath.c_str(), MOVEFILE_WRITE_THROUGH)) {
+            const DWORD nativeError = ::GetLastError();
+            if (nativeError == ERROR_ALREADY_EXISTS || nativeError == ERROR_FILE_EXISTS) continue;
+            ::CloseHandle(objectHandle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_unlink: detaching the host named object failed, error=" + std::to_string(nativeError));
+        }
+        ::CloseHandle(objectHandle);
+        ReapUnlinkedWindowsObject(orphanPath);
+        errno = savedError;
+        return 0;
+    }
+    ::CloseHandle(objectHandle);
+    return Fail(NamedGuestError(EEXIST));
+}
+
+int SetSharedMemoryModeInternal(int descriptor, int mode) {
+    if (!IsHostSharedMemoryDescriptor(descriptor)) return -2;
+    const auto rawHandle = ::_get_osfhandle(descriptor);
+    if (rawHandle == -1) { errno = EBADF; return -1; }
+    const auto handle = reinterpret_cast<HANDLE>(rawHandle);
+    WindowsNamedLock objectLock(handle);
+    if (objectLock.Error() != ERROR_SUCCESS) {
+        const int error = WindowsNamedError(objectLock.Error());
+        errno = error ? error : EIO;
+        return -1;
+    }
+    const DWORD nativeError = SetWindowsNamedPermissions(handle, mode & 0777);
+    if (nativeError == ERROR_SUCCESS) return 0;
+    const int error = WindowsNamedError(nativeError);
+    errno = error ? error : EACCES;
+    return -1;
+}
+
+std::filesystem::path SharedMemoryDescriptorPath(int descriptor) {
+    const auto rawHandle = ::_get_osfhandle(descriptor);
+    std::filesystem::path finalPath;
+    if (rawHandle != -1) {
+        std::vector<wchar_t> path(32768);
+        const DWORD length = ::GetFinalPathNameByHandleW(reinterpret_cast<HANDLE>(rawHandle), path.data(),
+            static_cast<DWORD>(path.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+        if (length > 4 && length < path.size()) {
+            std::wstring value(path.data(), length);
+            finalPath = std::filesystem::path(std::move(value));
+        }
+    }
+    return finalPath;
+}
+
+void ReapSharedMemoryDescriptorPath(const std::filesystem::path& path) {
+    if (!path.empty() && path.filename().wstring().find(L"-unlinked-") != std::wstring::npos)
+        ReapUnlinkedWindowsObject(path);
+}
+
+int CloseSharedMemoryDescriptorInternal(int descriptor) {
+    if (!IsHostSharedMemoryDescriptor(descriptor)) return -2;
+    const int savedError = errno;
+    const auto finalPath = SharedMemoryDescriptorPath(descriptor);
+    int result;
+    {
+        std::lock_guard lock(sharedDescriptorAccessMutex);
+        result = ::_close(descriptor);
+        if (result == 0) sharedDescriptorAccess.erase(descriptor);
+    }
+    if (result == 0) ReapSharedMemoryDescriptorPath(finalPath);
+    if (result == 0) errno = savedError;
+    return result;
+}
+
+int ReplaceSharedMemoryDescriptorInternal(int source, int destination) {
+    if (!IsHostSharedMemoryDescriptor(destination)) return -2;
+    const int savedError = errno;
+    const auto finalPath = SharedMemoryDescriptorPath(destination);
+    const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreDescriptorParameter);
+    const int result = ::_dup2(source, destination);
+    _set_thread_local_invalid_parameter_handler(previous);
+    if (result == 0) {
+        ReapSharedMemoryDescriptorPath(finalPath);
+        errno = savedError;
+    }
+    return result;
+}
+#else
 int OpenNamedFile(const char* path, int flags, int mode) {
     int validationError = 0;
-    const auto hostName = NamedHostPath(path, validationError);
+    const auto hostName = NamedHostName(path, validationError);
     if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
     HostShmLock namespaceLock;
     if (namespaceLock.Error() != 0) {
@@ -222,6 +670,44 @@ bool IsSharedMemoryDescriptor_nid_no_patch(int descriptor) {
     return IsHostSharedMemoryDescriptor(descriptor);
 }
 
+#ifdef _WIN32
+int SetSharedMemoryMode_nid_no_patch(int descriptor, int mode) {
+    return SetSharedMemoryModeInternal(descriptor, mode);
+}
+
+int CloseSharedMemoryDescriptor_nid_no_patch(int descriptor) {
+    return CloseSharedMemoryDescriptorInternal(descriptor);
+}
+
+int ReplaceSharedMemoryDescriptor_nid_no_patch(int source, int destination) {
+    return ReplaceSharedMemoryDescriptorInternal(source, destination);
+}
+
+int SharedMemoryDescriptorWritable_nid_no_patch(int descriptor) {
+    if (!IsHostSharedMemoryDescriptor(descriptor)) return -2;
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    const auto found = sharedDescriptorAccess.find(descriptor);
+    return found != sharedDescriptorAccess.end() && found->second ? 1 : 0;
+}
+
+void TrackSharedMemoryDescriptor_nid_no_patch(int descriptor, bool writable) {
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    sharedDescriptorAccess[descriptor] = writable;
+}
+
+void ForgetSharedMemoryDescriptor_nid_no_patch(int descriptor) {
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    sharedDescriptorAccess.erase(descriptor);
+}
+
+void DuplicateSharedMemoryDescriptor_nid_no_patch(int source, int destination) {
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    sharedDescriptorAccess.erase(destination);
+    const auto found = sharedDescriptorAccess.find(source);
+    if (found != sharedDescriptorAccess.end()) sharedDescriptorAccess[destination] = found->second;
+}
+#endif
+
 namespace {
 
 class SharedMemoryLock {
@@ -230,6 +716,18 @@ public:
 #ifdef __linux__
         struct stat originalStatus{};
         if (::fstat(value, &originalStatus) != 0) { shared = true; error = errno; return; }
+#elif defined(_WIN32)
+        if (!IsHostSharedMemoryDescriptor(value)) return;
+        const auto originalValue = ::_get_osfhandle(value);
+        if (originalValue == -1) return;
+        BY_HANDLE_FILE_INFORMATION originalStatus{};
+        if (!::GetFileInformationByHandle(reinterpret_cast<HANDLE>(originalValue), &originalStatus)) {
+            shared = true;
+            error = EBADF;
+            return;
+        }
+        windowsObjectLock = std::make_unique<WindowsNamedLock>(reinterpret_cast<HANDLE>(originalValue));
+        if (windowsObjectLock->Error() != ERROR_SUCCESS) { shared = true; error = WindowsNamedError(windowsObjectLock->Error()); if (!error) error = EIO; return; }
 #endif
         if (!IsHostSharedMemoryDescriptor(value)) {
 #ifdef __linux__
@@ -247,10 +745,20 @@ public:
         if (hostLock->Error() != 0) { error = hostLock->Error(); return; }
         descriptor = Duplicate(value);
         if (descriptor < 0) { error = errno; return; }
+#ifdef _WIN32
+        DuplicateSharedMemoryDescriptor_nid_no_patch(value, descriptor);
+#endif
         if (!IsHostSharedMemoryDescriptor(descriptor)) { error = EBADF; return; }
         if (!Refresh()) { error = errno; return; }
 #ifdef __linux__
         if (status.st_dev != originalStatus.st_dev || status.st_ino != originalStatus.st_ino) error = EBADF;
+#elif defined(_WIN32)
+        BY_HANDLE_FILE_INFORMATION duplicatedStatus{};
+        const auto duplicatedValue = ::_get_osfhandle(descriptor);
+        if (duplicatedValue == -1 || !::GetFileInformationByHandle(reinterpret_cast<HANDLE>(duplicatedValue), &duplicatedStatus) ||
+            duplicatedStatus.dwVolumeSerialNumber != originalStatus.dwVolumeSerialNumber ||
+            duplicatedStatus.nFileIndexHigh != originalStatus.nFileIndexHigh ||
+            duplicatedStatus.nFileIndexLow != originalStatus.nFileIndexLow) error = EBADF;
 #endif
     }
 
@@ -258,7 +766,7 @@ public:
         if (descriptor >= 0) {
             const int savedError = errno;
 #ifdef _WIN32
-            ::_close(descriptor);
+            CloseSharedMemoryDescriptor_nid_no_patch(descriptor);
 #else
             ::close(descriptor);
 #endif
@@ -292,6 +800,9 @@ private:
 
     int descriptor = -1;
     std::optional<HostShmLock> hostLock;
+#ifdef _WIN32
+    std::unique_ptr<WindowsNamedLock> windowsObjectLock;
+#endif
     bool shared = false;
     int error = 0;
 };
@@ -303,7 +814,9 @@ std::int64_t WriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
     if (guard.Error() != 0) { errno = guard.Error(); return -1; }
     if (!guard.Refresh()) return -1;
     const auto fd = guard.Descriptor();
-#ifndef _WIN32
+#ifdef _WIN32
+    if (SharedMemoryDescriptorWritable_nid_no_patch(fd) == 0) { errno = EBADF; return -1; }
+#else
     const int access = ::fcntl(fd, F_GETFL);
     if (access < 0) return -1;
     if ((access & O_ACCMODE) == O_RDONLY) { errno = EBADF; return -1; }
@@ -331,7 +844,9 @@ std::int64_t PwriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
     if (guard.Error() != 0) { errno = guard.Error(); return -1; }
     if (!guard.Refresh()) return -1;
     const auto fd = guard.Descriptor();
-#ifndef _WIN32
+#ifdef _WIN32
+    if (SharedMemoryDescriptorWritable_nid_no_patch(fd) == 0) { errno = EBADF; return -1; }
+#else
     const int access = ::fcntl(fd, F_GETFL);
     if (access < 0) return -1;
     if ((access & O_ACCMODE) == O_RDONLY) { errno = EBADF; return -1; }
@@ -341,7 +856,19 @@ std::int64_t PwriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
     if (offset >= status.st_size) return 0;
     const auto count = std::min<std::uint64_t>(size, static_cast<std::uint64_t>(status.st_size - offset));
 #ifdef _WIN32
-    const auto result = NativePositioned_nid_no_patch(fd, const_cast<void*>(buffer), static_cast<std::size_t>(count), offset, true);
+    const auto handle = reinterpret_cast<HANDLE>(::_get_osfhandle(fd));
+    if (handle == INVALID_HANDLE_VALUE || ::GetFileType(handle) != FILE_TYPE_DISK) { errno = EBADF; return -1; }
+    LARGE_INTEGER previous{};
+    if (!::SetFilePointerEx(handle, LARGE_INTEGER{}, &previous, FILE_CURRENT)) { errno = EIO; return -1; }
+    OVERLAPPED overlapped{};
+    overlapped.Offset = static_cast<DWORD>(offset);
+    overlapped.OffsetHigh = static_cast<DWORD>(static_cast<std::uint64_t>(offset) >> 32u);
+    DWORD written = 0;
+    const BOOL succeeded = ::WriteFile(handle, buffer, static_cast<DWORD>(std::min<std::uint64_t>(count, std::numeric_limits<DWORD>::max())), &written, &overlapped);
+    const DWORD writeError = succeeded ? ERROR_SUCCESS : ::GetLastError();
+    if (!::SetFilePointerEx(handle, previous, nullptr, FILE_BEGIN)) throw std::runtime_error("pwrite: restoring the host file position failed");
+    if (!succeeded) { errno = writeError == ERROR_ACCESS_DENIED ? EBADF : EIO; return -1; }
+    const auto result = written;
 #else
     const auto result = ::pwrite(fd, buffer, static_cast<std::size_t>(count), static_cast<off_t>(offset));
 #endif
@@ -436,9 +963,19 @@ std::int64_t PwritevSharedMemory_nid_no_patch(int descriptor, const struct iovec
 #endif
 
 int TruncateSharedMemory_nid_no_patch(int descriptor, std::int64_t length) {
+#ifdef _WIN32
+    const auto positioned = LockPositionedTransfer(descriptor);
+#endif
     SharedMemoryLock guard(descriptor);
     if (!guard.IsShared()) return -2;
-    if (guard.Error() != 0) { errno = guard.Error(); return -1; }
+    if (guard.Error() != 0) {
+        errno = guard.Error();
+#ifdef _WIN32
+        return errno;
+#else
+        return -1;
+#endif
+    }
     const auto fd = guard.Descriptor();
 #ifdef _WIN32
     const int result = static_cast<int>(::_chsize_s(fd, length));
@@ -455,8 +992,11 @@ extern "C" int APS5_VABI shm_open_nid_postfix(const char* path, int flags, int m
     if (accessMode != SCE_KERNEL_O_RDONLY && accessMode != SCE_KERNEL_O_RDWR) return Fail(GuestInvalid);
     if ((flags & ~AcceptedFlags) != 0) return Fail(GuestInvalid);
     if (path != anonymousObject) {
+        std::string copy;
+        if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return Fail(error);
+        path = copy.c_str();
 #ifdef _WIN32
-        NotImplemented_nid_no_patch("shm_open of a named object");
+        return OpenNamedFile(path, flags, mode);
 #else
         return OpenNamedFile(path, flags, mode);
 #endif
@@ -470,13 +1010,14 @@ extern "C" int APS5_VABI shm_open_nid_postfix(const char* path, int flags, int m
 }
 
 extern "C" int APS5_VABI shm_unlink_nid_postfix(const char* path) {
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return Fail(error);
+    path = copy.c_str();
 #ifdef _WIN32
-    (void)path;
-    NotImplemented_nid_no_patch("shm_unlink of a named object");
-    return 0;
+    return UnlinkNamedFile(path);
 #else
     int validationError = 0;
-    const auto hostName = NamedHostPath(path, validationError);
+    const auto hostName = NamedHostName(path, validationError);
     if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
     HostShmLock namespaceLock;
     if (namespaceLock.Error() != 0) {
diff --git a/core/libs/prx/libkernel/File/src/Stdio.cpp b/core/libs/prx/libkernel/File/src/Stdio.cpp
index b00d71b5d4..9068334dea 100644
--- a/core/libs/prx/libkernel/File/src/Stdio.cpp
+++ b/core/libs/prx/libkernel/File/src/Stdio.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
@@ -43,10 +45,6 @@
 #include <mach/mach_vm.h>
 #endif
 
-struct KernelIovec {
-    void* base;
-    std::size_t length;
-};
 static_assert(sizeof(KernelIovec) == sizeof(GuestSockets::Iovec));
 static_assert(sizeof(KernelIovec) == sizeof(AppArchiveBuffer) && offsetof(KernelIovec, length) == offsetof(AppArchiveBuffer, Length));
 
@@ -91,16 +89,7 @@ static int NativeMkdir(const std::filesystem::path& path, std::uint16_t mode) {
     (void)mode;
     return ::_wmkdir(path.wstring().c_str());
 }
-static int NativeChmod(const std::filesystem::path& path, int mode) {
-    RecordWrittenPath_nid_no_patch(path);
-    return ::_wchmod(path.wstring().c_str(), mode);
-}
-std::optional<std::filesystem::path> File::WindowsDescriptorPath_nid_no_patch(int descriptor) {
-    const auto handle = reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor));
-    if (handle == INVALID_HANDLE_VALUE) {
-        errno = EBADF;
-        return std::nullopt;
-    }
+static std::optional<std::filesystem::path> HandlePath(HANDLE handle) {
     std::wstring path(MAX_PATH, L'\0');
     auto length = ::GetFinalPathNameByHandleW(handle, path.data(), static_cast<DWORD>(path.size()), FILE_NAME_NORMALIZED);
     if (length >= path.size()) {
@@ -120,6 +109,32 @@ std::optional<std::filesystem::path> File::WindowsDescriptorPath_nid_no_patch(in
     else if (path.starts_with(LR"(\\?\)") && path.size() > 6 && path[5] == L':' && path[6] == L'\\') path.erase(0, 4);
     return path;
 }
+std::optional<std::filesystem::path> File::WindowsDescriptorPath_nid_no_patch(int descriptor) {
+    const auto handle = reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor));
+    if (handle == INVALID_HANDLE_VALUE) {
+        errno = EBADF;
+        return std::nullopt;
+    }
+    return HandlePath(handle);
+}
+static int NativeChmod(const std::filesystem::path& path, int mode) {
+    const DWORD attributes = GetFileAttributesW(path.c_str());
+    if (attributes == INVALID_FILE_ATTRIBUTES || (attributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0) {
+        RecordWrittenPath_nid_no_patch(path);
+        return ::_wchmod(path.wstring().c_str(), mode);
+    }
+    const HANDLE handle = CreateFileW(path.c_str(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr,
+        OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) {
+        errno = WindowsOpenError_nid_no_patch(GetLastError());
+        return -1;
+    }
+    const auto target = HandlePath(handle);
+    CloseHandle(handle);
+    if (!target) return -1;
+    RecordWrittenPath_nid_no_patch(*target);
+    return ::_wchmod(target->wstring().c_str(), mode);
+}
 static int NativeFchmod(int descriptor, int mode) {
     const auto path = File::WindowsDescriptorPath_nid_no_patch(descriptor);
     return path ? NativeChmod(*path, mode) : -1;
@@ -189,6 +204,7 @@ static int NativeUtimes(const std::filesystem::path& path, const KernelTimeval*
 }
 static int NativeFutimes(int descriptor, const KernelTimeval* times) {
     if (const auto directory = File::DirectoryDescriptorPath(descriptor)) return NativeUtimes(*directory, times);
+
     const auto original = reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor));
     if (original == INVALID_HANDLE_VALUE) { errno = EBADF; return -1; }
     if (GetFileType(original) != FILE_TYPE_DISK) { errno = EINVAL; return -1; }
@@ -447,10 +463,17 @@ static bool IsPipeDescriptor(int descriptor) {
 #endif
 }
 
-static int PositionedArgumentError(int descriptor, bool nullBuffer, std::int64_t offset) {
+static bool IsSeekableDescriptor(int descriptor) {
+    if (GuestSockets::IsOpen(descriptor)) return false;
+    return File::IsVnode(descriptor) || File::IsCharacterDevice(descriptor) || File::IsRandomDevice(descriptor);
+}
+
+static int PositionedArgumentError(int descriptor, bool write, bool nullBuffer, std::int64_t offset) {
+    if (IsKqueueDescriptor(descriptor)) return GUEST_ESPIPE;
     if (!nullBuffer && offset >= 0) return 0;
     if (!GuestSockets::IsOpen(descriptor) && !DescriptorIsOpen_nid_no_patch(descriptor)) return GUEST_EBADF;
-    if (GuestSockets::IsOpen(descriptor) || IsPipeDescriptor(descriptor)) return GUEST_ESPIPE;
+    if (!IsSeekableDescriptor(descriptor)) return GUEST_ESPIPE;
+    if (!File::GrantsAccess(descriptor, write)) return GUEST_EBADF;
     return offset < 0 ? GUEST_EINVAL : GUEST_EFAULT;
 }
 
@@ -484,8 +507,6 @@ static int PathLookupFailure(const std::error_code& error) {
     return lookup ? SceErrorFromErrno(error.default_error_condition().value()) : 0;
 }
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static int PosixFailure(int error) {
     *__error_nid_postfix() = error;
     return -1;
@@ -595,15 +616,15 @@ extern "C" int APS5_VABI pipe_nid_postfix(int* descriptors) {
     const int result = ::pipe(native);
 #endif
     if (result != 0) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
-    File::RememberDescriptor(native[0], 0);
-    File::RememberDescriptor(native[1], 0);
+    File::RememberPipe(native[0]);
+    File::RememberPipe(native[1]);
     std::memcpy(descriptors, native, sizeof(native));
     return 0;
 }
 
-static int PathError(const char* path) {
-    if (path == nullptr) return GUEST_EFAULT;
-    return *path == '\0' ? GUEST_ENOENT : 0;
+static int PathError(const char* path, std::string& copy) {
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return error;
+    return copy.empty() ? GUEST_ENOENT : 0;
 }
 
 #ifdef _WIN32
@@ -629,11 +650,10 @@ static bool HasNonDirectoryPrefix(const std::filesystem::path& native) {
     return false;
 }
 
-extern "C" int APS5_VABI dup_nid_postfix(int d);
-extern "C" int APS5_VABI close_nid_postfix(int d);
-
 int File::DuplicateFrom(int fd, int start) {
 #ifdef _WIN32
+    GuestResourceLimit openFileLimit{};
+    if (getrlimit_nid_postfix(8, &openFileLimit) == 0 && start >= openFileLimit.rlim_cur) return PosixFailure(GUEST_EINVAL);
     std::vector<int> below;
     int duplicate;
     while ((duplicate = dup_nid_postfix(fd)) >= 0 && duplicate < start) below.push_back(duplicate);
@@ -643,6 +663,7 @@ int File::DuplicateFrom(int fd, int start) {
 #else
     const int duplicate = ::fcntl(fd, F_DUPFD, start);
     if (duplicate < 0) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
+    File::DuplicateDirectoryDescriptor(fd, duplicate);
     if (File::IsRandomDevice(fd)) File::RememberRandomDevice(duplicate);
     File::ShareDescriptor(fd, duplicate);
     return duplicate;
@@ -650,6 +671,15 @@ int File::DuplicateFrom(int fd, int start) {
 }
 
 static int LookupError(const std::filesystem::path& native) {
+#ifdef _WIN32
+    const auto named = native.has_filename() ? native : WithoutTrailingSeparator(native);
+    const DWORD attributes = GetFileAttributesW(named.c_str());
+    if (attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
+        FileStat target{};
+        if (!File::TryFillFileStat(named, &target)) return SceErrorFromErrno(errno) & 0xffff;
+        return native.has_filename() || (target.st_mode & 0170000) == 0040000 ? 0 : GUEST_ENOTDIR;
+    }
+#endif
     std::error_code error;
     const auto status = std::filesystem::status(native, error);
     if (std::filesystem::exists(status)) return native.has_filename() || std::filesystem::is_directory(status) ? 0 : GUEST_ENOTDIR;
@@ -689,7 +719,9 @@ static int SetFileFlags(const char* function, const std::string& target, std::ui
 extern "C" {
 
 int APS5_VABI chmod_nid_postfix(const char* path, int mode) {
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return PosixFailure(error);
     if (NativeChmod(native, mode & 07777) != 0) return PosixResult(SceErrorFromErrno(errno == ENOENT ? NotFoundError_nid_no_patch(native) : errno));
@@ -697,7 +729,9 @@ int APS5_VABI chmod_nid_postfix(const char* path, int mode) {
 }
 
 int APS5_VABI chflags_nid_postfix(const char* path, std::uint64_t flags) {
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return PosixFailure(error);
     if (const int error = LookupError(native)) return PosixFailure(error);
@@ -706,7 +740,8 @@ int APS5_VABI chflags_nid_postfix(const char* path, std::uint64_t flags) {
 }
 
 int APS5_VABI fchflags_nid_postfix(int d, std::uint64_t flags) {
-    if (GuestSockets::IsOpen(d) || File::IsSharedMemoryDescriptor_nid_no_patch(d)) return PosixFailure(GUEST_EINVAL);
+    if (File::IsVirtualDirectoryDescriptor(d)) return PosixFailure(GUEST_EISDIR);
+    if (GuestSockets::IsOpen(d) || IsKqueueDescriptor(d) || File::IsSharedMemoryDescriptor_nid_no_patch(d)) return PosixFailure(GUEST_EINVAL);
     File::RefuseArchivedFile(d, "fchflags");
     if (!File::IsVnode(d)) {
         if (!DescriptorIsOpen_nid_no_patch(d)) return PosixFailure(GUEST_EBADF);
@@ -726,7 +761,7 @@ int APS5_VABI nmount_nid_postfix(const KernelIovec* iov, unsigned int niov, int
 }
 
 int APS5_VABI close_nid_postfix(int d) {
-    if (File::IsHostStream(d)) return PosixFailure(GUEST_EBADF);
+    if (File::IsHostStream(d)) return PosixFailure(GUEST_EPERM);
     int socketError = 0;
     if (KernelCloseSocket_nid_no_patch(d, &socketError)) {
         if (socketError == 0) return 0;
@@ -734,16 +769,18 @@ int APS5_VABI close_nid_postfix(int d) {
         return -1;
     }
     if (GuestSockets::IsOpen(d)) return GuestSockets::Close(d);
+    EqueueDescriptorClosed(d);
 #ifdef _WIN32
     const auto positioned = File::LockPositionedTransfer(d);
 #endif
-    EqueueDescriptorClosed(d);
     File::ForgetRandomDevice(d);
     File::ForgetDescriptor(d);
     ForgetJitSharedMemory(d);
-#ifdef _WIN32
     File::ForgetDirectoryDescriptor(d);
+#ifdef _WIN32
     File::ForgetFileLock(d);
+    const int shared = File::CloseSharedMemoryDescriptor_nid_no_patch(d);
+    if (shared != -2) return shared;
     return WithoutParameterHandler([d] { return ::_close(d); });
 #else
     return ::close(d);
@@ -762,26 +799,9 @@ std::atomic<int> g_hostStandardOutput{-1};
 
 void PreserveHostStream(int standard, std::atomic<int>& slot) {
     if (slot.load() >= 0) return;
-#ifdef _WIN32
-    const int saved = WithoutParameterHandler([standard] { return ::_dup(standard); });
-#else
     const int saved = standard == 1 ? KeepHostStandardOutput_nid_no_patch() : KeepHostStandardError_nid_no_patch();
-#endif
     if (saved < 0) throw std::runtime_error(standard == 1 ? "dup2: cannot keep the host standard output" : "dup2: cannot keep the host standard error");
-    int expected = -1;
-    if (!slot.compare_exchange_strong(expected, saved)) {
-#ifdef _WIN32
-        _close(saved);
-#endif
-        return;
-    }
-#ifdef _WIN32
-    if (!AdoptHostStandardStream_nid_no_patch(standard, saved)) {
-        slot.store(-1);
-        _close(saved);
-        throw std::runtime_error(standard == 1 ? "dup2: cannot keep the host standard output" : "dup2: cannot keep the host standard error");
-    }
-#endif
+    slot.store(saved);
 }
 
 void PreserveHostStandardError() { PreserveHostStream(2, g_hostStandardError); }
@@ -800,11 +820,12 @@ int APS5_VABI dup_nid_postfix(int d) {
     if (IsKqueueDescriptor(d)) throw std::runtime_error(std::string(__func__) + ": duplicating a kqueue descriptor is not supported");
 #ifdef _WIN32
     const int duplicate = WithoutParameterHandler([d] { return ::_dup(d); });
-    if (duplicate >= 0) File::DuplicateDirectoryDescriptor(d, duplicate);
+    if (duplicate >= 0) File::DuplicateSharedMemoryDescriptor_nid_no_patch(d, duplicate);
 #else
     const int duplicate = ::dup(d);
 #endif
     if (duplicate < 0) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
+    File::DuplicateDirectoryDescriptor(d, duplicate);
     if (File::IsRandomDevice(d)) File::RememberRandomDevice(duplicate);
     File::ShareDescriptor(d, duplicate);
     DuplicateJitSharedMemory(d, duplicate);
@@ -820,8 +841,8 @@ int APS5_VABI dup2_nid_postfix(int from, int to) {
         if (from == to) return to;
         File::ForgetRandomDevice(to);
         File::ForgetArchivedFile(to);
-#ifdef _WIN32
         File::ForgetDirectoryDescriptor(to);
+#ifdef _WIN32
         File::ForgetFileLock(to);
 #endif
         return to;
@@ -833,8 +854,10 @@ int APS5_VABI dup2_nid_postfix(int from, int to) {
     if (from == to) return to;
     if (to == 1) PreserveHostStandardOutput();
     if (to == 2) PreserveHostStandardError();
+    auto positioned = File::LockPositionedTransfer(to);
     auto* const standard = HostStandardHandle_nid_no_patch(to);
-    const int duplicated = WithoutParameterHandler([from, to] { return ::_dup2(from, to); });
+    int duplicated = File::ReplaceSharedMemoryDescriptor_nid_no_patch(from, to);
+    if (duplicated == -2) duplicated = WithoutParameterHandler([from, to] { return ::_dup2(from, to); });
     KeepStandardHandle_nid_no_patch(to, standard);
     if (duplicated != 0) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
     EqueueDescriptorClosed(to);
@@ -843,7 +866,10 @@ int APS5_VABI dup2_nid_postfix(int from, int to) {
     File::DuplicateDirectoryDescriptor(from, to);
     File::ForgetFileLock(to);
     File::ForgetRandomDevice(to);
+    File::ForgetSharedMemoryDescriptor_nid_no_patch(to);
+    File::DuplicateSharedMemoryDescriptor_nid_no_patch(from, to);
     if (sourceIsRandom) File::RememberRandomDevice(to);
+    positioned.unlock();
     File::ShareDescriptor(from, to);
     DuplicateJitSharedMemory(from, to);
     return to;
@@ -856,6 +882,8 @@ int APS5_VABI dup2_nid_postfix(int from, int to) {
     if (to == 2) PreserveHostStandardError();
     const int result = ::dup2(from, to);
     if (result < 0) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
+    File::ForgetDirectoryDescriptor(to);
+    File::DuplicateDirectoryDescriptor(from, to);
     EqueueDescriptorClosed(to);
     GuestSockets::Forget(to);
     File::ForgetRandomDevice(to);
@@ -867,6 +895,7 @@ int APS5_VABI dup2_nid_postfix(int from, int to) {
 }
 
 int APS5_VABI flock_nid_postfix(int d, int operation) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return PosixFailure(GUEST_EISDIR);
     if (GuestSockets::IsOpen(d)) return PosixFailure(GUEST_EOPNOTSUPP);
     File::RefuseArchivedFile(d, "flock");
 #ifdef _WIN32
@@ -898,16 +927,14 @@ int APS5_VABI flock_nid_postfix(int d, int operation) {
 }
 
 int APS5_VABI _fstatfs_nid_postfix(int d, KernelStatfs* buf) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return PosixFailure(GUEST_EOPNOTSUPP);
     if (GuestSockets::IsOpen(d) || IsKqueueDescriptor(d)) return PosixFailure(GUEST_EINVAL);
     if (d < 0) return PosixFailure(GUEST_EBADF);
     File::RefuseArchivedFile(d, "fstatfs");
     KernelStatfs result{};
     result.f_version = KERNEL_STATFS_VERSION;
     if (const int error = NativeFstatfs(d, &result)) return PosixFailure(error);
-    if (buf == nullptr) return PosixFailure(GUEST_EFAULT);
-    const GuestArena::HostWrite destination(buf, sizeof(result));
-    if (!destination.Open()) return PosixFailure(GUEST_EFAULT);
-    std::memcpy(buf, &result, sizeof(result));
+    if (!GuestCopyOut_nid_no_patch(buf, &result, sizeof(result))) return PosixFailure(GUEST_EFAULT);
     return 0;
 }
 
@@ -917,11 +944,13 @@ int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int d, FileStat* sb) {
         if (fstat_nid_disambig1_nid_postfix(d, &ignored) != 0) return -1;
         return PosixFailure(GUEST_EFAULT);
     }
+    FileStat result{};
     if (GuestSockets::IsOpen(d)) {
-        if (const int error = GuestSockets::Stat(d, sb)) return PosixFailure(error);
-        return 0;
+        if (const int error = GuestSockets::Stat(d, &result)) return PosixFailure(error);
+    } else if (!File::FillFileStatFromDescriptor(d, &result)) {
+        return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
     }
-    if (!File::FillFileStatFromDescriptor(d, sb)) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
+    if (!GuestCopyOut_nid_no_patch(sb, &result, sizeof(result))) return PosixFailure(GUEST_EFAULT);
     return 0;
 }
 
@@ -930,6 +959,7 @@ int64_t APS5_VABI _fstat_nid_postfix(int d, FileStat* sb) {
 }
 
 int APS5_VABI ftruncate_nid_postfix(int d, int64_t length) {
+    if (File::IsDirectoryDescriptor(d)) return PosixFailure(GUEST_EINVAL);
     if (length < 0 || GuestSockets::IsOpen(d)) {
         return PosixFailure(GUEST_EINVAL);
     }
@@ -959,7 +989,9 @@ int64_t APS5_VABI lseek_nid_postfix(int d, int64_t offset, int whence) {
 }
 
 int APS5_VABI mkdir_nid_postfix(const char* path, uint16_t mode) {
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return PosixFailure(error);
     if (NativeMkdir(native, mode) != 0) {
@@ -976,7 +1008,9 @@ int APS5_VABI mkdir_nid_postfix(const char* path, uint16_t mode) {
 
 int APS5_VABI open_nid_postfix(const char* path, int flags, int mode) {
     if (File::InvalidOpenFlags(flags)) return PosixFailure(GUEST_EINVAL);
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     return PosixResult(sceKernelOpen(path, flags, static_cast<std::uint16_t>(mode)));
 }
 
@@ -1003,8 +1037,9 @@ int APS5_VABI _open_nid_postfix(const char* path, int flags, ...) {
 }
 
 int64_t APS5_VABI pread_nid_postfix(int d, void* buf, size_t nbytes, int64_t offset) {
+    if (File::IsDirectoryDescriptor(d)) return PosixFailure(GUEST_EISDIR);
     if (ExceedsTransferLimit(nbytes)) return PosixFailure(GUEST_EINVAL);
-    if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return PosixFailure(error);
+    if (const int error = PositionedArgumentError(d, false, buf == nullptr && nbytes != 0, offset)) return PosixFailure(error);
     if (FailPosixPositionedGuestSocket(d)) return -1;
     const GuestArena::HostWrite destination(buf, nbytes);
     if (!destination.Open()) return PosixFailure(GUEST_EFAULT);
@@ -1016,9 +1051,11 @@ int64_t APS5_VABI pread_nid_postfix(int d, void* buf, size_t nbytes, int64_t off
 }
 
 int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int d, const void* buf, size_t nbytes, int64_t offset) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return PosixFailure(GUEST_EISDIR);
     if (ExceedsTransferLimit(nbytes)) return PosixFailure(GUEST_EINVAL);
-    if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return PosixFailure(error);
+    if (const int error = PositionedArgumentError(d, true, buf == nullptr && nbytes != 0, offset)) return PosixFailure(error);
     if (FailPosixPositionedGuestSocket(d)) return -1;
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     char empty = 0;
     const auto result = NativePwrite(d, buf == nullptr ? &empty : buf, nbytes, offset);
@@ -1059,27 +1096,38 @@ std::int64_t APS5_VABI _write_nid_postfix(int descriptor, const void* buffer, st
 
 int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb) {
     if (sb == nullptr) return PosixFailure(GUEST_EFAULT);
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     return PosixResult(sceKernelStat(path, sb));
 }
 
 int APS5_VABI lstat_nid_postfix(const char* path, FileStat* sb) {
     if (sb == nullptr) return PosixFailure(GUEST_EFAULT);
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     std::filesystem::path native;
-    if (const int error = ResolvePathError_nid_no_patch(path, native)) return PosixFailure(error);
-    if (!File::FillLinkStat(native, sb)) return PosixResult(SceErrorFromErrno(errno == ENOENT ? NotFoundError_nid_no_patch(native) : errno));
+    if (const int error = ResolvePathError_nid_no_patch(path, native, true)) return PosixFailure(error);
+    FileStat result{};
+    if (!File::FillLinkStat(native, &result)) return PosixResult(SceErrorFromErrno(errno == ENOENT ? NotFoundError_nid_no_patch(native) : errno));
+    if (!GuestCopyOut_nid_no_patch(sb, &result, sizeof(result))) return PosixFailure(GUEST_EFAULT);
     return 0;
 }
 
 int APS5_VABI unlink_nid_postfix(const char* path) {
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     return PosixResult(sceKernelUnlink(path));
 }
 
 int APS5_VABI sceKernelCheckReachability(const char* path) {
     if (path == nullptr) return SCE_KERNEL_ERROR_EINVAL;
-    if (*path == '\0') return SCE_KERNEL_ERROR_ENOENT;
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceKernelError(error);
+    path = copy.c_str();
+    if (copy.empty()) return SCE_KERNEL_ERROR_ENOENT;
     if (std::strlen(path) > 255) return SCE_KERNEL_ERROR_ENAMETOOLONG;
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native, true, true)) return SceKernelError(error);
@@ -1094,15 +1142,19 @@ int APS5_VABI sceKernelFstat(int d, FileStat* sb) {
         if (const int error = sceKernelFstat(d, &ignored)) return error;
         return SceErrorFromErrno(GUEST_EFAULT);
     }
+    FileStat result{};
     if (GuestSockets::IsOpen(d)) {
-        const int error = GuestSockets::Stat(d, sb);
-        return error == 0 ? 0 : SceErrorFromErrno(error);
+        const int error = GuestSockets::Stat(d, &result);
+        if (error != 0) return SceErrorFromErrno(error);
+    } else if (!File::FillFileStatFromDescriptor(d, &result)) {
+        return SceErrorFromErrno(errno);
     }
-    if (!File::FillFileStatFromDescriptor(d, sb)) return SceErrorFromErrno(errno);
+    if (!GuestCopyOut_nid_no_patch(sb, &result, sizeof(result))) return SceErrorFromErrno(GUEST_EFAULT);
     return 0;
 }
 
 int APS5_VABI sceKernelFsync(int fd) {
+    if (File::IsVirtualDirectoryDescriptor(fd)) return SceErrorFromErrno(GUEST_EISDIR);
     if (GuestSockets::IsOpen(fd)) return SceErrorFromErrno(GUEST_EINVAL);
     File::RefuseArchivedFile(fd, "fsync");
 #ifdef _WIN32
@@ -1114,6 +1166,7 @@ int APS5_VABI sceKernelFsync(int fd) {
 }
 
 int APS5_VABI sceKernelFdatasync(int fd) {
+    if (File::IsVirtualDirectoryDescriptor(fd)) return SceErrorFromErrno(GUEST_EISDIR);
     if (GuestSockets::IsOpen(fd)) return SceErrorFromErrno(GUEST_EINVAL);
     File::RefuseArchivedFile(fd, "fdatasync");
 #ifdef _WIN32
@@ -1192,12 +1245,15 @@ int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* bas
     constexpr std::size_t GuestMaxName = 255;
     if (buf == nullptr) return SceErrorFromErrno(GUEST_EFAULT);
     if (nbytes <= 0) return SceErrorFromErrno(GUEST_EINVAL);
-    struct stat status{};
-    if (::fstat(fd, &status) != 0) return SceErrorFromErrno(errno);
-    if (!S_ISDIR(status.st_mode)) return SceErrorFromErrno(GUEST_EINVAL);
     const GuestArena::HostWrite destination(buf, static_cast<std::size_t>(nbytes));
     const GuestArena::HostWrite baseDestination(basep, basep == nullptr ? 0 : sizeof(*basep));
     if (!destination.Open() || !baseDestination.Open()) return SceErrorFromErrno(GUEST_EFAULT);
+    if (File::IsDirectoryDescriptor(fd)) {
+        return File::ReadDirectoryDescriptor(fd, buf, nbytes, basep);
+    }
+    struct stat status{};
+    if (::fstat(fd, &status) != 0) return SceErrorFromErrno(errno);
+    if (!S_ISDIR(status.st_mode)) return SceErrorFromErrno(GUEST_EINVAL);
     const off_t base = ::lseek(fd, 0, SEEK_CUR);
     if (base < 0) return SceErrorFromErrno(errno);
     if (basep != nullptr) *basep = static_cast<int64_t>(base);
@@ -1254,8 +1310,10 @@ int APS5_VABI getdents_nid_postfix(int fd, char* buf, int nbytes) {
 
 int APS5_VABI sceKernelMkdir(const char* path, uint16_t mode) {
     (void)mode;
-    if (!path) return SceErrorFromErrno(GUEST_EFAULT);
-    if (!*path) return SceErrorFromErrno(GUEST_ENOENT);
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceErrorFromErrno(error);
+    path = copy.c_str();
+    if (copy.empty()) return SceErrorFromErrno(GUEST_ENOENT);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
     while (!native.has_filename() && native.has_relative_path()) native = native.parent_path();
@@ -1297,6 +1355,11 @@ static int CopyIovecs(const KernelIovec* iov, int iovcnt, std::vector<KernelIove
 #else
     throw std::runtime_error("iovec: checked guest copies are not implemented on this host");
 #endif
+    std::size_t total = 0;
+    for (const auto& vector : vectors) {
+        if (vector.length > static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max()) - total) return SceErrorFromErrno(GUEST_EINVAL);
+        total += vector.length;
+    }
     return 0;
 }
 
@@ -1323,7 +1386,8 @@ static void PrepareWriteIovecs(const KernelIovec* iov, int iovcnt) {
 #ifdef _WIN32
 
 int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset) {
-    if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
+    if (File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
+    if (const int error = PositionedArgumentError(d, false, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
     const GuestArena::HostWrite destination(buf, nbytes);
     if (!destination.Open()) return SceErrorFromErrno(GUEST_EFAULT);
@@ -1335,8 +1399,10 @@ int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset
 }
 
 int64_t APS5_VABI sceKernelPwrite(int d, const void* buf, size_t nbytes, int64_t offset) {
-    if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
+    if (const int error = PositionedArgumentError(d, true, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     char empty = 0;
     const auto result = NativePwrite(d, nbytes == 0 && buf == nullptr ? &empty : buf, nbytes, offset);
@@ -1344,14 +1410,16 @@ int64_t APS5_VABI sceKernelPwrite(int d, const void* buf, size_t nbytes, int64_t
 }
 
 static std::int64_t TransferIovecs(int d, const KernelIovec* guestIov, int iovcnt, const std::int64_t* offset, bool write) {
+    if (write ? File::IsVirtualDirectoryDescriptor(d) : File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     std::vector<KernelIovec> vectors;
     if (const int error = CopyIovecs(guestIov, iovcnt, vectors)) return error;
     const auto* iov = vectors.data();
-    if (offset != nullptr && *offset < 0) return SceErrorFromErrno(GUEST_EINVAL);
+    if (offset != nullptr) {
+        if (const int error = PositionedArgumentError(d, write, false, *offset)) return SceErrorFromErrno(error);
+    }
     std::size_t total = 0;
     for (int i = 0; i < iovcnt; ++i) {
         if (iov[i].base == nullptr && iov[i].length != 0) return SceErrorFromErrno(GUEST_EFAULT);
-        if (iov[i].length > static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max()) - total) return SceErrorFromErrno(GUEST_EINVAL);
         total += iov[i].length;
     }
     if (offset != nullptr && total > static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max() - *offset)) return SceErrorFromErrno(GUEST_EINVAL);
@@ -1365,6 +1433,7 @@ static std::int64_t TransferIovecs(int d, const KernelIovec* guestIov, int iovcn
                                   : GuestSockets::Readv(d, reinterpret_cast<const GuestSockets::Iovec*>(iov), iovcnt);
         return result < 0 ? SceKernelError(*__error_nid_postfix()) : result;
     }
+    const File::WriteSync sync(write ? d : -1);
     if (write) PrepareWriteIovecs(iov, iovcnt);
     if (!write && File::IsRandomDevice(d)) return ReadRandomIovecs(d, iov, iovcnt);
     if (!write) {
@@ -1405,25 +1474,30 @@ static std::int64_t TransferIovecs(int d, const KernelIovec* guestIov, int iovcn
 }
 
 int64_t APS5_VABI sceKernelReadv(int d, const KernelIovec* iov, int iovcnt) {
+    if (File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     return TransferIovecs(d, iov, iovcnt, nullptr, false);
 }
 
 int64_t APS5_VABI sceKernelWritev(int d, const KernelIovec* iov, int iovcnt) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     return TransferIovecs(d, iov, iovcnt, nullptr, true);
 }
 
 int64_t APS5_VABI sceKernelPreadv(int d, const KernelIovec* iov, int iovcnt, int64_t offset) {
+    if (File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     return TransferIovecs(d, iov, iovcnt, &offset, false);
 }
 
 int64_t APS5_VABI sceKernelPwritev(int d, const KernelIovec* iov, int iovcnt, int64_t offset) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     return TransferIovecs(d, iov, iovcnt, &offset, true);
 }
 
 #else
 
 int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset) {
-    if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
+    if (File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
+    if (const int error = PositionedArgumentError(d, false, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
     const GuestArena::HostWrite destination(buf, nbytes);
     if (!destination.Open()) return SceErrorFromErrno(GUEST_EFAULT);
@@ -1434,14 +1508,17 @@ int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset
 }
 
 int64_t APS5_VABI sceKernelPwrite(int d, const void* buf, size_t nbytes, int64_t offset) {
-    if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
+    if (const int error = PositionedArgumentError(d, true, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     const auto result = NativePwrite(d, buf, nbytes, offset);
     return result < 0 ? SceErrorFromErrno(errno) : result;
 }
 
 int64_t APS5_VABI sceKernelReadv(int d, const KernelIovec* guestIov, int iovcnt) {
+    if (File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     std::vector<KernelIovec> vectors;
     if (const int error = CopyIovecs(guestIov, iovcnt, vectors)) return error;
     const auto* iov = vectors.data();
@@ -1458,6 +1535,7 @@ int64_t APS5_VABI sceKernelReadv(int d, const KernelIovec* guestIov, int iovcnt)
 }
 
 int64_t APS5_VABI sceKernelWritev(int d, const KernelIovec* guestIov, int iovcnt) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     std::vector<KernelIovec> vectors;
     if (const int error = CopyIovecs(guestIov, iovcnt, vectors)) return error;
     const auto* iov = vectors.data();
@@ -1465,6 +1543,7 @@ int64_t APS5_VABI sceKernelWritev(int d, const KernelIovec* guestIov, int iovcnt
         const auto result = GuestSockets::Writev(d, reinterpret_cast<const GuestSockets::Iovec*>(iov), iovcnt);
         return result < 0 ? SceKernelError(*__error_nid_postfix()) : result;
     }
+    const File::WriteSync sync(d);
     PrepareWriteIovecs(iov, iovcnt);
     const auto sharedResult = File::WritevSharedMemory_nid_no_patch(d, NativeIovecs(iov), iovcnt);
     if (sharedResult != -2) return sharedResult < 0 ? SceErrorFromErrno(errno) : sharedResult;
@@ -1473,10 +1552,11 @@ int64_t APS5_VABI sceKernelWritev(int d, const KernelIovec* guestIov, int iovcnt
 }
 
 int64_t APS5_VABI sceKernelPreadv(int d, const KernelIovec* guestIov, int iovcnt, int64_t offset) {
+    if (File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     std::vector<KernelIovec> vectors;
     if (const int error = CopyIovecs(guestIov, iovcnt, vectors)) return error;
     const auto* iov = vectors.data();
-    if (offset < 0) return SceErrorFromErrno(GUEST_EINVAL);
+    if (const int error = PositionedArgumentError(d, false, false, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
     std::deque<GuestArena::HostWrite> destinations;
     if (!OpenIovecs(iov, iovcnt, destinations)) return SceErrorFromErrno(GUEST_EFAULT);
@@ -1487,11 +1567,13 @@ int64_t APS5_VABI sceKernelPreadv(int d, const KernelIovec* guestIov, int iovcnt
 }
 
 int64_t APS5_VABI sceKernelPwritev(int d, const KernelIovec* guestIov, int iovcnt, int64_t offset) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     std::vector<KernelIovec> vectors;
     if (const int error = CopyIovecs(guestIov, iovcnt, vectors)) return error;
     const auto* iov = vectors.data();
-    if (offset < 0) return SceErrorFromErrno(GUEST_EINVAL);
+    if (const int error = PositionedArgumentError(d, true, false, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
+    const File::WriteSync sync(d);
     PrepareWriteIovecs(iov, iovcnt);
     const auto sharedResult = File::PwritevSharedMemory_nid_no_patch(d, NativeIovecs(iov), iovcnt, offset);
     if (sharedResult != -2) return sharedResult < 0 ? SceErrorFromErrno(errno) : sharedResult;
@@ -1515,13 +1597,13 @@ int APS5_VABI sceKernelRename(const char* from, const char* to) {
     if (!from) return SceErrorFromErrno(GUEST_EFAULT);
     const int result = RenameGuestPath_nid_no_patch(from, to);
     return result == 0 ? 0 : SceKernelError(errno);
-    if (const int dot = RenameDotError_nid_no_patch(from)) return SceKernelError(dot);
-    if (const int dot = RenameDotError_nid_no_patch(to)) return SceKernelError(dot);
 }
 
 int APS5_VABI sceKernelRmdir(const char* path) {
-    if (!path) return SceErrorFromErrno(GUEST_EFAULT);
-    if (*path == '\0') return SceErrorFromErrno(GUEST_ENOENT);
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceErrorFromErrno(error);
+    path = copy.c_str();
+    if (copy.empty()) return SceErrorFromErrno(GUEST_ENOENT);
     if (const int dot = RenameDotError_nid_no_patch(path)) return SceKernelError(dot);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
@@ -1542,7 +1624,9 @@ int APS5_VABI sceKernelRmdir(const char* path) {
 }
 
 int APS5_VABI rmdir_nid_postfix(const char* path) {
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     return PosixResult(sceKernelRmdir(path));
 }
 
@@ -1551,8 +1635,10 @@ int APS5_VABI rmdir_nid_postfix(const char* path) {
 extern "C" {
 
 int APS5_VABI sceKernelChmod_nid_postfix(const char* path, std::uint16_t mode) {
-    if (!path) return SceErrorFromErrno(GUEST_EFAULT);
-    if (!*path) return SceErrorFromErrno(GUEST_ENOENT);
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceErrorFromErrno(error);
+    path = copy.c_str();
+    if (copy.empty()) return SceErrorFromErrno(GUEST_ENOENT);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
     if (NativeChmod(native, mode & 07777) != 0) return SceErrorFromErrno(errno);
@@ -1560,8 +1646,14 @@ int APS5_VABI sceKernelChmod_nid_postfix(const char* path, std::uint16_t mode) {
 }
 
 int APS5_VABI sceKernelFchmod(int d, std::uint16_t mode) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     if (GuestSockets::IsOpen(d)) return SceErrorFromErrno(GUEST_EINVAL);
+    if (IsPipeDescriptor(d)) return SceErrorFromErrno(GUEST_EINVAL);
     File::RefuseArchivedFile(d, "fchmod");
+#ifdef _WIN32
+    const int sharedMemoryResult = File::SetSharedMemoryMode_nid_no_patch(d, mode);
+    if (sharedMemoryResult != -2) return sharedMemoryResult == 0 ? 0 : SceErrorFromErrno(errno);
+#endif
     if (NativeFchmod(d, mode & 07777) != 0) return SceErrorFromErrno(errno);
     return 0;
 }
@@ -1576,8 +1668,10 @@ static bool InvalidTimes(const KernelTimeval* times) {
 
 int APS5_VABI sceKernelTruncate_nid_postfix(const char* path, std::int64_t length) {
     if (length < 0) return SceErrorFromErrno(GUEST_EINVAL);
-    if (!path) return SceErrorFromErrno(GUEST_EFAULT);
-    if (*path == '\0') return SceErrorFromErrno(GUEST_ENOENT);
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceErrorFromErrno(error);
+    path = copy.c_str();
+    if (copy.empty()) return SceErrorFromErrno(GUEST_ENOENT);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
     std::error_code error;
@@ -1597,14 +1691,18 @@ int APS5_VABI sceKernelTruncate_nid_postfix(const char* path, std::int64_t lengt
 
 int APS5_VABI truncate_nid_postfix(const char* path, std::int64_t length) {
     if (length < 0) return PosixFailure(GUEST_EINVAL);
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     return PosixResult(sceKernelTruncate_nid_postfix(path, length));
 }
 
 int APS5_VABI sceKernelUtimes_nid_postfix(const char* path, const KernelTimeval* times) {
     if (InvalidTimes(times)) return SCE_KERNEL_ERROR_EINVAL;
-    if (!path) return SceErrorFromErrno(GUEST_EFAULT);
-    if (*path == '\0') return SceErrorFromErrno(GUEST_ENOENT);
+    std::string copy;
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return SceErrorFromErrno(error);
+    path = copy.c_str();
+    if (copy.empty()) return SceErrorFromErrno(GUEST_ENOENT);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
     if (NativeUtimes(native, times) != 0) return SceErrorFromErrno(errno == ENOENT ? NotFoundError_nid_no_patch(native) : errno);
@@ -1613,13 +1711,17 @@ int APS5_VABI sceKernelUtimes_nid_postfix(const char* path, const KernelTimeval*
 
 int APS5_VABI utimes_nid_postfix(const char* path, const KernelTimeval* times) {
     if (InvalidTimes(times)) return PosixFailure(GUEST_EINVAL);
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     return PosixResult(sceKernelUtimes_nid_postfix(path, times));
 }
 
 int APS5_VABI lutimes_nid_postfix(const char* path, const KernelTimeval* times) {
     if (InvalidTimes(times)) return PosixFailure(GUEST_EINVAL);
-    if (const int error = PathError(path)) return PosixFailure(error);
+    std::string copy;
+    if (const int error = PathError(path, copy)) return PosixFailure(error);
+    path = copy.c_str();
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return PosixFailure(error);
     if (NativeUtimes(native, times, false) != 0) return PosixResult(SceErrorFromErrno(errno));
@@ -1627,6 +1729,7 @@ int APS5_VABI lutimes_nid_postfix(const char* path, const KernelTimeval* times)
 }
 
 int APS5_VABI sceKernelFutimes(int d, const KernelTimeval* times) {
+    if (File::IsVirtualDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
     if (GuestSockets::IsOpen(d)) return SceErrorFromErrno(GUEST_EINVAL);
     File::RefuseArchivedFile(d, "futimes");
     if (times != nullptr) {
diff --git a/core/libs/prx/libkernel/File/src/Terminal.cpp b/core/libs/prx/libkernel/File/src/Terminal.cpp
index 25f8a85526..d8220e00bb 100644
--- a/core/libs/prx/libkernel/File/src/Terminal.cpp
+++ b/core/libs/prx/libkernel/File/src/Terminal.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Socket/include/SocketRuntime.hpp"
 #include <cstddef>
@@ -13,7 +15,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
 #ifdef _WIN32
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 #endif
diff --git a/core/libs/prx/libkernel/KernelErrors.hpp b/core/libs/prx/libkernel/KernelErrors.hpp
index b7d37ba4f2..e3e5b759fd 100644
--- a/core/libs/prx/libkernel/KernelErrors.hpp
+++ b/core/libs/prx/libkernel/KernelErrors.hpp
@@ -99,5 +99,7 @@ inline constexpr int SCE_KERNEL_ERROR_ENOLINK = SceKernelError(91);
 inline constexpr int SCE_KERNEL_ERROR_EPROTO = SceKernelError(92);
 inline constexpr int SCE_KERNEL_ERROR_ENOTCAPABLE = SceKernelError(93);
 inline constexpr int SCE_KERNEL_ERROR_ECAPMODE = SceKernelError(94);
+inline constexpr int SCE_KERNEL_ERROR_ENOTRECOVERABLE = SceKernelError(95);
+inline constexpr int SCE_KERNEL_ERROR_EOWNERDEAD = SceKernelError(96);
 
 #endif
diff --git a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp
index 29765cb8e6..b9feacb7d1 100644
--- a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp
+++ b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libkernel/Module/ModuleArgs.hpp"
@@ -24,6 +25,9 @@
 #else
 #include <dlfcn.h>
 #include <link.h>
+#ifdef __linux__
+#include <unistd.h>
+#endif
 #endif
 
 #ifdef _WIN32
@@ -137,6 +141,56 @@ char* APS5_VABI dlerror_nid_postfix() {
     pendingError = false;
     return loaderError.data();
 }
+#ifdef __linux__
+static void InitializeLinuxGuestModule(void* native) {
+    auto* table = static_cast<std::uint64_t*>(::dlsym(native, "__aps5_guest_lifecycle_nid_no_patch"));
+    if (!table) return;
+    link_map* requested = nullptr;
+    link_map* owner = nullptr;
+    Dl_info info{};
+    if (::dlinfo(native, RTLD_DI_LINKMAP, &requested) != 0 || requested == nullptr ||
+        !::dladdr1(table, &info, reinterpret_cast<void**>(&owner), RTLD_DL_LINKMAP) || owner == nullptr)
+        throw std::runtime_error("dlopen: cannot identify guest lifecycle metadata owner");
+    if (owner != requested) return;
+    if (table[0] != 0x415053354c494658ull) throw std::runtime_error("dlopen: unsupported guest lifecycle metadata");
+    using Entry = int (APS5_VABI *)(std::size_t, const void*, void*);
+    using Initializer = void (APS5_VABI *)(int, char**, char**);
+    static std::mutex initializedLock;
+    static std::condition_variable initializedChanged;
+    const auto thread = static_cast<std::uint64_t>(::gettid());
+    std::unique_lock lock(initializedLock);
+    while (table[6] == 1) {
+        if (table[7] == thread) return;
+        initializedChanged.wait(lock);
+    }
+    if (table[6] == 2) return;
+    if (table[6] != 0) throw std::runtime_error("dlopen: deferred guest initialization failed or finalized");
+    table[6] = 1;
+    table[7] = thread;
+    lock.unlock();
+    try {
+        const auto pending = *static_cast<const PendingModuleArgs*>(__aps5_get_pending_module_args_nid_no_patch());
+        const int result = table[2] == 0 ? 0 : reinterpret_cast<Entry>(table[2])(pending.args, pending.argp, nullptr);
+        for (std::uint64_t index = 0; index < table[4]; ++index) {
+            const auto initializer = *reinterpret_cast<Initializer*>(table[8 + index]);
+            if (initializer) initializer(0, nullptr, nullptr);
+        }
+        __aps5_set_module_init_result_nid_no_patch(result);
+        lock.lock();
+        table[6] = 2;
+        table[7] = 0;
+        lock.unlock();
+        initializedChanged.notify_all();
+    } catch (...) {
+        lock.lock();
+        table[6] = 3;
+        table[7] = 0;
+        lock.unlock();
+        initializedChanged.notify_all();
+        throw;
+    }
+}
+#endif
 #ifdef _WIN32
 static void InitializeDeferredModule(HMODULE native) {
     using Entry = int (APS5_VABI *)(std::size_t, const void*, void*);
@@ -228,6 +282,9 @@ void* APS5_VABI dlopen_nid_postfix(const char* path, int flags) {
             if (path) LoadFailure(source, resolved, ::dlerror()); else Error(::dlerror());
             return nullptr;
         }
+#ifdef __linux__
+        if (path) InitializeLinuxGuestModule(module->native);
+#endif
 #endif
         std::lock_guard lock(modulesMutex);
         const auto handle = nextHandle++;
diff --git a/core/libs/prx/libkernel/Module/src/Module.cpp b/core/libs/prx/libkernel/Module/src/Module.cpp
index 9e71a3183c..9a9b712fcc 100644
--- a/core/libs/prx/libkernel/Module/src/Module.cpp
+++ b/core/libs/prx/libkernel/Module/src/Module.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -111,7 +112,6 @@ extern "C" void ForgetUnloadedUnwindImages_nid_no_patch() {
   for (const auto base : unloaded) UnwindImages().erase(base);
 }
 #elif !defined(__APPLE__)
-extern "C" int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
 
 namespace {
 struct ImageSearch {
@@ -142,7 +142,7 @@ bool IsRelinkedImage(std::uint64_t address) {
 void FillGuestUnwindInfo(std::uint64_t address, ModuleInfoForUnwind* info) {
   ModuleInfoEx module{};
   module.st_size = sizeof(ModuleInfoEx);
-  if (sceKernelGetModuleInfoFromAddr(address, 2, &module) != 0)
+  if (sceKernelGetModuleInfoFromAddr(address, 1, &module) != 0)
     throw std::runtime_error("sceKernelGetModuleInfoForUnwind: failed to query guest module information");
   info->eh_frame_hdr_addr = module.eh_frame_hdr_addr;
   info->eh_frame_addr = module.eh_frame_addr;
@@ -151,13 +151,6 @@ void FillGuestUnwindInfo(std::uint64_t address, ModuleInfoForUnwind* info) {
 }
 #endif
 
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
-void* APS5_VABI dlsym_nid_postfix(void* handle, const char* name);
-int APS5_VABI dlclose_nid_postfix(void* handle);
-const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-}
-
 namespace {
 constexpr int kRtldNow = 2;
 
diff --git a/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp b/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
index c240b13f9d..2df8293175 100644
--- a/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
+++ b/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -394,22 +395,32 @@ int FillModuleList(KernelModule* handles, std::size_t count, std::size_t* actual
 extern "C" {
 
 int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info) {
+    if (flags != 1 && flags != 2) {
+        if (!info) throw std::invalid_argument("sceKernelGetModuleInfoFromAddr: null info with flags " + std::to_string(flags));
+        *info = {};
+        return SCE_KERNEL_ERROR_EINVAL;
+    }
     if (!info) return SCE_KERNEL_ERROR_EFAULT;
-    if (flags != 2) throw std::invalid_argument("sceKernelGetModuleInfoFromAddr: unsupported flags " + std::to_string(flags));
     ModuleInfoEx result{};
-    result.st_size = sizeof(ModuleInfoEx);
 #ifdef _WIN32
-    if (!Fill(static_cast<std::uintptr_t>(address), result)) return SCE_KERNEL_ERROR_ESRCH;
+    MEMORY_BASIC_INFORMATION memory{};
+    const bool found = Fill(static_cast<std::uintptr_t>(address), result) &&
+        VirtualQuery(reinterpret_cast<LPCVOID>(address), &memory, sizeof(memory)) == sizeof(memory);
+    const GuestImage image{nullptr, found ? reinterpret_cast<std::uintptr_t>(memory.AllocationBase) : 0};
 #else
     Dl_info symbol{};
     link_map* native = nullptr;
-    if (!dladdr1(reinterpret_cast<const void*>(address), &symbol, reinterpret_cast<void**>(&native), RTLD_DL_LINKMAP) || !native)
-        return SCE_KERNEL_ERROR_ESRCH;
     ImageSearch<ModuleInfoEx> search{static_cast<std::uintptr_t>(address), &result, false};
-    dl_iterate_phdr(FindImage<ModuleInfoEx>, &search);
-    if (!search.found) return SCE_KERNEL_ERROR_ESRCH;
-    result.id = ModuleIdForImage_nid_no_patch(native);
+    if (dladdr1(reinterpret_cast<const void*>(address), &symbol, reinterpret_cast<void**>(&native), RTLD_DL_LINKMAP) && native)
+        dl_iterate_phdr(FindImage<ModuleInfoEx>, &search);
+    const bool found = search.found;
+    if (found) result.id = ModuleIdForImage_nid_no_patch(native);
+    const GuestImage image{native, 0};
 #endif
+    if (!found || (flags == 2 && SystemImage(image))) {
+        *info = {};
+        return SCE_KERNEL_ERROR_ESRCH;
+    }
     *info = result;
     return 0;
 }
diff --git a/core/libs/prx/libkernel/Module/src/Tls.cpp b/core/libs/prx/libkernel/Module/src/Tls.cpp
new file mode 100644
index 0000000000..bc3f81240f
--- /dev/null
+++ b/core/libs/prx/libkernel/Module/src/Tls.cpp
@@ -0,0 +1,44 @@
+#include <cstdint>
+#include <cstddef>
+#include <stdexcept>
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+
+namespace {
+
+#ifdef _WIN32
+constexpr std::size_t ThreadLocalStoragePointerOffset = 0x58;
+#endif
+
+}
+
+#if defined(__linux__)
+extern "C" void* __tls_get_addr(void* index);
+#endif
+
+extern "C" {
+
+void* APS5_VABI __tls_get_addr_nid_postfix(const KernelTlsIndex* index) {
+    if (index == nullptr || index->module == 0) throw std::invalid_argument("__tls_get_addr: null TLS index or module");
+#if defined(_WIN32)
+    const auto slot = *reinterpret_cast<const DWORD*>(static_cast<std::uintptr_t>(index->module));
+    auto* blocks = *reinterpret_cast<char***>(reinterpret_cast<char*>(NtCurrentTeb()) + ThreadLocalStoragePointerOffset);
+    if (blocks == nullptr || blocks[slot] == nullptr) throw std::logic_error("__tls_get_addr: thread has no TLS block for the module");
+    return blocks[slot] + index->offset;
+#elif defined(__linux__)
+    KernelTlsIndex host = *index;
+    return __tls_get_addr(&host);
+#else
+    NotImplemented_nid_no_patch("__tls_get_addr on this host");
+    return nullptr;
+#endif
+}
+
+}
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp b/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp
index 2becc20064..1f49be53c4 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Pthread/include/Atfork.hpp"
 #include "../include/Atfork.hpp"
 #include <mutex>
 #include <new>
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp b/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp
index 86fd01c134..1dae3e0f74 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <stdexcept>
@@ -7,16 +8,6 @@
 #include "../include/Pthread.hpp"
 #include "Common.hpp"
 
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stacksize);
-int APS5_VABI scePthreadAttrSetstack(PthreadAttr* attr, void* addr, std::size_t size);
-int APS5_VABI scePthreadAttrSetsolosched(PthreadAttr* attr, int solosched);
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-int APS5_VABI sched_get_priority_min_nid_postfix(int policy);
-}
-
 static constexpr int GuestSchedFifo = 1;
 static constexpr int GuestSchedRr = 3;
 
@@ -33,12 +24,15 @@ int APS5_VABI pthread_attr_destroy_nid_postfix(PthreadAttr* attr) {
 
 int APS5_VABI pthread_attr_get_np_nid_postfix(Pthread thread, PthreadAttr* attr) {
     if (!thread || !Valid(attr)) return PosixThread::GUEST_EINVAL;
+    const auto live = LockLiveGuestThread(thread);
+    if (!live) return PosixThread::GUEST_ESRCH;
     auto* p = *attr;
     p->_stacksize = thread->stackSize;
     p->stackAddress = thread->stackAddress;
     p->_detachstate = thread->_detached ? 1 : 0;
     p->_schedpriority = thread->priority.load(std::memory_order_relaxed);
     p->_schedpolicy = thread->schedPolicy.load(std::memory_order_relaxed);
+    p->_createSuspended = thread->createdSuspended;
     p->_affinity = thread->affinity.load(std::memory_order_relaxed);
     p->_affinityExplicit = true;
     p->_scope = thread->scope;
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp b/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp
index 4f4c7884db..9d98ca6274 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <climits>
 #include <condition_variable>
@@ -7,25 +8,12 @@
 #include <stdexcept>
 #include <string>
 
-struct PthreadBarrierPrivate {
-    std::mutex mutex;
-    std::condition_variable changed;
-    unsigned count;
-    unsigned arrived = 0;
-    unsigned active = 0;
-    std::uint64_t generation = 0;
-};
-
 namespace {
 
 constexpr int PROCESS_PRIVATE = 0;
 
 }
 
-struct PthreadBarrierattrPrivate {
-    int pshared = PROCESS_PRIVATE;
-};
-
 extern "C" {
 
 int APS5_VABI pthread_barrierattr_init_nid_postfix(PthreadBarrierattrPrivate** attr) {
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Common.hpp b/core/libs/prx/libkernel/Pthread/Posix/Common.hpp
index b89859ae7e..e16aa453c6 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Common.hpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Common.hpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Time/include/Time.hpp"
 #ifndef CORE_LIBS_PRX_LIBKERNEL_PTHREAD_POSIX_COMMON_HPP
 #define CORE_LIBS_PRX_LIBKERNEL_PTHREAD_POSIX_COMMON_HPP
 
@@ -6,8 +7,6 @@
 #include <limits>
 #include "SceTypes.hpp"
 
-extern "C" int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-
 namespace PosixThread {
 
 constexpr int GUEST_ESRCH = 3;
@@ -20,11 +19,16 @@ inline int ToErrno(int sceResult) {
     return sceResult == 0 ? 0 : static_cast<int>(static_cast<std::uint32_t>(sceResult) & 0xFFFFu);
 }
 
+inline int ToSce(int error) {
+    return error == 0 ? 0 : static_cast<int>(0x80020000u | static_cast<std::uint32_t>(error));
+}
+
 // Converts an absolute deadline on the guest clock into a relative wait, clamped to what the sce layer accepts.
 inline bool RelativeMicroseconds(int clockId, const KernelTimespec* abstime, KernelUseconds* usec) {
     if (!abstime || abstime->tv_nsec < 0 || abstime->tv_nsec >= 1000000000) return false;
     KernelTimespec now{};
     clock_gettime_nid_postfix(clockId, &now);
+
     constexpr auto maximum = std::numeric_limits<KernelUseconds>::max();
     if (abstime->tv_sec < now.tv_sec - 1) {
         *usec = 0;
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp b/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp
index f357cac53a..2476e63b2e 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "Common.hpp"
@@ -51,6 +52,10 @@ int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mut
     return toPosix(scePthreadCondWait(cond, mutex));
 }
 
+int APS5_VABI pthread_cond_setname_np_nid_postfix(PthreadCond* cond, const char* name) {
+    return toPosix(CondOperations::SetName(cond, name));
+}
+
 int APS5_VABI pthread_condattr_destroy_nid_postfix(PthreadCondattr* attr) {
     if (!attr || !*attr) return PosixThread::GUEST_EINVAL;
     return toPosix(scePthreadCondattrDestroy(attr));
@@ -80,4 +85,16 @@ int APS5_VABI pthread_condattr_getpshared_nid_postfix(const PthreadCondattr* att
     return 0;
 }
 
+int APS5_VABI pthread_cond_signalto_np_nid_postfix(PthreadCond* cond, Pthread thread) {
+    return toPosix(scePthreadCondSignalto(cond, thread));
+}
+
+int APS5_VABI scePthreadCondattrSetpshared(PthreadCondattr* attr, int pshared) {
+    return PosixThread::ToSce(pthread_condattr_setpshared_nid_postfix(attr, pshared));
+}
+
+int APS5_VABI scePthreadCondattrGetpshared(const PthreadCondattr* attr, int* pshared) {
+    return PosixThread::ToSce(pthread_condattr_getpshared_nid_postfix(attr, pshared));
+}
+
 }
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp b/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp
index 346b447bb8..6f41a86fde 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -38,8 +40,6 @@ void _initializeStatic(PthreadMutex* mutex, const char* funcName) {
 
 extern "C" {
 
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-
 int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex) {
     if (!mutex) throw std::runtime_error("pthread_mutex_destroy: null mutex");
     if (_isStaticInitializer(*mutex)) {
@@ -169,4 +169,51 @@ int APS5_VABI pthread_mutexattr_gettype_nid_postfix(const PthreadMutexattr* attr
     return 0;
 }
 
+int APS5_VABI pthread_mutexattr_setkind_np_nid_postfix(PthreadMutexattr* attr, int kind) {
+    if (!attr || !*attr) {
+        *__error_nid_postfix() = POSIX_EINVAL;
+        return -1;
+    }
+    if (kind < static_cast<int>(MutexType::ErrorCheck) || kind > static_cast<int>(MutexType::Adaptive))
+        throw std::runtime_error("pthread_mutexattr_setkind_np: kind " + std::to_string(kind) + " is not a mutex type, and pthread_mutex_init does not reject it with EINVAL");
+    (*attr)->type = static_cast<MutexType>(kind);
+    return 0;
+}
+
+int APS5_VABI pthread_mutexattr_getkind_np_nid_postfix(PthreadMutexattr attr) {
+    if (!attr) {
+        *__error_nid_postfix() = POSIX_EINVAL;
+        return -1;
+    }
+    return static_cast<int>(attr->type);
+}
+
+int APS5_VABI scePthreadMutexattrGettype(const PthreadMutexattr* attr, int* type) {
+    return PosixThread::ToSce(pthread_mutexattr_gettype_nid_postfix(attr, type));
+}
+
+int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol) {
+    return PosixThread::ToSce(pthread_mutexattr_setprotocol_nid_postfix(attr, protocol));
+}
+
+int APS5_VABI scePthreadMutexattrGetprotocol(const PthreadMutexattr* attr, int* protocol) {
+    return PosixThread::ToSce(pthread_mutexattr_getprotocol_nid_postfix(attr, protocol));
+}
+
+int APS5_VABI scePthreadMutexattrSetprioceiling(PthreadMutexattr* attr, int prioceiling) {
+    return PosixThread::ToSce(pthread_mutexattr_setprioceiling_nid_postfix(attr, prioceiling));
+}
+
+int APS5_VABI scePthreadMutexattrGetprioceiling(const PthreadMutexattr* attr, int* prioceiling) {
+    return PosixThread::ToSce(pthread_mutexattr_getprioceiling_nid_postfix(attr, prioceiling));
+}
+
+int APS5_VABI scePthreadMutexattrSetpshared(PthreadMutexattr* attr, int pshared) {
+    return PosixThread::ToSce(pthread_mutexattr_setpshared_nid_postfix(attr, pshared));
+}
+
+int APS5_VABI scePthreadMutexattrGetpshared(const PthreadMutexattr* attr, int* pshared) {
+    return PosixThread::ToSce(pthread_mutexattr_getpshared_nid_postfix(attr, pshared));
+}
+
 }
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Once.cpp b/core/libs/prx/libkernel/Pthread/Posix/Once.cpp
index 6919e008be..220e54a0a1 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Once.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Once.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Pthread/include/Cancel.hpp"
@@ -8,10 +9,7 @@
 
 namespace {
 // FreeBSD guest ABI: PTHREAD_ONCE_INIT is {0, nullptr}; completed state is 1.
-struct GuestOnce {
-    std::int32_t state;
-    void* mutex;
-};
+
 static_assert(offsetof(GuestOnce, mutex) == 8 && sizeof(GuestOnce) == 16);
 std::mutex onceMutex;
 std::condition_variable onceChanged;
@@ -39,6 +37,7 @@ extern "C" int APS5_VABI pthread_once_nid_postfix(
     CleanupHandler reset{};
     void* const mark = ThreadCancel::CleanupMark();
     __pthread_cleanup_push_imp_nid_postfix(ResetOnce, control, &reset);
+
     try {
         initialize();
     } catch (...) {
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp b/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp
index 203af9f0f4..86039d56d1 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -13,6 +14,8 @@ namespace {
 
 constexpr int GUEST_REALTIME_CLOCK = 0;
 constexpr int PROCESS_PRIVATE = 0;
+constexpr int FIRST_STORED_RWLOCK_TYPE = 1;
+constexpr int LAST_STORED_RWLOCK_TYPE = 2;
 
 int toPosix(int result) {
     if (result == 0)
@@ -37,8 +40,6 @@ void initializeStatic(PthreadRwlock* rwlock, const char* funcName) {
 
 extern "C" {
 
-int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
-
 int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock) {
     if (!rwlock) throw std::runtime_error("pthread_rwlock_destroy: null rwlock");
     if (*rwlock == nullptr) return 0;
@@ -57,6 +58,11 @@ int APS5_VABI pthread_rwlockattr_init_nid_postfix(PthreadRwlockattr* attr) {
     return toPosix(scePthreadRwlockattrInit(attr));
 }
 
+int APS5_VABI pthread_rwlockattr_settype_np_nid_postfix(PthreadRwlockattr* attr, int type) {
+    if (!attr || !*attr || type < FIRST_STORED_RWLOCK_TYPE || type > LAST_STORED_RWLOCK_TYPE) return PosixThread::GUEST_EINVAL;
+    return toPosix(scePthreadRwlockattrSettype(attr, type));
+}
+
 int APS5_VABI pthread_rwlockattr_getpshared_nid_postfix(const PthreadRwlockattr* attr, int* pshared) {
     if (!attr || !*attr) throw std::runtime_error("pthread_rwlockattr_getpshared: null attr");
     if (!pshared) throw std::runtime_error("pthread_rwlockattr_getpshared: null pshared");
@@ -70,6 +76,25 @@ int APS5_VABI pthread_rwlockattr_setpshared_nid_postfix(PthreadRwlockattr* attr,
     return 0;
 }
 
+int APS5_VABI pthread_rwlockattr_gettype_np_nid_postfix(const PthreadRwlockattr* attr, int* type) {
+    if (!attr || !*attr) throw std::runtime_error("pthread_rwlockattr_gettype_np: null attr");
+    if (!type) throw std::runtime_error("pthread_rwlockattr_gettype_np: null type");
+    *type = (*attr)->type;
+    return 0;
+}
+
+int APS5_VABI scePthreadRwlockattrGettype(const PthreadRwlockattr* attr, int* type) {
+    return PosixThread::ToSce(pthread_rwlockattr_gettype_np_nid_postfix(attr, type));
+}
+
+int APS5_VABI scePthreadRwlockattrSetpshared(PthreadRwlockattr* attr, int pshared) {
+    return PosixThread::ToSce(pthread_rwlockattr_setpshared_nid_postfix(attr, pshared));
+}
+
+int APS5_VABI scePthreadRwlockattrGetpshared(const PthreadRwlockattr* attr, int* pshared) {
+    return PosixThread::ToSce(pthread_rwlockattr_getpshared_nid_postfix(attr, pshared));
+}
+
 int APS5_VABI pthread_rwlock_rdlock_nid_postfix(PthreadRwlock* rwlock) {
     initializeStatic(rwlock, __func__);
     return toPosix(scePthreadRwlockRdlock(rwlock));
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp b/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp
index e780d7f59f..fc5ea88197 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -7,8 +8,14 @@
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 #include <cerrno>
 #include <chrono>
+#include <cstdarg>
 #include <cstring>
+#include <map>
+#include <memory>
 #include <mutex>
+#include <stdexcept>
+#include <string>
+#include <string_view>
 
 // The guest sem_t is at least 8 bytes; its first word holds a pointer to the host semaphore.
 struct PosixSemaphore {
@@ -17,10 +24,19 @@ struct PosixSemaphore {
     unsigned int count;
 };
 
+static constexpr int GUEST_ENOENT = 2;
+static constexpr int GUEST_EEXIST = 17;
 static constexpr int GUEST_EAGAIN = 35;
+static constexpr int GUEST_ENAMETOOLONG = 63;
 static constexpr int GUEST_EOVERFLOW = 84;
 static constexpr unsigned int GUEST_SEM_VALUE_MAX = 0x7fffffffu;
 static constexpr int GUEST_REALTIME_CLOCK = 0;
+static constexpr int GUEST_O_CREAT = 0x200;
+static constexpr int GUEST_O_EXCL = 0x800;
+static constexpr std::size_t GUEST_PATH_MAX = 1024;
+static constexpr std::size_t GUEST_NAME_MAX = 255;
+static constexpr std::string_view NAMED_SEMAPHORE_PREFIX = "/tmp/SEMD";
+static constexpr std::string_view NAMED_SEMAPHORE_FILE_PREFIX = "SEMD";
 
 static int Fail(int error) {
     errno = error;
@@ -34,6 +50,49 @@ static PosixSemaphore* Get(void* sem) {
     return semaphore;
 }
 
+struct NamedSemaphoreMapping {
+    PosixSemaphore* semaphore;
+    std::uint64_t reserved;
+};
+
+struct NamedSemaphore {
+    std::unique_ptr<PosixSemaphore> semaphore;
+    std::unique_ptr<NamedSemaphoreMapping> mapping;
+    int openCount = 0;
+};
+
+struct NamedSemaphores {
+    std::mutex lock;
+    std::map<std::string, std::shared_ptr<NamedSemaphore>> linked;
+    std::map<const void*, std::shared_ptr<NamedSemaphore>> open;
+};
+
+static NamedSemaphores& Named() {
+    static NamedSemaphores named;
+    return named;
+}
+
+static bool IsNamed(const void* sem) {
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    return named.open.count(sem) != 0;
+}
+
+static int NamedPathError(const char* function, const char* name, int notAbsolute) {
+    if (!name) throw std::invalid_argument(std::string(function) + ": null name");
+    if (name[0] != '/') return notAbsolute;
+    if (NAMED_SEMAPHORE_PREFIX.size() + std::strlen(name + 1) >= GUEST_PATH_MAX) return GUEST_ENAMETOOLONG;
+    return 0;
+}
+
+static int NamedFileError(const char* function, const char* name) {
+    const std::string_view file(name + 1);
+    if (file.find('/') != std::string_view::npos)
+        throw std::runtime_error(std::string(function) + ": the name " + name + " would resolve below /tmp, which is not modelled");
+    if (NAMED_SEMAPHORE_FILE_PREFIX.size() + file.size() > GUEST_NAME_MAX) return GUEST_ENAMETOOLONG;
+    return 0;
+}
+
 static int WaitFor(PosixSemaphore* semaphore, const KernelUseconds* usec) {
     ThreadCancel::Check();
     std::unique_lock lock(semaphore->lock);
@@ -60,7 +119,7 @@ int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value) {
 
 int APS5_VABI sem_destroy_nid_postfix(void* sem) {
     auto* semaphore = Get(sem);
-    if (!semaphore) return Fail(PosixThread::GUEST_EINVAL);
+    if (!semaphore || IsNamed(sem)) return Fail(PosixThread::GUEST_EINVAL);
     delete semaphore;
     std::memset(sem, 0, sizeof(semaphore));
     return 0;
@@ -108,11 +167,9 @@ int APS5_VABI sem_reltimedwait_np_nid_postfix(void* sem, uint32_t usec) {
 int APS5_VABI sem_post_nid_postfix(void* sem) {
     auto* semaphore = Get(sem);
     if (!semaphore) return Fail(PosixThread::GUEST_EINVAL);
-    {
-        std::lock_guard lock(semaphore->lock);
-        if (semaphore->count == GUEST_SEM_VALUE_MAX) return Fail(GUEST_EOVERFLOW);
-        ++semaphore->count;
-    }
+    std::lock_guard lock(semaphore->lock);
+    if (semaphore->count == GUEST_SEM_VALUE_MAX) return Fail(GUEST_EOVERFLOW);
+    ++semaphore->count;
     semaphore->available.NotifyOne();
     return 0;
 }
@@ -125,4 +182,86 @@ int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value) {
     return 0;
 }
 
+void* APS5_VABI sem_open_nid_postfix(const char* name, int flags, ...) {
+    if (const int error = NamedPathError("sem_open", name, PosixThread::GUEST_EINVAL)) {
+        Fail(error);
+        return nullptr;
+    }
+    if ((flags & ~(GUEST_O_CREAT | GUEST_O_EXCL)) != 0) {
+        Fail(PosixThread::GUEST_EINVAL);
+        return nullptr;
+    }
+    unsigned int value = 0;
+    if ((flags & GUEST_O_CREAT) != 0) {
+#ifdef _WIN32
+        __builtin_sysv_va_list arguments;
+        __builtin_sysv_va_start(arguments, flags);
+        static_cast<void>(__builtin_va_arg(arguments, int));
+        value = static_cast<unsigned int>(__builtin_va_arg(arguments, int));
+        __builtin_sysv_va_end(arguments);
+#else
+        std::va_list arguments;
+        va_start(arguments, flags);
+        static_cast<void>(va_arg(arguments, int));
+        value = static_cast<unsigned int>(va_arg(arguments, int));
+        va_end(arguments);
+#endif
+    }
+    if (const int error = NamedFileError("sem_open", name)) {
+        Fail(error);
+        return nullptr;
+    }
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    const std::string file(name + 1);
+    std::shared_ptr<NamedSemaphore> object;
+    if (const auto found = named.linked.find(file); found != named.linked.end()) {
+        if ((flags & (GUEST_O_CREAT | GUEST_O_EXCL)) == (GUEST_O_CREAT | GUEST_O_EXCL)) {
+            Fail(GUEST_EEXIST);
+            return nullptr;
+        }
+        object = found->second;
+    } else {
+        if ((flags & GUEST_O_CREAT) == 0) {
+            Fail(GUEST_ENOENT);
+            return nullptr;
+        }
+        if (value > GUEST_SEM_VALUE_MAX)
+            throw std::runtime_error("sem_open: initial value " + std::to_string(value) + " is above SEM_VALUE_MAX, which FreeBSD stores unchecked");
+        object = std::make_shared<NamedSemaphore>();
+        object->semaphore = std::make_unique<PosixSemaphore>();
+        object->semaphore->count = value;
+        named.linked.emplace(file, object);
+    }
+    if (!object->mapping) {
+        object->mapping = std::make_unique<NamedSemaphoreMapping>(NamedSemaphoreMapping{object->semaphore.get(), 0});
+        named.open.emplace(object->mapping.get(), object);
+    }
+    ++object->openCount;
+    return object->mapping.get();
+}
+
+int APS5_VABI sem_close_nid_postfix(void* sem) {
+    if (!sem) throw std::invalid_argument("sem_close: null semaphore");
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    const auto found = named.open.find(sem);
+    if (found == named.open.end()) return Fail(PosixThread::GUEST_EINVAL);
+    const auto object = found->second;
+    if (--object->openCount == 0) {
+        named.open.erase(found);
+        object->mapping.reset();
+    }
+    return 0;
+}
+
+int APS5_VABI sem_unlink_nid_postfix(const char* name) {
+    if (const int error = NamedPathError("sem_unlink", name, GUEST_ENOENT)) return Fail(error);
+    if (const int error = NamedFileError("sem_unlink", name)) return Fail(error);
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    if (named.linked.erase(std::string(name + 1)) == 0) return Fail(GUEST_ENOENT);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp b/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp
index 9101c62da8..92c36969eb 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "Common.hpp"
 #include <atomic>
@@ -5,10 +6,6 @@
 #include <stdexcept>
 #include <thread>
 
-struct PthreadSpinlockPrivate {
-    std::atomic<std::thread::id> owner{};
-};
-
 namespace {
 
 constexpr int GUEST_EPERM = 1;
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp b/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp
index 69198777f4..160ce82945 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -14,27 +19,9 @@
 #include <thread>
 
 extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadDetach(Pthread thread);
-void APS5_VABI scePthreadExit(void* retval);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
+
 int APS5_VABI JoinThread_nid_no_patch(Pthread thread, void** retval, const KernelTimespec* abstime);
-int APS5_VABI scePthreadRename(Pthread thread, const char* name);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadEqual(Pthread thread1, Pthread thread2);
-int APS5_VABI scePthreadOnce(int32_t* once, void (APS5_VABI* init)(void));
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* old_state);
-int APS5_VABI scePthreadSetcanceltype(int type, int* old_type);
-void APS5_VABI scePthreadTestcancel();
-int APS5_VABI scePthreadSetprio(Pthread thread, int prio);
-int APS5_VABI scePthreadGetprio(Pthread thread, int* prio);
-void APS5_VABI scePthreadYield();
+
 }
 
 static constexpr int GUEST_SCHED_FIFO = 1;
@@ -52,11 +39,6 @@ static constexpr std::size_t GUEST_CPUSET_BYTES = 32;
 static constexpr int GUEST_ERANGE = 34;
 
 extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI scePthreadGetaffinity(Pthread thread, KernelCpumask* mask);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
-int APS5_VABI getpid_nid_postfix(void);
 
 int APS5_VABI cpuset_getaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, void* mask) {
     constexpr int LevelWhich = 3, WhichThread = 1, WhichProcess = 2;
@@ -125,33 +107,30 @@ int APS5_VABI cpuset_setaffinity_nid_postfix(int level, int which, std::int64_t
     return 0;
 }
 
-struct GuestRtPrio {
-    std::uint16_t type;
-    std::uint16_t prio;
-};
-
 int APS5_VABI rtprio_thread_nid_postfix(int function, int lwpid, GuestRtPrio* priority) {
     constexpr int Lookup = 0, Set = 1;
-    constexpr int GuestEsrch = 3, GuestEfault = 14, GuestEinval = 22;
-    constexpr std::uint16_t Normal = 3;
+    constexpr int GuestEsrch = 3, GuestEfault = 14;
+    constexpr int GuestSchedFifo = 1, GuestSchedRr = 3;
+    constexpr std::uint16_t Realtime = 2, Normal = 3, Fifo = 10;
     const auto fail = [](int error) {
         *__error_nid_postfix() = error;
         return -1;
     };
-    if (function != Lookup && function != Set) return fail(GuestEinval);
+    if (function != Lookup && function != Set) return fail(GuestEsrch);
     if (priority == nullptr) return fail(GuestEfault);
     auto* self = scePthreadSelf();
-    if (lwpid != 0 && static_cast<std::int64_t>(lwpid) != static_cast<std::int64_t>(self->tid)) {
-        if (!LiveGuestThreadExists(lwpid)) return fail(GuestEsrch);
-        NotImplemented_nid_no_patch("rtprio_thread: a thread other than the calling one");
-    }
-    const int policy = self->schedPolicy.load(std::memory_order_relaxed);
-    if (policy == 1 || policy == 3) NotImplemented_nid_no_patch("rtprio_thread: a guest thread's real-time class");
+    int policy = self->schedPolicy.load(std::memory_order_relaxed);
+    int schedPriority = self->priority.load(std::memory_order_relaxed);
+    const bool other = lwpid != 0 && static_cast<std::int64_t>(lwpid) != static_cast<std::int64_t>(self->tid);
+    if (other && !GetLiveGuestThreadSched_nid_no_patch(lwpid, policy, schedPriority)) return fail(GuestEsrch);
+    const bool realTime = policy == GuestSchedFifo || policy == GuestSchedRr;
     if (function == Lookup) {
-        priority->type = Normal;
-        priority->prio = 0;
+        priority->type = realTime ? (policy == GuestSchedFifo ? Fifo : Realtime) : Normal;
+        priority->prio = realTime ? static_cast<std::uint16_t>(schedPriority) : 0;
         return 0;
     }
+    if (other) NotImplemented_nid_no_patch("rtprio_thread: a thread other than the calling one");
+    if (realTime) NotImplemented_nid_no_patch("rtprio_thread: a guest thread's real-time class");
     if (priority->type == Normal && priority->prio == 0) return 0;
     NotImplemented_nid_no_patch("rtprio_thread: a real-time priority change");
 }
@@ -181,6 +160,7 @@ int APS5_VABI pthread_detach_nid_postfix(Pthread thread) {
 
 void APS5_VABI pthread_exit_nid_postfix(void* value) {
     scePthreadExit(value);
+
 }
 
 int APS5_VABI scePthreadGetschedparam(Pthread thread, int* policy, KernelSchedParam* param) {
@@ -265,6 +245,25 @@ struct RegisterPthreadOnLoad {
             scePthreadExit,
         };
         RegisterThreadForwards_nid_no_patch(&forwards);
+        static const PthreadSyncForwards_nid_no_patch sync{
+            reinterpret_cast<decltype(sync.mutexattrInit)>(scePthreadMutexattrInit),
+            reinterpret_cast<decltype(sync.mutexattrSettype)>(scePthreadMutexattrSettype),
+            reinterpret_cast<decltype(sync.mutexattrDestroy)>(scePthreadMutexattrDestroy),
+            reinterpret_cast<decltype(sync.mutexInit)>(scePthreadMutexInit),
+            reinterpret_cast<decltype(sync.mutexDestroy)>(scePthreadMutexDestroy),
+            reinterpret_cast<decltype(sync.mutexLock)>(scePthreadMutexLock),
+            reinterpret_cast<decltype(sync.mutexTrylock)>(scePthreadMutexTrylock),
+            reinterpret_cast<decltype(sync.mutexUnlock)>(scePthreadMutexUnlock),
+            reinterpret_cast<decltype(sync.condInit)>(scePthreadCondInit),
+            reinterpret_cast<decltype(sync.condDestroy)>(scePthreadCondDestroy),
+            reinterpret_cast<decltype(sync.condWait)>(scePthreadCondWait),
+            reinterpret_cast<decltype(sync.condSignal)>(scePthreadCondSignal),
+            reinterpret_cast<decltype(sync.condBroadcast)>(scePthreadCondBroadcast),
+            reinterpret_cast<decltype(sync.detach)>(scePthreadDetach),
+            reinterpret_cast<decltype(sync.join)>(scePthreadJoin),
+            scePthreadYield,
+        };
+        RegisterPthreadSyncForwards_nid_no_patch(&sync);
     }
 };
 const RegisterPthreadOnLoad gRegisterPthread;
@@ -286,14 +285,13 @@ int APS5_VABI pthread_getname_np_nid_postfix(Pthread thread, char* name) {
 
 void APS5_VABI pthread_set_name_np_nid_postfix(Pthread thread, const char* name) {
     scePthreadRename(thread, name != nullptr ? name : "");
+
 }
 
 Pthread APS5_VABI pthread_self_nid_postfix(void) {
     return scePthreadSelf();
 }
 
-int APS5_VABI scePthreadGetthreadid(void);
-
 int APS5_VABI pthread_getthreadid_np_nid_postfix(void) {
     return scePthreadGetthreadid();
 }
@@ -312,6 +310,7 @@ int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId) {
 
 int APS5_VABI sched_yield_nid_postfix(void) {
     scePthreadYield();
+
     return 0;
 }
 
@@ -338,10 +337,12 @@ int APS5_VABI pthread_setschedparam_nid_postfix(Pthread thread, int policy, cons
 
 void APS5_VABI pthread_testcancel_nid_postfix(void) {
     scePthreadTestcancel();
+
 }
 
 void APS5_VABI pthread_yield_nid_postfix(void) {
     scePthreadYield();
+
 }
 
 unsigned int APS5_VABI sleep_nid_postfix(unsigned int seconds) {
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp b/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp
index d46ac1d42d..f715d153be 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp
@@ -1,16 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "Common.hpp"
 
-extern "C" {
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-}
-
 extern "C" {
 
 void* APS5_VABI pthread_getspecific_nid_postfix(PthreadKey key) {
diff --git a/core/libs/prx/libkernel/Pthread/include/Cond.hpp b/core/libs/prx/libkernel/Pthread/include/Cond.hpp
index 936b957149..de69c30f51 100644
--- a/core/libs/prx/libkernel/Pthread/include/Cond.hpp
+++ b/core/libs/prx/libkernel/Pthread/include/Cond.hpp
@@ -6,6 +6,7 @@
 class CondOperations {
 public:
     static int AbsoluteTimedwait(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
+    static int SetName(PthreadCond* cond, const char* name);
 };
 
 extern "C" {
diff --git a/core/libs/prx/libkernel/Pthread/include/Pthread.hpp b/core/libs/prx/libkernel/Pthread/include/Pthread.hpp
index c4442bd188..097d609562 100644
--- a/core/libs/prx/libkernel/Pthread/include/Pthread.hpp
+++ b/core/libs/prx/libkernel/Pthread/include/Pthread.hpp
@@ -110,6 +110,7 @@ struct PthreadAttrPrivate {
     int _schedpriority;
     int _schedpolicy;
     int _inheritsched;
+    bool _createSuspended = false;
     KernelCpumask _affinity = DEFAULT_THREAD_AFFINITY;
     bool _affinityExplicit = false;
     std::size_t _guardsize = 0x1000;
@@ -130,6 +131,8 @@ struct PthreadPrivate {
     std::atomic<unsigned> references{2};
     std::atomic<bool> inWait{false};
     std::atomic<int> pendingException{0};
+    std::atomic<bool> suspended{false};
+    bool createdSuspended = false;
     std::atomic<int> schedPolicy{1};
     void* wakeEvent = nullptr;
     void* stackAddress = nullptr;
@@ -179,8 +182,11 @@ void SetLiveGuestThreadsAffinity(KernelCpumask mask);
 KernelCpumask LiveGuestThreadsAffinity();
 bool GuestThreadIsLive(const PthreadPrivate* thread);
 std::unique_lock<std::mutex> LockLiveGuestThread(const PthreadPrivate* thread);
+extern "C" int ResumeGuestThread_nid_no_patch(PthreadPrivate* thread);
+extern "C" void ResumeAllGuestThreads_nid_no_patch();
 bool LiveGuestThreadExists(std::int64_t tid);
 bool GetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask& mask);
+bool GetLiveGuestThreadSched_nid_no_patch(std::int64_t tid, int& policy, int& priority);
 bool SetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask mask);
 extern "C" std::size_t GetDefaultStackSize_nid_no_patch();
 extern "C" bool SetDefaultStackSize_nid_no_patch(std::size_t size);
diff --git a/core/libs/prx/libkernel/Pthread/src/Attr.cpp b/core/libs/prx/libkernel/Pthread/src/Attr.cpp
index 0b3b82078c..9b7cb2e521 100644
--- a/core/libs/prx/libkernel/Pthread/src/Attr.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Attr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -97,6 +98,7 @@ int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr) {
     (*attr)->_schedpriority = thread->priority.load(std::memory_order_relaxed);
     (*attr)->_schedpolicy = thread->schedPolicy.load(std::memory_order_relaxed);
     (*attr)->_inheritsched = 4;
+    (*attr)->_createSuspended = thread->createdSuspended;
     (*attr)->_affinity = thread->affinity.load(std::memory_order_relaxed);
     (*attr)->_affinityExplicit = true;
     (*attr)->_scope = thread->scope;
diff --git a/core/libs/prx/libkernel/Pthread/src/Cond.cpp b/core/libs/prx/libkernel/Pthread/src/Cond.cpp
index a3a3087bf7..2b4743e877 100644
--- a/core/libs/prx/libkernel/Pthread/src/Cond.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Cond.cpp
@@ -25,7 +25,7 @@ std::mutex& InitializationMutex() {
 }
 
 PthreadCond destroyedCond() {
-    return reinterpret_cast<PthreadCond>(std::uintptr_t{2});
+    return reinterpret_cast<PthreadCond>(std::uintptr_t{1});
 }
 
 PthreadMutex destroyedMutex() {
@@ -36,10 +36,9 @@ PthreadMutex adaptiveInitializer() {
     return reinterpret_cast<PthreadMutex>(std::uintptr_t{1});
 }
 
-std::shared_ptr<TimedWait::Condition> resolveCond(PthreadCond* cond, int* clockId = nullptr) {
+PthreadCond resolveLocked(PthreadCond* cond) {
     if (!cond)
         throw std::invalid_argument("Condition variable pointer is null");
-    std::lock_guard lock(InitializationMutex());
     std::atomic_ref<PthreadCond> slot(*cond);
     auto current = slot.load(std::memory_order_acquire);
     if (current == destroyedCond())
@@ -48,6 +47,14 @@ std::shared_ptr<TimedWait::Condition> resolveCond(PthreadCond* cond, int* clockI
         current = new PthreadCondPrivate();
         slot.store(current, std::memory_order_release);
     }
+    return current;
+}
+
+std::shared_ptr<TimedWait::Condition> resolveCond(PthreadCond* cond, int* clockId = nullptr) {
+    std::lock_guard lock(InitializationMutex());
+    const auto current = resolveLocked(cond);
+    if (!current)
+        return nullptr;
     if (clockId) *clockId = current->_clockid;
     return current->_cv;
 }
@@ -136,6 +143,16 @@ int CondOperations::AbsoluteTimedwait(PthreadCond* cond, PthreadMutex* mutex, co
     return waitUntil(std::move(condition), mutex, TimedWait::DeadlineNanos(usec), __builtin_return_address(0));
 }
 
+int CondOperations::SetName(PthreadCond* cond, const char* name) {
+    if (!name)
+        throw std::invalid_argument("Condition variable name is null");
+    std::lock_guard lock(InitializationMutex());
+    const auto current = resolveLocked(cond);
+    if (!current)
+        return SCE_KERNEL_ERROR_EINVAL;
+    return 0;
+}
+
 extern "C" {
 
 int APS5_VABI scePthreadCondattrInit(PthreadCondattr* attr) {
@@ -153,7 +170,9 @@ int APS5_VABI scePthreadCondattrDestroy(PthreadCondattr* attr) {
 }
 
 int APS5_VABI scePthreadCondattrSetclock(PthreadCondattr* attr, KernelClockid clockId) {
+    constexpr KernelClockid realtime = 0, virtualTime = 1, profiling = 2, monotonic = 4;
     if (!attr || !*attr) return SCE_KERNEL_ERROR_EINVAL;
+    if (clockId != realtime && clockId != virtualTime && clockId != profiling && clockId != monotonic) return SCE_KERNEL_ERROR_EINVAL;
     (*attr)->_clockid = static_cast<int>(clockId);
     return 0;
 }
@@ -175,6 +194,8 @@ int APS5_VABI scePthreadCondDestroy(PthreadCond* cond) {
     std::lock_guard lock(InitializationMutex());
     if (*cond == destroyedCond())
         return SCE_KERNEL_ERROR_EINVAL;
+    if (*cond == nullptr)
+        return 0;
     delete *cond;
     std::atomic_ref<PthreadCond>(*cond).store(destroyedCond(), std::memory_order_release);
     return 0;
diff --git a/core/libs/prx/libkernel/Pthread/src/Mutex.cpp b/core/libs/prx/libkernel/Pthread/src/Mutex.cpp
index 04677c3ba8..62e5e38db1 100644
--- a/core/libs/prx/libkernel/Pthread/src/Mutex.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Mutex.cpp
@@ -1,7 +1,10 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/Mutex.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
+#include "prx/libc/include/General.hpp"
 #include <algorithm>
 #include <atomic>
 #include <chrono>
@@ -9,6 +12,7 @@
 #include <limits>
 #include <memory>
 #include <stdexcept>
+#include <string>
 
 namespace {
 
@@ -16,6 +20,7 @@ constexpr int sceNotPermitted = static_cast<int>(0x80020001u);
 constexpr int sceDeadlock = static_cast<int>(0x8002000bu);
 constexpr int sceBusy = static_cast<int>(0x80020010u);
 constexpr int sceTimedOut = static_cast<int>(0x8002003cu);
+constexpr std::int32_t posixFailure = -1;
 std::mutex& InitializationMutex() {
     static std::mutex mutex;
     return mutex;
@@ -136,6 +141,17 @@ int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr) {
     return 0;
 }
 
+int APS5_VABI scePthreadMutexattrSetkind(PthreadMutexattr* attr, int kind) {
+    if (!attr || !*attr) return sceKernelError(posixFailure);
+    if (kind < static_cast<int>(MutexType::ErrorCheck) || kind > static_cast<int>(MutexType::Adaptive))
+        NotImplemented_nid_no_patch("scePthreadMutexattrSetkind with a kind other than 1 to 4");
+    return scePthreadMutexattrSettype(attr, kind);
+}
+
+int APS5_VABI scePthreadMutexattrGetkind(PthreadMutexattr attr) {
+    return sceKernelError(attr ? static_cast<std::int32_t>(attr->type) : posixFailure);
+}
+
 int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type) {
     if (!attr || !*attr)
         return SCE_KERNEL_ERROR_EINVAL;
@@ -149,16 +165,6 @@ int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type) {
     return 0;
 }
 
-int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol) {
-    if (!attr || !*attr)
-        return SCE_KERNEL_ERROR_EINVAL;
-    constexpr int PrioNone = 0;
-    constexpr int PrioProtect = 2;
-    if (protocol < PrioNone || protocol > PrioProtect)
-        return SCE_KERNEL_ERROR_EINVAL;
-    return 0;
-}
-
 int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char*) {
     if (!mutex)
         throw std::invalid_argument("Mutex pointer is null");
@@ -229,6 +235,10 @@ int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex) {
 int APS5_VABI scePthreadMutexTimedlock(PthreadMutex* mutex, KernelUseconds usec) {
     const auto deadline = TimedWait::DeadlineNanos(usec);
     auto* current = resolveMutex(mutex, true);
+    if (current && current->_type != MutexType::Recursive && current->_owner.load(std::memory_order_acquire) == std::this_thread::get_id()) {
+        TimedWait::SleepUntil(deadline);
+        return sceTimedOut;
+    }
     return acquireMutex(current, [=](auto& native) {
         return TimedWait::AcquireUntil(current, deadline, [&] { return native.try_lock(); }, [&](std::uint64_t micros) { return native.try_lock_for(std::chrono::microseconds(micros)); });
     }, sceTimedOut, false);
diff --git a/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp b/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp
index 35a043a8e9..8d06b7e9ea 100644
--- a/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/Rwlock.hpp"
 #include "prx/libc/include/General.hpp"
@@ -14,6 +15,8 @@ static constexpr int SCE_KERNEL_ERROR_EDEADLK = 0x8002000B;
 static constexpr int SCE_KERNEL_ERROR_EBUSY = 0x80020010;
 static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = 0x8002003C;
 static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
+static constexpr int FIRST_STORED_RWLOCK_TYPE = 1;
+static constexpr int LAST_STORED_RWLOCK_TYPE = 2;
 
 static PthreadRwlockPrivate* const DestroyedRwlock = reinterpret_cast<PthreadRwlockPrivate*>(std::uintptr_t{1});
 
@@ -102,8 +105,11 @@ int APS5_VABI scePthreadRwlockTryrdlock(PthreadRwlock* rwlock) {
 int APS5_VABI scePthreadRwlockTimedrdlock(PthreadRwlock* rwlock, KernelUseconds usec) {
     auto* lock = RequireRwlock(rwlock, __func__);
     if (!lock) return SCE_KERNEL_ERROR_EINVAL;
-    if (OwnsWrite(lock)) return SCE_KERNEL_ERROR_EDEADLK;
     const std::uint64_t deadline = TimedWait::DeadlineNanos(usec);
+    if (OwnsWrite(lock)) {
+        TimedWait::SleepUntil(deadline);
+        return SCE_KERNEL_ERROR_ETIMEDOUT;
+    }
     std::unique_lock state(lock->_state);
     if (!lock->_changed.WaitUntil(state, deadline, [&] { return ReaderMayEnter(lock); })) return SCE_KERNEL_ERROR_ETIMEDOUT;
     return EnterRead(lock);
@@ -131,8 +137,11 @@ int APS5_VABI scePthreadRwlockTrywrlock(PthreadRwlock* rwlock) {
 int APS5_VABI scePthreadRwlockTimedwrlock(PthreadRwlock* rwlock, KernelUseconds usec) {
     auto* lock = RequireRwlock(rwlock, __func__);
     if (!lock) return SCE_KERNEL_ERROR_EINVAL;
-    if (OwnsWrite(lock)) return SCE_KERNEL_ERROR_EDEADLK;
     const std::uint64_t deadline = TimedWait::DeadlineNanos(usec);
+    if (OwnsWrite(lock)) {
+        TimedWait::SleepUntil(deadline);
+        return SCE_KERNEL_ERROR_ETIMEDOUT;
+    }
     std::unique_lock state(lock->_state);
     ++lock->_waitingWriters;
     const bool acquired = lock->_changed.WaitUntil(state, deadline, [&] { return WriterMayEnter(lock); });
@@ -174,7 +183,7 @@ int APS5_VABI scePthreadRwlockattrInit(PthreadRwlockattr* attr) {
 }
 
 int APS5_VABI scePthreadRwlockattrSettype(PthreadRwlockattr* attr, int type) {
-    if (!attr || !*attr) throw std::runtime_error("scePthreadRwlockattrSettype: null attr");
+    if (!attr || !*attr || type < FIRST_STORED_RWLOCK_TYPE || type > LAST_STORED_RWLOCK_TYPE) return SCE_KERNEL_ERROR_EINVAL;
     (*attr)->type = type;
     return SCE_OK;
 }
diff --git a/core/libs/prx/libkernel/Pthread/src/Sem.cpp b/core/libs/prx/libkernel/Pthread/src/Sem.cpp
index ea9006380e..5d6c44715d 100644
--- a/core/libs/prx/libkernel/Pthread/src/Sem.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Sem.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/Cancel.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libkernel/Pthread/src/Thread.cpp b/core/libs/prx/libkernel/Pthread/src/Thread.cpp
index 1d2fecb349..71680fca25 100644
--- a/core/libs/prx/libkernel/Pthread/src/Thread.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Thread.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/ThreadLifecycle.hpp"
 #include "../include/WindowsThreadLocal.hpp"
@@ -34,7 +37,22 @@
 #include <unistd.h>
 #endif
 
+#ifdef __linux__
+#include <sys/syscall.h>
+#else
+static const auto initialThreadId = std::this_thread::get_id();
+#endif
+
+extern "C" bool IsInitialPthread_nid_no_patch() {
+#ifdef __linux__
+    return ::syscall(SYS_gettid) == ::getpid();
+#else
+    return std::this_thread::get_id() == initialThreadId;
+#endif
+}
+
 static constexpr int SCE_OK = 0;
+static constexpr std::size_t GUEST_THREAD_NAME_CAPACITY = 32;
 
 static constexpr std::size_t HOST_STACK_MARGIN = 1u << 20;
 static constexpr int DETACH_DETACHED = 1;
@@ -109,14 +127,103 @@ struct RetiredStack {
     int hostTid;
 };
 
+struct FinishedStack {
+    void* address;
+    std::size_t bytes;
+};
+
 static std::mutex retiredStacksLock;
 static std::vector<RetiredStack> retiredStacks;
+static std::vector<FinishedStack> spareStacks;
+static std::size_t spareStackBytes = 0;
+
+static std::size_t SpareStackLimit() {
+    static const auto limit = [] {
+        const auto pages = sysconf(_SC_PHYS_PAGES);
+        const auto pageSize = sysconf(_SC_PAGESIZE);
+        if (pages <= 0 || pageSize <= 0) return std::size_t{4u << 20};
+        const auto total = static_cast<std::uint64_t>(pages) * static_cast<std::uint64_t>(pageSize);
+        return std::clamp<std::size_t>(static_cast<std::size_t>(total / 1024), 4u << 20, 64u << 20);
+    }();
+    return limit;
+}
+
+static void ReleaseFinishedStack(const FinishedStack& stack) {
+    UnregisterGuestStackMapping(stack.address);
+    DoMunmap(stack.address, stack.bytes);
+}
+
+static bool DiscardFinishedStackPages(const FinishedStack& stack) {
+    auto* usable = static_cast<std::byte*>(stack.address) + GUEST_STACK_GUARD;
+    const auto bytes = stack.bytes - GUEST_STACK_GUARD;
+    return madvise(usable, bytes, MADV_DONTNEED) == 0;
+}
+
+static void CollectFinishedStack(void* address, std::size_t bytes) {
+    UnregisterGuestStackMapping(address);
+    const FinishedStack finished{address, bytes};
+    if (!DiscardFinishedStackPages(finished)) {
+        ReleaseFinishedStack(finished);
+        return;
+    }
+    std::vector<FinishedStack> release;
+    {
+        std::lock_guard lock(retiredStacksLock);
+        spareStacks.push_back({address, bytes});
+        spareStackBytes += bytes;
+        const auto limit = SpareStackLimit();
+        while (spareStackBytes > limit && !spareStacks.empty()) {
+            spareStackBytes -= spareStacks.front().bytes;
+            release.push_back(spareStacks.front());
+            spareStacks.erase(spareStacks.begin());
+        }
+    }
+    if (!release.empty()) {
+        static std::atomic_flag logged = ATOMIC_FLAG_INIT;
+        if (!logged.test_and_set(std::memory_order_relaxed))
+            std::fprintf(stderr, "scePthread: spare stack cache reached its host-memory limit; releasing cached mappings\n");
+        for (const auto& stack : release) ReleaseFinishedStack(stack);
+    }
+}
+
+static bool TakeSpareStack(std::size_t bytes, FinishedStack* stack) {
+    std::lock_guard lock(retiredStacksLock);
+    const auto found = std::find_if(spareStacks.begin(), spareStacks.end(), [bytes](const FinishedStack& candidate) { return candidate.bytes == bytes; });
+    if (found == spareStacks.end()) return false;
+    *stack = *found;
+    spareStackBytes -= found->bytes;
+    spareStacks.erase(found);
+    return true;
+}
+
+static void ReleaseSpareStacks() {
+    std::vector<FinishedStack> release;
+    {
+        std::lock_guard lock(retiredStacksLock);
+        release.swap(spareStacks);
+        spareStackBytes = 0;
+    }
+    for (const auto& stack : release) ReleaseFinishedStack(stack);
+}
 
 static void AllocateGuestStack(PthreadPrivate* thread, std::size_t usableBytes) {
     const std::size_t bytes = (usableBytes + PS5_PAGE_SIZE - 1) / PS5_PAGE_SIZE * PS5_PAGE_SIZE + GUEST_STACK_GUARD;
+    FinishedStack spare{};
+    if (TakeSpareStack(bytes, &spare)) {
+        if (DoMprotect(spare.address, spare.bytes, 3) == 0 && DoMprotect(spare.address, GUEST_STACK_GUARD, 0) == 0) {
+            thread->guestStack = spare.address;
+            thread->guestStackBytes = spare.bytes;
+            return;
+        }
+        UnregisterGuestStackMapping(spare.address);
+        DoMunmap(spare.address, spare.bytes);
+    }
     void* stack = nullptr;
-    if (DoMapAnon(&stack, bytes, 3, 0) != 0)
-        throw std::runtime_error("scePthreadCreate: cannot map the guest thread stack");
+    if (DoMapAnon(&stack, bytes, 3, 0) != 0) {
+        ReleaseSpareStacks();
+        if (DoMapAnon(&stack, bytes, 3, 0) != 0)
+            throw std::runtime_error("scePthreadCreate: cannot map the guest thread stack");
+    }
     if (DoMprotect(stack, GUEST_STACK_GUARD, 0) != 0) {
         DoMunmap(stack, bytes);
         throw std::runtime_error("scePthreadCreate: cannot protect the guest thread stack guard");
@@ -127,9 +234,7 @@ static void AllocateGuestStack(PthreadPrivate* thread, std::size_t usableBytes)
 
 static void FreeGuestStack(PthreadPrivate* thread) {
     if (thread->guestStack == nullptr) return;
-    void* const mapping = thread->guestStack;
-    UnregisterGuestStackMapping(mapping);
-    DoMunmap(thread->guestStack, thread->guestStackBytes);
+    CollectFinishedStack(thread->guestStack, thread->guestStackBytes);
     thread->guestStack = nullptr;
     thread->guestStackBytes = 0;
 }
@@ -154,10 +259,7 @@ static void ReapRetiredStacks() {
             }
         }
     }
-    for (const auto& stack : ready) {
-        UnregisterGuestStackMapping(stack.address);
-        DoMunmap(stack.address, stack.bytes);
-    }
+    for (const auto& stack : ready) CollectFinishedStack(stack.address, stack.bytes);
 }
 
 static void RetireGuestStack(PthreadPrivate* thread) {
@@ -453,6 +555,26 @@ bool GuestThreadIsLive(const PthreadPrivate* thread) {
     return LockLiveGuestThread(thread).owns_lock();
 }
 
+extern "C" int ResumeGuestThread_nid_no_patch(PthreadPrivate* thread) {
+    constexpr int GuestEsrch = 3;
+    const auto live = LockLiveGuestThread(thread);
+    if (!live.owns_lock()) return GuestEsrch;
+    thread->suspended.store(false, std::memory_order_release);
+    thread->suspended.notify_all();
+    return 0;
+}
+
+extern "C" void ResumeAllGuestThreads_nid_no_patch() {
+    const auto* self = CurrentGuestState().current;
+    auto& registry = CpuClocks();
+    std::lock_guard lock(registry.lock);
+    for (const auto& [id, thread] : registry.threads) {
+        if (thread == self) continue;
+        thread->suspended.store(false, std::memory_order_release);
+        thread->suspended.notify_all();
+    }
+}
+
 bool GetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask& mask) {
     auto& registry = CpuClocks();
     std::lock_guard lock(registry.lock);
@@ -464,6 +586,18 @@ bool GetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask& ma
     return false;
 }
 
+bool GetLiveGuestThreadSched_nid_no_patch(std::int64_t tid, int& policy, int& priority) {
+    auto& registry = CpuClocks();
+    std::lock_guard lock(registry.lock);
+    for (const auto& [id, thread] : registry.threads) {
+        if (thread->tid != tid || thread->_finished.load(std::memory_order_acquire)) continue;
+        policy = thread->schedPolicy.load(std::memory_order_relaxed);
+        priority = thread->priority.load(std::memory_order_relaxed);
+        return true;
+    }
+    return false;
+}
+
 bool SetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask mask) {
     auto& registry = CpuClocks();
     std::lock_guard lock(registry.lock);
@@ -661,6 +795,7 @@ static void RunThread(std::unique_ptr<ThreadArgs> args) {
     const sigset_t signalMask = args->signalMask;
 #endif
     args.reset();
+    self->suspended.wait(true, std::memory_order_acquire);
 #ifndef _WIN32
     pthread_sigmask(SIG_SETMASK, &signalMask, nullptr);
 #endif
@@ -820,6 +955,7 @@ extern "C" {
 
 int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name) {
     if (!thread || !entry) throw std::runtime_error("scePthreadCreate: null arg");
+    if (name && std::strlen(name) >= GUEST_THREAD_NAME_CAPACITY) return SCE_KERNEL_ERROR_ENAMETOOLONG;
     if (attr && !*attr) attr = nullptr;
     auto p = std::make_unique<PthreadPrivate>(attr ? *attr : nullptr);
     bool detached = false;
@@ -835,6 +971,8 @@ int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, Pthread
         p->scope = CurrentGuestState().current->scope;
     }
     if (name) p->name = name;
+    p->createdSuspended = attr && (*attr)->_createSuspended;
+    p->suspended.store(p->createdSuspended, std::memory_order_relaxed);
     std::promise<bool> start;
     auto args = std::make_unique<ThreadArgs>(ThreadArgs{entry, arg, p.get()});
 #ifdef _WIN32
@@ -988,7 +1126,8 @@ int APS5_VABI scePthreadDetach(Pthread thread) {
     if (!thread) return SCE_KERNEL_ERROR_EINVAL;
     {
         std::lock_guard lock(thread->_join_mtx);
-        if (thread->_detached || thread->_joining || thread->_joined.load(std::memory_order_acquire)) return SCE_KERNEL_ERROR_EINVAL;
+        if (thread->_joined.load(std::memory_order_acquire)) return SCE_KERNEL_ERROR_ESRCH;
+        if (thread->_detached || thread->_joining) return SCE_KERNEL_ERROR_EINVAL;
         thread->_detached = true;
     }
 #ifdef _WIN32
@@ -1086,6 +1225,7 @@ int APS5_VABI scePthreadCancel(Pthread thread) {
             thread->cancelWait->NotifyAll();
         }
         scePthreadYield();
+
     }
 }
 
@@ -1113,6 +1253,7 @@ void APS5_VABI pthread_cleanup_push_nid_postfix(void (APS5_VABI* routine)(void*)
 
 void APS5_VABI pthread_cleanup_pop_nid_postfix(int execute) {
     __pthread_cleanup_pop_imp_nid_postfix(execute);
+
 }
 
 int APS5_VABI scePthreadEqual(Pthread thread1, Pthread thread2) {
@@ -1212,6 +1353,7 @@ int APS5_VABI scePthreadOnce(int32_t* once, void (APS5_VABI* init)(void)) {
     CleanupHandler reset{};
     void* const mark = ThreadCancel::CleanupMark();
     __pthread_cleanup_push_imp_nid_postfix(ResetOnce, once, &reset);
+
     try {
         init();
     } catch (...) {
diff --git a/core/libs/prx/libkernel/Pthread/src/Tsd.cpp b/core/libs/prx/libkernel/Pthread/src/Tsd.cpp
index 03c706c202..2cf90e324a 100644
--- a/core/libs/prx/libkernel/Pthread/src/Tsd.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Tsd.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/ThreadLifecycle.hpp"
 #include "../include/WindowsThreadLocal.hpp"
diff --git a/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp b/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp
index 725f297e67..a1b4e1bd60 100644
--- a/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp
+++ b/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp
@@ -21,9 +21,12 @@ extern "C" {
 
 int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t attr, int init, int max, void* opt) {
  (void)opt;
- if (sem == nullptr || name == nullptr || attr > 2 || init < 0 || max <= 0 || init > max) {
+ if (sem == nullptr || attr > 2 || max < 0) {
   APS5_INVALID_ARG_EX;
  }
+ if (name == nullptr || init < 0 || max == 0 || init > max) {
+  return SCE_KERNEL_ERROR_EINVAL;
+ }
 
  *sem = new KernelSemaPrivate(init, max, std::string(name), attr == 1);
  if (TraceSync()) std::fprintf(stderr, "[sema] create %p '%s' attr=0x%x init=%d max=%d\n", static_cast<void*>(*sem), name, attr, init, max);
@@ -31,8 +34,11 @@ int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t at
 }
 
 int APS5_VABI sceKernelPollSema(KernelSema sem, int need) {
- if (sem == nullptr || need <= 0) {
-  APS5_INVALID_ARG_EX;
+ if (sem == nullptr) {
+  return SCE_KERNEL_ERROR_ESRCH;
+ }
+ if (need <= 0 || need > sem->maxCount) {
+  return SCE_KERNEL_ERROR_EINVAL;
  }
 
  std::lock_guard<std::mutex> lock(sem->mutex);
@@ -44,9 +50,15 @@ int APS5_VABI sceKernelPollSema(KernelSema sem, int need) {
 }
 
 int APS5_VABI sceKernelSignalSema(KernelSema sem, int count) {
- if (sem == nullptr || count < 0) {
+ if (sem == nullptr) {
+  return SCE_KERNEL_ERROR_ESRCH;
+ }
+ if (count < 0) {
   APS5_INVALID_ARG_EX;
  }
+ if (count == 0) {
+  return SCE_KERNEL_ERROR_EINVAL;
+ }
 
  std::lock_guard<std::mutex> lock(sem->mutex);
  if (count > sem->maxCount - sem->tokenCount) {
@@ -60,7 +72,10 @@ int APS5_VABI sceKernelSignalSema(KernelSema sem, int count) {
 }
 
 int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time) {
- if (sem == nullptr || need <= 0) {
+ if (sem == nullptr) {
+  return SCE_KERNEL_ERROR_ESRCH;
+ }
+ if (need <= 0) {
   APS5_INVALID_ARG_EX;
  }
 
@@ -129,7 +144,7 @@ int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time)
 
 int APS5_VABI sceKernelCancelSema(KernelSema sem, int count, int* threads) {
  if (sem == nullptr) {
-  APS5_INVALID_ARG_EX;
+  return SCE_KERNEL_ERROR_ESRCH;
  }
 
  std::lock_guard<std::mutex> lock(sem->mutex);
@@ -148,7 +163,7 @@ int APS5_VABI sceKernelCancelSema(KernelSema sem, int count, int* threads) {
 
 int APS5_VABI sceKernelDeleteSema(KernelSema sem) {
  if (sem == nullptr) {
-  APS5_INVALID_ARG_EX;
+  return SCE_KERNEL_ERROR_ESRCH;
  }
 
  std::unique_lock<std::mutex> lock(sem->mutex);
diff --git a/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp b/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp
index 56bbe00efe..44990b4654 100644
--- a/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp
+++ b/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp
@@ -1,5 +1,6 @@
 #pragma once
 #include <cstdint>
+#include <vector>
 
 namespace GuestSockets {
 
@@ -9,13 +10,32 @@ struct SocketOptionState {
     bool noSignal = false;
     std::int64_t sendTimeout = 0;
     std::int64_t receiveTimeout = 0;
+    int sendBuffer = 0;
+    int receiveBuffer = 0;
+    int sendLowWater = 0;
+    int receiveLowWater = 0;
+    int ipTimeToLive = 64;
+    int ipTypeOfService = 0;
+    int multicastTimeToLive = 1;
+    bool multicastLoop = true;
+    int tcpMaximumSegment = 536;
+    unsigned int tcpKeepIdle = 0;
+    unsigned int tcpKeepInterval = 0;
+    unsigned int tcpKeepCount = 0;
+    int keptFlags = 0;
+    int tcpFlags = 0;
+    int ipReceiveOptions = 0;
+    std::uint32_t multicastInterface = 0;
+    std::vector<std::uint64_t> memberships;
 };
 
 bool NativeListening(std::uintptr_t native, bool& listening);
-int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int option, const void* value, std::uint32_t length);
-int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int type, int option, void* value, std::uint32_t* length);
-int SetTcpLevelOption(std::uintptr_t native, bool tcp, int option, const void* value, std::uint32_t length);
-int GetTcpLevelOption(std::uintptr_t native, bool tcp, int option, void* value, std::uint32_t* length);
+int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, const void* value, std::uint32_t length);
+int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, void* value, std::uint32_t* length);
+int SetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, const void* value, std::uint32_t length);
+int GetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, void* value, std::uint32_t* length);
+int SetIpLevelOption(std::uintptr_t native, SocketOptionState& state, bool ipv4, bool datagram, int option, const void* value, std::uint32_t length);
+int GetIpLevelOption(SocketOptionState& state, bool ipv4, bool datagram, int option, void* value, std::uint32_t* length);
 int SetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, const void* value, std::uint32_t length);
 int GetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, void* value, std::uint32_t* length);
 
diff --git a/core/libs/prx/libkernel/Socket/include/SocketRuntime.hpp b/core/libs/prx/libkernel/Socket/include/SocketRuntime.hpp
index d59cfc4304..c5343daede 100644
--- a/core/libs/prx/libkernel/Socket/include/SocketRuntime.hpp
+++ b/core/libs/prx/libkernel/Socket/include/SocketRuntime.hpp
@@ -41,3 +41,4 @@ std::int64_t Writev(int descriptor, const Iovec* iov, int iovcnt);
 }
 
 extern "C" bool GuestSocketIsOpen_nid_no_patch(int descriptor);
+extern "C" bool GuestSocketReadGuest_nid_no_patch(void* destination, const void* source, std::size_t bytes);
diff --git a/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp b/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp
index bbcb17e637..5ffab9d013 100644
--- a/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp
+++ b/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp
@@ -1,11 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
 #include <stdexcept>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 constexpr int kGuestInet = 2;
 constexpr int kGuestInet6 = 28;
diff --git a/core/libs/prx/libkernel/Socket/src/Pselect.cpp b/core/libs/prx/libkernel/Socket/src/Pselect.cpp
new file mode 100644
index 0000000000..f30cde4a91
--- /dev/null
+++ b/core/libs/prx/libkernel/Socket/src/Pselect.cpp
@@ -0,0 +1,70 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstdint>
+#include <cstring>
+
+namespace {
+
+constexpr int SetMask = 3;
+constexpr int Eintr = 4;
+constexpr int DescriptorLimit = 1024;
+
+struct Timeval {
+    std::int64_t seconds;
+    std::int64_t microseconds;
+};
+
+using SavedSet = std::array<std::uint64_t, DescriptorLimit / 64>;
+
+void Save(SavedSet& saved, const void* set, std::size_t bytes) {
+    if (set != nullptr) std::memcpy(saved.data(), set, bytes);
+}
+
+void Restore(void* set, const SavedSet& saved, std::size_t bytes) {
+    if (set != nullptr) std::memcpy(set, saved.data(), bytes);
+}
+
+int ScanAfterCaughtSignal(int nfds, void* readfds, void* writefds, void* exceptfds, const Timeval* wait) {
+    const bool validWait = wait == nullptr || (wait->seconds >= 0 && wait->microseconds >= 0 && wait->microseconds < 1000000);
+    if (nfds < 0 || nfds > DescriptorLimit || !validWait) return select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
+    const std::size_t bytes = static_cast<std::size_t>((nfds + 63) / 64) * sizeof(std::uint64_t);
+    SavedSet read{}, write{}, except{};
+    Save(read, readfds, bytes);
+    Save(write, writefds, bytes);
+    Save(except, exceptfds, bytes);
+    const Timeval zero{};
+    const int result = select_nid_postfix(nfds, readfds, writefds, exceptfds, &zero);
+    if (result != 0 || (wait != nullptr && wait->seconds == 0 && wait->microseconds == 0)) return result;
+    Restore(readfds, read, bytes);
+    Restore(writefds, write, bytes);
+    Restore(exceptfds, except, bytes);
+    *__error_nid_postfix() = Eintr;
+    return -1;
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI pselect_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout, const void* sigmask) {
+    Timeval limit{};
+    const Timeval* wait = nullptr;
+    if (timeout != nullptr) {
+        const auto* spec = static_cast<const std::int64_t*>(timeout);
+        limit = {spec[0], spec[1] / 1000};
+        wait = &limit;
+    }
+    if (sigmask == nullptr) return select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
+    GuestSignalSet previous{};
+    const bool caught = SetSignalMaskCatching_nid_no_patch(static_cast<const GuestSignalSet*>(sigmask), &previous) != 0;
+    const int result = caught ? ScanAfterCaughtSignal(nfds, readfds, writefds, exceptfds, wait)
+                              : select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
+    const int error = *__error_nid_postfix();
+    sigprocmask_nid_postfix(SetMask, &previous, nullptr);
+    *__error_nid_postfix() = error;
+    return result;
+}
+
+}
diff --git a/core/libs/prx/libkernel/Socket/src/Socket.cpp b/core/libs/prx/libkernel/Socket/src/Socket.cpp
index 6cc428f617..399e530a79 100644
--- a/core/libs/prx/libkernel/Socket/src/Socket.cpp
+++ b/core/libs/prx/libkernel/Socket/src/Socket.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -49,6 +51,14 @@ void ClearDescriptor(void* set, int descriptor) {
     if (set != nullptr) static_cast<std::uint64_t*>(set)[descriptor / 64] &= ~(std::uint64_t{1} << (descriptor % 64));
 }
 
+void ClearDescriptorsFrom(int nfds, void* readfds, void* writefds, void* exceptfds) {
+    if (nfds % 64 == 0) return;
+    const std::uint64_t kept = (std::uint64_t{1} << (nfds % 64)) - 1;
+    for (void* set : {readfds, writefds, exceptfds}) {
+        if (set != nullptr) static_cast<std::uint64_t*>(set)[nfds / 64] &= kept;
+    }
+}
+
 struct PollGroup {
     KernelSocketPoll::Poller poll;
     std::vector<KernelSocketPoll::Entry> entries;
@@ -131,9 +141,6 @@ int HostPoll(KernelSocketPoll::Entry* descriptors, int count, int timeoutMillise
 
 extern "C" {
 
-const char* APS5_VABI __inet_ntop_nid_postfix(int family, const void* source, char* destination, std::uint32_t capacity);
-int APS5_VABI __inet_pton_nid_postfix(int family, const char* text, void* destination);
-
 const char* APS5_VABI inet_ntop_nid_postfix(int af, const void* src, char* dst, uint32_t size) {
     return __inet_ntop_nid_postfix(af, src, dst, size);
 }
@@ -142,8 +149,6 @@ int APS5_VABI inet_pton_nid_postfix(int af, const char* src, void* dst) {
     return __inet_pton_nid_postfix(af, src, dst);
 }
 
-int* APS5_VABI __error_nid_postfix();
-
 void KernelSetSocketPoller_nid_no_patch(KernelSocketPoll::Poller poller) {
     g_socketPoller.store(poller);
 }
@@ -210,8 +215,8 @@ int APS5_VABI select_nid_postfix(int nfds, void* readfds, void* writefds, void*
             kqueues.slots.push_back(requested.size());
             requested.push_back({descriptor, events, 0});
         } else if (File::IsRandomDevice(descriptor)) devices.push_back({descriptor, events, static_cast<short>((events & KernelSocketPoll::Readable) != 0 ? KernelSocketPoll::Readable : events)});
-        else if (descriptor <= 2) devices.push_back({descriptor, events, static_cast<short>(descriptor == 0 ? 0 : events & KernelSocketPoll::Writable)});
         else if (File::IsVnode(descriptor)) devices.push_back({descriptor, events, static_cast<short>(events & (KernelSocketPoll::Readable | KernelSocketPoll::Writable))});
+        else if (descriptor <= 2) devices.push_back({descriptor, events, static_cast<short>(descriptor == 0 ? 0 : events & KernelSocketPoll::Writable)});
         else {
             net.entries.push_back({descriptor, events, 0});
             net.slots.push_back(requested.size());
@@ -314,6 +319,7 @@ int APS5_VABI select_nid_postfix(int nfds, void* readfds, void* writefds, void*
                 if ((entry.revents & (KernelSocketPoll::Writable | KernelSocketPoll::Error)) == 0) ClearDescriptor(writefds, entry.descriptor);
                 if ((entry.revents & KernelSocketPoll::Urgent) == 0) ClearDescriptor(exceptfds, entry.descriptor);
             }
+            ClearDescriptorsFrom(nfds, readfds, writefds, exceptfds);
             return ready;
         }
         if (limit != nullptr && std::chrono::steady_clock::now() >= deadline) {
@@ -322,6 +328,7 @@ int APS5_VABI select_nid_postfix(int nfds, void* readfds, void* writefds, void*
                 ClearDescriptor(writefds, entry.descriptor);
                 ClearDescriptor(exceptfds, entry.descriptor);
             }
+            ClearDescriptorsFrom(nfds, readfds, writefds, exceptfds);
             return 0;
         }
     }
diff --git a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
index 37fce2af2e..ff0fb47fb7 100644
--- a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
+++ b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
@@ -16,6 +16,7 @@
 #include "prx/libkernel/Socket/include/SocketOptions.hpp"
 #include <algorithm>
 #include <cstring>
+#include <stdexcept>
 
 namespace GuestSockets {
 namespace {
@@ -30,18 +31,54 @@ constexpr int GuestOobInline = 0x100;
 constexpr int GuestNoSigpipe = 0x800;
 constexpr int GuestSendBuffer = 0x1001;
 constexpr int GuestReceiveBuffer = 0x1002;
+constexpr int GuestSendLowWater = 0x1003;
+constexpr int GuestReceiveLowWater = 0x1004;
 constexpr int GuestSendTimeout = 0x1005;
 constexpr int GuestReceiveTimeout = 0x1006;
 constexpr int GuestError = 0x1007;
 constexpr int GuestType = 0x1008;
 constexpr int GuestNonBlocking = 0x1200;
+constexpr int GuestNonBlockingState = 0x100;
+constexpr int GuestUnix = 1;
 constexpr int GuestTcpNoDelay = 1;
+constexpr int GuestReusePort = 0x200;
+constexpr int KeptFlags = 0x1 | GuestReuseAddress | 0x40 | GuestReusePort | 0x400 | 0x2000 | 0x10000;
+constexpr int WriteOnlyFlags = 0x4000 | 0x8000;
 constexpr int GuestTcpNoDelayFlag = 4;
+constexpr int GuestTcpMaximumSegment = 2;
+constexpr int GuestTcpKeepIdle = 0x100;
+constexpr int GuestTcpKeepInterval = 0x200;
+constexpr int GuestTcpKeepCount = 0x400;
+constexpr int GuestTcpNoPush = 4;
+constexpr int GuestTcpNoOptions = 8;
+constexpr int GuestTcpOption80 = 0x80;
+constexpr int MinimumSegment = 216;
+constexpr unsigned int TicksPerSecond = 1000;
+constexpr unsigned int DefaultKeepIdle = 7200;
+constexpr unsigned int DefaultKeepInterval = 75;
+constexpr unsigned int DefaultKeepCount = 8;
 constexpr int GuestIpv6Only = 27;
+constexpr int GuestIpTypeOfService = 3;
+constexpr int GuestIpTimeToLive = 4;
+constexpr int GuestIpMulticastTimeToLive = 10;
+constexpr int GuestIpMulticastLoop = 11;
+constexpr int GuestIpMulticastInterface = 9;
+constexpr int GuestIpAddMembership = 12;
+constexpr int GuestIpDropMembership = 13;
+constexpr int GuestIpReceiveDestination = 7;
+constexpr int GuestIpReceiveInterface = 20;
+constexpr int GuestIpReceiveTimeToLive = 65;
+constexpr std::uint32_t MulticastRequestWithIndex = 12;
+constexpr int ErrorNotSupported = 45;
+constexpr int ErrorAddressInUse = 48;
+constexpr int ErrorAddressNotAvailable = 49;
 
 constexpr int ErrorInvalid = 22;
 constexpr int ErrorDomain = 33;
 constexpr int ErrorNoProtocolOption = 42;
+constexpr int ErrorNoBuffers = 55;
+constexpr int MaximumReservation = 5592405;
+constexpr int MaximumBuffer = 524288;
 constexpr int MaximumLinger = 65535;
 constexpr std::int64_t LongestTimeout = 0x7fffffffffffffffLL;
 
@@ -78,7 +115,6 @@ int HostError() { return GuestErrorFromHost(errno); }
 
 int NativeBoolean(int option) {
     switch (option) {
-        case GuestReuseAddress: return SO_REUSEADDR;
         case GuestKeepAlive: return SO_KEEPALIVE;
         case GuestDontRoute: return SO_DONTROUTE;
         case GuestBroadcast: return SO_BROADCAST;
@@ -87,9 +123,39 @@ int NativeBoolean(int option) {
     }
 }
 
+void EnsureBuffers(SocketOptionState& state, int family, int type) {
+    if (state.sendBuffer != 0) return;
+    if (family == GuestUnix) {
+        state.sendBuffer = type == 2 ? 2048 : 8192;
+        state.receiveBuffer = type == 2 ? 4096 : 8192;
+    } else {
+        state.sendBuffer = type == 1 ? 32768 : 9216;
+        state.receiveBuffer = type == 1 ? 65536 : 42080;
+    }
+    state.sendLowWater = std::min(2048, state.sendBuffer);
+    state.receiveLowWater = 1;
+}
+
+int TcpFlagBit(int option) {
+    switch (option) {
+        case GuestTcpNoPush: return 0x1000;
+        case GuestTcpNoOptions: return 0x8;
+        case GuestTcpOption80: return 0x10000;
+        default: return 0;
+    }
+}
+
+int IpReceiveBit(int option) {
+    switch (option) {
+        case GuestIpReceiveDestination: return 1;
+        case GuestIpReceiveInterface: return 2;
+        case GuestIpReceiveTimeToLive: return 4;
+        default: return 0;
+    }
+}
+
 int Copy(void* output, std::uint32_t* length, const void* value, std::uint32_t size) {
-    const std::uint32_t count = std::min(*length, size);
-    if (count != 0 && !output) return ErrorInvalid;
+    const std::uint32_t count = output ? std::min(*length, size) : 0;
     if (count != 0) std::memcpy(output, value, count);
     *length = count;
     return 0;
@@ -97,11 +163,10 @@ int Copy(void* output, std::uint32_t* length, const void* value, std::uint32_t s
 
 }
 
-int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int option, const void* value, std::uint32_t length) {
+int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, const void* value, std::uint32_t length) {
     const auto handle = static_cast<NativeHandle>(native);
     if (option == GuestLinger) {
         if (length < sizeof(GuestLingerValue)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         GuestLingerValue guest;
         std::memcpy(&guest, value, sizeof(guest));
         if (guest.seconds < 0 || guest.seconds > MaximumLinger) return ErrorDomain;
@@ -119,7 +184,6 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op
     }
     if (option == GuestSendTimeout || option == GuestReceiveTimeout) {
         if (length < sizeof(GuestTimeval)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         GuestTimeval time;
         std::memcpy(&time, value, sizeof(time));
         if (time.seconds < 0 || time.microseconds < 0 || time.microseconds >= 1000000) return ErrorDomain;
@@ -128,7 +192,6 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op
     }
     if (option == GuestNoSigpipe || option == GuestNonBlocking) {
         if (length < sizeof(int)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         int number;
         std::memcpy(&number, value, sizeof(number));
         if (option == GuestNoSigpipe) {
@@ -146,21 +209,52 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op
         return 0;
     }
     const bool native_boolean = NativeBoolean(option) != -1;
-    if (native_boolean || option == GuestSendBuffer || option == GuestReceiveBuffer) {
+    const bool buffer = option == GuestSendBuffer || option == GuestReceiveBuffer;
+    const bool lowWater = option == GuestSendLowWater || option == GuestReceiveLowWater;
+    if (native_boolean || buffer || lowWater) {
         if (length < sizeof(int)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         int number;
         std::memcpy(&number, value, sizeof(number));
-        if (option == GuestSendBuffer || option == GuestReceiveBuffer) {
+        if (buffer || lowWater) {
             if (number < 1) return ErrorInvalid;
-            const int nativeOption = option == GuestSendBuffer ? SO_SNDBUF : SO_RCVBUF;
+            EnsureBuffers(state, family, type);
+            const bool send = option == GuestSendBuffer || option == GuestSendLowWater;
+            int& size = send ? state.sendBuffer : state.receiveBuffer;
+            int& mark = send ? state.sendLowWater : state.receiveLowWater;
+            if (lowWater) {
+                mark = std::min(number, size);
+                return 0;
+            }
+            if (number > MaximumReservation) return ErrorNoBuffers;
+            const int nativeOption = send ? SO_SNDBUF : SO_RCVBUF;
             if (::setsockopt(handle, SOL_SOCKET, nativeOption, reinterpret_cast<NativeOptionValue>(&number), sizeof(number))) return HostError();
+            size = std::min(number, MaximumBuffer);
+            mark = std::min(mark, size);
             return 0;
         }
         const int enabled = number != 0 ? 1 : 0;
         if (::setsockopt(handle, SOL_SOCKET, NativeBoolean(option), reinterpret_cast<NativeOptionValue>(&enabled), sizeof(enabled))) return HostError();
         return 0;
     }
+    if ((option & (KeptFlags | WriteOnlyFlags)) != 0 && (option & (option - 1)) == 0) {
+        if (length < sizeof(int)) return ErrorInvalid;
+        int number;
+        std::memcpy(&number, value, sizeof(number));
+        if ((option & KeptFlags) == 0) return 0;
+        const int flags = number != 0 ? state.keptFlags | option : state.keptFlags & ~option;
+        if (option == GuestReuseAddress || option == GuestReusePort) {
+#ifdef _WIN32
+            const int reuseAddress = (flags & (GuestReuseAddress | GuestReusePort)) != 0 ? 1 : 0;
+#else
+            const int reuseAddress = (flags & GuestReuseAddress) != 0 ? 1 : 0;
+            const int reusePort = (flags & GuestReusePort) != 0 ? 1 : 0;
+            if (::setsockopt(handle, SOL_SOCKET, SO_REUSEPORT, reinterpret_cast<NativeOptionValue>(&reusePort), sizeof(reusePort))) return HostError();
+#endif
+            if (::setsockopt(handle, SOL_SOCKET, SO_REUSEADDR, reinterpret_cast<NativeOptionValue>(&reuseAddress), sizeof(reuseAddress))) return HostError();
+        }
+        state.keptFlags = flags;
+        return 0;
+    }
     return ErrorNoProtocolOption;
 }
 
@@ -178,7 +272,7 @@ bool NativeListening(std::uintptr_t native, bool& listening) {
     return true;
 }
 
-int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int type, int option, void* value, std::uint32_t* length) {
+int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, void* value, std::uint32_t* length) {
     const auto handle = static_cast<NativeHandle>(native);
     if (option == GuestLinger) {
         linger current{};
@@ -203,10 +297,12 @@ int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int ty
         number = listening ? GuestAcceptConnection : 0;
     } else if (option == GuestType) {
         number = type;
+    } else if ((option & KeptFlags) != 0 && (option & (option - 1)) == 0) {
+        number = state.keptFlags & option;
     } else if (option == GuestNoSigpipe) {
         number = state.noSignal ? GuestNoSigpipe : 0;
     } else if (option == GuestNonBlocking) {
-        number = state.nonblocking ? 1 : 0;
+        number = state.nonblocking ? GuestNonBlockingState : 0;
     } else if (option == GuestError) {
         int pending = 0;
         socklen_t size = sizeof(pending);
@@ -216,29 +312,67 @@ int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int ty
         else if (pending != 0) state.reportedError = pending;
 #endif
         number = pending == 0 ? 0 : GuestErrorFromHost(pending);
-    } else if (option == GuestSendBuffer || option == GuestReceiveBuffer) {
-        socklen_t size = sizeof(number);
-        if (::getsockopt(handle, SOL_SOCKET, option == GuestSendBuffer ? SO_SNDBUF : SO_RCVBUF, reinterpret_cast<NativeOptionOutput>(&number), &size)) return HostError();
+    } else if (option == GuestSendBuffer || option == GuestReceiveBuffer || option == GuestSendLowWater || option == GuestReceiveLowWater) {
+        EnsureBuffers(state, family, type);
+        number = option == GuestSendBuffer ? state.sendBuffer : option == GuestReceiveBuffer ? state.receiveBuffer
+            : option == GuestSendLowWater ? state.sendLowWater : state.receiveLowWater;
     } else {
         return ErrorNoProtocolOption;
     }
     return Copy(value, length, &number, sizeof(number));
 }
 
-int SetTcpLevelOption(std::uintptr_t native, bool tcp, int option, const void* value, std::uint32_t length) {
+bool HasPeer(std::uintptr_t native) {
+    sockaddr_storage peer{};
+    socklen_t size = sizeof(peer);
+    return ::getpeername(static_cast<NativeHandle>(native), reinterpret_cast<sockaddr*>(&peer), &size) == 0;
+}
+
+int SetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, const void* value, std::uint32_t length) {
     if (!tcp) return ErrorInvalid;
-    if (option != GuestTcpNoDelay) return ErrorNoProtocolOption;
+    if (option != GuestTcpNoDelay && option != GuestTcpMaximumSegment && option != GuestTcpKeepIdle && option != GuestTcpKeepInterval &&
+        option != GuestTcpKeepCount && TcpFlagBit(option) == 0)
+        return ErrorNoProtocolOption;
     if (length < sizeof(int)) return ErrorInvalid;
-    if (!value) return ErrorInvalid;
     int number;
     std::memcpy(&number, value, sizeof(number));
+    if (const int bit = TcpFlagBit(option); bit != 0) {
+        state.tcpFlags = number != 0 ? state.tcpFlags | bit : state.tcpFlags & ~bit;
+        return 0;
+    }
+    const auto unsignedNumber = static_cast<unsigned int>(number);
+    if (option == GuestTcpMaximumSegment) {
+        if (!HasPeer(native) || number <= 0 || number > state.tcpMaximumSegment || number + 40 < MinimumSegment) return ErrorInvalid;
+        state.tcpMaximumSegment = std::max(number, MinimumSegment);
+        return 0;
+    }
+    if (option == GuestTcpKeepCount) {
+        state.tcpKeepCount = unsignedNumber;
+        return 0;
+    }
+    if (option == GuestTcpKeepIdle || option == GuestTcpKeepInterval) {
+        if (unsignedNumber > UINT32_MAX / TicksPerSecond) return ErrorInvalid;
+        (option == GuestTcpKeepIdle ? state.tcpKeepIdle : state.tcpKeepInterval) = unsignedNumber;
+        return 0;
+    }
     const int enabled = number != 0 ? 1 : 0;
     if (::setsockopt(static_cast<NativeHandle>(native), IPPROTO_TCP, TCP_NODELAY, reinterpret_cast<NativeOptionValue>(&enabled), sizeof(enabled))) return HostError();
     return 0;
 }
 
-int GetTcpLevelOption(std::uintptr_t native, bool tcp, int option, void* value, std::uint32_t* length) {
+int GetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, void* value, std::uint32_t* length) {
     if (!tcp) return ErrorInvalid;
+    if (option == GuestTcpMaximumSegment || option == GuestTcpKeepIdle || option == GuestTcpKeepInterval || option == GuestTcpKeepCount) {
+        const unsigned int number = option == GuestTcpMaximumSegment ? static_cast<unsigned int>(state.tcpMaximumSegment)
+            : option == GuestTcpKeepIdle ? (state.tcpKeepIdle != 0 ? state.tcpKeepIdle : DefaultKeepIdle)
+            : option == GuestTcpKeepInterval ? (state.tcpKeepInterval != 0 ? state.tcpKeepInterval : DefaultKeepInterval)
+            : (state.tcpKeepCount != 0 ? state.tcpKeepCount : DefaultKeepCount);
+        return Copy(value, length, &number, sizeof(number));
+    }
+    if (const int bit = TcpFlagBit(option); bit != 0) {
+        const int number = state.tcpFlags & bit;
+        return Copy(value, length, &number, sizeof(number));
+    }
     if (option != GuestTcpNoDelay) return ErrorNoProtocolOption;
     int enabled = 0;
     socklen_t size = sizeof(enabled);
@@ -247,11 +381,125 @@ int GetTcpLevelOption(std::uintptr_t native, bool tcp, int option, void* value,
     return Copy(value, length, &number, sizeof(number));
 }
 
+bool MulticastOption(int option) {
+    return option == GuestIpMulticastInterface || option == GuestIpMulticastTimeToLive || option == GuestIpMulticastLoop ||
+        option == GuestIpAddMembership || option == GuestIpDropMembership;
+}
+
+int SetIpLevelOption(std::uintptr_t native, SocketOptionState& state, bool ipv4, bool datagram, int option, const void* value, std::uint32_t length) {
+    if (!ipv4) return ErrorInvalid;
+    if (MulticastOption(option) && !datagram) return ErrorNotSupported;
+    const auto handle = static_cast<NativeHandle>(native);
+    if (option == GuestIpAddMembership || option == GuestIpDropMembership) {
+        if (length < sizeof(ip_mreq)) return ErrorInvalid;
+        ip_mreq request{};
+        std::memcpy(&request, value, sizeof(request));
+        const auto* group = reinterpret_cast<const unsigned char*>(&request.imr_multiaddr);
+        if ((group[0] & 0xf0) != 0xe0) return ErrorInvalid;
+        std::uint32_t groupBits;
+        std::uint32_t interfaceBits;
+        std::memcpy(&groupBits, &request.imr_multiaddr, sizeof(groupBits));
+        std::memcpy(&interfaceBits, &request.imr_interface, sizeof(interfaceBits));
+        const std::uint64_t key = (std::uint64_t{groupBits} << 32) | interfaceBits;
+        const bool join = option == GuestIpAddMembership;
+        const auto found = join || interfaceBits != 0
+            ? std::find(state.memberships.begin(), state.memberships.end(), key)
+            : std::find_if(state.memberships.begin(), state.memberships.end(), [groupBits](std::uint64_t joined) { return joined >> 32 == groupBits; });
+        if (join && found != state.memberships.end()) return ErrorAddressInUse;
+        if (!join && found == state.memberships.end()) return ErrorAddressNotAvailable;
+        if (!join) {
+            const auto joinedInterface = static_cast<std::uint32_t>(*found);
+            std::memcpy(&request.imr_interface, &joinedInterface, sizeof(joinedInterface));
+        }
+        if (::setsockopt(handle, IPPROTO_IP, join ? IP_ADD_MEMBERSHIP : IP_DROP_MEMBERSHIP, reinterpret_cast<NativeOptionValue>(&request), sizeof(request)))
+            return HostError();
+        if (join) state.memberships.push_back(key);
+        else state.memberships.erase(found);
+        return 0;
+    }
+    if (option == GuestIpMulticastInterface) {
+        if (length < sizeof(in_addr)) return ErrorInvalid;
+        in_addr address{};
+        if (length == MulticastRequestWithIndex) {
+            std::int32_t index;
+            std::memcpy(&index, static_cast<const unsigned char*>(value) + 8, sizeof(index));
+            if (index != 0) throw std::runtime_error("IP_MULTICAST_IF: an interface index is not supported");
+            const auto* addresses = static_cast<const unsigned char*>(value);
+            if (std::any_of(addresses, addresses + 8, [](unsigned char byte) { return byte != 0; }))
+                throw std::runtime_error("IP_MULTICAST_IF: an ip_mreqn with a non-zero address is not supported");
+        } else {
+            std::memcpy(&address, value, sizeof(address));
+        }
+        if (::setsockopt(handle, IPPROTO_IP, IP_MULTICAST_IF, reinterpret_cast<NativeOptionValue>(&address), sizeof(address))) return HostError();
+        std::memcpy(&state.multicastInterface, &address, sizeof(address));
+        return 0;
+    }
+    if (const int bit = IpReceiveBit(option); bit != 0) {
+        if (length < sizeof(int)) return ErrorInvalid;
+        int number;
+        std::memcpy(&number, value, sizeof(number));
+        state.ipReceiveOptions = number != 0 ? state.ipReceiveOptions | bit : state.ipReceiveOptions & ~bit;
+        return 0;
+    }
+    if (option == GuestIpTimeToLive || option == GuestIpTypeOfService) {
+        if (length < sizeof(int)) return ErrorInvalid;
+        int number;
+        std::memcpy(&number, value, sizeof(number));
+        const int stored = number & 0xff;
+        if (option == GuestIpTypeOfService) {
+            state.ipTypeOfService = stored;
+            return 0;
+        }
+        if (stored != 0 && ::setsockopt(handle, IPPROTO_IP, IP_TTL, reinterpret_cast<NativeOptionValue>(&stored), sizeof(stored))) return HostError();
+        state.ipTimeToLive = stored;
+        return 0;
+    }
+    if (option == GuestIpMulticastTimeToLive || option == GuestIpMulticastLoop) {
+        unsigned int number;
+        if (length == 1) {
+            unsigned char byte;
+            std::memcpy(&byte, value, 1);
+            number = byte;
+        } else {
+            if (length < sizeof(number)) return ErrorInvalid;
+            std::memcpy(&number, value, sizeof(number));
+            if (option == GuestIpMulticastTimeToLive && number > 255) return ErrorInvalid;
+        }
+        const int host = option == GuestIpMulticastLoop ? ((number & 0xff) != 0 ? 1 : 0) : static_cast<int>(number);
+        const int nativeOption = option == GuestIpMulticastLoop ? IP_MULTICAST_LOOP : IP_MULTICAST_TTL;
+        if (::setsockopt(handle, IPPROTO_IP, nativeOption, reinterpret_cast<NativeOptionValue>(&host), sizeof(host))) return HostError();
+        if (option == GuestIpMulticastLoop) state.multicastLoop = host != 0;
+        else state.multicastTimeToLive = host;
+        return 0;
+    }
+    return ErrorNoProtocolOption;
+}
+
+int GetIpLevelOption(SocketOptionState& state, bool ipv4, bool datagram, int option, void* value, std::uint32_t* length) {
+    if (!ipv4) return ErrorInvalid;
+    if (MulticastOption(option) && option != GuestIpAddMembership && option != GuestIpDropMembership && !datagram) return ErrorNotSupported;
+    if (option == GuestIpMulticastInterface) {
+        if (*length == MulticastRequestWithIndex) throw std::runtime_error("IP_MULTICAST_IF: reading an ip_mreqn is not supported");
+        return Copy(value, length, &state.multicastInterface, sizeof(state.multicastInterface));
+    }
+    int number;
+    if (const int bit = IpReceiveBit(option); bit != 0) number = (state.ipReceiveOptions & bit) != 0 ? 1 : 0;
+    else if (option == GuestIpTimeToLive) number = state.ipTimeToLive;
+    else if (option == GuestIpTypeOfService) number = state.ipTypeOfService;
+    else if (option == GuestIpMulticastTimeToLive) number = state.multicastTimeToLive;
+    else if (option == GuestIpMulticastLoop) number = state.multicastLoop ? 1 : 0;
+    else return ErrorNoProtocolOption;
+    if ((option == GuestIpMulticastTimeToLive || option == GuestIpMulticastLoop) && *length == 1) {
+        const auto byte = static_cast<unsigned char>(number);
+        return Copy(value, length, &byte, 1);
+    }
+    return Copy(value, length, &number, sizeof(number));
+}
+
 int SetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, const void* value, std::uint32_t length) {
     if (!ipv6) return ErrorInvalid;
     if (option != GuestIpv6Only) return ErrorNoProtocolOption;
     if (length != sizeof(int)) return ErrorInvalid;
-    if (!value) return ErrorInvalid;
     int number;
     std::memcpy(&number, value, sizeof(number));
     const int enabled = number != 0 ? 1 : 0;
diff --git a/core/libs/prx/libkernel/Socket/src/Udp.cpp b/core/libs/prx/libkernel/Socket/src/Udp.cpp
index f17394f4e4..e32fd3acaf 100644
--- a/core/libs/prx/libkernel/Socket/src/Udp.cpp
+++ b/core/libs/prx/libkernel/Socket/src/Udp.cpp
@@ -1,7 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
 #include <ws2tcpip.h>
+#include <mswsock.h>
 #include <fcntl.h>
 #include <io.h>
 #else
@@ -38,6 +41,7 @@
 #include "prx/libkernel/Equeue/Equeue.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include "prx/libkernel/File/include/RandomDevice.hpp"
+#include "prx/libkernel/File/include/SharedMemory.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 #include "prx/libkernel/Socket/include/SocketPoll.hpp"
 #include "prx/libkernel/Socket/include/SocketConnect.hpp"
@@ -57,8 +61,6 @@
 #include <string>
 #include <vector>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI dup2_nid_postfix(int from, int to);
 namespace {
 #ifdef _WIN32
 using NativeSocket = SOCKET;
@@ -122,6 +124,7 @@ struct Socket : KernelSocketPoll::NativeOwner {
     GuestSockets::SocketOptionState options;
     bool receiveShut = false;
     bool sendShut = false;
+    std::weak_ptr<Socket> peer;
     Socket(NativeSocket value, int family, int type) : value(value), family(family), type(type) {}
     ~Socket() {
         if (value == Invalid) return;
@@ -272,11 +275,14 @@ int AddressLengthError(const void* input, std::uint32_t length) {
     if (length < 2) return 22;
     return input ? 0 : 14;
 }
-bool Address(const void* input, std::uint32_t length, sockaddr_storage& native, socklen_t& size) {
+bool Address(int family, const void* input, std::uint32_t length, sockaddr_storage& native, socklen_t& size, bool lengthFirst = false) {
     if (const int error = AddressLengthError(input, length)) { Fail(error); return false; }
     const auto* bytes = static_cast<const unsigned char*>(input);
-    if ((bytes[1] == 2 && length < 16) || (bytes[1] == 28 && length < 28)) { Fail(22); return false; }
-    if (bytes[1] == 2 && length >= 16) {
+    const bool wrongLength = (family == 2 && length != 16) || (family == 28 && length != 28);
+    if (lengthFirst && wrongLength) { Fail(22); return false; }
+    if (family == 2 && bytes[1] != 2) { Fail(47); return false; }
+    if (wrongLength) { Fail(22); return false; }
+    if (family == 2) {
         auto& v4 = reinterpret_cast<sockaddr_in&>(native);
         v4.sin_family = AF_INET;
         std::memcpy(&v4.sin_port, bytes + 2, 2);
@@ -284,7 +290,7 @@ bool Address(const void* input, std::uint32_t length, sockaddr_storage& native,
         size = sizeof(v4);
         return true;
     }
-    if (bytes[1] == 28 && length >= 28) {
+    if (family == 28 && bytes[1] == 28) {
         auto& v6 = reinterpret_cast<sockaddr_in6&>(native);
         v6.sin6_family = AF_INET6;
         std::memcpy(&v6.sin6_port, bytes + 2, 2);
@@ -297,6 +303,16 @@ bool Address(const void* input, std::uint32_t length, sockaddr_storage& native,
     Fail(47);
     return false;
 }
+int LongMappedDualStack(const Socket& socket, const void* address, std::uint32_t length) {
+    if (socket.family != 28 || socket.type != 2 || address == nullptr || length <= 28 || length > 255) return 0;
+    const auto* bytes = static_cast<const unsigned char*>(address);
+    constexpr unsigned char mapped[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    if (bytes[1] != 28 || std::memcmp(bytes + 8, mapped, sizeof(mapped)) != 0) return 0;
+    int ipv6Only = 0;
+    socklen_t size = sizeof(ipv6Only);
+    if (::getsockopt(socket.value, IPPROTO_IPV6, IPV6_V6ONLY, reinterpret_cast<char*>(&ipv6Only), &size)) return Fail(NativeError());
+    return ipv6Only ? 0 : 1;
+}
 std::uint16_t& PortOf(sockaddr_storage& address) {
     return address.ss_family == AF_INET ? reinterpret_cast<sockaddr_in&>(address).sin_port : reinterpret_cast<sockaddr_in6&>(address).sin6_port;
 }
@@ -304,15 +320,10 @@ bool Listening(const Socket& socket) {
     bool listening = false;
     return GuestSockets::NativeListening(static_cast<std::uintptr_t>(socket.value), listening) && listening;
 }
-bool ZeroPortConnect(const Socket& socket, const void* address, std::uint32_t length) {
-    if (!address || (socket.type != 1 && socket.type != 2) || (socket.family != 2 && socket.family != 28)) return false;
-    const auto* bytes = static_cast<const unsigned char*>(address);
-    if (length < (socket.family == 2 ? 16u : 28u) || bytes[1] != socket.family || (bytes[2] | bytes[3]) != 0) return false;
+bool PeerConnected(const Socket& socket) {
     sockaddr_storage peer{};
-    socklen_t peerSize = sizeof(peer);
-    if (::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &peerSize) == 0) return false;
-    Fail(49);
-    return true;
+    socklen_t size = sizeof(peer);
+    return ::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &size) == 0;
 }
 constexpr std::int64_t NotAnswered = -2;
 std::int64_t ZeroPortSend(const Socket& socket, const sockaddr_storage& destination, std::uint64_t length) {
@@ -355,6 +366,20 @@ int Disconnect(const Socket& socket) {
     if (::bind(socket.value, reinterpret_cast<sockaddr*>(&wildcard), localSize) != 0) return Fail(NativeError());
     return 0;
 }
+bool ZeroPortConnect(const Socket& socket, const void* address, std::uint32_t length) {
+    if (!address || (socket.type != 1 && socket.type != 2) || (socket.family != 2 && socket.family != 28)) return false;
+    const auto* bytes = static_cast<const unsigned char*>(address);
+    if (length < (socket.family == 2 ? 16u : 28u) || bytes[1] != socket.family || (bytes[2] | bytes[3]) != 0) return false;
+    if (socket.type == 2) {
+        if (Disconnect(socket) != 0) return true;
+    } else {
+        sockaddr_storage peer{};
+        socklen_t peerSize = sizeof(peer);
+        if (::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &peerSize) == 0) return false;
+    }
+    Fail(49);
+    return true;
+}
 void GuestAddress(const sockaddr_storage& native, void* output, std::uint32_t* length) {
     unsigned char bytes[28]{};
     bytes[0] = native.ss_family == AF_INET ? 16 : 28;
@@ -523,11 +548,7 @@ using NativePollDescriptor = WSAPOLLFD;
 #else
 using NativePollDescriptor = pollfd;
 #endif
-struct GuestPollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
+
 struct PollFlag {
     short guest;
     short native;
@@ -703,6 +724,17 @@ int SetNonBlocking(Socket& socket) {
     socket.options.nonblocking = true;
     return 0;
 }
+bool ReadableNow(const Socket& socket) {
+    NativePollDescriptor entry{};
+    entry.fd = socket.value;
+#ifdef _WIN32
+    entry.events = POLLRDNORM;
+    return WSAPoll(&entry, 1, 0) > 0;
+#else
+    entry.events = POLLIN;
+    return ::poll(&entry, 1, 0) > 0;
+#endif
+}
 int ReceiveAnsweredHere(Socket& socket, std::uint64_t length) {
 #ifdef _WIN32
     {
@@ -710,7 +742,8 @@ int ReceiveAnsweredHere(Socket& socket, std::uint64_t length) {
         if (socket.receiveShut) return 0;
     }
 #endif
-    if (length != 0 || socket.type != 1) return -1;
+    if (length != 0) return -1;
+    if (socket.type != 1) return ReadableNow(socket) ? -1 : 0;
     sockaddr_storage peer{};
     socklen_t size = sizeof(peer);
     return ::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &size) == 0 ? 0 : NativeError();
@@ -1113,31 +1146,35 @@ int APS5_VABI _fcntl_nid_postfix(int descriptor, int command, ...) {
 }
 int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option,
                                     const void* value, std::uint32_t length) {
+    if (!value && length != 0) return Fail(14);
     int netError = 0;
     if (!GuestSockets::IsOpen(descriptor) && KernelSetSocketOption_nid_no_patch(descriptor, level, option, value, length, &netError)) {
         return netError == 0 ? 0 : Fail(netError);
     }
     const auto socket = Lookup(descriptor);
     if (!socket) return -1;
-    if (level != 0xffff && level != 6 && level != 41) return Fail(42);
+    if (level != 0xffff && level != 0 && level != 6 && level != 41) return Fail(22);
     std::lock_guard lock(socket->modeMutex);
     const auto native = static_cast<std::uintptr_t>(socket->value);
-    const int error = level == 6    ? GuestSockets::SetTcpLevelOption(native, socket->family != GuestUnix && socket->type == 1, option, value, length)
+    const int error = level == 0    ? GuestSockets::SetIpLevelOption(native, socket->options, socket->family == 2, socket->type == 2, option, value, length)
+                      : level == 6  ? GuestSockets::SetTcpLevelOption(native, socket->options, socket->family != GuestUnix && socket->type == 1, option, value, length)
                       : level == 41 ? GuestSockets::SetIpv6LevelOption(native, socket->family == 28, option, value, length)
-                                    : GuestSockets::SetSocketLevelOption(native, socket->options, option, value, length);
+                                    : GuestSockets::SetSocketLevelOption(native, socket->options, socket->family, socket->type, option, value, length);
     return error == 0 ? 0 : Fail(error);
 }
 int APS5_VABI getsockopt_nid_postfix(int descriptor, int level, int option,
                                     void* value, std::uint32_t* length) {
     const auto socket = Lookup(descriptor);
     if (!socket) return -1;
-    if (level != 0xffff && level != 6 && level != 41) return Fail(42);
+    if (level != 0xffff && level != 0 && level != 6 && level != 41) return Fail(22);
     if (!length) return Fail(22);
+    if (!value) *length = 0;
     std::lock_guard lock(socket->modeMutex);
     const auto native = static_cast<std::uintptr_t>(socket->value);
-    const int error = level == 6    ? GuestSockets::GetTcpLevelOption(native, socket->family != GuestUnix && socket->type == 1, option, value, length)
+    const int error = level == 0    ? GuestSockets::GetIpLevelOption(socket->options, socket->family == 2, socket->type == 2, option, value, length)
+                      : level == 6  ? GuestSockets::GetTcpLevelOption(native, socket->options, socket->family != GuestUnix && socket->type == 1, option, value, length)
                       : level == 41 ? GuestSockets::GetIpv6LevelOption(native, socket->family == 28, option, value, length)
-                                    : GuestSockets::GetSocketLevelOption(native, socket->options, socket->type, option, value, length);
+                                    : GuestSockets::GetSocketLevelOption(native, socket->options, socket->family, socket->type, option, value, length);
     return error == 0 ? 0 : Fail(error);
 }
 int APS5_VABI socket_nid_postfix(int family, int type, int protocol) {
@@ -1146,7 +1183,7 @@ int APS5_VABI socket_nid_postfix(int family, int type, int protocol) {
     if (family != 2 && family != 28) return Fail(47);
     const int nativeType = plainType == 1 ? SOCK_STREAM : plainType == 2 ? SOCK_DGRAM : -1;
     const int expectedProtocol = plainType == 1 ? 6 : 17;
-    const bool inetKnowsType = plainType == 3 || plainType == 5;
+    const bool inetKnowsType = plainType == 3;
     if (nativeType == -1) return Fail(protocol == 0 && plainType != 0 && !inetKnowsType ? 41 : 43);
     if (protocol != 0 && protocol != expectedProtocol) return Fail(43);
 #ifdef _WIN32
@@ -1159,9 +1196,17 @@ int APS5_VABI socket_nid_postfix(int family, int type, int protocol) {
     const int ipv6Only = 1;
     if (family == 28 && ::setsockopt(native, IPPROTO_IPV6, IPV6_V6ONLY, reinterpret_cast<const char*>(&ipv6Only), sizeof(ipv6Only)))
         return Fail(NativeError());
+#ifdef _WIN32
+    BOOL reportUnreachable = FALSE;
+    DWORD returned = 0;
+    if (nativeType == SOCK_DGRAM && WSAIoctl(native, SIO_UDP_CONNRESET, &reportUnreachable, sizeof(reportUnreachable), nullptr, 0,
+            &returned, nullptr, nullptr) != 0)
+        return Fail(NativeError());
+#endif
     try {
         auto socket = std::make_shared<Socket>(native, family, plainType);
         guard.value = Invalid;
+        if (family == 28) socket->options.tcpMaximumSegment = 1220;
         if (nonblocking && SetNonBlocking(*socket)) return -1;
         const int number = Install(std::move(socket));
         if (number >= 0 && (type & GuestCloseOnExec) != 0) {
@@ -1200,6 +1245,8 @@ int APS5_VABI socketpair_nid_postfix(int family, int type, int protocol, int* de
         firstGuard.value = Invalid;
         auto second = std::make_shared<Socket>(native[1], GuestUnix, plainType);
         secondGuard.value = Invalid;
+        first->peer = second;
+        second->peer = first;
         if (nonblocking && (SetNonBlocking(*first) || SetNonBlocking(*second))) return -1;
         const int firstDescriptor = Install(std::move(first));
         if (firstDescriptor < 0) return -1;
@@ -1228,15 +1275,16 @@ int APS5_VABI connect_nid_postfix(int descriptor, const void* address, std::uint
     if (socket->family != GuestUnix && socket->type == 2 && address && length >= 2 && static_cast<const unsigned char*>(address)[1] == 0
         && Disconnect(*socket) != 0)
         return -1;
+    if (socket->type == 1 && Listening(*socket)) return Fail(45);
+    const int mapped = LongMappedDualStack(*socket, address, length);
+    if (mapped < 0) return -1;
     sockaddr_storage native{};
     socklen_t size;
-    if (!Address(address, length, native, size)) return -1;
+    if (!Address(socket->family, address, mapped ? 28 : length, native, size)) return -1;
 #ifdef _WIN32
     if (socket->type == 1) RefuseClosedLoopbackAtOnce_nid_no_patch(socket->value, reinterpret_cast<const sockaddr*>(&native));
 #endif
-    if (socket->type == 1 && Listening(*socket)) return Fail(45);
     if (ZeroPortConnect(*socket, address, length)) return -1;
-    if (native.ss_family != (socket->family == 2 ? AF_INET : AF_INET6)) return Fail(47);
     {
         std::lock_guard lock(socket->modeMutex);
         socket->options.reportedError = 0;
@@ -1264,13 +1312,25 @@ int APS5_VABI accept_nid_postfix(int descriptor, void* address, std::uint32_t* l
     try {
         auto accepted = std::make_shared<Socket>(native, listener->family, listener->type);
         guard.value = Invalid;
+        if (listener->family == 28) accepted->options.tcpMaximumSegment = 1220;
         bool inheritNonblocking;
         {
             std::lock_guard modeLock(listener->modeMutex);
             inheritNonblocking = listener->options.nonblocking;
             accepted->options.noSignal = listener->options.noSignal;
+            accepted->options.keptFlags = listener->options.keptFlags;
             accepted->options.sendTimeout = listener->options.sendTimeout;
             accepted->options.receiveTimeout = listener->options.receiveTimeout;
+            accepted->options.sendBuffer = listener->options.sendBuffer;
+            accepted->options.receiveBuffer = listener->options.receiveBuffer;
+            accepted->options.sendLowWater = listener->options.sendLowWater;
+            accepted->options.receiveLowWater = listener->options.receiveLowWater;
+            accepted->options.ipTimeToLive = listener->options.ipTimeToLive;
+            accepted->options.ipTypeOfService = listener->options.ipTypeOfService;
+            accepted->options.tcpKeepIdle = listener->options.tcpKeepIdle;
+            accepted->options.tcpKeepInterval = listener->options.tcpKeepInterval;
+            accepted->options.tcpKeepCount = listener->options.tcpKeepCount;
+            accepted->options.tcpFlags = listener->options.tcpFlags & 0x1000;
         }
         if (inheritNonblocking && SetNonBlocking(*accepted)) return -1;
         const int acceptedDescriptor = Install(std::move(accepted));
@@ -1314,14 +1374,35 @@ int APS5_VABI bind_nid_postfix(int descriptor, const void* address, std::uint32_
     if (!socket) return -1;
     sockaddr_storage native{};
     socklen_t size;
-    if (!Address(address, length, native, size)) return -1;
+    const int mapped = LongMappedDualStack(*socket, address, length);
+    if (mapped < 0) return -1;
+    if (!Address(socket->family, address, mapped ? 28 : length, native, size)) return -1;
     return ::bind(socket->value, reinterpret_cast<sockaddr*>(&native), size) ? Fail(NativeError()) : 0;
 }
+namespace {
+bool AlreadyShut(NativeSocket socket, int how) {
+#ifdef __APPLE__
+    if (errno != ENOTCONN) return false;
+    sockaddr_storage peer{};
+    socklen_t size = sizeof(peer);
+    if (::getpeername(socket, reinterpret_cast<sockaddr*>(&peer), &size)) {
+        errno = ENOTCONN;
+        return false;
+    }
+    return how != SHUT_RDWR || ::shutdown(socket, SHUT_WR) == 0 || errno == ENOTCONN;
+#else
+    (void)socket;
+    (void)how;
+    return false;
+#endif
+}
+}
+
 int APS5_VABI shutdown_nid_postfix(int descriptor, int how) {
     const auto socket = Lookup(descriptor);
     if (!socket) return -1;
     if (how < 0 || how > 2) return Fail(22);
-    if (::shutdown(socket->value, how)) return Fail(NativeError());
+    if (::shutdown(socket->value, how) && !AlreadyShut(socket->value, how)) return Fail(NativeError());
     std::lock_guard lock(socket->modeMutex);
     if (how != 1) socket->receiveShut = true;
     if (how != 0) socket->sendShut = true;
@@ -1349,6 +1430,7 @@ int APS5_VABI getsockname_nid_postfix(int descriptor, void* address, std::uint32
 int APS5_VABI getpeername_nid_postfix(int descriptor, void* address, std::uint32_t* length) {
     const auto socket = Lookup(descriptor);
     if (!socket) return -1;
+    if (socket->family == GuestUnix && socket->peer.expired()) return Fail(57);
     if (!address || !length) return Fail(14);
     if (socket->family == GuestUnix) return UnnamedAddress(address, length);
     sockaddr_storage native{};
@@ -1394,14 +1476,13 @@ std::int64_t APS5_VABI sendto_nid_postfix(int descriptor, const void* buffer, st
     if (!buffer && length) return Fail(14);
     if (const int waited = WaitForTransfer(*socket, true, flags)) return Fail(waited);
     int result;
-    if (!address) {
-        if (addressLength != 0) return Fail(22);
+    if (!address || (socket->type == 1 && PeerConnected(*socket))) {
+        if (!address && addressLength != 0) return Fail(22);
         result = ::send(socket->value, static_cast<const char*>(buffer), static_cast<int>(length), SocketSendFlags(*socket, flags));
     } else {
         sockaddr_storage native{};
         socklen_t size;
-        if (!Address(address, addressLength, native, size)) return -1;
-        if (native.ss_family != (socket->family == 2 ? AF_INET : AF_INET6)) return Fail(47);
+        if (!Address(socket->family, address, addressLength, native, size, true)) return -1;
         if (const auto answered = ZeroPortSend(*socket, native, length); answered != NotAnswered) return answered;
         result = static_cast<int>(::sendto(socket->value, static_cast<const char*>(buffer), static_cast<int>(length), SocketSendFlags(*socket, flags),
             reinterpret_cast<sockaddr*>(&native), size));
@@ -1441,19 +1522,7 @@ std::int64_t APS5_VABI recvfrom_nid_postfix(int descriptor, void* buffer, std::u
     }
     return result;
 }
-struct GuestIovec {
-    void* base;
-    std::uint64_t length;
-};
-struct GuestMsghdr {
-    void* name;
-    std::uint32_t nameLength;
-    GuestIovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
+
 static_assert(sizeof(GuestMsghdr) == 48 && offsetof(GuestMsghdr, iov) == 16 && offsetof(GuestMsghdr, control) == 32 && offsetof(GuestMsghdr, flags) == 44);
 static std::int64_t MessageLength(const GuestMsghdr* message) {
     if (!message) return Fail(14);
@@ -1555,8 +1624,8 @@ std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message,
     GuestMsghdr header{};
     if (!message || !ReadGuest(&header, message, sizeof(header))) return Fail(14);
     if (header.iovLength < 0 || header.iovLength > 1024) return Fail(40);
-    std::vector<GuestIovec> vectors(static_cast<std::size_t>(header.iovLength));
-    if (!ReadGuest(vectors.data(), header.iov, vectors.size() * sizeof(GuestIovec))) return Fail(14);
+    std::vector<KernelIovec> vectors(static_cast<std::size_t>(header.iovLength));
+    if (!ReadGuest(vectors.data(), header.iov, vectors.size() * sizeof(KernelIovec))) return Fail(14);
     header.iov = vectors.data();
     const auto total = MessageLength(&header);
     if (total < 0) return -1;
@@ -1571,22 +1640,26 @@ std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message,
         return Fail(55);
     }
     sockaddr_storage native{};
-    socklen_t size = sizeof(native);
-    if (const int waited = WaitForTransfer(*socket, false, flags)) return Fail(waited);
-    std::int64_t received = ::recvfrom(socket->value, buffer.data(), static_cast<int>(buffer.size()),
-        NativeReceiveFlags(flags, socket->type), reinterpret_cast<sockaddr*>(&native), &size);
-    if (received < 0) {
+    socklen_t size = 0;
+    std::int64_t received = 0;
+    if (total != 0 || socket->type == 1 || ReadableNow(*socket)) {
+        size = sizeof(native);
+        if (const int waited = WaitForTransfer(*socket, false, flags)) return Fail(waited);
+        received = ::recvfrom(socket->value, buffer.data(), static_cast<int>(buffer.size()),
+            NativeReceiveFlags(flags, socket->type), reinterpret_cast<sockaddr*>(&native), &size);
+        if (received < 0) {
 #ifdef _WIN32
-        if (!records || WSAGetLastError() != WSAEMSGSIZE) return Fail(NativeError());
-        received = static_cast<std::int64_t>(buffer.size());
+            if (!records || WSAGetLastError() != WSAEMSGSIZE) return Fail(NativeError());
+            received = static_cast<std::int64_t>(buffer.size());
 #else
-        return Fail(NativeError());
+            return Fail(NativeError());
 #endif
+        }
     }
-    header.flags = 0;
+    header.flags = flags;
     if (received > total) {
         received = total;
-        header.flags = 0x10;
+        header.flags |= 0x10;
     }
     std::size_t offset = 0;
     for (const auto& vector : vectors) {
@@ -1612,15 +1685,10 @@ std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message,
     if (!WriteGuest(reinterpret_cast<char*>(message) + results, reinterpret_cast<const char*>(&header) + results, sizeof(header) - results)) return Fail(14);
     return received;
 }
-struct GuestSendfileHeaders {
-    GuestIovec* headers;
-    int headerCount;
-    GuestIovec* trailers;
-    int trailerCount;
-};
+
 static_assert(sizeof(GuestSendfileHeaders) == 32 && offsetof(GuestSendfileHeaders, trailers) == 16);
-std::int64_t APS5_VABI sceKernelPread(int descriptor, void* buffer, std::size_t length, std::int64_t offset);
-static bool SendfileIovecs(const GuestIovec* iov, int count) {
+
+static bool SendfileIovecs(const KernelIovec* iov, int count) {
     if (!iov) return true;
     if (count < 0 || count > 1024) return false;
     std::uint64_t total = 0;
@@ -1642,7 +1710,7 @@ static int SendAll(const Socket& socket, const void* data, std::uint64_t length,
     }
     return 0;
 }
-static int SendIovecs(const Socket& socket, const GuestIovec* iov, int count, std::int64_t& sent) {
+static int SendIovecs(const Socket& socket, const KernelIovec* iov, int count, std::int64_t& sent) {
     for (int i = 0; iov && i < count; ++i)
         if (const int error = SendAll(socket, iov[i].base, iov[i].length, sent)) return error;
     return 0;
@@ -1653,6 +1721,12 @@ int APS5_VABI sendfile_nid_postfix(int file, int descriptor, std::int64_t offset
     if (offset < 0) return Fail(22);
     if (headers && (!SendfileIovecs(headers->headers, headers->headerCount) || !SendfileIovecs(headers->trailers, headers->trailerCount)))
         return Fail(22);
+    std::int64_t sent = 0;
+    const auto finish = [&](int error) {
+        if (sbytes) *sbytes = sent;
+        return error ? Fail(error) : 0;
+    };
+    if (DescriptorIsOpen_nid_no_patch(file) && !File::IsVnode(file) && !File::IsSharedMemoryDescriptor_nid_no_patch(file)) return finish(22);
     std::vector<char> chunk;
     try {
         chunk.resize(0x10000);
@@ -1666,11 +1740,6 @@ int APS5_VABI sendfile_nid_postfix(int file, int descriptor, std::int64_t offset
     std::uint64_t remaining = length ? length : UINT64_MAX;
     auto received = read(offset, remaining);
     if (received == -9) return Fail(9);
-    std::int64_t sent = 0;
-    const auto finish = [&](int error) {
-        if (sbytes) *sbytes = sent;
-        return error ? Fail(error) : 0;
-    };
     if (received < 0) return finish(received == -21 || received == -29 ? 22 : static_cast<int>(-received));
     const auto socket = Lookup(descriptor);
     if (!socket) return finish(*__error_nid_postfix());
@@ -1699,6 +1768,7 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
     std::vector<NativePollDescriptor> native;
     std::vector<std::uint32_t> owners;
     std::vector<std::uint32_t> pipes;
+    std::vector<std::uint32_t> kqueues;
     int ready = 0;
     for (std::uint32_t i = 0; i < count; ++i) {
         auto& entry = descriptors[i];
@@ -1717,19 +1787,23 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
                 ++ready;
                 continue;
             }
+            if (IsKqueueDescriptor(entry.descriptor)) {
+                kqueues.push_back(i);
+                continue;
+            }
             if (File::IsRandomDevice(entry.descriptor)) {
                 const short readable = static_cast<short>(entry.events & GuestPollReadable);
                 entry.revents = readable != 0 ? readable : entry.events;
                 if (entry.revents) ++ready;
                 continue;
             }
-            if (entry.descriptor <= 2) {
-                entry.revents = static_cast<short>(entry.descriptor == 0 ? 0 : entry.events & GuestPollWritable);
+            if (File::IsVnode(entry.descriptor)) {
+                entry.revents = static_cast<short>(entry.events & GuestPollVnodeReady);
                 if (entry.revents) ++ready;
                 continue;
             }
-            if (File::IsVnode(entry.descriptor)) {
-                entry.revents = static_cast<short>(entry.events & GuestPollVnodeReady);
+            if (entry.descriptor <= 2) {
+                entry.revents = static_cast<short>(entry.descriptor == 0 ? 0 : entry.events & GuestPollWritable);
                 if (entry.revents) ++ready;
                 continue;
             }
@@ -1739,7 +1813,7 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
 #else
             if (!IsPipe(entry.descriptor, entry.events))
 #endif
-                throw std::runtime_error("poll: descriptor " + std::to_string(entry.descriptor) + " is neither a socket, a pipe, a file nor a directory");
+                throw std::runtime_error("poll: descriptor " + std::to_string(entry.descriptor) + " is neither a socket, a pipe, a file, a directory nor a kqueue");
             pipes.push_back(i);
             continue;
         }
@@ -1762,7 +1836,7 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
         owners.push_back(index);
     }
 #endif
-    if (native.empty() && pipes.empty()) {
+    if (native.empty() && pipes.empty() && kqueues.empty()) {
         if (ready || timeout == 0) return ready;
         if (timeout < 0) throw std::runtime_error("poll: an infinite wait without sockets or pipes never returns");
         PreciseSleepUs(static_cast<unsigned long long>(timeout) * 1000);
@@ -1781,20 +1855,40 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
         if (pipe && (entry.revents & GuestPollError)) entry.revents = static_cast<short>((entry.revents & ~GuestPollError) | GuestPollHangUp);
         if (pipe && (entry.revents & GuestPollHangUp))
             entry.revents = static_cast<short>((entry.revents & ~GuestPollWritable) | (entry.events & GuestPollReadable));
+#ifndef _WIN32
+        if (entry.revents & GuestPollHangUp) entry.revents = static_cast<short>(entry.revents & ~GuestPollWritable);
+#endif
         if (entry.revents) ++ready;
     };
-#ifdef _WIN32
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(timeout < 0 ? 0 : timeout);
+#ifdef _WIN32
+    const bool sliced = !pipes.empty() || !kqueues.empty();
+#else
+    const bool sliced = !kqueues.empty();
+#endif
     for (;;) {
-        int pipeReady = 0;
+        int checkedReady = 0;
+#ifdef _WIN32
         for (const auto index : pipes) {
             auto& entry = descriptors[index];
             PipeReadiness(entry.descriptor, entry.events, entry.revents);
-            if (entry.revents) ++pipeReady;
+            if (entry.revents) ++checkedReady;
+        }
+#endif
+        for (const auto index : kqueues) {
+            auto& entry = descriptors[index];
+            const auto readable = KqueueReadable(entry.descriptor);
+            if (!readable && DescriptorIsOpen_nid_no_patch(entry.descriptor)) {
+                if (timeout < 0) return poll_nid_postfix(descriptors, count, -1);
+                const auto left = std::chrono::duration_cast<std::chrono::microseconds>(deadline - std::chrono::steady_clock::now()).count();
+                return poll_nid_postfix(descriptors, count, static_cast<int>(std::max<long long>(0, (left + 999) / 1000)));
+            }
+            entry.revents = !readable ? GuestPollInvalid : *readable ? static_cast<short>(entry.events & GuestPollReadable) : short{0};
+            if (entry.revents) ++checkedReady;
         }
         int slice = 0;
-        if (!ready && !pipeReady) {
-            if (pipes.empty()) slice = timeout;
+        if (!ready && !checkedReady) {
+            if (!sliced) slice = timeout;
             else if (timeout < 0) slice = 1;
             else {
                 const auto left = std::chrono::duration_cast<std::chrono::milliseconds>(deadline - std::chrono::steady_clock::now()).count();
@@ -1803,8 +1897,12 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
         }
         if (!native.empty()) {
             for (auto& request : native) request.revents = 0;
+#ifdef _WIN32
             if (WSAPoll(native.data(), static_cast<ULONG>(native.size()), slice) < 0) return Fail(NativeError());
-        } else if (!ready && !pipeReady) {
+#else
+            if (::poll(native.data(), static_cast<nfds_t>(native.size()), slice) < 0) return Fail(NativeError());
+#endif
+        } else if (!ready && !checkedReady) {
             const auto wake = std::chrono::steady_clock::now() + std::chrono::milliseconds(1);
             PreciseSleepUntil(timeout < 0 ? wake : std::min(deadline, wake));
         }
@@ -1812,22 +1910,23 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
         for (const auto& request : native)
             if (request.revents) ++socketReady;
         const bool expired = timeout >= 0 && std::chrono::steady_clock::now() >= deadline;
-        if (ready || pipeReady || socketReady || expired || pipes.empty()) {
-            ready += pipeReady;
+        if (ready || checkedReady || socketReady || expired || !sliced) {
+            ready += checkedReady;
+#ifdef _WIN32
             for (std::size_t i = 0; i < native.size(); ++i) collect(i, false);
+#else
+            for (std::size_t i = 0; i < native.size(); ++i) collect(i, i >= socketCount);
+#endif
             return ready;
         }
     }
-#else
-    const int wait = ready ? 0 : timeout;
-    const int result = ::poll(native.data(), static_cast<nfds_t>(native.size()), wait);
-    if (result < 0) return Fail(NativeError());
-    for (std::size_t i = 0; i < native.size(); ++i) collect(i, i >= socketCount);
-    return ready;
-#endif
 }
 }
 
+extern "C" bool GuestSocketReadGuest_nid_no_patch(void* destination, const void* source, std::size_t bytes) {
+    return ::ReadGuest(destination, source, bytes);
+}
+
 std::int64_t GuestSockets::Read(int descriptor, void* buffer, std::size_t length) {
     if (length == 0) return IsOpen(descriptor) ? 0 : Fail(9);
     return recv_nid_postfix(descriptor, buffer, std::min<std::size_t>(length, INT_MAX), 0);
diff --git a/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp b/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp
index 98da8ea9e9..a83f3e3c2d 100644
--- a/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp
+++ b/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <array>
 #include <atomic>
 #include <chrono>
@@ -16,8 +18,6 @@
 #include "prx/libkernel/Time/include/Time.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 constexpr int SYNC_ON_ADDRESS_OK = 0;
@@ -56,7 +56,7 @@ struct UserSemaphore {
 };
 
 struct AddressWaiter {
-    TimedWait::Condition condition;
+    TimedWait::SingleWaiterCondition condition;
     bool woken = false;
 };
 
@@ -81,15 +81,11 @@ bool IsAlignedAddress(std::uintptr_t address) {
 
 template <class TFunction>
 void DeferringDelivery(TFunction function) {
-#ifdef _WIN32
     {
         TimedWait::DeliveryDeferral deferral;
         function();
     }
     TimedWait::DeliverDeferred();
-#else
-    function();
-#endif
 }
 
 template <class TReady>
@@ -205,6 +201,7 @@ int UmtxDeadline(const void* sizeArgument, const void* timeArgument, std::option
     } else {
         KernelTimespec now{};
         clock_gettime_nid_postfix(static_cast<int>(time.clockId), &now);
+
         remaining = SaturatingNanos(time.timeout.tv_sec - now.tv_sec, time.timeout.tv_nsec - now.tv_nsec);
     }
     if (remaining < UNBOUNDED_WAIT_NANOS) {
diff --git a/core/libs/prx/libkernel/System/src/Coredump.cpp b/core/libs/prx/libkernel/System/src/Coredump.cpp
index f6502ea438..7f041e1b61 100644
--- a/core/libs/prx/libkernel/System/src/Coredump.cpp
+++ b/core/libs/prx/libkernel/System/src/Coredump.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <atomic>
@@ -48,7 +49,6 @@ int APS5_VABI sceKernelDebugWriteCppExceptionInfo(const void* exception, uint64_
     return 0;
 }
 
-
 int APS5_VABI sceCoredumpAttachUserFile(std::uint32_t userValue, const char* path) {
     if (!path || !validUserFileFlags(userValue)) return SCE_COREDUMP_ERROR_INVALID_ARGUMENT;
     if (static_cast<std::int32_t>(std::strlen(path)) < 0) return 0;
diff --git a/core/libs/prx/libkernel/System/src/Error.cpp b/core/libs/prx/libkernel/System/src/Error.cpp
index a0eb19f9b6..5b3452fd77 100644
--- a/core/libs/prx/libkernel/System/src/Error.cpp
+++ b/core/libs/prx/libkernel/System/src/Error.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cstdint>
diff --git a/core/libs/prx/libkernel/System/src/Exception.cpp b/core/libs/prx/libkernel/System/src/Exception.cpp
index 8508d317d0..73b40090f1 100644
--- a/core/libs/prx/libkernel/System/src/Exception.cpp
+++ b/core/libs/prx/libkernel/System/src/Exception.cpp
@@ -1,9 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
+#include "prx/libkernel/Time/include/TimedWait.hpp"
 #include <vector>
 #include <algorithm>
 #include <array>
@@ -26,7 +28,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" Pthread APS5_VABI scePthreadSelf();
 #ifdef _WIN32
 extern "C" void Aps5RedirectedEntryStub();
 extern "C" [[noreturn]] void Aps5RedirectedExit(CONTEXT* context, const void* vectors, void (*restore)(CONTEXT*, EXCEPTION_RECORD*));
@@ -527,7 +528,8 @@ void ToHost(const GuestMcontext& m, mcontext_t& host) {
     if (host.fpregs != nullptr) std::memcpy(host.fpregs, m.fpstate, FxsaveRegisterBytes);
 }
 
-void Deliver(int, siginfo_t*, void* context) {
+void Deliver(int signum, siginfo_t*, void* context) {
+    if (TimedWait::DeferDelivery(signum)) return;
     const auto handler = Handler(RaisedSignal);
     if (handler == nullptr) {
         static constexpr char message[] = "sceKernelRaiseException: the handler was removed before the signal was delivered\n";
@@ -679,6 +681,7 @@ int APS5_VABI sceKernelRaiseException(Pthread thread, int signum) {
  const auto handler = Handler(signum);
  if (handler == nullptr) throw std::runtime_error("sceKernelRaiseException: no handler installed for the signal");
 #ifdef _WIN32
+ if (thread->suspended.load(std::memory_order_acquire)) throw std::runtime_error("sceKernelRaiseException: the target thread is still suspended at creation");
  return RaiseOn(thread, handler, signum) ? 0 : SCE_KERNEL_ERROR_ESRCH;
 #else
  return RaiseOn(thread) ? 0 : SCE_KERNEL_ERROR_ESRCH;
diff --git a/core/libs/prx/libkernel/System/src/Getlogin.cpp b/core/libs/prx/libkernel/System/src/Getlogin.cpp
new file mode 100644
index 0000000000..c795555bcb
--- /dev/null
+++ b/core/libs/prx/libkernel/System/src/Getlogin.cpp
@@ -0,0 +1,12 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+extern "C" char* APS5_VABI getlogin_nid_postfix(void) {
+    static char logname[33];
+    if (const int error = getlogin_r_nid_postfix(logname, static_cast<int>(sizeof(logname))); error != 0) {
+        *__error_nid_postfix() = error;
+        return nullptr;
+    }
+    return logname[0] != '\0' ? logname : nullptr;
+}
diff --git a/core/libs/prx/libkernel/System/src/Login.cpp b/core/libs/prx/libkernel/System/src/Login.cpp
index 80f9eaabc9..d25e16d5b2 100644
--- a/core/libs/prx/libkernel/System/src/Login.cpp
+++ b/core/libs/prx/libkernel/System/src/Login.cpp
@@ -1,7 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cerrno>
 #include <cstring>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
 #include <system_error>
 #ifdef _WIN32
 #include <windows.h>
@@ -12,7 +17,16 @@
 #endif
 
 namespace {
+std::optional<std::string> g_loginForTest;
+
 int ReadLogin(char* output, int size) {
+    if (g_loginForTest) {
+        if (g_loginForTest->empty()) throw std::runtime_error("getlogin_r: host effective user has no account name");
+        const std::size_t length = g_loginForTest->size() + 1;
+        if (length > static_cast<std::size_t>(size)) return 34;
+        std::memcpy(output, g_loginForTest->c_str(), length);
+        return 0;
+    }
 #ifdef _WIN32
     std::array<wchar_t, UNLEN + 1> name{};
     DWORD count = static_cast<DWORD>(name.size());
@@ -43,9 +57,37 @@ int ReadLogin(char* output, int size) {
 }
 }
 
+extern "C" void LoginNameForTest_nid_no_patch(const char* name) {
+    if (name == nullptr) g_loginForTest.reset();
+    else g_loginForTest = name;
+}
+
+namespace {
+constexpr std::size_t MaxLoginName = 33;
+std::mutex sessionMutex;
+std::optional<std::string> sessionLogin;
+}
+
+extern "C" int SetLogin_nid_no_patch(const char* name) {
+    if (name == nullptr) return 14;
+    const std::size_t length = ::strnlen(name, MaxLoginName);
+    if (length == MaxLoginName) return 22;
+    std::lock_guard lock(sessionMutex);
+    sessionLogin.emplace(name, length);
+    return 0;
+}
+
 extern "C" int APS5_VABI getlogin_r_nid_postfix(char* output, int size) {
     if (size <= 0) return 34;
     if (output == nullptr) return 14;
+    {
+        std::lock_guard lock(sessionMutex);
+        if (sessionLogin) {
+            if (sessionLogin->size() + 1 > static_cast<std::size_t>(size)) return 34;
+            std::memcpy(output, sessionLogin->c_str(), sessionLogin->size() + 1);
+            return 0;
+        }
+    }
     const int saved = errno;
     const int result = ReadLogin(output, size);
     errno = saved;
diff --git a/core/libs/prx/libkernel/System/src/Notification.cpp b/core/libs/prx/libkernel/System/src/Notification.cpp
index 9d94d2b291..df976eac7f 100644
--- a/core/libs/prx/libkernel/System/src/Notification.cpp
+++ b/core/libs/prx/libkernel/System/src/Notification.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include <string>
diff --git a/core/libs/prx/libkernel/System/src/Process.cpp b/core/libs/prx/libkernel/System/src/Process.cpp
index 61b3fa2bab..42a4926f4c 100644
--- a/core/libs/prx/libkernel/System/src/Process.cpp
+++ b/core/libs/prx/libkernel/System/src/Process.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #ifndef NOMINMAX
 #define NOMINMAX
@@ -20,6 +22,11 @@
 #include <sys/syscall.h>
 #endif
 
+#ifdef _WIN32
+#include "prx/libc/include/ChildProcesses.hpp"
+#else
+#include <sys/wait.h>
+#endif
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
@@ -51,13 +58,10 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
-extern "C" int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, std::uint64_t info_size);
-
 namespace {
 
 constexpr int sceInvalidArgument = static_cast<int>(0x80020016u);
+constexpr int errnoOperationNotPermitted = 1;
 constexpr int errnoNoSuchProcess = 3;
 constexpr int errnoNoChild = 10;
 constexpr int errnoBadAddress = 14;
@@ -272,13 +276,6 @@ std::int64_t toGuestLimit(rlim_t value) {
 
 }
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
-struct GuestResourceLimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-
 namespace {
 std::mutex openFileLimitMutex;
 std::optional<GuestResourceLimit> guestOpenFileLimit;
@@ -286,27 +283,6 @@ std::mutex processLimitMutex;
 GuestResourceLimit guestProcessResourceLimit{guestProcessLimit, guestProcessLimit};
 }
 
-struct GuestResourceUsage {
-    KernelTimeval ru_utime;
-    KernelTimeval ru_stime;
-    std::int64_t ru_maxrss;
-    std::int64_t ru_ixrss;
-    std::int64_t ru_idrss;
-    std::int64_t ru_isrss;
-    std::int64_t ru_minflt;
-    std::int64_t ru_majflt;
-    std::int64_t ru_nswap;
-    std::int64_t ru_inblock;
-    std::int64_t ru_oublock;
-    std::int64_t ru_msgsnd;
-    std::int64_t ru_msgrcv;
-    std::int64_t ru_nsignals;
-    std::int64_t ru_nvcsw;
-    std::int64_t ru_nivcsw;
-};
-
-extern "C" Pthread APS5_VABI scePthreadSelf();
-
 extern "C" {
 
 // unknown data
@@ -344,6 +320,24 @@ int APS5_VABI getsid_nid_postfix(int pid) {
     return -1;
 }
 
+int APS5_VABI setpgid_nid_postfix(int pid, int pgid) {
+    if (pgid < 0) {
+        *__error_nid_postfix() = errnoInvalidArgument;
+        return -1;
+    }
+    const int self = getpid_nid_postfix();
+    if (pid != 0 && pid != self) {
+        *__error_nid_postfix() = errnoNoSuchProcess;
+        return -1;
+    }
+    *__error_nid_postfix() = errnoOperationNotPermitted;
+    return -1;
+}
+
+int APS5_VABI setpgrp_nid_postfix(int pid, int pgrp) {
+    return setpgid_nid_postfix(pid, pgrp);
+}
+
 int APS5_VABI getppid_nid_postfix(void) {
 #ifdef _WIN32
     const DWORD self = GetCurrentProcessId();
@@ -435,14 +429,60 @@ int APS5_VABI system_nid_postfix(const char* command) {
 }
 
 int APS5_VABI waitpid_nid_postfix(int pid, int* status, int options) {
-    (void)pid;
-    (void)status;
-    *__error_nid_postfix() = (static_cast<unsigned>(options) & ~freebsdWaitOptions) != 0 ? errnoInvalidArgument : errnoNoChild;
-    return -1;
+    if ((static_cast<unsigned>(options) & ~freebsdWaitOptions) != 0) {
+        *__error_nid_postfix() = errnoInvalidArgument;
+        return -1;
+    }
+#ifdef _WIN32
+    int encoded = 0;
+    const std::int64_t reaped = WaitChildProcess_nid_no_patch(pid, static_cast<unsigned>(options), &encoded);
+    if (reaped == -2) {
+        *__error_nid_postfix() = errnoNoChild;
+        return -1;
+    }
+    if (reaped == -1) return -1;
+    if (reaped == 0) return 0;
+    if (status != nullptr) *status = encoded;
+    return static_cast<int>(reaped);
+#else
+    unsigned hostOptions = static_cast<unsigned>(options) & 3u;
+    if ((static_cast<unsigned>(options) & 4u) != 0) hostOptions |= static_cast<unsigned>(WCONTINUED);
+    int encoded = 0;
+    const int result = ::waitpid(pid, &encoded, static_cast<int>(hostOptions));
+    if (result < 0) {
+        *__error_nid_postfix() = errno;
+        return -1;
+    }
+    if (result == 0) return 0;
+    if (WIFCONTINUED(encoded)) {
+        encoded = 0x13;
+    } else if (WIFSIGNALED(encoded) || WIFSTOPPED(encoded)) {
+        const int hostSignal = WIFSIGNALED(encoded) ? WTERMSIG(encoded) : WSTOPSIG(encoded);
+        int guestSignal = hostSignal;
+        switch (hostSignal) {
+        case 7: guestSignal = 10; break;
+        case 10: guestSignal = 30; break;
+        case 12: guestSignal = 31; break;
+        case 17: guestSignal = 20; break;
+        case 18: guestSignal = 19; break;
+        case 19: guestSignal = 17; break;
+        case 20: guestSignal = 18; break;
+        case 23: guestSignal = 16; break;
+        case 29: guestSignal = 23; break;
+        case 31: guestSignal = 12; break;
+        case 16:
+        case 30:
+            NotImplemented_nid_no_patch("waitpid: a child stopped or died with a signal without a guest equivalent");
+            return -1;
+        default: break;
+        }
+        encoded = WIFSTOPPED(encoded) ? ((encoded & ~0xff00) | (guestSignal << 8)) : ((encoded & ~0x7f) | guestSignal);
+    }
+    if (status != nullptr) *status = encoded;
+    return result;
+#endif
 }
 
-int APS5_VABI getrlimit_nid_postfix(int resource, GuestResourceLimit* limit);
-
 int APS5_VABI setrlimit_nid_postfix(int resource, const GuestResourceLimit* limit) {
     if (limit == nullptr) {
         *__error_nid_postfix() = guestFault;
@@ -463,6 +503,7 @@ int APS5_VABI setrlimit_nid_postfix(int resource, const GuestResourceLimit* limi
 
     GuestResourceLimit current{};
     getrlimit_nid_postfix(resource, &current);
+
     if (resource == guestRlimitNofile) {
         if (requested.rlim_max <= current.rlim_max && requested.rlim_cur <= requested.rlim_max) {
             std::lock_guard lock(openFileLimitMutex);
@@ -581,6 +622,7 @@ void APS5_VABI sceKernelSync(void) {
 
 void APS5_VABI sync_nid_postfix(void) {
     sceKernelSync();
+
 }
 
 int APS5_VABI sched_get_priority_max_nid_postfix(int policy) {
@@ -655,8 +697,12 @@ int APS5_VABI getrusage_nid_postfix(int who, GuestResourceUsage* usage) {
         *__error_nid_postfix() = guestFault;
         return -1;
     }
+    GuestResourceUsage result{};
     if (who == -1) {
-        *usage = {};
+        if (!WriteGuest(usage, &result, sizeof(result))) {
+            *__error_nid_postfix() = guestFault;
+            return -1;
+        }
         return 0;
     }
 #ifdef _WIN32
@@ -676,47 +722,37 @@ int APS5_VABI getrusage_nid_postfix(int who, GuestResourceUsage* usage) {
     };
     const auto userMicros = toMicros(user);
     const auto kernelMicros = toMicros(kernel);
-    usage->ru_utime.tv_sec = static_cast<std::int64_t>(userMicros / 1000000ULL);
-    usage->ru_utime.tv_usec = static_cast<std::int64_t>(userMicros % 1000000ULL);
-    usage->ru_stime.tv_sec = static_cast<std::int64_t>(kernelMicros / 1000000ULL);
-    usage->ru_stime.tv_usec = static_cast<std::int64_t>(kernelMicros % 1000000ULL);
-    usage->ru_maxrss = 0;
-    usage->ru_ixrss = 0;
-    usage->ru_idrss = 0;
-    usage->ru_isrss = 0;
-    usage->ru_minflt = 0;
-    usage->ru_majflt = 0;
-    usage->ru_nswap = 0;
-    usage->ru_inblock = 0;
-    usage->ru_oublock = 0;
-    usage->ru_msgsnd = 0;
-    usage->ru_msgrcv = 0;
-    usage->ru_nsignals = 0;
-    usage->ru_nvcsw = 0;
-    usage->ru_nivcsw = 0;
+    result.ru_utime.tv_sec = static_cast<std::int64_t>(userMicros / 1000000ULL);
+    result.ru_utime.tv_usec = static_cast<std::int64_t>(userMicros % 1000000ULL);
+    result.ru_stime.tv_sec = static_cast<std::int64_t>(kernelMicros / 1000000ULL);
+    result.ru_stime.tv_usec = static_cast<std::int64_t>(kernelMicros % 1000000ULL);
 #else
     struct rusage native{};
     if (::getrusage(who == 0 ? RUSAGE_SELF : RUSAGE_THREAD, &native) != 0)
         throw std::system_error(errno, std::generic_category(), "getrusage: getrusage failed");
-    usage->ru_utime.tv_sec = static_cast<std::int64_t>(native.ru_utime.tv_sec);
-    usage->ru_utime.tv_usec = static_cast<std::int64_t>(native.ru_utime.tv_usec);
-    usage->ru_stime.tv_sec = static_cast<std::int64_t>(native.ru_stime.tv_sec);
-    usage->ru_stime.tv_usec = static_cast<std::int64_t>(native.ru_stime.tv_usec);
-    usage->ru_maxrss = static_cast<std::int64_t>(native.ru_maxrss);
-    usage->ru_ixrss = static_cast<std::int64_t>(native.ru_ixrss);
-    usage->ru_idrss = static_cast<std::int64_t>(native.ru_idrss);
-    usage->ru_isrss = static_cast<std::int64_t>(native.ru_isrss);
-    usage->ru_minflt = static_cast<std::int64_t>(native.ru_minflt);
-    usage->ru_majflt = static_cast<std::int64_t>(native.ru_majflt);
-    usage->ru_nswap = static_cast<std::int64_t>(native.ru_nswap);
-    usage->ru_inblock = static_cast<std::int64_t>(native.ru_inblock);
-    usage->ru_oublock = static_cast<std::int64_t>(native.ru_oublock);
-    usage->ru_msgsnd = static_cast<std::int64_t>(native.ru_msgsnd);
-    usage->ru_msgrcv = static_cast<std::int64_t>(native.ru_msgrcv);
-    usage->ru_nsignals = static_cast<std::int64_t>(native.ru_nsignals);
-    usage->ru_nvcsw = static_cast<std::int64_t>(native.ru_nvcsw);
-    usage->ru_nivcsw = static_cast<std::int64_t>(native.ru_nivcsw);
+    result.ru_utime.tv_sec = static_cast<std::int64_t>(native.ru_utime.tv_sec);
+    result.ru_utime.tv_usec = static_cast<std::int64_t>(native.ru_utime.tv_usec);
+    result.ru_stime.tv_sec = static_cast<std::int64_t>(native.ru_stime.tv_sec);
+    result.ru_stime.tv_usec = static_cast<std::int64_t>(native.ru_stime.tv_usec);
+    result.ru_maxrss = static_cast<std::int64_t>(native.ru_maxrss);
+    result.ru_ixrss = static_cast<std::int64_t>(native.ru_ixrss);
+    result.ru_idrss = static_cast<std::int64_t>(native.ru_idrss);
+    result.ru_isrss = static_cast<std::int64_t>(native.ru_isrss);
+    result.ru_minflt = static_cast<std::int64_t>(native.ru_minflt);
+    result.ru_majflt = static_cast<std::int64_t>(native.ru_majflt);
+    result.ru_nswap = static_cast<std::int64_t>(native.ru_nswap);
+    result.ru_inblock = static_cast<std::int64_t>(native.ru_inblock);
+    result.ru_oublock = static_cast<std::int64_t>(native.ru_oublock);
+    result.ru_msgsnd = static_cast<std::int64_t>(native.ru_msgsnd);
+    result.ru_msgrcv = static_cast<std::int64_t>(native.ru_msgrcv);
+    result.ru_nsignals = static_cast<std::int64_t>(native.ru_nsignals);
+    result.ru_nvcsw = static_cast<std::int64_t>(native.ru_nvcsw);
+    result.ru_nivcsw = static_cast<std::int64_t>(native.ru_nivcsw);
 #endif
+    if (!WriteGuest(usage, &result, sizeof(result))) {
+        *__error_nid_postfix() = guestFault;
+        return -1;
+    }
     return 0;
 }
 
@@ -827,6 +863,7 @@ int APS5_VABI setpriority_nid_postfix(int which, int who, int niceval) {
 int APS5_VABI getdtablesize_nid_postfix(void) {
     GuestResourceLimit limit{};
     getrlimit_nid_postfix(guestRlimitNofile, &limit);
+
     std::int64_t tableSize = limit.rlim_cur;
 #ifndef _WIN32
     tableSize = std::min(tableSize, static_cast<std::int64_t>(::getdtablesize()));
diff --git a/core/libs/prx/libkernel/System/src/Rtld.cpp b/core/libs/prx/libkernel/System/src/Rtld.cpp
index 90472da544..cbce3c4e09 100644
--- a/core/libs/prx/libkernel/System/src/Rtld.cpp
+++ b/core/libs/prx/libkernel/System/src/Rtld.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <array>
@@ -35,15 +36,13 @@ const void* imageContaining(const void* address, bool reference, void*& handle,
 #ifdef _WIN32
     const DWORD flags = GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | (reference ? 0 : GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT);
     HMODULE module = nullptr;
-    if (!GetModuleHandleExW(flags, reinterpret_cast<LPCWSTR>(address), &module))
-        throw std::runtime_error(std::string(caller) + ": address outside every loaded image");
+    if (!GetModuleHandleExW(flags, reinterpret_cast<LPCWSTR>(address), &module)) return nullptr;
     if (reference) handle = module;
     return module;
 #else
     Dl_info info{};
     link_map* image = nullptr;
-    if (!dladdr1(address, &info, reinterpret_cast<void**>(&image), RTLD_DL_LINKMAP) || !image)
-        throw std::runtime_error(std::string(caller) + ": address outside every loaded image");
+    if (!dladdr1(address, &info, reinterpret_cast<void**>(&image), RTLD_DL_LINKMAP) || !image) return nullptr;
     if (reference && image->l_name && *image->l_name) {
         handle = dlopen(image->l_name, RTLD_LAZY | RTLD_NOLOAD);
         if (!handle) throw std::runtime_error(std::string(caller) + ": cannot reference " + image->l_name);
@@ -55,6 +54,7 @@ const void* imageContaining(const void* address, bool reference, void*& handle,
 int referenceThreadAtexitImage(const void* address, const char* caller) {
     void* handle = nullptr;
     const void* image = imageContaining(address, true, handle, caller);
+    if (!image) return -1;
     std::lock_guard lock(threadAtexitMutex);
     threadAtexitReferences.emplace(image, handle);
     return 0;
@@ -63,6 +63,7 @@ int referenceThreadAtexitImage(const void* address, const char* caller) {
 int releaseThreadAtexitImage(const void* address, const char* caller) {
     void* handle = nullptr;
     const void* image = imageContaining(address, false, handle, caller);
+    if (!image) return 0;
     {
         std::lock_guard lock(threadAtexitMutex);
         const auto found = threadAtexitReferences.find(image);
diff --git a/core/libs/prx/libkernel/System/src/Sandbox.cpp b/core/libs/prx/libkernel/System/src/Sandbox.cpp
index dd3918c68a..e904dc5942 100644
--- a/core/libs/prx/libkernel/System/src/Sandbox.cpp
+++ b/core/libs/prx/libkernel/System/src/Sandbox.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 extern "C" const char* APS5_VABI sceKernelGetFsSandboxRandomWord() {
diff --git a/core/libs/prx/libkernel/System/src/Sanitizer.cpp b/core/libs/prx/libkernel/System/src/Sanitizer.cpp
index 0586eef7d7..15ff3e040f 100644
--- a/core/libs/prx/libkernel/System/src/Sanitizer.cpp
+++ b/core/libs/prx/libkernel/System/src/Sanitizer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 
 extern "C" {
diff --git a/core/libs/prx/libkernel/System/src/SignalSets.cpp b/core/libs/prx/libkernel/System/src/SignalSets.cpp
index 688ad49ce8..8444422f5d 100644
--- a/core/libs/prx/libkernel/System/src/SignalSets.cpp
+++ b/core/libs/prx/libkernel/System/src/SignalSets.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -5,11 +7,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
 static_assert(sizeof(GuestSignalSet) == 16);
 
 namespace {
diff --git a/core/libs/prx/libkernel/System/src/Signals.cpp b/core/libs/prx/libkernel/System/src/Signals.cpp
index 0137030675..091f1db7d4 100644
--- a/core/libs/prx/libkernel/System/src/Signals.cpp
+++ b/core/libs/prx/libkernel/System/src/Signals.cpp
@@ -1,5 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libc/include/JumpBuffer.hpp"
 #include "prx/libkernel/Pthread/Posix/Common.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -17,25 +20,12 @@
 #include <string>
 #include <thread>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI getpid_nid_postfix(void);
-extern "C" Pthread APS5_VABI scePthreadSelf(void);
-
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-
-struct GuestSigaction {
-    std::uintptr_t handler;
-    int flags;
-    GuestSignalSet mask;
-};
 static_assert(sizeof(GuestSigaction) == 32 && offsetof(GuestSigaction, flags) == 8 && offsetof(GuestSigaction, mask) == 12);
 
 extern "C" GuestSignalSet _sigintr_nid_postfix{};
 
 namespace {
-using GuestHandler = void (APS5_VABI *)(int);
+
 constexpr int MaxSignal = 128;
 constexpr int GuestSigkill = 9;
 constexpr int GuestSigstop = 17;
@@ -43,12 +33,20 @@ constexpr std::uint32_t UnblockableSignals = (1u << (GuestSigkill - 1)) | (1u <<
 constexpr int GuestSigalrm = 14;
 constexpr int GuestSigcont = 19;
 constexpr int SaRestart = 0x2;
+constexpr int SaResethand = 0x4;
+constexpr int SaNodefer = 0x10;
 constexpr int SaSiginfo = 0x40;
 constexpr int SaDefinedFlags = 0x7f;
 std::atomic<GuestHandler> handlers[MaxSignal + 1]{};
+std::atomic<std::uint32_t> handlerMasks[MaxSignal + 1][4]{};
+std::atomic<int> handlerFlags[MaxSignal + 1]{};
+std::atomic<bool> handlerReset[MaxSignal + 1]{};
 static_assert(std::atomic<GuestHandler>::is_always_lock_free);
 std::atomic<std::uint32_t> blockedMask{0};
 std::atomic<std::uint32_t> blockedMaskExtra[3]{};
+std::atomic<std::uint64_t> handlerHolds[MaxSignal + 1]{};
+constexpr std::uint64_t HoldCount = 0xffffffffu;
+thread_local std::uint32_t holdReleases[MaxSignal + 1]{};
 static_assert(std::atomic<std::uint32_t>::is_always_lock_free);
 std::mutex registration;
 GuestSigaction dispositions[MaxSignal + 1]{};
@@ -75,11 +73,8 @@ struct GuestSiginfo {
 static_assert(sizeof(GuestSiginfo) == 80 && offsetof(GuestSiginfo, code) == 8 && offsetof(GuestSiginfo, pid) == 12 &&
     offsetof(GuestSiginfo, uid) == 16 && offsetof(GuestSiginfo, address) == 24 && offsetof(GuestSiginfo, value) == 32 &&
     offsetof(GuestSiginfo, band) == 40);
-struct GuestTimespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
-static_assert(sizeof(GuestTimespec) == 16 && offsetof(GuestTimespec, nanoseconds) == 8);
+
+static_assert(sizeof(KernelTimespec) == 16 && offsetof(KernelTimespec, tv_nsec) == 8);
 bool IgnoredByDefault(int guest) {
     return guest == 16 || guest == GuestSigcont || guest == 20 || guest == 23 || guest == 28 || guest == 29;
 }
@@ -87,11 +82,29 @@ std::uint32_t SignalBit(int guest) { return 1u << ((guest - 1) % 32); }
 std::uint32_t SignalWord(int guest) { return static_cast<std::uint32_t>((guest - 1) / 32); }
 bool SignalInSet(const GuestSignalSet& set, int guest) { return (set.bits[SignalWord(guest)] & SignalBit(guest)) != 0; }
 bool SetHasSignal(const GuestSignalSet& set) { return (set.bits[0] | set.bits[1] | set.bits[2] | set.bits[3]) != 0; }
+bool HeldByHandler(int guest) { return (handlerHolds[guest].load() & HoldCount) != 0; }
+void ReleaseHold(int guest, std::uint32_t epoch) {
+    auto value = handlerHolds[guest].load();
+    while ((value >> 32) == epoch && (value & HoldCount) != 0 && !handlerHolds[guest].compare_exchange_weak(value, value - 1)) {}
+}
+void ClearHold(int guest) {
+    auto value = handlerHolds[guest].load();
+    while ((value & HoldCount) != 0 && !handlerHolds[guest].compare_exchange_weak(value, ((value >> 32) + 1) << 32)) {}
+}
+std::uint32_t HeldWord(int word) {
+    std::uint32_t held = 0;
+    for (int bit = 0; bit < 32; ++bit)
+        if (HeldByHandler(word * 32 + bit + 1)) held |= 1u << bit;
+    return held;
+}
+std::uint32_t BlockedWord(int word) {
+    return (word == 0 ? blockedMask.load() : blockedMaskExtra[word - 1].load()) | HeldWord(word);
+}
 bool SignalBlocked(int guest) {
     if (guest < 1 || guest > MaxSignal) return false;
     const auto word = SignalWord(guest);
     const auto mask = word == 0 ? blockedMask.load() : blockedMaskExtra[word - 1].load();
-    return (mask & SignalBit(guest)) != 0;
+    return (mask & SignalBit(guest)) != 0 || HeldByHandler(guest);
 }
 
 struct PendingSignals {
@@ -124,6 +137,10 @@ bool TakePending(int guest) {
     return (word.fetch_and(~bit, std::memory_order_relaxed) & bit) != 0;
 }
 
+void DiscardPendingIfIgnored(int guest, const GuestSigaction& action) {
+    if (action.handler == 1 || (action.handler == 0 && IgnoredByDefault(guest))) TakePending(guest);
+}
+
 bool PendingInSet(const GuestSignalSet& set, int* guest) {
     for (int candidate = 1; candidate <= MaxSignal; ++candidate) {
         if (!SignalInSet(set, candidate) || !TakePending(candidate)) continue;
@@ -152,6 +169,41 @@ int NativeSignal(int guest) {
         default: return 0;
     }
 }
+void ResetToDefault(int guest) {
+    handlerReset[guest].store(true);
+    handlers[guest].store(nullptr);
+    if (const int native = NativeSignal(guest)) std::signal(native, SIG_DFL);
+}
+void RunHandler(int guest, GuestHandler handler) {
+    const int flags = handlerFlags[guest].load();
+    std::uint32_t mask[4];
+    for (int word = 0; word < 4; ++word) mask[word] = handlerMasks[guest][word].load();
+    if ((flags & SaNodefer) == 0) mask[SignalWord(guest)] |= SignalBit(guest);
+    mask[0] &= ~UnblockableSignals;
+    if ((flags & SaResethand) != 0) ResetToDefault(guest);
+    std::uint32_t before[4];
+    for (int word = 0; word < 4; ++word) before[word] = (word == 0 ? blockedMask.load() : blockedMaskExtra[word - 1].load()) & mask[word];
+    std::uint32_t epochs[MaxSignal + 1]{};
+    std::uint32_t releases[MaxSignal + 1]{};
+    for (int held = 1; held <= MaxSignal; ++held) {
+        if ((mask[SignalWord(held)] & SignalBit(held)) == 0) continue;
+        releases[held] = holdReleases[held];
+        epochs[held] = static_cast<std::uint32_t>(handlerHolds[held].fetch_add(1) >> 32);
+    }
+    handler(guest);
+    std::uint32_t replaced[4]{};
+    for (int held = 1; held <= MaxSignal; ++held) {
+        if ((mask[SignalWord(held)] & SignalBit(held)) == 0) continue;
+        if (holdReleases[held] != releases[held]) replaced[SignalWord(held)] |= SignalBit(held);
+        ReleaseHold(held, epochs[held]);
+    }
+    for (int word = 0; word < 4; ++word) {
+        if (replaced[word] == 0) continue;
+        auto& target = word == 0 ? blockedMask : blockedMaskExtra[word - 1];
+        target.fetch_and(~(replaced[word] & ~before[word]));
+        target.fetch_or(replaced[word] & before[word]);
+    }
+}
 void Dispatch(int native) {
     int guest = 0;
     for (int candidate : {2, 4, 6, 8, 11, 15})
@@ -166,12 +218,15 @@ void Dispatch(int native) {
         return;
     }
     const auto callback = handlers[guest].load();
-    if (reinterpret_cast<std::uintptr_t>(callback) > 1) callback(guest);
+    if (reinterpret_cast<std::uintptr_t>(callback) > 1) RunHandler(guest, callback);
 }
 bool Delivered(const GuestSigaction& action) {
     return action.handler > 1 && (action.flags & SaSiginfo) == 0;
 }
 bool Install(int guest, const GuestSigaction& action) {
+    handlerReset[guest].store(false);
+    for (int word = 0; word < 4; ++word) handlerMasks[guest][word].store(action.mask.bits[word]);
+    handlerFlags[guest].store(action.flags);
     const int native = NativeSignal(guest);
     if (!native) return true;
     const auto previous = handlers[guest].exchange(Delivered(action) ? reinterpret_cast<GuestHandler>(action.handler) : nullptr);
@@ -186,8 +241,15 @@ bool Install(int guest, const GuestSigaction& action) {
 
 namespace {
 
+void SettleReset(int guest) {
+    if (!handlerReset[guest].exchange(false)) return;
+    dispositions[guest].handler = 0;
+    dispositions[guest].flags &= ~SaSiginfo;
+}
+
 GuestSigaction Disposition(int guest) {
     std::lock_guard lock(registration);
+    SettleReset(guest);
     return dispositions[guest];
 }
 
@@ -230,13 +292,22 @@ bool DeliverPendingSignal(int guest) {
         return action.handler > 1;
     }
     if (action.handler > 1) {
-        reinterpret_cast<GuestHandler>(action.handler)(guest);
+        RunHandler(guest, reinterpret_cast<GuestHandler>(action.handler));
         return true;
     }
     return false;
 }
 
-int WaitForPendingInSet(const GuestSignalSet& set, bool waitForever, const GuestTimespec* timeout, int* guest) {
+bool DeliverUnblockedPending() {
+    bool caught = false;
+    for (int guest = 1; guest <= MaxSignal; ++guest) {
+        if (SignalBlocked(guest) || !Deliverable(guest) || !TakePending(guest)) continue;
+        if (DeliverPendingSignal(guest)) caught = true;
+    }
+    return caught;
+}
+
+int WaitForPendingInSet(const GuestSignalSet& set, bool waitForever, const KernelTimespec* timeout, int* guest) {
     auto& pending = Pending();
     std::unique_lock lock(pending.lock);
     std::optional<std::chrono::steady_clock::time_point> deadline;
@@ -246,8 +317,8 @@ int WaitForPendingInSet(const GuestSignalSet& set, bool waitForever, const Guest
             pending.changed.wait(lock);
             continue;
         }
-        if (!deadline) deadline = std::chrono::steady_clock::now() + std::chrono::seconds(timeout->seconds) +
-            std::chrono::nanoseconds(timeout->nanoseconds);
+        if (!deadline) deadline = std::chrono::steady_clock::now() + std::chrono::seconds(timeout->tv_sec) +
+            std::chrono::nanoseconds(timeout->tv_nsec);
         if (pending.changed.wait_until(lock, *deadline) == std::cv_status::no_timeout) continue;
         return PendingInSet(set, guest) ? 0 : GuestEagain;
     }
@@ -275,8 +346,6 @@ void WaitForDeliverableSignal() {
     }
 }
 
-extern "C" int APS5_VABI _sigprocmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet);
-
 }
 
 namespace {
@@ -373,10 +442,6 @@ extern "C" unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int seconds)
     return remaining;
 }
 
-struct GuestItimerval {
-    KernelTimeval interval;
-    KernelTimeval value;
-};
 static_assert(sizeof(GuestItimerval) == 32 && offsetof(GuestItimerval, value) == 16);
 
 extern "C" int APS5_VABI getitimer_nid_postfix(int which, GuestItimerval* output) {
@@ -468,11 +533,6 @@ extern "C" int APS5_VABI setitimer_nid_postfix(int which, const GuestItimerval*
     return 0;
 }
 
-struct GuestStack {
-    void* sp;
-    std::size_t size;
-    int flags;
-};
 static_assert(sizeof(GuestStack) == 24 && offsetof(GuestStack, flags) == 16);
 namespace {
 constexpr int SsDisable = 4;
@@ -480,15 +540,66 @@ constexpr std::size_t MinSignalStackSize = 2048;
 thread_local GuestStack alternateStack{nullptr, 0, SsDisable};
 }
 
+namespace {
+
+int ChangeBlockedMask(int how, const GuestSignalSet* set, GuestSignalSet* previousSet, bool releaseHolds, bool* caught = nullptr) {
+    if (set != nullptr && (how < 1 || how > 3)) { *__error_nid_postfix() = 22; return -1; }
+    {
+        std::lock_guard lock(registration);
+        if (previousSet != nullptr)
+            for (int word = 0; word < 4; ++word) previousSet->bits[word] = BlockedWord(word);
+        if (set != nullptr) {
+            switch (how) {
+                case 1:
+                    blockedMask.fetch_or(set->bits[0] & ~UnblockableSignals);
+                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_or(set->bits[word]);
+                    break;
+                case 2:
+                    blockedMask.fetch_and(~set->bits[0]);
+                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_and(~set->bits[word]);
+                    if (releaseHolds)
+                        for (int guest = 1; guest <= MaxSignal; ++guest) {
+                            if (!SignalInSet(*set, guest)) continue;
+                            ClearHold(guest);
+                            ++holdReleases[guest];
+                        }
+                    break;
+                case 3:
+                    blockedMask.store(set->bits[0] & ~UnblockableSignals);
+                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].store(set->bits[word]);
+                    if (releaseHolds)
+                        for (int guest = 1; guest <= MaxSignal; ++guest) {
+                            ClearHold(guest);
+                            ++holdReleases[guest];
+                        }
+                    break;
+            }
+        }
+    }
+    std::atomic_thread_fence(std::memory_order_seq_cst);
+    if (DeliverUnblockedPending() && caught != nullptr) *caught = true;
+    return 0;
+}
+
+}
+
+extern "C" int APS5_VABI SetSignalMaskCatching_nid_no_patch(const GuestSignalSet* set, GuestSignalSet* previousSet) {
+    bool caught = false;
+    ChangeBlockedMask(GuestSigsetmask, set, previousSet, true, &caught);
+    return caught ? 1 : 0;
+}
+
 extern "C" {
 GuestHandler APS5_VABI signal_nid_postfix(int guest, GuestHandler handler) {
     const auto invalid = reinterpret_cast<GuestHandler>(static_cast<std::uintptr_t>(-1));
     if (guest < 1 || guest > MaxSignal || ((guest == GuestSigkill || guest == GuestSigstop) && handler != nullptr)) { *__error_nid_postfix() = 22; return invalid; }
     std::lock_guard lock(registration);
+    SettleReset(guest);
     const GuestSigaction action{reinterpret_cast<std::uintptr_t>(handler), SignalInSet(_sigintr_nid_postfix, guest) ? 0 : SaRestart, {}};
     if (!Install(guest, action)) { *__error_nid_postfix() = 22; return invalid; }
     const auto previous = reinterpret_cast<GuestHandler>(dispositions[guest].handler);
     dispositions[guest] = action;
+    DiscardPendingIfIgnored(guest, action);
     return previous;
 }
 int APS5_VABI sigaction_nid_postfix(int guest, const GuestSigaction* action, GuestSigaction* previous) {
@@ -496,10 +607,12 @@ int APS5_VABI sigaction_nid_postfix(int guest, const GuestSigaction* action, Gue
     if (action && action->handler > 1 && (action->flags & ~SaDefinedFlags) != 0) { *__error_nid_postfix() = 22; return -1; }
     if (action && (guest == GuestSigkill || guest == GuestSigstop) && action->handler != 0) { *__error_nid_postfix() = 22; return -1; }
     std::lock_guard lock(registration);
+    SettleReset(guest);
     const GuestSigaction old = dispositions[guest];
     if (action) {
         if (!Install(guest, *action)) { *__error_nid_postfix() = 22; return -1; }
         dispositions[guest] = *action;
+        DiscardPendingIfIgnored(guest, *action);
     }
     if (previous) *previous = old;
     return 0;
@@ -521,11 +634,13 @@ int APS5_VABI raise_nid_postfix(int guest) {
     const int native = NativeSignal(guest);
     if (native != 0) {
         const int result = std::raise(native);
-        if (result) *__error_nid_postfix() = 22;
-        return result ? -1 : 0;
+        if (result) { *__error_nid_postfix() = 22; return -1; }
+        DeliverUnblockedPending();
+        return 0;
     }
     if (!CaughtByGuest(guest)) { *__error_nid_postfix() = 22; return -1; }
     DeliverPendingSignal(guest);
+    DeliverUnblockedPending();
     return 0;
 }
 int APS5_VABI kill_nid_postfix(int pid, int guest) {
@@ -560,36 +675,7 @@ int APS5_VABI sigaltstack_nid_postfix(const GuestStack* stack, GuestStack* previ
     return 0;
 }
 int APS5_VABI _sigprocmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet) {
-    if (set != nullptr && (how < 1 || how > 3)) { *__error_nid_postfix() = 22; return -1; }
-    {
-        std::lock_guard lock(registration);
-        if (previousSet != nullptr) {
-            previousSet->bits[0] = blockedMask.load();
-            for (int word = 1; word < 4; ++word) previousSet->bits[word] = blockedMaskExtra[word - 1].load();
-        }
-        if (set != nullptr) {
-            switch (how) {
-                case 1:
-                    blockedMask.fetch_or(set->bits[0] & ~UnblockableSignals);
-                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_or(set->bits[word]);
-                    break;
-                case 2:
-                    blockedMask.fetch_and(~set->bits[0]);
-                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_and(~set->bits[word]);
-                    break;
-                case 3:
-                    blockedMask.store(set->bits[0] & ~UnblockableSignals);
-                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].store(set->bits[word]);
-                    break;
-            }
-        }
-    }
-    std::atomic_thread_fence(std::memory_order_seq_cst);
-    for (int guest = 1; guest <= MaxSignal; ++guest) {
-        if (SignalBlocked(guest) || !Deliverable(guest) || !TakePending(guest)) continue;
-        DeliverPendingSignal(guest);
-    }
-    return 0;
+    return ChangeBlockedMask(how, set, previousSet, true);
 }
 
 int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet) {
@@ -602,9 +688,9 @@ int APS5_VABI pthread_sigmask_nid_postfix(int how, const GuestSignalSet* set, Gu
     return _sigprocmask_nid_postfix(how, set, previousSet);
 }
 
-int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet* set, void* info, const GuestTimespec* timeout) {
+int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet* set, void* info, const KernelTimespec* timeout) {
     if (set == nullptr || !SetHasSignal(*set)) { *__error_nid_postfix() = 22; return -1; }
-    if (timeout != nullptr && (timeout->nanoseconds < 0 || timeout->nanoseconds >= 1000000000) && !PendingInSetPresent(*set)) {
+    if (timeout != nullptr && (timeout->tv_nsec < 0 || timeout->tv_nsec >= 1000000000) && !PendingInSetPresent(*set)) {
         *__error_nid_postfix() = 22;
         return -1;
     }
@@ -647,7 +733,8 @@ int APS5_VABI sigsuspend_nid_postfix(const GuestSignalSet* set) {
         for (int word = 1; word < 4; ++word) previous.bits[word] = blockedMaskExtra[word - 1].exchange(set->bits[word]);
     }
     WaitForDeliverableSignal();
-    _sigprocmask_nid_postfix(GuestSigsetmask, &previous, nullptr);
+    ChangeBlockedMask(GuestSigsetmask, &previous, nullptr, false);
+
     *__error_nid_postfix() = GuestEintr;
     return -1;
 }
@@ -660,9 +747,8 @@ int APS5_VABI sigpending_nid_postfix(GuestSignalSet* set) {
     if (set == nullptr) { *__error_nid_postfix() = 14; return -1; }
     auto& pending = Pending();
     std::lock_guard lock(pending.lock);
-    set->bits[0] = pending.words[0].load(std::memory_order_relaxed) & blockedMask.load();
-    for (int word = 1; word < 4; ++word)
-        set->bits[word] = pending.words[word].load(std::memory_order_relaxed) & blockedMaskExtra[word - 1].load();
+    for (int word = 0; word < 4; ++word)
+        set->bits[word] = pending.words[word].load(std::memory_order_relaxed) & BlockedWord(word);
     return 0;
 }
 }
@@ -675,3 +761,18 @@ int APS5_VABI _is_signal_return_nid_postfix(std::uint64_t programCounter) {
 }
 
 }
+
+namespace {
+
+[[maybe_unused]] const bool RegisteredForJumps = [] {
+    JumpBuffer::GuestSigprocmaskRegister_nid_no_patch(sigprocmask_nid_postfix);
+    return true;
+}();
+
+struct RegisterSignalsOnLoad {
+    RegisterSignalsOnLoad() {
+        RegisterSigaction_nid_no_patch(reinterpret_cast<SigactionFn_nid_no_patch>(sigaction_nid_postfix), _sigintr_nid_postfix.bits);
+    }
+};
+const RegisterSignalsOnLoad gRegisterSignals;
+}
diff --git a/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp b/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp
index 6f834ce2ff..9c6bf6029c 100644
--- a/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp
+++ b/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp
@@ -1,15 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
 
-struct SceKernelProsperoSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
-
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, size) == 0x00);
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, versionString) == 0x08);
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, version) == 0x24);
diff --git a/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp b/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
index c0f33a4450..61c40e0f27 100644
--- a/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
+++ b/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
@@ -1,17 +1,23 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libkernel/System/include/HostCpu.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
+#include <iterator>
 #include <random>
 #include <stdexcept>
 #include <string>
+#include <string_view>
 #include <vector>
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
@@ -20,22 +26,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI getpid_nid_postfix();
-extern "C" std::uint64_t APS5_VABI sceKernelGetTscFrequency(void);
-struct GuestRlimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-extern "C" int APS5_VABI getrlimit_nid_postfix(int resource, GuestRlimit* limit);
-
-struct SceKernelSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
-extern "C" int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, uint64_t info_size);
-
 namespace {
 
 int CopyOut(const void* value, std::size_t size, void* oldValue, std::size_t* oldLength) {
@@ -44,7 +34,7 @@ int CopyOut(const void* value, std::size_t size, void* oldValue, std::size_t* ol
         return 0;
     }
     const std::size_t copied = std::min(oldLength != nullptr ? *oldLength : 0, size);
-    std::memcpy(oldValue, value, copied);
+    if (copied != 0) std::memcpy(oldValue, value, copied);
     if (oldLength != nullptr) *oldLength = copied;
     if (copied < size) {
         *__error_nid_postfix() = 12;
@@ -92,7 +82,33 @@ const SystemInteger* FindSystemInteger(const int* name) {
 }
 
 bool IsLeafMib(const int* name) {
-    return FindSystemInteger(name) != nullptr || (name[0] == 6 && (name[1] == 2 || name[1] == 3 || name[1] == 5 || name[1] == 7)) || (name[0] == 1 && (name[1] == 37 || name[1] == 50));
+    return FindSystemInteger(name) != nullptr || (name[0] == 6 && (name[1] == 2 || name[1] == 3 || name[1] == 5 || name[1] == 7)) || (name[0] == 1 && (name[1] == 21 || name[1] == 37 || name[1] == 50));
+}
+
+KernelTimeval BootTime() {
+    static const KernelTimeval bootTime = [] {
+        KernelTimespec now{};
+        KernelTimespec uptime{};
+        if (clock_gettime_nid_postfix(0, &now) != 0 || clock_gettime_nid_postfix(5, &uptime) != 0) throw std::runtime_error("kern.boottime: reading CLOCK_REALTIME or CLOCK_UPTIME failed");
+        const std::int64_t nanos = (now.tv_sec - uptime.tv_sec) * 1000000000LL + now.tv_nsec - uptime.tv_nsec;
+        return KernelTimeval{nanos / 1000000000LL, nanos % 1000000000LL / 1000LL};
+    }();
+    return bootTime;
+}
+
+constexpr std::size_t MaximumSysctlName = 1024;
+
+int TopLevelNode(std::string_view name) {
+    static constexpr std::string_view nodes[] = {"sysctl", "kern", "vm", "vfs", "net", "debug", "hw", "machdep", "user", "p1003_1b"};
+    for (std::size_t i = 0; i < std::size(nodes); ++i)
+        if (name == nodes[i]) return static_cast<int>(i);
+    return -1;
+}
+
+std::string WithoutTrailingDot(const char* name) {
+    std::string_view view(name);
+    if (!view.empty() && view.back() == '.') view.remove_suffix(1);
+    return std::string(view);
 }
 
 bool IsMeasuredAbsentMib(const int* name, std::uint32_t nameLength) {
@@ -192,7 +208,7 @@ std::int64_t APS5_VABI sysconf_nid_postfix(int name) {
             result = 128;
             break;
         case 5: { // _SC_OPEN_MAX
-            GuestRlimit limit{};
+            GuestResourceLimit limit{};
             if (getrlimit_nid_postfix(8, &limit) == 0) {
                 result = limit.rlim_cur;
             }
@@ -354,6 +370,14 @@ int APS5_VABI sysctl_nid_postfix(const int* name, std::uint32_t nameLength, void
         const auto entries = GuestVmEntries();
         return CopyOut(entries.data(), entries.size() * sizeof(GuestVmEntry), oldValue, oldLength);
     }
+    if (nameLength == 2 && name[0] == 1 && name[1] == 21) {
+        if (newValue != nullptr) {
+            *__error_nid_postfix() = 1;
+            return -1;
+        }
+        const KernelTimeval bootTime = BootTime();
+        return CopyOut(&bootTime, sizeof(bootTime), oldValue, oldLength);
+    }
     if (nameLength == 2 && name[0] == 1 && name[1] == 37) {
         if (newValue != nullptr) {
             *__error_nid_postfix() = 1;
@@ -382,6 +406,11 @@ int APS5_VABI sysctl_nid_postfix(const int* name, std::uint32_t nameLength, void
         *__error_nid_postfix() = 20;
         return -1;
     }
+    if (name[0] < 0 || (name[0] >= 10 && name[0] < 256)) {
+        if (newValue != nullptr) throw std::runtime_error(std::string(__func__) + ": writing MIB under absent top-level node " + std::to_string(name[0]));
+        *__error_nid_postfix() = 2;
+        return -1;
+    }
     std::string mib;
     for (std::uint32_t i = 0; i < nameLength; ++i) mib += (i == 0 ? "" : ".") + std::to_string(name[i]);
     throw std::runtime_error(std::string(__func__) + ": unsupported MIB " + mib);
@@ -392,6 +421,16 @@ int APS5_VABI sysctlbyname_nid_postfix(const char* name, void* oldValue, std::si
         *__error_nid_postfix() = 14;
         return -1;
     }
+    if (strnlen(name, MaximumSysctlName) == MaximumSysctlName) {
+        *__error_nid_postfix() = 63;
+        return -1;
+    }
+    const std::string trimmed = WithoutTrailingDot(name);
+    name = trimmed.c_str();
+    if (TopLevelNode(trimmed) >= 0) {
+        *__error_nid_postfix() = 22;
+        return -1;
+    }
     if (std::strcmp(name, "machdep.cacheline_size") == 0) {
         *__error_nid_postfix() = 2;
         return -1;
@@ -411,6 +450,10 @@ int APS5_VABI sysctlbyname_nid_postfix(const char* name, void* oldValue, std::si
         static constexpr int mib[] = {1, 14, 12};
         return sysctl_nid_postfix(mib, 3, oldValue, oldLength, newValue, newLength);
     }
+    if (std::strcmp(name, "kern.boottime") == 0) {
+        static constexpr int mib[] = {1, 21};
+        return sysctl_nid_postfix(mib, 2, oldValue, oldLength, newValue, newLength);
+    }
     if (std::strcmp(name, "kern.arandom") == 0) {
         static constexpr int mib[] = {1, 37};
         return sysctl_nid_postfix(mib, 2, oldValue, oldLength, newValue, newLength);
@@ -467,7 +510,8 @@ int APS5_VABI sysctlbyname_nid_postfix(const char* name, void* oldValue, std::si
         static constexpr int mib[] = {6, 12};
         return sysctl_nid_postfix(mib, 2, oldValue, oldLength, newValue, newLength);
     }
-    throw std::runtime_error(std::string(__func__) + ": unsupported name " + name);
+    *__error_nid_postfix() = 2;
+    return -1;
 }
 
 int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion* version) {
@@ -480,6 +524,31 @@ int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion*
     return 0;
 }
 
+int APS5_VABI sceKernelGetSystemExVersion(char* first, char* second) {
+    if (first == nullptr || second == nullptr) {
+        return 22;
+    }
+    *first = '\0';
+    *second = '\0';
+    return 0;
+}
+
+int APS5_VABI sysKernelGetLowerLimitSysexVersion_nid_postfix(char* version) {
+    if (version == nullptr) {
+        return SCE_KERNEL_ERROR_EINVAL;
+    }
+    *version = '\0';
+    return 0;
+}
+
+int APS5_VABI sysKernelGetLowerLimitUpdVersion_nid_postfix(std::uint32_t* version) {
+    if (version == nullptr) {
+        return SCE_KERNEL_ERROR_EINVAL;
+    }
+    *version = 0;
+    return 0;
+}
+
 int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_t* size) {
     struct KnownName {
         const char* name;
@@ -495,6 +564,7 @@ int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_
         {"hw.physmem", {6, 5}, 2},
         {"hw.realmem", {6, 12}, 2},
         {"kern.arandom", {1, 37}, 2},
+        {"kern.boottime", {1, 21}, 2},
         {"kern.clockrate", {1, 12}, 2},
         {"kern.maxfiles", {1, 7}, 2},
         {"kern.maxfilesperproc", {1, 27}, 2},
@@ -503,13 +573,14 @@ int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_
         {"kern.ps_strings", {1, 32}, 2},
         {"kern.rng_pseudo", {1, 50}, 2},
     };
-    constexpr std::size_t MaximumPath = 1024;
     if (name == nullptr || size == nullptr) throw std::invalid_argument(std::string(__func__) + ": null name or size");
-    const std::size_t nameLength = strnlen(name, MaximumPath);
-    if (nameLength == MaximumPath) {
+    const std::size_t nameLength = strnlen(name, MaximumSysctlName);
+    if (nameLength == MaximumSysctlName) {
         *__error_nid_postfix() = 63;
         return -1;
     }
+    const std::string trimmed = WithoutTrailingDot(name);
+    name = trimmed.c_str();
     if (nameLength == 0 || std::strcmp(name, "hw.cacheline_size") == 0 || std::strcmp(name, "hw.usermem") == 0 || std::strcmp(name, "machdep.cacheline_size") == 0) {
         *__error_nid_postfix() = 2;
         return -1;
@@ -520,6 +591,7 @@ int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_
         *size = bytes / sizeof(int);
         return result;
     };
+    if (const int node = TopLevelNode(trimmed); node >= 0) return copyMib(&node, 1);
     for (const auto& entry : known) {
         if (std::strcmp(name, entry.name) == 0) return copyMib(entry.mib, entry.length);
     }
@@ -529,6 +601,7 @@ int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_
     for (const auto& entry : SystemIntegers) {
         if (std::strcmp(name, entry.name) == 0) return copyMib(entry.mib, 2);
     }
-    throw std::runtime_error(std::string(__func__) + ": unsupported name " + name);
+    *__error_nid_postfix() = 2;
+    return -1;
 }
 }
diff --git a/core/libs/prx/libkernel/System/src/ThermalSensors.cpp b/core/libs/prx/libkernel/System/src/ThermalSensors.cpp
index bd83c4282c..6339926d84 100644
--- a/core/libs/prx/libkernel/System/src/ThermalSensors.cpp
+++ b/core/libs/prx/libkernel/System/src/ThermalSensors.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/System/include/ThermalSensors.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -238,6 +240,11 @@ int ReadStorageTemperature() {
 
 #endif
 
+int Fail(int error) {
+    *__error_nid_postfix() = error;
+    return SceKernelError(error);
+}
+
 void ReadHostSensors(int celsius[3]) {
 #ifdef _WIN32
     celsius[2] = ReadStorageTemperature();
@@ -254,20 +261,21 @@ void ReadHostSensors(int celsius[3]) {
 extern "C" {
 
 int APS5_VABI sceKernelGetCpuTemperature(int* outCelsius) {
-    if (outCelsius == nullptr) return SCE_KERNEL_ERROR_EFAULT;
+    if (outCelsius == nullptr) return Fail(14);
     int celsius[3];
     ReadHostSensors(celsius);
-    if (celsius[0] < 0) return SCE_KERNEL_ERROR_EINVAL;
+    if (celsius[0] < 0) return Fail(22);
     *outCelsius = celsius[0];
     return 0;
 }
 
 int APS5_VABI sceKernelGetSocSensorTemperature(int sensorId, int* outCelsius) {
-    if (outCelsius == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (sensorId < 0 || sensorId >= 3) return SCE_KERNEL_ERROR_EINVAL;
+    if (sensorId < 0 || sensorId > 64) return Fail(22);
+    if (outCelsius == nullptr) return Fail(14);
+    if (sensorId >= 3) throw std::runtime_error("sceKernelGetSocSensorTemperature: channels 3 to 64 have no host sensor");
     int celsius[3];
     ReadHostSensors(celsius);
-    if (celsius[sensorId] < 0) return SCE_KERNEL_ERROR_EINVAL;
+    if (celsius[sensorId] < 0) return Fail(22);
     *outCelsius = celsius[sensorId];
     return 0;
 }
diff --git a/core/libs/prx/libkernel/System/src/UserContext.cpp b/core/libs/prx/libkernel/System/src/UserContext.cpp
index 92eaa7a389..0d3d7f5937 100644
--- a/core/libs/prx/libkernel/System/src/UserContext.cpp
+++ b/core/libs/prx/libkernel/System/src/UserContext.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestStacks.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -7,9 +9,6 @@
 #include <cstring>
 #include <immintrin.h>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
-
 namespace {
 
 struct RegisterFrame {
@@ -71,47 +70,58 @@ std::uint32_t HostMxcsrMask() {
 
 extern "C" [[noreturn]] void APS5_VABI Aps5ContextRestore_nid_no_patch(const RegisterFrame* frame);
 
+#define APS5_CONTEXT_CAPTURE \
+    "    pushfq\n" \
+    "    push %rbp\n" \
+    "    mov %rsp, %rbp\n" \
+    "    sub $0x2a0, %rsp\n" \
+    "    and $-16, %rsp\n" \
+    "    mov %rax, 0x00(%rsp)\n" \
+    "    mov %rbx, 0x08(%rsp)\n" \
+    "    mov %rcx, 0x10(%rsp)\n" \
+    "    mov %rdx, 0x18(%rsp)\n" \
+    "    mov %rsi, 0x20(%rsp)\n" \
+    "    mov %rdi, 0x28(%rsp)\n" \
+    "    mov 0(%rbp), %rax\n" \
+    "    mov %rax, 0x30(%rsp)\n" \
+    "    lea 24(%rbp), %rax\n" \
+    "    mov %rax, 0x38(%rsp)\n" \
+    "    mov %r8, 0x40(%rsp)\n" \
+    "    mov %r9, 0x48(%rsp)\n" \
+    "    mov %r10, 0x50(%rsp)\n" \
+    "    mov %r11, 0x58(%rsp)\n" \
+    "    mov %r12, 0x60(%rsp)\n" \
+    "    mov %r13, 0x68(%rsp)\n" \
+    "    mov %r14, 0x70(%rsp)\n" \
+    "    mov %r15, 0x78(%rsp)\n" \
+    "    mov 16(%rbp), %rax\n" \
+    "    mov %rax, 0x80(%rsp)\n" \
+    "    mov 8(%rbp), %rax\n" \
+    "    mov %rax, 0x88(%rsp)\n" \
+    "    xor %eax, %eax\n" \
+    "    mov %cs, %ax\n" \
+    "    mov %rax, 0x90(%rsp)\n" \
+    "    mov %ss, %ax\n" \
+    "    mov %rax, 0x98(%rsp)\n" \
+    "    fxsave64 0xa0(%rsp)\n"
+
+#define APS5_CONTEXT_RETURN \
+    "    mov %rbp, %rsp\n" \
+    "    pop %rbp\n" \
+    "    lea 8(%rsp), %rsp\n" \
+    "    ret\n"
+
 asm(".text\n"
     APS5_ASM_FUNCTION("getcontext_nid_postfix")
-    "    pushfq\n"
-    "    push %rbp\n"
-    "    mov %rsp, %rbp\n"
-    "    sub $0x2a0, %rsp\n"
-    "    and $-16, %rsp\n"
-    "    mov %rax, 0x00(%rsp)\n"
-    "    mov %rbx, 0x08(%rsp)\n"
-    "    mov %rcx, 0x10(%rsp)\n"
-    "    mov %rdx, 0x18(%rsp)\n"
-    "    mov %rsi, 0x20(%rsp)\n"
-    "    mov %rdi, 0x28(%rsp)\n"
-    "    mov 0(%rbp), %rax\n"
-    "    mov %rax, 0x30(%rsp)\n"
-    "    lea 24(%rbp), %rax\n"
-    "    mov %rax, 0x38(%rsp)\n"
-    "    mov %r8, 0x40(%rsp)\n"
-    "    mov %r9, 0x48(%rsp)\n"
-    "    mov %r10, 0x50(%rsp)\n"
-    "    mov %r11, 0x58(%rsp)\n"
-    "    mov %r12, 0x60(%rsp)\n"
-    "    mov %r13, 0x68(%rsp)\n"
-    "    mov %r14, 0x70(%rsp)\n"
-    "    mov %r15, 0x78(%rsp)\n"
-    "    mov 16(%rbp), %rax\n"
-    "    mov %rax, 0x80(%rsp)\n"
-    "    mov 8(%rbp), %rax\n"
-    "    mov %rax, 0x88(%rsp)\n"
-    "    xor %eax, %eax\n"
-    "    mov %cs, %ax\n"
-    "    mov %rax, 0x90(%rsp)\n"
-    "    mov %ss, %ax\n"
-    "    mov %rax, 0x98(%rsp)\n"
-    "    fxsave64 0xa0(%rsp)\n"
+    APS5_CONTEXT_CAPTURE
     "    mov %rsp, %rsi\n"
     "    call " APS5_ASM_SYMBOL("Aps5GetcontextFinish_nid_no_patch") "\n"
-    "    mov %rbp, %rsp\n"
-    "    pop %rbp\n"
-    "    lea 8(%rsp), %rsp\n"
-    "    ret\n"
+    APS5_CONTEXT_RETURN
+    APS5_ASM_FUNCTION("swapcontext_nid_postfix")
+    APS5_CONTEXT_CAPTURE
+    "    mov %rsp, %rdx\n"
+    "    call " APS5_ASM_SYMBOL("Aps5SwapcontextFinish_nid_no_patch") "\n"
+    APS5_CONTEXT_RETURN
     APS5_ASM_FUNCTION("Aps5ContextRestore_nid_no_patch")
     "    mov %rdi, %r12\n"
     "    xor %eax, %eax\n"
@@ -157,6 +167,7 @@ int APS5_VABI Aps5GetcontextFinish_nid_no_patch(UserUcontext* context, const Reg
     if (context == nullptr) return Fail(GuestEinval);
     UserUcontext captured{};
     sigprocmask_nid_postfix(GuestSigBlock, nullptr, captured.sigmask);
+
     auto& machine = captured.mcontext;
     machine.rdi = frame->rdi;
     machine.rsi = frame->rsi;
@@ -213,7 +224,14 @@ int APS5_VABI setcontext_nid_postfix(const UserUcontext* context) {
     mxcsr &= HostMxcsrMask();
     std::memcpy(frame.fxsave + FxsaveMxcsr, &mxcsr, sizeof(mxcsr));
     sigprocmask_nid_postfix(GuestSigSetmask, context->sigmask, nullptr);
+
     Aps5ContextRestore_nid_no_patch(&frame);
 }
 
+int APS5_VABI Aps5SwapcontextFinish_nid_no_patch(UserUcontext* saved, const UserUcontext* next, const RegisterFrame* frame) {
+    if (saved == nullptr || next == nullptr) return Fail(GuestEinval);
+    Aps5GetcontextFinish_nid_no_patch(saved, frame);
+    return setcontext_nid_postfix(next);
+}
+
 }
diff --git a/core/libs/prx/libkernel/Time/Ktimer.cpp b/core/libs/prx/libkernel/Time/Ktimer.cpp
index 6dd8b16800..933a20bc60 100644
--- a/core/libs/prx/libkernel/Time/Ktimer.cpp
+++ b/core/libs/prx/libkernel/Time/Ktimer.cpp
@@ -1,11 +1,11 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include <cstdint>
 #include <mutex>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI clock_gettime_nid_postfix(int clockId, void* tp);
-
 namespace {
 
 constexpr int GuestEfault = 14;
@@ -29,21 +29,6 @@ constexpr int TimerMax = 32;
 constexpr long long NanosecondsPerSecond = 1000000000;
 constexpr long long TickNanoseconds = 1000000;
 
-struct GuestSigevent {
-    int notify;
-    int signo;
-};
-
-struct GuestTimespec {
-    std::int64_t tv_sec;
-    std::int64_t tv_nsec;
-};
-
-struct GuestItimerspec {
-    GuestTimespec it_interval;
-    GuestTimespec it_value;
-};
-
 using Nanoseconds = __int128;
 
 struct Ktimer {
@@ -56,22 +41,23 @@ struct Ktimer {
 std::mutex g_ktimerLock;
 Ktimer g_ktimers[TimerMax];
 
-Nanoseconds ToNanoseconds(const GuestTimespec& time) {
+Nanoseconds ToNanoseconds(const KernelTimespec& time) {
     return static_cast<Nanoseconds>(time.tv_sec) * NanosecondsPerSecond + time.tv_nsec;
 }
 
-GuestTimespec ToTimespec(Nanoseconds time) {
+KernelTimespec ToTimespec(Nanoseconds time) {
     return {static_cast<std::int64_t>(time / NanosecondsPerSecond),
             static_cast<std::int64_t>(time % NanosecondsPerSecond)};
 }
 
 Nanoseconds ClockNow(int clock) {
-    GuestTimespec now{};
+    KernelTimespec now{};
     clock_gettime_nid_postfix(clock, &now);
+
     return ToNanoseconds(now);
 }
 
-bool FixTimespec(GuestTimespec& time) {
+bool FixTimespec(KernelTimespec& time) {
     if (time.tv_sec < 0 || time.tv_nsec < 0 || time.tv_nsec >= NanosecondsPerSecond) return false;
     if (time.tv_sec == 0 && time.tv_nsec != 0 && time.tv_nsec < TickNanoseconds) time.tv_nsec = TickNanoseconds;
     return true;
@@ -95,7 +81,7 @@ GuestItimerspec Remaining(Ktimer& timer) {
     const Nanoseconds now = ClockNow(timer.clock);
     Expire(timer, now);
     GuestItimerspec result{ToTimespec(timer.interval), {}};
-    if (timer.value != 0) result.it_value = timer.value > now ? ToTimespec(timer.value - now) : GuestTimespec{0, 1};
+    if (timer.value != 0) result.it_value = timer.value > now ? ToTimespec(timer.value - now) : KernelTimespec{0, 1};
     return result;
 }
 
diff --git a/core/libs/prx/libkernel/Time/Time.cpp b/core/libs/prx/libkernel/Time/Time.cpp
index 411f92751d..60703eeb0e 100644
--- a/core/libs/prx/libkernel/Time/Time.cpp
+++ b/core/libs/prx/libkernel/Time/Time.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/Time/include/Time.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 #include "prx/libkernel/Time/include/SleepWake.hpp"
@@ -33,23 +37,19 @@
 #ifdef __linux__
 #include <dlfcn.h>
 #include <link.h>
+#include <pthread.h>
+#include <sched.h>
 #endif // __linux__
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_CLOCK_REALTIME = 0;
 static constexpr int GUEST_CLOCK_THREAD_CPUTIME_ID = 14;
+static constexpr int GUEST_CLOCK_PROCESS_CPUTIME_ID = 15;
 
 static bool IsCpuClock(int clockId) {
-    const auto bits = static_cast<std::uint32_t>(clockId);
-    if ((bits & CPU_CLOCK_BIT) == 0)
-        return false;
-    if ((bits & CPU_CLOCK_PROCESS_BIT) != 0)
-        throw std::runtime_error("clock: unsupported process CPU clock_id " + std::to_string(clockId));
-    return true;
+    return (static_cast<std::uint32_t>(clockId) & CPU_CLOCK_BIT) != 0;
 }
 
 static std::uint64_t RawMonotonicNanos() {
@@ -119,16 +119,6 @@ static const bool g_timerResolutionRaised = [] {
     return raised;
 }();
 
-extern "C" {
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-}
-
 static void ReportTimedWait(const char* name, const std::function<void()>& body) {
     std::vector<double> samples(200);
     for (auto& sample : samples) {
@@ -152,11 +142,13 @@ static const bool g_timerSelfTest = [] {
     scePthreadCondInit(&cond, nullptr, nullptr);
     scePthreadMutexInit(&guestMutex, nullptr, nullptr);
     scePthreadMutexLock(&guestMutex);
+
     ReportTimedWait("scePthreadCondTimedwait(1000 us)", [&] { scePthreadCondTimedwait(&cond, &guestMutex, 1000); });
     ReportTimedWait("scePthreadCondTimedwait(13000 us)", [&] { scePthreadCondTimedwait(&cond, &guestMutex, 13000); });
     scePthreadMutexUnlock(&guestMutex);
     scePthreadMutexDestroy(&guestMutex);
     scePthreadCondDestroy(&cond);
+
     ReportTimedWait("sceKernelUsleep(1000)", [&] { sceKernelUsleep_nid_postfix(1000); });
     ReportTimedWait("Sleep(1)", [&] { Sleep(1); });
     HANDLE event = CreateEventW(nullptr, TRUE, FALSE, nullptr);
@@ -169,6 +161,45 @@ static const bool g_timerSelfTest = [] {
 }();
 #endif
 
+namespace {
+
+class CurrentCpuPin {
+public:
+    CurrentCpuPin() {
+#ifdef _WIN32
+        previous = SetThreadAffinityMask(GetCurrentThread(), DWORD_PTR{1} << GetCurrentProcessorNumber());
+#elif defined(__linux__)
+        const int cpu = sched_getcpu();
+        if (cpu < 0 || cpu >= CPU_SETSIZE || pthread_getaffinity_np(pthread_self(), sizeof(previous), &previous) != 0) return;
+        cpu_set_t one;
+        CPU_ZERO(&one);
+        CPU_SET(cpu, &one);
+        pinned = pthread_setaffinity_np(pthread_self(), sizeof(one), &one) == 0;
+#endif
+    }
+
+    ~CurrentCpuPin() {
+#ifdef _WIN32
+        if (previous != 0) SetThreadAffinityMask(GetCurrentThread(), previous);
+#elif defined(__linux__)
+        if (pinned) pthread_setaffinity_np(pthread_self(), sizeof(previous), &previous);
+#endif
+    }
+
+    CurrentCpuPin(const CurrentCpuPin&) = delete;
+    CurrentCpuPin& operator=(const CurrentCpuPin&) = delete;
+
+private:
+#ifdef _WIN32
+    DWORD_PTR previous = 0;
+#elif defined(__linux__)
+    cpu_set_t previous{};
+    bool pinned = false;
+#endif
+};
+
+}
+
 extern "C" {
 
 std::uint64_t APS5_VABI sceKernelGetProcessTime() {
@@ -397,8 +428,11 @@ static bool ProcessCpuResolutionNanos(std::uint64_t* nanos) {
 
 static int ReadClock(int clockId, KernelTimespec* tp) {
     if (IsCpuClock(clockId)) {
+        const int id = static_cast<int>(static_cast<std::uint32_t>(clockId) & CPU_CLOCK_ID_MASK);
+        const bool process = (static_cast<std::uint32_t>(clockId) & CPU_CLOCK_PROCESS_BIT) != 0;
+        if (process && id == getpid_nid_postfix()) return ReadClock(GUEST_CLOCK_PROCESS_CPUTIME_ID, tp);
         std::uint64_t nanos = 0;
-        if (!GuestThreadCpuNanos(static_cast<int>(static_cast<std::uint32_t>(clockId) & CPU_CLOCK_ID_MASK), &nanos)) {
+        if (process || !GuestThreadCpuNanos(id, &nanos)) {
             *__error_nid_postfix() = GUEST_EINVAL;
             return -1;
         }
@@ -507,6 +541,9 @@ int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp) {
     return 0;
 }
 
+static std::mutex guestTimezoneMutex;
+static KernelTimezone guestTimezone{0, 0};
+
 int APS5_VABI gettimeofday_nid_postfix(KernelTimeval* tv, KernelTimezone* tz) {
     KernelTimeval ignoredTime{};
     if (tv == nullptr) tv = &ignoredTime;
@@ -526,8 +563,8 @@ int APS5_VABI gettimeofday_nid_postfix(KernelTimeval* tv, KernelTimezone* tz) {
     tv->tv_usec = static_cast<std::int64_t>(native.tv_usec);
 #endif
     if (tz != nullptr) {
-        tz->tz_minuteswest = 0;
-        tz->tz_dsttime = 0;
+        std::lock_guard lock(guestTimezoneMutex);
+        *tz = guestTimezone;
     }
     return 0;
 }
@@ -630,6 +667,23 @@ int APS5_VABI clock_settime_nid_postfix(int clockId, const KernelTimespec* tp) {
     throw std::runtime_error(std::string("clock_settime: setting CLOCK_REALTIME to ") + requested + " is not supported, the host clock is not changed");
 }
 
+int SetTimeOfDay_nid_no_patch(const KernelTimeval* tv, const KernelTimezone* tz) {
+    if (tv != nullptr && (tv->tv_usec < 0 || tv->tv_usec >= 1000000 || tv->tv_sec < 0)) {
+        *__error_nid_postfix() = GUEST_EINVAL;
+        return -1;
+    }
+    if (tv != nullptr) {
+        char requested[48];
+        std::snprintf(requested, sizeof(requested), "%lld.%06lld", static_cast<long long>(tv->tv_sec), static_cast<long long>(tv->tv_usec));
+        throw std::runtime_error(std::string("settimeofday: setting the time to ") + requested + " is not supported, the host clock is not changed");
+    }
+    if (tz != nullptr) {
+        std::lock_guard lock(guestTimezoneMutex);
+        guestTimezone = *tz;
+    }
+    return 0;
+}
+
 // ---------------------------------------------------------------------------
 // Moved as-is (not yet implemented) from the monolithic libkernel/Export.cpp.
 // ---------------------------------------------------------------------------
@@ -728,6 +782,7 @@ uint64_t APS5_VABI sceKernelReadTsc(void) {
 
 uint64_t APS5_VABI sceKernelGetTscFrequency(void) {
     static const std::uint64_t frequency = [] {
+        const CurrentCpuPin pin;
         const std::uint64_t startNanos = RawMonotonicNanos();
         const std::uint64_t startTicks = __rdtsc();
         TimedWait::SleepNanos(20000000ULL);
diff --git a/core/libs/prx/libkernel/Time/TimedWait.cpp b/core/libs/prx/libkernel/Time/TimedWait.cpp
index 7c171db399..bb5ba2cdca 100644
--- a/core/libs/prx/libkernel/Time/TimedWait.cpp
+++ b/core/libs/prx/libkernel/Time/TimedWait.cpp
@@ -11,6 +11,9 @@
 #include <windows.h>
 #else
 #include <cerrno>
+#include <csignal>
+#include <pthread.h>
+#include <system_error>
 #include <time.h>
 #endif
 
@@ -389,6 +392,91 @@ void Condition::NotifyAll() {
     coarse.notify_all();
 }
 
+namespace {
+
+constinit thread_local std::atomic<int> deferralDepth{0};
+constinit thread_local std::atomic<int> deferredSignal{0};
+
+class DeliveryAllowance {
+public:
+    DeliveryAllowance() : depth(deferralDepth.exchange(0)) { DeliverDeferred(); }
+    ~DeliveryAllowance() { deferralDepth.store(depth); }
+    DeliveryAllowance(const DeliveryAllowance&) = delete;
+    DeliveryAllowance& operator=(const DeliveryAllowance&) = delete;
+
+private:
+    int depth;
+};
+
+}
+
+DeliveryDeferral::DeliveryDeferral() {
+    deferralDepth.fetch_add(1);
+}
+
+DeliveryDeferral::~DeliveryDeferral() {
+    deferralDepth.fetch_sub(1);
+}
+
+void DeliverDeferred() {
+    if (deferralDepth.load() != 0) return;
+    const int signum = deferredSignal.exchange(0);
+    if (signum != 0) pthread_kill(pthread_self(), signum);
+}
+
+bool DeferDelivery(int signum) {
+    if (deferralDepth.load() == 0) return false;
+    deferredSignal.store(signum);
+    return true;
+}
+
+#ifdef __APPLE__
+SingleWaiterCondition::SingleWaiterCondition() : semaphore(dispatch_semaphore_create(0)) {
+    if (semaphore == nullptr) throw std::runtime_error("TimedWait: cannot create a wait semaphore");
+}
+
+SingleWaiterCondition::~SingleWaiterCondition() {
+    dispatch_release(semaphore);
+}
+
+void SingleWaiterCondition::NotifyOne() {
+    dispatch_semaphore_signal(semaphore);
+}
+
+bool SingleWaiterCondition::waitSignal(const std::uint64_t* deadlineNanos) {
+    DeliveryAllowance allowance;
+    if (deadlineNanos == nullptr) return dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER) == 0;
+    const std::uint64_t now = NowNanos();
+    const std::uint64_t remaining = *deadlineNanos > now ? *deadlineNanos - now : 0;
+    const dispatch_time_t deadline = remaining >= static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max()) ? DISPATCH_TIME_FOREVER : dispatch_time(DISPATCH_TIME_NOW, static_cast<std::int64_t>(remaining));
+    return dispatch_semaphore_wait(semaphore, deadline) == 0;
+}
+#else
+SingleWaiterCondition::SingleWaiterCondition() {
+    if (sem_init(&semaphore, 0, 0) != 0) throw std::system_error(errno, std::generic_category(), "TimedWait: cannot create a wait semaphore");
+}
+
+SingleWaiterCondition::~SingleWaiterCondition() {
+    sem_destroy(&semaphore);
+}
+
+void SingleWaiterCondition::NotifyOne() {
+    sem_post(&semaphore);
+}
+
+bool SingleWaiterCondition::waitSignal(const std::uint64_t* deadlineNanos) {
+    DeliveryAllowance allowance;
+    timespec deadline{};
+    if (deadlineNanos != nullptr) deadline = {static_cast<time_t>(*deadlineNanos / 1000000000ULL), static_cast<long>(*deadlineNanos % 1000000000ULL)};
+    for (;;) {
+        const int result = deadlineNanos == nullptr ? sem_wait(&semaphore) : sem_clockwait(&semaphore, CLOCK_MONOTONIC, &deadline);
+        if (result == 0) return true;
+        if (errno == ETIMEDOUT) return false;
+        if (errno != EINTR) throw std::system_error(errno, std::generic_category(), "TimedWait: cannot wait for a wait semaphore");
+    }
+}
+#endif
+
 #endif
 
 void BindThreadWaitState(std::atomic<int>* state) {
diff --git a/core/libs/prx/libkernel/Time/include/TimedWait.hpp b/core/libs/prx/libkernel/Time/include/TimedWait.hpp
index 2f1725819d..9ad4e09f03 100644
--- a/core/libs/prx/libkernel/Time/include/TimedWait.hpp
+++ b/core/libs/prx/libkernel/Time/include/TimedWait.hpp
@@ -7,6 +7,12 @@
 #include <cstdint>
 #include <mutex>
 
+#ifdef __APPLE__
+#include <dispatch/dispatch.h>
+#elif !defined(_WIN32)
+#include <semaphore.h>
+#endif
+
 namespace TimedWait {
 
 bool Coarse();
@@ -21,9 +27,6 @@ void WakeChangeSleepers();
 
 struct Waiter;
 
-#ifdef _WIN32
-constexpr unsigned PARK_SPINS = 1000;
-
 class DeliveryDeferral {
 public:
     DeliveryDeferral();
@@ -33,6 +36,10 @@ public:
 };
 
 void DeliverDeferred();
+
+#ifdef _WIN32
+constexpr unsigned PARK_SPINS = 1000;
+
 void SpinPause();
 Waiter* BeginPark(const void* key);
 bool FinishPark(const void* key, Waiter* waiter, const std::uint64_t* deadlineNanos);
@@ -132,6 +139,51 @@ private:
     std::condition_variable_any coarse;
 };
 
+#ifdef _WIN32
+using SingleWaiterCondition = Condition;
+#else
+bool DeferDelivery(int signum);
+
+class SingleWaiterCondition {
+public:
+    SingleWaiterCondition();
+    ~SingleWaiterCondition();
+    SingleWaiterCondition(const SingleWaiterCondition&) = delete;
+    SingleWaiterCondition& operator=(const SingleWaiterCondition&) = delete;
+
+    void NotifyOne();
+
+    template <class TLock, class TPredicate>
+    void Wait(TLock& lock, TPredicate predicate) {
+        while (!predicate()) {
+            lock.unlock();
+            waitSignal(nullptr);
+            lock.lock();
+        }
+    }
+
+    template <class TLock, class TPredicate>
+    bool WaitUntil(TLock& lock, std::uint64_t deadlineNanos, TPredicate predicate) {
+        while (!predicate()) {
+            lock.unlock();
+            const bool signaled = waitSignal(&deadlineNanos);
+            lock.lock();
+            if (!signaled) return predicate();
+        }
+        return true;
+    }
+
+private:
+    bool waitSignal(const std::uint64_t* deadlineNanos);
+
+#ifdef __APPLE__
+    dispatch_semaphore_t semaphore;
+#else
+    sem_t semaphore;
+#endif
+};
+#endif
+
 }  // namespace TimedWait
 
 #endif
diff --git a/core/libs/prx/libkernel/Unimplemented.cpp b/core/libs/prx/libkernel/Unimplemented.cpp
index 617dc506f1..20c5d80c94 100644
--- a/core/libs/prx/libkernel/Unimplemented.cpp
+++ b/core/libs/prx/libkernel/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,11 +6,6 @@
 
 extern "C" {
 
-int APS5_VABI __tls_get_addr_nid_postfix(void) {
-    NotImplemented_nid_no_patch("vNe1w4diLCs");
-    return 0;
-}
-
 int APS5_VABI physhm_open_nid_postfix(void) {
     NotImplemented_nid_no_patch("physhm_open");
     return 0;
@@ -141,9 +137,4 @@ int APS5_VABI __Ux86_64_setcontext() {
     return 0;
 }
 
-int APS5_VABI sigreturn() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 }
diff --git a/core/libs/prx/libkernel/include/Api.hpp b/core/libs/prx/libkernel/include/Api.hpp
new file mode 100644
index 0000000000..b5c59c40d6
--- /dev/null
+++ b/core/libs/prx/libkernel/include/Api.hpp
@@ -0,0 +1,812 @@
+#pragma once
+
+#include "prx/libSceLibcInternal/include/Spawn.hpp"
+#include "prx/libkernel/System/include/UserContext.hpp"
+#include "prx/libkernel/File/include/KernelStatfs.hpp"
+#include "prx/libkernel/Apr/include/AprCommandBuffer.hpp"
+#include "prx/libc/include/specifics/linux/ElfTypes.hpp"
+#include "SceTypes.hpp"
+#include <mutex>
+#include <condition_variable>
+#include <atomic>
+#include <thread>
+
+struct KernelIovec {
+    void* base;
+    std::size_t length;
+};
+
+struct KernelTlsIndex {
+    std::uint64_t module;
+    std::uint64_t offset;
+};
+
+using GuestHandler = void (APS5_VABI *)(int);
+
+struct GuestItimerspec {
+    KernelTimespec it_interval;
+    KernelTimespec it_value;
+};
+
+struct GuestItimerval {
+    KernelTimeval interval;
+    KernelTimeval value;
+};
+
+struct GuestMsghdr {
+    void* name;
+    std::uint32_t nameLength;
+    KernelIovec* iov;
+    int iovLength;
+    void* control;
+    std::uint32_t controlLength;
+    int flags;
+};
+
+struct GuestOnce {
+    std::int32_t state;
+    void* mutex;
+};
+
+struct GuestPollDescriptor {
+    int descriptor;
+    short events;
+    short revents;
+};
+
+struct GuestResourceLimit {
+    std::int64_t rlim_cur;
+    std::int64_t rlim_max;
+};
+
+struct GuestResourceUsage {
+    KernelTimeval ru_utime;
+    KernelTimeval ru_stime;
+    std::int64_t ru_maxrss;
+    std::int64_t ru_ixrss;
+    std::int64_t ru_idrss;
+    std::int64_t ru_isrss;
+    std::int64_t ru_minflt;
+    std::int64_t ru_majflt;
+    std::int64_t ru_nswap;
+    std::int64_t ru_inblock;
+    std::int64_t ru_oublock;
+    std::int64_t ru_msgsnd;
+    std::int64_t ru_msgrcv;
+    std::int64_t ru_nsignals;
+    std::int64_t ru_nvcsw;
+    std::int64_t ru_nivcsw;
+};
+
+struct GuestRtPrio {
+    std::uint16_t type;
+    std::uint16_t prio;
+};
+
+struct GuestSendfileHeaders {
+    KernelIovec* headers;
+    int headerCount;
+    KernelIovec* trailers;
+    int trailerCount;
+};
+
+struct GuestSigaction {
+    std::uintptr_t handler;
+    int flags;
+    GuestSignalSet mask;
+};
+
+struct GuestSigevent {
+    int notify;
+    int signo;
+    std::int64_t value;
+    std::int64_t extra[8];
+};
+
+struct GuestStack {
+    void* sp;
+    std::size_t size;
+    int flags;
+};
+
+struct PthreadBarrierPrivate {
+    std::mutex mutex;
+    std::condition_variable changed;
+    unsigned count;
+    unsigned arrived = 0;
+    unsigned active = 0;
+    std::uint64_t generation = 0;
+};
+
+struct PthreadBarrierattrPrivate {
+    int pshared = 0;
+};
+
+struct PthreadSpinlockPrivate {
+    std::atomic<std::thread::id> owner{};
+};
+
+struct SceKernelProsperoSystemSwVersion {
+    std::uint64_t size;
+    char versionString[0x1C];
+    std::uint32_t version;
+};
+
+struct SceKernelSystemSwVersion {
+    std::uint64_t size;
+    char versionString[0x1C];
+    std::uint32_t version;
+};
+
+extern "C" {
+int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, std::uint32_t attr, std::uint64_t initPattern, const void* param);
+int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef);
+int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, std::uint64_t bitPattern);
+int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, std::uint64_t setPattern, int* numWaitThreads);
+
+}
+
+extern "C" {
+
+void* APS5_VABI __tls_get_addr_nid_postfix(const KernelTlsIndex* index);
+int APS5_VABI physhm_open_nid_postfix(void);
+int APS5_VABI physhm_unlink_nid_postfix(void);
+int APS5_VABI sceKernelUnknown03(void);
+int APS5_VABI sceKernelUnknown04(void);
+int APS5_VABI sceKernelUnknown05(void);
+int APS5_VABI sceKernelUnknown06(void);
+int APS5_VABI sceKernelUnknown07(void);
+int APS5_VABI sceKernelUnknown08(void);
+int APS5_VABI sceKernelUnknown09(void);
+int APS5_VABI sceKernelUnknown10(void);
+int APS5_VABI sceKernelUnknown11(void);
+int APS5_VABI sceKernelUnknown12(void);
+int APS5_VABI sceKernelUnknown13(void);
+int APS5_VABI sceKernelUnknown14(void);
+int APS5_VABI sceKernelUnknown15(void);
+int APS5_VABI sceKernelUnknown16(void);
+int APS5_VABI sceKernelUnknown17(void);
+int APS5_VABI sceKernelUnknown18(void);
+int APS5_VABI sceKernelUnknown19(void);
+int APS5_VABI sceKernelPrintBacktraceWithModuleInfo(void);
+int APS5_VABI sceKernelGetProcessAbiType();
+int APS5_VABI __Ux86_64_setcontext();
+int APS5_VABI sceKernelAioDeleteRequest(int32_t id, int32_t* ret);
+int APS5_VABI sceKernelAioDeleteRequests(int32_t* id, int32_t num, int32_t* ret);
+int APS5_VABI sceKernelAioCancelRequest(int32_t id, int32_t* state);
+int APS5_VABI sceKernelAioCancelRequests(int32_t* id, int32_t num, int32_t* state);
+int APS5_VABI sceKernelAioInitializeImpl(void* param, int32_t size);
+void APS5_VABI sceKernelAioInitializeParam(void* param);
+int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, int32_t schedulingWindowSize, int32_t delayedCountLimit, uint32_t enableSplit, uint32_t splitSize, uint32_t splitChunkSize);
+int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioSubmitReadCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioPollRequest(int32_t id, int32_t* state);
+int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state, uint32_t mode, uint32_t* usec);
+int APS5_VABI sceKernelAioWaitRequest(int32_t id, int32_t* state, uint32_t* usec);
+int APS5_VABI sceKernelAioPollRequests(int32_t* id, int32_t num, int32_t* state);
+int APS5_VABI sceKernelAprResolveFilepathsToIds(const char** paths, uint32_t count, uint32_t* ids, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizes(const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIdsAndFileSizes(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIds(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprGetFileSize(uint32_t id, uint64_t* size);
+int APS5_VABI sceKernelAprGetFileStat(uint32_t id, FileStat* stat);
+int APS5_VABI sceKernelAprSubmitCommandBuffer(const Apr::CommandBufferObject* buffer, uint32_t priority);
+int APS5_VABI sceKernelAprSubmitCommandBufferAndGetId(const Apr::CommandBufferObject* buffer, uint32_t priority, uint32_t* id);
+int APS5_VABI sceKernelAprSubmitCommandBufferAndGetResult(const Apr::CommandBufferObject* buffer, uint32_t priority, uint32_t* result, uint32_t* id);
+int APS5_VABI sceKernelAprWaitCommandBuffer(uint32_t id);
+int APS5_VABI sceKernelAprResolveFilepathsToIdsForEach(const char** paths, uint32_t count, uint32_t* ids, int* results);
+int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizesForEach(const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, int* results);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIdsForEach(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, int* results);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIdsAndFileSizesForEach(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, int* results);
+int APS5_VABI sceKernelWriteModifyMtypeProtectCommand(void* dst, std::uint64_t address, std::uint64_t size, std::uint64_t type, std::uint64_t protection, std::uint64_t mask, std::uint64_t* outSize);
+int APS5_VABI sceKernelWriteRemapIntoPrtCommand(std::uint32_t* dst, std::uint64_t address, std::uint64_t source, std::uint64_t size, int protection, int opcode, std::uint64_t* outSize);
+int APS5_VABI sceKernelAllocateDirectMemory(int64_t searchStart, int64_t searchEnd, size_t len, size_t alignment, int memoryType, int64_t* physAddrOut);
+int APS5_VABI sceKernelAllocateMainDirectMemory(size_t len, size_t alignment, int memoryType, int64_t* physAddrOut);
+int APS5_VABI sceKernelAvailableDirectMemorySize(int64_t searchStart, int64_t searchEnd, size_t alignment, int64_t* physAddrOut, size_t* sizeOut);
+int APS5_VABI sceKernelDirectMemoryQuery(int64_t offset, int flags, void* info, size_t infoSize);
+int APS5_VABI sceKernelGetDirectMemoryType(int64_t offset, int* memoryType, int64_t* start, int64_t* end);
+size_t APS5_VABI sceKernelGetDirectMemorySize(void);
+int APS5_VABI sceKernelEnableDmemAliasing(void);
+int APS5_VABI sceKernelMapDirectMemory(void** addr, size_t len, int prot, int flags, int64_t directMemoryStart, size_t alignment);
+int APS5_VABI sceKernelMapDirectMemory2(void** addr, size_t len, int type, int prot, int flags, int64_t directMemoryStart, size_t alignment);
+int APS5_VABI sceKernelMapFlexibleMemory(void** addrInOut, size_t len, int prot, int flags);
+int APS5_VABI sceKernelMapNamedDirectMemory(void** addr, size_t len, int prot, int flags, int64_t directMemoryStart, size_t alignment, const char* name);
+int32_t APS5_VABI sceKernelMapNamedFlexibleMemory(void** addrInOut, size_t len, int prot, int flags, const char* name);
+int32_t APS5_VABI sceKernelMapNamedFlexibleMemoryInternal(void** addrInOut, size_t len, int prot, int flags, const char* name);
+int APS5_VABI sceKernelMprotect(const void* addr, size_t len, int prot);
+int APS5_VABI sceKernelMunmap(uint64_t vaddr, size_t len);
+int APS5_VABI sceKernelMmap(void* addr, size_t len, int prot, int flags, int fd, int64_t offset, void** res);
+int APS5_VABI sceKernelReleaseFlexibleMemory(void* addr, size_t len);
+int APS5_VABI sceKernelReleaseDirectMemory(int64_t start, size_t len);
+int APS5_VABI sceKernelReserveVirtualRange(void** addr, size_t len, int flags, size_t alignment);
+int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, uint64_t infoSize);
+int APS5_VABI sceKernelCheckedReleaseDirectMemory(int64_t start, size_t len);
+int APS5_VABI sceKernelMtypeprotect(const void* addr, size_t len, int type, int prot);
+int APS5_VABI sceKernelQueryMemoryProtection(void* addr, void** start, void** end, int* prot);
+int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
+int APS5_VABI sceKernelAvailableFlexibleMemorySize(size_t* size);
+int APS5_VABI sceKernelConfiguredFlexibleMemorySize(size_t* size);
+int APS5_VABI sceKernelInternalMemoryGetAvailableSize(std::size_t* size);
+int APS5_VABI sceKernelSetVirtualRangeName(const void* addr, uint64_t len, const char* name);
+int APS5_VABI sceKernelClearVirtualRangeName(const void* addr, uint64_t len);
+int APS5_VABI sceKernelGetPageTableStats(int* cpuTotal, int* cpuAvailable, int* gpuTotal, int* gpuAvailable);
+int APS5_VABI sceKernelGetPrtAperture(int index, void** addr, size_t* len);
+int APS5_VABI sceKernelSetPrtAperture(int index, void* addr, size_t len);
+int APS5_VABI sceKernelBatchMap(KernelBatchMapEntry* entries, int numEntries, int* numEntriesOut);
+int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry* entries, int numEntries, int* numEntriesOut, int flags);
+int APS5_VABI sceKernelMlock_nid_postfix(void* address, std::uint64_t length);
+int APS5_VABI sceKernelMunlock_nid_postfix(void* address, std::uint64_t length);
+int APS5_VABI sceKernelMunlockall_nid_postfix();
+int APS5_VABI sceKernelJitCreateSharedMemory(const char* name, std::size_t len, int maxProt, int* fdOut);
+int APS5_VABI sceKernelJitCreateAliasOfSharedMemory(int fd, int maxProt, int* fdOut);
+int APS5_VABI sceKernelJitMapSharedMemory(int fd, int prot, void** startOut);
+int APS5_VABI sceKernelMemoryPoolBatch(const KernelMemoryPoolBatchEntry* entries, int numEntries, int* numEntriesOut, int flags);
+int APS5_VABI sceKernelMemoryPoolCommit(void* addr, size_t len, int type, int prot, int flags);
+int APS5_VABI sceKernelMemoryPoolDecommit(void* addr, size_t len, int flags);
+int APS5_VABI sceKernelMemoryPoolExpand(int64_t searchStart, int64_t searchEnd, size_t len, size_t alignment, int64_t* physAddrOut);
+int APS5_VABI sceKernelMemoryPoolGetBlockStats(KernelMemoryPoolBlockStats* output, size_t outputSize);
+int APS5_VABI sceKernelMemoryPoolReserve(void* addrIn, size_t len, size_t alignment, int flags, void** addrOut);
+void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
+int APS5_VABI munmap_nid_postfix(void* address, std::size_t length) noexcept;
+int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
+int APS5_VABI mlock_nid_postfix(const void* address, std::size_t length);
+int APS5_VABI munlock_nid_postfix(const void* address, std::size_t length);
+int APS5_VABI mlockall_nid_postfix(int flags);
+int APS5_VABI munlockall_nid_postfix();
+int APS5_VABI msync_nid_postfix(void* address, std::size_t length, int flags);
+int APS5_VABI madvise_nid_postfix(void* address, std::size_t length, int advice);
+int APS5_VABI mincore_nid_postfix(const void* address, std::size_t length, char* vec);
+int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
+int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
+int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
+int APS5_VABI sceKernelAddUserEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
+int APS5_VABI sceKernelTriggerUserEvent(KernelEqueue eq, int id, void* udata);
+int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddHRTimerEvent(KernelEqueue eq, int id, const KernelTimespec* ts, void* udata);
+int APS5_VABI sceKernelDeleteHRTimerEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddTimerEvent(KernelEqueue eq, int id, KernelUseconds usec, void* udata);
+int APS5_VABI sceKernelDeleteTimerEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddAmprEvent(KernelEqueue eq, int id, void* udata);
+int APS5_VABI sceKernelAddAmprSystemEvent(KernelEqueue eq, int id, void* udata);
+int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelDeleteAmprSystemEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddReadEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
+int APS5_VABI sceKernelDeleteReadEvent(KernelEqueue eq, int fd);
+int APS5_VABI sceKernelAddWriteEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
+int APS5_VABI sceKernelDeleteWriteEvent(KernelEqueue eq, int fd);
+intptr_t APS5_VABI sceKernelGetEventData(const KernelEvent* ev);
+int APS5_VABI sceKernelGetEventError(const KernelEvent* ev);
+intptr_t APS5_VABI sceKernelGetEventFflags(const KernelEvent* ev);
+int APS5_VABI sceKernelGetEventFilter(const KernelEvent* ev);
+uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
+void* APS5_VABI sceKernelGetEventUserData(const KernelEvent* ev);
+int APS5_VABI sceKernelAddFileEvent(KernelEqueue eq, int fd, int watch, void* udata);
+int APS5_VABI sceKernelDeleteFileEvent(KernelEqueue eq, int fd);
+int APS5_VABI kqueue_nid_postfix();
+int APS5_VABI kevent_nid_postfix(int descriptor, const KernelEvent* changelist, int nchanges, KernelEvent* eventlist, int nevents, const KernelTimespec* timeout);
+int APS5_VABI sceKernelOpenEventFlag(KernelEventFlag* ef, const char* name);
+int APS5_VABI sceKernelCloseEventFlag(KernelEventFlag ef);
+int APS5_VABI sceKernelClearEventFlag(KernelEventFlag ef, uint64_t bitPattern);
+int APS5_VABI sceKernelPollEventFlag(KernelEventFlag ef, uint64_t bitPattern, uint32_t waitMode, uint64_t* resultPat);
+int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bitPattern, uint32_t waitMode, uint64_t* resultPat, KernelUseconds* timeout);
+int APS5_VABI shm_open_nid_postfix(const char* path, int flags, int mode);
+int APS5_VABI shm_unlink_nid_postfix(const char* path);
+int APS5_VABI pipe_nid_postfix(int* descriptors);
+int APS5_VABI chmod_nid_postfix(const char* path, int mode);
+int APS5_VABI chflags_nid_postfix(const char* path, std::uint64_t flags);
+int APS5_VABI fchflags_nid_postfix(int d, std::uint64_t flags);
+int APS5_VABI nmount_nid_postfix(const KernelIovec* iov, unsigned int niov, int flags);
+int APS5_VABI close_nid_postfix(int d);
+int APS5_VABI _close_nid_postfix(int descriptor);
+int APS5_VABI dup_nid_postfix(int d);
+int APS5_VABI dup2_nid_postfix(int from, int to);
+int APS5_VABI flock_nid_postfix(int d, int operation);
+int APS5_VABI _fstatfs_nid_postfix(int d, KernelStatfs* buf);
+int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int d, FileStat* sb);
+int64_t APS5_VABI _fstat_nid_postfix(int d, FileStat* sb);
+int APS5_VABI ftruncate_nid_postfix(int d, int64_t length);
+int APS5_VABI sceKernelFtruncate(int d, int64_t length);
+int64_t APS5_VABI lseek_nid_postfix(int d, int64_t offset, int whence);
+int APS5_VABI mkdir_nid_postfix(const char* path, uint16_t mode);
+int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
+int APS5_VABI creat_nid_postfix(const char* path, int mode);
+int APS5_VABI _open_nid_postfix(const char* path, int flags, ...);
+int64_t APS5_VABI pread_nid_postfix(int d, void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int d, const void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI read_nid_postfix(int d, void* buf, uint64_t nbytes);
+std::int64_t APS5_VABI _read_nid_postfix(int descriptor, void* buffer, std::size_t count);
+int64_t APS5_VABI write_nid_postfix(int d, const char* str, int64_t size);
+std::int64_t APS5_VABI _write_nid_postfix(int descriptor, const void* buffer, std::size_t count);
+int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
+int APS5_VABI lstat_nid_postfix(const char* path, FileStat* sb);
+int APS5_VABI unlink_nid_postfix(const char* path);
+int APS5_VABI sceKernelCheckReachability(const char* path);
+int APS5_VABI sceKernelFstat(int d, FileStat* sb);
+int APS5_VABI sceKernelFsync(int fd);
+int APS5_VABI sceKernelFdatasync(int fd);
+int APS5_VABI sceKernelWriteThrottlingStatus(std::uint64_t* status);
+int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* basep);
+int APS5_VABI sceKernelGetdents(int fd, char* buf, int nbytes);
+int APS5_VABI getdirentries_nid_postfix(int fd, char* buf, int nbytes, int64_t* basep);
+int APS5_VABI _getdirentries_nid_postfix(int fd, char* buf, int nbytes, int64_t* basep);
+int APS5_VABI getdents_nid_postfix(int fd, char* buf, int nbytes);
+int APS5_VABI sceKernelMkdir(const char* path, uint16_t mode);
+int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI sceKernelPwrite(int d, const void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI sceKernelReadv(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI sceKernelWritev(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI sceKernelPreadv(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int64_t APS5_VABI sceKernelPwritev(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int64_t APS5_VABI preadv_nid_postfix(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int64_t APS5_VABI pwritev_nid_postfix(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int APS5_VABI sceKernelRename(const char* from, const char* to);
+int APS5_VABI sceKernelRmdir(const char* path);
+int APS5_VABI rmdir_nid_postfix(const char* path);
+int APS5_VABI sceKernelChmod_nid_postfix(const char* path, std::uint16_t mode);
+int APS5_VABI sceKernelFchmod(int d, std::uint16_t mode);
+int APS5_VABI fchmod_nid_postfix(int d, int mode);
+int APS5_VABI sceKernelTruncate_nid_postfix(const char* path, std::int64_t length);
+int APS5_VABI truncate_nid_postfix(const char* path, std::int64_t length);
+int APS5_VABI sceKernelUtimes_nid_postfix(const char* path, const KernelTimeval* times);
+int APS5_VABI utimes_nid_postfix(const char* path, const KernelTimeval* times);
+int APS5_VABI lutimes_nid_postfix(const char* path, const KernelTimeval* times);
+int APS5_VABI sceKernelFutimes(int d, const KernelTimeval* times);
+int APS5_VABI futimes_nid_postfix(int d, const KernelTimeval* times);
+int APS5_VABI fsync_nid_postfix(int fd);
+int APS5_VABI fdatasync_nid_postfix(int fd);
+int64_t APS5_VABI readv_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI writev_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI _readv_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI _writev_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int APS5_VABI cfsetspeed_nid_postfix(void* attributes, std::uint32_t speed);
+int APS5_VABI tcgetattr_nid_postfix(int descriptor, void* attributes);
+int APS5_VABI tcsetattr_nid_postfix(int descriptor, int action, const void* attributes);
+int APS5_VABI tcsendbreak_nid_postfix(int descriptor, int duration);
+int APS5_VABI tcdrain_nid_postfix(int descriptor);
+int APS5_VABI tcflush_nid_postfix(int descriptor, int queue);
+int APS5_VABI tcflow_nid_postfix(int descriptor, int action);
+int APS5_VABI tcgetpgrp_nid_postfix(int descriptor);
+int APS5_VABI tcsetpgrp_nid_postfix(int descriptor, int group);
+char* APS5_VABI dlerror_nid_postfix();
+void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
+void* APS5_VABI dlsym_nid_postfix(void* handle, const char* name);
+int APS5_VABI dlclose_nid_postfix(void* handle);
+int APS5_VABI sceKernelDlsym(KernelModule handle, const char* symbol, void** addr);
+int APS5_VABI sceKernelGetModuleInfoForUnwind(uint64_t addr, int flags, ModuleInfoForUnwind* info);
+KernelModule APS5_VABI sceKernelLoadStartModule(const char* moduleFileName, size_t args, const void* argp, uint32_t flags, const KernelLoadModuleOpt* opt, int* res);
+int APS5_VABI sceKernelStopUnloadModule(KernelModule handle, size_t args, const void* argp, uint32_t flags, const KernelUnloadModuleOpt* opt, int* res);
+int APS5_VABI __elf_phdr_match_addr_nid_postfix(dl_phdr_info* phdrInfo, void* addr);
+int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
+int APS5_VABI sceKernelGetModuleList(KernelModule* handles, std::size_t count, std::size_t* actual);
+int APS5_VABI sceKernelGetModuleList2(KernelModule* handles, std::size_t count, std::size_t* actual);
+int APS5_VABI sceKernelGetModuleInfo(KernelModule handle, ModuleInfo* info);
+int APS5_VABI sceKernelGetModuleInfo2(KernelModule handle, ModuleInfo* info);
+std::int32_t APS5_VABI sceKernelGetLibkernelTextLocation_nid_postfix(void** address, std::size_t* size);
+std::int32_t APS5_VABI sceKernelInternalMemoryGetModuleSegmentInfo_nid_postfix(InternalSegmentInfo* result);
+int APS5_VABI pthread_attr_destroy_nid_postfix(PthreadAttr* attr);
+int APS5_VABI pthread_attr_get_np_nid_postfix(Pthread thread, PthreadAttr* attr);
+int APS5_VABI pthread_attr_getdetachstate_nid_postfix(const PthreadAttr* attr, int* state);
+int APS5_VABI pthread_attr_getguardsize_nid_postfix(const PthreadAttr* attr, size_t* guardSize);
+int APS5_VABI pthread_attr_getinheritsched_nid_postfix(const PthreadAttr* attr, int* inheritSched);
+int APS5_VABI pthread_attr_getschedparam_nid_postfix(const PthreadAttr* attr, KernelSchedParam* param);
+int APS5_VABI pthread_attr_getschedpolicy_nid_postfix(const PthreadAttr* attr, int* policy);
+int APS5_VABI pthread_attr_getscope_nid_postfix(const PthreadAttr* attr, int* scope);
+int APS5_VABI pthread_attr_getstack_nid_postfix(const PthreadAttr* __restrict attr, void** __restrict stackAddr, size_t* __restrict stackSize);
+int APS5_VABI pthread_attr_getstackaddr_nid_postfix(const PthreadAttr* __restrict attr, void** __restrict stackAddr);
+int APS5_VABI pthread_attr_getstacksize_nid_postfix(const PthreadAttr* attr, size_t* stackSize);
+int APS5_VABI pthread_attr_init_nid_postfix(PthreadAttr* attr);
+int APS5_VABI pthread_attr_setdetachstate_nid_postfix(PthreadAttr* attr, int state);
+int APS5_VABI pthread_attr_setguardsize_nid_postfix(PthreadAttr* attr, size_t guardSize);
+int APS5_VABI pthread_attr_setinheritsched_nid_postfix(PthreadAttr* attr, int inheritSched);
+int APS5_VABI pthread_attr_setschedparam_nid_postfix(PthreadAttr* attr, const KernelSchedParam* param);
+int APS5_VABI pthread_attr_setschedpolicy_nid_postfix(PthreadAttr* attr, int policy);
+int APS5_VABI pthread_attr_setscope_nid_postfix(PthreadAttr* attr, int scope);
+int APS5_VABI pthread_attr_setstacksize_nid_postfix(PthreadAttr* attr, size_t stackSize);
+int APS5_VABI pthread_attr_setstack_nid_postfix(PthreadAttr* attr, void* stackAddr, size_t stackSize);
+int APS5_VABI pthread_attr_setsolosched_np_nid_postfix(PthreadAttr* attr, int solosched);
+int APS5_VABI pthread_barrierattr_init_nid_postfix(PthreadBarrierattrPrivate** attr);
+int APS5_VABI pthread_barrierattr_destroy_nid_postfix(PthreadBarrierattrPrivate** attr);
+int APS5_VABI pthread_barrierattr_getpshared_nid_postfix(PthreadBarrierattrPrivate* const* attr, int* pshared);
+int APS5_VABI pthread_barrierattr_setpshared_nid_postfix(PthreadBarrierattrPrivate** attr, int pshared);
+int APS5_VABI pthread_barrier_init_nid_postfix(PthreadBarrierPrivate** barrier, PthreadBarrierattrPrivate* const* attr, unsigned count);
+int APS5_VABI pthread_barrier_wait_nid_postfix(PthreadBarrierPrivate** barrier);
+int APS5_VABI pthread_barrier_destroy_nid_postfix(PthreadBarrierPrivate** barrier);
+int APS5_VABI pthread_cond_destroy_nid_postfix(PthreadCond* cond);
+int APS5_VABI pthread_cond_broadcast_nid_postfix(PthreadCond* cond);
+int APS5_VABI pthread_cond_init_nid_postfix(PthreadCond* cond, const PthreadCondattr* attr);
+int APS5_VABI pthread_cond_signal_nid_postfix(PthreadCond* cond);
+int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
+int APS5_VABI pthread_cond_reltimedwait_np_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, KernelUseconds usec);
+int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
+int APS5_VABI pthread_cond_setname_np_nid_postfix(PthreadCond* cond, const char* name);
+int APS5_VABI pthread_condattr_destroy_nid_postfix(PthreadCondattr* attr);
+int APS5_VABI pthread_condattr_init_nid_postfix(PthreadCondattr* attr);
+int APS5_VABI pthread_condattr_setclock_nid_postfix(PthreadCondattr* attr, KernelClockid clockId);
+int APS5_VABI pthread_condattr_setpshared_nid_postfix(PthreadCondattr* attr, int pshared);
+int APS5_VABI pthread_condattr_getpshared_nid_postfix(const PthreadCondattr* attr, int* pshared);
+int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
+int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_timedlock_nid_postfix(PthreadMutex* mutex, const KernelTimespec* abstime);
+int APS5_VABI pthread_mutex_trylock_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_reltimedlock_np_nid_postfix(PthreadMutex* mutex, KernelUseconds usec);
+int APS5_VABI pthread_mutex_isowned_np_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_getspinloops_np_nid_postfix(PthreadMutex* mutex, int* count);
+int APS5_VABI pthread_mutex_setspinloops_np_nid_postfix(PthreadMutex* mutex, int count);
+int APS5_VABI pthread_mutex_getyieldloops_np_nid_postfix(PthreadMutex* mutex, int* count);
+int APS5_VABI pthread_mutex_setyieldloops_np_nid_postfix(PthreadMutex* mutex, int count);
+int APS5_VABI pthread_mutexattr_destroy_nid_postfix(PthreadMutexattr* attr);
+int APS5_VABI pthread_mutexattr_init_nid_postfix(PthreadMutexattr* attr);
+int APS5_VABI pthread_mutexattr_getpshared_nid_postfix(const PthreadMutexattr* attr, int* pshared);
+int APS5_VABI pthread_mutexattr_setpshared_nid_postfix(PthreadMutexattr* attr, int pshared);
+int APS5_VABI pthread_mutexattr_setprotocol_nid_postfix(PthreadMutexattr* attr, int protocol);
+int APS5_VABI pthread_mutexattr_getprotocol_nid_postfix(const PthreadMutexattr* attr, int* protocol);
+int APS5_VABI pthread_mutexattr_setprioceiling_nid_postfix(PthreadMutexattr* attr, int prioceiling);
+int APS5_VABI pthread_mutexattr_getprioceiling_nid_postfix(const PthreadMutexattr* attr, int* prioceiling);
+int APS5_VABI pthread_mutexattr_settype_nid_postfix(PthreadMutexattr* attr, int type);
+int APS5_VABI pthread_mutexattr_gettype_nid_postfix(const PthreadMutexattr* attr, int* type);
+int APS5_VABI pthread_once_nid_postfix( GuestOnce* control, void (APS5_VABI *initialize)());
+int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_init_nid_postfix(PthreadRwlock* rwlock, const PthreadRwlockattr* attr);
+int APS5_VABI pthread_rwlockattr_destroy_nid_postfix(PthreadRwlockattr* attr);
+int APS5_VABI pthread_rwlockattr_init_nid_postfix(PthreadRwlockattr* attr);
+int APS5_VABI pthread_rwlockattr_getpshared_nid_postfix(const PthreadRwlockattr* attr, int* pshared);
+int APS5_VABI pthread_rwlockattr_setpshared_nid_postfix(PthreadRwlockattr* attr, int pshared);
+int APS5_VABI pthread_rwlock_rdlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_timedrdlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
+int APS5_VABI pthread_rwlock_timedwrlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
+int APS5_VABI pthread_rwlock_reltimedrdlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec);
+int APS5_VABI pthread_rwlock_reltimedwrlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec);
+int APS5_VABI pthread_rwlock_tryrdlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_trywrlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_unlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value);
+int APS5_VABI sem_destroy_nid_postfix(void* sem);
+int APS5_VABI sem_wait_nid_postfix(void* sem);
+int APS5_VABI sem_trywait_nid_postfix(void* sem);
+int APS5_VABI sem_timedwait_nid_postfix(void* sem, const KernelTimespec* abstime);
+int APS5_VABI sem_reltimedwait_np_nid_postfix(void* sem, uint32_t usec);
+int APS5_VABI sem_post_nid_postfix(void* sem);
+int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value);
+void* APS5_VABI sem_open_nid_postfix(const char* name, int flags, ...);
+int APS5_VABI sem_close_nid_postfix(void* sem);
+int APS5_VABI sem_unlink_nid_postfix(const char* name);
+int APS5_VABI pthread_spin_init_nid_postfix(PthreadSpinlockPrivate** lock, int pshared);
+int APS5_VABI pthread_spin_destroy_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI pthread_spin_trylock_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI pthread_spin_lock_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI pthread_spin_unlock_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI cpuset_getaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, void* mask);
+int APS5_VABI cpuset_setaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, const void* mask);
+int APS5_VABI rtprio_thread_nid_postfix(int function, int lwpid, GuestRtPrio* priority);
+int APS5_VABI pthread_setconcurrency_nid_postfix(int newLevel);
+int APS5_VABI pthread_getconcurrency_nid_postfix();
+int APS5_VABI pthread_create_nid_postfix(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg);
+int APS5_VABI pthread_create_name_np_nid_postfix(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
+int APS5_VABI pthread_detach_nid_postfix(Pthread thread);
+void APS5_VABI pthread_exit_nid_postfix(void* value);
+int APS5_VABI scePthreadGetschedparam(Pthread thread, int* policy, KernelSchedParam* param);
+int APS5_VABI scePthreadSetschedparam(Pthread thread, int policy, const KernelSchedParam* param);
+int APS5_VABI pthread_getschedparam_nid_postfix(Pthread thread, int* policy, KernelSchedParam* param);
+int APS5_VABI pthread_getprio_nid_postfix(Pthread thread);
+int APS5_VABI pthread_getaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, void* cpuset);
+int APS5_VABI pthread_setaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, const void* cpuset);
+int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** value);
+int APS5_VABI pthread_timedjoin_np_nid_postfix(Pthread thread, void** value, const KernelTimespec* abstime);
+int APS5_VABI pthread_rename_np_nid_postfix(Pthread thread, const char* name);
+int APS5_VABI pthread_getname_np_nid_postfix(Pthread thread, char* name);
+void APS5_VABI pthread_set_name_np_nid_postfix(Pthread thread, const char* name);
+Pthread APS5_VABI pthread_self_nid_postfix(void);
+int APS5_VABI pthread_getthreadid_np_nid_postfix(void);
+int APS5_VABI pthread_equal_nid_postfix(Pthread first, Pthread second);
+int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId);
+int APS5_VABI sched_yield_nid_postfix(void);
+int APS5_VABI pthread_cancel_nid_postfix(Pthread thread);
+int APS5_VABI pthread_setcancelstate_nid_postfix(int state, int* oldState);
+int APS5_VABI pthread_setcanceltype_nid_postfix(int type, int* oldType);
+int APS5_VABI pthread_setprio_nid_postfix(Pthread thread, int prio);
+int APS5_VABI pthread_setschedparam_nid_postfix(Pthread thread, int policy, const KernelSchedParam* param);
+void APS5_VABI pthread_testcancel_nid_postfix(void);
+void APS5_VABI pthread_yield_nid_postfix(void);
+unsigned int APS5_VABI sleep_nid_postfix(unsigned int seconds);
+void* APS5_VABI pthread_getspecific_nid_postfix(PthreadKey key);
+int APS5_VABI pthread_setspecific_nid_postfix(PthreadKey key, void* value);
+int APS5_VABI pthread_key_create_nid_postfix(PthreadKey* key, pthread_key_destructor_func_t destructor);
+int APS5_VABI pthread_key_delete_nid_postfix(PthreadKey key);
+int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
+int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
+int APS5_VABI scePthreadAttrSetdetachstate(PthreadAttr* attr, int detachstate);
+int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
+int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stacksize);
+int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** stackaddr, std::size_t* stacksize);
+int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
+int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
+int APS5_VABI scePthreadAttrGetdetachstate(const PthreadAttr* attr, int* state);
+int APS5_VABI scePthreadAttrGetguardsize(const PthreadAttr* attr, size_t* guardSize);
+int APS5_VABI scePthreadAttrGetinheritsched(const PthreadAttr* attr, int* inheritSched);
+int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
+int APS5_VABI scePthreadAttrGetschedpolicy(const PthreadAttr* attr, int* policy);
+int APS5_VABI scePthreadAttrGetsolosched(const PthreadAttr* attr, int* solosched);
+int APS5_VABI scePthreadAttrGetstackaddr(const PthreadAttr* attr, void** stackAddr);
+int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, size_t* stackSize);
+int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
+int APS5_VABI scePthreadAttrSetguardsize(PthreadAttr* attr, size_t guardSize);
+int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
+int APS5_VABI scePthreadAttrSetschedpolicy(PthreadAttr* attr, int policy);
+int APS5_VABI scePthreadAttrSetsolosched(PthreadAttr* attr, int solosched);
+int APS5_VABI scePthreadAttrSetstack(PthreadAttr* attr, void* addr, size_t size);
+int APS5_VABI scePthreadAttrSetstackaddr(PthreadAttr* attr, void* addr);
+int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
+int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
+int APS5_VABI scePthreadSemPost(PthreadSem* sem);
+int APS5_VABI scePthreadSemWait(PthreadSem* sem);
+int APS5_VABI scePthreadSemTrywait(PthreadSem* sem);
+int APS5_VABI scePthreadSemTimedwait(PthreadSem* sem, KernelUseconds usec);
+int APS5_VABI scePthreadSemGetvalue(PthreadSem* sem, int* value);
+int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
+int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
+int APS5_VABI scePthreadDetach(Pthread thread);
+Pthread APS5_VABI scePthreadSelf();
+void APS5_VABI scePthreadYield();
+int APS5_VABI scePthreadCancel(Pthread thread);
+int APS5_VABI scePthreadEqual(Pthread thread1, Pthread thread2);
+KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
+int APS5_VABI scePthreadGetaffinity(Pthread thread, KernelCpumask* mask);
+int APS5_VABI scePthreadGetname(Pthread thread, char* name);
+int APS5_VABI scePthreadGetprio(Pthread thread, int* prio);
+int APS5_VABI scePthreadGetthreadid(void);
+int APS5_VABI scePthreadRename(Pthread thread, const char* name);
+int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
+int APS5_VABI scePthreadSetcancelstate(int state, int* oldState);
+int APS5_VABI scePthreadSetcanceltype(int type, int* oldType);
+void APS5_VABI scePthreadTestcancel();
+int APS5_VABI scePthreadSetprio(Pthread thread, int prio);
+int APS5_VABI scePthreadOnce(int32_t* once, void (APS5_VABI* init)(void));
+void APS5_VABI __pthread_cxa_finalize_nid_postfix(void* argument);
+int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
+int APS5_VABI scePthreadKeyDelete(PthreadKey key);
+void* APS5_VABI scePthreadGetspecific(PthreadKey key);
+int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
+int APS5_VABI __inet_pton_nid_postfix(int family, const char* text, void* destination);
+const char* APS5_VABI __inet_ntop_nid_postfix(int family, const void* source, char* destination, std::uint32_t capacity);
+std::uint32_t APS5_VABI htonl_nid_postfix(std::uint32_t value);
+std::uint32_t APS5_VABI ntohl_nid_postfix(std::uint32_t value);
+std::uint16_t APS5_VABI htons_nid_postfix(std::uint16_t value);
+std::uint16_t APS5_VABI ntohs_nid_postfix(std::uint16_t value);
+int APS5_VABI pselect_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout, const void* sigmask);
+const char* APS5_VABI inet_ntop_nid_postfix(int af, const void* src, char* dst, uint32_t size);
+int APS5_VABI inet_pton_nid_postfix(int af, const char* src, void* dst);
+int APS5_VABI select_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout);
+int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
+int APS5_VABI _fcntl_nid_postfix(int descriptor, int command, ...);
+int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length);
+int APS5_VABI getsockopt_nid_postfix(int descriptor, int level, int option, void* value, std::uint32_t* length);
+int APS5_VABI socket_nid_postfix(int family, int type, int protocol);
+int APS5_VABI __sys_socketex_nid_postfix(const char* name, int family, int type, int protocol);
+int APS5_VABI socketpair_nid_postfix(int family, int type, int protocol, int* descriptors);
+int APS5_VABI connect_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI listen_nid_postfix(int descriptor, int backlog);
+int APS5_VABI accept_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+std::int64_t APS5_VABI send_nid_postfix(int descriptor, const void* buffer, std::uint64_t length, int flags);
+std::int64_t APS5_VABI recv_nid_postfix(int descriptor, void* buffer, std::uint64_t length, int flags);
+int APS5_VABI bind_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI shutdown_nid_postfix(int descriptor, int how);
+int APS5_VABI getsockname_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI getpeername_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI ioctl_nid_postfix(int descriptor, std::uint64_t request, void* argument);
+int APS5_VABI _ioctl_nid_postfix(int descriptor, std::uint64_t request, void* argument);
+std::int64_t APS5_VABI sendto_nid_postfix(int descriptor, const void* buffer, std::uint64_t length, int flags, const void* address, std::uint32_t addressLength);
+std::int64_t APS5_VABI recvfrom_nid_postfix(int descriptor, void* buffer, std::uint64_t length, int flags, void* address, std::uint32_t* addressLength);
+std::int64_t APS5_VABI sendmsg_nid_postfix(int descriptor, const GuestMsghdr* message, int flags);
+std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message, int flags);
+int APS5_VABI sendfile_nid_postfix(int file, int descriptor, std::int64_t offset, std::uint64_t length, const GuestSendfileHeaders* headers, std::int64_t* sbytes, int flags);
+int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t count, int timeout);
+int APS5_VABI _setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length);
+int APS5_VABI _getsockopt_nid_postfix(int descriptor, int level, int option, void* value, std::uint32_t* length);
+int APS5_VABI _connect_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI _listen_nid_postfix(int descriptor, int backlog);
+int APS5_VABI _accept_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI _bind_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI _getsockname_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI _getpeername_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+std::int64_t APS5_VABI _sendto_nid_postfix(int descriptor, const void* buffer, std::uint64_t length, int flags, const void* address, std::uint32_t addressLength);
+std::int64_t APS5_VABI _recvfrom_nid_postfix(int descriptor, void* buffer, std::uint64_t length, int flags, void* address, std::uint32_t* addressLength);
+std::int64_t APS5_VABI _sendmsg_nid_postfix(int descriptor, const GuestMsghdr* message, int flags);
+std::int64_t APS5_VABI _recvmsg_nid_postfix(int descriptor, GuestMsghdr* message, int flags);
+int APS5_VABI sceKernelSyncOnAddressWait(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait8(std::uint8_t* address, std::uint8_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait16(std::uint16_t* address, std::uint16_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait32(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait64(std::uint64_t* address, std::uint64_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWake(void* address, std::int32_t count);
+int APS5_VABI _umtx_op_nid_postfix(void* object, int operation, std::uint64_t value, void* sizeArgument, void* timeArgument);
+int APS5_VABI sceCoredumpRegisterCoredumpHandler(uint64_t handler, size_t stackSize, uint64_t context);
+int APS5_VABI sceCoredumpUnregisterCoredumpHandler(void);
+int APS5_VABI sceKernelDebugWriteCppExceptionInfo(const void* exception, uint64_t unknown, const char* typeName, const char* what);
+int APS5_VABI sceCoredumpAttachUserFile(std::uint32_t userValue, const char* path);
+int APS5_VABI sceCoredumpGetStopInfoGpu_Agc(void* info, size_t size);
+int APS5_VABI sceCoredumpAttachMemoryRegionAsUserFile(std::uint32_t userValue, const void* mem, std::int32_t size, const char* name);
+int APS5_VABI sceCoredumpSetUserDataType(std::int32_t type);
+void APS5_VABI sceCoredumpDebugTextOut(const char* str, int len);
+int64_t APS5_VABI sceCoredumpWriteUserData(const void* data, size_t size);
+int APS5_VABI sceCoredumpGetStopInfoCpu(void* info, size_t size);
+int APS5_VABI sceCoredumpGetThreadContextInfo(void* threadContextInfo, size_t threadContextInfoSize);
+int APS5_VABI sceCoredumpWriteUserString(uint32_t first, const char* text, int third);
+int APS5_VABI sceCoredumpConfigDumpMode(int mode);
+int APS5_VABI sceCoredumpAttachUserMemoryFile(std::uint32_t userValue, const void* mem, std::int32_t size);
+int APS5_VABI sceCoredumpAttachMemoryRegion(std::uint32_t userValue, const void* mem, std::int32_t size);
+std::int32_t APS5_VABI sceKernelError(std::int32_t posixError);
+int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
+int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
+int APS5_VABI sceKernelRaiseException(Pthread thread, int signum);
+void APS5_VABI sceKernelDebugRaiseException(int c1, int c2);
+void APS5_VABI sceKernelDebugRaiseExceptionOnReleaseMode(int c1, int c2);
+int APS5_VABI getlogin_r_nid_postfix(char* output, int size);
+char* APS5_VABI getlogin_nid_postfix(void);
+int SetLogin_nid_no_patch(const char* name);
+int APS5_VABI sceKernelDebugOutText(int channel, const char* text);
+int APS5_VABI sceKernelSendNotificationRequest(int device, const void* request, std::size_t size, int flags);
+int APS5_VABI getargc_nid_postfix(void);
+const char** APS5_VABI getargv_nid_postfix(void);
+int APS5_VABI getpagesize_nid_postfix(void);
+int APS5_VABI getpid_nid_postfix(void);
+int APS5_VABI getsid_nid_postfix(int pid);
+int APS5_VABI getppid_nid_postfix(void);
+int APS5_VABI sceKernelGetAppInfo(int pid, void* info);
+int APS5_VABI getuid_nid_postfix(void);
+int APS5_VABI geteuid_nid_postfix(void);
+int APS5_VABI getgid_nid_postfix(void);
+int APS5_VABI getegid_nid_postfix(void);
+int APS5_VABI issetugid_nid_postfix(void);
+int APS5_VABI getresuid_nid_postfix(std::uint32_t* ruid, std::uint32_t* euid, std::uint32_t* suid);
+int APS5_VABI getresgid_nid_postfix(std::uint32_t* rgid, std::uint32_t* egid, std::uint32_t* sgid);
+int APS5_VABI system_nid_postfix(const char* command);
+int APS5_VABI waitpid_nid_postfix(int pid, int* status, int options);
+int APS5_VABI setrlimit_nid_postfix(int resource, const GuestResourceLimit* limit);
+int APS5_VABI wait_nid_postfix(int* status);
+int APS5_VABI execvp_nid_postfix(const char* file, char* const* arguments);
+int APS5_VABI execv_nid_postfix(const char* path, char* const* arguments);
+int APS5_VABI execve_nid_postfix(const char* path, char* const* arguments, char* const* environment);
+int APS5_VABI sceKernelGetCurrentCpu(void);
+int APS5_VABI sceKernelGetMainSocId(void);
+int APS5_VABI sceKernelGetCpumode(void);
+std::uint64_t APS5_VABI sceKernelGetGPI(void);
+void APS5_VABI sceKernelSetGPO(std::uint32_t bits);
+int APS5_VABI sceKernelGetOpenPsId(void* openPsIdOutput);
+void* APS5_VABI sceKernelGetProcParam(void);
+int APS5_VABI sceKernelUuidCreate(std::uint32_t* uuid);
+int APS5_VABI sceKernelCreateUuidV4(std::uint8_t* uuid);
+void APS5_VABI sceKernelSync(void);
+void APS5_VABI sync_nid_postfix(void);
+int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
+int APS5_VABI sched_get_priority_min_nid_postfix(int policy);
+int APS5_VABI sysarch(int operation, void* parameters);
+int APS5_VABI getrusage_nid_postfix(int who, GuestResourceUsage* usage);
+int APS5_VABI getrlimit_nid_postfix(int resource, GuestResourceLimit* limit);
+int APS5_VABI getpriority_nid_postfix(int which, int who);
+int APS5_VABI setpriority_nid_postfix(int which, int who, int niceval);
+int APS5_VABI getdtablesize_nid_postfix(void);
+int APS5_VABI sceKernelIsTrinityMode(void);
+void APS5_VABI sceKernelGetOperationMode(int* mode, int* submode);
+int APS5_VABI seteuid_nid_postfix(std::uint32_t euid);
+int APS5_VABI setegid_nid_postfix(std::uint32_t egid);
+int APS5_VABI setuid_nid_postfix(std::uint32_t uid);
+int APS5_VABI setgid_nid_postfix(std::uint32_t gid);
+int APS5_VABI setreuid_nid_postfix(std::uint32_t ruid, std::uint32_t euid);
+int APS5_VABI setregid_nid_postfix(std::uint32_t rgid, std::uint32_t egid);
+int APS5_VABI setresuid_nid_postfix(std::uint32_t ruid, std::uint32_t euid, std::uint32_t suid);
+int APS5_VABI setresgid_nid_postfix(std::uint32_t rgid, std::uint32_t egid, std::uint32_t sgid);
+int APS5_VABI setgroups_nid_postfix(int count, const std::uint32_t* groups);
+int APS5_VABI getgroups_nid_postfix(int capacity, std::uint32_t* groups);
+void APS5_VABI sceKernelRtldSetApplicationHeapAPI(void* api[]);
+int APS5_VABI sceKernelRtldThreadAtexitDecrement(const void* dsoSymbol);
+int APS5_VABI sceKernelRtldThreadAtexitIncrement(const void* dsoSymbol);
+void APS5_VABI sceKernelSetThreadAtexitCount(get_thread_atexit_count_func_t func);
+void APS5_VABI sceKernelSetThreadAtexitReport(thread_atexit_report_func_t func);
+void APS5_VABI sceKernelSetThreadDtors(thread_dtors_func_t dtors);
+void APS5_VABI _sceKernelRtldSetApplicationHeapAPI_nid_postfix(void* api[]);
+int APS5_VABI _sceKernelRtldThreadAtexitDecrement_nid_postfix(const void* dsoSymbol);
+int APS5_VABI _sceKernelRtldThreadAtexitIncrement_nid_postfix(const void* dsoSymbol);
+void APS5_VABI _sceKernelSetThreadAtexitCount_nid_postfix(get_thread_atexit_count_func_t callback);
+void APS5_VABI _sceKernelSetThreadAtexitReport_nid_postfix(thread_atexit_report_func_t callback);
+void APS5_VABI _sceKernelSetThreadDtors_nid_postfix(thread_dtors_func_t callback);
+const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
+int APS5_VABI sceKernelIsAddressSanitizerEnabled(void);
+int APS5_VABI sceKernelIsThreadSanitizerEnabled(void);
+MallocReplace* APS5_VABI sceKernelGetSanitizerMallocReplaceExternal(void);
+NewReplace* APS5_VABI sceKernelGetSanitizerNewReplaceExternal(void);
+int APS5_VABI getitimer_nid_postfix(int which, GuestItimerval* output);
+int APS5_VABI setitimer_nid_postfix(int which, const GuestItimerval* value, GuestItimerval* previous);
+GuestHandler APS5_VABI signal_nid_postfix(int guest, GuestHandler handler);
+int APS5_VABI sigaction_nid_postfix(int guest, const GuestSigaction* action, GuestSigaction* previous);
+int APS5_VABI _sigaction_nid_postfix(int guest, const GuestSigaction* action, GuestSigaction* previous);
+int APS5_VABI raise_nid_postfix(int guest);
+int APS5_VABI kill_nid_postfix(int pid, int guest);
+int APS5_VABI killpg_nid_postfix(int pgrp, int guest);
+int APS5_VABI pthread_kill_nid_postfix(Pthread thread, int guest);
+int APS5_VABI sigaltstack_nid_postfix(const GuestStack* stack, GuestStack* previous);
+int APS5_VABI _sigprocmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet);
+int APS5_VABI SetSignalMaskCatching_nid_no_patch(const GuestSignalSet* set, GuestSignalSet* previousSet);
+int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
+int APS5_VABI pthread_sigmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet);
+int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet* set, void* info, const KernelTimespec* timeout);
+int APS5_VABI sigwaitinfo_nid_postfix(const GuestSignalSet* set, void* info);
+int APS5_VABI sigwait_nid_postfix(const GuestSignalSet* set, int* received);
+int APS5_VABI pause_nid_postfix(void);
+int APS5_VABI sigsuspend_nid_postfix(const GuestSignalSet* set);
+int APS5_VABI _sigsuspend_nid_postfix(const GuestSignalSet* set);
+int APS5_VABI sigpending_nid_postfix(GuestSignalSet* set);
+int APS5_VABI _is_signal_return_nid_postfix(std::uint64_t programCounter);
+int APS5_VABI sigemptyset_nid_postfix(GuestSignalSet* set);
+int APS5_VABI sigfillset_nid_postfix(GuestSignalSet* set);
+int APS5_VABI sigaddset_nid_postfix(GuestSignalSet* set, int signal);
+int APS5_VABI sigdelset_nid_postfix(GuestSignalSet* set, int signal);
+int APS5_VABI sigismember_nid_postfix(const GuestSignalSet* set, int signal);
+int APS5_VABI sceKernelGetProsperoSystemSwVersion_nid_postfix(SceKernelProsperoSystemSwVersion* version);
+int APS5_VABI sceKernelGetAllowedSdkVersionOnSystem_nid_postfix(std::uint32_t* version);
+std::int64_t APS5_VABI sysconf_nid_postfix(int name);
+int APS5_VABI sysctl_nid_postfix(const int* name, std::uint32_t nameLength, void* oldValue, std::size_t* oldLength, const void* newValue, std::size_t newLength);
+int APS5_VABI sysctlbyname_nid_postfix(const char* name, void* oldValue, std::size_t* oldLength, const void* newValue, std::size_t newLength);
+int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion* version);
+int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_t* size);
+int APS5_VABI sceKernelGetCpuTemperature(int* outCelsius);
+int APS5_VABI sceKernelGetSocSensorTemperature(int sensorId, int* outCelsius);
+int APS5_VABI sceKernelGetSocPowerConsumption(void* consumption);
+int APS5_VABI setcontext_nid_postfix(const UserUcontext* context);
+int APS5_VABI ktimer_create_nid_postfix(int clock, const GuestSigevent* event, int* timerid);
+int APS5_VABI ktimer_delete_nid_postfix(int id);
+int APS5_VABI ktimer_settime_nid_postfix(int id, int flags, const GuestItimerspec* value, GuestItimerspec* oldValue);
+int APS5_VABI ktimer_gettime_nid_postfix(int id, GuestItimerspec* value);
+int APS5_VABI ktimer_getoverrun_nid_postfix(int id);
+int APS5_VABI _nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
+int APS5_VABI usleep_nid_postfix(KernelUseconds microseconds);
+int APS5_VABI clock_settime_nid_postfix(int clockId, const KernelTimespec* tp);
+int APS5_VABI sceKernelClockGetres(KernelClockid clockId, KernelTimespec* tp);
+int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
+int APS5_VABI sceKernelConvertLocaltimeToUtc(int64_t localTime, int64_t reserved, int64_t* utcTime, KernelTimesec* timezone, int32_t* dstSeconds);
+int APS5_VABI sceKernelConvertUtcToLocaltime(int64_t utcTime, int64_t* localTime, KernelTimesec* st, int32_t* dstSec);
+int APS5_VABI sceKernelGettimeofday(KernelTimeval* tp);
+int APS5_VABI sceKernelGettimezone(KernelTimezone* tz);
+uint64_t APS5_VABI sceKernelReadTsc(void);
+std::int64_t APS5_VABI sceKernelGetCpuFrequency(void);
+unsigned int APS5_VABI sceKernelSleep(unsigned int seconds);
+
+[[noreturn]] void APS5_VABI _exit_nid_postfix(int status);
+
+[[gnu::returns_twice]] int APS5_VABI getcontext_nid_postfix(UserUcontext* context);
+[[gnu::returns_twice]] int APS5_VABI swapcontext_nid_postfix(UserUcontext* oucp, const UserUcontext* ucp);
+
+[[gnu::returns_twice]] int APS5_VABI sigsetjmp_nid_postfix(std::uint64_t* buffer, int saveMask);
+[[noreturn]] void APS5_VABI siglongjmp_nid_postfix(std::uint64_t* buffer, int value);
+
+int APS5_VABI sceKernelGetTraceMemoryStats(std::uint64_t* first, std::uint64_t* second);
+int APS5_VABI pthread_cond_signalto_np_nid_postfix(PthreadCond* cond, Pthread thread);
+int APS5_VABI scePthreadCondattrSetpshared(PthreadCondattr* attr, int pshared);
+int APS5_VABI scePthreadCondattrGetpshared(const PthreadCondattr* attr, int* pshared);
+int APS5_VABI pthread_mutexattr_setkind_np_nid_postfix(PthreadMutexattr* attr, int kind);
+int APS5_VABI pthread_mutexattr_getkind_np_nid_postfix(PthreadMutexattr attr);
+int APS5_VABI scePthreadMutexattrGettype(const PthreadMutexattr* attr, int* type);
+int APS5_VABI scePthreadMutexattrSetkind(PthreadMutexattr* attr, int kind);
+int APS5_VABI scePthreadMutexattrGetkind(PthreadMutexattr attr);
+int APS5_VABI scePthreadMutexattrGetprotocol(const PthreadMutexattr* attr, int* protocol);
+int APS5_VABI scePthreadMutexattrSetprioceiling(PthreadMutexattr* attr, int prioceiling);
+int APS5_VABI scePthreadMutexattrGetprioceiling(const PthreadMutexattr* attr, int* prioceiling);
+int APS5_VABI scePthreadMutexattrSetpshared(PthreadMutexattr* attr, int pshared);
+int APS5_VABI scePthreadMutexattrGetpshared(const PthreadMutexattr* attr, int* pshared);
+int APS5_VABI pthread_rwlockattr_gettype_np_nid_postfix(const PthreadRwlockattr* attr, int* type);
+int APS5_VABI pthread_rwlockattr_settype_np_nid_postfix(PthreadRwlockattr* attr, int type);
+int APS5_VABI scePthreadRwlockattrGettype(const PthreadRwlockattr* attr, int* type);
+int APS5_VABI scePthreadRwlockattrSetpshared(PthreadRwlockattr* attr, int pshared);
+int APS5_VABI scePthreadRwlockattrGetpshared(const PthreadRwlockattr* attr, int* pshared);
+int APS5_VABI setpgid_nid_postfix(int pid, int pgid);
+int APS5_VABI setpgrp_nid_postfix(int pid, int pgrp);
+int APS5_VABI sceKernelGetSystemExVersion(char* first, char* second);
+int APS5_VABI sysKernelGetLowerLimitSysexVersion_nid_postfix(char* version);
+int APS5_VABI sysKernelGetLowerLimitUpdVersion_nid_postfix(std::uint32_t* version);
+
+}
diff --git a/core/libs/prx/libkernel/libkernel.hpp b/core/libs/prx/libkernel/libkernel.hpp
new file mode 100644
index 0000000000..3a32592846
--- /dev/null
+++ b/core/libs/prx/libkernel/libkernel.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/Equeue/Equeue.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Atfork.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
diff --git a/core/libs/prx/libkernel_sys/Aio.cpp b/core/libs/prx/libkernel_sys/Aio.cpp
index 789b0c72d3..f81b5842de 100644
--- a/core/libs/prx/libkernel_sys/Aio.cpp
+++ b/core/libs/prx/libkernel_sys/Aio.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <chrono>
 #include <condition_variable>
@@ -14,13 +17,6 @@
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-extern "C" std::int64_t APS5_VABI _fstat_nid_postfix(int descriptor, FileStat* status);
-extern "C" std::int64_t APS5_VABI pread_nid_postfix(int descriptor, void* buffer, std::size_t bytes, std::int64_t offset);
-extern "C" std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int descriptor, const void* buffer, std::size_t bytes, std::int64_t offset);
-extern "C" int APS5_VABI fsync_nid_postfix(int descriptor);
-
 namespace {
 
 constexpr int GuestEbadf = 9;
@@ -56,36 +52,9 @@ constexpr std::uint64_t IoSizeMax = std::numeric_limits<int>::max();
 constexpr std::int64_t NanosecondsPerSecond = 1000000000;
 constexpr std::int64_t TickNanoseconds = 1000000;
 
-struct GuestSigevent {
-    int notify;
-    int signo;
-    std::int64_t value;
-    std::int64_t extra[8];
-};
-
-struct GuestAiocb {
-    int fildes;
-    std::int64_t offset;
-    void* buf;
-    std::uint64_t nbytes;
-    int spare[2];
-    void* spare2;
-    int lioOpcode;
-    int reqprio;
-    std::int64_t status;
-    std::int64_t error;
-    void* kernelinfo;
-    GuestSigevent sigevent;
-};
-
 static_assert(offsetof(GuestAiocb, lioOpcode) == 48 && offsetof(GuestAiocb, status) == 56 && offsetof(GuestAiocb, sigevent) == 80);
 static_assert(sizeof(GuestAiocb) == 160);
 
-struct GuestTimespec {
-    std::int64_t tv_sec;
-    std::int64_t tv_nsec;
-};
-
 enum class State { Queued, Running, Done };
 
 struct Job {
@@ -170,7 +139,7 @@ std::int64_t Consume(Aio& aio, std::list<std::shared_ptr<Job>>::iterator found)
     return job->error != 0 ? Fail(job->error) : job->status;
 }
 
-std::optional<std::chrono::nanoseconds> WaitTime(const GuestTimespec& time) {
+std::optional<std::chrono::nanoseconds> WaitTime(const KernelTimespec& time) {
     if (time.tv_sec < 0 || time.tv_nsec < 0 || time.tv_nsec >= NanosecondsPerSecond) return std::nullopt;
     const auto microseconds = time.tv_nsec / 1000;
     const std::int64_t whole = microseconds * 1000;
@@ -270,7 +239,7 @@ std::int64_t APS5_VABI aio_return_nid_postfix(GuestAiocb* aiocb) {
     return Fail(GuestEinval);
 }
 
-int APS5_VABI aio_suspend_nid_postfix(const GuestAiocb* const* list, int count, const GuestTimespec* timeout) {
+int APS5_VABI aio_suspend_nid_postfix(const GuestAiocb* const* list, int count, const KernelTimespec* timeout) {
     if (count < 0 || count > static_cast<int>(QueuePerProcess)) return Fail(GuestEinval);
     std::optional<std::chrono::nanoseconds> wait;
     if (timeout != nullptr) {
@@ -296,7 +265,7 @@ int APS5_VABI aio_suspend_nid_postfix(const GuestAiocb* const* list, int count,
     }
 }
 
-std::int64_t APS5_VABI aio_waitcomplete_nid_postfix(GuestAiocb** result, const GuestTimespec* timeout) {
+std::int64_t APS5_VABI aio_waitcomplete_nid_postfix(GuestAiocb** result, const KernelTimespec* timeout) {
     if (result != nullptr) *result = nullptr;
     std::optional<std::chrono::nanoseconds> wait;
     bool poll = false;
diff --git a/core/libs/prx/libkernel_sys/CMakeLists.txt b/core/libs/prx/libkernel_sys/CMakeLists.txt
index 8aead464a0..70631309ca 100644
--- a/core/libs/prx/libkernel_sys/CMakeLists.txt
+++ b/core/libs/prx/libkernel_sys/CMakeLists.txt
@@ -1,3 +1,3 @@
-add_library(${LIB_NAME} SHARED EXCLUDE_FROM_ALL Export.cpp Export.Discovery.cpp Aio.cpp)
+add_library(${LIB_NAME} SHARED EXCLUDE_FROM_ALL Export.cpp Export.Discovery.cpp Aio.cpp ThreadQueries.cpp)
 target_include_directories(${LIB_NAME} PRIVATE ${LIBS_INCLUDE_DIR})
 configure_windows_unwind(${LIB_NAME})
diff --git a/core/libs/prx/libkernel_sys/Export.Discovery.cpp b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
index d95cef6785..2cb89a6cb3 100644
--- a/core/libs/prx/libkernel_sys/Export.Discovery.cpp
+++ b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
@@ -1,26 +1,14 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/Pthread/include/Pthread.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Atfork.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstddef>
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI pthread_barrier_init_nid_postfix(void** barrier, void* const* attr, unsigned count);
-int APS5_VABI pthread_barrier_wait_nid_postfix(void** barrier);
-int APS5_VABI pthread_barrier_destroy_nid_postfix(void** barrier);
-int APS5_VABI pthread_barrierattr_init_nid_postfix(void** attr);
-int APS5_VABI pthread_barrierattr_destroy_nid_postfix(void** attr);
-int APS5_VABI pthread_barrierattr_getpshared_nid_postfix(void* const* attr, int* pshared);
-int APS5_VABI pthread_barrierattr_setpshared_nid_postfix(void** attr, int pshared);
-int APS5_VABI pthread_getcpuclockid_nid_postfix(void* thread, int* clockId);
-int APS5_VABI pthread_getconcurrency_nid_postfix();
-int APS5_VABI pthread_setconcurrency_nid_postfix(int level);
-int APS5_VABI pthread_attr_getscope_nid_postfix(void* const* attr, int* scope);
-int APS5_VABI pthread_attr_setscope_nid_postfix(void** attr, int scope);
-int APS5_VABI pthread_atfork_nid_postfix(void (APS5_VABI* prepare)(), void (APS5_VABI* parent)(), void (APS5_VABI* child)());
-int APS5_VABI msync_nid_postfix(void* address, std::size_t length, int flags);
-}
-
 namespace {
 
 int SceResult(int error) {
@@ -56,11 +44,6 @@ int APS5_VABI blockpool_unmap_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI chown_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI cpuset_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -81,21 +64,11 @@ int APS5_VABI dynlib_get_obj_member_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI fchownat_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI futimesat_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI get_authinfo_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI get_module_info_list_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -126,11 +99,6 @@ int APS5_VABI getfsstat_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI getlogin_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI ipmimgr_call_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -271,16 +239,6 @@ int APS5_VABI lchflags_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI lchown_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI linkat_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI mdbg_call_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -306,11 +264,6 @@ int APS5_VABI profil_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pselect_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI pthread_attr_getaffinity_np_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -326,8 +279,10 @@ int APS5_VABI pthread_attr_setaffinity_np_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pthread_attr_setcreatesuspend_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI pthread_attr_setcreatesuspend_np_nid_postfix(PthreadAttr* attr) {
+    constexpr int GuestEinval = 22;
+    if (!attr || !*attr) return GuestEinval;
+    (*attr)->_createSuspended = true;
     return 0;
 }
 
@@ -341,11 +296,6 @@ int APS5_VABI pthread_barrier_setname_np_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pthread_cond_setname_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI pthread_get_specificarray_np_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -361,13 +311,8 @@ int APS5_VABI pthread_getstack_np_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pthread_main_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI pthread_multi_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
+    pthread_resume_all_np_nid_postfix();
     return 0;
 }
 
@@ -401,14 +346,15 @@ int APS5_VABI pthread_mutexattr_setgen_np_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pthread_resume_all_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI pthread_resume_all_np_nid_postfix(void) {
+    ResumeAllGuestThreads_nid_no_patch();
+    scePthreadTestcancel();
 }
 
-int APS5_VABI pthread_resume_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI pthread_resume_np_nid_postfix(Pthread thread) {
+    constexpr int GuestEinval = 22;
+    if (!thread) return GuestEinval;
+    return ResumeGuestThread_nid_no_patch(thread);
 }
 
 int APS5_VABI pthread_resume_user_context_np_nid_postfix(void) {
@@ -421,11 +367,6 @@ int APS5_VABI pthread_rwlock_setname_np_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pthread_rwlockattr_settype_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI pthread_set_user_context_np_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -452,13 +393,11 @@ int APS5_VABI pthread_suspend_user_context_np_nid_postfix(void) {
 }
 
 int APS5_VABI pthread_switch_add_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 45;
 }
 
 int APS5_VABI pthread_switch_delete_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 45;
 }
 
 int APS5_VABI ptrace_nid_postfix(void) {
@@ -532,7 +471,6 @@ int APS5_VABI sceKernelAddProcessToCanvasMap(void) {
 }
 
 int APS5_VABI sceKernelAddResource(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -612,18 +550,11 @@ int APS5_VABI sceKernelClearBootReqNotifyCount(void) {
 }
 
 int APS5_VABI sceKernelClearGameDirectMemory(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x8002004e);
 }
 
 int APS5_VABI sceKernelCloseEport(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceKernelCloseEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80020001);
 }
 
 int APS5_VABI sceKernelCloseSema(void) {
@@ -637,8 +568,7 @@ int APS5_VABI sceKernelCreateBudget(void) {
 }
 
 int APS5_VABI sceKernelCreateEport(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80020001);
 }
 
 int APS5_VABI sceKernelDebugAcquireAndUpdateDebugRegister(void) {
@@ -717,8 +647,7 @@ int APS5_VABI sceKernelDeleteCpumodeEvent(void) {
 }
 
 int APS5_VABI sceKernelDeleteEport(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80020001);
 }
 
 int APS5_VABI sceKernelDeleteGpuExceptionEvent(void) {
@@ -762,7 +691,6 @@ int APS5_VABI sceKernelEndAppMount2(void) {
 }
 
 int APS5_VABI sceKernelEventLogInit(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -1036,11 +964,6 @@ int APS5_VABI sceKernelGetMemoryPstate(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetOpenPsIdForSystem(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetPagingStatsOfAllObjects(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1181,11 +1104,6 @@ int APS5_VABI sceKernelGetSubsysSubId(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetSystemExVersion(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetSystemLevelDebuggerModeForRcmgr(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1201,11 +1119,6 @@ int APS5_VABI sceKernelGetThreadName(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetTraceMemoryStats(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetUniversalMode(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1282,8 +1195,7 @@ int APS5_VABI sceKernelGiveDirectMemoryToMapper(void) {
 }
 
 int APS5_VABI sceKernelHasNeoMode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 1;
 }
 
 int APS5_VABI sceKernelHwGetBdDriveInfo(void) {
@@ -1322,8 +1234,7 @@ int APS5_VABI sceKernelIccGetBootTimestamp(void) {
 }
 
 int APS5_VABI sceKernelIccGetCPMode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x8002002d);
 }
 
 int APS5_VABI sceKernelIccGetCountTime(void) {
@@ -1417,8 +1328,7 @@ int APS5_VABI sceKernelIccSetBuzzer(void) {
 }
 
 int APS5_VABI sceKernelIccSetCPMode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x8002002d);
 }
 
 int APS5_VABI sceKernelIccSetCpuInfoBit(void) {
@@ -1472,13 +1382,7 @@ int APS5_VABI sceKernelIsAllowedToSelectDvdRegion(void) {
 }
 
 int APS5_VABI sceKernelIsAuthenticNeo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceKernelIsCEX(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 1;
 }
 
 int APS5_VABI sceKernelIsDebuggerAttached(void) {
@@ -1486,11 +1390,6 @@ int APS5_VABI sceKernelIsDebuggerAttached(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelIsDevKit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelIsExperimentalBeta(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1507,13 +1406,11 @@ int APS5_VABI sceKernelIsGenuineDevKit(void) {
 }
 
 int APS5_VABI sceKernelIsGenuineKratosCex(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceKernelIsGenuineN(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 1;
 }
 
 int APS5_VABI sceKernelIsGenuineTestKit(void) {
@@ -1581,10 +1478,6 @@ int APS5_VABI sceKernelKernelHeapUsage(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelLoadStartModuleForSysmodule(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 int APS5_VABI sceKernelLoadStartModuleInternalForMono(void) {
     NotImplemented_nid_no_patch(__func__);
@@ -1632,8 +1525,7 @@ int APS5_VABI sceKernelMapToolMemory(void) {
 }
 
 int APS5_VABI sceKernelMapTraceMemory(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x8002004e);
 }
 
 int APS5_VABI sceKernelMapperGetParam(void) {
@@ -1681,8 +1573,7 @@ int APS5_VABI sceKernelNotifySystemSuspendStart(void) {
 }
 
 int APS5_VABI sceKernelOpenEport(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80020001);
 }
 
 int APS5_VABI sceKernelOpenInternal(void) {
@@ -1726,8 +1617,7 @@ int APS5_VABI sceKernelQueryToolMemory(void) {
 }
 
 int APS5_VABI sceKernelQueryTraceMemory(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80020002);
 }
 
 int APS5_VABI sceKernelRandomizedPath(void) {
@@ -1751,7 +1641,6 @@ int APS5_VABI sceKernelReleaseToolMemory(void) {
 }
 
 int APS5_VABI sceKernelReleaseTraceDirectMemory(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -2066,13 +1955,11 @@ int APS5_VABI sceKernelTitleWorkdaroundIsEnabled(void) {
 }
 
 int APS5_VABI sceKernelTraceMemoryTypeProtect(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x8002004e);
 }
 
 int APS5_VABI sceKernelTriggerEport(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x80020001);
 }
 
 int APS5_VABI sceKernelVirtualQueryAll(void) {
@@ -2199,46 +2086,46 @@ int APS5_VABI scePthreadAtfork(void (APS5_VABI* prepare)(), void (APS5_VABI* par
     return SceResult(pthread_atfork_nid_postfix(prepare, parent, child));
 }
 
-int APS5_VABI scePthreadAttrGetscope(void* const* attr, int* scope) {
+int APS5_VABI scePthreadAttrGetscope(const PthreadAttr* attr, int* scope) {
     return SceResult(pthread_attr_getscope_nid_postfix(attr, scope));
 }
 
-int APS5_VABI scePthreadAttrSetcreatesuspend(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadAttrSetcreatesuspend(PthreadAttr* attr) {
+    const int error = pthread_attr_setcreatesuspend_np_nid_postfix(attr);
+    return error == 0 ? 0 : SceKernelError(error);
 }
 
-int APS5_VABI scePthreadAttrSetscope(void** attr, int scope) {
+int APS5_VABI scePthreadAttrSetscope(PthreadAttr* attr, int scope) {
     return SceResult(pthread_attr_setscope_nid_postfix(attr, scope));
 }
 
-int APS5_VABI scePthreadBarrierDestroy(void** barrier) {
+int APS5_VABI scePthreadBarrierDestroy(PthreadBarrierPrivate** barrier) {
     return SceResult(pthread_barrier_destroy_nid_postfix(barrier));
 }
 
-int APS5_VABI scePthreadBarrierInit(void** barrier, void* const* attr, unsigned count, const char* name) {
+int APS5_VABI scePthreadBarrierInit(PthreadBarrierPrivate** barrier, PthreadBarrierattrPrivate* const* attr, unsigned count, const char* name) {
     (void)name;
     return SceResult(pthread_barrier_init_nid_postfix(barrier, attr, count));
 }
 
-int APS5_VABI scePthreadBarrierWait(void** barrier) {
+int APS5_VABI scePthreadBarrierWait(PthreadBarrierPrivate** barrier) {
     const int result = pthread_barrier_wait_nid_postfix(barrier);
     return result > 0 ? SceKernelError(result) : result;
 }
 
-int APS5_VABI scePthreadBarrierattrDestroy(void** attr) {
+int APS5_VABI scePthreadBarrierattrDestroy(PthreadBarrierattrPrivate** attr) {
     return SceResult(pthread_barrierattr_destroy_nid_postfix(attr));
 }
 
-int APS5_VABI scePthreadBarrierattrGetpshared(void* const* attr, int* pshared) {
+int APS5_VABI scePthreadBarrierattrGetpshared(PthreadBarrierattrPrivate* const* attr, int* pshared) {
     return SceResult(pthread_barrierattr_getpshared_nid_postfix(attr, pshared));
 }
 
-int APS5_VABI scePthreadBarrierattrInit(void** attr) {
+int APS5_VABI scePthreadBarrierattrInit(PthreadBarrierattrPrivate** attr) {
     return SceResult(pthread_barrierattr_init_nid_postfix(attr));
 }
 
-int APS5_VABI scePthreadBarrierattrSetpshared(void** attr, int pshared) {
+int APS5_VABI scePthreadBarrierattrSetpshared(PthreadBarrierattrPrivate** attr, int pshared) {
     return SceResult(pthread_barrierattr_setpshared_nid_postfix(attr, pshared));
 }
 
@@ -2246,18 +2133,14 @@ int APS5_VABI scePthreadGetconcurrency(void) {
     return pthread_getconcurrency_nid_postfix();
 }
 
-int APS5_VABI scePthreadGetcpuclockid(void* thread, int* clockId) {
+int APS5_VABI scePthreadGetcpuclockid(Pthread thread, int* clockId) {
     return SceResult(pthread_getcpuclockid_nid_postfix(thread, clockId));
 }
 
-int APS5_VABI scePthreadMain(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 int APS5_VABI scePthreadMulti(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    const int error = pthread_multi_np_nid_postfix();
+    return error == 0 ? 0 : SceKernelError(error);
 }
 
 int APS5_VABI scePthreadMutexGetprioceiling(void) {
@@ -2285,11 +2168,6 @@ int APS5_VABI scePthreadMutexattrGetgen(void) {
     return 0;
 }
 
-int APS5_VABI scePthreadMutexattrGetkind(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI scePthreadMutexattrInitForInternalLibc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -2300,19 +2178,13 @@ int APS5_VABI scePthreadMutexattrSetgen(void) {
     return 0;
 }
 
-int APS5_VABI scePthreadMutexattrSetkind(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadResume(Pthread thread) {
+    const int error = pthread_resume_np_nid_postfix(thread);
+    return error == 0 ? 0 : SceKernelError(error);
 }
 
-int APS5_VABI scePthreadResume(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI scePthreadResumeAll(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI scePthreadResumeAll(void) {
+    pthread_resume_all_np_nid_postfix();
 }
 
 int APS5_VABI scePthreadSetBesteffort(void) {
@@ -2364,41 +2236,16 @@ int APS5_VABI sched_setscheduler_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI sem_close_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sem_open_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sem_setname_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sem_unlink_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI set_phys_fmem_limit_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI setlogin_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI settimeofday_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sigqueue_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -2414,11 +2261,6 @@ int APS5_VABI statfs_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI swapcontext_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI swapon_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -2439,16 +2281,6 @@ int APS5_VABI sysKernelGetIntdevModeForRcmgr_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI sysKernelGetLowerLimitSysexVersion_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sysKernelGetLowerLimitUpdVersion_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sysKernelGetManufacturingMode_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index 03571bcf29..8dfa1ae6d7 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cstdarg>
 #include <cstdint>
@@ -29,7 +32,7 @@
 #include "prx/libkernel/File/include/DescriptorControl.hpp"
 #include "prx/libc/include/CreationMask.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
-extern "C" int APS5_VABI getpid_nid_postfix(void);
+
 #ifdef _WIN32
 #ifndef NOMINMAX
 #define NOMINMAX
@@ -43,24 +46,23 @@ extern "C" int APS5_VABI getpid_nid_postfix(void);
 #endif
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI getpid_nid_postfix();
-
 namespace {
 #ifdef _WIN32
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 static void IgnoreInvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {}
-static int GuestFstat(int fd) {
+static int GuestFstat(int fd, bool* withoutVnode = nullptr) {
     const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreInvalidParameter);
     struct _stat64 status{};
     const int result = ::_fstat64(fd, &status);
     _set_thread_local_invalid_parameter_handler(previous);
+    if (result == 0 && withoutVnode != nullptr) *withoutVnode = (status.st_mode & _S_IFMT) == _S_IFIFO;
     return result;
 }
 #endif
 
 constexpr int GuestEnoent = 2;
 constexpr int GuestEperm = 1;
+constexpr int GuestEsrch = 3;
 constexpr int GuestEio = 5;
 constexpr int GuestEbadf = 9;
 constexpr int GuestEfault = 14;
@@ -98,6 +100,7 @@ constexpr int PcRecXferAlign = 17;
 constexpr int PcSymlinkMax = 18;
 constexpr int PcMinHoleSize = 21;
 constexpr int PcAsyncIo = 53;
+constexpr std::int64_t PosixAsynchronousIo = 200112;
 constexpr int PcPrioIo = 54;
 constexpr int PcSyncIo = 55;
 constexpr int PcAclExtended = 59;
@@ -105,6 +108,7 @@ constexpr int PcAclPathMax = 60;
 constexpr int PcMacPresent = 63;
 constexpr int PcAclNfs4 = 64;
 constexpr int GuestAtSymlinkNofollow = 0x0200;
+constexpr int GuestAtSymlinkFollow = 0x0400;
 
 int GuestFileError(int error) {
     switch (error) {
@@ -128,6 +132,43 @@ std::int64_t Fail(int error) {
     return -1;
 }
 
+std::int64_t PathConfigurationValue(int name, const char* function) {
+    switch (name) {
+    case PcLinkMax: return 32767;
+    case PcNameMax: return static_cast<std::int64_t>(GuestNameMax);
+    case PcPathMax: return static_cast<std::int64_t>(GuestPathMax);
+    case PcPipeBuf: return 512;
+    case PcChownRestricted: return 1;
+    case PcNoTrunc: return 1;
+    case PcFileSizeBits: return 64;
+    case PcRecMaxXferSize: return -1;
+    case PcSymlinkMax: return static_cast<std::int64_t>(GuestPathMax);
+    case PcPrioIo: return 0;
+    case PcSyncIo: return 0;
+    case PcMaxCanon:
+    case PcMaxInput:
+    case PcVdisable:
+    case PcAllocSizeMin:
+    case PcRecIncrXferSize:
+    case PcRecMinXferSize:
+    case PcRecXferAlign:
+    case PcMinHoleSize:
+    case PcAsyncIo:
+    case PcAclExtended:
+    case PcAclPathMax:
+    case PcMacPresent:
+    case PcAclNfs4:
+        throw std::runtime_error(std::string(function) + ": name " + std::to_string(name) + " depends on the console filesystem or kernel configuration");
+    default: return Fail(GuestEinval);
+    }
+}
+
+int CopyPath(const char*& path, std::string& copy) {
+    if (const int error = CopyGuestPath_nid_no_patch(path, copy)) return error;
+    path = copy.c_str();
+    return copy.empty() ? GuestEnoent : 0;
+}
+
 int GuestError(const std::error_code& error) {
     const auto condition = error.default_error_condition();
     if (condition == std::errc::resource_unavailable_try_again) return GuestEagain;
@@ -156,6 +197,22 @@ bool HasNonDirectoryPrefix(const std::filesystem::path& native) {
     return false;
 }
 
+void RequireGuestOwner(const char* call, std::uint32_t uid, std::uint32_t gid) {
+    constexpr std::uint32_t Unchanged = 0xFFFFFFFFu;
+    if (uid != 0 && uid != Unchanged) NotImplemented_nid_no_patch((std::string(call) + ": an owner other than the guest user").c_str());
+    if (gid != 0 && gid != Unchanged) NotImplemented_nid_no_patch((std::string(call) + ": a group other than the guest group").c_str());
+}
+
+bool IsSymbolicLink(const std::filesystem::path& native) {
+#ifdef _WIN32
+    const DWORD attributes = GetFileAttributesW(native.wstring().c_str());
+    return attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0;
+#else
+    std::error_code error;
+    return std::filesystem::is_symlink(std::filesystem::symlink_status(native, error));
+#endif
+}
+
 std::int64_t ReadNativeLink(const std::filesystem::path& native, char* buffer, std::size_t size) {
 #ifdef _WIN32
     const DWORD attributes = GetFileAttributesW(native.wstring().c_str());
@@ -281,14 +338,42 @@ std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask) {
     return File::ExchangeCreationMask_nid_no_patch(mask);
 }
 
-int APS5_VABI _fstatfs_nid_postfix(int d, void* buf);
+int APS5_VABI sceKernelGetOpenPsIdForSystem(void* id) {
+    if (id == nullptr) return GuestEinval;
+    return sceKernelGetOpenPsId(id);
+}
 
-int APS5_VABI fstatfs_nid_postfix(int d, void* buf) {
+int APS5_VABI sceKernelIsCEX(void) {
+    return 1;
+}
+
+int APS5_VABI sceKernelIsDevKit(void) {
+    return 0;
+}
+
+int APS5_VABI get_authinfo_nid_postfix(int pid, KernelAuthInfo* info) {
+    if (info == nullptr) return static_cast<int>(Fail(GuestEperm));
+    if (pid != 0 && pid != getpid_nid_postfix()) return static_cast<int>(Fail(GuestEsrch));
+    *info = {};
+    info->capabilities[0] = 0x2000000000000000;
+    return 0;
+}
+
+int APS5_VABI setlogin_nid_postfix(const char* name) {
+    constexpr std::size_t MaxLoginName = 33;
+    std::string copy;
+    const int copied = CopyGuestString_nid_no_patch(name, MaxLoginName, copy);
+    if (copied == GuestEnametoolong) return static_cast<int>(Fail(GuestEinval));
+    if (copied != 0) return static_cast<int>(Fail(copied));
+    if (const int error = SetLogin_nid_no_patch(copy.c_str())) return static_cast<int>(Fail(error));
+    return 0;
+}
+
+int APS5_VABI fstatfs_nid_postfix(int d, KernelStatfs* buf) {
     return _fstatfs_nid_postfix(d, buf);
 }
 
 int GetModuleInfoExByHandle_nid_no_patch(KernelModule handle, ModuleInfoEx* info);
-int APS5_VABI sceKernelGetModuleList(KernelModule* handles, std::size_t count, std::size_t* actual);
 
 int APS5_VABI sceKernelGetModuleInfoInternal(KernelModule handle, ModuleInfoEx* info) {
     return GetModuleInfoExByHandle_nid_no_patch(handle, info);
@@ -298,7 +383,9 @@ int APS5_VABI sceKernelGetModuleListInternal(KernelModule* handles, std::size_t
     return sceKernelGetModuleList(handles, count, actual);
 }
 
-std::int64_t APS5_VABI _fstat_nid_postfix(int d, FileStat* sb);
+KernelModule APS5_VABI sceKernelLoadStartModuleForSysmodule(const char* moduleFileName, std::size_t args, const void* argp, std::uint32_t flags, const KernelLoadModuleOpt* opt, int* res) {
+    return sceKernelLoadStartModule(moduleFileName, args, argp, flags, opt, res);
+}
 
 int APS5_VABI fstat_nid_postfix(int d, FileStat* sb) {
     return static_cast<int>(_fstat_nid_postfix(d, sb));
@@ -306,8 +393,8 @@ int APS5_VABI fstat_nid_postfix(int d, FileStat* sb) {
 
 std::int64_t APS5_VABI readlink_nid_postfix(const char* path, char* buffer, std::size_t size) {
     if (size > static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max())) return Fail(GuestEinval);
-    if (path == nullptr) return Fail(GuestEfault);
-    if (*path == '\0') return Fail(GuestEnoent);
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return Fail(error);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return Fail(error);
     return ReadNativeLink(native, buffer, size);
@@ -315,8 +402,8 @@ std::int64_t APS5_VABI readlink_nid_postfix(const char* path, char* buffer, std:
 
 std::int64_t APS5_VABI readlinkat_nid_postfix(int fd, const char* path, char* buffer, std::size_t size) {
     if (size > static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max())) return Fail(GuestEinval);
-    if (path == nullptr) return Fail(GuestEfault);
-    if (*path == '\0') return Fail(GuestEnoent);
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return Fail(error);
     if (fd == GuestAtFdcwd || *path == '/') return readlink_nid_postfix(path, buffer, size);
     int error = 0;
     const char* base = GetDirectoryDescriptorPath_nid_no_patch(fd, &error);
@@ -326,8 +413,8 @@ std::int64_t APS5_VABI readlinkat_nid_postfix(int fd, const char* path, char* bu
 }
 
 std::int64_t APS5_VABI pathconf_nid_postfix(const char* path, int name) {
-    if (path == nullptr) return Fail(GuestEfault);
-    if (*path == '\0') return Fail(GuestEnoent);
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return Fail(error);
     if (std::strlen(path) >= GuestPathMax || HasLongComponent(path)) return Fail(GuestEnametoolong);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return Fail(error);
@@ -335,34 +422,26 @@ std::int64_t APS5_VABI pathconf_nid_postfix(const char* path, int name) {
     const auto status = std::filesystem::status(native, error);
     if (error) return Fail(error == std::errc::no_such_file_or_directory && HasNonDirectoryPrefix(native) ? GuestEnotdir : GuestError(error));
     if (!std::filesystem::exists(status)) return Fail(HasNonDirectoryPrefix(native) ? GuestEnotdir : GuestEnoent);
-    switch (name) {
-    case PcLinkMax: return 32767;
-    case PcNameMax: return static_cast<std::int64_t>(GuestNameMax);
-    case PcPathMax: return static_cast<std::int64_t>(GuestPathMax);
-    case PcPipeBuf: return 512;
-    case PcChownRestricted: return 1;
-    case PcNoTrunc: return 1;
-    case PcFileSizeBits: return 64;
-    case PcRecMaxXferSize: return -1;
-    case PcSymlinkMax: return static_cast<std::int64_t>(GuestPathMax);
-    case PcPrioIo: return 0;
-    case PcSyncIo: return 0;
-    case PcMaxCanon:
-    case PcMaxInput:
-    case PcVdisable:
-    case PcAllocSizeMin:
-    case PcRecIncrXferSize:
-    case PcRecMinXferSize:
-    case PcRecXferAlign:
-    case PcMinHoleSize:
-    case PcAsyncIo:
-    case PcAclExtended:
-    case PcAclPathMax:
-    case PcMacPresent:
-    case PcAclNfs4:
-        throw std::runtime_error("pathconf: name " + std::to_string(name) + " depends on the console filesystem or kernel configuration");
-    default: return Fail(GuestEinval);
-    }
+    return PathConfigurationValue(name, "pathconf");
+}
+
+std::int64_t APS5_VABI _fpathconf_nid_postfix(int fd, int name) {
+    if (fd < 0) return Fail(GuestEbadf);
+    bool withoutVnode = false;
+#ifdef _WIN32
+    if (GuestFstat(fd, &withoutVnode) != 0) return Fail(GuestEbadf);
+#else
+    struct stat status{};
+    if (::fstat(fd, &status) != 0) return Fail(GuestEbadf);
+    withoutVnode = S_ISFIFO(status.st_mode) || S_ISSOCK(status.st_mode);
+#endif
+    if (name == PcAsyncIo) return PosixAsynchronousIo;
+    if (withoutVnode) return name == PcPipeBuf ? 512 : Fail(GuestEinval);
+    return PathConfigurationValue(name, "fpathconf");
+}
+
+std::int64_t APS5_VABI fpathconf_nid_postfix(int fd, int name) {
+    return _fpathconf_nid_postfix(fd, name);
 }
 
 #ifdef _WIN32
@@ -394,16 +473,21 @@ static int FollowLinkPath(const std::filesystem::path& source, std::filesystem::
 }
 #endif
 
-int APS5_VABI link_nid_postfix(const char* existing, const char* created) {
-    if (existing == nullptr || created == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*existing == '\0' || *created == '\0') return static_cast<int>(Fail(GuestEnoent));
-    std::filesystem::path source, destination;
-    if (const int error = ResolvePathError_nid_no_patch(existing, source)) return static_cast<int>(Fail(error));
-    if (const int error = ResolvePathError_nid_no_patch(created, destination)) return static_cast<int>(Fail(error));
+static int LinkSourceError(const std::filesystem::path& source) {
     std::error_code error;
     const auto status = std::filesystem::status(source, error);
-    if (!std::filesystem::exists(status)) return static_cast<int>(Fail(HasNonDirectoryPrefix(source) ? GuestEnotdir : GuestEnoent));
-    if (std::filesystem::is_directory(status)) return static_cast<int>(Fail(GuestEperm));
+    if (!std::filesystem::exists(status)) {
+#ifdef _WIN32
+        std::filesystem::path target;
+        if (const int followError = FollowLinkPath(source, target)) return followError;
+#endif
+        return HasNonDirectoryPrefix(source) ? GuestEnotdir : GuestEnoent;
+    }
+    return std::filesystem::is_directory(status) ? GuestEperm : 0;
+}
+
+static int LinkNative(const std::filesystem::path& source, const std::filesystem::path& destination) {
+    std::error_code error;
     if (std::filesystem::exists(std::filesystem::symlink_status(destination, error))) return static_cast<int>(Fail(GuestEexist));
     if (!std::filesystem::is_directory(destination.parent_path(), error)) return static_cast<int>(Fail(HasNonDirectoryPrefix(destination) ? GuestEnotdir : GuestEnoent));
 #ifdef _WIN32
@@ -420,6 +504,40 @@ int APS5_VABI link_nid_postfix(const char* existing, const char* created) {
     return 0;
 }
 
+int APS5_VABI link_nid_postfix(const char* existing, const char* created) {
+    std::string existingCopy, createdCopy;
+    if (const int error = CopyPath(existing, existingCopy)) return static_cast<int>(Fail(error));
+    std::filesystem::path source, destination;
+    if (const int error = ResolvePathError_nid_no_patch(existing, source)) return static_cast<int>(Fail(error));
+    if (const int error = LinkSourceError(source)) return static_cast<int>(Fail(error));
+    if (const int error = CopyPath(created, createdCopy)) return static_cast<int>(Fail(error));
+    if (const int error = ResolvePathError_nid_no_patch(created, destination)) return static_cast<int>(Fail(error));
+    return LinkNative(source, destination);
+}
+
+static int ResolveAtPath(int fd, const char* path, std::filesystem::path& native) {
+    if (fd == GuestAtFdcwd || *path == '/') return ResolvePathError_nid_no_patch(path, native);
+    if (std::strlen(path) >= GuestPathMax || HasLongComponent(path)) return GuestEnametoolong;
+    int error = 0;
+    const char* base = GetDirectoryDescriptorPath_nid_no_patch(fd, &error);
+    if (base == nullptr) return error;
+    native = std::filesystem::path(reinterpret_cast<const char8_t*>(base)) / std::filesystem::path(reinterpret_cast<const char8_t*>(path));
+    return 0;
+}
+
+int APS5_VABI linkat_nid_postfix(int fd1, const char* path1, int fd2, const char* path2, int flag) {
+    if (flag & ~GuestAtSymlinkFollow) return static_cast<int>(Fail(GuestEinval));
+    std::string copy1, copy2;
+    if (const int error = CopyPath(path1, copy1)) return static_cast<int>(Fail(error));
+    std::filesystem::path source, destination;
+    if (const int error = ResolveAtPath(fd1, path1, source)) return static_cast<int>(Fail(error));
+    if (flag == 0 && IsSymbolicLink(source)) NotImplemented_nid_no_patch("linkat: a hard link to a symbolic link itself");
+    if (const int error = LinkSourceError(source)) return static_cast<int>(Fail(error));
+    if (const int error = CopyPath(path2, copy2)) return static_cast<int>(Fail(error));
+    if (const int error = ResolveAtPath(fd2, path2, destination)) return static_cast<int>(Fail(error));
+    return LinkNative(source, destination);
+}
+
 int APS5_VABI fchdir_nid_postfix(int fd) {
     int error = 0;
     const char* path = GetDirectoryDescriptorPath_nid_no_patch(fd, &error);
@@ -433,9 +551,15 @@ int APS5_VABI fchdir_nid_postfix(int fd) {
     return 0;
 }
 
+int SetTimeOfDay_nid_no_patch(const KernelTimeval* tv, const KernelTimezone* tz);
+
+int APS5_VABI settimeofday_nid_postfix(const KernelTimeval* tv, const KernelTimezone* tz) {
+    return SetTimeOfDay_nid_no_patch(tv, tz);
+}
+
 int APS5_VABI chroot_nid_postfix(const char* path) {
-    if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*path == '\0') return static_cast<int>(Fail(GuestEnoent));
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return static_cast<int>(Fail(error));
     if (std::strlen(path) >= GuestPathMax || HasLongComponent(path)) return static_cast<int>(Fail(GuestEnametoolong));
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return static_cast<int>(Fail(error));
@@ -451,9 +575,9 @@ int APS5_VABI chroot_nid_postfix(const char* path) {
 }
 
 int APS5_VABI symlink_nid_postfix(const char* target, const char* created) {
-    if (target == nullptr || created == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (std::strlen(target) >= GuestPathMax) return static_cast<int>(Fail(GuestEnametoolong));
-    if (*target == '\0' || *created == '\0') return static_cast<int>(Fail(GuestEnoent));
+    std::string targetCopy, createdCopy;
+    if (const int error = CopyPath(target, targetCopy)) return static_cast<int>(Fail(error));
+    if (const int error = CopyPath(created, createdCopy)) return static_cast<int>(Fail(error));
     const std::filesystem::path contents(target);
     if (contents.has_root_name() || contents.has_root_directory()) {
         NotImplemented_nid_no_patch("symlink: absolute targets");
@@ -496,8 +620,6 @@ int APS5_VABI symlink_nid_postfix(const char* target, const char* created) {
     return 0;
 }
 
-int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
-
 int APS5_VABI openat_nid_postfix(int fd, const char* path, int flags, ...) {
     int mode = 0;
     if (flags & SCE_KERNEL_O_CREAT) {
@@ -514,19 +636,36 @@ int APS5_VABI openat_nid_postfix(int fd, const char* path, int flags, ...) {
 #endif
     }
     if (File::InvalidOpenFlags(flags)) return static_cast<int>(Fail(GuestEinval));
-    if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*path == '\0') return static_cast<int>(Fail(GuestEnoent));
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return static_cast<int>(Fail(error));
     if (fd == GuestAtFdcwd || *path == '/') return open_nid_postfix(path, flags, mode);
     const int result = OpenInDirectory_nid_no_patch(fd, path, flags, static_cast<std::uint16_t>(mode));
     if (result < 0) return static_cast<int>(Fail(result & 0xffff));
     return result;
 }
 
-int APS5_VABI mkdir_nid_postfix(const char* path, std::uint16_t mode);
+int APS5_VABI _openat_nid_postfix(int fd, const char* path, int flags, ...) {
+    int mode = 0;
+    if (flags & SCE_KERNEL_O_CREAT) {
+#ifdef _WIN32
+        __builtin_sysv_va_list arguments;
+        __builtin_sysv_va_start(arguments, flags);
+        mode = __builtin_va_arg(arguments, int);
+        __builtin_sysv_va_end(arguments);
+#else
+        std::va_list arguments;
+        va_start(arguments, flags);
+        mode = va_arg(arguments, int);
+        va_end(arguments);
+#endif
+    }
+    return openat_nid_postfix(fd, path, flags, mode);
+}
+
 
 int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode) {
-    if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*path == '\0') return static_cast<int>(Fail(GuestEnoent));
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return static_cast<int>(Fail(error));
     if (fd == GuestAtFdcwd || *path == '/') return mkdir_nid_postfix(path, mode);
     if (std::strlen(path) >= GuestPathMax || HasLongComponent(path)) return static_cast<int>(Fail(GuestEnametoolong));
     int error = 0;
@@ -541,6 +680,7 @@ int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode)
         if (code == ERROR_ALREADY_EXISTS || code == ERROR_FILE_EXISTS) return static_cast<int>(Fail(GuestEexist));
         if (code == ERROR_ACCESS_DENIED) return static_cast<int>(Fail(GuestEperm));
         if (code == ERROR_FILENAME_EXCED_RANGE) return static_cast<int>(Fail(GuestEnametoolong));
+        if (code == ERROR_CANT_RESOLVE_FILENAME) return static_cast<int>(Fail(GuestEloop));
         if (code == ERROR_PATH_NOT_FOUND) {
             if (HasNonDirectoryPrefix(native)) return static_cast<int>(Fail(GuestEnotdir));
             return static_cast<int>(Fail(GuestEnoent));
@@ -561,8 +701,8 @@ int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode)
 
 int APS5_VABI fchmodat_nid_postfix(int fd, const char* path, int mode, int flag) {
     if (flag != 0 && flag != GuestAtSymlinkNofollow) return static_cast<int>(Fail(GuestEinval));
-    if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*path == '\0') return static_cast<int>(Fail(GuestEnoent));
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return static_cast<int>(Fail(error));
     std::filesystem::path native;
     if (fd == GuestAtFdcwd || *path == '/') {
         if (const int error = ResolvePathError_nid_no_patch(path, native)) return static_cast<int>(Fail(error));
@@ -600,9 +740,13 @@ int APS5_VABI fchmodat_nid_postfix(int fd, const char* path, int mode, int flag)
 }
 
 int APS5_VABI lchmod_nid_postfix(const char* path, std::uint16_t mode) {
+    std::string copy;
+    if (path != nullptr) {
+        if (const int error = CopyPath(path, copy)) return static_cast<int>(Fail(error));
+    }
 #ifndef __APPLE__
     std::filesystem::path native;
-    if (path != nullptr && *path != '\0' && ResolvePathError_nid_no_patch(path, native) == 0) {
+    if (path != nullptr && ResolvePathError_nid_no_patch(path, native) == 0) {
 #ifdef _WIN32
         const DWORD attributes = GetFileAttributesW(native.wstring().c_str());
         const bool symbolic = attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0;
@@ -617,15 +761,13 @@ int APS5_VABI lchmod_nid_postfix(const char* path, std::uint16_t mode) {
 }
 
 int APS5_VABI fchown_nid_postfix(int fd, std::uint32_t uid, std::uint32_t gid) {
-    constexpr std::uint32_t Unchanged = 0xFFFFFFFFu;
-    if (uid != 0 && uid != Unchanged) NotImplemented_nid_no_patch("fchown: an owner other than the guest user");
-    if (gid != 0 && gid != Unchanged) NotImplemented_nid_no_patch("fchown: a group other than the guest group");
 #ifdef _WIN32
     if (GuestFstat(fd) != 0) return static_cast<int>(Fail(GuestEbadf));
 #else
     struct stat status{};
     if (::fstat(fd, &status) != 0) return static_cast<int>(Fail(GuestEbadf));
 #endif
+    RequireGuestOwner("fchown", uid, gid);
     return 0;
 }
 
@@ -639,26 +781,42 @@ int APS5_VABI sched_rr_get_interval_nid_postfix(int pid, KernelTimespec* interva
     return 0;
 }
 
-int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
-int APS5_VABI lstat_nid_postfix(const char* path, FileStat* sb);
+int APS5_VABI chown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid) {
+    FileStat status{};
+    if (stat_nid_postfix(path, &status) != 0) return -1;
+    RequireGuestOwner("chown", uid, gid);
+    return 0;
+}
+
+int APS5_VABI lchown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid) {
+    FileStat status{};
+    if (lstat_nid_postfix(path, &status) != 0) return -1;
+    RequireGuestOwner("lchown", uid, gid);
+    return 0;
+}
+
+int APS5_VABI fchownat_nid_postfix(int fd, const char* path, std::uint32_t uid, std::uint32_t gid, int flag) {
+    if (flag & ~GuestAtSymlinkNofollow) return static_cast<int>(Fail(GuestEinval));
+    FileStat status{};
+    if (fstatat_nid_postfix(fd, path, &status, flag) != 0) return -1;
+    RequireGuestOwner("fchownat", uid, gid);
+    return 0;
+}
 
 int APS5_VABI fstatat_nid_postfix(int fd, const char* path, FileStat* sb, int flag) {
     if (flag & ~GuestAtSymlinkNofollow) return static_cast<int>(Fail(GuestEinval));
-    if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*path == '\0') return static_cast<int>(Fail(GuestEnoent));
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return static_cast<int>(Fail(error));
     if (fd == GuestAtFdcwd || *path == '/') return flag ? lstat_nid_postfix(path, sb) : stat_nid_postfix(path, sb);
     const int result = StatInDirectory_nid_no_patch(fd, path, sb, flag == 0);
     if (result < 0) return static_cast<int>(Fail(result & 0xffff));
     return 0;
 }
 
-int APS5_VABI unlink_nid_postfix(const char* path);
-int APS5_VABI rmdir_nid_postfix(const char* path);
-
 int APS5_VABI unlinkat_nid_postfix(int fd, const char* path, int flag) {
     if (flag & ~GuestAtRemovedir) return static_cast<int>(Fail(GuestEinval));
-    if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*path == '\0') return static_cast<int>(Fail(GuestEnoent));
+    std::string copy;
+    if (const int error = CopyPath(path, copy)) return static_cast<int>(Fail(error));
     if (fd == GuestAtFdcwd || *path == '/') return (flag & GuestAtRemovedir) ? rmdir_nid_postfix(path) : unlink_nid_postfix(path);
     if (std::strlen(path) >= GuestPathMax || HasLongComponent(path)) return static_cast<int>(Fail(GuestEnametoolong));
     int error = 0;
@@ -734,14 +892,13 @@ int APS5_VABI scePthreadCondattrGetclock(const PthreadCondattr* attr, KernelCloc
 }
 
 int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const char* to) {
-    if (from == nullptr || to == nullptr) return static_cast<int>(Fail(GuestEfault));
-    if (*from == '\0' || *to == '\0') return static_cast<int>(Fail(GuestEnoent));
-    if ((oldfd == GuestAtFdcwd || *from == '/') && (newfd == GuestAtFdcwd || *to == '/'))
+    std::string fromCopy, toCopy;
+    if (const int error = CopyPath(from, fromCopy)) return static_cast<int>(Fail(error));
+    if ((oldfd == GuestAtFdcwd || *from == '/') && newfd == GuestAtFdcwd)
         return RenameGuestPath_nid_no_patch(from, to);
-    if (std::strlen(from) >= GuestPathMax || HasLongComponent(from) ||
-        std::strlen(to) >= GuestPathMax || HasLongComponent(to))
+    if (std::strlen(from) >= GuestPathMax || HasLongComponent(from))
         return static_cast<int>(Fail(GuestEnametoolong));
-    if (IsDotOrDotDot(from) || IsDotOrDotDot(to)) return static_cast<int>(Fail(GuestEinval));
+    if (IsDotOrDotDot(from)) return static_cast<int>(Fail(GuestEinval));
 
     std::filesystem::path source;
     if (oldfd == GuestAtFdcwd || *from == '/') {
@@ -753,6 +910,20 @@ int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const
         source = std::filesystem::path(reinterpret_cast<const char8_t*>(base)) /
                  std::filesystem::path(reinterpret_cast<const char8_t*>(from));
     }
+    const std::string_view fromView(from);
+    const bool oldTrailingSlash = !fromView.empty() && fromView.back() == '/';
+    while (!source.has_filename() && source.has_relative_path()) source = source.parent_path();
+    std::error_code statusError;
+    const auto sourceStatus = std::filesystem::symlink_status(source, statusError);
+    if (statusError && statusError != std::errc::no_such_file_or_directory)
+        return static_cast<int>(Fail(FilesystemError(statusError)));
+    if (sourceStatus.type() == std::filesystem::file_type::not_found)
+        return static_cast<int>(Fail(HasNonDirectoryPrefix(source) ? GuestEnotdir : GuestEnoent));
+    if (oldTrailingSlash && !std::filesystem::is_directory(sourceStatus)) return static_cast<int>(Fail(GuestEnotdir));
+
+    if (const int error = CopyPath(to, toCopy)) return static_cast<int>(Fail(error));
+    if (std::strlen(to) >= GuestPathMax || HasLongComponent(to)) return static_cast<int>(Fail(GuestEnametoolong));
+    if (IsDotOrDotDot(to)) return static_cast<int>(Fail(GuestEinval));
 
     std::filesystem::path destination;
     if (newfd == GuestAtFdcwd || *to == '/') {
@@ -765,21 +936,11 @@ int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const
                       std::filesystem::path(reinterpret_cast<const char8_t*>(to));
     }
 
-    const std::string_view fromView(from);
     const std::string_view toView(to);
-    const bool oldTrailingSlash = !fromView.empty() && fromView.back() == '/';
     const bool newTrailingSlash = !toView.empty() && toView.back() == '/';
 
-    while (!source.has_filename() && source.has_relative_path()) source = source.parent_path();
     while (!destination.has_filename() && destination.has_relative_path()) destination = destination.parent_path();
 
-    std::error_code statusError;
-    const auto sourceStatus = std::filesystem::symlink_status(source, statusError);
-    if (oldTrailingSlash) {
-        if (sourceStatus.type() == std::filesystem::file_type::not_found)
-            return static_cast<int>(Fail(HasNonDirectoryPrefix(source) ? GuestEnotdir : GuestEnoent));
-        if (!std::filesystem::is_directory(sourceStatus)) return static_cast<int>(Fail(GuestEnotdir));
-    }
     if (newTrailingSlash && sourceStatus.type() != std::filesystem::file_type::not_found &&
         !std::filesystem::is_directory(sourceStatus))
         return static_cast<int>(Fail(GuestEnotdir));
@@ -791,9 +952,7 @@ int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const
     return 0;
 }
 
-
 bool SetDefaultStackSize_nid_no_patch(std::size_t size);
-void APS5_VABI pthread_set_name_np_nid_postfix(void* thread, const char* name);
 
 int APS5_VABI pthread_set_defaultstacksize_np_nid_postfix(std::size_t size) {
     return SetDefaultStackSize_nid_no_patch(size) ? 0 : GuestEinval;
@@ -803,15 +962,10 @@ int APS5_VABI scePthreadSetDefaultstacksize(std::size_t size) {
     return SetDefaultStackSize_nid_no_patch(size) ? 0 : SceKernelError(GuestEinval);
 }
 
-void APS5_VABI scePthreadSetName(void* thread, const char* name) {
+void APS5_VABI scePthreadSetName(Pthread thread, const char* name) {
     pthread_set_name_np_nid_postfix(thread, name);
-}
 
-struct KernelTitleWorkaround {
-    std::int32_t version;
-    std::int32_t align;
-    std::uint64_t ids[2];
-};
+}
 
 int APS5_VABI sceKernelTitleWorkaroundIsEnabled(const KernelTitleWorkaround* workaround, std::int32_t bit, std::int32_t* enabled) {
     if (!workaround || !enabled) return static_cast<int>(0x8002000E);
diff --git a/core/libs/prx/libkernel_sys/ThreadQueries.cpp b/core/libs/prx/libkernel_sys/ThreadQueries.cpp
new file mode 100644
index 0000000000..397716777c
--- /dev/null
+++ b/core/libs/prx/libkernel_sys/ThreadQueries.cpp
@@ -0,0 +1,14 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+extern "C" {
+bool IsInitialPthread_nid_no_patch();
+
+int APS5_VABI pthread_main_np_nid_postfix() {
+    return IsInitialPthread_nid_no_patch() ? 1 : 0;
+}
+
+int APS5_VABI scePthreadMain(void) {
+    return pthread_main_np_nid_postfix();
+}
+
+}
diff --git a/core/libs/prx/libkernel_sys/include/Api.hpp b/core/libs/prx/libkernel_sys/include/Api.hpp
new file mode 100644
index 0000000000..ae38852b68
--- /dev/null
+++ b/core/libs/prx/libkernel_sys/include/Api.hpp
@@ -0,0 +1,564 @@
+#pragma once
+
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+
+struct GuestAiocb {
+    int fildes;
+    std::int64_t offset;
+    void* buf;
+    std::uint64_t nbytes;
+    int spare[2];
+    void* spare2;
+    int lioOpcode;
+    int reqprio;
+    std::int64_t status;
+    std::int64_t error;
+    void* kernelinfo;
+    GuestSigevent sigevent;
+};
+
+struct KernelTitleWorkaround {
+    std::int32_t version;
+    std::int32_t align;
+    std::uint64_t ids[2];
+};
+
+struct KernelAuthInfo {
+    std::uint64_t programAuthorityId;
+    std::uint64_t capabilities[4];
+    std::uint64_t attributes[4];
+    std::uint64_t credentials[8];
+};
+static_assert(sizeof(KernelAuthInfo) == 0x88);
+
+extern "C" {
+
+int APS5_VABI aio_read_nid_postfix(GuestAiocb* aiocb);
+int APS5_VABI aio_write_nid_postfix(GuestAiocb* aiocb);
+int APS5_VABI aio_fsync_nid_postfix(int operation, GuestAiocb* aiocb);
+int APS5_VABI aio_error_nid_postfix(const GuestAiocb* aiocb);
+std::int64_t APS5_VABI aio_return_nid_postfix(GuestAiocb* aiocb);
+int APS5_VABI aio_suspend_nid_postfix(const GuestAiocb* const* list, int count, const KernelTimespec* timeout);
+std::int64_t APS5_VABI aio_waitcomplete_nid_postfix(GuestAiocb** result, const KernelTimespec* timeout);
+int APS5_VABI aio_cancel_nid_postfix(int descriptor, GuestAiocb* aiocb);
+int APS5_VABI sceKernelGetCompiledSdkVersion(std::int32_t* version);
+int APS5_VABI fork_nid_postfix(void);
+int APS5_VABI setsid_nid_postfix(void);
+std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask);
+int APS5_VABI fstatfs_nid_postfix(int d, KernelStatfs* buf);
+int APS5_VABI sceKernelGetModuleInfoInternal(KernelModule handle, ModuleInfoEx* info);
+int APS5_VABI sceKernelGetModuleListInternal(KernelModule* handles, std::size_t count, std::size_t* actual);
+KernelModule APS5_VABI sceKernelLoadStartModuleForSysmodule(const char* moduleFileName, std::size_t args, const void* argp, std::uint32_t flags, const KernelLoadModuleOpt* opt, int* res);
+int APS5_VABI fstat_nid_postfix(int d, FileStat* sb);
+std::int64_t APS5_VABI readlink_nid_postfix(const char* path, char* buffer, std::size_t size);
+std::int64_t APS5_VABI readlinkat_nid_postfix(int fd, const char* path, char* buffer, std::size_t size);
+std::int64_t APS5_VABI pathconf_nid_postfix(const char* path, int name);
+std::int64_t APS5_VABI _fpathconf_nid_postfix(int fd, int name);
+std::int64_t APS5_VABI fpathconf_nid_postfix(int fd, int name);
+int APS5_VABI link_nid_postfix(const char* existing, const char* created);
+int APS5_VABI linkat_nid_postfix(int fd1, const char* path1, int fd2, const char* path2, int flag);
+int APS5_VABI fchdir_nid_postfix(int fd);
+int APS5_VABI chroot_nid_postfix(const char* path);
+int APS5_VABI symlink_nid_postfix(const char* target, const char* created);
+int APS5_VABI openat_nid_postfix(int fd, const char* path, int flags, ...);
+int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode);
+int APS5_VABI fchmodat_nid_postfix(int fd, const char* path, int mode, int flag);
+int APS5_VABI lchmod_nid_postfix(const char* path, std::uint16_t mode);
+int APS5_VABI fchown_nid_postfix(int fd, std::uint32_t uid, std::uint32_t gid);
+int APS5_VABI sched_rr_get_interval_nid_postfix(int pid, KernelTimespec* interval);
+int APS5_VABI chown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid);
+int APS5_VABI lchown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid);
+int APS5_VABI fchownat_nid_postfix(int fd, const char* path, std::uint32_t uid, std::uint32_t gid, int flag);
+int APS5_VABI fstatat_nid_postfix(int fd, const char* path, FileStat* sb, int flag);
+int APS5_VABI settimeofday_nid_postfix(const KernelTimeval* tv, const KernelTimezone* tz);
+int APS5_VABI unlinkat_nid_postfix(int fd, const char* path, int flag);
+int APS5_VABI scePthreadCondattrGetclock(const PthreadCondattr* attr, KernelClockid* clockId);
+int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const char* to);
+int APS5_VABI pthread_set_defaultstacksize_np_nid_postfix(std::size_t size);
+int APS5_VABI scePthreadSetDefaultstacksize(std::size_t size);
+void APS5_VABI scePthreadSetName(Pthread thread, const char* name);
+int APS5_VABI sceKernelTitleWorkaroundIsEnabled(const KernelTitleWorkaround* workaround, std::int32_t bit, std::int32_t* enabled);
+int APS5_VABI sceKernelGetProcessType(int pid);
+int APS5_VABI amd64_set_fsbase_nid_postfix(void);
+int APS5_VABI blockpool_batch_nid_postfix(void);
+int APS5_VABI blockpool_map_nid_postfix(void);
+int APS5_VABI blockpool_open_nid_postfix(void);
+int APS5_VABI blockpool_unmap_nid_postfix(void);
+int APS5_VABI cpuset_nid_postfix(void);
+int APS5_VABI cpuset_getid_nid_postfix(void);
+int APS5_VABI cpuset_setid_nid_postfix(void);
+int APS5_VABI dynlib_get_obj_member_nid_postfix(void);
+int APS5_VABI futimesat_nid_postfix(void);
+int APS5_VABI get_authinfo_nid_postfix(int pid, KernelAuthInfo* info);
+int APS5_VABI get_module_info_list_nid_postfix(void);
+int APS5_VABI get_page_table_stats_nid_postfix(void);
+int APS5_VABI get_sdk_compiled_version_nid_postfix(void);
+int APS5_VABI get_self_auth_info_nid_postfix(void);
+int APS5_VABI get_vm_map_timestamp_nid_postfix(void);
+int APS5_VABI getfsstat_nid_postfix(void);
+int APS5_VABI ipmimgr_call_nid_postfix(void);
+int APS5_VABI is_in_sandbox_nid_postfix(void);
+int APS5_VABI kenv_nid_postfix(void);
+int APS5_VABI kldfind_nid_postfix(void);
+int APS5_VABI kldfirstmod_nid_postfix(void);
+int APS5_VABI kldload_nid_postfix(void);
+int APS5_VABI kldnext_nid_postfix(void);
+int APS5_VABI kldstat_nid_postfix(void);
+int APS5_VABI kldsym_nid_postfix(void);
+int APS5_VABI kldunload_nid_postfix(void);
+int APS5_VABI kmq_notify_nid_postfix(void);
+int APS5_VABI kmq_open_nid_postfix(void);
+int APS5_VABI kmq_setattr_nid_postfix(void);
+int APS5_VABI kmq_timedreceive_nid_postfix(void);
+int APS5_VABI kmq_timedsend_nid_postfix(void);
+int APS5_VABI kmq_unlink_nid_postfix(void);
+int APS5_VABI ksem_close_nid_postfix(void);
+int APS5_VABI ksem_destroy_nid_postfix(void);
+int APS5_VABI ksem_getvalue_nid_postfix(void);
+int APS5_VABI ksem_init_nid_postfix(void);
+int APS5_VABI ksem_open_nid_postfix(void);
+int APS5_VABI ksem_post_nid_postfix(void);
+int APS5_VABI ksem_timedwait_nid_postfix(void);
+int APS5_VABI ksem_trywait_nid_postfix(void);
+int APS5_VABI ksem_unlink_nid_postfix(void);
+int APS5_VABI ksem_wait_nid_postfix(void);
+int APS5_VABI ktrace_nid_postfix(void);
+int APS5_VABI lchflags_nid_postfix(void);
+int APS5_VABI mdbg_call_nid_postfix(void);
+int APS5_VABI mdbg_service_nid_postfix(void);
+int APS5_VABI mount_nid_postfix(void);
+int APS5_VABI openintr_nid_postfix(void);
+int APS5_VABI profil_nid_postfix(void);
+int APS5_VABI pthread_attr_getaffinity_np_nid_postfix(void);
+int APS5_VABI pthread_attr_getsolosched_np_nid_postfix(void);
+int APS5_VABI pthread_attr_setaffinity_np_nid_postfix(void);
+int APS5_VABI pthread_attr_setcreatesuspend_np_nid_postfix(PthreadAttr* attr);
+int APS5_VABI pthread_attr_setstackaddr_nid_postfix(void);
+int APS5_VABI pthread_barrier_setname_np_nid_postfix(void);
+int APS5_VABI pthread_get_specificarray_np_nid_postfix(void);
+int APS5_VABI pthread_get_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_getstack_np_nid_postfix(void);
+int APS5_VABI pthread_main_np_nid_postfix(void);
+int APS5_VABI pthread_multi_np_nid_postfix(void);
+int APS5_VABI pthread_mutex_getprioceiling_nid_postfix(void);
+int APS5_VABI pthread_mutex_init_for_mono_nid_postfix(void);
+int APS5_VABI pthread_mutex_setname_np_nid_postfix(void);
+int APS5_VABI pthread_mutex_setprioceiling_nid_postfix(void);
+int APS5_VABI pthread_mutexattr_getgen_np_nid_postfix(void);
+int APS5_VABI pthread_mutexattr_setgen_np_nid_postfix(void);
+void APS5_VABI pthread_resume_all_np_nid_postfix(void);
+int APS5_VABI pthread_resume_np_nid_postfix(Pthread thread);
+int APS5_VABI pthread_resume_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_rwlock_setname_np_nid_postfix(void);
+int APS5_VABI pthread_set_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_single_np_nid_postfix(void);
+int APS5_VABI pthread_suspend_all_np_nid_postfix(void);
+int APS5_VABI pthread_suspend_np_nid_postfix(void);
+int APS5_VABI pthread_suspend_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_switch_add_np_nid_postfix(void);
+int APS5_VABI pthread_switch_delete_np_nid_postfix(void);
+int APS5_VABI ptrace_nid_postfix(void);
+int APS5_VABI pwrite_nid_postfix(void);
+int APS5_VABI reboot_nid_postfix(void);
+int APS5_VABI revoke_nid_postfix(void);
+int APS5_VABI rfork_thread_nid_postfix(void);
+int APS5_VABI rtld_printf_nid_postfix(void);
+int APS5_VABI sceCoredumpDebugForceCoredumpOnAppClose(void);
+int APS5_VABI sceCoredumpDebugTriggerCoredump(void);
+int APS5_VABI sceCoredumpGetStopInfoGpu(void);
+int APS5_VABI sceCoredumpInternalGetThreadContextInfo(void);
+int APS5_VABI sceKernelAddACInfo(void);
+int APS5_VABI sceKernelAddCpumodeEvent(void);
+int APS5_VABI sceKernelAddGpuExceptionEvent(void);
+int APS5_VABI sceKernelAddProcessToCanvasMap(void);
+int APS5_VABI sceKernelAddResource(void);
+int APS5_VABI sceKernelAllocateDirectMemory2(void);
+int APS5_VABI sceKernelAllocateDirectMemoryForApp(void);
+int APS5_VABI sceKernelAllocateDirectMemoryForMiniApp(void);
+int APS5_VABI sceKernelAllocateToolMemory(void);
+int APS5_VABI sceKernelAllocateTraceDirectMemory(void);
+int APS5_VABI sceKernelAprCtrl(void);
+int APS5_VABI sceKernelAprSubmitCommandBufferAndGetResult_TEST(void);
+int APS5_VABI sceKernelAprSubmitCommandBuffer_TEST(void);
+int APS5_VABI sceKernelAvailableToolMemorySize(void);
+int APS5_VABI sceKernelBacktraceSelf(void);
+int APS5_VABI sceKernelBeginAppMount(void);
+int APS5_VABI sceKernelBeginAppMount2(void);
+int APS5_VABI sceKernelCallIndirectBuffer(void);
+int APS5_VABI sceKernelCallIndirectBuffer2(void);
+int APS5_VABI sceKernelClearBootReqNotifyCount(void);
+int APS5_VABI sceKernelClearGameDirectMemory(void);
+int APS5_VABI sceKernelCloseEport(void);
+int APS5_VABI sceKernelCloseSema(void);
+int APS5_VABI sceKernelCreateBudget(void);
+int APS5_VABI sceKernelCreateEport(void);
+int APS5_VABI sceKernelDebugAcquireAndUpdateDebugRegister(void);
+int APS5_VABI sceKernelDebugGetAppStatus(void);
+int APS5_VABI sceKernelDebugGetPauseCount(void);
+int APS5_VABI sceKernelDebugGetPrivateLogText(void);
+int APS5_VABI sceKernelDebugGetSchedLockMode(void);
+int APS5_VABI sceKernelDebugGetSdkLogText(void);
+int APS5_VABI sceKernelDebugGpuPaDebugIsInProgress(void);
+int APS5_VABI sceKernelDebugInjectProcessEvent(void);
+int APS5_VABI sceKernelDebugPackageCorrupted(void);
+int APS5_VABI sceKernelDebugRaiseExceptionWithContext(void);
+int APS5_VABI sceKernelDebugRaiseExceptionWithInfo(void);
+int APS5_VABI sceKernelDebugReleaseDebugContext(void);
+int APS5_VABI sceKernelDeleteACInfo(void);
+int APS5_VABI sceKernelDeleteBudget(void);
+int APS5_VABI sceKernelDeleteCpumodeEvent(void);
+int APS5_VABI sceKernelDeleteEport(void);
+int APS5_VABI sceKernelDeleteGpuExceptionEvent(void);
+int APS5_VABI sceKernelDeleteProcessFromCanvasMap(void);
+int APS5_VABI sceKernelDeleteSavedApp(void);
+int APS5_VABI sceKernelDirectMemoryQueryForId(void);
+int APS5_VABI sceKernelEnableDmemAliasing2(void);
+int APS5_VABI sceKernelEnablePthreadObjectCheck(void);
+int APS5_VABI sceKernelEndAppMount(void);
+int APS5_VABI sceKernelEndAppMount2(void);
+int APS5_VABI sceKernelEventLogInit(void);
+int APS5_VABI sceKernelEventLogPread(void);
+int APS5_VABI sceKernelEventLogRead(void);
+int APS5_VABI sceKernelEventLogWrite(void);
+int APS5_VABI sceKernelExpectedHddFormat(void);
+int APS5_VABI sceKernelFlock(void);
+int APS5_VABI sceKernelGetACInfoAllForCoredump(void);
+int APS5_VABI sceKernelGetAppCategoryType(void);
+int APS5_VABI sceKernelGetAppInfoByAppId(void);
+int APS5_VABI sceKernelGetAppState(void);
+int APS5_VABI sceKernelGetAslrStatus(void);
+int APS5_VABI sceKernelGetAutoUpdateVersion(void);
+int APS5_VABI sceKernelGetBackupRestoreMode(void);
+int APS5_VABI sceKernelGetBackupRestoreModeOfNextBoot(void);
+int APS5_VABI sceKernelGetBasicProductShape(void);
+int APS5_VABI sceKernelGetBetaUpdateTestForRcmgr(void);
+int APS5_VABI sceKernelGetBioUsageAll(void);
+int APS5_VABI sceKernelGetBootReqNotifyCount(void);
+int APS5_VABI sceKernelGetBudget(void);
+int APS5_VABI sceKernelGetBuildNumber(void);
+int APS5_VABI sceKernelGetCallRecord(void);
+int APS5_VABI sceKernelGetChildApp(void);
+int APS5_VABI sceKernelGetCompiledSdkVersionByPath(void);
+int APS5_VABI sceKernelGetCompiledSdkVersionByPid(void);
+int APS5_VABI sceKernelGetCoredumpAppInfo(void);
+int APS5_VABI sceKernelGetCpuUsage(void);
+int APS5_VABI sceKernelGetCpuUsageAll(void);
+int APS5_VABI sceKernelGetCpuUsageProc(void);
+int APS5_VABI sceKernelGetCpuUsageProc2(void);
+int APS5_VABI sceKernelGetCpuUsageThread(void);
+int APS5_VABI sceKernelGetCpumodeGame(void);
+int APS5_VABI sceKernelGetCurrentFanDuty(void);
+int APS5_VABI sceKernelGetDataTransferMode(void);
+int APS5_VABI sceKernelGetDebugMenuMiniModeForRcmgr(void);
+int APS5_VABI sceKernelGetDebugMenuModeForPsmForRcmgr(void);
+int APS5_VABI sceKernelGetDebugMenuModeForRcmgr(void);
+int APS5_VABI sceKernelGetDefaultToolMemorySize(void);
+int APS5_VABI sceKernelGetEmergencyErrorLog(void);
+int APS5_VABI sceKernelGetExecutableModuleHandle(void);
+int APS5_VABI sceKernelGetExtLibcHandle(void);
+int APS5_VABI sceKernelGetFakeFinalizeMenuForRcmgr(void);
+int APS5_VABI sceKernelGetFirstImageAddr(void);
+int APS5_VABI sceKernelGetFlagedUpdaterForRcmgr(void);
+int APS5_VABI sceKernelGetForceUpdateModeForRcmgr(void);
+int APS5_VABI sceKernelGetGPO(void);
+int APS5_VABI sceKernelGetHwFeatureInfoForDecid(void);
+int APS5_VABI sceKernelGetHwModelName(void);
+int APS5_VABI sceKernelGetHwSerialNumber(void);
+int APS5_VABI sceKernelGetIdPs(void);
+int APS5_VABI sceKernelGetIdTableCurrentCount(void);
+int APS5_VABI sceKernelGetIoreq(void);
+int APS5_VABI sceKernelGetIpcPath(void);
+int APS5_VABI sceKernelGetKnobs(void);
+int APS5_VABI sceKernelGetKqueueFromEqueue(void);
+int APS5_VABI sceKernelGetMemoryPstate(void);
+int APS5_VABI sceKernelGetOpenPsIdForSystem(void* id);
+int APS5_VABI sceKernelGetPagingStatsOfAllObjects(void);
+int APS5_VABI sceKernelGetPagingStatsOfAllThreads(void);
+int APS5_VABI sceKernelGetParentApp(void);
+int APS5_VABI sceKernelGetPhysPageSize(void);
+int APS5_VABI sceKernelGetProcessName(void);
+int APS5_VABI sceKernelGetProcessTypeOfBudget(void);
+int APS5_VABI sceKernelGetProductCode(void);
+int APS5_VABI sceKernelGetProductStr(void);
+int APS5_VABI sceKernelGetPs4SystemSwVersion(void);
+int APS5_VABI sceKernelGetPsmIntdevModeForRcmgr(void);
+int APS5_VABI sceKernelGetPsnAccessTraceLogForRcmgr(void);
+int APS5_VABI sceKernelGetQafExpirationTimeNotafterForRcmgr(void);
+int APS5_VABI sceKernelGetQafExpirationTimeNotbeforeForRcmgr(void);
+int APS5_VABI sceKernelGetQafGenerationForRcmgr(void);
+int APS5_VABI sceKernelGetQafNameForRcmgr(void);
+int APS5_VABI sceKernelGetRenderingMode(void);
+int APS5_VABI sceKernelGetResidentCount(void);
+int APS5_VABI sceKernelGetResidentFmemCount(void);
+int APS5_VABI sceKernelGetResource(void);
+int APS5_VABI sceKernelGetResourceLimit(void);
+int APS5_VABI sceKernelGetResourceOne(void);
+int APS5_VABI sceKernelGetSafemode(void);
+int APS5_VABI sceKernelGetSanitizerMallocReplace(void);
+int APS5_VABI sceKernelGetSanitizerNewReplace(void);
+int APS5_VABI sceKernelGetSocClock(void);
+int APS5_VABI sceKernelGetSpecialIForRcmgr(void);
+int APS5_VABI sceKernelGetSubsysId(void);
+int APS5_VABI sceKernelGetSubsysSubId(void);
+int APS5_VABI sceKernelGetSystemLevelDebuggerModeForRcmgr(void);
+int APS5_VABI sceKernelGetSystemSwBeta(void);
+int APS5_VABI sceKernelGetThreadName(void);
+int APS5_VABI sceKernelGetUniversalMode(void);
+int APS5_VABI sceKernelGetUpdVersion(void);
+int APS5_VABI sceKernelGetUtokenDataExecutionForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenExpirationTimeNotafterForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenExpirationTimeNotbeforeForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenFakeSharefactoryForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenFlagedUpdaterForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenNpEnvSwitchingForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenSaveDataRepairForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenStoreModeForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenUseSoftwagnerForAcmgr(void);
+int APS5_VABI sceKernelGetUtokenUseSoftwagnerForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenWeakenedPortRestrictionForRcmgr(void);
+int APS5_VABI sceKernelGetVrCaptureSize(void);
+int APS5_VABI sceKernelGiveDirectMemoryToMapper(void);
+int APS5_VABI sceKernelHasNeoMode(void);
+int APS5_VABI sceKernelHwGetBdDriveInfo(void);
+int APS5_VABI sceKernelHwHasOpticalOut(void);
+int APS5_VABI sceKernelHwHasWlanBt(void);
+int APS5_VABI sceKernelIccControlBDPowerState(void);
+int APS5_VABI sceKernelIccControlUSBPowerState(void);
+int APS5_VABI sceKernelIccGetBDPowerState(void);
+int APS5_VABI sceKernelIccGetBootTimestamp(void);
+int APS5_VABI sceKernelIccGetCPMode(void);
+int APS5_VABI sceKernelIccGetCountTime(void);
+int APS5_VABI sceKernelIccGetCpuInfoBit(void);
+int APS5_VABI sceKernelIccGetErrLog(void);
+int APS5_VABI sceKernelIccGetHwInfo(void);
+int APS5_VABI sceKernelIccGetPowerNumberOfBootShutdown(void);
+int APS5_VABI sceKernelIccGetPowerOperatingTime(void);
+int APS5_VABI sceKernelIccGetPowerUpCause(void);
+int APS5_VABI sceKernelIccGetSysEventLog(void);
+int APS5_VABI sceKernelIccGetUSBPowerState(void);
+int APS5_VABI sceKernelIccIndicatorBootDone(void);
+int APS5_VABI sceKernelIccIndicatorShutdown(void);
+int APS5_VABI sceKernelIccIndicatorStandby(void);
+int APS5_VABI sceKernelIccIndicatorStandbyBoot(void);
+int APS5_VABI sceKernelIccIndicatorStandbyShutdown(void);
+int APS5_VABI sceKernelIccNotifyBootStatus(void);
+int APS5_VABI sceKernelIccNvsFlush(void);
+int APS5_VABI sceKernelIccReadPowerBootMessage(void);
+int APS5_VABI sceKernelIccSetBuzzer(void);
+int APS5_VABI sceKernelIccSetCPMode(void);
+int APS5_VABI sceKernelIccSetCpuInfoBit(void);
+int APS5_VABI sceKernelIccSetDownloadMode(void);
+int APS5_VABI sceKernelInternalGetKmemStatistics(void);
+int APS5_VABI sceKernelInternalGetMapStatistics(void);
+int APS5_VABI sceKernelInternalHeapPrintBacktraceWithModuleInfo(void);
+int APS5_VABI sceKernelInternalMapDirectMemory(void);
+int APS5_VABI sceKernelInternalMapNamedDirectMemory(void);
+int APS5_VABI sceKernelInternalResumeDirectMemoryRelease(void);
+int APS5_VABI sceKernelInternalSuspendDirectMemoryRelease(void);
+int APS5_VABI sceKernelIsAllowedToSelectDvdRegion(void);
+int APS5_VABI sceKernelIsAuthenticNeo(void);
+int APS5_VABI sceKernelIsCEX(void);
+int APS5_VABI sceKernelIsDebuggerAttached(void);
+int APS5_VABI sceKernelIsDevKit(void);
+int APS5_VABI sceKernelIsExperimentalBeta(void);
+int APS5_VABI sceKernelIsGenuineCEX(void);
+int APS5_VABI sceKernelIsGenuineDevKit(void);
+int APS5_VABI sceKernelIsGenuineKratosCex(void);
+int APS5_VABI sceKernelIsGenuineN(void);
+int APS5_VABI sceKernelIsGenuineTestKit(void);
+int APS5_VABI sceKernelIsInSandbox(void);
+int APS5_VABI sceKernelIsKratos(void);
+int APS5_VABI sceKernelIsM2DeviceAttached(void);
+int APS5_VABI sceKernelIsMainOnStanbyMode(void);
+int APS5_VABI sceKernelIsMainOnStandbyMode(void);
+int APS5_VABI sceKernelIsModuleLoaded(void);
+int APS5_VABI sceKernelIsNeoMode(void);
+int APS5_VABI sceKernelIsProspero(void);
+int APS5_VABI sceKernelIsPs4Process(void);
+int APS5_VABI sceKernelIsTestKit(void);
+int APS5_VABI sceKernelJitGetSharedMemoryInfo(void);
+int APS5_VABI sceKernelKernelHeapUsage(void);
+int APS5_VABI sceKernelLoadStartModuleInternalForMono(void);
+int APS5_VABI sceKernelLwfsAllocateBlock(void);
+int APS5_VABI sceKernelLwfsLseek(void);
+int APS5_VABI sceKernelLwfsSetAttribute(void);
+int APS5_VABI sceKernelLwfsTrimBlock(void);
+int APS5_VABI sceKernelLwfsWrite(void);
+int APS5_VABI sceKernelMapNamedSystemFlexibleMemory(void);
+int APS5_VABI sceKernelMapSanitizerShadowMemory(void);
+int APS5_VABI sceKernelMapToolMemory(void);
+int APS5_VABI sceKernelMapTraceMemory(void);
+int APS5_VABI sceKernelMapperGetParam(void);
+int APS5_VABI sceKernelMemoryPoolMove(void);
+int APS5_VABI sceKernelMlockall(void);
+int APS5_VABI sceKernelMsync(void* address, std::size_t length, int flags);
+int APS5_VABI sceKernelNormalizePath(void);
+int APS5_VABI sceKernelNotifyAppEvent(void);
+int APS5_VABI sceKernelNotifyAppStateChanged(void);
+int APS5_VABI sceKernelNotifySystemSuspendResumeProgress(void);
+int APS5_VABI sceKernelNotifySystemSuspendStart(void);
+int APS5_VABI sceKernelOpenEport(void);
+int APS5_VABI sceKernelOpenInternal(void);
+int APS5_VABI sceKernelOpenSema(void);
+int APS5_VABI sceKernelPrepareDirectMemorySwap(void);
+int APS5_VABI sceKernelPrepareToResumeProcess(void);
+int APS5_VABI sceKernelPrepareToSuspendProcess(void);
+int APS5_VABI sceKernelProtectDirectMemory(void);
+int APS5_VABI sceKernelProtectDirectMemoryForPID(void);
+int APS5_VABI sceKernelQueryToolMemory(void);
+int APS5_VABI sceKernelQueryTraceMemory(void);
+int APS5_VABI sceKernelRandomizedPath(void);
+int APS5_VABI sceKernelRdup(void);
+int APS5_VABI sceKernelReboot(void);
+int APS5_VABI sceKernelReleaseToolMemory(void);
+int APS5_VABI sceKernelReleaseTraceDirectMemory(void);
+int APS5_VABI sceKernelReportUnpatchedFunctionCall(void);
+int APS5_VABI sceKernelReserve2mbPage(void);
+int APS5_VABI sceKernelReserveSystemDirectMemory(void);
+int APS5_VABI sceKernelRestoreApp(void);
+int APS5_VABI sceKernelResumeDirectMemoryRelease(void);
+int APS5_VABI sceKernelResumeProcess(void);
+int APS5_VABI sceKernelRtldControl(void);
+int APS5_VABI sceKernelSandboxPath(void);
+int APS5_VABI sceKernelSaveApp(void);
+int APS5_VABI sceKernelSetAppInfo(void);
+int APS5_VABI sceKernelSetAppState(void);
+int APS5_VABI sceKernelSetBackupRestoreMode(void);
+int APS5_VABI sceKernelSetBaseModeClock(void);
+int APS5_VABI sceKernelSetBesteffort(void);
+int APS5_VABI sceKernelSetBootReqNotify(void);
+int APS5_VABI sceKernelSetBudget(void);
+int APS5_VABI sceKernelSetCallRecord(void);
+int APS5_VABI sceKernelSetCompressionAttribute(void);
+int APS5_VABI sceKernelSetCoredumpAppInfo(void);
+int APS5_VABI sceKernelSetCpumodeGame(void);
+int APS5_VABI sceKernelSetDataTransferMode(void);
+int APS5_VABI sceKernelSetEmergencyErrorLog(void);
+int APS5_VABI sceKernelSetFsstParam(void);
+int APS5_VABI sceKernelSetGPI(void);
+int APS5_VABI sceKernelSetGameDirectMemoryLimit(void);
+int APS5_VABI sceKernelSetGpuCu(void);
+int APS5_VABI sceKernelSetIoreq(void);
+int APS5_VABI sceKernelSetKnobs(void);
+int APS5_VABI sceKernelSetMemoryPstate(void);
+int APS5_VABI sceKernelSetNeoModeClock(void);
+int APS5_VABI sceKernelSetPackageInfo(void);
+int APS5_VABI sceKernelSetPhysFmemLimit(void);
+int APS5_VABI sceKernelSetProcessName(void);
+int APS5_VABI sceKernelSetProcessProperty(void);
+int APS5_VABI sceKernelSetProcessPropertyString(void);
+int APS5_VABI sceKernelSetSafemode(void);
+int APS5_VABI sceKernelSetSafemodeDirect(void);
+int APS5_VABI sceKernelSetSuspendState(void);
+int APS5_VABI sceKernelSetTimezoneInfo(void);
+int APS5_VABI sceKernelSetUpdatemode(void);
+int APS5_VABI sceKernelSetVmContainer(void);
+int APS5_VABI sceKernelSettimeofday(void);
+int APS5_VABI sceKernelSflashGetWritePrio(void);
+int APS5_VABI sceKernelSflashSetWritePrio(void);
+int APS5_VABI sceKernelSlvNotifyError(void);
+int APS5_VABI sceKernelSpawn(void);
+int APS5_VABI sceKernelStreamWriteActivate(void);
+int APS5_VABI sceKernelStreamWriteCreate(void);
+int APS5_VABI sceKernelStreamWriteDeactivate(void);
+int APS5_VABI sceKernelStreamWriteDelete(void);
+int APS5_VABI sceKernelStreamWriteRead(void);
+int APS5_VABI sceKernelStreamWriteStat(void);
+int APS5_VABI sceKernelStreamWriteWrite(void);
+int APS5_VABI sceKernelSuspendDirectMemoryRelease(void);
+int APS5_VABI sceKernelSuspendProcess(void);
+int APS5_VABI sceKernelSuspendSystem(void);
+int APS5_VABI sceKernelSwitchToBaseMode(void);
+int APS5_VABI sceKernelSwitchToNativeMode(void);
+int APS5_VABI sceKernelSwitchToNeoMode(void);
+int APS5_VABI sceKernelTerminateProcess(void);
+int APS5_VABI sceKernelTerminateSysCore(void);
+int APS5_VABI sceKernelTitleWorkdaroundIsEnabled(void);
+int APS5_VABI sceKernelTraceMemoryTypeProtect(void);
+int APS5_VABI sceKernelTriggerEport(void);
+int APS5_VABI sceKernelVirtualQueryAll(void);
+int APS5_VABI sceKernelWaitCommandBufferCompletion(void);
+int APS5_VABI sceKernelWriteEventQueueOnCompletionCommand(void);
+int APS5_VABI sceKernelWriteMapCommand(void);
+int APS5_VABI sceKernelWriteMapCommand2(void);
+int APS5_VABI sceKernelWriteMapDirectCommand(void);
+int APS5_VABI sceKernelWriteMapDirectWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteMapWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteModifyMtypeProtectWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteModifyProtectCommand(void);
+int APS5_VABI sceKernelWriteModifyProtectWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteMultiMapCommand(void);
+int APS5_VABI sceKernelWriteMultiMapWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteRemapCommand(void);
+int APS5_VABI sceKernelWriteRemapWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteSdkEventLog(void);
+int APS5_VABI sceKernelWriteSdkEventLogV(void);
+int APS5_VABI sceKernelWriteUnmapCommand(void);
+int APS5_VABI sceKernelWriteWaitOnAddressCommand(void);
+int APS5_VABI sceKernelWriteWaitOnCounterCommand(void);
+int APS5_VABI sceKernelWriteWriteAddressCommand(void);
+int APS5_VABI sceKernelWriteWriteCounterCommand(void);
+int APS5_VABI sceKernelYieldCpumode(void);
+int APS5_VABI sceLibcMspaceCreateForMonoMutex(void);
+int APS5_VABI scePthreadAtfork(void (APS5_VABI* prepare)(), void (APS5_VABI* parent)(), void (APS5_VABI* child)());
+int APS5_VABI scePthreadAttrGetscope(const PthreadAttr* attr, int* scope);
+int APS5_VABI scePthreadAttrSetcreatesuspend(PthreadAttr* attr);
+int APS5_VABI scePthreadAttrSetscope(PthreadAttr* attr, int scope);
+int APS5_VABI scePthreadBarrierDestroy(PthreadBarrierPrivate** barrier);
+int APS5_VABI scePthreadBarrierInit(PthreadBarrierPrivate** barrier, PthreadBarrierattrPrivate* const* attr, unsigned count, const char* name);
+int APS5_VABI scePthreadBarrierWait(PthreadBarrierPrivate** barrier);
+int APS5_VABI scePthreadBarrierattrDestroy(PthreadBarrierattrPrivate** attr);
+int APS5_VABI scePthreadBarrierattrGetpshared(PthreadBarrierattrPrivate* const* attr, int* pshared);
+int APS5_VABI scePthreadBarrierattrInit(PthreadBarrierattrPrivate** attr);
+int APS5_VABI scePthreadBarrierattrSetpshared(PthreadBarrierattrPrivate** attr, int pshared);
+int APS5_VABI scePthreadGetconcurrency(void);
+int APS5_VABI scePthreadGetcpuclockid(Pthread thread, int* clockId);
+int APS5_VABI scePthreadMain(void);
+int APS5_VABI scePthreadMulti(void);
+int APS5_VABI scePthreadMutexGetprioceiling(void);
+int APS5_VABI scePthreadMutexInitForInternalLibc(void);
+int APS5_VABI scePthreadMutexIsowned(void);
+int APS5_VABI scePthreadMutexSetprioceiling(void);
+int APS5_VABI scePthreadMutexattrGetgen(void);
+int APS5_VABI scePthreadMutexattrInitForInternalLibc(void);
+int APS5_VABI scePthreadMutexattrSetgen(void);
+int APS5_VABI scePthreadResume(Pthread thread);
+void APS5_VABI scePthreadResumeAll(void);
+int APS5_VABI scePthreadSetBesteffort(void);
+int APS5_VABI scePthreadSetconcurrency(int level);
+int APS5_VABI scePthreadSingle(void);
+int APS5_VABI scePthreadSuspend(void);
+int APS5_VABI scePthreadSuspendAll(void);
+int APS5_VABI scePthreadTimedjoin(void);
+int APS5_VABI sched_getparam_nid_postfix(void);
+int APS5_VABI sched_getscheduler_nid_postfix(void);
+int APS5_VABI sched_setparam_nid_postfix(void);
+int APS5_VABI sched_setscheduler_nid_postfix(void);
+int APS5_VABI sem_setname_nid_postfix(void);
+int APS5_VABI set_phys_fmem_limit_nid_postfix(void);
+int APS5_VABI setlogin_nid_postfix(const char* name);
+int APS5_VABI sigqueue_nid_postfix(void);
+int APS5_VABI sigreturn_nid_postfix(void);
+int APS5_VABI statfs_nid_postfix(void);
+int APS5_VABI swapon_nid_postfix(void);
+int APS5_VABI symlinkat_nid_postfix(void);
+int APS5_VABI sysKernelGetIntdevModeForInternalLibc_nid_postfix(void);
+int APS5_VABI sysKernelGetIntdevModeForRcmgr_nid_postfix(void);
+int APS5_VABI sysKernelGetManufacturingMode_nid_postfix(void);
+int APS5_VABI sysKernelGetUpdVersion_nid_postfix(void);
+int APS5_VABI sysc_e00_nid_postfix(void);
+int APS5_VABI sysc_m00_nid_postfix(void);
+int APS5_VABI sysc_s00_nid_postfix(void);
+int APS5_VABI tcgetsid_nid_postfix(void);
+int APS5_VABI tcsetsid_nid_postfix(void);
+int APS5_VABI unmount_nid_postfix(void);
+int APS5_VABI utrace_nid_postfix(void);
+int APS5_VABI uuidgen_nid_postfix(void);
+int APS5_VABI vfork_nid_postfix(void);
+int APS5_VABI wait3_nid_postfix(void);
+int APS5_VABI wait4_nid_postfix(void);
+
+int APS5_VABI _openat_nid_postfix(int fd, const char* path, int flags, ...);
+
+}
diff --git a/core/libs/prx/libkernel_sys/libkernel_sys.hpp b/core/libs/prx/libkernel_sys/libkernel_sys.hpp
new file mode 100644
index 0000000000..d1700db775
--- /dev/null
+++ b/core/libs/prx/libkernel_sys/libkernel_sys.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libkernel_sys/include/Api.hpp"
diff --git a/core/libs/prx/libkernel_web/libkernel_web.hpp b/core/libs/prx/libkernel_web/libkernel_web.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libkernel_web/libkernel_web.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libmdbg_syscore/Export.cpp b/core/libs/prx/libmdbg_syscore/Export.cpp
index 195bb3c119..98fb4bdf87 100644
--- a/core/libs/prx/libmdbg_syscore/Export.cpp
+++ b/core/libs/prx/libmdbg_syscore/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libmdbg_syscore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -226,8 +227,7 @@ int APS5_VABI sceDebugGetProcessCoredumpHandlerResult() {
 }
 
 int APS5_VABI sceDebugGetProcessEventCntlFlag() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 1;
 }
 
 int APS5_VABI sceDebugGetProcessInfo() {
@@ -651,8 +651,7 @@ int APS5_VABI sceDebugResumeThread() {
 }
 
 int APS5_VABI sceDebugSetProcessEventCntlFlag() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 1;
 }
 
 int APS5_VABI sceDebugSetStepThread() {
diff --git a/core/libs/prx/libmdbg_syscore/include/Api.hpp b/core/libs/prx/libmdbg_syscore/include/Api.hpp
new file mode 100644
index 0000000000..9008d00bb7
--- /dev/null
+++ b/core/libs/prx/libmdbg_syscore/include/Api.hpp
@@ -0,0 +1,151 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDebugAcquireAndUpdateDebugRegister();
+int APS5_VABI sceDebugAttachProcess();
+int APS5_VABI sceDebugCancelCoredump();
+int APS5_VABI sceDebugClearStepThread();
+int APS5_VABI sceDebugCreatePerfScratchDataArea();
+int APS5_VABI sceDebugCreatePerfScratchExecutableArea();
+int APS5_VABI sceDebugCreateScratchDataArea();
+int APS5_VABI sceDebugCreateScratchDataAreaForPrx();
+int APS5_VABI sceDebugCreateScratchExecutableArea();
+int APS5_VABI sceDebugCreateScratchExecutableAreaForPrx();
+int APS5_VABI sceDebugDestroyPerfScratchDataArea();
+int APS5_VABI sceDebugDestroyPerfScratchExecutableArea();
+int APS5_VABI sceDebugDestroyScratchDataArea();
+int APS5_VABI sceDebugDestroyScratchExecutableArea();
+int APS5_VABI sceDebugDetachProcess();
+int APS5_VABI sceDebugGetApplicationIdByTitleId();
+int APS5_VABI sceDebugGetApplicationInfo();
+int APS5_VABI sceDebugGetApplicationList();
+int APS5_VABI sceDebugGetCrashInfoDetailForCoredump();
+int APS5_VABI sceDebugGetCrashInfoForCoredump();
+int APS5_VABI sceDebugGetDLLoadFlag();
+int APS5_VABI sceDebugGetDataListOfUltQueue();
+int APS5_VABI sceDebugGetDebugRegisterStatusMap();
+int APS5_VABI sceDebugGetEventList();
+int APS5_VABI sceDebugGetEventListForEQueueFd();
+int APS5_VABI sceDebugGetEventSubscriptionList();
+int APS5_VABI sceDebugGetEventSubscriptionListForEQueueFd();
+int APS5_VABI sceDebugGetFiberInfo();
+int APS5_VABI sceDebugGetFileInfo();
+int APS5_VABI sceDebugGetFileInfoForCoredump();
+int APS5_VABI sceDebugGetFileList();
+int APS5_VABI sceDebugGetFileListForCoredump();
+int APS5_VABI sceDebugGetGpuInfoArea();
+int APS5_VABI sceDebugGetJobManagerInfo();
+int APS5_VABI sceDebugGetJobManagerSequenceInfo();
+int APS5_VABI sceDebugGetJobManagerSequenceList();
+int APS5_VABI sceDebugGetModuleInfo();
+int APS5_VABI sceDebugGetModuleList();
+int APS5_VABI sceDebugGetModuleMetaData();
+int APS5_VABI sceDebugGetMonoVMInfo();
+int APS5_VABI sceDebugGetMonoVMList();
+int APS5_VABI sceDebugGetProcessCoredumpHandlerEventBlob();
+int APS5_VABI sceDebugGetProcessCoredumpHandlerEventInfo();
+int APS5_VABI sceDebugGetProcessCoredumpHandlerResult();
+int APS5_VABI sceDebugGetProcessEventCntlFlag();
+int APS5_VABI sceDebugGetProcessInfo();
+int APS5_VABI sceDebugGetProcessList();
+int APS5_VABI sceDebugGetProcessPropertyForCoredump();
+int APS5_VABI sceDebugGetProcessResourceStatCount();
+int APS5_VABI sceDebugGetProcessResourceStatData();
+int APS5_VABI sceDebugGetProcessTime();
+int APS5_VABI sceDebugGetProcessTimeCounter();
+int APS5_VABI sceDebugGetSyncExclusiveWaiterList();
+int APS5_VABI sceDebugGetSyncObjectData();
+int APS5_VABI sceDebugGetSyncObjectList();
+int APS5_VABI sceDebugGetSyncWaiterList();
+int APS5_VABI sceDebugGetSyncWaiterListForEQueueFd();
+int APS5_VABI sceDebugGetSystemStatusBlob();
+int APS5_VABI sceDebugGetSystemStatusCount();
+int APS5_VABI sceDebugGetThreadInfo();
+int APS5_VABI sceDebugGetThreadInfoByIdent();
+int APS5_VABI sceDebugGetThreadList();
+int APS5_VABI sceDebugGetThreadListAsIdent();
+int APS5_VABI sceDebugGetUlObjectList();
+int APS5_VABI sceDebugGetUltCondvarInfo();
+int APS5_VABI sceDebugGetUltInfo();
+int APS5_VABI sceDebugGetUltListOfUltRuntime();
+int APS5_VABI sceDebugGetUltMutexInfo();
+int APS5_VABI sceDebugGetUltQueueDataResourcePoolInfo();
+int APS5_VABI sceDebugGetUltQueueInfo();
+int APS5_VABI sceDebugGetUltRuntimeInfo();
+int APS5_VABI sceDebugGetUltRwlockInfo();
+int APS5_VABI sceDebugGetUltSemaphoreInfo();
+int APS5_VABI sceDebugGetUltWaitingQueueResourcePoolInfo();
+int APS5_VABI sceDebugGetVirtualMemoryDetailInfoForCoredump();
+int APS5_VABI sceDebugGetVirtualMemoryInfo();
+int APS5_VABI sceDebugGetVirtualMemoryInfoForCoredump();
+int APS5_VABI sceDebugGetWaitingListOfUltCondvar();
+int APS5_VABI sceDebugGetWaitingListOfUltMutex();
+int APS5_VABI sceDebugGetWaitingListOfUltQueue();
+int APS5_VABI sceDebugGetWaitingListOfUltRwlock();
+int APS5_VABI sceDebugGetWaitingListOfUltSemaphore();
+int APS5_VABI sceDebugGetWorkerThreadListOfUltRuntime();
+int APS5_VABI sceDebugInit();
+int APS5_VABI sceDebugInitForCoredump();
+int APS5_VABI sceDebugInitForTest();
+int APS5_VABI sceDebugIpmiGetBlockTimeInfoList();
+int APS5_VABI sceDebugIpmiGetBlockedIpcInfo();
+int APS5_VABI sceDebugIpmiGetChannelInfo();
+int APS5_VABI sceDebugIpmiGetChannelKidList();
+int APS5_VABI sceDebugIpmiGetChannelWaitingThreadList();
+int APS5_VABI sceDebugIpmiGetClientInfo();
+int APS5_VABI sceDebugIpmiGetClientKidList();
+int APS5_VABI sceDebugIpmiGetClientKidListByDump();
+int APS5_VABI sceDebugIpmiGetClientKidListByServerKid();
+int APS5_VABI sceDebugIpmiGetConnectRequestInfoList();
+int APS5_VABI sceDebugIpmiGetConnectionInfoList();
+int APS5_VABI sceDebugIpmiGetConnectionWaitingThreadListByClientKid();
+int APS5_VABI sceDebugIpmiGetConnectionWaitingThreadListBySessionKid();
+int APS5_VABI sceDebugIpmiGetDump();
+int APS5_VABI sceDebugIpmiGetEncryptedInfoAllForCoredump();
+int APS5_VABI sceDebugIpmiGetKidInfoListForCoredump();
+int APS5_VABI sceDebugIpmiGetServerDispatchInfo();
+int APS5_VABI sceDebugIpmiGetServerInfo();
+int APS5_VABI sceDebugIpmiGetServerKidList();
+int APS5_VABI sceDebugIpmiGetServerKidListByDump();
+int APS5_VABI sceDebugIpmiGetServerWaitingThreadList();
+int APS5_VABI sceDebugIpmiGetSessionInfo();
+int APS5_VABI sceDebugIpmiGetSessionKidList();
+int APS5_VABI sceDebugIpmiGetSessionKidListByServerKid();
+int APS5_VABI sceDebugIpmiGetTidListByDump();
+int APS5_VABI sceDebugKillApplication();
+int APS5_VABI sceDebugKillProcess();
+int APS5_VABI sceDebugNoStopChildProcesses();
+int APS5_VABI sceDebugNoStopOnDLLoad();
+int APS5_VABI sceDebugProcessSpawn();
+int APS5_VABI sceDebugReadEvent();
+int APS5_VABI sceDebugReadEventForTest();
+int APS5_VABI sceDebugReadProcessMemory();
+int APS5_VABI sceDebugReadProcessMemoryForSDBGP();
+int APS5_VABI sceDebugReadProcessRegister();
+int APS5_VABI sceDebugReadProcessRegisterForSDBGP();
+int APS5_VABI sceDebugReadProcessResourceStatData();
+int APS5_VABI sceDebugReadThreadRegister();
+int APS5_VABI sceDebugReadThreadRegisterForSDBGP();
+int APS5_VABI sceDebugReleaseDebugRegister();
+int APS5_VABI sceDebugResumeApplication();
+int APS5_VABI sceDebugResumeProcess();
+int APS5_VABI sceDebugResumeThread();
+int APS5_VABI sceDebugSetProcessEventCntlFlag();
+int APS5_VABI sceDebugSetStepThread();
+int APS5_VABI sceDebugSpawnApplication();
+int APS5_VABI sceDebugStopChildProcesses();
+int APS5_VABI sceDebugStopOnDLLoad();
+int APS5_VABI sceDebugSuspendApplication();
+int APS5_VABI sceDebugSuspendProcess();
+int APS5_VABI sceDebugSuspendThread();
+int APS5_VABI sceDebugTriggerCoredump();
+int APS5_VABI sceDebugTriggerCoredumpForSystem();
+int APS5_VABI sceDebugTriggerVrCaptureDump();
+int APS5_VABI sceDebugWriteProcessMemory();
+int APS5_VABI sceDebugWriteProcessRegister();
+int APS5_VABI sceDebugWriteThreadRegister();
+
+}
diff --git a/core/libs/prx/libmdbg_syscore/libmdbg_syscore.hpp b/core/libs/prx/libmdbg_syscore/libmdbg_syscore.hpp
new file mode 100644
index 0000000000..8a0fe08e5f
--- /dev/null
+++ b/core/libs/prx/libmdbg_syscore/libmdbg_syscore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libmdbg_syscore/include/Api.hpp"
diff --git a/core/libs/prx/ulobjmgr/Export.cpp b/core/libs/prx/ulobjmgr/Export.cpp
index 25b7f547b2..31328f15db 100644
--- a/core/libs/prx/ulobjmgr/Export.cpp
+++ b/core/libs/prx/ulobjmgr/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/ulobjmgr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -23,4 +24,12 @@ int APS5_VABI _sceUlobjmgrUnregisterObject(std::uint32_t id) {
  return 0;
 }
 
+int APS5_VABI _sceUlobjmgrRegisterObject_nid_postfix(std::uint64_t object, std::int32_t kind, std::uint32_t* id) {
+ return _sceUlobjmgrRegisterObject(object, kind, id);
+}
+
+int APS5_VABI _sceUlobjmgrUnregisterObject_nid_postfix(std::uint32_t id) {
+ return _sceUlobjmgrUnregisterObject(id);
+}
+
 }
diff --git a/core/libs/prx/ulobjmgr/include/Api.hpp b/core/libs/prx/ulobjmgr/include/Api.hpp
new file mode 100644
index 0000000000..f551d92f17
--- /dev/null
+++ b/core/libs/prx/ulobjmgr/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI _sceUlobjmgrRegisterObject(std::uint64_t object, std::int32_t kind, std::uint32_t* id);
+int APS5_VABI _sceUlobjmgrUnregisterObject(std::uint32_t id);
+
+int APS5_VABI _sceUlobjmgrRegisterObject_nid_postfix(std::uint64_t object, std::int32_t kind, std::uint32_t* id);
+int APS5_VABI _sceUlobjmgrUnregisterObject_nid_postfix(std::uint32_t id);
+
+}
diff --git a/core/libs/prx/ulobjmgr/ulobjmgr.hpp b/core/libs/prx/ulobjmgr/ulobjmgr.hpp
new file mode 100644
index 0000000000..3a6f8594df
--- /dev/null
+++ b/core/libs/prx/ulobjmgr/ulobjmgr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/ulobjmgr/include/Api.hpp"
diff --git a/core/libs/tests/AppArchiveFixture.hpp b/core/libs/tests/AppArchiveFixture.hpp
index b6c5e4529c..234c647e3c 100644
--- a/core/libs/tests/AppArchiveFixture.hpp
+++ b/core/libs/tests/AppArchiveFixture.hpp
@@ -20,8 +20,11 @@ inline std::vector<char> Pattern(std::size_t size) {
 }
 
 inline std::filesystem::path EnterFreshRoot(const char* name) {
-    const auto root = std::filesystem::temp_directory_path() /
-        (std::string(name) + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    std::filesystem::path root;
+    do {
+        root = std::filesystem::temp_directory_path() /
+            (std::string(name) + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    } while (!std::filesystem::create_directory(root));
     std::filesystem::create_directories(root / "app0" / "sce_sys");
     std::filesystem::current_path(root);
     return std::filesystem::canonical(root);
diff --git a/core/libs/tests/ApplicationHeap.cpp b/core/libs/tests/ApplicationHeap.cpp
index be99345d50..8c02b16146 100644
--- a/core/libs/tests/ApplicationHeap.cpp
+++ b/core/libs/tests/ApplicationHeap.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -22,24 +23,9 @@
 #endif
 
 extern "C" {
-void APS5_VABI _init_env_nid_postfix();
-int APS5_VABI posix_memalign_nid_postfix(void**, std::size_t, std::size_t);
-void* APS5_VABI reallocf_nid_postfix(void*, std::size_t);
-void* APS5_VABI _Znwm_nid_postfix(std::size_t);
-void* APS5_VABI _ZnwmRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void* APS5_VABI _ZnamRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void APS5_VABI _ZdlPv_nid_postfix(void*);
-void APS5_VABI _ZdaPv_nid_postfix(void*);
-void APS5_VABI _ZdlPvSt11align_val_t_nid_postfix(void*, std::size_t);
-void APS5_VABI _ZdlPvmSt11align_val_t_nid_postfix(void*, std::size_t, std::size_t);
+
 void* ApplicationHeapRealign_nid_no_patch(void*, std::size_t, std::size_t);
-char* APS5_VABI strdup_nid_postfix(const char*);
-char* APS5_VABI strndup_nid_postfix(const char*, std::size_t);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI atexit_nid_postfix(void (APS5_VABI*)());
-void* APS5_VABI scriptingGetMem_nid_postfix(std::size_t, std::size_t);
-void APS5_VABI scriptingFreeMem_nid_postfix(void*);
+
 }
 
 namespace {
@@ -256,8 +242,10 @@ int main(int argc, char** argv) {
         require(initializes == 0);
         require(_Znwm_nid_postfix(40) == storage.data() && lastSize == 40 && initializes == 1);
         _ZdlPv_nid_postfix(storage.data());
+
         require(frees == 1);
         _init_env_nid_postfix();
+
         require(initializes == 1);
         return 0;
     }
@@ -275,11 +263,14 @@ int main(int argc, char** argv) {
         require(first[blockBytes - 1] == std::byte{0x5a} && second[0] == std::byte{0xa5});
         scriptingFreeMem_nid_postfix(first);
         scriptingFreeMem_nid_postfix(second);
+
         require(initializes == 0 && frees == 0);
         _init_env_nid_postfix();
+
         require(initializes == 1);
         require(_Znwm_nid_postfix(40) == storage.data() && lastSize == 40);
         _ZdlPv_nid_postfix(storage.data());
+
         require(frees == 1);
         return 0;
     }
@@ -303,7 +294,8 @@ int main(int argc, char** argv) {
         for (unsigned i = 0; i < 63; ++i) require(pointer[i] == 0x5a);
         pointer = static_cast<unsigned char*>(ApplicationHeapReallocate_nid_no_patch(pointer, 11));
         for (unsigned i = 0; i < 11; ++i) require(pointer[i] == 0x5a);
-        require(ApplicationHeapReallocate_nid_no_patch(pointer, 0) == nullptr);
+        require(ApplicationHeapReallocate_nid_no_patch(pointer, 0) == pointer && ApplicationHeapUsableSize_nid_no_patch(pointer) == 0);
+        ApplicationHeapFree_nid_no_patch(pointer);
         pointer = static_cast<unsigned char*>(ApplicationHeapReallocate_nid_no_patch(nullptr, 32));
         require(pointer != nullptr);
         ApplicationHeapFree_nid_no_patch(pointer);
@@ -317,14 +309,20 @@ int main(int argc, char** argv) {
         require(pointer != nullptr && ApplicationHeapUsableSize_nid_no_patch(pointer) == 9);
         for (unsigned i = 0; i < 9; ++i) require(pointer[i] == 0x3c);
         *__error_nid_postfix() = 0;
-        require(reallocf_nid_postfix(pointer, 0) == nullptr && *__error_nid_postfix() == 0);
+        require(reallocf_nid_postfix(pointer, 0) == pointer && *__error_nid_postfix() == 0 && ApplicationHeapUsableSize_nid_no_patch(pointer) == 0);
+        ApplicationHeapFree_nid_no_patch(pointer);
         reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); });
         pointer = static_cast<unsigned char*>(reallocf_nid_postfix(nullptr, 40));
         require(pointer != nullptr);
-        require(reallocf_nid_postfix(pointer, SIZE_MAX - 4096) == nullptr && *__error_nid_postfix() == 12);
+        *__error_nid_postfix() = 77;
+        require(reallocf_nid_postfix(pointer, SIZE_MAX - 4096) == nullptr && *__error_nid_postfix() == 77);
         reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); });
-        *__error_nid_postfix() = 0;
-        require(reallocf_nid_postfix(nullptr, SIZE_MAX) == nullptr && *__error_nid_postfix() == 12);
+        pointer = static_cast<unsigned char*>(reallocf_nid_postfix(nullptr, 40));
+        require(pointer != nullptr);
+        require(reallocf_nid_postfix(pointer, SIZE_MAX - 0x1008f) == nullptr && *__error_nid_postfix() == 22);
+        reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); });
+        *__error_nid_postfix() = 77;
+        require(reallocf_nid_postfix(nullptr, SIZE_MAX) == nullptr && *__error_nid_postfix() == 77);
         void* empty = ApplicationHeapAllocate_nid_no_patch(0);
         require(empty != nullptr);
         ApplicationHeapFree_nid_no_patch(empty);
@@ -335,6 +333,7 @@ int main(int argc, char** argv) {
             auto* aligned = ApplicationHeapAlign_nid_no_patch(alignment, 37);
             require(reinterpret_cast<std::uintptr_t>(aligned) % alignment == 0);
             _ZdlPvSt11align_val_t_nid_postfix(aligned, alignment);
+
         }
         void* aligned = nullptr;
         require(ApplicationHeapPosixAlign_nid_no_patch(&aligned, 256, 99) == 0);
@@ -378,21 +377,27 @@ int main(int argc, char** argv) {
     require(_Znwm_nid_postfix(0) == storage.data() && lastSize == 1);
     _ZdlPv_nid_postfix(storage.data());
     _ZdlPv_nid_postfix(nullptr);
+
     require(frees == 3);
     require(_ZnamRKSt9nothrow_t_nid_postfix(24, nullptr) == storage.data() && lastSize == 24);
     _ZdaPv_nid_postfix(storage.data());
+
     require(frees == 4);
     require(ApplicationHeapRealign_nid_no_patch(storage.data(), 48, 32) == storage.data() && lastSize == 48 && lastAlignment == 32);
     reject([] { ApplicationHeapRealign_nid_no_patch(storage.data(), 16, 4096); });
     pointer = ApplicationHeapAlign_nid_no_patch(64, 37);
     _ZdlPvSt11align_val_t_nid_postfix(pointer, 64);
+
     require(frees == 5);
     _ZdlPvSt11align_val_t_nid_postfix(nullptr, 64);
+
     require(frees == 5);
     pointer = ApplicationHeapAlign_nid_no_patch(64, 37);
     _ZdlPvmSt11align_val_t_nid_postfix(pointer, 37, 64);
+
     require(frees == 6);
     _ZdlPvmSt11align_val_t_nid_postfix(nullptr, 37, 64);
+
     require(frees == 6);
     require(reallocf_nid_postfix(storage.data(), 80) == storage.data() && lastSize == 80 && frees == 6);
     require(reallocf_nid_postfix(storage.data(), 16) == storage.data() && lastSize == 16 && frees == 6);
@@ -473,6 +478,7 @@ int main(int argc, char** argv) {
     const auto beforeScripting = frees;
     const auto sizeBeforeScripting = lastSize;
     scriptingFreeMem_nid_postfix(nullptr);
+
     auto* small = static_cast<std::byte*>(scriptingGetMem_nid_postfix(0, 31));
     auto* aligned = static_cast<std::byte*>(scriptingGetMem_nid_postfix(64, 37));
     require(small != nullptr && small != storage.data() && reinterpret_cast<std::uintptr_t>(small) % 16 == 0);
@@ -482,12 +488,14 @@ int main(int argc, char** argv) {
     require(small + 31 <= aligned || aligned + 37 <= small);
     scriptingFreeMem_nid_postfix(small);
     scriptingFreeMem_nid_postfix(aligned);
+
     require(scriptingGetMem_nid_postfix(24, 80) == nullptr);
     require(scriptingGetMem_nid_postfix(16, std::numeric_limits<std::size_t>::max()) == nullptr);
     fail = true;
     auto* unaffected = scriptingGetMem_nid_postfix(16, 64);
     require(unaffected != nullptr);
     scriptingFreeMem_nid_postfix(unaffected);
+
     fail = false;
     require(frees == beforeScripting && lastSize == sizeBeforeScripting);
 }
diff --git a/core/libs/tests/ApplicationHeapStats.cpp b/core/libs/tests/ApplicationHeapStats.cpp
index 1345d218d1..8844a5c835 100644
--- a/core/libs/tests/ApplicationHeapStats.cpp
+++ b/core/libs/tests/ApplicationHeapStats.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -6,11 +7,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI malloc_stats_fast_nid_postfix(void*);
-std::size_t APS5_VABI malloc_usable_size_nid_postfix(void*);
-}
-
 namespace {
 
 alignas(64) std::array<std::byte, 256> storage{};
diff --git a/core/libs/tests/ExceptionCCleanup.cpp b/core/libs/tests/ExceptionCCleanup.cpp
index cca7677edb..9612a8aaa3 100644
--- a/core/libs/tests/ExceptionCCleanup.cpp
+++ b/core/libs/tests/ExceptionCCleanup.cpp
@@ -1,10 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdio>
 #include <sys/wait.h>
 #include <unistd.h>
 
 extern "C" void CallWithCleanup(void (*function)(), int* count);
 extern "C" void CallAroundCleanup(void (*before)(), void (*within)(), int* count);
-extern "C" void (*_ZSt13set_terminatePFvvE_nid_postfix(void (*)()))();
 
 int cleanups;
 
diff --git a/core/libs/tests/ExceptionRuntime.cpp b/core/libs/tests/ExceptionRuntime.cpp
index 54111f196c..633a2d2005 100644
--- a/core/libs/tests/ExceptionRuntime.cpp
+++ b/core/libs/tests/ExceptionRuntime.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #undef NDEBUG
 #include <cassert>
 #include <cstdio>
@@ -19,28 +20,6 @@
 #ifdef __linux__
 #include <sys/prctl.h>
 #endif
-#include <unwind.h>
-
-extern "C" unsigned __cxa_uncaught_exceptions_nid_postfix();
-extern "C" void* __cxa_current_primary_exception_nid_postfix();
-extern "C" void __cxa_decrement_exception_refcount_nid_postfix(void*);
-extern "C" void __cxa_rethrow_primary_exception_nid_postfix(void*);
-
-extern "C" [[noreturn]] void _ZSt14_Xout_of_rangePKc_nid_postfix(const char*);
-extern "C" [[noreturn]] void _ZSt13_Xrange_errorPKc_nid_postfix(const char*);
-extern "C" [[noreturn]] void _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix();
-extern "C" [[noreturn]] void __cxa_bad_cast_nid_postfix();
-extern "C" [[noreturn]] void _ZSt19_Throw_bad_weak_ptrv_nid_postfix();
-extern "C" [[noreturn]] void _ZSt26__throw_bad_variant_accessv_nid_postfix();
-extern "C" [[noreturn]] void _ZSt26_Throw_bad_optional_accessv_nid_postfix();
-extern "C" [[noreturn]] void _ZNKSt9exception6_RaiseEv_nid_postfix(const void*);
-extern "C" void* __cxa_vec_new3_nid_postfix(std::size_t, std::size_t, std::size_t, void(*)(void*), void(*)(void*), void*(*)(std::size_t), void(*)(void*, std::size_t));
-extern "C" void __cxa_vec_delete3_nid_postfix(void*, std::size_t, std::size_t, void(*)(void*), void(*)(void*, std::size_t));
-extern "C" _Unwind_Reason_Code _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn, void*);
-extern "C" _Unwind_Reason_Code _Unwind_ForcedUnwind_nid_postfix(_Unwind_Exception*, _Unwind_Stop_Fn, void*);
-extern "C" std::uintptr_t _Unwind_GetIP_nid_postfix(_Unwind_Context*);
-extern "C" std::uintptr_t _Unwind_GetGR_nid_postfix(_Unwind_Context*, int);
-extern "C" void (*_ZSt13set_terminatePFvvE_nid_postfix(void(*)()))();
 
 thread_local int destroyed = 0;
 struct Guard {
@@ -61,6 +40,7 @@ struct Virtual : virtual Base {};
 struct Left : Base {};
 struct Right : Base {};
 struct Repeated : Left, Right {};
+struct MixedRepeated : Left, private Right {};
 struct LeftVirtual : virtual Base {};
 struct RightVirtual : virtual Base {};
 struct Diamond : LeftVirtual, RightVirtual {};
@@ -80,6 +60,9 @@ void CheckRtti() {
     try { throw static_cast<Repeated*>(nullptr); }
     catch (Base*) { assert(false); }
     catch (Repeated* p) { assert(p == nullptr); }
+    try { throw MixedRepeated(); }
+    catch (Base&) { assert(false); }
+    catch (MixedRepeated&) {}
     try { throw static_cast<Diamond*>(nullptr); }
     catch (Base* p) { assert(p == nullptr); }
     try { throw nullptr; }
@@ -99,7 +82,7 @@ void CheckForeign() {
         assert(reason == _URC_FOREIGN_EXCEPTION_CAUGHT); ++foreignDeleted; delete p;
     };
     try {
-        try { _Unwind_RaiseException(exception); assert(false); }
+        try { _Unwind_RaiseException_nid_postfix(exception); assert(false); }
         catch (...) { assert(__cxa_current_primary_exception_nid_postfix() == nullptr); throw; }
     } catch (...) {}
     assert(foreignDeleted == 1);
@@ -134,6 +117,7 @@ void CheckArrays() {
     failArray = true;
     try {
         __cxa_vec_new3_nid_postfix(4, sizeof(int), sizeof(std::size_t), ArrayConstruct, ArrayDestroy, std::malloc, ArrayFree);
+
         assert(false);
     } catch (int value) { assert(value == 73); }
     assert(arrayConstructed == 2 && arrayDestroyed == 2 && arrayFreed == 1);
@@ -141,6 +125,7 @@ void CheckArrays() {
     failArray = false;
     void* array = __cxa_vec_new3_nid_postfix(4, sizeof(int), sizeof(std::size_t), ArrayConstruct, ArrayDestroy, std::malloc, ArrayFree);
     __cxa_vec_delete3_nid_postfix(array, sizeof(int), sizeof(std::size_t), ArrayDestroy, ArrayFree);
+
     assert(arrayConstructed == 4 && arrayDestroyed == 4 && arrayFreed == 1);
 }
 void* ThreadTest(void*) {
@@ -226,6 +211,7 @@ int main() {
     try { __cxa_rethrow_primary_exception_nid_postfix(retained); assert(false); }
     catch (int value) { assert(value == 27); }
     __cxa_decrement_exception_refcount_nid_postfix(retained);
+
     {
         auto made = std::make_exception_ptr(Counted());
         try { std::rethrow_exception(made); assert(false); } catch (const Counted&) {}
@@ -248,8 +234,17 @@ int main() {
     catch (const std::range_error&) {}
     bool badFunctionCall = false;
     try { _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix(); }
-    catch (const std::bad_function_call&) { badFunctionCall = true; }
+    catch (const std::bad_function_call&) { std::abort(); }
+    catch (const std::exception& value) {
+        if (std::strcmp(typeid(value).name(), "NSt8__sce_v217bad_function_callE") != 0) std::abort();
+        if (std::strcmp(value.what(), "bad function call") != 0) std::abort();
+        badFunctionCall = true;
+    }
     if (!badFunctionCall) std::abort();
+    bool plainBadFunctionCall = false;
+    try { _ZSt19_Xbad_function_callv_nid_postfix(); }
+    catch (const std::bad_function_call&) { plainBadFunctionCall = true; }
+    if (!plainBadFunctionCall) std::abort();
     try { __cxa_bad_cast_nid_postfix(); }
     catch (const std::exception& value) { assert(value.what() != nullptr); }
     try { _ZSt19_Throw_bad_weak_ptrv_nid_postfix(); std::abort(); }
@@ -260,8 +255,17 @@ int main() {
     catch (const std::bad_optional_access& value) { if (std::strcmp(value.what(), "bad_optional_access") != 0) std::abort(); }
     try { _ZNKSt9exception6_RaiseEv_nid_postfix(nullptr); assert(false); }
     catch (const std::invalid_argument&) {}
-    try { _ZNKSt9exception6_RaiseEv_nid_postfix(&object); assert(false); }
+    LibcException::ExceptionObject exceptionObject {};
+    _ZNSt9exceptionC1Ev_nid_postfix(&exceptionObject);
+    try { _ZNKSt9exception6_RaiseEv_nid_postfix(&exceptionObject); assert(false); }
     catch (const std::exception& value) { assert(std::strcmp(value.what(), "std::exception") == 0); }
+    _ZNSt9exceptionD1Ev_nid_postfix(&exceptionObject);
+    try { _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(nullptr); assert(false); }
+    catch (const std::invalid_argument&) {}
+    _ZNSt8bad_castC1Ev_nid_postfix(&exceptionObject);
+    try { _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(&exceptionObject); assert(false); }
+    catch (const std::bad_cast&) {}
+    _ZNSt8bad_castD1Ev_nid_postfix(&exceptionObject);
     CheckRtti();
     CheckForeign();
     CheckStaticInitialization();
diff --git a/core/libs/tests/Fiber.cpp b/core/libs/tests/Fiber.cpp
index 2267ee2497..b66f020ff5 100644
--- a/core/libs/tests/Fiber.cpp
+++ b/core/libs/tests/Fiber.cpp
@@ -1,9 +1,11 @@
+#include "prx/libSceFiber/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <string_view>
 #include <thread>
 #include <xmmintrin.h>
 #ifdef _WIN32
@@ -12,20 +14,6 @@
 
 using Entry = void (APS5_VABI*)(std::uint64_t, std::uint64_t);
 
-extern "C" {
-std::int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject*, const char*, Entry, std::uint64_t, void*, std::uint64_t, const void*, std::uint32_t);
-std::int32_t APS5_VABI sceFiberFinalize(FiberObject*);
-std::int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject*, std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberSwitch(FiberObject*, std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberReturnToThread(std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberGetSelf(FiberObject**);
-std::int32_t APS5_VABI sceFiberGetInfo(FiberObject*, FiberInfo*);
-std::int32_t APS5_VABI sceFiberGetThreadFramePointerAddress(std::uint64_t*);
-std::int32_t APS5_VABI _sceFiberGetThreadFramePointerAddress(std::uint64_t*);
-std::int32_t APS5_VABI sceFiberStartContextSizeCheck(std::uint32_t);
-std::int32_t APS5_VABI sceFiberStopContextSizeCheck(void);
-}
-
 static void Require(bool value, const char* what) {
     if (!value) { std::fprintf(stderr, "Fiber check failed: %s\n", what); std::abort(); }
 }
@@ -33,6 +21,8 @@ static void Require(bool value, const char* what) {
 namespace {
 
 constexpr std::int32_t FiberErrorNull = static_cast<std::int32_t>(0x80590001);
+constexpr std::int32_t FiberErrorAlignment = static_cast<std::int32_t>(0x80590002);
+constexpr std::int32_t FiberErrorRange = static_cast<std::int32_t>(0x80590003);
 constexpr std::int32_t FiberErrorInvalid = static_cast<std::int32_t>(0x80590004);
 constexpr std::int32_t FiberErrorPermission = static_cast<std::int32_t>(0x80590005);
 constexpr std::int32_t FiberErrorState = static_cast<std::int32_t>(0x80590006);
@@ -225,6 +215,7 @@ void APS5_VABI LargeContextEntry(std::uint64_t, std::uint64_t) {
     const auto* address = const_cast<const unsigned char*>(&local);
     g_largeOnContext = address >= g_largeContext.data() && address < g_largeContext.data() + g_largeContext.size();
     sceFiberReturnToThread(0, nullptr);
+
 }
 
 void RunOnLargeContext() {
@@ -235,6 +226,280 @@ void RunOnLargeContext() {
     Require(sceFiberFinalize(fiber) == 0, "finalize large fiber");
 }
 
+alignas(16) std::array<unsigned char, 64 * 1024> g_attachedContext;
+alignas(16) std::array<unsigned char, 4 * 1024> g_attachedSmallContext;
+FiberStorage g_attachedStorage;
+FiberStorage g_attachedTargetStorage;
+auto* const g_attached = reinterpret_cast<FiberObject*>(&g_attachedStorage);
+auto* const g_attachedTarget = reinterpret_cast<FiberObject*>(&g_attachedTargetStorage);
+
+void APS5_VABI AttachedTargetEntry(std::uint64_t argOnInitialize, std::uint64_t argOnRun) {
+    Require(argOnInitialize == 44 && argOnRun == 500, "attached switch target arguments");
+    CheckActiveContext(g_attachedTarget, g_attachedSmallContext.size());
+    std::uint64_t received = 0;
+    Require(sceFiberSwitch(g_attached, 600, &received) == 0, "switch back from the attached target");
+    Require(false, "attached switch target resumed after its last switch");
+}
+
+void APS5_VABI AttachedEntry(std::uint64_t argOnInitialize, std::uint64_t argOnRun) {
+    Require(argOnInitialize == 33 && argOnRun == 400, "attached fiber arguments");
+    FiberObject* self = nullptr;
+    Require(sceFiberGetSelf(&self) == 0 && self == g_attached, "attached fiber self");
+    CheckActiveContext(g_attached, g_attachedContext.size());
+    Require(_sceFiberAttachContextAndRun(g_attachedTarget, g_attachedSmallContext.data(), g_attachedSmallContext.size(), 0, nullptr) == FiberErrorPermission, "attach and run inside a fiber");
+    std::uint64_t received = 0;
+    Require(_sceFiberAttachContextAndSwitch(g_attached, g_attachedContext.data(), g_attachedContext.size(), 0, nullptr) == FiberErrorState, "attach and switch to self");
+    Require(_sceFiberAttachContextAndSwitch(g_attachedTarget, g_attachedSmallContext.data() + 8, g_attachedSmallContext.size() - 16, 500, nullptr) == FiberErrorAlignment, "attach and switch with a misaligned context");
+    Require(_sceFiberAttachContextAndSwitch(g_attachedTarget, g_attachedSmallContext.data(), g_attachedSmallContext.size(), 500, &received) == 0 && received == 600, "attach and switch");
+    Require(sceFiberReturnToThread(700, &received) == 0 && received == 800, "attached fiber resumed");
+    for (;;) sceFiberReturnToThread(received + 1, &received);
+}
+
+void APS5_VABI DefaultFpuEntry(std::uint64_t, std::uint64_t) {
+    std::uint16_t control = 0;
+    asm volatile("fnstcw %0" : "=m"(control));
+    std::uint64_t received = 0;
+    for (;;) sceFiberReturnToThread((static_cast<std::uint64_t>(control) << 32) | _mm_getcsr(), &received);
+}
+
+void RunAttachedContext() {
+    Require(_sceFiberInitializeImpl_nid_postfix(g_attached, "attached", AttachedEntry, 33, nullptr, 0, nullptr, 0) == 0, "initialize without a context");
+    Require(_sceFiberInitializeImpl_nid_postfix(g_attachedTarget, "attached target", AttachedTargetEntry, 44, nullptr, 0, nullptr, 0) == 0, "initialize switch target without a context");
+    FiberInfo info{};
+    info.size = sizeof(info);
+    Require(sceFiberGetInfo(g_attached, &info) == 0 && info.addr_context == nullptr && info.size_context == 0, "fiber without a context reports none");
+    Require(_sceFiberAttachContextAndRun(nullptr, g_attachedContext.data(), g_attachedContext.size(), 0, nullptr) == FiberErrorNull, "attach and run a null fiber");
+    Require(_sceFiberAttachContextAndRun(g_attached, nullptr, g_attachedContext.size(), 0, nullptr) == FiberErrorInvalid, "attach a null context with a size");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), 0, 0, nullptr) == FiberErrorRange, "attach a context without a size");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), 256, 0, nullptr) == FiberErrorRange, "attach a context below the minimum size");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), 1000, 0, nullptr) == FiberErrorAlignment, "attach a context of an unaligned size");
+    Require(_sceFiberAttachContextAndSwitch(g_attached, g_attachedContext.data(), g_attachedContext.size(), 0, nullptr) == FiberErrorPermission, "attach and switch outside a fiber");
+    std::uint64_t returned = 0;
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), g_attachedContext.size(), 400, &returned) == 0 && returned == 700, "attach and run");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), g_attachedContext.size(), 800, &returned) == FiberErrorInvalid, "attach to a fiber that has a context");
+    Require(_sceFiberAttachContextAndRun(g_attached, nullptr, 0, 800, &returned) == 0 && returned == 801, "run an attached fiber without a new context");
+    Require(sceFiberRun_nid_postfix(g_attached, 802, &returned) == 0 && returned == 803, "run an attached fiber");
+    Require(sceFiberFinalize(g_attachedTarget) == 0, "finalize a suspended attached target");
+    Require(sceFiberFinalize(g_attached) == 0, "finalize attached fiber");
+    Require(_sceFiberInitializeImpl_nid_postfix(g_attachedTarget, "attached target", AttachedTargetEntry, 44, nullptr, 0, nullptr, 0) == 0, "reinitialize attached target");
+    Require(sceFiberFinalize(g_attachedTarget) == 0, "finalize fiber without a context");
+}
+
+void RunInternalOptions() {
+    auto* fiber = reinterpret_cast<FiberObject*>(&g_checkedStorage);
+    Require(_sceFiberInitializeWithInternalOptionImpl(nullptr, "options", CheckedEntry, 0, g_checkedContext.data(), g_checkedContext.size(), nullptr, 0, 0) == FiberErrorNull, "internal option null fiber");
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "options", CheckedEntry, 0, g_checkedContext.data(), 256, nullptr, 0, 0) == FiberErrorRange, "internal option small context");
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "options", CheckedEntry, 0, g_checkedContext.data(), g_checkedContext.size(), nullptr, 0x1, 0) == 0, "internal option without object registration");
+    FiberInfo info{};
+    info.size = sizeof(info);
+    Require(sceFiberGetInfo(fiber, &info) == 0 && info.size_context_margin == ~0ull, "no margin without the size check flag");
+    Require(sceFiberFinalize(fiber) == 0, "finalize internal option fiber");
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "options", CheckedEntry, 0, g_checkedContext.data(), g_checkedContext.size(), nullptr, 0x10, 0) == 0, "internal option size check");
+    Require(sceFiberGetInfo(fiber, &info) == 0 && info.size_context_margin == g_checkedContext.size(), "size check flag fills the context");
+    Require(sceFiberRun_nid_postfix(fiber, 0, nullptr) == 0, "run size checked fiber");
+    Require(sceFiberGetInfo(fiber, &info) == 0 && info.size_context_margin < g_checkedContext.size() - 4096, "size check flag measures the margin");
+    Require(sceFiberFinalize(fiber) == 0, "finalize size checked fiber");
+
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "fpu", DefaultFpuEntry, 0, nullptr, 0, nullptr, 0x100, 0) == 0, "internal option fpu defaults without a context");
+    const auto threadCsr = _mm_getcsr();
+    _mm_setcsr((threadCsr & ~0x8040u) | 0x6000u);
+    std::uint64_t returned = 0;
+    Require(_sceFiberAttachContextAndRun(fiber, g_checkedContext.data(), g_checkedContext.size(), 0, &returned) == 0, "run fpu defaults fiber");
+    _mm_setcsr(threadCsr);
+    Require((returned & 0xffffffffu) == 0x9fc0u, "fpu defaults flag starts with the default MXCSR");
+    Require((returned >> 32) == 0x037fu, "fpu defaults flag starts with the default x87 control word");
+    Require(sceFiberFinalize(fiber) == 0, "finalize fpu defaults fiber");
+}
+
+std::array<FiberStorage, 2> g_contextlessStorage;
+std::array<unsigned, 2> g_contextlessEntries{};
+alignas(16) std::array<unsigned char, 65536> g_transitionContext;
+FiberStorage g_transitionStorage;
+auto* const g_transition = reinterpret_cast<FiberObject*>(&g_transitionStorage);
+std::uintptr_t g_callerStack = 0;
+std::uint64_t g_contextlessFramePointer = 0;
+unsigned g_contextlessHops = 0;
+#ifdef _WIN32
+void* g_callerBase = nullptr;
+void* g_callerLimit = nullptr;
+#endif
+
+FiberObject* Contextless(unsigned index) {
+    return reinterpret_cast<FiberObject*>(&g_contextlessStorage[index]);
+}
+
+void APS5_VABI ContextlessEntry(std::uint64_t index, std::uint64_t run) {
+    ++g_contextlessEntries[index];
+    auto* self = Contextless(index);
+    FiberObject* current = nullptr;
+    Require(sceFiberGetSelf(&current) == 0 && current == self, "contextless entry self");
+    FiberInfo info{};
+    info.size = sizeof(info);
+    Require(sceFiberGetInfo(self, &info) == 0, "contextless entry info");
+    if (info.addr_context) {
+        Require(run == 90, "attaching after contextless execution restarts entry");
+        for (;;) sceFiberReturnToThread(run + 1, &run);
+    }
+    Require(info.size_context == 0 && info.size_context_margin == ~0ull, "contextless info has no stack or margin");
+    std::uint64_t framePointer = 0;
+    Require(sceFiberGetThreadFramePointerAddress(&framePointer) == 0 && framePointer == g_contextlessFramePointer, "contextless entry preserves the caller frame pointer");
+    Require(sceFiberRun_nid_postfix(self, 0, nullptr) == FiberErrorPermission, "contextless entry cannot run a fiber");
+    Require(sceFiberSwitch(self, 0, nullptr) == FiberErrorState, "contextless entry cannot switch to itself");
+    Require(sceFiberFinalize(self) == FiberErrorState, "contextless entry cannot finalize itself");
+    volatile std::uint64_t marker = 0;
+    const auto address = reinterpret_cast<std::uintptr_t>(&marker);
+    Require(address < g_callerStack && g_callerStack - address < 32768, "contextless execution uses calling thread stack");
+    _mm_setcsr(_mm_getcsr() ^ 0x8000u);
+#ifdef _WIN32
+    const auto* tib = reinterpret_cast<const NT_TIB*>(NtCurrentTeb());
+    Require(tib->StackBase == g_callerBase && tib->StackLimit == g_callerLimit, "contextless execution restores thread stack bounds");
+#endif
+    if (run == 2) {
+        sceFiberSwitch(Contextless(1), 1, nullptr);
+    } else if (run == 3) {
+        _sceFiberAttachContextAndSwitch(g_transition, g_transitionContext.data(), g_transitionContext.size(), 50, nullptr);
+    } else if (run == 4) {
+        sceFiberSwitch(g_transition, 70, nullptr);
+    } else if (run == 5) {
+        if (++g_contextlessHops < 1024) sceFiberSwitch(Contextless(1 - index), 5, nullptr);
+        sceFiberReturnToThread(999, nullptr);
+    } else {
+        Require(run == 1, "contextless run argument");
+        sceFiberReturnToThread(200 + index, nullptr);
+    }
+    Require(false, "contextless fiber must restart rather than resume after yielding");
+}
+
+void APS5_VABI TransitionEntry(std::uint64_t, std::uint64_t run) {
+    Require(run == 50, "contextless source attaches target");
+    Require(sceFiberReturnToThread(777, &run) == 0 && run == 55, "attached target resumes after contextless source");
+    Require(_sceFiberAttachContextAndSwitch(Contextless(1), nullptr, 0, 1, &run) == 0 && run == 60, "attached source resumes after contextless target");
+    Require(sceFiberSwitch(Contextless(0), 4, &run) == 0 && run == 70, "contextless target switches back to suspended attached source");
+    for (;;) sceFiberReturnToThread(778, nullptr);
+}
+
+[[gnu::noinline]] std::int32_t RunContextless(FiberObject* fiber, std::uint64_t run, std::uint64_t* returned, bool attach = false) {
+    register std::uint64_t savedRbx asm("rbx") = 0x123456789abcdef0ull;
+    register std::uint64_t savedR12 asm("r12") = 0x23456789abcdef01ull;
+    register std::uint64_t savedR13 asm("r13") = 0x3456789abcdef012ull;
+    register std::uint64_t savedR14 asm("r14") = 0x456789abcdef0123ull;
+    register std::uint64_t savedR15 asm("r15") = 0x56789abcdef01234ull;
+    asm volatile("" : "+r"(savedRbx), "+r"(savedR12), "+r"(savedR13), "+r"(savedR14), "+r"(savedR15));
+    g_contextlessFramePointer = reinterpret_cast<std::uint64_t>(__builtin_frame_address(0));
+    const auto result = attach ? _sceFiberAttachContextAndRun(fiber, nullptr, 0, run, returned) : sceFiberRun_nid_postfix(fiber, run, returned);
+    asm volatile("" : "+r"(savedRbx), "+r"(savedR12), "+r"(savedR13), "+r"(savedR14), "+r"(savedR15) : : "memory");
+    Require(savedRbx == 0x123456789abcdef0ull && savedR12 == 0x23456789abcdef01ull && savedR13 == 0x3456789abcdef012ull && savedR14 == 0x456789abcdef0123ull && savedR15 == 0x56789abcdef01234ull, "contextless return restores caller nonvolatile registers");
+    return result;
+}
+
+void RunContextlessTransitions() {
+    volatile std::uint64_t marker = 0;
+    g_callerStack = reinterpret_cast<std::uintptr_t>(&marker);
+#ifdef _WIN32
+    const auto* tib = reinterpret_cast<const NT_TIB*>(NtCurrentTeb());
+    g_callerBase = tib->StackBase;
+    g_callerLimit = tib->StackLimit;
+#endif
+    for (unsigned index = 0; index < 2; ++index) {
+        Require(_sceFiberInitializeWithInternalOptionImpl(Contextless(index), "contextless", ContextlessEntry, index, nullptr, 0, nullptr, 0x10, 0) == 0, "initialize contextless transition fiber with size checking");
+    }
+    Require(_sceFiberInitializeImpl_nid_postfix(g_transition, "transition", TransitionEntry, 0, nullptr, 0, nullptr, 0) == 0, "initialize transition target");
+    std::uint64_t returned = 0;
+    const auto csr = _mm_getcsr();
+    Require(RunContextless(Contextless(0), 1, &returned) == 0 && returned == 200, "first contextless run");
+    Require(_mm_getcsr() == csr, "contextless return restores thread MXCSR");
+    Require(RunContextless(Contextless(0), 1, &returned) == 0 && returned == 200 && g_contextlessEntries[0] == 2, "contextless return discards continuation");
+    Require(RunContextless(Contextless(0), 2, &returned, true) == 0 && returned == 201, "contextless to contextless switch");
+    Require(RunContextless(Contextless(1), 1, &returned) == 0 && returned == 201 && g_contextlessEntries[1] == 2, "contextless switch target restarts");
+    Require(RunContextless(Contextless(0), 3, &returned) == 0 && returned == 777, "contextless to attached switch");
+    Require(RunContextless(g_transition, 55, &returned) == 0 && returned == 201, "attached to contextless switch");
+    Require(RunContextless(g_transition, 60, &returned) == 0 && returned == 778, "switch through contextless entry back to attached fiber");
+    Require(_sceFiberAttachContextAndRun(Contextless(0), g_firstContext.data(), g_firstContext.size(), 90, &returned) == 0 && returned == 91, "attach after abandoning contextless stack");
+    Require(sceFiberRun_nid_postfix(Contextless(0), 100, &returned) == 0 && returned == 101 && g_contextlessEntries[0] == 6, "attached continuation persists after contextless runs");
+    std::thread([&] {
+        volatile std::uint64_t workerMarker = 0;
+        g_callerStack = reinterpret_cast<std::uintptr_t>(&workerMarker);
+#ifdef _WIN32
+        const auto* workerTib = reinterpret_cast<const NT_TIB*>(NtCurrentTeb());
+        g_callerBase = workerTib->StackBase;
+        g_callerLimit = workerTib->StackLimit;
+#endif
+        Require(RunContextless(Contextless(1), 1, &returned) == 0 && returned == 201 && g_contextlessEntries[1] == 4, "contextless fiber restarts on another thread's stack");
+    }).join();
+    Require(sceFiberFinalize(Contextless(0)) == 0 && sceFiberFinalize(Contextless(1)) == 0 && sceFiberFinalize(g_transition) == 0, "finalize contextless transition fibers");
+    g_callerStack = reinterpret_cast<std::uintptr_t>(&marker);
+#ifdef _WIN32
+    g_callerBase = tib->StackBase;
+    g_callerLimit = tib->StackLimit;
+#endif
+    for (unsigned index = 0; index < 2; ++index) {
+        Require(_sceFiberInitializeImpl_nid_postfix(Contextless(index), "restart loop", ContextlessEntry, index, nullptr, 0, nullptr, 0) == 0, "initialize contextless restart loop");
+    }
+    Require(RunContextless(Contextless(0), 5, &returned) == 0 && returned == 999 && g_contextlessHops == 1024, "contextless switch loop reuses the caller stack");
+    Require(RunContextless(Contextless(1), 1, nullptr, true) == 0, "contextless run permits a null return output");
+    Require(sceFiberFinalize(Contextless(0)) == 0 && sceFiberFinalize(Contextless(1)) == 0, "finalize contextless restart loop");
+}
+
+std::uint16_t ReadFpuControl() {
+    std::uint16_t control = 0;
+    asm volatile("fnstcw %0" : "=m"(control));
+    return control;
+}
+
+void WriteFpuControl(std::uint16_t control) {
+    asm volatile("fldcw %0" : : "m"(control));
+}
+
+constexpr std::uint64_t ContextlessInitializeArgument = 0xfedcba9876543210ull;
+constexpr std::uint64_t ContextlessRunArgument = 0x8123456789abcdefull;
+constexpr std::uint32_t ContextlessCsr = 0x7f80;
+constexpr std::uint16_t ContextlessControl = 0x0b7f;
+unsigned g_contextlessOptionEntries = 0;
+
+void APS5_VABI ContextlessOptionsEntry(std::uint64_t initialized, std::uint64_t run) {
+    Require(initialized == ContextlessInitializeArgument && run == ContextlessRunArgument, "contextless entry keeps 64-bit arguments");
+    ++g_contextlessOptionEntries;
+    const auto result = (static_cast<std::uint64_t>(ReadFpuControl()) << 32) | _mm_getcsr();
+    _mm_setcsr(0x1f80);
+    WriteFpuControl(0x037f);
+    sceFiberReturnToThread(result, nullptr);
+    Require(false, "contextless options entry cannot resume after returning");
+}
+
+void APS5_VABI ContextlessFpuSource(std::uint64_t, std::uint64_t target) {
+    _mm_setcsr(ContextlessCsr);
+    WriteFpuControl(ContextlessControl);
+    sceFiberSwitch(reinterpret_cast<FiberObject*>(target), ContextlessRunArgument, nullptr);
+    Require(false, "contextless FPU source is not resumed");
+}
+
+void RunContextlessOptions() {
+    FiberStorage storage{};
+    FiberStorage sourceStorage{};
+    auto* fiber = reinterpret_cast<FiberObject*>(&storage);
+    auto* source = reinterpret_cast<FiberObject*>(&sourceStorage);
+    const auto callerCsr = _mm_getcsr();
+    const auto callerControl = ReadFpuControl();
+    for (const auto flags : {0u, 0x100u}) {
+        Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "contextless options", ContextlessOptionsEntry, ContextlessInitializeArgument, nullptr, 0, nullptr, flags, 0) == 0, "initialize contextless FPU options");
+        _mm_setcsr(ContextlessCsr);
+        WriteFpuControl(ContextlessControl);
+        const auto expected = flags ? (0x037full << 32) | 0x9fc0u : (static_cast<std::uint64_t>(ContextlessControl) << 32) | ContextlessCsr;
+        std::uint64_t returned = 0;
+        for (unsigned restart = 0; restart < 2; ++restart) {
+            Require(sceFiberRun_nid_postfix(fiber, ContextlessRunArgument, &returned) == 0 && returned == expected, "contextless FPU policy applies on each run");
+            Require(_mm_getcsr() == ContextlessCsr && ReadFpuControl() == ContextlessControl, "contextless return restores caller FPU registers");
+        }
+        _mm_setcsr(callerCsr);
+        WriteFpuControl(callerControl);
+        Require(_sceFiberInitializeImpl_nid_postfix(source, "FPU source", ContextlessFpuSource, 0, g_transitionContext.data(), g_transitionContext.size(), nullptr, 0) == 0, "initialize attached FPU source");
+        Require(sceFiberRun_nid_postfix(source, reinterpret_cast<std::uint64_t>(fiber), &returned) == 0 && returned == expected, "contextless switch inherits or resets the source FPU registers");
+        Require(_mm_getcsr() == callerCsr && ReadFpuControl() == callerControl, "contextless switch restores the original caller FPU registers");
+        Require(sceFiberFinalize(fiber) == 0 && sceFiberFinalize(source) == 0, "finalize contextless FPU options");
+    }
+    Require(g_contextlessOptionEntries == 6, "contextless FPU entry restarts on runs and switches");
+}
+
 [[gnu::noinline]] std::int32_t RunFirst(std::uint64_t* returned) {
     g_threadFramePointer = reinterpret_cast<std::uint64_t>(__builtin_frame_address(0));
     const std::int32_t result = sceFiberRun_nid_postfix(g_first, 100, returned);
@@ -244,7 +509,13 @@ void RunOnLargeContext() {
 
 }
 
-int main() {
+int main(int argc, char** argv) {
+    if (argc == 2 && std::string_view(argv[1]) == "--contextless") {
+        RunContextlessTransitions();
+        RunContextlessOptions();
+        return 0;
+    }
+    Require(argc == 1, "known test arguments");
     RunSmallContextFirst();
     FiberObject* self = nullptr;
     Require(sceFiberGetSelf(&self) == FiberErrorPermission, "no fiber on the thread");
@@ -285,4 +556,6 @@ int main() {
     RunHostCallOnSmallContext();
     RunFrameChain();
     RunOnLargeContext();
+    RunAttachedContext();
+    RunInternalOptions();
 }
diff --git a/core/libs/tests/FilePosition.cpp b/core/libs/tests/FilePosition.cpp
index 0337c58932..9bd695cc15 100644
--- a/core/libs/tests/FilePosition.cpp
+++ b/core/libs/tests/FilePosition.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
@@ -12,12 +13,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI fgetpos_nid_postfix(FileStream*, std::int64_t*);
-int APS5_VABI fsetpos_nid_postfix(FileStream*, const std::int64_t*);
-std::int64_t APS5_VABI ftello_nid_postfix(FileStream*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "File position check failed at line %d\n", line);
diff --git a/core/libs/tests/FileStreams.cpp b/core/libs/tests/FileStreams.cpp
index 2e11f4dfb2..fc8af8e721 100644
--- a/core/libs/tests/FileStreams.cpp
+++ b/core/libs/tests/FileStreams.cpp
@@ -1,8 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <barrier>
 #include <cerrno>
+#include <cstdarg>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -22,29 +24,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-FileStream* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
-FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char*, int, int);
-FileStream* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode, FileStream* stream);
-int APS5_VABI fclose_nid_postfix(FileStream* stream);
-std::size_t APS5_VABI fread_nid_postfix(void* buffer, std::size_t size, std::size_t count, FileStream* stream);
-std::size_t APS5_VABI fwrite_nid_postfix(const void* buffer, std::size_t size, std::size_t count, FileStream* stream);
-int APS5_VABI fseek_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream* stream);
-int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
-int APS5_VABI fflush_nid_postfix(FileStream* stream);
-int APS5_VABI remove_nid_postfix(const char* path);
-int APS5_VABI rename_nid_postfix(const char* from, const char* to);
-int APS5_VABI ferror_nid_postfix(FileStream* stream);
-int APS5_VABI feof_nid_postfix(FileStream* stream);
-void APS5_VABI clearerr_nid_postfix(FileStream* stream);
-int APS5_VABI fgetc_nid_postfix(FileStream* stream);
-int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream);
-char* APS5_VABI fgets_nid_postfix(char* buffer, int size, FileStream* stream);
-int APS5_VABI ungetc_nid_postfix(int value, FileStream* stream);
-int APS5_VABI fscanf_nid_postfix(FileStream* stream, const char* format, ...);
-}
-
 static void Require(bool condition, const char* message = "File stream check failed") {
     if (!condition) throw std::runtime_error(message);
 }
@@ -124,6 +103,23 @@ static void CheckExclusiveCppOpen(const std::string& base) {
     }
 }
 
+static int APS5_VABI ScanList(FileStream* stream, const char* format, ...) {
+#ifdef _WIN32
+    __builtin_sysv_va_list args;
+    __builtin_sysv_va_start(args, format);
+#else
+    std::va_list args;
+    va_start(args, format);
+#endif
+    const int result = vfscanf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+#ifdef _WIN32
+    __builtin_sysv_va_end(args);
+#else
+    va_end(args);
+#endif
+    return result;
+}
+
 static std::string ReadWhole(const std::string& path) {
     auto* stream = fopen_nid_postfix(path.c_str(), "rb");
     Require(stream != nullptr);
@@ -180,6 +176,11 @@ static void CheckUpdateStreamReadsAfterWrites(const std::string& base) {
         Require(fscanf_nid_postfix(stream, "%3s", buffer.data()) == 1, "fscanf after fwrite on an r+ stream");
         Require(std::strcmp(buffer.data(), "234") == 0, "fscanf after fwrite on an r+ stream read other bytes");
     });
+    CheckReadAfterWrite(path, "r+b", overwritten, [](FileStream* stream) {
+        std::array<char, 4> buffer{};
+        Require(ScanList(stream, "%3s", buffer.data()) == 1, "vfscanf after fwrite on an r+ stream");
+        Require(std::strcmp(buffer.data(), "234") == 0, "vfscanf after fwrite on an r+ stream read other bytes");
+    });
     CheckReadAfterWrite(path, "w+b", "AB", [](FileStream* stream) {
         std::array<char, 4> buffer{};
         Require(fread_nid_postfix(buffer.data(), 1, buffer.size(), stream) == 0 && feof_nid_postfix(stream) != 0, "fread after fwrite on a w+ stream");
diff --git a/core/libs/tests/Formatting.cpp b/core/libs/tests/Formatting.cpp
index 937f348f17..ad74c98f20 100644
--- a/core/libs/tests/Formatting.cpp
+++ b/core/libs/tests/Formatting.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
@@ -11,23 +12,13 @@
 #include <stdexcept>
 #include <cstdint>
 #include <cstdio>
+#include <cstdarg>
 
-extern "C" {
-int APS5_VABI snprintf_nid_postfix(char*, size_t, const char*, ...);
-int APS5_VABI sprintf_nid_postfix(char*, const char*, ...);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI libc_printf_nid_postfix(const char*, ...);
-int APS5_VABI sscanf_nid_postfix(const char*, const char*, ...);
-int APS5_VABI vsnprintf_nid_postfix(char*, size_t, const char*, VaList*);
-int APS5_VABI vsnprintf_s_nid_postfix(char*, size_t, const char*, VaList*);
-int APS5_VABI snprintf_s_nid_postfix(char*, size_t, const char*, ...);
-int APS5_VABI vsscanf_s_nid_postfix(const char*, const char*, VaList*);
-int APS5_VABI vsscanf_nid_postfix(const char*, const char*, VaList*);
-int APS5_VABI vprintf_nid_postfix(const char*, VaList*);
-int APS5_VABI asprintf_nid_postfix(char**, const char*, ...);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
+#if defined(__clang__) && !defined(_WIN32)
+#define __builtin_sysv_va_list va_list
+#define __builtin_sysv_va_start va_start
+#define __builtin_sysv_va_end va_end
+#endif
 
 static void Require(bool condition) {
     if (!condition) throw std::runtime_error("Formatting check failed");
@@ -96,8 +87,8 @@ static void CheckSizeLimits() {
                 *__error_nid_postfix() = 0;
                 const int result = wide ? format(output, oversized, "%ls%n", u"x", &consumed)
                                         : format(output, oversized, "x%n", &consumed);
-                Require(result == -1 && *__error_nid_postfix() == 84 && output[0] == 0 && consumed == -1);
-                Require(std::all_of(output + 1, output + sizeof(output), [](char value) { return value == 'Z'; }));
+                Require(result == 1 && *__error_nid_postfix() == 0 && std::strcmp(output, "x") == 0 && consumed == 1);
+                Require(std::all_of(output + 2, output + sizeof(output), [](char value) { return value == 'Z'; }));
             }
         }
         for (const std::size_t capacity : {std::size_t{0}, std::size_t{1}, static_cast<std::size_t>(INT_MAX), static_cast<std::size_t>(INT_MAX) + 1}) {
@@ -116,8 +107,8 @@ static void CheckSizeLimits() {
 static bool CheckWidePrecision() {
     const char16_t input[] = u"A\u00e9\u20ac\U0001f600Z";
     const char* expected[] = {"", "A", "A", "A\xc3\xa9", "A\xc3\xa9", "A\xc3\xa9", "A\xc3\xa9\xe2\x82\xac",
-        "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac",
-        "A\xc3\xa9\xe2\x82\xac\xf0\x9f\x98\x80", "A\xc3\xa9\xe2\x82\xac\xf0\x9f\x98\x80Z"};
+        "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac\xed\xa0\xbd",
+        "A\xc3\xa9\xe2\x82\xac\xed\xa0\xbd", "A\xc3\xa9\xe2\x82\xac\xed\xa0\xbd"};
     bool correct = true;
     for (int precision = 0; precision < 12; ++precision) {
         char output[32];
@@ -132,7 +123,8 @@ static bool CheckWidePrecision() {
     char output[32];
     Require(snprintf_nid_postfix(output, sizeof(output), "[%5.1ls]", u"\u00e9") == 7 && std::strcmp(output, "[     ]") == 0);
     Require(snprintf_nid_postfix(output, sizeof(output), "[%-5.2ls]", u"\u00e9") == 7 && std::strcmp(output, "[\xc3\xa9   ]") == 0);
-    Require(FormatList(output, sizeof(output), "%.3ls", u"\U0001f600") == 0 && output[0] == 0);
+    Require(FormatList(output, sizeof(output), "%.3ls", u"\U0001f600") == 3 && std::strcmp(output, "\xed\xa0\xbd") == 0);
+    Require(FormatList(output, sizeof(output), "%ls", u"\U0001f600") == 6 && std::strcmp(output, "\xed\xa0\xbd\xed\xb8\x80") == 0);
     Require(FormatList(output, sizeof(output), "%ls[% u][% 4u][%+ lu][%- 3hhu][% x][%+o]", u"", 5u, 5u, 5ULL, 5u, 255u, 8u) == 25
         && std::strcmp(output, "[5][   5][5][5  ][ff][10]") == 0);
     Require(FormatList(output, sizeof(output), "%.*ls:%d", -1, u"\u00e9", 7) == 4 && std::strcmp(output, "\xc3\xa9:7") == 0);
@@ -145,10 +137,11 @@ static bool CheckWidePrecision() {
     Require(snprintf_nid_postfix(output, sizeof(output), "[%ls]", static_cast<const char16_t*>(nullptr)) == 8 && std::strcmp(output, "[(null)]") == 0);
     Require(snprintf_nid_postfix(output, sizeof(output), "a%lcb%C", 0, 0) == 4 && std::memcmp(output, "a\0b\0", 5) == 0);
     Require(FormatList(output, sizeof(output), "%%ls:%2$d:%1$d", 3, 7) == 7 && std::strcmp(output, "%ls:7:3") == 0);
-    Require(FormatList(output, sizeof(output), "%ls[%f][%+f][% F][%5.1e]", u"", -NAN, -NAN, NAN, -NAN) == 22
-        && std::strcmp(output, "[nan][nan][NAN][  nan]") == 0);
-    Require(FormatList(output, sizeof(output), "%ls[%-6g][%06a][%LG][%+f]", u"", NAN, -NAN, -static_cast<long double>(NAN), -INFINITY) == 27
-        && std::strcmp(output, "[nan   ][   nan][NAN][-inf]") == 0);
+    Require(FormatList(output, sizeof(output), "%ls[%f][%+f][% F][%5.1e]", u"", -NAN, -NAN, NAN, -NAN) == 25
+        && std::strcmp(output, "[-nan][-nan][ NAN][ -nan]") == 0);
+    Require(FormatList(output, sizeof(output), "%ls[%-6g][%06a][%LG][%+f]", u"", NAN, -NAN, -static_cast<long double>(NAN), -INFINITY) == 28
+        && std::strcmp(output, "[nan   ][  -nan][-NAN][-inf]") == 0);
+    Require(FormatList(output, sizeof(output), "%ls[%+f][%8.3f|]", u"", NAN, -NAN) == 17 && std::strcmp(output, "[+nan][    -nan|]") == 0);
     for (std::size_t capacity = 0; capacity <= 6; ++capacity) {
         std::memset(output, '!', sizeof(output));
         int count = -1;
@@ -160,6 +153,53 @@ static bool CheckWidePrecision() {
     return correct;
 }
 
+static void CheckIntegerScanWidths() {
+    int value = 7;
+    *__error_nid_postfix() = 0;
+    Require(sscanf_nid_postfix("2147483648", "%d", &value) == 1 && value == -2147483647 - 1 && *__error_nid_postfix() == 0);
+    Require(sscanf_nid_postfix("0xFFFFFFFF", "%i", &value) == 1 && value == -1 && *__error_nid_postfix() == 0);
+    Require(sscanf_nid_postfix("99999999999999999999", "%d", &value) == 1 && value == -1 && *__error_nid_postfix() == 34);
+    unsigned unsignedValue = 7;
+    Require(sscanf_nid_postfix("4294967296", "%u", &unsignedValue) == 1 && unsignedValue == 0);
+    Require(sscanf_nid_postfix("100000001", "%x", &unsignedValue) == 1 && unsignedValue == 1);
+    Require(sscanf_nid_postfix("40000000001", "%o", &unsignedValue) == 1 && unsignedValue == 1);
+    short shortValue = 7;
+    Require(sscanf_nid_postfix("5000000000", "%hd", &shortValue) == 1 && shortValue == -3584);
+    signed char charValue = 7;
+    Require(sscanf_nid_postfix("300", "%hhd", &charValue) == 1 && charValue == 44);
+    Require(sscanf_nid_postfix("4294967295", "%u", &unsignedValue) == 1 && unsignedValue == 4294967295u);
+    unsigned short unsignedShort = 7;
+    Require(sscanf_nid_postfix("40000", "%hu", &unsignedShort) == 1 && unsignedShort == 40000);
+    Require(sscanf_nid_postfix("70000", "%hu", &unsignedShort) == 1 && unsignedShort == 4464);
+    Require(sscanf_nid_postfix("ffff", "%hx", &unsignedShort) == 1 && unsignedShort == 0xffff);
+    unsigned char unsignedChar = 7;
+    Require(sscanf_nid_postfix("200", "%hhu", &unsignedChar) == 1 && unsignedChar == 200);
+    Require(sscanf_nid_postfix("300", "%hhu", &unsignedChar) == 1 && unsignedChar == 44);
+    Require(sscanf_nid_postfix("377", "%hho", &unsignedChar) == 1 && unsignedChar == 255);
+    *__error_nid_postfix() = 0;
+    Require(sscanf_nid_postfix("-2147483649", "%d", &value) == 1 && value == 0x7fffffff && *__error_nid_postfix() == 0);
+    Require(sscanf_nid_postfix("-1", "%u", &unsignedValue) == 1 && unsignedValue == 0xffffffffu && *__error_nid_postfix() == 0);
+    Require(sscanf_nid_postfix("99999999999", "%x", &unsignedValue) == 1 && unsignedValue == 0x99999999u && *__error_nid_postfix() == 0);
+    Require(sscanf_nid_postfix("70000", "%hd", &shortValue) == 1 && shortValue == 0x1170 && *__error_nid_postfix() == 0);
+    long long quad = 0x5555555555555555ll;
+    Require(sscanf_nid_postfix("9223372036854775808", "%lld", &quad) == 1 && quad == 0x7fffffffffffffffll && *__error_nid_postfix() == 34);
+    unsigned long long unsignedQuad = 0x5555555555555555ull;
+    *__error_nid_postfix() = 0;
+    Require(sscanf_nid_postfix("18446744073709551616", "%llu", &unsignedQuad) == 1 && unsignedQuad == 0xffffffffffffffffull && *__error_nid_postfix() == 34);
+#ifdef _WIN32
+    quad = 0x5555555555555555ll;
+    *__error_nid_postfix() = 0;
+    Require(sscanf_nid_postfix("5", "%qd", &quad) == 0 && quad == 0x5555555555555555ll && *__error_nid_postfix() == 0);
+#endif
+    int first = 7;
+    int second = 7;
+    int position = 0;
+    Require(sscanf_nid_postfix("12 34", "%d %d%n", &first, &second, &position) == 2 && first == 12 && second == 34 && position == 5);
+    value = 7;
+    Require(sscanf_nid_postfix("x", "%d", &value) == 0 && value == 7);
+    Require(sscanf_nid_postfix("1 x", "%d %d", &first, &value) == 1 && first == 1 && value == 7);
+}
+
 static void CheckSecureFormat() {
     constexpr size_t rsizeMax = SIZE_MAX >> 1;
     char buffer[16];
@@ -200,19 +240,24 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(std::strcmp(buffer, "Mount requested: 0") == 0);
     for (int index = 0; index < 10000; ++index) {
         snprintf_nid_postfix(buffer, sizeof(buffer), "%d %d %d %d %d %d %d %d", 1, 2, 3, 4, 5, 6, 7, 8);
+
         Require(std::strcmp(buffer, "1 2 3 4 5 6 7 8") == 0);
         FormatList(buffer, sizeof(buffer), "%.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %d", 1., 2., 3., 4., 5., 6., 7., 8., 9., 10., 11);
         Require(std::strcmp(buffer, "1.0 2.0 3.0 4.0 5.0 6.0 7.0 8.0 9.0 10.0 11") == 0);
         snprintf_nid_postfix(buffer, sizeof(buffer), "%ld %lu %lld %zu %td %jd", -4294967297LL, 4294967297ULL, -5LL, 7ULL, -8LL, 9LL);
+
         Require(std::strcmp(buffer, "-4294967297 4294967297 -5 7 -8 9") == 0);
         snprintf_nid_postfix(buffer, sizeof(buffer), "%s:%*.*f:%d", "test", -8, 2, 1.25, 7);
+
         Require(std::strcmp(buffer, "test:1.25    :7") == 0);
         FormatList(buffer, sizeof(buffer), "%d %d %d %d %d %d %d %.3Lf %.1f", 1, 2, 3, 4, 5, 6, 7, 1.125L, 2.5);
         Require(std::strcmp(buffer, "1 2 3 4 5 6 7 1.125 2.5") == 0);
     }
     snprintf_nid_postfix(buffer, sizeof(buffer), "%.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f", 1., 2., 3., 4., 5., 6., 7., 8., 9., 10.);
+
     Require(std::strcmp(buffer, "1.0 2.0 3.0 4.0 5.0 6.0 7.0 8.0 9.0 10.0") == 0);
     snprintf_nid_postfix(buffer, sizeof(buffer), "%.3Lf %d %.1f", 1.125L, 7, 2.5);
+
     Require(std::strcmp(buffer, "1.125 7 2.5") == 0);
     Require(snprintf_nid_postfix(buffer, sizeof(buffer), "%'d|%'u|%'.2f|%'-8ld|%'+05d|%'g", 1234567, 4000000000u, 1234567.891, 1234567LL, 42, 1e6) == 50);
     Require(std::strcmp(buffer, "1234567|4000000000|1234567.89|1234567 |+0042|1e+06") == 0);
@@ -231,20 +276,12 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(FormatList(buffer, sizeof(buffer), "%2$ls|%1$C|%3$d", 0x41, u"\u00e9", 7) == 6 && std::strcmp(buffer, "\xc3\xa9|A|7") == 0);
     Require(FormatList(buffer, sizeof(buffer), "%2$d %d %ls|%*5$d|%1$d", 1, 2, 3, u"x", 4) == 12 && std::strcmp(buffer, "2 3 x|   4|1") == 0);
     Require(FormatList(buffer, sizeof(buffer), "[%*3$d]%ls", 5, u"", 3) == 5 && std::strcmp(buffer, "[  5]") == 0);
-    const char* const invalidPositions[] = {"%0$d%ls", "%100$d%ls", "%*0$d%ls"};
-    for (const char* format : invalidPositions) {
-        bool threw = false;
-        try {
-            FormatList(buffer, sizeof(buffer), format, 1, u"");
-        } catch (const std::invalid_argument&) {
-            threw = true;
-        }
-        Require(threw);
-    }
+    Require(FormatList(buffer, sizeof(buffer), "%100$d %2$d%1$ls", u"", 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100) == 4 && std::strcmp(buffer, "99 1") == 0);
     char expected[1024];
     std::snprintf(expected, sizeof(expected), "%#08x %.3e %a %g %llx", 42u, 1.25, 1.25, 1.25,
         static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(buffer)));
     snprintf_nid_postfix(buffer, sizeof(buffer), "%#08x %.3e %a %g %p", 42u, 1.25, 1.25, 1.25, static_cast<void*>(buffer));
+
     Require(std::strcmp(buffer, expected) == 0);
     char pointers[128];
     const auto address = [](std::uintptr_t value) { return reinterpret_cast<void*>(value); };
@@ -265,6 +302,7 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(snprintf_nid_postfix(pointers, sizeof(pointers), "%p", address(0xffffffffffffffffull)) == 16 &&
         std::strcmp(pointers, "ffffffffffffffff") == 0);
     snprintf_nid_postfix(buffer, sizeof(buffer), "%.*s", -1, "unlimited");
+
     Require(std::strcmp(buffer, "unlimited") == 0);
     buffer[5] = '!';
     Require(snprintf_nid_postfix(buffer, 5, "%s", "abcdef") == 6);
@@ -357,6 +395,21 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     }
     char narrow[8] = {};
     Require(sscanf_nid_postfix("ab%", "%7[^%ls]", narrow) == 1 && std::strcmp(narrow, "ab") == 0);
+#endif
+#ifdef _WIN32
+    char freebsd[64];
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "%qd|%qu|%qx|%qo") == 15 &&
+        std::strcmp(freebsd, "%qd|%qu|%qx|%qo") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "%qd|%d", 7) == 5 && std::strcmp(freebsd, "%qd|7") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "%D|%hD|%O|%U|%jD") == 14 &&
+        std::strcmp(freebsd, "%D|%D|%O|%U|%D") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "[%5%][%-5%][%y][%5y][%-3y][%hhz]") == 34 &&
+        std::strcmp(freebsd, "[    %][%    ][%y][   %y][%y ][%z]") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "[%#y][%.2y][%-#4.1y]") == 14 &&
+        std::strcmp(freebsd, "[%y][%y][%y  ]") == 0);
+    bool incomplete = false;
+    try { snprintf_nid_postfix(freebsd, sizeof(freebsd), "100%"); } catch (const std::invalid_argument&) { incomplete = true; }
+    Require(incomplete);
 #endif
     long long count = -1;
     int smallCount = -1;
@@ -365,11 +418,12 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(snprintf_nid_postfix(buffer, sizeof(buffer), "a%cb", 0) == 3);
     Require(buffer[0] == 'a' && buffer[1] == 0 && buffer[2] == 'b' && buffer[3] == 0);
     *__error_nid_postfix() = 35;
-    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%m][%.8m][%-10.5m][%d]", 7) == 59);
-    Require(std::strcmp(buffer, "[Resource temporarily unavailable][Resource][Resou     ][7]") == 0);
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%m][%.8m][%-10.5m][%d]", 7) == 23);
+    Require(std::strcmp(buffer, "[%m][%m][%m        ][7]") == 0);
     Require(*__error_nid_postfix() == 35);
-    *__error_nid_postfix() = 63;
-    Require(FormatList(buffer, sizeof(buffer), "%s: %m", "open") == 24 && std::strcmp(buffer, "open: File name too long") == 0);
+    Require(FormatList(buffer, sizeof(buffer), "%s: %m", "open") == 8 && std::strcmp(buffer, "open: %m") == 0);
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%5k][%-3y][%lk][%#.2k][%y%d][%0$d]", 42) == 31);
+    Require(std::strcmp(buffer, "[   %k][%y ][%k][%k][%y42][%$d]") == 0);
     Require(printf_nid_postfix("printf: %d %.1f\n", 7, 2.5) == 14);
     Require(libc_printf_nid_postfix("libc_printf: %s\n", "OK") == 16);
     Require(libc_printf_nid_postfix("%d %d %d %d %d %d %d\n", 1, 22, 333, 4444, 55555, 666666, 7777777) == 35);
@@ -381,6 +435,7 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(ScanListS("123 test", "%d %s", &scanNum, scanWord, 8u) == 2 && scanNum == 123 && std::strcmp(scanWord, "test") == 0);
     char tooSmall[4] = {'x', 'x', 'x', 'x'};
     Require(ScanListS("abcdef", "%s", tooSmall, 4u) == 0 && tooSmall[0] == '\0');
+    CheckIntegerScanWidths();
     std::puts("Formatting checks passed: 10000 iterations");
 }
 
@@ -395,6 +450,94 @@ static void CheckAllocatingFormat() {
     char* allocated = nullptr;
     Require(asprintf_nid_postfix(&allocated, "%ls:%S:%lc:%d", u"\u00e9", u"ab", 0x20ac, 7) == 11 && std::strcmp(allocated, "\xc3\xa9:ab:\xe2\x82\xac:7") == 0);
     free_nid_postfix(allocated);
+
 }
 
-int main() { CheckSizeLimits(); RunChecks(); CheckAllocatingFormat(); return CheckWidePrecision() ? 0 : 1; }
+static void RequireFloat(const char* format, double value, const char* expected) {
+    char buffer[64];
+    const int written = snprintf_nid_postfix(buffer, sizeof(buffer), format, value);
+    if (written != static_cast<int>(std::strlen(expected)) || std::strcmp(buffer, expected) != 0) {
+        std::fprintf(stderr, "%s of %a gave \"%s\", expected \"%s\"\n", format, value, buffer, expected);
+        Require(false);
+    }
+}
+
+static void CheckHexFloat() {
+    RequireFloat("[%-010a]", 1.5, "[0x1.8p+0  ]");
+    RequireFloat("[%-0#12A]", 0.75, "[0X1.8P-1    ]");
+    RequireFloat("[%0-10.2a]", 1.0, "[0x1.00p+0 ]");
+    RequireFloat("[%010a]", -1.5, "[-0x01.8p+0]");
+    RequireFloat("[%a]", 0x1p-1074, "[0x1p-1074]");
+    RequireFloat("[%a]", 0x0.fffffffffffffp-1022, "[0x1.ffffffffffffep-1023]");
+    RequireFloat("[%.3a]", 0x0.fffffffffffffp-1022, "[0x2.000p-1023]");
+    RequireFloat("[%A]", 0x0.012688b70e62bp-1022, "[0X1.2688B70E62BP-1030]");
+    RequireFloat("[%.0a]", 0x0.012688b70e62bp-1022, "[0x1p-1030]");
+    RequireFloat("[%.1a]", 0x1.08p0, "[0x1.1p+0]");
+    RequireFloat("[%.0a]", 0x1.8p0, "[0x2p+0]");
+    RequireFloat("[%#.0a]", 1.0, "[0x1.p+0]");
+    RequireFloat("[%.20a]", 0.1, "[0x1.999999999999a0000000p-4]");
+    RequireFloat("[% a]", -0.0, "[-0x0p+0]");
+    char buffer[32];
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%*a]", -12, 1.5) == 14 && std::strcmp(buffer, "[0x1.8p+0    ]") == 0);
+    Require(snprintf_nid_postfix(buffer, 6, "%a", 1.5) == 8 && std::strcmp(buffer, "0x1.8") == 0);
+#ifdef _WIN32
+    for (const char* format : {"%.2147483648a", "%.2147483649A", "%.9999999999a",
+            "%.9999999999999999999999999999999999999999A", "%.0002147483648a", "%-+20.2147483648A",
+            "%2147483648a", "%999999999999999999999999a", "%.2147483647a", "%.2147483641a", "%+.2147483640A",
+            "x%2147483647a", "xx%.2147483640a", "x%+.2147483639A"}) {
+        bool rejected = false;
+        try {
+            snprintf_nid_postfix(buffer, sizeof(buffer), format, 1.5);
+        } catch (const std::overflow_error&) {
+            rejected = true;
+        }
+        Require(rejected);
+    }
+#endif
+}
+
+static void CheckDecimalFloat() {
+    RequireFloat("[%.0f]", 0.5, "[1]");
+    RequireFloat("[%.0f]", 2.5, "[3]");
+    RequireFloat("[%.0f]", -0.5, "[-1]");
+    RequireFloat("[%.1f]", 0.25, "[0.3]");
+    RequireFloat("[%#.3g]", 2025.0, "[2.03e+03]");
+    RequireFloat("[%.2e]", 1125.0, "[1.13e+03]");
+    RequireFloat("[%.2f]", 0.015, "[0.01]");
+    RequireFloat("[%.1f]", 99.95, "[100.0]");
+    RequireFloat("[%.40e]", 0.1, "[1.0000000000000000555000000000000000000000e-01]");
+    RequireFloat("[%.20f]", 0.1, "[0.10000000000000000555]");
+    RequireFloat("[%.0f]", 0x1p100, "[1267650600228229401496700000000]");
+    RequireFloat("[%.25e]", 0x1p-1074, "[4.9406564584124654417600000e-324]");
+    RequireFloat("[%.23e]", 0x1.0f6b8p+1023, "[9.52987754335065669050000e+307]");
+    RequireFloat("[%.17e]", -0x1.16a55a5cd7c73p+48, "[-3.06374418159559187e+14]");
+    RequireFloat("[%.17g]", 0x1.e5dec6655f463p+50, "[2136879802973464.7]");
+    RequireFloat("[%.0f]", 67108865.5, "[67108865]");
+    RequireFloat("[%.0f]", 33554433.5, "[33554434]");
+    RequireFloat("[%+08.1f]", 2.25, "[+00002.3]");
+    RequireFloat("[%#.0e]", 2.5, "[3.e+00]");
+    RequireFloat("[%g]", 0.0001, "[0.0001]");
+    RequireFloat("[%G]", 0.00001, "[1E-05]");
+    RequireFloat("[%.3g]", 999.5, "[1e+03]");
+    RequireFloat("[%e]", 0.0, "[0.000000e+00]");
+    RequireFloat("[%#g]", 0.0, "[0.00000]");
+    RequireFloat("[%.0f]", -0.0, "[-0]");
+    RequireFloat("[%-12.3E]", -1.25e-5, "[-1.250E-05  ]");
+    char buffer[64];
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%.40Le]", 1.0L / 3) == 48 && std::strcmp(buffer, "[3.3333333333333333334000000000000000000000e-01]") == 0);
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%.2Lf]", 0.125L) == 6 && std::strcmp(buffer, "[0.13]") == 0);
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%.30Le]", 0x1p-16445L) == 40 && std::strcmp(buffer, "[3.645199531882474602528000000000e-4951]") == 0);
+    for (const char* format : {"%.2147483647e", "%+.2147483647E", "%.2147483647f", "% .2147483646F", "%#.2147483647g",
+            "%.2147483643e", "x%.2147483645f", "x%-2147483647e", "%.2147483647Le"}) {
+        bool rejected = false;
+        try {
+            if (std::strstr(format, "L")) snprintf_nid_postfix(buffer, sizeof(buffer), format, 1.5L);
+            else snprintf_nid_postfix(buffer, sizeof(buffer), format, 1.5);
+        } catch (const std::overflow_error&) {
+            rejected = true;
+        }
+        Require(rejected);
+    }
+}
+
+int main() { CheckSizeLimits(); RunChecks(); CheckHexFloat(); CheckDecimalFloat(); CheckAllocatingFormat(); return CheckWidePrecision() ? 0 : 1; }
diff --git a/core/libs/tests/FreeTypeFontFixture.hpp b/core/libs/tests/FreeTypeFontFixture.hpp
index 9458d09a81..b876a19139 100644
--- a/core/libs/tests/FreeTypeFontFixture.hpp
+++ b/core/libs/tests/FreeTypeFontFixture.hpp
@@ -20,7 +20,8 @@ static void PutAll16(std::vector<unsigned char>& out, std::initializer_list<int>
     for (const int value : values) Put16(out, static_cast<std::uint32_t>(static_cast<std::uint16_t>(value)));
 }
 
-static std::vector<unsigned char> SquareGlyphFont(std::uint32_t codepoint, int width, bool symbolMap = false) {
+static std::vector<unsigned char> SquareGlyphFont(std::uint32_t codepoint, int width, bool symbolMap = false,
+                                                 const std::vector<unsigned char>* gasp = nullptr) {
     std::vector<unsigned char> head;
     Put32(head, 0x00010000u);
     Put32(head, 0x00010000u);
@@ -53,11 +54,19 @@ static std::vector<unsigned char> SquareGlyphFont(std::uint32_t codepoint, int w
         const int symbol = static_cast<int>(codepoint + 0xF000);
         PutAll16(cmap, {4, 32, 0, 4, 4, 1, 0, symbol, 0xFFFF, 0, symbol, 0xFFFF, 1 - symbol, 1, 0, 0});
     }
-    const std::vector<std::pair<const char*, const std::vector<unsigned char>*>> tables = {
+    std::vector<std::pair<const char*, const std::vector<unsigned char>*>> tables = {
         {"cmap", &cmap}, {"glyf", &glyf}, {"head", &head}, {"hhea", &hhea}, {"hmtx", &hmtx}, {"loca", &loca}, {"maxp", &maxp}};
+    if (gasp) tables.insert(tables.begin() + 1, {"gasp", gasp});
+    unsigned power = 1;
+    unsigned selector = 0;
+    while (power <= tables.size() / 2) {
+        power *= 2;
+        ++selector;
+    }
     std::vector<unsigned char> font;
     Put32(font, 0x00010000u);
-    PutAll16(font, {static_cast<int>(tables.size()), 64, 2, static_cast<int>(tables.size()) * 16 - 64});
+    PutAll16(font, {static_cast<int>(tables.size()), static_cast<int>(power * 16), static_cast<int>(selector),
+                    static_cast<int>(tables.size() * 16 - power * 16)});
     std::uint32_t offset = 12 + static_cast<std::uint32_t>(tables.size()) * 16;
     for (const auto& [tag, data] : tables) {
         font.insert(font.end(), tag, tag + 4);
diff --git a/core/libs/tests/GuestAccess.cpp b/core/libs/tests/GuestAccess.cpp
index f4fa4fb8e8..1c1b6ae651 100644
--- a/core/libs/tests/GuestAccess.cpp
+++ b/core/libs/tests/GuestAccess.cpp
@@ -1,5 +1,7 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <chrono>
+#include <cstdio>
 #include <cstdlib>
 #include <fstream>
 #ifdef _WIN32
@@ -10,12 +12,6 @@
 #include <aclapi.h>
 #endif
 
-extern "C" {
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI chdir_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
@@ -76,6 +72,46 @@ int main() {
     Require(access_nid_postfix("sample.txt", 1) == -1 && *__error_nid_postfix() == 13);
     std::filesystem::permissions(file, std::filesystem::perms::owner_exec, std::filesystem::perm_options::add);
     Require(access_nid_postfix("sample.txt", 1) == 0);
+#endif
+    const auto dangling = directory / "dangling.link";
+    const auto pointing = directory / "sample.link";
+    const auto loop = directory / "loop.link";
+#ifdef _WIN32
+    const DWORD linkFlags = SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE;
+    const bool linked = CreateSymbolicLinkW(dangling.c_str(), L"missing.bin", linkFlags) &&
+        CreateSymbolicLinkW(pointing.c_str(), L"sample.txt", linkFlags) && CreateSymbolicLinkW(loop.c_str(), L"loop.link", linkFlags);
+#else
+    std::error_code linkError;
+    std::filesystem::create_symlink("missing.bin", dangling, linkError);
+    if (!linkError) std::filesystem::create_symlink("sample.txt", pointing, linkError);
+    if (!linkError) std::filesystem::create_symlink("loop.link", loop, linkError);
+    const bool linked = !linkError;
+#endif
+    if (linked) {
+        Require(access_nid_postfix("dangling.link", 0) == -1 && *__error_nid_postfix() == 2);
+        Require(access_nid_postfix("dangling.link", 4) == -1 && *__error_nid_postfix() == 2);
+        Require(access_nid_postfix("loop.link", 0) == -1 && *__error_nid_postfix() == 62);
+        Require(access_nid_postfix("sample.link", 6) == 0);
+#ifdef _WIN32
+        Require(SetFileAttributesW(file.c_str(), FILE_ATTRIBUTE_READONLY));
+        Require(access_nid_postfix("sample.link", 4) == 0);
+        Require(access_nid_postfix("sample.link", 2) == -1 && *__error_nid_postfix() == 13);
+        Require(SetFileAttributesW(file.c_str(), FILE_ATTRIBUTE_NORMAL));
+        Require(SetFileAttributesW(pointing.c_str(), FILE_ATTRIBUTE_READONLY));
+        Require(access_nid_postfix("sample.link", 2) == 0);
+        Require(SetFileAttributesW(pointing.c_str(), FILE_ATTRIBUTE_NORMAL));
+#endif
+    } else {
+        std::fprintf(stderr, "symbolic links unavailable: the access link cases not tested\n");
+    }
+#ifdef _WIN32
+    DeleteFileW(dangling.c_str());
+    DeleteFileW(pointing.c_str());
+    DeleteFileW(loop.c_str());
+#else
+    std::filesystem::remove(dangling, linkError);
+    std::filesystem::remove(pointing, linkError);
+    std::filesystem::remove(loop, linkError);
 #endif
     Require(chdir_nid_postfix("/") == 0);
     std::filesystem::remove(file);
diff --git a/core/libs/tests/GuestAcm.cpp b/core/libs/tests/GuestAcm.cpp
index 9ba39f03ee..80d918bda6 100644
--- a/core/libs/tests/GuestAcm.cpp
+++ b/core/libs/tests/GuestAcm.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAcm/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -6,17 +7,6 @@
 #include <initializer_list>
 #include "SceTypes.hpp"
 
-extern "C" {
-int APS5_VABI sceAcmContextCreate(std::uint32_t*);
-int APS5_VABI sceAcmContextDestroy(std::uint32_t);
-int APS5_VABI sceAcmBatchStartBuffer(std::uint32_t, const void*, std::size_t, void*, std::uint32_t*);
-int APS5_VABI sceAcmBatchStartBuffers(std::uint32_t, std::uint32_t, const void* const[], void*, std::uint32_t*);
-int APS5_VABI sceAcmBatchWait(std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAcm_ConvReverb_SharedInput(AcmBatchInfo*, std::uint32_t, AcmReverbInput*, std::uint32_t, const AcmReverbFilter* const*, const float*, const AcmReverbOutput* const*);
-int APS5_VABI sceAcm_FFT(AcmBatchInfo*, std::int32_t, std::uint32_t, std::int32_t, const void* const*, std::int32_t, void* const*, std::int32_t);
-int APS5_VABI sceAcm_Panner(AcmBatchInfo*, std::uint32_t, const void* const*, std::uint32_t, std::uint32_t, std::uint32_t, const void* const*, const void* const*, const void* const*, void* const*);
-}
-
 static void Require(bool value) {
     if (!value) std::abort();
 }
diff --git a/core/libs/tests/GuestAddressConversion.cpp b/core/libs/tests/GuestAddressConversion.cpp
index 4d44b0a41b..4b6b4f252a 100644
--- a/core/libs/tests/GuestAddressConversion.cpp
+++ b/core/libs/tests/GuestAddressConversion.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -5,17 +7,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI __inet_pton_nid_postfix(int, const char*, void*);
-const char* APS5_VABI __inet_ntop_nid_postfix(int, const void*, char*, std::uint32_t);
-int APS5_VABI inet_pton_nid_postfix(int, const char*, void*);
-const char* APS5_VABI inet_ntop_nid_postfix(int, const void*, char*, std::uint32_t);
-int* APS5_VABI __error_nid_postfix();
-std::uint32_t APS5_VABI htonl_nid_postfix(std::uint32_t);
-std::uint32_t APS5_VABI ntohl_nid_postfix(std::uint32_t);
-std::uint16_t APS5_VABI htons_nid_postfix(std::uint16_t);
-std::uint16_t APS5_VABI ntohs_nid_postfix(std::uint16_t);
-}
 static void Require(bool value) { if (!value) std::abort(); }
 
 using Ntop = const char* (APS5_VABI *)(int, const void*, char*, std::uint32_t);
@@ -470,6 +461,7 @@ static void CheckConsolePton() {
         *__error_nid_postfix() = 0;
         const int result = sample.plain ? inet_pton_nid_postfix(sample.family, sample.text, destination)
                                         : __inet_pton_nid_postfix(sample.family, sample.text, destination);
+
         Require(result == sample.result);
         Require(*__error_nid_postfix() == sample.error);
         Require(SameBytes(destination, sample.bytes));
@@ -484,6 +476,7 @@ static void CheckConsoleNtop() {
         *__error_nid_postfix() = 0;
         const char* result = sample.plain ? inet_ntop_nid_postfix(sample.family, source, Wide, sample.size)
                                           : __inet_ntop_nid_postfix(sample.family, source, Wide, sample.size);
+
         Require(result == (sample.succeeds ? Wide : nullptr));
         Require(*__error_nid_postfix() == sample.error);
         Require(SameBytes(Wide, sample.bytes));
diff --git a/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp b/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp
index 72b97bd56f..8e807d6996 100644
--- a/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp
+++ b/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp
@@ -1,38 +1,9 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceAgcDriverGetShaderDebuggingStatus();
-int APS5_VABI sceAgcDriverSetValidationErrorOutputFrequency(std::uint32_t);
-int APS5_VABI sceAgcDriverSetSubmitValidationMode(std::uint32_t);
-int APS5_VABI sceAgcDriverGetSubmitValidationMode(std::uint32_t*);
-int APS5_VABI sceAgcDriverSetSubmitValidationConfig(const void*);
-int APS5_VABI sceAgcDriverGetSubmitValidationConfig(void*);
-int APS5_VABI sceAgcDriverSetValidationDisabled();
-int APS5_VABI sceAgcDriverGetCaptureConfig();
-int APS5_VABI sceAgcDriverSetCaptureConfig();
-int APS5_VABI sceAgcDriverGetGpuPrintfWorkArea();
-int APS5_VABI sceAgcDriverSetGpuPrintfEnabled();
-int APS5_VABI sceAgcDriverDbgReadRegister();
-int APS5_VABI sceAgcDriverDbgWriteRegister();
-int APS5_VABI sceAgcDriverGetGpuRefClks();
-int APS5_VABI sceAgcDriverIsSuspendPointInFlight();
-int APS5_VABI sceAgcDriverIsPaDebug();
-int APS5_VABI sceAgcDriverGetExceptionStatus();
-int APS5_VABI sceAgcDriverGetTraceInitiator();
-int APS5_VABI sceAgcDriverRegisterGpuResetCallbacks();
-int APS5_VABI sceAgcDriverUnregisterGpuResetCallbacks();
-int APS5_VABI sceAgdResetGpu();
-int APS5_VABI sceAgcDriverSysSubmitFlipHandleProxy();
-int APS5_VABI sceAgcDriverUserDataImmediateWrite();
-int APS5_VABI sceAgcDriverUserDataImmediateWritePacket();
-int APS5_VABI sceAgcDriverGetCoredumpMode(std::uint32_t*);
-int APS5_VABI sceAgcDriverAllocateToolMemoryForGpuReset(std::uint64_t, std::uint64_t, std::uint64_t, void*);
-int APS5_VABI sceAgcDriverGetAllocatedToolMemoryForGpuReset(std::uint64_t, void*);
-}
-
 static constexpr int DebugUnavailable = static_cast<int>(0x8A6C1000);
 static constexpr int FeatureUnavailable = static_cast<int>(0x8A6D0001);
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestAgcDriverResources.cpp b/core/libs/tests/GuestAgcDriverResources.cpp
index fc55b15a8a..eafe67b86e 100644
--- a/core/libs/tests/GuestAgcDriverResources.cpp
+++ b/core/libs/tests/GuestAgcDriverResources.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgcDriver/State/include/Status.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Registration.hpp"
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstddef>
@@ -6,33 +9,6 @@
 #include <cstring>
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceAgcDriverRegisterDefaultOwner(std::uint32_t);
-int APS5_VABI sceAgcDriverRegisterOwner(std::uint32_t*, const char*);
-int APS5_VABI sceAgcDriverRegisterResource(std::uint32_t*, std::uint32_t, const void*, std::size_t, const char*, std::uint32_t, std::uint64_t);
-int APS5_VABI sceAgcDriverRegisterMultipleResources(std::uint32_t*, std::uint32_t, const void*, std::uint32_t);
-int APS5_VABI sceAgcDriverRegisterGdsResource(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, const char*, std::uint32_t, std::uint64_t);
-int APS5_VABI sceAgcDriverUnregisterAllResourcesForOwner(std::uint32_t);
-int APS5_VABI sceAgcDriverRegisterWorkloadStream(std::uint32_t, const void*);
-int APS5_VABI sceAgcDriverUnregisterWorkloadStream(std::uint32_t);
-int APS5_VABI sceAgcDriverGetDefaultOwner(std::uint32_t*);
-int APS5_VABI sceAgcDriverGetResourceRegistrationMaxNameLength(std::uint32_t*);
-int APS5_VABI sceAgcDriverGetOwnerName(std::uint32_t, const char**);
-int APS5_VABI sceAgcDriverGetResourceName(std::uint32_t, const char**);
-int APS5_VABI sceAgcDriverGetResourceType(std::uint32_t, std::uint32_t*);
-int APS5_VABI sceAgcDriverGetResourceUserData(std::uint32_t, std::uint64_t*);
-int APS5_VABI sceAgcDriverSetResourceUserData(std::uint32_t, std::uint64_t);
-int APS5_VABI sceAgcDriverGetResourceBaseAddressAndSizeInBytes(std::uint32_t, void**, std::size_t*);
-int APS5_VABI sceAgcDriverGetResourceShaderGuid(std::uint32_t, void*);
-int APS5_VABI sceAgcDriverFindResourcesPublic(const void*, void*);
-bool APS5_VABI sceAgcDriverIsCaptureInProgress(void);
-bool APS5_VABI sceAgcDriverIsTraceInProgress(void);
-bool APS5_VABI sceAgcDriverIsSubmitValidationEnabled(void);
-int APS5_VABI sceAgcDriverRegisterOwnerForSystem();
-int APS5_VABI sceAgcDriverInitResourceRegistrationInterface();
-int APS5_VABI sceAgcDriverSetResourceRegistrationInfo();
-}
-
 static constexpr int Unavailable = static_cast<int>(0x8A6C9018);
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -92,8 +68,25 @@ int main() {
     Require(sceAgcDriverFindResourcesPublic(nullptr, nullptr) == Unavailable);
     Require(sceAgcDriverUnregisterAllResourcesForOwner(owner) == Unavailable);
     Require(std::string_view(name) == "unchanged");
+    constexpr int InvalidStream = static_cast<int>(0x8A6C0033);
+    constexpr int NullStream = static_cast<int>(0x8A6C0035);
+    constexpr int StreamNotRegistered = static_cast<int>(0x8A6C003A);
+    for (const std::uint32_t id : {0u, 32u, 0x101u, 0xffffffffu}) {
+        Require(sceAgcDriverRegisterWorkloadStream(id, memory) == InvalidStream);
+        Require(sceAgcDriverRegisterWorkloadStream(id, nullptr) == InvalidStream);
+        Require(sceAgcDriverUnregisterWorkloadStream(id) == InvalidStream);
+    }
+    Require(sceAgcDriverRegisterWorkloadStream(2u, nullptr) == NullStream);
+    Require(sceAgcDriverUnregisterWorkloadStream(2u) == StreamNotRegistered);
+    Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == 0);
+    Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == InvalidStream);
+    Require(sceAgcDriverRegisterWorkloadStream(1u, nullptr) == InvalidStream);
+    Require(sceAgcDriverRegisterWorkloadStream(31u, reinterpret_cast<const char*>(memory) + 1) == 0);
+    Require(sceAgcDriverUnregisterWorkloadStream(1u) == 0);
+    Require(sceAgcDriverUnregisterWorkloadStream(1u) == StreamNotRegistered);
     Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == 0);
     Require(sceAgcDriverUnregisterWorkloadStream(1u) == 0);
+    Require(sceAgcDriverUnregisterWorkloadStream(31u) == 0);
     Require(!sceAgcDriverIsCaptureInProgress());
     Require(!sceAgcDriverIsTraceInProgress());
     Require(!sceAgcDriverIsSubmitValidationEnabled());
diff --git a/core/libs/tests/GuestAio.cpp b/core/libs/tests/GuestAio.cpp
index 161b1e0039..79dfd69a61 100644
--- a/core/libs/tests/GuestAio.cpp
+++ b/core/libs/tests/GuestAio.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -19,28 +21,7 @@
 #include <io.h>
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 #endif
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t id, std::int32_t* ret);
-int APS5_VABI sceKernelAioInitializeImpl(void* param, std::int32_t size);
-void APS5_VABI sceKernelAioInitializeParam(void* param);
-int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, std::int32_t schedulingWindowSize, std::int32_t delayedCountLimit, std::uint32_t enableSplit, std::uint32_t splitSize, std::uint32_t splitChunkSize);
-int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioPollRequest(std::int32_t id, std::int32_t* state);
-int APS5_VABI sceKernelAioWaitRequest(std::int32_t id, std::int32_t* state, std::uint32_t* usec);
-int APS5_VABI sceKernelAioSubmitReadCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioWaitRequests(std::int32_t* id, std::int32_t num, std::int32_t* state, std::uint32_t mode, std::uint32_t* usec);
-int APS5_VABI sceKernelAioPollRequests(std::int32_t* id, std::int32_t num, std::int32_t* state);
-int APS5_VABI sceKernelAioCancelRequest(std::int32_t id, std::int32_t* state);
-int APS5_VABI sceKernelAioCancelRequests(std::int32_t* id, std::int32_t num, std::int32_t* state);
-int APS5_VABI sceKernelAioDeleteRequests(std::int32_t* id, std::int32_t num, std::int32_t* ret);
-}
+
 static void Require(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Aio check failed at line %d\n", line);
@@ -69,9 +50,9 @@ static void CheckBadPositionedDescriptors() {
                 KernelAioResult result{-1, 0};
                 KernelAioRwRequest request{0, count, &buffer, &result, descriptor};
                 std::int32_t id = 0;
-                Check((write ? sceKernelAioSubmitWriteCommands(&request, 1, 0, &id)
-                             : sceKernelAioSubmitReadCommands(&request, 1, 0, &id)) == 0);
-                Check(result.state == 4 && result.return_value == SCE_KERNEL_ERROR_EBADF);
+                Check((write ? sceKernelAioSubmitWriteCommands(&request, 1, 1, &id)
+                             : sceKernelAioSubmitReadCommands(&request, 1, 1, &id)) == 0);
+                Check(result.state == 3 && result.return_value == SCE_KERNEL_ERROR_EBADF);
                 std::int32_t removed = -1;
                 Check(sceKernelAioDeleteRequest(id, &removed) == 0);
             }
@@ -109,26 +90,42 @@ int main(int argc, char** argv) {
     Check(sceKernelAioSetParam(&schedulingParams[2], 128, 128, 0, 0x1000000, 0x1000000) == 0);
     Check(schedulingParams[2].schedulingWindowSize == 128 && schedulingParams[2].delayedCountLimit == 128);
     Check(schedulingParams[2].enableSplit == 0 && schedulingParams[2].splitSize == 0x1000000 && schedulingParams[2].splitChunkSize == 0x1000000);
-    const auto setParamThrows = [&](std::int32_t window, std::int32_t delayed, std::uint32_t split, std::uint32_t size, std::uint32_t chunk) {
+    const auto setParamRefuses = [&](std::int32_t window, std::int32_t delayed, std::uint32_t split, std::uint32_t size, std::uint32_t chunk) {
         KernelAioSchedulingParam untouchedParam{7, 7, 7, 7, 7};
-        bool thrown = false;
-        try { sceKernelAioSetParam(&untouchedParam, window, delayed, split, size, chunk); } catch (const std::exception&) { thrown = true; }
-        return thrown && untouchedParam.schedulingWindowSize == 7 && untouchedParam.delayedCountLimit == 7 &&
+        return sceKernelAioSetParam(&untouchedParam, window, delayed, split, size, chunk) == SCE_KERNEL_ERROR_EINVAL &&
+            untouchedParam.schedulingWindowSize == 7 && untouchedParam.delayedCountLimit == 7 &&
             untouchedParam.enableSplit == 7 && untouchedParam.splitSize == 7 && untouchedParam.splitChunkSize == 7;
     };
-    Check(setParamThrows(129, 32, 1, 0x100000, 0x100000));
-    Check(setParamThrows(-1, 32, 1, 0x100000, 0x100000));
-    Check(setParamThrows(32, 129, 1, 0x100000, 0x100000));
-    Check(setParamThrows(32, -1, 1, 0x100000, 0x100000));
-    Check(setParamThrows(32, 32, 2, 0x100000, 0x100000));
-    Check(setParamThrows(32, 32, 1, 0x1000001, 0x100000));
-    Check(setParamThrows(32, 32, 1, 0x100000, 0x1000001));
+    Check(setParamRefuses(129, 32, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(0x7fffffff, 32, 0, 0, 0));
+    Check(setParamRefuses(-1, 32, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 129, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(32, -1, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 32, 2, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 32, 0xffffffffu, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 32, 1, 0x1000001, 0x100000));
+    Check(setParamRefuses(32, 32, 1, 0x100000, 0x1000001));
+    Check(setParamRefuses(32, 32, 1, 0, 0x100000));
+    Check(setParamRefuses(32, 32, 1, 0x100000, 0));
+    KernelAioSchedulingParam accepted{7, 7, 7, 7, 7};
+    Check(sceKernelAioSetParam(&accepted, 0, 0, 0, 0, 0) == 0 && accepted.schedulingWindowSize == 0 && accepted.splitSize == 0);
+    Check(sceKernelAioSetParam(&accepted, 1, 1, 0, 0xffffffffu, 0x1000001) == 0 && accepted.splitSize == 0xffffffffu && accepted.splitChunkSize == 0x1000001);
+    Check(sceKernelAioSetParam(&accepted, 1, 1, 1, 1, 0x20000) == 0 && accepted.splitSize == 1 && accepted.splitChunkSize == 0x20000);
+    Check(sceKernelAioSetParam(&accepted, 1, 1, 1, 0x10001, 0x1000000) == 0 && accepted.splitSize == 0x10001);
     bool nullThrew = false;
     try { sceKernelAioSetParam(nullptr, 32, 32, 1, 0x100000, 0x100000); } catch (const std::invalid_argument&) { nullThrew = true; }
     Check(nullThrew);
     Check(sceKernelAioInitializeImpl(schedulingParams.data(), static_cast<std::int32_t>(sizeof(schedulingParams))) == 0);
-    int initParam = 0;
-    sceKernelAioInitializeParam(&initParam);
+    std::array<KernelAioSchedulingParam, 4> initParam{};
+    initParam.fill({7, 7, 7, 7, 7});
+    sceKernelAioInitializeParam(initParam.data());
+    for (int index = 0; index < 2; ++index) {
+        Check(initParam[index].schedulingWindowSize == 32 && initParam[index].delayedCountLimit == 32 && initParam[index].enableSplit == 1 &&
+            initParam[index].splitSize == 0x100000 && initParam[index].splitChunkSize == 0x100000);
+    }
+    Check(initParam[2].schedulingWindowSize == 32 && initParam[2].delayedCountLimit == 32 && initParam[2].enableSplit == 0 &&
+        initParam[2].splitSize == 0 && initParam[2].splitChunkSize == 0);
+    Check(initParam[3].schedulingWindowSize == 7 && initParam[3].splitChunkSize == 7);
     const int fd = sceKernelOpen(file.string().c_str(), SCE_KERNEL_O_RDONLY, 0);
     Check(fd >= 0);
     std::array<char, 16> first{};
@@ -140,7 +137,7 @@ int main(int argc, char** argv) {
         {32, second.size(), second.data(), &secondResult, fd},
     };
     std::int32_t id = 0;
-    Check(sceKernelAioSubmitReadCommands(requests, 2, 0, &id) == 0);
+    Check(sceKernelAioSubmitReadCommands(requests, 2, 1, &id) == 0);
     Check(id > 0);
     std::int32_t state = 0;
     Check(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
@@ -152,11 +149,11 @@ int main(int argc, char** argv) {
     KernelAioResult invalidReadResult{-1, 0};
     KernelAioRwRequest invalidReadRequest{-1, first.size(), first.data(), &invalidReadResult, fd};
     std::int32_t invalidReadId = 0;
-    Check(sceKernelAioSubmitReadCommands(&invalidReadRequest, 1, 0, &invalidReadId) == 0);
+    Check(sceKernelAioSubmitReadCommands(&invalidReadRequest, 1, 1, &invalidReadId) == 0);
     std::int32_t invalidReadState = 0;
     Check(sceKernelAioWaitRequest(invalidReadId, &invalidReadState, nullptr) == 0);
-    Check(invalidReadState == 4);
-    Check(invalidReadResult.state == 4 && invalidReadResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(invalidReadState == 3);
+    Check(invalidReadResult.state == 3 && invalidReadResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::array<char, 4> aggregateReadBuffer{};
     KernelAioResult aggregateReadSuccessResult{-1, 0};
     KernelAioResult aggregateReadErrorResult{-1, 0};
@@ -165,16 +162,26 @@ int main(int argc, char** argv) {
         {-1, aggregateReadBuffer.size(), aggregateReadBuffer.data(), &aggregateReadErrorResult, fd},
     };
     std::int32_t aggregateReadId = 0;
-    Check(sceKernelAioSubmitReadCommands(aggregateReads, 2, 0, &aggregateReadId) == 0);
+    Check(sceKernelAioSubmitReadCommands(aggregateReads, 2, 1, &aggregateReadId) == 0);
     std::int32_t aggregateReadState = 0;
     Check(sceKernelAioWaitRequest(aggregateReadId, &aggregateReadState, nullptr) == 0);
-    Check(aggregateReadState == 4);
+    Check(aggregateReadState == 3);
     Check(aggregateReadSuccessResult.state == 3 && aggregateReadSuccessResult.return_value == 4);
-    Check(aggregateReadErrorResult.state == 4 && aggregateReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(aggregateReadErrorResult.state == 3 && aggregateReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     Check(std::memcmp(aggregateReadBuffer.data(), seed.data() + 4, aggregateReadBuffer.size()) == 0);
+    std::int32_t pollFirstId = 0;
+    Check(sceKernelAioSubmitReadCommands(requests, 1, 1, &pollFirstId) == 0);
+    std::int32_t pollFirst = 0;
+    std::int32_t cancelFirst = 0;
+    Check(sceKernelAioCancelRequest(pollFirstId, &cancelFirst) == 0 && cancelFirst == 3);
+    Check(sceKernelAioPollRequest(pollFirstId, &pollFirst) == 0 && pollFirst == 3);
+    Check(sceKernelAioPollRequest(pollFirstId, &pollFirst) == 0 && pollFirst == 0x10003);
+    Check(sceKernelAioCancelRequest(pollFirstId, &cancelFirst) == 0 && cancelFirst == 3);
+    Check(sceKernelAioDeleteRequest(pollFirstId, &cancelFirst) == 0 && cancelFirst == 0);
     std::int32_t polled = 0;
     Check(sceKernelAioPollRequest(id, &polled) == 0);
-    Check(polled == 3);
+    Check(polled == 0x10003);
+    Check(sceKernelAioWaitRequest(id, &state, nullptr) == 0 && state == 0x10003);
     std::int32_t deleted = -1;
     Check(sceKernelAioDeleteRequest(id, &deleted) == 0);
     Check(deleted == 0);
@@ -185,18 +192,18 @@ int main(int argc, char** argv) {
     KernelAioResult writeResult{-1, 0};
     KernelAioRwRequest writeRequest{0, written.size(), written.data(), &writeResult, writeFd};
     std::int32_t writeId = 0;
-    Check(sceKernelAioSubmitWriteCommands(&writeRequest, 1, 0, &writeId) == 0);
+    Check(sceKernelAioSubmitWriteCommands(&writeRequest, 1, 1, &writeId) == 0);
     std::int32_t writeState = 0;
     Check(sceKernelAioWaitRequest(writeId, &writeState, nullptr) == 0);
     Check(writeState == 3 && writeResult.state == 3 && writeResult.return_value == 5);
     KernelAioResult invalidWriteResult{-1, 0};
     KernelAioRwRequest invalidWriteRequest{-1, written.size(), written.data(), &invalidWriteResult, writeFd};
     std::int32_t invalidWriteId = 0;
-    Check(sceKernelAioSubmitWriteCommands(&invalidWriteRequest, 1, 0, &invalidWriteId) == 0);
+    Check(sceKernelAioSubmitWriteCommands(&invalidWriteRequest, 1, 1, &invalidWriteId) == 0);
     std::int32_t invalidWriteState = 0;
     Check(sceKernelAioWaitRequest(invalidWriteId, &invalidWriteState, nullptr) == 0);
-    Check(invalidWriteState == 4);
-    Check(invalidWriteResult.state == 4 && invalidWriteResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(invalidWriteState == 3);
+    Check(invalidWriteResult.state == 3 && invalidWriteResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::array<char, 4> aggregateWriteBuffer = {'G', 'O', 'O', 'D'};
     KernelAioResult aggregateWriteSuccessResult{-1, 0};
     KernelAioResult aggregateWriteErrorResult{-1, 0};
@@ -205,12 +212,12 @@ int main(int argc, char** argv) {
         {-1, aggregateWriteBuffer.size(), aggregateWriteBuffer.data(), &aggregateWriteErrorResult, writeFd},
     };
     std::int32_t aggregateWriteId = 0;
-    Check(sceKernelAioSubmitWriteCommands(aggregateWrites, 2, 0, &aggregateWriteId) == 0);
+    Check(sceKernelAioSubmitWriteCommands(aggregateWrites, 2, 1, &aggregateWriteId) == 0);
     std::int32_t aggregateWriteState = 0;
     Check(sceKernelAioWaitRequest(aggregateWriteId, &aggregateWriteState, nullptr) == 0);
-    Check(aggregateWriteState == 4);
+    Check(aggregateWriteState == 3);
     Check(aggregateWriteSuccessResult.state == 3 && aggregateWriteSuccessResult.return_value == 4);
-    Check(aggregateWriteErrorResult.state == 4 && aggregateWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(aggregateWriteErrorResult.state == 3 && aggregateWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     Check(sceKernelClose(writeFd) == 0);
     { std::ifstream stream(file, std::ios::binary); std::string contents; std::getline(stream, contents);
       Check(contents.rfind("HELLO", 0) == 0); }
@@ -220,13 +227,17 @@ int main(int argc, char** argv) {
       Check(contents.size() == seed.size());
       Check(contents.substr(8, aggregateWriteBuffer.size()) == "GOOD");
       Check(contents.substr(12, 4) == seed.substr(12, 4)); }
-    Check(sceKernelAioSubmitReadCommands(nullptr, 1, 0, &id) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitReadCommands(requests, 0, 0, &id) == SCE_KERNEL_ERROR_EINVAL);
-    Check(sceKernelAioSubmitReadCommands(requests, 1, 0, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioWaitRequest(9999, &state, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioSubmitReadCommands(nullptr, 1, 1, &id) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitReadCommands(requests, 0, 1, &id) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioSubmitReadCommands(requests, 1, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
+    state = 7;
+    Check(sceKernelAioWaitRequest(9999, &state, nullptr) == 0 && state == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioWaitRequest(id, nullptr, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioPollRequest(id, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioPollRequest(0, &polled) == SCE_KERNEL_ERROR_EINVAL);
+    for (const std::int32_t unknown : {0, -1, 511, 512, 100000}) {
+        polled = 7;
+        Check(sceKernelAioPollRequest(unknown, &polled) == 0 && polled == SCE_KERNEL_ERROR_ESRCH);
+    }
     Check(sceKernelAioDeleteRequest(id, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     const int batchFd = sceKernelOpen(file.string().c_str(), SCE_KERNEL_O_RDWR, 0);
     Check(batchFd >= 0);
@@ -239,13 +250,13 @@ int main(int argc, char** argv) {
         {-1, batchReadBuffer.size(), batchReadBuffer.data(), &batchReadErrorResult, batchFd},
     };
     std::int32_t batchReadIds[2] = {0, 0};
-    Check(sceKernelAioSubmitReadCommandsMultiple(batchReads, 2, 0, batchReadIds) == 0);
+    Check(sceKernelAioSubmitReadCommandsMultiple(batchReads, 2, 1, batchReadIds) == 0);
     Check(batchReadIds[0] > 0 && batchReadIds[1] > 0 && batchReadIds[0] != batchReadIds[1]);
     Check(batchReadSuccessResult.state == 3 && batchReadSuccessResult.return_value == 4);
-    Check(batchReadErrorResult.state == 4 && batchReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(batchReadErrorResult.state == 3 && batchReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::int32_t batchReadStates[2] = {0, 0};
     Check(sceKernelAioWaitRequests(batchReadIds, 2, batchReadStates, 1, nullptr) == 0);
-    Check(batchReadStates[0] == 3 && batchReadStates[1] == 4);
+    Check(batchReadStates[0] == 3 && batchReadStates[1] == 3);
     std::array<char, 4> batchWriteData = {'A', 'B', 'C', 'D'};
     KernelAioResult batchWriteSuccessResult{-1, 0};
     KernelAioResult batchWriteErrorResult{-1, 0};
@@ -254,13 +265,13 @@ int main(int argc, char** argv) {
         {-1, batchWriteData.size(), batchWriteData.data(), &batchWriteErrorResult, batchFd},
     };
     std::int32_t batchWriteIds[2] = {0, 0};
-    Check(sceKernelAioSubmitWriteCommandsMultiple(batchWrites, 2, 0, batchWriteIds) == 0);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(batchWrites, 2, 1, batchWriteIds) == 0);
     Check(batchWriteIds[0] > 0 && batchWriteIds[1] > 0 && batchWriteIds[0] != batchWriteIds[1]);
     Check(batchWriteSuccessResult.state == 3 && batchWriteSuccessResult.return_value == 4);
-    Check(batchWriteErrorResult.state == 4 && batchWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(batchWriteErrorResult.state == 3 && batchWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::int32_t batchWriteStates[2] = {0, 0};
     Check(sceKernelAioWaitRequests(batchWriteIds, 2, batchWriteStates, 1, nullptr) == 0);
-    Check(batchWriteStates[0] == 3 && batchWriteStates[1] == 4);
+    Check(batchWriteStates[0] == 3 && batchWriteStates[1] == 3);
     std::array<char, 4> patch = {'W', 'X', 'Y', 'Z'};
     KernelAioResult patchResult{-1, 0};
     KernelAioResult badResult{-1, 0};
@@ -269,17 +280,17 @@ int main(int argc, char** argv) {
         {0, patch.size(), patch.data(), &badResult, -1},
     };
     std::int32_t writeIds[2] = {0, 0};
-    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 2, 0, writeIds) == 0);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 2, 1, writeIds) == 0);
     Check(sceKernelLseek(batchFd, 0, 1) == 2);
     Check(writeIds[0] > 0 && writeIds[1] > 0 && writeIds[0] != writeIds[1]);
     Check(patchResult.state == 3 && patchResult.return_value == 4);
-    Check(badResult.state == 4 && badResult.return_value == SCE_KERNEL_ERROR_EBADF);
+    Check(badResult.state == 3 && badResult.return_value == SCE_KERNEL_ERROR_EBADF);
     std::int32_t writeStates[2] = {0, 0};
     Check(sceKernelAioWaitRequests(writeIds, 2, writeStates, 1, nullptr) == 0);
-    Check(writeStates[0] == 3 && writeStates[1] == 4);
+    Check(writeStates[0] == 3 && writeStates[1] == 3);
     std::int32_t polledStates[2] = {0, 0};
     Check(sceKernelAioPollRequests(writeIds, 2, polledStates) == 0);
-    Check(polledStates[0] == 3 && polledStates[1] == 4);
+    Check(polledStates[0] == 0x10003 && polledStates[1] == 0x10003);
     std::array<char, 4> readBack{};
     std::array<char, 4> tail{};
     KernelAioResult readBackResult{-1, 0};
@@ -289,7 +300,7 @@ int main(int argc, char** argv) {
         {60, tail.size(), tail.data(), &tailResult, batchFd},
     };
     std::int32_t readIds[2] = {0, 0};
-    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 2, 0, readIds) == 0);
+    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 2, 1, readIds) == 0);
     Check(readIds[0] > 0 && readIds[1] > 0 && readIds[0] != readIds[1]);
     Check(readBackResult.state == 3 && readBackResult.return_value == 4);
     Check(std::memcmp(readBack.data(), "WXYZ", 4) == 0);
@@ -301,74 +312,87 @@ int main(int argc, char** argv) {
     Check(readStates[0] == 3 && readStates[1] == 3);
     std::int32_t cancelled = 0;
     Check(sceKernelAioCancelRequest(readIds[0], &cancelled) == 0);
-    Check(cancelled == 4);
+    Check(cancelled == 3);
     Check(sceKernelAioPollRequest(readIds[0], &polled) == 0);
-    Check(polled == 4);
+    Check(polled == 0x10003);
     Check(sceKernelAioCancelRequest(0, &cancelled) == 0);
-    Check(cancelled == 2);
+    Check(cancelled == SCE_KERNEL_ERROR_ESRCH);
     std::int32_t cancelIds[2] = {0, readIds[1]};
     std::int32_t cancelStates[2] = {0, 0};
     Check(sceKernelAioCancelRequests(cancelIds, 2, cancelStates) == 0);
-    Check(cancelStates[0] == 2 && cancelStates[1] == 4);
+    Check(cancelStates[0] == SCE_KERNEL_ERROR_ESRCH && cancelStates[1] == 3);
     Check(sceKernelAioPollRequest(readIds[1], &polled) == 0);
-    Check(polled == 4);
+    Check(polled == 0x10003);
+    Check(sceKernelAioCancelRequest(readIds[1], &cancelled) == 0 && cancelled == 3);
     Check(sceKernelAioPollRequests(readIds, 2, polledStates) == 0);
-    Check(polledStates[0] == 4 && polledStates[1] == 4);
+    Check(polledStates[0] == 0x10003 && polledStates[1] == 0x10003);
     std::int32_t deletedRets[2] = {-1, -1};
     Check(sceKernelAioDeleteRequests(writeIds, 2, deletedRets) == 0);
     Check(deletedRets[0] == 0 && deletedRets[1] == 0);
     Check(sceKernelAioPollRequest(writeIds[0], &polled) == 0);
-    Check(polled == 4);
-    Check(sceKernelAioDeleteRequests(writeIds, 0, deletedRets) == 0);
+    Check(polled == SCE_KERNEL_ERROR_ESRCH);
+    Check(sceKernelAioDeleteRequests(writeIds, 2, deletedRets) == 0);
+    Check(deletedRets[0] == SCE_KERNEL_ERROR_ESRCH && deletedRets[1] == SCE_KERNEL_ERROR_ESRCH);
+    std::int32_t deletedRet = 7;
+    Check(sceKernelAioDeleteRequest(writeIds[0], &deletedRet) == 0 && deletedRet == SCE_KERNEL_ERROR_ESRCH);
+    std::uint32_t unknownTimeout = 1000;
+    Check(sceKernelAioWaitRequests(writeIds, 2, polledStates, 1, &unknownTimeout) == 0);
+    Check(polledStates[0] == SCE_KERNEL_ERROR_ESRCH && polledStates[1] == SCE_KERNEL_ERROR_ESRCH);
+    Check(sceKernelAioDeleteRequests(writeIds, 0, deletedRets) == SCE_KERNEL_ERROR_EINVAL);
     Check(sceKernelClose(batchFd) == 0);
     std::int32_t badIds[2] = {readIds[0], 9999};
     std::int32_t untouched[2] = {7, 7};
-    Check(sceKernelAioSubmitReadCommandsMultiple(nullptr, 1, 0, readIds) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 1, 0, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 0, 0, writeIds) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioSubmitReadCommandsMultiple(nullptr, 1, 1, readIds) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 1, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 0, 1, writeIds) == SCE_KERNEL_ERROR_EINVAL);
     KernelAioRwRequest noResult{0, 1, readBack.data(), nullptr, batchFd};
-    Check(sceKernelAioSubmitWriteCommandsMultiple(&noResult, 1, 0, writeIds) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(&noResult, 1, 1, writeIds) == SCE_KERNEL_ERROR_EFAULT);
     std::array<KernelAioRwRequest, 129> unread{};
     std::array<std::int32_t, 129> unreadIds{};
-    for (const auto submit : {sceKernelAioSubmitReadCommandsMultiple, sceKernelAioSubmitWriteCommandsMultiple}) {
-        bool limited = false;
-        try { submit(unread.data(), 129, 0, unreadIds.data()); } catch (const std::runtime_error&) { limited = true; }
-        Check(limited);
+    unreadIds.fill(7);
+    for (const auto submit : {sceKernelAioSubmitReadCommandsMultiple, sceKernelAioSubmitWriteCommandsMultiple, sceKernelAioSubmitReadCommands, sceKernelAioSubmitWriteCommands}) {
+        Check(submit(unread.data(), 129, 1, unreadIds.data()) == SCE_KERNEL_ERROR_EINVAL);
+        for (const std::int32_t priority : {0, 4, -1}) Check(submit(unread.data(), 1, priority, unreadIds.data()) == SCE_KERNEL_ERROR_EINVAL);
+        Check(unreadIds[0] == 7);
     }
-    std::int32_t unreadId = 0;
-    Check(sceKernelAioSubmitReadCommands(unread.data(), 129, 0, &unreadId) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitWriteCommands(unread.data(), 129, 0, &unreadId) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioWaitRequests(readIds, 2, nullptr, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioWaitRequests(nullptr, 2, readStates, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioWaitRequests(readIds, -1, readStates, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
-    Check(sceKernelAioWaitRequests(badIds, 2, untouched, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
-    Check(untouched[0] == 7 && untouched[1] == 7);
+    Check(sceKernelAioWaitRequests(badIds, 2, untouched, 1, nullptr) == 0);
+    Check(untouched[0] == 0x10003 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
+    untouched[0] = untouched[1] = 7;
     Check(sceKernelAioPollRequests(readIds, 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioPollRequests(nullptr, 2, readStates) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioPollRequests(readIds, -1, readStates) == SCE_KERNEL_ERROR_EINVAL);
-    Check(sceKernelAioPollRequests(badIds, 2, untouched) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioPollRequests(badIds, 2, untouched) == 0);
+    Check(untouched[0] == 0x10003 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
+    untouched[0] = untouched[1] = 7;
+    Check(sceKernelAioPollRequests(readIds, 0, untouched) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioWaitRequests(readIds, 0, untouched, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioCancelRequests(readIds, 0, untouched) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioDeleteRequests(readIds, 0, untouched) == SCE_KERNEL_ERROR_EINVAL);
     Check(untouched[0] == 7 && untouched[1] == 7);
-    Check(sceKernelAioPollRequests(readIds, 0, untouched) == 0);
-    Check(untouched[0] == 7 && untouched[1] == 7);
-    bool threw = false;
-    try { sceKernelAioWaitRequests(readIds, 2, readStates, 3, nullptr); } catch (const std::runtime_error&) { threw = true; }
-    Check(threw);
-    threw = false;
+    for (const std::uint32_t mode : {0u, 3u, 4u, 0x100u, 0xffffffffu}) {
+        Check(sceKernelAioWaitRequests(readIds, 2, untouched, mode, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+        Check(untouched[0] == 7 && untouched[1] == 7);
+    }
     std::array<std::int32_t, 129> manyIds{};
     std::array<std::int32_t, 129> manyStates{};
     manyIds.fill(readIds[0]);
-    try { sceKernelAioDeleteRequests(manyIds.data(), 129, manyStates.data()); } catch (const std::runtime_error&) { threw = true; }
-    Check(threw);
-    threw = false;
-    try { sceKernelAioPollRequests(manyIds.data(), 129, manyStates.data()); } catch (const std::runtime_error&) { threw = true; }
-    Check(threw);
-    Check(sceKernelAioCancelRequest(9999, &cancelled) == SCE_KERNEL_ERROR_EINVAL);
+    manyStates.fill(7);
+    Check(sceKernelAioDeleteRequests(manyIds.data(), 129, manyStates.data()) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioPollRequests(manyIds.data(), 129, manyStates.data()) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioWaitRequests(manyIds.data(), 129, manyStates.data(), 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioCancelRequests(manyIds.data(), 129, manyStates.data()) == SCE_KERNEL_ERROR_EINVAL);
+    Check(manyStates[0] == 7);
+    Check(sceKernelAioPollRequests(manyIds.data(), 128, manyStates.data()) == 0 && manyStates[127] == manyStates[0]);
+    Check(sceKernelAioCancelRequest(9999, &cancelled) == 0 && cancelled == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioCancelRequest(readIds[0], nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioCancelRequests(badIds, 2, untouched) == SCE_KERNEL_ERROR_EINVAL);
-    Check(untouched[0] == 7 && untouched[1] == 7);
+    Check(sceKernelAioCancelRequests(badIds, 2, untouched) == 0);
+    Check(untouched[0] == 3 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioCancelRequests(cancelIds, 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioDeleteRequests(badIds, 2, untouched) == SCE_KERNEL_ERROR_EINVAL);
-    Check(untouched[0] == 7 && untouched[1] == 7);
+    Check(sceKernelAioDeleteRequests(badIds, 2, untouched) == 0);
+    Check(untouched[0] == 0 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioDeleteRequests(writeIds, 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     const auto shared = root / "shared.bin";
     std::string sharedContents;
@@ -385,7 +409,7 @@ int main(int argc, char** argv) {
                 KernelAioResult result{-1, 0};
                 KernelAioRwRequest request{offset, bytes.size(), bytes.data(), &result, sharedFd};
                 std::int32_t requestId = 0;
-                if (sceKernelAioSubmitReadCommands(&request, 1, 0, &requestId) != 0 || result.state != 3 ||
+                if (sceKernelAioSubmitReadCommands(&request, 1, 1, &requestId) != 0 || result.state != 3 ||
                     result.return_value != 16 || std::memcmp(bytes.data(), sharedContents.data() + offset, 16) != 0) {
                     misread = true;
                 }
@@ -403,7 +427,7 @@ int main(int argc, char** argv) {
     KernelAioResult appendResult{-1, 0};
     KernelAioRwRequest appendRequest{0, appendBuffer.size(), appendBuffer.data(), &appendResult, appendFd};
     std::int32_t appendId = 0;
-    Check(sceKernelAioSubmitWriteCommands(&appendRequest, 1, 0, &appendId) == 0);
+    Check(sceKernelAioSubmitWriteCommands(&appendRequest, 1, 1, &appendId) == 0);
     std::int32_t appendState = 0;
     Check(sceKernelAioWaitRequest(appendId, &appendState, nullptr) == 0);
     Check(appendState == 3 && appendResult.state == 3 && appendResult.return_value == 4);
diff --git a/core/libs/tests/GuestAjm.cpp b/core/libs/tests/GuestAjm.cpp
index 4fca98867a..1aece55d9e 100644
--- a/core/libs/tests/GuestAjm.cpp
+++ b/core/libs/tests/GuestAjm.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -16,34 +17,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceAjmInitialize(std::int64_t, std::uint32_t*);
-int APS5_VABI sceAjmFinalize(std::uint32_t);
-int APS5_VABI sceAjmDecAt9ParseConfigData(const void*, AjmDecAt9ConfigDataInfo*);
-int APS5_VABI sceAjmDecMp3ParseFrame(const std::uint8_t*, std::uint32_t, int, AjmDecMp3ParseFrame*);
-int APS5_VABI sceAjmInstanceCreate(std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t*);
-int APS5_VABI sceAjmInstanceDestroy(std::uint32_t, std::uint32_t);
-int APS5_VABI sceAjmBatchInitialize(void*, std::size_t, AjmBatchInfo*);
-int APS5_VABI sceAjmBatchJobInitialize(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobDecode(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobDecodeSingle(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobRun(AjmBatchInfo*, std::uint32_t, std::uint64_t, const void*, std::size_t, void*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobRunSplit(AjmBatchInfo*, std::uint32_t, std::uint64_t, const AjmBuffer*, std::size_t, const AjmBuffer*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobSetGaplessDecode(AjmBatchInfo*, std::uint32_t, const void*, int, void*);
-int APS5_VABI sceAjmBatchJobControl(AjmBatchInfo*, std::uint32_t, std::uint64_t, const void*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobGetGaplessDecode(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobGetCodecInfo(AjmBatchInfo*, std::uint32_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobGetInfo(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchStart(std::uint32_t, const AjmBatchInfo*, int, AjmBatchError*, std::uint32_t*);
-int APS5_VABI sceAjmBatchWait(std::uint32_t, std::uint32_t, std::uint32_t, AjmBatchError*);
-int APS5_VABI sceAjmBatchCancel(std::uint32_t, std::uint32_t);
-int APS5_VABI sceAjmBatchJobClearContext(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobSetResampleParameters(AjmBatchInfo*, std::uint32_t, float, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobGetResampleInfo(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobSetResampleParametersEx(AjmBatchInfo*, std::uint32_t, float, float, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobDecodeSplit(AjmBatchInfo*, std::uint32_t, const AjmBuffer*, std::size_t, const AjmBuffer*, std::size_t, void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 namespace {
@@ -852,7 +825,7 @@ void TestGetInfo(std::uint32_t context) {
     Require(sceAjmBatchJobGetInfo(&info, instance, &at9) == 0);
     Submit(context, info);
     Require(initResult[0] == 0);
-    Require(at9.result == 0 && at9.internalResult == 0 && at9.numChannels == 2 && at9.channelMask == 0x3 && at9.sampleRate == 48000 && at9.sampleEncoding == 0 && at9.reserved == 0);
+    Require(at9.result == 0 && at9.internalResult == 0 && at9.numChannels == 2 && at9.channelMask == 0x3 && at9.sampleRate == 48000 && at9.sampleEncoding == 0 && at9.bitrate == 1024 * 8 * 48000 / (4 * 256) && at9.reserved == 0);
     Require(sceAjmInstanceDestroy(context, instance) == 0);
 
     Require(sceAjmInstanceCreate(context, 0, 0, &instance) == 0);
@@ -868,6 +841,69 @@ void TestGetInfo(std::uint32_t context) {
     Require(sceAjmInstanceDestroy(context, instance) == 0);
 }
 
+void TestBatchBounds(std::uint32_t context) {
+    constexpr int invalidParameter = static_cast<int>(0x80930005);
+    std::vector<std::uint8_t> storage(128);
+    AjmBatchInfo info{};
+    Require(sceAjmBatchInitialize(storage.data(), storage.size(), &info) == 0);
+    const std::uint32_t parameters[3] = {2, 48000, 0};
+    std::int32_t result[2] = {-1, -1};
+    Require(sceAjmBatchJobInitialize(&info, 0, parameters, sizeof(parameters), result) == 0);
+    const auto completeBytes = info.offset;
+#ifdef _WIN32
+    SYSTEM_INFO system{};
+    GetSystemInfo(&system);
+    const std::size_t pageSize = system.dwPageSize;
+    auto* pages = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, 2 * pageSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+    Require(pages != nullptr);
+    DWORD oldProtection = 0;
+    Require(VirtualProtect(pages + pageSize, pageSize, PAGE_NOACCESS, &oldProtection) != 0);
+#else
+    const long hostPageSize = sysconf(_SC_PAGESIZE);
+    Require(hostPageSize > 0);
+    const std::size_t pageSize = static_cast<std::size_t>(hostPageSize);
+    auto* pages = static_cast<std::uint8_t*>(mmap(nullptr, 2 * pageSize, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+    Require(pages != MAP_FAILED);
+    Require(mprotect(pages + pageSize, pageSize, PROT_NONE) == 0);
+#endif
+    Require(completeBytes < pageSize);
+    for (std::size_t bytes = 1; bytes < completeBytes; ++bytes) {
+        auto* truncated = pages + pageSize - bytes;
+        std::memcpy(truncated, storage.data(), bytes);
+        AjmBatchInfo partial{truncated, bytes, bytes};
+        std::uint32_t batch = 0xdeadbeef;
+        bool threw = false;
+        try {
+            sceAjmBatchStart(context, &partial, 0, nullptr, &batch);
+        } catch (const std::runtime_error&) {
+            threw = true;
+        }
+        Require(threw && batch == 0xdeadbeef && result[0] == -1 && result[1] == -1);
+    }
+    for (std::uint8_t value : {std::uint8_t{0}, std::uint8_t{0xff}}) {
+        std::fill(storage.begin(), storage.end(), value);
+        std::uint32_t batch = 0xdeadbeef;
+        bool threw = false;
+        try {
+            sceAjmBatchStart(context, &info, 0, nullptr, &batch);
+        } catch (const std::runtime_error&) {
+            threw = true;
+        }
+        Require(threw && batch == 0xdeadbeef && result[0] == -1 && result[1] == -1);
+    }
+    std::uint32_t batch = 0xdeadbeef;
+    AjmBatchInfo invalid{pages + pageSize, 1, 0};
+    Require(sceAjmBatchStart(context, &invalid, 0, nullptr, &batch) == invalidParameter);
+    invalid = {nullptr, 1, 1};
+    Require(sceAjmBatchStart(context, &invalid, 0, nullptr, &batch) == invalidParameter);
+    Require(batch == 0xdeadbeef);
+#ifdef _WIN32
+    Require(VirtualFree(pages, 0, MEM_RELEASE) != 0);
+#else
+    Require(munmap(pages, 2 * pageSize) == 0);
+#endif
+}
+
 void TestBatchWaitRelease(std::uint32_t context) {
     constexpr int invalidBatch = static_cast<int>(0x80930004);
     std::vector<std::uint8_t> batch(64);
@@ -1015,7 +1051,7 @@ std::vector<std::int16_t> DecodeAt9Superframe(std::uint32_t context, const std::
     Require(sceAjmBatchJobRun(&info, instance, sidebandStream | runMultipleFrames, superframe.data(), superframe.size(), pcm.data(), pcm.size() * sizeof(std::int16_t), &decoded, sizeof(decoded)) == 0);
     Submit(context, info);
     Require(initResult[0] == 0);
-    Require(decoded.stream.result == 0 && static_cast<std::size_t>(decoded.stream.inputConsumed) == superframe.size());
+    Require(decoded.stream.result == 0x18 && static_cast<std::size_t>(decoded.stream.inputConsumed) == superframe.size());
     Require(static_cast<std::size_t>(decoded.stream.outputWritten) == pcm.size() * sizeof(std::int16_t) && decoded.stream.totalDecodedSamples == 1024 && decoded.frames == 4);
     Require(sceAjmInstanceDestroy(context, instance) == 0);
     return pcm;
@@ -1542,7 +1578,7 @@ ResampledStream Stream(std::uint32_t context, std::uint32_t instance, const std:
         Require(sceAjmBatchJobDecode(&info, instance, stream + offset, size - offset, pcm.data(), pcm.size() * sizeof(std::int16_t), &sideband) == 0);
         Submit(context, info);
         if (ratio > 0) Require(setResult[0] == 0);
-        Require(sideband.result == 0 || (offset == size && sideband.outputWritten == 0));
+        Require(sideband.result == 0 || sideband.result == 0x8 || sideband.result == 0x10 || sideband.result == 0x18 || (offset == size && sideband.outputWritten == 0));
         offset += static_cast<std::size_t>(sideband.inputConsumed);
         if (offset < size && static_cast<std::size_t>(sideband.outputWritten) < pcm.size() * sizeof(std::int16_t)) ++out.shortJobs;
         out.pcm.insert(out.pcm.end(), pcm.begin(), pcm.begin() + sideband.outputWritten / static_cast<std::int32_t>(sizeof(std::int16_t)));
@@ -1762,7 +1798,7 @@ At9Run RunAt9Job(std::uint32_t context, std::uint32_t instance, std::uint64_t fl
     const std::size_t sidebandSize = (flags & runMultipleFrames) != 0 ? sizeof(decoded) : sizeof(decoded.stream);
     Require(sceAjmBatchJobRun(&info, instance, sidebandStream | flags, input, inputSize, pcm.data(), pcm.size() * sizeof(std::int16_t), &decoded, sidebandSize) == 0);
     Submit(context, info);
-    Require(decoded.stream.result == 0);
+    Require(decoded.stream.result == 0 || decoded.stream.result == 0x8 || decoded.stream.result == 0x18);
     return decoded;
 }
 
@@ -1796,7 +1832,318 @@ void TestAt9RunDecodesWholeInput(std::uint32_t context) {
     RunControl(context, instance, CONTROL_START, &start, sizeof(start), result);
     Require(result[0] == 0);
     const auto run = RunAt9Job(context, instance, 0, stream.data(), stream.size());
-    Require(static_cast<std::size_t>(run.stream.inputConsumed) == stream.size() && run.stream.outputWritten == 1024 * 2);
+    Require(run.stream.result == 0x18 && static_cast<std::size_t>(run.stream.inputConsumed) == stream.size() && run.stream.outputWritten == 1024 * 2);
+    Require(sceAjmInstanceDestroy(context, instance) == 0);
+}
+
+void TestAt9FlagRules(std::uint32_t context) {
+    constexpr std::uint64_t runMultipleFrames = 1ull << 12;
+    constexpr std::uint64_t sidebandStream = 1ull << 47;
+    std::vector<std::uint8_t> stream(2048, 0);
+    std::memcpy(stream.data(), AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    std::memcpy(stream.data() + 1024, AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    const At9Control start{{0, 0, 0}, {0xFE, 0x70, 0x1F, 0xF0}, 0};
+    const auto run = [&](std::size_t inputSize, std::size_t roomSamples, At9Run& decoded) {
+        std::uint32_t instance = 0;
+        Require(sceAjmInstanceCreate(context, 1, 0, &instance) == 0);
+        std::int32_t result[2] = {-1, -1};
+        RunControl(context, instance, CONTROL_START, &start, sizeof(start), result);
+        Require(result[0] == 0);
+        std::vector<std::uint8_t> batch(4096);
+        std::vector<std::int16_t> pcm(roomSamples + 1);
+        AjmBatchInfo info{};
+        Require(sceAjmBatchInitialize(batch.data(), batch.size(), &info) == 0);
+        Require(sceAjmBatchJobRun(&info, instance, sidebandStream | runMultipleFrames, stream.data(), inputSize, pcm.data(), roomSamples * sizeof(std::int16_t), &decoded, sizeof(decoded)) == 0);
+        Submit(context, info);
+        Require(sceAjmInstanceDestroy(context, instance) == 0);
+    };
+    At9Run inputRanOut{{-1, -1, 0, 0, 0}, 0, 0};
+    run(1024, 2048, inputRanOut);
+    Require(inputRanOut.stream.result == 0x8 && inputRanOut.stream.inputConsumed == 1024 && inputRanOut.stream.outputWritten == 1024 * 2 && inputRanOut.frames == 4);
+    At9Run roomRanOut{{-1, -1, 0, 0, 0}, 0, 0};
+    run(2048, 1024, roomRanOut);
+    Require(roomRanOut.stream.result == 0x10 && roomRanOut.stream.inputConsumed == 1024 && roomRanOut.stream.outputWritten == 1024 * 2 && roomRanOut.frames == 4);
+    At9Run halfRoom{{-1, -1, 0, 0, 0}, 0, 0};
+    run(1024, 512, halfRoom);
+    Require(halfRoom.stream.result == 0x10 && halfRoom.stream.inputConsumed > 0 && halfRoom.stream.inputConsumed < 1024 && halfRoom.stream.outputWritten == 512 * 2 && halfRoom.frames == 2);
+    At9Run noRoom{{-1, -1, 0, 0, 0}, 0, 0};
+    run(1024, 0, noRoom);
+    Require(noRoom.stream.result == 0x10 && noRoom.stream.inputConsumed == 0 && noRoom.stream.outputWritten == 0 && noRoom.frames == 0);
+    At9Run both{{-1, -1, 0, 0, 0}, 0, 0};
+    run(1024, 1024, both);
+    Require(both.stream.result == 0x18 && both.stream.inputConsumed == 1024 && both.stream.outputWritten == 1024 * 2 && both.frames == 4);
+}
+
+int StartBuffer(std::uint32_t context, const void* batch, std::size_t size) {
+    std::uint32_t id = 0;
+    AjmBatchError error{};
+    const int started = sceAjmBatchStartBuffer(context, static_cast<const std::uint8_t*>(batch), static_cast<std::uint32_t>(size), 0, &error, &id);
+    if (started == 0) Require(sceAjmBatchWait(context, id, 0, &error) == 0);
+    return started;
+}
+
+std::uint32_t BatchWord(const std::vector<std::uint8_t>& batch, std::size_t offset) {
+    std::uint32_t word = 0;
+    std::memcpy(&word, batch.data() + offset, sizeof(word));
+    return word;
+}
+
+void TestConsoleBufferJobs(std::uint32_t context) {
+    constexpr std::uint64_t version = 1;
+    constexpr std::uint64_t runMultipleFrames = 1ull << 12;
+    constexpr std::uint64_t sidebandStream = 1ull << 47;
+    std::vector<std::uint8_t> stream(2048, 0);
+    std::memcpy(stream.data(), AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    std::memcpy(stream.data() + 1024, AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    std::uint32_t instance = 0;
+    Require(sceAjmInstanceCreate(context, 1, 0, &instance) == 0);
+    const At9Control start{{0, 0, 0}, {0xFE, 0x70, 0x1F, 0xF0}, 0};
+    std::int32_t result[2] = {-1, -1};
+    std::vector<std::int16_t> pcm(2048, 0x55);
+    At9Run single{{-1, -1, 0, 0, 0}, 0, 0};
+    At9Run split{{-1, -1, 0, 0, 0}, 0, 0};
+    const AjmBuffer inputs[2] = {{stream.data() + 1024, 300}, {stream.data() + 1324, 724}};
+    const AjmBuffer outputs[2] = {{pcm.data() + 1024, 600 * 2}, {pcm.data() + 1624, 424 * 2}};
+    std::vector<std::uint8_t> batch(4096, 0xCD);
+
+    void* at = sceAjmBatchJobControlBufferRa(batch.data(), instance, version | CONTROL_START, &start, sizeof(start), result, sizeof(result), &context);
+    Require(at == batch.data() + 64);
+    Require(BatchWord(batch, 0) == instance << 6 && BatchWord(batch, 4) == 56);
+    Require(BatchWord(batch, 8) == 6 && BatchWord(batch, 24) == 2 && BatchWord(batch, 28) == sizeof(start));
+    Require(BatchWord(batch, 40) == (3u | (0x2000u << 6)) && BatchWord(batch, 44) == 0x6001 && BatchWord(batch, 48) == 18);
+    at = sceAjmBatchJobRunBufferRa(at, instance, version | sidebandStream | runMultipleFrames, stream.data(), 1024, pcm.data(), 1024 * 2, &single, sizeof(single), nullptr);
+    Require(at == batch.data() + 128);
+    Require(BatchWord(batch, 68) == 56 && BatchWord(batch, 72) == 1 && BatchWord(batch, 88) == (4u | (0x8000u << 6)) && BatchWord(batch, 96) == 17 && BatchWord(batch, 112) == 18);
+    at = sceAjmBatchJobRunSplitBufferRa(at, instance, version | sidebandStream | runMultipleFrames, inputs, 2, outputs, 2, &split, sizeof(split), nullptr);
+    Require(at == batch.data() + 224 && BatchWord(batch, 132) == 88);
+    Require(StartBuffer(context, batch.data(), static_cast<std::uint8_t*>(at) - batch.data()) == 0);
+
+    Require(result[0] == 0 && result[1] == 0);
+    constexpr std::int32_t exactFit = 0x18;
+    Require(single.stream.result == exactFit && single.stream.inputConsumed == 1024 && single.stream.outputWritten == 1024 * 2 && single.frames == 4 && single.stream.totalDecodedSamples == 1024);
+    Require(split.stream.result == exactFit && split.stream.inputConsumed == 1024 && split.stream.outputWritten == 1024 * 2 && split.frames == 4 && split.stream.totalDecodedSamples == 2048);
+    Require(std::all_of(pcm.begin(), pcm.end(), [](std::int16_t sample) { return sample == 0; }));
+    Require(sceAjmInstanceDestroy(context, instance) == 0);
+}
+
+class ConsoleBatch {
+public:
+    void Word(std::uint32_t word) { words.push_back(word); }
+    void Chunk(std::uint32_t kind, std::uint32_t payload, std::uint32_t word) {
+        Word(kind | (payload << 6));
+        Word(word);
+    }
+    void Buffer(std::uint32_t kind, const void* address, std::size_t size) {
+        Chunk(kind, 0, static_cast<std::uint32_t>(size));
+        const auto value = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(address));
+        Word(static_cast<std::uint32_t>(value));
+        Word(static_cast<std::uint32_t>(value >> 32));
+    }
+    const std::uint32_t* Data() const { return words.data(); }
+    std::size_t Bytes() const { return words.size() * sizeof(std::uint32_t); }
+
+private:
+    std::vector<std::uint32_t> words;
+};
+
+void TestConsoleHandWrittenJobs(std::uint32_t context) {
+    std::vector<std::uint8_t> stream(1024, 0);
+    std::memcpy(stream.data(), AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    std::uint32_t instance = 0;
+    Require(sceAjmInstanceCreate(context, 1, 0, &instance) == 0);
+    std::int32_t result[2] = {-1, -1};
+    std::int32_t statistics[6] = {-1, -1, -1, -1, -1, -1};
+    std::vector<std::int16_t> pcm(1024, 0x55);
+    At9Run decoded{{-1, -1, 0, 0, 0}, 0, 0};
+    const std::uint8_t initialize[8] = {0xFE, 0x70, 0x1F, 0xF0, 0, 0, 0, 0};
+    std::uint32_t inlined[2];
+    std::memcpy(inlined, initialize, sizeof(initialize));
+
+    ConsoleBatch batch;
+    batch.Chunk(7, 0, sizeof(initialize));
+    batch.Word(inlined[0]);
+    batch.Word(inlined[1]);
+    batch.Chunk(0, instance, 40);
+    batch.Buffer(2, nullptr, sizeof(initialize));
+    batch.Chunk(3, 0, 0x6001);
+    batch.Buffer(18, result, sizeof(result));
+    batch.Chunk(0, instance, 56);
+    batch.Buffer(1, stream.data(), stream.size());
+    batch.Chunk(4, 0x8000, 0x1001);
+    batch.Buffer(17, pcm.data(), pcm.size() * sizeof(std::int16_t));
+    batch.Buffer(18, &decoded, sizeof(decoded));
+    batch.Chunk(0, 0x80000, 24);
+    batch.Chunk(3, 0, 0x8007);
+    batch.Buffer(18, statistics, sizeof(statistics));
+    std::vector<std::uint32_t> words(batch.Data(), batch.Data() + batch.Bytes() / sizeof(std::uint32_t));
+    const auto inlineAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(words.data() + 2));
+    words[8] = static_cast<std::uint32_t>(inlineAddress);
+    words[9] = static_cast<std::uint32_t>(inlineAddress >> 32);
+    Require(StartBuffer(context, words.data(), words.size() * sizeof(std::uint32_t)) == 0);
+    Require(result[0] == 0 && result[1] == 0 && statistics[0] == 0 && statistics[1] == 0);
+    Require(decoded.stream.result == 0x18 && decoded.stream.inputConsumed == 1024 && decoded.stream.outputWritten == 1024 * 2 && decoded.frames == 4);
+    Require(std::all_of(pcm.begin(), pcm.end(), [](std::int16_t sample) { return sample == 0; }));
+
+    constexpr int malformedBatch = static_cast<int>(0x80930011);
+    Require(StartBuffer(context, words.data(), 12) == malformedBatch);
+    ConsoleBatch flagless;
+    flagless.Chunk(0, instance, 16);
+    flagless.Buffer(18, result, sizeof(result));
+    Require(StartBuffer(context, flagless.Data(), flagless.Bytes()) == malformedBatch);
+    ConsoleBatch overrun;
+    overrun.Chunk(0, instance, 32);
+    overrun.Chunk(3, 0, 0x2001);
+    overrun.Buffer(18, result, sizeof(result));
+    Require(StartBuffer(context, overrun.Data(), overrun.Bytes()) == malformedBatch);
+    ConsoleBatch unknown;
+    unknown.Chunk(0, instance, 16);
+    unknown.Chunk(3, 0, 0x2001);
+    unknown.Chunk(5, 0, 0);
+    bool unknownThrows = false;
+    try {
+        static_cast<void>(StartBuffer(context, unknown.Data(), unknown.Bytes()));
+    } catch (const std::runtime_error&) {
+        unknownThrows = true;
+    }
+    Require(unknownThrows);
+    Require(sceAjmInstanceDestroy(context, instance) == 0);
+}
+
+int StartBufferRefused(std::uint32_t context, const void* batch, std::size_t size, AjmBatchError& error) {
+    std::uint32_t id = 0;
+    error = AjmBatchError{};
+    return sceAjmBatchStartBuffer(context, static_cast<const std::uint8_t*>(batch), static_cast<std::uint32_t>(size), 0, &error, &id);
+}
+
+void TestConsoleBufferEdges(std::uint32_t context) {
+    constexpr int malformedBatch = static_cast<int>(0x80930011);
+    constexpr int invalidAddress = static_cast<int>(0x80930016);
+    std::vector<std::uint8_t> stream(1024, 0);
+    std::memcpy(stream.data(), AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    const std::uint8_t initialize[8] = {0xFE, 0x70, 0x1F, 0xF0, 0, 0, 0, 0};
+    std::uint32_t instance = 0;
+    Require(sceAjmInstanceCreate(context, 1, 0, &instance) == 0);
+    std::vector<std::int16_t> pcm(1024, 0x55);
+    std::int32_t result[2] = {-1, -1};
+    const auto control = [&](ConsoleBatch& batch) {
+        result[0] = result[1] = -1;
+        batch.Chunk(0, instance, 40);
+        batch.Buffer(2, initialize, sizeof(initialize));
+        batch.Chunk(3, 0, 0x6001);
+        batch.Buffer(18, result, sizeof(result));
+    };
+
+    At9Run dropped{{-1, -1, 0, 0, 0}, 0, 0};
+    ConsoleBatch zeroSizes;
+    control(zeroSizes);
+    zeroSizes.Chunk(0, instance, 104);
+    zeroSizes.Buffer(1, stream.data(), 0);
+    zeroSizes.Buffer(1, stream.data(), stream.size());
+    zeroSizes.Chunk(4, 0x8000, 0x1001);
+    zeroSizes.Buffer(17, pcm.data(), 0);
+    zeroSizes.Buffer(17, pcm.data(), pcm.size() * sizeof(std::int16_t));
+    zeroSizes.Buffer(17, nullptr, 0);
+    zeroSizes.Buffer(18, &dropped, sizeof(dropped));
+    Require(StartBuffer(context, zeroSizes.Data(), zeroSizes.Bytes()) == 0);
+    Require(result[0] == 0 && dropped.stream.result == 0x18 && dropped.stream.inputConsumed == 1024 && dropped.stream.outputWritten == 1024 * 2 && dropped.frames == 4);
+    Require(std::all_of(pcm.begin(), pcm.end(), [](std::int16_t sample) { return sample == 0; }));
+
+    At9Run noRoom{{-1, -1, 0, 0, 0}, 0, 0};
+    std::fill(pcm.begin(), pcm.end(), std::int16_t{0x55});
+    ConsoleBatch zeroRoom;
+    control(zeroRoom);
+    zeroRoom.Chunk(0, instance, 56);
+    zeroRoom.Buffer(1, stream.data(), stream.size());
+    zeroRoom.Chunk(4, 0x8000, 0x1001);
+    zeroRoom.Buffer(17, pcm.data(), 0);
+    zeroRoom.Buffer(18, &noRoom, sizeof(noRoom));
+    Require(StartBuffer(context, zeroRoom.Data(), zeroRoom.Bytes()) == 0);
+    Require(result[0] == 0 && noRoom.stream.result == 0x10 && noRoom.stream.inputConsumed == 0 && noRoom.stream.outputWritten == 0 && noRoom.frames == 0);
+    Require(std::all_of(pcm.begin(), pcm.end(), [](std::int16_t sample) { return sample == 0x55; }));
+
+    const void* returnAddress = &stream;
+    for (const bool nullInput : {true, false}) {
+        At9Run untouched{{-1, -1, 0, 0, 0}, 0, 0};
+        ConsoleBatch refused;
+        control(refused);
+        refused.Chunk(0, instance, 72);
+        refused.Buffer(6, returnAddress, 0);
+        refused.Buffer(1, nullInput ? nullptr : stream.data(), stream.size());
+        refused.Chunk(4, 0x8000, 0x1001);
+        refused.Buffer(17, nullInput ? pcm.data() : nullptr, pcm.size() * sizeof(std::int16_t));
+        refused.Buffer(18, &untouched, sizeof(untouched));
+        AjmBatchError error{};
+        Require(StartBufferRefused(context, refused.Data(), refused.Bytes(), error) == malformedBatch);
+        Require(error.error_code == invalidAddress && error.job_addr == reinterpret_cast<const std::uint8_t*>(refused.Data()) + 48);
+        Require(error.cmd_offset == (nullInput ? 24u : 48u) && error.job_ra == returnAddress);
+        Require(result[0] == -1 && untouched.stream.result == -1);
+    }
+    Require(sceAjmInstanceDestroy(context, instance) == 0);
+}
+
+void TestConsoleEmptyBatch(std::uint32_t context) {
+    constexpr int invalidParameter = static_cast<int>(0x80930005);
+    constexpr int invalidBatch = static_cast<int>(0x80930004);
+    std::uint32_t id = 0;
+    AjmBatchError error{};
+    Require(sceAjmBatchStartBuffer(context, nullptr, 0, 0, &error, &id) == invalidParameter);
+    Require(sceAjmBatchStartBuffer(context, nullptr, 16, 0, &error, &id) == invalidParameter);
+    const std::uint64_t words[2] = {0, 0};
+    Require(sceAjmBatchStartBuffer(context, reinterpret_cast<const std::uint8_t*>(words), 0, 0, &error, nullptr) == invalidParameter);
+    error.error_code = -1;
+    Require(sceAjmBatchStartBuffer(context, reinterpret_cast<const std::uint8_t*>(words), 0, 0, &error, &id) == 0);
+    Require(error.error_code == 0 && id != 0 && sceAjmBatchWait(context, id, 0, &error) == 0);
+    Require(sceAjmBatchWait(context, id, 0, &error) == invalidBatch);
+}
+
+void TestConsoleSingleFrameRun(std::uint32_t context) {
+    constexpr std::uint64_t version = 1;
+    constexpr std::uint64_t sidebandStream = 1ull << 47;
+    std::vector<std::uint8_t> stream(1024, 0);
+    std::memcpy(stream.data(), AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    std::uint32_t instance = 0;
+    Require(sceAjmInstanceCreate(context, 1, 0, &instance) == 0);
+    const At9Control start{{0, 0, 0}, {0xFE, 0x70, 0x1F, 0xF0}, 0};
+    std::int32_t result[2] = {-1, -1};
+    std::vector<std::int16_t> pcm(1024, 0x55);
+    DecodeSideband single{-1, -1, 0, 0, 0};
+    std::vector<std::uint8_t> batch(4096, 0xCD);
+    void* at = sceAjmBatchJobControlBufferRa(batch.data(), instance, version | CONTROL_START, &start, sizeof(start), result, sizeof(result), nullptr);
+    at = sceAjmBatchJobRunBufferRa(at, instance, version | sidebandStream, stream.data(), stream.size(), pcm.data(), pcm.size() * sizeof(std::int16_t), &single, sizeof(single), nullptr);
+    Require(StartBuffer(context, batch.data(), static_cast<std::uint8_t*>(at) - batch.data()) == 0);
+    Require(result[0] == 0 && single.result == 0 && single.inputConsumed > 0 && single.inputConsumed < 1024);
+    Require(single.outputWritten == 256 * 2 && single.totalDecodedSamples == 256);
+    Require(std::all_of(pcm.begin(), pcm.begin() + 256, [](std::int16_t sample) { return sample == 0; }));
+    Require(std::all_of(pcm.begin() + 256, pcm.end(), [](std::int16_t sample) { return sample == 0x55; }));
+    Require(sceAjmInstanceDestroy(context, instance) == 0);
+}
+
+void TestConsoleStaleHeaderBits(std::uint32_t context) {
+    std::vector<std::uint8_t> stream(1024, 0);
+    std::memcpy(stream.data(), AT9_MONO_SILENT_SUPERFRAME, sizeof(AT9_MONO_SILENT_SUPERFRAME));
+    std::uint32_t instance = 0;
+    Require(sceAjmInstanceCreate(context, 1, 0, &instance) == 0);
+    std::int32_t result[2] = {-1, -1};
+    std::vector<std::int16_t> pcm(1024, 0x55);
+    At9Run decoded{{-1, -1, 0, 0, 0}, 0, 0};
+    const std::uint8_t initialize[8] = {0xFE, 0x70, 0x1F, 0xF0, 0, 0, 0, 0};
+
+    ConsoleBatch batch;
+    batch.Chunk(0x8C000030u, instance, 56);
+    batch.Buffer(0xFFFFFFF6u, &context, 0);
+    batch.Buffer(0xFFFFFFE2u, initialize, sizeof(initialize));
+    batch.Chunk(0x04000033u, 0, 0x6001);
+    batch.Buffer(0xFFFFFFF2u, result, sizeof(result));
+    batch.Chunk(0x8C000020u, instance, 72);
+    batch.Buffer(0xFFFFFFF6u, &context, 0);
+    batch.Buffer(0xFFFFFFE1u, stream.data(), stream.size());
+    batch.Chunk(0x04000034u, 0x8000, 0x1001);
+    batch.Buffer(0xFFFFFFF1u, pcm.data(), pcm.size() * sizeof(std::int16_t));
+    batch.Buffer(0xFFFFFFF2u, &decoded, sizeof(decoded));
+    Require(StartBuffer(context, batch.Data(), batch.Bytes()) == 0);
+    Require(result[0] == 0 && result[1] == 0);
+    Require(decoded.stream.result == 0x18 && decoded.stream.inputConsumed == 1024 && decoded.stream.outputWritten == 1024 * 2 && decoded.frames == 4);
+    Require(std::all_of(pcm.begin(), pcm.end(), [](std::int16_t sample) { return sample == 0; }));
     Require(sceAjmInstanceDestroy(context, instance) == 0);
 }
 
@@ -1999,6 +2346,7 @@ int main() {
     bool nullBuffersThrow = false;
     try {
         sceAjmBatchJobRunSplit(&batchInfo, 0, 0, nullptr, 1, nullptr, 0, nullptr, 0);
+
     } catch (const std::runtime_error&) {
         nullBuffersThrow = true;
     }
@@ -2029,6 +2377,7 @@ int main() {
     TestGaplessDecode(context);
     TestCodecInfo(context);
     TestGetInfo(context);
+    TestBatchBounds(context);
     TestBatchWaitRelease(context);
     TestInstanceHandleLifetime(context);
     TestBatchCancel(context);
@@ -2050,6 +2399,14 @@ int main() {
     TestResampleAt9(context);
     TestAt9GaplessSegments(context);
     TestAt9RunDecodesWholeInput(context);
+    TestAt9FlagRules(context);
     TestPcmResample(context);
+    TestConsoleBufferJobs(context);
+    TestConsoleHandWrittenJobs(context);
+    TestConsoleBufferEdges(context);
+    TestConsoleEmptyBatch(context);
+    TestConsoleSingleFrameRun(context);
+    TestConsoleStaleHeaderBits(context);
+    Require(sceAjmDecWVorbisCreateHeaderPacket(nullptr) == static_cast<int>(0x8A6E0001));
     Require(sceAjmFinalize(context) == 0);
 }
diff --git a/core/libs/tests/GuestAjmVibration.cpp b/core/libs/tests/GuestAjmVibration.cpp
index 11351dcb6f..8157596435 100644
--- a/core/libs/tests/GuestAjmVibration.cpp
+++ b/core/libs/tests/GuestAjmVibration.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -8,19 +9,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAjmInitialize(std::int64_t, std::uint32_t*);
-int APS5_VABI sceAjmFinalize(std::uint32_t);
-int APS5_VABI sceAjmDecAt9ParseConfigData(const void*, AjmDecAt9ConfigDataInfo*);
-int APS5_VABI sceAjmInstanceCreate(std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t*);
-int APS5_VABI sceAjmInstanceDestroy(std::uint32_t, std::uint32_t);
-int APS5_VABI sceAjmBatchInitialize(void*, std::size_t, AjmBatchInfo*);
-int APS5_VABI sceAjmBatchJobInitialize(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobRun(AjmBatchInfo*, std::uint32_t, std::uint64_t, const void*, std::size_t, void*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchStart(std::uint32_t, const AjmBatchInfo*, int, AjmBatchError*, std::uint32_t*);
-int APS5_VABI sceAjmBatchWait(std::uint32_t, std::uint32_t, std::uint32_t, AjmBatchError*);
-}
-
 namespace {
 void Require(bool value, const char* message) {
     if (!value) throw std::runtime_error(message);
@@ -110,7 +98,7 @@ std::vector<T> Decode(std::uint32_t context, unsigned channels, unsigned encodin
         Require((stream.result & 2) != 0 && stream.consumed == 0 && stream.produced == 0, "invalid first-frame flag");
     }
     const auto stream = run(packet, packet.size());
-    Require(stream.result == 0 && stream.internalResult == 0, "decode vibration superframe");
+    Require(stream.result == 0x18 && stream.internalResult == 0, "decode vibration superframe");
     Require(stream.consumed == 128 && stream.produced == static_cast<int>(pcm.size() * sizeof(T)), "consumed/produced accounting");
     Require(stream.samples == static_cast<unsigned>(samples) && stream.frames == 4, "decoded sample/frame accounting");
     Require(sceAjmInstanceDestroy(context, instance) == 0, "destroy instance");
diff --git a/core/libs/tests/GuestAjmWVorbis.cpp b/core/libs/tests/GuestAjmWVorbis.cpp
index 4344e98e00..b017065e10 100644
--- a/core/libs/tests/GuestAjmWVorbis.cpp
+++ b/core/libs/tests/GuestAjmWVorbis.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -7,23 +8,7 @@
 #include <cstdlib>
 #include <cstring>
 
-struct HeaderPacketParam {
-    std::uint64_t size;
-    std::uint32_t channels;
-    std::uint32_t sampleRate;
-    std::int32_t bytesPerSecond;
-    std::int32_t blockSize0Log2;
-    std::int32_t blockSize1Log2;
-    std::uint32_t reserved;
-    const std::uint8_t* setupPacket;
-    std::uint64_t setupPacketSize;
-    std::uint8_t* output;
-    std::uint64_t outputSize;
-    std::uint64_t writtenSize;
-};
-static_assert(sizeof(HeaderPacketParam) == 0x48);
-
-extern "C" int APS5_VABI sceAjmDecWVorbisCreateHeaderPacket(HeaderPacketParam* param);
+static_assert(sizeof(WVorbisHeaderPacketParameter) == 0x48);
 
 namespace {
 
@@ -40,11 +25,11 @@ void Require(bool value, const char* message) {
 
 constexpr std::array<std::uint8_t, 12> Setup {5, 'v', 'o', 'r', 'b', 'i', 's', 9, 0, 0xAA, 0xBB, 0xCC};
 
-HeaderPacketParam Valid(std::uint8_t* output, std::size_t outputSize) {
-    return {sizeof(HeaderPacketParam), 2, 48000, 16000, 8, 11, 0, Setup.data(), Setup.size(), output, outputSize, 0};
+WVorbisHeaderPacketParameter Valid(std::uint8_t* output, std::size_t outputSize) {
+    return {sizeof(WVorbisHeaderPacketParameter), 2, 48000, 16000, 8, 11, 0, Setup.data(), Setup.size(), output, outputSize, 0};
 }
 
-int Create(HeaderPacketParam param) { return sceAjmDecWVorbisCreateHeaderPacket(&param); }
+int Create(WVorbisHeaderPacketParameter param) { return sceAjmDecWVorbisCreateHeaderPacket(&param); }
 
 void TestValidation() {
     std::array<std::uint8_t, 128> output {};
@@ -56,15 +41,15 @@ void TestValidation() {
     param.bytesPerSecond = -1;
     Require(Create(param) == InvalidParameter, "a negative byte rate is refused");
     param = Valid(output.data(), output.size());
-    param.blockSize0Log2 = 5;
+    param.shortBlockExponent = 5;
     Require(Create(param) == InvalidParameter, "a block size below 64 is refused");
-    param.blockSize0Log2 = 38;
-    param.blockSize1Log2 = 38;
+    param.shortBlockExponent = 38;
+    param.longBlockExponent = 38;
     Require(Create(param) == 0, "block size exponents are taken modulo 32 as the console's shift does");
     param = Valid(output.data(), output.size());
-    param.blockSize1Log2 = 7;
+    param.longBlockExponent = 7;
     Require(Create(param) == InvalidParameter, "block size 1 below block size 0 is refused");
-    param.blockSize1Log2 = 14;
+    param.longBlockExponent = 14;
     Require(Create(param) == InvalidParameter, "a block size above 8192 is refused");
     param = Valid(output.data(), output.size());
     param.setupPacket = nullptr;
@@ -86,7 +71,7 @@ void TestPacket() {
     output.fill(0xEE);
     auto param = Valid(output.data(), output.size());
     Require(sceAjmDecWVorbisCreateHeaderPacket(&param) == 0, "a valid header packet is built");
-    Require(param.writtenSize == 56 + Setup.size(), "the written size covers the table, both headers and the setup packet");
+    Require(param.outputSize == 56 + Setup.size(), "the written size covers the table, both headers and the setup packet");
     constexpr std::uint8_t Expected[] {
         0, 0, 30, 0, 16, 0, 9, 0, 3, 0,
         1, 'v', 'o', 'r', 'b', 'i', 's', 0, 0, 0, 0, 2, 0x80, 0xBB, 0, 0, 0, 0, 0, 0, 0x00, 0xF4, 0x01, 0x00, 0, 0, 0, 0, 0xB8, 1,
diff --git a/core/libs/tests/GuestAllocatingStrings.cpp b/core/libs/tests/GuestAllocatingStrings.cpp
index 8bf053914b..9bcaf27685 100644
--- a/core/libs/tests/GuestAllocatingStrings.cpp
+++ b/core/libs/tests/GuestAllocatingStrings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
@@ -8,15 +9,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-char* APS5_VABI strndup_nid_postfix(const char*, std::size_t);
-char* APS5_VABI strdup_nid_postfix(const char*);
-int APS5_VABI asprintf_nid_postfix(char**, const char*, ...);
-int APS5_VABI vasprintf_nid_postfix(char**, const char*, VaList*);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value) {
diff --git a/core/libs/tests/GuestAllocatorFailures.cpp b/core/libs/tests/GuestAllocatorFailures.cpp
index 5312249a50..f38e1a1e2d 100644
--- a/core/libs/tests/GuestAllocatorFailures.cpp
+++ b/core/libs/tests/GuestAllocatorFailures.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -12,23 +13,14 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" {
-void* APS5_VABI malloc_nid_postfix(std::size_t);
-void* APS5_VABI calloc_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI realloc_nid_postfix(void*, std::size_t);
-void* APS5_VABI memalign_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI aligned_alloc_nid_postfix(std::size_t, std::size_t);
-int APS5_VABI posix_memalign_nid_postfix(void**, std::size_t, std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int NoMemory = 12;
 constexpr int InvalidArgument = 22;
+constexpr int Untouched = 77;
 constexpr std::size_t Max = std::numeric_limits<std::size_t>::max();
 constexpr std::size_t HalfPlusOne = static_cast<std::size_t>(std::numeric_limits<std::ptrdiff_t>::max()) + 1;
+constexpr std::size_t LastPlainFailure = Max - 0x1008f;
 
 int failures = 0;
 
@@ -50,7 +42,7 @@ void report(const char* what, const char* detail) {
 
 template<typename TCall>
 void expectNull(const char* what, int expectedError, TCall call) {
-    *__error_nid_postfix() = 0;
+    *__error_nid_postfix() = Untouched;
     void* result = nullptr;
     try {
         result = call();
@@ -65,6 +57,7 @@ void expectNull(const char* what, int expectedError, TCall call) {
     if (result != nullptr) {
         report(what, "returned a block");
         free_nid_postfix(result);
+
         return;
     }
     if (*__error_nid_postfix() != expectedError) {
@@ -95,27 +88,59 @@ int main() {
     void* api[10]{};
     ApplicationHeapRegister_nid_no_patch(api);
 
-    expectNull("malloc(SIZE_MAX)", NoMemory, [] { return malloc_nid_postfix(Max); });
-    expectNull("malloc(PTRDIFF_MAX + 1)", NoMemory, [] { return malloc_nid_postfix(HalfPlusOne); });
-    expectNull("calloc(SIZE_MAX, 2)", NoMemory, [] { return calloc_nid_postfix(Max, 2); });
-    expectNull("calloc(2^33, 2^33)", NoMemory, [] { return calloc_nid_postfix(std::size_t{1} << 33, std::size_t{1} << 33); });
-    expectNull("calloc(PTRDIFF_MAX + 1, 1)", NoMemory, [] { return calloc_nid_postfix(HalfPlusOne, 1); });
-    expectNull("realloc(NULL, SIZE_MAX)", NoMemory, [] { return realloc_nid_postfix(nullptr, Max); });
-    expectNull("aligned_alloc(64, SIZE_MAX)", NoMemory, [] { return aligned_alloc_nid_postfix(64, Max); });
-    expectNull("memalign(64, PTRDIFF_MAX + 1)", NoMemory, [] { return memalign_nid_postfix(64, HalfPlusOne); });
-    expectNull("aligned_alloc(24, 64)", InvalidArgument, [] { return aligned_alloc_nid_postfix(24, 64); });
-    expectNull("aligned_alloc(0, 64)", InvalidArgument, [] { return aligned_alloc_nid_postfix(0, 64); });
-    expectNull("memalign(24, 64)", InvalidArgument, [] { return memalign_nid_postfix(24, 64); });
+    expectNull("malloc(SIZE_MAX)", Untouched, [] { return malloc_nid_postfix(Max); });
+    expectNull("malloc(SIZE_MAX - 0x1008e)", Untouched, [] { return malloc_nid_postfix(LastPlainFailure + 1); });
+    expectNull("malloc(SIZE_MAX - 0x1008f)", InvalidArgument, [] { return malloc_nid_postfix(LastPlainFailure); });
+    expectNull("malloc(PTRDIFF_MAX + 1)", InvalidArgument, [] { return malloc_nid_postfix(HalfPlusOne); });
+    expectNull("calloc(SIZE_MAX, 2)", Untouched, [] { return calloc_nid_postfix(Max, 2); });
+    expectNull("calloc(2^33, 2^33)", Untouched, [] { return calloc_nid_postfix(std::size_t{1} << 33, std::size_t{1} << 33); });
+    expectNull("calloc(1, SIZE_MAX - 0x1008e)", Untouched, [] { return calloc_nid_postfix(1, LastPlainFailure + 1); });
+    expectNull("calloc(PTRDIFF_MAX + 1, 1)", InvalidArgument, [] { return calloc_nid_postfix(HalfPlusOne, 1); });
+    expectNull("realloc(NULL, SIZE_MAX)", Untouched, [] { return realloc_nid_postfix(nullptr, Max); });
+    expectNull("realloc(NULL, PTRDIFF_MAX + 1)", InvalidArgument, [] { return realloc_nid_postfix(nullptr, HalfPlusOne); });
+    expectNull("aligned_alloc(64, SIZE_MAX)", Untouched, [] { return aligned_alloc_nid_postfix(64, Max); });
+    expectNull("aligned_alloc(16, PTRDIFF_MAX + 1)", InvalidArgument, [] { return aligned_alloc_nid_postfix(16, HalfPlusOne); });
+    expectNull("memalign(64, PTRDIFF_MAX + 1)", InvalidArgument, [] { return memalign_nid_postfix(64, HalfPlusOne); });
+    expectNull("memalign(4096, SIZE_MAX - 0x110af)", InvalidArgument, [] { return memalign_nid_postfix(4096, Max - 0x110af); });
+    expectNull("memalign(4096, SIZE_MAX - 0x110ae)", Untouched, [] { return memalign_nid_postfix(4096, Max - 0x110ae); });
+    expectNull("memalign(100, SIZE_MAX - 0x1012f)", InvalidArgument, [] { return memalign_nid_postfix(100, Max - 0x1012f); });
+    expectNull("memalign(100, SIZE_MAX - 0x1012e)", Untouched, [] { return memalign_nid_postfix(100, Max - 0x1012e); });
+    expectNull("memalign(3, SIZE_MAX - 0x1008f)", InvalidArgument, [] { return memalign_nid_postfix(3, LastPlainFailure); });
+    expectNull("memalign(3, SIZE_MAX - 0x1008e)", Untouched, [] { return memalign_nid_postfix(3, LastPlainFailure + 1); });
+    expectNull("memalign(2^63, 16)", Untouched, [] { return memalign_nid_postfix(HalfPlusOne, 16); });
+    expectNull("memalign(SIZE_MAX, 16)", Untouched, [] { return memalign_nid_postfix(Max, 16); });
+    expectNull("memalign(2^62 + 1, 16)", InvalidArgument, [] { return memalign_nid_postfix((std::size_t{1} << 62) + 1, 16); });
+    expectNull("aligned_alloc(24, 64)", Untouched, [] { return aligned_alloc_nid_postfix(24, 64); });
+    expectNull("aligned_alloc(0, 64)", Untouched, [] { return aligned_alloc_nid_postfix(0, 64); });
+    expectNull("aligned_alloc(2^63, 16)", Untouched, [] { return aligned_alloc_nid_postfix(HalfPlusOne, 16); });
+
+    struct RoundedAlignment {
+        std::size_t requested;
+        std::size_t guaranteed;
+    };
+    for (const RoundedAlignment& alignment : {RoundedAlignment{0, 32}, RoundedAlignment{3, 32}, RoundedAlignment{24, 32}, RoundedAlignment{48, 64},
+             RoundedAlignment{100, 128}, RoundedAlignment{3000, 4096}}) {
+        void* aligned = expectBlock("memalign with an alignment that is not a power of two", [&alignment] { return memalign_nid_postfix(alignment.requested, 40); });
+        if (aligned != nullptr && reinterpret_cast<std::uintptr_t>(aligned) % alignment.guaranteed != 0) report("memalign", "did not round the alignment up to a power of two");
+        free_nid_postfix(aligned);
+
+    }
 
     auto* block = static_cast<unsigned char*>(expectBlock("malloc(40)", [] { return malloc_nid_postfix(40); }));
     if (block != nullptr) {
         std::memset(block, 0x6b, 40);
-        expectNull("realloc(block, SIZE_MAX)", NoMemory, [block] { return realloc_nid_postfix(block, Max); });
-        expectNull("realloc(block, PTRDIFF_MAX + 1)", NoMemory, [block] { return realloc_nid_postfix(block, HalfPlusOne); });
+        expectNull("realloc(block, SIZE_MAX)", Untouched, [block] { return realloc_nid_postfix(block, Max); });
+        expectNull("realloc(block, PTRDIFF_MAX + 1)", InvalidArgument, [block] { return realloc_nid_postfix(block, HalfPlusOne); });
         for (unsigned index = 0; index < 40; ++index) {
             if (block[index] != 0x6b) report("realloc failure", "damaged the original block");
         }
-        free_nid_postfix(block);
+        void* emptied = expectBlock("realloc(block, 0)", [block] { return realloc_nid_postfix(block, 0); });
+        if (emptied != block) report("realloc(block, 0)", "did not return the same block");
+        if (emptied != nullptr && malloc_usable_size_nid_postfix(emptied) != 0) report("realloc(block, 0)", "left usable bytes in the block");
+        void* regrown = expectBlock("realloc(emptied, 64)", [emptied] { return realloc_nid_postfix(emptied, 64); });
+        if (regrown != nullptr && malloc_usable_size_nid_postfix(regrown) != 64) report("realloc(emptied, 64)", "did not hold 64 bytes");
+        free_nid_postfix(regrown);
+
     }
 
 #ifdef ANYPS5_ENABLE_ASAN
@@ -153,9 +178,10 @@ int main() {
             }
             if (huge != nullptr) {
                 free_nid_postfix(huge);
+
                 committed = true;
-            } else if (*__error_nid_postfix() != NoMemory) {
-                report("malloc(300 GiB)", "returned NULL without ENOMEM");
+            } else if (*__error_nid_postfix() != InvalidArgument) {
+                report("malloc(300 GiB)", "returned NULL without EINVAL");
             } else {
                 ++failedCommits;
             }
@@ -177,7 +203,7 @@ int main() {
             std::fputs("skipped: the host can commit 300 GiB, so the failed commit and arena release checks did not run\n", stderr);
 #endif
         } else {
-            if (failedCommits != 10) report("failed heap commits", "did not return ENOMEM for all ten attempts");
+            if (failedCommits != 10) report("failed heap commits", "did not return EINVAL for all ten attempts");
             void* after = nullptr;
             try {
                 after = GuestArena::GuestArenaAllocate_nid_postfix(probeBytes, 0x4000);
@@ -192,18 +218,35 @@ int main() {
         void* small = malloc_nid_postfix(100);
         if (small == nullptr) report("malloc(100) after a failed huge malloc", "returned NULL");
         free_nid_postfix(small);
+
         void* large = malloc_nid_postfix(std::size_t{1} << 20);
         if (large == nullptr) report("malloc(1 MiB) after a failed huge malloc", "returned NULL");
         free_nid_postfix(large);
+
     }
 #endif
 
-    void* untouched = &failures;
-    *__error_nid_postfix() = 77;
-    if (posix_memalign_nid_postfix(&untouched, HalfPlusOne, 8) != NoMemory) report("posix_memalign(PTRDIFF_MAX + 1)", "did not return ENOMEM");
-    if (posix_memalign_nid_postfix(&untouched, 64, HalfPlusOne) != NoMemory) report("posix_memalign(64, PTRDIFF_MAX + 1)", "did not return ENOMEM");
-    if (posix_memalign_nid_postfix(&untouched, 64, Max) != NoMemory) report("posix_memalign(64, SIZE_MAX)", "did not return ENOMEM");
-    if (untouched != &failures || *__error_nid_postfix() != 77) report("posix_memalign failure", "touched the output or errno");
+    struct PosixCase {
+        const char* what;
+        std::size_t alignment;
+        std::size_t size;
+        int result;
+        int error;
+    };
+    for (const PosixCase& check : {PosixCase{"posix_memalign(PTRDIFF_MAX + 1, 8)", HalfPlusOne, 8, NoMemory, Untouched},
+             PosixCase{"posix_memalign(64, PTRDIFF_MAX + 1)", 64, HalfPlusOne, NoMemory, InvalidArgument},
+             PosixCase{"posix_memalign(64, SIZE_MAX)", 64, Max, NoMemory, Untouched},
+             PosixCase{"posix_memalign(64, SIZE_MAX - 0x100ef)", 64, Max - 0x100ef, NoMemory, InvalidArgument},
+             PosixCase{"posix_memalign(64, SIZE_MAX - 0x100ee)", 64, Max - 0x100ee, NoMemory, Untouched},
+             PosixCase{"posix_memalign(4, 8)", 4, 8, InvalidArgument, Untouched}, PosixCase{"posix_memalign(24, 8)", 24, 8, InvalidArgument, Untouched},
+             PosixCase{"posix_memalign(PTRDIFF_MAX + 2, 8)", HalfPlusOne + 1, 8, InvalidArgument, Untouched}}) {
+        void* untouched = &failures;
+        *__error_nid_postfix() = Untouched;
+        const int result = posix_memalign_nid_postfix(&untouched, check.alignment, check.size);
+        if (result != check.result) report(check.what, "returned the wrong error number");
+        if (*__error_nid_postfix() != check.error) report(check.what, "left the wrong errno");
+        if (untouched != &failures) report(check.what, "touched the output");
+    }
 
     free_nid_postfix(expectBlock("calloc(3, 5)", [] { return calloc_nid_postfix(3, 5); }));
     free_nid_postfix(expectBlock("calloc(0, 5)", [] { return calloc_nid_postfix(0, 5); }));
diff --git a/core/libs/tests/GuestAmmPlacement.cpp b/core/libs/tests/GuestAmmPlacement.cpp
index db65b897bf..9c05f42929 100644
--- a/core/libs/tests/GuestAmmPlacement.cpp
+++ b/core/libs/tests/GuestAmmPlacement.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include <cstdint>
@@ -5,10 +6,6 @@
 #include <exception>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceAmprAmmGetVirtualAddressRanges(std::uint64_t*, std::uint64_t*, std::uint64_t*, std::uint64_t*);
-}
-
 static void Require(bool condition, const char* message) {
     if (!condition) throw std::runtime_error(message);
 }
diff --git a/core/libs/tests/GuestAmpr.cpp b/core/libs/tests/GuestAmpr.cpp
index b17776bcd9..7b5bc20439 100644
--- a/core/libs/tests/GuestAmpr.cpp
+++ b/core/libs/tests/GuestAmpr.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestArena.hpp"
@@ -20,136 +23,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceAmprCommandBufferConstructor(Apr::CommandBufferObject*);
-int APS5_VABI sceAmprAprCommandBufferConstructor(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*);
-int APS5_VABI sceAmprCommandBufferSetBuffer(Apr::CommandBufferObject*, void*, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferReset(Apr::CommandBufferObject*);
-void* APS5_VABI sceAmprCommandBufferClearBuffer(Apr::CommandBufferObject*);
-std::uint32_t APS5_VABI sceAmprCommandBufferGetCurrentOffset(const Apr::CommandBufferObject*);
-std::uint32_t APS5_VABI sceAmprCommandBufferGetNumCommands(const Apr::CommandBufferObject*);
-int APS5_VABI sceAmprCommandBufferWriteAddressOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferPushMarker(Apr::CommandBufferObject*, const char*);
-int APS5_VABI sceAmprCommandBufferPushMarkerWithColor(Apr::CommandBufferObject*, const char*, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferPopMarker(Apr::CommandBufferObject*);
-int APS5_VABI sceAmprCommandBufferSetMarker(Apr::CommandBufferObject*, const char*);
-int APS5_VABI sceAmprCommandBufferSetMarkerWithColor(Apr::CommandBufferObject*, const char*, const std::uint32_t*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarker(const char*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarkerWithColor(const char*, std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizePopMarker();
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressOnCompletion();
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteCounterOnCompletion();
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteKernelEventQueueOnCompletion();
-void* APS5_VABI sceAmprCommandBufferGetBufferBaseAddress(const Apr::CommandBufferObject*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarker(const char*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarkerWithColor(const char*, std::uint32_t);
-int APS5_VABI sceKernelAprSubmitCommandBuffer(const Apr::CommandBufferObject*, std::uint32_t);
-int APS5_VABI sceKernelAprSubmitCommandBufferAndGetId(const Apr::CommandBufferObject*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceKernelAprWaitCommandBuffer(std::uint32_t);
-int APS5_VABI sceAmprCommandBufferWaitOnAddress(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWaitOnCounter(Apr::CommandBufferObject*, std::uint8_t, std::uint32_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteCounterOnCompletion(Apr::CommandBufferObject*, std::uint8_t, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounterOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPairOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteKernelEventQueueOnCompletion(Apr::CommandBufferObject*, std::uint64_t, std::int32_t, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferNop(Apr::CommandBufferObject*, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferNopWithData(Apr::CommandBufferObject*, std::uint32_t, const std::uint32_t*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNop(std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNopWithData(std::uint32_t);
-int APS5_VABI sceAmprCommandBufferWaitOnAddress_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t, std::uint8_t, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnAddress_04_00(volatile std::uint64_t*, std::uint64_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounter_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounter_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPair_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferWriteKernelEventQueue_04_00(Apr::CommandBufferObject*, std::uint64_t, std::int32_t, std::uint64_t, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromTimeCounter_04_00(volatile std::uint64_t*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounter_04_00(volatile std::uint64_t*, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounterPair_04_00(volatile std::uint64_t*, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWaitOnCounter_04_00(Apr::CommandBufferObject*, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteCounter_04_00(Apr::CommandBufferObject*, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnCounter_04_00(std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteCounter_04_00(std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferConstructNop(Apr::CommandBufferObject*, std::int16_t, const void*, std::uint32_t, const std::uint32_t*);
-int APS5_VABI sceAmprCommandBufferConstructMarker(Apr::CommandBufferObject*, std::uint32_t, const char*, const std::uint32_t*);
-int APS5_VABI sceKernelAprResolveFilepathsToIds(const char**, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizes(const char**, std::uint32_t, std::uint32_t*, std::uint64_t*, std::uint32_t*);
-int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizesForEach(const char**, std::uint32_t, std::uint32_t*, std::uint64_t*, int*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceAmprAprCommandBufferReadFile(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, std::uint32_t, void*, std::uint64_t, std::uint64_t);
-std::uint32_t APS5_VABI sceAmprMeasureCommandSizeReadFile();
-int APS5_VABI sceAmprAprCommandBufferReadFileGather(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAprCommandBufferReadFileScatter(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, void*, std::uint64_t);
-int APS5_VABI sceAmprAprCommandBufferReadFileGatherScatter(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, void*, std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAprCommandBufferResetGatherScatterState(Apr::CommandBufferObject*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGather(std::uint64_t, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileScatter(void*, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGatherScatter(void*, std::uint64_t, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeResetGatherScatterState();
-std::size_t APS5_VABI sceKernelGetDirectMemorySize();
-int APS5_VABI sceAmprAmmGetUsageStatsData(void*);
-int APS5_VABI sceAmprAmmCommandBufferConstructor(Apr::CommandBufferObject*);
-int APS5_VABI sceAmprAmmCommandBufferMap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferMapWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferMapDirect(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferMapDirectWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferUnmap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMap(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapWithGpuMaskId(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirect(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirectWithGpuMaskId(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeUnmap(std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAmmGiveDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceAmprAmmGetVirtualAddressRanges(std::uint64_t*, std::uint64_t*, std::uint64_t*, std::uint64_t*);
-int APS5_VABI sceAmprAmmSubmitCommandBuffer(void*, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAmprAmmSubmitCommandBuffer2(void*, std::uint32_t, std::uint32_t, std::uint64_t*, std::uint32_t*);
-int APS5_VABI sceAmprAmmSubmitCommandBuffer3(void*, std::uint32_t, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceAmprAmmWaitCommandBufferCompletion(std::uint32_t);
-int APS5_VABI sceAmprAprCommandBufferMapBegin(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAprCommandBufferMapDirectBegin(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAprCommandBufferMapEnd(Apr::CommandBufferObject*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapBegin(std::uint64_t, std::uint64_t, std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapDirectBegin(std::uint64_t, std::uint64_t, std::uint64_t, std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapEnd();
-int APS5_VABI sceKernelQueryMemoryProtection(void*, void**, void**, int*);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceAmprAmmCommandBufferMapAsPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAmmCommandBufferAllocatePaForPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferRemapIntoPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint32_t);
-int APS5_VABI sceKernelWriteModifyMtypeProtectCommand(void*, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t*);
-int APS5_VABI sceKernelWriteRemapIntoPrtCommand(std::uint32_t*, std::uint64_t, std::uint64_t, std::uint64_t, int, int, std::uint64_t*);
-int APS5_VABI sceAmprAmmCommandBufferUnmapToPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapAsPrt(std::uint64_t, std::uint64_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeAllocatePaForPrt(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferRemap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferRemapWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferMultiMap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferMultiMapWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyProtect(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyProtectWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtect(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtectWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemap(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemapWithGpuMaskId(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMap(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMapWithGpuMaskId(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtect(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtectWithGpuMaskId(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtect(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtectWithGpuMaskId(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue*, const char*);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue, KernelEvent*, int, int*, const KernelUseconds*);
-int APS5_VABI sceKernelAddAmprEvent(KernelEqueue, int, void*);
-int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue, int);
-int APS5_VABI sceKernelGetEventFilter(const KernelEvent*);
-std::uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent*);
-std::intptr_t APS5_VABI sceKernelGetEventData(const KernelEvent*);
-void* APS5_VABI sceKernelGetEventUserData(const KernelEvent*);
-}
-
 static void RequireAt(bool value, int line) {
     if (value) return;
     std::fprintf(stderr, "GuestAmpr.cpp:%d: requirement failed\n", line);
@@ -749,6 +622,7 @@ void TestReadAtUnseekableOffsetThrows() {
     bool rejected = false;
     try {
         sceKernelAprSubmitCommandBuffer(&buffer, 0);
+
     } catch (const std::runtime_error& error) {
         rejected = std::string(error.what()).find("returned 0 of 4 bytes") != std::string::npos;
     }
@@ -786,6 +660,7 @@ void TestMalformedCommandSizes() {
         bool rejected = false;
         try {
             sceKernelAprSubmitCommandBuffer(&buffer, 0);
+
         } catch (const std::runtime_error& error) {
             rejected = std::string(error.what()).starts_with(expected);
         }
@@ -805,6 +680,7 @@ void TestMalformedCommandSizes() {
     bool rejected = false;
     try {
         sceKernelAprSubmitCommandBuffer(&buffer, 0);
+
     } catch (const std::runtime_error& error) {
         rejected = std::string(error.what()).starts_with("APR: malformed command");
     }
@@ -932,7 +808,7 @@ void TestAmmRangesAboveHintedMaps() {
     constexpr std::uint64_t step = 0x400000;
     void* span = nullptr;
     Require(sceKernelReserveVirtualRange(&span, 4 * step, 0, 0) == 0);
-    Require(sceKernelMunmap(span, 4 * step) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(span), 4 * step) == 0);
     const auto heap = reinterpret_cast<std::uint64_t>(span);
     void* placed = span;
     Require(sceKernelMapFlexibleMemory(&placed, page, 3, 0) == 0 && placed == span);
@@ -952,26 +828,26 @@ void TestAmmRangesAboveHintedMaps() {
         Require(sceKernelMapFlexibleMemory(&mapped, page, 3, 0) == 0);
         Require(reinterpret_cast<std::uint64_t>(mapped) == hint);
         Require(hint + page <= start || hint >= multimapEnd);
-        Require(sceKernelMunmap(mapped, page) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     }
-    Require(sceKernelMunmap(span, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(span), page) == 0);
 }
 
 void TestAmmUsageStats() {
     std::array<std::uint64_t, 4> stats{};
     Require(sceAmprAmmGetUsageStatsData(nullptr) == static_cast<int>(0x80020016));
     stats[0] = 0x19;
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == static_cast<int>(0x80020016));
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == static_cast<int>(0x80020016));
     stats = {0x18, 0xdeadbeef, 0xdeadbeef, 0xdeadbeef};
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == 0);
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == 0);
     Require(stats[0] == 0x18);
     Require((stats[1] & 0xffffu) == 512u && (stats[1] >> 16u) == 0u);
     Require((stats[2] & 0xffffffffu) == 7u && (stats[2] >> 32u) == 0u);
     stats = {0x8, 0xdeadbeef, 0xdeadbeef, 0xdeadbeef};
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == 0);
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == 0);
     Require(stats[0] == 0x8 && stats[1] == 0xdeadbeef && stats[2] == 0xdeadbeef);
     stats = {0x0, 0xdeadbeef, 0xdeadbeef, 0xdeadbeef};
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == 0);
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == 0);
     Require(stats[0] == 0 && stats[1] == 0xdeadbeef);
 }
 
@@ -1029,7 +905,7 @@ void TestAmm() {
     RequireAppended(remaps, offset, commands, Apr::Opcode::AmmUnmap, sceAmprAmmMeasureAmmCommandSizeUnmap(automatic, 2 * page));
     Require(sceAmprAmmCommandBufferMapWithGpuMaskId(&remaps.buffer, reused, 6 * page, 0, cpuReadWrite, 1) == 0);
     std::uint64_t result = ~0ull;
-    Require(sceAmprAmmSubmitCommandBuffer2(remaps.memory.data(), remaps.Offset(), 0, &result, &id) == 0 && result == 0);
+    Require(sceAmprAmmSubmitCommandBuffer2(remaps.memory.data(), remaps.Offset(), 0, reinterpret_cast<AmmSubmitResult*>(&result), &id) == 0 && result == 0);
     Require(sceAmprAmmWaitCommandBufferCompletion(id) == 0);
     At(reused + 6 * page - 8) = 0x5555;
     Require(At(reused + 6 * page - 8) == 0x5555);
diff --git a/core/libs/tests/GuestAmprCppError.cpp b/core/libs/tests/GuestAmprCppError.cpp
index 8e2407c199..62d9843363 100644
--- a/core/libs/tests/GuestAmprCppError.cpp
+++ b/core/libs/tests/GuestAmprCppError.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
@@ -11,18 +12,16 @@
 #include <string>
 
 struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
-struct Category { const void* const* vtable; };
-struct ErrorCode { int value; const Category* category; };
-struct SystemError { const void* const* vtable; const char* message; ErrorCode code; };
-static_assert(sizeof(SystemError) == 32 && offsetof(SystemError, code) == 16);
 
-using GuestWhat = const char* (APS5_VABI *)(const SystemError*);
-using CategoryDelete = void (APS5_VABI *)(const Category*);
-using CategoryName = const char* (APS5_VABI *)(const Category*);
-using CategoryMessage = void* (APS5_VABI *)(void*, const Category*, int);
-using CategoryCondition = ErrorCode (APS5_VABI *)(const Category*, int);
-using CategoryEquivalentCondition = bool (APS5_VABI *)(const Category*, int, const ErrorCode*);
-using CategoryEquivalentCode = bool (APS5_VABI *)(const Category*, const ErrorCode*, int);
+static_assert(sizeof(LibcException::SystemErrorObject) == 32 && offsetof(LibcException::SystemErrorObject, code) == 16);
+
+using GuestWhat = const char* (APS5_VABI *)(const LibcException::SystemErrorObject*);
+using CategoryDelete = void (APS5_VABI *)(const LibcException::CategoryObject*);
+using CategoryName = const char* (APS5_VABI *)(const LibcException::CategoryObject*);
+using CategoryMessage = void* (APS5_VABI *)(void*, const LibcException::CategoryObject*, int);
+using CategoryCondition = LibcException::ErrorCode (APS5_VABI *)(const LibcException::CategoryObject*, int);
+using CategoryEquivalentCondition = bool (APS5_VABI *)(const LibcException::CategoryObject*, int, const LibcException::ErrorCode*);
+using CategoryEquivalentCode = bool (APS5_VABI *)(const LibcException::CategoryObject*, const LibcException::ErrorCode*, int);
 
 struct Expected { int value; const char* what; };
 static constexpr Expected Errors[] {
@@ -40,11 +39,7 @@ extern const unsigned char _ZTISt9exception_nid_postfix[];
 extern const unsigned char _ZTISt11logic_error_nid_postfix[];
 extern const unsigned char _ZTISt13runtime_error_nid_postfix[];
 extern const unsigned char _ZTISt12system_error_nid_postfix[];
-[[noreturn]] void APS5_VABI _ZSt16_Throw_Cpp_errori_nid_postfix(int code);
-void APS5_VABI _ZNSt12system_errorC1ERKS__nid_postfix(SystemError* self, const SystemError* source);
-SystemError* APS5_VABI _ZNSt12system_erroraSERKS__nid_postfix(SystemError* self, const SystemError* source);
-void APS5_VABI _ZNSt12system_errorD1Ev_nid_postfix(SystemError* self);
-void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
+
 void APS5_VABI GuestCatch(int code);
 
 const void* FixtureCatchType = nullptr;
@@ -71,58 +66,61 @@ static const TypeRecord* TypeOf(const void* const* vtable, int destroySlot) {
     return static_cast<const TypeRecord*>(vtable[destroySlot - 1]);
 }
 
-static void CheckCategory(const SystemError& error) {
-    const Category* category = error.code.category;
+static void CheckCategory(const LibcException::SystemErrorObject& error) {
+    const LibcException::CategoryObject* category = error.code.category;
     Require(category != nullptr, 20);
-    const TypeRecord* type = TypeOf(category->vtable, 0);
+    const TypeRecord* type = TypeOf(static_cast<const void* const*>(category->vtable), 0);
     Require(std::strcmp(type->name, "St23_Generic_error_category") == 0, 21);
     Require(type->base && std::strcmp(type->base->name, "St14error_category") == 0, 22);
-    Require(std::strcmp(Slot<CategoryName>(category->vtable, 2)(category), "generic") == 0, 23);
-    const ErrorCode condition = Slot<CategoryCondition>(category->vtable, 4)(category, error.code.value);
+    Require(std::strcmp(Slot<CategoryName>(reinterpret_cast<const void* const*>(category->vtable), 2)(category), "generic") == 0, 23);
+    const LibcException::ErrorCode condition = Slot<CategoryCondition>(reinterpret_cast<const void* const*>(category->vtable), 4)(category, error.code.value);
     Require(condition.value == error.code.value && condition.category == category, 24);
-    const ErrorCode other {error.code.value + 1, category};
-    const ErrorCode foreign {error.code.value, nullptr};
-    auto equivalentCondition = Slot<CategoryEquivalentCondition>(category->vtable, 5);
+    const LibcException::ErrorCode other {0, error.code.value + 1, category};
+    const LibcException::ErrorCode foreign {0, error.code.value, nullptr};
+    auto equivalentCondition = Slot<CategoryEquivalentCondition>(reinterpret_cast<const void* const*>(category->vtable), 5);
     Require(equivalentCondition(category, error.code.value, &condition), 25);
     Require(!equivalentCondition(category, error.code.value, &other), 26);
     Require(!equivalentCondition(category, error.code.value, &foreign), 27);
-    auto equivalentCode = Slot<CategoryEquivalentCode>(category->vtable, 6);
+    auto equivalentCode = Slot<CategoryEquivalentCode>(reinterpret_cast<const void* const*>(category->vtable), 6);
     Require(equivalentCode(category, &error.code, error.code.value), 28);
     Require(!equivalentCode(category, &error.code, error.code.value + 1), 29);
     Require(!equivalentCode(category, &foreign, error.code.value), 30);
     GuestLocale::String result {};
-    Require(Slot<CategoryMessage>(category->vtable, 3)(&result, category, error.code.value) == &result, 33);
+    Require(Slot<CategoryMessage>(reinterpret_cast<const void* const*>(category->vtable), 3)(&result, category, error.code.value) == &result, 33);
     const char* data = result.capacity <= 15 ? result.buffer : result.pointer;
     Require(std::strcmp(data, std::strstr(FixtureExpected->what, ": ") + 2) == 0, 34);
     if (result.capacity > 15) _ZdlPv_nid_postfix(result.pointer);
     bool deleteThrew = false;
     try {
-        Slot<CategoryDelete>(category->vtable, 1)(category);
+        Slot<CategoryDelete>(reinterpret_cast<const void* const*>(category->vtable), 1)(category);
     } catch (const std::invalid_argument&) {
         deleteThrew = true;
     }
     Require(deleteThrew, 32);
 }
 
-static void CheckCopies(const SystemError& error) {
-    SystemError copy {};
+static void CheckCopies(const LibcException::SystemErrorObject& error) {
+    LibcException::SystemErrorObject copy {};
     _ZNSt12system_errorC1ERKS__nid_postfix(&copy, &error);
-    Require(copy.vtable == error.vtable && copy.message == error.message, 40);
+
+    Require(copy.base.vtable == error.base.vtable && copy.base.message == error.base.message, 40);
     Require(copy.code.value == error.code.value && copy.code.category == error.code.category, 41);
-    SystemError assigned {};
+    LibcException::SystemErrorObject assigned {};
     _ZNSt12system_errorC1ERKS__nid_postfix(&assigned, &error);
-    assigned.code = {0, nullptr};
+
+    assigned.code = {0, 0, nullptr};
     Require(_ZNSt12system_erroraSERKS__nid_postfix(&assigned, &error) == &assigned, 42);
     Require(assigned.code.value == error.code.value && assigned.code.category == error.code.category, 43);
-    _ZNSt12system_errorD1Ev_nid_postfix(&assigned);
-    _ZNSt12system_errorD1Ev_nid_postfix(&copy);
-    Require(copy.message == nullptr && assigned.message == nullptr, 44);
+    _ZNSt12system_errorD1Ev_nid_postfix(&assigned.base);
+    _ZNSt12system_errorD1Ev_nid_postfix(&copy.base);
+
+    Require(copy.base.message == nullptr && assigned.base.message == nullptr, 44);
 }
 
 extern "C" void APS5_VABI FixtureInspect(void* object) {
-    const auto& error = *static_cast<const SystemError*>(object);
-    Require(std::strcmp(TypeOf(error.vtable, 0)->name, "St12system_error") == 0, 10);
-    const char* what = Slot<GuestWhat>(error.vtable, 2)(&error);
+    const auto& error = *static_cast<const LibcException::SystemErrorObject*>(object);
+    Require(std::strcmp(TypeOf(static_cast<const void* const*>(error.base.vtable), 0)->name, "St12system_error") == 0, 10);
+    const char* what = Slot<GuestWhat>(reinterpret_cast<const void* const*>(error.base.vtable), 2)(&error);
     Require(what && std::strcmp(what, FixtureExpected->what) == 0, 11);
     Require(error.code.value == FixtureExpected->value, 12);
     CheckCategory(error);
@@ -142,6 +140,7 @@ static void CheckOutOfRange(int code) {
     bool threw = false;
     try {
         _ZSt16_Throw_Cpp_errori_nid_postfix(code);
+
     } catch (const std::out_of_range& error) {
         threw = std::string(error.what()).find(std::to_string(code)) != std::string::npos;
     }
diff --git a/core/libs/tests/GuestAmprThreads.cpp b/core/libs/tests/GuestAmprThreads.cpp
index 22e2e03b60..653c2cb941 100644
--- a/core/libs/tests/GuestAmprThreads.cpp
+++ b/core/libs/tests/GuestAmprThreads.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -17,11 +21,6 @@
 #include <unistd.h>
 #endif
 
-struct GuestXtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
 struct PadTarget {
     std::atomic<int>* order;
     std::atomic<bool>* destroyed;
@@ -38,48 +37,19 @@ struct GuestTypeInfo {
 struct GuestSystemError {
     const void* vtable;
     const char* message;
+    int reserved;
     int code;
     const void* category;
 };
 
-using GuestTerminate = void (APS5_VABI*)();
-
-struct TestPad {
-    unsigned (APS5_VABI* const* vtable)(TestPad*);
-    void* condition;
-    void* mutex;
-    bool started;
+struct TestPad : GuestPad {
     PadTarget target;
 };
 
+using GuestTerminate = void (APS5_VABI*)();
+
 extern "C" {
-void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(TestPad* pad);
-void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(TestPad* pad);
-void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(TestPad* pad, Pthread* thread);
-void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(TestPad* pad);
-int APS5_VABI _Thrd_join_nid_postfix(Pthread thread, int* code);
-int APS5_VABI _Thrd_sleep_nid_postfix(const GuestXtime* target, GuestXtime* remaining);
-void APS5_VABI _Lock_shared_ptr_spin_lock_nid_postfix(void);
-void APS5_VABI _Unlock_shared_ptr_spin_lock_nid_postfix(void);
-int APS5_VABI sceAmprWcstombsS(std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI pthread_detach_nid_postfix(Pthread thread);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
-int APS5_VABI _Cnd_init_with_name_nid_postfix(void** handle, const char* name);
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_wait_nid_postfix(void** condition, void** mutex);
-int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-GuestTerminate APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(GuestTerminate handler);
-const GuestTypeInfo* APS5_VABI __cxa_current_exception_type_nid_postfix();
-void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
-LibcException::Header* APS5_VABI __cxa_init_primary_exception_nid_postfix(void* object, std::type_info* type, void (*destructor)(void*));
-[[noreturn]] void APS5_VABI __cxa_call_unexpected_nid_postfix(void* unwindException);
+
 extern const unsigned char _ZTVN10__cxxabiv117__class_type_infoE_nid_postfix[];
 }
 
@@ -106,7 +76,7 @@ static std::int64_t RealtimeNanos() {
     return now.tv_sec * NanosPerSecond + now.tv_nsec;
 }
 
-static GuestXtime XtimeAfter(std::int64_t nanos) {
+static Xtime XtimeAfter(std::int64_t nanos) {
     const auto target = RealtimeNanos() + nanos;
     return {target / NanosPerSecond, target % NanosPerSecond};
 }
@@ -134,10 +104,12 @@ static void* APS5_VABI SpinWorker(void* arg) {
     auto& context = *static_cast<SpinContext*>(arg);
     for (int iteration = 0; iteration < SpinIterations; ++iteration) {
         _Lock_shared_ptr_spin_lock_nid_postfix();
+
         if (context.inside.fetch_add(1) != 0) context.overlapped = true;
         ++context.counter;
         context.inside.fetch_sub(1);
         _Unlock_shared_ptr_spin_lock_nid_postfix();
+
     }
     return nullptr;
 }
@@ -180,12 +152,12 @@ static void TestThreadSleep() {
     Require(RealtimeNanos() - before < NanosPerSecond / 2);
 
     const auto carried = XtimeAfter(30000000);
-    const GuestXtime unnormalized{carried.sec - 2, carried.nsec + 2 * NanosPerSecond};
+    const Xtime unnormalized{carried.sec - 2, carried.nsec + 2 * NanosPerSecond};
     Require(_Thrd_sleep_nid_postfix(&unnormalized, nullptr) == 0);
     Require(RealtimeNanos() >= carried.sec * NanosPerSecond + carried.nsec);
 
     const auto borrowed = XtimeAfter(20000000);
-    const GuestXtime negative{borrowed.sec + 1, borrowed.nsec - NanosPerSecond};
+    const Xtime negative{borrowed.sec + 1, borrowed.nsec - NanosPerSecond};
     Require(_Thrd_sleep_nid_postfix(&negative, nullptr) == 0);
     Require(RealtimeNanos() >= borrowed.sec * NanosPerSecond + borrowed.nsec);
 
@@ -209,6 +181,7 @@ static void TestThreadSleep() {
     bool rejected = false;
     try {
         _Thrd_sleep_nid_postfix(nullptr, nullptr);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -224,6 +197,7 @@ static void TestSpinLock() {
     Require(context.counter == SpinThreads * SpinIterations);
     _Lock_shared_ptr_spin_lock_nid_postfix();
     _Unlock_shared_ptr_spin_lock_nid_postfix();
+
 }
 
 static void TestWcstombs() {
@@ -366,6 +340,7 @@ static void TestConditionSignal() {
     RequireThrows<std::invalid_argument>([&] { _Cnd_signal_nid_postfix(&context.mutex); });
     RequireThrows<std::invalid_argument>([] { _Cnd_init_with_name_nid_postfix(nullptr, "AmprSignal"); });
     _Cnd_destroy_nid_postfix(&context.condition);
+
     Require(context.condition == nullptr);
     RequireThrows<std::invalid_argument>([&] { _Cnd_signal_nid_postfix(&context.condition); });
 
@@ -373,24 +348,28 @@ static void TestConditionSignal() {
     Require(_Cnd_init_with_name_nid_postfix(&unnamed, nullptr) == ThrdSuccess && unnamed != nullptr);
     Require(_Cnd_signal_nid_postfix(&unnamed) == ThrdSuccess);
     _Cnd_destroy_nid_postfix(&unnamed);
+
     void* plain = nullptr;
     Require(_Cnd_init_nid_postfix(&plain) == ThrdSuccess);
     Require(_Cnd_signal_nid_postfix(&plain) == ThrdSuccess);
     _Cnd_destroy_nid_postfix(&plain);
     _Mtx_destroy_nid_postfix(&context.mutex);
+
 }
 
-static unsigned APS5_VABI PadGo(TestPad* pad) {
+static unsigned APS5_VABI PadGo(GuestPad* base) {
+    auto* pad = static_cast<TestPad*>(base);
     const auto local = pad->target;
     std::this_thread::sleep_for(std::chrono::milliseconds(20));
     local.order->store(local.beforeRelease);
     _ZNSt4_Pad8_ReleaseEv_nid_postfix(pad);
+
     while (!local.destroyed->load()) std::this_thread::yield();
     local.order->store(local.afterRelease);
     return local.exitCode;
 }
 
-static constexpr std::array<unsigned (APS5_VABI*)(TestPad*), 1> PadVtable{PadGo};
+static constexpr std::array<unsigned (APS5_VABI*)(GuestPad*), 1> PadVtable{PadGo};
 
 template <typename TException, typename TCall>
 static bool Throws(TCall call) {
@@ -406,6 +385,7 @@ static void ConstructPad(TestPad& pad, std::atomic<int>& order, std::atomic<bool
     std::memset(&pad, 0xCD, sizeof(pad));
     pad.vtable = PadVtable.data();
     _ZNSt4_PadC2Ev_nid_postfix(&pad);
+
     Require(pad.vtable == PadVtable.data());
     Require(pad.condition && pad.mutex && !pad.started);
     pad.target = {&order, &destroyed, 2 * index + 1, 2 * index + 2, exitCode};
@@ -417,11 +397,13 @@ static void TestPadLaunch() {
     TestPad pad;
     ConstructPad(pad, order, destroyed, 0, 0);
     Pthread thread = nullptr;
-    _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, &thread);
+    _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, reinterpret_cast<void**>(&thread));
+
     Require(thread != nullptr);
     Require(pad.started);
     Require(order.load() == 1);
     _ZNSt4_PadD2Ev_nid_postfix(&pad);
+
     Require(!pad.condition && !pad.mutex);
     Require(order.load() == 1);
     destroyed = true;
@@ -439,9 +421,11 @@ static void TestPadLaunchMany() {
     std::array<Pthread, Count> threads{};
     for (int index = 0; index < Count; ++index) {
         ConstructPad(pads[index], orders[index], destroyed, index, 100u + index);
-        _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pads[index], &threads[index]);
+        _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pads[index], reinterpret_cast<void**>(&threads[index]));
+
         Require(orders[index].load() == 2 * index + 1);
         _ZNSt4_PadD2Ev_nid_postfix(&pads[index]);
+
     }
     destroyed = true;
     for (int index = 0; index < Count; ++index) {
@@ -452,10 +436,12 @@ static void TestPadLaunchMany() {
     }
 }
 
-static unsigned APS5_VABI PadGoImmediate(TestPad* pad) {
+static unsigned APS5_VABI PadGoImmediate(GuestPad* base) {
+    auto* pad = static_cast<TestPad*>(base);
     const auto local = pad->target;
     local.order->store(local.beforeRelease);
     _ZNSt4_Pad8_ReleaseEv_nid_postfix(pad);
+
     while (!local.destroyed->load()) std::this_thread::yield();
     local.order->store(local.afterRelease);
     return local.exitCode;
@@ -463,7 +449,7 @@ static unsigned APS5_VABI PadGoImmediate(TestPad* pad) {
 
 static void TestPadConcurrentLaunch() {
     constexpr int Count = 4;
-    constexpr std::array<unsigned (APS5_VABI*)(TestPad*), 1> immediateVtable{PadGoImmediate};
+    constexpr std::array<unsigned (APS5_VABI*)(GuestPad*), 1> immediateVtable{PadGoImmediate};
     std::atomic<int> ready{0};
     std::array<std::thread, Count> parents;
     for (int index = 0; index < Count; ++index) {
@@ -476,9 +462,11 @@ static void TestPadConcurrentLaunch() {
             ready.fetch_add(1);
             while (ready.load() != Count) std::this_thread::yield();
             Pthread thread = nullptr;
-            _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, &thread);
+            _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, reinterpret_cast<void**>(&thread));
+
             Require(thread != nullptr && pad.started && order.load() == 2 * index + 1);
             _ZNSt4_PadD2Ev_nid_postfix(&pad);
+
             std::memset(&pad, 0xcd, sizeof(pad));
             destroyed = true;
             int code = 0;
@@ -505,7 +493,7 @@ static void* APS5_VABI DestroyPad(void* arg) {
 static void APS5_VABI ExitWithSystemErrorCode() {
     const auto* type = __cxa_current_exception_type_nid_postfix();
     const auto* error = static_cast<const GuestSystemError*>(__cxa_current_primary_exception_nid_postfix());
-    _exit(type && error && std::strcmp(type->name, "St12system_error") == 0 ? error->code : 1);
+    _exit(type && error && std::strcmp(type->name(), "St12system_error") == 0 ? error->code : 1);
 }
 
 template <typename TCall>
@@ -514,6 +502,7 @@ static int TerminateExitCode(GuestTerminate handler, TCall call) {
     Require(child >= 0);
     if (child == 0) {
         _ZSt13set_terminatePFvvE_nid_postfix(handler);
+
         call();
         _exit(2);
     }
@@ -526,7 +515,7 @@ static const GuestTypeInfo UnexpectedType{_ZTVN10__cxxabiv117__class_type_infoE_
 
 static void APS5_VABI ExitWithCaughtType() {
     const auto* type = __cxa_current_exception_type_nid_postfix();
-    _exit(type == &UnexpectedType ? 42 : type == nullptr ? 43 : 1);
+    _exit(type == reinterpret_cast<const std::type_info*>(&UnexpectedType) ? 42 : type == nullptr ? 43 : 1);
 }
 
 static void TestCallUnexpected() {
@@ -535,6 +524,7 @@ static void TestCallUnexpected() {
         auto* type = reinterpret_cast<std::type_info*>(const_cast<GuestTypeInfo*>(&UnexpectedType));
         LibcException::Header* header = __cxa_init_primary_exception_nid_postfix(object, type, nullptr);
         __cxa_call_unexpected_nid_postfix(&header->unwind);
+
     }) == 42);
     Require(TerminateExitCode(ExitWithCaughtType, [] { __cxa_call_unexpected_nid_postfix(nullptr); }) == 43);
 }
@@ -545,7 +535,7 @@ static void TestPadErrors() {
     Require(Throws<std::invalid_argument>([] { _ZNSt4_PadD2Ev_nid_postfix(nullptr); }));
     Require(Throws<std::invalid_argument>([] { _ZNSt4_Pad8_ReleaseEv_nid_postfix(nullptr); }));
     Pthread thread = nullptr;
-    Require(Throws<std::invalid_argument>([&] { _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(nullptr, &thread); }));
+    Require(Throws<std::invalid_argument>([&] { _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(nullptr, reinterpret_cast<void**>(&thread)); }));
 
     std::atomic<int> order{0};
     std::atomic<bool> destroyed{true};
@@ -563,6 +553,7 @@ static void TestPadErrors() {
     Require(context.rejected);
     Require(pad.condition && pad.mutex);
     _ZNSt4_PadD2Ev_nid_postfix(&pad);
+
     Require(!pad.condition && !pad.mutex);
     Require(Throws<std::invalid_argument>([&] { _ZNSt4_PadD2Ev_nid_postfix(&pad); }));
 }
diff --git a/core/libs/tests/GuestAppContent.cpp b/core/libs/tests/GuestAppContent.cpp
index 42be4b89b2..e1197f4a94 100644
--- a/core/libs/tests/GuestAppContent.cpp
+++ b/core/libs/tests/GuestAppContent.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAppContent/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include <chrono>
@@ -8,27 +10,6 @@
 #include <array>
 #include "ProcessParametersFixture.hpp"
 
-extern "C" {
-int APS5_VABI sceAppContentInitialize(const AppContentInitParam*, AppContentBootParam*);
-int APS5_VABI sceAppContentAddcontMount(uint32_t, const NpUnifiedEntitlementLabel*, AppContentMountPoint*);
-int APS5_VABI sceAppContentAddcontUnmount(const AppContentMountPoint*);
-int APS5_VABI sceAppContentAddcontEnqueueDownload(uint32_t, const NpUnifiedEntitlementLabel*);
-int APS5_VABI sceAppContentAddcontDelete(uint32_t, const NpUnifiedEntitlementLabel*);
-int APS5_VABI sceAppContentGetAddcontDownloadProgress(uint32_t, const NpUnifiedEntitlementLabel*, void*);
-int APS5_VABI sceAppContentTemporaryDataMount(AppContentMountPoint*);
-int APS5_VABI sceAppContentTemporaryDataMount2(uint32_t, AppContentMountPoint*);
-int APS5_VABI sceAppContentTemporaryDataUnmount(const AppContentMountPoint*);
-int APS5_VABI sceAppContentTemporaryDataFormat(const AppContentMountPoint*);
-int APS5_VABI sceAppContentTemporaryDataGetAvailableSpaceKb(const AppContentMountPoint*, size_t*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceAppContentGetAddcontInfo(uint32_t, const NpUnifiedEntitlementLabel*, void*);
-int APS5_VABI sceAppContentGetAddcontInfoList(uint32_t, void*, uint32_t, uint32_t*);
-int APS5_VABI sceAppContentDownloadDataGetAvailableSpaceKb(const AppContentMountPoint*, size_t*);
-int APS5_VABI sceAppContentDownloadDataFormat(const AppContentMountPoint*);
-int APS5_VABI sceAppContentAppParamGetInt(uint32_t, int32_t*);
-}
-
 static constexpr int ErrorParameter = static_cast<int>(0x80D90002);
 static constexpr int ErrorNotFound = static_cast<int>(0x80D90005);
 static constexpr int ErrorDrmNoEntitlement = static_cast<int>(0x80D90007);
@@ -46,7 +27,11 @@ int main() {
     Require(sceAppContentAddcontUnmount(nullptr) == notInitialized);
     Require(sceAppContentGetAddcontInfo(0, nullptr, nullptr) == notInitialized);
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, nullptr) == notInitialized);
+    Require(sceAppContentGetEntitlementKey(0, nullptr, nullptr) == notInitialized);
     Require(sceAppContentAppParamGetInt(0, nullptr) == notInitialized);
+    AppContentMountPoint uninitializedMount{};
+    Require(sceAppContentTemporaryDataMount(nullptr) == notInitialized);
+    Require(sceAppContentTemporaryDataMount(&uninitializedMount) == notInitialized);
     Require(sceAppContentTemporaryDataMount2(0, nullptr) == notInitialized);
     Require(sceAppContentTemporaryDataUnmount(nullptr) == notInitialized);
     Require(sceAppContentTemporaryDataFormat(nullptr) == notInitialized);
@@ -207,10 +192,20 @@ int main() {
     std::memset(info, 0x5a, sizeof(info));
     unsigned char untouchedInfo[24];
     std::memcpy(untouchedInfo, info, sizeof(info));
-    Require(sceAppContentGetAddcontInfo(0, &label, info) == ErrorDrmNoEntitlement);
+    Require(sceAppContentGetAddcontInfo(0, &label, reinterpret_cast<AppContentAddcontInfo*>(info)) == ErrorDrmNoEntitlement);
     Require(std::memcmp(info, untouchedInfo, sizeof(info)) == 0);
-    Require(sceAppContentGetAddcontInfo(0, nullptr, info) == ErrorParameter);
+    Require(sceAppContentGetAddcontInfo(0, nullptr, reinterpret_cast<AppContentAddcontInfo*>(info)) == ErrorParameter);
     Require(sceAppContentGetAddcontInfo(0, &label, nullptr) == ErrorParameter);
+    AppContentEntitlementKey key;
+    std::memset(&key, 0x5a, sizeof(key));
+    const AppContentEntitlementKey untouchedKey = key;
+    for (const std::uint32_t serviceLabel : {0u, 7u, 8u, 0xffffffffu}) {
+        Require(sceAppContentGetEntitlementKey(serviceLabel, &label, &key) == ErrorDrmNoEntitlement);
+        Require(std::memcmp(&key, &untouchedKey, sizeof(key)) == 0);
+    }
+    Require(sceAppContentGetEntitlementKey(0, nullptr, &key) == ErrorParameter);
+    Require(std::memcmp(&key, &untouchedKey, sizeof(key)) == 0);
+    Require(sceAppContentGetEntitlementKey(0, &label, nullptr) == ErrorParameter);
 
     for (const std::uint32_t version : {0x014fffffu, 0x01500000u, 0x034fffffu, 0x03500000u}) {
         std::memcpy(process.data() + 16, &version, sizeof(version));
@@ -220,7 +215,9 @@ int main() {
             const int infoError = version >= 0x01500000 ? ErrorParameter : ErrorDrmNoEntitlement;
             const int lateError = version >= 0x03500000 ? ErrorParameter : ErrorNotFound;
             Require(sceAppContentAddcontMount(0, &label, &mountPoint) == earlyError);
-            Require(sceAppContentGetAddcontInfo(0, &label, info) == infoError);
+            Require(sceAppContentGetAddcontInfo(0, &label, reinterpret_cast<AppContentAddcontInfo*>(info)) == infoError);
+            Require(sceAppContentGetEntitlementKey(0, &label, &key) == infoError);
+            Require(std::memcmp(&key, &untouchedKey, sizeof(key)) == 0);
             Require(sceAppContentAddcontEnqueueDownload(0, &label) == earlyError);
             Require(sceAppContentAddcontDelete(0, &label) == lateError);
             Require(sceAppContentGetAddcontDownloadProgress(0, &label, progress) == lateError);
@@ -234,18 +231,18 @@ int main() {
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, &hitNum) == 0);
     Require(hitNum == 0);
     hitNum = 0x5a5a5a5a;
-    Require(sceAppContentGetAddcontInfoList(0, info, 0, &hitNum) == 0);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 0, &hitNum) == 0);
     Require(hitNum == 0);
     hitNum = 0x5a5a5a5a;
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 1, &hitNum) == 0);
     Require(hitNum == 0);
     hitNum = 0x5a5a5a5a;
-    Require(sceAppContentGetAddcontInfoList(0, info, 1, &hitNum) == 0);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 1, &hitNum) == 0);
     Require(hitNum == 0);
     Require(std::memcmp(info, untouchedInfo, sizeof(info)) == 0);
-    Require(sceAppContentGetAddcontInfoList(0, info, 1, nullptr) == ErrorParameter);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 1, nullptr) == ErrorParameter);
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, nullptr) == ErrorParameter);
-    Require(sceAppContentGetAddcontInfoList(0, info, 0, nullptr) == ErrorParameter);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 0, nullptr) == ErrorParameter);
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 1, nullptr) == ErrorParameter);
     std::filesystem::current_path(original);
     std::filesystem::remove_all(directory);
diff --git a/core/libs/tests/GuestAppInfo.cpp b/core/libs/tests/GuestAppInfo.cpp
index 860ff13718..e1220222b5 100644
--- a/core/libs/tests/GuestAppInfo.cpp
+++ b/core/libs/tests/GuestAppInfo.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -8,16 +10,6 @@
 #include <string>
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceKernelGetAppInfo(int pid, void* info);
-int APS5_VABI getpid_nid_postfix(void);
-int APS5_VABI sceKernelUuidCreate(std::uint32_t* uuid);
-int APS5_VABI sceKernelCreateUuidV4(std::uint8_t* uuid);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 struct AppInfo {
diff --git a/core/libs/tests/GuestAppendStreams.cpp b/core/libs/tests/GuestAppendStreams.cpp
index 2fb3939330..ee44d84e7f 100644
--- a/core/libs/tests/GuestAppendStreams.cpp
+++ b/core/libs/tests/GuestAppendStreams.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -13,21 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI flock_nid_postfix(int, int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "append stream check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestAppendWrites.cpp b/core/libs/tests/GuestAppendWrites.cpp
index 7184c45d5a..806611cae1 100644
--- a/core/libs/tests/GuestAppendWrites.cpp
+++ b/core/libs/tests/GuestAppendWrites.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -12,23 +14,6 @@
 #include <utility>
 #include <vector>
 
-struct GuestIovec {
-    const void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int APS5_VABI dup_nid_postfix(int);
-}
-
 static void Check(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "append check failed at line %d\n", line);
@@ -54,17 +39,17 @@ static std::string Line(int writer, int index) {
 
 static void WriteLines(int fd, int writer) {
     for (int index = 0; index < LinesPerWriter; ++index) {
-        const std::string line = Line(writer, index);
+        std::string line = Line(writer, index);
         std::int64_t written = -1;
         if (writer == 0 || writer == 2) {
             written = sceKernelWrite(fd, line.data(), line.size());
         } else if (writer == 1) {
             written = write_nid_postfix(fd, line.data(), static_cast<std::int64_t>(line.size()));
         } else if (writer == 3) {
-            const GuestIovec parts[2]{{line.data(), 7}, {line.data() + 7, line.size() - 7}};
+            const KernelIovec parts[2]{{line.data(), 7}, {line.data() + 7, line.size() - 7}};
             written = writev_nid_postfix(fd, parts, 2);
         } else {
-            const GuestIovec parts[2]{{line.data(), 7}, {line.data() + 7, line.size() - 7}};
+            const KernelIovec parts[2]{{line.data(), 7}, {line.data() + 7, line.size() - 7}};
             written = pwritev_nid_postfix(fd, parts, 2, 0);
         }
         Require(written == static_cast<std::int64_t>(LineLength));
@@ -94,7 +79,7 @@ int main() {
     Require(contents.size() == static_cast<std::size_t>(Writers) * LinesPerWriter * LineLength);
     std::set<std::pair<int, int>> seen;
     for (std::size_t offset = 0; offset < contents.size(); offset += LineLength) {
-        const std::string line = contents.substr(offset, LineLength);
+        std::string line = contents.substr(offset, LineLength);
         int writer = -1;
         int index = -1;
         Require(std::sscanf(line.c_str(), "w%d %d ", &writer, &index) == 2);
@@ -116,8 +101,8 @@ int main() {
     Require(sceKernelLseek(first, 0, FromStart) == 0);
     Require(sceKernelPwrite(first, positioned.data(), positioned.size(), 0) == static_cast<std::int64_t>(LineLength));
     Require(sceKernelLseek(first, 0, FromCurrent) == 0);
-    const std::string gathered = Line(9, 2);
-    const GuestIovec pieces[2]{{gathered.data(), 7}, {gathered.data() + 7, gathered.size() - 7}};
+    std::string gathered = Line(9, 2);
+    const KernelIovec pieces[2]{{gathered.data(), 7}, {gathered.data() + 7, gathered.size() - 7}};
     Require(pwritev_nid_postfix(first, pieces, 2, static_cast<std::int64_t>(LineLength)) == static_cast<std::int64_t>(LineLength));
     Require(sceKernelLseek(first, 0, FromCurrent) == 0);
     const std::string appended = Contents();
diff --git a/core/libs/tests/GuestAprRead.cpp b/core/libs/tests/GuestAprRead.cpp
index a8ba636dc3..004346dbcd 100644
--- a/core/libs/tests/GuestAprRead.cpp
+++ b/core/libs/tests/GuestAprRead.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Apr/include/AprCommandBuffer.hpp"
 #include <algorithm>
@@ -14,18 +16,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelAprResolveFilepathsToIds(const char**, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceKernelAprSubmitCommandBuffer(const Apr::CommandBufferObject*, std::uint32_t);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(void*);
-}
-
 namespace {
 
 constexpr std::size_t FileBytes = (16u << 20u) + 257u;
@@ -81,13 +71,15 @@ public:
         Require(sceKernelAllocateDirectMemory(0, 13824ll << 20, MappingBytes, 0x4000, 0, &physical) == 0, "cannot allocate direct memory");
         if (sceKernelMapDirectMemory(&pointer, MappingBytes, 0x33, 0, physical, 0x4000) != 0) {
             sceKernelReleaseDirectMemory(physical, MappingBytes);
+
             throw std::runtime_error("cannot map direct memory");
         }
     }
 
     ~DirectBuffer() {
-        sceKernelMunmap(pointer, MappingBytes);
+        sceKernelMunmap(reinterpret_cast<std::uint64_t>(pointer), MappingBytes);
         sceKernelReleaseDirectMemory(physical, MappingBytes);
+
     }
 
     std::uint8_t* Data() const { return static_cast<std::uint8_t*>(pointer); }
@@ -161,9 +153,9 @@ void TestErrors(const Fixture& fixture) {
 
 void TestStreams(const Fixture& fixture) {
     constexpr int StreamCount = 600;
-    std::vector<void*> streams;
+    std::vector<FileStream*> streams;
     for (int index = 0; index < StreamCount; ++index) {
-        void* stream = fopen_nid_postfix(("apr_stream_" + std::to_string(index) + ".tmp").c_str(), "w");
+        FileStream* stream = fopen_nid_postfix(("apr_stream_" + std::to_string(index) + ".tmp").c_str(), "w");
         if (stream == nullptr) break;
         streams.push_back(stream);
     }
@@ -175,7 +167,7 @@ void TestStreams(const Fixture& fixture) {
     } catch (const std::runtime_error& failure) {
         error = failure.what();
     }
-    for (void* stream : streams) fclose_nid_postfix(stream);
+    for (FileStream* stream : streams) fclose_nid_postfix(stream);
     for (int index = 0; index < StreamCount; ++index) std::filesystem::remove("apr_stream_" + std::to_string(index) + ".tmp");
     Require(error.empty(), ("APR read failed while " + std::to_string(streams.size()) + " guest streams were open: " + error).c_str());
     Require(held, "cannot hold 600 guest fopen streams");
diff --git a/core/libs/tests/GuestArrayCallbacks.cpp b/core/libs/tests/GuestArrayCallbacks.cpp
index 92bfdfdef7..cdb9079455 100644
--- a/core/libs/tests/GuestArrayCallbacks.cpp
+++ b/core/libs/tests/GuestArrayCallbacks.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -11,19 +12,6 @@ using AllocateCallback = void* (APS5_VABI *)(std::size_t);
 using FreeCallback = void (APS5_VABI *)(void*);
 using SizedFreeCallback = void (APS5_VABI *)(void*, std::size_t);
 
-extern "C" {
-void APS5_VABI __cxa_vec_ctor_nid_postfix(void*, std::size_t, std::size_t, ElementCallback, ElementCallback);
-void APS5_VABI __cxa_vec_cctor_nid_postfix(void*, void*, std::size_t, std::size_t, CopyCallback, ElementCallback);
-void APS5_VABI __cxa_vec_dtor_nid_postfix(void*, std::size_t, std::size_t, ElementCallback);
-void APS5_VABI __cxa_vec_cleanup_nid_postfix(void*, std::size_t, std::size_t, ElementCallback);
-void* APS5_VABI __cxa_vec_new_nid_postfix(std::size_t, std::size_t, std::size_t, ElementCallback, ElementCallback);
-void* APS5_VABI __cxa_vec_new2_nid_postfix(std::size_t, std::size_t, std::size_t, ElementCallback, ElementCallback, AllocateCallback, FreeCallback);
-void* APS5_VABI __cxa_vec_new3_nid_postfix(std::size_t, std::size_t, std::size_t, ElementCallback, ElementCallback, AllocateCallback, SizedFreeCallback);
-void APS5_VABI __cxa_vec_delete_nid_postfix(void*, std::size_t, std::size_t, ElementCallback);
-void APS5_VABI __cxa_vec_delete2_nid_postfix(void*, std::size_t, std::size_t, ElementCallback, FreeCallback);
-void APS5_VABI __cxa_vec_delete3_nid_postfix(void*, std::size_t, std::size_t, ElementCallback, SizedFreeCallback);
-}
-
 namespace {
 
 constexpr std::size_t Count = 4;
@@ -104,18 +92,23 @@ void checkCookie(const void* array) {
 void checkElements() {
     reset(source.data());
     __cxa_vec_ctor_nid_postfix(source.data(), Count, ElementBytes, construct, destroy);
+
     require(constructed == Count, "constructor count is wrong");
     __cxa_vec_dtor_nid_postfix(source.data(), Count, ElementBytes, destroy);
+
     require(destroyed == Count, "destructor count is wrong");
     reset(storage.data());
     __cxa_vec_cctor_nid_postfix(storage.data(), source.data(), Count, ElementBytes, copy, destroy);
+
     require(copied == Count && std::memcmp(storage.data(), source.data(), source.size()) == 0, "copy construction failed");
     __cxa_vec_cleanup_nid_postfix(storage.data(), Count, ElementBytes, destroy);
+
     require(destroyed == Count, "cleanup count is wrong");
     __cxa_vec_ctor_nid_postfix(nullptr, Count, ElementBytes, nullptr, nullptr);
     __cxa_vec_cctor_nid_postfix(nullptr, nullptr, Count, ElementBytes, nullptr, nullptr);
     __cxa_vec_dtor_nid_postfix(nullptr, Count, ElementBytes, nullptr);
     __cxa_vec_cleanup_nid_postfix(nullptr, Count, ElementBytes, nullptr);
+
 }
 
 void checkAllocation(bool sized) {
@@ -123,6 +116,7 @@ void checkAllocation(bool sized) {
     void* array = sized
         ? __cxa_vec_new3_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, releaseSized)
         : __cxa_vec_new2_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, release);
+
     require(array == destination && constructed == Count && allocated == 1, "array allocation failed");
     checkCookie(array);
     if (sized) __cxa_vec_delete3_nid_postfix(array, ElementBytes, Padding, destroy, releaseSized);
@@ -133,6 +127,7 @@ void checkAllocation(bool sized) {
     array = sized
         ? __cxa_vec_new3_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, releaseSized)
         : __cxa_vec_new2_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, release);
+
     require(array == nullptr && allocated == 1 && constructed == 0 && freed == 0, "failed allocation invoked element callbacks");
     if (sized) __cxa_vec_delete3_nid_postfix(nullptr, ElementBytes, Padding, destroy, releaseSized);
     else __cxa_vec_delete2_nid_postfix(nullptr, ElementBytes, Padding, destroy, release);
@@ -146,8 +141,10 @@ void checkDefaultAllocation() {
     reset(static_cast<std::byte*>(array));
     __cxa_vec_ctor_nid_postfix(array, Count, ElementBytes, construct, destroy);
     __cxa_vec_delete_nid_postfix(array, ElementBytes, Padding, destroy);
+
     require(constructed == Count && destroyed == Count, "default array deletion failed");
     __cxa_vec_delete_nid_postfix(nullptr, ElementBytes, Padding, destroy);
+
 }
 
 template<typename TAction>
@@ -170,6 +167,7 @@ void checkRollback(bool sized) {
     void* array = sized
         ? __cxa_vec_new3_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, releaseSized)
         : __cxa_vec_new2_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, release);
+
     failDestroy = true;
     expectException([&] {
         if (sized) __cxa_vec_delete3_nid_postfix(array, ElementBytes, Padding, destroy, releaseSized);
@@ -183,6 +181,7 @@ void checkCopyRollback() {
     failCopy = true;
     expectException([] {
         __cxa_vec_cctor_nid_postfix(storage.data(), source.data(), Count, ElementBytes, copy, destroy);
+
     });
     require(copied == 2 && destroyed == 2, "copy constructor rollback failed");
 }
diff --git a/core/libs/tests/GuestAt9Enc.cpp b/core/libs/tests/GuestAt9Enc.cpp
index 2da60d41b3..470baa0b57 100644
--- a/core/libs/tests/GuestAt9Enc.cpp
+++ b/core/libs/tests/GuestAt9Enc.cpp
@@ -1,16 +1,9 @@
+#include "prx/libSceAt9Enc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int32_t APS5_VABI sceAt9EncClearContext(void* pAt9EncWorkArea, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncCreateEncoder(void* pAt9EncWorkArea, void* pAt9EncParam, int32_t memSize, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncEncode(void* pAt9EncWorkArea, const void* pInputBuf, void* pOutputBuf, uint32_t inputBufSize, uint32_t outputBufSize, uint32_t* pOutputDataByte, uint32_t* pUsedBufSize, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncFlush(void* pAt9EncWorkArea, void* pOutputBuf, uint32_t outputBufSize, uint32_t* pOutputDataByte, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncQueryMemSize(void* pAt9EncParam, int32_t* pMemSize, int32_t* pInternalResult);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestAtoi.cpp b/core/libs/tests/GuestAtoi.cpp
index 31d63e6ccd..0d7be20f60 100644
--- a/core/libs/tests/GuestAtoi.cpp
+++ b/core/libs/tests/GuestAtoi.cpp
@@ -1,12 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 
-extern "C" {
-int APS5_VABI atoi_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 int main() {
     struct Case {
         const char* text;
diff --git a/core/libs/tests/GuestAtomicBuiltins.cpp b/core/libs/tests/GuestAtomicBuiltins.cpp
index 43d9a0f010..7ac75e5ea4 100644
--- a/core/libs/tests/GuestAtomicBuiltins.cpp
+++ b/core/libs/tests/GuestAtomicBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,22 +6,6 @@
 #include <stdexcept>
 #include <thread>
 
-using Uint128 = unsigned __int128;
-
-extern "C" {
-void APS5_VABI __atomic_load_nid_postfix(std::size_t, void*, void*, int);
-void APS5_VABI __atomic_store_nid_postfix(std::size_t, void*, void*, int);
-void APS5_VABI __atomic_exchange_nid_postfix(std::size_t, void*, void*, void*, int);
-bool APS5_VABI __atomic_compare_exchange_nid_postfix(std::size_t, void*, void*, void*, int, int);
-bool APS5_VABI __atomic_is_lock_free_nid_postfix(std::size_t, const void*);
-Uint128 APS5_VABI __sync_fetch_and_add_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_sub_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_and_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_or_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_xor_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_lock_test_and_set_16_nid_postfix(Uint128*, Uint128);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
diff --git a/core/libs/tests/GuestAudio3dParameters.cpp b/core/libs/tests/GuestAudio3dParameters.cpp
index 4335f1ff0f..8382df155a 100644
--- a/core/libs/tests/GuestAudio3dParameters.cpp
+++ b/core/libs/tests/GuestAudio3dParameters.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdio>
@@ -5,8 +6,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" void APS5_VABI sceAudio3dGetDefaultOpenParameters(Audio3dOpenParameters* parameters);
-
 static_assert(sizeof(Audio3dOpenParameters) == 0x28);
 static_assert(offsetof(Audio3dOpenParameters, num_beds) == 0x20);
 
@@ -74,4 +73,5 @@ int main() {
     CheckInvalidDestination();
     CheckShortBuffer();
     CheckExtendedBuffer();
+    Require(sceAudio3dInitialize(-1) == static_cast<int>(0x80EA0004), "non-zero reserved parameter rejected in sceAudio3dInitialize");
 }
diff --git a/core/libs/tests/GuestAudio3dPort.cpp b/core/libs/tests/GuestAudio3dPort.cpp
index 7adbb92ede..5833c4a051 100644
--- a/core/libs/tests/GuestAudio3dPort.cpp
+++ b/core/libs/tests/GuestAudio3dPort.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <chrono>
@@ -9,29 +10,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-void APS5_VABI sceAudio3dGetDefaultOpenParameters(Audio3dOpenParameters* parameters);
-int APS5_VABI sceAudio3dInitialize(std::int64_t reserved);
-int APS5_VABI sceAudio3dTerminate();
-int APS5_VABI sceAudio3dPortOpen(int user_id, const Audio3dOpenParameters* parameters, std::uint32_t* id);
-int APS5_VABI sceAudio3dPortClose(std::uint32_t port_id);
-int APS5_VABI sceAudio3dPortSetAttribute(std::uint32_t port_id, std::uint32_t attribute_id, const void* attribute, std::size_t attribute_size);
-int APS5_VABI sceAudio3dPortGetAttributesSupported(std::uint32_t port_id, std::uint32_t* attributes, std::uint32_t* num_attributes);
-int APS5_VABI sceAudio3dPortGetQueueLevel(std::uint32_t port_id, std::uint32_t* queue_level, std::uint32_t* queue_available);
-int APS5_VABI sceAudio3dPortAdvance(std::uint32_t port_id);
-int APS5_VABI sceAudio3dPortPush(std::uint32_t port_id, std::uint32_t blocking);
-int APS5_VABI sceAudio3dPortFlush(std::uint32_t port_id);
-int APS5_VABI sceAudio3dObjectReserve(std::uint32_t port_id, std::uint32_t* object_id);
-int APS5_VABI sceAudio3dObjectUnreserve(std::uint32_t port_id, std::uint32_t object_id);
-int APS5_VABI sceAudio3dObjectSetAttributes(std::uint32_t port_id, std::uint32_t object_id, std::uint64_t num_attributes, const Audio3dAttribute* attribute_array);
-int APS5_VABI sceAudio3dBedWrite(std::uint32_t port_id, std::uint32_t num_channels, std::uint32_t format, const void* buffer, std::uint32_t num_samples);
-int APS5_VABI sceAudio3dBedWrite2(std::uint32_t port_id, std::uint32_t num_channels, std::uint32_t format, const void* buffer, std::uint32_t num_samples, std::uint32_t output_route, bool restricted);
-int APS5_VABI sceAudio3dAudioOutOpen(std::uint32_t port_id, int user_id, std::int32_t type, std::int32_t index, std::uint32_t len, std::uint32_t freq, std::uint32_t param);
-int APS5_VABI sceAudio3dAudioOutClose(std::int32_t handle);
-int APS5_VABI sceAudio3dAudioOutOutput(std::int32_t handle, const void* ptr);
-int APS5_VABI sceAudio3dAudioOutOutputs(AudioOutOutputParam* param, std::uint32_t num);
-}
-
 namespace {
 
 constexpr int INVALID_PORT = static_cast<int>(0x80EA0002);
diff --git a/core/libs/tests/GuestAudio3dSpeakerArray.cpp b/core/libs/tests/GuestAudio3dSpeakerArray.cpp
index 7ef0c9942e..4a70481074 100644
--- a/core/libs/tests/GuestAudio3dSpeakerArray.cpp
+++ b/core/libs/tests/GuestAudio3dSpeakerArray.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,23 +7,6 @@
 #include <cstdlib>
 #include <exception>
 
-struct Audio3dSpeakerArrayParameters {
-    const AudioOut2Position* positions;
-    std::uint32_t numSpeakers;
-    std::uint8_t is3d;
-    void* memory;
-    std::size_t memorySize;
-};
-
-extern "C" {
-size_t APS5_VABI sceAudio3dGetSpeakerArrayMemorySize(std::uint32_t num_speakers, std::uint8_t is_3d);
-int APS5_VABI sceAudio3dCreateSpeakerArray(AudioOut2SpeakerArrayHandle* handle, const Audio3dSpeakerArrayParameters* parameters);
-int APS5_VABI sceAudio3dDeleteSpeakerArray(AudioOut2SpeakerArrayHandle handle);
-int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, std::uint32_t num_coefficients);
-int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients2(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, std::uint32_t num_coefficients, std::uint8_t height_aware, float downmix_spread_radius);
-size_t APS5_VABI sceAudioOut2GetSpeakerArrayMemorySize(std::uint32_t num_speakers, std::uint8_t is_3d, std::uint8_t is_ambisonics);
-}
-
 namespace {
 
 constexpr int INVALID_PARAMETER = static_cast<int>(0x80EA0004);
@@ -47,6 +32,7 @@ void RequireThrows(F f, const char* message) {
 
 int main() {
     Require(sceAudio3dGetSpeakerArrayMemorySize(4, 1) == sceAudioOut2GetSpeakerArrayMemorySize(4, 1, 0), "memory size forwards to AudioOut2 without ambisonics");
+    RequireThrows([] { sceAudio3dGetSpeakerArrayMemorySize(0, 0); }, "zero speakers throws invalid_argument");
 
     const AudioOut2Position positions[4] = {{1, 1, 0}, {1, -1, 0}, {-1, 1, 0}, {-1, -1, 0}};
     alignas(16) unsigned char memory[1024] = {};
@@ -68,6 +54,7 @@ int main() {
     Require(sceAudio3dGetSpeakerArrayMixCoefficients2(handle, AudioOut2Position{1, 0, 0}, 0.0f, coefficients2, 4, 1, 0.5f) == 0, "mix coefficients 2 succeed");
     Require(coefficients2[3] == 0.0f, "mix coefficients 2 are written");
     RequireThrows([&] { sceAudio3dGetSpeakerArrayMixCoefficients(handle, AudioOut2Position{1, 0, 0}, 0.0f, coefficients, 3); }, "a coefficient count that differs from the array is rejected");
+    RequireThrows([&] { sceAudio3dGetSpeakerArrayMixCoefficients(handle, AudioOut2Position{1, 0, 0}, 0.0f, nullptr, 4); }, "null coefficients pointer throws invalid_argument");
 
     Require(sceAudio3dDeleteSpeakerArray(handle) == 0, "delete succeeds");
     RequireThrows([&] { sceAudio3dDeleteSpeakerArray(handle); }, "a deleted array is no longer valid");
diff --git a/core/libs/tests/GuestAudioIn.cpp b/core/libs/tests/GuestAudioIn.cpp
index 15caefd1ec..f968624ea3 100644
--- a/core/libs/tests/GuestAudioIn.cpp
+++ b/core/libs/tests/GuestAudioIn.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioIn/include/AudioIn.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <chrono>
@@ -11,23 +12,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioInInit();
-int APS5_VABI sceAudioInOpen(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioInHqOpen(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioInAsyncOpen(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioInOpenEx(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioInHqOpenEx(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioInSetCompressorPreGain();
-int APS5_VABI sceAudioInSetNoiseGateThreshold();
-int32_t APS5_VABI sceAudioInIsPadEmbeddedMic(int32_t);
-int32_t APS5_VABI sceAudioInGetGain(int32_t, float*);
-int32_t APS5_VABI sceAudioInGetRerouteCount(int32_t);
-int APS5_VABI sceAudioInInput(int, void*);
-int APS5_VABI sceAudioInGetSilentState(int);
-int APS5_VABI sceAudioInClose(int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
diff --git a/core/libs/tests/GuestAudioPropagation.cpp b/core/libs/tests/GuestAudioPropagation.cpp
index bc5db1f6a6..b1435209ae 100644
--- a/core/libs/tests/GuestAudioPropagation.cpp
+++ b/core/libs/tests/GuestAudioPropagation.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioPropagation/include/Api.hpp"
 #include "prx/libSceAudioPropagation/AudioPropagation.hpp"
 
 #include <cstdint>
@@ -5,6 +6,7 @@
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <limits>
 #include <stdexcept>
 
 #ifdef _WIN32
@@ -13,11 +15,6 @@
 #include <dlfcn.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceAudioPropagationPathGetNumPoints();
-int APS5_VABI sceAudioPropagationSystemLock();
-}
-
 namespace {
 
 void Require(bool condition, const char* message) {
@@ -167,13 +164,54 @@ int main() {
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceCreate(system, nullptr); }, "source without output");
     Require(sceAudioPropagationSourceSetAttributes(source, portalAttributes, 3) == 0, "source attributes failed");
     std::uint32_t count = 7;
-    Require(sceAudioPropagationSourceGetAudioPathCount(source, &count) == 0 && count == 0, "source reports audio paths");
+    Require(sceAudioPropagationSourceGetAudioPathCount(source, &count) == 0 && count == AudioPropagation::MaxPaths, "source path pool size");
     AudioPropagationHandle path = 0;
-    path = 0x1234;
-    Require(sceAudioPropagationSourceGetAudioPath(source, 0, &path) == AudioPropagation::ErrorInvalidArgument && path == 0x1234, "audio path without paths");
-    Require(sceAudioPropagationSourceGetAudioPath(source, UINT32_MAX, &path) == AudioPropagation::ErrorInvalidArgument && path == 0x1234, "audio path index range");
-    Require(sceAudioPropagationSourceGetAudioPath(source, 0, nullptr) == AudioPropagation::ErrorNullPointer, "audio path null output");
-    Require(sceAudioPropagationSourceGetAudioPath(0, 0, nullptr) == AudioPropagation::ErrorInvalidHandle, "audio path handle precedence");
+    Require(sceAudioPropagationSourceGetAudioPath(source, 0, &path) == 0 && path != 0, "path lookup immediately after source creation");
+    AudioPropagationHandle repeated = 0;
+    Require(sceAudioPropagationSourceGetAudioPath(source, 0, &repeated) == 0 && repeated == path, "path handle is unstable");
+    AudioPropagationHandle lastPath = 0;
+    Require(sceAudioPropagationSourceGetAudioPath(source, AudioPropagation::MaxPaths - 1, &lastPath) == 0 && lastPath != path, "last path slot");
+    Require(sceAudioPropagationSourceGetAudioPath(source, AudioPropagation::MaxPaths, &repeated) == AudioPropagation::ErrorInvalidArgument, "out of range path slot");
+    Require(repeated == path, "rejected path lookup changed the output");
+    Require(sceAudioPropagationSourceGetAudioPath(source, 0, nullptr) == AudioPropagation::ErrorNullPointer, "null path output");
+    Require(sceAudioPropagationSourceGetAudioPath(0, 0, nullptr) == AudioPropagation::ErrorInvalidHandle, "path lookup handle precedence");
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 0, "initial path has points");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(source, &count); }, "source used as a path");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(path, nullptr); }, "null point-count output");
+    AudioPropagation::AudioPath configured{};
+    configured.desc = {AudioPropagation::PathId, sizeof(configured)};
+    configured.pointCount = 2;
+    configured.flags = AudioPropagation::PathInvalid;
+    for (auto& point : configured.points) {
+        point.desc = {AudioPropagation::PathPointId, sizeof(point)};
+        point.gain = 1.0f;
+    }
+    configured.points[0].room = rooms[0];
+    configured.points[0].opaque[0] = std::byte{0x7f};
+    configured.opaque[0] = std::byte{0x55};
+    configured.points[0].position[0] = 3.0f;
+    Require(sceAudioPropagationSourceSetAudioPath(path, &configured, 1.0f) == 0, "path configuration");
+    configured.pointCount = 0;
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 2, "path configuration aliases caller memory");
+    configured.pointCount = 2;
+    auto badPath = configured;
+    badPath.desc.size--;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "wrong path size");
+    badPath = configured;
+    badPath.pointCount = AudioPropagation::MaxPathPoints + 1;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "too many path points");
+    badPath = configured;
+    AudioPropagationHandle pathMaterial = 0;
+    Require(sceAudioPropagationSystemRegisterMaterial(system, material, &pathMaterial) == 0, "path material creation");
+    badPath.points[0].room = pathMaterial;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "material used as a path room");
+    Require(sceAudioPropagationSystemUnregisterMaterial(pathMaterial) == 0, "path material cleanup");
+    badPath = configured;
+    badPath.points[0].position[0] = std::numeric_limits<float>::infinity();
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "nonfinite point position");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &configured, std::numeric_limits<float>::quiet_NaN()); }, "nonfinite path gain");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, nullptr, 1.0f); }, "null path data");
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 2, "rejected update changed path state");
 
     std::uint8_t rays[AudioPropagation::RaySize * 2]{};
     count = 7;
@@ -201,6 +239,13 @@ int main() {
     Require(sceAudioPropagationSystemCreate(&options, &otherMemory, &otherSystem) == 0, "second system create failed");
     AudioPropagationHandle otherSource = 0;
     Require(sceAudioPropagationSourceCreate(otherSystem, &otherSource) == 0, "second system source create failed");
+    AudioPropagationHandle foreignRoom = 0;
+    Require(sceAudioPropagationRoomCreate(otherSystem, &foreignRoom) == 0, "foreign room create failed");
+    badPath = configured;
+    badPath.points[0].room = foreignRoom;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "room from another system");
+    Require(sceAudioPropagationRoomDestroy(otherSystem, foreignRoom) == 0, "foreign room cleanup");
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 2, "cross-system rejection changed path state");
     AudioPropagationHandle secondSource = 0;
     Require(sceAudioPropagationSourceCreate(system, &secondSource) == 0, "second source create failed");
 
@@ -275,10 +320,36 @@ int main() {
     reset();
     infos[0].outputSize = 0;
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceRender(system, infos, 1); }, "render with an empty output");
+    for (const std::uint32_t format : {0u, 1u, 2u, 4u, 5u}) {
+        reset();
+        infos[0].format = format;
+        const std::size_t channels = format == 0 ? 4 : format == 1 ? 9 : format == 2 ? 16 : 8;
+        infos[0].outputSize = sizeof(float) * options.frameSamples * channels;
+        Require(sceAudioPropagationSourceRender(system, infos, 1) == 0, "render in a known format failed");
+        Require(untouched(), "empty source modified a mix in a known format");
+        infos[0].outputSize -= sizeof(float) * channels;
+        RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceRender(system, infos, 1); }, "known format accepted an undersized frame");
+        Require(untouched(), "undersized known-format output modified a mix");
+    }
     reset();
-    infos[1].format = 1;
-    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSourceRender(system, infos, 2); }, "render with an unknown format");
-    Require(untouched(), "render with an unknown format wrote an output");
+    infos[0].format = 1;
+    infos[0].outputSize = sizeof(float) * (options.frameSamples * 9 + 1);
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceRender(system, infos, 1); }, "render of a partial nine-channel frame");
+    Require(untouched(), "render of a partial frame wrote an output");
+    for (const std::uint32_t format : {3u, 6u}) {
+        reset();
+        infos[1].format = format;
+        RequireThrows<std::runtime_error>([&] { sceAudioPropagationSourceRender(system, infos, 2); }, "render with an unknown format");
+        Require(untouched(), "render with an unknown format wrote an output");
+    }
+
+    reset();
+    configured.flags = 0;
+    Require(sceAudioPropagationSourceSetAudioPath(path, &configured, 1.0f) == 0, "active path configuration");
+    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSourceRender(system, infos, 2); }, "active path silently rendered");
+    Require(untouched(), "unsupported active-path render modified output");
+    configured.flags = AudioPropagation::PathInvalid;
+    Require(sceAudioPropagationSourceSetAudioPath(path, &configured, 1.0f) == 0, "invalidating path");
 
     Require(sceAudioPropagationSourceDestroy(system, secondSource) == 0, "second source destroy failed");
     reset();
@@ -289,13 +360,18 @@ int main() {
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceDestroy(system + 16, source); }, "source destroy with another system");
     Require(sceAudioPropagationPortalDestroy(system, portal) == 0, "portal destroy failed");
     Require(sceAudioPropagationSourceDestroy(system, source) == 0, "source destroy failed");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(path, &count); }, "path survived source destruction");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(lastPath, &configured, 1.0f); }, "path update after source destruction");
     Require(sceAudioPropagationRoomDestroy(system, rooms[0]) == 0, "room destroy failed");
 
     AudioPropagationHandle lateSource = 0;
     AudioPropagationHandle lateMaterial = 0;
     Require(sceAudioPropagationSourceCreate(system, &lateSource) == 0, "late source create failed");
+    AudioPropagationHandle latePath = 0;
+    Require(sceAudioPropagationSourceGetAudioPath(lateSource, 0, &latePath) == 0 && latePath != path, "path handle reuse");
     Require(sceAudioPropagationSystemRegisterMaterial(system, material, &lateMaterial) == 0, "late material register failed");
     Require(sceAudioPropagationSystemDestroy(system) == 0, "system destroy failed");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(latePath, &count); }, "path survived system destruction");
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAttributes(lateSource, &attribute, 1); }, "source used after its system");
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationRoomDestroy(system, lateSource); }, "orphan destroyed as the wrong kind");
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceDestroy(system + 16, lateSource); }, "orphan destroyed with another system");
@@ -307,8 +383,7 @@ int main() {
     Require(sceAudioPropagationSystemCreate(&options, &memory, &system) == 0, "memory reuse after destroy failed");
     Require(sceAudioPropagationSystemDestroy(system) == 0, "second destroy failed");
 
-    RequireThrows<std::runtime_error>([&] { sceAudioPropagationPathGetNumPoints(); }, "path get num points throw");
-    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSystemLock(); }, "system lock throw");
+    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSystemLock(0); }, "system lock throw");
 
     Require(Resolve("sceAudioPropagationSystemCreate") != nullptr && Resolve("sceAudioPropagationSourceSetAudioPath") != nullptr, "export lookup");
     for (const char* name : {"sceAudioPropagationAudioPathInit", "sceAudioPropagationAudioPathPointInit", "sceAudioPropagationMaterialInit", "sceAudioPropagationPortalSettingsInit", "sceAudioPropagationRayInit", "sceAudioPropagationSourceRenderInfoInit", "sceAudioPropagationSourceSetAudioPathsParamInit", "sceAudioPropagationSystemMemoryInit", "sceAudioPropagationSystemOptionInit", "sceAudioPropagationSystem"}) {
diff --git a/core/libs/tests/GuestAudiodec.cpp b/core/libs/tests/GuestAudiodec.cpp
index 3eb7a370db..ed04f8ee5d 100644
--- a/core/libs/tests/GuestAudiodec.cpp
+++ b/core/libs/tests/GuestAudiodec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodec/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cmath>
@@ -8,15 +9,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI sceAudiodecInitLibrary(std::uint32_t);
-std::int32_t APS5_VABI sceAudiodecTermLibrary(std::uint32_t);
-std::int32_t APS5_VABI sceAudiodecCreateDecoder(AudiodecCtrl*, std::uint32_t);
-std::int32_t APS5_VABI sceAudiodecDeleteDecoder(std::int32_t);
-std::int32_t APS5_VABI sceAudiodecDecode(std::int32_t, AudiodecCtrl*);
-std::int32_t APS5_VABI sceAudiodecClearContext(std::int32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 namespace {
diff --git a/core/libs/tests/GuestAvPlayer.cpp b/core/libs/tests/GuestAvPlayer.cpp
index 54220d0b27..6b757d9121 100644
--- a/core/libs/tests/GuestAvPlayer.cpp
+++ b/core/libs/tests/GuestAvPlayer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayer/include/Api.hpp"
 #include <algorithm>
 #include <array>
 #include <chrono>
@@ -25,35 +26,6 @@
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceAvPlayer/include/AvPlayer.hpp"
 
-extern "C" {
-AvPlayerInternal* APS5_VABI sceAvPlayerInit(AvPlayerInitData*);
-int APS5_VABI sceAvPlayerInitEx(const AvPlayerInitDataEx*, AvPlayerInternal**);
-int APS5_VABI sceAvPlayerPostInit(AvPlayerInternal*, const AvPlayerPostInitData*);
-int APS5_VABI sceAvPlayerSetLogCallback(void*, void*);
-int APS5_VABI sceAvPlayerAddSource(AvPlayerInternal*, const char*);
-int APS5_VABI sceAvPlayerStreamCount(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerGetStreamInfo(AvPlayerInternal*, std::uint32_t, AvPlayerStreamInfo*);
-int APS5_VABI sceAvPlayerGetStreamInfoEx(AvPlayerInternal*, std::uint32_t, AvPlayerStreamInfoEx*);
-int APS5_VABI sceAvPlayerEnableStream(AvPlayerInternal*, std::uint32_t);
-int APS5_VABI sceAvPlayerChangeStream(AvPlayerInternal*, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAvPlayerSetAvailableBandwidth(AvPlayerInternal*, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAvPlayerStart(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerStartEx(AvPlayerInternal*, const AvPlayer::StartInfo*);
-int APS5_VABI sceAvPlayerStop(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerPause(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerResume(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerJumpToTime(AvPlayerInternal*, std::uint64_t);
-int APS5_VABI sceAvPlayerSetLooping(AvPlayerInternal*, Bool);
-int APS5_VABI sceAvPlayerSetAvSyncMode(AvPlayerInternal*, std::uint32_t);
-int APS5_VABI sceAvPlayerSetTrickSpeed(AvPlayerInternal*, std::int32_t);
-Bool APS5_VABI sceAvPlayerGetVideoDataEx(AvPlayerInternal*, AvPlayerFrameInfoEx*);
-Bool APS5_VABI sceAvPlayerGetVideoData(AvPlayerInternal*, AvPlayerFrameInfo*);
-Bool APS5_VABI sceAvPlayerGetAudioData(AvPlayerInternal*, AvPlayerFrameInfo*);
-Bool APS5_VABI sceAvPlayerIsActive(AvPlayerInternal*);
-std::uint64_t APS5_VABI sceAvPlayerCurrentTime(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerClose(AvPlayerInternal*);
-}
-
 namespace {
 
 constexpr int Width = 100;
@@ -834,6 +806,8 @@ void TestPlayback() {
     Check(sceAvPlayerPostInit(player, &post) == 0, "post init failed");
     Check(sceAvPlayerPostInit(player, nullptr) == InvalidParams, "post init accepted null data");
     Check(sceAvPlayerStreamCount(player) == OperationFailed, "stream count without a source");
+    Check(sceAvPlayerSetTrickSpeed(player, 100) == OperationFailed, "trick speed accepted without a source");
+    Check(sceAvPlayerSetTrickSpeed(player, 0) == OperationFailed, "trick speed checked the speed before the source");
     Check(!sceAvPlayerIsActive(player), "active without a source");
     Check(sceAvPlayerAddSource(player, "/app0/missing.mp4") == OperationFailed, "missing file accepted");
     Check(sceAvPlayerAddSource(player, "/app0/missing/../avplayer.mp4") == OperationFailed, "missing parent accepted");
@@ -1069,6 +1043,7 @@ void TestExtendedExports() {
     Check(sceAvPlayerSetAvailableBandwidth(player, 4000, 1000, 8000) == 0, "bandwidth rejected");
     Check(sceAvPlayerSetAvailableBandwidth(nullptr, 4000, 1000, 8000) == InvalidParams, "bandwidth accepted for a null player");
     Check(sceAvPlayerAddSource(player, "/app0/avplayer.mp4") == 0, "add source failed");
+    Check(sceAvPlayerSetAvailableBandwidth(player, 4000, 1000, 8000) == OperationFailed, "bandwidth accepted after a source");
     Check(WaitFor([&] { return events.Seen(EventReady); }), "ready event missing");
     CheckStreamInfoEx(player);
     Check(sceAvPlayerEnableStream(player, VideoStream) == 0, "enable video failed");
@@ -1090,6 +1065,8 @@ void TestExtendedExports() {
     Check(WaitFor([&] { return sceAvPlayerGetVideoDataEx(player, &frame) != 0; }), "no frame after extended restart");
     Check(frame.timestamp <= 67, "zero-position start did not restart playback");
     Check(sceAvPlayerClose(player) == 0, "close failed");
+    Check(sceAvPlayerAddSourceEx(nullptr, 0, nullptr) == InvalidParams, "null player add source rejected");
+    Check(sceAvPlayerDisableStream(nullptr, 0) == InvalidParams, "null player disable stream rejected");
 }
 
 void TestWithoutAllocators() {
@@ -1617,6 +1594,437 @@ void TestVideoSyncTolerance() {
     Check(allocations.blocks.empty(), "sync tolerance allocations leaked");
 }
 
+void TestAudioClockDriftGating() {
+    const auto open = [](Events& events) {
+        AvPlayerInitData init = InitData(&events);
+        auto* player = sceAvPlayerInit(&init);
+        Check(player != nullptr, "audio drift gating init failed");
+        Check(sceAvPlayerAddSource(player, "/app0/avplayer.mp4") == 0, "audio drift gating source failed");
+        Check(WaitFor([&] { return events.Seen(EventReady); }), "audio drift gating ready missing");
+        Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "audio drift gating audio failed");
+        Check(sceAvPlayerStart(player) == 0, "audio drift gating start failed");
+        Check(WaitFor([&] { return events.Seen(EventPlay); }), "audio drift gating play missing");
+        return player;
+    };
+    const auto close = [](AvPlayerInternal* player) {
+        Check(sceAvPlayerClose(player) == 0, "audio drift gating close failed");
+        std::lock_guard lock(allocations.mutex);
+        Check(allocations.blocks.empty(), "audio drift gating allocations leaked");
+    };
+    const auto take = [](AvPlayerInternal* player, AvPlayerFrameInfo& sound, const char* missing) {
+        Check(WaitFor([&] { return sceAvPlayerGetAudioData(player, &sound) != 0; }), missing);
+    };
+
+    std::uint64_t secondTs = 0;
+    std::uint64_t beyondTs = 0;
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "probe first audio frame missing");
+        Check(sound.timestamp == 0, "first audio frame timestamp unexpected");
+        take(player, sound, "probe second audio frame missing");
+        Check(sound.timestamp > 0 && sound.timestamp <= 30, "second audio frame timestamp unexpected");
+        secondTs = sound.timestamp;
+        Check(WaitFor([&] {
+            while (sceAvPlayerGetAudioData(player, &sound)) {
+                if (sound.timestamp > 50) {
+                    beyondTs = sound.timestamp;
+                    return true;
+                }
+            }
+            return false;
+        }), "probe audio beyond 50ms missing");
+        close(player);
+    }
+    Check(beyondTs > 50, "probe timestamps unsuitable for drift gating");
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "within-threshold first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, 0.0);
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        take(player, sound, "within-threshold second audio missing");
+        Check(sound.timestamp == secondTs, "within-threshold second timestamp changed");
+        Check(sceAvPlayerCurrentTime(player) == 0, "clock rebased despite audio being within drift threshold");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "clock-lead boundary first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(secondTs + 50));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        take(player, sound, "clock-lead boundary second audio missing");
+        Check(sound.timestamp == secondTs, "clock-lead boundary second timestamp changed");
+        Check(sceAvPlayerCurrentTime(player) == secondTs + 50, "exact 50ms clock-lead boundary rebased");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "audio-lead boundary first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(beyondTs - 50));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        Check(WaitFor([&] {
+            while (sceAvPlayerGetAudioData(player, &sound)) {
+                if (sound.timestamp >= beyondTs) return true;
+            }
+            return false;
+        }), "audio-lead boundary frame missing");
+        Check(sound.timestamp == beyondTs, "audio-lead boundary timestamp unexpected");
+        Check(sceAvPlayerCurrentTime(player) == beyondTs - 50, "exact 50ms audio-lead boundary rebased");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "clock-lead rebase first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(secondTs + 51));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        take(player, sound, "clock-lead rebase second audio missing");
+        Check(sound.timestamp == secondTs, "clock-lead rebase second timestamp changed");
+        Check(sceAvPlayerCurrentTime(player) == secondTs, "clock-lead beyond 50ms did not rebase");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "audio-lead rebase first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, 0.0);
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        Check(WaitFor([&] {
+            while (sceAvPlayerGetAudioData(player, &sound)) {
+                if (sound.timestamp > 50) return true;
+            }
+            return false;
+        }), "audio-lead rebase frame missing");
+        Check(sound.timestamp == beyondTs, "audio-lead rebase timestamp unexpected");
+        Check(sceAvPlayerCurrentTime(player) == beyondTs, "audio-lead beyond 50ms did not rebase");
+        close(player);
+    }
+}
+
+constexpr std::array<std::uint8_t, 2687> ShortAudioMovie{
+    0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70, 0x69, 0x73, 0x6f, 0x6d, 0x00, 0x00, 0x02, 0x00,
+    0x69, 0x73, 0x6f, 0x6d, 0x69, 0x73, 0x6f, 0x32, 0x61, 0x76, 0x63, 0x31, 0x6d, 0x70, 0x34, 0x31,
+    0x00, 0x00, 0x06, 0x77, 0x6d, 0x6f, 0x6f, 0x76, 0x00, 0x00, 0x00, 0x6c, 0x6d, 0x76, 0x68, 0x64,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xe8,
+    0x00, 0x00, 0x03, 0xe8, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x02, 0xe8, 0x74, 0x72, 0x61, 0x6b, 0x00, 0x00, 0x00, 0x5c,
+    0x74, 0x6b, 0x68, 0x64, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xe8, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
+    0x00, 0x40, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x65, 0x64, 0x74, 0x73,
+    0x00, 0x00, 0x00, 0x1c, 0x65, 0x6c, 0x73, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x03, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, 0x60,
+    0x6d, 0x64, 0x69, 0x61, 0x00, 0x00, 0x00, 0x20, 0x6d, 0x64, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x3c, 0x00,
+    0x55, 0xc4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x68, 0x64, 0x6c, 0x72, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x76, 0x69, 0x64, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x56, 0x69, 0x64, 0x65, 0x6f, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72,
+    0x00, 0x00, 0x00, 0x02, 0x0b, 0x6d, 0x69, 0x6e, 0x66, 0x00, 0x00, 0x00, 0x14, 0x76, 0x6d, 0x68,
+    0x64, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x24, 0x64, 0x69, 0x6e, 0x66, 0x00, 0x00, 0x00, 0x1c, 0x64, 0x72, 0x65, 0x66, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x75, 0x72, 0x6c, 0x20, 0x00, 0x00, 0x00,
+    0x01, 0x00, 0x00, 0x01, 0xcb, 0x73, 0x74, 0x62, 0x6c, 0x00, 0x00, 0x00, 0xb7, 0x73, 0x74, 0x73,
+    0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xa7, 0x61, 0x76, 0x63,
+    0x31, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x40, 0x00, 0x48, 0x00,
+    0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0xff, 0xff, 0x00,
+    0x00, 0x00, 0x2d, 0x61, 0x76, 0x63, 0x43, 0x01, 0x42, 0xc0, 0x0a, 0xff, 0xe1, 0x00, 0x16, 0x67,
+    0x42, 0xc0, 0x0a, 0xda, 0x10, 0x9b, 0x01, 0x10, 0x00, 0x00, 0x03, 0x00, 0x10, 0x00, 0x00, 0x03,
+    0x03, 0xc0, 0xf1, 0x22, 0x6a, 0x01, 0x00, 0x04, 0x68, 0xce, 0x0f, 0xc8, 0x00, 0x00, 0x00, 0x10,
+    0x70, 0x61, 0x73, 0x70, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x14,
+    0x62, 0x74, 0x72, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x1c, 0x20,
+    0x00, 0x00, 0x00, 0x18, 0x73, 0x74, 0x74, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x14, 0x73, 0x74, 0x73, 0x73,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x28,
+    0x73, 0x74, 0x73, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x18,
+    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x8c, 0x73, 0x74, 0x73, 0x7a, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x02, 0x62, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x2c, 0x73, 0x74, 0x63, 0x6f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07,
+    0x00, 0x00, 0x06, 0xbf, 0x00, 0x00, 0x09, 0x2d, 0x00, 0x00, 0x09, 0x43, 0x00, 0x00, 0x09, 0x53,
+    0x00, 0x00, 0x09, 0x69, 0x00, 0x00, 0x09, 0x79, 0x00, 0x00, 0x09, 0x8f, 0x00, 0x00, 0x02, 0xb9,
+    0x74, 0x72, 0x61, 0x6b, 0x00, 0x00, 0x00, 0x5c, 0x74, 0x6b, 0x68, 0x64, 0x00, 0x00, 0x00, 0x03,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x24, 0x65, 0x64, 0x74, 0x73, 0x00, 0x00, 0x00, 0x1c, 0x65, 0x6c, 0x73, 0x74,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc8, 0x00, 0x00, 0x04, 0x00,
+    0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x6d, 0x64, 0x69, 0x61, 0x00, 0x00, 0x00, 0x20,
+    0x6d, 0x64, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0xbb, 0x80, 0x00, 0x00, 0x25, 0x80, 0x55, 0xc4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2d,
+    0x68, 0x64, 0x6c, 0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x73, 0x6f, 0x75, 0x6e,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x53, 0x6f, 0x75, 0x6e,
+    0x64, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x00, 0x00, 0x00, 0x01, 0xdc, 0x6d, 0x69, 0x6e,
+    0x66, 0x00, 0x00, 0x00, 0x10, 0x73, 0x6d, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x24, 0x64, 0x69, 0x6e, 0x66, 0x00, 0x00, 0x00, 0x1c, 0x64, 0x72, 0x65,
+    0x66, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x75, 0x72, 0x6c,
+    0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0xa0, 0x73, 0x74, 0x62, 0x6c, 0x00, 0x00, 0x00,
+    0x7e, 0x73, 0x74, 0x73, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x6e, 0x6d, 0x70, 0x34, 0x61, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0xbb, 0x80, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x36, 0x65, 0x73, 0x64, 0x73, 0x00, 0x00, 0x00, 0x00, 0x03, 0x80, 0x80,
+    0x80, 0x25, 0x00, 0x02, 0x00, 0x04, 0x80, 0x80, 0x80, 0x17, 0x40, 0x15, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x7d, 0x00, 0x00, 0x00, 0x0b, 0xdc, 0x05, 0x80, 0x80, 0x80, 0x05, 0x11, 0x90, 0x56, 0xe5,
+    0x00, 0x06, 0x80, 0x80, 0x80, 0x01, 0x02, 0x00, 0x00, 0x00, 0x14, 0x62, 0x74, 0x72, 0x74, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x7d, 0x00, 0x00, 0x00, 0x0b, 0xdc, 0x00, 0x00, 0x00, 0x20, 0x73,
+    0x74, 0x74, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00,
+    0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x80, 0x00, 0x00, 0x00, 0x58, 0x73,
+    0x74, 0x73, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x01, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00,
+    0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x02, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x73, 0x74, 0x73, 0x7a, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x2c, 0x73, 0x74, 0x63, 0x6f, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x07, 0x00, 0x00, 0x06, 0xa7, 0x00, 0x00, 0x09, 0x21, 0x00, 0x00, 0x09, 0x37, 0x00,
+    0x00, 0x09, 0x4d, 0x00, 0x00, 0x09, 0x5d, 0x00, 0x00, 0x09, 0x73, 0x00, 0x00, 0x09, 0x83, 0x00,
+    0x00, 0x00, 0x1a, 0x73, 0x67, 0x70, 0x64, 0x01, 0x00, 0x00, 0x00, 0x72, 0x6f, 0x6c, 0x6c, 0x00,
+    0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0x00, 0x00, 0x00, 0x1c, 0x73, 0x62, 0x67,
+    0x70, 0x00, 0x00, 0x00, 0x00, 0x72, 0x6f, 0x6c, 0x6c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x0b, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x62, 0x75, 0x64, 0x74, 0x61, 0x00, 0x00, 0x00,
+    0x5a, 0x6d, 0x65, 0x74, 0x61, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x21, 0x68, 0x64, 0x6c,
+    0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6d, 0x64, 0x69, 0x72, 0x61, 0x70, 0x70,
+    0x6c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x69, 0x6c,
+    0x73, 0x74, 0x00, 0x00, 0x00, 0x25, 0xa9, 0x74, 0x6f, 0x6f, 0x00, 0x00, 0x00, 0x1d, 0x64, 0x61,
+    0x74, 0x61, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x4c, 0x61, 0x76, 0x66, 0x35, 0x38,
+    0x2e, 0x37, 0x36, 0x2e, 0x31, 0x30, 0x30, 0x00, 0x00, 0x00, 0x08, 0x66, 0x72, 0x65, 0x65, 0x00,
+    0x00, 0x03, 0xe0, 0x6d, 0x64, 0x61, 0x74, 0xde, 0x04, 0x00, 0x4c, 0x61, 0x76, 0x63, 0x35, 0x38,
+    0x2e, 0x31, 0x33, 0x34, 0x2e, 0x31, 0x30, 0x30, 0x00, 0x42, 0x20, 0x08, 0xc1, 0x18, 0x38, 0x00,
+    0x00, 0x02, 0x44, 0x06, 0x05, 0xff, 0xff, 0x40, 0xdc, 0x45, 0xe9, 0xbd, 0xe6, 0xd9, 0x48, 0xb7,
+    0x96, 0x2c, 0xd8, 0x20, 0xd9, 0x23, 0xee, 0xef, 0x78, 0x32, 0x36, 0x34, 0x20, 0x2d, 0x20, 0x63,
+    0x6f, 0x72, 0x65, 0x20, 0x31, 0x36, 0x34, 0x20, 0x2d, 0x20, 0x48, 0x2e, 0x32, 0x36, 0x34, 0x2f,
+    0x4d, 0x50, 0x45, 0x47, 0x2d, 0x34, 0x20, 0x41, 0x56, 0x43, 0x20, 0x63, 0x6f, 0x64, 0x65, 0x63,
+    0x20, 0x2d, 0x20, 0x43, 0x6f, 0x70, 0x79, 0x6c, 0x65, 0x66, 0x74, 0x20, 0x32, 0x30, 0x30, 0x33,
+    0x2d, 0x32, 0x30, 0x32, 0x31, 0x20, 0x2d, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77,
+    0x77, 0x77, 0x2e, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x6c, 0x61, 0x6e, 0x2e, 0x6f, 0x72, 0x67, 0x2f,
+    0x78, 0x32, 0x36, 0x34, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x2d, 0x20, 0x6f, 0x70, 0x74, 0x69,
+    0x6f, 0x6e, 0x73, 0x3a, 0x20, 0x63, 0x61, 0x62, 0x61, 0x63, 0x3d, 0x30, 0x20, 0x72, 0x65, 0x66,
+    0x3d, 0x31, 0x20, 0x64, 0x65, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x3d, 0x30, 0x3a, 0x30, 0x3a, 0x30,
+    0x20, 0x61, 0x6e, 0x61, 0x6c, 0x79, 0x73, 0x65, 0x3d, 0x30, 0x3a, 0x30, 0x20, 0x6d, 0x65, 0x3d,
+    0x64, 0x69, 0x61, 0x20, 0x73, 0x75, 0x62, 0x6d, 0x65, 0x3d, 0x30, 0x20, 0x70, 0x73, 0x79, 0x3d,
+    0x31, 0x20, 0x70, 0x73, 0x79, 0x5f, 0x72, 0x64, 0x3d, 0x31, 0x2e, 0x30, 0x30, 0x3a, 0x30, 0x2e,
+    0x30, 0x30, 0x20, 0x6d, 0x69, 0x78, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x66, 0x3d, 0x30, 0x20, 0x6d,
+    0x65, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x3d, 0x31, 0x36, 0x20, 0x63, 0x68, 0x72, 0x6f, 0x6d,
+    0x61, 0x5f, 0x6d, 0x65, 0x3d, 0x31, 0x20, 0x74, 0x72, 0x65, 0x6c, 0x6c, 0x69, 0x73, 0x3d, 0x30,
+    0x20, 0x38, 0x78, 0x38, 0x64, 0x63, 0x74, 0x3d, 0x30, 0x20, 0x63, 0x71, 0x6d, 0x3d, 0x30, 0x20,
+    0x64, 0x65, 0x61, 0x64, 0x7a, 0x6f, 0x6e, 0x65, 0x3d, 0x32, 0x31, 0x2c, 0x31, 0x31, 0x20, 0x66,
+    0x61, 0x73, 0x74, 0x5f, 0x70, 0x73, 0x6b, 0x69, 0x70, 0x3d, 0x31, 0x20, 0x63, 0x68, 0x72, 0x6f,
+    0x6d, 0x61, 0x5f, 0x71, 0x70, 0x5f, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x3d, 0x30, 0x20, 0x74,
+    0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x3d, 0x32, 0x20, 0x6c, 0x6f, 0x6f, 0x6b, 0x61, 0x68, 0x65,
+    0x61, 0x64, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x3d, 0x31, 0x20, 0x73, 0x6c, 0x69,
+    0x63, 0x65, 0x64, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x3d, 0x30, 0x20, 0x6e, 0x72,
+    0x3d, 0x30, 0x20, 0x64, 0x65, 0x63, 0x69, 0x6d, 0x61, 0x74, 0x65, 0x3d, 0x31, 0x20, 0x69, 0x6e,
+    0x74, 0x65, 0x72, 0x6c, 0x61, 0x63, 0x65, 0x64, 0x3d, 0x30, 0x20, 0x62, 0x6c, 0x75, 0x72, 0x61,
+    0x79, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x61, 0x74, 0x3d, 0x30, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x74,
+    0x72, 0x61, 0x69, 0x6e, 0x65, 0x64, 0x5f, 0x69, 0x6e, 0x74, 0x72, 0x61, 0x3d, 0x30, 0x20, 0x62,
+    0x66, 0x72, 0x61, 0x6d, 0x65, 0x73, 0x3d, 0x30, 0x20, 0x77, 0x65, 0x69, 0x67, 0x68, 0x74, 0x70,
+    0x3d, 0x30, 0x20, 0x6b, 0x65, 0x79, 0x69, 0x6e, 0x74, 0x3d, 0x33, 0x30, 0x20, 0x6b, 0x65, 0x79,
+    0x69, 0x6e, 0x74, 0x5f, 0x6d, 0x69, 0x6e, 0x3d, 0x33, 0x20, 0x73, 0x63, 0x65, 0x6e, 0x65, 0x63,
+    0x75, 0x74, 0x3d, 0x30, 0x20, 0x69, 0x6e, 0x74, 0x72, 0x61, 0x5f, 0x72, 0x65, 0x66, 0x72, 0x65,
+    0x73, 0x68, 0x3d, 0x30, 0x20, 0x72, 0x63, 0x3d, 0x63, 0x72, 0x66, 0x20, 0x6d, 0x62, 0x74, 0x72,
+    0x65, 0x65, 0x3d, 0x30, 0x20, 0x63, 0x72, 0x66, 0x3d, 0x32, 0x33, 0x2e, 0x30, 0x20, 0x71, 0x63,
+    0x6f, 0x6d, 0x70, 0x3d, 0x30, 0x2e, 0x36, 0x30, 0x20, 0x71, 0x70, 0x6d, 0x69, 0x6e, 0x3d, 0x30,
+    0x20, 0x71, 0x70, 0x6d, 0x61, 0x78, 0x3d, 0x36, 0x39, 0x20, 0x71, 0x70, 0x73, 0x74, 0x65, 0x70,
+    0x3d, 0x34, 0x20, 0x69, 0x70, 0x5f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x3d, 0x31, 0x2e, 0x34, 0x30,
+    0x20, 0x61, 0x71, 0x3d, 0x30, 0x00, 0x80, 0x00, 0x00, 0x00, 0x16, 0x65, 0x88, 0x84, 0x3a, 0x26,
+    0x28, 0x00, 0x09, 0x02, 0xc9, 0xc9, 0xc9, 0xd7, 0x5d, 0x75, 0xd7, 0x5d, 0x75, 0xd7, 0x5d, 0x75,
+    0xe0, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9a, 0x20, 0x36, 0x82, 0x30, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04,
+    0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x40, 0x3a, 0x82, 0x30, 0x21, 0x10, 0x04,
+    0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x60, 0x3a, 0x82, 0x30, 0x21, 0x10, 0x04,
+    0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x80,
+    0x3a, 0x82, 0x30, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xa0,
+    0x3a, 0x82, 0x30, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00,
+    0x00, 0x00, 0x06, 0x41, 0x9a, 0xc0, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xe0,
+    0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x00, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9b, 0x20, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x40, 0x3e, 0x82,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x60, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41,
+    0x9b, 0x80, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0xa0, 0x3e, 0x82, 0x30, 0x00,
+    0x00, 0x00, 0x06, 0x41, 0x9b, 0xc0, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0xe0,
+    0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x00, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9a, 0x20, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x40, 0x3e, 0x82,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x60, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41,
+    0x9a, 0x80, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xa0, 0x3e, 0x82, 0x30, 0x00,
+    0x00, 0x00, 0x06, 0x41, 0x9a, 0xc0, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xe0,
+    0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x00, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9b, 0x20, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x40, 0x3e, 0x82,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x60, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41,
+    0x9b, 0x80, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0xa0, 0x3e, 0x82, 0x30
+};
+
+void WriteShortAudioMovie() {
+    std::filesystem::create_directories("app0");
+    std::ofstream file("app0/short-audio.mp4", std::ios::binary | std::ios::trunc);
+    file.write(reinterpret_cast<const char*>(ShortAudioMovie.data()), static_cast<std::streamsize>(ShortAudioMovie.size()));
+    Check(static_cast<bool>(file), "cannot write the short audio movie");
+}
+
+void TestAudioEofClockRebase() {
+    const auto open = [](Events& events, bool hold) {
+        AvPlayerInitData init = InitData(&events);
+        auto* player = sceAvPlayerInit(&init);
+        Check(player != nullptr, "audio eof clock init failed");
+        Check(sceAvPlayerAddSource(player, "/app0/avplayer.mp4") == 0, "audio eof clock source failed");
+        Check(WaitFor([&] { return events.Seen(EventReady); }), "audio eof clock ready missing");
+        Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "audio eof clock audio failed");
+        if (hold) AvPlayer::HoldAvPlayerAudioEofForTest_nid_no_patch(player, true);
+        Check(sceAvPlayerStart(player) == 0, "audio eof clock start failed");
+        Check(WaitFor([&] { return events.Seen(EventPlay); }), "audio eof clock play missing");
+        return player;
+    };
+    const auto close = [](AvPlayerInternal* player) {
+        AvPlayer::HoldAvPlayerAudioEofForTest_nid_no_patch(player, false);
+        Check(sceAvPlayerClose(player) == 0, "audio eof clock close failed");
+        std::lock_guard lock(allocations.mutex);
+        Check(allocations.blocks.empty(), "audio eof clock allocations leaked");
+    };
+    const auto pullQueued = [](AvPlayerInternal* player) {
+        std::uint64_t timestamp = 0;
+        Check(AvPlayer::NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(player, &timestamp), "audio eof clock queue empty");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(timestamp));
+        AvPlayerFrameInfo sound{};
+        Check(sceAvPlayerGetAudioData(player, &sound) != 0, "audio eof clock drain failed");
+        Check(sound.timestamp == timestamp, "audio eof clock drained an unexpected frame");
+    };
+    const auto leaveFinalFrame = [&](AvPlayerInternal* player, bool afterEof) {
+        Check(WaitFor([&] {
+            const auto queued = AvPlayer::QueuedAvPlayerAudioForTest_nid_no_patch(player);
+            const auto ready = afterEof ? AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player) : AvPlayer::AvPlayerAudioEofHeldForTest_nid_no_patch(player);
+            if (ready && queued >= 1) return true;
+            if (queued > 1) pullQueued(player);
+            return false;
+        }), afterEof ? "audio eof before the final pull missing" : "audio eof hold missing");
+        while (AvPlayer::QueuedAvPlayerAudioForTest_nid_no_patch(player) > 1) pullQueued(player);
+    };
+    const auto pullFinal = [](AvPlayerInternal* player, AvPlayerFrameInfo& sound) {
+        std::uint64_t last = 0;
+        Check(AvPlayer::NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(player, &last), "final audio frame was not queued");
+        Check(last > 50, "final audio timestamp is inside the drift gate");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(last - 42));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        Check(sceAvPlayerGetAudioData(player, &sound) != 0, "final audio frame missing");
+        Check(sound.timestamp == last, "final audio timestamp changed");
+        return last;
+    };
+
+    {
+        Events events;
+        auto* player = open(events, true);
+        leaveFinalFrame(player, false);
+        AvPlayerFrameInfo sound{};
+        const auto last = pullFinal(player, sound);
+        Check(sceAvPlayerCurrentTime(player) == last - 42, "clock rebased before audio eof was marked");
+        AvPlayer::HoldAvPlayerAudioEofForTest_nid_no_patch(player, false);
+        Check(WaitFor([&] { return AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player); }), "audio eof was not marked");
+        Check(sceAvPlayerCurrentTime(player) == last, "clock was not reconciled after audio eof");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events, false);
+        leaveFinalFrame(player, true);
+        AvPlayerFrameInfo sound{};
+        const auto last = pullFinal(player, sound);
+        Check(sceAvPlayerCurrentTime(player) == last, "clock was not reconciled when the final frame followed eof");
+        close(player);
+    }
+}
+
+void TestAudioClockAdvancesAfterEof() {
+    WriteShortAudioMovie();
+    Events events;
+    AvPlayerInitData init = InitData(&events);
+    auto* player = sceAvPlayerInit(&init);
+    Check(player != nullptr, "audio eof advance init failed");
+    Check(sceAvPlayerAddSource(player, "/app0/short-audio.mp4") == 0, "audio eof advance source failed");
+    Check(WaitFor([&] { return events.Seen(EventReady); }), "audio eof advance ready missing");
+    Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "audio eof advance audio failed");
+    Check(sceAvPlayerStart(player) == 0, "audio eof advance start failed");
+    Check(WaitFor([&] { return events.Seen(EventPlay); }), "audio eof advance play missing");
+    AvPlayerFrameInfo sound{};
+    std::uint64_t last = 0;
+    Check(WaitFor([&] {
+        while (sceAvPlayerGetAudioData(player, &sound)) last = sound.timestamp;
+        return AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player);
+    }), "short audio did not end");
+    Check(last > 0 && last < 500, "short audio timestamp unexpected");
+    const auto before = sceAvPlayerCurrentTime(player);
+    std::this_thread::sleep_for(std::chrono::milliseconds(80));
+    for (int poll = 0; poll < 5; ++poll) sceAvPlayerGetAudioData(player, &sound);
+    const auto after = sceAvPlayerCurrentTime(player);
+    Check(after >= before + 40, "clock stopped after audio eof: " + std::to_string(before) + " to " + std::to_string(after));
+    Check(sceAvPlayerClose(player) == 0, "audio eof advance close failed");
+    std::lock_guard lock(allocations.mutex);
+    Check(allocations.blocks.empty(), "audio eof advance allocations leaked");
+}
+
+void TestTrailingVideoAfterShortAudio() {
+    WriteShortAudioMovie();
+    Events events;
+    AvPlayerInitData init = InitData(&events);
+    auto* player = sceAvPlayerInit(&init);
+    Check(player != nullptr, "trailing video init failed");
+    Check(sceAvPlayerAddSource(player, "/app0/short-audio.mp4") == 0, "trailing video source failed");
+    Check(WaitFor([&] { return events.Seen(EventReady); }), "trailing video ready missing");
+    Check(sceAvPlayerEnableStream(player, VideoStream) == 0, "trailing video stream failed");
+    Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "trailing video audio failed");
+    Check(sceAvPlayerStart(player) == 0, "trailing video start failed");
+    Check(WaitFor([&] { return events.Seen(EventPlay); }), "trailing video play missing");
+    AvPlayerFrameInfo sound{};
+    std::uint64_t last = 0;
+    Check(WaitFor([&] {
+        while (sceAvPlayerGetAudioData(player, &sound)) last = sound.timestamp;
+        return AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player);
+    }), "trailing video audio did not end");
+    Check(last > 0 && last < 500, "trailing video audio timestamp unexpected");
+    std::uint64_t latest = 0;
+    Check(WaitFor([&] {
+        sceAvPlayerGetAudioData(player, &sound);
+        sceAvPlayerCurrentTime(player);
+        AvPlayerFrameInfoEx frame{};
+        if (sceAvPlayerGetVideoDataEx(player, &frame)) latest = std::max(latest, frame.timestamp);
+        return latest > last + 100;
+    }, 3000), "trailing video was not delivered after audio eof");
+    Check(sceAvPlayerClose(player) == 0, "trailing video close failed");
+    std::lock_guard lock(allocations.mutex);
+    Check(allocations.blocks.empty(), "trailing video allocations leaked");
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -1656,6 +2064,10 @@ int main(int argc, char** argv) {
         TestLoopWarningWaitsForPlayback();
         TestEofStopLatency();
         TestVideoSyncTolerance();
+        TestAudioClockDriftGating();
+        TestAudioEofClockRebase();
+        TestAudioClockAdvancesAfterEof();
+        TestTrailingVideoAfterShortAudio();
         std::puts("AvPlayer tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/tests/GuestAvailableCpumask.cpp b/core/libs/tests/GuestAvailableCpumask.cpp
index 31775180e5..1450a36bce 100644
--- a/core/libs/tests/GuestAvailableCpumask.cpp
+++ b/core/libs/tests/GuestAvailableCpumask.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstddef>
@@ -9,28 +11,6 @@
 #include <thread>
 #include <utility>
 
-extern "C" {
-KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetaffinity(Pthread thread, KernelCpumask* mask);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI cpuset_getaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, void* mask);
-int APS5_VABI cpuset_setaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, const void* mask);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
-Pthread APS5_VABI pthread_self_nid_postfix(void);
-int APS5_VABI pthread_getaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, void* cpuset);
-int APS5_VABI pthread_setaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, const void* cpuset);
-int APS5_VABI scePthreadGetthreadid(void);
-int APS5_VABI sceKernelGetCurrentCpu(void);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int PS5_LOGICAL_CPUS = 16;
 
@@ -120,6 +100,7 @@ static void* APS5_VABI SetCpuset(void* arg) {
     std::uint64_t set[4] = {cpu | (1ull << 40), 0, 0, 0};
     result->results[0] = cpuset_setaffinity_nid_postfix(3, 1, -1, 8, set);
     scePthreadGetaffinity(scePthreadSelf(), &result->affinity[0]);
+
     set[1] = 1;
     result->results[1] = cpuset_setaffinity_nid_postfix(3, 1, -1, 16, set) == -1 && *__error_nid_postfix() == 22;
     set[1] = 0;
@@ -130,9 +111,11 @@ static void* APS5_VABI SetCpuset(void* arg) {
     const std::uint64_t unavailable[1] = {1ull << 40};
     result->results[6] = cpuset_setaffinity_nid_postfix(3, 1, -1, 8, unavailable) == -1 && *__error_nid_postfix() == 11;
     scePthreadGetaffinity(scePthreadSelf(), &result->affinity[1]);
+
     const std::uint64_t process[1] = {cpu};
     result->results[7] = cpuset_setaffinity_nid_postfix(3, 2, getpid_nid_postfix(), 8, process);
     scePthreadGetaffinity(scePthreadSelf(), &result->affinity[2]);
+
     return nullptr;
 }
 
diff --git a/core/libs/tests/GuestBacktrace.cpp b/core/libs/tests/GuestBacktrace.cpp
index 7ae55383e3..8d3f597480 100644
--- a/core/libs/tests/GuestBacktrace.cpp
+++ b/core/libs/tests/GuestBacktrace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -13,8 +14,7 @@
 #include <vector>
 
 extern "C" {
-int APS5_VABI sceLibcBacktraceGetBufferSize_nid_postfix(int, int*, std::size_t*);
-int APS5_VABI sceLibcBacktraceSelf_nid_postfix(int, void*, std::size_t, int*);
+
 #if defined(_WIN32)
 std::string BacktraceModulePath_nid_no_patch(HMODULE, std::size_t);
 #endif
diff --git a/core/libs/tests/GuestBadOptionalAccess.cpp b/core/libs/tests/GuestBadOptionalAccess.cpp
index a4280e3ef5..0b9d8edfe9 100644
--- a/core/libs/tests/GuestBadOptionalAccess.cpp
+++ b/core/libs/tests/GuestBadOptionalAccess.cpp
@@ -1,19 +1,18 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
 struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
-struct Object { const void* vtable; const char* message; };
-struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const char* (APS5_VABI *what)(const Object*); };
+
+struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const char* (APS5_VABI *what)(const LibcException::ExceptionObject*); };
 
 extern "C" {
 extern const TypeRecord _ZTISt9exception_nid_postfix;
 extern const TypeRecord _ZTISt19bad_optional_access_nid_postfix;
 extern const Vtable _ZTVSt19bad_optional_access_nid_postfix;
-void APS5_VABI _ZNSt19bad_optional_accessC1Ev_nid_postfix(Object*);
-void APS5_VABI _ZNSt19bad_optional_accessD1Ev_nid_postfix(Object*);
-[[noreturn]] void APS5_VABI _ZSt26_Throw_bad_optional_accessv_nid_postfix();
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -24,14 +23,17 @@ int main() {
     Require(type.base == &_ZTISt9exception_nid_postfix);
     const auto& table = _ZTVSt19bad_optional_access_nid_postfix;
     Require(table.offset == 0 && table.type == &type && table.what != nullptr);
-    Object object{};
+    LibcException::ExceptionObject object{};
     _ZNSt19bad_optional_accessC1Ev_nid_postfix(&object);
+
     Require(object.vtable == &table.destroy);
     Require(std::strcmp(table.what(&object), "bad_optional_access") == 0);
     _ZNSt19bad_optional_accessD1Ev_nid_postfix(&object);
+
     bool thrown = false;
     try {
         _ZSt26_Throw_bad_optional_accessv_nid_postfix();
+
     } catch (...) {
         thrown = true;
     }
diff --git a/core/libs/tests/GuestBessel.cpp b/core/libs/tests/GuestBessel.cpp
index 75c94ec4ac..4ff093ad18 100644
--- a/core/libs/tests/GuestBessel.cpp
+++ b/core/libs/tests/GuestBessel.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cerrno>
@@ -10,16 +11,6 @@
 #include <iterator>
 #include <limits>
 
-extern "C" {
-double APS5_VABI j0_nid_postfix(double);
-double APS5_VABI j1_nid_postfix(double);
-double APS5_VABI jn_nid_postfix(int, double);
-double APS5_VABI y0_nid_postfix(double);
-double APS5_VABI y1_nid_postfix(double);
-double APS5_VABI yn_nid_postfix(int, double);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static double Value(std::uint64_t bits) { return std::bit_cast<double>(bits); }
@@ -96,10 +87,35 @@ static void CheckSecondKind() {
         y0_nid_postfix(input);
         y1_nid_postfix(input);
         yn_nid_postfix(3, input);
+
         Require(std::fetestexcept(FE_DIVBYZERO | FE_INVALID) == 0);
     }
 }
 
+static void CheckFloatSecondKindZero() {
+    const char* names[] = {"y0f", "y1f", "ynf"};
+    for (int function = 0; function < 3; ++function) {
+        for (const int order : {INT_MIN, -3, -2, -1, 0, 1, 2, 3, INT_MAX}) {
+            for (const float input : {0.0f, -0.0f}) {
+                for (const int flags : {0, FE_INEXACT, FE_DIVBYZERO}) {
+                    std::feclearexcept(FE_ALL_EXCEPT);
+                    std::feraiseexcept(flags);
+                    const int expectedFlags = std::fetestexcept(FE_ALL_EXCEPT);
+                    *__error_nid_postfix() = 12345;
+                    const float result = function == 0 ? y0f_nid_postfix(input) : function == 1 ? y1f_nid_postfix(input) : ynf_nid_postfix(order, input);
+                    const int actualFlags = std::fetestexcept(FE_ALL_EXCEPT);
+                    if (std::bit_cast<std::uint32_t>(result) != 0xff800000u || actualFlags != expectedFlags || *__error_nid_postfix() != 12345) {
+                        std::fprintf(stderr, "Guest %s(%d, %08x): result %08x, flags %x, expected %x, errno %d\n", names[function], order,
+                                     std::bit_cast<std::uint32_t>(input), std::bit_cast<std::uint32_t>(result), actualFlags, expectedFlags, *__error_nid_postfix());
+                        std::abort();
+                    }
+                }
+            }
+        }
+    }
+    std::feclearexcept(FE_ALL_EXCEPT);
+}
+
 static void CheckIntegerOrders() {
     const OrderCase first[] = {
         {2, 0x3ddb7cdfd9d7bdbbull, 0x3b979ca10c924224ull}, {5, 0xbddb7cdfd9d7bdbbull, 0xb4cfed4f3ec0c466ull}, {33, 0x3e00000000000000ull, 0x0000000000000000ull},
@@ -181,6 +197,7 @@ static void CheckValues() {
 int main() {
     CheckFirstKind();
     CheckSecondKind();
+    CheckFloatSecondKindZero();
     CheckIntegerOrders();
     CheckValues();
     return 0;
diff --git a/core/libs/tests/GuestBinaryWord.cpp b/core/libs/tests/GuestBinaryWord.cpp
index 2720a1f894..cfb2f004f0 100644
--- a/core/libs/tests/GuestBinaryWord.cpp
+++ b/core/libs/tests/GuestBinaryWord.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -10,22 +11,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI getw_nid_postfix(FileStream*);
-int APS5_VABI putw_nid_postfix(int, FileStream*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-int APS5_VABI ungetc_nid_postfix(int, FileStream*);
-int APS5_VABI fgetc_nid_postfix(FileStream*);
-void APS5_VABI clearerr_nid_postfix(FileStream*);
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-}
-
 namespace {
 
 void Require(bool condition, const char* message) {
@@ -75,6 +60,7 @@ void CheckShortReads(const char* path) {
         Require((stream->GuestState().flags & 0x60) == 0x20, "short-read EOF flag");
         Require(ftell_nid_postfix(stream) == static_cast<std::int64_t>(length), "consume incomplete word bytes");
         clearerr_nid_postfix(stream);
+
         Require((stream->GuestState().flags & 0x60) == 0, "clear short-read status");
         Require(fclose_nid_postfix(stream) == 0, "close incomplete word");
     }
@@ -107,8 +93,10 @@ void CheckConcurrentWrites(const char* path) {
     auto* stream = fopen_nid_postfix(path, "w+b");
     Require(stream != nullptr, "open shared stream");
     flockfile_nid_postfix(stream);
+
     Require(putw_nid_postfix(0, stream) == 0, "putw accepts a lock held by its caller");
     funlockfile_nid_postfix(stream);
+
     const auto writer = [stream](int value) {
         for (int count = 0; count < 256; ++count)
             Require(putw_nid_postfix(value, stream) == 0, "concurrent word write");
diff --git a/core/libs/tests/GuestBluetoothHid.cpp b/core/libs/tests/GuestBluetoothHid.cpp
index fb37aa3c23..fbc4db06e2 100644
--- a/core/libs/tests/GuestBluetoothHid.cpp
+++ b/core/libs/tests/GuestBluetoothHid.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBluetoothHid/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -6,36 +7,6 @@
 #include <cstdlib>
 #include <stdexcept>
 
-struct BluetoothHidEvent;
-struct BluetoothHidDeviceInfo;
-struct BluetoothHidThreadParam {
-    std::int32_t priority;
-    std::uint32_t padding;
-    std::uint64_t affinityMask;
-    std::uint32_t reserved;
-    std::uint32_t tailPadding;
-};
-struct BluetoothHidParam {
-    const BluetoothHidThreadParam* threadParam;
-    std::uint32_t reserved;
-    std::uint32_t padding;
-};
-using BluetoothHidCallback = void (APS5_VABI *)(const BluetoothHidEvent*, std::int32_t, void*);
-
-extern "C" {
-std::int32_t APS5_VABI sceBluetoothHidInit();
-std::int32_t APS5_VABI sceBluetoothHidRegisterCallback(BluetoothHidCallback callback, void* userData, const BluetoothHidParam* param);
-std::int32_t APS5_VABI sceBluetoothHidUnregisterCallback();
-std::int32_t APS5_VABI sceBluetoothHidRegisterDevice(std::uint16_t vendorId, std::uint16_t productId);
-std::int32_t APS5_VABI sceBluetoothHidUnregisterDevice(std::uint16_t vendorId, std::uint16_t productId);
-int APS5_VABI sceBluetoothHidGetInputReport(std::uint64_t, std::uint8_t);
-int APS5_VABI sceBluetoothHidDebugGetVersion();
-int APS5_VABI sceBluetoothHidGetDeviceInfo(std::int32_t, BluetoothHidDeviceInfo*);
-int APS5_VABI sceBluetoothHidDisconnectDevice(std::int32_t);
-int APS5_VABI sceBluetoothHidGetFeatureReport(std::uint64_t, std::uint8_t);
-int APS5_VABI sceBluetoothHidSetFeatureReport(std::uint64_t, std::uint8_t, const void*, std::size_t);
-}
-
 namespace {
 
 int callbackCalls = 0;
@@ -82,6 +53,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidGetInputReport(0, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -90,6 +62,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidGetDeviceInfo(0, nullptr);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -97,6 +70,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidDisconnectDevice(0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -104,6 +78,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidGetFeatureReport(0, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -111,6 +86,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidSetFeatureReport(0, 0, nullptr, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestBoundsChecking.cpp b/core/libs/tests/GuestBoundsChecking.cpp
index 2fe88a5685..fb7977eaa8 100644
--- a/core/libs/tests/GuestBoundsChecking.cpp
+++ b/core/libs/tests/GuestBoundsChecking.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -8,19 +9,8 @@
 #include <fstream>
 #include <string>
 
-using GuestContextCompare = int (APS5_VABI*)(const void*, const void*, void*);
-
 extern "C" {
-void* APS5_VABI set_constraint_handler_s_nid_postfix(void*);
-void* APS5_VABI bsearch_s_nid_postfix(const void*, const void*, std::size_t, std::size_t, GuestContextCompare, void*);
-std::uint16_t* APS5_VABI wcstok_s_nid_postfix(std::uint16_t*, std::size_t*, const std::uint16_t*, std::uint16_t**);
-int APS5_VABI wctomb_s_nid_postfix(int*, char*, std::size_t, std::uint16_t);
-int APS5_VABI wcrtomb_s_nid_postfix(std::size_t*, char*, std::size_t, std::uint16_t, void*);
-int APS5_VABI mbstowcs_s_nid_postfix(std::size_t*, std::uint16_t*, std::size_t, const char*, std::size_t);
-int APS5_VABI mbsrtowcs_s_nid_postfix(std::size_t*, std::uint16_t*, std::size_t, const char**, std::size_t, void*);
-char* APS5_VABI gets_s_nid_postfix(char*, std::size_t);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
+
 extern FileStream* __stdinp_nid_postfix;
 }
 
@@ -238,6 +228,7 @@ void CheckGets(const char* path) {
     RequireViolation(before, "gets_s: bad argument", 22);
     __stdinp_nid_postfix = saved;
     fclose_nid_postfix(stream);
+
     std::remove(path);
 }
 
@@ -246,6 +237,7 @@ void CheckGets(const char* path) {
 int main(int argc, char** argv) {
     Require(argc > 1, "usage: guest_bounds_checking_tests <scratch file>");
     set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(RecordConstraint));
+
     CheckBsearch();
     CheckWcstok();
     CheckWideToMultibyte();
diff --git a/core/libs/tests/GuestCallTrace.cpp b/core/libs/tests/GuestCallTrace.cpp
index 6fc77ae658..6721aaddac 100644
--- a/core/libs/tests/GuestCallTrace.cpp
+++ b/core/libs/tests/GuestCallTrace.cpp
@@ -12,8 +12,12 @@
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
 #include <memory>
 #include <source_location>
+#include <string>
 #include <thread>
 #include <vector>
 
@@ -199,4 +203,16 @@ int main(int argc, char** argv) {
     Require(owned == Window);
     Require(CopyCallCounts_nid_no_patch(counts, 1, &total) == 1 && total == 8 + Workers * Calls);
     Require(counts[0].calls == 1 + Workers * Calls && std::strcmp(counts[0].name, "Integers") == 0);
+
+    const auto path = std::filesystem::temp_directory_path() / ("guest_call_trace_counts_" + std::to_string(CurrentThread()) + ".txt");
+    const auto utf8 = path.u8string();
+    Require(WriteCallCounts_nid_no_patch(reinterpret_cast<const char*>(utf8.c_str())));
+    std::ifstream written(path, std::ios::binary);
+    const std::string text{std::istreambuf_iterator<char>(written), std::istreambuf_iterator<char>()};
+    written.close();
+    Require(text == std::to_string(1 + Workers * Calls) + " libTraced.prx Integers\n3 libTraced.prx Blocks\n2 libTraced Doubles\n1 libOther.prx Mixed\n1 libOther Variadic\n");
+    const auto unwritable = (path / "file").u8string();
+    Require(!WriteCallCounts_nid_no_patch(reinterpret_cast<const char*>(unwritable.c_str())));
+    Require(!WriteCallCounts_nid_no_patch(nullptr) && !WriteCallCounts_nid_no_patch(""));
+    std::filesystem::remove(path);
 }
diff --git a/core/libs/tests/GuestCamera.cpp b/core/libs/tests/GuestCamera.cpp
index 95647e9a97..c074795e23 100644
--- a/core/libs/tests/GuestCamera.cpp
+++ b/core/libs/tests/GuestCamera.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCamera/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,20 +6,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceCameraIsAttached(std::int32_t index);
-int APS5_VABI sceCameraOpen(void);
-int APS5_VABI sceCameraClose(void);
-int APS5_VABI sceCameraStart(void);
-int APS5_VABI sceCameraStop(void);
-int APS5_VABI sceCameraGetConfig(void);
-int APS5_VABI sceCameraSetConfig(void);
-int APS5_VABI sceCameraSetAttribute(void);
-int APS5_VABI sceCameraGetDeviceInfo(void);
-int APS5_VABI sceCameraGetFrameData(void);
-int APS5_VABI sceCameraIsValidFrameData(void);
-}
-
 namespace {
 
 constexpr int ErrorParam = static_cast<int>(0x802E0000u);
diff --git a/core/libs/tests/GuestCes.cpp b/core/libs/tests/GuestCes.cpp
index de0903e090..b978d9f935 100644
--- a/core/libs/tests/GuestCes.cpp
+++ b/core/libs/tests/GuestCes.cpp
@@ -1,57 +1,12 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
 #include <cstddef>
 #include <cstdint>
 #include <initializer_list>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1252(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1251(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1250(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_1(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_2(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_4(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_5(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_9(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_10(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_13(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_14(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_15(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_16(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp437(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp737(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp775(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp850(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp852(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp855(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp860(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp861(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp862(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp863(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp865(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp866(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8R(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8U(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1254(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1256(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1258(void);
-int APS5_VABI sceCesMbcsUcsContextInit(void*, const void*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-int APS5_VABI sceCesUtf8StrToMbcsStr(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8StrGetMbcsLen(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUtf8Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrGetUtf8Len(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesUcs2StrToMbcsStr(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUcs2StrGetMbcsLen(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUcs2Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrGetUcs2Len(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesEucJpToUcs2(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
-int APS5_VABI sceCesSbcToUtf8(const std::uint8_t*, std::uint8_t, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8ToSbc(const std::uint8_t*, std::uint32_t, std::uint32_t*, const std::uint8_t*, std::uint8_t*);
-void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void RequireSbcToUtf8(const std::uint8_t* profile, std::uint8_t sbc, const char* expected) {
@@ -75,6 +30,320 @@ static int Utf8ToSbc(const std::uint8_t* profile, const char* utf8, std::uint32_
     return sceCesUtf8ToSbc(reinterpret_cast<const std::uint8_t*>(utf8), utf8max, &length, profile, &sbc);
 }
 
+static void RequireSbcRoundTrip(const std::uint8_t* profile, std::initializer_list<int> unassigned) {
+    constexpr int unassignedCode = static_cast<int>(0x805C0020);
+    for (int sbc = 1; sbc < 256; ++sbc) {
+        std::uint8_t utf8[4] = {};
+        std::uint32_t length = 7;
+        std::uint8_t back = 0;
+        if (std::find(unassigned.begin(), unassigned.end(), sbc) != unassigned.end()) {
+            Require(sceCesSbcToUtf8(profile, static_cast<std::uint8_t>(sbc), utf8, sizeof(utf8), &length) == unassignedCode && length == 0);
+            continue;
+        }
+        Require(sceCesSbcToUtf8(profile, static_cast<std::uint8_t>(sbc), utf8, sizeof(utf8), &length) == 0);
+        Require(sceCesUtf8ToSbc(utf8, length, &length, profile, &back) == 0 && back == sbc);
+    }
+}
+
+struct MeasuredUtf8 {
+    const char* bytes;
+    std::uint32_t available;
+    int result;
+    std::uint32_t length;
+};
+
+static void RequireMeasuredUtf8ToSbc(const std::uint8_t* profile) {
+    constexpr MeasuredUtf8 cases[] = {
+        {"\xE2\x41", 1, static_cast<int>(0x805C0011), 3},
+        {"\xE2\x41", 2, static_cast<int>(0x805C0014), 2},
+        {"\xE2\x41\xAC", 3, static_cast<int>(0x805C0014), 1},
+        {"\xE2\x82\x41", 3, static_cast<int>(0x805C0014), 2},
+        {"\xE2\x82", 2, static_cast<int>(0x805C0011), 3},
+        {"\xE2\xC0", 2, static_cast<int>(0x805C0014), 2},
+        {"\xF0\x41\x98", 3, static_cast<int>(0x805C0014), 2},
+        {"\xF0\x9F\x41", 3, static_cast<int>(0x805C0014), 3},
+        {"\xF0\x41\x98\x80", 4, static_cast<int>(0x805C0014), 1},
+        {"\xF0\x9F\x98\x41", 4, static_cast<int>(0x805C0014), 3},
+        {"\xF0\x9F\x98", 3, static_cast<int>(0x805C0011), 4},
+        {"\xC3\x41", 2, static_cast<int>(0x805C0014), 1},
+        {"\xC3", 1, static_cast<int>(0x805C0011), 2},
+        {"\x80", 1, static_cast<int>(0x805C0014), 0},
+        {"\xFE", 1, static_cast<int>(0x805C0014), 0},
+        {"\xFF", 1, static_cast<int>(0x805C0014), 0},
+        {"\xC0\x80", 2, static_cast<int>(0x805C0015), 2},
+        {"\xC1\xBF", 2, static_cast<int>(0x805C0015), 2},
+        {"\xE0\x80\x80", 3, static_cast<int>(0x805C0015), 3},
+        {"\xE0\x9F\xBF", 3, static_cast<int>(0x805C0015), 3},
+        {"\xED\xA0\x80", 3, static_cast<int>(0x805C0015), 3},
+        {"\xF0\x8F\xBF\xBF", 4, static_cast<int>(0x805C0015), 4},
+        {"\xF8\x80\x80\x80\x80", 5, static_cast<int>(0x805C0015), 5},
+        {"\xFC\x80\x80\x80\x80\x80", 6, static_cast<int>(0x805C0015), 6},
+        {"\xE0\xA0\x80", 3, static_cast<int>(0x805C0020), 3},
+        {"\xED\x9F\xBF", 3, static_cast<int>(0x805C0020), 3},
+        {"\xEF\xBF\xBF", 3, static_cast<int>(0x805C0020), 3},
+        {"\xF0\x90\x80\x80", 4, static_cast<int>(0x805C0020), 4},
+        {"\xF4\x90\x80\x80", 4, static_cast<int>(0x805C0020), 4},
+        {"\xF5\x80\x80\x80", 4, static_cast<int>(0x805C0020), 4},
+        {"\xF7\xBF\xBF\xBF", 4, static_cast<int>(0x805C0020), 4},
+        {"\xF8\x88\x80\x80\x80", 4, static_cast<int>(0x805C0011), 5},
+        {"\xF8\x88\x80\x80\x80", 5, static_cast<int>(0x805C0020), 5},
+        {"\xFB\xBF\xBF\xBF\xBF", 5, static_cast<int>(0x805C0020), 5},
+        {"\xFC\x84\x80", 3, static_cast<int>(0x805C0011), 6},
+        {"\xFC\x84\x80\x80\x80\x80", 6, static_cast<int>(0x805C0020), 6},
+        {"\xFD\xBF\xBF\xBF\xBF\xBF", 6, static_cast<int>(0x805C0020), 6},
+        {"\xC2\x80", 2, static_cast<int>(0x805C0020), 2},
+        {"\xC2\x81", 2, static_cast<int>(0x805C0020), 2},
+        {"\xC2\x8D", 2, static_cast<int>(0x805C0020), 2},
+        {"\xC2\xA0", 2, 0, 2},
+        {"\xC5\x92", 2, 0, 2},
+    };
+    for (const MeasuredUtf8& measured : cases) {
+        std::uint32_t length = 0xAAAAAAAA;
+        std::uint8_t sbc = 0xBB;
+        Require(sceCesUtf8ToSbc(reinterpret_cast<const std::uint8_t*>(measured.bytes), measured.available, &length, profile, &sbc) == measured.result);
+        Require(length == measured.length);
+        Require(measured.result != 0 ? sbc == 0 : sbc != 0);
+    }
+}
+
+constexpr std::uint32_t MeasuredEucJpPairs = 0x9295D4B1;
+constexpr std::uint32_t MeasuredEucJpSupplementary = 0x75256134;
+
+struct MeasuredString {
+    const char* source;
+    std::uint32_t available;
+    std::uint32_t capacity;
+    int result;
+    std::uint32_t read;
+    std::uint32_t written;
+    const char* output;
+};
+
+static void RequireMeasuredStrings(void* latin, void* eucJp) {
+    constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+    constexpr int invalidEncode = static_cast<int>(0x805C0014);
+    constexpr int unassignedCode = static_cast<int>(0x805C0020);
+    constexpr MeasuredString toUtf8[] = {
+        {"ABC", 3, 16, 0, 3, 3, "ABC"},
+        {"ABC\0D", 5, 16, 0, 3, 3, "ABC"},
+        {"ABC", 0, 16, 0, 3, 3, "ABC"},
+        {"ABC", 3, 4, 0, 3, 3, "ABC"},
+        {"ABC", 3, 3, dstBufferEnd, 2, 2, "AB"},
+        {"ABC", 3, 2, dstBufferEnd, 1, 1, "A"},
+        {"A\xE9" "B", 3, 16, 0, 3, 4, "A\xC3\xA9" "B"},
+        {"A\xE9" "B", 3, 3, dstBufferEnd, 1, 1, "A"},
+        {"\x80\x80\x80", 3, 7, dstBufferEnd, 2, 6, "\xE2\x82\xAC\xE2\x82\xAC"},
+        {"A\x81" "B", 3, 16, unassignedCode, 1, 1, "A"},
+        {"", 2, 16, 0, 0, 0, ""},
+    };
+    for (const MeasuredString& measured : toUtf8) {
+        std::uint8_t output[16];
+        std::memset(output, 0xBB, sizeof(output));
+        std::uint32_t read = 0xAAAAAAAA;
+        std::uint32_t written = 0xCCCCCCCC;
+        Require(sceCesMbcsStrToUtf8Str(latin, reinterpret_cast<const std::uint8_t*>(measured.source), measured.available, &read, output, measured.capacity, &written) == measured.result);
+        Require(read == measured.read && written == measured.written);
+        Require(std::memcmp(output, measured.output, measured.written + 1) == 0 && output[measured.written + 1] == 0xBB);
+        Require(sceCesMbcsStrGetUtf8Len(latin, reinterpret_cast<const std::uint8_t*>(measured.source), measured.available, &read, &written) == (measured.result == dstBufferEnd ? 0 : measured.result));
+    }
+    constexpr MeasuredString fromUtf8[] = {
+        {"ABC", 3, 3, dstBufferEnd, 2, 2, "AB"},
+        {"A\xC3\xA9" "B", 4, 16, 0, 4, 3, "A\xE9" "B"},
+        {"A\xE4\xB8\x80" "B", 5, 16, unassignedCode, 1, 1, "A"},
+        {"A\xC3", 2, 16, static_cast<int>(0x805C0011), 1, 1, "A"},
+        {"A\xFF" "B", 3, 16, invalidEncode, 1, 1, "A"},
+        {"A\xC3\0B", 0, 16, invalidEncode, 1, 1, "A"},
+        {"A\xC0\x80" "B", 4, 16, static_cast<int>(0x805C0015), 1, 1, "A"},
+        {"A\xED\xA0\x80" "B", 5, 16, static_cast<int>(0x805C0015), 1, 1, "A"},
+        {"A\xC2\x81" "B", 4, 16, unassignedCode, 1, 1, "A"},
+        {"A\xF8\x88\x80\x80\x80" "B", 7, 16, unassignedCode, 1, 1, "A"},
+        {"A\xE2\x41\xAC" "B", 5, 16, invalidEncode, 1, 1, "A"},
+        {"ABC", 0, 16, 0, 3, 3, "ABC"},
+    };
+    for (const MeasuredString& measured : fromUtf8) {
+        std::uint8_t output[16];
+        std::memset(output, 0xBB, sizeof(output));
+        std::uint32_t read = 0xAAAAAAAA;
+        std::uint32_t written = 0xCCCCCCCC;
+        Require(sceCesUtf8StrToMbcsStr(latin, reinterpret_cast<const std::uint8_t*>(measured.source), measured.available, &read, output, measured.capacity, &written) == measured.result);
+        Require(read == measured.read && written == measured.written);
+        Require(std::memcmp(output, measured.output, measured.written + 1) == 0 && output[measured.written + 1] == 0xBB);
+    }
+    constexpr MeasuredString eucToUtf8[] = {
+        {"A\xA4\xA2" "B", 0, 16, 0, 4, 5, "A\xE3\x81\x82" "B"},
+        {"A\xA4\xA2" "B", 0, 4, dstBufferEnd, 1, 1, "A"},
+        {"A\xA4\xA2" "B", 0, 5, dstBufferEnd, 3, 4, "A\xE3\x81\x82"},
+        {"A\xA4", 2, 16, static_cast<int>(0x805C0011), 1, 1, "A"},
+        {"A\x0E" "B", 3, 16, invalidEncode, 1, 1, "A"},
+        {"A\x80" "B", 0, 16, 0, 3, 4, "A\xC2\x80" "B"},
+        {"A\xA4\0B", 0, 16, invalidEncode, 1, 1, "A"},
+    };
+    for (const MeasuredString& measured : eucToUtf8) {
+        std::uint8_t output[16];
+        std::memset(output, 0xBB, sizeof(output));
+        std::uint32_t read = 0xAAAAAAAA;
+        std::uint32_t written = 0xCCCCCCCC;
+        Require(sceCesMbcsStrToUtf8Str(eucJp, reinterpret_cast<const std::uint8_t*>(measured.source), measured.available, &read, output, measured.capacity, &written) == measured.result);
+        Require(read == measured.read && written == measured.written);
+        Require(std::memcmp(output, measured.output, measured.written + 1) == 0 && output[measured.written + 1] == 0xBB);
+    }
+
+    const auto* letters = reinterpret_cast<const std::uint8_t*>("ABC");
+    std::uint8_t output[4] = {0xBB, 0xBB, 0xBB, 0xBB};
+    std::uint32_t read = 7;
+    std::uint32_t written = 7;
+    Require(sceCesMbcsStrToUtf8Str(latin, letters, 3, &read, output, 0, &written) == dstBufferEnd && read == 0 && written == 0 && output[0] == 0xBB);
+    Require(sceCesMbcsStrToUtf8Str(latin, letters, 3, &read, nullptr, 16, &written) == static_cast<int>(0x805C0030) && read == 0 && written == 0);
+    Require(sceCesMbcsStrToUtf8Str(nullptr, letters, 3, &read, nullptr, 16, &written) == static_cast<int>(0x805C0001));
+    Require(sceCesMbcsStrToUtf8Str(latin, nullptr, 3, &read, nullptr, 16, &written) == static_cast<int>(0x805C0010));
+    Require(sceCesMbcsStrToUtf8Str(nullptr, letters, 3, &read, output, sizeof(output), &written) == static_cast<int>(0x805C0001) && output[0] == 0 && output[1] == 0xBB);
+    output[0] = 0xBB;
+    Require(sceCesMbcsStrToUtf8Str(latin, nullptr, 3, &read, output, sizeof(output), &written) == static_cast<int>(0x805C0010) && output[0] == 0 && read == 0 && written == 0);
+    output[0] = 0xBB;
+    Require(sceCesMbcsStrToUtf8Str(latin, nullptr, 3, &read, output, 0, &written) == static_cast<int>(0x805C0010) && output[0] == 0xBB);
+    Require(sceCesMbcsStrGetUtf8Len(latin, reinterpret_cast<const std::uint8_t*>("A\x81" "B"), 3, &read, &written) == unassignedCode && read == 1 && written == 1);
+    Require(sceCesMbcsStrGetUtf8Len(latin, nullptr, 3, &read, &written) == static_cast<int>(0x805C0010) && read == 0 && written == 0);
+    Require(sceCesUtf8StrGetMbcsLen(latin, reinterpret_cast<const std::uint8_t*>("A\xE4\xB8\x80" "B"), 5, &read, &written) == unassignedCode && read == 1 && written == 1);
+    Require(sceCesUtf8StrGetMbcsLen(latin, reinterpret_cast<const std::uint8_t*>("A\xC3"), 2, &read, &written) == static_cast<int>(0x805C0011) && read == 1 && written == 1);
+
+    std::uint16_t wide[8];
+    for (std::uint16_t& unit : wide) unit = 0xBBBB;
+    Require(sceCesMbcsStrToUcs2Str(latin, letters, 0, &read, wide, 3, &written) == dstBufferEnd && read == 2 && written == 2);
+    Require(wide[0] == u'A' && wide[1] == u'B' && wide[2] == 0 && wide[3] == 0xBBBB);
+    Require(sceCesMbcsStrToUcs2Str(latin, reinterpret_cast<const std::uint8_t*>("A\x81" "B"), 3, &read, wide, 8, &written) == unassignedCode && read == 1 && written == 1 && wide[1] == 0);
+    const std::uint16_t han[] = {u'A', 0x4E00, u'B', 0};
+    const std::uint16_t surrogate[] = {u'A', 0xD800, u'B', 0};
+    const std::uint16_t control[] = {u'A', 0x0081, u'B', 0};
+    const std::uint16_t plain[] = {u'A', u'B', u'C', 0};
+    std::memset(output, 0xBB, sizeof(output));
+    Require(sceCesUcs2StrToMbcsStr(latin, plain, 2, &read, output, sizeof(output), &written) == 0 && read == 2 && written == 2 && std::memcmp(output, "AB", 3) == 0);
+    Require(sceCesUcs2StrToMbcsStr(latin, plain, 0, &read, output, 3, &written) == dstBufferEnd && read == 2 && written == 2);
+    Require(sceCesUcs2StrToMbcsStr(latin, han, 0, &read, output, sizeof(output), &written) == unassignedCode && read == 1 && written == 1);
+    Require(sceCesUcs2StrToMbcsStr(latin, surrogate, 0, &read, output, sizeof(output), &written) == static_cast<int>(0x805C0015) && read == 1 && written == 1);
+    Require(sceCesUcs2StrToMbcsStr(latin, control, 0, &read, output, sizeof(output), &written) == unassignedCode && read == 1 && written == 1);
+    Require(sceCesUcs2StrGetMbcsLen(latin, han, 0, &read, &written) == unassignedCode && read == 1 && written == 1);
+}
+
+static std::uint32_t Fnv(std::uint32_t hash, std::uint32_t word) {
+    for (int k = 0; k < 4; ++k) {
+        hash ^= (word >> (8 * k)) & 0xFFu;
+        hash *= 16777619u;
+    }
+    return hash;
+}
+
+constexpr std::uint32_t MeasuredEucJpEncoder = 0x3AF3CD39;
+constexpr std::uint32_t MeasuredSjisEncoder = 0x2FB8906B;
+
+static std::uint32_t EncoderSweep(void* context) {
+    std::uint32_t hash = 2166136261u;
+    for (std::uint32_t value = 0; value <= 0xFFFF; ++value) {
+        const std::uint16_t source[1] = {static_cast<std::uint16_t>(value)};
+        std::uint8_t output[4] = {0xBB, 0xBB, 0xBB, 0xBB};
+        std::uint32_t used = 0xAAAAAAAA;
+        std::uint32_t produced = 0xCCCCCCCC;
+        const int result = sceCesUcs2StrToMbcsStr(context, source, 1, &used, output, sizeof(output), &produced);
+        std::uint32_t bytes = 0;
+        std::memcpy(&bytes, output, sizeof(bytes));
+        hash = Fnv(Fnv(Fnv(Fnv(hash, static_cast<std::uint32_t>(result)), produced), bytes), used);
+    }
+    return hash;
+}
+
+constexpr std::uint32_t MeasuredSjisDecoder = 0xCA99178C;
+
+static std::uint32_t SjisDecoderSweep(void* sjis) {
+    std::uint32_t hash = 2166136261u;
+    for (std::uint32_t lead = 0; lead < 256; ++lead) {
+        for (std::uint32_t trail = 0; trail < 256; ++trail) {
+            const std::uint8_t source[2] = {static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
+            std::uint16_t output[3] = {0xBBBB, 0xBBBB, 0xBBBB};
+            std::uint32_t used = 0xAAAAAAAA;
+            std::uint32_t produced = 0xCCCCCCCC;
+            const int result = sceCesMbcsStrToUcs2Str(sjis, source, 2, &used, output, 3, &produced);
+            hash = Fnv(Fnv(Fnv(Fnv(Fnv(hash, static_cast<std::uint32_t>(result)), used), produced), static_cast<std::uint32_t>(output[0]) | static_cast<std::uint32_t>(output[1]) << 16), output[2]);
+        }
+    }
+    return hash;
+}
+
+static void RequireMeasuredEncoders(void* eucJp, void* sjis) {
+    Require(SjisDecoderSweep(sjis) == MeasuredSjisDecoder);
+    Require(EncoderSweep(eucJp) == MeasuredEucJpEncoder);
+    Require(EncoderSweep(sjis) == MeasuredSjisEncoder);
+    const std::uint16_t aliases[] = {0x00A2, 0x00A3, 0x00AC, 0x2014, 0x2016, 0x203E, 0x2212, 0x301C, 0xFEFF, 0x0080, 0};
+    std::uint8_t output[32] = {};
+    std::uint32_t used = 0;
+    std::uint32_t produced = 0;
+    Require(sceCesUcs2StrToMbcsStr(eucJp, aliases, 0, &used, output, sizeof(output), &produced) == 0 && used == 10 && produced == 17);
+    Require(std::memcmp(output, "\xA1\xF1\xA1\xF2\xA2\xCC\xA1\xBD\xA1\xC2\xA1\xB1\xA1\xDD\xA1\xC1\x80", 18) == 0);
+    Require(sceCesUcs2StrToMbcsStr(sjis, aliases, 0, &used, output, sizeof(output), &produced) == static_cast<int>(0x805C0024) && used == 9 && produced == 16);
+    Require(std::memcmp(output, "\x81\x91\x81\x92\x81\xCA\x81\x5C\x81\x61\x81\x50\x81\x7C\x81\x60", 17) == 0);
+    const std::uint16_t shift[] = {u'A', 0x000E, 0};
+    Require(sceCesUcs2StrToMbcsStr(sjis, shift, 0, &used, output, sizeof(output), &produced) == 0 && produced == 2);
+    Require(sceCesUcs2StrToMbcsStr(eucJp, shift, 0, &used, output, sizeof(output), &produced) == static_cast<int>(0x805C0020) && used == 1 && produced == 1);
+}
+
+static void RequireMeasuredEucJp(void* eucJp) {
+    constexpr int invalidProfile = static_cast<int>(0x805C0004);
+    constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
+    constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+    constexpr int invalidEncode = static_cast<int>(0x805C0014);
+    constexpr int unassignedCode = static_cast<int>(0x805C0020);
+    constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
+    constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+    std::uint32_t pairs = 2166136261u;
+    for (int lead = 0; lead < 256; ++lead) {
+        for (int trail = 0; trail < 256; ++trail) {
+            const std::uint8_t cell[2] = {static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
+            std::uint32_t used = 0xAAAAAAAA;
+            std::uint16_t code = 0xBBBB;
+            const int result = sceCesEucJpToUcs2(eucJp, cell, 2, &used, &code);
+            pairs = Fnv(Fnv(Fnv(Fnv(pairs, static_cast<std::uint32_t>(cell[1])), static_cast<std::uint32_t>(result)), used), code);
+        }
+    }
+    Require(pairs == MeasuredEucJpPairs);
+    std::uint32_t supplementary = 2166136261u;
+    for (int second = 0; second < 256; ++second) {
+        for (int third = 0; third < 256; ++third) {
+            const std::uint8_t cell[3] = {0x8F, static_cast<std::uint8_t>(second), static_cast<std::uint8_t>(third)};
+            std::uint32_t used = 0xAAAAAAAA;
+            std::uint16_t code = 0xBBBB;
+            const int result = sceCesEucJpToUcs2(eucJp, cell, 3, &used, &code);
+            supplementary = Fnv(Fnv(Fnv(Fnv(supplementary, static_cast<std::uint32_t>(third)), static_cast<std::uint32_t>(result)), used), code);
+        }
+    }
+    Require(supplementary == MeasuredEucJpSupplementary);
+
+    const auto* hiragana = reinterpret_cast<const std::uint8_t*>("\xA4\xA2");
+    std::uint32_t used = 7;
+    std::uint32_t produced = 7;
+    std::uint16_t code = 0xBBBB;
+    std::uint8_t utf8[4] = {0xBB, 0xBB, 0xBB, 0xBB};
+    Require(sceCesEucJpToUcs2(nullptr, hiragana, 2, &used, &code) == invalidProfile && used == 0 && code == 0);
+    Require(sceCesEucJpToUcs2(eucJp, nullptr, 2, &used, &code) == invalidSrcBuffer && used == 0);
+    Require(sceCesEucJpToUcs2(eucJp, hiragana, 0, &used, nullptr) == invalidSrcBuffer && used == 0);
+    Require(sceCesEucJpToUcs2(eucJp, hiragana, 1, &used, nullptr) == srcBufferEnd && used == 2);
+    Require(sceCesEucJpToUcs2(eucJp, hiragana, 2, &used, nullptr) == invalidDstBuffer && used == 2);
+    Require(sceCesEucJpToUcs2(eucJp, hiragana, 2, nullptr, &code) == 0 && code == 0x3042);
+    Require(sceCesEucJpToUtf8(eucJp, hiragana, 2, &used, utf8, sizeof(utf8), &produced) == 0 && used == 2 && produced == 3 && std::memcmp(utf8, "\xE3\x81\x82", 3) == 0);
+    Require(sceCesEucJpToUtf8(eucJp, reinterpret_cast<const std::uint8_t*>("\x8E\xB1"), 2, &used, utf8, sizeof(utf8), &produced) == 0 && used == 2 && produced == 3 && std::memcmp(utf8, "\xEF\xBD\xB1", 3) == 0);
+    Require(sceCesEucJpToUtf8(eucJp, reinterpret_cast<const std::uint8_t*>("\x80"), 1, &used, utf8, sizeof(utf8), &produced) == 0 && used == 1 && produced == 2 && std::memcmp(utf8, "\xC2\x80", 2) == 0);
+    std::memset(utf8, 0xBB, sizeof(utf8));
+    Require(sceCesEucJpToUtf8(nullptr, nullptr, 2, &used, utf8, sizeof(utf8), &produced) == invalidProfile && used == 0 && produced == 0);
+    Require(sceCesEucJpToUtf8(eucJp, nullptr, 0, &used, utf8, sizeof(utf8), &produced) == invalidSrcBuffer && used == 0 && produced == 0);
+    Require(sceCesEucJpToUtf8(eucJp, hiragana, 1, &used, nullptr, sizeof(utf8), &produced) == srcBufferEnd && used == 2 && produced == 0);
+    Require(sceCesEucJpToUtf8(eucJp, reinterpret_cast<const std::uint8_t*>("\xA4\x20"), 2, &used, utf8, sizeof(utf8), &produced) == invalidEncode && used == 2 && produced == 0);
+    Require(sceCesEucJpToUtf8(eucJp, reinterpret_cast<const std::uint8_t*>("\x8E\xE0"), 2, &used, utf8, sizeof(utf8), &produced) == unassignedCode && used == 2 && produced == 0);
+    Require(sceCesEucJpToUtf8(eucJp, reinterpret_cast<const std::uint8_t*>("\xA9\xA1"), 2, &used, utf8, sizeof(utf8), &produced) == unassignedCode && used == 2 && produced == 0);
+    Require(sceCesEucJpToUtf8(eucJp, reinterpret_cast<const std::uint8_t*>("\xFF\xA1"), 2, &used, utf8, sizeof(utf8), &produced) == invalidEncode && used == 1 && produced == 0);
+    Require(sceCesEucJpToUtf8(eucJp, hiragana, 2, &used, nullptr, sizeof(utf8), &produced) == invalidDstBuffer && used == 2 && produced == 3);
+    Require(sceCesEucJpToUtf8(eucJp, hiragana, 2, &used, utf8, 2, &produced) == dstBufferEnd && used == 2 && produced == 3);
+    Require(sceCesEucJpToUtf8(eucJp, hiragana, 2, &used, utf8, 0, &produced) == dstBufferEnd && used == 2 && produced == 3);
+    Require(utf8[0] == 0xBB);
+    Require(sceCesEucJpToUtf8(eucJp, hiragana, 2, nullptr, utf8, sizeof(utf8), nullptr) == 0 && std::memcmp(utf8, "\xE3\x81\x82", 3) == 0);
+}
+
 static void RequireSbcCode(const std::uint8_t* profile, std::uint8_t sbc, std::uint32_t code) {
     char expected[4] = {};
     if (code < 0x80) {
@@ -93,12 +362,12 @@ static void RequireSbcCode(const std::uint8_t* profile, std::uint8_t sbc, std::u
 static void CheckSingleByteProfiles() {
     constexpr int unassignedCode = static_cast<int>(0x805C0020);
     const auto getters = {sceCesRefersUcsProfileIso8859_1, sceCesRefersUcsProfileIso8859_2, sceCesRefersUcsProfileIso8859_4, sceCesRefersUcsProfileIso8859_5, sceCesRefersUcsProfileIso8859_9, sceCesRefersUcsProfileIso8859_10, sceCesRefersUcsProfileIso8859_13, sceCesRefersUcsProfileIso8859_14, sceCesRefersUcsProfileIso8859_15, sceCesRefersUcsProfileIso8859_16, sceCesRefersUcsProfileCp437, sceCesRefersUcsProfileCp737, sceCesRefersUcsProfileCp775, sceCesRefersUcsProfileCp850, sceCesRefersUcsProfileCp852, sceCesRefersUcsProfileCp855, sceCesRefersUcsProfileCp860, sceCesRefersUcsProfileCp861, sceCesRefersUcsProfileCp862, sceCesRefersUcsProfileCp863, sceCesRefersUcsProfileCp865, sceCesRefersUcsProfileCp866, sceCesRefersUcsProfileKoi8R, sceCesRefersUcsProfileKoi8U, sceCesRefersUcsProfileCp1254, sceCesRefersUcsProfileCp1256, sceCesRefersUcsProfileCp1258};
-    const std::uint8_t* existing[] = {sceCesRefersUcsProfileCp1252(), sceCesRefersUcsProfileCp1251(), sceCesRefersUcsProfileCp1250()};
+    const void* existing[] = {sceCesRefersUcsProfileCp1252(), sceCesRefersUcsProfileCp1251(), sceCesRefersUcsProfileCp1250()};
     std::size_t index = 0;
     for (const auto getter : getters) {
         const std::uint8_t* profile = getter();
         Require(profile != nullptr && profile == getter());
-        for (const std::uint8_t* other : existing) Require(profile != other);
+        for (const void* other : existing) Require(profile != other);
         std::size_t inner = 0;
         for (const auto earlier : getters) {
             if (inner++ == index) break;
@@ -260,7 +529,6 @@ int main() {
     RequireSbcToUtf8(profile, 'A', "A");
     RequireSbcToUtf8(profile, 0x80, "\xE2\x82\xAC");
     RequireSbcToUtf8(profile, 0x9F, "\xC5\xB8");
-    RequireSbcToUtf8(profile, 0x81, "\xC2\x81");
     RequireSbcToUtf8(profile, 0xE9, "\xC3\xA9");
     RequireSbcToUtf8(profile, 0xFF, "\xC3\xBF");
 
@@ -268,29 +536,48 @@ int main() {
     RequireUtf8ToSbc(profile, "\xE2\x82\xAC", 0x80);
     RequireUtf8ToSbc(profile, "\xE2\x84\xA2", 0x99);
     RequireUtf8ToSbc(profile, "\xC3\xA9", 0xE9);
-    RequireUtf8ToSbc(profile, "\xC2\x8D", 0x8D);
-    for (int sbc = 1; sbc < 256; ++sbc) {
-        std::uint8_t utf8[4] = {};
-        std::uint32_t length = 0;
-        std::uint8_t back = 0;
-        Require(sceCesSbcToUtf8(profile, static_cast<std::uint8_t>(sbc), utf8, sizeof(utf8), &length) == 0);
-        Require(sceCesUtf8ToSbc(utf8, length, &length, profile, &back) == 0 && back == sbc);
-    }
+    RequireSbcRoundTrip(profile, {0x81, 0x8D, 0x8F, 0x90, 0x9D});
+    RequireMeasuredUtf8ToSbc(profile);
 
     std::uint8_t utf8[4] = {};
     std::uint32_t length = 0;
     std::uint8_t sbc = 0;
-    Require(sceCesSbcToUtf8(nullptr, 'A', utf8, sizeof(utf8), &length) == invalidParameter);
-    Require(sceCesSbcToUtf8(profile, 'A', nullptr, sizeof(utf8), &length) == invalidDstBuffer);
-    Require(sceCesSbcToUtf8(profile, 0x80, utf8, 2, &length) == dstBufferEnd);
-    Require(sceCesUtf8ToSbc(utf8, 1, &length, nullptr, &sbc) == invalidParameter);
-    Require(sceCesUtf8ToSbc(nullptr, 1, &length, profile, &sbc) == invalidSrcBuffer);
-    Require(sceCesUtf8ToSbc(utf8, 1, &length, profile, nullptr) == invalidDstBuffer);
-    Require(Utf8ToSbc(profile, "A", 0) == srcBufferEnd);
+    constexpr int invalidProfile = static_cast<int>(0x805C0004);
+    constexpr int illegalCode = static_cast<int>(0x805C0015);
+    length = 7;
+    Require(sceCesSbcToUtf8(nullptr, 'A', utf8, sizeof(utf8), &length) == invalidProfile && length == 0);
+    Require(sceCesSbcToUtf8(nullptr, 0x81, utf8, sizeof(utf8), &length) == invalidProfile && length == 0);
+    Require(sceCesSbcToUtf8(profile, 0x80, nullptr, sizeof(utf8), &length) == invalidDstBuffer && length == 3);
+    Require(sceCesSbcToUtf8(profile, 0x81, nullptr, sizeof(utf8), &length) == unassignedCode && length == 0);
+    Require(sceCesSbcToUtf8(profile, 0x81, utf8, 0, &length) == unassignedCode && length == 0);
+    utf8[0] = 0xBB;
+    Require(sceCesSbcToUtf8(profile, 0x80, utf8, 2, &length) == dstBufferEnd && length == 3 && utf8[0] == 0xBB);
+    Require(sceCesSbcToUtf8(profile, 'A', utf8, 0, &length) == dstBufferEnd && length == 1 && utf8[0] == 0xBB);
+    Require(sceCesSbcToUtf8(profile, 0xE9, utf8, 1, nullptr) == dstBufferEnd);
+    const auto* euro = reinterpret_cast<const std::uint8_t*>("\xE2\x82\xAC");
+    const auto* han = reinterpret_cast<const std::uint8_t*>("\xE4\xB8\x80");
+    const auto* letter = reinterpret_cast<const std::uint8_t*>("A");
+    sbc = 0xBB;
+    Require(sceCesUtf8ToSbc(letter, 1, &length, nullptr, &sbc) == invalidProfile && length == 1 && sbc == 0);
+    Require(sceCesUtf8ToSbc(letter, 1, &length, nullptr, nullptr) == invalidProfile && length == 1);
+    Require(sceCesUtf8ToSbc(euro, 3, &length, nullptr, &sbc) == invalidProfile && length == 3);
+    Require(sceCesUtf8ToSbc(euro, 2, &length, nullptr, &sbc) == srcBufferEnd && length == 3);
+    Require(sceCesUtf8ToSbc(reinterpret_cast<const std::uint8_t*>("\xFF"), 1, &length, nullptr, &sbc) == invalidEncode && length == 0);
+    sbc = 0xBB;
+    Require(sceCesUtf8ToSbc(nullptr, 1, &length, nullptr, &sbc) == invalidSrcBuffer && length == 0 && sbc == 0);
+    Require(sceCesUtf8ToSbc(nullptr, 1, &length, profile, nullptr) == invalidSrcBuffer && length == 0);
+    sbc = 0xBB;
+    Require(sceCesUtf8ToSbc(letter, 0, &length, profile, &sbc) == invalidSrcBuffer && length == 0 && sbc == 0);
+    Require(sceCesUtf8ToSbc(euro, 3, &length, profile, nullptr) == invalidDstBuffer && length == 3);
+    Require(sceCesUtf8ToSbc(han, 3, &length, profile, nullptr) == unassignedCode && length == 3);
+    sbc = 0xBB;
+    Require(sceCesUtf8ToSbc(han, 3, &length, profile, &sbc) == unassignedCode && length == 3 && sbc == 0);
+    Require(sceCesUtf8ToSbc(euro, 3, nullptr, profile, &sbc) == 0 && sbc == 0x80);
+    Require(Utf8ToSbc(profile, "A", 0) == invalidSrcBuffer);
     Require(Utf8ToSbc(profile, "\xE2\x82\xAC", 2) == srcBufferEnd);
     Require(Utf8ToSbc(profile, "\x80", 1) == invalidEncode);
-    Require(Utf8ToSbc(profile, "\xC0\xAF", 2) == invalidEncode);
-    Require(Utf8ToSbc(profile, "\xED\xA0\x80", 3) == invalidEncode);
+    Require(Utf8ToSbc(profile, "\xC0\xAF", 2) == illegalCode);
+    Require(Utf8ToSbc(profile, "\xED\xA0\x80", 3) == illegalCode);
     Require(Utf8ToSbc(profile, "\xE3\x81\x82", 3) == unassignedCode);
     Require(Utf8ToSbc(profile, "\xF0\x9F\x98\x80", 4) == unassignedCode);
 
@@ -304,21 +591,14 @@ int main() {
     RequireSbcToUtf8(cyrillic, 0xB9, "\xE2\x84\x96");
     RequireUtf8ToSbc(cyrillic, "\xD0\x9F", 0xCF);
     RequireUtf8ToSbc(cyrillic, "\xD1\x91", 0xB8);
-    for (int sbc = 1; sbc < 256; ++sbc) {
-        std::uint8_t cp[4] = {};
-        std::uint32_t cpLength = 0;
-        std::uint8_t back = 0;
-        Require(sceCesSbcToUtf8(cyrillic, static_cast<std::uint8_t>(sbc), cp, sizeof(cp), &cpLength) == 0);
-        Require(sceCesUtf8ToSbc(cp, cpLength, &cpLength, cyrillic, &back) == 0 && back == sbc);
-    }
+    RequireSbcRoundTrip(cyrillic, {0x98});
     Require(Utf8ToSbc(cyrillic, "\xC3\xA9", 2) == unassignedCode);
     Require(Utf8ToSbc(profile, "\xD0\x90", 2) == unassignedCode);
 
-    const std::uint8_t* latin2 = sceCesRefersUcsProfileCp1250();
+    const auto* latin2 = static_cast<const std::uint8_t*>(sceCesRefersUcsProfileCp1250());
     Require(latin2 != nullptr && latin2 == sceCesRefersUcsProfileCp1250() && latin2 != profile && latin2 != cyrillic);
     RequireSbcToUtf8(latin2, 'A', "A");
     RequireSbcToUtf8(latin2, 0x80, "\xE2\x82\xAC");
-    RequireSbcToUtf8(latin2, 0x81, "\xC2\x81");
     RequireSbcToUtf8(latin2, 0x8A, "\xC5\xA0");
     RequireSbcToUtf8(latin2, 0xA3, "\xC5\x81");
     RequireSbcToUtf8(latin2, 0xA5, "\xC4\x84");
@@ -328,13 +608,7 @@ int main() {
     RequireUtf8ToSbc(latin2, "\xC5\xA0", 0x8A);
     RequireUtf8ToSbc(latin2, "\xC5\x81", 0xA3);
     RequireUtf8ToSbc(latin2, "\xC3\xA9", 0xE9);
-    for (int sbc = 1; sbc < 256; ++sbc) {
-        std::uint8_t cp[4] = {};
-        std::uint32_t cpLength = 0;
-        std::uint8_t back = 0;
-        Require(sceCesSbcToUtf8(latin2, static_cast<std::uint8_t>(sbc), cp, sizeof(cp), &cpLength) == 0);
-        Require(sceCesUtf8ToSbc(cp, cpLength, &cpLength, latin2, &back) == 0 && back == sbc);
-    }
+    RequireSbcRoundTrip(latin2, {0x81, 0x83, 0x88, 0x90, 0x98});
     Require(Utf8ToSbc(latin2, "\xD0\x90", 2) == unassignedCode);
     char latin2Context[256] = {};
     Require(sceCesMbcsUcsContextInit(latin2Context, latin2) == 0);
@@ -355,7 +629,7 @@ int main() {
     char sjisContext[256] = {};
     Require(sceCesMbcsUcsContextInit(sjisContext, sjisSheet) == 0);
     const auto* eucSource = reinterpret_cast<const std::uint8_t*>("Go \xEF\xBD\xB1!");
-    std::uint8_t mbcs[16] = {};
+    std::uint8_t mbcs[32] = {};
     std::uint32_t used = 0;
     std::uint32_t produced = 0;
     char sheet[1024] = {};
@@ -368,8 +642,12 @@ int main() {
     Require(used == 7 && produced == 6 && std::memcmp(mbcs, "Go \x8E\xB1!", 6) == 0);
     Require(sceCesUtf8StrGetMbcsLen(eucContext, eucSource, 16, &used, &produced) == 0 && used == 7 && produced == 6);
     Require(sceCesUtf8StrToMbcsStr(eucContext, eucSource, 16, &used, mbcs, 4, &produced) == dstBufferEnd);
+    Require(used == 3 && produced == 3 && std::memcmp(mbcs, "Go ", 4) == 0);
+    Require(sceCesUtf8StrToMbcsStr(eucContext, eucSource, 16, &used, mbcs, sizeof(mbcs), &produced) == 0);
     Require(sceCesUtf8StrToMbcsStr(nullptr, eucSource, 16, &used, mbcs, sizeof(mbcs), &produced) == invalidParameter);
     Require(sceCesUtf8StrToMbcsStr(eucContext, reinterpret_cast<const std::uint8_t*>("\xF0\x9F\x98\x80"), 4, &used, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(used == 0 && produced == 0 && mbcs[0] == 0);
+    Require(sceCesUtf8StrToMbcsStr(eucContext, eucSource, 16, &used, mbcs, sizeof(mbcs), &produced) == 0);
 
     std::uint8_t back[16] = {};
     Require(sceCesMbcsStrToUtf8Str(nullptr, mbcs, 6, &used, back, sizeof(back), &produced) == invalidParameter);
@@ -384,8 +662,8 @@ int main() {
     Require(sceCesUcs2StrToMbcsStr(eucContext, ucs2, 4, &used, mbcs, sizeof(mbcs), &produced) == 0);
     Require(used == 3 && produced == 4 && std::memcmp(mbcs, "OK\x8E\xDF", 4) == 0);
     Require(sceCesUcs2StrGetMbcsLen(eucContext, ucs2, 4, &used, &produced) == 0 && produced == 4);
-    std::uint16_t wide[8] = {};
-    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 4, &used, wide, 8, &produced) == 0);
+    std::uint16_t wide[16] = {};
+    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 4, &used, wide, 16, &produced) == 0);
     Require(used == 4 && produced == 3 && wide[0] == u'O' && wide[1] == u'K' && wide[2] == 0xFF9F);
     Require(sceCesMbcsStrGetUcs2Len(eucContext, mbcs, 4, &used, &produced) == 0 && produced == 3);
     std::uint16_t single = 0;
@@ -397,15 +675,15 @@ int main() {
     Require(used == 24 && produced == 16 && std::memcmp(mbcs, "\xA4\xB3\xA4\xF3\xA4\xCB\xA4\xC1\xA4\xCF\xC6\xFC\xCB\xDC\xB8\xEC", 16) == 0);
     std::uint8_t japaneseBack[32] = {};
     Require(sceCesMbcsStrToUtf8Str(eucContext, mbcs, 16, &used, japaneseBack, sizeof(japaneseBack), &produced) == 0 && produced == 24 && std::memcmp(japaneseBack, japanese, 24) == 0);
-    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 16, &used, wide, 8, &produced) == 0 && used == 16 && produced == 8 && wide[0] == 0x3053 && wide[5] == 0x65E5 && wide[7] == 0x8A9E);
-    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 15, &used, wide, 8, &produced) == srcBufferEnd);
+    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 16, &used, wide, 16, &produced) == 0 && used == 16 && produced == 8 && wide[0] == 0x3053 && wide[5] == 0x65E5 && wide[7] == 0x8A9E);
+    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 15, &used, wide, 16, &produced) == srcBufferEnd);
     const std::uint16_t extensions[] = {0x2460, 0xFF5E, 0x2252, 0};
     Require(sceCesUcs2StrToMbcsStr(eucContext, extensions, 4, &used, mbcs, sizeof(mbcs), &produced) == 0 && produced == 6 && std::memcmp(mbcs, "\xAD\xA1\xA1\xC1\xA2\xE2", 6) == 0);
-    Require(sceCesMbcsStrToUcs2Str(eucContext, reinterpret_cast<const std::uint8_t*>("\xA9\xA1"), 2, &used, wide, 8, &produced) == unassignedCode);
-    Require(sceCesMbcsStrToUcs2Str(eucContext, reinterpret_cast<const std::uint8_t*>("\xA4\x41"), 2, &used, wide, 8, &produced) == invalidEncode);
-    Require(sceCesMbcsStrToUcs2Str(eucContext, reinterpret_cast<const std::uint8_t*>("\xA4"), 1, &used, wide, 8, &produced) == srcBufferEnd);
+    Require(sceCesMbcsStrToUcs2Str(eucContext, reinterpret_cast<const std::uint8_t*>("\xA9\xA1"), 2, &used, wide, 16, &produced) == unassignedCode);
+    Require(sceCesMbcsStrToUcs2Str(eucContext, reinterpret_cast<const std::uint8_t*>("\xA4\x41"), 2, &used, wide, 16, &produced) == invalidEncode);
+    Require(sceCesMbcsStrToUcs2Str(eucContext, reinterpret_cast<const std::uint8_t*>("\xA4"), 1, &used, wide, 16, &produced) == srcBufferEnd);
     const std::uint16_t yen[] = {0x00A5, 0};
-    Require(sceCesUcs2StrToMbcsStr(eucContext, yen, 2, &used, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(sceCesUcs2StrToMbcsStr(eucContext, yen, 2, &used, mbcs, sizeof(mbcs), &produced) == 0 && used == 1 && produced == 2 && std::memcmp(mbcs, "\xA1\xEF", 3) == 0);
     std::uint32_t assigned = 0;
     for (std::uint32_t lead = 0xA1; lead <= 0xFE; ++lead) {
         for (std::uint32_t trail = 0xA1; trail <= 0xFE; ++trail) {
@@ -424,47 +702,36 @@ int main() {
     Require(assigned == 7336);
 
     std::uint16_t supplementary = 0;
-    Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\xA2\xAF"), 3, &used, &supplementary) == 0 && used == 3 && supplementary == 0x02D8);
-    Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\xA2"), 2, &used, &supplementary) == srcBufferEnd);
+    Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\xA2\xAF"), 3, &used, &supplementary) == invalidEncode && used == 3 && supplementary == 0);
+    Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\xA2"), 2, &used, &supplementary) == srcBufferEnd && used == 3);
     Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\x41\xA1"), 3, &used, &supplementary) == invalidEncode);
     Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\xA2\x41"), 3, &used, &supplementary) == invalidEncode);
     Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\xA1\xA1"), 3, &used, &supplementary) == unassignedCode);
     Require(sceCesEucJpToUcs2(eucJp, reinterpret_cast<const std::uint8_t*>("\x8F\xF5\xA1"), 3, &used, &supplementary) == unassignedCode);
-    const std::uint16_t supplementaryText[] = {0x02D8, 0x0386, 0x0402, 0x6600, 0};
-    Require(sceCesUcs2StrToMbcsStr(eucContext, supplementaryText, 5, &used, mbcs, sizeof(mbcs), &produced) == 0);
-    Require(used == 4 && produced == 11 && std::memcmp(mbcs, "\x8F\xA2\xAF\x8F\xA6\xE1\x8F\xA7\xC2\xFA\xB4", 11) == 0);
-    Require(sceCesUcs2StrGetMbcsLen(eucContext, supplementaryText, 5, &used, &produced) == 0 && produced == 11);
-    std::uint16_t supplementaryBack[8] = {};
-    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 11, &used, supplementaryBack, 8, &produced) == 0);
-    Require(used == 11 && produced == 4 && supplementaryBack[0] == 0x02D8 && supplementaryBack[1] == 0x0386 && supplementaryBack[2] == 0x0402 && supplementaryBack[3] == 0x6600);
-    Require(sceCesMbcsStrGetUcs2Len(eucContext, mbcs, 11, &used, &produced) == 0 && produced == 4);
-    Require(sceCesMbcsStrToUtf8Str(eucContext, mbcs, 11, &used, japaneseBack, sizeof(japaneseBack), &produced) == 0);
-    Require(produced == 9 && std::memcmp(japaneseBack, "\xCB\x98\xCE\x86\xD0\x82\xE6\x98\x80", 9) == 0);
-    Require(sceCesMbcsStrGetUtf8Len(eucContext, mbcs, 11, &used, &produced) == 0 && produced == 9);
-    Require(sceCesMbcsStrToUcs2Str(eucContext, mbcs, 10, &used, supplementaryBack, 8, &produced) == srcBufferEnd);
-    std::uint32_t supplementaryAssigned = 0;
-    for (std::uint32_t lead = 0xA2; lead <= 0xF4; ++lead) {
-        for (std::uint32_t trail = 0xA1; trail <= 0xFE; ++trail) {
-            const std::uint8_t cell[3] = {0x8F, static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
-            std::uint16_t decoded[2] = {};
-            if (sceCesEucJpToUcs2(eucJp, cell, 3, &used, decoded) != 0) continue;
-            ++supplementaryAssigned;
-            decoded[1] = 0;
-            std::uint8_t again[4] = {};
-            std::uint16_t second[2] = {};
-            Require(sceCesUcs2StrToMbcsStr(eucContext, decoded, 2, &used, again, sizeof(again), &produced) == 0);
-            if (produced == 3) Require(again[1] == cell[1] && again[2] == cell[2]);
-            Require(sceCesEucJpToUcs2(eucJp, again, produced, &used, second) == 0 && second[0] == decoded[0]);
-        }
-    }
-    Require(supplementaryAssigned == 6067);
+    const std::uint16_t supplementaryText[] = {u'A', 0x02D8, 0};
+    Require(sceCesUcs2StrToMbcsStr(eucContext, supplementaryText, 0, &used, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(used == 1 && produced == 1 && std::memcmp(mbcs, "A", 2) == 0);
+    const std::uint16_t ibmText[] = {0x6600, 0x2170, 0};
+    Require(sceCesUcs2StrToMbcsStr(eucContext, ibmText, 0, &used, mbcs, sizeof(mbcs), &produced) == 0);
+    Require(used == 2 && produced == 4 && std::memcmp(mbcs, "\xFA\xB4\xFC\xF1", 5) == 0);
+    Require(sceCesMbcsStrToUtf8Str(eucContext, reinterpret_cast<const std::uint8_t*>("A\x8F\xA2\xAF" "B"), 0, &used, japaneseBack, sizeof(japaneseBack), &produced) == invalidEncode);
+    Require(used == 1 && produced == 1 && std::memcmp(japaneseBack, "A", 2) == 0);
+    RequireMeasuredEucJp(eucJp);
+    char measuredLatin[256] = {};
+    Require(sceCesMbcsUcsContextInit(measuredLatin, profile) == 0);
+    RequireMeasuredStrings(measuredLatin, eucContext);
+    Require(sceCesMbcsUcsContextInit(measuredLatin, nullptr) == invalidParameter);
 
     const auto* sjisSource = reinterpret_cast<const std::uint8_t*>("Go \xEF\xBD\xB1!");
     Require(sceCesUtf8StrToMbcsStr(sjisContext, sjisSource, 16, &used, mbcs, sizeof(mbcs), &produced) == 0);
     Require(used == 7 && produced == 5 && std::memcmp(mbcs, "Go \xB1!", 5) == 0);
     Require(sceCesUtf8StrGetMbcsLen(sjisContext, sjisSource, 16, &used, &produced) == 0 && used == 7 && produced == 5);
     Require(sceCesUtf8StrToMbcsStr(sjisContext, sjisSource, 16, &used, mbcs, 4, &produced) == dstBufferEnd);
+    Require(used == 3 && produced == 3 && std::memcmp(mbcs, "Go ", 4) == 0);
+    Require(sceCesUtf8StrToMbcsStr(sjisContext, sjisSource, 16, &used, mbcs, sizeof(mbcs), &produced) == 0);
     Require(sceCesUtf8StrToMbcsStr(sjisContext, reinterpret_cast<const std::uint8_t*>("\xF0\x9F\x98\x80"), 4, &used, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(used == 0 && produced == 0 && mbcs[0] == 0);
+    Require(sceCesUtf8StrToMbcsStr(sjisContext, sjisSource, 16, &used, mbcs, sizeof(mbcs), &produced) == 0);
 
     std::uint8_t sjisBack[16] = {};
     Require(sceCesMbcsStrToUtf8Str(sjisContext, mbcs, 5, &used, sjisBack, sizeof(sjisBack), &produced) == 0);
@@ -478,8 +745,8 @@ int main() {
     Require(sceCesUcs2StrToMbcsStr(sjisContext, sjisUcs2, 4, &used, mbcs, sizeof(mbcs), &produced) == 0);
     Require(used == 3 && produced == 3 && std::memcmp(mbcs, "OK\xDF", 3) == 0);
     Require(sceCesUcs2StrGetMbcsLen(sjisContext, sjisUcs2, 4, &used, &produced) == 0 && produced == 3);
-    std::uint16_t sjisWide[8] = {};
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, mbcs, 3, &used, sjisWide, 8, &produced) == 0);
+    std::uint16_t sjisWide[16] = {};
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, mbcs, 3, &used, sjisWide, 16, &produced) == 0);
     Require(used == 3 && produced == 3 && sjisWide[0] == u'O' && sjisWide[1] == u'K' && sjisWide[2] == 0xFF9F);
     Require(sceCesMbcsStrGetUcs2Len(sjisContext, mbcs, 3, &used, &produced) == 0 && produced == 3);
 
@@ -487,19 +754,20 @@ int main() {
     Require(used == 24 && produced == 16 && std::memcmp(mbcs, "\x82\xB1\x82\xF1\x82\xC9\x82\xBF\x82\xCD\x93\xFA\x96\x7B\x8C\xEA", 16) == 0);
     std::uint8_t sjisJapaneseBack[32] = {};
     Require(sceCesMbcsStrToUtf8Str(sjisContext, mbcs, 16, &used, sjisJapaneseBack, sizeof(sjisJapaneseBack), &produced) == 0 && produced == 24 && std::memcmp(sjisJapaneseBack, japanese, 24) == 0);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, mbcs, 16, &used, sjisWide, 8, &produced) == 0 && used == 16 && produced == 8 && sjisWide[0] == 0x3053 && sjisWide[5] == 0x65E5 && sjisWide[7] == 0x8A9E);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, mbcs, 15, &used, sjisWide, 8, &produced) == srcBufferEnd);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, mbcs, 16, &used, sjisWide, 16, &produced) == 0 && used == 16 && produced == 8 && sjisWide[0] == 0x3053 && sjisWide[5] == 0x65E5 && sjisWide[7] == 0x8A9E);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, mbcs, 15, &used, sjisWide, 16, &produced) == srcBufferEnd);
     const std::uint16_t sjisExtensions[] = {0x2460, 0xFF5E, 0x2252, 0};
     Require(sceCesUcs2StrToMbcsStr(sjisContext, sjisExtensions, 4, &used, mbcs, sizeof(mbcs), &produced) == 0 && produced == 6 && std::memcmp(mbcs, "\x87\x40\x81\x60\x81\xE0", 6) == 0);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\x85\x40"), 2, &used, sjisWide, 8, &produced) == unassignedCode);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\x80"), 1, &used, sjisWide, 8, &produced) == invalidEncode);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xA0"), 1, &used, sjisWide, 8, &produced) == invalidEncode);
-    Require(sceCesUcs2StrToMbcsStr(sjisContext, yen, 2, &used, mbcs, sizeof(mbcs), &produced) == unassignedCode);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFB\xFC"), 2, &used, sjisWide, 8, &produced) == 0 && used == 2 && produced == 1 && sjisWide[0] == 0x9AD9);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFA\x40"), 2, &used, sjisWide, 8, &produced) == 0 && used == 2 && produced == 1 && sjisWide[0] == 0x2170);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFC\x4B"), 2, &used, sjisWide, 8, &produced) == 0 && used == 2 && produced == 1 && sjisWide[0] == 0x9ED1);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFC\x4C"), 2, &used, sjisWide, 8, &produced) == unassignedCode);
-    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xF0\x40"), 2, &used, sjisWide, 8, &produced) == unassignedCode);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\x85\x40"), 2, &used, sjisWide, 16, &produced) == unassignedCode);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\x80"), 1, &used, sjisWide, 16, &produced) == invalidEncode);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xA0"), 1, &used, sjisWide, 16, &produced) == invalidEncode);
+    Require(sceCesUcs2StrToMbcsStr(sjisContext, yen, 2, &used, mbcs, sizeof(mbcs), &produced) == 0 && used == 1 && produced == 2 && std::memcmp(mbcs, "\x81\x8F", 3) == 0);
+    RequireMeasuredEncoders(eucContext, sjisContext);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFB\xFC"), 2, &used, sjisWide, 16, &produced) == 0 && used == 2 && produced == 1 && sjisWide[0] == 0x9AD9);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFA\x40"), 2, &used, sjisWide, 16, &produced) == 0 && used == 2 && produced == 1 && sjisWide[0] == 0x2170);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFC\x4B"), 2, &used, sjisWide, 16, &produced) == 0 && used == 2 && produced == 1 && sjisWide[0] == 0x9ED1);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xFC\x4C"), 2, &used, sjisWide, 16, &produced) == unassignedCode);
+    Require(sceCesMbcsStrToUcs2Str(sjisContext, reinterpret_cast<const std::uint8_t*>("\xF0\x40"), 2, &used, sjisWide, 16, &produced) == unassignedCode);
     std::uint32_t sjisAssigned = 0;
     for (std::uint32_t lead = 0x81; lead <= 0xFC; ++lead) {
         if (lead > 0x9F && lead < 0xE0) continue;
diff --git a/core/libs/tests/GuestCesChinese.cpp b/core/libs/tests/GuestCesChinese.cpp
index 8e4f16cf5a..424a2a27bd 100644
--- a/core/libs/tests/GuestCesChinese.cpp
+++ b/core/libs/tests/GuestCesChinese.cpp
@@ -1,45 +1,246 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-void* APS5_VABI sceCesUcsProfileInitEucCnGb2312(void*);
-void* APS5_VABI sceCesUcsProfileInitGbkCp936(void*);
-void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void*);
-int APS5_VABI sceCesMbcsUcsContextInit(void*, const void*);
-int APS5_VABI sceCesEucCnToUcs2(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
-int APS5_VABI sceCesEucCnToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesEucCnToUtf16be(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesEucCnToUtf32(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesGbToUcs2(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
-int APS5_VABI sceCesGbToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesGbToUtf16(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesGbToUtf32le(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesUcs2ToEucCn(std::uint16_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUcs2ToGb(std::uint16_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8ToEucCn(const std::uint8_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8ToGb(const std::uint8_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf16leToGb(const std::uint16_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf32ToEucCn(std::uint32_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf32beToGb(const std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8StrToMbcsStr(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUtf8Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
 
-int main() {
-    constexpr int invalidParameter = static_cast<int>(0x805C0001);
-    constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
-    constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
-    constexpr int invalidEncode = static_cast<int>(0x805C0014);
-    constexpr int unassignedCode = static_cast<int>(0x805C0020);
-    constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
-    constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+static constexpr int invalidParameter = static_cast<int>(0x805C0001);
+static constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
+static constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+static constexpr int invalidEncode = static_cast<int>(0x805C0014);
+ constexpr int outOfCodeSpace = static_cast<int>(0x805C0015);
+static constexpr int unassignedCode = static_cast<int>(0x805C0020);
+static constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
+static constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
 
+struct Gb18030Sequence {
+    std::uint32_t bytes;
+    std::uint32_t code2000;
+    std::uint32_t code2005;
+};
+
+struct Gb18030Difference {
+    std::uint32_t bytes;
+    std::uint32_t code2000;
+    std::uint32_t code2005;
+    bool fallback;
+};
+
+static constexpr Gb18030Sequence GB18030_BOUNDARIES[88] = {
+    {0x81308130, 0x80, 0x80}, {0x8130D239, 0x450, 0x450}, {0x8130D330, 0x452, 0x452}, {0x8135F436, 0x1E3E, 0x1E3E},
+    {0x8135F437, 0x1E3F, 0xE7C7}, {0x8135F438, 0x1E40, 0x1E40}, {0x8136A531, 0x200F, 0x200F}, {0x8136A532, 0x2011, 0x2011},
+    {0x8137A838, 0x2641, 0x2641}, {0x8137A839, 0x2643, 0x2643}, {0x8138FD38, 0x2E80, 0x2E80}, {0x8138FD39, 0x2E82, 0x2E82},
+    {0x8230A632, 0x3619, 0x3619}, {0x8230A633, 0x361B, 0x361B}, {0x8230F237, 0x3917, 0x3917}, {0x8230F238, 0x3919, 0x3919},
+    {0x8231D437, 0x3CDF, 0x3CDF}, {0x8231D438, 0x3CE1, 0x3CE1}, {0x8232AF32, 0x4055, 0x4055}, {0x8232AF33, 0x4057, 0x4057},
+    {0x8232C936, 0x415E, 0x415E}, {0x8232C937, 0x4160, 0x4160}, {0x8232F837, 0x4336, 0x4336}, {0x8232F838, 0x4338, 0x4338},
+    {0x8233A338, 0x44D5, 0x44D5}, {0x8233A339, 0x44D7, 0x44D7}, {0x8233C931, 0x464B, 0x464B}, {0x8233C932, 0x464D, 0x464D},
+    {0x8233E837, 0x478C, 0x478C}, {0x8233E838, 0x478E, 0x478E}, {0x82349638, 0x4946, 0x4946}, {0x82349639, 0x4948, 0x4948},
+    {0x8234A130, 0x49B5, 0x49B5}, {0x8234A131, 0x49B8, 0x49B8}, {0x8234E733, 0x4C76, 0x4C76}, {0x8234E734, 0x4C78, 0x4C78},
+    {0x82358F32, 0x4DFF, 0x4DFF}, {0x82358F33, 0x9FA6, 0x9FA6}, {0x8336C738, 0xD7FF, 0xD7FF}, {0x8336C739, 0xE76C, 0xE76C},
+    {0x8336CF39, 0xE863, 0xE863}, {0x8336D030, 0xE865, 0xE865}, {0x84308534, 0xF92B, 0xF92B}, {0x84308535, 0xF92D, 0xF92D},
+    {0x84309C37, 0xFA26, 0xFA26}, {0x84309C38, 0xFA2A, 0xFA2A}, {0x84318537, 0xFE2F, 0xFE2F}, {0x84318538, 0xFE32, 0xFE32},
+    {0x8431A233, 0xFFDF, 0xFFDF}, {0x8431A234, 0xFFE6, 0xFFE6}, {0x8431A439, 0xFFFF, 0xFFFF}, {0x8431A530, 0x0, 0x0},
+    {0x8F39FE39, 0x0, 0x0}, {0x90308130, 0x10000, 0x10000}, {0x95328235, 0x1FFFF, 0x1FFFF}, {0x95328236, 0x20000, 0x20000},
+    {0x9A348431, 0x2FFFF, 0x2FFFF}, {0x9A348432, 0x30000, 0x30000}, {0x9F368537, 0x3FFFF, 0x3FFFF}, {0x9F368538, 0x40000, 0x40000},
+    {0xA4388733, 0x4FFFF, 0x4FFFF}, {0xA4388734, 0x50000, 0x50000}, {0xAA308839, 0x5FFFF, 0x5FFFF}, {0xAA308930, 0x60000, 0x60000},
+    {0xAF328A35, 0x6FFFF, 0x6FFFF}, {0xAF328A36, 0x70000, 0x70000}, {0xB4348C31, 0x7FFFF, 0x7FFFF}, {0xB4348C32, 0x80000, 0x80000},
+    {0xB9368D37, 0x8FFFF, 0x8FFFF}, {0xB9368D38, 0x90000, 0x90000}, {0xBE388F33, 0x9FFFF, 0x9FFFF}, {0xBE388F34, 0xA0000, 0xA0000},
+    {0xC4309039, 0xAFFFF, 0xAFFFF}, {0xC4309130, 0xB0000, 0xB0000}, {0xC9329235, 0xBFFFF, 0xBFFFF}, {0xC9329236, 0xC0000, 0xC0000},
+    {0xCE349431, 0xCFFFF, 0xCFFFF}, {0xCE349432, 0xD0000, 0xD0000}, {0xD3369537, 0xDFFFF, 0xDFFFF}, {0xD3369538, 0xE0000, 0xE0000},
+    {0xD8389733, 0xEFFFF, 0xEFFFF}, {0xD8389734, 0xF0000, 0xF0000}, {0xDE309839, 0xFFFFF, 0xFFFFF}, {0xDE309930, 0x100000, 0x100000},
+    {0xE3329A35, 0x10FFFF, 0x10FFFF}, {0xE3329A36, 0x0, 0x0}, {0xFD308130, 0x0, 0x0}, {0xFE39FE39, 0x0, 0x0},
+};
+static constexpr Gb18030Difference GB18030_DIFFERENCES[26] = {
+    {0xA6D9, 0xE78D, 0xFE10, true}, {0xA6DA, 0xE78E, 0xFE12, true}, {0xA6DB, 0xE78F, 0xFE11, true}, {0xA6DC, 0xE790, 0xFE13, true},
+    {0xA6DD, 0xE791, 0xFE14, true}, {0xA6DE, 0xE792, 0xFE15, true}, {0xA6DF, 0xE793, 0xFE16, true}, {0xA6EC, 0xE794, 0xFE17, true},
+    {0xA6ED, 0xE795, 0xFE18, true}, {0xA6F3, 0xE796, 0xFE19, true}, {0xA8BC, 0xE7C7, 0x1E3F, false}, {0xFE51, 0xE816, 0x20087, true},
+    {0xFE52, 0xE817, 0x20089, true}, {0xFE53, 0xE818, 0x200CC, true}, {0xFE59, 0xE81E, 0x9FB4, true}, {0xFE61, 0xE826, 0x9FB5, true},
+    {0xFE66, 0xE82B, 0x9FB6, true}, {0xFE67, 0xE82C, 0x9FB7, true}, {0xFE6C, 0xE831, 0x215D7, true}, {0xFE6D, 0xE832, 0x9FB8, true},
+    {0xFE76, 0xE83B, 0x2298F, true}, {0xFE7E, 0xE843, 0x9FB9, true}, {0xFE90, 0xE854, 0x9FBA, true}, {0xFE91, 0xE855, 0x241FE, true},
+    {0xFEA0, 0xE864, 0x9FBB, true}, {0x8135F437, 0x1E3F, 0xE7C7, false},
+};
+static std::uint32_t Gb18030Bytes(std::uint32_t linear) {
+    return (0x81 + linear / 12600) << 24 | (0x30 + linear / 1260 % 10) << 16 | (0x81 + linear / 10 % 126) << 8 | (0x30 + linear % 10);
+}
+
+static void Fnv(std::uint32_t& hash, std::uint32_t value) {
+    for (int i = 0; i < 4; ++i) {
+        hash ^= (value >> (8 * i)) & 0xFF;
+        hash *= 0x01000193;
+    }
+}
+
+static std::uint32_t Gb18030Decode(const void* gb, std::uint32_t packed) {
+    std::uint8_t bytes[4] = {};
+    const std::uint32_t size = packed > 0xFFFF ? 4 : 2;
+    for (std::uint32_t i = 0; i < size; ++i) bytes[i] = static_cast<std::uint8_t>(packed >> (8 * (size - 1 - i)));
+    std::uint32_t consumed = 0x55;
+    std::uint32_t code = 0xDEADBEEF;
+    const int result = sceCesGbToUtf32(gb, bytes, size, &consumed, &code);
+    if (result != 0) {
+        Require(result == unassignedCode && consumed == size && code == 0);
+        return 0;
+    }
+    Require(consumed == size);
+    return code;
+}
+
+static std::uint32_t Gb18030Encode(const void* gb, std::uint32_t code) {
+    std::uint8_t bytes[4] = {};
+    std::uint32_t size = 0;
+    Require(sceCesUtf32ToGb(code, gb, bytes, sizeof(bytes), &size) == 0 && (size == 2 || size == 4));
+    std::uint32_t packed = 0;
+    for (std::uint32_t i = 0; i < size; ++i) packed = packed << 8 | bytes[i];
+    return packed;
+}
+
+static void RequireGb18030Error(const void* gb, const char* bytes, std::uint32_t size, int error, std::uint32_t length) {
+    std::uint32_t consumed = 0x55;
+    std::uint32_t utf32 = 0xDEADBEEF;
+    Require(sceCesGbToUtf32(gb, Bytes(bytes), size, &consumed, &utf32) == error && consumed == length && utf32 == 0);
+    std::uint16_t ucs2 = 0xBEEF;
+    consumed = 0x55;
+    Require(sceCesMbcToUcs2(gb, Bytes(bytes), size, &consumed, &ucs2) == error && consumed == length && ucs2 == 0);
+}
+
+static void CheckGb18030(const void* gb, bool revision2005, std::uint32_t twoByteHash, std::uint32_t fourByteHash, std::uint32_t encodeHash, int fourByteOneWay, int codeOneWay) {
+    std::uint32_t hash = 0x811C9DC5;
+    for (std::uint32_t cell = 0; cell < 126 * 190; ++cell) {
+        const std::uint32_t column = cell % 190;
+        const std::uint32_t bytes = (0x81 + cell / 190) << 8 | (column < 0x3F ? 0x40 + column : 0x41 + column);
+        const std::uint32_t code = Gb18030Decode(gb, bytes);
+        Require(code != 0 && Gb18030Encode(gb, code) == bytes);
+        Fnv(hash, code);
+    }
+    Require(hash == twoByteHash);
+
+    hash = 0x811C9DC5;
+    int oneWay = 0;
+    for (std::uint32_t linear = 0; linear < 39420; ++linear) {
+        const std::uint32_t bytes = Gb18030Bytes(linear);
+        const std::uint32_t code = Gb18030Decode(gb, bytes);
+        Require(code >= 0x80 && code <= 0xFFFF);
+        const std::uint32_t back = Gb18030Encode(gb, code);
+        if (back != bytes) {
+            Require(back <= 0xFFFF && Gb18030Decode(gb, back) == code);
+            ++oneWay;
+        }
+        Fnv(hash, code);
+    }
+    Require(hash == fourByteHash && oneWay == fourByteOneWay);
+
+    hash = 0x811C9DC5;
+    oneWay = 0;
+    for (std::uint32_t code = 0x80; code < 0x10000; ++code) {
+        if (code >= 0xD800 && code <= 0xDFFF) continue;
+        const std::uint32_t bytes = Gb18030Encode(gb, code);
+        if (Gb18030Decode(gb, bytes) != code) ++oneWay;
+        Fnv(hash, bytes);
+    }
+    Require(hash == encodeHash && oneWay == codeOneWay);
+
+    hash = 0x811C9DC5;
+    int samples = 0;
+    for (std::uint32_t linear = 189000; linear <= 189000 + 0xFFFFF; linear += 997) {
+        Fnv(hash, Gb18030Decode(gb, Gb18030Bytes(linear)));
+        ++samples;
+    }
+    Require(hash == 0x9E77B552 && samples == 1052);
+    hash = 0x811C9DC5;
+    for (std::uint32_t code = 0x10000; code < 0x110000; code += 997) Fnv(hash, Gb18030Encode(gb, code));
+    Require(hash == 0x3D088D7E);
+
+    for (const Gb18030Sequence& entry : GB18030_BOUNDARIES) {
+        const std::uint32_t code = revision2005 ? entry.code2005 : entry.code2000;
+        Require(Gb18030Decode(gb, entry.bytes) == code);
+        if (code != 0) Require(Gb18030Encode(gb, code) == entry.bytes);
+    }
+    for (const Gb18030Difference& entry : GB18030_DIFFERENCES) {
+        const std::uint32_t code = revision2005 ? entry.code2005 : entry.code2000;
+        Require(Gb18030Decode(gb, entry.bytes) == code && Gb18030Encode(gb, code) == entry.bytes);
+        if (revision2005 && entry.fallback) Require(Gb18030Encode(gb, entry.code2000) == entry.bytes);
+    }
+
+    RequireGb18030Error(gb, "\x80", 1, invalidEncode, 1);
+    RequireGb18030Error(gb, "\xFF", 1, invalidEncode, 1);
+    RequireGb18030Error(gb, "\x81", 1, srcBufferEnd, 2);
+    RequireGb18030Error(gb, "\x81\x30", 2, srcBufferEnd, 4);
+    RequireGb18030Error(gb, "\x81\x30\x81", 3, srcBufferEnd, 4);
+    RequireGb18030Error(gb, "\x81\x00", 2, invalidEncode, 1);
+    RequireGb18030Error(gb, "\x81\x2F", 2, invalidEncode, 2);
+    RequireGb18030Error(gb, "\x81\x3A", 2, invalidEncode, 2);
+    RequireGb18030Error(gb, "\x81\x7F", 2, invalidEncode, 2);
+    RequireGb18030Error(gb, "\x81\xFF", 2, invalidEncode, 2);
+    RequireGb18030Error(gb, "\x81\x30\x80\x30", 4, invalidEncode, 4);
+    RequireGb18030Error(gb, "\x81\x30\xFF\x30", 4, invalidEncode, 4);
+    RequireGb18030Error(gb, "\x81\x30\x30\x30", 4, invalidEncode, 4);
+    RequireGb18030Error(gb, "\x81\x30\x81\x2F", 4, invalidEncode, 4);
+    RequireGb18030Error(gb, "\x81\x30\x81\x3A", 4, invalidEncode, 4);
+    RequireGb18030Error(gb, "\x81\x30\x81\x81", 4, invalidEncode, 4);
+    RequireGb18030Error(gb, "\x84\x31\xA5\x30", 4, unassignedCode, 4);
+    RequireGb18030Error(gb, "\xE3\x32\x9A\x36", 4, unassignedCode, 4);
+    RequireGb18030Error(gb, "\xFE\x39\xFE\x39", 4, unassignedCode, 4);
+
+    std::uint32_t consumed = 0x55;
+    std::uint32_t produced = 0x55;
+    std::uint16_t ucs2 = 0xBEEF;
+    Require(sceCesGbToUcs2(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, &ucs2) == unassignedCode && consumed == 0x55 && ucs2 == 0xBEEF);
+    std::uint8_t utf8[4] = {1, 2, 3, 4};
+    Require(sceCesGbToUtf8(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, utf8, 3, &produced) == dstBufferEnd && consumed == 0x55 && produced == 0x55);
+    Require(std::memcmp(utf8, "\x01\x02\x03\x04", 4) == 0);
+    Require(sceCesGbToUtf8(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, utf8, 4, &produced) == 0 && consumed == 4 && produced == 4);
+    Require(std::memcmp(utf8, "\xF0\x90\x80\x80", 4) == 0);
+    std::uint16_t utf16[2] = {0xBEEF, 0xBEEF};
+    produced = 0x55;
+    Require(sceCesGbToUtf16(gb, Bytes("\xE3\x32\x9A\x35"), 4, &consumed, utf16, 1, &produced) == dstBufferEnd && produced == 0x55 && utf16[0] == 0xBEEF);
+    Require(sceCesGbToUtf16(gb, Bytes("\xE3\x32\x9A\x35"), 4, &consumed, utf16, 2, &produced) == 0 && produced == 2 && utf16[0] == 0xDBFF && utf16[1] == 0xDFFF);
+    Require(sceCesGbToUtf16be(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, utf16, 2, &produced) == 0 && std::memcmp(utf16, "\xD8\x00\xDC\x00", 4) == 0);
+    Require(sceCesMbcToUtf16le(gb, Bytes("\x94\x39\xFC\x36"), 4, &consumed, utf16, 2, &produced) == 0 && consumed == 4 && std::memcmp(utf16, "\x3D\xD8\x00\xDE", 4) == 0);
+    Require(sceCesGbToUcs2(gb, Bytes("\xA2\xE3"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x20AC);
+
+    std::uint8_t mbcs[4] = {1, 2, 3, 4};
+    produced = 0x55;
+    Require(sceCesUtf32ToGb(0x10000, gb, mbcs, 3, &produced) == dstBufferEnd && produced == 4 && std::memcmp(mbcs, "\x01\x02\x03\x04", 4) == 0);
+    Require(sceCesUtf32ToGb(0xD800, gb, mbcs, sizeof(mbcs), &produced) == outOfCodeSpace);
+    Require(sceCesUtf32ToGb(0x110000, gb, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    Require(sceCesUcs2ToGb(0x80, gb, mbcs, sizeof(mbcs), &produced) == 0 && produced == 4 && std::memcmp(mbcs, "\x81\x30\x81\x30", 4) == 0);
+    Require(sceCesUcs2ToGb(0x20AC, gb, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\xA2\xE3", 2) == 0);
+    Require(sceCesUtf8ToGb(Bytes("\xF0\x9F\x98\x80"), 4, &consumed, gb, mbcs, sizeof(mbcs), &produced) == 0 && consumed == 4 && produced == 4);
+    Require(std::memcmp(mbcs, "\x94\x39\xFC\x36", 4) == 0);
+    const std::uint16_t pair[2] = {0xD83D, 0xDE00};
+    Require(sceCesUtf16ToGb(pair, 2, &consumed, gb, mbcs, sizeof(mbcs), &produced) == 0 && consumed == 2 && produced == 4 && std::memcmp(mbcs, "\x94\x39\xFC\x36", 4) == 0);
+    Require(sceCesUtf16ToGb(pair, 1, &consumed, gb, mbcs, sizeof(mbcs), &produced) == srcBufferEnd);
+
+    alignas(8) std::uint8_t context[64] = {};
+    Require(sceCesMbcsUcsContextInit(context, gb) == 0);
+    const char* utf8Text = "A\xE4\xB8\xAD\xC2\x80\xF0\x9F\x98\x80\xEF\xB8\x90";
+    const char* gbText = revision2005 ? "A\xD6\xD0\x81\x30\x81\x30\x94\x39\xFC\x36\xA6\xD9" : "A\xD6\xD0\x81\x30\x81\x30\x94\x39\xFC\x36\x84\x31\x82\x36";
+    const std::uint32_t gbSize = revision2005 ? 13 : 15;
+    std::uint8_t text[16] = {};
+    Require(sceCesUtf8StrToMbcsStr(context, Bytes(utf8Text), 13, &consumed, text, sizeof(text), &produced) == 0 && consumed == 13 && produced == gbSize);
+    Require(std::memcmp(text, gbText, gbSize) == 0);
+    std::uint8_t backUtf8[16] = {};
+    Require(sceCesMbcsStrToUtf8Str(context, text, gbSize, &consumed, backUtf8, sizeof(backUtf8), &produced) == 0 && consumed == gbSize && produced == 13);
+    Require(std::memcmp(backUtf8, utf8Text, 13) == 0);
+    std::uint16_t backUtf16[8] = {};
+    Require(sceCesMbcsStrToUtf16Str(context, text, gbSize, &consumed, backUtf16, 8, &produced) == 0 && consumed == gbSize && produced == 6);
+    Require(backUtf16[0] == 'A' && backUtf16[1] == 0x4E2D && backUtf16[2] == 0x80 && backUtf16[3] == 0xD83D && backUtf16[4] == 0xDE00 && backUtf16[5] == 0xFE10);
+    std::uint16_t shortUtf16[4] = {};
+    Require(sceCesMbcsStrToUtf16Str(context, text, gbSize, &consumed, shortUtf16, 4, &produced) == dstBufferEnd);
+    Require(sceCesMbcsStrGetUtf16Len(context, text, gbSize, &consumed, &produced) == 0 && consumed == gbSize && produced == 6);
+    std::uint8_t again[16] = {};
+    Require(sceCesUtf16StrToMbcsStr(context, backUtf16, 6, &consumed, again, sizeof(again), &produced) == 0 && consumed == 6 && produced == gbSize);
+    Require(std::memcmp(again, gbText, gbSize) == 0);
+    std::uint16_t ucs2Text[8] = {};
+    Require(sceCesMbcsStrToUcs2Str(context, text, gbSize, &consumed, ucs2Text, 8, &produced) == unassignedCode);
+    Require(sceCesUtf8StrToMbcsStr(context, Bytes("\xC2\x80"), 2, &consumed, text, 3, &produced) == dstBufferEnd);
+}
+
+int main() {
     alignas(8) std::uint8_t eucSheet[64] = {};
     alignas(8) std::uint8_t gbkSheet[64] = {};
     alignas(8) std::uint8_t sjisSheet[64] = {};
@@ -91,7 +292,7 @@ int main() {
     Require(sceCesUcs2ToEucCn(0x4E02, euc, mbcs, sizeof(mbcs), &produced) == unassignedCode);
     Require(sceCesUcs2ToEucCn(0x20AC, euc, mbcs, sizeof(mbcs), &produced) == unassignedCode);
     Require(sceCesUcs2ToEucCn(0x4E2D, euc, mbcs, 1, &produced) == dstBufferEnd);
-    Require(sceCesUcs2ToEucCn(0xDC00, euc, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    Require(sceCesUcs2ToEucCn(0xDC00, euc, mbcs, sizeof(mbcs), &produced) == outOfCodeSpace);
     Require(sceCesUcs2ToGb(0x4E02, gbk, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\x81\x40", 2) == 0);
     Require(sceCesUcs2ToGb(0x20AC, gbk, mbcs, sizeof(mbcs), &produced) == 0 && produced == 1 && mbcs[0] == 0x80);
     Require(sceCesUcs2ToGb(0x3042, euc, mbcs, sizeof(mbcs), &produced) == invalidParameter);
@@ -134,5 +335,16 @@ int main() {
     std::uint8_t back[16] = {};
     Require(sceCesMbcsStrToUtf8Str(context, text, produced, &consumed, back, sizeof(back), &produced) == 0);
     Require(consumed == 4 && produced == 7 && std::memcmp(back, "A\xE4\xB8\xAD\xE2\x82\xAC", 7) == 0);
+
+    alignas(8) std::uint8_t gb2000Sheet[64] = {};
+    alignas(8) std::uint8_t gb2005Sheet[64] = {};
+    const void* gb2000 = sceCesUcsProfileInitGb18030_2000(gb2000Sheet);
+    const void* gb2005 = sceCesUcsProfileInitGb18030_2005(gb2005Sheet);
+    Require(gb2000 == gb2000Sheet && gb2005 == gb2005Sheet);
+    Require(sceCesUcsProfileInitGb18030_2000(nullptr) == nullptr && sceCesUcsProfileInitGb18030_2005(nullptr) == nullptr);
+    Require(sceCesEucCnToUcs2(gb2000, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesGbToUcs2(gb2005, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x4E2D);
+    CheckGb18030(gb2000, false, 0xE61D3BD3, 0x83476043, 0x469CFCE5, 0, 0);
+    CheckGb18030(gb2005, true, 0x83EDDA69, 0x8D188DFC, 0x31CD0B55, 18, 24);
     return 0;
 }
diff --git a/core/libs/tests/GuestCesDbcs.cpp b/core/libs/tests/GuestCesDbcs.cpp
index 552f5193e9..bd3edaa068 100644
--- a/core/libs/tests/GuestCesDbcs.cpp
+++ b/core/libs/tests/GuestCesDbcs.cpp
@@ -1,29 +1,46 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-void* APS5_VABI sceCesUcsProfileInitEucKr(void*);
-void* APS5_VABI sceCesUcsProfileInitUhc(void*);
-void* APS5_VABI sceCesUcsProfileInitBig5Cp950(void*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-int APS5_VABI sceCesEucKrToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUhcToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesBig5ToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsUcsContextInit(void*, const void*);
-int APS5_VABI sceCesUtf8StrToMbcsStr(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUtf8Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUcs2StrToMbcsStr(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUcs2Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-}
-
 using ToUtf8 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using ToUcs2 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
+using ToUtf16 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
+using ToUtf32 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
+using FromUcs2 = int (APS5_VABI*)(std::uint16_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf8 = int (APS5_VABI*)(const std::uint8_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf16 = int (APS5_VABI*)(const std::uint16_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf32 = int (APS5_VABI*)(std::uint32_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf32Unit = int (APS5_VABI*)(const std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+
+struct Decoders {
+    ToUtf8 utf8;
+    ToUcs2 ucs2;
+    ToUtf16 utf16[3];
+    ToUtf32 utf32[3];
+};
+
+struct Encoders {
+    FromUcs2 ucs2;
+    FromUtf8 utf8;
+    FromUtf16 utf16[3];
+    FromUtf32 utf32;
+    FromUtf32Unit utf32Unit[3];
+};
+
+constexpr Decoders eucKrDecoders = {sceCesEucKrToUtf8, sceCesEucKrToUcs2, {sceCesEucKrToUtf16, sceCesEucKrToUtf16be, sceCesEucKrToUtf16le}, {sceCesEucKrToUtf32, sceCesEucKrToUtf32be, sceCesEucKrToUtf32le}};
+constexpr Decoders uhcDecoders = {sceCesUhcToUtf8, sceCesUhcToUcs2, {sceCesUhcToUtf16, sceCesUhcToUtf16be, sceCesUhcToUtf16le}, {sceCesUhcToUtf32, sceCesUhcToUtf32be, sceCesUhcToUtf32le}};
+constexpr Decoders big5Decoders = {sceCesBig5ToUtf8, sceCesBig5ToUcs2, {sceCesBig5ToUtf16, sceCesBig5ToUtf16be, sceCesBig5ToUtf16le}, {sceCesBig5ToUtf32, sceCesBig5ToUtf32be, sceCesBig5ToUtf32le}};
+constexpr Encoders eucKrEncoders = {sceCesUcs2ToEucKr, sceCesUtf8ToEucKr, {sceCesUtf16ToEucKr, sceCesUtf16beToEucKr, sceCesUtf16leToEucKr}, sceCesUtf32ToEucKr, {nullptr, sceCesUtf32beToEucKr, sceCesUtf32leToEucKr}};
+constexpr Encoders uhcEncoders = {sceCesUcs2ToUhc, sceCesUtf8ToUhc, {sceCesUtf16ToUhc, sceCesUtf16beToUhc, sceCesUtf16leToUhc}, sceCesUtf32ToUhc, {nullptr, sceCesUtf32beToUhc, sceCesUtf32leToUhc}};
+constexpr Encoders big5Encoders = {sceCesUcs2ToBig5, sceCesUtf8ToBig5, {sceCesUtf16ToBig5, sceCesUtf16beToBig5, sceCesUtf16leToBig5}, sceCesUtf32ToBig5, {nullptr, sceCesUtf32beToBig5, sceCesUtf32leToBig5}};
 
 constexpr int invalidParameter = static_cast<int>(0x805C0001);
 constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
 constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
 constexpr int invalidEncode = static_cast<int>(0x805C0014);
+constexpr int illegalCode = static_cast<int>(0x805C0015);
 constexpr int unassignedCode = static_cast<int>(0x805C0020);
 constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
 constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
@@ -69,7 +86,8 @@ static int Scalar(ToUtf8 convert, const void* profile, const char* source, std::
     std::uint32_t consumed = 77;
     std::uint32_t produced = 77;
     const int result = convert(profile, Bytes(source), sourceMax, &consumed, utf8, utf8Max, &produced);
-    if (result != 0) Require(consumed == 77 && produced == 77 && std::memcmp(utf8, "\x55\x55\x55\x55", 4) == 0);
+    const bool decodeError = source && sourceMax > 0 && (result == static_cast<int>(0x805C0011) || result == static_cast<int>(0x805C0014) || result == static_cast<int>(0x805C0020));
+    if (result != 0) Require((decodeError ? consumed != 77 && produced == 0 : consumed == 77 && produced == 77) && std::memcmp(utf8, "\x55\x55\x55\x55", 4) == 0);
     return result;
 }
 
@@ -96,20 +114,151 @@ static std::uint32_t RoundTripMismatches(void* context) {
     for (std::uint32_t lead = 0x81; lead < 0xFF; ++lead) {
         for (std::uint32_t trail = 0x40; trail < 0xFF; ++trail) {
             const std::uint8_t source[2] = {static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
-            std::uint16_t ucs2 = 0;
+            std::uint16_t ucs2[2] = {};
             std::uint32_t read = 0;
             std::uint32_t written = 0;
-            if (sceCesMbcsStrToUcs2Str(context, source, sizeof(source), &read, &ucs2, 1, &written) != 0) continue;
-            Require(read == 2 && written == 1);
-            std::uint8_t back[2] = {};
-            Require(sceCesUcs2StrToMbcsStr(context, &ucs2, 1, &read, back, sizeof(back), &written) == 0);
-            Require(read == 1 && written == 2);
-            if (std::memcmp(source, back, sizeof(back)) != 0) ++mismatches;
+            if (sceCesMbcsStrToUcs2Str(context, source, sizeof(source), &read, ucs2, 2, &written) != 0) continue;
+            Require(read == 2 && written == 1 && ucs2[1] == 0);
+            std::uint8_t back[3] = {};
+            Require(sceCesUcs2StrToMbcsStr(context, ucs2, 1, &read, back, sizeof(back), &written) == 0);
+            Require(read == 1 && written == 2 && back[2] == 0);
+            if (std::memcmp(source, back, sizeof(source)) != 0) ++mismatches;
         }
     }
     return mismatches;
 }
 
+static std::uint32_t Load(const void* data, std::uint32_t size, int order) {
+    if (order == 0) {
+        std::uint16_t unit = 0;
+        std::uint32_t wide = 0;
+        if (size == 2) std::memcpy(&unit, data, 2);
+        else std::memcpy(&wide, data, 4);
+        return size == 2 ? unit : wide;
+    }
+    const auto* bytes = static_cast<const std::uint8_t*>(data);
+    std::uint32_t value = 0;
+    for (std::uint32_t i = 0; i < size; ++i) value |= static_cast<std::uint32_t>(bytes[i]) << (8 * (order == 1 ? size - 1 - i : i));
+    return value;
+}
+
+static void Store(void* data, std::uint32_t size, int order, std::uint32_t value) {
+    if (order == 0) {
+        const auto unit = static_cast<std::uint16_t>(value);
+        if (size == 2) std::memcpy(data, &unit, 2);
+        else std::memcpy(data, &value, 4);
+        return;
+    }
+    auto* bytes = static_cast<std::uint8_t*>(data);
+    for (std::uint32_t i = 0; i < size; ++i) bytes[i] = static_cast<std::uint8_t>(value >> (8 * (order == 1 ? size - 1 - i : i)));
+}
+
+static std::uint32_t Utf8Code(const std::uint8_t* utf8, std::uint32_t length) {
+    if (length == 1) return utf8[0];
+    if (length == 2) return (utf8[0] & 0x1Fu) << 6 | (utf8[1] & 0x3Fu);
+    return (utf8[0] & 0x0Fu) << 12 | (utf8[1] & 0x3Fu) << 6 | (utf8[2] & 0x3Fu);
+}
+
+static std::uint32_t Utf8Bytes(std::uint32_t code, std::uint8_t* utf8) {
+    if (code < 0x80) {
+        utf8[0] = static_cast<std::uint8_t>(code);
+        return 1;
+    }
+    const std::uint32_t length = code < 0x800 ? 2 : code < 0x10000 ? 3 : 4;
+    for (std::uint32_t i = length - 1; i > 0; --i) {
+        utf8[i] = static_cast<std::uint8_t>(0x80 | (code & 0x3F));
+        code >>= 6;
+    }
+    utf8[0] = static_cast<std::uint8_t>((length == 2 ? 0xC0 : length == 3 ? 0xE0 : 0xF0) | code);
+    return length;
+}
+
+static void RequireDecoders(const Decoders& decoders, const void* profile) {
+    for (std::uint32_t lead = 0; lead < 256; ++lead) {
+        for (std::uint32_t trail = 0; trail < 256; ++trail) {
+            const std::uint8_t source[2] = {static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
+            std::uint8_t utf8[4] = {};
+            std::uint32_t consumed = 0;
+            std::uint32_t produced = 0;
+            const int expected = decoders.utf8(profile, source, sizeof(source), &consumed, utf8, sizeof(utf8), &produced);
+            const std::uint32_t code = expected == 0 ? Utf8Code(utf8, produced) : 0;
+            std::uint16_t ucs2 = 0x5555;
+            std::uint32_t read = 77;
+            Require(decoders.ucs2(profile, source, sizeof(source), &read, &ucs2) == expected);
+            Require(read == consumed && ucs2 == (expected == 0 ? code : 0));
+            for (int order = 0; order < 3; ++order) {
+                std::uint16_t utf16 = 0x5555;
+                std::uint32_t units = 77;
+                read = 77;
+                Require(decoders.utf16[order](profile, source, sizeof(source), &read, &utf16, 1, &units) == expected);
+                Require(read == consumed && (expected == 0 ? units == 1 && Load(&utf16, 2, order) == code : units == 0 && utf16 == 0x5555));
+                std::uint32_t utf32 = 0x55555555;
+                read = 77;
+                Require(decoders.utf32[order](profile, source, sizeof(source), &read, &utf32) == expected);
+                Require(read == consumed && (expected == 0 ? Load(&utf32, 4, order) == code : utf32 == 0));
+            }
+        }
+    }
+}
+
+struct Encoded {
+    std::uint8_t bytes[2] = {0x55, 0x55};
+    std::uint32_t size = 77;
+    std::uint32_t read = 77;
+};
+
+static int Encode(const Encoders& encoders, int form, std::uint32_t code, const void* profile, Encoded& out) {
+    std::uint8_t utf8[4] = {};
+    std::uint16_t utf16[2] = {};
+    std::uint32_t utf32 = 0;
+    if (form == 0) return encoders.ucs2(static_cast<std::uint16_t>(code), profile, out.bytes, sizeof(out.bytes), &out.size);
+    if (form == 1) return encoders.utf8(utf8, Utf8Bytes(code, utf8), &out.read, profile, out.bytes, sizeof(out.bytes), &out.size);
+    if (form <= 4) {
+        const int order = form - 2;
+        if (code < 0x10000) Store(utf16, 2, order, code);
+        else {
+            Store(utf16, 2, order, 0xD800 | (code - 0x10000) >> 10);
+            Store(utf16 + 1, 2, order, 0xDC00 | (code & 0x3FF));
+        }
+        return encoders.utf16[order](utf16, code < 0x10000 ? 1 : 2, &out.read, profile, out.bytes, sizeof(out.bytes), &out.size);
+    }
+    if (form == 5) return encoders.utf32(code, profile, out.bytes, sizeof(out.bytes), &out.size);
+    Store(&utf32, 4, form - 5, code);
+    return encoders.utf32Unit[form - 5](&utf32, profile, out.bytes, sizeof(out.bytes), &out.size);
+}
+
+static std::uint32_t SourceUnits(int form, std::uint32_t code) {
+    if (form == 1) return code < 0x80 ? 1 : code < 0x800 ? 2 : code < 0x10000 ? 3 : 4;
+    if (form >= 2 && form <= 4) return code < 0x10000 ? 1 : 2;
+    return 77;
+}
+
+static void RequireEncode(const Encoders& encoders, const void* profile, std::uint32_t code, int expected, const std::uint8_t* bytes, std::uint32_t size) {
+    for (int form = 0; form < 8; ++form) {
+        if (form == 0 && code > 0xFFFF) continue;
+        Encoded out;
+        Require(Encode(encoders, form, code, profile, out) == expected);
+        if (expected == 0) Require(out.read == SourceUnits(form, code) && out.size == size && std::memcmp(out.bytes, bytes, size) == 0);
+        else Require(out.read == 77 && out.size == ((form == 0 || form >= 5) && expected != static_cast<int>(0x805C0001) ? 0u : 77u) && out.bytes[0] == 0x55 && out.bytes[1] == 0x55);
+    }
+}
+
+static void RequireEncoders(const Encoders& encoders, const void* profile, void* context) {
+    Require(sceCesMbcsUcsContextInit(context, profile) == 0);
+    for (std::uint32_t code = 1; code < 0x10000; ++code) {
+        if (code >= 0xD800 && code <= 0xDFFF) continue;
+        const auto ucs2 = static_cast<std::uint16_t>(code);
+        std::uint8_t bytes[3] = {};
+        std::uint32_t read = 0;
+        std::uint32_t written = 0;
+        const int expected = sceCesUcs2StrToMbcsStr(context, &ucs2, 1, &read, bytes, sizeof(bytes), &written);
+        RequireEncode(encoders, profile, code, expected, bytes, written);
+    }
+    RequireEncode(encoders, profile, 0, 0, Bytes("\0"), 1);
+    RequireEncode(encoders, profile, 0x20000, unassignedCode, nullptr, 0);
+    RequireEncode(encoders, profile, 0x10FFFF, unassignedCode, nullptr, 0);
+}
+
 int main() {
     alignas(8) std::uint8_t eucKrSheet[64] = {};
     alignas(8) std::uint8_t uhcSheet[64] = {};
@@ -124,8 +273,10 @@ int main() {
     void* eucJp = sceCesUcsProfileInitEucJpCp51932(eucJpSheet);
     Require(eucKr == eucKrSheet && uhc == uhcSheet && big5 == big5Sheet && eucJp == eucJpSheet);
 
-    RequireTable(sceCesEucKrToUtf8, eucKr, 0x01FF720E36F4AD67ull, 8226);
-    RequireTable(sceCesUhcToUtf8, uhc, 0x3B861A7E911985ABull, 17048);
+    RequireTable(sceCesEucKrToUtf8, eucKr, 0x18F4D7FD5B554273ull, 8227);
+    RequireTable(sceCesUhcToUtf8, uhc, 0x33B12AA5FAB04C43ull, 17049);
+    RequireScalar(sceCesEucKrToUtf8, eucKr, "\xA2\xE8", "\xE3\x89\xBE");
+    RequireScalar(sceCesUhcToUtf8, uhc, "\xA2\xE8", "\xE3\x89\xBE");
     RequireTable(sceCesBig5ToUtf8, big5, 0xE4D0D6A8019F35D9ull, 13503);
 
     RequireScalar(sceCesEucKrToUtf8, eucKr, "\xB0\xA1", "\xEA\xB0\x80");
@@ -171,9 +322,94 @@ int main() {
 
     Require(sceCesMbcsUcsContextInit(context, big5) == 0);
     RequireString(context, "\xA4\xA4\xA4\xE5", "\xE4\xB8\xAD\xE6\x96\x87");
-    RequireString(context, "\xF9\xF9\xA2\x7E\xA4\x51\xA4\xCA", "\xE2\x95\x90\xE2\x95\xAD\xE5\x8D\x81\xE5\x8D\x85");
-    RequireString(context, "\xF9\xE9\xF9\xEB\xF9\xEA\xA2\xA1\xA2\xA3\xA2\xA2", "\xE2\x95\x9E\xE2\x95\xA1\xE2\x95\xAA\xE2\x95\xAE\xE2\x95\xAF\xE2\x95\xB0");
+    RequireString(context, "\xA2\xA4\xA2\x7E\xA4\x51\xA4\xCA", "\xE2\x95\x90\xE2\x95\xAD\xE5\x8D\x81\xE5\x8D\x85");
+    RequireString(context, "\xA2\xA5\xA2\xA7\xA2\xA6\xA2\xA1\xA2\xA3\xA2\xA2", "\xE2\x95\x9E\xE2\x95\xA1\xE2\x95\xAA\xE2\x95\xAE\xE2\x95\xAF\xE2\x95\xB0");
     Require(Utf8ToMbcs(context, "\xEA\xB0\x80") == unassignedCode);
     Require(RoundTripMismatches(context) == 10);
+
+    RequireDecoders(eucKrDecoders, eucKr);
+    RequireDecoders(uhcDecoders, uhc);
+    RequireDecoders(big5Decoders, big5);
+    RequireEncoders(eucKrEncoders, eucKr, context);
+    RequireEncoders(uhcEncoders, uhc, context);
+    RequireEncoders(big5Encoders, big5, context);
+
+    const std::uint8_t* ga = Bytes("\xB0\xA1");
+    std::uint16_t unit = 0;
+    std::uint32_t wide = 0;
+    std::uint32_t read = 0;
+    std::uint32_t units = 0;
+    Require(sceCesEucKrToUtf16be(eucKr, ga, 2, &read, &unit, 1, &units) == 0 && read == 2 && units == 1 && std::memcmp(&unit, "\xAC\x00", 2) == 0);
+    Require(sceCesEucKrToUtf16le(eucKr, ga, 2, &read, &unit, 1, &units) == 0 && std::memcmp(&unit, "\x00\xAC", 2) == 0);
+    Require(sceCesEucKrToUtf16(eucKr, ga, 2, nullptr, &unit, 1, nullptr) == 0 && unit == 0xAC00);
+    Require(sceCesEucKrToUtf32be(eucKr, ga, 2, &read, &wide) == 0 && read == 2 && std::memcmp(&wide, "\x00\x00\xAC\x00", 4) == 0);
+    Require(sceCesEucKrToUtf32le(eucKr, ga, 2, &read, &wide) == 0 && std::memcmp(&wide, "\x00\xAC\x00\x00", 4) == 0);
+    Require(sceCesEucKrToUtf32(eucKr, ga, 2, nullptr, &wide) == 0 && wide == 0xAC00);
+    Require(sceCesEucKrToUcs2(eucKr, Bytes("\0"), 1, &read, &unit) == 0 && read == 1 && unit == 0);
+    Require(sceCesUhcToUcs2(uhc, Bytes("\x8C\x63"), 2, nullptr, &unit) == 0 && unit == 0xB620);
+    Require(sceCesBig5ToUtf32le(big5, Bytes("\xA4\xA4"), 2, &read, &wide) == 0 && std::memcmp(&wide, "\x2D\x4E\x00\x00", 4) == 0);
+
+    Require(sceCesEucKrToUtf16(uhc, nullptr, 0, nullptr, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesEucKrToUtf16(eucKr, nullptr, 0, nullptr, nullptr, 0, nullptr) == invalidSrcBuffer);
+    Require(sceCesEucKrToUtf16(eucKr, ga, 0, nullptr, nullptr, 0, nullptr) == srcBufferEnd);
+    Require(sceCesEucKrToUtf16(eucKr, ga, 2, nullptr, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesEucKrToUtf16(eucKr, Bytes("\x8C\x63"), 2, nullptr, &unit, 0, nullptr) == invalidEncode);
+    unit = 0x5555;
+    read = 77;
+    units = 77;
+    Require(sceCesEucKrToUtf16(eucKr, ga, 2, &read, &unit, 0, &units) == dstBufferEnd && unit == 0x5555 && read == 77 && units == 77);
+    Require(sceCesUhcToUcs2(uhc, ga, 2, nullptr, nullptr) == invalidDstBuffer);
+    Require(sceCesBig5ToUtf32(big5, Bytes("\xA4\xA4"), 1, nullptr, &wide) == srcBufferEnd);
+    Require(sceCesBig5ToUtf32be(eucJp, Bytes("\xA4\xA4"), 2, nullptr, &wide) == invalidParameter);
+    Require(sceCesBig5ToUtf32le(big5, Bytes("\xA4\xA4"), 2, nullptr, nullptr) == invalidDstBuffer);
+
+    RequireEncode(eucKrEncoders, eucKr, 0x20AC, 0, Bytes("\xA2\xE6"), 2);
+    RequireEncode(eucKrEncoders, eucKr, 0xB620, unassignedCode, nullptr, 0);
+    RequireEncode(uhcEncoders, uhc, 0xB620, 0, Bytes("\x8C\x63"), 2);
+    RequireEncode(big5Encoders, big5, 0x2550, 0, Bytes("\xA2\xA4"), 2);
+    RequireEncode(big5Encoders, big5, 0x255E, 0, Bytes("\xA2\xA5"), 2);
+    RequireEncode(big5Encoders, big5, 0x2561, 0, Bytes("\xA2\xA7"), 2);
+    RequireEncode(big5Encoders, big5, 0x256A, 0, Bytes("\xA2\xA6"), 2);
+    RequireEncode(big5Encoders, big5, 0x5341, 0, Bytes("\xA4\x51"), 2);
+    RequireEncode(big5Encoders, big5, 0xAC00, unassignedCode, nullptr, 0);
+    RequireEncode(eucKrEncoders, uhc, 0xAC00, invalidParameter, nullptr, 0);
+    RequireEncode(uhcEncoders, nullptr, 0xAC00, invalidParameter, nullptr, 0);
+    RequireEncode(big5Encoders, eucJp, 0x4E2D, invalidParameter, nullptr, 0);
+
+    std::uint8_t out[2] = {0x55, 0x55};
+    std::uint32_t size = 77;
+    read = 77;
+    const std::uint32_t big = 0x0000AC00;
+    Require(sceCesUcs2ToEucKr(0xAC00, uhc, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesUcs2ToEucKr(0xD800, eucKr, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesUcs2ToEucKr(0xD800, eucKr, out, 2, &size) == illegalCode);
+    Require(sceCesUtf32ToUhc(0x110000, uhc, out, 2, &size) == invalidEncode);
+    Require(sceCesUtf32ToUhc(0xDFFF, uhc, out, 2, &size) == illegalCode);
+    Require(sceCesUtf32beToBig5(nullptr, eucKr, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesUtf32beToBig5(nullptr, big5, nullptr, 0, nullptr) == invalidSrcBuffer);
+    Require(sceCesUtf32leToBig5(&big, big5, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesUtf8ToEucKr(nullptr, 0, nullptr, uhc, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesUtf8ToEucKr(nullptr, 0, nullptr, eucKr, nullptr, 0, nullptr) == invalidSrcBuffer);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 0, nullptr, eucKr, nullptr, 0, nullptr) == srcBufferEnd);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 3, nullptr, eucKr, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 2, &read, eucKr, out, 2, &size) == srcBufferEnd);
+    Require(sceCesUtf8ToEucKr(Bytes("\xC0\x80"), 2, &read, eucKr, out, 2, &size) == illegalCode);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 3, &read, eucKr, out, 1, &size) == dstBufferEnd);
+    const std::uint16_t lowSurrogate[1] = {0xDC00};
+    const std::uint16_t highSurrogate[2] = {0xD800, 0x0041};
+    Require(sceCesUtf16ToUhc(lowSurrogate, 1, &read, uhc, out, 2, &size) == invalidEncode);
+    Require(sceCesUtf16ToUhc(highSurrogate, 1, &read, uhc, out, 2, &size) == srcBufferEnd);
+    Require(sceCesUtf16ToUhc(highSurrogate, 2, &read, uhc, out, 2, &size) == invalidEncode);
+    Require(out[0] == 0x55 && out[1] == 0x55 && size == 0 && read == 77);
+
+    std::memcpy(&unit, "\xAC\x00", 2);
+    Require(sceCesUtf16beToEucKr(&unit, 1, &read, eucKr, out, 2, &size) == 0 && read == 1 && size == 2 && std::memcmp(out, "\xB0\xA1", 2) == 0);
+    std::memcpy(&unit, "\x00\xAC", 2);
+    Require(sceCesUtf16leToUhc(&unit, 1, nullptr, uhc, out, 2, nullptr) == 0 && std::memcmp(out, "\xB0\xA1", 2) == 0);
+    std::memcpy(&wide, "\x00\x00\x4E\x2D", 4);
+    Require(sceCesUtf32beToBig5(&wide, big5, out, 2, &size) == 0 && size == 2 && std::memcmp(out, "\xA4\xA4", 2) == 0);
+    std::memcpy(&wide, "\x2D\x4E\x00\x00", 4);
+    Require(sceCesUtf32leToBig5(&wide, big5, out, 2, nullptr) == 0 && std::memcmp(out, "\xA4\xA4", 2) == 0);
+    Require(sceCesUcs2ToEucKr(0, eucKr, out, 1, &size) == 0 && size == 1 && out[0] == 0);
     return 0;
 }
diff --git a/core/libs/tests/GuestCesJapanese.cpp b/core/libs/tests/GuestCesJapanese.cpp
index 2103b87187..42b8e2c16e 100644
--- a/core/libs/tests/GuestCesJapanese.cpp
+++ b/core/libs/tests/GuestCesJapanese.cpp
@@ -1,49 +1,245 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
-
-extern "C" {
-void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1252(void);
-int APS5_VABI sceCesSJisToUcs2(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
-int APS5_VABI sceCesSJisToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSJisToUtf16(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSJisToUtf16be(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSJisToUtf16le(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSJisToUtf32(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesSJisToUtf32be(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesSJisToUtf32le(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesEucJpToUtf16(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesEucJpToUtf16be(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesEucJpToUtf32(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesEucJpToUtf32le(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesUcs2ToSJis(std::uint16_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUcs2ToEucJp(std::uint16_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8ToSJis(const std::uint8_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8ToEucJp(const std::uint8_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf16ToSJis(const std::uint16_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf16beToEucJp(const std::uint16_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf32ToSJis(std::uint32_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf32beToSJis(const std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf32leToEucJp(const std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSJisCodeToJisX0208(std::uint16_t, std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesJisX0208ToSJisCode(std::uint8_t, std::uint8_t, std::uint16_t*);
-}
+#include <iterator>
+#include <stdexcept>
+#include <string>
 
 static void Require(bool value) { if (!value) std::abort(); }
 
 static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
 
+constexpr int invalidParameter = static_cast<int>(0x805C0001);
+constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+constexpr int invalidEncode = static_cast<int>(0x805C0014);
+constexpr int outOfCodeSpace = static_cast<int>(0x805C0015);
+constexpr int unassignedCode = static_cast<int>(0x805C0020);
+constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+constexpr std::uint32_t jisX0208Cells = 6879;
+constexpr std::uint32_t eucJisX0208Digest = 0xC1C98702;
+constexpr std::uint32_t sjisJisX0208Digest = 0x0CE46B27;
+constexpr std::uint32_t jisX0212Cells = 6067;
+constexpr std::uint32_t jisX0212Digest = 0x7C193A73;
+
+static std::uint32_t Digest(std::uint32_t hash, std::uint16_t value) {
+    hash = (hash ^ (value & 0xFF)) * 0x01000193u;
+    return (hash ^ (value >> 8)) * 0x01000193u;
+}
+
+static int EucToUcs2(const void* profile, const char* bytes, std::uint32_t size, std::uint16_t& ucs2) {
+    std::uint32_t used = 0;
+    return sceCesEucJpToUcs2(profile, Bytes(bytes), size, &used, &ucs2);
+}
+
+static int SJisToUcs2(const void* profile, const char* bytes, std::uint32_t size, std::uint16_t& ucs2) {
+    std::uint32_t used = 0;
+    return sceCesSJisToUcs2(profile, Bytes(bytes), size, &used, &ucs2);
+}
+
+static bool EucEncodes(const void* profile, std::uint16_t ucs2, const char* expected) {
+    std::uint8_t mbcs[4] = {};
+    std::uint32_t size = 0;
+    return sceCesUcs2ToEucJp(ucs2, profile, mbcs, sizeof(mbcs), &size) == 0 && size == std::strlen(expected) && std::memcmp(mbcs, expected, size) == 0;
+}
+
+static bool SJisEncodes(const void* profile, std::uint16_t ucs2, const char* expected) {
+    std::uint8_t mbcs[4] = {};
+    std::uint32_t size = 0;
+    return sceCesUcs2ToSJis(ucs2, profile, mbcs, sizeof(mbcs), &size) == 0 && size == std::strlen(expected) && std::memcmp(mbcs, expected, size) == 0;
+}
+
+static bool EncodeLeavesOutputs(int expected, const void* profile, std::uint16_t ucs2, bool sjis) {
+    std::uint8_t mbcs[4] = {0xEE, 0xEE, 0xEE, 0xEE};
+    std::uint32_t size = 77;
+    const int result = sjis ? sceCesUcs2ToSJis(ucs2, profile, mbcs, sizeof(mbcs), &size) : sceCesUcs2ToEucJp(ucs2, profile, mbcs, sizeof(mbcs), &size);
+    return result == expected && size == (expected == static_cast<int>(0x805C0001) ? 77u : 0u) && mbcs[0] == 0xEE && mbcs[1] == 0xEE && mbcs[2] == 0xEE;
+}
+
+static bool DecodeRejects(int expected, std::uint32_t length, const void* profile, const char* bytes, std::uint32_t size, bool sjis) {
+    std::uint32_t used = 77;
+    std::uint16_t ucs2 = 0xEEEE;
+    const int result = sjis ? sceCesSJisToUcs2(profile, Bytes(bytes), size, &used, &ucs2) : sceCesEucJpToUcs2(profile, Bytes(bytes), size, &used, &ucs2);
+    if (!sjis) return result == expected && ucs2 == 0;
+    return result == expected && used == length && ucs2 == 0;
+}
+
+static void SweepEucJisX0208(const void* profile) {
+    std::uint32_t assigned = 0;
+    std::uint32_t hash = 0x811C9DC5u;
+    for (std::uint32_t lead = 0xA1; lead <= 0xFE; ++lead) {
+        for (std::uint32_t trail = 0xA1; trail <= 0xFE; ++trail) {
+            const std::uint8_t cell[2] = {static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
+            std::uint32_t used = 77;
+            std::uint16_t ucs2 = 0xEEEE;
+            std::uint16_t value = 0;
+            if (const int result = sceCesEucJpToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
+                Require(used == 2);
+                value = ucs2;
+                ++assigned;
+                std::uint8_t again[4] = {};
+                std::uint32_t size = 0;
+                Require(sceCesUcs2ToEucJp(ucs2, profile, again, sizeof(again), &size) == 0 && size == 2 && again[0] == lead && again[1] == trail);
+            } else {
+                Require(result == unassignedCode && used == 2 && ucs2 == 0);
+            }
+            hash = Digest(hash, value);
+        }
+    }
+    Require(assigned == jisX0208Cells && hash == eucJisX0208Digest);
+}
+
+static void SweepSJisJisX0208(const void* profile) {
+    std::uint32_t assigned = 0;
+    std::uint32_t hash = 0x811C9DC5u;
+    for (int row = 1; row <= 94; ++row) {
+        for (int column = 1; column <= 94; ++column) {
+            std::uint16_t code = 0;
+            Require(sceCesJisX0208ToSJisCode(static_cast<std::uint8_t>(row), static_cast<std::uint8_t>(column), &code) == 0);
+            const std::uint8_t cell[2] = {static_cast<std::uint8_t>(code >> 8), static_cast<std::uint8_t>(code)};
+            std::uint32_t used = 77;
+            std::uint16_t ucs2 = 0xEEEE;
+            std::uint16_t value = 0;
+            if (const int result = sceCesSJisToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
+                Require(used == 2);
+                value = ucs2;
+                ++assigned;
+                std::uint8_t again[4] = {};
+                std::uint32_t size = 0;
+                Require(sceCesUcs2ToSJis(ucs2, profile, again, sizeof(again), &size) == 0 && size == 2 && again[0] == cell[0] && again[1] == cell[1]);
+            } else {
+                Require(result == unassignedCode && used == 2 && ucs2 == 0);
+            }
+            hash = Digest(hash, value);
+        }
+    }
+    Require(assigned == jisX0208Cells && hash == sjisJisX0208Digest);
+}
+
+static void TestJisX0208Profiles(const void* cp932, const void* cp51932) {
+    alignas(8) std::uint8_t sheets[4][256] = {};
+    Require(sceCesUcsProfileInitEucJpX0208(nullptr) == nullptr && sceCesUcsProfileInitEucJpX0208Ss2(nullptr) == nullptr);
+    Require(sceCesUcsProfileInitEucJpX0208Ss2Ss3(nullptr) == nullptr && sceCesUcsProfileInitSJis1997X0208(nullptr) == nullptr);
+    const void* euc = sceCesUcsProfileInitEucJpX0208(sheets[0]);
+    const void* ss2 = sceCesUcsProfileInitEucJpX0208Ss2(sheets[1]);
+    const void* ss3 = sceCesUcsProfileInitEucJpX0208Ss2Ss3(sheets[2]);
+    const void* sjis = sceCesUcsProfileInitSJis1997X0208(sheets[3]);
+    Require(euc == sheets[0] && ss2 == sheets[1] && ss3 == sheets[2] && sjis == sheets[3]);
+    const void* strictEuc[3] = {euc, ss2, ss3};
+
+    std::uint16_t ucs2 = 0;
+    Require(EucToUcs2(sjis, "\xA4\xA2", 2, ucs2) == invalidParameter);
+    Require(SJisToUcs2(euc, "\x82\xA0", 2, ucs2) == invalidParameter);
+    Require(EncodeLeavesOutputs(invalidParameter, sjis, 0x3042, false) && EncodeLeavesOutputs(invalidParameter, ss3, 0x3042, true));
+
+    for (const void* profile : strictEuc) {
+        SweepEucJisX0208(profile);
+        Require(EucToUcs2(profile, "\\~", 2, ucs2) == 0 && ucs2 == 0x5C && EucEncodes(profile, 0x5C, "\\") && EucEncodes(profile, 0x7E, "~"));
+        Require(EucToUcs2(profile, "\xA1\xC1", 2, ucs2) == 0 && ucs2 == 0x301C && EucEncodes(profile, 0x301C, "\xA1\xC1"));
+        Require(EucToUcs2(profile, "\xA1\xC2", 2, ucs2) == 0 && ucs2 == 0x2016);
+        Require(EucToUcs2(profile, "\xA1\xDD", 2, ucs2) == 0 && ucs2 == 0x2212);
+        Require(EucToUcs2(profile, "\xA1\xF1", 2, ucs2) == 0 && ucs2 == 0x00A2);
+        Require(EucToUcs2(profile, "\xA1\xF2", 2, ucs2) == 0 && ucs2 == 0x00A3);
+        Require(EucToUcs2(profile, "\xA2\xCC", 2, ucs2) == 0 && ucs2 == 0x00AC);
+        for (const std::uint16_t cp932Form : {0xFF5E, 0x2225, 0xFF0D, 0xFFE0, 0xFFE1, 0xFFE2, 0x2460, 0x2170}) Require(EncodeLeavesOutputs(unassignedCode, profile, cp932Form, false));
+        Require(EucToUcs2(profile, "\xA1\xC0", 2, ucs2) == 0 && ucs2 == 0xFF3C && EucEncodes(profile, 0xFF3C, "\xA1\xC0"));
+        Require(EucToUcs2(profile, "\xA1\xBD", 2, ucs2) == 0 && ucs2 == 0x2014 && EucEncodes(profile, 0x2014, "\xA1\xBD") && EncodeLeavesOutputs(unassignedCode, profile, 0x2015, false));
+        Require(EucEncodes(profile, 0x00A5, "\xA1\xEF") && EucEncodes(profile, 0x203E, "\xA1\xB1"));
+        Require(EucToUcs2(profile, "\xA1\xEF", 2, ucs2) == 0 && ucs2 == 0xFFE5 && EucToUcs2(profile, "\xA1\xB1", 2, ucs2) == 0 && ucs2 == 0xFFE3);
+        Require(DecodeRejects(unassignedCode, 2, profile, "\xAD\xA1", 2, false) && DecodeRejects(unassignedCode, 2, profile, "\xF9\xA1", 2, false));
+        Require(DecodeRejects(unassignedCode, 2, profile, "\xA9\xA1", 2, false) && DecodeRejects(unassignedCode, 2, profile, "\xFE\xFE", 2, false));
+        Require(DecodeRejects(invalidEncode, 2, profile, "\xA4\x41", 2, false) && DecodeRejects(invalidEncode, 2, profile, "\xA4\xFF", 2, false));
+        Require(DecodeRejects(invalidEncode, 1, profile, "\x80", 1, false) && DecodeRejects(invalidEncode, 1, profile, "\xFF", 1, false));
+        Require(DecodeRejects(srcBufferEnd, 2, profile, "\xA4\xA2", 1, false));
+        std::uint8_t mbcs[4] = {0xEE, 0xEE, 0xEE, 0xEE};
+        std::uint32_t size = 77;
+        Require(sceCesUcs2ToEucJp(0x3042, profile, mbcs, 1, &size) == dstBufferEnd && size == 2 && mbcs[0] == 0xEE);
+    }
+    Require(EucToUcs2(cp51932, "\xA1\xC0", 2, ucs2) == 0 && ucs2 == 0xFF3C && EucEncodes(cp51932, 0xFF3C, "\xA1\xC0"));
+    Require(EucToUcs2(cp51932, "\xA1\xC1", 2, ucs2) == 0 && ucs2 == 0xFF5E && EucToUcs2(cp51932, "\xAD\xA1", 2, ucs2) == 0 && ucs2 == 0x2460);
+    Require(EucEncodes(cp51932, 0x7E8A, "\xF9\xA1") && EucEncodes(ss3, 0x7E8A, "\x8F\xD4\xE3"));
+    Require(EncodeLeavesOutputs(unassignedCode, euc, 0x7E8A, false) && EncodeLeavesOutputs(unassignedCode, ss2, 0x7E8A, false));
+
+    Require(DecodeRejects(invalidEncode, 1, euc, "\x8E\xB1", 2, false) && DecodeRejects(invalidEncode, 1, euc, "\x8E", 1, false));
+    Require(DecodeRejects(invalidEncode, 1, euc, "\x8F\xB0\xA1", 3, false) && DecodeRejects(invalidEncode, 1, ss2, "\x8F\xB0\xA1", 3, false));
+    Require(EncodeLeavesOutputs(unassignedCode, euc, 0xFF71, false));
+    Require(EncodeLeavesOutputs(unassignedCode, euc, 0x4E02, false) && EncodeLeavesOutputs(unassignedCode, ss2, 0x4E02, false));
+    for (const void* profile : {ss2, ss3}) {
+        for (std::uint32_t kana = 0xA1; kana <= 0xDF; ++kana) {
+            const char bytes[3] = {'\x8E', static_cast<char>(kana), 0};
+            Require(EucToUcs2(profile, bytes, 2, ucs2) == 0 && ucs2 == 0xFF61 + kana - 0xA1 && EucEncodes(profile, ucs2, bytes));
+        }
+        Require(DecodeRejects(invalidEncode, 2, profile, "\x8E\xE0", 2, false) && DecodeRejects(invalidEncode, 2, profile, "\x8E\xA0", 2, false));
+        Require(DecodeRejects(srcBufferEnd, 2, profile, "\x8E\xB1", 1, false));
+    }
+    std::uint32_t supplementary = 0;
+    std::uint32_t hash = 0x811C9DC5u;
+    for (std::uint32_t lead = 0xA1; lead <= 0xFE; ++lead) {
+        for (std::uint32_t trail = 0xA1; trail <= 0xFE; ++trail) {
+            const char bytes[4] = {'\x8F', static_cast<char>(lead), static_cast<char>(trail), 0};
+            std::uint16_t value = 0;
+            if (const int result = EucToUcs2(ss3, bytes, 3, ucs2); result == 0) {
+                value = ucs2;
+                ++supplementary;
+                Require(EucEncodes(ss3, ucs2, ucs2 == 0x7E ? "~" : bytes));
+            } else {
+                Require(result == unassignedCode);
+            }
+            hash = Digest(hash, value);
+        }
+    }
+    Require(supplementary == jisX0212Cells && hash == jisX0212Digest);
+    Require(DecodeRejects(srcBufferEnd, 3, ss3, "\x8F\xB0", 2, false) && DecodeRejects(invalidEncode, 3, ss3, "\x8F\xB0\x41", 3, false));
+    Require(EucEncodes(ss3, 0x4E02, "\x8F\xB0\xA1") && EucEncodes(ss2, 0xFF71, "\x8E\xB1"));
+
+    std::uint8_t utf8[4] = {};
+    std::uint32_t used = 0;
+    std::uint32_t produced = 0;
+    Require(sceCesEucJpToUtf8(euc, Bytes("\xA1\xC1"), 2, &used, utf8, sizeof(utf8), &produced) == 0 && used == 2 && produced == 3 && std::memcmp(utf8, "\xE3\x80\x9C", 3) == 0);
+    alignas(8) std::uint8_t context[256] = {};
+    std::uint16_t wide[8] = {};
+    Require(sceCesMbcsUcsContextInit(context, ss2) == 0);
+    Require(sceCesMbcsStrToUcs2Str(context, Bytes("A\xA4\xA2\x8E\xB1"), 5, &used, wide, 8, &produced) == 0 && used == 5 && produced == 3 && wide[1] == 0x3042 && wide[2] == 0xFF71);
+    Require(sceCesMbcsUcsContextInit(context, euc) == 0);
+    Require(sceCesMbcsStrToUcs2Str(context, Bytes("A\xA4\xA2\x8E\xB1"), 5, &used, wide, 8, &produced) == invalidEncode);
+
+    SweepSJisJisX0208(sjis);
+    Require(SJisToUcs2(sjis, "\x81\x60", 2, ucs2) == 0 && ucs2 == 0x301C && SJisEncodes(sjis, 0x301C, "\x81\x60"));
+    Require(SJisToUcs2(sjis, "\x81\x91", 2, ucs2) == 0 && ucs2 == 0x00A2 && SJisEncodes(sjis, 0x00AC, "\x81\xCA"));
+    for (const std::uint16_t cp932Form : {0xFF5E, 0x2225, 0xFF0D, 0xFFE0, 0xFFE1, 0xFFE2, 0x2460, 0x2170, 0x7E8A, 0x4E02}) Require(EncodeLeavesOutputs(unassignedCode, sjis, cp932Form, true));
+    for (const char* removed : {"\x87\x40", "\xED\x40", "\xEE\xFC", "\xFA\x40", "\xFC\x4B", "\xF0\x40", "\xEF\xFC"}) Require(DecodeRejects(unassignedCode, 2, sjis, removed, 2, true));
+    Require(SJisToUcs2(cp932, "\x87\x40", 2, ucs2) == 0 && ucs2 == 0x2460 && SJisToUcs2(cp932, "\xFA\x40", 2, ucs2) == 0 && ucs2 == 0x2170);
+    Require(SJisToUcs2(cp932, "\x81\x5F", 2, ucs2) == 0 && ucs2 == 0xFF3C && SJisToUcs2(cp932, "\\", 1, ucs2) == 0 && ucs2 == 0x5C);
+    Require(DecodeRejects(invalidEncode, 2, sjis, "\x82\x7F", 2, true) && DecodeRejects(invalidEncode, 2, sjis, "\x82\xFD", 2, true));
+    Require(DecodeRejects(srcBufferEnd, 2, sjis, "\x82\xA0", 1, true));
+    for (std::uint32_t byte = 0; byte <= 0xFF; ++byte) {
+        const char bytes[2] = {static_cast<char>(byte), 0};
+        if (byte == 0x5C || byte == 0x7E) {
+            const std::uint16_t roman = byte == 0x5C ? 0x00A5 : 0x203E;
+            Require(SJisToUcs2(sjis, bytes, 1, ucs2) == 0 && ucs2 == roman && SJisEncodes(sjis, roman, bytes));
+        } else if (byte < 0x80) {
+            Require(SJisToUcs2(sjis, bytes, 1, ucs2) == 0 && ucs2 == byte && (byte == 0 || SJisEncodes(sjis, ucs2, bytes)));
+        } else if (byte >= 0xA1 && byte <= 0xDF) {
+            Require(SJisToUcs2(sjis, bytes, 1, ucs2) == 0 && ucs2 == 0xFF61 + byte - 0xA1 && SJisEncodes(sjis, ucs2, bytes));
+        } else {
+            Require(DecodeRejects(byte == 0x80 || byte == 0xA0 || byte >= 0xFD ? invalidEncode : srcBufferEnd, byte == 0x80 || byte == 0xA0 || byte >= 0xFD ? 1u : 2u, sjis, bytes, 1, true));
+        }
+    }
+    Require(SJisToUcs2(sjis, "\x81\x5F", 2, ucs2) == 0 && ucs2 == 0x005C && SJisEncodes(sjis, 0x005C, "\x81\x5F"));
+    Require(SJisToUcs2(sjis, "\x81\x5C", 2, ucs2) == 0 && ucs2 == 0x2014 && SJisEncodes(sjis, 0x2014, "\x81\x5C"));
+    for (const std::uint16_t unmapped : {0x007E, 0xFF3C, 0x2015}) Require(EncodeLeavesOutputs(unassignedCode, sjis, unmapped, true));
+    Require(sceCesMbcsUcsContextInit(context, sjis) == 0);
+    const std::uint16_t text[] = {0x3042, 0x301C, 0xFF71, 0};
+    std::uint8_t mbcs[8] = {};
+    Require(sceCesUcs2StrToMbcsStr(context, text, 4, &used, mbcs, sizeof(mbcs), &produced) == 0 && used == 3 && produced == 5 && std::memcmp(mbcs, "\x82\xA0\x81\x60\xB1", 5) == 0);
+    Require(sceCesMbcsStrToUcs2Str(context, Bytes("A\\"), 2, &used, wide, 8, &produced) == 0 && used == 2 && produced == 2 && wide[1] == 0x00A5);
+}
+
 int main() {
-    constexpr int invalidParameter = static_cast<int>(0x805C0001);
     constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
-    constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
-    constexpr int invalidEncode = static_cast<int>(0x805C0014);
-    constexpr int unassignedCode = static_cast<int>(0x805C0020);
     constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
-    constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
 
     alignas(8) std::uint8_t sjisSheet[64] = {};
     alignas(8) std::uint8_t eucSheet[64] = {};
@@ -90,7 +286,7 @@ int main() {
     Require(sceCesEucJpToUtf16(euc, Bytes("\xA4\xA2"), 2, &consumed, &utf16, 1, &produced) == 0 && consumed == 2 && utf16 == 0x3042);
     Require(sceCesEucJpToUtf16be(euc, Bytes("\x8E\xB1"), 2, &consumed, &utf16, 1, &produced) == 0);
     Require(std::memcmp(&utf16, "\xFF\x71", 2) == 0);
-    Require(sceCesEucJpToUtf32(euc, Bytes("\x8F\xB0\xA1"), 3, &consumed, &utf32) == 0 && consumed == 3 && utf32 == 0x4E02);
+    Require(sceCesEucJpToUtf32(euc, Bytes("\x8F\xB0\xA1"), 3, &consumed, &utf32) == invalidEncode);
     Require(sceCesEucJpToUtf32le(euc, Bytes("\xA4\xA2"), 2, &consumed, &utf32) == 0);
     Require(std::memcmp(&utf32, "\x42\x30\x00\x00", 4) == 0);
     Require(sceCesEucJpToUtf32(sjis, Bytes("\xA4\xA2"), 2, &consumed, &utf32) == invalidParameter);
@@ -99,12 +295,12 @@ int main() {
     Require(sceCesUcs2ToSJis(0x3042, sjis, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\x82\xA0", 2) == 0);
     Require(sceCesUcs2ToSJis(0xFF71, sjis, mbcs, sizeof(mbcs), &produced) == 0 && produced == 1 && mbcs[0] == 0xB1);
     Require(sceCesUcs2ToSJis(0x3042, sjis, mbcs, 1, &produced) == dstBufferEnd);
-    Require(sceCesUcs2ToSJis(0xD800, sjis, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    Require(sceCesUcs2ToSJis(0xD800, sjis, mbcs, sizeof(mbcs), &produced) == outOfCodeSpace);
     Require(sceCesUcs2ToSJis(0x4E02, sjis, mbcs, sizeof(mbcs), &produced) == unassignedCode);
     Require(sceCesUcs2ToSJis(0x3042, euc, mbcs, sizeof(mbcs), &produced) == invalidParameter);
     Require(sceCesUcs2ToSJis(0x3042, sceCesRefersUcsProfileCp1252(), mbcs, sizeof(mbcs), &produced) == invalidParameter);
     Require(sceCesUcs2ToSJis(0x3042, sjis, nullptr, sizeof(mbcs), &produced) == invalidDstBuffer);
-    Require(sceCesUcs2ToEucJp(0x4E02, euc, mbcs, sizeof(mbcs), &produced) == 0 && produced == 3 && std::memcmp(mbcs, "\x8F\xB0\xA1", 3) == 0);
+    Require(sceCesUcs2ToEucJp(0x4E02, euc, mbcs, sizeof(mbcs), &produced) == unassignedCode);
     Require(sceCesUcs2ToEucJp(0xFF71, euc, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\x8E\xB1", 2) == 0);
 
     Require(sceCesUtf8ToSJis(Bytes("\xE6\x97\xA5"), 3, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == 0);
@@ -136,8 +332,10 @@ int main() {
     std::memcpy(&utf32Le, "\xE5\x65\x00\x00", 4);
     Require(sceCesUtf32leToEucJp(&utf32Le, euc, mbcs, sizeof(mbcs), &produced) == 0 && std::memcmp(mbcs, "\xC6\xFC", 2) == 0);
 
+    constexpr int microsoftForms[] = {0x00A2, 0x00A3, 0x00A5, 0x00AC, 0x2014, 0x2016, 0x203E, 0x2212, 0x301C, 0xFEFF};
     for (int code = 1; code < 0x10000; ++code) {
         if (code >= 0xD800 && code <= 0xDFFF) continue;
+        if (std::find(std::begin(microsoftForms), std::end(microsoftForms), code) != std::end(microsoftForms)) continue;
         std::uint8_t encoded[4] = {};
         std::uint32_t size = 0;
         if (sceCesUcs2ToSJis(static_cast<std::uint16_t>(code), sjis, encoded, sizeof(encoded), &size) == 0) {
@@ -166,5 +364,6 @@ int main() {
             Require(sceCesSJisCodeToJisX0208(sjisCode, &ku, &ten) == 0 && ku == row && ten == cell);
         }
     }
+    TestJisX0208Profiles(sjis, euc);
     return 0;
 }
diff --git a/core/libs/tests/GuestCesMbc.cpp b/core/libs/tests/GuestCesMbc.cpp
index d586891262..9d1e17c780 100644
--- a/core/libs/tests/GuestCesMbc.cpp
+++ b/core/libs/tests/GuestCesMbc.cpp
@@ -1,34 +1,232 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <bit>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-void* APS5_VABI sceCesUcsProfileInitGbkCp936(void*);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1252(void);
-int APS5_VABI sceCesMbcsUcsContextInit(void*, const void*);
-int APS5_VABI sceCesMbcsUcsContextInitCopy(void*, const void*);
-int APS5_VABI sceCesMbcsStrToUtf8Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcToUcs2(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
-int APS5_VABI sceCesMbcToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcToUtf16(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcToUtf16be(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcToUtf16le(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcToUtf32(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcToUtf32be(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcToUtf32le(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesSJisGetCode(const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
-int APS5_VABI sceCesSJisPutCode(std::uint16_t, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSJisCodeToJisX0213(std::uint16_t, std::uint8_t*, std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesJisX0213ToSJisCode(std::uint8_t, std::uint8_t, std::uint8_t, std::uint16_t*);
-}
+constexpr int invalidParameter = static_cast<int>(0x805C0001);
+constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
+constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+constexpr int invalidEncode = static_cast<int>(0x805C0014);
+constexpr int outOfCodeSpace = static_cast<int>(0x805C0015);
+constexpr int unassignedCode = static_cast<int>(0x805C0020);
+constexpr int unsupported = static_cast<int>(0x805C0024);
+constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
+constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+constexpr std::uint32_t untouched = 0xEEEEEEEE;
+
+enum Form { Ucs2, Utf8, Utf16, Utf16be, Utf16le, Utf32, Utf32be, Utf32le, FormCount };
+
+struct Sequence {
+    std::uint32_t count;
+    std::uint32_t units[4];
+    int expected;
+};
 
 static void Require(bool value) { if (!value) std::abort(); }
 
 static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
 
+static bool IsBuffer(int form) { return form == Utf8 || form == Utf16 || form == Utf16be || form == Utf16le; }
+
+static std::uint32_t Units(int form, std::uint32_t code, std::uint32_t* units) {
+    constexpr std::uint32_t leads[5] = {0, 0, 0xC0, 0xE0, 0xF0};
+    if (form == Utf8 && code >= 0x80) {
+        const std::uint32_t count = code < 0x800 ? 2 : code < 0x10000 ? 3 : 4;
+        for (std::uint32_t i = count - 1; i > 0; --i, code >>= 6) units[i] = 0x80 | (code & 0x3F);
+        units[0] = leads[count] | code;
+        return count;
+    }
+    if (IsBuffer(form) && code >= 0x10000) {
+        units[0] = 0xD800 + ((code - 0x10000) >> 10);
+        units[1] = 0xDC00 + ((code - 0x10000) & 0x3FF);
+        return 2;
+    }
+    units[0] = code;
+    return 1;
+}
+
+static int Call(int form, const std::uint32_t* units, std::uint32_t count, const void* profile, std::uint8_t* mbc, std::uint32_t mbcMax, std::uint32_t* mbcLen, std::uint32_t* sourceLen) {
+    const bool bigEndian = form == Utf16be || form == Utf32be || ((form == Utf16 || form == Utf32) && std::endian::native == std::endian::big);
+    const std::uint32_t width = form == Utf8 ? 1 : form >= Utf32 ? 4 : 2;
+    alignas(4) std::uint8_t bytes[16] = {};
+    for (std::uint32_t i = 0; units && i < count; ++i) {
+        for (std::uint32_t b = 0; b < width; ++b) bytes[i * width + b] = static_cast<std::uint8_t>(units[i] >> (8 * (bigEndian ? width - 1 - b : b)));
+    }
+    const std::uint8_t* utf8 = units ? bytes : nullptr;
+    const auto* utf16 = reinterpret_cast<const std::uint16_t*>(utf8);
+    const auto* utf32 = reinterpret_cast<const std::uint32_t*>(utf8);
+    const std::uint32_t value = units ? units[0] : 0;
+    switch (form) {
+    case Ucs2: return sceCesUcs2ToMbc(static_cast<std::uint16_t>(value), profile, mbc, mbcMax, mbcLen);
+    case Utf8: return sceCesUtf8ToMbc(utf8, count, sourceLen, profile, mbc, mbcMax, mbcLen);
+    case Utf16: return sceCesUtf16ToMbc(utf16, count, sourceLen, profile, mbc, mbcMax, mbcLen);
+    case Utf16be: return sceCesUtf16beToMbc(utf16, count, sourceLen, profile, mbc, mbcMax, mbcLen);
+    case Utf16le: return sceCesUtf16leToMbc(utf16, count, sourceLen, profile, mbc, mbcMax, mbcLen);
+    case Utf32: return sceCesUtf32ToMbc(value, profile, mbc, mbcMax, mbcLen);
+    case Utf32be: return sceCesUtf32beToMbc(utf32, profile, mbc, mbcMax, mbcLen);
+    default: return sceCesUtf32leToMbc(utf32, profile, mbc, mbcMax, mbcLen);
+    }
+}
+
+static void RequireFailure(int form, const std::uint32_t* units, std::uint32_t count, const void* profile, bool target, std::uint32_t mbcMax, int expected) {
+    std::uint8_t mbc[4] = {0xEE, 0xEE, 0xEE, 0xEE};
+    std::uint32_t mbcLen = untouched;
+    std::uint32_t sourceLen = untouched;
+    Require(Call(form, units, count, profile, target ? mbc : nullptr, mbcMax, &mbcLen, &sourceLen) == expected);
+    const bool refused = !IsBuffer(form) && expected != invalidParameter && expected != invalidSrcBuffer && expected != invalidDstBuffer;
+    Require(mbc[0] == 0xEE && mbc[1] == 0xEE && mbc[2] == 0xEE && mbc[3] == 0xEE && mbcLen == (refused ? 0 : untouched) && sourceLen == untouched);
+}
+
+static void RequireAll(std::uint32_t code, const void* profile, int expected, const std::uint8_t* bytes, std::uint32_t size) {
+    for (int form = code > 0xFFFF ? Utf8 : Ucs2; form < FormCount; ++form) {
+        std::uint32_t units[4] = {};
+        const std::uint32_t count = Units(form, code, units);
+        if (expected != 0) {
+            RequireFailure(form, units, count, profile, true, 4, expected);
+            continue;
+        }
+        std::uint8_t mbc[4] = {0xEE, 0xEE, 0xEE, 0xEE};
+        std::uint32_t mbcLen = untouched;
+        std::uint32_t sourceLen = untouched;
+        Require(Call(form, units, count, profile, mbc, sizeof(mbc), &mbcLen, &sourceLen) == 0);
+        Require(mbcLen == size && std::memcmp(mbc, bytes, size) == 0 && sourceLen == (IsBuffer(form) ? count : untouched));
+    }
+}
+
+static std::uint32_t SweepCodes(const void* profile) {
+    constexpr std::uint32_t supplementary[] = {0x10000, 0x1F600, 0x10FFFF};
+    std::uint32_t mapped = 0;
+    for (std::uint32_t code = 0; code < 0x10000; ++code) {
+        if (code >= 0xD800 && code <= 0xDFFF) continue;
+        std::uint8_t bytes[4] = {};
+        std::uint32_t size = 0;
+        const int result = sceCesUtf32ToMbc(code, profile, bytes, sizeof(bytes), &size);
+        Require(result == 0 || result == unassignedCode || result == unsupported);
+        if (result == 0 && size > 0) {
+            std::uint32_t consumed = 0;
+            std::uint32_t back = 0;
+            Require(sceCesMbcToUtf32(profile, bytes, size, &consumed, &back) == 0 && consumed == size);
+            if (back == code) ++mapped;
+        }
+        RequireAll(code, profile, result, bytes, size);
+    }
+    for (const std::uint32_t code : supplementary) RequireAll(code, profile, unassignedCode, nullptr, 0);
+    return mapped;
+}
+
+static std::uint32_t RoundTrip(const void* profile, const std::uint8_t* source, std::uint32_t size) {
+    std::uint32_t consumed = 0;
+    std::uint32_t produced = 0;
+    std::uint32_t code = 0;
+    std::uint16_t ucs2 = 0;
+    std::uint8_t utf8[4] = {};
+    std::uint32_t utf8Size = 0;
+    std::uint16_t utf16[3] = {};
+    std::uint32_t utf32[2] = {};
+    Require(sceCesMbcToUtf32(profile, source, size, &consumed, &code) == 0 && consumed == size);
+    Require(sceCesMbcToUcs2(profile, source, size, &consumed, &ucs2) == 0 && consumed == size);
+    Require(sceCesMbcToUtf8(profile, source, size, &consumed, utf8, sizeof(utf8), &utf8Size) == 0 && consumed == size);
+    Require(sceCesMbcToUtf16(profile, source, size, &consumed, &utf16[0], 1, &produced) == 0 && consumed == size);
+    Require(sceCesMbcToUtf16be(profile, source, size, &consumed, &utf16[1], 1, &produced) == 0 && consumed == size);
+    Require(sceCesMbcToUtf16le(profile, source, size, &consumed, &utf16[2], 1, &produced) == 0 && consumed == size);
+    Require(sceCesMbcToUtf32be(profile, source, size, &consumed, &utf32[0]) == 0 && consumed == size);
+    Require(sceCesMbcToUtf32le(profile, source, size, &consumed, &utf32[1]) == 0 && consumed == size);
+    std::uint8_t mbc[8][4] = {};
+    std::uint32_t mbcLen[8] = {};
+    std::uint32_t sourceLen[4] = {};
+    Require(sceCesUtf32ToMbc(code, profile, mbc[0], 4, &mbcLen[0]) == 0);
+    Require(sceCesUcs2ToMbc(ucs2, profile, mbc[1], 4, &mbcLen[1]) == 0);
+    Require(sceCesUtf8ToMbc(utf8, utf8Size, &sourceLen[0], profile, mbc[2], 4, &mbcLen[2]) == 0 && sourceLen[0] == utf8Size);
+    Require(sceCesUtf16ToMbc(&utf16[0], 1, &sourceLen[1], profile, mbc[3], 4, &mbcLen[3]) == 0 && sourceLen[1] == 1);
+    Require(sceCesUtf16beToMbc(&utf16[1], 1, &sourceLen[2], profile, mbc[4], 4, &mbcLen[4]) == 0 && sourceLen[2] == 1);
+    Require(sceCesUtf16leToMbc(&utf16[2], 1, &sourceLen[3], profile, mbc[5], 4, &mbcLen[5]) == 0 && sourceLen[3] == 1);
+    Require(sceCesUtf32beToMbc(&utf32[0], profile, mbc[6], 4, &mbcLen[6]) == 0);
+    Require(sceCesUtf32leToMbc(&utf32[1], profile, mbc[7], 4, &mbcLen[7]) == 0);
+    for (std::uint32_t i = 1; i < 8; ++i) Require(mbcLen[i] == mbcLen[0] && std::memcmp(mbc[i], mbc[0], mbcLen[0]) == 0);
+    return mbcLen[0] == size && std::memcmp(mbc[0], source, size) == 0 ? 1 : 0;
+}
+
+static std::uint32_t SweepBytes(const void* profile) {
+    std::uint32_t identical = 0;
+    std::uint8_t source[3] = {};
+    std::uint32_t consumed = 0;
+    std::uint32_t code = 0;
+    for (std::uint32_t lead = 0; lead < 256; ++lead) {
+        source[0] = static_cast<std::uint8_t>(lead);
+        const int single = sceCesMbcToUtf32(profile, source, 1, &consumed, &code);
+        if (single == 0) identical += RoundTrip(profile, source, 1);
+        if (single != srcBufferEnd) continue;
+        for (std::uint32_t trail = 0; trail < 256; ++trail) {
+            source[1] = static_cast<std::uint8_t>(trail);
+            const int pair = sceCesMbcToUtf32(profile, source, 2, &consumed, &code);
+            if (pair == 0) identical += RoundTrip(profile, source, 2);
+            for (std::uint32_t third = 0; pair == srcBufferEnd && third < 256; ++third) {
+                source[2] = static_cast<std::uint8_t>(third);
+                if (sceCesMbcToUtf32(profile, source, 3, &consumed, &code) == 0) identical += RoundTrip(profile, source, 3);
+            }
+        }
+    }
+    return identical;
+}
+
+static void RequireInvalid(const void* profile) {
+    constexpr int scalarForms[] = {Ucs2, Utf32, Utf32be, Utf32le};
+    const Sequence utf8[] = {
+        {2, {0xC0, 0x80}, outOfCodeSpace}, {2, {0xC1, 0xBF}, outOfCodeSpace}, {3, {0xE0, 0x80, 0x80}, outOfCodeSpace},
+        {3, {0xE0, 0x9F, 0xBF}, outOfCodeSpace}, {4, {0xF0, 0x80, 0x80, 0x80}, outOfCodeSpace}, {4, {0xF0, 0x8F, 0xBF, 0xBF}, outOfCodeSpace},
+        {3, {0xED, 0xA0, 0x80}, outOfCodeSpace}, {3, {0xED, 0xBF, 0xBF}, outOfCodeSpace}, {4, {0xF4, 0x90, 0x80, 0x80}, unassignedCode},
+        {4, {0xF7, 0xBF, 0xBF, 0xBF}, unassignedCode}, {1, {0x80}, invalidEncode}, {1, {0xFF}, invalidEncode},
+        {3, {0xE3, 0x41, 0x42}, invalidEncode}, {2, {0xE3, 0x81}, srcBufferEnd}, {3, {0xF0, 0x9F, 0x98}, srcBufferEnd},
+    };
+    const Sequence utf16[] = {
+        {1, {0xDC00}, invalidEncode}, {1, {0xDFFF}, invalidEncode}, {2, {0xD800, 0x0041}, invalidEncode},
+        {2, {0xDBFF, 0xDBFF}, invalidEncode}, {2, {0xDC00, 0xD800}, invalidEncode}, {1, {0xD800}, srcBufferEnd},
+    };
+    const Sequence utf32[] = {{1, {0xD800}, outOfCodeSpace}, {1, {0xDFFF}, outOfCodeSpace}, {1, {0x110000}, invalidEncode}, {1, {0xFFFFFFFF}, invalidEncode}};
+    for (const Sequence& sequence : utf8) RequireFailure(Utf8, sequence.units, sequence.count, profile, true, 4, sequence.expected);
+    for (const Sequence& sequence : utf16) {
+        for (int form = Utf16; form <= Utf16le; ++form) RequireFailure(form, sequence.units, sequence.count, profile, true, 4, sequence.expected);
+    }
+    for (const Sequence& sequence : utf32) {
+        for (const int form : scalarForms) {
+            if (form != Ucs2 || sequence.units[0] <= 0xFFFF) RequireFailure(form, sequence.units, sequence.count, profile, true, 4, sequence.expected);
+        }
+    }
+}
+
+struct Rejected {
+    const void* profile;
+    const char* bytes;
+    std::uint32_t size;
+    int expected;
+    std::uint32_t length;
+};
+
+static void RequireRejected(const Rejected& sequence) {
+    for (int form = 0; form < 8; ++form) {
+        std::uint32_t consumed = 0xEEEEEEEE;
+        std::uint32_t produced = 0;
+        std::uint16_t units[2] = {};
+        std::uint8_t utf8[4] = {};
+        std::uint32_t utf32 = 0;
+        const auto* bytes = Bytes(sequence.bytes);
+        int result = 0;
+        switch (form) {
+        case 0: result = sceCesMbcToUcs2(sequence.profile, bytes, sequence.size, &consumed, units); break;
+        case 1: result = sceCesMbcToUtf8(sequence.profile, bytes, sequence.size, &consumed, utf8, sizeof(utf8), &produced); break;
+        case 2: result = sceCesMbcToUtf16(sequence.profile, bytes, sequence.size, &consumed, units, 2, &produced); break;
+        case 3: result = sceCesMbcToUtf16be(sequence.profile, bytes, sequence.size, &consumed, units, 2, &produced); break;
+        case 4: result = sceCesMbcToUtf16le(sequence.profile, bytes, sequence.size, &consumed, units, 2, &produced); break;
+        case 5: result = sceCesMbcToUtf32(sequence.profile, bytes, sequence.size, &consumed, &utf32); break;
+        case 6: result = sceCesMbcToUtf32be(sequence.profile, bytes, sequence.size, &consumed, &utf32); break;
+        default: result = sceCesMbcToUtf32le(sequence.profile, bytes, sequence.size, &consumed, &utf32); break;
+        }
+        Require(result == sequence.expected && consumed == sequence.length);
+    }
+}
+
 static void RequireX0213(std::uint16_t sjis, std::uint8_t men, std::uint8_t ku, std::uint8_t ten) {
     std::uint8_t m = 0;
     std::uint8_t k = 0;
@@ -39,14 +237,6 @@ static void RequireX0213(std::uint16_t sjis, std::uint8_t men, std::uint8_t ku,
 }
 
 int main() {
-    constexpr int invalidParameter = static_cast<int>(0x805C0001);
-    constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
-    constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
-    constexpr int invalidEncode = static_cast<int>(0x805C0014);
-    constexpr int unassignedCode = static_cast<int>(0x805C0020);
-    constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
-    constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
-
     alignas(8) std::uint8_t sjisSheet[64] = {};
     alignas(8) std::uint8_t eucSheet[64] = {};
     alignas(8) std::uint8_t gbkSheet[64] = {};
@@ -69,9 +259,25 @@ int main() {
     Require(sceCesMbcToUcs2(sjis, nullptr, 1, &consumed, &ucs2) == invalidSrcBuffer);
     Require(sceCesMbcToUcs2(sjis, Bytes("A"), 0, &consumed, &ucs2) == srcBufferEnd);
     Require(sceCesMbcToUcs2(sjis, Bytes("A"), 1, &consumed, nullptr) == invalidDstBuffer);
-    Require(sceCesMbcToUcs2(sjis, Bytes("\x82"), 1, &consumed, &ucs2) == srcBufferEnd);
-    Require(sceCesMbcToUcs2(sjis, Bytes("\x80"), 1, &consumed, &ucs2) == invalidEncode);
-    Require(sceCesMbcToUcs2(sjis, Bytes("\xF0\x40"), 2, &consumed, &ucs2) == unassignedCode);
+
+    alignas(8) std::uint8_t gb18030Sheet[64] = {};
+    alignas(8) std::uint8_t uhcSheet[64] = {};
+    alignas(8) std::uint8_t big5Sheet[64] = {};
+    const void* gb18030 = sceCesUcsProfileInitGb18030_2000(gb18030Sheet);
+    const void* uhc = sceCesUcsProfileInitUhc(uhcSheet);
+    const void* big5 = sceCesUcsProfileInitBig5Cp950(big5Sheet);
+    const Rejected rejected[] = {
+        {sjis, "\x82", 1, srcBufferEnd, 2}, {sjis, "\x80", 1, invalidEncode, 1}, {sjis, "\xA0", 1, invalidEncode, 1},
+        {sjis, "\x82\x00", 2, invalidEncode, 1}, {sjis, "\x82\x7F", 2, invalidEncode, 2}, {sjis, "\xF0\x40", 2, unassignedCode, 2},
+        {euc, "\xA4", 1, srcBufferEnd, 2}, {euc, "\x8F\xA1", 2, srcBufferEnd, 3}, {euc, "\xFF", 1, invalidEncode, 1},
+        {euc, "\xA4\x00", 2, invalidEncode, 1}, {euc, "\xA4\x41", 2, invalidEncode, 2}, {euc, "\x8F\x00", 2, invalidEncode, 1},
+        {gbk, "\x81", 1, srcBufferEnd, 2}, {gbk, "\xFF", 1, invalidEncode, 1}, {gbk, "\x81\x00", 2, invalidEncode, 1}, {gbk, "\x81\x7F", 2, invalidEncode, 2},
+        {gb18030, "\x81\x30", 2, srcBufferEnd, 4}, {gb18030, "\x81\x30\x81", 3, srcBufferEnd, 4}, {gb18030, "\x81\x00", 2, invalidEncode, 1},
+        {gb18030, "\x81\x30\x00", 3, invalidEncode, 2}, {gb18030, "\x81\x30\x20\x00", 4, invalidEncode, 3}, {gb18030, "\x81\x30\x20\x30", 4, invalidEncode, 4},
+        {uhc, "\xC9", 1, srcBufferEnd, 2}, {uhc, "\xC9\xFF", 2, invalidEncode, 2}, {uhc, "\xC9\x41", 2, unassignedCode, 2},
+        {big5, "\xA1\x00", 2, invalidEncode, 1}, {big5, "\xA1\x7F", 2, invalidEncode, 2}, {big5, "\x81\x40", 2, unassignedCode, 2},
+    };
+    for (const Rejected& sequence : rejected) RequireRejected(sequence);
 
     std::uint8_t utf8[4] = {};
     Require(sceCesMbcToUtf8(gbk, Bytes("\xD6\xD0"), 2, &consumed, utf8, sizeof(utf8), &produced) == 0 && consumed == 2 && produced == 3);
@@ -153,4 +359,76 @@ int main() {
     Require(std::memcmp(utf8, "\xE4\xB8\xAD", 3) == 0);
     Require(sceCesMbcsUcsContextInitCopy(nullptr, context) == invalidParameter);
     Require(sceCesMbcsUcsContextInitCopy(copy, nullptr) == invalidParameter);
+
+    alignas(8) std::uint8_t eucCnSheet[64] = {};
+    alignas(8) std::uint8_t eucKrSheet[64] = {};
+    const void* eucCn = sceCesUcsProfileInitEucCnGb2312(eucCnSheet);
+    const void* eucKr = sceCesUcsProfileInitEucKr(eucKrSheet);
+    const void* cp1251 = sceCesRefersUcsProfileCp1251();
+    const void* cp1250 = sceCesRefersUcsProfileCp1250();
+
+    RequireAll(0x20AC, cp1252, 0, Bytes("\x80"), 1);
+    RequireAll(0x00E9, cp1252, 0, Bytes("\xE9"), 1);
+    RequireAll(0x0100, cp1252, unassignedCode, nullptr, 0);
+    RequireAll(0x0416, cp1251, 0, Bytes("\xC6"), 1);
+    RequireAll(0x0141, cp1250, 0, Bytes("\xA3"), 1);
+    RequireAll(0x3042, sjis, 0, Bytes("\x82\xA0"), 2);
+    RequireAll(0xFF71, sjis, 0, Bytes("\xB1"), 1);
+    RequireAll(0x4E02, sjis, unassignedCode, nullptr, 0);
+    RequireAll(0x3042, euc, 0, Bytes("\xA4\xA2"), 2);
+    RequireAll(0xFF71, euc, 0, Bytes("\x8E\xB1"), 2);
+    RequireAll(0x4E02, euc, unassignedCode, nullptr, 0);
+    RequireAll(0x4E2D, gbk, 0, Bytes("\xD6\xD0"), 2);
+    RequireAll(0x4E02, gbk, 0, Bytes("\x81\x40"), 2);
+    RequireAll(0x20AC, gbk, 0, Bytes("\x80"), 1);
+    RequireAll(0x4E2D, eucCn, 0, Bytes("\xD6\xD0"), 2);
+    RequireAll(0x4E02, eucCn, unassignedCode, nullptr, 0);
+    RequireAll(0xAC00, eucKr, 0, Bytes("\xB0\xA1"), 2);
+    RequireAll(0xAC02, eucKr, unassignedCode, nullptr, 0);
+    RequireAll(0xAC02, uhc, 0, Bytes("\x81\x41"), 2);
+    RequireAll(0x4E00, big5, 0, Bytes("\xA4\x40"), 2);
+
+    std::uint32_t units[4] = {};
+    for (int form = Ucs2; form < FormCount; ++form) {
+        std::uint32_t count = Units(form, 0xDC00, units);
+        RequireFailure(form, nullptr, 0, nullptr, false, 0, invalidParameter);
+        RequireFailure(form, units, count, blankSheet, true, 4, invalidParameter);
+        if (form != Ucs2 && form != Utf32) RequireFailure(form, nullptr, 0, sjis, false, 0, invalidSrcBuffer);
+        if (IsBuffer(form)) RequireFailure(form, units, 0, sjis, false, 0, srcBufferEnd);
+        RequireFailure(form, units, count, sjis, false, 0, invalidDstBuffer);
+        RequireFailure(form, units, count, sjis, true, 0, IsBuffer(form) && form != Utf8 ? invalidEncode : outOfCodeSpace);
+        count = Units(form, 0x4E02, units);
+        RequireFailure(form, units, count, sjis, true, 0, unassignedCode);
+        count = Units(form, 0x3042, units);
+        std::uint8_t full[4] = {0xEE, 0xEE, 0xEE, 0xEE};
+        std::uint32_t needed = untouched;
+        std::uint32_t sourceLen = untouched;
+        Require(Call(form, units, count, sjis, full, 1, &needed, &sourceLen) == dstBufferEnd && needed == (IsBuffer(form) ? untouched : 2) && full[0] == 0xEE && sourceLen == untouched);
+        std::uint8_t mbc[4] = {};
+        Require(Call(form, units, count, sjis, mbc, sizeof(mbc), nullptr, nullptr) == 0 && std::memcmp(mbc, "\x82\xA0", 2) == 0);
+    }
+
+    std::uint8_t mbc[4] = {};
+    std::uint32_t wide = 0;
+    std::memcpy(&wide, "\x00\x00\x30\x42", 4);
+    Require(sceCesUtf32beToMbc(&wide, sjis, mbc, sizeof(mbc), &produced) == 0 && produced == 2 && std::memcmp(mbc, "\x82\xA0", 2) == 0);
+    Require(sceCesUtf32leToMbc(&wide, sjis, mbc, sizeof(mbc), &produced) == invalidEncode);
+    std::uint16_t narrow = 0;
+    std::memcpy(&narrow, "\xD8\x00", 2);
+    Require(sceCesUtf16leToMbc(&narrow, 1, &consumed, cp1252, mbc, sizeof(mbc), &produced) == 0 && consumed == 1 && produced == 1 && mbc[0] == 0xD8);
+    Require(sceCesUtf16beToMbc(&narrow, 1, &consumed, cp1252, mbc, sizeof(mbc), &produced) == srcBufferEnd);
+    Require(sceCesUtf8ToMbc(Bytes("A\xE4\xB8\xAD"), 4, &consumed, gbk, mbc, sizeof(mbc), &produced) == 0 && consumed == 1 && produced == 1 && mbc[0] == 'A');
+
+    const void* singleByte[] = {cp1252, cp1251, cp1250};
+    constexpr std::uint32_t singleByteMapped[] = {251, 255, 251};
+    const void* multiByte[] = {sjis, euc, eucCn, gbk, eucKr, uhc, big5};
+    for (std::size_t index = 0; index < 3; ++index) {
+        Require(SweepCodes(singleByte[index]) == singleByteMapped[index] && SweepBytes(singleByte[index]) == singleByteMapped[index]);
+        RequireInvalid(singleByte[index]);
+    }
+    for (const void* profile : multiByte) {
+        const std::uint32_t mapped = SweepCodes(profile);
+        Require(mapped > 256 && SweepBytes(profile) == mapped);
+        RequireInvalid(profile);
+    }
 }
diff --git a/core/libs/tests/GuestCesUnicode.cpp b/core/libs/tests/GuestCesUnicode.cpp
index 1603f09810..fa8fee7f88 100644
--- a/core/libs/tests/GuestCesUnicode.cpp
+++ b/core/libs/tests/GuestCesUnicode.cpp
@@ -1,31 +1,12 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceCesCs/JisX0208.hpp"
-#include "prx/libSceCesCs/JisX0212.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceCesUcs2ToUtf8(uint16_t, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUcs2(const uint8_t*, uint32_t, uint32_t*, uint16_t*);
-int APS5_VABI sceCesUtf32ToUtf8(uint32_t, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf32beToUtf8(const uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf32leToUtf8(const uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf32(const uint8_t*, uint32_t, uint32_t*, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf32be(const uint8_t*, uint32_t, uint32_t*, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf32le(const uint8_t*, uint32_t, uint32_t*, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf16(const uint8_t*, uint32_t, uint32_t*, uint16_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf16be(const uint8_t*, uint32_t, uint32_t*, uint16_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf16le(const uint8_t*, uint32_t, uint32_t*, uint16_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf16ToUtf8(const uint16_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf16beToUtf8(const uint16_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf16leToUtf8(const uint16_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-int APS5_VABI sceCesEucJpToUtf8(const void*, const uint8_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-}
-
 namespace {
 
 constexpr int INVALID_PARAMETER = static_cast<int>(0x805C0001);
@@ -178,6 +159,7 @@ void TestErrors() {
 }
 
 void TestEucJp() {
+    constexpr int INVALID_PROFILE = static_cast<int>(0x805C0004);
     std::array<uint8_t, 1024> sheet{};
     const void* profile = sceCesUcsProfileInitEucJpCp51932(sheet.data());
     auto check = [&](const uint8_t* source, uint32_t length, uint32_t code) {
@@ -195,10 +177,11 @@ void TestEucJp() {
             output.fill(0xA5);
             consumed = produced = SENTINEL;
             Require(sceCesEucJpToUtf8(profile, source, length, &consumed, output.data(), cap, &produced) == DST_BUFFER_END);
-            Require(consumed == SENTINEL && produced == SENTINEL && output[0] == 0xA5);
+            Require(consumed == length && produced == expectedLength && output[0] == 0xA5);
         }
     };
-    for (uint32_t code = 0; code < 128; ++code) {
+    for (uint32_t code = 0; code < 0xA0; ++code) {
+        if (code == 0x0E || code == 0x8E || code == 0x8F) continue;
         const uint8_t source[] = {static_cast<uint8_t>(code)};
         check(source, 1, code);
     }
@@ -207,39 +190,41 @@ void TestEucJp() {
         check(source, 2, 0xFF61 + cell);
     }
     uint32_t assigned = 0;
-    for (uint32_t supplementary = 0; supplementary < 2; ++supplementary) {
-        for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
-            const uint32_t code = supplementary ? JisX0212::TO_UCS2[cell] : JisX0208::TO_UCS2[cell];
-            const uint8_t source[] = {0x8F, static_cast<uint8_t>(0xA1 + cell / 94), static_cast<uint8_t>(0xA1 + cell % 94)};
-            const uint8_t* start = source + (supplementary ? 0 : 1);
-            const uint32_t length = supplementary ? 3 : 2;
-            if (code) { check(start, length, code); ++assigned; }
-            else {
-                uint8_t output[4] = {0xA5, 0xA5, 0xA5, 0xA5};
-                uint32_t consumed = SENTINEL;
-                uint32_t produced = SENTINEL;
-                Require(sceCesEucJpToUtf8(profile, start, length, &consumed, output, 4, &produced) == UNASSIGNED_CODE);
-                Require(consumed == SENTINEL && produced == SENTINEL && output[0] == 0xA5);
-            }
+    for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
+        const uint32_t code = JisX0208::TO_UCS2[cell];
+        const uint8_t source[] = {static_cast<uint8_t>(0xA1 + cell / 94), static_cast<uint8_t>(0xA1 + cell % 94)};
+        if (code) { check(source, 2, code); ++assigned; }
+        else {
+            uint8_t output[4] = {0xA5, 0xA5, 0xA5, 0xA5};
+            uint32_t consumed = SENTINEL;
+            uint32_t produced = SENTINEL;
+            Require(sceCesEucJpToUtf8(profile, source, 2, &consumed, output, 4, &produced) == UNASSIGNED_CODE);
+            Require(consumed == 2 && produced == 0 && output[0] == 0xA5);
         }
     }
-    Require(assigned == 13403);
-    const uint8_t source[] = {0x8F, 0xA2, 0xAF, 'X'};
+    Require(assigned == 7336);
+    const uint8_t source[] = {0xA4, 0xA2, 'X'};
     uint8_t output[4] = {0xA5, 0xA5, 0xA5, 0xA5};
     uint32_t consumed = SENTINEL;
     uint32_t produced = SENTINEL;
-    Require(sceCesEucJpToUtf8(nullptr, source, 3, &consumed, output, 4, &produced) == INVALID_PARAMETER);
+    Require(sceCesEucJpToUtf8(nullptr, source, 3, &consumed, output, 4, &produced) == INVALID_PROFILE);
+    Require(consumed == 0 && produced == 0);
     Require(sceCesEucJpToUtf8(profile, nullptr, 3, &consumed, output, 4, &produced) == INVALID_SRC_BUFFER);
-    Require(sceCesEucJpToUtf8(profile, source, 0, &consumed, output, 4, &produced) == SRC_BUFFER_END);
+    Require(sceCesEucJpToUtf8(profile, source, 0, &consumed, output, 4, &produced) == INVALID_SRC_BUFFER);
     Require(sceCesEucJpToUtf8(profile, source, 3, &consumed, nullptr, 4, &produced) == INVALID_DST_BUFFER);
-    for (uint32_t size : {1u, 2u}) Require(sceCesEucJpToUtf8(profile, source, size, &consumed, output, 4, &produced) == SRC_BUFFER_END);
+    Require(consumed == 2 && produced == 3);
+    Require(sceCesEucJpToUtf8(profile, source, 1, &consumed, output, 4, &produced) == SRC_BUFFER_END);
+    Require(consumed == 2 && produced == 0);
     const uint8_t malformed[] = {0x8E, 0x41};
     Require(sceCesEucJpToUtf8(profile, malformed, 2, &consumed, output, 4, &produced) == INVALID_ENCODE);
-    Require(consumed == SENTINEL && produced == SENTINEL && output[0] == 0xA5);
-    Require(sceCesEucJpToUtf8(profile, source, 4, &consumed, output, 4, &produced) == 0);
-    Require(consumed == 3 && produced == 2 && output[0] == 0xCB && output[1] == 0x98 && output[2] == 0xA5);
-    Require(sceCesEucJpToUtf8(profile, source, 4, nullptr, output, 4, nullptr) == 0);
-    std::puts("13403 assigned JIS cells plus ASCII, half-width katakana and unassigned cells checked");
+    Require(consumed == 2 && produced == 0 && output[0] == 0xA5);
+    const uint8_t supplementary[] = {0x8F, 0xA2, 0xAF};
+    Require(sceCesEucJpToUtf8(profile, supplementary, 3, &consumed, output, 4, &produced) == INVALID_ENCODE);
+    Require(consumed == 3 && produced == 0 && output[0] == 0xA5);
+    Require(sceCesEucJpToUtf8(profile, source, 3, &consumed, output, 4, &produced) == 0);
+    Require(consumed == 2 && produced == 3 && output[0] == 0xE3 && output[1] == 0x81 && output[2] == 0x82 && output[3] == 0xA5);
+    Require(sceCesEucJpToUtf8(profile, source, 3, nullptr, output, 4, nullptr) == 0);
+    std::puts("7336 assigned JIS X 0208 cells plus single bytes and half-width katakana checked");
 }
 
 }
diff --git a/core/libs/tests/GuestCesWide.cpp b/core/libs/tests/GuestCesWide.cpp
index 5d840cbdfe..e644f825e5 100644
--- a/core/libs/tests/GuestCesWide.cpp
+++ b/core/libs/tests/GuestCesWide.cpp
@@ -1,38 +1,9 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1252(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1251(void);
-void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-int APS5_VABI sceCesMbcsUcsContextInit(void*, const void*);
-int APS5_VABI sceCesSbcToUcs2(const std::uint8_t*, std::uint8_t, std::uint16_t*);
-int APS5_VABI sceCesSbcToUtf16(const std::uint8_t*, std::uint8_t, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSbcToUtf16be(const std::uint8_t*, std::uint8_t, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSbcToUtf16le(const std::uint8_t*, std::uint8_t, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesSbcToUtf32(const std::uint8_t*, std::uint8_t, std::uint32_t*);
-int APS5_VABI sceCesSbcToUtf32be(const std::uint8_t*, std::uint8_t, std::uint32_t*);
-int APS5_VABI sceCesSbcToUtf32le(const std::uint8_t*, std::uint8_t, std::uint32_t*);
-int APS5_VABI sceCesUcs2ToSbc(std::uint16_t, const std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesUtf16ToSbc(const std::uint16_t*, std::uint32_t, std::uint32_t*, const std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesUtf16beToSbc(const std::uint16_t*, std::uint32_t, std::uint32_t*, const std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesUtf16leToSbc(const std::uint16_t*, std::uint32_t, std::uint32_t*, const std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesUtf32ToSbc(std::uint32_t, const std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesUtf32beToSbc(const std::uint32_t*, const std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesUtf32leToSbc(const std::uint32_t*, const std::uint8_t*, std::uint8_t*);
-int APS5_VABI sceCesUtf16StrToMbcsStr(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf16StrGetMbcsLen(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesUtf32StrToMbcsStr(void*, const std::uint32_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf32StrGetMbcsLen(void*, const std::uint32_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUtf16Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrGetUtf16Len(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUtf32Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrGetUtf32Len(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
@@ -97,6 +68,10 @@ int main() {
     Require(sceCesUtf32leToSbc(&yLe, cp1252, &sbc) == 0 && sbc == 0x9F);
     Require(sceCesUtf32leToSbc(nullptr, cp1252, &sbc) == invalidSrcBuffer);
     for (int value = 0; value < 256; ++value) {
+        if (value == 0x98) {
+            Require(sceCesSbcToUtf32(cp1251, static_cast<std::uint8_t>(value), &utf32) == unassignedCode);
+            continue;
+        }
         Require(sceCesSbcToUtf32(cp1251, static_cast<std::uint8_t>(value), &utf32) == 0);
         Require(sceCesUtf32ToSbc(utf32, cp1251, &sbc) == 0 && sbc == value);
     }
diff --git a/core/libs/tests/GuestCharacter.cpp b/core/libs/tests/GuestCharacter.cpp
index 7601716b77..7f900acea7 100644
--- a/core/libs/tests/GuestCharacter.cpp
+++ b/core/libs/tests/GuestCharacter.cpp
@@ -1,44 +1,72 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
 #include <cctype>
 #include <clocale>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
-extern "C" {
-int APS5_VABI isupper_nid_postfix(int);
-int APS5_VABI islower_nid_postfix(int);
-int APS5_VABI isalpha_nid_postfix(int);
-int APS5_VABI isdigit_nid_postfix(int);
-int APS5_VABI isalnum_nid_postfix(int);
-int APS5_VABI isspace_nid_postfix(int);
-int APS5_VABI isblank_nid_postfix(int);
-int APS5_VABI iscntrl_nid_postfix(int);
-int APS5_VABI isprint_nid_postfix(int);
-int APS5_VABI isgraph_nid_postfix(int);
-int APS5_VABI ispunct_nid_postfix(int);
-int APS5_VABI isxdigit_nid_postfix(int);
-int APS5_VABI toupper_nid_postfix(int);
-int APS5_VABI tolower_nid_postfix(int);
-const short* APS5_VABI _Getptolower_nid_postfix();
-const short* APS5_VABI _Getptoupper_nid_postfix();
-const char* APS5_VABI setlocale_nid_postfix(int, const char*);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
+static int ConsoleClass(int c) {
+    if (c < 0 || c > 255) return 0;
+    int bits = 0;
+    if ((c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f')) bits |= 0x01;
+    if (c >= 'A' && c <= 'Z') bits |= 0x02;
+    if (c == ' ') bits |= 0x04;
+    if (c >= 33 && c <= 126 && !(c >= '0' && c <= '9') && !(c >= 'A' && c <= 'Z') && !(c >= 'a' && c <= 'z')) bits |= 0x08;
+    if (c >= 'a' && c <= 'z') bits |= 0x10;
+    if (c >= '0' && c <= '9') bits |= 0x20;
+    if (c >= '\t' && c <= '\r') bits |= 0x40;
+    if (c < 32 || c == 127) bits |= 0x80;
+    if (c == '\t') bits |= 0x400;
+    return bits;
+}
+static void CheckConsoleClassValues() {
+    Require(isspace_nid_postfix(' ') == 0x04 && isspace_nid_postfix('\t') == 0x40 && isspace_nid_postfix('\n') == 0x40);
+    Require(isblank_nid_postfix(' ') == 0x04 && isblank_nid_postfix('\t') == 0x400 && iscntrl_nid_postfix('\t') == 0x80);
+    Require(isdigit_nid_postfix('0') == 0x20 && isalnum_nid_postfix('0') == 0x20 && isxdigit_nid_postfix('0') == 0x01);
+    Require(isupper_nid_postfix('A') == 0x02 && isalpha_nid_postfix('A') == 0x02 && isxdigit_nid_postfix('F') == 0x01 && isxdigit_nid_postfix('G') == 0);
+    Require(islower_nid_postfix('a') == 0x10 && isalpha_nid_postfix('a') == 0x10 && isprint_nid_postfix(' ') == 0x04 && isgraph_nid_postfix(' ') == 0);
+    Require(ispunct_nid_postfix('_') == 0x08 && isgraph_nid_postfix('_') == 0x08 && isprint_nid_postfix('_') == 0x08 && iscntrl_nid_postfix(127) == 0x80);
+    for (int c = EOF; c <= 255; ++c) {
+        const int bits = ConsoleClass(c);
+        Require(isupper_nid_postfix(c) == (bits & 0x02) && islower_nid_postfix(c) == (bits & 0x10) && isalpha_nid_postfix(c) == (bits & 0x12));
+        Require(isdigit_nid_postfix(c) == (bits & 0x20) && isalnum_nid_postfix(c) == (bits & 0x32) && isxdigit_nid_postfix(c) == (bits & 0x01));
+        Require(isspace_nid_postfix(c) == (bits & 0x44) && isblank_nid_postfix(c) == (bits & 0x404) && iscntrl_nid_postfix(c) == (bits & 0x80));
+        Require(isprint_nid_postfix(c) == (bits & 0x3e) && isgraph_nid_postfix(c) == (bits & 0x3a) && ispunct_nid_postfix(c) == (bits & 0x08));
+    }
+}
+static void CheckSignedCharValues() {
+    for (int c = -128; c <= -2; ++c) {
+        Require(isupper_nid_postfix(c) == 0 && islower_nid_postfix(c) == 0 && isalpha_nid_postfix(c) == 0 && isdigit_nid_postfix(c) == 0);
+        Require(isalnum_nid_postfix(c) == 0 && isspace_nid_postfix(c) == 0 && isblank_nid_postfix(c) == 0 && iscntrl_nid_postfix(c) == 0);
+        Require(isprint_nid_postfix(c) == 0 && isgraph_nid_postfix(c) == 0 && ispunct_nid_postfix(c) == 0 && isxdigit_nid_postfix(c) == 0);
+        Require(toupper_nid_postfix(c) == c && tolower_nid_postfix(c) == c);
+    }
+}
+
 int main() {
+    CheckConsoleClassValues();
+    CheckSignedCharValues();
     Require(std::setlocale(LC_CTYPE, "C") != nullptr);
     for (int category = 0; category <= 6; ++category) {
         const char* result = setlocale_nid_postfix(category, "C");
         Require(result != nullptr && std::strcmp(result, "C") == 0);
-        result = setlocale_nid_postfix(category, "POSIX");
-        Require(result != nullptr && std::strcmp(result, "C") == 0);
+        Require(setlocale_nid_postfix(category, "POSIX") == nullptr);
         result = setlocale_nid_postfix(category, nullptr);
         Require(result != nullptr && std::strcmp(result, "C") == 0);
         result = setlocale_nid_postfix(category, "");
         Require(result != nullptr && std::strcmp(result, "C") == 0);
         Require(setlocale_nid_postfix(category, "en_US.UTF-8") == nullptr);
     }
-    Require(setlocale_nid_postfix(-1, "C") == nullptr);
-    Require(setlocale_nid_postfix(7, "C") == nullptr);
+    for (const int category : std::array<int, 4>{-1, 7, 100, 1 << 30}) {
+        const char* result = setlocale_nid_postfix(category, "C");
+        Require(result != nullptr && std::strcmp(result, "C") == 0);
+        result = setlocale_nid_postfix(category, nullptr);
+        Require(result != nullptr && std::strcmp(result, "C") == 0);
+        Require(setlocale_nid_postfix(category, "POSIX") == nullptr && setlocale_nid_postfix(category, "x") == nullptr);
+    }
     for (int c = EOF; c <= 255; ++c) {
         Require(bool(isupper_nid_postfix(c)) == bool(std::isupper(c)));
         Require(bool(islower_nid_postfix(c)) == bool(std::islower(c)));
@@ -52,9 +80,16 @@ int main() {
         Require(bool(isgraph_nid_postfix(c)) == bool(std::isgraph(c)));
         Require(bool(ispunct_nid_postfix(c)) == bool(std::ispunct(c)));
         Require(bool(isxdigit_nid_postfix(c)) == bool(std::isxdigit(c)));
+        Require(bool(isascii_nid_postfix(c)) == (c >= 0 && c <= 127));
+        Require(toascii_nid_postfix(c) == (c & 0x7F));
         Require(toupper_nid_postfix(c) == std::toupper(c));
         Require(tolower_nid_postfix(c) == std::tolower(c));
         Require(toupper_nid_postfix(c) == _Getptoupper_nid_postfix()[c]);
         Require(tolower_nid_postfix(c) == _Getptolower_nid_postfix()[c]);
     }
+    Require(!isascii_nid_postfix(-100));
+    Require(!isascii_nid_postfix(128));
+    Require(!isascii_nid_postfix(256));
+    Require(toascii_nid_postfix(258) == 2);
+    Require(toascii_nid_postfix(-1) == 0x7F);
 }
diff --git a/core/libs/tests/GuestClosedStandardDescriptors.cpp b/core/libs/tests/GuestClosedStandardDescriptors.cpp
index 4cb0deece1..de4c2500e5 100644
--- a/core/libs/tests/GuestClosedStandardDescriptors.cpp
+++ b/core/libs/tests/GuestClosedStandardDescriptors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstring>
@@ -6,10 +7,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-}
-
 namespace {
 
 constexpr int GuestGetFlags = 3;
diff --git a/core/libs/tests/GuestClosedStandardDescriptorsWindows.cpp b/core/libs/tests/GuestClosedStandardDescriptorsWindows.cpp
new file mode 100644
index 0000000000..b5633d602a
--- /dev/null
+++ b/core/libs/tests/GuestClosedStandardDescriptorsWindows.cpp
@@ -0,0 +1,93 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <windows.h>
+#include <io.h>
+
+extern "C" {
+
+extern FileStream* __stdinp_nid_postfix;
+extern FileStream* __stdoutp_nid_postfix;
+extern FileStream* __stderrp_nid_postfix;
+
+}
+
+namespace {
+
+constexpr int GuestGetDescriptorFlags = 1;
+constexpr int GuestGetFlags = 3;
+constexpr int GuestAccessMode = 3;
+constexpr int GuestReadOnly = 0;
+constexpr int GuestWriteOnly = 1;
+
+int Child(const char* closed) {
+    for (int descriptor = 0; descriptor <= 2; ++descriptor) {
+        if (closed[descriptor] != '1') continue;
+        const auto handle = reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor));
+        if (handle == INVALID_HANDLE_VALUE || handle == reinterpret_cast<HANDLE>(-2)) return 70 + descriptor;
+        if (::GetFileType(handle) != FILE_TYPE_CHAR) return 73 + descriptor;
+        if (fcntl_nid_postfix(descriptor, GuestGetDescriptorFlags) != 0) return 76 + descriptor;
+        const int expected = descriptor == 0 ? GuestReadOnly : GuestWriteOnly;
+        if ((fcntl_nid_postfix(descriptor, GuestGetFlags) & GuestAccessMode) != expected) return 79 + descriptor;
+        std::FILE* const host = descriptor == 0 ? stdin : descriptor == 1 ? stdout : stderr;
+        FileStream* const guest = descriptor == 0 ? __stdinp_nid_postfix : descriptor == 1 ? __stdoutp_nid_postfix : __stderrp_nid_postfix;
+        if (::_fileno(host) != descriptor) return 82 + descriptor;
+        if (guest->GuestState().descriptor != descriptor) return 96 + descriptor;
+        if (fileno_nid_postfix(guest) != descriptor) return 85 + descriptor;
+        if (descriptor == 0) {
+            if (std::fgetc(host) != EOF || std::feof(host) == 0 || std::ferror(host) != 0) return 88;
+            std::clearerr(host);
+            if (fgetc_nid_postfix(guest) != EOF || feof_nid_postfix(guest) == 0 || ferror_nid_postfix(guest) != 0) return 89;
+            clearerr_nid_postfix(guest);
+        } else {
+            if (std::fputc('x', host) == EOF || std::fflush(host) != 0 || std::ferror(host) != 0) return 90 + descriptor;
+            if (fputc_nid_postfix('x', guest) == EOF || fflush_nid_postfix(guest) != 0 || ferror_nid_postfix(guest) != 0) return 93 + descriptor;
+        }
+    }
+    return 0;
+}
+
+DWORD RunWithout(const wchar_t* self, bool input, bool output, bool error) {
+    std::wstring command = std::wstring(L"\"") + self + L"\" --closed-child " + (input ? L"1" : L"0") + (output ? L"1" : L"0") + (error ? L"1" : L"0");
+    STARTUPINFOW startup{};
+    startup.cb = sizeof(startup);
+    startup.dwFlags = STARTF_USESTDHANDLES;
+    startup.hStdInput = input ? nullptr : GetStdHandle(STD_INPUT_HANDLE);
+    startup.hStdOutput = output ? nullptr : GetStdHandle(STD_OUTPUT_HANDLE);
+    startup.hStdError = error ? nullptr : GetStdHandle(STD_ERROR_HANDLE);
+    PROCESS_INFORMATION process{};
+    if (!CreateProcessW(self, command.data(), nullptr, nullptr, TRUE, DETACHED_PROCESS, nullptr, nullptr, &startup, &process)) return 0xffffffffu;
+    DWORD code = 0xfffffffeu;
+    if (WaitForSingleObject(process.hProcess, 10000) == WAIT_OBJECT_0) GetExitCodeProcess(process.hProcess, &code);
+    else TerminateProcess(process.hProcess, code);
+    CloseHandle(process.hThread);
+    CloseHandle(process.hProcess);
+    return code;
+}
+
+}
+
+int main(int argc, char** argv) {
+    if (argc > 2 && std::strcmp(argv[1], "--closed-child") == 0 && std::strlen(argv[2]) == 3) return Child(argv[2]);
+    wchar_t self[MAX_PATH];
+    if (GetModuleFileNameW(nullptr, self, MAX_PATH) == 0) return 2;
+    const struct { bool input, output, error; const char* name; } cases[] = {
+        {true, false, false, "stdin"},
+        {false, true, false, "stdout"},
+        {false, false, true, "stderr"},
+        {true, true, true, "all three"},
+    };
+    for (const auto& test : cases) {
+        const DWORD result = RunWithout(self, test.input, test.output, test.error);
+        if (result != 0) {
+            std::fprintf(stderr, "missing standard handles, %s: child exited with %lu\n", test.name, result);
+            return 1;
+        }
+    }
+    std::puts("missing standard handles are opened on NUL");
+    return 0;
+}
diff --git a/core/libs/tests/GuestClosedStandardStreamsLoadWindows.cpp b/core/libs/tests/GuestClosedStandardStreamsLoadWindows.cpp
new file mode 100644
index 0000000000..da5ce1a579
--- /dev/null
+++ b/core/libs/tests/GuestClosedStandardStreamsLoadWindows.cpp
@@ -0,0 +1,104 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <cstdlib>
+#include <cstdint>
+#include <cwchar>
+#include <string>
+#include <windows.h>
+#include <shellapi.h>
+#include <io.h>
+
+extern "C" {
+_invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
+
+}
+
+namespace {
+int invalidCalls = 0;
+
+void InvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {
+    ++invalidCalls;
+}
+
+DWORD RunPrebound(const std::wstring& library, HANDLE report) {
+    wchar_t self[MAX_PATH];
+    const DWORD length = GetModuleFileNameW(nullptr, self, MAX_PATH);
+    if (length == 0 || length >= MAX_PATH) return 0xffffffffu;
+    HANDLE inherited = nullptr;
+    if (!DuplicateHandle(GetCurrentProcess(), report, GetCurrentProcess(), &inherited, 0, TRUE, DUPLICATE_SAME_ACCESS)) return 0xfffffffeu;
+    std::wstring command = L"\"" + std::wstring(self) + L"\" \"" + library + L"\" --prebound";
+    STARTUPINFOW startup{};
+    startup.cb = sizeof(startup);
+    startup.dwFlags = STARTF_USESTDHANDLES;
+    startup.hStdError = inherited;
+    PROCESS_INFORMATION process{};
+    const bool created = CreateProcessW(self, command.data(), nullptr, nullptr, TRUE, DETACHED_PROCESS, nullptr, nullptr, &startup, &process) != 0;
+    CloseHandle(inherited);
+    if (!created) return 0xfffffffdu;
+    DWORD code = 0xfffffffcu;
+    if (WaitForSingleObject(process.hProcess, 5000) == WAIT_OBJECT_0) GetExitCodeProcess(process.hProcess, &code);
+    else TerminateProcess(process.hProcess, code);
+    CloseHandle(process.hThread);
+    CloseHandle(process.hProcess);
+    return code;
+}
+}
+
+int main() {
+    HANDLE report = nullptr;
+    if (!DuplicateHandle(GetCurrentProcess(), GetStdHandle(STD_ERROR_HANDLE), GetCurrentProcess(), &report, 0, FALSE, DUPLICATE_SAME_ACCESS)) return 1;
+    const auto finish = [&](int code, const std::string& message) {
+        DWORD written = 0;
+        WriteFile(report, message.data(), static_cast<DWORD>(message.size()), &written, nullptr);
+        CloseHandle(report);
+        return code;
+    };
+    int count = 0;
+    auto** const arguments = CommandLineToArgvW(GetCommandLineW(), &count);
+    if (!arguments || (count != 2 && count != 3) || (count == 3 && std::wcscmp(arguments[2], L"--prebound") != 0)) {
+        if (arguments) LocalFree(arguments);
+        return finish(2, "expected one libc path argument\n");
+    }
+    const std::wstring library(arguments[1]);
+    const bool prebound = count == 3;
+    LocalFree(arguments);
+    int outputDescriptor = 1;
+    if (prebound) {
+        if (::_fileno(stdout) != -2 || ::_wfreopen(L"NUL", L"wb", stdout) != stdout)
+            return finish(11, "cannot prepare an already rebound stdout\n");
+        outputDescriptor = ::_fileno(stdout);
+        if (outputDescriptor < 3 || ::_get_osfhandle(1) != -2)
+            return finish(11, "stdout did not retain its separate descriptor\n");
+    } else {
+        const DWORD child = RunPrebound(library, report);
+        if (child != 0) return finish(12, "prebound stdout child exited with " + std::to_string(child) + "\n");
+        for (int descriptor : {1, 2}) {
+            if (::_fileno(__acrt_iob_func(descriptor)) != descriptor || ::_close(descriptor) != 0)
+                return finish(4, "cannot close an inherited standard descriptor\n");
+        }
+    }
+    const auto previous = _set_thread_local_invalid_parameter_handler(InvalidParameter);
+    const auto module = LoadLibraryW(library.c_str());
+    const DWORD loadError = module == nullptr ? GetLastError() : ERROR_SUCCESS;
+    _set_thread_local_invalid_parameter_handler(previous);
+    if (module == nullptr) return finish(5, "cannot load libc: " + std::to_string(loadError) + "\n");
+    if (invalidCalls != 0) return finish(6, "restoring bound standard streams invoked the invalid parameter handler " + std::to_string(invalidCalls) + " times\n");
+    const auto put = reinterpret_cast<decltype(&fputc_nid_postfix)>(GetProcAddress(module, "fputc_nid_postfix"));
+    const auto flush = reinterpret_cast<decltype(&fflush_nid_postfix)>(GetProcAddress(module, "fflush_nid_postfix"));
+    if (!put || !flush) return finish(7, "cannot find guest stream operations\n");
+    if (::_write(1, "x", 1) != 1) return finish(13, "the restored stdout descriptor cannot write\n");
+    for (int descriptor : {1, 2}) {
+        const auto pointer = GetProcAddress(module, descriptor == 1 ? "__stdoutp_nid_postfix" : "__stderrp_nid_postfix");
+        if (!pointer) return finish(8, "cannot find a guest standard stream\n");
+        auto* const guest = *reinterpret_cast<FileStream**>(pointer);
+        auto* const host = __acrt_iob_func(descriptor);
+        const int expected = descriptor == 1 ? outputDescriptor : descriptor;
+        if (!guest || guest->GuestState().descriptor != expected || ::_fileno(host) != expected)
+            return finish(9, "a restored stream has the wrong descriptor\n");
+        if (std::fputc('x', host) != 'x' || std::fflush(host) != 0 || put('x', guest) != 'x' || flush(guest) != 0)
+            return finish(10, "a restored stream cannot write to NUL\n");
+    }
+    return finish(0, "bound standard streams are restored without invalid parameter callbacks\n");
+}
diff --git a/core/libs/tests/GuestCollate.cpp b/core/libs/tests/GuestCollate.cpp
index 7dec7aabab..f886933573 100644
--- a/core/libs/tests/GuestCollate.cpp
+++ b/core/libs/tests/GuestCollate.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include <array>
@@ -10,8 +11,7 @@
 
 extern "C" {
 extern GuestLocale::Implementation* _ZSt21_sceLibcClassicLocale_nid_postfix;
-std::size_t APS5_VABI _ZNSt7collateIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
-std::size_t APS5_VABI _ZNSt7collateIwE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
+
 }
 
 namespace {
diff --git a/core/libs/tests/GuestCommonDialog.cpp b/core/libs/tests/GuestCommonDialog.cpp
index e5b9cd993b..b0d74a3b47 100644
--- a/core/libs/tests/GuestCommonDialog.cpp
+++ b/core/libs/tests/GuestCommonDialog.cpp
@@ -1,12 +1,8 @@
+#include "prx/libSceCommonDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceCommonDialogInitialize(void);
-bool APS5_VABI sceCommonDialogIsUsed(void);
-}
-
 namespace {
 
 void Require(bool value) {
diff --git a/core/libs/tests/GuestCompanionHttpd.cpp b/core/libs/tests/GuestCompanionHttpd.cpp
index e9f8990365..afe5b08822 100644
--- a/core/libs/tests/GuestCompanionHttpd.cpp
+++ b/core/libs/tests/GuestCompanionHttpd.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCompanionHttpd/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -6,26 +7,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceCompanionHttpdOptParamInitialize(void* param);
-int APS5_VABI sceCompanionHttpdInitialize(const void* param);
-int APS5_VABI sceCompanionHttpdTerminate(void);
-int APS5_VABI sceCompanionHttpdRegisterRequestCallback(void* function, void* argument);
-int APS5_VABI sceCompanionHttpdUnregisterRequestCallback(void);
-int APS5_VABI sceCompanionHttpdStart(void);
-int APS5_VABI sceCompanionHttpdStop(void);
-int APS5_VABI sceCompanionHttpdGetEvent(void* event);
-int APS5_VABI sceCompanionHttpdAddHeader(const char* key, const char* value, void* response);
-int APS5_VABI sceCompanionHttpdSetStatus(int status, void* response);
-int APS5_VABI sceCompanionHttpdSetBody(const char* body, std::uint64_t size, void* response);
-int APS5_VABI sceCompanionHttpdGet2ndScreenStatus(void);
-int APS5_VABI sceCompanionHttpdGetUserId(void);
-int APS5_VABI sceCompanionHttpdInitialize2(void);
-int APS5_VABI sceCompanionHttpdRegisterRequestBodyReceptionCallback(void);
-int APS5_VABI sceCompanionHttpdRegisterRequestCallback2(void);
-int APS5_VABI sceCompanionHttpdUnregisterRequestBodyReceptionCallback(void);
-}
-
 namespace {
 
 constexpr int InvalidParam = static_cast<int>(0x80E40004u);
@@ -63,7 +44,7 @@ void CheckOptionBlock() {
     unsigned char block[0x70];
     std::memset(block, 0x5a, sizeof(block));
     Require(sceCompanionHttpdOptParamInitialize(nullptr) == InvalidParam, "a null option block must be rejected");
-    Require(sceCompanionHttpdOptParamInitialize(block) == 0, "sceCompanionHttpdOptParamInitialize failed");
+    Require(sceCompanionHttpdOptParamInitialize(reinterpret_cast<CompanionHttpdOptParam*>(block)) == 0, "sceCompanionHttpdOptParamInitialize failed");
     for (std::size_t index = 0; index < sizeof(block); ++index) {
         Require(block[index] == (index < 0x60 ? 0u : 0x5au), "the option block must be zeroed over its 0x60 bytes and nothing past them");
     }
@@ -80,14 +61,14 @@ void CheckStates() {
     Require(sceCompanionHttpdStart() == NotInitialized, "a start before initialization");
     Require(sceCompanionHttpdStop() == NotInitialized, "a stop before initialization");
     Require(sceCompanionHttpdTerminate() == NotInitialized, "a termination before initialization");
-    Require(sceCompanionHttpdRegisterRequestCallback(callback, nullptr) == NotInitialized, "a callback before initialization");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), nullptr) == NotInitialized, "a callback before initialization");
     Require(sceCompanionHttpdUnregisterRequestCallback() == NotInitialized, "an unregistration before initialization");
     Require(sceCompanionHttpdInitialize(nullptr) == InvalidParam, "a null parameter must be rejected");
-    Require(sceCompanionHttpdInitialize(param) == 0, "sceCompanionHttpdInitialize failed");
-    Require(sceCompanionHttpdInitialize(param) == AlreadyInitialized, "a second initialization");
+    Require(sceCompanionHttpdInitialize(reinterpret_cast<const CompanionHttpdOptParam*>(param)) == 0, "sceCompanionHttpdInitialize failed");
+    Require(sceCompanionHttpdInitialize(reinterpret_cast<const CompanionHttpdOptParam*>(param)) == AlreadyInitialized, "a second initialization");
     Require(sceCompanionHttpdRegisterRequestCallback(nullptr, nullptr) == InvalidParam, "a null callback must be rejected");
-    Require(sceCompanionHttpdRegisterRequestCallback(callback, param) == 0, "registering the request callback failed");
-    Require(sceCompanionHttpdRegisterRequestCallback(callback, param) == AlreadyRegistered, "a second callback");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), param) == 0, "registering the request callback failed");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), param) == AlreadyRegistered, "a second callback");
     Require(sceCompanionHttpdGetEvent(nullptr) == InvalidParam, "a null event must be rejected");
     Require(sceCompanionHttpdGetEvent(event) == NoEvent, "no companion device connects before the start");
     Require(sceCompanionHttpdStop() == NotStarted, "a stop before the start");
@@ -101,8 +82,8 @@ void CheckStates() {
     RequireNotImplemented([] { sceCompanionHttpdUnregisterRequestCallback(); }, "sceCompanionHttpdUnregisterRequestCallback");
     Require(sceCompanionHttpdTerminate() == 0, "sceCompanionHttpdTerminate failed");
     Require(sceCompanionHttpdTerminate() == NotInitialized, "a second termination");
-    Require(sceCompanionHttpdInitialize(param) == 0, "initializing again after the termination failed");
-    Require(sceCompanionHttpdRegisterRequestCallback(callback, nullptr) == 0, "the termination kept the callback");
+    Require(sceCompanionHttpdInitialize(reinterpret_cast<const CompanionHttpdOptParam*>(param)) == 0, "initializing again after the termination failed");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), nullptr) == 0, "the termination kept the callback");
     Require(sceCompanionHttpdTerminate() == 0, "the last termination failed");
 }
 
diff --git a/core/libs/tests/GuestCondRecursiveMutex.cpp b/core/libs/tests/GuestCondRecursiveMutex.cpp
index 92f7166071..e21300d818 100644
--- a/core/libs/tests/GuestCondRecursiveMutex.cpp
+++ b/core/libs/tests/GuestCondRecursiveMutex.cpp
@@ -1,29 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 static constexpr int POSIX_ETIMEDOUT = 60;
 static constexpr int MUTEX_TYPE_RECURSIVE = 2;
 
diff --git a/core/libs/tests/GuestCondTimedwait.cpp b/core/libs/tests/GuestCondTimedwait.cpp
index 434d257d2d..70db4b4e2b 100644
--- a/core/libs/tests/GuestCondTimedwait.cpp
+++ b/core/libs/tests/GuestCondTimedwait.cpp
@@ -1,36 +1,18 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTrylock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI pthread_cond_init_nid_postfix(PthreadCond* cond, const PthreadCondattr* attr);
-int APS5_VABI pthread_cond_destroy_nid_postfix(PthreadCond* cond);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI pthread_cond_reltimedwait_np_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *)(void*), void*, void*);
-void APS5_VABI __pthread_cxa_finalize_nid_postfix(void*);
-unsigned int APS5_VABI sceKernelSleep(unsigned int seconds);
-}
-
 static int cleanupAt = -1;
 static void APS5_VABI Cleanup(void*) { cleanupAt = 0; }
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
 static constexpr int POSIX_EPERM = 1;
 static constexpr int POSIX_EINVAL = 22;
 static constexpr int POSIX_ETIMEDOUT = 60;
@@ -55,6 +37,7 @@ struct Signalled {
     PthreadCond cond = nullptr;
     bool ready = false;
     int trylock = SCE_OK;
+    Pthread target = nullptr;
 };
 
 static void* APS5_VABI Trylocker(void* arg) {
@@ -72,6 +55,15 @@ static void* APS5_VABI Signaller(void* arg) {
     return nullptr;
 }
 
+static void* APS5_VABI SignallerTo(void* arg) {
+    auto& signalled = *static_cast<Signalled*>(arg);
+    Require(scePthreadMutexLock(&signalled.mutex) == SCE_OK);
+    signalled.ready = true;
+    Require(pthread_cond_signalto_np_nid_postfix(&signalled.cond, signalled.target) == 0);
+    Require(scePthreadMutexUnlock(&signalled.mutex) == SCE_OK);
+    return nullptr;
+}
+
 static void RequireHeldByCaller(Signalled& signalled) {
     Pthread thread = nullptr;
     Require(scePthreadCreate(&thread, nullptr, Trylocker, &signalled, nullptr) == SCE_OK);
@@ -108,8 +100,29 @@ static void RelativeWait() {
     Require(scePthreadMutexDestroy(&signalled.mutex) == SCE_OK);
 }
 
+static void SignalTo() {
+    Signalled signalled;
+    signalled.target = scePthreadSelf();
+    Require(scePthreadMutexInit(&signalled.mutex, nullptr, nullptr) == SCE_OK);
+    Require(scePthreadCondInit(&signalled.cond, nullptr, nullptr) == SCE_OK);
+    Require(pthread_cond_signalto_np_nid_postfix(&signalled.cond, signalled.target) == 0);
+    Require(scePthreadMutexLock(&signalled.mutex) == SCE_OK);
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, nullptr, SignallerTo, &signalled, nullptr) == SCE_OK);
+    const auto waitStart = std::chrono::steady_clock::now();
+    while (!signalled.ready)
+        Require(pthread_cond_reltimedwait_np_nid_postfix(&signalled.cond, &signalled.mutex, 10000000) == 0);
+    Require(std::chrono::steady_clock::now() - waitStart < std::chrono::seconds(5));
+    Require(scePthreadMutexUnlock(&signalled.mutex) == SCE_OK);
+    Require(scePthreadJoin(thread, nullptr) == SCE_OK);
+    Require(scePthreadCondDestroy(&signalled.cond) == SCE_OK);
+    Require(pthread_cond_signalto_np_nid_postfix(&signalled.cond, signalled.target) == 22);
+    Require(scePthreadMutexDestroy(&signalled.mutex) == SCE_OK);
+}
+
 int main() {
     RelativeWait();
+    SignalTo();
 
     Context context;
     PthreadCond cond = nullptr;
@@ -148,5 +161,6 @@ int main() {
     void* finalizeHandle = reinterpret_cast<void*>(7);
     Require(__cxa_atexit_nid_postfix(Cleanup, nullptr, finalizeHandle) == SCE_OK);
     __pthread_cxa_finalize_nid_postfix(finalizeHandle);
+
     Require(cleanupAt == 0);
 }
diff --git a/core/libs/tests/GuestCondUnownedMutex.cpp b/core/libs/tests/GuestCondUnownedMutex.cpp
index f68fe17391..124b772719 100644
--- a/core/libs/tests/GuestCondUnownedMutex.cpp
+++ b/core/libs/tests/GuestCondUnownedMutex.cpp
@@ -1,28 +1,15 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int POSIX_EPERM = 1;
 static constexpr int POSIX_EINVAL = 22;
 static constexpr std::uintptr_t ADAPTIVE_INITIALIZER = 1;
diff --git a/core/libs/tests/GuestContentDelete.cpp b/core/libs/tests/GuestContentDelete.cpp
index 06cebf5b38..caafe4a5bd 100644
--- a/core/libs/tests/GuestContentDelete.cpp
+++ b/core/libs/tests/GuestContentDelete.cpp
@@ -1,14 +1,10 @@
+#include "prx/libSceContentDelete/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI sceContentDeleteInitialize(const ContentDeleteInitParam* initParam);
-extern "C" int APS5_VABI sceContentDeleteTerminate(void);
-extern "C" int APS5_VABI sceContentDeleteById(std::int64_t contentId);
-extern "C" int APS5_VABI sceContentDeleteByPath(const char* contentPath);
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestContentExport.cpp b/core/libs/tests/GuestContentExport.cpp
index 4f72b3a7c7..07fa418b6d 100644
--- a/core/libs/tests/GuestContentExport.cpp
+++ b/core/libs/tests/GuestContentExport.cpp
@@ -1,30 +1,10 @@
+#include "prx/libSceContentExport/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <set>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceContentExportAddToFavorites(std::int64_t contentId);
-extern "C" int APS5_VABI sceContentExportDataProvideFunction(void);
-extern "C" int APS5_VABI sceContentExportFree(void);
-extern "C" int APS5_VABI sceContentExportFrom(void);
-extern "C" int APS5_VABI sceContentExportFromFileForSf(std::int32_t expId, const ContentExportParam* param, const ContentExportSfParam* sfParam, const char* sourcePath, const char* thumbnailPath, char* path, std::size_t pathBufferLength);
-extern "C" int APS5_VABI sceContentExportFromFileWithContentIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const std::int64_t* contentIds, std::uint32_t contentCount, char* path, std::size_t pathBufferLength);
-extern "C" int APS5_VABI sceContentExportFromFileWithTitleIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const char* titleIdList, char* path, std::size_t pathBufferLength);
-extern "C" int APS5_VABI sceContentExportInit(const ContentExportInitParam* param);
-extern "C" int APS5_VABI sceContentExportMalloc(void);
-extern "C" int APS5_VABI sceContentExportRemoveFromFavorites(std::int64_t contentId);
-extern "C" int APS5_VABI sceContentExportRenameContent(std::int64_t contentId, const char* name);
-extern "C" int APS5_VABI sceContentExportValidateContents(const std::int64_t* contentIds, std::uint32_t count);
-
-extern "C" int APS5_VABI sceContentExportInit2(const ContentExportInitParam2* init_param);
-extern "C" int APS5_VABI sceContentExportTerm(void);
-extern "C" int APS5_VABI sceContentExportStart(void);
-extern "C" int APS5_VABI sceContentExportFinish(std::int32_t expId);
-extern "C" int APS5_VABI sceContentExportGetProgress(std::int32_t expId);
-extern "C" int APS5_VABI sceContentExportCancel(std::int32_t expId);
-extern "C" int APS5_VABI sceContentExportFromDataWithThumbnail(std::int32_t expId, const ContentExportParam* param, const ContentExportCallbackParam* contentCallbackParam, const char* thumbnailType, const ContentExportCallbackParam* thumbnailCallbackParam, char* path, std::size_t pathBufferLength);
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -47,6 +27,7 @@ void Export(std::int32_t expId) {
     ContentExportCallbackParam content{};
     ContentExportCallbackParam thumbnail{};
     sceContentExportFromDataWithThumbnail(expId, &param, &content, "image/png", &thumbnail, path, sizeof(path));
+
 }
 
 }
diff --git a/core/libs/tests/GuestContentSearch.cpp b/core/libs/tests/GuestContentSearch.cpp
index 5676436c77..c316de1c76 100644
--- a/core/libs/tests/GuestContentSearch.cpp
+++ b/core/libs/tests/GuestContentSearch.cpp
@@ -1,34 +1,12 @@
+#include "prx/libSceContentSearch/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
+#ifdef __APPLE__
+#include <initializer_list>
+#endif
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceContentSearchInit(const ContentSearchInitParam* init_param);
-int APS5_VABI sceContentSearchTerm(void);
-int APS5_VABI sceContentSearchGetContentLastUpdateId(std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchGetNumOfContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* numOfContent, std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchGetTotalContentSize(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* size, std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchSearchContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, const ContentSearchContentOrderByCondition* orderByConditions, std::uint32_t orderByConditionsLength, std::uint32_t offset, std::uint32_t limit, std::int64_t* numOfContent, void* infos, std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchOpenMetadata(const char* filePath, std::int32_t* metadataId);
-int APS5_VABI sceContentSearchOpenMetadataByContentId(std::int64_t contentId, std::int32_t* metadataId);
-int APS5_VABI sceContentSearchCloseMetadata(std::int32_t metadataId);
-int APS5_VABI sceContentSearchGetMetadataFieldInfo(std::int32_t metadataId, const char* field, std::int32_t* metadataType, std::int32_t* size);
-int APS5_VABI sceContentSearchGetMetadataValue(std::int32_t metadataId, const char* field, void* value);
-int APS5_VABI sceContentBinderEnd(void);
-int APS5_VABI sceContentBinderGetNumOfDifference(void);
-int APS5_VABI sceContentBinderInitialize(void);
-int APS5_VABI sceContentBinderIsUpdated(void);
-int APS5_VABI sceContentBinderReset(void);
-int APS5_VABI sceContentBinderSearchDifference(void);
-int APS5_VABI sceContentBinderStart(void);
-int APS5_VABI sceContentBinderTerminate(void);
-int APS5_VABI sceContentSearchGetApplicationLastUpdateId(void);
-int APS5_VABI sceContentSearchGetMyApplicationIndex(void);
-int APS5_VABI sceContentSearchGetNumOfApplication(void);
-int APS5_VABI sceContentSearchSearchApplication(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestConvertKeycode.cpp b/core/libs/tests/GuestConvertKeycode.cpp
index 3bb2493a66..d2d3cb463f 100644
--- a/core/libs/tests/GuestConvertKeycode.cpp
+++ b/core/libs/tests/GuestConvertKeycode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceConvertKeycode/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "ProcessParametersFixture.hpp"
@@ -12,14 +13,11 @@
 #include <string>
 #include <utility>
 
-extern "C" {
-int APS5_VABI sceConvertKeycodeGetVirtualKeycode(std::uint16_t, std::uint32_t, std::uint16_t*);
-int APS5_VABI sceConvertKeycodeGetImeKeyboardType(std::int32_t, std::uint32_t*);
-int APS5_VABI sceConvertKeycodeGetCharacter(std::uint16_t, std::uint32_t, std::uint32_t, char16_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
+static_assert(ImeKeyboardType::LookUp(INT32_MIN, 0, 0) == 0);
+static_assert(ImeKeyboardType::LookUp(INT32_MAX, 0, 0) == 0);
+
 static void SetLanguage(const char* value) {
 #ifdef _WIN32
     Require(_putenv_s("ANYPS5_LANGUAGE", value != nullptr ? value : "") == 0);
@@ -146,6 +144,7 @@ int main() {
         bool rejected = false;
         try {
             sceConvertKeycodeGetVirtualKeycode(28, layout, &virtualKey);
+
         } catch (const std::runtime_error&) {
             rejected = true;
         }
diff --git a/core/libs/tests/GuestConvertKeycodeTitle.cpp b/core/libs/tests/GuestConvertKeycodeTitle.cpp
index 6fd7337573..21ccc29fa5 100644
--- a/core/libs/tests/GuestConvertKeycodeTitle.cpp
+++ b/core/libs/tests/GuestConvertKeycodeTitle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceConvertKeycode/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "ProcessParametersFixture.hpp"
 #include <array>
@@ -6,10 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceConvertKeycodeGetImeKeyboardType(std::int32_t, std::uint32_t*);
-}
-
 int main() {
 #ifdef _WIN32
     if (_putenv_s("ANYPS5_LANGUAGE", "") != 0) return 2;
@@ -21,5 +18,11 @@ int main() {
     std::memcpy(process.data() + 16, &sdkVersion, sizeof(sdkVersion));
     if (!ProcessParametersFixture::Install(process.data(), process.size())) return 2;
     std::uint32_t type = 0xFFFFFFFFu;
+    std::uint16_t virtualKey = 0;
+    char16_t character = 0;
+    if (sceConvertKeycodeGetVirtualKeycode(0, 0, nullptr) != static_cast<int>(0x80BC0031u)) return 1;
+    if (sceConvertKeycodeGetVirtualKeycode(0, 0, &virtualKey) != static_cast<int>(0x80BC001Du)) return 1;
+    if (sceConvertKeycodeGetCharacter(0, 0, 0, nullptr) != static_cast<int>(0x80BC0031u)) return 1;
+    if (sceConvertKeycodeGetCharacter(0, 0, 0, &character) != static_cast<int>(0x80BC001Du)) return 1;
     return sceConvertKeycodeGetImeKeyboardType(0x10000000, &type) == 0 && type == 4 ? 0 : 1;
 }
diff --git a/core/libs/tests/GuestCoredumpAttach.cpp b/core/libs/tests/GuestCoredumpAttach.cpp
index 5d3b7ebb5e..e1948026e4 100644
--- a/core/libs/tests/GuestCoredumpAttach.cpp
+++ b/core/libs/tests/GuestCoredumpAttach.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,18 +9,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceCoredumpRegisterCoredumpHandler(uint64_t handler, size_t stackSize, uint64_t context);
-int APS5_VABI sceCoredumpUnregisterCoredumpHandler(void);
-int APS5_VABI sceCoredumpAttachMemoryRegion(uint32_t userValue, const void* mem, std::int32_t size);
-int APS5_VABI sceCoredumpAttachUserMemoryFile(uint32_t userValue, const void* mem, std::int32_t size);
-int APS5_VABI sceCoredumpGetStopInfoCpu(void* info, size_t size);
-int APS5_VABI sceCoredumpGetThreadContextInfo(void* threadContextInfo, size_t threadContextInfoSize);
-int APS5_VABI sceCoredumpGetStopInfoGpu_Agc(void* info, size_t size);
-int APS5_VABI sceCoredumpWriteUserString(uint32_t first, const char* text, int third);
-int APS5_VABI sceCoredumpConfigDumpMode(int mode);
-}
-
 namespace {
 alignas(16) std::array<std::byte, 0x40> process{};
 constexpr int InvalidArgument = static_cast<int>(0x81180000u);
diff --git a/core/libs/tests/GuestCoredumpUserData.cpp b/core/libs/tests/GuestCoredumpUserData.cpp
index d0baa9fd12..694d076666 100644
--- a/core/libs/tests/GuestCoredumpUserData.cpp
+++ b/core/libs/tests/GuestCoredumpUserData.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,16 +9,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceCoredumpRegisterCoredumpHandler(uint64_t handler, size_t stackSize, uint64_t context);
-int APS5_VABI sceCoredumpUnregisterCoredumpHandler(void);
-int64_t APS5_VABI sceCoredumpWriteUserData(const void* data, size_t size);
-void APS5_VABI sceCoredumpDebugTextOut(const char* str, int len);
-int APS5_VABI sceCoredumpAttachUserFile(uint32_t userValue, const char* path);
-int APS5_VABI sceCoredumpAttachMemoryRegionAsUserFile(uint32_t userValue, const void* mem, std::int32_t size, const char* name);
-int APS5_VABI sceCoredumpSetUserDataType(std::int32_t type);
-}
-
 namespace {
 alignas(16) std::array<std::byte, 0x40> process{};
 constexpr int64_t InvalidArgument = static_cast<int32_t>(0x81180000u);
@@ -93,6 +84,7 @@ int main() {
     RequireWritesRefused(region);
     RequireAttachesRefused(region);
     sceCoredumpDebugTextOut(text, static_cast<int>(sizeof(text) - 1));
+
     Require(!handlerRan);
 
     Require(sceCoredumpWriteUserData(nullptr, region.size()) == InvalidArgument);
diff --git a/core/libs/tests/GuestCpuTimeClocks.cpp b/core/libs/tests/GuestCpuTimeClocks.cpp
index cb7405736e..18ae60bb87 100644
--- a/core/libs/tests/GuestCpuTimeClocks.cpp
+++ b/core/libs/tests/GuestCpuTimeClocks.cpp
@@ -1,19 +1,17 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdlib>
 
 extern "C" {
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI clock_getres_nid_postfix(int clockId, KernelTimespec* res);
-int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-int APS5_VABI sceKernelClockGetres(KernelClockid clockId, KernelTimespec* tp);
+
 #ifdef _WIN32
 int APS5_VABI ClockTimeWin32ErrorToGuestErrno_nid_no_patch(std::uint32_t error);
 #endif
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
+
 }
 
 #ifdef _WIN32
@@ -23,7 +21,6 @@ static constexpr std::uint32_t WINDOWS_ERROR_INVALID_HANDLE = 6;
 #endif
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EFAULT = static_cast<int>(0x8002000E);
 
 static constexpr int GUEST_CLOCK_MONOTONIC = 4;
 static constexpr int GUEST_CLOCK_THREAD_CPUTIME_ID = 14;
diff --git a/core/libs/tests/GuestCredentials.cpp b/core/libs/tests/GuestCredentials.cpp
index ff69af902b..c2bc00310d 100644
--- a/core/libs/tests/GuestCredentials.cpp
+++ b/core/libs/tests/GuestCredentials.cpp
@@ -1,30 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI seteuid_nid_postfix(std::uint32_t);
-int APS5_VABI setegid_nid_postfix(std::uint32_t);
-int APS5_VABI setuid_nid_postfix(std::uint32_t);
-int APS5_VABI setgid_nid_postfix(std::uint32_t);
-int APS5_VABI setreuid_nid_postfix(std::uint32_t, std::uint32_t);
-int APS5_VABI setregid_nid_postfix(std::uint32_t, std::uint32_t);
-int APS5_VABI setresuid_nid_postfix(std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI setresgid_nid_postfix(std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI setgroups_nid_postfix(int, const std::uint32_t*);
-int APS5_VABI getgroups_nid_postfix(int, std::uint32_t*);
-int APS5_VABI getuid_nid_postfix(void);
-int APS5_VABI geteuid_nid_postfix(void);
-int APS5_VABI getgid_nid_postfix(void);
-int APS5_VABI getegid_nid_postfix(void);
-int APS5_VABI issetugid_nid_postfix(void);
-int APS5_VABI getresuid_nid_postfix(std::uint32_t*, std::uint32_t*, std::uint32_t*);
-int APS5_VABI getresgid_nid_postfix(std::uint32_t*, std::uint32_t*, std::uint32_t*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 using SetId = int (APS5_VABI *)(std::uint32_t);
 using SetReId = int (APS5_VABI *)(std::uint32_t, std::uint32_t);
diff --git a/core/libs/tests/GuestCrt.cpp b/core/libs/tests/GuestCrt.cpp
index d2fe45d744..1e8f1887f5 100644
--- a/core/libs/tests/GuestCrt.cpp
+++ b/core/libs/tests/GuestCrt.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/SonyCrt.hpp"
@@ -14,31 +16,6 @@
 #include <exception>
 #include <limits>
 
-extern "C" {
-SonyLconv* APS5_VABI sceAmprLocaleconv(void);
-double APS5_VABI sceAmprSinh(double x, double y);
-char* APS5_VABI sceAmprStrtokS(char* str, const char* delim, char** context);
-int APS5_VABI sceAmprCtimeS(char* buffer, std::size_t size, const std::int64_t* time);
-int APS5_VABI sceAmprWcscpyS(std::uint16_t* dest, std::size_t size, const std::uint16_t* src);
-void* APS5_VABI sceAmprSetConstraintHandlerS(void* handler);
-int APS5_VABI sceAmprFltrounds(void);
-void APS5_VABI sceAmprIgnoreHandlerS(const char* message, void* pointer, int error);
-std::size_t APS5_VABI sceAmprMbstowcs(std::uint16_t* dest, const char* src, std::size_t size);
-int APS5_VABI sceAmprAsctimeS(char* buffer, std::size_t size, const GuestTm* time);
-int APS5_VABI ctime_s_nid_postfix(char* buffer, std::size_t size, const std::int64_t* time);
-int APS5_VABI asctime_s_nid_postfix(char* buffer, std::size_t size, const GuestTm* time);
-std::size_t APS5_VABI mbstowcs_nid_postfix(std::uint16_t* dest, const char* src, std::size_t size);
-char* APS5_VABI strtok_s_nid_postfix(char* str, const char* delim, char** context);
-int APS5_VABI __fpclassifyd_nid_postfix(double value);
-unsigned __int128 APS5_VABI __udivti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
-__int128 APS5_VABI __divti3_nid_postfix(__int128 dividend, __int128 divisor);
-unsigned __int128 APS5_VABI __umodti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
-__int128 APS5_VABI __modti3_nid_postfix(__int128 dividend, __int128 divisor);
-SonyLconv* APS5_VABI localeconv_nid_postfix(void);
-int APS5_VABI sceAmprFpclassifyd(double value);
-unsigned int APS5_VABI _ZSt14_Random_devicev_nid_postfix();
-}
-
 #define Require(condition) do { if (!(condition)) { std::fprintf(stderr, "guest_crt: line %d: %s\n", __LINE__, #condition); std::abort(); } } while (0)
 
 static int g_handlerCalls = 0;
@@ -154,6 +131,7 @@ int main() {
     trapped = false;
     try {
         __umodti3_nid_postfix(((unsigned __int128)0x1234 << 64) | 0x5678, 0);
+
     } catch (const std::runtime_error& error) {
         trapped = std::strcmp(error.what(), "__umodti3: integer divide by zero (0x00000000000012340000000000005678 % 0)") == 0;
     }
@@ -195,6 +173,13 @@ int main() {
     known.tm_year = 9000;
     text[0] = 'x';
     Require(sceAmprAsctimeS(text, sizeof(text), &known) == EINVAL && text[0] == '\0');
+    for (const int year : {INT_MAX, INT_MAX - 1899, INT_MIN}) {
+        known.tm_year = year;
+        text[0] = 'x';
+        Require(sceAmprAsctimeS(text, sizeof(text), &known) == EINVAL && text[0] == '\0');
+        text[0] = 'x';
+        Require(asctime_s_nid_postfix(text, sizeof(text), &known) == EINVAL && text[0] == '\0');
+    }
     known.tm_year = 70;
     known.tm_mday = 32;
     text[0] = 'x';
diff --git a/core/libs/tests/GuestCryptoMemcmp.cpp b/core/libs/tests/GuestCryptoMemcmp.cpp
index 578b4a4645..e23991ed1f 100644
--- a/core/libs/tests/GuestCryptoMemcmp.cpp
+++ b/core/libs/tests/GuestCryptoMemcmp.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -13,8 +14,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI CRYPTO_memcmp_nid_postfix(const void*, const void*, std::size_t);
-
 namespace {
 
 void Require(bool value) {
diff --git a/core/libs/tests/GuestCurrentCpu.cpp b/core/libs/tests/GuestCurrentCpu.cpp
index 389ad302ff..323eead874 100644
--- a/core/libs/tests/GuestCurrentCpu.cpp
+++ b/core/libs/tests/GuestCurrentCpu.cpp
@@ -1,22 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <array>
 #include <bit>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceKernelGetCurrentCpu(void);
-int APS5_VABI sceKernelGetMainSocId(void);
-int APS5_VABI sceKernelGetCpumode(void);
-std::int64_t APS5_VABI sceKernelGetCpuFrequency(void);
-std::uint64_t APS5_VABI sceKernelGetTscFrequency(void);
-KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr unsigned MAX_HOST_CPUS = 256;
 static constexpr int CALLS_PER_THREAD = 64;
@@ -44,6 +33,7 @@ int main() {
     const KernelCpumask available = sceKernelGetAvailableCpumask();
     Require(sceKernelGetMainSocId() == 0 && sceKernelGetCpumode() == 0);
     Require(sceKernelGetCpuFrequency() > 0 && static_cast<std::uint64_t>(sceKernelGetCpuFrequency()) == sceKernelGetTscFrequency());
+    Require(sceKernelGetTscFrequency() >= 100000000u && sceKernelGetTscFrequency() <= 10000000000u);
 
     const std::array<KernelCpumask, 8> affinities{available, 0x1FFB, 0x3, 0x3F, 0x1000, 0x1, 0xFFFF, 0x10000};
     for (const KernelCpumask affinity : affinities) {
diff --git a/core/libs/tests/GuestDaemon.cpp b/core/libs/tests/GuestDaemon.cpp
index 0e87384eb6..bec3a6613a 100644
--- a/core/libs/tests/GuestDaemon.cpp
+++ b/core/libs/tests/GuestDaemon.cpp
@@ -1,12 +1,14 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 #include <string>
-extern "C" int APS5_VABI daemon_nid_postfix(int, int);
+
 static void Require(bool value) { if (!value) std::abort(); }
 static bool ReportsNotImplemented(int noChdir, int noClose) {
     try {
         daemon_nid_postfix(noChdir, noClose);
+
     } catch (const std::runtime_error& error) {
         return std::string(error.what()) == "daemon: forking into the background not implemented";
     }
diff --git a/core/libs/tests/GuestDatagramReceive.cpp b/core/libs/tests/GuestDatagramReceive.cpp
index 2c7bc9e0c5..d11fe04de6 100644
--- a/core/libs/tests/GuestDatagramReceive.cpp
+++ b/core/libs/tests/GuestDatagramReceive.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -8,30 +11,6 @@
 #include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetInit_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-int APS5_VABI sceNetSocketClose(int);
-int* APS5_VABI sceNetErrnoLoc();
-}
-
 static void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "%s\n", message);
@@ -56,6 +35,7 @@ static void Check(bool net, bool from, int family) {
     const auto bind = [&](int descriptor) {
         return net ? sceNetBind_nid_postfix(descriptor, destination.data(), addressSize) :
             bind_nid_postfix(descriptor, destination.data(), addressSize);
+
     };
     const int bound = bind(receiver);
     if (bound < 0 && family == 28 && *error == 49) {
@@ -80,6 +60,7 @@ static void Check(bool net, bool from, int family) {
             sceNetRecv(receiver, buffer, length, flags);
         return from ? recvfrom_nid_postfix(receiver, buffer, length, flags, address, addressLength) :
             recv_nid_postfix(receiver, buffer, length, flags);
+
     };
     const auto send = [&](const char* data, std::size_t length) {
         Require((net ? sceNetSendto(sender, data, length, 0, destination.data(), addressSize) :
@@ -140,6 +121,21 @@ static void Check(bool net, bool from, int family) {
         std::this_thread::sleep_for(std::chrono::milliseconds(1));
     } while (std::chrono::steady_clock::now() < deadline);
     Require(result == 0 && byte == '!', "empty datagram");
+    if (!net) {
+        send("hello", 5);
+        const auto ready = std::chrono::steady_clock::now() + std::chrono::seconds(1);
+        do {
+            result = receive(&byte, 1, 2, nullptr, nullptr);
+            if (result >= 0 || *error != 35) break;
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        } while (std::chrono::steady_clock::now() < ready);
+        Require(result == 1, "wait for the datagram");
+        Require(receive(&byte, 0, 2, nullptr, nullptr) == 0 && receive(&byte, 1, 2, nullptr, nullptr) == 1, "a zero-length peek keeps the datagram");
+        Require(receive(&byte, 0, 0, nullptr, nullptr) == 0, "a zero-length receive returns 0");
+        Require(receive(&byte, 1, 0, nullptr, nullptr) < 0 && *error == 35, "a zero-length receive discards the datagram");
+        Require(fcntl_nid_postfix(receiver, 4, 2) == 0, "make receiver blocking");
+        Require(receive(&byte, 0, 0, nullptr, nullptr) == 0, "a zero-length receive on an empty queue returns 0 without waiting");
+    }
     Require(closeSocket(receiver) == 0, "close receiver");
     Require(closeSocket(sender) == 0, "close sender");
 }
diff --git a/core/libs/tests/GuestDeferredModule.cpp b/core/libs/tests/GuestDeferredModule.cpp
index 719a68829f..f9e3089049 100644
--- a/core/libs/tests/GuestDeferredModule.cpp
+++ b/core/libs/tests/GuestDeferredModule.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #define WIN32_LEAN_AND_MEAN
 #include "GuestDeferredModule.hpp"
 #include <chrono>
@@ -6,15 +7,6 @@
 #include <filesystem>
 #include <future>
 
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-char* APS5_VABI dlerror_nid_postfix();
-int APS5_VABI sceKernelLoadStartModule(const char*, std::size_t, const void*, unsigned, const void*, int*);
-int APS5_VABI sceKernelStopUnloadModule(int, std::size_t, const void*, unsigned, const void*, int*);
-}
-
 static void Require(bool value, const char* what) {
     if (!value) {
         std::fprintf(stderr, "%s\n", what);
diff --git a/core/libs/tests/GuestDemangle.cpp b/core/libs/tests/GuestDemangle.cpp
index ea2f1100cf..b3bc34a66d 100644
--- a/core/libs/tests/GuestDemangle.cpp
+++ b/core/libs/tests/GuestDemangle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -9,12 +10,6 @@
 #include <new>
 #include <stdexcept>
 
-extern "C" {
-char* APS5_VABI __cxa_demangle_nid_postfix(const char*, char*, std::size_t*, int*);
-void* APS5_VABI malloc_nid_postfix(std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-}
-
 namespace {
 
 constexpr char MangledName[] = "_ZN3foo3barEi";
@@ -159,12 +154,13 @@ void RegisterAllocator() {
 void ReleaseIfReturned(void* result, void* original = nullptr) {
     ForgetIfMoved(original, result);
     free_nid_postfix(result != nullptr ? result : original);
+
 }
 
 void TestNullOutputBuffer() {
     std::size_t length = 0;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status));
     Check(result != nullptr, "null output buffer did not demangle");
     Check(status == 0, "null output buffer returned the wrong status");
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "null output buffer returned the wrong string");
@@ -174,7 +170,7 @@ void TestNullOutputBuffer() {
 }
 
 void TestOptionalStatus() {
-    char* result = __cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr));
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "optional status output failed");
     Check(result != nullptr && Owns(result), "optional status output was not guest-owned");
     ReleaseIfReturned(result);
@@ -185,7 +181,7 @@ void TestLargeBufferReuse() {
     const std::size_t originalLength = 128;
     std::size_t length = originalLength;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, &status));
     Check(result == buffer, "sufficient guest buffer was not reused");
     Check(status == 0, "sufficient guest buffer returned the wrong status");
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "sufficient guest buffer returned the wrong string");
@@ -198,7 +194,7 @@ void TestSmallBufferGrowth() {
     std::size_t length = 1;
     const std::size_t reallocationsBefore = reallocationCalls;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, &status));
     Check(result != nullptr, "too-small guest buffer did not grow");
     Check(status == 0, "grown guest buffer returned the wrong status");
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "grown guest buffer returned the wrong string");
@@ -210,18 +206,19 @@ void TestSmallBufferGrowth() {
 
 void TestInvalidInputs() {
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix("not_a_mangled_name", nullptr, nullptr, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix("not_a_mangled_name", nullptr, nullptr, &status));
     Check(result == nullptr && status == -2, "invalid mangled name did not return status -2");
     status = 99;
-    result = __cxa_demangle_nid_postfix(nullptr, nullptr, nullptr, &status);
+    result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(nullptr, nullptr, nullptr, &status));
     Check(result == nullptr && status == -3, "null mangled name did not return status -3");
 
     auto* buffer = static_cast<char*>(malloc_nid_postfix(32));
     std::memcpy(buffer, "unchanged", sizeof("unchanged"));
-    result = __cxa_demangle_nid_postfix(MangledName, buffer, nullptr, &status);
+    result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), nullptr, &status));
     Check(result == nullptr && status == -3, "missing length for a supplied buffer did not return status -3");
     Check(std::strcmp(buffer, "unchanged") == 0, "invalid supplied-buffer arguments modified the buffer");
     free_nid_postfix(buffer);
+
 }
 
 void TestAllocationFailure() {
@@ -229,7 +226,7 @@ void TestAllocationFailure() {
     failNextAllocation = true;
     std::size_t length = 0;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status));
     Check(result == nullptr, "guest allocation failure returned a buffer");
     Check(status == -1, "guest allocation failure did not return status -1");
     Check(allocationFailures == failuresBefore + 1, "demangler bypassed failed guest allocation");
@@ -243,7 +240,7 @@ void TestReallocationFailure() {
     const std::size_t failuresBefore = reallocationFailures;
     failNextReallocation = true;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, &status));
     Check(result == nullptr, "guest reallocation failure returned a buffer");
     Check(status == -1, "guest reallocation failure did not return status -1");
     Check(reallocationFailures == failuresBefore + 1, "demangler bypassed failed guest reallocation");
@@ -257,7 +254,7 @@ void TestAllocatorDiagnostics() {
     bool allocationDiagnostic = false;
     char* result = nullptr;
     try {
-        result = __cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr);
+        result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr));
     } catch (const std::runtime_error& error) {
         allocationDiagnostic = std::strcmp(error.what(), "guest allocator callback failure") == 0;
     }
@@ -271,7 +268,7 @@ void TestAllocatorDiagnostics() {
     bool reallocationDiagnostic = false;
     result = nullptr;
     try {
-        result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, nullptr);
+        result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, nullptr));
     } catch (const std::runtime_error& error) {
         reallocationDiagnostic = std::strcmp(error.what(), "guest reallocator callback failure") == 0;
     }
diff --git a/core/libs/tests/GuestDinkumwareAtomics.cpp b/core/libs/tests/GuestDinkumwareAtomics.cpp
index 8e45d76902..782953cae3 100644
--- a/core/libs/tests/GuestDinkumwareAtomics.cpp
+++ b/core/libs/tests/GuestDinkumwareAtomics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,39 +6,58 @@
 #include <cstring>
 #include <thread>
 
-extern "C" {
-void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
-void APS5_VABI _Atomic_store_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-std::uint16_t APS5_VABI _Atomic_load_2_nid_postfix(volatile std::uint16_t*, int);
-std::uint64_t APS5_VABI _Atomic_load_8_nid_postfix(volatile std::uint64_t*, int);
-std::uint32_t APS5_VABI _Atomic_exchange_4_nid_postfix(volatile std::uint32_t*, std::uint32_t, int);
-std::uint64_t APS5_VABI _Atomic_exchange_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-int APS5_VABI _Atomic_compare_exchange_strong_2_nid_postfix(volatile std::uint16_t*, std::uint16_t*, std::uint16_t, int, int);
-int APS5_VABI _Atomic_compare_exchange_weak_8_nid_postfix(volatile std::uint64_t*, std::uint64_t*, std::uint64_t, int, int);
-std::uint8_t APS5_VABI _Atomic_fetch_add_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
-std::uint64_t APS5_VABI _Atomic_fetch_add_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-std::uint16_t APS5_VABI _Atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
-std::uint32_t APS5_VABI _Atomic_fetch_and_4_nid_postfix(volatile std::uint32_t*, std::uint32_t, int);
-std::uint8_t APS5_VABI _Atomic_fetch_or_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
-std::uint64_t APS5_VABI _Atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-int APS5_VABI _Atomic_is_lock_free_4_nid_postfix();
-int APS5_VABI _Atomic_flag_test_and_set_nid_postfix(volatile unsigned char*, int);
-void APS5_VABI _Atomic_flag_clear_nid_postfix(volatile unsigned char*, int);
-void APS5_VABI _Atomic_thread_fence_nid_postfix(int);
-void APS5_VABI _Atomic_signal_fence_nid_postfix(int);
-void APS5_VABI _Atomic_copy_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, const volatile void*, int);
-void APS5_VABI _Atomic_exchange_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, volatile void*, int);
-int APS5_VABI _Atomic_compare_exchange_strong_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, void*, const void*, int, int);
-int APS5_VABI _Atomic_compare_exchange_weak_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, void*, const void*, int, int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int Relaxed = 0, Acquire = 2, Release = 3, AcqRel = 4, SeqCst = 5;
 
+static void CheckRemainingTyped() {
+    std::uint8_t byte = 0;
+    Require(_Atomic_load_1_nid_postfix(&byte, SeqCst) == 0);
+    Require(_Atomic_exchange_1_nid_postfix(&byte, 0xa5, SeqCst) == 0 && byte == 0xa5);
+    std::uint8_t expectedByte = 0;
+    Require(_Atomic_compare_exchange_strong_1_nid_postfix(&byte, &expectedByte, 1, SeqCst, SeqCst) == 0 && expectedByte == 0xa5 && byte == 0xa5);
+    Require(_Atomic_compare_exchange_strong_1_nid_postfix(&byte, &expectedByte, 0x3c, SeqCst, SeqCst) == 1 && byte == 0x3c);
+    expectedByte = 0;
+    Require(_Atomic_compare_exchange_weak_1_nid_postfix(&byte, &expectedByte, 1, SeqCst, Relaxed) == 0 && expectedByte == 0x3c);
+    Require(_Atomic_compare_exchange_weak_1_nid_postfix(&byte, &expectedByte, 0x0f, SeqCst, Relaxed) == 1 && byte == 0x0f);
+    Require(_Atomic_fetch_sub_1_nid_postfix(&byte, 0x10, SeqCst) == 0x0f && byte == 0xff);
+    Require(_Atomic_fetch_and_1_nid_postfix(&byte, 0x3c, Relaxed) == 0xff && byte == 0x3c);
+    Require(_Atomic_fetch_xor_1_nid_postfix(&byte, 0xff, AcqRel) == 0x3c && byte == 0xc3);
+
+    std::uint16_t half = 0;
+    _Atomic_store_2_nid_postfix(&half, 0x1234, Release);
+    Require(half == 0x1234 && _Atomic_exchange_2_nid_postfix(&half, 0xfff0, SeqCst) == 0x1234 && half == 0xfff0);
+    Require(_Atomic_fetch_add_2_nid_postfix(&half, 0x20, SeqCst) == 0xfff0 && half == 0x0010);
+    Require(_Atomic_fetch_and_2_nid_postfix(&half, 0x0018, SeqCst) == 0x0010 && half == 0x0010);
+    Require(_Atomic_fetch_or_2_nid_postfix(&half, 0x0101, SeqCst) == 0x0010 && half == 0x0111);
+    Require(_Atomic_fetch_xor_2_nid_postfix(&half, 0x0110, SeqCst) == 0x0111 && half == 0x0001);
+    std::uint16_t expectedHalf = 2;
+    Require(_Atomic_compare_exchange_weak_2_nid_postfix(&half, &expectedHalf, 9, SeqCst, Relaxed) == 0 && expectedHalf == 1);
+    Require(_Atomic_compare_exchange_weak_2_nid_postfix(&half, &expectedHalf, 9, SeqCst, Relaxed) == 1 && half == 9);
+
+    std::uint32_t word = 0;
+    _Atomic_store_4_nid_postfix(&word, 0x00ff00ffu, SeqCst);
+    Require(word == 0x00ff00ffu && _Atomic_fetch_or_4_nid_postfix(&word, 0xff000000u, SeqCst) == 0x00ff00ffu && word == 0xffff00ffu);
+    Require(_Atomic_fetch_xor_4_nid_postfix(&word, 0xffffffffu, SeqCst) == 0xffff00ffu && word == 0x0000ff00u);
+    std::uint32_t expectedWord = 0;
+    Require(_Atomic_compare_exchange_strong_4_nid_postfix(&word, &expectedWord, 1, SeqCst, SeqCst) == 0 && expectedWord == 0x0000ff00u);
+    Require(_Atomic_compare_exchange_strong_4_nid_postfix(&word, &expectedWord, 1, SeqCst, SeqCst) == 1 && word == 1);
+
+    std::uint64_t wide = 0x8000000000000001ull;
+    Require(_Atomic_fetch_sub_8_nid_postfix(&wide, 2, SeqCst) == 0x8000000000000001ull && wide == 0x7fffffffffffffffull);
+    Require(_Atomic_fetch_and_8_nid_postfix(&wide, 0xffffffff00000000ull, SeqCst) == 0x7fffffffffffffffull && wide == 0x7fffffff00000000ull);
+    Require(_Atomic_fetch_or_8_nid_postfix(&wide, 0xffull, SeqCst) == 0x7fffffff00000000ull && wide == 0x7fffffff000000ffull);
+    std::uint64_t expectedWide = 0;
+    Require(_Atomic_compare_exchange_strong_8_nid_postfix(&wide, &expectedWide, 5, SeqCst, SeqCst) == 0 && expectedWide == 0x7fffffff000000ffull);
+    Require(_Atomic_compare_exchange_strong_8_nid_postfix(&wide, &expectedWide, 5, SeqCst, SeqCst) == 1 && wide == 5);
+
+    Require(_Atomic_is_lock_free_1_nid_postfix() == 1 && _Atomic_is_lock_free_2_nid_postfix() == 1 && _Atomic_is_lock_free_8_nid_postfix() == 1);
+}
+
 static void CheckTyped() {
     std::uint8_t byte = 0;
     _Atomic_store_1_nid_postfix(&byte, 7, SeqCst);
+
     Require(byte == 7 && _Atomic_fetch_add_1_nid_postfix(&byte, 250, Relaxed) == 7 && byte == 1);
     Require(_Atomic_fetch_or_1_nid_postfix(&byte, 0x80, AcqRel) == 1 && byte == 0x81);
     std::uint16_t half = 5;
@@ -50,6 +70,7 @@ static void CheckTyped() {
     Require(_Atomic_exchange_4_nid_postfix(&word, 9, 6) == 0xf00f && word == 9);
     std::uint64_t wide = 0;
     _Atomic_store_8_nid_postfix(&wide, 0x123456789ull, Release);
+
     Require(_Atomic_load_8_nid_postfix(&wide, Acquire) == 0x123456789ull);
     Require(_Atomic_load_8_nid_postfix(&wide, Release) == 0 && _Atomic_load_8_nid_postfix(&wide, AcqRel) == 0);
     Require(_Atomic_fetch_add_8_nid_postfix(&wide, 1, SeqCst) == 0x123456789ull && wide == 0x12345678aull);
@@ -66,9 +87,11 @@ static void CheckFlagsAndFences() {
     Require(_Atomic_flag_test_and_set_nid_postfix(&flag, SeqCst) == 0 && flag == 1);
     Require(_Atomic_flag_test_and_set_nid_postfix(&flag, Relaxed) == 1);
     _Atomic_flag_clear_nid_postfix(&flag, Release);
+
     Require(flag == 0);
     _Atomic_thread_fence_nid_postfix(SeqCst);
     _Atomic_signal_fence_nid_postfix(SeqCst);
+
 }
 
 struct Wide {
@@ -79,9 +102,11 @@ static void CheckGeneric() {
     unsigned char lock = 0;
     Wide target{{1, 2, 3}}, source{{4, 5, 6}}, expected{{1, 2, 3}};
     _Atomic_copy_nid_postfix(&lock, sizeof(Wide), &target, &source, SeqCst);
+
     Require(std::memcmp(&target, &source, sizeof(Wide)) == 0 && lock == 0);
     Wide other{{7, 8, 9}};
     _Atomic_exchange_nid_postfix(&lock, sizeof(Wide), &target, &other, SeqCst);
+
     Require(target.parts[0] == 7 && other.parts[0] == 4 && lock == 0);
     const Wide desired{{10, 11, 12}};
     Require(_Atomic_compare_exchange_strong_nid_postfix(&lock, sizeof(Wide), &target, &expected, &desired, SeqCst, SeqCst) == 0);
@@ -98,6 +123,7 @@ static void CheckConcurrentGeneric() {
         for (int i = 0; i < Iterations; ++i) {
             Wide expected;
             _Atomic_copy_nid_postfix(&lock, sizeof(Wide), &expected, &counter, SeqCst);
+
             Wide next;
             do {
                 next = Wide{{expected.parts[0] + 1, expected.parts[1] + 2, expected.parts[2] + 3}};
@@ -111,8 +137,46 @@ static void CheckConcurrentGeneric() {
     Require(counter.parts[0] == 2 * Iterations && counter.parts[1] == 4 * Iterations && counter.parts[2] == 6 * Iterations);
 }
 
+static void CheckSized() {
+    std::uint8_t byte = 0xa5;
+    Require(__atomic_load_1_nid_postfix(&byte, Acquire) == 0xa5);
+    std::uint16_t half = 0;
+    __atomic_store_2_nid_postfix(&half, 0x1234, Release);
+    Require(half == 0x1234);
+    Require(__atomic_fetch_add_2_nid_postfix(&half, 0xffff, Relaxed) == 0x1234 && half == 0x1233);
+    Require(__atomic_fetch_or_2_nid_postfix(&half, 0x8000, SeqCst) == 0x1233 && half == 0x9233);
+    std::uint32_t word = 5;
+    Require(__atomic_exchange_4_nid_postfix(&word, 9, AcqRel) == 5 && word == 9);
+    Require(__atomic_fetch_sub_4_nid_postfix(&word, 10, SeqCst) == 9 && word == 0xffffffffu);
+    Require(__atomic_fetch_and_1_nid_postfix(&byte, 0x0f, SeqCst) == 0xa5 && byte == 0x05);
+    std::uint8_t expectedByte = 4;
+    Require(__atomic_compare_exchange_1_nid_postfix(&byte, &expectedByte, 7, SeqCst, Relaxed) == 0 && expectedByte == 5 && byte == 5);
+    Require(__atomic_compare_exchange_1_nid_postfix(&byte, &expectedByte, 7, SeqCst, Relaxed) == 1 && expectedByte == 5 && byte == 7);
+    std::uint64_t wide = 0;
+    __atomic_store_8_nid_postfix(&wide, 0x0123456789abcdefull, SeqCst);
+    Require(__atomic_load_8_nid_postfix(&wide, SeqCst) == 0x0123456789abcdefull);
+    Require(__atomic_fetch_xor_8_nid_postfix(&wide, 0xffffffff00000000ull, SeqCst) == 0x0123456789abcdefull && wide == 0xfedcba9889abcdefull);
+    std::uint64_t expectedWide = 0xfedcba9889abcdefull;
+    Require(__atomic_compare_exchange_8_nid_postfix(&wide, &expectedWide, 1, SeqCst, SeqCst) == 1 && wide == 1);
+    Require(__atomic_exchange_8_nid_postfix(&wide, 2, 6) == 1 && wide == 2);
+    Require(__atomic_load_8_nid_postfix(&wide, Release) == 2 && __atomic_load_8_nid_postfix(&wide, AcqRel) == 2 && __atomic_load_8_nid_postfix(&wide, -1) == 2);
+    Require(__atomic_fetch_add_8_nid_postfix(&wide, 1, 7) == 2 && wide == 3);
+
+    std::uint64_t counter = 0;
+    std::thread threads[4];
+    for (auto& thread : threads) {
+        thread = std::thread([&counter] {
+            for (int i = 0; i < 100000; ++i) __atomic_fetch_add_8_nid_postfix(&counter, 1, Relaxed);
+        });
+    }
+    for (auto& thread : threads) thread.join();
+    Require(counter == 400000);
+}
+
 int main() {
+    CheckRemainingTyped();
     CheckTyped();
+    CheckSized();
     CheckFlagsAndFences();
     CheckGeneric();
     CheckConcurrentGeneric();
diff --git a/core/libs/tests/GuestDinkumwareFetch.cpp b/core/libs/tests/GuestDinkumwareFetch.cpp
new file mode 100644
index 0000000000..81a8d10c1b
--- /dev/null
+++ b/core/libs/tests/GuestDinkumwareFetch.cpp
@@ -0,0 +1,133 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <nid/NidCompute.hpp>
+#include <array>
+#include <barrier>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <limits>
+#include <string>
+#include <thread>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
+
+static void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::exit(1);
+}
+
+template<typename TValue>
+using Fetch = TValue (APS5_VABI*)(volatile TValue*, TValue);
+
+template<typename TValue>
+static TValue Expected(TValue before, TValue operand, const std::string& operation) {
+    if (operation == "and") return before & operand;
+    if (operation == "or") return before | operand;
+    return before ^ operand;
+}
+
+template<typename TValue>
+static void Check(Fetch<TValue> fetch, const std::string& operation) {
+    constexpr TValue maximum = std::numeric_limits<TValue>::max();
+    std::array<TValue, 3> guarded{maximum, 0, maximum};
+    const auto one = [&](TValue before, TValue operand) {
+        guarded[1] = before;
+        Require(fetch(&guarded[1], operand) == before, "fetch must return the original value");
+        Require(guarded[1] == Expected(before, operand, operation), "bitwise result");
+        Require(guarded[0] == maximum && guarded[2] == maximum, "neighboring storage changed");
+    };
+    if constexpr (sizeof(TValue) == 1) {
+        for (unsigned before = 0; before < 256; ++before)
+            for (unsigned operand = 0; operand < 256; ++operand)
+                one(static_cast<TValue>(before), static_cast<TValue>(operand));
+    } else {
+        constexpr std::array<TValue, 6> values{0, 1, maximum, static_cast<TValue>(maximum >> 1), static_cast<TValue>(TValue{1} << (sizeof(TValue) * 8 - 1)), static_cast<TValue>(0xA55AA55A)};
+        for (TValue before : values) for (TValue operand : values) one(before, operand);
+        std::uint32_t random = 0x31415926;
+        for (unsigned i = 0; i < 4096; ++i) {
+            random = random * 1664525u + 1013904223u;
+            const TValue before = static_cast<TValue>(random);
+            random = random * 1664525u + 1013904223u;
+            one(before, static_cast<TValue>(random));
+        }
+    }
+    guarded[1] = operation == "and" ? maximum : 0;
+    std::array<std::thread, 4> workers;
+    std::barrier start(4);
+    for (unsigned index = 0; index < workers.size(); ++index) {
+        workers[index] = std::thread([&, index] {
+            const TValue bit = static_cast<TValue>(TValue{1} << index);
+            const TValue operand = operation == "and" ? static_cast<TValue>(~bit) : bit;
+            start.arrive_and_wait();
+            for (unsigned iteration = 0; iteration < 1025; ++iteration) {
+                const TValue previous = fetch(&guarded[1], operand);
+                const bool expected = operation == "and" ? iteration == 0 : operation == "or" ? iteration != 0 : iteration % 2 != 0;
+                Require(((previous & bit) != 0) == expected, "concurrent original-bit history");
+            }
+        });
+    }
+    for (auto& worker : workers) worker.join();
+    Require(guarded[1] == (operation == "and" ? static_cast<TValue>(maximum & ~TValue{15}) : TValue{15}), "concurrent updates lost");
+    Require(guarded[0] == maximum && guarded[2] == maximum, "concurrent neighboring storage changed");
+    std::array<TValue, 2> flags{};
+    std::array<TValue, 2> observed{};
+    std::barrier phase(3);
+    const auto litmus = [&](unsigned index) {
+        for (unsigned i = 0; i < 512; ++i) {
+            phase.arrive_and_wait();
+            fetch(&flags[index], operation == "and" ? TValue{0} : TValue{1});
+            observed[index] = fetch(&flags[1 - index], operation == "and" ? maximum : TValue{0});
+            phase.arrive_and_wait();
+        }
+    };
+    std::thread first(litmus, 0), second(litmus, 1);
+    for (unsigned i = 0; i < 512; ++i) {
+        flags.fill(operation == "and" ? maximum : TValue{0});
+        phase.arrive_and_wait();
+        phase.arrive_and_wait();
+        const TValue initial = operation == "and" ? maximum : TValue{0};
+        Require(observed[0] != initial || observed[1] != initial, "forbidden sequentially consistent outcome");
+    }
+    first.join();
+    second.join();
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 5, "library directory, patched or unpatched, operation, width");
+    const auto path = std::filesystem::absolute(argv[1]) / "libc.prx";
+    const std::string operation = argv[3];
+    const int width = std::atoi(argv[4]);
+    Require(operation == "and" || operation == "or" || operation == "xor", "operation");
+    Require(width == 1 || width == 2 || width == 4, "width");
+    const std::string name = "_Fetch_" + operation + "_seq_cst_" + std::to_string(width);
+    const std::string symbol = std::string(argv[2]) == "patched" ? Nid::ComputeNid(name, "") : name + "_nid_postfix";
+#ifdef _WIN32
+    SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX);
+    const auto startup = GetModuleHandleW(L"libc.prx");
+    const auto library = LoadLibraryExW(path.c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
+    Require(library != nullptr, "load libc");
+    std::array<wchar_t, 32768> loaded{};
+    const auto length = GetModuleFileNameW(library, loaded.data(), static_cast<DWORD>(loaded.size()));
+    Require(length != 0 && length < loaded.size(), "loaded libc path");
+    Require(std::filesystem::equivalent(path, std::filesystem::path(loaded.data())), "wrong libc loaded");
+    if (startup) Require(startup == library, "startup libc differs from selected libc");
+    std::printf("Selected libc: %ls (startup module %s)\n", loaded.data(), startup ? "same" : "not imported");
+    const auto function = reinterpret_cast<void*>(GetProcAddress(library, symbol.c_str()));
+#else
+    const auto library = dlopen(path.c_str(), RTLD_NOW | RTLD_LOCAL);
+    if (!library) std::fprintf(stderr, "%s\n", dlerror());
+    Require(library != nullptr, "load libc");
+    const auto function = dlsym(library, symbol.c_str());
+#endif
+    if (!function) std::fprintf(stderr, "Missing %s (%s)\n", name.c_str(), symbol.c_str());
+    Require(function != nullptr, "cannot exercise missing helper");
+    if (width == 1) Check(reinterpret_cast<Fetch<std::uint8_t>>(function), operation);
+    if (width == 2) Check(reinterpret_cast<Fetch<std::uint16_t>>(function), operation);
+    if (width == 4) Check(reinterpret_cast<Fetch<std::uint32_t>>(function), operation);
+    std::printf("%s: value, original result, bounds, concurrency and ordering checks passed\n", name.c_str());
+}
diff --git a/core/libs/tests/GuestDinkumwareInternals.cpp b/core/libs/tests/GuestDinkumwareInternals.cpp
index aa660dabdf..c1be3d457e 100644
--- a/core/libs/tests/GuestDinkumwareInternals.cpp
+++ b/core/libs/tests/GuestDinkumwareInternals.cpp
@@ -1,24 +1,25 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <cerrno>
+#include <cfenv>
 #include <cmath>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
-
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-double APS5_VABI _Stod_nid_postfix(const char* text, char** end, std::int64_t pten);
-long long APS5_VABI _Stoll_nid_postfix(const char* text, char** end, int base);
-double APS5_VABI _Sin_nid_postfix(double x, unsigned int quadrant);
-float APS5_VABI _FSin_nid_postfix(float x, unsigned int quadrant);
-long double APS5_VABI _LSin_nid_postfix(long double x, unsigned int quadrant);
-double APS5_VABI _Log_nid_postfix(double x, int base);
-float APS5_VABI _FLog_nid_postfix(float x, int base);
-}
+#include <initializer_list>
+#include <limits>
 
 namespace {
 
 constexpr int RangeError = 34;
+constexpr int InvalidArgument = 22;
+constexpr short Denormal = -2;
+constexpr short Finite = -1;
+constexpr short Zero = 0;
+constexpr short Infinite = 1;
+constexpr short NotANumber = 2;
+constexpr int FloatingExceptions = FE_INVALID | FE_DIVBYZERO | FE_OVERFLOW | FE_UNDERFLOW | FE_INEXACT;
 
 void Require(bool condition, const char* message) {
     if (!condition) {
@@ -35,6 +36,24 @@ void CheckStod(const char* text, std::int64_t pten, double expected, long consum
     Require(same && end - text == consumed && *__error_nid_postfix() == error, message);
 }
 
+void CheckExp(double x, double y, short offset, double expected, short expectedKind, int expectedErrno, int expectedFlags, const char* message) {
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    double result = x;
+    const short kind = _Exp_nid_postfix(&result, y, offset);
+    const bool same = std::isnan(expected) ? std::isnan(result) : result == expected && std::signbit(result) == std::signbit(expected);
+    Require(kind == expectedKind && same && errno == expectedErrno && (std::fetestexcept(FE_ALL_EXCEPT) & FloatingExceptions) == expectedFlags, message);
+}
+
+void CheckFExp(float x, float y, short offset, float expected, short expectedKind, int expectedErrno, int expectedFlags, const char* message) {
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    float result = x;
+    const short kind = _FExp_nid_postfix(&result, y, offset);
+    const bool same = std::isnan(expected) ? std::isnan(result) : result == expected && std::signbit(result) == std::signbit(expected);
+    Require(kind == expectedKind && same && errno == expectedErrno && (std::fetestexcept(FE_ALL_EXCEPT) & FloatingExceptions) == expectedFlags, message);
+}
+
 void TestStod() {
     CheckStod("1.5", 0, 1.5, 3, 0, "unscaled decimal");
     CheckStod("1.5", 1, 15.0, 3, 0, "decimal scaled up");
@@ -71,6 +90,301 @@ void TestStoll() {
     Require(_Stoll_nid_postfix("9223372036854775808", &end, 10) == 9223372036854775807ll && *__error_nid_postfix() == RangeError, "_Stoll saturates");
 }
 
+void TestArithmetic() {
+    Require(_Divide_nid_postfix(3.0, 2.0) == 1.5, "_Divide quotient");
+    Require(std::isinf(_Divide_nid_postfix(1.0, 0.0)) && !std::signbit(_Divide_nid_postfix(1.0, 0.0)), "_Divide positive infinity");
+    Require(std::isinf(_Divide_nid_postfix(-1.0, 0.0)) && std::signbit(_Divide_nid_postfix(-1.0, 0.0)), "_Divide negative infinity");
+    Require(std::isnan(_Divide_nid_postfix(0.0, 0.0)), "_Divide invalid");
+    Require(_Divide_nid_postfix(-0.0, 2.0) == 0.0 && std::signbit(_Divide_nid_postfix(-0.0, 2.0)), "_Divide signed zero");
+    Require(_Divide_nid_postfix(1.0, INFINITY) == 0.0 && !std::signbit(_Divide_nid_postfix(1.0, INFINITY)), "_Divide finite by infinity");
+    Require(std::isnan(_Divide_nid_postfix(INFINITY, INFINITY)), "_Divide infinity by infinity");
+    Require(_Recip_nid_postfix(4.0) == 0.25, "_Recip quotient");
+    Require(_Recip_nid_postfix(-4.0) == -0.25, "_Recip negative quotient");
+    Require(std::isinf(_Recip_nid_postfix(-0.0)) && std::signbit(_Recip_nid_postfix(-0.0)), "_Recip signed infinity");
+    Require(_Recip_nid_postfix(INFINITY) == 0.0 && !std::signbit(_Recip_nid_postfix(INFINITY)), "_Recip infinity");
+    Require(std::isnan(_Recip_nid_postfix(NAN)), "_Recip NaN");
+    Require(_FDivide_nid_postfix(3.0f, 2.0f) == 1.5f, "_FDivide quotient");
+    Require(std::isinf(_FDivide_nid_postfix(-1.0f, 0.0f)) && std::signbit(_FDivide_nid_postfix(-1.0f, 0.0f)), "_FDivide negative infinity");
+    Require(std::isnan(_FDivide_nid_postfix(0.0f, 0.0f)), "_FDivide invalid");
+    Require(_FDivide_nid_postfix(-0.0f, 2.0f) == 0.0f && std::signbit(_FDivide_nid_postfix(-0.0f, 2.0f)), "_FDivide signed zero");
+    Require(_FRecip_nid_postfix(4.0f) == 0.25f, "_FRecip quotient");
+    Require(_FRecip_nid_postfix(-4.0f) == -0.25f, "_FRecip negative quotient");
+    Require(std::isinf(_FRecip_nid_postfix(-0.0f)) && std::signbit(_FRecip_nid_postfix(-0.0f)), "_FRecip signed infinity");
+    Require(_FRecip_nid_postfix(INFINITY) == 0.0f && !std::signbit(_FRecip_nid_postfix(INFINITY)), "_FRecip infinity");
+    Require(std::isnan(_FRecip_nid_postfix(NAN)), "_FRecip NaN");
+}
+
+void TestFloatErrors() {
+    char* end = nullptr;
+    int error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("1.5", &end, 2, &error) == 150.0 && error == 0 && *__error_nid_postfix() == 0, "_Stodx in range");
+    error = 99;
+    Require(std::isinf(_Stodx_nid_postfix("1e400", &end, 0, &error)) && error == 1 && *__error_nid_postfix() == RangeError, "_Stodx overflow");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("1e-400", &end, 2, &error) == 0.0 && error == 1 && *__error_nid_postfix() == RangeError, "_Stodx underflow");
+    error = 99;
+    *__error_nid_postfix() = 7;
+    Require(_Stodx_nid_postfix("1e-400", &end, 300, &error) == 1e-100 && error == 0 && *__error_nid_postfix() == 7, "_Stodx rescued by its scale");
+    error = 99;
+    *__error_nid_postfix() = RangeError;
+    Require(_Stodx_nid_postfix("2.5", &end, 1, &error) == 25.0 && error == 0 && *__error_nid_postfix() == RangeError, "_Stodx kept a preset errno");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(std::isinf(_Stofx_nid_postfix("1e39", &end, 0, &error)) && error == 1 && *__error_nid_postfix() == RangeError, "_Stofx overflow");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("2.5e-1", &end, 3, &error) == 250.0f && error == 0 && *__error_nid_postfix() == 0, "_Stofx scaled");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1e39", &end, -1, &error) == 1e38f && error == 0 && *__error_nid_postfix() == 0, "_Stofx overflow scaled back into range");
+    error = 99;
+    Require(_Stodx_nid_postfix("1e400", &end, -100, &error) == 1e300 && error == 0 && *__error_nid_postfix() == 0, "_Stodx overflow scaled back into range");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stoldx_nid_postfix("1e400", &end, 0, &error) == 1e400L && error == 0 && *__error_nid_postfix() == 0, "_Stoldx uses the extended range");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("1e-310", &end, 0, &error) == 1e-310 && error == 0 && *__error_nid_postfix() == 0 && end[0] == '\0', "_Stodx subnormal");
+    error = 99;
+    Require(_Stodx_nid_postfix("1e-300", &end, -10, &error) == 1e-310 && error == 0 && *__error_nid_postfix() == 0, "_Stodx scaled into the subnormal range");
+    error = 99;
+    *__error_nid_postfix() = 7;
+    Require(_Stodx_nid_postfix("1e-310", &end, 0, &error) == 1e-310 && error == 0 && *__error_nid_postfix() == 7, "_Stodx subnormal kept a preset errno");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("2e-324", &end, 0, &error) == 0.0 && error == 1 && *__error_nid_postfix() == RangeError, "_Stodx below the smallest subnormal");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1e-45", &end, 0, &error) == 0x1p-149f && error == 0 && *__error_nid_postfix() == 0 && end[0] == '\0', "_Stofx inexact subnormal");
+    error = 99;
+    Require(_Stofx_nid_postfix("1e-35", &end, -10, &error) == 0x1p-149f && error == 0 && *__error_nid_postfix() == 0, "_Stofx scaled into the subnormal range");
+    error = 99;
+    *__error_nid_postfix() = 7;
+    const float subnormal = _Stofx_nid_postfix("1e-40", &end, 0, &error);
+    Require(subnormal > 0x1p-134f && subnormal < 0x1p-132f && error == 0 && *__error_nid_postfix() == 7, "_Stofx subnormal kept a preset errno");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1e-46", &end, 0, &error) == 0.0f && error == 1 && *__error_nid_postfix() == RangeError, "_Stofx underflow");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1.17549435e-38", &end, 0, &error) == 0x1p-126f && error == 0 && *__error_nid_postfix() == 0, "_Stofx smallest normal");
+    error = 99;
+    Require(_Stoldx_nid_postfix("1e-4940", &end, 0, &error) == 1e-4940L && error == 0 && *__error_nid_postfix() == 0, "_Stoldx subnormal");
+    error = 99;
+    Require(_Stoldx_nid_postfix("1e-4930", &end, -10, &error) == 1e-4940L && error == 0 && *__error_nid_postfix() == 0, "_Stoldx scaled into the subnormal range");
+    error = 99;
+    Require(_Stoldx_nid_postfix("1e-5000", &end, 0, &error) == 0.0L && error == 1 && *__error_nid_postfix() == RangeError, "_Stoldx underflow");
+    Require(_Stof_nid_postfix("1.5", &end, 1) == 15.0f, "_Stof");
+    Require(_Stold_nid_postfix("1.5", &end, -1) == 0.15L, "_Stold");
+    error = 99;
+    Require(std::isnan(_Stodx_nid_postfix("nan", &end, 2, &error)) && error == 0 && end[0] == '\0', "_Stodx NaN");
+}
+
+void TestIntegerErrors() {
+    char* end = nullptr;
+    int error = 99;
+    *__error_nid_postfix() = 5;
+    Require(_Stollx_nid_postfix("123", &end, 0, &error) == 123 && error == 0 && *__error_nid_postfix() == 5, "_Stollx in range");
+    Require(_Stollx_nid_postfix("9223372036854775808", &end, 10, &error) == 9223372036854775807ll && error == RangeError && *__error_nid_postfix() == RangeError, "_Stollx overflow");
+    *__error_nid_postfix() = 5;
+    const char* text = " 12";
+    for (int base : {1, -1, 37}) {
+        error = 99;
+        Require(_Stollx_nid_postfix(text, &end, base, &error) == 0 && error == InvalidArgument && end == text && *__error_nid_postfix() == 5, "_Stollx invalid base");
+        error = 99;
+        Require(_Stolx_nid_postfix(text, &end, base, &error) == 0 && error == InvalidArgument && end == text && *__error_nid_postfix() == 5, "_Stolx invalid base");
+    }
+    Require(_Stoll_nid_postfix(text, &end, 1) == 0 && end == text && *__error_nid_postfix() == 5, "_Stoll invalid base");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stolx_nid_postfix("9223372036854775808", &end, 0, &error) == 9223372036854775807ll && error == RangeError && *__error_nid_postfix() == 0, "_Stolx overflow inside the unsigned range");
+    Require(_Stolx_nid_postfix("-18446744073709551615", &end, 10, &error) == (-9223372036854775807ll - 1) && error == RangeError && *__error_nid_postfix() == 0, "_Stolx negative overflow inside the unsigned range");
+    Require(_Stolx_nid_postfix("18446744073709551616", &end, 10, &error) == 9223372036854775807ll && error == RangeError && *__error_nid_postfix() == RangeError, "_Stolx overflow past the unsigned range");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stoulx_nid_postfix("-1", &end, 0, &error) == 18446744073709551615ull && error == 0, "_Stoulx wraps a negative value");
+    Require(_Stoullx_nid_postfix("-18446744073709551615", &end, 10, &error) == 1 && error == 0 && *__error_nid_postfix() == 0, "_Stoullx wraps a negated maximum");
+    Require(_Stoullx_nid_postfix("18446744073709551616", &end, 10, &error) == 18446744073709551615ull && error == RangeError && *__error_nid_postfix() == RangeError, "_Stoullx overflow");
+}
+
+void TestDoubleHelpers() {
+    const double e = 0x1.5bf0a8b145769p+1;
+    CheckExp(1.0, 1.0, 0, e, Finite, 0, 0, "_Exp e");
+    CheckExp(0.0, 1.0, 0, 1.0, Finite, 0, 0, "_Exp zero exponent");
+    CheckExp(0.0, 5.0, 0, 5.0, Finite, 0, 0, "_Exp multiplier at zero exponent");
+    CheckExp(1.0, -0.0, 0, -0.0, Zero, 0, 0, "_Exp keeps a negative zero multiplier");
+    CheckExp(1.0, 0.0, 0, 0.0, Zero, 0, 0, "_Exp zero multiplier");
+    CheckExp(-1.0, -0.0, 0, -0.0, Zero, 0, 0, "_Exp negative zero multiplier");
+    CheckExp(INFINITY, -0.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp positive infinity with zero multiplier is invalid");
+    CheckExp(INFINITY, 0.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp positive infinity with positive zero is invalid");
+    CheckExp(INFINITY, 1.0, 0, INFINITY, Infinite, 0, 0, "_Exp positive infinity");
+    CheckExp(INFINITY, -1.0, 0, -INFINITY, Infinite, 0, 0, "_Exp positive infinity preserves the multiplier sign");
+    CheckExp(INFINITY, INFINITY, 0, INFINITY, Infinite, 0, 0, "_Exp positive infinity with infinite multiplier");
+    CheckExp(INFINITY, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_Exp positive infinity with negative infinite multiplier");
+    CheckExp(-INFINITY, 1.0, 0, 0.0, Zero, 0, 0, "_Exp negative infinity");
+    CheckExp(-INFINITY, -1.0, 0, -0.0, Zero, 0, 0, "_Exp negative infinity preserves the multiplier sign");
+    CheckExp(-INFINITY, 0.0, 0, 0.0, Zero, 0, 0, "_Exp negative infinity with positive zero");
+    CheckExp(-INFINITY, -0.0, 0, -0.0, Zero, 0, 0, "_Exp negative infinity with negative zero");
+    CheckExp(-INFINITY, INFINITY, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp negative infinity with infinite multiplier is invalid");
+    CheckExp(-INFINITY, -INFINITY, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp negative infinity with negative infinite multiplier is invalid");
+    CheckExp(0.0, INFINITY, 0, INFINITY, Infinite, 0, 0, "_Exp zero exponent with infinite multiplier");
+    CheckExp(0.0, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_Exp zero exponent with negative infinite multiplier");
+    CheckExp(1.0, INFINITY, 0, INFINITY, Infinite, 0, 0, "_Exp finite exponent with infinite multiplier");
+    CheckExp(1.0, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_Exp finite exponent with negative infinite multiplier");
+    CheckExp(1.0, std::numeric_limits<double>::quiet_NaN(), 0, 1.0, NotANumber, 0, 0, "_Exp NaN multiplier leaves the exponent");
+    CheckExp(INFINITY, std::numeric_limits<double>::quiet_NaN(), 0, INFINITY, NotANumber, 0, 0, "_Exp NaN multiplier leaves an infinite exponent");
+    CheckExp(std::numeric_limits<double>::quiet_NaN(), 0.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, 0, 0, "_Exp NaN exponent with zero multiplier");
+    CheckExp(std::numeric_limits<double>::quiet_NaN(), 1.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, 0, 0, "_Exp NaN exponent");
+    CheckExp(std::numeric_limits<double>::quiet_NaN(), INFINITY, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, 0, 0, "_Exp NaN exponent with infinite multiplier");
+    CheckExp(1843.0, 1.0, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp positive cutoff");
+    CheckExp(1843.0, -1.0, 0, -INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp positive cutoff preserves the multiplier sign");
+    CheckExp(1843.0, 1.0, -2660, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp positive cutoff ignores a compensating offset");
+    CheckExp(-1843.0, 1.0, 0, 0.0, Zero, 0, 0, "_Exp negative cutoff");
+    CheckExp(-1843.0, -1.0, 0, -0.0, Zero, 0, 0, "_Exp negative cutoff preserves the multiplier sign");
+    CheckExp(-1843.0, 1.0, 2660, 0.0, Zero, 0, 0, "_Exp negative cutoff ignores a compensating offset");
+    CheckExp(1843.0, 0.0, 0, 0.0, Zero, 0, 0, "_Exp positive cutoff with zero multiplier");
+    CheckExp(1843.0, std::numeric_limits<double>::quiet_NaN(), 0, 1843.0, NotANumber, 0, 0, "_Exp positive cutoff with NaN multiplier");
+    CheckExp(0.0, 1.0, -1074, std::numeric_limits<double>::denorm_min(), Finite, 0, 0, "_Exp exact minimum subnormal");
+    CheckExp(0.0, 1.0, -1075, 0.0, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_Exp scaled underflow");
+    CheckExp(0.0, -1.0, -1075, -0.0, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_Exp scaled underflow preserves the multiplier sign");
+    CheckExp(0.0, 1.0, 100, std::scalbn(1.0, 100), Finite, 0, 0, "_Exp scaled finite result");
+    CheckExp(0.0, 1.0, 2000, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp scaled overflow");
+    CheckExp(1842.0, 1.0, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp inside the positive cutoff overflows");
+    CheckExp(-1842.0, 1.0, 0, 0.0, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_Exp inside the negative cutoff underflows");
+
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    double result = 1.0;
+    Require(_Exp_nid_postfix(&result, 3.0, 0) == Finite && std::fabs(result - 3.0 * e) <= 3.0 * e * 1e-14, "_Exp multiplier");
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, -2.0, 0) == Finite && std::fabs(result + 2.0 * e) <= 2.0 * e * 1e-14, "_Exp negative multiplier");
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 10) == Finite && std::fabs(result - e * 1024.0) <= e * 1024.0 * 1e-14, "_Exp scale");
+    for (int i = -200; i <= 200; ++i) {
+        const double x = static_cast<double>(i) / 16.0;
+        result = x;
+        Require(_Exp_nid_postfix(&result, 1.0, 0) == Finite && std::fabs(result - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-13, "_Exp finite sweep");
+    }
+
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::denorm_min(), 0) == Finite && std::fpclassify(result) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp subnormal result classification");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -740.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == Finite && std::fpclassify(result) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp negative exponent subnormal result");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::max(), 0) == Infinite && std::isinf(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_INEXACT)) == (FE_OVERFLOW | FE_INEXACT), "_Exp finite multiplier overflow");
+
+    const double largeExpected = std::scalbn(std::exp(710.0 - 1024.0 * std::log(2.0)) * 1e-100, 1024);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 710.0;
+    Require(_Exp_nid_postfix(&result, 1e-100, 0) == Finite && std::isfinite(result) && std::fabs(result - largeExpected) <= largeExpected * 1e-13 && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_Exp large exponent stays finite");
+    const double smallExpected = std::scalbn(std::exp(-710.0 + 1024.0 * std::log(2.0)) * 1e300, -1024);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -710.0;
+    Require(_Exp_nid_postfix(&result, 1e300, 0) == Finite && std::isfinite(result) && std::fabs(result - smallExpected) <= smallExpected * 1e-13 && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_Exp small exponent stays finite");
+    const double multiplierExpected = std::exp(-0.5) * std::numeric_limits<double>::max();
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -0.5;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::max(), 0) == Finite && std::isfinite(result) && std::fabs(result - multiplierExpected) <= multiplierExpected * 1e-13 && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_Exp large multiplier stays finite");
+
+    const float ef = 0x1.5bf0a8p+1f;
+    CheckFExp(1.0f, 1.0f, 0, ef, Finite, 0, 0, "_FExp e");
+    CheckFExp(0.0f, 1.0f, 0, 1.0f, Finite, 0, 0, "_FExp zero exponent");
+    CheckFExp(0.0f, 5.0f, 0, 5.0f, Finite, 0, 0, "_FExp multiplier at zero exponent");
+    CheckFExp(1.0f, -0.0f, 0, -0.0f, Zero, 0, 0, "_FExp keeps a negative zero multiplier");
+    CheckFExp(1.0f, 0.0f, 0, 0.0f, Zero, 0, 0, "_FExp zero multiplier");
+    CheckFExp(-1.0f, -0.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative zero multiplier");
+    CheckFExp(INFINITY, -0.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp positive infinity with zero multiplier is invalid");
+    CheckFExp(INFINITY, 0.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp positive infinity with positive zero is invalid");
+    CheckFExp(INFINITY, 1.0f, 0, INFINITY, Infinite, 0, 0, "_FExp positive infinity");
+    CheckFExp(INFINITY, -1.0f, 0, -INFINITY, Infinite, 0, 0, "_FExp positive infinity preserves the multiplier sign");
+    CheckFExp(INFINITY, INFINITY, 0, INFINITY, Infinite, 0, 0, "_FExp positive infinity with infinite multiplier");
+    CheckFExp(INFINITY, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_FExp positive infinity with negative infinite multiplier");
+    CheckFExp(-INFINITY, 1.0f, 0, 0.0f, Zero, 0, 0, "_FExp negative infinity");
+    CheckFExp(-INFINITY, -1.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative infinity preserves the multiplier sign");
+    CheckFExp(-INFINITY, 0.0f, 0, 0.0f, Zero, 0, 0, "_FExp negative infinity with positive zero");
+    CheckFExp(-INFINITY, -0.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative infinity with negative zero");
+    CheckFExp(-INFINITY, INFINITY, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp negative infinity with infinite multiplier is invalid");
+    CheckFExp(-INFINITY, -INFINITY, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp negative infinity with negative infinite multiplier is invalid");
+    CheckFExp(0.0f, INFINITY, 0, INFINITY, Infinite, 0, 0, "_FExp zero exponent with infinite multiplier");
+    CheckFExp(0.0f, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_FExp zero exponent with negative infinite multiplier");
+    CheckFExp(1.0f, INFINITY, 0, INFINITY, Infinite, 0, 0, "_FExp finite exponent with infinite multiplier");
+    CheckFExp(1.0f, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_FExp finite exponent with negative infinite multiplier");
+    CheckFExp(1.0f, std::numeric_limits<float>::quiet_NaN(), 0, 1.0f, NotANumber, 0, 0, "_FExp NaN multiplier leaves the exponent");
+    CheckFExp(INFINITY, std::numeric_limits<float>::quiet_NaN(), 0, INFINITY, NotANumber, 0, 0, "_FExp NaN multiplier leaves an infinite exponent");
+    CheckFExp(std::numeric_limits<float>::quiet_NaN(), 0.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, 0, 0, "_FExp NaN exponent with zero multiplier");
+    CheckFExp(std::numeric_limits<float>::quiet_NaN(), 1.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, 0, 0, "_FExp NaN exponent");
+    CheckFExp(std::numeric_limits<float>::quiet_NaN(), INFINITY, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, 0, 0, "_FExp NaN exponent with infinite multiplier");
+    CheckFExp(230.0f, 1.0f, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp positive cutoff");
+    CheckFExp(230.0f, -1.0f, 0, -INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp positive cutoff preserves the multiplier sign");
+    CheckFExp(230.0f, 1.0f, -332, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp positive cutoff ignores the offset");
+    CheckFExp(-230.0f, 1.0f, 0, 0.0f, Zero, 0, 0, "_FExp negative cutoff");
+    CheckFExp(-230.0f, -1.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative cutoff preserves the multiplier sign");
+    CheckFExp(-230.0f, 1.0f, 332, 0.0f, Zero, 0, 0, "_FExp negative cutoff ignores the offset");
+    CheckFExp(230.0f, 0.0f, 0, 0.0f, Zero, 0, 0, "_FExp positive cutoff with zero multiplier");
+    CheckFExp(230.0f, std::numeric_limits<float>::quiet_NaN(), 0, 230.0f, NotANumber, 0, 0, "_FExp positive cutoff with NaN multiplier");
+    CheckFExp(0.0f, 1.0f, -149, std::numeric_limits<float>::denorm_min(), Finite, 0, 0, "_FExp exact minimum subnormal");
+    CheckFExp(0.0f, 1.0f, -150, 0.0f, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_FExp scaled underflow");
+    CheckFExp(0.0f, -1.0f, -150, -0.0f, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_FExp scaled underflow preserves the multiplier sign");
+    CheckFExp(0.0f, 1.0f, 100, std::scalbn(1.0f, 100), Finite, 0, 0, "_FExp scaled finite result");
+    CheckFExp(0.0f, 1.0f, 200, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp scaled overflow");
+    CheckFExp(229.0f, 1.0f, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp inside the positive cutoff overflows");
+    CheckFExp(-229.0f, 1.0f, 0, 0.0f, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_FExp inside the negative cutoff underflows");
+
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    float resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 3.0f, 0) == Finite && std::fabs(resultf - 3.0f * ef) <= 3.0f * ef * 1e-6f, "_FExp multiplier");
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, -2.0f, 0) == Finite && std::fabs(resultf + 2.0f * ef) <= 2.0f * ef * 1e-6f, "_FExp negative multiplier");
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 10) == Finite && std::fabs(resultf - ef * 1024.0f) <= ef * 1024.0f * 1e-6f, "_FExp scale");
+    for (int i = -120; i <= 120; ++i) {
+        const float x = static_cast<float>(i) / 16.0f;
+        resultf = x;
+        Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == Finite && std::fabs(resultf - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-6f, "_FExp finite sweep");
+    }
+
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::denorm_min(), 0) == Finite && std::fpclassify(resultf) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp subnormal result classification");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -100.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == Finite && std::fpclassify(resultf) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp negative exponent subnormal result");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::max(), 0) == Infinite && std::isinf(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_INEXACT)) == (FE_OVERFLOW | FE_INEXACT), "_FExp finite multiplier overflow");
+
+    const float largeExpectedf = static_cast<float>(std::exp(100.0) * 1e-35);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 100.0f;
+    Require(_FExp_nid_postfix(&resultf, 1e-35f, 0) == Finite && std::isfinite(resultf) && std::fabs(resultf - largeExpectedf) <= largeExpectedf * 1e-6f && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_FExp large exponent stays finite");
+    const float smallExpectedf = static_cast<float>(std::exp(-100.0) * 1e30);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -100.0f;
+    Require(_FExp_nid_postfix(&resultf, 1e30f, 0) == Finite && std::isfinite(resultf) && std::fabs(resultf - smallExpectedf) <= smallExpectedf * 1e-6f && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_FExp small exponent stays finite");
+    const float multiplierExpectedf = static_cast<float>(std::exp(-0.5) * std::numeric_limits<float>::max());
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -0.5f;
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::max(), 0) == Finite && std::isfinite(resultf) && std::fabs(resultf - multiplierExpectedf) <= multiplierExpectedf * 1e-6f && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_FExp large multiplier stays finite");
+}
+
 void TestDispatch() {
     Require(_Sin_nid_postfix(0.5, 0) == std::sin(0.5) && _Sin_nid_postfix(0.5, 1) == std::cos(0.5) && _Sin_nid_postfix(0.5, 7) == std::cos(0.5), "_Sin");
     Require(_FSin_nid_postfix(0.5f, 0) == std::sin(0.5f) && _FSin_nid_postfix(0.5f, 2) == std::cos(0.5f), "_FSin");
@@ -79,10 +393,26 @@ void TestDispatch() {
     Require(_FLog_nid_postfix(8.0f, 0) == std::log(8.0f) && _FLog_nid_postfix(100.0f, 1) == 2.0f && _FLog_nid_postfix(8.0f, -3) == 3.0f, "_FLog");
 }
 
+void TestLongDoubleHelpers() {
+    Require(_LDivide_nid_postfix(3.0L, 2.0L) == 1.5L, "_LDivide quotient");
+    Require(std::isinf(_LDivide_nid_postfix(1.0L, 0.0L)), "_LDivide infinity");
+    Require(std::isnan(_LDivide_nid_postfix(0.0L, 0.0L)), "_LDivide invalid");
+    Require(_LRecip_nid_postfix(4.0L) == 0.25L, "_LRecip quotient");
+    Require(std::isinf(_LRecip_nid_postfix(-0.0L)) && std::signbit(_LRecip_nid_postfix(-0.0L)), "_LRecip signed infinity");
+    Require(_LLog_nid_postfix(8.0L, 0) == std::log(8.0L), "_LLog natural");
+    Require(std::fabs(_LLog_nid_postfix(1000.0L, 1) - 3.0L) <= 1e-17L && std::fabs(_LLog_nid_postfix(1000.0L, 5) - 3.0L) <= 1e-17L, "_LLog base 10");
+    Require(_LLog_nid_postfix(8.0L, -1) == 3.0L && _LLog_nid_postfix(8.0L, -3) == 3.0L, "_LLog base 2");
+}
+
 }
 
 int main() {
     TestStod();
     TestStoll();
+    TestDoubleHelpers();
+    TestFloatErrors();
+    TestIntegerErrors();
+    TestArithmetic();
     TestDispatch();
+    TestLongDoubleHelpers();
 }
diff --git a/core/libs/tests/GuestDirectory.cpp b/core/libs/tests/GuestDirectory.cpp
index 4df4394622..5f6096246e 100644
--- a/core/libs/tests/GuestDirectory.cpp
+++ b/core/libs/tests/GuestDirectory.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
@@ -15,21 +17,12 @@
 #ifdef _WIN32
 #include <windows.h>
 #endif
-extern "C" {
-void* APS5_VABI opendir_nid_postfix(const char*);
-GuestDirectoryEntry* APS5_VABI readdir_nid_postfix(void*);
-int APS5_VABI readdir_r_nid_postfix(void*, GuestDirectoryEntry*, GuestDirectoryEntry**);
-int APS5_VABI closedir_nid_postfix(void*);
-void APS5_VABI rewinddir_nid_postfix(void*);
-std::int64_t APS5_VABI telldir_nid_postfix(void*);
-void APS5_VABI seekdir_nid_postfix(void*, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static std::map<std::string, std::uint32_t> ReadFileNumbers(void* directory) {
     std::map<std::string, std::uint32_t> numbers;
     rewinddir_nid_postfix(directory);
+
     while (auto* entry = readdir_nid_postfix(directory)) {
         Require(entry->fileNumber != 0);
         numbers[entry->name] = entry->fileNumber;
@@ -105,10 +98,12 @@ int main() {
     Require(entries.at("subdirectory") == 4);
     Require(entries.at(".") == 4 && entries.at("..") == 4);
     rewinddir_nid_postfix(directory);
+
     std::size_t count = 0;
     while (readdir_nid_postfix(directory)) ++count;
     Require(count == entries.size());
     rewinddir_nid_postfix(directory);
+
     std::map<std::string, int> copies;
     GuestDirectoryEntry buffer;
     GuestDirectoryEntry* result = nullptr;
@@ -129,6 +124,7 @@ int main() {
     result = &buffer;
     Require(readdir_r_nid_postfix(directory, &buffer, &result) == 0 && result == nullptr);
     rewinddir_nid_postfix(directory);
+
     *__error_nid_postfix() = 13;
     auto* first = readdir_nid_postfix(directory);
     Require(first != nullptr);
@@ -141,6 +137,7 @@ int main() {
     bool nullEntryThrows = false;
     try {
         readdir_r_nid_postfix(directory, nullptr, &result);
+
     } catch (const std::invalid_argument&) {
         nullEntryThrows = true;
     }
@@ -148,11 +145,13 @@ int main() {
     bool nullResultThrows = false;
     try {
         readdir_r_nid_postfix(directory, &buffer, nullptr);
+
     } catch (const std::invalid_argument&) {
         nullResultThrows = true;
     }
     Require(nullResultThrows);
     rewinddir_nid_postfix(directory);
+
     Require(readdir_nid_postfix(directory) != nullptr);
     const std::int64_t second = telldir_nid_postfix(directory);
     Require(second != -1);
@@ -161,6 +160,7 @@ int main() {
     const std::string secondName = entryAfterTell->name;
     while (readdir_nid_postfix(directory)) {}
     seekdir_nid_postfix(directory, second);
+
     auto* entryAfterSeek = readdir_nid_postfix(directory);
     Require(entryAfterSeek != nullptr && secondName == entryAfterSeek->name);
     Require(entryAfterSeek->fileNumber == fileNumbers.at(secondName));
@@ -168,12 +168,25 @@ int main() {
     Require(telldir_nid_postfix(nullptr) == -1 && *__error_nid_postfix() == 9);
     *__error_nid_postfix() = 0;
     seekdir_nid_postfix(nullptr, second);
+
     Require(*__error_nid_postfix() == 9);
     Require(closedir_nid_postfix(directory) == 0);
     Require(opendir_nid_postfix((root / "missing").string().c_str()) == nullptr);
     Require(*__error_nid_postfix() == 2);
-#ifndef _WIN32
     const auto symlinkLoop = root / "symlink-loop";
+#ifdef _WIN32
+    if (links) {
+        Require(CreateSymbolicLinkW(symlinkLoop.c_str(), L"symlink-loop", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        Require(opendir_nid_postfix(symlinkLoop.string().c_str()) == nullptr);
+        Require(*__error_nid_postfix() == 62);
+        Require(DeleteFileW(symlinkLoop.c_str()) != 0);
+        const auto directoryLoop = root / "directory-loop";
+        Require(CreateSymbolicLinkW(directoryLoop.c_str(), L"directory-loop", SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        Require(opendir_nid_postfix(directoryLoop.string().c_str()) == nullptr);
+        Require(*__error_nid_postfix() == 62);
+        Require(RemoveDirectoryW(directoryLoop.c_str()) != 0);
+    }
+#else
     std::filesystem::create_symlink("symlink-loop", symlinkLoop);
     Require(opendir_nid_postfix(symlinkLoop.string().c_str()) == nullptr);
     Require(*__error_nid_postfix() == 62);
diff --git a/core/libs/tests/GuestDirectoryBuffer.cpp b/core/libs/tests/GuestDirectoryBuffer.cpp
index e5d0c6c122..02e2ff0246 100644
--- a/core/libs/tests/GuestDirectoryBuffer.cpp
+++ b/core/libs/tests/GuestDirectoryBuffer.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -13,18 +15,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI sceKernelGetdirentries(int, char*, int, std::int64_t*);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMprotect(void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory buffer check failed at line %d\n", line);
@@ -88,6 +78,7 @@ static void CheckOversizedName() {
     bool threw = false;
     try {
         sceKernelGetdents(directory, buffer.data(), static_cast<int>(buffer.size()));
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -121,7 +112,7 @@ static void CheckReadOnlyDestination() {
         static_cast<std::int64_t*>(mapping)) == SCE_KERNEL_ERROR_EFAULT);
     Require(sceKernelMprotect(mapping, page, 3) == 0);
     Require(sceKernelGetdirentries(directory, buffer.data(), static_cast<int>(buffer.size()), &base) > 0);
-    Require(sceKernelMunmap(mapping, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), page) == 0);
     Require(sceKernelReleaseDirectMemory(physical, page) == 0);
     Require(sceKernelClose(directory) == 0);
     std::filesystem::remove_all(root);
diff --git a/core/libs/tests/GuestDirectoryClose.cpp b/core/libs/tests/GuestDirectoryClose.cpp
index 68d3d60176..5a59797a0e 100644
--- a/core/libs/tests/GuestDirectoryClose.cpp
+++ b/core/libs/tests/GuestDirectoryClose.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 
@@ -10,13 +12,6 @@
 #include <fstream>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI _close_nid_postfix(int);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory close check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestDirectoryEntries.cpp b/core/libs/tests/GuestDirectoryEntries.cpp
index 35bf2413c9..91b41aea16 100644
--- a/core/libs/tests/GuestDirectoryEntries.cpp
+++ b/core/libs/tests/GuestDirectoryEntries.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <array>
@@ -11,20 +14,6 @@
 #include <map>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-int APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI sceKernelGetdirentries(int, char*, int, std::int64_t*);
-int APS5_VABI getdents_nid_postfix(int, char*, int);
-int APS5_VABI getdirentries_nid_postfix(int, char*, int, std::int64_t*);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory entry check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestDirectoryLinkTypes.cpp b/core/libs/tests/GuestDirectoryLinkTypes.cpp
index 344b0c3a1c..fb9b0f0845 100644
--- a/core/libs/tests/GuestDirectoryLinkTypes.cpp
+++ b/core/libs/tests/GuestDirectoryLinkTypes.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <array>
@@ -11,12 +13,6 @@
 #include <map>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory link type check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestDirectoryRewind.cpp b/core/libs/tests/GuestDirectoryRewind.cpp
index 00217b646e..424c5bda23 100644
--- a/core/libs/tests/GuestDirectoryRewind.cpp
+++ b/core/libs/tests/GuestDirectoryRewind.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -14,15 +16,6 @@
 #include <set>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory rewind check failed at line %d\n", line);
@@ -31,7 +24,6 @@ static void Check(bool value, int line) {
 }
 #define Require(value) Check((value), __LINE__)
 
-
 static std::set<std::string> ReadAll(int directory) {
     std::set<std::string> names;
     std::array<char, 4096> buffer{};
diff --git a/core/libs/tests/GuestDiscId.cpp b/core/libs/tests/GuestDiscId.cpp
new file mode 100644
index 0000000000..2b77023662
--- /dev/null
+++ b/core/libs/tests/GuestDiscId.cpp
@@ -0,0 +1,43 @@
+#include "prx/libSceDiscId/include/Api.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+
+namespace {
+
+void Require(bool condition) {
+    if (!condition) std::abort();
+}
+
+template<typename TCall>
+bool Throws(TCall call) {
+    try {
+        static_cast<void>(call());
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
+}
+
+int main() {
+    Require(Throws([] { return sceDiscIdGet(nullptr); }));
+    Require(Throws([] { return sceDiscIdGet2(nullptr, 0); }));
+    Require(Throws([] { return sceDiscIdGet2(nullptr, 0xFFFFFFFFu); }));
+
+    std::uint8_t buffer[64];
+    std::memset(buffer, 0xAB, sizeof(buffer));
+    auto* id = reinterpret_cast<DiscId*>(buffer);
+    auto* id2 = reinterpret_cast<DiscId2*>(buffer);
+
+    Require(Throws([id] { return sceDiscIdGet(id); }));
+    Require(Throws([id2] { return sceDiscIdGet2(id2, 0); }));
+    Require(Throws([id2] { return sceDiscIdGet2(id2, 1); }));
+    Require(Throws([id2] { return sceDiscIdGet2(id2, 3); }));
+    Require(Throws([id2] { return sceDiscIdGet2(id2, 0xFFFFFFFFu); }));
+    for (std::uint8_t byte : buffer) Require(byte == 0xAB);
+
+    return 0;
+}
diff --git a/core/libs/tests/GuestDiscMap.cpp b/core/libs/tests/GuestDiscMap.cpp
index 498dc7c443..7c3811f9a5 100644
--- a/core/libs/tests/GuestDiscMap.cpp
+++ b/core/libs/tests/GuestDiscMap.cpp
@@ -1,14 +1,10 @@
+#include "prx/libSceDiscMap/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-std::int32_t APS5_VABI sceDiscMapIsRequestOnHDD(const char* path, std::int64_t offset, std::int64_t size, std::int32_t* result);
-std::int32_t APS5_VABI sceDiscMapUnknown_ioKMruft1ek(const char* path, std::int64_t offset, std::int64_t size, std::uint64_t* flags, std::uint64_t* out1, std::uint64_t* out2);
-}
-
 namespace {
 
 constexpr std::int32_t noBitmapInfo = static_cast<std::int32_t>(0x81100004);
diff --git a/core/libs/tests/GuestDup.cpp b/core/libs/tests/GuestDup.cpp
index 4e0451ae85..03db1dcba6 100644
--- a/core/libs/tests/GuestDup.cpp
+++ b/core/libs/tests/GuestDup.cpp
@@ -1,25 +1,13 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <climits>
 #include <cstdint>
 #include <initializer_list>
 #include <cstdlib>
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int GuestEbadf = 9;
@@ -104,6 +92,8 @@ static void BadDescriptors() {
 #ifdef _WIN32
     const auto previous = _set_invalid_parameter_handler(RecordInvalidParameter);
 #endif
+    Require(dup2_nid_postfix(pipe[0], closed) == closed);
+    Require(close_nid_postfix(closed) == 0);
     RequireFailure(close_nid_postfix(closed), GuestEbadf);
     RequireFailure(close_nid_postfix(-1), GuestEbadf);
 #ifdef _WIN32
@@ -190,6 +180,7 @@ static void DuplicatesShareStatusFlags() {
     constexpr int SetDescriptorFlags = 2;
     constexpr int GetFlags = 3;
     constexpr int SetFlags = 4;
+    constexpr int ReadWrite = 2;
     constexpr int NonBlocking = 4;
     constexpr int GuestEagain = 35;
     int pipe[2];
@@ -197,18 +188,20 @@ static void DuplicatesShareStatusFlags() {
     Require(pipe_nid_postfix(pipe) == 0);
     Require(pipe_nid_postfix(other) == 0);
     Require(fcntl_nid_postfix(pipe[0], SetDescriptorFlags, 1) == 0);
+    *__error_nid_postfix() = 0;
+    Require(fcntl_nid_postfix(pipe[0], 0, INT_MAX) == -1 && *__error_nid_postfix() == 22);
     const int duplicate = dup_nid_postfix(pipe[0]);
     Require(duplicate >= 0);
     Require(fcntl_nid_postfix(duplicate, GetDescriptorFlags) == 0);
     Require(fcntl_nid_postfix(duplicate, SetFlags, NonBlocking) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == NonBlocking);
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadWrite | NonBlocking));
     Require(dup2_nid_postfix(pipe[0], other[0]) == other[0]);
     Require(fcntl_nid_postfix(other[0], GetDescriptorFlags) == 0);
-    Require(fcntl_nid_postfix(other[0], GetFlags) == NonBlocking);
+    Require(fcntl_nid_postfix(other[0], GetFlags) == (ReadWrite | NonBlocking));
     char buffer[4] = {};
     RequireFailure(static_cast<int>(read_nid_postfix(other[0], buffer, sizeof(buffer))), GuestEagain);
     Require(fcntl_nid_postfix(pipe[0], SetFlags, 0) == 0);
-    Require(fcntl_nid_postfix(duplicate, GetFlags) == 0);
+    Require(fcntl_nid_postfix(duplicate, GetFlags) == ReadWrite);
     Require(fcntl_nid_postfix(pipe[0], GetDescriptorFlags) == 1);
     for (const int descriptor : {pipe[0], pipe[1], other[0], other[1], duplicate}) Require(close_nid_postfix(descriptor) == 0);
 }
diff --git a/core/libs/tests/GuestDynamicCast.cpp b/core/libs/tests/GuestDynamicCast.cpp
index c7892a5e96..5a4212d578 100644
--- a/core/libs/tests/GuestDynamicCast.cpp
+++ b/core/libs/tests/GuestDynamicCast.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -11,8 +12,7 @@ struct Object { const void* vtable; };
 extern "C" {
 extern const unsigned char _ZTVN10__cxxabiv117__class_type_infoE_nid_postfix[];
 extern const unsigned char _ZTVN10__cxxabiv120__si_class_type_infoE_nid_postfix[];
-void* APS5_VABI __dynamic_cast_nid_postfix(const void*, const void*, const void*, std::ptrdiff_t);
-LibcException::Header* APS5_VABI __cxa_init_primary_exception_nid_postfix(void*, std::type_info*, void (*)(void*));
+
 }
 
 namespace {
@@ -32,14 +32,15 @@ const Vtable DerivedVtable{0, &DerivedType, nullptr};
 int main() {
     const Object derived{&DerivedVtable.first};
     const Object base{&BaseVtable.first};
-    Require(__dynamic_cast_nid_postfix(&derived, &BaseType, &DerivedType, 0) == &derived);
-    Require(__dynamic_cast_nid_postfix(&derived, &BaseType, &OtherType, 0) == nullptr);
-    Require(__dynamic_cast_nid_postfix(&base, &BaseType, &DerivedType, 0) == nullptr);
-    Require(__dynamic_cast_nid_postfix(nullptr, &BaseType, &DerivedType, 0) == nullptr);
+    Require(__dynamic_cast_nid_postfix(&derived, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&DerivedType), 0) == &derived);
+    Require(__dynamic_cast_nid_postfix(&derived, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&OtherType), 0) == nullptr);
+    Require(__dynamic_cast_nid_postfix(&base, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&DerivedType), 0) == nullptr);
+    Require(__dynamic_cast_nid_postfix(nullptr, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&DerivedType), 0) == nullptr);
     void* object = __cxa_allocate_exception_nid_postfix(16);
     auto* type = reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(&DerivedType));
     LibcException::Header* header = __cxa_init_primary_exception_nid_postfix(object, type, Destroy);
     Require(header == LibcException::FromObject(object));
     Require(header->type == type && header->destructor == Destroy && header->adjusted == object);
     __cxa_free_exception_nid_postfix(object);
+
 }
diff --git a/core/libs/tests/GuestDynamicLoader.cpp b/core/libs/tests/GuestDynamicLoader.cpp
index 1307264c64..57bea0de5b 100644
--- a/core/libs/tests/GuestDynamicLoader.cpp
+++ b/core/libs/tests/GuestDynamicLoader.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdlib>
@@ -17,17 +18,7 @@
 #include <stdexcept>
 #include <source_location>
 #include <thread>
-extern "C" {
-int APS5_VABI sceKernelDlsym(std::int32_t, const char*, void**);
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-char* APS5_VABI dlerror_nid_postfix();
-int APS5_VABI _sceKernelRtldThreadAtexitIncrement_nid_postfix(const void*);
-int APS5_VABI _sceKernelRtldThreadAtexitDecrement_nid_postfix(const void*);
-int APS5_VABI sceKernelLoadStartModule(const char*, std::size_t, const void*, unsigned, const void*, int*);
-int APS5_VABI sceKernelStopUnloadModule(int, std::size_t, const void*, unsigned, const void*, int*);
-}
+
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "guest_dynamic_loader: failed at %s:%u\n", location.file_name(), location.line());
@@ -115,6 +106,7 @@ static bool CheckGlobalVisibility(const char* path, bool globalFirst) {
             std::fprintf(stderr, "RTLD_GLOBAL lost after closing its handle: global_first=%d scope=%s; surviving handle returns %d\n",
                 globalFirst, scope == nullptr ? "NULL" : "-2", add(20, 22));
             dlerror_nid_postfix();
+
             visible = false;
         }
     }
@@ -146,6 +138,7 @@ int main(int argc, char** argv) {
     Require(reinterpret_cast<MainFunction>(mainSymbol)(6, 7) == 42);
     Require(sceKernelDlsym(0, "anyps5_missing_main_symbol", &mainSymbol) == static_cast<int>(0x80020003u));
     dlerror_nid_postfix();
+
     void* executable = dlopen_nid_postfix(nullptr, 2);
     Require(executable != nullptr && dlclose_nid_postfix(executable) == 0);
 #ifdef _WIN32
@@ -218,6 +211,54 @@ int main(int argc, char** argv) {
     std::error_code notEmpty;
     if (createdLibs) std::filesystem::remove("libs", notEmpty);
 
+    const std::filesystem::path nestedRoot = "anyps5-relinked-prx-dir-for-test";
+    const std::filesystem::path nestedGuest = nestedRoot / "Engine.Render.prx";
+    const std::filesystem::path nestedRelinked = nestedRoot / "prx" / "Engine.Render.prx.guest.prx";
+    std::filesystem::create_directories(nestedRelinked.parent_path());
+    {
+        std::ofstream elf(nestedGuest, std::ios::binary);
+        elf.write("\x7f" "ELF", 4);
+    }
+    std::filesystem::copy_file(argv[1], nestedRelinked, std::filesystem::copy_options::overwrite_existing);
+    void* nested = dlopen_nid_postfix(nestedGuest.string().c_str(), 2);
+    Require(nested != nullptr);
+    add = reinterpret_cast<Add>(dlsym_nid_postfix(nested, "GuestModuleAdd"));
+    Require(add && add(20, 22) == 42);
+    Require(dlclose_nid_postfix(nested) == 0);
+    std::filesystem::remove_all(nestedRoot);
+
+    const std::filesystem::path layeredRoot = "anyps5-relinked-prx-layers-for-test";
+    const std::filesystem::path layeredGuest = layeredRoot / "Engine.Layers.prx";
+    std::filesystem::create_directories(layeredRoot / "prx");
+    {
+        std::ofstream elf(layeredGuest, std::ios::binary);
+        elf.write("" "ELF", 4);
+        std::ofstream broken(layeredRoot / "prx" / "Engine.Layers.prx.guest.prx", std::ios::binary);
+        broken << "not a module";
+    }
+    std::filesystem::copy_file(argv[1], layeredRoot / "ENGINE.LAYERS.PRX.GUEST.PRX", std::filesystem::copy_options::overwrite_existing);
+    void* layered = dlopen_nid_postfix(layeredGuest.string().c_str(), 2);
+    Require(layered != nullptr);
+    add = reinterpret_cast<Add>(dlsym_nid_postfix(layered, "GuestModuleAdd"));
+    Require(add && add(19, 23) == 42);
+    Require(dlclose_nid_postfix(layered) == 0);
+    std::filesystem::remove_all(layeredRoot);
+
+    const std::filesystem::path foldedRoot = "anyps5-relinked-prx-folded-for-test";
+    const std::filesystem::path foldedGuest = foldedRoot / "Engine.Folded.prx";
+    std::filesystem::create_directories(foldedRoot / "prx");
+    {
+        std::ofstream elf(foldedGuest, std::ios::binary);
+        elf.write("" "ELF", 4);
+    }
+    std::filesystem::copy_file(argv[1], foldedRoot / "prx" / "ENGINE.FOLDED.PRX.GUEST.PRX", std::filesystem::copy_options::overwrite_existing);
+    void* folded = dlopen_nid_postfix(foldedGuest.string().c_str(), 2);
+    Require(folded != nullptr);
+    add = reinterpret_cast<Add>(dlsym_nid_postfix(folded, "GuestModuleAdd"));
+    Require(add && add(10, 32) == 42);
+    Require(dlclose_nid_postfix(folded) == 0);
+    std::filesystem::remove_all(foldedRoot);
+
     void* pinned = dlopen_nid_postfix(argv[1], 2);
     add = reinterpret_cast<Add>(dlsym_nid_postfix(pinned, "GuestModuleAdd"));
     Require(add && _sceKernelRtldThreadAtexitIncrement_nid_postfix(reinterpret_cast<const void*>(add)) == 0);
@@ -229,9 +270,11 @@ int main(int argc, char** argv) {
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(add)) == 0);
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
-    Require(ThrowsRuntimeError([] { _sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&Require)); }));
     int local = 0;
-    Require(ThrowsRuntimeError([&] { _sceKernelRtldThreadAtexitIncrement_nid_postfix(&local); }));
+    Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(&local) == -1);
+    Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(nullptr) == -1);
+    Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(&local) == 0);
+    Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(nullptr) == 0);
 #ifndef _WIN32
     Require(dlsym_nid_postfix(nullptr, "malloc") == nullptr);
     Require(dlsym_nid_postfix(nullptr, "dlopen") == nullptr);
diff --git a/core/libs/tests/GuestDynamicLoaderVariants.cpp b/core/libs/tests/GuestDynamicLoaderVariants.cpp
index 5dd0f764b8..adeb771494 100644
--- a/core/libs/tests/GuestDynamicLoaderVariants.cpp
+++ b/core/libs/tests/GuestDynamicLoaderVariants.cpp
@@ -1,12 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <source_location>
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-}
+
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "guest_dynamic_loader_variants: failed at %s:%u\n", location.file_name(), location.line());
diff --git a/core/libs/tests/GuestElfPhdrMatch.cpp b/core/libs/tests/GuestElfPhdrMatch.cpp
index 3e8d585a70..4d0797a548 100644
--- a/core/libs/tests/GuestElfPhdrMatch.cpp
+++ b/core/libs/tests/GuestElfPhdrMatch.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/specifics/linux/ElfTypes.hpp"
 #include "SceTypes.hpp"
@@ -5,10 +6,6 @@
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI __elf_phdr_match_addr_nid_postfix(dl_phdr_info*, void*);
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
diff --git a/core/libs/tests/GuestEntitlements.cpp b/core/libs/tests/GuestEntitlements.cpp
index 868c1f6e7f..6960f9b349 100644
--- a/core/libs/tests/GuestEntitlements.cpp
+++ b/core/libs/tests/GuestEntitlements.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <cstdint>
@@ -11,11 +12,6 @@
 #include <string>
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfo(std::uint32_t, const NpUnifiedEntitlementLabel*, NpEntitlementAccessAddcontEntitlementInfo*);
-int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfoList(std::uint32_t, NpEntitlementAccessAddcontEntitlementInfo*, std::uint32_t, std::uint32_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEntitlements(const std::filesystem::path& file) {
@@ -31,11 +27,22 @@ int main(int argc, char** argv) {
     const auto directory = root / std::filesystem::path(u8"dlc-a\u00e7\u00e3o-\u65e5\u672c");
     const auto file = directory / "anyps5-entitlements.ini";
     if (argc == 2 && std::string_view(argv[1]) == "missing") {
-        SetEntitlements(file);
+        std::uint32_t skuFlag = 0;
+    Require(sceNpEntitlementAccessGetSkuFlag(nullptr) == static_cast<int>(0x80558003));
+    Require(sceNpEntitlementAccessGetSkuFlag(&skuFlag) == 0 && skuFlag == 3);
+    std::uint32_t pftFlag = 1;
+    Require(sceNpEntitlementAccessGetPftFlag(nullptr) == static_cast<int>(0x817D0002));
+    Require(sceNpEntitlementAccessGetPftFlag(&pftFlag) == 0 && pftFlag == 0);
+    std::uint32_t trialFlag = 1;
+    Require(sceNpEntitlementAccessGetGameTrialsFlag(nullptr) == static_cast<int>(0x817D0002));
+    Require(sceNpEntitlementAccessGetGameTrialsFlag(&trialFlag) == 0 && trialFlag == 0);
+    Require(sceNpEntitlementAccessGenerateTransactionId(nullptr) == static_cast<int>(0x80558003));
+    SetEntitlements(file);
         std::uint32_t hits = 0;
         bool rejected = false;
         try {
             sceNpEntitlementAccessGetAddcontEntitlementInfoList(0, nullptr, 0, &hits);
+
         } catch (const std::runtime_error& error) {
             rejected = std::string_view(error.what()).starts_with("NpEntitlementAccess: cannot read ");
         }
diff --git a/core/libs/tests/GuestEnvironment.cpp b/core/libs/tests/GuestEnvironment.cpp
index 46e2b2b11b..aab45e4742 100644
--- a/core/libs/tests/GuestEnvironment.cpp
+++ b/core/libs/tests/GuestEnvironment.cpp
@@ -1,14 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <cstring>
 #include <string>
-extern "C" {
-char* APS5_VABI getenv_nid_postfix(const char*);
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI unsetenv_nid_postfix(const char*);
-int APS5_VABI putenv_nid_postfix(char*);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     const char* key = "ANYPS5_GUEST_ENV_TEST_4C27";
diff --git a/core/libs/tests/GuestEqueueEvents.cpp b/core/libs/tests/GuestEqueueEvents.cpp
index c0858dc39a..1a990f8c23 100644
--- a/core/libs/tests/GuestEqueueEvents.cpp
+++ b/core/libs/tests/GuestEqueueEvents.cpp
@@ -1,42 +1,15 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Equeue/Equeue.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
+#include <initializer_list>
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddUserEvent(KernelEqueue eq, int id);
-int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
-int APS5_VABI sceKernelTriggerUserEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
-int APS5_VABI sceKernelAddAmprEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue eq, int id);
-int APS5_VABI EqueueTriggerEvent_nid_postfix(KernelEqueue eq, uintptr_t ident, int16_t filter, void* triggerData);
-int APS5_VABI sceKernelAddHRTimerEvent(KernelEqueue eq, int id, const KernelTimespec* ts, void* udata);
-int APS5_VABI sceKernelAddTimerEvent(KernelEqueue eq, int id, KernelUseconds usec, void* udata);
-int APS5_VABI sceKernelDeleteTimerEvent(KernelEqueue eq, int id);
-intptr_t APS5_VABI sceKernelGetEventData(const KernelEvent* ev);
-int APS5_VABI sceKernelGetEventError(const KernelEvent* ev);
-intptr_t APS5_VABI sceKernelGetEventFflags(const KernelEvent* ev);
-int APS5_VABI sceKernelGetEventFilter(const KernelEvent* ev);
-uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
-void* APS5_VABI sceKernelGetEventUserData(const KernelEvent* ev);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ENOENT = static_cast<int>(0x80020002);
-static constexpr int SCE_KERNEL_ERROR_EBADF = static_cast<int>(0x80020009);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003c);
-static constexpr int EVFILT_TIMER = -7;
-static constexpr int EVFILT_USER = -11;
-static constexpr int EVFILT_HRTIMER = -15;
-static constexpr int EVFILT_AMPR = -25;
-static constexpr std::uint16_t EV_ERROR = 0x4000;
-static constexpr std::uint16_t EV_EOF = 0x8000;
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -53,6 +26,7 @@ static bool RejectsNull(TResult (APS5_VABI *accessor)(const KernelEvent*)) {
 static bool RejectsWideFflags(const KernelEvent* ev) {
     try {
         sceKernelGetEventError(ev);
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -256,12 +230,64 @@ static void VerifyRepeatedAmprCompletionsAreNotLost() {
     Require(sceKernelDeleteEqueue(eq) == SCE_OK);
 }
 
+static void RequireReported(KernelEqueue eq, int num, std::initializer_list<uintptr_t> expected) {
+    KernelEvent events[4]{};
+    int count = 0;
+    const KernelUseconds poll = 0;
+    Require(sceKernelWaitEqueue(eq, events, num, &count, &poll) == SCE_OK);
+    Require(count == static_cast<int>(expected.size()));
+    int index = 0;
+    for (const uintptr_t id : expected) {
+        Require(sceKernelGetEventId(&events[index++]) == id);
+    }
+}
+
+static void VerifyReportedEventsMoveBehindWaitingOnes() {
+    KernelEqueue eq = 0;
+    KernelEvent events[4]{};
+    int count = 0;
+    const KernelUseconds poll = 0;
+    int payload = 0;
+    Require(sceKernelCreateEqueue(&eq, "rotate") == SCE_OK);
+    for (const int id : {1, 2}) {
+        Require(sceKernelAddUserEvent(eq, id) == SCE_OK);
+        Require(sceKernelTriggerUserEvent(eq, id, &payload) == SCE_OK);
+    }
+    RequireReported(eq, 1, {1});
+    RequireReported(eq, 1, {2});
+    RequireReported(eq, 1, {1});
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+
+    Require(sceKernelCreateEqueue(&eq, "rotate three") == SCE_OK);
+    for (const int id : {1, 2, 3}) {
+        Require(sceKernelAddUserEvent(eq, id) == SCE_OK);
+        Require(sceKernelTriggerUserEvent(eq, id, &payload) == SCE_OK);
+    }
+    RequireReported(eq, 2, {1, 2});
+    RequireReported(eq, 2, {3, 1});
+    RequireReported(eq, 2, {2, 3});
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+
+    Require(sceKernelCreateEqueue(&eq, "rotate edge") == SCE_OK);
+    for (const int id : {7, 8}) {
+        Require(sceKernelAddUserEventEdge(eq, id) == SCE_OK);
+        Require(sceKernelTriggerUserEvent(eq, id, &payload) == SCE_OK);
+    }
+    RequireReported(eq, 1, {7});
+    Require(sceKernelTriggerUserEvent(eq, 7, &payload) == SCE_OK);
+    RequireReported(eq, 1, {8});
+    RequireReported(eq, 1, {7});
+    Require(sceKernelWaitEqueue(eq, events, 4, &count, &poll) == SCE_KERNEL_ERROR_ETIMEDOUT);
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+}
+
 int main() {
     VerifyPeriodicTimer();
     VerifyUserEventReportedOncePerWait();
     VerifyBlockingWaitReportsLevelEventOnce();
     VerifyEdgeUserEventReportedOnce();
     VerifyRepeatedAmprCompletionsAreNotLost();
+    VerifyReportedEventsMoveBehindWaitingOnes();
 
     KernelEqueue eq = 0;
     Require(sceKernelCreateEqueue(&eq, "events") == SCE_OK);
diff --git a/core/libs/tests/GuestErr.cpp b/core/libs/tests/GuestErr.cpp
index cf7f656594..570a1c1d85 100644
--- a/core/libs/tests/GuestErr.cpp
+++ b/core/libs/tests/GuestErr.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
@@ -11,27 +13,10 @@
 #include <unistd.h>
 #endif
 
-using ErrExit = void (APS5_VABI*)(int);
-
 extern "C" {
-void APS5_VABI err_set_file_nid_postfix(FileStream* stream);
-void APS5_VABI err_set_exit_nid_postfix(ErrExit function);
-void APS5_VABI warn_nid_postfix(const char* format, ...);
-void APS5_VABI warnc_nid_postfix(int code, const char* format, ...);
-void APS5_VABI warnx_nid_postfix(const char* format, ...);
-[[noreturn]] void APS5_VABI err_nid_postfix(int status, const char* format, ...);
-[[noreturn]] void APS5_VABI errc_nid_postfix(int status, int code, const char* format, ...);
-[[noreturn]] void APS5_VABI errx_nid_postfix(int status, const char* format, ...);
-void APS5_VABI vwarn_nid_postfix(const char* format, VaList* args);
-void APS5_VABI vwarnc_nid_postfix(int code, const char* format, VaList* args);
-void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args);
-[[noreturn]] void APS5_VABI verr_nid_postfix(int status, const char* format, VaList* args);
-[[noreturn]] void APS5_VABI verrc_nid_postfix(int status, int code, const char* format, VaList* args);
-[[noreturn]] void APS5_VABI verrx_nid_postfix(int status, const char* format, VaList* args);
-char* APS5_VABI strerror_nid_postfix(int error);
-int* APS5_VABI __error_nid_postfix();
+
 extern const char* __progname_nid_postfix;
-void APS5_VABI psignal_nid_postfix(unsigned int signal, const char* prefix);
+
 extern const char* const sys_signame_nid_postfix[32];
 extern const char* const sys_siglist_nid_postfix[32];
 }
@@ -63,6 +48,7 @@ public:
     Capture() : stream(std::tmpfile()) { err_set_file_nid_postfix(&stream); }
     ~Capture() {
         err_set_file_nid_postfix(nullptr);
+
         stream.Close();
     }
     std::string Take() {
@@ -144,15 +130,24 @@ int main() {
         Capture capture;
         *__error_nid_postfix() = 2;
         warn_nid_postfix("open %s", "a.txt");
+
         Require(capture.Take() == "prog: open a.txt: " + noEntry + "\n", "warn");
         *__error_nid_postfix() = 2;
         warn_nid_postfix(nullptr);
+
         Require(capture.Take() == "prog: " + noEntry + "\n", "warn without format");
+        *__error_nid_postfix() = 13;
+        _warn_nid_postfix("open %s", "b.txt");
+
+        Require(capture.Take() == "prog: open b.txt: " + denied + "\n", "_warn");
         warnc_nid_postfix(13, "%d-%s", 7, "x");
+
         Require(capture.Take() == "prog: 7-x: " + denied + "\n", "warnc");
         warnx_nid_postfix("plain %c", 'q');
+
         Require(capture.Take() == "prog: plain q\n", "warnx");
         warnx_nid_postfix(nullptr);
+
         Require(capture.Take() == "prog: \n", "warnx without format");
 
         err_set_exit_nid_postfix(Hook);
@@ -163,6 +158,12 @@ int main() {
         *__error_nid_postfix() = 2;
         Require(ExitStatus([] { err_nid_postfix(5, "e"); }) == 5, "err status");
         Require(capture.Take() == "prog: e: " + noEntry + "\n", "err text");
+        *__error_nid_postfix() = 13;
+        Require(ExitStatus([] { _err_nid_postfix(7, "%s %d", "f", 8); }) == 7 && g_hookStatus == 7, "_err status");
+        Require(capture.Take() == "prog: f 8: " + denied + "\n", "_err text");
+        *__error_nid_postfix() = 2;
+        Require(ExitStatus([] { _warn_nid_postfix(nullptr); }) == -1 && g_hookStatus == 7, "_warn does not exit");
+        Require(capture.Take() == "prog: " + noEntry + "\n", "_warn without format");
 
         *__error_nid_postfix() = 2;
         CallVariant(Variant::Warn, 0, 0, "open %s", "a.txt");
@@ -185,6 +186,7 @@ int main() {
         Require(ExitStatus([] { CallVariant(Variant::Errx, 0, 0, nullptr); }) == 0, "verrx status 0");
         Require(capture.Take() == "prog: \n", "verrx without format");
         err_set_exit_nid_postfix(nullptr);
+
     }
     __progname_nid_postfix = savedName;
 
diff --git a/core/libs/tests/GuestErrorDialog.cpp b/core/libs/tests/GuestErrorDialog.cpp
index 51779896a1..034eb4e5e0 100644
--- a/core/libs/tests/GuestErrorDialog.cpp
+++ b/core/libs/tests/GuestErrorDialog.cpp
@@ -1,18 +1,8 @@
+#include "prx/libSceErrorDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceErrorDialogInitialize(void);
-int APS5_VABI sceErrorDialogOpen(const void* param);
-int APS5_VABI sceErrorDialogUpdateStatus(void);
-int APS5_VABI sceErrorDialogGetStatus(void);
-int APS5_VABI sceErrorDialogClose(void);
-int APS5_VABI sceErrorDialogTerminate(void);
-int APS5_VABI sceErrorDialogOpenDetail(void);
-int APS5_VABI sceErrorDialogOpenWithReport(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestErrors.cpp b/core/libs/tests/GuestErrors.cpp
index b66b25b00d..1946147d26 100644
--- a/core/libs/tests/GuestErrors.cpp
+++ b/core/libs/tests/GuestErrors.cpp
@@ -1,14 +1,12 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <climits>
+#include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <thread>
 
-extern "C" {
-char* APS5_VABI strerror_nid_postfix(int);
-int APS5_VABI strerror_r_nid_postfix(int, char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
 static void Require(bool value) { if (!value) std::abort(); }
 static const char* const freebsd[97] = {
     "No error: 0", "Operation not permitted", "No such file or directory",
@@ -21,7 +19,7 @@ static const char* const freebsd[97] = {
     "Is a directory", "Invalid argument", "Too many open files in system",
     "Too many open files", "Inappropriate ioctl for device", "Text file busy",
     "File too large", "No space left on device", "Illegal seek",
-    "Read-only file system", "Too many links", "Broken pipe",
+    "Read-only filesystem", "Too many links", "Broken pipe",
     "Numerical argument out of domain", "Result too large", "Resource temporarily unavailable",
     "Operation now in progress", "Operation already in progress", "Socket operation on non-socket",
     "Destination address required", "Message too long", "Protocol wrong type for socket",
@@ -62,7 +60,11 @@ int main() {
     for (int error = 0; error <= 96; ++error) {
         Require(strerror_r_nid_postfix(error, buffer, sizeof(buffer)) == 0);
         Require(std::strcmp(buffer, freebsd[error]) == 0);
-        Require(std::strcmp(strerror_nid_postfix(error), freebsd[error]) == 0);
+        char coded[32];
+        std::snprintf(coded, sizeof(coded), "error_code=0x%08x", static_cast<unsigned>(error));
+        const char* expected = error == 0 ? "No error" : error < 95 ? freebsd[error] : coded;
+        Require(std::strcmp(strerror_nid_postfix(error), expected) == 0);
+        Require(*__error_nid_postfix() == 13);
     }
     Require(strerror_r_nid_postfix(-1, buffer, sizeof(buffer)) == 22);
     Require(std::strcmp(buffer, "Unknown error: -1") == 0);
@@ -70,15 +72,18 @@ int main() {
     struct UnknownError {
         int error;
         const char* text;
+        const char* coded;
     };
-    for (const UnknownError& unknown : {UnknownError{97, "Unknown error: 97"}, UnknownError{INT_MAX, "Unknown error: 2147483647"},
-                                        UnknownError{INT_MIN, "Unknown error: -2147483648"}}) {
+    for (const UnknownError& unknown : {UnknownError{97, "Unknown error: 97", "error_code=0x00000061"},
+                                        UnknownError{9999, "Unknown error: 9999", "error_code=0x0000270f"},
+                                        UnknownError{INT_MAX, "Unknown error: 2147483647", "error_code=0x7fffffff"},
+                                        UnknownError{-1, "Unknown error: -1", "error_code=0xffffffff"},
+                                        UnknownError{INT_MIN, "Unknown error: -2147483648", "error_code=0x80000000"}}) {
         Require(strerror_r_nid_postfix(unknown.error, buffer, sizeof(buffer)) == 22);
         Require(std::strcmp(buffer, unknown.text) == 0);
         Require(*__error_nid_postfix() == 13);
-        Require(std::strcmp(strerror_nid_postfix(unknown.error), unknown.text) == 0);
-        Require(*__error_nid_postfix() == 22);
-        *__error_nid_postfix() = 13;
+        Require(std::strcmp(strerror_nid_postfix(unknown.error), unknown.coded) == 0);
+        Require(*__error_nid_postfix() == 13);
     }
     char sentinel[] = "xyz";
     Require(strerror_r_nid_postfix(22, sentinel, 1) == 34);
diff --git a/core/libs/tests/GuestExceptionHandler.cpp b/core/libs/tests/GuestExceptionHandler.cpp
index fbb5dfd8f7..2ad28a7af4 100644
--- a/core/libs/tests/GuestExceptionHandler.cpp
+++ b/core/libs/tests/GuestExceptionHandler.cpp
@@ -1,15 +1,9 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
-int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_EAGAIN = static_cast<int>(0x80020023);
-
 static void APS5_VABI Handler(int, void*) {}
 static void APS5_VABI Other(int, void*) {}
 
diff --git a/core/libs/tests/GuestExecuteOnce.cpp b/core/libs/tests/GuestExecuteOnce.cpp
index 327fbe8c32..e58792b37d 100644
--- a/core/libs/tests/GuestExecuteOnce.cpp
+++ b/core/libs/tests/GuestExecuteOnce.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -5,7 +6,7 @@
 #include <thread>
 
 using Callback = int (APS5_VABI *)(void*, void*, void**);
-extern "C" int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(int*, Callback, void*);
+
 static int ExecuteOnce(int* flag, Callback callback, void* arg) {
     return _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(flag, callback, arg);
 }
diff --git a/core/libs/tests/GuestExecuteOnceConcurrency.cpp b/core/libs/tests/GuestExecuteOnceConcurrency.cpp
index e5fc8f802e..1537ea5887 100644
--- a/core/libs/tests/GuestExecuteOnceConcurrency.cpp
+++ b/core/libs/tests/GuestExecuteOnceConcurrency.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -10,10 +11,6 @@
 
 using Callback = int (APS5_VABI *)(void*, void*, void**);
 using ExecuteFunction = int (APS5_VABI *)(int*, Callback, void*);
-extern "C" {
-int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(int*, Callback, void*);
-int APS5_VABI std_execute_once_nid_postfix(int*, Callback, void*);
-}
 
 static void Check(bool value, int line) {
     if (!value) {
diff --git a/core/libs/tests/GuestExecvp.cpp b/core/libs/tests/GuestExecvp.cpp
index 24044df2f7..22e67f4d98 100644
--- a/core/libs/tests/GuestExecvp.cpp
+++ b/core/libs/tests/GuestExecvp.cpp
@@ -1,12 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <cstdlib>
 #include <stdexcept>
 #include <string>
-extern "C" {
-int APS5_VABI execvp_nid_postfix(const char*, char* const*);
-int APS5_VABI execv_nid_postfix(const char*, char* const*);
-int APS5_VABI execve_nid_postfix(const char*, char* const*, char* const*);
-}
+
 template <typename TCall> static bool Throws(TCall call, const std::string& message) {
     try {
         call();
diff --git a/core/libs/tests/GuestExitOrder.cpp b/core/libs/tests/GuestExitOrder.cpp
index 889e6f0f26..af813531ef 100644
--- a/core/libs/tests/GuestExitOrder.cpp
+++ b/core/libs/tests/GuestExitOrder.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
@@ -5,9 +6,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
-extern "C" int APS5_VABI atexit_nid_postfix(void (APS5_VABI *func)());
-
 namespace {
 
 int events[2];
diff --git a/core/libs/tests/GuestFdopendir.cpp b/core/libs/tests/GuestFdopendir.cpp
index 551ad063f0..7dfad311ad 100644
--- a/core/libs/tests/GuestFdopendir.cpp
+++ b/core/libs/tests/GuestFdopendir.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/File.hpp"
@@ -9,16 +12,7 @@
 #include <fstream>
 #include <map>
 #include <string>
-extern "C" {
-void* APS5_VABI fdopendir_nid_postfix(int);
-GuestDirectoryEntry* APS5_VABI readdir_nid_postfix(void*);
-int APS5_VABI closedir_nid_postfix(void*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     const auto root = std::filesystem::path("anyps5-fdopendir-test-" +
diff --git a/core/libs/tests/GuestFileLock.cpp b/core/libs/tests/GuestFileLock.cpp
index 16766fef4e..26dd7afae8 100644
--- a/core/libs/tests/GuestFileLock.cpp
+++ b/core/libs/tests/GuestFileLock.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <barrier>
 #include <chrono>
@@ -12,25 +15,6 @@
 
 class FileStream;
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI flock_nid_postfix(int, int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-FileStream* APS5_VABI fdopen_nid_postfix(int, const char*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
diff --git a/core/libs/tests/GuestFileTimestamps.cpp b/core/libs/tests/GuestFileTimestamps.cpp
index ec6ac22fe7..e45df8c8f5 100644
--- a/core/libs/tests/GuestFileTimestamps.cpp
+++ b/core/libs/tests/GuestFileTimestamps.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstdio>
@@ -10,23 +12,6 @@
 #include <io.h>
 #endif
 
-extern "C" {
-int APS5_VABI utimes_nid_postfix(const char*, const KernelTimeval*);
-int APS5_VABI lutimes_nid_postfix(const char*, const KernelTimeval*);
-int APS5_VABI futimes_nid_postfix(int, const KernelTimeval*);
-int APS5_VABI sceKernelFutimes(int, const KernelTimeval*);
-int APS5_VABI sceKernelUtimes_nid_postfix(const char*, const KernelTimeval*);
-int APS5_VABI stat_nid_postfix(const char*, FileStat*);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-std::int64_t APS5_VABI _fstat_nid_postfix(int, FileStat*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s (guest errno %d)\n", message, *__error_nid_postfix());
@@ -61,7 +46,6 @@ static void CheckTimes(const std::string& path, int fd, const KernelTimeval* exp
 #endif
 }
 
-
 #ifdef _WIN32
 static std::uint64_t Ticks(const FILETIME& time) {
     return (static_cast<std::uint64_t>(time.dwHighDateTime) << 32) | time.dwLowDateTime;
@@ -242,7 +226,14 @@ int main() {
     Require(utimes_nid_postfix(path.c_str(), second) == 0, "utimes target to second");
     std::error_code symlinkError;
     const auto linkPath = (root / "link.txt").string();
+#ifdef _WIN32
+    if (!CreateSymbolicLinkW(std::filesystem::path(linkPath).c_str(), std::filesystem::path(path).c_str(),
+            SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)) {
+        symlinkError = std::error_code(GetLastError(), std::system_category());
+    }
+#else
     std::filesystem::create_symlink(path, linkPath, symlinkError);
+#endif
     if (!symlinkError) {
         Require(lutimes_nid_postfix(linkPath.c_str(), first) == 0, "lutimes modifies symlink");
         FileStat targetStatus{};
diff --git a/core/libs/tests/GuestFileVector.cpp b/core/libs/tests/GuestFileVector.cpp
index e9e7b46880..b60d388465 100644
--- a/core/libs/tests/GuestFileVector.cpp
+++ b/core/libs/tests/GuestFileVector.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <array>
@@ -11,6 +14,7 @@
 #include <filesystem>
 #include <fstream>
 #include <iterator>
+#include <limits>
 #include <string>
 #include <thread>
 #include <vector>
@@ -26,37 +30,6 @@ static int MakePipe(int* ends) { return ::pipe(ends); }
 static int ClosePipe(int end) { return ::close(end); }
 #endif
 
-struct GuestIovec {
-    void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI dup_nid_postfix(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelReadv(int, const GuestIovec*, int);
-std::int64_t APS5_VABI readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _writev_nid_postfix(int, const GuestIovec*, int);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI sceKernelWritev(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelPreadv(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwritev(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI preadv_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelFtruncate(int, std::int64_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "File vector check failed at line %d\n", line);
@@ -94,13 +67,14 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
     for (std::size_t worker = 0; worker < Workers; ++worker) {
         writers[worker] = std::thread([&, worker] {
             std::uint16_t label = 0;
-            std::array<GuestIovec, Parts> pieces;
+            std::array<KernelIovec, Parts> pieces;
             pieces.fill({&label, sizeof(label)});
             start.arrive_and_wait();
             for (std::size_t record = 0; record < Records; ++record) {
                 label = static_cast<std::uint16_t>(worker * Records + record);
                 const auto written = worker % 2 == 0 ? sceKernelWritev(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()))
                                                      : writev_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()));
+
                 Require(written == RecordBytes);
             }
         });
@@ -126,12 +100,13 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
     for (std::size_t worker = 0; worker < Workers; ++worker) {
         readers[worker] = std::thread([&, worker] {
             std::array<std::uint16_t, Parts> record{};
-            std::array<GuestIovec, Parts> pieces;
+            std::array<KernelIovec, Parts> pieces;
             for (std::size_t part = 0; part < Parts; ++part) pieces[part] = {&record[part], sizeof(record[part])};
             start.arrive_and_wait();
             for (;;) {
                 const auto read = worker % 2 == 0 ? sceKernelReadv(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()))
                                                  : readv_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()));
+
                 if (read == 0) break;
                 Require(read == RecordBytes);
                 for (const auto label : record) Require(label == record[0]);
@@ -152,7 +127,7 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
     for (std::size_t worker = 0; worker < Workers; ++worker) {
         positioned[worker] = std::thread([&, worker] {
             std::array<std::uint16_t, Parts> record{};
-            std::array<GuestIovec, Parts> pieces;
+            std::array<KernelIovec, Parts> pieces;
             for (std::size_t part = 0; part < Parts; ++part) pieces[part] = {&record[part], sizeof(record[part])};
             start.arrive_and_wait();
             for (std::size_t iteration = 0; iteration < Records; ++iteration) {
@@ -161,9 +136,11 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
                     record.fill(static_cast<std::uint16_t>(0x8000 + worker * Records + iteration));
                     transferred = worker == 0 ? sceKernelPwritev(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0)
                                               : pwritev_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0);
+
                 } else {
                     transferred = worker == 1 ? sceKernelPreadv(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0)
                                               : preadv_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0);
+
                     for (const auto label : record) Require(label == record[0]);
                 }
                 Require(transferred == RecordBytes);
@@ -189,7 +166,7 @@ int main() {
 
     char first[3] = {};
     char second[4] = {};
-    GuestIovec reads[2] = {{first, sizeof(first)}, {second, sizeof(second)}};
+    KernelIovec reads[2] = {{first, sizeof(first)}, {second, sizeof(second)}};
     Require(sceKernelReadv(file, reads, 2) == 7);
     Require(std::memcmp(first, "012", 3) == 0 && std::memcmp(second, "3456", 4) == 0);
     Require(sceKernelLseek(file, 0, 1) == 7);
@@ -215,7 +192,7 @@ int main() {
 
     char ab[] = "AB";
     char cde[] = "CDE";
-    GuestIovec writes[2] = {{ab, 2}, {cde, 3}};
+    KernelIovec writes[2] = {{ab, 2}, {cde, 3}};
     Require(sceKernelPwritev(file, writes, 2, 2) == 5);
     Require(sceKernelLseek(file, 0, 1) == 10);
     Require(Contents(path) == "01ABCDE789");
@@ -223,7 +200,7 @@ int main() {
     Require(sceKernelWritev(file, writes, 2) == 5);
     Require(sceKernelLseek(file, 0, 1) == 13);
     Require(Contents(path) == "01ABCDE7ABCDE");
-    GuestIovec swapped[2] = {{cde, 3}, {ab, 2}};
+    KernelIovec swapped[2] = {{cde, 3}, {ab, 2}};
     Require(sceKernelLseek(file, 8, 0) == 8 && writev_nid_postfix(file, swapped, 2) == 5);
     Require(sceKernelLseek(file, 0, 1) == 13 && Contents(path) == "01ABCDE7CDEAB");
     Require(sceKernelLseek(file, 8, 0) == 8 && writev_nid_postfix(file, writes, 2) == 5);
@@ -232,7 +209,7 @@ int main() {
     Require(sceKernelLseek(file, 0, 1) == 13 && Contents(path) == "01ABCDE7CDEAB");
     Require(sceKernelLseek(file, 8, 0) == 8 && writev_nid_postfix(file, writes, 2) == 5);
 
-    GuestIovec gapped[3] = {{first, 2}, {nullptr, 0}, {second, 3}};
+    KernelIovec gapped[3] = {{first, 2}, {nullptr, 0}, {second, 3}};
     Require(sceKernelPreadv(file, gapped, 3, 0) == 5);
     Require(std::memcmp(first, "01", 2) == 0 && std::memcmp(second, "ABC", 3) == 0);
     Require(sceKernelLseek(file, 2, 0) == 2);
@@ -240,7 +217,7 @@ int main() {
     Require(std::memcmp(first, "AB", 2) == 0 && std::memcmp(second, "CDE", 3) == 0);
     Require(sceKernelLseek(file, 0, 1) == 7);
 
-    GuestIovec empty[1] = {{nullptr, 0}};
+    KernelIovec empty[1] = {{nullptr, 0}};
     Require(sceKernelReadv(file, empty, 1) == 0);
     Require(sceKernelReadv(file, reads, 0) == 0);
     Require(sceKernelWritev(file, nullptr, 0) == 0);
@@ -272,12 +249,12 @@ int main() {
     Require(Contents(path) == "01ABCDE7ABCDE");
     char x[] = "X";
     char y[] = "Y";
-    GuestIovec marks[2] = {{x, 1}, {y, 1}};
+    KernelIovec marks[2] = {{x, 1}, {y, 1}};
     Require(pwritev_nid_postfix(file, marks, 2, 0) == 2);
     Require(Contents(path) == "XYABCDE7ABCDE");
     char zero[] = "0";
     char one[] = "1";
-    GuestIovec restore[2] = {{zero, 1}, {one, 1}};
+    KernelIovec restore[2] = {{zero, 1}, {one, 1}};
     Require(pwritev_nid_postfix(file, restore, 2, 0) == 2);
     Require(sceKernelLseek(file, 0, 1) == 4);
     Require(pwritev_nid_postfix(file, writes, 2, -1) == -1 && *__error_nid_postfix() == 22);
@@ -303,12 +280,22 @@ int main() {
     const int readOnly = sceKernelOpen(path.string().c_str(), SCE_KERNEL_O_RDONLY, 0);
     Require(readOnly >= 0);
     Require(sceKernelPwrite(readOnly, "X", 1, 0) == ErrorEbadf);
+    Require(sceKernelPwrite(readOnly, "X", 1, -1) == ErrorEbadf);
+    Require(pwrite_nid_disambig1_nid_postfix(readOnly, nullptr, 1, 0) == -1 && *__error_nid_postfix() == 9);
+    Require(sceKernelPwritev(readOnly, writes, 2, -1) == ErrorEbadf);
+    Require(pwritev_nid_postfix(readOnly, writes, 2, -1) == -1 && *__error_nid_postfix() == 9);
+    Require(sceKernelPreadv(readOnly, reads, 2, -1) == ErrorEinval);
     Require(sceKernelFtruncate(readOnly, 0) == ErrorEinval);
     Require(sceKernelClose(readOnly) == 0);
     const int writeOnly = sceKernelOpen(path.string().c_str(), SCE_KERNEL_O_WRONLY, 0);
     Require(writeOnly >= 0);
     Require(sceKernelPread(writeOnly, &byte, 1, 0) == ErrorEbadf);
     Require(pread_nid_postfix(writeOnly, &byte, 1, 0) == -1 && *__error_nid_postfix() == 9);
+    Require(sceKernelPread(writeOnly, &byte, 1, -1) == ErrorEbadf);
+    Require(pread_nid_postfix(writeOnly, nullptr, 1, 0) == -1 && *__error_nid_postfix() == 9);
+    Require(sceKernelPreadv(writeOnly, reads, 2, -1) == ErrorEbadf);
+    Require(preadv_nid_postfix(writeOnly, reads, 2, -1) == -1 && *__error_nid_postfix() == 9);
+    Require(sceKernelPwritev(writeOnly, writes, 2, -1) == ErrorEinval);
     Require(sceKernelClose(writeOnly) == 0);
     Require(Contents(path) == "01ABCDE7ABCDE");
     Require(sceKernelFtruncate(file, 5) == 0);
@@ -322,16 +309,27 @@ int main() {
     Require(sceKernelPread(file, &byte, 1, 0) == ErrorEbadf);
     Require(sceKernelPwrite(file, &byte, 1, 0) == ErrorEbadf);
     Require(sceKernelFtruncate(file, 0) == ErrorEbadf);
+    Require(sceKernelPreadv(file, reads, 2, -1) == ErrorEbadf);
+    Require(sceKernelPwritev(file, writes, 2, -1) == ErrorEbadf);
+    Require(preadv_nid_postfix(file, reads, 2, -1) == -1 && *__error_nid_postfix() == 9);
+    Require(pwritev_nid_postfix(file, writes, 2, -1) == -1 && *__error_nid_postfix() == 9);
+    KernelIovec oversized[2] = {{first, static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max())}, {second, 1}};
+    Require(sceKernelReadv(file, oversized, 2) == ErrorEinval);
+    Require(sceKernelWritev(file, oversized, 2) == ErrorEinval);
+    Require(sceKernelPreadv(file, oversized, 2, 0) == ErrorEinval);
+    Require(sceKernelPwritev(file, oversized, 2, 0) == ErrorEinval);
+    Require(readv_nid_postfix(file, oversized, 2) == -1 && *__error_nid_postfix() == 22);
+    Require(pwritev_nid_postfix(file, oversized, 2, 0) == -1 && *__error_nid_postfix() == 22);
 
     int ends[2] = {};
     Require(MakePipe(ends) == 0);
     char xyz[] = "xyz";
-    GuestIovec message[1] = {{xyz, 3}};
+    KernelIovec message[1] = {{xyz, 3}};
     Require(sceKernelWritev(ends[1], message, 1) == 3);
     Require(sceKernelReadv(ends[0], reads, 2) == 3);
     Require(std::memcmp(first, "xyz", 3) == 0);
     char stuvw[] = "stuvw";
-    GuestIovec longer[1] = {{stuvw, 5}};
+    KernelIovec longer[1] = {{stuvw, 5}};
     Require(sceKernelWritev(ends[1], longer, 1) == 5);
     Require(sceKernelReadv(ends[0], reads, 2) == 5);
     Require(std::memcmp(first, "stu", 3) == 0 && std::memcmp(second, "vw", 2) == 0);
@@ -341,6 +339,10 @@ int main() {
     Require(sceKernelReadv(ends[0], reads, 2) == 3 && std::memcmp(first, "uvw", 3) == 0);
     Require(sceKernelPreadv(ends[0], reads, 2, 0) == ErrorEspipe);
     Require(sceKernelPwritev(ends[1], message, 1, 0) == ErrorEspipe);
+    Require(sceKernelPreadv(ends[0], reads, 2, -1) == ErrorEspipe);
+    Require(sceKernelPwritev(ends[1], message, 1, -1) == ErrorEspipe);
+    Require(preadv_nid_postfix(ends[0], reads, 2, -1) == -1 && *__error_nid_postfix() == 29);
+    Require(pwritev_nid_postfix(ends[1], message, 1, -1) == -1 && *__error_nid_postfix() == 29);
 #ifndef _WIN32
     Require(::fcntl(ends[0], F_SETFL, ::fcntl(ends[0], F_GETFL) | O_NONBLOCK) == 0);
     Require(sceKernelReadv(ends[0], reads, 2) == ErrorEagain);
@@ -348,10 +350,22 @@ int main() {
 #endif
     Require(ClosePipe(ends[0]) == 0 && ClosePipe(ends[1]) == 0);
 
+    const int queue = kqueue_nid_postfix();
+    Require(queue >= 0);
+    Require(sceKernelPreadv(queue, reads, 2, -1) == ErrorEspipe);
+    Require(sceKernelPwritev(queue, writes, 2, -1) == ErrorEspipe);
+    Require(preadv_nid_postfix(queue, reads, 2, -1) == -1 && *__error_nid_postfix() == 29);
+    Require(pwritev_nid_postfix(queue, writes, 2, -1) == -1 && *__error_nid_postfix() == 29);
+    Require(sceKernelPreadv(queue, reads, 2, 0) == ErrorEspipe);
+    Require(sceKernelPwritev(queue, writes, 2, 0) == ErrorEspipe);
+    Require(sceKernelPread(queue, &byte, 1, 0) == ErrorEspipe);
+    Require(pwrite_nid_disambig1_nid_postfix(queue, &byte, 1, -1) == -1 && *__error_nid_postfix() == 29);
+    Require(sceKernelClose(queue) == 0);
+
     const int random = sceKernelOpen("/dev/urandom", 0, 0);
     Require(random >= 0);
     unsigned char noise[48]{};
-    GuestIovec pieces[2] = {{noise, 16}, {noise + 16, 16}};
+    KernelIovec pieces[2] = {{noise, 16}, {noise + 16, 16}};
     Require(sceKernelReadv(random, pieces, 2) == 32);
     Require(sceKernelPreadv(random, pieces, 1, 1000) == 16);
     Require(sceKernelPread(random, noise + 32, 16, 1000) == 16);
diff --git a/core/libs/tests/GuestFileVectorMemory.cpp b/core/libs/tests/GuestFileVectorMemory.cpp
index 58285bbdd7..8bac8775f0 100644
--- a/core/libs/tests/GuestFileVectorMemory.cpp
+++ b/core/libs/tests/GuestFileVectorMemory.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -19,28 +22,6 @@
 #include <unistd.h>
 #endif
 
-struct GuestIovec {
-    void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelReadv(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelWritev(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelPreadv(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwritev(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI preadv_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "File vector memory check failed at line %d\n", line);
@@ -54,7 +35,7 @@ struct Transfer {
     bool posix;
     bool positioned;
     bool write;
-    std::function<std::int64_t(int, const GuestIovec*, int)> call;
+    std::function<std::int64_t(int, const KernelIovec*, int)> call;
 };
 
 static std::uintptr_t observedTable = 0;
@@ -77,14 +58,14 @@ int main(int argc, char** argv) {
     const std::array<Transfer, 10> transfers{{
         {"readv", true, false, false, readv_nid_postfix},
         {"writev", true, false, true, writev_nid_postfix},
-        {"preadv", true, true, false, [](int fd, const GuestIovec* iov, int count) { return preadv_nid_postfix(fd, iov, count, 1); }},
-        {"pwritev", true, true, true, [](int fd, const GuestIovec* iov, int count) { return pwritev_nid_postfix(fd, iov, count, 1); }},
+        {"preadv", true, true, false, [](int fd, const KernelIovec* iov, int count) { return preadv_nid_postfix(fd, iov, count, 1); }},
+        {"pwritev", true, true, true, [](int fd, const KernelIovec* iov, int count) { return pwritev_nid_postfix(fd, iov, count, 1); }},
         {"_readv", true, false, false, _readv_nid_postfix},
         {"_writev", true, false, true, _writev_nid_postfix},
         {"sceKernelReadv", false, false, false, sceKernelReadv},
         {"sceKernelWritev", false, false, true, sceKernelWritev},
-        {"sceKernelPreadv", false, true, false, [](int fd, const GuestIovec* iov, int count) { return sceKernelPreadv(fd, iov, count, 1); }},
-        {"sceKernelPwritev", false, true, true, [](int fd, const GuestIovec* iov, int count) { return sceKernelPwritev(fd, iov, count, 1); }},
+        {"sceKernelPreadv", false, true, false, [](int fd, const KernelIovec* iov, int count) { return sceKernelPreadv(fd, iov, count, 1); }},
+        {"sceKernelPwritev", false, true, true, [](int fd, const KernelIovec* iov, int count) { return sceKernelPwritev(fd, iov, count, 1); }},
     }};
 #ifdef _WIN32
     SYSTEM_INFO system{};
@@ -98,9 +79,9 @@ int main(int argc, char** argv) {
     Require(memory != MAP_FAILED);
 #endif
     std::array<char, 2> bytes{'A', 'B'};
-    const std::array<GuestIovec, 2> vectors{{{bytes.data(), 1}, {bytes.data() + 1, 1}}};
+    const std::array<KernelIovec, 2> vectors{{{bytes.data(), 1}, {bytes.data() + 1, 1}}};
     std::memcpy(memory, vectors.data(), sizeof(vectors));
-    std::memcpy(memory + page - sizeof(GuestIovec), vectors.data(), sizeof(GuestIovec));
+    std::memcpy(memory + page - sizeof(KernelIovec), vectors.data(), sizeof(KernelIovec));
     Protect(memory, page, true);
     Protect(memory + page, page, false);
     const auto path = std::filesystem::temp_directory_path() /
@@ -113,13 +94,13 @@ int main(int argc, char** argv) {
         { std::ofstream file(path, std::ios::binary); file << "ABCD"; Require(static_cast<bool>(file)); }
         const int fd = sceKernelOpen(guestPath.c_str(), SCE_KERNEL_O_RDWR, 0);
         Require(fd >= 0);
-        const std::array<const GuestIovec*, 6> invalid{{
+        const std::array<const KernelIovec*, 6> invalid{{
             nullptr,
-            reinterpret_cast<const GuestIovec*>(std::uintptr_t{1}),
-            reinterpret_cast<const GuestIovec*>(memory + page),
-            reinterpret_cast<const GuestIovec*>(memory + page - sizeof(GuestIovec)),
-            reinterpret_cast<const GuestIovec*>(memory + page - sizeof(GuestIovec) / 2),
-            reinterpret_cast<const GuestIovec*>(UINTPTR_MAX - sizeof(GuestIovec) + 1),
+            reinterpret_cast<const KernelIovec*>(std::uintptr_t{1}),
+            reinterpret_cast<const KernelIovec*>(memory + page),
+            reinterpret_cast<const KernelIovec*>(memory + page - sizeof(KernelIovec)),
+            reinterpret_cast<const KernelIovec*>(memory + page - sizeof(KernelIovec) / 2),
+            reinterpret_cast<const KernelIovec*>(UINTPTR_MAX - sizeof(KernelIovec) + 1),
         }};
         for (const auto* table : invalid) {
             *__error_nid_postfix() = 0;
@@ -142,7 +123,7 @@ int main(int argc, char** argv) {
         observedTable = reinterpret_cast<std::uintptr_t>(memory);
         observedBytes = 0;
         GuestArena::GuestArenaSetHostReadHook_nid_no_patch(ObserveRead);
-        Require(transfer.call(fd, reinterpret_cast<const GuestIovec*>(memory), 2) == 2);
+        Require(transfer.call(fd, reinterpret_cast<const KernelIovec*>(memory), 2) == 2);
         GuestArena::GuestArenaSetHostReadHook_nid_no_patch(nullptr);
         Require(observedBytes == sizeof(vectors));
         Require(sceKernelLseek(fd, 0, SEEK_CUR) == (transfer.positioned ? 0 : 2));
@@ -156,10 +137,10 @@ int main(int argc, char** argv) {
             Require((bytes == (transfer.positioned ? std::array<char, 2>{'B', 'C'} : std::array<char, 2>{'A', 'B'})));
         }
         Require(sceKernelLseek(fd, 0, SEEK_SET) == 0);
-        Require(transfer.call(fd, reinterpret_cast<const GuestIovec*>(memory + page - sizeof(GuestIovec)), 1) == 1);
+        Require(transfer.call(fd, reinterpret_cast<const KernelIovec*>(memory + page - sizeof(KernelIovec)), 1) == 1);
         Require(sceKernelLseek(fd, 0, SEEK_CUR) == (transfer.positioned ? 0 : 1));
         Require(sceKernelLseek(fd, 0, SEEK_SET) == 0);
-        std::array<GuestIovec, 1024> maximum{};
+        std::array<KernelIovec, 1024> maximum{};
         maximum.back() = {bytes.data(), 1};
         Require(transfer.call(fd, maximum.data(), static_cast<int>(maximum.size())) == 1);
         Require(sceKernelLseek(fd, 0, SEEK_CUR) == (transfer.positioned ? 0 : 1));
diff --git a/core/libs/tests/GuestFilesystem.cpp b/core/libs/tests/GuestFilesystem.cpp
index 9e3fe832d1..043a147a54 100644
--- a/core/libs/tests/GuestFilesystem.cpp
+++ b/core/libs/tests/GuestFilesystem.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/General.hpp"
@@ -30,88 +32,7 @@
 #ifdef __linux__
 #include <sys/inotify.h>
 #endif
-extern "C" {
-int APS5_VABI remove_nid_postfix(const char*);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI sceKernelChmod_nid_postfix(const char*, unsigned short);
-int APS5_VABI sceKernelFchmod(int, unsigned short);
-int APS5_VABI fchmod_nid_postfix(int, int);
-int APS5_VABI chmod_nid_postfix(const char*, int);
-int APS5_VABI chflags_nid_postfix(const char*, std::uint64_t);
-int APS5_VABI fchflags_nid_postfix(int, std::uint64_t);
-int APS5_VABI futimes_nid_postfix(int, const KernelTimeval*);
-int APS5_VABI sceKernelFutimes(int, const KernelTimeval*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI sceKernelFsync(int);
-int APS5_VABI fdatasync_nid_postfix(int);
-int APS5_VABI fsync_nid_postfix(int);
-int APS5_VABI sceKernelFdatasync(int);
-int APS5_VABI sceKernelWriteThrottlingStatus(std::uint64_t*);
-int APS5_VABI sceKernelFtruncate(int, long long);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char*, long long);
-int APS5_VABI truncate_nid_postfix(const char*, long long);
-int APS5_VABI sceKernelUtimes_nid_postfix(const char*, const void*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI creat_nid_postfix(const char*, int);
-int APS5_VABI _open_nid_postfix(const char*, int, ...);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI flock_nid_postfix(int, int);
-int APS5_VABI stat_nid_postfix(const char*, FileStat*);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI sceKernelOpen(const char*, int, unsigned short);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI getdents_nid_postfix(int, char*, int);
-int APS5_VABI getdirentries_nid_postfix(int, char*, int, int64_t*);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelReadv(int, const void*, int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPreadv(int, const void*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-int APS5_VABI sceKernelCheckReachability(const char*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelUnlink(const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelRmdir(const char*);
-int APS5_VABI sceKernelMkdir(const char*, unsigned short);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelCheckReachability(const char*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI chdir_nid_postfix(const char*);
-void* APS5_VABI opendir_nid_postfix(const char*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fgetc_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-char* APS5_VABI fgets_nid_postfix(char*, int, FileStream*);
-int APS5_VABI fscanf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI fputc_nid_postfix(int, FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-void APS5_VABI clearerr_nid_postfix(FileStream*);
-int APS5_VABI feof_nid_postfix(FileStream*);
-int APS5_VABI ferror_nid_postfix(FileStream*);
-int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-int APS5_VABI ftrylockfile_nid_postfix(FileStream*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI dup2_nid_postfix(int, int);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-int APS5_VABI sceKernelDebugOutText(int, const char*);
-}
+
 #ifdef _WIN32
 static bool g_invalidParameter = false;
 static void RecordInvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned, std::uintptr_t) { g_invalidParameter = true; }
@@ -139,6 +60,7 @@ static void Check(bool value, int line) {
 static bool ChflagsThrows(const std::filesystem::path& path, std::uint64_t flags, const char* names) {
     try {
         chflags_nid_postfix(path.string().c_str(), flags);
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), names) != nullptr;
     }
@@ -148,6 +70,7 @@ static bool ChflagsThrows(const std::filesystem::path& path, std::uint64_t flags
 static bool FchflagsThrows(int descriptor, std::uint64_t flags, const char* names) {
     try {
         fchflags_nid_postfix(descriptor, flags);
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), names) != nullptr;
     }
@@ -283,19 +206,27 @@ static void TestParentTraversal() {
     Require(rmdir_nid_postfix("/parent-test-mount/missing/..") == -1 && *__error_nid_postfix() == 2);
     Require(std::filesystem::is_directory(root / "dot-victim") && std::filesystem::is_regular_file(root / "present.txt"));
     std::filesystem::remove(root / "dot-victim");
-#ifndef _WIN32
     for (const char* name : {"slash-unlink", "slash-remove", "slash-rename", "slash-open", "slash-kernel"}) std::ofstream(root / name) << "kept";
     Require(unlink_nid_postfix("/parent-test-mount/slash-unlink/") == -1 && *__error_nid_postfix() == 20);
     Require(remove_nid_postfix("/parent-test-mount/slash-remove/") == -1 && *__error_nid_postfix() == 20);
     Require(rename_nid_postfix("/parent-test-mount/slash-rename/", "/parent-test-mount/slash-renamed") == -1 && *__error_nid_postfix() == 20);
     Require(open_nid_postfix("/parent-test-mount/slash-open/", 0, 0) == -1 && *__error_nid_postfix() == 20);
     Require(sceKernelUnlink("/parent-test-mount/slash-kernel/") == static_cast<int>(0x80020014u));
+    Require(rename_nid_postfix("/parent-test-mount/slash-remove", "/parent-test-mount/slash-open/") == -1 && *__error_nid_postfix() == 20);
+    Require(stat_nid_postfix("/parent-test-mount/slash-open/", &status) == -1 && *__error_nid_postfix() == 20);
+    Require(access_nid_postfix("/parent-test-mount/slash-open/", 0) == -1 && *__error_nid_postfix() == 20);
+    Require(chmod_nid_postfix("/parent-test-mount/slash-open/", 0644) == -1 && *__error_nid_postfix() == 20);
+    Require(mkdir_nid_postfix("/parent-test-mount/slash-open/", 0755) == -1 && *__error_nid_postfix() == 20);
+    Require(rmdir_nid_postfix("/parent-test-mount/slash-open/") == -1 && *__error_nid_postfix() == 20);
+    Require(sceKernelOpen("/parent-test-mount/slash-open/", 0x601, 0600) == static_cast<int>(0x80020014u));
+    Require(unlink_nid_postfix((root.generic_string() + "/slash-kernel/").c_str()) == -1 && *__error_nid_postfix() == 20);
     for (const char* name : {"slash-unlink", "slash-remove", "slash-rename", "slash-open", "slash-kernel"}) Require(std::filesystem::is_regular_file(root / name));
     Require(!std::filesystem::exists(root / "slash-renamed"));
     Require(sceKernelStat("/parent-test-mount/Existing/", &status) == 0 && (status.st_mode & 0170000) == 0040000);
+    const int listed = sceKernelOpen("/parent-test-mount/Existing/", 0x20000, 0);
+    Require(listed >= 0 && sceKernelClose(listed) == 0);
     Require(mkdir_nid_postfix("/parent-test-mount/slash-directory/", 0755) == 0 && std::filesystem::is_directory(root / "slash-directory"));
     Require(rmdir_nid_postfix("/parent-test-mount/slash-directory/") == 0 && !std::filesystem::exists(root / "slash-directory"));
-#endif
     RemovePathAlias_nid_no_patch("parent-test-mount");
     std::error_code linkError;
     std::filesystem::create_directory_symlink("Existing", root / "directory-link", linkError);
@@ -324,6 +255,7 @@ static void TestRelinkedModuleNames() {
     const auto relinked = original + ".guest.prx";
     FileStat status{};
     Require(sceKernelStat(original.c_str(), &status) == static_cast<int>(0x80020002u));
+    Require(lstat_nid_postfix(original.c_str(), &status) == -1 && *__error_nid_postfix() == 2);
     Require(sceKernelCheckReachability(original.c_str()) == static_cast<int>(0x80020002u));
     Require(sceKernelOpen(original.c_str(), 0, 0) == static_cast<int>(0x80020002u));
     const auto missing = (root / "missing-content.pak").string();
@@ -336,6 +268,7 @@ static void TestRelinkedModuleNames() {
     { std::ofstream file(relinked); file << "relinked"; }
     Require(sceKernelStat(original.c_str(), &status) == 0 && status.st_size == 8);
     Require(stat_nid_postfix(original.c_str(), &status) == 0 && status.st_size == 8);
+    Require(lstat_nid_postfix(original.c_str(), &status) == 0 && status.st_size == 8);
     Require(sceKernelCheckReachability(original.c_str()) == 0);
     const int opened = sceKernelOpen(original.c_str(), 0, 0);
     Require(opened >= 0 && sceKernelClose(opened) == 0);
@@ -480,6 +413,7 @@ static void TestMissingPathListsDirectoryOnce() {
     bool ambiguous = false;
     try {
         sceKernelStat((root / "PLUGIN.prx").generic_string().c_str(), &status);
+
     } catch (const std::runtime_error&) {
         ambiguous = true;
     }
@@ -655,16 +589,20 @@ int main() {
             Require(fread_nid_postfix(unread, 1, sizeof(unread), directoryStream) == 0 && *__error_nid_postfix() == 21);
             Require(ferror_nid_postfix(directoryStream) != 0 && feof_nid_postfix(directoryStream) == 0);
             clearerr_nid_postfix(directoryStream);
+
             Require(ferror_nid_postfix(directoryStream) == 0);
             *__error_nid_postfix() = 0;
             Require(fgetc_nid_postfix(directoryStream) == -1 && *__error_nid_postfix() == 21 && ferror_nid_postfix(directoryStream) != 0);
             clearerr_nid_postfix(directoryStream);
+
             *__error_nid_postfix() = 0;
             Require(fgets_nid_postfix(unread, sizeof(unread), directoryStream) == nullptr && *__error_nid_postfix() == 21 && ferror_nid_postfix(directoryStream) != 0);
             clearerr_nid_postfix(directoryStream);
+
             *__error_nid_postfix() = 0;
             Require(fscanf_nid_postfix(directoryStream, "%d", &scanned) == -1 && *__error_nid_postfix() == 21 && ferror_nid_postfix(directoryStream) != 0);
             clearerr_nid_postfix(directoryStream);
+
             Require(fseek_nid_postfix(directoryStream, 0, 0) == 0 && ftell_nid_postfix(directoryStream) == 0);
             *__error_nid_postfix() = 0;
             Require(fputc_nid_postfix('x', directoryStream) == -1 && *__error_nid_postfix() == 9 && ferror_nid_postfix(directoryStream) != 0);
@@ -696,6 +634,27 @@ int main() {
     Require(chflags_nid_postfix(file.string().c_str(), 0x200000) == -1 && *__error_nid_postfix() == 1);
     Require(ChflagsThrows(file, 0x2, "UF_IMMUTABLE"));
     Require(ChflagsThrows(file, 0x1000 | 0x40000, "UF_READONLY|SF_APPEND"));
+    const auto chflagsDangling = root / "dangling.link";
+    const auto chflagsPointing = root / "file.link";
+#ifdef _WIN32
+    const bool chflagsLinked = CreateSymbolicLinkW(chflagsDangling.wstring().c_str(), L"missing.bin", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0 &&
+        CreateSymbolicLinkW(chflagsPointing.wstring().c_str(), L"file.txt", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0;
+#else
+    std::error_code chflagsLinkError;
+    std::filesystem::create_symlink("missing.bin", chflagsDangling, chflagsLinkError);
+    if (!chflagsLinkError) std::filesystem::create_symlink("file.txt", chflagsPointing, chflagsLinkError);
+    const bool chflagsLinked = !chflagsLinkError;
+#endif
+    if (chflagsLinked) {
+        Require(chflags_nid_postfix(chflagsDangling.string().c_str(), 0) == -1 && *__error_nid_postfix() == 2);
+        Require(chflags_nid_postfix(chflagsPointing.string().c_str(), 0) == 0);
+        Require(chflags_nid_postfix((chflagsPointing.string() + "/").c_str(), 0) == -1 && *__error_nid_postfix() == 20);
+        Require(chflags_nid_postfix(chflagsPointing.string().c_str(), 0x20) == -1 && *__error_nid_postfix() == 45);
+        Require(unlink_nid_postfix(chflagsDangling.string().c_str()) == 0 && unlink_nid_postfix(chflagsPointing.string().c_str()) == 0);
+    } else {
+        unlink_nid_postfix(chflagsDangling.string().c_str());
+        std::fprintf(stderr, "symbolic links unavailable: the chflags link cases not tested\n");
+    }
     const int flagged = open_nid_postfix(file.string().c_str(), 0, 0);
     Require(flagged >= 0 && fchflags_nid_postfix(flagged, 0) == 0);
     Require(fchflags_nid_postfix(flagged, 0x20) == -1 && *__error_nid_postfix() == 45);
@@ -708,8 +667,33 @@ int main() {
     Require(fchflags_nid_postfix(flagged, 0) == -1 && *__error_nid_postfix() == 9);
     Require(fchflags_nid_postfix(flagged, ~0ULL) == -1 && *__error_nid_postfix() == 9);
     Require(fchflags_nid_postfix(-1, 0) == -1 && *__error_nid_postfix() == 9);
+    const int flaggedKqueue = kqueue_nid_postfix();
+    Require(flaggedKqueue >= 0);
+    Require(fchflags_nid_postfix(flaggedKqueue, 0) == -1 && *__error_nid_postfix() == 22);
+    Require(close_nid_postfix(flaggedKqueue) == 0);
     const int flaggedRoot = sceKernelOpen(root.string().c_str(), 0x20000, 0);
     Require(flaggedRoot >= 0 && fchflags_nid_postfix(flaggedRoot, 0) == 0 && sceKernelClose(flaggedRoot) == 0);
+    const auto exclusiveLink = root / "exclusive.link";
+    const auto exclusiveTarget = root / "exclusive-target.txt";
+#ifdef _WIN32
+    const bool exclusiveLinked = CreateSymbolicLinkW(exclusiveLink.wstring().c_str(), L"exclusive-target.txt",
+        SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0;
+#else
+    std::error_code exclusiveLinkError;
+    std::filesystem::create_symlink("exclusive-target.txt", exclusiveLink, exclusiveLinkError);
+    const bool exclusiveLinked = !exclusiveLinkError;
+#endif
+    if (exclusiveLinked) {
+        Require(open_nid_postfix(exclusiveLink.string().c_str(), 0xa01, 0644) == -1 && *__error_nid_postfix() == 17);
+        Require(sceKernelOpen(exclusiveLink.string().c_str(), 0xa01, 0644) == static_cast<int>(0x80020011u));
+        Require(!std::filesystem::exists(exclusiveTarget));
+        const int exclusiveCreated = open_nid_postfix(exclusiveLink.string().c_str(), 0x201, 0644);
+        Require(exclusiveCreated >= 0 && close_nid_postfix(exclusiveCreated) == 0 && std::filesystem::is_regular_file(exclusiveTarget));
+        Require(open_nid_postfix(exclusiveLink.string().c_str(), 0xa01, 0644) == -1 && *__error_nid_postfix() == 17);
+        Require(unlink_nid_postfix(exclusiveLink.string().c_str()) == 0 && unlink_nid_postfix(exclusiveTarget.string().c_str()) == 0);
+    } else {
+        std::fprintf(stderr, "symbolic links unavailable: the O_EXCL link cases not tested\n");
+    }
     int flaggedPipe[2];
     Require(pipe_nid_postfix(flaggedPipe) == 0);
     Require(fchflags_nid_postfix(flaggedPipe[0], 0) == -1 && *__error_nid_postfix() == 22);
@@ -836,6 +820,7 @@ int main() {
             Require(held != INVALID_HANDLE_VALUE);
             const int result = kernel ? sceKernelRename(name(lockedSource).c_str(), name(preservedTarget).c_str()) :
                 rename_nid_postfix(name(lockedSource).c_str(), name(preservedTarget).c_str());
+
             Require(CloseHandle(held) != 0);
             Require(result != 0 && std::filesystem::is_regular_file(marker));
             if (!std::filesystem::is_directory(preservedTarget))
@@ -906,6 +891,37 @@ int main() {
     };
     Require(sceKernelFchmod(descriptor, 0400) == 0 && !ownerWrite());
     Require(fchmod_nid_postfix(descriptor, 0600) == 0 && ownerWrite());
+    const auto sizedLink = sized.parent_path() / "sized.link";
+    const auto missingLink = sized.parent_path() / "missing.link";
+    const auto loopLink = sized.parent_path() / "loop.link";
+#ifdef _WIN32
+    const DWORD linkFlags = SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE;
+    const bool chmodLinked = CreateSymbolicLinkW(sizedLink.wstring().c_str(), sized.filename().wstring().c_str(), linkFlags) &&
+        CreateSymbolicLinkW(missingLink.wstring().c_str(), L"missing.bin", linkFlags) &&
+        CreateSymbolicLinkW(loopLink.wstring().c_str(), L"loop.link", linkFlags);
+#else
+    std::error_code chmodLinkError;
+    std::filesystem::create_symlink(sized.filename(), sizedLink, chmodLinkError);
+    if (!chmodLinkError) std::filesystem::create_symlink("missing.bin", missingLink, chmodLinkError);
+    if (!chmodLinkError) std::filesystem::create_symlink("loop.link", loopLink, chmodLinkError);
+    const bool chmodLinked = !chmodLinkError;
+#endif
+    if (chmodLinked) {
+        Require(chmod_nid_postfix(sizedLink.string().c_str(), 0400) == 0 && !ownerWrite());
+#ifdef _WIN32
+        Require((GetFileAttributesW(sizedLink.wstring().c_str()) & FILE_ATTRIBUTE_READONLY) == 0);
+#endif
+        Require(chmod_nid_postfix(sizedLink.string().c_str(), 0600) == 0 && ownerWrite());
+        Require(chmod_nid_postfix(missingLink.string().c_str(), 0600) == -1 && *__error_nid_postfix() == 2);
+#ifdef _WIN32
+        Require(chmod_nid_postfix(loopLink.string().c_str(), 0600) == -1 && *__error_nid_postfix() == 62);
+#endif
+    } else {
+        std::fprintf(stderr, "symbolic links unavailable: the chmod link cases not tested\n");
+    }
+    unlink_nid_postfix(sizedLink.string().c_str());
+    unlink_nid_postfix(missingLink.string().c_str());
+    unlink_nid_postfix(loopLink.string().c_str());
     Require(sceKernelFtruncate(descriptor, 3) == 0);
     FileStat times{};
     const KernelTimeval past[2]{{1000000000, 0}, {1000000000, 500000}};
@@ -943,6 +959,8 @@ int main() {
         Require(fsync_nid_postfix(end) == -1 && *__error_nid_postfix() == 22);
         Require(fdatasync_nid_postfix(end) == -1 && *__error_nid_postfix() == 22);
         Require(sceKernelFsync(end) == static_cast<int>(0x80020016u) && sceKernelFdatasync(end) == static_cast<int>(0x80020016u));
+        Require(fchmod_nid_postfix(end, 0600) == -1 && *__error_nid_postfix() == 22);
+        Require(sceKernelFchmod(end, 0600) == static_cast<int>(0x80020016u));
     }
     Require(close_nid_postfix(syncPipe[0]) == 0 && close_nid_postfix(syncPipe[1]) == 0);
     Require(close_nid_postfix(socket) == 0);
@@ -1101,6 +1119,18 @@ int main() {
         Require(stat_nid_postfix(fileLink.string().c_str(), &followed) == 0 && (followed.st_mode & 0170000) == 0100000);
         Require(followed.st_ino == status.st_ino && linkStatus.st_ino != status.st_ino && linkStatus.st_dev == status.st_dev);
         Require(stat_nid_postfix(directoryLink.string().c_str(), &followed) == 0 && (followed.st_mode & 0170000) == 0040000);
+        const auto renameThroughLoop = statLoop.string() + "\\inside";
+        const auto renameTarget = (root / "rename-target").string();
+        Require(sceKernelRename(renameThroughLoop.c_str(), renameTarget.c_str()) == static_cast<int>(0x8002003eu));
+        Require(rename_nid_postfix(renameThroughLoop.c_str(), renameTarget.c_str()) == -1 && *__error_nid_postfix() == 62);
+        Require(sceKernelRename(present.string().c_str(), renameThroughLoop.c_str()) == static_cast<int>(0x8002003eu));
+        Require(rename_nid_postfix(present.string().c_str(), renameThroughLoop.c_str()) == -1 && *__error_nid_postfix() == 62);
+        const auto missingSource = (root / "missing-source").string();
+        const auto underFile = present.string() + "\\child";
+        Require(sceKernelRename(missingSource.c_str(), renameThroughLoop.c_str()) == static_cast<int>(0x80020002u));
+        Require(rename_nid_postfix(missingSource.c_str(), renameThroughLoop.c_str()) == -1 && *__error_nid_postfix() == 2);
+        Require(sceKernelRename(underFile.c_str(), renameThroughLoop.c_str()) == static_cast<int>(0x80020014u));
+        Require(rename_nid_postfix(underFile.c_str(), renameThroughLoop.c_str()) == -1 && *__error_nid_postfix() == 20);
         Require(stat_nid_postfix(fileLink.string().c_str(), &status) == 0 && status.st_size == 5);
         FileStat absoluteStatus{};
         Require(lstat_nid_postfix(absoluteLink.string().c_str(), &absoluteStatus) == 0);
@@ -1290,13 +1320,18 @@ int main() {
     const int directoryDescriptor = open_nid_postfix(rootName.c_str(), 0, 0);
     Require(directoryDescriptor >= 0);
     char directoryBytes[8]{};
-    struct { void* base; std::size_t length; } directoryVector[2] = {{directoryBytes, 3}, {directoryBytes + 3, 5}};
+    KernelIovec directoryVector[2] = {{directoryBytes, 3}, {directoryBytes + 3, 5}};
     Require(read_nid_postfix(directoryDescriptor, directoryBytes, sizeof(directoryBytes)) == -1 && *__error_nid_postfix() == 21);
     Require(sceKernelRead(directoryDescriptor, directoryBytes, sizeof(directoryBytes)) == static_cast<int>(0x80020015u));
     Require(sceKernelReadv(directoryDescriptor, directoryVector, 2) == static_cast<int>(0x80020015u));
     Require(sceKernelPread(directoryDescriptor, directoryBytes, sizeof(directoryBytes), 0) == static_cast<int>(0x80020015u));
     Require(sceKernelPreadv(directoryDescriptor, directoryVector, 2, 0) == static_cast<int>(0x80020015u));
     Require(sceKernelPwrite(directoryDescriptor, "x", 1, 0) == static_cast<int>(0x80020009u));
+    Require(sceKernelWrite(directoryDescriptor, "x", 1) == static_cast<int>(0x80020009u));
+    Require(write_nid_postfix(directoryDescriptor, "x", 1) == -1 && *__error_nid_postfix() == 9);
+    Require(pwrite_nid_disambig1_nid_postfix(directoryDescriptor, "x", 1, 0) == -1 && *__error_nid_postfix() == 9);
+    Require(sceKernelWritev(directoryDescriptor, directoryVector, 2) == static_cast<int>(0x80020009u));
+    Require(sceKernelPwritev(directoryDescriptor, directoryVector, 2, 0) == static_cast<int>(0x80020009u));
     std::vector<char> listing(4096);
     Require(sceKernelGetdents(directoryDescriptor, listing.data(), static_cast<int>(listing.size())) > 0);
     const int plainFile = open_nid_postfix(presentName.c_str(), 0, 0);
@@ -1516,14 +1551,18 @@ int main() {
         Require(std::memcmp(first, second, sizeof(first)) != 0);
         Require(feof_nid_postfix(stream) == 0 && ferror_nid_postfix(stream) == 0);
         flockfile_nid_postfix(stream);
+
         Require(fread_nid_postfix(first, 1, 4, stream) == 4);
         funlockfile_nid_postfix(stream);
+
         Require(ftrylockfile_nid_postfix(stream) == 0);
         funlockfile_nid_postfix(stream);
+
         Require(fflush_nid_postfix(stream) == 0);
         bool unsupported = false;
         try {
             fgetc_nid_postfix(stream);
+
         } catch (const std::runtime_error&) {
             unsupported = true;
         }
@@ -1533,6 +1572,7 @@ int main() {
             bool rejected = false;
             try {
                 fopen_nid_postfix(device, mode);
+
             } catch (const std::runtime_error&) {
                 rejected = true;
             }
diff --git a/core/libs/tests/GuestFiopen.cpp b/core/libs/tests/GuestFiopen.cpp
index 276459ec07..b5d8e930bd 100644
--- a/core/libs/tests/GuestFiopen.cpp
+++ b/core/libs/tests/GuestFiopen.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -7,14 +8,6 @@
 #include <filesystem>
 #include <string>
 
-extern "C" {
-FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char*, int, int);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fopen_s_nid_postfix(FileStream**, const char*, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-std::int64_t APS5_VABI ftello_nid_postfix(FileStream*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Fiopen check failed at line %d\n", line);
@@ -38,6 +31,7 @@ static std::string Contents(const char* name) {
     std::string text;
     for (int c; (c = std::fgetc(stream->GetHandle())) != EOF;) text += static_cast<char>(c);
     fclose_nid_postfix(stream);
+
     return text;
 }
 
@@ -45,6 +39,7 @@ static void Write(FileStream* stream, const char* text) {
     Require(stream != nullptr);
     Require(std::fputs(text, stream->GetHandle()) >= 0);
     fclose_nid_postfix(stream);
+
 }
 
 static bool Exists(const char* name) {
@@ -87,10 +82,12 @@ int main() {
     auto* stream = Open(file, In);
     Require(stream != nullptr && std::fgetc(stream->GetHandle()) == 'a');
     fclose_nid_postfix(stream);
+
     stream = Open(file, In);
     Require(stream != nullptr);
     std::fputc('x', stream->GetHandle());
     fclose_nid_postfix(stream);
+
     Require(Contents(file) == "abc");
 
     Write(Open(file, App), "d");
@@ -101,6 +98,7 @@ int main() {
     stream = Open(file, In | Ate);
     Require(stream != nullptr && ftello_nid_postfix(stream) == 5);
     fclose_nid_postfix(stream);
+
     stream = Open(file, In | Binary);
     Require(stream != nullptr && ftello_nid_postfix(stream) == 0);
     fclose_nid_postfix(stream);
@@ -112,6 +110,7 @@ int main() {
     stream = Open(file, In | Noreplace);
     Require(stream != nullptr);
     fclose_nid_postfix(stream);
+
     stream = Open(file, In | Binary | Noreplace);
     Require(stream != nullptr);
     fclose_nid_postfix(stream);
@@ -128,6 +127,7 @@ int main() {
     stream = Open(file, In | Out);
     Require(stream != nullptr && std::fgetc(stream->GetHandle()) == 'X');
     fclose_nid_postfix(stream);
+
     Require(Contents(file) == "Xbcdef");
 
     Write(Open(file, In | Out | App), "g");
@@ -152,7 +152,7 @@ int main() {
     Require(stream != nullptr && std::fgetc(stream->GetHandle()) == 'k');
     fclose_nid_postfix(stream);
 
-#ifndef _WIN32
+#ifdef __linux__
     auto* full = std::fopen("/dev/full", "wb");
     Require(full != nullptr);
     auto* fullStream = new FileStream(full, true);
diff --git a/core/libs/tests/GuestFirmwareConstantReturns.cpp b/core/libs/tests/GuestFirmwareConstantReturns.cpp
new file mode 100644
index 0000000000..f88525c988
--- /dev/null
+++ b/core/libs/tests/GuestFirmwareConstantReturns.cpp
@@ -0,0 +1,81 @@
+#include "SceTypes.hpp"
+#include "prx/libSceComposite/libSceComposite.hpp"
+#include "prx/libSceFsInternalForVsh/libSceFsInternalForVsh.hpp"
+#include "prx/libSceHttpCache/libSceHttpCache.hpp"
+#include "prx/libScePlayReady/libScePlayReady.hpp"
+#include "prx/libSceSdma/libSceSdma.hpp"
+#include "prx/libSceSsl/libSceSsl.hpp"
+#include "prx/libSceVisionManager/libSceVisionManager.hpp"
+#include "prx/libmdbg_syscore/libmdbg_syscore.hpp"
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+void CheckComposite() {
+    constexpr int Unsupported = static_cast<int>(0x80d40006);
+    Require(sceCompositorCreateIndirectRenderTarget() == Unsupported);
+    Require(sceCompositorDeleteIndirectRenderTarget() == Unsupported);
+    Require(sceCompositorSetIndirectCanvasCommand() == 0);
+    Require(sceCompositorSetIndirectCompositionCommand() == 0);
+    Require(sceCompositorSetIndirectRenderTargetConfigCommand() == 0);
+}
+
+void CheckFsInternal() {
+    constexpr int KernelNotSupported = static_cast<int>(0x8002002d);
+    Require(sceFsErriCtl() == KernelNotSupported);
+    Require(sceFsErriGetState() == KernelNotSupported);
+}
+
+void CheckHttpCacheAndPlayReady() {
+    Require(sceHttpCacheDebugSetUrl() == 0);
+    Require(scePlayReadyMemGetStats() == static_cast<int>(0x80004001));
+}
+
+void CheckSdma() {
+    constexpr int SdmaError = static_cast<int>(0x809900c9);
+    Require(sceSdmaInitialize() == 0);
+    Require(sceSdmaFinalize() == 0);
+    Require(sceSdmaQueryWorkingBufferSize() == 0x8000);
+    Require(sceSdmaFlushAllWithEvent() == SdmaError);
+    Require(sceSdmaWaitForEvent() == SdmaError);
+}
+
+void CheckSsl() {
+    Require(CRYPTO_uninitAsymmetricKey() == 0);
+    Require(VLONG_freeVlongQueue() == 0);
+}
+
+void CheckVisionManager() {
+    constexpr int VisionError = static_cast<int>(0x80e70004);
+    Require(sceVisionManagerOpen() == VisionError);
+    Require(sceVisionManagerClose() == VisionError);
+    Require(sceVisionManagerRequestFindUser() == VisionError);
+    Require(sceVisionManagerRequestFindUserInRegion() == VisionError);
+    Require(sceVisionManagerRequestFindUserWithoutIdentify() == VisionError);
+    Require(sceVisionManagerRequestRegisterUserInRegion() == VisionError);
+    Require(sceVisionManagerGetResultOfFindUser() == VisionError);
+    Require(sceVisionManagerGetResultOfFindUserInRegion() == VisionError);
+    Require(sceVisionManagerGetResultOfFindUserWithoutIdentify() == VisionError);
+    Require(sceVisionManagerGetResultOfRegisterUserInRegion() == VisionError);
+    Require(sceVisionManagerLoadSettings() == 0);
+}
+
+void CheckDebugSyscore() {
+    Require(sceDebugGetProcessEventCntlFlag() == 1);
+    Require(sceDebugSetProcessEventCntlFlag() == 1);
+}
+
+}
+
+int main() {
+    CheckComposite();
+    CheckFsInternal();
+    CheckHttpCacheAndPlayReady();
+    CheckSdma();
+    CheckSsl();
+    CheckVisionManager();
+    CheckDebugSyscore();
+    return 0;
+}
diff --git a/core/libs/tests/GuestFlexibleMemoryBudget.cpp b/core/libs/tests/GuestFlexibleMemoryBudget.cpp
index cba381e734..2b3b74f051 100644
--- a/core/libs/tests/GuestFlexibleMemoryBudget.cpp
+++ b/core/libs/tests/GuestFlexibleMemoryBudget.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
@@ -12,24 +13,9 @@
 #include <string_view>
 
 extern "C" {
-int APS5_VABI sceKernelConfiguredFlexibleMemorySize(std::size_t*);
-int APS5_VABI sceKernelAvailableFlexibleMemorySize(std::size_t*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelReleaseFlexibleMemory(void*, std::size_t);
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
+
 std::uint64_t GuestImageSegmentBytes_nid_no_patch();
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-char* APS5_VABI dlerror_nid_postfix();
-int APS5_VABI dlclose_nid_postfix(void*);
-std::size_t APS5_VABI sceKernelGetDirectMemorySize();
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMapDirectMemory2(void**, std::size_t, int, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMapNamedDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t, const char*);
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry*, int, int*, int);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
+
 }
 
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
diff --git a/core/libs/tests/GuestFlexibleMemoryModule.cpp b/core/libs/tests/GuestFlexibleMemoryModule.cpp
index 1bf220a810..10f33287fc 100644
--- a/core/libs/tests/GuestFlexibleMemoryModule.cpp
+++ b/core/libs/tests/GuestFlexibleMemoryModule.cpp
@@ -1,3 +1,37 @@
+#ifdef __APPLE__
+#include "prx/libc/include/specifics/linux/ElfTypes.hpp"
+#include <dlfcn.h>
+#include <cstring>
+#endif
+
 extern "C" {
 unsigned char guestFlexibleMemoryModuleData[512u * 1024u * 1024u] = {};
 }
+
+#ifdef __APPLE__
+namespace {
+
+[[gnu::section("__APS5DATA,__meta"), gnu::used]] alignas(8) std::byte metadata[0x60 + sizeof(Elf64_Phdr)]{};
+
+[[maybe_unused]] const bool described = [] {
+    Dl_info image{};
+    if (dladdr(guestFlexibleMemoryModuleData, &image) == 0) return false;
+    const std::uint64_t loadBias = reinterpret_cast<std::uintptr_t>(image.dli_fbase);
+    Elf64_Phdr header{};
+    header.p_type = PT_LOAD;
+    header.p_flags = PF_R | PF_W;
+    header.p_offset = reinterpret_cast<std::uintptr_t>(guestFlexibleMemoryModuleData) - loadBias;
+    header.p_vaddr = header.p_offset;
+    header.p_paddr = header.p_offset;
+    header.p_memsz = sizeof(guestFlexibleMemoryModuleData);
+    const std::uint64_t version = 2;
+    const std::uint64_t count = 1;
+    std::memcpy(metadata + 0x08, &loadBias, sizeof(loadBias));
+    std::memcpy(metadata + 0x58, &count, sizeof(count));
+    std::memcpy(metadata + 0x60, &header, sizeof(header));
+    std::memcpy(metadata, &version, sizeof(version));
+    return true;
+}();
+
+}
+#endif
diff --git a/core/libs/tests/GuestFloatBuiltins.cpp b/core/libs/tests/GuestFloatBuiltins.cpp
index a64f17eb85..e8051b96c0 100644
--- a/core/libs/tests/GuestFloatBuiltins.cpp
+++ b/core/libs/tests/GuestFloatBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cmath>
@@ -6,75 +7,6 @@
 #include <cstring>
 #include <xmmintrin.h>
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
-extern "C" {
-double APS5_VABI __adddf3_nid_postfix(double, double);
-float APS5_VABI __addsf3_nid_postfix(float, float);
-double APS5_VABI __subdf3_nid_postfix(double, double);
-float APS5_VABI __subsf3_nid_postfix(float, float);
-double APS5_VABI __muldf3_nid_postfix(double, double);
-float APS5_VABI __mulsf3_nid_postfix(float, float);
-double APS5_VABI __divdf3_nid_postfix(double, double);
-float APS5_VABI __divsf3_nid_postfix(float, float);
-double APS5_VABI __negdf2_nid_postfix(double);
-float APS5_VABI __negsf2_nid_postfix(float);
-int APS5_VABI __eqdf2_nid_postfix(double, double);
-int APS5_VABI __nedf2_nid_postfix(double, double);
-int APS5_VABI __ltdf2_nid_postfix(double, double);
-int APS5_VABI __ledf2_nid_postfix(double, double);
-int APS5_VABI __gtdf2_nid_postfix(double, double);
-int APS5_VABI __gedf2_nid_postfix(double, double);
-int APS5_VABI __unorddf2_nid_postfix(double, double);
-int APS5_VABI __eqsf2_nid_postfix(float, float);
-int APS5_VABI __ltsf2_nid_postfix(float, float);
-int APS5_VABI __gesf2_nid_postfix(float, float);
-int APS5_VABI __unordsf2_nid_postfix(float, float);
-double APS5_VABI __extendsfdf2_nid_postfix(float);
-float APS5_VABI __truncdfsf2_nid_postfix(double);
-std::int32_t APS5_VABI __fixsfsi_nid_postfix(float);
-std::int64_t APS5_VABI __fixsfdi_nid_postfix(float);
-Int128 APS5_VABI __fixsfti_nid_postfix(float);
-std::int32_t APS5_VABI __fixdfsi_nid_postfix(double);
-std::int64_t APS5_VABI __fixdfdi_nid_postfix(double);
-Int128 APS5_VABI __fixdfti_nid_postfix(double);
-std::uint32_t APS5_VABI __fixunssfsi_nid_postfix(float);
-std::uint64_t APS5_VABI __fixunssfdi_nid_postfix(float);
-Uint128 APS5_VABI __fixunssfti_nid_postfix(float);
-std::uint32_t APS5_VABI __fixunsdfsi_nid_postfix(double);
-std::uint64_t APS5_VABI __fixunsdfdi_nid_postfix(double);
-Uint128 APS5_VABI __fixunsdfti_nid_postfix(double);
-std::int64_t APS5_VABI __fixxfdi_nid_postfix(long double);
-Int128 APS5_VABI __fixxfti_nid_postfix(long double);
-std::uint32_t APS5_VABI __fixunsxfsi_nid_postfix(long double);
-std::uint64_t APS5_VABI __fixunsxfdi_nid_postfix(long double);
-Uint128 APS5_VABI __fixunsxfti_nid_postfix(long double);
-double APS5_VABI __floatsidf_nid_postfix(std::int32_t);
-double APS5_VABI __floatunsidf_nid_postfix(std::uint32_t);
-float APS5_VABI __floatsisf_nid_postfix(std::int32_t);
-float APS5_VABI __floatunsisf_nid_postfix(std::uint32_t);
-double APS5_VABI __floatdidf_nid_postfix(std::int64_t);
-float APS5_VABI __floatdisf_nid_postfix(std::int64_t);
-long double APS5_VABI __floatdixf_nid_postfix(std::int64_t);
-double APS5_VABI __floatundidf_nid_postfix(std::uint64_t);
-float APS5_VABI __floatundisf_nid_postfix(std::uint64_t);
-long double APS5_VABI __floatundixf_nid_postfix(std::uint64_t);
-double APS5_VABI __floattidf_nid_postfix(Int128);
-float APS5_VABI __floattisf_nid_postfix(Int128);
-long double APS5_VABI __floattixf_nid_postfix(Int128);
-double APS5_VABI __floatuntidf_nid_postfix(Uint128);
-float APS5_VABI __floatuntisf_nid_postfix(Uint128);
-long double APS5_VABI __floatuntixf_nid_postfix(Uint128);
-__complex__ float APS5_VABI __mulsc3_nid_postfix(float, float, float, float);
-__complex__ double APS5_VABI __muldc3_nid_postfix(double, double, double, double);
-__complex__ long double APS5_VABI __mulxc3_nid_postfix(long double, long double, long double, long double);
-__complex__ float APS5_VABI __divsc3_nid_postfix(float, float, float, float);
-__complex__ double APS5_VABI __divdc3_nid_postfix(double, double, double, double);
-__complex__ long double APS5_VABI __divxc3_nid_postfix(long double, long double, long double, long double);
-long double APS5_VABI __powixf2_nid_postfix(long double, int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::uint64_t Bits(double value) { return std::bit_cast<std::uint64_t>(value); }
diff --git a/core/libs/tests/GuestFloatingPoint.cpp b/core/libs/tests/GuestFloatingPoint.cpp
index 3ea9884bb0..6d9afd5ae6 100644
--- a/core/libs/tests/GuestFloatingPoint.cpp
+++ b/core/libs/tests/GuestFloatingPoint.cpp
@@ -1,29 +1,22 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <barrier>
 #include <cstdint>
+#include <cstddef>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 #include <thread>
 #include <xmmintrin.h>
-
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-void APS5_VABI _Feraise_nid_postfix(int);
-int APS5_VABI fegetround_nid_postfix();
-int APS5_VABI fesetround_nid_postfix(int);
-int APS5_VABI fetestexcept_nid_postfix(int);
-int APS5_VABI feclearexcept_nid_postfix(int);
-int APS5_VABI fegetexceptflag_nid_postfix(std::uint16_t*, int);
-int APS5_VABI fesetexceptflag_nid_postfix(const std::uint16_t*, int);
-int APS5_VABI feenableexcept_nid_postfix(int);
-int APS5_VABI fedisableexcept_nid_postfix(int);
-int APS5_VABI __feenableexcept_nid_postfix(int);
-int APS5_VABI __fedisableexcept_nid_postfix(int);
-int APS5_VABI fegettrapenable_nid_postfix();
-int APS5_VABI fesettrapenable_nid_postfix(int);
-}
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
 
 namespace {
 
@@ -44,6 +37,10 @@ void WriteEnvironment(const Environment& state) {
     _mm_setcsr(state.sse);
 }
 
+bool SameControlState(const Environment& left, const Environment& right) {
+    return left.x87[0] == right.x87[0] && left.x87[1] == right.x87[1] && left.sse == right.sse;
+}
+
 void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "floating-point environment: %s\n", message);
@@ -60,6 +57,28 @@ Environment SeedFlags(unsigned x87, unsigned sse) {
     return ReadEnvironment();
 }
 
+void CheckEnabledExceptions() {
+    const auto seeded = SeedFlags(0, 0);
+    for (unsigned x87 = 0; x87 <= 0x3f; ++x87) {
+        for (unsigned sse = 0; sse <= 0x3f; ++sse) {
+            auto state = seeded;
+            state.x87[0] = (state.x87[0] & ~0xc3fu) | 0x800 | x87;
+            state.x87[1] = (state.x87[1] & ~0x3fu) | (x87 & 0x15u);
+            state.sse = (state.sse & ~0x7fbfu) | 0x2000 | (sse << 7) | (sse & 0x2au);
+            WriteEnvironment(state);
+            *__error_nid_postfix() = 123;
+            const int enabled = fegetexcept_nid_postfix();
+            const int error = *__error_nid_postfix();
+            const auto after = ReadEnvironment();
+            WriteEnvironment(seeded);
+            Require(enabled == static_cast<int>(0x3f ^ x87), "enabled exceptions use the x87 masks independently of SSE");
+            Require(after.x87[0] == state.x87[0] && after.x87[1] == state.x87[1] && after.sse == state.sse,
+                    "enabled exception query preserves control modes and flags");
+            Require(error == 123, "enabled exception query preserves errno");
+        }
+    }
+}
+
 void CheckRounding() {
     const auto seeded = SeedFlags(0x02, 0x10);
     constexpr int modes[] = {0, 0x400, 0x800, 0xc00};
@@ -103,6 +122,7 @@ void CheckFeraise() {
         const auto seeded = SeedFlags(0, 0);
         *__error_nid_postfix() = 0;
         _Feraise_nid_postfix(static_cast<int>(requested));
+
         const unsigned raised = (requested & 0x18) != 0 ? requested | 0x20 : requested;
         const auto state = ReadEnvironment();
         Require((state.x87[1] & 0x3f) == raised && (state.sse & 0x3f) == raised, "_Feraise raises the flags on both units");
@@ -142,6 +162,7 @@ void CheckFlags() {
     traps.x87[0] &= ~0x08u;
     traps.sse &= ~(0x08u << 7);
     WriteEnvironment(traps);
+    traps = ReadEnvironment();
     const std::uint16_t none = 0;
     Require(fesetexceptflag_nid_postfix(&none, 0x01) == 0, "restore with an unmasked exception");
     Require(feclearexcept_nid_postfix(0x02) == 0, "clear with an unmasked exception");
@@ -187,35 +208,156 @@ unsigned SseMasks() {
     return (ReadEnvironment().sse >> 7) & 0x3fu;
 }
 
+bool HostKeepsSseTraps() {
+    const unsigned saved = _mm_getcsr();
+    _mm_setcsr(saved & ~(0x01u << 7));
+    const bool kept = (_mm_getcsr() & (0x01u << 7)) == 0;
+    _mm_setcsr(saved);
+    return kept;
+}
+
 void CheckTraps() {
     const auto seeded = SeedFlags(0, 0);
+    const bool sseKept = HostKeepsSseTraps();
+    const auto sse = [&](unsigned masks) { return sseKept ? masks : 0x3fu; };
+    const auto both = [&](unsigned traps) { return static_cast<int>(0xffffffc0u | (sseKept ? traps : 0u)); };
     Require(feenableexcept_nid_postfix(0x49) == static_cast<int>(0xffffffc0u), "enable reports no previous trap as the console does");
     Require(X87Masks() == 0x36 && fegettrapenable_nid_postfix() == 0x09, "enable unmasks the x87 exceptions");
-    Require(SseMasks() == 0x36, "enable unmasks the SSE exceptions");
-    Require(fedisableexcept_nid_postfix(0x41) == static_cast<int>(0xffffffc9u), "disable returns the traps enabled on both units");
+    Require(SseMasks() == sse(0x36), "enable unmasks the SSE exceptions");
+    Require(fedisableexcept_nid_postfix(0x41) == both(0x09), "disable returns the traps enabled on both units");
     Require(X87Masks() == 0x37 && fegettrapenable_nid_postfix() == 0x08, "disable masks the x87 exception");
-    Require(SseMasks() == 0x37, "disable masks the SSE exception");
-    Require(__feenableexcept_nid_postfix(0x02) == static_cast<int>(0xffffffc8u) && X87Masks() == 0x35, "the internal enable differs");
-    Require(__fedisableexcept_nid_postfix(0x3f) == static_cast<int>(0xffffffcau) && X87Masks() == 0x3f && fegettrapenable_nid_postfix() == 0, "the internal disable differs");
+    Require(SseMasks() == sse(0x37), "disable masks the SSE exception");
+    Require(__feenableexcept_nid_postfix(0x02) == both(0x08) && X87Masks() == 0x35, "the internal enable differs");
+    Require(__fedisableexcept_nid_postfix(0x3f) == both(0x0a) && X87Masks() == 0x3f && fegettrapenable_nid_postfix() == 0, "the internal disable differs");
     Require(fesettrapenable_nid_postfix(0x40) == 1 && X87Masks() == 0x3f, "an out-of-range trap set was accepted");
-    Require(fesettrapenable_nid_postfix(0x10004) == 0 && fegettrapenable_nid_postfix() == 0x04 && SseMasks() == 0x3b, "a trap set did not use the low 16 bits");
-    Require(fesettrapenable_nid_postfix(0x01) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == 0x3a, "a trap set masked enabled traps");
-    Require(fesettrapenable_nid_postfix(0) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == 0x3a, "an empty trap set masked enabled traps");
+    Require(fesettrapenable_nid_postfix(0x10004) == 0 && fegettrapenable_nid_postfix() == 0x04 && SseMasks() == sse(0x3b), "a trap set did not use the low 16 bits");
+    Require(fesettrapenable_nid_postfix(0x01) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == sse(0x3a), "a trap set masked enabled traps");
+    Require(fesettrapenable_nid_postfix(0) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == sse(0x3a), "an empty trap set masked enabled traps");
     auto mixed = ReadEnvironment();
     mixed.x87[0] = (mixed.x87[0] & ~0x3fu) | 0x36;
     mixed.sse = (mixed.sse & ~(0x3fu << 7)) | (0x3au << 7);
     WriteEnvironment(mixed);
-    Require(feenableexcept_nid_postfix(0) == static_cast<int>(0xffffffc1u), "enable reports only the traps enabled on both units");
+    Require(feenableexcept_nid_postfix(0) == both(0x01), "enable reports only the traps enabled on both units");
     Require(fegettrapenable_nid_postfix() == 0x09, "the trap query reads only the x87 control word");
     WriteEnvironment(seeded);
 }
 
-int main() {
+using HoldExcept = int (APS5_VABI*)(Environment*);
+
+void CheckHold(HoldExcept hold, Environment* saved) {
+    const auto before = ReadEnvironment();
+    *__error_nid_postfix() = 123;
+    Require(hold(saved) == 0, "feholdexcept succeeds");
+    const auto after = ReadEnvironment();
+    Require(std::memcmp(saved, &before, sizeof(before)) == 0, "feholdexcept saves the full original environment");
+    Require((after.x87[0] & 0x3f) == 0x3f && (after.sse & 0x1f80) == 0x1f80, "feholdexcept masks both units");
+    Require((after.x87[1] & 0x80ff) == 0 && (after.sse & 0x3f) == 0, "feholdexcept clears pending exceptions");
+    Require((after.x87[1] & ~0x80ffu) == (before.x87[1] & ~0x80ffu), "feholdexcept preserves other x87 status bits");
+    Require((after.x87[0] & ~0x3fu) == (before.x87[0] & ~0x3fu), "feholdexcept preserves x87 control settings");
+    Require((after.sse & ~0x1fbfu) == (before.sse & ~0x1fbfu), "feholdexcept preserves SSE control settings");
+    Require(after.x87[2] == before.x87[2] && std::memcmp(after.x87.data() + 3, before.x87.data() + 3, 16) == 0, "feholdexcept preserves x87 tags and instruction/data state");
+    Require(*__error_nid_postfix() == 123, "feholdexcept preserves errno");
+}
+
+void CheckHoldExcept(HoldExcept hold) {
+    Require(hold != nullptr, "feholdexcept export is missing");
+    static_assert(sizeof(Environment) == 32 && alignof(Environment) == 4 && offsetof(Environment, sse) == 28);
+    const auto original = ReadEnvironment();
+    struct {
+        std::array<unsigned char, 8> before;
+        Environment value;
+        std::array<unsigned char, 8> after;
+    } output;
+    for (unsigned rounding = 0; rounding < 4; ++rounding) {
+        for (unsigned modes = 0; modes < 4; ++modes) {
+            for (unsigned mask = 0; mask < 64; ++mask) {
+                auto state = original;
+                const unsigned sseMask = (mask * 13 + 7) & 0x3f;
+                state.x87[0] = (state.x87[0] & ~0xc3fu) | (rounding << 10) | mask;
+                state.x87[1] = (state.x87[1] & ~0x80ffu) | (mask & 0x25);
+                state.sse = (state.sse & ~0xffffu) | (sseMask << 7) | (sseMask & 0x1a) | (((rounding + 1) & 3) << 13) | ((modes & 1) << 6) | ((modes & 2) << 14);
+                WriteEnvironment(state);
+                std::memset(&output, 0xa5, sizeof(output));
+                CheckHold(hold, &output.value);
+                for (const auto byte : output.before) Require(byte == 0xa5, "feholdexcept underwrites output");
+                for (const auto byte : output.after) Require(byte == 0xa5, "feholdexcept overwrites output");
+            }
+        }
+    }
+    WriteEnvironment(original);
+    bool threw = false;
+    try { hold(nullptr); } catch (const std::invalid_argument&) { threw = true; }
+    Require(threw, "feholdexcept rejects null storage");
+    const auto afterNull = ReadEnvironment();
+    Require(SameControlState(original, afterNull), "null feholdexcept preserves the environment");
+#ifdef _WIN32
+    SYSTEM_INFO info{};
+    GetSystemInfo(&info);
+    const std::size_t page = info.dwPageSize;
+    auto* memory = static_cast<unsigned char*>(VirtualAlloc(nullptr, page * 2, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+    Require(memory != nullptr, "allocate feholdexcept guard pages");
+    DWORD oldProtection;
+    Require(VirtualProtect(memory + page, page, PAGE_NOACCESS, &oldProtection) != 0, "protect feholdexcept trailing page");
+#else
+    const auto page = static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+    auto* memory = static_cast<unsigned char*>(mmap(nullptr, page * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+    Require(memory != MAP_FAILED, "allocate feholdexcept guard pages");
+    Require(mprotect(memory + page, page, PROT_NONE) == 0, "protect feholdexcept trailing page");
+#endif
+    CheckHold(hold, reinterpret_cast<Environment*>(memory + page - sizeof(Environment)));
+#ifdef _WIN32
+    Require(VirtualFree(memory, 0, MEM_RELEASE) != 0, "release feholdexcept guard pages");
+#else
+    Require(munmap(memory, page * 2) == 0, "release feholdexcept guard pages");
+#endif
+    WriteEnvironment(original);
+    std::barrier ready(2);
+    const auto worker = [&](unsigned mode) {
+        const auto saved = ReadEnvironment();
+        auto state = saved;
+        state.x87[0] = (state.x87[0] & ~0xc00u) | (mode << 10) | 0x3f;
+        state.x87[1] &= ~0x80ffu;
+        state.sse |= 0x1f80;
+        state.sse &= ~0x3fu;
+        WriteEnvironment(state);
+        ready.arrive_and_wait();
+        Environment output;
+        CheckHold(hold, &output);
+        ready.arrive_and_wait();
+        Require(fegetround_nid_postfix() == static_cast<int>(mode << 10), "feholdexcept keeps thread-local rounding");
+        WriteEnvironment(saved);
+    };
+    std::thread first(worker, 1);
+    std::thread second(worker, 2);
+    first.join();
+    second.join();
+    const auto afterThreads = ReadEnvironment();
+    Require(SameControlState(original, afterThreads), "feholdexcept workers preserve the main environment");
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 2, "expected libc path");
+#ifdef _WIN32
+    const auto library = LoadLibraryA(argv[1]);
+    Require(library != nullptr, "load libc for feholdexcept");
+    const auto hold = reinterpret_cast<HoldExcept>(GetProcAddress(library, "feholdexcept_nid_postfix"));
+#else
+    const auto library = dlopen(argv[1], RTLD_NOW);
+    Require(library != nullptr, "load libc for feholdexcept");
+    const auto hold = reinterpret_cast<HoldExcept>(dlsym(library, "feholdexcept_nid_postfix"));
+#endif
     const auto original = ReadEnvironment();
     CheckRounding();
+    CheckEnabledExceptions();
     CheckFlags();
     CheckTraps();
     CheckThreads();
+    CheckHoldExcept(hold);
     WriteEnvironment(original);
+#ifdef _WIN32
+    FreeLibrary(library);
+#else
+    dlclose(library);
+#endif
     std::puts("floating-point environment checks passed");
 }
diff --git a/core/libs/tests/GuestFminf.cpp b/core/libs/tests/GuestFminf.cpp
index fcf48171a6..a414e26444 100644
--- a/core/libs/tests/GuestFminf.cpp
+++ b/core/libs/tests/GuestFminf.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cfenv>
 #include <cmath>
@@ -5,15 +6,6 @@
 #include <cstdlib>
 #include <limits>
 
-extern "C" {
-double APS5_VABI fmin_nid_postfix(double, double);
-float APS5_VABI fminf_nid_postfix(float, float);
-long double APS5_VABI fminl_nid_postfix(long double, long double);
-double APS5_VABI fmax_nid_postfix(double, double);
-float APS5_VABI fmaxf_nid_postfix(float, float);
-long double APS5_VABI fmaxl_nid_postfix(long double, long double);
-}
-
 static void Check(bool condition, const char* name, int line) {
     if (!condition) {
         std::fprintf(stderr, "%s check failed at line %d\n", name, line);
diff --git a/core/libs/tests/GuestFnmatch.cpp b/core/libs/tests/GuestFnmatch.cpp
index 32b4e5b16e..8ed07dc566 100644
--- a/core/libs/tests/GuestFnmatch.cpp
+++ b/core/libs/tests/GuestFnmatch.cpp
@@ -1,15 +1,86 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <stdexcept>
-extern "C" int APS5_VABI fnmatch_nid_postfix(const char*, const char*, int);
+#include <clocale>
+#include <cctype>
+#include <string>
+
 struct Case {
     const char* pattern;
     const char* string;
     int flags;
     int result;
 };
+static void Require(bool value) {
+    if (!value) {
+        std::fputs("Guest byte case check failed\n", stderr);
+        std::abort();
+    }
+}
+
+static int FoldCByte(int byte) {
+    return byte >= 'A' && byte <= 'Z' ? byte + 'a' - 'A' : byte;
+}
+
+static void CheckCaseInsensitiveBytePairs() {
+    for (int a = 0; a < 256; ++a) {
+        for (int b = 0; b < 256; ++b) {
+            char left[] = {static_cast<char>(a), 0};
+            char right[] = {static_cast<char>(b), 0};
+            const int expected = FoldCByte(a) - FoldCByte(b);
+            const int sign = (expected > 0) - (expected < 0);
+            Require(strcasecmp_nid_postfix(left, right) == sign);
+            Require(strncasecmp_nid_postfix(left, right, 0) == 0);
+            Require(strncasecmp_nid_postfix(left, right, 1) == sign);
+            Require(strncasecmp_nid_postfix(left, right, 2) == sign);
+            const char* match = b == 0 || expected == 0 ? left : nullptr;
+            Require(strcasestr_nid_postfix(left, right) == match);
+            const char pattern[] = {'\\', static_cast<char>(a), 0};
+            Require(fnmatch_nid_postfix(a == 0 ? pattern + 1 : pattern, right, 0x10) == (expected == 0 ? 0 : 1));
+            Require(static_cast<unsigned char>(left[0]) == a && left[1] == 0);
+            Require(static_cast<unsigned char>(right[0]) == b && right[1] == 0);
+        }
+    }
+    const char left = 'A', right = 'a';
+    Require(strncasecmp_nid_postfix(&left, &right, 0) == 0);
+    Require(strncasecmp_nid_postfix(&left, &right, 1) == 0);
+    const char repeated[] = "AaAaBAaAaC";
+    Require(strcasestr_nid_postfix(repeated, "aaac") == repeated + 6);
+    Require(strcasestr_nid_postfix(repeated, "aAa") == repeated);
+    Require(strcasestr_nid_postfix(repeated, "aaad") == nullptr);
+    Require(strcasecmp_nid_postfix("AbC", "aBcD") == -1);
+    Require(strncasecmp_nid_postfix("AbC", "aBcD", 3) == 0);
+    Require(strncasecmp_nid_postfix("AbC", "aBcD", 4) == -1);
+}
+
+static void CheckCaseInsensitiveHostLocale() {
+    const char* original = std::setlocale(LC_CTYPE, nullptr);
+    Require(original != nullptr);
+    struct RestoreLocale {
+        std::string name;
+        ~RestoreLocale() { Require(std::setlocale(LC_CTYPE, name.c_str()) != nullptr); }
+    } restore{original};
+    Require(std::setlocale(LC_CTYPE, "C") != nullptr);
+    CheckCaseInsensitiveBytePairs();
+    bool exercised = false;
+    for (const char* name : {".1252", "English_United States.1252", "en_US.ISO8859-1", "de_DE.ISO8859-1",
+                             "en_US.iso88591", "tr_TR.ISO8859-9", "Turkish_Turkey.1254", "tr_TR.UTF-8"}) {
+        if (!std::setlocale(LC_CTYPE, name)) continue;
+        bool changed = false;
+        for (int byte = 0; byte < 256; ++byte) changed |= std::tolower(byte) != FoldCByte(byte);
+        if (!changed) continue;
+        std::fprintf(stderr, "Checking guest byte comparisons with host LC_CTYPE=%s\n", name);
+        CheckCaseInsensitiveBytePairs();
+        exercised = true;
+    }
+    if (!exercised) std::fputs("No installed locale changes host byte case folding; host-locale regression skipped\n", stderr);
+}
+
 int main() {
+    CheckCaseInsensitiveHostLocale();
     static const Case cases[] = {
         {"*.txt", "notes.txt", 0x00, 0},
         {"*.txt", "notes.TXT", 0x00, 1},
@@ -71,6 +142,7 @@ int main() {
     bool threw = false;
     try {
         fnmatch_nid_postfix(nullptr, "x", 0);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestFont.cpp b/core/libs/tests/GuestFont.cpp
index 5fc1104e79..093c88fe45 100644
--- a/core/libs/tests/GuestFont.cpp
+++ b/core/libs/tests/GuestFont.cpp
@@ -1,8 +1,11 @@
+#include "prx/libSceFontFt/include/Api.hpp"
+#include "prx/libSceFont/include/Api.hpp"
 #include "prx/libSceFont/include/FontDriver.hpp"
 #include "prx/libc/include/General.hpp"
 #include "tests/FontFixture.hpp"
 #include <array>
 #include <cstddef>
+#include <cmath>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -16,72 +19,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceFontMemoryInit(FontMemory*, void*, std::uint32_t, const FontMemoryInterface*, void*, FontMemoryDestroyFunction, void*);
-int APS5_VABI sceFontMemoryTerm(FontMemory*);
-int APS5_VABI sceFontCreateLibrary(const FontMemory*, const void*, FontLibrary*);
-int APS5_VABI sceFontDestroyLibrary(FontLibrary*);
-int APS5_VABI sceFontCreateRenderer(const FontMemory*, const void*, FontRenderer*);
-int APS5_VABI sceFontDestroyRenderer(FontRenderer*);
-int APS5_VABI sceFontGetPixelResolution(FontLibrary, std::uint32_t*);
-int APS5_VABI sceFontAttachDeviceCacheBuffer(FontLibrary, void*, std::uint32_t);
-int APS5_VABI sceFontClearDeviceCache(FontLibrary);
-int APS5_VABI sceFontDettachDeviceCacheBuffer(FontLibrary, void**, std::uint32_t*);
-int APS5_VABI sceFontSupportSystemFonts(FontLibrary);
-int APS5_VABI sceFontSupportExternalFonts(FontLibrary, std::uint32_t, std::uint32_t);
-int APS5_VABI sceFontOpenFontSet(FontLibrary, std::uint32_t, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontMemory(FontLibrary, const void*, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontFile(FontLibrary, const char*, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontCloseFont(FontHandle);
-int APS5_VABI sceFontSetScriptLanguage(FontHandle, int, int);
-int APS5_VABI sceFontGetScriptLanguage(FontHandle, int, int*);
-int APS5_VABI sceFontSetTypographicDesign(FontHandle, int, int);
-int APS5_VABI sceFontGetTypographicDesign(FontHandle, int, int*);
-int APS5_VABI sceFontDefineAttribute(FontHandle, int, int*);
-int APS5_VABI sceFontGetAttribute(FontHandle, int, int*);
-int APS5_VABI sceFontSetResolutionDpi(FontHandle, std::uint32_t, std::uint32_t);
-int APS5_VABI sceFontGetResolutionDpi(FontHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceFontSetScalePixel(FontHandle, float, float);
-int APS5_VABI sceFontBindRenderer(FontHandle, FontRenderer);
-int APS5_VABI sceFontUnbindRenderer(FontHandle);
-int APS5_VABI sceFontSetupRenderScalePixel(FontHandle, float, float);
-int APS5_VABI sceFontSetupRenderScalePoint(FontHandle, float, float);
-int APS5_VABI sceFontGetKerning(FontHandle, std::uint32_t, std::uint32_t, FontKerning*);
-int APS5_VABI sceFontGetFontGlyphsCount(FontHandle, std::uint32_t*);
-int APS5_VABI sceFontGetCharGlyphCode(FontHandle, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceFontGetFontResolution(FontHandle, std::uint32_t*, float*);
-int APS5_VABI sceFontGetRenderScaledKerning(FontHandle, std::uint32_t, std::uint32_t, FontKerning*);
-int APS5_VABI sceFontGenerateCharGlyph(FontHandle, std::uint32_t, const FontGenerateGlyphDetail*, FontGlyph*);
-int APS5_VABI sceFontGlyphDefineAttribute(FontGlyph, std::int32_t, std::int32_t*);
-int APS5_VABI sceFontGlyphGetAttribute(FontGlyph, int, int*);
-int APS5_VABI sceFontDeleteGlyph(const FontMemory*, FontGlyph*);
-int APS5_VABI sceFontTextSourceInit(FontTextSource*, const void*, std::uint32_t, FontTextParseFunction, void*);
-int APS5_VABI sceFontCreateString(const FontMemory*, FontTextSource*, const FontCreateStringDetail*, FontString*);
-int APS5_VABI sceFontDestroyString(FontString*);
-FontTextCharacter* APS5_VABI sceFontStringRefersTextCharacters(FontString, std::uint32_t*);
-int APS5_VABI sceFontWritingInit(FontWriting*, FontString, const FontTextCharacter*);
-const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting*);
-FontTextCharacter* APS5_VABI sceFontWritingRefersRenderStepCharacter(FontWriting*, const FontWritingLetterStep**);
-const void* APS5_VABI sceFontSelectLibraryFt(int);
-const void* APS5_VABI sceFontSelectRendererFt(int);
-int APS5_VABI sceFontFtSupportBdf(FontLibrary library);
-int APS5_VABI sceFontFtSupportCid(FontLibrary library);
-int APS5_VABI sceFontFtSupportOpenType(FontLibrary library);
-int APS5_VABI sceFontFtSupportOpenTypeOtf(FontLibrary library);
-int APS5_VABI sceFontFtSupportOpenTypeTtf(FontLibrary library);
-int APS5_VABI sceFontFtSupportPcf(FontLibrary library);
-int APS5_VABI sceFontFtSupportPfr(FontLibrary library);
-int APS5_VABI sceFontFtSupportTrueType(FontLibrary library);
-int APS5_VABI sceFontFtSupportTrueTypeGx(FontLibrary library);
-int APS5_VABI sceFontFtSupportType1(FontLibrary library);
-int APS5_VABI sceFontFtSupportType42(FontLibrary library);
-int APS5_VABI sceFontFtSupportWinFonts(FontLibrary library);
-int APS5_VABI sceFontCharacterGetSyllableStringState(const FontTextCharacter*, int*);
-FontTextCodes* APS5_VABI sceFontCharactersRefersTextCodes(const FontTextCharacter*, const FontTextCharacter*, FontTextCodes*);
-FontTextCodes* APS5_VABI sceFontTextCodesStepNext(FontTextCodes*);
-FontTextCodes* APS5_VABI sceFontTextCodesStepBack(FontTextCodes*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Font check failed at line %d\n", line);
@@ -150,6 +87,25 @@ static std::int32_t APS5_VABI ParseText(FontTextSource* source, void** order, Fo
     return 1;
 }
 
+struct ParsedCodes {
+    const std::uint32_t* codes;
+    std::size_t count;
+    std::size_t at;
+    FontHandle font;
+};
+
+static std::int32_t APS5_VABI ParseCodes(FontTextSource* source, void** order, FontTextParseResult* result) {
+    auto* parsed = static_cast<ParsedCodes*>(source->textObject);
+    *order = const_cast<std::uint32_t*>(parsed->codes + parsed->at);
+    if (parsed->at == parsed->count) {
+        result->Terminate.terminateCode = 0;
+        return 0;
+    }
+    result->FontCode.font = parsed->font;
+    result->FontCode.code = parsed->codes[parsed->at++];
+    return 1;
+}
+
 static void CheckTextCodes(const FontMemory* memory, FontHandle font) {
     ParsedText parsed{"AVA", 0, font};
     FontTextSource source{};
@@ -159,6 +115,73 @@ static void CheckTextCodes(const FontMemory* memory, FontHandle font) {
     std::uint32_t count = 0;
     FontTextCharacter* characters = sceFontStringRefersTextCharacters(string, &count);
     Require(characters != nullptr && count == 3);
+    Require(sceFontStringGetWritingForm(string) == 0x12);
+    FontString rtlString = nullptr;
+    Require(sceFontTextSourceSetWritingForm(&source, 0x11) == SCE_FONT_OK && sceFontCreateString(memory, &source, nullptr, &rtlString) == SCE_FONT_OK);
+    Require(sceFontStringGetWritingForm(rtlString) == 0x11);
+    Require(sceFontDestroyString(&rtlString) == SCE_FONT_OK);
+    Require(sceFontTextSourceSetWritingForm(&source, 0x12) == SCE_FONT_OK && sceFontCreateString(memory, &source, nullptr, &rtlString) == SCE_FONT_OK);
+    Require(sceFontStringGetWritingForm(rtlString) == 0x12);
+    Require(sceFontDestroyString(&rtlString) == SCE_FONT_OK);
+    Require(sceFontTextSourceSetWritingForm(&source, 0x10) == SCE_FONT_OK);
+
+    const std::uint32_t latinCodes[]{'A', 0x00E9, 0x4E2D};
+    const std::uint32_t greekCodes[]{0x03B1};
+    const std::uint32_t digitsCodes[]{'1', '2', ' '};
+    const std::uint32_t hebrewCodes[]{0x05E9, 0x05DC};
+    const std::uint32_t arabicCodes[]{0x0627, 0x0644};
+    const std::uint32_t syriacCodes[]{0x0710};
+    const std::uint32_t thaanaCodes[]{0x0780};
+    const std::uint32_t nkoCodes[]{0x07CA};
+    const std::uint32_t hebrewLetterCodes[]{0xFB1D};
+    const std::uint32_t arabicFormCodes[]{0xFE70};
+    const std::uint32_t digitHebrewCodes[]{'1', ' ', 0x05D0};
+    const std::uint32_t hebrewLatinCodes[]{0x05D0, 'A'};
+    const std::uint32_t latinHebrewCodes[]{'A', 0x05D0};
+    const std::uint32_t rlmLatinCodes[]{0x200F, 'A'};
+    const std::uint32_t lrmHebrewCodes[]{0x200E, 0x05D0};
+    const std::uint32_t embeddingCodes[]{0x202B, 'A'};
+    const std::uint32_t overrideCodes[]{0x202E, 'A'};
+    const std::uint32_t isolatedHebrewCodes[]{0x2067, 0x05D0, 0x2069, 'A'};
+    const std::uint32_t isolatedLatinCodes[]{0x2066, 'A', 0x2069, 0x05D0};
+    const std::uint32_t openIsolateCodes[]{0x2067, 0x05D0};
+    const struct { const std::uint32_t* codes; std::size_t count; std::int32_t sourceForm; int expected; } forms[]{
+        {latinCodes, 3, 0x10, 0x12},
+        {greekCodes, 1, 0x10, 0x12},
+        {digitsCodes, 3, 0x10, 0x12},
+        {nullptr, 0, 0x10, 0x12},
+        {hebrewCodes, 2, 0x10, 0x11},
+        {arabicCodes, 2, 0x10, 0x11},
+        {syriacCodes, 1, 0x10, 0x11},
+        {thaanaCodes, 1, 0x10, 0x11},
+        {nkoCodes, 1, 0x10, 0x11},
+        {hebrewLetterCodes, 1, 0x10, 0x11},
+        {arabicFormCodes, 1, 0x10, 0x11},
+        {digitHebrewCodes, 3, 0x10, 0x11},
+        {hebrewLatinCodes, 2, 0x10, 0x11},
+        {latinHebrewCodes, 2, 0x10, 0x12},
+        {rlmLatinCodes, 2, 0x10, 0x11},
+        {lrmHebrewCodes, 2, 0x10, 0x12},
+        {embeddingCodes, 2, 0x10, 0x12},
+        {overrideCodes, 2, 0x10, 0x12},
+        {isolatedHebrewCodes, 4, 0x10, 0x12},
+        {isolatedLatinCodes, 4, 0x10, 0x11},
+        {openIsolateCodes, 2, 0x10, 0x12},
+        {hebrewCodes, 2, 0x11, 0x11},
+        {hebrewCodes, 2, 0x12, 0x12},
+        {latinCodes, 3, 0x11, 0x11},
+        {latinCodes, 3, 0x12, 0x12},
+    };
+    for (const auto& form : forms) {
+        ParsedCodes parsedCodes{form.codes, form.count, 0, font};
+        FontTextSource codeSource{};
+        FontString codeString = nullptr;
+        Require(sceFontTextSourceInit(&codeSource, parsed.text, 3, ParseCodes, &parsedCodes) == SCE_FONT_OK);
+        Require(sceFontTextSourceSetWritingForm(&codeSource, form.sourceForm) == SCE_FONT_OK);
+        Require(sceFontCreateString(memory, &codeSource, nullptr, &codeString) == SCE_FONT_OK && codeString != nullptr);
+        Require(sceFontStringGetWritingForm(codeString) == form.expected);
+        Require(sceFontDestroyString(&codeString) == SCE_FONT_OK);
+    }
 
     FontTextCodes codes;
     std::memset(&codes, 0xa5, sizeof(codes));
@@ -197,6 +220,7 @@ static void CheckTextCodes(const FontMemory* memory, FontHandle font) {
     bool threw = false;
     try {
         sceFontCharactersRefersTextCodes(nullptr, nullptr, &codes);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -208,6 +232,68 @@ static bool KerningIs(const FontKerning& kerning, float offsetX) {
     return kerning.offsetX == offsetX && kerning.offsetY == 0.0f && kerning.positionX == 0.0f && kerning.positionY == 0.0f;
 }
 
+static void CheckGlyphScale(FontHandle font, const FontMemory* memory, float expectedW, float expectedH) {
+    float width = 0.0f;
+    float height = 0.0f;
+    Require(sceFontGetScalePixel(font, &width, &height) == SCE_FONT_OK);
+    Require(width == expectedW && height == expectedH);
+    FontGlyph glyph = nullptr;
+    Require(sceFontGenerateCharGlyph(font, 'A', nullptr, &glyph) == SCE_FONT_OK && glyph != nullptr);
+    Require(sceFontGlyphGetScalePixel(glyph, &width, &height) == SCE_FONT_OK);
+    if (width != expectedW || height != expectedH) {
+        std::fprintf(stderr, "Generated glyph scale %.3f x %.3f differs from font scale %.3f x %.3f\n", width, height, expectedW, expectedH);
+    }
+    Require(width == expectedW && height == expectedH);
+    Require(glyph->em_size == static_cast<std::uint16_t>(std::lround(expectedH)));
+    Require(sceFontDeleteGlyph(memory, &glyph) == SCE_FONT_OK && glyph == nullptr);
+}
+
+static void CheckPointAndDpiScale(FontHandle font, FontLibrary library, const FontMemory* memory, FontRenderer renderer) {
+    FontKerning kerning{};
+    Require(sceFontSetScalePoint(font, 20.0f, 30.0f) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 40.0f, 60.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    Require(sceFontSetResolutionDpi(font, 216, 288) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 60.0f, 120.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -12.0f));
+    Require(sceFontSetScalePoint(font, 50.0f, 40.0f) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 150.0f, 160.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -30.0f));
+    Require(sceFontSetResolutionDpi(font, 0, 0) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 50.0f, 40.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -10.0f));
+    Require(sceFontSetScalePixel(font, 100.0f, 75.0f) == SCE_FONT_OK);
+    Require(sceFontSetResolutionDpi(font, 144, 216) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 100.0f, 75.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -20.0f));
+    Require(sceFontSetScalePoint(font, 20.0f, 30.0f) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 40.0f, 90.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    FontHandle instance = nullptr;
+    Require(sceFontOpenFontInstance(font, nullptr, &instance) == SCE_FONT_OK && instance != nullptr);
+    CheckGlyphScale(instance, memory, 40.0f, 90.0f);
+    Require(sceFontGetKerning(instance, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    Require(sceFontSetScalePoint(instance, 30.0f, 40.0f) == SCE_FONT_OK);
+    CheckGlyphScale(instance, memory, 60.0f, 120.0f);
+    CheckGlyphScale(font, memory, 40.0f, 90.0f);
+    Require(sceFontCloseFont(instance) == SCE_FONT_OK);
+    Require(sceFontBindRenderer(font, renderer) == SCE_FONT_OK);
+    Require(sceFontSetupRenderScalePixel(font, 100.0f, 100.0f) == SCE_FONT_OK);
+    Require(sceFontGetRenderScaledKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -20.0f));
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    Require(sceFontUnbindRenderer(font) == SCE_FONT_OK);
+    const std::vector<unsigned char> data = KerningFont();
+    FontHandle fresh = nullptr;
+    Require(sceFontOpenFontMemory(library, data.data(), static_cast<std::uint32_t>(data.size()), nullptr, &fresh) == SCE_FONT_OK);
+    float width = 0.0f;
+    float height = 0.0f;
+    Require(sceFontGetScalePixel(fresh, &width, &height) == SCE_FONT_OK);
+    CheckGlyphScale(fresh, memory, width, height);
+    Require(sceFontCloseFont(fresh) == SCE_FONT_OK);
+    Require(sceFontSetResolutionDpi(font, 144, 144) == SCE_FONT_OK);
+    Require(sceFontSetScalePixel(font, 100.0f, 100.0f) == SCE_FONT_OK);
+}
+
 int main() {
     constexpr std::uint32_t SystemFontSet = 0x18070043u;
     const std::filesystem::path fontRoot = std::filesystem::temp_directory_path() / ("anyps5_guest_font-" + std::to_string(std::random_device{}()));
@@ -343,11 +429,13 @@ int main() {
         bool getThrew = false;
         try {
             sceFontSetScriptLanguage(font, script, script);
+
         } catch (const std::logic_error&) {
             setThrew = true;
         }
         try {
             sceFontGetScriptLanguage(font, script, &setting);
+
         } catch (const std::logic_error&) {
             getThrew = true;
         }
@@ -369,6 +457,7 @@ int main() {
         bool getThrew = false;
         try {
             sceFontGetTypographicDesign(font, selector, &setting);
+
         } catch (const std::logic_error&) {
             getThrew = true;
         }
@@ -378,6 +467,7 @@ int main() {
             bool setThrew = false;
             try {
                 sceFontSetTypographicDesign(font, selector, feature);
+
             } catch (const std::logic_error&) {
                 setThrew = true;
             }
@@ -402,6 +492,7 @@ int main() {
     bool typographyQueryThrew = false;
     try {
         sceFontGetTypographicDesign(font, 65537, &setting);
+
     } catch (const std::logic_error&) {
         typographyQueryThrew = true;
     }
@@ -558,6 +649,8 @@ int main() {
     Require(sceFontUnbindRenderer(font) == SCE_FONT_OK);
     Require(sceFontGetRenderScaledKerning(font, 'A', 'V', &kerning) == SCE_FONT_ERROR_NOT_BOUND_RENDERER);
 
+    CheckPointAndDpiScale(font, library, &memory, renderer);
+
     ParsedText parsed{"AV", 0, font};
     FontTextSource source{};
     Require(sceFontTextSourceInit(&source, parsed.text, 2, ParseText, &parsed) == SCE_FONT_OK);
@@ -578,11 +671,31 @@ int main() {
     Require(step != nullptr);
     Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == characters && out.letter != nullptr && out.guard == guard);
     Require(out.letter->x == step->x && out.letter->advanceX == step->advanceX && out.letter->Components.textsIndex == 0 && out.letter->Components.characterTextCount == 1);
+    const FontWritingLetterStep* retainedLetter = out.letter;
+    const FontWritingLetterStep retainedValue = *retainedLetter;
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr && out.guard == guard);
+    Require(std::memcmp(retainedLetter, &retainedValue, sizeof(retainedValue)) == 0);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == nullptr);
     step = sceFontWritingRefersRenderStep(&writing);
     Require(step != nullptr);
     Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == characters + 1 && out.guard == guard);
     Require(out.letter->x == step->x && out.letter->Components.textsIndex == 1 && out.letter->Components.glyphsIndex == 1);
-    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == characters + 1);
+    Require(out.letter == retainedLetter);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == nullptr);
+    out.letter = retainedLetter;
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr && out.guard == guard);
+    Require(sceFontWritingRefersRenderStep(&writing) == nullptr);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
+    Require(sceFontWritingInit(&writing, string, characters) == SCE_FONT_OK);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
+    Require(sceFontWritingRefersRenderStep(&writing) != nullptr);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == characters);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
+    Require(sceFontWritingInit(&writing, string, characters) == SCE_FONT_OK);
+    Require(sceFontWritingRefersRenderStep(&writing) != nullptr);
+    Require(sceFontWritingRefersRenderStep(&writing) != nullptr);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == characters + 1 && out.letter == retainedLetter && out.guard == guard);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
     Require(sceFontDestroyString(&string) == SCE_FONT_OK);
     CheckTextCodes(&memory, font);
     Require(sceFontCloseFont(font) == SCE_FONT_OK);
diff --git a/core/libs/tests/GuestFontGraphics.cpp b/core/libs/tests/GuestFontGraphics.cpp
new file mode 100644
index 0000000000..3093955bc9
--- /dev/null
+++ b/core/libs/tests/GuestFontGraphics.cpp
@@ -0,0 +1,214 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libSceFont/libSceFont.hpp"
+#include <array>
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+
+namespace {
+
+constexpr int InvalidParameter = static_cast<int>(0x80460002);
+constexpr int InvalidFill = static_cast<int>(0x80460086);
+constexpr int InvalidRegion = static_cast<int>(0x80460087);
+constexpr int InvalidFillPlot = static_cast<int>(0x80460088);
+constexpr int InvalidFillRates = static_cast<int>(0x80460089);
+constexpr float NaN = std::numeric_limits<float>::quiet_NaN();
+
+int g_lastError = 0;
+int g_errorCount = 0;
+
+void APS5_VABI RecordError(int error) {
+    g_lastError = error;
+    ++g_errorCount;
+}
+
+void Require(bool value) { if (!value) std::abort(); }
+
+template <typename T>
+void Fill(T& object, std::uint8_t value) {
+    std::memset(&object, value, sizeof(object));
+}
+
+template <typename T>
+bool AllBytes(const T& object, std::size_t from, std::size_t to, std::uint8_t value) {
+    const auto* bytes = reinterpret_cast<const std::uint8_t*>(&object);
+    for (std::size_t i = from; i < to; ++i) if (bytes[i] != value) return false;
+    return true;
+}
+
+int g_expectedErrors = 0;
+
+void RequireError(int result, int error) {
+    Require(result == error);
+    Require(g_lastError == error);
+    g_lastError = 0;
+    ++g_expectedErrors;
+}
+
+const FontGraphicsFill* Sentinel(std::intptr_t value) {
+    return reinterpret_cast<const FontGraphicsFill*>(value);
+}
+
+void Regions() {
+    FontGraphicsRegion region;
+    Fill(region, 0xa5);
+    Require(sceFontGraphicsRegionInit(&region, 1.0f, 2.0f, 3.0f, 4.0f) == 0);
+    Require(region.x == 1.0f && region.y == 2.0f && region.width == 3.0f && region.height == 4.0f);
+    Require(region.flags == 0xf && region.tag == 0xf60 && region.outerRadius == 0.0f && region.innerRadius == 0.0f);
+    Require(sceFontGraphicsRegionInit(&region, 0.0f, 0.0f, 0.0f, 0.0f) == 0);
+    Require(sceFontGraphicsRegionInit(&region, 0.0f, 0.0f, NaN, NaN) == 0);
+    Fill(region, 0xa5);
+    RequireError(sceFontGraphicsRegionInit(&region, 0.0f, 0.0f, -1.0f, 1.0f), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInit(&region, 0.0f, 0.0f, 1.0f, -1.0f), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInit(nullptr, 0.0f, 0.0f, 1.0f, 1.0f), InvalidParameter);
+    Require(AllBytes(region, 0, sizeof(region), 0xa5));
+
+    Require(sceFontGraphicsRegionInitCircular(&region, 10.0f, 20.0f, 4.0f, 1.0f) == 0);
+    Require(region.x == 6.0f && region.y == 16.0f && region.width == 8.0f && region.height == 8.0f);
+    Require(region.flags == 0xff && region.tag == 0xf60 && region.outerRadius == 4.0f && region.innerRadius == 1.0f);
+    Require(sceFontGraphicsRegionInitCircular(&region, 0.0f, 0.0f, 2.0f, 2.0f) == 0);
+    RequireError(sceFontGraphicsRegionInitCircular(&region, 0.0f, 0.0f, 1.0f, 2.0f), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInitCircular(&region, 0.0f, 0.0f, 0.0f, 0.0f), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInitCircular(&region, 0.0f, 0.0f, 1.0f, 0.0f), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInitCircular(nullptr, 0.0f, 0.0f, 2.0f, 1.0f), InvalidParameter);
+
+    Require(sceFontGraphicsRegionInitRoundish(&region, 1.0f, 2.0f, 10.0f, 8.0f, 4.0f, 2.0f, 0x5) == 0);
+    Require(region.width == 10.0f && region.height == 8.0f && region.flags == 0x5 && region.tag == 0xf60);
+    Require(region.outerRadius == 4.0f && region.innerRadius == 2.0f);
+    Require(sceFontGraphicsRegionInitRoundish(&region, 0.0f, 0.0f, 10.0f, 8.0f, 0.0f, 9.0f, 0xff) == 0);
+    RequireError(sceFontGraphicsRegionInitRoundish(&region, 0.0f, 0.0f, 10.0f, 8.0f, 4.5f, 0.0f, 0), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInitRoundish(&region, 0.0f, 0.0f, 10.0f, 8.0f, 2.0f, 3.0f, 0), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInitRoundish(&region, 0.0f, 0.0f, 10.0f, 8.0f, 2.0f, 1.0f, 0x100), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInitRoundish(&region, 0.0f, 0.0f, 0.0f, 8.0f, 0.0f, 0.0f, 0), InvalidParameter);
+    RequireError(sceFontGraphicsRegionInitRoundish(&region, 0.0f, 0.0f, 10.0f, 8.0f, -1.0f, 0.0f, 0), InvalidParameter);
+}
+
+void FillMethods() {
+    FontGraphicsFillMethod method;
+    Fill(method, 0xa5);
+    Require(sceFontGraphicsFillMethodInit(&method, 0x50, 12) == 0);
+    Require(method.mode == 0x50 && method.type == 12 && method.flags == 0xf && method.tag == 0xf01b);
+    Require(AllBytes(method, 16, 32, 0));
+    for (std::int32_t mode : {0x00, 0x10, 0x20, 0x30, 0x40}) Require(sceFontGraphicsFillMethodInit(&method, mode, 1) == 0);
+    for (std::int32_t type = 1; type <= 7; ++type) Require(sceFontGraphicsFillMethodInit(&method, 0, type) == 0);
+    for (std::int32_t mode : {0x01, 0x08, 0x60, -0x10}) RequireError(sceFontGraphicsFillMethodInit(&method, mode, 1), InvalidParameter);
+    for (std::int32_t type : {0, 8, 11, 13, -1}) RequireError(sceFontGraphicsFillMethodInit(&method, 0, type), InvalidParameter);
+    RequireError(sceFontGraphicsFillMethodInit(nullptr, 0, 1), InvalidParameter);
+}
+
+void FillPlots() {
+    FontGraphicsRegion region;
+    Require(sceFontGraphicsRegionInitRoundish(&region, 1.0f, 2.0f, 10.0f, 8.0f, 4.0f, 2.0f, 0x5) == 0);
+    FontGraphicsFillPlot plot;
+    Fill(plot, 0xa5);
+    Require(sceFontGraphicsFillPlotInit(&plot, &region) == 0);
+    Require(plot.mapping[0] == 1.0f && plot.mapping[1] == 2.0f && plot.mapping[2] == 11.0f && plot.mapping[3] == 10.0f);
+    Require(plot.region == &region && plot.tag == 0xf01c && plot.reserved26 == 0 && plot.layout == 0xf77 && plot.flags == 1);
+    Require(AllBytes(plot, 31, 64, 0));
+
+    Fill(plot, 0xa5);
+    Require(sceFontGraphicsFillPlotInit(&plot, nullptr) == 0);
+    Require(plot.region == nullptr && plot.tag == 0xf01c && plot.layout == 0 && plot.flags == 2);
+    Require(AllBytes(plot, 0, 16, 0));
+    const auto* whole = reinterpret_cast<const FontGraphicsRegion*>(std::intptr_t{-1});
+    Require(sceFontGraphicsFillPlotInit(&plot, whole) == 0);
+    Require(plot.region == whole && plot.layout == 0xf77 && plot.flags == 6);
+
+    FontGraphicsRegion bad = region;
+    bad.tag = 0;
+    Fill(plot, 0xa5);
+    RequireError(sceFontGraphicsFillPlotInit(&plot, &bad), InvalidRegion);
+    Require(plot.tag == 0 && AllBytes(plot, 0, 24, 0xa5) && AllBytes(plot, 26, 64, 0xa5));
+    bad = region;
+    bad.outerRadius = NaN;
+    RequireError(sceFontGraphicsFillPlotInit(&plot, &bad), InvalidRegion);
+    bad = region;
+    bad.outerRadius = 4.5f;
+    RequireError(sceFontGraphicsFillPlotInit(&plot, &bad), InvalidRegion);
+    bad = region;
+    bad.outerRadius = 0.0f;
+    bad.innerRadius = 4.0f;
+    Require(sceFontGraphicsFillPlotInit(&plot, &bad) == 0);
+    bad.innerRadius = 4.5f;
+    RequireError(sceFontGraphicsFillPlotInit(&plot, &bad), InvalidRegion);
+    RequireError(sceFontGraphicsFillPlotInit(nullptr, &region), InvalidFillPlot);
+
+    Require(sceFontGraphicsFillPlotInit(&plot, &region) == 0);
+    Require(sceFontGraphicsFillPlotSetLayout(&plot, 0x400, 0x24) == 0);
+    Require(plot.layout == 0x424 && plot.flags == 9);
+    Require(sceFontGraphicsFillPlotSetLayout(&plot, 0, 0) == 0);
+    Require(plot.layout == 0 && plot.flags == 8);
+    Require(sceFontGraphicsFillPlotSetLayout(&plot, 0x170, 0x1100) == 0);
+    Require(plot.layout == 0x1170);
+    RequireError(sceFontGraphicsFillPlotSetLayout(&plot, 0x171, 0), InvalidParameter);
+    RequireError(sceFontGraphicsFillPlotSetLayout(&plot, 0, 0x3), InvalidParameter);
+    RequireError(sceFontGraphicsFillPlotSetLayout(&plot, 0, 0x50), InvalidParameter);
+    Require(sceFontGraphicsFillPlotSetMapping(&plot, 5.0f, 6.0f, 7.0f, NaN) == 0);
+    Require(plot.mapping[0] == 5.0f && plot.mapping[2] == 7.0f && std::isnan(plot.mapping[3]) && plot.flags == 9);
+
+    FontGraphicsFillPlot untagged{};
+    RequireError(sceFontGraphicsFillPlotSetLayout(&untagged, 0, 0), InvalidFillPlot);
+    RequireError(sceFontGraphicsFillPlotSetMapping(&untagged, 0.0f, 0.0f, 0.0f, 0.0f), InvalidFillPlot);
+}
+
+void FillRates() {
+    FontGraphicsFillRates rates;
+    Fill(rates, 0xa5);
+    std::array<std::uint8_t, 8> fill{0x30};
+    const auto* fillPointer = reinterpret_cast<const FontGraphicsFill*>(fill.data());
+    Require(sceFontGraphicsFillRatesInit(&rates, fillPointer, 9) == 0);
+    Require(rates.fill == fillPointer && rates.tag == 0xf01a && rates.effect == 9 && rates.layout == 0xf77 && rates.flags == 2);
+    Require(AllBytes(rates, 0, 16, 0) && AllBytes(rates, 31, 64, 0));
+    for (std::intptr_t value : {-1, 0, 1, 2}) Require(sceFontGraphicsFillRatesInit(&rates, Sentinel(value), 0) == 0);
+    for (std::uint32_t effect : {0u, 1u, 2u, 3u, 4u, 5u, 8u, 9u, 16u}) {
+        Require(sceFontGraphicsFillRatesInit(&rates, nullptr, effect) == 0);
+        Require(rates.effect == effect);
+    }
+
+    Fill(rates, 0xa5);
+    RequireError(sceFontGraphicsFillRatesInit(&rates, nullptr, 6), InvalidParameter);
+    Require(AllBytes(rates, 0, sizeof(rates), 0));
+    fill[0] = 0x31;
+    RequireError(sceFontGraphicsFillRatesInit(&rates, fillPointer, 0), InvalidFill);
+    fill[0] = 0x60;
+    RequireError(sceFontGraphicsFillRatesInit(&rates, fillPointer, 0), InvalidFill);
+    RequireError(sceFontGraphicsFillRatesInit(nullptr, nullptr, 0), InvalidParameter);
+
+    fill[0] = 0x10;
+    Require(sceFontGraphicsFillRatesInit(&rates, nullptr, 0) == 0);
+    Require(sceFontGraphicsFillRatesSetFillEffect(&rates, fillPointer, 16) == 0);
+    Require(rates.fill == fillPointer && rates.effect == 16 && rates.flags == 2 && rates.layout == 0xf77);
+    RequireError(sceFontGraphicsFillRatesSetFillEffect(&rates, nullptr, 17), InvalidParameter);
+    Require(rates.fill == fillPointer && rates.effect == 16);
+
+    Require(sceFontGraphicsFillRatesSetLayout(&rates, 0xf77, 0x44) == 0);
+    Require(rates.layout == 0 && rates.flags == 3);
+    Require(sceFontGraphicsFillRatesSetLayout(&rates, 0, 0) == 0);
+    Require(rates.layout == 0 && rates.flags == 2);
+    RequireError(sceFontGraphicsFillRatesSetLayout(&rates, 0x801, 0), InvalidParameter);
+    Require(sceFontGraphicsFillRatesSetMapping(&rates, 1.0f, 2.0f, 3.0f, 4.0f) == 0);
+    Require(rates.mapping[0] == 1.0f && rates.mapping[3] == 4.0f && rates.flags == 1);
+
+    FontGraphicsFillRates untagged{};
+    RequireError(sceFontGraphicsFillRatesSetFillEffect(&untagged, nullptr, 0), InvalidFillRates);
+    RequireError(sceFontGraphicsFillRatesSetLayout(&untagged, 0, 0), InvalidFillRates);
+    RequireError(sceFontGraphicsFillRatesSetMapping(&untagged, 0.0f, 0.0f, 0.0f, 0.0f), InvalidFillRates);
+}
+
+}
+
+int main() {
+    sceFontSetGraphicsErrorCallback(RecordError);
+    Regions();
+    FillMethods();
+    FillPlots();
+    FillRates();
+    Require(g_errorCount == g_expectedErrors);
+    sceFontSetGraphicsErrorCallback(nullptr);
+    const int before = g_errorCount;
+    FontGraphicsRegion region;
+    Require(sceFontGraphicsRegionInit(&region, 0.0f, 0.0f, -1.0f, 0.0f) == InvalidParameter);
+    Require(g_errorCount == before);
+}
diff --git a/core/libs/tests/GuestFontMetrics.cpp b/core/libs/tests/GuestFontMetrics.cpp
new file mode 100644
index 0000000000..24d5f2b1ca
--- /dev/null
+++ b/core/libs/tests/GuestFontMetrics.cpp
@@ -0,0 +1,137 @@
+#include "prx/libSceFont/include/FontDriver.hpp"
+#include "prx/libSceFont/libSceFont.hpp"
+#include "prx/libSceFontFt/libSceFontFt.hpp"
+#include "tests/FontFixture.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <map>
+#include <string>
+#include <vector>
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "Font metrics check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+struct Expected {
+    std::uint32_t form;
+    float ascender;
+    float descender;
+    float lineGap;
+    float maxAdvance;
+    float verticalDescender;
+    float verticalAscender;
+};
+
+static FontMetrics Metrics(FontHandle font, std::uint32_t form) {
+    FontMetrics metrics{};
+    std::memset(&metrics, 0x7F, sizeof(metrics));
+    Require(sceFontGetFontMetrics(font, form, &metrics) == SCE_FONT_OK);
+    return metrics;
+}
+
+static void RequireMetrics(FontHandle font, std::uint32_t form, const Expected& expected) {
+    const FontMetrics metrics = Metrics(font, form);
+    Require(metrics.form == expected.form);
+    Require(metrics.ascender == expected.ascender && metrics.descender == expected.descender && metrics.lineGap == expected.lineGap);
+    Require(metrics.maxAdvance == expected.maxAdvance);
+    Require(metrics.verticalDescender == expected.verticalDescender && metrics.verticalAscender == expected.verticalAscender);
+    Require(metrics.xMin == 0.0f && metrics.yMin == 0.0f && metrics.xMax == 0.0f && metrics.yMax == 0.0f);
+    Require(metrics.emWidth == 99.984375f && metrics.emHeight == 99.984375f);
+}
+
+static void* APS5_VABI Allocate(void*, std::uint32_t size) {
+    return std::malloc(size);
+}
+
+static void APS5_VABI Release(void*, void* pointer) {
+    std::free(pointer);
+}
+
+using FontFixture::BuildFont;
+using FontFixture::Words;
+
+static std::vector<unsigned char> Os2Table() {
+    return Words({0, 500, 400, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0x20, 0x7E, 700, -300, 100, 900, 250});
+}
+
+static FontHandle Open(FontLibrary library, const std::vector<unsigned char>& data) {
+    FontHandle font = nullptr;
+    Require(sceFontOpenFontMemory(library, data.data(), static_cast<std::uint32_t>(data.size()), nullptr, &font) == SCE_FONT_OK && font != nullptr);
+    Require(sceFontSetScalePixel(font, 100.0f, 100.0f) == SCE_FONT_OK);
+    return font;
+}
+
+static std::vector<unsigned char> VerticalHeader(int major) {
+    return Words({major, 0, 880, -120, 60, 1000, 40, 0, 950, 0, 0, 0, 0, 0, 0, 0, 0, 1});
+}
+
+int main() {
+    const FontMemoryInterface iface{Allocate, Release, nullptr, nullptr, nullptr, nullptr};
+    FontMemory memory{};
+    Require(sceFontMemoryInit(&memory, nullptr, 0, &iface, nullptr, nullptr, nullptr) == SCE_FONT_OK);
+    FontLibrary library = nullptr;
+    Require(sceFontCreateLibrary(&memory, sceFontSelectLibraryFt(0), &library) == SCE_FONT_OK);
+    Require(sceFontSupportExternalFonts(library, 4, 0x52) == SCE_FONT_OK);
+
+    const auto plainData = BuildFont(1, {});
+    FontHandle plain = Open(library, plainData);
+    RequireMetrics(plain, 1, {1, 80.0f, -20.0f, 0.0f, 50.0f, 0.0f, 0.0f});
+    RequireMetrics(plain, 2, {1, 80.0f, -20.0f, 0.0f, 50.0f, 0.0f, 0.0f});
+    RequireMetrics(plain, 3, {1, 80.0f, -20.0f, 0.0f, 50.0f, 0.0f, 0.0f});
+    RequireMetrics(plain, 4, {4, 0.0f, 100.0f, 0.0f, 100.0f, -50.0f, 80.0f});
+    FontMetrics untouched{};
+    untouched.ascender = 5.0f;
+    untouched.descender = 6.0f;
+    untouched.lineGap = 7.0f;
+    Require(sceFontGetFontMetrics(plain, 7, &untouched) == SCE_FONT_OK);
+    Require(untouched.form == 7 && untouched.ascender == 5.0f && untouched.descender == 6.0f && untouched.lineGap == 7.0f);
+    Require(untouched.maxAdvance == 50.0f && untouched.verticalDescender == 0.0f && untouched.verticalAscender == 0.0f);
+
+    const auto typoData = BuildFont(1, {{"OS/2", Os2Table()}, {"vhea", VerticalHeader(0x11)}, {"vmtx", Words({1000, 40})}});
+    FontHandle typo = Open(library, typoData);
+    RequireMetrics(typo, 1, {1, 80.0f, -20.0f, 0.0f, 50.0f, 0.0f, 0.0f});
+    RequireMetrics(typo, 2, {2, 70.0f, -30.0f, 10.0f, 50.0f, 0.0f, 0.0f});
+    RequireMetrics(typo, 3, {3, 90.0f, -25.0f, 0.0f, 50.0f, 0.0f, 0.0f});
+    RequireMetrics(typo, 4, {4, 4.0f, 95.0f, -93.984375f, 100.0f, -12.0f, 70.0f});
+    Require(sceFontSetEffectWeight(typo, 1.03125f, 0.984375f, 0) == SCE_FONT_OK);
+    Require(sceFontSetEffectSlant(typo, 0.25f) == SCE_FONT_OK);
+    const FontMetrics styled = Metrics(typo, 2);
+    Require(styled.effectWeightX == 0.03125f && styled.effectWeightY == -0.015625f && styled.slantRatio == 0.25f);
+    Require(sceFontSetEffectWeight(typo, 1.5f, 0.5f, 0) == SCE_FONT_OK);
+    const FontMetrics clamped = Metrics(typo, 2);
+    Require(clamped.effectWeightX == 0.04f && clamped.effectWeightY == -0.04f);
+
+    const auto versionOneData = BuildFont(1, {{"vhea", VerticalHeader(1)}, {"vmtx", Words({1000, 40})}});
+    FontHandle versionOne = Open(library, versionOneData);
+    RequireMetrics(versionOne, 4, {4, 4.0f, 95.0f, 0.0f, 100.0f, -12.0f, 4.0f});
+
+    const auto os2OnlyData = BuildFont(1, {{"OS/2", Os2Table()}});
+    FontHandle os2Only = Open(library, os2OnlyData);
+    RequireMetrics(os2Only, 4, {4, 70.0f, 70.0f, 0.0f, 100.0f, -50.0f, 70.0f});
+
+    FontMetrics cleared{};
+    std::memset(&cleared, 0x7F, sizeof(cleared));
+    Require(sceFontGetFontMetrics(nullptr, 1, &cleared) == SCE_FONT_ERROR_INVALID_FONT_HANDLE);
+    Require(cleared.form == 0 && cleared.ascender == 0.0f && cleared.maxAdvance == 0.0f && cleared.emHeight == 0.0f);
+    Require(cleared.effectWeightX == 1.0f && cleared.effectWeightY == 1.0f && cleared.slantRatio == 0.0f);
+    std::uint64_t notAFont[32]{};
+    std::memset(&cleared, 0x7F, sizeof(cleared));
+    Require(sceFontGetFontMetrics(reinterpret_cast<FontHandle>(notAFont), 1, &cleared) == SCE_FONT_ERROR_INVALID_FONT_HANDLE);
+    Require(cleared.form == 0 && cleared.effectWeightX == 1.0f);
+    Require(sceFontGetFontMetrics(plain, 1, nullptr) == SCE_FONT_ERROR_INVALID_FONT_HANDLE);
+    Require(sceFontGetFontMetrics(nullptr, 1, nullptr) == SCE_FONT_ERROR_INVALID_FONT_HANDLE);
+
+    for (FontHandle font : {plain, typo, versionOne, os2Only}) Require(sceFontCloseFont(font) == SCE_FONT_OK);
+    Require(sceFontDestroyLibrary(&library) == SCE_FONT_OK);
+    Require(sceFontMemoryTerm(&memory) == SCE_FONT_OK);
+    std::puts("Font metrics tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestFontOutlineProfile.cpp b/core/libs/tests/GuestFontOutlineProfile.cpp
new file mode 100644
index 0000000000..1c57782d45
--- /dev/null
+++ b/core/libs/tests/GuestFontOutlineProfile.cpp
@@ -0,0 +1,121 @@
+#include "prx/libSceFont/include/FontDriver.hpp"
+#include "prx/libSceFont/libSceFont.hpp"
+#include "prx/libSceFontFt/libSceFontFt.hpp"
+#include "tests/FontFixture.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <initializer_list>
+#include <vector>
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "Font outline profile check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static void* APS5_VABI Allocate(void*, std::uint32_t size) {
+    return std::malloc(size);
+}
+
+static void APS5_VABI Release(void*, void* pointer) {
+    std::free(pointer);
+}
+
+static void PatchMaxp(std::vector<unsigned char>& font, std::initializer_list<int> words) {
+    const int tableCount = (font[4] << 8) | font[5];
+    for (int i = 0; i < tableCount; ++i) {
+        const std::size_t entry = 12 + 16 * static_cast<std::size_t>(i);
+        if (std::memcmp(font.data() + entry, "maxp", 4) != 0) continue;
+        std::size_t offset = (static_cast<std::size_t>(font[entry + 8]) << 24) | (static_cast<std::size_t>(font[entry + 9]) << 16) |
+            (static_cast<std::size_t>(font[entry + 10]) << 8) | font[entry + 11];
+        for (const int word : words) {
+            if (word >= 0) {
+                font[offset] = static_cast<unsigned char>((word >> 8) & 0xFF);
+                font[offset + 1] = static_cast<unsigned char>(word & 0xFF);
+            }
+            offset += 2;
+        }
+        return;
+    }
+    Require(false);
+}
+
+static FontHandle Open(FontLibrary library, const std::vector<unsigned char>& data) {
+    FontHandle font = nullptr;
+    Require(sceFontOpenFontMemory(library, data.data(), static_cast<std::uint32_t>(data.size()), nullptr, &font) == SCE_FONT_OK && font != nullptr);
+    return font;
+}
+
+static void Fill(FontOutlineProfile& profile) {
+    std::memset(&profile, 0x7F, sizeof(profile));
+}
+
+static bool Zero(const FontOutlineProfile& profile) {
+    return profile.maxContours == 0 && profile.maxPoints == 0 && profile.maxCompositeContours == 0 && profile.maxCompositePoints == 0;
+}
+
+int main() {
+    const FontMemoryInterface iface{Allocate, Release, nullptr, nullptr, nullptr, nullptr};
+    FontMemory memory{};
+    Require(sceFontMemoryInit(&memory, nullptr, 0, &iface, nullptr, nullptr, nullptr) == SCE_FONT_OK);
+    FontLibrary library = nullptr;
+    Require(sceFontCreateLibrary(&memory, sceFontSelectLibraryFt(0), &library) == SCE_FONT_OK);
+    Require(sceFontSupportExternalFonts(library, 4, 0x52) == SCE_FONT_OK);
+
+    auto profiledData = FontFixture::BuildFont(1, {});
+    PatchMaxp(profiledData, {-1, -1, -1, 120, 7, 300, 11});
+    FontHandle profiled = Open(library, profiledData);
+    FontOutlineProfile profile{};
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(profiled, &profile) == SCE_FONT_OK);
+    Require(profile.maxContours == 7 && profile.maxPoints == 120 && profile.maxCompositeContours == 11 && profile.maxCompositePoints == 300);
+
+    const auto plainData = FontFixture::BuildFont(1, {});
+    FontHandle plain = Open(library, plainData);
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(plain, &profile) == SCE_FONT_OK && Zero(profile));
+
+    auto shortData = FontFixture::BuildFont(1, {});
+    PatchMaxp(shortData, {0, 0x5000});
+    FontHandle shortMaxp = Open(library, shortData);
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(shortMaxp, &profile) == SCE_FONT_ERROR_NO_SUPPORT_FUNCTION && Zero(profile));
+
+    std::array<std::byte, 116> record{};
+    auto* nativeFont = reinterpret_cast<Font::FontHandleNative*>(profiled);
+    nativeFont->open_info.fontset_record = record.data();
+    Require(sceFontGetFontGlyphsOutlineProfile(profiled, nullptr) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    nativeFont->open_info.fontset_record = nullptr;
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(profiled, &profile) == SCE_FONT_OK && profile.maxPoints == 120);
+
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(nullptr, &profile) == SCE_FONT_ERROR_INVALID_FONT_HANDLE && Zero(profile));
+    std::uint64_t notAFont[32]{};
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(reinterpret_cast<FontHandle>(notAFont), &profile) == SCE_FONT_ERROR_INVALID_FONT_HANDLE && Zero(profile));
+    Require(sceFontGetFontGlyphsOutlineProfile(plain, nullptr) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    Require(sceFontGetFontGlyphsOutlineProfile(nullptr, nullptr) == SCE_FONT_ERROR_INVALID_FONT_HANDLE);
+    Require(sceFontGetFontGlyphsOutlineProfile(reinterpret_cast<FontHandle>(notAFont), nullptr) == SCE_FONT_ERROR_INVALID_FONT_HANDLE);
+    auto* plainFont = reinterpret_cast<Font::FontHandleNative*>(plain);
+    const FontLibrary owner = plainFont->library;
+    plainFont->library = nullptr;
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(plain, &profile) == SCE_FONT_ERROR_INVALID_FONT_HANDLE && Zero(profile));
+    Require(sceFontGetFontGlyphsOutlineProfile(plain, nullptr) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    plainFont->library = owner;
+    Fill(profile);
+    Require(sceFontGetFontGlyphsOutlineProfile(plain, &profile) == SCE_FONT_OK && Zero(profile));
+
+    for (FontHandle font : {profiled, plain, shortMaxp}) Require(sceFontCloseFont(font) == SCE_FONT_OK);
+    Require(sceFontDestroyLibrary(&library) == SCE_FONT_OK);
+    Require(sceFontMemoryTerm(&memory) == SCE_FONT_OK);
+    std::puts("Font outline profile tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestFontStyleInformation.cpp b/core/libs/tests/GuestFontStyleInformation.cpp
new file mode 100644
index 0000000000..21443be90b
--- /dev/null
+++ b/core/libs/tests/GuestFontStyleInformation.cpp
@@ -0,0 +1,158 @@
+#include "prx/libSceFont/include/FontDriver.hpp"
+#include "prx/libSceFont/libSceFont.hpp"
+#include "prx/libSceFontFt/libSceFontFt.hpp"
+#include "tests/FontFixture.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <map>
+#include <string>
+#include <string_view>
+#include <vector>
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "Font style information check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+using FontFixture::BuildFont;
+using FontFixture::Words;
+
+static void* APS5_VABI Allocate(void*, std::uint32_t size) {
+    return std::malloc(size);
+}
+
+static void APS5_VABI Release(void*, void* pointer) {
+    std::free(pointer);
+}
+
+static std::vector<unsigned char> NameTable(std::string_view family, std::string_view style) {
+    const int familyBytes = static_cast<int>(family.size() * 2);
+    const int styleBytes = static_cast<int>(style.size() * 2);
+    std::vector<unsigned char> table = Words({0, 2, 30, 3, 1, 0x409, 1, familyBytes, 0, 3, 1, 0x409, 2, styleBytes, familyBytes});
+    for (const char c : family) FontFixture::Put16(table, c);
+    for (const char c : style) FontFixture::Put16(table, c);
+    return table;
+}
+
+static std::vector<unsigned char> Os2Table(int weight, int width) {
+    return Words({0, 500, weight, width, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+        0, 0x20, 0x7E, 700, -300, 100, 900, 250});
+}
+
+static void PatchHead(std::vector<unsigned char>& font, int macStyle, int direction) {
+    const int tableCount = (font[4] << 8) | font[5];
+    for (int i = 0; i < tableCount; ++i) {
+        const std::size_t entry = 12 + 16 * static_cast<std::size_t>(i);
+        if (std::memcmp(font.data() + entry, "head", 4) != 0) continue;
+        const std::size_t offset = (static_cast<std::size_t>(font[entry + 8]) << 24) | (static_cast<std::size_t>(font[entry + 9]) << 16) |
+            (static_cast<std::size_t>(font[entry + 10]) << 8) | font[entry + 11];
+        font[offset + 44] = static_cast<unsigned char>((macStyle >> 8) & 0xFF);
+        font[offset + 45] = static_cast<unsigned char>(macStyle & 0xFF);
+        font[offset + 48] = static_cast<unsigned char>((direction >> 8) & 0xFF);
+        font[offset + 49] = static_cast<unsigned char>(direction & 0xFF);
+        return;
+    }
+    Require(false);
+}
+
+static FontHandle Open(FontLibrary library, const std::vector<unsigned char>& data) {
+    FontHandle font = nullptr;
+    Require(sceFontOpenFontMemory(library, data.data(), static_cast<std::uint32_t>(data.size()), nullptr, &font) == SCE_FONT_OK && font != nullptr);
+    return font;
+}
+
+static FontStyleInformation Information(FontHandle font) {
+    FontStyleInformation information{};
+    std::memset(&information, 0x7F, sizeof(information));
+    Require(sceFontGetFontStyleInformation(font, &information) == SCE_FONT_OK);
+    return information;
+}
+
+static bool Cleared(const FontStyleInformation& information) {
+    return information.familyName && information.familyName[0] == '\0' && information.styleName && information.styleName[0] == '\0' &&
+        information.styleFlags == 0 && information.weight == 0 && information.width == 0 && information.layoutFlags == 0;
+}
+
+int main() {
+    const FontMemoryInterface iface{Allocate, Release, nullptr, nullptr, nullptr, nullptr};
+    FontMemory memory{};
+    Require(sceFontMemoryInit(&memory, nullptr, 0, &iface, nullptr, nullptr, nullptr) == SCE_FONT_OK);
+    FontLibrary library = nullptr;
+    Require(sceFontCreateLibrary(&memory, sceFontSelectLibraryFt(0), &library) == SCE_FONT_OK);
+    Require(sceFontSupportExternalFonts(library, 4, 0x52) == SCE_FONT_OK);
+
+    auto namedData = BuildFont(1, {{"name", NameTable("Tst", "Bd")}});
+    PatchHead(namedData, 3, -2);
+    FontHandle named = Open(library, namedData);
+    const FontStyleInformation namedInfo = Information(named);
+    Require(namedInfo.familyName && std::string(namedInfo.familyName) == "Tst");
+    Require(namedInfo.styleName && std::string(namedInfo.styleName) == "Bd");
+    Require(namedInfo.styleFlags == 3 && namedInfo.weight == 0 && namedInfo.width == 0 && namedInfo.layoutFlags == 2);
+
+    const auto os2Data = BuildFont(1, {{"name", NameTable("Tst", "Rg")}, {"OS/2", Os2Table(400, 5)},
+        {"vhea", Words({0x11, 0, 880, -120, 60, 1000, 40, 0, 950, 0, 0, 0, 0, 0, 0, 0, 0, 1})}, {"vmtx", Words({1000, 40})}});
+    FontHandle os2 = Open(library, os2Data);
+    const FontStyleInformation os2Info = Information(os2);
+    Require(os2Info.styleFlags == 0 && os2Info.weight == 400 && os2Info.width == 5 && os2Info.layoutFlags == 0x81);
+
+    const auto oddData = BuildFont(1, {{"name", NameTable("Tst", "Rg")}, {"OS/2", Os2Table(450, 12)}});
+    FontHandle odd = Open(library, oddData);
+    const FontStyleInformation oddInfo = Information(odd);
+    Require(oddInfo.weight == 0 && oddInfo.width == 0 && oddInfo.layoutFlags == 1);
+
+    for (const int weight : {100, 900}) {
+        const auto data = BuildFont(1, {{"name", NameTable("Tst", "Rg")}, {"OS/2", Os2Table(weight, 9)}});
+        FontHandle font = Open(library, data);
+        const FontStyleInformation info = Information(font);
+        Require(info.weight == weight && info.width == 9);
+        Require(sceFontCloseFont(font) == SCE_FONT_OK);
+    }
+    for (const int weight : {0, 1000}) {
+        const auto data = BuildFont(1, {{"name", NameTable("Tst", "Rg")}, {"OS/2", Os2Table(weight, 10)}});
+        FontHandle font = Open(library, data);
+        const FontStyleInformation info = Information(font);
+        Require(info.weight == 0 && info.width == 0);
+        Require(sceFontCloseFont(font) == SCE_FONT_OK);
+    }
+
+    static const char recordFamily[] = "Rf";
+    static const char recordStyle[] = "Rs";
+    std::array<std::byte, 116> record{};
+    record[4] = std::byte{1};
+    record[5] = std::byte{7};
+    record[6] = std::byte{3};
+    record[7] = std::byte{0x81};
+    const char* familyPointer = recordFamily;
+    const char* stylePointer = recordStyle;
+    std::memcpy(record.data() + 8, &familyPointer, sizeof(familyPointer));
+    std::memcpy(record.data() + 16, &stylePointer, sizeof(stylePointer));
+    auto* nativeFont = reinterpret_cast<Font::FontHandleNative*>(os2);
+    nativeFont->open_info.fontset_record = record.data();
+    const FontStyleInformation recordInfo = Information(os2);
+    nativeFont->open_info.fontset_record = nullptr;
+    Require(recordInfo.familyName == recordFamily && recordInfo.styleName == recordStyle);
+    Require(recordInfo.styleFlags == 1 && recordInfo.weight == 700 && recordInfo.width == 3 && recordInfo.layoutFlags == 0x81);
+
+    FontStyleInformation cleared{};
+    std::memset(&cleared, 0x7F, sizeof(cleared));
+    Require(sceFontGetFontStyleInformation(nullptr, &cleared) == SCE_FONT_ERROR_INVALID_FONT_HANDLE && Cleared(cleared));
+    std::uint64_t notAFont[32]{};
+    std::memset(&cleared, 0x7F, sizeof(cleared));
+    Require(sceFontGetFontStyleInformation(reinterpret_cast<FontHandle>(notAFont), &cleared) == SCE_FONT_ERROR_INVALID_FONT_HANDLE && Cleared(cleared));
+    Require(sceFontGetFontStyleInformation(named, nullptr) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    Require(sceFontGetFontStyleInformation(nullptr, nullptr) == SCE_FONT_ERROR_INVALID_FONT_HANDLE);
+
+    for (FontHandle font : {named, os2, odd}) Require(sceFontCloseFont(font) == SCE_FONT_OK);
+    Require(sceFontDestroyLibrary(&library) == SCE_FONT_OK);
+    Require(sceFontMemoryTerm(&memory) == SCE_FONT_OK);
+    std::puts("Font style information tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestFontWords.cpp b/core/libs/tests/GuestFontWords.cpp
new file mode 100644
index 0000000000..6a23430a7c
--- /dev/null
+++ b/core/libs/tests/GuestFontWords.cpp
@@ -0,0 +1,314 @@
+#include "prx/libSceFont/libSceFont.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <string>
+#include <vector>
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "Font words check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+struct AllocationState {
+    std::size_t live = 0;
+    bool fail = false;
+};
+
+static void* APS5_VABI Allocate(void* object, std::uint32_t size) {
+    auto& state = *static_cast<AllocationState*>(object);
+    if (state.fail) return nullptr;
+    void* allocation = std::malloc(size == 0 ? 1 : size);
+    if (allocation) ++state.live;
+    return allocation;
+}
+
+static void APS5_VABI Deallocate(void* object, void* allocation) {
+    auto& state = *static_cast<AllocationState*>(object);
+    Require(allocation && state.live > 0);
+    --state.live;
+    std::free(allocation);
+}
+
+struct WordText {
+    std::vector<std::uint32_t> codes;
+    std::size_t position = 0;
+    std::size_t parses = 0;
+    std::int32_t errorCode = 0;
+};
+
+static std::int32_t APS5_VABI ParseWords(FontTextSource* source, void** order, FontTextParseResult* result) {
+    auto& text = *static_cast<WordText*>(source->textObject);
+    ++text.parses;
+    if (text.errorCode != 0 && text.position == 1) {
+        result->Error.errorCode = text.errorCode;
+        return -1;
+    }
+    const std::uint32_t code = text.position < text.codes.size() ? text.codes[text.position] : 0;
+    *order = reinterpret_cast<void*>(text.position);
+    ++text.position;
+    if (code == 0 || code == ' ') {
+        result->Terminate.terminateCode = code;
+        return 0;
+    }
+    result->FontCode.code = code;
+    return 1;
+}
+
+static int APS5_VABI RewindWords(FontTextSource* source) {
+    static_cast<WordText*>(source->textObject)->position = 0;
+    return SCE_FONT_OK;
+}
+
+static WordText Text(const std::string& value) {
+    WordText text;
+    for (const char c : value) text.codes.push_back(static_cast<unsigned char>(c));
+    return text;
+}
+
+struct Fixture {
+    AllocationState allocations;
+    FontMemoryInterface iface{Allocate, Deallocate, nullptr, nullptr, nullptr, nullptr};
+    FontMemory memory{};
+
+    Fixture() { Require(sceFontMemoryInit(&memory, nullptr, 0, &iface, &allocations, nullptr, nullptr) == SCE_FONT_OK); }
+
+    int Create(WordText& text, FontWords** words) {
+        FontTextSource source{};
+        Require(sceFontTextSourceInit(&source, nullptr, 0, ParseWords, &text) == SCE_FONT_OK);
+        text.position = 0;
+        const int rc = sceFontCreateWords(&memory, &source, 0, words);
+        RewindWords(&source);
+        return rc;
+    }
+};
+
+struct Characters {
+    std::vector<FontTextCharacter> items;
+
+    explicit Characters(const std::string& value, std::uint64_t flags = 0) : items(value.size()) {
+        for (std::size_t i = 0; i < value.size(); ++i) {
+            items[i].characterCode = static_cast<unsigned char>(value[i]);
+            items[i].clusterSpan = 1;
+            items[i].flags = flags;
+        }
+        Link();
+    }
+
+    void Link() {
+        for (std::size_t i = 0; i < items.size(); ++i) {
+            items[i].prev = i == 0 ? nullptr : &items[i - 1];
+            items[i].next = i + 1 < items.size() ? &items[i + 1] : nullptr;
+        }
+    }
+
+    FontTextCharacter* operator[](std::size_t index) { return &items[index]; }
+};
+
+static FontTextCharacter* Find(FontWords* words, FontTextCharacter* first, FontTextCharacter** next = nullptr, FontTextCharacter* end = nullptr) {
+    FontTextCharacter* last = reinterpret_cast<FontTextCharacter*>(1);
+    FontTextCharacter* following = reinterpret_cast<FontTextCharacter*>(1);
+    Require(sceFontWordsFindWordCharacters(words, first, end, &last, &following) == SCE_FONT_OK);
+    if (next) *next = following;
+    return last;
+}
+
+static void CreateValidation() {
+    Fixture fixture;
+    WordText text = Text("an");
+    FontTextSource source{};
+    Require(sceFontTextSourceInit(&source, nullptr, 0, ParseWords, &text) == SCE_FONT_OK);
+    FontWords* words = reinterpret_cast<FontWords*>(1);
+    Require(sceFontCreateWords(nullptr, &source, 0, &words) == SCE_FONT_ERROR_INVALID_PARAMETER && words == nullptr);
+    FontMemory badMemory{};
+    words = reinterpret_cast<FontWords*>(1);
+    Require(sceFontCreateWords(&badMemory, &source, 0, &words) == SCE_FONT_ERROR_INVALID_MEMORY && words == nullptr);
+    Require(sceFontCreateWords(&fixture.memory, nullptr, 0, &words) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    Require(sceFontCreateWords(&fixture.memory, &source, 0, nullptr) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    FontTextSource unknown = source;
+    unknown.systemUse0 = 0;
+    Require(sceFontCreateWords(&fixture.memory, &unknown, 0, &words) == SCE_FONT_ERROR_INVALID_TEXT_SOURCE && words == nullptr);
+    Require(sceFontTextSourceRewind(&unknown) == SCE_FONT_ERROR_INVALID_TEXT_SOURCE);
+    Require(sceFontTextSourceSetDefaultFont(&unknown, nullptr) == SCE_FONT_ERROR_INVALID_TEXT_SOURCE);
+    Require(sceFontTextSourceSetWritingForm(&unknown, 0x10) == SCE_FONT_ERROR_INVALID_TEXT_SOURCE);
+    Require(sceFontTextSourceRewind(nullptr) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    Require(sceFontTextSourceSetWritingForm(&source, 0x13) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    Require(text.parses == 0);
+    Require(fixture.allocations.live == 0);
+}
+
+static void CreateFailures() {
+    Fixture fixture;
+    FontWords* words = reinterpret_cast<FontWords*>(1);
+    WordText unsorted = Text("be an");
+    Require(fixture.Create(unsorted, &words) == SCE_FONT_ERROR_NO_SUPPORT_CODE && words == nullptr);
+    WordText sibling = Text("abc abb");
+    Require(fixture.Create(sibling, &words) == SCE_FONT_ERROR_NO_SUPPORT_CODE && words == nullptr);
+    WordText prefixThenSmaller = Text("abc ab abb");
+    Require(fixture.Create(prefixThenSmaller, &words) == SCE_FONT_ERROR_NO_SUPPORT_CODE && words == nullptr);
+    WordText negative;
+    negative.codes = {'a', 0x80000000u};
+    Require(fixture.Create(negative, &words) == SCE_FONT_ERROR_NO_SUPPORT_CODE && words == nullptr);
+    WordText failing = Text("an");
+    failing.errorCode = static_cast<std::int32_t>(0x80460099);
+    Require(fixture.Create(failing, &words) == static_cast<int>(0x80460099) && words == nullptr);
+    failing = Text("an");
+    failing.errorCode = 5;
+    Require(fixture.Create(failing, &words) == SCE_FONT_ERROR_INVALID_TEXT_SOURCE && words == nullptr);
+    WordText valid = Text("an");
+    fixture.allocations.fail = true;
+    Require(fixture.Create(valid, &words) == SCE_FONT_ERROR_ALLOCATION_FAILED && words == nullptr);
+    fixture.allocations.fail = false;
+    Require(fixture.allocations.live == 0);
+}
+
+static void CreateAndDestroy() {
+    Fixture fixture;
+    WordText text = Text("an and ant be");
+    FontWords* words = nullptr;
+    Require(fixture.Create(text, &words) == SCE_FONT_OK && words != nullptr);
+    Require(fixture.allocations.live == 2);
+    FontWords* copy = words;
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK && words == nullptr);
+    Require(fixture.allocations.live == 0);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    Require(sceFontDestroyWords(nullptr) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    std::uint64_t garbage[8]{};
+    copy = reinterpret_cast<FontWords*>(garbage);
+    Require(sceFontDestroyWords(&copy) == SCE_FONT_ERROR_INVALID_WORDS && copy != nullptr);
+    WordText empty;
+    Require(fixture.Create(empty, &words) == SCE_FONT_OK && words != nullptr);
+    Characters chars("an");
+    Require(Find(words, chars[0]) == nullptr);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+    Require(fixture.allocations.live == 0);
+}
+
+static void FindValidation() {
+    Fixture fixture;
+    WordText text = Text("an");
+    FontWords* words = nullptr;
+    Require(fixture.Create(text, &words) == SCE_FONT_OK);
+    Characters chars("an");
+    FontTextCharacter* last = chars[0];
+    FontTextCharacter* next = chars[0];
+    Require(sceFontWordsFindWordCharacters(nullptr, chars[0], nullptr, &last, &next) == SCE_FONT_ERROR_INVALID_PARAMETER && last == nullptr && next == nullptr);
+    next = chars[0];
+    Require(sceFontWordsFindWordCharacters(words, nullptr, nullptr, &last, &next) == SCE_FONT_ERROR_INVALID_PARAMETER && next == nullptr);
+    Require(sceFontWordsFindWordCharacters(words, chars[0], nullptr, nullptr, &next) == SCE_FONT_ERROR_INVALID_PARAMETER);
+    std::uint64_t garbage[8]{};
+    last = chars[0];
+    Require(sceFontWordsFindWordCharacters(reinterpret_cast<FontWords*>(garbage), chars[0], nullptr, &last, nullptr) == SCE_FONT_ERROR_INVALID_WORDS && last == nullptr);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+}
+
+static void LongestMatch() {
+    Fixture fixture;
+    WordText text = Text("an and ant be");
+    FontWords* words = nullptr;
+    Require(fixture.Create(text, &words) == SCE_FONT_OK);
+    Characters andy("andy");
+    FontTextCharacter* next = nullptr;
+    Require(Find(words, andy[0], &next) == andy[2] && next == andy[3]);
+    Characters ant("ant");
+    Require(Find(words, ant[0], &next) == ant[2] && next == nullptr);
+    Characters ab("ab");
+    Require(Find(words, ab[0], &next) == nullptr && next == nullptr);
+    Characters ba("ba");
+    Require(Find(words, ba[0]) == nullptr);
+    Characters band("and");
+    Require(Find(words, band[0], &next, band[2]) == band[1] && next == band[2]);
+    Characters empty("be");
+    Require(Find(words, empty[0], &next, empty[0]) == empty[1] && next == nullptr);
+    Characters joined("andy");
+    joined.items[3].flags = std::uint64_t{1} << 43;
+    Require(Find(words, joined[0]) == joined[1]);
+    joined.items[3].flags = std::uint64_t{3} << 43;
+    Require(Find(words, joined[0]) == joined[2]);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+}
+
+static void Clusters() {
+    Fixture fixture;
+    WordText text = Text("ab abc");
+    FontWords* words = nullptr;
+    Require(fixture.Create(text, &words) == SCE_FONT_OK);
+    Characters split("abcd");
+    split.items[2].clusterIndex = 1;
+    FontTextCharacter* next = nullptr;
+    Require(Find(words, split[0], &next) == split[1] && next == split[3]);
+    Characters marked("abxc");
+    marked.items[2].synthetic = 1;
+    Require(Find(words, marked[0], &next) == marked[3] && next == nullptr);
+    marked.items[2].synthetic = -1;
+    marked.items[2].clusterKind = 1;
+    Require(Find(words, marked[0]) == marked[3]);
+    Characters lead("abxc");
+    lead.items[2].synthetic = -1;
+    lead.items[2].clusterKind = 2;
+    lead.items[3].characterCode = 'z';
+    Require(Find(words, lead[0]) == nullptr);
+    lead.items[2].clusterKind = 1;
+    Require(Find(words, lead[0], &next) == lead[1] && next == lead[3]);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+}
+
+static void SegmentedRuns() {
+    Fixture fixture;
+    WordText text = Text("an ant be tea");
+    FontWords* words = nullptr;
+    Require(fixture.Create(text, &words) == SCE_FONT_OK);
+    Characters following("antbe", 1);
+    Require(Find(words, following[0]) == following[2]);
+    Characters shorter("antea", 1);
+    Require(Find(words, shorter[0]) == shorter[1]);
+    Characters fallback("antx", 1);
+    Require(Find(words, fallback[0]) == fallback[2]);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+
+    WordText overlapping = Text("ab bcd");
+    Require(fixture.Create(overlapping, &words) == SCE_FONT_OK);
+    Characters overrun("abcd", 1);
+    overrun.items[0].flags = 0;
+    FontTextCharacter* next = overrun[0];
+    Require(Find(words, overrun[0], &next) == nullptr && next == nullptr);
+    Characters contained("abcd", 1);
+    Require(Find(words, contained[0]) == contained[1]);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+    Require(fixture.allocations.live == 0);
+}
+
+static void DepthLimit() {
+    Fixture fixture;
+    WordText text = Text(std::string(129, 'a') + " b");
+    FontWords* words = nullptr;
+    Require(fixture.Create(text, &words) == SCE_FONT_OK);
+    Characters longWord(std::string(129, 'a'));
+    Require(Find(words, longWord[0]) == nullptr);
+    Characters later("b");
+    Require(Find(words, later[0]) == nullptr);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+    WordText exact = Text(std::string(128, 'a') + " b");
+    Require(fixture.Create(exact, &words) == SCE_FONT_OK);
+    Characters fullWord(std::string(128, 'a'));
+    Require(Find(words, fullWord[0]) == fullWord[127]);
+    Require(Find(words, later[0]) == later[0]);
+    Require(sceFontDestroyWords(&words) == SCE_FONT_OK);
+}
+
+int main() {
+    CreateValidation();
+    CreateFailures();
+    CreateAndDestroy();
+    FindValidation();
+    LongestMatch();
+    Clusters();
+    SegmentedRuns();
+    DepthLimit();
+    std::puts("Font words tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestFontWritingLine.cpp b/core/libs/tests/GuestFontWritingLine.cpp
index 5c311aede3..0f41bb2066 100644
--- a/core/libs/tests/GuestFontWritingLine.cpp
+++ b/core/libs/tests/GuestFontWritingLine.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 #include "prx/libSceFont/include/FontTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,16 +6,6 @@
 #include <exception>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceFontCreateWritingLine(const FontMemory*, std::int32_t, const void*, void**);
-int APS5_VABI sceFontDestroyWritingLine(void**);
-int APS5_VABI sceFontWritingLineClear(void*);
-int APS5_VABI sceFontWritingLineWritesOrder(void*, std::uint64_t, const FontWritingMetrics*, void*);
-const FontWritingLineStep* APS5_VABI sceFontWritingLineRefersRenderStep(void*);
-int APS5_VABI sceFontWritingLineGetRenderMetrics(void*, FontWritingMetrics*);
-int APS5_VABI sceFontWritingLineGetOrderingSpace(void*, float*, float*, float*, float*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Font writing line check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestFopenErrors.cpp b/core/libs/tests/GuestFopenErrors.cpp
index 5c72df7df0..8b2f1f0d81 100644
--- a/core/libs/tests/GuestFopenErrors.cpp
+++ b/core/libs/tests/GuestFopenErrors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <chrono>
@@ -6,15 +7,11 @@
 #include <filesystem>
 #include <fstream>
 #include <string>
+#ifdef _WIN32
+#include <windows.h>
+#else
 #include <unistd.h>
-
-extern "C" {
-void* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
-int APS5_VABI fclose_nid_postfix(void* stream);
-void* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode, void* stream);
-int APS5_VABI fopen_s_nid_postfix(void** result, const char* filename, const char* mode);
-int* APS5_VABI __error_nid_postfix();
-}
+#endif
 
 namespace {
 
@@ -29,6 +26,7 @@ void Require(bool value, int line) {
 constexpr int GuestEnoent = 2;
 constexpr int GuestEisdir = 21;
 constexpr int GuestEinval = 22;
+constexpr int GuestEnotsup = 45;
 constexpr int GuestEloop = 62;
 constexpr int GuestEnametoolong = 63;
 
@@ -39,7 +37,17 @@ std::filesystem::path EnterFreshRoot() {
         ("anyps5-fopen-errors-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
     std::filesystem::create_directories(root / "folder");
     std::filesystem::current_path(root);
+#ifdef _WIN32
+    if (CreateSymbolicLinkW(L"loop", L"loop", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) == 0) {
+        Check(GetLastError() == ERROR_PRIVILEGE_NOT_HELD);
+        std::fprintf(stderr, "fopen error checks skipped: creating symbolic links needs Developer Mode or administrator rights\n");
+        std::filesystem::current_path(root.parent_path());
+        std::filesystem::remove_all(root);
+        std::exit(77);
+    }
+#else
     Check(::symlink("loop", "loop") == 0);
+#endif
     { std::ofstream file("plain.txt"); file << "plain"; }
     return root;
 }
@@ -60,12 +68,12 @@ void Open() {
     Check(OpenFails((LongName + "/inside").c_str(), "a", GuestEnametoolong));
     Check(OpenFails("missing.txt", "r", GuestEnoent));
     Check(OpenFails("folder", "w", GuestEisdir));
-    void* plain = fopen_nid_postfix("plain.txt", "r");
+    FileStream* plain = fopen_nid_postfix("plain.txt", "r");
     Check(plain != nullptr && fclose_nid_postfix(plain) == 0);
 }
 
 bool ReopenFails(const char* name, const char* mode, int error) {
-    void* stream = fopen_nid_postfix("plain.txt", "r");
+    FileStream* stream = fopen_nid_postfix("plain.txt", "r");
     Check(stream != nullptr);
     *__error_nid_postfix() = 0;
     const bool failed = freopen_nid_postfix(name, mode, stream) == nullptr && *__error_nid_postfix() == error;
@@ -79,14 +87,14 @@ void Reopen() {
     Check(ReopenFails(LongName.c_str(), "r", GuestEnametoolong));
     Check(ReopenFails(LongName.c_str(), "w", GuestEnametoolong));
     Check(ReopenFails("missing.txt", "r", GuestEnoent));
-    void* stream = fopen_nid_postfix("plain.txt", "r");
+    FileStream* stream = fopen_nid_postfix("plain.txt", "r");
     Check(stream != nullptr);
-    void* reopened = freopen_nid_postfix("plain.txt", "r", stream);
+    FileStream* reopened = freopen_nid_postfix("plain.txt", "r", stream);
     Check(reopened != nullptr && fclose_nid_postfix(reopened) == 0);
 }
 
 void CheckedOpen() {
-    void* stream = reinterpret_cast<void*>(1);
+    FileStream* stream = reinterpret_cast<FileStream*>(1);
     Check(fopen_s_nid_postfix(&stream, "loop", "r") == GuestEloop && stream == nullptr);
     Check(fopen_s_nid_postfix(&stream, LongName.c_str(), "w") == GuestEnametoolong && stream == nullptr);
     Check(fopen_s_nid_postfix(&stream, "folder", "w") == GuestEisdir && stream == nullptr);
@@ -95,6 +103,31 @@ void CheckedOpen() {
     Check(fopen_s_nid_postfix(&stream, "plain.txt", "r") == 0 && stream != nullptr && fclose_nid_postfix(stream) == 0);
 }
 
+void CheckedReopen() {
+    FileStream* const sentinel = reinterpret_cast<FileStream*>(1);
+    FileStream* result = sentinel;
+    FileStream* stream = fopen_nid_postfix("plain.txt", "r");
+    Check(stream != nullptr);
+    Check(freopen_s_nid_postfix(nullptr, "plain.txt", "r", stream) == GuestEinval);
+    Check(freopen_s_nid_postfix(&result, nullptr, "r", stream) == GuestEnotsup && result == nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "plain.txt", nullptr, stream) == GuestEinval && result == nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "plain.txt", "r", nullptr) == GuestEinval && result == nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "plain.txt", "z", stream) == GuestEinval && result == nullptr);
+    Check(freopen_s_nid_postfix(&result, "reopened.txt", "w", stream) == 0 && result == stream);
+    Check(fclose_nid_postfix(stream) == 0 && std::filesystem::exists("reopened.txt"));
+    stream = fopen_nid_postfix("plain.txt", "r");
+    Check(stream != nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "loop", "r", stream) == GuestEloop && result == nullptr);
+    stream = fopen_nid_postfix("plain.txt", "r");
+    Check(stream != nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "missing.txt", "r", stream) == GuestEnoent && result == nullptr);
+}
+
 }
 
 int main() {
@@ -102,7 +135,11 @@ int main() {
     Open();
     Reopen();
     CheckedOpen();
+    CheckedReopen();
     std::error_code error;
+#ifdef _WIN32
+    DeleteFileW(L"loop");
+#endif
     std::filesystem::current_path(std::filesystem::temp_directory_path(), error);
     std::filesystem::remove_all(root, error);
     return 0;
diff --git a/core/libs/tests/GuestFopenLongHostPath.cpp b/core/libs/tests/GuestFopenLongHostPath.cpp
index 9ebe1738ce..8b79945a60 100644
--- a/core/libs/tests/GuestFopenLongHostPath.cpp
+++ b/core/libs/tests/GuestFopenLongHostPath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -7,17 +8,11 @@
 #include <memory>
 #include <stdexcept>
 #include <string>
+#ifndef NOMINMAX
 #define NOMINMAX
+#endif
 #include <windows.h>
 
-extern "C" {
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(void*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, void*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value, const char* message) {
@@ -29,7 +24,7 @@ std::filesystem::path Extended(const std::filesystem::path& path) {
     return native.starts_with(L"\\\\") ? L"\\\\?\\UNC\\" + native.substr(2) : L"\\\\?\\" + native;
 }
 
-using Stream = std::unique_ptr<void, decltype(&fclose_nid_postfix)>;
+using Stream = std::unique_ptr<FileStream, decltype(&fclose_nid_postfix)>;
 
 Stream Open(const char* path, const char* mode) {
     Stream stream(fopen_nid_postfix(path, mode), fclose_nid_postfix);
diff --git a/core/libs/tests/GuestForceTlsDestructor.cpp b/core/libs/tests/GuestForceTlsDestructor.cpp
index 6f900b9396..aba2bcafaa 100644
--- a/core/libs/tests/GuestForceTlsDestructor.cpp
+++ b/core/libs/tests/GuestForceTlsDestructor.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -10,15 +12,6 @@
 #include <dlfcn.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
-int APS5_VABI _sceLibcInternalThreadAtexit_nid_postfix(void (APS5_VABI* destructor)(void*), void* object, void* dsoSymbol);
-void APS5_VABI _sceLibcInternalThreadDtors_nid_postfix();
-int APS5_VABI _sceLibcInternalForceTlsDestructor_nid_postfix(KernelModule handle);
-}
-
 namespace {
 
 using Destructor = void (APS5_VABI*)(void*);
@@ -57,13 +50,14 @@ void* APS5_VABI Worker(void*) {
 KernelModule ModuleOf(const void* address) {
     ModuleInfoEx info{};
     info.st_size = sizeof(ModuleInfoEx);
-    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 2, &info) == 0);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 1, &info) == 0);
     return info.id;
 }
 
 bool ForceThrows(KernelModule handle) {
     try {
         _sceLibcInternalForceTlsDestructor_nid_postfix(handle);
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -101,6 +95,7 @@ int main() {
     Require(_sceLibcInternalForceTlsDestructor_nid_postfix(0) == 0);
     Require(calls.size() == 2);
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls == std::vector<std::intptr_t>{3, 1, 2});
 
     calls.clear();
@@ -108,6 +103,7 @@ int main() {
     Require(_sceLibcInternalForceTlsDestructor_nid_postfix(other) == 0);
     Require(calls.empty());
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls.empty());
 
     Require(Register(RecordAndRegister, 10) == 0);
diff --git a/core/libs/tests/GuestFreeType.cpp b/core/libs/tests/GuestFreeType.cpp
index 73139c73d1..ed1987ef28 100644
--- a/core/libs/tests/GuestFreeType.cpp
+++ b/core/libs/tests/GuestFreeType.cpp
@@ -1,10 +1,16 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FreeTypeFontFixture.hpp"
-#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <ft2build.h>
 #include FT_FREETYPE_H
+#include FT_GASP_H
 #include FT_OUTLINE_H
+#include FT_TRIGONOMETRY_H
+#include FT_CID_H
+#include FT_SIZES_H
+#include FT_SYSTEM_H
 
 #include <algorithm>
 #include <array>
@@ -24,22 +30,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-void APS5_VABI FT_Set_Transform_nid_postfix(GuestFaceRec*, const GuestMatrix*, const GuestVector*);
-int APS5_VABI FT_Init_FreeType_nid_postfix(void**);
-int APS5_VABI FT_Done_FreeType_nid_postfix(void*);
-int APS5_VABI FT_New_Face_nid_postfix(void*, const char*, std::int64_t, GuestFaceRec**);
-int APS5_VABI FT_New_Memory_Face_nid_postfix(void*, const unsigned char*, std::int64_t, std::int64_t, GuestFaceRec**);
-int APS5_VABI FT_Done_Face_nid_postfix(GuestFaceRec*);
-int APS5_VABI FT_Set_Pixel_Sizes_nid_postfix(GuestFaceRec*, std::uint32_t, std::uint32_t);
-int APS5_VABI FT_Get_Kerning_nid_postfix(GuestFaceRec*, std::uint32_t, std::uint32_t, std::uint32_t, GuestVector*);
-std::uint32_t APS5_VABI FT_Get_Char_Index_nid_postfix(GuestFaceRec*, std::uint64_t);
-int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec*, std::uint32_t, std::int32_t);
-int APS5_VABI FT_Load_Char_nid_postfix(GuestFaceRec*, std::uint64_t, std::int32_t);
-int APS5_VABI FT_Render_Glyph_nid_postfix(GuestGlyphSlotRec*, std::int32_t);
-int APS5_VABI FT_Set_Char_Size_nid_postfix(GuestFaceRec*, std::int64_t, std::int64_t, std::uint32_t, std::uint32_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType check failed at line %d\n", line);
@@ -48,6 +38,77 @@ static void Check(bool value, int line) {
 }
 #define Require(value) Check((value), __LINE__)
 
+static void CheckGaspTable(const std::vector<unsigned char>* table, const std::vector<std::pair<unsigned, int>>& ranges,
+                           bool versionZero, bool render) {
+    const auto font = SquareGlyphFont('A', 700, false, table);
+    FreeType::GuestLibrary* library = nullptr;
+    GuestFaceRec* face = nullptr;
+    FT_Library nativeLibrary = nullptr;
+    FT_Face native = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face(nativeLibrary, font.data(), static_cast<FT_Long>(font.size()), 0, &native) == 0);
+    auto* slot = face->glyph;
+    const auto glyphIndex = slot->glyph_index;
+    const auto bitmap = slot->bitmap.buffer;
+    const auto points = slot->outline.points;
+    for (std::uint32_t ppem = 0; ppem <= 65536; ++ppem) {
+        int expected = FT_GASP_NO_TABLE;
+        for (const auto& [maximum, flags] : ranges) {
+            if (ppem > maximum) continue;
+            expected = versionZero ? flags & 3 : flags;
+            break;
+        }
+        Require(FT_Get_Gasp_nid_postfix(face, ppem) == expected);
+        Require(FT_Get_Gasp(native, ppem) == expected);
+    }
+    Require(FT_Get_Gasp_nid_postfix(face, UINT32_MAX) == FT_GASP_NO_TABLE);
+    Require(face->glyph == slot && slot->glyph_index == glyphIndex && slot->bitmap.buffer == bitmap && slot->outline.points == points);
+    if (render) {
+        for (const unsigned ppem : {7u, 8u, 15u, 16u, 31u, 32u, 64u}) {
+            const int flags = FT_Get_Gasp_nid_postfix(face, ppem);
+            const int load = flags & FT_GASP_DO_GRIDFIT ? FT_LOAD_DEFAULT : FT_LOAD_NO_HINTING;
+            const auto mode = flags & FT_GASP_DO_GRAY ? FT_RENDER_MODE_NORMAL : FT_RENDER_MODE_MONO;
+            Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, ppem) == 0 && FT_Set_Pixel_Sizes(native, 0, ppem) == 0);
+            Require(FT_Load_Char_nid_postfix(face, 'A', load) == 0 && FT_Load_Char(native, 'A', load) == 0);
+            Require(FT_Render_Glyph_nid_postfix(face->glyph, mode) == 0 && FT_Render_Glyph(native->glyph, mode) == 0);
+            const auto& actual = face->glyph->bitmap;
+            const auto& expected = native->glyph->bitmap;
+            Require(actual.width > 0 && actual.rows > 0);
+            Require(actual.width == expected.width && actual.rows == expected.rows && actual.pitch == expected.pitch);
+            Require(actual.pixel_mode == expected.pixel_mode && actual.num_grays == expected.num_grays);
+            Require(face->glyph->bitmap_left == native->glyph->bitmap_left && face->glyph->bitmap_top == native->glyph->bitmap_top);
+            Require(std::memcmp(actual.buffer, expected.buffer, static_cast<std::size_t>(actual.rows) * std::abs(actual.pitch)) == 0);
+        }
+    }
+    Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+}
+
+static void CheckGasp() {
+    Require(FT_Get_Gasp_nid_postfix(nullptr, 0) == FT_GASP_NO_TABLE);
+    Require(FT_Get_Gasp_nid_postfix(nullptr, UINT32_MAX) == FT_GASP_NO_TABLE);
+    CheckGaspTable(nullptr, {}, false, false);
+    const std::vector<std::pair<unsigned, int>> ranges{{0, 0x8003}, {7, 2}, {15, 1}, {31, 0}, {65535, 0xFFFF}};
+    for (const unsigned version : {0u, 1u}) {
+        std::vector<unsigned char> table;
+        Put16(table, version);
+        Put16(table, ranges.size());
+        for (const auto& [maximum, flags] : ranges) {
+            Put16(table, maximum);
+            Put16(table, flags);
+        }
+        CheckGaspTable(&table, ranges, version == 0, true);
+    }
+    std::vector<unsigned char> shortRange;
+    PutAll16(shortRange, {1, 1, 48, FT_GASP_DO_GRAY});
+    CheckGaspTable(&shortRange, {{48, FT_GASP_DO_GRAY}}, false, false);
+    for (const std::vector<unsigned char>& table : {std::vector<unsigned char>{}, {0, 1}, {0, 1, 0, 0}, {0, 2, 0, 1, 0, 10, 0, 3}}) {
+        CheckGaspTable(&table, {}, false, false);
+    }
+    std::puts("FreeType gasp: 8 fonts, 524304 queries, null faces and 14 rendered glyphs passed");
+}
+
 template <typename TCall> static bool ThrowsWith(TCall call, const std::string& prefix) {
     try {
         call();
@@ -57,7 +118,7 @@ template <typename TCall> static bool ThrowsWith(TCall call, const std::string&
     return false;
 }
 
-static void FaceMatches(const GuestFaceRec* face, FT_Face host, const void* library) {
+static void FaceMatches(const GuestFaceRec* face, FT_Face host, const FreeType::GuestLibrary* library) {
     Require(face->num_faces == host->num_faces && face->face_index == host->face_index && face->face_flags == host->face_flags);
     Require(face->style_flags == host->style_flags && face->num_glyphs == host->num_glyphs && face->num_glyphs == 2);
     Require((face->family_name == nullptr) == (host->family_name == nullptr) && (face->style_name == nullptr) == (host->style_name == nullptr));
@@ -72,8 +133,6 @@ static void FaceMatches(const GuestFaceRec* face, FT_Face host, const void* libr
     Require(face->glyph != nullptr && face->glyph->face == face && face->glyph->library == library && face->size != nullptr && face->size->face == face);
 }
 
-extern "C" int APS5_VABI FT_Outline_Get_Orientation_nid_postfix(GuestOutline*);
-
 static unsigned orientationCases = 0;
 
 static void CheckOrientationCase(std::vector<GuestVector> points, std::vector<std::uint16_t> contours,
@@ -158,7 +217,7 @@ static void CheckOutlineOrientation() {
         CheckOrientationCase(points, contours, twiceArea == 0 ? FT_ORIENTATION_NONE : expected == FT_ORIENTATION_POSTSCRIPT ? FT_ORIENTATION_TRUETYPE : FT_ORIENTATION_POSTSCRIPT);
     }
     const auto font = SquareGlyphFont('A', 700);
-    void* library = nullptr;
+    FreeType::GuestLibrary* library = nullptr;
     GuestFaceRec* face = nullptr;
     FT_Library nativeLibrary = nullptr;
     FT_Face native = nullptr;
@@ -220,10 +279,591 @@ static void SizeMatches(const GuestFaceRec* face, FT_Face host) {
     Require(actual.height == expected.height && actual.max_advance == expected.max_advance);
 }
 
+static void Trigonometry() {
+    constexpr std::int64_t circle = 360ll << 16;
+    const std::array<std::pair<std::int64_t, std::int64_t>, 68> poleTangents{{
+        {-17694728ll, 33692373208ll},
+        {-17694727ll, 45725363639ll},
+        {-17694726ll, 45725363639ll},
+        {-17694725ll, 64015509094ll},
+        {-17694724ll, 64015509094ll},
+        {-17694723ll, 128031018189ll},
+        {-17694722ll, 128031018189ll},
+        {-17694721ll, 640155090944ll},
+        {-17694720ll, -640155090944ll},
+        {-17694719ll, -128031018189ll},
+        {-17694718ll, -128031018189ll},
+        {-17694717ll, -64015509094ll},
+        {-17694716ll, -64015509094ll},
+        {-17694715ll, -45725363639ll},
+        {-17694714ll, -45725363639ll},
+        {-17694713ll, -33692373208ll},
+        {-17694712ll, -33692373208ll},
+        {-5898248ll, 33692373208ll},
+        {-5898247ll, 45725363639ll},
+        {-5898246ll, 45725363639ll},
+        {-5898245ll, 64015509094ll},
+        {-5898244ll, 64015509094ll},
+        {-5898243ll, 128031018189ll},
+        {-5898242ll, 128031018189ll},
+        {-5898241ll, 640155090944ll},
+        {-5898240ll, -640155090944ll},
+        {-5898239ll, -128031018189ll},
+        {-5898238ll, -128031018189ll},
+        {-5898237ll, -64015509094ll},
+        {-5898236ll, -64015509094ll},
+        {-5898235ll, -45725363639ll},
+        {-5898234ll, -45725363639ll},
+        {-5898233ll, -33692373208ll},
+        {-5898232ll, -33692373208ll},
+        {5898232ll, 33692373208ll},
+        {5898233ll, 45725363639ll},
+        {5898234ll, 45725363639ll},
+        {5898235ll, 64015509094ll},
+        {5898236ll, 64015509094ll},
+        {5898237ll, 128031018189ll},
+        {5898238ll, 128031018189ll},
+        {5898239ll, 640155090944ll},
+        {5898240ll, -640155090944ll},
+        {5898241ll, -128031018189ll},
+        {5898242ll, -128031018189ll},
+        {5898243ll, -64015509094ll},
+        {5898244ll, -64015509094ll},
+        {5898245ll, -45725363639ll},
+        {5898246ll, -45725363639ll},
+        {5898247ll, -33692373208ll},
+        {5898248ll, -33692373208ll},
+        {17694712ll, 33692373208ll},
+        {17694713ll, 45725363639ll},
+        {17694714ll, 45725363639ll},
+        {17694715ll, 64015509094ll},
+        {17694716ll, 64015509094ll},
+        {17694717ll, 128031018189ll},
+        {17694718ll, 128031018189ll},
+        {17694719ll, 640155090944ll},
+        {17694720ll, -640155090944ll},
+        {17694721ll, -128031018189ll},
+        {17694722ll, -128031018189ll},
+        {17694723ll, -64015509094ll},
+        {17694724ll, -64015509094ll},
+        {17694725ll, -45725363639ll},
+        {17694726ll, -45725363639ll},
+        {17694727ll, -33692373208ll},
+        {17694728ll, -33692373208ll}}};
+    int scalarCases = 0;
+    int vectorCases = 0;
+    int differenceCases = 0;
+    for (const auto& [angle, tangent] : poleTangents) {
+        Require(FT_Tan_nid_postfix(angle) == tangent);
+        if (sizeof(FT_Fixed) == 4) {
+            Require(static_cast<std::int64_t>(FT_Tan(static_cast<FT_Angle>(angle))) != tangent);
+        } else {
+            Require(static_cast<std::int64_t>(FT_Tan(static_cast<FT_Angle>(angle))) == tangent);
+        }
+    }
+    auto compare = [&](std::int64_t angle, FT_Angle nativeAngle, std::int64_t expectedTangent) {
+        Require(FT_Cos_nid_postfix(angle) == FT_Cos(nativeAngle));
+        Require(FT_Sin_nid_postfix(angle) == FT_Sin(nativeAngle));
+        Require(FT_Tan_nid_postfix(angle) == expectedTangent);
+        FT_Vector expected{};
+        FT_Vector_Unit(&expected, nativeAngle);
+        struct GuardedVector {
+            std::uint64_t before;
+            GuestVector vector;
+            std::uint64_t after;
+        } actual{0xA55A0FF0FF00AA55ull, {INT64_MAX, INT64_MIN}, 0x55AA00FFF00F5AA5ull};
+        FT_Vector_Unit_nid_postfix(&actual.vector, angle);
+        Require(actual.vector.x == expected.x && actual.vector.y == expected.y);
+        Require(actual.vector.x == FT_Cos_nid_postfix(angle) && actual.vector.y == FT_Sin_nid_postfix(angle));
+        Require(actual.before == 0xA55A0FF0FF00AA55ull && actual.after == 0x55AA00FFF00F5AA5ull);
+        ++scalarCases;
+        ++vectorCases;
+    };
+    std::mt19937 random(0x17A693Bu);
+    std::uniform_int_distribution<std::int32_t> angles(INT32_MIN, INT32_MAX);
+    for (unsigned sample = 0; sample < 4096; ++sample) {
+        const std::int32_t angle = angles(random);
+        Require(FT_Cos_nid_postfix(angle) == FT_Cos(angle));
+        Require(FT_Sin_nid_postfix(angle) == FT_Sin(angle));
+        Require(static_cast<std::int32_t>(FT_Tan_nid_postfix(angle)) == FT_Tan(angle));
+        FT_Vector expected{};
+        GuestVector actual{};
+        FT_Vector_Unit(&expected, angle);
+        FT_Vector_Unit_nid_postfix(&actual, angle);
+        Require(actual.x == expected.x && actual.y == expected.y);
+        ++scalarCases;
+        ++vectorCases;
+    }
+    const std::array<std::int64_t, 14> bases{-circle + 1, -(180ll << 16), -(90ll << 16) - 1, -(45ll << 16),
+        -1, 0, 1, 25783, 45ll << 16, (90ll << 16) - 1, 90ll << 16, (90ll << 16) + 1, 180ll << 16, circle - 1};
+    for (const std::int64_t turns : {0ll, 1ll, -1ll, 97ll, -97ll, 100000000000ll, -100000000000ll, 390000000000ll, -390000000000ll}) {
+        for (const std::int64_t base : bases) {
+            const std::int64_t tangent = FT_Tan_nid_postfix(base);
+            compare(base + circle * turns, static_cast<FT_Angle>(base), tangent);
+            for (const std::int64_t other : bases) {
+                Require(FT_Angle_Diff_nid_postfix(base + circle * turns, other + circle * turns) ==
+                        FT_Angle_Diff(static_cast<FT_Angle>(base), static_cast<FT_Angle>(other)));
+                ++differenceCases;
+            }
+        }
+    }
+    for (const auto boundary : std::array<std::pair<std::int64_t, std::int64_t>, 4>{
+             std::pair{INT64_MIN, -16252928ll}, std::pair{INT64_MAX, 16252927ll},
+             std::pair{INT64_MIN + 1, -16252927ll}, std::pair{INT64_MAX - 1, 16252926ll}}) {
+        Require(FT_Cos_nid_postfix(boundary.first) == FT_Cos(static_cast<FT_Angle>(boundary.second)));
+        Require(FT_Sin_nid_postfix(boundary.first) == FT_Sin(static_cast<FT_Angle>(boundary.second)));
+        Require(FT_Tan_nid_postfix(boundary.first) == FT_Tan_nid_postfix(boundary.second));
+        FT_Vector expected{};
+        GuestVector actual{};
+        FT_Vector_Unit(&expected, static_cast<FT_Angle>(boundary.second));
+        FT_Vector_Unit_nid_postfix(&actual, boundary.first);
+        Require(actual.x == expected.x && actual.y == expected.y);
+        ++scalarCases;
+        ++vectorCases;
+    }
+    FT_Vector_Unit_nid_postfix(nullptr, INT64_MIN);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MIN, INT64_MIN + 1) == 1);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MAX, INT64_MAX - 1) == -1);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MIN, INT64_MIN) == 0);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MAX, INT64_MAX) == 0);
+    for (const auto pair : std::array<std::pair<std::int64_t, std::int64_t>, 4>{
+             std::pair{INT64_MIN, INT64_MAX}, std::pair{INT64_MAX, INT64_MIN}, std::pair{INT64_MIN, 0ll}, std::pair{0ll, INT64_MIN}}) {
+        if (pair.first == 0) {
+            Require(FT_Angle_Diff_nid_postfix(pair.first, pair.second) == FT_Angle_Diff_nid_postfix(0, -16252928));
+        } else {
+            Require(ThrowsWith([&] { FT_Angle_Diff_nid_postfix(pair.first, pair.second); }, "FT_Angle_Diff: overflowing signed angle subtraction"));
+        }
+    }
+    const auto font = SquareGlyphFont('A', 700);
+    GuestLibrary* library = nullptr;
+    FT_Library oracle = nullptr;
+    GuestFaceRec* face = nullptr;
+    FT_Face native = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&oracle) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face(oracle, font.data(), static_cast<FT_Long>(font.size()), 0, &native) == 0);
+    int rendered = 0;
+    for (const unsigned pixels : {32u, 64u}) {
+        Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, pixels) == FT_Set_Pixel_Sizes(native, 0, pixels));
+        for (const FT_Angle angle : {0L, 30L << 16, 45L << 16, 90L << 16, 135L << 16}) {
+            Require(FT_Load_Char_nid_postfix(face, 'A', FT_LOAD_DEFAULT) == FT_Load_Char(native, 'A', FT_LOAD_DEFAULT));
+            GuestVector unit{};
+            FT_Vector_Unit_nid_postfix(&unit, angle + circle * 100000000000ll);
+            for (unsigned point = 0; point < face->glyph->outline.n_points; ++point) {
+                auto& value = face->glyph->outline.points[point];
+                const auto x = static_cast<FT_Long>(value.x);
+                const auto y = static_cast<FT_Long>(value.y);
+                value = {FT_MulFix(x, static_cast<FT_Long>(unit.x)) - FT_MulFix(y, static_cast<FT_Long>(unit.y)),
+                         FT_MulFix(x, static_cast<FT_Long>(unit.y)) + FT_MulFix(y, static_cast<FT_Long>(unit.x))};
+            }
+            FT_Matrix matrix{FT_Cos(angle), -FT_Sin(angle), FT_Sin(angle), FT_Cos(angle)};
+            FT_Outline_Transform(&native->glyph->outline, &matrix);
+            Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL));
+            SlotMatches(face->glyph, native->glyph);
+            ++rendered;
+        }
+    }
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(oracle) == 0);
+    std::printf("FreeType trigonometry: %d scalar cases, %d vectors, %d angle differences, 68 LP64 tangent goldens, %d rendered glyphs\n",
+                scalarCases, vectorCases, differenceCases, rendered);
+}
+
+struct DecomposeEvents {
+    std::vector<std::array<std::int64_t, 7>> calls;
+    std::size_t stopAt = static_cast<std::size_t>(-1);
+    int result = 0;
+
+    int Add(int kind, GuestVector first, GuestVector second = {}, GuestVector third = {}) {
+        calls.push_back({kind, first.x, first.y, second.x, second.y, third.x, third.y});
+        return calls.size() - 1 == stopAt ? result : 0;
+    }
+};
+
+static GuestVector GuestPoint(const FT_Vector& point) { return {point.x, point.y}; }
+
+static int NativeMove(const FT_Vector* to, void* user) { return static_cast<DecomposeEvents*>(user)->Add(1, GuestPoint(*to)); }
+static int NativeLine(const FT_Vector* to, void* user) { return static_cast<DecomposeEvents*>(user)->Add(2, GuestPoint(*to)); }
+static int NativeConic(const FT_Vector* control, const FT_Vector* to, void* user) {
+    return static_cast<DecomposeEvents*>(user)->Add(3, GuestPoint(*control), GuestPoint(*to));
+}
+static int NativeCubic(const FT_Vector* first, const FT_Vector* second, const FT_Vector* to, void* user) {
+    return static_cast<DecomposeEvents*>(user)->Add(4, GuestPoint(*first), GuestPoint(*second), GuestPoint(*to));
+}
+
+static int APS5_VABI GuestMove(const GuestVector* to, void* user) { return static_cast<DecomposeEvents*>(user)->Add(1, *to); }
+static int APS5_VABI GuestLine(const GuestVector* to, void* user) { return static_cast<DecomposeEvents*>(user)->Add(2, *to); }
+static int APS5_VABI GuestConic(const GuestVector* control, const GuestVector* to, void* user) {
+    return static_cast<DecomposeEvents*>(user)->Add(3, *control, *to);
+}
+static int APS5_VABI GuestCubic(const GuestVector* first, const GuestVector* second, const GuestVector* to, void* user) {
+    return static_cast<DecomposeEvents*>(user)->Add(4, *first, *second, *to);
+}
+
+static int APS5_VABI NullUserMove(const GuestVector*, void* user) {
+    Require(user == nullptr);
+    return -17;
+}
+
+static std::size_t CompareDecomposition(std::vector<GuestVector> points, std::vector<unsigned char> tags,
+                                        std::vector<unsigned short> contours, int shift, std::int64_t delta,
+                                        std::size_t stopAt = static_cast<std::size_t>(-1), int stopResult = 0) {
+    std::vector<FT_Vector> nativePoints;
+    for (const auto point : points) nativePoints.push_back({static_cast<FT_Pos>(point.x), static_cast<FT_Pos>(point.y)});
+    GuestOutline outline{static_cast<std::uint16_t>(contours.size()), static_cast<std::uint16_t>(points.size()), points.data(), tags.data(), contours.data(), 0};
+    FT_Outline native{outline.n_contours, outline.n_points, nativePoints.data(), tags.data(), contours.data(), 0};
+    DecomposeEvents actual;
+    DecomposeEvents expected;
+    actual.stopAt = expected.stopAt = stopAt;
+    actual.result = expected.result = stopResult;
+    const GuestOutlineFuncs functions{GuestMove, GuestLine, GuestConic, GuestCubic, shift, delta};
+    const FT_Outline_Funcs nativeFunctions{NativeMove, NativeLine, NativeConic, NativeCubic, shift, static_cast<FT_Pos>(delta)};
+    const int result = FT_Outline_Decompose_nid_postfix(&outline, &functions, &actual);
+    Require(result == FT_Outline_Decompose(&native, &nativeFunctions, &expected));
+    Require(actual.calls == expected.calls);
+    for (std::size_t index = 0; index < points.size(); ++index) {
+        Require(points[index].x == nativePoints[index].x && points[index].y == nativePoints[index].y);
+    }
+    if (stopAt < expected.calls.size()) Require(result == stopResult && actual.calls.size() == stopAt + 1);
+    return actual.calls.size();
+}
+
+struct ChangingDecomposition {
+    DecomposeEvents events;
+    GuestOutlineFuncs guest{};
+    FT_Outline_Funcs native{};
+    GuestOutline* outline = nullptr;
+    FT_Outline* nativeOutline = nullptr;
+    GuestVector* replacement = nullptr;
+    FT_Vector* nativeReplacement = nullptr;
+};
+
+static int NativeChangedLine(const FT_Vector* to, void* user) {
+    return static_cast<ChangingDecomposition*>(user)->events.Add(5, GuestPoint(*to));
+}
+static int APS5_VABI GuestChangedLine(const GuestVector* to, void* user) {
+    return static_cast<ChangingDecomposition*>(user)->events.Add(5, *to);
+}
+static int NativeChangingMove(const FT_Vector* to, void* user) {
+    auto& state = *static_cast<ChangingDecomposition*>(user);
+    state.native.line_to = NativeChangedLine;
+    state.native.shift = 4;
+    state.native.delta = 999;
+    state.nativeOutline->points = state.nativeReplacement;
+    return state.events.Add(1, GuestPoint(*to));
+}
+static int APS5_VABI GuestChangingMove(const GuestVector* to, void* user) {
+    auto& state = *static_cast<ChangingDecomposition*>(user);
+    state.guest.line_to = GuestChangedLine;
+    state.guest.shift = 4;
+    state.guest.delta = 999;
+    state.outline->points = state.replacement;
+    GuestOutline empty{};
+    const GuestOutlineFuncs noCallbacks{};
+    Require(FT_Outline_Decompose_nid_postfix(&empty, &noCallbacks, nullptr) == 0);
+    return state.events.Add(1, *to);
+}
+
+static void OutlineDecomposition() {
+    GuestOutline empty{};
+    const GuestOutlineFuncs callbacks{GuestMove, GuestLine, GuestConic, GuestCubic, 0, 0};
+    const FT_Outline_Funcs nativeCallbacks{NativeMove, NativeLine, NativeConic, NativeCubic, 0, 0};
+    Require(FT_Outline_Decompose_nid_postfix(nullptr, nullptr, nullptr) == FT_Outline_Decompose(nullptr, nullptr, nullptr));
+    Require(FT_Outline_Decompose_nid_postfix(nullptr, &callbacks, nullptr) == FT_Outline_Decompose(nullptr, &nativeCallbacks, nullptr));
+    Require(FT_Outline_Decompose_nid_postfix(&empty, nullptr, nullptr) == FT_Err_Invalid_Argument);
+    const GuestOutlineFuncs unused{nullptr, nullptr, nullptr, nullptr, -1, INT64_MIN};
+    Require(FT_Outline_Decompose_nid_postfix(&empty, &unused, nullptr) == 0);
+    int scenarios = 0;
+    std::size_t calls = 0;
+    for (unsigned count = 1; count <= 6; ++count) {
+        std::vector<GuestVector> points;
+        for (unsigned point = 0; point < count; ++point) points.push_back({static_cast<std::int64_t>(point) * 13 - 37, static_cast<std::int64_t>(point) * -17 + 23});
+        const unsigned patterns = 1u << (2 * count);
+        for (unsigned pattern = 0; pattern < patterns; ++pattern) {
+            std::vector<unsigned char> tags;
+            for (unsigned point = 0; point < count; ++point) tags.push_back(static_cast<unsigned char>(((pattern >> (point * 2)) & 3) | 0xA4));
+            for (const int shift : {0, 1, 4}) {
+                for (const int delta : {-17, 0, 19}) {
+                    calls += CompareDecomposition(points, tags, {static_cast<unsigned short>(count - 1)}, shift, delta);
+                    ++scenarios;
+                }
+            }
+        }
+    }
+    const std::vector<GuestVector> curve{{-17, 3}, {7, -5}, {29, 31}, {43, -11}, {59, 37}, {73, -13}, {89, 41}, {101, -17}};
+    for (const auto& tags : std::vector<std::vector<unsigned char>>{{1, 0, 0, 1, 2, 2, 1, 0}, {1, 2, 2, 1, 0, 1, 2, 2}, {0, 0, 0, 0, 0, 0, 0, 0}}) {
+        for (const auto& contours : std::vector<std::vector<unsigned short>>{{7}, {2, 7}, {0, 3, 7}, {2, 1}}) {
+            const std::size_t events = CompareDecomposition(curve, tags, contours, 2, -3);
+            ++scenarios;
+            for (std::size_t stop = 0; stop < events; ++stop) {
+                for (const int error : {1, -17, 0x12345678, INT32_MIN}) {
+                    calls += CompareDecomposition(curve, tags, contours, 2, -3, stop, error);
+                    ++scenarios;
+                }
+            }
+        }
+    }
+    {
+        GuestVector points[]{{7, -5}, {11, 13}, {17, -19}, {23, 29}};
+        FT_Vector nativePoints[]{{7, -5}, {11, 13}, {17, -19}, {23, 29}};
+        GuestVector replacement[]{{107, 95}, {111, 113}, {117, 81}, {123, 129}};
+        FT_Vector nativeReplacement[]{{107, 95}, {111, 113}, {117, 81}, {123, 129}};
+        unsigned char tags[]{1, 1, 1, 1};
+        unsigned short contours[]{1, 3};
+        GuestOutline outline{2, 4, points, tags, contours, 0};
+        FT_Outline native{2, 4, nativePoints, tags, contours, 0};
+        ChangingDecomposition actual;
+        ChangingDecomposition expected;
+        actual.guest = {GuestChangingMove, nullptr, nullptr, nullptr, 1, -3};
+        expected.native = {NativeChangingMove, nullptr, nullptr, nullptr, 1, -3};
+        actual.outline = &outline;
+        actual.replacement = replacement;
+        expected.nativeOutline = &native;
+        expected.nativeReplacement = nativeReplacement;
+        Require(FT_Outline_Decompose_nid_postfix(&outline, &actual.guest, &actual) == FT_Outline_Decompose(&native, &expected.native, &expected));
+        Require(actual.events.calls == expected.events.calls && actual.events.calls.size() == 6);
+    }
+    {
+        GuestVector point{7, -5};
+        unsigned char tag = 1;
+        unsigned short contour = 0;
+        GuestOutline outline{1, 1, &point, &tag, &contour, 0};
+        const GuestOutlineFuncs nullUser{NullUserMove, nullptr, nullptr, nullptr, 0, 0};
+        Require(FT_Outline_Decompose_nid_postfix(&outline, &nullUser, nullptr) == -17);
+    }
+    {
+        GuestVector points[]{{0x10000000001ll, -0x10000000003ll}, {0x10000000005ll, -0x10000000007ll}, {0x10000000009ll, -0x1000000000Bll}};
+        unsigned char tags[]{1, 1, 1};
+        unsigned short contours[]{1};
+        GuestOutline outline{1, 2, points, tags, contours, 0};
+        auto functions = callbacks;
+        functions.shift = 2;
+        functions.delta = 0x100000000ll;
+        DecomposeEvents events;
+        Require(FT_Outline_Decompose_nid_postfix(&outline, &functions, &events) == 0);
+        const std::vector<std::array<std::int64_t, 7>> expected{{1, 0x3FF00000004ll, -0x4010000000Cll, 0, 0, 0, 0},
+                                                            {2, 0x3FF00000014ll, -0x4010000001Cll, 0, 0, 0, 0},
+                                                            {2, 0x3FF00000004ll, -0x4010000000Cll, 0, 0, 0, 0}};
+        Require(events.calls == expected);
+        tags[0] = tags[1] = 0;
+        events.calls.clear();
+        Require(FT_Outline_Decompose_nid_postfix(&outline, &functions, &events) == 0);
+        const std::vector<std::array<std::int64_t, 7>> conic{{1, 0x3FF0000000Cll, -0x40100000014ll, 0, 0, 0, 0},
+                                                         {3, 0x3FF00000004ll, -0x4010000000Cll, 0x3FF0000000Cll, -0x40100000014ll, 0, 0},
+                                                         {3, 0x3FF00000014ll, -0x4010000001Cll, 0x3FF0000000Cll, -0x40100000014ll, 0, 0}};
+        Require(events.calls == conic);
+        tags[0] = 1;
+        tags[1] = tags[2] = 2;
+        contours[0] = 2;
+        outline.n_points = 3;
+        events.calls.clear();
+        Require(FT_Outline_Decompose_nid_postfix(&outline, &functions, &events) == 0);
+        const std::vector<std::array<std::int64_t, 7>> cubic{{1, 0x3FF00000004ll, -0x4010000000Cll, 0, 0, 0, 0},
+                                                         {4, 0x3FF00000014ll, -0x4010000001Cll, 0x3FF00000024ll, -0x4010000002Cll, 0x3FF00000004ll, -0x4010000000Cll}};
+        Require(events.calls == cubic);
+        contours[0] = 1;
+        outline.n_points = 2;
+        for (const int shift : {-1, 63, INT32_MAX}) {
+            functions.shift = shift;
+            Require(ThrowsWith([&] { FT_Outline_Decompose_nid_postfix(&outline, &functions, &events); }, "FT_Outline_Decompose: a shift"));
+        }
+        functions.shift = 62;
+        functions.delta = 0;
+        Require(ThrowsWith([&] { FT_Outline_Decompose_nid_postfix(&outline, &functions, &events); }, "FT_Outline_Decompose: overflowing coordinate scaling"));
+        functions.shift = 0;
+        functions.delta = INT64_MIN;
+        Require(ThrowsWith([&] { FT_Outline_Decompose_nid_postfix(&outline, &functions, &events); }, "FT_Outline_Decompose: overflowing coordinate translation"));
+        functions.delta = 0;
+        points[0] = {INT64_MAX, 0};
+        points[1] = {INT64_MAX, 0};
+        tags[0] = tags[1] = 0;
+        Require(ThrowsWith([&] { FT_Outline_Decompose_nid_postfix(&outline, &functions, &events); }, "FT_Outline_Decompose: overflowing midpoint"));
+    }
+    const auto font = SquareGlyphFont('A', 700);
+    GuestLibrary* library = nullptr;
+    FT_Library oracle = nullptr;
+    GuestFaceRec* face = nullptr;
+    FT_Face native = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&oracle) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face(oracle, font.data(), static_cast<FT_Long>(font.size()), 0, &native) == 0);
+    int rendered = 0;
+    for (const unsigned pixels : {8u, 16u, 31u, 100u}) {
+        Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, pixels) == FT_Set_Pixel_Sizes(native, 0, pixels));
+        for (const unsigned glyph : {0u, 1u}) {
+            Require(FT_Load_Glyph_nid_postfix(face, glyph, FT_LOAD_DEFAULT) == FT_Load_Glyph(native, glyph, FT_LOAD_DEFAULT));
+            DecomposeEvents actual;
+            DecomposeEvents expected;
+            Require(FT_Outline_Decompose_nid_postfix(&face->glyph->outline, &callbacks, &actual) == FT_Outline_Decompose(&native->glyph->outline, &nativeCallbacks, &expected));
+            Require(actual.calls == expected.calls);
+            SlotMatches(face->glyph, native->glyph);
+            Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL));
+            SlotMatches(face->glyph, native->glyph);
+            ++rendered;
+        }
+    }
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(oracle) == 0);
+    std::printf("FreeType outline decomposition: %d native comparisons, %zu callbacks, %d rendered glyphs, wide coordinates and callback mutation\n", scenarios, calls, rendered);
+}
+
 struct Finalizers {
     std::vector<int> calls;
+    bool reenter = false;
 };
 
+static std::vector<unsigned char> CidMetadataFont(bool keyed, const std::string& registry, const std::string& ordering,
+                                                int supplement, unsigned cid) {
+    const auto index = [](const std::vector<std::vector<unsigned char>>& objects) {
+        std::vector<unsigned char> result;
+        Put16(result, objects.size());
+        if (objects.empty()) return result;
+        result.insert(result.end(), {1, 1});
+        unsigned offset = 1;
+        for (const auto& object : objects) {
+            offset += object.size();
+            Require(offset < 256);
+            result.push_back(static_cast<unsigned char>(offset));
+        }
+        for (const auto& object : objects) result.insert(result.end(), object.begin(), object.end());
+        return result;
+    };
+    const auto integer = [](std::vector<unsigned char>& dict, int value) {
+        dict.push_back(29);
+        Put32(dict, static_cast<std::uint32_t>(value));
+    };
+    const auto bytes = [](const std::string& text) { return std::vector<unsigned char>(text.begin(), text.end()); };
+    std::array<int, 5> offsets{};
+    std::vector<unsigned char> font;
+    for (unsigned pass = 0; pass < 2; ++pass) {
+        std::vector<unsigned char> top;
+        for (const int value : {0, 0, 700, 800}) integer(top, value);
+        top.push_back(5);
+        if (keyed) {
+            for (const int value : {391, 392, supplement}) integer(top, value);
+            top.insert(top.end(), {12, 30});
+            integer(top, cid + 1);
+            top.insert(top.end(), {12, 34});
+        }
+        integer(top, offsets[0]); top.push_back(15);
+        integer(top, offsets[1]); top.push_back(17);
+        if (keyed) {
+            integer(top, offsets[3]); top.insert(top.end(), {12, 36});
+            integer(top, offsets[2]); top.insert(top.end(), {12, 37});
+        }
+        font = {1, 0, 4, 4};
+        const auto append = [&](const std::vector<std::vector<unsigned char>>& objects) {
+            const auto data = index(objects);
+            font.insert(font.end(), data.begin(), data.end());
+        };
+        append({bytes(keyed ? "TestCID" : "TestNamed")});
+        append({top});
+        append({bytes(registry), bytes(ordering)});
+        append({});
+        offsets[0] = static_cast<int>(font.size());
+        font.push_back(0); Put16(font, cid);
+        offsets[2] = static_cast<int>(font.size());
+        font.insert(font.end(), {0, 0, 0});
+        offsets[1] = static_cast<int>(font.size());
+        append({{248, 236, 14}, {248, 236, 239, 139, 21, 248, 136, 139, 139, 249, 80, 252, 136, 139, 139, 253, 80, 5, 14}});
+        offsets[3] = static_cast<int>(font.size());
+        std::vector<unsigned char> privateDict;
+        integer(privateDict, 0); integer(privateDict, offsets[4]); privateDict.push_back(18);
+        append({privateDict});
+        offsets[4] = static_cast<int>(font.size());
+    }
+    return font;
+}
+
+static bool SameCidString(const char* a, const char* b) { return a && b ? std::strcmp(a, b) == 0 : a == b; }
+
+static unsigned cidQueries = 0;
+
+static void CheckCidQueries(GuestFaceRec* face, FT_Face native, int kind, unsigned cid, int supplement,
+                            const char* registry, const char* ordering) {
+    for (unsigned mask = 0; mask < 8; ++mask) {
+        struct Result {
+            std::uint64_t before = 0x123456789ABCDEF0;
+            const char* registry = "registry sentinel";
+            const char* ordering = "ordering sentinel";
+            std::int32_t supplement = 0x12345678;
+            std::uint32_t after = 0xFEDCBA98;
+        } actual, expected;
+        const int error = FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, mask & 1 ? &actual.registry : nullptr,
+                            mask & 2 ? &actual.ordering : nullptr, mask & 4 ? &actual.supplement : nullptr);
+        Require(error == FT_Get_CID_Registry_Ordering_Supplement(native, mask & 1 ? &expected.registry : nullptr,
+                            mask & 2 ? &expected.ordering : nullptr, mask & 4 ? &expected.supplement : nullptr));
+        Require(error == (kind > 0 ? 0 : FT_Err_Invalid_Argument));
+        Require(SameCidString(actual.registry, expected.registry) && SameCidString(actual.ordering, expected.ordering));
+        Require(actual.supplement == expected.supplement && actual.before == 0x123456789ABCDEF0 && actual.after == 0xFEDCBA98);
+        if (mask & 1) Require(SameCidString(actual.registry, kind > 0 ? registry : nullptr));
+        if (mask & 2) Require(SameCidString(actual.ordering, kind > 0 ? ordering : nullptr));
+        if (mask & 4) Require(actual.supplement == (kind > 0 ? supplement : 0));
+        ++cidQueries;
+    }
+    const char* alias = "sentinel";
+    const char* nativeAlias = "sentinel";
+    Require(FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, &alias, &alias, nullptr) ==
+            FT_Get_CID_Registry_Ordering_Supplement(native, &nativeAlias, &nativeAlias, nullptr));
+    Require(SameCidString(alias, nativeAlias) && SameCidString(alias, kind > 0 ? ordering : nullptr));
+    ++cidQueries;
+    for (const bool output : {false, true}) {
+        struct Result { std::uint8_t before = 0x12; std::uint8_t value = 0xA5; std::array<std::uint8_t, 3> after{0x34, 0x56, 0x78}; } actual, expected;
+        const int error = FT_Get_CID_Is_Internally_CID_Keyed_nid_postfix(face, output ? &actual.value : nullptr);
+        Require(error == FT_Get_CID_Is_Internally_CID_Keyed(native, output ? &expected.value : nullptr));
+        Require(error == (kind >= 0 ? 0 : FT_Err_Invalid_Argument));
+        Require(actual.value == expected.value && (!output || actual.value == (kind > 0 ? 1 : 0)));
+        Require(actual.before == 0x12 && actual.after == expected.after);
+        ++cidQueries;
+        for (const unsigned glyph : {0u, 1u, 2u, 41u, 65535u, UINT32_MAX}) {
+            struct Mapping { std::uint32_t before = 0x12345678; std::uint32_t value = 0xDEADBEEF; std::uint32_t after = 0x87654321; } actualCid, nativeCid;
+            const int mappingError = FT_Get_CID_From_Glyph_Index_nid_postfix(face, glyph, output ? &actualCid.value : nullptr);
+            Require(mappingError == FT_Get_CID_From_Glyph_Index(native, glyph, output ? &nativeCid.value : nullptr));
+            Require(mappingError == (kind > 0 && glyph < 2 ? 0 : FT_Err_Invalid_Argument));
+            Require(actualCid.value == nativeCid.value && (!output || actualCid.value == (mappingError == 0 && glyph == 1 ? cid : 0)));
+            Require(actualCid.before == 0x12345678 && actualCid.after == 0x87654321);
+            ++cidQueries;
+        }
+    }
+}
+
+static void CheckCidMetadata() {
+    CheckCidQueries(nullptr, nullptr, -2, 0, 0, nullptr, nullptr);
+    struct Fixture { std::vector<unsigned char> bytes; int kind; unsigned cid; int supplement; const char* registry; const char* ordering; unsigned renderGlyph; };
+    const std::array<Fixture, 4> fixtures{{
+        {CidMetadataFont(true, "Adobe", "Identity", 7, 41), 1, 41, 7, "Adobe", "Identity", 41},
+        {CidMetadataFont(true, "TestRegistry", "TestOrdering", 9, 65535), 1, 65535, 9, "TestRegistry", "TestOrdering", 65535},
+        {CidMetadataFont(false, "Adobe", "Identity", 0, 41), 0, 0, 0, nullptr, nullptr, 1},
+        {SquareGlyphFont('A', 700), -1, 0, 0, nullptr, nullptr, 1}}};
+    for (const auto& fixture : fixtures) {
+        FreeType::GuestLibrary* library = nullptr;
+        GuestFaceRec* face = nullptr;
+        FT_Library nativeLibrary = nullptr;
+        FT_Face native = nullptr;
+        Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+        Require(FT_New_Memory_Face_nid_postfix(library, fixture.bytes.data(), fixture.bytes.size(), 0, &face) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, fixture.bytes.data(), static_cast<FT_Long>(fixture.bytes.size()), 0, &native) == 0);
+        CheckCidQueries(face, native, fixture.kind, fixture.cid, fixture.supplement, fixture.registry, fixture.ordering);
+        const char* registry = nullptr;
+        const char* ordering = nullptr;
+        if (fixture.kind > 0) Require(FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, &registry, &ordering, nullptr) == 0);
+        Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 32) == 0 && FT_Set_Pixel_Sizes(native, 0, 32) == 0);
+        Require(FT_Load_Glyph_nid_postfix(face, fixture.renderGlyph, FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        Require(FT_Load_Glyph(native, fixture.renderGlyph, FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == 0 && FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL) == 0);
+        SlotMatches(face->glyph, native->glyph);
+        Require(face->glyph->bitmap.width > 0 && face->glyph->bitmap.rows > 0);
+        if (fixture.kind > 0) {
+            const char* againRegistry = nullptr;
+            const char* againOrdering = nullptr;
+            Require(FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, &againRegistry, &againOrdering, nullptr) == 0);
+            Require(registry == againRegistry && ordering == againOrdering);
+            Require(SameCidString(registry, fixture.registry) && SameCidString(ordering, fixture.ordering));
+        }
+        Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+        Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+    }
+    std::printf("FreeType CID metadata: %u query scenarios, 4 fonts and 4 rendered glyphs passed\n", cidQueries);
+}
+
 static void NativeSlotFinalizer(void* object) {
     auto* slot = static_cast<FT_GlyphSlot>(object);
     Require(slot->face->glyph == nullptr);
@@ -239,7 +879,13 @@ static void NativeSizeFinalizer(void* object) {
 static void NativeFaceFinalizer(void* object) {
     auto* face = static_cast<FT_Face>(object);
     Require(face->glyph == nullptr && face->size == nullptr);
-    static_cast<Finalizers*>(face->generic.data)->calls.push_back(3);
+    auto* events = static_cast<Finalizers*>(face->generic.data);
+    events->calls.push_back(3);
+    if (events->reenter) {
+        Require(FT_Reference_Face(face) == 0 && FT_Reference_Face(face) == 0);
+        Require(FT_Done_Face(face) == 0);
+        Require(face->glyph == nullptr && face->size == nullptr);
+    }
 }
 
 static void APS5_VABI GuestSlotFinalizer(void* object) {
@@ -257,7 +903,109 @@ static void APS5_VABI GuestSizeFinalizer(void* object) {
 static void APS5_VABI GuestFaceFinalizer(void* object) {
     auto* face = static_cast<GuestFaceRec*>(object);
     Require(face->glyph == nullptr && face->size == nullptr);
-    static_cast<Finalizers*>(face->generic.data)->calls.push_back(3);
+    auto* events = static_cast<Finalizers*>(face->generic.data);
+    events->calls.push_back(3);
+    if (events->reenter) {
+        const auto* library = static_cast<const GuestFace*>(face->internal)->library;
+        Require(FT_Reference_Face_nid_postfix(face) == 0 && FT_Reference_Face_nid_postfix(face) == 0);
+        Require(FT_Done_Face_nid_postfix(face) == 0 && library->faces.size() == 1);
+        Require(face->glyph == nullptr && face->size == nullptr);
+    }
+}
+
+static std::string BitmapStrikeFont(int width, int height, int descent) {
+    std::string font = "STARTFONT 2.1\nFONT -anyps5-strike-medium-r-normal--" + std::to_string(height) + "-0-72-72-c-0-iso10646-1\n";
+    font += "SIZE " + std::to_string(height) + " 72 72\nFONTBOUNDINGBOX " + std::to_string(width) + " " + std::to_string(height) + " 0 -" + std::to_string(descent);
+    font += "\nSTARTPROPERTIES 4\nFONT_ASCENT " + std::to_string(height - descent) + "\nFONT_DESCENT " + std::to_string(descent);
+    font += "\nCHARSET_REGISTRY \"ISO10646\"\nCHARSET_ENCODING \"1\"\nENDPROPERTIES\nCHARS 1\nSTARTCHAR A\nENCODING 65\nSWIDTH 1000 0\nDWIDTH ";
+    font += std::to_string(width) + " 0\nBBX " + std::to_string(width) + " " + std::to_string(height) + " 0 -" + std::to_string(descent) + "\nBITMAP\n";
+    for (int y = 0; y < height; ++y) {
+        for (int byte = 0; byte < (width + 7) / 8; ++byte) {
+            unsigned value = 0;
+            for (int bit = 0; bit < 8; ++bit) {
+                const int x = byte * 8 + bit;
+                if (x < width && (x == 0 || y == height - 1 || (x + y) % 3 == 0)) value |= 0x80u >> bit;
+            }
+            font += "0123456789ABCDEF"[value >> 4];
+            font += "0123456789ABCDEF"[value & 15];
+        }
+        font += '\n';
+    }
+    return font + "ENDCHAR\nENDFONT\n";
+}
+
+static void CheckStrikeSelection(GuestLibrary* library, FT_Library nativeLibrary, GuestFaceRec* scalable, FT_Face nativeScalable) {
+    const auto sizeMatches = [](const GuestSizeRec* size, FT_Size host) {
+        const auto& actual = size->metrics;
+        const auto& expected = host->metrics;
+        Require(actual.x_ppem == expected.x_ppem && actual.y_ppem == expected.y_ppem);
+        Require(actual.x_scale == expected.x_scale && actual.y_scale == expected.y_scale);
+        Require(actual.ascender == expected.ascender && actual.descender == expected.descender);
+        Require(actual.height == expected.height && actual.max_advance == expected.max_advance);
+    };
+    constexpr std::array<std::int32_t, 5> invalidIndices{-1, 1, 2, std::numeric_limits<std::int32_t>::min(), std::numeric_limits<std::int32_t>::max()};
+    int requests = 0;
+    int rendered = 0;
+    for (const auto index : invalidIndices) {
+        const auto nullError = FT_Select_Size(nullptr, index);
+        Require(nullError != 0 && FT_Select_Size_nid_postfix(nullptr, index) == nullError);
+        ++requests;
+    }
+    for (const auto index : {0, -1, std::numeric_limits<std::int32_t>::max()}) {
+        const auto error = FT_Select_Size(nativeScalable, index);
+        Require(error == FT_Err_Invalid_Face_Handle && FT_Select_Size_nid_postfix(scalable, index) == error);
+        sizeMatches(scalable->size, nativeScalable->size);
+        ++requests;
+    }
+    for (const auto& dimensions : {std::array{5, 7, 2}, std::array{11, 13, 3}}) {
+        const auto [width, height, descent] = dimensions;
+        const std::string font = BitmapStrikeFont(width, height, descent);
+        const auto* bytes = reinterpret_cast<const unsigned char*>(font.data());
+        GuestFaceRec* face = nullptr;
+        FT_Face native = nullptr;
+        Require(FT_New_Memory_Face_nid_postfix(library, bytes, static_cast<std::int64_t>(font.size()), 0, &face) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, bytes, static_cast<FT_Long>(font.size()), 0, &native) == 0);
+        Require(FT_HAS_FIXED_SIZES(native) && !FT_IS_SCALABLE(native) && face->num_fixed_sizes == 1);
+        const GuestBitmapSize* strikes = face->available_sizes;
+        const auto& expectedStrike = native->available_sizes[0];
+        Require(strikes[0].width == expectedStrike.width && strikes[0].height == expectedStrike.height && strikes[0].size == expectedStrike.size);
+        Require(strikes[0].x_ppem == expectedStrike.x_ppem && strikes[0].y_ppem == expectedStrike.y_ppem);
+        GuestSizeRec* size = face->size;
+        int marker = 0;
+        size->generic.data = &marker;
+        sizeMatches(size, native->size);
+        Require(size->metrics.y_ppem == 0);
+        const std::array<std::int32_t, 9> indices{-1, 1, invalidIndices[3], invalidIndices[4], 0, 2, 0, -1, 0};
+        for (const auto index : indices) {
+            face->glyph->advance.x = 0x123456789ABCll;
+            face->bbox.xMin = -0x123456789ABCll;
+            const auto error = FT_Select_Size(native, index);
+            Require((index == 0) == (error == 0));
+            Require(FT_Select_Size_nid_postfix(face, index) == error);
+            ++requests;
+            sizeMatches(size, native->size);
+            Require(face->size == size && size->face == face && size->generic.data == &marker && face->available_sizes == strikes);
+            Require(face->glyph->advance.x == 0x123456789ABCll && face->bbox.xMin == -0x123456789ABCll);
+            if (error != 0) continue;
+            Require(size->metrics.y_ppem == height && size->metrics.ascender == (height - descent) * 64 && size->metrics.descender == -descent * 64);
+            for (const auto flags : std::array<std::int32_t, 3>{FT_LOAD_DEFAULT, FT_LOAD_RENDER, FT_LOAD_RENDER | FT_LOAD_MONOCHROME}) {
+                Require(FT_Load_Char_nid_postfix(face, 'A', flags) == 0 && FT_Load_Char(native, 'A', flags) == 0);
+                SlotMatches(face->glyph, native->glyph);
+                const auto& bitmap = face->glyph->bitmap;
+                Require(face->glyph->format == FT_GLYPH_FORMAT_BITMAP && bitmap.pixel_mode == FT_PIXEL_MODE_MONO);
+                Require(bitmap.width == width && bitmap.rows == height && bitmap.pitch > 0 && face->glyph->bitmap_top == height - descent);
+                for (int y = 0; y < height; ++y) {
+                    for (int x = 0; x < width; ++x) {
+                        const bool pixel = (bitmap.buffer[y * bitmap.pitch + x / 8] & (0x80u >> (x % 8))) != 0;
+                        Require(pixel == (x == 0 || y == height - 1 || (x + y) % 3 == 0));
+                    }
+                }
+                ++rendered;
+            }
+        }
+        Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+    }
+    std::printf("FT_Select_Size: %d native request comparisons, %d bitmap glyph comparisons\n", requests, rendered);
 }
 
 static void SetFinalizers(FT_Face face, Finalizers& events) {
@@ -266,6 +1014,156 @@ static void SetFinalizers(FT_Face face, Finalizers& events) {
     face->size->generic = {&events, NativeSizeFinalizer};
 }
 
+static bool Equal(GuestVector a, GuestVector b) {
+    return a.x == b.x && a.y == b.y;
+}
+
+static bool Equal(const GuestOutline& a, const GuestOutline& b) {
+    return a.n_points == b.n_points && a.n_contours == b.n_contours && a.points == b.points &&
+           a.tags == b.tags && a.contours == b.contours && a.flags == b.flags;
+}
+
+static void CopyCase(std::uint16_t pointCount, std::uint16_t contourCount, int sourceFlags, int targetFlags, bool wide) {
+    const GuestVector guard{0x123456789ABCDEF, -0x123456789ABCDEF};
+    std::vector<GuestVector> points(pointCount + 2, guard), copied(pointCount + 2, guard);
+    std::vector<unsigned char> tags(pointCount + 2, 0xA5), copiedTags(pointCount + 2, 0x5A);
+    std::vector<std::uint16_t> contours(contourCount + 2, 0xABCD), copiedContours(contourCount + 2, 0xDCBA);
+    std::vector<FT_Vector> hostPoints(pointCount), hostCopied(pointCount);
+    std::vector<unsigned char> hostTags(pointCount), hostCopiedTags(pointCount);
+    std::vector<unsigned short> hostContours(contourCount), hostCopiedContours(contourCount);
+    for (unsigned index = 0; index < pointCount; ++index) {
+        const auto value = static_cast<std::int64_t>(index) * 65537 - 100000;
+        points[index + 1] = wide ? GuestVector{INT64_MIN + index,
+                                             INT64_MAX - index}
+                                : GuestVector{value / 4, -value / 4};
+        tags[index + 1] = static_cast<unsigned char>(index);
+        hostPoints[index] = {static_cast<FT_Pos>(points[index + 1].x), static_cast<FT_Pos>(points[index + 1].y)};
+        hostTags[index] = tags[index + 1];
+    }
+    for (unsigned index = 0; index < contourCount; ++index) {
+        contours[index + 1] = static_cast<std::uint16_t>(index);
+        hostContours[index] = contours[index + 1];
+    }
+    GuestOutline source{contourCount, pointCount, pointCount ? points.data() + 1 : nullptr,
+                        pointCount ? tags.data() + 1 : nullptr, contourCount ? contours.data() + 1 : nullptr, sourceFlags};
+    GuestOutline target{contourCount, pointCount, pointCount ? copied.data() + 1 : nullptr,
+                        pointCount ? copiedTags.data() + 1 : nullptr, contourCount ? copiedContours.data() + 1 : nullptr, targetFlags};
+    const auto originalSource = source;
+    auto expectedTarget = target;
+    const auto originalPoints = points;
+    const auto originalTags = tags;
+    const auto originalContours = contours;
+    FT_Outline hostSource{contourCount, pointCount, hostPoints.data(), hostTags.data(), hostContours.data(), sourceFlags};
+    FT_Outline hostTarget{contourCount, pointCount, hostCopied.data(), hostCopiedTags.data(), hostCopiedContours.data(), targetFlags};
+    Require(FT_Outline_Copy_nid_postfix(&source, &target) == FT_Outline_Copy(&hostSource, &hostTarget));
+    expectedTarget.flags = hostTarget.flags;
+    Require(Equal(source, originalSource) && Equal(target, expectedTarget));
+    Require(Equal(copied.front(), guard) && Equal(copied.back(), guard));
+    Require(copiedTags.front() == 0x5A && copiedTags.back() == 0x5A);
+    Require(copiedContours.front() == 0xDCBA && copiedContours.back() == 0xDCBA);
+    for (unsigned index = 0; index < pointCount; ++index) {
+        Require(Equal(copied[index + 1], originalPoints[index + 1]));
+        if (!wide) Require(copied[index + 1].x == hostCopied[index].x && copied[index + 1].y == hostCopied[index].y);
+        Require(copiedTags[index + 1] == hostCopiedTags[index]);
+    }
+    for (unsigned index = 0; index < contourCount; ++index) Require(copiedContours[index + 1] == hostCopiedContours[index]);
+    if (pointCount) {
+        target.points[0] = {321, -654};
+        target.tags[0] ^= 0xFF;
+    }
+    if (contourCount) target.contours[0] ^= 0xFFFF;
+    for (std::size_t index = 0; index < points.size(); ++index) Require(Equal(points[index], originalPoints[index]));
+    Require(tags == originalTags && contours == originalContours);
+}
+
+static void InvalidAndSelfCopies() {
+    GuestOutline source{1, 4, nullptr, nullptr, nullptr, 0x1234};
+    auto target = source;
+    Require(FT_Outline_Copy_nid_postfix(nullptr, nullptr) == FT_Outline_Copy(nullptr, nullptr));
+    Require(FT_Outline_Copy_nid_postfix(nullptr, &target) == FT_Err_Invalid_Outline);
+    Require(Equal(target, source));
+    Require(FT_Outline_Copy_nid_postfix(&source, nullptr) == FT_Err_Invalid_Outline);
+    Require(FT_Outline_Copy_nid_postfix(&source, &source) == 0);
+    for (const auto counts : std::array<std::array<std::uint16_t, 2>, 3>{{{1, 3}, {0, 4}, {0, 0}}}) {
+        target.n_contours = counts[0];
+        target.n_points = counts[1];
+        const auto before = target;
+        FT_Outline nativeSource{1, 4, nullptr, nullptr, nullptr, source.flags};
+        FT_Outline nativeTarget{target.n_contours, target.n_points, nullptr, nullptr, nullptr, target.flags};
+        Require(FT_Outline_Copy_nid_postfix(&source, &target) == FT_Outline_Copy(&nativeSource, &nativeTarget));
+        Require(Equal(target, before));
+    }
+}
+
+static void RenderCopy() {
+    const auto font = SquareGlyphFont('A', 700);
+    GuestLibrary* library = nullptr;
+    GuestFaceRec* face = nullptr;
+    FT_Library nativeLibrary = nullptr;
+    FT_Face nativeFace = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face(nativeLibrary, font.data(), static_cast<FT_Long>(font.size()), 0, &nativeFace) == 0);
+    Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 32) == 0 && FT_Set_Pixel_Sizes(nativeFace, 0, 32) == 0);
+    for (const int offset : {0, 37, -129}) {
+        Require(FT_Load_Char_nid_postfix(face, 'A', FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        Require(FT_Load_Char(nativeFace, 'A', FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        auto& target = face->glyph->outline;
+        std::vector<GuestVector> points(target.points, target.points + target.n_points);
+        std::vector<FT_Vector> nativePoints(nativeFace->glyph->outline.points,
+                                            nativeFace->glyph->outline.points + nativeFace->glyph->outline.n_points);
+        for (std::size_t index = 0; index < points.size(); ++index) {
+            points[index].x += offset + points[index].y / 4;
+            nativePoints[index].x += offset + nativePoints[index].y / 4;
+        }
+        auto source = target;
+        source.points = points.data();
+        source.flags ^= FT_OUTLINE_OWNER;
+        auto nativeSource = nativeFace->glyph->outline;
+        nativeSource.points = nativePoints.data();
+        nativeSource.flags ^= FT_OUTLINE_OWNER;
+        Require(FT_Outline_Copy_nid_postfix(&source, &target) == 0);
+        Require(FT_Outline_Copy(&nativeSource, &nativeFace->glyph->outline) == 0);
+        points[0] = {};
+        nativePoints[0] = {};
+        Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == 0);
+        Require(FT_Render_Glyph(nativeFace->glyph, FT_RENDER_MODE_NORMAL) == 0);
+        const auto& actual = face->glyph->bitmap;
+        const auto& expected = nativeFace->glyph->bitmap;
+        Require(actual.rows > 0 && actual.width > 0);
+        Require(actual.rows == expected.rows && actual.width == expected.width && actual.pitch == expected.pitch);
+        Require(actual.pixel_mode == expected.pixel_mode && actual.num_grays == expected.num_grays);
+        Require(face->glyph->bitmap_left == nativeFace->glyph->bitmap_left && face->glyph->bitmap_top == nativeFace->glyph->bitmap_top);
+        const auto size = static_cast<std::size_t>(actual.rows) * std::abs(actual.pitch);
+        Require(std::memcmp(actual.buffer, expected.buffer, size) == 0);
+    }
+    Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(nativeFace) == 0);
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+}
+
+static void CheckOutlineCopies() {
+    InvalidAndSelfCopies();
+    for (const int sourceFlags : {0, FT_OUTLINE_OWNER, FT_OUTLINE_REVERSE_FILL, -1}) {
+        for (const int targetFlags : {0, FT_OUTLINE_OWNER, FT_OUTLINE_EVEN_ODD_FILL, -1}) {
+            CopyCase(0, 0, sourceFlags, targetFlags, false);
+            CopyCase(4, 2, sourceFlags, targetFlags, false);
+            CopyCase(4, 2, sourceFlags, targetFlags, true);
+        }
+    }
+    CopyCase(65535, 65535, FT_OUTLINE_REVERSE_FILL, FT_OUTLINE_OWNER, false);
+    CopyCase(65535, 65535, FT_OUTLINE_OWNER, 0, true);
+    std::mt19937 random(0xF7C0);
+    for (unsigned index = 0; index < 128; ++index) {
+        const auto count = static_cast<std::uint16_t>(random() % 256 + 1);
+        const auto contours = static_cast<std::uint16_t>(random() % (count + 1));
+        const auto sourceFlags = static_cast<std::int32_t>(random() & 0x7FFFFFFFu);
+        const auto targetFlags = static_cast<std::int32_t>(random() & 0x7FFFFFFFu);
+        CopyCase(count, contours, sourceFlags, targetFlags, false);
+    }
+    RenderCopy();
+    std::puts("FreeType outline copy: 178 copy cases, validation, self-copy and 3 rendered copies passed");
+}
+
 static void SetFinalizers(GuestFaceRec* face, Finalizers& events) {
     face->generic = {&events, GuestFaceFinalizer};
     face->glyph->generic = {&events, GuestSlotFinalizer};
@@ -276,7 +1174,7 @@ static void CheckTransforms(const std::vector<unsigned char>& font) {
     FT_Library native = nullptr;
     FT_Face host = nullptr;
     FT_Face nativeOther = nullptr;
-    void* library = nullptr;
+    FreeType::GuestLibrary* library = nullptr;
     GuestFaceRec* face = nullptr;
     GuestFaceRec* other = nullptr;
     Require(FT_Init_FreeType(&native) == 0 && FT_Init_FreeType_nid_postfix(&library) == 0);
@@ -304,6 +1202,7 @@ static void CheckTransforms(const std::vector<unsigned char>& font) {
             std::memcpy(savedSlot.data(), face->glyph, savedSlot.size());
             std::memcpy(savedSize.data(), face->size, savedSize.size());
             FT_Set_Transform_nid_postfix(face, m < matrices.size() ? &input : nullptr, d < deltas.size() ? &delta : nullptr);
+
             FT_Set_Transform(host, m < matrices.size() ? &matrix : nullptr, d < deltas.size() ? &translation : nullptr);
             Require(std::memcmp(savedSlot.data(), face->glyph, savedSlot.size()) == 0);
             Require(std::memcmp(savedSize.data(), face->size, savedSize.size()) == 0);
@@ -355,19 +1254,343 @@ static void CheckTransforms(const std::vector<unsigned char>& font) {
     rejectedDelta.x = std::numeric_limits<std::int64_t>::min();
     FT_Set_Transform_nid_postfix(nullptr, &rejected, &rejectedDelta);
     FT_Set_Transform_nid_postfix(nullptr, nullptr, nullptr);
+
     Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(native) == 0);
     std::printf("FT_Set_Transform: %zu native glyph and bitmap comparisons\n", comparisons);
 }
 
+static void SizeMatches(const GuestSizeRec* size, FT_Size native) {
+    Require(size != nullptr && native != nullptr);
+    const auto& a = size->metrics;
+    const auto& b = native->metrics;
+    Require(a.x_ppem == b.x_ppem && a.y_ppem == b.y_ppem && a.x_scale == b.x_scale && a.y_scale == b.y_scale);
+    Require(a.ascender == b.ascender && a.descender == b.descender && a.height == b.height && a.max_advance == b.max_advance);
+}
+
+static bool OwnsSize(const GuestFace& face, const GuestSizeRec* size) {
+    if (size == &face.size) return true;
+    for (const auto& entry : face.sizes) {
+        if (size == &entry.rec) return true;
+    }
+    return false;
+}
+
+struct SizeEvents {
+    std::vector<void*> sizes;
+    std::vector<std::array<int, 4>> calls;
+
+    int Index(void* size) const {
+        if (!size) return -1;
+        for (std::size_t index = 0; index < sizes.size(); ++index) {
+            if (sizes[index] == size) return static_cast<int>(index);
+        }
+        Require(false);
+        return -2;
+    }
+};
+
+static void NativeMultipleSizeFinalizer(void* object) {
+    auto* size = static_cast<FT_Size>(object);
+    auto& events = *static_cast<SizeEvents*>(size->generic.data);
+    events.calls.push_back({events.Index(size), events.Index(size->face->size), size->metrics.y_ppem, size->face->glyph == nullptr});
+}
+
+static void APS5_VABI GuestMultipleSizeFinalizer(void* object) {
+    auto* size = static_cast<GuestSizeRec*>(object);
+    auto* face = static_cast<GuestFaceRec*>(size->face);
+    const auto& owner = *static_cast<GuestFace*>(face->internal);
+    Require(OwnsSize(owner, size));
+    if (face->size) Require(OwnsSize(owner, face->size));
+    SizeMatches(size, static_cast<FT_Size>(size->internal));
+    auto& events = *static_cast<SizeEvents*>(size->generic.data);
+    events.calls.push_back({events.Index(size), events.Index(face->size), size->metrics.y_ppem, face->glyph == nullptr});
+}
+
+static void NativeMultipleSizeFaceFinalizer(void* object) {
+    auto* face = static_cast<FT_Face>(object);
+    Require(face->glyph == nullptr && face->size == nullptr);
+    static_cast<SizeEvents*>(face->generic.data)->calls.push_back({100, -1, 0, 1});
+}
+
+static void APS5_VABI GuestMultipleSizeFaceFinalizer(void* object) {
+    auto* face = static_cast<GuestFaceRec*>(object);
+    Require(face->glyph == nullptr && face->size == nullptr);
+    static_cast<SizeEvents*>(face->generic.data)->calls.push_back({100, -1, 0, 1});
+}
+
+static FT_Alloc_Func SizeOriginalAlloc = nullptr;
+static int SizeAllocationsBeforeFailure = 0;
+
+static void* SizeFailingAlloc(FT_Memory memory, long bytes) {
+    if (SizeAllocationsBeforeFailure-- == 0) return nullptr;
+    return SizeOriginalAlloc(memory, bytes);
+}
+
+static void SizeObjects(const std::vector<unsigned char>& font) {
+    Require(FT_New_Size_nid_postfix(nullptr, nullptr) == FT_New_Size(nullptr, nullptr));
+    Require(FT_Done_Size_nid_postfix(nullptr) == FT_Done_Size(nullptr));
+    Require(FT_Activate_Size_nid_postfix(nullptr) == FT_Activate_Size(nullptr));
+    GuestSizeRec sentinel{};
+    GuestSizeRec* untouched = &sentinel;
+    Require(FT_New_Size_nid_postfix(nullptr, &untouched) == FT_Err_Invalid_Face_Handle && untouched == &sentinel);
+    FT_FaceRec driverless{};
+    GuestFace invalidOwner;
+    invalidOwner.host = &driverless;
+    invalidOwner.rec.internal = &invalidOwner;
+    FT_Size nativeUntouched = reinterpret_cast<FT_Size>(&sentinel);
+    Require(FT_New_Size(&driverless, &nativeUntouched) == FT_Err_Invalid_Driver_Handle);
+    Require(FT_New_Size_nid_postfix(&invalidOwner.rec, &untouched) == FT_Err_Invalid_Driver_Handle && untouched == &sentinel);
+    Require(FT_New_Size_nid_postfix(&invalidOwner.rec, nullptr) == FT_New_Size(&driverless, nullptr));
+
+    FT_SizeRec driverlessSize{};
+    GuestSizeRec invalidSize{};
+    invalidSize.internal = &driverlessSize;
+    Require(FT_Done_Size_nid_postfix(&invalidSize) == FT_Done_Size(&driverlessSize));
+    Require(FT_Activate_Size_nid_postfix(&invalidSize) == FT_Activate_Size(&driverlessSize));
+    driverlessSize.face = &driverless;
+    Require(FT_Done_Size_nid_postfix(&invalidSize) == FT_Done_Size(&driverlessSize));
+    Require(FT_Activate_Size_nid_postfix(&invalidSize) == FT_Activate_Size(&driverlessSize));
+    static_assert(sizeof(GuestSizeMetrics) == 56 && sizeof(GuestSizeRec) == 88);
+
+    int scenarios = 0;
+    int rendered = 0;
+    int failures = 0;
+    for (const int faceIndex : {0, -1}) {
+        for (const int count : {0, 1, 5, 41}) {
+            for (const int cleanup : {0, 1, 2}) {
+                GuestLibrary* library = nullptr;
+                FT_Library oracle = nullptr;
+                Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&oracle) == 0);
+                GuestFaceRec* face = nullptr;
+                FT_Face native = nullptr;
+                Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), faceIndex, &face) == 0);
+                Require(FT_New_Memory_Face(oracle, font.data(), static_cast<FT_Long>(font.size()), faceIndex, &native) == 0);
+                SizeEvents actual;
+                SizeEvents expected;
+                face->generic = {&actual, GuestMultipleSizeFaceFinalizer};
+                native->generic = {&expected, NativeMultipleSizeFaceFinalizer};
+                std::vector<GuestSizeRec*> sizes;
+                std::vector<FT_Size> originals;
+                auto remember = [&](GuestSizeRec* size, FT_Size original) {
+                    Require(size->face == face && original->face == native);
+                    actual.sizes.push_back(size);
+                    expected.sizes.push_back(original);
+                    size->generic = {&actual, GuestMultipleSizeFinalizer};
+                    original->generic = {&expected, NativeMultipleSizeFinalizer};
+                    sizes.push_back(size);
+                    originals.push_back(original);
+                    SizeMatches(size, original);
+                };
+                if (native->size) remember(face->size, native->size);
+                Require(FT_New_Size_nid_postfix(face, nullptr) == FT_New_Size(native, nullptr));
+                for (int index = 0; index < count; ++index) {
+                    GuestSizeRec* before = face->size;
+                    FT_Size previous = native->size;
+                    GuestSizeRec* created = nullptr;
+                    FT_Size original = nullptr;
+                    Require(FT_New_Size_nid_postfix(face, &created) == FT_New_Size(native, &original));
+                    Require(created != nullptr && original != nullptr && face->size == before && native->size == previous);
+                    remember(created, original);
+                }
+                if (count == 5) {
+                    Require(FT_New_Size_nid_postfix(face, &face->size) == FT_New_Size(native, &native->size));
+                    remember(face->size, native->size);
+                }
+                for (std::size_t index = 0; index < sizes.size(); ++index) {
+                    Require(FT_Activate_Size_nid_postfix(sizes[index]) == 0 && FT_Activate_Size(originals[index]) == 0);
+                    Require(face->size == sizes[index] && native->size == originals[index]);
+                    Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 12 + index) == FT_Set_Pixel_Sizes(native, 0, 12 + index));
+                    SizeMatches(sizes[index], originals[index]);
+                }
+                for (std::size_t turn = 0; turn < sizes.size() * 3; ++turn) {
+                    const std::size_t index = (turn * 17 + 3) % sizes.size();
+                    Require(FT_Activate_Size_nid_postfix(sizes[index]) == FT_Activate_Size(originals[index]));
+                    Require(face->size == sizes[index]);
+                    for (std::size_t other = 0; other < sizes.size(); ++other) SizeMatches(sizes[other], originals[other]);
+                    if (!native->glyph) continue;
+                    Require(FT_Load_Char_nid_postfix(face, 'A', FT_LOAD_NO_HINTING) == FT_Load_Char(native, 'A', FT_LOAD_NO_HINTING));
+                    for (unsigned point = 0; point < face->glyph->outline.n_points; ++point) face->glyph->outline.points[point].x += 64;
+                    FT_Outline_Translate(&native->glyph->outline, 64, 0);
+                    Require(FT_Activate_Size_nid_postfix(sizes[index]) == FT_Activate_Size(originals[index]));
+                    Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL));
+                    SlotMatches(face->glyph, native->glyph);
+                    ++rendered;
+                }
+                if (cleanup == 0) {
+                    while (!sizes.empty()) {
+                        const std::size_t index = sizes.size() % 2 == 0 ? 0 : sizes.size() - 1;
+                        const int removed = actual.Index(sizes[index]);
+                        Require(FT_Done_Size_nid_postfix(sizes[index]) == FT_Done_Size(originals[index]));
+                        actual.sizes[removed] = nullptr;
+                        expected.sizes[removed] = nullptr;
+                        sizes.erase(sizes.begin() + index);
+                        originals.erase(originals.begin() + index);
+                        Require(actual.Index(face->size) == expected.Index(native->size) && actual.calls == expected.calls);
+                    }
+                    Require(face->size == nullptr && native->size == nullptr);
+                    Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 24) == FT_Set_Pixel_Sizes(native, 0, 24));
+                    Require(FT_New_Size_nid_postfix(face, &face->size) == FT_New_Size(native, &native->size));
+                    Require(face->size != nullptr && native->size != nullptr);
+                    remember(face->size, native->size);
+                    Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 24) == FT_Set_Pixel_Sizes(native, 0, 24));
+                    for (const bool alias : {false, true}) {
+                        for (const int allocation : {0, 1, 2}) {
+                            auto* owner = static_cast<GuestFace*>(face->internal);
+                            FT_Memory memory = owner->host->memory;
+                            SizeOriginalAlloc = memory->alloc;
+                            SizeAllocationsBeforeFailure = allocation;
+                            memory->alloc = SizeFailingAlloc;
+                            GuestSizeRec* output = &sentinel;
+                            const int error = FT_New_Size_nid_postfix(face, alias ? &face->size : &output);
+                            memory->alloc = SizeOriginalAlloc;
+                            Require(error == FT_Err_Out_Of_Memory && owner->sizes.size() == 1);
+                            FT_Memory nativeMemory = native->memory;
+                            SizeOriginalAlloc = nativeMemory->alloc;
+                            SizeAllocationsBeforeFailure = allocation;
+                            nativeMemory->alloc = SizeFailingAlloc;
+                            FT_Size nativeOutput = reinterpret_cast<FT_Size>(&sentinel);
+                            const int nativeError = FT_New_Size(native, alias ? &native->size : &nativeOutput);
+                            nativeMemory->alloc = SizeOriginalAlloc;
+                            Require(error == nativeError);
+                            Require(alias ? face->size == nullptr && native->size == nullptr : output == nullptr && nativeOutput == nullptr);
+                            Require(actual.Index(face->size) == expected.Index(native->size));
+                            Require(actual.calls == expected.calls);
+                            ++failures;
+                        }
+                    }
+                }
+                if (cleanup == 1) {
+                    Require(FT_Reference_Face_nid_postfix(face) == 0 && FT_Reference_Face(native) == 0);
+                    Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+                    Require(actual.calls.empty() && expected.calls.empty());
+                }
+                if (cleanup == 2 && count == 5) {
+                    Require(sizes.size() > 2);
+                    Require(FT_Activate_Size_nid_postfix(sizes[1]) == FT_Activate_Size(originals[1]));
+                    Require(face->size == sizes[1] && native->size == originals[1]);
+                }
+                if (cleanup != 2) Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+                Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(oracle) == 0);
+                Require(actual.calls == expected.calls && !actual.calls.empty() && actual.calls.back()[0] == 100);
+                if (cleanup == 2 && count == 5) {
+                    Require(actual.calls.size() > 3 && actual.calls[0][1] == 1 && actual.calls[1][0] == 1);
+                    for (std::size_t index = 2; index + 1 < actual.calls.size(); ++index) Require(actual.calls[index][1] == 1);
+                }
+                ++scenarios;
+            }
+        }
+    }
+    std::printf("FreeType size objects: %d lifecycles, %d rendered glyphs, %d allocation failures compared with native\n", scenarios, rendered, failures);
+}
+
 int main() {
+    SizeObjects(SquareGlyphFont('A', 700));
+    {
+        const auto referenceFont = SquareGlyphFont('A', 700);
+        GuestLibrary* referenceLibrary = nullptr;
+        FT_Library oracle = nullptr;
+        Require(FT_Init_FreeType_nid_postfix(&referenceLibrary) == 0 && FT_Init_FreeType(&oracle) == 0);
+        auto* owners = referenceLibrary;
+        Require(FT_Reference_Face_nid_postfix(nullptr) == FT_Reference_Face(nullptr));
+        int references = 0;
+        int retained = 0;
+        int finalized = 0;
+        for (const unsigned depth : {1u, 2u, 3u, 17u}) {
+            GuestFaceRec* shared = nullptr;
+            FT_Face native = nullptr;
+            Require(FT_New_Memory_Face_nid_postfix(referenceLibrary, referenceFont.data(), static_cast<std::int64_t>(referenceFont.size()), 0, &shared) == 0);
+            Require(FT_New_Memory_Face(oracle, referenceFont.data(), static_cast<FT_Long>(referenceFont.size()), 0, &native) == 0);
+            Finalizers guestEvents;
+            Finalizers nativeEvents;
+            guestEvents.reenter = nativeEvents.reenter = depth == 3;
+            SetFinalizers(shared, guestEvents);
+            SetFinalizers(native, nativeEvents);
+            for (unsigned index = 1; index < depth; ++index) {
+                Require(FT_Reference_Face_nid_postfix(shared) == FT_Reference_Face(native));
+                ++references;
+            }
+            for (unsigned index = 1; index < depth; ++index) {
+                Require(FT_Done_Face(native) == 0 && FT_Done_Face_nid_postfix(shared) == 0);
+                Require(owners->faces.size() == 1 && guestEvents.calls.empty() && nativeEvents.calls.empty());
+                Require(FT_Get_Char_Index_nid_postfix(shared, 'A') == FT_Get_Char_Index(native, 'A'));
+                Require(FT_Set_Pixel_Sizes_nid_postfix(shared, 0, 16 + index) == 0 && FT_Set_Pixel_Sizes(native, 0, 16 + index) == 0);
+                Require(FT_Load_Char_nid_postfix(shared, 'A', FT_LOAD_RENDER) == 0 && FT_Load_Char(native, 'A', FT_LOAD_RENDER) == 0);
+                SlotMatches(shared->glyph, native->glyph);
+                ++retained;
+            }
+            Require(FT_Done_Face(native) == 0 && FT_Done_Face_nid_postfix(shared) == 0);
+            if (guestEvents.reenter) {
+                references += 2;
+                ++retained;
+            }
+            Require(owners->faces.empty() && guestEvents.calls == nativeEvents.calls && guestEvents.calls == std::vector<int>({1, 2, 3}));
+            ++finalized;
+        }
+        GuestFaceRec* plain = nullptr;
+        FT_Face nativePlain = nullptr;
+        Require(FT_New_Memory_Face_nid_postfix(referenceLibrary, referenceFont.data(), static_cast<std::int64_t>(referenceFont.size()), 0, &plain) == 0);
+        Require(FT_New_Memory_Face(oracle, referenceFont.data(), static_cast<FT_Long>(referenceFont.size()), 0, &nativePlain) == 0);
+        Require(FT_Reference_Face_nid_postfix(plain) == FT_Reference_Face(nativePlain));
+        ++references;
+        Require(FT_Done_Face(nativePlain) == 0 && FT_Done_Face_nid_postfix(plain) == 0 && owners->faces.size() == 1);
+        ++retained;
+        Require(FT_Done_Face(nativePlain) == 0 && FT_Done_Face_nid_postfix(plain) == 0 && owners->faces.empty());
+        ++finalized;
+        GuestFaceRec* probe = nullptr;
+        FT_Face nativeProbe = nullptr;
+        Require(FT_New_Memory_Face_nid_postfix(referenceLibrary, referenceFont.data(), static_cast<std::int64_t>(referenceFont.size()), -1, &probe) == 0);
+        Require(FT_New_Memory_Face(oracle, referenceFont.data(), static_cast<FT_Long>(referenceFont.size()), -1, &nativeProbe) == 0);
+        Finalizers probeEvents;
+        Finalizers nativeProbeEvents;
+        probe->generic = {&probeEvents, GuestFaceFinalizer};
+        nativeProbe->generic = {&nativeProbeEvents, NativeFaceFinalizer};
+        Require(probe->glyph == nullptr && probe->size == nullptr);
+        Require(FT_Reference_Face_nid_postfix(probe) == FT_Reference_Face(nativeProbe));
+        ++references;
+        Require(FT_Done_Face(nativeProbe) == 0 && FT_Done_Face_nid_postfix(probe) == 0 && owners->faces.size() == 1);
+        ++retained;
+        Require(probeEvents.calls.empty() && nativeProbeEvents.calls.empty());
+        Require(FT_Done_Face(nativeProbe) == 0 && FT_Done_Face_nid_postfix(probe) == 0);
+        Require(owners->faces.empty() && probeEvents.calls == nativeProbeEvents.calls && probeEvents.calls == std::vector<int>({3}));
+        ++finalized;
+        std::array<Finalizers, 2> shutdownEvents;
+        std::array<Finalizers, 2> nativeShutdownEvents;
+        std::array<GuestFaceRec*, 2> shutdown{};
+        std::array<FT_Face, 2> nativeShutdown{};
+        for (unsigned index = 0; index < shutdown.size(); ++index) {
+            Require(FT_New_Memory_Face_nid_postfix(referenceLibrary, referenceFont.data(), static_cast<std::int64_t>(referenceFont.size()), 0, &shutdown[index]) == 0);
+            Require(FT_New_Memory_Face(oracle, referenceFont.data(), static_cast<FT_Long>(referenceFont.size()), 0, &nativeShutdown[index]) == 0);
+            SetFinalizers(shutdown[index], shutdownEvents[index]);
+            SetFinalizers(nativeShutdown[index], nativeShutdownEvents[index]);
+            for (unsigned reference = 0; reference < 3 - index; ++reference) {
+                Require(FT_Reference_Face_nid_postfix(shutdown[index]) == FT_Reference_Face(nativeShutdown[index]));
+                ++references;
+            }
+            Require(FT_Done_Face(nativeShutdown[index]) == 0 && FT_Done_Face_nid_postfix(shutdown[index]) == 0);
+            Require(owners->faces.size() == index + 1 && shutdownEvents[index].calls.empty());
+            ++retained;
+        }
+        Require(FT_Done_FreeType(oracle) == 0 && FT_Done_FreeType_nid_postfix(referenceLibrary) == 0);
+        for (unsigned index = 0; index < shutdown.size(); ++index) {
+            Require(shutdownEvents[index].calls == nativeShutdownEvents[index].calls && shutdownEvents[index].calls == std::vector<int>({1, 2, 3}));
+            ++finalized;
+        }
+        Require(references == 28 && retained == 24 && finalized == 8);
+        std::printf("FreeType face references: %d retains, %d non-final releases, %d finalized faces compared with native\n", references, retained, finalized);
+    }
     const auto root = std::filesystem::temp_directory_path() / ("anyps5_guest_freetype-" + std::to_string(std::random_device{}()));
     std::filesystem::create_directories(root / "app0");
+    CheckGasp();
+    Trigonometry();
+    OutlineDecomposition();
     const std::vector<unsigned char> font = SquareGlyphFont('A', 700);
+    CheckOutlineCopies();
     {
         std::ofstream file(root / "app0" / "font.ttf", std::ios::binary);
         file.write(reinterpret_cast<const char*>(font.data()), static_cast<std::streamsize>(font.size()));
     }
     const auto previous = std::filesystem::current_path();
+    CheckCidMetadata();
     std::filesystem::current_path(root);
     CheckOutlineOrientation();
 
@@ -380,7 +1603,7 @@ int main() {
     Require(secondFace != 0);
 
     Require(FT_Init_FreeType_nid_postfix(nullptr) == FT_Err_Invalid_Argument);
-    void* library = nullptr;
+    FreeType::GuestLibrary* library = nullptr;
     Require(FT_Init_FreeType_nid_postfix(&library) == 0 && library != nullptr);
     Require(FT_Done_FreeType_nid_postfix(nullptr) == FT_Err_Invalid_Library_Handle);
     Require(FT_Done_Face_nid_postfix(nullptr) == FT_Err_Invalid_Face_Handle);
@@ -396,8 +1619,23 @@ int main() {
     GuestFaceRec* masked = nullptr;
     Require(FT_New_Face_nid_postfix(library, "/app0/font.ttf", 0x180000000ll, &masked) == 0 && masked != nullptr && masked->face_index == 0);
     Require(FT_New_Face_nid_postfix(library, "/app0/font.ttf", 0, &face) == 0 && face != nullptr && face != masked);
+    {
+        FT_Face nativeFile = nullptr;
+        Require(FT_New_Face(hostLibrary, "app0/font.ttf", 0, &nativeFile) == 0);
+        const auto* bytes = FaceOf(face)->bytes.data();
+        Require(FaceOf(face)->bytes.size() == font.size() && std::memcmp(bytes, font.data(), font.size()) == 0);
+        Require(FT_Reference_Face_nid_postfix(face) == FT_Reference_Face(nativeFile));
+        Require(FT_Done_Face(nativeFile) == 0 && FT_Done_Face_nid_postfix(face) == 0);
+        Require(static_cast<GuestLibrary*>(library)->faces.size() == 2);
+        Require(FaceOf(face)->bytes.data() == bytes && std::memcmp(bytes, font.data(), font.size()) == 0);
+        Require(FT_Get_Char_Index_nid_postfix(face, 'A') == FT_Get_Char_Index(nativeFile, 'A'));
+        Require(FT_Done_Face(nativeFile) == 0);
+        std::puts("File-backed face reference: owned font bytes survive a non-final release");
+    }
     FaceMatches(face, host, library);
 
+    CheckStrikeSelection(library, hostLibrary, face, host);
+
     const auto fontSize = static_cast<std::int64_t>(font.size());
     GuestFaceRec* memoryFace = nullptr;
     Require(FT_New_Memory_Face_nid_postfix(library, nullptr, fontSize, 0, &memoryFace) == FT_Err_Invalid_Argument);
@@ -673,7 +1911,7 @@ int main() {
     SetFinalizers(memoryFace, guestSecondEvents);
     Require(FT_Done_FreeType(hostLibrary) == 0);
 
-    void* independent = nullptr;
+    FreeType::GuestLibrary* independent = nullptr;
     GuestFaceRec* independentFace = nullptr;
     Require(FT_Init_FreeType_nid_postfix(&independent) == 0);
     Require(FT_New_Memory_Face_nid_postfix(independent, font.data(), fontSize, 0, &independentFace) == 0);
@@ -685,7 +1923,7 @@ int main() {
     Require(FT_Get_Char_Index_nid_postfix(independentFace, 'A') == 1);
     Require(FT_Done_FreeType_nid_postfix(independent) == 0 && independentEvents.calls == nativeDone.calls);
 
-    void* empty = nullptr;
+    FreeType::GuestLibrary* empty = nullptr;
     Require(FT_Init_FreeType_nid_postfix(&empty) == 0 && FT_Done_FreeType_nid_postfix(empty) == 0);
     CheckTransforms(font);
     std::filesystem::current_path(previous);
diff --git a/core/libs/tests/GuestFreeTypeBitmap.cpp b/core/libs/tests/GuestFreeTypeBitmap.cpp
new file mode 100644
index 0000000000..6a05b55c58
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeBitmap.cpp
@@ -0,0 +1,290 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_BITMAP_H
+#include FT_MODULE_H
+
+#include <cstdint>
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <new>
+#include <stdexcept>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType bitmap check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static GuestBitmap Guest(const FT_Bitmap& bitmap) {
+    return {bitmap.rows, bitmap.width, bitmap.pitch, bitmap.buffer, bitmap.num_grays, bitmap.pixel_mode, bitmap.palette_mode, bitmap.palette};
+}
+
+static void Matches(const GuestBitmap& guest, const FT_Bitmap& native, bool comparePadding) {
+    Require(guest.rows == native.rows && guest.width == native.width && guest.pitch == native.pitch);
+    Require(guest.num_grays == native.num_grays && guest.pixel_mode == native.pixel_mode && guest.palette_mode == native.palette_mode);
+    Require(guest.palette == native.palette && (guest.buffer == nullptr) == (native.buffer == nullptr));
+    if (!guest.buffer) return;
+    const auto pitch = static_cast<std::size_t>(native.pitch < 0 ? -native.pitch : native.pitch);
+    const std::size_t width = comparePadding ? pitch : native.width;
+    for (std::uint32_t row = 0; row < native.rows; ++row) {
+        Require(std::memcmp(guest.buffer + row * pitch, native.buffer + row * pitch, width) == 0);
+    }
+}
+
+static void TestFormat(GuestLibrary* library, FT_Library oracle, unsigned char mode, int bits) {
+    constexpr std::uint32_t width = 10;
+    constexpr std::uint32_t rows = 3;
+    const int stride = static_cast<int>((width * bits + 7) / 8) + 2;
+    std::vector<unsigned char> data(rows * static_cast<std::size_t>(stride));
+    for (std::size_t index = 0; index < data.size(); ++index) data[index] = static_cast<unsigned char>(index * 37 + 11);
+    if (mode == FT_PIXEL_MODE_BGRA) {
+        for (std::uint32_t row = 0; row < rows; ++row) {
+            for (std::uint32_t col = 0; col < width; ++col) {
+                unsigned char* pixel = data.data() + row * stride + col * 4;
+                pixel[0] = static_cast<unsigned char>(col * 7);
+                pixel[1] = static_cast<unsigned char>(row * 23);
+                pixel[2] = static_cast<unsigned char>(col * 11);
+                pixel[3] = col == 0 ? 0 : static_cast<unsigned char>(128 + row * 63);
+                if (col == 0) pixel[0] = pixel[1] = pixel[2] = 0;
+            }
+        }
+    }
+    const auto original = data;
+    int palette = 17;
+    for (const int sign : {-1, 1}) {
+        const FT_Bitmap source{rows, width, sign * stride, data.data(), static_cast<unsigned short>(bits < 8 ? 1 << bits : 256), mode, 7, &palette};
+        GuestBitmap guestSource = Guest(source);
+        for (const int flow : {-1, 0, 1}) {
+            FT_Bitmap native{};
+            native.pitch = flow;
+            GuestBitmap target{};
+            target.pitch = flow;
+            Require(FT_Bitmap_Copy_nid_postfix(library, &guestSource, &target) == FT_Bitmap_Copy(oracle, &source, &native));
+            Require(target.buffer != source.buffer && native.buffer != source.buffer && target.buffer != native.buffer);
+            Matches(target, native, true);
+            const GuestBitmap before = target;
+            Require(FT_Bitmap_Copy_nid_postfix(library, &target, &target) == 0);
+            Require(target.buffer == before.buffer && target.pitch == before.pitch);
+            Matches(target, native, true);
+            data[0] ^= 0xFF;
+            Require(target.buffer[flow != 0 && flow != sign ? (rows - 1) * stride : 0] == original[0]);
+            data[0] ^= 0xFF;
+            for (const int alignment : {0, 1, 2, 4, -4}) {
+                Require(FT_Bitmap_Convert_nid_postfix(library, &guestSource, &target, alignment) == FT_Bitmap_Convert(oracle, &source, &native, alignment));
+                Matches(target, native, false);
+                Require(target.pixel_mode == FT_PIXEL_MODE_GRAY && target.rows == rows && target.width == width);
+                Require(target.pitch == (flow < 0 || (flow == 0 && sign < 0) ? -1 : 1) * (alignment == 4 || alignment == -4 ? 12 : 10));
+                Require(data == original);
+            }
+            Require(FT_Bitmap_Done_nid_postfix(library, &target) == FT_Bitmap_Done(oracle, &native));
+            Matches(target, native, true);
+            Require(target.rows == 0 && target.pitch == 0 && target.buffer == nullptr && target.palette == nullptr);
+            Require(FT_Bitmap_Done_nid_postfix(library, &target) == 0);
+        }
+    }
+}
+
+struct Allocations {
+    bool fail = false;
+    std::unordered_set<void*> blocks;
+
+    static void* Allocate(FT_Memory memory, long size) {
+        auto& state = *static_cast<Allocations*>(memory->user);
+        if (state.fail) return nullptr;
+        void* block = std::malloc(static_cast<std::size_t>(size));
+        if (block) Require(state.blocks.insert(block).second);
+        return block;
+    }
+
+    static void Free(FT_Memory memory, void* block) {
+        auto& state = *static_cast<Allocations*>(memory->user);
+        Require(state.blocks.erase(block) == 1);
+        std::free(block);
+    }
+
+    static void* Reallocate(FT_Memory, long, long, void*) {
+        return nullptr;
+    }
+};
+
+static void TestAllocationFailure() {
+    Allocations guestAllocations;
+    Allocations nativeAllocations;
+    FT_MemoryRec_ guestMemory{&guestAllocations, Allocations::Allocate, Allocations::Free, Allocations::Reallocate};
+    FT_MemoryRec_ nativeMemory{&nativeAllocations, Allocations::Allocate, Allocations::Free, Allocations::Reallocate};
+    GuestLibrary library{};
+    FT_Library oracle = nullptr;
+    Require(FT_New_Library(&guestMemory, &library.host) == 0);
+    Require(FT_New_Library(&nativeMemory, &oracle) == 0);
+    const auto guestBase = guestAllocations.blocks.size();
+    const auto nativeBase = nativeAllocations.blocks.size();
+    unsigned char pixels[]{1, 2, 3, 4, 5, 6, 7, 8, 9, 10};
+    const FT_Bitmap source{2, 5, 5, pixels, 256, FT_PIXEL_MODE_GRAY, 0, nullptr};
+    const GuestBitmap guestSource = Guest(source);
+    GuestBitmap target{};
+    FT_Bitmap native{};
+    for (const bool convert : {false, true}) {
+        Require(FT_Bitmap_Copy_nid_postfix(&library, &guestSource, &target) == 0);
+        Require(FT_Bitmap_Copy(oracle, &source, &native) == 0);
+        Require(guestAllocations.blocks.size() == guestBase + 1 && nativeAllocations.blocks.size() == nativeBase + 1);
+        guestAllocations.fail = nativeAllocations.fail = true;
+        const FT_Error expected = convert ? FT_Bitmap_Convert(oracle, &source, &native, 4) : FT_Bitmap_Copy(oracle, &source, &native);
+        const int error = convert ? FT_Bitmap_Convert_nid_postfix(&library, &guestSource, &target, 4) : FT_Bitmap_Copy_nid_postfix(&library, &guestSource, &target);
+        Require(expected == FT_Err_Out_Of_Memory && error == expected);
+        Matches(target, native, false);
+        Require(target.buffer == nullptr && guestAllocations.blocks.size() == guestBase && nativeAllocations.blocks.size() == nativeBase);
+        guestAllocations.fail = nativeAllocations.fail = false;
+    }
+    Require(FT_Bitmap_Convert_nid_postfix(&library, &guestSource, &target, 4) == 0);
+    Require(FT_Bitmap_Convert(oracle, &source, &native, 4) == 0);
+    Matches(target, native, false);
+    Require(FT_Bitmap_Done_nid_postfix(&library, &target) == 0 && FT_Bitmap_Done(oracle, &native) == 0);
+    Require(guestAllocations.blocks.size() == guestBase && nativeAllocations.blocks.size() == nativeBase);
+    Require(FT_Done_Library(library.host) == 0 && FT_Done_Library(oracle) == 0);
+    Require(guestAllocations.blocks.empty() && nativeAllocations.blocks.empty());
+}
+
+struct SlotFinalizer {
+    GuestFace* face;
+    GuestLibrary* library;
+    bool called = false;
+
+    static void Run(void* object) {
+        auto* slot = static_cast<FT_GlyphSlot>(object);
+        auto& state = *static_cast<SlotFinalizer*>(slot->generic.data);
+        Require(slot->face->glyph == nullptr);
+        Require(FT_Load_Glyph_nid_postfix(&state.face->rec, 0, FT_LOAD_DEFAULT) == FT_Err_Invalid_Face_Handle);
+        Require(FT_Bitmap_Done_nid_postfix(state.library, &state.face->slot.bitmap) == 0);
+        Require(slot->bitmap.buffer == nullptr && slot->bitmap.width == 0);
+        state.called = true;
+    }
+};
+
+static void TestGlyphSlot(GuestLibrary* library, FT_Library oracle) {
+    const auto bytes = FontFixture::BuildFont(1, {});
+    GuestFace face;
+    face.library = library;
+    Require(FT_New_Memory_Face(library->host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &face.host) == 0);
+    FT_Face nativeFace = nullptr;
+    Require(FT_New_Memory_Face(oracle, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &nativeFace) == 0);
+    SyncFace(face);
+    unsigned char pixels[]{7, 31, 65, 127, 255, 17, 61, 101, 189, 239};
+    const FT_Bitmap source{2, 5, 5, pixels, 256, FT_PIXEL_MODE_GRAY, 0, nullptr};
+    const GuestBitmap guestSource = Guest(source);
+    auto& target = face.slot.bitmap;
+    auto& native = nativeFace->glyph->bitmap;
+    Require(FT_Bitmap_Copy_nid_postfix(library, &guestSource, &target) == FT_Bitmap_Copy(oracle, &source, &native));
+    Matches(target, native, true);
+    Require(face.host->glyph->bitmap.buffer == target.buffer && face.host->glyph->bitmap.width == 5);
+    GuestBitmap retained{};
+    Require(FT_Bitmap_Copy_nid_postfix(library, &target, &retained) == 0);
+    Require(retained.buffer != target.buffer && std::memcmp(retained.buffer, target.buffer, 10) == 0);
+    Require(FT_Bitmap_Done_nid_postfix(library, &target) == FT_Bitmap_Done(oracle, &native));
+    Require(face.host->glyph->bitmap.buffer == nullptr && face.host->glyph->bitmap.width == 0);
+    Require(FT_Bitmap_Convert_nid_postfix(library, &guestSource, &target, 4) == FT_Bitmap_Convert(oracle, &source, &native, 4));
+    Matches(target, native, false);
+    Require(face.host->glyph->bitmap.buffer == target.buffer && face.host->glyph->bitmap.pitch == 8);
+    Require(FT_Bitmap_Done_nid_postfix(library, &target) == 0 && FT_Bitmap_Done(oracle, &native) == 0);
+    target.rows = 9;
+    target.width = 17;
+    face.host->glyph->bitmap.rows = 9;
+    face.host->glyph->bitmap.width = 17;
+    FT_Bitmap_New_nid_postfix(&target);
+    Require(target.rows == 0 && face.host->glyph->bitmap.rows == 0 && face.host->glyph->bitmap.width == 0);
+    Require(FT_Bitmap_Done_nid_postfix(library, &retained) == 0);
+    Require(FT_Bitmap_Copy_nid_postfix(library, &guestSource, &target) == 0);
+    SlotFinalizer finalizer{&face, library};
+    face.host->glyph->generic = {&finalizer, SlotFinalizer::Run};
+    Require(FT_Done_Face(face.host) == 0 && FT_Done_Face(nativeFace) == 0);
+    Require(finalizer.called);
+}
+
+static void TestReusedStorage(GuestLibrary* library) {
+    const auto bytes = FontFixture::BuildFont(1, {});
+    alignas(GuestFace) std::byte storage[sizeof(GuestFace)]{};
+    auto* face = new (storage) GuestFace;
+    face->library = library;
+    Require(FT_New_Memory_Face(library->host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &face->host) == 0);
+    FT_Face native = face->host;
+    SyncFace(*face);
+    void* address = &face->slot.bitmap;
+    face->~GuestFace();
+    auto* bitmap = new (address) GuestBitmap{};
+    native->glyph->bitmap.width = 73;
+    FT_Bitmap_New_nid_postfix(bitmap);
+    Require(bitmap->width == 0 && native->glyph->bitmap.width == 73);
+    Require(FT_Done_Face(native) == 0);
+}
+
+int main() {
+    GuestLibrary* library = nullptr;
+    FT_Library oracle = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && library != nullptr);
+    Require(FT_Init_FreeType(&oracle) == 0);
+
+    GuestBitmap empty{1, 2, 3, nullptr, 4, 5, 6, nullptr};
+    FT_Bitmap_New_nid_postfix(&empty);
+    FT_Bitmap nativeEmpty{};
+    Matches(empty, nativeEmpty, true);
+    Require(empty.rows == 0 && empty.width == 0 && empty.pitch == 0);
+    FT_Bitmap_New_nid_postfix(nullptr);
+    Require(FT_Bitmap_Copy_nid_postfix(nullptr, nullptr, nullptr) == FT_Err_Invalid_Library_Handle);
+    Require(FT_Bitmap_Convert_nid_postfix(nullptr, nullptr, nullptr, 1) == FT_Err_Invalid_Library_Handle);
+    Require(FT_Bitmap_Done_nid_postfix(nullptr, nullptr) == FT_Err_Invalid_Library_Handle);
+    Require(FT_Bitmap_Copy_nid_postfix(library, nullptr, &empty) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Copy_nid_postfix(library, &empty, nullptr) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Convert_nid_postfix(library, nullptr, &empty, 1) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Convert_nid_postfix(library, &empty, nullptr, 1) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Done_nid_postfix(library, nullptr) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Copy_nid_postfix(library, &empty, &empty) == 0);
+
+    for (const auto [mode, bits] : {std::pair{FT_PIXEL_MODE_MONO, 1}, {FT_PIXEL_MODE_GRAY2, 2}, {FT_PIXEL_MODE_GRAY4, 4},
+                                  {FT_PIXEL_MODE_GRAY, 8}, {FT_PIXEL_MODE_LCD, 8}, {FT_PIXEL_MODE_LCD_V, 8}, {FT_PIXEL_MODE_BGRA, 32}}) {
+        TestFormat(library, oracle, static_cast<unsigned char>(mode), bits);
+    }
+    GuestBitmap target{};
+    const GuestBitmap unsupported{0, 0, 0, nullptr, 0, FT_PIXEL_MODE_NONE, 0, nullptr};
+    Require(FT_Bitmap_Copy_nid_postfix(library, &unsupported, &target) == 0);
+    Require(target.buffer == nullptr);
+    Require(FT_Bitmap_Convert_nid_postfix(library, &unsupported, &target, 1) == FT_Err_Invalid_Argument);
+    Require(target.buffer == nullptr && target.width == 0);
+    bool overlapThrew = false;
+    try {
+        FT_Bitmap_Convert_nid_postfix(library, &target, &target, 1);
+    } catch (const std::runtime_error&) {
+        overlapThrew = true;
+    }
+    Require(overlapThrew);
+    unsigned char sharedPixel = 17;
+    GuestBitmap shared{1, 1, 1, &sharedPixel, 256, FT_PIXEL_MODE_GRAY, 0, nullptr};
+    GuestBitmap alias = shared;
+    for (const bool convert : {false, true}) {
+        overlapThrew = false;
+        try {
+            if (convert) FT_Bitmap_Convert_nid_postfix(library, &shared, &alias, 1);
+            else FT_Bitmap_Copy_nid_postfix(library, &shared, &alias);
+        } catch (const std::runtime_error&) {
+            overlapThrew = true;
+        }
+        Require(overlapThrew && sharedPixel == 17 && alias.buffer == &sharedPixel);
+    }
+    Require(FT_Bitmap_Done_nid_postfix(library, &target) == 0);
+    TestAllocationFailure();
+    TestGlyphSlot(library, oracle);
+    TestReusedStorage(library);
+    Require(FT_Done_FreeType(library->host) == 0);
+    delete library;
+    Require(FT_Done_FreeType(oracle) == 0);
+}
diff --git a/core/libs/tests/GuestFreeTypeCharmap.cpp b/core/libs/tests/GuestFreeTypeCharmap.cpp
index 27372b1526..cfa8f479b9 100644
--- a/core/libs/tests/GuestFreeTypeCharmap.cpp
+++ b/core/libs/tests/GuestFreeTypeCharmap.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FreeTypeFontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestFreeType.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -19,17 +20,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-int APS5_VABI FT_Init_FreeType_nid_postfix(void**);
-int APS5_VABI FT_New_Face_nid_postfix(void*, const char*, std::int64_t, GuestFaceRec**);
-std::uint32_t APS5_VABI FT_Get_Char_Index_nid_postfix(GuestFaceRec*, std::uint64_t);
-int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec*, std::uint32_t, std::int32_t);
-int APS5_VABI FT_Select_Charmap_nid_postfix(GuestFaceRec*, std::int32_t);
-int APS5_VABI FT_Set_Charmap_nid_postfix(GuestFaceRec*, GuestCharMapRec*);
-std::uint64_t APS5_VABI FT_Get_First_Char_nid_postfix(GuestFaceRec*, std::uint32_t*);
-std::uint64_t APS5_VABI FT_Get_Next_Char_nid_postfix(GuestFaceRec*, std::uint64_t, std::uint32_t*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType charmap check failed at line %d\n", line);
@@ -76,7 +66,7 @@ int main() {
     Require(FT_New_Memory_Face(native, font.data(), static_cast<FT_Long>(font.size()), 0, &host) == 0);
     Require(FT_New_Memory_Face(native, font.data(), static_cast<FT_Long>(font.size()), 0, &foreignHost) == 0);
     Require(FT_New_Memory_Face(native, zeroFont.data(), static_cast<FT_Long>(zeroFont.size()), 0, &zeroHost) == 0);
-    void* library = nullptr;
+    FreeType::GuestLibrary* library = nullptr;
     GuestFaceRec* face = nullptr;
     GuestFaceRec* foreign = nullptr;
     GuestFaceRec* zero = nullptr;
diff --git a/core/libs/tests/GuestFreeTypeCharmapInfo.cpp b/core/libs/tests/GuestFreeTypeCharmapInfo.cpp
index 1c8ec9dd5a..33c47e7d1c 100644
--- a/core/libs/tests/GuestFreeTypeCharmapInfo.cpp
+++ b/core/libs/tests/GuestFreeTypeCharmapInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -14,13 +15,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-int APS5_VABI FT_Get_Charmap_Index_nid_postfix(GuestCharMapRec*);
-std::uint64_t APS5_VABI FT_Get_CMap_Language_ID_nid_postfix(GuestCharMapRec*);
-std::int64_t APS5_VABI FT_Get_CMap_Format_nid_postfix(GuestCharMapRec*);
-int APS5_VABI FT_Set_Charmap_nid_postfix(GuestFaceRec*, GuestCharMapRec*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType charmap info check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestFreeTypeFaceInfo.cpp b/core/libs/tests/GuestFreeTypeFaceInfo.cpp
index f30e8e8a78..65ca766d9b 100644
--- a/core/libs/tests/GuestFreeTypeFaceInfo.cpp
+++ b/core/libs/tests/GuestFreeTypeFaceInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -13,11 +14,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-const char* APS5_VABI FT_Get_X11_Font_Format_nid_postfix(GuestFaceRec*);
-std::uint16_t APS5_VABI FT_Get_FSType_Flags_nid_postfix(GuestFaceRec*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType face info check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestFreeTypeList.cpp b/core/libs/tests/GuestFreeTypeList.cpp
index ba2a805e48..f853e00bbb 100644
--- a/core/libs/tests/GuestFreeTypeList.cpp
+++ b/core/libs/tests/GuestFreeTypeList.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestList.hpp"
 
 #include <array>
@@ -6,19 +7,12 @@
 #include <map>
 #include <random>
 #include <vector>
+#include <type_traits>
+#include <ft2build.h>
+#include FT_LIST_H
 
 using namespace FreeType;
 
-extern "C" {
-GuestListNodeRec* APS5_VABI FT_List_Find_nid_postfix(GuestListRec*, void*);
-void APS5_VABI FT_List_Add_nid_postfix(GuestListRec*, GuestListNodeRec*);
-void APS5_VABI FT_List_Insert_nid_postfix(GuestListRec*, GuestListNodeRec*);
-void APS5_VABI FT_List_Remove_nid_postfix(GuestListRec*, GuestListNodeRec*);
-void APS5_VABI FT_List_Up_nid_postfix(GuestListRec*, GuestListNodeRec*);
-int APS5_VABI FT_List_Iterate_nid_postfix(GuestListRec*, GuestListIterator, void*);
-void APS5_VABI FT_List_Finalize_nid_postfix(GuestListRec*, GuestListDestructor, GuestMemoryRec*, void*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType list check failed at line %d\n", line);
@@ -29,9 +23,11 @@ static void Check(bool value, int line) {
 #define Require(value) Check((value), __LINE__)
 
 constexpr std::size_t Count = 16;
-using Nodes = std::array<FT_ListNodeRec, Count>;
+template<typename TNode>
+using Nodes = std::array<TNode, Count>;
 
-static int Index(FT_ListNode node, const Nodes& nodes) {
+template<typename TNode>
+static int Index(TNode* node, const Nodes<TNode>& nodes) {
     if (!node) return -1;
     for (std::size_t i = 0; i < nodes.size(); ++i) if (node == &nodes[i]) return static_cast<int>(i);
     Require(false);
@@ -39,10 +35,10 @@ static int Index(FT_ListNode node, const Nodes& nodes) {
 }
 
 struct Lists {
-    FT_ListRec guest{};
+    GuestListRec guest{};
     FT_ListRec native{};
-    Nodes actual{};
-    Nodes expected{};
+    Nodes<GuestListNodeRec> actual{};
+    Nodes<FT_ListNodeRec> expected{};
     std::array<int, 4> values{11, 22, 33, 44};
 
     Lists() {
@@ -62,6 +58,7 @@ struct Lists {
     void Fill() {
         for (std::size_t i = 0; i < Count; ++i) {
             FT_List_Add_nid_postfix(&guest, &actual[i]);
+
             FT_List_Add(&native, &expected[i]);
         }
         Match();
@@ -79,10 +76,12 @@ static void Mutations() {
         if (active[i]) {
             if (choice) {
                 FT_List_Up_nid_postfix(&lists.guest, &lists.actual[i]);
+
                 FT_List_Up(&lists.native, &lists.expected[i]);
                 ++operations[3];
             } else {
                 FT_List_Remove_nid_postfix(&lists.guest, &lists.actual[i]);
+
                 FT_List_Remove(&lists.native, &lists.expected[i]);
                 active[i] = false;
                 ++operations[2];
@@ -90,10 +89,12 @@ static void Mutations() {
         } else {
             if (choice) {
                 FT_List_Insert_nid_postfix(&lists.guest, &lists.actual[i]);
+
                 FT_List_Insert(&lists.native, &lists.expected[i]);
                 ++operations[1];
             } else {
                 FT_List_Add_nid_postfix(&lists.guest, &lists.actual[i]);
+
                 FT_List_Add(&lists.native, &lists.expected[i]);
                 ++operations[0];
             }
@@ -118,9 +119,10 @@ static void Mutations() {
     std::printf("list mutations: 2048 states compared with native FreeType\n");
 }
 
+template<typename TNode>
 struct Walk {
-    FT_List list;
-    Nodes* nodes;
+    std::conditional_t<std::is_same_v<TNode, GuestListNodeRec>, GuestListRec, FT_ListRec>* list;
+    Nodes<TNode>* nodes;
     bool guest;
     bool remove;
     std::size_t stop;
@@ -128,12 +130,13 @@ struct Walk {
     std::vector<int> visits;
 };
 
-static int Visit(FT_ListNode node, void* user, bool guest) {
-    auto& state = *static_cast<Walk*>(user);
+template<typename TNode>
+static int Visit(TNode* node, void* user, bool guest) {
+    auto& state = *static_cast<Walk<TNode>*>(user);
     Require(state.guest == guest);
     state.visits.push_back(Index(node, *state.nodes));
     if (state.remove) {
-        if (guest) FT_List_Remove_nid_postfix(state.list, node);
+        if constexpr (std::is_same_v<TNode, GuestListNodeRec>) FT_List_Remove_nid_postfix(state.list, node);
         else FT_List_Remove(state.list, node);
         node->prev = nullptr;
         node->next = nullptr;
@@ -176,8 +179,9 @@ struct Event {
     bool operator==(const Event&) const = default;
 };
 
+template<typename TList>
 struct Disposal {
-    FT_List list;
+    TList* list;
     FT_Memory native;
     GuestMemoryRec* guest;
     void* user;
@@ -185,34 +189,36 @@ struct Disposal {
     std::vector<Event> events;
 };
 
-static void Release(Disposal& state, void* block) {
+template<typename TList>
+static void Release(Disposal<TList>& state, void* block) {
     const auto found = state.live.find(block);
     Require(found != state.live.end());
     state.events.push_back({2, found->second, state.list->head == nullptr || state.list->tail == nullptr});
     state.live.erase(found);
-    delete static_cast<FT_ListNode>(block);
+    using Node = std::conditional_t<std::is_same_v<TList, GuestListRec>, GuestListNodeRec, FT_ListNodeRec>;
+    delete static_cast<Node*>(block);
 }
 
 static void NativeFree(FT_Memory memory, void* block) {
-    auto& state = *static_cast<Disposal*>(memory->user);
+    auto& state = *static_cast<Disposal<FT_ListRec>*>(memory->user);
     Require(state.native == memory);
     Release(state, block);
 }
 
 static void APS5_VABI GuestFree(GuestMemoryRec* memory, void* block) {
-    auto& state = *static_cast<Disposal*>(memory->user);
+    auto& state = *static_cast<Disposal<GuestListRec>*>(memory->user);
     Require(state.guest == memory);
     Release(state, block);
 }
 
 static void NativeDestroy(FT_Memory memory, void* data, void* user) {
-    auto& state = *static_cast<Disposal*>(memory->user);
+    auto& state = *static_cast<Disposal<FT_ListRec>*>(memory->user);
     Require(state.native == memory && state.user == user);
     state.events.push_back({1, data ? *static_cast<int*>(data) : -1, state.list->head == nullptr || state.list->tail == nullptr});
 }
 
 static void APS5_VABI GuestDestroy(GuestMemoryRec* memory, void* data, void* user) {
-    auto& state = *static_cast<Disposal*>(memory->user);
+    auto& state = *static_cast<Disposal<GuestListRec>*>(memory->user);
     Require(state.guest == memory && state.user == user);
     state.events.push_back({1, data ? *static_cast<int*>(data) : -1, state.list->head == nullptr || state.list->tail == nullptr});
 }
@@ -220,7 +226,8 @@ static void APS5_VABI GuestDestroy(GuestMemoryRec* memory, void* data, void* use
 static void FinalizationCases() {
     for (const bool destroy : {false, true}) {
         for (const unsigned count : {0u, 1u, 8u}) {
-            FT_ListRec guestList{}, nativeList{};
+            GuestListRec guestList{};
+            FT_ListRec nativeList{};
             std::array<int, 8> ids{0, 1, 2, 3, 4, 5, 6, 7};
             int token = 9;
             Disposal guest{&guestList, nullptr, nullptr, &token, {}, {}};
@@ -230,20 +237,24 @@ static void FinalizationCases() {
             guest.guest = &guestMemory;
             native.native = &nativeMemory;
             for (unsigned i = 0; i < count; ++i) {
-                auto* a = new FT_ListNodeRec{};
+                auto* a = new GuestListNodeRec{};
                 auto* b = new FT_ListNodeRec{};
                 a->data = b->data = i == 0 ? nullptr : &ids[i];
                 guest.live.emplace(a, i);
                 native.live.emplace(b, i);
                 FT_List_Add_nid_postfix(&guestList, a);
+
                 FT_List_Add(&nativeList, b);
             }
             const auto savedHead = guestList.head;
             FT_List_Finalize_nid_postfix(&guestList, GuestDestroy, nullptr, &token);
+
             Require(guestList.head == savedHead && guest.events.empty());
             FT_List_Finalize_nid_postfix(nullptr, GuestDestroy, &guestMemory, &token);
+
             Require(guest.events.empty());
             FT_List_Finalize_nid_postfix(&guestList, destroy ? GuestDestroy : nullptr, &guestMemory, &token);
+
             FT_List_Finalize(&nativeList, destroy ? NativeDestroy : nullptr, &nativeMemory, &token);
             Require(guestList.head == nullptr && guestList.tail == nullptr && nativeList.head == nullptr && nativeList.tail == nullptr);
             Require(guest.live.empty() && native.live.empty());
diff --git a/core/libs/tests/GuestFreeTypeNames.cpp b/core/libs/tests/GuestFreeTypeNames.cpp
index a6aa3b7673..7ae21fde1a 100644
--- a/core/libs/tests/GuestFreeTypeNames.cpp
+++ b/core/libs/tests/GuestFreeTypeNames.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -13,12 +14,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-int APS5_VABI FT_Get_Glyph_Name_nid_postfix(GuestFaceRec*, std::uint32_t, void*, std::uint32_t);
-std::uint32_t APS5_VABI FT_Get_Name_Index_nid_postfix(GuestFaceRec*, const char*);
-const char* APS5_VABI FT_Get_Postscript_Name_nid_postfix(GuestFaceRec*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType names check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestFreeTypeOutline.cpp b/core/libs/tests/GuestFreeTypeOutline.cpp
index 234090218f..39013980a0 100644
--- a/core/libs/tests/GuestFreeTypeOutline.cpp
+++ b/core/libs/tests/GuestFreeTypeOutline.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestFreeType.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -13,11 +14,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-int APS5_VABI FT_Outline_Check_nid_postfix(GuestOutline*);
-void APS5_VABI FT_Outline_Get_CBox_nid_postfix(const GuestOutline*, GuestBBox*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType outline check failed at line %d\n", line);
@@ -62,9 +58,11 @@ static void CompareBounds(std::vector<GuestVector> points) {
     FT_BBox expected{91, 92, 93, 94};
     FT_Outline_Get_CBox(&native, &expected);
     FT_Outline_Get_CBox_nid_postfix(&guest, &actual.value);
+
     Require(Equal(actual.value, {expected.xMin, expected.yMin, expected.xMax, expected.yMax}));
     Require(actual.before == 0x1122334455667788 && actual.after == 0x8877665544332211);
     FT_Outline_Get_CBox_nid_postfix(&guest, nullptr);
+
     Require(guest.n_contours == 65535 && guest.flags == 0x71 && guest.tags == nullptr && guest.contours == nullptr);
 }
 
@@ -96,10 +94,13 @@ int main() {
     GuestOutline outline{0, static_cast<std::uint16_t>(wide.size()), wide.data(), nullptr, nullptr, 0};
     GuestBBox box{1, 2, 3, 4};
     FT_Outline_Get_CBox_nid_postfix(&outline, &box);
+
     Require(Equal(box, {std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::min(),
                         std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::max()}));
     const GuestBBox retained = box;
     FT_Outline_Get_CBox_nid_postfix(nullptr, &box);
+
     Require(Equal(box, retained));
     FT_Outline_Get_CBox_nid_postfix(nullptr, nullptr);
+
 }
diff --git a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
new file mode 100644
index 0000000000..069142dbb8
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
@@ -0,0 +1,274 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include <ft2build.h>
+#include FT_FREETYPE_H
+#include FT_STROKER_H
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <limits>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <type_traits>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+using FreeType::GuestOutline;
+using FreeType::GuestVector;
+using Query = decltype(&FT_Outline_GetInsideBorder_nid_postfix);
+static_assert(std::is_same_v<Query, decltype(&FT_Outline_GetOutsideBorder_nid_postfix)>);
+static_assert(sizeof(GuestOutline) == 40 && alignof(GuestOutline) == 8);
+static_assert(offsetof(GuestOutline, points) == 8 && offsetof(GuestOutline, contours) == 24);
+static_assert(offsetof(GuestOutline, flags) == 32 && sizeof(GuestVector) == 16);
+static_assert(sizeof(FT_StrokerBorder) == 4);
+
+namespace {
+
+bool nativeInside;
+
+void Require(bool result, const char* message) {
+    if (result) return;
+    std::fprintf(stderr, "FreeType outline border: %s\n", message);
+    std::exit(1);
+}
+
+int APS5_VABI Native(const GuestOutline* input) {
+    if (!input) return nativeInside ? FT_Outline_GetInsideBorder(nullptr) : FT_Outline_GetOutsideBorder(nullptr);
+    FT_Outline outline{};
+    outline.n_points = input->n_points;
+    outline.n_contours = input->n_contours;
+    outline.flags = input->flags;
+    std::vector<FT_Vector> points;
+    std::vector<unsigned short> contours;
+    if (outline.n_points > 0) {
+        for (int i = 0; i < outline.n_points; ++i) {
+            Require(input->points[i].x >= std::numeric_limits<FT_Pos>::min() && input->points[i].x <= std::numeric_limits<FT_Pos>::max(), "reference x range");
+            Require(input->points[i].y >= std::numeric_limits<FT_Pos>::min() && input->points[i].y <= std::numeric_limits<FT_Pos>::max(), "reference y range");
+            points.push_back({static_cast<FT_Pos>(input->points[i].x), static_cast<FT_Pos>(input->points[i].y)});
+        }
+        if (outline.n_contours > 0)
+            for (int i = 0; i < outline.n_contours; ++i) contours.push_back(input->contours[i]);
+    }
+    outline.points = points.data();
+    outline.contours = contours.data();
+    return nativeInside ? FT_Outline_GetInsideBorder(&outline) : FT_Outline_GetOutsideBorder(&outline);
+}
+
+int Expected(bool inside, bool clockwise) { return inside == clockwise ? 1 : 0; }
+
+class ReadOnlyTail {
+    void* memory;
+    std::size_t page;
+    void* data;
+public:
+    ReadOnlyTail(const void* source, std::size_t bytes) {
+#ifdef _WIN32
+        SYSTEM_INFO info;
+        GetSystemInfo(&info);
+        page = info.dwPageSize;
+        memory = VirtualAlloc(nullptr, page * 2, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+        Require(memory != nullptr, "allocate guard pages");
+#else
+        page = static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+        memory = mmap(nullptr, page * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        Require(memory != MAP_FAILED, "allocate guard pages");
+#endif
+        Require(bytes <= page, "guard fixture size");
+        data = static_cast<unsigned char*>(memory) + page - bytes;
+        std::memcpy(data, source, bytes);
+#ifdef _WIN32
+        DWORD previous;
+        Require(VirtualProtect(memory, page, PAGE_READONLY, &previous) != 0, "read-only input");
+        Require(VirtualProtect(static_cast<unsigned char*>(memory) + page, page, PAGE_NOACCESS, &previous) != 0, "inaccessible neighbor");
+#else
+        Require(mprotect(memory, page, PROT_READ) == 0, "read-only input");
+        Require(mprotect(static_cast<unsigned char*>(memory) + page, page, PROT_NONE) == 0, "inaccessible neighbor");
+#endif
+    }
+    ~ReadOnlyTail() {
+#ifdef _WIN32
+        VirtualFree(memory, 0, MEM_RELEASE);
+#else
+        munmap(memory, page * 2);
+#endif
+    }
+    template<class T> T* As() const { return static_cast<T*>(data); }
+    void* End() const { return static_cast<unsigned char*>(memory) + page; }
+};
+
+void Cases(Query query, bool inside, bool guest) {
+    Require(query(nullptr) == Expected(inside, true), "null outline");
+    GuestOutline outline{};
+    outline.points = reinterpret_cast<GuestVector*>(std::uintptr_t{1});
+    outline.contours = reinterpret_cast<std::uint16_t*>(std::uintptr_t{1});
+    Require(query(&outline) == Expected(inside, true), "empty outline does not read points or contours");
+    std::array<GuestVector, 4> points{{{0, 0}, {0, 64}, {64, 64}, {64, 0}}};
+    std::uint16_t end = 3;
+    outline = {1, 4, points.data(), nullptr, &end, 0};
+    Require(query(&outline) == Expected(inside, true), "clockwise polygon");
+    const auto original = points;
+    for (const int flags : {0, 1, 2, -1}) {
+        outline.flags = flags;
+        Require(query(&outline) == Expected(inside, true), "orientation ignores outline flags");
+    }
+    Require(std::memcmp(points.data(), original.data(), sizeof(points)) == 0, "input points unchanged");
+    std::reverse(points.begin(), points.end());
+    Require(query(&outline) == Expected(inside, false), "counterclockwise polygon");
+    for (auto& point : points) point.y = 0;
+    Require(query(&outline) == Expected(inside, false), "collapsed polygon uses no-orientation fallback");
+    points = original;
+    outline.n_contours = 0;
+    Require(query(&outline) == Expected(inside, false), "no contours");
+    outline.n_contours = 1;
+    for (const std::int64_t edge : {std::int64_t{0x1000000}, std::int64_t{0x1000001}}) {
+        points = {{{-edge, -edge}, {-edge, edge}, {edge, edge}, {edge, -edge}}};
+        Require(query(&outline) == (edge == 0x1000000 ? Expected(inside, true) : Expected(inside, false)), "coordinate-limit boundary");
+    }
+    std::array<GuestVector, 8> mixed{};
+    std::copy(original.begin(), original.end(), mixed.begin());
+    std::copy(original.rbegin(), original.rend(), mixed.begin() + 4);
+    std::array<std::uint16_t, 2> mixedEnds{{3, 7}};
+    GuestOutline cancelled{2, 8, mixed.data(), nullptr, mixedEnds.data(), 0};
+    Require(query(&cancelled) == Expected(inside, false), "non-collapsed opposite contours cancel area");
+    std::vector<GuestVector> manyPoints(65535);
+    std::copy(original.rbegin(), original.rend(), manyPoints.begin());
+    std::uint16_t manyEnd = 65534;
+    GuestOutline many{1, 65535, manyPoints.data(), nullptr, &manyEnd, 0};
+    Require(query(&many) == Expected(inside, false), "unsigned point count above 32767");
+    std::fill(manyPoints.begin(), manyPoints.end(), GuestVector{});
+    std::copy(original.begin(), original.end(), manyPoints.end() - 4);
+    std::vector<std::uint16_t> manyEnds(65532);
+    for (unsigned i = 0; i < manyEnds.size() - 1; ++i) manyEnds[i] = static_cast<std::uint16_t>(i);
+    manyEnds.back() = 65534;
+    many.n_contours = 65532;
+    many.contours = manyEnds.data();
+    Require(query(&many) == Expected(inside, true), "unsigned contour count above 32767");
+    if (guest) {
+        for (const auto edge : {std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max()}) {
+            points = original;
+            points[0].x = edge;
+            Require(query(&outline) == Expected(inside, false), "64-bit out-of-range coordinate");
+        }
+        points = original;
+        std::array<GuestVector, 20> repeated{};
+        std::array<std::uint16_t, 5> ends{};
+        const std::array<GuestVector, 4> large{{{0, 0}, {0, 16384}, {16384, 16384}, {16384, 0}}};
+        for (unsigned i = 0; i < 5; ++i) {
+            std::copy(large.begin(), large.end(), repeated.begin() + i * 4);
+            ends[i] = static_cast<std::uint16_t>(i * 4 + 3);
+        }
+        GuestOutline wide{5, 20, repeated.data(), nullptr, ends.data(), 0};
+        Require(query(&wide) == Expected(inside, true), "LP64 area must not wrap at 32 bits");
+        ReadOnlyTail guardedPoints(original.data(), sizeof(original));
+        ReadOnlyTail guardedEnds(&end, sizeof(end));
+        GuestOutline guarded{1, 4, guardedPoints.As<GuestVector>(), static_cast<unsigned char*>(guardedPoints.End()), guardedEnds.As<std::uint16_t>(), -1};
+        ReadOnlyTail guardedOutline(&guarded, sizeof(guarded));
+        Require(query(guardedOutline.As<GuestOutline>()) == Expected(inside, true), "read-only bounded inputs and unused inaccessible tags");
+        outline = {1, 4, nullptr, nullptr, &end, 0};
+        bool threw = false;
+        try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+        Require(threw, "null positive-count points are explicitly unsupported");
+        outline.points = points.data();
+        outline.contours = nullptr;
+        threw = false;
+        try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+        Require(threw, "null positive-count contours are explicitly unsupported");
+        for (const std::uint16_t badEnd : {std::uint16_t{4}, std::uint16_t{0xffff}}) {
+            auto invalidEnd = badEnd;
+            outline.contours = &invalidEnd;
+            threw = false;
+            try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+            Require(threw, "invalid contour endpoint is explicitly unsupported");
+        }
+        for (const std::uint16_t nextEnd : {std::uint16_t{2}, std::uint16_t{3}}) {
+            std::array<std::uint16_t, 2> invalidEnds{{3, nextEnd}};
+            outline.n_contours = 2;
+            outline.contours = invalidEnds.data();
+            threw = false;
+            try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+            Require(threw, "non-increasing contour endpoints are explicitly unsupported");
+        }
+    }
+    std::uint32_t state = 7;
+    for (unsigned iteration = 0; iteration < 512; ++iteration) {
+        for (auto& point : points) {
+            state = state * 1664525u + 1013904223u;
+            point.x = static_cast<int>((state >> 16) & 255) - 128;
+            state = state * 1664525u + 1013904223u;
+            point.y = static_cast<int>((state >> 16) & 255) - 128;
+        }
+        outline = {1, 4, points.data(), nullptr, &end, 0};
+        nativeInside = inside;
+        Require(query(&outline) == Native(&outline), "bounded polygon matches bundled FreeType");
+    }
+    if (guest) {
+        points = original;
+        outline = {1, 4, points.data(), nullptr, &end, 0};
+        std::array<std::thread, 4> threads;
+        for (auto& thread : threads) thread = std::thread([&] {
+            for (unsigned i = 0; i < 100; ++i) Require(query(&outline) == Expected(inside, true), "concurrent independent query");
+        });
+        for (auto& thread : threads) thread.join();
+    }
+}
+
+}
+
+int main(int argc, char** argv) {
+#ifdef _WIN32
+    SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX);
+#endif
+    if (argc == 2 && std::strcmp(argv[1], "reference") == 0) {
+        for (const bool inside : {false, true}) {
+            nativeInside = inside;
+            Cases(Native, inside, false);
+        }
+        std::puts("Bundled FreeType reference cases passed");
+        return 0;
+    }
+    Require(argc == 4, "expected library, border and export mode");
+    const bool inside = std::strcmp(argv[2], "inside") == 0;
+    const bool patched = std::strcmp(argv[3], "patched") == 0;
+    const char* symbol = patched ? (inside ? "Pz262plj20w" : "sKneJjUXWkQ") :
+        (inside ? "FT_Outline_GetInsideBorder_nid_postfix" : "FT_Outline_GetOutsideBorder_nid_postfix");
+#ifdef _WIN32
+    const auto library = LoadLibraryA(argv[1]);
+    Require(library != nullptr, "load requested library");
+    const auto checkPath = [](HMODULE module, const std::filesystem::path& expected) {
+        Require(module != nullptr, "load matching runtime module");
+        std::array<wchar_t, 32768> path{};
+        const auto length = GetModuleFileNameW(module, path.data(), static_cast<DWORD>(path.size()));
+        Require(length != 0 && length < path.size(), "read loaded module path");
+        Require(std::filesystem::equivalent(expected, std::filesystem::path(path.data())), "loaded module variant path");
+    };
+    const auto requested = std::filesystem::absolute(argv[1]);
+    checkPath(library, requested);
+    checkPath(GetModuleHandleW(L"libc.prx"), requested.parent_path() / "libc.prx");
+    auto query = reinterpret_cast<Query>(GetProcAddress(library, symbol));
+#else
+    const auto library = dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
+    if (!library) std::fprintf(stderr, "%s\n", dlerror());
+    Require(library != nullptr, "load requested library");
+    auto query = reinterpret_cast<Query>(dlsym(library, symbol));
+#endif
+    if (!query) std::fprintf(stderr, "Missing %s\n", symbol);
+    Require(query != nullptr, "missing outline-border export");
+    Cases(query, inside, true);
+    std::puts("Guest outline-border cases passed");
+#ifdef _WIN32
+    FreeLibrary(library);
+#else
+    dlclose(library);
+#endif
+}
diff --git a/core/libs/tests/GuestFreeTypeOutlineMutations.cpp b/core/libs/tests/GuestFreeTypeOutlineMutations.cpp
index 67144147f3..b7e437d03e 100644
--- a/core/libs/tests/GuestFreeTypeOutlineMutations.cpp
+++ b/core/libs/tests/GuestFreeTypeOutlineMutations.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FreeTypeFontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -14,12 +15,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-void APS5_VABI FT_Outline_Translate_nid_postfix(const GuestOutline*, std::int64_t, std::int64_t);
-void APS5_VABI FT_Outline_Reverse_nid_postfix(GuestOutline*);
-int APS5_VABI FT_Render_Glyph_nid_postfix(GuestGlyphSlotRec*, std::int32_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType outline mutation check failed at line %d\n", line);
@@ -54,6 +49,7 @@ static void ReverseOracle(std::size_t count, std::vector<std::uint16_t> contours
     FT_Outline native{guest.n_contours, guest.n_points, nativePoints.data(), nativeTags.data(), contours.data(), flags};
     FT_Outline_Reverse(&native);
     FT_Outline_Reverse_nid_postfix(&guest);
+
     Require(guest.flags == native.flags && guest.flags == (flags ^ FT_OUTLINE_REVERSE_FILL));
     Require(guest.n_points == count && guest.n_contours == contours.size() && contours == originalContours);
     for (std::size_t index = 0; index < count; ++index) {
@@ -64,6 +60,7 @@ static void ReverseOracle(std::size_t count, std::vector<std::uint16_t> contours
     Require(Equal(storage.front(), original.front()) && Equal(storage.back(), original.back()));
     Require(tags.front() == 0xA5 && tags.back() == 0xA5);
     FT_Outline_Reverse_nid_postfix(&guest);
+
     Require(guest.flags == flags && tags == originalTags);
     for (std::size_t index = 0; index < storage.size(); ++index) Require(Equal(storage[index], original[index]));
 }
@@ -80,6 +77,7 @@ static void TranslateOracle(std::size_t count, FT_Pos xOffset, FT_Pos yOffset) {
     FT_Outline native{guest.n_contours, guest.n_points, nativePoints.data(), nullptr, nullptr, guest.flags};
     FT_Outline_Translate(&native, xOffset, yOffset);
     FT_Outline_Translate_nid_postfix(&guest, xOffset, yOffset);
+
     for (std::size_t index = 0; index < count; ++index) {
         Require(storage[index + 1].x == nativePoints[index].x && storage[index + 1].y == nativePoints[index].y);
     }
@@ -97,16 +95,20 @@ static void WideTranslation() {
     const std::array<GuestVector, 6> expected = {{{low, high}, {low + 1, high - 1}, {0, -1}, {2, -2}, {wide + 1, -wide - 1}, {high - 4, low + 4}}};
     GuestOutline guest{0, static_cast<std::uint16_t>(points.size()), points.data(), nullptr, nullptr, 0};
     FT_Outline_Translate_nid_postfix(&guest, 1, -1);
+
     for (std::size_t index = 0; index < points.size(); ++index) Require(Equal(points[index], expected[index]));
     FT_Outline_Translate_nid_postfix(&guest, -1, 1);
+
     for (std::size_t index = 0; index < points.size(); ++index) Require(Equal(points[index], original[index]));
     GuestVector point{7, -9};
     guest.n_points = 1;
     guest.points = &point;
     FT_Outline_Translate_nid_postfix(&guest, wide, -wide);
+
     Require(Equal(point, {wide + 7, -wide - 9}));
     point = {low, 1};
     FT_Outline_Translate_nid_postfix(&guest, low, high);
+
     Require(Equal(point, {0, low}));
 }
 
@@ -126,6 +128,7 @@ static void RenderModifiedOutline() {
         SyncFace(guest);
         FT_Outline_Reverse_nid_postfix(&guest.slot.outline);
         FT_Outline_Translate_nid_postfix(&guest.slot.outline, 77, -129);
+
         FT_Outline_Reverse(&native->glyph->outline);
         FT_Outline_Translate(&native->glyph->outline, 77, -129);
         Require(FT_Render_Glyph_nid_postfix(&guest.slot, FT_RENDER_MODE_NORMAL) == FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL));
@@ -144,6 +147,7 @@ static void RenderModifiedOutline() {
 int main() {
     FT_Outline_Reverse_nid_postfix(nullptr);
     FT_Outline_Translate_nid_postfix(nullptr, std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max());
+
     ReverseOracle(0, {}, FT_OUTLINE_REVERSE_FILL);
     for (std::size_t count = 1; count <= 8; ++count) {
         for (unsigned mask = 0; mask < (1u << (count - 1)); ++mask) {
diff --git a/core/libs/tests/GuestFreeTypePfr.cpp b/core/libs/tests/GuestFreeTypePfr.cpp
new file mode 100644
index 0000000000..a0a217c393
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypePfr.cpp
@@ -0,0 +1,261 @@
+#include "FreeTypeFontFixture.hpp"
+#include "prx/libSceFreeType/include/Api.hpp"
+#include <nid/NidCompute.hpp>
+#include <ft2build.h>
+#include FT_FREETYPE_H
+#include FT_PFR_H
+#include <array>
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <limits>
+#include <string>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (value) return;
+    std::fprintf(stderr, "PFR check failed at line %d\n", line);
+    std::exit(1);
+}
+#define Require(value) Check((value), __LINE__)
+
+static void CheckNullFace(int error) {
+    if (error != FT_Err_Invalid_Argument) std::fprintf(stderr, "PFR null-face returned %d, expected %d\n", error, FT_Err_Invalid_Argument);
+    Require(error == FT_Err_Invalid_Argument);
+}
+
+static void Put24(std::vector<unsigned char>& bytes, std::uint32_t value) {
+    bytes.push_back(static_cast<unsigned char>(value >> 16));
+    Put16(bytes, value);
+}
+
+static void Field(std::vector<unsigned char>& bytes, unsigned offset, unsigned width, std::uint32_t value) {
+    for (unsigned index = 0; index < width; ++index) bytes[offset + index] = static_cast<unsigned char>(value >> (8 * (width - index - 1)));
+}
+
+static std::vector<unsigned char> PfrFont() {
+    std::vector<unsigned char> physical;
+    PutAll16(physical, {1, 1000, 2000, 0, -200, 1000, 800});
+    physical.push_back(0x84);
+    physical.insert(physical.end(), {1, 7, 4, 1, 0xFF, 0x9C, 0, 65, 66, 20});
+    Put24(physical, 0);
+    physical.push_back(0);
+    physical.insert(physical.end(), {0, 0});
+    PutAll16(physical, {0, 0, 2});
+    for (const auto [code, advance] : {std::pair{65, 600}, std::pair{66, -120}}) {
+        physical.push_back(static_cast<unsigned char>(code));
+        Put16(physical, static_cast<std::uint16_t>(advance));
+        physical.push_back(3);
+        Put16(physical, 1);
+    }
+    std::vector<unsigned char> bytes(58);
+    Field(bytes, 0, 4, 0x50465230);
+    Field(bytes, 4, 2, 4);
+    Field(bytes, 6, 2, 0x0D0A);
+    Field(bytes, 8, 2, 58);
+    Field(bytes, 10, 2, 7);
+    Field(bytes, 12, 2, 58);
+    Field(bytes, 14, 2, 18);
+    Field(bytes, 16, 3, 18);
+    Field(bytes, 19, 3, 65);
+    Field(bytes, 22, 2, static_cast<std::uint32_t>(physical.size()));
+    Field(bytes, 24, 3, static_cast<std::uint32_t>(physical.size()));
+    Field(bytes, 27, 3, 83);
+    Field(bytes, 30, 2, 3);
+    Field(bytes, 32, 3, 4);
+    Field(bytes, 35, 3, 83 + static_cast<std::uint32_t>(physical.size()));
+    Field(bytes, 52, 2, 1);
+    Field(bytes, 56, 2, 2);
+    PutAll16(bytes, {1, 18});
+    Put24(bytes, 65);
+    for (auto value : {0x10000u, 0u, 0u, 0x10000u}) Put24(bytes, value);
+    bytes.push_back(0);
+    Put16(bytes, static_cast<std::uint32_t>(physical.size()));
+    Put24(bytes, 83);
+    bytes.insert(bytes.end(), physical.begin(), physical.end());
+    bytes.insert(bytes.end(), 12, 0);
+    return bytes;
+}
+
+template<typename TValue>
+struct Guarded {
+    std::array<std::uint8_t, 8> before{0xA5, 0xA5, 0xA5, 0xA5, 0xA5, 0xA5, 0xA5, 0xA5};
+    TValue value;
+    std::array<std::uint8_t, 8> after{0xD3, 0xD3, 0xD3, 0xD3, 0xD3, 0xD3, 0xD3, 0xD3};
+
+    void Verify() const {
+        for (auto byte : before) Require(byte == 0xA5);
+        for (auto byte : after) Require(byte == 0xD3);
+    }
+};
+
+static_assert(offsetof(Guarded<std::uint32_t>, after) == offsetof(Guarded<std::uint32_t>, value) + sizeof(std::uint32_t));
+static_assert(offsetof(Guarded<std::int64_t>, after) == offsetof(Guarded<std::int64_t>, value) + sizeof(std::int64_t));
+static_assert(offsetof(Guarded<GuestVector>, after) == offsetof(Guarded<GuestVector>, value) + sizeof(GuestVector));
+
+static void Reference(const std::vector<unsigned char>& font) {
+    FT_Library library = nullptr;
+    FT_Face face = nullptr;
+    Require(FT_Init_FreeType(&library) == 0);
+    Require(FT_New_Memory_Face(library, font.data(), static_cast<FT_Long>(font.size()), 0, &face) == 0);
+    Require(face->num_glyphs == 3 && FT_Get_Char_Index(face, 65) == 1 && FT_Get_Char_Index(face, 66) == 2);
+    Require(FT_Set_Pixel_Sizes(face, 20, 30) == 0);
+    FT_UInt outline = 0, metrics = 0;
+    FT_Fixed x = 0, y = 0;
+    Require(FT_Get_PFR_Metrics(face, &outline, &metrics, &x, &y) == 0);
+    Require(outline == 1000 && metrics == 2000 && x == FT_DivFix(20 * 64, 2000) && y == FT_DivFix(30 * 64, 2000));
+    FT_Pos advance = 0;
+    Require(FT_Get_PFR_Advance(face, 1, &advance) == 0 && advance == 600);
+    Require(FT_Get_PFR_Advance(face, 2, &advance) == 0 && advance == -120);
+    FT_Vector kerning{};
+    Require(FT_Get_PFR_Kerning(face, 1, 2, &kerning) == 0 && kerning.x == -80 && kerning.y == 0);
+    Require(FT_Get_Kerning(face, 1, 2, FT_KERNING_UNSCALED, &kerning) == 0 && kerning.x == -40);
+    Require(FT_Load_Glyph(face, 1, FT_LOAD_NO_SCALE) == 0);
+    Require(FT_Done_Face(face) == 0 && FT_Done_FreeType(library) == 0);
+}
+
+#ifdef _WIN32
+using Module = HMODULE;
+#else
+using Module = void*;
+#endif
+
+static Module Open(const std::filesystem::path& path) {
+#ifdef _WIN32
+    const auto module = LoadLibraryExW(path.c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
+    Require(module != nullptr);
+    std::array<wchar_t, 32768> selected{};
+    const auto length = GetModuleFileNameW(module, selected.data(), static_cast<DWORD>(selected.size()));
+    Require(length != 0 && length < selected.size());
+    Require(std::filesystem::equivalent(path, std::filesystem::path(selected.data())));
+#else
+    const auto module = dlopen(path.c_str(), RTLD_NOW | RTLD_LOCAL);
+    if (!module) std::fprintf(stderr, "%s\n", dlerror());
+    Require(module != nullptr);
+#endif
+    return module;
+}
+
+template<typename TFunction>
+static TFunction Resolve(Module module, const std::string& name, bool patched) {
+    const auto symbol = patched ? Nid::ComputeNid(name, "") : name + "_nid_postfix";
+#ifdef _WIN32
+    const auto address = GetProcAddress(module, symbol.c_str());
+#else
+    const auto address = dlsym(module, symbol.c_str());
+#endif
+    if (!address) std::fprintf(stderr, "Missing %s (%s)\n", name.c_str(), symbol.c_str());
+    Require(address != nullptr);
+    return reinterpret_cast<TFunction>(address);
+}
+
+using Metrics = decltype(&FT_Get_PFR_Metrics_nid_postfix);
+using Advance = decltype(&FT_Get_PFR_Advance_nid_postfix);
+using Kerning = decltype(&FT_Get_PFR_Kerning_nid_postfix);
+
+static void MetricsCases(Metrics call, GuestFaceRec* face, bool pfr) {
+    Guarded<std::uint32_t> outline{.value = 0xDEADBEEFu}, metrics{.value = 0xDEADBEEFu};
+    Guarded<std::int64_t> x{.value = 0x123456789ABCll}, y{.value = 0x123456789ABCll};
+    for (unsigned mask = 0; mask < 16; ++mask) {
+        CheckNullFace(call(nullptr, mask & 1 ? &outline.value : nullptr, mask & 2 ? &metrics.value : nullptr,
+                     mask & 4 ? &x.value : nullptr, mask & 8 ? &y.value : nullptr));
+        Require(outline.value == 0xDEADBEEFu && metrics.value == 0xDEADBEEFu && x.value == 0x123456789ABCll && y.value == 0x123456789ABCll);
+        outline.Verify(); metrics.Verify(); x.Verify(); y.Verify();
+    }
+    const auto expectedX = pfr ? FT_DivFix(20 * 64, 2000) : face->size->metrics.x_scale;
+    const auto expectedY = pfr ? FT_DivFix(30 * 64, 2000) : face->size->metrics.y_scale;
+    for (unsigned mask = 0; mask < 16; ++mask) {
+        outline.value = metrics.value = 0xDEADBEEFu;
+        x.value = y.value = 0x123456789ABCll;
+        Require(call(face, mask & 1 ? &outline.value : nullptr, mask & 2 ? &metrics.value : nullptr,
+                     mask & 4 ? &x.value : nullptr, mask & 8 ? &y.value : nullptr) == (pfr ? 0 : FT_Err_Unknown_File_Format));
+        Require(outline.value == (mask & 1 ? 1000u : 0xDEADBEEFu));
+        Require(metrics.value == (mask & 2 ? pfr ? 2000u : 1000u : 0xDEADBEEFu));
+        Require(x.value == (mask & 4 ? expectedX : 0x123456789ABCll));
+        Require(y.value == (mask & 8 ? expectedY : 0x123456789ABCll));
+        outline.Verify(); metrics.Verify(); x.Verify(); y.Verify();
+    }
+    Require(call(face, &outline.value, &outline.value, &x.value, &x.value) == (pfr ? 0 : FT_Err_Unknown_File_Format));
+    Require(outline.value == (pfr ? 2000u : 1000u) && x.value == expectedY);
+}
+
+static void AdvanceCases(Advance call, GuestFaceRec* face, bool pfr) {
+    Guarded<std::int64_t> value{.value = 0x123456789ABCll};
+    CheckNullFace(call(nullptr, 1, nullptr));
+    CheckNullFace(call(nullptr, 1, &value.value));
+    Require(value.value == 0x123456789ABCll);
+    value.Verify();
+    Require(call(face, 1, nullptr) == FT_Err_Invalid_Argument);
+    for (const auto index : {0u, 1u, 2u, 3u, std::numeric_limits<std::uint32_t>::max()}) {
+        value.value = 0x123456789ABCll;
+        const auto error = call(face, index, &value.value);
+        Require(error == (pfr && (index == 1 || index == 2) ? 0 : FT_Err_Invalid_Argument));
+        Require(value.value == (pfr ? index == 1 ? 600 : index == 2 ? -120 : 0 : 0x123456789ABCll));
+        value.Verify();
+    }
+}
+
+static void KerningCases(Kerning call, GuestFaceRec* face, bool pfr) {
+    Guarded<GuestVector> value{.value = {0x123456789ABCll, -0x123456789ABCll}};
+    CheckNullFace(call(nullptr, 1, 2, nullptr));
+    CheckNullFace(call(nullptr, 1, 2, &value.value));
+    Require(value.value.x == 0x123456789ABCll && value.value.y == -0x123456789ABCll);
+    value.Verify();
+    Require(call(face, 1, 2, nullptr) == FT_Err_Invalid_Argument);
+    for (const auto [left, right] : {std::pair{1u, 2u}, std::pair{2u, 1u}, std::pair{0u, 2u}, std::pair{0xFFFFFFFFu, 1u}}) {
+        value.value = {0x123456789ABCll, -0x123456789ABCll};
+        Require(call(face, left, right, &value.value) == 0);
+        Require(value.value.x == (pfr && left == 1 && right == 2 ? -80 : 0) && value.value.y == 0);
+        value.Verify();
+    }
+}
+
+int main(int argc, char** argv) {
+    const auto pfrFont = PfrFont();
+    Reference(pfrFont);
+    if (argc == 2 && std::string(argv[1]) == "reference") return 0;
+    Require(argc == 4);
+    const auto directory = std::filesystem::absolute(argv[1]);
+    const bool patched = std::string(argv[2]) == "patched";
+    const std::string operation = argv[3];
+    Require(operation == "metrics" || operation == "advance" || operation == "kerning");
+    const auto base = Open(directory / "libSceFreeType.prx");
+    const auto optional = Open(directory / "libSceFreeTypeOptOl.prx");
+    const auto init = Resolve<int (APS5_VABI*)(void**)>(base, "FT_Init_FreeType", patched);
+    const auto done = Resolve<int (APS5_VABI*)(void*)>(base, "FT_Done_FreeType", patched);
+    const auto create = Resolve<int (APS5_VABI*)(void*, const unsigned char*, std::int64_t, std::int64_t, GuestFaceRec**)>(base, "FT_New_Memory_Face", patched);
+    const auto destroy = Resolve<int (APS5_VABI*)(GuestFaceRec*)>(base, "FT_Done_Face", patched);
+    const auto resize = Resolve<int (APS5_VABI*)(GuestFaceRec*, std::uint32_t, std::uint32_t)>(base, "FT_Set_Pixel_Sizes", patched);
+    Metrics metrics = nullptr;
+    Advance advance = nullptr;
+    Kerning kerning = nullptr;
+    if (operation == "metrics") metrics = Resolve<Metrics>(optional, "FT_Get_PFR_Metrics", patched);
+    if (operation == "advance") advance = Resolve<Advance>(optional, "FT_Get_PFR_Advance", patched);
+    if (operation == "kerning") kerning = Resolve<Kerning>(optional, "FT_Get_PFR_Kerning", patched);
+    void* library = nullptr;
+    Require(init(&library) == 0);
+    const auto ttfFont = SquareGlyphFont(65, 700);
+    for (bool pfr : {true, false, true}) {
+        const auto& bytes = pfr ? pfrFont : ttfFont;
+        GuestFaceRec* face = nullptr;
+        Require(create(library, bytes.data(), static_cast<std::int64_t>(bytes.size()), 0, &face) == 0);
+        Require(resize(face, 20, 30) == 0);
+        std::array<unsigned char, sizeof(GuestFaceRec)> snapshot;
+        std::memcpy(snapshot.data(), face, snapshot.size());
+        if (metrics) MetricsCases(metrics, face, pfr);
+        if (advance) AdvanceCases(advance, face, pfr);
+        if (kerning) KerningCases(kerning, face, pfr);
+        Require(std::memcmp(snapshot.data(), face, snapshot.size()) == 0);
+        Require(destroy(face) == 0);
+    }
+    Require(done(library) == 0);
+    std::printf("PFR %s %s: positive/non-PFR, LP64, bounds, errors, optional outputs and lifetime passed\n", operation.c_str(), argv[2]);
+}
diff --git a/core/libs/tests/GuestFreeTypePfrNull.cpp b/core/libs/tests/GuestFreeTypePfrNull.cpp
new file mode 100644
index 0000000000..bfde675ce7
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypePfrNull.cpp
@@ -0,0 +1,95 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include FT_FONT_FORMATS_H
+#include FT_PFR_H
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+namespace {
+
+unsigned imports = 0;
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "PFR null face: %s\n", message);
+    std::exit(1);
+}
+
+void CheckError(int result, const char* operation) {
+    if (result == 6) return;
+    std::fprintf(stderr, "PFR null face: %s returned %d, expected 6; host imports %u\n", operation, result, imports);
+    std::exit(1);
+}
+
+template<class T>
+struct Guarded {
+    std::uint64_t before = UINT64_C(0x123456789abcdef0);
+    T value;
+    std::uint64_t after = UINT64_C(0xfedcba9876543210);
+
+    void Verify() const {
+        Require(before == UINT64_C(0x123456789abcdef0) && after == UINT64_C(0xfedcba9876543210), "output canaries");
+    }
+};
+
+}
+
+namespace FreeType {
+
+GuestFace* FaceOf(const GuestFaceRec* face) {
+    Require(face == nullptr, "fixture received a nonnull face");
+    return nullptr;
+}
+
+}
+
+extern "C" {
+
+FT_Error FT_Get_PFR_Advance(FT_Face, FT_UInt, FT_Pos*) {
+    ++imports;
+    return FT_Err_Invalid_Face_Handle;
+}
+
+FT_Error FT_Get_PFR_Kerning(FT_Face, FT_UInt, FT_UInt, FT_Vector*) {
+    ++imports;
+    return FT_Err_Invalid_Face_Handle;
+}
+
+FT_Error FT_Get_PFR_Metrics(FT_Face, FT_UInt*, FT_UInt*, FT_Fixed*, FT_Fixed*) {
+    ++imports;
+    return FT_Err_Invalid_Face_Handle;
+}
+
+const char* FT_Get_Font_Format(FT_Face) {
+    ++imports;
+    return nullptr;
+}
+
+}
+
+int main() {
+    Guarded<std::uint32_t> outline{.value = 0xdeadbeefu}, metrics{.value = 0xa5a5a5a5u};
+    Guarded<std::int64_t> x{.value = INT64_C(0x123456789abc)}, y{.value = -INT64_C(0x123456789abc)};
+    for (unsigned mask = 0; mask < 16; ++mask) {
+        CheckError(FT_Get_PFR_Metrics_nid_postfix(nullptr, mask & 1 ? &outline.value : nullptr,
+            mask & 2 ? &metrics.value : nullptr, mask & 4 ? &x.value : nullptr, mask & 8 ? &y.value : nullptr), "metrics");
+        Require(outline.value == 0xdeadbeefu && metrics.value == 0xa5a5a5a5u &&
+            x.value == INT64_C(0x123456789abc) && y.value == -INT64_C(0x123456789abc), "metrics output unchanged");
+        outline.Verify(); metrics.Verify(); x.Verify(); y.Verify();
+    }
+    Guarded<std::int64_t> advance{.value = INT64_C(0x123456789abc)};
+    Guarded<FreeType::GuestVector> vector{.value = {INT64_C(0x123456789abc), -INT64_C(0x123456789abc)}};
+    for (const auto index : std::array<std::uint32_t, 3>{0, 1, UINT32_MAX}) {
+        for (const bool output : {false, true}) {
+            CheckError(FT_Get_PFR_Advance_nid_postfix(nullptr, index, output ? &advance.value : nullptr), "advance");
+            CheckError(FT_Get_PFR_Kerning_nid_postfix(nullptr, index, UINT32_MAX - index, output ? &vector.value : nullptr), "kerning");
+            Require(advance.value == INT64_C(0x123456789abc), "advance output unchanged");
+            Require(vector.value.x == INT64_C(0x123456789abc) && vector.value.y == -INT64_C(0x123456789abc), "kerning output unchanged");
+            advance.Verify(); vector.Verify();
+        }
+    }
+    Require(imports == 0, "null face called a host import");
+    std::puts("PFR null-face contract passed without host imports");
+}
diff --git a/core/libs/tests/GuestFreeTypeRequestSize.cpp b/core/libs/tests/GuestFreeTypeRequestSize.cpp
index 536d8493b1..a1e8356b3d 100644
--- a/core/libs/tests/GuestFreeTypeRequestSize.cpp
+++ b/core/libs/tests/GuestFreeTypeRequestSize.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FreeTypeFontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestFreeType.hpp"
 
@@ -17,14 +18,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-int APS5_VABI FT_Init_FreeType_nid_postfix(void**);
-int APS5_VABI FT_Done_FreeType_nid_postfix(void*);
-int APS5_VABI FT_New_Memory_Face_nid_postfix(void*, const unsigned char*, std::int64_t, std::int64_t, GuestFaceRec**);
-int APS5_VABI FT_Request_Size_nid_postfix(GuestFaceRec*, const GuestSizeRequestRec*);
-int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec*, std::uint32_t, std::int32_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType size request check failed at line %d\n", line);
@@ -37,7 +30,7 @@ struct Fixture {
     std::vector<unsigned char> bytes;
     FT_Library library = nullptr;
     FT_Face native = nullptr;
-    void* guestLibrary = nullptr;
+    FreeType::GuestLibrary* guestLibrary = nullptr;
     GuestFaceRec* guest = nullptr;
 
     explicit Fixture(std::vector<unsigned char> font, int faceIndex = 0) : bytes(std::move(font)) {
@@ -155,6 +148,7 @@ static void CheckInvalid() {
             bool threw = false;
             try {
                 FT_Request_Size_nid_postfix(fixture.guest, &request);
+
             } catch (const std::runtime_error&) {
                 threw = true;
             }
diff --git a/core/libs/tests/GuestFreeTypeSfntNames.cpp b/core/libs/tests/GuestFreeTypeSfntNames.cpp
index 12affd6cbd..4cd1e8f14c 100644
--- a/core/libs/tests/GuestFreeTypeSfntNames.cpp
+++ b/core/libs/tests/GuestFreeTypeSfntNames.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -14,11 +15,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-std::uint32_t APS5_VABI FT_Get_Sfnt_Name_Count_nid_postfix(GuestFaceRec*);
-int APS5_VABI FT_Get_Sfnt_Name_nid_postfix(GuestFaceRec*, std::uint32_t, GuestSfntName*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType SFNT names check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestFreebsdClocks.cpp b/core/libs/tests/GuestFreebsdClocks.cpp
index 40972ab464..1ae0f71258 100644
--- a/core/libs/tests/GuestFreebsdClocks.cpp
+++ b/core/libs/tests/GuestFreebsdClocks.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <climits>
@@ -8,20 +11,6 @@
 #include <ctime>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI clock_getres_nid_postfix(int clockId, KernelTimespec* res);
-int APS5_VABI clock_settime_nid_postfix(int clockId, const KernelTimespec* tp);
-int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-int APS5_VABI sceKernelClockGetres(KernelClockid clockId, KernelTimespec* tp);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-int APS5_VABI gettimeofday_nid_postfix(KernelTimeval* tv, KernelTimezone* tz);
-std::int64_t APS5_VABI _Xtime_get_ticks_nid_postfix();
-int APS5_VABI sceKernelConvertLocaltimeToUtc(std::int64_t, std::int64_t, std::int64_t*, KernelTimesec*, std::int32_t*);
-int APS5_VABI sceKernelConvertUtcToLocaltime(std::int64_t, std::int64_t*, KernelTimesec*, std::int32_t*);
-}
-
 static constexpr int SCE_OK = 0;
 
 static constexpr int GUEST_CLOCK_REALTIME = 0;
@@ -70,6 +59,7 @@ static void UnsupportedResolutionStillThrows() {
     bool rejected = false;
     try {
         clock_getres_nid_postfix(3, &resolution);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -88,6 +78,7 @@ static void OmittedTimeIsFaultAfterClockValidation() {
     bool rejected = false;
     try {
         clock_gettime_nid_postfix(3, nullptr);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -244,6 +235,7 @@ static void RequireSettimeError(int clockId, const KernelTimespec* time, int err
 static bool SettimeThrows(const KernelTimespec& time, const char* requested) {
     try {
         clock_settime_nid_postfix(GUEST_CLOCK_REALTIME, &time);
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), requested) != nullptr;
     }
diff --git a/core/libs/tests/GuestFreopenHostStandard.cpp b/core/libs/tests/GuestFreopenHostStandard.cpp
new file mode 100644
index 0000000000..cf8e85e536
--- /dev/null
+++ b/core/libs/tests/GuestFreopenHostStandard.cpp
@@ -0,0 +1,77 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cerrno>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <string>
+#include <fcntl.h>
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <io.h>
+#else
+#include <unistd.h>
+#endif
+
+extern "C" {
+
+extern FileStream* __stdoutp_nid_postfix;
+}
+
+static void Require(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "freopen host standard check failed at line %d, errno %d\n", line, errno);
+        std::abort();
+    }
+}
+#define Check(value) Require((value), __LINE__)
+
+#ifdef _WIN32
+static int HostDup(int descriptor) { return ::_dup(descriptor); }
+static int HostDup2(int from, int to) { return ::_dup2(from, to); }
+static int HostClose(int descriptor) { return ::_close(descriptor); }
+static int HostWrite(int descriptor, const char* text, unsigned size) { return ::_write(descriptor, text, size); }
+static int HostFileno(std::FILE* stream) { return ::_fileno(stream); }
+#else
+static int HostDup(int descriptor) { return ::dup(descriptor); }
+static int HostDup2(int from, int to) { return ::dup2(from, to) == to ? 0 : -1; }
+static int HostClose(int descriptor) { return ::close(descriptor); }
+static int HostWrite(int descriptor, const char* text, unsigned size) { return static_cast<int>(::write(descriptor, text, size)); }
+static int HostFileno(std::FILE* stream) { return ::fileno(stream); }
+#endif
+
+static std::string Contents(const std::string& name) {
+    std::ifstream stream(name, std::ios::binary);
+    return std::string(std::istreambuf_iterator<char>(stream), std::istreambuf_iterator<char>());
+}
+
+int main() {
+    const auto sinkName = "anyps5-freopen-host-standard-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + ".txt";
+    std::FILE* sink = std::fopen(sinkName.c_str(), "wb");
+    Check(sink != nullptr);
+    const int original = HostDup(1);
+    Check(original >= 0 && HostDup2(HostFileno(sink), 1) == 0);
+
+    errno = 0;
+    FileStream* const reopened = freopen_nid_postfix("", "w", __stdoutp_nid_postfix);
+    const int error = errno;
+
+    const int written = HostWrite(1, "host", 4);
+    const bool restored = HostDup2(original, 1) == 0 && HostClose(original) == 0;
+    Check(std::fclose(sink) == 0);
+    Check(restored);
+    Check(reopened == nullptr);
+    Check(error == ENOENT);
+    Check(written == 4);
+    Check(Contents(sinkName) == "host");
+
+    errno = 0;
+    Check(fputs_nid_postfix("text", __stdoutp_nid_postfix) == -1 && errno == EBADF);
+    Check(std::filesystem::remove(sinkName));
+    return 0;
+}
diff --git a/core/libs/tests/GuestFstatFault.cpp b/core/libs/tests/GuestFstatFault.cpp
index 06524f7df8..669cb3c903 100644
--- a/core/libs/tests/GuestFstatFault.cpp
+++ b/core/libs/tests/GuestFstatFault.cpp
@@ -1,23 +1,34 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 
 #include <chrono>
+#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <filesystem>
 #include <fstream>
+#include <stdexcept>
 #include <string>
 
-extern "C" {
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int* APS5_VABI __error_nid_postfix();
-}
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#endif
+#ifdef __linux__
+#include <errno.h>
+#include <linux/filter.h>
+#include <linux/seccomp.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#endif
 
 static void Check(bool value, int line) {
     if (!value) {
@@ -37,6 +48,72 @@ static void RequireFailure(int descriptor, int error) {
     Require(sceKernelFstat(descriptor, nullptr) == static_cast<int>(0x80020000u | static_cast<unsigned>(error)));
 }
 
+static void RequireBadPointerAt(int descriptor, const char* path, void* address) {
+    {
+        auto* bad = static_cast<FileStat*>(address);
+        *__error_nid_postfix() = 0;
+        Require(fstat_nid_disambig1_nid_postfix(descriptor, bad) == -1 && *__error_nid_postfix() == GuestEfault);
+        Require(sceKernelFstat(descriptor, bad) == static_cast<int>(0x80020000u | GuestEfault));
+        *__error_nid_postfix() = 0;
+        Require(stat_nid_postfix(path, bad) == -1 && *__error_nid_postfix() == GuestEfault);
+        *__error_nid_postfix() = 0;
+        Require(lstat_nid_postfix(path, bad) == -1 && *__error_nid_postfix() == GuestEfault);
+        Require(sceKernelStat(path, bad) == static_cast<int>(0x80020000u | GuestEfault));
+        *__error_nid_postfix() = 0;
+        Require(_fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(bad)) == -1 && *__error_nid_postfix() == GuestEfault);
+    }
+}
+
+static void RequireUnwritablePage(int descriptor, const char* path) {
+#ifdef _WIN32
+    void* page = VirtualAlloc(nullptr, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_READONLY);
+    Require(page != nullptr);
+    void* none = VirtualAlloc(nullptr, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_NOACCESS);
+    Require(none != nullptr);
+    RequireBadPointerAt(descriptor, path, page);
+    RequireBadPointerAt(descriptor, path, none);
+    VirtualFree(page, 0, MEM_RELEASE);
+    VirtualFree(none, 0, MEM_RELEASE);
+#else
+    void* page = mmap(nullptr, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    Require(page != MAP_FAILED);
+    void* none = mmap(nullptr, 4096, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    Require(none != MAP_FAILED);
+    RequireBadPointerAt(descriptor, path, page);
+    RequireBadPointerAt(descriptor, path, none);
+    munmap(page, 4096);
+    munmap(none, 4096);
+#endif
+}
+
+#ifdef __linux__
+static void RequireNonEfaultFailureThrows() {
+    const pid_t child = fork();
+    Require(child >= 0);
+    if (child == 0) {
+        sock_filter filter[] = {
+            BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
+            BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_process_vm_writev, 0, 1),
+            BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | EPERM),
+            BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
+        };
+        sock_fprog program{static_cast<unsigned short>(sizeof(filter) / sizeof(filter[0])), filter};
+        if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0 || prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &program) != 0) _exit(2);
+        char source[8] = {1, 2, 3, 4, 5, 6, 7, 8};
+        char destination[8] = {};
+        try {
+            GuestCopyOut_nid_no_patch(destination, source, sizeof(source));
+        } catch (const std::runtime_error&) {
+            _exit(destination[0] == 0 ? 0 : 3);
+        }
+        _exit(1);
+    }
+    int status = 0;
+    Require(waitpid(child, &status, 0) == child);
+    Require(WIFEXITED(status) && WEXITSTATUS(status) == 0);
+}
+#endif
+
 int main() {
     const auto root = std::filesystem::temp_directory_path() /
         ("anyps5-fstat-fault-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
@@ -53,6 +130,12 @@ int main() {
     FileStat status{};
     Require(fstat_nid_disambig1_nid_postfix(file, &status) == 0 && status.st_size == 5);
     RequireFailure(file, GuestEfault);
+    for (const std::uintptr_t address : {std::uintptr_t{1}, ~std::uintptr_t{0xfff}})
+        RequireBadPointerAt(file, "/anyps5-fstat-fault-test/file.txt", reinterpret_cast<void*>(address));
+    RequireUnwritablePage(file, "/anyps5-fstat-fault-test/file.txt");
+#ifdef __linux__
+    RequireNonEfaultFailureThrows();
+#endif
 
     int sockets[2];
     Require(socketpair_nid_postfix(1, 1, 0, sockets) == 0);
diff --git a/core/libs/tests/GuestFstatfs.cpp b/core/libs/tests/GuestFstatfs.cpp
index 1a647f6094..9950e6b9dc 100644
--- a/core/libs/tests/GuestFstatfs.cpp
+++ b/core/libs/tests/GuestFstatfs.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 
@@ -36,16 +39,6 @@ struct GuestStatfs {
 };
 static_assert(sizeof(GuestStatfs) == 472);
 
-extern "C" {
-int APS5_VABI _fstatfs_nid_postfix(int, GuestStatfs*);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int APS5_VABI kqueue_nid_postfix();
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "fstatfs check failed at line %d\n", line);
@@ -64,7 +57,7 @@ static void RequireFailure(int descriptor, int error) {
     GuestStatfs fs;
     std::memset(&fs, 0x5a, sizeof(fs));
     *__error_nid_postfix() = 0;
-    Require(_fstatfs_nid_postfix(descriptor, &fs) == -1);
+    Require(_fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(&fs)) == -1);
     Require(*__error_nid_postfix() == error);
     for (std::size_t i = 0; i < sizeof(fs); ++i) Require(reinterpret_cast<const unsigned char*>(&fs)[i] == 0x5a);
 }
@@ -72,7 +65,7 @@ static void RequireFailure(int descriptor, int error) {
 static void RequireVolume(int descriptor, const std::filesystem::path& path) {
     GuestStatfs fs;
     std::memset(&fs, 0x5a, sizeof(fs));
-    Require(_fstatfs_nid_postfix(descriptor, &fs) == 0);
+    Require(_fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(&fs)) == 0);
     const auto space = std::filesystem::space(path);
     Require(fs.f_version == StatfsVersion);
     Require(fs.f_bsize > 0 && fs.f_iosize > 0);
@@ -87,7 +80,7 @@ static void RequireVolume(int descriptor, const std::filesystem::path& path) {
 static void RequireDeviceFilesystem(int descriptor) {
     GuestStatfs fs;
     std::memset(&fs, 0x5a, sizeof(fs));
-    Require(_fstatfs_nid_postfix(descriptor, &fs) == 0);
+    Require(_fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(&fs)) == 0);
     GuestStatfs expected{};
     expected.f_version = StatfsVersion;
     expected.f_bsize = 512;
diff --git a/core/libs/tests/GuestFstatvfs.cpp b/core/libs/tests/GuestFstatvfs.cpp
index 487e8bacc7..9137793fbb 100644
--- a/core/libs/tests/GuestFstatvfs.cpp
+++ b/core/libs/tests/GuestFstatvfs.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <array>
@@ -11,16 +15,6 @@
 #include <fstream>
 #include <string>
 
-extern "C" {
-int APS5_VABI fstatvfs_nid_postfix(int, void*);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "fstatvfs check failed at line %d\n", line);
@@ -34,7 +28,7 @@ static void RequireFailure(int descriptor, int error) {
     output.fill(0x5A5A5A5A5A5A5A5Aull);
     const auto saved = output;
     *__error_nid_postfix() = 0;
-    Require(fstatvfs_nid_postfix(descriptor, output.data()) == -1);
+    Require(fstatvfs_nid_postfix(descriptor, reinterpret_cast<LibcStatvfs*>(output.data())) == -1);
     Require(*__error_nid_postfix() == error);
     Require(output == saved);
 }
@@ -43,7 +37,7 @@ static void RequireVolume(int descriptor, const std::filesystem::path& path) {
     std::array<std::uint64_t, 13> guarded;
     guarded.fill(0xA5A5A5A5A5A5A5A5ull);
     *__error_nid_postfix() = 12345;
-    Require(fstatvfs_nid_postfix(descriptor, guarded.data() + 1) == 0);
+    Require(fstatvfs_nid_postfix(descriptor, reinterpret_cast<LibcStatvfs*>(guarded.data() + 1)) == 0);
     Require(*__error_nid_postfix() == 12345);
     Require(guarded.front() == 0xA5A5A5A5A5A5A5A5ull && guarded.back() == guarded.front());
     const auto* fields = guarded.data() + 1;
diff --git a/core/libs/tests/GuestFstatvfsConversion.cpp b/core/libs/tests/GuestFstatvfsConversion.cpp
index f93e221e6b..d8533937ad 100644
--- a/core/libs/tests/GuestFstatvfsConversion.cpp
+++ b/core/libs/tests/GuestFstatvfsConversion.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/KernelStatfs.hpp"
 #include <array>
@@ -7,8 +8,6 @@
 #include <cstring>
 #include <limits>
 
-extern "C" int APS5_VABI fstatvfs_nid_postfix(int, void*);
-
 namespace {
 KernelStatfs backend;
 int backendError;
@@ -55,7 +54,7 @@ int main() {
         };
         const int before = calls;
         guestError = 12345;
-        Require(fstatvfs_nid_postfix(42, output.data() + 1) == 0);
+        Require(fstatvfs_nid_postfix(42, reinterpret_cast<LibcStatvfs*>(output.data() + 1)) == 0);
         Require(calls == before + 1 && guestError == 12345);
         Require(output.front() == 0xA5A5A5A5A5A5A5A5ull && output.back() == output.front());
         Require(std::memcmp(output.data() + 1, expected.data(), sizeof(expected)) == 0);
@@ -63,7 +62,7 @@ int main() {
     backend.f_bavail = -1;
     backend.f_ffree = -2;
     std::array<std::uint64_t, 11> output{};
-    Require(fstatvfs_nid_postfix(42, output.data()) == 0);
+    Require(fstatvfs_nid_postfix(42, reinterpret_cast<LibcStatvfs*>(output.data())) == 0);
     Require(output[0] == std::numeric_limits<std::uint64_t>::max());
     Require(output[3] == std::numeric_limits<std::uint64_t>::max() - 1 && output[4] == output[3]);
     Require(fstatvfs_nid_postfix(42, nullptr) == -1 && guestError == 14);
@@ -71,7 +70,7 @@ int main() {
         backendError = failure;
         output.fill(0x5A5A5A5A5A5A5A5Aull);
         const auto saved = output;
-        Require(fstatvfs_nid_postfix(42, output.data()) == -1 && guestError == failure);
+        Require(fstatvfs_nid_postfix(42, reinterpret_cast<LibcStatvfs*>(output.data())) == -1 && guestError == failure);
         Require(output == saved);
         Require(fstatvfs_nid_postfix(42, nullptr) == -1 && guestError == failure);
     }
diff --git a/core/libs/tests/GuestG2PDialog.cpp b/core/libs/tests/GuestG2PDialog.cpp
index a318e77f68..afb2800b64 100644
--- a/core/libs/tests/GuestG2PDialog.cpp
+++ b/core/libs/tests/GuestG2PDialog.cpp
@@ -1,21 +1,10 @@
+#include "prx/libSceCdlgG2P/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include "prx/libSceUserService/UserService.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceG2PDialogInitialize(void);
-int APS5_VABI sceG2PDialogOpen(const void* param);
-int APS5_VABI sceG2PDialogUpdateStatus(void);
-int APS5_VABI sceG2PDialogGetStatus(void);
-int APS5_VABI sceG2PDialogGetResult(void* result);
-int APS5_VABI sceG2PDialogClose(void);
-int APS5_VABI sceG2PDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -43,7 +32,7 @@ int main() {
     Require(sceG2PDialogTerminate() == kErrNotInitialized);
     Require(sceG2PDialogOpen(&param) == kErrNotInitialized);
     Require(sceG2PDialogClose() == kErrNotInitialized);
-    Require(sceG2PDialogGetResult(result) == kErrNotInitialized);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == kErrNotInitialized);
     Require(sceG2PDialogOpen(nullptr) == static_cast<int>(0x80B8000Du));
     Require(sceG2PDialogGetResult(nullptr) == static_cast<int>(0x80B8000Du));
     Require(sceG2PDialogGetStatus() == kStatusNone);
@@ -55,7 +44,7 @@ int main() {
     Require(sceG2PDialogUpdateStatus() == kStatusInitialized);
 
     Require(sceG2PDialogOpen(nullptr) == kErrArgNull);
-    Require(sceG2PDialogGetResult(result) == kErrNotFinished);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == kErrNotFinished);
 
     param.base.size = 0;
     Require(sceG2PDialogOpen(&param) == static_cast<int>(0x80B8000Au));
@@ -82,7 +71,7 @@ int main() {
     Require(sceG2PDialogUpdateStatus() == kStatusFinished);
 
     Require(sceG2PDialogGetResult(nullptr) == kErrArgNull);
-    Require(sceG2PDialogGetResult(result) == 0);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == 0);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == kResultUserCanceled);
     Require(result[1] == -1);
@@ -97,7 +86,7 @@ int main() {
     Require(sceG2PDialogClose() == static_cast<int>(0x80B8000Bu));
     Require(sceG2PDialogGetStatus() == kStatusInitialized);
     result[2] = -1;
-    Require(sceG2PDialogGetResult(result) == kErrNotFinished);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == kErrNotFinished);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == -1);
     Require(sceG2PDialogTerminate() == 0);
diff --git a/core/libs/tests/GuestGameCustomDataDialog.cpp b/core/libs/tests/GuestGameCustomDataDialog.cpp
index f410bc031b..5d5d686a9b 100644
--- a/core/libs/tests/GuestGameCustomDataDialog.cpp
+++ b/core/libs/tests/GuestGameCustomDataDialog.cpp
@@ -1,17 +1,8 @@
+#include "prx/libSceGameCustomDataDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceGameCustomDataDialogInitialize(void);
-int APS5_VABI sceGameCustomDataDialogOpenA(const void* param);
-int APS5_VABI sceGameCustomDataDialogUpdateStatus(void);
-int APS5_VABI sceGameCustomDataDialogGetStatus(void);
-int APS5_VABI sceGameCustomDataDialogGetResultA(void* result);
-int APS5_VABI sceGameCustomDataDialogClose(void);
-int APS5_VABI sceGameCustomDataDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestGameLiveStreaming.cpp b/core/libs/tests/GuestGameLiveStreaming.cpp
index 22950d430e..7d641c4e23 100644
--- a/core/libs/tests/GuestGameLiveStreaming.cpp
+++ b/core/libs/tests/GuestGameLiveStreaming.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGameLiveStreaming/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -7,27 +8,8 @@
 #include <stdexcept>
 #include <span>
 
-struct GameLiveStreamingStatus2 {
-    std::int32_t userId;
-    bool isOnAir;
-    std::uint8_t align[3];
-    std::uint32_t spectatorCounts;
-    std::uint32_t textMessageCounts;
-    std::uint32_t commandMessageCounts;
-    std::uint32_t broadcastVideoResolution;
-    std::uint8_t reserved[48];
-};
 static_assert(sizeof(GameLiveStreamingStatus2) == 72);
 
-extern "C" {
-int APS5_VABI sceGameLiveStreamingInitialize(std::size_t heap_size);
-int APS5_VABI sceGameLiveStreamingTerminate(void);
-int APS5_VABI sceGameLiveStreamingGetCurrentStatus2(GameLiveStreamingStatus2* status);
-struct GameLiveStreamingProgramInfo;
-int APS5_VABI sceGameLiveStreamingGetProgramInfo(GameLiveStreamingProgramInfo*);
-int APS5_VABI sceGameLiveStreamingEnableLiveStreaming(bool isEnableLiveStreaming);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -37,6 +19,7 @@ constexpr std::int32_t kInvalidUserId = -1;
 bool EnableThrowsNotInitialized(bool isEnableLiveStreaming) {
     try {
         sceGameLiveStreamingEnableLiveStreaming(isEnableLiveStreaming);
+
     } catch (const std::logic_error&) {
         return true;
     }
diff --git a/core/libs/tests/GuestGameUpdate.cpp b/core/libs/tests/GuestGameUpdate.cpp
index c46d451c83..34c5c5308b 100644
--- a/core/libs/tests/GuestGameUpdate.cpp
+++ b/core/libs/tests/GuestGameUpdate.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGameUpdate/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -6,16 +7,6 @@
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceGameUpdateInitialize(void);
-int APS5_VABI sceGameUpdateTerminate(void);
-int APS5_VABI sceGameUpdateGetAddcontLatestVersion(std::uint32_t, const NpUnifiedEntitlementLabel*, GameUpdateAddcontVersionInfo*);
-int APS5_VABI sceGameUpdateCreateRequest(void);
-int APS5_VABI sceGameUpdateCheck(int, const GameUpdateCheckParam*, GameUpdateCheckResult*);
-int APS5_VABI sceGameUpdateAbortRequest(int);
-int APS5_VABI sceGameUpdateDeleteRequest(int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TFunction>
@@ -67,6 +58,42 @@ static void TestRequestArguments(int notInitialized, int invalidArgument, int in
     Require(sceGameUpdateTerminate() == 0);
 }
 
+static void TestRequestLifecycle(int notFound) {
+    constexpr int tooManyRequests = static_cast<int>(0x80412806);
+    constexpr int aborted = static_cast<int>(0x80412807);
+    GameUpdateCheckParam param{};
+    param.size = sizeof(param);
+    GameUpdateCheckResult result{};
+    std::memset(&result, 0xAB, sizeof(result));
+    result.size = sizeof(result);
+    const auto original = result;
+
+    int ids[8];
+    for (int& id : ids) {
+        id = sceGameUpdateCreateRequest();
+        Require(id >= 0x20000000 && id <= 0x2FFFFFFF);
+    }
+    Require(ids[0] != ids[1]);
+    Require(sceGameUpdateCreateRequest() == tooManyRequests);
+
+    Require(sceGameUpdateCheck(ids[0], &param, &result) == 0);
+    Require(!result.found && !result.addcont_found);
+    Require(std::memcmp(&result, &original, 8) == 0);
+    Require(std::memcmp(reinterpret_cast<const char*>(&result) + 10, reinterpret_cast<const char*>(&original) + 10, sizeof(result) - 10) == 0);
+
+    Require(sceGameUpdateAbortRequest(ids[1]) == 0);
+    Require(sceGameUpdateCheck(ids[1], &param, &result) == aborted);
+
+    Require(sceGameUpdateDeleteRequest(ids[3]) == 0);
+    Require(sceGameUpdateDeleteRequest(ids[3]) == notFound);
+    Require(sceGameUpdateCheck(ids[3], &param, &result) == notFound);
+    Require(sceGameUpdateCreateRequest() >= 0x20000000);
+
+    Require(sceGameUpdateTerminate() == 0);
+    Require(sceGameUpdateInitialize() == 0);
+    Require(sceGameUpdateCheck(ids[0], &param, &result) == notFound);
+}
+
 int main() {
     constexpr int notInitialized = static_cast<int>(0x80412801);
     constexpr int invalidArgument = static_cast<int>(0x80412803);
@@ -100,7 +127,7 @@ int main() {
     const auto original = info;
     RequireThrows([&] { sceGameUpdateGetAddcontLatestVersion(0, &label, &info); });
     Require(std::memcmp(&info, &original, sizeof(info)) == 0);
-    RequireThrows([] { sceGameUpdateCreateRequest(); });
+    TestRequestLifecycle(notFound);
 
     Require(sceGameUpdateTerminate() == 0);
     Require(sceGameUpdateTerminate() == notInitialized);
diff --git a/core/libs/tests/GuestGenericCategory.cpp b/core/libs/tests/GuestGenericCategory.cpp
index b4f3f98687..36026d3f0b 100644
--- a/core/libs/tests/GuestGenericCategory.cpp
+++ b/core/libs/tests/GuestGenericCategory.cpp
@@ -1,6 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include <array>
+#include <bit>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -8,20 +10,13 @@
 #include <limits>
 #include <stdexcept>
 
-struct Category { void* const* vtable; };
-struct ErrorCode { int value; const Category* category; };
-using Message = GuestLocale::String* (APS5_VABI *)(GuestLocale::String*, const Category*, int);
-using Name = const char* (APS5_VABI *)(const Category*);
-using Condition = ErrorCode (APS5_VABI *)(const Category*, int);
-
-extern "C" {
-const char* APS5_VABI _ZSt13_Syserror_mapi_nid_postfix(int value);
-const Category* APS5_VABI _ZSt16generic_categoryv_nid_postfix();
-GuestLocale::String* APS5_VABI _ZNKSt23_Generic_error_category7messageEi_nid_postfix(
-    GuestLocale::String* result, const Category* self, int value);
-int* APS5_VABI __error_nid_postfix();
-void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
-}
+using Message = GuestLocale::String* (APS5_VABI *)(GuestLocale::String*, const LibcException::CategoryObject*, int);
+using Name = const char* (APS5_VABI *)(const LibcException::CategoryObject*);
+using Condition = LibcException::ErrorCode (APS5_VABI *)(const LibcException::CategoryObject*, int);
+using EquivalentCondition = bool (APS5_VABI *)(const LibcException::CategoryObject*, int, const LibcException::ErrorCode*);
+using EquivalentCode = bool (APS5_VABI *)(const LibcException::CategoryObject*, const LibcException::ErrorCode*, int);
+using Delete = void (APS5_VABI *)(const LibcException::CategoryObject*);
+struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
 
 static void Require(bool value, int line) {
     if (value) return;
@@ -30,7 +25,7 @@ static void Require(bool value, int line) {
 }
 #define REQUIRE(value) Require((value), __LINE__)
 
-static void CheckMessage(Message message, const Category* category, int value, const char* expected) {
+static void CheckMessage(Message message, const LibcException::CategoryObject* category, int value, const char* expected) {
     constexpr std::uint64_t marker = 0xA55AA55AA55AA55Aull;
     struct Guarded { std::uint64_t before; GuestLocale::String result; std::uint64_t after; };
     Guarded guarded {marker, {}, marker};
@@ -48,15 +43,48 @@ static void CheckMessage(Message message, const Category* category, int value, c
     if (length > 15) _ZdlPv_nid_postfix(guarded.result.pointer);
 }
 
+static void CheckSystemCategory(const LibcException::CategoryObject* generic) {
+    const LibcException::CategoryObject* system = _ZSt15system_categoryv_nid_postfix();
+    REQUIRE(system && system != generic && system == _ZSt15system_categoryv_nid_postfix());
+    const auto* type = static_cast<const TypeRecord*>(static_cast<const void* const*>(system->vtable)[-1]);
+    REQUIRE(std::strcmp(type->name, "St22_System_error_category") == 0);
+    REQUIRE(type->base && std::strcmp(type->base->name, "St14error_category") == 0);
+    REQUIRE(std::strcmp(std::bit_cast<Name>(static_cast<const void* const*>(system->vtable)[2])(system), "system") == 0);
+    const auto condition = std::bit_cast<Condition>(static_cast<const void* const*>(system->vtable)[4]);
+    const LibcException::ErrorCode known = condition(system, 2);
+    std::uint64_t head = 0;
+    std::memcpy(&head, &known, sizeof(head));
+    REQUIRE(head == std::uint64_t{2} << 32 && known.value == 2 && known.category == generic);
+    const LibcException::ErrorCode unknown = condition(system, 44);
+    REQUIRE(unknown.reserved == 0 && unknown.value == 44 && unknown.category == system);
+    const auto equivalentCondition = std::bit_cast<EquivalentCondition>(static_cast<const void* const*>(system->vtable)[5]);
+    REQUIRE(equivalentCondition(system, 2, &known));
+    const LibcException::ErrorCode sameCategory {0, 2, system};
+    REQUIRE(!equivalentCondition(system, 2, &sameCategory));
+    REQUIRE(equivalentCondition(system, 44, &unknown));
+    const auto equivalentCode = std::bit_cast<EquivalentCode>(static_cast<const void* const*>(system->vtable)[6]);
+    REQUIRE(equivalentCode(system, &sameCategory, 2) && !equivalentCode(system, &known, 2));
+    const auto message = std::bit_cast<Message>(static_cast<const void* const*>(system->vtable)[3]);
+    CheckMessage(message, system, 2, "no such file or directory");
+    CheckMessage(message, system, 44, "unknown error");
+    bool rejected = false;
+    try { std::bit_cast<Delete>(static_cast<const void* const*>(system->vtable)[1])(system); }
+    catch (const std::invalid_argument&) { rejected = true; }
+    REQUIRE(rejected);
+}
+
 int main() {
     const std::array<void*, 10> api {};
     ApplicationHeapRegister_nid_no_patch(api.data());
-    const Category* category = _ZSt16generic_categoryv_nid_postfix();
+    const LibcException::CategoryObject* category = _ZSt16generic_categoryv_nid_postfix();
     REQUIRE(category && category == _ZSt16generic_categoryv_nid_postfix());
-    REQUIRE(std::strcmp(reinterpret_cast<Name>(category->vtable[2])(category), "generic") == 0);
-    const auto message = reinterpret_cast<Message>(category->vtable[3]);
-    const auto condition = reinterpret_cast<Condition>(category->vtable[4])(category, 35);
-    REQUIRE(condition.value == 35 && condition.category == category);
+    REQUIRE(std::strcmp(std::bit_cast<Name>(static_cast<const void* const*>(category->vtable)[2])(category), "generic") == 0);
+    const auto message = std::bit_cast<Message>(static_cast<const void* const*>(category->vtable)[3]);
+    const auto condition = std::bit_cast<Condition>(static_cast<const void* const*>(category->vtable)[4])(category, 35);
+    REQUIRE(condition.reserved == 0 && condition.value == 35 && condition.category == category);
+    const auto equivalent = std::bit_cast<EquivalentCondition>(static_cast<const void* const*>(category->vtable)[5]);
+    REQUIRE(equivalent(category, 35, &condition));
+    CheckSystemCategory(category);
 
     struct Expected { int value; const char* text; };
     const Expected expected[] {
@@ -89,11 +117,13 @@ int main() {
     REQUIRE(message(&first, category, 25) == &first && message(&second, category, 11) == &second);
     REQUIRE(first.pointer != second.pointer);
     _ZdlPv_nid_postfix(second.pointer);
+
     REQUIRE(std::strcmp(first.pointer, "inappropriate io control operation") == 0);
     _ZdlPv_nid_postfix(first.pointer);
+
     bool rejected = false;
     try { message(nullptr, category, 22); }
     catch (const std::invalid_argument&) { rejected = true; }
     REQUIRE(rejected);
-    std::puts("guest generic category, FreeBSD error map and message ownership: PASS");
+    std::puts("guest generic and system categories, FreeBSD error map and message ownership: PASS");
 }
diff --git a/core/libs/tests/GuestGetitimer.cpp b/core/libs/tests/GuestGetitimer.cpp
index 1fa5f82516..ae97af4f05 100644
--- a/core/libs/tests/GuestGetitimer.cpp
+++ b/core/libs/tests/GuestGetitimer.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -10,19 +12,14 @@
 #include <limits>
 #include <thread>
 
-struct GuestItimerval {
-    KernelTimeval interval;
-    KernelTimeval value;
-};
-
 static_assert(sizeof(GuestItimerval) == 32 && offsetof(GuestItimerval, value) == 16);
 
 extern "C" {
-int APS5_VABI getitimer_nid_postfix(int, GuestItimerval*);
+
 unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int);
-int* APS5_VABI __error_nid_postfix();
+
 using Handler = void (APS5_VABI *)(int);
-Handler APS5_VABI signal_nid_postfix(int, Handler);
+
 }
 
 static void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestGetlogin.cpp b/core/libs/tests/GuestGetlogin.cpp
index b006a283fc..5071c786c9 100644
--- a/core/libs/tests/GuestGetlogin.cpp
+++ b/core/libs/tests/GuestGetlogin.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cerrno>
@@ -13,12 +16,10 @@
 #include <lmcons.h>
 #else
 #include <pwd.h>
+#include <sys/mman.h>
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI getlogin_r_nid_postfix(char*, int);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Check(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "getlogin_r check failed at line %d\n", line);
@@ -43,6 +44,27 @@ static std::string HostLogin() {
 #endif
 }
 
+static char* GuardedPageEnd() {
+#ifdef _WIN32
+    SYSTEM_INFO info{};
+    GetSystemInfo(&info);
+    const std::size_t pageSize = info.dwPageSize;
+    auto* memory = static_cast<char*>(VirtualAlloc(nullptr, pageSize * 2, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+    Require(memory != nullptr);
+    DWORD previous;
+    Require(VirtualProtect(memory + pageSize, pageSize, PAGE_NOACCESS, &previous) != 0);
+#else
+    const long nativePageSize = sysconf(_SC_PAGESIZE);
+    Require(nativePageSize > 0);
+    const std::size_t pageSize = static_cast<std::size_t>(nativePageSize);
+    void* allocation = mmap(nullptr, pageSize * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    Require(allocation != MAP_FAILED);
+    auto* memory = static_cast<char*>(allocation);
+    Require(mprotect(memory + pageSize, pageSize, PROT_NONE) == 0);
+#endif
+    return memory + pageSize;
+}
+
 static void RequireLogin(const std::string& expected) {
     std::vector<char> output(expected.size() + 3, '\x5A');
     *__error_nid_postfix() = 12345;
@@ -78,4 +100,30 @@ int main() {
         for (int i = 0; i != 20; ++i) RequireLogin(expected);
     });
     for (auto& reader : readers) reader.join();
+    *__error_nid_postfix() = 0;
+    Require(setlogin_nid_postfix(nullptr) == -1 && *__error_nid_postfix() == 14);
+    *__error_nid_postfix() = 0;
+    Require(setlogin_nid_postfix(reinterpret_cast<const char*>(0x10)) == -1 && *__error_nid_postfix() == 14);
+    RequireLogin(expected);
+    const std::string longest(32, 'n');
+    const std::string tooLong(33, 'n');
+    *__error_nid_postfix() = 0;
+    Require(setlogin_nid_postfix(tooLong.c_str()) == -1 && *__error_nid_postfix() == 22);
+    RequireLogin(expected);
+    char* const pageEnd = GuardedPageEnd();
+    std::memset(pageEnd - 33, 'p', 33);
+    *__error_nid_postfix() = 0;
+    Require(setlogin_nid_postfix(pageEnd - 33) == -1 && *__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setlogin_nid_postfix(pageEnd - 32) == -1 && *__error_nid_postfix() == 14);
+    RequireLogin(expected);
+    pageEnd[-1] = '\0';
+    Require(setlogin_nid_postfix(pageEnd - 33) == 0);
+    RequireLogin(std::string(32, 'p'));
+    Require(setlogin_nid_postfix("guest") == 0);
+    RequireLogin("guest");
+    Require(setlogin_nid_postfix(longest.c_str()) == 0);
+    RequireLogin(longest);
+    Require(setlogin_nid_postfix("") == 0);
+    RequireLogin("");
 }
diff --git a/core/libs/tests/GuestGetloginNoSession.cpp b/core/libs/tests/GuestGetloginNoSession.cpp
index c9f29f5513..fc31313d74 100644
--- a/core/libs/tests/GuestGetloginNoSession.cpp
+++ b/core/libs/tests/GuestGetloginNoSession.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cerrno>
@@ -8,8 +9,6 @@
 #include <string>
 #include <unistd.h>
 
-extern "C" int APS5_VABI getlogin_r_nid_postfix(char*, int);
-
 static int loginError = ENXIO;
 
 extern "C" int getlogin_r(char* output, std::size_t size) {
diff --git a/core/libs/tests/GuestGetopt.cpp b/core/libs/tests/GuestGetopt.cpp
index 26e0ca0803..13db14bc90 100644
--- a/core/libs/tests/GuestGetopt.cpp
+++ b/core/libs/tests/GuestGetopt.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
@@ -7,19 +9,8 @@
 #include <string>
 #include <vector>
 
-struct GuestOption {
-    const char* name;
-    int hasArgument;
-    int* flag;
-    int value;
-};
-
 extern "C" {
-int APS5_VABI getopt_nid_postfix(int, char* const*, const char*);
-int APS5_VABI getopt_long_nid_postfix(int, char* const*, const char*, const GuestOption*, int*);
-int APS5_VABI getopt_long_only_nid_postfix(int, char* const*, const char*, const GuestOption*, int*);
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI unsetenv_nid_postfix(const char*);
+
 extern int opterr_nid_postfix;
 extern int optind_nid_postfix;
 extern int optopt_nid_postfix;
diff --git a/core/libs/tests/GuestGetrlimit.cpp b/core/libs/tests/GuestGetrlimit.cpp
index 14b00ab71a..9f2a39f589 100644
--- a/core/libs/tests/GuestGetrlimit.cpp
+++ b/core/libs/tests/GuestGetrlimit.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <cstdint>
@@ -18,20 +20,6 @@
 #include <sys/sysctl.h>
 #endif
 
-struct ResourceLimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-
-extern "C" int APS5_VABI getrlimit_nid_postfix(int resource, ResourceLimit* limit);
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI getdtablesize_nid_postfix(void);
-extern "C" int APS5_VABI setrlimit_nid_postfix(int resource, const ResourceLimit* limit);
-extern "C" int APS5_VABI pipe_nid_postfix(int* descriptors);
-extern "C" int APS5_VABI close_nid_postfix(int descriptor);
-extern "C" void* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
-extern "C" int APS5_VABI fclose_nid_postfix(void* stream);
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_RLIMIT_CPU = 0;
@@ -54,15 +42,15 @@ static constexpr std::int64_t GUEST_RLIM_INFINITY = std::numeric_limits<std::int
 
 static void Require(bool value) { if (!value) std::abort(); }
 
-static ResourceLimit GuestLimit(int resource) {
-    ResourceLimit limit{-1, -1};
+static GuestResourceLimit GuestLimit(int resource) {
+    GuestResourceLimit limit{-1, -1};
     Require(getrlimit_nid_postfix(resource, &limit) == 0);
     Require(limit.rlim_cur >= 0 && limit.rlim_cur <= limit.rlim_max);
     return limit;
 }
 
 #if defined(_WIN32) || defined(__APPLE__)
-static void RequireDescriptorsEndAt(const ResourceLimit& limit) {
+static void RequireDescriptorsEndAt(const GuestResourceLimit& limit) {
     constexpr int GUEST_EMFILE = 24;
     std::vector<int> descriptors;
     int pair[2]{-1, -1};
@@ -82,19 +70,19 @@ static void RequireDescriptorsEndAt(const ResourceLimit& limit) {
 #ifdef _WIN32
 static void RequireStreamsOpen() {
     const auto path = (std::filesystem::temp_directory_path() / ("aps5-open-streams-" + std::to_string(GetCurrentProcessId()))).string();
-    std::vector<void*> streams;
+    std::vector<FileStream*> streams;
     for (int index = 0; index < 1024; ++index) {
-        void* stream = fopen_nid_postfix(path.c_str(), "ab");
+        FileStream* stream = fopen_nid_postfix(path.c_str(), "ab");
         Require(stream != nullptr);
         streams.push_back(stream);
     }
-    for (void* stream : streams) Require(fclose_nid_postfix(stream) == 0);
+    for (FileStream* stream : streams) Require(fclose_nid_postfix(stream) == 0);
     std::filesystem::remove(path);
 }
 #endif
 
 static void CheckOpenFileLimit() {
-    const ResourceLimit limit = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit limit = GuestLimit(GUEST_RLIMIT_NOFILE);
     Require(limit.rlim_cur == limit.rlim_max);
 #ifdef _WIN32
     Require(limit.rlim_cur == 8192);
@@ -114,20 +102,21 @@ static void CheckOpenFileLimit() {
     RequireDescriptorsEndAt(limit);
 #endif
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &limit) == 0);
-    const ResourceLimit lowered{limit.rlim_max > 1 ? limit.rlim_max - 1 : 1, limit.rlim_max};
+    const GuestResourceLimit lowered{limit.rlim_max > 1 ? limit.rlim_max - 1 : 1, limit.rlim_max};
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &lowered) == 0);
-    const ResourceLimit updated = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit updated = GuestLimit(GUEST_RLIMIT_NOFILE);
     Require(updated.rlim_cur == lowered.rlim_cur);
     Require(updated.rlim_max == lowered.rlim_max);
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &limit) == 0);
-    const ResourceLimit restored = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit restored = GuestLimit(GUEST_RLIMIT_NOFILE);
     Require(restored.rlim_cur == limit.rlim_cur);
     Require(restored.rlim_max == limit.rlim_max);
     if (limit.rlim_max != GUEST_RLIM_INFINITY) {
-        const ResourceLimit raised{limit.rlim_cur, limit.rlim_max + 1};
+        const GuestResourceLimit raised{limit.rlim_cur, limit.rlim_max + 1};
         bool raisedRejected = false;
         try {
             setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &raised);
+
         } catch (const std::runtime_error&) {
             raisedRejected = true;
         }
@@ -135,14 +124,14 @@ static void CheckOpenFileLimit() {
     }
 }
 
-static void RequireError(int resource, ResourceLimit* limit, int error) {
+static void RequireError(int resource, GuestResourceLimit* limit, int error) {
     *__error_nid_postfix() = 0;
     Require(getrlimit_nid_postfix(resource, limit) == -1);
     Require(*__error_nid_postfix() == error);
 }
 
 static void RequireInvalidOutputPointer(int resource) {
-    auto* const invalid = reinterpret_cast<ResourceLimit*>(static_cast<std::uintptr_t>(1));
+    auto* const invalid = reinterpret_cast<GuestResourceLimit*>(static_cast<std::uintptr_t>(1));
     RequireError(resource, invalid, GUEST_EFAULT);
 }
 
@@ -154,7 +143,7 @@ static std::int64_t Guest(rlim_t value) {
 static void RequireHostLimit(int resource, int hostResource) {
     rlimit host{};
     Require(getrlimit(hostResource, &host) == 0);
-    const ResourceLimit guest = GuestLimit(resource);
+    const GuestResourceLimit guest = GuestLimit(resource);
     Require(guest.rlim_cur == Guest(host.rlim_cur));
     Require(guest.rlim_max == Guest(host.rlim_max));
 }
@@ -190,12 +179,12 @@ int main() {
              GUEST_RLIMIT_KQUEUES,
              GUEST_RLIMIT_UMTXP,
          }) {
-        const ResourceLimit guest = GuestLimit(resource);
+        const GuestResourceLimit guest = GuestLimit(resource);
         Require(guest.rlim_cur == GUEST_RLIM_INFINITY);
         Require(guest.rlim_max == GUEST_RLIM_INFINITY);
         RequireError(resource, nullptr, GUEST_EFAULT);
     }
-    ResourceLimit limit{};
+    GuestResourceLimit limit{};
     RequireError(GUEST_RLIM_NLIMITS, &limit, GUEST_EINVAL);
     RequireError(-1, &limit, GUEST_EINVAL);
     RequireError(GUEST_RLIM_NLIMITS, nullptr, GUEST_EINVAL);
@@ -203,13 +192,13 @@ int main() {
     RequireError(GUEST_RLIMIT_DATA, nullptr, GUEST_EFAULT);
     RequireInvalidOutputPointer(GUEST_RLIMIT_DATA);
     RequireInvalidOutputPointer(GUEST_RLIMIT_NOFILE);
-    const ResourceLimit stack = GuestLimit(GUEST_RLIMIT_STACK);
+    const GuestResourceLimit stack = GuestLimit(GUEST_RLIMIT_STACK);
     Require(stack.rlim_cur == 0x200000 && stack.rlim_max == 0x200000);
     RequireError(GUEST_RLIMIT_STACK, nullptr, GUEST_EFAULT);
-    const ResourceLimit processes = GuestLimit(GUEST_RLIMIT_NPROC);
+    const GuestResourceLimit processes = GuestLimit(GUEST_RLIMIT_NPROC);
     Require(processes.rlim_cur == 1604 && processes.rlim_max == 1604);
     RequireError(GUEST_RLIMIT_NPROC, nullptr, GUEST_EFAULT);
-    const ResourceLimit nofile = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit nofile = GuestLimit(GUEST_RLIMIT_NOFILE);
     const int tableSize = getdtablesize_nid_postfix();
     std::int64_t expectedTableSize = nofile.rlim_cur;
 #ifndef _WIN32
diff --git a/core/libs/tests/GuestGetrusage.cpp b/core/libs/tests/GuestGetrusage.cpp
index 7fefbdca94..5c37bcc0b6 100644
--- a/core/libs/tests/GuestGetrusage.cpp
+++ b/core/libs/tests/GuestGetrusage.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -8,16 +10,10 @@ struct Timeval {
     std::int64_t tv_sec;
     std::int64_t tv_usec;
 };
-struct ResourceUsage {
-    Timeval ru_utime;
-    Timeval ru_stime;
-    std::int64_t rest[14];
-};
-extern "C" int APS5_VABI getrusage_nid_postfix(int who, ResourceUsage* usage);
-extern "C" int* APS5_VABI __error_nid_postfix();
+
 static void Require(bool value) { if (!value) std::abort(); }
 static std::int64_t CpuMicros(int who) {
-    ResourceUsage usage{};
+    GuestResourceUsage usage{};
     Require(getrusage_nid_postfix(who, &usage) == 0);
     return (usage.ru_utime.tv_sec + usage.ru_stime.tv_sec) * 1000000 + usage.ru_utime.tv_usec + usage.ru_stime.tv_usec;
 }
@@ -29,15 +25,15 @@ static void SpinUntil(int who, std::int64_t micros) {
         Require(std::chrono::steady_clock::now() < deadline);
     }
 }
-static void RequireFailure(int who, ResourceUsage* usage, int error) {
+static void RequireFailure(int who, GuestResourceUsage* usage, int error) {
     *__error_nid_postfix() = 0;
     Require(getrusage_nid_postfix(who, usage) == -1);
     Require(*__error_nid_postfix() == error);
 }
 int main() {
-    ResourceUsage untouched;
+    GuestResourceUsage untouched;
     std::memset(&untouched, 0x5a, sizeof(untouched));
-    const ResourceUsage pattern = untouched;
+    const GuestResourceUsage pattern = untouched;
     RequireFailure(2, &untouched, 22);
     RequireFailure(-2, &untouched, 22);
     Require(std::memcmp(&untouched, &pattern, sizeof(untouched)) == 0);
@@ -45,10 +41,15 @@ int main() {
     RequireFailure(0, nullptr, 14);
     RequireFailure(1, nullptr, 14);
     RequireFailure(-1, nullptr, 14);
-    ResourceUsage children;
+    auto* const invalid = reinterpret_cast<GuestResourceUsage*>(static_cast<std::uintptr_t>(1));
+    RequireFailure(2, invalid, 22);
+    RequireFailure(0, invalid, 14);
+    RequireFailure(1, invalid, 14);
+    RequireFailure(-1, invalid, 14);
+    GuestResourceUsage children;
     std::memset(&children, 0xff, sizeof(children));
     Require(getrusage_nid_postfix(-1, &children) == 0);
-    const ResourceUsage empty{};
+    const GuestResourceUsage empty{};
     Require(std::memcmp(&children, &empty, sizeof(children)) == 0);
     SpinUntil(0, 400000);
     const std::int64_t mainThread = CpuMicros(1);
diff --git a/core/libs/tests/GuestGets.cpp b/core/libs/tests/GuestGets.cpp
new file mode 100644
index 0000000000..4862729c19
--- /dev/null
+++ b/core/libs/tests/GuestGets.cpp
@@ -0,0 +1,156 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <atomic>
+#include <cerrno>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <thread>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
+
+extern "C" {
+extern FileStream* __stdinp_nid_postfix;
+
+}
+
+namespace {
+
+using Gets = char* (APS5_VABI*)(char*);
+Gets readLine;
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "gets: %s\n", message);
+    std::abort();
+}
+
+class Input {
+    FileStream* previous = __stdinp_nid_postfix;
+    FileStream stream;
+
+public:
+    explicit Input(std::FILE* handle) : stream(handle) { __stdinp_nid_postfix = &stream; }
+    Input(const void* bytes, std::size_t size) : stream(std::tmpfile()) {
+        Require(std::fwrite(bytes, 1, size, stream.GetHandle()) == size, "seed input");
+        std::rewind(stream.GetHandle());
+        __stdinp_nid_postfix = &stream;
+    }
+    ~Input() {
+        __stdinp_nid_postfix = previous;
+        if (stream.IsOpen()) stream.Close();
+    }
+    FileStream& Stream() { return stream; }
+};
+
+void CheckBytes() {
+    std::array<unsigned char, 257> bytes;
+    std::size_t size = 0;
+    for (unsigned value = 0; value < 256; ++value)
+        if (value != '\n') bytes[size++] = static_cast<unsigned char>(value);
+    bytes[size++] = '\n';
+    Input input(bytes.data(), size);
+    std::array<unsigned char, 264> output;
+    output.fill(0xa5);
+    *__error_nid_postfix() = 123;
+    Require(readLine(reinterpret_cast<char*>(output.data() + 4)) == reinterpret_cast<char*>(output.data() + 4), "byte read pointer");
+    const int error = *__error_nid_postfix();
+    Require(std::memcmp(output.data() + 4, bytes.data(), 255) == 0 && output[259] == 0, "all byte values and terminator");
+    Require(error == 123, "successful read preserves errno");
+    for (std::size_t index = 0; index < 4; ++index) Require(output[index] == 0xa5, "prefix guard");
+    for (std::size_t index = 260; index < output.size(); ++index) Require(output[index] == 0xa5, "suffix guard");
+    output.fill(0xa5);
+    Require(readLine(reinterpret_cast<char*>(output.data() + 4)) == nullptr, "EOF return");
+    for (const auto value : output) Require(value == 0xa5, "initial EOF leaves buffer unchanged");
+    Require((input.Stream().GuestState().flags & 0x20) != 0, "guest EOF flag");
+}
+
+void CheckLines() {
+    const char text[] = "\nfirst\r\nlast";
+    Input input(text, sizeof(text) - 1);
+    char output[16];
+    Require(readLine(output) == output && output[0] == 0, "empty line");
+    Require(readLine(output) == output && std::strcmp(output, "first\r") == 0, "newline removed without dropping carriage return");
+    Require(readLine(output) == output && std::strcmp(output, "last") == 0, "partial last line at EOF");
+    output[0] = 'x';
+    Require(readLine(output) == nullptr && output[0] == 'x', "repeated EOF preserves destination");
+}
+
+void CheckErrors() {
+    Input input("", 0);
+    input.Stream().Close();
+    char output[8] = "keep";
+    Require(readLine(output) == nullptr && std::strcmp(output, "keep") == 0 && *__error_nid_postfix() == 9, "closed input");
+    bool threw = false;
+    try { readLine(nullptr); } catch (const std::invalid_argument&) { threw = true; }
+    Require(threw, "null buffer is explicit unsupported input");
+}
+
+void CheckReadError(const char* path) {
+    {
+        Input input(std::fopen(path, "wb"));
+        std::array<char, 8> output;
+        output.fill('x');
+        Require(readLine(output.data()) == nullptr, "write-only input read error");
+        for (const auto value : output) Require(value == 'x', "initial read error leaves destination unchanged");
+        Require((input.Stream().GuestState().flags & 0x40) != 0, "guest error flag");
+    }
+    Require(std::remove(path) == 0, "remove error fixture");
+}
+
+void CheckThreads() {
+    constexpr unsigned lines = 2048;
+    std::array<char, lines * 9> text;
+    for (unsigned index = 0; index < lines; ++index)
+        std::snprintf(text.data() + index * 8, 9, "%07u\n", index);
+    Input input(text.data(), lines * 8);
+    std::array<std::atomic<unsigned>, lines> seen{};
+    std::atomic<bool> invalid{false};
+    std::vector<std::thread> workers;
+    for (unsigned thread = 0; thread < 8; ++thread) workers.emplace_back([&] {
+        char output[lines * 8 + 1];
+        while (readLine(output)) {
+            if (std::strlen(output) != 7) { invalid = true; continue; }
+            unsigned index = 0;
+            bool digits = true;
+            for (unsigned digit = 0; digit < 7; ++digit) {
+                if (output[digit] < '0' || output[digit] > '9') { digits = false; break; }
+                index = index * 10 + static_cast<unsigned>(output[digit] - '0');
+            }
+            if (!digits || index >= lines) invalid = true;
+            else ++seen[index];
+        }
+    });
+    for (auto& worker : workers) worker.join();
+    Require(!invalid, "concurrent line contents");
+    for (auto& count : seen) Require(count == 1, "each line read exactly once");
+}
+
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 3, "expected libc path and scratch file");
+#ifdef _WIN32
+    const auto library = LoadLibraryA(argv[1]);
+    Require(library != nullptr, "load libc");
+    readLine = reinterpret_cast<Gets>(GetProcAddress(library, "gets_nid_postfix"));
+#else
+    const auto library = dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
+    Require(library != nullptr, "load libc");
+    readLine = reinterpret_cast<Gets>(dlsym(library, "gets_nid_postfix"));
+#endif
+    Require(readLine != nullptr, "missing gets export");
+    CheckBytes();
+    CheckLines();
+    CheckErrors();
+    CheckReadError(argv[2]);
+    CheckThreads();
+    std::puts("gets checks passed");
+}
diff --git a/core/libs/tests/GuestGnmNeoDefaultState.cpp b/core/libs/tests/GuestGnmNeoDefaultState.cpp
index 7288e795c4..c4731f75ea 100644
--- a/core/libs/tests/GuestGnmNeoDefaultState.cpp
+++ b/core/libs/tests/GuestGnmNeoDefaultState.cpp
@@ -1,16 +1,9 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceGnmDrawInitDefaultHardwareState(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceGnmDrawInitDefaultHardwareState200(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceGnmDrawInitDefaultHardwareState350(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceGnmDrawInitToDefaultContextState(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceGnmDrawInitToDefaultContextState400(std::uint32_t*, std::uint32_t);
-}
-
 namespace {
 
 using StateWriter = int (APS5_VABI *)(std::uint32_t*, std::uint32_t);
diff --git a/core/libs/tests/GuestGnmNeoEmbedded.cpp b/core/libs/tests/GuestGnmNeoEmbedded.cpp
new file mode 100644
index 0000000000..fb8f7caa80
--- /dev/null
+++ b/core/libs/tests/GuestGnmNeoEmbedded.cpp
@@ -0,0 +1,73 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <initializer_list>
+
+namespace {
+
+constexpr int Failure = static_cast<int>(0x8EEE00FFu);
+constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
+constexpr std::uint32_t BufferWords = 48;
+
+std::uint32_t g_words[BufferWords];
+
+void Require(bool value) { if (!value) std::abort(); }
+
+std::uint32_t* Fresh() {
+    for (auto& word : g_words) word = Untouched;
+    return g_words;
+}
+
+void RequireAt(std::uint32_t at, std::initializer_list<std::uint32_t> expected) {
+    for (const auto word : expected) Require(g_words[at++] == word);
+}
+
+void RequireUntouchedFrom(std::uint32_t at) {
+    for (; at < BufferWords; ++at) Require(g_words[at] == Untouched);
+}
+
+const std::uint32_t* ShaderCode() {
+    const auto address = (static_cast<std::uintptr_t>(g_words[3]) << 40) | (static_cast<std::uintptr_t>(g_words[2]) << 8);
+    return reinterpret_cast<const std::uint32_t*>(address);
+}
+
+void CheckVs() {
+    Require(sceGnmSetEmbeddedVsShader(Fresh(), 0x1d, 0, 0) == 0);
+    RequireAt(0, {0xc0027600u, 0x48});
+    RequireAt(4, {0xc0027600u, 0x4a, 0xc0000, 4, 0xc0016900u, 0x207, 0, 0xc0016900u, 0x1b1, 0, 0xc0016900u, 0x1c3, 4,
+        0xc00a1000u, 0});
+    RequireUntouchedFrom(19);
+    const auto* code = ShaderCode();
+    Require(code[0] == 0xbeeb0387u && code[10] == 0xf80008cfu && code[11] == 0x03020001u && code[14] == 0xbf810000u);
+
+    Require(sceGnmSetEmbeddedVsShader(Fresh(), 0x1d, 1, 0) == Failure);
+    RequireUntouchedFrom(0);
+}
+
+void CheckPs() {
+    Require(sceGnmSetEmbeddedPsShader(Fresh(), 0x28, 0, 0) == 0);
+    RequireAt(0, {0xc0027600u, 8});
+    RequireAt(4, {0xc0027600u, 10, 0xc0000, 4, 0xc0026900u, 0x1c4, 0, 4, 0xc0026900u, 0x1b3, 2, 2, 0xc0016900u, 0x1b6, 0,
+        0xc0016900u, 0x1b8, 0, 0xc0016900u, 0x203, 0x10, 0xc0016900u, 0x8f, 0xf, 0xc00a1000u, 0});
+    RequireUntouchedFrom(30);
+    const auto* black = ShaderCode();
+    Require(black[0] == 0xbeeb0383u && black[2] == 0x5e000100u && black[4] == 0xf8001c0fu && black[6] == 0xbf810000u);
+
+    Require(sceGnmSetEmbeddedPsShader(Fresh(), 0x28, 1, 0) == 0);
+    RequireAt(4, {0xc0027600u, 10, 0x2000, 0, 0xc0026900u, 0x1c4, 0, 2, 0xc0026900u, 0x1b3, 2, 2, 0xc0016900u, 0x1b6, 0,
+        0xc0016900u, 0x1b8, 0, 0xc0016900u, 0x203, 0x10, 0xc0016900u, 0x8f, 3, 0xc00a1000u, 0});
+    RequireUntouchedFrom(30);
+    const auto* depthOnly = ShaderCode();
+    Require(depthOnly != black && depthOnly[1] == 0x7e040280u && depthOnly[2] == 0xf8001803u && depthOnly[4] == 0xbf810000u);
+
+    Require(sceGnmSetEmbeddedPsShader(Fresh(), 0x28, 2, 0) == Failure);
+    RequireUntouchedFrom(0);
+}
+
+} // namespace
+
+int main() {
+    CheckVs();
+    CheckPs();
+}
diff --git a/core/libs/tests/GuestGnmNeoPackets.cpp b/core/libs/tests/GuestGnmNeoPackets.cpp
index 984bc33dad..b31a5d0897 100644
--- a/core/libs/tests/GuestGnmNeoPackets.cpp
+++ b/core/libs/tests/GuestGnmNeoPackets.cpp
@@ -1,28 +1,9 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceGnmInsertDingDongMarker(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceGnmDrawIndexAuto(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndex(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndexOffset(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDispatchDirect(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDispatchIndirect(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDispatchIndirectOnMec(std::uint32_t*, std::uint32_t, std::uint64_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndirect(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndexIndirect(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndirectMulti(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndexIndirectMulti(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndirectCountMulti(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmDrawIndexIndirectCountMulti(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmComputeWaitSemaphore(std::uint32_t*, std::uint32_t, std::uint64_t, std::uint32_t);
-int APS5_VABI sceGnmComputeWaitOnAddress(std::uint32_t*, std::uint32_t, std::uint64_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmSetVgtControl(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceGnmResetVgtControl(std::uint32_t*, std::uint32_t);
-}
-
 namespace {
 
 constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
diff --git a/core/libs/tests/GuestGnmNeoRetail.cpp b/core/libs/tests/GuestGnmNeoRetail.cpp
index 29148976fa..3101ebb9b0 100644
--- a/core/libs/tests/GuestGnmNeoRetail.cpp
+++ b/core/libs/tests/GuestGnmNeoRetail.cpp
@@ -1,58 +1,8 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceGnmDebugModuleReset(void);
-int APS5_VABI sceGnmDebugReset(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterface(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForGpuDebugger(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForReplay(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForResourceRegistration(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForValidation(void);
-int APS5_VABI sceGnmDriverTraceInProgress(void);
-int APS5_VABI sceGnmFindResources(void);
-int APS5_VABI sceGnmFindResourcesPublic(void);
-int APS5_VABI sceGnmGetDbgGcHandle(void);
-int APS5_VABI sceGnmGetOwnerName(void);
-int APS5_VABI sceGnmGetPhysicalCounterFromVirtualized(void);
-int APS5_VABI sceGnmGetResourceBaseAddressAndSizeInBytes(void);
-int APS5_VABI sceGnmGetResourceName(void);
-int APS5_VABI sceGnmGetResourceRegistrationBuffers(void);
-int APS5_VABI sceGnmGetResourceShaderGuid(void);
-int APS5_VABI sceGnmGetResourceType(void);
-int APS5_VABI sceGnmGetResourceUserData(void);
-int APS5_VABI sceGnmQueryResourceRegistrationUserMemoryRequirements(void);
-int APS5_VABI sceGnmRegisterGdsResource(void);
-int APS5_VABI sceGnmRegisterOwner(void);
-int APS5_VABI sceGnmRegisterOwnerForSystem(void);
-int APS5_VABI sceGnmRegisterResource(void);
-int APS5_VABI sceGnmSdmaClose(void);
-int APS5_VABI sceGnmSdmaConstFill(void);
-int APS5_VABI sceGnmSdmaCopyLinear(void);
-int APS5_VABI sceGnmSdmaCopyTiled(void);
-int APS5_VABI sceGnmSdmaCopyWindow(void);
-int APS5_VABI sceGnmSdmaFlush(void);
-int APS5_VABI sceGnmSdmaGetMinCmdSize(void);
-int APS5_VABI sceGnmSdmaOpen(void);
-int APS5_VABI sceGnmSetResourceRegistrationUserMemory(void);
-int APS5_VABI sceGnmSetResourceUserData(void);
-int APS5_VABI sceGnmSetSpiEnableSqCounters(void);
-int APS5_VABI sceGnmSetSpiEnableSqCountersForUnitInstance(void);
-int APS5_VABI sceGnmUnregisterAllResourcesForOwner(void);
-int APS5_VABI sceGnmUnregisterOwnerAndResources(void);
-int APS5_VABI sceGnmUnregisterResource(void);
-int APS5_VABI sceGnmValidateDisableDiagnostics(void);
-int APS5_VABI sceGnmValidateDisableDiagnostics2(void);
-int APS5_VABI sceGnmValidateDispatchCommandBuffers(void);
-int APS5_VABI sceGnmValidateDrawCommandBuffers(void);
-int APS5_VABI sceGnmValidateGetDiagnosticInfo(void);
-int APS5_VABI sceGnmValidateGetDiagnostics(void);
-int APS5_VABI sceGnmValidateOnSubmitEnabled(void);
-int APS5_VABI sceGnmValidateResetState(void);
-int APS5_VABI sceGnmValidationRegisterMemoryCheckCallback(void);
-}
-
 namespace {
 
 constexpr int Failure = static_cast<int>(0x8EEE00FFu);
diff --git a/core/libs/tests/GuestGnmNeoShaders.cpp b/core/libs/tests/GuestGnmNeoShaders.cpp
new file mode 100644
index 0000000000..75760c5b1e
--- /dev/null
+++ b/core/libs/tests/GuestGnmNeoShaders.cpp
@@ -0,0 +1,128 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <initializer_list>
+
+namespace {
+
+constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
+constexpr std::size_t BufferWords = 48;
+constexpr std::uint32_t Regs[12] = {0x1000, 0, 0x2000, 0x3000, 0x4000, 0x5000, 0x6000, 0x7000, 0x8000, 0x9000, 0xa000, 0xb000};
+constexpr std::uint32_t BadRegs[12] = {0x1000, 1};
+constexpr std::uint32_t MaskedRegs[12] = {0x1000, 0, 0x030003c0u, 0x3000, 0x4000, 0x5000, 0x6000};
+
+std::uint32_t g_words[BufferWords];
+
+void Require(bool value) { if (!value) std::abort(); }
+
+std::uint32_t* Fresh() {
+    for (auto& word : g_words) word = Untouched;
+    return g_words;
+}
+
+void RequireWords(std::initializer_list<std::uint32_t> expected) {
+    std::size_t at = 0;
+    for (const auto word : expected) Require(g_words[at++] == word);
+    for (; at < BufferWords; ++at) Require(g_words[at] == Untouched);
+}
+
+void RequireRefused(int result) {
+    Require(result == -1);
+    RequireWords({});
+}
+
+void CheckVs() {
+    Require(sceGnmUpdateVsShader(Fresh(), 0x1d, Regs, 0) == 0);
+    RequireWords({0xc0027600u, 0x48, 0x1000, 0, 0xc0027600u, 0x4a, 0x2000, 0x3000, 0xc0011000u, 0xc01e0207u, 0x6000,
+        0xc0011000u, 0xc01e01b1u, 0x4000, 0xc0011000u, 0xc01e01c3u, 0x5000, 0xc00a1000u, 0});
+    Require(sceGnmUpdateVsShader(Fresh(), 0x1d, MaskedRegs, 0x40) == 0);
+    Require(g_words[6] == 0x40);
+    Require(sceGnmUpdateVsShader(Fresh(), 0x1d, MaskedRegs, 0) == 0);
+    Require(g_words[6] == 0x030003c0u);
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1d, Regs, 0x80000000u));
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1c, Regs, 0));
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1d, BadRegs, 0));
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1d, nullptr, 0));
+}
+
+void CheckPs() {
+    Require(sceGnmUpdatePsShader(Fresh(), 0x28, Regs) == 0);
+    RequireWords({0xc0027600u, 8, 0x1000, 0, 0xc0027600u, 10, 0x2000, 0x3000, 0xc0021000u, 0xc01e01c4u, 0x4000, 0x5000,
+        0xc0021000u, 0xc01e01b3u, 0x6000, 0x7000, 0xc0011000u, 0xc01e01b6u, 0x8000, 0xc0011000u, 0xc01e01b8u, 0x9000,
+        0xc0011000u, 0xc01e0203u, 0xa000, 0xc0011000u, 0xc01e008fu, 0xb000, 0xc00a1000u, 0});
+    Require(sceGnmUpdatePsShader(Fresh(), 0x28, nullptr) == 0);
+    RequireWords({0xc0027600u, 8, 0, 0, 0xc0011000u, 0xc01e0203u, 0, 0xc01f1000u, 0});
+    RequireRefused(sceGnmUpdatePsShader(Fresh(), 0x27, Regs));
+    RequireRefused(sceGnmUpdatePsShader(Fresh(), 0x28, BadRegs));
+
+    Require(sceGnmUpdatePsShader350(Fresh(), 0x28, Regs) == 0);
+    Require(g_words[26] == 0xc01e008fu && g_words[28] == 0xc00a1000u);
+    Require(sceGnmUpdatePsShader350(Fresh(), 0x28, nullptr) == 0);
+    RequireWords({0xc0027600u, 8, 0, 0, 0xc0011000u, 0xc01e0203u, 0, 0xc0016900u, 0x8f, 0xf, 0xc01c1000u, 0});
+    RequireRefused(sceGnmUpdatePsShader350(Fresh(), 0x27, nullptr));
+    RequireRefused(sceGnmUpdatePsShader350(Fresh(), 0x28, BadRegs));
+
+    Require(sceGnmSetPsShader350(Fresh(), 0x28, Regs) == 0);
+    RequireWords({0xc0027600u, 8, 0x1000, 0, 0xc0027600u, 10, 0x2000, 0x3000, 0xc0026900u, 0x1c4, 0x4000, 0x5000,
+        0xc0026900u, 0x1b3, 0x6000, 0x7000, 0xc0016900u, 0x1b6, 0x8000, 0xc0016900u, 0x1b8, 0x9000,
+        0xc0016900u, 0x203, 0xa000, 0xc0016900u, 0x8f, 0xb000, 0xc00a1000u, 0});
+    Require(sceGnmSetPsShader350(Fresh(), 0x28, nullptr) == 0);
+    RequireWords({0xc0027600u, 8, 0, 0, 0xc0016900u, 0x203, 0, 0xc0016900u, 0x8f, 0xf, 0xc01c1000u, 0});
+    RequireRefused(sceGnmSetPsShader350(Fresh(), 0x27, Regs));
+    RequireRefused(sceGnmSetPsShader350(Fresh(), 0x28, BadRegs));
+}
+
+void CheckGsHsCs() {
+    Require(sceGnmUpdateGsShader(Fresh(), 0x1d, Regs) == 0);
+    RequireWords({0xc0027600u, 0x88, 0x1000, 0, 0xc0027600u, 0x8a, 0x2000, 0x3000, 0xc0011000u, 0xc01e02e5u, 0x4000,
+        0xc0011000u, 0xc01e029bu, 0x5000, 0xc0011000u, 0xc01e02e4u, 0x6000, 0xc00a1000u, 0});
+    RequireRefused(sceGnmUpdateGsShader(Fresh(), 0x1c, Regs));
+    RequireRefused(sceGnmUpdateGsShader(Fresh(), 0x1d, nullptr));
+    RequireRefused(sceGnmUpdateGsShader(Fresh(), 0x1d, BadRegs));
+
+    Require(sceGnmUpdateHsShader(Fresh(), 0x1d, Regs, 0x77) == 0);
+    RequireWords({0xc0027600u, 0x108, 0x1000, 0, 0xc0027600u, 0x10a, 0x2000, 0x3000, 0xc0021000u, 0xc01e0286u, 0x5000, 0x6000,
+        0xc0011000u, 0xc01e02dbu, 0x4000, 0xc0011000u, 0xc01e02d6u, 0x77, 0xc00a1000u, 0});
+    RequireRefused(sceGnmUpdateHsShader(Fresh(), 0x1c, Regs, 0));
+    RequireRefused(sceGnmUpdateHsShader(Fresh(), 0x1d, BadRegs, 0));
+
+    Require(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, Regs, 0x3c0) == 0);
+    RequireWords({0xc0027600u, 0x20c, 0x1000, 0, 0xc0027600u, 0x212, 0x23c0, 0x3000, 0xc0037600u, 0x207, 0x4000, 0x5000, 0x6000,
+        0xc00a1000u, 0});
+    Require(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, MaskedRegs, 0x40) == 0);
+    Require(g_words[6] == 0x03000040u);
+    Require(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, MaskedRegs, 0) == 0);
+    Require(g_words[6] == 0x030003c0u);
+    RequireRefused(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, Regs, 0x400));
+    RequireRefused(sceGnmSetCsShaderWithModifier(Fresh(), 0x18, Regs, 0));
+    RequireRefused(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, BadRegs, 0));
+}
+
+void CheckWorkloads() {
+    std::uint32_t stream = Untouched;
+    Require(sceGnmCreateWorkloadStream(0, &stream) == 3 && stream == Untouched);
+    Require(sceGnmCreateWorkloadStream(5, nullptr) == 3);
+    Require(sceGnmCreateWorkloadStream(5, &stream) == 0 && stream == 1);
+
+    std::uint64_t workload = Untouched;
+    Require(sceGnmBeginWorkload(3, &workload) == 0 && workload == 1);
+    Require(sceGnmBeginWorkload(0x10, &workload) == 1 && workload == 0);
+    Require(sceGnmBeginWorkload(0, nullptr) == 3);
+
+    Require(sceGnmEndWorkload(0) == 2);
+    Require(sceGnmEndWorkload(1) == 0);
+    Require(sceGnmEndWorkload(0x0full << 56) == 0);
+    Require(sceGnmEndWorkload(0x10ull << 56) == 2);
+}
+
+} // namespace
+
+int main() {
+    CheckVs();
+    CheckPs();
+    CheckGsHsCs();
+    CheckWorkloads();
+    Require(sceGnmGetGpuCoreClockFrequency() == 911000000);
+    Require(sceGnmGetOffChipTessellationBufferSize() == 0x800000);
+}
diff --git a/core/libs/tests/GuestHeapReportForGame.cpp b/core/libs/tests/GuestHeapReportForGame.cpp
index de3ce98250..ccc355a05d 100644
--- a/core/libs/tests/GuestHeapReportForGame.cpp
+++ b/core/libs/tests/GuestHeapReportForGame.cpp
@@ -1,15 +1,27 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#ifdef _WIN32
+#include <process.h>
+#else
+#include <unistd.h>
+#endif
 #include <filesystem>
 #include <fstream>
 #include <sstream>
 #include <string>
 
-extern "C" {
-void APS5_VABI sceLibcInternalBacktraceForGame_nid_postfix(const char* heapName);
-void APS5_VABI sceLibcInternalHeapErrorReportForGame_nid_postfix(void* heap, void* block, std::uint32_t error);
+
+static std::string ReadAll(const std::filesystem::path& path) {
+    std::ifstream file(path);
+    std::stringstream text;
+    text << file.rdbuf();
+    return text.str();
 }
 
 static void Require(bool value, const char* message) {
@@ -20,29 +32,68 @@ static void Require(bool value, const char* message) {
 
 int main() {
     const auto path = std::filesystem::temp_directory_path() / ("anyps5-heap-report-" + std::to_string(std::rand()) + ".txt");
+    const auto outputPath = std::filesystem::temp_directory_path() / ("anyps5-heap-report-out-" + std::to_string(std::rand()) + ".txt");
 #ifdef _WIN32
     Require(_wfreopen(path.wstring().c_str(), L"w", stderr) != nullptr, "stderr redirection failed");
+    Require(_wfreopen(outputPath.wstring().c_str(), L"w", stdout) != nullptr, "stdout redirection failed");
 #else
     Require(std::freopen(path.c_str(), "w", stderr) != nullptr, "stderr redirection failed");
+    Require(std::freopen(outputPath.c_str(), "w", stdout) != nullptr, "stdout redirection failed");
 #endif
 
     char heapName[] = "SceLibcHeap";
     sceLibcInternalBacktraceForGame_nid_postfix(heapName);
     sceLibcInternalBacktraceForGame_nid_postfix(nullptr);
-    int heap = 0;
+    alignas(16) char heap[0x400] = {};
+    std::strcpy(heap + 0x3B0, "SceLibcHeap");
+    const std::uint32_t number = 3;
+    std::memcpy(heap + 0x3F4, &number, sizeof(number));
     int block = 0;
-    sceLibcInternalHeapErrorReportForGame_nid_postfix(&heap, &block, 0x1234u);
+    sceLibcInternalHeapErrorReportForGame_nid_postfix(heap, &block, 1);
+    std::memset(heap + 0x3F4, 0, sizeof(number));
+    sceLibcInternalHeapErrorReportForGame_nid_postfix(heap, &block, 2);
+    bool threw = false;
+    try {
+        sceLibcInternalHeapErrorReportForGame_nid_postfix(nullptr, &block, 1);
+    } catch (const std::invalid_argument&) {
+        threw = true;
+    }
+    Require(threw, "null heap accepted");
+    std::fflush(stdout);
+    const bool closed = _Stdout_nid_postfix.Close() == 0;
+    bool closedThrew = false;
+    try {
+        sceLibcInternalHeapErrorReportForGame_nid_postfix(heap, &block, 1);
+    } catch (const std::exception&) {
+        closedThrew = true;
+    }
+    if (!closed || closedThrew) {
+        std::fputs("heap error report on a closed standard output\n", stderr);
+        std::abort();
+    }
     std::fflush(stderr);
     std::fclose(stderr);
 
-    std::ifstream file(path);
-    std::stringstream text;
-    text << file.rdbuf();
-    file.close();
+    const std::string report = ReadAll(path);
+    const std::string output = ReadAll(outputPath);
     std::filesystem::remove(path);
-    const std::string report = text.str();
+    std::filesystem::remove(outputPath);
+    const std::string first = "[SceLibc] A heap error is detected.\n[SceLibc] -- Mspace Name --\n[SceLibc] SceLibcHeap ( 3)\n"
+        "[SceLibc] -- Error reason --\n[SceLibc] segment out of range.\n[SceLibc] pid:<0x";
+    const std::string second = "[SceLibc] A heap error is detected.\n[SceLibc] -- Mspace Name --\n[SceLibc] SceLibcHeap\n[SceLibc] pid:<0x";
+    Require(output.rfind(first, 0) == 0, "segment error report differs");
+    Require(output.find(second, first.size()) != std::string::npos, "unnamed reason report differs");
+    Require(output.find("reason", output.find(second)) == std::string::npos, "reason printed for error 2");
     Require(report.find("[SceLibcHeap] backtrace requested from guest 0x") != std::string::npos, "heap name not reported");
     Require(report.find("[] backtrace requested from guest 0x") != std::string::npos, "null heap name not reported");
-    Require(report.find("[libc] heap error 0x1234: heap ") != std::string::npos, "heap error not reported");
+    Require(report.find("[libc] heap error 0x1: heap ") != std::string::npos, "host diagnostic missing");
+#ifdef _WIN32
+    const unsigned long pid = static_cast<unsigned long>(_getpid());
+#else
+    const unsigned long pid = static_cast<unsigned long>(getpid());
+#endif
+    char pidText[32];
+    std::snprintf(pidText, sizeof(pidText), "pid:<0x%lx> tid:<0x", pid);
+    Require(output.find(pidText) != std::string::npos, "pid differs");
     Require(std::string(heapName) == "SceLibcHeap", "heap name modified");
 }
diff --git a/core/libs/tests/GuestHeapRounding.cpp b/core/libs/tests/GuestHeapRounding.cpp
index d888f7311f..e71d91abab 100644
--- a/core/libs/tests/GuestHeapRounding.cpp
+++ b/core/libs/tests/GuestHeapRounding.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #ifndef NOMINMAX
 #define NOMINMAX
 #endif
@@ -16,13 +17,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-void* APS5_VABI malloc_nid_postfix(std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-void* APS5_VABI realloc_nid_postfix(void*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr std::size_t HeaderBytes = 2 * sizeof(void*);
@@ -40,6 +34,7 @@ bool checkThreshold(std::size_t bytes, unsigned char value) {
     pointer[bytes - 1] = static_cast<unsigned char>(value + 1);
     const bool preserved = pointer[0] == value && pointer[bytes - 1] == static_cast<unsigned char>(value + 1);
     free_nid_postfix(pointer);
+
     return preserved;
 }
 
@@ -77,14 +72,15 @@ DWORD runChild(const wchar_t* mode) {
 
 int runMallocOverflow() {
     registerDefaultHeap();
-    *__error_nid_postfix() = 0;
+    *__error_nid_postfix() = 77;
     try {
         auto* pointer = malloc_nid_postfix(std::numeric_limits<std::size_t>::max() - HeaderBytes);
         if (pointer != nullptr) {
             free_nid_postfix(pointer);
+
             return 1;
         }
-        return *__error_nid_postfix() == 12 ? 0 : 4;
+        return *__error_nid_postfix() == 77 ? 0 : 4;
     } catch (const std::exception& error) {
         std::fprintf(stderr, "malloc failed with an unexpected exception: %s\n", error.what());
         return 2;
@@ -100,14 +96,15 @@ int runReallocOverflow() {
     auto* original = static_cast<unsigned char*>(malloc_nid_postfix(bytes));
     std::memset(original, 0x5a, bytes);
     bool rejectedWithExpectedError = false;
-    *__error_nid_postfix() = 0;
+    *__error_nid_postfix() = 77;
     try {
         auto* result = realloc_nid_postfix(original, std::numeric_limits<std::size_t>::max() - HeaderBytes);
         if (result != nullptr) {
             free_nid_postfix(result);
+
             return 4;
         }
-        rejectedWithExpectedError = *__error_nid_postfix() == 12;
+        rejectedWithExpectedError = *__error_nid_postfix() == 77;
     } catch (const std::exception& error) {
         std::fprintf(stderr, "realloc failed with an unexpected exception: %s\n", error.what());
     } catch (...) {
@@ -141,6 +138,7 @@ int runReallocOverflow() {
     if (result == 0) {
         free_nid_postfix(replacement);
         free_nid_postfix(original);
+
     }
     return static_cast<int>(result);
 }
diff --git a/core/libs/tests/GuestHmd.cpp b/core/libs/tests/GuestHmd.cpp
index 257e9f381c..fa06463949 100644
--- a/core/libs/tests/GuestHmd.cpp
+++ b/core/libs/tests/GuestHmd.cpp
@@ -1,5 +1,6 @@
 #include "ProcessParametersFixture.hpp"
 #include "prx/libSceHmd/Hmd.hpp"
+#include "prx/libSceHmd/include/Api.hpp"
 
 #include <array>
 #include <cstddef>
@@ -50,7 +51,9 @@ void CheckDisconnected() {
 
 void CheckBufferQueries() {
     Require(sceHmdDistortionGetWorkMemoryAlign() == 0x400, "distortion work memory alignment");
+    Require(sceHmdGetDistortionWorkMemoryAlign() == 0x400, "distortion work memory alignment query");
     Require(sceHmdDistortionGetWorkMemorySize() == 0x20000, "distortion work memory size");
+    Require(sceHmdGetDistortionWorkMemorySize() == 0x20000, "distortion work memory size query");
     Require(sceHmdReprojectionQueryGarlicBuffAlign() == 0x100, "reprojection garlic buffer alignment");
     Require(sceHmdReprojectionQueryGarlicBuffSize() == 0x100000, "reprojection garlic buffer size");
     Require(sceHmdReprojectionQueryOnionBuffAlign() == 0x100, "reprojection onion buffer alignment");
diff --git a/core/libs/tests/GuestHmd2.cpp b/core/libs/tests/GuestHmd2.cpp
index e1bd7b8c52..6303182c1e 100644
--- a/core/libs/tests/GuestHmd2.cpp
+++ b/core/libs/tests/GuestHmd2.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHmd2/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libSceHmd/Hmd.hpp"
 #include "prx/libSceHmd2/Hmd2.hpp"
@@ -11,57 +12,7 @@
 #include <stdexcept>
 
 namespace Hmd2 {
-struct ReprojectionOutput;
-}
 
-extern "C" {
-std::int32_t APS5_VABI Hmd2WriteStateTwo(void* a0);
-std::int32_t APS5_VABI Hmd2WriteSize0x2000Align0x100(std::uint64_t* a0, std::uint64_t* a1);
-std::int32_t APS5_VABI Hmd2WriteFourConstants(void* a0);
-std::int32_t APS5_VABI Hmd2WriteSixHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
-std::int32_t APS5_VABI Hmd2WriteTwelveHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
-std::int32_t APS5_VABI Hmd2SlotUpTo3CheckSecondThirdThenZero(std::uint64_t a0, const void* a1, const void* a2);
-std::int32_t APS5_VABI Hmd2SlotUpTo1ThenError1002(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo1CheckSecondThenError1002(std::uint64_t a0, const void* a1);
-std::int32_t APS5_VABI Hmd2SlotUpTo1ThenMinusOne(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2ThenMinusOne(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1002(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1003(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2CheckSecondThenError002C(std::uint64_t a0, const void* a1);
-std::int32_t APS5_VABI Hmd2IndexZeroCheckSecondThenZero(std::uint64_t a0, const void* a1);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError0004(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenZero(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError1002(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenMinusOne(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstTwoThenParameterInvalid(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenError002C(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenParameterInvalid(const void*);
-std::int32_t APS5_VABI Hmd2CheckAllSixThenZero(const void*, const void*, const void*, const void*, const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenParameterInvalid(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError800d0203(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError1003(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError1010(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1002(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1003(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenZero(const void*, const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenError1003(const void*, const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenInvalidHandle(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenError1002(const void*, const void*);
-std::int32_t APS5_VABI Hmd2BeforeInitializeZero();
-std::int32_t APS5_VABI Hmd2BeforeInitializeNotInitialized();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError0004();
-std::int32_t APS5_VABI Hmd2BeforeInitializeParameterNull();
-std::int32_t APS5_VABI Hmd2BeforeInitializeParameterInvalid();
-std::int32_t APS5_VABI Hmd2BeforeInitializeReprojectionNotInitialized();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError002C();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError1002();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError1003();
-std::int32_t APS5_VABI Hmd2BeforeInitializeMinusOne();
-std::int32_t APS5_VABI Hmd2BeforeInitializeValue0400();
-std::int32_t APS5_VABI Hmd2BeforeInitializeValue20000();
-int APS5_VABI sceHmd2GazeActivateGazeTracking(std::int32_t mode);
-int APS5_VABI sceHmd2ReprojectionGetCurrentOutput(Hmd2::ReprojectionOutput* output);
-int APS5_VABI sceHmd2SetFieldOfView(const Hmd2::FieldOfView* fieldOfView);
 }
 
 namespace {
diff --git a/core/libs/tests/GuestHmd2Gaze.cpp b/core/libs/tests/GuestHmd2Gaze.cpp
index e3cce92206..7a9a674c36 100644
--- a/core/libs/tests/GuestHmd2Gaze.cpp
+++ b/core/libs/tests/GuestHmd2Gaze.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceHmd2/include/Api.hpp"
+#include "prx/libSceHmd2/Hmd2.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -6,18 +8,6 @@
 #include <cstring>
 #include <initializer_list>
 
-struct GazeParam {
-    std::uint32_t size;
-    std::int32_t handle;
-    std::uint64_t reserved;
-};
-
-extern "C" {
-std::int32_t APS5_VABI sceHmd2Initialize(const void* param);
-std::int32_t APS5_VABI sceHmd2GazeGetResult(const GazeParam* param, void* result);
-std::int32_t APS5_VABI sceHmd2GazeGetResultForFoveatedRendering(const GazeParam* param, void* result);
-}
-
 namespace {
 
 constexpr std::int32_t InvalidHandle = static_cast<std::int32_t>(0x8a720003);
@@ -42,24 +32,24 @@ bool NegativeZero(float value) {
 }
 
 void CheckGazeResult() {
-    GazeParam param {sizeof(GazeParam), 0x0e010000, 0};
+    Hmd2::GazeResultParameter param {sizeof(Hmd2::GazeResultParameter), 0x0e010000, 0};
     unsigned char result[0x38];
     std::memset(result, 0x5a, sizeof(result));
     const std::uint32_t size = 0x38;
     std::memcpy(result, &size, sizeof(size));
 
-    Require(sceHmd2GazeGetResult(nullptr, result) == ParameterNull, "null param");
+    Require(sceHmd2GazeGetResult(nullptr, reinterpret_cast<Hmd2::GazeResult*>(result)) == ParameterNull, "null param");
     Require(sceHmd2GazeGetResult(&param, nullptr) == ParameterNull, "null result");
-    GazeParam wrongParam = param;
+    Hmd2::GazeResultParameter wrongParam = param;
     wrongParam.size = 0x18;
-    Require(sceHmd2GazeGetResult(&wrongParam, result) == ParameterInvalid, "param size");
+    Require(sceHmd2GazeGetResult(&wrongParam, reinterpret_cast<Hmd2::GazeResult*>(result)) == ParameterInvalid, "param size");
     const std::uint32_t wrongSize = 0x18;
     std::memcpy(result, &wrongSize, sizeof(wrongSize));
-    Require(sceHmd2GazeGetResult(&param, result) == ParameterInvalid, "result size");
+    Require(sceHmd2GazeGetResult(&param, reinterpret_cast<Hmd2::GazeResult*>(result)) == ParameterInvalid, "result size");
     Require(Read<std::uint32_t>(result, 4) == 0x5a5a5a5a, "result untouched after a size error");
 
     std::memcpy(result, &size, sizeof(size));
-    Require(sceHmd2GazeGetResult(&param, result) == InvalidHandle, "unopened handle");
+    Require(sceHmd2GazeGetResult(&param, reinterpret_cast<Hmd2::GazeResult*>(result)) == InvalidHandle, "unopened handle");
     Require(Read<std::uint32_t>(result, 0) == 0x38, "size kept");
     Require(Read<std::int32_t>(result, 4) == -1, "+4 is -1");
     for (const std::size_t offset : {0x8u, 0xcu, 0x10u, 0x20u, 0x24u, 0x28u, 0x2cu, 0x30u, 0x34u})
@@ -68,25 +58,25 @@ void CheckGazeResult() {
     Require(Read<std::uint32_t>(result, 0x18) == 0, "+0x18 is 0.0");
     Require(Read<float>(result, 0x1c) == -1.0f, "+0x1c is -1.0");
 
-    GazeParam zero {sizeof(GazeParam), 0, 0};
-    Require(sceHmd2GazeGetResult(&zero, result) == InvalidHandle, "handle 0");
+    Hmd2::GazeResultParameter zero {sizeof(Hmd2::GazeResultParameter), 0, 0};
+    Require(sceHmd2GazeGetResult(&zero, reinterpret_cast<Hmd2::GazeResult*>(result)) == InvalidHandle, "handle 0");
 }
 
 void CheckFoveatedResult() {
-    GazeParam param {sizeof(GazeParam), 0x0e010000, 0};
+    Hmd2::GazeResultParameter param {sizeof(Hmd2::GazeResultParameter), 0x0e010000, 0};
     unsigned char result[0x18];
     std::memset(result, 0x5a, sizeof(result));
     const std::uint32_t size = 0x18;
     std::memcpy(result, &size, sizeof(size));
 
-    Require(sceHmd2GazeGetResultForFoveatedRendering(nullptr, result) == ParameterNull, "foveated null param");
+    Require(sceHmd2GazeGetResultForFoveatedRendering(nullptr, reinterpret_cast<Hmd2::FoveatedRenderingResult*>(result)) == ParameterNull, "foveated null param");
     Require(sceHmd2GazeGetResultForFoveatedRendering(&param, nullptr) == ParameterNull, "foveated null result");
     unsigned char large[0x38] = {};
     const std::uint32_t largeSize = 0x38;
     std::memcpy(large, &largeSize, sizeof(largeSize));
-    Require(sceHmd2GazeGetResultForFoveatedRendering(&param, large) == ParameterInvalid, "foveated result size");
+    Require(sceHmd2GazeGetResultForFoveatedRendering(&param, reinterpret_cast<Hmd2::FoveatedRenderingResult*>(large)) == ParameterInvalid, "foveated result size");
 
-    Require(sceHmd2GazeGetResultForFoveatedRendering(&param, result) == InvalidHandle, "foveated unopened handle");
+    Require(sceHmd2GazeGetResultForFoveatedRendering(&param, reinterpret_cast<Hmd2::FoveatedRenderingResult*>(result)) == InvalidHandle, "foveated unopened handle");
     Require(Read<std::uint32_t>(result, 0) == 0x18, "foveated size kept");
     Require(Read<std::int32_t>(result, 4) == -1, "foveated +4 is -1");
     Require(NegativeZero(Read<float>(result, 8)), "foveated +8 is -0.0");
diff --git a/core/libs/tests/GuestHmdSetupDialog.cpp b/core/libs/tests/GuestHmdSetupDialog.cpp
index 7939b5eb8f..1b4f731d93 100644
--- a/core/libs/tests/GuestHmdSetupDialog.cpp
+++ b/core/libs/tests/GuestHmdSetupDialog.cpp
@@ -1,17 +1,8 @@
+#include "prx/libSceHmdSetupDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceHmdSetupDialogInitialize(void);
-int APS5_VABI sceHmdSetupDialogOpen(const void* param);
-int APS5_VABI sceHmdSetupDialogUpdateStatus(void);
-int APS5_VABI sceHmdSetupDialogGetStatus(void);
-int APS5_VABI sceHmdSetupDialogGetResult(void* result);
-int APS5_VABI sceHmdSetupDialogClose(void);
-int APS5_VABI sceHmdSetupDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestHostStandardError.cpp b/core/libs/tests/GuestHostStandardError.cpp
index 4c3fdc2309..131df792f6 100644
--- a/core/libs/tests/GuestHostStandardError.cpp
+++ b/core/libs/tests/GuestHostStandardError.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <csignal>
@@ -16,18 +18,7 @@
 #endif
 
 extern "C" {
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI dup2_nid_postfix(int, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI puts_nid_postfix(const char*);
-int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...);
-void APS5_VABI perror_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
+
 extern FileStream* __stderrp_nid_postfix;
 extern FileStream* __stdoutp_nid_postfix;
 }
diff --git a/core/libs/tests/GuestHostStandardErrorWindows.cpp b/core/libs/tests/GuestHostStandardErrorWindows.cpp
index f91c92d09e..0248298110 100644
--- a/core/libs/tests/GuestHostStandardErrorWindows.cpp
+++ b/core/libs/tests/GuestHostStandardErrorWindows.cpp
@@ -1,9 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/HostStandardStreams.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <string>
 #ifdef _WIN32
 #include <windows.h>
@@ -12,15 +15,7 @@
 #endif
 
 extern "C" {
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI dup2_nid_postfix(int, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI puts_nid_postfix(const char*);
-int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-void APS5_VABI perror_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
+
 extern FileStream _Stdout_nid_postfix;
 extern FileStream _Stderr_nid_postfix;
 }
@@ -84,6 +79,7 @@ static void GuestText(int standard, const std::string& text) {
         Require(fprintf_nid_postfix(&_Stderr_nid_postfix, "guest-fprintf\n") >= 0);
         *__error_nid_postfix() = 2;
         perror_nid_postfix("guest-perror");
+
         Require(fflush_nid_postfix(&_Stderr_nid_postfix) == 0);
     }
     std::string got(text.size(), '\0');
@@ -96,7 +92,55 @@ static void GuestText(int standard, const std::string& text) {
     ::_close(guest[1]);
 }
 
-int main() {
+static void Buffering(int standard) {
+    int capture[2]{-1, -1};
+    Require(::_pipe(capture, 65536, _O_BINARY) == 0);
+    const int original = ::_dup(standard);
+    Require(original >= 0 && ::_dup2(capture[1], standard) == 0);
+    auto* guestStream = standard == 1 ? &_Stdout_nid_postfix : &_Stderr_nid_postfix;
+    char buffer[4096]{};
+    flockfile_nid_postfix(guestStream);
+
+    if (standard == 1) setbuf_nid_postfix(guestStream, buffer);
+    else Require(setvbuf_nid_postfix(guestStream, buffer, 0, sizeof(buffer)) == 0);
+    funlockfile_nid_postfix(guestStream);
+
+    Require(fprintf_nid_postfix(guestStream, "guest-buffered") == 14);
+    Require(std::fputs("host-immediate", standard == 1 ? stdout : stderr) >= 0);
+    char bytes[64]{};
+    DWORD read = 0;
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 14);
+    Require(read == 14 && std::string(bytes, read) == "host-immediate");
+    Require(::_read(capture[0], bytes, 14) == 14);
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 0);
+    Require(fflush_nid_postfix(guestStream) == 0);
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 14);
+    Require(read == 14 && std::string(bytes, read) == "guest-buffered");
+    Require(::_read(capture[0], bytes, 14) == 14);
+
+    int guest[2]{-1, -1};
+    Require(pipe_nid_postfix(guest) == 0 && dup2_nid_postfix(guest[1], standard) == standard);
+    Require(fprintf_nid_postfix(guestStream, "guest-redirected") == 16 && fflush_nid_postfix(guestStream) == 0);
+    Require(std::fputs("host-original", standard == 1 ? stdout : stderr) >= 0);
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 13);
+    Require(read == 13 && std::string(bytes, read) == "host-original");
+    Require(Available(guest[0], bytes, sizeof(bytes), read) == 16);
+    Require(read == 16 && std::string(bytes, read) == "guest-redirected");
+    Require(setvbuf_nid_postfix(guestStream, nullptr, 2, 0) == 0);
+    Require(::_dup2(original, standard) == 0);
+    ::_close(original);
+    ::_close(capture[0]);
+    ::_close(capture[1]);
+    ::_close(guest[0]);
+    ::_close(guest[1]);
+}
+
+int main(int argc, char** argv) {
+    if (argc == 2 && std::strcmp(argv[1], "--buffering") == 0) {
+        Buffering(2);
+        Buffering(1);
+        return 0;
+    }
     Split(2);
     Split(1);
     GuestText(1, "guest-printf\nguest-puts\n");
diff --git a/core/libs/tests/GuestHostStreams.cpp b/core/libs/tests/GuestHostStreams.cpp
index e31c1dad51..f05f9f4b1b 100644
--- a/core/libs/tests/GuestHostStreams.cpp
+++ b/core/libs/tests/GuestHostStreams.cpp
@@ -1,17 +1,14 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
+constexpr int GuestEperm = 1;
 constexpr int GuestEbadf = 9;
+constexpr int SceKernelErrorEperm = static_cast<int>(0x80020001);
 constexpr int SceKernelErrorEbadf = static_cast<int>(0x80020009);
 
 static bool Open(int fd) {
@@ -26,13 +23,17 @@ int main() {
     for (int fd = 0; fd < 3; ++fd) open[fd] = Open(fd);
     for (int fd = 0; fd < 3; ++fd) {
         if (!open[fd]) continue;
-        Require(close_nid_postfix(fd) == -1 && *__error_nid_postfix() == GuestEbadf);
-        Require(sceKernelClose(fd) == SceKernelErrorEbadf);
+        Require(close_nid_postfix(fd) == -1 && *__error_nid_postfix() == GuestEperm);
+        Require(sceKernelClose(fd) == SceKernelErrorEperm);
         Require(Open(fd));
     }
     int pipe[2];
     Require(pipe_nid_postfix(pipe) == 0);
     for (const int fd : pipe) Require(fd >= 3 || !open[fd]);
     Require(close_nid_postfix(pipe[0]) == 0 && close_nid_postfix(pipe[1]) == 0);
+    Require(close_nid_postfix(pipe[0]) == -1 && *__error_nid_postfix() == GuestEbadf);
+    Require(sceKernelClose(pipe[1]) == SceKernelErrorEbadf);
+    Require(close_nid_postfix(-1) == -1 && *__error_nid_postfix() == GuestEbadf);
+    Require(sceKernelClose(-1) == SceKernelErrorEbadf);
     return 0;
 }
diff --git a/core/libs/tests/GuestHostname.cpp b/core/libs/tests/GuestHostname.cpp
index 36e18845dc..871c2b68d1 100644
--- a/core/libs/tests/GuestHostname.cpp
+++ b/core/libs/tests/GuestHostname.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdio>
@@ -8,11 +9,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI gethostname_nid_postfix(char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "Hostname check failed at line %d\n", line);
@@ -22,7 +18,7 @@ static void Require(bool condition, int line) {
 #define Check(value) Require((value), __LINE__)
 
 int main() {
-    constexpr std::string_view expected = "AnyPS5";
+    constexpr std::string_view expected = "";
     for (std::size_t length = 0; length <= expected.size() + 2; ++length) {
         std::vector<char> buffer(length + 2, '#');
         *__error_nid_postfix() = 71;
diff --git a/core/libs/tests/GuestHttp.cpp b/core/libs/tests/GuestHttp.cpp
index 9ecb47dd94..fbbdd525bf 100644
--- a/core/libs/tests/GuestHttp.cpp
+++ b/core/libs/tests/GuestHttp.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "SceTypes.hpp"
 #include "ProcessParametersFixture.hpp"
 #include <array>
@@ -9,51 +10,47 @@
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <exception>
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceHttpUriParse(SceHttpUriElement*, const char*, void*, std::size_t*, std::size_t);
-int APS5_VABI sceHttpUriCopy(SceHttpUriElement*, const SceHttpUriElement*, void*, std::size_t, std::size_t*);
-int APS5_VABI sceHttpUriMerge(char*, const char*, const char*, std::size_t*, std::size_t, std::uint32_t);
-int APS5_VABI sceHttpSetInflateGZIPEnabled(int, int);
-int APS5_VABI sceHttpSetRequestStatusCallback(int, void (APS5_VABI *)(int, int, void*), void*);
-int APS5_VABI sceHttpSendRequest(int, const void*, std::size_t);
-int APS5_VABI sceHttpUriBuild(char*, std::size_t*, std::size_t, const SceHttpUriElement*, std::uint32_t);
-int APS5_VABI sceHttpUriEscape(char*, std::size_t*, std::size_t, const char*);
-int APS5_VABI sceHttpUriUnescape(char*, std::size_t*, std::size_t, const char*);
-int APS5_VABI sceHttpUriSweepPath(char*, const char*, std::size_t);
-int APS5_VABI sceHttpCreateEpoll(int, HttpEpollHandle*);
-int APS5_VABI sceHttpDestroyEpoll(int, HttpEpollHandle);
-int APS5_VABI sceHttpWaitRequest(HttpEpollHandle, HttpNBEvent*, int, int);
-int APS5_VABI sceHttpAbortWaitRequest(HttpEpollHandle);
-int APS5_VABI sceHttpInit_nid_postfix(int, int, std::uint64_t);
-int APS5_VABI sceHttpTerm_nid_postfix(int);
-int APS5_VABI sceHttpAuthCacheFlush(int);
-int APS5_VABI sceHttpCookieFlush(int);
-int APS5_VABI sceHttpReadData(int, void*, std::size_t);
-int APS5_VABI sceHttpCreateRequest2(int, const char*, const char*, std::uint64_t);
-int APS5_VABI sceHttpsEnableOption(int, std::uint32_t);
-int APS5_VABI sceHttpsLoadCert(int, int, void*, void*, void*);
-int APS5_VABI sceHttpGetLastErrno(int, int*);
-int APS5_VABI sceHttpSetResponseHeaderMaxSize(int, std::uint64_t);
-int APS5_VABI sceHttpSetRecvBlockSize(int, std::uint32_t);
-int APS5_VABI sceHttpRedirectCacheFlush(int);
-int APS5_VABI sceHttpsUnloadCert(int);
-int APS5_VABI sceHttpsSetSslVersion(int, int);
-int APS5_VABI sceHttpsGetSslError(int, int*, std::uint32_t*);
-int APS5_VABI sceHttpSetRedirectCallback(int, HttpRedirectCallback, void*);
-int APS5_VABI sceHttpSetCookieRecvCallback(int, HttpCookieRecvCallback, void*);
-int APS5_VABI sceHttpSetAuthInfoCallback(int, HttpAuthInfoCallback, void*);
-int APS5_VABI sceHttpParseStatusLine(const char*, std::size_t, std::int32_t*, std::int32_t*, std::int32_t*, const char**, std::size_t*);
-}
-
 alignas(16) static std::array<std::byte, 0x40> processParameters{};
 
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool Equal(const char* left, const char* right) { return std::strcmp(left, right) == 0; }
 
+
+static_assert(sizeof(HttpMemoryPoolStats) == 24);
+
+template <typename TCall>
+static bool Throws(TCall call) {
+    try {
+        call();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+static void CheckPoolStatsRejected(int id, int expected) {
+    alignas(HttpMemoryPoolStats) unsigned char buffer[sizeof(HttpMemoryPoolStats) + 16];
+    std::memset(buffer, 0x5a, sizeof(buffer));
+    Require(sceHttpGetMemoryPoolStats(id, reinterpret_cast<HttpMemoryPoolStats*>(buffer)) == expected);
+    for (unsigned char byte : buffer) Require(byte == 0x5a);
+}
+
+static void CheckPoolStats(int id, std::size_t poolSize) {
+    alignas(HttpMemoryPoolStats) unsigned char buffer[sizeof(HttpMemoryPoolStats) + 16];
+    std::memset(buffer, 0x5a, sizeof(buffer));
+    Require(sceHttpGetMemoryPoolStats(id, reinterpret_cast<HttpMemoryPoolStats*>(buffer)) == 0);
+    HttpMemoryPoolStats stats;
+    std::memcpy(&stats, buffer, sizeof(stats));
+    Require(stats.poolSize == poolSize);
+    Require(stats.peakUsedSize == 0 && stats.usedSize == 0);
+    for (std::size_t i = sizeof(stats); i < sizeof(buffer); ++i) Require(buffer[i] == 0x5a);
+}
+
 static void CheckUriParseCharacters() {
     char pool[256];
     SceHttpUriElement element{};
@@ -679,6 +676,10 @@ int main() {
     flushCaches(0, beforeInit);
     flushCaches(-1, beforeInit);
     flushCaches(request, beforeInit);
+    CheckPoolStatsRejected(0, beforeInit);
+    CheckPoolStatsRejected(-1, beforeInit);
+    CheckPoolStatsRejected(request, beforeInit);
+    Require(Throws([] { sceHttpGetMemoryPoolStats(0, nullptr); }));
     HttpEpollHandle epoll = nullptr;
     HttpNBEvent events[2]{};
     Require(sceHttpCreateEpoll(1, &epoll) == beforeInit);
@@ -692,6 +693,14 @@ int main() {
     flushCaches(-1, invalidId);
     flushCaches(INT32_MAX, invalidId);
     flushCaches(request, invalidId);
+    CheckPoolStats(context, 0x10000);
+    CheckPoolStats(context, 0x10000);
+    CheckPoolStatsRejected(0, invalidId);
+    CheckPoolStatsRejected(-1, invalidId);
+    CheckPoolStatsRejected(INT32_MAX, invalidId);
+    CheckPoolStatsRejected(request, invalidId);
+    Require(Throws([context] { sceHttpGetMemoryPoolStats(context, nullptr); }));
+    Require(Throws([] { sceHttpGetMemoryPoolStats(INT32_MAX, nullptr); }));
     Require(sceHttpCreateEpoll(-1, &epoll) == invalidId);
     Require(sceHttpCreateEpoll(context, nullptr) == invalidValue);
     Require(sceHttpCreateEpoll(context, &epoll) == 0 && epoll != nullptr);
@@ -733,11 +742,15 @@ int main() {
     Require(waitWokenBy([&] { Require(sceHttpDestroyEpoll(context, epoll) == 0); }) == 0);
 
     Require(sceHttpCreateEpoll(context, &epoll) == 0);
-    const int otherContext = sceHttpInit_nid_postfix(0, 0, 0x10000);
+    const int otherContext = sceHttpInit_nid_postfix(0, 0, 0x23000);
     Require(otherContext > 0 && otherContext != context);
     flushCaches(otherContext, 0);
+    CheckPoolStats(otherContext, 0x23000);
+    CheckPoolStats(context, 0x10000);
     Require(sceHttpTerm_nid_postfix(otherContext) == 0);
     flushCaches(otherContext, invalidId);
+    CheckPoolStatsRejected(otherContext, invalidId);
+    CheckPoolStats(context, 0x10000);
     flushCaches(context, 0);
     Require(sceHttpTerm_nid_postfix(otherContext) == invalidId);
     Require(sceHttpWaitRequest(epoll, events, 2, 0) == 0);
@@ -745,13 +758,23 @@ int main() {
     Require(sceHttpWaitRequest(epoll, events, 2, 0) == beforeInit);
     Require(sceHttpTerm_nid_postfix(context) == beforeInit);
     flushCaches(context, beforeInit);
-    const int newContext = sceHttpInit_nid_postfix(0, 0, 0x10000);
+    CheckPoolStatsRejected(context, beforeInit);
+    const int newContext = sceHttpInit_nid_postfix(0, 0, 0x123456000ull);
     Require(newContext > 0 && newContext != context && newContext != otherContext);
     flushCaches(context, invalidId);
     flushCaches(otherContext, invalidId);
     flushCaches(newContext, 0);
+    CheckPoolStatsRejected(context, invalidId);
+    CheckPoolStatsRejected(otherContext, invalidId);
+    CheckPoolStats(newContext, 0x123456000ull);
     Require(sceHttpTerm_nid_postfix(newContext) == 0);
     flushCaches(newContext, beforeInit);
+    CheckPoolStatsRejected(newContext, beforeInit);
+    const int emptyPoolContext = sceHttpInit_nid_postfix(0, 0, 0);
+    Require(emptyPoolContext > 0);
+    CheckPoolStats(emptyPoolContext, 0);
+    CheckPoolStatsRejected(newContext, invalidId);
+    Require(sceHttpTerm_nid_postfix(emptyPoolContext) == 0);
 
     char data[16];
     Require(sceHttpReadData(1, data, sizeof(data)) == network);
diff --git a/core/libs/tests/GuestHttp2.cpp b/core/libs/tests/GuestHttp2.cpp
index 102369b0c4..286b03b042 100644
--- a/core/libs/tests/GuestHttp2.cpp
+++ b/core/libs/tests/GuestHttp2.cpp
@@ -1,48 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceHttp2/include/Http2.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceHttp2Init(int, int, std::size_t, int);
-int APS5_VABI sceHttp2CreateTemplate(int, const char*, int, int);
-int APS5_VABI sceHttp2CreateRequestWithURL(int, const char*, const char*, std::uint64_t);
-int APS5_VABI sceHttp2CreateCookieBox(std::size_t);
-int APS5_VABI sceHttp2DeleteCookieBox(int);
-int APS5_VABI sceHttp2SetCookieBox(int, int);
-int APS5_VABI sceHttp2CookieFlush(int);
-int APS5_VABI sceHttp2SetRequestNoContentLength(int);
-int APS5_VABI sceHttp2SendRequest(int, const void*, std::size_t);
-int APS5_VABI sceHttp2SendRequestAsync(int, const void*, std::size_t, Http2AsyncOption*, void*);
-int APS5_VABI sceHttp2WaitAsync(int, Http2AsyncResult*, std::uint32_t*, void*);
-int APS5_VABI sceHttp2DeleteRequest(int);
-int APS5_VABI sceHttp2DeleteTemplate(int);
-int APS5_VABI sceHttp2SetMinSslVersion(int, std::uint32_t);
-int APS5_VABI sceHttp2SslEnableOption(int, std::uint32_t);
-int APS5_VABI sceHttp2SslDisableOption(int, std::uint32_t);
-int APS5_VABI sceHttp2Term(int);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
-int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
-uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
-void* APS5_VABI sceKernelGetEventUserData(const KernelEvent* ev);
-}
-
-struct Http2MemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-extern "C" {
-int APS5_VABI sceHttp2GetMemoryPoolStats(int, Http2MemoryPoolStats*);
-int APS5_VABI sceHttp2SetResolveRetry(int, std::int32_t);
-int APS5_VABI sceHttp2WebSocketSetPingInterval(std::int32_t, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static constexpr int InvalidId = static_cast<int>(0x817B1100);
diff --git a/core/libs/tests/GuestHttpOptions.cpp b/core/libs/tests/GuestHttpOptions.cpp
index a2f0f1ce7a..d5f927e1fc 100644
--- a/core/libs/tests/GuestHttpOptions.cpp
+++ b/core/libs/tests/GuestHttpOptions.cpp
@@ -1,45 +1,11 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <initializer_list>
-
-extern "C" {
-int APS5_VABI sceHttpInit_nid_postfix(int, int, std::uint64_t);
-int APS5_VABI sceHttpTerm_nid_postfix(int);
-int APS5_VABI sceHttpCreateTemplate(int, const char*, int, int);
-int APS5_VABI sceHttpDeleteTemplate(int);
-int APS5_VABI sceHttpCreateConnectionWithURL(int, const char*, int);
-int APS5_VABI sceHttpDeleteConnection(int);
-int APS5_VABI sceHttpCreateRequestWithURL(int, int, const char*, std::uint64_t);
-int APS5_VABI sceHttpDeleteRequest(int);
-int APS5_VABI sceHttpSetAutoRedirect(int, int);
-int APS5_VABI sceHttpGetAutoRedirect(int, int*);
-int APS5_VABI sceHttpSetAuthEnabled(int, int);
-int APS5_VABI sceHttpGetAuthEnabled(int, int*);
-int APS5_VABI sceHttpSetCookieEnabled(int, int);
-int APS5_VABI sceHttpGetCookieEnabled(int, int*);
-int APS5_VABI sceHttpSetNonblock(int, int);
-int APS5_VABI sceHttpGetNonblock(int, int*);
-int APS5_VABI sceHttpTrySetNonblock(int, int);
-int APS5_VABI sceHttpTryGetNonblock(int, int*);
-int APS5_VABI sceHttpSetAcceptEncodingGZIPEnabled(int, int);
-int APS5_VABI sceHttpGetAcceptEncodingGZIPEnabled(int, int*);
-int APS5_VABI sceHttpSetDefaultAcceptEncodingGZIPEnabled(int, int);
-int APS5_VABI sceHttpCreateEpoll(int, HttpEpollHandle*);
-int APS5_VABI sceHttpDestroyEpoll(int, HttpEpollHandle);
-int APS5_VABI sceHttpSetEpoll(int, HttpEpollHandle, void*);
-int APS5_VABI sceHttpUnsetEpoll(int);
-int APS5_VABI sceHttpGetEpoll(int, HttpEpollHandle*, void**);
-int APS5_VABI sceHttpCacheRedirectedConnectionEnabled(int, int);
-int APS5_VABI sceHttpsEnableOptionPrivate(int, std::uint32_t);
-int APS5_VABI sceHttpsDisableOptionPrivate(int, std::uint32_t);
-int APS5_VABI sceHttpAbortRequestForce(int);
-int APS5_VABI sceHttpSetProxy(int, int, int, const char*, std::uint16_t);
-int APS5_VABI sceHttpAddRequestHeader(int, const char*, const char*, std::uint32_t);
-int APS5_VABI sceHttpRemoveRequestHeader(int, const char*);
-}
+#include <stdexcept>
 
 namespace {
 
@@ -201,6 +167,34 @@ void CheckTermEndsOptions() {
     Require(sceHttpTerm_nid_postfix(next) == 0, "sceHttpTerm failed");
 }
 
+bool RefusesNull(int context, int* netPoolId, int* sslContextId) {
+    try {
+        sceHttpGetRegisteredCtxIds(context, netPoolId, sslContextId);
+    } catch (const std::invalid_argument&) {
+        return true;
+    }
+    return false;
+}
+
+void CheckRegisteredCtxIds() {
+    int netPoolId = -1;
+    int sslContextId = -1;
+    Require(sceHttpGetRegisteredCtxIds(UnknownId, &netPoolId, &sslContextId) == BeforeInit, "sceHttpGetRegisteredCtxIds answered before sceHttpInit");
+    const int first = sceHttpInit_nid_postfix(3, 7, 0x10000);
+    const int second = sceHttpInit_nid_postfix(5, 9, 0x20000);
+    Require(sceHttpGetRegisteredCtxIds(first, &netPoolId, &sslContextId) == 0 && netPoolId == 3 && sslContextId == 7, "the ids given to the first sceHttpInit were not reported");
+    Require(sceHttpGetRegisteredCtxIds(second, &netPoolId, &sslContextId) == 0 && netPoolId == 5 && sslContextId == 9, "the ids given to the second sceHttpInit were not reported");
+    Require(RefusesNull(second, nullptr, &sslContextId) && RefusesNull(second, &netPoolId, nullptr), "a null output was taken");
+    netPoolId = -1;
+    sslContextId = -1;
+    Require(sceHttpGetRegisteredCtxIds(UnknownId, &netPoolId, &sslContextId) == InvalidId, "sceHttpGetRegisteredCtxIds took an unknown id");
+    Require(sceHttpTerm_nid_postfix(first) == 0, "sceHttpTerm failed");
+    Require(sceHttpGetRegisteredCtxIds(first, &netPoolId, &sslContextId) == InvalidId, "a terminated context still reported its ids");
+    Require(netPoolId == -1 && sslContextId == -1, "a refused query wrote its outputs");
+    Require(sceHttpTerm_nid_postfix(second) == 0, "sceHttpTerm failed");
+    Require(sceHttpGetRegisteredCtxIds(second, &netPoolId, &sslContextId) == BeforeInit, "sceHttpGetRegisteredCtxIds answered after the last sceHttpTerm");
+}
+
 void CheckUnobservedOptions(int context) {
     const int pattern = sceHttpCreateTemplate(context, "anyps5-test", 2, 0);
     const int connection = sceHttpCreateConnectionWithURL(pattern, "http://example.com/", 1);
@@ -241,6 +235,7 @@ int main() {
     Require(sceHttpTerm_nid_postfix(context) == 0, "sceHttpTerm failed");
     Require(sceHttpSetDefaultAcceptEncodingGZIPEnabled(context, 1) == BeforeInit, "a gzip default was taken before sceHttpInit");
     CheckTermEndsOptions();
+    CheckRegisteredCtxIds();
     std::puts("HTTP option tests passed");
     return 0;
 }
diff --git a/core/libs/tests/GuestHttpResponseHeader.cpp b/core/libs/tests/GuestHttpResponseHeader.cpp
index 76bbc60b5d..46244f8153 100644
--- a/core/libs/tests/GuestHttpResponseHeader.cpp
+++ b/core/libs/tests/GuestHttpResponseHeader.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdio>
@@ -13,8 +14,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI sceHttpParseResponseHeader(const char*, std::size_t, const char*, const char**, std::size_t*);
-
 static void Require(bool value) {
     if (!value) {
         std::fputs("HTTP response header check failed\n", stderr);
diff --git a/core/libs/tests/GuestImeDialog.cpp b/core/libs/tests/GuestImeDialog.cpp
index 756a809fd7..cd5fce7fcb 100644
--- a/core/libs/tests/GuestImeDialog.cpp
+++ b/core/libs/tests/GuestImeDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceImeDialog/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
@@ -7,18 +8,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceImeDialogInit(const Param*, const ExtendedParam*);
-int APS5_VABI sceImeDialogGetStatus(void);
-int APS5_VABI sceImeDialogGetResult(Result*);
-int APS5_VABI sceImeDialogAbort(void);
-int APS5_VABI sceImeDialogTerm(void);
-int APS5_VABI sceImeDialogForceClose(void);
-int APS5_VABI sceImeDialogGetCurrentStarState(std::int64_t);
-int APS5_VABI sceImeDialogInitInternal(const Param*, const ExtendedParam*);
-int APS5_VABI sceImeDialogSetPanelPosition(std::int32_t, std::int32_t);
-}
-
 namespace {
 
 constexpr int StatusNone = 0;
@@ -181,6 +170,13 @@ int main() {
     Open(param);
     Close();
 
+    Require(sceImeDialogGetPanelPositionAndForm(nullptr) == ErrorNotOpened);
+    std::uint32_t panelWidth = 0;
+    std::uint32_t panelHeight = 0;
+    Require(sceImeDialogGetPanelSize(nullptr, &panelWidth, &panelHeight) == 0 && panelWidth == 1920 && panelHeight == 1080);
+    panelWidth = 0;
+    panelHeight = 0;
+    Require(sceImeDialogGetPanelSizeExtended(nullptr, nullptr, &panelWidth, &panelHeight) == 0 && panelWidth == 1920 && panelHeight == 1080);
     Require(sceImeDialogInit(nullptr, nullptr) == ErrorInvalidAddress);
     const Param empty = DialogParam(buffer, 0);
     Require(sceImeDialogInit(&empty, nullptr) == ErrorInvalidMaxTextLength);
diff --git a/core/libs/tests/GuestImeFilterText.cpp b/core/libs/tests/GuestImeFilterText.cpp
index bac9e2daa2..7c15604512 100644
--- a/core/libs/tests/GuestImeFilterText.cpp
+++ b/core/libs/tests/GuestImeFilterText.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceIme/include/ImeFilterText.hpp"
 #include <cstdint>
@@ -7,11 +8,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceImeFilterText(char16_t* dst, int32_t* out_length, uint32_t capacity,
-                               const ime_filter::FilterParam* param, const char16_t* src, uint32_t src_length);
-}
-
 namespace {
 
 constexpr int kInvalidParam = static_cast<int>(0x80bc0030u);
@@ -65,6 +61,7 @@ void CheckArguments() {
     Require(Run(0, 5, 16, {u'a'}).code == kInvalidParam, "type 5");
     Require(Run(0, 0xff, 16, {u'a'}).code == kInvalidParam, "type 0xff");
     Require(Run(0, 0x104, 16, {u'a'}).code == kInvalidParam, "type 0x104");
+    Require(Run(0, 0x200, 16, {u'a'}).code == kInvalidParam, "type 0x200");
 }
 
 void CheckSimpleTypes() {
diff --git a/core/libs/tests/GuestImeKeyboard.cpp b/core/libs/tests/GuestImeKeyboard.cpp
index 180a47106f..a7fff4e531 100644
--- a/core/libs/tests/GuestImeKeyboard.cpp
+++ b/core/libs/tests/GuestImeKeyboard.cpp
@@ -1,15 +1,9 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceImeKeyboardOpen(int32_t user_id, const KeyboardParam* param);
-int APS5_VABI sceImeKeyboardClose(int32_t user_id);
-int APS5_VABI sceImeKeyboardGetInfo(uint32_t resource_id, KeyboardInfo* info);
-int APS5_VABI sceImeKeyboardSetMode(int32_t user_id, uint32_t mode);
-}
-
 static_assert(sizeof(KeyboardInfo) == 36);
 
 constexpr int AlreadyOpened = static_cast<int>(0x80bc0001u);
@@ -34,6 +28,7 @@ static void CheckClosed() {
     KeyboardInfo info;
     std::memset(&info, 0xa5, sizeof(info));
     Require(sceImeKeyboardGetInfo(0, nullptr) == InvalidAddress, "null info");
+    Require(sceImeKeyboardOpen(1, nullptr) == InvalidAddress, "null param");
     Require(sceImeKeyboardGetInfo(0, &info) == NotOpened, "info without an open keyboard");
     RequireUntouched(info);
     Require(sceImeKeyboardClose(1) == NotOpened, "close without an open keyboard");
diff --git a/core/libs/tests/GuestImeOpen.cpp b/core/libs/tests/GuestImeOpen.cpp
index 39c7278c1e..a9ecc94acb 100644
--- a/core/libs/tests/GuestImeOpen.cpp
+++ b/core/libs/tests/GuestImeOpen.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
 #include "prx/libSceVideoOut/include/ImeTextInput.hpp"
@@ -10,16 +11,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceImeOpen_nid_postfix(const Param* param, const ExtendedParam* extended);
-int APS5_VABI sceImeClose_nid_postfix(void);
-int APS5_VABI sceImeUpdate(EventHandler handler);
-int APS5_VABI sceImeSetText(const char16_t* text, uint32_t length);
-int APS5_VABI sceImeSetCaret(const Caret* caret);
-int APS5_VABI sceImeGetPanelPositionAndForm(PositionAndForm* form);
-void APS5_VABI sceImeParamInit(Param* param);
-}
-
 namespace {
 
 constexpr int Busy = static_cast<int>(0x80bc0001u);
@@ -181,6 +172,7 @@ struct Buffers {
 Param MakeParam(Buffers& buffers, uint32_t maxLength) {
     Param param;
     sceImeParamInit(&param);
+
     param.user_id = 1;
     param.max_text_length = maxLength;
     param.input_text_buffer = buffers.text;
@@ -225,6 +217,7 @@ void RequireCaretSteps(const std::vector<Recorded>& events, uint32_t direction,
 void CheckValidation() {
     Buffers buffers;
     Require(sceImeOpen_nid_postfix(nullptr, nullptr) == InvalidAddress, "null param");
+    Require(sceImeUpdate(nullptr) == InvalidHandler, "null handler");
     auto expect = [&](auto change, int error, const char* message) {
         Param param = MakeParam(buffers, 16);
         change(param);
diff --git a/core/libs/tests/GuestImeParameters.cpp b/core/libs/tests/GuestImeParameters.cpp
index 23f590a389..82ec0959f8 100644
--- a/core/libs/tests/GuestImeParameters.cpp
+++ b/core/libs/tests/GuestImeParameters.cpp
@@ -1,22 +1,10 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-void APS5_VABI sceImeParamInit(Param* param);
-int APS5_VABI sceImeGetPanelSize(const Param* param, uint32_t* width, uint32_t* height);
-int APS5_VABI sceImeClose_nid_postfix(void);
-int APS5_VABI sceImeGetPanelPositionAndForm(PositionAndForm* form);
-int APS5_VABI sceImeSetCaret(const Caret* caret);
-int APS5_VABI sceImeSetText(const char16_t* text, uint32_t length);
-int APS5_VABI sceImeSetTextGeometry(TextAreaMode mode, const TextGeometry* geometry);
-int APS5_VABI sceImeKeyboardOpen(int32_t user_id, const KeyboardParam* param);
-int APS5_VABI sceImeKeyboardClose(int32_t user_id);
-int APS5_VABI sceImeKeyboardGetResourceId(int32_t user_id, KeyboardResourceIdArray* resource_ids);
-}
-
 static_assert(sizeof(Param) == 96);
 static_assert(offsetof(Param, option) == 32);
 static_assert(offsetof(Param, reserved) == 88);
@@ -36,6 +24,7 @@ static void CheckInitialization() {
     std::memset(&guarded, 0xa5, sizeof(guarded));
     sceImeParamInit(nullptr);
     sceImeParamInit(&guarded.param);
+
     Require(guarded.param.user_id == -1, "initial user must be invalid");
     const auto* bytes = reinterpret_cast<const unsigned char*>(&guarded.param);
     for (size_t i = sizeof(guarded.param.user_id); i < sizeof(Param); ++i) {
@@ -47,6 +36,7 @@ static void CheckInitialization() {
     guarded.param.option = 0x4000;
     guarded.param.max_text_length = 32;
     sceImeParamInit(&guarded.param);
+
     Require(guarded.param.user_id == -1 && guarded.param.type == 0 &&
             guarded.param.option == 0 && guarded.param.max_text_length == 0,
             "reinitialization must reset previous values");
diff --git a/core/libs/tests/GuestIndexedDraw.cpp b/core/libs/tests/GuestIndexedDraw.cpp
index 3c6ed23b0b..14333e04f6 100644
--- a/core/libs/tests/GuestIndexedDraw.cpp
+++ b/core/libs/tests/GuestIndexedDraw.cpp
@@ -1,15 +1,11 @@
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include <array>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbSetIndexCount(CommandBuffer*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetIndexCountGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbDrawIndex(CommandBuffer*, std::uint32_t, const volatile void*, std::uint64_t);
-std::uint32_t APS5_VABI sceAgcDcbDrawIndexGetSize();
-}
 static void Require(bool condition) { if (!condition) std::abort(); }
 template<typename TAction> static void Reject(TAction action) {
     bool rejected = false;
diff --git a/core/libs/tests/GuestInetAddress.cpp b/core/libs/tests/GuestInetAddress.cpp
index 80447cad5d..444bfb5b21 100644
--- a/core/libs/tests/GuestInetAddress.cpp
+++ b/core/libs/tests/GuestInetAddress.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,13 +7,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-int APS5_VABI inet_aton_nid_postfix(const char* text, std::uint32_t* address);
-std::uint32_t APS5_VABI inet_addr_nid_postfix(const char* text);
-char* APS5_VABI inet_ntoa_nid_postfix(std::uint32_t address);
-char* APS5_VABI inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size);
-}
-
 namespace {
 
 void Require(bool value, const char* what) {
@@ -64,5 +59,14 @@ int main() {
     Require(inet_ntoa_r_nid_postfix(Network(1, 2, 3, 4), buffer, sizeof(buffer)) == buffer && std::string(buffer) == "1.2.3.4", "inet_ntoa_r");
     char tiny[4] = {'k', 'e', 'e', 'p'};
     Require(inet_ntoa_r_nid_postfix(Network(1, 2, 3, 4), tiny, sizeof(tiny)) == tiny, "inet_ntoa_r small buffer returns it");
+
+    char exact[14];
+    std::memset(exact, 'z', sizeof(exact));
+    Require(__inet_ntoa_r_nid_postfix(Network(192, 168, 0, 255), exact, sizeof(exact)) == exact && std::string(exact) == "192.168.0.255", "__inet_ntoa_r");
+    char oneShort[13];
+    std::memset(oneShort, 'z', sizeof(oneShort));
+    *__error_nid_postfix() = 0;
+    Require(__inet_ntoa_r_nid_postfix(Network(192, 168, 0, 255), oneShort, sizeof(oneShort)) == oneShort && *__error_nid_postfix() == 28, "__inet_ntoa_r small buffer");
+    Require(std::string(oneShort, sizeof(oneShort)) == std::string(sizeof(oneShort), 'z') && std::string(text) == "255.255.255.255", "__inet_ntoa_r leaves the buffers");
     return 0;
 }
diff --git a/core/libs/tests/GuestInitOnce.cpp b/core/libs/tests/GuestInitOnce.cpp
new file mode 100644
index 0000000000..c7140ac745
--- /dev/null
+++ b/core/libs/tests/GuestInitOnce.cpp
@@ -0,0 +1,49 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <thread>
+
+namespace {
+
+constexpr unsigned long InitFailed = 4;
+
+void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "init once: %s\n", message);
+    std::abort();
+}
+
+int Begin(void** once) {
+    int pending = -1;
+    Require(__std_init_once_begin_initialize_clr_nid_postfix(once, 0, &pending, nullptr) == 1, "begin returns 1");
+    return pending;
+}
+
+}
+
+int main() {
+    alignas(8) void* once = nullptr;
+    Require(Begin(&once) == 1, "the first caller runs the initialization");
+    Require(reinterpret_cast<std::uintptr_t>(once) == 1, "a running initialization marks the object");
+    Require(__std_init_once_complete_clr_nid_postfix(&once, InitFailed, nullptr) == 1, "complete a failed initialization");
+    Require(once == nullptr, "a failed initialization resets the object");
+    Require(Begin(&once) == 1, "a caller after a failure runs the initialization again");
+
+    std::atomic<bool> waiterDone{false};
+    std::atomic<int> waiterPending{-1};
+    std::thread waiter([&] {
+        waiterPending = Begin(&once);
+        waiterDone = true;
+    });
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    Require(!waiterDone, "a second caller waits while the initialization runs");
+    Require(__std_init_once_complete_clr_nid_postfix(&once, 0, nullptr) == 1, "complete the initialization");
+    waiter.join();
+    Require(waiterPending == 0, "the waiting caller sees the initialization done");
+    Require(reinterpret_cast<std::uintptr_t>(once) == 2, "a completed initialization marks the object");
+    Require(Begin(&once) == 0, "a later caller does not run the initialization");
+    return 0;
+}
diff --git a/core/libs/tests/GuestIntegerBuiltins.cpp b/core/libs/tests/GuestIntegerBuiltins.cpp
index 64f5cbb0e1..e0b4eaac19 100644
--- a/core/libs/tests/GuestIntegerBuiltins.cpp
+++ b/core/libs/tests/GuestIntegerBuiltins.cpp
@@ -1,73 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
-extern "C" {
-std::int64_t APS5_VABI __ashldi3_nid_postfix(std::int64_t, int);
-std::int64_t APS5_VABI __ashrdi3_nid_postfix(std::int64_t, int);
-std::int64_t APS5_VABI __lshrdi3_nid_postfix(std::int64_t, int);
-Int128 APS5_VABI __ashlti3_nid_postfix(Int128, int);
-Int128 APS5_VABI __ashrti3_nid_postfix(Int128, int);
-Int128 APS5_VABI __lshrti3_nid_postfix(Int128, int);
-int APS5_VABI __clzsi2_nid_postfix(std::uint32_t);
-int APS5_VABI __clzdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __clzti2_nid_postfix(Uint128);
-int APS5_VABI __ctzsi2_nid_postfix(std::uint32_t);
-int APS5_VABI __ctzdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __ctzti2_nid_postfix(Uint128);
-int APS5_VABI __ffsdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __ffsti2_nid_postfix(Uint128);
-int APS5_VABI __paritysi2_nid_postfix(std::uint32_t);
-int APS5_VABI __paritydi2_nid_postfix(std::uint64_t);
-int APS5_VABI __parityti2_nid_postfix(Uint128);
-int APS5_VABI __popcountsi2_nid_postfix(std::uint32_t);
-int APS5_VABI __popcountdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __popcountti2_nid_postfix(Uint128);
-int APS5_VABI __cmpdi2_nid_postfix(std::int64_t, std::int64_t);
-int APS5_VABI __cmpti2_nid_postfix(Int128, Int128);
-int APS5_VABI __ucmpdi2_nid_postfix(std::uint64_t, std::uint64_t);
-int APS5_VABI __ucmpti2_nid_postfix(Uint128, Uint128);
-std::int64_t APS5_VABI __negdi2_nid_postfix(std::int64_t);
-Int128 APS5_VABI __negti2_nid_postfix(Int128);
-std::int64_t APS5_VABI __muldi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __multi3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __divsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __divdi3_nid_postfix(std::int64_t, std::int64_t);
-std::int32_t APS5_VABI __modsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __moddi3_nid_postfix(std::int64_t, std::int64_t);
-std::uint32_t APS5_VABI __udivsi3_nid_postfix(std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI __udivdi3_nid_postfix(std::uint64_t, std::uint64_t);
-std::uint32_t APS5_VABI __umodsi3_nid_postfix(std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI __umoddi3_nid_postfix(std::uint64_t, std::uint64_t);
-std::int32_t APS5_VABI __divmodsi4_nid_postfix(std::int32_t, std::int32_t, std::int32_t*);
-std::int64_t APS5_VABI __divmoddi4_nid_postfix(std::int64_t, std::int64_t, std::int64_t*);
-std::uint32_t APS5_VABI __udivmodsi4_nid_postfix(std::uint32_t, std::uint32_t, std::uint32_t*);
-std::uint64_t APS5_VABI __udivmoddi4_nid_postfix(std::uint64_t, std::uint64_t, std::uint64_t*);
-Uint128 APS5_VABI __udivmodti4_nid_postfix(Uint128, Uint128, Uint128*);
-std::int32_t APS5_VABI __mulosi4_nid_postfix(std::int32_t, std::int32_t, int*);
-std::int64_t APS5_VABI __mulodi4_nid_postfix(std::int64_t, std::int64_t, int*);
-Int128 APS5_VABI __muloti4_nid_postfix(Int128, Int128, int*);
-std::int32_t APS5_VABI __mulvsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __mulvdi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __mulvti3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __addvsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __addvdi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __addvti3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __subvsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __subvdi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __subvti3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __negvsi2_nid_postfix(std::int32_t);
-std::int64_t APS5_VABI __negvdi2_nid_postfix(std::int64_t);
-Int128 APS5_VABI __negvti2_nid_postfix(Int128);
-std::int32_t APS5_VABI __absvsi2_nid_postfix(std::int32_t);
-std::int64_t APS5_VABI __absvdi2_nid_postfix(std::int64_t);
-Int128 APS5_VABI __absvti2_nid_postfix(Int128);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
diff --git a/core/libs/tests/GuestInterfaces.cpp b/core/libs/tests/GuestInterfaces.cpp
index 5b69f12016..6306850521 100644
--- a/core/libs/tests/GuestInterfaces.cpp
+++ b/core/libs/tests/GuestInterfaces.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -7,9 +8,11 @@
 #include <arpa/inet.h>
 #include <ifaddrs.h>
 #include <net/if.h>
-#include <net/if_arp.h>
 #include <netinet/in.h>
+#ifdef __linux__
+#include <net/if_arp.h>
 #include <netpacket/packet.h>
+#endif
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <unistd.h>
@@ -25,15 +28,6 @@
 #include <cstring>
 #include <vector>
 
-struct GuestInterfaceAddress {
-    GuestInterfaceAddress* next;
-    char* name;
-    std::uint32_t flags;
-    void* address;
-    void* netmask;
-    void* destination;
-    void* data;
-};
 static_assert(sizeof(GuestInterfaceAddress) == 56);
 static_assert(offsetof(GuestInterfaceAddress, flags) == 16);
 static_assert(offsetof(GuestInterfaceAddress, address) == 24);
@@ -41,13 +35,6 @@ static_assert(offsetof(GuestInterfaceAddress, netmask) == 32);
 static_assert(offsetof(GuestInterfaceAddress, destination) == 40);
 static_assert(offsetof(GuestInterfaceAddress, data) == 48);
 
-extern "C" {
-int APS5_VABI getifaddrs_nid_postfix(GuestInterfaceAddress** list);
-void APS5_VABI freeifaddrs_nid_postfix(GuestInterfaceAddress* list);
-void APS5_VABI free_nid_postfix(void* pointer);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 struct HostInterfaceAddress {
@@ -76,7 +63,7 @@ static HostInterfaceAddress HostAddress(const sockaddr* address) {
     return entry;
 }
 
-#ifndef _WIN32
+#ifdef __linux__
 static std::uint64_t SysfsCounter(const char* name, const char* file) {
     std::ifstream input(std::string("/sys/class/net/") + name + "/statistics/" + file);
     unsigned long long value = 0;
@@ -151,6 +138,7 @@ static std::vector<HostInterfaceAddress> HostSnapshot() {
     try {
         for (auto* item = host; item; item = item->ifa_next) {
             if (!item->ifa_addr) continue;
+#ifdef __linux__
             if (item->ifa_addr->sa_family == AF_PACKET) {
                 const auto& link = *reinterpret_cast<const sockaddr_ll*>(item->ifa_addr);
                 HostInterfaceAddress entry{};
@@ -165,6 +153,7 @@ static std::vector<HostInterfaceAddress> HostSnapshot() {
                 members.insert(members.begin(), entry);
                 continue;
             }
+#endif
             if (item->ifa_addr->sa_family != AF_INET && item->ifa_addr->sa_family != AF_INET6) continue;
             Require(item->ifa_netmask != nullptr);
             HostInterfaceAddress entry = HostAddress(item->ifa_addr);
@@ -192,7 +181,7 @@ int main() {
     const std::uint8_t loopbackAddress[] = {127, 0, 0, 1};
     const std::uint8_t loopbackMask[] = {255, 0, 0, 0};
     bool matched = false;
-#ifndef _WIN32
+#ifdef __linux__
     bool linkChecked = false;
     SendLoopbackDatagram();
 #endif
@@ -211,7 +200,7 @@ int main() {
             Require((item->flags & ~knownFlags) == 0);
             const auto* address = static_cast<const std::uint8_t*>(item->address);
             Require(address != nullptr && reinterpret_cast<std::uintptr_t>(address) % 8 == 0);
-#ifndef _WIN32
+#ifdef __linux__
             if (address[1] == 18) {
                 Require(item->netmask == nullptr && item->destination == nullptr);
                 const auto* data = static_cast<const std::uint8_t*>(item->data);
@@ -293,15 +282,17 @@ int main() {
         }
         matched = equal && entries == host.size() && loopback;
         freeifaddrs_nid_postfix(list);
+
     }
     Require(matched);
-#ifndef _WIN32
+#ifdef __linux__
     Require(linkChecked);
 #endif
     GuestInterfaceAddress* released = nullptr;
     Require(getifaddrs_nid_postfix(&released) == 0 && released != nullptr);
     free_nid_postfix(released);
     freeifaddrs_nid_postfix(nullptr);
+
     *__error_nid_postfix() = 0;
     Require(getifaddrs_nid_postfix(nullptr) == -1);
     Require(*__error_nid_postfix() == 14);
diff --git a/core/libs/tests/GuestItimer.cpp b/core/libs/tests/GuestItimer.cpp
index 4e1e9d5845..7a688d67d0 100644
--- a/core/libs/tests/GuestItimer.cpp
+++ b/core/libs/tests/GuestItimer.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
@@ -12,33 +14,14 @@
 #include <thread>
 #include <typeinfo>
 
-struct GuestItimerval {
-    KernelTimeval interval;
-    KernelTimeval value;
-};
 static_assert(sizeof(GuestItimerval) == 32 && offsetof(GuestItimerval, value) == 16);
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-struct GuestTimespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
 
 using Handler = void (APS5_VABI *)(int);
 using TerminateHandler = void (*)();
 extern "C" {
-int APS5_VABI setitimer_nid_postfix(int, const GuestItimerval*, GuestItimerval*);
-int APS5_VABI getitimer_nid_postfix(int, GuestItimerval*);
+
 unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int);
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI _sigprocmask_nid_postfix(int, const GuestSignalSet*, GuestSignalSet*);
-int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet*, void*, const GuestTimespec*);
-int APS5_VABI sigpending_nid_postfix(GuestSignalSet*);
-int* APS5_VABI __error_nid_postfix();
-void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
-std::type_info* APS5_VABI __cxa_current_exception_type_nid_postfix();
-TerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(TerminateHandler);
+
 }
 
 static void Require(bool value, const char* message) {
@@ -140,6 +123,7 @@ int main(int argc, char** argv) {
         bool threw = false;
         try {
             setitimer_nid_postfix(cpu, &valid, &previous);
+
         } catch (const std::runtime_error&) {
             threw = true;
         }
@@ -150,6 +134,7 @@ int main(int argc, char** argv) {
     const GuestItimerval tiny{{0, 999}, {1, 0}};
     try {
         setitimer_nid_postfix(0, &tiny, nullptr);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -189,8 +174,8 @@ int main(int argc, char** argv) {
     Require(GuestAlarm_nid_no_patch(0) == 0, "setitimer did not cancel the alarm");
 
     const GuestSignalSet alarmSet{{1u << 13, 0, 0, 0}};
-    const GuestTimespec poll{0, 0};
-    const GuestTimespec patience{2, 0};
+    const KernelTimespec poll{0, 0};
+    const KernelTimespec patience{2, 0};
     GuestSignalSet unblocked{};
     Require(_sigprocmask_nid_postfix(1, &alarmSet, &unblocked) == 0, "blocking SIGALRM failed");
     ExpireOnce();
@@ -220,6 +205,7 @@ int main(int argc, char** argv) {
 
     Require(signal_nid_postfix(14, OnAlarm) == ignore, "SIGALRM handler was not installed");
     _ZSt13set_terminatePFvvE_nid_postfix(OnTerminate);
+
     const GuestItimerval handled{{0, 250000}, {0, 50000}};
     Require(setitimer_nid_postfix(0, &handled, nullptr) == 0, "arming the handled timer failed");
     std::this_thread::sleep_for(std::chrono::seconds(2));
diff --git a/core/libs/tests/GuestJitSharedMemory.cpp b/core/libs/tests/GuestJitSharedMemory.cpp
index 66ed8a4838..02a9cf253f 100644
--- a/core/libs/tests/GuestJitSharedMemory.cpp
+++ b/core/libs/tests/GuestJitSharedMemory.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstddef>
@@ -7,19 +8,6 @@
 #include <cstring>
 #include <source_location>
 
-extern "C" {
-int APS5_VABI sceKernelJitCreateSharedMemory(const char*, std::size_t, int, int*);
-int APS5_VABI sceKernelJitCreateAliasOfSharedMemory(int, int, int*);
-int APS5_VABI sceKernelJitMapSharedMemory(int, int, void**);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-}
-
 namespace {
 
 constexpr std::size_t Size = 0x10000;
@@ -79,10 +67,10 @@ void WriteThroughAliasRunsThroughExecutableView() {
     Require(close_nid_postfix(fd) == 0);
     auto* again = static_cast<unsigned char*>(Map(alias, Read));
     Require(again[Size - 1] == 0x5a);
-    Require(sceKernelMunmap(again, Size) == 0);
-    Require(sceKernelMunmap(writable, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(writable), Size) == 0);
     Require(Call(executable) == 0x12345678);
-    Require(sceKernelMunmap(executable, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(executable), Size) == 0);
     Require(close_nid_postfix(alias) == 0);
 }
 
@@ -98,8 +86,8 @@ void OneViewWritesAndRuns() {
     Require(close_nid_postfix(fd) == 0);
     auto* view = static_cast<unsigned char*>(Map(duplicate, Read | Execute));
     Require(Call(view) == 42);
-    Require(sceKernelMunmap(view, Size) == 0);
-    Require(sceKernelMunmap(code, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(view), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(code), Size) == 0);
     Require(close_nid_postfix(duplicate) == 0);
 }
 
@@ -114,7 +102,7 @@ void MmapOfTheDescriptorSharesTheObject() {
     view[0x300] = 0x6b;
     Require(jit[0x300] == 0x6b);
     Require(munmap_nid_postfix(mapped, Size) == 0);
-    Require(sceKernelMunmap(const_cast<unsigned char*>(jit), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(const_cast<unsigned char*>(jit)), Size) == 0);
     Require(close_nid_postfix(fd) == 0);
 }
 
@@ -138,9 +126,9 @@ void Dup2KeepsTheDescriptorTableInStep() {
     address = nullptr;
     Require(sceKernelJitMapSharedMemory(target, Read, &address) == SCE_KERNEL_ERROR_EBADF);
     Require(address == nullptr);
-    Require(sceKernelMunmap(same, Size) == 0);
-    Require(sceKernelMunmap(readable, Size) == 0);
-    Require(sceKernelMunmap(writable, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(same), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(readable), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(writable), Size) == 0);
     Require(close_nid_postfix(plain) == 0);
     Require(close_nid_postfix(target) == 0);
     Require(close_nid_postfix(fd) == 0);
@@ -187,6 +175,8 @@ int main() {
     WriteThroughAliasRunsThroughExecutableView();
     OneViewWritesAndRuns();
     Dup2KeepsTheDescriptorTableInStep();
+#ifndef __APPLE__
     MmapOfTheDescriptorSharesTheObject();
+#endif
     InvalidArgumentsAreRejected();
 }
diff --git a/core/libs/tests/GuestJobManager.cpp b/core/libs/tests/GuestJobManager.cpp
index 7258ae6694..af4995720a 100644
--- a/core/libs/tests/GuestJobManager.cpp
+++ b/core/libs/tests/GuestJobManager.cpp
@@ -1,4 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libSceJobManager/libSceJobManager.hpp"
 #include "SceTypes.hpp"
+#include <array>
 #include <atomic>
 #include <chrono>
 #include <cstdint>
@@ -9,61 +13,9 @@
 #include <string>
 #include <thread>
 #include <vector>
-
-struct MemorySizeQueryParams {
-    std::uint32_t version;
-    std::uint32_t workers;
-    std::uint32_t sequences;
-    std::uint32_t invocations;
-    std::uint32_t dispatches;
-    std::uint32_t syncPoints;
-    std::uint32_t waits;
-    std::uint32_t computeSequences;
-    std::uint64_t computeQueueMask;
-};
-
-struct ConfigParams {
-    std::uint32_t version;
-    std::uint32_t threadFlags;
-    std::uint32_t stackSize;
-    std::uint32_t priority;
-    const char* threadName;
-    std::uint32_t spinMicroseconds;
-    std::uint32_t computeAffinity;
-    std::uint32_t computePriority;
-    std::uint32_t reserved;
-};
-
-using JobEntry = void (APS5_VABI*)(void*, std::uint32_t);
-
-struct Sequence {
-    APS5_VABI virtual int Dispatch(JobEntry, void*, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int SyncPoint() = 0;
-    APS5_VABI virtual int Wait() = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-};
-
-struct SequenceFactory {
-    APS5_VABI virtual int Create(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int Destroy(Sequence*) = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-    APS5_VABI virtual int CreateCompute(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int DestroyCompute(Sequence*) = 0;
-};
-
-extern "C" {
-void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void*);
-void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void*);
-std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams*);
-int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void*, void*, std::uint64_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint64_t, const ConfigParams*);
-int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(void*, void*, std::uint64_t, std::uint32_t, std::uint32_t, const ConfigParams*);
-int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void*);
-SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(void*, std::uint32_t);
-SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void*, std::uint32_t);
-int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void*, std::uint32_t);
-}
+#ifdef _WIN32
+#include <windows.h>
+#endif
 
 #define Construct _ZN3sce3Job10JobManagerC1Ev
 #define Destruct _ZN3sce3Job10JobManagerD1Ev
@@ -137,6 +89,46 @@ static void MemoryCase() {
 static void APS5_VABI Nothing(void*, std::uint32_t) {
 }
 
+static void OwnedStateCase() {
+    for (const auto [workers, count] : {std::pair{1u, 1u}, std::pair{3u, 32u}, std::pair{13u, 2u}}) {
+        const auto size = SizeFor(workers, count, count * 4, count * 2, count * 2);
+        Block block(size + 256);
+        std::memset(block.memory, 0xa5, block.bytes);
+        ManagerObject manager;
+        const auto begin = reinterpret_cast<std::uintptr_t>(block.memory);
+        const auto inside = [begin, size](const void* pointer) {
+            const auto address = reinterpret_cast<std::uintptr_t>(pointer);
+            return address >= begin && address < begin + size;
+        };
+        for (int round = 0; round < 3; ++round) {
+            Require(Initialize(manager.storage, block.memory, size, workers, count, nullptr) == 0);
+            void* implementation = nullptr;
+            std::memcpy(&implementation, manager.storage, sizeof(implementation));
+            Require(inside(implementation));
+            for (std::uint32_t priority = 0; priority < 2; ++priority) {
+                Require(inside(Factories(manager.storage, priority)));
+                Require(inside(UnifiedFactories(manager.storage, priority)));
+            }
+            auto* factory = Factories(manager.storage, round % 2);
+            std::array<ISequence*, 32> sequences{};
+            for (std::uint32_t index = 0; index < count; ++index) {
+                auto*& sequence = sequences[index];
+                Require(factory->Create(&sequence, 4, 4, 2, 2, nullptr) == 0 && inside(sequence));
+                Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0);
+                Require(sequence->SyncPoint() == 0);
+                Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0);
+            }
+            for (std::uint32_t index = count; index != 0; --index) {
+                Require(sequences[index - 1]->Wait() == 0);
+                Require(factory->Destroy(sequences[index - 1]) == 0);
+            }
+            Require(Shutdown(manager.storage) == 0);
+            const auto* bytes = static_cast<const std::uint8_t*>(block.memory);
+            for (auto offset = size; offset < block.bytes; ++offset) Require(bytes[offset] == 0xa5);
+        }
+    }
+}
+
 static void ValidationCase() {
     Block block(SizeFor(2, 2, 16, 4, 4));
     ManagerObject manager;
@@ -176,10 +168,10 @@ static void ValidationCase() {
     Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == AlreadyInitialized);
     Require(SetPersistentThreadCount(manager.storage, 3) == InvalidArgument);
     Require(SetPersistentThreadCount(manager.storage, 2) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
     Require(factory != nullptr && Factories(manager.storage, 1) != nullptr && factory != Factories(manager.storage, 1));
     Require(UnifiedFactories(manager.storage, 0) != nullptr);
-    Sequence* sequence = nullptr;
+    ISequence* sequence = nullptr;
     Require(factory->Create(nullptr, 1, 1, 1, 1, nullptr) == NullArgument);
     Require(factory->Create(&sequence, 0, 0, 0, 0, nullptr) == OutOfRange);
     Require(factory->Create(&sequence, 0x8000, 1, 1, 1, nullptr) == OutOfRange);
@@ -187,13 +179,13 @@ static void ValidationCase() {
     Require(factory->Create(&sequence, 1, 1, 0x100, 1, nullptr) == OutOfRange);
     Require(factory->Create(&sequence, 1, 1, 1, 0x40, nullptr) == OutOfRange);
     Require(factory->CreateCompute(&sequence, 1, 1, 1, 1, nullptr) == NoneFree && sequence == nullptr);
-    Sequence* first = nullptr;
-    Sequence* second = nullptr;
+    ISequence* first = nullptr;
+    ISequence* second = nullptr;
     Require(factory->Create(&first, 8, 8, 2, 2, "first") == 0 && first != nullptr);
     Require(factory->Create(&second, 8, 8, 2, 2, "second") == 0 && second != nullptr && second != first);
     Require(factory->Create(&sequence, 8, 8, 2, 2, "third") == NoneFree);
     Require(factory->DestroyCompute(first) == Invalid);
-    Require(factory->Destroy(reinterpret_cast<Sequence*>(block.memory)) == Invalid);
+    Require(factory->Destroy(reinterpret_cast<ISequence*>(block.memory)) == Invalid);
     Require(factory->Destroy(first) == 0 && factory->Destroy(first) == Invalid);
     Require(factory->Create(&sequence, 8, 8, 2, 2, "again") == 0 && sequence == first);
     Require(sequence->Dispatch(nullptr, nullptr, 1, nullptr) == NullArgument);
@@ -219,8 +211,8 @@ static void DispatchCase() {
     Block block(SizeFor(4, 1, 8, 2, 2));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
-    Sequence* sequence = nullptr;
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 0x7fff, 8, 2, 2, "dispatch") == 0);
     Tally tally(1000);
     Tally single(1);
@@ -251,8 +243,8 @@ static void OrderingCase() {
     Block block(SizeFor(4, 1, 8, 4, 2));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 1);
-    Sequence* sequence = nullptr;
+    ISequenceFactory* factory = Factories(manager.storage, 1);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 256, 8, 4, 2, "ordering") == 0);
     std::atomic<std::uint32_t> finished{0};
     std::atomic<std::uint32_t> early{0};
@@ -273,7 +265,7 @@ static void OrderingCase() {
 }
 
 struct Nested {
-    Sequence* sequence;
+    ISequence* sequence;
     std::atomic<bool> barrierAppended{false};
     std::atomic<bool> followerAppended{false};
     std::atomic<bool> leaderFinished{false};
@@ -295,11 +287,66 @@ static void APS5_VABI LeaderJob(void* argument, std::uint32_t) {
     nested.leaderFinished = true;
 }
 
+static void RequireParked(int clock);
+
+struct WorkerWait {
+    int spareClock = 0;
+    ISequence* child;
+    std::atomic<bool> publisherEntered{false};
+    std::atomic<bool> spareEntered{false};
+    std::atomic<bool> publish{false};
+    std::atomic<bool> finished{false};
+    std::atomic<unsigned> childCalls{0};
+};
+
+static void APS5_VABI WorkerWaitChild(void* argument, std::uint32_t) {
+    ++static_cast<WorkerWait*>(argument)->childCalls;
+}
+
+static void APS5_VABI WorkerWaitPublisher(void* argument, std::uint32_t index) {
+    auto& state = *static_cast<WorkerWait*>(argument);
+    if (index != 0) {
+        Require(pthread_getcpuclockid_nid_postfix(scePthreadSelf(), &state.spareClock) == 0);
+        state.spareEntered = true;
+        return;
+    }
+    state.publisherEntered = true;
+    while (!state.publish) std::this_thread::yield();
+    Require(state.child->Dispatch(WorkerWaitChild, &state, 1, "child") == 0);
+    Require(state.child->Wait() == 0);
+    state.finished = true;
+}
+
+static void WorkerWaitCase() {
+    Block block(SizeFor(2, 2, 4, 0, 4));
+    ManagerObject manager;
+    const ConfigParams config{0, 0x21fff, 0x10000, 0x2bc, "WorkerWait", 0, 0, 0, 0};
+    Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, &config) == 0);
+    Require(SetPersistentThreadCount(manager.storage, 0) == 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* publisher = nullptr;
+    WorkerWait state{};
+    Require(factory->Create(&publisher, 2, 1, 0, 1, "publisher") == 0);
+    Require(factory->Create(&state.child, 1, 1, 0, 1, "child") == 0);
+    Require(publisher->Dispatch(WorkerWaitPublisher, &state, 2, "park spare") == 0);
+    auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+    while ((!state.publisherEntered || !state.spareEntered) && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(state.publisherEntered && state.spareEntered);
+    RequireParked(state.spareClock);
+    state.publish = true;
+    deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+    while (!state.finished && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(state.finished && state.childCalls == 1);
+    Require(publisher->Wait() == 0);
+    Require(factory->Destroy(publisher) == 0 && factory->Destroy(state.child) == 0);
+    Require(Shutdown(manager.storage) == 0);
+}
+
 static void NestedCase() {
     Block block(SizeFor(2, 1, 4, 2, 2));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 2, 1, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
     Nested nested{};
     Require(factory->Create(&nested.sequence, 16, 4, 2, 2, "nested") == 0);
     Require(nested.sequence->Dispatch(LeaderJob, &nested, 1, "leader") == 0);
@@ -323,8 +370,8 @@ static void LimitsCase() {
     Block block(SizeFor(2, 2, 2, 1, 1));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
-    Sequence* sequence = nullptr;
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 4, 2, 1, 1, "limits") == 0);
     for (int round = 0; round < 3; ++round) {
         Require(sequence->Dispatch(Nothing, nullptr, 2, nullptr) == 0);
@@ -348,6 +395,15 @@ static void LimitsCase() {
     Require(factory->Create(&sequence, 4, 2, 1, 1, "waits") == 0);
     Require(sequence->Wait() == 0 && sequence->Wait() == 0);
     Require(factory->Destroy(sequence) == 0);
+    Require(Shutdown(manager.storage) == 0);
+}
+
+static void NodePoolCase() {
+    Block block(SizeFor(2, 2, 2, 1, 1));
+    ManagerObject manager;
+    Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 0x7fff, 0x3ff, 0xff, 1, "nodes") == 0);
     int result = 0;
     int accepted = 0;
@@ -413,9 +469,9 @@ static void PriorityCase() {
     Block block(SizeFor(1, 3, 8, 2, 4));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 1, 3, nullptr) == 0);
-    Sequence* gate = nullptr;
-    Sequence* low = nullptr;
-    Sequence* high = nullptr;
+    ISequence* gate = nullptr;
+    ISequence* low = nullptr;
+    ISequence* high = nullptr;
     Require(Factories(manager.storage, 0)->Create(&gate, 4, 4, 1, 1, "gate") == 0);
     Require(Factories(manager.storage, 0)->Create(&low, 4, 4, 1, 1, "low") == 0);
     Require(Factories(manager.storage, 1)->Create(&high, 4, 4, 1, 1, "high") == 0);
@@ -437,8 +493,8 @@ static void ShutdownCase() {
     ManagerObject manager;
     for (int round = 0; round < 3; ++round) {
         Require(Initialize(manager.storage, block.memory, block.bytes, 3, 2, nullptr) == 0);
-        SequenceFactory* factory = UnifiedFactories(manager.storage, 0);
-        Sequence* sequence = nullptr;
+        ISequenceFactory* factory = UnifiedFactories(manager.storage, 0);
+        ISequence* sequence = nullptr;
         Tally tally(64);
         Require(factory->Create(&sequence, 64, 8, 2, 2, "shutdown") == 0);
         Require(sequence->Dispatch(CountJob, &tally, 64, nullptr) == 0 && sequence->Wait() == 0 && tally.calls == 64);
@@ -453,16 +509,416 @@ static void ShutdownCase() {
     }
 }
 
-int main(int argc, char** argv) {
-    const std::string name = argc > 1 ? argv[1] : "";
+static void APS5_VABI CaptureWorkerClock(void* argument, std::uint32_t) {
+    Require(pthread_getcpuclockid_nid_postfix(scePthreadSelf(), static_cast<int*>(argument)) == 0);
+}
+
+static std::int64_t CpuNanos(int clock) {
+    KernelTimespec time{};
+    Require(sceKernelClockGettime(clock, &time) == 0);
+    return time.tv_sec * 1000000000LL + time.tv_nsec;
+}
+
+static void RequireParked(int clock) {
+    std::this_thread::sleep_for(std::chrono::milliseconds(30));
+    const auto start = CpuNanos(clock);
+    std::this_thread::sleep_for(std::chrono::milliseconds(80));
+    Require(CpuNanos(clock) - start < 20000000);
+}
+
+static void WorkerPolicyCase() {
+    for (const std::uint32_t mode : {0x10000u, 0x20000u}) {
+        for (const std::uint32_t spin : {0u, 50u}) {
+            Block block(SizeFor(1, 1, 8, 2, 2));
+            ManagerObject manager;
+            const ConfigParams config{0, mode | 0x1fff, 0x10000, 0x2bc, "WorkerPolicy", spin, 0, 0, 0};
+            Require(Initialize(manager.storage, block.memory, block.bytes, 1, 1, &config) == 0);
+            auto* factory = Factories(manager.storage, 0);
+            ISequence* sequence = nullptr;
+            Require(factory->Create(&sequence, 8, 8, 2, 2, "worker policy") == 0);
+            int clock = 0;
+            Require(sequence->Dispatch(CaptureWorkerClock, &clock, 1, nullptr) == 0 && sequence->Wait() == 0);
+            RequireParked(clock);
+            for (int round = 0; round < 2; ++round) {
+                Require(SetPersistentThreadCount(manager.storage, 1) == 0);
+                RequireParked(clock);
+                Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0);
+                const auto start = CpuNanos(clock);
+                const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+                while (CpuNanos(clock) - start < 30000000 && std::chrono::steady_clock::now() < deadline) {
+                    std::this_thread::sleep_for(std::chrono::milliseconds(10));
+                }
+                Require(CpuNanos(clock) - start >= 30000000);
+                Require(SetPersistentThreadCount(manager.storage, 0) == 0);
+                RequireParked(clock);
+            }
+            Require(SetPersistentThreadCount(manager.storage, 1) == 0);
+            Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0);
+            Require(Shutdown(manager.storage) == 0);
+        }
+    }
+}
+
+static void WorkerWakeCase() {
+    Block block(SizeFor(4, 1, 8, 2, 2));
+    ManagerObject manager;
+    for (const std::uint32_t mode : {0x10000u, 0x20000u}) {
+        const ConfigParams config{0, mode | 0x1fff, 0x10000, 0x2bc, "WorkerWake", 50, 0, 0, 0};
+        Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, &config) == 0);
+        ISequence* sequence = nullptr;
+        auto* factory = Factories(manager.storage, 0);
+        Require(factory->Create(&sequence, 1024, 8, 2, 2, "worker wake") == 0);
+        for (std::uint32_t round = 0; round < 60; ++round) {
+            Require(SetPersistentThreadCount(manager.storage, round % 5) == 0);
+            Tally tally(257);
+            Require(sequence->Dispatch(CountJob, &tally, 257, nullptr) == 0);
+            Require(sequence->SyncPoint() == 0);
+            Require(sequence->Dispatch(CountJob, &tally, 257, nullptr) == 0);
+            Require(sequence->Wait() == 0 && tally.calls == 514);
+            for (const auto& count : tally.seen) Require(count == 2);
+        }
+        Require(factory->Destroy(sequence) == 0);
+        Require(Shutdown(manager.storage) == 0);
+    }
+}
+
+struct HeldWorker {
+    std::atomic<bool> started{false};
+    std::atomic<bool> release{false};
+};
+
+struct SpinClock {
+    int guest = 0;
+    std::int64_t reference = 0;
+#ifdef _WIN32
+    HANDLE thread = nullptr;
+    ~SpinClock() { if (thread != nullptr) CloseHandle(thread); }
+#endif
+};
+
+static std::int64_t SpinCpuUnits(const SpinClock& clock);
+
+static void APS5_VABI CaptureSpinClock(void* argument, std::uint32_t) {
+    auto& clock = *static_cast<SpinClock*>(argument);
+    CaptureWorkerClock(&clock.guest, 0);
+#ifdef _WIN32
+    clock.thread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION, FALSE, GetCurrentThreadId());
+    Require(clock.thread != nullptr);
+#endif
+    const auto before = SpinCpuUnits(clock);
+    const auto until = std::chrono::steady_clock::now() + std::chrono::milliseconds(5);
+    while (std::chrono::steady_clock::now() < until) {}
+    clock.reference = SpinCpuUnits(clock) - before;
+    Require(clock.reference > 0);
+}
+
+static std::int64_t SpinCpuUnits(const SpinClock& clock) {
+#ifdef _WIN32
+    ULONG64 cycles = 0;
+    Require(QueryThreadCycleTime(clock.thread, &cycles));
+    return static_cast<std::int64_t>(cycles);
+#else
+    return CpuNanos(clock.guest);
+#endif
+}
+
+static void APS5_VABI HoldWorker(void* argument, std::uint32_t) {
+    auto& worker = *static_cast<HeldWorker*>(argument);
+    worker.started = true;
+    worker.started.notify_one();
+    worker.release.wait(false);
+}
+
+struct SpinSample {
+    std::int64_t consumed;
+    std::int64_t reference;
+};
+
+static SpinSample MeasureWorkerSpin(std::uint32_t spin, std::uint32_t rounds, bool pending) {
+    Block block(SizeFor(2, 2, 4, 2, 2));
+    ManagerObject manager;
+    const ConfigParams config{0, 0x10003, 0x10000, 0x2bc, "WorkerSpin", spin, 0, 0, 0};
+    Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, &config) == 0);
+    auto* factory = Factories(manager.storage, 0);
+    ISequence* held = nullptr;
+    ISequence* pulse = nullptr;
+    Require(factory->Create(&held, 4, 4, 2, 2, "held worker") == 0);
+    Require(factory->Create(&pulse, 4, 4, 2, 2, "idle worker") == 0);
+    HeldWorker worker;
+    Require(held->Dispatch(HoldWorker, &worker, 1, nullptr) == 0);
+    worker.started.wait(false);
+    if (pending) {
+        Require(held->SyncPoint() == 0);
+        Require(held->Dispatch(Nothing, nullptr, 1, nullptr) == 0);
+    }
+    SpinClock clock;
+    Require(pulse->Dispatch(CaptureSpinClock, &clock, 1, nullptr) == 0 && pulse->Wait() == 0);
+    RequireParked(clock.guest);
+    const auto before = SpinCpuUnits(clock);
+    for (std::uint32_t round = 0; round < rounds; ++round) {
+        Require(pulse->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && pulse->Wait() == 0);
+        Require(sceKernelUsleep_nid_postfix(1000) == 0);
+    }
+    const auto consumed = SpinCpuUnits(clock) - before;
+    RequireParked(clock.guest);
+    Require(!worker.release);
+    worker.release = true;
+    worker.release.notify_one();
+    Require(held->Wait() == 0);
+    Require(factory->Destroy(held) == 0 && factory->Destroy(pulse) == 0);
+    Require(Shutdown(manager.storage) == 0);
+    return {consumed, clock.reference};
+}
+
+static SpinSample QuietestWorkerSpin(std::uint32_t spin, std::uint32_t rounds, bool pending) {
+    auto best = MeasureWorkerSpin(spin, rounds, pending);
+    for (int attempt = 1; attempt < 3; ++attempt) {
+        const auto sample = MeasureWorkerSpin(spin, rounds, pending);
+        if (sample.consumed < best.consumed) {
+            best = sample;
+        }
+    }
+    return best;
+}
+
+static void WorkerSpinCase() {
+    constexpr std::uint32_t rounds = 512;
+    const auto parked = MeasureWorkerSpin(0, rounds, true);
+    const auto spinning = MeasureWorkerSpin(50, rounds, true);
+    const auto noPending = QuietestWorkerSpin(50, rounds, false);
+#ifdef _WIN32
+    constexpr const char* units = "cycles";
+#else
+    constexpr const char* units = "ns";
+#endif
+    std::fprintf(stderr, "idle worker CPU over %u pulses (%s): spin=0 %lld, spin=50 %lld, no pending work %lld, 5ms active reference %lld\n", rounds, units,
+        static_cast<long long>(parked.consumed), static_cast<long long>(spinning.consumed), static_cast<long long>(noPending.consumed), static_cast<long long>(spinning.reference));
+    const auto interval = spinning.reference * rounds / 100;
+    Require(spinning.consumed > parked.consumed + interval / 3);
+    Require(spinning.consumed < parked.consumed + interval * 5);
+    Require(noPending.consumed < parked.consumed + interval / 3);
+}
+
+struct WorkerClocks {
+    std::array<int, 4> clocks{};
+    std::atomic<unsigned int> arrived{0};
+    std::atomic<bool> release{false};
+};
+
+static void APS5_VABI CaptureWorkerClocks(void* argument, std::uint32_t index) {
+    auto& workers = *static_cast<WorkerClocks*>(argument);
+    CaptureWorkerClock(&workers.clocks[index], 0);
+    ++workers.arrived;
+    while (!workers.release) std::this_thread::yield();
+}
+
+static void WorkerCountCase() {
+    Block block(SizeFor(4, 1, 8, 2, 2));
+    ManagerObject manager;
+    const ConfigParams config{0, 0x1000f, 0x10000, 0x2bc, "WorkerCount", 0, 0, 0, 0};
+    Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, &config) == 0);
+    ISequence* sequence = nullptr;
+    Require(Factories(manager.storage, 0)->Create(&sequence, 8, 8, 2, 2, "worker count") == 0);
+    WorkerClocks workers;
+    Require(sequence->Dispatch(CaptureWorkerClocks, &workers, 4, nullptr) == 0);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    while (workers.arrived != 4 && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(workers.arrived == 4);
+    workers.release = true;
+    Require(sequence->Wait() == 0);
+    for (const std::uint32_t persistent : {2u, 4u}) {
+        Require(SetPersistentThreadCount(manager.storage, 0) == 0);
+        for (const int clock : workers.clocks) RequireParked(clock);
+        Require(SetPersistentThreadCount(manager.storage, persistent) == 0);
+        for (std::uint32_t job = 0; job < persistent; ++job) {
+            Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0);
+        }
+        std::array<std::int64_t, 4> starts{};
+        for (std::size_t index = 0; index < starts.size(); ++index) starts[index] = CpuNanos(workers.clocks[index]);
+        const auto until = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+        unsigned int active = 0;
+        do {
+            std::this_thread::sleep_for(std::chrono::milliseconds(20));
+            active = 0;
+            for (std::size_t index = 0; index < starts.size(); ++index) {
+                if (CpuNanos(workers.clocks[index]) - starts[index] >= 30000000) ++active;
+            }
+        } while (active < persistent && std::chrono::steady_clock::now() < until);
+        Require(active == persistent);
+    }
+    Require(Shutdown(manager.storage) == 0);
+}
+
+static void APS5_VABI ShutdownGateJob(void* argument, std::uint32_t index) {
+    GateJob(argument, index);
+    ++static_cast<Order*>(argument)->next;
+}
+
+static void ShutdownActiveCase(bool wait, bool queue, bool destroy, std::uint32_t count = 1) {
+    for (int round = 0; round < 3; ++round) {
+        Block block(SizeFor(1, 1, 4, 2, 2));
+        ManagerObject manager;
+        Require(Initialize(manager.storage, block.memory, block.bytes, 1, 1, nullptr) == 0);
+        ISequenceFactory* factory = Factories(manager.storage, 0);
+        ISequence* sequence = nullptr;
+        Require(factory->Create(&sequence, 4, 4, 2, 2, "shutdown active") == 0);
+        Order order;
+        Require(sequence->Dispatch(ShutdownGateJob, &order, count, nullptr) == 0);
+        while (!order.started) std::this_thread::yield();
+        if (queue) {
+            Require(sequence->SyncPoint() == 0);
+            Require(sequence->Dispatch(LowJob, &order, 1, nullptr) == 0);
+        }
+        std::atomic<bool> entered{false};
+        std::atomic<bool> returned{false};
+        std::thread waiter;
+        if (wait) {
+            waiter = std::thread([&] {
+                entered = true;
+                Require(destroy ? factory->Destroy(sequence) == 0 : sequence->Wait() == 0);
+                returned = true;
+            });
+            while (!entered) std::this_thread::yield();
+            std::this_thread::sleep_for(std::chrono::milliseconds(30));
+            Require(!returned);
+        }
+        std::atomic<bool> stopping{false};
+        std::atomic<bool> stopped{false};
+        std::thread shutdown([&] {
+            stopping = true;
+            Require(Shutdown(manager.storage) == 0);
+            stopped = true;
+        });
+        while (!stopping) std::this_thread::yield();
+        std::this_thread::sleep_for(std::chrono::milliseconds(30));
+        Require(!stopped);
+        order.release = true;
+        shutdown.join();
+        if (waiter.joinable()) waiter.join();
+        Require(stopped && (!wait || returned));
+        Require(order.next == 1);
+        Require(Factories(manager.storage, 0) == nullptr);
+        Require(Initialize(manager.storage, block.memory, block.bytes, 1, 1, nullptr) == 0);
+        Require(Shutdown(manager.storage) == 0);
+    }
+}
+
+struct ShutdownCrossWait {
+    ISequence* sequence;
+    std::atomic<bool> entered{false};
+    std::atomic<bool> returned{false};
+};
+
+static void APS5_VABI ShutdownWaitOther(void* argument, std::uint32_t) {
+    auto& state = *static_cast<ShutdownCrossWait*>(argument);
+    state.entered = true;
+    Require(state.sequence->Wait() == 0);
+    state.returned = true;
+}
+
+static void ConcurrentWaitCase() {
+    for (const bool stop : {false, true}) {
+        for (int round = 0; round < 3; ++round) {
+            Block block(SizeFor(2, 1, 4, 2, 8));
+            ManagerObject manager;
+            Require(Initialize(manager.storage, block.memory, block.bytes, 2, 1, nullptr) == 0);
+            auto* factory = Factories(manager.storage, 0);
+            ISequence* sequence = nullptr;
+            Require(factory->Create(&sequence, 2, 2, 1, 8, nullptr) == 0);
+            Order order;
+            Require(sequence->Dispatch(ShutdownGateJob, &order, 1, nullptr) == 0);
+            while (!order.started) std::this_thread::yield();
+            std::atomic<std::uint32_t> entered{0};
+            std::atomic<std::uint32_t> returned{0};
+            std::array<std::thread, 4> waiters;
+            for (auto& waiter : waiters) waiter = std::thread([&] {
+                ++entered;
+                Require(sequence->Wait() == 0);
+                ++returned;
+            });
+            while (entered != waiters.size()) std::this_thread::yield();
+            std::this_thread::sleep_for(std::chrono::milliseconds(50));
+            Require(returned == 0);
+            std::thread shutdown;
+            if (stop) {
+                shutdown = std::thread([&] { Require(Shutdown(manager.storage) == 0); });
+                std::this_thread::sleep_for(std::chrono::milliseconds(50));
+            }
+            order.release = true;
+            for (auto& waiter : waiters) waiter.join();
+            Require(returned == waiters.size() && order.next == 1);
+            if (stop) shutdown.join();
+            else {
+                Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0);
+                Require(factory->Destroy(sequence) == 0);
+                Require(Shutdown(manager.storage) == 0);
+            }
+        }
+    }
+}
+
+static void ShutdownCrossWaitCase() {
+    Block block(SizeFor(2, 2, 4, 2, 2));
+    ManagerObject manager;
+    Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == 0);
+    auto* factory = Factories(manager.storage, 0);
+    ISequence* producer = nullptr;
+    ISequence* consumer = nullptr;
+    Require(factory->Create(&producer, 1, 1, 1, 1, nullptr) == 0);
+    Require(factory->Create(&consumer, 1, 1, 1, 1, nullptr) == 0);
+    Order order;
+    Require(producer->Dispatch(ShutdownGateJob, &order, 1, nullptr) == 0);
+    while (!order.started) std::this_thread::yield();
+    ShutdownCrossWait state{producer};
+    Require(consumer->Dispatch(ShutdownWaitOther, &state, 1, nullptr) == 0);
+    while (!state.entered) std::this_thread::yield();
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    Require(!state.returned);
+    std::atomic<bool> stopping{false};
+    std::atomic<bool> stopped{false};
+    std::thread shutdown([&] {
+        stopping = true;
+        Require(Shutdown(manager.storage) == 0);
+        stopped = true;
+    });
+    while (!stopping) std::this_thread::yield();
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    Require(!stopped);
+    order.release = true;
+    shutdown.join();
+    Require(state.returned && stopped && order.next == 1);
+}
+
+int RunJobManagerCase(const char* caseName) {
+    const std::string name = caseName;
     if (name == "memory") MemoryCase();
+    else if (name == "owned_state") OwnedStateCase();
     else if (name == "validation") ValidationCase();
     else if (name == "dispatch") DispatchCase();
     else if (name == "ordering") OrderingCase();
     else if (name == "limits") LimitsCase();
+    else if (name == "node_pool") NodePoolCase();
     else if (name == "nested") NestedCase();
     else if (name == "priority") PriorityCase();
     else if (name == "shutdown") ShutdownCase();
+    else if (name == "worker_policy") WorkerPolicyCase();
+    else if (name == "worker_wait") WorkerWaitCase();
+    else if (name == "worker_wake") WorkerWakeCase();
+    else if (name == "worker_spin") WorkerSpinCase();
+    else if (name == "worker_count") WorkerCountCase();
+    else if (name == "shutdown_running") ShutdownActiveCase(false, false, false);
+    else if (name == "shutdown_waiter") ShutdownActiveCase(true, false, false);
+    else if (name == "shutdown_queued") ShutdownActiveCase(true, true, false);
+    else if (name == "shutdown_destroy") ShutdownActiveCase(true, true, true);
+    else if (name == "shutdown_partial") ShutdownActiveCase(true, false, false, 4);
+    else if (name == "shutdown_cross_wait") ShutdownCrossWaitCase();
+    else if (name == "concurrent_wait") ConcurrentWaitCase();
     else return 2;
     return 0;
 }
+
+#ifndef ANYPS5_JOB_MANAGER_REFERENCE
+int main(int argc, char** argv) {
+    return RunJobManagerCase(argc > 1 ? argv[1] : "");
+}
+#endif
diff --git a/core/libs/tests/GuestJpegDec.cpp b/core/libs/tests/GuestJpegDec.cpp
index 6a8273a54e..6c6183b175 100644
--- a/core/libs/tests/GuestJpegDec.cpp
+++ b/core/libs/tests/GuestJpegDec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegDec/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Jpeg.hpp"
@@ -25,14 +26,6 @@ static_assert(offsetof(JpegDecImageInfo, component_id) == 0xC && offsetof(JpegDe
 static_assert(offsetof(JpegDecImageInfo, coefficient_mem_size) == 0x14 && offsetof(JpegDecImageInfo, suitable_csc_attribute) == 0x18);
 static_assert(offsetof(JpegDecImageInfo, output_image_width) == 0x1C && offsetof(JpegDecImageInfo, output_image_height) == 0x20);
 
-extern "C" {
-std::int32_t APS5_VABI sceJpegDecQueryMemorySize(const JpegDecCreateParam*);
-std::int32_t APS5_VABI sceJpegDecCreate(const JpegDecCreateParam*, void*, std::uint32_t, void**);
-std::int32_t APS5_VABI sceJpegDecDelete(void*);
-std::int32_t APS5_VABI sceJpegDecParseHeader(const JpegDecParseParam*, JpegDecImageInfo*);
-std::int32_t APS5_VABI sceJpegDecDecode(void*, const JpegDecDecodeParam*, JpegDecImageInfo*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
diff --git a/core/libs/tests/GuestJpegEnc.cpp b/core/libs/tests/GuestJpegEnc.cpp
index 5475dde235..c97ce0d6a1 100644
--- a/core/libs/tests/GuestJpegEnc.cpp
+++ b/core/libs/tests/GuestJpegEnc.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegEnc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Jpeg.hpp"
@@ -8,13 +9,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI sceJpegEncQueryMemorySize(const JpegEncCreateParam*);
-std::int32_t APS5_VABI sceJpegEncCreate(const JpegEncCreateParam*, void*, std::uint32_t, void**);
-std::int32_t APS5_VABI sceJpegEncDelete(void*);
-std::int32_t APS5_VABI sceJpegEncEncode(void*, const JpegEncEncodeParam*, JpegEncOutputInfo*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 alignas(4) static unsigned char image[16 * 16 * 4];
diff --git a/core/libs/tests/GuestJson.cpp b/core/libs/tests/GuestJson.cpp
index b2951558b6..1cc2993f93 100644
--- a/core/libs/tests/GuestJson.cpp
+++ b/core/libs/tests/GuestJson.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJson2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <clocale>
@@ -12,146 +13,14 @@
 #include <utility>
 #include <vector>
 
-struct Value { void* node; };
-struct String { void* text; };
-struct Array { void* items; };
-struct Object { void* items; };
-struct Iterator { void* position; };
-struct Pair {
-    String key;
-    std::uint64_t reserved;
-    Value value;
-};
-using NullAccessCallback = const Value& (APS5_VABI*)(std::int32_t, const Value*, void*);
+using namespace SceJson2;
+
 using SetNullAccessCallback = int (APS5_VABI*)(void*, NullAccessCallback, void*);
-using TypeMismatchHandler = const Value& (APS5_VABI*)(std::int32_t, const Value*, const Value*, void*);
-using SpecialFloatHandler = Value* (APS5_VABI*)(Value*, std::int32_t, double, const Value*, void*, bool*);
-using ElementAccessFailureHandler = void (APS5_VABI*)(std::int32_t, const String*, const std::size_t*, const Value*, const Value*, void*);
 
 extern "C" {
-int APS5_VABI _ZN3sce4Json11InitializerC1Ev(void*);
-int APS5_VABI _ZN3sce4Json11InitializerD1Ev(void*);
-int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_13InitParameterE(void*, const void*);
-int APS5_VABI _ZN3sce4Json11Initializer9terminateEv(void*);
-int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallBackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void*, NullAccessCallback, void*);
-int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallbackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void*, NullAccessCallback, void*);
-void APS5_VABI _ZN3sce4Json5Value21setNullAccessCallBackEPFRKS1_NS0_9ValueTypeEPS2_PvES6_(NullAccessCallback, void*);
-int APS5_VABI _ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(Value*, TypeMismatchHandler, void*);
-int APS5_VABI _ZN3sce4Json5Value22setSpecialFloatHandlerEPFKS1_NS0_12FunctionTypeEdPS2_PvPbES5_(Value*, SpecialFloatHandler, void*);
-int APS5_VABI _ZN3sce4Json5Value30setElementAccessFailureHandlerEPFviPKNS0_6StringEPKmPKS1_S8_PvES9_(Value*, ElementAccessFailureHandler, void*);
-int APS5_VABI _ZN3sce4Json5Value3setEd(Value*, double);
-int APS5_VABI _ZN3sce4Json5Value3setERKS1_(Value*, const Value*);
-Value* APS5_VABI _ZN3sce4Json5ValueaSERKS1_(Value*, const Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKS1_(Value*, const Value*);
-void APS5_VABI _ZN3sce4Json6StringC1Ev(String*);
-void APS5_VABI _ZN3sce4Json6StringC1EPKc(String*, const char*);
-void APS5_VABI _ZN3sce4Json6StringD1Ev(String*);
-const char* APS5_VABI _ZNK3sce4Json6String5c_strEv(const String*);
-std::size_t APS5_VABI _ZNK3sce4Json6String6lengthEv(const String*);
-bool APS5_VABI _ZNK3sce4Json6String5emptyEv(const String*);
-void APS5_VABI _ZN3sce4Json5ArrayC1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(Array*, const Array*);
-void APS5_VABI _ZN3sce4Json5Array5clearEv(Array*);
-const Value* APS5_VABI _ZNK3sce4Json5Array5frontEv(const Array*);
-Value* APS5_VABI _ZNK3sce4Json5Array8iteratorptEv(const Iterator*);
-void APS5_VABI _ZN3sce4Json5ArrayD1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(Array*, const Value*);
-Iterator* APS5_VABI _ZNK3sce4Json5Array5beginEv(Iterator*, const Array*);
-Iterator* APS5_VABI _ZNK3sce4Json5Array3endEv(Iterator*, const Array*);
-std::size_t APS5_VABI _ZNK3sce4Json5Array4sizeEv(const Array*);
-const Value* APS5_VABI _ZNK3sce4Json5Array4backEv(const Array*);
-void APS5_VABI _ZN3sce4Json5Array9pop_frontEv(Array*);
-bool APS5_VABI _ZNK3sce4Json5Array5emptyEv(const Array*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorD1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEv(Iterator*);
-Value* APS5_VABI _ZNK3sce4Json5Array8iteratordeEv(const Iterator*);
-bool APS5_VABI _ZNK3sce4Json5Array8iteratorneERKS2_(const Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json6ObjectC1Ev(Object*);
-void APS5_VABI _ZN3sce4Json6ObjectD1Ev(Object*);
-Value* APS5_VABI _ZN3sce4Json6ObjectixERKNS0_6StringE(Object*, const String*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object5beginEv(Iterator*, const Object*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object3endEv(Iterator*, const Object*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorD1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEv(Iterator*);
-Pair* APS5_VABI _ZNK3sce4Json6Object8iteratordeEv(const Iterator*);
-Pair* APS5_VABI _ZNK3sce4Json6Object8iteratorptEv(const Iterator*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object4findERKNS0_6StringE(Iterator*, const Object*, const String*);
-int APS5_VABI _ZNK3sce4Json6String7compareEPKc(const String*, const char*);
-int APS5_VABI _ZNK3sce4Json6String7compareERKS1_(const String*, const String*);
-std::size_t APS5_VABI _ZNK3sce4Json6String4sizeEv(const String*);
-std::size_t APS5_VABI _ZNK3sce4Json6String8capacityEv(const String*);
-bool APS5_VABI _ZNK3sce4Json6StringeqEPKc(const String*, const char*);
-bool APS5_VABI _ZNK3sce4Json6StringeqERKS1_(const String*, const String*);
+
 extern std::size_t _ZN3sce4Json6String4nposE;
-void APS5_VABI _ZN3sce4Json6String5clearEv(String*);
-void APS5_VABI _ZN3sce4Json6String6resizeEm(String*, std::size_t);
-void APS5_VABI _ZN3sce4Json6String7reserveEm(String*, std::size_t);
-String* APS5_VABI _ZN3sce4Json6String6appendERKS1_(String*, const String*);
-String* APS5_VABI _ZN3sce4Json6String6appendEPKc(String*, const char*);
-String* APS5_VABI _ZN3sce4Json6String6appendEPKcm(String*, const char*, std::size_t);
-String* APS5_VABI _ZN3sce4Json6StringpLEPKc(String*, const char*);
-String* APS5_VABI _ZN3sce4Json6StringpLEh(String*, unsigned char);
-String* APS5_VABI _ZNK3sce4Json6String6substrEmm(String*, const String*, std::size_t, std::size_t);
-std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const String*, char, std::size_t);
-std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const String*, char, std::size_t);
-bool APS5_VABI _ZNK3sce4Json6Object8iteratorneERKS2_(const Iterator*, const Iterator*);
-bool APS5_VABI _ZNK3sce4Json6Object8iteratoreqERKS2_(const Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json5ValueC1Ev(Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1Eb(Value*, bool);
-void APS5_VABI _ZN3sce4Json5ValueC1Ed(Value*, double);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(Value*, const Object*);
-void APS5_VABI _ZN3sce4Json5ValueD1Ev(Value*);
-void APS5_VABI _ZN3sce4Json5Value5clearEv(Value*);
-int APS5_VABI _ZN3sce4Json5Value3setEl(Value*, std::int64_t);
-int APS5_VABI _ZN3sce4Json5Value3setEm(Value*, std::uint64_t);
-int APS5_VABI _ZN3sce4Json5Value3setEPKc(Value*, const char*);
-std::int32_t APS5_VABI _ZNK3sce4Json5Value7getTypeEv(const Value*);
-const bool* APS5_VABI _ZNK3sce4Json5Value10getBooleanEv(const Value*);
-const std::int64_t* APS5_VABI _ZNK3sce4Json5Value10getIntegerEv(const Value*);
-const std::uint64_t* APS5_VABI _ZNK3sce4Json5Value11getUIntegerEv(const Value*);
-const double* APS5_VABI _ZNK3sce4Json5Value7getRealEv(const Value*);
-const String* APS5_VABI _ZNK3sce4Json5Value9getStringEv(const Value*);
-const Array* APS5_VABI _ZNK3sce4Json5Value8getArrayEv(const Value*);
-std::size_t APS5_VABI _ZNK3sce4Json5Value5countEv(const Value*);
-const Value* APS5_VABI _ZNK3sce4Json5ValueixEPKc(const Value*, const char*);
-Value* APS5_VABI _ZN3sce4Json5Value10referValueERKNS0_6StringE(Value*, const String*);
-const Value* APS5_VABI _ZNK3sce4Json5ValueixEm(const Value*, std::size_t);
-int APS5_VABI _ZN3sce4Json5Value9serializeERNS0_6StringE(Value*, String*);
-int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(Value*, const char*, std::size_t);
-int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(Value*, int (APS5_VABI*)(char&, void*), void*);
-bool APS5_VABI _ZNK3sce4Json6Object5emptyEv(const Object*);
-std::size_t APS5_VABI _ZNK3sce4Json6Object4sizeEv(const Object*);
-const Object* APS5_VABI _ZNK3sce4Json5Value9getObjectEv(const Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(Value*, std::int32_t);
-const Value* APS5_VABI _ZNK3sce4Json5Value8getValueEm(const Value*, std::size_t);
-const Value* APS5_VABI _ZNK3sce4Json5Value8getValueERKNS0_6StringE(const Value*, const String*);
-Value* APS5_VABI _ZN3sce4Json5Value10referValueEm(Value*, std::size_t);
-void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(void*);
-void APS5_VABI _ZN3sce4Json14InitParameter2C2Ev(void*);
-void APS5_VABI _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(void*, void*, void*);
-void APS5_VABI _ZN3sce4Json14InitParameter217setFileBufferSizeEm(void*, std::size_t);
-int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(void*, const void*);
-void APS5_VABI _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(void*, void*, void*);
-void APS5_VABI _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(void*, std::int32_t);
-void APS5_VABI _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(void*, void*, void*, std::size_t);
-void APS5_VABI _ZN3sce4Json6Object4PairC1Ev(Pair*);
-void APS5_VABI _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(Pair*, const String*, const Value*);
-void APS5_VABI _ZN3sce4Json6Object4PairD1Ev(Pair*);
-Iterator* APS5_VABI _ZN3sce4Json6Object6insertERKNS1_4PairE(Iterator*, Object*, const Pair*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorC1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iteratoraSERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEi(Iterator*, Iterator*, int);
-void APS5_VABI _ZN3sce4Json5Array8iteratorC1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iteratoraSERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEi(Iterator*, Iterator*, int);
-void APS5_VABI _ZN3sce4Json12MemAllocator11notifyErrorEimPv(void*, int, std::size_t, void*);
-bool APS5_VABI _ZNK3sce4Json5ValuecvbEv(const Value*);
-void APS5_VABI _ZN3sce4Json5Value4swapERS1_(Value*, Value*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorC1ERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iterator7advanceEm(Iterator*, std::size_t);
-void APS5_VABI _ZN3sce4Json6Object8iteratorC1ERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iterator7advanceEm(Iterator*, std::size_t);
-void APS5_VABI _ZN3sce4Json6Object5eraseERKNS0_6StringE(Object*, const String*);
+
 }
 
 static void Check(bool value, int line) {
@@ -162,7 +31,6 @@ static void Check(bool value, int line) {
 }
 #define Require(value) Check((value), __LINE__)
 
-enum : std::int32_t { TypeNull, TypeBoolean, TypeInteger, TypeUInteger, TypeReal, TypeString, TypeArray, TypeObject };
 constexpr int JsonErrorParse = static_cast<int>(0x80848101);
 
 static Value fallback{};
@@ -171,7 +39,7 @@ static std::int32_t lastRequested = -1;
 static const Value* lastParent = nullptr;
 static void* lastContext = nullptr;
 
-static const Value& APS5_VABI OnNullAccess(std::int32_t requested, const Value* parent, void* context) {
+static const Value& APS5_VABI OnNullAccess(ValueType requested, const Value* parent, void* context) {
     ++callbackCalls;
     lastRequested = requested;
     lastParent = parent;
@@ -182,9 +50,11 @@ static const Value& APS5_VABI OnNullAccess(std::int32_t requested, const Value*
 static std::string Serialize(Value& value) {
     String out{};
     _ZN3sce4Json6StringC1Ev(&out);
+
     Require(_ZN3sce4Json5Value9serializeERNS0_6StringE(&value, &out) == 0);
     std::string text(_ZNK3sce4Json6String5c_strEv(&out), _ZNK3sce4Json6String6lengthEv(&out));
     _ZN3sce4Json6StringD1Ev(&out);
+
     return text;
 }
 
@@ -198,6 +68,7 @@ static void ParseAndRoundTrip() {
         " \"pi\": 1.5, \"ok\": true, \"none\": null, \"list\": [1, \"two\", [3]] }";
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text.c_str(), text.size()) == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&root) == TypeObject);
     Require(_ZNK3sce4Json5Value5countEv(&root) == 8);
@@ -216,6 +87,7 @@ static void ParseAndRoundTrip() {
     String absent{};
     _ZN3sce4Json6StringC1EPKc(&present, "ok");
     _ZN3sce4Json6StringC1EPKc(&absent, "applyToAll");
+
     Require(_ZN3sce4Json5Value10referValueERKNS0_6StringE(&root, &present) == &Member(root, "ok"));
     Require(_ZN3sce4Json5Value10referValueERKNS0_6StringE(&root, &absent) == nullptr);
     Require(_ZNK3sce4Json5Value5countEv(&root) == 8);
@@ -226,13 +98,15 @@ static void ParseAndRoundTrip() {
     const Array* array = _ZNK3sce4Json5Value8getArrayEv(&list);
     Require(_ZNK3sce4Json5Array4sizeEv(array) == 3);
     std::vector<std::int32_t> types;
-    Iterator it{}, end{};
+    ArrayIterator it{}, end{};
     _ZNK3sce4Json5Array5beginEv(&it, array);
     _ZNK3sce4Json5Array3endEv(&end, array);
+
     for (; _ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end); _ZN3sce4Json5Array8iteratorppEv(&it))
         types.push_back(_ZNK3sce4Json5Value7getTypeEv(_ZNK3sce4Json5Array8iteratordeEv(&it)));
     _ZN3sce4Json5Array8iteratorD1Ev(&it);
     _ZN3sce4Json5Array8iteratorD1Ev(&end);
+
     Require((types == std::vector<std::int32_t>{TypeUInteger, TypeString, TypeArray}));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5ValueixEm(_ZNK3sce4Json5ValueixEm(&list, 2), 0)) == 3);
 
@@ -241,6 +115,7 @@ static void ParseAndRoundTrip() {
                           "\"name\":\"x\xc3\xa9\\n\",\"neg\":-5,\"none\":null,\"ok\":true,\"pi\":1.5}");
     Value reparsed{};
     _ZN3sce4Json5ValueC1Ev(&reparsed);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&reparsed, serialized.c_str(), serialized.size()) == 0);
     Require(Serialize(reparsed) == serialized);
     _ZN3sce4Json5ValueD1Ev(&reparsed);
@@ -253,6 +128,7 @@ static void ParseAndRoundTrip() {
     bool nullTextRejected = false;
     try {
         _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, nullptr, 10);
+
     } catch (const std::invalid_argument&) {
         nullTextRejected = true;
     }
@@ -263,6 +139,7 @@ static void ParseAndRoundTrip() {
         bool unverified = false;
         try {
             _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, overflow, std::strlen(overflow));
+
         } catch (const std::runtime_error& error) {
             unverified = std::string(error.what()).find("unverified") != std::string::npos;
         }
@@ -270,6 +147,7 @@ static void ParseAndRoundTrip() {
         Require(_ZNK3sce4Json5Value7getTypeEv(&root) == TypeObject && _ZNK3sce4Json5Value5countEv(&root) == 8);
     }
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static std::string Nested(std::size_t depth, bool objects) {
@@ -283,6 +161,7 @@ static std::string Nested(std::size_t depth, bool objects) {
 static void NestingDepth() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     for (const bool objects : {false, true}) {
         const std::string accepted = Nested(512, objects);
         Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, accepted.c_str(), accepted.size()) == 0);
@@ -292,14 +171,47 @@ static void NestingDepth() {
         }
     }
     _ZN3sce4Json5ValueD1Ev(&root);
+
+}
+
+static void ArrayAssignment() {
+    Array source{}, target{};
+    _ZN3sce4Json5ArrayC1Ev(&source);
+    _ZN3sce4Json5ArrayC1Ev(&target);
+
+    Value flag{}, real{};
+    _ZN3sce4Json5ValueC1Eb(&flag, true);
+    _ZN3sce4Json5ValueC1Ed(&real, 1.5);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&source, &flag);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&source, &real);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&source, &flag);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&target, &real);
+
+    Require(_ZN3sce4Json5ArrayaSERKS1_(&target, &source) == &target);
+    Require(_ZNK3sce4Json5Array4sizeEv(&target) == 3);
+    Require(_ZNK3sce4Json5Array4sizeEv(&source) == 3);
+    _ZN3sce4Json5Array5clearEv(&source);
+
+    Require(_ZNK3sce4Json5Array4sizeEv(&target) == 3);
+    Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array5frontEv(&target)));
+    Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array4backEv(&target)));
+    Require(_ZN3sce4Json5ArrayaSERKS1_(&target, &target) == &target);
+    Require(_ZNK3sce4Json5Array4sizeEv(&target) == 3);
+    _ZN3sce4Json5ValueD1Ev(&flag);
+    _ZN3sce4Json5ValueD1Ev(&real);
+    _ZN3sce4Json5ArrayD1Ev(&source);
+    _ZN3sce4Json5ArrayD1Ev(&target);
+
 }
 
 static void ObjectsAndArrays() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String alpha{}, beta{};
     _ZN3sce4Json6StringC1EPKc(&alpha, "alpha");
     _ZN3sce4Json6StringC1EPKc(&beta, "beta");
+
     Require(_ZNK3sce4Json6Object5emptyEv(&object));
     Value* first = _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &alpha);
     Require(!_ZNK3sce4Json6Object5emptyEv(&object));
@@ -309,9 +221,10 @@ static void ObjectsAndArrays() {
     Require(_ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &alpha) == first);
 
     std::vector<std::string> keys;
-    Iterator it{}, end{};
+    ObjectIterator it{}, end{};
     _ZNK3sce4Json6Object5beginEv(&it, &object);
     _ZNK3sce4Json6Object3endEv(&end, &object);
+
     for (; _ZNK3sce4Json6Object8iteratorneERKS2_(&it, &end); _ZN3sce4Json6Object8iteratorppEv(&it)) {
         const Pair* pair = _ZNK3sce4Json6Object8iteratordeEv(&it);
         keys.emplace_back(_ZNK3sce4Json6String5c_strEv(&pair->key));
@@ -319,10 +232,12 @@ static void ObjectsAndArrays() {
     }
     _ZN3sce4Json6Object8iteratorD1Ev(&it);
     _ZN3sce4Json6Object8iteratorD1Ev(&end);
+
     Require((keys == std::vector<std::string>{"alpha", "beta"}));
 
     Value wrapped{};
     _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(&wrapped, &object);
+
     Require(Serialize(wrapped) == "{\"alpha\":1,\"beta\":\"b\"}");
     _ZN3sce4Json5ValueD1Ev(&wrapped);
     _ZN3sce4Json6StringD1Ev(&alpha);
@@ -331,6 +246,7 @@ static void ObjectsAndArrays() {
 
     Array array{};
     _ZN3sce4Json5ArrayC1Ev(&array);
+
     Value flag{}, real{};
     _ZN3sce4Json5ValueC1Eb(&flag, true);
     _ZN3sce4Json5ValueC1Ed(&real, 2.5);
@@ -338,23 +254,29 @@ static void ObjectsAndArrays() {
     _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&array, &real);
     _ZN3sce4Json5ValueD1Ev(&flag);
     _ZN3sce4Json5ValueD1Ev(&real);
+
     Require(_ZNK3sce4Json5Array4sizeEv(&array) == 2);
     Require(*_ZNK3sce4Json5Value7getRealEv(_ZNK3sce4Json5Array4backEv(&array)) == 2.5);
+    ArrayIterator arrayIt{}, arrayEnd{};
     int visited = 0;
-    _ZNK3sce4Json5Array5beginEv(&it, &array);
-    _ZNK3sce4Json5Array3endEv(&end, &array);
-    for (; _ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end); _ZN3sce4Json5Array8iteratorppEv(&it)) ++visited;
+    _ZNK3sce4Json5Array5beginEv(&arrayIt, &array);
+    _ZNK3sce4Json5Array3endEv(&arrayEnd, &array);
+
+    for (; _ZNK3sce4Json5Array8iteratorneERKS2_(&arrayIt, &arrayEnd); _ZN3sce4Json5Array8iteratorppEv(&arrayIt)) ++visited;
     Require(visited == 2);
     Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array5frontEv(&array)));
-    _ZNK3sce4Json5Array5beginEv(&it, &array);
-    Require(_ZNK3sce4Json5Array8iteratorptEv(&it) == _ZNK3sce4Json5Array8iteratordeEv(&it));
+    _ZNK3sce4Json5Array5beginEv(&arrayIt, &array);
+
+    Require(_ZNK3sce4Json5Array8iteratorptEv(&arrayIt) == _ZNK3sce4Json5Array8iteratordeEv(&arrayIt));
     Array copy{};
     _ZN3sce4Json5ArrayC1ERKS1_(&copy, &array);
     _ZN3sce4Json5Array5clearEv(&array);
+
     Require(_ZNK3sce4Json5Array4sizeEv(&array) == 0);
     bool threw = false;
     try {
         _ZNK3sce4Json5Array5frontEv(&array);
+
     } catch (const std::out_of_range&) {
         threw = true;
     }
@@ -363,31 +285,38 @@ static void ObjectsAndArrays() {
     Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array5frontEv(&copy)));
     Require(*_ZNK3sce4Json5Value7getRealEv(_ZNK3sce4Json5Array4backEv(&copy)) == 2.5);
     _ZN3sce4Json5Array9pop_frontEv(&copy);
+
     Require(_ZNK3sce4Json5Array4sizeEv(&copy) == 1);
     Require(*_ZNK3sce4Json5Value7getRealEv(_ZNK3sce4Json5Array5frontEv(&copy)) == 2.5);
     _ZN3sce4Json5Array9pop_frontEv(&copy);
+
     Require(_ZNK3sce4Json5Array5emptyEv(&copy));
     threw = false;
     try {
         _ZN3sce4Json5Array9pop_frontEv(&copy);
+
     } catch (const std::out_of_range&) {
         threw = true;
     }
     Require(threw && _ZNK3sce4Json5Array5emptyEv(&copy));
     _ZN3sce4Json5ArrayD1Ev(&copy);
     _ZN3sce4Json5ArrayD1Ev(&array);
+
 }
 
 static void ObjectPair() {
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "answer");
+
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     Require(_ZN3sce4Json5Value3setEPKc(&value, "forty-two") == 0);
 
     Pair pair{};
     std::memset(&pair, 0x5a, sizeof(pair));
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&pair, &key, &value);
+
     Require(pair.reserved == 0);
     Require(pair.key.text != key.text && pair.value.node != value.node);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&pair.key), "answer") == 0);
@@ -397,38 +326,46 @@ static void ObjectPair() {
     Require(_ZN3sce4Json5Value3setEl(&value, 7) == 0);
     _ZN3sce4Json6StringD1Ev(&key);
     _ZN3sce4Json5ValueD1Ev(&value);
+
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&pair.key), "answer") == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&pair.value) == TypeString);
     _ZN3sce4Json6Object4PairD1Ev(&pair);
+
     Require(pair.key.text == nullptr && pair.value.node == nullptr);
 }
 
 static void ArrayIteratorCopies() {
     Array array{};
     _ZN3sce4Json5ArrayC1Ev(&array);
+
     for (std::int64_t i = 1; i <= 3; ++i) {
         Value item{};
         _ZN3sce4Json5ValueC1Ev(&item);
+
         Require(_ZN3sce4Json5Value3setEl(&item, i) == 0);
         _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&array, &item);
         _ZN3sce4Json5ValueD1Ev(&item);
+
     }
 
-    Iterator it{};
+    ArrayIterator it{};
     std::memset(&it, 0x5a, sizeof(it));
     _ZN3sce4Json5Array8iteratorC1Ev(&it);
-    Require(it.position != nullptr);
 
-    Iterator begin{}, end{};
+    Require(it.state != nullptr);
+
+    ArrayIterator begin{}, end{};
     _ZNK3sce4Json5Array5beginEv(&begin, &array);
     _ZNK3sce4Json5Array3endEv(&end, &array);
+
     Require(_ZN3sce4Json5Array8iteratoraSERKS2_(&it, &begin) == &it);
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &begin));
 
     std::vector<std::int64_t> seen;
-    Iterator previous{};
+    ArrayIterator previous{};
     while (_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end)) {
         _ZN3sce4Json5Array8iteratorD1Ev(&previous);
+
         Require(_ZN3sce4Json5Array8iteratorppEi(&previous, &it, 0) == &previous);
         seen.push_back(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&previous)));
         Require(_ZNK3sce4Json5Array8iteratorneERKS2_(&previous, &it));
@@ -437,9 +374,9 @@ static void ArrayIteratorCopies() {
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&previous)) == 3);
     Require(_ZN3sce4Json5Array8iteratoraSERKS2_(&it, &end) == &it);
-    Require(it.position == nullptr);
+    Require(it.state == nullptr);
     Require(_ZN3sce4Json5Array8iteratoraSERKS2_(&it, &begin) == &it);
-    Require(it.position == nullptr);
+    Require(it.state == nullptr);
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &begin));
 
     _ZN3sce4Json5Array8iteratorD1Ev(&previous);
@@ -453,19 +390,23 @@ static void AllocatorNotifyError() {
     int allocator = 0x1234;
     int userData = 0x5678;
     _ZN3sce4Json12MemAllocator11notifyErrorEimPv(&allocator, -1, 64, &userData);
+
     Require(allocator == 0x1234 && userData == 0x5678);
 }
 
 static void ObjectFind() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String alpha{}, beta{}, gamma{};
     _ZN3sce4Json6StringC1EPKc(&alpha, "alpha");
     _ZN3sce4Json6StringC1EPKc(&beta, "beta");
     _ZN3sce4Json6StringC1EPKc(&gamma, "gamma");
-    Iterator found{}, end{};
+
+    ObjectIterator found{}, end{};
     _ZNK3sce4Json6Object3endEv(&end, &object);
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &alpha);
+
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
     _ZN3sce4Json6Object8iteratorD1Ev(&end);
@@ -475,7 +416,8 @@ static void ObjectFind() {
     Require(_ZN3sce4Json5Value3setEPKc(second, "b") == 0);
     _ZNK3sce4Json6Object3endEv(&end, &object);
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
-    Iterator* returned = _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &beta);
+
+    ObjectIterator* returned = _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &beta);
     Require(returned == &found);
     Require(_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     const Pair* pair = _ZNK3sce4Json6Object8iteratorptEv(&found);
@@ -483,9 +425,11 @@ static void ObjectFind() {
     Require(&pair->value == second);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&pair->key), "beta") == 0);
     _ZN3sce4Json6Object8iteratorppEv(&found);
+
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &gamma);
+
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
@@ -506,49 +450,56 @@ static void ObjectFind() {
     _ZN3sce4Json6StringD1Ev(&beta);
     _ZN3sce4Json6StringD1Ev(&gamma);
     _ZN3sce4Json6ObjectD1Ev(&object);
+
 }
 
 static void ObjectIteratorCopies() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String key1{}, key2{};
     _ZN3sce4Json6StringC1EPKc(&key1, "one");
     _ZN3sce4Json6StringC1EPKc(&key2, "two");
+
     Value val1{}, val2{};
     _ZN3sce4Json5ValueC1Ev(&val1);
     _ZN3sce4Json5ValueC1Ev(&val2);
+
     Require(_ZN3sce4Json5Value3setEl(&val1, 10) == 0);
     Require(_ZN3sce4Json5Value3setEl(&val2, 20) == 0);
     Pair p1{}, p2{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p1, &key1, &val1);
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p2, &key2, &val2);
-    Iterator ins1{}, ins2{};
+
+    ObjectIterator ins1{}, ins2{};
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&ins1, &object, &p1) == &ins1);
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&ins2, &object, &p2) == &ins2);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins1);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins2);
 
-    Iterator it{};
+    ObjectIterator it{};
     std::memset(&it, 0x5a, sizeof(it));
     _ZN3sce4Json6Object8iteratorC1Ev(&it);
-    Require(it.position != nullptr);
+
+    Require(it.state != nullptr);
     _ZN3sce4Json6Object8iteratorD1Ev(&it);
 
-    Iterator begin{}, end{};
+    ObjectIterator begin{}, end{};
     _ZNK3sce4Json6Object5beginEv(&begin, &object);
     _ZNK3sce4Json6Object3endEv(&end, &object);
 
     Require(!_ZNK3sce4Json6Object8iteratoreqERKS2_(&begin, &end));
     Require(_ZNK3sce4Json6Object8iteratorneERKS2_(&begin, &end));
 
-    Iterator post{};
+    ObjectIterator post{};
     Require(_ZN3sce4Json6Object8iteratorppEi(&post, &begin, 0) == &post);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&post)->key), "one") == 0);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&begin)->key), "two") == 0);
     _ZN3sce4Json6Object8iteratorD1Ev(&post);
 
-    Iterator assigned{};
+    ObjectIterator assigned{};
     _ZN3sce4Json6Object8iteratorC1Ev(&assigned);
+
     Require(_ZN3sce4Json6Object8iteratoraSERKS2_(&assigned, &begin) == &assigned);
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&assigned, &begin));
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&assigned, &begin));
@@ -569,16 +520,20 @@ static void ObjectIteratorCopies() {
 static void ObjectInsert() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "score");
+
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     Require(_ZN3sce4Json5Value3setEl(&value, 100) == 0);
     Pair pair{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&pair, &key, &value);
 
-    Iterator inserted{}, end{};
+    ObjectIterator inserted{}, end{};
     _ZNK3sce4Json6Object3endEv(&end, &object);
+
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&inserted, &object, &pair) == &inserted);
     Require(_ZNK3sce4Json6Object8iteratorneERKS2_(&inserted, &end));
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 1);
@@ -587,7 +542,7 @@ static void ObjectInsert() {
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&p->value) == 100);
 
     Require(_ZN3sce4Json5Value3setEl(&pair.value, 200) == 0);
-    Iterator duplicate{};
+    ObjectIterator duplicate{};
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&duplicate, &object, &pair) == &duplicate);
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&duplicate, &inserted));
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 1);
@@ -596,16 +551,20 @@ static void ObjectInsert() {
 
     String otherKey{};
     _ZN3sce4Json6StringC1EPKc(&otherKey, "other");
+
     Value otherValue{};
     _ZN3sce4Json5ValueC1Ev(&otherValue);
+
     Require(_ZN3sce4Json5Value3setEPKc(&otherValue, "str") == 0);
     Pair otherPair{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&otherPair, &otherKey, &otherValue);
-    Iterator otherInserted{};
+
+    ObjectIterator otherInserted{};
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&otherInserted, &object, &otherPair) == &otherInserted);
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
-    Iterator first{};
+    ObjectIterator first{};
     _ZNK3sce4Json6Object5beginEv(&first, &object);
+
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&first, &otherInserted));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&_ZNK3sce4Json6Object8iteratordeEv(&inserted)->value) == 100);
     _ZN3sce4Json6Object8iteratorD1Ev(&first);
@@ -625,43 +584,56 @@ static void ObjectInsert() {
 static void ObjectKeyOrder() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     for (const char* name : {"z", "\xc3\xa9", "a", "A", ""}) {
         String key{};
         _ZN3sce4Json6StringC1EPKc(&key, name);
         _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &key);
         _ZN3sce4Json6StringD1Ev(&key);
+
     }
-    Iterator member{};
+    ObjectIterator member{};
     _ZNK3sce4Json6Object5beginEv(&member, &object);
+
     for (const char* expected : {"", "A", "a", "z", "\xc3\xa9"}) {
         Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&member)->key), expected) == 0);
         _ZN3sce4Json6Object8iteratorppEv(&member);
+
     }
     _ZN3sce4Json6Object8iteratorD1Ev(&member);
+
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "a");
+
     Value* existing = _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &key);
     _ZN3sce4Json6String6appendEPKcm(&key, "\0suffix", 7);
+
     Require(_ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &key) == existing);
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&member, &object, &key);
+
     Require(&_ZNK3sce4Json6Object8iteratordeEv(&member)->value == existing);
     _ZN3sce4Json6Object8iteratorD1Ev(&member);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 5);
     _ZN3sce4Json6Object5eraseERKNS0_6StringE(&object, &key);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 4);
     _ZN3sce4Json6StringD1Ev(&key);
     _ZN3sce4Json6ObjectD1Ev(&object);
+
 }
 
 static void ParseDuplicateKeys() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     for (const char* text : {R"({"a":1,"a":2})", R"({"a":[1,2],"a":2})", R"({"a":{"old":true},"a":2})", R"({"a":1,"a\u0000suffix":2})"}) {
         Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, std::strlen(text)) == 0);
         Require(_ZNK3sce4Json5Value5countEv(&root) == 1);
         Require(Serialize(root) == R"({"a":2})");
     }
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static void StringComparison() {
@@ -669,6 +641,7 @@ static void StringComparison() {
     _ZN3sce4Json6StringC1EPKc(&left, "a");
     _ZN3sce4Json6StringC1EPKc(&right, "a");
     _ZN3sce4Json6String6appendEPKcm(&left, "\0suffix", 7);
+
     Require(_ZNK3sce4Json6StringeqERKS1_(&left, &right));
     Require(_ZNK3sce4Json6StringeqEPKc(&left, "a"));
     Require(_ZNK3sce4Json6String7compareERKS1_(&left, &right) == 0);
@@ -678,6 +651,7 @@ static void StringComparison() {
     Require(_ZNK3sce4Json6String7compareEPKc(&left, "\xff") == -158);
     _ZN3sce4Json6StringD1Ev(&right);
     _ZN3sce4Json6StringD1Ev(&left);
+
 }
 
 static void StringMethods() {
@@ -687,21 +661,65 @@ static void StringMethods() {
     String suffix{};
     _ZN3sce4Json6StringC1EPKc(&base, "a/b/c");
     _ZN3sce4Json6StringC1EPKc(&suffix, "-tail");
+
     Require(_ZNK3sce4Json6String4findEcm(&base, '/', 0) == 1);
     Require(_ZNK3sce4Json6String4findEcm(&base, '/', 2) == 3);
     Require(_ZNK3sce4Json6String4findEcm(&base, 'z', 0) == _ZN3sce4Json6String4nposE);
     Require(_ZNK3sce4Json6String5rfindEcm(&base, '/', _ZN3sce4Json6String4nposE) == 3);
     Require(_ZNK3sce4Json6String5rfindEcm(&base, '/', 2) == 1);
+    const std::size_t npos = _ZN3sce4Json6String4nposE;
+    Require(_ZNK3sce4Json6String2atEm(&base, 0) == 'a');
+    Require(_ZNK3sce4Json6String2atEm(&base, 4) == 'c');
+    bool atRefused = false;
+    try {
+        _ZNK3sce4Json6String2atEm(&base, 5);
+
+    } catch (const std::out_of_range&) {
+        atRefused = true;
+    }
+    Require(atRefused);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "/b", 0) == 1);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "/", 2) == 3);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "", 5) == 5);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "", 6) == npos);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "b/d", 0) == npos);
+    Require(_ZNK3sce4Json6String4findEPKcmm(&base, "b/d", 0, 2) == 2);
+    Require(_ZNK3sce4Json6String4findEPKcmm(&base, nullptr, 3, 0) == 3);
+    Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "/", npos) == 3);
+    Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "/", 2) == 1);
+    Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "", npos) == 5);
+    Require(_ZNK3sce4Json6String5rfindEPKcmm(&base, "a/x", npos, 2) == 0);
+    Require(_ZNK3sce4Json6String5rfindEPKcmm(&base, "zz", npos, 2) == npos);
+    String needle{};
+    _ZN3sce4Json6StringC1EPKc(&needle, "/c");
+
+    Require(_ZNK3sce4Json6String4findERKS1_m(&base, &needle, 0) == 3);
+    Require(_ZNK3sce4Json6String4findERKS1_m(&base, &needle, 4) == npos);
+    Require(_ZNK3sce4Json6String5rfindERKS1_m(&base, &needle, npos) == 3);
+    Require(_ZNK3sce4Json6String5rfindERKS1_m(&base, &needle, 2) == npos);
+    _ZN3sce4Json6StringD1Ev(&needle);
+
+    bool findRefused = false;
+    try {
+        _ZNK3sce4Json6String4findEPKcm(&base, nullptr, 0);
+
+    } catch (const std::invalid_argument&) {
+        findRefused = true;
+    }
+    Require(findRefused);
     String part{};
     Require(_ZNK3sce4Json6String6substrEmm(&part, &base, 2, 3) == &part);
     Require(text(part) == "b/c");
     _ZN3sce4Json6StringD1Ev(&part);
+
     Require(_ZNK3sce4Json6String6substrEmm(&part, &base, 5, _ZN3sce4Json6String4nposE) == &part);
     Require(text(part).empty());
     _ZN3sce4Json6StringD1Ev(&part);
+
     bool refused = false;
     try {
         _ZNK3sce4Json6String6substrEmm(&part, &base, 6, 1);
+
     } catch (const std::out_of_range&) {
         refused = true;
     }
@@ -710,10 +728,12 @@ static void StringMethods() {
     Require(_ZNK3sce4Json6String6lengthEv(&base) == 5);
     String match{};
     _ZN3sce4Json6StringC1EPKc(&match, "a/b/c");
+
     Require(_ZNK3sce4Json6StringeqERKS1_(&base, &match));
     Require(_ZNK3sce4Json6String7compareERKS1_(&base, &match) == 0);
     _ZN3sce4Json6StringD1Ev(&match);
     _ZN3sce4Json6String7reserveEm(&base, 64);
+
     Require(_ZNK3sce4Json6String8capacityEv(&base) >= 64);
     Require(_ZN3sce4Json6String6appendERKS1_(&base, &suffix) == &base);
     Require(_ZN3sce4Json6String6appendEPKc(&base, "!") == &base);
@@ -722,73 +742,91 @@ static void StringMethods() {
     Require(_ZN3sce4Json6StringpLEh(&base, '?') == &base);
     Require(text(base) == "a/b/c-tail!12+?");
     _ZN3sce4Json6String6resizeEm(&base, 5);
+
     Require(_ZNK3sce4Json6String4sizeEv(&base) == 5);
     Require(text(base) == "a/b/c");
     _ZN3sce4Json6String6appendERKS1_(&base, &base);
+
     Require(text(base) == "a/b/ca/b/c");
     _ZN3sce4Json6String5clearEv(&base);
+
     Require(text(base).empty());
     _ZN3sce4Json6StringD1Ev(&suffix);
     _ZN3sce4Json6StringD1Ev(&base);
+
 }
 
 static void ValueSwap() {
     Value v1{}, v2{};
     _ZN3sce4Json5ValueC1Ev(&v1);
     _ZN3sce4Json5ValueC1Ev(&v2);
+
     Require(_ZN3sce4Json5Value3setEl(&v1, 123) == 0);
     Require(_ZN3sce4Json5Value3setEPKc(&v2, "hello") == 0);
     _ZN3sce4Json5Value4swapERS1_(&v1, &v2);
+
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&v2) == 123);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(_ZNK3sce4Json5Value9getStringEv(&v1)), "hello") == 0);
     Require(_ZN3sce4Json5Value3setEl(&v1, -456) == 0);
     const auto* firstStorage = _ZNK3sce4Json5Value10getIntegerEv(&v1);
     const auto* secondStorage = _ZNK3sce4Json5Value10getIntegerEv(&v2);
     _ZN3sce4Json5Value4swapERS1_(&v1, &v2);
+
     Require(_ZNK3sce4Json5Value10getIntegerEv(&v1) == firstStorage && *firstStorage == 123);
     Require(_ZNK3sce4Json5Value10getIntegerEv(&v2) == secondStorage && *secondStorage == -456);
     _ZN3sce4Json5Value4swapERS1_(&v1, &v1);
+
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&v1) == 123);
     _ZN3sce4Json5ValueD1Ev(&v1);
     _ZN3sce4Json5ValueD1Ev(&v2);
+
 }
 
 static void ArrayIteratorAdvance() {
     Array array{};
     _ZN3sce4Json5ArrayC1Ev(&array);
+
     for (int i = 0; i < 5; ++i) {
         Value val{};
         _ZN3sce4Json5ValueC1Ev(&val);
         _ZN3sce4Json5Value3setEl(&val, i * 10);
         _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&array, &val);
         _ZN3sce4Json5ValueD1Ev(&val);
+
     }
-    Iterator begin{};
+    ArrayIterator begin{};
     _ZNK3sce4Json5Array5beginEv(&begin, &array);
-    Iterator copy{};
+
+    ArrayIterator copy{};
     _ZN3sce4Json5Array8iteratorC1ERKS2_(&copy, &begin);
+
     Require(_ZN3sce4Json5Array8iterator7advanceEm(&copy, 3) == &copy);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&copy)) == 30);
-    Iterator end{};
+    ArrayIterator end{};
     _ZNK3sce4Json5Array3endEv(&end, &array);
     _ZN3sce4Json5Array8iterator7advanceEm(&copy, std::numeric_limits<std::size_t>::max());
+
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&copy, &end));
     _ZN3sce4Json5Array8iteratorppEv(&copy);
+
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&copy, &end));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&begin)) == 0);
     _ZN3sce4Json5Array8iteratorD1Ev(&end);
     _ZN3sce4Json5Array8iteratorD1Ev(&begin);
     _ZN3sce4Json5Array8iteratorD1Ev(&copy);
     _ZN3sce4Json5ArrayD1Ev(&array);
+
 }
 
 static void ObjectOperations() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String k1{}, k2{}, k3{};
     _ZN3sce4Json6StringC1EPKc(&k1, "alpha");
     _ZN3sce4Json6StringC1EPKc(&k2, "beta");
     _ZN3sce4Json6StringC1EPKc(&k3, "gamma");
+
     Value v1{}, v2{}, v3{};
     _ZN3sce4Json5ValueC1Ev(&v1);
     _ZN3sce4Json5ValueC1Ev(&v2);
@@ -796,11 +834,13 @@ static void ObjectOperations() {
     _ZN3sce4Json5Value3setEl(&v1, 1);
     _ZN3sce4Json5Value3setEl(&v2, 2);
     _ZN3sce4Json5Value3setEl(&v3, 3);
+
     Pair p1{}, p2{}, p3{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p1, &k1, &v1);
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p2, &k2, &v2);
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p3, &k3, &v3);
-    Iterator ins{};
+
+    ObjectIterator ins{};
     _ZN3sce4Json6Object6insertERKNS1_4PairE(&ins, &object, &p3);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins);
     _ZN3sce4Json6Object6insertERKNS1_4PairE(&ins, &object, &p2);
@@ -808,16 +848,20 @@ static void ObjectOperations() {
     _ZN3sce4Json6Object6insertERKNS1_4PairE(&ins, &object, &p1);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins);
 
-    Iterator begin{};
+    ObjectIterator begin{};
     _ZNK3sce4Json6Object5beginEv(&begin, &object);
-    Iterator copy{};
+
+    ObjectIterator copy{};
     _ZN3sce4Json6Object8iteratorC1ERKS2_(&copy, &begin);
+
     Require(_ZN3sce4Json6Object8iterator7advanceEm(&copy, 2) == &copy);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&copy)->key), "gamma") == 0);
     _ZN3sce4Json6Object8iterator7advanceEm(&copy, 1);
+
     bool endRejected = false;
     try {
         _ZN3sce4Json6Object8iterator7advanceEm(&copy, 1);
+
     } catch (const std::out_of_range&) {
         endRejected = true;
     }
@@ -827,13 +871,16 @@ static void ObjectOperations() {
 
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 3);
     _ZN3sce4Json6Object5eraseERKNS0_6StringE(&object, &k2);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
     _ZN3sce4Json6Object5eraseERKNS0_6StringE(&object, &k2);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
 
-    Iterator findResult{}, end{};
+    ObjectIterator findResult{}, end{};
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&findResult, &object, &k2);
     _ZNK3sce4Json6Object3endEv(&end, &object);
+
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&findResult, &end));
     _ZN3sce4Json6Object8iteratorD1Ev(&findResult);
     _ZN3sce4Json6Object8iteratorD1Ev(&end);
@@ -862,10 +909,12 @@ static void NullAccess(SetNullAccessCallback setCallback) {
     int context = 0;
     Require(setCallback(initializer, OnNullAccess, &context) == 0);
     _ZN3sce4Json5ValueC1Ev(&fallback);
+
     Require(_ZN3sce4Json5Value3setEl(&fallback, 99) == 0);
 
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"present\":\"text\"}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     Require(&Member(root, "missing") == &fallback);
@@ -882,33 +931,40 @@ static void NullAccess(SetNullAccessCallback setCallback) {
     Require(callbackCalls == 4);
     _ZN3sce4Json5ValueD1Ev(&root);
     _ZN3sce4Json5ValueD1Ev(&fallback);
+
     Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
 }
 
 static void ValueAccess() {
     for (std::int32_t type = TypeNull; type <= TypeObject; ++type) {
         Value typed{};
-        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&typed, type);
+        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&typed, static_cast<ValueType>(type));
+
         Require(_ZNK3sce4Json5Value7getTypeEv(&typed) == type);
         Require(_ZNK3sce4Json5Value5countEv(&typed) == 0);
         _ZN3sce4Json5ValueD1Ev(&typed);
+
     }
 
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"list\":[10,20,30],\"name\":\"value\",\"flag\":true}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     Require(_ZNK3sce4Json6Object4sizeEv(_ZNK3sce4Json5Value9getObjectEv(&root)) == 3);
-    Iterator member{};
+    ObjectIterator member{};
     _ZNK3sce4Json6Object5beginEv(&member, _ZNK3sce4Json5Value9getObjectEv(&root));
+
     for (const char* expected : {"flag", "list", "name"}) {
         Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&member)->key), expected) == 0);
         _ZN3sce4Json6Object8iteratorppEv(&member);
+
     }
     _ZN3sce4Json6Object8iteratorD1Ev(&member);
 
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "list");
+
     const Value* list = _ZNK3sce4Json5Value8getValueERKNS0_6StringE(&root, &key);
     Require(_ZNK3sce4Json5Value7getTypeEv(list) == TypeArray);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Value8getValueEm(list, 1)) == 20);
@@ -926,23 +982,26 @@ static void ValueAccess() {
 
     String missing{};
     _ZN3sce4Json6StringC1EPKc(&missing, "missing");
+
     Require(_ZNK3sce4Json5Value7getTypeEv(_ZNK3sce4Json5Value8getValueERKNS0_6StringE(&root, &missing)) == TypeNull);
     _ZN3sce4Json6StringD1Ev(&missing);
     _ZN3sce4Json5ValueD1Ev(&root);
 
     alignas(16) std::uint8_t parameter[40];
     std::memset(parameter, 0xff, sizeof(parameter));
-    _ZN3sce4Json14InitParameter2C1Ev(parameter);
+    _ZN3sce4Json14InitParameter2C1Ev(reinterpret_cast<SceJson2::InitParameter2*>(parameter));
+
     int allocator = 0;
     int userData = 0;
-    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(parameter, &allocator, &userData);
-    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(parameter, 4096);
+    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(reinterpret_cast<SceJson2::InitParameter2*>(parameter), &allocator, &userData);
+    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 4096);
+
     void* stored[3]{};
     std::memcpy(stored, parameter, sizeof(stored));
     Require(stored[0] == &allocator && stored[1] == &userData && reinterpret_cast<std::uintptr_t>(stored[2]) == 4096);
     alignas(16) std::uint8_t initializer[16]{};
     Require(_ZN3sce4Json11InitializerC1Ev(initializer) == 0);
-    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, parameter) == 0);
+    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, reinterpret_cast<const SceJson2::InitParameter2*>(parameter)) == 0);
     Require(_ZN3sce4Json11Initializer9terminateEv(initializer) == 0);
     Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
 }
@@ -950,11 +1009,13 @@ static void ValueAccess() {
 static void InitParameter2BaseConstructor() {
     alignas(16) std::uint8_t parameter[40];
     std::memset(parameter, 0xff, sizeof(parameter));
-    _ZN3sce4Json14InitParameter2C1Ev(parameter);
+    _ZN3sce4Json14InitParameter2C1Ev(reinterpret_cast<SceJson2::InitParameter2*>(parameter));
+
     alignas(16) std::uint8_t baseStorage[72];
     std::memset(baseStorage, 0xff, sizeof(baseStorage));
     auto* baseParameter = baseStorage + 16;
-    _ZN3sce4Json14InitParameter2C2Ev(baseParameter);
+    _ZN3sce4Json14InitParameter2C2Ev(reinterpret_cast<SceJson2::InitParameter2*>(baseParameter));
+
     Require(std::memcmp(parameter, baseParameter, sizeof(parameter)) == 0);
     void* defaultAllocator;
     void* defaultUserData;
@@ -965,8 +1026,9 @@ static void InitParameter2BaseConstructor() {
     Require(defaultAllocator == nullptr && defaultUserData == nullptr && defaultFileBufferSize == 0);
     int allocator = 0;
     int userData = 0;
-    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(baseParameter, &allocator, &userData);
-    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(baseParameter, 4096);
+    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(reinterpret_cast<SceJson2::InitParameter2*>(baseParameter), &allocator, &userData);
+    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(reinterpret_cast<SceJson2::InitParameter2*>(baseParameter), 4096);
+
     void* storedAllocator;
     void* storedUserData;
     std::size_t storedFileBufferSize;
@@ -979,22 +1041,15 @@ static void InitParameter2BaseConstructor() {
         Require(baseStorage[i] == 0xff);
     alignas(16) std::uint8_t initializer[16]{};
     Require(_ZN3sce4Json11InitializerC1Ev(initializer) == 0);
-    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, baseParameter) == 0);
+    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, reinterpret_cast<const SceJson2::InitParameter2*>(baseParameter)) == 0);
     Require(_ZN3sce4Json11Initializer9terminateEv(initializer) == 0);
     Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
 }
 
-struct StoredInitParameter2 {
-    void* allocator;
-    void* userData;
-    std::size_t fileBufferSize;
-    std::int32_t specialFloatFormatType;
-    std::uint32_t reserved[3];
-};
-static_assert(sizeof(StoredInitParameter2) == 40);
+static_assert(sizeof(InitParameter2) == 40);
 
-static StoredInitParameter2 Stored(const std::uint8_t* parameter) {
-    StoredInitParameter2 stored{};
+static InitParameter2 Stored(const std::uint8_t* parameter) {
+    InitParameter2 stored{};
     std::memcpy(&stored, parameter, sizeof(stored));
     return stored;
 }
@@ -1006,32 +1061,33 @@ static bool Untouched(const std::uint8_t* parameter, std::size_t from) {
 }
 
 static void InitParameters() {
-    using Constructor = void (APS5_VABI*)(void*);
+    using Constructor = decltype(&_ZN3sce4Json14InitParameter2C1Ev);
     for (Constructor construct : {_ZN3sce4Json14InitParameter2C1Ev, _ZN3sce4Json14InitParameter2C2Ev}) {
         alignas(16) std::uint8_t parameter[40];
         std::memset(parameter, 0xff, sizeof(parameter));
-        construct(parameter);
-        StoredInitParameter2 stored = Stored(parameter);
+        construct(reinterpret_cast<InitParameter2*>(parameter));
+        InitParameter2 stored = Stored(parameter);
         Require(stored.allocator == nullptr && stored.userData == nullptr && stored.fileBufferSize == 0);
         Require(stored.specialFloatFormatType == 2);
         Require(stored.reserved[0] == 0 && stored.reserved[1] == 0 && stored.reserved[2] == 0);
 
         int allocParam = 0;
         int userData = 0;
-        _ZN3sce4Json14InitParameter217setFileBufferSizeEm(parameter, 8192);
-        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(parameter, 2);
-        _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(parameter, &allocParam, &userData);
+        _ZN3sce4Json14InitParameter217setFileBufferSizeEm(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 8192);
+        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 2);
+        _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(reinterpret_cast<SceJson2::InitParameter2*>(parameter), &allocParam, &userData);
+
         stored = Stored(parameter);
         Require(stored.allocator == &allocParam && stored.userData == &userData && stored.fileBufferSize == 8192);
         Require(stored.specialFloatFormatType == 2);
         Require(stored.reserved[0] == 0 && stored.reserved[1] == 0 && stored.reserved[2] == 0);
 
-        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(parameter, 0);
+        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 0);
         Require(Stored(parameter).specialFloatFormatType == 0 && Stored(parameter).fileBufferSize == 8192);
 
         alignas(16) std::uint8_t initializer[16]{};
         Require(_ZN3sce4Json11InitializerC1Ev(initializer) == 0);
-        Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, parameter) == 0);
+        Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, reinterpret_cast<const SceJson2::InitParameter2*>(parameter)) == 0);
         Require(_ZN3sce4Json11Initializer9terminateEv(initializer) == 0);
         Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
     }
@@ -1040,7 +1096,8 @@ static void InitParameters() {
     std::memset(rttiParameter, 0xff, sizeof(rttiParameter));
     int allocParam = 0;
     int userData = 0;
-    _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(rttiParameter, &allocParam, &userData, 4096);
+    _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(reinterpret_cast<InitParameterRtti*>(rttiParameter), &allocParam, &userData, 4096);
+
     void* rttiStored[3]{};
     std::memcpy(rttiStored, rttiParameter, sizeof(rttiStored));
     Require(rttiStored[0] == &allocParam && rttiStored[1] == &userData && reinterpret_cast<std::uintptr_t>(rttiStored[2]) == 4096);
@@ -1050,30 +1107,38 @@ static void InitParameters() {
 static void ValueClear() {
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
 
     Require(_ZN3sce4Json5Value3setEl(&value, 12345) == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeInteger);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
 
     Require(_ZN3sce4Json5Value3setEPKc(&value, "test string") == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeString);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
 
     Object obj{};
     _ZN3sce4Json6ObjectC1Ev(&obj);
+
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "prop");
+
     Value* item = _ZN3sce4Json6ObjectixERKNS0_6StringE(&obj, &key);
     _ZN3sce4Json5Value3setEl(item, 999);
     _ZN3sce4Json5ValueD1Ev(&value);
     _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(&value, &obj);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeObject);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
     _ZN3sce4Json6StringD1Ev(&key);
     _ZN3sce4Json6ObjectD1Ev(&obj);
@@ -1107,6 +1172,7 @@ static int APS5_VABI ReadNext(char& ch, void* context) {
 static void IntegerRepresentation() {
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     for (const char* text : {"0", "1", "9223372036854775807", "9223372036854775808", "18446744073709551615"}) {
         Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&value, text, std::strlen(text)) == 0);
         Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeUInteger);
@@ -1124,11 +1190,13 @@ static void IntegerRepresentation() {
     Require(*_ZNK3sce4Json5Value11getUIntegerEv(&value) == (std::uint64_t{1} << 63));
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeInteger);
     _ZN3sce4Json5ValueD1Ev(&value);
+
 }
 
 static void StreamParse() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     ReadState valid{"{\"list\": [1, 2.5, true]}", 0, 0};
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(&root, ReadNext, &valid) == 0);
     Require(valid.calls == static_cast<int>(std::strlen(valid.text)));
@@ -1153,6 +1221,7 @@ static void StreamParse() {
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, "01", 2) == 0);
     Require(Serialize(root) == "1");
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static void StaticNullAccess() {
@@ -1163,10 +1232,12 @@ static void StaticNullAccess() {
     int context = 0;
     _ZN3sce4Json5Value21setNullAccessCallBackEPFRKS1_NS0_9ValueTypeEPS2_PvES6_(OnNullAccess, &context);
     _ZN3sce4Json5ValueC1Ev(&fallback);
+
     Require(_ZN3sce4Json5Value3setEl(&fallback, 99) == 0);
 
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"present\":\"text\"}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     Require(&Member(root, "missing") == &fallback);
@@ -1180,6 +1251,7 @@ static void StaticNullAccess() {
     Require(callbackCalls == 2);
     _ZN3sce4Json5ValueD1Ev(&root);
     _ZN3sce4Json5ValueD1Ev(&fallback);
+
 }
 
 static Value replacement{};
@@ -1189,7 +1261,7 @@ static const Value* mismatchValue = nullptr;
 static const Value* mismatchSecond = nullptr;
 static void* mismatchContext = nullptr;
 
-static const Value& APS5_VABI OnTypeMismatch(std::int32_t requested, const Value* value, const Value* second, void* context) {
+static const Value& APS5_VABI OnTypeMismatch(ValueType requested, const Value* value, const Value* second, void* context) {
     ++mismatchCalls;
     mismatchRequested = requested;
     mismatchValue = value;
@@ -1198,17 +1270,19 @@ static const Value& APS5_VABI OnTypeMismatch(std::int32_t requested, const Value
     return replacement;
 }
 
-static void RequireMismatch(int calls, std::int32_t requested, const Value* value, void* context) {
+static void RequireMismatch(int calls, ValueType requested, const Value* value, void* context) {
     Require(mismatchCalls == calls && mismatchRequested == requested && mismatchValue == value);
     Require(mismatchSecond == nullptr && mismatchContext == context);
 }
 
 static void ValueTypeMismatchHandler() {
     _ZN3sce4Json5ValueC1Ev(&replacement);
+
     Require(_ZN3sce4Json5Value3setEl(&replacement, 42) == 0);
     int context = 0;
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     Require(_ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(&root, OnTypeMismatch, &context) == 0);
     const char text[] = "{\"name\":\"text\",\"none\":null,\"list\":[true]}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
@@ -1230,6 +1304,7 @@ static void ValueTypeMismatchHandler() {
 
     Value later{};
     _ZN3sce4Json5ValueC1Ev(&later);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&later, text, sizeof(text) - 1) == 0);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&Member(later, "name")) == 0);
     Require(mismatchCalls == 4);
@@ -1240,6 +1315,7 @@ static void ValueTypeMismatchHandler() {
 
     Value other{};
     _ZN3sce4Json5ValueC1Ev(&other);
+
     Require(_ZN3sce4Json5Value3setEPKc(&other, "other") == 0);
     Require(_ZN3sce4Json5ValueaSERKS1_(&root, &other) == &root);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&root) == 42);
@@ -1251,11 +1327,13 @@ static void ValueTypeMismatchHandler() {
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&root) == 42);
     RequireMismatch(7, TypeInteger, &root, &context);
     _ZN3sce4Json5Value5clearEv(&root);
+
     Require(_ZN3sce4Json5Value3setEPKc(&root, "cleared") == 0);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&root) == 42);
     RequireMismatch(8, TypeInteger, &root, &context);
     Value copy{};
     _ZN3sce4Json5ValueC1ERKS1_(&copy, &root);
+
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&copy) == 0);
     Require(mismatchCalls == 8);
 
@@ -1267,6 +1345,7 @@ static void ValueTypeMismatchHandler() {
     _ZN3sce4Json5ValueD1Ev(&later);
     _ZN3sce4Json5ValueD1Ev(&root);
     _ZN3sce4Json5ValueD1Ev(&replacement);
+
 }
 
 static int failureCalls = 0;
@@ -1288,6 +1367,7 @@ static bool ThrowsUnverified(const TAccess& access) {
 static void ValueElementAccessFailureHandler() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"list\":[1],\"key\":2}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     int context = 0;
@@ -1298,6 +1378,7 @@ static void ValueElementAccessFailureHandler() {
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Value8getValueEm(&list, 0)) == 1);
     String missing{};
     _ZN3sce4Json6StringC1EPKc(&missing, "missing");
+
     Require(ThrowsUnverified([&] { _ZNK3sce4Json5ValueixEPKc(&root, "missing"); }));
     Require(ThrowsUnverified([&] { _ZNK3sce4Json5Value8getValueERKNS0_6StringE(&root, &missing); }));
     Require(ThrowsUnverified([&] { _ZNK3sce4Json5ValueixEm(&root, 0); }));
@@ -1309,6 +1390,7 @@ static void ValueElementAccessFailureHandler() {
     Require(_ZNK3sce4Json5Value7getTypeEv(_ZNK3sce4Json5Value8getValueEm(&list, 1)) == TypeNull);
     _ZN3sce4Json6StringD1Ev(&missing);
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static int specialFloatCalls = 0;
@@ -1316,49 +1398,59 @@ static int specialFloatCalls = 0;
 static Value* APS5_VABI OnSpecialFloat(Value* result, std::int32_t, double, const Value*, void*, bool*) {
     ++specialFloatCalls;
     _ZN3sce4Json5ValueC1Ev(result);
+
     return result;
 }
 
 static void ValueSpecialFloatHandler() {
     Value real{};
     _ZN3sce4Json5ValueC1Ed(&real, std::numeric_limits<double>::quiet_NaN());
+
     int context = 0;
     Require(_ZN3sce4Json5Value22setSpecialFloatHandlerEPFKS1_NS0_12FunctionTypeEdPS2_PvPbES5_(&real, OnSpecialFloat, &context) == 0);
     String out{};
     _ZN3sce4Json6StringC1Ev(&out);
+
     Require(ThrowsUnverified([&] { _ZN3sce4Json5Value9serializeERNS0_6StringE(&real, &out); }));
     Require(_ZN3sce4Json5Value3setEd(&real, std::numeric_limits<double>::infinity()) == 0);
     Require(ThrowsUnverified([&] { _ZN3sce4Json5Value9serializeERNS0_6StringE(&real, &out); }));
     _ZN3sce4Json6StringD1Ev(&out);
+
     Require(_ZN3sce4Json5Value3setEd(&real, 2.5) == 0);
     Require(Serialize(real) == "2.5");
     Require(specialFloatCalls == 0);
     _ZN3sce4Json5ValueD1Ev(&real);
+
 }
 
 static void ValueOperatorBool() {
     Value nullVal{};
     _ZN3sce4Json5ValueC1Ev(&nullVal);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&nullVal));
     _ZN3sce4Json5ValueD1Ev(&nullVal);
 
     Value typedNull{};
     _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&typedNull, TypeNull);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&typedNull));
     _ZN3sce4Json5ValueD1Ev(&typedNull);
 
     Value boolFalse{};
     _ZN3sce4Json5ValueC1Eb(&boolFalse, false);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&boolFalse));
     _ZN3sce4Json5ValueD1Ev(&boolFalse);
 
     Value boolTrue{};
     _ZN3sce4Json5ValueC1Eb(&boolTrue, true);
+
     Require(_ZNK3sce4Json5ValuecvbEv(&boolTrue));
     _ZN3sce4Json5ValueD1Ev(&boolTrue);
 
     Value scalar{};
     _ZN3sce4Json5ValueC1Ev(&scalar);
+
     for (std::int64_t value : {std::int64_t{0}, std::int64_t{1}, std::int64_t{-1}}) {
         Require(_ZN3sce4Json5Value3setEl(&scalar, value) == 0);
         Require(_ZNK3sce4Json5ValuecvbEv(&scalar) == (value != 0));
@@ -1376,19 +1468,25 @@ static void ValueOperatorBool() {
         Require(_ZNK3sce4Json5ValuecvbEv(&scalar) == (*text != 0));
     }
     _ZN3sce4Json5ValueD1Ev(&scalar);
+
     for (std::int32_t type : {TypeArray, TypeObject}) {
         Value container{};
-        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&container, type);
+        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&container, static_cast<ValueType>(type));
+
         Require(_ZNK3sce4Json5ValuecvbEv(&container));
         _ZN3sce4Json5ValueD1Ev(&container);
+
     }
 
     Value cleared{};
     _ZN3sce4Json5ValueC1Eb(&cleared, true);
+
     Require(_ZNK3sce4Json5ValuecvbEv(&cleared));
     _ZN3sce4Json5Value5clearEv(&cleared);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&cleared));
     _ZN3sce4Json5ValueD1Ev(&cleared);
+
 }
 
 static int NumericLocale() {
@@ -1417,14 +1515,17 @@ static int NumericLocale() {
                               std::numeric_limits<double>::min(), std::numeric_limits<double>::denorm_min()}) {
         Value value{};
         _ZN3sce4Json5ValueC1Ed(&value, number);
+
         const auto text = Serialize(value);
         check(text.find(',') == std::string::npos, "Decimal-point serialization", text.c_str());
         Value parsed{};
         _ZN3sce4Json5ValueC1Ev(&parsed);
+
         const int result = _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&parsed, text.c_str(), text.size());
         check(result == 0 && *_ZNK3sce4Json5Value7getRealEv(&parsed) == number, "Numeric round trip", text.c_str());
         _ZN3sce4Json5ValueD1Ev(&parsed);
         _ZN3sce4Json5ValueD1Ev(&value);
+
     }
     for (const auto [text, number] : {std::pair{"1.5", 1.5}, {"-1.25e2", -125.0},
                                     {"4.9406564584124654e-324", std::numeric_limits<double>::denorm_min()},
@@ -1434,13 +1535,16 @@ static int NumericLocale() {
                                     {"1e-999", 0.0}, {"-1e-999", -0.0}}) {
         Value value{};
         _ZN3sce4Json5ValueC1Ev(&value);
+
         const int result = _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&value, text, std::strlen(text));
         const auto parsed = *_ZNK3sce4Json5Value7getRealEv(&value);
         check(result == 0 && parsed == number && std::signbit(parsed) == std::signbit(number), "Decimal-point parsing", text);
         _ZN3sce4Json5ValueD1Ev(&value);
+
     }
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     constexpr char document[] = "{\"list\":[2.5,-0.125],\"value\":1.5}";
     check(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, document, sizeof(document) - 1) == 0,
           "Nested numeric parsing", document);
@@ -1451,11 +1555,13 @@ static int NumericLocale() {
     bool overflow = false;
     try {
         _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, "1e309", 5);
+
     } catch (const std::runtime_error&) {
         overflow = true;
     }
     check(overflow, "Retain overflow rejection", "1e309");
     _ZN3sce4Json5ValueD1Ev(&root);
+
     check(std::strcmp(std::localeconv()->decimal_point, ",") == 0, "Preserve host locale", selected);
     std::setlocale(LC_NUMERIC, previous.c_str());
     return failures ? 1 : 0;
@@ -1466,6 +1572,7 @@ int main(int argc, char** argv) {
     ParseAndRoundTrip();
     NestingDepth();
     ObjectsAndArrays();
+    ArrayAssignment();
     ObjectFind();
     ObjectPair();
     ObjectInsert();
diff --git a/core/libs/tests/GuestJxr.cpp b/core/libs/tests/GuestJxr.cpp
index 1bcda397b1..6c295e4822 100644
--- a/core/libs/tests/GuestJxr.cpp
+++ b/core/libs/tests/GuestJxr.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceJxr/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -6,11 +8,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-void* APS5_VABI malloc_nid_postfix(std::size_t size);
-std::int64_t APS5_VABI PKFree_nid_postfix(void** memory);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestKernelAppArchive.cpp b/core/libs/tests/GuestKernelAppArchive.cpp
index 2eb8aae01f..d3922949f5 100644
--- a/core/libs/tests/GuestKernelAppArchive.cpp
+++ b/core/libs/tests/GuestKernelAppArchive.cpp
@@ -1,67 +1,53 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "AppArchiveFixture.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libc/include/GuestFileNumber.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
+#include "prx/libkernel/File/include/KernelStatfs.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libc/include/GuestDirectory.hpp"
 
 #include <algorithm>
+#include <array>
+#include <atomic>
+#include <barrier>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <filesystem>
 #include <fstream>
+#include <map>
+#include <mutex>
 #include <stdexcept>
 #include <string>
+#include <system_error>
+#include <thread>
 #include <typeinfo>
 #include <vector>
 
-struct KernelIovec {
-    void* base;
-    std::size_t length;
-};
-
 extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-std::int64_t APS5_VABI sceKernelRead(int d, void* buf, std::size_t nbytes);
-std::int64_t APS5_VABI sceKernelWrite(int d, const void* buf, std::size_t nbytes);
-std::int64_t APS5_VABI sceKernelPread(int d, void* buf, std::size_t nbytes, std::int64_t offset);
-std::int64_t APS5_VABI sceKernelReadv(int d, const KernelIovec* iov, int iovcnt);
-std::int64_t APS5_VABI sceKernelPreadv(int d, const KernelIovec* iov, int iovcnt, std::int64_t offset);
-std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence);
-int APS5_VABI sceKernelStat(const char* path, FileStat* sb);
-int APS5_VABI sceKernelFstat(int d, FileStat* sb);
-int APS5_VABI sceKernelCheckReachability(const char* path);
-int APS5_VABI dup_nid_postfix(int d);
-int APS5_VABI dup2_nid_postfix(int from, int to);
-int APS5_VABI close_nid_postfix(int d);
-std::int64_t APS5_VABI pread_nid_postfix(int d, void* buf, std::size_t nbytes, std::int64_t offset);
-std::int64_t APS5_VABI lseek_nid_postfix(int d, std::int64_t offset, int whence);
-int APS5_VABI fcntl_nid_postfix(int d, int command, ...);
-int APS5_VABI ioctl_nid_postfix(int d, std::uint64_t request, void* argument);
-void* APS5_VABI opendir_nid_postfix(const char* path);
-void* APS5_VABI fdopen_nid_postfix(int d, const char* mode);
-int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioWaitRequest(std::int32_t id, std::int32_t* state, std::uint32_t* usec);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t id, std::int32_t* ret);
-int APS5_VABI flock_nid_postfix(int d, int operation);
-int APS5_VABI _fstatfs_nid_postfix(int d, void* buf);
-int APS5_VABI ftruncate_nid_postfix(int d, std::int64_t length);
-int APS5_VABI sceKernelFsync(int d);
-int APS5_VABI sceKernelFdatasync(int d);
-int APS5_VABI sceKernelGetdents(int d, char* buf, int nbytes);
-int APS5_VABI sceKernelFchmod(int d, std::uint16_t mode);
-int APS5_VABI sceKernelFutimes(int d, const void* times);
-void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
-std::type_info* APS5_VABI __cxa_current_exception_type_nid_postfix();
+
 using TerminateHandler = void (*)();
-TerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(TerminateHandler);
+
 }
 
 namespace {
 
+struct KernelLock {
+    std::int64_t start;
+    std::int64_t length;
+    std::int32_t pid;
+    std::int16_t type;
+    std::int16_t whence;
+    std::int32_t system;
+};
+
 void Require(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "app0.zar kernel check failed at line %d\n", line);
@@ -95,14 +81,240 @@ constexpr int DuplicateFrom = 0;
 constexpr std::uint64_t ReadableRequest = 0x4004667f;
 
 void Archive(const std::filesystem::path& root) {
-    AppArchiveFixture::WriteArchive(root / "app0.zar", {
+    std::map<std::string, std::vector<char>> files{
         {"Data/Big.bin", AppArchiveFixture::Pattern(BigSize)},
         {"Data/Small.txt", {'z', 'a', 'r'}},
         {"sce_sys/Packed.json", {'{', '}'}},
         {"eboot.bin", {'o', 'l', 'd'}},
-    });
+        {"Readme.TXT", {'z'}},
+        {"MaskedDir/Child.txt", {'d'}},
+        {"MaskedFile", {'f'}},
+    };
+    for (unsigned index = 0; index < 32; ++index) {
+        const auto suffix = std::string(1, static_cast<char>('a' + index / 10)) + static_cast<char>('0' + index % 10);
+        files.emplace("sce_sys/Concurrent/" + suffix, std::vector<char>{static_cast<char>(index)});
+    }
+    AppArchiveFixture::WriteArchive(root / "app0.zar", files, {"EmptyArchive"});
     std::ofstream eboot(root / "app0" / "eboot.bin", std::ios::binary);
     eboot << "disk";
+    std::ofstream readme(root / "app0" / "README.txt", std::ios::binary);
+    readme << "disk";
+    std::ofstream masked(root / "app0" / "MaskedDir", std::ios::binary);
+    masked << "disk";
+    std::filesystem::create_directory(root / "app0" / "MaskedFile");
+}
+
+void FileNumbers() {
+    constexpr std::uint32_t Fold = 0x9E3779B1u;
+    Check(GuestFileNumber_nid_no_patch(7) == 7);
+    Check(GuestFileNumber_nid_no_patch((std::uint64_t{1} << 32) | 7) == (Fold ^ 7u));
+    Check(GuestFileNumber_nid_no_patch((std::uint64_t{1} << 32) | Fold) == 1);
+}
+
+void ConcurrentArchiveDirectoryEntries() {
+    constexpr int WorkerCount = 8;
+    constexpr int ChildCount = 32;
+    struct Entry {
+        std::int64_t base;
+        std::string name;
+    };
+    const int directory = sceKernelOpen("/app0/sce_sys/Concurrent", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Check(directory >= 0);
+    std::barrier start(WorkerCount);
+    std::mutex entriesMutex;
+    std::vector<Entry> entries;
+    entries.reserve(ChildCount + 2);
+    std::atomic<int> failures{0};
+    std::vector<std::thread> workers;
+    workers.reserve(WorkerCount);
+    for (int worker = 0; worker < WorkerCount; ++worker) {
+        workers.emplace_back([&] {
+            start.arrive_and_wait();
+            for (;;) {
+                std::array<char, 12> record{};
+                std::int64_t base = -1;
+                const int bytes = sceKernelGetdirentries(directory, record.data(), static_cast<int>(record.size()), &base);
+                if (bytes == 0) break;
+                if (bytes != static_cast<int>(record.size()) || base < 0 || record[7] == 0) {
+                    failures.fetch_add(1, std::memory_order_relaxed);
+                    break;
+                }
+                std::lock_guard lock(entriesMutex);
+                entries.push_back({base, std::string(record.data() + 8)});
+            }
+        });
+    }
+    for (auto& worker : workers) worker.join();
+    Check(failures.load(std::memory_order_relaxed) == 0);
+    Check(sceKernelClose(directory) == 0);
+    std::sort(entries.begin(), entries.end(), [](const Entry& left, const Entry& right) { return left.base < right.base; });
+    Check(entries.size() == ChildCount + 2);
+    Check(entries[0].base == 0 && entries[0].name == ".");
+    Check(entries[1].base == 1 && entries[1].name == "..");
+    for (int index = 0; index < ChildCount; ++index) {
+        const auto name = std::string(1, static_cast<char>('a' + index / 10)) + static_cast<char>('0' + index % 10);
+        Check(entries[index + 2].base == index + 2 && entries[index + 2].name == name);
+    }
+}
+
+std::map<std::string, std::uint8_t> ReadDirectory(void* directory) {
+    std::map<std::string, std::uint8_t> entries;
+    while (auto* entry = readdir_nid_postfix(directory)) Check(entries.emplace(entry->name, entry->type).second);
+    return entries;
+}
+
+std::map<std::string, std::uint8_t> ReadKernelDirectory(int fd) {
+    std::array<char, 4096> bytes{};
+    std::map<std::string, std::uint8_t> entries;
+    const int count = sceKernelGetdents(fd, bytes.data(), static_cast<int>(bytes.size()));
+    Check(count >= 0);
+    for (int offset = 0; offset < count;) {
+        std::uint16_t recordLength = 0;
+        std::memcpy(&recordLength, bytes.data() + offset + 4, sizeof(recordLength));
+        const auto nameLength = static_cast<std::uint8_t>(bytes[offset + 7]);
+        const std::string name(bytes.data() + offset + 8);
+        Check(name.size() == nameLength && recordLength == ((8 + nameLength + 1 + 3) & ~3));
+        Check(offset + recordLength <= count && entries.emplace(name, static_cast<std::uint8_t>(bytes[offset + 6])).second);
+        offset += recordLength;
+    }
+    return entries;
+}
+
+void Directories() {
+    void* archive = opendir_nid_postfix("/app0/Data");
+    Check(archive != nullptr);
+    const auto archiveEntries = ReadDirectory(archive);
+    Check(archiveEntries.size() == 4 && archiveEntries.at(".") == 4 && archiveEntries.at("..") == 4);
+    Check(archiveEntries.at("Big.bin") == 8 && archiveEntries.at("Small.txt") == 8);
+    GuestDirectoryEntry copied{};
+    GuestDirectoryEntry* copiedResult = nullptr;
+    rewinddir_nid_postfix(archive);
+    Check(readdir_r_nid_postfix(archive, &copied, &copiedResult) == 0 && copiedResult == &copied && std::strcmp(copied.name, ".") == 0);
+    rewinddir_nid_postfix(archive);
+    Check(telldir_nid_postfix(archive) == 0 && readdir_nid_postfix(archive) != nullptr);
+    Check(telldir_nid_postfix(archive) == 1);
+    seekdir_nid_postfix(archive, 0);
+    Check(readdir_nid_postfix(archive) != nullptr);
+    rewinddir_nid_postfix(archive);
+    Check(closedir_nid_postfix(archive) == 0);
+
+    void* merged = opendir_nid_postfix("/app0");
+    Check(merged != nullptr);
+#ifdef _WIN32
+    bool diskIdentityChecked = false;
+    while (auto* entry = readdir_nid_postfix(merged)) {
+        if (std::strcmp(entry->name, "README.txt") != 0) continue;
+        FileStat identity{};
+        Check(sceKernelStat("/app0/README.txt", &identity) == 0);
+        Check(entry->fileNumber != 0 && entry->fileNumber == static_cast<std::uint32_t>(identity.st_ino));
+        diskIdentityChecked = true;
+    }
+    Check(diskIdentityChecked);
+    rewinddir_nid_postfix(merged);
+#endif
+    const auto mergedEntries = ReadDirectory(merged);
+    Check(mergedEntries.at("eboot.bin") == 8 && mergedEntries.at("README.txt") == 8);
+    Check(mergedEntries.at("EmptyArchive") == 4 && mergedEntries.at("Data") == 4);
+    Check(mergedEntries.at("MaskedDir") == 8 && mergedEntries.at("MaskedFile") == 4);
+    Check(mergedEntries.size() == 9);
+    Check(closedir_nid_postfix(merged) == 0);
+
+    void* refreshed = opendir_nid_postfix("/app0");
+    Check(refreshed != nullptr && readdir_nid_postfix(refreshed) != nullptr);
+    const auto addedPath = std::filesystem::current_path() / "app0" / "AfterOpen.txt";
+    { std::ofstream added(addedPath); added << "disk"; }
+    rewinddir_nid_postfix(refreshed);
+    const auto refreshedEntries = ReadDirectory(refreshed);
+    Check(refreshedEntries.contains("AfterOpen.txt"));
+    Check(closedir_nid_postfix(refreshed) == 0);
+    std::filesystem::remove(addedPath);
+
+    const int fd = sceKernelOpen("/app0/Data", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Check(fd >= 0);
+    FileStat pathStatus{};
+    FileStat descriptorStatus{};
+    Check(sceKernelStat("/app0/Data", &pathStatus) == 0 && sceKernelFstat(fd, &descriptorStatus) == 0);
+    Check((descriptorStatus.st_mode & TypeMask) == DirectoryType && descriptorStatus.st_ino == pathStatus.st_ino && descriptorStatus.st_dev == pathStatus.st_dev);
+    char rejectedByte = 0;
+    Check(sceKernelRead(fd, &rejectedByte, 1) == SCE_KERNEL_ERROR_EISDIR);
+    Check(sceKernelWrite(fd, &rejectedByte, 1) == SCE_KERNEL_ERROR_EISDIR);
+    Check(sceKernelPread(fd, &rejectedByte, 1, 0) == SCE_KERNEL_ERROR_EISDIR);
+    const KernelIovec rejectedIovec{&rejectedByte, 1};
+    Check(sceKernelReadv(fd, &rejectedIovec, 1) == SCE_KERNEL_ERROR_EISDIR);
+    Check(sceKernelPreadv(fd, &rejectedIovec, 1, 0) == SCE_KERNEL_ERROR_EISDIR);
+    Check(sceKernelFsync(fd) == SCE_KERNEL_ERROR_EISDIR && sceKernelFdatasync(fd) == SCE_KERNEL_ERROR_EISDIR);
+    Check(ftruncate_nid_postfix(fd, 0) == -1 && *__error_nid_postfix() == 22);
+    Check(ftruncate_nid_postfix(fd, 8) == -1 && *__error_nid_postfix() == 22);
+    Check(sceKernelFchmod(fd, 0600) == SCE_KERNEL_ERROR_EISDIR);
+    Check(sceKernelFutimes(fd, nullptr) == SCE_KERNEL_ERROR_EISDIR);
+    Check(flock_nid_postfix(fd, 1) == -1);
+    KernelLock recordLock{};
+    Check(fcntl_nid_postfix(fd, 12, &recordLock) == -1);
+    Check(_fstatfs_nid_postfix(fd, nullptr) == -1);
+    int available = 0;
+    Check(ioctl_nid_postfix(fd, ReadableRequest, &available) == -1);
+    Check(mmap_nid_postfix(nullptr, 4096, 1, 1, fd, 0) == reinterpret_cast<void*>(static_cast<std::uintptr_t>(-1)));
+    std::array<char, 12> first{};
+    Check(sceKernelGetdents(fd, first.data(), 1) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelGetdents(fd, first.data(), static_cast<int>(first.size())) == 12);
+    Check(std::string(first.data() + 8) == ".");
+    std::uint32_t dotNumber = 0;
+    std::memcpy(&dotNumber, first.data(), sizeof(dotNumber));
+    Check(dotNumber == static_cast<std::uint32_t>(descriptorStatus.st_ino));
+    const int duplicate = dup_nid_postfix(fd);
+    Check(duplicate >= 0);
+    std::array<char, 12> second{};
+    Check(sceKernelGetdents(duplicate, second.data(), static_cast<int>(second.size())) == 12);
+    Check(std::string(second.data() + 8) == "..");
+    FileStat parentStatus{};
+    std::uint32_t dotdotNumber = 0;
+    std::memcpy(&dotdotNumber, second.data(), sizeof(dotdotNumber));
+    Check(sceKernelStat("/app0", &parentStatus) == 0 && dotdotNumber == static_cast<std::uint32_t>(parentStatus.st_ino));
+    Check(sceKernelLseek(fd, 0, 1) == 2);
+    Check(sceKernelClose(fd) == 0);
+    const auto remaining = ReadKernelDirectory(duplicate);
+    Check(remaining.size() == 2 && remaining.contains("Big.bin") && remaining.contains("Small.txt"));
+    Check(sceKernelClose(duplicate) == 0);
+
+    const int reused = sceKernelOpen("/app0/Data", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Check(reused >= 0 && File::IsDirectoryDescriptor(reused));
+    Check(sceKernelClose(reused) == 0);
+    const int regular = sceKernelOpen("/app0/eboot.bin", SCE_KERNEL_O_RDONLY, 0);
+    Check(regular == reused && !File::IsDirectoryDescriptor(regular));
+    Check(sceKernelFstat(regular, &descriptorStatus) == 0 && (descriptorStatus.st_mode & TypeMask) == RegularType);
+    Check(sceKernelGetdents(regular, first.data(), static_cast<int>(first.size())) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelGetdents(regular, first.data(), 1) == SCE_KERNEL_ERROR_EINVAL);
+    void* invalidStream = fdopendir_nid_postfix(regular);
+    Check(invalidStream == nullptr);
+    Check(sceKernelClose(regular) == 0);
+
+    const int replaced = sceKernelOpen("/app0/Data", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    const int replacement = sceKernelOpen("/app0/eboot.bin", SCE_KERNEL_O_RDONLY, 0);
+    Check(replaced >= 0 && replacement >= 0 && dup2_nid_postfix(replacement, replaced) == replaced);
+    Check(!File::IsDirectoryDescriptor(replaced) && sceKernelFstat(replaced, &descriptorStatus) == 0 && (descriptorStatus.st_mode & TypeMask) == RegularType);
+    Check(sceKernelClose(replaced) == 0 && sceKernelClose(replacement) == 0);
+
+    const int duplicateFrom = sceKernelOpen("/app0/Data", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    const int duplicateTo = fcntl_nid_postfix(duplicateFrom, DuplicateFrom, duplicateFrom + 5);
+    Check(duplicateFrom >= 0 && duplicateTo >= duplicateFrom + 5 && File::IsDirectoryDescriptor(duplicateTo));
+    Check(sceKernelClose(duplicateFrom) == 0 && File::IsDirectoryDescriptor(duplicateTo));
+    Check(sceKernelClose(duplicateTo) == 0);
+
+    const int owned = sceKernelOpen("/app0/Data", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Check(owned >= 0 && sceKernelGetdents(owned, first.data(), static_cast<int>(first.size())) == 12);
+    void* stream = fdopendir_nid_postfix(owned);
+    Check(stream != nullptr);
+    auto* next = readdir_nid_postfix(stream);
+    Check(next != nullptr && std::strcmp(next->name, "..") == 0);
+    const auto cookie = telldir_nid_postfix(stream);
+    Check(cookie == 2);
+    next = readdir_nid_postfix(stream);
+    Check(next != nullptr && std::strcmp(next->name, "Big.bin") == 0);
+    seekdir_nid_postfix(stream, cookie);
+    next = readdir_nid_postfix(stream);
+    Check(next != nullptr && std::strcmp(next->name, "Big.bin") == 0);
+    Check(closedir_nid_postfix(stream) == 0);
+    Check(!DescriptorIsOpen_nid_no_patch(owned));
 }
 
 void Reads() {
@@ -146,7 +358,7 @@ void Reads() {
     KernelAioRwRequest request{65530, 20, buffer.data(), &result, fd};
     std::int32_t id = 0;
     std::int32_t state = 0;
-    Check(sceKernelAioSubmitReadCommands(&request, 1, 0, &id) == 0);
+    Check(sceKernelAioSubmitReadCommands(&request, 1, 1, &id) == 0);
     Check(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
     Check(result.return_value == 20 && std::equal(buffer.begin(), buffer.begin() + 20, expected.begin() + 65530));
     std::int32_t removed = 0;
@@ -190,15 +402,16 @@ void Refusals() {
     Check(sceKernelOpen("/app0/Data/Small.txt", SCE_KERNEL_O_WRONLY | SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL, 0666) == SCE_KERNEL_ERROR_EEXIST);
     Check(sceKernelOpen("/app0/Data/Small.txt", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0) == SCE_KERNEL_ERROR_ENOTDIR);
     Check(sceKernelOpen("/app0/Data/Missing.txt", SCE_KERNEL_O_RDONLY, 0) == SCE_KERNEL_ERROR_ENOENT);
-    Check(NotImplemented([] { (void)sceKernelOpen("/app0/Data", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0); }));
-    Check(NotImplemented([] { (void)sceKernelOpen("/app0/sce_sys", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0); }));
-    Check(NotImplemented([] { (void)opendir_nid_postfix("/app0/sce_sys"); }));
-    Check(NotImplemented([] { (void)opendir_nid_postfix("/app0/Data"); }));
+    const int directory = sceKernelOpen("/app0/Data", SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Check(directory >= 0 && sceKernelClose(directory) == 0);
+    void* archivedDirectory = opendir_nid_postfix("/app0/sce_sys");
+    Check(archivedDirectory != nullptr && closedir_nid_postfix(archivedDirectory) == 0);
+    Directories();
     const int fd = sceKernelOpen("/app0/Data/Small.txt", SCE_KERNEL_O_RDONLY, 0);
     Check(fd >= 0);
     Check(NotImplemented([fd] { (void)fdopen_nid_postfix(fd, "r"); }));
     Check(NotImplemented([fd] { (void)flock_nid_postfix(fd, 1); }));
-    Check(NotImplemented([fd] { alignas(8) char statfs[512]; (void)_fstatfs_nid_postfix(fd, statfs); }));
+    Check(NotImplemented([fd] { alignas(8) char statfs[512]; (void)_fstatfs_nid_postfix(fd, reinterpret_cast<KernelStatfs*>(statfs)); }));
     Check(NotImplemented([fd] { (void)ftruncate_nid_postfix(fd, 0); }));
     Check(NotImplemented([fd] { (void)sceKernelFsync(fd); }));
     Check(NotImplemented([fd] { (void)sceKernelFdatasync(fd); }));
@@ -224,6 +437,52 @@ void WithoutArchive() {
     Check(directory >= 0 && sceKernelClose(directory) == 0);
 }
 
+void NativeDirectoryIdentity(const std::filesystem::path& root) {
+    const auto original = root / "ordinary-directory-original";
+    const auto renamed = root / "ordinary-directory-renamed";
+    std::filesystem::create_directory(original);
+    { std::ofstream file(original / "original-entry"); file << "old"; }
+    const int fd = File::OpenDirectoryDescriptor(original);
+    Check(fd >= 0 && File::IsDirectoryDescriptor(fd) && !File::IsVirtualDirectoryDescriptor(fd) && File::IsNativeDirectoryDescriptor(fd));
+    FileStat before{};
+    Check(sceKernelFstat(fd, &before) == 0);
+    std::filesystem::rename(original, renamed);
+    std::filesystem::create_directory(original);
+    { std::ofstream file(original / "replacement-entry"); file << "new"; }
+#ifdef _WIN32
+    auto expectedPath = renamed;
+    auto expectedNative = expectedPath.native();
+    if (expectedNative.size() >= 2 && expectedNative[1] == L':') {
+        if (expectedNative[0] >= L'A' && expectedNative[0] <= L'Z') expectedNative[0] += L'a' - L'A';
+        else if (expectedNative[0] >= L'a' && expectedNative[0] <= L'z') expectedNative[0] -= L'a' - L'A';
+        expectedPath = expectedNative;
+    }
+#else
+    const auto expectedPath = renamed;
+#endif
+    FileStat after{};
+    Check(sceKernelFstat(fd, &after) == 0 && after.st_ino == before.st_ino);
+    const auto path = File::DirectoryDescriptorPath(fd);
+    Check(path.has_value());
+    std::error_code pathError;
+    Check(std::filesystem::equivalent(*path, expectedPath, pathError) && !pathError);
+    std::error_code replacementError;
+    Check(!std::filesystem::equivalent(*path, original, replacementError) && !replacementError);
+    std::array<char, 512> entries{};
+    const int bytes = sceKernelGetdents(fd, entries.data(), static_cast<int>(entries.size()));
+    Check(bytes > 0);
+    const std::string listing(entries.data(), static_cast<std::size_t>(bytes));
+    Check(listing.find("original-entry") != std::string::npos && listing.find("replacement-entry") == std::string::npos);
+    Check(sceKernelFchmod(fd, 0700) == 0);
+    Check(sceKernelFutimes(fd, nullptr) == 0);
+    Check(sceKernelFsync(fd) == 0);
+    KernelStatfs fileSystem{};
+    Check(_fstatfs_nid_postfix(fd, &fileSystem) == 0);
+    Check(sceKernelClose(fd) == 0);
+    std::filesystem::remove_all(original);
+    std::filesystem::remove_all(renamed);
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -235,6 +494,8 @@ int main(int argc, char** argv) {
     const auto root = AppArchiveFixture::EnterFreshRoot("anyps5-kernel-app-archive");
     if (mode == "archive") {
         Archive(root);
+        FileNumbers();
+        ConcurrentArchiveDirectoryEntries();
         Reads();
         Status();
         Refusals();
@@ -243,10 +504,12 @@ int main(int argc, char** argv) {
         const int fd = sceKernelOpen("/app0/Data/Small.txt", SCE_KERNEL_O_RDONLY, 0);
         Check(fd >= 0);
         _ZSt13set_terminatePFvvE_nid_postfix(OnMmapRefused);
+
         (void)mmap_nid_postfix(nullptr, 16384, 1, 2, fd, 0);
         return 1;
     } else if (mode == "plain") {
         WithoutArchive();
+        NativeDirectoryIdentity(root);
     } else {
         return 2;
     }
diff --git a/core/libs/tests/GuestKernelErrors.cpp b/core/libs/tests/GuestKernelErrors.cpp
index 1932625356..0cc54fbfe9 100644
--- a/core/libs/tests/GuestKernelErrors.cpp
+++ b/core/libs/tests/GuestKernelErrors.cpp
@@ -1,3 +1,9 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
+#include "prx/libSceSaveData/SaveDataCore.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -8,60 +14,20 @@
 #include <thread>
 
 extern "C" {
-int APS5_VABI sceKernelCreateSema(KernelSema*, const char*, std::uint32_t, int, int, void*);
-int APS5_VABI sceKernelDeleteSema(KernelSema);
-int APS5_VABI sceKernelSignalSema(KernelSema, int);
-int APS5_VABI sceKernelPollSema(KernelSema, int);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_init_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_settype_nid_postfix(PthreadMutexattr* attr, int type);
-int APS5_VABI pthread_mutexattr_destroy_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTrylock(PthreadMutex* mutex);
-int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, std::uint32_t attr, std::uint64_t init_pattern, const void* param);
-int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef);
-int APS5_VABI sceKernelOpenEventFlag(KernelEventFlag* ef, const char* name);
-int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern);
-int APS5_VABI sceKernelClearEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern);
-int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, std::uint64_t set_pattern, int* num_wait_threads);
-int APS5_VABI sceKernelPollEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern, std::uint32_t wait_mode, std::uint64_t* result_pat);
-int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern, std::uint32_t wait_mode, std::uint64_t* result_pat, KernelUseconds* timeout);
+
 int APS5_Test_GetEventFlagWaiterCount(KernelEventFlag handle);
 }
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_ENOENT = static_cast<int>(0x80020002);
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
-static constexpr int SCE_KERNEL_ERROR_EBADF = static_cast<int>(0x80020009);
-static constexpr int SCE_KERNEL_ERROR_EDEADLK = static_cast<int>(0x8002000B);
-static constexpr int SCE_KERNEL_ERROR_EFAULT = static_cast<int>(0x8002000E);
-static constexpr int SCE_KERNEL_ERROR_EACCES = static_cast<int>(0x8002000D);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
-static constexpr int SCE_KERNEL_ERROR_ECANCELED = static_cast<int>(0x80020055);
 static constexpr std::uint32_t EVF_ATTR_SINGLE = 0x10;
 static constexpr std::uint32_t EVF_ATTR_MULTI = 0x20;
+static constexpr std::uint32_t EVF_ATTR_SHARED = 0x100;
 static constexpr std::uint32_t EVF_WAITMODE_AND = 0x01;
 static constexpr std::uint32_t EVF_WAITMODE_OR = 0x02;
 static constexpr std::uint32_t EVF_WAITMODE_CLEAR_ALL = 0x10;
 static constexpr std::uint32_t EVF_WAITMODE_CLEAR_PAT = 0x20;
 static constexpr int MUTEX_TYPE_ERRORCHECK = 1;
+static constexpr int MUTEX_TYPE_NORMAL = 3;
 static constexpr int PRIO_NONE = 0;
 static constexpr int PRIO_INHERIT = 1;
 static constexpr int PRIO_PROTECT = 2;
@@ -78,6 +44,13 @@ static void WaitForEventFlagWaiters(KernelEventFlag handle, int expected) {
     }
 }
 
+template <typename TLock>
+static void RequireTimesOut(TLock lock) {
+    const auto start = std::chrono::steady_clock::now();
+    Require(lock(20000) == SCE_KERNEL_ERROR_ETIMEDOUT);
+    Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(15));
+}
+
 int main() {
     constexpr int maximum = std::numeric_limits<int>::max();
     KernelSema semaphore = nullptr;
@@ -92,9 +65,9 @@ int main() {
     Require(sceKernelCreateSema(&semaphore, "limit", 1, 1, 3, nullptr) == SCE_OK);
     Require(sceKernelSignalSema(semaphore, 3) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelSignalSema(semaphore, 2) == SCE_OK);
-    Require(sceKernelSignalSema(semaphore, 0) == SCE_OK);
+    Require(sceKernelSignalSema(semaphore, 0) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollSema(semaphore, 3) == SCE_OK);
-    Require(sceKernelSignalSema(semaphore, 0) == SCE_OK);
+    Require(sceKernelSignalSema(semaphore, 0) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollSema(semaphore, 1) == SCE_KERNEL_ERROR_EBUSY);
     Require(sceKernelDeleteSema(semaphore) == SCE_OK);
 
@@ -126,6 +99,7 @@ int main() {
     Require(scePthreadMutexattrDestroy(&attr) == SCE_OK);
     Require(scePthreadMutexLock(&mutex) == SCE_OK);
     Require(scePthreadMutexLock(&mutex) == SCE_KERNEL_ERROR_EDEADLK);
+    RequireTimesOut([&](KernelUseconds usec) { return scePthreadMutexTimedlock(&mutex, usec); });
     Require(scePthreadMutexDestroy(&mutex) == SCE_KERNEL_ERROR_EBUSY);
     Require(scePthreadMutexUnlock(&mutex) == SCE_OK);
     Require(scePthreadMutexDestroy(&mutex) == SCE_OK);
@@ -137,9 +111,41 @@ int main() {
     Require(scePthreadMutexattrDestroy(&attr) == SCE_OK);
     Require(scePthreadMutexLock(&adaptive) == SCE_OK);
     Require(scePthreadMutexLock(&adaptive) == SCE_KERNEL_ERROR_EDEADLK);
+    RequireTimesOut([&](KernelUseconds usec) { return scePthreadMutexTimedlock(&adaptive, usec); });
     Require(scePthreadMutexUnlock(&adaptive) == SCE_OK);
     Require(scePthreadMutexDestroy(&adaptive) == SCE_OK);
 
+    PthreadMutex timedDefault = nullptr;
+    Require(scePthreadMutexInit(&timedDefault, nullptr, nullptr) == SCE_OK);
+    Require(scePthreadMutexLock(&timedDefault) == SCE_OK);
+    RequireTimesOut([&](KernelUseconds usec) { return scePthreadMutexTimedlock(&timedDefault, usec); });
+    Require(scePthreadMutexUnlock(&timedDefault) == SCE_OK);
+    Require(scePthreadMutexTimedlock(&timedDefault, 20000) == SCE_OK);
+    Require(scePthreadMutexUnlock(&timedDefault) == SCE_OK);
+    Require(scePthreadMutexDestroy(&timedDefault) == SCE_OK);
+
+    Require(scePthreadMutexattrInit(&attr) == SCE_OK);
+    Require(scePthreadMutexattrSettype(&attr, MUTEX_TYPE_NORMAL) == SCE_OK);
+    PthreadMutex normal = nullptr;
+    Require(scePthreadMutexInit(&normal, &attr, nullptr) == SCE_OK);
+    Require(scePthreadMutexattrDestroy(&attr) == SCE_OK);
+    Require(scePthreadMutexLock(&normal) == SCE_OK);
+    RequireTimesOut([&](KernelUseconds usec) { return scePthreadMutexTimedlock(&normal, usec); });
+    Require(scePthreadMutexUnlock(&normal) == SCE_OK);
+    Require(scePthreadMutexDestroy(&normal) == SCE_OK);
+
+    PthreadRwlock rwlock = nullptr;
+    Require(scePthreadRwlockInit(&rwlock, nullptr, nullptr) == SCE_OK);
+    Require(scePthreadRwlockWrlock(&rwlock) == SCE_OK);
+    Require(scePthreadRwlockTrywrlock(&rwlock) == SCE_KERNEL_ERROR_EBUSY);
+    Require(scePthreadRwlockWrlock(&rwlock) == SCE_KERNEL_ERROR_EDEADLK);
+    RequireTimesOut([&](KernelUseconds usec) { return scePthreadRwlockTimedrdlock(&rwlock, usec); });
+    RequireTimesOut([&](KernelUseconds usec) { return scePthreadRwlockTimedwrlock(&rwlock, usec); });
+    Require(scePthreadRwlockUnlock(&rwlock) == SCE_OK);
+    Require(scePthreadRwlockTimedwrlock(&rwlock, 20000) == SCE_OK);
+    Require(scePthreadRwlockUnlock(&rwlock) == SCE_OK);
+    Require(scePthreadRwlockDestroy(&rwlock) == SCE_OK);
+
     PthreadMutex adaptiveStatic = reinterpret_cast<PthreadMutex>(std::uintptr_t{1});
     Require(scePthreadMutexLock(&adaptiveStatic) == SCE_OK);
     Require(adaptiveStatic != reinterpret_cast<PthreadMutex>(std::uintptr_t{1}));
@@ -198,6 +204,13 @@ int main() {
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
     Require(sceKernelCreateEventFlag(&ef, "test", EVF_ATTR_SINGLE | EVF_ATTR_MULTI, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelCreateEventFlag(&ef, "test", EVF_ATTR_MULTI | 0x1000u, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    for (const std::uint32_t attr : {0x03u, 0x13u, 0x23u, 0x103u, 0x130u, 0x04u, 0x08u, 0x40u, 0x80u, 0x200u, 0x80000000u, 0xffffffffu}) {
+        Require(sceKernelCreateEventFlag(&ef, "test_bad_attr", attr, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    }
+    for (const std::uint32_t attr : {0x02u, 0x11u, 0x12u, 0x21u, 0x22u}) {
+        Require(sceKernelCreateEventFlag(&ef, "test_attr", attr, 0, nullptr) == SCE_OK);
+        Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    }
     Require(sceKernelDeleteEventFlag(nullptr) == SCE_KERNEL_ERROR_ESRCH);
     Require(sceKernelSetEventFlag(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
     Require(sceKernelClearEventFlag(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
@@ -205,18 +218,89 @@ int main() {
     Require(sceKernelWaitEventFlag(nullptr, 1, EVF_WAITMODE_OR, nullptr, nullptr) == SCE_KERNEL_ERROR_ESRCH);
     Require(sceKernelCancelEventFlag(nullptr, 0, nullptr) == SCE_KERNEL_ERROR_ESRCH);
 
-    KernelEventFlag opened = nullptr;
-    Require(sceKernelOpenEventFlag(nullptr, "test") == SCE_KERNEL_ERROR_EINVAL);
-    Require(sceKernelOpenEventFlag(&opened, nullptr) == SCE_KERNEL_ERROR_EINVAL);
-    Require(sceKernelOpenEventFlag(&opened, "SceShellCoreUtilAppFocus") == SCE_KERNEL_ERROR_ENOENT && opened == nullptr);
-    Require(sceKernelCreateEventFlag(&ef, "test_open", EVF_ATTR_MULTI, 0x05, nullptr) == SCE_OK);
-    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_OK && opened == ef);
-    Require(sceKernelSetEventFlag(opened, 0x08) == SCE_OK);
-    std::uint64_t openedPattern = 0;
-    Require(sceKernelPollEventFlag(ef, 0x08, EVF_WAITMODE_OR, &openedPattern) == SCE_OK && openedPattern == 0x0d);
+    Require(sceKernelCreateEventFlag(&ef, "", EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
-    opened = nullptr;
-    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_KERNEL_ERROR_ENOENT && opened == nullptr);
+    Require(sceKernelCreateEventFlag(&ef, "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn", EVF_ATTR_SHARED | EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    for (const std::uint32_t attr : {EVF_ATTR_MULTI, EVF_ATTR_SHARED | EVF_ATTR_MULTI}) {
+        Require(sceKernelCreateEventFlag(&ef, "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn", attr, 0, nullptr) == SCE_KERNEL_ERROR_ENAMETOOLONG);
+    }
+
+    KernelEventFlag opened = nullptr;
+    Require(sceKernelOpenEventFlag(nullptr, "test") == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelOpenEventFlag(&opened, nullptr) == SCE_KERNEL_ERROR_EFAULT && opened == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "") == SCE_KERNEL_ERROR_ESRCH && opened == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn") == SCE_KERNEL_ERROR_ENAMETOOLONG && opened == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "SceShellCoreUtilAppFocus") == SCE_KERNEL_ERROR_ESRCH && opened == nullptr);
+    Require(sceKernelCloseEventFlag(nullptr) == SCE_KERNEL_ERROR_ESRCH);
+
+    KernelEventFlag plain = nullptr;
+    Require(sceKernelCreateEventFlag(&plain, "test_open", EVF_ATTR_MULTI, 0x01, nullptr) == SCE_OK);
+    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_KERNEL_ERROR_ESRCH && opened == nullptr);
+    Require(sceKernelCloseEventFlag(plain) == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelSetEventFlag(plain, 0x02) == SCE_OK);
+    KernelEventFlag plainTwin = nullptr;
+    Require(sceKernelCreateEventFlag(&plainTwin, "test_open", EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(plainTwin) == SCE_OK);
+
+    Require(sceKernelCreateEventFlag(&ef, "test_open", EVF_ATTR_SHARED | EVF_ATTR_MULTI, 0x05, nullptr) == SCE_OK);
+    KernelEventFlag sharedTwin = nullptr;
+    Require(sceKernelCreateEventFlag(&sharedTwin, "test_open", EVF_ATTR_SHARED | EVF_ATTR_MULTI, 0, nullptr) == SCE_KERNEL_ERROR_EPERM && sharedTwin == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_OK && opened != nullptr && opened != ef && opened != plain);
+    Require(sceKernelOpenEventFlag(nullptr, "test_open") == SCE_KERNEL_ERROR_EFAULT);
+    KernelEventFlag openedTwice = nullptr;
+    Require(sceKernelOpenEventFlag(&openedTwice, "test_open") == SCE_OK && openedTwice != opened && openedTwice != ef);
+    Require(sceKernelSetEventFlag(opened, 0x08) == SCE_OK);
+    Require(sceKernelClearEventFlag(openedTwice, ~std::uint64_t{0x04}) == SCE_OK);
+    std::uint64_t openedPattern = 0;
+    Require(sceKernelPollEventFlag(ef, 0x08, EVF_WAITMODE_OR, &openedPattern) == SCE_OK && openedPattern == 0x09);
+    Require(sceKernelDeleteEventFlag(opened) == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelCloseEventFlag(ef) == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelCloseEventFlag(openedTwice) == SCE_OK);
+    Require(sceKernelCloseEventFlag(openedTwice) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelSetEventFlag(openedTwice, 0x01) == SCE_KERNEL_ERROR_ESRCH);
+
+    std::atomic<int> orphanWaitRes{-1};
+    std::uint64_t orphanWaitPat = 0xdeadbeef;
+    std::thread orphanWaiter([&] {
+        orphanWaitRes = sceKernelWaitEventFlag(opened, 0x80, EVF_WAITMODE_OR, &orphanWaitPat, nullptr);
+    });
+    WaitForEventFlagWaiters(opened, 1);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    orphanWaiter.join();
+    Require(orphanWaitRes == SCE_KERNEL_ERROR_EACCES && orphanWaitPat == 0);
+    KernelEventFlag reopened = nullptr;
+    Require(sceKernelOpenEventFlag(&reopened, "test_open") == SCE_KERNEL_ERROR_ESRCH && reopened == nullptr);
+    std::uint64_t orphanPattern = 0xdeadbeef;
+    Require(sceKernelPollEventFlag(opened, 0, EVF_WAITMODE_OR, &orphanPattern) == SCE_KERNEL_ERROR_EINVAL && orphanPattern == 0xdeadbeef);
+    Require(sceKernelPollEventFlag(opened, 0x01, EVF_WAITMODE_OR, &orphanPattern) == SCE_KERNEL_ERROR_EACCES && orphanPattern == 0);
+    orphanPattern = 0xdeadbeef;
+    KernelUseconds orphanTimeout = 1000;
+    Require(sceKernelWaitEventFlag(opened, 0x01, EVF_WAITMODE_OR, &orphanPattern, &orphanTimeout) == SCE_KERNEL_ERROR_EACCES && orphanPattern == 0 && orphanTimeout == 1000);
+    Require(sceKernelSetEventFlag(opened, 0x02) == SCE_OK);
+    Require(sceKernelClearEventFlag(opened, 0) == SCE_OK);
+    int orphanCount = -1;
+    Require(sceKernelCancelEventFlag(opened, 0x04, &orphanCount) == SCE_OK && orphanCount == 0);
+    Require(sceKernelDeleteEventFlag(opened) == SCE_KERNEL_ERROR_EPERM);
+
+    Require(sceKernelCreateEventFlag(&ef, "test_open", EVF_ATTR_SHARED | EVF_ATTR_SINGLE, 0x01, nullptr) == SCE_OK);
+    Require(sceKernelOpenEventFlag(&reopened, "test_open") == SCE_OK && reopened != opened);
+    Require(sceKernelCloseEventFlag(opened) == SCE_OK);
+    Require(sceKernelCloseEventFlag(opened) == SCE_KERNEL_ERROR_ESRCH);
+    std::atomic<int> sharedSingleRes{-1};
+    std::uint64_t sharedSinglePat = 0;
+    std::thread sharedSingleWaiter([&] {
+        sharedSingleRes = sceKernelWaitEventFlag(ef, 0x80, EVF_WAITMODE_OR, &sharedSinglePat, nullptr);
+    });
+    WaitForEventFlagWaiters(ef, 1);
+    openedPattern = 0xdeadbeef;
+    Require(sceKernelPollEventFlag(reopened, 0x01, EVF_WAITMODE_OR, &openedPattern) == SCE_KERNEL_ERROR_EPERM && openedPattern == 0);
+    Require(sceKernelSetEventFlag(reopened, 0x80) == SCE_OK);
+    sharedSingleWaiter.join();
+    Require(sharedSingleRes == SCE_OK && sharedSinglePat == 0x81);
+    Require(sceKernelCloseEventFlag(reopened) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(plain) == SCE_OK);
 
     Require(sceKernelCreateEventFlag(&ef, "flag", EVF_ATTR_MULTI, 0x15, nullptr) == SCE_OK);
     std::uint64_t pattern = 0;
@@ -224,6 +308,16 @@ int main() {
     Require(sceKernelPollEventFlag(ef, 1, 0, &pattern) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollEventFlag(ef, 1, EVF_WAITMODE_AND | EVF_WAITMODE_OR, &pattern) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollEventFlag(ef, 1, EVF_WAITMODE_AND | EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT, &pattern) == SCE_KERNEL_ERROR_EINVAL);
+    for (const std::uint32_t mode : {0x04u, 0x40u, 0x100u, 0x80000000u, 0x103u}) {
+        pattern = 0xdeadbeef;
+        Require(sceKernelPollEventFlag(ef, 1, mode, &pattern) == SCE_KERNEL_ERROR_EINVAL && pattern == 0xdeadbeef);
+    }
+    for (const std::uint32_t mode : {EVF_WAITMODE_OR | 0x04u, EVF_WAITMODE_OR | 0x08u, EVF_WAITMODE_AND | 0x40u, EVF_WAITMODE_AND | 0x100u, EVF_WAITMODE_OR | 0x80000000u,
+                                     EVF_WAITMODE_OR | 0xffffff00u}) {
+        Require(sceKernelPollEventFlag(ef, 0x10, mode, &pattern) == SCE_OK && pattern == 0x15);
+    }
+    Require(sceKernelPollEventFlag(ef, 0x10, EVF_WAITMODE_OR | EVF_WAITMODE_CLEAR_PAT | 0x100u, &pattern) == SCE_OK && pattern == 0x15);
+    Require(sceKernelSetEventFlag(ef, 0x10) == SCE_OK);
 
     Require(sceKernelPollEventFlag(ef, 0x20, EVF_WAITMODE_OR, &pattern) == SCE_KERNEL_ERROR_EBUSY);
     Require(pattern == 0x15);
@@ -261,7 +355,43 @@ int main() {
 
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
 
-    Require(sceKernelCreateEventFlag(&ef, "single", EVF_ATTR_SINGLE | 0x02u, 0, nullptr) == SCE_OK);
+    Require(sceKernelCreateEventFlag(&ef, "single", EVF_ATTR_SINGLE | 0x02u, 0x04, nullptr) == SCE_OK);
+    std::atomic<int> singleRes{-1};
+    std::uint64_t singlePat = 0xdeadbeef;
+    std::thread singleWaiter([&] {
+        singleRes = sceKernelWaitEventFlag(ef, 0x01, EVF_WAITMODE_AND, &singlePat, nullptr);
+    });
+    WaitForEventFlagWaiters(ef, 1);
+    pattern = 0xdeadbeef;
+    Require(sceKernelPollEventFlag(ef, 0x04, EVF_WAITMODE_AND, &pattern) == SCE_KERNEL_ERROR_EPERM && pattern == 0);
+    pattern = 0xdeadbeef;
+    Require(sceKernelWaitEventFlag(ef, 0x04, EVF_WAITMODE_AND, &pattern, nullptr) == SCE_KERNEL_ERROR_EPERM && pattern == 0);
+    waitThreads = -1;
+    Require(sceKernelCancelEventFlag(ef, 0x08, &waitThreads) == SCE_OK && waitThreads == 1);
+    singleWaiter.join();
+    Require(singleRes == SCE_KERNEL_ERROR_ECANCELED && singlePat == 0);
+    Require(sceKernelPollEventFlag(ef, 0x08, EVF_WAITMODE_AND, &pattern) == SCE_OK && pattern == 0x08);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+
+    Require(sceKernelCreateEventFlag(&ef, "multi_cancel", EVF_ATTR_MULTI, 0x01, nullptr) == SCE_OK);
+    std::atomic<int> cancelRes1{-1};
+    std::atomic<int> cancelRes2{-1};
+    std::uint64_t cancelPat1 = 0xdeadbeef;
+    std::uint64_t cancelPat2 = 0xdeadbeef;
+    std::thread cancelT1([&] {
+        cancelRes1 = sceKernelWaitEventFlag(ef, 0x02, EVF_WAITMODE_AND, &cancelPat1, nullptr);
+    });
+    std::thread cancelT2([&] {
+        cancelRes2 = sceKernelWaitEventFlag(ef, 0x04, EVF_WAITMODE_OR, &cancelPat2, nullptr);
+    });
+    WaitForEventFlagWaiters(ef, 2);
+    waitThreads = -1;
+    Require(sceKernelCancelEventFlag(ef, 0x05, &waitThreads) == SCE_OK && waitThreads == 2);
+    cancelT1.join();
+    cancelT2.join();
+    Require(cancelRes1 == SCE_KERNEL_ERROR_ECANCELED && cancelPat1 == 0);
+    Require(cancelRes2 == SCE_KERNEL_ERROR_ECANCELED && cancelPat2 == 0);
+    Require(sceKernelPollEventFlag(ef, 0x05, EVF_WAITMODE_AND, &pattern) == SCE_OK && pattern == 0x05);
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
 
     Require(sceKernelCreateEventFlag(&ef, "imm_sat", EVF_ATTR_MULTI, 0x05, nullptr) == SCE_OK);
@@ -323,8 +453,9 @@ int main() {
     Require(sceKernelCreateEventFlag(&ef, "del_waiters", EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
     std::atomic<int> delRes1{-1};
     std::atomic<int> delRes2{-1};
+    std::uint64_t delPat = 0xdeadbeef;
     std::thread delT1([&] {
-        delRes1 = sceKernelWaitEventFlag(ef, 0x01, EVF_WAITMODE_AND, nullptr, nullptr);
+        delRes1 = sceKernelWaitEventFlag(ef, 0x01, EVF_WAITMODE_AND, &delPat, nullptr);
     });
     std::thread delT2([&] {
         delRes2 = sceKernelWaitEventFlag(ef, 0x02, EVF_WAITMODE_AND, nullptr, nullptr);
@@ -333,7 +464,7 @@ int main() {
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
     delT1.join();
     delT2.join();
-    Require(delRes1 == SCE_KERNEL_ERROR_EACCES);
+    Require(delRes1 == SCE_KERNEL_ERROR_EACCES && delPat == 0);
     Require(delRes2 == SCE_KERNEL_ERROR_EACCES);
 
     for (int iter = 0; iter < 50; ++iter) {
diff --git a/core/libs/tests/GuestKernelFcntl.cpp b/core/libs/tests/GuestKernelFcntl.cpp
index b75d3c22a9..492633063c 100644
--- a/core/libs/tests/GuestKernelFcntl.cpp
+++ b/core/libs/tests/GuestKernelFcntl.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -14,23 +17,7 @@
 #include <sys/socket.h>
 #include <unistd.h>
 #endif
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI __sys_socketex_nid_postfix(const char*, int, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI _fcntl_nid_postfix(int, int, ...);
-int APS5_VABI ioctl_nid_postfix(int, std::uint64_t, void*);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelFcntl(int, int, ...);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static constexpr int DuplicateCommand = 0;
 static constexpr int GetDescriptorFlags = 1;
@@ -199,6 +186,7 @@ static void SocketsKeepTheirPath() {
 }
 
 static void FileFlagsRoundTrip() {
+    std::remove("kernel_fcntl_probe.bin");
     const int file = sceKernelOpen("kernel_fcntl_probe.bin", CreateReadWrite, 0644);
     Require(file >= 0);
     Require(sceKernelFcntl(file, GetFlags) == ReadWrite);
@@ -275,13 +263,27 @@ static void FileFlagsRoundTrip() {
     Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append));
     Require(fcntl_nid_postfix(appending, SetFlags, Append | NonBlocking) == 0);
     Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append | NonBlocking));
-#ifdef _WIN32
-    Require(ThrowsWith([appending] { fcntl_nid_postfix(appending, SetFlags, 0); }, "fcntl: changing O_APPEND on a file is not implemented"));
-#else
+    Require(write_nid_postfix(appending, "ab", 2) == 2);
     Require(fcntl_nid_postfix(appending, SetFlags, 0) == 0);
     Require(fcntl_nid_postfix(appending, GetFlags) == WriteOnly);
-#endif
-    Require(ThrowsWith([appending] { fcntl_nid_postfix(appending, SetFlags, Append | 0x80); }, "fcntl: changing O_FSYNC on a file is not implemented"));
+    Require(sceKernelLseek(appending, 0, FromStart) == 0);
+    Require(write_nid_postfix(appending, "X", 1) == 1);
+    const int sharing = fcntl_nid_postfix(appending, DuplicateCommand, 0);
+    Require(sharing >= 0);
+    Require(fcntl_nid_postfix(sharing, SetFlags, Append) == 0);
+    Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append));
+    Require(sceKernelLseek(appending, 0, FromStart) == 0);
+    Require(write_nid_postfix(appending, "c", 1) == 1);
+    Require(fcntl_nid_postfix(sharing, SetFlags, 0) == 0);
+    Require(sceKernelLseek(appending, 0, FromStart) == 0);
+    Require(write_nid_postfix(appending, "Y", 1) == 1);
+    Require(close_nid_postfix(sharing) == 0);
+    const int reading = sceKernelOpen("kernel_fcntl_probe.bin", ReadOnly, 0);
+    Require(reading >= 0);
+    char written[16]{};
+    Require(sceKernelRead(reading, written, sizeof(written)) == 8 && std::memcmp(written, "Ybcdeabc", 8) == 0);
+    Require(sceKernelClose(reading) == 0);
+    Require(fcntl_nid_postfix(appending, SetFlags, Append | 0x80) == 0 && fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append | 0x80));
     Require(sceKernelClose(appending) == 0);
     std::remove("kernel_fcntl_probe.bin");
 }
@@ -425,8 +427,10 @@ static void RecordLocksBelongToTheProcess() {
 static void PipeFlagsRoundTrip() {
     int pipe[2];
     Require(pipe_nid_postfix(pipe) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadOnly);
-    Require(fcntl_nid_postfix(pipe[1], GetFlags) == WriteOnly);
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadWrite);
+    Require(fcntl_nid_postfix(pipe[1], GetFlags) == ReadWrite);
+    const int duplicate = fcntl_nid_postfix(pipe[1], DuplicateCommand, 20);
+    Require(duplicate >= 20 && fcntl_nid_postfix(duplicate, GetFlags) == ReadWrite && close_nid_postfix(duplicate) == 0);
     Require(fcntl_nid_postfix(pipe[1], SetDescriptorFlags, 1) == 0);
     Require(fcntl_nid_postfix(pipe[1], GetDescriptorFlags) == 1);
     Require(fcntl_nid_postfix(pipe[0], GetDescriptorFlags) == 0);
@@ -436,7 +440,7 @@ static void PipeFlagsRoundTrip() {
     Require(fcntl_nid_postfix(pipe[1], GetDescriptorFlags) == 0);
 
     Require(fcntl_nid_postfix(pipe[0], SetFlags, fcntl_nid_postfix(pipe[0], GetFlags) | NonBlocking) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadOnly | NonBlocking));
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadWrite | NonBlocking));
     char buffer[8] = {};
     RequireFailure(static_cast<int>(read_nid_postfix(pipe[0], buffer, sizeof(buffer))), GuestEagain);
     Require(write_nid_postfix(pipe[1], "abc", 3) == 3);
@@ -448,10 +452,10 @@ static void PipeFlagsRoundTrip() {
 
     int off = 0;
     Require(ioctl_nid_postfix(pipe[0], NonblockingRequest, &off) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadOnly);
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadWrite);
     int on = 1;
     Require(ioctl_nid_postfix(pipe[0], NonblockingRequest, &on) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadOnly | NonBlocking));
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadWrite | NonBlocking));
 
     Require(fcntl_nid_postfix(pipe[1], SetFlags, NonBlocking) == 0);
     char block[1024] = {};
diff --git a/core/libs/tests/GuestKernelFcntlSync.cpp b/core/libs/tests/GuestKernelFcntlSync.cpp
new file mode 100644
index 0000000000..e5f6665f44
--- /dev/null
+++ b/core/libs/tests/GuestKernelFcntlSync.cpp
@@ -0,0 +1,96 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <source_location>
+#include <string>
+
+extern "C" std::uint64_t FileSynchronousWritesForTest_nid_no_patch();
+
+namespace {
+
+constexpr int GetFlags = 3;
+constexpr int SetFlags = 4;
+constexpr int Synchronous = 0x80;
+constexpr int ReadWrite = 2;
+constexpr int Create = 0x200;
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+std::uint64_t Synced() {
+    return FileSynchronousWritesForTest_nid_no_patch();
+}
+
+void Toggle(const std::string& path) {
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create, 0600);
+    Require(file >= 0);
+    Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) == 0);
+    auto before = Synced();
+    Require(write_nid_postfix(file, "a", 1) == 1 && Synced() == before);
+
+    Require(fcntl_nid_postfix(file, SetFlags, Synchronous) == 0);
+    Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) != 0);
+    before = Synced();
+    Require(write_nid_postfix(file, "b", 1) == 1 && Synced() == before + 1);
+    char c[] = "c", d[] = "d", y[] = "y", z[] = "z";
+    const KernelIovec vectors[] = {{c, 1}, {d, 1}};
+    Require(writev_nid_postfix(file, vectors, 2) == 2 && Synced() == before + 2);
+    Require(pwrite_nid_disambig1_nid_postfix(file, "x", 1, 10) == 1 && Synced() == before + 3);
+    const KernelIovec tail[] = {{y, 1}, {z, 1}};
+    Require(pwritev_nid_postfix(file, tail, 2, 11) == 2 && Synced() == before + 4);
+
+    const int duplicate = dup_nid_postfix(file);
+    Require(duplicate >= 0 && (fcntl_nid_postfix(duplicate, GetFlags) & Synchronous) != 0);
+    Require(write_nid_postfix(duplicate, "e", 1) == 1 && Synced() == before + 5);
+
+    Require(fcntl_nid_postfix(duplicate, SetFlags, 0) == 0);
+    Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) == 0);
+    before = Synced();
+    Require(write_nid_postfix(file, "f", 1) == 1 && Synced() == before);
+
+    char contents[13] = {};
+    Require(pread_nid_postfix(file, contents, sizeof(contents), 0) == 13);
+    Require(std::memcmp(contents, "abcdef", 6) == 0 && std::memcmp(contents + 10, "xyz", 3) == 0);
+    Require(close_nid_postfix(duplicate) == 0 && close_nid_postfix(file) == 0);
+}
+
+void OpenedSynchronous(const std::string& path) {
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create | Synchronous, 0600);
+    Require(file >= 0 && (fcntl_nid_postfix(file, GetFlags) & Synchronous) != 0);
+    const auto before = Synced();
+    Require(write_nid_postfix(file, "h", 1) == 1 && Synced() == before + 1);
+    Require(close_nid_postfix(file) == 0);
+}
+
+void Pipes() {
+    int ends[2] = {-1, -1};
+    Require(pipe_nid_postfix(ends) == 0);
+    Require(fcntl_nid_postfix(ends[1], SetFlags, Synchronous) == 0);
+    Require((fcntl_nid_postfix(ends[1], GetFlags) & Synchronous) != 0);
+    const auto before = Synced();
+    Require(write_nid_postfix(ends[1], "i", 1) == 1 && Synced() == before);
+    Require(close_nid_postfix(ends[0]) == 0 && close_nid_postfix(ends[1]) == 0);
+}
+
+}
+
+int main() {
+    const auto stamp = std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const std::string first = "anyps5-fsync-" + stamp + ".bin";
+    const std::string second = "anyps5-fsync-open-" + stamp + ".bin";
+    Toggle(first);
+    OpenedSynchronous(second);
+    Pipes();
+    std::filesystem::remove(first);
+    std::filesystem::remove(second);
+    std::puts("guest_kernel_fcntl_sync passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelIsStack.cpp b/core/libs/tests/GuestKernelIsStack.cpp
index 968cdc981f..e9fdbae01d 100644
--- a/core/libs/tests/GuestKernelIsStack.cpp
+++ b/core/libs/tests/GuestKernelIsStack.cpp
@@ -1,24 +1,16 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
-int APS5_VABI sceKernelMapFlexibleMemory(void** addr, std::size_t len, int prot, int flags);
-int APS5_VABI sceKernelMunmap(std::uint64_t addr, std::size_t len);
-int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, std::uint64_t infoSize);
-}
-
 static constexpr int SCE_OK = 0;
 #ifdef ANYPS5_ENABLE_ASAN
 static constexpr std::uintptr_t APPLICATION_AREA_END = 0x000010FC00000000ull;
 #else
 static constexpr std::uintptr_t APPLICATION_AREA_END = 0x000000FC00000000ull;
 #endif
-static constexpr int SCE_KERNEL_ERROR_EACCES = static_cast<int>(0x8002000d);
 static int global = 0;
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestKernelRename.cpp b/core/libs/tests/GuestKernelRename.cpp
index 6b74a12f95..22cbbdbf65 100644
--- a/core/libs/tests/GuestKernelRename.cpp
+++ b/core/libs/tests/GuestKernelRename.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdio>
@@ -11,9 +12,7 @@
 #else
 #include <dlfcn.h>
 #endif
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-}
+
 using RenameFunction = int (APS5_VABI*)(const char*, const char*);
 static RenameFunction LoadKernelRename() {
 #ifdef _WIN32
diff --git a/core/libs/tests/GuestKernelStackProtect.cpp b/core/libs/tests/GuestKernelStackProtect.cpp
index a980ea9d09..2574e5e198 100644
--- a/core/libs/tests/GuestKernelStackProtect.cpp
+++ b/core/libs/tests/GuestKernelStackProtect.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <atomic>
@@ -18,18 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
-void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
-int* APS5_VABI __error_nid_postfix();
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr std::uintptr_t Page = 0x4000;
 static constexpr std::size_t GuardBytes = 0x10000;
diff --git a/core/libs/tests/GuestKernelSync.cpp b/core/libs/tests/GuestKernelSync.cpp
index fbe8391437..6386538124 100644
--- a/core/libs/tests/GuestKernelSync.cpp
+++ b/core/libs/tests/GuestKernelSync.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <algorithm>
 #include <cstdint>
@@ -12,19 +15,7 @@
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #endif
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, unsigned short);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-int APS5_VABI sceKernelMkdir(const char*, unsigned short);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelUnlink(const char*);
-int APS5_VABI sceKernelChmod_nid_postfix(const char*, std::uint16_t);
-void APS5_VABI sceKernelSync();
-void APS5_VABI sync_nid_postfix();
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(void*);
-}
+
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Kernel sync check failed at line %d\n", line);
@@ -50,7 +41,7 @@ int main() {
     Require(sceKernelMkdir("kernel_sync_probe/existing.bin/child", 0777) == static_cast<int>(0x80020014u));
     const int reader = sceKernelOpen("kernel_sync_probe/existing.bin", 0x0, 0);
     Require(reader >= 0 && sceKernelClose(reader) == 0);
-    void* stream = fopen_nid_postfix("kernel_sync_probe/existing.bin", "r");
+    FileStream* stream = fopen_nid_postfix("kernel_sync_probe/existing.bin", "r");
     Require(stream != nullptr && fclose_nid_postfix(stream) == 0);
     Require(!Recorded("kernel_sync_probe/existing.bin"));
     stream = fopen_nid_postfix("kernel_sync_probe/existing.bin", "a");
@@ -63,27 +54,33 @@ int main() {
     Require(Recorded("kernel_sync_probe/moved.bin"));
     Require(sceKernelUnlink("kernel_sync_probe/moved.bin") == 0);
     sceKernelSync();
+
     Require(!Recorded("kernel_sync_probe/data.bin") && !Recorded("kernel_sync_probe/moved.bin"));
     sceKernelSync();
+
     const int locked = sceKernelOpen("kernel_sync_probe/read_only.bin", 0x1 | 0x200, 0644);
     Require(locked >= 0 && sceKernelWrite(locked, "data", 4) == 4 && sceKernelClose(locked) == 0);
     Require(sceKernelChmod_nid_postfix("kernel_sync_probe/read_only.bin", 0444) == 0);
     Require(Recorded("kernel_sync_probe/read_only.bin"));
     sceKernelSync();
+
     Require(sceKernelChmod_nid_postfix("kernel_sync_probe/read_only.bin", 0644) == 0);
 #ifdef _WIN32
     const auto exclusive = CreateFileW(ResolvePath_nid_no_patch("kernel_sync_probe/read_only.bin").c_str(), GENERIC_READ, FILE_SHARE_READ,
         nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
     Require(exclusive != INVALID_HANDLE_VALUE);
     sceKernelSync();
+
     CloseHandle(exclusive);
 #endif
     sceKernelSync();
+
     const int synced = sceKernelOpen("kernel_sync_probe/synced.bin", 0x1 | 0x200 | 0x400, 0644);
     Require(synced >= 0 && sceKernelWrite(synced, "data", 4) == 4 && sceKernelClose(synced) == 0);
     Require(Recorded("kernel_sync_probe/synced.bin"));
     Require(sceKernelUnlink("kernel_sync_probe/synced.bin") == 0);
     sync_nid_postfix();
+
     Require(!Recorded("kernel_sync_probe/synced.bin"));
     std::filesystem::remove_all("kernel_sync_probe");
 }
diff --git a/core/libs/tests/GuestKernelSys.cpp b/core/libs/tests/GuestKernelSys.cpp
index a540b9b666..99ffc5a124 100644
--- a/core/libs/tests/GuestKernelSys.cpp
+++ b/core/libs/tests/GuestKernelSys.cpp
@@ -1,5 +1,12 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libc/include/General.hpp"
 #include "prx/libc/include/RemoveTree.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -25,58 +32,10 @@
 #endif
 #ifndef _WIN32
 #include <cerrno>
+#include <sys/mman.h>
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI fstatfs_nid_postfix(int, void*);
-int APS5_VABI _fstatfs_nid_postfix(int, void*);
-int APS5_VABI fstat_nid_postfix(int, FileStat*);
-std::int64_t APS5_VABI _fstat_nid_postfix(int, FileStat*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-std::int64_t APS5_VABI readlink_nid_postfix(const char*, char*, std::size_t);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-std::int64_t APS5_VABI pathconf_nid_postfix(const char*, int);
-int APS5_VABI fchdir_nid_postfix(int);
-int APS5_VABI chdir_nid_postfix(const char*);
-int APS5_VABI chroot_nid_postfix(const char*);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-int APS5_VABI getpid_nid_postfix();
-int APS5_VABI sceKernelTitleWorkaroundIsEnabled(const void*, std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelGetProcessType(int);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI setsid_nid_postfix(void);
-int APS5_VABI link_nid_postfix(const char*, const char*);
-int APS5_VABI symlink_nid_postfix(const char*, const char*);
-int APS5_VABI openat_nid_postfix(int, const char*, int, ...);
-int APS5_VABI unlinkat_nid_postfix(int, const char*, int);
-std::int64_t APS5_VABI readlinkat_nid_postfix(int, const char*, char*, std::size_t);
-int APS5_VABI mkdirat_nid_postfix(int, const char*, std::uint16_t);
-int APS5_VABI renameat_nid_postfix(int, const char*, int, const char*);
-int APS5_VABI fchmodat_nid_postfix(int, const char*, int, int);
-int APS5_VABI lchmod_nid_postfix(const char*, std::uint16_t);
-int APS5_VABI fchown_nid_postfix(int, std::uint32_t, std::uint32_t);
-int APS5_VABI fstatat_nid_postfix(int, const char*, FileStat*, int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t);
-int APS5_VABI scePthreadCondattrInit(PthreadCondattr*);
-int APS5_VABI scePthreadCondattrDestroy(PthreadCondattr*);
-int APS5_VABI scePthreadCondattrSetclock(PthreadCondattr*, KernelClockid);
-int APS5_VABI scePthreadCondattrGetclock(const PthreadCondattr*, KernelClockid*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Kernel sys check failed at line %u (guest errno %d)\n", location.line(), *__error_nid_postfix());
@@ -91,6 +50,7 @@ int Error() {
 bool PathconfThrows(const char* path, int name) {
     try {
         pathconf_nid_postfix(path, name);
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -100,15 +60,111 @@ bool PathconfThrows(const char* path, int name) {
 bool ChrootThrows(const std::string& path) {
     try {
         chroot_nid_postfix(path.c_str());
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), path.c_str()) != nullptr;
     }
     return false;
 }
 
+template <typename Call>
+bool ThrowsNaming(Call call, const char* text) {
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        return std::strstr(error.what(), text) != nullptr;
+    }
+    return false;
+}
+
+void OwnershipAndLinkTests(const std::filesystem::path& root) {
+    constexpr std::uint32_t Unchanged = 0xFFFFFFFFu;
+    const auto file = (root / "owned.txt").string();
+    std::ofstream(file).put('x');
+    const auto missing = (root / "missing.txt").string();
+    const auto throughFile = file + "/inner";
+    const auto linked = (root / "linked.txt").string();
+    const auto other = (root / "other.txt").string();
+    Require(chown_nid_postfix(file.c_str(), 0, 0) == 0);
+    Require(chown_nid_postfix(file.c_str(), Unchanged, Unchanged) == 0);
+    Require(lchown_nid_postfix(file.c_str(), 0, Unchanged) == 0);
+    Require(fchownat_nid_postfix(-100, file.c_str(), Unchanged, 0, 0) == 0);
+    Require(fchownat_nid_postfix(-100, file.c_str(), 0, 0, 0x200) == 0);
+    for (const auto call : {chown_nid_postfix, lchown_nid_postfix}) {
+        Require(call(missing.c_str(), 0, 0) == -1 && Error() == 2);
+        Require(call(throughFile.c_str(), 0, 0) == -1 && Error() == 20);
+        Require(call("", 0, 0) == -1 && Error() == 2);
+        Require(call(nullptr, 0, 0) == -1 && Error() == 14);
+    }
+    Require(fchownat_nid_postfix(-100, missing.c_str(), 0, 0, 0) == -1 && Error() == 2);
+    Require(fchownat_nid_postfix(-100, file.c_str(), 0, 0, 0x400) == -1 && Error() == 22);
+    Require(chown_nid_postfix(missing.c_str(), 1000, 0) == -1 && Error() == 2);
+    Require(chown_nid_postfix(nullptr, 1000, 0) == -1 && Error() == 14);
+    Require(lchown_nid_postfix(throughFile.c_str(), 0, 1000) == -1 && Error() == 20);
+    Require(fchownat_nid_postfix(-100, missing.c_str(), 1000, 0, 0) == -1 && Error() == 2);
+    Require(fchownat_nid_postfix(4321, "owned.txt", 1000, 0, 0) == -1 && Error() == 9);
+    Require(fchownat_nid_postfix(-100, file.c_str(), 1000, 0, 0x400) == -1 && Error() == 22);
+    Require(ThrowsNaming([&] { chown_nid_postfix(file.c_str(), 1000, 0); }, "chown: an owner"));
+    Require(ThrowsNaming([&] { lchown_nid_postfix(file.c_str(), 0, 1000); }, "lchown: a group"));
+    Require(ThrowsNaming([&] { fchownat_nid_postfix(-100, file.c_str(), 5, Unchanged, 0); }, "fchownat: an owner"));
+    const int directory = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(directory >= 0);
+    Require(fchownat_nid_postfix(directory, "owned.txt", 0, 0, 0) == 0);
+    Require(fchownat_nid_postfix(directory, "missing.txt", 0, 0, 0) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(-100, file.c_str(), -100, linked.c_str(), 0) == 0);
+    Require(std::filesystem::hard_link_count(file) == 2);
+    Require(linkat_nid_postfix(-100, file.c_str(), -100, linked.c_str(), 0x400) == -1 && Error() == 17);
+    Require(linkat_nid_postfix(-100, missing.c_str(), -100, other.c_str(), 0x400) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(-100, file.c_str(), -100, other.c_str(), 0x200) == -1 && Error() == 22);
+    Require(linkat_nid_postfix(-100, nullptr, -100, other.c_str(), 0) == -1 && Error() == 14);
+    Require(linkat_nid_postfix(-100, "", -100, other.c_str(), 0) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(directory, "owned.txt", -100, other.c_str(), 0) == 0);
+    Require(std::filesystem::hard_link_count(file) == 3 && std::filesystem::remove(other));
+    Require(linkat_nid_postfix(-100, file.c_str(), directory, "other.txt", 0) == 0);
+    Require(std::filesystem::hard_link_count(file) == 3);
+    Require(linkat_nid_postfix(directory, "owned.txt", directory, "other.txt", 0) == -1 && Error() == 17);
+    Require(linkat_nid_postfix(directory, "missing.txt", directory, "absent.txt", 0) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(4321, "owned.txt", directory, "absent.txt", 0) == -1 && Error() == 9);
+    Require(linkat_nid_postfix(directory, "owned.txt", 4321, "absent.txt", 0) == -1 && Error() == 9);
+    Require(linkat_nid_postfix(directory, "missing.txt", 4321, "absent.txt", 0) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(directory, "missing.txt", -100, nullptr, 0) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(-100, root.string().c_str(), 4321, "absent.txt", 0) == -1 && Error() == 1);
+    Require(linkat_nid_postfix(-100, root.string().c_str(), -100, "", 0) == -1 && Error() == 1);
+    Require(linkat_nid_postfix(directory, "owned.txt", -100, nullptr, 0) == -1 && Error() == 14);
+    Require(linkat_nid_postfix(directory, "owned.txt", -100, "", 0) == -1 && Error() == 2);
+    const int plain = sceKernelOpen(file.c_str(), SCE_KERNEL_O_RDONLY, 0);
+    Require(plain >= 0);
+    Require(linkat_nid_postfix(plain, "owned.txt", directory, "absent.txt", 0) == -1 && Error() == 20);
+    Require(linkat_nid_postfix(directory, "owned.txt", plain, "absent.txt", 0) == -1 && Error() == 20);
+    Require(sceKernelClose(plain) == 0 && std::filesystem::remove(other));
+    Require(!std::filesystem::exists(root / "absent.txt"));
+    const auto symbolic = (root / "owned.link").string();
+    const auto dangling = (root / "dangling.link").string();
+    if (symlink_nid_postfix("owned.txt", symbolic.c_str()) == 0) {
+        Require(symlink_nid_postfix("missing.txt", dangling.c_str()) == 0);
+        Require(chown_nid_postfix(symbolic.c_str(), 0, 0) == 0 && lchown_nid_postfix(symbolic.c_str(), 0, 0) == 0);
+        Require(chown_nid_postfix(dangling.c_str(), 0, 0) == -1 && Error() == 2);
+        Require(lchown_nid_postfix(dangling.c_str(), 0, 0) == 0);
+        Require(fchownat_nid_postfix(-100, dangling.c_str(), 0, 0, 0) == -1 && Error() == 2);
+        Require(fchownat_nid_postfix(-100, dangling.c_str(), 0, 0, 0x200) == 0);
+        Require(ThrowsNaming([&] { linkat_nid_postfix(-100, symbolic.c_str(), -100, other.c_str(), 0); }, "symbolic link itself"));
+        Require(linkat_nid_postfix(-100, symbolic.c_str(), -100, other.c_str(), 0x400) == 0);
+#ifdef _WIN32
+        Require((GetFileAttributesW(std::filesystem::path(other).c_str()) & FILE_ATTRIBUTE_REPARSE_POINT) == 0);
+#else
+        Require(!std::filesystem::is_symlink(std::filesystem::symlink_status(other)));
+#endif
+        Require(std::filesystem::hard_link_count(file) == 3);
+        Require(std::filesystem::remove(other) && std::filesystem::remove(symbolic) && std::filesystem::remove(dangling));
+    }
+    Require(sceKernelClose(directory) == 0);
+    Require(std::filesystem::remove(linked) && std::filesystem::remove(file));
+}
+
 bool SymlinkTargetThrows(const char* target, const std::string& created) {
     try {
         symlink_nid_postfix(target, created.c_str());
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -128,6 +184,119 @@ bool RemoveSymlink(const std::string& link) {
 #endif
 }
 
+class GuardedPaths {
+public:
+    GuardedPaths() {
+#ifdef _WIN32
+        SYSTEM_INFO info{};
+        GetSystemInfo(&info);
+        page = info.dwPageSize;
+        memory = static_cast<char*>(VirtualAlloc(nullptr, 2 * page, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        Require(memory != nullptr);
+        DWORD previous = 0;
+        Require(VirtualProtect(memory + page, page, PAGE_NOACCESS, &previous) != 0);
+#else
+        const long size = sysconf(_SC_PAGESIZE);
+        Require(size > 0);
+        page = static_cast<std::size_t>(size);
+        memory = static_cast<char*>(mmap(nullptr, 2 * page, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+        Require(memory != MAP_FAILED);
+        Require(mprotect(memory + page, page, PROT_NONE) == 0);
+#endif
+    }
+
+    ~GuardedPaths() {
+#ifdef _WIN32
+        Require(VirtualFree(memory, 0, MEM_RELEASE) != 0);
+#else
+        Require(munmap(memory, 2 * page) == 0);
+#endif
+    }
+
+    char* Unreadable() const { return memory + page; }
+    char* Crossing() const { return memory + page - 3; }
+    char* Boundary() const { return memory + page - 2; }
+
+private:
+    char* memory = nullptr;
+    std::size_t page = 0;
+};
+
+void CheckUnreadablePaths(const std::string& renameSource, int directory) {
+    constexpr int Fault = 14;
+    constexpr int KernelFault = static_cast<int>(0x8002000Eu);
+    GuardedPaths paths;
+    std::memcpy(paths.Crossing(), "abc", 3);
+    std::string copy;
+    Require(CopyGuestPath_nid_no_patch(paths.Unreadable(), copy) == Fault);
+    Require(CopyGuestPath_nid_no_patch(paths.Crossing(), copy) == Fault);
+    paths.Boundary()[0] = '.';
+    paths.Boundary()[1] = '\0';
+    Require(CopyGuestPath_nid_no_patch(paths.Boundary(), copy) == 0 && copy == ".");
+    const std::string maximum(1023, 'p');
+    std::array<char, 1024> unterminated{};
+    unterminated.fill('p');
+    Require(CopyGuestPath_nid_no_patch(maximum.c_str(), copy) == 0 && copy == maximum);
+    Require(CopyGuestPath_nid_no_patch(unterminated.data(), copy) == 63);
+    const auto posixFault = [&](auto call) {
+        *__error_nid_postfix() = 0;
+        Require(call() == -1 && Error() == Fault);
+    };
+    FileStat status{};
+    char linkBuffer[16]{};
+    posixFault([&] { return open_nid_postfix(paths.Unreadable(), SCE_KERNEL_O_RDONLY, 0); });
+    posixFault([&] { return chmod_nid_postfix(paths.Unreadable(), 0); });
+    posixFault([&] { return mkdir_nid_postfix(paths.Unreadable(), 0755); });
+    posixFault([&] { return rmdir_nid_postfix(paths.Unreadable()); });
+    posixFault([&] { return unlink_nid_postfix(paths.Unreadable()); });
+    posixFault([&] { return stat_nid_postfix(paths.Unreadable(), &status); });
+    posixFault([&] { return lstat_nid_postfix(paths.Unreadable(), &status); });
+    posixFault([&] { return truncate_nid_postfix(paths.Unreadable(), 0); });
+    posixFault([&] { return utimes_nid_postfix(paths.Unreadable(), nullptr); });
+    posixFault([&] { return lutimes_nid_postfix(paths.Unreadable(), nullptr); });
+    posixFault([&] { return readlink_nid_postfix(paths.Unreadable(), linkBuffer, sizeof(linkBuffer)); });
+    posixFault([&] { return pathconf_nid_postfix(paths.Unreadable(), 4); });
+    posixFault([&] { return link_nid_postfix(paths.Unreadable(), "unused-link"); });
+    posixFault([&] { return link_nid_postfix(renameSource.c_str(), paths.Unreadable()); });
+    posixFault([&] { return symlink_nid_postfix(paths.Unreadable(), "unused-symlink"); });
+    posixFault([&] { return symlink_nid_postfix("target", paths.Unreadable()); });
+    posixFault([&] { return openat_nid_postfix(-100, paths.Unreadable(), SCE_KERNEL_O_RDONLY); });
+    posixFault([&] { return mkdirat_nid_postfix(-100, paths.Unreadable(), 0755); });
+    posixFault([&] { return fchmodat_nid_postfix(-100, paths.Unreadable(), 0, 0); });
+    posixFault([&] { return lchmod_nid_postfix(paths.Unreadable(), 0); });
+    posixFault([&] { return fstatat_nid_postfix(-100, paths.Unreadable(), &status, 0); });
+    posixFault([&] { return unlinkat_nid_postfix(-100, paths.Unreadable(), 0); });
+    posixFault([&] { return readlinkat_nid_postfix(-100, paths.Unreadable(), linkBuffer, sizeof(linkBuffer)); });
+    posixFault([&] { return renameat_nid_postfix(-100, paths.Unreadable(), -100, "unused-rename"); });
+    posixFault([&] { return renameat_nid_postfix(-100, renameSource.c_str(), -100, paths.Unreadable()); });
+    posixFault([&] { return openat_nid_postfix(directory, paths.Unreadable(), SCE_KERNEL_O_RDONLY); });
+    posixFault([&] { return mkdirat_nid_postfix(directory, paths.Unreadable(), 0755); });
+    posixFault([&] { return fchmodat_nid_postfix(directory, paths.Unreadable(), 0, 0); });
+    posixFault([&] { return fstatat_nid_postfix(directory, paths.Unreadable(), &status, 0); });
+    posixFault([&] { return unlinkat_nid_postfix(directory, paths.Unreadable(), 0); });
+    posixFault([&] { return readlinkat_nid_postfix(directory, paths.Unreadable(), linkBuffer, sizeof(linkBuffer)); });
+    posixFault([&] { return renameat_nid_postfix(directory, paths.Unreadable(), directory, "unused-rename"); });
+    posixFault([&] { return renameat_nid_postfix(directory, "file.txt", directory, paths.Unreadable()); });
+    *__error_nid_postfix() = 0;
+    Require(renameat_nid_postfix(directory, "missing", directory, paths.Unreadable()) == -1 && Error() == 2);
+    *__error_nid_postfix() = 0;
+    Require(link_nid_postfix("missing", paths.Unreadable()) == -1 && Error() == 2);
+    posixFault([&] { return shm_open_nid_postfix(paths.Unreadable(), SCE_KERNEL_O_RDWR, 0600); });
+    posixFault([&] { return shm_unlink_nid_postfix(paths.Unreadable()); });
+    Require(sceKernelOpen(paths.Unreadable(), SCE_KERNEL_O_RDONLY, 0) == KernelFault);
+    Require(sceKernelStat(paths.Unreadable(), &status) == KernelFault);
+    Require(sceKernelMkdir(paths.Unreadable(), 0755) == KernelFault);
+    Require(sceKernelRmdir(paths.Unreadable()) == KernelFault);
+    Require(sceKernelUnlink(paths.Unreadable()) == KernelFault);
+    Require(sceKernelChmod_nid_postfix(paths.Unreadable(), 0) == KernelFault);
+    Require(sceKernelTruncate_nid_postfix(paths.Unreadable(), 0) == KernelFault);
+    Require(sceKernelUtimes_nid_postfix(paths.Unreadable(), nullptr) == KernelFault);
+    Require(sceKernelCheckReachability(paths.Unreadable()) == KernelFault);
+    Require(sceKernelRename(paths.Unreadable(), ".") == KernelFault);
+    Require(sceKernelRename(renameSource.c_str(), paths.Unreadable()) == KernelFault);
+    Require(!std::filesystem::exists("unused-link") && !std::filesystem::exists("unused-symlink") && !std::filesystem::exists("unused-rename"));
+}
+
 void CheckSymlinkTargetRestrictions(const std::filesystem::path& root) {
     const auto created = (root / "rejected").string();
     for (const auto& target : {std::string(".."), std::string("../x"), std::string("a/../b"), std::string("a/../../x"), std::string("/abs")})
@@ -210,6 +379,31 @@ void CheckPathconf(const std::filesystem::path& root, const std::string& file) {
     Require(pathconf_nid_postfix(longPath.c_str(), 4) == -1 && Error() == 63);
 }
 
+void CheckSettimeofday() {
+    KernelTimezone zone{-1, -1};
+    Require(settimeofday_nid_postfix(nullptr, nullptr) == 0);
+    Require(gettimeofday_nid_postfix(nullptr, &zone) == 0 && zone.tz_minuteswest == 0 && zone.tz_dsttime == 0);
+    const KernelTimezone west{60, 1};
+    for (const KernelTimeval invalid : {KernelTimeval{0, 1000000}, KernelTimeval{0, -1}, KernelTimeval{-1, 0}})
+        Require(settimeofday_nid_postfix(&invalid, &west) == -1 && Error() == 22);
+    Require(gettimeofday_nid_postfix(nullptr, &zone) == 0 && zone.tz_minuteswest == 0 && zone.tz_dsttime == 0);
+    const KernelTimeval valid{1000000000, 0};
+    bool rejected = false;
+    try {
+        settimeofday_nid_postfix(&valid, &west);
+    } catch (const std::runtime_error& error) {
+        rejected = std::strstr(error.what(), "settimeofday: setting the time to 1000000000.000000") != nullptr;
+    }
+    Require(rejected);
+    Require(gettimeofday_nid_postfix(nullptr, &zone) == 0 && zone.tz_minuteswest == 0 && zone.tz_dsttime == 0);
+    Require(settimeofday_nid_postfix(nullptr, &west) == 0);
+    KernelTimeval now{};
+    Require(gettimeofday_nid_postfix(&now, &zone) == 0 && zone.tz_minuteswest == 60 && zone.tz_dsttime == 1 && now.tv_sec > 0);
+    const KernelTimezone zero{0, 0};
+    Require(settimeofday_nid_postfix(nullptr, &zero) == 0);
+    Require(gettimeofday_nid_postfix(nullptr, &zone) == 0 && zone.tz_minuteswest == 0 && zone.tz_dsttime == 0);
+}
+
 void DirectoryRenameTests(const std::filesystem::path& parent) {
     const auto fixture = parent / "directory-identity";
     const auto original = fixture / "original";
@@ -292,11 +486,7 @@ void DirectoryRenameTests(const std::filesystem::path& parent) {
 }
 
 static void CheckProcessQueries() {
-    struct {
-        std::int32_t version;
-        std::int32_t align;
-        std::uint64_t ids[2];
-    } workaround{1, 0, {(1ull << 3) | (1ull << 0x39), ~0ull}};
+    KernelTitleWorkaround workaround{1, 0, {(1ull << 3) | (1ull << 0x39), ~0ull}};
     std::int32_t enabled = -1;
     Require(sceKernelTitleWorkaroundIsEnabled(nullptr, 3, &enabled) == static_cast<int>(0x8002000E));
     Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 3, nullptr) == static_cast<int>(0x8002000E));
@@ -312,6 +502,52 @@ static void CheckProcessQueries() {
     Require(sceKernelGetProcessType(getpid_nid_postfix() + 1) == static_cast<int>(0x80020003));
 }
 
+template <typename F>
+bool DescriptorPathconfThrows(F fn, int descriptor, int name) {
+    try {
+        fn(descriptor, name);
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
+template <typename F>
+void CheckDescriptorPathconf(F fn, int descriptor) {
+    Require(fn(descriptor, 1) == 32767);
+    Require(fn(descriptor, 4) == 255);
+    Require(fn(descriptor, 5) == 1024);
+    Require(fn(descriptor, 6) == 512);
+    Require(fn(descriptor, 7) == 1);
+    Require(fn(descriptor, 8) == 1);
+    Require(fn(descriptor, 12) == 64);
+    *__error_nid_postfix() = 0;
+    Require(fn(descriptor, 15) == -1 && Error() == 0);
+    Require(fn(descriptor, 18) == 1024);
+    Require(fn(descriptor, 54) == 0);
+    Require(fn(descriptor, 55) == 0);
+    for (const int name : {0, 11, 61, 62, 65, -1})
+        Require(fn(descriptor, name) == -1 && Error() == 22);
+    Require(fn(descriptor, 53) == 200112);
+    for (const int name : {2, 3, 9, 10, 14, 16, 17, 21, 59, 60, 63, 64})
+        Require(DescriptorPathconfThrows(fn, descriptor, name));
+    Require(fn(-1, 4) == -1 && Error() == 9);
+    Require(fn(descriptor + 1000, 4) == -1 && Error() == 9);
+}
+
+template <typename F>
+void CheckPipePathconf(F fn) {
+    int ends[2]{-1, -1};
+    Require(pipe_nid_postfix(ends) == 0);
+    for (const int end : ends) {
+        Require(fn(end, 6) == 512);
+        Require(fn(end, 53) == 200112);
+        for (const int name : {0, 1, 4, 5, 7, 8, 12, 18, 54, 55, 61, -1})
+            Require(fn(end, name) == -1 && Error() == 22);
+    }
+    Require(close_nid_postfix(ends[0]) == 0 && close_nid_postfix(ends[1]) == 0);
+}
+
 int main() {
 #ifdef _WIN32
     auto hostDirectorySpelling = std::filesystem::current_path().native();
@@ -328,14 +564,17 @@ int main() {
         std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
     Require(std::filesystem::create_directory(root));
     DirectoryRenameTests(root);
+    OwnershipAndLinkTests(root);
     const auto file = (root / "file.txt").string();
     std::ofstream(file).put('x');
     CheckPathconf(root, file);
     const int descriptor = open_nid_postfix(file.c_str(), 0, 0);
     Require(descriptor >= 0);
-    unsigned char viaPublic[472] = {};
-    unsigned char viaSyscall[472] = {};
-    Require(fstatfs_nid_postfix(descriptor, viaPublic) == 0 && _fstatfs_nid_postfix(descriptor, viaSyscall) == 0);
+    KernelStatfs publicStats{};
+    auto* viaPublic = reinterpret_cast<unsigned char*>(&publicStats);
+    KernelStatfs syscallStats{};
+    auto* viaSyscall = reinterpret_cast<unsigned char*>(&syscallStats);
+    Require(fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(viaPublic)) == 0 && _fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(viaSyscall)) == 0);
     Require(std::memcmp(viaPublic, viaSyscall, 4) == 0 && std::memcmp(viaPublic + 16, viaSyscall + 16, 8) == 0);
     Require(std::memcmp(viaPublic + 280, viaSyscall + 280, 16) == 0);
     Require(fstatfs_nid_postfix(descriptor, nullptr) == -1 && Error() == 14);
@@ -344,10 +583,21 @@ int main() {
     Require(fstat_nid_postfix(descriptor, &viaFstat) == 0 && _fstat_nid_postfix(descriptor, &viaUnderscore) == 0);
     Require(std::memcmp(&viaFstat, &viaUnderscore, sizeof(FileStat)) == 0 && viaFstat.st_size == 1);
     Require(fstat_nid_postfix(descriptor, nullptr) == -1 && Error() == 14);
+    CheckDescriptorPathconf(fpathconf_nid_postfix, descriptor);
+    CheckDescriptorPathconf(_fpathconf_nid_postfix, descriptor);
+    CheckPipePathconf(fpathconf_nid_postfix);
+    CheckPipePathconf(_fpathconf_nid_postfix);
     Require(close_nid_postfix(descriptor) == 0);
-    Require(fstatfs_nid_postfix(-1, viaPublic) == -1 && Error() == 9);
+    Require(fstatfs_nid_postfix(-1, reinterpret_cast<KernelStatfs*>(viaPublic)) == -1 && Error() == 9);
     Require(fstat_nid_postfix(descriptor, &viaFstat) == -1 && Error() == 9);
     Require(fstat_nid_postfix(-1, &viaFstat) == -1 && Error() == 9);
+    Require(fpathconf_nid_postfix(descriptor, 4) == -1 && Error() == 9);
+    Require(_fpathconf_nid_postfix(descriptor, 4) == -1 && Error() == 9);
+    const int dirDescriptor = open_nid_postfix(root.generic_string().c_str(), 0, 0);
+    Require(dirDescriptor >= 0);
+    CheckDescriptorPathconf(fpathconf_nid_postfix, dirDescriptor);
+    CheckDescriptorPathconf(_fpathconf_nid_postfix, dirDescriptor);
+    Require(close_nid_postfix(dirDescriptor) == 0);
     char buffer[64];
     for (const auto& component : {std::string("missing"), std::string("file.txt")}) {
         const auto prefix = root.generic_string() + "/" + component + "/../";
@@ -442,7 +692,13 @@ int main() {
 #endif
     std::error_code error;
     const auto link = (root / "link").string();
+#ifdef _WIN32
+    if (!CreateSymbolicLinkW(std::filesystem::path(link).c_str(), L"sub\\target.txt", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)) {
+        error = std::error_code(GetLastError(), std::system_category());
+    }
+#else
     std::filesystem::create_symlink("sub/target.txt", link, error);
+#endif
     if (!error) {
         std::memset(buffer, '#', sizeof(buffer));
         Require(readlink_nid_postfix(link.c_str(), buffer, sizeof(buffer)) == 14);
@@ -487,6 +743,7 @@ int main() {
     Require(link_nid_postfix(nullptr, linked.c_str()) == -1 && Error() == 14);
     Require(link_nid_postfix(original.c_str(), "") == -1 && Error() == 2);
     Require(std::filesystem::remove(linked) && std::filesystem::hard_link_count(original) == 1);
+    CheckSettimeofday();
     const int directory = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
     Require(directory >= 0);
     const int fileDescriptor = sceKernelOpen(file.c_str(), SCE_KERNEL_O_RDONLY, 0);
@@ -628,6 +885,7 @@ int main() {
     CheckSymlinkTargetRestrictions(root);
     const int base = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
     Require(base >= 0);
+    CheckUnreadablePaths(file, base);
     const int relative = openat_nid_postfix(base, "file.txt", SCE_KERNEL_O_RDONLY);
     char byte = 0;
     Require(relative >= 0 && sceKernelRead(relative, &byte, 1) == 1 && byte == 'x');
@@ -651,6 +909,22 @@ int main() {
     const int plain = sceKernelOpen(file.c_str(), SCE_KERNEL_O_RDONLY, 0);
     Require(plain >= 0);
     Require(openat_nid_postfix(plain, "file.txt", SCE_KERNEL_O_RDONLY) == -1 && Error() == 20);
+    const int aliased = _openat_nid_postfix(base, "file.txt", SCE_KERNEL_O_RDONLY);
+    byte = 0;
+    Require(aliased >= 0 && sceKernelRead(aliased, &byte, 1) == 1 && byte == 'x');
+    Require(sceKernelClose(aliased) == 0);
+    const int aliasMade = _openat_nid_postfix(base, "alias.bin", SCE_KERNEL_O_WRONLY | SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL, 0600);
+    Require(aliasMade >= 0 && sceKernelClose(aliasMade) == 0 && std::filesystem::is_regular_file(root / "alias.bin"));
+#ifndef _WIN32
+    Require((std::filesystem::status(root / "alias.bin").permissions() & std::filesystem::perms::all) ==
+        (std::filesystem::perms::owner_read | std::filesystem::perms::owner_write));
+#endif
+    const int aliasWritten = _openat_nid_postfix(base, "alias.bin", SCE_KERNEL_O_WRONLY);
+    Require(aliasWritten >= 0 && sceKernelClose(aliasWritten) == 0);
+    Require(_openat_nid_postfix(base, "alias.bin", SCE_KERNEL_O_WRONLY | SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL, 0600) == -1 && Error() == 17);
+    Require(_openat_nid_postfix(base, "file.txt", SCE_KERNEL_O_ACCMODE) == -1 && Error() == 22);
+    Require(_openat_nid_postfix(-1, "file.txt", SCE_KERNEL_O_RDONLY) == -1 && Error() == 9);
+    Require(_openat_nid_postfix(plain, "file.txt", SCE_KERNEL_O_RDONLY) == -1 && Error() == 20);
     Require(readlinkat_nid_postfix(base, "file.txt", buffer, sizeof(buffer)) == -1 && Error() == 22);
     Require(readlinkat_nid_postfix(base, "missing.bin", buffer, sizeof(buffer)) == -1 && Error() == 2);
     Require(readlinkat_nid_postfix(base, "file.txt/child", buffer, sizeof(buffer)) == -1 && Error() == 20);
@@ -677,6 +951,19 @@ int main() {
     const std::string longName(256, 'a');
     Require(mkdirat_nid_postfix(base, longName.c_str(), 0700) == -1 && Error() == 63);
     Require(mkdirat_nid_postfix(base, "dir/../dotdot_dir", 0700) == 0 && std::filesystem::is_directory(root / "dotdot_dir"));
+#ifdef _WIN32
+    for (const DWORD linkFlags : {DWORD(0), DWORD(SYMBOLIC_LINK_FLAG_DIRECTORY)}) {
+        const auto loopLink = root / "mkdirat_loop";
+        if (CreateSymbolicLinkW(loopLink.c_str(), L"mkdirat_loop", linkFlags | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) == 0) {
+            Require(GetLastError() == ERROR_PRIVILEGE_NOT_HELD);
+            std::fprintf(stderr, "symbolic links unavailable: the mkdirat loop case not tested\n");
+            break;
+        }
+        Require(mkdirat_nid_postfix(base, "mkdirat_loop/child", 0700) == -1 && Error() == 62);
+        Require(mkdirat_nid_postfix(base, "mkdirat_loop", 0700) == -1 && Error() == 17);
+        Require((linkFlags != 0 ? RemoveDirectoryW(loopLink.c_str()) : DeleteFileW(loopLink.c_str())) != 0);
+    }
+#endif
     Require(unlinkat_nid_postfix(plain, "file.txt", 0) == -1 && Error() == 20);
     Require(unlinkat_nid_postfix(-1, "file.txt", 0) == -1 && Error() == 9);
     Require(sceKernelClose(plain) == 0);
@@ -820,7 +1107,12 @@ int main() {
 #endif
     Require(fchown_nid_postfix(base, 0, 0) == 0);
     Require(fchown_nid_postfix(base, 0xFFFFFFFFu, 0xFFFFFFFFu) == 0);
+    Require(fchown_nid_postfix(base, 0, 0xFFFFFFFFu) == 0);
+    Require(fchown_nid_postfix(base, 0xFFFFFFFFu, 0) == 0);
     Require(fchown_nid_postfix(-1, 0, 0) == -1 && Error() == 9);
+    Require(fchown_nid_postfix(-1, 1, 0) == -1 && Error() == 9);
+    Require(fchown_nid_postfix(-1, 0, 1) == -1 && Error() == 9);
+    Require(fchown_nid_postfix(-1, 1, 1) == -1 && Error() == 9);
     bool fchownThrew = false;
     try { fchown_nid_postfix(base, 1, 0); } catch (const std::exception&) { fchownThrew = true; }
     Require(fchownThrew);
diff --git a/core/libs/tests/GuestKernelSysAio.cpp b/core/libs/tests/GuestKernelSysAio.cpp
index 7eb23d13ad..200d3290b8 100644
--- a/core/libs/tests/GuestKernelSysAio.cpp
+++ b/core/libs/tests/GuestKernelSysAio.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
@@ -12,48 +15,10 @@
 
 namespace {
 
-struct Sigevent {
-    int notify;
-    int signo;
-    std::int64_t value;
-    std::int64_t extra[8];
-};
-
-struct Aiocb {
-    int fildes;
-    std::int64_t offset;
-    void* buf;
-    std::uint64_t nbytes;
-    int spare[2];
-    void* spare2;
-    int lioOpcode;
-    int reqprio;
-    std::int64_t status;
-    std::int64_t error;
-    void* kernelinfo;
-    Sigevent sigevent;
-};
-
-struct Timespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
-
 }
 
 extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
-int APS5_VABI close_nid_postfix(int descriptor);
-int APS5_VABI pipe_nid_postfix(int* descriptors);
-int APS5_VABI aio_read_nid_postfix(Aiocb* aiocb);
-int APS5_VABI aio_write_nid_postfix(Aiocb* aiocb);
-int APS5_VABI aio_fsync_nid_postfix(int operation, Aiocb* aiocb);
-int APS5_VABI aio_error_nid_postfix(const Aiocb* aiocb);
-std::int64_t APS5_VABI aio_return_nid_postfix(Aiocb* aiocb);
-int APS5_VABI aio_suspend_nid_postfix(const Aiocb* const* list, int count, const Timespec* timeout);
-std::int64_t APS5_VABI aio_waitcomplete_nid_postfix(Aiocb** result, const Timespec* timeout);
-int APS5_VABI aio_cancel_nid_postfix(int descriptor, Aiocb* aiocb);
+
 void AioHoldWorkerForTest_nid_no_patch(bool hold);
 }
 
@@ -84,8 +49,8 @@ int Error() {
     return *__error_nid_postfix();
 }
 
-Aiocb Request(int descriptor, void* buffer, std::uint64_t bytes, std::int64_t offset = 0) {
-    Aiocb request{};
+GuestAiocb Request(int descriptor, void* buffer, std::uint64_t bytes, std::int64_t offset = 0) {
+    GuestAiocb request{};
     request.fildes = descriptor;
     request.buf = buffer;
     request.nbytes = bytes;
@@ -93,14 +58,14 @@ Aiocb Request(int descriptor, void* buffer, std::uint64_t bytes, std::int64_t of
     return request;
 }
 
-void Wait(Aiocb& request) {
-    const Aiocb* list[] = {&request};
+void Wait(GuestAiocb& request) {
+    const GuestAiocb* list[] = {&request};
     Require(aio_suspend_nid_postfix(list, 1, nullptr) == 0);
 }
 
 void BeforeUse() {
-    Aiocb request{};
-    const Aiocb* list[] = {&request};
+    GuestAiocb request{};
+    const GuestAiocb* list[] = {&request};
     Require(aio_error_nid_postfix(&request) == Einval);
     Require(aio_return_nid_postfix(&request) == -1 && Error() == Einval);
     Require(aio_suspend_nid_postfix(list, 1, nullptr) == -1 && Error() == Eagain);
@@ -163,12 +128,12 @@ void ReadAndWrite(int file) {
     Wait(empty);
     Require(aio_return_nid_postfix(&empty) == 0);
 
-    const Aiocb* none[] = {&request};
+    const GuestAiocb* none[] = {&request};
     Require(aio_suspend_nid_postfix(none, 1, nullptr) == 0);
     Require(aio_suspend_nid_postfix(none, 0, nullptr) == 0);
     Require(aio_suspend_nid_postfix(none, -1, nullptr) == -1 && Error() == Einval);
     Require(aio_suspend_nid_postfix(none, 257, nullptr) == -1 && Error() == Einval);
-    const Timespec badTime{0, 1000000000};
+    const KernelTimespec badTime{0, 1000000000};
     Require(aio_suspend_nid_postfix(none, 1, &badTime) == -1 && Error() == Einval);
 }
 
@@ -179,8 +144,8 @@ void Cancel(int file) {
     auto second = Request(file, buffer, sizeof(buffer));
     Require(aio_read_nid_postfix(&first) == 0 && aio_read_nid_postfix(&second) == 0);
     Require(first.error == Einprogress && aio_error_nid_postfix(&first) == Einprogress);
-    const Aiocb* list[] = {&first};
-    const Timespec brief{0, 5000000};
+    const GuestAiocb* list[] = {&first};
+    const KernelTimespec brief{0, 5000000};
     Require(aio_suspend_nid_postfix(list, 1, &brief) == -1 && Error() == Eagain);
 
     Require(aio_cancel_nid_postfix(file, &first) == AioCanceled);
@@ -207,14 +172,14 @@ void SyncOrder(int file) {
     Require(aio_error_nid_postfix(&sync) == Einprogress);
     AioHoldWorkerForTest_nid_no_patch(false);
 
-    Aiocb* done = nullptr;
+    GuestAiocb* done = nullptr;
     Require(aio_waitcomplete_nid_postfix(&done, nullptr) == 7 && done == &write);
     Require(aio_waitcomplete_nid_postfix(&done, nullptr) == 0 && done == &sync && sync.status == 0);
-    const Timespec zero{0, 0};
+    const KernelTimespec zero{0, 0};
     Require(aio_waitcomplete_nid_postfix(&done, &zero) == -1 && Error() == Eagain && done == nullptr);
-    const Timespec brief{0, 5000000};
+    const KernelTimespec brief{0, 5000000};
     Require(aio_waitcomplete_nid_postfix(&done, &brief) == -1 && Error() == Eagain);
-    const Timespec badTime{0, -1};
+    const KernelTimespec badTime{0, -1};
     Require(aio_waitcomplete_nid_postfix(&done, &badTime) == -1 && Error() == Einval);
 }
 
diff --git a/core/libs/tests/GuestKernelSysBarrier.cpp b/core/libs/tests/GuestKernelSysBarrier.cpp
index 6969511d3a..084228c772 100644
--- a/core/libs/tests/GuestKernelSysBarrier.cpp
+++ b/core/libs/tests/GuestKernelSysBarrier.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
@@ -5,30 +8,6 @@
 #include <cstdint>
 #include <cstdlib>
 
-struct GuestBarrier;
-struct GuestBarrierattr;
-
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadBarrierattrInit(GuestBarrierattr** attr);
-int APS5_VABI scePthreadBarrierattrDestroy(GuestBarrierattr** attr);
-int APS5_VABI scePthreadBarrierattrGetpshared(GuestBarrierattr* const* attr, int* pshared);
-int APS5_VABI scePthreadBarrierattrSetpshared(GuestBarrierattr** attr, int pshared);
-int APS5_VABI scePthreadBarrierInit(GuestBarrier** barrier, GuestBarrierattr* const* attr, unsigned count, const char* name);
-int APS5_VABI scePthreadBarrierWait(GuestBarrier** barrier);
-int APS5_VABI scePthreadBarrierDestroy(GuestBarrier** barrier);
-int APS5_VABI scePthreadGetcpuclockid(Pthread thread, int* clockId);
-int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId);
-int APS5_VABI scePthreadGetconcurrency();
-int APS5_VABI pthread_setconcurrency_nid_postfix(int level);
-int APS5_VABI sceKernelMsync(void* address, std::size_t length, int flags);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_EFAULT = static_cast<int>(0x8002000E);
-static constexpr int SCE_KERNEL_ERROR_ENOMEM = static_cast<int>(0x8002000C);
 static constexpr int PROCESS_PRIVATE = 0;
 static constexpr int PROCESS_SHARED = 1;
 static constexpr int BARRIER_SERIAL_THREAD = -1;
@@ -39,7 +18,7 @@ static constexpr unsigned WAITERS = 4;
 static void Require(bool value) { if (!value) std::abort(); }
 
 struct Context {
-    GuestBarrier* barrier = nullptr;
+    PthreadBarrierPrivate* barrier = nullptr;
     std::atomic<int> serial{0};
     std::atomic<int> released{0};
 };
@@ -54,7 +33,7 @@ static void* APS5_VABI Waiter(void* arg) {
 }
 
 int main() {
-    GuestBarrierattr* attr = nullptr;
+    PthreadBarrierattrPrivate* attr = nullptr;
     Require(scePthreadBarrierattrInit(nullptr) == SCE_KERNEL_ERROR_EINVAL);
     Require(scePthreadBarrierattrInit(&attr) == 0 && attr != nullptr);
     int pshared = -1;
@@ -82,7 +61,7 @@ int main() {
     Require(scePthreadBarrierDestroy(&context.barrier) == SCE_KERNEL_ERROR_EINVAL);
     Require(scePthreadBarrierWait(nullptr) == SCE_KERNEL_ERROR_EINVAL);
 
-    GuestBarrier* single = nullptr;
+    PthreadBarrierPrivate* single = nullptr;
     Require(scePthreadBarrierInit(&single, nullptr, 1, nullptr) == 0);
     Require(scePthreadBarrierWait(&single) == BARRIER_SERIAL_THREAD);
     Require(scePthreadBarrierDestroy(&single) == 0);
diff --git a/core/libs/tests/GuestKernelSysConsoleIdentity.cpp b/core/libs/tests/GuestKernelSysConsoleIdentity.cpp
new file mode 100644
index 0000000000..f01ac5f625
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysConsoleIdentity.cpp
@@ -0,0 +1,71 @@
+#include "prx/libkernel_sys/libkernel_sys.hpp"
+#include "prx/libc/libc.hpp"
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+namespace {
+
+constexpr int GuestEperm = 1;
+constexpr int GuestEsrch = 3;
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "KERNEL SYS CONSOLE IDENTITY: %s\n", message);
+        std::abort();
+    }
+}
+
+void CheckConsoleKind() {
+    Require(sceKernelIsCEX() == 1, "the console must be reported as a retail unit");
+    Require(sceKernelIsDevKit() == 0, "the console must not be reported as a development kit");
+}
+
+void CheckAuthInfo() {
+    struct {
+        KernelAuthInfo value;
+        std::uint64_t guard;
+    } info;
+    *__error_nid_postfix() = 0;
+    Require(get_authinfo_nid_postfix(0, nullptr) == -1 && *__error_nid_postfix() == GuestEperm, "a null result must fail with EPERM");
+    std::memset(&info, 0x5a, sizeof(info));
+    *__error_nid_postfix() = 0;
+    Require(get_authinfo_nid_postfix(getpid_nid_postfix() + 1, &info.value) == -1 && *__error_nid_postfix() == GuestEsrch,
+            "another process must fail with ESRCH");
+    for (const auto byte : std::bit_cast<std::array<std::uint8_t, sizeof(info)>>(info))
+        Require(byte == 0x5a, "a refused call must not write the result");
+    for (const int pid : {0, getpid_nid_postfix()}) {
+        std::memset(&info, 0x5a, sizeof(info));
+        Require(get_authinfo_nid_postfix(pid, &info.value) == 0, "the guest process must be described");
+        Require(info.value.programAuthorityId == 0 && info.value.capabilities[0] == 0x2000000000000000, "the authority ID or first capability word is wrong");
+        const auto bytes = std::bit_cast<std::array<std::uint8_t, sizeof(KernelAuthInfo)>>(info.value);
+        for (std::size_t i = 16; i < bytes.size(); ++i) Require(bytes[i] == 0, "the rest of the result must be cleared");
+        Require(info.guard == 0x5a5a5a5a5a5a5a5a, "get_authinfo wrote past its 0x88-byte result");
+    }
+}
+
+void CheckOpenPsId() {
+    std::array<std::uint8_t, 16> plain{};
+    std::array<std::uint8_t, 24> system;
+    system.fill(0xa5);
+    *__error_nid_postfix() = GuestEsrch;
+    Require(sceKernelGetOpenPsIdForSystem(nullptr) == 22, "a null system OpenPSID must return positive EINVAL");
+    Require(*__error_nid_postfix() == GuestEsrch, "a null system OpenPSID must leave errno unchanged");
+    for (auto byte : system) Require(byte == 0xa5, "a null system OpenPSID must not write output");
+    Require(sceKernelGetOpenPsId(plain.data()) == 0, "the OpenPSID must be readable");
+    Require(sceKernelGetOpenPsIdForSystem(system.data()) == 0, "the system OpenPSID must be readable");
+    Require(std::memcmp(plain.data(), system.data(), plain.size()) == 0, "both OpenPSID queries must agree");
+    for (std::size_t i = plain.size(); i < system.size(); ++i) Require(system[i] == 0xa5, "the system OpenPSID wrote past 16 bytes");
+}
+
+}
+
+int main() {
+    CheckConsoleKind();
+    CheckAuthInfo();
+    CheckOpenPsId();
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysConstants.cpp b/core/libs/tests/GuestKernelSysConstants.cpp
new file mode 100644
index 0000000000..8565415fc8
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysConstants.cpp
@@ -0,0 +1,45 @@
+#include "SceTypes.hpp"
+#include "prx/libkernel_sys/libkernel_sys.hpp"
+#include <cstdlib>
+
+namespace {
+
+constexpr int GUEST_ENOTSUP = 45;
+constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
+constexpr int SCE_KERNEL_ERROR_ENOENT = static_cast<int>(0x80020002);
+constexpr int SCE_KERNEL_ERROR_ENOTSUP = static_cast<int>(0x8002002d);
+constexpr int SCE_KERNEL_ERROR_ENOSYS = static_cast<int>(0x8002004e);
+
+void Require(bool value) { if (!value) std::abort(); }
+
+}
+
+int main() {
+    Require(pthread_switch_add_np_nid_postfix() == GUEST_ENOTSUP);
+    Require(pthread_switch_delete_np_nid_postfix() == GUEST_ENOTSUP);
+
+    Require(sceKernelAddResource() == 0);
+    Require(sceKernelEventLogInit() == 0);
+    Require(sceKernelIsGenuineKratosCex() == 0);
+    Require(sceKernelReleaseTraceDirectMemory() == 0);
+
+    Require(sceKernelHasNeoMode() == 1);
+    Require(sceKernelIsAuthenticNeo() == 1);
+    Require(sceKernelIsGenuineN() == 1);
+
+    Require(sceKernelCreateEport() == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelDeleteEport() == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelOpenEport() == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelCloseEport() == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelTriggerEport() == SCE_KERNEL_ERROR_EPERM);
+
+    Require(sceKernelQueryTraceMemory() == SCE_KERNEL_ERROR_ENOENT);
+
+    Require(sceKernelIccGetCPMode() == SCE_KERNEL_ERROR_ENOTSUP);
+    Require(sceKernelIccSetCPMode() == SCE_KERNEL_ERROR_ENOTSUP);
+
+    Require(sceKernelClearGameDirectMemory() == SCE_KERNEL_ERROR_ENOSYS);
+    Require(sceKernelMapTraceMemory() == SCE_KERNEL_ERROR_ENOSYS);
+    Require(sceKernelTraceMemoryTypeProtect() == SCE_KERNEL_ERROR_ENOSYS);
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysKtimer.cpp b/core/libs/tests/GuestKernelSysKtimer.cpp
index 2dc1cc763f..bb189576b4 100644
--- a/core/libs/tests/GuestKernelSysKtimer.cpp
+++ b/core/libs/tests/GuestKernelSysKtimer.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
@@ -10,33 +13,6 @@
 
 namespace {
 
-struct Sigevent {
-    int notify;
-    int signo;
-    std::int64_t value;
-    std::int64_t extra[6];
-};
-
-struct Timespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
-
-struct Itimerspec {
-    Timespec interval;
-    Timespec value;
-};
-
-}
-
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI clock_gettime_nid_postfix(int clock, Timespec* time);
-int APS5_VABI ktimer_create_nid_postfix(int clock, const Sigevent* event, int* timerid);
-int APS5_VABI ktimer_delete_nid_postfix(int timerid);
-int APS5_VABI ktimer_settime_nid_postfix(int timerid, int flags, const Itimerspec* value, Itimerspec* oldValue);
-int APS5_VABI ktimer_gettime_nid_postfix(int timerid, Itimerspec* value);
-int APS5_VABI ktimer_getoverrun_nid_postfix(int timerid);
 }
 
 namespace {
@@ -51,7 +27,7 @@ constexpr int TimerAbstime = 1;
 constexpr std::int64_t Millisecond = 1000000;
 constexpr std::int64_t Second = 1000000000;
 
-const Sigevent None{0, 0, 0, {}};
+const GuestSigevent None{0, 0, 0, {}};
 
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (condition) return;
@@ -63,8 +39,8 @@ int Error() {
     return *__error_nid_postfix();
 }
 
-std::int64_t Nanoseconds(const Timespec& time) {
-    return time.seconds * Second + time.nanoseconds;
+std::int64_t Nanoseconds(const KernelTimespec& time) {
+    return time.tv_sec * Second + time.tv_nsec;
 }
 
 int Create(int clock = ClockMonotonic) {
@@ -73,8 +49,8 @@ int Create(int clock = ClockMonotonic) {
     return id;
 }
 
-Itimerspec Get(int id) {
-    Itimerspec value{{-1, -1}, {-1, -1}};
+GuestItimerspec Get(int id) {
+    GuestItimerspec value{{-1, -1}, {-1, -1}};
     Require(ktimer_gettime_nid_postfix(id, &value) == 0);
     return value;
 }
@@ -85,9 +61,9 @@ void Sleep(std::int64_t nanoseconds) {
 
 void Creation() {
     int id = -1;
-    const Sigevent badNotify{2, 0, 0, {}};
-    const Sigevent noSignal{1, 0, 0, {}};
-    const Sigevent badSignal{4, 129, 0, {}};
+    const GuestSigevent badNotify{2, 0, 0, {}};
+    const GuestSigevent noSignal{1, 0, 0, {}};
+    const GuestSigevent badSignal{4, 129, 0, {}};
     Require(ktimer_create_nid_postfix(ClockUptime, &None, &id) == -1 && Error() == Einval && id == -1);
     Require(ktimer_create_nid_postfix(-1, &None, &id) == -1 && Error() == Einval);
     Require(ktimer_create_nid_postfix(ClockMonotonic, &badNotify, &id) == -1 && Error() == Einval);
@@ -107,7 +83,7 @@ void Creation() {
 }
 
 void InvalidIds() {
-    Itimerspec value{};
+    GuestItimerspec value{};
     const int id = Create();
     Require(ktimer_delete_nid_postfix(id) == 0);
     for (const int bad : {-1, 0, 2, id, 32}) {
@@ -121,50 +97,50 @@ void InvalidIds() {
 
 void Values() {
     const int id = Create();
-    Itimerspec disarmed = Get(id);
-    Require(Nanoseconds(disarmed.value) == 0 && Nanoseconds(disarmed.interval) == 0);
-    for (const Itimerspec bad : {Itimerspec{{0, 0}, {-1, 0}}, Itimerspec{{0, 0}, {0, -1}}, Itimerspec{{0, 0}, {0, Second}},
-                                 Itimerspec{{-1, 0}, {1, 0}}, Itimerspec{{0, Second}, {1, 0}}})
+    GuestItimerspec disarmed = Get(id);
+    Require(Nanoseconds(disarmed.it_value) == 0 && Nanoseconds(disarmed.it_interval) == 0);
+    for (const GuestItimerspec bad : {GuestItimerspec{{0, 0}, {-1, 0}}, GuestItimerspec{{0, 0}, {0, -1}}, GuestItimerspec{{0, 0}, {0, Second}},
+                                 GuestItimerspec{{-1, 0}, {1, 0}}, GuestItimerspec{{0, Second}, {1, 0}}})
         Require(ktimer_settime_nid_postfix(id, 0, &bad, nullptr) == -1 && Error() == Einval);
 
-    const Itimerspec clear{{-1, 0}, {0, 0}};
+    const GuestItimerspec clear{{-1, 0}, {0, 0}};
     Require(ktimer_settime_nid_postfix(id, 0, &clear, nullptr) == 0);
     disarmed = Get(id);
-    Require(Nanoseconds(disarmed.value) == 0 && Nanoseconds(disarmed.interval) == 0);
+    Require(Nanoseconds(disarmed.it_value) == 0 && Nanoseconds(disarmed.it_interval) == 0);
 
-    const Itimerspec small{{0, 1}, {10, 0}};
+    const GuestItimerspec small{{0, 1}, {10, 0}};
     Require(ktimer_settime_nid_postfix(id, 0, &small, nullptr) == 0);
-    Itimerspec old{};
-    const Itimerspec later{{0, 0}, {20, 0}};
+    GuestItimerspec old{};
+    const GuestItimerspec later{{0, 0}, {20, 0}};
     Require(ktimer_settime_nid_postfix(id, 0, &later, &old) == 0);
-    Require(Nanoseconds(old.interval) == Millisecond);
-    Require(Nanoseconds(old.value) > 9 * Second && Nanoseconds(old.value) <= 10 * Second);
-    const Itimerspec tiny{{0, 0}, {0, 1}};
+    Require(Nanoseconds(old.it_interval) == Millisecond);
+    Require(Nanoseconds(old.it_value) > 9 * Second && Nanoseconds(old.it_value) <= 10 * Second);
+    const GuestItimerspec tiny{{0, 0}, {0, 1}};
     Require(ktimer_settime_nid_postfix(id, 0, &tiny, &old) == 0);
-    Require(Nanoseconds(old.value) > 19 * Second && Nanoseconds(old.value) <= 20 * Second);
-    const Itimerspec off{};
+    Require(Nanoseconds(old.it_value) > 19 * Second && Nanoseconds(old.it_value) <= 20 * Second);
+    const GuestItimerspec off{};
     Require(ktimer_settime_nid_postfix(id, 0, &off, &old) == 0);
-    Require(Nanoseconds(old.interval) == 0 && Nanoseconds(old.value) <= Millisecond);
+    Require(Nanoseconds(old.it_interval) == 0 && Nanoseconds(old.it_value) <= Millisecond);
     Require(ktimer_delete_nid_postfix(id) == 0);
 }
 
 void Expiry() {
     const int id = Create();
-    const Itimerspec once{{0, 0}, {0, 30 * Millisecond}};
+    const GuestItimerspec once{{0, 0}, {0, 30 * Millisecond}};
     Require(ktimer_settime_nid_postfix(id, 0, &once, nullptr) == 0);
     const auto running = Get(id);
-    Require(Nanoseconds(running.value) > 0 && Nanoseconds(running.value) <= 30 * Millisecond);
+    Require(Nanoseconds(running.it_value) > 0 && Nanoseconds(running.it_value) <= 30 * Millisecond);
     Sleep(60 * Millisecond);
     const auto expired = Get(id);
-    Require(Nanoseconds(expired.value) == 0 && Nanoseconds(expired.interval) == 0);
+    Require(Nanoseconds(expired.it_value) == 0 && Nanoseconds(expired.it_interval) == 0);
     Require(ktimer_getoverrun_nid_postfix(id) == 0);
 
-    const Itimerspec periodic{{0, 10 * Millisecond}, {0, 10 * Millisecond}};
+    const GuestItimerspec periodic{{0, 10 * Millisecond}, {0, 10 * Millisecond}};
     Require(ktimer_settime_nid_postfix(id, 0, &periodic, nullptr) == 0);
     Sleep(55 * Millisecond);
     const auto period = Get(id);
-    Require(Nanoseconds(period.interval) == 10 * Millisecond);
-    Require(Nanoseconds(period.value) > 0 && Nanoseconds(period.value) <= 10 * Millisecond);
+    Require(Nanoseconds(period.it_interval) == 10 * Millisecond);
+    Require(Nanoseconds(period.it_value) > 0 && Nanoseconds(period.it_value) <= 10 * Millisecond);
     Require(ktimer_getoverrun_nid_postfix(id) == 0);
     Require(ktimer_delete_nid_postfix(id) == 0);
 }
@@ -172,21 +148,21 @@ void Expiry() {
 void Absolute() {
     for (const int clock : {ClockRealtime, ClockMonotonic}) {
         const int id = Create(clock);
-        Timespec now{};
+        KernelTimespec now{};
         Require(clock_gettime_nid_postfix(clock, &now) == 0);
-        const Itimerspec future{{0, 0}, {now.seconds + 5, now.nanoseconds}};
+        const GuestItimerspec future{{0, 0}, {now.tv_sec + 5, now.tv_nsec}};
         Require(ktimer_settime_nid_postfix(id, TimerAbstime, &future, nullptr) == 0);
         const auto remaining = Get(id);
-        Require(Nanoseconds(remaining.value) > 4 * Second && Nanoseconds(remaining.value) <= 5 * Second);
+        Require(Nanoseconds(remaining.it_value) > 4 * Second && Nanoseconds(remaining.it_value) <= 5 * Second);
 
-        const Itimerspec past{{0, 0}, {now.seconds - 1, now.nanoseconds}};
+        const GuestItimerspec past{{0, 0}, {now.tv_sec - 1, now.tv_nsec}};
         Require(ktimer_settime_nid_postfix(id, TimerAbstime, &past, nullptr) == 0);
-        Require(Nanoseconds(Get(id).value) == 0);
-        const Itimerspec pastPeriodic{{1, 0}, {now.seconds - 10, now.nanoseconds}};
+        Require(Nanoseconds(Get(id).it_value) == 0);
+        const GuestItimerspec pastPeriodic{{1, 0}, {now.tv_sec - 10, now.tv_nsec}};
         Require(ktimer_settime_nid_postfix(id, TimerAbstime, &pastPeriodic, nullptr) == 0);
         const auto moved = Get(id);
-        Require(Nanoseconds(moved.value) > 0 && Nanoseconds(moved.value) <= Second);
-        Require(Nanoseconds(moved.interval) == Second);
+        Require(Nanoseconds(moved.it_value) > 0 && Nanoseconds(moved.it_value) <= Second);
+        Require(Nanoseconds(moved.it_interval) == Second);
         Require(ktimer_delete_nid_postfix(id) == 0);
     }
 }
diff --git a/core/libs/tests/GuestKernelSysLogin.cpp b/core/libs/tests/GuestKernelSysLogin.cpp
new file mode 100644
index 0000000000..44c5f217ed
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysLogin.cpp
@@ -0,0 +1,76 @@
+#include "SceTypes.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include <stdexcept>
+#include <string>
+
+extern "C" {
+void LoginNameForTest_nid_no_patch(const char* name);
+}
+
+namespace {
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+int Error() {
+    return *__error_nid_postfix();
+}
+
+void Getlogin() {
+    char expected[33]{};
+    const int error = getlogin_r_nid_postfix(expected, static_cast<int>(sizeof(expected)));
+    char* name = getlogin_nid_postfix();
+    if (error != 0) {
+        Require(name == nullptr && Error() == error);
+        return;
+    }
+    if (expected[0] == '\0') {
+        Require(name == nullptr);
+        return;
+    }
+    Require(name != nullptr && std::strcmp(name, expected) == 0);
+    Require(getlogin_nid_postfix() == name);
+}
+
+void GetloginPaths() {
+    LoginNameForTest_nid_no_patch("player");
+    char* name = getlogin_nid_postfix();
+    Require(name != nullptr && std::strcmp(name, "player") == 0);
+    char buffer[7];
+    std::memset(buffer, 'x', sizeof(buffer));
+    Require(getlogin_r_nid_postfix(buffer, 6) == 34 && buffer[0] == 'x');
+    Require(getlogin_r_nid_postfix(buffer, 7) == 0 && std::strcmp(buffer, "player") == 0);
+
+    const std::string longName(40, 'n');
+    LoginNameForTest_nid_no_patch(longName.c_str());
+    *__error_nid_postfix() = 0;
+    Require(getlogin_nid_postfix() == nullptr && Error() == 34);
+
+    LoginNameForTest_nid_no_patch("");
+    bool threw = false;
+    try {
+        getlogin_nid_postfix();
+    } catch (const std::runtime_error&) {
+        threw = true;
+    }
+    Require(threw);
+    LoginNameForTest_nid_no_patch(nullptr);
+}
+
+}
+
+int main() {
+    Getlogin();
+    GetloginPaths();
+    std::puts("getlogin passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysModuleInternal.cpp b/core/libs/tests/GuestKernelSysModuleInternal.cpp
index 0d477ebd9f..a51226a5e9 100644
--- a/core/libs/tests/GuestKernelSysModuleInternal.cpp
+++ b/core/libs/tests/GuestKernelSysModuleInternal.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <algorithm>
@@ -8,14 +10,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelGetModuleInfoInternal(KernelModule, ModuleInfoEx*);
-int APS5_VABI sceKernelGetModuleListInternal(KernelModule*, std::size_t, std::size_t*);
-int APS5_VABI sceKernelGetModuleList(KernelModule*, std::size_t, std::size_t*);
-int APS5_VABI sceKernelGetModuleInfo(KernelModule, ModuleInfo*);
-int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t, int, ModuleInfoEx*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::vector<KernelModule> List(int (APS5_VABI* list)(KernelModule*, std::size_t, std::size_t*)) {
@@ -57,11 +51,12 @@ static void CheckEachModule() {
 static void CheckMatchesAddressLookup() {
     ModuleInfoEx byAddress{};
     byAddress.st_size = sizeof(ModuleInfoEx);
-    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(&sceKernelGetModuleInfo), 2, &byAddress) == 0);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(&sceKernelGetModuleInfo), 1, &byAddress) == 0);
     ModuleInfoEx byHandle{};
     byHandle.st_size = sizeof(ModuleInfoEx);
     Require(sceKernelGetModuleInfoInternal(byAddress.id, &byHandle) == 0);
-    Require(std::memcmp(&byHandle, &byAddress, sizeof(ModuleInfoEx)) == 0);
+    Require(byAddress.st_size == 0 && byHandle.st_size == sizeof(ModuleInfoEx));
+    Require(std::memcmp(byHandle.name, byAddress.name, sizeof(ModuleInfoEx) - offsetof(ModuleInfoEx, name)) == 0);
 }
 
 static void CheckRefusals() {
@@ -79,10 +74,22 @@ static void CheckRefusals() {
     Require(sceKernelGetModuleInfoInternal(-1, &unknown) == SCE_KERNEL_ERROR_ESRCH && unknown.name[0] == '\0');
 }
 
+static void CheckLoadStartSysmodule() {
+    int res = -1;
+    Require(sceKernelLoadStartModuleForSysmodule(nullptr, 0, nullptr, 0, nullptr, &res) == static_cast<KernelModule>(SCE_KERNEL_ERROR_EFAULT));
+    Require(res == 0);
+    Require(sceKernelLoadStartModuleForSysmodule(nullptr, 0, nullptr, 0, nullptr, nullptr) == static_cast<KernelModule>(SCE_KERNEL_ERROR_EFAULT));
+    res = -1;
+    Require(sceKernelLoadStartModuleForSysmodule("/system/common/lib/nonexistent_sysmodule.sprx", 0, nullptr, 0, nullptr, &res) ==
+            static_cast<KernelModule>(SCE_KERNEL_ERROR_ENOENT));
+    Require(res == 0);
+}
+
 int main() {
     CheckList();
     CheckEachModule();
     CheckMatchesAddressLookup();
     CheckRefusals();
+    CheckLoadStartSysmodule();
     return 0;
 }
diff --git a/core/libs/tests/GuestKernelSysPselect.cpp b/core/libs/tests/GuestKernelSysPselect.cpp
new file mode 100644
index 0000000000..c4cb2f25a5
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysPselect.cpp
@@ -0,0 +1,167 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+
+namespace {
+
+constexpr int Eintr = 4;
+constexpr int Einval = 22;
+constexpr int SigBlock = 1;
+constexpr int SigSetmask = 3;
+constexpr int SigUsr1 = 30;
+
+struct Timespec {
+    std::int64_t seconds;
+    std::int64_t nanoseconds;
+};
+
+struct SignalSet {
+    std::uint32_t bits[4]{};
+};
+
+struct DescriptorSet {
+    std::array<std::uint64_t, 1024 / 64> words{};
+    void Add(int descriptor) { words[descriptor / 64] |= std::uint64_t{1} << (descriptor % 64); }
+    bool Has(int descriptor) const { return ((words[descriptor / 64] >> (descriptor % 64)) & 1u) != 0; }
+};
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+int Error() {
+    return *__error_nid_postfix();
+}
+
+SignalSet CurrentMask() {
+    SignalSet current{};
+    Require(sigprocmask_nid_postfix(SigBlock, nullptr, &current) == 0);
+    return current;
+}
+
+bool Same(const SignalSet& left, const SignalSet& right) {
+    return std::memcmp(left.bits, right.bits, sizeof(left.bits)) == 0;
+}
+
+int caught = 0;
+
+void APS5_VABI Count(int) {
+    ++caught;
+}
+
+void RaiseBlocked(const SignalSet& blocked) {
+    Require(sigprocmask_nid_postfix(SigBlock, &blocked, nullptr) == 0);
+    Require(raise_nid_postfix(SigUsr1) == 0 && caught == 0);
+}
+
+}
+
+int main() {
+    int descriptors[2]{-1, -1};
+    Require(pipe_nid_postfix(descriptors) == 0);
+    const int reader = descriptors[0];
+    const int writer = descriptors[1];
+    SignalSet blocked{};
+    blocked.bits[(SigUsr1 - 1) / 32] |= 1u << ((SigUsr1 - 1) % 32);
+    const SignalSet before = CurrentMask();
+    {
+        DescriptorSet read{};
+        read.Add(reader);
+        const Timespec limit{0, 200000000};
+        const auto start = std::chrono::steady_clock::now();
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, &limit, &blocked) == 0);
+        Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(150));
+        Require(!read.Has(reader));
+        Require(Same(CurrentMask(), before));
+    }
+    Require(write_nid_postfix(writer, "x", 1) == 1);
+    {
+        DescriptorSet read{};
+        read.Add(reader);
+        const Timespec limit{0, 999999999};
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, &limit, nullptr) == 1);
+        Require(read.Has(reader));
+    }
+    {
+        DescriptorSet read{};
+        read.Add(reader);
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, nullptr, &blocked) == 1);
+        Require(read.Has(reader));
+        Require(Same(CurrentMask(), before));
+    }
+    {
+        const Timespec invalid{0, 1000000000};
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, &invalid, &blocked) == -1 && Error() == Einval);
+        Require(Same(CurrentMask(), before));
+        const Timespec zero{0, 0};
+        Require(pselect_nid_postfix(-1, nullptr, nullptr, nullptr, &zero, nullptr) == -1 && Error() == Einval);
+    }
+    Require(signal_nid_postfix(SigUsr1, Count) != reinterpret_cast<GuestHandler>(static_cast<std::uintptr_t>(-1)));
+    const SignalSet empty{};
+    {
+        RaiseBlocked(blocked);
+        const SignalSet withUsr1 = CurrentMask();
+        DescriptorSet read{};
+        read.Add(writer);
+        const DescriptorSet original = read;
+        const Timespec limit{0, 300000000};
+        const auto start = std::chrono::steady_clock::now();
+        Require(pselect_nid_postfix(writer + 1, read.words.data(), nullptr, nullptr, &limit, &empty) == -1 && Error() == Eintr);
+        Require(std::chrono::steady_clock::now() - start < std::chrono::milliseconds(150));
+        Require(caught == 1);
+        Require(read.words == original.words);
+        Require(Same(CurrentMask(), withUsr1));
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, nullptr, &empty) == -1 && Error() == Eintr && caught == 1);
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        DescriptorSet read{};
+        read.Add(reader);
+        const Timespec limit{0, 300000000};
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, &limit, &empty) == 1 && caught == 1);
+        Require(read.Has(reader));
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        const Timespec zero{0, 0};
+        DescriptorSet read{};
+        read.Add(writer);
+        Require(pselect_nid_postfix(writer + 1, read.words.data(), nullptr, nullptr, &zero, &empty) == 0 && caught == 1);
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        const Timespec invalid{0, 1000000000};
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, &invalid, &empty) == -1 && Error() == Einval && caught == 1);
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        const Timespec limit{0, 200000000};
+        const auto start = std::chrono::steady_clock::now();
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, &limit, &blocked) == 0 && caught == 0);
+        Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(150));
+        Require(sigprocmask_nid_postfix(SigSetmask, &empty, nullptr) == 0 && caught == 1);
+        caught = 0;
+    }
+    Require(sigprocmask_nid_postfix(SigSetmask, &before, nullptr) == 0);
+    Require(close_nid_postfix(reader) == 0 && close_nid_postfix(writer) == 0);
+    std::puts("pselect passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysPthread.cpp b/core/libs/tests/GuestKernelSysPthread.cpp
index 9d352aa66c..1fbcc5054b 100644
--- a/core/libs/tests/GuestKernelSysPthread.cpp
+++ b/core/libs/tests/GuestKernelSysPthread.cpp
@@ -1,18 +1,10 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Atfork.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetscope(const PthreadAttr* attr, int* scope);
-int APS5_VABI scePthreadAttrSetscope(PthreadAttr* attr, int scope);
-int APS5_VABI scePthreadAtfork(PthreadAtforkHandler prepare, PthreadAtforkHandler parent, PthreadAtforkHandler child);
-int APS5_VABI scePthreadSetconcurrency(int level);
-int APS5_VABI scePthreadGetconcurrency();
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int SCOPE_PROCESS = 0;
 static constexpr int SCOPE_SYSTEM = 2;
 
diff --git a/core/libs/tests/GuestKernelSysPthreadNp.cpp b/core/libs/tests/GuestKernelSysPthreadNp.cpp
new file mode 100644
index 0000000000..a1cd8ca017
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysPthreadNp.cpp
@@ -0,0 +1,111 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
+#include "SceTypes.hpp"
+#include <cstdio>
+#include <exception>
+#include <initializer_list>
+#include <stdexcept>
+#include <string_view>
+
+namespace {
+
+constexpr int GUEST_EDEADLK = 11;
+constexpr int GUEST_EINVAL = 22;
+constexpr int SCE_FAILED_CALL = static_cast<int>(0x8001ffffu);
+constexpr unsigned SCE_KERNEL_ERROR_BASE = 0x80020000u;
+constexpr int KIND_ERRORCHECK = 1;
+constexpr int KIND_RECURSIVE = 2;
+constexpr int KIND_NORMAL = 3;
+constexpr int KIND_ADAPTIVE = 4;
+
+int failures = 0;
+
+template<typename TCall>
+void Case(const char* name, TCall call) {
+    try {
+        if (call()) return;
+        std::printf("%s: wrong answer\n", name);
+    } catch (const std::exception& error) {
+        std::printf("%s: %s\n", name, error.what());
+    }
+    ++failures;
+}
+
+template<typename TException, typename TCall>
+bool Throws(TCall call) {
+    try {
+        static_cast<void>(call());
+    } catch (const TException&) {
+        return true;
+    }
+    return false;
+}
+
+bool HasKind(const PthreadMutexattr* attr, int kind) {
+    int type = -1;
+    return pthread_mutexattr_gettype_nid_postfix(attr, &type) == 0 && type == kind;
+}
+
+bool LocksTwice(const PthreadMutexattr* attr, int secondLock) {
+    PthreadMutex mutex = nullptr;
+    if (pthread_mutex_init_nid_postfix(&mutex, attr) != 0) return false;
+    const bool locked = pthread_mutex_lock_nid_postfix(&mutex) == 0 && pthread_mutex_lock_nid_postfix(&mutex) == secondLock;
+    if (secondLock == 0) pthread_mutex_unlock_nid_postfix(&mutex);
+    return locked && pthread_mutex_unlock_nid_postfix(&mutex) == 0 && pthread_mutex_destroy_nid_postfix(&mutex) == 0;
+}
+
+void TestKind() {
+    Case("scePthreadMutexattrSetkind", [] {
+        PthreadMutexattr attr = nullptr;
+        if (pthread_mutexattr_init_nid_postfix(&attr) != 0) return false;
+        for (const int kind : {KIND_RECURSIVE, KIND_NORMAL, KIND_ADAPTIVE, KIND_ERRORCHECK}) {
+            if (scePthreadMutexattrSetkind(&attr, kind) != 0 || !HasKind(&attr, kind)) return false;
+        }
+        if (!LocksTwice(&attr, GUEST_EDEADLK)) return false;
+        if (scePthreadMutexattrSetkind(&attr, KIND_RECURSIVE) != 0 || !LocksTwice(&attr, 0)) return false;
+        for (const int kind : {0, 5, -1}) {
+            if (!Throws<std::runtime_error>([&] { return scePthreadMutexattrSetkind(&attr, kind); }) || !HasKind(&attr, KIND_RECURSIVE)) return false;
+        }
+        if (pthread_mutexattr_destroy_nid_postfix(&attr) != 0) return false;
+        return scePthreadMutexattrSetkind(&attr, KIND_NORMAL) == SCE_FAILED_CALL && scePthreadMutexattrSetkind(nullptr, KIND_NORMAL) == SCE_FAILED_CALL;
+    });
+    Case("scePthreadMutexattrGetkind", [] {
+        PthreadMutexattr attr = nullptr;
+        if (pthread_mutexattr_init_nid_postfix(&attr) != 0) return false;
+        for (const int kind : {KIND_RECURSIVE, KIND_NORMAL, KIND_ADAPTIVE, KIND_ERRORCHECK}) {
+            if (scePthreadMutexattrSetkind(&attr, kind) != 0 || scePthreadMutexattrGetkind(attr) != static_cast<int>(SCE_KERNEL_ERROR_BASE + static_cast<unsigned>(kind))) return false;
+        }
+        if (pthread_mutexattr_destroy_nid_postfix(&attr) != 0) return false;
+        return scePthreadMutexattrGetkind(nullptr) == SCE_FAILED_CALL;
+    });
+}
+
+void TestRwlockattr() {
+    Case("pthread_rwlockattr_settype_np", [] {
+        PthreadRwlockattr attr = nullptr;
+        if (pthread_rwlockattr_init_nid_postfix(&attr) != 0) return false;
+        for (const int type : {1, 2}) {
+            if (pthread_rwlockattr_settype_np_nid_postfix(&attr, type) != 0 || scePthreadRwlockattrSettype(&attr, type) != 0) return false;
+            PthreadRwlock rwlock = nullptr;
+            if (pthread_rwlock_init_nid_postfix(&rwlock, &attr) != 0) return false;
+            const bool usable = pthread_rwlock_wrlock_nid_postfix(&rwlock) == 0 && pthread_rwlock_unlock_nid_postfix(&rwlock) == 0;
+            if (!usable || pthread_rwlock_destroy_nid_postfix(&rwlock) != 0) return false;
+        }
+        for (const int type : {0, 3, -1, static_cast<int>(0x80000000u)}) {
+            if (pthread_rwlockattr_settype_np_nid_postfix(&attr, type) != GUEST_EINVAL) return false;
+        }
+        if (pthread_rwlockattr_destroy_nid_postfix(&attr) != 0) return false;
+        return pthread_rwlockattr_settype_np_nid_postfix(&attr, 1) == GUEST_EINVAL && pthread_rwlockattr_settype_np_nid_postfix(nullptr, 1) == GUEST_EINVAL;
+    });
+}
+
+}
+
+int main(int argc, char** argv) {
+    const std::string_view mode = argc > 1 ? argv[1] : "";
+    if (mode == "rwlockattr") TestRwlockattr();
+    else if (mode == "kind") TestKind();
+    else return 2;
+    if (failures == 0) std::printf("all cases passed\n");
+    return failures == 0 ? 0 : 1;
+}
diff --git a/core/libs/tests/GuestKernelSysSdkVersion.cpp b/core/libs/tests/GuestKernelSysSdkVersion.cpp
index 5579fe7e5e..dc20a51ac8 100644
--- a/core/libs/tests/GuestKernelSysSdkVersion.cpp
+++ b/core/libs/tests/GuestKernelSysSdkVersion.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel_sys/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -8,8 +9,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" int APS5_VABI sceKernelGetCompiledSdkVersion(std::int32_t* version);
-
 namespace {
 
 alignas(16) std::array<std::byte, 0x40> process{};
diff --git a/core/libs/tests/GuestKernelSysSwapcontext.cpp b/core/libs/tests/GuestKernelSysSwapcontext.cpp
new file mode 100644
index 0000000000..1aa364e87e
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysSwapcontext.cpp
@@ -0,0 +1,172 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
+#include "prx/libc/include/general/AsmMacros.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/System/include/UserContext.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <source_location>
+
+using ContextEntry = void (APS5_VABI*)();
+
+extern "C" {
+int APS5_VABI SwapKeepingRegisters(UserUcontext* saved, const UserUcontext* next);
+int APS5_VABI SwapClobberingRegisters(UserUcontext* saved, const UserUcontext* next);
+}
+
+asm(".text\n"
+    APS5_ASM_FUNCTION("SwapKeepingRegisters")
+    "    push %rbx\n"
+    "    push %rbp\n"
+    "    push %r12\n"
+    "    push %r13\n"
+    "    push %r14\n"
+    "    push %r15\n"
+    "    sub $8, %rsp\n"
+    "    movabsq $0x1111111111111111, %rbx\n"
+    "    movabsq $0x2222222222222222, %rbp\n"
+    "    movabsq $0x3333333333333333, %r12\n"
+    "    movabsq $0x4444444444444444, %r13\n"
+    "    movabsq $0x5555555555555555, %r14\n"
+    "    movabsq $0x6666666666666666, %r15\n"
+    "    call " APS5_ASM_SYMBOL("swapcontext_nid_postfix") "\n"
+    "    movabsq $0x1111111111111111, %rcx\n"
+    "    cmp %rcx, %rbx\n"
+    "    jne 1f\n"
+    "    movabsq $0x2222222222222222, %rcx\n"
+    "    cmp %rcx, %rbp\n"
+    "    jne 1f\n"
+    "    movabsq $0x3333333333333333, %rcx\n"
+    "    cmp %rcx, %r12\n"
+    "    jne 1f\n"
+    "    movabsq $0x4444444444444444, %rcx\n"
+    "    cmp %rcx, %r13\n"
+    "    jne 1f\n"
+    "    movabsq $0x5555555555555555, %rcx\n"
+    "    cmp %rcx, %r14\n"
+    "    jne 1f\n"
+    "    movabsq $0x6666666666666666, %rcx\n"
+    "    cmp %rcx, %r15\n"
+    "    je 2f\n"
+    "1:\n"
+    "    mov $-100, %eax\n"
+    "2:\n"
+    "    add $8, %rsp\n"
+    "    pop %r15\n"
+    "    pop %r14\n"
+    "    pop %r13\n"
+    "    pop %r12\n"
+    "    pop %rbp\n"
+    "    pop %rbx\n"
+    "    ret\n"
+    APS5_ASM_FUNCTION("SwapClobberingRegisters")
+    "    push %rbx\n"
+    "    push %rbp\n"
+    "    push %r12\n"
+    "    push %r13\n"
+    "    push %r14\n"
+    "    push %r15\n"
+    "    sub $8, %rsp\n"
+    "    movabsq $0x0badc0de0badc0de, %rbx\n"
+    "    mov %rbx, %rbp\n"
+    "    mov %rbx, %r12\n"
+    "    mov %rbx, %r13\n"
+    "    mov %rbx, %r14\n"
+    "    mov %rbx, %r15\n"
+    "    call " APS5_ASM_SYMBOL("swapcontext_nid_postfix") "\n"
+    "    add $8, %rsp\n"
+    "    pop %r15\n"
+    "    pop %r14\n"
+    "    pop %r13\n"
+    "    pop %r12\n"
+    "    pop %rbp\n"
+    "    pop %rbx\n"
+    "    ret\n");
+
+namespace {
+
+constexpr int Einval = 22;
+constexpr int SigBlock = 1;
+constexpr int SigSetmask = 3;
+constexpr int SigUsr1 = 30;
+constexpr std::size_t StackBytes = 256 * 1024;
+
+struct alignas(16) Stack {
+    unsigned char bytes[StackBytes];
+};
+
+Stack g_stack;
+UserUcontext g_main = {};
+UserUcontext g_coroutine = {};
+int g_steps = 0;
+bool g_coroutineSawBlocked = true;
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+int Error() {
+    return *__error_nid_postfix();
+}
+
+bool Usr1Blocked() {
+    std::uint32_t mask[4] = {};
+    Require(sigprocmask_nid_postfix(SigBlock, nullptr, mask) == 0);
+    return (mask[0] & (1u << (SigUsr1 - 1))) != 0;
+}
+
+void APS5_VABI Coroutine() {
+    g_coroutineSawBlocked = Usr1Blocked();
+    for (int step = 0; step < 3; ++step) {
+        ++g_steps;
+        Require(SwapClobberingRegisters(&g_coroutine, &g_main) == 0);
+    }
+}
+
+void Arguments() {
+    UserUcontext context = {};
+    Require(getcontext_nid_postfix(&context) == 0);
+    Require(swapcontext_nid_postfix(nullptr, &context) == -1 && Error() == Einval);
+    Require(swapcontext_nid_postfix(&context, nullptr) == -1 && Error() == Einval);
+
+    UserUcontext saved = {};
+    UserUcontext invalid = context;
+    invalid.mcontext.len = 0;
+    Require(swapcontext_nid_postfix(&saved, &invalid) == -1 && Error() == Einval);
+    Require(saved.mcontext.len == sizeof(UserMcontext) && saved.mcontext.rip != 0);
+}
+
+void PingPong() {
+    Require(getcontext_nid_postfix(&g_coroutine) == 0);
+    g_coroutine.stackPointer = g_stack.bytes;
+    g_coroutine.stackSize = sizeof(g_stack.bytes);
+    g_coroutine.link = &g_main;
+    makecontext_nid_postfix(&g_coroutine, &Coroutine, 0);
+    Require(g_coroutine.mcontext.len == sizeof(UserMcontext));
+
+    std::uint32_t block[4] = {1u << (SigUsr1 - 1), 0, 0, 0};
+    std::uint32_t previous[4] = {};
+    Require(sigprocmask_nid_postfix(SigBlock, block, previous) == 0);
+    for (int expected = 1; expected <= 3; ++expected) {
+        Require(SwapKeepingRegisters(&g_main, &g_coroutine) == 0);
+        Require(g_steps == expected && Usr1Blocked());
+    }
+    Require(!g_coroutineSawBlocked);
+    Require(SwapKeepingRegisters(&g_main, &g_coroutine) == 0);
+    Require(g_steps == 3 && Usr1Blocked());
+    Require(sigprocmask_nid_postfix(SigSetmask, previous, nullptr) == 0);
+}
+
+}
+
+int main() {
+    Arguments();
+    PingPong();
+    std::puts("guest_kernel_sys_swapcontext passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysThreadDefaults.cpp b/core/libs/tests/GuestKernelSysThreadDefaults.cpp
index 18a48b8f15..f38f272d56 100644
--- a/core/libs/tests/GuestKernelSysThreadDefaults.cpp
+++ b/core/libs/tests/GuestKernelSysThreadDefaults.cpp
@@ -1,23 +1,11 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI pthread_set_defaultstacksize_np_nid_postfix(std::size_t size);
-int APS5_VABI scePthreadSetDefaultstacksize(std::size_t size);
-void APS5_VABI scePthreadSetName(Pthread thread, const char* name);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, std::size_t* stackSize);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int POSIX_EINVAL = 22;
 static constexpr std::size_t INITIAL_DEFAULT = 1u << 20;
 
@@ -70,9 +58,11 @@ static void CheckDefaultStackSize() {
 static void CheckSetName() {
     char name[32] = {};
     scePthreadSetName(scePthreadSelf(), "renamed main");
+
     Require(scePthreadGetname(scePthreadSelf(), name) == 0);
     Require(std::strcmp(name, "renamed main") == 0);
     scePthreadSetName(scePthreadSelf(), nullptr);
+
     Require(scePthreadGetname(scePthreadSelf(), name) == 0);
     Require(name[0] == '\0');
 }
diff --git a/core/libs/tests/GuestKernelSysThreads.cpp b/core/libs/tests/GuestKernelSysThreads.cpp
new file mode 100644
index 0000000000..4134cfd6f2
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysThreads.cpp
@@ -0,0 +1,104 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/File/include/FileFlags.hpp"
+#include <nid/NidCompute.hpp>
+#include <thread>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <limits>
+#include <source_location>
+#include <string>
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#include <winioctl.h>
+#else
+#include <dlfcn.h>
+#endif
+
+static void Require(bool value, std::source_location location = std::source_location::current()) {
+    if (!value) {
+        std::fprintf(stderr, "Kernel sys API check failed at line %u\n", location.line());
+        std::abort();
+    }
+}
+
+static void* LoadLibraryFile(const std::filesystem::path& path) {
+#ifdef _WIN32
+    auto* module = reinterpret_cast<void*>(LoadLibraryExW(path.c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH));
+#else
+    auto* module = dlopen(path.c_str(), RTLD_NOW | RTLD_LOCAL);
+    if (!module) std::fprintf(stderr, "%s\n", dlerror());
+#endif
+    Require(module != nullptr);
+#ifdef _WIN32
+    std::wstring loaded(32768, L'\0');
+    const auto length = GetModuleFileNameW(static_cast<HMODULE>(module), loaded.data(), static_cast<DWORD>(loaded.size()));
+    Require(length != 0 && length < loaded.size());
+    loaded.resize(length);
+    Require(std::filesystem::equivalent(path, std::filesystem::path(loaded)));
+#endif
+    return module;
+}
+
+template <typename Function>
+static Function LoadFunction(void* module, const char* name, bool patched, const char* unpatched = nullptr) {
+    const auto symbol = patched ? Nid::ComputeNid(name, "") : unpatched ? std::string(unpatched) : std::string(name) + "_nid_postfix";
+#ifdef _WIN32
+    const auto function = reinterpret_cast<Function>(reinterpret_cast<void*>(GetProcAddress(static_cast<HMODULE>(module), symbol.c_str())));
+#else
+    const auto function = reinterpret_cast<Function>(dlsym(module, symbol.c_str()));
+#endif
+    if (!function) std::fprintf(stderr, "Missing symbol %s\n", symbol.c_str());
+    Require(function != nullptr);
+    return function;
+}
+
+
+int main(int argc, char** argv) {
+    Require(argc == 4);
+    const auto directory = std::filesystem::absolute(argv[1]);
+    const bool patched = std::strcmp(argv[2], "patched") == 0;
+    const std::string test = argv[3];
+#ifdef __linux__
+    if (test == "main_late_load") {
+        int (APS5_VABI* isMain)() = nullptr;
+        int (APS5_VABI* sceIsMain)() = nullptr;
+        int other = -1;
+        int sceOther = -1;
+        std::thread loader([&] {
+            auto* module = LoadLibraryFile(directory / "libkernel_sys.prx");
+            isMain = LoadFunction<int (APS5_VABI*)()>(module, "pthread_main_np", patched);
+            sceIsMain = LoadFunction<int (APS5_VABI*)()>(module, "scePthreadMain", patched, "scePthreadMain");
+            other = isMain();
+            sceOther = sceIsMain();
+        });
+        loader.join();
+        Require(other == 0 && isMain() == 1 && sceOther == 0 && sceIsMain() == 1);
+        return 0;
+    }
+#endif
+    Require(test == "main");
+    auto* sys = LoadLibraryFile(directory / "libkernel_sys.prx");
+    LoadLibraryFile(directory / "libkernel.prx");
+    auto* libc = LoadLibraryFile(directory / "libc.prx");
+    const auto error = LoadFunction<int* (APS5_VABI*)()>(libc, "__error", patched);
+    const auto isMain = LoadFunction<int (APS5_VABI*)()>(sys, "pthread_main_np", patched);
+    const auto sceIsMain = LoadFunction<int (APS5_VABI*)()>(sys, "scePthreadMain", patched, "scePthreadMain");
+    *error() = 71;
+    int other = -1;
+    int sceOther = -1;
+    std::thread worker([&] {
+        other = isMain();
+        sceOther = sceIsMain();
+    });
+    worker.join();
+    Require(other == 0 && isMain() == 1 && sceOther == 0 && sceIsMain() == 1 && *error() == 71);
+    return 0;
+}
diff --git a/core/libs/tests/GuestKill.cpp b/core/libs/tests/GuestKill.cpp
index 7b75694ea5..162e1b47ed 100644
--- a/core/libs/tests/GuestKill.cpp
+++ b/core/libs/tests/GuestKill.cpp
@@ -1,16 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <csignal>
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 using Handler = void (APS5_VABI *)(int);
-extern "C" {
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI kill_nid_postfix(int, int);
-int APS5_VABI killpg_nid_postfix(int, int);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
-}
+
 volatile std::sig_atomic_t received = 0;
 void APS5_VABI Callback(int value) { received = value; }
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestKqueue.cpp b/core/libs/tests/GuestKqueue.cpp
index 62085d4470..f3a6638b89 100644
--- a/core/libs/tests/GuestKqueue.cpp
+++ b/core/libs/tests/GuestKqueue.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <cctype>
@@ -15,33 +17,14 @@
 #include <aclapi.h>
 #include <windows.h>
 #endif
+#include <fcntl.h>
+#ifdef _WIN32
+#include <io.h>
+#else
+#include <unistd.h>
+#endif
 
-extern "C" {
-int APS5_VABI kqueue_nid_postfix();
-int APS5_VABI kevent_nid_postfix(int, const KernelEvent*, int, KernelEvent*, int, const KernelTimespec*);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI rmdir_nid_postfix(const char*);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddFileEvent(KernelEqueue eq, int fd, int watch, void* udata);
-int APS5_VABI sceKernelDeleteFileEvent(KernelEqueue eq, int fd);
-int* APS5_VABI __error_nid_postfix();
-}
-
+static constexpr int GuestEperm = 1;
 static constexpr int GuestEnoent = 2;
 static constexpr int GuestEbadf = 9;
 static constexpr int GuestEinval = 22;
@@ -56,9 +39,13 @@ static constexpr int FirstSocket = 0x10000000;
 static constexpr std::int16_t EvfiltRead = -1;
 static constexpr std::int16_t EvfiltWrite = -2;
 static constexpr std::int16_t EvfiltVnode = -4;
+static constexpr std::int16_t EvfiltAio = -3;
 static constexpr std::int16_t EvfiltProc = -5;
 static constexpr std::int16_t EvfiltTimer = -7;
+static constexpr std::int16_t EvfiltProcdesc = -8;
+static constexpr std::int16_t EvfiltLio = -10;
 static constexpr std::int16_t EvfiltUser = -11;
+static constexpr std::int16_t EvfiltSendfile = -12;
 static constexpr std::uint16_t EvAdd = 0x0001;
 static constexpr std::uint16_t EvDelete = 0x0002;
 static constexpr std::uint16_t EvEnable = 0x0004;
@@ -186,7 +173,94 @@ static void Timers() {
     RequireFailure(Apply(kq, Change(3, EvfiltTimer, EvAdd, 0x10, 5)), GuestEinval);
     RequireFailure(Apply(kq, Change(3, EvfiltTimer, EvAdd, NoteUseconds | 0x1, 5)), GuestEinval);
     Require(Apply(kq, Change(4, EvfiltTimer, EvAdd, 0, 100000)) == 0);
-    Require(Throws([kq] { Apply(kq, Change(4, EvfiltTimer, EvAdd, 0, 5)); }));
+    Require(Apply(kq, Change(4, EvfiltTimer, EvAdd, 0, 5)) == 0);
+    const KernelTimespec fiftyMillis{0, 50000000};
+    Require(kevent_nid_postfix(kq, nullptr, 0, events, 4, &fiftyMillis) == 0);
+    Require(close_nid_postfix(kq) == 0);
+}
+
+static void TimerReadd() {
+    const int kq = kqueue_nid_postfix();
+    int first = 0;
+    int second = 0;
+    KernelEvent events[4]{};
+    Require(Apply(kq, Change(6, EvfiltTimer, EvAdd, 0, 10, &first)) == 0);
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    Require(Apply(kq, Change(6, EvfiltTimer, EvAdd, 0, 1000, &second)) == 0);
+    Require(Poll(kq, events, 4) == 1 && events[0].ident == 6 && events[0].data >= 6 && events[0].udata == &second);
+    Require(Apply(kq, Change(6, EvfiltTimer, EvDelete)) == 0);
+
+    const auto armed = std::chrono::steady_clock::now();
+    Require(Apply(kq, Change(7, EvfiltTimer, EvAdd, 0, 50)) == 0);
+    Require(Apply(kq, Change(7, EvfiltTimer, EvAdd, 0, 10)) == 0);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 7);
+    Require(std::chrono::steady_clock::now() - armed >= std::chrono::milliseconds(49));
+    std::this_thread::sleep_for(std::chrono::milliseconds(120));
+    Require(Poll(kq, events, 4) == 1 && events[0].ident == 7 && events[0].data >= 6);
+    Require(Apply(kq, Change(7, EvfiltTimer, EvDelete)) == 0);
+
+    Require(Apply(kq, Change(8, EvfiltTimer, EvAdd, 0, 10)) == 0);
+    Require(Apply(kq, Change(8, EvfiltTimer, EvAdd, 0, 100)) == 0);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 8);
+    std::this_thread::sleep_for(std::chrono::milliseconds(120));
+    Require(Poll(kq, events, 4) == 1 && events[0].ident == 8 && events[0].data >= 1 && events[0].data <= 4);
+    Require(Apply(kq, Change(8, EvfiltTimer, EvDelete)) == 0);
+
+    Require(Apply(kq, Change(9, EvfiltTimer, EvAdd, 0, 20)) == 0);
+    Require(Apply(kq, Change(9, EvfiltTimer, EvAdd | EvOneshot, 0, 20)) == 0);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 9);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 9);
+    Require(Apply(kq, Change(9, EvfiltTimer, EvDelete)) == 0);
+
+    Require(Apply(kq, Change(10, EvfiltTimer, EvAdd | EvOneshot, 0, 100000)) == 0);
+    Require(Throws([kq] { Apply(kq, Change(10, EvfiltTimer, EvAdd, 0, 5)); }));
+    Require(Apply(kq, Change(11, EvfiltTimer, EvAdd, 0, 100000)) == 0);
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd, NoteUseconds, 5)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd, 0, 0)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd, 0, INTPTR_MAX)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd | EvClear, 0, 5)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvEnable, 0, 5)); }));
+    Require(Apply(kq, Change(12, EvfiltTimer, EvAdd | EvDisable, 0, 100000)) == 0);
+    Require(Throws([kq] { Apply(kq, Change(12, EvfiltTimer, EvAdd, 0, 5)); }));
+    Require(close_nid_postfix(kq) == 0);
+}
+
+static void UnsupportedFilters() {
+    const int kq = kqueue_nid_postfix();
+    for (const std::int16_t filter : {EvfiltAio, EvfiltLio, EvfiltSendfile}) {
+        RequireFailure(Apply(kq, Change(0, filter, EvAdd)), GuestEperm);
+        RequireFailure(Apply(kq, Change(5, filter, EvAdd)), GuestEperm);
+        RequireFailure(Apply(kq, Change(5, filter, EvAdd | EvClear)), GuestEperm);
+        RequireFailure(Apply(kq, Change(5, filter, EvDelete)), GuestEnoent);
+        RequireFailure(Apply(kq, Change(5, filter, EvEnable)), GuestEnoent);
+        const KernelEvent add = Change(5, filter, EvAdd, 7, 9);
+        KernelEvent failed[1]{};
+        Require(kevent_nid_postfix(kq, &add, 1, failed, 1, nullptr) == 1);
+        Require(failed[0].flags == EvError && failed[0].data == GuestEperm && failed[0].fflags == 0);
+    }
+    int pipe[2];
+    Require(pipe_nid_postfix(pipe) == 0);
+    int pair[2];
+    Require(socketpair_nid_postfix(Unix, Stream, 0, pair) == 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pipe[0]), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pipe[1]), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pair[0]), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pair[0]), EvfiltProcdesc, EvDelete)), GuestEnoent);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(kq), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(std::uintptr_t{1} << 40, EvfiltProcdesc, EvAdd)), GuestEbadf);
+    const KernelEvent attach = Change(static_cast<std::uintptr_t>(pipe[0]), EvfiltProcdesc, EvAdd, 7, 9);
+    KernelEvent failed[1]{};
+    Require(kevent_nid_postfix(kq, &attach, 1, failed, 1, nullptr) == 1);
+    Require(failed[0].flags == EvError && failed[0].data == GuestEinval && failed[0].fflags == 0);
+    const int random = open_nid_postfix("/dev/urandom", 0, 0);
+    Require(random >= 0);
+    Require(Throws([kq, random] { Apply(kq, Change(static_cast<std::uintptr_t>(random), EvfiltProcdesc, EvAdd)); }));
+    Require(Throws([kq] { Apply(kq, Change(2, EvfiltProcdesc, EvAdd)); }));
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(random), EvfiltProcdesc, EvDelete)), GuestEnoent);
+    Require(close_nid_postfix(random) == 0);
+    Require(close_nid_postfix(pipe[0]) == 0 && close_nid_postfix(pipe[1]) == 0);
+    Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pipe[0]), EvfiltProcdesc, EvAdd)), GuestEbadf);
     Require(close_nid_postfix(kq) == 0);
 }
 
@@ -785,6 +859,59 @@ static void DisableAndDispatch() {
     Require(close_nid_postfix(kq) == 0);
 }
 
+static void RequireNext(int kq, std::uintptr_t ident) {
+    KernelEvent event{};
+    Require(Poll(kq, &event, 1) == 1 && event.ident == ident);
+}
+
+static void ReportedKnotesMoveToTail() {
+    const int kq = kqueue_nid_postfix();
+    int first[2];
+    int second[2];
+    int pair[2];
+    Require(pipe_nid_postfix(first) == 0 && pipe_nid_postfix(second) == 0);
+    Require(socketpair_nid_postfix(Unix, Stream, 0, pair) == 0);
+    const std::uintptr_t level[3] = {static_cast<std::uintptr_t>(first[0]), static_cast<std::uintptr_t>(second[0]), static_cast<std::uintptr_t>(pair[0])};
+    for (const auto ident : level) {
+        Require(Apply(kq, Change(ident, EvfiltRead, EvAdd)) == 0);
+    }
+    Require(write_nid_postfix(first[1], "a", 1) == 1 && write_nid_postfix(second[1], "b", 1) == 1);
+    Require(send_nid_postfix(pair[1], "c", 1, 0) == 1);
+    for (int round = 0; round < 2; ++round) {
+        for (const auto ident : level) {
+            RequireNext(kq, ident);
+        }
+    }
+    for (const auto ident : level) {
+        Require(Apply(kq, Change(ident, EvfiltRead, EvDelete)) == 0);
+    }
+
+    KernelEvent event{};
+    for (const std::uintptr_t ident : {11, 12}) {
+        Require(Apply(kq, Change(ident, EvfiltUser, EvAdd | EvClear)) == 0);
+        Require(Apply(kq, Change(ident, EvfiltUser, 0, NoteTrigger)) == 0);
+    }
+    RequireNext(kq, 11);
+    Require(Apply(kq, Change(11, EvfiltUser, 0, NoteTrigger)) == 0);
+    RequireNext(kq, 12);
+    RequireNext(kq, 11);
+    Require(Poll(kq, &event, 1) == 0);
+
+    for (const std::uintptr_t ident : {21, 22}) {
+        Require(Apply(kq, Change(ident, EvfiltUser, EvAdd | EvDispatch)) == 0);
+        Require(Apply(kq, Change(ident, EvfiltUser, 0, NoteTrigger)) == 0);
+    }
+    RequireNext(kq, 21);
+    Require(Apply(kq, Change(21, EvfiltUser, EvEnable, NoteTrigger)) == 0);
+    RequireNext(kq, 22);
+    RequireNext(kq, 21);
+    Require(Poll(kq, &event, 1) == 0);
+
+    for (const int descriptor : {first[0], first[1], second[0], second[1], pair[0], pair[1], kq}) {
+        Require(close_nid_postfix(descriptor) == 0);
+    }
+}
+
 static void Errors() {
     const int kq = kqueue_nid_postfix();
     KernelEvent events[4]{};
@@ -828,7 +955,28 @@ static void Errors() {
 }
 
 static std::string TemporaryName(const char* stem) {
-    return std::string("anyps5-kqueue-") + stem + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    return std::string("anyps5-kqueue-") + stem + "-" + std::to_string(getpid_nid_postfix()) + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+}
+
+static void ProcdescOnFiles() {
+    const int kq = kqueue_nid_postfix();
+    const int other = kqueue_nid_postfix();
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(other), EvfiltProcdesc, EvAdd)), GuestEinval);
+    const auto path = TemporaryName("procdesc-file");
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create, 0644);
+    Require(file >= 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(file), EvfiltProcdesc, EvAdd)), GuestEinval);
+    Require(close_nid_postfix(file) == 0);
+    Require(std::filesystem::remove(path));
+    const auto folder = TemporaryName("procdesc-directory");
+    Require(std::filesystem::create_directory(folder));
+    const int directory = open_nid_postfix(folder.c_str(), Directory, 0);
+    Require(directory >= 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(directory), EvfiltProcdesc, EvAdd)), GuestEinval);
+    Require(close_nid_postfix(directory) == 0);
+    Require(std::filesystem::remove(folder));
+    Require(close_nid_postfix(other) == 0);
+    Require(close_nid_postfix(kq) == 0);
 }
 
 static void FileWatch() {
@@ -1101,6 +1249,102 @@ static void DeniedParentWatch() {
     Require(std::filesystem::remove_all(path) == 2);
 }
 #endif
+
+#ifdef __linux__
+static std::size_t InotifyWatchCount() {
+    std::size_t count = 0;
+    std::error_code error;
+    for (const auto& entry : std::filesystem::directory_iterator("/proc/self/fd", error)) {
+        std::error_code linkError;
+        const auto target = std::filesystem::read_symlink(entry.path(), linkError);
+        if (!linkError && target.string().find("inotify") != std::string::npos) ++count;
+    }
+    return count;
+}
+#endif
+
+static void VnodeOneshotWatchStops() {
+    const auto path = TemporaryName("oneshot");
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create, 0644);
+    Require(file >= 0);
+    const int kq = kqueue_nid_postfix();
+    int marker = 0;
+    KernelEvent events[4]{};
+    const auto ident = static_cast<std::uintptr_t>(file);
+#ifdef __linux__
+    auto watchesBefore = InotifyWatchCount();
+    for (int attempt = 0; attempt < 100; ++attempt) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(20));
+        const auto settled = InotifyWatchCount();
+        if (settled == watchesBefore) break;
+        watchesBefore = settled;
+    }
+#endif
+    Require(Apply(kq, Change(ident, EvfiltVnode, EvAdd | EvOneshot, NoteDelete | NoteWrite, 0, &marker)) == 0);
+    Require(write_nid_postfix(file, "abc", 3) == 3);
+    Require(Wait(kq, events, 4) == 1);
+    Require(events[0].ident == ident && events[0].filter == EvfiltVnode && (events[0].flags & EvOneshot) != 0 && events[0].udata == &marker);
+    Require(write_nid_postfix(file, "def", 3) == 3);
+    std::this_thread::sleep_for(std::chrono::milliseconds(300));
+    Require(Poll(kq, events, 4) == 0);
+    RequireFailure(Apply(kq, Change(ident, EvfiltVnode, EvDelete)), GuestEnoent);
+#ifdef __linux__
+    for (int attempt = 0; attempt < 100 && InotifyWatchCount() > watchesBefore; ++attempt) std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    Require(InotifyWatchCount() <= watchesBefore);
+#endif
+    Require(close_nid_postfix(file) == 0);
+    Require(close_nid_postfix(kq) == 0);
+    Require(std::filesystem::remove(path));
+}
+
+static void TimerDisableEnableRearm() {
+    const int kq = kqueue_nid_postfix();
+    int marker = 0;
+    KernelEvent events[4]{};
+    Require(Apply(kq, Change(1, EvfiltTimer, EvAdd, NoteUseconds, 50000, &marker)) == 0);
+    Require(Apply(kq, Change(1, EvfiltTimer, EvDisable, 0, 0, &marker)) == 0);
+    std::this_thread::sleep_for(std::chrono::milliseconds(150));
+    Require(Apply(kq, Change(1, EvfiltTimer, EvEnable, 0, 0, &marker)) == 0);
+    Require(Wait(kq, events, 4) == 1);
+    Require(events[0].ident == 1 && events[0].filter == EvfiltTimer && events[0].udata == &marker);
+    Require(events[0].data >= 2 && events[0].data <= 6);
+    Require(Wait(kq, events, 4) == 1);
+    Require(events[0].data >= 1 && events[0].data <= 2);
+    Require(Throws([kq] { Apply(kq, Change(1, EvfiltTimer, EvAdd | EvEnable)); }));
+    Require(Apply(kq, Change(1, EvfiltTimer, EvDelete)) == 0);
+    Require(close_nid_postfix(kq) == 0);
+}
+
+static void PeriodicTimerFiresTwice() {
+    const int kq = kqueue_nid_postfix();
+    KernelEvent events[4]{};
+    Require(Apply(kq, Change(1, EvfiltTimer, EvAdd, NoteUseconds, 50000)) == 0);
+    Require(Wait(kq, events, 4) == 1);
+    Require(Wait(kq, events, 4) == 1);
+    Require(Apply(kq, Change(1, EvfiltTimer, EvDelete)) == 0);
+    Require(close_nid_postfix(kq) == 0);
+}
+
+#ifdef _WIN32
+static void RecycleBinDeleteWatchedFile() {
+    const auto directory = TemporaryName("deleted");
+    std::filesystem::create_directories(directory + "\\$Extend\\$Deleted");
+    const auto path = directory + "\\watched";
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create, 0644);
+    Require(file >= 0);
+    const int kq = kqueue_nid_postfix();
+    KernelEvent events[4]{};
+    const auto ident = static_cast<std::uintptr_t>(file);
+    Require(Apply(kq, Change(ident, EvfiltVnode, EvAdd | EvClear, NoteDelete | NoteRename)) == 0);
+    Require(sceKernelRename(path.c_str(), (directory + "\\$Extend\\$Deleted\\moved").c_str()) == SceOk);
+    std::this_thread::sleep_for(std::chrono::milliseconds(300));
+    Require(Poll(kq, events, 4) == 1 && events[0].ident == ident && (events[0].fflags & NoteDelete) != 0);
+    Require(close_nid_postfix(file) == 0);
+    Require(close_nid_postfix(kq) == 0);
+    std::filesystem::remove_all(directory);
+}
+#endif
+
 static void Timeout() {
     const int kq = kqueue_nid_postfix();
     KernelEvent event{};
@@ -1112,7 +1356,47 @@ static void Timeout() {
     Require(close_nid_postfix(kq) == 0);
 }
 
+static void ReplaceStandardInputWithNull() {
+#ifdef _WIN32
+    const int null = _open("NUL", _O_RDONLY);
+    Require(null >= 0);
+    if (null != 0) {
+        Require(_dup2(null, 0) == 0);
+        Require(_close(null) == 0);
+    }
+#else
+    const int null = ::open("/dev/null", O_RDONLY);
+    Require(null >= 0);
+    if (null != 0) {
+        Require(::dup2(null, 0) == 0);
+        Require(::close(null) == 0);
+    }
+#endif
+}
+
+static bool StandardInputAtEnd() {
+    char byte = 0;
+#ifdef _WIN32
+    return _read(0, &byte, 1) == 0;
+#else
+    return ::read(0, &byte, 1) == 0;
+#endif
+}
+
+static void StandardInputReplacement() {
+    ReplaceStandardInputWithNull();
+    Require(StandardInputAtEnd());
+#ifdef _WIN32
+    Require(_close(0) == 0);
+#else
+    Require(::close(0) == 0);
+#endif
+    ReplaceStandardInputWithNull();
+    Require(StandardInputAtEnd());
+}
+
 static void StandardInput() {
+    ReplaceStandardInputWithNull();
     const int copy = dup_nid_postfix(0);
     if (copy < 0) {
         Require(*__error_nid_postfix() == GuestEbadf);
@@ -1134,9 +1418,13 @@ static void StandardInput() {
 }
 
 int main() {
+    StandardInputReplacement();
     StandardInput();
     CreateAndClose();
     Timers();
+    TimerReadd();
+    UnsupportedFilters();
+    ProcdescOnFiles();
     PipeRead();
 #ifndef __APPLE__
     PipeWrite();
@@ -1152,11 +1440,18 @@ int main() {
     EdgeTriggeredDispatch();
 #endif
     DisableAndDispatch();
+    ReportedKnotesMoveToTail();
     Errors();
     LowWaterMarks();
     FileWatch();
 #ifndef _WIN32
     RenameAndDeleteWatchedFile();
+    VnodeOneshotWatchStops();
+    PeriodicTimerFiresTwice();
+    TimerDisableEnableRearm();
+#endif
+#ifdef _WIN32
+    RecycleBinDeleteWatchedFile();
 #endif
 #if !defined(_WIN32) && !defined(__APPLE__)
     MoveDirectoryEntries();
diff --git a/core/libs/tests/GuestLibcCndInitDefaultName.cpp b/core/libs/tests/GuestLibcCndInitDefaultName.cpp
index 6d5d046398..582215e686 100644
--- a/core/libs/tests/GuestLibcCndInitDefaultName.cpp
+++ b/core/libs/tests/GuestLibcCndInitDefaultName.cpp
@@ -1,13 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI _Cnd_init_with_default_name_override_nid_postfix(void** handle, const char* name);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TException, typename TCall>
@@ -28,6 +23,7 @@ int main() {
     Require(condition != nullptr);
     Require(_Cnd_signal_nid_postfix(&condition) == success);
     _Cnd_destroy_nid_postfix(&condition);
+
     Require(condition == nullptr);
 
     void* unnamed = nullptr;
@@ -37,6 +33,7 @@ int main() {
 
     RequireThrows<std::invalid_argument>([] {
         _Cnd_init_with_default_name_override_nid_postfix(nullptr, "NullHandle");
+
     });
     return 0;
 }
diff --git a/core/libs/tests/GuestLibcCndTimedWait.cpp b/core/libs/tests/GuestLibcCndTimedWait.cpp
index e85144f158..da073cf4f1 100644
--- a/core/libs/tests/GuestLibcCndTimedWait.cpp
+++ b/core/libs/tests/GuestLibcCndTimedWait.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <chrono>
@@ -14,23 +15,6 @@
 #include <windows.h>
 #endif
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
-extern "C" {
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_wait_nid_postfix(void** condition, void** mutex);
-int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
-int APS5_VABI _Cnd_timedwait_nid_postfix(void** condition, void** mutex, const Xtime* target);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 #ifdef _WIN32
@@ -181,4 +165,5 @@ int main() {
     RequireThrows<std::overflow_error>([&] { _Cnd_timedwait_nid_postfix(&condition, &mutex, &overflowSecTime); });
     _Cnd_destroy_nid_postfix(&condition);
     _Mtx_destroy_nid_postfix(&mutex);
+
 }
diff --git a/core/libs/tests/GuestLibcFilesystem.cpp b/core/libs/tests/GuestLibcFilesystem.cpp
new file mode 100644
index 0000000000..fe53b7ff63
--- /dev/null
+++ b/core/libs/tests/GuestLibcFilesystem.cpp
@@ -0,0 +1,122 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <random>
+#include <set>
+#include <string>
+#include <system_error>
+
+namespace {
+
+constexpr int NoSuchFile = 2;
+constexpr int TypeNotFound = -1;
+constexpr int TypeRegular = 1;
+constexpr int TypeDirectory = 2;
+constexpr int TypeUnknown = 8;
+
+void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "filesystem: %s\n", message);
+    std::abort();
+}
+
+std::string root;
+
+std::string At(const char* name) {
+    return root + "/" + name;
+}
+
+void Write(const std::string& path, std::size_t bytes) {
+    std::ofstream file(path, std::ios::binary | std::ios::trunc);
+    file << std::string(bytes, 'x');
+}
+
+void TestStat() {
+    Write(At("file"), 7);
+    int perms = -1;
+    int error = -1;
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(At("file").c_str(), &perms, &error) == TypeRegular && error == 0, "regular file");
+    FileStat status{};
+    Require(stat_nid_postfix(At("file").c_str(), &status) == 0 && perms == (status.st_mode & 07777), "permission bits");
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(root.c_str(), nullptr, &error) == TypeDirectory && error == 0, "directory");
+    perms = 1234;
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(At("missing").c_str(), &perms, &error) == TypeNotFound && error == NoSuchFile && perms == 1234, "missing path");
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(At("file/below").c_str(), nullptr, &error) == TypeNotFound, "path below a file");
+    Require(_ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(At("file").c_str(), nullptr, &error) == TypeRegular && error == 0, "lstat of a regular file");
+    std::error_code link;
+    std::filesystem::create_symlink("file", At("link"), link);
+    if (!link) Require(_ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(At("link").c_str(), nullptr, &error) == TypeRegular, "lstat follows a link as the console does");
+}
+
+void TestSizeAndTime() {
+    int error = 0;
+    Require(_ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(At("file").c_str(), &error) == 7 && error == 0, "file size");
+    error = 0;
+    Require(_ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(At("missing").c_str(), &error) == UINT64_MAX && error == NoSuchFile, "size of a missing file");
+    std::int64_t seconds = 0;
+    std::int64_t nanoseconds = -1;
+    FileStat status{};
+    Require(stat_nid_postfix(At("file").c_str(), &status) == 0, "stat for time");
+    Require(_ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(At("file").c_str(), &seconds, &nanoseconds) == 0, "last write time");
+    Require(seconds == status.st_mtim.tv_sec && nanoseconds == status.st_mtim.tv_nsec, "last write time matches stat");
+    seconds = 5;
+    Require(_ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(At("missing").c_str(), &seconds, &nanoseconds) == NoSuchFile && seconds == 5, "time of a missing file");
+}
+
+void TestDirectories() {
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("made").c_str(), nullptr) == 1, "make a directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("made").c_str(), nullptr) == 0, "make an existing directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("absent/made").c_str(), nullptr) == -NoSuchFile, "make below a missing directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("copy").c_str(), At("missing").c_str()) == -NoSuchFile, "copy the mode of a missing directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("copy").c_str(), At("made").c_str()) == 1, "copy the mode of a directory");
+    Require(_ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(At("copy").c_str()), "remove a directory");
+    Require(!_ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(At("copy").c_str()), "remove a missing directory");
+    char name[260];
+    int error = -1;
+    int type = -1;
+    Require(_ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(name, At("made").c_str(), &error, &type) == nullptr && error == 0 && name[0] == '\0', "an empty directory gives no handle");
+    Require(_ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(name, At("missing").c_str(), &error, &type) == nullptr && error == NoSuchFile, "a missing directory");
+    Write(At("made/one"), 1);
+    Write(At("made/two"), 2);
+    void* handle = _ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(name, At("made").c_str(), &error, &type);
+    Require(handle != nullptr && error == 0 && type == TypeUnknown, "open a directory");
+    std::set<std::string> names{name};
+    type = 0;
+    Require(_ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(name, handle, &type) == name && type == TypeUnknown, "read a directory");
+    names.insert(name);
+    Require(names == std::set<std::string>{"one", "two"}, "entries without dot entries");
+    Require(_ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(name, handle, &type)[0] == '\0' && type == TypeUnknown, "end of the directory");
+    Require(_ZNSt10filesystem10_Close_dirEPv_nid_postfix(handle) == 0, "close a directory");
+}
+
+void TestFiles() {
+    Require(_ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(At("file").c_str(), 0600) == 0, "chmod");
+    Require(_ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(At("missing").c_str(), 0600) == -1, "chmod of a missing file");
+    Require(_ZNSt10filesystem7_UnlinkEPKc_nid_postfix(At("made/one").c_str()) == 0, "unlink");
+    Require(_ZNSt10filesystem7_UnlinkEPKc_nid_postfix(At("made/one").c_str()) == NoSuchFile, "unlink a missing file");
+    char current[260];
+    char expected[256];
+    Require(getcwd_nid_postfix(expected, sizeof(expected)) != nullptr, "getcwd");
+    Require(_ZNSt10filesystem12_Current_getERA260_c_nid_postfix(current) && std::strcmp(current, expected) == 0, "current directory");
+}
+
+}
+
+int main() {
+    root = "anyps5-libc-filesystem-" + std::to_string(std::random_device{}());
+    std::filesystem::create_directory(root);
+    TestStat();
+    TestSizeAndTime();
+    TestDirectories();
+    TestFiles();
+    std::error_code ignored;
+    std::filesystem::remove_all(root, ignored);
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibcMutexInitWithName.cpp b/core/libs/tests/GuestLibcMutexInitWithName.cpp
index 2501aef36b..a3faa64d90 100644
--- a/core/libs/tests/GuestLibcMutexInitWithName.cpp
+++ b/core/libs/tests/GuestLibcMutexInitWithName.cpp
@@ -1,14 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI _Mtx_init_with_name_nid_postfix(void** handle, int type, const char* name);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TException, typename TCall>
@@ -33,9 +27,11 @@ int main() {
     Require(_Mtx_lock_nid_postfix(&mutex) == busy);
     Require(_Mtx_unlock_nid_postfix(&mutex) == success);
     _Mtx_destroy_nid_postfix(&mutex);
+
     Require(mutex == nullptr);
 
     RequireThrows<std::invalid_argument>([] {
         _Mtx_init_with_name_nid_postfix(nullptr, plain, "NullHandle");
+
     });
 }
diff --git a/core/libs/tests/GuestLibcRandomSeeding.cpp b/core/libs/tests/GuestLibcRandomSeeding.cpp
new file mode 100644
index 0000000000..33e46f6781
--- /dev/null
+++ b/core/libs/tests/GuestLibcRandomSeeding.cpp
@@ -0,0 +1,112 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <vector>
+
+static int failures = 0;
+
+static void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "%s\n", message);
+        ++failures;
+    }
+}
+
+static std::vector<std::int64_t> Draw(std::size_t count) {
+    std::vector<std::int64_t> values;
+    values.reserve(count);
+    for (std::size_t index = 0; index < count; ++index) values.push_back(random_nid_postfix());
+    return values;
+}
+
+static void RequireSequence(const std::vector<std::int64_t>& actual, const std::vector<std::int64_t>& expected, const char* message) {
+    Require(actual == expected, message);
+}
+
+static std::string FirstStateWord(const char* table) {
+    static const char* digits = "0123456789abcdef";
+    std::string text;
+    const unsigned char* bytes = reinterpret_cast<const unsigned char*>(table);
+    for (std::size_t index = 0; index < 8; ++index) {
+        text.push_back(digits[bytes[index] >> 4]);
+        text.push_back(digits[bytes[index] & 0x0f]);
+    }
+    return text;
+}
+
+struct StateCase {
+    std::int64_t size;
+    std::vector<std::int64_t> values;
+    const char* firstStateWord;
+};
+
+int main() {
+    RequireSequence(Draw(5), {1804289383, 846930886, 1681692777, 1714636915, 1957747793},
+        "a fresh process must draw the measured first five values");
+
+    srandom_nid_postfix(1);
+    RequireSequence(Draw(6), {1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335},
+        "srandom(1) must match the measured sequence");
+
+    srandom_nid_postfix(0);
+    RequireSequence(Draw(6), {577655601, 1248161417, 192959563, 143633695, 541917479, 1903093295},
+        "srandom(0) must match the measured sequence");
+
+    srandom_nid_postfix(2);
+    RequireSequence(Draw(6), {1505335290, 1738766719, 190686788, 260874575, 747983061, 906156498},
+        "srandom(2) must match the measured sequence");
+
+    srandom_nid_postfix(12345);
+    RequireSequence(Draw(6), {383100999, 858300821, 357768173, 455528251, 133005921, 116285904},
+        "srandom(12345) must match the measured sequence");
+
+    srandom_nid_postfix(0xffffffffull);
+    RequireSequence(Draw(6), {254925627, 1205188300, 366127624, 1401405153, 76053476, 1604170158},
+        "srandom(0xffffffff) must match the measured sequence");
+
+    srandom_nid_postfix(0x80000000ull);
+    RequireSequence(Draw(6), {1336741213, 1210407648, 1447044896, 337392383, 82502902, 538660432},
+        "srandom(0x80000000) must match the measured sequence");
+
+    std::vector<char> tiny(16);
+    Require(initstate_nid_postfix(1, tiny.data(), 0) == nullptr, "initstate of 0 bytes must return null");
+    Require(initstate_nid_postfix(1, tiny.data(), 7) == nullptr, "initstate of 7 bytes must return null");
+
+    const std::array<StateCase, 13> states {{
+        {8, {1646035001, 1025921153, 510616708, 590357944, 771515668}, "000000001465fc2d"},
+        {15, {1646035001, 1025921153, 510616708, 590357944, 771515668}, "000000001465fc2d"},
+        {31, {1646035001, 1025921153, 510616708, 590357944, 771515668}, "000000001465fc2d"},
+        {32, {964237963, 406111040, 156505215, 1274863108, 1882652865}, "0100000082016ee0"},
+        {63, {964237963, 406111040, 156505215, 1274863108, 1882652865}, "0100000082016ee0"},
+        {64, {1894937090, 1645272306, 2143216519, 1889283008, 669383071}, "02000000fea8f5e2"},
+        {127, {1894937090, 1645272306, 2143216519, 1889283008, 669383071}, "02000000fea8f5e2"},
+        {128, {1804289383, 846930886, 1681692777, 1714636915, 1957747793}, "03000000b1391599"},
+        {129, {1804289383, 846930886, 1681692777, 1714636915, 1957747793}, "03000000b1391599"},
+        {255, {1804289383, 846930886, 1681692777, 1714636915, 1957747793}, "03000000b1391599"},
+        {256, {510644794, 625058908, 1816371419, 326864818, 1257431873}, "0400000032ba371f"},
+        {257, {510644794, 625058908, 1816371419, 326864818, 1257431873}, "0400000032ba371f"},
+        {1000, {510644794, 625058908, 1816371419, 326864818, 1257431873}, "0400000032ba371f"},
+    }};
+
+    std::vector<std::vector<char>> buffers;
+    for (const auto& state : states) {
+        buffers.emplace_back(static_cast<std::size_t>(state.size) + 16, static_cast<char>(0xa5));
+        char* const buffer = buffers.back().data();
+        char* const returned = initstate_nid_postfix(1, buffer, state.size);
+        Require(returned != nullptr, "initstate must not return null from 8 bytes up");
+        RequireSequence(Draw(5), state.values, "initstate must draw the measured values");
+        Require(FirstStateWord(buffer) == state.firstStateWord, "initstate must save the measured type word and first state word");
+    }
+
+    std::vector<char> last(128);
+    char* const replaced = initstate_nid_postfix(5, last.data(), 128);
+    Require(replaced != nullptr, "initstate must not return null from 8 bytes up");
+    Require(setstate_nid_postfix(replaced) != nullptr, "setstate of the state initstate returned must not return null");
+
+    return failures == 0 ? 0 : 1;
+}
diff --git a/core/libs/tests/GuestLibcStaticImports.cpp b/core/libs/tests/GuestLibcStaticImports.cpp
index a8068575dd..ff0cc2a7fc 100644
--- a/core/libs/tests/GuestLibcStaticImports.cpp
+++ b/core/libs/tests/GuestLibcStaticImports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
 #include <cmath>
@@ -8,21 +9,6 @@
 #include <thread>
 #include <time.h>
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
-extern "C" {
-float APS5_VABI nearbyintf_nid_postfix(float x);
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_trylock_nid_postfix(void** handle);
-int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime* remaining);
-}
-
 namespace {
 
 void Require(bool value) {
@@ -156,6 +142,7 @@ void TestThrdSleep() {
 
     RequireThrows<std::invalid_argument>([] {
         _Thrd_sleep_nid_postfix(nullptr, nullptr);
+
     });
 }
 
diff --git a/core/libs/tests/GuestLibcThreads.cpp b/core/libs/tests/GuestLibcThreads.cpp
index 001558be39..adb6ec98ee 100644
--- a/core/libs/tests/GuestLibcThreads.cpp
+++ b/core/libs/tests/GuestLibcThreads.cpp
@@ -1,61 +1,19 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
+#include <barrier>
 #include <chrono>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
+#include <limits>
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_wait_nid_postfix(void** condition, void** mutex);
-int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
-int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
-
-struct GuestPad {
-    unsigned (APS5_VABI* const* vtable)(GuestPad*);
-    void* condition;
-    void* mutex;
-    bool started;
-};
-
-void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad);
-void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(GuestPad* pad);
-void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(GuestPad* pad);
-void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(GuestPad* pad, void** thread);
-int APS5_VABI _Thrd_join_nid_postfix(void* thread, int* code);
-int APS5_VABI _Thrd_detach_nid_postfix(void* thread);
-void RegisterPthreadCreate_nid_no_patch(int (APS5_VABI* fn)(void**, const void*, void* (APS5_VABI*)(void*), void*));
-void RegisterPthreadJoin_nid_no_patch(int (APS5_VABI* fn)(void*, void**));
-void RegisterPthreadDetach_nid_no_patch(int (APS5_VABI* fn)(void*));
-
-struct ThreadForwards {
-    int (APS5_VABI* once)(std::int32_t*, void (APS5_VABI*)(void));
-    int (APS5_VABI* keyCreate)(int*, void (APS5_VABI*)(void*));
-    int (APS5_VABI* keyDelete)(int);
-    void* (APS5_VABI* getSpecific)(int);
-    int (APS5_VABI* setSpecific)(int, void*);
-    int (APS5_VABI* equal)(void*, void*);
-    void* (APS5_VABI* self)();
-    void (APS5_VABI* exit)(void*);
-};
-void RegisterThreadForwards_nid_no_patch(const ThreadForwards* forwards);
-void APS5_VABI _Call_once_nid_postfix(std::int32_t* flag, void (APS5_VABI* function)(void));
-int APS5_VABI _Tss_create_nid_postfix(int* key, void (APS5_VABI* destructor)(void*));
-int APS5_VABI _Tss_delete_nid_postfix(int key);
-void* APS5_VABI _Tss_get_nid_postfix(int key);
-int APS5_VABI _Tss_set_nid_postfix(int key, void* value);
-int APS5_VABI _Thrd_equal_nid_postfix(void* first, void* second);
-void* APS5_VABI _Thrd_current_nid_postfix(void);
-int APS5_VABI _Mtx_current_owns_nid_postfix(void** handle);
-void* APS5_VABI scePthreadSelf();
-}
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -70,6 +28,7 @@ static void RequireThrows(TCall call) {
 }
 
 constexpr int success = 0;
+constexpr int timedout = 2;
 constexpr int busy = 3;
 constexpr int plain = 0x01;
 constexpr int tryable = 0x02;
@@ -82,6 +41,14 @@ static void* CreateMutex(int type) {
     return mutex;
 }
 
+static Xtime RelativeTime(int milliseconds) {
+    const auto point = std::chrono::system_clock::now() + std::chrono::milliseconds(milliseconds);
+    const auto since = point.time_since_epoch();
+    const auto seconds = std::chrono::duration_cast<std::chrono::seconds>(since);
+    const auto nanos = std::chrono::duration_cast<std::chrono::nanoseconds>(since - seconds);
+    return {seconds.count(), nanos.count()};
+}
+
 static void MutexBasics() {
     void* mutex = CreateMutex(tryable);
     Require(_Mtx_lock_nid_postfix(&mutex) == success);
@@ -98,10 +65,12 @@ static void MutexBasics() {
     RequireThrows<std::invalid_argument>([&] { _Mtx_lock_nid_postfix(&foreignMutex); });
     _Cnd_destroy_nid_postfix(&foreignCondition);
     _Mtx_destroy_nid_postfix(&mutex);
+
     Require(mutex == nullptr);
     RequireThrows<std::invalid_argument>([&] { _Mtx_lock_nid_postfix(&mutex); });
     void* emptyMutex = nullptr;
     _Mtx_destroy_nid_postfix(&emptyMutex);
+
     RequireThrows<std::invalid_argument>([] { _Mtx_destroy_nid_postfix(nullptr); });
 
     void* plainMutex = CreateMutex(plain);
@@ -119,11 +88,13 @@ static void MutexBasics() {
     Require(_Mtx_lock_nid_postfix(&defaultMutex) == success && _Mtx_lock_nid_postfix(&defaultMutex) == busy);
     Require(_Mtx_unlock_nid_postfix(&defaultMutex) == success);
     _Mtx_destroy_nid_postfix(&defaultMutex);
+
     void* unknownBitsMutex = nullptr;
     Require(_Mtx_init_nid_postfix(&unknownBitsMutex, tryable | 0x8) == success && unknownBitsMutex != nullptr);
     Require(_Mtx_lock_nid_postfix(&unknownBitsMutex) == success && _Mtx_lock_nid_postfix(&unknownBitsMutex) == busy);
     Require(_Mtx_unlock_nid_postfix(&unknownBitsMutex) == success);
     _Mtx_destroy_nid_postfix(&unknownBitsMutex);
+
     RequireThrows<std::invalid_argument>([] { _Mtx_init_nid_postfix(nullptr, tryable); });
     RequireThrows<std::invalid_argument>([] { _Mtx_lock_nid_postfix(nullptr); });
     RequireThrows<std::invalid_argument>([] { _Mtx_unlock_nid_postfix(nullptr); });
@@ -145,6 +116,38 @@ static void RecursiveMutex() {
     other.join();
     Require(acquired);
     _Mtx_destroy_nid_postfix(&mutex);
+
+}
+
+static void TimedMutex() {
+    void* mutex = CreateMutex(tryable);
+    Xtime future = RelativeTime(60000);
+    Require(_Mtx_timedlock_nid_postfix(&mutex, &future) == success);
+    Require(_Mtx_timedlock_nid_postfix(&mutex, &future) == busy);
+    Require(_Mtx_unlock_nid_postfix(&mutex) == success);
+
+    Require(_Mtx_lock_nid_postfix(&mutex) == success);
+    int result = -1;
+    std::thread worker([&] {
+        Xtime deadline = RelativeTime(30);
+        result = _Mtx_timedlock_nid_postfix(&mutex, &deadline);
+    });
+    worker.join();
+    Require(result == timedout);
+    Require(_Mtx_unlock_nid_postfix(&mutex) == success);
+
+    void* empty = nullptr;
+    RequireThrows<std::invalid_argument>([&] { _Mtx_timedlock_nid_postfix(&empty, &future); });
+    RequireThrows<std::invalid_argument>([&] { _Mtx_timedlock_nid_postfix(nullptr, &future); });
+    RequireThrows<std::invalid_argument>([&] { _Mtx_timedlock_nid_postfix(&mutex, nullptr); });
+    _Mtx_destroy_nid_postfix(&mutex);
+
+    void* recursiveMutex = CreateMutex(recursive);
+    Require(_Mtx_timedlock_nid_postfix(&recursiveMutex, &future) == success);
+    Require(_Mtx_timedlock_nid_postfix(&recursiveMutex, &future) == success);
+    Require(_Mtx_unlock_nid_postfix(&recursiveMutex) == success);
+    Require(_Mtx_unlock_nid_postfix(&recursiveMutex) == success);
+    _Mtx_destroy_nid_postfix(&recursiveMutex);
 }
 
 static void MutualExclusion() {
@@ -161,6 +164,7 @@ static void MutualExclusion() {
     for (auto& worker : workers) worker.join();
     Require(counter == 80000);
     _Mtx_destroy_nid_postfix(&mutex);
+
 }
 
 static void ConditionBroadcast() {
@@ -206,12 +210,15 @@ static void ConditionBroadcast() {
     RequireThrows<std::invalid_argument>([] { _Cnd_broadcast_nid_postfix(nullptr); });
     RequireThrows<std::invalid_argument>([] { _Cnd_init_nid_postfix(nullptr); });
     _Cnd_destroy_nid_postfix(&condition);
+
     Require(condition == nullptr);
     RequireThrows<std::invalid_argument>([&] { _Cnd_broadcast_nid_postfix(&condition); });
     void* emptyCondition = nullptr;
     _Cnd_destroy_nid_postfix(&emptyCondition);
+
     RequireThrows<std::invalid_argument>([] { _Cnd_destroy_nid_postfix(nullptr); });
     _Mtx_destroy_nid_postfix(&mutex);
+
 }
 
 static void ConditionSignal() {
@@ -219,6 +226,7 @@ static void ConditionSignal() {
     Require(_Cnd_init_nid_postfix(&condition) == success);
     Require(_Cnd_signal_nid_postfix(&condition) == success);
     _Cnd_destroy_nid_postfix(&condition);
+
 }
 
 struct TestPad {
@@ -234,7 +242,10 @@ struct HostPadThread {
     void* result = nullptr;
 };
 
-static int APS5_VABI HostPthreadCreate(void** thread, const void*, void* (APS5_VABI* entry)(void*), void* arg) {
+static const void* lastCreateAttrSlot = nullptr;
+
+static int APS5_VABI HostPthreadCreate(void** thread, const void* attrSlot, void* (APS5_VABI* entry)(void*), void* arg) {
+    lastCreateAttrSlot = attrSlot;
     auto* handle = new HostPadThread{};
     handle->worker = std::thread([handle, entry, arg] { handle->result = entry(arg); });
     *thread = handle;
@@ -260,23 +271,101 @@ static unsigned APS5_VABI TestPadGo(GuestPad* base) {
     auto* pad = reinterpret_cast<TestPad*>(base);
     pad->ran.store(true);
     _ZNSt4_Pad8_ReleaseEv_nid_postfix(base);
+
     return 42;
 }
 
+static void RequireExit(bool value, const char* message) {
+    if (!value) {
+        std::fprintf(stderr, "CRT exit lifecycle: %s\n", message);
+        std::abort();
+    }
+}
+
+struct CrtExitState {
+    int code = 0;
+    int key = -1;
+    std::barrier<>* ready = nullptr;
+    void* parent = nullptr;
+    void* self = nullptr;
+    std::atomic<unsigned> destructors{0};
+    std::atomic<bool> returned{false};
+};
+
+static void APS5_VABI CrtExitDestructor(void* value) {
+    auto& state = *static_cast<CrtExitState*>(value);
+    RequireExit(_Thrd_current_nid_postfix() == state.self, "identity during destructor");
+    RequireExit(_Tss_get_nid_postfix(state.key) == nullptr, "value cleared before destructor");
+    if (state.destructors.fetch_add(1) == 0)
+        RequireExit(_Tss_set_nid_postfix(state.key, &state) == 0, "reinstall value for another cleanup pass");
+}
+
+static auto volatile crtExit = &_Thrd_exit_nid_postfix;
+
+static void* APS5_VABI CrtExitEntry(void* value) {
+    auto& state = *static_cast<CrtExitState*>(value);
+    state.self = _Thrd_current_nid_postfix();
+    RequireExit(state.self && _Thrd_equal_nid_postfix(state.self, state.self) == 1, "current identity");
+    RequireExit(_Thrd_equal_nid_postfix(state.self, state.parent) == 0, "different parent identity");
+    RequireExit(_Tss_get_nid_postfix(state.key) == nullptr, "child starts with empty value");
+    RequireExit(_Tss_set_nid_postfix(state.key, &state) == 0, "set child value");
+    state.ready->arrive_and_wait();
+    RequireExit(_Tss_get_nid_postfix(state.key) == &state, "child value isolation");
+    crtExit(state.code);
+    state.returned = true;
+    return nullptr;
+}
+
+static void ThreadExitLifecycle() {
+    constexpr std::array<int, 5> codes{0, 42, -1, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()};
+    constexpr std::array<std::uintptr_t, 5> expected{0, 42, 0xffffffffu, 0x80000000u, 0x7fffffffu};
+    std::barrier ready(6);
+    std::array<CrtExitState, 5> states;
+    std::array<Pthread, 5> threads{};
+    int key = -1, parentValue = 31;
+    void* parent = _Thrd_current_nid_postfix();
+    RequireExit(_Tss_create_nid_postfix(&key, CrtExitDestructor) == 0, "create destructor key");
+    RequireExit(_Tss_set_nid_postfix(key, &parentValue) == 0, "set parent value");
+    for (unsigned i = 0; i < states.size(); ++i) {
+        states[i].code = codes[i];
+        states[i].key = key;
+        states[i].ready = &ready;
+        states[i].parent = parent;
+        RequireExit(scePthreadCreate(&threads[i], nullptr, CrtExitEntry, &states[i], "CRT exit audit") == 0, "create child");
+    }
+    RequireExit(_Tss_get_nid_postfix(key) == &parentValue, "parent isolated before release");
+    ready.arrive_and_wait();
+    for (unsigned i = 0; i < states.size(); ++i) {
+        void* result = nullptr;
+        RequireExit(scePthreadJoin(threads[i], &result) == 0, "join exiting child");
+        RequireExit(reinterpret_cast<std::uintptr_t>(result) == expected[i], "full zero-extended exit result");
+        RequireExit(!states[i].returned, "exit must not return");
+        RequireExit(states[i].destructors == 2, "reinstalled destructor runs twice before join returns");
+        RequireExit(states[i].self == threads[i], "created and current identity match");
+    }
+    RequireExit(_Tss_get_nid_postfix(key) == &parentValue, "parent isolated after children exit");
+    RequireExit(_Tss_delete_nid_postfix(key) == 0, "delete key");
+    RequireExit(_Tss_get_nid_postfix(key) == nullptr, "deleted key value unavailable");
+    std::puts("PASS CRT lifecycle: five concurrent exit codes, full return width, identity, parent/child isolation, two destructor passes, key deletion");
+}
+
 static void PadLaunchAndJoin() {
     unsigned (APS5_VABI* vtable[1])(GuestPad*) = {TestPadGo};
     TestPad unregPad{};
     unregPad.vtable = vtable;
     _ZNSt4_PadC2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&unregPad));
+
     RegisterPthreadCreate_nid_no_patch(nullptr);
     RegisterPthreadJoin_nid_no_patch(nullptr);
     void* unregThread = nullptr;
     RequireThrows<std::runtime_error>([&] {
         _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(reinterpret_cast<GuestPad*>(&unregPad), &unregThread);
+
     });
     RequireThrows<std::runtime_error>([&] {
         int code = 0;
         _Thrd_join_nid_postfix(&unregPad, &code);
+
     });
     _ZNSt4_PadD2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&unregPad));
 
@@ -286,10 +375,14 @@ static void PadLaunchAndJoin() {
     TestPad pad{};
     pad.vtable = vtable;
     _ZNSt4_PadC2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     void* thread = nullptr;
     _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(reinterpret_cast<GuestPad*>(&pad), &thread);
+
     Require(thread != nullptr && pad.started && pad.ran.load());
+    Require(lastCreateAttrSlot == nullptr);
     _ZNSt4_PadD2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     int code = 0;
     Require(_Thrd_join_nid_postfix(thread, &code) == success && code == 42);
     Require(_Thrd_join_nid_postfix(nullptr, &code) == 4);
@@ -298,6 +391,32 @@ static void PadLaunchAndJoin() {
     RegisterPthreadJoin_nid_no_patch(nullptr);
 }
 
+static void PadLaunchWithAttributes() {
+    unsigned (APS5_VABI* vtable[1])(GuestPad*) = {TestPadGo};
+    RegisterPthreadCreate_nid_no_patch(HostPthreadCreate);
+    RegisterPthreadJoin_nid_no_patch(HostPthreadJoin);
+
+    TestPad pad{};
+    pad.vtable = vtable;
+    _ZNSt4_PadC2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
+    int attribute = 0;
+    void* attrSlot = &attribute;
+    void* thread = nullptr;
+    lastCreateAttrSlot = nullptr;
+    _ZNSt4_Pad7_LaunchEPP12pthread_attrPP7pthread_nid_postfix(reinterpret_cast<GuestPad*>(&pad), &attrSlot, &thread);
+    Require(thread != nullptr && pad.started && pad.ran.load());
+    Require(attrSlot == &attribute);
+    Require(lastCreateAttrSlot == &attrSlot);
+
+    _ZNSt4_PadD2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+    int code = 0;
+    Require(_Thrd_join_nid_postfix(thread, &code) == success && code == 42);
+
+    RegisterPthreadCreate_nid_no_patch(nullptr);
+    RegisterPthreadJoin_nid_no_patch(nullptr);
+}
+
 static void PadDetach() {
     unsigned (APS5_VABI* vtable[1])(GuestPad*) = {TestPadGo};
     RegisterPthreadDetach_nid_no_patch(nullptr);
@@ -309,10 +428,13 @@ static void PadDetach() {
     TestPad pad{};
     pad.vtable = vtable;
     _ZNSt4_PadC2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     void* thread = nullptr;
     _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(reinterpret_cast<GuestPad*>(&pad), &thread);
+
     Require(thread != nullptr && pad.ran.load());
     _ZNSt4_PadD2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     Require(_Thrd_detach_nid_postfix(thread) == success);
     Require(_Thrd_detach_nid_postfix(nullptr) == 4);
 
@@ -322,6 +444,7 @@ static void PadDetach() {
 
 static void KernelKeys() {
     Require(_Thrd_current_nid_postfix() == scePthreadSelf());
+    Require(_Thrd_id_nid_postfix() == scePthreadSelf());
     int key = -1;
     Require(_Tss_create_nid_postfix(&key, nullptr) == success && key >= 0);
     int value = 0;
@@ -355,10 +478,11 @@ static void APS5_VABI FakeExit(void*) { std::abort(); }
 static void APS5_VABI OnceTarget() {}
 
 static void ForwardedCalls() {
-    static const ThreadForwards fakes{FakeOnce, FakeKeyCreate, FakeKeyDelete, FakeGetSpecific, FakeSetSpecific, FakeEqual, FakeSelf, FakeExit};
+    static const ThreadForwards_nid_no_patch fakes{FakeOnce, FakeKeyCreate, FakeKeyDelete, FakeGetSpecific, FakeSetSpecific, FakeEqual, FakeSelf, FakeExit};
     RegisterThreadForwards_nid_no_patch(&fakes);
     std::int32_t flag = 0;
     _Call_once_nid_postfix(&flag, OnceTarget);
+
     Require(forwardLog.flag == &flag && forwardLog.function == OnceTarget);
     int key = 0;
     Require(_Tss_create_nid_postfix(&key, nullptr) == static_cast<int>(0x80020016) && key == 41);
@@ -367,21 +491,109 @@ static void ForwardedCalls() {
     Require(_Tss_set_nid_postfix(8, &flag) == success && forwardLog.key == 8 && forwardLog.value == &flag);
     Require(_Thrd_equal_nid_postfix(&flag, &key) == 1 && forwardLog.first == &flag && forwardLog.second == &key);
     Require(_Thrd_current_nid_postfix() == &forwardLog.key);
+    Require(_Thrd_id_nid_postfix() == &forwardLog.key);
     Require(_Mtx_current_owns_nid_postfix(nullptr) == 1);
 
     RegisterThreadForwards_nid_no_patch(nullptr);
     RequireThrows<std::runtime_error>([] { _Thrd_current_nid_postfix(); });
+    RequireThrows<std::runtime_error>([] { _Thrd_id_nid_postfix(); });
     RequireThrows<std::runtime_error>([] { _Tss_get_nid_postfix(0); });
 }
 
+struct VersionedShared {
+    PthreadMutex mutex = nullptr;
+    PthreadCond condition = nullptr;
+    std::atomic<int> stage{0};
+    int tryResult = -1;
+};
+
+static void* APS5_VABI VersionedWorker(void* argument) {
+    auto* shared = static_cast<VersionedShared*>(argument);
+    shared->tryResult = _ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared->mutex));
+    shared->stage = 1;
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared->mutex)) == success);
+    shared->stage = 2;
+    Require(_ZNSt8__sce_v211_Cnd_signalEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&shared->condition)) == success);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared->mutex)) == success);
+    return reinterpret_cast<void*>(std::intptr_t{42});
+}
+
+static void* APS5_VABI DetachedWorker(void*) { return nullptr; }
+
+static void VersionedSync() {
+    PthreadMutex recursiveMutex = reinterpret_cast<PthreadMutex>(std::uintptr_t{1});
+    Require(_ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(reinterpret_cast<void**>(&recursiveMutex), plain | recursive) == success && recursiveMutex != nullptr);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    for (int unlock = 0; unlock < 3; ++unlock) Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+
+    PthreadMutex plainMutex = nullptr;
+    Require(_ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(reinterpret_cast<void**>(&plainMutex), plain, "") == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == busy);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+    PthreadCond unownedCondition = nullptr;
+    Require(_ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&unownedCondition)) == success);
+    Require(scePthreadMutexUnlock(&plainMutex) != 0);
+    Require(scePthreadCondWait(&unownedCondition, &plainMutex) != 0);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+    Require(_ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&unownedCondition), reinterpret_cast<void**>(&plainMutex)) == success);
+    Require(_ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&unownedCondition)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+
+    VersionedShared shared;
+    Require(_ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(reinterpret_cast<void**>(&shared.mutex), plain) == success);
+    Require(_ZNSt8__sce_v219_Cnd_init_with_nameEPP12pthread_condPKc_nid_postfix(reinterpret_cast<void**>(&shared.condition), "versioned") == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.mutex)) == success);
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, nullptr, VersionedWorker, &shared, "versioned") == 0);
+    while (shared.stage.load() == 0) std::this_thread::yield();
+    while (shared.stage.load() == 1) Require(_ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.condition), reinterpret_cast<void**>(&shared.mutex)) == success);
+    Require(shared.tryResult == busy);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.mutex)) == success);
+    int code = 0;
+    Require(_ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(thread, &code) == success && code == 42);
+    Require(_ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(thread, &code) == 4);
+    Require(_ZNSt8__sce_v214_Cnd_broadcastEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&shared.condition)) == success);
+    Require(_ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&shared.condition)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.mutex)) == success);
+
+    PthreadCond condition = nullptr;
+    Require(_ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&condition)) == success);
+    Require(_ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&condition)) == success);
+
+    Pthread detached = nullptr;
+    Require(scePthreadCreate(&detached, nullptr, DetachedWorker, nullptr, "detached") == 0);
+    Require(_ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(detached) == success);
+    Require(_ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(nullptr) == 4);
+    _ZNSt8__sce_v211_Thrd_yieldEv_nid_postfix();
+
+    Require(_ZNSt8__sce_v28_Thrd_idEv_nid_postfix() != nullptr);
+}
+
+static void ThreadHelpers() {
+    Require(_Thrd_yield_nid_postfix() == success);
+    std::thread other([&] {
+        Require(_Thrd_yield_nid_postfix() == success);
+    });
+    other.join();
+}
+
 int main() {
+    ThreadExitLifecycle();
     KernelKeys();
+    VersionedSync();
     ForwardedCalls();
     MutexBasics();
     RecursiveMutex();
+    TimedMutex();
     MutualExclusion();
     ConditionBroadcast();
     ConditionSignal();
     PadLaunchAndJoin();
+    PadLaunchWithAttributes();
     PadDetach();
+    ThreadHelpers();
 }
diff --git a/core/libs/tests/GuestLibreSsl3Digest.cpp b/core/libs/tests/GuestLibreSsl3Digest.cpp
index 19f6f8cb2b..c2b6bf80a8 100644
--- a/core/libs/tests/GuestLibreSsl3Digest.cpp
+++ b/core/libs/tests/GuestLibreSsl3Digest.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdio>
@@ -7,19 +8,14 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-unsigned char* APS5_VABI MD5_nid_postfix(const unsigned char*, std::size_t, unsigned char*);
-unsigned char* APS5_VABI SHA1_nid_postfix(const unsigned char*, std::size_t, unsigned char*);
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (condition) return;
     std::fprintf(stderr, "LibreSSL3 digest check failed at line %u\n", location.line());
     std::abort();
 }
 
-template<typename TAction> static void RequireThrows(TAction action, std::source_location location = std::source_location::current()) {
-    try { action(); } catch (const std::exception&) { return; }
+template<typename TAction> static void RequireInvalidArgument(TAction action, std::source_location location = std::source_location::current()) {
+    try { action(); } catch (const std::invalid_argument&) { return; } catch (const std::exception&) {}
     Require(false, location);
 }
 
@@ -46,9 +42,9 @@ int main() {
     Require(SHA1_nid_postfix(abc, 3, digest) == digest && Hex(digest, 20) == "a9993e364706816aba3e25717850c26c9cd0d89d" && digest[20] == 0xee);
     Require(SHA1_nid_postfix(nullptr, 0, digest) == digest && Hex(digest, 20) == "da39a3ee5e6b4b0d3255bfef95601890afd80709");
     Require(SHA1_nid_postfix(many, million.size(), digest) == digest && Hex(digest, 20) == "34aa973cd4c4daa4f61eeb2bdbad27316534016f");
-    RequireThrows([&] { MD5_nid_postfix(abc, 3, nullptr); });
-    RequireThrows([&] { SHA1_nid_postfix(abc, 3, nullptr); });
-    RequireThrows([&] { SHA1_nid_postfix(nullptr, 1, digest); });
+    RequireInvalidArgument([&] { MD5_nid_postfix(abc, 3, nullptr); });
+    RequireInvalidArgument([&] { SHA1_nid_postfix(abc, 3, nullptr); });
+    RequireInvalidArgument([&] { SHA1_nid_postfix(nullptr, 1, digest); });
 
     std::puts("libSceLibreSsl3 digest tests passed");
 }
diff --git a/core/libs/tests/GuestLibreSslAes.cpp b/core/libs/tests/GuestLibreSslAes.cpp
new file mode 100644
index 0000000000..e36afbc5d8
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslAes.cpp
@@ -0,0 +1,219 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "failed: %s\n", what);
+    std::abort();
+}
+
+template<typename TAction> static void RequireThrows(TAction action, const char* what) {
+    try { action(); } catch (const std::exception&) { return; }
+    Require(false, what);
+}
+
+static std::vector<unsigned char> Bytes(const char* hex) {
+    std::vector<unsigned char> bytes;
+    for (; hex[0] && hex[1]; hex += 2) bytes.push_back(static_cast<unsigned char>(std::stoi(std::string(hex, 2), nullptr, 16)));
+    return bytes;
+}
+
+static std::string Hex(const unsigned char* data, std::size_t size) {
+    static constexpr char digits[] = "0123456789abcdef";
+    std::string text;
+    for (std::size_t i = 0; i < size; ++i) {
+        text += digits[data[i] >> 4];
+        text += digits[data[i] & 15];
+    }
+    return text;
+}
+
+static std::uint32_t Word(const std::vector<unsigned char>& bytes, std::size_t index) {
+    return std::uint32_t(bytes[4 * index]) << 24 | std::uint32_t(bytes[4 * index + 1]) << 16 | std::uint32_t(bytes[4 * index + 2]) << 8 | bytes[4 * index + 3];
+}
+
+static AesKey Sentinel() {
+    AesKey key;
+    for (std::uint32_t i = 0; i < 60; ++i) key.roundKeys[i] = 0xa5a50000u | i;
+    key.rounds = 0x5a5a;
+    return key;
+}
+
+template<typename TSetup> static void RequireSchedule(TSetup setup, const char* keyHex, const char* scheduleHex, const char* what) {
+    const auto userKey = Bytes(keyHex);
+    const auto schedule = Bytes(scheduleHex);
+    const std::size_t used = schedule.size() / 4;
+    const AesKey before = Sentinel();
+    AesKey key = before;
+    Require(setup(userKey.data(), static_cast<int>(userKey.size() * 8), &key) == 0 && key.rounds == static_cast<int>(used / 4 - 1), what);
+    for (std::size_t i = 0; i < 60; ++i) Require(key.roundKeys[i] == (i < used ? Word(schedule, i) : before.roundKeys[i]), what);
+}
+
+template<typename TSetup> static void RequireRefusalsKeepKey(TSetup setup, const char* what) {
+    const unsigned char userKey[32] {};
+    const AesKey before = Sentinel();
+    for (const int bits : {0, 64, 127, 129, 160, 224, 255, 384, 512, -128}) {
+        AesKey key = before;
+        Require(setup(userKey, bits, &key) == -2 && !std::memcmp(&key, &before, sizeof(key)), what);
+    }
+    for (const int bits : {128, 64}) {
+        AesKey key = before;
+        Require(setup(nullptr, bits, &key) == -1 && !std::memcmp(&key, &before, sizeof(key)), what);
+    }
+    Require(setup(userKey, 128, nullptr) == -1, what);
+}
+
+int main() {
+    const auto plain = Bytes("00112233445566778899aabbccddeeff");
+    const char* keys[3] {
+        "000102030405060708090a0b0c0d0e0f",
+        "000102030405060708090a0b0c0d0e0f1011121314151617",
+        "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+    };
+    const char* ciphers[3] {"69c4e0d86a7b0430d8cdb78070b4c55a", "dda97ca4864cdfe06eaf70a0ec0d7191", "8ea2b7ca516745bfeafc49904b496089"};
+    for (int i = 0; i < 3; ++i) {
+        const auto key = Bytes(keys[i]);
+        const int bits = static_cast<int>(key.size() * 8);
+        AesKey encrypt {}, decrypt {};
+        unsigned char out[16] {}, back[16] {};
+        Require(AES_set_encrypt_key_nid_postfix(key.data(), bits, &encrypt) == 0 && encrypt.rounds == 10 + 2 * i, "encrypt key");
+        Require(AES_set_decrypt_key_nid_postfix(key.data(), bits, &decrypt) == 0 && decrypt.rounds == encrypt.rounds, "decrypt key");
+        const int last = 4 * encrypt.rounds;
+        Require(!std::memcmp(decrypt.roundKeys, encrypt.roundKeys + last, 16) && !std::memcmp(decrypt.roundKeys + last, encrypt.roundKeys, 16), "decrypt key reverses the round keys");
+        AES_encrypt_nid_postfix(plain.data(), out, &encrypt);
+
+        Require(Hex(out, 16) == ciphers[i], "FIPS-197 appendix C cipher");
+        AES_decrypt_nid_postfix(out, back, &decrypt);
+
+        Require(!std::memcmp(back, plain.data(), 16), "FIPS-197 appendix C inverse cipher");
+        AES_ecb_encrypt_nid_postfix(plain.data(), out, &encrypt, 1);
+
+        Require(Hex(out, 16) == ciphers[i], "ECB encrypt");
+        AES_ecb_encrypt_nid_postfix(out, out, &decrypt, 0);
+
+        Require(!std::memcmp(out, plain.data(), 16), "ECB decrypt in place");
+    }
+
+    AesKey fipsKey {};
+    Require(AES_set_encrypt_key_nid_postfix(Bytes("2b7e151628aed2a6abf7158809cf4f3c").data(), 128, &fipsKey) == 0, "FIPS-197 appendix A key");
+    Require(fipsKey.roundKeys[4] == 0xa0fafe17 && fipsKey.roundKeys[43] == 0xb6630ca6, "FIPS-197 appendix A.1 expansion");
+    AesKey bad {};
+    bad.rounds = 7;
+    bad.roundKeys[0] = 1;
+    const unsigned char zero[32] {};
+    Require(AES_set_encrypt_key_nid_postfix(zero, 64, &bad) == -2 && bad.rounds == 7 && bad.roundKeys[0] == 1, "unsupported key length keeps the key");
+    Require(AES_set_decrypt_key_nid_postfix(zero, 129, &bad) == -2 && bad.rounds == 7 && bad.roundKeys[0] == 1, "unsupported decrypt key length keeps the key");
+    Require(AES_set_encrypt_key_nid_postfix(nullptr, 128, &bad) == -1 && AES_set_encrypt_key_nid_postfix(zero, 128, nullptr) == -1, "null key arguments");
+    unsigned char block[16] {};
+    RequireThrows([&] { AES_encrypt_nid_postfix(zero, block, &bad); }, "key schedule with an invalid round count");
+    RequireRefusalsKeepKey(&AES_set_encrypt_key_nid_postfix, "refused encrypt key setup leaves the key unchanged");
+    RequireRefusalsKeepKey(&AES_set_decrypt_key_nid_postfix, "refused decrypt key setup leaves the key unchanged");
+    RequireSchedule(&AES_set_encrypt_key_nid_postfix, "2b7e151628aed2a6abf7158809cf4f3c",
+        "2b7e151628aed2a6abf7158809cf4f3ca0fafe1788542cb123a339392a6c7605f2c295f27a96b9435935807a7359f67f3d80477d4716fe3e1e237e446d7a883b"
+        "ef44a541a8525b7fb671253bdb0bad00d4d1c6f87c839d87caf2b8bc11f915bc6d88a37a110b3efddbf98641ca0093fd4e54f70e5f5fc9f384a64fb24ea6dc4f"
+        "ead27321b58dbad2312bf5607f8d292fac7766f319fadc2128d12941575c006ed014f9a8c9ee2589e13f0cc8b6630ca6",
+        "FIPS-197 appendix A.1 AES-128 encrypt schedule");
+    RequireSchedule(&AES_set_encrypt_key_nid_postfix, "8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7b",
+        "8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bfe0c91f72402f5a5ec12068e6c827f6b0e7a95b95c56fec24db7b4bd69b5411885a74796e92538fd"
+        "e75fad44bb095386485af05721efb14fa448f6d94d6dce24aa326360113b30e6a25e7ed583b1cf9a27f939436a94f767c0a69407d19da4e1ec1786eb6fa64971"
+        "485f703222cb8755e26d135233f0b7b340beeb282f18a2596747d26b458c553ea7e1466c9411f1df821f750aad07d753ca4005388fcc5006282d166abc3ce7b5"
+        "e98ba06f448c773c8ecc720401002202",
+        "FIPS-197 appendix A.2 AES-192 encrypt schedule");
+    RequireSchedule(&AES_set_encrypt_key_nid_postfix, "603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4",
+        "603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff49ba354118e6925afa51a8b5f2067fcdea8b09c1a93d194cdbe49846eb75d5b9a"
+        "d59aecb85bf3c917fee94248de8ebe96b5a9328a2678a647983122292f6c79b3812c81addadf48ba24360af2fab8b46498c5bfc9bebd198e268c3ba709e04214"
+        "68007bacb2df331696e939e46c518d80c814e20476a9fb8a5025c02d59c58239de1369676ccc5a71fa2563959674ee155886ca5d2e2f31d77e0af1fa27cf73c3"
+        "749c47ab18501ddae2757e4f7401905acafaaae3e4d59b349adf6acebd10190dfe4890d1e6188d0b046df344706c631e",
+        "FIPS-197 appendix A.3 AES-256 encrypt schedule");
+    RequireSchedule(&AES_set_decrypt_key_nid_postfix, "2b7e151628aed2a6abf7158809cf4f3c",
+        "d014f9a8c9ee2589e13f0cc8b6630ca60c7b5a631319eafeb0398890664cfbb4df7d925a1f62b09da320626ed675732412c07647c01f22c7bc42d2f37555114a"
+        "6efcd876d2df54807c5df034c917c3b96ea30afcbc238cf6ae82a4b4b54a338d90884413d280860a12a128421bc897397c1f13f74208c219c021ae480969bf7b"
+        "cc7505eb3e17d1ee82296c51c94811332b3708a7f262d405bc3ebdbf4b617d622b7e151628aed2a6abf7158809cf4f3c",
+        "AES-128 decrypt schedule");
+    RequireSchedule(&AES_set_decrypt_key_nid_postfix, "8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7b",
+        "e98ba06f448c773c8ecc720401002202ac491644e55710b746c08a75c89b2cada3979ac28e5ba6d8e12cc9e654b272baf3b42258b59ebb5cf8fb64fe491e06f3"
+        "4d65dfa2b1e5620dea899c312dcc3c1a5b6cfe3cc745a02bf8b9a572462a9904c5ddb7f8be933c760b4f46a6fc80bdafb5dc7ad0f7cffb09a7ec43939c295e17"
+        "5023b89a3bc51d84d04b19377b4e8b8e41b34544ab0592b9ce92f15e421381d9659763e78c817087123039436be6a51e9eb149c479d69c5dfeb4a27ceab6d7fd"
+        "8e73b0f7da0e6452c810f32b809079e5",
+        "AES-192 decrypt schedule");
+    RequireSchedule(&AES_set_decrypt_key_nid_postfix, "603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4",
+        "fe4890d1e6188d0b046df344706c631eada23f4963e23b2455427c8a5c70910457c96cf6074f07c0706abb07137f9241b668b621ce40046d36a047ae0932ed8e"
+        "34ad1e4450866b367725bcc76315294632526c367828b24cf8e043c33f92aa20c440b289642b757227a3d7f114309581d669a7334a7ade7a80c8f18fc772e9e3"
+        "25ba3c22a06bc7fb4388a2833393427054fb808b9c137949cab22ff547ba186c6c3d632985d1fbd9e3e36578701be0f34a7459f9c8e8f9c256a156bc8d083799"
+        "42107758e9ec98f066329ea193f8858b8ec6bff6829ca03b9e49af7edba96125603deb1015ca71be2b73aef0857d7781",
+        "AES-256 decrypt schedule");
+
+    const auto key = Bytes("2b7e151628aed2a6abf7158809cf4f3c");
+    const auto message = Bytes("6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e5130c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710");
+    AesKey encrypt {}, decrypt {};
+    AES_set_encrypt_key_nid_postfix(key.data(), 128, &encrypt);
+    AES_set_decrypt_key_nid_postfix(key.data(), 128, &decrypt);
+
+    std::vector<unsigned char> out(message.size() + 16), back(message.size() + 16);
+
+    auto iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    AES_cbc_encrypt_nid_postfix(message.data(), out.data(), 64, &encrypt, iv.data(), 1);
+
+    Require(Hex(out.data(), 64) == "7649abac8119b246cee98e9b12e9197d5086cb9b507219ee95db113a917678b273bed6b8e3c1743b7116e69e222295163ff1caa1681fac09120eca307586e1a7", "SP 800-38A F.2.1 CBC encrypt");
+    Require(Hex(iv.data(), 16) == "3ff1caa1681fac09120eca307586e1a7", "CBC encrypt returns the last cipher block as iv");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    std::memcpy(back.data(), out.data(), 64);
+    AES_cbc_encrypt_nid_postfix(back.data(), back.data(), 32, &decrypt, iv.data(), 0);
+    AES_cbc_encrypt_nid_postfix(back.data() + 32, back.data() + 32, 32, &decrypt, iv.data(), 0);
+
+    Require(!std::memcmp(back.data(), message.data(), 64) && Hex(iv.data(), 16) == "3ff1caa1681fac09120eca307586e1a7", "SP 800-38A F.2.2 CBC decrypt in place across calls");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    std::vector<unsigned char> partial(32, 0xee);
+    AES_cbc_encrypt_nid_postfix(message.data(), partial.data(), 20, &encrypt, iv.data(), 1);
+
+    Require(Hex(partial.data(), 16) == "7649abac8119b246cee98e9b12e9197d" && partial[31] != 0xee && Hex(iv.data(), 16) == Hex(partial.data() + 16, 16), "CBC encrypt pads a partial block with the iv and writes the whole block");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    std::vector<unsigned char> plainPartial(32, 0xee);
+    AES_cbc_encrypt_nid_postfix(partial.data(), plainPartial.data(), 20, &decrypt, iv.data(), 0);
+
+    Require(!std::memcmp(plainPartial.data(), message.data(), 20) && plainPartial[20] == 0xee && Hex(iv.data(), 16) == Hex(partial.data() + 16, 16), "CBC decrypt writes only the requested length");
+
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    int num = 0;
+    AES_cfb128_encrypt_nid_postfix(message.data(), out.data(), 5, &encrypt, iv.data(), &num, 1);
+    AES_cfb128_encrypt_nid_postfix(message.data() + 5, out.data() + 5, 32, &encrypt, iv.data(), &num, 1);
+
+    Require(num == 5, "CFB128 keeps the block position");
+    AES_cfb128_encrypt_nid_postfix(message.data() + 37, out.data() + 37, 27, &encrypt, iv.data(), &num, 1);
+
+    Require(Hex(out.data(), 64) == "3b3fd92eb72dad20333449f8e83cfb4ac8a64537a0b3a93fcde3cdad9f1ce58b26751f67a3cbb140b1808cf187a4f4dfc04b05357c5d1c0eeac4c66f9ff7f2e6" && num == 0, "SP 800-38A F.3.13 CFB128 encrypt in pieces");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    num = 0;
+    AES_cfb128_encrypt_nid_postfix(out.data(), back.data(), 64, &encrypt, iv.data(), &num, 0);
+
+    Require(!std::memcmp(back.data(), message.data(), 64), "SP 800-38A F.3.14 CFB128 decrypt");
+    num = 16;
+    RequireThrows([&] { AES_cfb128_encrypt_nid_postfix(message.data(), out.data(), 1, &encrypt, iv.data(), &num, 1); }, "CFB128 position out of range");
+
+    auto counter = Bytes("f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff");
+    unsigned char keystream[16] {};
+    unsigned position = 0;
+    AES_ctr128_encrypt_nid_postfix(message.data(), out.data(), 7, &encrypt, counter.data(), keystream, &position);
+    AES_ctr128_encrypt_nid_postfix(message.data() + 7, out.data() + 7, 57, &encrypt, counter.data(), keystream, &position);
+
+    Require(Hex(out.data(), 64) == "874d6191b620e3261bef6864990db6ce9806f66b7970fdff8617187bb9fffdff5ae4df3edbd5d35e5b4f09020db03eab1e031dda2fbe03d1792170a0f3009cee", "SP 800-38A F.5.1 CTR encrypt in pieces");
+    Require(position == 0 && Hex(counter.data(), 16) == "f0f1f2f3f4f5f6f7f8f9fafbfcfdff03", "CTR advances the counter per block");
+    counter = Bytes("ffffffffffffffffffffffffffffffff");
+    position = 0;
+    AES_ctr128_encrypt_nid_postfix(message.data(), out.data(), 37, &encrypt, counter.data(), keystream, &position);
+
+    Require(Hex(out.data(), 37) == "e13338e36cb71962e00d020b4cedbd86d3dae15b04bb352fa0f59febfcb4da3e67da610697", "CTR counter wraps across all 128 bits");
+    Require(position == 5 && Hex(counter.data(), 16) == "00000000000000000000000000000002", "CTR position and counter after a partial block");
+    position = 16;
+    RequireThrows([&] { AES_ctr128_encrypt_nid_postfix(message.data(), out.data(), 1, &encrypt, counter.data(), keystream, &position); }, "CTR position out of range");
+
+    std::puts("libSceLibreSsl AES tests passed");
+}
diff --git a/core/libs/tests/GuestLibreSslAlert.cpp b/core/libs/tests/GuestLibreSslAlert.cpp
new file mode 100644
index 0000000000..73741f8c45
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslAlert.cpp
@@ -0,0 +1,62 @@
+#include "prx/libSceLibreSsl/libSceLibreSsl.hpp"
+#include <array>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+
+void Check(int value, const char* expected) {
+    const char* actual = SSL_alert_desc_string_long_nid_postfix(value);
+    if (actual == nullptr || std::strcmp(actual, expected) != 0) {
+        std::fprintf(stderr, "LibreSSL alert %d: expected %s, got %s\n", value, expected, actual ? actual : "(null)");
+        std::abort();
+    }
+}
+
+int main() {
+    std::array<const char*, 256> expected;
+    expected.fill("unknown");
+    expected[0] = "close notify";
+    expected[10] = "unexpected_message";
+    expected[20] = "bad record mac";
+    expected[30] = "decompression failure";
+    expected[40] = "handshake failure";
+    expected[41] = "no certificate";
+    expected[42] = "bad certificate";
+    expected[43] = "unsupported certificate";
+    expected[44] = "certificate revoked";
+    expected[45] = "certificate expired";
+    expected[46] = "certificate unknown";
+    expected[47] = "illegal parameter";
+    expected[21] = "decryption failed";
+    expected[22] = "record overflow";
+    expected[48] = "unknown CA";
+    expected[49] = "access denied";
+    expected[50] = "decode error";
+    expected[51] = "decrypt error";
+    expected[60] = "export restriction";
+    expected[70] = "protocol version";
+    expected[71] = "insufficient security";
+    expected[80] = "internal error";
+    expected[90] = "user canceled";
+    expected[100] = "no renegotiation";
+    expected[110] = "unsupported extension";
+    expected[111] = "certificate unobtainable";
+    expected[112] = "unrecognized name";
+    expected[113] = "bad certificate status response";
+    expected[114] = "bad certificate hash value";
+    expected[115] = "unknown PSK identity";
+    for (int code = 0; code < 256; ++code) {
+        Check(code, expected[code]);
+        Check(0x100 | code, expected[code]);
+        Check(0x200 | code, expected[code]);
+        Check(0x123400 | code, expected[code]);
+        Check(code - 256, expected[code]);
+    }
+    Check(std::numeric_limits<int>::min(), "close notify");
+    Check(std::numeric_limits<int>::max(), "unknown");
+    const char* retained = SSL_alert_desc_string_long_nid_postfix(40);
+    Check(42, "bad certificate");
+    if (std::strcmp(retained, "handshake failure") != 0) std::abort();
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibreSslCipher.cpp b/core/libs/tests/GuestLibreSslCipher.cpp
new file mode 100644
index 0000000000..366264cc99
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslCipher.cpp
@@ -0,0 +1,97 @@
+#include "prx/libSceLibreSsl/libSceLibreSsl.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+
+struct alignas(8) RawCipher {
+    std::array<std::byte, 80> prefix;
+    std::int32_t strength;
+    std::int32_t algorithm;
+};
+
+static_assert(sizeof(RawCipher) == 88);
+static_assert(offsetof(RawCipher, strength) == 80);
+static_assert(offsetof(RawCipher, algorithm) == 84);
+
+static void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "failed: %s\n", message);
+    std::abort();
+}
+
+static void RequireString(const char* actual, const char* expected) {
+    Require(actual && std::strcmp(actual, expected) == 0, expected);
+}
+
+int main() {
+    struct { std::int32_t before, bits, after; } output {0x12345678, -777, 0x23456789};
+    Require(SSL_CIPHER_get_bits_nid_postfix(nullptr, &output.bits) == 0, "null cipher has zero strength");
+    Require(output.bits == -777, "null cipher leaves the optional output untouched");
+    Require(SSL_CIPHER_get_bits_nid_postfix(nullptr, nullptr) == 0, "both pointers may be null");
+    RequireString(SSL_CIPHER_get_name_nid_postfix(nullptr), "(NONE)");
+    RequireString(SSL_CIPHER_get_version_nid_postfix(nullptr), "(NONE)");
+
+    struct { std::uint64_t before; RawCipher cipher; std::uint64_t after; } guarded;
+    std::memset(&guarded, 0xa5, sizeof(guarded));
+    RawCipher& cipher = guarded.cipher;
+    const char customName[] = "arbitrary caller-provided cipher";
+    const char* name = customName;
+    std::memcpy(cipher.prefix.data() + 8, &name, sizeof(name));
+    Require(SSL_CIPHER_get_name_nid_postfix(&cipher) == name, "name pointer is returned without copying or a registry lookup");
+    name = nullptr;
+    std::memcpy(cipher.prefix.data() + 8, &name, sizeof(name));
+    Require(SSL_CIPHER_get_name_nid_postfix(&cipher) == nullptr, "null name field is preserved");
+    name = customName;
+    std::memcpy(cipher.prefix.data() + 8, &name, sizeof(name));
+
+    constexpr std::int32_t bitPairs[][2] {
+        {0, 0}, {40, 128}, {56, 64}, {112, 168}, {128, 128}, {192, 192}, {256, 256},
+        {-1, -2}, {std::numeric_limits<std::int32_t>::min(), std::numeric_limits<std::int32_t>::max()},
+        {std::numeric_limits<std::int32_t>::max(), std::numeric_limits<std::int32_t>::min()},
+    };
+    for (const auto& pair : bitPairs) {
+        cipher.strength = pair[0];
+        cipher.algorithm = pair[1];
+        const auto snapshot = guarded;
+        output.bits = -777;
+        Require(SSL_CIPHER_get_bits_nid_postfix(&cipher, &output.bits) == pair[0], "effective strength is distinct from algorithm bits");
+        Require(output.bits == pair[1], "algorithm bits use the 32-bit field at guest offset 84");
+        Require(output.before == 0x12345678 && output.after == 0x23456789, "output writes exactly four bytes");
+        Require(SSL_CIPHER_get_bits_nid_postfix(&cipher, nullptr) == pair[0], "optional output may be omitted");
+        Require(std::memcmp(&guarded, &snapshot, sizeof(guarded)) == 0, "queries preserve the cipher and its guards");
+    }
+
+    constexpr std::uint64_t lowIds[] {0, 1, 0x35, 0xc02f, 0xffffff};
+    for (std::uint64_t version = 0; version < 256; ++version) {
+        for (const auto low : lowIds) {
+            const std::uint64_t id = (version << 24) | low;
+            std::memcpy(cipher.prefix.data() + 16, &id, sizeof(id));
+            RequireString(SSL_CIPHER_get_version_nid_postfix(&cipher), version == 3 ? "TLSv1/SSLv3" : "unknown");
+        }
+    }
+    constexpr std::uint64_t wideIds[] {0x103000035ULL, 0x800000000300c02fULL, 0xffffffff03000000ULL,
+                                      std::numeric_limits<std::uint64_t>::max()};
+    for (const auto id : wideIds) {
+        std::memcpy(cipher.prefix.data() + 16, &id, sizeof(id));
+        RequireString(SSL_CIPHER_get_version_nid_postfix(&cipher), "unknown");
+    }
+
+    cipher.strength = 40;
+    cipher.algorithm = 128;
+    Require(SSL_CIPHER_get_bits_nid_postfix(&cipher, &cipher.algorithm) == 40, "output may alias the algorithm field");
+    Require(cipher.algorithm == 128, "self-alias preserves algorithm bits");
+    Require(SSL_CIPHER_get_bits_nid_postfix(&cipher, &cipher.strength) == 128, "algorithm output is written before strength is read");
+    Require(cipher.strength == 128, "aliased output receives algorithm bits");
+
+    const auto snapshot = guarded;
+    const std::int32_t valid = 0;
+    std::memcpy(cipher.prefix.data(), &valid, sizeof(valid));
+    Require(SSL_CIPHER_get_name_nid_postfix(&cipher) == customName, "valid flag does not gate name access");
+    Require(SSL_CIPHER_get_bits_nid_postfix(&cipher, nullptr) == 128, "valid flag does not gate strength access");
+    Require(guarded.before == snapshot.before && guarded.after == snapshot.after, "input guards remain intact");
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibreSslDes.cpp b/core/libs/tests/GuestLibreSslDes.cpp
index 630f2601ed..6191facec5 100644
--- a/core/libs/tests/GuestLibreSslDes.cpp
+++ b/core/libs/tests/GuestLibreSslDes.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -10,12 +11,6 @@
 using DesBlock = std::array<unsigned char, 8>;
 using DesSchedule = std::array<unsigned char, 128>;
 
-extern "C" {
-void APS5_VABI DES_ecb_encrypt_nid_postfix(const unsigned char*, unsigned char*, const unsigned char*, int);
-int APS5_VABI DES_set_key_nid_postfix(const unsigned char*, unsigned char*);
-void APS5_VABI DES_set_odd_parity_nid_postfix(unsigned char*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TAction>
@@ -38,22 +33,27 @@ static void CheckVector(std::uint64_t key, std::uint64_t plain, std::uint64_t ci
     const auto plainBlock = Block(plain);
     DesBlock output{};
     DES_ecb_encrypt_nid_postfix(plainBlock.data(), output.data(), schedule.data(), 1);
+
     Require(output == Block(cipher));
     DES_ecb_encrypt_nid_postfix(output.data(), output.data(), schedule.data(), 0);
+
     Require(output == plainBlock);
     DesBlock again{};
     DES_ecb_encrypt_nid_postfix(plainBlock.data(), again.data(), schedule.data(), 7);
+
     Require(again == Block(cipher));
 }
 
 static void CheckParity() {
     DesBlock key{0x00, 0x01, 0x02, 0x03, 0x12, 0x13, 0xfe, 0xff};
     DES_set_odd_parity_nid_postfix(key.data());
+
     Require(key == (DesBlock{0x01, 0x01, 0x02, 0x02, 0x13, 0x13, 0xfe, 0xfe}));
     for (int value = 0; value < 256; ++value) {
         DesBlock single{};
         single.fill(static_cast<unsigned char>(value));
         DES_set_odd_parity_nid_postfix(single.data());
+
         Require((single[0] & 0xfe) == (value & 0xfe) && std::popcount(single[0]) % 2 == 1);
     }
 }
diff --git a/core/libs/tests/GuestLibreSslDigest.cpp b/core/libs/tests/GuestLibreSslDigest.cpp
index 8b9ba6183b..e207d3ec6c 100644
--- a/core/libs/tests/GuestLibreSslDigest.cpp
+++ b/core/libs/tests/GuestLibreSslDigest.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <cstddef>
@@ -9,35 +10,19 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI MD4_Init_nid_postfix(void*);
-int APS5_VABI MD4_Update_nid_postfix(void*, const void*, std::size_t);
-int APS5_VABI MD4_Final_nid_postfix(unsigned char*, void*);
-int APS5_VABI MD5_Init_nid_postfix(void*);
-int APS5_VABI MD5_Update_nid_postfix(void*, const void*, std::size_t);
-int APS5_VABI MD5_Final_nid_postfix(unsigned char*, void*);
-int APS5_VABI SHA1_Init_nid_postfix(void*);
-int APS5_VABI SHA1_Update_nid_postfix(void*, const void*, std::size_t);
-int APS5_VABI SHA1_Final_nid_postfix(unsigned char*, void*);
-int APS5_VABI SHA224_Init_nid_postfix(void*);
-int APS5_VABI SHA224_Update_nid_postfix(void*, const void*, std::size_t);
-int APS5_VABI SHA224_Final_nid_postfix(unsigned char*, void*);
-int APS5_VABI SHA256_Init_nid_postfix(void*);
-int APS5_VABI SHA256_Update_nid_postfix(void*, const void*, std::size_t);
-int APS5_VABI SHA256_Final_nid_postfix(unsigned char*, void*);
-unsigned char* APS5_VABI SHA256_nid_postfix(const unsigned char*, std::size_t, unsigned char*);
-int APS5_VABI SHA384_Init_nid_postfix(void*);
-int APS5_VABI SHA384_Update_nid_postfix(void*, const void*, std::size_t);
-int APS5_VABI SHA384_Final_nid_postfix(unsigned char*, void*);
-int APS5_VABI SHA512_Init_nid_postfix(void*);
-int APS5_VABI SHA512_Update_nid_postfix(void*, const void*, std::size_t);
-int APS5_VABI SHA512_Final_nid_postfix(unsigned char*, void*);
-}
-
 using InitFunction = int (APS5_VABI*)(void*);
 using UpdateFunction = int (APS5_VABI*)(void*, const void*, std::size_t);
 using FinalFunction = int (APS5_VABI*)(unsigned char*, void*);
 
+template<typename TContext, auto TFunction>
+int APS5_VABI Initialize(void* context) { return TFunction(static_cast<TContext*>(context)); }
+
+template<typename TContext, auto TFunction>
+int APS5_VABI Update(void* context, const void* data, std::size_t size) { return TFunction(static_cast<TContext*>(context), data, size); }
+
+template<typename TContext, auto TFunction>
+int APS5_VABI Finalize(unsigned char* digest, void* context) { return TFunction(digest, static_cast<TContext*>(context)); }
+
 struct Algorithm {
     const char* name;
     InitFunction init;
@@ -92,31 +77,31 @@ int main() {
         std::string(1000000, 'a'),
     };
     const Algorithm algorithms[] {
-        {"MD4", MD4_Init_nid_postfix, MD4_Update_nid_postfix, MD4_Final_nid_postfix, 92, 64, 16, {
+        {"MD4", Initialize<Md4Context, MD4_Init_nid_postfix>, Update<Md4Context, MD4_Update_nid_postfix>, Finalize<Md4Context, MD4_Final_nid_postfix>, 92, 64, 16, {
             "31d6cfe0d16ae931b73c59d7e0c089c0", "a448017aaf21d8525fc10ae87aa6729d", "4691a9ec81b1a6bd1ab8557240b245c5",
             nullptr, "e33b4ddc9c38f2199c3e7b164fcc0536", nullptr}},
-        {"MD5", MD5_Init_nid_postfix, MD5_Update_nid_postfix, MD5_Final_nid_postfix, 92, 64, 16, {
+        {"MD5", Initialize<Md5Context, MD5_Init_nid_postfix>, Update<Md5Context, MD5_Update_nid_postfix>, Finalize<Md5Context, MD5_Final_nid_postfix>, 92, 64, 16, {
             "d41d8cd98f00b204e9800998ecf8427e", "900150983cd24fb0d6963f7d28e17f72", "8215ef0796a20bcaaae116d3876c664a",
             "03dd8807a93175fb062dfb55dc7d359c", "57edf4a22be3c955ac49da2e2107b67a", "7707d6ae4e027c70eea2a935c2296f21"}},
-        {"SHA1", SHA1_Init_nid_postfix, SHA1_Update_nid_postfix, SHA1_Final_nid_postfix, 96, 64, 20, {
+        {"SHA1", Initialize<Sha1Context, SHA1_Init_nid_postfix>, Update<Sha1Context, SHA1_Update_nid_postfix>, Finalize<Sha1Context, SHA1_Final_nid_postfix>, 96, 64, 20, {
             "da39a3ee5e6b4b0d3255bfef95601890afd80709", "a9993e364706816aba3e25717850c26c9cd0d89d", "84983e441c3bd26ebaae4aa1f95129e5e54670f1",
             "a49b2446a02c645bf419f995b67091253a04a259", "50abf5706a150990a08b2c5ea40fa0e585554732", "34aa973cd4c4daa4f61eeb2bdbad27316534016f"}},
-        {"SHA224", SHA224_Init_nid_postfix, SHA224_Update_nid_postfix, SHA224_Final_nid_postfix, 112, 64, 28, {
+        {"SHA224", Initialize<Sha256Context, SHA224_Init_nid_postfix>, Update<Sha256Context, SHA224_Update_nid_postfix>, Finalize<Sha256Context, SHA224_Final_nid_postfix>, 112, 64, 28, {
             "d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f", "23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7",
             "75388b16512776cc5dba5da1fd890150b0c6455cb4f58b1952522525", "c97ca9a559850ce97a04a96def6d99a9e0e0e2ab14e6b8df265fc0b3",
             "b50aecbe4e9bb0b57bc5f3ae760a8e01db24f203fb3cdcd13148046e", "20794655980c91d8bbb4c1ea97618a4bf03f42581948b2ee4ee7ad67"}},
-        {"SHA256", SHA256_Init_nid_postfix, SHA256_Update_nid_postfix, SHA256_Final_nid_postfix, 112, 64, 32, {
+        {"SHA256", Initialize<Sha256Context, SHA256_Init_nid_postfix>, Update<Sha256Context, SHA256_Update_nid_postfix>, Finalize<Sha256Context, SHA256_Final_nid_postfix>, 112, 64, 32, {
             "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
             "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1", "cf5b16a778af8380036ce59e7b0492370b249b11e8f07a51afac45037afee9d1",
             "f371bc4a311f2b009eef952dd83ca80e2b60026c8e935592d0f9c308453c813e", "cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0"}},
-        {"SHA384", SHA384_Init_nid_postfix, SHA384_Update_nid_postfix, SHA384_Final_nid_postfix, 216, 128, 48, {
+        {"SHA384", Initialize<Sha512Context, SHA384_Init_nid_postfix>, Update<Sha512Context, SHA384_Update_nid_postfix>, Finalize<Sha512Context, SHA384_Final_nid_postfix>, 216, 128, 48, {
             "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b",
             "cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7",
             "3391fdddfc8dc7393707a65b1b4709397cf8b1d162af05abfe8f450de5f36bc6b0455a8520bc4e6f5fe95b1fe3c8452b",
             "09330c33f71147e83d192fc782cd1b4753111b173b3b05d22fa08086e3b0f712fcc7c71a557e2db966c3e9fa91746039",
             "b12932b0627d1c060942f5447764155655bd4da0c9afa6dd9b9ef53129af1b8fb0195996d2de9ca0df9d821ffee67026",
             "9d0e1809716474cb086e834e310a4a1ced149e9c00f248527972cec5704c2a5b07b8b3dc38ecc4ebae97ddd87f3d8985"}},
-        {"SHA512", SHA512_Init_nid_postfix, SHA512_Update_nid_postfix, SHA512_Final_nid_postfix, 216, 128, 64, {
+        {"SHA512", Initialize<Sha512Context, SHA512_Init_nid_postfix>, Update<Sha512Context, SHA512_Update_nid_postfix>, Finalize<Sha512Context, SHA512_Final_nid_postfix>, 216, 128, 64, {
             "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e",
             "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f",
             "204a8fc6dda82f0a0ced7beb8e08a41657c16ef468b228a8279be331a703c33596fd15c13b1b07f9aa1d3bea57789ca031ad85c7a71dd70354ec631238ca3445",
@@ -168,28 +153,35 @@ int main() {
 
     alignas(16) unsigned char context[256] {};
     unsigned char digest[64] {};
-    Require(SHA512_Init_nid_postfix(context) == 1 && SHA512_Final_nid_postfix(nullptr, context) == 0, "SHA512_Final without a digest buffer");
-    SHA256_Init_nid_postfix(context);
+    Require(SHA512_Init_nid_postfix(reinterpret_cast<Sha512Context*>(context)) == 1 && SHA512_Final_nid_postfix(nullptr, reinterpret_cast<Sha512Context*>(context)) == 0, "SHA512_Final without a digest buffer");
+    SHA256_Init_nid_postfix(reinterpret_cast<Sha256Context*>(context));
+
     std::uint32_t length = 33;
     std::memcpy(context + 108, &length, 4);
-    Require(SHA256_Final_nid_postfix(digest, context) == 0, "SHA256_Final with an oversized digest length");
-    SHA256_Init_nid_postfix(context);
+    Require(SHA256_Final_nid_postfix(digest, reinterpret_cast<Sha256Context*>(context)) == 0, "SHA256_Final with an oversized digest length");
+    SHA256_Init_nid_postfix(reinterpret_cast<Sha256Context*>(context));
+
     length = 16;
     std::memcpy(context + 108, &length, 4);
     std::memset(digest, 0xee, sizeof(digest));
-    Require(SHA256_Final_nid_postfix(digest, context) == 1 && Hex(digest, 16) == "e3b0c44298fc1c149afbf4c8996fb924" && digest[16] == 0xee, "SHA256_Final truncates to the digest length");
-    SHA512_Init_nid_postfix(context);
-    length = 32;
-    std::memcpy(context + 212, &length, 4);
-    RequireThrows([&] { SHA512_Final_nid_postfix(digest, context); }, "SHA-512/256 digest length");
-    SHA256_Init_nid_postfix(context);
+    Require(SHA256_Final_nid_postfix(digest, reinterpret_cast<Sha256Context*>(context)) == 1 && Hex(digest, 16) == "e3b0c44298fc1c149afbf4c8996fb924" && digest[16] == 0xee, "SHA256_Final truncates to the digest length");
+    for (std::uint32_t truncated : {28u, 32u}) {
+        SHA512_Init_nid_postfix(reinterpret_cast<Sha512Context*>(context));
+        std::memcpy(context + 212, &truncated, 4);
+        std::memset(digest, 0xee, sizeof(digest));
+        Require(SHA512_Final_nid_postfix(digest, reinterpret_cast<Sha512Context*>(context)) == 0 && digest[0] == 0xee && digest[63] == 0xee, "SHA512_Final with a SHA-512/t digest length");
+    }
+    SHA256_Init_nid_postfix(reinterpret_cast<Sha256Context*>(context));
+
     length = 64;
     std::memcpy(context + 104, &length, 4);
-    RequireThrows([&] { SHA256_Update_nid_postfix(context, "a", 1); }, "corrupt buffered count");
+    RequireThrows([&] { SHA256_Update_nid_postfix(reinterpret_cast<Sha256Context*>(context), "a", 1); }, "corrupt buffered count");
 
     const auto* abc = reinterpret_cast<const unsigned char*>("abc");
     Require(SHA256_nid_postfix(abc, 3, digest) == digest && Hex(digest, 32) == "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", "SHA256 one-shot");
     Require(SHA256_nid_postfix(nullptr, 0, digest) == digest && Hex(digest, 32) == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "SHA256 one-shot of nothing");
-    RequireThrows([&] { SHA256_nid_postfix(abc, 3, nullptr); }, "SHA256 one-shot without a digest buffer");
+    unsigned char* shared = SHA256_nid_postfix(abc, 3, nullptr);
+    Require(shared && shared != digest && Hex(shared, 32) == "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", "SHA256 one-shot into the static buffer");
+    Require(SHA256_nid_postfix(nullptr, 0, nullptr) == shared && Hex(shared, 32) == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "SHA256 one-shot reuses the static buffer");
     std::puts("libSceLibreSsl digest tests passed");
 }
diff --git a/core/libs/tests/GuestLibreSslError.cpp b/core/libs/tests/GuestLibreSslError.cpp
new file mode 100644
index 0000000000..f81ec64d6b
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslError.cpp
@@ -0,0 +1,69 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libSceLibreSsl/include/Error.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <thread>
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "failed: %s\n", what);
+    std::abort();
+}
+
+static std::uint64_t Pack(std::uint64_t library, std::uint64_t function, std::uint64_t reason) {
+    return library << 24 | function << 12 | reason;
+}
+
+int main() {
+    Require(ERR_get_error_nid_postfix() == 0, "empty queue get");
+    Require(ERR_peek_error_nid_postfix() == 0, "empty queue peek");
+
+    LibreSslPutError_nid_no_patch(3, 100, 65);
+    LibreSslPutError_nid_no_patch(4, 101, 66);
+    LibreSslPutError_nid_no_patch(20, 102, 67);
+    Require(ERR_peek_error_nid_postfix() == Pack(3, 100, 65), "peek returns the earliest error");
+    Require(ERR_peek_error_nid_postfix() == Pack(3, 100, 65), "peek keeps the earliest error");
+    Require(ERR_get_error_nid_postfix() == Pack(3, 100, 65), "get returns the earliest error");
+    Require(ERR_get_error_nid_postfix() == Pack(4, 101, 66), "get returns the second error");
+    Require(ERR_peek_error_nid_postfix() == Pack(20, 102, 67), "peek follows get");
+    Require(ERR_get_error_nid_postfix() == Pack(20, 102, 67), "get returns the third error");
+    Require(ERR_get_error_nid_postfix() == 0, "drained queue get");
+    Require(ERR_peek_error_nid_postfix() == 0, "drained queue peek");
+
+    for (int i = 1; i <= 16; ++i) LibreSslPutError_nid_no_patch(i, 0, i);
+    for (int i = 2; i <= 16; ++i) Require(ERR_get_error_nid_postfix() == Pack(i, 0, i), "full queue drops the oldest error");
+    Require(ERR_get_error_nid_postfix() == 0, "full queue holds 15 errors");
+
+    LibreSslPutError_nid_no_patch(0x1ff, 0x1fff, 0x1fff);
+    Require(ERR_get_error_nid_postfix() == 0xFFFFFFFFu, "fields are masked and the code keeps 32 bits");
+
+    LibreSslPutError_nid_no_patch(5, 1, 2);
+    LibreSslPutError_nid_no_patch(6, 1, 2);
+    ERR_clear_error_nid_postfix();
+    Require(ERR_peek_error_nid_postfix() == 0, "clear empties the queue");
+    LibreSslPutError_nid_no_patch(7, 1, 2);
+    Require(ERR_get_error_nid_postfix() == Pack(7, 1, 2), "queue works after clear");
+
+    LibreSslPutError_nid_no_patch(8, 1, 2);
+    bool otherEmpty = false;
+    bool otherOwn = false;
+    std::thread other([&] {
+        otherEmpty = ERR_peek_error_nid_postfix() == 0;
+        LibreSslPutError_nid_no_patch(9, 1, 2);
+        otherOwn = ERR_get_error_nid_postfix() == Pack(9, 1, 2);
+    });
+    other.join();
+    Require(otherEmpty, "another thread starts with an empty queue");
+    Require(otherOwn, "another thread reads its own error");
+    Require(ERR_get_error_nid_postfix() == Pack(8, 1, 2), "this thread keeps its error");
+    Require(ERR_get_error_nid_postfix() == 0, "the other thread's error stays on that thread");
+
+    LibreSslPutError_nid_no_patch(10, 1, 2);
+    ERR_remove_thread_state_nid_postfix(nullptr);
+    Require(ERR_peek_error_nid_postfix() == 0, "removing the thread state empties the queue");
+
+    std::puts("guest_libressl_error: ok");
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibreSslOcsp.cpp b/core/libs/tests/GuestLibreSslOcsp.cpp
new file mode 100644
index 0000000000..f0c3f82ad8
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslOcsp.cpp
@@ -0,0 +1,46 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+
+using StringFunction = const char* (APS5_VABI*)(std::int64_t);
+
+void Check(StringFunction function, const char* name, std::int64_t value, const char* expected) {
+    const char* actual = function(value);
+    if (actual == nullptr || std::strcmp(actual, expected) != 0) {
+        std::fprintf(stderr, "%s(%lld): expected %s, got %s\n", name, static_cast<long long>(value), expected, actual ? actual : "(null)");
+        std::abort();
+    }
+}
+
+int main() {
+    constexpr auto Unknown = "(UNKNOWN)";
+    constexpr std::int64_t Outside[] {-1, 4, 7, 9, 0x100, 0x100000000, std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max()};
+
+    const char* responses[] {"successful", "malformedrequest", "internalerror", "trylater", nullptr, "sigrequired", "unauthorized"};
+    for (std::int64_t code = 0; code < 7; ++code) {
+        Check(OCSP_response_status_str_nid_postfix, "OCSP_response_status_str", code, responses[code] ? responses[code] : Unknown);
+    }
+
+    const char* certificates[] {"good", "revoked", "unknown"};
+    for (std::int64_t code = 0; code < 3; ++code) {
+        Check(OCSP_cert_status_str_nid_postfix, "OCSP_cert_status_str", code, certificates[code]);
+    }
+
+    const char* reasons[] {"unspecified", "keyCompromise", "cACompromise", "affiliationChanged", "superseded", "cessationOfOperation", "certificateHold", nullptr, "removeFromCRL"};
+    for (std::int64_t code = 0; code < 9; ++code) {
+        Check(OCSP_crl_reason_str_nid_postfix, "OCSP_crl_reason_str", code, reasons[code] ? reasons[code] : Unknown);
+    }
+
+    for (const auto value : Outside) {
+        Check(OCSP_response_status_str_nid_postfix, "OCSP_response_status_str", value, Unknown);
+        Check(OCSP_cert_status_str_nid_postfix, "OCSP_cert_status_str", value, Unknown);
+        if (value != 4) Check(OCSP_crl_reason_str_nid_postfix, "OCSP_crl_reason_str", value, Unknown);
+    }
+    Check(OCSP_response_status_str_nid_postfix, "OCSP_response_status_str", 0x100000000 | 1, Unknown);
+    Check(OCSP_crl_reason_str_nid_postfix, "OCSP_crl_reason_str", -0x100000000 | 8, Unknown);
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibreSslRuntime.cpp b/core/libs/tests/GuestLibreSslRuntime.cpp
new file mode 100644
index 0000000000..7a67fb61ea
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslRuntime.cpp
@@ -0,0 +1,86 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include <stdexcept>
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "LibreSSL runtime check failed at line %u\n", location.line());
+    std::abort();
+}
+
+template<typename TAction> static void RequireThrows(TAction action, std::source_location location = std::source_location::current()) {
+    try { action(); } catch (const std::exception&) { return; }
+    Require(false, location);
+}
+
+static void InitializeHeap() {
+    void* const api[10] {};
+    ApplicationHeapRegister_nid_no_patch(api);
+}
+
+int main() {
+    InitializeHeap();
+    std::array<unsigned char, 4099> first {};
+    std::array<unsigned char, 4099> second {};
+    first.fill(0xa5);
+    Require(RAND_bytes_nid_postfix(first.data(), 0) == 1 && RAND_bytes_nid_postfix(first.data(), -5) == 1);
+    Require(RAND_bytes_nid_postfix(nullptr, 0) == 1);
+    Require(std::all_of(first.begin(), first.end(), [](unsigned char value) { return value == 0xa5; }));
+    Require(RAND_bytes_nid_postfix(first.data(), 3) == 1);
+    Require(std::all_of(first.begin() + 3, first.end(), [](unsigned char value) { return value == 0xa5; }));
+    Require(RAND_bytes_nid_postfix(first.data(), static_cast<int>(first.size())) == 1);
+    Require(RAND_bytes_nid_postfix(second.data(), static_cast<int>(second.size())) == 1);
+    Require(first != second);
+    std::array<std::size_t, 256> counts {};
+    for (const auto value : first) ++counts[value];
+    Require(*std::max_element(counts.begin(), counts.end()) < 64);
+    RequireThrows([] { RAND_bytes_nid_postfix(nullptr, 1); });
+
+    RAND_add_nid_postfix(first.data(), 16, 8.0);
+    RAND_add_nid_postfix(nullptr, 0, 0.0);
+    Require(RAND_status_nid_postfix() == 1);
+    Require(RAND_load_file_nid_postfix("/nonexistent", -1) == 123456);
+    Require(RAND_load_file_nid_postfix(nullptr, 1024) == 1024 && RAND_load_file_nid_postfix(nullptr, 0) == 0);
+    Require(RAND_load_file_nid_postfix(nullptr, 0x100000005) == 5);
+
+    char name[32];
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, sizeof(name)) == name && !std::strcmp(name, "/dev/urandom"));
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, 13) == name && !std::strcmp(name, "/dev/urandom"));
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, 12) == nullptr && !std::strcmp(name, "/dev/urando"));
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, 0) == nullptr && name[0] == 'x');
+    Require(RAND_file_name_nid_postfix(nullptr, 0) == nullptr);
+    RequireThrows([] { RAND_file_name_nid_postfix(nullptr, 1); });
+
+    auto* block = static_cast<unsigned char*>(CRYPTO_malloc_nid_postfix(64, "file.c", 10));
+    Require(block != nullptr);
+    std::memset(block, 0x5a, 64);
+    CRYPTO_free_nid_postfix(block);
+
+    block = static_cast<unsigned char*>(CRYPTO_malloc_nid_postfix(32, nullptr, 0));
+    Require(block != nullptr);
+    free_nid_postfix(block);
+
+    block = static_cast<unsigned char*>(malloc_nid_postfix(16));
+    CRYPTO_free_nid_postfix(block);
+    CRYPTO_free_nid_postfix(nullptr);
+
+    Require(CRYPTO_malloc_nid_postfix(0, nullptr, 0) == nullptr);
+    Require(CRYPTO_malloc_nid_postfix(-1, nullptr, 0) == nullptr);
+    Require(CRYPTO_set_mem_functions_nid_postfix(reinterpret_cast<void*>(&std::malloc), reinterpret_cast<void*>(&std::realloc), reinterpret_cast<void*>(&std::free)) == 0);
+    Require(CRYPTO_set_mem_functions_nid_postfix(nullptr, nullptr, nullptr) == 0);
+    std::puts("libSceLibreSsl runtime tests passed");
+}
diff --git a/core/libs/tests/GuestLibreSslVersion.cpp b/core/libs/tests/GuestLibreSslVersion.cpp
new file mode 100644
index 0000000000..b59a170fd2
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslVersion.cpp
@@ -0,0 +1,18 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <source_location>
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "LibreSSL version check failed at line %u\n", location.line());
+    std::abort();
+}
+
+int main() {
+    Require(SSLeay_nid_postfix() == std::uint64_t{0x20000000});
+    Require(SSLeay_nid_postfix() == SSLeay_nid_postfix());
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibreSslX509Errors.cpp b/core/libs/tests/GuestLibreSslX509Errors.cpp
index 7a53a5e582..4b68ca300b 100644
--- a/core/libs/tests/GuestLibreSslX509Errors.cpp
+++ b/core/libs/tests/GuestLibreSslX509Errors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -6,8 +7,6 @@
 #include <limits>
 #include <string>
 
-extern "C" const char* APS5_VABI X509_verify_cert_error_string_nid_postfix(std::int64_t);
-
 static constexpr std::uint64_t ExpectedHashes[] {
     0x8b05d07b5566befULL, 0, 0x708834e4234778b5ULL, 0xefb3526cbf8b4d8fULL,
     0xf9c246e135cdbad1ULL, 0xd42f63e9d35f4aa1ULL, 0xcccbec8974d6af08ULL, 0x8d443856acab19a4ULL,
diff --git a/core/libs/tests/GuestLifecycle.cpp b/core/libs/tests/GuestLifecycle.cpp
index 11cb61e1ec..ccdf3cc1df 100644
--- a/core/libs/tests/GuestLifecycle.cpp
+++ b/core/libs/tests/GuestLifecycle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
 #include <cstdint>
@@ -10,19 +11,6 @@
 #include <dlfcn.h>
 #endif
 
-struct InitEnvParams {
-    int argc;
-    std::uint32_t pad;
-    const char* argv[3];
-};
-
-extern "C" {
-int APS5_VABI cxa_atexit_nid_postfix(void (APS5_VABI *)(void*), void*, void*);
-void APS5_VABI cxa_finalize_nid_postfix(void*);
-int APS5_VABI LibcInternalExtCxaThreadAtexit_nid_postfix(void (APS5_VABI *)(void*), void*, void*);
-void APS5_VABI init_env_nid_postfix(const InitEnvParams*);
-}
-
 namespace {
 
 void Require(bool value) {
@@ -54,10 +42,13 @@ int main() {
     Require(cxa_atexit_nid_postfix(Second, nullptr, first) == 0);
     Require(cxa_atexit_nid_postfix(Other, nullptr, second) == 0);
     cxa_finalize_nid_postfix(first);
+
     Require(secondAt == 0 && firstAt == 1 && otherAt == -1);
     cxa_finalize_nid_postfix(reinterpret_cast<void*>(3));
+
     Require(otherAt == -1);
     cxa_finalize_nid_postfix(second);
+
     Require(otherAt == 2);
 
     std::thread worker([] {
@@ -79,6 +70,7 @@ int main() {
 
     try {
         init_env_nid_postfix(nullptr);
+
     } catch (const std::runtime_error& error) {
         Require(std::strstr(error.what(), "not implemented") == nullptr);
         return 0;
diff --git a/core/libs/tests/GuestLoadExecHost.cpp b/core/libs/tests/GuestLoadExecHost.cpp
index bba40568d0..618d8f5ebf 100644
--- a/core/libs/tests/GuestLoadExecHost.cpp
+++ b/core/libs/tests/GuestLoadExecHost.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/General.hpp"
@@ -17,11 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI*)(void*), void*, void*);
-extern "C" int APS5_VABI getargc_nid_postfix();
-extern "C" const char** APS5_VABI getargv_nid_postfix();
-
 namespace {
 
 bool cleaned = false;
diff --git a/core/libs/tests/GuestLocale.cpp b/core/libs/tests/GuestLocale.cpp
index 78aaee27be..346286e815 100644
--- a/core/libs/tests/GuestLocale.cpp
+++ b/core/libs/tests/GuestLocale.cpp
@@ -1,6 +1,9 @@
+#include "prx/libc/include/ApplicationHeap.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include <array>
 #include <cstdint>
+#include <cstdlib>
 #include <cstring>
 #include <cwchar>
 #include <climits>
@@ -11,32 +14,17 @@
 
 extern "C" {
 extern GuestLocale::Implementation* _ZSt21_sceLibcClassicLocale_nid_postfix;
-GuestLocale::Implementation* APS5_VABI _ZNSt6locale16_GetgloballocaleEv_nid_postfix();
-GuestLocale::Implementation* APS5_VABI _ZNSt6locale5_InitEv_nid_postfix();
-struct GuestLocaleFacade { GuestLocale::Implementation* implementation; };
-GuestLocaleFacade* APS5_VABI _ZNSt6locale7classicEv_nid_postfix();
-void APS5_VABI _ZNSt6locale5facet9_RegisterEv_nid_postfix(GuestLocale::Facet* self);
-void APS5_VABI _ZNSt8_LocinfoC1EPKc_nid_postfix(GuestLocale::LocinfoStorage* self, const char* localeName);
-void APS5_VABI _ZNSt8_LocinfoD1Ev_nid_postfix(GuestLocale::LocinfoStorage* self);
-void APS5_VABI _ZNSt8ios_baseD2Ev_nid_postfix(GuestLocale::IosBase* self);
-struct StreamManipulator {
-    GuestLocale::IosBase* (APS5_VABI* function)(GuestLocale::IosBase*, std::int32_t);
-    std::int32_t argument;
-};
-StreamManipulator APS5_VABI _ZSt4setwi_nid_postfix(std::int32_t width);
-void APS5_VABI _ZNSt8ios_base7_AddstdEPS__nid_postfix(GuestLocale::IosBase* self);
-const short* APS5_VABI _Getpctype_nid_postfix();
-const short* APS5_VABI _Getptolower_nid_postfix();
-const short* APS5_VABI _Getptoupper_nid_postfix();
-int APS5_VABI _Mbtowcx_nid_postfix(std::uint16_t* dst, const char* src, std::size_t count, std::mbstate_t* st);
-int APS5_VABI _Wctombx_nid_postfix(char* dst, std::uint16_t src, std::mbstate_t* st);
-void APS5_VABI _Locksyslock_nid_postfix();
-void APS5_VABI _Unlocksyslock_nid_postfix();
-std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t wc, std::uint64_t desc);
-int* APS5_VABI __error_nid_postfix();
+
 extern std::uint64_t _ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix;
 extern std::uint64_t _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix;
+extern std::uint64_t _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix;
 extern std::uintptr_t _ZTVSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[17];
+extern std::uintptr_t _ZTVSt7codecvtIwc9_MbstatetE_nid_postfix[13];
+extern std::uintptr_t _ZTVSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[14];
+extern std::uintptr_t _ZTVSt7collateIcE_nid_postfix[9];
+extern std::uintptr_t _ZTVSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[13];
+extern std::uintptr_t _ZTVSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[13];
+extern std::uintptr_t _ZTVSt7num_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[17];
 
 }
 
@@ -44,6 +32,17 @@ static void Require(bool condition) {
     if (!condition) throw std::runtime_error("Guest locale check failed");
 }
 
+void* APS5_VABI TestHeapAllocate(std::size_t bytes) { return std::malloc(bytes); }
+void APS5_VABI TestHeapFree(void* pointer) { std::free(pointer); }
+void* APS5_VABI TestHeapCalloc(std::size_t count, std::size_t bytes) { return std::calloc(count, bytes); }
+void* APS5_VABI TestHeapReallocate(void* pointer, std::size_t bytes) { return std::realloc(pointer, bytes); }
+void* APS5_VABI TestHeapAlign(std::size_t, std::size_t bytes) { return std::malloc(bytes); }
+void* APS5_VABI TestHeapRealign(void* pointer, std::size_t bytes, std::size_t) { return std::realloc(pointer, bytes); }
+int APS5_VABI TestHeapPosixAlign(void** pointer, std::size_t, std::size_t bytes) {
+    *pointer = std::malloc(bytes);
+    return *pointer == nullptr ? 12 : 0;
+}
+
 template<typename TAction>
 static void RequireException(TAction action) {
     bool caught = false;
@@ -65,6 +64,24 @@ static void CheckInputFacetObjects() {
     for (const auto slot : _ZTVSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix) Require(slot == 0);
 }
 
+static void CheckCodecvtWideVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt7codecvtIwc9_MbstatetE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
+static void CheckCollateVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt7collateIcE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
 static void CheckGuestCalls() {
     auto* locale = _ZSt21_sceLibcClassicLocale_nid_postfix;
     Require(locale != nullptr && locale == _ZNSt6locale16_GetgloballocaleEv_nid_postfix());
@@ -108,8 +125,10 @@ static void CheckLocinfoAlignment() {
     bytes.fill(std::byte{0x5a});
     auto* storage = reinterpret_cast<GuestLocale::LocinfoStorage*>(bytes.data() + 8);
     _ZNSt8_LocinfoC1EPKc_nid_postfix(storage, "C");
+
     for (std::size_t index = 0; index < bytes.size(); ++index) Require(bytes[index] == (index >= 8 && index < 72 ? std::byte{} : std::byte{0x5a}));
     _ZNSt8_LocinfoD1Ev_nid_postfix(storage);
+
     RequireException([&] { _ZNSt8_LocinfoC1EPKc_nid_postfix(storage, "unknown-locale"); });
     RequireException([] { _ZNSt8_LocinfoC1EPKc_nid_postfix(nullptr, "C"); });
 }
@@ -121,7 +140,7 @@ static void CheckCharacterTables() {
     Require(classification[-1] == 0 && lower[-1] == -1 && upper[-1] == -1);
     Require(classification['A'] == 0x03 && classification['a'] == 0x11);
     Require(classification['G'] == 0x02 && classification['0'] == 0x21);
-    Require(classification[' '] == 0x04 && classification['\t'] == 0xc0);
+    Require(classification[' '] == 0x04 && classification['\t'] == 0x4c0);
     Require(classification['\n'] == 0xc0 && classification['!'] == 0x08);
     for (int value = 0; value < 256; ++value) {
         Require(lower[value] == (value >= 'A' && value <= 'Z' ? value + 32 : value));
@@ -164,6 +183,7 @@ static void CheckStreamDestruction() {
     } object;
     object.stream.locale = &_ZSt21_sceLibcClassicLocale_nid_postfix;
     _ZNSt8ios_baseD2Ev_nid_postfix(&object.stream);
+
     Require(object.stream.locale == nullptr && object.before == 0x12345678 && object.after == 0x87654321);
     object.stream.locale = &_ZSt21_sceLibcClassicLocale_nid_postfix;
     object.stream.callbacks = &object;
@@ -201,31 +221,42 @@ static void CheckStandardStreams() {
     RequireException([&] { _ZNSt8ios_base7_AddstdEPS__nid_postfix(nullptr); });
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[0].stream);
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[1].stream);
+
     Require(streams[0].stream.standardStream == 1 && streams[1].stream.standardStream == 2);
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.standardStream == 1);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.locale == classic && streams[0].stream.standardStream == 1);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.locale == nullptr && streams[0].stream.standardStream == 1);
     streams[0].stream.locale = classic;
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.standardStream == 1);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[1].stream);
+
     Require(streams[1].stream.locale == nullptr && streams[1].stream.standardStream == 2);
     for (int index = 2; index < 7; ++index) {
         _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[index].stream);
+
         Require(streams[index].stream.standardStream == index + 1);
     }
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[7].stream);
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[8].stream);
+
     Require(streams[7].stream.standardStream == 8 && streams[8].stream.standardStream == 8);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[7].stream);
+
     Require(streams[7].stream.locale == classic);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[8].stream);
+
     Require(streams[8].stream.locale == nullptr);
     for (int index = 2; index < 7; ++index) {
         _ZNSt8ios_baseD2Ev_nid_postfix(&streams[index].stream);
+
         Require(streams[index].stream.locale == nullptr && streams[index].stream.standardStream == index + 1);
     }
     for (auto& object : streams) Require(object.before == 0x12345678 && object.after == 0x87654321);
@@ -253,7 +284,96 @@ static void CheckWideCaseTranslation() {
     }
 }
 
+static void CheckWideNumPutVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
+static void CheckFacetGetcat() {
+    const GuestLocale::Implementation* locale = _ZSt21_sceLibcClassicLocale_nid_postfix;
+    GuestLocale::Facet* codecvt = nullptr;
+    Require(_ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(&codecvt, &locale) == 2 && codecvt != nullptr);
+    auto* codecvtVtable = reinterpret_cast<const GuestLocale::CodecvtVtable*>(codecvt->vtable);
+    Require(codecvtVtable->alwaysNoconv(codecvt) && codecvtVtable->encoding(codecvt) == 1 && codecvtVtable->maxLength(codecvt) == 1);
+    const char* nextFrom = nullptr;
+    char target[4]{};
+    char* nextTo = nullptr;
+    Require(codecvtVtable->out(codecvt, nullptr, "ab", "ab" + 2, &nextFrom, target, target + 4, &nextTo) == 3);
+    Require(nextFrom == "ab" && nextTo == target);
+    Require(codecvtVtable->in(codecvt, nullptr, "ab", "ab" + 2, &nextFrom, target, target + 4, &nextTo) == 3);
+    nextTo = reinterpret_cast<char*>(0x10);
+    Require(codecvtVtable->unshift(codecvt, nullptr, nullptr, nullptr, &nextTo) == 0 && nextTo == nullptr);
+    Require(codecvtVtable->length(codecvt, nullptr, "ab", "ab" + 2, 5) == 2);
+    Require(codecvtVtable->length(codecvt, nullptr, "ab", "ab" + 2, 1) == 1);
+    GuestLocale::Facet* punct = nullptr;
+    Require(_ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(&punct, &locale) == 4 && punct != nullptr);
+    auto* punctVtable = reinterpret_cast<const GuestLocale::NumpunctVtable*>(punct->vtable);
+    auto* punctFacet = reinterpret_cast<const GuestLocale::NumpunctFacet*>(punct);
+    Require(punctVtable->decimalPoint(punctFacet) == '.' && punctVtable->thousandsSep(punctFacet) == ',');
+    GuestLocale::String name{};
+    Require(punctVtable->grouping(&name, punctFacet) == &name && name.size == 0);
+    const char* contents = name.size <= 15 ? name.buffer : name.pointer;
+    Require(punctVtable->falsename(&name, punctFacet)->size == 5 && std::memcmp(contents, "false", 5) == 0);
+    contents = name.size <= 15 ? name.buffer : name.pointer;
+    Require(punctVtable->truename(&name, punctFacet)->size == 4 && std::memcmp(contents, "true", 4) == 0);
+    GuestLocale::Facet* numPut = nullptr;
+    Require(_ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(&numPut, &locale) == 4 && numPut != nullptr);
+    GuestLocale::Facet* timePut = nullptr;
+    Require(_ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(&timePut, &locale) == 5 && timePut != nullptr);
+    _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 11;
+    Require(_ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix == 11);
+    _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+    for (GuestLocale::Facet* facet : {codecvt, punct, numPut, timePut}) {
+        facet->vtable->retain(facet);
+        facet->vtable->retain(facet);
+        Require(facet->references == 2);
+        facet->vtable->deleteObject(facet);
+    }
+    Require(_ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(nullptr, &locale) == 2);
+    Require(_ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(&punct, &locale) == 4);
+}
+
+static void CheckNumGetWideVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt7num_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
+static void CheckTimeGetVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
+static void CheckTimeGetWideVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
 int main() {
+    std::array<void*, 10> heapApi{};
+    heapApi[0] = reinterpret_cast<void*>(&TestHeapAllocate);
+    heapApi[1] = reinterpret_cast<void*>(&TestHeapFree);
+    heapApi[2] = reinterpret_cast<void*>(&TestHeapCalloc);
+    heapApi[3] = reinterpret_cast<void*>(&TestHeapReallocate);
+    heapApi[4] = reinterpret_cast<void*>(&TestHeapAlign);
+    heapApi[5] = reinterpret_cast<void*>(&TestHeapRealign);
+    heapApi[6] = reinterpret_cast<void*>(&TestHeapPosixAlign);
+    ApplicationHeapRegister_nid_no_patch(heapApi.data());
     CheckGuestCalls();
     CheckLocinfoAlignment();
     CheckCharacterTables();
@@ -263,9 +383,17 @@ int main() {
     CheckStandardStreams();
     CheckWideCaseTranslation();
     CheckInputFacetObjects();
+    CheckCodecvtWideVtableObject();
+    CheckWideNumPutVtableObject();
+    CheckFacetGetcat();
+    CheckCollateVtableObject();
+    CheckTimeGetVtableObject();
+    CheckTimeGetWideVtableObject();
+    CheckNumGetWideVtableObject();
     _Locksyslock_nid_postfix();
     _Locksyslock_nid_postfix();
     _Unlocksyslock_nid_postfix();
     _Unlocksyslock_nid_postfix();
+
     std::cout << "Guest locale checks passed\n";
 }
diff --git a/core/libs/tests/GuestLoginDialog.cpp b/core/libs/tests/GuestLoginDialog.cpp
index 09e5d52663..9b567297b0 100644
--- a/core/libs/tests/GuestLoginDialog.cpp
+++ b/core/libs/tests/GuestLoginDialog.cpp
@@ -1,18 +1,9 @@
+#include "prx/libSceLoginDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 
-extern "C" {
-int APS5_VABI sceLoginDialogInitialize(void);
-int APS5_VABI sceLoginDialogOpen(const LoginDialogParam* param);
-int APS5_VABI sceLoginDialogUpdateStatus(void);
-int APS5_VABI sceLoginDialogGetStatus(void);
-int APS5_VABI sceLoginDialogGetResult(LoginDialogResult* result);
-int APS5_VABI sceLoginDialogClose(void);
-int APS5_VABI sceLoginDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -35,8 +26,10 @@ int main() {
     LoginDialogResult result{-1, -1, {11, 22, 33, 44, 55, 66, 77, 88}};
 
     Require(sceLoginDialogTerminate() == kErrNotInitialized);
+    Require(sceLoginDialogOpen(nullptr) == kErrArgNull);
     Require(sceLoginDialogOpen(&param) == kErrNotInitialized);
     Require(sceLoginDialogClose() == kErrNotInitialized);
+    Require(sceLoginDialogGetResult(nullptr) == kErrArgNull);
     Require(sceLoginDialogGetResult(&result) == kErrNotInitialized);
     Require(sceLoginDialogGetStatus() == kStatusNone);
     Require(sceLoginDialogUpdateStatus() == kStatusNone);
@@ -47,6 +40,7 @@ int main() {
     Require(sceLoginDialogUpdateStatus() == kStatusInitialized);
 
     Require(sceLoginDialogOpen(nullptr) == kErrArgNull);
+    Require(sceLoginDialogGetResult(nullptr) == kErrArgNull);
     Require(sceLoginDialogGetResult(&result) == kErrNotFinished);
     Require(result.result == 1 && result.errorCode == static_cast<int>(0x81340007u));
 
diff --git a/core/libs/tests/GuestLoginService.cpp b/core/libs/tests/GuestLoginService.cpp
index a1fa20d143..dfee6d6f6c 100644
--- a/core/libs/tests/GuestLoginService.cpp
+++ b/core/libs/tests/GuestLoginService.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLoginService/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
@@ -5,12 +6,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceLoginServiceInitialize(void);
-int APS5_VABI sceLoginServiceTerminate(void);
-int APS5_VABI sceLoginServiceRequestDevices(void* param);
-}
-
 static void Require(bool value) {
     if (!value) std::abort();
 }
@@ -20,7 +15,8 @@ int main() {
     Require(sceLoginServiceTerminate() == 0);
     unsigned char buffer[0x80]{};
     try {
-        sceLoginServiceRequestDevices(buffer);
+        sceLoginServiceRequestDevices(reinterpret_cast<const LoginServiceDeviceRequest*>(buffer));
+
     } catch (const std::runtime_error& error) {
         if (std::string(error.what()) == "sceLoginServiceRequestDevices not implemented") return 0;
         std::fprintf(stderr, "sceLoginServiceRequestDevices threw: %s\n", error.what());
diff --git a/core/libs/tests/GuestLowAddressMemory.cpp b/core/libs/tests/GuestLowAddressMemory.cpp
new file mode 100644
index 0000000000..3af824dcac
--- /dev/null
+++ b/core/libs/tests/GuestLowAddressMemory.cpp
@@ -0,0 +1,60 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <source_location>
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "Low guest memory check failed at line %u\n", static_cast<unsigned>(location.line()));
+        std::abort();
+    }
+}
+
+int main() {
+    constexpr std::size_t page = 0x4000;
+    constexpr std::size_t bufferBytes = 64u << 20;
+    constexpr std::size_t stackBytes = 128u << 20;
+    constexpr std::uintptr_t lowLimit = 0x80000000;
+    const auto failed = reinterpret_cast<void*>(~std::uintptr_t{0});
+    auto* buffer = static_cast<unsigned char*>(mmap_nid_postfix(reinterpret_cast<void*>(0x20000000), bufferBytes, 3, 0x1002, -1, 0));
+    auto* stack = static_cast<unsigned char*>(mmap_nid_postfix(reinterpret_cast<void*>(0x40000000), stackBytes, 3, 0x1002, -1, 0));
+    std::fprintf(stderr, "Low guest memory: buffer=%p stack=%p\n", static_cast<void*>(buffer), static_cast<void*>(stack));
+    Require(buffer != failed && stack != failed);
+    const auto bufferAddress = reinterpret_cast<std::uintptr_t>(buffer);
+    const auto stackAddress = reinterpret_cast<std::uintptr_t>(stack);
+    Require(bufferAddress >= 0x20000000 && bufferAddress <= lowLimit - bufferBytes);
+    Require(stackAddress >= 0x40000000 && stackAddress <= lowLimit - stackBytes);
+    Require(GuestArena::GuestArenaContains_nid_postfix(buffer, bufferBytes));
+    Require(GuestArena::GuestArenaContains_nid_postfix(stack, stackBytes));
+    buffer[0] = 0x31;
+    buffer[bufferBytes - 1] = 0x32;
+    stack[0] = 0x41;
+    stack[stackBytes - 1] = 0x42;
+
+    void* collision = mmap_nid_postfix(buffer, page, 3, 0x1002, -1, 0);
+    Require(collision != failed && collision != buffer);
+    Require(buffer[0] == 0x31 && buffer[bufferBytes - 1] == 0x32);
+    Require(munmap_nid_postfix(collision, page) == 0);
+    Require(mmap_nid_postfix(buffer, page, 3, 0x5012, -1, 0) == failed && buffer[0] == 0x31);
+    Require(mmap_nid_postfix(buffer, page, 3, 0x1012, -1, 0) == buffer);
+    Require(buffer[0] == 0 && buffer[bufferBytes - 1] == 0x32);
+
+    Require(mprotect_nid_postfix(buffer, page, 1) == 0);
+    VirtualQueryInfo info{};
+    Require(sceKernelVirtualQuery(buffer, 0, &info, sizeof(info)) == 0 && info.protection == 1);
+    Require(mprotect_nid_postfix(buffer, page, 3) == 0);
+    buffer[0] = 0x51;
+
+    void* ordinary = mmap_nid_postfix(nullptr, page, 3, 0x1002, -1, 0);
+    Require(ordinary != failed && reinterpret_cast<std::uintptr_t>(ordinary) >= 0x200000000ull);
+    Require(munmap_nid_postfix(ordinary, page) == 0);
+    Require(munmap_nid_postfix(buffer, bufferBytes) == 0);
+    Require(munmap_nid_postfix(stack, stackBytes) == 0);
+    Require(mmap_nid_postfix(buffer, page, 3, 0x1002, -1, 0) == buffer);
+    Require(buffer[0] == 0);
+    Require(munmap_nid_postfix(buffer, page) == 0);
+}
diff --git a/core/libs/tests/GuestM4aacEnc.cpp b/core/libs/tests/GuestM4aacEnc.cpp
index d9f6f00888..0db4db35fa 100644
--- a/core/libs/tests/GuestM4aacEnc.cpp
+++ b/core/libs/tests/GuestM4aacEnc.cpp
@@ -1,28 +1,9 @@
+#include "prx/libSceM4aacEnc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int32_t APS5_VABI sceM4aacEncClearContext(int32_t m4aacEncHandle);
-int APS5_VABI sceM4aacEncClearContextEx();
-int32_t APS5_VABI sceM4aacEncCreateEncoder(int32_t channels, int32_t samplingRate, int32_t bitRate, int32_t inputFormat, int32_t outputFormat, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncCreateEncoderEx();
-int32_t APS5_VABI sceM4aacEncDeleteEncoder(int32_t m4aacEncHandle, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncDeleteEncoderEx();
-int32_t APS5_VABI sceM4aacEncEncode(int32_t m4aacEncHandle, void* pInput, uint32_t inputByte, void* pOutput, uint32_t* pOutputByte, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncEncodeEx();
-int APS5_VABI sceM4aacEncEncodeWithPriority();
-int APS5_VABI sceM4aacEncEncodeWithPriorityEx();
-int32_t APS5_VABI sceM4aacEncFlush(int32_t m4aacEncHandle, void* pOutput, uint32_t* pOutputByte, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncFlushEx();
-int APS5_VABI sceM4aacEncFlushWithPriority();
-int APS5_VABI sceM4aacEncFlushWithPriorityEx();
-int APS5_VABI sceM4aacEncGetContext();
-int APS5_VABI sceM4aacEncInitialize();
-int APS5_VABI sceM4aacEncTerminate();
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp
index 04541e7c79..f9cffe9b6e 100644
--- a/core/libs/tests/GuestMath.cpp
+++ b/core/libs/tests/GuestMath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cerrno>
@@ -13,50 +14,10 @@
 #include <limits>
 #include <initializer_list>
 #include <xmmintrin.h>
-struct GuestFloatingPointEnvironment {
-    std::uint32_t control;
-    std::uint32_t status;
-    std::uint32_t tag;
-    unsigned char other[16];
-    std::uint32_t mxcsr;
-};
+
 static_assert(sizeof(GuestFloatingPointEnvironment) == 32);
 extern "C" {
-int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment*);
-double APS5_VABI atof_nid_postfix(const char*);
-double APS5_VABI strtod_nid_postfix(const char*, char**);
-double APS5_VABI wcstod_nid_postfix(const char16_t*, char16_t**);
-float APS5_VABI wcstof_nid_postfix(const char16_t*, char16_t**);
-long double APS5_VABI wcstold_nid_postfix(const char16_t*, char16_t**);
-float APS5_VABI strtof_nid_postfix(const char*, char**);
-long double APS5_VABI strtold_nid_postfix(const char*, char**);
-std::int64_t APS5_VABI strtol_nid_postfix(const char*, char**, int);
-std::uint64_t APS5_VABI strtoul_nid_postfix(const char*, char**, int);
-std::intmax_t APS5_VABI strtoimax_nid_postfix(const char*, char**, int);
-long long APS5_VABI strtoll_nid_postfix(const char*, char**, int);
-unsigned long long APS5_VABI strtoull_nid_postfix(const char*, char**, int);
-std::uintmax_t APS5_VABI strtoumax_nid_postfix(const char*, char**, int);
-unsigned long long APS5_VABI _Stoull_nid_postfix(const char*, char**, int);
-std::uint64_t APS5_VABI _Stoul_nid_postfix(const char*, char**, int);
-int APS5_VABI atoi_nid_postfix(const char*);
-std::int64_t APS5_VABI atol_nid_postfix(const char*);
-long long APS5_VABI atoll_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-double APS5_VABI sqrt_nid_postfix(double);
-float APS5_VABI sqrtf_nid_postfix(float);
-double APS5_VABI fabs_nid_postfix(double);
-int APS5_VABI abs_nid_postfix(int);
-double APS5_VABI trunc_nid_postfix(double);
-double APS5_VABI ceil_nid_postfix(double);
-double APS5_VABI floor_nid_postfix(double);
-float APS5_VABI truncf_nid_postfix(float);
-float APS5_VABI ceilf_nid_postfix(float);
-float APS5_VABI floorf_nid_postfix(float);
-double APS5_VABI nearbyint_nid_postfix(double);
-double APS5_VABI fma_nid_postfix(double, double, double);
-long double APS5_VABI acosl_nid_postfix(long double);
-long double APS5_VABI asinl_nid_postfix(long double);
-long double APS5_VABI frexpl_nid_postfix(long double, int*);
+
 struct LibcFloatConstant { std::uint32_t bits[4]; };
 extern LibcFloatConstant _FInf_nid_postfix;
 extern LibcFloatConstant _FNan_nid_postfix;
@@ -72,137 +33,9 @@ extern SonyDconst _LDenorm_nid_postfix;
 extern SonyDconst _LInf_nid_postfix;
 extern SonyDconst _LNan_nid_postfix;
 extern SonyDconst _LSnan_nid_postfix;
-short APS5_VABI _FDtest_nid_postfix(const float*);
-short APS5_VABI _Dtest_nid_postfix(const double*);
-int APS5_VABI __fpclassifyf_nid_postfix(float);
-int APS5_VABI isnanf_nid_postfix(float);
-int APS5_VABI __signbitl_nid_postfix(long double);
-float APS5_VABI fmodf_nid_postfix(float, float);
-double APS5_VABI fmod_nid_postfix(double, double);
-float APS5_VABI asinf_nid_postfix(float);
-float APS5_VABI acosf_nid_postfix(float);
-double APS5_VABI asin_nid_postfix(double);
-float APS5_VABI atan2f_nid_postfix(float, float);
-float APS5_VABI hypotf_nid_postfix(float, float);
-double APS5_VABI hypot_nid_postfix(double, double);
-double APS5_VABI fdim_nid_postfix(double, double);
-float APS5_VABI fdimf_nid_postfix(float, float);
-float APS5_VABI fabsf_nid_postfix(float);
-long double APS5_VABI fabsl_nid_postfix(long double);
-double APS5_VABI copysign_nid_postfix(double, double);
-float APS5_VABI copysignf_nid_postfix(float, float);
-double APS5_VABI remquo_nid_postfix(double, double, int*);
-float APS5_VABI remquof_nid_postfix(float, float, int*);
-float APS5_VABI fmaf_nid_postfix(float, float, float);
-long double APS5_VABI ceill_nid_postfix(long double);
-long double APS5_VABI floorl_nid_postfix(long double);
-float APS5_VABI tanf_nid_postfix(float);
-int APS5_VABI rand_nid_postfix();
-void APS5_VABI srand_nid_postfix(unsigned int);
-int APS5_VABI rand_r_nid_postfix(unsigned int*);
-float APS5_VABI log10f_nid_postfix(float);
-float APS5_VABI powf_nid_postfix(float, float);
-double APS5_VABI log1p_nid_postfix(double);
-float APS5_VABI log1pf_nid_postfix(float);
-double APS5_VABI expm1_nid_postfix(double);
-float APS5_VABI expm1f_nid_postfix(float);
-float APS5_VABI erff_nid_postfix(float);
-double APS5_VABI erf_nid_postfix(double);
-double APS5_VABI erfc_nid_postfix(double);
-float APS5_VABI erfcf_nid_postfix(float);
-double APS5_VABI lgamma_nid_postfix(double);
+
 extern int signgam_nid_postfix;
-float APS5_VABI logbf_nid_postfix(float);
-int APS5_VABI ilogb_nid_postfix(double);
-int APS5_VABI ilogbf_nid_postfix(float);
-double APS5_VABI exp2_nid_postfix(double);
-float APS5_VABI __powisf2_nid_postfix(float, int);
-double APS5_VABI __powidf2_nid_postfix(double, int);
-double APS5_VABI ldexp_nid_postfix(double, int);
-double APS5_VABI scalbn_nid_postfix(double, int);
-float APS5_VABI scalbnf_nid_postfix(float, int);
-float APS5_VABI nextafterf_nid_postfix(float, float);
-double APS5_VABI nextafter_nid_postfix(double, double);
-double APS5_VABI frexp_nid_postfix(double, int*);
-float APS5_VABI frexpf_nid_postfix(float, int*);
-std::int64_t APS5_VABI lround_nid_postfix(double);
-std::div_t APS5_VABI div_nid_postfix(int, int);
-double APS5_VABI sinh_nid_postfix(double);
-double APS5_VABI cosh_nid_postfix(double);
-double APS5_VABI _Cosh_nid_postfix(double, double);
-float APS5_VABI coshf_nid_postfix(float);
-float APS5_VABI sinhf_nid_postfix(float);
-float APS5_VABI _FSinh_nid_postfix(float, float);
-float APS5_VABI _FCosh_nid_postfix(float, float);
-double APS5_VABI asinh_nid_postfix(double);
-float APS5_VABI asinhf_nid_postfix(float);
-double APS5_VABI acosh_nid_postfix(double);
-float APS5_VABI acoshf_nid_postfix(float);
-double APS5_VABI atanh_nid_postfix(double);
-float APS5_VABI atanhf_nid_postfix(float);
-std::int64_t APS5_VABI lroundf_nid_postfix(float);
-std::int64_t APS5_VABI llround_nid_postfix(double);
-std::int64_t APS5_VABI llroundf_nid_postfix(float);
-std::int64_t APS5_VABI llroundl_nid_postfix(long double);
-int APS5_VABI __isfinitef_nid_postfix(float);
-int APS5_VABI __isfinitel_nid_postfix(long double);
-int APS5_VABI __isnormal_nid_postfix(double);
-int APS5_VABI __isnormalf_nid_postfix(float);
-int APS5_VABI __isinff_nid_postfix(float);
-int APS5_VABI __isinf_nid_postfix(double);
-int APS5_VABI isnan_nid_postfix(double);
-int APS5_VABI isinf_nid_postfix(double);
-std::lldiv_t APS5_VABI lldiv_nid_postfix(long long, long long);
-std::lldiv_t APS5_VABI imaxdiv_nid_postfix(std::int64_t, std::int64_t);
-std::int64_t APS5_VABI labs_nid_postfix(std::int64_t);
-std::int64_t APS5_VABI llabs_nid_postfix(std::int64_t);
-std::int64_t APS5_VABI imaxabs_nid_postfix(std::int64_t);
-long double APS5_VABI scalbnl_nid_postfix(long double, int);
-float APS5_VABI significandf_nid_postfix(float);
-double APS5_VABI significand_nid_postfix(double);
-long double APS5_VABI acoshl_nid_postfix(long double);
-long double APS5_VABI asinhl_nid_postfix(long double);
-long double APS5_VABI atanhl_nid_postfix(long double);
-long double APS5_VABI atan2l_nid_postfix(long double, long double);
-long double APS5_VABI cbrtl_nid_postfix(long double);
-long double APS5_VABI erfl_nid_postfix(long double);
-long double APS5_VABI erfcl_nid_postfix(long double);
-long double APS5_VABI expm1l_nid_postfix(long double);
-long double APS5_VABI log1pl_nid_postfix(long double);
-long double APS5_VABI log2l_nid_postfix(long double);
-long double APS5_VABI lgammal_nid_postfix(long double);
-long double APS5_VABI tgammal_nid_postfix(long double);
-float APS5_VABI tgammaf_nid_postfix(float);
-long double APS5_VABI hypotl_nid_postfix(long double, long double);
-float APS5_VABI hypot3f_nid_postfix(float, float, float);
-double APS5_VABI hypot3_nid_postfix(double, double, double);
-long double APS5_VABI hypot3l_nid_postfix(long double, long double, long double);
-float APS5_VABI j0f_nid_postfix(float);
-float APS5_VABI j1f_nid_postfix(float);
-float APS5_VABI jnf_nid_postfix(int, float);
-float APS5_VABI y0f_nid_postfix(float);
-float APS5_VABI y1f_nid_postfix(float);
-float APS5_VABI ynf_nid_postfix(int, float);
-std::lldiv_t APS5_VABI ldiv_nid_postfix(std::int64_t, std::int64_t);
-float APS5_VABI nanf_nid_postfix(const char*);
-double APS5_VABI nan_nid_postfix(const char*);
-long double APS5_VABI atanl_nid_postfix(long double);
-long double APS5_VABI sinl_nid_postfix(long double);
-long double APS5_VABI cosl_nid_postfix(long double);
-long double APS5_VABI tanl_nid_postfix(long double);
-long double APS5_VABI sinhl_nid_postfix(long double);
-long double APS5_VABI coshl_nid_postfix(long double);
-long double APS5_VABI tanhl_nid_postfix(long double);
-long double APS5_VABI expl_nid_postfix(long double);
-long double APS5_VABI exp2l_nid_postfix(long double);
-long double APS5_VABI logl_nid_postfix(long double);
-long double APS5_VABI log10l_nid_postfix(long double);
-long double APS5_VABI powl_nid_postfix(long double, long double);
-long double APS5_VABI ldexpl_nid_postfix(long double, int);
-long double APS5_VABI truncl_nid_postfix(long double);
-long double APS5_VABI nearbyintl_nid_postfix(long double);
-double APS5_VABI logb_nid_postfix(double);
-double APS5_VABI remainder_nid_postfix(double, double);
+
 struct DinkumwareFloatCharacteristics {
     int digits;
     int mantissaDigits;
@@ -437,8 +270,9 @@ static void CheckNanConversions() {
             std::fprintf(stderr, "atof(\"%s\")\n", test.text);
             correct = false;
         }
+        const std::uint32_t expectedSingle = (test.bits >> 63 != 0 ? 0x80000000u : 0) | 0x7fc00000u;
         const auto single = std::bit_cast<std::uint32_t>(strtof_nid_postfix(test.text, &end));
-        if (single != 0x7fc00000u || end != test.text + test.sequenceUsed) {
+        if (single != expectedSingle || end != test.text + test.sequenceUsed) {
             std::fprintf(stderr, "strtof(\"%s\") = 0x%08x\n", test.text, static_cast<unsigned>(single));
             correct = false;
         }
@@ -461,7 +295,7 @@ static void CheckNanConversions() {
         }
         if (test.wideOtherMeasured) {
             const auto wideSingle = std::bit_cast<std::uint32_t>(wcstof_nid_postfix(wide, &wideEnd));
-            const bool singleOk = wideSingle == 0x7fc00000u && wideEnd == wide + test.sequenceUsed;
+            const bool singleOk = wideSingle == expectedSingle && wideEnd == wide + test.sequenceUsed;
             const long double wideExtended = wcstold_nid_postfix(wide, &wideEnd);
             if (!singleOk || !ExtendedBits(wideExtended, 0xc000000000000000ull, 0x7fff) || wideEnd != wide + test.sequenceUsed) {
                 std::fprintf(stderr, "wcstof/wcstold(\"%s\")\n", test.text);
@@ -487,7 +321,6 @@ static void CheckFloatUnderflowErrno() {
     errno = 7;
     Require(strtod_nid_postfix("1e-310", &end) == 1e-310 && errno == 7);
     Require(strtod_nid_postfix("-4.9406564584124654e-324", &end) == -0x1p-1074 && errno == 7);
-    Require(strtof_nid_postfix("1e-40", &end) == 1e-40f && errno == 7);
     Require(strtold_nid_postfix("1e-4940", &end) == 1e-4940L && errno == 7);
     Require(strtod_nid_postfix("1e-330", &end) == 0.0 && errno == ERANGE);
     errno = 0;
@@ -496,6 +329,49 @@ static void CheckFloatUnderflowErrno() {
     Require(strtod_nid_postfix("1e400", &end) == HUGE_VAL && errno == ERANGE);
     errno = 0;
     Require(strtod_nid_postfix("2.2250738585072014e-308", &end) == 0x1p-1022 && errno == 0);
+    Require(strtod_nid_postfix("0x1.8p-1075", &end) == 0x1p-1074 && errno == ERANGE);
+    errno = 0;
+    Require(strtod_nid_postfix("-0x1.000001p-1075", &end) == -0x1p-1074 && errno == ERANGE);
+    errno = 0;
+    Require(strtod_nid_postfix("0x1p-1074", &end) == 0x1p-1074 && strtod_nid_postfix("0x1.8p-1074", &end) == 0x1p-1073 && errno == 0);
+    Require(strtod_nid_postfix("0x1p-1076", &end) == 0.0 && errno == ERANGE);
+    errno = 0;
+    Require(strtod_nid_postfix("0x1p+1100", &end) == HUGE_VAL && errno == ERANGE);
+    errno = 7;
+    Require(strtold_nid_postfix("0x1p-16446", &end) == 0.0L && strtold_nid_postfix("0x1p+20000", &end) == HUGE_VALL && errno == 7);
+    Require(strtof_nid_postfix("0x1p-149", &end) == 0x1p-149f && strtof_nid_postfix("0x1.8p-149", &end) == 0x1p-148f && strtof_nid_postfix("0x1.000001p-149", &end) == 0x1p-149f && errno == 7);
+    Require(strtof_nid_postfix("1.40129846432481707092372958328991613128026194187651577175706828388979108268586060148663818836212158203125e-45", &end) == 0x1p-149f && strtof_nid_postfix("1.17549435e-38", &end) == 0x1p-126f && errno == 7);
+    Require(strtof_nid_postfix("0x1p-150", &end) == 0.0f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("0x1.8p-150", &end) == 0x1p-149f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("-0x0.0000018p-126", &end) == -0x1p-149f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("0x1.4p-149", &end) == 0x1p-149f && strtof_nid_postfix("0x1.cp-149", &end) == 0x1p-148f && errno == 7);
+    errno = 7;
+    Require(strtof_nid_postfix("0x1p+200", &end) == HUGE_VALF && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("1e-40", &end) == 1e-40f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("-1e-45", &end) == -0x1p-149f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("3e-45", &end) == 0x1p-148f && errno == ERANGE);
+    Require(strtof_nid_postfix("1e39", &end) == HUGE_VALF && errno == ERANGE);
+    errno = 0;
+}
+
+static void CheckAtanfConsoleBits() {
+    constexpr std::uint32_t cases[][2] = {
+        {0x3e80000bu, 0x3e7adbc5u}, {0x3e0007c9u, 0x3dfebd2au}, {0xbdccce4cu, 0xbdcc2090u},
+        {0x3ef00334u, 0x3ee07046u}, {0x3f40077eu, 0x3f24c148u}, {0x3fa009a5u, 0x3f656b6au},
+        {0x4080055cu, 0x3fa9b5a8u}, {0xbf12345eu, 0xbf04d718u}, {0x3f800000u, 0x3f490fdbu},
+        {0x4c800000u, 0x3fc90fdbu}, {0xcc800000u, 0xbfc90fdbu}, {0x7f800000u, 0x3fc90fdbu},
+        {0xff800000u, 0xbfc90fdbu}, {0x7fc00001u, 0x7fc00001u}, {0x80000000u, 0x80000000u},
+        {0x00000001u, 0x00000001u}, {0x39000000u, 0x39000000u},
+    };
+    for (const auto& [input, expected] : cases) {
+        Require(std::bit_cast<std::uint32_t>(atanf_nid_postfix(std::bit_cast<float>(input))) == expected);
+    }
 }
 
 static void CheckHypotSpecialValue() {
@@ -524,6 +400,13 @@ static void CheckPowfSpecialValue() {
     Require(std::bit_cast<std::uint32_t>(powf_nid_postfix(1.0f, std::bit_cast<float>(0x7f800001u))) == 0x3f800000u);
 }
 
+struct RestoreFloatingPointState {
+    std::fenv_t environment;
+    int error = errno;
+    RestoreFloatingPointState() { Require(std::fegetenv(&environment) == 0); }
+    ~RestoreFloatingPointState() { Require(std::fesetenv(&environment) == 0); errno = error; }
+};
+
 static void CheckAcosfErrno() {
     errno = 0;
     Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(2.0f)) == 0xffc00000u);
@@ -534,6 +417,47 @@ static void CheckAcosfErrno() {
     Require(errno == 0);
 }
 
+static void CheckFmodfErrno() {
+    const RestoreFloatingPointState saved;
+    const struct { std::uint32_t dividend; std::uint32_t divisor; std::uint32_t expected; bool invalid; bool nan; } cases[] = {
+        {0x3f800000u, 0x00000000u, 0u, true, true}, {0x3f800000u, 0x80000000u, 0u, true, true},
+        {0x7f800000u, 0x40000000u, 0u, true, true}, {0x7fc00000u, 0x40000000u, 0u, false, true},
+        {0x3f800000u, 0x7f800000u, 0x3f800000u, false, false}, {0xbf800000u, 0x7f800000u, 0xbf800000u, false, false},
+        {0x41280000u, 0x40000000u, 0x3f000000u, false, false}, {0xc1280000u, 0x40000000u, 0xbf000000u, false, false},
+        {0x41280000u, 0xc0000000u, 0x3f000000u, false, false}, {0xc1280000u, 0xc0000000u, 0xbf000000u, false, false},
+        {0x00000000u, 0x40000000u, 0x00000000u, false, false}, {0x80000000u, 0x40000000u, 0x80000000u, false, false},
+        {0x00000000u, 0x80000000u, 0u, true, true},
+        {0x3f800000u, 0x7fc00001u, 0u, false, true},
+        {0x00000000u, 0x7fc00001u, 0u, false, true},
+        {0x7f800001u, 0x40000000u, 0u, true, true},
+        {0x3f800000u, 0x7f800001u, 0u, true, true},
+        {0x00000003u, 0x00000002u, 0x00000001u, false, false},
+        {0x00800001u, 0x00800000u, 0x00000001u, false, false},
+        {0x80000001u, 0x3f800000u, 0x80000001u, false, false},
+    };
+    for (const auto& test : cases) {
+        std::feclearexcept(FE_ALL_EXCEPT);
+        *__error_nid_postfix() = 73;
+        const float result = fmodf_nid_postfix(std::bit_cast<float>(test.dividend), std::bit_cast<float>(test.divisor));
+        const std::uint32_t bits = std::bit_cast<std::uint32_t>(result);
+        const int invalid = std::fetestexcept(FE_INVALID) != 0;
+        const bool nan = std::isnan(result);
+        if (nan != test.nan || (!nan && bits != test.expected) || invalid != test.invalid || *__error_nid_postfix() != 73) {
+            std::fprintf(stderr, "Guest fmodf failed for %08x and %08x: got %08x, invalid %d, errno %d\n",
+                test.dividend, test.divisor, bits, invalid, *__error_nid_postfix());
+            std::abort();
+        }
+    }
+    std::feclearexcept(FE_ALL_EXCEPT);
+    std::feraiseexcept(FE_DIVBYZERO);
+    *__error_nid_postfix() = 73;
+    (void)fmodf_nid_postfix(1.0f, 0.0f);
+    if (*__error_nid_postfix() != 73 || std::fetestexcept(FE_DIVBYZERO) == 0) {
+        std::fprintf(stderr, "Guest fmodf dropped the floating-point environment\n");
+        std::abort();
+    }
+}
+
 static void CheckLongDouble() {
     Require(ExtendedBits(acosl_nid_postfix(-1.0L), 0xc90fdaa22168c235ull, 0x4000));
     Require(ExtendedBits(acosl_nid_postfix(0.0L), 0xc90fdaa22168c235ull, 0x3fff));
@@ -589,6 +513,164 @@ static long double MakeExtended(std::uint64_t mantissa, std::uint16_t signExpone
     return value;
 }
 
+static void CheckExpm1ConsoleBits() {
+    constexpr struct {
+        std::uint64_t input;
+        std::uint64_t expected;
+        int error;
+    } cases[] = {
+        {0x0000000000000000ull, 0x0000000000000000ull, 0}, {0x8000000000000000ull, 0x8000000000000000ull, 0},
+        {0x3c8fffffffffffffull, 0x3c8fffffffffffffull, 0}, {0x3c90000000000000ull, 0x3c90000000000000ull, 0},
+        {0x3fd62e42fefa39efull, 0x3fda827999fcef32ull, 0}, {0x3fd62e4300000000ull, 0x3fda82799b6f2366ull, 0},
+        {0x3ff0a2b1ffffffffull, 0x3ffd413c1a24d411ull, 0}, {0x3ff0a2b200000000ull, 0x3ffd413c1a24d414ull, 0},
+        {0xbfd0000000000000ull, 0xbfcc5041854df7d4ull, 0}, {0xbfe0000000000000ull, 0xbfd92e9a0720d3ecull, 0},
+        {0x3ff0000000000000ull, 0x3ffb7e151628aed2ull, 0}, {0xbff0000000000000ull, 0xbfe43a54e4e98864ull, 0},
+        {0x4043687a00000000ull, 0x436fffd8395c0c41ull, 0}, {0xc043687a00000000ull, 0xbff0000000000000ull, 0},
+        {0x4049000000000000ull, 0x44719103e4080b45ull, 0}, {0x40862e42fefa39efull, 0x7fefffffffffff2aull, 0},
+        {0x40862e42fefa39f0ull, 0x7ff0000000000000ull, ERANGE}, {0xc08f400000000000ull, 0xbff0000000000000ull, 0},
+        {0x7fefffffffffffffull, 0x7ff0000000000000ull, ERANGE}, {0xffefffffffffffffull, 0xbff0000000000000ull, 0},
+        {0x7ff0000000000000ull, 0x7ff0000000000000ull, 0}, {0xfff0000000000000ull, 0xbff0000000000000ull, 0},
+        {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0}, {0xfff8000000000002ull, 0xfff8000000000002ull, 0},
+        {0x3fc78b9e474afed8ull, 0x3fc9d99e60806b35ull, 0}, {0xbf887a99bea50fb1ull, 0xbf88554c5b9d0cbbull, 0},
+        {0x3ff790fb0ae85390ull, 0x400ae5103402894bull, 0}, {0xbf840fe48e07e54dull, 0xbf83f6d1bcda4943ull, 0},
+        {0xbfbb1276066a31c7ull, 0xbfb9b098289dab68ull, 0}, {0x3fc07bc20a0c887eull, 0x3fc197828317c86cull, 0},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint64_t>(expm1_nid_postfix(std::bit_cast<double>(item.input))) == item.expected);
+        Require(errno == (item.error != 0 ? item.error : 1234));
+    }
+}
+
+static void CheckNextafterConsoleBits() {
+    constexpr struct {
+        std::uint64_t x;
+        std::uint64_t y;
+        std::uint64_t expected;
+        int expectedErrno;
+    } cases[] = {
+        {0x0000000000000000ull, 0x3ff0000000000000ull, 0x0000000000000001ull, 0},
+        {0x8000000000000000ull, 0xbff0000000000000ull, 0x8000000000000001ull, 0},
+        {0x0000000000000001ull, 0x0000000000000000ull, 0x0000000000000000ull, ERANGE},
+        {0x8000000000000001ull, 0x3ff0000000000000ull, 0x8000000000000000ull, ERANGE},
+        {0x0010000000000000ull, 0x0000000000000000ull, 0x000fffffffffffffull, ERANGE},
+        {0x000fffffffffffffull, 0x3ff0000000000000ull, 0x0010000000000000ull, 0},
+        {0x7fefffffffffffffull, 0x7ff0000000000000ull, 0x7ff0000000000000ull, ERANGE},
+        {0xffefffffffffffffull, 0xfff0000000000000ull, 0xfff0000000000000ull, ERANGE},
+        {0x7ff0000000000000ull, 0x0000000000000000ull, 0x7fefffffffffffffull, 0},
+        {0x3ff0000000000000ull, 0x4000000000000000ull, 0x3ff0000000000001ull, 0},
+        {0x3ff0000000000000ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull, 0},
+        {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull, 0},
+        {0x7ff0000000000001ull, 0x3ff0000000000000ull, 0x7ff8000000000001ull, 0},
+        {0x3ff0000000000000ull, 0xfff8000000000123ull, 0xfff8000000000123ull, 0},
+        {0x7ff8000000000123ull, 0xfff8000000000456ull, 0x7ff8000000000123ull, 0},
+        {0xfff8000000000456ull, 0x7ff0000000000001ull, 0xfff8000000000456ull, 0},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint64_t>(nextafter_nid_postfix(std::bit_cast<double>(item.x), std::bit_cast<double>(item.y))) == item.expected);
+        Require(errno == (item.expectedErrno != 0 ? item.expectedErrno : 1234));
+    }
+    constexpr struct {
+        std::uint32_t x;
+        std::uint32_t y;
+        std::uint32_t expected;
+        int expectedErrno;
+    } floatCases[] = {
+        {0x00000000u, 0x3f800000u, 0x00000001u, 0},
+        {0x80000000u, 0xbf800000u, 0x80000001u, 0},
+        {0x00000001u, 0x00000000u, 0x00000000u, ERANGE},
+        {0x80000001u, 0x3f800000u, 0x80000000u, ERANGE},
+        {0x00800000u, 0x00000000u, 0x007fffffu, ERANGE},
+        {0x007fffffu, 0x3f800000u, 0x00800000u, 0},
+        {0x7f7fffffu, 0x7f800000u, 0x7f800000u, ERANGE},
+        {0xff7fffffu, 0xff800000u, 0xff800000u, ERANGE},
+        {0x7f800000u, 0x00000000u, 0x7f7fffffu, 0},
+        {0x3f800000u, 0x40000000u, 0x3f800001u, 0},
+        {0x3f800000u, 0x3f800000u, 0x3f800000u, 0},
+        {0x80000000u, 0x00000000u, 0x00000000u, 0},
+        {0x7f800001u, 0x3f800000u, 0x7fc00001u, 0},
+        {0x3f800000u, 0xffc00123u, 0xffc00123u, 0},
+        {0x7fc00123u, 0xffc00456u, 0x7fc00123u, 0},
+        {0xffc00456u, 0x7f800001u, 0xffc00456u, 0},
+    };
+    for (const auto& item : floatCases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(nextafterf_nid_postfix(std::bit_cast<float>(item.x), std::bit_cast<float>(item.y))) == item.expected);
+        Require(errno == (item.expectedErrno != 0 ? item.expectedErrno : 1234));
+    }
+}
+
+static void CheckLog1pConsoleBits() {
+    constexpr struct {
+        std::uint64_t input;
+        std::uint64_t expected;
+        int error;
+    } cases[] = {
+        {0x0000000000000000ull, 0x0000000000000000ull, 0}, {0x8000000000000000ull, 0x8000000000000000ull, 0},
+        {0x3c8fffffffffffffull, 0x3c8fffffffffffffull, 0}, {0x3c90000000000000ull, 0x3c90000000000000ull, 0},
+        {0x3e1fffffffffffffull, 0x3e1fffffff7fffffull, 0}, {0x3e20000000000000ull, 0x3e1fffffff800000ull, 0},
+        {0xbe20000000000000ull, 0xbe20000000400000ull, 0}, {0x3fda8279ffffffffull, 0x3fd62e43471c5d9dull, 0},
+        {0x3fda827a00000000ull, 0x3fd62e43471c5d9eull, 0}, {0xbfd2bec400000000ull, 0xbfd62e4420e1ff10ull, 0},
+        {0xbfd2bec3ffffffffull, 0xbfd62e4420e1ff0full, 0}, {0x3ff0000000000000ull, 0x3fe62e42fefa39efull, 0},
+        {0xbfe0000000000000ull, 0xbfe62e42fefa39efull, 0}, {0xbfefffffffffffffull, 0xc0425e4f7b2737faull, 0},
+        {0xbff0000000000000ull, 0xfff0000000000000ull, 0}, {0xbff0000000000001ull, 0xfff8000000000000ull, EDOM},
+        {0xc000000000000000ull, 0xfff8000000000000ull, EDOM}, {0x433fffffffffffffull, 0x40425e4f7b2737faull, 0},
+        {0x4340000000000000ull, 0x40425e4f7b2737faull, 0}, {0x7fefffffffffffffull, 0x40862e42fefa39efull, 0},
+        {0x7ff0000000000000ull, 0x7ff0000000000000ull, 0}, {0xfff0000000000000ull, 0xfff8000000000000ull, EDOM},
+        {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0}, {0xfff8000000000002ull, 0xfff8000000000002ull, EDOM},
+        {0x3f0f5ab6d3865ccaull, 0x3f0f5a7962a0216cull, 0}, {0x3fe8683f0ace287cull, 0x3fe223b9ede79242ull, 0},
+        {0x3f5f8cd247124706ull, 0x3f5f850e039f6187ull, 0}, {0x40298faede87074bull, 0x4004fc71ddb00cc0ull, 0},
+        {0x404b621796f08648ull, 0x401015adbb851c70ull, 0}, {0x3f21ecf9339d7420ull, 0x3f21eca8e0601790ull, 0},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint64_t>(log1p_nid_postfix(std::bit_cast<double>(item.input))) == item.expected);
+        Require(errno == (item.error != 0 ? item.error : 1234));
+    }
+}
+
+static void CheckTanhConsoleBits() {
+    constexpr std::uint64_t cases[][2] = {
+        {0x0000000000000000ull, 0x0000000000000000ull}, {0x8000000000000000ull, 0x8000000000000000ull},
+        {0x3e2fffffffffffffull, 0x3e2fffffffffffffull}, {0x3e30000000000000ull, 0x3e30000000000000ull},
+        {0xbe30000000000000ull, 0xbe30000000000000ull}, {0x3fefffffffffffffull, 0x3fe85efab514f394ull},
+        {0x3ff0000000000000ull, 0x3fe85efab514f394ull}, {0xbff0000000000000ull, 0xbfe85efab514f394ull},
+        {0x3fe0000000000000ull, 0x3fdd9353d7568af3ull}, {0x4035ffffffffffffull, 0x3ff0000000000000ull},
+        {0x4036000000000000ull, 0x3ff0000000000000ull}, {0xc036000000000000ull, 0xbff0000000000000ull},
+        {0x4049000000000000ull, 0x3ff0000000000000ull}, {0x7fefffffffffffffull, 0x3ff0000000000000ull},
+        {0x7ff0000000000000ull, 0x3ff0000000000000ull}, {0xfff0000000000000ull, 0xbff0000000000000ull},
+        {0x7ff8000000000001ull, 0x7ff8000000000001ull}, {0xfff8000000000002ull, 0xfff8000000000002ull},
+        {0x3f927ed0db8370b1ull, 0x3f927e4d1092a580ull}, {0x3f95d74e4cee78bfull, 0x3f95d67547d523a0ull},
+        {0x3f18f1b062cb523cull, 0x3f18f1b06187faaeull}, {0x3f937129f25ae835ull, 0x3f937090dd8c9cb3ull},
+        {0x3facb0d89f8aa91cull, 0x3faca92afe31a32bull}, {0x3f07f462f020acdeull, 0x3f07f462efd91530ull},
+    };
+    for (const auto& [input, expected] : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint64_t>(tanh_nid_postfix(std::bit_cast<double>(input))) == expected && errno == 1234);
+    }
+}
+
+static void CheckRoundingNaNConsoleBits() {
+    constexpr std::uint64_t cases[][2] = {
+        {0x7ff0000000000001ull, 0x7ff8000000000001ull}, {0xfff4000000000123ull, 0xfffc000000000123ull}, {0x7ff8000000000456ull, 0x7ff8000000000456ull},
+        {0x7ff0000000000000ull, 0x7ff0000000000000ull}, {0xfff0000000000000ull, 0xfff0000000000000ull},
+    };
+    constexpr std::uint32_t floatCases[][2] = {
+        {0x7f800001u, 0x7fc00001u}, {0xffa00123u, 0xffe00123u}, {0x7fc00456u, 0x7fc00456u}, {0x7f800000u, 0x7f800000u}, {0xff800000u, 0xff800000u},
+    };
+    for (const auto function : {trunc_nid_postfix, ceil_nid_postfix, floor_nid_postfix, nearbyint_nid_postfix}) {
+        for (const auto& [input, expected] : cases) {
+            Require(std::bit_cast<std::uint64_t>(function(std::bit_cast<double>(input))) == expected);
+        }
+    }
+    for (const auto function : {truncf_nid_postfix, ceilf_nid_postfix, floorf_nid_postfix, nearbyintf_nid_postfix}) {
+        for (const auto& [input, expected] : floatCases) {
+            Require(std::bit_cast<std::uint32_t>(function(std::bit_cast<float>(input))) == expected);
+        }
+    }
+}
+
 static void CheckAsinl() {
     const struct { std::uint64_t inputMantissa; std::uint16_t inputSignExponent; std::uint64_t outputMantissa; std::uint16_t outputSignExponent; } cases[] = {
         {0, 0x0000, 0, 0x0000}, {0, 0x8000, 0, 0x8000},
@@ -623,6 +705,21 @@ static void CheckAsinl() {
     *__error_nid_postfix() = 0;
 }
 
+static void CheckCbrtfConsoleBits() {
+    constexpr std::uint32_t cases[][2] = {
+        {0x00000123u, 0x28059605u}, {0x00400327u, 0x2a4b334bu}, {0x3f000555u, 0x3f4b32c7u}, {0x3fc00778u, 0x3f9287e5u},
+        {0x42000999u, 0x404b3509u}, {0x7e000bbcu, 0x544b362au}, {0xbf400dddu, 0xbf689d01u}, {0x80201002u, 0xaa215ff8u},
+        {0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u}, {0x00000001u, 0x26a14518u}, {0x007fffffu, 0x2a7fffffu},
+        {0x00800000u, 0x2a800000u}, {0x3f800000u, 0x3f800000u}, {0x41000000u, 0x40000000u}, {0xc1000000u, 0xc0000000u},
+        {0x7f7fffffu, 0x54cb2ff5u}, {0x7f800000u, 0x7f800000u}, {0xff800000u, 0xff800000u}, {0x7fc00001u, 0x7fc00001u},
+        {0xffc00002u, 0xffc00002u},
+    };
+    for (const auto& [input, expected] : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(cbrtf_nid_postfix(std::bit_cast<float>(input))) == expected && errno == 1234);
+    }
+}
+
 static void CheckIntegerConversions() {
     for (const long long numerator : {4294967301LL, -4294967301LL}) {
         for (const long long denominator : {3LL, -3LL}) {
@@ -797,13 +894,52 @@ static void CheckAsin() {
     std::feclearexcept(FE_ALL_EXCEPT);
     errno = 0;
     asin_nid_postfix(2.0);
+
     Require(std::fetestexcept(FE_INVALID));
     Require(errno == 0);
     std::feclearexcept(FE_ALL_EXCEPT);
     asin_nid_postfix(nan);
+
     Require(!std::fetestexcept(FE_INVALID));
 }
 
+static void CheckTrigfConsoleBits() {
+    constexpr struct {
+        std::uint32_t input;
+        std::uint32_t sine;
+        std::uint32_t cosine;
+        std::uint32_t tangent;
+        int error;
+    } cases[] = {
+        {0x3e801d5au, 0x3e7d9057u, 0x3f780703u, 0x3e82db72u, 0}, {0x3fc00321u, 0x3f7f5c46u, 0x3d90acbbu, 0x4161edb0u, 0},
+        {0x40400556u, 0x3e102d3eu, 0xbf7d7328u, 0xbe11a09du, 0}, {0x40c00781u, 0xbe8e9c41u, 0x3f75de78u, 0xbe947c92u, 0},
+        {0x412009acu, 0xbf0bc6b7u, 0xbf56790du, 0x3f26d71eu, 0}, {0x47000bbbu, 0x3eb0df2fu, 0x3f703d5au, 0x3ebc799eu, 0},
+        {0x4e000de0u, 0xbf664722u, 0x3edfade4u, 0xc003c6abu, 0}, {0x5f001006u, 0xbe0ecf11u, 0x3f7d7f8cu, 0xbe1037deu, 0},
+        {0x7e001112u, 0x3eabd0cbu, 0x3f7127beu, 0x3eb6645du, 0}, {0xc0400556u, 0xbe102d3eu, 0xbf7d7328u, 0x3e11a09du, 0},
+        {0x00000000u, 0x00000000u, 0x3f800000u, 0x00000000u, 0}, {0x80000000u, 0x80000000u, 0x3f800000u, 0x80000000u, 0},
+        {0x39000000u, 0x39000000u, 0x3f800000u, 0x39000000u, 0}, {0x3f490fdbu, 0x3f3504f3u, 0x3f3504f3u, 0x3f800000u, 0},
+        {0x40490fdbu, 0xb3bbbd2eu, 0xbf800000u, 0x33bbbd2fu, 0}, {0x4dc90fdbu, 0xbf3d5f98u, 0x3f2c42b6u, 0xbf8cb742u, 0},
+        {0x7f7fffffu, 0xbf0599b3u, 0x3f5a5f96u, 0xbf1c9ecau, 0}, {0xff7fffffu, 0x3f0599b3u, 0x3f5a5f96u, 0x3f1c9ecau, 0},
+        {0x7f800000u, 0xffc00000u, 0xffc00000u, 0xffc00000u, EDOM}, {0xff800000u, 0xffc00000u, 0xffc00000u, 0xffc00000u, EDOM},
+        {0x7fc00001u, 0x7fc00001u, 0x7fc00001u, 0x7fc00001u, 0},
+    };
+    for (const auto& item : cases) {
+        const float x = std::bit_cast<float>(item.input);
+        const int expected = item.error != 0 ? item.error : 1234;
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(sinf_nid_postfix(x)) == item.sine && errno == expected);
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(cosf_nid_postfix(x)) == item.cosine && errno == expected);
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(tanf_nid_postfix(x)) == item.tangent && errno == expected);
+        float sine = 0.0f;
+        float cosine = 0.0f;
+        sincosf_nid_postfix(x, &sine, &cosine);
+
+        Require(std::bit_cast<std::uint32_t>(sine) == item.sine && std::bit_cast<std::uint32_t>(cosine) == item.cosine);
+    }
+}
+
 static void CheckExtendedMath() {
     Require(ExtendedBits(atanl_nid_postfix(INFINITY), 0xc90fdaa22168c235ull, 0x3fff));
     Require(std::fabs(atanl_nid_postfix(1.0L) - 0.785398163397448309616L) < 1e-18L);
@@ -838,6 +974,26 @@ static void CheckExtendedMath() {
     Require(std::isnan(remainder_nid_postfix(1.0, 0.0)) && std::isnan(remainder_nid_postfix(INFINITY, 1.0)));
 }
 
+static void CheckExp2fConsoleBits() {
+    constexpr struct {
+        std::uint32_t input;
+        std::uint32_t expected;
+        int error;
+    } cases[] = {
+        {0x3d00010bu, 0x3f82cd8du, 0}, {0x3f000303u, 0x3fb5066du, 0}, {0x40a0051bu, 0x42000e29u, 0}, {0x42f0070cu, 0x7b813a1bu, 0},
+        {0xbf400909u, 0x3f183437u, 0}, {0xc2f00b14u, 0x037c3073u, 0}, {0x00000000u, 0x3f800000u, 0}, {0x80000000u, 0x3f800000u, 0},
+        {0x33000000u, 0x3f800000u, 0}, {0x3f800000u, 0x40000000u, 0}, {0x42fe0000u, 0x7f000000u, 0}, {0x42ffffffu, 0x7f7fffa7u, 0},
+        {0x43000000u, 0x7f800000u, ERANGE}, {0x7f7fffffu, 0x7f800000u, ERANGE}, {0x7f800000u, 0x7f800000u, 0}, {0xff800000u, 0x00000000u, 0},
+        {0xc2fc0000u, 0x00800000u, 0}, {0xc3150000u, 0x00000001u, 0}, {0xc315ffffu, 0x00000001u, 0}, {0xc3160000u, 0x00000000u, ERANGE},
+        {0xc3160001u, 0x00000000u, ERANGE}, {0xff7fffffu, 0x00000000u, ERANGE}, {0x7fc00001u, 0x7fc00001u, 0}, {0xffc00002u, 0xffc00002u, 0},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(exp2f_nid_postfix(std::bit_cast<float>(item.input))) == item.expected);
+        Require(errno == (item.error != 0 ? item.error : 1234));
+    }
+}
+
 static void CheckHyperbolic() {
     const double infinity = std::numeric_limits<double>::infinity();
     Require(_Cosh_nid_postfix(0.0, 2.0) == 2.0);
@@ -868,6 +1024,150 @@ static void CheckHyperbolic() {
     Require(Near(acosh_nid_postfix(1e300), 691.4686750787736, 1e-15));
 }
 
+static void CheckAcoshfDomainEnvironment() {
+    const RestoreFloatingPointState saved;
+    const unsigned savedCsr = _mm_getcsr();
+    const struct {
+        std::uint32_t input;
+        std::uint32_t result;
+        unsigned raised;
+        unsigned x87Raised;
+        int error;
+    } cases[] = {
+        {0x00000000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0x80000000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0x3f000000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0x3f7fffffu, 0xffc00000u, 1u, 1u, EDOM},
+        {0xbf800000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0xff800000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0xffc00001u, 0xffc00001u, 1u, 1u, EDOM},
+        {0xff800001u, 0xffc00001u, 1u, 1u, EDOM},
+        {0x3f800000u, 0x00000000u, 0u, 0u, 1234},
+        {0x7f800000u, 0x7f800000u, 0u, 0u, 1234},
+        {0x7fc00001u, 0x7fc00001u, 0u, 0u, 1234},
+        {0x7f800001u, 0x7fc00001u, 1u, 0u, 1234},
+    };
+    const int rounding[] = {FE_TONEAREST, FE_DOWNWARD, FE_UPWARD, FE_TOWARDZERO};
+    float (APS5_VABI * volatile call)(float) = acoshf_nid_postfix;
+    for (unsigned mode = 0; mode != 4; ++mode) {
+        for (unsigned denorm = 0; denorm != 4; ++denorm) {
+            const unsigned control = 0x1f80u | (mode << 13u) | ((denorm & 1u) ? 0x40u : 0u) | ((denorm & 2u) ? 0x8000u : 0u);
+            for (std::uint16_t sticky : {0u, 5u, 32u}) {
+                for (const auto& item : cases) {
+                    Require(std::fesetenv(FE_DFL_ENV) == 0 && std::fesetround(rounding[mode]) == 0);
+                    Require(fesetexceptflag_nid_postfix(&sticky, 0x3f) == 0);
+                    _mm_setcsr(control | sticky);
+                    GuestFloatingPointEnvironment before;
+                    Require(fegetenv_nid_postfix(&before) == 0 && (before.status & 0x3fu) == sticky);
+                    errno = 1234;
+                    const auto result = std::bit_cast<std::uint32_t>(call(std::bit_cast<float>(item.input)));
+                    const int error = errno;
+                    GuestFloatingPointEnvironment after;
+                    Require(fegetenv_nid_postfix(&after) == 0);
+                    if (result != item.result || after.mxcsr != (control | sticky | item.raised) || (after.status & 0x3fu) != (sticky | item.x87Raised) || after.control != before.control || error != item.error) {
+                        std::fprintf(stderr, "acoshf domain: input=%08llx mode=%u denorm=%u sticky=%u bits=%08llx csr=%x x87=%x errno=%d\n", static_cast<unsigned long long>(item.input), mode, denorm, sticky, static_cast<unsigned long long>(result), after.mxcsr, after.status, error);
+                        Require(false);
+                    }
+                }
+            }
+        }
+    }
+    _mm_setcsr(savedCsr);
+}
+
+static void CheckAcoshfMsunBoundaries() {
+    Require(acoshf_nid_postfix(1.0f) == 0.0f && !std::signbit(acoshf_nid_postfix(1.0f)));
+    errno = EINTR;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    Require(std::isnan(acoshf_nid_postfix(0.5f)) && errno == EDOM && (std::fetestexcept(FE_INVALID) & FE_INVALID) != 0);
+    for (const std::uint32_t bits : {0x3f800001u, 0x3fffffffu, 0x40000000u, 0x40000001u,
+                                     0x4d7fffffu, 0x4d800000u, 0x4d800001u, 0x7f7fffffu}) {
+        const float x = std::bit_cast<float>(bits);
+        Require(Near(acoshf_nid_postfix(x), std::acosh(static_cast<double>(x)), 1e-6));
+    }
+    Require(std::isinf(acoshf_nid_postfix(INFINITY)) && acoshf_nid_postfix(INFINITY) > 0.0f);
+    Require(std::isnan(acoshf_nid_postfix(-INFINITY)));
+    Require(std::isnan(acoshf_nid_postfix(std::numeric_limits<float>::quiet_NaN())));
+    const RestoreFloatingPointState saved;
+    const unsigned savedCsr = _mm_getcsr();
+    const struct {
+        std::uint32_t input;
+        std::uint32_t result[4];
+        unsigned raised;
+    } cases[] = {
+        {0x3f800000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, 0u},
+        {0x3f800001u, {0x39ffffffu, 0x39ffffffu, 0x3a000001u, 0x39ffffffu}, 32u},
+        {0x3fffffffu, {0x3fa89213u, 0x3fa89212u, 0x3fa89214u, 0x3fa89212u}, 32u},
+        {0x40000000u, {0x3fa89214u, 0x3fa89213u, 0x3fa89214u, 0x3fa89213u}, 32u},
+        {0x40000001u, {0x3fa89215u, 0x3fa89214u, 0x3fa89215u, 0x3fa89214u}, 32u},
+        {0x40000002u, {0x3fa89216u, 0x3fa89215u, 0x3fa89217u, 0x3fa89215u}, 32u},
+        {0x40000003u, {0x3fa89217u, 0x3fa89217u, 0x3fa89218u, 0x3fa89217u}, 32u},
+        {0x4d7fffffu, {0x41a0cf66u, 0x41a0cf65u, 0x41a0cf66u, 0x41a0cf65u}, 32u},
+        {0x4d800000u, {0x41a0cf66u, 0x41a0cf64u, 0x41a0cf66u, 0x41a0cf64u}, 32u},
+        {0x4d800001u, {0x41a0cf66u, 0x41a0cf65u, 0x41a0cf67u, 0x41a0cf65u}, 32u},
+        {0x4d8050f2u, {0x41a0d473u, 0x41a0d472u, 0x41a0d474u, 0x41a0d472u}, 32u},
+        {0x7f7fffffu, {0x42b2d4fcu, 0x42b2d4fbu, 0x42b2d4fdu, 0x42b2d4fbu}, 32u},
+    };
+    const int rounding[] = {FE_TONEAREST, FE_DOWNWARD, FE_UPWARD, FE_TOWARDZERO};
+    float (APS5_VABI * volatile call)(float) = acoshf_nid_postfix;
+    for (unsigned mode = 0; mode != 4; ++mode) {
+        for (unsigned denorm = 0; denorm != 4; ++denorm) {
+            const unsigned control = 0x1f80u | (mode << 13u) | ((denorm & 1u) ? 0x40u : 0u) | ((denorm & 2u) ? 0x8000u : 0u);
+            for (std::uint16_t sticky : {0u, 5u, 32u}) {
+                for (const auto& item : cases) {
+                    Require(std::fesetenv(FE_DFL_ENV) == 0 && std::fesetround(rounding[mode]) == 0);
+                    Require(fesetexceptflag_nid_postfix(&sticky, 0x3f) == 0);
+                    _mm_setcsr(control | sticky);
+                    GuestFloatingPointEnvironment before;
+                    Require(fegetenv_nid_postfix(&before) == 0 && (before.status & 0x3fu) == sticky);
+                    errno = 1234;
+                    const auto result = std::bit_cast<std::uint32_t>(call(std::bit_cast<float>(item.input)));
+                    const int error = errno;
+                    GuestFloatingPointEnvironment after;
+                    Require(fegetenv_nid_postfix(&after) == 0);
+                    if (result != item.result[mode] || after.mxcsr != (control | sticky | item.raised) || (after.status & 0x3fu) != sticky || after.control != before.control || error != 1234) {
+                        std::fprintf(stderr, "acoshf positive: input=%08llx mode=%u denorm=%u sticky=%u bits=%08llx expected=%08llx csr=%x x87=%x errno=%d\n", static_cast<unsigned long long>(item.input), mode, denorm, sticky, static_cast<unsigned long long>(result), static_cast<unsigned long long>(item.result[mode]), after.mxcsr, after.status, error);
+                        Require(false);
+                    }
+                }
+            }
+        }
+    }
+    _mm_setcsr(savedCsr);
+
+}
+
+static void CheckCoshfMsunBoundaries() {
+    static constexpr struct {
+        std::uint32_t input;
+        std::uint32_t output;
+    } cases[] = {
+        {0x00000000u, 0x3f800000u},
+        {0x80000000u, 0x3f800000u},
+        {0x00000001u, 0x3f800000u},
+        {0x397fffffu, 0x3f800000u},
+        {0x39800000u, 0x3f800000u},
+        {0x3eb17217u, 0x3f87c3b6u},
+        {0x3eb17218u, 0x3f87c3b6u},
+        {0x3f800000u, 0x3fc583aau},
+        {0xbf800000u, 0x3fc583aau},
+        {0x410fffffu, 0x457d389cu},
+        {0x41100000u, 0x457d38acu},
+        {0x42b17216u, 0x7effff04u},
+        {0x42b17217u, 0x7effff84u},
+        {0x42b17218u, 0x7f000002u},
+        {0x42b2d4fbu, 0x7f7fff6cu},
+        {0x42b2d4fcu, 0x7f7fffecu},
+        {0xc2b2d4fcu, 0x7f7fffecu},
+    };
+    for (const auto& test : cases)
+        Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(std::bit_cast<float>(test.input))) == test.output);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(std::bit_cast<float>(0x42b2d4fdu))) == 0x7f800000u);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(INFINITY)) == 0x7f800000u);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(-INFINITY)) == 0x7f800000u);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(std::bit_cast<float>(0x7fc12345u))) == 0x7fc12345u);
+}
+
 static void CheckScaledHyperbolic() {
     const int rounding = std::fegetround();
     Require(std::fesetround(FE_TONEAREST) == 0);
@@ -1058,6 +1358,26 @@ static void RequireBytes(const void* constant, std::initializer_list<unsigned ch
     while (index < 16) Require(bytes[index++] == 0);
 }
 
+static void CheckLogfConsoleBits() {
+    constexpr struct {
+        std::uint32_t input;
+        std::uint32_t expected;
+        int error;
+    } cases[] = {
+        {0x00000983u, 0xc2bef664u, 0}, {0x3e003791u, 0xc004f9cfu, 0}, {0x3f7f0a10u, 0xbb76666fu, 0}, {0x3f81086bu, 0x3c03adacu, 0},
+        {0x40400de0u, 0x3f8ca894u, 0}, {0x5f00a041u, 0x422eb14eu, 0}, {0x3f800000u, 0x00000000u, 0}, {0x40000000u, 0x3f317218u, 0},
+        {0x00000001u, 0xc2ce8ed0u, 0}, {0x00800000u, 0xc2aeac50u, 0}, {0x7f7fffffu, 0x42b17218u, 0}, {0x7f800000u, 0x7f800000u, 0},
+        {0x3f800001u, 0x33ffffffu, 0}, {0x3f7fffffu, 0xb3800000u, 0}, {0x7fc00001u, 0x7fc00001u, 0},
+        {0x00000000u, 0xff800000u, ERANGE}, {0x80000000u, 0xff800000u, ERANGE}, {0x80000001u, 0xffc00000u, EDOM},
+        {0xbf800000u, 0xffc00000u, EDOM}, {0xff800000u, 0xffc00000u, EDOM}, {0xffc00002u, 0xffc00002u, EDOM},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(logf_nid_postfix(std::bit_cast<float>(item.input))) == item.expected);
+        Require(errno == (item.error != 0 ? item.error : 1234));
+    }
+}
+
 static void CheckDinkumwareConstants() {
     RequireBytes(&_Inf_nid_postfix, {0, 0, 0, 0, 0, 0, 0xf0, 0x7f});
     RequireBytes(&_Denorm_nid_postfix, {1});
@@ -1146,6 +1466,53 @@ static bool Near(long double actual, long double expected) {
     return std::fabs(actual - expected) <= std::fabs(expected) * 1e-17L;
 }
 
+static void CheckAcosfMsun() {
+    Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(std::bit_cast<float>(0x3d58d031u))) == 0x3fc2488au);
+    Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(std::bit_cast<float>(0x3f00b99au))) == 0x3f859f4fu);
+    Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(std::bit_cast<float>(0xbf00b99au))) == 0x40064033u);
+    Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(1.0f)) == 0u);
+    Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(-1.0f)) == 0x40490fdbu);
+    Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(std::bit_cast<float>(0x32800000u))) == 0x3fc90fdbu);
+}
+
+static void CheckLongDoubleHyperbolic() {
+    const long double infinity = std::numeric_limits<long double>::infinity();
+    const long double nan = std::numeric_limits<long double>::quiet_NaN();
+    Require(_LCosh_nid_postfix(0.0L, 2.0L) == 2.0L);
+    Require(Near(_LCosh_nid_postfix(1.0L, 2.0L), 3.08616126963048755696L));
+    Require(Near(_LCosh_nid_postfix(-1.0L, -2.0L), -3.08616126963048755696L));
+    Require(std::isinf(_LCosh_nid_postfix(infinity, -1.0L)) && std::signbit(_LCosh_nid_postfix(infinity, -1.0L)));
+    Require(std::isnan(_LCosh_nid_postfix(infinity, 0.0L)));
+    Require(std::isnan(_LCosh_nid_postfix(nan, 1.0L)));
+    Require(_LCosh_nid_postfix(720.0L, 0.0L) == 0.0L && !std::signbit(_LCosh_nid_postfix(720.0L, 0.0L)));
+    Require(_LCosh_nid_postfix(720.0L, -0.0L) == 0.0L && std::signbit(_LCosh_nid_postfix(720.0L, -0.0L)));
+    Require(Near(_LCosh_nid_postfix(11357.0L, 0x1p-16000L), 0xc.e2773666cc8cc68p+380L));
+    Require(Near(_LCosh_nid_postfix(-11357.0L, 0x1p-16000L), 0xc.e2773666cc8cc68p+380L));
+    Require(Near(_LCosh_nid_postfix(11360.0L, 0x1p-16384L), 0x8.165ba1f5c0ff231p+1L));
+    Require(std::isinf(_LCosh_nid_postfix(11360.0L, 1.0L)));
+    Require(_LSinh_nid_postfix(0.0L, 2.0L) == 0.0L && !std::signbit(_LSinh_nid_postfix(0.0L, 2.0L)));
+    Require(_LSinh_nid_postfix(0.0L, -2.0L) == 0.0L && std::signbit(_LSinh_nid_postfix(0.0L, -2.0L)));
+    Require(Near(_LSinh_nid_postfix(1.0L, 2.0L), 2.35040238728760291376L));
+    Require(Near(_LSinh_nid_postfix(-1.0L, -2.0L), 2.35040238728760291376L));
+    Require(Near(_LSinh_nid_postfix(1.0L, -2.0L), -2.35040238728760291376L));
+    Require(std::isinf(_LSinh_nid_postfix(infinity, -1.0L)) && std::signbit(_LSinh_nid_postfix(infinity, -1.0L)));
+    Require(std::isinf(_LSinh_nid_postfix(-infinity, -1.0L)) && !std::signbit(_LSinh_nid_postfix(-infinity, -1.0L)));
+    Require(std::isnan(_LSinh_nid_postfix(infinity, 0.0L)));
+    Require(std::isnan(_LSinh_nid_postfix(nan, 1.0L)));
+    Require(_LSinh_nid_postfix(720.0L, 0.0L) == 0.0L && !std::signbit(_LSinh_nid_postfix(720.0L, 0.0L)));
+    Require(_LSinh_nid_postfix(720.0L, -0.0L) == 0.0L && std::signbit(_LSinh_nid_postfix(720.0L, -0.0L)));
+    Require(_LSinh_nid_postfix(-720.0L, 0.0L) == 0.0L && std::signbit(_LSinh_nid_postfix(-720.0L, 0.0L)));
+    Require(_LSinh_nid_postfix(-720.0L, -0.0L) == 0.0L && !std::signbit(_LSinh_nid_postfix(-720.0L, -0.0L)));
+    Require(Near(_LSinh_nid_postfix(11357.0L, 0x1p-16000L), 0xc.e2773666cc8cc68p+380L));
+    Require(Near(_LSinh_nid_postfix(-11357.0L, 0x1p-16000L), -0xc.e2773666cc8cc68p+380L));
+    Require(Near(_LSinh_nid_postfix(11357.0L, -0x1p-16000L), -0xc.e2773666cc8cc68p+380L));
+    Require(Near(_LSinh_nid_postfix(-11357.0L, -0x1p-16000L), 0xc.e2773666cc8cc68p+380L));
+    Require(Near(_LSinh_nid_postfix(11360.0L, 0x1p-16384L), 0x8.165ba1f5c0ff231p+1L));
+    Require(Near(_LSinh_nid_postfix(-11360.0L, 0x1p-16384L), -0x8.165ba1f5c0ff231p+1L));
+    Require(std::isinf(_LSinh_nid_postfix(11360.0L, 1.0L)));
+    Require(std::isinf(_LSinh_nid_postfix(-11360.0L, 1.0L)) && std::signbit(_LSinh_nid_postfix(-11360.0L, 1.0L)));
+}
+
 static void CheckLongDoubleFunctions() {
     const long double infinity = std::numeric_limits<long double>::infinity();
     const long double nan = std::numeric_limits<long double>::quiet_NaN();
@@ -1236,17 +1603,31 @@ static void CheckLongDoubleRounding(long double value, std::int64_t expected, bo
     }
 }
 
-static void CheckNoConversionIsPositiveZero() {
-    for (const char* text : {"", " ", "-", "+", "-.", "+.", "-x", "-.e1", "-e5", "- 1", "  -."}) {
+static void CheckNoConversionZero() {
+    for (const char* text : {"", " ", "-", " -", "+", "-.", "+.", "-x", "-.e1", "-e5", "- 1", "  -."}) {
         char* end = nullptr;
         const double parsed = strtod_nid_postfix(text, &end);
         Require(parsed == 0. && !std::signbit(parsed) && end == text);
+        const bool negative = std::strchr(text, '-') != nullptr;
+        const bool loneSign = negative && text[std::strlen(text) - 1] == '-';
         const float parsedFloat = strtof_nid_postfix(text, &end);
-        Require(parsedFloat == 0.f && !std::signbit(parsedFloat) && end == text);
+        Require(parsedFloat == 0.f && std::signbit(parsedFloat) == (negative && !loneSign) && end == text);
         const long double parsedLong = strtold_nid_postfix(text, &end);
-        Require(parsedLong == 0.L && !std::signbit(parsedLong) && end == text);
+        Require(parsedLong == 0.L && std::signbit(parsedLong) == negative && end == text);
         Require(!std::signbit(atof_nid_postfix(text)));
     }
+    for (const char* text : {"-i", "-in", "-N", "-nax"}) {
+        char* end = nullptr;
+        const float parsedFloat = strtof_nid_postfix(text, &end);
+        Require(parsedFloat == 0.f && std::signbit(parsedFloat) && end == text);
+        Require(!std::signbit(strtold_nid_postfix(text, nullptr)));
+    }
+    for (const char* text : {"-nan", "-NAN", " -nan(5)"}) {
+        char* end = nullptr;
+        const float parsedFloat = strtof_nid_postfix(text, &end);
+        Require(std::bit_cast<std::uint32_t>(parsedFloat) == 0xffc00000u && end == text + std::strlen(text));
+    }
+    Require(std::bit_cast<std::uint32_t>(strtof_nid_postfix("nan", nullptr)) == 0x7fc00000u);
     char* end = nullptr;
     const char negativeZero[] = "-0.0x";
     const double parsed = strtod_nid_postfix(negativeZero, &end);
@@ -1271,9 +1652,9 @@ static void CheckNoConversionIsPositiveZero() {
     const double parsedWide = wcstod_nid_postfix(wide, &wideEnd);
     Require(parsedWide == 0. && !std::signbit(parsedWide) && wideEnd == wide);
     const float parsedWideFloat = wcstof_nid_postfix(wide, &wideEnd);
-    Require(parsedWideFloat == 0.f && !std::signbit(parsedWideFloat) && wideEnd == wide);
+    Require(parsedWideFloat == 0.f && std::signbit(parsedWideFloat) && wideEnd == wide);
     const long double parsedWideLong = wcstold_nid_postfix(wide, &wideEnd);
-    Require(parsedWideLong == 0.L && !std::signbit(parsedWideLong) && wideEnd == wide);
+    Require(parsedWideLong == 0.L && std::signbit(parsedWideLong) && wideEnd == wide);
 }
 
 template<typename TValue, std::size_t TBytes>
@@ -1305,11 +1686,13 @@ static void CheckDinkumwareFloatCharacteristics() {
 int main() {
     CheckFloatClassification();
     CheckDinkumwareConstants();
-    CheckNoConversionIsPositiveZero();
+    CheckNoConversionZero();
     CheckMissingClassificationExports();
     CheckFloatMathExports();
     CheckIntegerConversions();
+    CheckCbrtfConsoleBits();
     CheckExtendedMath();
+    CheckTrigfConsoleBits();
     Require(atof_nid_postfix(" -12.5tail") == -12.5);
     char* end = nullptr;
     const char input[] = "0x1.8p+2 remainder";
@@ -1349,6 +1732,7 @@ int main() {
     Require(rand_r_nid_postfix(&randomState) == 16806 && randomState == 16806u);
     for (const unsigned int seed : {0u, 1u, 12345u, 0x7ffffffeu, 0xffffffffu}) {
         srand_nid_postfix(seed);
+
         randomState = seed;
         for (int step = 0; step < 8; ++step) Require(rand_r_nid_postfix(&randomState) == rand_nid_postfix());
     }
@@ -1415,6 +1799,7 @@ int main() {
     const auto gammaSign = [](double x) {
         signgam_nid_postfix = 7;
         lgamma_nid_postfix(x);
+
         return signgam_nid_postfix;
     };
     Require(gammaSign(0.5) == 1 && gammaSign(10.) == 1 && gammaSign(0.) == 1 && gammaSign(-0.) == -1);
@@ -1464,6 +1849,11 @@ int main() {
     CheckFegetenv();
     CheckLongDouble();
     CheckNearbyintl();
+    CheckExpm1ConsoleBits();
+    CheckLog1pConsoleBits();
+    CheckNextafterConsoleBits();
+    CheckTanhConsoleBits();
+    CheckRoundingNaNConsoleBits();
     CheckAsinl();
     Require(scalbn_nid_postfix(0.75, -2) == 0.1875);
     Require(scalbnf_nid_postfix(0.75f, 4) == 12.f);
@@ -1551,6 +1941,7 @@ int main() {
     CheckPowfSpecialValue();
     Require(abs_nid_postfix(0) == 0);
     CheckAcosfErrno();
+    CheckAcosfMsun();
     Require(abs_nid_postfix(42) == 42);
     Require(abs_nid_postfix(-42) == 42);
     Require(abs_nid_postfix(std::numeric_limits<int>::max()) == std::numeric_limits<int>::max());
@@ -1586,15 +1977,23 @@ int main() {
     Require(std::isinf(__powidf2_nid_postfix(-0.0, -3)) && std::signbit(__powidf2_nid_postfix(-0.0, -3)));
     Require(__powidf2_nid_postfix(2.0, -127) == 0x1p-127);
     CheckHyperbolic();
+    CheckAcoshfDomainEnvironment();
+    CheckAcoshfMsunBoundaries();
+    CheckCoshfMsunBoundaries();
+    CheckExp2fConsoleBits();
     CheckScaledHyperbolic();
     CheckSinhf();
     CheckAtanhf();
+    CheckLogfConsoleBits();
     CheckHypotSpecialValue();
+    CheckAtanfConsoleBits();
     CheckFloatUnderflowErrno();
     CheckFmodErrno();
+    CheckFmodfErrno();
     CheckDoubleClassification();
     CheckIntegerAbsAndDivision();
     CheckScaling();
     CheckLongDoubleFunctions();
+    CheckLongDoubleHyperbolic();
     CheckDinkumwareFloatCharacteristics();
 }
diff --git a/core/libs/tests/GuestMathExact.cpp b/core/libs/tests/GuestMathExact.cpp
index e601e88973..5db64f610d 100644
--- a/core/libs/tests/GuestMathExact.cpp
+++ b/core/libs/tests/GuestMathExact.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
 #include <cfenv>
@@ -7,38 +8,9 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-long double APS5_VABI fdiml_nid_postfix(long double, long double);
-long double APS5_VABI fmodl_nid_postfix(long double, long double);
-long double APS5_VABI remquol_nid_postfix(long double, long double, int*);
-int APS5_VABI ilogbl_nid_postfix(long double);
-long double APS5_VABI roundl_nid_postfix(long double);
-long double APS5_VABI modfl_nid_postfix(long double, long double*);
-long double APS5_VABI nanl_nid_postfix(const char*);
-long double APS5_VABI scalblnl_nid_postfix(long double, std::int64_t);
-long double APS5_VABI fmal_nid_postfix(long double, long double, long double);
-double APS5_VABI scalb_nid_postfix(double, double);
-double APS5_VABI scalbln_nid_postfix(double, std::int64_t);
-long double APS5_VABI remainderl_nid_postfix(long double, long double);
-double APS5_VABI drem_nid_postfix(double, double);
-float APS5_VABI dremf_nid_postfix(float, float);
-std::int64_t APS5_VABI lrint_nid_postfix(double);
-double APS5_VABI rint_nid_postfix(double);
-float APS5_VABI rintf_nid_postfix(float);
-long double APS5_VABI rintl_nid_postfix(long double);
-long long APS5_VABI llrint_nid_postfix(double);
-int APS5_VABI finite_nid_postfix(double);
-int APS5_VABI __fpclassifyl_nid_postfix(long double);
-int APS5_VABI __isnanl_nid_postfix(long double);
-int APS5_VABI __isnormall_nid_postfix(long double);
-short APS5_VABI _LDtest_nid_postfix(const long double*);
-int APS5_VABI _Dclass_nid_postfix(double);
-short APS5_VABI _LDsign_nid_postfix(long double);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
-static long double Extended(std::uint16_t signExponent, std::uint64_t mantissa) {
+[[gnu::noinline]] static long double Extended(std::uint16_t signExponent, std::uint64_t mantissa) {
     long double value = 0;
     unsigned char bytes[sizeof(long double)] = {};
     std::memcpy(bytes, &mantissa, sizeof(mantissa));
@@ -49,6 +21,40 @@ static long double Extended(std::uint16_t signExponent, std::uint64_t mantissa)
 
 static bool SameBits(long double left, long double right) { return std::memcmp(&left, &right, 10) == 0; }
 
+static void CheckRoundingAndScaling() {
+    Require(copysignl_nid_postfix(3.0L, -1.0L) == -3.0L && copysignl_nid_postfix(-3.0L, 0.0L) == 3.0L);
+    Require(std::signbit(copysignl_nid_postfix(0.0L, -0.0L)) && !std::signbit(copysignl_nid_postfix(-0.0L, 2.0L)));
+    Require(sqrtl_nid_postfix(6.25L) == 2.5L && std::isnan(sqrtl_nid_postfix(-1.0L)));
+    Require(sqrtl_nid_postfix(-0.0L) == 0.0L && std::signbit(sqrtl_nid_postfix(-0.0L)));
+
+    const int saved = std::fegetround();
+    const struct {
+        int mode;
+        long long half;
+        long long negativeHalf;
+    } modes[] = {{FE_TONEAREST, 2, -2}, {FE_UPWARD, 3, -2}, {FE_DOWNWARD, 2, -3}, {FE_TOWARDZERO, 2, -2}};
+    for (const auto& mode : modes) {
+        Require(std::fesetround(mode.mode) == 0);
+        errno = 0;
+        Require(lrintl_nid_postfix(2.5L) == mode.half && lrintl_nid_postfix(-2.5L) == mode.negativeHalf);
+        Require(llrintl_nid_postfix(2.5L) == mode.half && llrintl_nid_postfix(-2.5L) == mode.negativeHalf);
+        Require(lrintf_nid_postfix(2.5f) == mode.half && lrintf_nid_postfix(-2.5f) == mode.negativeHalf);
+        Require(llrintf_nid_postfix(2.5f) == mode.half && llrintf_nid_postfix(-2.5f) == mode.negativeHalf);
+        Require(errno == 0);
+    }
+    std::fesetround(saved);
+    Require(llrintl_nid_postfix(3.5L) == 4 && lrintf_nid_postfix(16777216.0f) == 16777216);
+
+    Require(scalbf_nid_postfix(1.5f, 3.0f) == 12.0f && scalbf_nid_postfix(12.0f, -2.0f) == 3.0f);
+    Require(std::isnan(scalbf_nid_postfix(1.0f, 0.5f)) && std::isnan(scalbf_nid_postfix(NAN, 1.0f)));
+    Require(std::isinf(scalbf_nid_postfix(1.0f, INFINITY)) && scalbf_nid_postfix(8.0f, -INFINITY) == 0.0f);
+    Require(scalblnf_nid_postfix(1.0f, 10) == 1024.0f && scalblnf_nid_postfix(1024.0f, -10) == 1.0f);
+    Require(std::isinf(scalblnf_nid_postfix(1.0f, INT64_MAX)) && scalblnf_nid_postfix(1.0f, INT64_MIN) == 0.0f);
+
+    Require(__isinfl_nid_postfix(static_cast<long double>(INFINITY)) == 1 && __isinfl_nid_postfix(-static_cast<long double>(INFINITY)) == 1);
+    Require(__isinfl_nid_postfix(1.0L) == 0 && __isinfl_nid_postfix(static_cast<long double>(NAN)) == 0 && __isinfl_nid_postfix(0.0L) == 0);
+}
+
 static void CheckSignalingNanPassThrough() {
     const long double signaling = Extended(0x7fff, 0x8000000000001234ull);
     Require(SameBits(fdiml_nid_postfix(signaling, 1.0L), signaling));
@@ -70,6 +76,7 @@ static void CheckErrno() {
     Require(std::isnan(remquol_nid_postfix(1.0L, 0.0L, &quotient)) && errno == EDOM);
     errno = 0;
     remquol_nid_postfix(NAN, 0.0L, &quotient);
+
     Require(errno == 0);
     Require(remquol_nid_postfix(-7.0L, 2.0L, &quotient) == 1.0L && quotient == -4);
     errno = 0;
@@ -133,6 +140,7 @@ static void CheckClassification() {
 }
 
 int main() {
+    CheckRoundingAndScaling();
     CheckSignalingNanPassThrough();
     CheckErrno();
     CheckConsoleQuirks();
diff --git a/core/libs/tests/GuestMbus.cpp b/core/libs/tests/GuestMbus.cpp
index e867068157..29ef46dc7e 100644
--- a/core/libs/tests/GuestMbus.cpp
+++ b/core/libs/tests/GuestMbus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMbus/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,26 +7,6 @@
 #include <cstdlib>
 #include <stdexcept>
 
-struct DeviceServiceThreadParam;
-struct DeviceServiceInitParam {
-    std::uint32_t size;
-    std::uint32_t reserved;
-    const DeviceServiceThreadParam* threadParam;
-};
-struct DeviceServiceUsageFilter {
-    std::uint16_t usagePage;
-    std::uint16_t minimumUsage;
-    std::uint16_t maximumUsage;
-};
-
-extern "C" {
-std::int32_t APS5_VABI sceDeviceServiceInitialize(std::int32_t mode, const DeviceServiceInitParam* param);
-std::int32_t APS5_VABI sceDeviceServiceTerminate();
-std::int32_t APS5_VABI sceDeviceServiceGetEventState(std::int32_t clear);
-std::int32_t APS5_VABI sceDeviceServiceQueryDeviceInfo_(std::int32_t deviceClass, const DeviceServiceUsageFilter* filter, std::int32_t arg2, void* infos, std::int32_t maxInfos, std::int32_t* count, std::int32_t* reserved, std::uint32_t infoSize);
-std::int32_t APS5_VABI sceDeviceServiceGetGeneration();
-}
-
 namespace {
 
 void Require(bool condition, const char* message) {
@@ -45,6 +26,11 @@ int main() {
     param.reserved = 1;
     Require(sceDeviceServiceInitialize(3, &param) == invalidArgument, "reserved field accepted");
     param.reserved = 0;
+    DeviceServiceThreadParam threadParam{};
+    threadParam.reserved = 1;
+    param.threadParam = &threadParam;
+    Require(sceDeviceServiceInitialize(3, &param) == invalidArgument, "threadParam reserved field accepted");
+    param.threadParam = nullptr;
     Require(sceDeviceServiceInitialize(3, &param) == 0, "default parameter initialization failed");
     Require(sceDeviceServiceInitialize(3, 0) == 0, "initialization failed");
     Require(sceDeviceServiceGetGeneration() == 0, "the device set started at another generation");
diff --git a/core/libs/tests/GuestMemory.cpp b/core/libs/tests/GuestMemory.cpp
index d03a35de70..f31f21accc 100644
--- a/core/libs/tests/GuestMemory.cpp
+++ b/core/libs/tests/GuestMemory.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
@@ -42,55 +45,6 @@
 #include <io.h>
 #endif
 
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI sceKernelMmap(void*, std::size_t, int, int, int, std::int64_t, void**);
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-int APS5_VABI madvise_nid_postfix(void*, std::size_t, int);
-int APS5_VABI mincore_nid_postfix(const void*, std::size_t, char*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelMapNamedFlexibleMemory(void**, std::size_t, int, int, const char*);
-int APS5_VABI sceKernelMapNamedFlexibleMemoryInternal(void**, std::size_t, int, int, const char*);
-int APS5_VABI sceKernelAvailableFlexibleMemorySize(std::size_t*);
-int APS5_VABI sceKernelInternalMemoryGetAvailableSize(std::size_t*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelReleaseFlexibleMemory(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMtypeprotect(const void*, std::size_t, int, int);
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry*, int, int*, int);
-int APS5_VABI sceKernelMemoryPoolBatch(const KernelMemoryPoolBatchEntry*, int, int*, int);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
-int APS5_VABI sceKernelSetVirtualRangeName(const void*, std::uint64_t, const char*);
-int APS5_VABI sceKernelClearVirtualRangeName(const void*, std::uint64_t);
-int APS5_VABI sceKernelGetPageTableStats(int*, int*, int*, int*);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelEnableDmemAliasing();
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelAvailableDirectMemorySize(std::int64_t, std::int64_t, std::size_t, std::int64_t*, std::size_t*);
-int APS5_VABI sceKernelCheckedReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMemoryPoolReserve(void*, std::size_t, std::size_t, int, void**);
-int APS5_VABI sceKernelMemoryPoolCommit(void*, std::size_t, int, int, int);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelAioInitializeImpl(void*, std::int32_t);
-int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest*, std::int32_t, std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelAioWaitRequest(std::int32_t, std::int32_t*, std::uint32_t*);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelMlock_nid_postfix(void*, std::uint64_t);
-int APS5_VABI sceKernelGetDirectMemoryType(std::int64_t, int*, std::int64_t*, std::int64_t*);
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry*, int, int*, int);
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Guest memory check failed at %s:%u\n", location.file_name(), static_cast<unsigned>(location.line()));
@@ -113,12 +67,33 @@ static void CheckReleaseFlexibleMemory() {
     Require(sceKernelMapFlexibleMemory(&mapped, length, 3, 0) == 0 && mapped != nullptr);
     static_cast<volatile unsigned char*>(mapped)[length - 1] = 1;
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
+    auto* bytes = static_cast<volatile unsigned char*>(mapped);
+    Require(sceKernelMprotect(mapped, 0x4000, 1) == 0);
     Require(sceKernelReleaseFlexibleMemory(mapped, length) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
+    VirtualQueryInfo info{};
+    Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) == 0 && info.protection == 1);
+    Require(sceKernelVirtualQuery(static_cast<unsigned char*>(mapped) + length - 1, 0, &info, sizeof(info)) == 0 && info.protection == 3);
+    Require(bytes[length - 1] == 1);
+    bytes[length - 2] = 2;
+    Require(sceKernelReleaseFlexibleMemory(mapped, length) == 0);
+    Require(sceKernelReleaseFlexibleMemory(mapped, 0) == 0);
+    Require(sceKernelReleaseFlexibleMemory(reinterpret_cast<void*>(std::uintptr_t{0x7ff000000000}), length) == 0);
+    Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
+    Require(sceKernelReleaseFlexibleMemory(nullptr, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(static_cast<unsigned char*>(mapped) + 1, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(mapped, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(static_cast<unsigned char*>(mapped) + 0x1000, 0x4000) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(mapped, 0x6000) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(reinterpret_cast<void*>(~std::uintptr_t{0x3fff}), 0x8000) == SCE_KERNEL_ERROR_EINVAL);
     void* again = mapped;
-    Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x90) == 0 && again == mapped);
+    Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x90) == SCE_KERNEL_ERROR_ENOMEM);
+    Require(bytes[length - 1] == 1 && bytes[length - 2] == 2);
+    again = mapped;
+    Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x10) == 0 && again == mapped);
     Require(static_cast<volatile unsigned char*>(again)[length - 1] == 0);
-    Require(sceKernelMunmap(again, length) == 0);
+    Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), length) == 0);
 }
 
 static void CheckFlexibleMappingIgnoresFlag8000() {
@@ -130,11 +105,11 @@ static void CheckFlexibleMappingIgnoresFlag8000() {
     Require(sceKernelMapFlexibleMemory(&mapped, length, 3, 0x8000) == 0 && mapped != nullptr);
     static_cast<volatile unsigned char*>(mapped)[length - 1] = 1;
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
     void* again = mapped;
     Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x8090) == 0 && again == mapped);
     Require(static_cast<volatile unsigned char*>(again)[length - 1] == 0);
-    Require(sceKernelMunmap(again, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), length) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
     bool rejected = false;
     void* unknown = nullptr;
@@ -160,6 +135,7 @@ static void CheckInternalMemoryAvailableSize() {
     bool threw = false;
     try {
         sceKernelInternalMemoryGetAvailableSize(&available);
+
     } catch (const std::logic_error&) {
         threw = true;
     }
@@ -186,13 +162,13 @@ static void CheckNamedAndHintedMappings() {
     void* overwrite = first;
     Require(sceKernelMapFlexibleMemory(&overwrite, 0x4000, 3, 0x90) == static_cast<int>(0x8002000cu));
     Require(overwrite == first);
-    Require(sceKernelMunmap(hinted, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(hinted), length) == 0);
     void* exclusive = hinted;
     Require(sceKernelMapFlexibleMemory(&exclusive, length, 3, 0x90) == 0);
     Require(exclusive == hinted);
     static_cast<volatile unsigned char*>(exclusive)[0] = 1;
-    Require(sceKernelMunmap(exclusive, length) == 0);
-    Require(sceKernelMunmap(first, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(exclusive), length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), length) == 0);
 }
 
 static void CheckAudioCoprocessorProtection() {
@@ -205,7 +181,7 @@ static void CheckAudioCoprocessorProtection() {
     Require(static_cast<volatile unsigned char*>(writable)[length - 1] == 7);
     Require(sceKernelMprotect(writable, length, 0x3f2) == 0);
     static_cast<volatile unsigned char*>(writable)[0] = 9;
-    Require(sceKernelMunmap(writable, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(writable), length) == 0);
     bool rejected = false;
     void* undefined = nullptr;
     try { sceKernelMapFlexibleMemory(&undefined, length, 0x400, 0); } catch (const std::invalid_argument&) { rejected = true; }
@@ -241,7 +217,7 @@ static void CheckMprotectIgnoresUndefinedBits() {
         for (const auto undefined : {0u, 8u, 0x400u, 0x80000000u, 0xfffffc08u})
             check(mapping, static_cast<int>(static_cast<std::uint32_t>(protection) | undefined));
     }
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     std::int64_t physical = 0;
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, length, 0, 0, &physical) == 0);
     mapping = nullptr;
@@ -251,7 +227,7 @@ static void CheckMprotectIgnoresUndefinedBits() {
     check(mapping, 0x100);
     check(mapping, 0x200);
     check(mapping, 0x3f7);
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     Require(sceKernelReleaseDirectMemory(physical, length) == 0);
 }
 
@@ -289,7 +265,7 @@ static void CheckStrictMemoryProtectionBits() {
         Require(sceKernelGetDirectMemoryType(physical, &type, &start, &end) == 0 && type == 0);
         Require(bytes[0] == 5 && bytes[length - 1] == 7);
     }
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     Require(sceKernelReleaseDirectMemory(physical, length) == 0);
 }
 
@@ -313,14 +289,14 @@ static void CheckInternalNamedFlexibleMapping() {
     Require(sceKernelMapNamedFlexibleMemoryInternal(&mapped, length, 3, 0, "internal mapping") == 0 && mapped != nullptr);
     Require(std::strcmp(NameAt(mapped), "internal mapping") == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
     void* flagged = nullptr;
     Require(sceKernelMapNamedFlexibleMemoryInternal(&flagged, length, 3, 0x8000, "internal flag") == 0 && flagged != nullptr);
     Require(std::strcmp(NameAt(flagged), "internal flag") == 0);
     static_cast<volatile unsigned char*>(flagged)[length - 1] = 1;
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
-    Require(sceKernelMunmap(flagged, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flagged), length) == 0);
     bool rejected = false;
     void* unknown = nullptr;
     try { sceKernelMapNamedFlexibleMemoryInternal(&unknown, length, 3, 0x20000, "internal mapping"); } catch (const std::exception&) { rejected = true; }
@@ -343,7 +319,7 @@ static void CheckFlexibleFixedReplacement() {
     Require(sceKernelMapFlexibleMemory(&replacement, page, 3, 0x10) == 0 && replacement == middle);
     Require(bytes[0] == 17 && bytes[page] == 0 && bytes[page * 2] == 19 && bytes[page * 3] == 20);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 4);
-    Require(sceKernelMunmap(base, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page * 4) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
 }
 
@@ -361,23 +337,23 @@ static void CheckMunmapScopedFlexibleRelease() {
     Require(sceKernelMapDirectMemory(&direct, page, 3, 0x10, phys, 0) == 0 && direct == static_cast<unsigned char*>(base) + page);
     std::size_t mid = 0;
     Require(sceKernelAvailableFlexibleMemorySize(&mid) == 0);
-    Require(sceKernelMunmap(direct, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(direct), page) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid);
     void* reserved = nullptr;
     Require(sceKernelReserveVirtualRange(&reserved, page * 2, 0, 0) == 0 && reserved != nullptr);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid);
-    Require(sceKernelMunmap(base, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid + page);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
     void* fresh = nullptr;
     Require(sceKernelMapFlexibleMemory(&fresh, page * 4, 3, 0) == 0 && fresh != nullptr);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 4);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(fresh) + page, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(fresh) + page), page * 2) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 2);
-    Require(sceKernelMunmap(fresh, page) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(fresh) + page * 3, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fresh), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(fresh) + page * 3), page) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
 }
 
@@ -409,7 +385,7 @@ static void CheckBatchMapStopsAtInvalidEntry() {
         Require(sceKernelBatchMap2(entries, 3, &processed, 0) == SCE_KERNEL_ERROR_EINVAL);
         Require(processed == 1);
         Require(entries[0].start != nullptr && entries[1].start == nullptr && entries[2].start == nullptr);
-        Require(sceKernelMunmap(entries[0].start, page) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(entries[0].start), page) == 0);
     }
     KernelBatchMapEntry entries[3] = {flexible(), flexible(), flexible()};
     entries[1].operation = protect;
@@ -425,7 +401,7 @@ static void CheckBatchMapStopsAtInvalidEntry() {
     processed = -1;
     Require(sceKernelBatchMap2(unmaps, 2, &processed, 0) == SCE_KERNEL_ERROR_EINVAL && processed == 1);
     Require(sceKernelBatchMap2(entries, 1, &processed, 0) == 0 && processed == 1);
-    Require(sceKernelMunmap(entries[0].start, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(entries[0].start), page) == 0);
 }
 
 static void CheckVirtualQueryFindsNeighbours() {
@@ -443,14 +419,14 @@ static void CheckVirtualQueryFindsNeighbours() {
     Require(info.start == reinterpret_cast<std::uintptr_t>(low) + page && info.end == reinterpret_cast<std::uintptr_t>(low) + page * 2 && info.protection == 1);
     Require(sceKernelVirtualQuery(lowBytes + page * 2, 0, &info, sizeof(info)) == 0);
     Require(info.start == reinterpret_cast<std::uintptr_t>(low) + page * 2 && info.end == reinterpret_cast<std::uintptr_t>(low) + page * 4 && info.protection == 3);
-    Require(sceKernelMunmap(lowBytes + page * 2, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(lowBytes + page * 2), page) == 0);
     Require(sceKernelVirtualQuery(lowBytes + page * 2, 0, &info, sizeof(info)) != 0);
     Require(sceKernelVirtualQuery(lowBytes + page * 2, 1, &info, sizeof(info)) == 0);
     Require(info.start == reinterpret_cast<std::uintptr_t>(low) + page * 3 && info.end == reinterpret_cast<std::uintptr_t>(low) + page * 4);
     Require(sceKernelVirtualQuery(lowBytes + page * 3, 0, &info, sizeof(info)) == 0 && info.start == reinterpret_cast<std::uintptr_t>(low) + page * 3);
-    Require(sceKernelMunmap(low, page * 2) == 0);
-    Require(sceKernelMunmap(lowBytes + page * 3, page) == 0);
-    Require(sceKernelMunmap(high, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(low), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(lowBytes + page * 3), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(high), page) == 0);
 }
 
 static void CheckReleaseFindsEveryDirectMapping() {
@@ -479,6 +455,23 @@ static void CheckReleaseFindsEveryDirectMapping() {
     for (std::size_t index = 0; index < pieces; ++index) Require(sceKernelVirtualQuery(mapped[index], 0, &info, sizeof(info)) != 0);
 }
 
+static void CheckReleaseSkipsFreePages() {
+    constexpr std::size_t page = 0x4000;
+    std::int64_t phys = 0;
+    Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 4, 0, 0, &phys) == 0);
+    void* mapped = nullptr;
+    Require(sceKernelMapDirectMemory(&mapped, page * 4, 3, 0, phys, 0) == 0);
+    Require(sceKernelReleaseDirectMemory(phys + static_cast<std::int64_t>(page), page) == 0);
+    Require(sceKernelReleaseDirectMemory(phys + static_cast<std::int64_t>(page), page) == 0);
+    Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
+    VirtualQueryInfo info{};
+    Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) != 0);
+    Require(sceKernelVirtualQuery(static_cast<unsigned char*>(mapped) + page * 3, 0, &info, sizeof(info)) == 0);
+    Require(sceKernelCheckedReleaseDirectMemory(phys, page) == SCE_KERNEL_ERROR_ENOENT);
+    Require(sceKernelCheckedReleaseDirectMemory(phys + static_cast<std::int64_t>(page * 3), page) == 0);
+    Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
+}
+
 static void CheckCheckedReleaseDirectMemory() {
     constexpr std::size_t page = 0x4000;
     std::int64_t phys = 0;
@@ -489,7 +482,7 @@ static void CheckCheckedReleaseDirectMemory() {
     Require(sceKernelCheckedReleaseDirectMemory(phys, page * 3) == SCE_KERNEL_ERROR_ENOENT);
     void* mapped = nullptr;
     Require(sceKernelMapDirectMemory(&mapped, page * 2, 3, 0, phys, 0) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelCheckedReleaseDirectMemory(phys + page, page) == 0);
     Require(sceKernelCheckedReleaseDirectMemory(phys, page * 2) == SCE_KERNEL_ERROR_ENOENT);
     Require(sceKernelCheckedReleaseDirectMemory(phys, page) == 0);
@@ -518,9 +511,9 @@ static void CheckDirectMemoryFollowsPhysicalPages() {
     Require(sceKernelMprotect(alias, page, 3) == 0);
     static_cast<unsigned char*>(alias)[5] = 22;
     Require(static_cast<unsigned char*>(first)[page + 5] == 22);
-    Require(sceKernelMunmap(alias, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
     static_cast<unsigned char*>(first)[page + 5] = 22;
-    Require(sceKernelMunmap(first, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 2) == 0);
     void* filler = nullptr;
     Require(sceKernelMapFlexibleMemory(&filler, page * 2, 3, 0) == 0);
     void* second = nullptr;
@@ -531,16 +524,16 @@ static void CheckDirectMemoryFollowsPhysicalPages() {
     void* fixed = reserved;
     Require(sceKernelMapDirectMemory(&fixed, page, 1, 0x10, phys, 0) == 0);
     Require(fixed == reserved && static_cast<unsigned char*>(fixed)[0] == 11);
-    Require(sceKernelMunmap(fixed, page) == 0);
-    Require(sceKernelMunmap(second, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fixed), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     std::int64_t again = 0;
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 2, 0, 0, &again) == 0 && again == phys);
     void* fresh = nullptr;
     Require(sceKernelMapDirectMemory(&fresh, page * 2, 3, 0, again, 0) == 0);
     Require(static_cast<unsigned char*>(fresh)[0] == 0 && static_cast<unsigned char*>(fresh)[page + 5] == 0);
-    Require(sceKernelMunmap(fresh, page * 2) == 0);
-    Require(sceKernelMunmap(filler, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fresh), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(filler), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(again, page * 2) == 0);
 }
 
@@ -564,11 +557,11 @@ static void CheckSparseDirectMemoryBacking() {
     Require(aliasBytes[page - 1] == 29 && aliasBytes[0] == 0);
     aliasBytes[page - 1] = 41;
     Require(lastBytes[page - 1] == 41 && firstBytes[0] == 17);
-    Require(sceKernelMunmap(last, page) == 0 && sceKernelMunmap(alias, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(last), page) == 0 && sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
     last = nullptr;
     Require(sceKernelMapDirectMemory(&last, page, 3, 0, physical + size - page, 0) == 0);
     Require(static_cast<unsigned char*>(last)[page - 1] == 41);
-    Require(sceKernelMunmap(first, page) == 0 && sceKernelMunmap(last, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page) == 0 && sceKernelMunmap(reinterpret_cast<std::uint64_t>(last), page) == 0);
     Require(sceKernelReleaseDirectMemory(physical, size) == 0);
 }
 
@@ -581,7 +574,7 @@ static void CheckSavedDirectMemorySurvivesCachePressure() {
         void* mapped = nullptr;
         Require(sceKernelMapDirectMemory(&mapped, bytes, 3, 0, retained[index], bytes) == 0);
         std::memset(mapped, static_cast<int>(index + 1), bytes);
-        Require(sceKernelMunmap(mapped, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     }
     const auto temporary = [] {
         constexpr std::size_t small = 0x10000;
@@ -594,12 +587,12 @@ static void CheckSavedDirectMemorySurvivesCachePressure() {
             Require(std::all_of(data, data + small, [](unsigned char value) { return value == 0; }));
             data[7] = round;
             data[small - 1] = static_cast<unsigned char>(round + 0x40);
-            Require(sceKernelMunmap(mapped, small) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), small) == 0);
             mapped = nullptr;
             Require(sceKernelMapDirectMemory(&mapped, small, 3, 0, physical, 0) == 0);
             data = static_cast<unsigned char*>(mapped);
             for (std::size_t at = 0; at < small; ++at) Require(data[at] == (at == 7 ? round : at == small - 1 ? static_cast<unsigned char>(round + 0x40) : 0));
-            Require(sceKernelMunmap(mapped, small) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), small) == 0);
             Require(sceKernelReleaseDirectMemory(physical, small) == 0);
         }
     };
@@ -609,7 +602,7 @@ static void CheckSavedDirectMemorySurvivesCachePressure() {
         Require(sceKernelMapDirectMemory(&mapped, bytes, 3, 0, retained[index], bytes) == 0);
         const auto* data = static_cast<const unsigned char*>(mapped);
         Require(std::all_of(data, data + bytes, [&](unsigned char value) { return value == index + 1; }));
-        Require(sceKernelMunmap(mapped, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
         Require(sceKernelReleaseDirectMemory(retained[index], bytes) == 0);
     }
     temporary();
@@ -640,7 +633,7 @@ static void CheckReusedDirectMemorySections() {
     auto physical = allocate();
     auto* data = map(physical);
     std::memset(data, 0x5a, bytes);
-    Require(sceKernelMunmap(data, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
     auto before = handles();
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
     const auto released = handles();
@@ -659,12 +652,12 @@ static void CheckReusedDirectMemorySections() {
     Require(data[page + 3] == 41);
     data[page * 2] = 53;
     Require(alias[page * 2] == 53);
-    Require(sceKernelMunmap(alias, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), bytes) == 0);
     Require(data[5] == 17 && data[page + 3] == 41 && data[page * 2] == 53);
-    Require(sceKernelMunmap(data, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
     data = map(physical);
     Require(data[5] == 17 && data[page + 3] == 41 && data[page * 2] == 53 && data[bytes - 1] == 29);
-    Require(sceKernelMunmap(data, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
     before = handles();
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
     Require(handles() == before - 1);
@@ -677,9 +670,9 @@ static void CheckReusedDirectMemorySections() {
             second = nullptr;
             Require(sceKernelMapDirectMemory(&second, page, 3, 0, physical + static_cast<std::int64_t>(page), 0) == 0);
             Require(static_cast<unsigned char*>(second)[page - 1] == round);
-            Require(sceKernelMunmap(second, page) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
         }
-        Require(sceKernelMunmap(data, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
         Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
     }
 #endif
@@ -731,7 +724,7 @@ static void CheckFixedMappingReplacesPartialOverlap() {
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 3, 0, 0, &phys) == 0);
     void* reserved = nullptr;
     Require(sceKernelMapDirectMemory(&reserved, page * 3, 3, 0, phys, 0) == 0);
-    Require(sceKernelMunmap(reserved, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 3) == 0);
     void* head = reserved;
     Require(sceKernelMapDirectMemory(&head, page, 3, 0x10, phys, 0) == 0 && head == reserved);
     void* fixed = reserved;
@@ -742,7 +735,7 @@ static void CheckFixedMappingReplacesPartialOverlap() {
     Require(sceKernelVirtualQuery(fixed, 0, &info, sizeof(info)) == 0);
     Require(info.is_direct && info.offset == static_cast<std::uint64_t>(phys));
     Require(static_cast<unsigned char*>(fixed)[page * 2 + 7] == 0x5c);
-    Require(sceKernelMunmap(fixed, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fixed), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -755,14 +748,14 @@ static void CheckFixedMappingOverHoleInsideAllocation() {
     auto* bytes = static_cast<unsigned char*>(mapped);
     bytes[7] = 0x11;
     bytes[page * 3 + 7] = 0x44;
-    Require(sceKernelMunmap(bytes + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page), page) == 0);
     void* fixed = bytes + page;
     Require(sceKernelMapDirectMemory(&fixed, page * 2, 3, 0x10, phys + static_cast<std::int64_t>(page), 0) == 0);
     Require(fixed == bytes + page);
     bytes[page * 2 + 7] = 0x33;
     Require(bytes[7] == 0x11 && bytes[page * 2 + 7] == 0x33 && bytes[page * 3 + 7] == 0x44);
-    Require(sceKernelMunmap(bytes + page * 2, page * 2) == 0);
-    Require(sceKernelMunmap(mapped, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page * 2), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 }
 
@@ -863,7 +856,7 @@ static void CheckMtypeprotect() {
     std::int64_t start = -1;
     std::int64_t end = -1;
     Require(sceKernelGetDirectMemoryType(phys + static_cast<std::int64_t>(page * 2), &type, &start, &end) == 0 && type == 2);
-    Require(sceKernelMunmap(mapped, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -875,7 +868,7 @@ static void CheckDirectMemoryGpuProtBits() {
     Require(sceKernelMapDirectMemory(&mapping, page, 0x3f2, 0, phys, 0) == 0);
     static_cast<unsigned char*>(mapping)[0] = 11;
     Require(static_cast<unsigned char*>(mapping)[0] == 11);
-    Require(sceKernelMunmap(mapping, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -909,16 +902,16 @@ static void CheckGpuAccessFollowsProtection() {
         const auto image = std::find_if(lease.begin(), lease.end(), [&](const auto& range) { return probe >= range->address && probe - range->address < range->bytes; });
         Require(image != lease.end() && !(*image)->releasable && !(*image)->gpu);
     }
-    Require(sceKernelMunmap(cpu, page) == 0);
-    Require(sceKernelMunmap(gpu, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(cpu), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(gpu), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     void* flexible = nullptr;
     Require(sceKernelMapNamedFlexibleMemory(&flexible, page, 3, 0, "cpu") == 0);
     Require(!GpuMapped(flexible));
-    Require(sceKernelMunmap(flexible, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
     Require(sceKernelMapNamedFlexibleMemory(&flexible, page, 0x33, 0, "gpu") == 0);
     Require(GpuMapped(flexible));
-    Require(sceKernelMunmap(flexible, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
 }
 
 static std::vector<std::pair<std::uintptr_t, std::size_t>> gpuMapped;
@@ -941,7 +934,7 @@ static void CheckClearingTheObserverWaitsForItsCalls() {
     GuestAllocations::GuestAllocationsSetGpuMapObserver_nid_postfix(nullptr);
     Require(observerDone);
     mapper.join();
-    Require(sceKernelMunmap(gpu, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(gpu), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -981,10 +974,10 @@ static void CheckGpuMapsAreObserved() {
     Require(sceKernelMapDirectMemory(&gpuRemap, page, 0x32, 0x10, remapPhys + static_cast<std::int64_t>(page), 0) == 0 && gpuRemap == gpuTarget);
     Require(gpuMapped.size() == 2 && gpuMapped.back().first == reinterpret_cast<std::uintptr_t>(gpuTarget) && gpuMapped.back().second == page);
     GuestAllocations::GuestAllocationsSetGpuMapObserver_nid_postfix(nullptr);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(remapPhys, page * 2) == 0);
-    Require(sceKernelMunmap(cpu, page) == 0);
-    Require(sceKernelMunmap(gpu, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(cpu), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(gpu), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -992,7 +985,7 @@ static void CheckHintedVirtualReservation() {
     constexpr std::size_t page = 0x4000;
     void* probe = nullptr;
     Require(sceKernelReserveVirtualRange(&probe, page * 8, 0, 0) == 0);
-    Require(sceKernelMunmap(probe, page * 8) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(probe), page * 8) == 0);
     void* const hint = static_cast<unsigned char*>(probe) + page * 2;
     void* placed = hint;
     Require(sceKernelReserveVirtualRange(&placed, page * 2, 0, 0) == 0);
@@ -1000,8 +993,8 @@ static void CheckHintedVirtualReservation() {
     void* above = hint;
     Require(sceKernelReserveVirtualRange(&above, page * 2, 0, 0) == 0);
     Require(above > hint);
-    Require(sceKernelMunmap(above, page * 2) == 0);
-    Require(sceKernelMunmap(placed, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(above), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(placed), page * 2) == 0);
 }
 
 static void CheckReservationHintWithoutRoomAbove() {
@@ -1017,15 +1010,15 @@ static void CheckReservationHintWithoutRoomAbove() {
     void* belowTheHint = lastPage;
     Require(sceKernelReserveVirtualRange(&belowTheHint, page * 2, 0, 0) == 0);
     Require(belowTheHint < lastPage && GuestArena::GuestArenaContains_nid_postfix(belowTheHint, page * 2));
-    Require(sceKernelMunmap(belowTheHint, page * 2) == 0);
-    Require(sceKernelMunmap(aboveTheArena, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(belowTheHint), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(aboveTheArena), page * 2) == 0);
 }
 
 static void CheckFixedVirtualReservation() {
     constexpr std::size_t page = 0x4000;
     void* probe = nullptr;
     Require(sceKernelReserveVirtualRange(&probe, page * 4, 0, 0) == 0);
-    Require(sceKernelMunmap(probe, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(probe), page * 4) == 0);
     void* const requested = static_cast<unsigned char*>(probe) + page;
     void* fixed = requested;
     Require(sceKernelReserveVirtualRange(&fixed, page * 2, 0x400010, 0) == 0);
@@ -1057,16 +1050,17 @@ static void CheckFixedVirtualReservation() {
     bool refused = false;
     try {
         sceKernelReserveVirtualRange(&reserved, page * 2, 0x90, 0);
+
     } catch (const std::exception&) {
         refused = true;
     }
     Require(refused);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     void* pooled = nullptr;
     Require(sceKernelMemoryPoolReserve(requested, page * 2, 0, 0x10, &pooled) == 0);
     Require(pooled == requested);
-    Require(sceKernelMunmap(pooled, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(pooled), page * 2) == 0);
 }
 
 static void CheckHintInsideReservation() {
@@ -1095,8 +1089,8 @@ static void CheckHintInsideReservation() {
     Require(sceKernelMapDirectMemory(&overlapping, page * 2, 3, 0, phys + page, 0) == 0);
     Require(overlapping != base + page);
     Require(static_cast<unsigned char*>(direct)[0] == 21 && static_cast<unsigned char*>(flexible)[0] == 22);
-    Require(sceKernelMunmap(overlapping, page * 2) == 0);
-    Require(sceKernelMunmap(reserved, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(overlapping), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -1121,7 +1115,7 @@ static void CheckReservedRangeIsNotCommitted() {
     Require(sceKernelVirtualQuery(static_cast<unsigned char*>(reserved) + page, 0, &info, sizeof(info)) == 0);
     Require(!info.is_committed && info.protection == 0);
     Require(info.start == start + page && info.end == start + page * 2);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -1142,7 +1136,7 @@ static void CheckNoOverwriteRefusesLiveMapping() {
     VirtualQueryInfo info{};
     Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) == 0);
     Require(info.is_direct && info.offset == static_cast<std::uint64_t>(phys));
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -1156,7 +1150,7 @@ static void CheckNoOverwriteRejectsHostOccupiedMapping() {
     constexpr std::size_t page = 0x4000;
     void* reservation = nullptr;
     Require(sceKernelReserveVirtualRange(&reservation, page * 4, 0, 0) == 0);
-    Require(sceKernelMunmap(reservation, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reservation), page * 4) == 0);
     void* target = static_cast<unsigned char*>(reservation) + page;
     GuestArena::GuestArenaCommit_nid_postfix(target, page, ReadWriteProtection, page);
     std::int64_t phys = 0;
@@ -1217,6 +1211,7 @@ static void CheckGuestModuleImageProtection() {
         bool failed = false;
         try {
             dlclose_nid_postfix(module);
+
         } catch (const std::runtime_error&) {
             failed = true;
         }
@@ -1257,6 +1252,7 @@ static void CheckGuestModuleImageProtection() {
     bool rejected = false;
     try {
         sceKernelMprotect(GetModuleHandleA("kernel32.dll"), page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1267,6 +1263,7 @@ static void CheckGuestModuleImageProtection() {
         const auto libkernel = GetModuleHandleA("libkernel.prx");
         Require(libkernel != nullptr);
         sceKernelMprotect(libkernel, page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1294,6 +1291,7 @@ static void CheckGuestModuleImageProtection() {
     rejected = false;
     try {
         sceKernelMprotect(plainTarget, page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1344,6 +1342,7 @@ static void CheckGuestModuleImageProtection() {
     bool rejected = false;
     try {
         sceKernelMprotect(reinterpret_cast<const void*>(&::getpid), page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1371,8 +1370,8 @@ static void CheckUnhintedKernelMappingsLandInTheWindow() {
     const auto flexibleAddress = reinterpret_cast<std::uintptr_t>(flexible);
     Require(flexibleAddress >= windowStart);
     Require(flexibleAddress + page <= windowEnd);
-    Require(sceKernelMunmap(direct, page) == 0);
-    Require(sceKernelMunmap(flexible, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(direct), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -1382,13 +1381,13 @@ static void CheckUnmappedArenaRangeStaysReserved() {
     void* address = nullptr;
     Require(sceKernelMapNamedFlexibleMemory(&address, page, 3, 0, "reserved-after-unmap") == 0);
     Require(address != nullptr);
-    Require(sceKernelMunmap(address, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(address), page) == 0);
     void* hostile = mmap(address, page, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE, -1, 0);
     Require(hostile == MAP_FAILED && errno == EEXIST);
     void* again = nullptr;
     Require(sceKernelMapNamedFlexibleMemory(&again, page, 3, 0, "reserved-after-unmap-2") == 0);
     Require(again != nullptr);
-    Require(sceKernelMunmap(again, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), page) == 0);
 }
 #endif
 
@@ -1441,7 +1440,13 @@ static void CheckFixedMappingsReachTheApplicationAreaEnd() {
         0;
 #endif
     constexpr std::uintptr_t applicationAreaEnd = 0xFC00000000ull + expectedOffset;
-    Require(base == 0x200000000ull + expectedOffset && base + size == applicationAreaEnd);
+    constexpr std::uintptr_t expectedBase =
+#ifdef __APPLE__
+        0x200000000ull + expectedOffset;
+#else
+        expectedOffset == 0 ? 0x10000ull : 0x200000000ull + expectedOffset;
+#endif
+    Require(base == expectedBase && base + size == applicationAreaEnd);
     std::int64_t phys = 0;
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 2, 0, 0, &phys) == 0);
     void* const requested = reinterpret_cast<void*>(applicationAreaEnd - page * 2);
@@ -1462,8 +1467,8 @@ static void CheckFixedMappingsReachTheApplicationAreaEnd() {
         refused = true;
     }
     Require(refused && beyond == reinterpret_cast<void*>(applicationAreaEnd));
-    Require(sceKernelMunmap(alias, page) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 #ifdef _WIN32
@@ -1489,7 +1494,7 @@ static void CheckAliasOfReorderedSharedPages() {
     Require(bytes[6] == 0x33 && bytes[page + 6] == 0x44);
     GuestArena::GuestArenaUnmapAlias_nid_postfix(const_cast<unsigned char*>(alias));
     Require(bytes[5] == 0x22 && bytes[page + 5] == 0x11);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -1520,7 +1525,7 @@ static void CheckAliasAcrossDirectAllocations() {
         Require(VirtualQuery(alias + offset, &released, sizeof(released)) == sizeof(released) && released.State == MEM_FREE);
     }
     Require(bytes[5] == 0x11 && bytes[page + 5] == 0x22 && bytes[page * 2 + 5] == 0x33);
-    Require(sceKernelMunmap(mapped, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(first, page * 3) == 0);
 }
 
@@ -1542,7 +1547,7 @@ static void CheckAliasLeavesResidentRunsUnderAHostWrite() {
     Require(alias != nullptr && alias[5] == 0x11 && alias[page + 5] == 0x22);
     GuestArena::GuestArenaUnmapAlias_nid_postfix(const_cast<unsigned char*>(alias));
     Require(bytes[5] == 0x11 && bytes[page + 5] == 0x22);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -1559,7 +1564,7 @@ static void CheckAliasRefusesPagesThatAreNotSharedViews() {
     bool refused = false;
     try { GuestArena::GuestArenaMapAlias_nid_postfix(reinterpret_cast<std::uintptr_t>(reserved), page * 2); } catch (const std::runtime_error&) { refused = true; }
     Require(refused);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 #endif
@@ -1611,8 +1616,8 @@ static void CheckMlock() {
 #ifndef ANYPS5_ENABLE_ASAN
     Require(sceKernelMlock_nid_postfix(reserved, page) == outOfMemory);
 #endif
-    Require(sceKernelMunmap(reserved, page) == 0);
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
 #ifndef ANYPS5_ENABLE_ASAN
     Require(sceKernelMlock_nid_postfix(mapped, page) == outOfMemory);
 #endif
@@ -1640,8 +1645,8 @@ static void CheckSharedDirectMemoryLifecycle() {
     left[page] = 48;
     Require(sceKernelMprotect(inaccessible, page, 1) == 0);
     Require(static_cast<const unsigned char*>(inaccessible)[0] == 48);
-    Require(sceKernelMunmap(inaccessible, page) == 0);
-    Require(sceKernelMunmap(left + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(inaccessible), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(left + page), page) == 0);
     right[page] = 79;
     Require(left[0] == 31 && left[page * 2] == 63);
     void* middle = left + page;
@@ -1653,9 +1658,9 @@ static void CheckSharedDirectMemoryLifecycle() {
     left[page] = 95;
     Require(sceKernelMprotect(second, page * 3, 1) == 0);
     Require(right[page] == 95);
-    Require(sceKernelMunmap(first, page) == 0);
-    Require(sceKernelMunmap(left + page * 2, page) == 0);
-    Require(sceKernelMunmap(middle, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(left + page * 2), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(middle), page) == 0);
     Require(sceKernelMprotect(second, page * 3, 3) == 0);
     right[page * 2] = 111;
     void* reserved = nullptr;
@@ -1671,8 +1676,8 @@ static void CheckSharedDirectMemoryLifecycle() {
     Require(!info.is_direct && info.is_flexible && info.offset == 0);
     static_cast<unsigned char*>(fixed)[0] = 143;
     Require(right[page * 2] == 127);
-    Require(sceKernelMunmap(reserved, page * 3) == 0);
-    Require(sceKernelMunmap(second, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys + page, page) == 0);
     std::int64_t replacement = 0;
     Require(sceKernelAllocateDirectMemory(phys + page, phys + page * 2, page, 0, 0, &replacement) == 0);
@@ -1681,7 +1686,7 @@ static void CheckSharedDirectMemoryLifecycle() {
     Require(sceKernelMapDirectMemory(&mixed, page * 3, 3, 0, phys, 0) == 0);
     const auto* data = static_cast<const unsigned char*>(mixed);
     Require(data[0] == 31 && data[page] == 0 && data[page * 2] == 127);
-    Require(sceKernelMunmap(mixed, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mixed), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -1748,7 +1753,7 @@ static void CheckSingleDirectMappingTracksWritesWithoutFaults() {
     Require(g_accessViolations == 0);
     Require(collect(mapped, page * 4) == 2);
     Require(collect(mapped, page * 4) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(mapped) + page * 2, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(mapped) + page * 2), page) == 0);
     Require(bytes[page + 0x1000] == 7 && bytes[page * 3] == 9);
     bytes[0] = 5;
     Require(collect(mapped, page * 2) != 0);
@@ -1759,19 +1764,19 @@ static void CheckSingleDirectMappingTracksWritesWithoutFaults() {
     static_cast<volatile unsigned char*>(second)[0x1001] = 11;
     Require(bytes[page + 0x1001] == 11);
     Require(collect(mapped, page * 2) != 0);
-    Require(sceKernelMunmap(second, page) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(mapped) + page * 3, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(mapped) + page * 3), page) == 0);
     void* again = nullptr;
     Require(sceKernelMapDirectMemory(&again, page * 4, 3, 0, phys, 0) == 0);
     const auto* data = static_cast<const unsigned char*>(again);
     Require(data[0] == 5 && data[page + 0x1000] == 7 && data[page + 0x1001] == 11 && data[page * 2] == 0 && data[page * 3] == 9);
-    Require(sceKernelMunmap(again, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 #endif
 }
 
-static void CheckLargeResidentWritesStopFaulting() {
+static void CheckLargeResidentWritesDoNotFault() {
 #ifdef _WIN32
     constexpr std::size_t bytes = 0x200000;
     std::int64_t physical = 0;
@@ -1787,7 +1792,7 @@ static void CheckLargeResidentWritesStopFaulting() {
     Require(collect() == bytes / 4096);
     Require(collect() == 0 && collect() == 0);
     MEMORY_BASIC_INFORMATION memory{};
-    Require(VirtualQuery(mapped, &memory, sizeof(memory)) == sizeof(memory) && memory.Protect == PAGE_READONLY);
+    Require(VirtualQuery(mapped, &memory, sizeof(memory)) == sizeof(memory) && memory.Protect == PAGE_READWRITE);
     auto* data = static_cast<unsigned char*>(mapped);
     const auto path = std::filesystem::path("anyps5-resident-read-" +
         std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + ".bin");
@@ -1815,7 +1820,7 @@ static void CheckLargeResidentWritesStopFaulting() {
         Require(collect() == 1 && collect() == 0);
     }
     for (unsigned int round = 0; round < 16; ++round) Require(collect() == 0);
-    Require(VirtualQuery(mapped, &memory, sizeof(memory)) == sizeof(memory) && memory.Protect == PAGE_READONLY);
+    Require(VirtualQuery(mapped, &memory, sizeof(memory)) == sizeof(memory) && memory.Protect == PAGE_READWRITE);
     const auto before = g_accessViolations;
     const auto handler = AddVectoredExceptionHandler(1, CountAccessViolations);
     Require(handler != nullptr);
@@ -1824,14 +1829,14 @@ static void CheckLargeResidentWritesStopFaulting() {
         Require(collect() == bytes / 4096 && collect() == 0);
     }
     Require(RemoveVectoredExceptionHandler(handler));
-    Require(g_accessViolations == before + 1);
+    Require(g_accessViolations == before);
     Require(VirtualQuery(mapped, &memory, sizeof(memory)) == sizeof(memory) && memory.Protect == PAGE_READWRITE);
     Require(mprotect_nid_postfix(mapped, bytes, 1) == 0);
     Require(collect() == 0 && collect() == 0);
     Require(mprotect_nid_postfix(mapped, bytes, 3) == 0);
     data[0x10000] = 97;
     Require(collect() == 1 && collect() == 0);
-    Require(sceKernelMunmap(mapped, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -1867,8 +1872,8 @@ static void CheckImportAccessDoesNotInventSharedWrites() {
     }
     Require(static_cast<unsigned char*>(second)[4097] == 73);
     Require(collect(first) == 0 && collect(second) == 0);
-    Require(sceKernelMunmap(first, bytes) == 0);
-    Require(sceKernelMunmap(second, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -1908,7 +1913,7 @@ static void CheckResidentCollectPreservesPartialWrites() {
     Require(collect(small, bytes - small, 1, true, false) == std::vector<std::uintptr_t>{small});
     Require(collect(small * 2, bytes - small * 2, bytes / small, true, true) == std::vector<std::uintptr_t>{0x200000});
     Require(collect(0, bytes, bytes / small, true, false).empty());
-    Require(sceKernelMunmap(mapped, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -1970,8 +1975,8 @@ static void CheckResidentCollectionDuringHostWrites() {
     Require(data[small + 11] == 4);
     const auto pages = collect();
     Require(std::find(pages.begin(), pages.end(), data + small) != pages.end());
-    Require(sceKernelMunmap(alias, 0x4000) == 0);
-    Require(sceKernelMunmap(mapped, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), 0x4000) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -2051,8 +2056,8 @@ static void CheckSecondDirectMappingWaitsForLeases() {
     static_cast<volatile unsigned char*>(second)[8] = 3;
     Require(static_cast<unsigned char*>(mapped)[page + 8] == 3);
     static_cast<volatile unsigned char*>(mapped)[page * 2 + 8] = 4;
-    Require(sceKernelMunmap(second, page) == 0);
-    Require(sceKernelMunmap(mapped, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 #endif
 }
@@ -2105,7 +2110,7 @@ static void CheckBreakingAResidentRunKeepsConcurrentAccesses() {
         std::array<void*, chunks> second{};
         go = true;
         for (std::size_t index = 0; index < chunks; ++index) {
-            if (unmap) Require(sceKernelMunmap(static_cast<unsigned char*>(mapped) + index * chunk + page, page) == 0);
+            if (unmap) Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(mapped) + index * chunk + page), page) == 0);
             else Require(sceKernelMapDirectMemory(&second[index], page, 3, 0, phys + static_cast<std::int64_t>(index * chunk + page), 0) == 0);
         }
         writer.join();
@@ -2118,16 +2123,16 @@ static void CheckBreakingAResidentRunKeepsConcurrentAccesses() {
             }
             if (unmap) continue;
             for (std::size_t offset = 0; offset < page; ++offset) Require(static_cast<unsigned char*>(second[index])[offset] == value(index * chunk + page + offset));
-            Require(sceKernelMunmap(second[index], page) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second[index]), page) == 0);
         }
         for (std::size_t index = 0; index < chunks; ++index) {
             auto* base = static_cast<unsigned char*>(mapped) + index * chunk;
             if (!unmap) {
-                Require(sceKernelMunmap(base, chunk) == 0);
+                Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), chunk) == 0);
                 continue;
             }
-            Require(sceKernelMunmap(base, page) == 0);
-            Require(sceKernelMunmap(base + page * 2, chunk - page * 2) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base + page * 2), chunk - page * 2) == 0);
         }
         Require(sceKernelReleaseDirectMemory(phys, chunk * chunks) == 0);
     }
@@ -2138,30 +2143,30 @@ static void CheckRemappedDirectMemoryIsChargedOnce() {
 #ifdef _WIN32
     constexpr std::size_t bytes = 0x10000000;
     const auto committed = [] {
-        PERFORMANCE_INFORMATION info{};
-        info.cb = sizeof(info);
-        Require(K32GetPerformanceInfo(&info, sizeof(info)) != 0);
-        return static_cast<std::int64_t>(info.CommitTotal) * static_cast<std::int64_t>(info.PageSize);
+        struct {
+            PROCESS_MEMORY_COUNTERS_EX counters;
+            SIZE_T privateWorkingSetSize;
+            ULONG64 sharedCommitUsage;
+        } info{};
+        info.counters.cb = sizeof(info);
+        Require(K32GetProcessMemoryInfo(GetCurrentProcess(), reinterpret_cast<PROCESS_MEMORY_COUNTERS*>(&info), sizeof(info)) != 0);
+        return static_cast<std::int64_t>(info.counters.PrivateUsage) + static_cast<std::int64_t>(info.sharedCommitUsage);
     };
-    bool once = false;
-    for (int attempt = 0; attempt < 3 && !once; ++attempt) {
-        const auto before = committed();
-        std::int64_t phys = 0;
-        Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, bytes, 0, 0, &phys) == 0);
-        void* mapped = nullptr;
-        Require(sceKernelMapDirectMemory(&mapped, bytes, 3, 0, phys, 0) == 0);
-        RequireResidentMapping(mapped);
-        std::memset(mapped, 0xa5, bytes);
-        Require(sceKernelMunmap(mapped, bytes) == 0);
-        void* again = nullptr;
-        Require(sceKernelMapDirectMemory(&again, bytes, 3, 0, phys, 0) == 0);
-        const auto* data = static_cast<const unsigned char*>(again);
-        Require(data[0] == 0xa5 && data[bytes / 2] == 0xa5 && data[bytes - 1] == 0xa5);
-        once = committed() - before < static_cast<std::int64_t>(bytes + bytes / 2);
-        Require(sceKernelMunmap(again, bytes) == 0);
-        Require(sceKernelReleaseDirectMemory(phys, bytes) == 0);
-    }
-    Require(once);
+    const auto before = committed();
+    std::int64_t phys = 0;
+    Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, bytes, 0, 0, &phys) == 0);
+    void* mapped = nullptr;
+    Require(sceKernelMapDirectMemory(&mapped, bytes, 3, 0, phys, 0) == 0);
+    RequireResidentMapping(mapped);
+    std::memset(mapped, 0xa5, bytes);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
+    void* again = nullptr;
+    Require(sceKernelMapDirectMemory(&again, bytes, 3, 0, phys, 0) == 0);
+    const auto* data = static_cast<const unsigned char*>(again);
+    Require(data[0] == 0xa5 && data[bytes / 2] == 0xa5 && data[bytes - 1] == 0xa5);
+    Require(committed() - before < static_cast<std::int64_t>(bytes + bytes / 2));
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), bytes) == 0);
+    Require(sceKernelReleaseDirectMemory(phys, bytes) == 0);
 #endif
 }
 
@@ -2212,9 +2217,9 @@ static void CheckSharedWriteTracking() {
     collect(second, page * 3);
     static_cast<volatile unsigned char*>(third)[0] = 105;
     Require(collect(first, page * 3) == 1 && collect(second, page * 3) == 1);
-    Require(sceKernelMunmap(third, page) == 0);
-    Require(sceKernelMunmap(first, page * 3) == 0);
-    Require(sceKernelMunmap(second, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(third), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 #endif
 }
@@ -2257,7 +2262,7 @@ static void CheckSharedWritePages() {
     Require(bytes[page + small] == 5 && bytes[page + small * 2 - 1] == 5);
     Require(collect(page, small) == 0);
     Require(collect(0, page * 2) == 1);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     std::filesystem::remove(path);
 #endif
@@ -2300,8 +2305,8 @@ static void CheckSharedWritesDuringHostWrite() {
     Require(collect(first).empty() && collect(second).empty());
     left[small + 16] = 3;
     Require(right[small + 16] == 3 && collect(second) == std::vector<std::size_t>{small});
-    Require(sceKernelMunmap(first, page) == 0);
-    Require(sceKernelMunmap(second, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 #endif
 }
@@ -2334,7 +2339,7 @@ static void CheckFailedCollectKeepsWrites() {
     Require(sceKernelMprotect(const_cast<unsigned char*>(shared + page), page, 0) == 0);
     Require(!collect(mapped, page * 2, count));
     Require(collect(mapped, page, count) && count == 1);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 #endif
 }
@@ -2416,8 +2421,8 @@ static void CheckPinnedSharedPages() {
     Require(protection(page) == PAGE_READONLY);
     bytes[page + 8] = 11;
     Require(collect() == 1);
-    Require(sceKernelMunmap(alias, page * 3) == 0);
-    Require(sceKernelMunmap(mapped, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 #endif
 }
@@ -2461,7 +2466,7 @@ static void CheckReadsIntoSharedWriteTracking() {
     KernelAioRwRequest request{static_cast<std::int64_t>(page), page, bytes, &result, fd};
     std::int32_t id = 0;
     std::int32_t state = 0;
-    Require(sceKernelAioSubmitReadCommands(&request, 1, 0, &id) == 0);
+    Require(sceKernelAioSubmitReadCommands(&request, 1, 1, &id) == 0);
     Require(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
     Require(result.state == 3 && result.return_value == static_cast<std::int64_t>(page));
     Require(std::memcmp(bytes, seed.data() + page, page) == 0);
@@ -2472,12 +2477,12 @@ static void CheckReadsIntoSharedWriteTracking() {
     Require(sceKernelPread(fd, mapped, page, 0) == static_cast<std::int64_t>(SCE_KERNEL_ERROR_EFAULT));
     KernelAioResult refusedResult{-1, 0};
     KernelAioRwRequest refusedRequest{0, page, bytes, &refusedResult, fd};
-    Require(sceKernelAioSubmitReadCommands(&refusedRequest, 1, 0, &id) == 0);
+    Require(sceKernelAioSubmitReadCommands(&refusedRequest, 1, 1, &id) == 0);
     Require(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
     Require(refusedResult.return_value == static_cast<std::int64_t>(SCE_KERNEL_ERROR_EFAULT));
     Require(sceKernelAioDeleteRequest(id, &deleted) == 0);
     Require(sceKernelClose(fd) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     std::filesystem::remove(path);
 #endif
@@ -2532,7 +2537,7 @@ static void CheckWriteWatchArmedCollect() {
     Require(CollectArmedRuns(mapping, 0, length, runs) && runs == PageRuns{{5, 6}});
     Require(Written(mapping, length, {{length / small / 2, length / small}}));
     Require(Written(mapping, length, {}));
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
 }
 
 static bool CollectFreshRuns(const void* base, std::size_t offset, std::size_t bytes, PageRuns& runs) {
@@ -2560,7 +2565,7 @@ static void CheckWriteWatchFreshCollect() {
     Require(CollectFreshRuns(mapping, 0, length, runs) && runs.empty());
     bytes[200 * small] = 1;
     Require(Written(mapping, length, {{5, 6}, {200, 201}}));
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
 }
 
 static void CheckWriteWatch() {
@@ -2610,7 +2615,7 @@ static void CheckWriteWatch() {
     Require(Written(mapping, length, {{50, 51}}));
     constexpr std::size_t guestPage = 0x4000;
     auto* middle = const_cast<unsigned char*>(bytes + 4 * guestPage);
-    Require(sceKernelMunmap(middle, guestPage) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(middle), guestPage) == 0);
     Require(!GuestWriteWatch::GuestWriteWatchCovers_nid_postfix(address, length));
     Require(!CollectRuns(mapping, 0, length, runs) && runs.empty());
     void* fixed = middle;
@@ -2620,7 +2625,7 @@ static void CheckWriteWatch() {
     Require(Written(mapping, length, {}));
     middle[1] = 1;
     Require(Written(mapping, length, {{16, 17}}));
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     Require(!GuestWriteWatch::GuestWriteWatchCovers_nid_postfix(address, small));
     constexpr std::size_t tableSpan = 0x200000;
     constexpr std::size_t spanned = 2 * tableSpan;
@@ -2660,7 +2665,7 @@ static void CheckDirectMemoryBackingNeedsNoFilesystem() {
     const auto backing = BackingOf(mapped);
     if (backing.rfind("/memfd:", 0) != 0) std::fprintf(stderr, "direct memory backing: %s\n", backing.c_str());
     Require(backing.rfind("/memfd:", 0) == 0);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -2703,10 +2708,10 @@ static void CheckDirectMemorySharedBacking() {
     Require(!GuestArena::GuestArenaSharedBacking_nid_postfix(flexibleAddress, page * 2, &file, &offset));
     Require(GuestArena::GuestArenaSharedBacking_nid_postfix(flexibleAddress + page, page, &file, &offset) && offset == base + page * 2);
     close(file);
-    Require(sceKernelMunmap(high, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(high), page) == 0);
     Require(!GuestArena::GuestArenaSharedBacking_nid_postfix(flexibleAddress + page, page, &file, &offset));
-    Require(sceKernelMunmap(flexible, page) == 0);
-    Require(sceKernelMunmap(first, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 2) == 0);
     Require(!GuestArena::GuestArenaSharedBacking_nid_postfix(address, page, &file, &offset));
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 
@@ -2730,15 +2735,15 @@ static void CheckDirectMemorySharedBacking() {
     close(leftFile);
     close(rightFile);
     std::memset(leftView, 0x77, page);
-    Require(sceKernelMunmap(leftView, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(leftView), page) == 0);
     Require(sceKernelReleaseDirectMemory(left, page) == 0);
     std::int64_t again = 0;
     Require(sceKernelAllocateDirectMemory(left, left + static_cast<std::int64_t>(page), page, 0, 0, &again) == 0 && again == left);
     void* againView = nullptr;
     Require(sceKernelMapDirectMemory(&againView, page, 3, 0, again, 0) == 0);
     for (std::size_t i = 0; i < page; ++i) Require(static_cast<const unsigned char*>(againView)[i] == 0);
-    Require(sceKernelMunmap(againView, page) == 0);
-    Require(sceKernelMunmap(rightView, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(againView), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(rightView), page) == 0);
     Require(sceKernelReleaseDirectMemory(again, page) == 0);
     Require(sceKernelReleaseDirectMemory(right, page) == 0);
 }
@@ -2774,8 +2779,8 @@ static void CheckDirectMemoryWriteWatch() {
     Require(bytes[page + 7] == 3);
     Require(CollectRuns(first, 0, page, runs) && runs == PageRuns{{0, 1}});
     Require(CollectRuns(first, page * 2, page, runs) && runs.empty());
-    Require(sceKernelMunmap(alias, page) == 0);
-    Require(sceKernelMunmap(first, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 3) == 0);
     Require(!GuestWriteWatch::GuestWriteWatchCovers_nid_postfix(address, page));
     void* flexible = nullptr;
     Require(sceKernelMapFlexibleMemory(&flexible, page * 3, 3, 0) == 0);
@@ -2789,7 +2794,7 @@ static void CheckDirectMemoryWriteWatch() {
     Require(Written(flexible, page * 3, {}));
     static_cast<volatile unsigned char*>(fixed)[9] = 4;
     Require(Written(flexible, page * 3, {{page / small, page / small + 1}}));
-    Require(sceKernelMunmap(flexible, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -2809,12 +2814,12 @@ static void CheckDirectMemoryWriteWatchFollowsRemovedMappings() {
     Require(sceKernelMapDirectMemory(&pair, page * 2, 3, 0, phys + page, 0) == 0);
     Require(watched(whole, 0) && !watched(whole, page) && !watched(whole, page * 2) && watched(whole, page * 3));
     Require(!watched(pair, 0) && !watched(pair, page));
-    Require(sceKernelMunmap(pair, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(pair), page) == 0);
     void* single = nullptr;
     Require(sceKernelMapDirectMemory(&single, page, 3, 0, phys + page, 0) == 0);
     Require(!watched(single, 0) && watched(whole, 0) && watched(whole, page * 3));
-    Require(sceKernelMunmap(single, page) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(pair) + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(single), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(pair) + page), page) == 0);
     void* replaced = whole;
     Require(sceKernelMapDirectMemory(&replaced, page, 3, 0x10, phys + page * 3, 0) == 0 && replaced == whole);
     Require(!watched(whole, 0) && !watched(whole, page * 3));
@@ -2829,9 +2834,9 @@ static void CheckDirectMemoryWriteWatchFollowsRemovedMappings() {
     void* again = nullptr;
     Require(sceKernelMapDirectMemory(&again, page, 3, 0, phys, 0) == 0);
     Require(!watched(alone, 0) && !watched(again, 0));
-    Require(sceKernelMunmap(again, page) == 0);
-    Require(sceKernelMunmap(alone, page) == 0);
-    Require(sceKernelMunmap(whole, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alone), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(whole), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 }
 
@@ -2854,7 +2859,7 @@ static double MapAcrossBackingsSeconds(std::int64_t phys, std::size_t backings)
         std::uint64_t offset = 0;
         int type = 0;
         Require(QueryDirectMapping(last, &start, &end, &offset, &type) && start == last && end == last + page);
-        Require(sceKernelMunmap(mapped, page * backings) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * backings) == 0);
     }
     return best;
 }
@@ -2995,7 +3000,7 @@ static void CheckVirtualQuerySplitFlexibleRanges() {
         Require(info.protection == (index == 1 ? 1 : 3));
         Require(info.is_committed && info.is_flexible && !info.is_direct);
     }
-    Require(sceKernelMunmap(bytes + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page), page) == 0);
     for (std::size_t index : {std::size_t{0}, std::size_t{2}}) {
         VirtualQueryInfo info{};
         Require(sceKernelVirtualQuery(bytes + page * index, 0, &info, sizeof(info)) == 0);
@@ -3007,8 +3012,8 @@ static void CheckVirtualQuerySplitFlexibleRanges() {
     Require(next.start == reinterpret_cast<std::uintptr_t>(bytes + page * 2));
     Require(next.end == next.start + page && next.protection == 3);
     Require(bytes[0] == 17 && bytes[page * 2] == 29);
-    Require(sceKernelMunmap(bytes, page) == 0);
-    Require(sceKernelMunmap(bytes + page * 2, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page * 2), page) == 0);
 }
 
 static void CheckVirtualQueryWireLayout() {
@@ -3038,7 +3043,7 @@ static void CheckVirtualQueryWireLayout() {
     Require(std::all_of(result.before.begin(), result.before.end(), [](auto byte) { return byte == 0xa5; }));
     Require(std::all_of(result.after.begin(), result.after.end(), [](auto byte) { return byte == 0x5a; }));
     Require(sceKernelClearVirtualRangeName(mapped, page) == 0);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
 }
 
 static void CheckVirtualQueryForNonReadableGuestRange() {
@@ -3051,7 +3056,7 @@ static void CheckVirtualQueryForNonReadableGuestRange() {
     Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) == 0);
     Require(info.start == reinterpret_cast<std::uintptr_t>(mapped));
     Require(info.end == info.start + page && info.protection == 0);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
 }
 
 static void CheckPosixFixedAnonymousMapping() {
@@ -3087,7 +3092,7 @@ static void CheckPosixFixedAnonymousMapping() {
     memory[page] = 0x51;
     memory[page * 2 - 1] = 0x52;
     memory[page * 2] = 0x61;
-    Require(sceKernelMunmap(memory + page * 3, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory + page * 3), page) == 0);
     Require(mmap_nid_postfix(memory + page * 3, page, 3, exclusive, -1, 0) == memory + page * 3);
     Require(std::all_of(memory + page * 3, memory + page * 4, [](unsigned char value) { return value == 0; }));
     memory[page * 4 - 1] = 0x62;
@@ -3140,7 +3145,7 @@ static void CheckPosixFixedAnonymousReleasesFlexibleAccounting() {
     Require(mmap_nid_postfix(bytes + page, page, 3, fixed, -1, 0) == bytes + page);
     Require(bytes[0] == 0x31 && bytes[page] == 0 && bytes[page * 2] == 0x51);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 2);
-    Require(sceKernelMunmap(base, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page * 3) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
 }
 
@@ -3169,7 +3174,7 @@ static void CheckPosixFixedFileReleasesFlexibleAccounting() {
     Require(mmap_nid_postfix(bytes + page, page, 1, fixedShared, fd, 0) == bytes + page);
     Require(bytes[0] == 0x31 && bytes[page] == 0x6d && bytes[page * 2] == 0x51);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 2);
-    Require(sceKernelMunmap(base, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page * 3) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
     Require(sceKernelClose(fd) == 0);
     std::filesystem::remove(path);
@@ -3182,7 +3187,7 @@ static void CheckSceKernelMmap() {
     Require(sceKernelMmap(nullptr, page, 3, 0x1002, -1, 0, &mapped) == 0 && mapped != nullptr);
     static_cast<volatile unsigned char*>(mapped)[page - 1] = 7;
     Require(static_cast<volatile unsigned char*>(mapped)[page - 1] == 7);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     void* untouched = &mapped;
     Require(sceKernelMmap(nullptr, 0, 3, 0x1002, -1, 0, &untouched) == static_cast<int>(0x80020016u));
     Require(untouched == &mapped);
@@ -3217,7 +3222,6 @@ static void CheckVirtualQueryPartialMunmap() {
     Require(munmap_nid_postfix(memory + page * 2, page) == 0);
 }
 
-
 static void CheckAvailableDirectMemoryIsLargestFreeBlock() {
     constexpr std::int64_t window = 0x4000000;
     const std::int64_t top = static_cast<std::int64_t>(DIRECT_MEMORY_SIZE) - window;
@@ -3237,12 +3241,43 @@ static void CheckAvailableDirectMemoryIsLargestFreeBlock() {
     Require(start == top + 0x200000 && size == 0x400000);
     Require(sceKernelAvailableDirectMemorySize(top, top + window, 0x1000000, &start, &size) == 0);
     Require(start == top + 0x1000000 && size == static_cast<std::size_t>(window - 0x1000000));
-    Require(sceKernelAvailableDirectMemorySize(top, top + 0x200000, 0, &start, &size) == SCE_KERNEL_ERROR_ENOMEM);
-    Require(start == 0 && size == 0);
-    Require(sceKernelAvailableDirectMemorySize(top + window, top, 0, &start, &size) == SCE_KERNEL_ERROR_EAGAIN);
-    Require(sceKernelAvailableDirectMemorySize(-1, top + window, 0, &start, &size) == SCE_KERNEL_ERROR_EAGAIN);
-    Require(sceKernelAvailableDirectMemorySize(top, top + window, std::numeric_limits<std::size_t>::max(), &start, &size) == SCE_KERNEL_ERROR_EAGAIN);
-    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, nullptr, &size) == SCE_KERNEL_ERROR_EINVAL);
+    const std::int64_t run = top + 0x800000;
+    const auto untouched = [&](std::int64_t searchStart, std::int64_t searchEnd, std::size_t alignment, int expected) {
+        start = -7;
+        size = 7;
+        return sceKernelAvailableDirectMemorySize(searchStart, searchEnd, alignment, &start, &size) == expected && start == -7 && size == 7;
+    };
+    Require(untouched(top, top + 0x200000, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(top + window, top, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(run, run, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(0, -1, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(run + 0x1000, run + 0x3000, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(static_cast<std::int64_t>(DIRECT_MEMORY_SIZE), std::numeric_limits<std::int64_t>::max(), 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(std::numeric_limits<std::int64_t>::max() - 0x3ffe, std::numeric_limits<std::int64_t>::max(), 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(std::numeric_limits<std::int64_t>::max(), run + 0x100000, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(run, std::numeric_limits<std::int64_t>::max(), std::size_t{1} << 62, SCE_KERNEL_ERROR_ENOMEM));
+    for (const std::size_t alignment : {std::size_t{3}, std::size_t{0x6000}, std::size_t{0xc000}, std::size_t{0x14000}, ~std::size_t{0x3fff}, std::numeric_limits<std::size_t>::max()}) {
+        Require(untouched(top, top + window, alignment, SCE_KERNEL_ERROR_EINVAL));
+        Require(untouched(top + window, top, alignment, SCE_KERNEL_ERROR_EINVAL));
+    }
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, nullptr, &size) == 0 && size == static_cast<std::size_t>(window - 0x800000));
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, &start, nullptr) == 0 && start == run);
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, nullptr, nullptr) == 0);
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 3, nullptr, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelAvailableDirectMemorySize(-1, top + window, 0, &start, &size) == 0 && start >= 0 && static_cast<std::int64_t>(size) <= top + window - start);
+    Require(sceKernelAvailableDirectMemorySize(std::numeric_limits<std::int64_t>::min(), top + window, 0, &start, &size) == 0 && start >= 0);
+    Require(sceKernelAvailableDirectMemorySize(run, run + 0xfffff, 0, &start, &size) == 0 && start == run && size == 0xfffff);
+    Require(sceKernelAvailableDirectMemorySize(run, run + 0x3fff, 0, &start, &size) == 0 && start == run && size == 0x3fff);
+    Require(sceKernelAvailableDirectMemorySize(run + 1, run + 0x100000, 0, &start, &size) == 0 && start == run + 0x4000 && size == 0xfc000);
+    Require(sceKernelAvailableDirectMemorySize(run + 0x2000, run + 0x6000, 0, &start, &size) == 0 && start == run + 0x4000 && size == 0x2000);
+    Require(sceKernelAvailableDirectMemorySize(run + 0x2000, run + 0x10e000, 1, &start, &size) == 0 && start == run + 0x4000 && size == 0x10a000);
+    Require(sceKernelAvailableDirectMemorySize(run + 0x4000, run + 0x100000, 0x8000, &start, &size) == 0 && start == run + 0x8000 && size == 0xf8000);
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, std::size_t{1} << 63, &start, &size) == 0);
+    Require(start == std::numeric_limits<std::int64_t>::min() && size == static_cast<std::size_t>(top + window) - (std::size_t{1} << 63));
+    std::int64_t divider = -1;
+    Require(sceKernelAllocateDirectMemory(run + 0x40000, run + 0x44000, 0x4000, 0, 0, &divider) == 0 && divider == run + 0x40000);
+    Require(sceKernelAvailableDirectMemorySize(run, run + 0x84000, 0, &start, &size) == 0 && start == run && size == 0x40000);
+    Require(sceKernelReleaseDirectMemory(divider, 0x4000) == 0);
 
     Require(sceKernelReleaseDirectMemory(first, 0x200000) == 0);
     Require(sceKernelReleaseDirectMemory(last, 0x200000) == 0);
@@ -3268,8 +3303,8 @@ static void CheckMunmapOverUnmappedPages() {
     Require(sceKernelVirtualQuery(memory, 0, &info, sizeof(info)) == SCE_KERNEL_ERROR_EACCES);
     Require(sceKernelVirtualQuery(memory + page * 2, 0, &info, sizeof(info)) == SCE_KERNEL_ERROR_EACCES);
     Require(munmap_nid_postfix(memory, page * 3) == 0);
-    Require(sceKernelMunmap(memory, page * 3) == 0);
-    Require(sceKernelMunmap(memory, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), 0) == SCE_KERNEL_ERROR_EINVAL);
 }
 
 int main(int argc, char** argv) {
@@ -3303,6 +3338,7 @@ int main(int argc, char** argv) {
     CheckGuestModuleUsesFlexibleMemory();
     CheckBatchMapStopsAtInvalidEntry();
     CheckCheckedReleaseDirectMemory();
+    CheckReleaseSkipsFreePages();
     CheckAudioCoprocessorProtection();
     CheckMprotectIgnoresUndefinedBits();
     CheckStrictMemoryProtectionBits();
@@ -3357,7 +3393,7 @@ int main(int argc, char** argv) {
     CheckPinnedSharedPages();
     CheckFailedCollectKeepsWrites();
     CheckSingleDirectMappingTracksWritesWithoutFaults();
-    CheckLargeResidentWritesStopFaulting();
+    CheckLargeResidentWritesDoNotFault();
     CheckImportAccessDoesNotInventSharedWrites();
     CheckResidentCollectPreservesPartialWrites();
     CheckResidentCollectionDuringHostWrites();
@@ -3467,7 +3503,7 @@ int main(int argc, char** argv) {
     Require(sceKernelReserveVirtualRange(&mincoreReserved, page, 0, 0) == 0);
     mincoreVec[0] = 0x55;
     Require(mincore_nid_postfix(mincoreReserved, page, mincoreVec) == 0 && mincoreVec[0] == 0);
-    Require(sceKernelMunmap(mincoreReserved, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mincoreReserved), page) == 0);
     Require(munmap_nid_postfix(memory + 1, page) == -1 && *__error_nid_postfix() == 22);
     Require(munmap_nid_postfix(memory, 0) == -1 && *__error_nid_postfix() == 22);
     Require(memory[0] == 42);
diff --git a/core/libs/tests/GuestMemoryPoolStats.cpp b/core/libs/tests/GuestMemoryPoolStats.cpp
index 7aec461e18..14d926ca31 100644
--- a/core/libs/tests/GuestMemoryPoolStats.cpp
+++ b/core/libs/tests/GuestMemoryPoolStats.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
+#include "prx/libSceNet/include/Net.hpp"
+#include "prx/libSceHttp2/include/Http2.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,41 +9,19 @@
 #include <cstdlib>
 #include <cstring>
 
-struct PoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-struct NetPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-};
-
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::size_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetMemoryPoolStats(int, void*);
-int APS5_VABI sceHttp2Init(int, int, std::size_t, int);
-int APS5_VABI sceHttp2Term(int);
-int APS5_VABI sceHttp2GetMemoryPoolStats(int, void*);
-int APS5_VABI sceNetPoolCreate(const char*, int, int);
-int APS5_VABI sceNetPoolDestroy(int);
-int APS5_VABI sceNetGetMemoryPoolStats(int, void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
-using StatsCall = int(APS5_VABI*)(int, void*);
-
-static void CheckRejected(StatsCall call, int id, int expected) {
-    std::array<unsigned char, 0x40> buffer;
-    buffer.fill(0x5a);
-    Require(call(id, buffer.data()) == expected);
-    for (std::size_t i = 0; i < sizeof(PoolStats); ++i) Require(buffer[i] == 0);
-    for (std::size_t i = sizeof(PoolStats); i < buffer.size(); ++i) Require(buffer[i] == 0x5a);
+template <typename TStats>
+static void CheckRejected(int (APS5_VABI *call)(int, TStats*), int id, int expected) {
+    struct {
+        TStats stats;
+        std::array<unsigned char, 0x40 - sizeof(TStats)> guard;
+    } buffer;
+    std::memset(&buffer, 0x5a, sizeof(buffer));
+    Require(call(id, &buffer.stats) == expected);
+    const auto* bytes = reinterpret_cast<const unsigned char*>(&buffer.stats);
+    for (std::size_t i = 0; i < sizeof(TStats); ++i) Require(bytes[i] == 0);
+    for (const auto byte : buffer.guard) Require(byte == 0x5a);
 }
 
 int main() {
@@ -50,12 +31,12 @@ int main() {
     constexpr int http2NullPointer = static_cast<int>(0x817B1225);
     constexpr int netBadDescriptor = static_cast<int>(0x80410109);
     constexpr int netInvalid = static_cast<int>(0x80410116);
-    static_assert(sizeof(PoolStats) == 0x20 && sizeof(NetPoolStats) == 0x18);
+    static_assert(sizeof(SceSsl::MemoryPoolStats) == 0x20 && sizeof(Http2MemoryPoolStats) == 0x20 && sizeof(NetMemoryPoolStats) == 0x18);
 
     const int ssl = sceSslInit_nid_postfix(0x40000);
     Require(ssl > 0);
-    PoolStats stats{};
-    Require(sceSslGetMemoryPoolStats(ssl, &stats) == 0 && stats.pool_size == 0x40000);
+    SceSsl::MemoryPoolStats sslStats{};
+    Require(sceSslGetMemoryPoolStats(ssl, &sslStats) == 0 && sslStats.poolSize == 0x40000);
     Require(sceSslGetMemoryPoolStats(ssl, nullptr) == sslInvalidValue);
     Require(sceSslGetMemoryPoolStats(12345, nullptr) == sslInvalidValue);
     CheckRejected(sceSslGetMemoryPoolStats, 12345, sslInvalidId);
@@ -63,7 +44,8 @@ int main() {
 
     const int http2 = sceHttp2Init(1, ssl, 0x40000, 1);
     Require(http2 > 0);
-    Require(sceHttp2GetMemoryPoolStats(http2, &stats) == 0 && stats.pool_size == 0x40000);
+    Http2MemoryPoolStats http2Stats{};
+    Require(sceHttp2GetMemoryPoolStats(http2, &http2Stats) == 0 && http2Stats.pool_size == 0x40000);
     Require(sceHttp2GetMemoryPoolStats(http2, nullptr) == http2NullPointer);
     Require(sceHttp2GetMemoryPoolStats(12345, nullptr) == http2NullPointer);
     CheckRejected(sceHttp2GetMemoryPoolStats, 12345, http2InvalidId);
@@ -76,14 +58,17 @@ int main() {
 
     const int pool = sceNetPoolCreate("stats", 0x20000, 0);
     Require(pool > 0);
-    NetPoolStats netStats{};
+    NetMemoryPoolStats netStats{};
     Require(sceNetGetMemoryPoolStats(pool, &netStats) == 0 && netStats.pool_size == 0x20000);
     Require(sceNetGetMemoryPoolStats(pool, nullptr) == netInvalid);
     Require(sceNetGetMemoryPoolStats(12345, nullptr) == netBadDescriptor);
-    std::array<unsigned char, 0x20> untouched;
-    untouched.fill(0x5a);
+    struct {
+        NetMemoryPoolStats stats;
+        std::array<unsigned char, 8> guard;
+    } untouched;
+    std::memset(&untouched, 0x5a, sizeof(untouched));
     auto buffer = untouched;
-    Require(sceNetGetMemoryPoolStats(12345, buffer.data()) == netBadDescriptor && buffer == untouched);
+    Require(sceNetGetMemoryPoolStats(12345, &buffer.stats) == netBadDescriptor && std::memcmp(&buffer, &untouched, sizeof(buffer)) == 0);
     Require(sceNetPoolDestroy(pool) == 0);
     Require(sceNetGetMemoryPoolStats(pool, nullptr) == netBadDescriptor);
     return 0;
diff --git a/core/libs/tests/GuestMemrchr.cpp b/core/libs/tests/GuestMemrchr.cpp
index 8715e30bf2..6f09c1f987 100644
--- a/core/libs/tests/GuestMemrchr.cpp
+++ b/core/libs/tests/GuestMemrchr.cpp
@@ -1,10 +1,7 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 
-extern "C" {
-void* APS5_VABI memrchr_nid_postfix(const void*, int, std::size_t);
-}
-
 int main() {
     const unsigned char bytes[] = {0xff, 0x01, 0xff, 0x00};
     const auto* found = static_cast<const unsigned char*>(memrchr_nid_postfix(bytes, 0xff, sizeof(bytes)));
diff --git a/core/libs/tests/GuestMessageDestructorAbi.cpp b/core/libs/tests/GuestMessageDestructorAbi.cpp
index 8c55dbc490..90d524adf0 100644
--- a/core/libs/tests/GuestMessageDestructorAbi.cpp
+++ b/core/libs/tests/GuestMessageDestructorAbi.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <cstdio>
 #include <cstring>
@@ -10,10 +11,10 @@ using GuestDestroy = void (APS5_VABI *)(void*);
 using HostDestroy = void (*)(void*);
 using GuestThrowFunction = void (APS5_VABI *)(std::uintptr_t);
 struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
-struct Object { const void* vtable; const char* message; };
+
 struct Table { std::ptrdiff_t offset; const TypeRecord* type; GuestDestroy destroy; GuestDestroy deleteObject; GuestWhat what; };
 struct Message { std::size_t length; std::size_t capacity; std::atomic<std::ptrdiff_t> references; };
-static_assert(sizeof(Object) == 16);
+static_assert(sizeof(LibcException::ExceptionObject) == 16);
 
 extern "C" {
 extern const unsigned char _ZTVN10__cxxabiv117__class_type_infoE_nid_postfix[];
@@ -22,22 +23,12 @@ extern const unsigned char _ZTISt12out_of_range_nid_postfix[];
 extern const unsigned char _ZTISt11regex_error_nid_postfix[];
 extern const unsigned char _ZTISt13runtime_error_nid_postfix[];
 extern const unsigned char _ZTISt11logic_error_nid_postfix[];
-void APS5_VABI _ZNSt12out_of_rangeC1EPKc_nid_postfix(Object*, const char*);
-void APS5_VABI _ZNSt12out_of_rangeC1ERKS__nid_postfix(Object*, const Object*);
-void APS5_VABI _ZNSt12out_of_rangeD1Ev_nid_postfix(Object*);
-void APS5_VABI _ZNSt11logic_errorC1EPKc_nid_postfix(Object*, const char*);
-void APS5_VABI _ZNSt11logic_errorD1Ev_nid_postfix(Object*);
-[[noreturn]] void APS5_VABI _ZSt14_Xout_of_rangePKc_nid_postfix(const char*);
-[[noreturn]] void APS5_VABI _ZSt15_Xruntime_errorPKc_nid_postfix(const char*);
-[[noreturn]] void APS5_VABI _ZNKSt11logic_error8_DoraiseEv_nid_postfix(const Object*);
-[[noreturn]] void APS5_VABI _ZSt13_Xregex_errorNSt15regex_constants10error_typeE_nid_postfix(std::regex_constants::error_type);
+
 int APS5_VABI GuestOuter();
 void APS5_VABI GuestCleanup();
 void APS5_VABI GuestStdCapture();
 void APS5_VABI ProbeDestroy(GuestDestroy, void*, void*);
 const char* APS5_VABI ProbeWhat(GuestWhat, const void*, const void*);
-void APS5_VABI _ZNSt8bad_castC1Ev_nid_postfix(Object*);
-void APS5_VABI _ZNSt9bad_allocC1Ev_nid_postfix(Object*);
 
 TypeRecord FixtureBaseType{_ZTVN10__cxxabiv117__class_type_infoE_nid_postfix + 16, "11FixtureBase", nullptr};
 TypeRecord FixtureErrorType{_ZTVN10__cxxabiv120__si_class_type_infoE_nid_postfix + 16, "12FixtureError", &FixtureBaseType};
@@ -56,7 +47,7 @@ unsigned FixtureWhatChecked = 0;
     std::fprintf(stderr, "guest exception failure %u\n", code);
     ExitProcess(code);
 }
-const char* APS5_VABI FixtureWhat(const void* object) { return static_cast<const Object*>(object)->message; }
+const char* APS5_VABI FixtureWhat(const void* object) { return static_cast<const LibcException::ExceptionObject*>(object)->message; }
 void APS5_VABI FixtureDestroy(void* object) {
     if (object != FixtureLastObject) FixtureFail(11);
     ++FixtureDestroyed;
@@ -68,7 +59,7 @@ void APS5_VABI FixtureCheckWhat(const char* message) {
 }
 }
 
-static Object decoy{}, retained{};
+static LibcException::ExceptionObject decoy{}, retained{};
 static GuestDestroy registeredDestructor;
 static void* expectedObject;
 static void* poison;
@@ -129,18 +120,20 @@ static int TestVtable(const char* mode) {
     const bool plain = std::strstr(mode, "plain") != nullptr;
     const bool deleting = std::strstr(mode, "delete") != nullptr;
     const bool destroying = deleting || std::strstr(mode, "destroy") != nullptr;
-    auto* actual = static_cast<Object*>(std::malloc(sizeof(Object)));
-    auto* other = static_cast<Object*>(std::malloc(sizeof(Object)));
+    auto* actual = static_cast<LibcException::ExceptionObject*>(std::malloc(sizeof(LibcException::ExceptionObject)));
+    auto* other = static_cast<LibcException::ExceptionObject*>(std::malloc(sizeof(LibcException::ExceptionObject)));
     if (!actual || !other) FixtureFail(57);
     actual->message = other->message = nullptr;
     if (plain) {
         _ZNSt9bad_allocC1Ev_nid_postfix(actual);
         _ZNSt8bad_castC1Ev_nid_postfix(other);
+
     } else {
         _ZNSt12out_of_rangeC1EPKc_nid_postfix(actual, "actual virtual message");
         _ZNSt12out_of_rangeC1EPKc_nid_postfix(other, "unrelated virtual message");
+
     }
-    const Object originalOther = *other;
+    const LibcException::ExceptionObject originalOther = *other;
     watchedObject = actual;
     watchedMessage = plain ? nullptr : reinterpret_cast<Message*>(const_cast<char*>(actual->message)) - 1;
     foreignObject = other;
@@ -168,20 +161,21 @@ static int TestVtable(const char* mode) {
     if (!plain) {
         if (!deleting) _ZNSt12out_of_rangeD1Ev_nid_postfix(actual);
         _ZNSt12out_of_rangeD1Ev_nid_postfix(other);
+
     }
     if (!deleting) std::free(actual);
     std::free(other);
     return 0;
 }
 
-static Message* MessageHeader(const Object& object) {
+static Message* MessageHeader(const LibcException::ExceptionObject& object) {
     return reinterpret_cast<Message*>(const_cast<char*>(object.message)) - 1;
 }
 
 extern "C" void APS5_VABI ObserveDestroy(void* pointer) {
     if (pointer != expectedObject || ++callbacks != 1) FixtureFail(40);
     ProbeDestroy(registeredDestructor, pointer, poison);
-    if (static_cast<Object*>(pointer)->message != nullptr ||
+    if (static_cast<LibcException::ExceptionObject*>(pointer)->message != nullptr ||
         !decoy.message || std::strcmp(decoy.message, "unrelated message") ||
         (keepMessage && MessageHeader(retained)->references.load() != 0)) FixtureFail(41);
 }
@@ -191,12 +185,13 @@ extern "C" void APS5_VABI FixtureInspect(void* pointer) {
     if (header->_pad != 0 || !header->destructor) FixtureFail(42);
     expectedObject = pointer;
     GuestWhat what;
-    std::memcpy(&what, static_cast<const unsigned char*>(static_cast<Object*>(pointer)->vtable) +
+    std::memcpy(&what, static_cast<const unsigned char*>(static_cast<LibcException::ExceptionObject*>(pointer)->vtable) +
         2 * sizeof(void*), sizeof(what));
     const char* message = ProbeWhat(what, pointer, poison);
     if (!message || std::strcmp(message, expectedMessage)) FixtureFail(62);
     if (keepMessage) {
-        _ZNSt12out_of_rangeC1ERKS__nid_postfix(&retained, static_cast<Object*>(pointer));
+        _ZNSt12out_of_rangeC1ERKS__nid_postfix(&retained, static_cast<LibcException::ExceptionObject*>(pointer));
+
         if (MessageHeader(retained)->references.load() != 1) FixtureFail(43);
     }
     registeredDestructor = reinterpret_cast<GuestDestroy>(header->destructor);
@@ -255,7 +250,7 @@ int main(int argc, char** argv) {
     regularRelease = std::strcmp(argv[1], "release") == 0;
     keepMessage = std::strstr(argv[1], "unshared") == nullptr;
     FixtureArgument = reinterpret_cast<std::uintptr_t>(FixtureMessage);
-    Object raised{};
+    LibcException::ExceptionObject raised{};
     if (regex) {
         expectedMessage = "regular expression error";
         FixtureStdOutType = _ZTISt11regex_error_nid_postfix;
@@ -267,12 +262,14 @@ int main(int argc, char** argv) {
         FixtureThrow = reinterpret_cast<GuestThrowFunction>(_ZSt15_Xruntime_errorPKc_nid_postfix);
     } else if (doraise) {
         _ZNSt11logic_errorC1EPKc_nid_postfix(&raised, FixtureMessage);
+
         expectedMessage = FixtureMessage;
         FixtureStdOutType = _ZTISt11logic_error_nid_postfix;
         FixtureThrow = reinterpret_cast<GuestThrowFunction>(_ZNKSt11logic_error8_DoraiseEv_nid_postfix);
         FixtureArgument = reinterpret_cast<std::uintptr_t>(&raised);
     }
     _ZNSt12out_of_rangeC1EPKc_nid_postfix(&decoy, "unrelated message");
+
     poison = std::strstr(argv[1], "zero") ? nullptr : &decoy;
     GuestStdCapture();
     const char* expected = regex ? "regular expression error" : FixtureMessage;
@@ -282,6 +279,7 @@ int main(int argc, char** argv) {
         !decoy.message || std::strcmp(decoy.message, "unrelated message")) return 44;
     _ZNSt12out_of_rangeD1Ev_nid_postfix(&retained);
     _ZNSt12out_of_rangeD1Ev_nid_postfix(&decoy);
+
     if (doraise) _ZNSt11logic_errorD1Ev_nid_postfix(&raised);
     if (retained.message || decoy.message || (doraise && raised.message)) return 45;
     std::puts("guest message callback, retained ownership and release: PASS");
diff --git a/core/libs/tests/GuestMktime.cpp b/core/libs/tests/GuestMktime.cpp
index 97d72aeaa9..f3e74a4a6b 100644
--- a/core/libs/tests/GuestMktime.cpp
+++ b/core/libs/tests/GuestMktime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,14 +10,6 @@
 #include <cstring>
 #include <limits>
 
-extern "C" {
-std::int64_t APS5_VABI libc_mktime_nid_postfix(GuestTm*);
-std::int64_t APS5_VABI mktime_nid_postfix(GuestTm*);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-void APS5_VABI tzset_nid_postfix();
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-}
-
 using Converter = std::int64_t (APS5_VABI *)(GuestTm*);
 
 static void Require(bool value, const char* message) {
@@ -67,6 +61,7 @@ static void CheckFailure(Converter convert) {
 static void CheckZone(const char* zone) {
     Require(setenv_nid_postfix("TZ", zone, 1) == 0, "Could not set the time zone");
     tzset_nid_postfix();
+
     constexpr std::array<Converter, 2> converters{libc_mktime_nid_postfix, mktime_nid_postfix};
     constexpr std::array<std::int64_t, 8> timers{-86401, -2, -1, 0, 1, 59, 60, 86400};
     for (auto convert : converters) {
diff --git a/core/libs/tests/GuestMlock.cpp b/core/libs/tests/GuestMlock.cpp
index 79b571e9b2..71883b2b4c 100644
--- a/core/libs/tests/GuestMlock.cpp
+++ b/core/libs/tests/GuestMlock.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -15,17 +17,6 @@
 #include <string>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI mlock_nid_postfix(const void*, std::size_t);
-int APS5_VABI munlock_nid_postfix(const void*, std::size_t);
-int APS5_VABI mlockall_nid_postfix(int);
-int APS5_VABI munlockall_nid_postfix();
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void RequireLockAllInvalid(int flags) {
@@ -37,6 +28,7 @@ static void RequireLockAllUnsupported(int flags) {
     bool rejected = false;
     try {
         mlockall_nid_postfix(flags);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -140,9 +132,9 @@ int main() {
     *__error_nid_postfix() = untouched;
     Require(munlock_nid_postfix(reserved, page) == 0);
     Require(*__error_nid_postfix() == untouched);
-    Require(sceKernelMunmap(reserved, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page) == 0);
 
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
 #ifndef ANYPS5_ENABLE_ASAN
     *__error_nid_postfix() = 0;
     Require(mlock_nid_postfix(mapped, page) == -1 && *__error_nid_postfix() == 12);
diff --git a/core/libs/tests/GuestModuleInfo.cpp b/core/libs/tests/GuestModuleInfo.cpp
index d596bf0280..85dd43c3fb 100644
--- a/core/libs/tests/GuestModuleInfo.cpp
+++ b/core/libs/tests/GuestModuleInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <algorithm>
@@ -11,18 +12,7 @@
 #include <source_location>
 #include <string>
 #include <vector>
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t, int, ModuleInfoEx*);
-int APS5_VABI sceKernelGetModuleList(KernelModule*, std::size_t, std::size_t*);
-int APS5_VABI sceKernelGetModuleInfo(KernelModule, ModuleInfo*);
-int APS5_VABI sceKernelGetModuleList2(KernelModule*, std::size_t, std::size_t*);
-int APS5_VABI sceKernelGetModuleInfo2(KernelModule, ModuleInfo*);
-std::int32_t APS5_VABI sceKernelGetLibkernelTextLocation_nid_postfix(void**, std::size_t*);
-std::int32_t APS5_VABI sceKernelInternalMemoryGetModuleSegmentInfo_nid_postfix(InternalSegmentInfo*);
-}
+
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (!value) {
         std::fprintf(stderr, "module info check failed at line %u\n", location.line());
@@ -41,7 +31,7 @@ static bool ThrowsInvalidArgument(TFunction function) {
 static ModuleInfoEx Query(const void* address, int expected) {
     ModuleInfoEx info{};
     info.st_size = sizeof(ModuleInfoEx);
-    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 2, &info) == expected);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 1, &info) == expected);
     return info;
 }
 int main(int argc, char** argv) {
@@ -51,7 +41,7 @@ int main(int argc, char** argv) {
     const void* add = dlsym_nid_postfix(module, "GuestModuleAdd");
     Require(add != nullptr);
     const auto info = Query(add, 0);
-    Require(info.st_size == sizeof(ModuleInfoEx));
+    Require(info.st_size == 0);
     Require(info.id == static_cast<KernelModule>(reinterpret_cast<std::intptr_t>(module)));
     Require(std::string(info.name) == std::string(argv[1]).substr(std::string(argv[1]).find_last_of("/\\") + 1));
     Require(info.segment_count > 0 && info.segment_count <= 4 && info.ref_count == 1);
@@ -169,10 +159,34 @@ int main(int argc, char** argv) {
     Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     ModuleInfoEx invalid{};
     invalid.st_size = sizeof(ModuleInfoEx);
-    Require(ThrowsInvalidArgument([&] { sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 1, &invalid); }));
+    for (const int flags : {-1, 0, 3, 4, 8}) {
+        std::memset(&invalid, 0xbb, sizeof(invalid));
+        Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), flags, &invalid) == SCE_KERNEL_ERROR_EINVAL);
+        Require(std::all_of(reinterpret_cast<const unsigned char*>(&invalid), reinterpret_cast<const unsigned char*>(&invalid + 1), [](unsigned char value) { return value == 0; }));
+    }
+    Require(ThrowsInvalidArgument([&] { sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 0, nullptr); }));
+    std::vector<KernelModule> everyModule(64);
+    std::vector<KernelModule> titleOnlyModules(64);
+    std::size_t everyCount = 0;
+    std::size_t titleOnlyCount = 0;
+    Require(sceKernelGetModuleList(everyModule.data(), everyModule.size(), &everyCount) == 0);
+    Require(sceKernelGetModuleList2(titleOnlyModules.data(), titleOnlyModules.size(), &titleOnlyCount) == 0);
+    const auto systemModule = std::find_if(everyModule.begin(), everyModule.begin() + static_cast<std::ptrdiff_t>(everyCount),
+        [&](KernelModule handle) { return std::find(titleOnlyModules.begin(), titleOnlyModules.begin() + static_cast<std::ptrdiff_t>(titleOnlyCount), handle) == titleOnlyModules.begin() + static_cast<std::ptrdiff_t>(titleOnlyCount); });
+    Require(systemModule != everyModule.begin() + static_cast<std::ptrdiff_t>(everyCount));
+    ModuleInfo systemInfo{};
+    systemInfo.st_size = sizeof(ModuleInfo);
+    Require(sceKernelGetModuleInfo(*systemModule, &systemInfo) == 0 && systemInfo.segment_count > 0);
+    const auto systemAddress = static_cast<std::uintptr_t>(systemInfo.segments[0].address);
+    ModuleInfoEx anyModule{};
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(&Query), 2, &anyModule) == 0 && anyModule.segment_count > 0 && anyModule.st_size == 0);
+    Require(sceKernelGetModuleInfoFromAddr(systemAddress, 1, &anyModule) == 0 && anyModule.id == *systemModule);
+    std::memset(&anyModule, 0xbb, sizeof(anyModule));
+    Require(sceKernelGetModuleInfoFromAddr(systemAddress, 2, &anyModule) == SCE_KERNEL_ERROR_ESRCH && anyModule.segment_count == 0 && anyModule.name[0] == 0);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 1, &anyModule) == 0 && anyModule.id == info.id);
     ModuleInfoEx unset{};
     unset.st_size = 0xf0000;
-    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 2, &unset) == 0 && unset.st_size == sizeof(ModuleInfoEx));
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 1, &unset) == 0 && unset.st_size == 0);
     const auto again = Query(add, 0);
     Require(again.eh_frame_hdr_addr == info.eh_frame_hdr_addr && again.eh_frame_hdr_size == info.eh_frame_hdr_size);
     Require(again.eh_frame_addr == info.eh_frame_addr && again.eh_frame_size == info.eh_frame_size);
diff --git a/core/libs/tests/GuestMove.cpp b/core/libs/tests/GuestMove.cpp
index ad027c999f..98d1e59b72 100644
--- a/core/libs/tests/GuestMove.cpp
+++ b/core/libs/tests/GuestMove.cpp
@@ -1,23 +1,10 @@
+#include "prx/libSceMove/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceMoveInit(void);
-int APS5_VABI sceMoveTerm(void);
-int APS5_VABI sceMoveOpen(std::int32_t userId, std::int32_t type, std::int32_t index);
-int APS5_VABI sceMoveClose(std::int32_t handle);
-int APS5_VABI sceMoveGetDeviceInfo(std::int32_t handle, void* info);
-int APS5_VABI sceMoveGetExtensionPortInfo(std::int32_t handle, void* data);
-int APS5_VABI sceMoveReadStateLatest(std::int32_t handle, void* data);
-int APS5_VABI sceMoveReadStateRecent(std::int32_t handle, std::int64_t timestamp, void* data, std::int32_t* outCount);
-int APS5_VABI sceMoveSetVibration(std::int32_t handle, std::uint8_t motor);
-int APS5_VABI sceMoveSetLightSphere(std::int32_t handle, std::uint8_t red, std::uint8_t green, std::uint8_t blue);
-int APS5_VABI sceMoveResetLightSphere(std::int32_t handle);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestMprotectUnmapped.cpp b/core/libs/tests/GuestMprotectUnmapped.cpp
index 8a4ed05199..326051d6ab 100644
--- a/core/libs/tests/GuestMprotectUnmapped.cpp
+++ b/core/libs/tests/GuestMprotectUnmapped.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "SceTypes.hpp"
@@ -6,16 +8,6 @@
 #include <cstdlib>
 #include <exception>
 
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMtypeprotect(const void*, std::size_t, int, int);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr std::size_t Page = 0x4000;
diff --git a/core/libs/tests/GuestMsgDialogNative.cpp b/core/libs/tests/GuestMsgDialogNative.cpp
index 8842c84299..21383b3c87 100644
--- a/core/libs/tests/GuestMsgDialogNative.cpp
+++ b/core/libs/tests/GuestMsgDialogNative.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -5,16 +6,7 @@
 
 extern "C" {
 extern int SceMsgDialogNativeModuleLoaded_nid_no_patch;
-int APS5_VABI sceMsgDialogInitialize(void);
-int APS5_VABI sceMsgDialogOpen(const void* param);
-int APS5_VABI sceMsgDialogGetStatus(void);
-int APS5_VABI sceMsgDialogUpdateStatus(void);
-int APS5_VABI sceMsgDialogGetResult(MsgDialogResult* result);
-int APS5_VABI sceMsgDialogClose(void);
-int APS5_VABI sceMsgDialogTerminate(void);
-int APS5_VABI sceMsgDialogProgressBarInc(int target, std::uint32_t delta);
-int APS5_VABI sceMsgDialogProgressBarSetMsg(int target, const char* msg);
-int APS5_VABI sceMsgDialogProgressBarSetValue(int target, std::uint32_t rate);
+
 }
 
 namespace {
diff --git a/core/libs/tests/GuestMsync.cpp b/core/libs/tests/GuestMsync.cpp
index 451dd44583..e5dc64d5ce 100644
--- a/core/libs/tests/GuestMsync.cpp
+++ b/core/libs/tests/GuestMsync.cpp
@@ -1,18 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <limits>
 #include <source_location>
-#include <stdexcept>
-
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI msync_nid_postfix(void*, std::size_t, int);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
 
 namespace {
 constexpr std::size_t Page = 0x4000;
@@ -23,6 +16,7 @@ constexpr int Async = 0x1;
 constexpr int Invalidate = 0x2;
 constexpr int Invalid = 22;
 constexpr int NoMemory = 12;
+constexpr int Busy = 16;
 
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (condition) return;
@@ -40,15 +34,6 @@ bool Fails(void* address, std::size_t length, int flags, int error) {
     return msync_nid_postfix(address, length, flags) == -1 && *__error_nid_postfix() == error;
 }
 
-bool Throws(void* address, std::size_t length, int flags) {
-    try {
-        msync_nid_postfix(address, length, flags);
-    } catch (const std::runtime_error&) {
-        return true;
-    }
-    return false;
-}
-
 char* Map(std::size_t pages) {
     void* mapped = mmap_nid_postfix(nullptr, pages * Page, ReadWrite, PrivateAnonymous, -1, 0);
     Require(mapped != reinterpret_cast<void*>(static_cast<std::uintptr_t>(-1)));
@@ -69,7 +54,11 @@ int main() {
     Require(Fails(mapped, Page, Async | Invalidate, Invalid));
     const auto top = std::numeric_limits<std::uintptr_t>::max() & ~(Page - 1);
     Require(Fails(reinterpret_cast<void*>(top), 2 * Page, Sync, Invalid));
-    Require(Throws(mapped, Page, Invalidate));
+    Require(Fails(mapped, Page, Invalidate, Busy));
+    Require(Fails(mapped, 3 * Page, Sync | Invalidate, Busy));
+    Require(Fails(mapped + 1, 16, Invalidate, Busy));
+    Require(Fails(mapped, 0, Invalidate, Busy));
+    Require(Succeeds(mapped, Page, 0x8));
 
     Require(munmap_nid_postfix(mapped, 3 * Page) == 0);
     Require(Fails(mapped, Page, Sync, NoMemory));
diff --git a/core/libs/tests/GuestMultibyteLocale.cpp b/core/libs/tests/GuestMultibyteLocale.cpp
index 60a4a52808..682521486d 100644
--- a/core/libs/tests/GuestMultibyteLocale.cpp
+++ b/core/libs/tests/GuestMultibyteLocale.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,21 +6,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-std::size_t APS5_VABI mbrtowc_nid_postfix(std::uint16_t*, const char*, std::size_t, void*);
-std::size_t APS5_VABI mbrlen_nid_postfix(const char*, std::size_t, void*);
-int APS5_VABI mbtowc_nid_postfix(std::uint16_t*, const char*, std::size_t);
-int APS5_VABI mblen_nid_postfix(const char*, std::size_t);
-std::size_t APS5_VABI wcrtomb_nid_postfix(char*, std::uint16_t, void*);
-int APS5_VABI wctomb_nid_postfix(char*, std::uint16_t);
-int APS5_VABI mbsinit_nid_postfix(const void*);
-int APS5_VABI _Getmbcurmax_nid_postfix();
-std::size_t APS5_VABI mbstowcs_nid_postfix(std::uint16_t*, const char*, std::size_t);
-std::size_t APS5_VABI wcstombs_nid_postfix(char*, const std::uint16_t*, std::size_t);
-std::size_t APS5_VABI mbsrtowcs_nid_postfix(std::uint16_t*, const char**, std::size_t, void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 constexpr auto Invalid = static_cast<std::size_t>(-1);
 constexpr auto Incomplete = static_cast<std::size_t>(-2);
 
@@ -83,6 +69,7 @@ static void CheckState() {
     Require(mbtowc_nid_postfix(&value, "\xa9", 1) == 1 && value == 0xe9, "mbtowc keeps the partial character");
     Require(mbtowc_nid_postfix(&value, "\xe2\x82\xac", 8) == 3 && value == 0x20ac, "mbtowc limits the count to three bytes");
     mbtowc_nid_postfix(&value, "\xc3", 1);
+
     Require(mbtowc_nid_postfix(nullptr, nullptr, 0) == 0 && mbtowc_nid_postfix(&value, "A", 1) == 1, "a null string resets mbtowc");
     Require(mblen_nid_postfix("\xc3", 1) == -1 && mblen_nid_postfix("\xa9", 1) == -1, "mblen keeps no state");
     Require(mblen_nid_postfix("\xe2\x82\xac", 3) == 3 && mblen_nid_postfix(nullptr, 0) == 0, "mblen");
diff --git a/core/libs/tests/GuestMutexContention.cpp b/core/libs/tests/GuestMutexContention.cpp
index dbb0da5e2f..648e403aa7 100644
--- a/core/libs/tests/GuestMutexContention.cpp
+++ b/core/libs/tests/GuestMutexContention.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -11,19 +13,6 @@
 #include <vector>
 #include <windows.h>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr*);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr*, int);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr*);
-int APS5_VABI scePthreadMutexInit(PthreadMutex*, const PthreadMutexattr*, const char*);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex*);
-int APS5_VABI scePthreadMutexLock(PthreadMutex*);
-int APS5_VABI scePthreadMutexTimedlock(PthreadMutex*, KernelUseconds);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex*);
-}
-
 namespace {
 
 using Clock = std::chrono::steady_clock;
diff --git a/core/libs/tests/GuestMutexRaiseException.cpp b/core/libs/tests/GuestMutexRaiseException.cpp
index ecdd471b4e..6bfa05b6ac 100644
--- a/core/libs/tests/GuestMutexRaiseException.cpp
+++ b/core/libs/tests/GuestMutexRaiseException.cpp
@@ -1,52 +1,42 @@
-#include "SceTypes.hpp"
-#include <atomic>
-#include <chrono>
-#include <cstdlib>
-#include <mutex>
-#include <thread>
-
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI scePthreadMutexInit(PthreadMutex*, const PthreadMutexattr*, const char*);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex*);
-int APS5_VABI scePthreadMutexLock(PthreadMutex*);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex*);
-int APS5_VABI sceKernelInstallExceptionHandler(int, void*);
-int APS5_VABI sceKernelRemoveExceptionHandler(int);
-int APS5_VABI sceKernelRaiseException(Pthread, int);
-}
-
-static constexpr int SigUsr1 = 30;
-static void Require(bool value) { if (!value) std::abort(); }
-static std::atomic<int> deliveries{0};
-static void APS5_VABI Handler(int, void*) { deliveries.fetch_add(1); }
-
-struct Context { PthreadMutex mutex = nullptr; std::atomic<bool> started{false}; std::atomic<bool> acquired{false}; };
-static void* APS5_VABI Worker(void* opaque) {
-    auto& context = *static_cast<Context*>(opaque);
-    context.started.store(true);
-    Require(scePthreadMutexLock(&context.mutex) == 0);
-    context.acquired.store(true);
-    Require(scePthreadMutexUnlock(&context.mutex) == 0);
-    return nullptr;
-}
-
-int main() {
-    Require(sceKernelInstallExceptionHandler(SigUsr1, reinterpret_cast<void*>(&Handler)) == 0);
-    Context context;
-    Require(scePthreadMutexInit(&context.mutex, nullptr, nullptr) == 0);
-    Require(scePthreadMutexLock(&context.mutex) == 0);
-    Pthread worker = nullptr;
-    Require(scePthreadCreate(&worker, nullptr, Worker, &context, "mutex wait") == 0);
-    while (!context.started.load()) std::this_thread::yield();
-    std::this_thread::sleep_for(std::chrono::milliseconds(10));
-    Require(sceKernelRaiseException(worker, SigUsr1) == 0);
-    for (int i = 0; i < 5000 && deliveries.load() == 0; ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
-    Require(deliveries.load() == 1);
-    Require(scePthreadMutexUnlock(&context.mutex) == 0);
-    Require(scePthreadJoin(worker, nullptr) == 0);
-    Require(context.acquired.load());
-    Require(scePthreadMutexDestroy(&context.mutex) == 0);
-    Require(sceKernelRemoveExceptionHandler(SigUsr1) == 0);
-}
\ No newline at end of file
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "SceTypes.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdlib>
+#include <mutex>
+#include <thread>
+
+static constexpr int SigUsr1 = 30;
+static void Require(bool value) { if (!value) std::abort(); }
+static std::atomic<int> deliveries{0};
+static void APS5_VABI Handler(int, void*) { deliveries.fetch_add(1); }
+
+struct Context { PthreadMutex mutex = nullptr; std::atomic<bool> started{false}; std::atomic<bool> acquired{false}; };
+static void* APS5_VABI Worker(void* opaque) {
+    auto& context = *static_cast<Context*>(opaque);
+    context.started.store(true);
+    Require(scePthreadMutexLock(&context.mutex) == 0);
+    context.acquired.store(true);
+    Require(scePthreadMutexUnlock(&context.mutex) == 0);
+    return nullptr;
+}
+
+int main() {
+    Require(sceKernelInstallExceptionHandler(SigUsr1, reinterpret_cast<void*>(&Handler)) == 0);
+    Context context;
+    Require(scePthreadMutexInit(&context.mutex, nullptr, nullptr) == 0);
+    Require(scePthreadMutexLock(&context.mutex) == 0);
+    Pthread worker = nullptr;
+    Require(scePthreadCreate(&worker, nullptr, Worker, &context, "mutex wait") == 0);
+    while (!context.started.load()) std::this_thread::yield();
+    std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    Require(sceKernelRaiseException(worker, SigUsr1) == 0);
+    for (int i = 0; i < 5000 && deliveries.load() == 0; ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    Require(deliveries.load() == 1);
+    Require(scePthreadMutexUnlock(&context.mutex) == 0);
+    Require(scePthreadJoin(worker, nullptr) == 0);
+    Require(context.acquired.load());
+    Require(scePthreadMutexDestroy(&context.mutex) == 0);
+    Require(sceKernelRemoveExceptionHandler(SigUsr1) == 0);
+}
diff --git a/core/libs/tests/GuestNamedShmConcurrency.cpp b/core/libs/tests/GuestNamedShmConcurrency.cpp
index 5dc2e7e350..da44c93dba 100644
--- a/core/libs/tests/GuestNamedShmConcurrency.cpp
+++ b/core/libs/tests/GuestNamedShmConcurrency.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -14,16 +16,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI fchmod_nid_postfix(int, int);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 using Unlink = int (*)(const char*);
 constexpr std::int64_t Page = 0x4000;
diff --git a/core/libs/tests/GuestNamedShmDescriptorReuse.cpp b/core/libs/tests/GuestNamedShmDescriptorReuse.cpp
index e2b7263e23..6af68772cb 100644
--- a/core/libs/tests/GuestNamedShmDescriptorReuse.cpp
+++ b/core/libs/tests/GuestNamedShmDescriptorReuse.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -15,17 +17,6 @@
 #include <unistd.h>
 #include <vector>
 
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 constexpr int ReadWrite = 2;
 constexpr int Create = 0x200;
diff --git a/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp b/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp
index 368fb3cc60..088119df94 100644
--- a/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp
+++ b/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -14,19 +16,6 @@
 #include <sys/syscall.h>
 #include <unistd.h>
 
-struct GuestIovec { void* base; std::size_t length; };
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
 namespace {
 int original = -1;
 int replacement = -1;
@@ -76,7 +65,7 @@ void Run(int operation, int boundary) {
     swapped = false;
     armed = true;
     char payload[] = "bad!";
-    GuestIovec vector{payload, 4};
+    KernelIovec vector{payload, 4};
     std::int64_t result = 0;
     switch (operation) {
     case 0: result = write_nid_postfix(original, payload, 4); break;
@@ -115,6 +104,9 @@ extern "C" ssize_t readlink(const char* path, char* buffer, std::size_t length)
     }
     return result;
 }
+extern "C" ssize_t __readlink_chk(const char* path, char* buffer, std::size_t length, std::size_t) {
+    return readlink(path, buffer, length);
+}
 extern "C" int flock(int descriptor, int operation) {
     const int result = static_cast<int>(::syscall(SYS_flock, descriptor, operation));
     if (result == 0 && operation == LOCK_EX && armed && !replaceAtProbe && !replaceBeforeProbe && !swapped) {
diff --git a/core/libs/tests/GuestNamedShmLifecycle.cpp b/core/libs/tests/GuestNamedShmLifecycle.cpp
index a5c26b8bee..4c14b9cc3c 100644
--- a/core/libs/tests/GuestNamedShmLifecycle.cpp
+++ b/core/libs/tests/GuestNamedShmLifecycle.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
@@ -15,31 +17,6 @@
 #include <sys/mman.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int APS5_VABI dup2_nid_postfix(int, int);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const struct GuestIovec*, int);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const struct GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
-struct GuestIovec {
-    void* base;
-    std::size_t length;
-};
-
 namespace {
 constexpr int ReadOnly = 0;
 constexpr int ReadWrite = 2;
@@ -115,7 +92,7 @@ void Run() {
     Require(write_nid_postfix(descriptor, "xy", 2) == 1, "cross-EOF write did not return its short length");
     Require(lseek_nid_postfix(descriptor, 0, SEEK_END) == static_cast<std::int64_t>(Page), "cross-EOF write changed object size");
     char vectorBytes[] = "uv";
-    GuestIovec vectorWrite{vectorBytes, 2};
+    KernelIovec vectorWrite{vectorBytes, 2};
     Require(pwritev_nid_postfix(descriptor, nullptr, 0, Page) == 0, "zero-vector positioned write on a writable descriptor failed");
     Require(pwritev_nid_postfix(descriptor, &vectorWrite, 1, Page) == 0, "positioned vector write at EOF grew the object");
     Require(pwritev_nid_postfix(descriptor, &vectorWrite, 1, Page - 1) == 1, "positioned vector write past EOF was not short");
diff --git a/core/libs/tests/GuestNamedShmOpen.cpp b/core/libs/tests/GuestNamedShmOpen.cpp
index dc6cebf447..82abbb8a07 100644
--- a/core/libs/tests/GuestNamedShmOpen.cpp
+++ b/core/libs/tests/GuestNamedShmOpen.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "nid/Sha1.hpp"
 #include <cstdio>
@@ -10,9 +12,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Require(bool value, const char* message) {
     if (!value) {
         throw std::runtime_error(std::string(message) + " (guest errno=" + std::to_string(*__error_nid_postfix()) + ")");
diff --git a/core/libs/tests/GuestNamedShmPermissions.cpp b/core/libs/tests/GuestNamedShmPermissions.cpp
index c6f8d4c1bf..332d7f6441 100644
--- a/core/libs/tests/GuestNamedShmPermissions.cpp
+++ b/core/libs/tests/GuestNamedShmPermissions.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "nid/Sha1.hpp"
 #include <cstdint>
@@ -9,9 +11,6 @@
 #include <unistd.h>
 #include <vector>
 
-extern "C" int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-extern "C" std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t);
-
 static void Require(bool condition, const char* message) {
     if (!condition) throw std::runtime_error(message);
 }
diff --git a/core/libs/tests/GuestNamedShmWindows.cpp b/core/libs/tests/GuestNamedShmWindows.cpp
new file mode 100644
index 0000000000..401ac8df2e
--- /dev/null
+++ b/core/libs/tests/GuestNamedShmWindows.cpp
@@ -0,0 +1,614 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/File/include/SharedMemory.hpp"
+#include "nid/Sha1.hpp"
+#include <windows.h>
+#include <aclapi.h>
+#include <io.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <cwchar>
+#include <filesystem>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <system_error>
+#include <thread>
+#include <utility>
+#include <vector>
+#include <barrier>
+#include <algorithm>
+
+
+namespace {
+constexpr int ReadOnly = 0;
+constexpr int ReadWrite = 2;
+constexpr int Create = 0x200;
+constexpr int Exclusive = 0x800;
+constexpr std::int64_t RaceSize = 4096;
+
+void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(std::string(message) + " (guest errno=" + std::to_string(*__error_nid_postfix()) + ")");
+}
+
+void RequireError(int descriptor, int expected, const char* message) {
+    Require(descriptor == -1 && *__error_nid_postfix() == expected, message);
+}
+
+void RequireNoAdministratorsAccess(HANDLE handle) {
+    PACL dacl = nullptr;
+    PSECURITY_DESCRIPTOR descriptor = nullptr;
+    const DWORD result = ::GetSecurityInfo(handle, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
+        nullptr, nullptr, &dacl, nullptr, &descriptor);
+    if (result != ERROR_SUCCESS || dacl == nullptr) {
+        if (descriptor != nullptr) ::LocalFree(descriptor);
+        Require(false, "reading named shared-memory object permissions failed");
+    }
+    SID_IDENTIFIER_AUTHORITY authority = SECURITY_NT_AUTHORITY;
+    PSID administrators = nullptr;
+    if (::AllocateAndInitializeSid(&authority, 2, SECURITY_BUILTIN_DOMAIN_RID,
+        DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &administrators) == FALSE) {
+        ::LocalFree(descriptor);
+        Require(false, "building the Administrators SID failed");
+    }
+    ACL_SIZE_INFORMATION information{};
+    const BOOL gotInformation = ::GetAclInformation(dacl, &information, sizeof(information), AclSizeInformation);
+    bool grantsAdministrators = false;
+    if (gotInformation) {
+        for (DWORD index = 0; index < information.AceCount; ++index) {
+            void* rawAce = nullptr;
+            if (!::GetAce(dacl, index, &rawAce)) continue;
+            const auto* header = static_cast<const ACE_HEADER*>(rawAce);
+            if (header->AceType != ACCESS_ALLOWED_ACE_TYPE) continue;
+            const auto* ace = static_cast<const ACCESS_ALLOWED_ACE*>(rawAce);
+            if (::EqualSid(const_cast<DWORD*>(&ace->SidStart), administrators) != FALSE) {
+                grantsAdministrators = true;
+                break;
+            }
+        }
+    }
+    ::FreeSid(administrators);
+    ::LocalFree(descriptor);
+    Require(gotInformation && !grantsAdministrators,
+        "named shared-memory object grants access to the Administrators group");
+}
+
+void RequireNoUnlinkedFiles(const std::string& name) {
+    const auto digest = Nid::Sha1(std::vector<std::uint8_t>(name.begin(), name.end()));
+    std::string prefix;
+    for (const auto byte : digest) {
+        prefix += "0123456789abcdef"[byte >> 4];
+        prefix += "0123456789abcdef"[byte & 15];
+    }
+    const auto directory = std::filesystem::temp_directory_path() / L"AnyPS5" / L"shm";
+    if (!std::filesystem::exists(directory)) return;
+    for (const auto& entry : std::filesystem::directory_iterator(directory)) {
+        const auto filename = entry.path().filename().string();
+        Require(!filename.starts_with(prefix + "-unlinked-"),
+                "closing the last descriptor did not reap its unlinked host object");
+    }
+}
+
+void VerifyUntrackedDescriptor(int descriptor) {
+    Require(File::IsSharedMemoryDescriptor_nid_no_patch(descriptor), "named descriptor was not tracked");
+    std::vector<wchar_t> path(32768);
+    const DWORD length = ::GetFinalPathNameByHandleW(reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor)),
+        path.data(), static_cast<DWORD>(path.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+    Require(length > 0 && length < path.size(), "locating the tracked file failed");
+    const HANDLE handle = ::CreateFileW(path.data(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
+    Require(handle != INVALID_HANDLE_VALUE, "opening an untracked handle to the named file failed");
+    const int untracked = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), _O_RDONLY | _O_BINARY);
+    if (untracked < 0) ::CloseHandle(handle);
+    Require(untracked >= 0, "creating an untracked descriptor failed");
+    const bool classified = File::IsSharedMemoryDescriptor_nid_no_patch(untracked);
+    Require(::_close(untracked) == 0, "closing the untracked descriptor failed");
+    Require(!classified, "an untracked descriptor entered the named shared-memory path");
+    Require(!File::IsSharedMemoryDescriptor_nid_no_patch(untracked), "a closed untracked descriptor was classified as shared memory");
+}
+
+void VerifyConcurrentDescriptorReuse(const std::string& name) {
+    std::barrier start(3);
+    std::vector<int> okay(2, 1);
+    std::vector<std::thread> workers;
+    for (int index = 0; index < 2; ++index) {
+        workers.emplace_back([&, index] {
+            start.arrive_and_wait();
+            for (int iteration = 0; iteration < 64; ++iteration) {
+                const int descriptor = shm_open_nid_postfix(name.c_str(), ReadWrite, 0);
+                if (descriptor < 0) { okay[index] = 0; break; }
+                if (!File::IsSharedMemoryDescriptor_nid_no_patch(descriptor) ||
+                    pwrite_nid_disambig1_nid_postfix(descriptor, "x", 1, 64) != 0) okay[index] = 0;
+                if (close_nid_postfix(descriptor) != 0) okay[index] = 0;
+            }
+        });
+    }
+    start.arrive_and_wait();
+    for (auto& worker : workers) worker.join();
+    Require(okay[0] && okay[1], "concurrent close/open lost named-descriptor tracking or bounded writes");
+}
+
+bool RunResizeWriteRace(const std::string& name) {
+    const int descriptor = shm_open_nid_postfix(name.c_str(), ReadWrite, 0);
+    if (descriptor < 0) return false;
+    bool okay = true;
+    for (int iteration = 0; iteration < 300; ++iteration) {
+        const auto size = (iteration & 1) ? 0 : RaceSize;
+        if (ftruncate_nid_postfix(descriptor, size) != 0) { okay = false; break; }
+        if (pwrite_nid_disambig1_nid_postfix(descriptor, "x", 1, RaceSize / 2) < 0) { okay = false; break; }
+        struct _stat64 status{};
+        if (::_fstat64(descriptor, &status) != 0 || (status.st_size != 0 && status.st_size != RaceSize)) {
+            okay = false;
+            break;
+        }
+    }
+    close_nid_postfix(descriptor);
+    return okay;
+}
+
+void VerifyCrossProcessResizeWrite(const std::string& name, int descriptor) {
+    wchar_t executable[32768]{};
+    const DWORD length = ::GetModuleFileNameW(nullptr, executable, static_cast<DWORD>(std::size(executable)));
+    Require(length > 0 && length < std::size(executable), "locating the Windows shared-memory test executable failed");
+    std::vector<PROCESS_INFORMATION> workers;
+    for (int index = 0; index < 2; ++index) {
+        std::wstring command = L"\"" + std::wstring(executable, length) + L"\" --race " + std::wstring(name.begin(), name.end());
+        STARTUPINFOW startup{};
+        startup.cb = sizeof(startup);
+        PROCESS_INFORMATION process{};
+        Require(::CreateProcessW(nullptr, command.data(), nullptr, nullptr, FALSE, CREATE_NO_WINDOW,
+                                 nullptr, nullptr, &startup, &process) != FALSE,
+                "starting a cross-process shared-memory race worker failed");
+        workers.push_back(process);
+    }
+    const bool localSucceeded = RunResizeWriteRace(name);
+    bool childrenSucceeded = true;
+    for (const auto& process : workers) {
+        childrenSucceeded = childrenSucceeded && ::WaitForSingleObject(process.hProcess, 10000) == WAIT_OBJECT_0;
+        DWORD exitCode = 1;
+        childrenSucceeded = childrenSucceeded && ::GetExitCodeProcess(process.hProcess, &exitCode) && exitCode == 0;
+        ::CloseHandle(process.hThread);
+        ::CloseHandle(process.hProcess);
+    }
+    Require(localSucceeded && childrenSucceeded,
+            "cross-process truncate/write race produced an invalid shared-object size");
+    struct _stat64 status{};
+    Require(::_fstat64(descriptor, &status) == 0 && (status.st_size == 0 || status.st_size == RaceSize),
+            "cross-process truncate/write race left an invalid final size");
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0, "cross-process race cleanup failed");
+}
+
+void VerifyResizeReadPosition(const std::string& name) {
+    constexpr std::size_t payloadSize = 2u << 20;
+    const int descriptor = shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(descriptor >= 0 && ftruncate_nid_postfix(descriptor, payloadSize) == 0,
+            "creating the resize/read object failed");
+    const int resizer = dup_nid_postfix(descriptor);
+    Require(resizer >= 0, "duplicating the resize/read descriptor failed");
+    std::vector<char> payload(payloadSize, 'r');
+    Require(pwrite_nid_disambig1_nid_postfix(descriptor, payload.data(), payload.size(), 0) == payloadSize &&
+            lseek_nid_postfix(descriptor, 137, 0) == 137, "preparing the resize/read object failed");
+    std::barrier start(2);
+    bool resized = true;
+    std::thread resizing([&] {
+        start.arrive_and_wait();
+        for (int iteration = 0; iteration < 256; ++iteration)
+            if (ftruncate_nid_postfix(resizer, payloadSize + ((iteration & 1) ? 4096 : 0)) != 0) resized = false;
+    });
+    start.arrive_and_wait();
+    std::vector<char> output(payloadSize);
+    bool read = true;
+    for (int iteration = 0; iteration < 32; ++iteration)
+        if (pread_nid_postfix(descriptor, output.data(), output.size(), 0) != payloadSize || output != payload) read = false;
+    resizing.join();
+    Require(resized && read && lseek_nid_postfix(descriptor, 0, 1) == 137,
+            "concurrent resize/read changed the shared file position or contents");
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0 && close_nid_postfix(descriptor) == 0 && close_nid_postfix(resizer) == 0,
+            "resize/read cleanup failed");
+    RequireNoUnlinkedFiles(name);
+}
+
+void Run() {
+    const std::string base = "/anyps5-windows-named-" + std::to_string(::GetCurrentProcessId()) + "-" + std::to_string(::GetTickCount64());
+    const std::string name = base + "-lifecycle";
+    Require(shm_unlink_nid_postfix(name.c_str()) == -1 && *__error_nid_postfix() == 2,
+            "new test name unexpectedly existed");
+
+    *__error_nid_postfix() = 73;
+    const int original = shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(original >= 0 && *__error_nid_postfix() == 73, "exclusive creation failed or changed guest errno");
+    VerifyUntrackedDescriptor(original);
+    Require(ftruncate_nid_postfix(original, 64) == 0, "sizing the named object failed");
+    VerifyConcurrentDescriptorReuse(name);
+    const char originalBytes[] = "original";
+    Require(pwrite_nid_disambig1_nid_postfix(original, originalBytes, sizeof(originalBytes), 0) == sizeof(originalBytes),
+            "write to named object failed");
+
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600), 17,
+                 "exclusive creation replaced an existing named object");
+    const int reader = shm_open_nid_postfix(name.c_str(), ReadOnly, 0);
+    char contents[sizeof(originalBytes)]{};
+    Require(reader >= 0 && pread_nid_postfix(reader, contents, sizeof(contents), 0) == sizeof(contents) &&
+            std::memcmp(contents, originalBytes, sizeof(contents)) == 0, "reopen did not share the original contents");
+    *__error_nid_postfix() = 0;
+    Require(pwrite_nid_disambig1_nid_postfix(reader, "x", 1, 0) == -1 && *__error_nid_postfix() == 9,
+            "read-only descriptor accepted a write");
+    *__error_nid_postfix() = 0;
+    Require(pwrite_nid_disambig1_nid_postfix(reader, "x", 1, 64) == -1 && *__error_nid_postfix() == 9,
+            "read-only descriptor accepted a write at end of file");
+    *__error_nid_postfix() = 0;
+    Require(pwrite_nid_disambig1_nid_postfix(reader, "", 0, 64) == -1 && *__error_nid_postfix() == 9,
+            "read-only descriptor accepted a zero-length write");
+
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0, "unlink of named object failed");
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(name.c_str(), ReadOnly, 0), 2, "unlinked name remained openable");
+    std::memset(contents, 0, sizeof(contents));
+    Require(pread_nid_postfix(original, contents, sizeof(contents), 0) == sizeof(contents) &&
+            std::memcmp(contents, originalBytes, sizeof(contents)) == 0, "open descriptor stopped working after unlink");
+    const char updatedByte = 'X';
+    Require(pwrite_nid_disambig1_nid_postfix(original, &updatedByte, 1, 0) == 1,
+            "open descriptor stopped accepting writes after unlink");
+
+    const int replacement = shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(replacement >= 0, "name could not be recreated while old descriptors remained open");
+    Require(ftruncate_nid_postfix(replacement, 64) == 0, "sizing the replacement object failed");
+    Require(fchmod_nid_postfix(original, 0400) == 0,
+            "fchmod failed on the old open object after unlink and name recreation");
+    Require(fchmod_nid_postfix(original, 0600) == 0,
+            "restoring mode on the old open object after name recreation failed");
+    std::memset(contents, 0x7f, sizeof(contents));
+    Require(pread_nid_postfix(replacement, contents, sizeof(contents), 0) == sizeof(contents) &&
+            std::memcmp(contents, "\0\0\0\0\0\0\0\0", sizeof(contents)) == 0,
+            "recreated name still referred to the unlinked object");
+    Require(pwrite_nid_disambig1_nid_postfix(replacement, "y", 1, 0) == 1,
+            "fchmod on the old descriptor changed the replacement object's permissions");
+    const char replacementBytes[] = "replacement";
+    Require(pwrite_nid_disambig1_nid_postfix(replacement, replacementBytes, sizeof(replacementBytes), 0) == sizeof(replacementBytes),
+            "write to replacement object failed");
+    std::memset(contents, 0, sizeof(contents));
+    Require(pread_nid_postfix(original, contents, sizeof(contents), 0) == sizeof(contents) &&
+            contents[0] == updatedByte && std::memcmp(contents + 1, originalBytes + 1, sizeof(originalBytes) - 2) == 0,
+            "replacement write changed the old open object");
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0, "replacement unlink failed");
+    Require(close_nid_postfix(reader) == 0 && close_nid_postfix(original) == 0 && close_nid_postfix(replacement) == 0,
+            "closing lifecycle descriptors failed");
+    RequireNoUnlinkedFiles(name);
+
+    const std::string duplicateName = base + "-duplicate";
+    const int duplicateOriginal = shm_open_nid_postfix(duplicateName.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(duplicateOriginal >= 0 && ftruncate_nid_postfix(duplicateOriginal, 64) == 0,
+            "creating the duplicate test object failed");
+    const int duplicate = dup_nid_postfix(duplicateOriginal);
+    Require(duplicate >= 0 && pwrite_nid_disambig1_nid_postfix(duplicate, "d", 1, 0) == 1,
+            "dup lost shared-memory write access");
+    const int duplicateReader = shm_open_nid_postfix(duplicateName.c_str(), ReadOnly, 0);
+    Require(duplicateReader >= 0 && shm_unlink_nid_postfix(duplicateName.c_str()) == 0,
+            "unlinking the duplicate test object failed");
+    Require(close_nid_postfix(duplicateOriginal) == 0, "closing the duplicated original failed");
+    Require(dup2_nid_postfix(-1, duplicate) == -1,
+            "dup2 accepted an invalid source");
+    Require(pwrite_nid_disambig1_nid_postfix(duplicate, "e", 1, 0) == 1,
+            "failed dup2 destroyed its shared-memory target");
+    Require(dup2_nid_postfix(duplicateReader, duplicate) == duplicate,
+            "dup2 could not replace a shared-memory target");
+    Require(pwrite_nid_disambig1_nid_postfix(duplicate, "f", 1, 0) == -1 && *__error_nid_postfix() == 9,
+            "dup2 lost shared-memory read-only access");
+    Require(close_nid_postfix(duplicateReader) == 0, "closing the duplicate reader failed");
+    const std::string replacementName = base + "-duplicate-replacement";
+    const int duplicateReplacement = shm_open_nid_postfix(replacementName.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(duplicateReplacement >= 0 && dup2_nid_postfix(duplicateReplacement, duplicate) == duplicate,
+            "dup2 could not replace the last unlinked descriptor");
+    RequireNoUnlinkedFiles(duplicateName);
+    Require(shm_unlink_nid_postfix(replacementName.c_str()) == 0 &&
+            close_nid_postfix(duplicateReplacement) == 0 && close_nid_postfix(duplicate) == 0,
+            "cleaning up dup2 replacement descriptors failed");
+    RequireNoUnlinkedFiles(replacementName);
+    VerifyResizeReadPosition(base + "-resize-read");
+
+    const std::string concurrentName = base + "-exclusive-race";
+    constexpr int contenderCount = 12;
+    std::vector<int> descriptors(contenderCount, -2);
+    std::vector<int> errors(contenderCount, 0);
+    std::vector<std::thread> contenders;
+    contenders.reserve(contenderCount);
+    for (int index = 0; index < contenderCount; ++index) {
+        contenders.emplace_back([&, index] {
+            descriptors[index] = shm_open_nid_postfix(concurrentName.c_str(), ReadWrite | Create | Exclusive, 0600);
+            errors[index] = *__error_nid_postfix();
+        });
+    }
+    for (auto& contender : contenders) contender.join();
+    int created = 0;
+    for (int index = 0; index < contenderCount; ++index) {
+        if (descriptors[index] >= 0) {
+            ++created;
+            Require(close_nid_postfix(descriptors[index]) == 0, "closing exclusive-race descriptor failed");
+        } else {
+            Require(errors[index] == 17, "exclusive-race loser did not receive EEXIST");
+        }
+    }
+    Require(created == 1, "exclusive create race produced more or fewer than one winner");
+    Require(shm_unlink_nid_postfix(concurrentName.c_str()) == 0, "exclusive-race cleanup failed");
+
+    const std::string raceName = base + "-cross-process-race";
+    const int raceDescriptor = shm_open_nid_postfix(raceName.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(raceDescriptor >= 0 && ftruncate_nid_postfix(raceDescriptor, RaceSize) == 0,
+            "cross-process race object creation failed");
+    VerifyCrossProcessResizeWrite(raceName, raceDescriptor);
+    Require(close_nid_postfix(raceDescriptor) == 0, "closing cross-process race descriptor failed");
+
+    const std::string permissionsName = base + "-permissions";
+    const int restricted = shm_open_nid_postfix(permissionsName.c_str(), ReadWrite | Create | Exclusive, 0400);
+    Require(restricted >= 0, "read-only mode creation failed");
+    RequireNoAdministratorsAccess(reinterpret_cast<HANDLE>(::_get_osfhandle(restricted)));
+    Require(close_nid_postfix(restricted) == 0, "closing read-only mode object failed");
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(permissionsName.c_str(), ReadWrite, 0), 13,
+                 "mode 0400 allowed a later read-write open");
+    const int restrictedReader = shm_open_nid_postfix(permissionsName.c_str(), ReadOnly, 0);
+    Require(restrictedReader >= 0, "mode 0400 rejected a read-only open");
+    Require(fchmod_nid_postfix(restrictedReader, 0600) == 0,
+            "fchmod could not restore write permission on a named object");
+    const int restoredWriter = shm_open_nid_postfix(permissionsName.c_str(), ReadWrite, 0);
+    Require(restoredWriter >= 0, "mode 0600 after fchmod rejected read-write open");
+    Require(fchmod_nid_postfix(restoredWriter, 0400) == 0,
+            "fchmod could not remove write permission on a named object");
+    *__error_nid_postfix() = 0;
+    Require(shm_unlink_nid_postfix(permissionsName.c_str()) == -1 && *__error_nid_postfix() == 13,
+            "unlink of a read-only named object did not return EACCES");
+    Require(fchmod_nid_postfix(restoredWriter, 0600) == 0,
+            "fchmod could not restore permission before unlink");
+    Require(shm_unlink_nid_postfix(permissionsName.c_str()) == 0,
+            "owner could not unlink a writable named object");
+    Require(close_nid_postfix(restoredWriter) == 0, "closing restored writer failed");
+    Require(close_nid_postfix(restrictedReader) == 0, "closing restricted reader failed");
+
+    const std::string noPermissionsName = base + "-mode-zero";
+    const int noPermissions = shm_open_nid_postfix(noPermissionsName.c_str(), ReadWrite | Create | Exclusive, 0000);
+    Require(noPermissions >= 0 && fchmod_nid_postfix(noPermissions, 0600) == 0,
+            "fchmod could not restore access to a mode 0000 named object");
+    Require(shm_unlink_nid_postfix(noPermissionsName.c_str()) == 0 && close_nid_postfix(noPermissions) == 0,
+            "mode 0000 object cleanup failed");
+
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(nullptr, ReadWrite, 0), 14, "null name did not return EFAULT");
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix("relative", ReadWrite, 0), 22, "relative name did not return EINVAL");
+    std::puts("Windows named shared-memory lifecycle checks passed");
+}
+
+bool EnvironmentEntryHasKey(const std::wstring& entry, const wchar_t* key) {
+    const auto separator = entry.find(L'=');
+    return separator != std::wstring::npos && separator == std::wcslen(key) &&
+        ::CompareStringOrdinal(entry.data(), static_cast<int>(separator), key, static_cast<int>(separator), TRUE) == CSTR_EQUAL;
+}
+
+std::vector<wchar_t> EnvironmentWithTempPath(const std::wstring& path) {
+    std::vector<std::wstring> entries;
+    LPWCH environment = ::GetEnvironmentStringsW();
+    if (environment == nullptr) throw std::runtime_error("reading the Windows environment failed");
+    try {
+        for (const wchar_t* current = environment; *current != L'\0'; current += std::wcslen(current) + 1) {
+            std::wstring entry(current);
+            if (!EnvironmentEntryHasKey(entry, L"TMP") && !EnvironmentEntryHasKey(entry, L"TEMP"))
+                entries.push_back(std::move(entry));
+        }
+    } catch (...) {
+        ::FreeEnvironmentStringsW(environment);
+        throw;
+    }
+    ::FreeEnvironmentStringsW(environment);
+    entries.push_back(L"TMP=" + path);
+    entries.push_back(L"TEMP=" + path);
+    std::sort(entries.begin(), entries.end(), [](const auto& left, const auto& right) {
+        return ::CompareStringOrdinal(left.c_str(), -1, right.c_str(), -1, TRUE) == CSTR_LESS_THAN;
+    });
+    std::vector<wchar_t> block;
+    for (const auto& entry : entries) {
+        block.insert(block.end(), entry.begin(), entry.end());
+        block.push_back(L'\0');
+    }
+    block.push_back(L'\0');
+    return block;
+}
+
+bool SameDirectory(HANDLE left, HANDLE right) {
+    BY_HANDLE_FILE_INFORMATION leftInfo{}, rightInfo{};
+    return ::GetFileInformationByHandle(left, &leftInfo) && ::GetFileInformationByHandle(right, &rightInfo) &&
+        leftInfo.dwVolumeSerialNumber == rightInfo.dwVolumeSerialNumber &&
+        leftInfo.nFileIndexHigh == rightInfo.nFileIndexHigh && leftInfo.nFileIndexLow == rightInfo.nFileIndexLow;
+}
+
+std::filesystem::path ExtendedPath(const std::filesystem::path& path) {
+    wchar_t fullPath[32768]{};
+    const DWORD length = ::GetFullPathNameW(path.c_str(), static_cast<DWORD>(std::size(fullPath)), fullPath, nullptr);
+    if (length == 0 || length >= std::size(fullPath))
+        throw std::runtime_error("getting the full private temporary path failed");
+    std::wstring full(fullPath, length);
+    if (full.starts_with(L"\\\\?\\")) return full;
+    if (full.starts_with(L"\\\\")) return L"\\\\?\\UNC\\" + full.substr(2);
+    return L"\\\\?\\" + full;
+}
+
+std::filesystem::path DosPath(const std::filesystem::path& path) {
+    const auto& native = path.native();
+    if (native.starts_with(L"\\\\?\\UNC\\")) return L"\\\\" + native.substr(8);
+    if (native.starts_with(L"\\\\?\\")) return native.substr(4);
+    return path;
+}
+
+void RemovePrivateDirectory(const std::filesystem::path& directory) {
+    WIN32_FIND_DATAW entry{};
+    const HANDLE search = ::FindFirstFileW((directory / L"*").c_str(), &entry);
+    if (search == INVALID_HANDLE_VALUE) {
+        if (::GetLastError() != ERROR_FILE_NOT_FOUND)
+            throw std::runtime_error("enumerating the private temporary directory for cleanup failed");
+    } else {
+        try {
+            do {
+                if (std::wcscmp(entry.cFileName, L".") == 0 || std::wcscmp(entry.cFileName, L"..") == 0) continue;
+                if (entry.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
+                    throw std::runtime_error("the private temporary directory contains a reparse point");
+                const auto child = directory / entry.cFileName;
+                if (entry.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) RemovePrivateDirectory(child);
+                else if (!::DeleteFileW(child.c_str()))
+                    throw std::runtime_error("removing a private temporary file failed");
+            } while (::FindNextFileW(search, &entry));
+            if (::GetLastError() != ERROR_NO_MORE_FILES)
+                throw std::runtime_error("enumerating the private temporary directory for cleanup failed");
+        } catch (...) {
+            ::FindClose(search);
+            throw;
+        }
+        ::FindClose(search);
+    }
+    if (!::RemoveDirectoryW(directory.c_str()))
+        throw std::runtime_error("removing the private temporary directory failed");
+}
+
+int RunWithShortTempPath(bool longPath) {
+    wchar_t tempBuffer[32768]{};
+    const DWORD tempLength = ::GetTempPathW(static_cast<DWORD>(std::size(tempBuffer)), tempBuffer);
+    if (tempLength == 0 || tempLength >= std::size(tempBuffer))
+        throw std::runtime_error("locating the Windows temporary directory failed");
+    const std::filesystem::path parent(std::wstring(tempBuffer, tempLength));
+    std::filesystem::path baseRoot;
+    bool created = false;
+    for (unsigned attempt = 0; attempt < 16; ++attempt) {
+        baseRoot = parent / (L"AnyPS5-Temp-Regression-" + std::to_wstring(::GetCurrentProcessId()) + L"-" +
+            std::to_wstring(::GetTickCount64()) + L"-" + std::to_wstring(attempt));
+        if (::CreateDirectoryW(baseRoot.c_str(), nullptr)) {
+            created = true;
+            break;
+        }
+        if (::GetLastError() != ERROR_ALREADY_EXISTS) throw std::runtime_error("creating a private temporary directory failed");
+    }
+    if (!created) throw std::runtime_error("creating a unique private temporary directory failed");
+    const auto cleanupRoot = ExtendedPath(baseRoot);
+    std::filesystem::path longRoot = cleanupRoot;
+    const auto cleanup = [&] {
+        RemovePrivateDirectory(cleanupRoot);
+    };
+
+    try {
+        std::vector<wchar_t> shortBuffer(32768);
+        DWORD shortLength = ::GetShortPathNameW(longRoot.c_str(), shortBuffer.data(), static_cast<DWORD>(shortBuffer.size()));
+        if (shortLength == 0)
+            throw std::runtime_error("GetShortPathNameW failed (Win32 error " + std::to_string(::GetLastError()) + ")");
+        if (shortLength >= shortBuffer.size())
+            throw std::runtime_error("GetShortPathNameW required a buffer of " + std::to_string(shortLength) + " characters");
+        std::filesystem::path shortRoot(std::wstring(shortBuffer.data(), shortLength));
+        if (longPath) {
+            bool aliasAvailable = true;
+            bool longAliasReady = false;
+            for (unsigned level = 0; level < 80; ++level) {
+                longRoot /= L"LongSharedMemoryTempDirectoryRegressionSegment";
+                if (!::CreateDirectoryW(longRoot.c_str(), nullptr))
+                    throw std::runtime_error("creating the nested long temporary directory failed (Win32 error " + std::to_string(::GetLastError()) + ")");
+                shortLength = ::GetShortPathNameW(longRoot.c_str(), shortBuffer.data(), static_cast<DWORD>(shortBuffer.size()));
+                if (shortLength == 0)
+                    throw std::runtime_error("GetShortPathNameW failed for nested path (Win32 error " + std::to_string(::GetLastError()) + ")");
+                if (shortLength >= shortBuffer.size())
+                    throw std::runtime_error("GetShortPathNameW required a buffer of " + std::to_string(shortLength) + " characters");
+                shortRoot = std::filesystem::path(std::wstring(shortBuffer.data(), shortLength));
+                if (::CompareStringOrdinal(longRoot.filename().c_str(), -1, shortRoot.filename().c_str(), -1, TRUE) == CSTR_EQUAL) {
+                    aliasAvailable = false;
+                    break;
+                }
+                if (DosPath(longRoot).native().size() > MAX_PATH + 64 && DosPath(shortRoot).native().size() < MAX_PATH - 64) {
+                    longAliasReady = true;
+                    break;
+                }
+            }
+            if (!aliasAvailable) {
+                std::puts("long-short-temp regression skipped: this volume did not create an 8.3 alias for the nested directory");
+                cleanup();
+                return 77;
+            }
+            if (!longAliasReady)
+                throw std::runtime_error("nested private path did not exceed MAX_PATH with a usable short alias");
+        }
+        if (::CompareStringOrdinal(longRoot.filename().c_str(), -1, shortRoot.filename().c_str(), -1, TRUE) == CSTR_EQUAL) {
+            std::puts("short-temp regression skipped: this volume did not create an 8.3 alias for the private directory");
+            cleanup();
+            return 77;
+        }
+        const HANDLE longHandle = ::CreateFileW(longRoot.c_str(), FILE_READ_ATTRIBUTES,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+        if (longHandle == INVALID_HANDLE_VALUE) throw std::runtime_error("opening the long temporary path failed");
+        const HANDLE shortHandle = ::CreateFileW(shortRoot.c_str(), FILE_READ_ATTRIBUTES,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+        if (shortHandle == INVALID_HANDLE_VALUE) {
+            ::CloseHandle(longHandle);
+            throw std::runtime_error("opening the 8.3 temporary alias failed");
+        }
+        const bool isSameDirectory = SameDirectory(longHandle, shortHandle);
+        ::CloseHandle(shortHandle);
+        ::CloseHandle(longHandle);
+        if (!isSameDirectory) throw std::runtime_error("the short temporary path did not identify the created directory");
+        std::wprintf(L"%ls regression verified 8.3 directory alias (%llu/%llu characters):\n%ls\n%ls\n",
+            longPath ? L"long-short-temp" : L"short-temp",
+            static_cast<unsigned long long>(longRoot.native().size()),
+            static_cast<unsigned long long>(shortRoot.native().size()), longRoot.c_str(), shortRoot.c_str());
+        std::fflush(stdout);
+
+        wchar_t executable[32768]{};
+        const DWORD executableLength = ::GetModuleFileNameW(nullptr, executable, static_cast<DWORD>(std::size(executable)));
+        if (executableLength == 0 || executableLength >= std::size(executable))
+            throw std::runtime_error("locating the Windows shared-memory test executable failed");
+        std::wstring command = L"\"" + std::wstring(executable, executableLength) + L"\" --short-temp-child";
+        auto environment = EnvironmentWithTempPath(DosPath(shortRoot).native());
+        STARTUPINFOW startup{};
+        startup.cb = sizeof(startup);
+        PROCESS_INFORMATION process{};
+        if (!::CreateProcessW(nullptr, command.data(), nullptr, nullptr, FALSE,
+                CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT, environment.data(), nullptr, &startup, &process))
+            throw std::runtime_error("starting the short temporary path child failed");
+        const DWORD wait = ::WaitForSingleObject(process.hProcess, 16000);
+        DWORD exitCode = 1;
+        const bool childSucceeded = wait == WAIT_OBJECT_0 && ::GetExitCodeProcess(process.hProcess, &exitCode) && exitCode == 0;
+        if (wait != WAIT_OBJECT_0) {
+            ::TerminateProcess(process.hProcess, 1);
+            ::WaitForSingleObject(process.hProcess, 1000);
+        }
+        if (!childSucceeded)
+            std::fprintf(stderr, "%s child failed: wait=%lu exit=%lu\n", longPath ? "long-short-temp" : "short-temp",
+                static_cast<unsigned long>(wait), static_cast<unsigned long>(exitCode));
+        ::CloseHandle(process.hThread);
+        ::CloseHandle(process.hProcess);
+        cleanup();
+        return childSucceeded ? 0 : 1;
+    } catch (...) {
+        cleanup();
+        throw;
+    }
+}
+}
+
+int main(int argumentCount, char** arguments) {
+    try {
+        if (argumentCount == 3 && std::string_view(arguments[1]) == "--race")
+            return RunResizeWriteRace(arguments[2]) ? 0 : 1;
+        if (argumentCount == 2 && std::string_view(arguments[1]) == "--short-temp")
+            return RunWithShortTempPath(false);
+        if (argumentCount == 2 && std::string_view(arguments[1]) == "--long-short-temp")
+            return RunWithShortTempPath(true);
+        if (argumentCount == 2 && std::string_view(arguments[1]) == "--short-temp-child") {
+            Run();
+            return 0;
+        }
+        Run();
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/tests/GuestNanosleep.cpp b/core/libs/tests/GuestNanosleep.cpp
index c97b6c1f13..6ae6cbbd17 100644
--- a/core/libs/tests/GuestNanosleep.cpp
+++ b/core/libs/tests/GuestNanosleep.cpp
@@ -1,20 +1,14 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI _nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI sceKernelNanosleep(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int* APS5_VABI __error_nid_postfix();
-}
-
 using Nanosleep = int (APS5_VABI *)(const KernelTimespec*, KernelTimespec*);
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EFAULT = static_cast<int>(0x8002000E);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 
 static constexpr int GUEST_EACCES = 13;
 static constexpr int GUEST_EFAULT = 14;
diff --git a/core/libs/tests/GuestNanosleepLongRequest.cpp b/core/libs/tests/GuestNanosleepLongRequest.cpp
index b2b6ec9cd6..c68722401f 100644
--- a/core/libs/tests/GuestNanosleepLongRequest.cpp
+++ b/core/libs/tests/GuestNanosleepLongRequest.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <atomic>
@@ -8,12 +10,6 @@
 #include <source_location>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI sceKernelNanosleep(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-}
-
 static void Require(bool value, std::source_location location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "%s:%u: requirement failed\n", location.file_name(), location.line());
diff --git a/core/libs/tests/GuestNetBooleanReadback.cpp b/core/libs/tests/GuestNetBooleanReadback.cpp
new file mode 100644
index 0000000000..c4680dad9f
--- /dev/null
+++ b/core/libs/tests/GuestNetBooleanReadback.cpp
@@ -0,0 +1,66 @@
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <winsock2.h>
+#else
+#include <sys/socket.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include "prx/libSceNet/libSceNet.hpp"
+#include "prx/libkernel/Socket/include/SocketPoll.hpp"
+
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "check failed at line %u\n", location.line());
+        std::abort();
+    }
+}
+
+int main() {
+    Require(sceNetInit_nid_postfix() == 0);
+    for (const int family : {2, 28}) {
+        for (const int type : {1, 2}) {
+            const int socket = sceNetSocket("boolean-readback", family, type, type == 1 ? 6 : 17);
+            Require(socket >= 0);
+            std::shared_ptr<void> owner;
+            std::uintptr_t native = 0;
+            Require(KernelFindSocketNative_nid_no_patch(socket, &owner, &native));
+            for (const int option : {4, 32}) {
+                if (option == 32 && (family != 2 || type != 2)) continue;
+                for (const int setting : {1, -1, 0, 4, 0}) {
+                    Require(sceNetSetsockopt(socket, 0xffff, option, &setting, sizeof(setting)) == 0);
+                    for (const std::uint32_t capacity : {0u, 1u, 3u, 4u, 8u}) {
+                        std::array<std::uint8_t, 8> bytes;
+                        bytes.fill(0xa5);
+                        std::uint32_t size = capacity;
+                        const int expected = setting != 0 ? option : 0;
+                        Require(sceNetGetsockopt(socket, 0xffff, option, bytes.data(), &size) == 0);
+                        Require(size == std::min(capacity, 4u));
+                        Require(std::memcmp(bytes.data(), &expected, size) == 0);
+                        Require(std::all_of(bytes.begin() + size, bytes.end(), [](auto byte) { return byte == 0xa5; }));
+                    }
+                }
+                const int enabled = 1;
+                Require(::setsockopt(native, SOL_SOCKET, option == 4 ? SO_REUSEADDR : SO_BROADCAST,
+                    reinterpret_cast<const char*>(&enabled), sizeof(enabled)) == 0);
+                int value = 0;
+                std::uint32_t size = sizeof(value);
+                Require(sceNetGetsockopt(socket, 0xffff, option, &value, &size) == 0 && value == option);
+                Require(sceNetGetsockopt(socket, 0xffff, option, nullptr, &size) == static_cast<int>(0x80410116u));
+                Require(*sceNetErrnoLoc() == 22);
+                Require(sceNetGetsockopt(socket, 0xffff, option, &value, nullptr) == static_cast<int>(0x80410116u));
+            }
+            Require(sceNetSocketClose(socket) == 0);
+            int value = 0;
+            std::uint32_t size = sizeof(value);
+            Require(sceNetGetsockopt(socket, 0xffff, 4, &value, &size) == static_cast<int>(0x80410109u));
+            Require(*sceNetErrnoLoc() == 9);
+        }
+    }
+}
diff --git a/core/libs/tests/GuestNetBufferValidation.cpp b/core/libs/tests/GuestNetBufferValidation.cpp
index 4b2c66402d..cf734de324 100644
--- a/core/libs/tests/GuestNetBufferValidation.cpp
+++ b/core/libs/tests/GuestNetBufferValidation.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -12,17 +15,6 @@
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Socket/include/SocketPoll.hpp"
 
-extern "C" {
-int APS5_VABI sceNetInit_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetSocketClose(int);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockopt(int, int, int, void*, std::uint32_t*);
-int* APS5_VABI sceNetErrnoLoc();
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "check failed at line %u\n", location.line());
diff --git a/core/libs/tests/GuestNetCtl.cpp b/core/libs/tests/GuestNetCtl.cpp
index f45a66dc77..fa070adf54 100644
--- a/core/libs/tests/GuestNetCtl.cpp
+++ b/core/libs/tests/GuestNetCtl.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -31,26 +32,13 @@ struct NetCtlDefaultRoute {
 };
 #endif
 
-union NetCtlInfoV6;
 
 extern "C" {
-int APS5_VABI sceNetCtlInit(void);
-int APS5_VABI sceNetCtlCheckCallback(void);
-int APS5_VABI sceNetCtlGetInfo(int, NetCtlInfo*);
-int APS5_VABI sceNetCtlGetNatInfo(NetCtlNatInfo*);
-int APS5_VABI sceNetCtlGetState(int*);
-int APS5_VABI sceNetCtlGetStateV6(int*);
-int APS5_VABI sceNetCtlGetInfoV6(std::uint32_t, NetCtlInfoV6*);
-int APS5_VABI sceNetCtlGetResult(int, int*);
-int APS5_VABI sceNetCtlGetResultV6(int, int*);
+
 #ifdef __APPLE__
 std::size_t NetCtlDefaultRoutes_nid_no_patch(const char*, std::size_t, NetCtlDefaultRoute*, std::size_t);
 #endif
-int APS5_VABI sceNetCtlRegisterCallback(NetCtlCallback, void*, int*);
-int APS5_VABI sceNetCtlRegisterCallbackV6(NetCtlCallback, void*, int*);
-void APS5_VABI sceNetCtlTerm(void);
-int APS5_VABI sceNetCtlUnregisterCallback(int);
-int APS5_VABI sceNetCtlUnregisterCallbackV6(int);
+
 }
 
 namespace {
@@ -161,6 +149,94 @@ void CheckCallbacks() {
     Require(sceNetCtlUnregisterCallbackV6(v6) == 0);
 }
 
+Delivery g_ipcInt;
+
+void APS5_VABI RecordIpcInt(int event, void* arg) {
+    ++g_ipcInt.calls;
+    g_ipcInt.event = event;
+    g_ipcInt.arg = arg;
+}
+
+int CurrentEvent() {
+    int state = -1;
+    Require(sceNetCtlGetState(&state) == 0);
+    return state == kStateIpObtained ? kEventIpObtained : kEventDisconnected;
+}
+
+void CheckIpcIntGetters() {
+    Require(sceNetCtlGetStateIpcInt(nullptr) == kErrInvalidAddr);
+    Require(sceNetCtlGetStateV6IpcInt(nullptr) == kErrInvalidAddr);
+    int state = -1;
+    int twin = -2;
+    Require(sceNetCtlGetStateIpcInt(&state) == 0 && sceNetCtlGetState(&twin) == 0 && state == twin);
+    state = -1;
+    twin = -2;
+    Require(sceNetCtlGetStateV6IpcInt(&state) == 0 && sceNetCtlGetStateV6(&twin) == 0 && state == twin);
+
+    Require(sceNetCtlGetResultIpcInt(kEventDisconnected, nullptr) == kErrInvalidAddr);
+    Require(sceNetCtlGetResultV6IpcInt(kEventDisconnected, nullptr) == kErrInvalidAddr);
+    for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) {
+        int errorCode = -1;
+        Require(sceNetCtlGetResultIpcInt(eventType, &errorCode) == 0 && errorCode == 0);
+        errorCode = -1;
+        Require(sceNetCtlGetResultV6IpcInt(eventType, &errorCode) == 0 && errorCode == 0);
+    }
+
+    NetCtlInfo info{};
+    Require(sceNetCtlGetInfoIpcInt(14, nullptr) == kErrInvalidAddr);
+    Require(sceNetCtlGetInfoIpcInt(0, &info) == kErrInvalidCode);
+    Require(sceNetCtlGetInfoIpcInt(22, &info) == kErrInvalidCode);
+    Require(sceNetCtlGetInfoIpcInt(0xffffffffu, &info) == kErrInvalidCode);
+    for (std::uint32_t code = 1; code <= 21; ++code) {
+        NetCtlInfo internal;
+        NetCtlInfo expected;
+        std::memset(&internal, kFill, sizeof(internal));
+        std::memset(&expected, kFill, sizeof(expected));
+        Require(sceNetCtlGetInfoIpcInt(code, &internal) == sceNetCtlGetInfo(static_cast<int>(code), &expected));
+        Require(std::memcmp(&internal, &expected, sizeof(internal)) == 0);
+    }
+
+    std::uint8_t infoV6[256] = {};
+    auto* v6 = reinterpret_cast<NetCtlInfoV6*>(infoV6);
+    Require(sceNetCtlGetInfoV6IpcInt(0, v6) == kErrInvalidCode);
+    Require(sceNetCtlGetInfoV6IpcInt(6, v6) == kErrInvalidCode);
+    Require(sceNetCtlGetInfoV6IpcInt(1, nullptr) == kErrInvalidAddr);
+    int stateV6 = -1;
+    Require(sceNetCtlGetStateV6(&stateV6) == 0);
+    if (stateV6 != kStateIpObtained) Require(sceNetCtlGetInfoV6IpcInt(1, v6) == kErrNotConnected);
+}
+
+void CheckIpcIntCallbacks() {
+    constexpr int invalidId = static_cast<int>(0x80412105);
+    constexpr int idNotFound = static_cast<int>(0x80412104);
+    Require(sceNetCtlRegisterCallbackIpcInt(nullptr, nullptr, nullptr) == kErrInvalidAddr);
+    Require(sceNetCtlRegisterCallbackV6IpcInt(nullptr, nullptr, nullptr) == kErrInvalidAddr);
+    Require(sceNetCtlUnregisterCallbackIpcInt(-1) == invalidId);
+    Require(sceNetCtlUnregisterCallbackV6IpcInt(-1) == invalidId);
+
+    const int event = CurrentEvent();
+    int probe = 0;
+    int internal = -1;
+    Require(sceNetCtlRegisterCallbackIpcInt(RecordIpcInt, &probe, &internal) == 0 && internal == 0);
+    int shared = -1;
+    Require(sceNetCtlRegisterCallback(RecordIpcInt, &probe, &shared) == 0 && shared == 1);
+    Require(sceNetCtlCheckCallback() == 0);
+    Require(g_ipcInt.calls == 2 && g_ipcInt.event == event && g_ipcInt.arg == &probe);
+    Require(sceNetCtlUnregisterCallbackIpcInt(shared) == 0);
+    Require(sceNetCtlUnregisterCallback(internal) == 0);
+    Require(sceNetCtlUnregisterCallbackIpcInt(internal) == idNotFound);
+
+    int internalV6 = -1;
+    Require(sceNetCtlRegisterCallbackV6IpcInt(RecordIpcInt, &probe, &internalV6) == 0 && internalV6 == 0);
+    int sharedV6 = -1;
+    Require(sceNetCtlRegisterCallbackV6(RecordIpcInt, &probe, &sharedV6) == 0 && sharedV6 == 1);
+    Require(sceNetCtlCheckCallback() == 0);
+    Require(g_ipcInt.calls == 2);
+    Require(sceNetCtlUnregisterCallbackV6IpcInt(sharedV6) == 0);
+    Require(sceNetCtlUnregisterCallbackV6(internalV6) == 0);
+    Require(sceNetCtlUnregisterCallbackV6IpcInt(internalV6) == idNotFound);
+}
+
 NetCtlInfo Query(int code) {
     NetCtlInfo info;
     std::memset(&info, kFill, sizeof(info));
@@ -283,32 +359,28 @@ int main() {
     Require(sceNetCtlRegisterCallbackV6(nullptr, nullptr, nullptr) == kErrInvalidAddr);
     Require(sceNetCtlUnregisterCallback(-1) == invalidId);
     Require(sceNetCtlUnregisterCallbackV6(-1) == invalidId);
+    Require(sceNetCtlRegisterCallbackForNpToolkit(nullptr, nullptr, nullptr) == kErrInvalidAddr);
+    Require(sceNetCtlUnregisterCallbackForNpToolkit(-1) == invalidId);
+    Require(sceNetCtlCheckCallbackForNpToolkit() == 0);
     CheckCallbacks();
+    CheckIpcIntGetters();
+    CheckIpcIntCallbacks();
 
     Require(sceNetCtlGetStateV6(nullptr) == kErrInvalidAddr);
     int stateV6 = -1;
     Require(sceNetCtlGetStateV6(&stateV6) == 0);
     Require(stateV6 == 0 || stateV6 == kStateIpObtained);
     Require(sceNetCtlGetResult(0, nullptr) == kErrInvalidAddr);
-    int errorCode = -1;
-    bool resultUnsupported = false;
-    try {
-        sceNetCtlGetResult(0, &errorCode);
-    } catch (const std::logic_error&) {
-        resultUnsupported = true;
+    Require(sceNetCtlGetResult(kEventDisconnected, nullptr) == kErrInvalidAddr);
+    for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) {
+        int errorCode = -1;
+        Require(sceNetCtlGetResult(eventType, &errorCode) == 0 && errorCode == 0);
     }
-    Require(resultUnsupported && errorCode == -1);
     Require(sceNetCtlGetResultV6(kEventIpObtained, nullptr) == kErrInvalidAddr);
     for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) {
         int errorCodeV6 = -1;
         Require(sceNetCtlGetResultV6(eventType, &errorCodeV6) == 0 && errorCodeV6 == 0);
     }
-    for (const int eventType : {0, 4, -1}) {
-        int errorCodeV6 = -1;
-        bool threw = false;
-        try { sceNetCtlGetResultV6(eventType, &errorCodeV6); } catch (const std::runtime_error&) { threw = true; }
-        Require(threw && errorCodeV6 == -1);
-    }
     NetCtlInfo info{};
     Require(sceNetCtlGetInfo(0, &info) == kErrInvalidCode);
     Require(sceNetCtlGetInfo(22, &info) == kErrInvalidCode);
diff --git a/core/libs/tests/GuestNetCtlAp.cpp b/core/libs/tests/GuestNetCtlAp.cpp
index 3689260ee4..d9db3b4796 100644
--- a/core/libs/tests/GuestNetCtlAp.cpp
+++ b/core/libs/tests/GuestNetCtlAp.cpp
@@ -1,23 +1,11 @@
+#include "prx/libSceNetCtlAp/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNetCtlApInit(void);
-void APS5_VABI sceNetCtlApTerm(void);
-int APS5_VABI sceNetCtlApCheckCallback(void);
-int APS5_VABI sceNetCtlApClearEvent(int eventType);
-int APS5_VABI sceNetCtlApRegisterCallback(void (APS5_VABI *func)(int, void*), void* arg, int* cid);
-int APS5_VABI sceNetCtlApUnregisterCallback(int cid);
-int APS5_VABI sceNetCtlApGetResult(int eventType, int* errorCode);
-int APS5_VABI sceNetCtlApGetInfo(void* info);
-int APS5_VABI sceNetCtlApGetState(int* state);
-int APS5_VABI sceNetCtlApStop(void);
-int APS5_VABI sceNetCtlApGetConnectInfo(const char* optStr, void* connectInfo);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -107,7 +95,7 @@ int main() {
         cids[i] = -1;
         Require(sceNetCtlApRegisterCallback(Callback, &cids[i], &cids[i]) == 0 && cids[i] == i);
     }
-    int extra = -1;
+    int extra = 0x5a5a;
     Require(sceNetCtlApRegisterCallback(Callback, nullptr, &extra) == kErrCallbackMax && extra == -1);
     Require(sceNetCtlApRegisterCallback(nullptr, nullptr, &extra) == kErrInvalidAddr);
     Require(sceNetCtlApRegisterCallback(Callback, nullptr, nullptr) == kErrInvalidAddr);
@@ -122,6 +110,7 @@ int main() {
     bool threw = false;
     try {
         sceNetCtlApInit();
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -135,5 +124,6 @@ int main() {
     Require(sceNetCtlApGetState(&state) == 0 && state == 0);
     sceNetCtlApTerm();
     sceNetCtlApTerm();
+
     RequireUninitialized();
 }
diff --git a/core/libs/tests/GuestNetCtlApDialog.cpp b/core/libs/tests/GuestNetCtlApDialog.cpp
index f17c171e56..82b0318b87 100644
--- a/core/libs/tests/GuestNetCtlApDialog.cpp
+++ b/core/libs/tests/GuestNetCtlApDialog.cpp
@@ -1,19 +1,10 @@
+#include "prx/libSceNetCtlApDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 
-extern "C" {
-int APS5_VABI sceNetCtlApDialogInitialize(void);
-int APS5_VABI sceNetCtlApDialogTerminate(void);
-int APS5_VABI sceNetCtlApDialogOpen(const NetCtlApDialogParam* param);
-int APS5_VABI sceNetCtlApDialogClose(void);
-int APS5_VABI sceNetCtlApDialogUpdateStatus(void);
-int APS5_VABI sceNetCtlApDialogGetStatus(void);
-int APS5_VABI sceNetCtlApDialogGetResult(void* result);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -48,7 +39,7 @@ int main() {
     Require(sceNetCtlApDialogTerminate() == kErrNotInitialized);
     Require(sceNetCtlApDialogOpen(&param) == kErrNotInitialized);
     Require(sceNetCtlApDialogClose() == kErrNotInitialized);
-    Require(sceNetCtlApDialogGetResult(result) == kErrNotInitialized);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kErrNotInitialized);
     Require(sceNetCtlApDialogGetStatus() == kStatusNone);
     Require(sceNetCtlApDialogUpdateStatus() == kStatusNone);
 
@@ -59,9 +50,9 @@ int main() {
 
     Require(sceNetCtlApDialogOpen(nullptr) == kErrArgNull);
     Require(sceNetCtlApDialogGetStatus() == kStatusInitialized);
-    Require(sceNetCtlApDialogGetResult(result) == static_cast<int>(0x80B8000Au));
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == static_cast<int>(0x80B8000Au));
     std::memset(result + 4, 0, 36);
-    Require(sceNetCtlApDialogGetResult(result) == kErrNotFinished);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kErrNotFinished);
 
     param.size = 103;
     Require(sceNetCtlApDialogOpen(&param) == static_cast<int>(0x80B8000Au));
@@ -80,7 +71,7 @@ int main() {
     Require(sceNetCtlApDialogUpdateStatus() == kStatusFinished);
 
     Require(sceNetCtlApDialogGetResult(nullptr) == kErrArgNull);
-    Require(sceNetCtlApDialogGetResult(result) == kResultUserCanceled);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kResultUserCanceled);
     RequireCanceled(result);
 
     Require(sceNetCtlApDialogOpen(&param) == 0);
@@ -92,6 +83,6 @@ int main() {
     Require(sceNetCtlApDialogInitialize() == 0);
     Require(sceNetCtlApDialogClose() == static_cast<int>(0x80B8000Bu));
     Require(sceNetCtlApDialogGetStatus() == kStatusInitialized);
-    Require(sceNetCtlApDialogGetResult(result) == kErrNotFinished);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kErrNotFinished);
     Require(sceNetCtlApDialogTerminate() == 0);
 }
diff --git a/core/libs/tests/GuestNetDnsInfo.cpp b/core/libs/tests/GuestNetDnsInfo.cpp
new file mode 100644
index 0000000000..2dc49bca3e
--- /dev/null
+++ b/core/libs/tests/GuestNetDnsInfo.cpp
@@ -0,0 +1,139 @@
+#include "prx/libSceNet/include/Net.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <initializer_list>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kErrorBase = static_cast<int>(0x80410100);
+constexpr int kEfault = 14;
+constexpr int kEinval = 22;
+constexpr int kEnotinit = 200;
+
+bool Failed(int result, int error) { return result == (kErrorBase | error) && *sceNetErrnoLoc() == error; }
+
+void CheckUninitialized() {
+    NetDnsInfo info{0x08080808u, 0x01010101u};
+    const NetDnsInfo before = info;
+    NetDns6Info info6{};
+    std::memset(&info6, 0x5a, sizeof(info6));
+    const NetDns6Info before6 = info6;
+    for (const std::uint32_t flags : {0u, 1u, 0xffffffffu}) {
+        Require(Failed(sceNetGetDnsInfo(&info, flags), kEnotinit));
+        Require(Failed(sceNetSetDnsInfo(&info, flags), kEnotinit));
+        Require(Failed(sceNetGetDns6Info(&info6, flags), kEnotinit));
+        Require(Failed(sceNetSetDns6Info(&info6, flags), kEnotinit));
+        Require(Failed(sceNetGetDnsInfo(nullptr, flags), kEnotinit));
+        Require(Failed(sceNetSetDnsInfo(nullptr, flags), kEnotinit));
+        Require(Failed(sceNetGetDns6Info(nullptr, flags), kEnotinit));
+        Require(Failed(sceNetSetDns6Info(nullptr, flags), kEnotinit));
+        Require(std::memcmp(&info, &before, sizeof(info)) == 0);
+        Require(std::memcmp(&info6, &before6, sizeof(info6)) == 0);
+    }
+}
+
+void CheckDns() {
+    NetDnsInfo info{0x08080808u, 0};
+    Require(Failed(sceNetSetDnsInfo(&info, 1), kEinval));
+    NetDnsInfo empty{0, 0x01010101u};
+    Require(Failed(sceNetSetDnsInfo(&empty, 0), kEinval));
+
+    Require(sceNetSetDnsInfo(&info, 0) == 0);
+    NetDnsInfo read{1, 1};
+    Require(sceNetGetDnsInfo(&read, 0) == 1 && read.primaryAddress == 0x08080808u && read.secondaryAddress == 0);
+    info.secondaryAddress = 0x04040808u;
+    Require(sceNetSetDnsInfo(&info, 0) == 0);
+    Require(sceNetGetDnsInfo(&read, 0) == 2 && read.primaryAddress == 0x08080808u && read.secondaryAddress == 0x04040808u);
+    Require(sceNetSetDnsInfo(nullptr, 0) == 0);
+    Require(sceNetGetDnsInfo(&read, 0) >= 0);
+
+    NetDns6Info info6{};
+    Require(Failed(sceNetGetDnsInfo(nullptr, 0), kEinval));
+    Require(Failed(sceNetGetDns6Info(nullptr, 0), kEinval));
+    for (const std::uint32_t flags : {1u, 2u, 0xffffffffu}) {
+        NetDnsInfo unchanged{0x5a5a5a5au, 0x5a5a5a5au};
+        const NetDnsInfo before = unchanged;
+        std::memset(&info6, 0x5a, sizeof(info6));
+        const NetDns6Info before6 = info6;
+        Require(Failed(sceNetGetDnsInfo(&unchanged, flags), kEinval));
+        Require(Failed(sceNetGetDns6Info(&info6, flags), kEinval));
+        Require(Failed(sceNetGetDnsInfo(nullptr, flags), kEinval));
+        Require(Failed(sceNetGetDns6Info(nullptr, flags), kEinval));
+        Require(Failed(sceNetSetDnsInfo(nullptr, flags), kEinval));
+        Require(Failed(sceNetSetDns6Info(nullptr, flags), kEinval));
+        Require(std::memcmp(&unchanged, &before, sizeof(before)) == 0);
+        Require(std::memcmp(&info6, &before6, sizeof(before6)) == 0);
+    }
+    std::memset(&info6, 0xff, sizeof(info6));
+    Require(sceNetGetDns6Info(&info6, 0) == 0);
+    for (const auto byte : info6.primaryAddress.bytes) Require(byte == 0);
+    for (const auto byte : info6.secondaryAddress.bytes) Require(byte == 0);
+
+    NetDns6Info set6{};
+    Require(Failed(sceNetSetDns6Info(&set6, 0), kEinval));
+    set6.primaryAddress.bytes[0] = 0x20;
+    set6.primaryAddress.bytes[15] = 0x01;
+    Require(Failed(sceNetSetDns6Info(&set6, 2), kEinval));
+    Require(sceNetSetDns6Info(&set6, 0) == 0);
+    Require(sceNetGetDns6Info(&info6, 0) == 1 && std::memcmp(&info6, &set6, sizeof(set6)) == 0);
+    set6.secondaryAddress.bytes[0] = 0x26;
+    Require(sceNetSetDns6Info(&set6, 0) == 0);
+    Require(sceNetGetDns6Info(&info6, 0) == 2 && std::memcmp(&info6, &set6, sizeof(set6)) == 0);
+    Require(sceNetSetDns6Info(nullptr, 0) == 0);
+    Require(sceNetGetDns6Info(&info6, 0) == 0);
+}
+
+}
+
+void* UnreadablePage() {
+#ifdef _WIN32
+    return VirtualAlloc(nullptr, 4096, MEM_RESERVE | MEM_COMMIT, PAGE_NOACCESS);
+#else
+    void* page = mmap(nullptr, 4096, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    return page == MAP_FAILED ? nullptr : page;
+#endif
+}
+
+void CheckUnreadableInfo() {
+    void* page = UnreadablePage();
+    Require(page != nullptr);
+    NetDnsInfo info{0x08080808u, 0};
+    Require(sceNetSetDnsInfo(&info, 0) == 0);
+    Require(Failed(sceNetSetDnsInfo(static_cast<const NetDnsInfo*>(page), 1), kEinval));
+    Require(Failed(sceNetSetDnsInfo(static_cast<const NetDnsInfo*>(page), 0), kEfault));
+    NetDnsInfo read{};
+    Require(sceNetGetDnsInfo(&read, 0) == 1 && read.primaryAddress == 0x08080808u);
+    Require(sceNetSetDnsInfo(nullptr, 0) == 0);
+
+    NetDns6Info info6{};
+    info6.primaryAddress.bytes[0] = 0x20;
+    Require(sceNetSetDns6Info(&info6, 0) == 0);
+    Require(Failed(sceNetSetDns6Info(static_cast<const NetDns6Info*>(page), 1), kEinval));
+    Require(Failed(sceNetSetDns6Info(static_cast<const NetDns6Info*>(page), 0), kEfault));
+    NetDns6Info read6{};
+    Require(sceNetGetDns6Info(&read6, 0) == 1 && std::memcmp(&read6, &info6, sizeof(info6)) == 0);
+    Require(sceNetSetDns6Info(nullptr, 0) == 0);
+#ifdef _WIN32
+    Require(VirtualFree(page, 0, MEM_RELEASE) != 0);
+#else
+    Require(munmap(page, 4096) == 0);
+#endif
+}
+
+int main() {
+    CheckUninitialized();
+    Require(sceNetInit_nid_postfix() == 0);
+    CheckDns();
+    CheckUnreadableInfo();
+    Require(sceNetTerm() == 0);
+    CheckUninitialized();
+    return 0;
+}
diff --git a/core/libs/tests/GuestNetKeepalive.cpp b/core/libs/tests/GuestNetKeepalive.cpp
new file mode 100644
index 0000000000..d8d8624a88
--- /dev/null
+++ b/core/libs/tests/GuestNetKeepalive.cpp
@@ -0,0 +1,115 @@
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <winsock2.h>
+#else
+#include <sys/socket.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include "prx/libSceNet/libSceNet.hpp"
+#include "prx/libkernel/libkernel.hpp"
+#include "prx/libkernel/Socket/include/SocketPoll.hpp"
+
+
+static void Require(bool condition) {
+    if (!condition) std::abort();
+}
+
+static bool Failed(std::int64_t result, int error) {
+    return result == static_cast<int>(0x80410100u | static_cast<unsigned>(error)) && *sceNetErrnoLoc() == error;
+}
+
+static void CheckKeepalive() {
+    for (const int family : {2, 28}) {
+        for (const int type : {1, 2}) {
+            const int socket = sceNetSocket("keepalive", family, type, type == 1 ? 6 : 17);
+            Require(socket >= 0);
+            int value = -1;
+            std::uint32_t size = sizeof(value);
+            Require(sceNetGetsockopt(socket, 0xffff, 8, &value, &size) == 0 && value == 0 && size == sizeof(value));
+            for (const int setting : {1, -1, 0, 8, 0}) {
+                Require(sceNetSetsockopt(socket, 0xffff, 8, &setting, sizeof(setting)) == 0);
+                size = sizeof(value);
+                Require(sceNetGetsockopt(socket, 0xffff, 8, &value, &size) == 0 && value == (setting ? 8 : 0));
+                if (type == 1) {
+                    std::shared_ptr<void> owner;
+                    std::uintptr_t native = 0;
+                    Require(KernelFindSocketNative_nid_no_patch(socket, &owner, &native));
+                    int enabled = 0;
+#ifdef _WIN32
+                    int length = sizeof(enabled);
+#else
+                    socklen_t length = sizeof(enabled);
+#endif
+                    Require(::getsockopt(native, SOL_SOCKET, SO_KEEPALIVE, reinterpret_cast<char*>(&enabled), &length) == 0);
+                    Require((enabled != 0) == (setting != 0));
+                }
+            }
+            const int enabled = 1;
+            Require(Failed(sceNetSetsockopt(socket, 0xffff, 8, &enabled, sizeof(enabled) - 1), 22));
+            Require(Failed(sceNetSetsockopt(socket, 0xffff, 8, nullptr, sizeof(enabled)), 22));
+            Require(setsockopt_nid_postfix(socket, 0xffff, 8, &enabled, sizeof(enabled)) == 0);
+            const int other = sceNetSocket("keepalive-other", family, type, type == 1 ? 6 : 17);
+            Require(other >= 0);
+            size = sizeof(value);
+            Require(sceNetGetsockopt(other, 0xffff, 8, &value, &size) == 0 && value == 0);
+            Require(sceNetSocketClose(other) == 0);
+            Require(Failed(sceNetGetsockopt(socket, 0xffff, 8, nullptr, &size), 22));
+            Require(Failed(sceNetGetsockopt(socket, 0xffff, 8, &value, nullptr), 22));
+            for (const std::uint32_t length : {0u, 1u, 3u, 4u, 8u}) {
+                std::array<std::uint8_t, 8> bytes;
+                bytes.fill(0xa5);
+                size = length;
+                const int expected = 8;
+                Require(sceNetGetsockopt(socket, 0xffff, 8, bytes.data(), &size) == 0 && size == std::min(length, 4u));
+                Require(std::memcmp(bytes.data(), &expected, size) == 0);
+                Require(std::all_of(bytes.begin() + size, bytes.end(), [](auto byte) { return byte == 0xa5; }));
+            }
+            Require(sceNetSocketClose(socket) == 0);
+            size = sizeof(value);
+            Require(Failed(sceNetGetsockopt(socket, 0xffff, 8, &value, &size), 9));
+            Require(Failed(sceNetSetsockopt(socket, 0xffff, 8, &enabled, sizeof(enabled)), 9));
+        }
+    }
+}
+
+int main() {
+    Require(sceNetInit_nid_postfix() == 0);
+    CheckKeepalive();
+    const auto readFlag = [](int socket) {
+        int value = -1;
+        std::uint32_t size = sizeof(value);
+        Require(sceNetGetsockopt(socket, 0xffff, 8, &value, &size) == 0 && size == sizeof(value));
+        return value;
+    };
+    for (const int family : {2, 28}) {
+        const int listener = sceNetSocket("keepalive-listener", family, 1, 6);
+        const int client = sceNetSocket("keepalive-client", family, 1, 6);
+        Require(listener >= 0 && client >= 0);
+        const int on = 1;
+        const int off = 0;
+        Require(sceNetSetsockopt(listener, 0xffff, 8, &on, sizeof(on)) == 0);
+        std::array<std::uint8_t, 28> address{};
+        std::uint32_t size = family == 2 ? 16 : 28;
+        address[0] = size;
+        address[1] = family;
+        if (family == 2) {
+            address[4] = 127;
+            address[7] = 1;
+        } else {
+            address[23] = 1;
+        }
+        Require(sceNetBind_nid_postfix(listener, address.data(), size) == 0);
+        Require(sceNetListen(listener, 1) == 0);
+        Require(sceNetGetsockname(listener, address.data(), &size) == 0);
+        Require(sceNetConnect(client, address.data(), size) == 0);
+        const int accepted = sceNetAccept(listener, nullptr, nullptr);
+        Require(accepted >= 0 && readFlag(accepted) == 8 && readFlag(client) == 0);
+        Require(sceNetSetsockopt(listener, 0xffff, 8, &off, sizeof(off)) == 0);
+        Require(readFlag(listener) == 0 && readFlag(accepted) == 8);
+        for (const int socket : {accepted, client, listener}) Require(sceNetSocketClose(socket) == 0);
+    }
+}
diff --git a/core/libs/tests/GuestNetNodelayReadback.cpp b/core/libs/tests/GuestNetNodelayReadback.cpp
new file mode 100644
index 0000000000..ad296cdba6
--- /dev/null
+++ b/core/libs/tests/GuestNetNodelayReadback.cpp
@@ -0,0 +1,77 @@
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <winsock2.h>
+#else
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include "prx/libSceNet/libSceNet.hpp"
+#include "prx/libkernel/Socket/include/SocketPoll.hpp"
+
+
+static void Require(bool condition, std::source_location where = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "check failed at line %u\n", where.line());
+        std::abort();
+    }
+}
+
+static void CheckValue(int socket, int expected) {
+    for (const std::uint32_t capacity : {0u, 1u, 2u, 3u, 4u, 8u}) {
+        std::array<std::uint8_t, 8> bytes;
+        bytes.fill(0xa5);
+        auto size = capacity;
+        Require(sceNetGetsockopt(socket, 6, 1, bytes.data(), &size) == 0);
+        Require(size == std::min(capacity, 4u));
+        Require(std::memcmp(bytes.data(), &expected, size) == 0);
+        Require(std::all_of(bytes.begin() + size, bytes.end(), [](auto value) { return value == 0xa5; }));
+    }
+}
+
+int main() {
+    Require(sceNetInit_nid_postfix() == 0);
+    for (const int family : {2, 28}) {
+        const int socket = sceNetSocket("nodelay", family, 1, 6);
+        const int other = sceNetSocket("nodelay-other", family, 1, 0);
+        const int datagram = sceNetSocket("nodelay-datagram", family, 2, 17);
+        Require(socket >= 0 && other >= 0 && datagram >= 0);
+        CheckValue(socket, 0);
+        for (const int requested : {1, 0, -1, 256, 0}) {
+            Require(sceNetSetsockopt(socket, 6, 1, &requested, sizeof(requested)) == 0);
+            CheckValue(socket, requested != 0 ? 4 : 0);
+            CheckValue(other, 0);
+        }
+        std::shared_ptr<void> owner;
+        std::uintptr_t native = 0;
+        Require(KernelFindSocketNative_nid_no_patch(socket, &owner, &native));
+        const int enabled = 1;
+        Require(::setsockopt(native, IPPROTO_TCP, TCP_NODELAY,
+            reinterpret_cast<const char*>(&enabled), sizeof(enabled)) == 0);
+        CheckValue(socket, 4);
+        std::uint32_t size = 0;
+        int value = 99;
+        Require(sceNetGetsockopt(socket, 6, 1, nullptr, &size) < 0 && *sceNetErrnoLoc() == 22);
+        Require(sceNetGetsockopt(socket, 6, 1, &value, nullptr) < 0 && *sceNetErrnoLoc() == 22);
+        for (const std::uint32_t capacity : {0u, 3u, 4u}) {
+            size = capacity;
+            Require(sceNetGetsockopt(datagram, 6, 1, &value, &size) < 0 && *sceNetErrnoLoc() == 22);
+            Require(size == capacity && value == 99);
+            Require(sceNetGetsockopt(socket, 6, 0x7fffffff, &value, &size) < 0);
+            Require(*sceNetErrnoLoc() == (capacity < 4 ? 22 : 42));
+            Require(size == capacity && value == 99);
+        }
+        owner.reset();
+        for (const int descriptor : {socket, other, datagram}) Require(sceNetSocketClose(descriptor) == 0);
+        size = 0;
+        Require(sceNetGetsockopt(socket, 6, 1, &value, &size) < 0 && *sceNetErrnoLoc() == 9);
+        Require(size == 0 && value == 99);
+    }
+}
diff --git a/core/libs/tests/GuestNetOobInline.cpp b/core/libs/tests/GuestNetOobInline.cpp
new file mode 100644
index 0000000000..6a8e4c4cf5
--- /dev/null
+++ b/core/libs/tests/GuestNetOobInline.cpp
@@ -0,0 +1,135 @@
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <winsock2.h>
+#else
+#include <sys/socket.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include "prx/libSceNet/libSceNet.hpp"
+#include "prx/libkernel/Socket/include/SocketPoll.hpp"
+
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "check failed at line %u\n", location.line());
+        std::abort();
+    }
+}
+
+static void CheckFlag(int socket, int expected) {
+    for (const std::uint32_t capacity : {0u, 1u, 3u, 4u, 8u}) {
+        std::array<std::uint8_t, 8> bytes;
+        bytes.fill(0xa5);
+        std::uint32_t size = capacity;
+        Require(sceNetGetsockopt(socket, 0xffff, 0x100, bytes.data(), &size) == 0 && size == std::min(capacity, 4u));
+        Require(std::memcmp(bytes.data(), &expected, size) == 0);
+        Require(std::all_of(bytes.begin() + size, bytes.end(), [](auto byte) { return byte == 0xa5; }));
+    }
+}
+
+static void CheckInheritance(int family, int beforeListen, bool changeAfterListen) {
+    std::fprintf(stderr, "inheritance family=%d beforeListen=%d changeAfterListen=%d\n",
+        family, beforeListen, changeAfterListen);
+    const int listener = sceNetSocket("inheritance-listener", family, 1, 6);
+    const int client = sceNetSocket("inheritance-client", family, 1, 6);
+    Require(listener >= 0 && client >= 0);
+    Require(sceNetSetsockopt(listener, 0xffff, 0x100, &beforeListen, sizeof(beforeListen)) == 0);
+    CheckFlag(listener, beforeListen != 0 ? 256 : 0);
+    std::array<std::uint8_t, 28> address{};
+    std::uint32_t size = family == 2 ? 16 : 28;
+    address[0] = size;
+    address[1] = family;
+    if (family == 2) { address[4] = 127; address[7] = 1; }
+    else address[23] = 1;
+    Require(sceNetBind_nid_postfix(listener, address.data(), size) == 0);
+    Require(sceNetListen(listener, 1) == 0);
+    const int setting = changeAfterListen ? 1 - beforeListen : beforeListen;
+    if (changeAfterListen)
+        Require(sceNetSetsockopt(listener, 0xffff, 0x100, &setting, sizeof(setting)) == 0);
+    CheckFlag(listener, setting != 0 ? 256 : 0);
+    Require(sceNetGetsockname(listener, address.data(), &size) == 0);
+    Require(sceNetConnect(client, address.data(), size) == 0);
+    const int accepted = sceNetAccept(listener, nullptr, nullptr);
+    Require(accepted >= 0);
+    CheckFlag(accepted, setting != 0 ? 256 : 0);
+    CheckFlag(client, 0);
+    const int opposite = 1 - setting;
+    Require(sceNetSetsockopt(listener, 0xffff, 0x100, &opposite, sizeof(opposite)) == 0);
+    CheckFlag(listener, opposite != 0 ? 256 : 0);
+    CheckFlag(accepted, setting != 0 ? 256 : 0);
+    Require(sceNetSetsockopt(listener, 0xffff, 0x100, &setting, sizeof(setting)) == 0);
+    Require(sceNetSetsockopt(accepted, 0xffff, 0x100, &opposite, sizeof(opposite)) == 0);
+    CheckFlag(accepted, opposite != 0 ? 256 : 0);
+    CheckFlag(listener, setting != 0 ? 256 : 0);
+    CheckFlag(client, 0);
+    for (const int socket : {accepted, client, listener}) Require(sceNetSocketClose(socket) == 0);
+}
+
+int main() {
+    Require(sceNetInit_nid_postfix() == 0);
+    for (const int family : {2, 28}) {
+        for (const int beforeListen : {0, 1}) {
+            for (const bool changeAfterListen : {false, true})
+                CheckInheritance(family, beforeListen, changeAfterListen);
+        }
+        const int datagram = sceNetSocket("inline-datagram", family, 2, 17);
+        const int listener = sceNetSocket("inline-listener", family, 1, 6);
+        const int client = sceNetSocket("inline-client", family, 1, 6);
+        Require(datagram >= 0 && listener >= 0 && client >= 0);
+        for (const int socket : {datagram, listener}) {
+            CheckFlag(socket, 0);
+            for (const int setting : {1, -1, 0, 256, 0, 1}) {
+                Require(sceNetSetsockopt(socket, 0xffff, 0x100, &setting, sizeof(setting)) == 0);
+                CheckFlag(socket, setting != 0 ? 256 : 0);
+            }
+            const int on = 1;
+            Require(sceNetSetsockopt(socket, 0xffff, 0x100, &on, 3) == static_cast<int>(0x80410116u));
+            Require(*sceNetErrnoLoc() == 22);
+            Require(sceNetSetsockopt(socket, 0xffff, 0x100, nullptr, 4) == static_cast<int>(0x80410116u));
+        }
+        CheckFlag(client, 0);
+        std::array<std::uint8_t, 28> address{};
+        std::uint32_t size = family == 2 ? 16 : 28;
+        address[0] = size;
+        address[1] = family;
+        if (family == 2) { address[4] = 127; address[7] = 1; }
+        else address[23] = 1;
+        Require(sceNetBind_nid_postfix(listener, address.data(), size) == 0);
+        Require(sceNetListen(listener, 1) == 0);
+        Require(sceNetGetsockname(listener, address.data(), &size) == 0);
+        Require(sceNetConnect(client, address.data(), size) == 0);
+        const int accepted = sceNetAccept(listener, nullptr, nullptr);
+        Require(accepted >= 0);
+        CheckFlag(accepted, 256);
+        const int timeout = 500000;
+        Require(sceNetSetsockopt(accepted, 0xffff, 0x1106, &timeout, sizeof(timeout)) == 0);
+        std::shared_ptr<void> owner;
+        std::uintptr_t native = 0;
+        Require(KernelFindSocketNative_nid_no_patch(client, &owner, &native));
+        Require(::send(native, "A", 1, 0) == 1);
+        Require(::send(native, "!", 1, MSG_OOB) == 1);
+        Require(::send(native, "B", 1, 0) == 1);
+        std::array<char, 3> received{};
+        std::size_t count = 0;
+        while (count < received.size()) {
+            const auto result = sceNetRecv(accepted, received.data() + count, received.size() - count, 0);
+            Require(result > 0);
+            count += result;
+        }
+        Require(std::memcmp(received.data(), "A!B", 3) == 0);
+        const int off = 0;
+        Require(sceNetSetsockopt(listener, 0xffff, 0x100, &off, sizeof(off)) == 0);
+        CheckFlag(listener, 0);
+        CheckFlag(accepted, 256);
+        for (const int socket : {accepted, client, listener, datagram}) Require(sceNetSocketClose(socket) == 0);
+        int value = 0;
+        size = sizeof(value);
+        Require(sceNetGetsockopt(listener, 0xffff, 0x100, &value, &size) == static_cast<int>(0x80410109u));
+    }
+}
diff --git a/core/libs/tests/GuestNetProtocol.cpp b/core/libs/tests/GuestNetProtocol.cpp
new file mode 100644
index 0000000000..038c59f77d
--- /dev/null
+++ b/core/libs/tests/GuestNetProtocol.cpp
@@ -0,0 +1,71 @@
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include "prx/libSceNet/libSceNet.hpp"
+
+
+static void Require(bool condition, std::source_location where = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "check failed at line %u\n", where.line());
+        std::abort();
+    }
+}
+
+static void CheckProtocol(int socket, int expected) {
+    for (const std::uint32_t capacity : {0u, 1u, 3u, 4u, 8u}) {
+        std::array<std::uint8_t, 8> bytes;
+        bytes.fill(0xa5);
+        auto size = capacity;
+        Require(sceNetGetsockopt(socket, 0xffff, 0x1016, bytes.data(), &size) == 0);
+        Require(size == std::min(capacity, 4u));
+        Require(std::memcmp(bytes.data(), &expected, size) == 0);
+        Require(std::all_of(bytes.begin() + size, bytes.end(), [](auto value) { return value == 0xa5; }));
+    }
+}
+
+int main() {
+    Require(sceNetInit_nid_postfix() == 0);
+    for (const int family : {2, 28}) {
+        for (const int type : {1, 2}) {
+            const int expected = type == 1 ? 6 : 17;
+            for (const int protocol : {0, expected}) {
+                const int socket = sceNetSocket("protocol", family, type, protocol);
+                Require(socket >= 0);
+                CheckProtocol(socket, expected);
+                std::uint32_t size = 4;
+                int value = 99;
+                Require(sceNetGetsockopt(socket, 0xffff, 0x1016, nullptr, &size) < 0 && *sceNetErrnoLoc() == 22);
+                Require(sceNetGetsockopt(socket, 0xffff, 0x1016, &value, nullptr) < 0 && *sceNetErrnoLoc() == 22);
+                Require(value == 99 && size == 4);
+                Require(sceNetSetsockopt(socket, 0xffff, 0x1016, &value, sizeof(value)) < 0);
+                CheckProtocol(socket, expected);
+                Require(sceNetSocketClose(socket) == 0);
+                Require(sceNetGetsockopt(socket, 0xffff, 0x1016, &value, &size) < 0 && *sceNetErrnoLoc() == 9);
+                Require(value == 99 && size == 4);
+            }
+        }
+        const int listener = sceNetSocket("protocol-listener", family, 1, 0);
+        const int client = sceNetSocket("protocol-client", family, 1, 6);
+        Require(listener >= 0 && client >= 0);
+        std::array<std::uint8_t, 28> address{};
+        std::uint32_t size = family == 2 ? 16 : 28;
+        address[0] = size;
+        address[1] = family;
+        if (family == 2) { address[4] = 127; address[7] = 1; }
+        else address[23] = 1;
+        Require(sceNetBind_nid_postfix(listener, address.data(), size) == 0);
+        Require(sceNetListen(listener, 1) == 0);
+        CheckProtocol(listener, 6);
+        Require(sceNetGetsockname(listener, address.data(), &size) == 0);
+        Require(sceNetConnect(client, address.data(), size) == 0);
+        const int accepted = sceNetAccept(listener, nullptr, nullptr);
+        Require(accepted >= 0);
+        CheckProtocol(accepted, 6);
+        CheckProtocol(client, 6);
+        for (const int socket : {accepted, client, listener}) Require(sceNetSocketClose(socket) == 0);
+    }
+}
diff --git a/core/libs/tests/GuestNetSocketState.cpp b/core/libs/tests/GuestNetSocketState.cpp
new file mode 100644
index 0000000000..2101d0c167
--- /dev/null
+++ b/core/libs/tests/GuestNetSocketState.cpp
@@ -0,0 +1,74 @@
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include "prx/libSceNet/libSceNet.hpp"
+
+
+static void Require(bool condition) {
+    if (!condition) std::abort();
+}
+
+static void CheckOption(int socket, int option, int expected) {
+    for (const std::uint32_t capacity : {0u, 1u, 3u, 4u, 8u}) {
+        std::array<std::uint8_t, 8> bytes;
+        bytes.fill(0xa5);
+        std::uint32_t size = capacity;
+        Require(sceNetGetsockopt(socket, 0xffff, option, bytes.data(), &size) == 0);
+        Require(size == std::min(capacity, 4u));
+        Require(std::memcmp(bytes.data(), &expected, size) == 0);
+        Require(std::all_of(bytes.begin() + size, bytes.end(), [](auto byte) { return byte == 0xa5; }));
+    }
+}
+
+int main() {
+    Require(sceNetInit_nid_postfix() == 0);
+    for (const int family : {2, 28}) {
+        const int datagram = sceNetSocket("state-datagram", family, 2, 17);
+        const int listener = sceNetSocket("state-listener", family, 1, 6);
+        const int client = sceNetSocket("state-client", family, 1, 6);
+        Require(datagram >= 0 && listener >= 0 && client >= 0);
+        CheckOption(datagram, 0x1008, 2);
+        CheckOption(datagram, 2, 0);
+        CheckOption(listener, 0x1008, 1);
+        CheckOption(listener, 2, 0);
+        std::array<std::uint8_t, 28> address{};
+        const std::uint32_t addressSize = family == 2 ? 16 : 28;
+        address[0] = addressSize;
+        address[1] = family;
+        if (family == 2) {
+            address[4] = 127;
+            address[7] = 1;
+        } else {
+            address[23] = 1;
+        }
+        Require(sceNetBind_nid_postfix(listener, address.data(), addressSize) == 0);
+        Require(sceNetListen(listener, 1) == 0);
+        CheckOption(listener, 2, 2);
+        CheckOption(client, 2, 0);
+        std::uint32_t size = addressSize;
+        Require(sceNetGetsockname(listener, address.data(), &size) == 0);
+        Require(sceNetConnect(client, address.data(), size) == 0);
+        const int accepted = sceNetAccept(listener, nullptr, nullptr);
+        Require(accepted >= 0);
+        CheckOption(listener, 2, 2);
+        CheckOption(client, 0x1008, 1);
+        CheckOption(client, 2, 0);
+        CheckOption(accepted, 0x1008, 1);
+        CheckOption(accepted, 2, 0);
+        int value = 0;
+        size = sizeof(value);
+        for (const int option : {2, 0x1008}) {
+            Require(sceNetGetsockopt(listener, 0xffff, option, nullptr, &size) == static_cast<int>(0x80410116u));
+            Require(*sceNetErrnoLoc() == 22);
+            Require(sceNetGetsockopt(listener, 0xffff, option, &value, nullptr) == static_cast<int>(0x80410116u));
+            Require(*sceNetErrnoLoc() == 22);
+        }
+        for (const int socket : {accepted, client, listener, datagram}) Require(sceNetSocketClose(socket) == 0);
+        for (const int option : {2, 0x1008}) {
+            Require(sceNetGetsockopt(listener, 0xffff, option, &value, &size) == static_cast<int>(0x80410109u));
+            Require(*sceNetErrnoLoc() == 9);
+        }
+    }
+}
diff --git a/core/libs/tests/GuestNetThread.cpp b/core/libs/tests/GuestNetThread.cpp
new file mode 100644
index 0000000000..abdc2c22d8
--- /dev/null
+++ b/core/libs/tests/GuestNetThread.cpp
@@ -0,0 +1,73 @@
+#include "prx/libSceNet/include/Net.hpp"
+#include "SceTypes.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <thread>
+
+namespace {
+
+constexpr int Einval = 22;
+constexpr int Eopnotsupp = 45;
+constexpr int NetError = static_cast<int>(0x80410100u);
+
+
+
+struct Run {
+    std::atomic<int> started{0};
+    std::atomic<bool> pastExit{false};
+};
+
+Run run;
+
+void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", what);
+    std::abort();
+}
+
+void APS5_VABI Count(void* arg) {
+    ++static_cast<Run*>(arg)->started;
+}
+
+void APS5_VABI ExitEarly(void* arg) {
+    auto* run = static_cast<Run*>(arg);
+    ++run->started;
+    sceNetThreadExit();
+    run->pastExit = true;
+}
+
+}
+
+int main() {
+    NetThreadParameter counting{Count, &run, 0, 0};
+    Pthread thread = nullptr;
+    Require(sceNetThreadCreate(&thread, &counting, "anyps5-net-thread") == 0 && thread != nullptr, "sceNetThreadCreate failed");
+    Require(sceNetThreadJoin(thread) == 0, "sceNetThreadJoin failed");
+    Require(run.started == 1, "the thread did not run its entry with its argument");
+
+    Pthread untouched = reinterpret_cast<Pthread>(&run);
+    *sceNetErrnoLoc() = 0;
+    Require(sceNetThreadCreate(&untouched, nullptr, "anyps5-net-thread") == (NetError | Einval), "a null parameter was not refused with EINVAL");
+    Require(*sceNetErrnoLoc() == Einval && untouched == reinterpret_cast<Pthread>(&run), "a refused create set no errno or wrote the thread");
+
+    NetThreadParameter exiting{ExitEarly, &run, 0, 1};
+    Require(sceNetThreadCreate(&thread, &exiting, nullptr) == 0, "sceNetThreadCreate failed without a name");
+    Require(sceNetThreadJoin(thread) == 0, "joining an exited thread failed");
+    Require(run.started == 2 && !run.pastExit, "sceNetThreadExit did not end the thread");
+
+    static NetThreadParameter detached{Count, &run, 0, 0};
+    Require(sceNetThreadCreate(nullptr, &detached, "anyps5-net-thread") == 0, "a null thread output was refused");
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (run.started != 3 && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    Require(run.started == 3, "the thread created without an output did not run");
+
+    *sceNetErrnoLoc() = 0;
+    Require(sceNetEmulationGet(nullptr, 0) == (NetError | Eopnotsupp) && *sceNetErrnoLoc() == Eopnotsupp, "sceNetEmulationGet did not return EOPNOTSUPP");
+    *sceNetErrnoLoc() = 0;
+    Require(sceNetEmulationSet(nullptr, 0) == (NetError | Eopnotsupp) && *sceNetErrnoLoc() == Eopnotsupp, "sceNetEmulationSet did not return EOPNOTSUPP");
+    std::puts("net thread tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNewHandler.cpp b/core/libs/tests/GuestNewHandler.cpp
index 04a5d9a8a1..29b5acfc3c 100644
--- a/core/libs/tests/GuestNewHandler.cpp
+++ b/core/libs/tests/GuestNewHandler.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -11,15 +12,7 @@
 
 extern "C" {
 using Handler = void (APS5_VABI*)();
-Handler APS5_VABI _ZSt15set_new_handlerPFvvE_nid_postfix(Handler);
-Handler APS5_VABI _ZSt15get_new_handlerv_nid_postfix();
-void* APS5_VABI _Znwm_nid_postfix(std::size_t);
-void* APS5_VABI _Znam_nid_postfix(std::size_t);
-void* APS5_VABI _ZnwmSt11align_val_t_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI _ZnwmRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void* APS5_VABI _ZnamRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void APS5_VABI _ZdlPv_nid_postfix(void*);
-void APS5_VABI _ZdlPvSt11align_val_t_nid_postfix(void*, std::size_t);
+
 }
 
 namespace {
@@ -27,6 +20,7 @@ namespace {
 alignas(16) std::array<std::byte, 64> storage{};
 unsigned failuresLeft = 0;
 unsigned allocations = 0;
+unsigned releases = 0;
 unsigned handlerCalls = 0;
 std::size_t lastSize = 0;
 std::size_t lastAlignment = 0;
@@ -50,7 +44,7 @@ void* APS5_VABI allocate(std::size_t bytes) {
     return storage.data();
 }
 
-void APS5_VABI release(void*) {}
+void APS5_VABI release(void*) { ++releases; }
 void* APS5_VABI allocateZeroed(std::size_t count, std::size_t bytes) { return allocate(count * bytes); }
 void* APS5_VABI reallocate(void*, std::size_t bytes) { return allocate(bytes); }
 void* APS5_VABI align(std::size_t alignment, std::size_t bytes) {
@@ -80,6 +74,7 @@ void APS5_VABI allocatingHandler() {
 void Reset(unsigned failures) {
     failuresLeft = failures;
     allocations = 0;
+    releases = 0;
     handlerCalls = 0;
 }
 
@@ -138,6 +133,17 @@ int main(int argc, char** argv) {
 
     REQUIRE(_ZSt15get_new_handlerv_nid_postfix() == nullptr);
 
+    Reset(0);
+    void* nothrowPointer = _Znwm_nid_postfix(8);
+    const int nothrowTag = 0;
+    REQUIRE(nothrowPointer == storage.data() && releases == 0);
+    _ZdlPvRKSt9nothrow_t_nid_postfix(nothrowPointer, &nothrowTag);
+
+    REQUIRE(releases == 1);
+    _ZdlPvRKSt9nothrow_t_nid_postfix(nullptr, &nothrowTag);
+
+    REQUIRE(releases == 1);
+
     Reset(1);
     REQUIRE(Throws([] { _Znwm_nid_postfix(8); }) && handlerCalls == 0 && allocations == 1);
     Reset(1);
@@ -186,6 +192,7 @@ int main(int argc, char** argv) {
     void* aligned = _ZnwmSt11align_val_t_nid_postfix(24, 16);
     REQUIRE(aligned == storage.data() && lastSize == 24 && lastAlignment == 16 && allocations == 1);
     _ZdlPvSt11align_val_t_nid_postfix(aligned, 16);
+
     Reset(1);
     REQUIRE(Throws([] { _ZnwmSt11align_val_t_nid_postfix(8, 32); }) && handlerCalls == 0 && allocations == 1);
 
@@ -193,6 +200,7 @@ int main(int argc, char** argv) {
     REQUIRE(_ZnwmSt11align_val_t_nid_postfix(0, 16) == storage.data() && lastSize == 1 && lastAlignment == 16);
     Reset(2);
     _ZSt15set_new_handlerPFvvE_nid_postfix(&countingHandler);
+
     REQUIRE(_ZnwmSt11align_val_t_nid_postfix(8, 16) == storage.data() && handlerCalls == 2 && allocations == 3);
     _ZSt15set_new_handlerPFvvE_nid_postfix(nullptr);
 
diff --git a/core/libs/tests/GuestNpAuth.cpp b/core/libs/tests/GuestNpAuth.cpp
index 695d37a67d..a1920ceb5c 100644
--- a/core/libs/tests/GuestNpAuth.cpp
+++ b/core/libs/tests/GuestNpAuth.cpp
@@ -1,26 +1,10 @@
+#include "prx/libSceNpAuth/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceNpAuthAbortRequest(int req_id);
-int APS5_VABI sceNpAuthCreateAsyncRequest(const void* param);
-int APS5_VABI sceNpAuthCreateRequest(void);
-int APS5_VABI sceNpAuthDeleteRequest(int req_id);
-int APS5_VABI sceNpAuthGetAuthorizationCode(int req_id, const void* param, void* auth_code);
-int APS5_VABI sceNpAuthGetAuthorizationCodeA(int req_id, const void* param, void* auth_code, int* issuer_id);
-int APS5_VABI sceNpAuthGetAuthorizationCodeV3(int req_id, const void* param, void* auth_code, int* issuer_id);
-int APS5_VABI sceNpAuthGetAuthorizedAppCode(std::int32_t, const NpAuthAuthorizedAppCodeParameter*, char*, std::int32_t*, bool*);
-int APS5_VABI sceNpAuthGetIdToken(int req_id, const void* param, void* id_token);
-int APS5_VABI sceNpAuthGetIdTokenA(int req_id, const void* param, void* id_token);
-int APS5_VABI sceNpAuthGetIdTokenV3(int req_id, const void* param, void* id_token);
-int APS5_VABI sceNpAuthPollAsync(int req_id, int* result);
-int APS5_VABI sceNpAuthSetTimeout(int req_id, int resolve_retry, uint32_t resolve_timeout, uint32_t connect_timeout, uint32_t send_timeout, uint32_t receive_timeout);
-int APS5_VABI sceNpAuthWaitAsync(int req_id, int* result);
-}
-
 static void Require(bool condition) {
     if (!condition) {
         std::abort();
diff --git a/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp b/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp
index a5d7f6fe17..b644c62ed3 100644
--- a/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp
+++ b/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp
@@ -1,14 +1,9 @@
+#include "prx/libSceNpAuth/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpAuthCreateRequest();
-int APS5_VABI sceNpAuthDeleteRequest(int);
-int APS5_VABI sceNpAuthGetAuthorizedAppCode(std::int32_t, const NpAuthAuthorizedAppCodeParameter*, char*, std::int32_t*, bool*);
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
@@ -41,6 +36,7 @@ int main() {
     bool threw = false;
     try {
         sceNpAuthGetAuthorizedAppCode(requestId, &parameter, code.data(), nullptr, &authorizationRequired);
+
     } catch (const std::logic_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp b/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp
index aedef7375a..a8fecd529b 100644
--- a/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp
+++ b/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -5,18 +6,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceNpAuthAuthorizedAppDialogInitialize(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogOpen(const NpAuthAuthorizedAppDialogParam* param);
-int APS5_VABI sceNpAuthAuthorizedAppDialogUpdateStatus(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogGetStatus(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogGetResult(std::int32_t* result);
-int APS5_VABI sceNpAuthAuthorizedAppDialogClose(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestNpCommerceDialog.cpp b/core/libs/tests/GuestNpCommerceDialog.cpp
index 3db9b4c3b3..58383cb878 100644
--- a/core/libs/tests/GuestNpCommerceDialog.cpp
+++ b/core/libs/tests/GuestNpCommerceDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCommerce/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 #include <array>
@@ -9,20 +10,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceNpCommerceDialogInitialize();
-int APS5_VABI sceNpCommerceDialogInitializeInternal();
-int APS5_VABI sceNpCommerceDialogOpen(const NpCommerceDialogParam* param);
-int APS5_VABI sceNpCommerceDialogOpen2(const NpCommerceDialogParam2* param);
-int APS5_VABI sceNpCommerceDialogUpdateStatus(void);
-int APS5_VABI sceNpCommerceDialogGetStatus(void);
-int APS5_VABI sceNpCommerceDialogGetResult(NpCommerceDialogResult* result);
-int APS5_VABI sceNpCommerceDialogClose(void);
-int APS5_VABI sceNpCommerceDialogTerminate();
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -157,6 +144,7 @@ int main() {
     bool threw = false;
     try {
         sceNpCommerceDialogOpen2(&param2);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestNpCommon.cpp b/core/libs/tests/GuestNpCommon.cpp
index d605767148..fc8817dbf1 100644
--- a/core/libs/tests/GuestNpCommon.cpp
+++ b/core/libs/tests/GuestNpCommon.cpp
@@ -1,40 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceNpCommon/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
 
-struct NpIdFull {
-    NpOnlineId handle;
-    std::uint8_t opt[8];
-    std::uint8_t reserved[8];
-};
-
-extern "C" {
-int APS5_VABI sceNpCmpOnlineId(const NpOnlineId* onlineId1, const NpOnlineId* onlineId2);
-int APS5_VABI sceNpCmpNpIdInOrder(const NpIdFull* npId1, const NpIdFull* npId2, std::int32_t* order);
-int APS5_VABI sceNpGetPlatformType(const NpIdFull* npId);
-int APS5_VABI sceNpIntIsValidOnlineId(const NpOnlineId* onlineId);
-int APS5_VABI sceNpMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags);
-int APS5_VABI sceNpMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI sceNpMutexLock(PthreadMutex* mutex);
-int APS5_VABI sceNpMutexTryLock(PthreadMutex* mutex);
-int APS5_VABI sceNpMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI sceNpLwMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags);
-int APS5_VABI sceNpLwMutexTryLock(PthreadMutex* mutex);
-int APS5_VABI sceNpLwMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI sceNpLwMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI sceNpCondInit(PthreadCond* cond, const char* name, std::uint64_t flags);
-int APS5_VABI sceNpCondDestroy(PthreadCond* cond);
-int APS5_VABI sceNpCondSignal(PthreadCond* cond);
-int APS5_VABI sceNpCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, std::uint32_t usec);
-int APS5_VABI sceNpJoinThread(Pthread thread, void** retval);
-int APS5_VABI sceNpGetSystemClockUsec(std::int64_t* usec);
-void APS5_VABI sceNpGetSdkVersion(char* version);
-int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-}
-
 static constexpr int INVALID_ARGUMENT = static_cast<int>(0x80550003);
 static constexpr int INVALID_PLATFORM_TYPE = static_cast<int>(0x80550004);
 static constexpr int NOT_MATCH = static_cast<int>(0x80550609);
@@ -127,6 +98,8 @@ static int testSync() {
     ok &= expect(sceNpMutexUnlock(&plain) == 0, "the plain mutex did not unlock");
     ok &= expect(sceNpLwMutexTryLock(&recursive) == 0 && sceNpLwMutexTryLock(&recursive) == 0, "flag 1 did not make the mutex recursive");
     ok &= expect(sceNpLwMutexUnlock(&recursive) == 0 && sceNpLwMutexUnlock(&recursive) == 0, "the recursive mutex did not unlock twice");
+    ok &= expect(sceNpLwMutexLock(&recursive) == 0, "the recursive mutex did not lock via sceNpLwMutexLock");
+    ok &= expect(sceNpLwMutexUnlock(&recursive) == 0, "the recursive mutex did not unlock");
     ok &= expect(sceNpLwMutexDestroy(&recursive) == 0, "the recursive mutex was not destroyed");
 
     PthreadCond cond = nullptr;
@@ -150,12 +123,15 @@ static int testClock() {
     KernelTimespec after{};
     std::int64_t usec = -1;
     sceKernelClockGettime(4, &before);
+
     bool ok = expect(sceNpGetSystemClockUsec(&usec) == 0, "the clock was not read");
     sceKernelClockGettime(4, &after);
+
     ok &= expect(usec >= before.tv_sec * 1000000 + before.tv_nsec / 1000 && usec <= after.tv_sec * 1000000 + after.tv_nsec / 1000, "the clock is not the monotonic kernel clock in microseconds");
     char version[12];
     std::memset(version, 'x', sizeof(version));
     sceNpGetSdkVersion(version);
+
     ok &= expect(std::strcmp(version, "1.00") == 0, "the version is not 1.00");
     ok &= expect(version[8] == 'x', "the version was written past 8 bytes");
     return ok ? 0 : 1;
diff --git a/core/libs/tests/GuestNpCommonRuntime.cpp b/core/libs/tests/GuestNpCommonRuntime.cpp
new file mode 100644
index 0000000000..1747776629
--- /dev/null
+++ b/core/libs/tests/GuestNpCommonRuntime.cpp
@@ -0,0 +1,432 @@
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include "SceTypes.hpp"
+
+#include <atomic>
+#include <chrono>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <thread>
+
+namespace {
+
+constexpr int NpIpcAlreadyInitialized = static_cast<int>(0x80559D00);
+constexpr int NpIpcNotInitialized = static_cast<int>(0x80559D01);
+constexpr int NpOutOfMemory = static_cast<int>(0x80550005);
+constexpr int NpNullObject = static_cast<int>(0x80558005);
+constexpr int NpNotInitialized = static_cast<int>(0x80558001);
+constexpr int NpAlreadyInitialized = static_cast<int>(0x80558002);
+constexpr int NpAlreadyQueued = static_cast<int>(0x80558006);
+constexpr int NpUtilInvalid = static_cast<int>(0x80550601);
+constexpr int NpUtilBufferTooSmall = static_cast<int>(0x80550602);
+constexpr int NpUtilOutOfRange = static_cast<int>(0x8055060A);
+constexpr int NpUtilInvalidCharacter = static_cast<int>(0x80550608);
+constexpr int NpInvalidFormat = static_cast<int>(0x80558003);
+constexpr int NpInvalidCharacter = static_cast<int>(0x80558004);
+constexpr int NpBufferTooSmall = static_cast<int>(0x80558008);
+constexpr int NpOutOfRange = static_cast<int>(0x8055800E);
+constexpr int NpInvalidArgument = static_cast<int>(0x80558009);
+constexpr int NpEventFlagBusy = static_cast<int>(0x8055800C);
+constexpr int NpSemaBusy = static_cast<int>(0x8055800D);
+constexpr int KernelNotPermitted = static_cast<int>(0x80020001);
+constexpr int KernelNoSuchObject = static_cast<int>(0x80020003);
+constexpr std::uint32_t EventFlagWaitAnd = 1;
+constexpr std::uint32_t EventFlagShared = 0x100;
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+void* APS5_VABI ReturnArgument(void* arg) {
+    Pthread self {};
+    Require(sceNpThreadGetId(&self) == 0 && self != nullptr, "a created thread can read its id");
+    return arg;
+}
+
+void TestAtomics() {
+    std::int32_t value = 5;
+    Require(sceNpAtomicInc32(&value) == 5 && value == 6, "increment returns the previous value");
+    Require(sceNpAtomicDec32(&value) == 6 && value == 5, "decrement returns the previous value");
+    Require(sceNpAtomicCas32(&value, 4, 9) == 5 && value == 5, "a failed compare-and-swap returns the current value");
+    Require(sceNpAtomicCas32(&value, 5, 9) == 5 && value == 9, "a successful compare-and-swap returns the previous value");
+}
+
+void TestSemaphoresAndFlags() {
+    KernelSema sema {};
+    Require(sceNpCreateSema(&sema, 0, 0, 2, "NpSema") == 0, "a semaphore is created");
+    Require(sceNpPollSema(sema) == NpSemaBusy, "an empty semaphore reports the busy error");
+    Require(sceNpSignalSema(sema) == 0 && sceNpPollSema(sema) == 0, "a signalled semaphore can be taken once");
+    Require(sceNpDeleteSema(sema) == 0, "the semaphore is deleted");
+
+    KernelEventFlag flag {};
+    Require(sceNpCreateEventFlag(&flag, "NpFlag", 0, 0) == 0, "an event flag is created");
+    std::uint64_t result = 0;
+    Require(sceNpPollEventFlag(flag, 1, EventFlagWaitAnd, &result) == NpEventFlagBusy, "a clear event flag reports the busy error");
+    Require(sceNpSetEventFlag(flag, 1) == 0 && sceNpPollEventFlag(flag, 1, EventFlagWaitAnd, &result) == 0 && result == 1, "a set bit is polled");
+    Require(sceNpDeleteEventFlag(flag) == 0, "the event flag is deleted");
+}
+
+void TestSharedEventFlags() {
+    KernelEventFlag creator {};
+    Require(sceNpCreateEventFlag(&creator, "NpSharedFlag", EventFlagShared, 0) == 0, "a shared event flag is created");
+    KernelEventFlag opened {};
+    Require(sceNpOpenEventFlag(&opened, "NpSharedFlag") == 0 && opened != creator, "the shared event flag is opened by name");
+    std::uint64_t result = 0;
+    Require(sceNpSetEventFlag(opened, 2) == 0 && sceNpPollEventFlag(creator, 2, EventFlagWaitAnd, &result) == 0 && result == 2,
+        "a bit set through the opened handle is polled through the creator");
+    Require(sceNpCloseEventFlag(creator) == KernelNotPermitted, "the creator handle is not closed");
+    Require(sceNpCloseEventFlag(opened) == 0, "the opened handle is closed");
+    Require(sceNpCloseEventFlag(opened) == KernelNoSuchObject, "a closed handle is gone");
+    Require(sceNpDeleteEventFlag(creator) == 0, "the creator deletes the shared event flag");
+}
+
+void TestThreads() {
+    Require(sceNpThreadGetId(nullptr) == NpInvalidArgument, "a null thread id output is refused");
+    Pthread thread {};
+    int marker = 0;
+    Require(sceNpCreateThread(&thread, ReturnArgument, &marker, 0, 0x10000, 0, "NpThread") == 0, "a thread is created");
+    void* value = nullptr;
+    Require(sceNpJoinThread(thread, &value) == 0 && value == &marker, "the thread is joined with its return value");
+}
+
+void UseAllocator(const NpAllocator& allocator) {
+    auto* block = static_cast<std::uint8_t*>(allocator.allocate(64, allocator.context));
+    Require(block != nullptr, "the allocator hands out memory");
+    block[63] = 0x5A;
+    block = static_cast<std::uint8_t*>(allocator.reallocate(block, 256, allocator.context));
+    Require(block != nullptr && block[63] == 0x5A, "reallocation keeps the contents");
+    allocator.release(block, allocator.context);
+    allocator.release(nullptr, allocator.context);
+}
+
+void TestHeaps() {
+    NpMemoryHeap memoryHeap {};
+    Require(sceNpMemoryHeapInit(nullptr, 0x1000, "np-test") == NpNullObject, "a null memory heap is refused");
+    Require(sceNpMemoryHeapInit(&memoryHeap, 0x1001, "np-test") == 0, "a memory heap is created");
+    Require(memoryHeap.memory.size == 0x4000 && memoryHeap.memory.address != nullptr && memoryHeap.heap.mspace != nullptr,
+        "the memory heap size is rounded up to 16 KiB");
+    NpAllocatorEx allocatorEx {};
+    sceNpMemoryHeapGetAllocatorEx(&memoryHeap, 0x1234, &allocatorEx);
+
+    Require(allocatorEx.allocator.context == &memoryHeap && allocatorEx.outOfMemoryError == 0x1234,
+        "the extended allocator carries the caller's error code");
+    UseAllocator(allocatorEx.allocator);
+    sceNpMemoryHeapDestroy(&memoryHeap);
+
+    Require(memoryHeap.memory.address == nullptr && memoryHeap.heap.mspace == nullptr, "destroying clears the memory heap");
+
+    NpKernelMemory memory {};
+    void* address = nullptr;
+    Require(sceNpAllocateKernelMemoryWithAlignment(0x10, "np-test", &address, nullptr) == NpNullObject,
+        "kernel memory needs an object");
+    Require(sceNpAllocateKernelMemoryWithAlignment(0x10, "np-test", &address, &memory) == 0
+            && address == memory.address && memory.size == 0x4000,
+        "kernel memory is mapped in 16 KiB units");
+    NpHeap heap {};
+    Require(sceNpHeapInit(&heap, memory.address, memory.size, "np-test") == 0 && heap.mspace != nullptr, "a heap is created");
+    NpAllocator allocator {};
+    sceNpHeapGetAllocator(&heap, &allocator);
+
+    Require(allocator.context == &heap, "the heap allocator uses the heap as its context");
+    UseAllocator(allocator);
+    NpHeapStat stat {};
+    Require(sceNpHeapGetStat(&heap, &stat) == 0 && stat.maxInuseSize >= stat.currentInuseSize, "heap statistics are reported");
+    sceNpHeapDestroy(&heap);
+
+    Require(heap.mspace == nullptr, "destroying clears the heap");
+    Require(sceNpFreeKernelMemory(&memory) == 0 && memory.address == nullptr, "kernel memory is released");
+    Require(sceNpFreeKernelMemory(nullptr) == NpNullObject, "freeing needs an object");
+
+    Require(sceNpArchInit() == 0 && sceNpArchInit() == 0, "the library initialises more than once");
+    NpAllocatorEx* global = sceNpGlobalHeapGetAllocatorExPtr();
+    Require(global->outOfMemoryError == NpOutOfMemory, "the global allocator reports the library's out-of-memory error");
+    UseAllocator(global->allocator);
+    sceNpArchTerm();
+
+    UseAllocator(sceNpGlobalHeapGetAllocatorExPtr()->allocator);
+    sceNpArchTerm();
+
+    Require(sceNpIpc2ClientTerm() == NpIpcNotInitialized, "the ipc client must be started before it stops");
+    Require(sceNpIpc2ClientInit() == 0 && sceNpIpc2ClientInit() == NpIpcAlreadyInitialized, "the ipc client starts once");
+    Require(sceNpIpc2ClientTerm() == 0 && sceNpIpc2ClientInit() == 0 && sceNpIpc2ClientTerm() == 0, "the ipc client restarts");
+}
+
+struct CalloutRecord {
+    std::atomic<int> order {0};
+    std::atomic<int> first {0};
+    std::atomic<int> second {0};
+};
+
+CalloutRecord g_callouts;
+
+void APS5_VABI RecordFirst(void*) {
+    g_callouts.first = ++g_callouts.order;
+}
+
+void APS5_VABI RecordSecond(void*) {
+    g_callouts.second = ++g_callouts.order;
+}
+
+void APS5_VABI RecordUnexpected(void*) {
+    Require(false, "a stopped callout does not run");
+}
+
+void TestCallouts() {
+    NpCalloutContext context {};
+    NpCallout callout {};
+    Require(sceNpCalloutStartOnCtx(&context, &callout, 0, RecordFirst, nullptr) == NpNotInitialized, "a context must be initialised first");
+    Require(sceNpCalloutInitCtx(&context, "np-callout", 0x4000, 0, 0) == 0, "a callout context starts");
+    Require(sceNpCalloutInitCtx(&context, "np-callout", 0x4000, 0, 0) == NpAlreadyInitialized, "a context starts once");
+
+    NpCallout stopped {};
+    int wasPending = 0;
+    Require(sceNpCalloutStartOnCtx(&context, &stopped, 60000000, RecordUnexpected, nullptr) == 0, "a distant callout is queued");
+    Require(sceNpCalloutStartOnCtx(&context, &stopped, 60000000, RecordUnexpected, nullptr) == NpAlreadyQueued,
+        "a queued callout cannot be queued again");
+    Require(sceNpCalloutStopOnCtx(&context, &stopped, &wasPending) == 0 && wasPending == 1, "a queued callout is removed");
+    Require(sceNpCalloutStopOnCtx(&context, &stopped, &wasPending) == 0 && wasPending == 0, "removing twice reports nothing pending");
+
+    NpCallout queuedFirst {};
+    NpCallout queuedSecond {};
+    Require(sceNpCalloutStartOnCtx(&context, &queuedFirst, 30000000, RecordUnexpected, nullptr) == 0, "an earlier distant callout is queued");
+    Require(sceNpCalloutStartOnCtx(&context, &queuedSecond, 60000000, RecordUnexpected, nullptr) == 0, "a later distant callout is queued");
+    const std::uint64_t queuedDeadline = queuedFirst.deadline;
+    Require(sceNpCalloutStartOnCtx(&context, &queuedFirst, 0, RecordFirst, &context) == NpAlreadyQueued,
+        "the earlier callout cannot be queued again");
+    Require(queuedFirst.next == &queuedSecond && queuedFirst.deadline == queuedDeadline && queuedFirst.handler == RecordUnexpected &&
+        queuedFirst.arg == nullptr, "a rejected start leaves the queued callout unchanged");
+    Require(sceNpCalloutStopOnCtx(&context, &queuedSecond, &wasPending) == 0 && wasPending == 1,
+        "the later callout is still pending after the rejected start");
+    Require(sceNpCalloutStopOnCtx(&context, &queuedFirst, &wasPending) == 0 && wasPending == 1, "the earlier callout is still pending");
+
+    NpCallout later {};
+    Require(sceNpCalloutStartOnCtx(&context, &later, 20000, RecordSecond, nullptr) == 0, "a later callout is queued");
+    Require(sceNpCalloutStartOnCtx(&context, &callout, 1000, RecordFirst, nullptr) == 0, "an earlier callout is queued");
+    for (int i = 0; i < 2000 && g_callouts.second == 0; ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    Require(g_callouts.first == 1 && g_callouts.second == 2, "callouts run in deadline order");
+    sceNpCalloutTermCtx(&context);
+
+    Require(context.initialized == 0, "terminating clears the context");
+    sceNpCalloutTermCtx(&context);
+
+}
+
+bool Equals(const char* actual, const char* expected) {
+    return std::strcmp(actual, expected) == 0;
+}
+
+void TestIds() {
+    Require(sceNpUtilCmpAccountId(7, 7) == 0 && sceNpUtilCmpAccountId(7, 8) == 1, "account ids compare for equality");
+
+    constexpr int NullArgument = static_cast<int>(0x80550003);
+    constexpr int InvalidNpId = static_cast<int>(0x80550605);
+    constexpr int NotMatch = static_cast<int>(0x80550609);
+    auto makeNpId = [](const char* name, std::uint32_t opt, std::uint32_t platform) {
+        std::array<std::uint8_t, 0x24> id{};
+        std::memcpy(id.data(), name, std::strlen(name));
+        std::memcpy(id.data() + 0x14, &opt, sizeof(opt));
+        std::memcpy(id.data() + 0x18, &platform, sizeof(platform));
+        id[0x1C] = 1;
+        return id;
+    };
+    const auto alice = makeNpId("Alice_01", 5, 0x11223344);
+    auto other = alice;
+    Require(sceNpCmpNpId(nullptr, alice.data()) == NullArgument && sceNpCmpNpId(alice.data(), nullptr) == NullArgument, "null NpIds are refused");
+    Require(sceNpCmpNpId(alice.data(), other.data()) == 0, "identical NpIds match");
+    other[0x1C] = 0;
+    Require(sceNpCmpNpId(alice.data(), other.data()) == InvalidNpId && sceNpCmpNpId(other.data(), alice.data()) == InvalidNpId, "the flag byte at 0x1C must be 1");
+    Require(sceNpCmpNpId(makeNpId("Bob-2", 5, 0x11223344).data(), alice.data()) == NotMatch, "different online ids do not match");
+    Require(sceNpCmpNpId(makeNpId("Alice_01", 6, 0x11223344).data(), alice.data()) == NotMatch, "different words at 0x14 do not match");
+    Require(sceNpCmpNpId(makeNpId("Alice_01", 5, 0).data(), alice.data()) == 0, "an empty first byte at 0x18 on the first id matches");
+    Require(sceNpCmpNpId(alice.data(), makeNpId("Alice_01", 5, 0).data()) == 0, "an empty first byte at 0x18 on the second id matches");
+    Require(sceNpCmpNpId(alice.data(), makeNpId("Alice_01", 5, 0x11223355).data()) == NotMatch, "different words at 0x18 do not match");
+
+    Require(sceNpIntIsOnlineIdString("Alice_01") && sceNpIntIsOnlineIdString("Bob-2"), "letters, digits, '_' and '-' are allowed");
+    Require(!sceNpIntIsOnlineIdString("ab") && !sceNpIntIsOnlineIdString("abcdefghijklmnopq"), "online ids are 3 to 16 characters");
+    Require(!sceNpIntIsOnlineIdString("1abc") && !sceNpIntIsOnlineIdString("ab.c") && !sceNpIntIsOnlineIdString(nullptr),
+        "online ids start with a letter and use no other symbols");
+}
+
+void TestJsonText() {
+    char escaped[64] = {};
+    Require(sceNpUtilJsonEscape(escaped, sizeof(escaped), "a\"b/\n\x01", 7) == 0 && Equals(escaped, "a\\\"b\\/\\n\\u0001"),
+        "json escaping covers quotes, solidus, newlines and controls");
+    std::strcpy(escaped, "x");
+    Require(sceNpUtilJsonEscape(escaped, sizeof(escaped), "yz", 2) == 0 && Equals(escaped, "xyz"), "escaping appends to the buffer");
+    Require(sceNpUtilJsonEscape(escaped, 6, "a", 1) == NpUtilBufferTooSmall, "escaping needs room for one escape");
+    Require(sceNpUtilJsonEscape(escaped, sizeof(escaped), nullptr, 1) == NpUtilInvalid, "escaping needs a source");
+
+    char text[32] = {};
+    std::size_t length = 0;
+    Require(sceNpUtilJsonUnescape(text, sizeof(text), "a\\nb\\u0041", 10, &length) == 0 && Equals(text, "a\nbA") && length == 5,
+        "json unescaping decodes escapes and counts the terminator");
+    Require(sceNpUtilJsonUnescape(text, sizeof(text), "\\uD83D\\uDE00", 12, &length) == 0 && Equals(text, "\xF0\x9F\x98\x80")
+            && length == 5,
+        "surrogate pairs become one UTF-8 character");
+    Require(sceNpUtilJsonUnescape(text, sizeof(text), "\\u00G1", 6, &length) == NpUtilBufferTooSmall && Equals(text, "\\u00G1"),
+        "a bad unicode escape is copied and reported");
+    Require(sceNpUtilJsonUnescape(nullptr, sizeof(text), "abc", 3, &length) == 0 && length == 4, "a null buffer reports the size");
+    Require(sceNpUtilJsonUnescape(text, 3, "abc", 3, &length) == NpUtilBufferTooSmall, "unescaping needs room for the terminator");
+
+    char one[4] = {};
+    std::size_t consumed = 0;
+    Require(sceNpUtilJsonGetOneChar(one, sizeof(one), "\\u00e9x", 7, &length, &consumed) == 0 && length == 2 && consumed == 6
+            && std::memcmp(one, "\xC3\xA9", 2) == 0,
+        "one escaped character is decoded");
+    Require(sceNpUtilJsonGetOneChar(one, sizeof(one), "\xE6\x97\xA5", 3, &length, &consumed) == 0 && length == 3 && consumed == 3,
+        "one UTF-8 character is copied");
+    Require(sceNpUtilJsonGetOneChar(one, sizeof(one), "\xE6\x97", 2, &length, &consumed) == NpUtilBufferTooSmall && length == 0
+            && consumed == 3,
+        "a cut UTF-8 character reports its full length");
+    Require(sceNpUtilJsonGetOneChar(one, 1, "\xC3\xA9", 2, &length, &consumed) == NpUtilBufferTooSmall && length == 2,
+        "a short buffer still reports the decoded size");
+
+    const char* character = nullptr;
+    const char* japanese = "\xE6\x97\xA5" "a";
+    Require(sceNpUtilGetNthChar(1, japanese, &character) == 0 && character == japanese + 3, "characters are counted, not bytes");
+    Require(sceNpUtilGetNthChar(10, "abc", &character) == 0 && *character == '\0', "counting stops at the end");
+    Require(sceNpUtilGetNthChar(2, "a\x01b", &character) == NpUtilInvalidCharacter, "control characters are refused");
+
+    char url[32] = {};
+    Require(sceNpUtilHttpUrlEncode(url, sizeof(url), "a b=c*", 6, &length) == 0 && Equals(url, "a+b%3Dc*") && length == 9,
+        "form encoding keeps the safe set and escapes the rest");
+    Require(sceNpUtilHttpUrlEncode(nullptr, 0, "@", 1, &length) == 0 && length == 4, "a null buffer reports the encoded size");
+    Require(sceNpUtilHttpUrlEncode(url, 3, "@", 1, &length) == NpUtilBufferTooSmall, "encoding needs room for the terminator");
+}
+
+void TestTitleIds() {
+    NpTitleIdParts parts {{'A', 'B', 'C', 'D', '1', '2', '3', '4', '5'}, 0, 7};
+    char titleId[13] = {};
+    Require(sceNpUtilBuildTitleId(&parts, titleId, sizeof(titleId)) == 0 && Equals(titleId, "ABCD12345_07"), "the index is two digits");
+    Require(sceNpUtilBuildTitleId(&parts, titleId, 12) == NpUtilBufferTooSmall, "a title id needs 13 bytes");
+    parts.index = 100;
+    Require(sceNpUtilBuildTitleId(&parts, titleId, sizeof(titleId)) == NpUtilOutOfRange, "the index is at most 99");
+}
+
+void TestLanguagesAndDebugIds() {
+    char code[6] = {};
+    char tag[36] = {};
+    Require(sceNpUtilGetNpLanguageCode(1, code) == 0 && Equals(code, "en"), "language 1 is English");
+    Require(sceNpUtilGetNpLanguageCode2(20, tag) == 0 && Equals(tag, "es-419"), "language 20 is Latin American Spanish");
+    Require(Equals(sceNpUtilGetNpLanguageCodeStr(11), "zh-CN") && Equals(sceNpUtilGetNpLanguageCode2Str(30), "uk-UA"),
+        "language strings are returned directly");
+    Require(sceNpUtilGetNpLanguageCode(31, code) == NpUtilInvalid && sceNpUtilGetNpLanguageCodeStr(31) == nullptr,
+        "unknown languages are refused");
+    Require(sceNpUtilGetNpLanguageCode2(0, nullptr) == NpUtilInvalid, "a language code needs a buffer");
+    const std::uint32_t first = sceNpDbgAssignDebugId();
+    Require(first != 0 && sceNpDbgAssignDebugId() == first + 1, "debug ids count up");
+}
+
+void TestBase64() {
+    const std::uint8_t payload[] = {1, 2, 3, 4, 5};
+    char text[16] = {};
+    Require(sceNpBase64Encoder(payload, text, 5) == 8 && Equals(text, "AQIDBAU="), "base64 pads the last group");
+    Require(sceNpBase64Encoder(payload, text, 0) == 0, "an empty payload encodes to nothing");
+    Require(sceNpBase64GetDecodeSize("AQIDBAU=", 8) == 5 && sceNpBase64GetDecodeSize("AQ==", 4) == 1,
+        "the decoded size follows the padding");
+    Require(sceNpBase64GetDecodeSize("", 0) == NpInvalidFormat && sceNpBase64GetDecodeSize("AQI", 3) == NpInvalidFormat,
+        "base64 needs whole groups");
+    Require(sceNpBase64GetDecodeSize("AQ=A", 4) == NpInvalidCharacter && sceNpBase64GetDecodeSize("A=AAAQID", 8) == NpInvalidCharacter,
+        "padding is only allowed at the end");
+    std::uint8_t bytes[8] = {};
+    Require(sceNpBase64Decoder("AQIDBAU=", 8, bytes, sizeof(bytes)) == 5 && std::memcmp(bytes, payload, 5) == 0,
+        "base64 decodes back to the payload");
+    Require(sceNpBase64Decoder("AQID", 4, bytes, 2) == NpInvalidFormat, "decoding refuses a short buffer");
+    Require(sceNpBase64Decoder("AQ?D", 4, bytes, 3) == NpInvalidCharacter, "decoding refuses characters outside the alphabet");
+
+    const std::uint8_t url[] = {0xFB, 0x00};
+    std::memset(text, 0, sizeof(text));
+    Require(sceNpBase64UrlEncoder(url, text, 1) == 2 && Equals(text, "-w"), "base64url leaves out the padding");
+    Require(sceNpBase64UrlEncoder(url, text, 2) == 3 && Equals(text, "-wA"), "base64url writes three characters for two bytes");
+    Require(sceNpBase64UrlGetDecodeSize("-wA", 3) == 2 && sceNpBase64UrlGetDecodeSize("-w==", 4) == 1,
+        "base64url accepts padded and unpadded tails");
+    Require(sceNpBase64UrlGetDecodeSize("", 0) == NpInvalidCharacter && sceNpBase64UrlGetDecodeSize("AAAAA", 5) == NpInvalidCharacter,
+        "a single trailing character cannot be decoded");
+    Require(sceNpBase64UrlGetDecodeSize("+w==", 4) == NpInvalidCharacter, "base64url refuses the standard alphabet");
+    Require(sceNpBase64UrlDecoder("-wA", 3, bytes, 2) == 2 && bytes[0] == 0xFB && bytes[1] == 0, "base64url decodes a short tail");
+    Require(sceNpBase64UrlDecoder("-w", 2, bytes, 0) == NpInvalidFormat, "base64url decoding refuses a short buffer");
+}
+
+void TestNumbers() {
+    Require(sceNpHexToInt('a') == 10 && sceNpHexToInt('F') == 15 && sceNpHexToInt('g') == -1, "hex digits are read");
+    Require(sceNpIntToHex(10, false) == 'a' && sceNpIntToHex(15, true) == 'F' && sceNpIntToHex(9, true) == '9', "hex digits are written");
+
+    char text[32] = {};
+    std::size_t length = 0;
+    Require(sceNpUInt32ToStr(text, sizeof(text), 255, 16, 3, &length) == 0 && Equals(text, "0XFF") && length == 4,
+        "the hex prefix follows the case flag");
+    Require(sceNpUInt32ToStr(text, sizeof(text), 8, 8, 2, &length) == 0 && Equals(text, "010") && length == 3, "octal gets a zero prefix");
+    Require(sceNpUInt32ToStr(text, sizeof(text), 0, 10, 4, &length) == 0 && Equals(text, "0") && length == 1, "zero has no sign");
+    Require(sceNpUInt32ToStr(text, 4, 1234, 10, 0, &length) == NpBufferTooSmall, "the terminator must fit");
+    Require(sceNpUInt32ToStr(text, sizeof(text), 1, 37, 0, &length) == NpInvalidArgument, "the radix is limited to 36");
+    Require(sceNpUInt32ToStr(nullptr, 0, 42, 10, 4, &length) == 0 && length == 3, "a null buffer reports the length");
+    Require(sceNpInt32ToStr(text, sizeof(text), -2147483647 - 1, 10, 0, &length) == 0 && Equals(text, "-2147483648"),
+        "a negative 32-bit value always has a sign");
+    Require(sceNpInt32ToStr(text, 3, -42, 10, 0, &length) == NpBufferTooSmall, "the sign takes buffer space");
+    Require(sceNpInt64ToStr(text, sizeof(text), -42, 10, 0, &length) == 0 && Equals(text, "42") && length == 2,
+        "a 64-bit value only gets a sign with the sign flag");
+    Require(sceNpInt64ToStr(text, sizeof(text), -42, 10, 4, &length) == 0 && Equals(text, "-42"), "the sign flag writes the minus");
+    Require(sceNpUInt64ToStr(text, sizeof(text), UINT64_MAX, 16, 3, &length) == 0 && Equals(text, "0XFFFFFFFFFFFFFFFF") && length == 18,
+        "the full 64-bit range is formatted");
+
+    std::int32_t value32 = 0;
+    std::size_t parsed = 0;
+    Require(sceNpStrToInt32("-567abc", &value32, 10, &parsed) == 0 && value32 == -567 && parsed == 4, "parsing stops at the first non-digit");
+    Require(sceNpStrToInt32("0x1A", &value32, 0, &parsed) == 0 && value32 == 26, "base zero follows the prefix");
+    Require(sceNpStrToInt32("invalid", &value32, 10, &parsed) == NpOutOfRange, "no digits is an error");
+    parsed = 0;
+    Require(sceNpStrToInt32("3000000000", &value32, 10, &parsed) == NpOutOfRange && parsed == 10,
+        "the length is reported before the 32-bit range check");
+    std::int64_t value64 = 0;
+    Require(sceNpStrToInt64("-9223372036854775808", &value64, 10, nullptr) == 0 && value64 == INT64_MIN, "the 64-bit minimum parses");
+    Require(sceNpStrToInt64("99999999999999999999", &value64, 10, nullptr) == NpOutOfRange, "64-bit overflow is an error");
+    std::uint32_t unsigned32 = 0;
+    Require(sceNpStrToUInt32("4294967295", &unsigned32, 10, nullptr) == 0 && unsigned32 == UINT32_MAX, "the 32-bit maximum parses");
+    Require(sceNpStrToUInt32("4294967296", &unsigned32, 10, nullptr) == NpOutOfRange, "32-bit unsigned overflow is an error");
+    std::uint64_t unsigned64 = 0;
+    Require(sceNpStrToUInt64("0xFFFFFFFFFFFFFFFF", &unsigned64, 0, nullptr) == 0 && unsigned64 == UINT64_MAX, "the 64-bit maximum parses");
+    Require(sceNpStrToUInt64("18446744073709551616", &unsigned64, 10, nullptr) == NpOutOfRange, "64-bit unsigned overflow is an error");
+}
+
+void TestHexAndCopies() {
+    const std::uint8_t data[] = {0x0A, 0xFE};
+    char text[8] = {};
+    Require(sceNpStrBuildHex(text, 5, data, 2, false) == 0 && Equals(text, "0afe"), "bytes are written as lowercase hex");
+    Require(sceNpStrBuildHex(text, 5, data, 2, true) == 0 && Equals(text, "0AFE"), "bytes are written as uppercase hex");
+    Require(sceNpStrBuildHex(text, 4, data, 2, false) == NpBufferTooSmall, "hex output needs room for the terminator");
+    std::uint8_t bytes[4] = {};
+    Require(sceNpStrParseHex("0aFE", bytes, 2) == 0 && bytes[0] == 0x0A && bytes[1] == 0xFE, "hex is read in either case");
+    Require(sceNpStrParseHex("0AF", bytes, 2) == NpInvalidArgument, "odd hex is refused");
+    Require(sceNpStrParseHex("0AFE", bytes, 1) == NpBufferTooSmall, "hex parsing checks the output size");
+    Require(sceNpStrParseHex("0AG1", bytes, 2) == NpInvalidArgument, "non-hex characters are refused");
+    Require(sceNpStrnParseHex("DEADBEEF1234", 8, bytes, 4) == 0 && bytes[0] == 0xDE && bytes[3] == 0xEF, "a hex prefix is read");
+
+    char copy[8] = {};
+    Require(sceNpStrcpyToBuf(copy, 6, "Hello") == 0 && Equals(copy, "Hello"), "a string that fits is copied");
+    Require(sceNpStrcpyToBuf(copy, 5, "Hello") == NpBufferTooSmall, "a string without room for its terminator is refused");
+    Require(sceNpStrncpyToBuf(copy, 6, "Hello World", 5) == 0 && Equals(copy, "Hello"), "the length limit sizes the copy");
+    Require(sceNpStrncpyToBuf(copy, 5, "Hello World", 5) == NpBufferTooSmall, "the limited string still needs a terminator");
+}
+
+}
+
+int main() {
+    TestAtomics();
+    TestSemaphoresAndFlags();
+    TestSharedEventFlags();
+    TestThreads();
+    TestHeaps();
+    TestBase64();
+    TestNumbers();
+    TestHexAndCopies();
+    TestCallouts();
+    TestIds();
+    TestLanguagesAndDebugIds();
+    TestJsonText();
+    TestTitleIds();
+    std::puts("guest np common runtime: PASS");
+}
diff --git a/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp b/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp
index f9a03f0d52..13cc9a8491 100644
--- a/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp
+++ b/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -7,80 +8,11 @@
 
 using Deleter = void (APS5_VABI*)(void*);
 
-struct IntrusivePtr {
-    void* object;
-    Deleter deleter;
-    void* libContext;
-};
-
 using Construct = void (APS5_VABI*)(IntrusivePtr*);
 using Copy = void (APS5_VABI*)(IntrusivePtr*, const IntrusivePtr*);
 using Destroy = void (APS5_VABI*)(IntrusivePtr*);
 using Access = void* (APS5_VABI*)(const IntrusivePtr*);
 
-extern "C" {
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEC1Ev(IntrusivePtr*);
-
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1ERS7_(IntrusivePtr*, const IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_(IntrusivePtr*, const IntrusivePtr*);
-
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEED1Ev(IntrusivePtr*);
-
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V15EntryEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6BinaryEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEEdeEv(const IntrusivePtr*);
-
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr*, void*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEED1Ev(IntrusivePtr*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEE8pushBackERKS8_(IntrusivePtr*, const IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1EPS6_PFvS8_EPNS2_10LibContextE(IntrusivePtr*, void*, Deleter, void*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEED1Ev(IntrusivePtr*);
-
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1ERS7_(IntrusivePtr*, const IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEED1Ev(IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEE3getEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEE3getEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEdeEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEdeEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEptEv(const IntrusivePtr*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static constexpr std::size_t ObjectSize = 0x40;
@@ -216,11 +148,13 @@ static void TestSharedOwnership() {
 
     IntrusivePtr owner;
     _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1Ev(&owner);
+
     owner.object = object;
     owner.deleter = RecordDelete;
 
     IntrusivePtr argument;
     _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_(&argument, &owner);
+
     Require(_ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEptEv(&argument) == object);
     Require(ReadCount(object, 0) == 2);
 
@@ -245,6 +179,7 @@ static void TestVectorPushBackReleasesElements() {
 
     IntrusivePtr vector;
     _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEEC1EPNS2_10LibContextE(&vector, &context);
+
     Require(vector.object == nullptr);
     Require(vector.deleter == nullptr);
     Require(vector.libContext == &context);
@@ -280,6 +215,7 @@ static void TestAdoptedVectorBodyDestroyedThroughDeleter() {
 
     IntrusivePtr vector;
     _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1EPS6_PFvS8_EPNS2_10LibContextE(&vector, body, RecordDelete, &context);
+
     Require(vector.object == body);
     Require(vector.deleter == RecordDelete);
     Require(vector.libContext == &context);
@@ -305,6 +241,8 @@ int main() {
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1Ev,
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEC1Ev,
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev,
     };
     for (const auto construct : constructors) TestConstruct(construct);
 
@@ -333,6 +271,16 @@ int main() {
         _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEptEv,
         _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEdeEv,
         _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv,
     };
     for (const auto access : accessors) TestAccess(access);
 
@@ -340,6 +288,8 @@ int main() {
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1ERS7_,
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_,
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1ERS7_,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_,
     };
     for (const auto copy : copies) TestCopy(copy);
 
@@ -356,6 +306,14 @@ int main() {
         {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEED1Ev, 0},
         {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEED1Ev, 0},
         {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev, VectorReferenceCountOffset},
     };
     for (const auto& testCase : destructors) TestDestroy(testCase);
 
diff --git a/core/libs/tests/GuestNpCppWebApiOffline.cpp b/core/libs/tests/GuestNpCppWebApiOffline.cpp
new file mode 100644
index 0000000000..5317a857ed
--- /dev/null
+++ b/core/libs/tests/GuestNpCppWebApiOffline.cpp
@@ -0,0 +1,109 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+using SelfCall = int (APS5_VABI*)(void*);
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", what);
+    std::abort();
+}
+
+static constexpr int ParameterNotInitialized = static_cast<int>(0x80553502);
+static constexpr int ParameterInvalidArgument = static_cast<int>(0x80553503);
+static constexpr int ParameterAlreadyInitialized = static_cast<int>(0x8055350f);
+static constexpr int ParameterTerminatedUninitialized = static_cast<int>(0x80553510);
+
+struct ParameterLifecycle {
+    int (APS5_VABI* construct)(void*);
+    int (APS5_VABI* destroy)(void*);
+    int (APS5_VABI* terminate)(void*);
+    int (APS5_VABI* setText)(void*, const char*);
+};
+
+template <typename TInitialize>
+static void TestParameterLifecycle(const ParameterLifecycle& lifecycle, TInitialize initialize) {
+    std::uint64_t context = 0;
+    alignas(16) unsigned char parameter[0x20];
+    std::memset(parameter, 0x5a, sizeof(parameter));
+    Require(lifecycle.construct(parameter) == 0, "a parameter constructor failed");
+    for (std::size_t index = 0; index < sizeof(parameter); ++index)
+        Require(parameter[index] == (index < 0x10 ? 0 : 0x5a), "a parameter constructor wrote the wrong bytes");
+    Require(lifecycle.setText(parameter, "text") == ParameterNotInitialized, "a setter accepted an uninitialized parameter");
+    Require(lifecycle.terminate(parameter) == ParameterTerminatedUninitialized, "terminate accepted an uninitialized parameter");
+    Require(initialize(parameter, nullptr, true) == ParameterInvalidArgument, "initialize accepted a null context");
+    Require(initialize(parameter, &context, true) == ParameterNotInitialized, "initialize accepted an uninitialized context");
+    Require(_ZN3sce2Np9CppWebApi6Common10initializeERKNS2_10InitParamsERNS2_10LibContextE(nullptr, &context) == 0, "the context did not initialize");
+    Require(initialize(parameter, &context, false) == ParameterInvalidArgument, "initialize accepted a null argument");
+    Require(lifecycle.setText(parameter, "text") == ParameterNotInitialized, "a failed initialize left the parameter initialized");
+    Require(initialize(parameter, &context, true) == 0, "initialize failed");
+    Require(initialize(parameter, &context, true) == ParameterAlreadyInitialized, "initialize ran twice");
+    Require(lifecycle.setText(parameter, nullptr) == ParameterInvalidArgument, "a setter accepted a null string");
+    Require(lifecycle.setText(parameter, "text") == 0, "a setter failed");
+    Require(lifecycle.terminate(parameter) == 0, "terminate failed");
+    Require(lifecycle.terminate(parameter) == ParameterTerminatedUninitialized, "terminate ran twice");
+    Require(initialize(parameter, &context, true) == 0, "initialize after terminate failed");
+    Require(lifecycle.terminate(parameter) == 0, "the second terminate failed");
+    Require(lifecycle.destroy(parameter) == 0, "a parameter destructor failed");
+    for (std::size_t index = 0; index < sizeof(parameter); ++index)
+        Require(parameter[index] == (index < 0x10 ? 0 : 0x5a), "a parameter lifecycle wrote the wrong bytes");
+    Require(_ZN3sce2Np9CppWebApi6Common9terminateERNS2_10LibContextE(&context) == 0, "the context did not terminate");
+}
+
+static void TestParameterLifecycles() {
+    TestParameterLifecycle(
+        {
+            _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerC1Ev,
+            _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerD1Ev,
+            _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9terminateEv,
+            _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setcontainerIdsEPKc,
+        },
+        [](void* parameter, const std::uint64_t* context, bool present) {
+            const bool before = _ZNK3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer13isInitializedEv(parameter);
+            const int result = present ? _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer10initializeEPNS1_6Common10LibContextE(parameter, context) : ParameterInvalidArgument;
+            Require(_ZNK3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer13isInitializedEv(parameter) == (before || result == 0), "isInitialized disagrees with initialize");
+            Require(_ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setserviceLabelEi(parameter, 1) == 0, "setserviceLabel failed");
+            return result;
+        });
+    TestParameterLifecycle(
+        {
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserC1Ev,
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserD1Ev,
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9terminateEv,
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9setfieldsEPKc,
+        },
+        [](void* parameter, const std::uint64_t* context, bool present) {
+            return _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser10initializeEPNS1_6Common10LibContextEPKcSA_(parameter, context, "me", present ? "slot" : nullptr);
+        });
+    TestParameterLifecycle(
+        {
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadDataC1Ev,
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadDataD1Ev,
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData9terminateEv,
+            _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData11setobjectIdEPKc,
+        },
+        [](void* parameter, const std::uint64_t* context, bool present) {
+            return _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData10initializeEPNS1_6Common10LibContextEPKci(parameter, context, present ? "me" : nullptr, 0);
+        });
+}
+
+static void TestIteratorDestructors() {
+    unsigned char iterator[0x20];
+    std::memset(iterator, 0x5a, sizeof(iterator));
+    const SelfCall destructors[] = {
+        _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev,
+        _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev,
+    };
+    for (const auto call : destructors) Require(call(iterator) == 0, "an iterator destructor failed");
+    for (const auto byte : iterator) Require(byte == 0x5a, "an iterator destructor wrote to the iterator");
+}
+
+int main() {
+    TestParameterLifecycles();
+    TestIteratorDestructors();
+    std::puts("NpCppWebApi offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpCppWebApiSignedOut.cpp b/core/libs/tests/GuestNpCppWebApiSignedOut.cpp
index 455bc254b0..826ceb8fa0 100644
--- a/core/libs/tests/GuestNpCppWebApiSignedOut.cpp
+++ b/core/libs/tests/GuestNpCppWebApiSignedOut.cpp
@@ -1,72 +1,9 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsD1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends10initializeEPNS1_6Common10LibContextEPKc();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends9terminateEv();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi10getFriendsEiRKNS4_21ParameterToGetFriendsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_18GetFriendsResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersD1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers10initializeEPNS1_6Common10LibContextE();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers9terminateEv();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi16getBlockingUsersEiRKNS4_27ParameterToGetBlockingUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_24GetBlockingUsersResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesD1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences10initializeEPNS1_6Common10LibContextEPKc();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences9terminateEv();
-int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi17getBasicPresencesEiRKNS4_28ParameterToGetBasicPresencesERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_25GetBasicPresencesResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
-int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityD1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity10initializeEPNS1_6Common10LibContextEPKcSA_NS6_12IntrusivePtrINS3_19WebApiFilterRequestEEE();
-int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity9terminateEv();
-int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi15filterProfanityEiRKNS4_26ParameterToFilterProfanityERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_23FilterProfanityResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
-int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusC1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusD1Ev(void*);
-int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus10initializeEPNS1_6Common10LibContextEm();
-int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus9terminateEv();
-int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi33getCommunicationRestrictionStatusEiRKNS4_44ParameterToGetCommunicationRestrictionStatusERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_38CommunicationRestrictionStatusResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
-int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V226WebApiFilterRequestFactory6createEPNS1_6Common10LibContextEPKcPNS5_12IntrusivePtrINS3_19WebApiFilterRequestEEE();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static constexpr int NotSignedIn = static_cast<int>(0x80552907);
diff --git a/core/libs/tests/GuestNpCppWebApiString.cpp b/core/libs/tests/GuestNpCppWebApiString.cpp
index eb127730a9..6d50a21eb3 100644
--- a/core/libs/tests/GuestNpCppWebApiString.cpp
+++ b/core/libs/tests/GuestNpCppWebApiString.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,24 +6,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(void* self, void* libContext);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringD1Ev(void* self);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6String6appendEPKc(void* self, const char* text);
-const char* APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(const void* self);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(void* self, void* libContext);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(void* self);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(void* self, const void* element);
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5emptyEv(const void* self);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringeqEPKc(const void* self, const char* other);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEEC1EPNS2_10LibContextE(void* self, void* libContext);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEED1Ev(void* self);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEE8pushBackERKS8_(void* self, const void* element);
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
-int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi17getPlayerSessionsEiRKNS4_28ParameterToGetPlayerSessionsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_29GetPlayerSessionsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
-int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi26setPlayerSessionPropertiesEiRKNS4_37ParameterToSetPlayerSessionPropertiesERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE();
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -89,18 +72,17 @@ void TestConstructedStringIsEmpty() {
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, &libContext);
-
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
     Require(Load<std::int32_t>(storage, kReferenceCountOffset) == 0);
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
     Require(Load<std::uint64_t>(storage, kBufferSizeOffset) == 0);
     Require(Load<void*>(storage, kLibContextOffset) == &libContext);
     Require(GuardIntact(storage));
 
-    const char* text = _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes);
+    const char* text = _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes));
     Require(text != nullptr && text[0] == '\0');
 
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
     Require(Load<std::uint64_t>(storage, kBufferSizeOffset) == 0);
     Require(GuardIntact(storage));
@@ -110,29 +92,28 @@ void TestNullLibContextIsStored() {
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, nullptr);
-
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), nullptr);
     Require(Load<void*>(storage, kLibContextOffset) == nullptr);
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
-    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes)[0] == '\0');
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes))[0] == '\0');
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
+
 }
 
 void TestAppendBuildsAndClearsBuffer() {
     std::uint64_t libContext = 1;
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, &libContext);
-
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(storage.bytes, "rank") == 0);
-    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes), "rank") == 0);
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(storage.bytes, "ing") == 0);
-    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes), "ranking") == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), "rank") == 0);
+    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes)), "rank") == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), "ing") == 0);
+    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes)), "ranking") == 0);
     Require(Load<char*>(storage, kBufferOffset) != nullptr);
     Require(GuardIntact(storage));
 
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
     Require(Load<std::uint64_t>(storage, kBufferSizeOffset) == 0);
     Require(GuardIntact(storage));
@@ -143,11 +124,12 @@ void TestAppendNullKeepsEmpty() {
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, &libContext);
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(storage.bytes, nullptr) == 0);
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), nullptr) == 0);
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
-    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes)[0] == '\0');
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes))[0] == '\0');
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
+
 }
 
 void TestVectorPushBackCopiesStringContent() {
@@ -157,15 +139,15 @@ void TestVectorPushBackCopiesStringContent() {
     std::memset(vector.bytes, kFill, sizeof(vector.bytes));
     std::memset(element.bytes, kFill, sizeof(element.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(vector.bytes, &libContext);
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(reinterpret_cast<IntrusivePtr*>(vector.bytes), &libContext);
     Require(VectorGuardIntact(vector));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(element.bytes, &libContext);
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(element.bytes, "privilege") == 0);
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(element.bytes), &libContext);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(element.bytes), "privilege") == 0);
     char* elementBuffer = Load<char*>(element, kBufferOffset);
     Require(elementBuffer != nullptr);
 
-    Require(_ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(vector.bytes, element.bytes) == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(reinterpret_cast<IntrusivePtr*>(vector.bytes), element.bytes) == 0);
 
     void* body;
     std::memcpy(&body, vector.bytes + kObjectOffset, sizeof(body));
@@ -181,10 +163,10 @@ void TestVectorPushBackCopiesStringContent() {
     Require(storedBuffer != elementBuffer);
     Require(std::strcmp(storedBuffer, "privilege") == 0);
 
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(element.bytes);
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(element.bytes));
     Require(std::strcmp(storedBuffer, "privilege") == 0);
 
-    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(vector.bytes);
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(reinterpret_cast<IntrusivePtr*>(vector.bytes));
     Require(VectorGuardIntact(vector));
 }
 
@@ -193,18 +175,18 @@ void TestStringEmptyAndEquals() {
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, &libContext);
-    Require(_ZNK3sce2Np9CppWebApi6Common6String5emptyEv(storage.bytes) == 1);
-    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(storage.bytes, "rank") == 0);
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5emptyEv(reinterpret_cast<const CommonString*>(storage.bytes)) == 1);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), "rank") == 0);
 
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(storage.bytes, "rank") == 0);
-    Require(_ZNK3sce2Np9CppWebApi6Common6String5emptyEv(storage.bytes) == 0);
-    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(storage.bytes, "rank") == 1);
-    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(storage.bytes, "rank2") == 0);
-    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(storage.bytes, nullptr) == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), "rank") == 0);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5emptyEv(reinterpret_cast<const CommonString*>(storage.bytes)) == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), "rank") == 1);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), "rank2") == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), nullptr) == 0);
     Require(GuardIntact(storage));
 
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
 }
 
 int g_elementDeleterCalls = 0;
@@ -227,10 +209,10 @@ void TestIntrusivePtrVectorPushBack() {
     std::memcpy(element + 0x08, &deleter, sizeof(void*));
     std::memcpy(element + 0x10, &libContext, sizeof(void*));
 
-    _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEEC1EPNS2_10LibContextE(vector.bytes, &libContext);
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEEC1EPNS2_10LibContextE(reinterpret_cast<IntrusivePtr*>(vector.bytes), &libContext);
     Require(VectorGuardIntact(vector));
 
-    Require(_ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEE8pushBackERKS8_(vector.bytes, element) == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEE8pushBackERKS8_(reinterpret_cast<IntrusivePtr*>(vector.bytes), element) == 0);
 
     void* body;
     std::memcpy(&body, vector.bytes + kObjectOffset, sizeof(body));
@@ -240,7 +222,7 @@ void TestIntrusivePtrVectorPushBack() {
     Require(LoadBody<std::uint64_t>(body, kBodySizeOffset) == 1);
     Require(*reinterpret_cast<std::int32_t*>(elementObject) == 1);
 
-    _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEED1Ev(vector.bytes);
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEED1Ev(reinterpret_cast<IntrusivePtr*>(vector.bytes));
     Require(g_elementDeleterCalls == 1);
     Require(VectorGuardIntact(vector));
 }
diff --git a/core/libs/tests/GuestNpFriendListDialog.cpp b/core/libs/tests/GuestNpFriendListDialog.cpp
index 70385c595c..f06898db7b 100644
--- a/core/libs/tests/GuestNpFriendListDialog.cpp
+++ b/core/libs/tests/GuestNpFriendListDialog.cpp
@@ -1,17 +1,8 @@
+#include "prx/libSceNpFriendListDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceNpFriendListDialogInitialize(void);
-int APS5_VABI sceNpFriendListDialogOpenA(const void* param);
-int APS5_VABI sceNpFriendListDialogUpdateStatus(void);
-int APS5_VABI sceNpFriendListDialogGetStatus(void);
-int APS5_VABI sceNpFriendListDialogGetResultA(void* result);
-int APS5_VABI sceNpFriendListDialogClose(void);
-int APS5_VABI sceNpFriendListDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestNpGameIntent.cpp b/core/libs/tests/GuestNpGameIntent.cpp
index dbf030f79e..8e74607008 100644
--- a/core/libs/tests/GuestNpGameIntent.cpp
+++ b/core/libs/tests/GuestNpGameIntent.cpp
@@ -1,24 +1,12 @@
+#include "prx/libSceNpGameIntent/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpGameIntentInitParamInit(NpGameIntentInitParam* param);
-int APS5_VABI sceNpGameIntentInfoInit(NpGameIntentInfo* info);
-int APS5_VABI sceNpGameIntentInitialize(const void* initParam);
-int APS5_VABI sceNpGameIntentReceiveIntent(NpGameIntentInfo* intentInfo);
-int APS5_VABI sceNpGameIntentGetPropertyValueString(const NpGameIntentData* intentData, const char* key, char* valueBuf, size_t bufSize);
-int APS5_VABI sceNpGameIntentVshInitialize(void);
-int APS5_VABI sceNpGameIntentVshTerminate(void);
-int APS5_VABI sceNpGameIntentTerminate(void);
-int APS5_VABI sceNpAppLauncherInitialize(const void* initParam);
-int APS5_VABI sceNpAppLauncherLaunchApp(void);
-int APS5_VABI sceNpAppLauncherTerminate(void);
-}
-
 static void Require(bool value, const char* what) {
     if (value) return;
     std::printf("NpGameIntent: %s\n", what);
@@ -36,6 +24,8 @@ static bool Throws(TCall call) {
 }
 
 int main() {
+    constexpr int kNotInitialized = -2141898750;
+    constexpr int kInvalidArgument = -2141898748;
     constexpr int kIntentNotFound = -2141898746;
     constexpr int kValueNotFound = -2141898745;
 
@@ -54,22 +44,75 @@ int main() {
     Require(info.size == sizeof(NpGameIntentInfo), "info size mismatch");
     Require(info.user_id == -1, "info user_id mismatch");
 
+    char preBuf[64]{};
+    Require(sceNpGameIntentGetPropertyValueString(nullptr, "key", preBuf, sizeof(preBuf)) == kNotInitialized,
+            "uninitialized get property string with null data must report not-initialized");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", preBuf, sizeof(preBuf)) == kNotInitialized,
+            "uninitialized get property string with valid data must report not-initialized");
+    Require(sceNpGameIntentReceiveIntent(nullptr) == kNotInitialized,
+            "uninitialized receive intent with null pointer must report not-initialized");
+    Require(sceNpGameIntentReceiveIntent(&info) == kNotInitialized,
+            "uninitialized receive intent with valid pointer must report not-initialized");
+
     Require(sceNpGameIntentInitialize(&initParam) == 0, "initialization failed");
-    Require(sceNpGameIntentReceiveIntent(&info) == kIntentNotFound, "receive intent mismatch");
+    Require(sceNpGameIntentReceiveIntent(nullptr) == kInvalidArgument, "null receive intent did not fail");
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "mismatched struct size must report invalid argument");
+    info.size = 0;
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "zero size must report invalid argument");
+    info.size = 0x413f;
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "0x413f size must report invalid argument");
+    info.size = 0x4141;
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "0x4141 size must report invalid argument");
+    info.size = sizeof(NpGameIntentInfo);
 
     char buf[64]{};
-    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, sizeof(buf)) == kValueNotFound,
+    Require(sceNpGameIntentGetPropertyValueString(nullptr, "key", buf, sizeof(buf)) == kInvalidArgument,
+            "null intent data did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, nullptr, buf, sizeof(buf)) == kInvalidArgument,
+            "null key did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "", buf, sizeof(buf)) == kInvalidArgument,
+            "empty key did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", nullptr, sizeof(buf)) == kInvalidArgument,
+            "null value buf did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, 0) == kInvalidArgument,
+            "zero buf size did not fail");
+
+    char canaryBuf[64]{};
+    std::memset(canaryBuf, 'X', sizeof(canaryBuf));
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", canaryBuf, 0) == kInvalidArgument,
+            "zero buf size canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on zero size error");
+    Require(sceNpGameIntentGetPropertyValueString(nullptr, "key", canaryBuf, sizeof(canaryBuf)) == kInvalidArgument,
+            "null data canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on null data error");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, nullptr, canaryBuf, sizeof(canaryBuf)) == kInvalidArgument,
+            "null key canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on null key error");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "", canaryBuf, sizeof(canaryBuf)) == kInvalidArgument,
+            "empty key canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on empty key error");
+
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", canaryBuf, sizeof(canaryBuf)) == kValueNotFound,
             "get property value mismatch");
+    Require(canaryBuf[0] == '\0', "valid call did not write terminator");
+
+    canaryBuf[0] = 'Y';
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", canaryBuf, 1) == kValueNotFound,
+            "bufSize 1 did not succeed");
+    Require(canaryBuf[0] == '\0', "bufSize 1 did not write terminator");
 
     Require(sceNpGameIntentVshInitialize() == 0, "vsh init failed");
     Require(sceNpGameIntentVshTerminate() == 0, "vsh terminate failed");
     Require(sceNpGameIntentTerminate() == 0, "terminate failed");
 
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, sizeof(buf)) == kNotInitialized,
+            "post-terminate get property value must report not-initialized");
+    Require(sceNpGameIntentReceiveIntent(&info) == kNotInitialized,
+            "post-terminate receive intent must report not-initialized");
+
     unsigned char appLauncherParam[0x28]{};
     *reinterpret_cast<std::uint64_t*>(appLauncherParam) = 0x28;
     Require(sceNpAppLauncherInitialize(appLauncherParam) == 0, "app launcher init failed");
-    Require(Throws<std::runtime_error>([] { sceNpAppLauncherLaunchApp(); }),
-            "app launcher launch must throw until implemented");
     Require(sceNpAppLauncherTerminate() == 0, "app launcher terminate failed");
     *reinterpret_cast<std::uint64_t*>(appLauncherParam) = 0x10;
     Require(sceNpAppLauncherInitialize(appLauncherParam) == 0,
diff --git a/core/libs/tests/GuestNpManager.cpp b/core/libs/tests/GuestNpManager.cpp
index 67e63ff3b0..01c3629c98 100644
--- a/core/libs/tests/GuestNpManager.cpp
+++ b/core/libs/tests/GuestNpManager.cpp
@@ -1,63 +1,14 @@
+#include "prx/libSceNpManager/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <limits>
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceNpGetAccountCountryA(int user_id, void* country_code);
-int APS5_VABI sceNpGetNpId(int user_id, NpId* np_id);
-int APS5_VABI sceNpGetOnlineId(int user_id, NpOnlineId* online_id);
-int APS5_VABI sceNpGetUserIdByAccountId(std::uint64_t account_id, int* user_id);
-int APS5_VABI sceNpUnknown_8weiQyIdI3A(int userId, const NpOnlineId* buffer);
-int APS5_VABI sceNpUnknown_WxLcN76q19o(void);
-int APS5_VABI sceNpGetAccountCountry(const NpOnlineId* online_id, void* country_code);
-int APS5_VABI sceNpGetAccountDateOfBirth(const NpOnlineId* online_id, void* date_of_birth);
-int APS5_VABI sceNpGetAccountLanguage(int req_id, const NpOnlineId* online_id, void* language);
-int APS5_VABI sceNpGetParentalControlInfo(int req_id, const NpOnlineId* online_id, std::int8_t* age, void* info);
-int APS5_VABI sceNpGetUserIdByOnlineId(const NpOnlineId* online_id, int* user_id);
-int APS5_VABI sceNpCheckPlus(int req_id, const void* param, void* result);
-int APS5_VABI sceNpNotifyPlusFeature(const void* param);
-int APS5_VABI sceNpGetAccountId(const NpOnlineId* online_id, std::uint64_t* account_id);
-int APS5_VABI sceNpSetGamePresenceOnline(int req_id, const NpOnlineId* online_id, std::uint32_t presence);
-int APS5_VABI sceNpRegisterPlusEventCallback(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterPlusEventCallback(void);
-int APS5_VABI sceNpIsPlusMember(int user_id, bool* is_member);
-int APS5_VABI sceNpSetContentRestriction(const NpContentRestriction* restriction);
-}
-
-extern "C" {
-int APS5_VABI sceNpCreateRequest(void);
-int APS5_VABI sceNpCreateAsyncRequest(const NpCreateAsyncRequestParameter* param);
-int APS5_VABI sceNpDeleteRequest(int reqId);
-int APS5_VABI sceNpSetTimeout(int reqId, std::int32_t resolveRetry, std::uint32_t resolveTimeout,
-    std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout);
-}
-
-extern "C" {
-int APS5_VABI sceNpCheckCallback(void);
-int APS5_VABI sceNpCheckCallbackForLib(void);
-int APS5_VABI sceNpRegisterStateCallback(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterStateCallback(void);
-int APS5_VABI sceNpRegisterStateCallbackA(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterStateCallbackA(int callbackId);
-int APS5_VABI sceNpRegisterNpReachabilityStateCallback(void* callback, void* userdata);
-void APS5_VABI sceNpRegisterGamePresenceCallback(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterNpReachabilityStateCallback(void);
-}
-
-extern "C" {
-int APS5_VABI sceNpCheckNpAvailabilityA(int reqId, int userId);
-int APS5_VABI sceNpGetAccountDateOfBirthA(int userId, void* dateOfBirth);
-int APS5_VABI sceNpGetAccountLanguageA(int reqId, int userId, void* language);
-int APS5_VABI sceNpGetGamePresenceStatus(const NpOnlineId* onlineId, std::uint32_t* status);
-int APS5_VABI sceNpGetGamePresenceStatusA(int userId, std::uint32_t* status);
-int APS5_VABI sceNpGetParentalControlInfoA(int reqId, int userId, std::int8_t* age, void* info);
-}
-
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80550003u);
@@ -67,6 +18,7 @@ constexpr int UserNotFound = static_cast<int>(0x80550007u);
 constexpr int AlreadyRegistered = static_cast<int>(0x80550008u);
 constexpr int NotRegistered = static_cast<int>(0x80550009u);
 constexpr int RequestNotFound = static_cast<int>(0x80550014u);
+constexpr int InvalidId = static_cast<int>(0x80550015u);
 
 void Require(bool condition, const char* message) {
     if (!condition) {
@@ -135,41 +87,45 @@ void CheckStateCallbacksA() {
     int userdata[9]{};
     Require(sceNpRegisterStateCallbackA(nullptr, &userdata[0]) == InvalidArgument, "null state callback");
     int ids[8]{};
-    ids[0] = sceNpRegisterStateCallbackA(callbacks[0], &userdata[0]);
+    ids[0] = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[0]), &userdata[0]);
     Require(ids[0] >= 1 && ids[0] <= 8, "state callback id outside 1..8");
-    Require(sceNpRegisterStateCallbackA(callbacks[0], &userdata[1]) == AlreadyRegistered, "duplicate state callback");
+    Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[0]), &userdata[1]) == AlreadyRegistered, "duplicate state callback");
     Require(stateCallsA[0].calls == 0, "registering calls the state callback");
     Require(sceNpRegisterNpReachabilityStateCallback(reinterpret_cast<void*>(&AbortingReachabilityCallback), nullptr) == 0,
         "registering the reachability callback");
     sceNpRegisterGamePresenceCallback(nullptr, nullptr);
     sceNpRegisterGamePresenceCallback(reinterpret_cast<void*>(&AbortingGamePresenceCallback), &userdata[0]);
+
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed");
     Require(SignedOutOnce(stateCallsA[0], &userdata[0]), "sceNpCheckCallback must deliver SIGNED_OUT once");
     Require(sceNpUnregisterNpReachabilityStateCallback() == 0, "unregistering the reachability callback");
     Require(sceNpCheckCallback() == 0, "second sceNpCheckCallback failed");
     Require(stateCallsA[0].calls == 1, "the second sceNpCheckCallback delivered the state again");
     for (int index = 1; index < 8; ++index) {
-        ids[index] = sceNpRegisterStateCallbackA(callbacks[index], &userdata[index]);
+        ids[index] = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[index]), &userdata[index]);
         Require(ids[index] >= 1 && ids[index] <= 8, "state callback id outside 1..8");
         for (int other = 0; other < index; ++other) {
             Require(ids[index] != ids[other], "two state callbacks got the same id");
         }
     }
-    Require(sceNpRegisterStateCallbackA(callbacks[8], &userdata[8]) == CallbackMax, "ninth state callback");
+    Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[8]), &userdata[8]) == CallbackMax, "ninth state callback");
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with eight callbacks");
     for (int index = 0; index < 8; ++index) {
         Require(SignedOutOnce(stateCallsA[index], &userdata[index]), "each callback gets SIGNED_OUT once");
     }
     Require(stateCallsA[8].calls == 0, "a rejected callback was called");
-    Require(sceNpUnregisterStateCallbackA(0) == InvalidArgument, "callback id 0");
-    Require(sceNpUnregisterStateCallbackA(9) == InvalidArgument, "callback id 9");
+    Require(sceNpUnregisterStateCallbackA(0) == InvalidId, "callback id 0");
+    Require(sceNpUnregisterStateCallbackA(9) == InvalidId, "callback id 9");
+    Require(sceNpUnregisterStateCallbackA(-1) == InvalidId, "callback id -1");
+    Require(sceNpUnregisterStateCallbackA(std::numeric_limits<int>::min()) == InvalidId, "callback id INT_MIN");
+    Require(sceNpUnregisterStateCallbackA(std::numeric_limits<int>::max()) == InvalidId, "callback id INT_MAX");
     Require(sceNpUnregisterStateCallbackA(ids[3]) == 0, "unregistering one state callback");
     for (int index = 0; index < 8; ++index) {
         if (index == 3) continue;
-        Require(sceNpRegisterStateCallbackA(callbacks[index], &userdata[index]) == AlreadyRegistered,
+        Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[index]), &userdata[index]) == AlreadyRegistered,
             "unregistering one id removed another callback");
     }
-    Require(sceNpRegisterStateCallbackA(callbacks[3], &userdata[3]) == ids[3], "registering again takes the freed slot");
+    Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[3]), &userdata[3]) == ids[3], "registering again takes the freed slot");
     Require(sceNpCheckCallbackForLib() == 0, "sceNpCheckCallbackForLib failed after registering again");
     for (int index = 0; index < 8; ++index) {
         Require(stateCallsA[index].calls == (index == 3 ? 2 : 1), "only the registration made again gets SIGNED_OUT");
@@ -182,13 +138,13 @@ void CheckStateCallbacksA() {
         Require(sceNpUnregisterStateCallbackA(ids[index]) == 0, "unregistering a state callback");
     }
     Require(sceNpUnregisterStateCallbackA(ids[0]) == NotRegistered, "unregistering a state callback twice");
-    const int removed = sceNpRegisterStateCallbackA(callbacks[8], &userdata[8]);
+    const int removed = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[8]), &userdata[8]);
     Require(removed >= 1 && removed <= 8, "a freed slot is reused");
     Require(sceNpUnregisterStateCallbackA(removed) == 0, "unregistering before sceNpCheckCallback");
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with no callbacks");
     Require(stateCallsA[8].calls == 0, "an unregistered callback was called");
     SelfUnregister self{};
-    self.id = sceNpRegisterStateCallbackA(reinterpret_cast<void*>(&SelfUnregisteringCallback), &self);
+    self.id = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(reinterpret_cast<void*>(&SelfUnregisteringCallback)), &self);
     Require(self.id >= 1 && self.id <= 8, "state callback id outside 1..8");
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with a callback that unregisters itself");
     Require(self.calls == 1 && self.result == 0, "a state callback must be able to unregister itself");
@@ -201,8 +157,8 @@ void CheckLegacyStateCallback() {
     auto* callback = reinterpret_cast<void*>(&LegacyStateCallback);
     Require(sceNpUnregisterStateCallback() == NotRegistered, "unregistering with no legacy callback");
     Require(sceNpRegisterStateCallback(nullptr, &userdata) == InvalidArgument, "null legacy callback");
-    Require(sceNpRegisterStateCallback(callback, &userdata) == 0, "registering the legacy callback");
-    Require(sceNpRegisterStateCallback(callback, nullptr) == AlreadyRegistered, "duplicate legacy callback");
+    Require(sceNpRegisterStateCallback(reinterpret_cast<NpStateCallback>(callback), &userdata) == 0, "registering the legacy callback");
+    Require(sceNpRegisterStateCallback(reinterpret_cast<NpStateCallback>(callback), nullptr) == AlreadyRegistered, "duplicate legacy callback");
     legacyStateCall.npId = &sentinel;
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with the legacy callback");
     Require(SignedOutOnce(legacyStateCall, &userdata), "the legacy callback must get SIGNED_OUT with no NpId");
@@ -238,6 +194,33 @@ void CheckRequestTimeouts() {
     Require(sceNpSetTimeout(asyncId, 2, 0, 0, 0, 0) == RequestNotFound, "deleted async request");
 }
 
+void CheckAsyncRequestLifecycle() {
+    NpCreateAsyncRequestParameter param{};
+    const int unusedAsyncResult = sceNpCreateAsyncRequest(&param);
+    Require(unusedAsyncResult > 0, "sceNpCreateAsyncRequest must return a positive request id");
+    const int deletedId = sceNpCreateAsyncRequest(&param);
+    Require(sceNpDeleteRequest(deletedId) == 0, "initial delete");
+
+    constexpr int resultSentinel = 0x5a5a5a5a;
+    const int unknownIds[] = {0, -1, 0x7fffffff, deletedId};
+    for (const int id : unknownIds) {
+        int result = resultSentinel;
+        Require(sceNpPollAsync(id, &result) == RequestNotFound, "poll must reject an absent or deleted id");
+        Require(result == resultSentinel, "poll must not touch the result for an absent or deleted id");
+        Require(sceNpPollAsync(id, nullptr) == InvalidArgument,
+            "poll must reject a null result before the id");
+        Require(sceNpAbortRequest(id) == RequestNotFound, "abort must reject an absent or deleted id");
+        Require(sceNpDeleteRequest(id) == RequestNotFound, "delete must reject an absent or deleted id");
+    }
+
+    int result = resultSentinel;
+    Require(sceNpPollAsync(unusedAsyncResult, &result) == 0, "poll on a live async request");
+    Require(result == SignedOut, "poll must report the signed-out result on a live async request");
+    Require(sceNpAbortRequest(unusedAsyncResult) == 0, "abort on a live request");
+    Require(sceNpDeleteRequest(unusedAsyncResult) == 0, "delete after abort");
+    Require(sceNpDeleteRequest(unusedAsyncResult) == RequestNotFound, "second delete");
+}
+
 void CheckOnlineIdQueries() {
     NpOnlineId onlineId{};
     std::memcpy(onlineId.data, "player", 6);
@@ -284,6 +267,7 @@ void CheckOnlineIdQueries() {
     Require(std::memcmp(output, untouched, sizeof(output)) == 0 && age == 0x5a && userId == 0x5a5a && accountId == 0x5a5a, "a failed query wrote its output");
     try {
         sceNpNotifyPlusFeature(output);
+
         Require(false, "sceNpNotifyPlusFeature must report that it is not implemented");
     } catch (const std::runtime_error& error) {
         Require(std::string(error.what()) == "sceNpNotifyPlusFeature not implemented", "sceNpNotifyPlusFeature threw");
@@ -394,6 +378,7 @@ int main() {
     CheckStateCallbacksA();
     CheckLegacyStateCallback();
     CheckRequestTimeouts();
+    CheckAsyncRequestLifecycle();
     CheckPlusAndContentRestriction();
     NpId npId{};
     std::memset(&npId, 0x5a, sizeof(npId));
@@ -424,6 +409,7 @@ int main() {
     NpOnlineId buffer{};
     try {
         sceNpUnknown_8weiQyIdI3A(0x10000, &buffer);
+
         Require(false, "sceNpUnknown_8weiQyIdI3A must report that it is not implemented");
     } catch (const std::runtime_error& error) {
         Require(std::string(error.what()) == "sceNpUnknown_8weiQyIdI3A not implemented",
@@ -431,6 +417,7 @@ int main() {
     }
     try {
         sceNpUnknown_WxLcN76q19o();
+
         Require(false, "sceNpUnknown_WxLcN76q19o must report that it is not implemented");
     } catch (const std::runtime_error& error) {
         Require(std::string(error.what()) == "sceNpUnknown_WxLcN76q19o not implemented",
diff --git a/core/libs/tests/GuestNpMatching2Offline.cpp b/core/libs/tests/GuestNpMatching2Offline.cpp
new file mode 100644
index 0000000000..796c217bdf
--- /dev/null
+++ b/core/libs/tests/GuestNpMatching2Offline.cpp
@@ -0,0 +1,92 @@
+#include "prx/libSceNpMatching2/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+
+
+
+
+
+namespace {
+
+constexpr int ResolverTimedOut = static_cast<int>(0x804101E2u);
+constexpr int NotInitialized = static_cast<int>(0x80550C03u);
+constexpr int ContextMax = static_cast<int>(0x80550C04u);
+constexpr int ContextNotStarted = static_cast<int>(0x80550C08u);
+constexpr int InvalidArgument = static_cast<int>(0x80550C0Au);
+constexpr int InvalidContextId = static_cast<int>(0x80550C0Bu);
+
+int failures = 0;
+
+void Require(bool value, const char* name, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s: %s\n", name, what);
+    ++failures;
+}
+
+}
+
+int main() {
+    NpMatching2InitializeParameter init{};
+    NpMatching2CreateContextParameter create{};
+    create.size = 0x28;
+    unsigned char requestOpt[24] = {};
+    std::uint16_t context = 77;
+
+    Require(sceNpMatching2CreateContext(nullptr, nullptr) == NotInitialized, "sceNpMatching2CreateContext", "a call before initialization did not return NOT_INITIALIZED first");
+    Require(sceNpMatching2DestroyContext(1) == NotInitialized, "sceNpMatching2DestroyContext", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2ContextStart(1, 0) == NotInitialized, "sceNpMatching2ContextStart", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2ContextStop(1) == NotInitialized, "sceNpMatching2ContextStop", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterContextCallback(nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterContextCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterRoomEventCallback(1, nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterRoomEventCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterRoomMessageCallback(1, nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterRoomMessageCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterSignalingCallback(1, nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterSignalingCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2SetDefaultRequestOptParam(1, nullptr) == NotInitialized, "sceNpMatching2SetDefaultRequestOptParam", "a call before initialization did not return NOT_INITIALIZED first");
+
+    init.size = 0x30;
+    Require(sceNpMatching2Initialize(&init) == 0, "sceNpMatching2Initialize", "initialization failed");
+
+    Require(sceNpMatching2CreateContext(nullptr, &context) == InvalidArgument, "sceNpMatching2CreateContext", "a null parameter was taken");
+    create.size = 0x30;
+    Require(sceNpMatching2CreateContext(&create, &context) == InvalidArgument, "sceNpMatching2CreateContext", "parameter size 0x30 was taken");
+    create.size = 0x28;
+    Require(sceNpMatching2CreateContext(&create, nullptr) == InvalidArgument, "sceNpMatching2CreateContext", "a null output was taken");
+    Require(context == 77, "sceNpMatching2CreateContext", "a refused call wrote the context id");
+    Require(sceNpMatching2CreateContext(&create, &context) == 0 && context == 1, "sceNpMatching2CreateContext", "the first context is not id 1");
+    Require(sceNpMatching2DestroyContext(1) == 0, "sceNpMatching2DestroyContext", "destroying context 1 failed");
+    std::uint16_t created = 0;
+    for (std::uint16_t expected = 2; expected <= 10; ++expected) {
+        Require(sceNpMatching2CreateContext(&create, &created) == 0 && created == expected, "sceNpMatching2CreateContext", "a context id was reused before the ids up to 10 were handed out");
+    }
+    Require(sceNpMatching2CreateContext(&create, &created) == 0 && created == 1, "sceNpMatching2CreateContext", "after id 10 the allocation did not wrap to the free id 1");
+    created = 77;
+    Require(sceNpMatching2CreateContext(&create, &created) == ContextMax && created == 77, "sceNpMatching2CreateContext", "an eleventh context did not return CONTEXT_MAX");
+    Require(sceNpMatching2DestroyContext(11) == InvalidContextId, "sceNpMatching2DestroyContext", "an unknown context was destroyed");
+
+    Require(sceNpMatching2ContextStart(1, 0) == ResolverTimedOut, "sceNpMatching2ContextStart", "starting a context did not return the offline resolver timeout");
+    Require(sceNpMatching2ContextStart(99, 0) == ResolverTimedOut, "sceNpMatching2ContextStart", "the offline answer did not come before the context check");
+    Require(sceNpMatching2ContextStop(1) == ContextNotStarted, "sceNpMatching2ContextStop", "a context that never started did not return CONTEXT_NOT_STARTED");
+    Require(sceNpMatching2ContextStop(99) == InvalidContextId, "sceNpMatching2ContextStop", "an unknown context was taken");
+
+    Require(sceNpMatching2RegisterContextCallback(nullptr, nullptr) == 0, "sceNpMatching2RegisterContextCallback", "registering the context callback failed");
+    Require(sceNpMatching2RegisterRoomEventCallback(99, nullptr, nullptr) == InvalidContextId, "sceNpMatching2RegisterRoomEventCallback", "an unknown context was taken");
+    Require(sceNpMatching2RegisterRoomEventCallback(1, nullptr, nullptr) == 0, "sceNpMatching2RegisterRoomEventCallback", "registering failed");
+    Require(sceNpMatching2RegisterRoomMessageCallback(99, nullptr, nullptr) == InvalidContextId, "sceNpMatching2RegisterRoomMessageCallback", "an unknown context was taken");
+    Require(sceNpMatching2RegisterRoomMessageCallback(1, nullptr, nullptr) == 0, "sceNpMatching2RegisterRoomMessageCallback", "registering failed");
+    Require(sceNpMatching2RegisterSignalingCallback(99, nullptr, nullptr) == InvalidContextId, "sceNpMatching2RegisterSignalingCallback", "an unknown context was taken");
+    Require(sceNpMatching2RegisterSignalingCallback(1, nullptr, nullptr) == 0, "sceNpMatching2RegisterSignalingCallback", "registering failed");
+    Require(sceNpMatching2SetDefaultRequestOptParam(99, nullptr) == InvalidArgument, "sceNpMatching2SetDefaultRequestOptParam", "a null option was not refused before the context");
+    Require(sceNpMatching2SetDefaultRequestOptParam(99, requestOpt) == InvalidContextId, "sceNpMatching2SetDefaultRequestOptParam", "an unknown context was taken");
+    Require(sceNpMatching2SetDefaultRequestOptParam(1, requestOpt) == 0, "sceNpMatching2SetDefaultRequestOptParam", "setting the default option failed");
+
+    Require(sceNpMatching2Terminate() == 0, "sceNpMatching2Terminate", "termination failed");
+    Require(sceNpMatching2DestroyContext(1) == NotInitialized, "sceNpMatching2DestroyContext", "a context was destroyed after termination");
+    Require(sceNpMatching2Initialize(&init) == 0, "sceNpMatching2Initialize", "initializing again failed");
+    Require(sceNpMatching2RegisterRoomEventCallback(5, nullptr, nullptr) == InvalidContextId, "sceNpMatching2Terminate", "a context created before termination is still found");
+    Require(sceNpMatching2CreateContext(&create, &created) == 0 && created == 1, "sceNpMatching2Terminate", "termination did not restart the context ids at 1");
+    Require(sceNpMatching2Terminate() == 0, "sceNpMatching2Terminate", "the second termination failed");
+
+    if (failures != 0) return 1;
+    std::puts("NpMatching2 offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpPartner.cpp b/core/libs/tests/GuestNpPartner.cpp
index 700570470a..e57e29c5c5 100644
--- a/core/libs/tests/GuestNpPartner.cpp
+++ b/core/libs/tests/GuestNpPartner.cpp
@@ -1,13 +1,8 @@
+#include "prx/libSceNpPartner001/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpEAAccessInitialize(void);
-int APS5_VABI sceNpEAAccessTerminate(void);
-int APS5_VABI sceNpHasEAAccessSubscription(int, bool*);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestNpParty.cpp b/core/libs/tests/GuestNpParty.cpp
index e60834546c..2ee253c2b5 100644
--- a/core/libs/tests/GuestNpParty.cpp
+++ b/core/libs/tests/GuestNpParty.cpp
@@ -1,24 +1,10 @@
+#include "prx/libSceNpParty/libSceNpParty.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceNpPartyGetState(std::uint16_t* state);
-int APS5_VABI sceNpPartyInitialize(const void* param);
-int APS5_VABI sceNpPartyTerminate(void);
-int APS5_VABI sceNpPartyCheckCallback(void);
-int APS5_VABI sceNpPartyRegisterHandlerA(const void* handlers, void* userdata);
-int APS5_VABI sceNpPartyGetStateAsUserA(std::int32_t asUserId, std::uint16_t* state);
-int APS5_VABI sceNpPartyGetId(void* id);
-int APS5_VABI sceNpPartyGetMembersA(void* memberList);
-int APS5_VABI sceNpPartyGetMemberInfoA(std::uint16_t memberId, void* memberInfo);
-int APS5_VABI sceNpPartyGetMemberSessionInfo(std::uint16_t memberId, void* memberGameSessionInfo);
-int APS5_VABI sceNpPartyGetMemberVoiceInfo(std::uint16_t asMemberId, std::uint16_t memberId, std::uint8_t* memberVoiceState);
-int APS5_VABI sceNpPartySendBinaryMessage(const void* sendParams);
-}
-
 namespace {
 
 constexpr int kAlreadyInitialized = static_cast<int>(0x80552502u);
@@ -48,11 +34,14 @@ bool lifecycleTests() {
     return check(sceNpPartyTerminate() == kNotInitialized, "terminate before initialize did not fail")
         && check(sceNpPartyCheckCallback() == kNotInitialized, "check callback before initialize did not fail")
         && check(sceNpPartyRegisterHandlerA(handlers, nullptr) == kNotInitialized, "register handler before initialize did not fail")
+        && check(sceNpPartyRegisterHandler(handlers, nullptr) == kNotInitialized, "the plain register handler before initialize did not fail")
         && check(sceNpPartyInitialize(nullptr) == kInvalidArgument, "a null initialize param was not refused")
         && check(sceNpPartyInitialize(param) == 0, "initialize failed")
         && check(sceNpPartyInitialize(param) == kAlreadyInitialized, "a second initialize did not fail")
         && check(sceNpPartyRegisterHandlerA(nullptr, nullptr) == kInvalidArgument, "null handlers were not refused")
         && check(sceNpPartyRegisterHandlerA(handlers, param) == 0, "register handler failed")
+        && check(sceNpPartyRegisterHandler(nullptr, nullptr) == kInvalidArgument, "null plain handlers were not refused")
+        && check(sceNpPartyRegisterHandler(handlers, param) == 0, "the plain register handler failed")
         && check(sceNpPartyCheckCallback() == 0, "check callback failed")
         && check(sceNpPartyTerminate() == 0, "terminate failed")
         && check(sceNpPartyTerminate() == kNotInitialized, "a second terminate did not fail")
@@ -69,6 +58,10 @@ bool notInPartyTests() {
         && check(sceNpPartyGetMembersA(out) == kNotInParty, "get members did not report NOT_IN_PARTY")
         && check(sceNpPartyGetMemberInfoA(1, nullptr) == kInvalidArgument, "a null member info was not refused")
         && check(sceNpPartyGetMemberInfoA(1, out) == kNotInParty, "get member info did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMembers(nullptr) == kInvalidArgument, "a null plain member list was not refused")
+        && check(sceNpPartyGetMembers(out) == kNotInParty, "the plain get members did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMemberInfo(1, nullptr) == kInvalidArgument, "a null plain member info was not refused")
+        && check(sceNpPartyGetMemberInfo(1, out) == kNotInParty, "the plain get member info did not report NOT_IN_PARTY")
         && check(sceNpPartyGetMemberSessionInfo(1, nullptr) == kInvalidArgument, "a null session info was not refused")
         && check(sceNpPartyGetMemberSessionInfo(1, out) == kNotInParty, "get session info did not report NOT_IN_PARTY")
         && check(sceNpPartyGetMemberVoiceInfo(1, 2, nullptr) == kInvalidArgument, "a null voice state was not refused")
diff --git a/core/libs/tests/GuestNpProfileDialog.cpp b/core/libs/tests/GuestNpProfileDialog.cpp
index a9d2986bfe..cb7fa68f8d 100644
--- a/core/libs/tests/GuestNpProfileDialog.cpp
+++ b/core/libs/tests/GuestNpProfileDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpProfileDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -6,17 +7,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceNpProfileDialogInitialize(void);
-int APS5_VABI sceNpProfileDialogTerminate(void);
-int APS5_VABI sceNpProfileDialogUpdateStatus(void);
-int APS5_VABI sceNpProfileDialogGetStatus(void);
-int APS5_VABI sceNpProfileDialogOpen(const void* param);
-int APS5_VABI sceNpProfileDialogOpenA(const void* param);
-int APS5_VABI sceNpProfileDialogClose(void);
-int APS5_VABI sceNpProfileDialogGetResult(void* result);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -91,12 +81,12 @@ int main() {
 
     Require(sceNpProfileDialogTerminate() == kErrNotInitialized);
     Require(sceNpProfileDialogClose() == kErrNotInitialized);
-    Require(sceNpProfileDialogGetResult(result) == kErrNotInitialized);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotInitialized);
     Require(sceNpProfileDialogGetResult(nullptr) == kErrNotInitialized);
     Require(sceNpProfileDialogGetStatus() == kStatusNone);
     Require(sceNpProfileDialogUpdateStatus() == kStatusNone);
-    RequireThrows([&] { sceNpProfileDialogOpen(param); });
-    RequireThrows([&] { sceNpProfileDialogOpenA(paramA); });
+    RequireThrows([&] { sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(param)); });
+    RequireThrows([&] { sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(paramA)); });
     Require(sceNpProfileDialogGetStatus() == kStatusNone);
     Require(result[0] == kSentinel);
 
@@ -105,7 +95,7 @@ int main() {
     Require(sceNpProfileDialogGetStatus() == kStatusInitialized);
     Require(sceNpProfileDialogUpdateStatus() == kStatusInitialized);
 
-    Require(sceNpProfileDialogGetResult(result) == kErrNotFinished);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotFinished);
     Require(result[0] == kSentinel);
     RequireThrows([] { sceNpProfileDialogGetResult(nullptr); });
     RequireThrows([] { sceNpProfileDialogClose(); });
@@ -117,24 +107,24 @@ int main() {
 
     alignas(8) std::uint8_t wrong[kParamSize + 16];
     MakeParam(wrong, sizeof(wrong), kParamASize, 1, kParamUserData, &first);
-    RequireThrows([&] { sceNpProfileDialogOpen(wrong); });
+    RequireThrows([&] { sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(wrong)); });
     MakeParam(wrong, sizeof(wrong), kParamSize, 1, kParamAUserData, &second);
-    RequireThrows([&] { sceNpProfileDialogOpenA(wrong); });
+    RequireThrows([&] { sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(wrong)); });
     MakeParam(wrong, sizeof(wrong), kParamSize, 0, kParamUserData, &first);
-    RequireThrows([&] { sceNpProfileDialogOpen(wrong); });
+    RequireThrows([&] { sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(wrong)); });
     MakeParam(wrong, sizeof(wrong), kParamASize, 5, kParamAUserData, &second);
-    RequireThrows([&] { sceNpProfileDialogOpenA(wrong); });
+    RequireThrows([&] { sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(wrong)); });
     Require(sceNpProfileDialogGetStatus() == kStatusInitialized);
-    Require(sceNpProfileDialogGetResult(result) == kErrNotFinished);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotFinished);
 
     std::uint8_t paramCopy[sizeof(param)];
     std::memcpy(paramCopy, param, sizeof(param));
-    Require(sceNpProfileDialogOpen(param) == 0);
+    Require(sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(param)) == 0);
     Require(std::memcmp(param, paramCopy, sizeof(param)) == 0);
     Require(sceNpProfileDialogGetStatus() == kStatusFinished);
     Require(sceNpProfileDialogUpdateStatus() == kStatusFinished);
     Require(sceNpProfileDialogGetResult(nullptr) == kErrArgNull);
-    Require(sceNpProfileDialogGetResult(result) == 0);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == 0);
     RequireCanceled(result, &first);
     RequireThrows([] { sceNpProfileDialogClose(); });
     Require(sceNpProfileDialogGetStatus() == kStatusFinished);
@@ -144,25 +134,25 @@ int main() {
         std::uint8_t paramACopy[sizeof(paramA)];
         std::memcpy(paramACopy, paramA, sizeof(paramA));
         std::memset(result, kSentinel, sizeof(result));
-        Require(sceNpProfileDialogOpenA(paramA) == 0);
+        Require(sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(paramA)) == 0);
         Require(std::memcmp(paramA, paramACopy, sizeof(paramA)) == 0);
         Require(sceNpProfileDialogUpdateStatus() == kStatusFinished);
-        Require(sceNpProfileDialogGetResult(result) == 0);
+        Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == 0);
         RequireCanceled(result, &second);
     }
 
     Require(sceNpProfileDialogTerminate() == 0);
     Require(sceNpProfileDialogTerminate() == kErrNotInitialized);
     Require(sceNpProfileDialogGetStatus() == kStatusNone);
-    Require(sceNpProfileDialogGetResult(result) == kErrNotInitialized);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotInitialized);
 
     Require(sceNpProfileDialogInitialize() == 0);
     std::memset(result, kSentinel, sizeof(result));
-    Require(sceNpProfileDialogGetResult(result) == kErrNotFinished);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotFinished);
     Require(result[0] == kSentinel);
     Store<std::uint32_t>(param, 56, 4);
-    Require(sceNpProfileDialogOpen(param) == 0);
-    Require(sceNpProfileDialogGetResult(result) == 0);
+    Require(sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(param)) == 0);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == 0);
     RequireCanceled(result, &first);
     Require(sceNpProfileDialogTerminate() == 0);
     return 0;
diff --git a/core/libs/tests/GuestNpPs4Imports.cpp b/core/libs/tests/GuestNpPs4Imports.cpp
new file mode 100644
index 0000000000..4ffc79c2fe
--- /dev/null
+++ b/core/libs/tests/GuestNpPs4Imports.cpp
@@ -0,0 +1,127 @@
+#include "prx/libSceNpTrophy/include/Api.hpp"
+#include "prx/libSceNpSignaling/include/Api.hpp"
+#include "prx/libSceNpMatching2/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <stdexcept>
+#include <string>
+#include <system_error>
+#include <vector>
+
+namespace {
+
+constexpr int Matching2AlreadyInitialized = static_cast<int>(0x80550C02u);
+constexpr int Matching2NotInitialized = static_cast<int>(0x80550C03u);
+constexpr int Matching2InvalidArgument = static_cast<int>(0x80550C0Au);
+constexpr int TrophyInvalidArgument = static_cast<int>(0x80551604u);
+constexpr int TrophyInvalidTrophyId = static_cast<int>(0x8055160au);
+constexpr int TrophyInvalidGroupId = static_cast<int>(0x8055160bu);
+constexpr int TrophyNotRegistered = static_cast<int>(0x8055160fu);
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "NpPs4Imports: %s\n", message);
+        std::abort();
+    }
+}
+
+void WriteBigEndian(std::vector<std::uint8_t>& bytes, std::size_t at, std::uint64_t value, std::size_t width) {
+    for (std::size_t index = 0; index < width; ++index) bytes[at + index] = static_cast<std::uint8_t>(value >> (8u * (width - 1u - index)));
+}
+
+void WriteTrophyPackage(const std::filesystem::path& path) {
+    const char* const names[] = {"TROPCONF.ESFM", "TROP000.PNG", "TROP001.PNG", "TROP002.PNG", "ICON0.PNG"};
+    constexpr std::size_t count = sizeof(names) / sizeof(names[0]);
+    std::vector<std::uint8_t> bytes(0x60 + count * 0x40 + count * 16, 0u);
+    WriteBigEndian(bytes, 0x00, 0xdca24d00u, 4);
+    WriteBigEndian(bytes, 0x08, bytes.size(), 8);
+    WriteBigEndian(bytes, 0x10, count, 4);
+    WriteBigEndian(bytes, 0x14, 0x40u, 4);
+    for (std::size_t index = 0; index < count; ++index) {
+        const auto entry = 0x60 + index * 0x40;
+        std::memcpy(bytes.data() + entry, names[index], std::strlen(names[index]));
+        WriteBigEndian(bytes, entry + 32, 0x60 + count * 0x40 + index * 16, 8);
+        WriteBigEndian(bytes, entry + 40, 16u, 8);
+    }
+    std::filesystem::create_directories(path.parent_path());
+    std::ofstream(path, std::ios::binary).write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+}
+
+void CheckTrophyInfo() {
+    constexpr int user = 0x10000000;
+    constexpr std::uint32_t label = 7u;
+    const std::filesystem::path package = "app0/sce_sys/trophy/trophy07.trp";
+    const std::filesystem::path state = "_trophy/trophy07.268435456";
+    std::filesystem::remove(state);
+    WriteTrophyPackage(package);
+    int context = -1;
+    int handle = -1;
+    Require(sceNpTrophyCreateContext(&context, user, label, 0u) == 0 && sceNpTrophyCreateHandle(&handle) == 0, "trophy context or handle not created");
+    GameDetails game{};
+    GameData gameData{};
+    game.size = sizeof(game);
+    gameData.size = sizeof(gameData);
+    Require(sceNpTrophyGetGameInfo(context, handle, &game, &gameData) == TrophyNotRegistered, "game info answered before registration");
+    Require(sceNpTrophyRegisterContext(context, handle, 0u) == 0, "trophy context not registered");
+    Require(sceNpTrophyGetGameInfo(context, handle, nullptr, nullptr) == TrophyInvalidArgument, "game info without outputs accepted");
+    game.size = sizeof(game) - 8u;
+    Require(sceNpTrophyGetGameInfo(context, handle, &game, nullptr) == TrophyInvalidArgument, "game details of a wrong size accepted");
+    game.size = sizeof(game);
+    std::memset(game.title, 'x', sizeof(game.title));
+    Require(sceNpTrophyGetGameInfo(context, handle, &game, &gameData) == 0, "game info refused");
+    Require(game.numTrophies == 3u && game.numGroups == 0u && game.numPlatinum + game.numGold + game.numSilver + game.numBronze == 0u && game.title[0] == '\0', "game details are not the package's three trophies with unknown grades");
+    Require(gameData.unlockedTrophies == 0u && gameData.progressPercentage == 0u, "game data reports progress before an unlock");
+    int platinum = 0;
+    Require(sceNpTrophyUnlockTrophy(context, handle, 1, &platinum) == 0, "trophy 1 not unlocked");
+    Require(sceNpTrophyGetGameInfo(context, handle, nullptr, &gameData) == 0 && gameData.unlockedTrophies == 1u && gameData.progressPercentage == 33u, "game data does not count the unlock");
+    TrophyDetails trophy{};
+    TrophyData trophyData{};
+    trophy.size = sizeof(trophy);
+    trophyData.size = sizeof(trophyData);
+    Require(sceNpTrophyGetTrophyInfo(context, handle, 1, &trophy, &trophyData) == 0, "trophy info refused");
+    Require(trophy.trophyId == 1 && trophy.trophyGrade == 0 && trophy.groupId == -1 && !trophy.hidden && trophy.name[0] == '\0' && trophyData.trophyId == 1 && trophyData.unlocked, "trophy 1 info is wrong");
+    Require(sceNpTrophyGetTrophyInfo(context, handle, 0, nullptr, &trophyData) == 0 && trophyData.trophyId == 0 && !trophyData.unlocked, "trophy 0 reported unlocked");
+    Require(sceNpTrophyGetTrophyInfo(context, handle, 3, &trophy, &trophyData) == TrophyInvalidTrophyId, "a trophy past the package accepted");
+    GroupDetails group{};
+    GroupData groupData{};
+    group.size = sizeof(group);
+    groupData.size = sizeof(groupData);
+    Require(sceNpTrophyGetGroupInfo(context, handle, -1, &group, &groupData) == 0, "base game group refused");
+    Require(group.groupId == -1 && group.numTrophies == 3u && groupData.groupId == -1 && groupData.unlockedTrophies == 1u && groupData.progressPercentage == 33u, "base game group info is wrong");
+    Require(sceNpTrophyGetGroupInfo(context, handle, 0, &group, &groupData) == TrophyInvalidGroupId, "a group the package does not have accepted");
+    std::filesystem::remove(state);
+    std::filesystem::remove(package);
+    std::error_code ignored;
+    for (auto directory = package.parent_path(); !directory.empty(); directory = directory.parent_path()) std::filesystem::remove(directory, ignored);
+    std::filesystem::remove(state.parent_path(), ignored);
+}
+
+void CheckMatching2() {
+    unsigned char param[0x30]{};
+    const auto setSize = [&](std::uint64_t size) { std::memcpy(param + 0x20, &size, sizeof(size)); };
+    Require(sceNpMatching2Terminate() == Matching2NotInitialized, "NpMatching2 terminated before initialization");
+    Require(sceNpMatching2Initialize(nullptr) == Matching2InvalidArgument, "a null NpMatching2 parameter was accepted");
+    setSize(0x20u);
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == Matching2InvalidArgument, "an NpMatching2 parameter of size 0x20 was accepted");
+    setSize(0x28u);
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == 0, "an NpMatching2 parameter of size 0x28 was refused");
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == Matching2AlreadyInitialized, "NpMatching2 initialized twice");
+    Require(sceNpMatching2Terminate() == 0, "NpMatching2 did not terminate");
+    setSize(0x30u);
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == 0, "an NpMatching2 parameter with an SSL pool was refused");
+    Require(sceNpMatching2Terminate() == 0, "NpMatching2 did not terminate after the SSL form");
+}
+
+}
+
+int main() {
+    CheckTrophyInfo();
+    CheckMatching2();
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpReachability.cpp b/core/libs/tests/GuestNpReachability.cpp
index e6995ac80d..1c16e32fe7 100644
--- a/core/libs/tests/GuestNpReachability.cpp
+++ b/core/libs/tests/GuestNpReachability.cpp
@@ -1,14 +1,7 @@
+#include "prx/libSceNpManager/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceNpRegisterNpReachabilityStateCallback(void*, void*);
-int APS5_VABI sceNpUnregisterNpReachabilityStateCallback();
-int APS5_VABI sceNpGetNpReachabilityState(int, uint32_t*);
-int APS5_VABI sceNpCheckCallback();
-int APS5_VABI sceNpCheckNpAvailability(int, const NpOnlineId*, std::uint8_t*);
-}
-
 static constexpr int ErrorArgument = static_cast<int>(0x80550003);
 static constexpr int ErrorAlreadyRegistered = static_cast<int>(0x80550008);
 static constexpr int ErrorNotRegistered = static_cast<int>(0x80550009);
diff --git a/core/libs/tests/GuestNpScoreOffline.cpp b/core/libs/tests/GuestNpScoreOffline.cpp
new file mode 100644
index 0000000000..15cc132c95
--- /dev/null
+++ b/core/libs/tests/GuestNpScoreOffline.cpp
@@ -0,0 +1,200 @@
+#include "prx/libSceNpScoreRanking/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+
+namespace {
+
+constexpr int SignedOut = static_cast<int>(0x80550006u);
+constexpr int InvalidArgument = static_cast<int>(0x80550704u);
+constexpr int TooManyObjects = static_cast<int>(0x80550706u);
+constexpr int Aborted = static_cast<int>(0x80550707u);
+constexpr int InsufficientArgument = static_cast<int>(0x8055070Cu);
+constexpr int InvalidId = static_cast<int>(0x8055070Eu);
+constexpr int InvalidAlignment = static_cast<int>(0x80550714u);
+constexpr int TooManyNpId = static_cast<int>(0x80550719u);
+constexpr int PollFinished = 0;
+constexpr int PollRunning = 1;
+
+int failures = 0;
+int context = 0;
+unsigned char selfNpId[36];
+unsigned char npIds[2 * 36];
+unsigned char ranks[2 * 0x88];
+unsigned char comments[2 * 64];
+unsigned char infos[2 * 200];
+unsigned char board[24];
+unsigned char manyNpIds[101 * 36];
+unsigned char manyRanks[101 * 0x88];
+
+void Require(bool value, const char* name, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s: %s\n", name, what);
+    ++failures;
+}
+
+int NewRequest() {
+    return sceNpScoreCreateRequest(context);
+}
+
+bool Untouched() {
+    for (const unsigned char value : ranks) if (value != 0xA5) return false;
+    for (const unsigned char value : comments) if (value != 0xA5) return false;
+    for (const unsigned char value : infos) if (value != 0xA5) return false;
+    for (const unsigned char value : board) if (value != 0xA5) return false;
+    return true;
+}
+
+void CheckOffline(const char* name, int status, int req) {
+    Require(status == SignedOut, name, "valid arguments did not return SIGNED_OUT");
+    int result = 0;
+    Require(sceNpScorePollAsync(req, &result) == PollFinished && result == SignedOut, name, "the request did not finish with SIGNED_OUT");
+}
+
+void CheckContexts() {
+    Require(sceNpScoreCreateNpTitleCtx(0xFFFFFFFFu, nullptr) == InvalidArgument, "sceNpScoreCreateNpTitleCtx", "the invalid service label was not refused before the null NpId");
+    Require(sceNpScoreCreateNpTitleCtx(0, nullptr) == InsufficientArgument, "sceNpScoreCreateNpTitleCtx", "a null NpId was taken");
+    context = sceNpScoreCreateNpTitleCtx(0, selfNpId);
+    Require(context == 1, "sceNpScoreCreateNpTitleCtx", "the first context is not id 1");
+    Require(sceNpScoreCreateRequest(context + 100) == InvalidId, "sceNpScoreCreateRequest", "an unknown context was taken");
+    int extra[31];
+    for (int& entry : extra) entry = sceNpScoreCreateNpTitleCtx(1, selfNpId);
+    Require(extra[30] == 32, "sceNpScoreCreateNpTitleCtx", "32 contexts could not be created");
+    Require(sceNpScoreCreateNpTitleCtx(1, selfNpId) == TooManyObjects, "sceNpScoreCreateNpTitleCtx", "a 33rd context did not return TOO_MANY_OBJECTS");
+    const int kept = sceNpScoreCreateRequest(extra[0]);
+    Require(kept == 1, "sceNpScoreCreateRequest", "the first request is not id 1");
+    for (const int entry : extra) Require(sceNpScoreDeleteNpTitleCtx(entry) == 0, "sceNpScoreDeleteNpTitleCtx", "deleting a context failed");
+    Require(sceNpScoreDeleteRequest(kept) == InvalidId, "sceNpScoreDeleteNpTitleCtx", "a request of a deleted context was kept");
+    Require(sceNpScoreDeleteNpTitleCtx(extra[0]) == InvalidId, "sceNpScoreDeleteNpTitleCtx", "a deleted context was found");
+    int requests[32];
+    for (int& entry : requests) entry = NewRequest();
+    Require(requests[31] > 0, "sceNpScoreCreateRequest", "32 requests could not be created");
+    Require(NewRequest() == TooManyObjects, "sceNpScoreCreateRequest", "a 33rd request did not return TOO_MANY_OBJECTS");
+    for (const int entry : requests) sceNpScoreDeleteRequest(entry);
+    Require(sceNpScoreDeleteRequest(requests[0]) == InvalidId, "sceNpScoreDeleteRequest", "a deleted request was found");
+}
+
+void CheckRequests() {
+    int req = NewRequest();
+    int result = 7;
+    Require(sceNpScorePollAsync(req + 100, &result) == InvalidId, "sceNpScorePollAsync", "an unknown request was taken");
+    Require(sceNpScorePollAsync(req, &result) == PollRunning && result == 7, "sceNpScorePollAsync", "an unstarted request was not running");
+    Require(sceNpScoreAbortRequest(req + 100) == InvalidId, "sceNpScoreAbortRequest", "an unknown request was taken");
+    Require(sceNpScoreAbortRequest(req) == 0, "sceNpScoreAbortRequest", "aborting failed");
+    Require(sceNpScorePollAsync(req, nullptr) == PollFinished, "sceNpScorePollAsync", "a null result was not accepted");
+    Require(sceNpScorePollAsync(req, &result) == PollFinished && result == Aborted, "sceNpScoreAbortRequest", "an aborted request did not finish with ABORTED");
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == Aborted, "sceNpScoreRecordScore", "an aborted request did not return ABORTED");
+    sceNpScoreDeleteRequest(req);
+
+    req = NewRequest();
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreRecordScore", "the first call did not return SIGNED_OUT");
+    Require(sceNpScoreAbortRequest(req) == 0, "sceNpScoreAbortRequest", "aborting a finished request failed");
+    Require(sceNpScorePollAsync(req, &result) == PollFinished && result == SignedOut, "sceNpScoreAbortRequest", "aborting a finished request changed its result");
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreRecordScore", "a finished request was not reused");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckRecord() {
+    NpScoreGameInfo info{};
+    std::uint32_t tmpRank = 77;
+    const int req = NewRequest();
+    info.infoSize = 190;
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, &info, &tmpRank, nullptr, &info) == InvalidArgument, "sceNpScoreRecordScore", "an option was taken");
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidArgument, "sceNpScoreRecordScore", "190 bytes of game info were taken");
+    Require(sceNpScoreRecordScoreAsync(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidArgument, "sceNpScoreRecordScoreAsync", "190 bytes of game info were taken");
+    info.infoSize = 189;
+    Require(sceNpScoreRecordScore(req + 100, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidId, "sceNpScoreRecordScore", "an unknown request was taken");
+    Require(sceNpScorePollAsync(req, nullptr) == PollRunning, "sceNpScoreRecordScore", "a refused call finished the request");
+    CheckOffline("sceNpScoreRecordScoreAsync", sceNpScoreRecordScoreAsync(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr), req);
+    Require(tmpRank == 77, "sceNpScoreRecordScoreAsync", "a rank was written");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckRange() {
+    const int req = NewRequest();
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, board) == InvalidArgument, "sceNpScoreGetRankingByRange", "an option was taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 101 * 0x80, nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRange", "101 ranks were taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 0, nullptr, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRange", "rank 0 was not refused before the null array");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, nullptr, 3, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByRange", "a null rank array was not refused before its size");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByRange", "zero ranks were taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "a rank array size other than 0x80 per rank was taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 64, nullptr, 0, 2, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "a comment array size other than 64 per rank was taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 128, infos, 200, 2, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "an info array size other than 200 per rank was taken");
+    Require(sceNpScoreGetRankingByRange(req + 100, 1, 1, ranks, 0x100, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr) == InvalidId, "sceNpScoreGetRankingByRange", "an unknown request was taken");
+    CheckOffline("sceNpScoreGetRankingByRange", sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr), req);
+    Require(sceNpScoreGetRankingByRangeAsync(req, 1, 1, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByRangeAsync", "valid arguments did not return SIGNED_OUT");
+    Require(sceNpScoreGetRankingByRangeAsync(req, 1, 0, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRangeAsync", "rank 0 was taken");
+    Require(sceNpScoreGetRankingByRangeAsync(req, 1, 1, manyRanks, 100 * 0x80, nullptr, 0, nullptr, 0, 100, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByRangeAsync", "100 ranks did not return SIGNED_OUT");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckNpId() {
+    const int req = NewRequest();
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, board) == InvalidArgument, "sceNpScoreGetRankingByNpId", "an option was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, nullptr, 0, nullptr, 0, nullptr, 0, nullptr, 0, 102, nullptr, nullptr, nullptr) == TooManyNpId, "sceNpScoreGetRankingByNpId", "102 NpIds were not refused before the null arrays");
+    Require(sceNpScoreGetRankingByNpId(req, 1, nullptr, 36, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByNpId", "a null NpId array was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, nullptr, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByNpId", "a null rank array was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 24, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "an NpId array size other than 36 per NpId was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "a rank array size other than 0x88 per NpId was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x88, comments, 128, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "a comment array size other than 64 per NpId was taken");
+    CheckOffline("sceNpScoreGetRankingByNpId", sceNpScoreGetRankingByNpId(req, 1, npIds, 72, ranks, 0x110, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr), req);
+    Require(sceNpScoreGetRankingByNpIdAsync(req, 1, npIds, 0, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByNpIdAsync", "zero NpIds did not return SIGNED_OUT");
+    Require(sceNpScoreGetRankingByNpIdAsync(req, 1, manyNpIds, sizeof(manyNpIds), manyRanks, sizeof(manyRanks), nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByNpIdAsync", "101 NpIds did not return SIGNED_OUT");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckFriends() {
+    const int req = NewRequest();
+    const std::uint32_t zero = 0;
+    const std::uint32_t five = 5;
+    const NpScoreFriendRankingOption shortOption{16, nullptr, nullptr};
+    const NpScoreFriendRankingOption rankZero{24, &zero, nullptr};
+    const NpScoreFriendRankingOption rankFive{24, &five, nullptr};
+    Require(sceNpScoreGetFriendsRanking(req, 1, 0, nullptr, 0x80, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, &shortOption) == InvalidArgument, "sceNpScoreGetFriendsRanking", "a null rank array was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 0, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &shortOption) == InvalidAlignment, "sceNpScoreGetFriendsRanking", "the rank array size was not checked before the option");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 0, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &rankFive) == InvalidArgument, "sceNpScoreGetFriendsRanking", "an option without includeSelf was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &shortOption) == InvalidArgument, "sceNpScoreGetFriendsRanking", "an option size other than 24 was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &rankZero) == InvalidArgument, "sceNpScoreGetFriendsRanking", "start rank 0 was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 101 * 0x80, nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetFriendsRanking", "101 friends were taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetFriendsRanking", "zero friends were taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, infos, 400, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetFriendsRanking", "an info array size other than 200 per friend was taken");
+    CheckOffline("sceNpScoreGetFriendsRanking", sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, comments, 64, infos, 200, 1, nullptr, nullptr, &rankFive), req);
+    Require(sceNpScoreGetFriendsRankingAsync(req, 1, 0, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetFriendsRankingAsync", "valid arguments did not return SIGNED_OUT");
+    Require(sceNpScoreGetFriendsRankingAsync(req, 1, 0, manyRanks, 100 * 0x80, nullptr, 0, nullptr, 0, 100, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetFriendsRankingAsync", "100 friends did not return SIGNED_OUT");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckBoard() {
+    const int req = NewRequest();
+    Require(sceNpScoreGetBoardInfo(req, 1, board, board) == InvalidArgument, "sceNpScoreGetBoardInfo", "an option was taken");
+    Require(sceNpScoreGetBoardInfo(req + 100, 1, board, nullptr) == InvalidId, "sceNpScoreGetBoardInfo", "an unknown request was taken");
+    CheckOffline("sceNpScoreGetBoardInfo", sceNpScoreGetBoardInfo(req, 1, board, nullptr), req);
+    sceNpScoreDeleteRequest(req);
+
+}
+
+}
+
+int main() {
+    std::memset(ranks, 0xA5, sizeof(ranks));
+    std::memset(comments, 0xA5, sizeof(comments));
+    std::memset(infos, 0xA5, sizeof(infos));
+    std::memset(board, 0xA5, sizeof(board));
+    CheckContexts();
+    CheckRequests();
+    CheckRecord();
+    CheckRange();
+    CheckNpId();
+    CheckFriends();
+    CheckBoard();
+    Require(Untouched(), "libSceNpScoreRanking", "an output array was written");
+    if (failures != 0) return 1;
+    std::puts("NpScoreRanking offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpSessionSignaling.cpp b/core/libs/tests/GuestNpSessionSignaling.cpp
index 74240e67b1..1818d3df1b 100644
--- a/core/libs/tests/GuestNpSessionSignaling.cpp
+++ b/core/libs/tests/GuestNpSessionSignaling.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSessionSignaling/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,24 +6,6 @@
 #include <cstring>
 #include <array>
 
-extern "C" {
-int APS5_VABI sceNpSessionSignalingInitialize(void* param);
-int APS5_VABI sceNpSessionSignalingCreateContext(const void* param, std::uint32_t* contextId);
-int APS5_VABI sceNpSessionSignalingCreateContext2(const void* param, std::uint32_t* contextId);
-int APS5_VABI sceNpSessionSignalingDestroyContext(std::uint32_t contextId);
-int APS5_VABI sceNpSessionSignalingDeactivate(std::uint32_t contextId, std::uint32_t connectionId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetLocalNetInfo(std::int32_t contextId, void* info);
-int APS5_VABI sceNpSessionSignalingRequestPrepare(std::uint32_t contextId, std::uint32_t* requestId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetConnectionStatus(std::int32_t contextId, std::int32_t connectionId, std::int32_t* status, void* peerAddress, std::uint16_t* peerPort);
-std::int32_t APS5_VABI sceNpSessionSignalingGetGroupInfo(std::int32_t contextId, std::int32_t groupId, void* info);
-std::int32_t APS5_VABI sceNpSessionSignalingGetGroupFromSessionId(std::int32_t contextId, const void* sessionId, std::int32_t* groupId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress(std::int32_t contextId, std::uint32_t address, std::uint16_t port, std::int32_t* connectionId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress2(std::int32_t contextId, std::int32_t groupId, std::uint32_t address, std::uint16_t port, std::int32_t* connectionId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetConnectionFromPeerAddress(std::int32_t contextId, const void* peerAddress, std::int32_t* connectionId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetConnectionFromPeerAddress2(std::int32_t contextId, std::int32_t groupId, const void* peerAddress, std::int32_t* connectionId);
-int APS5_VABI sceNpSessionSignalingTerminate(void);
-}
-
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80553303u);
@@ -49,10 +32,10 @@ int main() {
     Require(sceNpSessionSignalingCreateContext2(nullptr, nullptr) == NotInitialized, "initialization check precedes context arguments");
     Require(sceNpSessionSignalingGetConnectionStatus(0, 0, nullptr, nullptr, nullptr) == NotInitialized, "status before initialize");
     Require(sceNpSessionSignalingInitialize(nullptr) == InvalidArgument, "null initialize parameter");
-    Require(sceNpSessionSignalingInitialize(initializeParam) == InvalidArgument, "zero pool size");
+    Require(sceNpSessionSignalingInitialize(reinterpret_cast<const SessionSignalingInitParam*>(initializeParam)) == InvalidArgument, "zero pool size");
     const std::uint64_t poolSize = 4 * 1024 * 1024;
     std::memcpy(initializeParam + 8, &poolSize, sizeof(poolSize));
-    Require(sceNpSessionSignalingInitialize(initializeParam) == 0, "initialize failed");
+    Require(sceNpSessionSignalingInitialize(reinterpret_cast<const SessionSignalingInitParam*>(initializeParam)) == 0, "initialize failed");
     Require(sceNpSessionSignalingInitialize(nullptr) == AlreadyInitialized, "initialization check precedes initialize arguments");
     alignas(8) unsigned char contextParam[56] = {};
     std::uint32_t contextId = 0;
@@ -60,24 +43,24 @@ int main() {
     Require(contextId == 0, "invalid context parameter wrote an id");
     Require(sceNpSessionSignalingCreateContext2(nullptr, &contextId) == InvalidArgument, "null context2 parameter");
     Require(contextId == 0, "invalid context2 parameter wrote an id");
-    Require(sceNpSessionSignalingCreateContext(contextParam, nullptr) == InvalidArgument, "null context id");
-    Require(sceNpSessionSignalingCreateContext2(contextParam, nullptr) == InvalidArgument, "null context2 id");
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == 0, "context creation failed");
+    Require(sceNpSessionSignalingCreateContext(reinterpret_cast<const SessionSignalingContextParam1*>(contextParam), nullptr) == InvalidArgument, "null context id");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), nullptr) == InvalidArgument, "null context2 id");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == 0, "context creation failed");
     const auto firstId = contextId;
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == ContextLimit, "duplicate user context");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == ContextLimit, "duplicate user context");
     Require(contextId == firstId, "duplicate context modified output");
     std::array<std::uint32_t, 9> otherContexts{};
     for (std::int32_t userId = 1; userId <= 9; ++userId) {
         std::memcpy(contextParam, &userId, sizeof(userId));
-        Require(sceNpSessionSignalingCreateContext2(contextParam, &otherContexts[userId - 1]) == 0, "create remaining contexts");
+        Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &otherContexts[userId - 1]) == 0, "create remaining contexts");
     }
     const std::int32_t overflowUser = 10;
     std::memcpy(contextParam, &overflowUser, sizeof(overflowUser));
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == ContextLimit, "context limit");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == ContextLimit, "context limit");
     Require(contextId == firstId, "context limit modified output");
     Require(sceNpSessionSignalingDestroyContext(firstId) == 0, "destroy first context");
     Require(sceNpSessionSignalingDestroyContext(firstId) == ContextNotFound, "destroy stale context");
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == 0, "reuse context slot");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == 0, "reuse context slot");
     Require(contextId != firstId, "reused context kept stale id");
 
     std::uint32_t requestId = 0xa5a5a5a5u;
@@ -93,7 +76,7 @@ int main() {
     unsigned char untouched[sizeof(info)];
     std::memcpy(untouched, info, sizeof(info));
     Require(sceNpSessionSignalingGetLocalNetInfo(netContextId, nullptr) == InvalidArgument, "null info");
-    Require(sceNpSessionSignalingGetLocalNetInfo(netContextId, info) == Unavailable, "local net info without network");
+    Require(sceNpSessionSignalingGetLocalNetInfo(netContextId, reinterpret_cast<SessionSignalingLocalNetInfo*>(info)) == Unavailable, "local net info without network");
     Require(std::memcmp(info, untouched, sizeof(info)) == 0, "failed query modified the info");
 
     std::int32_t status = 0x5a5a5a5a;
@@ -108,30 +91,30 @@ int main() {
     Require(sceNpSessionSignalingDeactivate(contextId, 1) == GroupNotFound, "deactivate nonexistent group");
 
     Require(sceNpSessionSignalingGetGroupInfo(netContextId, 1, nullptr) == InvalidArgument, "null group info");
-    Require(sceNpSessionSignalingGetGroupInfo(netContextId, 1, info) == GroupNotFound, "group info without a session");
+    Require(sceNpSessionSignalingGetGroupInfo(netContextId, 1, reinterpret_cast<SessionSignalingGroupInfo*>(info)) == GroupNotFound, "group info without a session");
     Require(std::memcmp(info, untouched, sizeof(info)) == 0, "failed group query modified the info");
 
     const unsigned char sessionId[48] = {};
     const unsigned char peer[40] = {};
     std::int32_t found = 0x5a5a5a5a;
-    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, nullptr, &found) == InvalidArgument, "null session id");
-    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, sessionId, nullptr) == InvalidArgument, "null group id");
-    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, sessionId, &found) == GroupNotFound, "group from session id without a session");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, nullptr, reinterpret_cast<std::uint32_t*>(&found)) == InvalidArgument, "null session id");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, reinterpret_cast<const char*>(sessionId), nullptr) == InvalidArgument, "null group id");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, reinterpret_cast<const char*>(sessionId), reinterpret_cast<std::uint32_t*>(&found)) == GroupNotFound, "group from session id without a session");
     Require(sceNpSessionSignalingGetConnectionFromNetAddress(netContextId, 0x0100007fu, 3658, nullptr) == InvalidArgument, "null connection id from net address");
-    Require(sceNpSessionSignalingGetConnectionFromNetAddress(netContextId, 0x0100007fu, 3658, &found) == ConnectionNotFound, "connection from net address without a session");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress(netContextId, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == ConnectionNotFound, "connection from net address without a session");
     Require(sceNpSessionSignalingGetConnectionFromNetAddress2(netContextId, 1, 0x0100007fu, 3658, nullptr) == InvalidArgument, "null connection id from group net address");
-    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(netContextId, 1, 0x0100007fu, 3658, &found) == GroupNotFound, "connection from group net address without a session");
-    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, nullptr, &found) == InvalidArgument, "null peer address");
-    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, peer, nullptr) == InvalidArgument, "null connection id from peer address");
-    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, peer, &found) == ConnectionNotFound, "connection from peer address without a session");
-    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, nullptr, &found) == InvalidArgument, "null group peer address");
-    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, peer, nullptr) == InvalidArgument, "null connection id from group peer address");
-    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, peer, &found) == GroupNotFound, "connection from group peer address without a session");
-    Require(sceNpSessionSignalingGetGroupInfo(firstId, 1, info) == ContextNotFound, "group info stale context");
-    Require(sceNpSessionSignalingGetGroupFromSessionId(firstId, sessionId, &found) == ContextNotFound, "group from session id stale context");
-    Require(sceNpSessionSignalingGetConnectionFromNetAddress(firstId, 0x0100007fu, 3658, &found) == ContextNotFound, "connection from net address stale context");
-    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(firstId, 1, 0x0100007fu, 3658, &found) == ContextNotFound, "connection from group net address stale context");
-    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(firstId, peer, &found) == ContextNotFound, "connection from peer address stale context");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(netContextId, 1, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == GroupNotFound, "connection from group net address without a session");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, nullptr, reinterpret_cast<std::uint32_t*>(&found)) == InvalidArgument, "null peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), nullptr) == InvalidArgument, "null connection id from peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), reinterpret_cast<std::uint32_t*>(&found)) == ConnectionNotFound, "connection from peer address without a session");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, nullptr, reinterpret_cast<std::uint32_t*>(&found)) == InvalidArgument, "null group peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), nullptr) == InvalidArgument, "null connection id from group peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), reinterpret_cast<std::uint32_t*>(&found)) == GroupNotFound, "connection from group peer address without a session");
+    Require(sceNpSessionSignalingGetGroupInfo(firstId, 1, reinterpret_cast<SessionSignalingGroupInfo*>(info)) == ContextNotFound, "group info stale context");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(firstId, reinterpret_cast<const char*>(sessionId), reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "group from session id stale context");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress(firstId, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "connection from net address stale context");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(firstId, 1, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "connection from group net address stale context");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(firstId, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "connection from peer address stale context");
     Require(found == 0x5a5a5a5a, "a failed lookup wrote an id");
 
     Require(sceNpSessionSignalingTerminate() == 0, "terminate failed");
@@ -142,7 +125,7 @@ int main() {
     Require(sceNpSessionSignalingGetConnectionFromNetAddress2(netContextId, 1, 0, 0, nullptr) == NotInitialized, "connection from group net address after terminate");
     Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, nullptr, nullptr) == NotInitialized, "connection from peer address after terminate");
     Require(sceNpSessionSignalingTerminate() == NotInitialized, "repeated terminate");
-    Require(sceNpSessionSignalingInitialize(initializeParam) == 0, "reinitialize");
+    Require(sceNpSessionSignalingInitialize(reinterpret_cast<const SessionSignalingInitParam*>(initializeParam)) == 0, "reinitialize");
     Require(sceNpSessionSignalingRequestPrepare(contextId, &requestId) == ContextNotFound, "reinitialize retained a context");
     Require(sceNpSessionSignalingTerminate() == 0, "final terminate");
 }
diff --git a/core/libs/tests/GuestNpSignalingOffline.cpp b/core/libs/tests/GuestNpSignalingOffline.cpp
index dd246473a7..f457b0aeae 100644
--- a/core/libs/tests/GuestNpSignalingOffline.cpp
+++ b/core/libs/tests/GuestNpSignalingOffline.cpp
@@ -1,19 +1,9 @@
+#include "prx/libSceNpSignaling/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceNpSignalingInitialize(std::int64_t memorySize, int threadPriority, int cpuAffinityMask, std::int64_t threadStackSize);
-int APS5_VABI sceNpSignalingTerminate();
-int APS5_VABI sceNpSignalingCreateContext(const void* npId, void* callback, void* callbackArg, int* outContextId);
-int APS5_VABI sceNpSignalingDeleteContext(int ctxId);
-int APS5_VABI sceNpSignalingSetContextOption(int ctxId, int optionId, int optionValue);
-int APS5_VABI sceNpSignalingActivateConnection(int ctxId, const void* peerNpId, int* outConnId);
-int APS5_VABI sceNpSignalingTerminateConnection(int ctxId, int connId);
-int APS5_VABI sceNpSignalingGetConnectionInfo(int ctxId, int connId, int infoCode, void* outInfo);
-}
-
 namespace {
 
 constexpr int SignedOut = static_cast<int>(0x80550006u);
@@ -71,6 +61,7 @@ int main() {
     Require(sceNpSignalingSetContextOption(1, 1, 1) == NotInitialized, "sceNpSignalingSetContextOption", "a call before initialization did not return NOT_INITIALIZED");
     Require(sceNpSignalingActivateConnection(1, nullptr, nullptr) == NotInitialized, "sceNpSignalingActivateConnection", "a call before initialization did not return NOT_INITIALIZED first");
     Require(sceNpSignalingTerminateConnection(1, 1) == NotInitialized, "sceNpSignalingTerminateConnection", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpSignalingDeactivateConnection(1, 1) == NotInitialized, "sceNpSignalingDeactivateConnection", "a call before initialization did not return NOT_INITIALIZED");
     Require(sceNpSignalingGetConnectionInfo(1, 1, 1, nullptr) == NotInitialized, "sceNpSignalingGetConnectionInfo", "a call before initialization did not return NOT_INITIALIZED first");
     Require(sceNpSignalingTerminate() == NotInitialized, "sceNpSignalingTerminate", "terminating before initialization did not return NOT_INITIALIZED");
 
@@ -114,6 +105,8 @@ int main() {
 
     Require(sceNpSignalingTerminateConnection(99, 1) == CtxNotFound, "sceNpSignalingTerminateConnection", "an unknown context was taken");
     Require(sceNpSignalingTerminateConnection(context, 1) == ConnNotFound, "sceNpSignalingTerminateConnection", "a connection that was never created was found");
+    Require(sceNpSignalingDeactivateConnection(99, 1) == CtxNotFound, "sceNpSignalingDeactivateConnection", "an unknown context was taken");
+    Require(sceNpSignalingDeactivateConnection(context, 1) == ConnNotFound, "sceNpSignalingDeactivateConnection", "a connection that was never created was found");
     Require(sceNpSignalingGetConnectionInfo(99, 1, 1, nullptr) == InvalidArgument, "sceNpSignalingGetConnectionInfo", "a null output was not refused before the context");
     Require(sceNpSignalingGetConnectionInfo(99, 1, 1, info) == CtxNotFound, "sceNpSignalingGetConnectionInfo", "an unknown context was taken");
     Require(sceNpSignalingGetConnectionInfo(context, 1, 1, info) == ConnNotFound, "sceNpSignalingGetConnectionInfo", "a connection that was never created was found");
diff --git a/core/libs/tests/GuestNpSnsFacebookDialog.cpp b/core/libs/tests/GuestNpSnsFacebookDialog.cpp
index 2b78b0007c..347a2dcfe3 100644
--- a/core/libs/tests/GuestNpSnsFacebookDialog.cpp
+++ b/core/libs/tests/GuestNpSnsFacebookDialog.cpp
@@ -1,17 +1,8 @@
+#include "prx/libSceNpSnsFacebookDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceNpSnsFacebookDialogInitialize(void);
-int APS5_VABI sceNpSnsFacebookDialogOpen(const void* param);
-int APS5_VABI sceNpSnsFacebookDialogUpdateStatus(void);
-int APS5_VABI sceNpSnsFacebookDialogGetStatus(void);
-int APS5_VABI sceNpSnsFacebookDialogGetResult(void* result);
-int APS5_VABI sceNpSnsFacebookDialogClose(void);
-int APS5_VABI sceNpSnsFacebookDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestNpTrophy.cpp b/core/libs/tests/GuestNpTrophy.cpp
index e8a9b8749f..768dd77112 100644
--- a/core/libs/tests/GuestNpTrophy.cpp
+++ b/core/libs/tests/GuestNpTrophy.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -9,22 +10,12 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceNpTrophyCreateContext(int* context, int userId, std::uint32_t serviceLabel, std::uint64_t options);
-int APS5_VABI sceNpTrophyDestroyContext(int context);
-int APS5_VABI sceNpTrophyCreateHandle(int* handle);
-int APS5_VABI sceNpTrophyDestroyHandle(int handle);
-int APS5_VABI sceNpTrophyRegisterContext(int context, int handle, std::uint64_t options);
-int APS5_VABI sceNpTrophyGetTrophyUnlockState(int context, int handle, std::uint32_t* flags, std::uint32_t* count);
-int APS5_VABI sceNpTrophyUnlockTrophy(int context, int handle, int trophyId, int* platinumId);
-int APS5_VABI sceNpTrophyGetGameIcon(int context, int handle, void* buffer, std::uint64_t* size);
-int APS5_VABI sceNpTrophyGetTrophyIcon(int context, int handle, int trophyId, void* buffer, std::uint64_t* size);
-}
-
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80551604u);
 constexpr int InsufficientBuffer = static_cast<int>(0x80551605u);
+constexpr int Abort = static_cast<int>(0x80551607u);
+constexpr int InvalidHandle = static_cast<int>(0x80551608u);
 constexpr int InvalidContext = static_cast<int>(0x80551609u);
 constexpr int InvalidTrophyId = static_cast<int>(0x8055160au);
 constexpr int AlreadyUnlocked = static_cast<int>(0x8055160cu);
@@ -78,10 +69,10 @@ int main() {
     Require(sceNpTrophyCreateHandle(&handle) == 0, "create the handle");
 
     std::uint32_t flags[4] = {}, count = 0;
-    Require(sceNpTrophyGetTrophyUnlockState(context, handle, flags, &count) == NotRegistered, "state before registration");
+    Require(sceNpTrophyGetTrophyUnlockState(context, handle, reinterpret_cast<TrophyFlagArray*>(flags), &count) == NotRegistered, "state before registration");
     Require(sceNpTrophyRegisterContext(context, handle, 0) == 0, "register the context");
     Require(sceNpTrophyRegisterContext(context, handle, 0) == AlreadyRegistered, "register twice");
-    Require(sceNpTrophyGetTrophyUnlockState(context, handle, flags, &count) == 0 && count == 2 && flags[0] == 0, "two trophies, none unlocked");
+    Require(sceNpTrophyGetTrophyUnlockState(context, handle, reinterpret_cast<TrophyFlagArray*>(flags), &count) == 0 && count == 2 && flags[0] == 0, "two trophies, none unlocked");
 
     std::uint64_t size = 0;
     Require(sceNpTrophyGetGameIcon(context, handle, nullptr, &size) == 0 && size == 9, "game icon size");
@@ -96,7 +87,7 @@ int main() {
     Require(sceNpTrophyUnlockTrophy(context, handle, 2, &platinum) == InvalidTrophyId, "unlock a trophy past the count");
     Require(sceNpTrophyUnlockTrophy(context, handle, 1, &platinum) == 0 && platinum == -1, "unlock trophy 1");
     Require(sceNpTrophyUnlockTrophy(context, handle, 1, &platinum) == AlreadyUnlocked, "unlock trophy 1 twice");
-    Require(sceNpTrophyGetTrophyUnlockState(context, handle, flags, &count) == 0 && flags[0] == 2u, "trophy 1 unlocked");
+    Require(sceNpTrophyGetTrophyUnlockState(context, handle, reinterpret_cast<TrophyFlagArray*>(flags), &count) == 0 && flags[0] == 2u, "trophy 1 unlocked");
     size = sizeof(icon);
     Require(sceNpTrophyGetTrophyIcon(context, handle, 1, icon, &size) == 0 && size == 6 && std::memcmp(icon, "second", 6) == 0, "icon of the unlocked trophy");
     int saved = -1;
@@ -108,8 +99,27 @@ int main() {
 
     Require(sceNpTrophyCreateContext(&missing, 1, 1, 0) == 0, "context for a label without a package");
     Require(sceNpTrophyRegisterContext(missing, handle, 0) == TitleConfNotInstalled, "register without a trophy package");
+    Require(sceNpTrophyCreateHandle(nullptr) == InvalidArgument, "null handle creation");
+    Require(sceNpTrophyCreateContext(nullptr, 1, 0, 0) == InvalidArgument, "null context creation");
+    Require(sceNpTrophyGetGameIcon(context, handle, icon, nullptr) == InvalidArgument, "null game icon size pointer");
+    Require(sceNpTrophyGetGroupIcon(context, handle, 0, icon, nullptr) == InvalidArgument, "null group icon size pointer");
+    Require(sceNpTrophyGetTrophyIcon(context, handle, 0, icon, nullptr) == InvalidArgument, "null trophy icon size pointer");
+    Require(sceNpTrophyDestroyHandle(-1) == InvalidHandle, "invalid handle destruction");
     Require(sceNpTrophyDestroyContext(missing) == 0, "destroy the second context");
+    int live = 0;
+    Require(sceNpTrophyCreateHandle(&live) == 0, "second handle");
+    Require(sceNpTrophyAbortHandle(handle) == 0, "abort a live handle");
+    size = sizeof(icon);
+    Require(sceNpTrophyGetTrophyUnlockState(context, handle, reinterpret_cast<TrophyFlagArray*>(flags), &count) == Abort, "unlock state through an aborted handle");
+    Require(sceNpTrophyGetGameIcon(context, handle, icon, &size) == Abort, "game icon through an aborted handle");
+    Require(sceNpTrophyUnlockTrophy(context, handle, 0, &platinum) == Abort, "unlock through an aborted handle");
+    Require(sceNpTrophyRegisterContext(context, handle, 0) == Abort, "register through an aborted handle");
+    Require(sceNpTrophyAbortHandle(handle) == 0, "abort the handle again");
+    Require(sceNpTrophyGetTrophyUnlockState(context, live, reinterpret_cast<TrophyFlagArray*>(flags), &count) == 0, "the other handle still works");
+    Require(sceNpTrophyDestroyHandle(live) == 0, "destroy the second handle");
+    Require(sceNpTrophyAbortHandle(999) == InvalidHandle && sceNpTrophyAbortHandle(-1) == InvalidHandle, "abort an unknown handle");
     Require(sceNpTrophyDestroyHandle(handle) == 0 && sceNpTrophyDestroyContext(context) == 0, "destroy the handle and context");
+    Require(sceNpTrophyAbortHandle(handle) == InvalidHandle, "abort a destroyed handle");
     Require(sceNpTrophyDestroyContext(context) == InvalidContext, "destroy the context twice");
 
     std::filesystem::current_path(root.parent_path());
diff --git a/core/libs/tests/GuestNpTrophy2.cpp b/core/libs/tests/GuestNpTrophy2.cpp
index 165d4347f1..2dcaa5f409 100644
--- a/core/libs/tests/GuestNpTrophy2.cpp
+++ b/core/libs/tests/GuestNpTrophy2.cpp
@@ -1,17 +1,11 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libSceNpTrophy2/include/NpTrophy2Constants.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
+#include <cstddef>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpTrophy2RegisterUnlockCallback(void*, void*);
-int APS5_VABI sceNpTrophy2UnregisterUnlockCallback();
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetGroupInfo(int, int, int, NpTrophy2GroupDetails*, NpTrophy2GroupData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-int APS5_VABI sceNpTrophy2ShowTrophyList(int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void APS5_VABI OnUnlock(int, int, void*) {}
@@ -57,4 +51,8 @@ int main() {
     Require(sceNpTrophy2GetTrophyInfo(1, 1, 3, nullptr, &trophyData) == 0);
     Require(trophyData.trophy_id == 3);
     Require(ThrowsInvalidArgument([] { sceNpTrophy2GetTrophyInfo(1, 1, 3, nullptr, nullptr); }));
+    std::size_t iconSize = 1234;
+    Require(sceNpTrophy2GetRewardIcon(1, 1, 1, nullptr, &iconSize) == SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND);
+    Require(iconSize == 0);
+    Require(sceNpTrophy2GetRewardIcon(1, 1, 1, nullptr, nullptr) == SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND);
 }
diff --git a/core/libs/tests/GuestNpTrophyData.cpp b/core/libs/tests/GuestNpTrophyData.cpp
index 8bf4e7ad00..6810f8a3da 100644
--- a/core/libs/tests/GuestNpTrophyData.cpp
+++ b/core/libs/tests/GuestNpTrophyData.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
@@ -18,24 +20,6 @@
 struct NpUniversalDataSystemEvent;
 struct NpUniversalDataSystemEventPropertyObject;
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemRegisterContext(int, int, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateHandle(int*);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetGroupInfo(int, int, int, NpTrophy2GroupDetails*, NpTrophy2GroupData*);
-int APS5_VABI sceNpTrophy2GetGroupInfoArray(int, int, uint32_t, uint32_t, NpTrophy2GroupDetails*, NpTrophy2GroupData*, uint32_t*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-int APS5_VABI sceNpTrophy2GetTrophyInfoArray(int, int, uint32_t, uint32_t, NpTrophy2Details*, NpTrophy2Data*, uint32_t*);
-}
-
 static constexpr int InitialUser = 0x10000000;
 static constexpr int InvalidTrophyId = static_cast<int>(0x8055390Au);
 
diff --git a/core/libs/tests/GuestNpTrophyStats.cpp b/core/libs/tests/GuestNpTrophyStats.cpp
index a8e94f7516..35511ae5b6 100644
--- a/core/libs/tests/GuestNpTrophyStats.cpp
+++ b/core/libs/tests/GuestNpTrophyStats.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
@@ -21,26 +23,6 @@
 struct NpUniversalDataSystemEvent;
 struct NpUniversalDataSystemEventPropertyObject;
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemRegisterContext(int, int, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateHandle(int*);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt32(NpUniversalDataSystemEventPropertyObject*, const char*, uint32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt64(NpUniversalDataSystemEventPropertyObject*, const char*, int64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt64(NpUniversalDataSystemEventPropertyObject*, const char*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat32(NpUniversalDataSystemEventPropertyObject*, const char*, float);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetObject(NpUniversalDataSystemEventPropertyObject*, const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-}
-
 static constexpr int InitialUser = 0x10000000;
 
 static const char TropConf[] = R"({"defaultLanguage":"en-US","trophies":[
@@ -63,6 +45,20 @@ static const char StatsDefinition[] = R"({"statDefinitionArray":[
     {"statId":10,"dataType":"uint64","aggregation":"latest"},{"statId":20,"dataType":"uint64","aggregation":"latest"},
     {"statId":30,"dataType":"uint32","aggregation":"latest"},{"statId":40,"dataType":"uint32","aggregation":"latest"}]})";
 
+static const char ProgressConf[] = R"({"defaultLanguage":"en-US","trophies":[
+    {"id":"0","grade":"P"},
+    {"id":"1","grade":"B","platinumTrophyId":"0","unlockCondition":{"udsStatId":"112","comparator":"ge","targetValue":"10","progressive":true}},
+    {"id":"2","grade":"B","platinumTrophyId":"0","unlockCondition":{"udsStatId":"113","comparator":"ge","targetValue":"3","progressive":true}}
+]})";
+
+static const char ProgressDefinition[] = R"({"statDefinitionArray":[
+    {"statId":112,"dataType":"int32","aggregation":"max","minValue":"0","initialValue":"0"},
+    {"statId":113,"dataType":"int32","aggregation":"max","minValue":"0","initialValue":"0"}]})";
+
+static const char ProgressExtraction[] = R"({"statsExtractionRuleArray":[
+    {"condition":{"eventName":"_UpdateTrophyProgress","property":{"path":"$._trophy_id","comparator":"==","value":"1"}},"action":{"input":"$._trophy_progress","output":{"statId":112}}},
+    {"condition":{"eventName":"_UpdateTrophyProgress","property":{"path":"$._trophy_id","comparator":"==","value":"2"}},"action":{"input":"$._trophy_progress","output":{"statId":113}}}]})";
+
 static const char SumDefinition[] = R"({"statDefinitionArray":[{"statId":10,"dataType":"uint64","aggregation":"sum"}]})";
 
 static const char StatsExtraction[] = R"({"statsExtractionRuleArray":[
@@ -165,13 +161,13 @@ private:
     int saved = -1;
 };
 
-struct Uds {
+struct UdsSession {
     int context = 0;
     int handle = 0;
 };
 
-static Uds OpenUds(std::uint32_t serviceLabel) {
-    Uds uds;
+static UdsSession OpenUds(std::uint32_t serviceLabel) {
+    UdsSession uds;
     Require(sceNpUniversalDataSystemCreateContext(&uds.context, InitialUser, serviceLabel, 0) == 0, "UDS context was not created");
     Require(sceNpUniversalDataSystemCreateHandle(&uds.handle) == 0, "UDS handle was not created");
     Require(sceNpUniversalDataSystemRegisterContext(uds.context, uds.handle, 0) == 0, "UDS context was not registered");
@@ -179,7 +175,7 @@ static Uds OpenUds(std::uint32_t serviceLabel) {
 }
 
 template <typename TSet>
-static void Post(const Uds& uds, const char* name, TSet set) {
+static void Post(const UdsSession& uds, const char* name, TSet set) {
     NpUniversalDataSystemEventPropertyObject* properties = nullptr;
     Require(sceNpUniversalDataSystemCreateEventPropertyObject(&properties) == 0, "property object was not created");
     set(properties);
@@ -326,11 +322,36 @@ static void IgnoreOtherAggregations(Unlocks& unlocks) {
         Require(sceNpUniversalDataSystemEventPropertyObjectSetUInt32(properties, "counter", 10) == 0, "counter was not set");
     });
     const auto log = capture.Finish();
-    Require(log.find("[trophy] /app0/sce_sys/uds/uds05.ucp: stat 10 has aggregation \"sum\"; only \"latest\" is supported") != std::string::npos,
+    Require(log.find("[trophy] /app0/sce_sys/uds/uds05.ucp: stat 10 has aggregation \"sum\"; only \"latest\" and \"max\" are supported") != std::string::npos,
             "a stat with a sum aggregation was not reported");
     Require(!Trophy(context, 1).unlocked && !Exists("_trophy/268435456_5.stats.txt") && unlocks.trophies.size() == 6, "a stat with a sum aggregation was stored or unlocked a trophy");
 }
 
+static void RecordTrophyProgress(Unlocks& unlocks) {
+    const auto context = TrophyContext(6);
+    const auto uds = OpenUds(6);
+    const auto progress = [&uds](std::int32_t trophy, std::int32_t value) {
+        Post(uds, "_UpdateTrophyProgress", [trophy, value](NpUniversalDataSystemEventPropertyObject* properties) {
+            Require(sceNpUniversalDataSystemEventPropertyObjectSetInt32(properties, "_trophy_id", trophy) == 0, "_trophy_id was not set");
+            Require(sceNpUniversalDataSystemEventPropertyObjectSetInt32(properties, "_trophy_progress", value) == 0, "_trophy_progress was not set");
+        });
+    };
+    progress(1, 4);
+    const auto partway = Trophy(context, 1);
+    Require(!partway.unlocked && partway.progress.type == 1 && partway.progress.value == 4 && Trophy(context, 2).progress.value == 0, "trophy progress was not recorded for its own trophy");
+    progress(1, 2);
+    Require(Trophy(context, 1).progress.value == 4, "lower trophy progress replaced higher progress");
+    progress(2, 3);
+    Require(Trophy(context, 2).unlocked && !Trophy(context, 1).unlocked && !Trophy(context, 0).unlocked, "trophy progress at its target did not unlock only that trophy");
+    progress(1, 12);
+    const auto done = Trophy(context, 1);
+    Require(done.unlocked && done.progress.value == 10 && Trophy(context, 0).unlocked, "trophy progress past its target did not unlock the trophy and the platinum");
+    Require(Read("_trophy/268435456_6.stats.txt") == "112 12\n113 3\n", "trophy progress was not stored");
+    const std::vector<std::pair<std::uint32_t, std::int32_t>> expected{{6, 2}, {6, 1}, {6, 0}};
+    Require(unlocks.trophies.size() == 9 && std::vector<std::pair<std::uint32_t, std::int32_t>>(unlocks.trophies.end() - 3, unlocks.trophies.end()) == expected,
+            "the listener did not see the progress unlocks and the platinum once, in order");
+}
+
 int main() {
     const auto previous = std::filesystem::current_path();
     const auto root = std::filesystem::temp_directory_path() / ("anyps5-trophy-stats-" + std::to_string(std::random_device{}()));
@@ -347,6 +368,8 @@ int main() {
     Write("app0/sce_sys/uds/uds03.ucp", rules.substr(0, rules.size() - 1));
     Write("app0/sce_sys/trophy2/trophy05.ucp", trophies);
     Write("app0/sce_sys/uds/uds05.ucp", Ucp({{"stats_definition.json", SumDefinition}, {"stats_extraction.json", StatsExtraction}}));
+    Write("app0/sce_sys/trophy2/trophy06.ucp", Ucp({{"tropconf.json", ProgressConf}, {"tropmeta_en-US.json", TropMeta}}));
+    Write("app0/sce_sys/uds/uds06.ucp", Ucp({{"stats_definition.json", ProgressDefinition}, {"stats_extraction.json", ProgressExtraction}}));
     Write("_trophy/268435456_0.stats.txt", "40 2\n");
 
     Unlocks unlocks;
@@ -356,6 +379,7 @@ int main() {
     UnlockThroughStats(context, unlocks);
     IgnoreMissingAndMalformedFiles(unlocks);
     IgnoreOtherAggregations(unlocks);
+    RecordTrophyProgress(unlocks);
     NpTrophy2RemoveUnlockListener_nid_no_patch(listener);
 
     std::filesystem::current_path(previous);
diff --git a/core/libs/tests/GuestNpTrophyUnlocks.cpp b/core/libs/tests/GuestNpTrophyUnlocks.cpp
index be3d6e2859..ba632255da 100644
--- a/core/libs/tests/GuestNpTrophyUnlocks.cpp
+++ b/core/libs/tests/GuestNpTrophyUnlocks.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 
@@ -12,21 +14,6 @@
 struct NpUniversalDataSystemEvent;
 struct NpUniversalDataSystemEventPropertyObject;
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemRegisterContext(int, int, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateHandle(int*);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-}
-
 static constexpr int InitialUser = 0x10000000;
 
 static void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestNpTus.cpp b/core/libs/tests/GuestNpTus.cpp
index d252efcfaa..b80d87fa8b 100644
--- a/core/libs/tests/GuestNpTus.cpp
+++ b/core/libs/tests/GuestNpTus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTus/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <array>
@@ -5,39 +6,6 @@
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceNpTusCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId);
-int APS5_VABI sceNpTusDeleteNpTitleCtx(int titleCtxId);
-int APS5_VABI sceNpTssCreateNpTitleCtx(std::uint32_t serviceLabel, const NpId* npId);
-int APS5_VABI sceNpTssCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId);
-int APS5_VABI sceNpTusCreateRequest(int titleCtxId);
-int APS5_VABI sceNpTusDeleteRequest(int reqId);
-int APS5_VABI sceNpTusAbortRequest(int reqId);
-int APS5_VABI sceNpTusPollAsync(int reqId, int* result);
-int APS5_VABI sceNpTusGetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusWaitAsync(int reqId, int* result);
-int APS5_VABI sceNpTusGetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
-}
-
 static constexpr int SIGNED_OUT = static_cast<int>(0x80550006);
 static constexpr int INVALID_ARGUMENT = static_cast<int>(0x80550704);
 static constexpr int TOO_MANY_OBJECTS = static_cast<int>(0x80550706);
diff --git a/core/libs/tests/GuestNpTusOffline.cpp b/core/libs/tests/GuestNpTusOffline.cpp
index af24d244c8..d4157cb607 100644
--- a/core/libs/tests/GuestNpTusOffline.cpp
+++ b/core/libs/tests/GuestNpTusOffline.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTus/libSceNpTus.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,95 +6,6 @@
 #include <cstring>
 #include <functional>
 
-extern "C" {
-int APS5_VABI sceNpTusCreateNpTitleCtxA(std::uint32_t, int);
-int APS5_VABI sceNpTusCreateRequest(int);
-int APS5_VABI sceNpTusDeleteRequest(int);
-int APS5_VABI sceNpTusWaitAsync(int, int*);
-int APS5_VABI sceNpTssGetSmallStorage(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
-int APS5_VABI sceNpTssGetSmallStorageAsync(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
-int APS5_VABI sceNpTusAddAndGetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotData(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotDataA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotDataAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotDataAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetFriendsDataStatus(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetFriendsDataStatusAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetFriendsVariable(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetFriendsVariableAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatus(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatus(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariable(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusTryAndSetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-}
-
 namespace {
 
 constexpr int SignedOut = static_cast<int>(0x80550006u);
@@ -112,6 +24,7 @@ NpOnlineId emptyUser{};
 unsigned char npIds[2][64];
 std::uint64_t accounts[2] = {1, 2};
 std::int32_t slots[2] = {1, 2};
+std::int64_t variables[2] = {5, 6};
 std::int32_t manySlots[65] = {};
 std::uint64_t length = 0;
 int failures = 0;
@@ -137,11 +50,13 @@ void CheckAsync(const char* name, const std::function<int(int)>& valid, const st
     int result = 0;
     Require(sceNpTusWaitAsync(req, &result) == 0 && result == SignedOut, name, "the request did not finish signed out");
     sceNpTusDeleteRequest(req);
+
     Require(unknownRequest() == InvalidId, name, "an unknown request was not refused with INVALID_ID");
     if (withOption) {
         req = NewRequest();
         Require(withOption(req) == InvalidArgument, name, "a non-null option was not refused with INVALID_ARGUMENT");
         sceNpTusDeleteRequest(req);
+
     }
 }
 
@@ -149,6 +64,7 @@ void CheckSync(const char* name, const std::function<int(int)>& call) {
     const int req = NewRequest();
     Require(call(req) == SignedOut, name, "the synchronous call did not return SIGNED_OUT");
     sceNpTusDeleteRequest(req);
+
 }
 
 }
@@ -213,9 +129,11 @@ int main() {
     CheckSync("sceNpTusAddAndGetVariableVUser", [&](int req) { return sceNpTusAddAndGetVariableVUser(req, &virtualUser, 1, 5, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusDeleteMultiSlotData", [&](int req) { return sceNpTusDeleteMultiSlotData(req, &npId, slots, 2, nullptr); });
     CheckSync("sceNpTusDeleteMultiSlotDataA", [&](int req) { return sceNpTusDeleteMultiSlotDataA(req, 1, slots, 2, nullptr); });
+    CheckSync("sceNpTusGetData", [&](int req) { return sceNpTusGetData(req, &npId, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetDataA", [&](int req) { return sceNpTusGetDataA(req, 1, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetDataAVUser", [&](int req) { return sceNpTusGetDataAVUser(req, &virtualUser, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetDataForCrossSave", [&](int req) { return sceNpTusGetDataForCrossSave(req, 1, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
+    CheckSync("sceNpTusGetDataVUser", [&](int req) { return sceNpTusGetDataVUser(req, &virtualUser, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetFriendsDataStatus", [&](int req) { return sceNpTusGetFriendsDataStatus(req, 1, 0, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetFriendsVariable", [&](int req) { return sceNpTusGetFriendsVariable(req, 1, 0, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiSlotDataStatus", [&](int req) { return sceNpTusGetMultiSlotDataStatus(req, &npId, slots, buffer, sizeof(buffer), 2, nullptr); });
@@ -224,6 +142,8 @@ int main() {
     CheckSync("sceNpTusGetMultiSlotDataStatusForCrossSave", [&](int req) { return sceNpTusGetMultiSlotDataStatusForCrossSave(req, 1, slots, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiSlotDataStatusForCrossSaveVUser", [&](int req) { return sceNpTusGetMultiSlotDataStatusForCrossSaveVUser(req, &virtualUser, slots, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiSlotDataStatusVUser", [&](int req) { return sceNpTusGetMultiSlotDataStatusVUser(req, &virtualUser, slots, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusGetMultiSlotVariable", [&](int req) { return sceNpTusGetMultiSlotVariable(req, &npId, slots, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusGetMultiSlotVariableVUser", [&](int req) { return sceNpTusGetMultiSlotVariableVUser(req, &virtualUser, slots, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserDataStatus", [&](int req) { return sceNpTusGetMultiUserDataStatus(req, npIds, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserDataStatusA", [&](int req) { return sceNpTusGetMultiUserDataStatusA(req, accounts, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserDataStatusAVUser", [&](int req) { return sceNpTusGetMultiUserDataStatusAVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
@@ -233,16 +153,27 @@ int main() {
     CheckSync("sceNpTusGetMultiUserVariable", [&](int req) { return sceNpTusGetMultiUserVariable(req, npIds, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableA", [&](int req) { return sceNpTusGetMultiUserVariableA(req, accounts, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableAVUser", [&](int req) { return sceNpTusGetMultiUserVariableAVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusGetMultiUserVariableForCrossSave", [&](int req) { return sceNpTusGetMultiUserVariableForCrossSave(req, accounts, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableForCrossSaveVUser", [&](int req) { return sceNpTusGetMultiUserVariableForCrossSaveVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableVUser", [&](int req) { return sceNpTusGetMultiUserVariableVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusSetData", [&](int req) { return sceNpTusSetData(req, &npId, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
     CheckSync("sceNpTusSetDataA", [&](int req) { return sceNpTusSetDataA(req, 1, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
     CheckSync("sceNpTusSetDataAVUser", [&](int req) { return sceNpTusSetDataAVUser(req, &virtualUser, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
+    CheckSync("sceNpTusSetDataVUser", [&](int req) { return sceNpTusSetDataVUser(req, &virtualUser, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
+    CheckSync("sceNpTusSetMultiSlotVariable", [&](int req) { return sceNpTusSetMultiSlotVariable(req, &npId, slots, variables, 2, nullptr); });
+    CheckSync("sceNpTusSetMultiSlotVariableVUser", [&](int req) { return sceNpTusSetMultiSlotVariableVUser(req, &virtualUser, slots, variables, 2, nullptr); });
     CheckSync("sceNpTusTryAndSetVariable", [&](int req) { return sceNpTusTryAndSetVariable(req, &npId, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableA", [&](int req) { return sceNpTusTryAndSetVariableA(req, 1, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableAVUser", [&](int req) { return sceNpTusTryAndSetVariableAVUser(req, &virtualUser, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableForCrossSave", [&](int req) { return sceNpTusTryAndSetVariableForCrossSave(req, 1, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableForCrossSaveVUser", [&](int req) { return sceNpTusTryAndSetVariableForCrossSaveVUser(req, &virtualUser, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableVUser", [&](int req) { return sceNpTusTryAndSetVariableVUser(req, &virtualUser, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
+    {
+        const int req = NewRequest();
+        Require(sceNpTusGetData(req, &npId, 1, buffer, sizeof(buffer), buffer, 16, &buffer) == InvalidArgument, "sceNpTusGetData", "an option was not refused before waiting");
+        Require(sceNpTusSetMultiSlotVariable(req, &npId, manySlots, reinterpret_cast<const std::int64_t*>(buffer), 65, nullptr) == TooManySlotId, "sceNpTusSetMultiSlotVariable", "65 slots were not refused before waiting");
+        sceNpTusDeleteRequest(req);
+    }
     {
         int req = NewRequest();
         Require(sceNpTusAddAndGetVariableVUserAsync(req, &emptyUser, 1, 5, nullptr, nullptr, buffer, sizeof(buffer), nullptr) == InvalidArgument, "sceNpTusAddAndGetVariableVUserAsync", "an empty virtual user was taken");
@@ -261,6 +192,7 @@ int main() {
         Require(sceNpTusGetFriendsVariableAsync(req, 1, 0, 5, buffer, sizeof(buffer), 2, nullptr) == InvalidArgument, "sceNpTusGetFriendsVariableAsync", "sort type 5 was taken");
         Require(sceNpTusGetFriendsVariableAsync(req, 1, 0, 1, buffer, sizeof(buffer), 101, nullptr) == TooManyNpId, "sceNpTusGetFriendsVariableAsync", "101 friends were taken");
         sceNpTusDeleteRequest(req);
+
     }
     if (failures != 0) return 1;
     std::puts("NpTus offline request tests passed");
diff --git a/core/libs/tests/GuestNpUtilityOffline.cpp b/core/libs/tests/GuestNpUtilityOffline.cpp
index 08cd2b84e2..7f92da4f61 100644
--- a/core/libs/tests/GuestNpUtilityOffline.cpp
+++ b/core/libs/tests/GuestNpUtilityOffline.cpp
@@ -1,24 +1,11 @@
+#include "prx/libSceNpUtility/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
-
-extern "C" {
-int APS5_VABI sceNpLookupCreateTitleCtx(const void* selfNpId);
-int APS5_VABI sceNpLookupDeleteTitleCtx(int titleCtxId);
-int APS5_VABI sceNpLookupCreateRequest(int titleCtxId);
-int APS5_VABI sceNpLookupDeleteRequest(int reqId);
-int APS5_VABI sceNpLookupNpId(int reqId, const NpOnlineId* onlineId, void* npId, void* option);
-int APS5_VABI sceNpWordFilterCreateTitleCtx(const void* selfNpId);
-int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId);
-int APS5_VABI sceNpWordFilterCreateRequest(int titleCtxId);
-int APS5_VABI sceNpWordFilterCreateAsyncRequest(int titleCtxId, const std::uint64_t* param);
-int APS5_VABI sceNpWordFilterDeleteRequest(int reqId);
-int APS5_VABI sceNpWordFilterAbortRequest(int reqId);
-int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result);
-int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void* option);
-int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option);
-}
+#include <atomic>
+#include <chrono>
+#include <thread>
 
 namespace {
 
@@ -29,6 +16,7 @@ constexpr int Aborted = static_cast<int>(0x80550707u);
 constexpr int InsufficientArgument = static_cast<int>(0x8055070Cu);
 constexpr int InvalidId = static_cast<int>(0x8055070Eu);
 constexpr int InvalidType = static_cast<int>(0x80550711u);
+constexpr int LookupSynchronousRequest = static_cast<int>(0x80550307u);
 constexpr int PollFinished = 0;
 constexpr int PollRunning = 1;
 constexpr int WordFilterTitleCtxBase = 0x01000000;
@@ -132,13 +120,124 @@ void CheckWordFilter() {
     Require(sceNpLookupDeleteTitleCtx(context) == InvalidId, "sceNpLookupDeleteTitleCtx", "a word filter context was found among the lookup contexts");
 }
 
+void CheckBandwidthTestInitStart() {
+    Require(sceNpBandwidthTestInitStart() == SignedOut, "sceNpBandwidthTestInitStart", "starting a test while signed out did not return SIGNED_OUT");
+    Require(sceNpBandwidthTestInitStart() == sceNpBandwidthTestInitStartDownload(nullptr), "sceNpBandwidthTestInitStart", "the answer differs from sceNpBandwidthTestInitStartDownload");
+    Require(sceNpBandwidthTestInitStart() == sceNpBandwidthTestInitStartUpload(nullptr), "sceNpBandwidthTestInitStart", "the answer differs from sceNpBandwidthTestInitStartUpload");
+}
+
+void CheckBandwidthTestShutdownWithDetailedInfo() {
+    constexpr int npInvalidArgument = static_cast<int>(0x80550003u);
+    Require(sceNpBandwidthTestShutdownWithDetailedInfo() == npInvalidArgument, "sceNpBandwidthTestShutdownWithDetailedInfo", "shutting down a test that never started did not return INVALID_ARGUMENT");
+    Require(sceNpBandwidthTestShutdownWithDetailedInfo() == sceNpBandwidthTestShutdown(0, nullptr), "sceNpBandwidthTestShutdownWithDetailedInfo", "the answer differs from sceNpBandwidthTestShutdown");
+}
+
+}
+
+int WaitInThread(const char* name, int (APS5_VABI *wait)(int, int*), int reqId, int* result, void (*finish)(int)) {
+    int status = 7;
+    std::atomic<bool> entered{false};
+    std::atomic<bool> returned{false};
+    std::thread waiter([&] {
+        entered = true;
+        status = wait(reqId, result);
+        returned = true;
+    });
+    while (!entered) std::this_thread::yield();
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    Require(!returned, name, "the wait returned before the request finished");
+    finish(reqId);
+    waiter.join();
+    return status;
+}
+
+void StartLookup(int reqId) {
+    NpOnlineId onlineId{};
+    std::strcpy(onlineId.data, "player_2");
+    sceNpLookupNpId(reqId, &onlineId, npId, nullptr);
+}
+
+void AbortLookup(int reqId) {
+    sceNpLookupAbortRequest(reqId);
+}
+
+void DeleteLookup(int reqId) {
+    sceNpLookupDeleteRequest(reqId);
+}
+
+void CheckLookupAsync() {
+    const int context = sceNpLookupCreateTitleCtx(selfNpId);
+    Require(sceNpLookupCreateAsyncRequest(context, nullptr) == InvalidArgument, "sceNpLookupCreateAsyncRequest", "a null parameter was taken");
+    Require(sceNpLookupCreateAsyncRequest(context, wrongAsyncParam) == InvalidArgument, "sceNpLookupCreateAsyncRequest", "a parameter size other than 0x18 was taken");
+    Require(sceNpLookupCreateAsyncRequest(context + 100, asyncParam) == InvalidId, "sceNpLookupCreateAsyncRequest", "an unknown context was taken");
+
+    Require(sceNpLookupSetTimeout(context, -1, 0, 0, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a negative retry count was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 0, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "settings without any effect were taken");
+    Require(sceNpLookupSetTimeout(context, 0, 999999, 0, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a resolve timeout under 1 s was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 9999999, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a connect timeout under 10 s was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 0, 9999999, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a send timeout under 10 s was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 0, 0, 9999999) == InvalidArgument, "sceNpLookupSetTimeout", "a receive timeout under 10 s was taken");
+    Require(sceNpLookupSetTimeout(context + 100, 1, 0, 0, 0, 0) == InvalidId, "sceNpLookupSetTimeout", "an unknown id was taken");
+    Require(sceNpLookupSetTimeout(context, 1, 0, 0, 0, 0) == 0, "sceNpLookupSetTimeout", "a context timeout was refused");
+
+    const int async = sceNpLookupCreateAsyncRequest(context, asyncParam);
+    Require(async > 0, "sceNpLookupCreateAsyncRequest", "creating an asynchronous request failed");
+    Require(sceNpLookupSetTimeout(async, 0, 1000000, 10000000, 10000000, 10000000) == 0, "sceNpLookupSetTimeout", "a request timeout was refused");
+    int result = 7;
+    Require(sceNpLookupPollAsync(async + 100, &result) == InvalidId, "sceNpLookupPollAsync", "an unknown request was taken");
+    Require(sceNpLookupPollAsync(async, nullptr) == InvalidArgument, "sceNpLookupPollAsync", "a null result was taken");
+    Require(sceNpLookupPollAsync(async + 100, nullptr) == InvalidArgument, "sceNpLookupPollAsync", "an unknown request was checked before a null result");
+    Require(sceNpLookupWaitAsync(async, nullptr) == InvalidArgument, "sceNpLookupWaitAsync", "a null result was taken");
+    Require(sceNpLookupPollAsync(async, &result) == PollRunning && result == 7, "sceNpLookupPollAsync", "an unstarted request was not running");
+    Require(WaitInThread("sceNpLookupWaitAsync", sceNpLookupWaitAsync, async, &result, StartLookup) == 0 && result == SignedOut, "sceNpLookupWaitAsync", "waiting did not end with SIGNED_OUT when the lookup started");
+    Require(sceNpLookupPollAsync(async, nullptr) == InvalidArgument, "sceNpLookupPollAsync", "a null result was taken on a finished request");
+    result = 7;
+    Require(sceNpLookupPollAsync(async, &result) == PollFinished && result == SignedOut, "sceNpLookupPollAsync", "the request did not finish with SIGNED_OUT");
+
+    const int sync = sceNpLookupCreateRequest(context);
+    StartLookup(sync);
+    result = 7;
+    Require(sceNpLookupWaitAsync(sync, &result) == LookupSynchronousRequest && result == 7, "sceNpLookupWaitAsync", "a synchronous request was not refused with 0x80550307");
+    Require(sceNpLookupPollAsync(sync, &result) == LookupSynchronousRequest && result == 7, "sceNpLookupPollAsync", "a synchronous request was not refused with 0x80550307");
+
+    const int aborted = sceNpLookupCreateAsyncRequest(context, asyncParam);
+    Require(sceNpLookupAbortRequest(aborted + 100) == InvalidId, "sceNpLookupAbortRequest", "an unknown request was taken");
+    Require(WaitInThread("sceNpLookupWaitAsync", sceNpLookupWaitAsync, aborted, &result, AbortLookup) == 0 && result == Aborted, "sceNpLookupAbortRequest", "waiting did not end with ABORTED");
+    Require(sceNpLookupNpId(aborted, nullptr, npId, nullptr) == InsufficientArgument, "sceNpLookupNpId", "arguments were not checked before the abort");
+
+    const int deleted = sceNpLookupCreateAsyncRequest(context, asyncParam);
+    Require(WaitInThread("sceNpLookupWaitAsync", sceNpLookupWaitAsync, deleted, &result, DeleteLookup) == InvalidId, "sceNpLookupWaitAsync", "waiting on a deleted request did not return INVALID_ID");
+    Require(sceNpLookupWaitAsync(deleted, &result) == InvalidId, "sceNpLookupWaitAsync", "an unknown request was taken");
+    sceNpLookupDeleteTitleCtx(context);
+}
+
+void CheckWordFilterAsync() {
+    const int context = sceNpWordFilterCreateTitleCtx(selfNpId);
+    Require(sceNpWordFilterSetTimeout(context, 0, 0, 0, 0, 0) == InvalidArgument, "sceNpWordFilterSetTimeout", "settings without any effect were taken");
+    Require(sceNpWordFilterSetTimeout(context, 0, 0, 0, 0, 9999999) == InvalidArgument, "sceNpWordFilterSetTimeout", "a receive timeout under 10 s was taken");
+    Require(sceNpWordFilterSetTimeout(context, 1, 0, 0, 0, 0) == 0, "sceNpWordFilterSetTimeout", "a context timeout was refused");
+    Require(sceNpWordFilterSetTimeout(1, 1, 0, 0, 0, 0) == InvalidId, "sceNpWordFilterSetTimeout", "a lookup id was taken");
+    const int sync = sceNpWordFilterCreateRequest(context);
+    const int async = sceNpWordFilterCreateAsyncRequest(context, asyncParam);
+    Require(sceNpWordFilterSetTimeout(async, 2, 1000000, 0, 0, 0) == 0, "sceNpWordFilterSetTimeout", "a request timeout was refused");
+    int result = 7;
+    Require(sceNpWordFilterWaitAsync(async, nullptr) == InvalidArgument, "sceNpWordFilterWaitAsync", "a null result was taken");
+    Require(sceNpWordFilterWaitAsync(sync, &result) == InvalidId, "sceNpWordFilterWaitAsync", "a synchronous request was taken");
+    Require(sceNpWordFilterWaitAsync(async + 100, &result) == InvalidId, "sceNpWordFilterWaitAsync", "an unknown request was taken");
+    Require(sceNpWordFilterCensorComment(async, "word", nullptr) == 0, "sceNpWordFilterCensorComment", "the asynchronous request did not start");
+    Require(sceNpWordFilterWaitAsync(async, &result) == 0 && result == SignedOut, "sceNpWordFilterWaitAsync", "the request did not finish with SIGNED_OUT");
+    sceNpWordFilterDeleteTitleCtx(context);
 }
 
 int main() {
     std::memset(selfNpId, 0, sizeof(selfNpId));
     std::strcpy(reinterpret_cast<char*>(selfNpId), "player_1");
+    CheckBandwidthTestInitStart();
+    CheckBandwidthTestShutdownWithDetailedInfo();
     CheckLookup();
     CheckWordFilter();
+    CheckLookupAsync();
+    CheckWordFilterAsync();
     if (failures != 0) return 1;
     std::puts("NpUtility offline tests passed");
     return 0;
diff --git a/core/libs/tests/GuestNpWebApi.cpp b/core/libs/tests/GuestNpWebApi.cpp
index 9281e58632..465ee0900c 100644
--- a/core/libs/tests/GuestNpWebApi.cpp
+++ b/core/libs/tests/GuestNpWebApi.cpp
@@ -1,28 +1,40 @@
+#include "ProcessParametersFixture.hpp"
+#include "prx/libSceNpWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
 #include <cstddef>
+#include <cstdint>
 #include <cstdio>
 #include <cstdlib>
-
-extern "C" {
-int APS5_VABI sceNpWebApiInitialize(int libHttpCtxId, std::size_t poolSize);
-int APS5_VABI sceNpWebApiTerminate(int libCtxId);
-int APS5_VABI sceNpWebApiCreateHandle(int libCtxId);
-int APS5_VABI sceNpWebApiDeleteHandle(int libCtxId, int handleId);
-int APS5_VABI sceNpWebApiCreatePushEventFilter(int libCtxId, const void* filterParam, std::size_t filterParamNum);
-int APS5_VABI sceNpWebApiDeletePushEventFilter(int libCtxId, int filterId);
-int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId, const char* npServiceName, unsigned npServiceLabel, const void* filterParam, std::size_t filterParamNum);
-int APS5_VABI sceNpWebApiDeleteServicePushEventFilter(int libCtxId, int filterId);
-}
+#include <cstring>
 
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80552902u);
+constexpr int InvalidLibContextId = static_cast<int>(0x80552903u);
 constexpr int LibContextNotFound = static_cast<int>(0x80552904u);
+constexpr int UserContextNotFound = static_cast<int>(0x80552905u);
+constexpr int RequestNotFound = static_cast<int>(0x80552906u);
+constexpr int NotSignedIn = static_cast<int>(0x80552907u);
+constexpr int InvalidContentParameter = static_cast<int>(0x80552908u);
+constexpr int Aborted = static_cast<int>(0x80552909u);
+constexpr int UserContextAlreadyExist = static_cast<int>(0x8055290Au);
 constexpr int PushEventFilterNotFound = static_cast<int>(0x8055290Bu);
+constexpr int PushEventCallbackNotFound = static_cast<int>(0x8055290Cu);
 constexpr int HandleNotFound = static_cast<int>(0x8055290Du);
 constexpr int ServicePushEventFilterNotFound = static_cast<int>(0x8055290Eu);
+constexpr int ServicePushEventCallbackNotFound = static_cast<int>(0x8055290Fu);
 constexpr int SignedInUserNotFound = static_cast<int>(0x80552910u);
 
+constexpr int MethodGet = 0;
+constexpr int MethodPost = 1;
+constexpr int MethodPatch = 4;
+
+alignas(16) std::array<std::byte, 0x40> process{};
+const char onlineId[20] = "player";
+const char filterParam[16] = {};
+const char body[] = "{}";
+
 void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "NpWebApi: %s\n", message);
@@ -30,9 +42,26 @@ void Require(bool condition, const char* message) {
     }
 }
 
+void APS5_VABI PushEvent() {
 }
 
-int main() {
+void* PushEventCallback() {
+    return reinterpret_cast<void*>(&PushEvent);
+}
+
+void SetSdkVersion(std::uint32_t version) {
+    std::memcpy(process.data() + 16, &version, sizeof(version));
+}
+
+void InstallProcessParameters() {
+    const std::uint64_t size = process.size();
+    const std::uint32_t magic = 0x4942524f;
+    std::memcpy(process.data(), &size, sizeof(size));
+    std::memcpy(process.data() + 8, &magic, sizeof(magic));
+    Require(ProcessParametersFixture::Install(process.data(), process.size()), "process parameters were not installed");
+}
+
+void TestLibraryContexts() {
     const int context = sceNpWebApiInitialize(1, 0x10000);
     Require(context > 0 && context <= 0x7fff, "library context id out of range");
     const int other = sceNpWebApiInitialize(1, 0x10000);
@@ -41,7 +70,6 @@ int main() {
 
     const int handle = sceNpWebApiCreateHandle(context);
     Require(handle > 0 && static_cast<unsigned>(handle) < 0xf0000000u, "handle id out of range");
-    const char filterParam[16] = {};
     Require(sceNpWebApiCreatePushEventFilter(context, nullptr, 1) == InvalidArgument, "push event filter without its parameter");
     Require(sceNpWebApiCreatePushEventFilter(context, filterParam, 0) == InvalidArgument, "push event filter with no parameters");
     const int filter = sceNpWebApiCreatePushEventFilter(context, filterParam, 1);
@@ -50,6 +78,8 @@ int main() {
     Require(sceNpWebApiCreateServicePushEventFilter(context, handle, nullptr, 0, filterParam, 1) == InvalidArgument, "service filter without a service name");
     Require(sceNpWebApiCreateServicePushEventFilter(0x7fff + 1, handle, "service", 0, filterParam, 1) == LibContextNotFound, "service filter of an unknown context");
     Require(sceNpWebApiCreateServicePushEventFilter(other, handle, "service", 0, filterParam, 1) == HandleNotFound, "service filter with another context's handle");
+    Require(sceNpWebApiCreateServicePushEventFilter(context, handle, "service", 0xffffffffu, filterParam, 1) == InvalidArgument, "service filter with the invalid service label from SDK 2.00");
+    Require(sceNpWebApiCreateServicePushEventFilter(0x7fff + 1, handle, "service", 0xffffffffu, filterParam, 1) == InvalidArgument, "the service label is checked before the library context");
     Require(sceNpWebApiCreateServicePushEventFilter(context, handle, "service", 0, filterParam, 1) == SignedInUserNotFound, "service filter without a signed-in user");
     Require(sceNpWebApiDeleteServicePushEventFilter(context, 1) == ServicePushEventFilterNotFound, "no service filter exists");
 
@@ -63,5 +93,160 @@ int main() {
     Require(sceNpWebApiTerminate(context) == LibContextNotFound, "library context terminated twice");
     Require(sceNpWebApiCreateHandle(context) == LibContextNotFound, "handle of a terminated context");
     Require(sceNpWebApiTerminate(other) == 0, "terminate the second library context");
+}
+
+void TestUserContexts() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int other = sceNpWebApiInitialize(1, 0x10000);
+    Require(context > 0 && other > 0, "library contexts for user contexts");
+    Require(sceNpWebApiTerminate(other) == 0, "terminate the unused library context");
+
+    Require(sceNpWebApiCreateContext(0x8000, onlineId) == InvalidLibContextId, "user context of a library context id above the range");
+    Require(sceNpWebApiCreateContext(0x8000, nullptr) == InvalidLibContextId, "the library context id is checked before the online id");
+    Require(sceNpWebApiCreateContext(context, nullptr) == InvalidArgument, "user context without an online id");
+    Require(sceNpWebApiCreateContext(0, onlineId) == LibContextNotFound, "user context of library context 0");
+    Require(sceNpWebApiCreateContext(other, onlineId) == LibContextNotFound, "user context of a terminated library context");
+
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0 && (user >> 16) == context && (user & 0xffff) != 0, "user context id holds its library context");
+    Require(sceNpWebApiCreateContext(context, onlineId) == UserContextAlreadyExist, "a second user context for the same user");
+
+    Require(sceNpWebApiDeleteContext(user + 1) == UserContextNotFound, "delete an unknown user context");
+    Require(sceNpWebApiDeleteContext(-1) == LibContextNotFound, "delete user context -1");
+    Require(sceNpWebApiDeleteContext((other << 16) | 1) == LibContextNotFound, "delete a user context of a terminated library context");
+    Require(sceNpWebApiDeleteContext(user) == 0, "delete the user context");
+    Require(sceNpWebApiDeleteContext(user) == UserContextNotFound, "user context deleted twice");
+
+    const int next = sceNpWebApiCreateContext(context, onlineId);
+    Require(next > 0 && next != user && (next >> 16) == context, "a new user context after the first was deleted");
+    std::int64_t request = 0;
+    Require(sceNpWebApiCreateRequest(next, "group", "/path", MethodGet, nullptr, &request) == 0, "request before termination");
+    Require(sceNpWebApiTerminate(context) == 0, "terminate a library context with a user context");
+    Require(sceNpWebApiDeleteContext(next) == LibContextNotFound, "user context of a terminated library context");
+    Require(sceNpWebApiSendRequest(request, nullptr, 0) == LibContextNotFound, "request of a terminated library context");
+}
+
+void TestRequests() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0, "user context for requests");
+
+    std::int64_t request = 0;
+    Require(sceNpWebApiCreateRequest(user, nullptr, "/path", MethodGet, nullptr, &request) == InvalidArgument, "request without an API group");
+    Require(sceNpWebApiCreateRequest(user, "group", nullptr, MethodGet, nullptr, &request) == InvalidArgument, "request without a path");
+    const NpWebApiContentParameter untyped{sizeof(body), nullptr, {}};
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPost, &untyped, &request) == InvalidContentParameter, "content without a type");
+    Require(sceNpWebApiCreateRequest(0, "group", "/path", MethodPost, &untyped, &request) == InvalidContentParameter, "content is checked before the user context");
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPatch, nullptr, &request) == InvalidArgument, "PATCH with SDK 2.50 or later");
+    Require(sceNpWebApiCreateRequest(user + 1, "group", "/path", MethodGet, nullptr, &request) == UserContextNotFound, "request of an unknown user context");
+    Require(sceNpWebApiCreateRequest(0, "group", "/path", MethodGet, nullptr, &request) == LibContextNotFound, "request of user context 0");
+    Require(sceNpWebApiCreateRequest(-1, "group", "/path", MethodGet, nullptr, &request) == LibContextNotFound, "request of user context -1");
+    Require(request == 0, "a failed request leaves the id alone");
+
+    const NpWebApiContentParameter empty{0, nullptr, {}};
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodGet, &empty, nullptr) == 0, "empty content without a type and no id output");
+    const NpWebApiContentParameter typed{sizeof(body), "application/json", {}};
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPost, &typed, &request) == 0, "create a request");
+    Require(static_cast<int>(request >> 32) == user && (request & 0xffffffff) != 0, "request id holds its user context");
+    std::int64_t second = 0;
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodGet, nullptr, &second) == 0 && second != request && static_cast<int>(second >> 32) == user, "a second request");
+
+    Require(sceNpWebApiSendRequest(request, body, sizeof(body)) == NotSignedIn, "a request cannot be sent without a signed-in user");
+    Require(sceNpWebApiSendRequest(request, body, sizeof(body)) == NotSignedIn, "a failed send can be retried");
+    Require(sceNpWebApiSendRequest(request + 0x10000, nullptr, 0) == RequestNotFound, "send an unknown request");
+    Require(sceNpWebApiSendRequest(static_cast<std::int64_t>(user + 1) << 32 | 1, nullptr, 0) == UserContextNotFound, "send a request of an unknown user context");
+    Require(sceNpWebApiSendRequest(1, nullptr, 0) == LibContextNotFound, "send a request of library context 0");
+
+    Require(sceNpWebApiAbortRequest(request + 0x10000) == RequestNotFound, "abort an unknown request");
+    Require(sceNpWebApiAbortRequest(-1) == LibContextNotFound, "abort request -1");
+    Require(sceNpWebApiDeleteRequest(-1) == LibContextNotFound, "delete request -1");
+    Require(sceNpWebApiAbortRequest(request) == 0, "abort the request");
+    Require(sceNpWebApiAbortRequest(request) == 0, "abort the request twice");
+    Require(sceNpWebApiSendRequest(request, body, sizeof(body)) == Aborted, "send an aborted request");
+    Require(sceNpWebApiSendRequest(second, nullptr, 0) == NotSignedIn, "aborting one request leaves the other");
+
+    Require(sceNpWebApiDeleteRequest(request) == 0, "delete the request");
+    Require(sceNpWebApiDeleteRequest(request) == RequestNotFound, "request deleted twice");
+    Require(sceNpWebApiSendRequest(request, nullptr, 0) == RequestNotFound, "send a deleted request");
+    Require(sceNpWebApiDeleteContext(user) == 0, "delete the user context with a request");
+    Require(sceNpWebApiSendRequest(second, nullptr, 0) == UserContextNotFound, "request of a deleted user context");
+    Require(sceNpWebApiDeleteRequest(second) == UserContextNotFound, "delete a request of a deleted user context");
+    Require(sceNpWebApiTerminate(context) == 0, "terminate the request library context");
+}
+
+void TestPushEventCallbacks() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int other = sceNpWebApiInitialize(1, 0x10000);
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0, "user context for callbacks");
+    const int filter = sceNpWebApiCreatePushEventFilter(context, filterParam, 1);
+    const int otherFilter = sceNpWebApiCreatePushEventFilter(other, filterParam, 1);
+    Require(filter > 0 && otherFilter > 0, "push event filters for callbacks");
+    int argument = 0;
+
+    Require(sceNpWebApiRegisterPushEventCallback(user, filter, nullptr, &argument) == InvalidArgument, "push event callback without a function");
+    Require(sceNpWebApiRegisterPushEventCallback(user + 1, filter, nullptr, &argument) == InvalidArgument, "the function is checked before the user context");
+    Require(sceNpWebApiRegisterPushEventCallback(user + 1, filter, PushEventCallback(), &argument) == UserContextNotFound, "push event callback of an unknown user context");
+    Require(sceNpWebApiRegisterPushEventCallback(user, otherFilter, PushEventCallback(), &argument) == PushEventFilterNotFound, "push event callback with another context's filter");
+    const int callback = sceNpWebApiRegisterPushEventCallback(user, filter, PushEventCallback(), &argument);
+    Require(callback > 0 && static_cast<unsigned>(callback) < 0xf0000000u, "push event callback id");
+    Require(sceNpWebApiUnregisterPushEventCallback(user + 1, callback) == UserContextNotFound, "unregister through an unknown user context");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, callback) == ServicePushEventCallbackNotFound, "a push event callback is not a service callback");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, callback) == 0, "unregister the push event callback");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, callback) == PushEventCallbackNotFound, "push event callback unregistered twice");
+
+    Require(sceNpWebApiRegisterServicePushEventCallback(user, 1, nullptr, &argument) == InvalidArgument, "service callback without a function");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user + 1, 1, PushEventCallback(), &argument) == UserContextNotFound, "service callback of an unknown user context");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user, filter, PushEventCallback(), &argument) == ServicePushEventFilterNotFound, "a push event filter is not a service filter");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, 1) == ServicePushEventCallbackNotFound, "no service callback exists");
+
+    Require(sceNpWebApiTerminate(context) == 0 && sceNpWebApiTerminate(other) == 0, "terminate the callback library contexts");
+}
+
+void TestOlderSdks() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0, "user context for older SDKs");
+    int argument = 0;
+
+    SetSdkVersion(0x02000000);
+    std::int64_t request = 0;
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPatch, nullptr, &request) == 0, "PATCH before SDK 2.50");
+    Require(sceNpWebApiSendRequest(request, nullptr, 0) == NotSignedIn, "send a PATCH request");
+    Require(sceNpWebApiRegisterPushEventCallback(user, 1, nullptr, &argument) == InvalidArgument, "push event callback without a function from SDK 1.00");
+    const int callback = sceNpWebApiRegisterPushEventCallback(user, 1, PushEventCallback(), &argument);
+    Require(callback > 0, "push event callback without a filter before SDK 2.50");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, callback) == 0, "unregister the unfiltered push event callback");
+    const int service = sceNpWebApiRegisterServicePushEventCallback(user, 1, PushEventCallback(), &argument);
+    Require(service > 0 && service != callback, "service callback without a filter before SDK 2.50");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, service) == PushEventCallbackNotFound, "a service callback is not a push event callback");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, service) == 0, "unregister the service callback");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, service) == ServicePushEventCallbackNotFound, "service callback unregistered twice");
+
+    SetSdkVersion(0x01000000);
+    const int handle = sceNpWebApiCreateHandle(context);
+    Require(sceNpWebApiCreateServicePushEventFilter(context, handle, "service", 0xffffffffu, filterParam, 1) == SignedInUserNotFound, "the invalid service label is accepted before SDK 2.00");
+
+    SetSdkVersion(0x00900000);
+    const int unchecked = sceNpWebApiRegisterPushEventCallback(user, 1, nullptr, &argument);
+    Require(unchecked > 0, "push event callback without a function before SDK 1.00");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, unchecked) == 0, "unregister the push event callback without a function");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user + 1, 1, nullptr, &argument) == UserContextNotFound, "the user context is checked before the service callback function before SDK 1.00");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user, 1, nullptr, &argument) == InvalidArgument, "service callback without a function before SDK 1.00");
+
+    SetSdkVersion(0x04508001);
+    Require(sceNpWebApiTerminate(context) == 0, "terminate the older SDK library context");
+}
+
+}
+
+int main() {
+    InstallProcessParameters();
+    SetSdkVersion(0x04508001);
+    TestLibraryContexts();
+    TestUserContexts();
+    TestRequests();
+    TestPushEventCallbacks();
+    TestOlderSdks();
     return 0;
 }
diff --git a/core/libs/tests/GuestNpWebApi2.cpp b/core/libs/tests/GuestNpWebApi2.cpp
index 1adccd989d..291dfdadd8 100644
--- a/core/libs/tests/GuestNpWebApi2.cpp
+++ b/core/libs/tests/GuestNpWebApi2.cpp
@@ -1,35 +1,14 @@
+#include "prx/libSceNpWebApi2/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
+#ifdef __APPLE__
+#include <initializer_list>
+#endif
 #include <cstring>
 #include <stdexcept>
 
-struct NpWebApi2MemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-extern "C" {
-int APS5_VABI sceNpWebApi2Initialize(int, std::size_t);
-int APS5_VABI sceNpWebApi2InitializeForPresence(int, std::uint64_t);
-int APS5_VABI sceNpWebApi2IntInitialize(const NpWebApi2IntInitializeArgs*);
-int APS5_VABI sceNpWebApi2IntInitialize2(const NpWebApi2IntInitialize2Args*);
-int APS5_VABI sceNpWebApi2Terminate(int);
-int APS5_VABI sceNpWebApi2GetMemoryPoolStats(int, NpWebApi2MemoryPoolStats*);
-int APS5_VABI sceNpWebApi2PushEventCreateHandle(int);
-int APS5_VABI sceNpWebApi2PushEventAbortHandle(int, int);
-int APS5_VABI sceNpWebApi2PushEventDeleteHandle(int, int);
-int APS5_VABI sceNpWebApi2PushEventSetHandleTimeout(int, int, std::uint32_t);
-int APS5_VABI sceNpWebApi2CreateUserContext(int, int);
-int APS5_VABI sceNpWebApi2CreateRequest(int, const char*, const char*, const char*, const void*, std::int64_t*);
-int APS5_VABI sceNpWebApi2SetRequestTimeout(std::int64_t, std::uint32_t);
-int APS5_VABI sceNpWebApi2AddWebTraceTag(std::int64_t, const char*);
-int APS5_VABI sceNpWebApi2DeleteRequest(std::int64_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestOfflineImports.cpp b/core/libs/tests/GuestOfflineImports.cpp
index 351c78faa7..3dd2c7a0b7 100644
--- a/core/libs/tests/GuestOfflineImports.cpp
+++ b/core/libs/tests/GuestOfflineImports.cpp
@@ -1,3 +1,7 @@
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
+#include "prx/libSceRudp/include/Api.hpp"
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
+#include "prx/libSceHttp/include/Http.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -7,30 +11,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoRecordingGetInfo(std::int32_t info, void* data, std::size_t size);
-int APS5_VABI sceVideoRecordingSetInfo(std::int32_t info, const void* data, std::size_t size);
-int APS5_VABI sceNpEntitlementAccessAbortRequest(std::int64_t);
-int APS5_VABI sceNpEntitlementAccessDeleteRequest(std::int64_t);
-int APS5_VABI sceHttpSendRequest(int, const void*, std::size_t);
-int APS5_VABI sceNpEntitlementAccessGetEntitlementKey(
-    std::uint32_t, const NpUnifiedEntitlementLabel*, NpEntitlementAccessEntitlementKey*);
-int APS5_VABI sceNpEntitlementAccessGetGameTrialsFlag(std::uint32_t*);
-int APS5_VABI sceNpEntitlementAccessGetPftFlag(std::uint32_t*);
-int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
-int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
-int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* info);
-int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* info);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpActivate(std::int32_t, const void*, std::uint32_t);
-int APS5_VABI sceRudpGetStatus(void*, std::size_t);
-int APS5_VABI sceRudpEnd();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
@@ -63,11 +43,13 @@ int main() {
         bool deleteFailed = false;
         try {
             sceNpEntitlementAccessAbortRequest(requestId);
+
         } catch (const std::logic_error&) {
             abortFailed = true;
         }
         try {
             sceNpEntitlementAccessDeleteRequest(requestId);
+
         } catch (const std::logic_error&) {
             deleteFailed = true;
         }
diff --git a/core/libs/tests/GuestOnce.cpp b/core/libs/tests/GuestOnce.cpp
index 3e60f58ec3..be0de52b29 100644
--- a/core/libs/tests/GuestOnce.cpp
+++ b/core/libs/tests/GuestOnce.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
@@ -6,20 +9,9 @@
 #include <cstdlib>
 #include <thread>
 
-struct GuestOnce { std::int32_t state; void* mutex; };
 static_assert(sizeof(GuestOnce) == 16 && offsetof(GuestOnce, mutex) == 8);
 using Initializer = void (APS5_VABI *)();
-extern "C" {
-int APS5_VABI pthread_once_nid_postfix(GuestOnce*, Initializer);
-int APS5_VABI scePthreadOnce(std::int32_t* once, Initializer init);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-void APS5_VABI scePthreadExit(void* retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-void APS5_VABI scePthreadTestcancel();
-Pthread APS5_VABI scePthreadSelf();
-void APS5_VABI __pthread_cleanup_push_imp_nid_postfix(void (APS5_VABI* routine)(void*), void* argument, void* info);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static GuestOnce control{}, nested{}, retry{};
 static std::atomic<int> calls{0}, arrived{0};
@@ -41,12 +33,14 @@ static void APS5_VABI ExitInsideInitializer() { scePthreadExit(nullptr); }
 static void APS5_VABI CancelInsideInitializer() {
     Require(scePthreadCancel(scePthreadSelf()) == 0);
     scePthreadTestcancel();
+
 }
 static void APS5_VABI CountRetry() { ++retried; }
 static void APS5_VABI AbortCleanup(void*) { std::abort(); }
 static void APS5_VABI PushAndThrow() {
     std::uintptr_t info[8];
     __pthread_cleanup_push_imp_nid_postfix(AbortCleanup, nullptr, info);
+
     throw 7;
 }
 static GuestOnce pushed{};
diff --git a/core/libs/tests/GuestOperationMode.cpp b/core/libs/tests/GuestOperationMode.cpp
index b3fe29f518..e0f08ff13c 100644
--- a/core/libs/tests/GuestOperationMode.cpp
+++ b/core/libs/tests/GuestOperationMode.cpp
@@ -1,10 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
-extern "C" {
-void APS5_VABI sceKernelGetOperationMode(int* mode, int* submode);
-int APS5_VABI sceKernelIsTrinityMode(void);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static bool Throws(int* mode, int* submode) {
     try { sceKernelGetOperationMode(mode, submode); } catch (const std::invalid_argument&) { return true; }
@@ -13,6 +11,7 @@ static bool Throws(int* mode, int* submode) {
 int main() {
     int out[4] = {-1, -1, -1, -1};
     sceKernelGetOperationMode(&out[0], &out[2]);
+
     Require(out[0] == 2 && out[1] == -1);
     Require(out[2] == 0 && out[3] == -1);
     int value = -1;
diff --git a/core/libs/tests/GuestOpusCeltDec.cpp b/core/libs/tests/GuestOpusCeltDec.cpp
index b0dc8ae383..653acfe878 100644
--- a/core/libs/tests/GuestOpusCeltDec.cpp
+++ b/core/libs/tests/GuestOpusCeltDec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceOpusCeltDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -7,15 +8,6 @@
 #include <stdexcept>
 #include <opus.h>
 
-extern "C" {
-int APS5_VABI sceOpusCeltDecInitialize(std::uint32_t*);
-int APS5_VABI sceOpusCeltDecTerminate(const std::uint32_t*);
-int APS5_VABI sceOpusCeltDecGetSize(int);
-int APS5_VABI sceOpusCeltDecCreateEx(const std::uint32_t*, void*, int, int);
-int APS5_VABI sceOpusCeltDecDecode(void*, const std::uint8_t*, int, std::int16_t*, int);
-int APS5_VABI sceOpusCeltDecDestroy(void*);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestOpusDec.cpp b/core/libs/tests/GuestOpusDec.cpp
index 6446a6e8e3..24eddac922 100644
--- a/core/libs/tests/GuestOpusDec.cpp
+++ b/core/libs/tests/GuestOpusDec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceOpusDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -9,15 +10,6 @@
 #include <stdexcept>
 #include <opus.h>
 
-extern "C" {
-int APS5_VABI sceOpusDecInitialize(std::uint32_t*);
-int APS5_VABI sceOpusDecTerminate(const std::uint32_t*);
-int APS5_VABI sceOpusDecGetSize(int);
-int APS5_VABI sceOpusDecCreateEx(const std::uint32_t*, void*, int, int);
-int APS5_VABI sceOpusDecDecode(void*, const std::uint8_t*, int, std::int16_t*, int);
-int APS5_VABI sceOpusDecDestroy(void*);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestOpusDecVariants.cpp b/core/libs/tests/GuestOpusDecVariants.cpp
new file mode 100644
index 0000000000..497d3a1305
--- /dev/null
+++ b/core/libs/tests/GuestOpusDecVariants.cpp
@@ -0,0 +1,142 @@
+#include "prx/libSceOpusCeltDec/libSceOpusCeltDec.hpp"
+#include "prx/libSceOpusDec/libSceOpusDec.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdlib>
+#include <stdexcept>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+template <typename TFunction>
+void RequireThrows(TFunction function) {
+    try { function(); } catch (const std::runtime_error&) { return; }
+    std::abort();
+}
+
+const std::uint8_t CELT_PACKET[] = {
+    0xFC, 0xB5, 0x1F, 0xBC, 0xC8, 0xCA, 0x0B, 0xC2, 0x18, 0x1A, 0xFB, 0xDB, 0x3E, 0x2B, 0x6B, 0x0A, 0x67, 0x71, 0x25, 0x2F, 0x51, 0x57, 0x4F, 0x78,
+    0xB3, 0x1F, 0xE9, 0xF3, 0x99, 0x51, 0xE9, 0x70, 0x72, 0x23, 0x99, 0x3E, 0x26, 0xA3, 0xF1, 0x8F, 0x02, 0xB3, 0xAA, 0xBA, 0xAB, 0x7E, 0xA5, 0x6A,
+    0xBA, 0x33, 0xCA, 0xE9, 0x43, 0x4D, 0x41, 0xC9, 0x90, 0x3C, 0xD0, 0x5F, 0x55, 0xC1, 0x54, 0xA8, 0xD0, 0x6F, 0x71, 0x4F, 0xCB, 0x95, 0xDF, 0x09,
+    0xC9, 0xB6, 0xAA, 0xA1, 0x8D, 0xD4, 0x2B, 0xC0, 0xF7, 0x23, 0xDD, 0xF5, 0x54, 0xEF, 0x90, 0xC4, 0xD3, 0x47, 0xC1, 0x91, 0x2D, 0xA8, 0x3D, 0x53,
+    0xF4, 0x7D, 0xFF, 0xBD, 0x47, 0x0E, 0xD2, 0x95, 0x25, 0x42, 0x66, 0x02, 0xD7, 0x80, 0x00, 0x67, 0x59, 0x13, 0x60, 0x2F, 0x6C,
+};
+
+struct Api {
+    std::uint32_t errorBase;
+    int (APS5_VABI* initialize)(std::uint32_t*);
+    int (APS5_VABI* terminate)(const std::uint32_t*);
+    int (APS5_VABI* createEx)(const std::uint32_t*, void*, int, int);
+    int (APS5_VABI* decode)(void*, const std::uint8_t*, int, std::int16_t*, int);
+    int (APS5_VABI* decodeWithPriority)(void*, const std::uint8_t*, int, std::int16_t*, int, int);
+    int (APS5_VABI* decodeFloat)(void*, const std::uint8_t*, int, float*, int);
+    int (APS5_VABI* decodeFloatWithPriority)(void*, const std::uint8_t*, int, float*, int, int);
+    int (APS5_VABI* destroy)(void*);
+};
+
+float Converted(std::int16_t sample) { return sample > 0 ? sample / 32767.0f : sample / 32768.0f; }
+
+void RequireValidation(const Api& api) {
+    std::array<std::uint8_t, 640> invalidState{};
+    std::int16_t output = 12345;
+    float floatOutput = 2.0f;
+    const std::uint8_t packet = 0;
+    const auto error = [&](std::uint32_t offset) { return static_cast<int>(api.errorBase + offset); };
+    Require(api.decodeWithPriority(nullptr, nullptr, -1, nullptr, -1, 0) == error(0));
+    Require(api.decodeWithPriority(invalidState.data(), nullptr, -1, nullptr, -1, 0) == error(6));
+    Require(api.decodeWithPriority(invalidState.data(), &packet, -1, nullptr, -1, 0) == error(7));
+    Require(api.decodeWithPriority(invalidState.data(), &packet, 1, nullptr, -1, 0) == error(8));
+    Require(api.decodeWithPriority(invalidState.data(), &packet, 1, &output, -1, 0) == error(9));
+    for (int priority : {-1, 0, 19, 101, 255})
+        Require(api.decodeWithPriority(invalidState.data(), &packet, 1, &output, 2, priority) == error(10));
+    for (int priority : {20, 40, 100})
+        Require(api.decodeWithPriority(invalidState.data(), &packet, 1, &output, 2, priority) == error(1));
+    Require(api.decodeFloatWithPriority(nullptr, nullptr, -1, nullptr, -1, 0) == error(0));
+    Require(api.decodeFloatWithPriority(invalidState.data(), &packet, 1, &floatOutput, -1, 0) == error(9));
+    Require(api.decodeFloatWithPriority(invalidState.data(), &packet, 1, &floatOutput, 4, 19) == error(10));
+    Require(api.decodeFloatWithPriority(invalidState.data(), &packet, 1, &floatOutput, 4, 100) == error(1));
+    Require(api.decodeFloat(invalidState.data(), &packet, 1, nullptr, 4) == error(8));
+    Require(api.decodeFloat(invalidState.data(), &packet, 1, &floatOutput, 4) == error(1));
+    Require(output == 12345 && floatOutput == 2.0f);
+}
+
+void RequireDecoding(const Api& api) {
+    std::uint32_t context = 0;
+    Require(api.initialize(&context) == 0);
+    std::array<std::array<std::uint8_t, 640>, 4> states{};
+    for (auto& state : states) Require(api.createEx(&context, state.data(), 48000, 2) == 0);
+    std::array<std::int16_t, 1922> reference{}, prioritized{};
+    std::array<float, 1922> floats{}, prioritizedFloats{};
+    for (int frame = 0; frame < 3; ++frame) {
+        reference.fill(12345);
+        prioritized.fill(12345);
+        floats.fill(2.0f);
+        prioritizedFloats.fill(2.0f);
+        Require(api.decode(states[0].data(), CELT_PACKET, sizeof(CELT_PACKET), reference.data() + 1, 3840) == 3840);
+        Require(api.decodeWithPriority(states[1].data(), CELT_PACKET, sizeof(CELT_PACKET), prioritized.data() + 1, 3841, 100) == 3840);
+        Require(api.decodeFloat(states[2].data(), CELT_PACKET, sizeof(CELT_PACKET), floats.data() + 1, 7683) == 7680);
+        Require(api.decodeFloatWithPriority(states[3].data(), CELT_PACKET, sizeof(CELT_PACKET), prioritizedFloats.data() + 1, 7680, 20) == 7680);
+        Require(prioritized == reference);
+        Require(std::any_of(reference.begin() + 1, reference.end() - 1, [](auto value) { return value != 0; }));
+        Require(floats.front() == 2.0f && floats.back() == 2.0f && floats == prioritizedFloats);
+        for (std::size_t index = 1; index <= 1920; ++index) Require(floats[index] == Converted(reference[index]));
+    }
+    floats.fill(2.0f);
+    RequireThrows([&] { api.decodeFloat(states[2].data(), CELT_PACKET, sizeof(CELT_PACKET), floats.data() + 1, 7679); });
+    Require(std::all_of(floats.begin(), floats.end(), [](auto value) { return value == 2.0f; }));
+    for (auto& state : states) Require(api.destroy(state.data()) == 0);
+    Require(api.terminate(&context) == 0);
+}
+
+void RequireTimeoutVariants() {
+    std::uint32_t context = 0;
+    Require(sceOpusDecInitialize(&context) == 0);
+    std::array<std::array<std::uint8_t, 640>, 2> states{};
+    for (auto& state : states) Require(sceOpusDecCreateEx(&context, state.data(), 48000, 2) == 0);
+    std::array<std::uint8_t, 640> invalidState{};
+    std::int16_t output = 12345;
+    const std::uint8_t packet = 0;
+    std::uint32_t batch = 0xA5A5A5A5u;
+    Require(sceOpusDecDecodeWithPriorityAndTimeout(invalidState.data(), &packet, 1, &output, 2, 19, 0, &batch) == static_cast<int>(0x8174000Au));
+    Require(sceOpusDecDecodeWithPriorityAndTimeout(invalidState.data(), &packet, 1, &output, 2, 20, 0xFFFFFFFFu, &batch) == static_cast<int>(0x81740001u));
+    Require(sceOpusDecDecodeFloatWithPriorityAndTimeout(nullptr, &packet, 1, nullptr, 2, 20, 0, &batch) == static_cast<int>(0x81740000u));
+    Require(sceOpusDecDecodeFloatWithPriorityAndTimeout(invalidState.data(), &packet, -1, nullptr, 2, 20, 1000, &batch) == static_cast<int>(0x81740007u));
+    std::array<std::int16_t, 1920> reference{}, pcm{};
+    std::array<float, 1920> floats{};
+    for (int frame = 0; frame < 2; ++frame) {
+        Require(sceOpusDecDecode(states[0].data(), CELT_PACKET, sizeof(CELT_PACKET), reference.data(), 3840) == 3840);
+        Require(sceOpusDecDecodeWithPriorityAndTimeout(states[1].data(), CELT_PACKET, sizeof(CELT_PACKET), pcm.data(), 3840, 40, 0xFFFFFFFFu, &batch) == 3840);
+        Require(pcm == reference);
+    }
+    pcm.fill(12345);
+    floats.fill(2.0f);
+    for (std::uint32_t timeout : {0u, 1u, 1000u, 0xFFFFFFFEu}) {
+        RequireThrows([&] { sceOpusDecDecodeWithPriorityAndTimeout(states[1].data(), CELT_PACKET, sizeof(CELT_PACKET), pcm.data(), 3840, 40, timeout, &batch); });
+        RequireThrows([&] { sceOpusDecDecodeFloatWithPriorityAndTimeout(states[1].data(), CELT_PACKET, sizeof(CELT_PACKET), floats.data(), 7680, 40, timeout, &batch); });
+    }
+    Require(batch == 0xA5A5A5A5u);
+    Require(std::all_of(pcm.begin(), pcm.end(), [](auto value) { return value == 12345; }));
+    Require(std::all_of(floats.begin(), floats.end(), [](auto value) { return value == 2.0f; }));
+    Require(sceOpusDecDecode(states[0].data(), CELT_PACKET, sizeof(CELT_PACKET), reference.data(), 3840) == 3840);
+    Require(sceOpusDecDecodeFloatWithPriorityAndTimeout(states[1].data(), CELT_PACKET, sizeof(CELT_PACKET), floats.data(), 7680, 40, 0xFFFFFFFFu, nullptr) == 7680);
+    for (std::size_t index = 0; index < floats.size(); ++index) Require(floats[index] == Converted(reference[index]));
+    for (auto& state : states) Require(sceOpusDecDestroy(state.data()) == 0);
+    Require(sceOpusDecTerminate(&context) == 0);
+}
+
+} // namespace
+
+int main() {
+    const Api opus{0x81740000u, sceOpusDecInitialize, sceOpusDecTerminate, sceOpusDecCreateEx, sceOpusDecDecode,
+                   sceOpusDecDecodeWithPriority, sceOpusDecDecodeFloat, sceOpusDecDecodeFloatWithPriority, sceOpusDecDestroy};
+    const Api celt{0x81400000u, sceOpusCeltDecInitialize, sceOpusCeltDecTerminate, sceOpusCeltDecCreateEx, sceOpusCeltDecDecode,
+                   sceOpusCeltDecDecodeWithPriority, sceOpusCeltDecDecodeFloat, sceOpusCeltDecDecodeFloatWithPriority, sceOpusCeltDecDestroy};
+    for (const auto* api : {&opus, &celt}) {
+        RequireValidation(*api);
+        RequireDecoding(*api);
+    }
+    RequireTimeoutVariants();
+}
diff --git a/core/libs/tests/GuestOverflowError.cpp b/core/libs/tests/GuestOverflowError.cpp
index 9bfb21a082..7b7e633934 100644
--- a/core/libs/tests/GuestOverflowError.cpp
+++ b/core/libs/tests/GuestOverflowError.cpp
@@ -1,10 +1,11 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
 struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
-struct Object { const void* vtable; const char* message; };
+
 struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const void* what; };
 
 extern "C" {
@@ -12,8 +13,7 @@ extern const TypeRecord _ZTISt13runtime_error_nid_postfix;
 extern const TypeRecord _ZTISt14overflow_error_nid_postfix;
 extern const Vtable _ZTVSt13runtime_error_nid_postfix;
 extern const Vtable _ZTVSt14overflow_error_nid_postfix;
-void APS5_VABI _ZNSt13runtime_errorC1EPKc_nid_postfix(Object*, const char*);
-void APS5_VABI _ZNSt14overflow_errorD1Ev_nid_postfix(Object*);
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -27,12 +27,15 @@ int main() {
     const auto& runtimeTable = _ZTVSt13runtime_error_nid_postfix;
     Require(table.offset == 0 && table.type == &type);
     Require(table.destroy == runtimeTable.destroy && table.deleteObject == runtimeTable.deleteObject && table.what == runtimeTable.what);
-    Object object{};
+    LibcException::ExceptionObject object{};
     _ZNSt13runtime_errorC1EPKc_nid_postfix(&object, "value too large");
+
     Require(object.message != nullptr && std::strcmp(object.message, "value too large") == 0);
     _ZNSt14overflow_errorD1Ev_nid_postfix(&object);
+
     Require(object.message == nullptr);
     _ZNSt14overflow_errorD1Ev_nid_postfix(&object);
+
     Require(object.message == nullptr);
     return 0;
 }
diff --git a/core/libs/tests/GuestPad.cpp b/core/libs/tests/GuestPad.cpp
index 35abd4888c..7fbee7be4d 100644
--- a/core/libs/tests/GuestPad.cpp
+++ b/core/libs/tests/GuestPad.cpp
@@ -6,6 +6,7 @@
 #include <array>
 #include <chrono>
 #include <cstdlib>
+#include <cstdio>
 #include <cstring>
 #include <filesystem>
 #include <fstream>
@@ -13,36 +14,6 @@
 #include <thread>
 #include <utility>
 
-extern "C" {
-int APS5_VABI scePadOpen_nid_postfix(int, int, int, const void*);
-int APS5_VABI scePadOpenExt(int, int, int, const void*);
-int APS5_VABI scePadClose_nid_postfix(int);
-int APS5_VABI scePadGetHandle(int, int, int);
-int APS5_VABI scePadSetVibrationTriggerEffectWeakWhileEmbeddedMicInUse(bool);
-int APS5_VABI scePadSetVibrationMode(int, int);
-int APS5_VABI scePadInit_nid_postfix(void);
-int APS5_VABI scePadUnknown_n3kSX62fgNo();
-int APS5_VABI scePadRead_nid_postfix(int, PadData*, int);
-int APS5_VABI scePadReadState(int, PadData*);
-int APS5_VABI scePadSetTiltCorrectionState(int, bool);
-int APS5_VABI scePadResetOrientation(int);
-int APS5_VABI scePadSetAngularVelocityDeadbandState(int, bool);
-int APS5_VABI scePadSetAngularVelocityBiasCorrectionState(int, bool);
-int APS5_VABI scePadIsRemoteController(int, bool*);
-int APS5_VABI scePadGetAccessibilityControllerState(int, std::uint32_t*);
-bool APS5_VABI scePadIsDS4Connected(std::int32_t);
-bool APS5_VABI scePadIsBlasterConnected(std::int32_t);
-bool APS5_VABI scePadIsMoveConnected(std::int32_t);
-int APS5_VABI scePadGetControllerInformation(int, PadControllerInformation*);
-int APS5_VABI scePadDeviceClassParseData(int, const PadData*, PadDeviceClassData*);
-int APS5_VABI scePadDeviceClassGetExtendedInformation(int, PadDeviceClassExtendedInformation*);
-int APS5_VABI scePadSetVibration(int, const PadVibrationParam*);
-int APS5_VABI scePadGetExtControllerInformation(int, void*);
-int APS5_VABI scePadResetLightBar(int);
-int APS5_VABI scePadSetLightBar(int, const PadLightBarParam*);
-int APS5_VABI scePadSetMotionSensorState(int, bool);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckInputCommands() {
@@ -289,6 +260,7 @@ static void CheckLatchedPressLifetime(int handle) {
     std::this_thread::sleep_for(std::chrono::milliseconds(150));
     Require(scePadReadState(handle, &data) == PAD_OK);
     Require((data.buttons & cross) == 0);
+    Require(scePadReadState(handle, &data) == PAD_OK);
     pressed.buttons = cross;
     PadPublishInput_nid_postfix(pressed);
     PadPublishInput_nid_postfix(PadInputState{});
@@ -301,6 +273,41 @@ static void CheckLatchedPressLifetime(int handle) {
     Require((data.buttons & circle) != 0);
 }
 
+static void CheckLatchedPressAtSlowReads(int handle) {
+    const auto cross = static_cast<std::uint32_t>(Pad::PadButton::Cross);
+    PadInputState pressed;
+    pressed.buttons = cross;
+    PadData data{};
+    Require(scePadReadState(handle, &data) == PAD_OK);
+    std::this_thread::sleep_for(std::chrono::milliseconds(170));
+    Require(scePadReadState(handle, &data) == PAD_OK);
+    PadPublishInput_nid_postfix(pressed);
+    PadPublishInput_nid_postfix(PadInputState{});
+    std::this_thread::sleep_for(std::chrono::milliseconds(150));
+    Require(scePadReadState(handle, &data) == PAD_OK);
+    Require((data.buttons & cross) != 0);
+    PadPublishInput_nid_postfix(pressed);
+    PadPublishInput_nid_postfix(PadInputState{});
+    std::this_thread::sleep_for(std::chrono::milliseconds(400));
+    Require(scePadReadState(handle, &data) == PAD_OK);
+    Require((data.buttons & cross) == 0);
+}
+
+static void CheckLatchedPressPerPort() {
+    const auto cross = static_cast<std::uint32_t>(Pad::PadButton::Cross);
+    PadInputState pressed;
+    pressed.buttons = cross;
+    Pad::ReadState(0);
+    Pad::ReadState(1);
+    std::this_thread::sleep_for(std::chrono::milliseconds(170));
+    Pad::ReadState(0);
+    Pad::ReadState(1);
+    PadPublishInputForPort_nid_postfix(0, pressed);
+    PadPublishInputForPort_nid_postfix(0, PadInputState{});
+    std::this_thread::sleep_for(std::chrono::milliseconds(150));
+    Require((Pad::ReadState(0).buttons & cross) != 0);
+}
+
 static void CheckReadStateHandle(int handle) {
     PadData data{};
     Require(scePadReadState(0, &data) == PAD_ERROR_INVALID_HANDLE);
@@ -351,6 +358,9 @@ static void CheckSpecialPort(int user, int handle) {
     Require(extended.deviceClass == -1 && extended.reserved[0] == 0);
     Require(scePadDeviceClassGetExtendedInformation(handle, &extended) == PAD_OK);
     Require(extended.deviceClass == 0);
+    std::int32_t specialType = -1;
+    Require(scePadGetControllerType(special, &specialType) == PAD_OK);
+    Require(specialType == PAD_CONTROLLER_TYPE_UNKNOWN);
     const PadVibrationParam vibration{0, 0};
     const PadLightBarParam lightBar{0, 0, 255};
     Require(scePadSetVibration(special, nullptr) == PAD_ERROR_INVALID_ARG);
@@ -420,6 +430,40 @@ static void CheckTrackerDevices(int handle) {
     }
 }
 
+static void CheckSystemRemote(int handle) {
+    constexpr int noHandle = static_cast<int>(0x80920008);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0) == noHandle);
+    const int remote = scePadOpen_nid_postfix(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0, nullptr);
+    Require(remote > 0 && remote != handle);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0) == remote);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 1) == noHandle);
+    PadData drained[64]{};
+    scePadRead_nid_postfix(handle, drained, 64);
+    PadInputState pressed;
+    pressed.buttons = static_cast<std::uint32_t>(Pad::PadButton::Cross);
+    PadPublishInput_nid_postfix(pressed);
+    PadData data{};
+    data.buttons = ~0u;
+    data.connected = true;
+    Require(scePadReadState(remote, &data) == PAD_OK);
+    Require(data.buttons == 0 && !data.connected);
+    Require(scePadReadState(remote, nullptr) == PAD_ERROR_INVALID_ARG);
+    PadData queued[4]{};
+    queued[0].connected = true;
+    Require(scePadRead_nid_postfix(remote, queued, 4) == 1);
+    Require(queued[0].buttons == 0 && !queued[0].connected);
+    PadLightBarParam lightBar{1, 2, 3};
+    Require(scePadSetLightBar(remote, &lightBar) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadReadState(handle, &data) == PAD_OK);
+    Require((data.buttons & pressed.buttons) != 0 && data.connected);
+    PadPublishInput_nid_postfix(PadInputState{});
+    scePadRead_nid_postfix(handle, drained, 64);
+    Require(scePadClose_nid_postfix(remote) == PAD_OK);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0) == noHandle);
+    Require(scePadReadState(remote, &data) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadReadState(handle, &data) == PAD_OK);
+}
+
 static void CheckAccessibilityControllerState(int handle) {
     std::uint32_t state = 7;
     Require(scePadGetAccessibilityControllerState(handle + 1, nullptr) == PAD_ERROR_INVALID_ARG);
@@ -429,6 +473,15 @@ static void CheckAccessibilityControllerState(int handle) {
     Require(state == 0);
 }
 
+static void CheckControllerType(int handle) {
+    std::int32_t type = -1;
+    Require(scePadGetControllerType(handle + 1, nullptr) == PAD_ERROR_INVALID_ARG);
+    Require(scePadGetControllerType(handle + 1, &type) == PAD_ERROR_INVALID_HANDLE);
+    Require(type == -1);
+    Require(scePadGetControllerType(handle, &type) == PAD_OK);
+    Require(type == PAD_CONTROLLER_TYPE_DUAL_SENSE);
+}
+
 static void CheckInjectedState(const std::filesystem::path& path) {
     PadInputState physical;
     physical.buttons = 0x2000;
@@ -487,12 +540,53 @@ static void CheckInjectedState(const std::filesystem::path& path) {
     PadPublishInput_nid_postfix(PadInputState{});
 }
 
+static void CheckInjectedQueueTimes(const std::filesystem::path& path) {
+    PadData drained[64]{};
+    Pad::Read(drained, 64);
+    PadInputState physical;
+    physical.buttons = 0x2000;
+    PadPublishInput_nid_postfix(physical);
+    const auto before = Pad::ReadState();
+    std::ofstream(path) << "5 16384 300\n";
+    PadData pressed{};
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    do {
+        pressed = Pad::ReadState();
+        if ((pressed.buttons & 0x4000) != 0) break;
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    } while (std::chrono::steady_clock::now() < deadline);
+    Require(pressed.buttons == 0x6000 && pressed.timestamp > before.timestamp);
+    PadData queued{};
+    Require(Pad::Read(&queued, 1) == 1);
+    Require(queued.buttons == pressed.buttons);
+    if (queued.timestamp < pressed.timestamp) {
+        std::fputs("queued input predates its injected button press\n", stderr);
+        std::abort();
+    }
+    physical.sticks[0] = 130;
+    PadPublishInput_nid_postfix(physical);
+    std::this_thread::sleep_for(std::chrono::milliseconds(310));
+    const auto released = Pad::ReadState();
+    Require(released.buttons == 0x2000 && released.timestamp > pressed.timestamp);
+    Require(Pad::Read(&queued, 1) == 1);
+    Require(queued.buttons == released.buttons && queued.left_stick_x == 130);
+    if (queued.timestamp < released.timestamp) {
+        std::fputs("queued input predates its injected button release\n", stderr);
+        std::abort();
+    }
+    PadPublishInput_nid_postfix(PadInputState{});
+}
+
 int main() {
     CheckInputCommands();
     std::uint32_t accessibilityState = 7;
     Require(scePadGetAccessibilityControllerState(PAD_HANDLE, nullptr) == PAD_ERROR_NOT_INITIALIZED);
     Require(scePadGetAccessibilityControllerState(PAD_HANDLE, &accessibilityState) == PAD_ERROR_NOT_INITIALIZED);
     Require(accessibilityState == 7);
+    std::int32_t controllerType = -1;
+    Require(scePadGetControllerType(PAD_HANDLE, nullptr) == PAD_ERROR_NOT_INITIALIZED);
+    Require(scePadGetControllerType(PAD_HANDLE, &controllerType) == PAD_ERROR_NOT_INITIALIZED);
+    Require(controllerType == -1);
     Require(scePadUnknown_n3kSX62fgNo() == static_cast<int>(0x80920005));
     const auto path = std::filesystem::temp_directory_path() / ("anyps5-pad-state-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
     struct Cleanup {
@@ -534,7 +628,11 @@ int main() {
 
     Require(scePadGetHandle(user, 0, 0) == noHandle);
     Require(scePadOpen_nid_postfix(user, 1, 0, nullptr) == PAD_ERROR_INVALID_ARG);
-    Require(scePadOpen_nid_postfix(user, 0, 1, nullptr) == PAD_ERROR_INVALID_ARG);
+    Require(scePadOpen_nid_postfix(user, 0, 1, nullptr) == static_cast<int>(0x809b0003));
+    for (const int type : {0, 2, 3, 4}) Require(scePadOpen_nid_postfix(-1, type, 0, nullptr) == static_cast<int>(0x809b0001));
+    Require(scePadOpen_nid_postfix(-1, 0, 1, nullptr) == static_cast<int>(0x809b0001));
+    Require(scePadOpen_nid_postfix(-1, 1, 0, nullptr) == PAD_ERROR_INVALID_ARG);
+    for (const int type : {5, 6, 16, 0xff, -1}) Require(scePadOpen_nid_postfix(user, type, 0, nullptr) == PAD_ERROR_INVALID_ARG);
     Require(scePadGetHandle(user, 0, 0) == noHandle);
     const unsigned char wheel[16]{0xb7, 0x0e, 0x04, 0x0e, 0x08, 0x6e, 0x01};
     Require(scePadOpenExt(user, PAD_PORT_TYPE_SPECIAL, 0, wheel) == static_cast<int>(0x80920007));
@@ -547,7 +645,14 @@ int main() {
     Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == earlySpecial);
     Require(scePadClose_nid_postfix(earlySpecial) == PAD_OK);
     Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
+    PadSetPortConnected_nid_postfix(1, true);
     Require(scePadInit_nid_postfix() == 0);
+    PadInfo initInfo{};
+    Require(scePadGetInfo_nid_postfix(&initInfo) == PAD_OK);
+    Require(initInfo.connectedCount[0] == 2);
+    Require(initInfo.padTypeInfo[0].connectPort == 0);
+    Require(initInfo.padTypeInfo[1].connectPort == 1);
+    PadSetPortConnected_nid_postfix(1, false);
     Require(scePadUnknown_n3kSX62fgNo() == PAD_OK);
     const int handle = scePadOpen_nid_postfix(user, 0, 0, nullptr);
     Require(handle > 0);
@@ -564,11 +669,15 @@ int main() {
     CheckReadQueue(handle);
     CheckTapBetweenReads();
     CheckLatchedPressLifetime(handle);
+    CheckLatchedPressAtSlowReads(handle);
+    CheckLatchedPressPerPort();
     CheckReadStateHandle(handle);
     CheckRemoteController(handle);
     CheckTrackerDevices(handle);
     CheckAccessibilityControllerState(handle);
+    CheckControllerType(handle);
     CheckInjectedState(commandPath);
+    CheckInjectedQueueTimes(commandPath);
     PadLightBarParam lightBar{255, 128, 64};
     Require(scePadSetLightBar(handle, &lightBar) == PAD_OK);
     Require(scePadSetLightBar(handle, nullptr) == PAD_ERROR_INVALID_ARG);
@@ -585,7 +694,7 @@ int main() {
     Require(scePadSetVibrationMode(handle, 5) == 0);
     Require(scePadSetVibrationMode(handle, 6) == PAD_ERROR_INVALID_ARG);
     Require(scePadSetVibrationMode(handle, -1) == PAD_ERROR_INVALID_ARG);
-    Require(scePadGetHandle(0xff, 16, 0) == handle);
+    CheckSystemRemote(handle);
     Require(scePadGetHandle(user, 16, 0) == noHandle);
     Require(scePadGetHandle(user, 0, 1) == noHandle);
     Require(scePadClose_nid_postfix(handle) == 0);
@@ -597,4 +706,45 @@ int main() {
     Require(scePadSetAngularVelocityDeadbandState(handle + 1, true) == PAD_ERROR_INVALID_HANDLE);
     Require(scePadSetAngularVelocityBiasCorrectionState(handle, false) == PAD_OK);
     Require(scePadSetAngularVelocityBiasCorrectionState(handle + 1, false) == PAD_ERROR_INVALID_HANDLE);
+    PadInfo info{};
+    Require(scePadGetInfo_nid_postfix(&info) == PAD_OK);
+    Require(info.maxConnectCount == PAD_MAX_CONTROLLERS);
+    Require(info.connectedCount[0] == 1);
+    Require(info.padTypeInfo[0].connectPort == 0);
+
+    const int user2 = 0x10000001;
+    Require(scePadGetHandle(user2, 0, 0) == noHandle);
+    const int handle2 = scePadOpen_nid_postfix(user2, 0, 0, nullptr);
+    Require(handle2 == PAD_HANDLE_BASE + 1);
+    Require(scePadGetHandle(user2, 0, 0) == handle2);
+
+    PadInputState p2Input{};
+    p2Input.buttons = static_cast<std::uint32_t>(Pad::PadButton::Triangle);
+    PadPublishInputForPort_nid_postfix(1, p2Input);
+    PadData p2Data{};
+    Require(scePadReadState(handle2, &p2Data) == 0);
+    Require((p2Data.buttons & static_cast<std::uint32_t>(Pad::PadButton::Triangle)) != 0);
+
+    Require(scePadSetVibrationMode(handle2, 1) == 0);
+    std::uint32_t p2AccessState = 7;
+    Require(scePadGetAccessibilityControllerState(handle2, &p2AccessState) == PAD_OK);
+    Require(p2AccessState == 0);
+    std::int32_t p2Type = -1;
+    Require(scePadGetControllerType(handle2, &p2Type) == PAD_OK);
+    Require(p2Type == PAD_CONTROLLER_TYPE_DUAL_SENSE);
+
+    PadSetPortConnected_nid_postfix(1, true);
+    Require(scePadGetInfo_nid_postfix(&info) == PAD_OK);
+    Require(info.connectedCount[0] == 2);
+    Require(info.padTypeInfo[0].connectPort == 0);
+    Require(info.padTypeInfo[1].connectPort == 1);
+    PadSetPortConnected_nid_postfix(1, false);
+    Require(scePadGetInfo_nid_postfix(&info) == PAD_OK);
+    Require(info.connectedCount[0] == 1);
+    Require(info.padTypeInfo[0].connectPort == 0);
+
+    Require(scePadClose_nid_postfix(handle2) == 0);
+    Require(scePadGetHandle(user2, 0, 0) == noHandle);
+    Require(scePadSetAngularVelocityDeadbandState(handle2, false) == PAD_OK);
+    Require(scePadSetAngularVelocityDeadbandState(handle2 + 1, false) == PAD_ERROR_INVALID_HANDLE);
 }
diff --git a/core/libs/tests/GuestPadVibrationMode.cpp b/core/libs/tests/GuestPadVibrationMode.cpp
index 1d826fedb1..4b54861ff0 100644
--- a/core/libs/tests/GuestPadVibrationMode.cpp
+++ b/core/libs/tests/GuestPadVibrationMode.cpp
@@ -3,13 +3,6 @@
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI scePadInit_nid_postfix(void);
-int APS5_VABI scePadOpen_nid_postfix(int userId, int type, int index, const void* param);
-int APS5_VABI scePadClose_nid_postfix(int handle);
-int APS5_VABI scePadSetVibrationMode(int handle, int mode);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
@@ -29,5 +22,10 @@ int main() {
     Require(handle > 0);
     Require(scePadSetVibrationMode(handle, 0) == PAD_ERROR_INVALID_ARG);
     Require(scePadSetVibrationMode(handle, 1) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 2) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 3) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 4) == PAD_ERROR_INVALID_ARG);
+    Require(scePadSetVibrationMode(handle, 5) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 6) == PAD_ERROR_INVALID_ARG);
     Require(scePadClose_nid_postfix(handle) == PAD_OK);
 }
diff --git a/core/libs/tests/GuestPageTableStats.cpp b/core/libs/tests/GuestPageTableStats.cpp
index eba38dd12c..18b33b9f39 100644
--- a/core/libs/tests/GuestPageTableStats.cpp
+++ b/core/libs/tests/GuestPageTableStats.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 
@@ -7,17 +8,6 @@
 #include <cstdlib>
 #include <source_location>
 
-extern "C" {
-int APS5_VABI sceKernelGetPageTableStats(int*, int*, int*, int*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Page table stats check failed at %s:%u\n", location.file_name(), static_cast<unsigned>(location.line()));
@@ -76,7 +66,7 @@ static void CheckCpuGranules() {
     RequireTaken(before, 1, 0);
     Map(base + PageTableGranule, 0x4000, 0);
     RequireTaken(before, 2, 0);
-    Require(sceKernelMunmap(base, GpuDirectorySpan * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), GpuDirectorySpan * 2) == 0);
     RequireTaken(before, 0, 0);
 }
 
@@ -89,7 +79,7 @@ static void CheckGpuEntries() {
     RequireTaken(before, 3, 4);
     Map(base + GpuDirectorySpan, 0x4000, 0x33);
     RequireTaken(before, 4, 6);
-    Require(sceKernelMunmap(base, GpuDirectorySpan * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), GpuDirectorySpan * 2) == 0);
     RequireTaken(before, 0, 0);
 }
 
@@ -106,13 +96,26 @@ static void CheckGpuDirectMapping() {
     Require(sceKernelMapDirectMemory(&small, 0x10000, 0x33, 0x10, phys + static_cast<std::int64_t>(2 * PageTableGranule), 0x10000) == 0);
     Require(small == base + 2 * PageTableGranule + 0x10000);
     RequireTaken(before, 3, 2);
-    Require(sceKernelMunmap(base, GpuDirectorySpan * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), GpuDirectorySpan * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, 3 * PageTableGranule) == 0);
     RequireTaken(before, 0, 0);
 }
 
+static void CheckTraceMemoryStats() {
+    std::uint64_t first[2] = {0xaaaaaaaaaaaaaaaaull, 0xaaaaaaaaaaaaaaaaull};
+    std::uint64_t second[2] = {0xaaaaaaaaaaaaaaaaull, 0xaaaaaaaaaaaaaaaaull};
+    Require(sceKernelGetTraceMemoryStats(first, second) == 0);
+    Require(first[0] == 0 && first[1] == 0xaaaaaaaaaaaaaaaaull && second[0] == 0 && second[1] == 0xaaaaaaaaaaaaaaaaull);
+    first[0] = 1;
+    Require(sceKernelGetTraceMemoryStats(first, nullptr) == 0 && first[0] == 0);
+    second[0] = 1;
+    Require(sceKernelGetTraceMemoryStats(nullptr, second) == 0 && second[0] == 0);
+    Require(sceKernelGetTraceMemoryStats(nullptr, nullptr) == 0);
+}
+
 int main() {
     CheckRejectedArguments();
+    CheckTraceMemoryStats();
     CheckCpuGranules();
     CheckGpuEntries();
     CheckGpuDirectMapping();
diff --git a/core/libs/tests/GuestParentProcess.cpp b/core/libs/tests/GuestParentProcess.cpp
index 203cfe3a00..6098a0766a 100644
--- a/core/libs/tests/GuestParentProcess.cpp
+++ b/core/libs/tests/GuestParentProcess.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #ifdef _WIN32
@@ -5,12 +7,7 @@
 #else
 #include <unistd.h>
 #endif
-extern "C" {
-int APS5_VABI getpid_nid_postfix(void);
-int APS5_VABI getppid_nid_postfix(void);
-int APS5_VABI getsid_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     const int self = getpid_nid_postfix();
@@ -21,6 +18,72 @@ int main() {
     Require(*__error_nid_postfix() == 3);
     Require(getsid_nid_postfix(-1) == -1);
     Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(-1, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(-1, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(123456, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(-1, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(-1, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(123456, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
     const int parent = getppid_nid_postfix();
     Require(parent > 0 && parent != getpid_nid_postfix());
     Require(getppid_nid_postfix() == parent);
diff --git a/core/libs/tests/GuestPathCase.cpp b/core/libs/tests/GuestPathCase.cpp
index 18b87e9c6e..675bd28809 100644
--- a/core/libs/tests/GuestPathCase.cpp
+++ b/core/libs/tests/GuestPathCase.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -8,21 +10,6 @@
 #include <fstream>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-int APS5_VABI chdir_nid_postfix(const char*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI remove_nid_postfix(const char*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckRead(const std::string& path, char expected) {
diff --git a/core/libs/tests/GuestPathErrors.cpp b/core/libs/tests/GuestPathErrors.cpp
index 3da76d9739..9eb21a8c7a 100644
--- a/core/libs/tests/GuestPathErrors.cpp
+++ b/core/libs/tests/GuestPathErrors.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -12,26 +15,6 @@
 #include <string>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelUnlink(const char* path);
-int APS5_VABI sceKernelClose(int d);
-int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
-int APS5_VABI unlink_nid_postfix(const char* path);
-int APS5_VABI sceKernelStat(const char* path, FileStat* sb);
-int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
-int APS5_VABI lstat_nid_postfix(const char* path, FileStat* sb);
-int APS5_VABI sceKernelMkdir(const char* path, std::uint16_t mode);
-int APS5_VABI sceKernelRmdir(const char* path);
-int APS5_VABI mkdir_nid_postfix(const char* path, std::uint16_t mode);
-int APS5_VABI rmdir_nid_postfix(const char* path);
-int APS5_VABI sceKernelRename(const char* from, const char* to);
-int APS5_VABI rename_nid_postfix(const char* from, const char* to);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char* path, std::int64_t length);
-int APS5_VABI truncate_nid_postfix(const char* path, std::int64_t length);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value, int line) {
diff --git a/core/libs/tests/GuestPathLifetime.cpp b/core/libs/tests/GuestPathLifetime.cpp
index 44e8f59072..041de1ffb8 100644
--- a/core/libs/tests/GuestPathLifetime.cpp
+++ b/core/libs/tests/GuestPathLifetime.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include <cstdio>
@@ -9,8 +10,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-
 namespace {
 
 int events[2];
diff --git a/core/libs/tests/GuestPathNameLength.cpp b/core/libs/tests/GuestPathNameLength.cpp
index e07722661b..c6197d2e8f 100644
--- a/core/libs/tests/GuestPathNameLength.cpp
+++ b/core/libs/tests/GuestPathNameLength.cpp
@@ -1,22 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <string>
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI mkdir_nid_postfix(const char*, int);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI stat_nid_postfix(const char*, void*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI chflags_nid_postfix(const char*, std::uint64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ErrorNoEntry = 2;
@@ -32,7 +21,7 @@ bool Fails(long result, int error) { return result == -1 && *__error_nid_postfix
 
 bool TooLong(const std::string& path) {
     unsigned char status[256];
-    return Fails(stat_nid_postfix(path.c_str(), status), ErrorNameTooLong);
+    return Fails(stat_nid_postfix(path.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong);
 }
 
 }
@@ -42,11 +31,12 @@ int main() {
     const std::string longName(256, 'n');
     const std::string longPath(1100, 'p');
     const std::string maxName(255, 'm');
-    Require(Fails(stat_nid_postfix(longName.c_str(), status), ErrorNameTooLong), "stat of a name above NAME_MAX (255) must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix(longName.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a name above NAME_MAX (255) must fail with ENAMETOOLONG (63)");
     rmdir_nid_postfix("anyps5_name_length");
+
     Require(mkdir_nid_postfix("anyps5_name_length", 0755) == 0, "mkdir of the test directory failed");
-    Require(Fails(stat_nid_postfix(("anyps5_name_length/" + longName).c_str(), status), ErrorNameTooLong), "stat of a long final component below an existing directory must fail with ENAMETOOLONG (63)");
-    Require(Fails(stat_nid_postfix(("anyps5_name_length/missing/" + longName).c_str(), status), ErrorNoEntry), "stat of a long component below a missing directory must fail with ENOENT (2), the lookup stops there first");
+    Require(Fails(stat_nid_postfix(("anyps5_name_length/" + longName).c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a long final component below an existing directory must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix(("anyps5_name_length/missing/" + longName).c_str(), reinterpret_cast<FileStat*>(status)), ErrorNoEntry), "stat of a long component below a missing directory must fail with ENOENT (2), the lookup stops there first");
     const std::string below = "anyps5_name_length/";
     const std::string name255(255, 'n');
     Require(!TooLong(below + name255), "a final component of exactly 255 bytes must not be too long");
@@ -55,11 +45,13 @@ int main() {
     Require(TooLong(below + longName + "/"), "a long component followed by a trailing slash must fail with ENAMETOOLONG (63)");
     Require(!TooLong(below + std::string(200, 'n') + "\\" + std::string(100, 'n')), "a backslash separates components here, so 200 + 100 bytes around it are accepted (FreeBSD would refuse the 301-byte name)");
     const std::string block = name255 + "/";
+#ifndef __APPLE__
     Require(!TooLong(block + block + block + name255), "a path of exactly 1023 bytes must not be too long");
+#endif
     Require(TooLong(block + block + block + block), "a path of exactly 1024 bytes must fail with ENAMETOOLONG (63)");
     Require(rmdir_nid_postfix("anyps5_name_length") == 0, "rmdir of the test directory failed");
-    Require(Fails(stat_nid_postfix((longName + "/x").c_str(), status), ErrorNameTooLong), "stat of a long first component must fail with ENAMETOOLONG (63)");
-    Require(Fails(stat_nid_postfix(longPath.c_str(), status), ErrorNameTooLong), "stat of a path of 1100 bytes must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix((longName + "/x").c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a long first component must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix(longPath.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a path of 1100 bytes must fail with ENAMETOOLONG (63)");
     Require(Fails(access_nid_postfix(longName.c_str(), 0), ErrorNameTooLong), "access of a long name must fail with ENAMETOOLONG (63)");
     Require(Fails(chflags_nid_postfix(longName.c_str(), 0), ErrorNameTooLong), "chflags of a long name must fail with ENAMETOOLONG (63)");
     Require(Fails(unlink_nid_postfix(longName.c_str()), ErrorNameTooLong), "unlink of a long name must fail with ENAMETOOLONG (63)");
@@ -69,6 +61,6 @@ int main() {
     Require(Fails(rename_nid_postfix(longName.c_str(), "anyps5_name_length_target"), ErrorNameTooLong), "rename from a long name must fail with ENAMETOOLONG (63)");
     Require(Fails(rename_nid_postfix("anyps5_name_length_source", longName.c_str()), ErrorNameTooLong), "rename to a long name must fail with ENAMETOOLONG (63)");
 
-    Require(Fails(stat_nid_postfix(maxName.c_str(), status), ErrorNoEntry), "a name of exactly 255 bytes is not too long");
+    Require(Fails(stat_nid_postfix(maxName.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNoEntry), "a name of exactly 255 bytes is not too long");
     return 0;
 }
diff --git a/core/libs/tests/GuestPlayGo.cpp b/core/libs/tests/GuestPlayGo.cpp
index c03f4761ca..529e3fd923 100644
--- a/core/libs/tests/GuestPlayGo.cpp
+++ b/core/libs/tests/GuestPlayGo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayGo/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -14,20 +15,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-int APS5_VABI scePlayGoInitialize(const PlayGoInitParams*);
-int APS5_VABI scePlayGoOpen(int*, const void*);
-int APS5_VABI scePlayGoClose(int);
-int APS5_VABI scePlayGoGetLanguageMask(int, std::uint64_t*);
-int APS5_VABI scePlayGoSetLanguageMask(int, std::uint64_t);
-int APS5_VABI scePlayGoGetSupportedOptionalChunk(int, std::uint32_t, PlayGoOptionalChunk*);
-int APS5_VABI scePlayGoGetOptionalChunk(int, std::uint32_t, PlayGoOptionalChunk*);
-int APS5_VABI scePlayGoSetToDoList(int, const PlayGoToDo*, std::uint32_t);
-int APS5_VABI scePlayGoGetToDoList(int, PlayGoToDo*, std::uint32_t, std::uint32_t*);
-int APS5_VABI scePlayGoGetLocus(int, const std::uint16_t*, std::uint32_t, std::int8_t*);
-int APS5_VABI scePlayGoGetChunkId(int, std::uint16_t*, std::uint32_t, std::uint32_t*);
-}
-
 static void Require(bool value, const std::source_location location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "requirement failed at line %u\n", location.line());
@@ -73,11 +60,15 @@ static int CheckScenarioWithoutChunkTable(const char* root) {
     int handle = 0;
     Require(scePlayGoInitialize(&init) == 0);
     Require(scePlayGoOpen(&handle, nullptr) == 0);
-    const std::uint16_t anyIds[3] = {1, 10, 0xFFFF};
+    const std::uint16_t listedIds[3] = {1, 10, 999};
     std::int8_t loci[3] = {0, 0, 0};
-    Require(scePlayGoGetLocus(handle, anyIds, 3, loci) == 0 && loci[0] == 3 && loci[1] == 3 && loci[2] == 3);
-    const PlayGoToDo todo[2] = {{0, 3, 0}, {0xFFFF, 3, 0}};
+    Require(scePlayGoGetLocus(handle, listedIds, 3, loci) == 0 && loci[0] == 3 && loci[1] == 3 && loci[2] == 3);
+    const PlayGoToDo todo[2] = {{0, 3, 0}, {999, 3, 0}};
     Require(scePlayGoSetToDoList(handle, todo, 2) == 0);
+    for (const std::uint16_t unlisted : {std::uint16_t{1000}, std::uint16_t{0xFFFF}}) {
+        std::int8_t locus = 0;
+        RequireMissingChunkMetadata([&] { scePlayGoGetLocus(handle, &unlisted, 1, &locus); });
+    }
     std::uint32_t chunkCount = 0;
     Require(scePlayGoGetChunkId(handle, nullptr, 0, &chunkCount) == 0 && chunkCount == 1000);
     std::vector<std::uint16_t> ids(chunkCount + 1, 0xFFFF);
@@ -175,6 +166,7 @@ static int CheckRejectedLayout(const char* root, const char* fileName) {
     bool threw = false;
     try {
         scePlayGoGetLocus(handle, &chunk, 1, &locus);
+
     } catch (const std::runtime_error& error) {
         threw = std::string_view(error.what()).find(fileName) != std::string_view::npos;
     }
@@ -209,6 +201,27 @@ static int CheckNoPlayGoFileAnswered(const char* root, const char* answer) {
     return 0;
 }
 
+static int CheckScenarioWithoutChunkTableAnswered(const char* root, const char* answer) {
+    constexpr int badChunkId = static_cast<int>(0x80B2000C);
+    SetUnlistedChunks(answer);
+    std::filesystem::current_path(root);
+    PlayGoInitParams init{};
+    int handle = 0;
+    Require(scePlayGoInitialize(&init) == 0);
+    Require(scePlayGoOpen(&handle, nullptr) == 0);
+    const std::uint16_t unlisted[2] = {1000, 0xFFFF};
+    std::int8_t loci[2] = {0, 0};
+    const int result = scePlayGoGetLocus(handle, unlisted, 2, loci);
+    if (std::string_view(answer) == "installed") Require(result == 0 && loci[0] == 3 && loci[1] == 3);
+    else Require(result == badChunkId);
+    const std::uint16_t listed[2] = {0, 999};
+    Require(scePlayGoGetLocus(handle, listed, 2, loci) == 0 && loci[0] == 3 && loci[1] == 3);
+    std::uint32_t chunkCount = 0;
+    Require(scePlayGoGetChunkId(handle, nullptr, 0, &chunkCount) == 0 && chunkCount == 1000);
+    Require(scePlayGoClose(handle) == 0);
+    return 0;
+}
+
 static int CheckUnknownUnlistedChunkAnswer(const char* root) {
     SetUnlistedChunks("maybe");
     std::filesystem::current_path(root);
@@ -221,6 +234,7 @@ static int CheckUnknownUnlistedChunkAnswer(const char* root) {
     bool threw = false;
     try {
         scePlayGoGetLocus(handle, &unlisted, 1, &locus);
+
     } catch (const std::runtime_error& error) {
         threw = std::string_view(error.what()).find("APS5_PLAYGO_UNLISTED_CHUNKS must be installed or absent") != std::string_view::npos;
     }
@@ -260,6 +274,8 @@ int main(int argc, char** argv) {
         if (mode == "--no-file-unknown-answer") return CheckUnknownUnlistedChunkAnswer(argv[2]);
         if (mode == "--package-chunk-table" || mode == "--scenario-with-chunk-table") return CheckPackageChunkTable(argv[2]);
         if (mode == "--scenario-only") return CheckScenarioWithoutChunkTable(argv[2]);
+        if (mode == "--scenario-only-installed") return CheckScenarioWithoutChunkTableAnswered(argv[2], "installed");
+        if (mode == "--scenario-only-absent") return CheckScenarioWithoutChunkTableAnswered(argv[2], "absent");
         if (mode == "--ficm-only") return CheckRejectedLayout(argv[2], "playgo-ficm.dat");
         if (mode == "--hash-table-only") return CheckRejectedLayout(argv[2], "playgo-hash-table.dat");
         if (mode == "--invalid-chunk-table") return CheckRejectedLayout(argv[2], "playgo-chunk.dat");
@@ -271,7 +287,25 @@ int main(int argc, char** argv) {
     RunLayout(argv[0], "--package-chunk-table", {{"playgo-chunk.dat", ChunkTableFile()}});
     RunLayout(argv[0], "--package-chunk-table", {{"playgo-chunk.dat", ChunkTableFile("plgo")}});
     RunLayout(argv[0], "--scenario-with-chunk-table", {{"playgo-chunk.dat", ChunkTableFile()}, {"playgo-scenario.json", "{}"}});
+    std::int64_t eta = -1;
+    std::int32_t speed = -1;
+    PlayGoInitParams fixtureInit{};
+    int validHandle = -1;
+    Require(scePlayGoInitialize(&fixtureInit) == 0);
+    Require(scePlayGoOpen(&validHandle, nullptr) == 0);
+    constexpr int badHandleError = static_cast<int>(0x80B20009);
+    constexpr int badPointerError = static_cast<int>(0x80B2000A);
+    Require(scePlayGoGetEta(-1, nullptr, 0, &eta) == badHandleError);
+    Require(scePlayGoGetEta(validHandle, nullptr, 0, nullptr) == badPointerError);
+    Require(scePlayGoGetInstallSpeed(-1, &speed) == badHandleError);
+    Require(scePlayGoGetInstallSpeed(0x506C476F, &speed) == badHandleError && speed == -1);
+    Require(scePlayGoGetInstallSpeed(validHandle, nullptr) == badPointerError);
+    Require(scePlayGoGetInstallSpeed(validHandle, &speed) == 0 && speed == 2);
+    Require(scePlayGoPrefetch(-1, nullptr, 0, 0) == badHandleError);
+    Require(scePlayGoClose(validHandle) == 0);
     RunLayout(argv[0], "--scenario-only", {{"playgo-scenario.json", "{}"}});
+    RunLayout(argv[0], "--scenario-only-installed", {{"playgo-scenario.json", "{}"}});
+    RunLayout(argv[0], "--scenario-only-absent", {{"playgo-scenario.json", "{}"}});
     RunLayout(argv[0], "--ficm-only", {{"playgo-ficm.dat", "x"}});
     RunLayout(argv[0], "--hash-table-only", {{"playgo-hash-table.dat", "x"}});
     RunLayout(argv[0], "--invalid-chunk-table", {{"playgo-chunk.dat", "not a chunk table"}});
diff --git a/core/libs/tests/GuestPlayGoDialog.cpp b/core/libs/tests/GuestPlayGoDialog.cpp
index 0a8291f96c..e8a89d8e49 100644
--- a/core/libs/tests/GuestPlayGoDialog.cpp
+++ b/core/libs/tests/GuestPlayGoDialog.cpp
@@ -1,19 +1,10 @@
+#include "prx/libScePlayGoDialog/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI scePlayGoDialogInitialize(void);
-int APS5_VABI scePlayGoDialogTerminate(void);
-int APS5_VABI scePlayGoDialogOpen(const void* param);
-int APS5_VABI scePlayGoDialogClose(void);
-int APS5_VABI scePlayGoDialogUpdateStatus(void);
-int APS5_VABI scePlayGoDialogGetStatus(void);
-int APS5_VABI scePlayGoDialogGetResult(PlayGoDialogResult* result);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestPlayerReviewDialog.cpp b/core/libs/tests/GuestPlayerReviewDialog.cpp
index 45621694d4..c14e478429 100644
--- a/core/libs/tests/GuestPlayerReviewDialog.cpp
+++ b/core/libs/tests/GuestPlayerReviewDialog.cpp
@@ -1,21 +1,10 @@
+#include "prx/libSceCdlgPlayerReview/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include "prx/libSceUserService/UserService.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI scePlayerReviewDialogInitialize(void);
-int APS5_VABI scePlayerReviewDialogTerminate(void);
-int APS5_VABI scePlayerReviewDialogOpen(const void* param);
-int APS5_VABI scePlayerReviewDialogClose(void);
-int APS5_VABI scePlayerReviewDialogGetStatus(void);
-int APS5_VABI scePlayerReviewDialogUpdateStatus(void);
-int APS5_VABI scePlayerReviewDialogGetResult(void* result);
-}
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
@@ -44,13 +33,13 @@ int main() {
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_NONE);
     Require(scePlayerReviewDialogOpen(&param) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(scePlayerReviewDialogClose() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
 
     Require(scePlayerReviewDialogInitialize() == 0);
     Require(scePlayerReviewDialogInitialize() == COMMON_DIALOG_ERROR_ALREADY_INITIALIZED);
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
     Require(scePlayerReviewDialogUpdateStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_ERROR_NOT_FINISHED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_ERROR_NOT_FINISHED);
     Require(scePlayerReviewDialogTerminate() == 0);
     Require(scePlayerReviewDialogTerminate() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_NONE);
@@ -86,7 +75,7 @@ int main() {
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_FINISHED);
     Require(scePlayerReviewDialogUpdateStatus() == COMMON_DIALOG_STATUS_FINISHED);
     Require(scePlayerReviewDialogGetResult(nullptr) == COMMON_DIALOG_ERROR_ARG_NULL);
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_RESULT_USER_CANCELED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_RESULT_USER_CANCELED);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == COMMON_DIALOG_RESULT_USER_CANCELED);
     Require(scePlayerReviewDialogClose() == static_cast<int>(0x80B8000Bu));
@@ -100,7 +89,7 @@ int main() {
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
     Require(scePlayerReviewDialogUpdateStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
     result[2] = -1;
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_ERROR_NOT_FINISHED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_ERROR_NOT_FINISHED);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == -1);
     Require(scePlayerReviewDialogTerminate() == 0);
diff --git a/core/libs/tests/GuestPlayerSelectionDialog.cpp b/core/libs/tests/GuestPlayerSelectionDialog.cpp
index 4d3e163d12..4b1c516bd1 100644
--- a/core/libs/tests/GuestPlayerSelectionDialog.cpp
+++ b/core/libs/tests/GuestPlayerSelectionDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayerSelectionDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -5,19 +6,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI scePlayerSelectionDialogInitialize(void);
-int APS5_VABI scePlayerSelectionDialogOpen(const PlayerSelectionDialogParam* param);
-int APS5_VABI scePlayerSelectionDialogUpdateStatus(void);
-int APS5_VABI scePlayerSelectionDialogGetStatus(void);
-int APS5_VABI scePlayerSelectionDialogGetResult(PlayerSelectionDialogResult* result);
-int APS5_VABI scePlayerSelectionDialogParamInitialize(void* param);
-int APS5_VABI scePlayerSelectionDialogClose(void);
-int APS5_VABI scePlayerSelectionDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -47,6 +35,7 @@ int main() {
     bool threw = false;
     try {
         scePlayerSelectionDialogParamInitialize(&param);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestPngDec.cpp b/core/libs/tests/GuestPngDec.cpp
index 4ee4031ad2..120be43fdc 100644
--- a/core/libs/tests/GuestPngDec.cpp
+++ b/core/libs/tests/GuestPngDec.cpp
@@ -1,31 +1,21 @@
+#include "prx/libScePngDec/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Png.hpp"
 #include <algorithm>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <cstring>
-#include <stdexcept>
+#include <initializer_list>
+#include <source_location>
+#include <span>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI scePngDecQueryMemorySize(const PngDecCreateParam*);
-std::int32_t APS5_VABI scePngDecCreate(const PngDecCreateParam*, void*, std::uint32_t, void**);
-std::int32_t APS5_VABI scePngDecDelete(void*);
-std::int32_t APS5_VABI scePngDecParseHeader(const PngDecParseParam*, PngDecImageInfo*);
-std::int32_t APS5_VABI scePngDecDecode(void*, const PngDecDecodeParam*, PngDecImageInfo*);
-}
-
-static void Require(bool value) { if (!value) std::abort(); }
-
-template<typename TFunction>
-static bool ThrowsRuntimeError(TFunction function) {
-    try {
-        function();
-    } catch (const std::runtime_error&) {
-        return true;
-    }
-    return false;
+static void Require(bool value, std::source_location location = std::source_location::current()) {
+    if (value) return;
+    std::fprintf(stderr, "%s:%u: PNG decoder assertion failed\n", location.file_name(), location.line());
+    std::abort();
 }
 
 static const std::uint8_t PALETTE_TRNS[] = {
@@ -46,6 +36,44 @@ static const std::uint8_t GRAY16[] = {
     0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
 };
 
+static const std::uint8_t GRAY16_TRNS[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x00, 0x07, 0x4D, 0x8E,
+    0xBB, 0x00, 0x00, 0x00, 0x02, 0x74, 0x52, 0x4E, 0x53, 0x12, 0x34, 0x2F, 0xD3, 0x49, 0x5E, 0x00,
+    0x00, 0x00, 0x12, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x63, 0x10, 0x32, 0x11, 0x5A, 0xCD, 0xB0,
+    0xFA, 0x2C, 0x03, 0x03, 0x00, 0x0B, 0xDF, 0x02, 0x7C, 0x4E, 0x3C, 0x25, 0x55, 0x00, 0x00, 0x00,
+    0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
+};
+
+static const std::uint8_t RGB16_TRNS[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x02, 0x00, 0x00, 0x00, 0xAD, 0x44, 0x46,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x74, 0x52, 0x4E, 0x53, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0x89,
+    0xE4, 0x4E, 0xE6, 0x00, 0x00, 0x00, 0x23, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x63, 0x10, 0x32,
+    0x09, 0xAB, 0x98, 0xB5, 0x47, 0xE8, 0x7F, 0xD8, 0xFF, 0x59, 0xFF, 0x19, 0xFE, 0x33, 0x30, 0x30,
+    0x36, 0x30, 0x32, 0x30, 0x34, 0x30, 0xFC, 0xFF, 0x0F, 0x00, 0x88, 0xFB, 0x0A, 0x69, 0xC3, 0x3F,
+    0x47, 0x19, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
+};
+
+static const std::uint8_t GRAY_ALPHA16[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x04, 0x00, 0x00, 0x00, 0x88, 0x2F, 0x19,
+    0xEC, 0x00, 0x00, 0x00, 0x19, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x63, 0x10, 0x32, 0xB9, 0xF7,
+    0x61, 0xF5, 0x59, 0x06, 0x20, 0xF8, 0xF7, 0xFF, 0xFF, 0x7F, 0xC6, 0x86, 0x46, 0x00, 0x48, 0x58,
+    0x08, 0x8A, 0x8F, 0xC8, 0x5C, 0x92, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42,
+    0x60, 0x82,
+};
+
+static const std::uint8_t RGBA16[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x06, 0x00, 0x00, 0x00, 0x22, 0x26, 0xD1,
+    0x67, 0x00, 0x00, 0x00, 0x2D, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x01, 0x22, 0x00, 0xDD, 0xFF,
+    0x00, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0x0D, 0xEF, 0xAB, 0xCD, 0x20, 0x01, 0xEE, 0xFE, 0xFF,
+    0xFF, 0x00, 0x00, 0x01, 0x80, 0x40, 0xFF, 0xAB, 0x00, 0x00, 0xFF, 0xFF, 0x01, 0x02, 0x7F, 0xFE,
+    0x80, 0xFF, 0x07, 0xD0, 0x10, 0x52, 0x90, 0xA2, 0xAC, 0x25, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45,
+    0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
+};
+
 static std::vector<std::uint8_t> RgbPng() {
     std::vector<std::uint8_t> rgb(3 * 2 * 3);
     for (std::size_t i = 0; i < rgb.size(); ++i) rgb[i] = static_cast<std::uint8_t>(10 + i * 13);
@@ -70,6 +98,121 @@ static PngDecDecodeParam DecodeParam(const std::vector<std::uint8_t>& png, std::
     return param;
 }
 
+static void Check16BitImage(void* limitedHandle, void* enabledHandle, std::span<const std::uint8_t> png,
+                            std::initializer_list<std::uint8_t> expected, std::uint16_t colorSpace,
+                            std::uint32_t flags, std::uint32_t height = 2) {
+    constexpr std::int32_t invalidSize = static_cast<std::int32_t>(0x80690002);
+    constexpr std::int32_t invalidParam = static_cast<std::int32_t>(0x80690003);
+    constexpr std::int32_t invalidWorkMemory = static_cast<std::int32_t>(0x80690005);
+    const std::vector<std::uint8_t> input(png.begin(), png.end());
+    const std::vector<std::uint8_t> expectedPixels(expected);
+    Require(expectedPixels.size() == 2 * height * 4);
+    for (const std::uint16_t format : {0, 1}) {
+        for (const std::uint32_t padding : {0, 8}) {
+            const std::uint32_t pitch = 8 + padding;
+            const std::uint32_t size = pitch * height;
+            std::vector<std::uint8_t> output(size + 16, 0xCC);
+            PngDecDecodeParam decode = DecodeParam(input, output);
+            decode.pixel_format = format;
+            decode.image_pitch = padding == 0 ? 0 : pitch;
+            decode.image_mem_size = size;
+            PngDecImageInfo info{};
+            Require(scePngDecDecode(limitedHandle, &decode, &info) == invalidWorkMemory);
+            Require(info.image_width == 2 && info.image_height == height && info.bit_depth == 16);
+            Require(info.color_space == colorSpace && info.image_flag == flags);
+            Require(std::all_of(output.begin(), output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+            Require(scePngDecDecode(enabledHandle, &decode, format == 0 ? &info : nullptr) == static_cast<std::int32_t>(2 << 16 | height));
+            Require(info.image_width == 2 && info.image_height == height && info.bit_depth == 16);
+            Require(info.color_space == colorSpace && info.image_flag == flags);
+            for (std::uint32_t y = 0; y < height; ++y) {
+                for (std::uint32_t x = 0; x < 2; ++x) {
+                    for (std::uint32_t channel = 0; channel < 4; ++channel) {
+                        const std::uint32_t inputChannel = format == 1 && channel < 3 ? 2 - channel : channel;
+                        Require(output[y * pitch + x * 4 + channel] == expectedPixels[y * 8 + x * 4 + inputChannel]);
+                    }
+                }
+                for (std::uint32_t offset = 8; offset < pitch; ++offset) Require(output[y * pitch + offset] == 0xCC);
+            }
+            Require(std::all_of(output.begin() + size, output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+            std::fill(output.begin(), output.end(), 0xCC);
+            decode.image_mem_size = size - 1;
+            for (void* handle : {limitedHandle, enabledHandle}) {
+                Require(scePngDecDecode(handle, &decode, &info) == (padding == 0 ? invalidSize : invalidParam));
+                Require(std::all_of(output.begin(), output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+                const auto validPitch = decode.image_pitch;
+                decode.image_pitch = 7;
+                Require(scePngDecDecode(handle, &decode, &info) == invalidParam);
+                Require(std::all_of(output.begin(), output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+                decode.image_pitch = validPitch;
+            }
+        }
+    }
+}
+
+static void CheckDimensionReporting(std::uint32_t width, std::uint32_t height) {
+    constexpr std::int32_t invalidAddr = static_cast<std::int32_t>(0x80690001);
+    constexpr std::int32_t invalidSize = static_cast<std::int32_t>(0x80690002);
+    constexpr std::int32_t invalidParam = static_cast<std::int32_t>(0x80690003);
+    constexpr std::int32_t invalidData = static_cast<std::int32_t>(0x80690010);
+    std::vector<std::uint8_t> rgb(static_cast<std::size_t>(width) * height * 3);
+    for (std::size_t i = 0; i < rgb.size(); ++i) rgb[i] = static_cast<std::uint8_t>(i * 13 + 7);
+    const auto png = Decoder::Png::Encode(rgb, width, height, 3);
+    const PngDecCreateParam create{sizeof(PngDecCreateParam), 0, width};
+    const auto memorySize = scePngDecQueryMemorySize(&create);
+    Require(memorySize > 0);
+    std::vector<std::uint8_t> memory(memorySize);
+    void* handle = nullptr;
+    Require(scePngDecCreate(&create, memory.data(), memorySize, &handle) == 0);
+    const bool packed = width <= 32767 && height <= 32767;
+    const auto result = packed ? static_cast<std::int32_t>(width << 16 | height) : 0;
+    for (const std::uint16_t format : {0, 1}) {
+        for (const std::uint32_t padding : {0, 8}) {
+            const std::uint32_t pitch = width * 4 + padding;
+            const std::uint32_t size = pitch * height;
+            std::vector<std::uint8_t> image(size + 16, 0xCC);
+            auto decode = DecodeParam(png, image);
+            decode.pixel_format = format;
+            decode.image_pitch = padding == 0 ? 0 : pitch;
+            decode.image_mem_size = size;
+            Require(scePngDecDecode(handle, &decode, nullptr) == (packed ? result : invalidAddr));
+            if (!packed) Require(std::all_of(image.begin(), image.end(), [](auto byte) { return byte == 0xCC; }));
+            PngDecImageInfo info{};
+            Require(scePngDecDecode(handle, &decode, &info) == result);
+            Require(info.image_width == width && info.image_height == height && info.color_space == 3 && info.bit_depth == 8 && info.image_flag == 0);
+            for (std::uint32_t y = 0; y < height; ++y) {
+                for (std::uint32_t x = 0; x < width; ++x) {
+                    for (std::uint32_t channel = 0; channel < 3; ++channel) {
+                        const auto inputChannel = format == 0 ? channel : 2 - channel;
+                        Require(image[y * pitch + x * 4 + channel] == rgb[(static_cast<std::size_t>(y) * width + x) * 3 + inputChannel]);
+                    }
+                    Require(image[y * pitch + x * 4 + 3] == 0x77);
+                }
+                for (std::uint32_t offset = width * 4; offset < pitch; ++offset) Require(image[y * pitch + offset] == 0xCC);
+            }
+            Require(std::all_of(image.begin() + size, image.end(), [](auto byte) { return byte == 0xCC; }));
+            if (packed) continue;
+            std::fill(image.begin(), image.end(), 0xCC);
+            decode.image_mem_size = 1;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidAddr);
+            Require(scePngDecDecode(handle, &decode, &info) == (padding == 0 ? invalidSize : invalidParam));
+            decode.image_mem_size = size;
+            decode.image_pitch = 1;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidAddr);
+            Require(scePngDecDecode(handle, &decode, &info) == invalidParam);
+            decode.image_mem_size = 0;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidSize);
+            decode.image_mem_size = size;
+            decode.pixel_format = 2;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidParam);
+            decode.pixel_format = format;
+            decode.png_mem_size = 8;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidData);
+            Require(std::all_of(image.begin(), image.end(), [](auto byte) { return byte == 0xCC; }));
+        }
+    }
+    Require(scePngDecDelete(handle) == 0);
+}
+
 int main() {
     constexpr std::int32_t invalidAddr = static_cast<std::int32_t>(0x80690001);
     constexpr std::int32_t invalidSize = static_cast<std::int32_t>(0x80690002);
@@ -205,10 +348,10 @@ int main() {
     Require(info.image_flag == 2);
 
     const std::vector<std::uint8_t> gray16Png(GRAY16, GRAY16 + sizeof(GRAY16));
-    std::vector<std::uint8_t> gray16Image(2 * 4);
+    std::vector<std::uint8_t> gray16Image(2 * 4, 0xCC);
     decode = DecodeParam(gray16Png, gray16Image);
-    Require(scePngDecDecode(handle, &decode, &info) == (2 << 16 | 1));
-    Require(gray16Image == std::vector<std::uint8_t>({0x12, 0x12, 0x12, 0x77, 0xAB, 0xAB, 0xAB, 0x77}));
+    Require(scePngDecDecode(handle, &decode, &info) == invalidWorkMemory);
+    Require(std::all_of(gray16Image.begin(), gray16Image.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
     Require(info.bit_depth == 16);
 
     decode = DecodeParam(rgbPng, image);
@@ -258,8 +401,11 @@ int main() {
     Require(deepSize == 85136);
     std::vector<unsigned char> deepMemory(static_cast<std::size_t>(deepSize));
     Require(scePngDecCreate(&deepParam, deepMemory.data(), static_cast<std::uint32_t>(deepSize), &deepHandle) == 0);
-    decode = DecodeParam(gray16Png, gray16Image);
-    Require(ThrowsRuntimeError([&] { scePngDecDecode(deepHandle, &decode, &info); }));
+    Check16BitImage(handle, deepHandle, GRAY16, {0x12, 0x12, 0x12, 0x77, 0xAB, 0xAB, 0xAB, 0x77}, 2, 0, 1);
+    Check16BitImage(handle, deepHandle, GRAY16_TRNS, {0x12, 0x12, 0x12, 0, 0x12, 0x12, 0x12, 0xFF, 0xAB, 0xAB, 0xAB, 0xFF, 0, 0, 0, 0xFF}, 2, 2);
+    Check16BitImage(handle, deepHandle, RGB16_TRNS, {0x12, 0x56, 0x9A, 0, 0x12, 0x56, 0x9A, 0xFF, 0xFF, 0, 0x80, 0xFF, 0, 0x80, 0xFF, 0xFF}, 3, 2);
+    Check16BitImage(handle, deepHandle, GRAY_ALPHA16, {0x12, 0x12, 0x12, 0xDE, 0xAB, 0xAB, 0xAB, 0, 0, 0, 0, 0xFF, 0xFF, 0xFF, 0xFF, 0x80}, 18, 0);
+    Check16BitImage(handle, deepHandle, RGBA16, {0x12, 0x56, 0x9A, 0x0D, 0xAB, 0x20, 0xEE, 0xFF, 0, 0x80, 0xFF, 0, 0xFF, 1, 0x7F, 0x80}, 19, 0);
     decode = DecodeParam(rgbPng, image);
     Require(scePngDecDecode(deepHandle, &decode, &info) == (3 << 16 | 2));
     Require(scePngDecDelete(deepHandle) == 0);
@@ -270,5 +416,9 @@ int main() {
     Require(scePngDecDelete(handle) == invalidHandle);
     Require(scePngDecDecode(handle, &decode, &info) == invalidHandle);
 
+    for (const std::uint32_t dimension : {32767, 32768, 65536}) {
+        CheckDimensionReporting(dimension, 1);
+        CheckDimensionReporting(1, dimension);
+    }
     return 0;
 }
diff --git a/core/libs/tests/GuestPngEnc.cpp b/core/libs/tests/GuestPngEnc.cpp
index d8227b3bab..53cbcd808f 100644
--- a/core/libs/tests/GuestPngEnc.cpp
+++ b/core/libs/tests/GuestPngEnc.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePngEnc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Png.hpp"
@@ -7,13 +8,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-int APS5_VABI scePngEncQueryMemorySize(const PngEncCreateParam*);
-int APS5_VABI scePngEncCreate(const PngEncCreateParam*, void*, std::uint32_t, void**);
-int APS5_VABI scePngEncDelete(void*);
-int APS5_VABI scePngEncEncode(void*, const PngEncEncodeParam*, PngEncOutputInfo*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestPoll.cpp b/core/libs/tests/GuestPoll.cpp
index 7be6d0675c..c5241498ea 100644
--- a/core/libs/tests/GuestPoll.cpp
+++ b/core/libs/tests/GuestPoll.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -7,43 +9,18 @@
 #include <unistd.h>
 #endif
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
 #include <chrono>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <stdexcept>
 #include <string>
 #include <thread>
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI shutdown_nid_postfix(int, int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI kqueue_nid_postfix();
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int* APS5_VABI __error_nid_postfix();
-}
+
 #ifdef _WIN32
 using NativeSocket = SOCKET;
 constexpr NativeSocket NativeInvalid = INVALID_SOCKET;
@@ -62,6 +39,46 @@ constexpr short Hup = 0x10;
 constexpr short Invalid = 0x20;
 constexpr short ReadNormal = 0x40;
 constexpr short WriteBand = 0x100;
+constexpr std::int16_t EvfiltUser = -11;
+constexpr std::uint16_t EvAdd = 0x0001;
+constexpr std::uint16_t EvClear = 0x0020;
+constexpr std::uint32_t NoteTrigger = 0x01000000;
+static KernelEvent UserEvent(std::uint16_t flags, std::uint32_t fflags) {
+    KernelEvent change{};
+    change.ident = 7;
+    change.filter = EvfiltUser;
+    change.flags = flags;
+    change.fflags = fflags;
+    return change;
+}
+static void PollsKqueues(int socket) {
+    const int queue = kqueue_nid_postfix();
+    Require(queue >= 0);
+    GuestPollDescriptor kq{queue, static_cast<short>(In | ReadNormal | Out | Priority | ReadBand | WriteBand), -1};
+    Require(poll_nid_postfix(&kq, 1, 0) == 0 && kq.revents == 0);
+    const auto added = UserEvent(EvAdd | EvClear, 0);
+    Require(kevent_nid_postfix(queue, &added, 1, nullptr, 0, nullptr) == 0);
+    Require(poll_nid_postfix(&kq, 1, 0) == 0 && kq.revents == 0);
+    const auto start = std::chrono::steady_clock::now();
+    Require(poll_nid_postfix(&kq, 1, 30) == 0 && kq.revents == 0);
+    Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(25));
+    std::thread trigger([queue] {
+        std::this_thread::sleep_for(std::chrono::milliseconds(20));
+        const auto triggered = UserEvent(0, NoteTrigger);
+        Require(kevent_nid_postfix(queue, &triggered, 1, nullptr, 0, nullptr) == 0);
+    });
+    GuestPollDescriptor mixed[2]{{socket, In, -1}, {queue, static_cast<short>(In | Out), -1}};
+    Require(poll_nid_postfix(mixed, 2, -1) == 1);
+    trigger.join();
+    Require(mixed[0].revents == 0 && mixed[1].revents == In);
+    Require(poll_nid_postfix(&kq, 1, 0) == 1 && kq.revents == (In | ReadNormal));
+    KernelEvent events[1]{};
+    const KernelTimespec zero{0, 0};
+    Require(kevent_nid_postfix(queue, nullptr, 0, events, 1, &zero) == 1);
+    Require(poll_nid_postfix(&kq, 1, 0) == 0 && kq.revents == 0);
+    Require(close_nid_postfix(queue) == 0);
+    Require(poll_nid_postfix(&kq, 1, 0) == 1 && kq.revents == Invalid);
+}
 static void PollsFilesAndDirectories(int socket) {
     constexpr int ReadWrite = 0x0002, Create = 0x0200, DirectoryFlag = 0x00020000;
     const auto stamp = std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
@@ -72,28 +89,48 @@ static void PollsFilesAndDirectories(int socket) {
     Require(mkdir_nid_postfix(directoryPath.c_str(), 0755) == 0);
     const int directory = open_nid_postfix(directoryPath.c_str(), DirectoryFlag, 0);
     Require(directory >= 0);
-    PollDescriptor vnode{file, static_cast<short>(In | Out | ReadNormal | Priority | ReadBand | WriteBand), -1};
+    GuestPollDescriptor vnode{file, static_cast<short>(In | Out | ReadNormal | Priority | ReadBand | WriteBand), -1};
     Require(poll_nid_postfix(&vnode, 1, 0) == 1 && vnode.revents == (In | Out | ReadNormal));
     vnode.events = static_cast<short>(Priority | ReadBand | WriteBand);
     Require(poll_nid_postfix(&vnode, 1, 0) == 0 && vnode.revents == 0);
     const auto start = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&vnode, 1, 30) == 0);
     Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(25));
-    PollDescriptor folder{directory, static_cast<short>(In | Out), -1};
+    GuestPollDescriptor folder{directory, static_cast<short>(In | Out), -1};
     Require(poll_nid_postfix(&folder, 1, -1) == 1 && folder.revents == (In | Out));
-    PollDescriptor mixed[3]{{socket, In, -1}, {file, Out, -1}, {directory, ReadNormal, -1}};
+    GuestPollDescriptor mixed[3]{{socket, In, -1}, {file, Out, -1}, {directory, ReadNormal, -1}};
     Require(poll_nid_postfix(mixed, 3, -1) == 2);
     Require(mixed[0].revents == 0 && mixed[1].revents == Out && mixed[2].revents == ReadNormal);
     Require(close_nid_postfix(directory) == 0 && close_nid_postfix(file) == 0);
     Require(rmdir_nid_postfix(directoryPath.c_str()) == 0 && unlink_nid_postfix(filePath.c_str()) == 0);
 }
 
+static void StandardDescriptorFile(int descriptor) {
+    const int saved = dup_nid_postfix(descriptor);
+    const std::string path = "anyps5-poll-input-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const int file = open_nid_postfix(path.c_str(), 0x0002 | 0x0200, 0644);
+    Require(file >= 0);
+    Require(dup2_nid_postfix(file, descriptor) == descriptor);
+    if (file != descriptor) Require(close_nid_postfix(file) == 0);
+    GuestPollDescriptor input{descriptor, static_cast<short>(In | Out | ReadNormal | Priority), -1};
+    const int ready = poll_nid_postfix(&input, 1, 0);
+    if (ready != 1) std::fprintf(stderr, "poll on a regular file at descriptor %d returned %d instead of 1\n", descriptor, ready);
+    Require(ready == 1 && input.revents == (In | Out | ReadNormal));
+    input.events = Priority;
+    Require(poll_nid_postfix(&input, 1, 0) == 0 && input.revents == 0);
+    if (saved >= 0) {
+        Require(dup2_nid_postfix(saved, descriptor) == descriptor);
+        Require(close_nid_postfix(saved) == 0);
+    } else Require(close_nid_postfix(descriptor) == 0);
+    Require(unlink_nid_postfix(path.c_str()) == 0);
+}
+
 static void TestPipes(int socket) {
     int ends[2];
     Require(pipe_nid_postfix(ends) == 0);
-    PollDescriptor empty[2]{{ends[0], In, -1}, {ends[1], Out, -1}};
+    GuestPollDescriptor empty[2]{{ends[0], In, -1}, {ends[1], Out, -1}};
     Require(poll_nid_postfix(empty, 2, 0) == 1 && empty[0].revents == 0 && empty[1].revents == Out);
-    PollDescriptor reader{ends[0], In | ReadNormal, -1};
+    GuestPollDescriptor reader{ends[0], In | ReadNormal, -1};
     const auto start = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&reader, 1, 50) == 0 && reader.revents == 0);
     Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(40));
@@ -103,13 +140,13 @@ static void TestPipes(int socket) {
     Require(shortWait >= std::chrono::milliseconds(40) && shortWait < std::chrono::milliseconds(200));
     Require(write_nid_postfix(ends[1], "wake", 4) == 4);
     Require(poll_nid_postfix(&reader, 1, 1000) == 1 && reader.revents == (In | ReadNormal));
-    PollDescriptor writer{ends[1], In, -1};
+    GuestPollDescriptor writer{ends[1], In, -1};
     Require(poll_nid_postfix(&writer, 1, 0) == 0 && writer.revents == 0);
-    PollDescriptor readerOut{ends[0], Out, -1};
+    GuestPollDescriptor readerOut{ends[0], Out, -1};
     bool threw = false;
     try { poll_nid_postfix(&readerOut, 1, 0); } catch (const std::runtime_error&) { threw = true; }
     Require(threw);
-    PollDescriptor mixed[2]{{socket, In, -1}, {ends[0], In, -1}};
+    GuestPollDescriptor mixed[2]{{socket, In, -1}, {ends[0], In, -1}};
     Require(poll_nid_postfix(mixed, 2, 1000) == 1 && mixed[0].revents == 0 && mixed[1].revents == In);
     char buffer[8]{};
     Require(read_nid_postfix(ends[0], buffer, sizeof(buffer)) == 4);
@@ -136,14 +173,14 @@ static void TestPipes(int socket) {
     Require(read_nid_postfix(ends[0], buffer, sizeof(buffer)) == 1);
     Require(poll_nid_postfix(&reader, 1, 0) == 1 && reader.revents == (In | ReadNormal | Hup));
     Require(read_nid_postfix(ends[0], buffer, sizeof(buffer)) == 0);
-    PollDescriptor closedPipe{ends[1], In, -1};
+    GuestPollDescriptor closedPipe{ends[1], In, -1};
     Require(poll_nid_postfix(&closedPipe, 1, 0) == 1 && closedPipe.revents == Invalid);
     Require(close_nid_postfix(ends[0]) == 0);
     int full[2];
     Require(pipe_nid_postfix(full) == 0);
     static char block[4096];
     std::int64_t queued = 0;
-    PollDescriptor fill{full[1], Out, -1};
+    GuestPollDescriptor fill{full[1], Out, -1};
     while (poll_nid_postfix(&fill, 1, 0) == 1) {
         Require(fill.revents == Out && queued < (1 << 20));
         Require(write_nid_postfix(full[1], block, 256) == 256);
@@ -161,7 +198,7 @@ static void TestPipes(int socket) {
     int other[2];
     Require(pipe_nid_postfix(other) == 0);
     Require(close_nid_postfix(other[0]) == 0);
-    PollDescriptor orphan{other[1], Out, -1};
+    GuestPollDescriptor orphan{other[1], Out, -1};
     Require(poll_nid_postfix(&orphan, 1, 0) == 1 && orphan.revents == Hup);
     orphan.events = In | Out;
     Require(poll_nid_postfix(&orphan, 1, 0) == 1 && orphan.revents == (In | Hup));
@@ -179,11 +216,11 @@ static void PollsUrgentData() {
     Require(client >= 0 && fcntl_nid_postfix(client, 4, 4) == 0);
     if (connect_nid_postfix(client, address.data(), address.size()) != 0)
         Require(*__error_nid_postfix() == 36);
-    PollDescriptor connecting{client, Priority | Out, -1};
+    GuestPollDescriptor connecting{client, Priority | Out, -1};
     Require(poll_nid_postfix(&connecting, 1, 1000) == 1 && connecting.revents == Out);
     const int server = accept_nid_postfix(listener, nullptr, nullptr);
     Require(server >= 0);
-    PollDescriptor pair[2]{{server, Priority | Out, -1}, {client, In | Priority | Out | ReadBand, -1}};
+    GuestPollDescriptor pair[2]{{server, Priority | Out, -1}, {client, In | Priority | Out | ReadBand, -1}};
     Require(poll_nid_postfix(pair, 2, 0) == 2 && pair[0].revents == Out && pair[1].revents == Out);
     char byte = 'u';
     Require(send_nid_postfix(client, &byte, 1, 1) == -1 && *__error_nid_postfix() == 45);
@@ -197,14 +234,14 @@ static void PollsUrgentData() {
     Require(::connect(peer, reinterpret_cast<const sockaddr*>(&native), sizeof(native)) == 0);
     const int urgent = accept_nid_postfix(listener, nullptr, nullptr);
     Require(urgent >= 0);
-    PollDescriptor waiting{urgent, Priority, -1};
+    GuestPollDescriptor waiting{urgent, Priority, -1};
     Require(poll_nid_postfix(&waiting, 1, 0) == 0 && waiting.revents == 0);
     Require(::send(peer, "u", 1, MSG_OOB) == 1);
     Require(poll_nid_postfix(&waiting, 1, 1000) == 1 && waiting.revents == Priority);
-    PollDescriptor bands{urgent, In | Priority | Out, -1};
+    GuestPollDescriptor bands{urgent, In | Priority | Out, -1};
     Require(poll_nid_postfix(&bands, 1, 0) == 1 && bands.revents == (Priority | Out));
 #ifdef _WIN32
-    PollDescriptor band{urgent, ReadBand, -1};
+    GuestPollDescriptor band{urgent, ReadBand, -1};
     Require(poll_nid_postfix(&band, 1, 0) == 1 && band.revents == ReadBand);
 #endif
     CloseNative(peer);
@@ -226,7 +263,7 @@ static void PollsAStreamWhosePeerClosed() {
     Require(server >= 0);
 
     Require(shutdown_nid_postfix(client, 1) == 0);
-    PollDescriptor wait{server, In, 0};
+    GuestPollDescriptor wait{server, In, 0};
     Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == In);
     wait = {server, static_cast<short>(In | Out), 0};
     Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == (In | Out));
@@ -245,9 +282,37 @@ static void PollsAStreamWhosePeerClosed() {
     for (const int descriptor : {client, server, listener}) Require(close_nid_postfix(descriptor) == 0);
 }
 
+#ifndef _WIN32
+static void PollsAHungUpSocketWithoutPollout() {
+    const int listener = socket_nid_postfix(2, 1, 0);
+    Require(listener >= 0);
+    std::array<unsigned char, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(bind_nid_postfix(listener, address.data(), address.size()) == 0);
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(listener, address.data(), &size) == 0 && listen_nid_postfix(listener, 1) == 0);
+    const int client = socket_nid_postfix(2, 1, 0);
+    Require(client >= 0 && connect_nid_postfix(client, address.data(), address.size()) == 0);
+    const int server = accept_nid_postfix(listener, nullptr, nullptr);
+    Require(server >= 0);
+    Require(close_nid_postfix(client) == 0);
+    char byte = 0;
+    GuestPollDescriptor ended{server, In, 0};
+    Require(poll_nid_postfix(&ended, 1, 1000) == 1);
+    Require(recv_nid_postfix(server, &byte, 1, 0) == 0);
+    Require(shutdown_nid_postfix(server, 1) == 0);
+    GuestPollDescriptor hungUp{server, static_cast<short>(In | Out), 0};
+    Require(poll_nid_postfix(&hungUp, 1, 1000) == 1 && hungUp.revents == (In | Hup));
+    Require(close_nid_postfix(server) == 0 && close_nid_postfix(listener) == 0);
+}
+#endif
+
 int main() {
+    for (const int descriptor : {0, 1, 2}) StandardDescriptorFile(descriptor);
     PollsUrgentData();
     PollsAStreamWhosePeerClosed();
+#ifndef _WIN32
+    PollsAHungUpSocketWithoutPollout();
+#endif
     const int listener = socket_nid_postfix(2, 1, 0);
     Require(listener >= 0 && listener < 1024);
     std::array<unsigned char, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
@@ -255,7 +320,7 @@ int main() {
     std::uint32_t size = address.size();
     Require(getsockname_nid_postfix(listener, address.data(), &size) == 0);
     Require(listen_nid_postfix(listener, 4) == 0);
-    PollDescriptor single{listener, In, -1};
+    GuestPollDescriptor single{listener, In, -1};
     Require(poll_nid_postfix(&single, 1, 0) == 0 && single.revents == 0);
     const auto start = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&single, 1, 50) == 0);
@@ -265,7 +330,7 @@ int main() {
     Require(poll_nid_postfix(&single, 1, 1000) == 1 && single.revents == In);
     const int server = accept_nid_postfix(listener, nullptr, nullptr);
     Require(server >= 0);
-    PollDescriptor pair[3]{{server, In, 0}, {-1, In, 7}, {client, Out, 0}};
+    GuestPollDescriptor pair[3]{{server, In, 0}, {-1, In, 7}, {client, Out, 0}};
     Require(poll_nid_postfix(pair, 3, 1000) == 1);
     Require(pair[0].revents == 0 && pair[1].revents == 0 && pair[2].revents == Out);
     const char message[] = "poll";
@@ -277,7 +342,7 @@ int main() {
     Require(close_nid_postfix(client) == 0);
     Require(poll_nid_postfix(pair, 1, 1000) == 1 && (pair[0].revents & (In | Hup)) != 0);
     Require(recv_nid_postfix(server, buffer, sizeof(buffer), 0) == 0);
-    PollDescriptor closed[2]{{client, In, 0}, {listener, In, 0}};
+    GuestPollDescriptor closed[2]{{client, In, 0}, {listener, In, 0}};
     Require(poll_nid_postfix(closed, 2, -1) == 1 && closed[0].revents == Invalid && closed[1].revents == 0);
     Require(poll_nid_postfix(nullptr, 0, 10) == 0);
     const auto shortWaitStart = std::chrono::steady_clock::now();
@@ -292,33 +357,23 @@ int main() {
     for (const char* path : {"/dev/urandom", "/dev/random"}) {
         const int random = open_nid_postfix(path, 0, 0);
         Require(random >= 0);
-        PollDescriptor device{random, static_cast<short>(In | Out | Priority), -1};
+        GuestPollDescriptor device{random, static_cast<short>(In | Out | Priority), -1};
         Require(poll_nid_postfix(&device, 1, 0) == 1 && device.revents == In);
         device.events = static_cast<short>(ReadNormal | Out);
         Require(poll_nid_postfix(&device, 1, 0) == 1 && device.revents == ReadNormal);
         device.events = static_cast<short>(Out | Priority | ReadBand | WriteBand);
         Require(poll_nid_postfix(&device, 1, -1) == 1 && device.revents == (Out | Priority | ReadBand | WriteBand));
-        PollDescriptor mixed[2]{{listener, In, 0}, {random, Out, 0}};
+        GuestPollDescriptor mixed[2]{{listener, In, 0}, {random, Out, 0}};
         Require(poll_nid_postfix(mixed, 2, -1) == 1 && mixed[0].revents == 0 && mixed[1].revents == Out);
         Require(close_nid_postfix(random) == 0);
     }
-    PollDescriptor console[3]{{0, static_cast<short>(In | ReadNormal | Out), -1}, {1, static_cast<short>(In | Out | WriteBand), -1}, {2, Out, -1}};
+    GuestPollDescriptor console[3]{{0, static_cast<short>(In | ReadNormal | Out), -1}, {1, static_cast<short>(In | Out | WriteBand), -1}, {2, Out, -1}};
     Require(poll_nid_postfix(console, 3, 0) == 2);
     Require(console[0].revents == 0 && console[1].revents == Out && console[2].revents == Out);
-    PollDescriptor input{0, In, -1};
+    GuestPollDescriptor input{0, In, -1};
     const auto inputStart = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&input, 1, 30) == 0 && input.revents == 0);
     Require(std::chrono::steady_clock::now() - inputStart >= std::chrono::milliseconds(25));
-    const int queue = kqueue_nid_postfix();
-    Require(queue >= 0);
-    PollDescriptor unknown[2]{{listener, In, 0}, {queue, In, 0}};
-    bool unsupported = false;
-    try {
-        poll_nid_postfix(unknown, 2, 0);
-    } catch (const std::runtime_error&) {
-        unsupported = true;
-    }
-    Require(unsupported);
-    Require(close_nid_postfix(queue) == 0);
+    PollsKqueues(listener);
     Require(close_nid_postfix(listener) == 0);
 }
diff --git a/core/libs/tests/GuestPositionedClose.cpp b/core/libs/tests/GuestPositionedClose.cpp
index 3d44da1f08..1d89c27276 100644
--- a/core/libs/tests/GuestPositionedClose.cpp
+++ b/core/libs/tests/GuestPositionedClose.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/PreciseWait.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -13,12 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Positioned close check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestPositionedRace.cpp b/core/libs/tests/GuestPositionedRace.cpp
index 6c936c56b4..90c3257cf6 100644
--- a/core/libs/tests/GuestPositionedRace.cpp
+++ b/core/libs/tests/GuestPositionedRace.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -12,13 +14,7 @@
 #include <fstream>
 #include <string>
 #include <thread>
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-std::int64_t APS5_VABI sceKernelRead(int d, void* buf, std::size_t nbytes);
-std::int64_t APS5_VABI sceKernelPread(int d, void* buf, std::size_t nbytes, std::int64_t offset);
-std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence);
-}
+
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Positioned race check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestPosixFilesystem.cpp b/core/libs/tests/GuestPosixFilesystem.cpp
index fbe8e7566e..c18d690982 100644
--- a/core/libs/tests/GuestPosixFilesystem.cpp
+++ b/core/libs/tests/GuestPosixFilesystem.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 #include <array>
@@ -18,32 +22,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI mkstemp_nid_postfix(char*);
-int APS5_VABI isatty_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI __wrap_access(const char*, int);
-int APS5_VABI clock_gettime_nid_postfix(int, KernelTimespec*);
-int APS5_VABI __wrap_clock_gettime(int, KernelTimespec*);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-char* APS5_VABI __wrap_getcwd(char*, std::size_t);
-char* APS5_VABI getenv_nid_postfix(const char*);
-char* APS5_VABI __wrap_getenv(const char*);
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-int APS5_VABI __wrap_lstat(const char*, FileStat*);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-void* APS5_VABI __wrap_mmap(void*, std::size_t, int, int, int, std::int64_t);
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "POSIX filesystem check failed at line %u (guest errno %d)\n", location.line(), *__error_nid_postfix());
diff --git a/core/libs/tests/GuestPosixNamedSem.cpp b/core/libs/tests/GuestPosixNamedSem.cpp
new file mode 100644
index 0000000000..99ab8cb8a5
--- /dev/null
+++ b/core/libs/tests/GuestPosixNamedSem.cpp
@@ -0,0 +1,125 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <stdexcept>
+#include <string>
+#include <thread>
+
+static constexpr int GUEST_ENOENT = 2;
+static constexpr int GUEST_EEXIST = 17;
+static constexpr int GUEST_EINVAL = 22;
+static constexpr int GUEST_EAGAIN = 35;
+static constexpr int GUEST_ENAMETOOLONG = 63;
+static constexpr int O_CREAT_FLAG = 0x200;
+static constexpr int O_EXCL_FLAG = 0x800;
+
+static void Require(bool condition, int line) {
+    if (!condition) {
+        std::fprintf(stderr, "line %d failed, errno=%d\n", line, *__error_nid_postfix());
+        std::abort();
+    }
+}
+#define REQUIRE(condition) Require(condition, __LINE__)
+
+template <typename Call>
+static bool Throws(Call call) {
+    try {
+        call();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+static bool OpenFails(const char* name, int flags, int error) {
+    *__error_nid_postfix() = 0;
+    return sem_open_nid_postfix(name, flags, 0600, 1) == nullptr && *__error_nid_postfix() == error;
+}
+
+static bool UnlinkFails(const char* name, int error) {
+    *__error_nid_postfix() = 0;
+    return sem_unlink_nid_postfix(name) == -1 && *__error_nid_postfix() == error;
+}
+
+static int Value(void* sem) {
+    int value = -1;
+    REQUIRE(sem_getvalue_nid_postfix(sem, &value) == 0);
+    return value;
+}
+
+static void CheckNames() {
+    REQUIRE(OpenFails("relative", O_CREAT_FLAG, GUEST_EINVAL));
+    REQUIRE(OpenFails("/anyps5-named-flags", 0x1, GUEST_EINVAL));
+    REQUIRE(OpenFails("/anyps5-named-flags", O_CREAT_FLAG | 0x2, GUEST_EINVAL));
+    REQUIRE(OpenFails("/anyps5-named-missing", 0, GUEST_ENOENT));
+    REQUIRE(OpenFails("/anyps5-named-missing", O_EXCL_FLAG, GUEST_ENOENT));
+    const std::string longPath = "/" + std::string(1015, 'p');
+    REQUIRE(OpenFails(longPath.c_str(), O_CREAT_FLAG, GUEST_ENAMETOOLONG));
+    REQUIRE(UnlinkFails(longPath.c_str(), GUEST_ENAMETOOLONG));
+    const std::string longFile = "/" + std::string(252, 'f');
+    REQUIRE(OpenFails(longFile.c_str(), O_CREAT_FLAG, GUEST_ENAMETOOLONG));
+    REQUIRE(OpenFails(longFile.c_str(), 0x1, GUEST_EINVAL));
+    REQUIRE(UnlinkFails(longFile.c_str(), GUEST_ENAMETOOLONG));
+    const std::string longestFile = "/" + std::string(251, 'f');
+    void* longest = sem_open_nid_postfix(longestFile.c_str(), O_CREAT_FLAG, 0600, 0);
+    REQUIRE(longest != nullptr && sem_close_nid_postfix(longest) == 0 && sem_unlink_nid_postfix(longestFile.c_str()) == 0);
+    REQUIRE(UnlinkFails("relative", GUEST_ENOENT));
+    REQUIRE(UnlinkFails("/anyps5-named-missing", GUEST_ENOENT));
+    REQUIRE(Throws([] { sem_open_nid_postfix(nullptr, 0); }));
+    REQUIRE(Throws([] { sem_unlink_nid_postfix(nullptr); }));
+}
+
+static void CheckLifetime() {
+    const char* name = "/anyps5-named-lifetime";
+    void* sem = sem_open_nid_postfix(name, O_CREAT_FLAG | O_EXCL_FLAG, 0600, 2);
+    REQUIRE(sem != nullptr && Value(sem) == 2);
+    REQUIRE(sem_open_nid_postfix(name, 0) == sem);
+    REQUIRE(sem_open_nid_postfix(name, O_CREAT_FLAG, 0600, 9) == sem && Value(sem) == 2);
+    REQUIRE(OpenFails(name, O_CREAT_FLAG | O_EXCL_FLAG, GUEST_EEXIST));
+    REQUIRE(sem_trywait_nid_postfix(sem) == 0 && sem_trywait_nid_postfix(sem) == 0);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_trywait_nid_postfix(sem) == -1 && *__error_nid_postfix() == GUEST_EAGAIN);
+    std::thread poster([name] {
+        void* other = sem_open_nid_postfix(name, 0);
+        REQUIRE(other != nullptr && sem_post_nid_postfix(other) == 0 && sem_close_nid_postfix(other) == 0);
+    });
+    REQUIRE(sem_wait_nid_postfix(sem) == 0);
+    poster.join();
+    REQUIRE(sem_post_nid_postfix(sem) == 0 && sem_post_nid_postfix(sem) == 0 && Value(sem) == 2);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_destroy_nid_postfix(sem) == -1 && *__error_nid_postfix() == GUEST_EINVAL && Value(sem) == 2);
+    for (int open = 0; open < 3; ++open) REQUIRE(sem_close_nid_postfix(sem) == 0);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_close_nid_postfix(sem) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+
+    void* reopened = sem_open_nid_postfix(name, 0);
+    REQUIRE(reopened != nullptr && Value(reopened) == 2);
+    REQUIRE(sem_unlink_nid_postfix(name) == 0);
+    REQUIRE(UnlinkFails(name, GUEST_ENOENT));
+    REQUIRE(OpenFails(name, 0, GUEST_ENOENT));
+    REQUIRE(sem_post_nid_postfix(reopened) == 0 && Value(reopened) == 3);
+    void* recreated = sem_open_nid_postfix(name, O_CREAT_FLAG | O_EXCL_FLAG, 0600, 5);
+    REQUIRE(recreated != nullptr && recreated != reopened && Value(recreated) == 5 && Value(reopened) == 3);
+    REQUIRE(sem_close_nid_postfix(reopened) == 0);
+    REQUIRE(sem_close_nid_postfix(recreated) == 0 && sem_unlink_nid_postfix(name) == 0);
+}
+
+static void CheckUnnamed() {
+    std::uintptr_t storage[2] = {};
+    REQUIRE(sem_init_nid_postfix(storage, 0, 1) == 0);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_close_nid_postfix(storage) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    REQUIRE(Value(storage) == 1 && sem_destroy_nid_postfix(storage) == 0);
+    REQUIRE(Throws([] { sem_close_nid_postfix(nullptr); }));
+}
+
+int main() {
+    CheckNames();
+    CheckLifetime();
+    CheckUnnamed();
+    return 0;
+}
diff --git a/core/libs/tests/GuestPosixRandom.cpp b/core/libs/tests/GuestPosixRandom.cpp
index 396fcc3aa1..e4f7307064 100644
--- a/core/libs/tests/GuestPosixRandom.cpp
+++ b/core/libs/tests/GuestPosixRandom.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -7,9 +8,6 @@
 #include <cstdlib>
 #include <source_location>
 
-extern "C" void APS5_VABI arc4random_buf_nid_postfix(void*, std::size_t);
-extern "C" std::uint32_t APS5_VABI arc4random_nid_postfix();
-
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Posix random check failed at line %u\n", location.line());
@@ -22,15 +20,18 @@ int main() {
     std::array<unsigned char, 4099> second{};
     first.fill(0xa5);
     arc4random_buf_nid_postfix(first.data(), 0);
+
     Require(std::all_of(first.begin(), first.end(), [](unsigned char value) { return value == 0xa5; }));
     for (const std::size_t size : {1u, 3u, 5u, 4098u}) {
         first.fill(0xa5);
         arc4random_buf_nid_postfix(first.data(), size);
+
         Require(std::all_of(first.begin() + static_cast<std::ptrdiff_t>(size), first.end(),
             [](unsigned char value) { return value == 0xa5; }));
     }
     arc4random_buf_nid_postfix(first.data(), first.size());
     arc4random_buf_nid_postfix(second.data(), second.size());
+
     Require(first != second);
     std::array<std::size_t, 256> counts{};
     for (const auto value : first) ++counts[value];
diff --git a/core/libs/tests/GuestPosixScalarIo.cpp b/core/libs/tests/GuestPosixScalarIo.cpp
index ec96da483a..ea79971ed5 100644
--- a/core/libs/tests/GuestPosixScalarIo.cpp
+++ b/core/libs/tests/GuestPosixScalarIo.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -20,30 +23,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI _read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI _write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-int APS5_VABI sceKernelUnlink(const char*);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI sceKernelUtimes_nid_postfix(const char*, const void*);
-int APS5_VABI sceKernelMkdir(const char*, std::uint16_t);
-int APS5_VABI sceKernelRmdir(const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "POSIX scalar I/O check failed at line %d (guest errno %d)\n", line, *__error_nid_postfix());
@@ -145,6 +124,7 @@ int main() {
     bool limitDiagnosticPreserved = false;
     try {
         write_nid_postfix(descriptor, payload, static_cast<std::int64_t>(std::numeric_limits<unsigned int>::max()) + 1);
+
     } catch (const std::runtime_error& error) {
         limitDiagnosticPreserved = std::string(error.what()).find("nbytes exceeds platform limit") != std::string::npos;
     }
diff --git a/core/libs/tests/GuestPosixSem.cpp b/core/libs/tests/GuestPosixSem.cpp
index f6a2963120..bb2dc5f570 100644
--- a/core/libs/tests/GuestPosixSem.cpp
+++ b/core/libs/tests/GuestPosixSem.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
@@ -9,16 +11,6 @@
 #include <initializer_list>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sem_init_nid_postfix(void*, int, unsigned int);
-int APS5_VABI sem_destroy_nid_postfix(void*);
-int APS5_VABI sem_post_nid_postfix(void*);
-int APS5_VABI sem_trywait_nid_postfix(void*);
-int APS5_VABI sem_timedwait_nid_postfix(void*, const KernelTimespec*);
-int APS5_VABI sem_getvalue_nid_postfix(void*, int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "%s\n", message);
@@ -26,6 +18,29 @@ static void Require(bool condition, const char* message) {
     }
 }
 
+static void CheckRetire() {
+    constexpr int rounds = 20000;
+    std::atomic<std::uintptr_t*> published{nullptr};
+    std::thread poster([&] {
+        for (int round = 0; round < rounds; ++round) {
+            published.wait(nullptr, std::memory_order_acquire);
+            std::uintptr_t* target = published.exchange(nullptr, std::memory_order_acq_rel);
+            Require(sem_post_nid_postfix(target) == 0, "post to a semaphore its waiter destroys must succeed");
+        }
+    });
+    for (int round = 0; round < rounds; ++round) {
+        std::uintptr_t slot = 0;
+        Require(sem_init_nid_postfix(&slot, 0, 0) == 0, "retired semaphore must initialize");
+        published.store(&slot, std::memory_order_release);
+        published.notify_one();
+        for (int spins = 0; sem_trywait_nid_postfix(&slot) != 0; ++spins) {
+            if (spins >= 4096) std::this_thread::yield();
+        }
+        Require(sem_destroy_nid_postfix(&slot) == 0, "semaphore must be destroyable once its count is taken");
+    }
+    poster.join();
+}
+
 int main(int argc, char** argv) {
     constexpr unsigned int maximum = 0x7fffffffu;
     std::uintptr_t sem = 0;
@@ -99,4 +114,5 @@ int main(int argc, char** argv) {
     Require(sem_timedwait_nid_postfix(&sem, &expiredTimeout) == -1 && *__error_nid_postfix() == 60, "blocked expired-timeout wait must report ETIMEDOUT");
     Require(sem_getvalue_nid_postfix(&sem, &value) == 0 && value == 0, "failed timed waits must preserve the count");
     Require(sem_destroy_nid_postfix(&sem) == 0, "blocked semaphore destroy must succeed");
+    CheckRetire();
 }
diff --git a/core/libs/tests/GuestPosixSpawn.cpp b/core/libs/tests/GuestPosixSpawn.cpp
index 5b714f2fb0..d71e652950 100644
--- a/core/libs/tests/GuestPosixSpawn.cpp
+++ b/core/libs/tests/GuestPosixSpawn.cpp
@@ -1,6 +1,10 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libSceLibcInternal/include/Spawn.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
+#include <csignal>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -9,33 +13,17 @@
 #include <fstream>
 #include <stdexcept>
 #include <string>
+#include <thread>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#else
+extern "C" int kill(int, int);
+#endif
 
-extern "C" {
-int APS5_VABI posix_spawnattr_init_nid_postfix(PosixSpawnAttributes**);
-int APS5_VABI posix_spawnattr_destroy_nid_postfix(PosixSpawnAttributes**);
-int APS5_VABI posix_spawnattr_setflags_nid_postfix(PosixSpawnAttributes**, std::int16_t);
-int APS5_VABI posix_spawnattr_setsigdefault_nid_postfix(PosixSpawnAttributes**, const GuestSignalSet*);
-int APS5_VABI posix_spawnattr_getflags_nid_postfix(PosixSpawnAttributes* const*, std::int16_t*);
-int APS5_VABI posix_spawnattr_getpgroup_nid_postfix(PosixSpawnAttributes* const*, std::int32_t*);
-int APS5_VABI posix_spawnattr_getschedparam_nid_postfix(PosixSpawnAttributes* const*, std::int32_t*);
-int APS5_VABI posix_spawnattr_getschedpolicy_nid_postfix(PosixSpawnAttributes* const*, std::int32_t*);
-int APS5_VABI posix_spawnattr_getsigdefault_nid_postfix(PosixSpawnAttributes* const*, GuestSignalSet*);
-int APS5_VABI posix_spawnattr_getsigmask_nid_postfix(PosixSpawnAttributes* const*, GuestSignalSet*);
-int APS5_VABI posix_spawnattr_setpgroup_nid_postfix(PosixSpawnAttributes**, std::int32_t);
-int APS5_VABI posix_spawnattr_setschedparam_nid_postfix(PosixSpawnAttributes**, const std::int32_t*);
-int APS5_VABI posix_spawnattr_setschedpolicy_nid_postfix(PosixSpawnAttributes**, std::int32_t);
-int APS5_VABI posix_spawnattr_setsigmask_nid_postfix(PosixSpawnAttributes**, const GuestSignalSet*);
-int APS5_VABI posix_spawn_file_actions_init_nid_postfix(PosixSpawnFileActions**);
-int APS5_VABI posix_spawn_file_actions_destroy_nid_postfix(PosixSpawnFileActions**);
-int APS5_VABI posix_spawn_file_actions_addopen_nid_postfix(PosixSpawnFileActions**, int, const char*, int, std::uint16_t);
-int APS5_VABI posix_spawn_file_actions_adddup2_nid_postfix(PosixSpawnFileActions**, int, int);
-int APS5_VABI posix_spawn_file_actions_addclose_nid_postfix(PosixSpawnFileActions**, int);
-int APS5_VABI posix_spawn_nid_postfix(std::int32_t*, const char*, PosixSpawnFileActions* const*, PosixSpawnAttributes* const*, char* const*, char* const*);
-int APS5_VABI posix_spawnp_nid_postfix(std::int32_t*, const char*, PosixSpawnFileActions* const*, PosixSpawnAttributes* const*, char* const*, char* const*);
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI unsetenv_nid_postfix(const char*);
-int APS5_VABI chdir_nid_postfix(const char*);
-}
+#if defined(__linux__)
+extern char** environ;
+#endif
 
 static void Require(bool condition, int line) {
     if (!condition) {
@@ -175,29 +163,29 @@ static void CheckSpawn() {
     std::int32_t processId = 77;
 
     Check(ReportsNotImplemented([&] { posix_spawn_nid_postfix(&processId, existing.c_str(), &actions, &attributes, arguments, environment); },
-        "posix_spawn: process creation not implemented"));
+        "posix_spawn: executables outside /app0 (" + existing + ") not implemented"));
     Check(posix_spawn_nid_postfix(&processId, missing.c_str(), &actions, &attributes, arguments, environment) == NoSuchFile);
     Check(posix_spawn_nid_postfix(&processId, "", nullptr, nullptr, arguments, nullptr) == NoSuchFile);
     Check(posix_spawn_nid_postfix(&processId, "tool.elf", nullptr, nullptr, arguments, nullptr) == NoSuchFile);
 
     Check(setenv_nid_postfix("PATH", bothDirectories.c_str(), 1) == 0);
     Check(ReportsNotImplemented([&] { posix_spawnp_nid_postfix(&processId, "tool.elf", &actions, &attributes, arguments, nullptr); },
-        "posix_spawnp: process creation not implemented"));
+        "posix_spawnp: executables outside /app0 (" + existing + ") not implemented"));
     Check(posix_spawnp_nid_postfix(&processId, "missing.elf", &actions, &attributes, arguments, nullptr) == NoSuchFile);
     Check(posix_spawnp_nid_postfix(&processId, "", nullptr, nullptr, arguments, nullptr) == NoSuchFile);
     Check(setenv_nid_postfix("PATH", emptyOnly.c_str(), 1) == 0);
     Check(posix_spawnp_nid_postfix(&processId, "tool.elf", nullptr, nullptr, arguments, nullptr) == NoSuchFile);
     Check(ReportsNotImplemented([&] { posix_spawnp_nid_postfix(&processId, existing.c_str(), nullptr, nullptr, arguments, nullptr); },
-        "posix_spawnp: process creation not implemented"));
+        "posix_spawnp: executables outside /app0 (" + existing + ") not implemented"));
     Check(posix_spawnp_nid_postfix(&processId, missing.c_str(), nullptr, nullptr, arguments, nullptr) == NoSuchFile);
 
     Check(setenv_nid_postfix("PATH", (emptyOnly + ":").c_str(), 1) == 0);
     Check(posix_spawnp_nid_postfix(&processId, "tool.elf", nullptr, nullptr, arguments, nullptr) == NoSuchFile);
     Check(chdir_nid_postfix(guest.c_str()) == 0);
     Check(ReportsNotImplemented([&] { posix_spawnp_nid_postfix(&processId, "tool.elf", nullptr, nullptr, arguments, nullptr); },
-        "posix_spawnp: process creation not implemented"));
+        "posix_spawnp: executables outside /app0 (./tool.elf) not implemented"));
     Check(ReportsNotImplemented([&] { posix_spawn_nid_postfix(&processId, "tool.elf", nullptr, nullptr, arguments, nullptr); },
-        "posix_spawn: process creation not implemented"));
+        "posix_spawn: executables outside /app0 (tool.elf) not implemented"));
     Check(chdir_nid_postfix("/") == 0);
 
     Check(unsetenv_nid_postfix("PATH") == 0);
@@ -215,8 +203,170 @@ static void CheckSpawn() {
     std::filesystem::remove_all(directory);
 }
 
+static std::filesystem::path OwnExecutablePath() {
+#ifdef _WIN32
+    std::wstring own(32768, L'\0');
+    const DWORD length = GetModuleFileNameW(nullptr, own.data(), static_cast<DWORD>(own.size()));
+    own.resize(length);
+    return std::filesystem::path(own);
+#else
+    std::error_code error;
+    return std::filesystem::read_symlink("/proc/self/exe", error);
+#endif
+}
+
+static std::int32_t SpawnChild(const char* role) {
+    const auto own = OwnExecutablePath();
+    const auto target = own.parent_path() / std::filesystem::path(reinterpret_cast<const char8_t*>(("child.bin" + own.extension().string()).c_str()));
+    std::error_code error;
+    std::filesystem::copy_file(own, target, std::filesystem::copy_options::overwrite_existing, error);
+    Check(!error);
+    const auto app0 = std::filesystem::current_path() / "app0";
+    Check(std::filesystem::create_directories(app0) || std::filesystem::exists(app0));
+    { std::ofstream file(app0 / "child.bin"); file << "child"; }
+
+    char program[] = "/app0/child.bin";
+    char* arguments[] = {program, nullptr};
+    std::vector<std::string> entries;
+#ifdef _WIN32
+    char** const parentEnvironment = _environ;
+#else
+    char** const parentEnvironment = environ;
+#endif
+    for (char** entry = parentEnvironment; entry != nullptr && *entry != nullptr; ++entry)
+        entries.push_back(*entry);
+    entries.push_back(std::string("ANYPS5_POSIX_SPAWN_ROLE=") + role);
+    std::vector<char*> environment;
+    for (auto& entry : entries)
+        environment.push_back(entry.data());
+    environment.push_back(nullptr);
+    std::int32_t processId = 0;
+    Check(posix_spawn_nid_postfix(&processId, program, nullptr, nullptr, arguments, environment.data()) == 0);
+    Check(processId > 0);
+    return processId;
+}
+
+static void CleanupChild() {
+    std::error_code error;
+    std::filesystem::remove(OwnExecutablePath().parent_path() / std::filesystem::path(reinterpret_cast<const char8_t*>(("child.bin" + OwnExecutablePath().extension().string()).c_str())), error);
+    std::filesystem::remove_all(std::filesystem::current_path() / "app0", error);
+}
+
+static void CheckSpawnedChild(const char* role, int expectedCode) {
+    const std::int32_t processId = SpawnChild(role);
+    int status = -1;
+    if (std::strcmp(role, "child-sleep") == 0)
+        Check(waitpid_nid_postfix(processId, &status, 1) == 0);
+    Check(waitpid_nid_postfix(processId, &status, 0) == processId);
+    Check((status & 0x7f) == 0 && ((status >> 8) & 0xff) == expectedCode);
+    status = -1;
+    Check(waitpid_nid_postfix(processId, &status, 0) == -1 && *__error_nid_postfix() == 10);
+    CleanupChild();
+}
+
+static void CheckConcurrentWaiters() {
+    const std::int32_t processId = SpawnChild("child-sleep");
+    int statusA = -1;
+    int statusB = -1;
+    int errorA = 0;
+    int errorB = 0;
+    int resultA = 0;
+    int resultB = 0;
+    const auto waiter = [processId](int* status, int* error) {
+        const int result = waitpid_nid_postfix(processId, status, 0);
+        *error = *__error_nid_postfix();
+        return result;
+    };
+    std::thread threadA([&] { resultA = waiter(&statusA, &errorA); });
+    std::thread threadB([&] { resultB = waiter(&statusB, &errorB); });
+    threadA.join();
+    threadB.join();
+    const bool reapedA = resultA == processId;
+    const bool reapedB = resultB == processId;
+    Check(reapedA != reapedB);
+    const int reapedStatus = reapedA ? statusA : statusB;
+    Check((reapedStatus & 0x7f) == 0 && ((reapedStatus >> 8) & 0xff) == 43);
+    Check((reapedA ? errorB : errorA) == 10);
+    CleanupChild();
+}
+
+#ifndef _WIN32
+static void CheckStoppedChild() {
+    const std::int32_t processId = SpawnChild("child-stop");
+    int status = -1;
+    Check(waitpid_nid_postfix(processId, &status, 2) == processId);
+    Check((status & 0x7f) == 0x7f && (status >> 8) == 17);
+    Check(kill(processId, SIGCONT) == 0);
+    Check(waitpid_nid_postfix(processId, &status, 4) == processId && status == 0x13);
+    Check(waitpid_nid_postfix(processId, &status, 0) == processId);
+    Check((status & 0x7f) == 0 && ((status >> 8) & 0xff) == 44);
+    Check(waitpid_nid_postfix(processId, &status, 0) == -1 && *__error_nid_postfix() == 10);
+    CleanupChild();
+}
+
+static void CheckKilledChild(const char* role, int guestSignal) {
+    const std::int32_t processId = SpawnChild(role);
+    int status = -1;
+    Check(waitpid_nid_postfix(processId, &status, 0) == processId);
+    Check((status & 0x7f) == guestSignal);
+    Check(waitpid_nid_postfix(processId, &status, 0) == -1 && *__error_nid_postfix() == 10);
+    CleanupChild();
+}
+#else
+static void CheckTerminatedChild(const char* role, unsigned code, int guestSignal) {
+    const std::int32_t processId = SpawnChild(role);
+    const HANDLE process = OpenProcess(PROCESS_TERMINATE, FALSE, static_cast<DWORD>(processId));
+    Check(process != nullptr);
+    Check(TerminateProcess(process, code) != 0);
+    CloseHandle(process);
+    int status = -1;
+    Check(waitpid_nid_postfix(processId, &status, 0) == processId);
+    Check(code == 0xFFFFFFFFu ? ((status & 0x7f) == 0 && ((status >> 8) & 0xff) == 255)
+                              : ((status & 0x7f) == guestSignal && (status & 0x80) == 0));
+    Check(waitpid_nid_postfix(processId, &status, 0) == -1 && *__error_nid_postfix() == 10);
+    CleanupChild();
+}
+#endif
+
 int main() {
+    if (const char* role = std::getenv("ANYPS5_POSIX_SPAWN_ROLE")) {
+        if (std::strcmp(role, "child-exit-42") == 0) std::_Exit(42);
+        if (std::strcmp(role, "child-exit-neg") == 0) std::exit(-1);
+#ifndef _WIN32
+        if (std::strcmp(role, "child-stop") == 0) {
+            std::raise(SIGSTOP);
+            std::_Exit(44);
+        }
+        if (std::strcmp(role, "child-kill-bus") == 0) std::raise(SIGBUS);
+        if (std::strcmp(role, "child-kill-sys") == 0) std::raise(SIGSYS);
+#endif
+        if (std::strcmp(role, "child-sleep") == 0) {
+            std::this_thread::sleep_for(std::chrono::milliseconds(250));
+            std::_Exit(43);
+        }
+        if (std::strcmp(role, "child-laze") == 0) {
+            std::this_thread::sleep_for(std::chrono::seconds(30));
+            std::_Exit(47);
+        }
+        std::_Exit(99);
+    }
     CheckAttributes();
     CheckFileActions();
     CheckSpawn();
+    CheckSpawnedChild("child-exit-42", 42);
+    CheckSpawnedChild("child-sleep", 43);
+    CheckSpawnedChild("child-exit-neg", 255);
+    CheckConcurrentWaiters();
+#ifndef _WIN32
+    CheckStoppedChild();
+    CheckKilledChild("child-kill-bus", 10);
+    CheckKilledChild("child-kill-sys", 12);
+#else
+    CheckTerminatedChild("child-laze", 0xC0000005u, 11);
+    CheckTerminatedChild("child-laze", 0xC0000096u, 4);
+    CheckTerminatedChild("child-laze", 0x80000003u, 5);
+    CheckTerminatedChild("child-laze", 0xC0000094u, 8);
+    CheckTerminatedChild("child-laze", 0xC0000409u, 6);
+    CheckTerminatedChild("child-laze", 0xFFFFFFFFu, 0);
+#endif
 }
diff --git a/core/libs/tests/GuestPosixThreadName.cpp b/core/libs/tests/GuestPosixThreadName.cpp
new file mode 100644
index 0000000000..05f284f0db
--- /dev/null
+++ b/core/libs/tests/GuestPosixThreadName.cpp
@@ -0,0 +1,46 @@
+#include "SceTypes.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include <array>
+#include <cstdlib>
+#include <cstring>
+#include <string>
+
+static constexpr int GUEST_EINVAL = 22;
+static constexpr int GUEST_ENAMETOOLONG = 63;
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static std::string ReadName(Pthread thread) {
+    std::array<char, 64> buffer{};
+    buffer.fill(0x55);
+    Require(pthread_getname_np_nid_postfix(thread, buffer.data()) == 0);
+    return std::string(buffer.data());
+}
+
+static void RequireStored(Pthread thread, const std::string& name) {
+    Require(ReadName(thread) == name);
+}
+
+int main() {
+    const Pthread self = pthread_self_nid_postfix();
+    RequireStored(self, "");
+
+    Require(pthread_setname_np_nid_postfix(self, "webkit") == 0);
+    RequireStored(self, "webkit");
+
+    Require(pthread_setname_np_nid_postfix(self, "") == 0);
+    RequireStored(self, "");
+
+    Require(pthread_setname_np_nid_postfix(self, nullptr) == GUEST_EINVAL);
+    Require(pthread_setname_np_nid_postfix(nullptr, "name") == GUEST_EINVAL);
+
+    const std::string longest(31, 'b');
+    Require(pthread_setname_np_nid_postfix(self, longest.c_str()) == 0);
+    RequireStored(self, longest);
+
+    const std::string tooLong(32, 'c');
+    Require(pthread_setname_np_nid_postfix(self, tooLong.c_str()) == GUEST_ENAMETOOLONG);
+    RequireStored(self, longest);
+    return 0;
+}
diff --git a/core/libs/tests/GuestPosixWrap.cpp b/core/libs/tests/GuestPosixWrap.cpp
new file mode 100644
index 0000000000..5eff3c0b04
--- /dev/null
+++ b/core/libs/tests/GuestPosixWrap.cpp
@@ -0,0 +1,80 @@
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libc/include/RemoveTree.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <source_location>
+#include <string>
+
+namespace {
+
+constexpr int Enoent = 2;
+constexpr int Ebadf = 9;
+constexpr int Eexist = 17;
+constexpr int Einval = 22;
+constexpr std::uint32_t Unchanged = 0xffffffffu;
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "WebKit wrapper check failed at line %u (guest errno %d)\n", location.line(), *__error_nid_postfix());
+        std::abort();
+    }
+}
+
+bool Fails(std::int64_t result, int error) {
+    return result == -1 && *__error_nid_postfix() == error;
+}
+
+}
+
+int main() {
+    const auto root = std::filesystem::path("anyps5-posix-wrap-test-" +
+        std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directory(root));
+    const auto file = (root / "data.bin").string();
+    std::ofstream(file, std::ios::binary) << "abcdefgh";
+    const auto missing = (root / "missing").string();
+
+    const int descriptor = open_nid_postfix(file.c_str(), 0, 0);
+    Require(descriptor >= 0);
+    Require(__wrap_fchown(descriptor, Unchanged, Unchanged) == 0);
+    Require(close_nid_postfix(descriptor) == 0);
+    Require(Fails(__wrap_fchown(-1, Unchanged, Unchanged), Ebadf));
+
+    const auto linked = (root / "linked.bin").string();
+    Require(__wrap_link(file.c_str(), linked.c_str()) == 0 && std::filesystem::hard_link_count(file) == 2);
+    Require(Fails(__wrap_link(file.c_str(), linked.c_str()), Eexist));
+    Require(Fails(__wrap_link(missing.c_str(), (root / "other.bin").string().c_str()), Enoent));
+
+    char target[64] = {};
+    Require(Fails(__wrap_readlink(file.c_str(), target, sizeof(target)), Einval));
+    Require(Fails(__wrap_readlink(missing.c_str(), target, sizeof(target)), Enoent));
+
+    LibcStatvfs wrapped{};
+    LibcStatvfs plain{};
+    Require(__wrap_statvfs(root.string().c_str(), &wrapped) == 0 && statvfs_nid_postfix(root.string().c_str(), &plain) == 0);
+    Require(wrapped.f_bsize != 0 && wrapped.f_bsize == plain.f_bsize && wrapped.f_namemax == plain.f_namemax && wrapped.f_fsid == plain.f_fsid);
+    Require(Fails(__wrap_statvfs(missing.c_str(), &wrapped), Enoent));
+
+    Require(Fails(__wrap_symlink("data.bin", linked.c_str()), Eexist));
+    const auto symbolic = (root / "symbolic").string();
+    if (__wrap_symlink("data.bin", symbolic.c_str()) == 0) {
+        FileStat status{};
+        Require(__wrap_readlink(symbolic.c_str(), target, sizeof(target)) == 8 && std::memcmp(target, "data.bin", 8) == 0);
+        Require(lstat_nid_postfix(symbolic.c_str(), &status) == 0 && (status.st_mode & 0170000) == 0120000);
+    }
+
+    std::error_code error;
+    RemoveTree(root, error);
+    return 0;
+}
diff --git a/core/libs/tests/GuestProcessArguments.cpp b/core/libs/tests/GuestProcessArguments.cpp
index fa0f5584b8..d32233f67b 100644
--- a/core/libs/tests/GuestProcessArguments.cpp
+++ b/core/libs/tests/GuestProcessArguments.cpp
@@ -1,11 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" int APS5_VABI getargc_nid_postfix(void);
-extern "C" const char** APS5_VABI getargv_nid_postfix(void);
-
 static void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/tests/GuestProgramName.cpp b/core/libs/tests/GuestProgramName.cpp
index 48be372cc8..7436649aa5 100644
--- a/core/libs/tests/GuestProgramName.cpp
+++ b/core/libs/tests/GuestProgramName.cpp
@@ -1,11 +1,13 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <cstring>
 
 extern "C" {
-const char* APS5_VABI getprogname_nid_postfix();
+
 extern const char* __progname_nid_postfix;
-int* APS5_VABI __error_nid_postfix();
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -14,12 +16,14 @@ int main() {
     const char* const original = __progname_nid_postfix;
     *__error_nid_postfix() = 45;
     Require(getprogname_nid_postfix() == original);
+    Require(_getprogname_nid_postfix() == original);
     Require(std::strcmp(getprogname_nid_postfix(), "eboot.bin") == 0);
     Require(*__error_nid_postfix() == 45);
 
     char renamed[] = "quake2";
     __progname_nid_postfix = renamed;
     Require(getprogname_nid_postfix() == renamed);
+    Require(_getprogname_nid_postfix() == renamed);
     renamed[0] = 'Q';
     Require(std::strcmp(getprogname_nid_postfix(), "Quake2") == 0);
 
diff --git a/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp b/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp
index 27f0e6dff8..f3f512f138 100644
--- a/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp
+++ b/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp
@@ -1,17 +1,10 @@
+#include "prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceProprietaryVoiceChatHelperInitialize();
-int APS5_VABI sceProprietaryVoiceChatHelperTerminate();
-int APS5_VABI sceProprietaryVoiceChatHelperSetVoiceChatState();
-int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChatUsageState();
-int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChat();
-}
-
 static void Require(bool value, const char* what) {
     if (value) return;
     std::printf("ProprietaryVoiceChatHelper: %s\n", what);
diff --git a/core/libs/tests/GuestProtectionReport.cpp b/core/libs/tests/GuestProtectionReport.cpp
index 87a3d29b52..00bf0c9ab7 100644
--- a/core/libs/tests/GuestProtectionReport.cpp
+++ b/core/libs/tests/GuestProtectionReport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
@@ -5,17 +6,6 @@
 #include <cstdlib>
 #include <exception>
 
-extern "C" {
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(std::uint64_t, std::size_t);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
-int APS5_VABI sceKernelQueryMemoryProtection(void*, void**, void**, int*);
-}
-
 namespace {
 
 constexpr std::size_t Page = 0x4000;
diff --git a/core/libs/tests/GuestPsml.cpp b/core/libs/tests/GuestPsml.cpp
index 882a4b5d04..d2cc7925b7 100644
--- a/core/libs/tests/GuestPsml.cpp
+++ b/core/libs/tests/GuestPsml.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePsml_debug/libScePsml_debug.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -7,28 +8,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement1100(void* requirement, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateContext1100(void** context, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1100(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement800M3_2(void* requirement, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateContext800M3_2(void** context, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateContext1300(void** context, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket900(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1000(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1300(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrInit();
-std::int32_t APS5_VABI scePsmlMfsrGetSharedResourcesInitRequirement(void* requirement, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateSharedResources(void** sharedResources, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrReleaseSharedResources(void* sharedResources);
-std::int32_t APS5_VABI scePsmlMfsrReleaseContext(void* context);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacketSizeInDwords(void* context, std::uint32_t* packetSizeInDwords);
-std::int32_t APS5_VABI scePsmlMfsrSelectConfig(void* config);
-std::int32_t APS5_VABI scePsmlMfsrGetMipmapBias(void* context, float* bias, std::uint32_t dimension);
-std::int32_t APS5_VABI scePsmlMfsrRequestCapture(void* context);
-std::int32_t APS5_VABI scePsmlMfsrIsCaptureInProgress(void* context);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -37,20 +16,15 @@ constexpr std::int32_t kErrNotInitialized = static_cast<std::int32_t>(0x8A810001
 constexpr std::int32_t kErrInvalidArgument = static_cast<std::int32_t>(0x8A810005);
 constexpr std::int32_t kErrNullOutput = static_cast<std::int32_t>(0x8A810009);
 
-struct CommandBuffer {
-    std::uint32_t* cursor;
-    std::uint32_t sizeInDwords;
-};
-
-using CreateContext = std::int32_t (APS5_VABI*)(void**, const void*);
 using GetDispatchPacket = std::int32_t (APS5_VABI*)(void*, void*, const void*);
 
-void CreateContextUntouched(CreateContext create) {
+template <typename TParam>
+void CreateContextUntouched(std::int32_t (APS5_VABI* create)(void**, const TParam*)) {
     std::array<std::uint8_t, 0x158> param{};
     std::uint64_t contextStorage = 0;
     void* const sentinel = &contextStorage;
     void* context = sentinel;
-    Require(create(&context, param.data()) == kErrNotInitialized);
+    Require(create(&context, reinterpret_cast<const TParam*>(param.data())) == kErrNotInitialized);
     Require(context == sentinel);
     Require(create(nullptr, nullptr) == kErrNotInitialized);
 }
@@ -61,7 +35,7 @@ void DispatchPacketUntouched(GetDispatchPacket dispatch) {
     std::array<std::uint32_t, 64> dwords;
     dwords.fill(0xa5a5a5a5u);
     const auto untouchedDwords = dwords;
-    CommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
+    MfsrCommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
     Require(dispatch(&contextStorage, &commandBuffer, param.data()) == kErrNotInitialized);
     Require(dispatch(nullptr, &commandBuffer, nullptr) == kErrNotInitialized);
     Require(commandBuffer.cursor == dwords.data());
@@ -79,29 +53,10 @@ bool Throws(TCall call, const char* text) {
     return false;
 }
 
-struct Requirement {
-    std::uint64_t blockBytes;
-    std::uint64_t alignment;
-    std::uint64_t blockCount;
-};
-
-struct Block {
-    std::uint64_t address;
-    std::uint64_t bytes;
-};
-
-struct SharedParam {
-    std::uint32_t type;
-    std::uint32_t reserved;
-    const Block* blocks;
-    std::uint64_t blockCount;
-    std::uint64_t reserved2;
-};
-
 struct ContextParam {
     std::array<std::uint8_t, 0x60> bytes{};
 
-    void Set(const Block* blocks, std::uint64_t count, void* shared) {
+    void Set(const MfsrBlock* blocks, std::uint64_t count, void* shared) {
         std::memcpy(bytes.data() + 0x08, &blocks, sizeof(blocks));
         std::memcpy(bytes.data() + 0x10, &count, sizeof(count));
         std::memcpy(bytes.data() + 0x38, &shared, sizeof(shared));
@@ -117,8 +72,8 @@ struct ContextParam {
     }
 };
 
-std::vector<Block> Blocks(const Requirement& requirement, std::uint64_t first) {
-    std::vector<Block> blocks(requirement.blockCount);
+std::vector<MfsrBlock> Blocks(const MfsrRequirement& requirement, std::uint64_t first) {
+    std::vector<MfsrBlock> blocks(requirement.blockCount);
     for (std::size_t i = 0; i < blocks.size(); ++i) blocks[i] = {first + i * requirement.blockBytes, requirement.blockBytes};
     return blocks;
 }
@@ -127,8 +82,8 @@ void SetupBeforeInit() {
     std::uint64_t storage = 0;
     void* const sentinel = &storage;
     void* handle = sentinel;
-    Requirement requirement{1, 2, 3};
-    SharedParam sharedParam{};
+    MfsrRequirement requirement{1, 2, 3};
+    MfsrSharedResourcesParam sharedParam{};
     Require(scePsmlMfsrGetSharedResourcesInitRequirement(&requirement, &sharedParam) == kErrNotInitialized);
     Require(requirement.blockBytes == 1 && requirement.alignment == 2 && requirement.blockCount == 3);
     Require(scePsmlMfsrCreateSharedResources(&handle, &sharedParam) == kErrNotInitialized);
@@ -151,8 +106,8 @@ void SetupAfterInit() {
     Require(scePsmlMfsrInit() == 0);
     Require(scePsmlMfsrInit() == 0);
 
-    SharedParam sharedParam{};
-    Requirement shared{};
+    MfsrSharedResourcesParam sharedParam{};
+    MfsrRequirement shared{};
     Require(scePsmlMfsrGetSharedResourcesInitRequirement(&shared, &sharedParam) == 0);
     Require(shared.blockBytes == 0x200000 && shared.alignment == 0x200000 && shared.blockCount == 52);
 
@@ -165,14 +120,14 @@ void SetupAfterInit() {
 
     ContextParam contextParam;
     contextParam.Set(nullptr, 0, sharedResources);
-    Requirement context{};
-    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(&context, contextParam.bytes.data()) == 0);
+    MfsrRequirement context{};
+    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(&context, reinterpret_cast<const MfsrContextParam*>(contextParam.bytes.data())) == 0);
     Require(context.blockBytes == 0x200000 && context.alignment == 0x200000 && context.blockCount == 4);
 
     const auto contextBlocks = Blocks(context, 0x20000000);
     contextParam.Set(contextBlocks.data(), contextBlocks.size(), sharedResources);
     void* mfsrContext = nullptr;
-    Require(scePsmlMfsrCreateContext800M3_2(&mfsrContext, contextParam.bytes.data()) == 0);
+    Require(scePsmlMfsrCreateContext800M3_2(&mfsrContext, reinterpret_cast<const MfsrContextParam*>(contextParam.bytes.data())) == 0);
     Require(mfsrContext != nullptr && mfsrContext != sharedResources);
 
     std::uint32_t packetDwords = 0;
@@ -202,7 +157,7 @@ void SetupAfterInit() {
     dimensionsParam.Set(contextBlocks.data(), contextBlocks.size(), sharedResources);
     dimensionsParam.SetInputDimensions(1920, 1080);
     void* dimensionContext = nullptr;
-    Require(scePsmlMfsrCreateContext800M3_2(&dimensionContext, dimensionsParam.bytes.data()) == 0);
+    Require(scePsmlMfsrCreateContext800M3_2(&dimensionContext, reinterpret_cast<const MfsrContextParam*>(dimensionsParam.bytes.data())) == 0);
     Require(scePsmlMfsrGetMipmapBias(dimensionContext, &bias, 3840) == 0);
     Require(bias == 0.0f);
     Require(scePsmlMfsrGetMipmapBias(dimensionContext, &bias, 1920) == 0);
@@ -218,7 +173,7 @@ void SetupAfterInit() {
     descriptorParam.Set(contextBlocks.data(), contextBlocks.size(), sharedResources);
     descriptorParam.SetDescriptor0(descriptor.data());
     void* descriptorContext = nullptr;
-    Require(scePsmlMfsrCreateContext800M3_2(&descriptorContext, descriptorParam.bytes.data()) == 0);
+    Require(scePsmlMfsrCreateContext800M3_2(&descriptorContext, reinterpret_cast<const MfsrContextParam*>(descriptorParam.bytes.data())) == 0);
     Require(scePsmlMfsrGetMipmapBias(descriptorContext, &bias, 2560) == 0);
     Require(bias == 0.0f);
     Require(scePsmlMfsrReleaseContext(descriptorContext) == 0);
@@ -230,9 +185,47 @@ void SetupAfterInit() {
     Require(scePsmlMfsrReleaseSharedResources(sharedResources) == 0);
 }
 
+void Mfsr2OnBaseConsole() {
+    constexpr std::int32_t notInitialized = static_cast<std::int32_t>(0x8A8A0001);
+    constexpr std::int32_t unsupportedConsole = static_cast<std::int32_t>(0x8A8A0012);
+    Require(scePsmlMfsr2Init() == unsupportedConsole);
+    Require(scePsmlMfsr2Init() == unsupportedConsole);
+
+    std::array<std::uint8_t, 0x30> param{};
+    std::array<std::uint8_t, 0x18> requirement;
+    requirement.fill(0xa5);
+    const auto untouchedRequirement = requirement;
+    Require(scePsmlMfsr2GetSharedResourcesInitRequirement(reinterpret_cast<MfsrRequirement*>(requirement.data()), reinterpret_cast<const Mfsr2SharedResourcesParam*>(param.data())) == notInitialized);
+    Require(scePsmlMfsr2GetContextInitRequirement(reinterpret_cast<MfsrRequirement*>(requirement.data()), reinterpret_cast<const Mfsr2ContextParam*>(param.data())) == notInitialized);
+    Require(requirement == untouchedRequirement);
+
+    std::uint64_t storage = 0;
+    void* const sentinel = &storage;
+    void* handle = sentinel;
+    Require(scePsmlMfsr2CreateSharedResources(&handle, reinterpret_cast<const Mfsr2SharedResourcesParam*>(param.data())) == notInitialized);
+    Require(scePsmlMfsr2CreateContext(&handle, reinterpret_cast<const Mfsr2ContextParam*>(param.data())) == notInitialized);
+    Require(handle == sentinel);
+    Require(scePsmlMfsr2ReleaseContext(sentinel) == notInitialized);
+    Require(scePsmlMfsr2ReleaseSharedResources(sentinel) == notInitialized);
+
+    std::uint32_t packetDwords = 0xa5a5a5a5;
+    Require(scePsmlMfsr2GetDispatchPacketsSizeInDwords(sentinel, &packetDwords) == notInitialized);
+    Require(packetDwords == 0xa5a5a5a5);
+
+    std::array<std::uint8_t, 112> dispatchParam{};
+    std::array<std::uint32_t, 64> dwords;
+    dwords.fill(0xa5a5a5a5u);
+    const auto untouchedDwords = dwords;
+    MfsrCommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
+    Require(scePsmlMfsr2GetDispatchPackets(sentinel, &commandBuffer, reinterpret_cast<const Mfsr2DispatchParam*>(dispatchParam.data())) == notInitialized);
+    Require(commandBuffer.cursor == dwords.data());
+    Require(commandBuffer.sizeInDwords == dwords.size());
+    Require(dwords == untouchedDwords);
+}
+
 void RefusedAfterInit() {
-    SharedParam sharedParam{};
-    Requirement requirement{};
+    MfsrSharedResourcesParam sharedParam{};
+    MfsrRequirement requirement{};
     sharedParam.type = 1;
     Require(Throws([&] { scePsmlMfsrGetSharedResourcesInitRequirement(&requirement, &sharedParam); }, "type 1 is not supported"));
 
@@ -254,12 +247,12 @@ void RefusedAfterInit() {
     ContextParam contextParam;
     contextParam.Set(blocks.data(), blocks.size(), &foreign);
     void* context = nullptr;
-    Require(Throws([&] { scePsmlMfsrCreateContext800M3_2(&context, contextParam.bytes.data()); }, "shared resources handle was not created"));
+    Require(Throws([&] { scePsmlMfsrCreateContext800M3_2(&context, reinterpret_cast<const MfsrContextParam*>(contextParam.bytes.data())); }, "shared resources handle was not created"));
     Require(context == nullptr);
 
     std::array<std::uint8_t, 0x158> param{};
     std::array<std::uint32_t, 64> dwords{};
-    CommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
+    MfsrCommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
     Require(Throws([&] { scePsmlMfsrGetContextBufferRequirement1100(&requirement, param.data()); }, "not implemented"));
     Require(Throws([&] { scePsmlMfsrCreateContext1300(&context, param.data()); }, "not implemented"));
     Require(Throws([&] { scePsmlMfsrGetDispatchMfsrPacket900(&foreign, &commandBuffer, param.data()); }, "not implemented"));
@@ -289,7 +282,7 @@ int main() {
     std::array<std::uint32_t, 64> dwords;
     dwords.fill(0xa5a5a5a5u);
     const auto untouchedDwords = dwords;
-    CommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
+    MfsrCommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
     Require(scePsmlMfsrGetDispatchMfsrPacket1100(&contextStorage, &commandBuffer, param.data()) == kErrNotInitialized);
     Require(commandBuffer.cursor == dwords.data());
     Require(commandBuffer.sizeInDwords == dwords.size());
@@ -301,7 +294,7 @@ int main() {
     std::array<std::uint8_t, 0x18> olderRequirement;
     olderRequirement.fill(0xa5);
     const auto untouchedOlderRequirement = olderRequirement;
-    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(olderRequirement.data(), param.data()) == kErrNotInitialized);
+    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(reinterpret_cast<MfsrRequirement*>(olderRequirement.data()), reinterpret_cast<const MfsrContextParam*>(param.data())) == kErrNotInitialized);
     Require(olderRequirement == untouchedOlderRequirement);
     Require(scePsmlMfsrGetContextBufferRequirement800M3_2(nullptr, nullptr) == kErrNotInitialized);
 
@@ -311,6 +304,7 @@ int main() {
     DispatchPacketUntouched(scePsmlMfsrGetDispatchMfsrPacket1000);
     DispatchPacketUntouched(scePsmlMfsrGetDispatchMfsrPacket1300);
     SetupBeforeInit();
+    Mfsr2OnBaseConsole();
     SetupAfterInit();
     RefusedAfterInit();
 }
diff --git a/core/libs/tests/GuestPthreadAttr.cpp b/core/libs/tests/GuestPthreadAttr.cpp
index 5afa252aa8..7e85c80984 100644
--- a/core/libs/tests/GuestPthreadAttr.cpp
+++ b/core/libs/tests/GuestPthreadAttr.cpp
@@ -1,46 +1,15 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstddef>
+#include <cstdio>
 #include <cstdlib>
 #include <future>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadSetprio(Pthread thread, int prio);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
-int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, std::size_t* stackSize);
-int APS5_VABI scePthreadAttrGetdetachstate(const PthreadAttr* attr, int* state);
-int APS5_VABI scePthreadAttrGetsolosched(const PthreadAttr* attr, int* solosched);
-int APS5_VABI pthread_attr_setstacksize_nid_postfix(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI pthread_attr_setsolosched_np_nid_postfix(PthreadAttr* attr, int solosched);
-int APS5_VABI pthread_attr_getinheritsched_nid_postfix(const PthreadAttr* attr, int* inherit_sched);
-int APS5_VABI pthread_attr_setinheritsched_nid_postfix(PthreadAttr* attr, int inherit_sched);
-int APS5_VABI pthread_attr_getscope_nid_postfix(const PthreadAttr* attr, int* scope);
-int APS5_VABI pthread_attr_setscope_nid_postfix(PthreadAttr* attr, int scope);
-int APS5_VABI pthread_attr_get_np_nid_postfix(Pthread thread, PthreadAttr* attr);
-int APS5_VABI pthread_attr_setschedparam_nid_postfix(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI pthread_attr_setschedpolicy_nid_postfix(PthreadAttr* attr, int policy);
-int APS5_VABI pthread_attr_getschedpolicy_nid_postfix(const PthreadAttr* attr, int* policy);
-int APS5_VABI scePthreadAttrSetdetachstate(PthreadAttr* attr, int state);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-Pthread APS5_VABI scePthreadSelf();
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int EXPLICIT_SCHED = 0;
 static constexpr int INHERIT_SCHED = 4;
 static constexpr int SCOPE_PROCESS = 0;
@@ -52,9 +21,9 @@ static constexpr KernelCpumask CREATION_AFFINITY = 0x3;
 static constexpr KernelCpumask UPDATED_AFFINITY = 0x1000;
 static constexpr std::size_t STACK_SIZE = 2u << 20;
 static constexpr std::size_t MIN_STACK_SIZE = 16384;
+static constexpr int GUEST_ESRCH = 3;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_ENOTSUP = 45;
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
 static constexpr int DETACH_DETACHED = 1;
 static constexpr int DETACHED_THREADS = 32;
 
@@ -67,12 +36,6 @@ struct ReportedAttributes {
     int detachState = -1;
 };
 
-extern "C" {
-int APS5_VABI pthread_attr_setstack_nid_postfix(PthreadAttr* attr, void* addr, std::size_t size);
-int APS5_VABI pthread_attr_getstack_nid_postfix(const PthreadAttr* attr, void** addr, std::size_t* size);
-int APS5_VABI pthread_attr_getstackaddr_nid_postfix(const PthreadAttr* attr, void** addr);
-}
-
 static ReportedAttributes Query(Pthread thread) {
     PthreadAttr attr = nullptr;
     Require(scePthreadAttrInit(&attr) == SCE_OK);
@@ -101,8 +64,6 @@ static void CheckStackSizeLimit() {
     Require(scePthreadAttrDestroy(&attr) == SCE_OK);
 }
 
-extern "C" int APS5_VABI scePthreadAttrSetsolosched(PthreadAttr* attr, int solosched);
-
 static void CheckSoloSched() {
     PthreadAttr attr = nullptr;
     Require(pthread_attr_setsolosched_np_nid_postfix(nullptr, 1) == GUEST_EINVAL);
@@ -207,6 +168,7 @@ static void CheckSchedulingAttributes() {
     bool threw = false;
     try {
         pthread_attr_getinheritsched_nid_postfix(&attr, nullptr);
+
     } catch (const std::exception&) {
         threw = true;
     }
@@ -266,11 +228,13 @@ static void CheckThreadScope() {
     Require(scePthreadJoin(inheritedThread, nullptr) == SCE_OK);
 }
 
-static int QueryResult(Pthread thread) {
+static int QueryResult(Pthread thread, bool posix = false) {
     PthreadAttr attr = nullptr;
     Require(scePthreadAttrInit(&attr) == SCE_OK);
     Require(scePthreadAttrSetstacksize(&attr, STACK_SIZE) == SCE_OK);
-    const int result = scePthreadAttrGet(thread, &attr);
+    *__error_nid_postfix() = 12345;
+    const int result = posix ? pthread_attr_get_np_nid_postfix(thread, &attr) : scePthreadAttrGet(thread, &attr);
+    if (posix) Require(*__error_nid_postfix() == 12345);
     std::size_t stackSize = 0;
     Require(scePthreadAttrGetstacksize(&attr, &stackSize) == SCE_OK);
     Require(result == SCE_OK || stackSize == STACK_SIZE);
@@ -278,6 +242,13 @@ static int QueryResult(Pthread thread) {
     return result;
 }
 
+static void CheckPosixQuery(Pthread thread, int expected) {
+    const int result = QueryResult(thread, true);
+    if (result == expected) return;
+    std::fprintf(stderr, "pthread_attr_get_np returned %d, expected %d\n", result, expected);
+    std::abort();
+}
+
 static bool ReportedEnded(Pthread thread) {
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
     while (QueryResult(thread) == SCE_OK) {
@@ -290,11 +261,13 @@ static bool ReportedEnded(Pthread thread) {
 struct ExitQuery {
     PthreadKey key = -1;
     int result = -1;
+    int posixResult = -1;
 };
 
 static void APS5_VABI QuerySelfAtExit(void* value) {
     auto* query = static_cast<ExitQuery*>(value);
     query->result = QueryResult(scePthreadSelf());
+    query->posixResult = QueryResult(scePthreadSelf(), true);
 }
 
 static void* APS5_VABI SetExitQuery(void* arg) {
@@ -309,22 +282,28 @@ static void* APS5_VABI Finish(void*) {
 
 static void CheckEndedThreads() {
     Require(QueryResult(scePthreadSelf()) == SCE_OK);
+    CheckPosixQuery(scePthreadSelf(), 0);
+    CheckPosixQuery(nullptr, GUEST_EINVAL);
 
     Pthread joined = nullptr;
     Require(scePthreadCreate(&joined, nullptr, Finish, nullptr, nullptr) == SCE_OK);
     Require(scePthreadJoin(joined, nullptr) == SCE_OK);
     Require(QueryResult(joined) == SCE_KERNEL_ERROR_ESRCH);
+    CheckPosixQuery(joined, GUEST_ESRCH);
     PthreadAttr unset = nullptr;
     Require(scePthreadAttrGet(joined, nullptr) == SCE_KERNEL_ERROR_EINVAL);
     Require(scePthreadAttrGet(joined, &unset) == SCE_KERNEL_ERROR_EINVAL);
+    Require(pthread_attr_get_np_nid_postfix(joined, nullptr) == GUEST_EINVAL);
+    Require(pthread_attr_get_np_nid_postfix(joined, &unset) == GUEST_EINVAL);
 
     ExitQuery exitQuery;
     Require(scePthreadKeyCreate(&exitQuery.key, reinterpret_cast<pthread_key_destructor_func_t>(QuerySelfAtExit)) == SCE_OK);
     Pthread finished = nullptr;
     Require(scePthreadCreate(&finished, nullptr, SetExitQuery, &exitQuery, nullptr) == SCE_OK);
     Require(ReportedEnded(finished));
+    CheckPosixQuery(finished, GUEST_ESRCH);
     Require(scePthreadJoin(finished, nullptr) == SCE_OK);
-    Require(exitQuery.result == SCE_OK);
+    Require(exitQuery.result == SCE_OK && exitQuery.posixResult == 0);
     Require(QueryResult(finished) == SCE_KERNEL_ERROR_ESRCH);
     Require(scePthreadKeyDelete(exitQuery.key) == SCE_OK);
 
@@ -335,6 +314,7 @@ static void CheckEndedThreads() {
         Pthread detached = nullptr;
         Require(scePthreadCreate(&detached, &detachedAttr, Finish, nullptr, nullptr) == SCE_OK);
         Require(ReportedEnded(detached));
+        CheckPosixQuery(detached, GUEST_ESRCH);
     }
     Require(scePthreadAttrDestroy(&detachedAttr) == SCE_OK);
 }
diff --git a/core/libs/tests/GuestPthreadAttrErrors.cpp b/core/libs/tests/GuestPthreadAttrErrors.cpp
index 06c2e15832..97636eb722 100644
--- a/core/libs/tests/GuestPthreadAttrErrors.cpp
+++ b/core/libs/tests/GuestPthreadAttrErrors.cpp
@@ -1,29 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, std::size_t* stackSize);
-int APS5_VABI scePthreadAttrSetdetachstate(PthreadAttr* attr, int state);
-int APS5_VABI scePthreadAttrGetdetachstate(const PthreadAttr* attr, int* state);
-int APS5_VABI scePthreadAttrSetschedpolicy(PthreadAttr* attr, int policy);
-int APS5_VABI scePthreadAttrGetschedpolicy(const PthreadAttr* attr, int* policy);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrGetinheritsched(const PthreadAttr* attr, int* inheritSched);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
-static constexpr int SCE_KERNEL_ERROR_EOPNOTSUPP = static_cast<int>(0x8002002Du);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
diff --git a/core/libs/tests/GuestPthreadAttrStack.cpp b/core/libs/tests/GuestPthreadAttrStack.cpp
index faf907527a..4193f08fe6 100644
--- a/core/libs/tests/GuestPthreadAttrStack.cpp
+++ b/core/libs/tests/GuestPthreadAttrStack.cpp
@@ -1,19 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** stackAddress, std::size_t* stackSize);
-int APS5_VABI scePthreadAttrGetstackaddr(const PthreadAttr* attr, void** stackAddress);
-int APS5_VABI scePthreadAttrGetguardsize(const PthreadAttr* attr, std::size_t* guardSize);
-int APS5_VABI scePthreadAttrSetguardsize(PthreadAttr* attr, std::size_t guardSize);
-int APS5_VABI scePthreadAttrSetstack(PthreadAttr* attr, void* stackAddress, std::size_t stackSize);
-int APS5_VABI scePthreadAttrSetstackaddr(PthreadAttr* attr, void* stackAddress);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int SceEinval = static_cast<int>(0x80020016u);
 static constexpr std::size_t DefaultStackSize = 1u << 20;
diff --git a/core/libs/tests/GuestPthreadBarrier.cpp b/core/libs/tests/GuestPthreadBarrier.cpp
index 163c97b14c..3b314e9430 100644
--- a/core/libs/tests/GuestPthreadBarrier.cpp
+++ b/core/libs/tests/GuestPthreadBarrier.cpp
@@ -1,24 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
 #include <cstdlib>
 #include <stdexcept>
 
-struct GuestBarrier;
-struct GuestBarrierattr;
-
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_barrierattr_init_nid_postfix(GuestBarrierattr** attr);
-int APS5_VABI pthread_barrierattr_destroy_nid_postfix(GuestBarrierattr** attr);
-int APS5_VABI pthread_barrierattr_getpshared_nid_postfix(GuestBarrierattr* const* attr, int* pshared);
-int APS5_VABI pthread_barrierattr_setpshared_nid_postfix(GuestBarrierattr** attr, int pshared);
-int APS5_VABI pthread_barrier_init_nid_postfix(GuestBarrier** barrier, GuestBarrierattr* const* attr, unsigned count);
-int APS5_VABI pthread_barrier_wait_nid_postfix(GuestBarrier** barrier);
-int APS5_VABI pthread_barrier_destroy_nid_postfix(GuestBarrier** barrier);
-}
-
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int PROCESS_PRIVATE = 0;
 static constexpr int PROCESS_SHARED = 1;
@@ -28,7 +14,7 @@ static constexpr unsigned WAITERS = 4;
 static void Require(bool value) { if (!value) std::abort(); }
 
 struct Context {
-    GuestBarrier* barrier = nullptr;
+    PthreadBarrierPrivate* barrier = nullptr;
     std::atomic<int> serial{0};
     std::atomic<int> released{0};
 };
@@ -57,7 +43,7 @@ static void RunWaiters(Context& context) {
 }
 
 int main() {
-    GuestBarrierattr* missing = nullptr;
+    PthreadBarrierattrPrivate* missing = nullptr;
     int pshared = -1;
     Require(pthread_barrierattr_init_nid_postfix(nullptr) == GUEST_EINVAL);
     Require(pthread_barrierattr_destroy_nid_postfix(nullptr) == GUEST_EINVAL);
@@ -68,7 +54,7 @@ int main() {
     Require(pthread_barrierattr_setpshared_nid_postfix(&missing, PROCESS_PRIVATE) == GUEST_EINVAL);
     Require(pshared == -1);
 
-    GuestBarrierattr* attr = nullptr;
+    PthreadBarrierattrPrivate* attr = nullptr;
     Require(pthread_barrierattr_init_nid_postfix(&attr) == 0 && attr != nullptr);
     Require(pthread_barrierattr_getpshared_nid_postfix(&attr, &pshared) == 0 && pshared == PROCESS_PRIVATE);
     Require(pthread_barrierattr_setpshared_nid_postfix(&attr, 2) == GUEST_EINVAL);
@@ -88,7 +74,7 @@ int main() {
     catch (const std::invalid_argument&) { rejected = true; }
     Require(rejected);
 
-    GuestBarrier* invalid = nullptr;
+    PthreadBarrierPrivate* invalid = nullptr;
     Require(pthread_barrier_init_nid_postfix(nullptr, &attr, 1) == GUEST_EINVAL);
     Require(pthread_barrier_init_nid_postfix(&invalid, &attr, 0) == GUEST_EINVAL && invalid == nullptr);
     Require(pthread_barrier_init_nid_postfix(&invalid, &attr, 0x80000000u) == GUEST_EINVAL && invalid == nullptr);
@@ -120,7 +106,7 @@ int main() {
         Require(destroyed.serial == 1);
     }
 
-    GuestBarrier* single = nullptr;
+    PthreadBarrierPrivate* single = nullptr;
     Require(pthread_barrierattr_init_nid_postfix(&attr) == 0);
     Require(pthread_barrier_init_nid_postfix(&single, &attr, 1) == 0);
     Require(pthread_barrier_wait_nid_postfix(&single) == BARRIER_SERIAL_THREAD);
diff --git a/core/libs/tests/GuestPthreadCancel.cpp b/core/libs/tests/GuestPthreadCancel.cpp
index 81cc47ebde..9309d74dae 100644
--- a/core/libs/tests/GuestPthreadCancel.cpp
+++ b/core/libs/tests/GuestPthreadCancel.cpp
@@ -1,3 +1,10 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -5,42 +12,7 @@
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-void APS5_VABI scePthreadExit(void* retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* old_state);
-int APS5_VABI scePthreadSetcanceltype(int type, int* old_type);
-void APS5_VABI scePthreadTestcancel();
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
-int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
-int APS5_VABI scePthreadSemWait(PthreadSem* sem);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-int APS5_VABI pthread_cancel_nid_postfix(Pthread thread);
-int APS5_VABI pthread_setcanceltype_nid_postfix(int type, int* old_type);
-int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value);
-int APS5_VABI sem_destroy_nid_postfix(void* sem);
-int APS5_VABI sem_wait_nid_postfix(void* sem);
-int APS5_VABI sem_timedwait_nid_postfix(void* sem, const KernelTimespec* abstime);
-int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value);
-void APS5_VABI __pthread_cleanup_push_imp_nid_postfix(void (APS5_VABI* routine)(void*), void* argument, void* info);
-void APS5_VABI __pthread_cleanup_pop_imp_nid_postfix(int execute);
-void APS5_VABI pthread_cleanup_push_nid_postfix(void (APS5_VABI* routine)(void*), void* argument);
-void APS5_VABI pthread_cleanup_pop_nid_postfix(int execute);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int GUEST_ESRCH = 3;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int CANCEL_ENABLE = 0;
@@ -80,6 +52,7 @@ static void* APS5_VABI CondWaiter(void*) {
     std::uintptr_t info[8];
     Require(scePthreadMutexLock(&shared.mutex) == SCE_OK);
     __pthread_cleanup_push_imp_nid_postfix(UnlockMutex, nullptr, info);
+
     shared.ready.store(true);
     for (;;) Require(scePthreadCondWait(&shared.cond, &shared.mutex) == SCE_OK);
 }
@@ -87,6 +60,7 @@ static void* APS5_VABI CondWaiter(void*) {
 static void* APS5_VABI SemWaiter(void*) {
     shared.ready.store(true);
     scePthreadSemWait(&shared.sem);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -94,6 +68,7 @@ static void* APS5_VABI SemWaiter(void*) {
 static void* APS5_VABI PosixSemWaiter(void*) {
     shared.ready.store(true);
     sem_wait_nid_postfix(&shared.posixSem);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -144,6 +119,7 @@ static void* APS5_VABI Idler(void*) {
 static void* APS5_VABI Joiner(void*) {
     shared.ready.store(true);
     scePthreadJoin(shared.target, nullptr);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -160,10 +136,12 @@ static void* APS5_VABI Disabled(void*) {
     while (!shared.release.load()) {
         sceKernelUsleep_nid_postfix(1000);
         scePthreadTestcancel();
+
     }
     shared.survived.store(true);
     Require(scePthreadSetcancelstate(CANCEL_ENABLE, &old) == SCE_OK && old == CANCEL_DISABLE);
     scePthreadTestcancel();
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -175,6 +153,7 @@ static void* APS5_VABI Asynchronous(void*) {
     shared.ready.store(true);
     while (!shared.release.load()) std::this_thread::sleep_for(std::chrono::milliseconds(1));
     scePthreadSetcancelstate(CANCEL_ENABLE, nullptr);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -185,8 +164,10 @@ static void* APS5_VABI Handlers(void*) {
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{1}), first);
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{2}), second);
     __pthread_cleanup_pop_imp_nid_postfix(0);
+
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{3}), second);
     __pthread_cleanup_pop_imp_nid_postfix(1);
+
     scePthreadExit(reinterpret_cast<void*>(std::intptr_t{7}));
     return nullptr;
 }
@@ -196,8 +177,10 @@ static void* APS5_VABI HeapHandlers(void*) {
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{1}), first);
     pthread_cleanup_push_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{2}));
     pthread_cleanup_pop_nid_postfix(0);
+
     pthread_cleanup_push_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{3}));
     __pthread_cleanup_pop_imp_nid_postfix(1);
+
     pthread_cleanup_push_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{4}));
     scePthreadExit(reinterpret_cast<void*>(std::intptr_t{8}));
     return nullptr;
diff --git a/core/libs/tests/GuestPthreadCancelRecovery.cpp b/core/libs/tests/GuestPthreadCancelRecovery.cpp
index 297f761a92..e7f647ad7c 100644
--- a/core/libs/tests/GuestPthreadCancelRecovery.cpp
+++ b/core/libs/tests/GuestPthreadCancelRecovery.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <array>
@@ -17,46 +22,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* oldState);
-int APS5_VABI scePthreadSetcanceltype(int type, int* oldType);
-void APS5_VABI scePthreadTestcancel();
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, KernelUseconds usec);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* time);
-int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
-int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
-int APS5_VABI scePthreadSemWait(PthreadSem* sem);
-int APS5_VABI scePthreadSemTimedwait(PthreadSem* sem, KernelUseconds usec);
-int APS5_VABI scePthreadSemGetvalue(PthreadSem* sem, int* value);
-int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value);
-int APS5_VABI sem_destroy_nid_postfix(void* sem);
-int APS5_VABI sem_wait_nid_postfix(void* sem);
-int APS5_VABI sem_reltimedwait_np_nid_postfix(void* sem, std::uint32_t usec);
-int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-void APS5_VABI __pthread_cleanup_push_imp_nid_postfix(void (APS5_VABI* routine)(void*), void* argument, void* info);
-void APS5_VABI __pthread_cleanup_pop_imp_nid_postfix(int execute);
-}
-
 static constexpr int CANCEL_ENABLE = 0;
 static constexpr int CANCEL_DISABLE = 1;
 static constexpr int CANCEL_DEFERRED = 0;
@@ -121,6 +86,7 @@ static void APS5_VABI Record(void* value) {
 static void APS5_VABI CleanupWithPoints(void*) {
     Record(reinterpret_cast<void*>(std::uintptr_t{2}));
     scePthreadTestcancel();
+
     Require(sceKernelUsleep_nid_postfix(1) == 0);
     Record(reinterpret_cast<void*>(std::uintptr_t{3}));
 }
@@ -150,6 +116,7 @@ static void* APS5_VABI PendingToken(void*) {
     Require(scePthreadSetspecific(key, &normalResult) == 0);
     __pthread_cleanup_push_imp_nid_postfix(Record, reinterpret_cast<void*>(std::uintptr_t{1}), first);
     __pthread_cleanup_push_imp_nid_postfix(CleanupWithPoints, nullptr, second);
+
     Gate();
     WaitForToken();
     returned = true;
@@ -161,6 +128,7 @@ static void CheckDefaults() {
     Require(scePthreadSetcancelstate(CANCEL_ENABLE, &old) == 0 && old == CANCEL_ENABLE);
     Require(scePthreadSetcanceltype(CANCEL_DEFERRED, &old) == 0 && old == CANCEL_DEFERRED);
     scePthreadTestcancel();
+
 }
 
 static void* APS5_VABI ConsumeToken(void*) {
@@ -198,17 +166,21 @@ static void* APS5_VABI ConditionWaiter(void*) {
     Require(scePthreadMutexLock(&mutex) == 0);
     std::uintptr_t info[8];
     __pthread_cleanup_push_imp_nid_postfix(Unlock, nullptr, info);
+
     Signal(ready);
     while (!conditionReleased) Require(scePthreadCondTimedwait(&cond, &mutex, WAIT_MICROSECONDS) == 0);
     Require(scePthreadMutexUnlock(&mutex) == 0);
     __pthread_cleanup_pop_imp_nid_postfix(0);
+
     if (disabled) {
         stage = 1;
         scePthreadTestcancel();
+
         int old = -1;
         Require(scePthreadSetcancelstate(CANCEL_ENABLE, &old) == 0 && old == CANCEL_DISABLE);
         stage = 2;
         scePthreadTestcancel();
+
     }
     returned = true;
     return &normalResult;
@@ -279,6 +251,7 @@ static void* APS5_VABI SignaledConditionWaiter(void* value) {
     for (int level = 0; level < context.lockCount; ++level) Require(scePthreadMutexLock(&context.mutex) == 0);
     std::uintptr_t cleanup[8];
     __pthread_cleanup_push_imp_nid_postfix(UnlockSignaledCondition, &worker, cleanup);
+
     context.ready.fetch_add(1);
     int result = 0;
     do {
@@ -303,6 +276,7 @@ static void* APS5_VABI SignaledConditionWaiter(void* value) {
     } while (result == 0 && !context.released);
     context.results[worker.index] = result;
     __pthread_cleanup_pop_imp_nid_postfix(1);
+
     return nullptr;
 }
 
diff --git a/core/libs/tests/GuestPthreadCondSetname.cpp b/core/libs/tests/GuestPthreadCondSetname.cpp
new file mode 100644
index 0000000000..7d508abebb
--- /dev/null
+++ b/core/libs/tests/GuestPthreadCondSetname.cpp
@@ -0,0 +1,39 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdlib>
+#include <stdexcept>
+
+static constexpr int GuestEinval = 22;
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+template <class TCall>
+static bool ThrowsInvalidArgument(TCall call) {
+    try {
+        call();
+    } catch (const std::invalid_argument&) {
+        return true;
+    }
+    return false;
+}
+
+int main() {
+    PthreadCond cond = nullptr;
+    Require(pthread_cond_init_nid_postfix(&cond, nullptr) == 0);
+    Require(pthread_cond_setname_np_nid_postfix(&cond, "first") == 0);
+    Require(pthread_cond_setname_np_nid_postfix(&cond, "second") == 0);
+    Require(pthread_cond_signal_nid_postfix(&cond) == 0);
+    Require(ThrowsInvalidArgument([&] { return pthread_cond_setname_np_nid_postfix(&cond, nullptr); }));
+    Require(ThrowsInvalidArgument([] { return pthread_cond_setname_np_nid_postfix(nullptr, "cond"); }));
+    Require(pthread_cond_destroy_nid_postfix(&cond) == 0);
+    Require(pthread_cond_setname_np_nid_postfix(&cond, "destroyed") == GuestEinval);
+    Require(pthread_cond_init_nid_postfix(&cond, nullptr) == 0);
+    Require(pthread_cond_setname_np_nid_postfix(&cond, "reinitialized") == 0);
+    Require(pthread_cond_destroy_nid_postfix(&cond) == 0);
+
+    PthreadCond lazy = nullptr;
+    Require(pthread_cond_setname_np_nid_postfix(&lazy, "lazy") == 0 && lazy != nullptr);
+    Require(pthread_cond_signal_nid_postfix(&lazy) == 0);
+    Require(pthread_cond_destroy_nid_postfix(&lazy) == 0);
+    Require(pthread_cond_setname_np_nid_postfix(&lazy, "lazy") == GuestEinval);
+}
diff --git a/core/libs/tests/GuestPthreadCondattr.cpp b/core/libs/tests/GuestPthreadCondattr.cpp
index 237ac4374e..465bd7c678 100644
--- a/core/libs/tests/GuestPthreadCondattr.cpp
+++ b/core/libs/tests/GuestPthreadCondattr.cpp
@@ -1,17 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI scePthreadCondattrInit(PthreadCondattr* attr);
-int APS5_VABI scePthreadCondattrDestroy(PthreadCondattr* attr);
-int APS5_VABI scePthreadCondattrSetclock(PthreadCondattr* attr, KernelClockid clockId);
-int APS5_VABI pthread_condattr_setclock_nid_postfix(PthreadCondattr* attr, KernelClockid clockId);
-int APS5_VABI pthread_condattr_setpshared_nid_postfix(PthreadCondattr* attr, int pshared);
-int APS5_VABI pthread_condattr_getpshared_nid_postfix(const PthreadCondattr* attr, int* pshared);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int SceEinval = static_cast<int>(0x80020016u);
 static constexpr int GuestEinval = 22;
@@ -31,14 +24,23 @@ int main() {
     Require(pthread_condattr_setpshared_nid_postfix(&unset, 0) == GuestEinval);
     Require(pthread_condattr_getpshared_nid_postfix(nullptr, &sharing) == GuestEinval && sharing == -1);
     Require(pthread_condattr_getpshared_nid_postfix(&unset, &sharing) == GuestEinval && sharing == -1);
+    Require(scePthreadCondattrSetpshared(&unset, 0) == SceEinval);
+    Require(scePthreadCondattrGetpshared(nullptr, &sharing) == SceEinval && sharing == -1);
 
     PthreadCondattr attr = nullptr;
     Require(scePthreadCondattrInit(&attr) == SCE_OK);
-    for (const KernelClockid clock : {0, 1, 2, Monotonic, 5, 12}) {
+    for (const KernelClockid clock : {0, 1, 2, Monotonic}) {
         Require(scePthreadCondattrSetclock(&attr, clock) == SCE_OK);
         Require(pthread_condattr_setclock_nid_postfix(&attr, clock) == 0);
     }
+    Require(scePthreadCondattrSetpshared(&attr, 1) == SceEinval);
+    Require(scePthreadCondattrSetpshared(&attr, 0) == SCE_OK);
+    Require(scePthreadCondattrGetpshared(&attr, &sharing) == SCE_OK && sharing == 0);
     Require(pthread_condattr_getpshared_nid_postfix(&attr, &sharing) == 0 && sharing == 0);
+    for (const KernelClockid clock : {-1, 3, 5, 12, 13, 14, 15}) {
+        Require(scePthreadCondattrSetclock(&attr, clock) == SceEinval);
+        Require(pthread_condattr_setclock_nid_postfix(&attr, clock) == GuestEinval);
+    }
     for (const int invalid : {1, 2, -1}) {
         Require(pthread_condattr_setpshared_nid_postfix(&attr, invalid) == GuestEinval);
         sharing = -1;
@@ -50,6 +52,7 @@ int main() {
     bool threw = false;
     try {
         pthread_condattr_getpshared_nid_postfix(&attr, nullptr);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestPthreadCreateSuspended.cpp b/core/libs/tests/GuestPthreadCreateSuspended.cpp
new file mode 100644
index 0000000000..cadde5c8e2
--- /dev/null
+++ b/core/libs/tests/GuestPthreadCreateSuspended.cpp
@@ -0,0 +1,276 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <stdexcept>
+#include <string>
+#include <thread>
+
+static constexpr int SCE_OK = 0;
+static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
+static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003u);
+static constexpr int GUEST_ESRCH = 3;
+static constexpr int GUEST_EINVAL = 22;
+static constexpr int GUEST_SIGUSR1 = 30;
+static constexpr int GUEST_CREATE_DETACHED = 1;
+static constexpr int DETACHED_ROUNDS = 200;
+static constexpr auto SUSPENDED_WINDOW = std::chrono::milliseconds(50);
+static void* const CANCELED = reinterpret_cast<void*>(std::uintptr_t{1});
+static void* const FINISHED = reinterpret_cast<void*>(std::uintptr_t{7});
+
+static void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "%s\n", message);
+        std::abort();
+    }
+}
+
+struct Started {
+    std::atomic<bool> ran{false};
+    std::atomic<bool> returned{false};
+};
+
+static std::atomic<bool> release{false};
+static std::atomic<bool> stopResuming{false};
+static std::atomic<int> raised{0};
+static std::atomic<Pthread> raisedOn{nullptr};
+
+static void* APS5_VABI Record(void* opaque) {
+    static_cast<Started*>(opaque)->ran.store(true);
+    return FINISHED;
+}
+
+static void* APS5_VABI CancelAfterResume(void* opaque) {
+    auto* started = static_cast<Started*>(opaque);
+    started->ran.store(true);
+    scePthreadTestcancel();
+    started->returned.store(true);
+    return FINISHED;
+}
+
+static void* APS5_VABI CancelInResumeAll(void* opaque) {
+    auto* started = static_cast<Started*>(opaque);
+    started->ran.store(true);
+    Require(scePthreadCancel(scePthreadSelf()) == SCE_OK, "scePthreadCancel of the calling thread failed");
+    pthread_resume_all_np_nid_postfix();
+    started->returned.store(true);
+    return FINISHED;
+}
+
+static void* APS5_VABI ResumeAllUntilStopped(void*) {
+    while (!stopResuming.load()) pthread_resume_all_np_nid_postfix();
+    return FINISHED;
+}
+
+static void* APS5_VABI WaitForRelease(void*) {
+    while (!release.load()) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    return FINISHED;
+}
+
+static void APS5_VABI Handler(int, void*) {
+    raisedOn.store(scePthreadSelf());
+    raised.fetch_add(1);
+}
+
+static void CreateSuspendedPosix(Pthread* thread, PthreadEntry entry, void* arg) {
+    PthreadAttr attr = nullptr;
+    Require(pthread_attr_init_nid_postfix(&attr) == 0, "pthread_attr_init failed");
+    Require(pthread_attr_setcreatesuspend_np_nid_postfix(&attr) == 0, "pthread_attr_setcreatesuspend_np failed");
+    Require(pthread_create_nid_postfix(thread, &attr, entry, arg) == 0, "pthread_create of a suspended thread failed");
+    Require(pthread_attr_destroy_nid_postfix(&attr) == 0, "pthread_attr_destroy failed");
+}
+
+static void CreateSuspendedSce(Pthread* thread, PthreadEntry entry, void* arg) {
+    PthreadAttr attr = nullptr;
+    Require(scePthreadAttrInit(&attr) == SCE_OK, "scePthreadAttrInit failed");
+    Require(scePthreadAttrSetcreatesuspend(&attr) == SCE_OK, "scePthreadAttrSetcreatesuspend failed");
+    Require(scePthreadCreate(thread, &attr, entry, arg, "suspended") == SCE_OK, "scePthreadCreate of a suspended thread failed");
+    Require(scePthreadAttrDestroy(&attr) == SCE_OK, "scePthreadAttrDestroy failed");
+}
+
+static void ReportsErrors() {
+    Require(pthread_attr_setcreatesuspend_np_nid_postfix(nullptr) == GUEST_EINVAL, "pthread_attr_setcreatesuspend_np accepted a null attribute");
+    Require(scePthreadAttrSetcreatesuspend(nullptr) == SCE_KERNEL_ERROR_EINVAL, "scePthreadAttrSetcreatesuspend accepted a null attribute");
+    PthreadAttr destroyed = nullptr;
+    Require(scePthreadAttrInit(&destroyed) == SCE_OK, "scePthreadAttrInit failed");
+    Require(scePthreadAttrDestroy(&destroyed) == SCE_OK, "scePthreadAttrDestroy failed");
+    Require(pthread_attr_setcreatesuspend_np_nid_postfix(&destroyed) == GUEST_EINVAL, "pthread_attr_setcreatesuspend_np accepted a destroyed attribute");
+    Require(scePthreadAttrSetcreatesuspend(&destroyed) == SCE_KERNEL_ERROR_EINVAL, "scePthreadAttrSetcreatesuspend accepted a destroyed attribute");
+    Require(pthread_resume_np_nid_postfix(nullptr) == GUEST_EINVAL, "pthread_resume_np accepted a null thread");
+    Require(scePthreadResume(nullptr) == SCE_KERNEL_ERROR_EINVAL, "scePthreadResume accepted a null thread");
+    Pthread joined = nullptr;
+    Started started;
+    Require(scePthreadCreate(&joined, nullptr, Record, &started, "joined") == SCE_OK, "scePthreadCreate failed");
+    Require(scePthreadJoin(joined, nullptr) == SCE_OK, "scePthreadJoin failed");
+    Require(pthread_resume_np_nid_postfix(joined) == GUEST_ESRCH, "pthread_resume_np found a joined thread");
+    Require(scePthreadResume(joined) == SCE_KERNEL_ERROR_ESRCH, "scePthreadResume found a joined thread");
+}
+
+static void ResumesOneThread(bool sce) {
+    Started started;
+    Pthread thread = nullptr;
+    if (sce) CreateSuspendedSce(&thread, Record, &started);
+    else CreateSuspendedPosix(&thread, Record, &started);
+    std::this_thread::sleep_for(SUSPENDED_WINDOW);
+    Require(!started.ran.load(), "a thread created suspended ran before it was resumed");
+    Require((sce ? scePthreadResume(thread) : pthread_resume_np_nid_postfix(thread)) == 0, "resuming a suspended thread failed");
+    void* result = nullptr;
+    Require((sce ? scePthreadJoin(thread, &result) : pthread_join_nid_postfix(thread, &result)) == 0, "joining a resumed thread failed");
+    Require(result == FINISHED && started.ran.load(), "a resumed thread did not run its start routine");
+}
+
+static void ResumesRunningAndCallingThreads() {
+    Require(pthread_resume_np_nid_postfix(scePthreadSelf()) == 0, "pthread_resume_np of the calling thread failed");
+    release.store(false);
+    Pthread running = nullptr;
+    Require(scePthreadCreate(&running, nullptr, WaitForRelease, nullptr, "running") == SCE_OK, "scePthreadCreate failed");
+    Require(pthread_resume_np_nid_postfix(running) == 0, "pthread_resume_np of a running thread failed");
+    release.store(true);
+    void* result = nullptr;
+    Require(scePthreadJoin(running, &result) == SCE_OK && result == FINISHED, "joining a running thread failed");
+}
+
+static void ResumesAllThreads(void (*resumeAll)()) {
+    Started first;
+    Started second;
+    Pthread firstThread = nullptr;
+    Pthread secondThread = nullptr;
+    CreateSuspendedPosix(&firstThread, Record, &first);
+    CreateSuspendedSce(&secondThread, Record, &second);
+    std::this_thread::sleep_for(SUSPENDED_WINDOW);
+    Require(!first.ran.load() && !second.ran.load(), "a thread created suspended ran before it was resumed");
+    resumeAll();
+    void* result = nullptr;
+    Require(scePthreadJoin(firstThread, &result) == SCE_OK && result == FINISHED && first.ran.load(), "resuming all threads left the first one suspended");
+    Require(scePthreadJoin(secondThread, &result) == SCE_OK && result == FINISHED && second.ran.load(), "resuming all threads left the second one suspended");
+}
+
+static void CancelsBeforeResume() {
+    Started started;
+    Pthread thread = nullptr;
+    CreateSuspendedSce(&thread, CancelAfterResume, &started);
+    Require(scePthreadCancel(thread) == SCE_OK, "scePthreadCancel of a suspended thread failed");
+    Require(pthread_resume_np_nid_postfix(thread) == 0, "pthread_resume_np of a canceled thread failed");
+    void* result = nullptr;
+    Require(scePthreadJoin(thread, &result) == SCE_OK, "joining a canceled thread failed");
+    Require(result == CANCELED && started.ran.load() && !started.returned.load(), "a cancel requested while suspended did not take effect at the first cancellation point");
+}
+
+static void CancelsInResumeAll() {
+    Started started;
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, nullptr, CancelInResumeAll, &started, "resume_all") == SCE_OK, "scePthreadCreate failed");
+    void* result = nullptr;
+    Require(scePthreadJoin(thread, &result) == SCE_OK, "joining a canceled thread failed");
+    Require(result == CANCELED && started.ran.load() && !started.returned.load(), "pthread_resume_all_np did not act on a pending cancel");
+}
+
+static void ReportsCreateSuspendedInAttrGet(int (APS5_VABI* get)(Pthread, PthreadAttr*)) {
+    Started first;
+    Started second;
+    Pthread suspended = nullptr;
+    CreateSuspendedPosix(&suspended, Record, &first);
+    PthreadAttr attr = nullptr;
+    Require(pthread_attr_init_nid_postfix(&attr) == 0, "pthread_attr_init failed");
+    Require(get(suspended, &attr) == 0, "getting the attributes of a suspended thread failed");
+    Pthread copy = nullptr;
+    Require(pthread_create_nid_postfix(&copy, &attr, Record, &second) == 0, "pthread_create with the attributes of a suspended thread failed");
+    std::this_thread::sleep_for(SUSPENDED_WINDOW);
+    Require(!second.ran.load(), "a thread created with the attributes of a suspended thread ran before it was resumed");
+    Require(pthread_resume_np_nid_postfix(copy) == 0 && pthread_resume_np_nid_postfix(suspended) == 0, "resuming a suspended thread failed");
+    void* result = nullptr;
+    Require(pthread_join_nid_postfix(copy, &result) == 0 && result == FINISHED && second.ran.load(), "joining a resumed thread failed");
+    Require(pthread_join_nid_postfix(suspended, &result) == 0 && result == FINISHED && first.ran.load(), "joining a resumed thread failed");
+    release.store(false);
+    Pthread running = nullptr;
+    Require(scePthreadCreate(&running, nullptr, WaitForRelease, nullptr, "running") == SCE_OK, "scePthreadCreate failed");
+    Require(pthread_attr_setcreatesuspend_np_nid_postfix(&attr) == 0, "pthread_attr_setcreatesuspend_np failed");
+    Require(get(running, &attr) == 0, "getting the attributes of a running thread failed");
+    Started third;
+    Pthread plain = nullptr;
+    Require(pthread_create_nid_postfix(&plain, &attr, Record, &third) == 0, "pthread_create with the attributes of a running thread failed");
+    Require(pthread_join_nid_postfix(plain, &result) == 0 && result == FINISHED && third.ran.load(), "a thread created with the attributes of a running thread did not run");
+    release.store(true);
+    Require(scePthreadJoin(running, nullptr) == SCE_OK, "joining a running thread failed");
+    Require(pthread_attr_destroy_nid_postfix(&attr) == 0, "pthread_attr_destroy failed");
+}
+
+static void ResumesDetachedThreadsWhileTheyExit() {
+    stopResuming.store(false);
+    Pthread resumer = nullptr;
+    Require(scePthreadCreate(&resumer, nullptr, ResumeAllUntilStopped, nullptr, "resumer") == SCE_OK, "scePthreadCreate failed");
+    for (int round = 0; round < DETACHED_ROUNDS; ++round) {
+        Started started;
+        PthreadAttr attr = nullptr;
+        Require(pthread_attr_init_nid_postfix(&attr) == 0, "pthread_attr_init failed");
+        Require(pthread_attr_setcreatesuspend_np_nid_postfix(&attr) == 0, "pthread_attr_setcreatesuspend_np failed");
+        Require(pthread_attr_setdetachstate_nid_postfix(&attr, GUEST_CREATE_DETACHED) == 0, "pthread_attr_setdetachstate failed");
+        Pthread thread = nullptr;
+        Require(pthread_create_nid_postfix(&thread, &attr, Record, &started) == 0, "pthread_create of a detached suspended thread failed");
+        Require(pthread_attr_destroy_nid_postfix(&attr) == 0, "pthread_attr_destroy failed");
+        int result = 0;
+        while ((result = pthread_resume_np_nid_postfix(thread)) == 0) std::this_thread::yield();
+        Require(result == GUEST_ESRCH && started.ran.load(), "a detached thread resumed while it exited did not run its start routine");
+    }
+    stopResuming.store(true);
+    Require(scePthreadJoin(resumer, nullptr) == SCE_OK, "joining the resuming thread failed");
+}
+
+#ifdef _WIN32
+static void RefusesRaiseWhileSuspended() {
+    Require(sceKernelInstallExceptionHandler(GUEST_SIGUSR1, reinterpret_cast<void*>(&Handler)) == SCE_OK, "sceKernelInstallExceptionHandler failed");
+    Started started;
+    Pthread thread = nullptr;
+    CreateSuspendedSce(&thread, Record, &started);
+    bool refused = false;
+    try {
+        sceKernelRaiseException(thread, GUEST_SIGUSR1);
+    } catch (const std::runtime_error& error) {
+        refused = std::string(error.what()).find("suspended") != std::string::npos;
+    }
+    Require(refused, "sceKernelRaiseException did not refuse a thread still suspended at creation");
+    Require(pthread_resume_np_nid_postfix(thread) == 0, "pthread_resume_np failed");
+    Require(scePthreadJoin(thread, nullptr) == SCE_OK && started.ran.load(), "joining a resumed thread failed");
+    Require(raised.load() == 0, "the handler ran for a refused raise");
+    Require(sceKernelRemoveExceptionHandler(GUEST_SIGUSR1) == SCE_OK, "sceKernelRemoveExceptionHandler failed");
+}
+#else
+static void DefersRaiseUntilResume() {
+    Require(sceKernelInstallExceptionHandler(GUEST_SIGUSR1, reinterpret_cast<void*>(&Handler)) == SCE_OK, "sceKernelInstallExceptionHandler failed");
+    Started started;
+    Pthread thread = nullptr;
+    CreateSuspendedSce(&thread, Record, &started);
+    Require(sceKernelRaiseException(thread, GUEST_SIGUSR1) == SCE_OK, "sceKernelRaiseException on a suspended thread failed");
+    std::this_thread::sleep_for(SUSPENDED_WINDOW);
+    Require(raised.load() == 0, "the handler ran on a thread still suspended at creation");
+    Require(pthread_resume_np_nid_postfix(thread) == 0, "pthread_resume_np failed");
+    Require(scePthreadJoin(thread, nullptr) == SCE_OK && started.ran.load(), "joining a resumed thread failed");
+    Require(raised.load() == 1 && raisedOn.load() == thread, "the handler did not run on the thread once it was resumed");
+    Require(sceKernelRemoveExceptionHandler(GUEST_SIGUSR1) == SCE_OK, "sceKernelRemoveExceptionHandler failed");
+}
+#endif
+
+int main() {
+    ReportsErrors();
+    ResumesOneThread(false);
+    ResumesOneThread(true);
+    ResumesRunningAndCallingThreads();
+    ResumesAllThreads([] { Require(pthread_multi_np_nid_postfix() == 0, "pthread_multi_np failed"); });
+    ResumesAllThreads([] { pthread_resume_all_np_nid_postfix(); });
+    ResumesAllThreads([] { Require(scePthreadMulti() == SCE_OK, "scePthreadMulti failed"); });
+    ResumesAllThreads([] { scePthreadResumeAll(); });
+    CancelsBeforeResume();
+    CancelsInResumeAll();
+    ReportsCreateSuspendedInAttrGet(pthread_attr_get_np_nid_postfix);
+    ReportsCreateSuspendedInAttrGet(scePthreadAttrGet);
+    ResumesDetachedThreadsWhileTheyExit();
+#ifdef _WIN32
+    RefusesRaiseWhileSuspended();
+#else
+    DefersRaiseUntilResume();
+#endif
+}
diff --git a/core/libs/tests/GuestPthreadDestroyedObjects.cpp b/core/libs/tests/GuestPthreadDestroyedObjects.cpp
index ca35d7b099..2687a84b66 100644
--- a/core/libs/tests/GuestPthreadDestroyedObjects.cpp
+++ b/core/libs/tests/GuestPthreadDestroyedObjects.cpp
@@ -1,26 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTrylock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI scePthreadCondBroadcast(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_cond_signal_nid_postfix(PthreadCond* cond);
-int APS5_VABI pthread_cond_destroy_nid_postfix(PthreadCond* cond);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001u);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
 static constexpr int POSIX_EINVAL = 22;
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -53,10 +39,19 @@ int main() {
     PthreadCond cond = nullptr;
     Require(scePthreadCondInit(&cond, nullptr, "destroyed") == SCE_OK);
     Require(scePthreadCondDestroy(&cond) == SCE_OK);
+    Require(reinterpret_cast<std::uintptr_t>(cond) == 1);
     Require(scePthreadCondSignal(&cond) == SCE_KERNEL_ERROR_EINVAL);
     Require(scePthreadCondBroadcast(&cond) == SCE_KERNEL_ERROR_EINVAL);
     Require(scePthreadCondWait(&cond, &mutex) == SCE_KERNEL_ERROR_EINVAL);
     Require(pthread_cond_signal_nid_postfix(&cond) == POSIX_EINVAL);
     Require(scePthreadCondDestroy(&cond) == SCE_KERNEL_ERROR_EINVAL);
     Require(pthread_cond_destroy_nid_postfix(&cond) == POSIX_EINVAL);
+
+    PthreadCond untouched = nullptr;
+    Require(scePthreadCondDestroy(&untouched) == SCE_OK && untouched == nullptr);
+    Require(scePthreadCondSignal(&untouched) == SCE_OK && untouched != nullptr);
+    Require(scePthreadCondDestroy(&untouched) == SCE_OK && reinterpret_cast<std::uintptr_t>(untouched) == 1);
+    untouched = nullptr;
+    Require(scePthreadCondBroadcast(&untouched) == SCE_OK && untouched != nullptr);
+    Require(scePthreadCondDestroy(&untouched) == SCE_OK);
 }
diff --git a/core/libs/tests/GuestPthreadDestructorLifetime.cpp b/core/libs/tests/GuestPthreadDestructorLifetime.cpp
index 4bddcb951c..2001d54acb 100644
--- a/core/libs/tests/GuestPthreadDestructorLifetime.cpp
+++ b/core/libs/tests/GuestPthreadDestructorLifetime.cpp
@@ -1,23 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
 #include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-void APS5_VABI scePthreadExit(void* retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetthreadid();
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-}
-
 struct Context {
     PthreadKey key = -1;
     Pthread expected = nullptr;
diff --git a/core/libs/tests/GuestPthreadFrameChain.cpp b/core/libs/tests/GuestPthreadFrameChain.cpp
index d9c491090f..b0d3fc5822 100644
--- a/core/libs/tests/GuestPthreadFrameChain.cpp
+++ b/core/libs/tests/GuestPthreadFrameChain.cpp
@@ -1,13 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr std::uintptr_t ChainReach = std::uintptr_t{64} << 10;
 
diff --git a/core/libs/tests/GuestPthreadGetname.cpp b/core/libs/tests/GuestPthreadGetname.cpp
index f8545f6078..fe3554d545 100644
--- a/core/libs/tests/GuestPthreadGetname.cpp
+++ b/core/libs/tests/GuestPthreadGetname.cpp
@@ -1,18 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdlib>
 #include <cstring>
 #include <string>
 
-extern "C" {
-Pthread APS5_VABI pthread_self_nid_postfix(void);
-int APS5_VABI pthread_rename_np_nid_postfix(Pthread thread, const char* name);
-int APS5_VABI pthread_getname_np_nid_postfix(Pthread thread, char* name);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-}
-
 static constexpr int GUEST_ESRCH = 3;
 static constexpr int GUEST_EFAULT = 14;
 
diff --git a/core/libs/tests/GuestPthreadJoinDetach.cpp b/core/libs/tests/GuestPthreadJoinDetach.cpp
index 48a982989e..20c8014765 100644
--- a/core/libs/tests/GuestPthreadJoinDetach.cpp
+++ b/core/libs/tests/GuestPthreadJoinDetach.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <atomic>
@@ -7,10 +8,6 @@
 #include <mutex>
 #include <thread>
 
-extern "C" int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-extern "C" int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-extern "C" int APS5_VABI scePthreadDetach(Pthread thread);
-
 static constexpr int SCE_OK = 0;
 
 static void Require(bool condition, const char* message) {
diff --git a/core/libs/tests/GuestPthreadJoinSelf.cpp b/core/libs/tests/GuestPthreadJoinSelf.cpp
index 2fec26bef7..6277b58467 100644
--- a/core/libs/tests/GuestPthreadJoinSelf.cpp
+++ b/core/libs/tests/GuestPthreadJoinSelf.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -5,16 +7,7 @@
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** retval);
-int APS5_VABI scePthreadDetach(Pthread thread);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EDEADLK = static_cast<int>(0x8002000Bu);
 static constexpr int GUEST_EDEADLK = 11;
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestPthreadKey.cpp b/core/libs/tests/GuestPthreadKey.cpp
index ae87651a61..bbe608bc54 100644
--- a/core/libs/tests/GuestPthreadKey.cpp
+++ b/core/libs/tests/GuestPthreadKey.cpp
@@ -1,21 +1,11 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI pthread_key_create_nid_postfix(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI pthread_key_delete_nid_postfix(PthreadKey key);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
diff --git a/core/libs/tests/GuestPthreadMutexErrors.cpp b/core/libs/tests/GuestPthreadMutexErrors.cpp
index da1083b121..7d7947f824 100644
--- a/core/libs/tests/GuestPthreadMutexErrors.cpp
+++ b/core/libs/tests/GuestPthreadMutexErrors.cpp
@@ -1,38 +1,13 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexGetspinloops(PthreadMutex* mutex, int* count);
-int APS5_VABI scePthreadMutexSetspinloops(PthreadMutex* mutex, int count);
-int APS5_VABI scePthreadMutexGetyieldloops(PthreadMutex* mutex, int* count);
-int APS5_VABI scePthreadMutexSetyieldloops(PthreadMutex* mutex, int count);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_reltimedlock_np_nid_postfix(PthreadMutex* mutex, KernelUseconds usec);
-int APS5_VABI pthread_mutex_isowned_np_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_getspinloops_np_nid_postfix(PthreadMutex* mutex, int* count);
-int APS5_VABI pthread_mutex_setspinloops_np_nid_postfix(PthreadMutex* mutex, int count);
-int APS5_VABI pthread_mutex_getyieldloops_np_nid_postfix(PthreadMutex* mutex, int* count);
-int APS5_VABI pthread_mutex_setyieldloops_np_nid_postfix(PthreadMutex* mutex, int count);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010u);
 
 static constexpr int POSIX_EDEADLK = 11;
 static constexpr int POSIX_EINVAL = 22;
@@ -72,7 +47,7 @@ static void CheckOwnershipAndRelativeLock() {
     Require(pthread_mutex_isowned_np_nid_postfix(&adaptive) == 0 && adaptive == AdaptiveInitializer);
     Require(pthread_mutex_reltimedlock_np_nid_postfix(&mutex, 1000) == 0 && mutex != nullptr);
     Require(pthread_mutex_isowned_np_nid_postfix(&mutex) == 1);
-    Require(pthread_mutex_reltimedlock_np_nid_postfix(&mutex, 1000) == POSIX_EDEADLK);
+    Require(pthread_mutex_reltimedlock_np_nid_postfix(&mutex, 1000) == POSIX_ETIMEDOUT);
     OtherThread other{&mutex};
     Pthread thread = nullptr;
     Require(scePthreadCreate(&thread, nullptr, CheckFromOtherThread, &other, nullptr) == SCE_OK);
diff --git a/core/libs/tests/GuestPthreadMutexattr.cpp b/core/libs/tests/GuestPthreadMutexattr.cpp
index 48dd291a5b..58774211dd 100644
--- a/core/libs/tests/GuestPthreadMutexattr.cpp
+++ b/core/libs/tests/GuestPthreadMutexattr.cpp
@@ -1,35 +1,19 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI pthread_mutexattr_init_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_destroy_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_getpshared_nid_postfix(const PthreadMutexattr* attr, int* pshared);
-int APS5_VABI pthread_mutexattr_setpshared_nid_postfix(PthreadMutexattr* attr, int pshared);
-int APS5_VABI pthread_mutexattr_setprotocol_nid_postfix(PthreadMutexattr* attr, int protocol);
-int APS5_VABI pthread_mutexattr_getprotocol_nid_postfix(const PthreadMutexattr* attr, int* protocol);
-int APS5_VABI pthread_mutexattr_setprioceiling_nid_postfix(PthreadMutexattr* attr, int prioceiling);
-int APS5_VABI pthread_mutexattr_getprioceiling_nid_postfix(const PthreadMutexattr* attr, int* prioceiling);
-int APS5_VABI pthread_mutexattr_settype_nid_postfix(PthreadMutexattr* attr, int type);
-int APS5_VABI pthread_mutexattr_gettype_nid_postfix(const PthreadMutexattr* attr, int* type);
-int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_timedlock_nid_postfix(PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-}
-
 static constexpr int GUEST_EINVAL = 22;
+static constexpr int SCE_OK = 0;
+static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
 static constexpr int PRIO_NONE = 0;
 static constexpr int PRIO_INHERIT = 1;
 static constexpr int PRIO_PROTECT = 2;
-static constexpr int SCHED_RR = 3;
+static constexpr int GuestSched_Rr = 3;
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -80,6 +64,78 @@ static void CheckType() {
     Require(pthread_mutexattr_gettype_nid_postfix(nullptr, &type) == GUEST_EINVAL && type == -1);
 }
 
+static void CheckKind() {
+    PthreadMutexattr attr = nullptr;
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_getkind_np_nid_postfix(nullptr) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_setkind_np_nid_postfix(nullptr, 2) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_setkind_np_nid_postfix(&attr, 2) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    Require(pthread_mutexattr_init_nid_postfix(&attr) == 0);
+    Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == 1);
+    int type = -1;
+    for (const int kind : {2, 3, 4, 1}) {
+        Require(pthread_mutexattr_setkind_np_nid_postfix(&attr, kind) == 0);
+        Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == kind);
+        Require(pthread_mutexattr_gettype_nid_postfix(&attr, &type) == 0 && type == kind);
+    }
+    Require(pthread_mutexattr_settype_nid_postfix(&attr, 2) == 0);
+    Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == 2);
+    for (const int invalid : {0, 5, -1})
+        Require(Throws([&] { pthread_mutexattr_setkind_np_nid_postfix(&attr, invalid); }));
+    Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == 2);
+    PthreadMutex mutex = nullptr;
+    Require(pthread_mutex_init_nid_postfix(&mutex, &attr) == 0);
+    Require(pthread_mutex_lock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_lock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_unlock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_unlock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_destroy_nid_postfix(&mutex) == 0);
+    Require(pthread_mutexattr_destroy_nid_postfix(&attr) == 0);
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_setkind_np_nid_postfix(&attr, 2) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+}
+
+static void CheckSceAccessors() {
+    PthreadMutexattr attr = nullptr;
+    int value = -1;
+    Require(scePthreadMutexattrGettype(nullptr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetprotocol(&attr, PRIO_NONE) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetprioceiling(&attr, 300) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetpshared(nullptr, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetpshared(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(value == -1);
+    Require(scePthreadMutexattrInit(&attr) == SCE_OK);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_OK && value == 1);
+    Require(scePthreadMutexattrSettype(&attr, 3) == SCE_OK);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_OK && value == 3);
+    Require(Throws([&] { scePthreadMutexattrGettype(&attr, nullptr); }));
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_OK && value == PRIO_NONE);
+    for (const int invalid : {-1, 3})
+        Require(scePthreadMutexattrSetprotocol(&attr, invalid) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_OK && value == PRIO_NONE);
+    Require(scePthreadMutexattrSetprotocol(&attr, PRIO_INHERIT) == SCE_OK);
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_OK && value == PRIO_INHERIT);
+    Require(scePthreadMutexattrSetprioceiling(&attr, 300) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetprotocol(&attr, PRIO_PROTECT) == SCE_OK);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_OK && value == sched_get_priority_max_nid_postfix(GuestSched_Rr));
+    Require(scePthreadMutexattrSetprioceiling(&attr, 300) == SCE_OK);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_OK && value == 300);
+    int protocol = -1;
+    Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_PROTECT);
+    Require(scePthreadMutexattrGetpshared(&attr, &value) == SCE_OK && value == 0);
+    Require(scePthreadMutexattrSetpshared(&attr, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetpshared(&attr, 0) == SCE_OK);
+    Require(scePthreadMutexattrGetpshared(&attr, &value) == SCE_OK && value == 0);
+    Require(scePthreadMutexattrDestroy(&attr) == SCE_OK);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+}
+
 static void CheckProcessSharing() {
     PthreadMutexattr attr = nullptr;
     int sharing = -1;
@@ -127,6 +183,8 @@ static void CheckInvalidPriorityAttribute(PthreadMutexattr* attr) {
 
 int main() {
     CheckType();
+    CheckKind();
+    CheckSceAccessors();
     CheckProcessSharing();
     CheckTimedlockInvalidDeadline();
     PthreadMutexattr attr = nullptr;
@@ -143,7 +201,7 @@ int main() {
     Require(pthread_mutexattr_setprioceiling_nid_postfix(&attr, 300) == GUEST_EINVAL);
     Require(pthread_mutexattr_setprotocol_nid_postfix(&attr, PRIO_PROTECT) == 0);
     Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_PROTECT);
-    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(SCHED_RR));
+    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(GuestSched_Rr));
     Require(pthread_mutexattr_setprioceiling_nid_postfix(&attr, 300) == 0);
     Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == 300);
     PthreadMutex mutex = nullptr;
@@ -153,7 +211,7 @@ int main() {
     Require(pthread_mutex_destroy_nid_postfix(&mutex) == 0);
     Require(pthread_mutexattr_setprotocol_nid_postfix(&attr, PRIO_PROTECT) == 0);
     Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_PROTECT);
-    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(SCHED_RR));
+    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(GuestSched_Rr));
     Require(pthread_mutexattr_setprotocol_nid_postfix(&attr, PRIO_NONE) == 0);
     Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_NONE);
     Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == GUEST_EINVAL);
diff --git a/core/libs/tests/GuestPthreadRename.cpp b/core/libs/tests/GuestPthreadRename.cpp
index e3fdbd18b1..ccfa5ced39 100644
--- a/core/libs/tests/GuestPthreadRename.cpp
+++ b/core/libs/tests/GuestPthreadRename.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdio>
@@ -5,15 +7,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI pthread_rename_np_nid_postfix(Pthread thread, const char* name);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckStoredName(Pthread thread, const std::string& expected) {
diff --git a/core/libs/tests/GuestPthreadRwlock.cpp b/core/libs/tests/GuestPthreadRwlock.cpp
index 91c219a1cb..1f6783b2d5 100644
--- a/core/libs/tests/GuestPthreadRwlock.cpp
+++ b/core/libs/tests/GuestPthreadRwlock.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -6,37 +10,9 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_init_nid_postfix(PthreadRwlock* rwlock, const PthreadRwlockattr* attr);
-int APS5_VABI pthread_rwlockattr_init_nid_postfix(PthreadRwlockattr* attr);
-int APS5_VABI pthread_rwlockattr_destroy_nid_postfix(PthreadRwlockattr* attr);
-int APS5_VABI pthread_rwlockattr_getpshared_nid_postfix(const PthreadRwlockattr* attr, int* pshared);
-int APS5_VABI pthread_rwlockattr_setpshared_nid_postfix(PthreadRwlockattr* attr, int pshared);
-int APS5_VABI pthread_rwlock_rdlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_unlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_tryrdlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_trywrlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_timedrdlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI pthread_rwlock_timedwrlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI pthread_rwlock_reltimedrdlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec);
-int APS5_VABI pthread_rwlock_reltimedwrlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec);
-int APS5_VABI scePthreadRwlockInit(PthreadRwlock* rwlock, const PthreadRwlockattr* attr, const char* name);
-int APS5_VABI scePthreadRwlockDestroy(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockRdlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockWrlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockTryrdlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockUnlock(PthreadRwlock* rwlock);
-}
-
 using TimedLock = int (APS5_VABI *)(PthreadRwlock*, const KernelTimespec*);
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
 static constexpr int GUEST_EPERM = 1;
 static constexpr int GUEST_EDEADLK = 11;
 static constexpr int GUEST_EBUSY = 16;
@@ -206,7 +182,7 @@ static void CheckFailedLockAttempts() {
     PthreadRwlock rwlock = nullptr;
     Require(pthread_rwlock_wrlock_nid_postfix(&rwlock) == 0);
     const KernelTimespec timeout = After(10);
-    Require(pthread_rwlock_timedrdlock_nid_postfix(&rwlock, &timeout) == GUEST_EDEADLK);
+    Require(pthread_rwlock_timedrdlock_nid_postfix(&rwlock, &timeout) == GUEST_ETIMEDOUT);
     Require(pthread_rwlock_tryrdlock_nid_postfix(&rwlock) == GUEST_EBUSY);
     Require(pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
     Require(pthread_rwlock_destroy_nid_postfix(&rwlock) == 0);
@@ -397,8 +373,49 @@ static void CheckAttrProcessSharing() {
     Require(pthread_rwlockattr_destroy_nid_postfix(&attr) == 0);
 }
 
+static void CheckAttrSettype() {
+    PthreadRwlockattr attr = nullptr;
+    Require(pthread_rwlockattr_init_nid_postfix(&attr) == 0);
+    for (const int type : {1, 2}) {
+        Require(scePthreadRwlockattrSettype(&attr, type) == SCE_OK);
+        PthreadRwlock rwlock = nullptr;
+        Require(pthread_rwlock_init_nid_postfix(&rwlock, &attr) == 0);
+        Require(pthread_rwlock_wrlock_nid_postfix(&rwlock) == 0 && pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
+        Require(pthread_rwlock_destroy_nid_postfix(&rwlock) == 0);
+    }
+    for (const int type : {0, 3, -1, static_cast<int>(0x80000000u)}) Require(scePthreadRwlockattrSettype(&attr, type) == SCE_KERNEL_ERROR_EINVAL);
+    Require(pthread_rwlockattr_destroy_nid_postfix(&attr) == 0);
+    Require(scePthreadRwlockattrSettype(&attr, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadRwlockattrSettype(nullptr, 1) == SCE_KERNEL_ERROR_EINVAL);
+}
+
+static void CheckAttrType() {
+    PthreadRwlockattr attr = nullptr;
+    Require(pthread_rwlockattr_init_nid_postfix(&attr) == 0);
+    int type = -1;
+    Require(pthread_rwlockattr_gettype_np_nid_postfix(&attr, &type) == 0 && type == 0);
+    Require(scePthreadRwlockattrGettype(&attr, &type) == SCE_OK && type == 0);
+    for (const int set : {1, 2}) {
+        Require(scePthreadRwlockattrSettype(&attr, set) == SCE_OK);
+        Require(pthread_rwlockattr_gettype_np_nid_postfix(&attr, &type) == 0 && type == set);
+        Require(scePthreadRwlockattrGettype(&attr, &type) == SCE_OK && type == set);
+    }
+    Require(Throws([&] { pthread_rwlockattr_gettype_np_nid_postfix(&attr, nullptr); }));
+    int pshared = -1;
+    Require(scePthreadRwlockattrGetpshared(&attr, &pshared) == SCE_OK && pshared == PROCESS_PRIVATE);
+    Require(scePthreadRwlockattrSetpshared(&attr, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadRwlockattrSetpshared(&attr, PROCESS_PRIVATE) == SCE_OK);
+    Require(pthread_rwlockattr_destroy_nid_postfix(&attr) == 0);
+    PthreadRwlockattr unset = nullptr;
+    Require(Throws([&] { pthread_rwlockattr_gettype_np_nid_postfix(nullptr, &type); }));
+    Require(Throws([&] { pthread_rwlockattr_gettype_np_nid_postfix(&unset, &type); }));
+    Require(Throws([&] { scePthreadRwlockattrGettype(&unset, &type); }));
+}
+
 int main() {
+    CheckAttrSettype();
     CheckAttrProcessSharing();
+    CheckAttrType();
     CheckWaitingWriterHoldsBackNewReaders();
     CheckConcurrentFirstWrlockExcludes();
     CheckDeadlinesBeyondTheClockRange();
@@ -430,9 +447,10 @@ int main() {
     Require(pthread_rwlock_trywrlock_nid_postfix(&rwlock) == 0);
     Require(pthread_rwlock_tryrdlock_nid_postfix(&rwlock) == GUEST_EBUSY);
     Require(pthread_rwlock_trywrlock_nid_postfix(&rwlock) == GUEST_EBUSY);
-    KernelTimespec deadline = After(5000);
-    Require(pthread_rwlock_timedrdlock_nid_postfix(&rwlock, &deadline) == GUEST_EDEADLK);
-    Require(pthread_rwlock_timedwrlock_nid_postfix(&rwlock, &deadline) == GUEST_EDEADLK);
+    KernelTimespec deadline = After(20);
+    Require(pthread_rwlock_timedrdlock_nid_postfix(&rwlock, &deadline) == GUEST_ETIMEDOUT);
+    deadline = After(20);
+    Require(pthread_rwlock_timedwrlock_nid_postfix(&rwlock, &deadline) == GUEST_ETIMEDOUT);
     Require(pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
     Require(pthread_rwlock_unlock_nid_postfix(&rwlock) == GUEST_EPERM);
     Require(pthread_rwlock_tryrdlock_nid_postfix(&rwlock) == 0);
diff --git a/core/libs/tests/GuestPthreadSchedparam.cpp b/core/libs/tests/GuestPthreadSchedparam.cpp
index 171d3fc5be..71d9ab1a58 100644
--- a/core/libs/tests/GuestPthreadSchedparam.cpp
+++ b/core/libs/tests/GuestPthreadSchedparam.cpp
@@ -1,33 +1,13 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <cstdint>
 #include <future>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI scePthreadGetschedparam(Pthread thread, int* policy, KernelSchedParam* param);
-int APS5_VABI scePthreadSetschedparam(Pthread thread, int policy, const KernelSchedParam* param);
-int APS5_VABI pthread_getschedparam_nid_postfix(Pthread thread, int* policy, KernelSchedParam* param);
-int APS5_VABI pthread_getprio_nid_postfix(Pthread thread);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI pthread_setschedparam_nid_postfix(Pthread thread, int policy, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI pthread_attr_get_np_nid_postfix(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetschedpolicy(const PthreadAttr* attr, int* policy);
-int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrSetschedpolicy(PthreadAttr* attr, int policy);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_ESRCH = 3;
 static constexpr int GUEST_SCHED_FIFO = 1;
diff --git a/core/libs/tests/GuestPthreadSecondJoin.cpp b/core/libs/tests/GuestPthreadSecondJoin.cpp
index 4db4d57034..3bca2b8745 100644
--- a/core/libs/tests/GuestPthreadSecondJoin.cpp
+++ b/core/libs/tests/GuestPthreadSecondJoin.cpp
@@ -1,20 +1,14 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
+#include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadDetach(Pthread thread);
-int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** retval);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003u);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
 static constexpr int GUEST_ESRCH = 3;
 static constexpr std::size_t REUSED_SLOT_ROUNDS = 64;
 
@@ -40,7 +34,7 @@ int main() {
     result = reinterpret_cast<void*>(std::uintptr_t{0x55});
     Require(scePthreadJoin(thread, &result) == SCE_KERNEL_ERROR_ESRCH);
     Require(result == reinterpret_cast<void*>(std::uintptr_t{0x55}));
-    Require(scePthreadDetach(thread) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadDetach(thread) == SCE_KERNEL_ERROR_ESRCH);
     Require(pthread_join_nid_postfix(thread, &result) == GUEST_ESRCH);
     Require(result == reinterpret_cast<void*>(std::uintptr_t{0x55}));
 
@@ -62,4 +56,18 @@ int main() {
     Require(result == reinterpret_cast<void*>(std::uintptr_t{0x55}));
     Require(scePthreadDetach(detached) == SCE_KERNEL_ERROR_EINVAL);
     release = true;
+
+    Pthread named = nullptr;
+    char name[64] = {};
+    Require(scePthreadCreate(&named, nullptr, Finish, nullptr, "0123456789abcdefghijklmnopqrstu") == SCE_OK);
+    Require(scePthreadGetname(named, name) == SCE_OK && std::strcmp(name, "0123456789abcdefghijklmnopqrstu") == 0);
+    Require(scePthreadJoin(named, nullptr) == SCE_OK);
+    Pthread untouched = reinterpret_cast<Pthread>(std::uintptr_t{0x77});
+    Require(scePthreadCreate(&untouched, nullptr, Finish, nullptr, "0123456789abcdefghijklmnopqrstuv") == SCE_KERNEL_ERROR_ENAMETOOLONG);
+    Require(untouched == reinterpret_cast<Pthread>(std::uintptr_t{0x77}));
+    Pthread unnamed = nullptr;
+    std::memset(name, 'x', sizeof(name));
+    Require(scePthreadCreate(&unnamed, nullptr, Finish, nullptr, nullptr) == SCE_OK);
+    Require(scePthreadGetname(unnamed, name) == SCE_OK && name[0] == 0);
+    Require(scePthreadJoin(unnamed, nullptr) == SCE_OK);
 }
diff --git a/core/libs/tests/GuestPthreadSem.cpp b/core/libs/tests/GuestPthreadSem.cpp
index 574228ddf4..c2f4373538 100644
--- a/core/libs/tests/GuestPthreadSem.cpp
+++ b/core/libs/tests/GuestPthreadSem.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -7,23 +9,7 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
-int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
-int APS5_VABI scePthreadSemPost(PthreadSem* sem);
-int APS5_VABI scePthreadSemWait(PthreadSem* sem);
-int APS5_VABI scePthreadSemTrywait(PthreadSem* sem);
-int APS5_VABI scePthreadSemTimedwait(PthreadSem* sem, unsigned int usec);
-int APS5_VABI scePthreadSemGetvalue(PthreadSem* sem, int* value);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
-static constexpr int SCE_KERNEL_ERROR_EOVERFLOW = static_cast<int>(0x80020054u);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
diff --git a/core/libs/tests/GuestPthreadSpin.cpp b/core/libs/tests/GuestPthreadSpin.cpp
index ca7e2b6926..2308710c88 100644
--- a/core/libs/tests/GuestPthreadSpin.cpp
+++ b/core/libs/tests/GuestPthreadSpin.cpp
@@ -1,25 +1,15 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-struct PthreadSpinlockPrivate;
 using PthreadSpinlock = PthreadSpinlockPrivate*;
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_spin_init_nid_postfix(PthreadSpinlock* lock, int pshared);
-int APS5_VABI pthread_spin_destroy_nid_postfix(PthreadSpinlock* lock);
-int APS5_VABI pthread_spin_lock_nid_postfix(PthreadSpinlock* lock);
-int APS5_VABI pthread_spin_trylock_nid_postfix(PthreadSpinlock* lock);
-int APS5_VABI pthread_spin_unlock_nid_postfix(PthreadSpinlock* lock);
-}
-
 static constexpr int GUEST_EPERM = 1;
 static constexpr int GUEST_EBUSY = 16;
 static constexpr int GUEST_EINVAL = 22;
-static constexpr int PTHREAD_PROCESS_PRIVATE = 0;
-static constexpr int PTHREAD_PROCESS_SHARED = 1;
+static constexpr int GuestPthread_Process_Private = 0;
+static constexpr int GuestPthread_Process_Shared = 1;
 static constexpr int Increments = 200000;
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -49,9 +39,9 @@ static void* APS5_VABI Incrementer(void* arg) {
 }
 
 static void ArgumentErrors() {
-    Require(pthread_spin_init_nid_postfix(nullptr, PTHREAD_PROCESS_PRIVATE) == GUEST_EINVAL);
+    Require(pthread_spin_init_nid_postfix(nullptr, GuestPthread_Process_Private) == GUEST_EINVAL);
     PthreadSpinlock lock = nullptr;
-    Require(pthread_spin_init_nid_postfix(&lock, PTHREAD_PROCESS_SHARED) == GUEST_EINVAL);
+    Require(pthread_spin_init_nid_postfix(&lock, GuestPthread_Process_Shared) == GUEST_EINVAL);
     Require(pthread_spin_init_nid_postfix(&lock, 2) == GUEST_EINVAL);
     Require(pthread_spin_init_nid_postfix(&lock, -1) == GUEST_EINVAL);
     Require(lock == nullptr);
@@ -75,6 +65,7 @@ static void SingleThread(int pshared) {
     bool threw = false;
     try {
         pthread_spin_lock_nid_postfix(&lock);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -90,7 +81,7 @@ static void SingleThread(int pshared) {
 
 static void HeldByAnotherThread() {
     Shared shared;
-    Require(pthread_spin_init_nid_postfix(&shared.lock, PTHREAD_PROCESS_PRIVATE) == 0);
+    Require(pthread_spin_init_nid_postfix(&shared.lock, GuestPthread_Process_Private) == 0);
     Require(pthread_spin_lock_nid_postfix(&shared.lock) == 0);
     Pthread thread = nullptr;
     Require(scePthreadCreate(&thread, nullptr, Contender, &shared, nullptr) == 0);
@@ -103,7 +94,7 @@ static void HeldByAnotherThread() {
 
 static void MutualExclusion() {
     Shared shared;
-    Require(pthread_spin_init_nid_postfix(&shared.lock, PTHREAD_PROCESS_PRIVATE) == 0);
+    Require(pthread_spin_init_nid_postfix(&shared.lock, GuestPthread_Process_Private) == 0);
     Pthread first = nullptr;
     Pthread second = nullptr;
     Require(scePthreadCreate(&first, nullptr, Incrementer, &shared, nullptr) == 0);
@@ -116,7 +107,7 @@ static void MutualExclusion() {
 
 int main() {
     ArgumentErrors();
-    SingleThread(PTHREAD_PROCESS_PRIVATE);
+    SingleThread(GuestPthread_Process_Private);
     HeldByAnotherThread();
     MutualExclusion();
 }
diff --git a/core/libs/tests/GuestPthreadStack.cpp b/core/libs/tests/GuestPthreadStack.cpp
index 5fcbe7ac52..d0e2472a70 100644
--- a/core/libs/tests/GuestPthreadStack.cpp
+++ b/core/libs/tests/GuestPthreadStack.cpp
@@ -1,11 +1,15 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #ifdef __linux__
 #include "prx/libc/include/GuestAllocations.hpp"
+#include <cerrno>
 #include <atomic>
 #include <cstdio>
 #include <chrono>
 #include <thread>
 #include <string>
+#include <vector>
+#include <sys/mman.h>
 #include <sys/syscall.h>
 #include <unistd.h>
 #endif
@@ -14,16 +18,9 @@
 #include <cstdlib>
 
 extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** stackAddress, std::size_t* stackSize);
-Pthread APS5_VABI scePthreadSelf();
+
 #ifdef __linux__
-int APS5_VABI scePthreadDetach(Pthread thread);
+
 #endif
 }
 
@@ -32,6 +29,20 @@ static constexpr std::size_t FRAME_SIZE = 4096;
 static constexpr std::size_t FRAME_MARGIN = 2 * FRAME_SIZE;
 static constexpr std::size_t HOST_CALL_STACK = 256 * 1024;
 static constexpr std::size_t STACK_SIZES[] = {16384, 65536, 1u << 20, 16u << 20};
+#ifdef __linux__
+static void* lastGuestStack = nullptr;
+static std::size_t lastGuestStackSize = 0;
+#endif
+
+#ifdef __linux__
+extern bool GuestThreadStackHostRangeOverlaps(std::uintptr_t start, std::uintptr_t end);
+static std::atomic<unsigned> observedUnmaps{0};
+
+static void ObserveUnmap(std::uintptr_t address, std::size_t bytes) {
+    if (GuestThreadStackHostRangeOverlaps(address, address + bytes)) std::abort();
+    observedUnmaps.fetch_add(1, std::memory_order_relaxed);
+}
+#endif
 
 thread_local unsigned char threadLocalBlock[512 * 1024];
 
@@ -61,6 +72,10 @@ static void* APS5_VABI Worker(void* arg) {
     void* address = nullptr;
     std::size_t size = 0;
     Require(scePthreadAttrGetstack(&attr, &address, &size) == SCE_OK);
+#ifdef __linux__
+    lastGuestStack = address;
+    lastGuestStackSize = size;
+#endif
     Require(scePthreadAttrDestroy(&attr) == SCE_OK);
     Require(size == requested);
 
@@ -78,33 +93,56 @@ static void* APS5_VABI Worker(void* arg) {
 }
 
 #ifdef __linux__
-bool GuestThreadStackHostRangeOverlaps(std::uintptr_t start, std::uintptr_t end);
-static std::atomic<unsigned> observedUnmaps{0};
-static std::atomic<std::uintptr_t> retiredStackWord{0};
-static std::atomic<bool> retiredUnmapped{false};
-static std::atomic<bool> detachedDone{false};
-static int detachedTid = 0;
+struct StackProbe {
+    std::size_t requested = 0;
+    std::uintptr_t stack = 0;
+    std::uintptr_t markerAddress = 0;
+    std::uintptr_t marker = 0;
+    std::atomic<bool> done{false};
+    int hostTid = 0;
+};
 
-static void* APS5_VABI DetachedWorker(void*) {
-    int local = 0;
-    detachedTid = static_cast<int>(syscall(SYS_gettid));
-    retiredStackWord.store(reinterpret_cast<std::uintptr_t>(&local), std::memory_order_relaxed);
-    detachedDone.store(true, std::memory_order_release);
+static void* APS5_VABI RetainedStackWorker(void* opaque) {
+    auto& probe = *static_cast<StackProbe*>(opaque);
+    PthreadAttr attr = nullptr;
+    Require(scePthreadAttrInit(&attr) == SCE_OK);
+    Require(scePthreadAttrGet(scePthreadSelf(), &attr) == SCE_OK);
+    void* address = nullptr;
+    std::size_t size = 0;
+    Require(scePthreadAttrGetstack(&attr, &address, &size) == SCE_OK);
+    Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+    Require(size == probe.requested);
+    probe.stack = reinterpret_cast<std::uintptr_t>(address);
+    probe.markerAddress = probe.stack + size - 4096;
+    *reinterpret_cast<std::uintptr_t*>(probe.markerAddress) = probe.marker;
+    Require(*reinterpret_cast<const std::uintptr_t*>(probe.markerAddress) == probe.marker);
+    probe.hostTid = static_cast<int>(syscall(SYS_gettid));
+    probe.done.store(true, std::memory_order_release);
     return nullptr;
 }
 
-static void* APS5_VABI ReaperWorker(void*) {
-    return nullptr;
-}
-
-static void ObserveUnmap(std::uintptr_t address, std::size_t bytes) {
-    if (GuestThreadStackHostRangeOverlaps(address, address + bytes)) {
-        std::fprintf(stderr, "Retired stack still owns host-only pages after unmap\n");
-        std::abort();
+static void WaitForProbe(StackProbe& probe) {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    while (!probe.done.load(std::memory_order_acquire)) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
     }
-    observedUnmaps.fetch_add(1, std::memory_order_relaxed);
-    const auto retired = retiredStackWord.load(std::memory_order_relaxed);
-    if (retired >= address && retired - address < bytes) retiredUnmapped.store(true, std::memory_order_relaxed);
+    const auto task = "/proc/self/task/" + std::to_string(probe.hostTid);
+    while (access(task.c_str(), F_OK) == 0) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+}
+
+static void RequireCachedStackDiscarded(const StackProbe& probe) {
+    const auto range = GuestAllocations::GuestAllocationsLookup_nid_postfix(probe.markerAddress, false);
+    Require(range != nullptr && range->readable && range->writable);
+    Require(*reinterpret_cast<const std::uintptr_t*>(probe.markerAddress) == 0);
+}
+
+static bool ReusesOneOf(const StackProbe& probe, const StackProbe* previous, std::size_t count) {
+    for (std::size_t i = 0; i < count; ++i) if (probe.stack == previous[i].stack) return true;
+    return false;
 }
 #endif
 
@@ -122,26 +160,91 @@ int main() {
         void* result = nullptr;
         Require(scePthreadJoin(thread, &result) == SCE_OK);
         Require(result == &stackSize);
+#ifdef __linux__
+        if (stackSize == STACK_SIZES[sizeof(STACK_SIZES) / sizeof(STACK_SIZES[0]) - 1]) {
+            const auto pageSize = static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+            const auto stackAddress = reinterpret_cast<std::uintptr_t>(lastGuestStack);
+            const auto firstPageAddress = stackAddress - stackAddress % pageSize;
+            const auto leadingBytes = stackAddress - firstPageAddress;
+            const auto pageCount = (leadingBytes + lastGuestStackSize + pageSize - 1) / pageSize;
+            std::vector<unsigned char> residency(pageCount);
+            if (mincore(reinterpret_cast<void*>(firstPageAddress), pageCount * pageSize, residency.data()) == 0) {
+                for (std::size_t page = 0; page < pageCount; ++page)
+                    Require((residency[page] & 1u) == 0);
+            } else {
+                Require(errno == ENOMEM);
+            }
+        }
+#endif
     }
 #ifdef __linux__
-    Pthread detached = nullptr;
-    Require(scePthreadCreate(&detached, nullptr, DetachedWorker, nullptr, nullptr) == SCE_OK);
-    Require(scePthreadDetach(detached) == SCE_OK);
-    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
-    while (!detachedDone.load(std::memory_order_acquire)) {
-        Require(std::chrono::steady_clock::now() < deadline);
-        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    constexpr std::size_t JoinedStackSize = 81920;
+    StackProbe joined[6];
+    for (std::size_t i = 0; i < 6; ++i) {
+        joined[i].requested = JoinedStackSize;
+        joined[i].marker = 0x77000000u + i;
+        PthreadAttr attr = nullptr;
+        Require(scePthreadAttrInit(&attr) == SCE_OK);
+        Require(scePthreadAttrSetstacksize(&attr, JoinedStackSize) == SCE_OK);
+        Pthread thread = nullptr;
+        Require(scePthreadCreate(&thread, &attr, RetainedStackWorker, &joined[i], nullptr) == SCE_OK);
+        Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+        Require(scePthreadJoin(thread, nullptr) == SCE_OK);
+        RequireCachedStackDiscarded(joined[i]);
     }
-    const auto task = "/proc/self/task/" + std::to_string(detachedTid);
-    while (access(task.c_str(), F_OK) == 0) {
-        Require(std::chrono::steady_clock::now() < deadline);
-        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    StackProbe joinedReuse;
+    joinedReuse.requested = JoinedStackSize;
+    joinedReuse.marker = 0x7700ffffu;
+    PthreadAttr joinedAttr = nullptr;
+    Require(scePthreadAttrInit(&joinedAttr) == SCE_OK);
+    Require(scePthreadAttrSetstacksize(&joinedAttr, JoinedStackSize) == SCE_OK);
+    Pthread joinedThread = nullptr;
+    Require(scePthreadCreate(&joinedThread, &joinedAttr, RetainedStackWorker, &joinedReuse, nullptr) == SCE_OK);
+    Require(scePthreadAttrDestroy(&joinedAttr) == SCE_OK);
+    Require(scePthreadJoin(joinedThread, nullptr) == SCE_OK);
+    Require(ReusesOneOf(joinedReuse, joined, 6));
+    RequireCachedStackDiscarded(joinedReuse);
+
+    constexpr std::size_t DetachedStackSize = 114688;
+    StackProbe detached[5];
+    for (std::size_t i = 0; i < 5; ++i) {
+        detached[i].requested = DetachedStackSize;
+        detached[i].marker = 0x77300000u + i;
+        PthreadAttr attr = nullptr;
+        Require(scePthreadAttrInit(&attr) == SCE_OK);
+        Require(scePthreadAttrSetstacksize(&attr, DetachedStackSize) == SCE_OK);
+        Pthread thread = nullptr;
+        Require(scePthreadCreate(&thread, &attr, RetainedStackWorker, &detached[i], nullptr) == SCE_OK);
+        Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+        Require(scePthreadDetach(thread) == SCE_OK);
+        WaitForProbe(detached[i]);
+    }
+    StackProbe detachedReuse;
+    detachedReuse.requested = DetachedStackSize;
+    detachedReuse.marker = 0x7730ffffu;
+    PthreadAttr detachedAttr = nullptr;
+    Require(scePthreadAttrInit(&detachedAttr) == SCE_OK);
+    Require(scePthreadAttrSetstacksize(&detachedAttr, DetachedStackSize) == SCE_OK);
+    Pthread detachedThread = nullptr;
+    Require(scePthreadCreate(&detachedThread, &detachedAttr, RetainedStackWorker, &detachedReuse, nullptr) == SCE_OK);
+    Require(scePthreadAttrDestroy(&detachedAttr) == SCE_OK);
+    Require(scePthreadJoin(detachedThread, nullptr) == SCE_OK);
+    for (const auto& probe : detached) RequireCachedStackDiscarded(probe);
+    Require(ReusesOneOf(detachedReuse, detached, 5));
+    RequireCachedStackDiscarded(detachedReuse);
+
+    for (std::size_t stackSize = 4u << 20; stackSize <= 20u << 20; stackSize += 1u << 20) {
+        PthreadAttr attr = nullptr;
+        Require(scePthreadAttrInit(&attr) == SCE_OK);
+        Require(scePthreadAttrSetstacksize(&attr, stackSize) == SCE_OK);
+        Pthread thread = nullptr;
+        Require(scePthreadCreate(&thread, &attr, Worker, &stackSize, nullptr) == SCE_OK);
+        Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+        void* result = nullptr;
+        Require(scePthreadJoin(thread, &result) == SCE_OK);
+        Require(result == &stackSize);
     }
-    Pthread reaper = nullptr;
-    Require(scePthreadCreate(&reaper, nullptr, ReaperWorker, nullptr, nullptr) == SCE_OK);
-    Require(scePthreadJoin(reaper, nullptr) == SCE_OK);
-    Require(retiredUnmapped.load(std::memory_order_relaxed));
-    GuestAllocations::GuestAllocationsSetUnmapObserver_nid_postfix(nullptr);
     Require(observedUnmaps.load(std::memory_order_relaxed) != 0);
+    GuestAllocations::GuestAllocationsSetUnmapObserver_nid_postfix(nullptr);
 #endif
 }
diff --git a/core/libs/tests/GuestPthreadTimedLocks.cpp b/core/libs/tests/GuestPthreadTimedLocks.cpp
index ae2a8187fa..601619c9cd 100644
--- a/core/libs/tests/GuestPthreadTimedLocks.cpp
+++ b/core/libs/tests/GuestPthreadTimedLocks.cpp
@@ -1,24 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_unlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_timedrdlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI pthread_rwlock_timedwrlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_timedlock_nid_postfix(PthreadMutex* mutex, const KernelTimespec* abstime);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int GUEST_EDEADLK = 11;
 static constexpr auto HoldTime = std::chrono::milliseconds(50);
diff --git a/core/libs/tests/GuestQsort.cpp b/core/libs/tests/GuestQsort.cpp
index f27a089c63..00e7f72ef2 100644
--- a/core/libs/tests/GuestQsort.cpp
+++ b/core/libs/tests/GuestQsort.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,14 +9,6 @@
 #include <cstring>
 #include <vector>
 
-extern "C" {
-int APS5_VABI mergesort_nid_postfix(void*, std::size_t, std::size_t, int (APS5_VABI*)(const void*, const void*));
-int* APS5_VABI __error_nid_postfix();
-void APS5_VABI qsort_nid_postfix(void*, std::size_t, std::size_t, int (APS5_VABI*)(const void*, const void*));
-int APS5_VABI qsort_s_nid_postfix(void*, std::size_t, std::size_t, int (APS5_VABI*)(const void*, const void*, void*), void*);
-void* APS5_VABI set_constraint_handler_s_nid_postfix(void*);
-}
-
 namespace {
 
 bool failAllocation = false;
@@ -156,6 +149,7 @@ bool ExpectOrder(const char* name, const std::vector<int>& keys, const std::vect
     std::vector<Element> elements;
     for (std::size_t index = 0; index < keys.size(); ++index) elements.push_back({keys[index], static_cast<int>(index)});
     qsort_nid_postfix(elements.data(), elements.size(), sizeof(Element), CompareKeys);
+
     for (std::size_t index = 0; index < tags.size(); ++index) {
         if (elements[index].tag != tags[index]) {
             std::fprintf(stderr, "%s: element %zu has tag %d, expected %d\n", name, index, elements[index].tag, tags[index]);
@@ -175,6 +169,7 @@ bool ExpectSorted(std::size_t size, std::size_t count) {
     std::vector<unsigned char> counts(256);
     for (std::size_t index = 0; index < count; ++index) ++counts[bytes[index * size]];
     qsort_nid_postfix(bytes.data(), count, size, CompareFirstByte);
+
     for (std::size_t index = 0; index < count; ++index) {
         if (index > 0 && bytes[(index - 1) * size] > bytes[index * size]) {
             std::fprintf(stderr, "qsort of %zu %zu-byte elements is not sorted at %zu\n", count, size, index);
@@ -191,7 +186,6 @@ bool ExpectSorted(std::size_t size, std::size_t count) {
     return true;
 }
 
-
 bool CheckMergesort() {
     InitializeHeap();
     bool correct = true;
diff --git a/core/libs/tests/GuestRaiseException.cpp b/core/libs/tests/GuestRaiseException.cpp
index fd74e36771..205e6e4c81 100644
--- a/core/libs/tests/GuestRaiseException.cpp
+++ b/core/libs/tests/GuestRaiseException.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -13,33 +18,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
-int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
-int APS5_VABI sceKernelRaiseException(Pthread thread, int signum);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t attr, int init, int max, void* opt);
-int APS5_VABI sceKernelDeleteSema(KernelSema sem);
-int APS5_VABI sceKernelSignalSema(KernelSema sem, int count);
-int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTimedlock(PthreadMutex* mutex, KernelUseconds usec);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadRwlockInit(PthreadRwlock* rwlock, const PthreadRwlockattr* attr, const char* name);
-int APS5_VABI scePthreadRwlockDestroy(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockWrlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockUnlock(PthreadRwlock* rwlock);
-int APS5_VABI sceKernelSyncOnAddressWait(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWake(void* address, std::int32_t count);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003c);
 static constexpr int SIGUSR1 = 30;
 static constexpr int Repeats = 50;
 static constexpr std::size_t R12Offset = 0xa0;
@@ -404,7 +382,6 @@ static void NestedWaitKeepsOuterWake() {
     Require(sceKernelDeleteSema(sem) == 0);
 }
 
-#ifdef _WIN32
 static constexpr int AddressRounds = 50;
 static std::uint32_t addressWord = 0;
 static std::uint32_t otherAddressWord = 0;
@@ -483,7 +460,36 @@ static void HandlerLeavesAddressLock(PthreadEntry entry, const char* name) {
     worker.stop.store(true);
     Require(scePthreadJoin(thread, nullptr) == 0);
 }
-#endif
+
+static std::uint32_t idleWord = 0;
+
+static void* APS5_VABI AddressIdle(void* arg) {
+    auto& worker = *static_cast<Worker*>(arg);
+    worker.id = std::this_thread::get_id();
+    worker.started.store(true);
+    worker.waitResult = sceKernelSyncOnAddressWait(&idleWord, 0, nullptr, "address idle");
+    return nullptr;
+}
+
+static void HandlerRunsInUnboundedAddressWait() {
+    Worker worker;
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, nullptr, AddressIdle, &worker, "address idle") == 0);
+    while (!worker.started.load()) std::this_thread::yield();
+    std::this_thread::sleep_for(std::chrono::milliseconds(50));
+    holdingEntered.store(false);
+    holdingLeft.store(false);
+    holdingRelease.store(false);
+    Require(sceKernelRaiseException(thread, SIGUSR1) == 0);
+    RequireInRound(AwaitWithin(holdingEntered, std::chrono::seconds(5)), "address idle", 0, "the handler did not run while the thread waited without a timeout");
+    RequireInRound(holdingThread.load() == worker.id, "address idle", 0, "the handler ran on another thread");
+    holdingRelease.store(true);
+    RequireInRound(AwaitWithin(holdingLeft, std::chrono::seconds(5)), "address idle", 0, "the handler did not return within 5 s of its release");
+    std::atomic_ref<std::uint32_t>(idleWord).store(1);
+    Require(sceKernelSyncOnAddressWake(&idleWord, 1) >= 0);
+    Require(scePthreadJoin(thread, nullptr) == 0);
+    Require(worker.waitResult == 0);
+}
 
 static void ExpectDelivery(int before, std::thread::id thread) {
     for (int attempt = 0; attempt < 5000 && calls.load() == before; ++attempt) std::this_thread::sleep_for(std::chrono::milliseconds(1));
@@ -551,6 +557,7 @@ int main() {
     bool rejected = false;
     try {
         sceKernelRaiseException(scePthreadSelf(), SIGUSR1);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -659,6 +666,7 @@ int main() {
     bool refused = false;
     try {
         sceKernelRaiseException(loopingThread, SIGUSR1);
+
     } catch (const std::runtime_error&) {
         refused = true;
     }
@@ -745,10 +753,9 @@ int main() {
     NestedWaitKeepsOuterWake();
     Require(sceKernelRemoveExceptionHandler(SIGUSR1) == 0);
 
-#ifdef _WIN32
     Require(sceKernelInstallExceptionHandler(SIGUSR1, reinterpret_cast<void*>(&HoldingHandler)) == 0);
     HandlerLeavesAddressLock(AddressWaking, "address waking");
     HandlerLeavesAddressLock(AddressWaiting, "address waiting");
+    HandlerRunsInUnboundedAddressWait();
     Require(sceKernelRemoveExceptionHandler(SIGUSR1) == 0);
-#endif
 }
diff --git a/core/libs/tests/GuestRaiseInHostCode.cpp b/core/libs/tests/GuestRaiseInHostCode.cpp
index 0a41f83ca8..e89332fc4c 100644
--- a/core/libs/tests/GuestRaiseInHostCode.cpp
+++ b/core/libs/tests/GuestRaiseInHostCode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <atomic>
@@ -8,14 +9,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI sceKernelInstallExceptionHandler(int, void*);
-int APS5_VABI sceKernelRemoveExceptionHandler(int);
-int APS5_VABI sceKernelRaiseException(Pthread, int);
-}
-
 static constexpr int SigUsr1 = 30;
 static constexpr int Raises = 100;
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestRaiseInSystemCall.cpp b/core/libs/tests/GuestRaiseInSystemCall.cpp
index 834594d260..6f0d08c8be 100644
--- a/core/libs/tests/GuestRaiseInSystemCall.cpp
+++ b/core/libs/tests/GuestRaiseInSystemCall.cpp
@@ -1,86 +1,122 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <fcntl.h>
 #include <io.h>
 #include <string>
+#include <string_view>
 #include <thread>
 #include <windows.h>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI sceKernelInstallExceptionHandler(int, void*);
-int APS5_VABI sceKernelRemoveExceptionHandler(int);
-int APS5_VABI sceKernelRaiseException(Pthread, int);
-}
-
 static constexpr int SigUsr1 = 30;
 static constexpr int Raises = 10;
 static constexpr DWORD PipeBytes = 4096;
+static constexpr std::uint64_t BlockBytes = 4u * PipeBytes;
+static constexpr std::size_t RipOffset = 0xe0;
+static constexpr ULONG ThreadSuspendCount = 35;
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::FILE* shared = nullptr;
 static std::atomic<int> deliveries{0};
 static std::atomic<int> released{0};
-static std::atomic<bool> stop{false};
-static std::atomic<int> blocks{0};
+static std::atomic<int> written{0};
+static std::atomic<int> blocked{0};
+static std::atomic<HANDLE> writerThread{nullptr};
+static bool delayReturn = false;
 
-static void APS5_VABI Handler(int, void*) {
+static bool InTestImage(std::uint64_t rip) {
+    const auto base = reinterpret_cast<std::uint64_t>(GetModuleHandleW(nullptr));
+    const auto* dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
+    const auto* nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(base + dos->e_lfanew);
+    return rip >= base && rip - base < nt->OptionalHeader.SizeOfImage;
+}
+
+static bool Suspended(HANDLE thread) {
+    using Query = LONG(NTAPI*)(HANDLE, ULONG, void*, ULONG, ULONG*);
+    static const auto query = reinterpret_cast<Query>(GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtQueryInformationThread"));
+    ULONG count = 0;
+    Require(query != nullptr && query(thread, ThreadSuspendCount, &count, sizeof(count), nullptr) >= 0);
+    return count > 0;
+}
+
+static void APS5_VABI Handler(int, void* context) {
     const auto delivery = deliveries.fetch_add(1) + 1;
+    std::uint64_t rip = 0;
+    std::memcpy(&rip, static_cast<const std::byte*>(context) + RipOffset, sizeof(rip));
+    Require(InTestImage(rip));
     while (released.load() < delivery) std::this_thread::yield();
 }
 
 static void* APS5_VABI Writer(void*) {
-    const std::string block(16u * PipeBytes, 'x');
-    while (!stop.load()) {
+    HANDLE self = nullptr;
+    Require(DuplicateHandle(GetCurrentProcess(), GetCurrentThread(), GetCurrentProcess(), &self, THREAD_QUERY_INFORMATION, FALSE, 0) != 0);
+    writerThread.store(self);
+    const std::string block(BlockBytes, 'x');
+    for (int raise = 1; raise <= Raises; ++raise) {
         Require(std::fwrite(block.data(), 1, block.size(), shared) == block.size());
-        blocks.fetch_add(1);
-        volatile std::uint64_t spin = 0;
-        for (std::uint64_t i = 0; i < 200000; ++i) spin = spin + i;
+        if (delayReturn) {
+            volatile std::uint64_t spin = 0;
+            for (std::uint64_t i = 0; i < 100000000; ++i) spin = spin + i;
+        }
+        written.store(raise);
+        while (deliveries.load() < raise) {
+        }
     }
     return nullptr;
 }
 
-int main() {
+int main(int argc, char** argv) {
+    const std::string_view mode = argc > 1 ? argv[1] : "";
+    Require(mode.empty() || mode == "--delay-raise" || mode == "--delay-return");
+    delayReturn = mode == "--delay-return";
     std::atomic<bool> done{false};
     std::thread watchdog([&done] {
-        for (int i = 0; i < 25000 && !done.load(); ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(25);
+        while (!done.load() && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(10));
         if (!done.load()) std::abort();
     });
     HANDLE read = nullptr;
     HANDLE write = nullptr;
     Require(CreatePipe(&read, &write, nullptr, PipeBytes) != 0);
     shared = _fdopen(_open_osfhandle(reinterpret_cast<intptr_t>(write), _O_WRONLY | _O_BINARY), "wb");
-    Require(shared != nullptr);
-    std::atomic<bool> draining{true};
+    Require(shared != nullptr && std::setvbuf(shared, nullptr, _IONBF, 0) == 0);
     std::thread reader([&] {
         char chunk[PipeBytes];
         DWORD got = 0;
+        std::uint64_t total = 0;
+        int block = 0;
         while (ReadFile(read, chunk, sizeof(chunk), &got, nullptr) != 0 && got != 0) {
-            if (draining.load()) std::this_thread::sleep_for(std::chrono::milliseconds(10));
+            total += got;
+            if (block == Raises || total <= static_cast<std::uint64_t>(block) * (BlockBytes + 1)) continue;
+            blocked.store(++block);
+            while (!Suspended(writerThread.load())) {
+            }
+            std::this_thread::sleep_for(std::chrono::milliseconds(100));
+            Require(written.load() < block);
         }
     });
     Require(sceKernelInstallExceptionHandler(SigUsr1, reinterpret_cast<void*>(&Handler)) == 0);
     Pthread writer = nullptr;
     Require(scePthreadCreate(&writer, nullptr, Writer, nullptr, "pipe writer") == 0);
-    while (blocks.load() == 0) std::this_thread::yield();
     for (int raise = 1; raise <= Raises; ++raise) {
+        while (blocked.load() < raise) std::this_thread::yield();
+        if (mode == "--delay-raise") std::this_thread::sleep_for(std::chrono::milliseconds(200));
         Require(sceKernelRaiseException(writer, SigUsr1) == 0);
         while (deliveries.load() < raise) std::this_thread::yield();
         Require(std::fputc('y', shared) == 'y');
         released.store(raise);
     }
-    stop.store(true);
-    draining.store(false);
     Require(scePthreadJoin(writer, nullptr) == 0);
     Require(sceKernelRemoveExceptionHandler(SigUsr1) == 0);
     std::fclose(shared);
     reader.join();
     CloseHandle(read);
+    CloseHandle(writerThread.load());
     done.store(true);
     watchdog.join();
 }
diff --git a/core/libs/tests/GuestRaiseNestedSleep.cpp b/core/libs/tests/GuestRaiseNestedSleep.cpp
index 839f831ecf..b5e27b4f5a 100644
--- a/core/libs/tests/GuestRaiseNestedSleep.cpp
+++ b/core/libs/tests/GuestRaiseNestedSleep.cpp
@@ -1,18 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
-int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
-int APS5_VABI sceKernelRaiseException(Pthread thread, int signum);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-}
-
 static constexpr int SIGUSR1 = 30;
 static constexpr int SCE_OK = 0;
 static constexpr KernelUseconds OuterSleep = 1000000;
diff --git a/core/libs/tests/GuestRandom.cpp b/core/libs/tests/GuestRandom.cpp
index df1d5f83c9..9ac352658a 100644
--- a/core/libs/tests/GuestRandom.cpp
+++ b/core/libs/tests/GuestRandom.cpp
@@ -1,11 +1,9 @@
+#include "prx/libSceRandom/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceRandomGetRandomNumber(void*, std::size_t);
-}
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     constexpr int invalid = static_cast<int>(0x817C0016);
diff --git a/core/libs/tests/GuestRandomDeviceSeed.cpp b/core/libs/tests/GuestRandomDeviceSeed.cpp
new file mode 100644
index 0000000000..0f2ffde1ad
--- /dev/null
+++ b/core/libs/tests/GuestRandomDeviceSeed.cpp
@@ -0,0 +1,91 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/HostEntropy.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+
+static void* entropyBuffer;
+static std::size_t entropySize;
+static bool failEntropy;
+
+void HostEntropy_nid_no_patch(void* buffer, std::size_t size) {
+    entropyBuffer = buffer;
+    entropySize = size;
+    if (failEntropy) throw std::runtime_error("entropy unavailable");
+    auto* bytes = static_cast<unsigned char*>(buffer);
+    for (std::size_t i = 0; i < size; ++i) bytes[i] = static_cast<unsigned char>(i * 37 + 11);
+}
+
+static void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "%s\n", message);
+        std::abort();
+    }
+}
+
+static std::uint32_t Word(const char* buffer, std::size_t index) {
+    std::uint32_t value;
+    std::memcpy(&value, buffer + sizeof(value) * index, sizeof(value));
+    return value;
+}
+
+int main() {
+    constexpr std::array<std::size_t, 5> sizes {8, 32, 64, 128, 256};
+    constexpr std::array<std::size_t, 5> degrees {1, 7, 15, 31, 63};
+    constexpr std::array<std::size_t, 5> separations {0, 3, 1, 3, 1};
+    std::array<char, 272> state{};
+    for (std::size_t type = 0; type < sizes.size(); ++type) {
+        state.fill(static_cast<char>(0xa5));
+        char* table = state.data() + 1;
+        char* previous = initstate_nid_postfix(42, table, static_cast<std::int64_t>(sizes[type]));
+        for (int i = 0; i < 5; ++i) random_nid_postfix();
+        const std::uint32_t header = Word(table, 0);
+        srandomdev_nid_postfix();
+        Require(entropyBuffer == table + 4, "srandomdev fills the active state after its header");
+        Require(entropySize == degrees[type] * 4, "srandomdev fills every generator word");
+        Require(Word(table, 0) == header, "srandomdev leaves the saved header untouched");
+        for (std::size_t i = 0; i < entropySize; ++i)
+            Require(static_cast<unsigned char>(table[4 + i]) == static_cast<unsigned char>(i * 37 + 11),
+                "srandomdev neither derives words from one seed nor advances the generator");
+        Require(state[0] == static_cast<char>(0xa5) &&
+            std::all_of(state.begin() + 1 + sizes[type], state.end(), [](char c) { return c == static_cast<char>(0xa5); }),
+            "srandomdev preserves the buffer guards");
+        const auto seeded = state;
+        if (type != 0) {
+            const std::uint32_t sum = Word(table, 1) + Word(table, 1 + separations[type]);
+            Require(random_nid_postfix() == sum / 2, "srandomdev resets the front and rear positions");
+            Require(Word(table, 1 + separations[type]) == sum, "random advances the newly seeded table");
+        } else {
+            std::int64_t x = static_cast<std::int32_t>(Word(table, 1));
+            if (x == 0) x = 123459876;
+            x = 16807 * (x % 127773) - 2836 * (x / 127773);
+            if (x < 0) x += 0x7fffffff;
+            const auto expected = x;
+            Require(random_nid_postfix() == static_cast<std::int64_t>(expected), "the linear generator uses the entropy word");
+        }
+        setstate_nid_postfix(previous);
+        Require(Word(table, 0) == type + (type == 0 ? 0 : 5), "the reseeded state saves its new position");
+        state = seeded;
+        const std::uint32_t resetHeader = static_cast<std::uint32_t>(type);
+        std::memcpy(table, &resetHeader, sizeof(resetHeader));
+        setstate_nid_postfix(table);
+        const auto beforeFailure = state;
+        failEntropy = true;
+        bool threw = false;
+        try {
+            srandomdev_nid_postfix();
+        } catch (const std::runtime_error&) {
+            threw = true;
+        }
+        failEntropy = false;
+        Require(threw, "srandomdev propagates entropy failures");
+        Require(state == beforeFailure, "an entropy failure before writing keeps the state");
+        setstate_nid_postfix(previous);
+    }
+}
diff --git a/core/libs/tests/GuestRandomState.cpp b/core/libs/tests/GuestRandomState.cpp
index 71511241be..6e126f762d 100644
--- a/core/libs/tests/GuestRandomState.cpp
+++ b/core/libs/tests/GuestRandomState.cpp
@@ -1,6 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
+#include <cmath>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
@@ -10,23 +12,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-std::int64_t APS5_VABI random_nid_postfix();
-void APS5_VABI srandom_nid_postfix(std::uint64_t);
-char* APS5_VABI initstate_nid_postfix(std::uint64_t, char*, std::int64_t);
-char* APS5_VABI setstate_nid_postfix(char*);
-int* APS5_VABI __error_nid_postfix();
-double APS5_VABI erand48_nid_postfix(std::uint16_t*);
-std::int64_t APS5_VABI nrand48_nid_postfix(std::uint16_t*);
-std::int64_t APS5_VABI jrand48_nid_postfix(std::uint16_t*);
-double APS5_VABI drand48_nid_postfix();
-std::int64_t APS5_VABI lrand48_nid_postfix();
-std::int64_t APS5_VABI mrand48_nid_postfix();
-void APS5_VABI srand48_nid_postfix(std::int64_t);
-std::uint16_t* APS5_VABI seed48_nid_postfix(const std::uint16_t*);
-void APS5_VABI lcong48_nid_postfix(const std::uint16_t*);
-}
-
 static int failures = 0;
 
 static void Require(bool condition, const char* message) {
@@ -56,10 +41,10 @@ static bool SeedIs(const std::uint16_t* seed, std::uint16_t low, std::uint16_t m
 
 static void CheckRand48() {
     std::uint16_t seed[3] = {0x330e, 0xabcd, 0x1234};
-    Require(erand48_nid_postfix(seed) == 0x657eb7255101p-48 && SeedIs(seed, 0x5101, 0xb725, 0x657e), "erand48 first value");
+    Require(erand48_nid_postfix(seed) == 0x657eb725p-32 && SeedIs(seed, 0x5101, 0xb725, 0x657e), "erand48 first value");
     Require(nrand48_nid_postfix(seed) == 1804928587 && SeedIs(seed, 0x6378, 0x0c96, 0xd72a), "nrand48 second value");
     Require(jrand48_nid_postfix(seed) == 1517566982 && SeedIs(seed, 0x2a23, 0x3c06, 0x5a74), "jrand48 third value");
-    Require(erand48_nid_postfix(seed) == 0x72534abf62f2p-48 && SeedIs(seed, 0x62f2, 0x4abf, 0x7253), "erand48 fourth value");
+    Require(erand48_nid_postfix(seed) == 0x72534abfp-32 && SeedIs(seed, 0x62f2, 0x4abf, 0x7253), "erand48 fourth value");
     Require(nrand48_nid_postfix(seed) == 684387517 && SeedIs(seed, 0x8d15, 0xd97a, 0x5195), "nrand48 fifth value");
     Require(jrand48_nid_postfix(seed) == 3807181130 && SeedIs(seed, 0xeffc, 0xf94a, 0xe2ec), "jrand48 keeps bit 31 without sign extension");
 
@@ -78,6 +63,7 @@ static void CheckRand48() {
 
     const std::uint16_t parameters[7] = {1, 0, 0, 3, 0, 0, 5};
     lcong48_nid_postfix(parameters);
+
     Require(lrand48_nid_postfix() == 0 && mrand48_nid_postfix() == 0, "lcong48 sets seed, multiplier and addend");
     std::uint16_t high[3] = {0, 0, 1};
     Require(jrand48_nid_postfix(high) == 196608 && SeedIs(high, 5, 0, 3), "lcong48 multiplier scales the seed");
@@ -90,6 +76,7 @@ static void CheckRand48() {
     Require(drand48_nid_postfix() == erand48_nid_postfix(again), "seed48 restores the default multiplier and addend");
     lcong48_nid_postfix(parameters);
     srand48_nid_postfix(0x1234abcd);
+
     std::uint16_t reset[3] = {0x330e, 0xabcd, 0x1234};
     Require(lrand48_nid_postfix() == nrand48_nid_postfix(reset), "srand48 restores the default multiplier and addend");
 
@@ -101,20 +88,25 @@ static void CheckRand48() {
     Require(jrand48_nid_postfix(ones) == 4294582547, "jrand48 matches the console for an all-ones seed");
     constexpr std::array<std::int64_t, 6> consoleMrand48 {178800969, 1952030186, 3585512650, 1443049011, 2428758494, 7588830};
     srand48_nid_postfix(1);
+
     for (const std::int64_t expected : consoleMrand48) Require(mrand48_nid_postfix() == expected, "mrand48 matches the console after srand48(1)");
+    constexpr std::array<double, 3> consoleDrand48 {0x4435afd7p-32, 0xae99dc60p-32, 0x43f73108p-32};
+    srand48_nid_postfix(7);
+    for (const double expected : consoleDrand48) Require(drand48_nid_postfix() == expected, "drand48 matches the titles' libc.prx after srand48(7)");
 
 #ifndef _WIN32
     std::uint16_t guest[3] = {0x1234, 0x5678, 0x9abc};
     unsigned short host[3] = {0x1234, 0x5678, 0x9abc};
     for (int round = 0; round < 64; ++round) {
-        Require(erand48_nid_postfix(guest) == ::erand48(host), "erand48 matches the host");
+        Require(erand48_nid_postfix(guest) == std::ldexp(std::floor(::erand48(host) * 0x1p32), -32), "erand48 keeps the host's upper 32 bits");
         Require(nrand48_nid_postfix(guest) == ::nrand48(host), "nrand48 matches the host");
         Require(jrand48_nid_postfix(guest) == static_cast<std::uint32_t>(::jrand48(host)), "jrand48 matches the host's 32 bits");
     }
     ::srand48(1234567);
     srand48_nid_postfix(1234567);
+
     for (int round = 0; round < 32; ++round) {
-        Require(drand48_nid_postfix() == ::drand48(), "drand48 matches the host");
+        Require(drand48_nid_postfix() == std::ldexp(std::floor(::drand48() * 0x1p32), -32), "drand48 keeps the host's upper 32 bits");
         Require(lrand48_nid_postfix() == ::lrand48(), "lrand48 matches the host");
         Require(mrand48_nid_postfix() == static_cast<std::uint32_t>(::mrand48()), "mrand48 matches the host's 32 bits");
     }
@@ -123,23 +115,26 @@ static void CheckRand48() {
 
 int main() {
     CheckRand48();
-    constexpr Sequence seedOne {1408992891, 1638182910, 83848093, 145962118, 627851256};
-    constexpr Sequence seed12345 {1052984060, 1639322404, 1971525204, 2097956667, 2012147915};
+    constexpr Sequence seedOne {1804289383, 846930886, 1681692777, 1714636915, 1957747793};
+    constexpr Sequence seed12345 {383100999, 858300821, 357768173, 455528251, 133005921};
     constexpr std::array<Sequence, 5> seed42ByType {{
-        {2060028338, 1164936638, 481681973, 1763071474, 962919018},
-        {660273387, 1356916325, 287587791, 1132382070, 1497594867},
-        {1015209508, 12952757, 1418769128, 2005808989, 1212998434},
-        {745791173, 418148062, 949332769, 1480536337, 177711995},
-        {996638292, 1209745284, 1148231710, 400392963, 1149215164},
+        {413993338, 139015486, 2118548913, 1172713531, 191403351},
+        {769798547, 2024571666, 1204852799, 931293870, 1762463907},
+        {2051258974, 339992574, 1379825892, 1298392284, 825292997},
+        {71876166, 708592740, 1483128881, 907283241, 442951012},
+        {472624893, 994493761, 100792968, 176611971, 1804504504},
     }};
-    constexpr std::array<std::int64_t, 6> seed7Type1 {1271472800, 27686551, 1252069488, 1609001632, 28873941, 508017694};
+    constexpr std::array<std::int64_t, 6> seed7Type1 {1380991591, 1769076016, 21842418, 334161865, 1367472909, 1249858043};
 
     Require(Draw() == seedOne, "unseeded random must match srandom(1)");
     srandom_nid_postfix(1);
+
     Require(Draw() == seedOne, "srandom(1) sequence");
     srandom_nid_postfix(0x100000001ull);
+
     Require(Draw() == seedOne, "srandom must use the low 32 bits of the seed");
     srandom_nid_postfix(12345);
+
     Require(Draw() == seed12345, "srandom(12345) sequence");
 
     struct SizeCase {
@@ -167,14 +162,16 @@ int main() {
     }
     Require(defaultTable != nullptr && Word(defaultTable, 0) == 5 * 5 + 3, "default table must hold its rear position");
     Require(setstate_nid_postfix(defaultTable) == active, "setstate must return the previous state");
-    Require(random_nid_postfix() == 1533042628 && random_nid_postfix() == 1225903521,
+    Require(random_nid_postfix() == 116285904 && random_nid_postfix() == 591987137,
         "setstate on the default table must continue the srandom(12345) sequence");
 
     alignas(4) std::array<char, 32> small{};
     alignas(4) std::array<char, 64> large{};
     initstate_nid_postfix(7, small.data(), static_cast<std::int64_t>(small.size()));
+
     for (std::size_t i = 0; i < 3; ++i) Require(random_nid_postfix() == seed7Type1[i], "initstate(7) on 32 bytes");
     initstate_nid_postfix(7, large.data(), static_cast<std::int64_t>(large.size()));
+
     Require(setstate_nid_postfix(small.data()) == large.data(), "setstate must return the 64-byte state");
     Require(setstate_nid_postfix(large.data()) == small.data(), "setstate must return the 32-byte state");
     Require(Word(small.data(), 0) == 5 * 3 + 1, "setstate must save the rear position of the old state");
@@ -203,6 +200,7 @@ int main() {
     bool threw = false;
     try {
         initstate_nid_postfix(1, nullptr, 128);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -210,6 +208,7 @@ int main() {
     threw = false;
     try {
         setstate_nid_postfix(nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -218,9 +217,11 @@ int main() {
     constexpr std::size_t threadCount = 4;
     constexpr std::size_t callsPerThread = 2000;
     srandom_nid_postfix(99);
+
     std::vector<std::int64_t> serial(threadCount * callsPerThread);
     for (auto& value : serial) value = random_nid_postfix();
     srandom_nid_postfix(99);
+
     std::vector<std::int64_t> concurrent(threadCount * callsPerThread);
     std::vector<std::thread> threads;
     for (std::size_t t = 0; t < threadCount; ++t)
@@ -232,5 +233,25 @@ int main() {
     std::sort(concurrent.begin(), concurrent.end());
     Require(serial == concurrent, "concurrent calls must draw the serial sequence");
 
+    for (const std::int64_t size : {8, 32, 64, 128, 256}) {
+        std::array<char, 256> entropyState{};
+        char* previous = initstate_nid_postfix(42, entropyState.data(), size);
+        srandomdev_nid_postfix();
+        const std::size_t separation = size == 32 || size == 128 ? 3 : 1;
+        std::int64_t expected;
+        if (size == 8) {
+            std::int64_t x = static_cast<std::int32_t>(Word(entropyState.data(), 1));
+            if (x == 0) x = 123459876;
+            x = 16807 * (x % 127773) - 2836 * (x / 127773);
+            if (x < 0) x += 0x7fffffff;
+            expected = x;
+        } else {
+            const std::uint32_t sum = Word(entropyState.data(), 1) + Word(entropyState.data(), 1 + separation);
+            expected = sum >> 1;
+        }
+        Require(random_nid_postfix() == expected, "srandomdev seeds the shared library's active state from host entropy");
+        setstate_nid_postfix(previous);
+    }
+
     return failures == 0 ? 0 : 1;
 }
diff --git a/core/libs/tests/GuestRazorCpu.cpp b/core/libs/tests/GuestRazorCpu.cpp
index 69f35dbfa0..f938b7a80b 100644
--- a/core/libs/tests/GuestRazorCpu.cpp
+++ b/core/libs/tests/GuestRazorCpu.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRazorCpu/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,31 +6,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t APS5_VABI sceRazorCpuIsCapturing(void);
-int APS5_VABI sceRazorCpuJobManagerDispatch(const char* label, std::uint16_t firstId, std::uint16_t secondId, std::uint16_t firstCount, std::uint16_t secondCount, std::uint64_t firstValue, std::uint64_t secondValue);
-int APS5_VABI sceRazorCpuJobManagerJob(std::uint16_t firstId, std::uint16_t secondId, std::uint16_t thirdId, std::uint16_t event);
-int APS5_VABI sceRazorCpuJobManagerSequence(const char* label, std::uint16_t firstId, std::uint16_t secondId, std::uint16_t event);
-int APS5_VABI sceRazorCpuPushMarker(const char* label, std::uint32_t color, std::uint32_t flags);
-int APS5_VABI sceRazorCpuNamedSync(const char* label);
-int APS5_VABI sceRazorCpuPushMarkerStatic(const char* name, std::uint32_t color, std::uint32_t flags);
-int APS5_VABI sceRazorCpuPopMarker(void);
-bool APS5_VABI sceRazorCpuFlushOccurred(std::uint64_t* timeSpentInFlush);
-int APS5_VABI sceRazorCpuPlotValue(const char* series, float value);
-int APS5_VABI sceRazorCpuWriteBookmark(const char* label, const char* description);
-int APS5_VABI sceRazorCpuSync(void);
-void APS5_VABI sceRazorCpuDisableFiberUserMarkers(void);
-int APS5_VABI sceRazorCpuInitDataTags(void* buffer, std::size_t size);
-int APS5_VABI sceRazorCpuShutdownDataTags(void);
-std::size_t APS5_VABI sceRazorCpuGetDataTagStorageSize(std::uint32_t tagCount);
-int APS5_VABI sceRazorCpuTagArray(const char* label, std::uint32_t category, void* array, std::size_t bufferSize, std::size_t elementSize);
-int APS5_VABI sceRazorCpuTagBuffer(const char* label, std::uint32_t category, void* buffer, std::size_t bufferSize);
-int APS5_VABI sceRazorCpuResizeTaggedBuffer(std::uint32_t category, void* buffer, std::size_t newBufferSize);
-int APS5_VABI sceRazorCpuUnTagBuffer(std::uint32_t category, void* buffer);
-int APS5_VABI sceRazorCpuBeginLogicalFileAccess(const char* filename, std::uint64_t tag, std::uint64_t size, std::uint8_t operation);
-int APS5_VABI sceRazorCpuEndLogicalFileAccess(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -91,6 +67,7 @@ int main() {
     bool threw = false;
     try {
         sceRazorCpuGetDataTagStorageSize(16);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestReallocalign.cpp b/core/libs/tests/GuestReallocalign.cpp
index fded34f311..ff924916d5 100644
--- a/core/libs/tests/GuestReallocalign.cpp
+++ b/core/libs/tests/GuestReallocalign.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -5,11 +6,6 @@
 #include <limits>
 #include <stdexcept>
 
-extern "C" {
-void* APS5_VABI reallocalign_nid_postfix(void*, std::size_t, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value) {
@@ -30,12 +26,28 @@ int main() {
     auto* shrunk = static_cast<unsigned char*>(reallocalign_nid_postfix(grown, 16, 16));
     Require(shrunk != nullptr && (reinterpret_cast<std::uintptr_t>(shrunk) % 16) == 0);
     for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
-    *__error_nid_postfix() = 0;
-    Require(reallocalign_nid_postfix(shrunk, 16, 0) == nullptr && *__error_nid_postfix() == 22);
-    *__error_nid_postfix() = 0;
-    Require(reallocalign_nid_postfix(shrunk, 16, 3) == nullptr && *__error_nid_postfix() == 22);
-    *__error_nid_postfix() = 0;
-    Require(reallocalign_nid_postfix(shrunk, std::numeric_limits<std::size_t>::max(), 16) == nullptr && *__error_nid_postfix() == 12);
+    shrunk = static_cast<unsigned char*>(reallocalign_nid_postfix(shrunk, 16, 0));
+    Require(shrunk != nullptr && (reinterpret_cast<std::uintptr_t>(shrunk) % 32) == 0);
     for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
-    Require(reallocalign_nid_postfix(shrunk, 0, 16) == nullptr);
+    shrunk = static_cast<unsigned char*>(reallocalign_nid_postfix(shrunk, 40, 100));
+    Require(shrunk != nullptr && (reinterpret_cast<std::uintptr_t>(shrunk) % 128) == 0);
+    for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
+    constexpr std::size_t max = std::numeric_limits<std::size_t>::max();
+    *__error_nid_postfix() = 77;
+    Require(reallocalign_nid_postfix(shrunk, max, 16) == nullptr && *__error_nid_postfix() == 77);
+    Require(reallocalign_nid_postfix(shrunk, max - 0x1008f, 16) == nullptr && *__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 77;
+    Require(reallocalign_nid_postfix(shrunk, max - 0x110ae, 4096) == nullptr && *__error_nid_postfix() == 77);
+    Require(reallocalign_nid_postfix(shrunk, max - 0x110af, 4096) == nullptr && *__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 77;
+    Require(reallocalign_nid_postfix(shrunk, 16, std::size_t{1} << 63) == nullptr && *__error_nid_postfix() == 77);
+    for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
+    Require(reallocalign_nid_postfix(shrunk, 0, 16) == shrunk && malloc_usable_size_nid_postfix(shrunk) == 0);
+    free_nid_postfix(shrunk);
+
+    void* empty = reallocalign_nid_postfix(nullptr, 0, 0);
+    Require(empty != nullptr);
+    free_nid_postfix(empty);
+
+    return 0;
 }
diff --git a/core/libs/tests/GuestRealpath.cpp b/core/libs/tests/GuestRealpath.cpp
index faae73050f..52240b0a7f 100644
--- a/core/libs/tests/GuestRealpath.cpp
+++ b/core/libs/tests/GuestRealpath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -11,13 +12,6 @@
 #include <fstream>
 #include <string>
 
-extern "C" {
-char* APS5_VABI realpath_nid_postfix(const char*, char*);
-int APS5_VABI chdir_nid_postfix(const char*);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool Resolves(const std::string& path, const std::string& expected) {
diff --git a/core/libs/tests/GuestRecordLockOwners.cpp b/core/libs/tests/GuestRecordLockOwners.cpp
index cbffd82062..416bb02141 100644
--- a/core/libs/tests/GuestRecordLockOwners.cpp
+++ b/core/libs/tests/GuestRecordLockOwners.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 
@@ -12,13 +15,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value, int line) {
diff --git a/core/libs/tests/GuestRefusedConnect.cpp b/core/libs/tests/GuestRefusedConnect.cpp
index 409f8ad97c..b78fccbe41 100644
--- a/core/libs/tests/GuestRefusedConnect.cpp
+++ b/core/libs/tests/GuestRefusedConnect.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <chrono>
@@ -5,22 +8,6 @@
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetInit_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetSocketClose(int);
-int* APS5_VABI sceNetErrnoLoc();
-}
-
 namespace {
 
 constexpr int GuestInet = 2;
diff --git a/core/libs/tests/GuestRegMgr.cpp b/core/libs/tests/GuestRegMgr.cpp
index dfdf074535..ec355a78f7 100644
--- a/core/libs/tests/GuestRegMgr.cpp
+++ b/core/libs/tests/GuestRegMgr.cpp
@@ -1,13 +1,11 @@
+#include "prx/libSceRegMgr/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-std::int32_t APS5_VABI sceRegMgrNonSysGetInt(std::int64_t key, std::int32_t unk, std::int32_t* data);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
@@ -24,4 +22,26 @@ int main() {
     std::int32_t value = 0;
     Require(ReportsNotImplemented("sceRegMgrNonSysGetInt", [&] { sceRegMgrNonSysGetInt(0, 0, &value); }));
     Require(ReportsNotImplemented("sceRegMgrNonSysGetInt", [&] { sceRegMgrNonSysGetInt(-1, 1, nullptr); }));
+
+    int32_t intVal = 0;
+    char strBuf[64] = {};
+    uint8_t binBuf[32] = {};
+
+    Require(sceRegMgrGetInt(0x1000, nullptr) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetStr(0x1001, nullptr, 10) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetStr(0x1001, strBuf, -1) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetBin(0x1002, nullptr, 10) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetBin(0x1002, binBuf, -1) == static_cast<int>(0x80820001));
+
+    intVal = 0x55AA;
+    Require(sceRegMgrGetInt(888888, &intVal) == static_cast<int>(0x80820002));
+    Require(intVal == 0x55AA);
+    std::strcpy(strBuf, "CANARY");
+    Require(sceRegMgrGetStr(888888, strBuf, sizeof(strBuf)) == static_cast<int>(0x80820002));
+    Require(std::strcmp(strBuf, "CANARY") == 0);
+    binBuf[0] = 0x77;
+    Require(sceRegMgrGetBin(888888, binBuf, sizeof(binBuf)) == static_cast<int>(0x80820002));
+    Require(binBuf[0] == 0x77);
+
+    return 0;
 }
diff --git a/core/libs/tests/GuestRenameDot.cpp b/core/libs/tests/GuestRenameDot.cpp
index ed44b81e35..83260cf108 100644
--- a/core/libs/tests/GuestRenameDot.cpp
+++ b/core/libs/tests/GuestRenameDot.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -7,15 +9,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI mkdir_nid_postfix(const char*, int);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI stat_nid_postfix(const char*, void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ErrorNoEntry = 2;
@@ -32,6 +25,7 @@ void Cleanup() {
     rmdir_nid_postfix(Source);
     rmdir_nid_postfix(Target);
     rmdir_nid_postfix(Moved);
+
     std::remove(PlainFile);
     std::remove(Loop);
 }
@@ -47,7 +41,7 @@ bool Fails(long result, int error) { return result == -1 && *__error_nid_postfix
 
 bool Exists(const char* path) {
     unsigned char status[256];
-    return stat_nid_postfix(path, status) == 0;
+    return stat_nid_postfix(path, reinterpret_cast<FileStat*>(status)) == 0;
 }
 
 }
diff --git a/core/libs/tests/GuestRenderingWait.cpp b/core/libs/tests/GuestRenderingWait.cpp
index a17c039713..352b8b1d1d 100644
--- a/core/libs/tests/GuestRenderingWait.cpp
+++ b/core/libs/tests/GuestRenderingWait.cpp
@@ -8,14 +8,7 @@
 #include <condition_variable>
 #include <cstdlib>
 #include <mutex>
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetWaitRenderingPacketSizeInDwords();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetFlipPacketSizeInDwords();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadsActivePacketSize();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadCompletePacketSize();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadStreamInactivePacketSize();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverNopDataGetPacketSize(std::uint32_t);
-extern "C" std::uint32_t APS5_VABI sceAgcDriverUserDataGetPacketSize(std::uint32_t);
-extern "C" std::uint32_t APS5_VABI sceAgcDriverWaitUntilSafeForRendering(std::uint32_t**, std::uint32_t, std::uint32_t, std::uint32_t, int);
+
 static void Require(bool value) { if (!value) std::abort(); }
 class Output final : public AgcDriver::IVideoOutput, public AgcDriver::IRenderingWait,
     public AgcDriver::IFlipRequest, public std::enable_shared_from_this<Output> {
diff --git a/core/libs/tests/GuestResolver.cpp b/core/libs/tests/GuestResolver.cpp
index 20f02e1d16..3773c62df8 100644
--- a/core/libs/tests/GuestResolver.cpp
+++ b/core/libs/tests/GuestResolver.cpp
@@ -1,3 +1,5 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -16,14 +18,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-GuestResolver::HostEntry* APS5_VABI gethostbyname_nid_postfix(const char*);
-int* APS5_VABI sceNetErrnoLoc();
-int APS5_VABI getaddrinfo_nid_postfix(const char*, const char*, const GuestResolver::AddressInfo*, GuestResolver::AddressInfo**);
-void APS5_VABI freeaddrinfo_nid_postfix(GuestResolver::AddressInfo*);
-int APS5_VABI getnameinfo_nid_postfix(const void*, std::uint32_t, char*, std::uint32_t, char*, std::uint32_t, int);
-const char* APS5_VABI gai_strerror_nid_postfix(int);
-}
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Resolver check failed at line %u\n", location.line());
@@ -135,6 +129,7 @@ int main() {
             Require(std::strcmp(host, numeric) == 0 && std::strcmp(service, "27910") == 0);
         }
         freeaddrinfo_nid_postfix(result);
+
     }
     GuestResolver::AddressInfo* result = reinterpret_cast<GuestResolver::AddressInfo*>(1);
     hints.family = 1234;
@@ -145,4 +140,5 @@ int main() {
     hints.flags = 12;
     Require(getaddrinfo_nid_postfix("invalid-numeric-address", "1", &hints, &result) == 8 && !result);
     freeaddrinfo_nid_postfix(nullptr);
+
 }
diff --git a/core/libs/tests/GuestRtc.cpp b/core/libs/tests/GuestRtc.cpp
index 13d1678125..8d9b302b49 100644
--- a/core/libs/tests/GuestRtc.cpp
+++ b/core/libs/tests/GuestRtc.cpp
@@ -1,75 +1,21 @@
+#include "prx/libSceRtc/include/Rtc.hpp"
 #include "SceTypes.hpp"
+#include "ProcessParametersFixture.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <ctime>
 #include <exception>
+#include <filesystem>
+#include <fstream>
+#include <string>
+#include <string_view>
 #include <initializer_list>
 #include <limits>
-
-extern "C" {
-int APS5_VABI sceRtcCheckValid(const RtcDateTime*);
-int APS5_VABI sceRtcIsLeapYear(int);
-int APS5_VABI sceRtcGetDaysInMonth(int, int);
-int APS5_VABI sceRtcGetDayOfWeek(int, int, int);
-int APS5_VABI sceRtcGetTickResolution(void);
-int APS5_VABI sceRtcGetTick(const RtcDateTime*, RtcTick*);
-int APS5_VABI sceRtcSetTick(RtcDateTime*, const RtcTick*);
-int APS5_VABI sceRtcGetCurrentTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentNetworkTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentClock(RtcDateTime*, int);
-int APS5_VABI sceRtcGetCurrentClockLocalTime(RtcDateTime*);
-int APS5_VABI sceRtcConvertUtcToLocalTime(const RtcTick*, RtcTick*);
-int APS5_VABI sceRtcConvertLocalTimeToUtc(const RtcTick*, RtcTick*);
-int APS5_VABI sceRtcGetTime_t(const RtcDateTime*, std::int64_t*);
-int APS5_VABI sceRtcSetTime_t(RtcDateTime*, std::int64_t);
-int APS5_VABI sceRtcGetWin32FileTime(const RtcDateTime*, std::uint64_t*);
-int APS5_VABI sceRtcSetWin32FileTime(RtcDateTime*, std::uint64_t);
-int APS5_VABI sceRtcGetDosTime(const RtcDateTime*, std::uint32_t*);
-int APS5_VABI sceRtcSetDosTime(RtcDateTime*, std::uint32_t);
-int APS5_VABI sceRtcGetYear(const RtcDateTime*);
-int APS5_VABI sceRtcSetYear(RtcDateTime*, int);
-int APS5_VABI sceRtcGetMonth(const RtcDateTime*);
-int APS5_VABI sceRtcSetMonth(RtcDateTime*, int);
-int APS5_VABI sceRtcGetDay(const RtcDateTime*);
-int APS5_VABI sceRtcSetDay(RtcDateTime*, int);
-int APS5_VABI sceRtcGetHour(const RtcDateTime*);
-int APS5_VABI sceRtcSetHour(RtcDateTime*, int);
-int APS5_VABI sceRtcGetMinute(const RtcDateTime*);
-int APS5_VABI sceRtcSetMinute(RtcDateTime*, int);
-int APS5_VABI sceRtcGetSecond(const RtcDateTime*);
-int APS5_VABI sceRtcSetSecond(RtcDateTime*, int);
-int APS5_VABI sceRtcGetMicrosecond(const RtcDateTime*);
-int APS5_VABI sceRtcSetMicrosecond(RtcDateTime*, int);
-int APS5_VABI sceRtcFormatRFC3339(char*, const RtcTick*, int);
-int APS5_VABI sceRtcParseRFC3339(RtcTick*, const char*);
-int APS5_VABI sceRtcParseDateTime(RtcTick*, const char*);
-int APS5_VABI sceRtcTickAddTicks(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddMicroseconds(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddSeconds(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddMinutes(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddHours(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddDays(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddWeeks(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddMonths(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddYears(RtcTick*, const RtcTick*, std::int16_t);
-int APS5_VABI sceRtcFormatRFC3339LocalTime(char*, const RtcTick*);
-int APS5_VABI sceRtcFormatRFC2822(char*, const RtcTick*, int);
-int APS5_VABI sceRtcFormatRFC2822LocalTime(char*, const RtcTick*);
-int APS5_VABI sceRtcFormatRFC3339Precise(char*, const RtcTick*, int, int);
-int APS5_VABI sceRtcFormatRFC3339PreciseLocalTime(char*, const RtcTick*, int);
-int APS5_VABI sceRtcCompareTick(const RtcTick*, const RtcTick*);
-int APS5_VABI sceRtcGetCurrentAdNetworkTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentRawNetworkTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentDebugNetworkTick(RtcTick*);
-int APS5_VABI sceRtcSetCurrentTick(const RtcTick*);
-int APS5_VABI sceRtcSetCurrentNetworkTick(const RtcTick*);
-int APS5_VABI sceRtcSetCurrentAdNetworkTick(const RtcTick*);
-int APS5_VABI sceRtcSetCurrentDebugNetworkTick(const RtcTick*);
-int APS5_VABI sceRtcInit(void);
-int APS5_VABI sceRtcEnd(void);
-}
+#include <random>
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -113,7 +59,40 @@ static int CallAdd(Add function, RtcTick* destination, const RtcTick* source, st
     std::abort();
 }
 
-int main() {
+static void SetCompiledSdkVersion(std::byte* process, std::uint32_t version) {
+    std::memcpy(process + 16, &version, sizeof(version));
+}
+
+static void EnterTitleDirectory(const char* titleId) {
+    const auto directory = std::filesystem::temp_directory_path() / ("rtc-test-" + std::to_string(std::random_device{}()));
+    std::filesystem::create_directories(directory / "app0" / "sce_sys");
+    std::filesystem::current_path(directory);
+    if (titleId == nullptr) return;
+    struct Entry { std::uint16_t key, format; std::uint32_t length, maximum, offset; };
+    const std::uint32_t header[5] = {0x46535000, 0x0101, 52, 72, 2};
+    const Entry entries[2] = {{0, 0x0204, 8, 8, 0}, {6, 0x0204, 10, 12, 8}};
+    std::ofstream file("app0/sce_sys/param.sfo", std::ios::binary);
+    file.write(reinterpret_cast<const char*>(header), sizeof(header));
+    file.write(reinterpret_cast<const char*>(entries), sizeof(entries));
+    file << std::string("TITLE\0TITLE_ID\0\0\0\0\0\0", 20) << std::string("Example\0", 8) << titleId << std::string("\0\0\0", 3);
+}
+
+int main(int argc, char** argv) {
+    static std::array<std::byte, 64> process{};
+    Require(ProcessParametersFixture::Install(process.data(), process.size()));
+    SetCompiledSdkVersion(process.data(), 0x01000051);
+    if (argc == 2 && std::string_view(argv[1]) == "ps5-title") {
+        EnterTitleDirectory(nullptr);
+        RtcDateTime untouched{0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaaaaaau};
+        RtcDateTime converted = untouched;
+        Require(sceRtcGetDayOfWeek(10000, 1, 1) == static_cast<int>(0x80B50008) && sceRtcGetDayOfWeek(0, 13, 1) == static_cast<int>(0x80B50009));
+        Require(sceRtcSetTime_t(&converted, -1) == static_cast<int>(0x80B50003) && Equal(converted, untouched));
+        char text[64];
+        RtcTick tick{std::numeric_limits<std::uint64_t>::max()};
+        Require(sceRtcFormatRFC3339(text, &tick, 1) == static_cast<int>(0x80B50003));
+        return 0;
+    }
+    EnterTitleDirectory("CUSA00000");
     constexpr int invalidPointer = static_cast<int>(0x80B50002);
     constexpr int invalidValue = static_cast<int>(0x80B50003);
     constexpr int badParse = static_cast<int>(0x80B50007);
@@ -136,6 +115,7 @@ int main() {
     Require(sceRtcGetDaysInMonth(10000, 1) == 31);
     Require(sceRtcGetDaysInMonth(9999, 1) == 31);
     Require(sceRtcGetDayOfWeek(1, 1, 1) == 1 && sceRtcGetDayOfWeek(2026, 9, 26) == 6);
+    Require(sceRtcGetDayOfWeek(10000, 1, 1) == 6);
     Require(sceRtcGetDayOfWeek(2023, 2, 29) == invalidDay);
 
     RtcDateTime leapDay{2024, 2, 29, 12, 34, 56, 789000};
@@ -158,7 +138,7 @@ int main() {
     tick.tick = maxTick;
     Require(sceRtcSetTick(&converted, &tick) == 0 && Equal(converted, RtcDateTime{9999, 12, 31, 23, 59, 59, 999999}));
     tick.tick = maxTick + 1;
-    Require(sceRtcSetTick(&converted, &tick) == invalidValue);
+    Require(sceRtcSetTick(&converted, &tick) == 0 && Equal(converted, RtcDateTime{10000, 1, 1, 0, 0, 0, 0}));
 
     Require(sceRtcGetCurrentClock(nullptr, 0) == invalidPointer);
     Require(sceRtcGetCurrentClock(&converted, 0) == 0 && sceRtcCheckValid(&converted) == 0);
@@ -173,10 +153,24 @@ int main() {
     RtcDateTime millennium{2000, 1, 1, 0, 0, 0, 0};
     Require(sceRtcGetTime_t(&millennium, &seconds) == 0 && seconds == 946684800);
     Require(sceRtcSetTime_t(&converted, 946684800) == 0 && Equal(converted, millennium));
-    Require(sceRtcSetTime_t(&converted, -1) == invalidValue);
+    Require(sceRtcSetTime_t(&converted, -1) == 0 && Equal(converted, RtcDateTime{2106, 2, 7, 6, 28, 15, 0}));
+    Require(sceRtcSetTime_t(&converted, 0x100000001ll) == 0 && Equal(converted, RtcDateTime{1970, 1, 1, 0, 0, 1, 0}));
+    Require(sceRtcSetTime_t(&converted, -0x80000000ll) == 0 && Equal(converted, RtcDateTime{2038, 1, 19, 3, 14, 8, 0}));
+    const RtcDateTime past2106{2106, 2, 7, 6, 28, 16, 0};
+    Require(sceRtcGetTime_t(&past2106, &seconds) == 0 && seconds == 0x100000000ll);
+    const RtcDateTime beforeEpoch{1969, 12, 31, 23, 59, 59, 0};
+    seconds = -1;
+    Require(sceRtcGetTime_t(&beforeEpoch, &seconds) == invalidYear && seconds == 0);
+    const RtcDateTime badMonth{1969, 13, 1, 0, 0, 0, 0};
+    seconds = -1;
+    Require(sceRtcGetTime_t(&badMonth, &seconds) == invalidMonth && seconds == -1);
     std::uint64_t fileTime = 0;
     Require(sceRtcGetWin32FileTime(&epoch, &fileTime) == 0 && fileTime == 116444736000000000ull);
     Require(sceRtcSetWin32FileTime(&converted, 116444736000000000ull) == 0 && Equal(converted, epoch));
+    const RtcDateTime before1601{1600, 12, 31, 23, 59, 59, 0};
+    fileTime = 1;
+    Require(sceRtcGetWin32FileTime(&before1601, &fileTime) == invalidYear && fileTime == 0);
+    Require(sceRtcSetWin32FileTime(&converted, std::numeric_limits<std::uint64_t>::max()) == 0 && Equal(converted, RtcDateTime{60056, 5, 28, 5, 36, 10, 955161}));
     std::uint32_t dosTime = 0xffffffffu;
     const RtcDateTime dosDate{2024, 2, 29, 12, 34, 57, 789000};
     Require(sceRtcGetDosTime(&dosDate, &dosTime) == 0 && dosTime == 0x585d645cu);
@@ -272,6 +266,22 @@ int main() {
         Require(sceRtcFormatRFC3339(text, &tick, offset) == invalidValue);
         Require(std::memcmp(text, original, sizeof(text)) == 0);
     }
+    RtcTick edge{maxTick + 1};
+    Require(sceRtcFormatRFC3339(text, &edge, 0) == invalidYear);
+    edge.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC3339(text, &edge, 0) == invalidYear);
+    edge.tick = maxTick;
+    Require(sceRtcFormatRFC3339(text, &edge, 1) == invalidYear);
+    edge.tick = 59999999;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == invalidYear);
+    edge.tick = 60000000;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == 0 && std::strcmp(text, "0001-01-01T00:00:00.00-00:01") == 0);
+    edge.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC3339(text, &edge, 1) == 0 && std::strcmp(text, "0001-01-01T00:00:59.99+00:01") == 0);
+    edge.tick = 1ull << 63;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == invalidYear);
+    edge.tick = maxTick + 1;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == 0 && std::strcmp(text, "9999-12-31T23:59:00.00-00:01") == 0);
     Require(sceRtcFormatRFC3339(nullptr, &tick, 1440) == invalidPointer);
     Require(sceRtcFormatRFC3339(text, nullptr, 1440) == invalidValue);
     {
@@ -752,10 +762,11 @@ int main() {
 
     RtcTick now{};
     Require(sceRtcGetCurrentTick(&now) == 0 && now.tick > leapDayTick);
+    const RtcTick fixed{leapDayTick};
     RtcTick local{};
     RtcTick back{};
-    Require(sceRtcConvertUtcToLocalTime(&now, &local) == 0);
-    Require(sceRtcConvertLocalTimeToUtc(&local, &back) == 0 && back.tick == now.tick);
+    Require(sceRtcConvertUtcToLocalTime(&fixed, &local) == 0);
+    Require(sceRtcConvertLocalTimeToUtc(&local, &back) == 0 && back.tick == fixed.tick);
 
     char rfc2822[32];
     tick.tick = leapDayTick;
@@ -777,7 +788,19 @@ int main() {
     Require(sceRtcFormatRFC2822(rfc2822, &tick, -1) == invalidValue);
     tick.tick = maxTick;
     Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == 0 && std::strcmp(rfc2822, "Fri, 31 Dec 9999 23:59:59 +0000") == 0);
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 1) == invalidYear);
+    tick.tick = maxTick + 1;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == invalidYear);
+    tick.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == invalidValue);
     Require(sceRtcFormatRFC2822(rfc2822, &tick, 1) == invalidValue);
+    tick.tick = 0ull - 60000000ull;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 1) == invalidValue);
+    tick.tick = 1ull << 63;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == invalidValue);
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, -1) == invalidYear);
+    tick.tick = maxTick + 1;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, -1) == 0 && std::strcmp(rfc2822, "Fri, 31 Dec 9999 23:59:00 -0001") == 0);
     tick.tick = leapDayTick;
     for (int offset : {1440, -1440, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()}) {
         std::memset(rfc2822, 'x', sizeof(rfc2822));
@@ -909,6 +932,40 @@ int main() {
         Require(sceRtcGetCurrentDebugNetworkTick(&current) == 0 && current.tick >= debugClock.tick && current.tick < debugClock.tick + 1000000);
         Require(sceRtcGetCurrentRawNetworkTick(&current) == 0 && current.tick > unixEpochTick);
     }
+    SetCompiledSdkVersion(process.data(), 0x02ffffff);
+    Require(sceRtcGetDayOfWeek(0, 13, 1) == invalidYear && sceRtcGetDayOfWeek(10000, 1, 1) == 6);
+    SetCompiledSdkVersion(process.data(), 0x03000000);
+    Require(sceRtcGetDayOfWeek(0, 13, 1) == invalidMonth && sceRtcGetDayOfWeek(10000, 1, 1) == invalidYear);
+    SetCompiledSdkVersion(process.data(), 0x05050001);
+    Require(sceRtcGetDayOfWeek(0, 13, 1) == invalidMonth && sceRtcGetDayOfWeek(10000, 13, 1) == invalidMonth && sceRtcGetDayOfWeek(2024, 0, 1) == invalidMonth);
+    Require(sceRtcGetDayOfWeek(0, 1, 0) == invalidYear && sceRtcGetDayOfWeek(10000, 2, 30) == invalidYear && sceRtcGetDayOfWeek(65536, 1, 1) == invalidYear);
+    Require(sceRtcGetDayOfWeek(2024, 2, 30) == invalidDay && sceRtcGetDayOfWeek(9999, 12, 31) == 5 && sceRtcGetDayOfWeek(1, 1, 1) == 1);
+    Require(sceRtcGetDaysInMonth(0, 13) == invalidYear && sceRtcGetDaysInMonth(10000, 1) == 31 && sceRtcIsLeapYear(10000) == 1);
+    RtcDateTime sentinel{0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaaaaaau};
+    RtcDateTime ranged = sentinel;
+    Require(sceRtcSetTime_t(&ranged, -1) == invalidValue && Equal(ranged, sentinel));
+    Require(sceRtcSetTime_t(&ranged, std::numeric_limits<std::int64_t>::min()) == invalidValue && Equal(ranged, sentinel));
+    Require(sceRtcSetTime_t(&ranged, 4294967296ll) == 0 && Equal(ranged, RtcDateTime{2106, 2, 7, 6, 28, 16, 0}));
+    Require(sceRtcSetTime_t(&ranged, 253402300800ll) == 0 && Equal(ranged, RtcDateTime{10000, 1, 1, 0, 0, 0, 0}));
+    Require(sceRtcSetTime_t(&ranged, 18446744073709ll) == 0 && Equal(ranged, RtcDateTime{1969, 12, 31, 23, 59, 59, 448384}));
+    Require(sceRtcSetTime_t(&ranged, std::numeric_limits<std::int64_t>::max()) == 0 && Equal(ranged, RtcDateTime{1969, 12, 31, 23, 59, 59, 0}));
+    char ranges[64];
+    RtcTick shifted{0};
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == invalidValue);
+    shifted.tick = 59999999;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == invalidValue);
+    shifted.tick = 60000000;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == 0 && std::strcmp(ranges, "0001-01-01T00:00:00.00-00:01") == 0);
+    shifted.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 1) == invalidValue && sceRtcFormatRFC3339(ranges, &shifted, 1439) == invalidValue);
+    shifted.tick = std::numeric_limits<std::uint64_t>::max() - 60000000 + 1;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 1) == invalidValue);
+    shifted.tick = std::numeric_limits<std::uint64_t>::max() - 60000000;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 1) == invalidYear);
+    shifted.tick = 1ull << 63;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 0) == invalidYear && sceRtcFormatRFC3339(ranges, &shifted, -1) == invalidYear);
+    shifted.tick = maxTick + 1;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == 0 && std::strcmp(ranges, "9999-12-31T23:59:00.00-00:01") == 0);
     Require(sceRtcInit() == 0);
     Require(sceRtcEnd() == 0);
 }
diff --git a/core/libs/tests/GuestRtprioThread.cpp b/core/libs/tests/GuestRtprioThread.cpp
new file mode 100644
index 0000000000..0d44857120
--- /dev/null
+++ b/core/libs/tests/GuestRtprioThread.cpp
@@ -0,0 +1,100 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdlib>
+#include <stdexcept>
+#include <thread>
+
+static constexpr int SCE_OK = 0;
+static constexpr int GUEST_SCHED_FIFO = 1;
+static constexpr int GUEST_SCHED_RR = 3;
+static constexpr int EXPLICIT_SCHED = 0;
+static constexpr int RTP_LOOKUP = 0;
+static constexpr int RTP_SET = 1;
+static constexpr std::uint16_t RTP_PRIO_REALTIME = 2;
+static constexpr std::uint16_t RTP_PRIO_FIFO = 10;
+static constexpr int GUEST_ESRCH = 3;
+static constexpr int GUEST_EFAULT = 14;
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+struct Report {
+    int policy;
+    int priority;
+    std::atomic<int> tid{0};
+    GuestRtPrio lookup{7, 7};
+    int lookupResult = -1;
+    std::atomic<bool> release{false};
+};
+
+static void* APS5_VABI Entry(void* arg) {
+    auto* report = static_cast<Report*>(arg);
+    report->lookupResult = rtprio_thread_nid_postfix(RTP_LOOKUP, 0, &report->lookup);
+    report->tid.store(scePthreadGetthreadid(), std::memory_order_release);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (!report->release.load(std::memory_order_acquire)) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::yield();
+    }
+    return nullptr;
+}
+
+static int LookupError(int function, int lwpid, GuestRtPrio* priority) {
+    *__error_nid_postfix() = 0;
+    Require(rtprio_thread_nid_postfix(function, lwpid, priority) == -1);
+    return *__error_nid_postfix();
+}
+
+static void CheckThread(int policy, int priority, std::uint16_t expectedType) {
+    Report report{policy, priority};
+    PthreadAttr attr = nullptr;
+    KernelSchedParam param{priority};
+    Require(scePthreadAttrInit(&attr) == SCE_OK);
+    Require(scePthreadAttrSetinheritsched(&attr, EXPLICIT_SCHED) == SCE_OK);
+    Require(scePthreadAttrSetschedpolicy(&attr, policy) == SCE_OK);
+    Require(scePthreadAttrSetschedparam(&attr, &param) == SCE_OK);
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, &attr, Entry, &report, "rtprio") == SCE_OK);
+    Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (report.tid.load(std::memory_order_acquire) == 0) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::yield();
+    }
+    Require(report.lookupResult == 0 && report.lookup.type == expectedType && report.lookup.prio == priority);
+    GuestRtPrio fromCreator{7, 7};
+    Require(rtprio_thread_nid_postfix(RTP_LOOKUP, report.tid.load(), &fromCreator) == 0);
+    Require(fromCreator.type == expectedType && fromCreator.prio == priority);
+    bool threw = false;
+    try { rtprio_thread_nid_postfix(RTP_SET, report.tid.load(), &fromCreator); } catch (const std::exception&) { threw = true; }
+    Require(threw);
+    report.release.store(true, std::memory_order_release);
+    Require(scePthreadJoin(thread, nullptr) == SCE_OK);
+    Require(LookupError(RTP_LOOKUP, report.tid.load(), &fromCreator) == GUEST_ESRCH);
+}
+
+int main() {
+    int policy = -1;
+    KernelSchedParam param{};
+    Require(scePthreadGetschedparam(scePthreadSelf(), &policy, &param) == SCE_OK);
+    Require(policy == GUEST_SCHED_FIFO || policy == GUEST_SCHED_RR);
+    GuestRtPrio self{7, 7};
+    Require(rtprio_thread_nid_postfix(RTP_LOOKUP, 0, &self) == 0);
+    Require(self.type == (policy == GUEST_SCHED_FIFO ? RTP_PRIO_FIFO : RTP_PRIO_REALTIME) && self.prio == param.sched_priority);
+    GuestRtPrio byId{7, 7};
+    Require(rtprio_thread_nid_postfix(RTP_LOOKUP, scePthreadGetthreadid(), &byId) == 0);
+    Require(byId.type == self.type && byId.prio == self.prio);
+    CheckThread(GUEST_SCHED_FIFO, 512, RTP_PRIO_FIFO);
+    CheckThread(GUEST_SCHED_RR, 600, RTP_PRIO_REALTIME);
+    CheckThread(GUEST_SCHED_FIFO, 256, RTP_PRIO_FIFO);
+    Require(LookupError(2, 0, &self) == GUEST_ESRCH);
+    Require(LookupError(RTP_LOOKUP, 0, nullptr) == GUEST_EFAULT);
+    Require(LookupError(RTP_LOOKUP, 1, &self) == GUEST_ESRCH);
+    Require(LookupError(RTP_LOOKUP, 999999, &self) == GUEST_ESRCH);
+    bool threw = false;
+    try { rtprio_thread_nid_postfix(RTP_SET, 0, &self); } catch (const std::exception&) { threw = true; }
+    Require(threw);
+}
diff --git a/core/libs/tests/GuestRudpContextLifecycle.cpp b/core/libs/tests/GuestRudpContextLifecycle.cpp
index 51a119e0d8..766e84b8dd 100644
--- a/core/libs/tests/GuestRudpContextLifecycle.cpp
+++ b/core/libs/tests/GuestRudpContextLifecycle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -10,21 +11,7 @@
 #include <utility>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpActivate(std::int32_t, const void*, std::uint32_t);
-int APS5_VABI sceRudpEnableInternalIOThread(std::uint32_t, std::uint32_t);
-int APS5_VABI sceRudpSetEventHandler(GuestRudpEventHandler, void*);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpBind(int, std::uint16_t, int, std::uint16_t);
-int APS5_VABI sceRudpSetOption(int, int, const void*, std::uint32_t);
-int APS5_VABI sceRudpGetOption(int, int, void*, std::uint32_t);
-int APS5_VABI sceRudpInitiate(int, const void*, std::uint32_t, std::uint16_t);
-int APS5_VABI sceRudpGetContextStatus(int, void*, std::uint32_t);
-int APS5_VABI sceRudpWrite(int, const void*, std::uint32_t, int);
-int APS5_VABI sceRudpRead(int, void*, std::uint32_t, int, void*);
-int APS5_VABI sceRudpTerminate(int);
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -78,6 +65,7 @@ static void CheckOptions(int context) {
         bool threw = false;
         try {
             sceRudpGetOption(context, option, &value, sizeof(value));
+
         } catch (const std::runtime_error&) {
             threw = true;
         }
@@ -91,6 +79,7 @@ static void CheckOptions(int context) {
                 threw = false;
                 try {
                     sceRudpGetOption(current, option, &value, sizeof(value));
+
                 } catch (const std::runtime_error&) {
                     threw = true;
                 }
@@ -176,6 +165,7 @@ int main() {
     bool activationUnsupported = false;
     try {
         sceRudpActivate(ctx, address, sizeof(address));
+
     } catch (const std::runtime_error&) {
         activationUnsupported = true;
     }
diff --git a/core/libs/tests/GuestRudpContextQueries.cpp b/core/libs/tests/GuestRudpContextQueries.cpp
index 76374d4b86..a45bc97d8e 100644
--- a/core/libs/tests/GuestRudpContextQueries.cpp
+++ b/core/libs/tests/GuestRudpContextQueries.cpp
@@ -1,17 +1,11 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
 #include <cstdlib>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpTerminate(int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpGetNumberOfPacketsToRead(int);
-int APS5_VABI sceRudpGetSizeWritable(int);
-int APS5_VABI sceRudpGetSizeReadable(int);
+
 }
 
 static void Require(bool value) {
diff --git a/core/libs/tests/GuestRudpPoll.cpp b/core/libs/tests/GuestRudpPoll.cpp
index 4ff92c482f..21274887b3 100644
--- a/core/libs/tests/GuestRudpPoll.cpp
+++ b/core/libs/tests/GuestRudpPoll.cpp
@@ -1,28 +1,18 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
+#include <algorithm>
 #include <array>
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <limits>
 #include <thread>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-struct GuestRudpPollEvent {
-    int ctxId;
-    std::uint16_t reqEvents;
-    std::uint16_t rtnEvents;
-};
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpTerminate(int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpPollCreate(std::size_t);
-int APS5_VABI sceRudpPollControl(int, int, int, std::uint16_t);
-int APS5_VABI sceRudpPollWait(int, GuestRudpPollEvent*, std::size_t, std::uint64_t);
-int APS5_VABI sceRudpPollDestroy(int);
+
 }
 
 static void Require(bool value) {
@@ -44,7 +34,7 @@ int main() {
     constexpr std::uint16_t write = 0x0002;
     constexpr std::uint64_t forever = std::numeric_limits<std::uint64_t>::max();
     alignas(16) static std::array<unsigned char, 0x10000> pool{};
-    std::array<GuestRudpPollEvent, 4> events{};
+    std::array<RudpPollEvent, 4> events{};
     const auto eventCount = static_cast<std::uint32_t>(events.size());
 
     Require(sceRudpPollCreate(1) == notInitialized);
@@ -92,6 +82,23 @@ int main() {
     Require(sceRudpPollWait(poll, events.data(), eventCount, 20000) == 0);
     Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(20));
 
+#ifdef _WIN32
+    for (const auto timeout : {100ULL, 1000ULL}) {
+        std::array<std::chrono::nanoseconds, 31> samples{};
+        for (auto& sample : samples) {
+            const auto before = std::chrono::steady_clock::now();
+            Require(sceRudpPollWait(poll, events.data(), eventCount, timeout) == 0);
+            sample = std::chrono::steady_clock::now() - before;
+            Require(sample >= std::chrono::microseconds(timeout));
+        }
+        std::sort(samples.begin(), samples.end());
+        const auto median = samples[samples.size() / 2];
+        std::fprintf(stderr, "sceRudpPollWait(%llu us) median: %lld ns\n", timeout,
+                     static_cast<long long>(median.count()));
+        Require(median < std::chrono::milliseconds(12));
+    }
+#endif
+
     Require(sceRudpTerminate(second) == 0);
     Require(sceRudpPollControl(poll, add, first, read) == 0);
     Require(sceRudpTerminate(first) == 0);
@@ -101,6 +108,19 @@ int main() {
     Require(sceRudpPollControl(poll, add, third, read) == 0);
     Require(sceRudpPollControl(other, add, third, read) == 0);
 
+    const int finitePoll = sceRudpPollCreate(1);
+    Require(finitePoll > 0);
+    int finiteResult = 0;
+    std::thread finiteWaiter([&] {
+        finiteResult = sceRudpPollWait(finitePoll, events.data(), eventCount, 1000000);
+    });
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    const auto destroyedAt = std::chrono::steady_clock::now();
+    Require(sceRudpPollDestroy(finitePoll) == 0);
+    finiteWaiter.join();
+    Require(finiteResult == invalidPoll);
+    Require(std::chrono::steady_clock::now() - destroyedAt < std::chrono::milliseconds(500));
+
     int destroyedResult = 0;
     std::thread destroyedWaiter([&] { destroyedResult = sceRudpPollWait(poll, events.data(), eventCount, forever); });
     std::this_thread::sleep_for(std::chrono::milliseconds(20));
diff --git a/core/libs/tests/GuestRudpPump.cpp b/core/libs/tests/GuestRudpPump.cpp
index 2cc7f5586f..26482bfeea 100644
--- a/core/libs/tests/GuestRudpPump.cpp
+++ b/core/libs/tests/GuestRudpPump.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -6,16 +7,6 @@
 #include <cstdlib>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpProcessEvents(std::uint64_t timeout);
-int APS5_VABI sceRudpNetFlush();
-int APS5_VABI sceRudpGetMaxSegmentSize(std::uint16_t*);
-int APS5_VABI sceRudpNetReceived(int socketId, const void* data, std::size_t dataSize, const void* sourceAddress, std::uint32_t sourceAddressSize);
-int APS5_VABI sceRudpEnableInternalIOThread2(std::uint32_t, std::uint32_t, std::uint64_t);
-}
-
 static void Require(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "rudp check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestRudpStatus.cpp b/core/libs/tests/GuestRudpStatus.cpp
index ab845fffac..8aed90988d 100644
--- a/core/libs/tests/GuestRudpStatus.cpp
+++ b/core/libs/tests/GuestRudpStatus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -7,12 +8,7 @@
 #include <cstring>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpGetStatus(void*, std::size_t);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpTerminate(int);
-int APS5_VABI sceRudpEnd();
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestRuneLocale.cpp b/core/libs/tests/GuestRuneLocale.cpp
index ff51720da5..31a506c9f8 100644
--- a/core/libs/tests/GuestRuneLocale.cpp
+++ b/core/libs/tests/GuestRuneLocale.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cctype>
 #include <cerrno>
@@ -11,43 +12,6 @@ extern "C" {
 extern const unsigned char _DefaultRuneLocale_nid_postfix[4224];
 extern const unsigned char* _CurrentRuneLocale_nid_postfix;
 extern int __mb_sb_limit_nid_postfix;
-int APS5_VABI isalpha_nid_postfix(int);
-int APS5_VABI iscntrl_nid_postfix(int);
-int APS5_VABI isdigit_nid_postfix(int);
-int APS5_VABI isgraph_nid_postfix(int);
-int APS5_VABI islower_nid_postfix(int);
-int APS5_VABI isprint_nid_postfix(int);
-int APS5_VABI ispunct_nid_postfix(int);
-int APS5_VABI isspace_nid_postfix(int);
-int APS5_VABI isupper_nid_postfix(int);
-int APS5_VABI isxdigit_nid_postfix(int);
-int APS5_VABI isblank_nid_postfix(int);
-int APS5_VABI tolower_nid_postfix(int);
-int APS5_VABI toupper_nid_postfix(int);
-int APS5_VABI iswalnum_nid_postfix(std::uint32_t);
-int APS5_VABI iswalpha_nid_postfix(std::uint32_t);
-int APS5_VABI iswblank_nid_postfix(std::uint32_t);
-int APS5_VABI iswcntrl_nid_postfix(std::uint32_t);
-int APS5_VABI iswdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswgraph_nid_postfix(std::uint32_t);
-int APS5_VABI iswlower_nid_postfix(std::uint32_t);
-int APS5_VABI iswprint_nid_postfix(std::uint32_t);
-int APS5_VABI iswpunct_nid_postfix(std::uint32_t);
-int APS5_VABI iswspace_nid_postfix(std::uint32_t);
-int APS5_VABI iswupper_nid_postfix(std::uint32_t);
-int APS5_VABI iswxdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswctype_nid_postfix(std::uint32_t, std::uint64_t);
-std::uint64_t APS5_VABI wctype_nid_postfix(const char*);
-std::uint32_t APS5_VABI towlower_nid_postfix(std::uint32_t);
-std::uint32_t APS5_VABI towupper_nid_postfix(std::uint32_t);
-std::uint64_t APS5_VABI wctrans_nid_postfix(const char*);
-std::uint32_t APS5_VABI towctrans_nid_postfix(std::uint32_t, std::uint64_t);
-std::uint32_t APS5_VABI _Towlower_nid_postfix(std::uint32_t, const void*);
-std::uint32_t APS5_VABI _Towupper_nid_postfix(std::uint32_t, const void*);
-int APS5_VABI _Tolower_nid_postfix(int, const void*);
-int APS5_VABI _Toupper_nid_postfix(int, const void*);
-std::uint32_t APS5_VABI btowc_nid_postfix(int);
-int APS5_VABI wctob_nid_postfix(std::uint32_t);
 }
 
 void Require(bool condition, std::source_location location = std::source_location::current()) {
@@ -120,6 +84,10 @@ int main() {
         }
         Require(entry.wide(0xffffffff) == 0 && iswctype_nid_postfix(0xffffffff, entry.mask) == 0);
     }
+    for (std::uint32_t c = 0; c < 300; ++c) {
+        Require((iswascii_nid_postfix(c) != 0) == (c <= 0x7f));
+    }
+    Require(iswascii_nid_postfix(0xffffffff) == 0);
     Require(wctype_nid_postfix("ideogram") == 0x80000 && wctype_nid_postfix("special") == 0x100000);
     Require(wctype_nid_postfix("phonogram") == 0x200000 && wctype_nid_postfix("number") == 0x400000);
     Require(wctype_nid_postfix("rune") == 0xffffff00 && wctype_nid_postfix("") == 0 && wctype_nid_postfix("Alpha") == 0);
diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp
new file mode 100644
index 0000000000..2a4dd8a22d
--- /dev/null
+++ b/core/libs/tests/GuestRuntimeLifecycle.cpp
@@ -0,0 +1,135 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <dlfcn.h>
+#include <thread>
+#include <source_location>
+#include <pthread.h>
+
+namespace {
+struct Event { std::size_t args; const void* argp; };
+std::array<Event, 8> events{};
+std::atomic<unsigned> count{0};
+std::atomic<bool> entered{false}, releaseEntry{false};
+bool concurrent = false, reentrant = false;
+thread_local bool isLifecycleWaiter = false;
+std::atomic<bool> waiterObserved{false};
+std::atomic<unsigned> waiterReturns{0};
+const char* modulePath = nullptr;
+std::int32_t reentrantHandle = -1;
+void Require(bool ok, const std::source_location& where = std::source_location::current()) {
+    if (ok) return;
+    std::fprintf(stderr, "guest_runtime_lifecycle: failed at %u\n", where.line());
+    std::abort();
+}
+}
+
+extern "C" int pthread_cond_wait(pthread_cond_t* condition, pthread_mutex_t* mutex) {
+    using Wait = int (*)(pthread_cond_t*, pthread_mutex_t*);
+    static const auto actual = reinterpret_cast<Wait>(::dlsym(RTLD_NEXT, "pthread_cond_wait"));
+    Require(actual != nullptr);
+    if (isLifecycleWaiter) waiterObserved.store(true, std::memory_order_release);
+    const int result = actual(condition, mutex);
+    if (isLifecycleWaiter) waiterReturns.fetch_add(1, std::memory_order_relaxed);
+    return result;
+}
+
+extern "C" void APS5_VABI RecordArgs(std::size_t args, const void* argp) {
+    const auto index = count.fetch_add(1);
+    Require(index < events.size());
+    events[index] = {args, argp};
+    if (index == 0 && reentrant) {
+        reentrantHandle = sceKernelLoadStartModule(modulePath, 0, nullptr, 0, nullptr, nullptr);
+        Require(reentrantHandle > 0 && count.load() == 1);
+    }
+    if (index == 0 && concurrent) {
+        entered.store(true, std::memory_order_release);
+        const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+        while (!releaseEntry.load(std::memory_order_acquire)) {
+            Require(std::chrono::steady_clock::now() < limit);
+            std::this_thread::yield();
+        }
+    }
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 3);
+    concurrent = std::strcmp(argv[2], "concurrent") == 0;
+    reentrant = std::strcmp(argv[2], "reentrant") == 0;
+    modulePath = argv[1];
+    void* preload = ::dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
+    if (!preload) std::fprintf(stderr, "%s\n", ::dlerror());
+    Require(preload && count.load() == 0);
+    if (std::strcmp(argv[2], "never-start") == 0) {
+        Require(::dlclose(preload) == 0 && count.load() == 0);
+        return 0;
+    }
+    const std::uint64_t payload = 0xfeed0123;
+    const bool zeroStart = std::strcmp(argv[2], "zero-start") == 0;
+    const std::size_t requestedSize = zeroStart ? 0 : sizeof(payload);
+    const void* requestedPointer = zeroStart ? nullptr : &payload;
+    int result = -1;
+    std::int32_t first = -1, second = -1;
+    if (concurrent) {
+        std::thread one([&] { first = sceKernelLoadStartModule(argv[1], requestedSize, requestedPointer, 0, nullptr, &result); });
+        const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+        while (!entered.load(std::memory_order_acquire)) {
+            Require(std::chrono::steady_clock::now() < limit);
+            std::this_thread::yield();
+        }
+        std::thread two([&] {
+            isLifecycleWaiter = true;
+            second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr);
+            isLifecycleWaiter = false;
+        });
+        while (!waiterObserved.load(std::memory_order_acquire)) {
+            Require(std::chrono::steady_clock::now() < limit);
+            std::this_thread::yield();
+        }
+        Require(count.load() == 1);
+        releaseEntry.store(true, std::memory_order_release);
+        one.join();
+        two.join();
+        Require(waiterReturns.load() > 0);
+        std::fprintf(stderr, "Observed lifecycle waiter before initializer release; actual condition-wait returns=%u\n", waiterReturns.load());
+    } else {
+        first = sceKernelLoadStartModule(argv[1], requestedSize, requestedPointer, 0, nullptr, &result);
+        second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr);
+    }
+    std::fprintf(stderr, "first=%d second=%d result=%x count=%u\n", first, second, result, count.load());
+    if (first < 0) std::fprintf(stderr, "loader error: %s\n", dlerror_nid_postfix());
+    Require(first > 0 && second > 0 && first != second && result == 0x5a17);
+    Require(count.load() == 2 && events[0].args == requestedSize && events[0].argp == requestedPointer);
+    Require(events[1].args == 0xa1 && events[1].argp == nullptr);
+    Require(sceKernelStopUnloadModule(first, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2);
+    Require(sceKernelStopUnloadModule(second, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2);
+    if (reentrant) {
+        Require(reentrantHandle != first && reentrantHandle != second);
+        Require(::dlclose(preload) == 0 && count.load() == 2);
+        Require(sceKernelStopUnloadModule(reentrantHandle, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 4);
+    } else {
+        Require(::dlclose(preload) == 0 && count.load() == 4);
+    }
+    Require(events[2].args == 0xf1 && events[2].argp == nullptr);
+    Require(events[3].args == 0xfe && events[3].argp == nullptr);
+    if (std::strcmp(argv[2], "reload") == 0) {
+        void* resident = ::dlopen(argv[1], RTLD_NOW | RTLD_NOLOAD);
+        Require(resident == nullptr);
+        result = -1;
+        const auto reload = sceKernelLoadStartModule(argv[1], sizeof(payload), &payload, 0, nullptr, &result);
+        Require(reload > 0 && reload != first && reload != second && result == 0x5a17);
+        Require(count.load() == 6 && events[4].args == sizeof(payload) && events[4].argp == &payload);
+        Require(events[5].args == 0xa1 && events[5].argp == nullptr);
+        Require(sceKernelStopUnloadModule(reload, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 8);
+        Require(events[6].args == 0xf1 && events[6].argp == nullptr);
+        Require(events[7].args == 0xfe && events[7].argp == nullptr);
+        Require(::dlopen(argv[1], RTLD_NOW | RTLD_NOLOAD) == nullptr);
+    }
+}
diff --git a/core/libs/tests/GuestSafeErrors.cpp b/core/libs/tests/GuestSafeErrors.cpp
index 436ce48e09..b253f14d6c 100644
--- a/core/libs/tests/GuestSafeErrors.cpp
+++ b/core/libs/tests/GuestSafeErrors.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -8,15 +10,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI strerror_s_nid_postfix(char*, std::size_t, int);
-std::size_t APS5_VABI strerrorlen_s_nid_postfix(int);
-int APS5_VABI strerror_r_nid_postfix(int, char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-void* APS5_VABI set_constraint_handler_s_nid_postfix(void*);
-void APS5_VABI ignore_handler_s_nid_postfix(const char*, void*, int);
-}
-
 namespace {
 
 void Require(bool condition, const char* message) {
@@ -96,8 +89,10 @@ void CheckConstraints() {
         Require(violations == before + 1 && violationBuffer == nullptr, "one callback for null destination");
     }
     set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(ignore_handler_s_nid_postfix));
+
     Require(strerror_s_nid_postfix(nullptr, 1, 2) == 22, "installed ignore handler returns to caller");
     set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(Constraint));
+
 }
 
 void CheckThreads() {
@@ -122,5 +117,6 @@ int main() {
     CheckConstraints();
     CheckThreads();
     set_constraint_handler_s_nid_postfix(previous);
+
     std::puts("safe error message checks passed");
 }
diff --git a/core/libs/tests/GuestSandboxCertificates.cpp b/core/libs/tests/GuestSandboxCertificates.cpp
index 2c76c900ba..5fb1e400b3 100644
--- a/core/libs/tests/GuestSandboxCertificates.cpp
+++ b/core/libs/tests/GuestSandboxCertificates.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "SceTypes.hpp"
@@ -7,16 +10,7 @@
 #include <filesystem>
 #include <fstream>
 #include <string>
-extern "C" {
-const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-int APS5_VABI sceKernelOpen(const char*, int, unsigned short);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, void*);
-int APS5_VABI fclose_nid_postfix(void*);
-}
+
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Sandbox certificates check failed at line %d\n", line);
@@ -37,7 +31,7 @@ static std::string ReadKernel(const std::string& path) {
     return text;
 }
 static std::string ReadStream(const std::string& path) {
-    void* stream = fopen_nid_postfix(path.c_str(), "rb");
+    FileStream* stream = fopen_nid_postfix(path.c_str(), "rb");
     Require(stream != nullptr);
     std::string text;
     char buffer[4096];
diff --git a/core/libs/tests/GuestSandboxRandomWord.cpp b/core/libs/tests/GuestSandboxRandomWord.cpp
index 15eb6eb241..b9ec713584 100644
--- a/core/libs/tests/GuestSandboxRandomWord.cpp
+++ b/core/libs/tests/GuestSandboxRandomWord.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cctype>
 #include <cstdlib>
@@ -5,12 +7,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestSaveDataCancel.cpp b/core/libs/tests/GuestSaveDataCancel.cpp
index ce9c2e8c20..5f9612d5ce 100644
--- a/core/libs/tests/GuestSaveDataCancel.cpp
+++ b/core/libs/tests/GuestSaveDataCancel.cpp
@@ -1,14 +1,14 @@
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdint>
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI sceSaveDataCancel(std::uint32_t cancelArgument);
-
 int main() {
     try {
         sceSaveDataCancel(0);
+
     } catch (const std::runtime_error& error) {
         if (std::string(error.what()) == "sceSaveDataCancel not implemented") return 0;
         std::fprintf(stderr, "sceSaveDataCancel threw: %s\n", error.what());
diff --git a/core/libs/tests/GuestSaveDataConvert.cpp b/core/libs/tests/GuestSaveDataConvert.cpp
index df8f6743ce..13085f00db 100644
--- a/core/libs/tests/GuestSaveDataConvert.cpp
+++ b/core/libs/tests/GuestSaveDataConvert.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
@@ -6,18 +8,11 @@
 #include <fstream>
 #include <iterator>
 #include <random>
+#include <stdexcept>
 #include <string>
 #include <system_error>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataConvert(const SaveDataConvert*);
-int APS5_VABI sceSaveDataGetConvertProgress(float*);
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-int APS5_VABI sceSaveDataGetEventResult(const void*, SaveDataEvent*);
-}
-
 namespace {
 
 constexpr int SaveDataErrorParameter = -2137063424;
@@ -32,6 +27,15 @@ void Check(bool condition, const std::string& what) {
     ++failures;
 }
 
+bool Throws(const SaveDataConvert* convert) {
+    try {
+        sceSaveDataConvert(convert);
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
 int Convert(const char* data, std::size_t size) {
     SceSaveDataDirName name{};
     std::memcpy(name.data, data, size);
@@ -59,6 +63,9 @@ int main() {
 
     float progress = 0.0f;
     Check(sceSaveDataGetConvertProgress(&progress) == SaveDataErrorNotInitialized, "query before initialize fails with not initialized");
+    Check(Throws(nullptr), "null convert pointer throws");
+    SaveDataConvert nullDir{};
+    Check(Throws(&nullDir), "null dir_name throws");
     Check(sceSaveDataInitialize3(nullptr) == 0, "SaveData initializes");
     Check(sceSaveDataGetConvertProgress(&progress) == 0, "get convert progress succeeds");
     Check(progress == 0.0f, "convert progress reports 0.0f initially");
diff --git a/core/libs/tests/GuestSaveDataDelete.cpp b/core/libs/tests/GuestSaveDataDelete.cpp
index 0ebbce1462..c8f243059d 100644
--- a/core/libs/tests/GuestSaveDataDelete.cpp
+++ b/core/libs/tests/GuestSaveDataDelete.cpp
@@ -1,3 +1,6 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "SceTypes.hpp"
@@ -13,17 +16,6 @@
 #include <system_error>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataDelete(const SaveDataDelete*);
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataMount3(const SaveDataMount3*, SaveDataMountResult*);
-int APS5_VABI sceSaveDataUmount2(std::uint32_t, const SaveDataMountPoint*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-}
-
 namespace {
 
 constexpr int SaveDataErrorParameter = -2137063424;
@@ -89,6 +81,9 @@ int main() {
     char unterminated[sizeof(SceSaveDataDirName::data)];
     std::memset(unterminated, 'a', sizeof(unterminated));
     Check(Delete(unterminated, sizeof(unterminated)) == SaveDataErrorParameter, "an unterminated name is rejected");
+    Check(sceSaveDataDelete(nullptr) == SaveDataErrorParameter, "null del returns PARAMETER");
+    SaveDataDelete nullDirDel{};
+    Check(sceSaveDataDelete(&nullDirDel) == SaveDataErrorParameter, "null dir_name returns PARAMETER");
 
     constexpr char mountedPayload[] = "live mounted save";
     constexpr char updatedPayload[] = "still mounted";
diff --git a/core/libs/tests/GuestSaveDataDialog.cpp b/core/libs/tests/GuestSaveDataDialog.cpp
index 1c3ffc702d..e3f2ef95bf 100644
--- a/core/libs/tests/GuestSaveDataDialog.cpp
+++ b/core/libs/tests/GuestSaveDataDialog.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
+#include "prx/libSceSaveDataDialog.native/include/Api.hpp"
 #include "prx/libSceSaveDataDialog.native/SaveDataDialog.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -5,19 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceSaveDataDialogInitialize();
-int APS5_VABI sceSaveDataDialogOpen(const void* param);
-int APS5_VABI sceSaveDataDialogGetStatus();
-int APS5_VABI sceSaveDataDialogUpdateStatus();
-int APS5_VABI sceSaveDataDialogIsReadyToDisplay();
-int APS5_VABI sceSaveDataDialogProgressBarInc(int target, std::uint32_t delta);
-int APS5_VABI sceSaveDataDialogProgressBarSetValue(int target, std::uint32_t rate);
-int APS5_VABI sceSaveDataDialogClose(const void* param);
-int APS5_VABI sceSaveDataDialogGetResult(void* result);
-int APS5_VABI sceSaveDataDialogTerminate();
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -106,6 +95,38 @@ int main() {
     Require(sceSaveDataDialogTerminate() == 0, "terminate");
     Require(sceSaveDataDialogTerminate() == SAVE_DATA_DIALOG_ERROR_NOT_INITIALIZED, "terminate when already terminated");
     Require(sceSaveDataDialogGetStatus() == SAVE_DATA_DIALOG_STATUS_NONE, "terminated state");
+
+    Require(sceSaveDataDialogInitialize() == 0, "re-initialize for empty selection");
+    SaveDataDialogParam emptySelectionParam{};
+    emptySelectionParam.size = sizeof(emptySelectionParam);
+    emptySelectionParam.mode = 1;
+    Require(sceSaveDataDialogOpen(&emptySelectionParam) == 0, "open selection dialog without items");
+    Require(sceSaveDataDialogGetStatus() == SAVE_DATA_DIALOG_STATUS_FINISHED, "selection finishes immediately");
+    SaveDataDirName emptySelectionDir{};
+    std::memset(emptySelectionDir.data, 'X', sizeof(emptySelectionDir.data));
+    SaveDataDialogResult emptySelectionResult{};
+    emptySelectionResult.dir_name = &emptySelectionDir;
+    Require(sceSaveDataDialogGetResult(&emptySelectionResult) == 0, "read empty selection result");
+    Require(emptySelectionDir.data[0] == '\0', "empty selection directory name must be null-terminated");
+    Require(emptySelectionResult.mode == emptySelectionParam.mode &&
+            emptySelectionResult.result == SAVE_DATA_DIALOG_RESULT_OK, "selection result status");
+    Require(sceSaveDataDialogTerminate() == 0, "terminate selection");
+
+    Require(sceSaveDataDialogInitialize() == 0, "re-initialize for empty result");
+    param = {};
+    param.size = sizeof(param);
+    param.mode = SAVE_DATA_DIALOG_MODE_PROGRESS_BAR;
+    Require(sceSaveDataDialogOpen(&param) == 0, "open progress without items");
+    Require(sceSaveDataDialogClose(nullptr) == 0, "close empty progress");
+    Require(sceSaveDataDialogUpdateStatus() == SAVE_DATA_DIALOG_STATUS_FINISHED, "finish empty progress");
+    SaveDataDirName emptySelected{};
+    std::memset(emptySelected.data, 'X', sizeof(emptySelected.data));
+    SaveDataDialogResult emptyResult{};
+    emptyResult.dir_name = &emptySelected;
+    Require(sceSaveDataDialogGetResult(&emptyResult) == 0, "read empty result");
+    Require(emptySelected.data[0] == '\0', "empty directory name must be null-terminated");
+    Require(sceSaveDataDialogTerminate() == 0, "terminate empty progress");
+
     Require(sceSaveDataDialogProgressBarInc(0, 10) == SAVE_DATA_DIALOG_ERROR_NOT_RUNNING, "progress inc after terminate");
     Require(sceSaveDataDialogProgressBarSetValue(0, 50) == SAVE_DATA_DIALOG_ERROR_NOT_RUNNING, "progress set value after terminate");
 }
diff --git a/core/libs/tests/GuestSaveDataMountStatus.cpp b/core/libs/tests/GuestSaveDataMountStatus.cpp
index 33fd69861e..596fc94026 100644
--- a/core/libs/tests/GuestSaveDataMountStatus.cpp
+++ b/core/libs/tests/GuestSaveDataMountStatus.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
@@ -7,20 +9,9 @@
 #include <set>
 #include <string>
 #include <system_error>
-
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataBackup(const SaveDataBackup*);
-int APS5_VABI sceSaveDataGetEventResult(const void*, SaveDataEvent*);
-int APS5_VABI sceSaveDataMount3(const SaveDataMount3*, SaveDataMountResult*);
-int APS5_VABI sceSaveDataUmount2(std::uint32_t, const SaveDataMountPoint*);
-int APS5_VABI sceSaveDataGetMountInfo(const SaveDataMountPoint*, SaveDataMountInfo*);
-int APS5_VABI sceSaveDataGetParam(const SaveDataMountPoint*, std::uint32_t, void*, std::size_t, std::size_t*);
-int APS5_VABI sceSaveDataSetParam(const SaveDataMountPoint*, std::uint32_t, const void*, std::size_t);
-int APS5_VABI sceSaveDataLoadIcon(const SaveDataMountPoint*, SaveDataIcon*);
-int APS5_VABI sceSaveDataSaveIcon(const SaveDataMountPoint*, const SaveDataIcon*);
-int APS5_VABI sceSaveDataSaveIconByPath(const SaveDataMountPoint*, const char*);
-}
+#ifdef _WIN32
+#include <windows.h>
+#endif
 
 namespace {
 
@@ -47,6 +38,11 @@ void CheckUnmountedCalls() {
     SaveDataIcon icon{};
     char buf[128]{};
     std::size_t gotSize = 0;
+    SaveDataMount3 nullMount{};
+    SaveDataMountResult mountResult{};
+    Check(sceSaveDataMount3(nullptr, &mountResult) == SaveDataErrorParameter, "mount3 null mount is PARAMETER");
+    Check(sceSaveDataMount3(&nullMount, nullptr) == SaveDataErrorParameter, "mount3 null result is PARAMETER");
+    Check(sceSaveDataMount3(&nullMount, &mountResult) == SaveDataErrorParameter, "mount3 null dir_name is PARAMETER");
     Check(sceSaveDataUmount2(0, nullptr) == SaveDataErrorParameter, "umount2 null point is PARAMETER");
     Check(sceSaveDataUmount2(0, &point) == SaveDataErrorNotMounted, "umount2 unmounted point is NOT_MOUNTED");
     Check(sceSaveDataLoadIcon(nullptr, &icon) == SaveDataErrorParameter, "loadIcon null point is PARAMETER");
@@ -163,7 +159,15 @@ void CheckEquivalentMounts() {
     const auto casePath = std::filesystem::path("_sd") / "IDENTITY";
     const bool caseAlias = std::filesystem::exists(casePath) && std::filesystem::equivalent(originalPath, casePath, error);
     Check(!error || error == std::errc::no_such_file_or_directory, "case-alias identity check succeeds");
+#ifdef _WIN32
+    error.clear();
+    if (!CreateSymbolicLinkW((std::filesystem::path("_sd") / "linked").c_str(), L"identity",
+            SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)) {
+        error = std::error_code(GetLastError(), std::system_category());
+    }
+#else
     std::filesystem::create_directory_symlink("identity", std::filesystem::path("_sd") / "linked", error);
+#endif
     const bool symlinkAlias = !error;
     Check(caseAlias || symlinkAlias, "a host alias is available to check mount identity");
 
@@ -185,7 +189,12 @@ void CheckEquivalentMounts() {
     if (caseAlias) MountAndCheck("IDENTITY", MountReadWrite, 0u, "case alias after unmount");
     if (symlinkAlias) {
         MountAndCheck("linked", MountReadWrite, 0u, "symlink alias after unmount");
+#ifdef _WIN32
+        error.clear();
+        if (!RemoveDirectoryW((std::filesystem::path("_sd") / "linked").c_str())) error = std::error_code(GetLastError(), std::system_category());
+#else
         std::filesystem::remove(std::filesystem::path("_sd") / "linked", error);
+#endif
         Check(!error, "symlink alias is removed");
     }
 }
@@ -232,6 +241,7 @@ int main() {
     const auto previous = std::filesystem::current_path();
     std::filesystem::current_path(root);
     CheckUnmountedCalls();
+    Check(sceSaveDataSyncSaveDataMemory(nullptr) == static_cast<int>(0x809F0000), "null param rejected in memory sync");
     Check(sceSaveDataInitialize3(nullptr) == 0, "SaveData initializes");
     MountAndCheck("fresh", MountReadWrite | MountCreate2, 1u, "CREATE2 of a missing save");
     MountAndCheck("fresh", MountReadWrite | MountCreate2, 0u, "CREATE2 of an existing save");
diff --git a/core/libs/tests/GuestSaveDataPs4.cpp b/core/libs/tests/GuestSaveDataPs4.cpp
index 6ee6868bd4..0c4a45540f 100644
--- a/core/libs/tests/GuestSaveDataPs4.cpp
+++ b/core/libs/tests/GuestSaveDataPs4.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
@@ -8,19 +10,13 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI sceSaveDataTransferringMountPs4(const SaveDataTransferringMount*, SaveDataMountResult*);
-extern "C" int APS5_VABI sceSaveDataDirNameSearchPs4(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-extern "C" int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-extern "C" int APS5_VABI sceSaveDataInitialize(const void*);
-extern "C" int APS5_VABI sceSaveDataTerminate();
-extern "C" int APS5_VABI sceSaveDataSetupSaveDataMemory(std::int32_t, std::size_t, const SaveDataParam*);
-extern "C" int APS5_VABI sceSaveDataSetSaveDataMemory(std::int32_t, void*, std::size_t, std::int64_t);
-extern "C" int APS5_VABI sceSaveDataGetSaveDataMemory(std::int32_t, void*, std::size_t, std::int64_t);
-
 namespace {
 
 constexpr int SaveDataErrorNotFound = -2137063416;
 constexpr int SaveDataErrorNotInitialized = -2137063423;
+constexpr int SaveDataErrorParameter = -2137063424;
+constexpr int SaveDataErrorNotMounted = -2137063420;
+constexpr std::uint32_t MountReadWrite = 2;
 
 int failures = 0;
 
@@ -53,6 +49,11 @@ void TestTransferringMountPs4() {
     std::memset(&result, 0xAA, sizeof(result));
     Check(sceSaveDataTransferringMountPs4(&mount, &result) == SaveDataErrorNotFound, "TransferringMountPs4 returns NOT_FOUND");
     Check(result.mount_point.data[0] == '\0', "TransferringMountPs4 reports no mount point");
+    std::memset(&result, 0xAA, sizeof(result));
+    Check(sceSaveDataTransferringMount(&mount, &result) == SaveDataErrorNotFound, "TransferringMount returns NOT_FOUND");
+    Check(result.mount_point.data[0] == '\0', "TransferringMount reports no mount point");
+    Check(sceSaveDataTransferringMount(nullptr, nullptr) == SaveDataErrorNotFound, "TransferringMount handles null arguments");
+    Check(sceSaveDataTransferringMountPs4(nullptr, nullptr) == SaveDataErrorNotFound, "TransferringMountPs4 handles null arguments");
 }
 
 void TestDirNameSearchPs4() {
@@ -96,6 +97,23 @@ void TestSaveDataMemoryV1() {
     Check(sceSaveDataTerminate() == 0, "Terminate after v1 Initialize");
 }
 
+void TestMountPs4() {
+    SaveDataMountResult result{};
+    Check(sceSaveDataMount(nullptr, &result) == SaveDataErrorParameter, "null mount is PARAMETER");
+    SaveDataMountPs4 mount{};
+    Check(sceSaveDataMount(&mount, &result) == SaveDataErrorParameter, "null dir_name is PARAMETER");
+    Check(sceSaveDataUmount(nullptr) == SaveDataErrorParameter, "umount null point is PARAMETER");
+    SceSaveDataDirName dir{};
+    std::strcpy(dir.data, "kept");
+    mount.dir_name = &dir;
+    mount.mount_mode = MountReadWrite;
+    Check(sceSaveDataMount(&mount, nullptr) == SaveDataErrorParameter, "null mount_result is PARAMETER");
+    Check(sceSaveDataMount(&mount, &result) == 0, "mount existing save directory succeeds");
+    Check(result.mount_point.data[0] != '\0', "mount writes mount point");
+    Check(sceSaveDataUmount(&result.mount_point) == 0, "umount mounted point succeeds");
+    Check(sceSaveDataUmount(&result.mount_point) == SaveDataErrorNotMounted, "umount unmounted point is NOT_MOUNTED");
+}
+
 }
 
 int main() {
@@ -107,6 +125,7 @@ int main() {
     TestTransferringMountPs4();
     TestDirNameSearchPs4();
     TestSaveDataMemoryV1();
+    TestMountPs4();
 
     std::filesystem::current_path(previous);
     std::error_code error;
diff --git a/core/libs/tests/GuestSaveDataSearch.cpp b/core/libs/tests/GuestSaveDataSearch.cpp
index 47613690d3..c476d6fd0c 100644
--- a/core/libs/tests/GuestSaveDataSearch.cpp
+++ b/core/libs/tests/GuestSaveDataSearch.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -12,30 +13,12 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-int APS5_VABI sceSaveDataDirNameSearch2(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-int APS5_VABI sceSaveDataMount3(const SaveDataMount3*, SaveDataMountResult*);
-int APS5_VABI sceSaveDataUmount2(std::uint32_t, const SaveDataMountPoint*);
-int APS5_VABI sceSaveDataSetParam(const SaveDataMountPoint*, std::uint32_t, const void*, std::size_t);
-int APS5_VABI sceSaveDataGetMountInfo(const SaveDataMountPoint*, SaveDataMountInfo*);
-}
-
 static constexpr int SaveDataErrorParameter = -2137063424;
 
 static void Require(bool value, const char* message) {
     if (!value) throw std::runtime_error(message);
 }
 
-template <typename TFunction>
-static bool ThrowsRuntimeError(TFunction function) {
-    try {
-        function();
-    } catch (const std::runtime_error&) {
-        return true;
-    }
-    return false;
-}
 
 static std::vector<std::string> Search(std::uint32_t key, std::uint32_t order, std::uint32_t capacity, std::uint32_t* hits) {
     SceSaveDataDirName pattern{};
@@ -291,10 +274,10 @@ static void CheckNullArguments() {
     SaveDataDirNameSearchCond cond{};
     cond.user_id = 1;
     SaveDataDirNameSearchResult result{};
-    Require(ThrowsRuntimeError([&] { sceSaveDataDirNameSearch(nullptr, &result); }), "null cond throws in sceSaveDataDirNameSearch");
-    Require(ThrowsRuntimeError([&] { sceSaveDataDirNameSearch(&cond, nullptr); }), "null result throws in sceSaveDataDirNameSearch");
-    Require(ThrowsRuntimeError([&] { sceSaveDataDirNameSearch2(nullptr, &result); }), "null cond throws in sceSaveDataDirNameSearch2");
-    Require(ThrowsRuntimeError([&] { sceSaveDataDirNameSearch2(&cond, nullptr); }), "null result throws in sceSaveDataDirNameSearch2");
+    Require(sceSaveDataDirNameSearch(nullptr, &result) == SaveDataErrorParameter, "null cond returns PARAMETER in sceSaveDataDirNameSearch");
+    Require(sceSaveDataDirNameSearch(&cond, nullptr) == SaveDataErrorParameter, "null result returns PARAMETER in sceSaveDataDirNameSearch");
+    Require(sceSaveDataDirNameSearch2(nullptr, &result) == SaveDataErrorParameter, "null cond returns PARAMETER in sceSaveDataDirNameSearch2");
+    Require(sceSaveDataDirNameSearch2(&cond, nullptr) == SaveDataErrorParameter, "null result returns PARAMETER in sceSaveDataDirNameSearch2");
     cond.order = 2;
     Require(sceSaveDataDirNameSearch2(&cond, &result) == SaveDataErrorParameter, "invalid order must be rejected in sceSaveDataDirNameSearch2");
 }
diff --git a/core/libs/tests/GuestScanCount.cpp b/core/libs/tests/GuestScanCount.cpp
index 1ddfe19674..9c2df500c0 100644
--- a/core/libs/tests/GuestScanCount.cpp
+++ b/core/libs/tests/GuestScanCount.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <array>
@@ -8,9 +9,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" int APS5_VABI sscanf_s_nid_postfix(const char*, const char*, ...);
-extern "C" int APS5_VABI vsscanf_s_nid_postfix(const char*, const char*, VaList*);
-
 static int APS5_VABI ScanList(const char* input, const char* format, ...) {
 #ifdef _WIN32
     __builtin_sysv_va_list args;
diff --git a/core/libs/tests/GuestSceNet.cpp b/core/libs/tests/GuestSceNet.cpp
index 276da969b7..77e3e7ad0d 100644
--- a/core/libs/tests/GuestSceNet.cpp
+++ b/core/libs/tests/GuestSceNet.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <io.h>
@@ -32,116 +36,14 @@
 extern "C" {
 extern const std::uint8_t in6addr_any_nid_postfix[16];
 extern const std::uint8_t in6addr_loopback_nid_postfix[16];
-int APS5_VABI sceNetInit_nid_postfix(void);
-int APS5_VABI sceNetShowNetstatWithMemory(int);
-int APS5_VABI sceNetShowNetstat(void);
-int APS5_VABI sceNetShowIfconfig(void);
-int APS5_VABI sceNetShowRoute(void);
-int APS5_VABI sceNetShowRoute6(void);
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetListen(int, int);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetGetpeername(int, void*, std::uint32_t*);
-int APS5_VABI sceNetGetSockInfo(int, void*, int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetAccept(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetSend(int, const void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-int APS5_VABI sceNetSocketClose(int);
-int APS5_VABI sceNetSocketAbort(int, int);
-int APS5_VABI sceNetShutdown(int, int);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockopt(int, int, int, void*, std::uint32_t*);
-int APS5_VABI sceNetIoctl(int, std::uint32_t, void*);
-int* APS5_VABI sceNetErrnoLoc(void);
-int APS5_VABI sceNetEtherNtostr(const NetEtherAddr*, char*, std::size_t);
-int APS5_VABI sceNetEtherStrton(const char*, NetEtherAddr*);
-int APS5_VABI sceNetEpollCreate(const char*, int);
-int APS5_VABI sceNetEpollControl(int, int, int, const NetEpollEvent*);
-int APS5_VABI sceNetEpollWait(int, NetEpollEvent*, int, int);
-int APS5_VABI sceNetEpollDestroy(int);
-int APS5_VABI sceNetEpollAbort(int, int);
-int APS5_VABI sceNetGetsockopt(int, int, int, void*, std::uint32_t*);
+
 extern const std::uint32_t sce_net_in6addr_any[4];
 extern const std::uint8_t sce_net_in6addr_linklocal_allnodes[16];
-int APS5_VABI sceNetResolverCreate(const char*, int, int);
-int APS5_VABI sceNetResolverStartNtoa(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartNtoa6(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartNtoaMultipleRecordsEx(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartNtoaMultipleRecords(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartAton(int, const void*, char*, int, int, int, int);
-int APS5_VABI sceNetResolverStartAton6(int, const void*, char*, int, int, int, int);
-int APS5_VABI sceNetResolverAbort(int, int);
-int APS5_VABI sceNetResolverDestroy(int);
-int APS5_VABI sceNetResolverGetError(int, int*);
-int APS5_VABI sceNetClearDnsCache(int);
-int APS5_VABI sceNetGetDnsInfo(std::uint32_t*, int);
-int APS5_VABI sceNetCtlInit(void);
-int APS5_VABI sceNetCtlGetState(int*);
-int APS5_VABI sceNetCtlGetInfo(int, NetCtlInfo*);
-int APS5_VABI sceNetCtlGetIfStat(NetCtlIfStat*);
-int APS5_VABI sceNetCtlRegisterCallback(NetCtlCallback, void*, int*);
-int APS5_VABI sceNetCtlUnregisterCallback(int);
-int APS5_VABI sceNetCtlRegisterCallbackV6(NetCtlCallback, void*, int*);
-int APS5_VABI sceNetCtlUnregisterCallbackV6(int);
+
 std::uint64_t NetCtlReadByteCounter_nid_no_patch(const char*);
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
+
 bool GuestSocketIsOpen_nid_no_patch(int);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-struct GuestPollEntry {
-    int descriptor;
-    short events;
-    short revents;
-};
-int APS5_VABI poll_nid_postfix(GuestPollEntry*, std::uint32_t, int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetInetPton(int, const char*, void*);
-int APS5_VABI sceNetInetPtonEx(int, const char*, void*, int);
-int APS5_VABI sceNetUsleep(int);
-void APS5_VABI sceNetGetSystemTime(std::uint64_t*);
-const char* APS5_VABI sceNetInetNtop(int, const void*, char*, std::uint32_t);
-int* APS5_VABI sceNetErrnoLoc(void);
-}
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t name_length;
-    NetIovec* iov;
-    int iov_length;
-    void* control;
-    std::uint32_t control_length;
-    int flags;
-};
-
-struct NetMemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-};
-
-extern "C" {
-std::int64_t APS5_VABI sceNetSendmsg(int, const NetMsghdr*, int);
-std::int64_t APS5_VABI sceNetRecvmsg(int, NetMsghdr*, int);
-int APS5_VABI sceNetPoolCreate(const char*, int, int);
-int APS5_VABI sceNetPoolDestroy(int);
-int APS5_VABI sceNetGetMemoryPoolStats(int, NetMemoryPoolStats*);
-const char* APS5_VABI sceNetGetIfName(std::uint32_t);
-int APS5_VABI sceNetGetRandom(std::uint32_t*);
-void* APS5_VABI sceNetMemoryAllocate(std::int32_t, int);
-void APS5_VABI sceNetMemoryFree(void*);
 }
 
 static void Require(bool condition) {
@@ -167,10 +69,51 @@ public:
 
 static void APS5_VABI IgnoreNetCtlEvent(int, void*) {}
 
+struct NetCtlEventRecord {
+    int calls = 0;
+    int event = 0;
+    void* arg = nullptr;
+};
+
+static void APS5_VABI RecordNetCtlEvent(int event, void* arg) {
+    auto* record = static_cast<NetCtlEventRecord*>(arg);
+    ++record->calls;
+    record->event = event;
+    record->arg = arg;
+}
+
 static bool Failed(std::int64_t result, int error) {
     return result == static_cast<int>(0x80410100u | static_cast<unsigned>(error)) && *sceNetErrnoLoc() == error;
 }
 
+template<typename TBody>
+static std::string CaptureStdout(TBody body) {
+    std::fflush(stdout);
+    std::FILE* capture = std::tmpfile();
+    Require(capture != nullptr);
+#ifdef _WIN32
+    const int saved = _dup(_fileno(stdout));
+    Require(saved >= 0 && _dup2(_fileno(capture), _fileno(stdout)) == 0);
+#else
+    const int saved = dup(fileno(stdout));
+    Require(saved >= 0 && dup2(fileno(capture), fileno(stdout)) >= 0);
+#endif
+    body();
+    std::fflush(stdout);
+#ifdef _WIN32
+    Require(_dup2(saved, _fileno(stdout)) == 0);
+    _close(saved);
+#else
+    Require(dup2(saved, fileno(stdout)) >= 0);
+    close(saved);
+#endif
+    std::string text;
+    std::rewind(capture);
+    for (int character = std::fgetc(capture); character != EOF; character = std::fgetc(capture)) text.push_back(static_cast<char>(character));
+    std::fclose(capture);
+    return text;
+}
+
 static void CheckSocketHostErrors() {
     Require(Failed(sceNetSocket(nullptr, 2, 1, 17), 43));
 }
@@ -270,11 +213,15 @@ static void CheckNetstat() {
         }
         Require(unsupported);
     }
+    Require(sceNetShowPolicy() == 0);
+    Require(sceNetShowNetstatEx(0) == 0);
     Require(sceNetShowRoute() == 0);
     Require(sceNetShowRoute6() == 0);
     Require(Failed(sceNetShowNetstatWithMemory(-1), 9));
+    Require(Failed(sceNetShowRouteWithMemory(-1), 9));
     const int pool = sceNetPoolCreate("netstat", 4096, 0);
     Require(pool > 0);
+    Require(sceNetShowRouteWithMemory(pool) == 0);
     const auto empty = CaptureNetstat(pool);
     Require(empty.find("bytes=4096 sockets=0") != std::string::npos);
     const int socket = sceNetSocket("netstat", 2, 1, 0);
@@ -295,6 +242,7 @@ static void CheckNetstat() {
     Require(CaptureNetstat(pool).find("sockets=0") != std::string::npos);
     Require(sceNetPoolDestroy(pool) == 0);
     Require(Failed(sceNetShowNetstatWithMemory(pool), 9));
+    Require(Failed(sceNetShowRouteWithMemory(pool), 9));
 }
 
 static void CheckPoolStats() {
@@ -557,6 +505,40 @@ static void CheckEmptyEpoll() {
     }
 }
 
+static void CheckRejectedArguments() {
+    Require(Failed(sceNetEpollCreate(nullptr, 0), 22));
+    for (const int flags : {1, 0x10000, -1}) Require(Failed(sceNetEpollCreate("rejected-epoll", flags), 22));
+
+    std::array<std::uint8_t, 6> untouched{};
+    untouched.fill(0xA5);
+    NetEtherAddr mac{};
+    std::memcpy(mac.data, untouched.data(), untouched.size());
+    for (const int flags : {1, 0x10000, -1}) {
+        Require(Failed(sceNetGetMacAddress(&mac, flags), 22));
+        Require(std::memcmp(mac.data, untouched.data(), untouched.size()) == 0);
+    }
+    Require(Failed(sceNetGetMacAddress(nullptr, 1), 22));
+
+    for (const int flags : {1, 0x10000, -1}) Require(Failed(sceNetResolverCreate("rejected-resolver", 0, flags), 22));
+
+    std::array<std::uint8_t, 4> ipv4{};
+    const int resolver = sceNetResolverCreate("rejected-ntoa", 0, 0);
+    Require(resolver >= 0);
+    Require(sceNetResolverAbort(resolver, 1) == 0);
+    Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), -1, 1, 0), 22));
+    Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, -1, 0), 22));
+    for (const int flags : {2, 0x20000, 0x10003, static_cast<int>(0x80000000u), -1})
+        Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, flags), 22));
+    Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, 0), 4));
+    Require(sceNetResolverDestroy(resolver) == 0);
+
+    Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), -1, 0, 0), 22));
+    Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 0, -1, 0), 22));
+    Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 0, 0, 2), 22));
+    for (const int flags : {0, 1, 0x10000, 0x10001})
+        Require(Failed(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 0, 0, flags), 9));
+}
+
 static void CheckDontWait() {
     constexpr int DontWait = 0x80;
     constexpr int Peek = 0x2;
@@ -840,7 +822,7 @@ static void CheckIoctl() {
     Require(sceNetIoctl(socket, 0x4004667f, &readable) == 0 && readable == 0);
     const char payload[5] = {'i', 'o', 'c', 't', 'l'};
     Require(sceNetSendto(socket, payload, sizeof(payload), 0, address.data(), address.size()) == sizeof(payload));
-    GuestPollEntry entry{socket, 1, 0};
+    GuestPollDescriptor entry{socket, 1, 0};
     Require(poll_nid_postfix(&entry, 1, 1000) == 1 && entry.revents == 1);
     Require(sceNetIoctl(socket, 0x4004667f, &readable) == 0 && readable == sizeof(payload));
     Require(sceNetRecv(socket, buffer, sizeof(buffer), 0) == sizeof(payload));
@@ -926,9 +908,24 @@ static void CheckInetPtonWhitespace() {
     for (const char* text : {" 1.2.3.4", "1.2.3.4x", "1.2.3.4.", "1.2.3.4\x01", "1.2.3.4\xa0", "1.2. 3.4", "1.2.3", "1.2.3 ", "01.2.3.4", "256.0.0.1"}) {
         CheckInetPtonRejects(2, text);
     }
-    for (const char* text : {"::1 ", "::1\t", " ::1", "::1x"}) {
+    for (const char* text : {"::1 ", "::1\t", " ::1", "::1x", "::ffff:1.2.3.4x", "::ffff:1.2.3.4\x01", "::ffff:01.2.3.4", "::ffff:1.2.3",
+                             "::ffff:0x1.2.3.4", "::ffff ", "::ffff:1.2 .3.4"}) {
         CheckInetPtonRejects(28, text);
     }
+    for (const char* text : {"::ffff:1.2.3.4 x", "::ffff:1.2.3.4\t", "::ffff:1.2.3.4\nzz", "::ffff:1.2.3.4 "}) {
+        std::array<std::uint8_t, 16> address{};
+        *sceNetErrnoLoc() = 123;
+        Require(sceNetInetPton(28, text, address.data()) == 1 && *sceNetErrnoLoc() == 123);
+        Require(address[10] == 0xff && address[11] == 0xff && address[12] == 1 && address[15] == 4);
+    }
+    std::array<std::uint8_t, 16> full{};
+    Require(sceNetInetPton(28, "1:2:3:4:5:6:1.2.3.4 z", full.data()) == 1 && full[1] == 1 && full[11] == 6 && full[12] == 1 && full[15] == 4);
+    *sceNetErrnoLoc() = 123;
+    Require(sceNetInetPton(2, "1.2.3.4", nullptr) == 1 && *sceNetErrnoLoc() == 123);
+    Require(sceNetInetPton(2, "abc", nullptr) == 0 && *sceNetErrnoLoc() == 123);
+    Require(sceNetInetPton(28, "::1", nullptr) < 0 && *sceNetErrnoLoc() == 22);
+    *sceNetErrnoLoc() = 123;
+    Require(sceNetInetPton(28, nullptr, full.data()) < 0 && *sceNetErrnoLoc() == 22);
 }
 
 struct AtonCase {
@@ -984,7 +981,9 @@ static void CheckInetPtonEx() {
     Require(sceNetInetPtonEx(2, "not an address", address.data(), 0) == 0);
     Require(Failed(sceNetInetPtonEx(99, "127.0.0.1", address.data(), 0), 47));
     Require(Failed(sceNetInetPtonEx(2, nullptr, address.data(), 0), 22));
-    Require(Failed(sceNetInetPtonEx(2, "127.0.0.1", nullptr, 0), 22));
+    *sceNetErrnoLoc() = 123;
+    Require(sceNetInetPtonEx(2, "127.0.0.1", nullptr, 0) == 1 && *sceNetErrnoLoc() == 123);
+    Require(sceNetInetPtonEx(2, "abc", nullptr, 0) == 0 && *sceNetErrnoLoc() == 123);
     for (const int flags : {1, 0x100, -1}) {
         address.fill(0);
         Require(sceNetInetPtonEx(2, "1.2.3", address.data(), flags) == 1);
@@ -1104,14 +1103,17 @@ static void CheckSystemTime() {
 }
 
 static void CheckUsleep() {
-    Require(sceNetUsleep(0) == 0);
+    Require(CaptureStdout([] { Require(sceNetUsleep(0) == 0); }).empty());
     const auto start = std::chrono::steady_clock::now();
     Require(sceNetUsleep(2000) == 0);
     Require(std::chrono::steady_clock::now() - start >= std::chrono::microseconds(2000));
-    *sceNetErrnoLoc() = 0;
-    Require(Failed(sceNetUsleep(-1), 22));
-    *sceNetErrnoLoc() = 0;
-    Require(Failed(sceNetUsleep(INT32_MIN), 22));
+    const std::string printed = CaptureStdout([] {
+        *sceNetErrnoLoc() = 0;
+        Require(Failed(sceNetUsleep(-1), 22));
+        *sceNetErrnoLoc() = 0;
+        Require(Failed(sceNetUsleep(INT32_MIN), 22));
+    });
+    Require(printed == "[LIBNET] usleep -1\n[LIBNET] usleep -2147483648\n");
 }
 
 static void CheckEpollIdent() {
@@ -1140,6 +1142,39 @@ static void CheckEpollIdent() {
     Require(sceNetSocketClose(sender) == 0 && sceNetSocketClose(receiver) == 0);
 }
 
+static void CheckEpollClosedStream() {
+    std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+    const int listener = sceNetSocket("closed-stream-listener", 2, 1, 6);
+    Require(listener >= 0);
+    Require(sceNetBind_nid_postfix(listener, address.data(), address.size()) == 0 && sceNetListen(listener, 1) == 0);
+    std::uint32_t size = address.size();
+    Require(sceNetGetsockname(listener, address.data(), &size) == 0);
+    const int client = sceNetSocket("closed-stream-client", 2, 1, 6);
+    Require(client >= 0 && sceNetConnect(client, address.data(), address.size()) == 0);
+    const int accepted = sceNetAccept(listener, nullptr, nullptr);
+    Require(accepted >= 0);
+    const int epoll = sceNetEpollCreate("epoll-closed-stream", 0);
+    Require(epoll >= 0);
+    NetEpollEvent registration{};
+    registration.events = 1;
+    registration.ident = static_cast<std::uint64_t>(accepted);
+    Require(sceNetEpollControl(epoll, 1, accepted, &registration) == 0);
+    Require(sceNetSocketClose(client) == 0);
+    NetEpollEvent ready{};
+    Require(sceNetEpollWait(epoll, &ready, 1, 1000000) == 1 && ready.events == 1);
+    char byte = 0;
+    Require(sceNetRecv(accepted, &byte, 1, 0) == 0);
+    registration.events = 3;
+    Require(sceNetEpollControl(epoll, 2, accepted, &registration) == 0);
+    Require(sceNetEpollWait(epoll, &ready, 1, 0) == 1 && ready.events == 3);
+    Require(sceNetShutdown(accepted, 1) == 0);
+    registration.events = 1;
+    Require(sceNetEpollControl(epoll, 2, accepted, &registration) == 0);
+    Require(sceNetEpollWait(epoll, &ready, 1, 0) == 1 && ready.events == (1 | 16));
+    Require(sceNetEpollDestroy(epoll) == 0);
+    Require(sceNetSocketClose(accepted) == 0 && sceNetSocketClose(listener) == 0);
+}
+
 static void CheckTcpNoDelay() {
     const int stream = sceNetSocket("tcp-nodelay", 2, 1, 6);
     const int datagram = sceNetSocket("tcp-nodelay-udp", 2, 2, 17);
@@ -1192,6 +1227,13 @@ static bool HostIpv6LoopbackUnavailable() {
 #endif
 }
 
+static void CheckRejectedAddressText(const char* text) {
+    std::array<std::uint8_t, 16> address;
+    address.fill(0xa5);
+    Require(sceNetInetPton(28, text, address.data()) == 0);
+    Require(address[0] == 0xa5 && address[15] == 0xa5);
+}
+
 static void CheckLinkLocalAllNodesIpv6() {
     Require(reinterpret_cast<std::uintptr_t>(sce_net_in6addr_linklocal_allnodes) % alignof(std::uint32_t) == 0);
     std::array<std::uint8_t, 16> address{};
@@ -1536,7 +1578,7 @@ static std::vector<int> RequireSockInfoList(int flags) {
         int socket = 0;
         std::memcpy(&socket, &listed[0x24], sizeof(socket));
         Require(sockets.empty() || socket > sockets.back());
-        std::array<std::uint8_t, 0xa0> single;
+        alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> single;
         Require(sceNetGetSockInfo(socket, single.data(), 1, 0) == 1 && std::equal(single.begin(), single.end(), listed));
         sockets.push_back(socket);
     }
@@ -1583,7 +1625,7 @@ static void CheckSockInfo() {
     Require(sceNetSetsockopt(datagram, 0xffff, 0x1001, &buffers[1], sizeof(buffers[1])) == 0);
     const auto configured = RequireSockInfo(datagram, 2, 0x200001, datagramAddress, listening);
     Require(std::memcmp(configured.data() + 0x64, buffers.data(), sizeof(buffers)) == 0);
-    std::array<std::uint8_t, 0xa0> record;
+    alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> record;
     record.fill(0xa5);
     Require(Failed(sceNetGetSockInfo(datagram, nullptr, 1, 0), 22));
     Require(Failed(sceNetGetSockInfo(datagram, record.data(), 0, 0), 22));
@@ -1606,6 +1648,185 @@ static void CheckSockInfo() {
     Require(RequireSockInfoList(0) == earlier);
 }
 
+static std::array<std::uint8_t, 0xa0> RequireSockInfo6(int socket, int type, bool ipv6, bool nonblock, const std::array<std::uint8_t, 28>& local,
+    const std::array<std::uint8_t, 28>& remote, int requestFlags) {
+    std::array<std::uint8_t, 0x140> records;
+    records.fill(0xa5);
+    Require(sceNetGetSockInfo6(socket, reinterpret_cast<NetSockInfo6*>(records.data()), 2, requestFlags) == 1);
+    std::array<std::uint8_t, 0xa0> expected{};
+    std::memcpy(expected.data() + 0x24, &socket, sizeof(socket));
+    expected[0x28] = static_cast<std::uint8_t>(type);
+    if (ipv6) {
+        std::memcpy(expected.data() + 0x6c, local.data() + 8, 16);
+        std::memcpy(expected.data() + 0x7c, remote.data() + 8, 16);
+    } else {
+        std::memcpy(expected.data() + 0x34, local.data() + 4, 4);
+        std::memcpy(expected.data() + 0x38, remote.data() + 4, 4);
+    }
+    std::memcpy(expected.data() + 0x3c, local.data() + 2, 2);
+    std::memcpy(expected.data() + 0x3e, remote.data() + 2, 2);
+    const int flags = 1 | (nonblock ? 0x200000 : 0) | (ipv6 ? 0x400000 : 0);
+    std::memcpy(expected.data() + 0x48, &flags, sizeof(flags));
+    for (const auto [offset, option] : {std::array{0x64, 0x1002}, std::array{0x68, 0x1001}}) {
+        int size = 0;
+        std::uint32_t length = sizeof(size);
+        Require(sceNetGetsockopt(socket, 0xffff, option, &size, &length) == 0 && size > 0);
+        std::memcpy(expected.data() + offset, &size, sizeof(size));
+    }
+    Require(std::equal(expected.begin(), expected.end(), records.begin()));
+    Require(std::all_of(records.begin() + 0xa0, records.end(), [](auto byte) { return byte == 0xa5; }));
+    return expected;
+}
+
+static std::vector<int> RequireSockInfo6List(int flags) {
+    const int count = sceNetGetSockInfo6(-1, nullptr, 0, flags);
+    Require(count >= 0);
+    std::vector<std::uint8_t> records(static_cast<std::size_t>(count + 1) * 0xa0, 0xa5);
+    Require(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(records.data()), count + 1, flags) == count);
+    Require(std::all_of(records.end() - 0xa0, records.end(), [](auto byte) { return byte == 0xa5; }));
+    std::vector<std::uint8_t> unbounded(records.size(), 0xa5);
+    Require(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(unbounded.data()), INT32_MAX, flags) == count && unbounded == records);
+    std::vector<int> sockets;
+    for (int index = 0; index < count; ++index) {
+        const auto listed = records.begin() + index * 0xa0;
+        int socket = 0;
+        int status = 0;
+        std::memcpy(&socket, &listed[0x24], sizeof(socket));
+        std::memcpy(&status, &listed[0x48], sizeof(status));
+        Require(sockets.empty() || socket > sockets.back());
+        Require((flags & 0x1000) != 0 || (status & 0x400000) != 0);
+        alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> single;
+        Require(sceNetGetSockInfo6(socket, reinterpret_cast<NetSockInfo6*>(single.data()), 1, flags) == 1 && std::equal(single.begin(), single.end(), listed));
+        sockets.push_back(socket);
+    }
+    for (const int limit : {1, 2}) {
+        const int written = std::min(count, limit);
+        std::vector<std::uint8_t> limited(records.size(), 0xa5);
+        Require(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(limited.data()), limit, flags) == written);
+        Require(std::equal(limited.begin(), limited.begin() + written * 0xa0, records.begin()));
+        Require(std::all_of(limited.begin() + written * 0xa0, limited.end(), [](auto byte) { return byte == 0xa5; }));
+    }
+    return sockets;
+}
+
+static std::vector<int> WithSockets(std::vector<int> sockets, std::initializer_list<int> added) {
+    sockets.insert(sockets.end(), added);
+    std::sort(sockets.begin(), sockets.end());
+    return sockets;
+}
+
+static void CheckSockInfo6() {
+    const auto earlier = RequireSockInfo6List(0);
+    const auto earlierAll = RequireSockInfo6List(0x1000);
+    Require(RequireSockInfo6List(0x40) == earlier && RequireSockInfo6List(0x1040) == earlierAll);
+    Require(std::includes(earlierAll.begin(), earlierAll.end(), earlier.begin(), earlier.end()));
+
+    const std::array<std::uint8_t, 28> unnamed{};
+    const int datagram = sceNetSocket("sockinfo6-inet", 2, 2, 17);
+    Require(datagram >= 0);
+    std::array<std::uint8_t, 28> inetAddress{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(sceNetBind_nid_postfix(datagram, inetAddress.data(), 16) == 0);
+    std::uint32_t size = 16;
+    Require(sceNetGetsockname(datagram, inetAddress.data(), &size) == 0 && size == 16);
+    const int nonblocking = 1;
+    Require(sceNetSetsockopt(datagram, 0xffff, 0x1200, &nonblocking, sizeof(nonblocking)) == 0);
+    RequireSockInfo6(datagram, 2, false, true, inetAddress, unnamed, 0x1000);
+    RequireSockInfo6(datagram, 2, false, true, inetAddress, unnamed, 0x1040);
+
+    alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> record;
+    record.fill(0xa5);
+    const auto untouched = [&record] { return std::all_of(record.begin(), record.end(), [](auto byte) { return byte == 0xa5; }); };
+    Require(Failed(sceNetGetSockInfo6(datagram, nullptr, 1, 0x1000), 22));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 0, 0x1000), 22));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), -1, 0x1000), 22));
+    Require(Failed(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(record.data()), 0, 0), 22));
+    Require(Failed(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(record.data()), -5, 0x1000), 22));
+    for (const int flags : {1, 0x41, 0x80, 0x1001, 0x2000, 0x400000, 0x1048}) {
+        Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 22));
+        Require(Failed(sceNetGetSockInfo6(-1, nullptr, 0, flags), 22));
+        Require(Failed(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 22));
+    }
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0), 47));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0x40), 47));
+    Require(untouched());
+    const int closed = sceNetSocket("sockinfo6-closed", 2, 2, 17);
+    Require(closed >= 0 && sceNetSocketClose(closed) == 0);
+    for (const int flags : {0, 0x40, 0x1000, 0x1040}) {
+        Require(Failed(sceNetGetSockInfo6(closed, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 9));
+        Require(Failed(sceNetGetSockInfo6(INT32_MAX, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 9));
+    }
+    Require(untouched());
+    Require(RequireSockInfo6List(0) == earlier);
+    Require(RequireSockInfo6List(0x1000) == WithSockets(earlierAll, {datagram}));
+
+    if (ipv6Unavailable) {
+        Require(sceNetSocketClose(datagram) == 0);
+        Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0x1000), 9));
+        Require(RequireSockInfo6List(0x1000) == earlierAll);
+        return;
+    }
+
+    const int udp = sceNetSocket("sockinfo6-datagram", 28, 2, 17);
+    Require(udp >= 0);
+    RequireSockInfo6(udp, 2, true, false, unnamed, unnamed, 0);
+    std::array<std::uint8_t, 28> udpAddress{28, 28};
+    udpAddress[23] = 1;
+    Require(sceNetBind_nid_postfix(udp, udpAddress.data(), udpAddress.size()) == 0);
+    size = udpAddress.size();
+    Require(sceNetGetsockname(udp, udpAddress.data(), &size) == 0 && size == udpAddress.size());
+    Require(udpAddress[2] != 0 || udpAddress[3] != 0);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0x40);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0x1000);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0x1040);
+
+    const int listener = sceNetSocket("sockinfo6-listener", 28, 1, 6);
+    std::array<std::uint8_t, 28> listening{28, 28};
+    listening[23] = 1;
+    Require(listener >= 0 && sceNetBind_nid_postfix(listener, listening.data(), listening.size()) == 0 && sceNetListen(listener, 1) == 0);
+    size = listening.size();
+    Require(sceNetGetsockname(listener, listening.data(), &size) == 0 && size == listening.size());
+    RequireSockInfo6(listener, 1, true, false, listening, unnamed, 0);
+    const int client = sceNetSocket("sockinfo6-client", 28, 1, 6);
+    Require(client >= 0 && sceNetConnect(client, listening.data(), listening.size()) == 0);
+    const int accepted = sceNetAccept(listener, nullptr, nullptr);
+    Require(accepted >= 0);
+    std::array<std::uint8_t, 28> clientAddress{};
+    size = clientAddress.size();
+    Require(sceNetGetsockname(client, clientAddress.data(), &size) == 0 && size == clientAddress.size());
+    Require(clientAddress[2] != 0 || clientAddress[3] != 0);
+    RequireSockInfo6(client, 1, true, false, clientAddress, listening, 0);
+    RequireSockInfo6(accepted, 1, true, false, listening, clientAddress, 0);
+
+    const int peer = sceNetSocket("sockinfo6-peer", 28, 2, 17);
+    std::array<std::uint8_t, 28> peerAddress{28, 28};
+    peerAddress[23] = 1;
+    Require(peer >= 0 && sceNetBind_nid_postfix(peer, peerAddress.data(), peerAddress.size()) == 0);
+    size = peerAddress.size();
+    Require(sceNetGetsockname(peer, peerAddress.data(), &size) == 0 && size == peerAddress.size());
+    Require(sceNetConnect(peer, udpAddress.data(), udpAddress.size()) == 0);
+    RequireSockInfo6(peer, 2, true, false, peerAddress, udpAddress, 0);
+    const std::array<int, 2> buffers{65536, 32768};
+    Require(sceNetSetsockopt(peer, 0xffff, 0x1200, &nonblocking, sizeof(nonblocking)) == 0);
+    Require(sceNetSetsockopt(peer, 0xffff, 0x1002, &buffers[0], sizeof(buffers[0])) == 0);
+    Require(sceNetSetsockopt(peer, 0xffff, 0x1001, &buffers[1], sizeof(buffers[1])) == 0);
+    const auto configured = RequireSockInfo6(peer, 2, true, true, peerAddress, udpAddress, 0);
+    Require(std::memcmp(configured.data() + 0x64, buffers.data(), sizeof(buffers)) == 0);
+    Require(std::all_of(configured.begin() + 0x34, configured.begin() + 0x3c, [](auto byte) { return byte == 0; }));
+    Require(sceNetGetSockInfo6(peer, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0x1040) == 1 && std::equal(configured.begin(), configured.end(), record.begin()));
+
+    Require(RequireSockInfo6List(0) == WithSockets(earlier, {udp, listener, client, accepted, peer}));
+    Require(RequireSockInfo6List(0x40) == WithSockets(earlier, {udp, listener, client, accepted, peer}));
+    Require(RequireSockInfo6List(0x1000) == WithSockets(earlierAll, {datagram, udp, listener, client, accepted, peer}));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0), 47));
+
+    for (const int descriptor : {peer, accepted, client, listener, udp}) Require(sceNetSocketClose(descriptor) == 0);
+    Require(Failed(sceNetGetSockInfo6(udp, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0), 9));
+    Require(RequireSockInfo6List(0) == earlier);
+    Require(sceNetSocketClose(datagram) == 0);
+    Require(RequireSockInfo6List(0x1000) == earlierAll);
+}
+
 static void CheckDatagramDisconnect() {
     const int peer = sceNetSocket("disconnect-peer", 2, 2, 17);
     const int other = sceNetSocket("disconnect-other", 2, 2, 17);
@@ -1677,10 +1898,16 @@ int main() {
     CheckNetMemory();
     CheckNetstat();
     CheckEmptyEpoll();
+    CheckRejectedArguments();
     CheckDontWait();
     CheckAddressText(2, "127.0.0.1");
     CheckAddressText(2, "255.255.255.255");
     CheckAddressText(28, "::1");
+    CheckAddressText(28, "::ffff:0.0.0.1");
+    CheckAddressText(28, "::ffff:0:102:304");
+    CheckAddressText(28, "fe80::5efe:102:304");
+    CheckRejectedAddressText("::01.2.3.4");
+    CheckRejectedAddressText("::ffff:01.2.3.4");
     CheckAddressText(28, "1234:5678:9abc:def0:1234:5678:9abc:def0");
     CheckInetPtonWhitespace();
     CheckInetPtonExParts();
@@ -1688,6 +1915,7 @@ int main() {
     CheckUsleep();
     CheckSystemTime();
     CheckEpollIdent();
+    CheckEpollClosedStream();
     CheckTcpNoDelay();
     CheckLinkLocalAllNodesIpv6();
     CheckUnboundSocketName();
@@ -1705,6 +1933,7 @@ int main() {
     CheckDatagramDisconnect();
     CheckCloseKernelSocket();
     CheckSockInfo();
+    CheckSockInfo6();
 
     const int closed = sceNetSocket("closed-by-kernel", 2, 2, 17);
     Require(closed >= 0);
@@ -1863,12 +2092,12 @@ int main() {
     Require(select_nid_postfix(std::max(kernel_socket, udp_sender) + 1, nullptr, mixed_writable, nullptr, wait_second) == 2);
     Require(((mixed_writable[kernel_socket / 64] >> (kernel_socket % 64)) & 1u) != 0);
     Require(((mixed_writable[udp_sender / 64] >> (udp_sender % 64)) & 1u) != 0);
-    GuestPollEntry net_read{udp_receiver, 1, 0};
+    GuestPollDescriptor net_read{udp_receiver, 1, 0};
     Require(poll_nid_postfix(&net_read, 1, 0) == 0 && net_read.revents == 0);
     Require(sceNetSendto(udp_sender, datagram, sizeof(datagram), 0, address.data(), address.size()) == sizeof(datagram));
     Require(poll_nid_postfix(&net_read, 1, 1000) == 1 && net_read.revents == 1);
     Require(sceNetRecvfrom(udp_receiver, datagram_result, sizeof(datagram_result), 0, nullptr, nullptr) == sizeof(datagram_result));
-    GuestPollEntry mixed_poll[2]{{kernel_socket, 4, 0}, {udp_sender, 4, 0}};
+    GuestPollDescriptor mixed_poll[2]{{kernel_socket, 4, 0}, {udp_sender, 4, 0}};
     Require(poll_nid_postfix(mixed_poll, 2, 1000) == 2 && mixed_poll[0].revents == 4 && mixed_poll[1].revents == 4);
     Require(close_nid_postfix(kernel_socket) == 0);
     std::uint64_t stdio_readable[16]{1};
@@ -1915,9 +2144,9 @@ int main() {
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == static_cast<int>(0x804101E1));
     Require(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, 0) == 0);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
-    std::array<std::uint8_t, 512> records{};
+    alignas(NetResolverInfo) std::array<std::uint8_t, 512> records{};
     records.fill(0xA5);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) == 0);
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) == 0);
     std::int32_t record_family = 0;
     std::int32_t record_count = 0;
     std::int32_t record_count4 = 0;
@@ -1935,37 +2164,37 @@ int main() {
         }
     }
     const auto resolved = records;
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, nullptr, records.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, nullptr, reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22 && records == resolved);
     Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", nullptr, 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22);
     {
         ScopedResolverLookupOverride lookupOverride(FailResolverLookup);
-        Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "guest-sce-net.invalid.", records.data(), 5000000, 1, 0) ==
+        Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "guest-sce-net.invalid.", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
             static_cast<int>(0x804101E1));
     }
     Require(records == resolvedRecords);
 
-    std::array<std::uint8_t, 512> plain{};
+    alignas(NetResolverInfo) std::array<std::uint8_t, 512> plain{};
     plain.fill(0xA5);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) == 0);
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) == 0);
     Require(plain == resolved);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, nullptr, plain.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, nullptr, reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22 && plain == resolved);
     Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", nullptr, 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22);
     const auto resolvedPlain = plain;
     {
         ScopedResolverLookupOverride lookupOverride(FailResolverLookup);
-        Require(sceNetResolverStartNtoaMultipleRecords(resolver, "guest-sce-net.invalid", plain.data(), 5000000, 1, 0) ==
+        Require(sceNetResolverStartNtoaMultipleRecords(resolver, "guest-sce-net.invalid", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
             static_cast<int>(0x804101E1));
     }
     Require(plain == resolvedPlain);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == static_cast<int>(0x804101E1));
     for (const int flags : {0x1, 0x10000}) {
         bool threw = false;
-        try { sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, flags); }
+        try { sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, flags); }
         catch (const std::runtime_error&) { threw = true; }
         Require(threw && plain == resolved);
     }
@@ -1989,11 +2218,11 @@ int main() {
     Require(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, 0) == 0 && ipv4[0] == 127);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
     Require(sceNetResolverAbort(resolver, 1) == 0);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) == 0 && plain == resolved);
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) == 0 && plain == resolved);
     Require(sceNetResolverAbort(resolver, 2) == 0);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) == 0 && records == resolved);
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) == 0 && records == resolved);
     std::memset(reverse, 0x5A, sizeof(reverse));
     Require(sceNetResolverStartAton(resolver, loopback.data(), reverse, sizeof(reverse), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4 && reverse[0] == 0x5A);
@@ -2002,7 +2231,7 @@ int main() {
     Require(sceNetResolverAbort(resolver, 3) == 0);
     Require(sceNetResolverStartAton(resolver, loopback.data(), reverse, sizeof(reverse), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4 && records == resolved);
     Require(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, 0) == 0);
     for (const int flags : {0x4, -1}) {
@@ -2062,7 +2291,7 @@ int main() {
     const int other = sceNetResolverCreate("guest-sce-net-other", 0, 0);
     Require(other >= 0 && other != resolver);
     Require(sceNetResolverAbort(other, 3) == 0);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) == 0);
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) == 0);
     Require(sceNetResolverDestroy(other) == 0);
     Require(sceNetResolverAbort(other, 0) == static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9);
     Require(sceNetResolverAbort(-1, 1) == static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9);
@@ -2079,9 +2308,9 @@ int main() {
     resolver_error = -1;
     Require(sceNetResolverGetError(resolver, &resolver_error) == static_cast<int>(0x80410109) &&
         *sceNetErrnoLoc() == 9 && resolver_error == -1);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9 && records == resolved);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9 && plain == resolved);
     Require(sceNetResolverAbort(resolver, 1) == static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9);
 
@@ -2118,7 +2347,7 @@ int main() {
     {
         std::array<std::uint32_t, 3> dns{};
         dns.fill(0xA5A5A5A5u);
-        const int count = sceNetGetDnsInfo(dns.data(), 0);
+        const int count = sceNetGetDnsInfo(reinterpret_cast<NetDnsInfo*>(dns.data()), 0);
         Require(count >= 0 && count <= 2 && dns[2] == 0xA5A5A5A5u);
         Require(count == 0 || state == 3);
         for (int index = count; index < 2; ++index) Require(dns[index] == 0);
@@ -2135,13 +2364,11 @@ int main() {
             Require(std::strcmp(text, reinterpret_cast<const char*>(info.opaque)) == 0);
         }
         for (const int flags : {0x1, -1}) {
-            bool threw = false;
-            try { sceNetGetDnsInfo(dns.data(), flags); } catch (const std::runtime_error&) { threw = true; }
-            Require(threw);
+            const auto before = dns;
+            Require(Failed(sceNetGetDnsInfo(reinterpret_cast<NetDnsInfo*>(dns.data()), flags), 22));
+            Require(dns == before);
         }
-        bool threw = false;
-        try { sceNetGetDnsInfo(nullptr, 0); } catch (const std::runtime_error&) { threw = true; }
-        Require(threw);
+        Require(Failed(sceNetGetDnsInfo(nullptr, 0), 22));
     }
     NetCtlIfStat first{};
     first.device = 7;
@@ -2194,6 +2421,46 @@ int main() {
         }
         Require(sceNetCtlUnregisterCallbackV6(0) == 0);
     }
+    {
+        int cid = -1;
+        Require(sceNetCtlRegisterCallbackForNpToolkit(nullptr, nullptr, &cid) == static_cast<int>(0x80412107));
+        Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, nullptr) == static_cast<int>(0x80412107));
+        int cids[8] = {};
+        for (int i = 0; i < 8; ++i) {
+            Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, &cids[i]) == 0);
+            Require(cids[i] == i);
+        }
+        Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, &cid) == static_cast<int>(0x80412103));
+        Require(sceNetCtlRegisterCallback(IgnoreNetCtlEvent, nullptr, &cid) == 0 && cid == 0);
+        Require(sceNetCtlUnregisterCallback(0) == 0);
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(-1) == static_cast<int>(0x80412105));
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(8) == static_cast<int>(0x80412105));
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(3) == 0);
+        Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, &cid) == 0);
+        Require(cid == 3);
+        for (int i = 0; i < 8; ++i) {
+            Require(sceNetCtlUnregisterCallbackForNpToolkit(i) == 0);
+        }
+
+        NetCtlEventRecord toolkit;
+        NetCtlEventRecord plain;
+        Require(sceNetCtlRegisterCallbackForNpToolkit(RecordNetCtlEvent, &toolkit, &cid) == 0 && cid == 0);
+        Require(sceNetCtlCheckCallback() == 0 && toolkit.calls == 0);
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0);
+        Require(toolkit.calls == 1 && toolkit.arg == &toolkit && (toolkit.event == 1 || toolkit.event == 3));
+        int current = -1;
+        Require(sceNetCtlGetState(&current) == 0 && toolkit.event == (current == 3 ? 3 : 1));
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0 && toolkit.calls == 1);
+        int plainCid = -1;
+        Require(sceNetCtlRegisterCallback(RecordNetCtlEvent, &plain, &plainCid) == 0);
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0 && plain.calls == 0);
+        Require(sceNetCtlCheckCallback() == 0 && plain.calls == 1 && toolkit.calls == 1);
+        Require(sceNetCtlUnregisterCallback(plainCid) == 0);
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(cid) == 0);
+        Require(sceNetCtlRegisterCallbackForNpToolkit(RecordNetCtlEvent, &toolkit, &cid) == 0);
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0 && toolkit.calls == 2);
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(cid) == 0);
+    }
     if (ipv6Unavailable) {
         std::puts("skipped the IPv6 socket checks, the host has no usable IPv6 loopback");
         return 77;
diff --git a/core/libs/tests/GuestSceV2Exceptions.S b/core/libs/tests/GuestSceV2Exceptions.S
new file mode 100644
index 0000000000..8b076dc726
--- /dev/null
+++ b/core/libs/tests/GuestSceV2Exceptions.S
@@ -0,0 +1,72 @@
+.cfi_sections .eh_frame
+.text
+.globl SceV2Catch
+SceV2Catch:
+    .cfi_startproc
+#ifdef _WIN32
+    .cfi_personality 0x00, __gxx_personality_v0_nid_postfix
+    .cfi_lsda 0x00, .Lcatch_lsda
+#else
+    .cfi_personality 0x9b, .Lcatch_personality
+    .cfi_lsda 0x1b, .Lcatch_lsda
+#endif
+    pushq %rbp
+    .cfi_def_cfa_offset 16
+    .cfi_offset %rbp, -16
+    movq %rsp, %rbp
+    .cfi_def_cfa_register %rbp
+    subq $16, %rsp
+    movq %rdi, %rax
+    movq %rsi, %rdi
+.Lcatch_call:
+    call *%rax
+.Lcatch_call_end:
+    ud2
+.Lcatch_landing:
+    movl %edx, SceV2Selector(%rip)
+    movq %rax, %rdi
+    call __cxa_begin_catch_nid_postfix
+    movq %rax, %rdi
+    call SceV2Inspect
+    call __cxa_end_catch_nid_postfix
+    leave
+    .cfi_def_cfa %rsp, 8
+    ret
+    .cfi_endproc
+#ifdef _WIN32
+.section .rdata,"dr"
+#else
+.section .data.rel.ro,"aw",@progbits
+.p2align 3
+.Lcatch_personality:
+    .quad __gxx_personality_v0_nid_postfix
+.section .rodata
+#endif
+.Lcatch_lsda:
+#ifdef _WIN32
+    .byte 0xff, 0x80
+#else
+    .byte 0xff, 0x9b
+#endif
+    .uleb128 .Lcatch_types_end-.Lcatch_types_offset
+.Lcatch_types_offset:
+    .byte 0x01
+    .uleb128 .Lcatch_calls_end-.Lcatch_calls
+.Lcatch_calls:
+    .uleb128 .Lcatch_call-SceV2Catch
+    .uleb128 .Lcatch_call_end-.Lcatch_call
+    .uleb128 .Lcatch_landing-SceV2Catch
+    .uleb128 1
+.Lcatch_calls_end:
+    .byte 1, 1, 2, 0
+#ifdef _WIN32
+    .quad SceV2CatchType
+    .quad SceV2OtherType
+#else
+    .long SceV2CatchType-.
+    .long SceV2OtherType-.
+#endif
+.Lcatch_types_end:
+#ifndef _WIN32
+.section .note.GNU-stack,"",@progbits
+#endif
diff --git a/core/libs/tests/GuestSceV2Exceptions.cpp b/core/libs/tests/GuestSceV2Exceptions.cpp
new file mode 100644
index 0000000000..6683c8d67b
--- /dev/null
+++ b/core/libs/tests/GuestSceV2Exceptions.cpp
@@ -0,0 +1,192 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
+static_assert(sizeof(LibcException::ExceptionObject) == 16 && sizeof(LibcException::SystemErrorObject) == 32);
+
+using GuestWhat = const char* (APS5_VABI *)(const LibcException::ExceptionObject*);
+using Thrower = void (APS5_VABI *)(const void*);
+
+extern "C" {
+extern const TypeRecord _ZTISt9exception_nid_postfix;
+extern const TypeRecord _ZTISt9bad_alloc_nid_postfix;
+extern const TypeRecord _ZTISt12length_error_nid_postfix;
+extern const TypeRecord _ZTISt12system_error_nid_postfix;
+extern const TypeRecord _ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix;
+
+void APS5_VABI SceV2Catch(Thrower thrower, const void* argument);
+
+const void* SceV2CatchType = nullptr;
+const void* SceV2OtherType = nullptr;
+int SceV2Selector = 0;
+const void* SceV2Caught = nullptr;
+}
+
+static unsigned failures = 0;
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "FAIL: %s\n", what);
+    ++failures;
+}
+
+static const TypeRecord* TypeOf(const LibcException::ExceptionObject* object) {
+    return static_cast<const TypeRecord*>(static_cast<const void* const*>(object->vtable)[-1]);
+}
+
+static const char* What(const LibcException::ExceptionObject* object) {
+    return reinterpret_cast<GuestWhat>(const_cast<void*>(static_cast<const void* const*>(object->vtable)[2]))(object);
+}
+
+static TypeRecord Named(const char* name) {
+    return {_ZTISt9exception_nid_postfix.vtable, name, nullptr};
+}
+
+static char inspected[256];
+static std::size_t inspectBytes = sizeof(LibcException::ExceptionObject);
+static LibcException::SystemErrorObject inspectedSystem {};
+
+extern "C" void APS5_VABI SceV2Inspect(void* object) {
+    const auto* exception = static_cast<const LibcException::ExceptionObject*>(object);
+    std::snprintf(inspected, sizeof(inspected), "%s|%s", TypeOf(exception)->name, What(exception));
+    std::memcpy(&inspectedSystem, object, inspectBytes);
+}
+
+struct Case { const char* label; Thrower thrower; const void* argument; const void* catchType; const void* otherType; int selector; const char* expected; };
+
+static void Run(const Case& test) {
+    SceV2CatchType = test.catchType;
+    SceV2OtherType = test.otherType;
+    SceV2Selector = 0;
+    inspected[0] = 0;
+    SceV2Catch(test.thrower, test.argument);
+    Require(SceV2Selector == test.selector, test.label);
+    if (std::strcmp(inspected, test.expected) != 0) {
+        std::fprintf(stderr, "  %s: got '%s', want '%s'\n", test.label, inspected, test.expected);
+        ++failures;
+    }
+}
+
+template<class TFunction>
+static Thrower AsThrower(TFunction function) {
+    return reinterpret_cast<Thrower>(function);
+}
+
+static void CheckThrowers() {
+    const TypeRecord logicError = Named("NSt8__sce_v211logic_errorE");
+    const TypeRecord runtimeError = Named("NSt8__sce_v213runtime_errorE");
+    const TypeRecord lengthError = Named("NSt8__sce_v212length_errorE");
+    const TypeRecord systemError = Named("NSt8__sce_v212system_errorE");
+    const TypeRecord unrelated = Named("NSt8__sce_v211range_errorE");
+    const void* exception = &_ZTISt9exception_nid_postfix;
+    const void* errorException = &_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix;
+    const Case cases[] {
+        {"_Xlength_error", AsThrower(_ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix), "length", &logicError, &unrelated, 2,
+            "NSt8__sce_v212length_errorE|length"},
+        {"_Xlength_error is not std::length_error", AsThrower(_ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix), "length", &lengthError, &_ZTISt12length_error_nid_postfix, 2,
+            "NSt8__sce_v212length_errorE|length"},
+        {"_Xout_of_range", AsThrower(_ZNSt8__sce_v214_Xout_of_rangeEPKc_nid_postfix), "range", errorException, &runtimeError, 2,
+            "NSt8__sce_v212out_of_rangeE|range"},
+        {"_Xinvalid_argument", AsThrower(_ZNSt8__sce_v218_Xinvalid_argumentEPKc_nid_postfix), "argument", &logicError, &runtimeError, 2,
+            "NSt8__sce_v216invalid_argumentE|argument"},
+        {"_Xruntime_error", AsThrower(_ZNSt8__sce_v215_Xruntime_errorEPKc_nid_postfix), "runtime", &runtimeError, &logicError, 2,
+            "NSt8__sce_v213runtime_errorE|runtime"},
+        {"_Xoverflow_error", AsThrower(_ZNSt8__sce_v216_Xoverflow_errorEPKc_nid_postfix), nullptr, exception, &logicError, 2,
+            "NSt8__sce_v214overflow_errorE|"},
+        {"_Xbad_alloc", AsThrower(_ZNSt8__sce_v211_Xbad_allocEv_nid_postfix), nullptr, &_ZTISt9bad_alloc_nid_postfix, errorException, 2,
+            "St9bad_alloc|std::bad_alloc"},
+        {"_Xbad_function_call", AsThrower(_ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v217bad_function_callE|bad function call"},
+        {"_Throw(bad_optional_access)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_19bad_optional_accessE_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v219bad_optional_accessE|Bad optional access"},
+        {"_Throw(bad_weak_ptr)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_12bad_weak_ptrE_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v212bad_weak_ptrE|bad_weak_ptr"},
+        {"_Throw(bad_variant_access)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_18bad_variant_accessE_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v218bad_variant_accessE|bad variant access"},
+        {"_Throw_Cpp_error", AsThrower(_ZNSt8__sce_v216_Throw_Cpp_errorEi_nid_postfix), reinterpret_cast<const void*>(1), &systemError, &_ZTISt12system_error_nid_postfix, 2,
+            "NSt8__sce_v212system_errorE|invalid argument: invalid argument"},
+    };
+    inspectBytes = sizeof(void*);
+    for (const auto& test : cases) Run(test);
+    inspectBytes = sizeof(LibcException::ExceptionObject);
+}
+
+static void CheckCopies() {
+    const TypeRecord runtimeError = Named("NSt8__sce_v213runtime_errorE");
+    const TypeRecord systemError = Named("NSt8__sce_v212system_errorE");
+    const TypeRecord logicError = Named("NSt8__sce_v211logic_errorE");
+
+    LibcException::ExceptionObject range {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(&range, "range copy");
+    Run({"_Throw(range_error)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_11range_errorE_nid_postfix), &range, &runtimeError, &logicError, 2,
+        "NSt8__sce_v211range_errorE|range copy"});
+    Require(inspectedSystem.base.message == range.message, "_Throw(range_error) shares the message");
+    _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(&range);
+
+    LibcException::SystemErrorObject error {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(&error.base, "system copy");
+    error.code = {0, 5, _ZSt16generic_categoryv_nid_postfix()};
+    inspectBytes = sizeof(LibcException::SystemErrorObject);
+    SceV2CatchType = &runtimeError;
+    SceV2OtherType = &logicError;
+    SceV2Catch(AsThrower(_ZNSt8__sce_v26_ThrowERKNS_12system_errorE_nid_postfix), &error);
+    Require(std::strcmp(inspected, "NSt8__sce_v212system_errorE|system copy") == 0, "_Throw(system_error) type and message");
+    Require(inspectedSystem.code.value == 5, "_Throw(system_error) copies the code value");
+    Require(inspectedSystem.code.category == error.code.category, "_Throw(system_error) copies the category");
+
+    SceV2CatchType = &systemError;
+    SceV2Catch(AsThrower(_ZNSt8__sce_v28ios_base6_ThrowERKNS0_7failureE_nid_postfix), &error);
+    Require(std::strcmp(inspected, "NSt8__sce_v28ios_base7failureE|system copy") == 0, "ios_base::_Throw(failure) type and message");
+    Require(inspectedSystem.code.value == 5, "ios_base::_Throw(failure) copies the code");
+    inspectBytes = sizeof(LibcException::ExceptionObject);
+    _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(&error.base);
+}
+
+static void CheckErrorException() {
+    LibcException::ExceptionObject empty {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC1EPKc_nid_postfix(&empty, nullptr);
+    Require(std::strcmp(_ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(&empty), "") == 0, "_Error_exception(nullptr) has an empty message");
+    Require(std::strcmp(TypeOf(&empty)->name, "NSt13__sce_cxxvers16_Error_exceptionE") == 0, "_Error_exception type name");
+    Require(TypeOf(&empty)->base == &_ZTISt9exception_nid_postfix, "_Error_exception derives from std::exception");
+
+    LibcException::ExceptionObject text {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(&text, "text");
+    LibcException::ExceptionObject copy {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC1ERKS0__nid_postfix(&copy, &text);
+    Require(std::strcmp(_ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(&copy), "text") == 0, "_Error_exception copy keeps the message");
+    _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(&text);
+    Require(std::strcmp(_ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(&copy), "text") == 0, "_Error_exception copy outlives the source");
+    _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(&copy);
+    _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(&empty);
+}
+
+static void CheckSyserrorMap() {
+    Require(std::strcmp(_ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(0), "success") == 0, "_Syserror_map(0)");
+    Require(_ZSt13_Syserror_mapi_nid_postfix(0) == nullptr, "unversioned _Syserror_map(0) stays null");
+    Require(std::strcmp(_ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(2), _ZSt13_Syserror_mapi_nid_postfix(2)) == 0, "_Syserror_map(2) matches the unversioned text");
+    Require(std::strcmp(_ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(99999), "unknown error") == 0, "_Syserror_map(unknown)");
+    Require(_ZSt13_Syserror_mapi_nid_postfix(99999) == nullptr, "unversioned _Syserror_map(unknown) stays null");
+}
+
+static void CheckTicks() {
+    const auto before = _Xtime_get_ticks_nid_postfix();
+    const auto ticks = _ZNSt8__sce_v216_Xtime_get_ticksEv_nid_postfix();
+    const auto after = _Xtime_get_ticks_nid_postfix();
+    Require(before <= ticks && ticks <= after, "_Xtime_get_ticks is the unversioned clock");
+}
+
+int main() {
+    CheckErrorException();
+    CheckThrowers();
+    CheckCopies();
+    CheckSyserrorMap();
+    CheckTicks();
+    if (failures) return 1;
+    std::puts("guest std::__sce_v2 exceptions: PASS");
+    return 0;
+}
diff --git a/core/libs/tests/GuestSchedPriority.cpp b/core/libs/tests/GuestSchedPriority.cpp
index 0b15d2becd..34e03f1f99 100644
--- a/core/libs/tests/GuestSchedPriority.cpp
+++ b/core/libs/tests/GuestSchedPriority.cpp
@@ -1,29 +1,15 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 #include <ctime>
-extern "C" int* APS5_VABI __error_nid_postfix();
+
 extern "C" {
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-int APS5_VABI sched_get_priority_min_nid_postfix(int policy);
-int APS5_VABI getpriority_nid_postfix(int which, int who);
-int APS5_VABI setpriority_nid_postfix(int which, int who, int niceval);
-struct GuestRtPrio {
-    std::uint16_t type;
-    std::uint16_t prio;
-};
-int APS5_VABI rtprio_thread_nid_postfix(int function, int lwpid, GuestRtPrio* priority);
-int APS5_VABI pthread_setconcurrency_nid_postfix(int newLevel);
-int APS5_VABI pthread_getconcurrency_nid_postfix(void);
-struct GuestTimespec {
-    std::int64_t tv_sec;
-    std::int64_t tv_nsec;
-};
-int APS5_VABI sched_rr_get_interval_nid_postfix(int pid, GuestTimespec* interval);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
+
 }
 static constexpr int PrioProcess = 0;
 static constexpr int PrioGroup = 1;
@@ -54,7 +40,7 @@ static void RequireSetError(int which, int who, int nice, int error) {
 int main() {
     Require(Rejects(-1) && Rejects(2) && Rejects(5));
     const int self = getpid_nid_postfix();
-    GuestTimespec interval{};
+    KernelTimespec interval{};
     *__error_nid_postfix() = 13;
     Require(sched_rr_get_interval_nid_postfix(0, &interval) == 0 && interval.tv_sec == 0 && interval.tv_nsec == 94000000 && *__error_nid_postfix() == 13);
     interval.tv_sec = -1;
@@ -100,14 +86,12 @@ int main() {
     Require(setpriority_nid_postfix(PrioProcess, 0, -99) == 0 && getpriority_nid_postfix(PrioProcess, 0) == -20);
     Require(setpriority_nid_postfix(PrioProcess, 0, 0) == 0 && getpriority_nid_postfix(PrioProcess, 0) == 0);
     GuestRtPrio rtprio{7, 7};
+    Require(rtprio_thread_nid_postfix(0, 0, &rtprio) == 0 && rtprio.type == 10 && rtprio.prio == 700);
     bool rtprioThrew = false;
-    try { rtprio_thread_nid_postfix(0, 0, &rtprio); } catch (const std::exception&) { rtprioThrew = true; }
-    Require(rtprioThrew);
-    rtprioThrew = false;
     try { rtprio_thread_nid_postfix(1, 0, &rtprio); } catch (const std::exception&) { rtprioThrew = true; }
     Require(rtprioThrew);
     *__error_nid_postfix() = 0;
-    Require(rtprio_thread_nid_postfix(2, 0, &rtprio) == -1 && *__error_nid_postfix() == 22);
+    Require(rtprio_thread_nid_postfix(2, 0, &rtprio) == -1 && *__error_nid_postfix() == 3);
     *__error_nid_postfix() = 0;
     Require(rtprio_thread_nid_postfix(0, 0, nullptr) == -1 && *__error_nid_postfix() == 14);
     *__error_nid_postfix() = 0;
diff --git a/core/libs/tests/GuestScreenShot.cpp b/core/libs/tests/GuestScreenShot.cpp
index 836b70da94..fe9a121fed 100644
--- a/core/libs/tests/GuestScreenShot.cpp
+++ b/core/libs/tests/GuestScreenShot.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceScreenShot/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "SceTypes.hpp"
 #include <array>
@@ -11,16 +12,6 @@
 #include <random>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceScreenShotDisable();
-int APS5_VABI sceScreenShotEnable();
-int APS5_VABI sceScreenShotIsDisabled(int id, int* isDisabled);
-int APS5_VABI sceScreenShotDisableNotification();
-int APS5_VABI sceScreenShotEnableNotification();
-int APS5_VABI sceScreenShotSetOverlayImage(const char* path, int offsetX, int offsetY);
-int APS5_VABI sceScreenShotSetOverlayImageWithOrigin(const char* path, int offsetX, int offsetY, int origin);
-}
-
 namespace {
 
 constexpr int ErrorArgument = static_cast<int>(0x80BE0001);
diff --git a/core/libs/tests/GuestSearch.cpp b/core/libs/tests/GuestSearch.cpp
index f1572c3640..55d2862aba 100644
--- a/core/libs/tests/GuestSearch.cpp
+++ b/core/libs/tests/GuestSearch.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdlib>
@@ -7,7 +8,7 @@
 #include <cstdio>
 #include <source_location>
 using Comparator = int (APS5_VABI *)(const void*, const void*);
-extern "C" void* APS5_VABI bsearch_nid_postfix(const void*, const void*, std::size_t, std::size_t, Comparator);
+
 static void Require(bool value, std::source_location location = std::source_location::current()) {
     if (!value) { std::fprintf(stderr, "Guest search failed at line %u\n", location.line()); std::abort(); }
 }
diff --git a/core/libs/tests/GuestSelect.cpp b/core/libs/tests/GuestSelect.cpp
index 979415e15d..1c1f48d9dd 100644
--- a/core/libs/tests/GuestSelect.cpp
+++ b/core/libs/tests/GuestSelect.cpp
@@ -1,8 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <chrono>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <string>
 #include <thread>
@@ -24,25 +27,6 @@ struct GuestDescriptorSet {
     }
 };
 
-extern "C" {
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI kqueue_nid_postfix();
-int APS5_VABI kevent_nid_postfix(int, const KernelEvent*, int, KernelEvent*, int, const KernelTimespec*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int GuestEbadf = 9;
@@ -72,6 +56,30 @@ static KernelEvent UserEvent(std::uint16_t flags, std::uint32_t fflags) {
     return change;
 }
 
+static void StandardDescriptorFile(int descriptor) {
+    const int saved = dup_nid_postfix(descriptor);
+    const std::string path = "anyps5-select-input-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const int file = open_nid_postfix(path.c_str(), 0x0002 | 0x0200, 0644);
+    Require(file >= 0);
+    Require(dup2_nid_postfix(file, descriptor) == descriptor);
+    if (file != descriptor) Require(close_nid_postfix(file) == 0);
+    GuestDescriptorSet read{};
+    GuestDescriptorSet write{};
+    GuestDescriptorSet except{};
+    const GuestTimeval zero{0, 0};
+    const int ready = SelectAll(descriptor, read, write, except, zero);
+    if (ready != 2) std::fprintf(stderr, "select on a regular file at descriptor %d returned %d instead of 2\n", descriptor, ready);
+    Require(ready == 2);
+    Require(read.Has(descriptor) && write.Has(descriptor) && !except.Has(descriptor));
+    char byte = 0;
+    Require(read_nid_postfix(descriptor, &byte, 1) == 0);
+    if (saved >= 0) {
+        Require(dup2_nid_postfix(saved, descriptor) == descriptor);
+        Require(close_nid_postfix(saved) == 0);
+    } else Require(close_nid_postfix(descriptor) == 0);
+    Require(unlink_nid_postfix(path.c_str()) == 0);
+}
+
 static void Kqueues() {
     const int kq = kqueue_nid_postfix();
     Require(kq >= 0 && kq < GuestDescriptorLimit);
@@ -102,6 +110,7 @@ static void Kqueues() {
 }
 
 int main() {
+    for (const int descriptor : {0, 1, 2}) StandardDescriptorFile(descriptor);
     Kqueues();
 
     int descriptors[2]{-1, -1};
@@ -202,14 +211,43 @@ int main() {
         Require(read.Has(reader) && write.Has(writer));
     }
 
+    Require(reader < 63);
+
+    {
+        GuestDescriptorSet read{};
+        GuestDescriptorSet except{};
+        read.Add(reader);
+        read.Add(63);
+        read.Add(64);
+        except.Add(63);
+        GuestTimeval limit{0, 100000};
+        Require(select_nid_postfix(reader, read.words.data(), nullptr, except.words.data(), &limit) == 0);
+        Require(!read.Has(reader) && !read.Has(63) && read.Has(64) && !except.Has(63));
+    }
+
     {
         GuestDescriptorSet read{};
         read.Add(reader);
-        GuestTimeval limit{0, 100000};
-        Require(select_nid_postfix(reader, read.words.data(), nullptr, nullptr, &limit) == 0);
+        const GuestTimeval zero{0, 0};
+        Require(select_nid_postfix(0, read.words.data(), nullptr, nullptr, &zero) == 0);
         Require(read.Has(reader));
     }
 
+    {
+        const char byte = 'n';
+        Require(write_nid_postfix(writer, &byte, 1) == 1);
+        GuestDescriptorSet read{};
+        read.Add(reader);
+        read.Add(63);
+        read.Add(64);
+        GuestTimeval limit{0, 200000};
+        Require(select_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, &limit) == 1);
+        Require(read.Has(reader) && !read.Has(63) && read.Has(64));
+        char buffer[8]{};
+        const auto count = read_nid_postfix(reader, buffer, sizeof(buffer));
+        Require(count >= 1 && buffer[count - 1] == byte);
+    }
+
     {
         GuestDescriptorSet read{};
         read.Add(reader);
diff --git a/core/libs/tests/GuestSelectWait.cpp b/core/libs/tests/GuestSelectWait.cpp
index a21b7b320a..e5dd072cd4 100644
--- a/core/libs/tests/GuestSelectWait.cpp
+++ b/core/libs/tests/GuestSelectWait.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <chrono>
@@ -10,11 +12,6 @@ struct GuestTimeval {
     std::int64_t microseconds;
 };
 
-extern "C" {
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -56,14 +53,17 @@ int main() {
     }
     std::array<std::uint64_t, 16> read{};
     read[0] = 1 | (std::uint64_t{1} << 63);
+    read[1] = 1;
     const GuestTimeval limit{0, 500};
     const auto start = Clock::now();
     Require(select_nid_postfix(1, read.data(), nullptr, nullptr, &limit) == 0,
         "select with no ready device did not time out");
     Require(Clock::now() - start >= std::chrono::microseconds(limit.microseconds),
         "select with no ready device returned before its deadline");
-    Require(read[0] == (std::uint64_t{1} << 63),
-        "select did not preserve bits outside the descriptor limit");
+    Require(read[0] == 0,
+        "select did not clear the bits up to the end of the last copied word");
+    Require(read[1] == 1,
+        "select did not preserve the words past the descriptor limit");
     std::array<std::uint64_t, 16> write{};
     write[0] = 2;
     const GuestTimeval longLimit{1, 0};
diff --git a/core/libs/tests/GuestSemCanceledWake.cpp b/core/libs/tests/GuestSemCanceledWake.cpp
index 526888bcb0..8bf56c413a 100644
--- a/core/libs/tests/GuestSemCanceledWake.cpp
+++ b/core/libs/tests/GuestSemCanceledWake.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include <atomic>
@@ -6,19 +7,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI scePthreadCancel(Pthread);
-int APS5_VABI scePthreadSetcancelstate(int, int*);
-int APS5_VABI scePthreadSemInit(PthreadSem*, int, unsigned, const char*);
-int APS5_VABI scePthreadSemDestroy(PthreadSem*);
-int APS5_VABI scePthreadSemPost(PthreadSem*);
-int APS5_VABI scePthreadSemWait(PthreadSem*);
-int APS5_VABI scePthreadSemTimedwait(PthreadSem*, KernelUseconds);
-int APS5_VABI scePthreadSemGetvalue(PthreadSem*, int*);
-}
-
 namespace {
 
 void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestSemaphore.cpp b/core/libs/tests/GuestSemaphore.cpp
index 5392fa1603..bc843e1a5a 100644
--- a/core/libs/tests/GuestSemaphore.cpp
+++ b/core/libs/tests/GuestSemaphore.cpp
@@ -1,24 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t attr, int init, int max, void* opt);
-int APS5_VABI sceKernelDeleteSema(KernelSema sem);
-int APS5_VABI sceKernelPollSema(KernelSema sem, int need);
-int APS5_VABI sceKernelSignalSema(KernelSema sem, int count);
-int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time);
-int APS5_VABI sceKernelCancelSema(KernelSema sem, int count, int* threads);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_ECANCELED = static_cast<int>(0x80020055);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -35,7 +23,37 @@ static void* APS5_VABI Wait(void* arg) {
     return nullptr;
 }
 
+static void RequireInvalidArguments() {
+    KernelSema rejected = nullptr;
+    Require(sceKernelCreateSema(&rejected, "rejected", 0, 5, 3, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelCreateSema(&rejected, "rejected", 0, 0, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelCreateSema(&rejected, "rejected", 0, -1, 3, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelCreateSema(&rejected, nullptr, 0, 0, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(rejected == nullptr);
+
+    KernelSema sem = nullptr;
+    Require(sceKernelCreateSema(&sem, "limits", 0, 2, 3, nullptr) == SCE_OK);
+    Require(sceKernelPollSema(sem, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, -1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 4) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 100) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 3) == SCE_KERNEL_ERROR_EBUSY);
+    Require(sceKernelSignalSema(sem, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 2) == SCE_OK);
+    Require(sceKernelSignalSema(sem, 3) == SCE_OK);
+    Require(sceKernelPollSema(sem, 3) == SCE_OK);
+    Require(sceKernelDeleteSema(sem) == SCE_OK);
+}
+
 int main() {
+    KernelUseconds nullTimeout = 1000;
+    int nullWaiters = -1;
+    Require(sceKernelWaitSema(nullptr, 1, nullptr) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelWaitSema(nullptr, 1, &nullTimeout) == SCE_KERNEL_ERROR_ESRCH && nullTimeout == 1000);
+    Require(sceKernelPollSema(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelSignalSema(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelCancelSema(nullptr, 0, &nullWaiters) == SCE_KERNEL_ERROR_ESRCH && nullWaiters == -1);
+    Require(sceKernelDeleteSema(nullptr) == SCE_KERNEL_ERROR_ESRCH);
     KernelSema sem = nullptr;
     Require(sceKernelCreateSema(&sem, "cancel", 0, 1, 3, nullptr) == SCE_OK);
 
@@ -85,4 +103,6 @@ int main() {
     Require(sceKernelSignalSema(sem, 1) == SCE_OK);
     Require(sceKernelWaitSema(sem, 1, nullptr) == SCE_OK);
     Require(sceKernelDeleteSema(sem) == SCE_OK);
+
+    RequireInvalidArguments();
 }
diff --git a/core/libs/tests/GuestSendfile.cpp b/core/libs/tests/GuestSendfile.cpp
index 9759531b34..f2fac5d3cc 100644
--- a/core/libs/tests/GuestSendfile.cpp
+++ b/core/libs/tests/GuestSendfile.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -6,27 +8,7 @@
 #include <string>
 #include <thread>
 #include <vector>
-struct Iovec {
-    const void* base;
-    std::uint64_t length;
-};
-struct Hdtr {
-    const Iovec* headers;
-    int headerCount;
-    const Iovec* trailers;
-    int trailerCount;
-};
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI ioctl_nid_postfix(int, std::uint64_t, void*);
-int APS5_VABI sendfile_nid_postfix(int, int, std::int64_t, std::uint64_t, const Hdtr*, std::int64_t*, int);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static bool Fails(int result, int error) { return result == -1 && *__error_nid_postfix() == error; }
 static std::string Receive(int descriptor, std::size_t length) {
@@ -59,9 +41,9 @@ int main() {
     const int file = OpenWritten("sendfile_probe.bin", content);
     int pair[2];
     Require(socketpair_nid_postfix(1, 1, 0, pair) == 0);
-    const Iovec header[] = {{"GET", 3}, {" ", 1}};
-    const Iovec trailer[] = {{"END", 3}};
-    const Hdtr parts{header, 2, trailer, 1};
+    KernelIovec header[] = {{const_cast<char*>("GET"), 3}, {const_cast<char*>(" "), 1}};
+    KernelIovec trailer[] = {{const_cast<char*>("END"), 3}};
+    const GuestSendfileHeaders parts{header, 2, trailer, 1};
     std::int64_t sent = -1;
     Require(sendfile_nid_postfix(file, pair[0], 5, 10, &parts, &sent, 0) == 0 && sent == 17);
     Require(Receive(pair[1], 17) == "GET " + content.substr(5, 10) + "END");
@@ -75,17 +57,17 @@ int main() {
     Require(Receive(pair[1], 4) == content.substr(content.size() - 4));
     Require(sendfile_nid_postfix(file, pair[0], size + 10, 0, &parts, &sent, 0) == 0 && sent == 7);
     Require(Receive(pair[1], 7) == "GET END");
-    const Hdtr nullHeaders{nullptr, 5, trailer, 1};
+    const GuestSendfileHeaders nullHeaders{nullptr, 5, trailer, 1};
     Require(sendfile_nid_postfix(file, pair[0], 0, 3, &nullHeaders, nullptr, 0) == 0);
     Require(Receive(pair[1], 6) == content.substr(0, 3) + "END");
     Require(lseek_nid_postfix(file, 0, 1) == 0);
 
     sent = 77;
     Require(Fails(sendfile_nid_postfix(file, pair[0], -1, 0, nullptr, &sent, 0), 22) && sent == 77);
-    const std::vector<Iovec> many(1025, Iovec{"x", 1});
-    const Hdtr tooMany{many.data(), 1025, nullptr, 0};
+    std::vector<KernelIovec> many(1025, KernelIovec{const_cast<char*>("x"), 1});
+    const GuestSendfileHeaders tooMany{many.data(), 1025, nullptr, 0};
     Require(Fails(sendfile_nid_postfix(file, pair[0], 0, 0, &tooMany, &sent, 0), 22) && sent == 77);
-    const Hdtr negative{nullptr, 0, trailer, -1};
+    const GuestSendfileHeaders negative{nullptr, 0, trailer, -1};
     Require(Fails(sendfile_nid_postfix(file, pair[0], 0, 0, &negative, &sent, 0), 22) && sent == 77);
     Require(Fails(sendfile_nid_postfix(pair[1], pair[0], 0, 0, nullptr, &sent, 0), 22) && sent == 0);
     sent = 77;
@@ -98,6 +80,17 @@ int main() {
     Require(unconnected >= 0);
     sent = 77;
     Require(Fails(sendfile_nid_postfix(file, unconnected, size + 10, 0, nullptr, &sent, 0), 57) && sent == 0);
+    const int random = open_nid_postfix("/dev/urandom", 0, 0);
+    Require(random >= 0);
+    sent = 77;
+    Require(Fails(sendfile_nid_postfix(random, pair[0], 0, 16, &parts, &sent, 0), 22) && sent == 0);
+    sent = 77;
+    Require(Fails(sendfile_nid_postfix(random, pair[0], 0, 0, nullptr, &sent, 0), 22) && sent == 0);
+    const int queue = kqueue_nid_postfix();
+    Require(queue >= 0);
+    sent = 77;
+    Require(Fails(sendfile_nid_postfix(queue, pair[0], 0, 0, nullptr, &sent, 0), 22) && sent == 0);
+    Require(close_nid_postfix(queue) == 0 && close_nid_postfix(random) == 0);
 
     const std::string large = Content(32 << 20);
     const int largeFile = OpenWritten("sendfile_large.bin", large);
diff --git a/core/libs/tests/GuestServiceDatabase.cpp b/core/libs/tests/GuestServiceDatabase.cpp
index 30caec9095..e89a3d5985 100644
--- a/core/libs/tests/GuestServiceDatabase.cpp
+++ b/core/libs/tests/GuestServiceDatabase.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libScePosixForWebKit/GuestResolver.hpp"
 #include <cerrno>
@@ -8,8 +9,6 @@
 #include <source_location>
 #include <thread>
 
-extern "C" GuestResolver::ServiceEntry* APS5_VABI getservbyname_nid_postfix(const char*, const char*);
-
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Service database check failed at line %u\n", location.line());
diff --git a/core/libs/tests/GuestSetrlimit.cpp b/core/libs/tests/GuestSetrlimit.cpp
index 0691db0980..f86c83edfb 100644
--- a/core/libs/tests/GuestSetrlimit.cpp
+++ b/core/libs/tests/GuestSetrlimit.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,17 +7,6 @@
 #include <limits>
 #include <stdexcept>
 
-struct ResourceLimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-
-extern "C" {
-int APS5_VABI getrlimit_nid_postfix(int, ResourceLimit*);
-int APS5_VABI setrlimit_nid_postfix(int, const ResourceLimit*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_RLIMIT_DATA = 2;
@@ -29,23 +20,24 @@ static constexpr std::int64_t GUEST_RLIM_INFINITY = std::numeric_limits<std::int
 
 static void Require(bool value) { if (!value) std::abort(); }
 
-static bool Throws(int resource, const ResourceLimit& limit) {
+static bool Throws(int resource, const GuestResourceLimit& limit) {
     try {
         setrlimit_nid_postfix(resource, &limit);
+
     } catch (const std::runtime_error&) {
         return true;
     }
     return false;
 }
 
-static void RequireError(int resource, const ResourceLimit* limit, int error) {
+static void RequireError(int resource, const GuestResourceLimit* limit, int error) {
     *__error_nid_postfix() = 0;
     Require(setrlimit_nid_postfix(resource, limit) == -1);
     Require(*__error_nid_postfix() == error);
 }
 
 int main() {
-    const ResourceLimit infinity{GUEST_RLIM_INFINITY, GUEST_RLIM_INFINITY};
+    const GuestResourceLimit infinity{GUEST_RLIM_INFINITY, GUEST_RLIM_INFINITY};
     RequireError(-1, nullptr, GUEST_EFAULT);
     RequireError(GUEST_RLIM_NLIMITS, nullptr, GUEST_EFAULT);
     RequireError(-1, &infinity, GUEST_EINVAL);
@@ -53,41 +45,41 @@ int main() {
 
     static constexpr int unchanged[] = {GUEST_RLIMIT_STACK, GUEST_RLIMIT_RSS, GUEST_RLIMIT_MEMLOCK};
     for (int resource : unchanged) {
-        ResourceLimit before{};
+        GuestResourceLimit before{};
         Require(getrlimit_nid_postfix(resource, &before) == 0);
         *__error_nid_postfix() = 13;
         Require(setrlimit_nid_postfix(resource, &before) == 0 && *__error_nid_postfix() == 13);
-        ResourceLimit after{};
+        GuestResourceLimit after{};
         Require(getrlimit_nid_postfix(resource, &after) == 0 && after.rlim_cur == before.rlim_cur && after.rlim_max == before.rlim_max);
     }
-    ResourceLimit processes{};
+    GuestResourceLimit processes{};
     Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1604 && processes.rlim_max == 1604);
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0);
     Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1443 && processes.rlim_max == 1443);
-    const ResourceLimit noProcesses{0, 0};
+    const GuestResourceLimit noProcesses{0, 0};
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &noProcesses) == 0);
     Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1 && processes.rlim_max == 1);
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &infinity) == 0);
     Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1443 && processes.rlim_max == 1443);
-    Require(Throws(GUEST_RLIMIT_STACK, ResourceLimit{0x100000, 0x200000}));
+    Require(Throws(GUEST_RLIMIT_STACK, GuestResourceLimit{0x100000, 0x200000}));
 
-    ResourceLimit current{};
+    GuestResourceLimit current{};
     Require(getrlimit_nid_postfix(GUEST_RLIMIT_DATA, &current) == 0);
     *__error_nid_postfix() = 13;
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_DATA, &current) == 0);
     Require(*__error_nid_postfix() == 13);
 
     if (current.rlim_cur > 0) {
-        const ResourceLimit changed{current.rlim_cur - 1, current.rlim_max};
+        const GuestResourceLimit changed{current.rlim_cur - 1, current.rlim_max};
         Require(Throws(GUEST_RLIMIT_DATA, changed));
     }
-    const ResourceLimit softAboveHard{GUEST_RLIM_INFINITY, current.rlim_max};
+    const GuestResourceLimit softAboveHard{GUEST_RLIM_INFINITY, current.rlim_max};
     if (current.rlim_cur == current.rlim_max)
         Require(setrlimit_nid_postfix(GUEST_RLIMIT_DATA, &softAboveHard) == 0);
     else
         Require(Throws(GUEST_RLIMIT_DATA, softAboveHard));
 
-    const ResourceLimit negative{-1, -2};
+    const GuestResourceLimit negative{-1, -2};
     if (current.rlim_cur == GUEST_RLIM_INFINITY && current.rlim_max == GUEST_RLIM_INFINITY)
         Require(setrlimit_nid_postfix(GUEST_RLIMIT_DATA, &negative) == 0);
     else
diff --git a/core/libs/tests/GuestShaderLink.cpp b/core/libs/tests/GuestShaderLink.cpp
index f5b510652b..5c39b6fffe 100644
--- a/core/libs/tests/GuestShaderLink.cpp
+++ b/core/libs/tests/GuestShaderLink.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
+#include "prx/libSceAgc/Misc/include/RegisterDefaults.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceAgc/Shader/include/ShaderConstants.hpp"
@@ -6,9 +8,7 @@
 #include <cstring>
 #include <stdexcept>
 #include <span>
-extern "C" int APS5_VABI sceAgcLinkShaders(ShaderRegister*, ShaderRegister*, const void*, const Shader*, const Shader*, std::uint32_t);
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults();
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults2(std::uint32_t);
+
 static void Require(bool value) { if (!value) std::abort(); }
 static unsigned preparations = 0;
 static unsigned mappings = 0;
diff --git a/core/libs/tests/GuestShare.cpp b/core/libs/tests/GuestShare.cpp
index 0ef5a51bc5..a3e197e8a4 100644
--- a/core/libs/tests/GuestShare.cpp
+++ b/core/libs/tests/GuestShare.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShare/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -5,17 +6,6 @@
 #include <initializer_list>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceShareCaptureScreenshotExtended(const void* extended_param, std::int32_t* req_id);
-int APS5_VABI sceShareCaptureScreenshot(const void* param, std::int32_t* req_id);
-int APS5_VABI sceShareCaptureVideoClip(const void* param, std::int32_t* req_id);
-int APS5_VABI sceShareCaptureVideoClipExtended(const void* extended_param, std::int32_t* req_id);
-int APS5_VABI sceShareGetCurrentStatus(std::uint32_t feature_flag, void* status);
-int APS5_VABI sceShareOpenMenuForContent(const void* content_id);
-int APS5_VABI sceShareGetRunningStatus(std::uint32_t* status);
-int APS5_VABI sceShareSetContentParamForApplicationTitle(const char* application_title);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -29,25 +19,26 @@ int main() {
     using Capture = int (APS5_VABI*)(const void*, std::int32_t*);
     std::int32_t reqId = 7;
     constexpr std::int32_t invalidParam = static_cast<std::int32_t>(0x81960002);
-    for (Capture capture : {sceShareCaptureScreenshotExtended, sceShareCaptureVideoClipExtended}) {
+    const auto checkExtended = [&]<typename TParam>(int (APS5_VABI* capture)(const TParam*, std::int32_t*), std::uint64_t size) {
         std::uint64_t fields[5]{};
-        const std::uint64_t size = capture == sceShareCaptureScreenshotExtended ? 24 : 40;
         reqId = 7;
-        Require(capture(fields, &reqId) == invalidParam && reqId == 7);
+        Require(capture(reinterpret_cast<const TParam*>(fields), &reqId) == invalidParam && reqId == 7);
         Require(capture(nullptr, &reqId) == invalidParam && reqId == 7);
         fields[0] = size;
-        Require(capture(fields, &reqId) == notSupported && reqId == -1);
-        Require(capture(fields, nullptr) == notSupported);
+        Require(capture(reinterpret_cast<const TParam*>(fields), &reqId) == notSupported && reqId == -1);
+        Require(capture(reinterpret_cast<const TParam*>(fields), nullptr) == notSupported);
         if (size == 40) {
             fields[2] = 1;
             reqId = 7;
-            Require(capture(fields, &reqId) == invalidParam && reqId == -1);
+            Require(capture(reinterpret_cast<const TParam*>(fields), &reqId) == invalidParam && reqId == -1);
             fields[3] = 1;
-            Require(capture(fields, nullptr) == notSupported);
+            Require(capture(reinterpret_cast<const TParam*>(fields), nullptr) == notSupported);
             fields[3] |= std::uint64_t{1} << 32;
-            Require(capture(fields, nullptr) == invalidParam);
+            Require(capture(reinterpret_cast<const TParam*>(fields), nullptr) == invalidParam);
         }
-    }
+    };
+    checkExtended(sceShareCaptureScreenshotExtended, 24);
+    checkExtended(sceShareCaptureVideoClipExtended, 40);
 
     for (Capture capture : {sceShareCaptureScreenshot, sceShareCaptureVideoClip}) {
         reqId = 7;
@@ -64,13 +55,13 @@ int main() {
 
     std::uint8_t status[18];
     std::memset(status, 0x5a, sizeof(status));
-    Require(sceShareGetCurrentStatus(1, status) == 0);
+    Require(sceShareGetCurrentStatus(1, reinterpret_cast<ShareCurrentStatus*>(status)) == 0);
     for (std::size_t index = 0; index < sizeof(status); ++index) Require(status[index] == (index < 16 ? 0 : 0x5a));
     std::memset(status, 0x5a, sizeof(status));
-    Require(sceShareGetCurrentStatus(0xffffffffu, status) == 0);
+    Require(sceShareGetCurrentStatus(0xffffffffu, reinterpret_cast<ShareCurrentStatus*>(status)) == 0);
     Require(status[0] == 0 && status[15] == 0 && status[16] == 0x5a);
     std::memset(status, 0x5a, sizeof(status));
-    Require(sceShareGetCurrentStatus(0, status) == invalidParam);
+    Require(sceShareGetCurrentStatus(0, reinterpret_cast<ShareCurrentStatus*>(status)) == invalidParam);
     Require(status[0] == 0x5a);
     Require(sceShareGetCurrentStatus(1, nullptr) == invalidParam);
     std::uint32_t running[2]{0xffffffffu, 0x5a5a5a5au};
diff --git a/core/libs/tests/GuestSharePlay.cpp b/core/libs/tests/GuestSharePlay.cpp
index 4d1b7f1199..c1545a1dad 100644
--- a/core/libs/tests/GuestSharePlay.cpp
+++ b/core/libs/tests/GuestSharePlay.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSharePlay/libSceSharePlay.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -6,13 +7,6 @@
 #include <exception>
 #include <span>
 
-extern "C" {
-int APS5_VABI sceSharePlayInitialize(void*, std::size_t);
-int APS5_VABI sceSharePlayTerminate(void);
-int APS5_VABI sceSharePlayGetCurrentConnectionInfoA(SharePlayConnectionInfoA*);
-int APS5_VABI sceSharePlayProhibitController(std::uint8_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
@@ -32,6 +26,7 @@ int main() {
     constexpr int invalidArgument = static_cast<int>(0x810E0001);
     Require(sceSharePlayTerminate() == notInitialized);
     Require(sceSharePlayGetCurrentConnectionInfoA(nullptr) == notInitialized);
+    Require(sceSharePlayGetCurrentConnectionInfo(nullptr) == notInitialized);
     Require(sceSharePlayProhibitController(2) == notInitialized);
     Require(sceSharePlayInitialize(nullptr, sizeof(heap)) == 0);
     Require(sceSharePlayInitialize(heap, 0) == alreadyInitialized);
@@ -47,6 +42,14 @@ int main() {
     Require(info.hostOnlineId.data[0] == 0 && info.visitorOnlineId.data[0] == 0 && info.hostOnlineId.pad[2] == 0);
     Require(info.hostUserId == -1 && info.visitorUserId == -1);
     Require(sceSharePlayGetCurrentConnectionInfoA(nullptr) == static_cast<int>(0x810E0001));
+    unsigned char plain[sizeof(SharePlayConnectionInfo) + 8];
+    std::memset(plain, 0x5a, sizeof(plain));
+    auto* plainInfo = reinterpret_cast<SharePlayConnectionInfo*>(plain);
+    Require(sceSharePlayGetCurrentConnectionInfo(plainInfo) == 0);
+    Require(plainInfo->status == 0 && plainInfo->mode == 0 && plainInfo->hostOnlineId.data[0] == 0 && plainInfo->visitorOnlineId.pad[2] == 0);
+    Require(plainInfo->hostUserId == -1 && plainInfo->visitorUserId == -1);
+    for (std::size_t i = sizeof(SharePlayConnectionInfo); i < sizeof(plain); ++i) Require(plain[i] == 0x5a);
+    Require(sceSharePlayGetCurrentConnectionInfo(nullptr) == invalidArgument);
     Require(sceSharePlayProhibitController(1) == 0);
     Require(sceSharePlayProhibitController(1) == 0);
     Require(sceSharePlayProhibitController(0) == 0);
diff --git a/core/libs/tests/GuestShmOpen.cpp b/core/libs/tests/GuestShmOpen.cpp
index ff4f8fb16c..6d6461d725 100644
--- a/core/libs/tests/GuestShmOpen.cpp
+++ b/core/libs/tests/GuestShmOpen.cpp
@@ -1,19 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <stdexcept>
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI close_nid_postfix(int);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static const char* const anonymous = reinterpret_cast<const char*>(1);
 static void RequireInvalid(const char* path, int flags) {
@@ -68,13 +61,7 @@ int main() {
     RequireInvalid("/anyps5-shm", 0x1);
     RequireInvalid("/anyps5-shm", 0x202 | 0x8);
 #ifdef _WIN32
-    bool threw = false;
-    try {
-        shm_open_nid_postfix("/anyps5-shm", 0x202, 0600);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
+    RequireInvalid("", 0x202);
 #else
     RequireInvalid("", 0x202);
 #endif
diff --git a/core/libs/tests/GuestSigaltstack.cpp b/core/libs/tests/GuestSigaltstack.cpp
index 6260846fd8..afd3787ccc 100644
--- a/core/libs/tests/GuestSigaltstack.cpp
+++ b/core/libs/tests/GuestSigaltstack.cpp
@@ -1,17 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 #include <thread>
-struct GuestStack {
-    void* sp;
-    std::size_t size;
-    int flags;
-};
-extern "C" {
-int APS5_VABI sigaltstack_nid_postfix(const GuestStack*, GuestStack*);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static GuestStack Query() {
     GuestStack current;
diff --git a/core/libs/tests/GuestSignalHandlerMask.cpp b/core/libs/tests/GuestSignalHandlerMask.cpp
new file mode 100644
index 0000000000..36029bfd31
--- /dev/null
+++ b/core/libs/tests/GuestSignalHandlerMask.cpp
@@ -0,0 +1,229 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <thread>
+
+static constexpr int SigKill = 9;
+static constexpr int SigTerm = 15;
+static constexpr int SigUsr1 = 30;
+static constexpr int SigUsr2 = 31;
+static constexpr int SaRestart = 0x2;
+static constexpr int SaResethand = 0x4;
+static constexpr int SaNodefer = 0x10;
+static constexpr int SigBlock = 1;
+static constexpr int SigUnblock = 2;
+static constexpr int SigSetmask = 3;
+
+static std::uint32_t Bit(int signal) { return 1u << (signal - 1); }
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static int calls = 0;
+static int callsAfterNestedRaise = 0;
+static std::uint32_t maskInHandler = 0;
+
+static std::uint32_t CurrentMask() {
+    GuestSignalSet set{};
+    Require(sigprocmask_nid_postfix(SigBlock, nullptr, &set) == 0);
+    return set.bits[0];
+}
+
+static void APS5_VABI RaiseAgain(int signal) {
+    if (++calls == 1) {
+        maskInHandler = CurrentMask();
+        Require(raise_nid_postfix(signal) == 0);
+        callsAfterNestedRaise = calls;
+    }
+}
+
+static void APS5_VABI Count(int) {
+    ++calls;
+}
+
+static std::uint64_t handlerExit[12];
+
+static void APS5_VABI LeaveWithLongjmp(int) {
+    ++calls;
+    longjmp_nid_postfix(handlerExit, 1);
+}
+
+static void APS5_VABI BlockFromOtherThread(int) {
+    ++calls;
+    std::thread([] {
+        const GuestSignalSet set{{Bit(SigTerm), 0, 0, 0}};
+        Require(sigprocmask_nid_postfix(SigBlock, &set, nullptr) == 0);
+    }).join();
+}
+
+static void APS5_VABI SetMaskFromOtherThread(int) {
+    ++calls;
+    std::thread([] {
+        const GuestSignalSet set{{Bit(SigTerm), 0, 0, 0}};
+        Require(sigprocmask_nid_postfix(SigSetmask, &set, nullptr) == 0);
+    }).join();
+}
+
+static void APS5_VABI SaveAndRestoreMask(int) {
+    ++calls;
+    GuestSignalSet old{};
+    Require(sigprocmask_nid_postfix(SigBlock, nullptr, &old) == 0);
+    Require(sigprocmask_nid_postfix(SigSetmask, &old, nullptr) == 0);
+}
+
+static void APS5_VABI ReplaceAndRestoreMask(int) {
+    ++calls;
+    const GuestSignalSet none{};
+    GuestSignalSet old{};
+    Require(sigprocmask_nid_postfix(SigSetmask, &none, &old) == 0);
+    Require(sigprocmask_nid_postfix(SigSetmask, &old, nullptr) == 0);
+}
+
+static GuestSignalSet setInHandler{};
+
+static void APS5_VABI RecordMask(int) {
+    ++calls;
+    Require(sigprocmask_nid_postfix(SigBlock, nullptr, &setInHandler) == 0);
+}
+
+static void APS5_VABI UnblockAndRaise(int signal) {
+    if (++calls == 1) {
+        const GuestSignalSet own{{Bit(signal), 0, 0, 0}};
+        Require(sigprocmask_nid_postfix(SigUnblock, &own, nullptr) == 0);
+        Require(raise_nid_postfix(signal) == 0);
+        callsAfterNestedRaise = calls;
+    }
+}
+
+static void Install(int signal, void (APS5_VABI* handler)(int), int flags, std::uint32_t mask) {
+    GuestSigaction action{reinterpret_cast<std::uintptr_t>(handler), flags, {{mask, 0, 0, 0}}};
+    Require(sigaction_nid_postfix(signal, &action, nullptr) == 0);
+}
+
+static void CheckDeferred(int signal) {
+    calls = 0;
+    callsAfterNestedRaise = 0;
+    Install(signal, RaiseAgain, SaRestart, Bit(SigUsr1));
+    Require(raise_nid_postfix(signal) == 0);
+    Require(callsAfterNestedRaise == 1);
+    Require(calls == 2);
+    Require(maskInHandler == (Bit(signal) | Bit(SigUsr1)));
+    Require(CurrentMask() == 0);
+}
+
+static void CheckNodefer() {
+    calls = 0;
+    callsAfterNestedRaise = 0;
+    Install(SigUsr2, RaiseAgain, SaRestart | SaNodefer, 0);
+    Require(raise_nid_postfix(SigUsr2) == 0);
+    Require(callsAfterNestedRaise == 2);
+    Require(maskInHandler == 0);
+    Require(CurrentMask() == 0);
+}
+
+static void CheckResethand() {
+    calls = 0;
+    Install(SigUsr1, Count, SaResethand, 0);
+    Require(raise_nid_postfix(SigUsr1) == 0);
+    Require(calls == 1);
+    GuestSigaction current{};
+    Require(sigaction_nid_postfix(SigUsr1, nullptr, &current) == 0);
+    Require(current.handler == 0);
+    Require((current.flags & SaResethand) != 0);
+}
+
+static void CheckOtherThreadKept() {
+    calls = 0;
+    Install(SigUsr1, BlockFromOtherThread, SaRestart, 0);
+    Require(raise_nid_postfix(SigUsr1) == 0);
+    Require(calls == 1);
+    Require(CurrentMask() == Bit(SigTerm));
+    const GuestSignalSet set{{Bit(SigTerm), 0, 0, 0}};
+    Require(sigprocmask_nid_postfix(SigUnblock, &set, nullptr) == 0);
+    Require(CurrentMask() == 0);
+}
+
+static void CheckOtherThreadKeptSameSignal() {
+    calls = 0;
+    Install(SigUsr1, BlockFromOtherThread, SaRestart, Bit(SigTerm));
+    Require(raise_nid_postfix(SigUsr1) == 0);
+    Require(calls == 1);
+    Require(CurrentMask() == Bit(SigTerm));
+    const GuestSignalSet set{{Bit(SigTerm), 0, 0, 0}};
+    Require(sigprocmask_nid_postfix(SigUnblock, &set, nullptr) == 0);
+    Require(CurrentMask() == 0);
+}
+
+static void CheckOtherThreadSetMaskKept() {
+    calls = 0;
+    Install(SigUsr1, SetMaskFromOtherThread, SaRestart, 0);
+    Require(raise_nid_postfix(SigUsr1) == 0);
+    Require(calls == 1);
+    Require(CurrentMask() == Bit(SigTerm));
+    const GuestSignalSet none{};
+    Require(sigprocmask_nid_postfix(SigSetmask, &none, nullptr) == 0);
+    Require(CurrentMask() == 0);
+}
+
+static void CheckMaskRestoredInsideHandler(int signal, void (APS5_VABI* handler)(int)) {
+    calls = 0;
+    Install(signal, handler, SaRestart, 0);
+    Require(raise_nid_postfix(signal) == 0);
+    Require(calls == 1);
+    Require(CurrentMask() == 0);
+    Require(raise_nid_postfix(signal) == 0);
+    Require(calls == 2);
+    Require(CurrentMask() == 0);
+}
+
+static void CheckUnblockInsideHandler() {
+    calls = 0;
+    callsAfterNestedRaise = 0;
+    Install(SigUsr2, UnblockAndRaise, SaRestart, 0);
+    Require(raise_nid_postfix(SigUsr2) == 0);
+    Require(callsAfterNestedRaise == 2);
+    Require(CurrentMask() == 0);
+}
+
+static void CheckUpperMaskWords() {
+    calls = 0;
+    const GuestSigaction action{reinterpret_cast<std::uintptr_t>(RecordMask), SaRestart, {{Bit(SigKill), 1u << 7, 0, 1u << 31}}};
+    Require(sigaction_nid_postfix(SigUsr1, &action, nullptr) == 0);
+    Require(raise_nid_postfix(SigUsr1) == 0);
+    Require(calls == 1);
+    Require(setInHandler.bits[0] == Bit(SigUsr1) && setInHandler.bits[1] == 1u << 7 && setInHandler.bits[2] == 0 && setInHandler.bits[3] == 1u << 31);
+    GuestSignalSet after{};
+    Require(sigprocmask_nid_postfix(SigBlock, nullptr, &after) == 0);
+    Require(after.bits[0] == 0 && after.bits[1] == 0 && after.bits[2] == 0 && after.bits[3] == 0);
+}
+
+static void CheckLeftWithLongjmp() {
+    calls = 0;
+    Install(SigUsr1, LeaveWithLongjmp, SaRestart, Bit(SigUsr2));
+    for (int round = 1; round <= 2; ++round) {
+        if (setjmp_nid_postfix(handlerExit) == 0) {
+            raise_nid_postfix(SigUsr1);
+            std::abort();
+        }
+        Require(calls == round);
+        Require(CurrentMask() == 0);
+    }
+}
+
+int main() {
+    CheckDeferred(SigUsr2);
+    CheckDeferred(SigTerm);
+    CheckNodefer();
+    CheckResethand();
+    CheckOtherThreadKept();
+    CheckOtherThreadKeptSameSignal();
+    CheckOtherThreadSetMaskKept();
+    CheckMaskRestoredInsideHandler(SigUsr2, SaveAndRestoreMask);
+    CheckMaskRestoredInsideHandler(SigTerm, SaveAndRestoreMask);
+    CheckMaskRestoredInsideHandler(SigUsr2, ReplaceAndRestoreMask);
+    CheckUnblockInsideHandler();
+    CheckUpperMaskWords();
+    CheckLeftWithLongjmp();
+    return 0;
+}
diff --git a/core/libs/tests/GuestSignalInterrupt.cpp b/core/libs/tests/GuestSignalInterrupt.cpp
new file mode 100644
index 0000000000..d520e1954a
--- /dev/null
+++ b/core/libs/tests/GuestSignalInterrupt.cpp
@@ -0,0 +1,98 @@
+#include "SceTypes.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <initializer_list>
+#include <limits>
+
+using Handler = void (APS5_VABI *)(int);
+
+static_assert(sizeof(GuestSignalSet) == 16 && alignof(GuestSignalSet) == 4);
+static_assert(sizeof(GuestSigaction) == 32 && offsetof(GuestSigaction, flags) == 8 && offsetof(GuestSigaction, mask) == 12);
+
+extern "C" {
+extern GuestSignalSet _sigintr_nid_postfix;
+}
+
+namespace {
+
+void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+bool Same(const GuestSigaction& first, const GuestSigaction& second) {
+    return first.handler == second.handler && first.flags == second.flags &&
+        std::memcmp(&first.mask, &second.mask, sizeof(first.mask)) == 0;
+}
+
+void APS5_VABI HandlerFunction(int) {}
+
+}
+
+int main() {
+    const GuestSignalSet initial = _sigintr_nid_postfix;
+    Require(initial.bits[0] == 0 && initial.bits[1] == 0 && initial.bits[2] == 0 && initial.bits[3] == 0, "initial interrupt set");
+    for (int guest : {1, 32, 33, 64, 65, 96, 97, 128}) {
+        GuestSigaction original{};
+        Require(sigaction_nid_postfix(guest, nullptr, &original) == 0, "read original disposition");
+        GuestSigaction custom{reinterpret_cast<std::uintptr_t>(HandlerFunction), 0x42,
+            {{0x11111111, 0x22222222, 0x33333333, 0x44444444}}};
+        Require(sigaction_nid_postfix(guest, &custom, nullptr) == 0, "install custom disposition");
+        Require(sigaction_nid_postfix(guest, nullptr, &custom) == 0, "read installed disposition");
+        const auto word = static_cast<unsigned>(guest - 1) / 32;
+        const auto bit = std::uint32_t{1} << (static_cast<unsigned>(guest - 1) % 32);
+        GuestSignalSet expected{{0x55555555, 0xaaaaaaaa, 0x55555555, 0xaaaaaaaa}};
+        expected.bits[word] &= ~bit;
+        _sigintr_nid_postfix = expected;
+        for (int flag : {1, -1, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()}) {
+            *__error_nid_postfix() = 12345;
+            Require(siginterrupt_nid_postfix(guest, flag) == 0, "nonzero flag");
+            Require(*__error_nid_postfix() == 12345, "successful errno preservation");
+            expected.bits[word] |= bit;
+            Require(std::memcmp(&_sigintr_nid_postfix, &expected, sizeof(expected)) == 0, "set bit without changing neighboring bits");
+            GuestSigaction actual{};
+            Require(sigaction_nid_postfix(guest, nullptr, &actual) == 0, "read interrupted disposition");
+            auto interrupted = custom;
+            interrupted.flags &= ~0x2;
+            Require(Same(actual, interrupted), "preserve handler, mask and other flags");
+        }
+        for (int repeat = 0; repeat < 2; ++repeat) {
+            *__error_nid_postfix() = 23456;
+            Require(siginterrupt_nid_postfix(guest, 0) == 0, "clear interrupt bit");
+            Require(*__error_nid_postfix() == 23456, "zero flag errno preservation");
+            expected.bits[word] &= ~bit;
+            Require(std::memcmp(&_sigintr_nid_postfix, &expected, sizeof(expected)) == 0, "clear bit without changing neighboring bits");
+            GuestSigaction actual{};
+            Require(sigaction_nid_postfix(guest, nullptr, &actual) == 0 && Same(actual, custom), "restore restart without changing disposition");
+        }
+        Require(siginterrupt_nid_postfix(guest, -1) == 0, "make later signal interruptible");
+        Require(signal_nid_postfix(guest, HandlerFunction) == HandlerFunction, "subsequent signal preserves previous handler");
+        GuestSigaction actual{};
+        Require(sigaction_nid_postfix(guest, nullptr, &actual) == 0 && actual.flags == 0, "signal consults shared interrupt set");
+        Require(siginterrupt_nid_postfix(guest, 0) == 0, "make later signal restartable");
+        Require(signal_nid_postfix(guest, HandlerFunction) == HandlerFunction, "repeat signal registration");
+        Require(sigaction_nid_postfix(guest, nullptr, &actual) == 0 && actual.flags == 0x2, "signal restores restart");
+        Require(sigaction_nid_postfix(guest, &original, nullptr) == 0, "restore original disposition");
+        _sigintr_nid_postfix = initial;
+    }
+    const GuestSignalSet sentinels{{0x12345678, 0xabcdef01, 0x23456789, 0xbcdef012}};
+    _sigintr_nid_postfix = sentinels;
+    GuestSigaction before{};
+    Require(sigaction_nid_postfix(30, nullptr, &before) == 0, "read invalid-call control");
+    for (int guest : {0, -1, 129, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()}) {
+        for (int flag : {0, 1, -1}) {
+            *__error_nid_postfix() = 34567;
+            Require(siginterrupt_nid_postfix(guest, flag) == -1 && *__error_nid_postfix() == 22, "invalid signal reports EINVAL");
+            Require(std::memcmp(&_sigintr_nid_postfix, &sentinels, sizeof(sentinels)) == 0, "invalid signal leaves all words unchanged");
+        }
+    }
+    GuestSigaction after{};
+    Require(sigaction_nid_postfix(30, nullptr, &after) == 0 && Same(before, after), "invalid calls preserve dispositions");
+    _sigintr_nid_postfix = initial;
+}
diff --git a/core/libs/tests/GuestSignalSets.cpp b/core/libs/tests/GuestSignalSets.cpp
index 786ddae94b..5440dc7032 100644
--- a/core/libs/tests/GuestSignalSets.cpp
+++ b/core/libs/tests/GuestSignalSets.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <climits>
@@ -7,21 +9,8 @@
 #include <cstring>
 #include <initializer_list>
 
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-
 extern "C" {
-int APS5_VABI sigemptyset_nid_postfix(GuestSignalSet*);
-int APS5_VABI sigfillset_nid_postfix(GuestSignalSet*);
-int APS5_VABI sigaddset_nid_postfix(GuestSignalSet*, int);
-int APS5_VABI sigdelset_nid_postfix(GuestSignalSet*, int);
-int APS5_VABI sigismember_nid_postfix(const GuestSignalSet*, int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI _sigprocmask_nid_postfix(int, const GuestSignalSet*, GuestSignalSet*);
-int APS5_VABI sigprocmask_nid_postfix(int, const void*, void*);
-[[gnu::returns_twice]] int APS5_VABI sigsetjmp_nid_postfix(std::uint64_t* buffer, int saveMask);
-[[noreturn]] void APS5_VABI siglongjmp_nid_postfix(std::uint64_t* buffer, int value);
+
 int APS5_VABI JumpKeepingCalleeSaved(std::uint64_t* buffer);
 }
 
@@ -165,6 +154,30 @@ static void CheckSigsetjmp() {
     SetBlockedMask(0);
 }
 
+static int LongjumpBack(int value, std::uint32_t maskAtSet, std::uint32_t maskAtJump) {
+    std::uint64_t buffer[12]{};
+    volatile int jumped = 0;
+    SetBlockedMask(maskAtSet);
+    const int result = setjmp_nid_postfix(buffer);
+    if (jumped == 0) {
+        Require(result == 0);
+        Require(BufferWord(buffer, 72) == maskAtSet);
+        Require(BufferWord(buffer, 88) == 1);
+        jumped = 1;
+        SetBlockedMask(maskAtJump);
+        longjmp_nid_postfix(buffer, value);
+    }
+    return result;
+}
+
+static void CheckLongjmp() {
+    Require(LongjumpBack(0, 0x5u, 0x30u) == 1);
+    Require(BlockedMask() == 0x5u);
+    Require(LongjumpBack(7, 0x80000009u, 0u) == 7);
+    Require(BlockedMask() == 0x80000009u);
+    SetBlockedMask(0);
+}
+
 static void CheckInvalidHow() {
     SetBlockedMask(0x5u);
     const GuestSignalSet blocked{{0x30u, 0, 0, 0}};
@@ -186,6 +199,7 @@ static void CheckInvalidHow() {
 int main() {
     CheckSigsetjmp();
     CheckSiglongjmp();
+    CheckLongjmp();
     CheckInvalidHow();
     static constexpr int Untouched = 5;
     GuestSignalSet set{{0x12345678u, 0x9abcdef0u, 0xffffffffu, 1u}};
diff --git a/core/libs/tests/GuestSignals.cpp b/core/libs/tests/GuestSignals.cpp
index a5ca92484b..8afec0ead8 100644
--- a/core/libs/tests/GuestSignals.cpp
+++ b/core/libs/tests/GuestSignals.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <csignal>
 #include <initializer_list>
@@ -9,32 +11,13 @@
 #include <chrono>
 #include <thread>
 using Handler = void (APS5_VABI *)(int);
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
+
 extern "C" {
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI raise_nid_postfix(int);
-int APS5_VABI kill_nid_postfix(int, int);
-int APS5_VABI getpid_nid_postfix();
-int APS5_VABI pthread_kill_nid_postfix(void*, int);
-void* APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadCreate(void** thread, const void* attr, void* (APS5_VABI *entry)(void*), void* arg, const char* name);
-int APS5_VABI scePthreadJoin(void* thread, void** retval);
-int APS5_VABI sigaction_nid_postfix(int, const void*, void*);
-int APS5_VABI sigprocmask_nid_postfix(int, const void*, void*);
-int APS5_VABI pthread_sigmask_nid_postfix(int, const void*, void*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sigsuspend_nid_postfix(const GuestSignalSet*);
-int APS5_VABI _is_signal_return_nid_postfix(std::uint64_t);
+
 unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int);
-int APS5_VABI sigpending_nid_postfix(GuestSignalSet*);
+
 }
-struct GuestSigaction {
-    std::uintptr_t handler;
-    int flags;
-    GuestSignalSet mask;
-};
+
 static_assert(sizeof(GuestSigaction) == 32);
 extern GuestSignalSet _sigintr_nid_postfix;
 static bool Same(const GuestSigaction& left, const GuestSigaction& right) {
@@ -55,7 +38,7 @@ void* APS5_VABI SuspendEntry(void* arg) {
     return nullptr;
 }
 struct SuspendSender {
-    void* target = nullptr;
+    Pthread target = nullptr;
     int result = -1;
 };
 struct EndingThread {
@@ -80,6 +63,7 @@ GuestSignalSet maskInHandler{};
 void APS5_VABI MaskCallback(int value) {
     received = value;
     sigprocmask_nid_postfix(1, nullptr, &maskInHandler);
+
 }
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
@@ -103,11 +87,11 @@ int main() {
     Require(pthread_kill_nid_postfix(nullptr, 15) == 3);
     Require(pthread_kill_nid_postfix(nullptr, 128) == 3);
     Require(pthread_kill_nid_postfix(nullptr, 129) == 22);
-    Require(pthread_kill_nid_postfix(reinterpret_cast<void*>(std::uintptr_t{0x10}), 15) == 3);
-    Require(pthread_kill_nid_postfix(reinterpret_cast<void*>(std::uintptr_t{0x10}), 0) == 3);
+    Require(pthread_kill_nid_postfix(reinterpret_cast<Pthread>(std::uintptr_t{0x10}), 15) == 3);
+    Require(pthread_kill_nid_postfix(reinterpret_cast<Pthread>(std::uintptr_t{0x10}), 0) == 3);
     {
         EndingThread ending;
-        void* thread = nullptr;
+        Pthread thread = nullptr;
         Require(scePthreadCreate(&thread, nullptr, EndingEntry, &ending, nullptr) == 0);
         Require(pthread_kill_nid_postfix(thread, 0) == 0);
         ending.release.store(true);
@@ -199,6 +183,7 @@ int main() {
     bool rejected = false;
     try {
         raise_nid_postfix(6);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -246,15 +231,15 @@ int main() {
     received = 0;
     Require(raise_nid_postfix(30) == 0 && received == 0);
     Require(sigsuspend_nid_postfix(&suspendWithKillAndStop) == -1 && received == 30);
-    Require(maskInHandler.bits[0] == (1u << 28));
+    Require(maskInHandler.bits[0] == ((1u << 28) | (1u << 29)));
     Require(sigprocmask_nid_postfix(1, nullptr, &previous) == 0 && previous.bits[0] == user.bits[0]);
     Require(signal_nid_postfix(30, Callback) != invalid);
     received = 0;
     SuspendWait wait{&empty, 0, 0};
-    void* suspender = nullptr;
+    Pthread suspender = nullptr;
     Require(scePthreadCreate(&suspender, nullptr, SuspendEntry, &wait, nullptr) == 0);
     SuspendSender sender{suspender, -1};
-    void* senderThread = nullptr;
+    Pthread senderThread = nullptr;
     Require(scePthreadCreate(&senderThread, nullptr, SuspendSend, &sender, nullptr) == 0);
     Require(scePthreadJoin(senderThread, nullptr) == 0 && sender.result == 0);
     Require(scePthreadJoin(suspender, nullptr) == 0);
@@ -269,10 +254,10 @@ int main() {
     Require(signal_nid_postfix(73, Callback) != invalid);
     received = 0;
     SuspendWait highWait{&suspendMask, 0, 0};
-    void* highSuspender = nullptr;
+    Pthread highSuspender = nullptr;
     Require(scePthreadCreate(&highSuspender, nullptr, SuspendEntry, &highWait, nullptr) == 0);
     SuspendSender highSender{highSuspender, -1};
-    void* highSenderThread = nullptr;
+    Pthread highSenderThread = nullptr;
     Require(scePthreadCreate(&highSenderThread, nullptr, SuspendSend, &highSender, nullptr) == 0);
     Require(scePthreadJoin(highSenderThread, nullptr) == 0 && highSender.result == 0);
     Require(scePthreadJoin(highSuspender, nullptr) == 0);
@@ -399,6 +384,54 @@ int main() {
     Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
     Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0);
     Require(sigaction_nid_postfix(30, &restored, nullptr) == 0);
+
+    const GuestSigaction caught{callback, 0, {}};
+    received = 0;
+    Require(sigaction_nid_postfix(30, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &userSignal, nullptr) == 0);
+    Require(raise_nid_postfix(30) == 0 && received == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == userSignal.bits[0]);
+    Require(sigaction_nid_postfix(30, &restored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == userSignal.bits[0]);
+    Require(sigaction_nid_postfix(30, &ignored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(sigaction_nid_postfix(30, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+    Require(sigprocmask_nid_postfix(3, &userSignal, nullptr) == 0);
+    Require(raise_nid_postfix(30) == 0 && received == 0);
+    Require(signal_nid_postfix(30, ignore) == Callback);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(signal_nid_postfix(30, Callback) == ignore);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+    Require(signal_nid_postfix(30, nullptr) == Callback);
+
+    const GuestSignalSet windowSignal{{1u << 27, 0, 0, 0}};
+    Require(sigaction_nid_postfix(28, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &windowSignal, nullptr) == 0);
+    Require(raise_nid_postfix(28) == 0 && received == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == windowSignal.bits[0]);
+    Require(sigaction_nid_postfix(28, &restored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(sigaction_nid_postfix(28, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+    Require(sigaction_nid_postfix(28, &restored, nullptr) == 0);
+
+    const GuestSignalSet continueSignal{{1u << 18, 0, 0, 0}};
+    Require(sigprocmask_nid_postfix(3, &continueSignal, nullptr) == 0);
+    Require(raise_nid_postfix(19) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == continueSignal.bits[0]);
+    Require(signal_nid_postfix(19, nullptr) == nullptr);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+
+    const GuestSignalSet highSignal{{0, 1u << 7, 0, 0}};
+    Require(sigprocmask_nid_postfix(3, &highSignal, nullptr) == 0);
+    Require(raise_nid_postfix(40) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[1] == highSignal.bits[1]);
+    Require(sigaction_nid_postfix(40, &ignored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0 && pendingIgnored.bits[1] == 0);
+    Require(sigaction_nid_postfix(40, &restored, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0);
     Require(_sigintr_nid_postfix.bits[0] == 0 && _sigintr_nid_postfix.bits[1] == 0 && _sigintr_nid_postfix.bits[2] == 0 &&
         _sigintr_nid_postfix.bits[3] == 0);
     GuestSigaction interruptible{};
@@ -409,6 +442,7 @@ int main() {
     Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 &&
         interruptible.handler == reinterpret_cast<std::uintptr_t>(Callback) && interruptible.flags == 0);
     signal_nid_postfix(31, Callback);
+
     Require(sigaction_nid_postfix(31, nullptr, &interruptible) == 0 && interruptible.flags == 0x2);
     _sigintr_nid_postfix.bits[3] = 1u << 31;
     Require(signal_nid_postfix(128, Callback) == nullptr);
@@ -419,4 +453,24 @@ int main() {
     Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 && interruptible.flags == 0x2);
     Require(signal_nid_postfix(30, nullptr) == Callback && signal_nid_postfix(31, nullptr) == Callback &&
         signal_nid_postfix(128, nullptr) == Callback);
+    Require(signal_nid_postfix(30, Callback) == nullptr);
+    Require(siginterrupt_nid_postfix(30, 1) == 0 && _sigintr_nid_postfix.bits[0] == (1u << 29));
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 &&
+        interruptible.handler == reinterpret_cast<std::uintptr_t>(Callback) && interruptible.flags == 0);
+    Require(signal_nid_postfix(30, Callback) == Callback);
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 && interruptible.flags == 0);
+    Require(siginterrupt_nid_postfix(30, 0) == 0 && _sigintr_nid_postfix.bits[0] == 0);
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 &&
+        interruptible.handler == reinterpret_cast<std::uintptr_t>(Callback) && interruptible.flags == 0x2);
+    Require(siginterrupt_nid_postfix(128, 1) == 0 && _sigintr_nid_postfix.bits[3] == (1u << 31));
+    Require(sigaction_nid_postfix(128, nullptr, &interruptible) == 0 && interruptible.handler == 0 && interruptible.flags == 0);
+    Require(siginterrupt_nid_postfix(128, 0) == 0 && _sigintr_nid_postfix.bits[3] == 0);
+    Require(sigaction_nid_postfix(128, nullptr, &interruptible) == 0 && interruptible.flags == 0x2);
+    for (const int badSignal : {0, -1, 129}) {
+        *__error_nid_postfix() = 0;
+        Require(siginterrupt_nid_postfix(badSignal, 1) == -1 && *__error_nid_postfix() == 22);
+    }
+    Require(_sigintr_nid_postfix.bits[0] == 0 && _sigintr_nid_postfix.bits[3] == 0);
+    Require(signal_nid_postfix(30, nullptr) == Callback);
+    Require(sigaction_nid_postfix(128, &restored, nullptr) == 0);
 }
diff --git a/core/libs/tests/GuestSigninDialog.cpp b/core/libs/tests/GuestSigninDialog.cpp
index d8410fcbd5..7baf28dae6 100644
--- a/core/libs/tests/GuestSigninDialog.cpp
+++ b/core/libs/tests/GuestSigninDialog.cpp
@@ -1,18 +1,9 @@
+#include "prx/libSceSigninDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceSigninDialogInitialize(void);
-int APS5_VABI sceSigninDialogOpen(const void* param);
-int APS5_VABI sceSigninDialogUpdateStatus(void);
-int APS5_VABI sceSigninDialogGetStatus(void);
-int APS5_VABI sceSigninDialogGetResult(void* result);
-int APS5_VABI sceSigninDialogClose(void);
-int APS5_VABI sceSigninDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -34,8 +25,10 @@ int main() {
     std::memset(result, 0x5a, sizeof(result));
 
     Require(sceSigninDialogTerminate() == kErrNotInitialized);
+    Require(sceSigninDialogOpen(nullptr) == kErrNotInitialized);
     Require(sceSigninDialogOpen(&param) == kErrNotInitialized);
     Require(sceSigninDialogClose() == kErrNotInitialized);
+    Require(sceSigninDialogGetResult(nullptr) == kErrNotInitialized);
     Require(sceSigninDialogGetResult(result) == kErrNotInitialized);
     Require(sceSigninDialogGetStatus() == kStatusNone);
     Require(sceSigninDialogUpdateStatus() == kStatusNone);
@@ -45,6 +38,7 @@ int main() {
     Require(sceSigninDialogGetStatus() == kStatusInitialized);
 
     Require(sceSigninDialogOpen(nullptr) == kErrArgNull);
+    Require(sceSigninDialogGetResult(nullptr) == kErrNotFinished);
     Require(sceSigninDialogGetResult(result) == kErrNotFinished);
 
     Require(sceSigninDialogOpen(&param) == 0);
diff --git a/core/libs/tests/GuestSigtimedwait.cpp b/core/libs/tests/GuestSigtimedwait.cpp
index 0663a3ce2f..4c0101000c 100644
--- a/core/libs/tests/GuestSigtimedwait.cpp
+++ b/core/libs/tests/GuestSigtimedwait.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
@@ -6,13 +8,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <thread>
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-struct GuestTimespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
+
 struct GuestSiginfo {
     std::int32_t signo;
     std::int32_t error;
@@ -28,22 +24,7 @@ struct GuestSiginfo {
     std::int32_t tail;
 };
 using Handler = void (APS5_VABI *)(int);
-extern "C" {
-int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet*, void*, const GuestTimespec*);
-int APS5_VABI sigwaitinfo_nid_postfix(const GuestSignalSet*, void*);
-int APS5_VABI sigwait_nid_postfix(const GuestSignalSet*, int*);
-int APS5_VABI pause_nid_postfix(void);
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI raise_nid_postfix(int);
-int APS5_VABI kill_nid_postfix(int, int);
-int APS5_VABI _sigprocmask_nid_postfix(int, const GuestSignalSet*, GuestSignalSet*);
-int APS5_VABI getpid_nid_postfix(void);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_kill_nid_postfix(Pthread thread, int guest);
-int* APS5_VABI __error_nid_postfix();
-}
+
 volatile int received = 0;
 void APS5_VABI Callback(int value) { received = value; }
 static void Require(bool value) { if (!value) std::abort(); }
@@ -97,8 +78,8 @@ static void CheckTimeoutWithUnrelatedSignals() {
     const GuestSignalSet blocked{{(1u << 1) | (1u << 12), 0, 0, 0}};
     const GuestSignalSet pipe{{1u << 12, 0, 0, 0}};
     const GuestSignalSet interrupt{{1u << 1, 0, 0, 0}};
-    const GuestTimespec timeout{0, 200000000};
-    const GuestTimespec poll{0, 0};
+    const KernelTimespec timeout{0, 200000000};
+    const KernelTimespec poll{0, 0};
     GuestSignalSet previous{};
     Require(_sigprocmask_nid_postfix(1, &blocked, &previous) == 0);
     TimeoutSender sender{scePthreadSelf()};
@@ -122,8 +103,8 @@ int main() {
     const GuestSignalSet empty{{0, 0, 0, 0}};
     const GuestSignalSet pipe{{1u << 12, 0, 0, 0}};
     const GuestSignalSet interrupt{{1u << 1, 0, 0, 0}};
-    const GuestTimespec poll{0, 0};
-    const GuestTimespec expired{0, 1000000000};
+    const KernelTimespec poll{0, 0};
+    const KernelTimespec expired{0, 1000000000};
     GuestSiginfo info{};
     int taken = -1;
     *__error_nid_postfix() = 0;
@@ -189,7 +170,7 @@ int main() {
     Require(sigtimedwait_nid_postfix(&pipe, nullptr, nullptr) == 13);
     JoinSender(senderThread, sender);
     senderThread = StartSender(sender);
-    const GuestTimespec patience{1, 0};
+    const KernelTimespec patience{1, 0};
     Require(sigtimedwait_nid_postfix(&pipe, &info, &patience) == 13 && info.signo == 13);
     JoinSender(senderThread, sender);
     Require(signal_nid_postfix(15, Callback) != reinterpret_cast<Handler>(static_cast<std::uintptr_t>(-1)));
diff --git a/core/libs/tests/GuestSleepCancel.cpp b/core/libs/tests/GuestSleepCancel.cpp
index 463a4a0cbe..a77fbe126f 100644
--- a/core/libs/tests/GuestSleepCancel.cpp
+++ b/core/libs/tests/GuestSleepCancel.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <atomic>
@@ -9,15 +10,6 @@
 #include <string_view>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** result);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* oldState);
-void APS5_VABI scePthreadTestcancel();
-unsigned int APS5_VABI sleep_nid_postfix(unsigned int seconds);
-}
-
 static void Require(bool value, std::source_location location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "%s:%u: requirement failed\n", location.file_name(), location.line());
@@ -46,6 +38,7 @@ static void* APS5_VABI Sleeper(void*) {
     if (disabled) {
         Require(scePthreadSetcancelstate(0, nullptr) == 0);
         scePthreadTestcancel();
+
         Require(false);
     }
     return nullptr;
diff --git a/core/libs/tests/GuestSleepWake.cpp b/core/libs/tests/GuestSleepWake.cpp
index 177ef4b990..d4477301c6 100644
--- a/core/libs/tests/GuestSleepWake.cpp
+++ b/core/libs/tests/GuestSleepWake.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -6,7 +7,7 @@
 #include <thread>
 
 extern "C" {
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
+
 void KernelWakeSleepers_nid_no_patch();
 void KernelNoteGpuSubmit_nid_no_patch();
 }
diff --git a/core/libs/tests/GuestSocialScreenDialog.cpp b/core/libs/tests/GuestSocialScreenDialog.cpp
index 61d42e6488..dcbb9c085e 100644
--- a/core/libs/tests/GuestSocialScreenDialog.cpp
+++ b/core/libs/tests/GuestSocialScreenDialog.cpp
@@ -1,17 +1,8 @@
+#include "prx/libSceSocialScreenDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceSocialScreenDialogInitialize(void);
-int APS5_VABI sceSocialScreenDialogOpen(const void* param);
-int APS5_VABI sceSocialScreenDialogUpdateStatus(void);
-int APS5_VABI sceSocialScreenDialogGetStatus(void);
-int APS5_VABI sceSocialScreenDialogGetResult(void* result);
-int APS5_VABI sceSocialScreenDialogClose(void);
-int APS5_VABI sceSocialScreenDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestSocketAddressLength.cpp b/core/libs/tests/GuestSocketAddressLength.cpp
index d18dd5910c..e2b7017eec 100644
--- a/core/libs/tests/GuestSocketAddressLength.cpp
+++ b/core/libs/tests/GuestSocketAddressLength.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -5,21 +7,13 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int Stream = 1;
 constexpr int Datagram = 2;
 constexpr int ErrorFault = 14;
 constexpr int ErrorInvalid = 22;
+constexpr int ErrorAddressFamilyNotSupported = 47;
 constexpr int ErrorNameTooLong = 63;
 
 void Require(bool condition, const char* what) {
@@ -51,6 +45,7 @@ void ShortAddressesAreInvalid() {
     const int stream6 = socket_nid_postfix(28, Stream, 0);
     Require(stream6 >= 0, "socket failed");
     Require(Fails(connect_nid_postfix(stream6, v6.data(), 20), ErrorInvalid), "connect with an AF_INET6 address shorter than sockaddr_in6 must fail with EINVAL (22)");
+    Require(Fails(bind_nid_postfix(stream6, v6.data(), 20), ErrorInvalid), "bind with an AF_INET6 address shorter than sockaddr_in6 must fail with EINVAL (22)");
     Require(Fails(bind_nid_postfix(stream, address.data(), 256), ErrorNameTooLong), "an address longer than SOCK_MAXADDRLEN (255) must fail with ENAMETOOLONG (63)");
     Require(Fails(bind_nid_postfix(stream, nullptr, address.size()), ErrorFault), "a null address must fail with EFAULT (14)");
     Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0 && close_nid_postfix(stream6) == 0, "close failed");
@@ -69,6 +64,70 @@ void ArgumentsAreCheckedBeforeTheDescriptor() {
     Require(Fails(sendto_nid_postfix(-1, "x", 1, 0, address.data(), address.size()), ErrorBadDescriptor), "sendto(-1) with a valid address must fail with EBADF (9)");
 }
 
+void LongAddressesAndOtherFamiliesFail() {
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    const int stream6 = socket_nid_postfix(28, Stream, 0);
+    const int datagram6 = socket_nid_postfix(28, Datagram, 0);
+    Require(datagram >= 0 && stream6 >= 0 && datagram6 >= 0, "socket failed");
+    std::array<std::uint8_t, 255> address{16, 2};
+    address[4] = 127;
+    address[7] = 1;
+    for (const std::uint32_t length : {17u, 28u, 255u}) {
+        Require(Fails(bind_nid_postfix(datagram, address.data(), length), ErrorInvalid), "bind with an AF_INET address longer than sockaddr_in must fail with EINVAL (22)");
+        Require(Fails(connect_nid_postfix(datagram, address.data(), length), ErrorInvalid), "connect with an AF_INET address longer than sockaddr_in must fail with EINVAL (22)");
+        Require(Fails(sendto_nid_postfix(datagram, "x", 1, 0, address.data(), length), ErrorInvalid), "sendto with an AF_INET address longer than sockaddr_in must fail with EINVAL (22)");
+    }
+    std::array<std::uint8_t, 64> v6{28, 28};
+    v6[23] = 1;
+    Require(Fails(bind_nid_postfix(stream6, v6.data(), 29), ErrorInvalid), "bind with an AF_INET6 address longer than sockaddr_in6 must fail with EINVAL (22)");
+    Require(Fails(connect_nid_postfix(stream6, v6.data(), 64), ErrorInvalid), "connect with an AF_INET6 address longer than sockaddr_in6 must fail with EINVAL (22)");
+    for (const std::uint8_t family : {std::uint8_t{28}, std::uint8_t{1}, std::uint8_t{0}}) {
+        address[1] = family;
+        Require(Fails(bind_nid_postfix(datagram, address.data(), 16), ErrorAddressFamilyNotSupported), "bind of another family on an AF_INET socket must fail with EAFNOSUPPORT (47)");
+    }
+    address[1] = 28;
+    Require(Fails(sendto_nid_postfix(datagram, "x", 1, 0, address.data(), 28), ErrorInvalid), "sendto checks the length before the family");
+    Require(Fails(sendto_nid_postfix(datagram, "x", 1, 0, address.data(), 16), ErrorAddressFamilyNotSupported), "sendto of another family fails with EAFNOSUPPORT (47)");
+    address[1] = 2;
+    Require(Fails(bind_nid_postfix(datagram6, address.data(), 16), ErrorInvalid), "an AF_INET6 socket checks the length before the family");
+    Require(Fails(connect_nid_postfix(datagram6, address.data(), 28), ErrorAddressFamilyNotSupported), "an AF_INET address of the AF_INET6 length fails with EAFNOSUPPORT (47)");
+    Require(close_nid_postfix(datagram) == 0 && close_nid_postfix(stream6) == 0 && close_nid_postfix(datagram6) == 0, "close failed");
+}
+
+void ConnectedStreamSendtoIgnoresTheAddress() {
+    const int listener = socket_nid_postfix(2, Stream, 0);
+    const int client = socket_nid_postfix(2, Stream, 0);
+    Require(listener >= 0 && client >= 0, "socket failed");
+    auto address = Loopback();
+    Require(bind_nid_postfix(listener, address.data(), address.size()) == 0 && listen_nid_postfix(listener, 1) == 0, "listen failed");
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(listener, address.data(), &size) == 0, "getsockname failed");
+    Require(connect_nid_postfix(client, address.data(), address.size()) == 0, "connect failed");
+    std::array<std::uint8_t, 17> padded{};
+    std::memcpy(padded.data(), address.data(), address.size());
+    Require(sendto_nid_postfix(client, "x", 1, 0, padded.data(), padded.size()) == 1, "tcp_usr_send ignores the address of a connected stream socket, so sendto must send");
+    Require(Fails(sendto_nid_postfix(client, "x", 1, 0, padded.data(), 1), ErrorInvalid), "getsockaddr still checks the length of a connected stream socket's address");
+    Require(close_nid_postfix(client) == 0 && close_nid_postfix(listener) == 0, "close failed");
+}
+
+void MismatchedAndUnknownFamiliesFail() {
+    const int stream = socket_nid_postfix(2, Stream, 0);
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    const int stream6 = socket_nid_postfix(28, Stream, 0);
+    const int datagram6 = socket_nid_postfix(28, Datagram, 0);
+    Require(stream >= 0 && datagram >= 0 && stream6 >= 0 && datagram6 >= 0, "socket failed");
+    const auto address = Loopback();
+    Require(Fails(bind_nid_postfix(stream6, address.data(), address.size()), ErrorInvalid), "bind with an AF_INET address on an AF_INET6 socket must fail with EINVAL (22)");
+    std::array<std::uint8_t, 16> unknownFamily{16, 99};
+    Require(Fails(connect_nid_postfix(stream, unknownFamily.data(), unknownFamily.size()), ErrorAddressFamilyNotSupported), "connect with an unknown family must fail with EAFNOSUPPORT (47)");
+    Require(Fails(sendto_nid_postfix(datagram, "x", 1, 0, unknownFamily.data(), unknownFamily.size()), ErrorAddressFamilyNotSupported), "sendto with an unknown family must fail with EAFNOSUPPORT (47)");
+    std::array<std::uint8_t, 28> unknownFamily6{28, 99};
+    Require(Fails(bind_nid_postfix(stream6, unknownFamily6.data(), unknownFamily6.size()), ErrorAddressFamilyNotSupported), "bind with an unknown family must fail with EAFNOSUPPORT (47)");
+    Require(Fails(connect_nid_postfix(stream6, unknownFamily6.data(), unknownFamily6.size()), ErrorAddressFamilyNotSupported), "connect with an unknown family must fail with EAFNOSUPPORT (47)");
+    Require(Fails(sendto_nid_postfix(datagram6, "x", 1, 0, unknownFamily6.data(), unknownFamily6.size()), ErrorAddressFamilyNotSupported), "sendto with an unknown family must fail with EAFNOSUPPORT (47)");
+    Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0 && close_nid_postfix(stream6) == 0 && close_nid_postfix(datagram6) == 0, "close failed");
+}
+
 void FullAddressesStillWork() {
     const int stream = socket_nid_postfix(2, Stream, 0);
     Require(stream >= 0, "socket failed");
@@ -77,11 +136,77 @@ void FullAddressesStillWork() {
     Require(close_nid_postfix(stream) == 0, "close failed");
 }
 
+std::array<std::uint8_t, 255> PaddedLoopback(int family) {
+    std::array<std::uint8_t, 255> address{};
+    if (family == 2) {
+        const auto v4 = Loopback();
+        std::memcpy(address.data(), v4.data(), v4.size());
+    } else {
+        address[0] = 28;
+        address[1] = 28;
+        address[23] = 1;
+    }
+    return address;
+}
+
+void LongAddressesAreInvalid(int family, int type) {
+    const std::uint32_t size = family == 2 ? 16 : 28;
+    auto address = PaddedLoopback(family);
+    const int descriptor = socket_nid_postfix(family, type, 0);
+    const int listener = type == Stream ? socket_nid_postfix(family, Stream, 0) : descriptor;
+    Require(descriptor >= 0 && listener >= 0, "socket failed");
+    for (std::uint32_t length = size + 1; length <= address.size(); ++length) {
+        Require(Fails(bind_nid_postfix(descriptor, address.data(), length), ErrorInvalid), "bind with an address longer than sockaddr_in or sockaddr_in6 must fail with EINVAL (22)");
+    }
+    Require(bind_nid_postfix(listener, address.data(), size) == 0, "bind with an address of exactly the size of sockaddr_in or sockaddr_in6 failed");
+    if (type == Stream) Require(listen_nid_postfix(listener, 1) == 0, "listen failed");
+    std::uint32_t named = size;
+    Require(getsockname_nid_postfix(listener, address.data(), &named) == 0 && named == size, "getsockname failed");
+    for (std::uint32_t length = size + 1; length <= address.size(); ++length) {
+        Require(Fails(connect_nid_postfix(descriptor, address.data(), length), ErrorInvalid), "connect with an address longer than sockaddr_in or sockaddr_in6 must fail with EINVAL (22)");
+    }
+    if (family == 28 && type == Datagram) {
+        for (std::uint32_t length = size + 1; length <= address.size(); ++length) {
+            Require(Fails(sendto_nid_postfix(descriptor, "x", 1, 0, address.data(), length), ErrorInvalid), "sendto on an AF_INET6 datagram socket with an address longer than sockaddr_in6 must fail with EINVAL (22)");
+        }
+        Require(sendto_nid_postfix(descriptor, "x", 1, 0, address.data(), size) == 1, "sendto with an address of exactly the size of sockaddr_in6 failed");
+    }
+    Require(connect_nid_postfix(descriptor, address.data(), size) == 0, "connect with an address of exactly the size of sockaddr_in or sockaddr_in6 failed");
+    Require(close_nid_postfix(descriptor) == 0, "close failed");
+    if (listener != descriptor) Require(close_nid_postfix(listener) == 0, "close failed");
+}
+
+void LongMappedAddressesBindOnlyDualStackDatagramSockets() {
+    const int datagram = socket_nid_postfix(28, Datagram, 0);
+    Require(datagram >= 0, "socket failed");
+    std::array<std::uint8_t, 29> mapped{29, 28};
+    mapped[18] = 0xff;
+    mapped[19] = 0xff;
+    mapped[20] = 127;
+    mapped[23] = 1;
+    Require(Fails(bind_nid_postfix(datagram, mapped.data(), mapped.size()), ErrorInvalid), "bind of a long IPv4-mapped address with IPV6_V6ONLY set must fail with EINVAL (22)");
+    const int off = 0;
+    Require(setsockopt_nid_postfix(datagram, 41, 27, &off, sizeof(off)) == 0, "clearing IPV6_V6ONLY failed");
+    Require(bind_nid_postfix(datagram, mapped.data(), mapped.size()) == 0, "udp6_bind passes a long IPv4-mapped address to in_pcbbind without IPV6_V6ONLY, so bind must succeed");
+    Require(Fails(sendto_nid_postfix(datagram, "x", 1, 0, mapped.data(), mapped.size()), ErrorInvalid), "udp6_send checks the length before the IPv4-mapped case, so sendto must fail with EINVAL (22)");
+    mapped[3] = 9;
+    Require(connect_nid_postfix(datagram, mapped.data(), mapped.size()) == 0, "udp6_connect passes a long IPv4-mapped address to in_pcbconnect without IPV6_V6ONLY, so connect must succeed");
+    Require(close_nid_postfix(datagram) == 0, "close failed");
+}
+
 }
 
 int main() {
     ShortAddressesAreInvalid();
     ArgumentsAreCheckedBeforeTheDescriptor();
+    LongAddressesAndOtherFamiliesFail();
+    ConnectedStreamSendtoIgnoresTheAddress();
+    MismatchedAndUnknownFamiliesFail();
     FullAddressesStillWork();
+    LongAddressesAreInvalid(2, Stream);
+    LongAddressesAreInvalid(2, Datagram);
+    LongAddressesAreInvalid(28, Stream);
+    LongAddressesAreInvalid(28, Datagram);
+    LongMappedAddressesBindOnlyDualStackDatagramSockets();
     return 0;
 }
diff --git a/core/libs/tests/GuestSocketConnectListening.cpp b/core/libs/tests/GuestSocketConnectListening.cpp
index 0f42c12bdb..fb5e900c3d 100644
--- a/core/libs/tests/GuestSocketConnectListening.cpp
+++ b/core/libs/tests/GuestSocketConnectListening.cpp
@@ -1,20 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int Inet = 2;
diff --git a/core/libs/tests/GuestSocketDescriptorFlags.cpp b/core/libs/tests/GuestSocketDescriptorFlags.cpp
index ef8772f738..6d14f3997a 100644
--- a/core/libs/tests/GuestSocketDescriptorFlags.cpp
+++ b/core/libs/tests/GuestSocketDescriptorFlags.cpp
@@ -1,18 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int DuplicateDescriptor = 0;
diff --git a/core/libs/tests/GuestSocketDescriptors.cpp b/core/libs/tests/GuestSocketDescriptors.cpp
index 9a0ac4f5e6..3a66b41464 100644
--- a/core/libs/tests/GuestSocketDescriptors.cpp
+++ b/core/libs/tests/GuestSocketDescriptors.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -25,32 +28,6 @@ struct GuestDescriptorSet {
     }
 };
 
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket descriptor check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -159,7 +136,7 @@ static void CloseReleasesNumber() {
     Require(files.back() == socket);
     unsigned char bytes[4]{};
     Require(read_nid_postfix(socket, bytes, sizeof(bytes)) == sizeof(bytes));
-    PollDescriptor entry{socket, In, 0};
+    GuestPollDescriptor entry{socket, In, 0};
     Require(poll_nid_postfix(&entry, 1, 0) == 1 && entry.revents == In);
     for (const int file : files) Require(close_nid_postfix(file) == 0);
     const int kernelClosed = Socket();
diff --git a/core/libs/tests/GuestSocketEvents.cpp b/core/libs/tests/GuestSocketEvents.cpp
index 1ef4eea859..59bd2bb4ad 100644
--- a/core/libs/tests/GuestSocketEvents.cpp
+++ b/core/libs/tests/GuestSocketEvents.cpp
@@ -1,37 +1,17 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
+#include <atomic>
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
+#include <filesystem>
 #include <stdexcept>
+#include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddReadEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
-int APS5_VABI sceKernelDeleteReadEvent(KernelEqueue eq, int fd);
-int APS5_VABI sceKernelAddWriteEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
-int APS5_VABI sceKernelDeleteWriteEvent(KernelEqueue eq, int fd);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ENOENT = static_cast<int>(0x80020002);
-static constexpr int SCE_KERNEL_ERROR_EBADF = static_cast<int>(0x80020009);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003c);
 static constexpr int EVFILT_READ = -1;
 static constexpr int EVFILT_WRITE = -2;
 static constexpr std::uint16_t EV_EOF = 0x8000;
@@ -96,8 +76,83 @@ static void PipeReadEvents() {
     Require(sceKernelDeleteEqueue(eq) == SCE_OK);
 }
 
+static void RegularFileEvents() {
+    const std::string path = "anyps5-equeue-file-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const int file = open_nid_postfix(path.c_str(), 0x0002 | 0x0200, 0644);
+    Require(file >= 0);
+    Require(write_nid_postfix(file, "0123456789", 10) == 10);
+    Require(lseek_nid_postfix(file, 2, 0) == 2);
+    KernelEqueue eq = 0;
+    Require(sceKernelCreateEqueue(&eq, "file") == SCE_OK);
+    const KernelUseconds shortTimeout = 20000;
+    const KernelUseconds timeout = 1000000;
+    int marker = 0;
+    int count = 0;
+    std::array<KernelEvent, 4> events{};
+    Require(sceKernelAddReadEvent(eq, file, 1, &marker) == SCE_OK);
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &timeout) == SCE_OK);
+    Require(count == 1 && events[0].ident == static_cast<std::uintptr_t>(file) && events[0].filter == EVFILT_READ);
+    Require(events[0].data == 8 && events[0].udata == &marker);
+    Require(lseek_nid_postfix(file, 0, 2) == 10);
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &shortTimeout) == SCE_KERNEL_ERROR_ETIMEDOUT);
+    const int appender = open_nid_postfix(path.c_str(), 0x0002, 0);
+    Require(appender >= 0);
+    std::thread writer([appender] {
+        std::this_thread::sleep_for(std::chrono::milliseconds(50));
+        Require(lseek_nid_postfix(appender, 0, 2) == 10);
+        Require(write_nid_postfix(appender, "abc", 3) == 3);
+    });
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, nullptr) == SCE_OK);
+    writer.join();
+    Require(count == 1 && events[0].data == 3);
+    Require(sceKernelDeleteReadEvent(eq, file) == SCE_OK);
+    Require(sceKernelAddWriteEvent(eq, file, 0, nullptr) == SCE_OK);
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &timeout) == SCE_OK);
+    Require(count == 1 && events[0].filter == EVFILT_WRITE && events[0].data == 0);
+    Require(sceKernelDeleteWriteEvent(eq, file) == SCE_OK);
+    Require(Rejects(sceKernelAddReadEvent, eq, file, 64));
+    Require(Rejects(sceKernelAddWriteEvent, eq, file, 64));
+    Require(sceKernelAddReadEvent(eq, file, 0, nullptr) == SCE_OK);
+    Require(close_nid_postfix(file) == 0);
+    Require(sceKernelDeleteReadEvent(eq, file) == SCE_KERNEL_ERROR_ENOENT);
+    Require(sceKernelAddReadEvent(eq, file, 0, nullptr) == SCE_KERNEL_ERROR_EBADF);
+    Require(close_nid_postfix(appender) == 0);
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+    Require(std::filesystem::remove(path));
+}
+
+static void CloseWhileWaitingOnFile() {
+    const std::string path = "anyps5-equeue-close-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const int created = open_nid_postfix(path.c_str(), 0x0002 | 0x0200, 0644);
+    Require(created >= 0);
+    Require(close_nid_postfix(created) == 0);
+    KernelEqueue eq = 0;
+    Require(sceKernelCreateEqueue(&eq, "close") == SCE_OK);
+    std::atomic<bool> stop{false};
+    std::thread waiter([eq, &stop] {
+        const KernelUseconds timeout = 1000;
+        std::array<KernelEvent, 4> events{};
+        int count = 0;
+        while (!stop.load()) {
+            Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &timeout) == SCE_KERNEL_ERROR_ETIMEDOUT);
+        }
+    });
+    for (int i = 0; i < 2000; ++i) {
+        const int file = open_nid_postfix(path.c_str(), 0x0002, 0);
+        Require(file >= 0);
+        Require(sceKernelAddReadEvent(eq, file, 0, nullptr) == SCE_OK);
+        Require(close_nid_postfix(file) == 0);
+    }
+    stop.store(true);
+    waiter.join();
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+    Require(std::filesystem::remove(path));
+}
+
 int main() {
     PipeReadEvents();
+    RegularFileEvents();
+    CloseWhileWaitingOnFile();
     const int listener = socket_nid_postfix(2, 1, 6);
     Require(listener >= 0);
     std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
diff --git a/core/libs/tests/GuestSocketHostWrite.cpp b/core/libs/tests/GuestSocketHostWrite.cpp
index df022d1f8a..a49e49d08d 100644
--- a/core/libs/tests/GuestSocketHostWrite.cpp
+++ b/core/libs/tests/GuestSocketHostWrite.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #include "prx/libc/include/GuestArena.hpp"
@@ -12,57 +16,8 @@
 #include <cstring>
 #include <thread>
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t nameLength;
-    NetIovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
 static_assert(sizeof(NetMsghdr) == 48 && offsetof(NetMsghdr, iov) == 16 && offsetof(NetMsghdr, flags) == 44);
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetListen(int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetAccept(int, void*, std::uint32_t*);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetRecvmsg(int, NetMsghdr*, int);
-int APS5_VABI sceNetSocketClose(int);
-int* APS5_VABI sceNetErrnoLoc();
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMprotect(void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -94,6 +49,7 @@ int main(int argc, char** argv) {
     const auto create = [&] {
         return net ? sceNetSocket(nullptr, 2, stream ? 1 : 2, stream ? 6 : 17) :
             socket_nid_postfix(2, stream ? 1 : 2, stream ? 6 : 17);
+
     };
     int receiver = create();
     const int sender = create();
@@ -156,6 +112,7 @@ int main(int argc, char** argv) {
         do {
             result = net ? sceNetRecv(receiver, buffer.data(), buffer.size(), 2) :
                 recv_nid_postfix(receiver, buffer.data(), buffer.size(), 2);
+
             if (result == sizeof(payload) || (result < 0 && *error != 35)) break;
             std::this_thread::sleep_for(std::chrono::milliseconds(1));
         } while (std::chrono::steady_clock::now() < deadline);
@@ -312,8 +269,8 @@ int main(int argc, char** argv) {
             Require(sceKernelMprotect(static_cast<char*>(outputMapping) + page, page, 3) == 0,
                 "restore bytes beyond the sender address");
         }
-        Require(sceKernelMunmap(outputTwin, page * 2) == 0, "unmap the second sender output mapping");
-        Require(sceKernelMunmap(outputMapping, page * 2) == 0, "unmap sender outputs");
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(outputTwin), page * 2) == 0, "unmap the second sender output mapping");
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(outputMapping), page * 2) == 0, "unmap sender outputs");
         Require(sceKernelReleaseDirectMemory(outputPhysical, page * 2) == 0, "release sender output memory");
     }
     reset();
@@ -355,7 +312,7 @@ int main(int argc, char** argv) {
         waitForPacket();
         Require(sceNetRecvmsg(receiver, message, 0) == static_cast<int>(0x8041010eu) && *error == 14,
             "read-only message outputs fail with EFAULT");
-        Require(message->flags == -1 && message->controlLength == 123, "rejected message outputs unchanged");
+        Require(message->flags == -1 && message->control_length == 123, "rejected message outputs unchanged");
         Require(receive(recovery.data(), recovery.size(), 0, nullptr, nullptr) == sizeof(payload),
             "a rejected message preserves queued data");
         Require(sceKernelMprotect(twin, page, 3) == 0, "restore receive message write permission");
@@ -411,7 +368,7 @@ int main(int argc, char** argv) {
     Require(Protection(buffer) == PAGE_READONLY, "completed receive can be rearmed");
     Require((net ? sceNetSocketClose(sender) : close_nid_postfix(sender)) == 0, "close sender");
     Require((net ? sceNetSocketClose(receiver) : close_nid_postfix(receiver)) == 0, "close receiver");
-    Require(sceKernelMunmap(twin, page * 2) == 0, "unmap the second direct memory mapping");
-    Require(sceKernelMunmap(mapping, page * 2) == 0, "unmap direct memory");
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(twin), page * 2) == 0, "unmap the second direct memory mapping");
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), page * 2) == 0, "unmap direct memory");
     Require(sceKernelReleaseDirectMemory(physical, page * 2) == 0, "release direct memory");
 }
diff --git a/core/libs/tests/GuestSocketOnNonSocket.cpp b/core/libs/tests/GuestSocketOnNonSocket.cpp
index 953bd473d0..49c9d54ea0 100644
--- a/core/libs/tests/GuestSocketOnNonSocket.cpp
+++ b/core/libs/tests/GuestSocketOnNonSocket.cpp
@@ -1,25 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI shutdown_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ErrorBadDescriptor = 9;
diff --git a/core/libs/tests/GuestSocketOptions.cpp b/core/libs/tests/GuestSocketOptions.cpp
index 7ab20ba2f4..7c73a6f364 100644
--- a/core/libs/tests/GuestSocketOptions.cpp
+++ b/core/libs/tests/GuestSocketOptions.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -5,21 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI poll_nid_postfix(void*, std::uint32_t, int);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int Stream = 1;
@@ -35,6 +22,9 @@ constexpr int SoReusePort = 0x200;
 constexpr int SoTimestamp = 0x400;
 constexpr int SoNoSigpipe = 0x800;
 constexpr int SoSendBuffer = 0x1001;
+constexpr int SoReceiveBuffer = 0x1002;
+constexpr int SoSendLowWater = 0x1003;
+constexpr int SoReceiveLowWater = 0x1004;
 constexpr int SoError = 0x1007;
 constexpr int SoType = 0x1008;
 constexpr int ErrorInvalid = 22;
@@ -48,12 +38,6 @@ struct Linger {
     std::int32_t seconds;
 };
 
-struct PollDescriptor {
-    std::int32_t descriptor;
-    std::int16_t events;
-    std::int16_t revents;
-};
-
 void Require(bool condition, const char* what) {
     if (condition) return;
     std::fprintf(stderr, "%s (errno %d)\n", what, *__error_nid_postfix());
@@ -95,7 +79,7 @@ std::array<std::uint8_t, 16> Listen(int* listener) {
 }
 
 void WaitUntilSettled(int descriptor) {
-    PollDescriptor entry{descriptor, 0x1 | 0x4, 0};
+    GuestPollDescriptor entry{descriptor, 0x1 | 0x4, 0};
     Require(poll_nid_postfix(&entry, 1, 6000) == 1, "the nonblocking connect did not settle within 6 s");
 }
 
@@ -154,16 +138,41 @@ void BooleanOptionsReportTheirBit() {
     Require(GetInt(datagram, SoBroadcast) == SoBroadcast, "SO_BROADCAST reads back as its bit");
     SetInt(stream, SoNoSigpipe, 1);
     Require(GetInt(stream, SoNoSigpipe) == SoNoSigpipe, "SO_NOSIGPIPE reads back as its bit");
-    for (const int option : {SoReusePort, SoDebug, SoUseLoopback, SoTimestamp}) {
-        const int one = 1;
-        Require(SetFails(stream, SolSocket, option, &one, sizeof(one), ErrorNoProtocolOption), "an option no title needs must fail with ENOPROTOOPT (42)");
+    for (const int option : {SoReusePort, SoDebug, SoUseLoopback, SoTimestamp, 0x2000, 0x10000}) {
+        Require(GetInt(stream, option) == 0, "a kept flag starts off");
+        SetInt(stream, option, 5);
+        Require(GetInt(stream, option) == option, "a kept flag reads back as its bit");
+        SetInt(stream, option, 0);
+        Require(GetInt(stream, option) == 0, "a kept flag turns off");
+    }
+    for (const int option : {0x4000, 0x8000}) {
+        SetInt(stream, option, 1);
         int value = 0;
         std::uint32_t size = sizeof(value);
-        Require(getsockopt_nid_postfix(stream, SolSocket, option, &value, &size) == -1 && *__error_nid_postfix() == ErrorNoProtocolOption, "getsockopt of an option no title needs must fail with ENOPROTOOPT (42)");
+        Require(getsockopt_nid_postfix(stream, SolSocket, option, &value, &size) == -1 && *__error_nid_postfix() == ErrorNoProtocolOption, "SO_NO_OFFLOAD and SO_NO_DDP are accepted but cannot be read");
     }
+    const unsigned char narrowFlag = 1;
+    Require(SetFails(stream, SolSocket, SoDebug, &narrowFlag, 1, ErrorInvalid), "a flag shorter than an int must fail with EINVAL (22)");
     Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0, "close failed");
 }
 
+void ReusePortSharesAPort() {
+    const int first = socket_nid_postfix(2, Datagram, 0);
+    const int second = socket_nid_postfix(2, Datagram, 0);
+    const int third = socket_nid_postfix(2, Datagram, 0);
+    Require(first >= 0 && second >= 0 && third >= 0, "socket failed");
+    SetInt(first, SoReusePort, 1);
+    SetInt(second, SoReusePort, 1);
+    Require(GetInt(first, SoReusePort) == SoReusePort && GetInt(first, 0x4) == 0, "SO_REUSEPORT does not read back as SO_REUSEADDR");
+    auto address = Loopback(0);
+    Require(bind_nid_postfix(first, address.data(), address.size()) == 0, "bind failed");
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(first, address.data(), &size) == 0, "getsockname failed");
+    Require(bind_nid_postfix(second, address.data(), address.size()) == 0, "a second SO_REUSEPORT socket must bind the same port");
+    Require(bind_nid_postfix(third, address.data(), address.size()) == -1 && *__error_nid_postfix() == 48, "a socket without SO_REUSEPORT must fail with EADDRINUSE (48)");
+    Require(close_nid_postfix(first) == 0 && close_nid_postfix(second) == 0 && close_nid_postfix(third) == 0, "close failed");
+}
+
 void LingerFollowsFreeBsd() {
     const int stream = socket_nid_postfix(2, Stream, 0);
     Require(stream >= 0, "socket failed");
@@ -204,6 +213,176 @@ void LengthsFollowFreeBsd() {
     Require(close_nid_postfix(stream) == 0, "close failed");
 }
 
+void BuffersFollowThePs5() {
+    const int stream = socket_nid_postfix(2, Stream, 0);
+    const int datagram = socket_nid_postfix(28, Datagram, 0);
+    Require(stream >= 0 && datagram >= 0, "socket failed");
+    Require(GetInt(stream, SoSendBuffer) == 32768 && GetInt(stream, SoReceiveBuffer) == 65536, "a stream socket starts with 32768 and 65536 bytes");
+    Require(GetInt(stream, SoSendLowWater) == 2048 && GetInt(stream, SoReceiveLowWater) == 1, "the low-water marks start at 2048 and 1");
+    Require(GetInt(datagram, SoSendBuffer) == 9216 && GetInt(datagram, SoReceiveBuffer) == 42080, "a datagram socket starts with 9216 and 42080 bytes");
+    SetInt(stream, SoSendBuffer, 1000);
+    Require(GetInt(stream, SoSendBuffer) == 1000 && GetInt(stream, SoSendLowWater) == 1000, "a smaller buffer is kept and lowers its low-water mark");
+    SetInt(stream, SoReceiveBuffer, 524289);
+    Require(GetInt(stream, SoReceiveBuffer) == 524288, "a buffer above 512 KiB is limited to 524288 bytes");
+    SetInt(stream, SoSendBuffer, 5592405);
+    Require(GetInt(stream, SoSendBuffer) == 524288, "the largest reservation is accepted and limited");
+    const int tooLarge = 5592406;
+    Require(SetFails(stream, SolSocket, SoSendBuffer, &tooLarge, sizeof(tooLarge), 55), "a reservation above sb_max must fail with ENOBUFS (55)");
+    Require(GetInt(stream, SoSendBuffer) == 524288, "a failed reservation keeps the buffer");
+    SetInt(stream, SoReceiveLowWater, 600000);
+    Require(GetInt(stream, SoReceiveLowWater) == 524288, "a low-water mark above the buffer is limited to it");
+    SetInt(stream, SoReceiveBuffer, 50);
+    Require(GetInt(stream, SoReceiveLowWater) == 50, "a smaller buffer lowers the low-water mark");
+    const int zero = 0;
+    Require(SetFails(stream, SolSocket, SoReceiveLowWater, &zero, sizeof(zero), ErrorInvalid), "a low-water mark below 1 must fail with EINVAL (22)");
+    int pair[2] = {-1, -1};
+    Require(socketpair_nid_postfix(1, Stream, 0, pair) == 0, "socketpair failed");
+    Require(GetInt(pair[0], SoSendBuffer) == 8192 && GetInt(pair[0], SoReceiveBuffer) == 8192, "an AF_UNIX stream socket starts with 8192 bytes each way");
+    Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0, "close failed");
+    Require(socketpair_nid_postfix(1, Datagram, 0, pair) == 0, "socketpair failed");
+    Require(GetInt(pair[0], SoSendBuffer) == 2048 && GetInt(pair[0], SoReceiveBuffer) == 4096, "an AF_UNIX datagram socket starts with 2048 and 4096 bytes");
+    Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0, "close failed");
+    Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0, "close failed");
+    const int listener = socket_nid_postfix(2, Stream, 0);
+    Require(listener >= 0, "socket failed");
+    auto address = Loopback(0);
+    Require(bind_nid_postfix(listener, address.data(), address.size()) == 0 && listen_nid_postfix(listener, 1) == 0, "listen failed");
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(listener, address.data(), &size) == 0, "getsockname failed");
+    SetInt(listener, SoReceiveBuffer, 3000);
+    SetInt(listener, SoSendLowWater, 700);
+    const int client = socket_nid_postfix(2, Stream, 0);
+    Require(client >= 0 && connect_nid_postfix(client, address.data(), address.size()) == 0, "connect failed");
+    const int accepted = accept_nid_postfix(listener, nullptr, nullptr);
+    Require(accepted >= 0, "accept failed");
+    Require(GetInt(accepted, SoReceiveBuffer) == 3000 && GetInt(accepted, SoSendLowWater) == 700 && GetInt(accepted, SoSendBuffer) == 32768, "an accepted socket takes the listener's buffers");
+    Require(close_nid_postfix(accepted) == 0 && close_nid_postfix(client) == 0 && close_nid_postfix(listener) == 0, "close failed");
+}
+
+void NullValues() {
+    const int stream = socket_nid_postfix(2, Stream, 0);
+    Require(stream >= 0, "socket failed");
+    Require(SetFails(stream, SolSocket, SoKeepAlive, nullptr, sizeof(int), 14), "a null value with a length must fail with EFAULT (14)");
+    Require(SetFails(-1, SolSocket, SoKeepAlive, nullptr, sizeof(int), 14), "the null value is checked before the descriptor");
+    Require(SetFails(stream, SolSocket, 0x7fff, nullptr, sizeof(int), 14), "the null value is checked before the option");
+    Require(SetFails(stream, SolSocket, SoKeepAlive, nullptr, 0, ErrorInvalid), "a null value without a length must fail with EINVAL (22)");
+    std::uint32_t size = sizeof(int);
+    Require(getsockopt_nid_postfix(stream, SolSocket, SoSendBuffer, nullptr, &size) == 0 && size == 0, "getsockopt without a value succeeds with length 0");
+    Require(close_nid_postfix(stream) == 0, "close failed");
+}
+
+int GetIp(int descriptor, int option) {
+    int value = -12345;
+    std::uint32_t size = sizeof(value);
+    Require(getsockopt_nid_postfix(descriptor, 0, option, &value, &size) == 0 && size == sizeof(value), "getsockopt of an IPPROTO_IP option failed");
+    return value;
+}
+
+bool SetIp(int descriptor, int option, int value) {
+    return setsockopt_nid_postfix(descriptor, 0, option, &value, sizeof(value)) == 0;
+}
+
+void IpLevelFollowsThePs5() {
+    constexpr int IpTypeOfService = 3;
+    constexpr int IpTimeToLive = 4;
+    constexpr int IpMulticastTimeToLive = 10;
+    constexpr int IpMulticastLoop = 11;
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    const int datagram6 = socket_nid_postfix(28, Datagram, 0);
+    Require(datagram >= 0 && datagram6 >= 0, "socket failed");
+    Require(GetIp(datagram, IpTimeToLive) == 64 && GetIp(datagram, IpTypeOfService) == 0, "IP_TTL starts at 64 and IP_TOS at 0");
+    Require(GetIp(datagram, IpMulticastTimeToLive) == 1 && GetIp(datagram, IpMulticastLoop) == 1, "IP_MULTICAST_TTL and IP_MULTICAST_LOOP start at 1");
+    Require(SetIp(datagram, IpTimeToLive, 32) && GetIp(datagram, IpTimeToLive) == 32, "IP_TTL reads back");
+    Require(SetIp(datagram, IpTimeToLive, 300) && GetIp(datagram, IpTimeToLive) == 44, "IP_TTL keeps the low byte");
+    Require(SetIp(datagram, IpTimeToLive, -1) && GetIp(datagram, IpTimeToLive) == 255, "IP_TTL of -1 reads back as 255");
+    Require(SetIp(datagram, IpTimeToLive, 0) && GetIp(datagram, IpTimeToLive) == 0, "IP_TTL of 0 is kept");
+    const unsigned char byte = 9;
+    Require(SetFails(datagram, 0, IpTimeToLive, &byte, 1, ErrorInvalid), "a one-byte IP_TTL must fail with EINVAL (22)");
+    Require(SetIp(datagram, IpTypeOfService, 0x1ff) && GetIp(datagram, IpTypeOfService) == 0xff, "IP_TOS keeps the low byte");
+    const unsigned char seven = 7;
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastTimeToLive, &seven, 1) == 0 && GetIp(datagram, IpMulticastTimeToLive) == 7, "a one-byte IP_MULTICAST_TTL is accepted");
+    const int tooLarge = 300;
+    Require(SetFails(datagram, 0, IpMulticastTimeToLive, &tooLarge, sizeof(tooLarge), ErrorInvalid) && GetIp(datagram, IpMulticastTimeToLive) == 7, "IP_MULTICAST_TTL above 255 must fail with EINVAL (22)");
+    unsigned char narrow = 0xaa;
+    std::uint32_t size = 1;
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastTimeToLive, &narrow, &size) == 0 && size == 1 && narrow == 7, "a one-byte read gets the IP_MULTICAST_TTL byte");
+    Require(SetIp(datagram, IpMulticastLoop, 5) && GetIp(datagram, IpMulticastLoop) == 1, "IP_MULTICAST_LOOP reads back as 1");
+    Require(SetIp(datagram, IpMulticastLoop, 0) && GetIp(datagram, IpMulticastLoop) == 0, "IP_MULTICAST_LOOP can be turned off");
+    Require(SetIp(datagram, IpMulticastLoop, 1) && SetIp(datagram, IpMulticastLoop, 0x100) && GetIp(datagram, IpMulticastLoop) == 0, "an int IP_MULTICAST_LOOP keeps only its low byte");
+    int value = 0;
+    size = sizeof(value);
+    Require(getsockopt_nid_postfix(datagram6, 0, IpTimeToLive, &value, &size) == -1 && *__error_nid_postfix() == ErrorInvalid, "IPPROTO_IP on an AF_INET6 socket must fail with EINVAL (22)");
+    size = sizeof(value);
+    Require(getsockopt_nid_postfix(datagram, 0, 0x7777, &value, &size) == -1 && *__error_nid_postfix() == ErrorNoProtocolOption, "an unknown IPPROTO_IP option must fail with ENOPROTOOPT (42)");
+    size = sizeof(value);
+    Require(getsockopt_nid_postfix(datagram, 99, 1, &value, &size) == -1 && *__error_nid_postfix() == ErrorInvalid, "an unknown level must fail with EINVAL (22)");
+    Require(SetFails(datagram, 99, 1, &value, sizeof(value), ErrorInvalid), "setsockopt at an unknown level must fail with EINVAL (22)");
+    for (const int option : {7, 20, 65}) {
+        Require(GetIp(datagram, option) == 0, "a receive option starts off");
+        Require(SetIp(datagram, option, 5) && GetIp(datagram, option) == 1, "a receive option reads back as 1");
+        Require(SetIp(datagram, option, 0) && GetIp(datagram, option) == 0, "a receive option turns off");
+    }
+    Require(close_nid_postfix(datagram) == 0 && close_nid_postfix(datagram6) == 0, "close failed");
+}
+
+void MulticastMembership() {
+    constexpr int IpMulticastInterface = 9;
+    constexpr int IpAddMembership = 12;
+    constexpr int IpDropMembership = 13;
+    constexpr int ErrorNotSupported = 45;
+    constexpr int ErrorAddressNotAvailable = 49;
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    const int stream = socket_nid_postfix(2, Stream, 0);
+    Require(datagram >= 0 && stream >= 0, "socket failed");
+    const std::array<std::uint8_t, 8> group{224, 0, 0, 251, 0, 0, 0, 0};
+    const std::array<std::uint8_t, 8> unicast{10, 0, 0, 1, 0, 0, 0, 0};
+    const std::array<std::uint8_t, 8> other{224, 0, 0, 253, 0, 0, 0, 0};
+    Require(SetFails(stream, 0, IpAddMembership, group.data(), group.size(), ErrorNotSupported), "a stream socket must fail a membership with EOPNOTSUPP (45)");
+    Require(SetFails(datagram, 0, IpAddMembership, group.data(), 7, ErrorInvalid), "a short membership must fail with EINVAL (22)");
+    Require(SetFails(datagram, 0, IpAddMembership, unicast.data(), unicast.size(), ErrorInvalid), "a group that is not multicast must fail with EINVAL (22)");
+    Require(SetFails(datagram, 0, IpDropMembership, other.data(), other.size(), ErrorAddressNotAvailable), "dropping a group never joined must fail with EADDRNOTAVAIL (49)");
+    std::array<std::uint8_t, 4> address{0xaa, 0xaa, 0xaa, 0xaa};
+    std::uint32_t size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && size == 4 && address == std::array<std::uint8_t, 4>{}, "IP_MULTICAST_IF starts at INADDR_ANY");
+    const std::array<std::uint8_t, 4> loopback{127, 0, 0, 1};
+    const std::array<std::uint8_t, 12> anyIndex{};
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastInterface, anyIndex.data(), anyIndex.size()) == 0, "an ip_mreqn without an index selects the default interface");
+    size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && address == std::array<std::uint8_t, 4>{}, "the default interface reads back as INADDR_ANY");
+    Require(SetFails(datagram, 0, IpMulticastInterface, loopback.data(), 2, ErrorInvalid), "a short IP_MULTICAST_IF must fail with EINVAL (22)");
+    Require(close_nid_postfix(datagram) == 0 && close_nid_postfix(stream) == 0, "close failed");
+}
+
+void MulticastOnTheHost() {
+    constexpr int IpMulticastInterface = 9;
+    constexpr int IpAddMembership = 12;
+    constexpr int IpDropMembership = 13;
+    constexpr int ErrorAddressInUse = 48;
+    constexpr int ErrorAddressNotAvailable = 49;
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    Require(datagram >= 0, "socket failed");
+    const std::array<std::uint8_t, 8> group{224, 0, 0, 251, 0, 0, 0, 0};
+    Require(setsockopt_nid_postfix(datagram, 0, IpAddMembership, group.data(), group.size()) == 0, "joining 224.0.0.251 through INADDR_ANY failed");
+    Require(SetFails(datagram, 0, IpAddMembership, group.data(), group.size(), ErrorAddressInUse), "joining twice must fail with EADDRINUSE (48)");
+    Require(setsockopt_nid_postfix(datagram, 0, IpDropMembership, group.data(), group.size()) == 0, "drop failed");
+    Require(SetFails(datagram, 0, IpDropMembership, group.data(), group.size(), ErrorAddressNotAvailable), "dropping twice must fail with EADDRNOTAVAIL (49)");
+    const std::array<std::uint8_t, 8> throughLoopback{224, 0, 0, 252, 127, 0, 0, 1};
+    const std::array<std::uint8_t, 8> anyInterface{224, 0, 0, 252, 0, 0, 0, 0};
+    Require(setsockopt_nid_postfix(datagram, 0, IpAddMembership, throughLoopback.data(), throughLoopback.size()) == 0, "joining 224.0.0.252 through 127.0.0.1 failed");
+    Require(setsockopt_nid_postfix(datagram, 0, IpDropMembership, anyInterface.data(), anyInterface.size()) == 0, "a drop through INADDR_ANY leaves the group on any interface");
+    Require(SetFails(datagram, 0, IpDropMembership, anyInterface.data(), anyInterface.size(), ErrorAddressNotAvailable), "dropping it again must fail with EADDRNOTAVAIL (49)");
+    const std::array<std::uint8_t, 4> loopback{127, 0, 0, 1};
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastInterface, loopback.data(), loopback.size()) == 0, "selecting the loopback interface for IP_MULTICAST_IF failed");
+    std::array<std::uint8_t, 4> address{0xaa, 0xaa, 0xaa, 0xaa};
+    std::uint32_t size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && size == 4 && address == loopback, "IP_MULTICAST_IF reads back");
+    const std::array<std::uint8_t, 12> anyIndex{};
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastInterface, anyIndex.data(), anyIndex.size()) == 0, "an ip_mreqn without an index selects the default interface");
+    size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && address == std::array<std::uint8_t, 4>{}, "the default interface reads back as INADDR_ANY");
+    Require(close_nid_postfix(datagram) == 0, "close failed");
+}
+
 void UnknownRequestsFail() {
     const int stream = socket_nid_postfix(2, Stream, 0);
     Require(stream >= 0, "socket failed");
@@ -218,12 +397,21 @@ void UnknownRequestsFail() {
 
 }
 
-int main() {
+int main(int argc, char** argv) {
+    if (argc > 1 && std::strcmp(argv[1], "multicast") == 0) {
+        MulticastOnTheHost();
+        return 0;
+    }
     ReportsTypeAndListening();
     ReportsAndClearsTheConnectError();
     BooleanOptionsReportTheirBit();
+    ReusePortSharesAPort();
     LingerFollowsFreeBsd();
     LengthsFollowFreeBsd();
+    BuffersFollowThePs5();
+    NullValues();
+    IpLevelFollowsThePs5();
+    MulticastMembership();
     UnknownRequestsFail();
     return 0;
 }
diff --git a/core/libs/tests/GuestSocketPair.cpp b/core/libs/tests/GuestSocketPair.cpp
index 0b827364c4..367ebff08d 100644
--- a/core/libs/tests/GuestSocketPair.cpp
+++ b/core/libs/tests/GuestSocketPair.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -7,47 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-
-struct Iovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct Msghdr {
-    void* name;
-    std::uint32_t nameLength;
-    Iovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-
-extern "C" {
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI recvmsg_nid_postfix(int, Msghdr*, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI shutdown_nid_postfix(int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
@@ -81,7 +42,7 @@ static bool Fails(int domain, int type, int protocol, int error) {
 }
 
 static bool Readable(int descriptor, short accepted = In) {
-    PollDescriptor waited{descriptor, In, 0};
+    GuestPollDescriptor waited{descriptor, In, 0};
     return poll_nid_postfix(&waited, 1, 2000) == 1 && (waited.revents & accepted) != 0;
 }
 
@@ -104,7 +65,15 @@ static bool Unnamed(int descriptor, int (APS5_VABI *query)(int, void*, std::uint
     return query(descriptor, name, &length) == 0 && length == 4 && name[0] == 16 && name[1] == 1 && name[4] == 0xaa;
 }
 
-static bool ReceiveFaults(int descriptor, Msghdr* message) {
+static bool NotConnected(int descriptor) {
+    std::uint8_t name[16];
+    std::memset(name, 0xaa, sizeof(name));
+    std::uint32_t length = sizeof(name);
+    *__error_nid_postfix() = 0;
+    return getpeername_nid_postfix(descriptor, name, &length) == -1 && *__error_nid_postfix() == 57 && length == sizeof(name) && name[0] == 0xaa;
+}
+
+static bool ReceiveFaults(int descriptor, GuestMsghdr* message) {
     *__error_nid_postfix() = 0;
     return recvmsg_nid_postfix(descriptor, message, 0) == -1 && *__error_nid_postfix() == 14;
 }
@@ -122,26 +91,26 @@ static void CheckReceiveMessageFaults() {
     auto* readOnly = writable + page;
     auto* inaccessible = writable + 2 * page;
     char data[16]{};
-    Iovec good{data, sizeof(data)};
-    auto* readOnlyMessage = reinterpret_cast<Msghdr*>(readOnly);
+    KernelIovec good{data, sizeof(data)};
+    auto* readOnlyMessage = reinterpret_cast<GuestMsghdr*>(readOnly);
     *readOnlyMessage = {nullptr, 0, &good, 1, nullptr, 0, -1};
-    auto* readOnlyVector = reinterpret_cast<Iovec*>(readOnly + 64);
+    auto* readOnlyVector = reinterpret_cast<KernelIovec*>(readOnly + 64);
     *readOnlyVector = {data, sizeof(data)};
     Require(sceKernelMprotect(readOnly, page, 1) == 0 && sceKernelMprotect(inaccessible, page, 0) == 0);
     int pair[2] = {-1, -1};
     Require(socketpair_nid_postfix(Unix, Datagram, 0, pair) == 0);
 
     Require(Queue(pair[0], pair[1], "x"));
-    Require(ReceiveFaults(pair[1], reinterpret_cast<Msghdr*>(0x1000)));
-    Require(ReceiveFaults(pair[1], reinterpret_cast<Msghdr*>(inaccessible)));
-    Msghdr message{nullptr, 0, reinterpret_cast<Iovec*>(0x1000), 1, nullptr, 0, -1};
+    Require(ReceiveFaults(pair[1], reinterpret_cast<GuestMsghdr*>(0x1000)));
+    Require(ReceiveFaults(pair[1], reinterpret_cast<GuestMsghdr*>(inaccessible)));
+    GuestMsghdr message{nullptr, 0, reinterpret_cast<KernelIovec*>(0x1000), 1, nullptr, 0, -1};
     Require(ReceiveFaults(pair[1], &message));
-    message.iov = reinterpret_cast<Iovec*>(inaccessible);
+    message.iov = reinterpret_cast<KernelIovec*>(inaccessible);
     Require(ReceiveFaults(pair[1], &message));
     char peeked[4]{};
     Require(recv_nid_postfix(pair[1], peeked, sizeof(peeked), Peek) == 1 && peeked[0] == 'x');
 
-    Iovec vector{reinterpret_cast<void*>(0x1000), sizeof(data)};
+    KernelIovec vector{reinterpret_cast<void*>(0x1000), sizeof(data)};
     message = {nullptr, 0, &vector, 1, nullptr, 0, -1};
     Require(ReceiveFaults(pair[1], &message));
     vector.base = inaccessible;
@@ -164,7 +133,7 @@ static void CheckReceiveMessageFaults() {
     Require(Queue(pair[0], pair[1], "abcd") && recvmsg_nid_postfix(pair[1], &message, 0) == 4);
     Require(std::memcmp(writable, "abcd", 4) == 0 && message.flags == 0 && message.controlLength == 0);
     Require(message.nameLength == 16 && name[0] == 16 && name[1] == Unix && name[16] == 0xa5);
-    Iovec vectors[2]{{writable, 2}, {inaccessible, 16}};
+    KernelIovec vectors[2]{{writable, 2}, {inaccessible, 16}};
     message = {nullptr, 0, vectors, 2, nullptr, 0, -1};
     Require(Queue(pair[0], pair[1], "ef") && recvmsg_nid_postfix(pair[1], &message, 0) == 2 && std::memcmp(writable, "ef", 2) == 0);
     message = {readOnly + 128, 0, readOnlyVector, 1, nullptr, 0, -1};
@@ -172,7 +141,7 @@ static void CheckReceiveMessageFaults() {
     Require(std::memcmp(data, "gh", 2) == 0 && message.nameLength == 0);
 
     Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0);
-    Require(sceKernelMprotect(memory, page * 3, 3) == 0 && sceKernelMunmap(memory, page * 3) == 0);
+    Require(sceKernelMprotect(memory, page * 3, 3) == 0 && sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), page * 3) == 0);
 }
 
 int main(int argc, char** argv) {
@@ -188,7 +157,7 @@ int main(int argc, char** argv) {
     Require(Exchange(pair[1], pair[0], "other way"));
     Require(Unnamed(pair[0], getsockname_nid_postfix) && Unnamed(pair[1], getpeername_nid_postfix));
 
-    PollDescriptor polled[2] = {{pair[1], In, 0}, {pair[0], Out, 0}};
+    GuestPollDescriptor polled[2] = {{pair[1], In, 0}, {pair[0], Out, 0}};
     Require(poll_nid_postfix(polled, 2, 0) == 1 && polled[0].revents == 0 && (polled[1].revents & Out) != 0);
     const char ping[] = "ping";
     Require(send_nid_postfix(pair[0], ping, sizeof(ping), 0) == sizeof(ping));
@@ -211,7 +180,9 @@ int main(int argc, char** argv) {
     Require(shutdown_nid_postfix(pair[0], 1) == 0);
     Require(Readable(pair[1], In | Hup) && recv_nid_postfix(pair[1], received, sizeof(received), 0) == 0);
     Require(Exchange(pair[1], pair[0], "still open"));
+    Require(Unnamed(pair[0], getpeername_nid_postfix) && Unnamed(pair[1], getpeername_nid_postfix));
     Require(close_nid_postfix(pair[0]) == 0);
+    Require(NotConnected(pair[1]) && Unnamed(pair[1], getsockname_nid_postfix));
     Require(Readable(pair[1], In | Hup) && recv_nid_postfix(pair[1], received, sizeof(received), 0) == 0);
     std::int64_t sent = 0;
     for (int i = 0; i < 100 && sent >= 0; ++i) sent = send_nid_postfix(pair[1], ping, sizeof(ping), NoSignal);
@@ -260,7 +231,11 @@ int main(int argc, char** argv) {
     Require(senderLength == 16 && sender[0] == 16 && sender[1] == 1);
     Require(recv_nid_postfix(pair[1], datagram, sizeof(datagram), 0) == 2 && datagram[0] == 'b' && datagram[1] == 'b');
     Require(Exchange(pair[1], pair[0], "back"));
-    Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0);
+    const int copy = dup_nid_postfix(pair[0]);
+    Require(copy >= 0 && close_nid_postfix(pair[0]) == 0);
+    Require(Unnamed(pair[1], getpeername_nid_postfix) && Exchange(pair[1], copy, "copy"));
+    Require(close_nid_postfix(copy) == 0 && NotConnected(pair[1]));
+    Require(close_nid_postfix(pair[1]) == 0);
 
 #ifdef __APPLE__
     Require(ThrowsRuntimeError([&] { socketpair_nid_postfix(Unix, SequencedPacket, 0, pair); }));
@@ -273,8 +248,8 @@ int main(int argc, char** argv) {
     Require(send_nid_postfix(pair[0], "record", 6, 0) == 6);
     Require(send_nid_postfix(pair[0], "next", 4, 0) == 4);
     char part[2]{};
-    Iovec piece{part, sizeof(part)};
-    Msghdr message{nullptr, 0, &piece, 1, nullptr, 0, -1};
+    KernelIovec piece{part, sizeof(part)};
+    GuestMsghdr message{nullptr, 0, &piece, 1, nullptr, 0, -1};
     const auto truncated = recvmsg_nid_postfix(pair[1], &message, 0);
     if (truncated != 2 || message.flags != 0x10) {
         std::fprintf(stderr, "recvmsg of a 6-byte SOCK_SEQPACKET record into 2 bytes returned %lld with msg_flags 0x%x, expected 2 with MSG_TRUNC (0x10)\n",
diff --git a/core/libs/tests/GuestSocketPortZero.cpp b/core/libs/tests/GuestSocketPortZero.cpp
index 070b9c8982..f450f75277 100644
--- a/core/libs/tests/GuestSocketPortZero.cpp
+++ b/core/libs/tests/GuestSocketPortZero.cpp
@@ -1,20 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
 
 static void Require(bool value, const char* message) {
     if (!value) {
@@ -45,7 +36,28 @@ static void CheckDatagram(int family) {
     Require(connect_nid_postfix(probe, address.data(), size) == -1 && *__error_nid_postfix() == 49,
         "connect to port 0 on an unconnected datagram socket must fail with EADDRNOTAVAIL (49)");
     Require(getpeername_nid_postfix(probe, name.data(), &length) == -1 && *__error_nid_postfix() == 57, "still unconnected");
-    Require(close_nid_postfix(probe) == 0, "close");
+    const int peer = socket_nid_postfix(family, 2, 0);
+    Require(peer >= 0, "peer");
+    const int bound = bind_nid_postfix(peer, address.data(), size);
+    if (bound < 0 && family == 28 && *__error_nid_postfix() == 49) {
+        Require(close_nid_postfix(peer) == 0 && close_nid_postfix(probe) == 0, "close");
+        return;
+    }
+    Require(bound == 0, "bind peer");
+    Address target{};
+    length = target.size();
+    Require(getsockname_nid_postfix(peer, target.data(), &length) == 0, "peer name");
+    Require(connect_nid_postfix(probe, target.data(), size) == 0, "connect to the peer");
+    length = name.size();
+    Require(getpeername_nid_postfix(probe, name.data(), &length) == 0, "connected");
+    Require(connect_nid_postfix(probe, address.data(), size) == -1 && *__error_nid_postfix() == 49,
+        "connect to port 0 on a connected datagram socket must fail with EADDRNOTAVAIL (49)");
+    length = name.size();
+    Require(getpeername_nid_postfix(probe, name.data(), &length) == -1 && *__error_nid_postfix() == 57,
+        "connect to port 0 must disconnect a connected datagram socket");
+    Require(send_nid_postfix(probe, "x", 1, 0) == -1 && *__error_nid_postfix() == 39,
+        "send without an address after the disconnect must fail with EDESTADDRREQ (39)");
+    Require(close_nid_postfix(peer) == 0 && close_nid_postfix(probe) == 0, "close");
 }
 
 static void CheckStream(int family) {
diff --git a/core/libs/tests/GuestSocketReadWrite.cpp b/core/libs/tests/GuestSocketReadWrite.cpp
index 4af5913b09..f320cf6569 100644
--- a/core/libs/tests/GuestSocketReadWrite.cpp
+++ b/core/libs/tests/GuestSocketReadWrite.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -9,47 +12,6 @@
 #include <csignal>
 #endif
 
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-
-struct Iovec {
-    void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI _read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI _write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelReadv(int, const Iovec*, int);
-std::int64_t APS5_VABI sceKernelWritev(int, const Iovec*, int);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI preadv_nid_postfix(int, const Iovec*, int, std::int64_t);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const Iovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPreadv(int, const Iovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwritev(int, const Iovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket read/write check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -65,7 +27,7 @@ constexpr int KernelBadDescriptor = static_cast<int>(0x80020009u);
 constexpr int KernelIllegalSeek = static_cast<int>(0x8002001du);
 
 static bool Readable(int descriptor, short accepted = In) {
-    PollDescriptor waited{descriptor, In, 0};
+    GuestPollDescriptor waited{descriptor, In, 0};
     return poll_nid_postfix(&waited, 1, 2000) == 1 && (waited.revents & accepted) != 0;
 }
 
@@ -105,28 +67,28 @@ int main() {
 
     const char vectorFirst[] = "vector ";
     const char vectorSecond[] = "write";
-    Iovec vectorWrite[] = {{const_cast<char*>(vectorFirst), sizeof(vectorFirst) - 1},
+    KernelIovec vectorWrite[] = {{const_cast<char*>(vectorFirst), sizeof(vectorFirst) - 1},
         {const_cast<char*>(vectorSecond), sizeof(vectorSecond)}};
     Require(sceKernelWritev(client, vectorWrite, 2) == sizeof(vectorFirst) + sizeof(vectorSecond) - 1);
     char vectorReadFirst[sizeof(vectorFirst) - 1]{};
     char vectorReadSecond[sizeof(vectorSecond)]{};
-    Iovec vectorRead[] = {{vectorReadFirst, sizeof(vectorReadFirst)}, {vectorReadSecond, sizeof(vectorReadSecond)}};
+    KernelIovec vectorRead[] = {{vectorReadFirst, sizeof(vectorReadFirst)}, {vectorReadSecond, sizeof(vectorReadSecond)}};
     Require(Readable(server) && sceKernelReadv(server, vectorRead, 2) == sizeof(vectorFirst) + sizeof(vectorSecond) - 1);
     Require(std::memcmp(vectorReadFirst, "vector ", sizeof(vectorReadFirst)) == 0 && std::strcmp(vectorReadSecond, "write") == 0);
 
     const char sceVectorFirst[] = "sceKernel";
     const char sceVectorSecond[] = "Writev";
-    Iovec sceVectorWrite[] = {{const_cast<char*>(sceVectorFirst), sizeof(sceVectorFirst) - 1},
+    KernelIovec sceVectorWrite[] = {{const_cast<char*>(sceVectorFirst), sizeof(sceVectorFirst) - 1},
         {const_cast<char*>(sceVectorSecond), sizeof(sceVectorSecond)}};
     Require(sceKernelWritev(client, sceVectorWrite, 2) == sizeof(sceVectorFirst) + sizeof(sceVectorSecond) - 1);
     char sceVectorReadFirst[sizeof(sceVectorFirst) - 1]{};
     char sceVectorReadSecond[sizeof(sceVectorSecond)]{};
-    Iovec sceVectorRead[] = {{sceVectorReadFirst, sizeof(sceVectorReadFirst)}, {sceVectorReadSecond, sizeof(sceVectorReadSecond)}};
+    KernelIovec sceVectorRead[] = {{sceVectorReadFirst, sizeof(sceVectorReadFirst)}, {sceVectorReadSecond, sizeof(sceVectorReadSecond)}};
     Require(Readable(server) && sceKernelReadv(server, sceVectorRead, 2) == sizeof(sceVectorFirst) + sizeof(sceVectorSecond) - 1);
     Require(std::memcmp(sceVectorReadFirst, "sceKernel", sizeof(sceVectorReadFirst)) == 0 && std::strcmp(sceVectorReadSecond, "Writev") == 0);
 
     const char positionedWrite[] = "positioned";
-    Iovec positionedIov[] = {{const_cast<char*>(positionedWrite), sizeof(positionedWrite)}};
+    KernelIovec positionedIov[] = {{const_cast<char*>(positionedWrite), sizeof(positionedWrite)}};
     *__error_nid_postfix() = 0;
     Require(pread_nid_postfix(server, received, 1, 0) == -1 && *__error_nid_postfix() == 29);
     Require(pwrite_nid_disambig1_nid_postfix(client, positionedWrite, 1, 0) == -1 && *__error_nid_postfix() == 29);
@@ -141,7 +103,7 @@ int main() {
     *__error_nid_postfix() = 0;
     Require(read_nid_postfix(server, received, sizeof(received)) == -1 && *__error_nid_postfix() == 35);
     Require(sceKernelRead(server, received, sizeof(received)) == KernelAgain);
-    Iovec emptyRead[] = {{received, sizeof(received)}};
+    KernelIovec emptyRead[] = {{received, sizeof(received)}};
     Require(sceKernelReadv(server, emptyRead, 1) == KernelAgain);
 
     Require(read_nid_postfix(server, received, 0) == 0 && sceKernelRead(server, received, 0) == 0);
diff --git a/core/libs/tests/GuestSocketStreamOptions.cpp b/core/libs/tests/GuestSocketStreamOptions.cpp
index f85a693f17..647c93cdda 100644
--- a/core/libs/tests/GuestSocketStreamOptions.cpp
+++ b/core/libs/tests/GuestSocketStreamOptions.cpp
@@ -1,29 +1,13 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
+#include <utility>
 #include <csignal>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI shutdown_nid_postfix(int, int);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket stream option check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -91,12 +75,14 @@ int main() {
     Require(client >= 0 && connect_nid_postfix(client, address.data(), address.size()) == 0);
     const int server = accept_nid_postfix(listener, nullptr, nullptr);
     Require(server >= 0);
-    Require(Set(listener, SocketLevel, NoSigpipe, 1) && Set(listener, TcpLevel, TcpNoDelay, 1));
+    Require(Set(listener, SocketLevel, NoSigpipe, 1) && Set(listener, TcpLevel, TcpNoDelay, 1) && Set(listener, TcpLevel, 0x100, 60) && Set(listener, TcpLevel, 4, 1) && Set(listener, TcpLevel, 8, 1));
     const int secondClient = socket_nid_postfix(2, 1, 0);
     Require(secondClient >= 0 && connect_nid_postfix(secondClient, address.data(), address.size()) == 0);
     const int inheriting = accept_nid_postfix(listener, nullptr, nullptr);
     Require(inheriting >= 0);
     Require(Get(inheriting, SocketLevel, NoSigpipe) == NoSigpipe && Get(inheriting, TcpLevel, TcpNoDelay) == 4);
+    Require(Get(inheriting, TcpLevel, 0x100) == 60 && Get(server, TcpLevel, 0x100) == 7200);
+    Require(Get(inheriting, TcpLevel, 4) == 0x1000 && Get(inheriting, TcpLevel, 8) == 0);
     Require(Get(server, SocketLevel, NoSigpipe) == 0 && Get(server, TcpLevel, TcpNoDelay) == 0);
     Require(close_nid_postfix(inheriting) == 0 && close_nid_postfix(secondClient) == 0);
     const int datagram = socket_nid_postfix(2, 2, 0);
@@ -114,7 +100,38 @@ int main() {
     int value = 0;
     Require(Set(client, TcpLevel, TcpNoDelay, 0) && Get(client, TcpLevel, TcpNoDelay) == 0);
     Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &one, sizeof(one) - 1), Invalid));
-    Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpMaximumSegment, &one, sizeof(one)), NoProtocolOption));
+    Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpMaximumSegment, &one, sizeof(one)), Invalid));
+    const int fresh = socket_nid_postfix(2, 1, 0);
+    Require(fresh >= 0 && Get(fresh, TcpLevel, TcpMaximumSegment) == 536);
+    for (const int segment : {1000, 175, 0, -1}) {
+        Require(Fails(setsockopt_nid_postfix(fresh, TcpLevel, TcpMaximumSegment, &segment, sizeof(segment)), Invalid));
+    }
+    for (const int segment : {176, 300, 536})
+        Require(Fails(setsockopt_nid_postfix(fresh, TcpLevel, TcpMaximumSegment, &segment, sizeof(segment)), Invalid));
+    Require(Get(fresh, TcpLevel, TcpMaximumSegment) == 536);
+    const int fresh6 = socket_nid_postfix(28, 1, 0);
+    if (fresh6 >= 0) {
+        Require(Get(fresh6, TcpLevel, TcpMaximumSegment) == 1220);
+        Require(close_nid_postfix(fresh6) == 0);
+    }
+    Require(Set(client, TcpLevel, TcpMaximumSegment, 176) && Get(client, TcpLevel, TcpMaximumSegment) == 216);
+    Require(Set(client, TcpLevel, TcpMaximumSegment, 200) && Get(client, TcpLevel, TcpMaximumSegment) == 216);
+    const int larger = 400;
+    Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpMaximumSegment, &larger, sizeof(larger)), Invalid));
+    Require(Get(fresh, TcpLevel, 0x100) == 7200 && Get(fresh, TcpLevel, 0x200) == 75 && Get(fresh, TcpLevel, 0x400) == 8);
+    Require(Set(fresh, TcpLevel, 0x100, 60) && Get(fresh, TcpLevel, 0x100) == 60);
+    Require(Set(fresh, TcpLevel, 0x100, 0) && Get(fresh, TcpLevel, 0x100) == 7200);
+    Require(Set(fresh, TcpLevel, 0x200, 10) && Get(fresh, TcpLevel, 0x200) == 10);
+    Require(Set(fresh, TcpLevel, 0x400, 3) && Get(fresh, TcpLevel, 0x400) == 3);
+    Require(Set(fresh, TcpLevel, 0x400, -1) && Get(fresh, TcpLevel, 0x400) == -1);
+    Require(Fails(setsockopt_nid_postfix(fresh, TcpLevel, 0x7777, &one, sizeof(one)), NoProtocolOption));
+    for (const auto& [option, bit] : {std::pair{4, 0x1000}, std::pair{8, 0x8}, std::pair{0x80, 0x10000}}) {
+        Require(Get(fresh, TcpLevel, option) == 0);
+        Require(Set(fresh, TcpLevel, option, 5) && Get(fresh, TcpLevel, option) == bit);
+        Require(Set(fresh, TcpLevel, option, -1) && Get(fresh, TcpLevel, option) == bit);
+        Require(Set(fresh, TcpLevel, option, 0) && Get(fresh, TcpLevel, option) == 0);
+    }
+    Require(close_nid_postfix(fresh) == 0);
     length = sizeof(value);
     Require(Fails(setsockopt_nid_postfix(datagram, TcpLevel, TcpNoDelay, &one, sizeof(one)), Invalid));
     Require(Fails(getsockopt_nid_postfix(datagram, TcpLevel, TcpNoDelay, &value, &length), Invalid));
@@ -124,13 +141,13 @@ int main() {
     char received = 0;
     Require(Get(server, SocketLevel, NonBlockingOption) == 0);
     Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) == 0);
-    Require(Set(server, SocketLevel, NonBlockingOption, 5) && Get(server, SocketLevel, NonBlockingOption) == 1);
+    Require(Set(server, SocketLevel, NonBlockingOption, 5) && Get(server, SocketLevel, NonBlockingOption) == 0x100);
     Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) != 0);
     Require(Fails(recv_nid_postfix(server, &received, sizeof(received), 0), Again));
     Require(Set(server, SocketLevel, NonBlockingOption, 0) && Get(server, SocketLevel, NonBlockingOption) == 0);
     Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) == 0);
     Require(Fails(setsockopt_nid_postfix(server, SocketLevel, NonBlockingOption, &one, sizeof(one) - 1), Invalid));
-    Require(Set(datagram, SocketLevel, NonBlockingOption, 1) && Get(datagram, SocketLevel, NonBlockingOption) == 1);
+    Require(Set(datagram, SocketLevel, NonBlockingOption, 1) && Get(datagram, SocketLevel, NonBlockingOption) == 0x100);
     Require(Fails(recv_nid_postfix(datagram, &received, sizeof(received), 0), Again));
 
 #ifndef _WIN32
diff --git a/core/libs/tests/GuestSocketTimeouts.cpp b/core/libs/tests/GuestSocketTimeouts.cpp
index 2ff28a2173..104d70406e 100644
--- a/core/libs/tests/GuestSocketTimeouts.cpp
+++ b/core/libs/tests/GuestSocketTimeouts.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <chrono>
@@ -11,40 +13,6 @@ struct Timeval {
     std::int64_t microseconds;
 };
 
-struct Iovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct Msghdr {
-    void* name;
-    std::uint32_t nameLength;
-    Iovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI recvmsg_nid_postfix(int, Msghdr*, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket timeout check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -115,8 +83,8 @@ int main() {
     Require(Fails(recv_nid_postfix(datagram, &byte, sizeof(byte), 0), WouldBlock));
     Require(Clock::now() - started >= std::chrono::milliseconds(59));
     Require(Fails(recvfrom_nid_postfix(datagram, &byte, sizeof(byte), 0, nullptr, nullptr), WouldBlock));
-    Iovec part{&byte, sizeof(byte)};
-    Msghdr message{nullptr, 0, &part, 1, nullptr, 0, 0};
+    KernelIovec part{&byte, sizeof(byte)};
+    GuestMsghdr message{nullptr, 0, &part, 1, nullptr, 0, 0};
     Require(Fails(recvmsg_nid_postfix(datagram, &message, 0), WouldBlock));
     Require(Fails(read_nid_postfix(datagram, &byte, sizeof(byte)), WouldBlock));
     Require(Set(datagram, ReceiveTimeout, 60, 0) == 0);
diff --git a/core/libs/tests/GuestSoftwareVersion.cpp b/core/libs/tests/GuestSoftwareVersion.cpp
index d572e1722b..1343316e32 100644
--- a/core/libs/tests/GuestSoftwareVersion.cpp
+++ b/core/libs/tests/GuestSoftwareVersion.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstddef>
@@ -5,22 +7,10 @@
 #include <cstdlib>
 #include <cstring>
 
-struct SceKernelProsperoSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
-
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, versionString) == 0x08);
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, version) == 0x24);
 static_assert(sizeof(SceKernelProsperoSystemSwVersion) == 0x28);
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelGetProsperoSystemSwVersion_nid_postfix(SceKernelProsperoSystemSwVersion*);
-int APS5_VABI sceKernelGetAllowedSdkVersionOnSystem_nid_postfix(std::uint32_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckProsperoSystemSwVersion() {
diff --git a/core/libs/tests/GuestSpSysCallWrapper.cpp b/core/libs/tests/GuestSpSysCallWrapper.cpp
new file mode 100644
index 0000000000..1d22c59592
--- /dev/null
+++ b/core/libs/tests/GuestSpSysCallWrapper.cpp
@@ -0,0 +1,153 @@
+#include "SceTypes.hpp"
+#include "prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp"
+#include "prx/libSceNet/libSceNet.hpp"
+#include "prx/libkernel/libkernel.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+struct Shared {
+    PthreadMutex mutex = nullptr;
+    PthreadCond cond = nullptr;
+    bool ready = false;
+};
+
+void* APS5_VABI ExitWithArgument(void* arg) {
+    sceSpPthreadExit(arg);
+    return nullptr;
+}
+
+void* APS5_VABI SignalReady(void* arg) {
+    auto* shared = static_cast<Shared*>(arg);
+    Require(sceSpPthreadMutexLock(&shared->mutex) == 0);
+    shared->ready = true;
+    Require(sceSpPthreadCondSignal(&shared->cond) == 0);
+    Require(sceSpPthreadMutexUnlock(&shared->mutex) == 0);
+    return nullptr;
+}
+
+void Threads() {
+    PthreadAttr attr = nullptr;
+    Require(sceSpPthreadAttrInit(&attr) == 0);
+    Require(sceSpPthreadAttrSetstacksize(&attr, 0x10000) == 0);
+    Require(sceSpPthreadAttrSetinheritsched(&attr, 0) == scePthreadAttrSetinheritsched(&attr, 0));
+    const KernelSchedParam param{700};
+    Require(sceSpPthreadAttrSetschedparam(&attr, &param) == scePthreadAttrSetschedparam(&attr, &param));
+
+    Pthread thread = nullptr;
+    int marker = 0;
+    Require(sceSpPthreadCreate(&thread, &attr, ExitWithArgument, &marker, "sp_exit") == 0);
+    void* result = nullptr;
+    Require(sceSpPthreadJoin(thread, &result) == 0);
+    Require(result == &marker);
+
+    Pthread detached = nullptr;
+    Require(sceSpPthreadCreate(&detached, &attr, ExitWithArgument, nullptr, "sp_detach") == 0);
+    Require(sceSpPthreadDetach(detached) == 0);
+    Require(sceSpPthreadAttrDestroy(&attr) == 0);
+
+    PthreadMutexattr mutexAttr = nullptr;
+    Require(sceSpPthreadMutexattrInit(&mutexAttr) == 0);
+    Require(sceSpPthreadMutexattrSettype(&mutexAttr, 2) == 0);
+    Require(sceSpPthreadMutexattrSetprotocol(&mutexAttr, 0) == scePthreadMutexattrSetprotocol(&mutexAttr, 0));
+    Require(sceSpPthreadSetprio(scePthreadSelf(), 700) == scePthreadSetprio(scePthreadSelf(), 700));
+    PthreadCondattr condAttr = nullptr;
+    Require(sceSpPthreadCondattrInit(&condAttr) == 0);
+
+    Shared shared;
+    Require(sceSpPthreadMutexInit(&shared.mutex, &mutexAttr, "sp_mutex") == 0);
+    Require(sceSpPthreadCondInit(&shared.cond, &condAttr, "sp_cond") == 0);
+    Require(sceSpPthreadMutexattrDestroy(&mutexAttr) == 0);
+    Require(sceSpPthreadCondattrDestroy(&condAttr) == 0);
+
+    Require(sceSpPthreadMutexLock(&shared.mutex) == 0);
+    Pthread signaller = nullptr;
+    Require(sceSpPthreadCreate(&signaller, nullptr, SignalReady, &shared, "sp_signal") == 0);
+    while (!shared.ready) Require(sceSpPthreadCondWait(&shared.cond, &shared.mutex) == 0);
+    Require(sceSpPthreadMutexUnlock(&shared.mutex) == 0);
+    Require(sceSpPthreadJoin(signaller, nullptr) == 0);
+    Require(sceSpPthreadCondDestroy(&shared.cond) == 0);
+    Require(sceSpPthreadMutexDestroy(&shared.mutex) == 0);
+}
+
+void Time() {
+    KernelTimeval now{};
+    Require(sceSpKernelGettimeofday(&now) == 0);
+    Require(now.tv_sec > 0 && now.tv_usec >= 0 && now.tv_usec < 1000000);
+    const KernelTimespec delay{0, 1000000};
+    Require(sceSpKernelNanosleep(&delay, nullptr) == 0);
+}
+
+template <typename TWrapped, typename TDirect>
+void SameError(TWrapped wrapped, TDirect direct) {
+    const auto wrappedResult = wrapped();
+    const int wrappedErrno = *sceNetErrnoLoc();
+    const auto directResult = direct();
+    Require(wrappedResult == directResult);
+    Require(wrappedErrno == *sceNetErrnoLoc());
+}
+
+void Net() {
+    Require(sceSpNetErrnoLoc() == sceNetErrnoLoc());
+
+    const int pool = sceSpNetPoolCreate("sp_pool", 0x4000, 0);
+    Require(pool >= 0);
+    const int resolver = sceSpNetResolverCreate("sp_resolver", pool, 0);
+    Require(resolver >= 0);
+    int status = 0;
+    Require(sceSpNetResolverGetError(resolver, &status) == sceNetResolverGetError(resolver, &status));
+    Require(sceSpNetResolverDestroy(resolver) == 0);
+    Require(sceSpNetPoolDestroy(pool) == 0);
+
+    const int epoll = sceSpNetEpollCreate("sp_epoll", 0);
+    Require(epoll >= 0);
+    Require(sceSpNetEpollDestroy(epoll) == 0);
+
+    const int socket = sceSpNetSocket("sp_socket", 2, 2, 0);
+    Require(socket >= 0);
+    const int enable = 1;
+    Require(sceSpNetSetsockopt(socket, 0xffff, 0x4, &enable, sizeof(enable)) == sceNetSetsockopt(socket, 0xffff, 0x4, &enable, sizeof(enable)));
+    Require(sceSpNetSocketClose(socket) == 0);
+
+    char byte = 0;
+    const std::uint8_t address[16]{16, 2};
+    SameError([&] { return sceSpNetSend(-1, &byte, 1, 0); }, [&] { return sceNetSend(-1, &byte, 1, 0); });
+    SameError([&] { return sceSpNetRecv(-1, &byte, 1, 0); }, [&] { return sceNetRecv(-1, &byte, 1, 0); });
+    SameError([&] { return sceSpNetConnect(-1, address, sizeof(address)); }, [&] { return sceNetConnect(-1, address, sizeof(address)); });
+    SameError([&] { return sceSpNetEpollControl(-1, 1, 0, nullptr); }, [&] { return sceNetEpollControl(-1, 1, 0, nullptr); });
+    SameError([&] { return sceSpNetEpollWait(-1, nullptr, 0, 0); }, [&] { return sceNetEpollWait(-1, nullptr, 0, 0); });
+    SameError([&] { return sceSpNetEpollAbort(-1, 0); }, [&] { return sceNetEpollAbort(-1, 0); });
+    SameError([&] { return sceSpNetResolverAbort(-1, 0); }, [&] { return sceNetResolverAbort(-1, 0); });
+    std::uint32_t resolved = 0;
+    SameError([&] { return sceSpNetResolverStartNtoa(-1, "localhost", &resolved, 0, 0, 0); }, [&] { return sceNetResolverStartNtoa(-1, "localhost", &resolved, 0, 0, 0); });
+}
+
+void Posix() {
+    Require(sceSpGetPid() > 0);
+    Require(sceSpGetPid() == getpid_nid_postfix());
+
+    const std::int64_t zero[2]{0, 0};
+    Require(sceSpSelect(0, nullptr, nullptr, nullptr, zero) == 0);
+    const std::int64_t invalid[2]{0, 1000000};
+    *__error_nid_postfix() = 0;
+    Require(sceSpSelect(0, nullptr, nullptr, nullptr, invalid) == -1);
+    const int wrappedErrno = *__error_nid_postfix();
+    *__error_nid_postfix() = 0;
+    Require(select_nid_postfix(0, nullptr, nullptr, nullptr, invalid) == -1);
+    Require(wrappedErrno == 22 && *__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(sceSpSelect(-1, nullptr, nullptr, nullptr, nullptr) == -1 && *__error_nid_postfix() == 22);
+}
+
+}
+
+int main() {
+    Threads();
+    Time();
+    Net();
+    Posix();
+}
diff --git a/core/libs/tests/GuestSsl.cpp b/core/libs/tests/GuestSsl.cpp
index 4aa00482b6..f4d57bc7a2 100644
--- a/core/libs/tests/GuestSsl.cpp
+++ b/core/libs/tests/GuestSsl.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "ProcessParametersFixture.hpp"
 #include <array>
@@ -8,37 +9,6 @@
 #include <exception>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::size_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetCaCerts(int, void*);
-int APS5_VABI sceSslFreeCaCerts(int, void*);
-int APS5_VABI sceSslGetCaList(int, void*);
-int APS5_VABI sceSslFreeCaList(int, void*);
-int APS5_VABI sceSslUnloadCert(int);
-int APS5_VABI sceSslCreateConnection(int, int, const char*);
-int APS5_VABI sceSslDeleteConnection(int);
-int APS5_VABI sceSslSetVerifyCallback(int, int (APS5_VABI *)(int, unsigned int, void**, int, void*), void*);
-int APS5_VABI sceSslConnect(int);
-int APS5_VABI sceSslRead(int, void*, std::size_t, int);
-int APS5_VABI sceSslWrite(int, void*, std::size_t, int);
-int APS5_VABI sceSslClose(int);
-int APS5_VABI sceSslEnableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslDisableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslSetMinSslVersion(int, int);
-int APS5_VABI sceSslSetAlpn(int, const char*);
-const char* APS5_VABI sceSslGetAlpnSelected(int);
-}
-
-struct SslMemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-extern "C" int APS5_VABI sceSslGetMemoryPoolStats(int, SslMemoryPoolStats*);
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
@@ -53,17 +23,6 @@ static bool Throws(TCall call) {
 
 static int APS5_VABI VerifyCallback(int, unsigned int, void**, int, void*) { return 0; }
 
-struct SslCaCerts {
-    void* certs;
-    std::size_t num;
-    void* pool;
-};
-
-struct SslCaList {
-    void** certs;
-    int num;
-};
-
 int main() {
     static std::array<std::byte, 64> parameters{};
     const std::uint64_t processSize = parameters.size();
@@ -77,17 +36,18 @@ int main() {
     int marker = 0;
     const int context = sceSslInit_nid_postfix(0x10000);
     Require(context > 0);
-    SslMemoryPoolStats stats{1, 1, 1, 1};
+    SceSsl::MemoryPoolStats stats{1, 1, 1, 1};
     Require(sceSslGetMemoryPoolStats(context, &stats) == 0);
-    Require(stats.pool_size == 0x10000 && stats.max_inuse_size == 0 && stats.current_inuse_size == 0 && stats.reserved == 0);
+    Require(stats.poolSize == 0x10000 && stats.maxInuseSize == 0 && stats.currentInuseSize == 0 && stats.reserved == 0);
     Require(sceSslGetCaCerts(context, nullptr) == invalidValue);
     Require(sceSslFreeCaCerts(context, nullptr) == invalidArg);
 
-    SslCaCerts certs{&marker, 3, &marker};
+    SceSsl::Data certificateMarker{};
+    SceSsl::CaCerts certs{&certificateMarker, 3, &marker};
     Require(sceSslGetCaCerts(context, &certs) == notFound);
     Require(certs.certs == nullptr && certs.num == 0 && certs.pool == nullptr);
 
-    certs = {&marker, 3, &marker};
+    certs = {&certificateMarker, 3, &marker};
     Require(sceSslFreeCaCerts(context, &certs) == 0);
     Require(certs.certs == nullptr && certs.num == 0 && certs.pool == nullptr);
 
@@ -95,13 +55,13 @@ int main() {
     Require(sceSslFreeCaList(context, nullptr) == invalidArg);
 
     void* handle = &marker;
-    SslCaList list{&handle, 3};
+    SceSsl::CaList list{&handle, 3};
     Require(sceSslGetCaList(context, &list) == notFound);
     Require(list.certs == nullptr && list.num == 0);
     Require(sceSslFreeCaList(context, &list) == 0);
     Require(list.certs == nullptr && list.num == 0);
 
-    SslCaList foreign{&handle, 1};
+    SceSsl::CaList foreign{&handle, 1};
     Require(Throws([&] { sceSslFreeCaList(context, &foreign); }));
     foreign = {nullptr, 1};
     Require(Throws([&] { sceSslFreeCaList(context, &foreign); }));
@@ -187,9 +147,9 @@ int main() {
     Require(sceSslGetCaList(context, &list) == invalidId);
     Require(list.certs == &handle && list.num == 3);
     Require(sceSslGetCaCerts(context, nullptr) == invalidId);
-    certs = {&marker, 3, &marker};
+    certs = {&certificateMarker, 3, &marker};
     Require(sceSslGetCaCerts(context, &certs) == invalidId);
-    Require(certs.certs == &marker && certs.num == 3 && certs.pool == &marker);
+    Require(certs.certs == &certificateMarker && certs.num == 3 && certs.pool == &marker);
     Require(Throws([&] { sceSslFreeCaList(context, &list); }));
     for (const std::uint32_t sdkVersion : {0u, 0x074fffffu, 0x07500000u, 0x09000000u}) {
         std::memcpy(parameters.data() + 16, &sdkVersion, sizeof(sdkVersion));
diff --git a/core/libs/tests/GuestSslLoad.cpp b/core/libs/tests/GuestSslLoad.cpp
index b59ad7c6c5..92507f0183 100644
--- a/core/libs/tests/GuestSslLoad.cpp
+++ b/core/libs/tests/GuestSslLoad.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #include "prx/libSceSsl/SslTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SslCertificateFixture.hpp"
@@ -10,32 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::uint64_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetMemoryPoolStats(int, SceSsl::MemoryPoolStats*);
-int APS5_VABI sceSslLoadCert(int, int, SceSsl::Data**, SceSsl::Data*, SceSsl::Data*);
-int APS5_VABI sceSslUnloadCert(int);
-int APS5_VABI sceSslGetCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslFreeCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslGetCaCerts(int, SceSsl::CaCerts*);
-int APS5_VABI sceSslFreeCaCerts(int, SceSsl::CaCerts*);
-int APS5_VABI sceSslCreateConnection(int, int, const char*);
-int APS5_VABI sceSslDeleteConnection(int);
-int APS5_VABI sceSslSetVerifyCallback(int, int (APS5_VABI *)(int, unsigned int, void**, int, void*), void*);
-int APS5_VABI sceSslGetSerialNumber(int, void*, unsigned char*, std::size_t*);
-void* APS5_VABI sceSslGetSubjectName(int, void*);
-void* APS5_VABI sceSslGetIssuerName(int, void*);
-int APS5_VABI sceSslGetNameEntryCount(int, void*);
-int APS5_VABI sceSslGetNameEntryInfo(int, void*, int, char*, std::size_t, char*, std::size_t, std::size_t*);
-int APS5_VABI sceSslFreeSslCertName(int, void*);
-int APS5_VABI sceSslClose(int);
-int APS5_VABI sceSslGetNotBefore(int, void*, SceSsl::RtcTick*);
-int APS5_VABI sceSslGetNotAfter(int, void*, SceSsl::RtcTick*);
-int APS5_VABI sceSslGetFingerprint(int, void*, int, unsigned char*);
-int APS5_VABI sceSslGetPem(int, void*, char*, std::size_t*);
-}
-
 namespace {
 
 constexpr int NotFound = static_cast<int>(0x8095F004);
diff --git a/core/libs/tests/GuestSslPs5Readers.cpp b/core/libs/tests/GuestSslPs5Readers.cpp
index 3075a601e9..60aeebcbde 100644
--- a/core/libs/tests/GuestSslPs5Readers.cpp
+++ b/core/libs/tests/GuestSslPs5Readers.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #include "prx/libSceSsl/SslTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SslCertificateFixture.hpp"
@@ -11,22 +12,6 @@
 #include <vector>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::uint64_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslLoadCert(int, int, SceSsl::Data**, SceSsl::Data*, SceSsl::Data*);
-int APS5_VABI sceSslUnloadCert(int);
-int APS5_VABI sceSslGetCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslFreeCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslGetSerialNumber(int, void*, unsigned char*, std::size_t*);
-void* APS5_VABI sceSslGetSubjectName(int, void*);
-void* APS5_VABI sceSslGetIssuerName(int, void*);
-int APS5_VABI sceSslGetNameEntryCount(int, void*);
-int APS5_VABI sceSslGetNameEntryInfo(int, void*, int, char*, std::size_t, char*, std::size_t, std::size_t*);
-int APS5_VABI sceSslFreeSslCertName(int, void*);
-int APS5_VABI sceSslGetPem(int, void*, char*, std::size_t*);
-}
-
 namespace {
 
 void Check(bool value, const char* message) {
diff --git a/core/libs/tests/GuestSslTransport.cpp b/core/libs/tests/GuestSslTransport.cpp
index 4d956c68be..94aafaf622 100644
--- a/core/libs/tests/GuestSslTransport.cpp
+++ b/core/libs/tests/GuestSslTransport.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSsl/include/Ssl.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #include <winsock2.h>
 #else
@@ -28,40 +31,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::uint64_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetMemoryPoolStats(int, SceSsl::MemoryPoolStats*);
-int APS5_VABI sceSslLoadCert(int, int, SceSsl::Data**, SceSsl::Data*, SceSsl::Data*);
-int APS5_VABI sceSslCreateConnection(int, int, const char*);
-int APS5_VABI sceSslDeleteConnection(int);
-int APS5_VABI sceSslSetVerifyCallback(int, int (APS5_VABI *)(int, unsigned int, void**, int, void*), void*);
-int APS5_VABI sceSslConnect(int);
-int APS5_VABI sceSslRead(int, void*, std::size_t, int);
-int APS5_VABI sceSslWrite(int, void*, std::size_t, int);
-int APS5_VABI sceSslRecv(int, void*, std::size_t);
-int APS5_VABI sceSslSend(int, void*, std::size_t);
-int APS5_VABI sceSslClose(int);
-int APS5_VABI sceSslEnableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslDisableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslSetMinSslVersion(int, int);
-int APS5_VABI sceSslSetAlpn(int, const char*);
-const char* APS5_VABI sceSslGetAlpnSelected(int);
-void* APS5_VABI sceSslGetSubjectName(int, void*);
-int APS5_VABI sceSslGetNameEntryCount(int, void*);
-int APS5_VABI sceSslGetNameEntryInfo(int, void*, int, char*, std::size_t, char*, std::size_t, std::size_t*);
-int APS5_VABI sceSslFreeSslCertName(int, void*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceNetInit_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-int APS5_VABI sceNetSocketClose(int);
-}
-
 namespace {
 
 constexpr int ParallelConnections = 4;
@@ -314,6 +283,7 @@ struct Sockets {
     int Set(int descriptor, int option, const void* value, std::uint32_t length) const {
         return net ? sceNetSetsockopt(descriptor, GuestSocketLevel, option, value, length)
                    : setsockopt_nid_postfix(descriptor, GuestSocketLevel, option, value, length);
+
     }
 
     int Close(int descriptor) const { return net ? sceNetSocketClose(descriptor) : close_nid_postfix(descriptor); }
diff --git a/core/libs/tests/GuestStandardStreams.cpp b/core/libs/tests/GuestStandardStreams.cpp
index cdbd9a9a5e..f2d65cf2a4 100644
--- a/core/libs/tests/GuestStandardStreams.cpp
+++ b/core/libs/tests/GuestStandardStreams.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
@@ -17,68 +18,17 @@
 #include <stdexcept>
 #ifdef _WIN32
 #include <fcntl.h>
+#include <windows.h>
 #else
 #include <unistd.h>
 #endif
 extern "C" {
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-void APS5_VABI clearerr_unlocked_nid_postfix(FileStream*);
-int APS5_VABI fileno_unlocked_nid_postfix(FileStream*);
-char* APS5_VABI fgetln_nid_postfix(FileStream*, std::size_t*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-int APS5_VABI fseeko_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftello_nid_postfix(FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-int* APS5_VABI __error_nid_postfix();
+
 extern FileStream* __stdinp_nid_postfix;
 extern FileStream* __stdoutp_nid_postfix;
 extern FileStream* __stderrp_nid_postfix;
 extern int __isthreaded_nid_postfix;
-int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI fputs_nid_postfix(const char*, FileStream*);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI vprintf_nid_postfix(const char*, void*);
-int APS5_VABI puts_nid_postfix(const char*);
-int APS5_VABI vfprintf_nid_postfix(FileStream*, const char*, void*);
-int APS5_VABI vsprintf_nid_postfix(char*, const char*, void*);
-int APS5_VABI fgetc_nid_postfix(FileStream*);
-int APS5_VABI fputc_nid_postfix(int, FileStream*);
-int APS5_VABI getc_unlocked_nid_postfix(FileStream*);
-int APS5_VABI putc_unlocked_nid_postfix(int, FileStream*);
-int APS5_VABI fputwc_nid_postfix(char16_t, FileStream*);
-int APS5_VABI fputws_nid_postfix(const char16_t*, FileStream*);
-std::int32_t APS5_VABI getwc_nid_postfix(FileStream*);
-std::int32_t APS5_VABI getwchar_nid_postfix();
-int APS5_VABI putwc_nid_postfix(char16_t, FileStream*);
-int APS5_VABI putwchar_nid_postfix(char16_t);
-char16_t* APS5_VABI fgetws_nid_postfix(char16_t*, int, FileStream*);
-int APS5_VABI getchar_unlocked_nid_postfix();
-int APS5_VABI putchar_unlocked_nid_postfix(int);
-int APS5_VABI fscanf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI __srget_nid_postfix(FileStream*);
-int APS5_VABI __swbuf_nid_postfix(int, FileStream*);
-int APS5_VABI ungetc_nid_postfix(int, FileStream*);
-char* APS5_VABI fgets_nid_postfix(char*, int, FileStream*);
-int APS5_VABI feof_nid_postfix(FileStream*);
-int APS5_VABI ferror_nid_postfix(FileStream*);
-int APS5_VABI feof_unlocked_nid_postfix(FileStream*);
-int APS5_VABI ferror_unlocked_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-void APS5_VABI clearerr_nid_postfix(FileStream*);
-void APS5_VABI rewind_nid_postfix(FileStream*);
-int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t);
-void APS5_VABI setbuf_nid_postfix(FileStream*, char*);
-FileStream* APS5_VABI fdopen_nid_postfix(int, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-int APS5_VABI _Getmbcurmax_nid_postfix();
-int APS5_VABI ___mb_cur_max_nid_postfix();
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-int APS5_VABI ftrylockfile_nid_postfix(FileStream*);
+
 }
 static void Require(bool value) { if (!value) std::abort(); }
 static int APS5_VABI WriteFormatted(FileStream* stream, const char* format, ...) {
@@ -89,7 +39,7 @@ static int APS5_VABI WriteFormatted(FileStream* stream, const char* format, ...)
     std::va_list args;
     va_start(args, format);
 #endif
-    const int result = vfprintf_nid_postfix(stream, format, args);
+    const int result = vfprintf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
@@ -105,7 +55,7 @@ static int APS5_VABI PrintStandard(const char* format, ...) {
     std::va_list args;
     va_start(args, format);
 #endif
-    const int result = vprintf_nid_postfix(format, args);
+    const int result = vprintf_nid_postfix(format, reinterpret_cast<VaList*>(args));
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
@@ -121,7 +71,7 @@ static int APS5_VABI FormatString(char* buffer, const char* format, ...) {
     std::va_list args;
     va_start(args, format);
 #endif
-    const int result = vsprintf_nid_postfix(buffer, format, args);
+    const int result = vsprintf_nid_postfix(buffer, format, reinterpret_cast<VaList*>(args));
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
@@ -162,6 +112,7 @@ static void CheckUnlockedStreams() {
     stream.SetError();
     Require(putc_unlocked_nid_postfix('R', &stream) == 'R' && (guest.flags & 0x40));
     clearerr_nid_postfix(&stream);
+
     Require(!(guest.flags & 0x40));
     stream.Close();
 
@@ -171,6 +122,7 @@ static void CheckUnlockedStreams() {
     Require(putc_unlocked_nid_postfix('X', &readOnly) == EOF && (readOnly.GuestState().flags & 0x40));
     Require(ferror_unlocked_nid_postfix(&readOnly) == 1 && feof_unlocked_nid_postfix(&readOnly) == 0);
     clearerr_unlocked_nid_postfix(&readOnly);
+
     Require(ferror_unlocked_nid_postfix(&readOnly) == 0);
     readOnly.Close();
     Require(CheckFileBytes(filename, "A", "rb", false));
@@ -186,6 +138,7 @@ static void CheckUnlockedQueries() {
     stream.SetError();
     Require(feof_unlocked_nid_postfix(&stream) == 1 && ferror_unlocked_nid_postfix(&stream) == 1);
     clearerr_unlocked_nid_postfix(&stream);
+
     Require(feof_unlocked_nid_postfix(&stream) == 0 && ferror_unlocked_nid_postfix(&stream) == 0);
     Require(std::fgetc(stream.GetHandle()) == EOF && std::ungetc('Q', stream.GetHandle()) == 'Q');
     Require(feof_unlocked_nid_postfix(&stream) == 0 && ferror_unlocked_nid_postfix(&stream) == 0);
@@ -195,6 +148,7 @@ static void CheckUnlockedQueries() {
     Require(fgetc_nid_postfix(&stream) == 0x7f && feof_nid_postfix(&stream) == 0);
     Require(fgetc_nid_postfix(&stream) == -1 && feof_nid_postfix(&stream) != 0);
     clearerr_unlocked_nid_postfix(&stream);
+
     Require(feof_nid_postfix(&stream) == 0 && ferror_nid_postfix(&stream) == 0);
     Require(fileno_unlocked_nid_postfix(&stream) == fileno_nid_postfix(&stream) && fileno_unlocked_nid_postfix(&stream) >= 0);
     Require(fileno_unlocked_nid_postfix(nullptr) == -1);
@@ -219,6 +173,7 @@ static void CheckTryLock() {
     Require(ftrylockfile_nid_postfix(&stream) == 0);
     Require(tryFromOtherThread() == -1);
     funlockfile_nid_postfix(&stream);
+
     Require(tryFromOtherThread() == -1);
     std::atomic<bool> written = false;
     std::thread writer([&] {
@@ -228,14 +183,17 @@ static void CheckTryLock() {
     std::this_thread::sleep_for(std::chrono::milliseconds(50));
     Require(!written && fputc_nid_postfix('A', &stream) == 'A');
     funlockfile_nid_postfix(&stream);
+
     writer.join();
     Require(written && tryFromOtherThread() == 0);
     std::atomic<bool> held = false, release = false;
     std::thread owner([&] {
         flockfile_nid_postfix(&stream);
+
         held = true;
         while (!release) std::this_thread::yield();
         funlockfile_nid_postfix(&stream);
+
     });
     while (!held) std::this_thread::yield();
     const int contended = ftrylockfile_nid_postfix(&stream);
@@ -243,6 +201,7 @@ static void CheckTryLock() {
     owner.join();
     Require(contended == -1 && ftrylockfile_nid_postfix(&stream) == 0);
     funlockfile_nid_postfix(&stream);
+
     Require(tryFromOtherThread() == 0);
     Require(fseeko_nid_postfix(&stream, 0, SEEK_SET) == 0);
     Require(fgetc_nid_postfix(&stream) == 'A' && fgetc_nid_postfix(&stream) == 'B');
@@ -263,9 +222,11 @@ static void CheckUnlockedStreamLock(bool write, int (APS5_VABI *query)(FileStrea
     int result = EOF;
     std::thread owner([&] {
         flockfile_nid_postfix(&stream);
+
         held = true;
         while (!release) std::this_thread::yield();
         funlockfile_nid_postfix(&stream);
+
     });
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(1);
     while (!held && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
@@ -301,6 +262,7 @@ static void CheckFgetsSize() {
     FileStream stream(std::tmpfile());
     Require(fwrite_nid_postfix("line\n", 1, 5, &stream) == 5);
     rewind_nid_postfix(&stream);
+
     for (const int size : {0, -1, std::numeric_limits<int>::min()}) {
         char buffer[8];
         std::memset(buffer, '!', sizeof(buffer));
@@ -310,6 +272,7 @@ static void CheckFgetsSize() {
         Require(buffer[0] == '!' && ftello_nid_postfix(&stream) == 0);
         Require(ferror_nid_postfix(&stream) != 0);
         clearerr_nid_postfix(&stream);
+
         Require(ferror_nid_postfix(&stream) == 0);
     }
     char line[8]{};
@@ -323,14 +286,17 @@ static void CheckRewind() {
     Require(fwrite_nid_postfix("ab", 1, 2, &stream) == 2);
     *__error_nid_postfix() = 7;
     rewind_nid_postfix(&stream);
+
     Require(*__error_nid_postfix() == 7 && ftello_nid_postfix(&stream) == 0);
     Require(fgetc_nid_postfix(&stream) == 'a' && ungetc_nid_postfix('z', &stream) == 'z');
     rewind_nid_postfix(&stream);
+
     Require(fgetc_nid_postfix(&stream) == 'a' && fgetc_nid_postfix(&stream) == 'b' && fgetc_nid_postfix(&stream) == EOF);
     Require(feof_nid_postfix(&stream) != 0);
     stream.SetError();
     Require(ferror_nid_postfix(&stream) != 0);
     rewind_nid_postfix(&stream);
+
     Require(feof_nid_postfix(&stream) == 0 && ferror_nid_postfix(&stream) == 0 && fgetc_nid_postfix(&stream) == 'a');
     stream.Close();
     int pipeEnds[2];
@@ -353,6 +319,7 @@ static void CheckRewind() {
     Require(fgetc_nid_postfix(&pipe) == 'q' && fgetc_nid_postfix(&pipe) == EOF && feof_nid_postfix(&pipe) != 0);
     *__error_nid_postfix() = 0;
     rewind_nid_postfix(&pipe);
+
     Require(*__error_nid_postfix() == 29 && feof_nid_postfix(&pipe) == 0 && ferror_nid_postfix(&pipe) == 0);
     pipe.Close();
 }
@@ -572,6 +539,16 @@ static void CheckClosedStreamWrites() {
     Require(fseeko_nid_postfix(&stream, 0, SEEK_SET) == -1 && *__error_nid_postfix() == 9);
     Require(ftello_nid_postfix(&stream) == -1 && *__error_nid_postfix() == 9);
     Require(fileno_nid_postfix(&stream) == -1 && *__error_nid_postfix() == 9);
+    *__error_nid_postfix() = 0;
+    Require(fputwc_nid_postfix(u't', &stream) == -1 && *__error_nid_postfix() == 9);
+    *__error_nid_postfix() = 0;
+    Require(putwc_nid_postfix(u't', &stream) == -1 && *__error_nid_postfix() == 9);
+    *__error_nid_postfix() = 0;
+    Require(fputws_nid_postfix(u"text", &stream) == -1 && *__error_nid_postfix() == 9);
+    *__error_nid_postfix() = 0;
+    Require(ungetwc_nid_postfix('t', &stream) == -1 && *__error_nid_postfix() == 9);
+    *__error_nid_postfix() = 0;
+    Require(ungetwc_nid_postfix(0x100, &stream) == -1 && *__error_nid_postfix() == 9);
     Require(ferror_nid_postfix(&stream) == 0 && feof_nid_postfix(&stream) == 0);
     Require(fclose_nid_postfix(&stream) == -1 && *__error_nid_postfix() == 9);
 }
@@ -582,6 +559,10 @@ static int CheckClosedStandardOutput() {
     Require(puts_nid_postfix("text") == -1 && *__error_nid_postfix() == 9);
     Require(PrintStandard("%d", 1) == -1 && *__error_nid_postfix() == 9);
     Require(fputs_nid_postfix("text", __stdoutp_nid_postfix) == -1 && *__error_nid_postfix() == 9);
+    *__error_nid_postfix() = 0;
+    Require(wprintf_nid_postfix(u"%d", 1) == -1 && *__error_nid_postfix() == 9);
+    *__error_nid_postfix() = 0;
+    Require(putwchar_nid_postfix(u't') == -1 && *__error_nid_postfix() == 9);
     Require(std::fputs("host output\n", stdout) >= 0 && std::fflush(stdout) == 0 && !std::ferror(stdout));
     Require(freopen_nid_postfix("missing-closed-stream-dir/err.log", "a", __stderrp_nid_postfix) == nullptr);
     Require(std::fputs("host error\n", stderr) >= 0 && std::fflush(stderr) == 0 && !std::ferror(stderr));
@@ -641,6 +622,7 @@ int main(int argc, char** argv) {
     auto* wrapped = fdopen_nid_postfix(descriptor, "r+b");
     Require(wrapped != nullptr && fileno_nid_postfix(wrapped) == descriptor);
     setbuf_nid_postfix(wrapped, nullptr);
+
     Require(fseek_nid_postfix(wrapped, 0, SEEK_SET) == 0);
     char contents[32]{};
     Require(fgets_nid_postfix(contents, sizeof(contents), wrapped) == contents && std::strcmp(contents, "retained") == 0);
@@ -713,6 +695,7 @@ int main(int argc, char** argv) {
     Require(fgetc_nid_postfix(&stream) == EOF);
     Require(feof_nid_postfix(&stream) && (guest.flags & 0x20));
     clearerr_nid_postfix(&stream);
+
     Require(!feof_nid_postfix(&stream) && !(guest.flags & 0x20));
     stream.Close();
     Require(guest.flags == 0 && guest.descriptor == -1);
@@ -744,17 +727,21 @@ int main(int argc, char** argv) {
     Require(wideBuf[0] == u'E' && wideBuf[1] == u'n' && wideBuf[2] == u'd' && wideBuf[3] == 0);
     Require(fgetws_nid_postfix(wideBuf, 16, &wideIo) == nullptr);
     Require(feof_nid_postfix(&wideIo));
-    Require(fgetws_nid_postfix(wideBuf, 0, &wideIo) == nullptr && *__error_nid_postfix() == 22);
-    Require(ferror_nid_postfix(&wideIo));
     clearerr_nid_postfix(&wideIo);
+
+    *__error_nid_postfix() = 0;
+    Require(fgetws_nid_postfix(wideBuf, 0, &wideIo) == nullptr && *__error_nid_postfix() == 0);
+    Require(fgetws_nid_postfix(wideBuf, -1, &wideIo) == nullptr && *__error_nid_postfix() == 0);
+    Require(!ferror_nid_postfix(&wideIo));
     Require(fgetws_nid_postfix(nullptr, 16, &wideIo) == nullptr && *__error_nid_postfix() == 22);
     Require(ferror_nid_postfix(&wideIo));
     clearerr_nid_postfix(&wideIo);
+
     Require(fgetws_nid_postfix(wideBuf, 16, nullptr) == nullptr && *__error_nid_postfix() == 22);
     wideBuf[0] = u'X';
     wideBuf[1] = u'Y';
     std::rewind(wideIo.GetHandle());
-    Require(fgetws_nid_postfix(wideBuf, 1, &wideIo) == wideBuf && wideBuf[0] == 0 && wideBuf[1] == u'Y');
+    Require(fgetws_nid_postfix(wideBuf, 1, &wideIo) == nullptr && wideBuf[0] == u'X' && wideBuf[1] == u'Y');
     Require(fgetc_nid_postfix(&wideIo) == 'H');
     wideIo.Close();
 
@@ -778,7 +765,7 @@ int main(int argc, char** argv) {
     Require(fputc_nid_postfix(0xff, &midErr) == 0xff);
     std::rewind(midErr.GetHandle());
     char16_t midBuf[16]{};
-    Require(fgetws_nid_postfix(midBuf, 16, &midErr) == nullptr);
+    Require(fgetws_nid_postfix(midBuf, 16, &midErr) == midBuf && midBuf[0] == u'A' && midBuf[1] == 0);
     Require(ferror_nid_postfix(&midErr));
     midErr.Close();
 
@@ -891,6 +878,7 @@ int main(int argc, char** argv) {
     FileStream locked(std::tmpfile());
     flockfile_nid_postfix(&locked);
     flockfile_nid_postfix(&locked);
+
     std::atomic<bool> lockedWrite = false;
     std::thread writer([&] {
         Require(fputc_nid_postfix('B', &locked) == 'B');
@@ -899,9 +887,11 @@ int main(int argc, char** argv) {
     std::this_thread::sleep_for(std::chrono::milliseconds(50));
     Require(!lockedWrite && fputc_nid_postfix('A', &locked) == 'A');
     funlockfile_nid_postfix(&locked);
+
     std::this_thread::sleep_for(std::chrono::milliseconds(50));
     Require(!lockedWrite);
     funlockfile_nid_postfix(&locked);
+
     writer.join();
     Require(lockedWrite && fseeko_nid_postfix(&locked, 0, SEEK_SET) == 0);
     Require(fgetc_nid_postfix(&locked) == 'A' && fgetc_nid_postfix(&locked) == 'B');
@@ -920,6 +910,14 @@ int main(int argc, char** argv) {
     CheckStandardStreamDeleteSharing();
     const std::string standardFilename = "anyps5-standard-reopen-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
     Require(freopen_nid_postfix(standardFilename.c_str(), "w", __stdoutp_nid_postfix) == __stdoutp_nid_postfix);
+    const HANDLE hostOutput = ::GetStdHandle(STD_OUTPUT_HANDLE);
+    Require(hostOutput != nullptr && hostOutput != INVALID_HANDLE_VALUE);
+    Require(hostOutput != reinterpret_cast<HANDLE>(::_get_osfhandle(::_fileno(stdout))));
+    DWORD handleFlags = 0;
+    Require(::GetHandleInformation(hostOutput, &handleFlags) != 0);
+    constexpr char hostMessage[] = "host stdout preserved\n";
+    DWORD hostWritten = 0;
+    Require(::WriteFile(hostOutput, hostMessage, sizeof(hostMessage) - 1, &hostWritten, nullptr) != 0 && hostWritten == sizeof(hostMessage) - 1);
     Require(printf_nid_postfix("standard output") == 15 && fflush_nid_postfix(__stdoutp_nid_postfix) == 0);
     { std::ifstream input(standardFilename, std::ios::binary); std::string contents; std::getline(input, contents);
       Require(contents == "standard output"); }
diff --git a/core/libs/tests/GuestStatvfs.cpp b/core/libs/tests/GuestStatvfs.cpp
index 2019801dc0..ba87a280b0 100644
--- a/core/libs/tests/GuestStatvfs.cpp
+++ b/core/libs/tests/GuestStatvfs.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <array>
 #include <chrono>
@@ -18,9 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI statvfs_nid_postfix(const char*, void*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "statvfs check failed at line %d\n", line);
@@ -33,7 +32,7 @@ static void RequireVolume(const char* path, const std::filesystem::path& native)
     std::array<std::uint64_t, 13> output;
     output.fill(0xA5A5A5A5A5A5A5A5ull);
     *__error_nid_postfix() = 12345;
-    Require(statvfs_nid_postfix(path, output.data() + 1) == 0);
+    Require(statvfs_nid_postfix(path, reinterpret_cast<LibcStatvfs*>(output.data() + 1)) == 0);
     Require(*__error_nid_postfix() == 12345);
     Require(output.front() == 0xA5A5A5A5A5A5A5A5ull && output.back() == output.front());
     const auto* fields = output.data() + 1;
@@ -49,7 +48,7 @@ static void RequireError(const char* path, int error) {
     output.fill(0x5A5A5A5A5A5A5A5Aull);
     const auto saved = output;
     *__error_nid_postfix() = 0;
-    const int result = statvfs_nid_postfix(path, output.data());
+    const int result = statvfs_nid_postfix(path, reinterpret_cast<LibcStatvfs*>(output.data()));
     if (result != -1)
         std::fprintf(stderr, "path %s: expected failure, got %d\n", path ? path : "(null)", result);
     Require(result == -1);
diff --git a/core/libs/tests/GuestStdExecuteOnce.cpp b/core/libs/tests/GuestStdExecuteOnce.cpp
index d189ddcd71..9bead6d3e1 100644
--- a/core/libs/tests/GuestStdExecuteOnce.cpp
+++ b/core/libs/tests/GuestStdExecuteOnce.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -5,7 +6,7 @@
 #include <thread>
 
 using Callback = int (APS5_VABI *)(void*, void*, void**);
-extern "C" int APS5_VABI std_execute_once_nid_postfix(int*, Callback, void*);
+
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::atomic<int> calls{0}, arrived{0};
@@ -53,6 +54,7 @@ int main() {
 
     try {
         std_execute_once_nid_postfix(&throwing, Throw, nullptr);
+
         std::abort();
     } catch (int value) {
         Require(value == 7 && throwing == 0);
diff --git a/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp
new file mode 100644
index 0000000000..a0e900ce98
--- /dev/null
+++ b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp
@@ -0,0 +1,14 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <thread>
+
+int main() {
+    const unsigned result = _ZNSt6thread20hardware_concurrencyEv_nid_postfix();
+    if (result != std::thread::hardware_concurrency()) {
+        std::fprintf(stderr, "guest processor hint %u differs from std::thread::hardware_concurrency %u\n",
+            result, std::thread::hardware_concurrency());
+        return 1;
+    }
+    return 0;
+}
diff --git a/core/libs/tests/GuestStdioVariadic.cpp b/core/libs/tests/GuestStdioVariadic.cpp
index 62ead8be7f..80d9e2d166 100644
--- a/core/libs/tests/GuestStdioVariadic.cpp
+++ b/core/libs/tests/GuestStdioVariadic.cpp
@@ -1,5 +1,7 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <cerrno>
 #include <cstdarg>
 #include <cstdint>
 #include <cstdio>
@@ -9,13 +11,7 @@
 
 extern "C" {
 extern FileStream* __stdinp_nid_postfix;
-int APS5_VABI vfscanf_nid_postfix(FileStream*, const char*, void*);
-int APS5_VABI vscanf_nid_postfix(const char*, void*);
-int APS5_VABI scanf_nid_postfix(const char*, ...);
-int APS5_VABI vfwprintf_nid_postfix(FileStream*, const char16_t*, void*);
-int APS5_VABI fwprintf_nid_postfix(FileStream*, const char16_t*, ...);
-int APS5_VABI vswscanf_nid_postfix(const char16_t*, const char16_t*, void*);
-int APS5_VABI vswscanf_s_nid_postfix(const char16_t*, const char16_t*, void*);
+
 }
 
 #ifdef _WIN32
@@ -34,39 +30,124 @@ static void Require(bool value, const char* what) {
 
 static int APS5_VABI ScanStream(FileStream* stream, const char* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfscanf_nid_postfix(stream, format, args);
+    const int result = vfscanf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanInput(const char* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vscanf_nid_postfix(format, args);
+    const int result = vscanf_nid_postfix(format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
+static int APS5_VABI PrintSecure(FileStream* stream, const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI PrintSecureOutput(const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vprintf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI ScanSecureStream(FileStream* stream, const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfscanf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI ScanSecureInput(const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vscanf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI PrintWideSecure(FileStream* stream, const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfwprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI PrintWideSecureOutput(const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vwprintf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static FileStream* SeededStream(const char* text) {
+    auto* stream = new FileStream(std::tmpfile(), true);
+    Require(std::fputs(text, stream->GetHandle()) >= 0, "seed a stream");
+    std::rewind(stream->GetHandle());
+    return stream;
+}
+
+static int NextByte(FileStream* stream) {
+    return std::fgetc(stream->GetHandle());
+}
+
 static int APS5_VABI PrintWide(FileStream* stream, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfwprintf_nid_postfix(stream, format, args);
+    const int result = vfwprintf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanWide(const char16_t* input, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vswscanf_nid_postfix(input, format, args);
+    const int result = vswscanf_nid_postfix(input, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanWideSized(const char16_t* input, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vswscanf_s_nid_postfix(input, format, args);
+    const int result = vswscanf_s_nid_postfix(input, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
+static long APS5_VABI SumThroughCopy(int count, ...) {
+    APS5_VA_BEGIN(count);
+    unsigned char before[24];
+    std::memcpy(before, &args, sizeof(before));
+#ifdef _WIN32
+    __builtin_sysv_va_list copy;
+#else
+    std::va_list copy;
+#endif
+    _Vacopy_nid_postfix(reinterpret_cast<unsigned char*>(&copy), reinterpret_cast<const unsigned char*>(&args));
+
+    Require(std::memcmp(&copy, &args, sizeof(before)) == 0, "_Vacopy copies all 24 bytes");
+    long sum = 0;
+    for (int index = 0; index < count; ++index) sum += __builtin_va_arg(copy, long) * (index + 1);
+    Require(std::memcmp(&args, before, sizeof(before)) == 0, "_Vacopy leaves the source untouched");
+    for (int index = 0; index < count; ++index) sum -= __builtin_va_arg(args, long);
+    APS5_VA_END();
+    return sum;
+}
+
+static void CheckVacopy() {
+    long expected = 0;
+    for (long index = 1; index <= 9; ++index) expected += index * 100 * index - index * 100;
+    Require(SumThroughCopy(9, 100L, 200L, 300L, 400L, 500L, 600L, 700L, 800L, 900L) == expected, "_Vacopy copy reads every argument");
+    unsigned char overlap[32];
+    for (int index = 0; index < 32; ++index) overlap[index] = static_cast<unsigned char>(index);
+    _Vacopy_nid_postfix(overlap + 8, overlap);
+
+    const unsigned char shifted[32] = {0, 1, 2, 3, 4, 5, 6, 7, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23};
+    Require(std::memcmp(overlap, shifted, sizeof(overlap)) == 0, "_Vacopy copies the overflow area before the offsets");
+}
+
 static std::string Contents(FileStream& stream) {
     std::fflush(stream.GetHandle());
     std::rewind(stream.GetHandle());
@@ -101,14 +182,114 @@ int main() {
     FileStream written(std::tmpfile());
     Require(fwprintf_nid_postfix(&written, u"%d:%ls|", 7, u"été") == 6, "fwprintf counts wide characters");
     Require(PrintWide(&written, u"%5.1f", 2.25) == 5, "vfwprintf counts wide characters");
-    Require(Contents(written) == "7:\xc3\xa9t\xc3\xa9|  2.2", "the stream holds the formatted text");
+    Require(Contents(written) == "7:\xc3\xa9t\xc3\xa9|  2.3", "the stream holds the formatted text");
     written.Close();
 
+    FileStream securePlain(std::tmpfile());
+    FileStream secureChecked(std::tmpfile());
+    FileStream secureList(std::tmpfile());
+    Require(fprintf_nid_postfix(&securePlain, "%d|%s|%5.2f|%c|%ls", 42, "ab", 3.14159, 'z', u"é") == 16, "fprintf reference");
+    Require(fprintf_s_nid_postfix(&secureChecked, "%d|%s|%5.2f|%c|%ls", 42, "ab", 3.14159, 'z', u"é") == 16, "fprintf_s count");
+    Require(PrintSecure(&secureList, "%d|%s|%5.2f|%c|%ls", 42, "ab", 3.14159, 'z', u"é") == 16, "vfprintf_s count");
+    const std::string expectedText = "42|ab| 3.14|z|\xc3\xa9";
+    Require(Contents(securePlain) == expectedText, "fprintf reference bytes");
+    Require(Contents(secureChecked) == expectedText, "fprintf_s writes the bytes fprintf writes");
+    Require(Contents(secureList) == expectedText, "vfprintf_s writes the bytes fprintf writes");
+    securePlain.Close();
+    secureChecked.Close();
+    secureList.Close();
+
+    FileStream violations(std::tmpfile());
+    signed char marker = -7;
+    char sibling[16];
+    Require(snprintf_s_nid_postfix(sibling, sizeof(sibling), "ab%hhn", &marker) == -1, "snprintf_s rejects %n");
+    Require(fprintf_s_nid_postfix(&violations, "ab%hhn", &marker) == -1 && marker == -7, "fprintf_s rejects %n like snprintf_s");
+    Require(PrintSecure(&violations, "ab%n", &number) == -1, "vfprintf_s rejects %n");
+    Require(snprintf_s_nid_postfix(sibling, sizeof(sibling), "%s", static_cast<const char*>(nullptr)) == -1, "snprintf_s rejects a null %s");
+    Require(fprintf_s_nid_postfix(&violations, "x%s", static_cast<const char*>(nullptr)) == -1, "fprintf_s rejects a null %s");
+    Require(fprintf_s_nid_postfix(&violations, static_cast<const char*>(nullptr)) == -1, "fprintf_s rejects a null format");
+    Require(PrintSecure(&violations, static_cast<const char*>(nullptr)) == -1, "vfprintf_s rejects a null format");
+    Require(fprintf_s_nid_postfix(nullptr, "x") == -1, "fprintf_s rejects a null stream");
+    Require(PrintSecure(nullptr, "x") == -1, "vfprintf_s rejects a null stream");
+    Require(Contents(violations).empty(), "a rejected call writes nothing");
+    Require(fprintf_s_nid_postfix(&violations, "%s", "") == 0, "fprintf_s of an empty string");
+    violations.Close();
+    errno = 0;
+    Require(fprintf_s_nid_postfix(&violations, "x") == -1 && errno == 9, "fprintf_s on a closed stream sets EBADF");
+    Require(PrintSecureOutput("vprintf_s: %d\n", 42) == 14, "vprintf_s counts the bytes written to standard output");
+    Require(PrintSecureOutput("%n", &number) == -1 && PrintSecureOutput(static_cast<const char*>(nullptr)) == -1, "vprintf_s violations");
+
+    FileStream wideChecked(std::tmpfile());
+    FileStream wideList(std::tmpfile());
+    int widePosition = -5;
+    Require(fwprintf_s_nid_postfix(&wideChecked, u"%05d:%ls|", 42, u"été") == 10, "fwprintf_s counts wide characters");
+    Require(PrintWideSecure(&wideList, u"%05d:%ls|", 42, u"été") == 10, "vfwprintf_s counts wide characters");
+    Require(Contents(wideChecked) == "00042:\xc3\xa9t\xc3\xa9|" && Contents(wideList) == Contents(wideChecked), "wide secure output bytes");
+    Require(fwprintf_s_nid_postfix(&wideChecked, u"a%n", &widePosition) == -1 && widePosition == -5, "fwprintf_s rejects %n");
+    Require(PrintWideSecure(&wideChecked, u"a%ls", static_cast<const char16_t*>(nullptr)) == -1, "vfwprintf_s rejects a null %ls");
+    Require(fwprintf_s_nid_postfix(&wideChecked, static_cast<const char16_t*>(nullptr)) == -1, "fwprintf_s rejects a null format");
+    Require(fwprintf_s_nid_postfix(nullptr, u"x") == -1 && PrintWideSecure(nullptr, u"x") == -1, "wide secure forms reject a null stream");
+    wideChecked.Close();
+    wideList.Close();
+    errno = 0;
+    Require(fwprintf_s_nid_postfix(&wideList, u"x") == -1 && errno == 9, "fwprintf_s on a closed stream sets EBADF");
+    Require(wprintf_s_nid_postfix(u"wprintf_s %d\n", 5) == 12, "wprintf_s counts wide characters");
+    Require(PrintWideSecureOutput(u"vwprintf_s %d\n", 6) == 13, "vwprintf_s counts wide characters");
+    Require(wprintf_s_nid_postfix(u"%n", &widePosition) == -1 && PrintWideSecureOutput(static_cast<const char16_t*>(nullptr)) == -1, "wide standard output violations");
+
+    FileStream* sizedInput = SeededStream("17 hello Q 9 12abc key=val abcdef 4.5");
+    char sizedWord[6]{};
+    char sizedChar = 0;
+    Require(fscanf_s_nid_postfix(sizedInput, "%d %s %c", &number, sizedWord, 6u, &sizedChar, 1u) == 3, "fscanf_s assigns the sized conversions");
+    Require(number == 17 && std::strcmp(sizedWord, "hello") == 0 && sizedChar == 'Q', "fscanf_s values");
+    Require(ScanSecureStream(sizedInput, "%d", &number) == 1 && number == 9, "vfscanf_s continues from the stream position");
+    Require(fscanf_s_nid_postfix(sizedInput, "%d", &number) == 1 && number == 12 && NextByte(sizedInput) == 'a', "fscanf_s leaves the character that ended the number");
+    char key[4]{};
+    char value[8]{};
+    Require(fscanf_s_nid_postfix(sizedInput, "bc %3[a-z]=%7s", key, 4u, value, 8u) == 2, "fscanf_s with a set and a string");
+    Require(std::strcmp(key, "key") == 0 && std::strcmp(value, "val") == 0 && NextByte(sizedInput) == ' ', "fscanf_s set and string values");
+    char tooSmall[4] = {'x', 'x', 'x', 'x'};
+    char siblingSmall[4] = {'x', 'x', 'x', 'x'};
+    Require(sscanf_s_nid_postfix("abcdef", "%s", siblingSmall, 4u) == 0 && siblingSmall[0] == '\0', "sscanf_s reference for an undersized buffer");
+    Require(fscanf_s_nid_postfix(sizedInput, "%s", tooSmall, 4u) == 0 && tooSmall[0] == '\0', "fscanf_s rejects an undersized buffer like sscanf_s");
+    sizedInput->Close();
+    errno = 0;
+    Require(fscanf_s_nid_postfix(sizedInput, "%d", &number) == EOF && errno == 9, "fscanf_s on a closed stream sets EBADF");
+    delete sizedInput;
+
+    FileStream* tailInput = SeededStream("x 3.5 7");
+    int count = 0;
+    Require(ScanSecureStream(tailInput, "%d", &number) == 0, "vfscanf_s matching failure");
+    Require(fscanf_s_nid_postfix(tailInput, " x %*f%n %d", &count, &number) == 1 && count == 5 && number == 7, "fscanf_s suppression and %n");
+    Require(fscanf_s_nid_postfix(tailInput, "%d", &number) == EOF, "fscanf_s at end of file");
+    tailInput->Close();
+    delete tailInput;
+
+    FileStream* nullInput = SeededStream("5 6");
+    Require(fscanf_s_nid_postfix(nullInput, "%d", static_cast<int*>(nullptr)) == EOF, "fscanf_s null destination");
+    Require(fscanf_s_nid_postfix(nullInput, static_cast<const char*>(nullptr)) == EOF, "fscanf_s null format");
+    Require(fscanf_s_nid_postfix(nullptr, "%d", &number) == EOF && ScanSecureStream(nullptr, "%d", &number) == EOF, "fscanf_s null stream");
+    nullInput->Close();
+    delete nullInput;
+
+    FileStream* const savedInput = __stdinp_nid_postfix;
+    FileStream* redirected = SeededStream("21 word 3 more");
+    __stdinp_nid_postfix = redirected;
+    char redirectedWord[8]{};
+    int redirectedNumber = 0;
+    Require(scanf_s_nid_postfix("%d %7s", &number, redirectedWord, 8u) == 2 && number == 21 && std::strcmp(redirectedWord, "word") == 0, "scanf_s reads the guest standard input");
+    Require(ScanSecureInput("%d %4s", &redirectedNumber, redirectedWord, 5u) == 2 && redirectedNumber == 3 && std::strcmp(redirectedWord, "more") == 0, "vscanf_s reads the guest standard input");
+    Require(scanf_s_nid_postfix("%d", &number) == EOF, "scanf_s at end of input");
+    __stdinp_nid_postfix = savedInput;
+    redirected->Close();
+    delete redirected;
+
     std::int32_t a = 0, b = 0;
     Require(ScanWide(u"  31 -4", u"%d%d", &a, &b) == 2 && a == 31 && b == -4, "vswscanf");
     Require(ScanWide(u"", u"%d", &a) == EOF, "vswscanf on empty input");
     char16_t letters[4]{};
     Require(ScanWideSized(u"abcdef", u"%3ls", letters, 4u) == 1 && std::u16string(letters) == u"abc", "vswscanf_s %ls with a size");
     Require(ScanWideSized(u"abcdef", u"%ls", letters, 4u) == 0 && letters[0] == 0, "vswscanf_s rejects a too small buffer");
+    CheckVacopy();
     return 0;
 }
diff --git a/core/libs/tests/GuestStrftime.cpp b/core/libs/tests/GuestStrftime.cpp
index eef399eda0..cf18e7c687 100644
--- a/core/libs/tests/GuestStrftime.cpp
+++ b/core/libs/tests/GuestStrftime.cpp
@@ -1,95 +1,253 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include <cstddef>
 #include <cstdio>
 #include <cstring>
-
-extern "C" {
-std::size_t APS5_VABI strftime_nid_postfix(char*, std::size_t, const char*, const GuestTm*);
-char* APS5_VABI asctime_nid_postfix(const GuestTm*);
-}
+#include <stdexcept>
 
 namespace {
 
-GuestTm MakeTime(int year, int hour, int wday, int yday, int isdst) {
+bool correct = true;
+
+GuestTm MakeTime() {
     GuestTm time{};
-    time.tm_sec = 5;
-    time.tm_min = 4;
-    time.tm_hour = hour;
+    time.tm_year = 126;
+    time.tm_mon = 9;
     time.tm_mday = 2;
-    time.tm_mon = 0;
-    time.tm_year = year;
-    time.tm_wday = wday;
-    time.tm_yday = yday;
-    time.tm_isdst = isdst;
+    time.tm_hour = 13;
+    time.tm_min = 5;
+    time.tm_sec = 9;
+    time.tm_wday = 5;
+    time.tm_yday = 274;
     time.tm_gmtoff = 19800;
-    time.tm_zone = "IST";
+    time.tm_zone = "XYZ";
     return time;
 }
 
+void Check(const char* name, const GuestTm& time, const char* format, const char* expected) {
+    char text[256];
+    const std::size_t length = strftime_nid_postfix(text, sizeof(text), format, &time);
+    if (length != std::strlen(expected) || std::strcmp(text, expected) != 0) {
+        std::fprintf(stderr, "strftime %s (\"%s\"): expected \"%s\", received \"%s\" (%zu)\n", name, format, expected, length == 0 ? "" : text, length);
+        correct = false;
+    }
+}
+
+void CheckAsctime(const char* name, const GuestTm& time, const char* expected) {
+    const char* result = asctime_nid_postfix(&time);
+    if (std::strcmp(result, expected) != 0) {
+        std::fprintf(stderr, "asctime %s: expected \"%s\", received \"%s\"\n", name, expected, result);
+        correct = false;
+    }
+}
+
 }
 
 int main() {
-    struct Case {
-        const char* name;
-        int year;
-        int hour;
-        int wday;
-        int yday;
-        int isdst;
-        const char* format;
+    if (setenv_nid_postfix("TZ", "UTC+3", 1) != 0) return 1;
+    tzset_nid_postfix();
+    const GuestTm base = MakeTime();
+    Check("names", base, "%a|%A|%b|%B|%h", "Fri|Friday|Oct|October|Oct");
+    Check("composites", base, "%c|%D|%x|%X|%T|%r|%R|%F", "Fri Oct  2 13:05:09 2026|10/02/26|10/02/26|13:05:09|13:05:09|01:05:09 PM|13:05|2026-10-02");
+    Check("numbers", base, "%C|%d|%e|%g|%G|%H|%I|%j|%m|%M|%p|%S|%u|%U|%V|%w|%W|%y|%Y", "20|02| 2|26|2026|13|01|275|10|05|PM|09|5|39|40|5|39|26|2026");
+    Check("whitespace and percent", base, "%n%t%%", "\n\t%");
+    Check("alternative forms", base, "%Ec|%EC|%Ex|%EX|%Ey|%EY|%Od|%Oe|%OH|%OI|%Om|%OM|%OS|%Ou|%OU|%OV|%Ow|%OW|%Oy|%Ez", "Fri Oct  2 13:05:09 2026|20|10/02/26|13:05:09|26|2026|02| 2|13|01|10|05|09|5|39|40|5|39|26|-0300");
+    Check("other conversions", base, "%k|%l|%P|%s|%+|%v|%Q|%q", "%k|%l|%P|%s|%+|%v|%Q|%q");
+    Check("flags and widths", base, "%-d|%_d|%0e|%^a|%#b|%10Y", "%-d|%_d|%0e|%^a|%#b|%10Y");
+    Check("modifier before an unknown conversion", base, "%Ea|%Oa|%EE|%OO|%Ek|%EY", "Fri|Fri|%E|%O|%k|2026");
+    Check("trailing percent", base, "ab%", "ab%");
+    Check("zone", base, "%z|%Z", "-0300|UTC");
+
+    GuestTm zone = base;
+    zone.tm_isdst = 1;
+    zone.tm_gmtoff = -1;
+    Check("zone in daylight time", zone, "%z", "-0200");
+    zone.tm_isdst = -1;
+    Check("zone with unknown daylight time", zone, "%z", "-0300");
+
+    for (int value = -3; value <= 14; ++value) {
+        GuestTm time = base;
+        time.tm_wday = value;
+        time.tm_mon = value;
+        static const char* const expected[] = {
+            "Sun|Sun|Jan|Jan|00|0|0", "Sun|Sun|Jan|Jan|00|0|0", "Sun|Sun|Jan|Jan|00|0|0", "Sun|Sunday|Jan|January|01|7|0",
+            "Mon|Monday|Feb|February|02|1|1", "Tue|Tuesday|Mar|March|03|2|2", "Wed|Wednesday|Apr|April|04|3|3", "Thu|Thursday|May|May|05|4|4",
+            "Fri|Friday|Jun|June|06|5|5", "Sat|Saturday|Jul|July|07|6|6", "||Aug|August|08|7|7", "||Sep|September|09|8|8",
+            "||Oct|October|10|9|9", "||Nov|November|11|0|0", "||Dec|December|12|1|1", "||||13|2|2", "||||14|3|3", "||||15|4|4",
+        };
+        char name[24];
+        std::snprintf(name, sizeof(name), "index %d", value);
+        Check(name, time, "%a|%A|%b|%B|%m|%u|%w", expected[value + 3]);
+    }
+
+    struct Field {
+        int value;
         const char* expected;
     };
-    constexpr Case cases[] = {
-        {"alternative", 126, 3, 5, 1, 0, "%Ea %OX %OD %EF %EEY", "Fri 03:04:05 01/02/26 2026-01-02 EY"},
-        {"padding", 126, 3, 5, 1, 0, "%-d|%_d|%0e|%-k|%_+|%--d", "2| 2|02|3|Fri Jan  2 03:04:05 IST 2026|-d"},
-        {"zone", 126, 3, 5, 1, 0, "%z %Z %0z", "+0530 IST +0530"},
-        {"year 899", -1001, 3, 5, 1, 0, "%Y %C %y %G %g %F", "0899 08 99 0899 99 0899-01-02"},
-        {"year -1", -1901, 3, 5, 1, 0, "%Y %C %y %c", "-001 -0 01 Fri Jan  2 03:04:05 -001"},
-        {"year 12345", 10445, 3, 5, 1, 0, "%Y %C %y %D %v", "12345 123 45 01/02/45  2-Jan-12345"},
-        {"out of range", 126, 100, 8, 400, 0, "%I %l %u %W %U %j %a %p", "04  4 8 57 57 401 ? PM"},
-        {"unknown dst", 126, 3, 5, 1, -1, "[%z][%Z]", "[][IST]"},
-        {"literals", 126, 3, 5, 1, 0, "%q %% %", "q % %"},
+    constexpr Field fields[] = {
+        {-25, "00|00|AM|00|00|00| 0|000|00|00"}, {-13, "00|00|AM|00|00|00| 0|000|00|00"}, {-12, "00|00|AM|00|00|00| 0|000|00|00"},
+        {-1, "00|11|AM|00|00|00| 0|000|00|00"}, {0, "00|12|AM|00|00|00| 0|001|00|00"}, {1, "01|01|AM|01|01|01| 1|002|00|00"},
+        {11, "11|11|AM|11|11|11|11|012|01|02"}, {12, "12|12|PM|12|12|12|12|013|02|02"}, {13, "13|01|PM|13|13|13|13|014|02|02"},
+        {25, "25|01|PM|25|25|25|25|026|03|04"}, {99, "99|03|PM|99|99|99|99|100|14|14"}, {100, "00|04|PM|00|00|00| 0|101|14|14"},
     };
-    bool correct = true;
-    for (const auto& test : cases) {
-        const GuestTm time = MakeTime(test.year, test.hour, test.wday, test.yday, test.isdst);
-        char text[128];
-        const std::size_t length = strftime_nid_postfix(text, sizeof(text), test.format, &time);
-        if (length != std::strlen(test.expected) || std::strcmp(text, test.expected) != 0) {
-            std::fprintf(stderr, "strftime %s (\"%s\"): expected \"%s\", received \"%s\" (%zu)\n",
-                test.name, test.format, test.expected, length == 0 ? "" : text, length);
-            correct = false;
-        }
+    for (const auto& field : fields) {
+        GuestTm time = base;
+        time.tm_hour = field.value;
+        time.tm_min = field.value;
+        time.tm_sec = field.value;
+        time.tm_mday = field.value;
+        time.tm_yday = field.value;
+        char name[24];
+        std::snprintf(name, sizeof(name), "field %d", field.value);
+        Check(name, time, "%H|%I|%p|%M|%S|%d|%e|%j|%U|%W", field.expected);
     }
-    const GuestTm now = MakeTime(126, 3, 5, 1, 0);
-    char text[32];
-    if (strftime_nid_postfix(text, 10, "%Y-%m-%d", &now) != 0 || strftime_nid_postfix(text, 11, "%Y-%m-%d", &now) != 10) {
-        std::fprintf(stderr, "strftime does not return 0 when the result and its terminator do not fit\n");
-        correct = false;
+
+    constexpr Field numbers[] = {
+        {-10, "00| 0|000|00|00|00"}, {9, "09| 9|010|09|09|09"}, {101, "01| 1|102|01|01|01"}, {999, "99|99|000|99|99|99"},
+        {1000, "00| 0|001|00|00|00"}, {123456, "56|56|457|56|56|56"},
+    };
+    for (const auto& field : numbers) {
+        GuestTm time = base;
+        time.tm_hour = field.value;
+        time.tm_min = field.value;
+        time.tm_sec = field.value;
+        time.tm_mday = field.value;
+        time.tm_yday = field.value;
+        char name[24];
+        std::snprintf(name, sizeof(name), "number %d", field.value);
+        Check(name, time, "%d|%e|%j|%H|%M|%S", field.expected);
     }
-    if (strftime_nid_postfix(text, sizeof(text), nullptr, &now) == 0 || std::strcmp(text, "Fri Jan  2 03:04:05 2026") != 0) {
-        std::fprintf(stderr, "strftime with a null format does not format %%c\n");
-        correct = false;
-    }
-    struct AsctimeCase {
-        int year;
+    GuestTm leap = base;
+    leap.tm_sec = 61;
+    Check("leap second", leap, "%S|%T", "61|13:05:61");
+
+    struct Year {
+        int tmYear;
         const char* expected;
     };
-    constexpr AsctimeCase asctimeCases[] = {
-        {126, "Fri Jan  2 03:04:05 2026\n"},
-        {-1001, "Fri Jan  2 03:04:05 0899\n"},
-        {-1901, "Fri Jan  2 03:04:05 -001\n"},
-        {10445, "Fri Jan  2 03:04:05     12345\n"},
-        {-2147483647 - 1, "Fri Jan  2 03:04:05     -2147481748\n"},
+    constexpr Year years[] = {
+        {-14245, "0000|00|55|0000|55"}, {-11900, "0000|00|00|0000|00"}, {-2001, "0000|00|99|0000|99"}, {-1999, "0000|00|01|0000|01"},
+        {-1901, "0000|00|99|0000|99"}, {-1900, "0000|00|00|0000|00"}, {-1899, "0001|01|01|0001|01"}, {-1800, "0100|01|00|0100|00"},
+        {-1, "1899|19|99|1899|99"}, {0, "1900|19|00|1900|00"}, {8099, "9999|99|99|9999|99"}, {8100, "0000|00|00|0000|00"},
+        {8101, "0001|00|01|0001|01"}, {10099, "1999|19|99|1999|99"}, {10445, "2345|23|45|2345|45"},
     };
-    for (const auto& test : asctimeCases) {
-        const GuestTm time = MakeTime(test.year, 3, 5, 1, 0);
-        const char* result = asctime_nid_postfix(&time);
-        if (std::strcmp(result, test.expected) != 0) {
-            std::fprintf(stderr, "asctime of tm_year %d: expected \"%s\", received \"%s\"\n", test.year, test.expected, result);
-            correct = false;
-        }
+    for (const auto& year : years) {
+        GuestTm time = base;
+        time.tm_year = year.tmYear;
+        char name[24];
+        std::snprintf(name, sizeof(name), "year %d", year.tmYear);
+        Check(name, time, "%Y|%C|%y|%G|%g", year.expected);
     }
+
+    struct Iso {
+        int year, mon, mday, wday, yday;
+        const char* expected;
+    };
+    constexpr Iso weeks[] = {
+        {126, 0, 1, 4, 0, "2026|26|01|00|00"}, {126, 0, 4, 0, 3, "2026|26|01|01|00"}, {126, 0, 5, 1, 4, "2026|26|02|01|01"},
+        {120, 11, 31, 4, 365, "2020|20|53|52|52"}, {121, 0, 3, 0, 2, "2020|20|53|01|00"}, {121, 0, 4, 1, 3, "2021|21|01|01|01"},
+        {124, 11, 30, 1, 364, "2025|25|01|52|53"}, {104, 11, 31, 5, 365, "2004|04|53|52|52"}, {105, 0, 2, 0, 1, "2004|04|53|01|00"},
+        {126, 0, 1, 9, 10, "2026|26|02|02|02"}, {126, 0, 1, -2, 10, "2026|26|02|01|01"}, {-1901, 0, 1, 4, 0, "0000|99|01|00|00"},
+    };
+    for (const auto& week : weeks) {
+        GuestTm time = base;
+        time.tm_year = week.year;
+        time.tm_mon = week.mon;
+        time.tm_mday = week.mday;
+        time.tm_wday = week.wday;
+        time.tm_yday = week.yday;
+        char name[48];
+        std::snprintf(name, sizeof(name), "week %d/%d wday %d yday %d", week.year, week.mon, week.wday, week.yday);
+        Check(name, time, "%G|%g|%V|%U|%W", week.expected);
+    }
+
+    constexpr Iso outOfRangeWeeks[] = {
+        {126, 0, 11, -2, 10, "01|01"}, {126, 1, 5, 4, 400, "57|57"}, {126, 3, 11, -19, 100, "16|16"}, {126, 9, 5, -16, 277, "40|41"},
+        {126, 0, 19, -12, 18, "04|04"}, {126, 0, 1, 6, 1365, "95|95"}, {97, 0, 1, 6, 415, "59|59"}, {113, 11, 31, 1, 365, "53|53"},
+        {7, 11, 31, 1, 365, "53|53"}, {126, 9, 24, 6, 296, "42|42"},
+    };
+    for (const auto& week : outOfRangeWeeks) {
+        GuestTm time = base;
+        time.tm_year = week.year;
+        time.tm_mon = week.mon;
+        time.tm_mday = week.mday;
+        time.tm_wday = week.wday;
+        time.tm_yday = week.yday;
+        char name[48];
+        std::snprintf(name, sizeof(name), "week number wday %d yday %d", week.wday, week.yday);
+        Check(name, time, "%U|%W", week.expected);
+    }
+
+    char text[8];
+    std::memset(text, '#', sizeof(text));
+    if (strftime_nid_postfix(text, 5, "%Y", &base) != 4 || std::strcmp(text, "2026") != 0) {
+        std::fprintf(stderr, "strftime does not fill a buffer that holds the result and its terminator\n");
+        correct = false;
+    }
+    std::memset(text, '#', sizeof(text));
+    if (strftime_nid_postfix(text, 4, "%Y", &base) != 0 || std::memcmp(text, "2026#", 5) != 0) {
+        std::fprintf(stderr, "strftime with no room for the terminator does not return 0 after writing the conversion\n");
+        correct = false;
+    }
+    std::memset(text, '#', sizeof(text));
+    if (strftime_nid_postfix(text, 5, "ab%Ycd", &base) != 0 || std::memcmp(text, "ab####", 6) != 0) {
+        std::fprintf(stderr, "strftime writes part of a conversion that does not fit\n");
+        correct = false;
+    }
+    std::memset(text, '#', sizeof(text));
+    if (strftime_nid_postfix(text, 8, "%t%D", &base) != 0 || std::memcmp(text, "\t10/02/#", 8) != 0) {
+        std::fprintf(stderr, "strftime does not write the parts of a composite conversion that fit\n");
+        correct = false;
+    }
+    std::memset(text, '#', sizeof(text));
+    if (strftime_nid_postfix(text, 2, "%X%#H", &base) != 0 || std::memcmp(text, "13#", 3) != 0) {
+        std::fprintf(stderr, "strftime does not stop a composite conversion at the first part that does not fit\n");
+        correct = false;
+    }
+    std::memset(text, '#', sizeof(text));
+    if (strftime_nid_postfix(text, 3, "abc", &base) != 0 || std::memcmp(text, "abc#", 4) != 0) {
+        std::fprintf(stderr, "strftime does not write the literals that fit\n");
+        correct = false;
+    }
+    std::memset(text, '#', sizeof(text));
+    if (strftime_nid_postfix(text, 0, "%Y", &base) != 0 || text[0] != '#') {
+        std::fprintf(stderr, "strftime writes to a zero-size buffer\n");
+        correct = false;
+    }
+    bool threw = false;
+    try {
+        strftime_nid_postfix(text, sizeof(text), "%E", &base);
+    } catch (const std::invalid_argument&) {
+        threw = true;
+    }
+    if (!threw) {
+        std::fprintf(stderr, "strftime does not throw for a format ending after a modifier\n");
+        correct = false;
+    }
+
+    CheckAsctime("base", base, "Fri Oct  2 13:05:09 2026\n");
+    GuestTm negative = base;
+    negative.tm_wday = -1;
+    negative.tm_mon = -1;
+    CheckAsctime("negative names", negative, "Sun Jan  2 13:05:09 2026\n");
+    GuestTm past = base;
+    past.tm_wday = 7;
+    past.tm_mon = 12;
+    CheckAsctime("names past the tables", past, "   2 13:05:09 2026\n");
+    GuestTm big = base;
+    big.tm_mday = 40;
+    big.tm_hour = 25;
+    big.tm_min = 61;
+    big.tm_sec = 61;
+    CheckAsctime("large fields", big, "Fri Oct 40 25:61:61 2026\n");
+    big.tm_mday = 123456;
+    big.tm_hour = -10;
+    CheckAsctime("wrapped and negative fields", big, "Fri Oct 56 00:61:61 2026\n");
+    GuestTm year = base;
+    year.tm_year = 8100;
+    CheckAsctime("year 10000", year, "Fri Oct  2 13:05:09 0000\n");
+    year.tm_year = -1901;
+    CheckAsctime("year -1", year, "Fri Oct  2 13:05:09 0000\n");
     return correct ? 0 : 1;
 }
diff --git a/core/libs/tests/GuestStringCompare.cpp b/core/libs/tests/GuestStringCompare.cpp
new file mode 100644
index 0000000000..9fc7691c39
--- /dev/null
+++ b/core/libs/tests/GuestStringCompare.cpp
@@ -0,0 +1,44 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) {
+    if (!value) std::abort();
+}
+
+}
+
+int main() {
+    Require(strcmp_nid_postfix("abc", "abc") == 0);
+    Require(strcmp_nid_postfix("abc", "abd") == -1);
+    Require(strcmp_nid_postfix("abd", "abc") == 1);
+    Require(strcmp_nid_postfix("a", "z") == -25);
+    Require(strcmp_nid_postfix("abc", "abcd") == -100);
+    Require(strcmp_nid_postfix("abcd", "abc") == 100);
+    Require(strcmp_nid_postfix("\x80", "a") == 31);
+    Require(strcmp_nid_postfix("", "") == 0);
+
+    Require(strncmp_nid_postfix("abcdef", "abcxyz", 3) == 0);
+    Require(strncmp_nid_postfix("abcdef", "abcxyz", 4) == -20);
+    Require(strncmp_nid_postfix("abc", "xyz", 0) == 0);
+    Require(strncmp_nid_postfix("abc\0x", "abc\0y", 6) == 0);
+    Require(strncmp_nid_postfix("ab", "abc", 8) == -99);
+
+    const unsigned char base[] = {0x01, 0x02, 0x03};
+    const unsigned char higher[] = {0x01, 0x02, 0x04};
+    const unsigned char top[] = {0x01, 0x02, 0xff};
+    const unsigned char low[] = {0x01, 0x02, 0x01};
+    Require(memcmp_nid_postfix(base, base, 3) == 0);
+    Require(memcmp_nid_postfix(base, higher, 3) == -1);
+    Require(memcmp_nid_postfix(top, low, 3) == 254);
+    Require(memcmp_nid_postfix(top, low, 2) == 0);
+    const unsigned char sign[] = {0x80};
+    const unsigned char one[] = {0x01};
+    Require(memcmp_nid_postfix(sign, one, 1) == 127);
+    const unsigned char withNul[] = {0x00, 0x05};
+    const unsigned char withNulLow[] = {0x00, 0x02};
+    Require(memcmp_nid_postfix(withNul, withNulLow, 2) == 3);
+}
diff --git a/core/libs/tests/GuestStrings.cpp b/core/libs/tests/GuestStrings.cpp
index a30f57eb0a..c7ee8ee32e 100644
--- a/core/libs/tests/GuestStrings.cpp
+++ b/core/libs/tests/GuestStrings.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -8,46 +10,6 @@
 #include <cstdlib>
 #include <string>
 
-extern "C" {
-void APS5_VABI bcopy_nid_postfix(const void*, void*, std::size_t);
-char* APS5_VABI basename_nid_postfix(const char*);
-char* APS5_VABI basename_r_nid_postfix(const char*, char*);
-char* APS5_VABI __inet_ntoa_nid_postfix(unsigned int);
-char* APS5_VABI dirname_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-long long APS5_VABI strtonum_nid_postfix(const char*, long long, long long, const char**);
-int APS5_VABI strcasecmp_nid_postfix(const char*, const char*);
-int APS5_VABI strncasecmp_nid_postfix(const char*, const char*, std::size_t);
-std::size_t APS5_VABI strnlen_nid_postfix(const char*, std::size_t);
-std::size_t APS5_VABI strnlen_s_nid_postfix(const char*, std::size_t);
-char* APS5_VABI strncat_nid_postfix(char*, const char*, std::size_t);
-char* APS5_VABI strpbrk_nid_postfix(const char*, const char*);
-const char* APS5_VABI strchr_nid_postfix(const char*, int);
-char* APS5_VABI strrchr_nid_postfix(const char*, int);
-std::size_t APS5_VABI strcspn_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI strlcat_nid_postfix(char*, const char*, std::size_t);
-char* APS5_VABI stpcpy_nid_postfix(char*, const char*);
-char* APS5_VABI strtok_r_nid_postfix(char*, const char*, char**);
-char* APS5_VABI strtok_nid_postfix(char*, const char*);
-char* APS5_VABI strsep_nid_postfix(char**, const char*);
-char* APS5_VABI strcasestr_nid_postfix(const char*, const char*);
-int APS5_VABI strcpy_s_nid_postfix(char*, std::size_t, const char*);
-int APS5_VABI strncpy_s_nid_postfix(char*, std::size_t, const char*, std::size_t);
-int APS5_VABI strcat_s_nid_postfix(char*, std::size_t, const char*);
-int APS5_VABI strncat_s_nid_postfix(char*, std::size_t, const char*, std::size_t);
-int APS5_VABI memcpy_s_nid_postfix(void*, std::size_t, const void*, std::size_t);
-int APS5_VABI memmove_s_nid_postfix(void*, std::size_t, const void*, std::size_t);
-int APS5_VABI memset_s_nid_postfix(void*, std::size_t, int, std::size_t);
-void* APS5_VABI memccpy_nid_postfix(void*, const void*, int, std::size_t);
-void* APS5_VABI memmem_nid_postfix(const void*, std::size_t, const void*, std::size_t);
-char* APS5_VABI strnstr_nid_postfix(const char*, const char*, std::size_t);
-std::size_t APS5_VABI strxfrm_nid_postfix(char*, const char*, std::size_t);
-int APS5_VABI snprintf_s_nid_postfix(char*, std::size_t, const char*, ...);
-int APS5_VABI sscanf_s_nid_postfix(const char*, const char*, ...);
-int APS5_VABI __inet_aton_nid_postfix(const char*, void*);
-std::uint32_t APS5_VABI __inet_addr_nid_postfix(const char*);
-}
-
 static void Require(bool condition) {
     if (!condition) {
         std::fputs("Guest string check failed\n", stderr);
@@ -82,6 +44,40 @@ static bool CheckMemcpyOverlap() {
     return correct;
 }
 
+static int Sign(int value) {
+    return value < 0 ? -1 : value > 0 ? 1 : 0;
+}
+
+static void CheckStandardStrings() {
+    Require(strcmp_nid_postfix("abc", "abc") == 0 && Sign(strcmp_nid_postfix("abc", "abd")) == -1 && Sign(strcmp_nid_postfix("abc", "ab")) == 1);
+    Require(Sign(strcmp_nid_postfix("\x80", "\x7f")) == 1);
+    Require(strncmp_nid_postfix("abcX", "abcY", 3) == 0 && Sign(strncmp_nid_postfix("abcX", "abcY", 4)) == -1 && strncmp_nid_postfix("a", "b", 0) == 0);
+    Require(strcoll_nid_postfix("same", "same") == 0 && Sign(strcoll_nid_postfix("B", "a")) == -1);
+    Require(strlen_nid_postfix("") == 0 && strlen_nid_postfix("seven 7") == 7);
+
+    char buffer[16];
+    std::memset(buffer, 'x', sizeof(buffer));
+    Require(strcpy_nid_postfix(buffer, "ab") == buffer && std::memcmp(buffer, "ab\0x", 4) == 0);
+    Require(strcat_nid_postfix(buffer, "cd") == buffer && std::strcmp(buffer, "abcd") == 0);
+
+    std::memset(buffer, 'x', sizeof(buffer));
+    Require(strncpy_nid_postfix(buffer, "ab", 5) == buffer && std::memcmp(buffer, "ab\0\0\0x", 6) == 0);
+    std::memset(buffer, 'x', sizeof(buffer));
+    Require(strncpy_nid_postfix(buffer, "abcdef", 3) == buffer && std::memcmp(buffer, "abcx", 4) == 0);
+
+    const char* text = "needle in a haystack";
+    Require(strstr_nid_postfix(text, "hay") == text + 12 && strstr_nid_postfix(text, "") == text && strstr_nid_postfix(text, "hey") == nullptr);
+    Require(strspn_nid_postfix("aabbc", "ab") == 4 && strspn_nid_postfix("xyz", "ab") == 0 && strspn_nid_postfix("ab", "") == 0);
+
+    unsigned char bytes[6] = {1, 2, 3, 4, 5, 6};
+    const unsigned char same[6] = {1, 2, 3, 4, 5, 6};
+    Require(bcmp_nid_postfix(bytes, same, 6) == 0 && bcmp_nid_postfix(bytes, "zz", 0) == 0);
+    bytes[5] = 9;
+    Require(bcmp_nid_postfix(bytes, same, 6) != 0 && bcmp_nid_postfix(bytes, same, 5) == 0);
+    bzero_nid_postfix(bytes + 1, 4);
+    Require(bytes[0] == 1 && bytes[1] == 0 && bytes[4] == 0 && bytes[5] == 9);
+}
+
 static void CheckSecureCopySizeLimits() {
     using Copy = int (APS5_VABI*)(void*, std::size_t, const void*, std::size_t);
     constexpr std::size_t RsizeMax = SIZE_MAX >> 1;
@@ -180,19 +176,20 @@ static void CheckSecureStringSizeLimits() {
 }
 
 static void CheckCaseInsensitiveComparison() {
+    Require(strcoll_nid_postfix("a", "z") == -25 && strcoll_nid_postfix("z", "a") == 25 && strcoll_nid_postfix("ab", "abc") == -99);
+    Require(strcoll_nid_postfix("A", "a") == -32 && strcoll_nid_postfix("same", "same") == 0 && strcoll_nid_postfix("\xff", "\x01") == 254);
     Require(strcasecmp_nid_postfix("", "") == 0 && strcasecmp_nid_postfix("AbC", "aBc") == 0);
-    Require(strcasecmp_nid_postfix("A", "b") == 'a' - 'b' && strcasecmp_nid_postfix("b", "A") == 'b' - 'a');
-    Require(strcasecmp_nid_postfix("ab", "A") == 'b' && strcasecmp_nid_postfix("AB", "a") == 'b');
-    Require(strcasecmp_nid_postfix("A", "aB") == -'b' && strcasecmp_nid_postfix("a", "AB") == -'b');
-    Require(strcasecmp_nid_postfix("", "Z") == -'z' && strcasecmp_nid_postfix("Z", "") == 'z');
-    Require(strncasecmp_nid_postfix("abc", "ABD", 2) == 0 && strncasecmp_nid_postfix("abc", "ABD", 3) == 'c' - 'd');
-    Require(strncasecmp_nid_postfix("Ab", "a", 2) == 'b' && strncasecmp_nid_postfix("a", "AB", 5) == -'b');
-    Require(strncasecmp_nid_postfix("Q", "", 1) == 'q' && strncasecmp_nid_postfix("", "Q", 1) == -'q');
+    Require(strcasecmp_nid_postfix("A", "b") == -1 && strcasecmp_nid_postfix("b", "A") == 1);
+    Require(strcasecmp_nid_postfix("ab", "A") == 1 && strcasecmp_nid_postfix("AB", "a") == 1);
+    Require(strcasecmp_nid_postfix("A", "aB") == -1 && strcasecmp_nid_postfix("a", "AB") == -1);
+    Require(strcasecmp_nid_postfix("", "Z") == -1 && strcasecmp_nid_postfix("Z", "") == 1);
+    Require(strncasecmp_nid_postfix("abc", "ABD", 2) == 0 && strncasecmp_nid_postfix("abc", "ABD", 3) == -1);
+    Require(strncasecmp_nid_postfix("Ab", "a", 2) == 1 && strncasecmp_nid_postfix("a", "AB", 5) == -1);
+    Require(strncasecmp_nid_postfix("Q", "", 1) == 1 && strncasecmp_nid_postfix("", "Q", 1) == -1);
     Require(strncasecmp_nid_postfix("x", "y", 0) == 0 && strncasecmp_nid_postfix("same", "SAME", 99) == 0);
 }
 
 static void CheckSscanfS() {
-#ifndef _WIN32
     int number = 0;
     char word[4] = "zz";
     char letter = 0;
@@ -209,7 +206,6 @@ static void CheckSscanfS() {
     Require(sscanf_s_nid_postfix("7 %", "%d %%%n", &number, &position) == 1 && position == 3);
     Require(sscanf_s_nid_postfix("   ", "%d", &number) == EOF);
     Require(sscanf_s_nid_postfix("x", "%d", &number) == 0);
-#endif
 }
 
 static bool CheckDirnameLengths() {
@@ -265,6 +261,7 @@ static void CheckBcopy() {
                 auto expected = original;
                 for (std::size_t i = 0; i < count; ++i) expected[destination + i] = original[source + i];
                 bcopy_nid_postfix(actual.data() + source, actual.data() + destination, count);
+
                 Require(actual == expected);
             }
         }
@@ -272,8 +269,10 @@ static void CheckBcopy() {
     auto destination = original;
     destination.fill(0xff);
     bcopy_nid_postfix(original.data(), destination.data(), original.size());
+
     Require(destination == original);
     bcopy_nid_postfix(nullptr, nullptr, 0);
+
 }
 
 static void CheckStrtonum() {
@@ -334,6 +333,7 @@ static void CheckCharacterConversionInSearches() {
 }
 
 int main() {
+    CheckStandardStrings();
     CheckStrtonum();
     CheckBcopy();
     if (!CheckDirnameLengths()) return 1;
diff --git a/core/libs/tests/GuestSulphaConfig.cpp b/core/libs/tests/GuestSulphaConfig.cpp
new file mode 100644
index 0000000000..007930e68a
--- /dev/null
+++ b/core/libs/tests/GuestSulphaConfig.cpp
@@ -0,0 +1,46 @@
+#include "prx/libSceSulphaDrv/libSceSulphaDrv.hpp"
+#include <array>
+#include <cerrno>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+static void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+int main() {
+    errno = 7;
+    Require(sceSulphaGetDefaultConfig(nullptr) == static_cast<int>(0x804d0003u) && errno == 7,
+            "A null configuration must return the native argument error without changing errno");
+    struct Config {
+        std::uint64_t size;
+        std::uint64_t capacity;
+        std::uint32_t setting;
+        std::uint32_t port;
+    };
+    static_assert(sizeof(Config) == 24);
+    for (const auto shift : {0u, 1u}) for (const auto initial : std::array<std::uint64_t, 4>{0, 24, 560, UINT64_MAX}) {
+        for (const unsigned char pattern : {0xa5, 0x5a}) {
+            std::array<unsigned char, 48> storage;
+            storage.fill(pattern);
+            auto* config = storage.data() + 8 + shift;
+            std::memcpy(config, &initial, sizeof(initial));
+            errno = 7;
+            Require(sceSulphaGetDefaultConfig(config) == 0 && errno == 7,
+                    "Default configuration must accept non-null storage regardless of its incoming size");
+            Config result;
+            std::memcpy(&result, config, sizeof(result));
+            Require(result.size == 24 && result.capacity == 4194304 && result.setting == 3 && result.port == 4001,
+                    "Default configuration must match the native 24-byte record");
+            for (std::size_t i = 0; i < storage.size(); ++i) {
+                if (i < 8 + shift || i >= 8 + shift + sizeof(Config))
+                    Require(storage[i] == pattern, "Default configuration must preserve bytes outside its record");
+            }
+        }
+    }
+}
diff --git a/core/libs/tests/GuestSyncOnAddress.cpp b/core/libs/tests/GuestSyncOnAddress.cpp
index c43e7a66fe..e320373917 100644
--- a/core/libs/tests/GuestSyncOnAddress.cpp
+++ b/core/libs/tests/GuestSyncOnAddress.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -8,17 +10,7 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelSyncOnAddressWait(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait32(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait64(std::uint64_t* address, std::uint64_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait8(std::uint8_t* address, std::uint8_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait16(std::uint16_t* address, std::uint16_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWake(void* address, std::int32_t count);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 static constexpr KernelUseconds FAILSAFE_TIMEOUT = 10000000;
 static constexpr auto SETTLE = std::chrono::milliseconds(100);
 
diff --git a/core/libs/tests/GuestSysarch.cpp b/core/libs/tests/GuestSysarch.cpp
index f2c4551138..b6533c2e65 100644
--- a/core/libs/tests/GuestSysarch.cpp
+++ b/core/libs/tests/GuestSysarch.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <cstdint>
@@ -6,13 +8,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sysarch(int number, void* args);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall> static std::string Thrown(TCall call) {
diff --git a/core/libs/tests/GuestSyslog.cpp b/core/libs/tests/GuestSyslog.cpp
index 0d55e1a440..c0a954c07a 100644
--- a/core/libs/tests/GuestSyslog.cpp
+++ b/core/libs/tests/GuestSyslog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
@@ -11,13 +12,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-void APS5_VABI syslog_nid_postfix(int, const char*, ...);
-void APS5_VABI openlog_nid_postfix(const char*, int, int);
-void APS5_VABI closelog_nid_postfix();
-int APS5_VABI setlogmask_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     auto* captured = std::tmpfile();
@@ -33,33 +27,42 @@ int main() {
     *__error_nid_postfix() = 2;
     Require(setlogmask_nid_postfix(0) == 0xff);
     syslog_nid_postfix(6, "station %s at %d kbps", "radio", 128);
+
     const int afterFirst = *__error_nid_postfix();
     syslog_nid_postfix(16 | 3, "open: %m, %%m kept, %d%%\n", 50);
     syslog_nid_postfix(0x10000 | 4, "masked");
     syslog_nid_postfix(7, "");
+
     Require(setlogmask_nid_postfix(1 << 3) == 0xff);
     Require(setlogmask_nid_postfix(0) == (1 << 3));
     int count = -1;
     syslog_nid_postfix(7, "suppressed %m%n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     syslog_nid_postfix(16 | 3, "allowed: %m");
+
     Require(*__error_nid_postfix() == 2);
     syslog_nid_postfix(0x10000 | 7, "suppressed %n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     Require(setlogmask_nid_postfix(1 << 4) == (1 << 3));
     syslog_nid_postfix(0x10000 | 4, "warning without diagnostic");
     syslog_nid_postfix(0x10000 | 7, "both suppressed %n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     Require(setlogmask_nid_postfix(0x100) == (1 << 4));
     Require(setlogmask_nid_postfix(0) == 0x100);
     syslog_nid_postfix(0x10000 | 3, "no priorities enabled %n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     Require(setlogmask_nid_postfix(-1) == 0x100);
     Require(setlogmask_nid_postfix(0) == -1);
     syslog_nid_postfix(7, "negative mask");
+
     Require(setlogmask_nid_postfix(0x55) == -1);
     for (int priority = 0; priority < 8; ++priority)
         syslog_nid_postfix(16 | priority, "level %d", priority);
+
     std::thread([] { Require(setlogmask_nid_postfix(0xff) == 0x55); }).join();
     Require(setlogmask_nid_postfix(0) == 0xff);
     syslog_nid_postfix(7, "mask shared across threads");
@@ -73,6 +76,7 @@ int main() {
     openlog_nid_postfix("closing", 1, 0);
     closelog_nid_postfix();
     syslog_nid_postfix(6, "identity cleared, options and facility retained");
+
     std::fflush(stderr);
 #ifdef _WIN32
     Require(::_dup2(saved, ::_fileno(stderr)) == 0 && ::_close(saved) == 0);
diff --git a/core/libs/tests/GuestSysmodule.cpp b/core/libs/tests/GuestSysmodule.cpp
index 59d871c47b..c4955a5348 100644
--- a/core/libs/tests/GuestSysmodule.cpp
+++ b/core/libs/tests/GuestSysmodule.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSysmodule/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceSysmodule/ModuleTable.hpp"
@@ -18,20 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceSysmoduleIsLoaded(std::uint16_t id);
-int APS5_VABI sceSysmoduleLoadModule(std::uint16_t id);
-int APS5_VABI sceSysmoduleUnloadModule(std::uint16_t id);
-int APS5_VABI sceSysmoduleLoadModuleInternal(std::uint32_t id);
-int APS5_VABI sceSysmoduleUnloadModuleInternal(std::uint32_t id);
-int APS5_VABI sceSysmoduleIsLoadedInternal(std::uint32_t id);
-int APS5_VABI sceSysmoduleLoadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
-int APS5_VABI sceSysmoduleUnloadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
-int APS5_VABI sceSysmoduleGetModuleInfoForUnwind(std::uint64_t addr, int flags, ModuleInfoForUnwind* info);
-int APS5_VABI sceSysmoduleGetModuleHandleInternal(std::uint32_t id, std::int32_t* handle);
-int APS5_VABI sceKernelDlsym(std::int32_t handle, const char* symbol, void** addr);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -110,6 +98,7 @@ void CheckUnwindInfo() {
     bool threw = false;
     try {
         sceSysmoduleGetModuleInfoForUnwind(reinterpret_cast<std::uint64_t>(gap), 0, &info);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestSystemCommand.cpp b/core/libs/tests/GuestSystemCommand.cpp
index 23290b0822..9eb03d0240 100644
--- a/core/libs/tests/GuestSystemCommand.cpp
+++ b/core/libs/tests/GuestSystemCommand.cpp
@@ -1,9 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
-extern "C" {
-int APS5_VABI system_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     *__error_nid_postfix() = 13;
diff --git a/core/libs/tests/GuestSystemConfiguration.cpp b/core/libs/tests/GuestSystemConfiguration.cpp
index 707fcd5ea7..0616d9bb6e 100644
--- a/core/libs/tests/GuestSystemConfiguration.cpp
+++ b/core/libs/tests/GuestSystemConfiguration.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <algorithm>
@@ -5,34 +8,17 @@
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <ctime>
 #include <stdexcept>
+#include <string>
 #include <vector>
-struct SceKernelSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
+
 static_assert(offsetof(SceKernelSystemSwVersion, size) == 0x00);
 static_assert(offsetof(SceKernelSystemSwVersion, versionString) == 0x08);
 static_assert(offsetof(SceKernelSystemSwVersion, version) == 0x24);
 static_assert(sizeof(SceKernelSystemSwVersion) == 0x28);
 extern "C" {
-std::int64_t APS5_VABI sysconf_nid_postfix(int);
-int APS5_VABI getpagesize_nid_postfix();
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sysctl_nid_postfix(const int*, std::uint32_t, void*, std::size_t*, const void*, std::size_t);
-int APS5_VABI sysctlbyname_nid_postfix(const char*, void*, std::size_t*, const void*, std::size_t);
-int APS5_VABI sysctlnametomib_nid_postfix(const char*, int*, std::size_t*);
-int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion*);
-int APS5_VABI getpid_nid_postfix();
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t);
-int APS5_VABI munmap_nid_postfix(void*, std::size_t);
-std::uint64_t APS5_VABI sceKernelGetTscFrequency(void);
-struct GuestRlimitTest {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-int APS5_VABI getrlimit_nid_postfix(int resource, GuestRlimitTest* limit);
+
 extern char** environ_nid_postfix;
 }
 static void Require(bool value) { if (!value) std::abort(); }
@@ -64,6 +50,7 @@ static void CheckProcessorCountSysctl() {
     const int unknown[] = {6, 99};
     try {
         sysctl_nid_postfix(unknown, 2, &value, &length, nullptr, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -249,6 +236,29 @@ static void CheckUnansweredSysctl() {
         Require(size == 4 && untouched[0] == 0x5a5a5a5a && untouched[1] == 0x5a5a5a5a && untouched[2] == 0x5a5a5a5a);
     }
 }
+static void CheckUnknownSysctlName() {
+    static constexpr const char* name = "kern.anyps5_no_such_name";
+    unsigned char buffer[16];
+    std::memset(buffer, 0xaa, sizeof(buffer));
+    std::size_t length = sizeof(buffer);
+    *__error_nid_postfix() = 13;
+    Require(sysctlbyname_nid_postfix(name, buffer, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 2);
+    Require(length == sizeof(buffer) && Untouched(buffer, sizeof(buffer)));
+
+    length = 77;
+    *__error_nid_postfix() = 13;
+    Require(sysctlbyname_nid_postfix(name, nullptr, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 2 && length == 77);
+
+    int mib[4] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::size_t mibLength = 4;
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix(name, mib, &mibLength) == -1 && *__error_nid_postfix() == 2);
+    Require(mibLength == 4 && mib[0] == 0x5a5a5a5a && mib[1] == 0x5a5a5a5a && mib[2] == 0x5a5a5a5a && mib[3] == 0x5a5a5a5a);
+
+    mibLength = 0;
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix(name, nullptr, &mibLength) == -1 && *__error_nid_postfix() == 2 && mibLength == 0);
+}
 static void CheckPathnameSysctl() {
     *__error_nid_postfix() = 13;
     char buffer[32] = {};
@@ -383,8 +393,60 @@ static void CheckOsReleaseDateSysctl() {
     length = sizeof(value);
     Require(sysctl_nid_postfix(deeper, 3, &value, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 20);
 }
+struct BootTimeval {
+    std::int64_t tv_sec;
+    std::int64_t tv_usec;
+};
+static_assert(sizeof(BootTimeval) == 16);
+
+static void CheckBootTimeSysctl() {
+    const int mib[] = {1, 21};
+    *__error_nid_postfix() = 13;
+    std::size_t length = 0;
+    Require(sysctl_nid_postfix(mib, 2, nullptr, &length, nullptr, 0) == 0 && length == sizeof(BootTimeval));
+    length = 0;
+    Require(sysctlbyname_nid_postfix("kern.boottime", nullptr, &length, nullptr, 0) == 0 && length == sizeof(BootTimeval));
+    BootTimeval first{};
+    length = sizeof(first);
+    Require(sysctl_nid_postfix(mib, 2, &first, &length, nullptr, 0) == 0 && length == sizeof(first));
+    Require(first.tv_sec > 0 && first.tv_sec <= static_cast<std::int64_t>(std::time(nullptr)));
+    Require(first.tv_usec >= 0 && first.tv_usec < 1000000);
+    KernelTimespec now{};
+    KernelTimespec uptime{};
+    Require(clock_gettime_nid_postfix(5, &uptime) == 0 && clock_gettime_nid_postfix(0, &now) == 0);
+    const std::int64_t drift = (first.tv_sec + uptime.tv_sec - now.tv_sec) * 1000000 + first.tv_usec + uptime.tv_nsec / 1000 - now.tv_nsec / 1000;
+    Require(drift > -1000000 && drift < 1000000);
+    BootTimeval second{};
+    length = sizeof(second);
+    Require(sysctl_nid_postfix(mib, 2, &second, &length, nullptr, 0) == 0 && length == sizeof(second));
+    Require(second.tv_sec == first.tv_sec && second.tv_usec == first.tv_usec);
+    BootTimeval named{};
+    length = 32;
+    Require(sysctlbyname_nid_postfix("kern.boottime", &named, &length, nullptr, 0) == 0 && length == sizeof(named));
+    Require(named.tv_sec == first.tv_sec && named.tv_usec == first.tv_usec);
+    Require(*__error_nid_postfix() == 13);
+
+    int namedMib[3] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::size_t mibLength = 3;
+    Require(sysctlnametomib_nid_postfix("kern.boottime", namedMib, &mibLength) == 0 && mibLength == 2);
+    Require(namedMib[0] == 1 && namedMib[1] == 21 && namedMib[2] == 0x5a5a5a5a);
+
+    unsigned char truncated[16];
+    std::memset(truncated, 0xaa, sizeof(truncated));
+    length = 8;
+    Require(sysctl_nid_postfix(mib, 2, truncated, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 12);
+    Require(length == 8 && std::memcmp(truncated, &first.tv_sec, 8) == 0 && truncated[8] == 0xaa);
+    std::memset(truncated, 0xaa, sizeof(truncated));
+    length = 8;
+    Require(sysctlbyname_nid_postfix("kern.boottime", truncated, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 12);
+    Require(length == 8 && truncated[8] == 0xaa);
+
+    length = sizeof(first);
+    Require(sysctl_nid_postfix(mib, 2, &first, &length, &first, sizeof(first)) == -1 && *__error_nid_postfix() == 1);
+    Require(sysctlbyname_nid_postfix("kern.boottime", &first, &length, &first, sizeof(first)) == -1 && *__error_nid_postfix() == 1);
+}
 static void CheckLeafWithTrailingComponent() {
-    const int leaves[][2] = {{6, 3}, {6, 2}, {6, 5}, {6, 7}, {1, 24}, {1, 37}, {1, 50}};
+    const int leaves[][2] = {{6, 3}, {6, 2}, {6, 5}, {6, 7}, {1, 21}, {1, 24}, {1, 37}, {1, 50}};
     for (const auto& leaf : leaves) {
         const int mib[] = {leaf[0], leaf[1], 0};
         char buffer[8] = {};
@@ -432,12 +494,38 @@ static void CheckMeasuredAbsentSysctlMibs() {
         bool threw = false;
         try {
             sysctl_nid_postfix(entry.mib, entry.length, buffer, &length, buffer, sizeof(buffer));
+
         } catch (const std::runtime_error&) {
             threw = true;
         }
         Require(threw);
     }
 }
+static void CheckVersionLimits() {
+    unsigned char first[4];
+    unsigned char second[4];
+    std::memset(first, 0xaa, sizeof(first));
+    std::memset(second, 0xaa, sizeof(second));
+    *__error_nid_postfix() = 13;
+    Require(sceKernelGetSystemExVersion(reinterpret_cast<char*>(first + 1), reinterpret_cast<char*>(second + 1)) == 0 && *__error_nid_postfix() == 13);
+    Require(first[0] == 0xaa && first[1] == 0 && first[2] == 0xaa && second[0] == 0xaa && second[1] == 0 && second[2] == 0xaa);
+    std::memset(first, 0xaa, sizeof(first));
+    Require(sceKernelGetSystemExVersion(reinterpret_cast<char*>(first), nullptr) == 22 && first[0] == 0xaa);
+    Require(sceKernelGetSystemExVersion(nullptr, reinterpret_cast<char*>(first)) == 22 && first[0] == 0xaa);
+    Require(sceKernelGetSystemExVersion(nullptr, nullptr) == 22 && *__error_nid_postfix() == 13);
+
+    std::memset(first, 0xaa, sizeof(first));
+    Require(sysKernelGetLowerLimitSysexVersion_nid_postfix(reinterpret_cast<char*>(first + 1)) == 0);
+    Require(first[0] == 0xaa && first[1] == 0 && first[2] == 0xaa);
+    Require(sysKernelGetLowerLimitSysexVersion_nid_postfix(nullptr) == SCE_KERNEL_ERROR_EINVAL);
+
+    struct {
+        std::uint32_t version;
+        std::uint32_t after;
+    } update{0xaaaaaaaau, 0xaaaaaaaau};
+    Require(sysKernelGetLowerLimitUpdVersion_nid_postfix(&update.version) == 0 && update.version == 0 && update.after == 0xaaaaaaaau);
+    Require(sysKernelGetLowerLimitUpdVersion_nid_postfix(nullptr) == SCE_KERNEL_ERROR_EINVAL && *__error_nid_postfix() == 13);
+}
 static void CheckSystemSwVersion() {
     *__error_nid_postfix() = 13;
     Require(sceKernelGetSystemSwVersion_nid_postfix(nullptr) == SCE_KERNEL_ERROR_EFAULT && *__error_nid_postfix() == 13);
@@ -523,6 +611,7 @@ static void CheckOvercommitSysctl() {
     length = sizeof(value);
     try {
         sysctlbyname_nid_postfix("vm.overcommit", &value, &length, &value, sizeof(value));
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -691,6 +780,7 @@ static void CheckPseudoRandomMibSysctl() {
     bool threw = false;
     try {
         sysctl_nid_postfix(mib, 2, &value, &length, &value, sizeof(value));
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -709,6 +799,7 @@ static void CheckNameToMib() {
         {"hw.physmem", {6, 5}, 2},
         {"hw.realmem", {6, 12}, 2},
         {"kern.arandom", {1, 37}, 2},
+        {"kern.boottime", {1, 21}, 2},
         {"kern.rng_pseudo", {1, 50}, 2},
         {"kern.proc.pathname", {1, 14, 12}, 3},
     };
@@ -770,18 +861,18 @@ static void CheckNameToMib() {
     char tooLong[1025];
     std::memset(tooLong, 'a', sizeof(tooLong) - 1);
     tooLong[sizeof(tooLong) - 1] = 0;
-    Require(sysctlnametomib_nid_postfix(tooLong, mib, &size) == -1 && *__error_nid_postfix() == 63);
+    int tooLongMib[4] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::size_t tooLongMibSize = 4;
+    Require(sysctlnametomib_nid_postfix(tooLong, tooLongMib, &tooLongMibSize) == -1 && *__error_nid_postfix() == 63);
+    Require(tooLongMibSize == 4 && tooLongMib[0] == 0x5a5a5a5a && tooLongMib[1] == 0x5a5a5a5a && tooLongMib[2] == 0x5a5a5a5a && tooLongMib[3] == 0x5a5a5a5a);
     tooLong[1023] = 0;
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix(tooLong, tooLongMib, &tooLongMibSize) == -1 && *__error_nid_postfix() == 2 && tooLongMibSize == 4);
+    Require(tooLongMib[0] == 0x5a5a5a5a && tooLongMib[1] == 0x5a5a5a5a && tooLongMib[2] == 0x5a5a5a5a && tooLongMib[3] == 0x5a5a5a5a);
     bool threw = false;
-    try {
-        sysctlnametomib_nid_postfix(tooLong, mib, &size);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
-    threw = false;
     try {
         sysctlnametomib_nid_postfix(nullptr, mib, &size);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -789,19 +880,63 @@ static void CheckNameToMib() {
     threw = false;
     try {
         sysctlnametomib_nid_postfix("hw.ncpu", mib, nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
     Require(threw);
-    threw = false;
-    try {
-        sysctlnametomib_nid_postfix("kern.cp_times", mib, &size);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix("kern.anyps5_no_such_name", mib, &size) == -1 && *__error_nid_postfix() == 2);
 }
+static void CheckUnknownRootsAndTopLevelNames() {
+    for (const int root : {99, 10, 255, -1, -5}) {
+        const int mib[] = {root, 1};
+        int value = 0x5a5a5a5a;
+        std::size_t length = sizeof(value);
+        *__error_nid_postfix() = 13;
+        Require(sysctl_nid_postfix(mib, 2, &value, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 2);
+        Require(value == 0x5a5a5a5a && length == sizeof(value));
+    }
+    struct TopLevel {
+        const char* name;
+        int number;
+    };
+    for (const TopLevel& node : {TopLevel{"sysctl", 0}, TopLevel{"kern", 1}, TopLevel{"vm", 2}, TopLevel{"vfs", 3}, TopLevel{"net", 4},
+                                 TopLevel{"debug", 5}, TopLevel{"hw", 6}, TopLevel{"machdep", 7}, TopLevel{"user", 8}, TopLevel{"p1003_1b", 9}}) {
+        for (const bool dotted : {false, true}) {
+            const std::string name = std::string(node.name) + (dotted ? "." : "");
+            int mib[3] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+            std::size_t size = 3;
+            Require(sysctlnametomib_nid_postfix(name.c_str(), mib, &size) == 0 && size == 1 && mib[0] == node.number && mib[1] == 0x5a5a5a5a);
+            int value = 0x5a5a5a5a;
+            std::size_t length = sizeof(value);
+            *__error_nid_postfix() = 13;
+            Require(sysctlbyname_nid_postfix(name.c_str(), &value, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 22);
+            Require(value == 0x5a5a5a5a && length == sizeof(value));
+        }
+    }
+    int mib[3] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::size_t size = 3;
+    Require(sysctlnametomib_nid_postfix("hw.ncpu.", mib, &size) == 0 && size == 2 && mib[0] == 6 && mib[1] == 3);
+    for (const char* name : {"kern..", ".", "kern.anyps5.x", "kernel"}) {
+        size = 3;
+        *__error_nid_postfix() = 13;
+        Require(sysctlnametomib_nid_postfix(name, mib, &size) == -1 && *__error_nid_postfix() == 2);
+    }
+    int value = 0;
+    std::size_t length = sizeof(value);
+    Require(sysctlbyname_nid_postfix("hw.ncpu.", &value, &length, nullptr, 0) == 0 && value > 0 && length == sizeof(value));
+    std::string tooLong(1024, 'a');
+    length = sizeof(value);
+    *__error_nid_postfix() = 13;
+    Require(sysctlbyname_nid_postfix(tooLong.c_str(), &value, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 63);
+    tooLong.resize(1023);
+    *__error_nid_postfix() = 13;
+    Require(sysctlbyname_nid_postfix(tooLong.c_str(), &value, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 2);
+}
+
 int main() {
+    CheckUnknownRootsAndTopLevelNames();
     CheckProcessorCountSysctl();
     CheckPageSizeSysctl();
     CheckPhysicalMemorySysctl(5, "hw.physmem");
@@ -811,13 +946,16 @@ int main() {
 #endif
     CheckTscFrequencySysctl();
     CheckUnansweredSysctl();
+    CheckUnknownSysctlName();
     CheckPathnameSysctl();
     CheckSystemStringSysctl();
     CheckSystemStringNames();
     CheckOsReleaseDateSysctl();
+    CheckBootTimeSysctl();
     CheckLeafWithTrailingComponent();
     CheckMeasuredAbsentSysctlMibs();
     CheckSystemSwVersion();
+    CheckVersionLimits();
     CheckPseudoRandomSysctl();
     CheckSdkVersionSysctl();
     CheckOvercommitSysctl();
@@ -829,7 +967,7 @@ int main() {
     *__error_nid_postfix() = 13;
     Require(sysconf_nid_postfix(1) == 262144);
     Require(sysconf_nid_postfix(3) == 128);
-    GuestRlimitTest nofileLimit{};
+    GuestResourceLimit nofileLimit{};
     Require(getrlimit_nid_postfix(8, &nofileLimit) == 0);
     Require(sysconf_nid_postfix(5) == nofileLimit.rlim_cur);
     Require(sysconf_nid_postfix(47) == 0x4000);
diff --git a/core/libs/tests/GuestSystemExit.cpp b/core/libs/tests/GuestSystemExit.cpp
index 612272c35b..a760b7a5b9 100644
--- a/core/libs/tests/GuestSystemExit.cpp
+++ b/core/libs/tests/GuestSystemExit.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
@@ -22,14 +24,9 @@
 #include <mach-o/dyld.h>
 #include <vector>
 #endif
-extern "C" int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
-extern "C" void APS5_VABI _Exit_nid_postfix(int);
-extern "C" void APS5_VABI exit_nid_postfix(int);
-extern "C" void APS5_VABI catchReturnFromMain_nid_postfix(int);
+
 using GuestQuickExitCallback = void (APS5_VABI*)();
-extern "C" int APS5_VABI at_quick_exit_nid_postfix(GuestQuickExitCallback);
-extern "C" void APS5_VABI quick_exit_nid_postfix(int);
+
 namespace {
 std::atomic<bool> awaiting{false};
 void AwaitExit() {
@@ -243,6 +240,7 @@ int main(int argc, char** argv) {
             LibcSetEndFlush_nid_no_patch(ExitFlushAfterDrain);
         }
         _Exit_nid_postfix(7);
+
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--requested-exit-driver") == 0) {
         Require(RunChild(OwnExecutable(), "--requested-exit") == 0);
@@ -256,16 +254,19 @@ int main(int argc, char** argv) {
         Require(slot != FLS_OUT_OF_INDEXES && FlsSetValue(slot, &slot));
 #endif
         _Exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--return-from-main") == 0) {
         catchReturnFromMain_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--quick-exit") == 0) {
         Require(at_quick_exit_nid_postfix(QuickFirst) == 0);
         Require(at_quick_exit_nid_postfix(QuickSecond) == 0);
         quick_exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--nested-exit-driver") == 0) {
@@ -277,6 +278,7 @@ int main(int argc, char** argv) {
         Require(__cxa_atexit_nid_postfix(CheckShutdownStillRunning, nullptr, nullptr) == 0);
         Require(__cxa_atexit_nid_postfix(ExitingHandler, nullptr, nullptr) == 0);
         exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--exit-order-driver") == 0) {
@@ -286,6 +288,7 @@ int main(int argc, char** argv) {
         LibcRegisterShutdown_nid_postfix(GuestExitShutdown);
         Require(__cxa_atexit_nid_postfix(CheckShutdownStillRunning, nullptr, nullptr) == 0);
         exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--relaunch-driver") == 0) {
diff --git a/core/libs/tests/GuestSystemFont.cpp b/core/libs/tests/GuestSystemFont.cpp
index 392d3ad044..643b4761e0 100644
--- a/core/libs/tests/GuestSystemFont.cpp
+++ b/core/libs/tests/GuestSystemFont.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceFontFt/include/Api.hpp"
+#include "prx/libSceFont/include/Api.hpp"
 #include "prx/libSceFont/include/FontTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -17,31 +19,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceFontMemoryInit(FontMemory*, void*, std::uint32_t, const FontMemoryInterface*, void*, FontMemoryDestroyFunction, void*);
-int APS5_VABI sceFontCreateLibrary(const FontMemory*, const void*, FontLibrary*);
-int APS5_VABI sceFontDestroyLibrary(FontLibrary*);
-int APS5_VABI sceFontSupportSystemFonts(FontLibrary);
-int APS5_VABI sceFontSupportExternalFonts(FontLibrary, std::uint32_t, std::uint32_t);
-int APS5_VABI sceFontOpenFontSet(FontLibrary, std::uint32_t, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontMemory(FontLibrary, const void*, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontInstance(FontHandle, FontHandle, FontHandle*);
-int APS5_VABI sceFontCloseFont(FontHandle);
-int APS5_VABI sceFontSetScalePixel(FontHandle, float, float);
-int APS5_VABI sceFontGetCharGlyphMetrics(FontHandle, std::uint32_t, FontGlyphMetrics*);
-int APS5_VABI sceFontGetHorizontalLayout(FontHandle, FontHorizontalLayout*);
-int APS5_VABI sceFontGetKerning(FontHandle, std::uint32_t, std::uint32_t, FontKerning*);
-int APS5_VABI sceFontCreateRenderer(const FontMemory*, const void*, FontRenderer*);
-int APS5_VABI sceFontDestroyRenderer(FontRenderer*);
-int APS5_VABI sceFontBindRenderer(FontHandle, FontRenderer);
-int APS5_VABI sceFontUnbindRenderer(FontHandle);
-int APS5_VABI sceFontSetupRenderScalePixel(FontHandle, float, float);
-void APS5_VABI sceFontRenderSurfaceInit(FontRenderSurface*, void*, int, int, int, int);
-int APS5_VABI sceFontRenderCharGlyphImageHorizontal(FontHandle, std::uint32_t, FontRenderSurface*, float, float, FontGlyphMetrics*, FontRenderOutput*);
-const void* APS5_VABI sceFontSelectLibraryFt(int);
-const void* APS5_VABI sceFontSelectRendererFt(int);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "System font check failed at line %d\n", line);
@@ -187,6 +164,7 @@ static int RenderedPixels(FontHandle font, std::uint32_t code, float& advance) {
     std::vector<std::uint8_t> pixels(128 * 128);
     FontRenderSurface surface{};
     sceFontRenderSurfaceInit(&surface, pixels.data(), 128, 1, 128, 128);
+
     FontGlyphMetrics metrics{};
     FontRenderOutput result{};
     const int rc = sceFontRenderCharGlyphImageHorizontal(font, code, &surface, 10.0f, 100.0f, &metrics, &result);
@@ -239,6 +217,7 @@ int main() {
     bool threw = false;
     try {
         sceFontOpenFontSet(library, EuropeanBold, 1, nullptr, &font);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -338,9 +317,46 @@ int main() {
     Require(RenderedPixels(mixed, 0x4E00, advance) > 0 && advance == 63.0f);
     Require(RenderedPixels(mixed, 0x0627, advance) > 0 && advance == 66.0f);
     Require(RenderedPixels(mixed, 0xAC00, advance) == SCE_FONT_ERROR_NO_SUPPORT_GLYPH);
+    std::vector<std::uint8_t> untouched(128 * 128);
+    FontRenderSurface measuring{};
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 0, 1, 0, 31);
+
+    FontGlyphMetrics measured{};
+    FontRenderOutput measuredResult{};
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_OK);
+    Require(measured.Horizontal.advance == 60.0f && measured.width > 0.0f && measuredResult.ImageMetrics.advance > 0.0f);
+    Require(measuredResult.UpdateRect.w == 0 && measuredResult.UpdateRect.h == 0);
+    for (const std::uint8_t pixel : untouched) Require(pixel == 0);
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 128, 1, 128, 0);
+
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_OK && measured.Horizontal.advance == 60.0f);
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 128, 1, 128, 128);
+
+    measuring.width = -1;
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_ERROR_NO_SUPPORT_SURFACE);
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 0, 1, 128, 128);
+
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_ERROR_NO_SUPPORT_SURFACE);
+    sceFontRenderSurfaceInit(&measuring, nullptr, 0, 1, 0, 31);
+
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_ERROR_NO_SUPPORT_SURFACE);
     Require(sceFontUnbindRenderer(mixed) == SCE_FONT_OK);
     Require(sceFontDestroyRenderer(&renderer) == SCE_FONT_OK);
 
+    const auto hangulFonts = root / "hangul-fonts";
+    std::filesystem::create_directories(hangulFonts);
+    for (const auto* name : {"SST-Light.otf", "SST-Roman.otf", "SST-Bold.otf", "SSTJpPro-Regular.otf"}) {
+        WriteFile(hangulFonts / name, SquareGlyphFont('A', 600));
+    }
+    WriteFile(hangulFonts / "SCEPS4Yoongd-Light.otf", SquareGlyphFont(0xAC00, 400));
+    WriteFile(hangulFonts / "SCEPS4Yoongd-Medium.otf", SquareGlyphFont(0xAC00, 650));
+    WriteFile(hangulFonts / "SCEPS4Yoongd-Bold.otf", SquareGlyphFont(0xAC00, 800));
+    SetFontDirectory(hangulFonts);
+    Require(SetAdvanceOf(library, 0x1A072543u, 0xAC00) == 40.0f);
+    Require(SetAdvanceOf(library, 0x1A082543u, 0xAC00) == 40.0f);
+    Require(SetAdvanceOf(library, 0x18072444u, 0xAC00) == 65.0f);
+    Require(SetAdvanceOf(library, 0x18072447u, 0xAC00) == 80.0f);
+
     for (FontHandle handle : {font, instance, substitute, memoryFont, mixed, mixedInstance}) Require(sceFontCloseFont(handle) == SCE_FONT_OK);
     Require(sceFontDestroyLibrary(&library) == SCE_FONT_OK);
     Require(allocations == 0);
diff --git a/core/libs/tests/GuestSystemGesture.cpp b/core/libs/tests/GuestSystemGesture.cpp
index 656f943aca..23970e8b82 100644
--- a/core/libs/tests/GuestSystemGesture.cpp
+++ b/core/libs/tests/GuestSystemGesture.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemGesture/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -9,30 +10,6 @@
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceSystemGestureClose(std::int32_t);
-std::int32_t APS5_VABI sceSystemGestureOpen(std::int32_t, const void*);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEvents(std::int32_t, void*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEventsCount(std::int32_t);
-int APS5_VABI sceSystemGestureGetTouchEvents(std::int32_t, const void*, void*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByIndex(std::int32_t, std::uint32_t, void*);
-int APS5_VABI sceSystemGestureGetTouchEventByIndex(std::int32_t, const void*, std::uint32_t, void*);
-int APS5_VABI sceSystemGestureGetTouchEventByEventID(std::int32_t, const void*, std::uint32_t, void*);
-int APS5_VABI sceSystemGestureAppendTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureCreateTouchRecognizer(std::int32_t, void*, std::int32_t, const void*, const void*);
-int APS5_VABI sceSystemGestureGetTouchRecognizerInformation(std::int32_t, const void*, void*);
-int APS5_VABI sceSystemGestureRemoveTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureResetTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureUpdateTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureUpdateTouchRecognizerRectangle(std::int32_t, void*, const void*);
-int APS5_VABI sceSystemGestureResetPrimitiveTouchRecognizer(std::int32_t);
-int APS5_VABI sceSystemGestureUpdateAllTouchRecognizer(std::int32_t);
-int APS5_VABI sceSystemGestureUpdatePrimitiveTouchRecognizer(std::int32_t, const SystemGestureTouchPadData*);
-int APS5_VABI sceSystemGestureInitializePrimitiveTouchRecognizer();
-int APS5_VABI sceSystemGestureFinalizePrimitiveTouchRecognizer(void);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByPrimitiveID(std::int32_t, std::uint16_t, void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool SameRectangle(const SystemGestureRectangle& left, const SystemGestureRectangle& right) {
@@ -228,13 +205,13 @@ int main() {
     buffer.fill(0x5a);
     const auto original = buffer;
     std::uint32_t count = 7;
-    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, buffer.data(), 4, &count) == 0);
+    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data()), 4, &count) == 0);
     Require(count == 0);
     Require(buffer == original);
 
     count = 7;
-    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, buffer.data(), 4, nullptr) == invalidArgument);
-    Require(sceSystemGestureGetPrimitiveTouchEvents(handle + 1, buffer.data(), 4, &count) == invalidHandle);
+    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data()), 4, nullptr) == invalidArgument);
+    Require(sceSystemGestureGetPrimitiveTouchEvents(handle + 1, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data()), 4, &count) == invalidHandle);
     Require(count == 7);
 
     Require(sceSystemGestureGetPrimitiveTouchEventsCount(handle) == 0);
@@ -244,17 +221,17 @@ int main() {
     SystemGestureTouchRecognizer recognizer{};
     SystemGestureRectangle rectangle{};
     count = 7;
-    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, buffer.data(), 4, &count) == 0 && count == 0);
-    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, buffer.data(), 4, nullptr) == invalidArgument);
-    Require(sceSystemGestureGetTouchEvents(handle + 1, &recognizer, buffer.data(), 4, &count) == invalidHandle);
-    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle, 0, buffer.data()) == indexOutOfArray);
-    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle + 1, 0, buffer.data()) == invalidHandle);
-    Require(sceSystemGestureGetTouchEventByIndex(handle, &recognizer, 0, buffer.data()) == indexOutOfArray);
-    Require(sceSystemGestureGetTouchEventByIndex(handle + 1, &recognizer, 0, buffer.data()) == invalidHandle);
-    Require(sceSystemGestureGetTouchEventByIndex(handle, nullptr, 0, buffer.data()) == invalidArgument);
-    Require(sceSystemGestureGetTouchEventByEventID(handle, &recognizer, 0, buffer.data()) == indexOutOfArray);
-    Require(sceSystemGestureGetTouchEventByEventID(handle + 1, &recognizer, 0, buffer.data()) == invalidHandle);
-    Require(sceSystemGestureGetTouchEventByEventID(handle, nullptr, 0, buffer.data()) == invalidArgument);
+    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data()), 4, &count) == 0 && count == 0);
+    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data()), 4, nullptr) == invalidArgument);
+    Require(sceSystemGestureGetTouchEvents(handle + 1, &recognizer, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data()), 4, &count) == invalidHandle);
+    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle, 0, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data())) == indexOutOfArray);
+    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle + 1, 0, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data())) == invalidHandle);
+    Require(sceSystemGestureGetTouchEventByIndex(handle, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == indexOutOfArray);
+    Require(sceSystemGestureGetTouchEventByIndex(handle + 1, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidHandle);
+    Require(sceSystemGestureGetTouchEventByIndex(handle, nullptr, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidArgument);
+    Require(sceSystemGestureGetTouchEventByEventID(handle, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == indexOutOfArray);
+    Require(sceSystemGestureGetTouchEventByEventID(handle + 1, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidHandle);
+    Require(sceSystemGestureGetTouchEventByEventID(handle, nullptr, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidArgument);
     Require(buffer == original);
 
     Require(sceSystemGestureAppendTouchRecognizer(handle, &recognizer) == 0);
@@ -280,6 +257,7 @@ int main() {
     Require(sceSystemGestureUpdateAllTouchRecognizer(handle + 1) == invalidHandle);
     Require(sceSystemGestureUpdatePrimitiveTouchRecognizer(handle + 1, nullptr) == invalidArgument);
 
+    Require(sceSystemGestureDebugGetVersion() == 0x6a00);
     TestTouchRecognizerInformation(handle, invalidArgument, invalidHandle);
     TestPrimitiveTouchEvents(handle, invalidArgument, invalidHandle, indexOutOfArray);
     std::array<std::int32_t, 7> otherHandles{};
diff --git a/core/libs/tests/GuestSystemKillApp.cpp b/core/libs/tests/GuestSystemKillApp.cpp
index 3ebfe28013..b42f9d8de6 100644
--- a/core/libs/tests/GuestSystemKillApp.cpp
+++ b/core/libs/tests/GuestSystemKillApp.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include <cstdio>
@@ -5,10 +6,7 @@
 #include <cstring>
 #include <initializer_list>
 #include <stdexcept>
-extern "C" int APS5_VABI sceSystemServiceGetAppIdOfRunningBigApp(void);
-extern "C" int APS5_VABI sceSystemServiceKillApp(int, int, int, int);
-extern "C" int APS5_VABI sceLncUtilKillApp(unsigned);
-extern "C" int APS5_VABI sceLncUtilKillAppWithReason(unsigned, int);
+
 namespace {
 bool cleaned = false;
 bool finished = false;
diff --git a/core/libs/tests/GuestSystemService.cpp b/core/libs/tests/GuestSystemService.cpp
index 9ad6c43d4c..8a197d97b5 100644
--- a/core/libs/tests/GuestSystemService.cpp
+++ b/core/libs/tests/GuestSystemService.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include <cstddef>
@@ -7,12 +8,6 @@
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceSystemServiceGetHdrToneMapLuminance(SystemServiceHdrToneMapLuminance* luminance);
-extern "C" int APS5_VABI sceSystemServiceParamGetString(int paramId, char* buf, std::size_t bufSize);
-extern "C" int APS5_VABI sceSystemServiceLaunchApp(const char* titleId, const char* const* arguments, const void* param);
-extern "C" int APS5_VABI sceSystemServiceAddLocalProcessForPsmKit(const char* path, const char* const* arguments, const void* param);
-extern "C" int APS5_VABI sceSystemServiceKillLocalProcessForPsmKit(int handle);
-
 namespace {
 
 constexpr int browserUnavailable = static_cast<int>(0x8002002Du);
@@ -40,27 +35,6 @@ bool LaunchAppThrows(const char* titleId, const char* const* arguments, const vo
 
 }
 
-extern "C" int APS5_VABI sceSystemServicePowerTick(void);
-extern "C" int APS5_VABI sceSystemServiceIsBgmPlaying(void);
-extern "C" int APS5_VABI sceShellCoreUtilIsBgmPlaying(void);
-extern "C" int APS5_VABI sceSystemServiceReportAbnormalTermination(const void* info);
-extern "C" int APS5_VABI sceSystemServiceDisableMusicPlayer(void);
-extern "C" int APS5_VABI sceSystemServiceReenableMusicPlayer(void);
-extern "C" int APS5_VABI sceSystemServiceDisableMediaPlay(void);
-extern "C" int APS5_VABI sceSystemServiceReenableMediaPlay(void);
-extern "C" int APS5_VABI sceSystemServiceLaunchWebBrowser(const char* uri);
-extern "C" int APS5_VABI sceSystemServiceShowControllerSettings(void);
-extern "C" int APS5_VABI sceSystemServiceShowDisplaySafeAreaSettings(void);
-extern "C" int APS5_VABI sceSystemServiceOpenChallengeActivity(void);
-extern "C" int APS5_VABI sceSystemServiceGetStatus(SystemServiceStatus* status);
-extern "C" int APS5_VABI sceSystemServiceGetDisplaySafeAreaInfo(SystemServiceDisplaySafeAreaInfo* info);
-extern "C" int APS5_VABI sceSystemServiceGetNoticeScreenSkipFlag(bool* value);
-extern "C" int APS5_VABI sceSystemServiceSetNoticeScreenSkipFlag(void);
-extern "C" int APS5_VABI sceSystemServiceDisableNoticeScreenSkipFlagAutoSet(void);
-extern "C" int APS5_VABI sceSystemServiceHideSplashScreen(void);
-extern "C" int APS5_VABI sceSystemServiceReceiveEvent(SystemServiceEvent* event);
-extern "C" void APS5_VABI sceSystemServiceInitializePlayerDialogParam(SystemServicePlayerDialogParam* param);
-
 namespace {
 
 void TestPlayerDialogParam() {
diff --git a/core/libs/tests/GuestSystemServiceAppTitleId.cpp b/core/libs/tests/GuestSystemServiceAppTitleId.cpp
new file mode 100644
index 0000000000..7fee52ec8e
--- /dev/null
+++ b/core/libs/tests/GuestSystemServiceAppTitleId.cpp
@@ -0,0 +1,132 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <limits>
+#include <string_view>
+
+namespace {
+
+constexpr char Sentinel = 0x5A;
+
+struct GuardedBuffer {
+    char bytes[10 + 6];
+    GuardedBuffer() { std::memset(bytes, Sentinel, sizeof(bytes)); }
+    bool Untouched() const {
+        for (const char byte : bytes) {
+            if (byte != Sentinel) return false;
+        }
+        return true;
+    }
+    bool GuardIntact() const {
+        for (std::size_t index = 10; index < sizeof(bytes); ++index) {
+            if (bytes[index] != Sentinel) return false;
+        }
+        return true;
+    }
+};
+
+void Require(bool value) { if (!value) std::abort(); }
+
+template<typename TCall>
+bool Throws(TCall call) {
+    try {
+        call();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+bool GetAppIdThrows(const char* titleId) {
+    return Throws([&] { static_cast<void>(sceSystemServiceGetAppId(titleId)); });
+}
+
+bool GetAppTitleIdThrows(int appId, GuardedBuffer& buffer) {
+    return Throws([&] { static_cast<void>(sceSystemServiceGetAppTitleId(appId, buffer.bytes)); }) && buffer.Untouched();
+}
+
+bool LncGetAppTitleIdThrows(std::uint32_t appId, GuardedBuffer& buffer) {
+    return Throws([&] { static_cast<void>(sceLncUtilGetAppTitleId(static_cast<std::int32_t>(appId), buffer.bytes)); }) && buffer.Untouched();
+}
+
+void CheckOtherApplications(int runningAppId) {
+    const int otherAppIds[] = {runningAppId + 1, runningAppId - 1, 0, -1, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()};
+    for (const int appId : otherAppIds) {
+        GuardedBuffer buffer;
+        Require(GetAppTitleIdThrows(appId, buffer));
+        Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(appId), buffer));
+    }
+    GuardedBuffer buffer;
+    Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(runningAppId) | 0x80000000u, buffer));
+    Require(LncGetAppTitleIdThrows(std::numeric_limits<std::uint32_t>::max(), buffer));
+}
+
+void CheckNullBuffers(int runningAppId) {
+    Require(Throws([&] { static_cast<void>(sceSystemServiceGetAppTitleId(runningAppId, nullptr)); }));
+    Require(Throws([&] { static_cast<void>(sceLncUtilGetAppTitleId(runningAppId, nullptr)); }));
+    Require(Throws([&] { static_cast<void>(sceSystemServiceGetAppTitleId(runningAppId + 1, nullptr)); }));
+    Require(GetAppIdThrows(nullptr));
+}
+
+void CheckKnownTitle(int runningAppId) {
+    constexpr std::string_view titleId = "PPSA00000";
+    Require(runningAppId >= 0);
+    Require(sceSystemServiceGetAppId("PPSA00000") == runningAppId);
+    Require(sceSystemServiceGetAppId("PPSA00000") == runningAppId);
+    const char* const otherTitles[] = {"PPSA00001", "PPSA00010", "ppsa00000", "PPSA0000", "PPSA000000", "PPSA00000 ", " PPSA00000", "CUSA00000", ""};
+    for (const char* other : otherTitles) {
+        Require(GetAppIdThrows(other));
+    }
+
+    GuardedBuffer buffer;
+    Require(sceSystemServiceGetAppTitleId(runningAppId, buffer.bytes) == 0);
+    Require(std::memcmp(buffer.bytes, "PPSA00000", titleId.size() + 1) == 0);
+    Require(buffer.GuardIntact());
+    Require(sceSystemServiceGetAppId(buffer.bytes) == runningAppId);
+
+    GuardedBuffer lncBuffer;
+    Require(sceLncUtilGetAppTitleId(runningAppId, lncBuffer.bytes) == 0);
+    Require(std::memcmp(lncBuffer.bytes, "PPSA00000", titleId.size() + 1) == 0);
+    Require(lncBuffer.GuardIntact());
+
+    GuardedBuffer dirty;
+    std::memset(dirty.bytes, 'x', 10);
+    Require(sceSystemServiceGetAppTitleId(runningAppId, dirty.bytes) == 0);
+    Require(std::strcmp(dirty.bytes, "PPSA00000") == 0 && dirty.GuardIntact());
+
+    CheckOtherApplications(runningAppId);
+    CheckNullBuffers(runningAppId);
+}
+
+void CheckLongTitle(int runningAppId) {
+    Require(sceSystemServiceGetAppId("PPSA000000") == runningAppId);
+    Require(GetAppIdThrows("PPSA00000"));
+    Require(GetAppIdThrows("PPSA0000000"));
+    GuardedBuffer buffer;
+    Require(GetAppTitleIdThrows(runningAppId, buffer));
+    Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(runningAppId), buffer));
+}
+
+void CheckMissingMetadata(int runningAppId) {
+    Require(GetAppIdThrows("PPSA00000"));
+    Require(GetAppIdThrows(nullptr));
+    GuardedBuffer buffer;
+    Require(GetAppTitleIdThrows(runningAppId, buffer));
+    Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(runningAppId), buffer));
+}
+
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 2);
+    const std::string_view mode = argv[1];
+    const int runningAppId = sceSystemServiceGetAppIdOfRunningBigApp();
+    if (mode == "known") CheckKnownTitle(runningAppId);
+    else if (mode == "long") CheckLongTitle(runningAppId);
+    else if (mode == "missing") CheckMissingMetadata(runningAppId);
+    else Require(false);
+}
diff --git a/core/libs/tests/GuestSystemServiceLanguage.cpp b/core/libs/tests/GuestSystemServiceLanguage.cpp
index 2be7c170c6..8e1aefdf3a 100644
--- a/core/libs/tests/GuestSystemServiceLanguage.cpp
+++ b/core/libs/tests/GuestSystemServiceLanguage.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include <cstdlib>
@@ -6,8 +7,6 @@
 #include <string>
 #include <utility>
 
-extern "C" int APS5_VABI sceSystemServiceParamGetInt(int paramId, int* value);
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp b/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
index ec83ac1c10..f054b5793b 100644
--- a/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
+++ b/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
@@ -1,16 +1,14 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <string>
+#include <string_view>
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-int APS5_VABI dup2_nid_postfix(int, int);
-}
-
 namespace {
 
 constexpr const char* Marker = "APS5_LOAD_EXEC_STANDARD_ERROR";
@@ -28,6 +26,17 @@ std::string Drain(int descriptor) {
     return text;
 }
 
+bool HostOutputIs(const std::string& text, const std::string& line) {
+    constexpr std::string_view WriteWatchUnavailable = "[memory] write watch unavailable: ";
+    std::size_t begin = 0;
+    if (text.compare(0, WriteWatchUnavailable.size(), WriteWatchUnavailable) == 0) {
+        const std::size_t end = text.find('\n');
+        if (end == std::string::npos) return false;
+        begin = end + 1;
+    }
+    return text.compare(begin, std::string::npos, line) == 0;
+}
+
 void Run(const char* mode, const char* const* arguments) {
     int host[2] = {-1, -1};
     int guest[2] = {-1, -1};
@@ -53,7 +62,7 @@ void Run(const char* mode, const char* const* arguments) {
     int status = 0;
     Require(::waitpid(child, &status, 0) == child);
     Require(WIFEXITED(status) && WEXITSTATUS(status) == 0);
-    Require(hostText == std::string("started ") + mode + "\n");
+    Require(HostOutputIs(hostText, std::string("started ") + mode + "\n"));
     Require(guestText.empty());
 }
 
diff --git a/core/libs/tests/GuestSystemServicePathBoundary.cpp b/core/libs/tests/GuestSystemServicePathBoundary.cpp
index da8e6927f0..8d80cb489a 100644
--- a/core/libs/tests/GuestSystemServicePathBoundary.cpp
+++ b/core/libs/tests/GuestSystemServicePathBoundary.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
@@ -8,8 +9,6 @@
 #include <stdexcept>
 #include <windows.h>
 
-extern "C" int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-
 namespace {
 
 void Require(bool value) {
diff --git a/core/libs/tests/GuestSystemServiceTimeZone.cpp b/core/libs/tests/GuestSystemServiceTimeZone.cpp
index 7f61bcf1fe..cb0e4c65c8 100644
--- a/core/libs/tests/GuestSystemServiceTimeZone.cpp
+++ b/core/libs/tests/GuestSystemServiceTimeZone.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include <cstdlib>
 #include <ctime>
 
-extern "C" int APS5_VABI sceSystemServiceParamGetInt(int paramId, int* value);
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestTcp.cpp b/core/libs/tests/GuestTcp.cpp
index 11fe4a9366..71878e7021 100644
--- a/core/libs/tests/GuestTcp.cpp
+++ b/core/libs/tests/GuestTcp.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -8,24 +10,6 @@
 #include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI shutdown_nid_postfix(int, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
diff --git a/core/libs/tests/GuestTerminal.cpp b/core/libs/tests/GuestTerminal.cpp
index ad27b96a30..8fabd1454f 100644
--- a/core/libs/tests/GuestTerminal.cpp
+++ b/core/libs/tests/GuestTerminal.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -8,24 +10,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI tcgetattr_nid_postfix(int, void*);
-int APS5_VABI tcsetattr_nid_postfix(int, int, const void*);
-int APS5_VABI tcsendbreak_nid_postfix(int, int);
-int APS5_VABI tcdrain_nid_postfix(int);
-int APS5_VABI tcflush_nid_postfix(int, int);
-int APS5_VABI tcflow_nid_postfix(int, int);
-int APS5_VABI tcgetpgrp_nid_postfix(int);
-int APS5_VABI tcsetpgrp_nid_postfix(int, int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "terminal check failed at line %d, errno %d\n", line, *__error_nid_postfix());
diff --git a/core/libs/tests/GuestTermiosSpeed.cpp b/core/libs/tests/GuestTermiosSpeed.cpp
index cc0a4c76b4..1ad51b5903 100644
--- a/core/libs/tests/GuestTermiosSpeed.cpp
+++ b/core/libs/tests/GuestTermiosSpeed.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -14,8 +15,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 using SetSpeed = int (APS5_VABI*)(void*, std::uint32_t);
diff --git a/core/libs/tests/GuestTextToSpeech2.cpp b/core/libs/tests/GuestTextToSpeech2.cpp
index 93de9dc755..13cab7e16c 100644
--- a/core/libs/tests/GuestTextToSpeech2.cpp
+++ b/core/libs/tests/GuestTextToSpeech2.cpp
@@ -1,24 +1,14 @@
+#include "prx/libSceTextToSpeech2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-std::int32_t APS5_VABI sceTextToSpeech2Initialize(const void* param);
-int APS5_VABI sceTextToSpeech2Open(const void* parameter);
-int APS5_VABI sceTextToSpeech2Cancel();
-int APS5_VABI sceTextToSpeech2Close();
-int APS5_VABI sceTextToSpeech2GetSpeechStatus(std::int32_t* status);
-int APS5_VABI sceTextToSpeech2Speak(const void* parameter);
-int APS5_VABI sceTextToSpeech2Terminate();
-int APS5_VABI sceTextToSpeech2GetSystemStatus(std::int32_t* status);
-}
-
 int main() {
     constexpr std::int32_t unsupported = static_cast<std::int32_t>(0x8002002D);
     const std::uint32_t param[16]{0x2000000, 0x26c};
-    if (sceTextToSpeech2Initialize(param) != unsupported) {
+    if (sceTextToSpeech2Initialize(reinterpret_cast<const TextToSpeechInitParameter*>(param)) != unsupported) {
         std::puts("TextToSpeech2: initialization did not report the unsupported operation");
         std::abort();
     }
diff --git a/core/libs/tests/GuestThermalSensors.cpp b/core/libs/tests/GuestThermalSensors.cpp
index 3c051911a6..de58b80a6a 100644
--- a/core/libs/tests/GuestThermalSensors.cpp
+++ b/core/libs/tests/GuestThermalSensors.cpp
@@ -1,6 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <algorithm>
+#include <climits>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -11,9 +14,7 @@
 
 extern "C" {
 void ReadThermalSensors_nid_no_patch(const char* root, int celsius[3]);
-int APS5_VABI sceKernelGetCpuTemperature(int* outCelsius);
-int APS5_VABI sceKernelGetSocSensorTemperature(int sensorId, int* outCelsius);
-int APS5_VABI sceKernelGetSocPowerConsumption(void* consumption);
+
 }
 
 static void Require(bool value) {
@@ -62,14 +63,22 @@ int main() {
     Require(fallback[0] == 55 && fallback[1] == -1 && fallback[2] == -1);
     std::filesystem::remove_all(skipped);
 
-    int value = 0;
-    Require(sceKernelGetCpuTemperature(nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Require(sceKernelGetSocSensorTemperature(0, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Require(sceKernelGetSocSensorTemperature(-1, &value) == SCE_KERNEL_ERROR_EINVAL);
-    Require(sceKernelGetSocSensorTemperature(3, &value) == SCE_KERNEL_ERROR_EINVAL);
+    *__error_nid_postfix() = 0;
+    Require(sceKernelGetCpuTemperature(nullptr) == SCE_KERNEL_ERROR_EFAULT && *__error_nid_postfix() == 14);
+    *__error_nid_postfix() = 0;
+    Require(sceKernelGetSocSensorTemperature(0, nullptr) == SCE_KERNEL_ERROR_EFAULT && *__error_nid_postfix() == 14);
+    for (const int invalid : {-1, 65, 256, INT_MAX, INT_MIN}) {
+        int untouched = -12345;
+        *__error_nid_postfix() = 0;
+        Require(sceKernelGetSocSensorTemperature(invalid, &untouched) == SCE_KERNEL_ERROR_EINVAL && *__error_nid_postfix() == 22 && untouched == -12345);
+        *__error_nid_postfix() = 0;
+        Require(sceKernelGetSocSensorTemperature(invalid, nullptr) == SCE_KERNEL_ERROR_EINVAL && *__error_nid_postfix() == 22);
+    }
+    for (const int unmapped : {3, 15, 32, 64}) {
+        *__error_nid_postfix() = 0;
+        Require(sceKernelGetSocSensorTemperature(unmapped, nullptr) == SCE_KERNEL_ERROR_EFAULT && *__error_nid_postfix() == 14);
+    }
 
-    int sentinel = -12345;
-    Require(sceKernelGetSocSensorTemperature(15, &sentinel) == SCE_KERNEL_ERROR_EINVAL && sentinel == -12345);
     int probe = -12345;
     const int result = sceKernelGetSocSensorTemperature(0, &probe);
     Require(result == 0 ? (probe >= 0 && probe <= 130) : (result == SCE_KERNEL_ERROR_EINVAL && probe == -12345));
diff --git a/core/libs/tests/GuestThreadAtexit.cpp b/core/libs/tests/GuestThreadAtexit.cpp
index f37fd5d526..ebcfc1eeeb 100644
--- a/core/libs/tests/GuestThreadAtexit.cpp
+++ b/core/libs/tests/GuestThreadAtexit.cpp
@@ -1,17 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI _sceLibcInternalThreadAtexit_nid_postfix(void (APS5_VABI* destructor)(void*), void* object, void* dsoSymbol);
-void APS5_VABI _sceLibcInternalThreadDtors_nid_postfix();
-}
-
 namespace {
 
 using Destructor = void (APS5_VABI*)(void*);
@@ -47,6 +41,7 @@ void* APS5_VABI Worker(void*) {
 bool DestructorsThrow() {
     try {
         _sceLibcInternalThreadDtors_nid_postfix();
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -61,9 +56,11 @@ int main() {
     Require(Register(RecordAndRegister, 2) == 0);
     Require(Register(Record, 3) == 0);
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls == std::vector<std::intptr_t>{3, 2, 9, 1});
     Require(callers == std::vector<Pthread>(4, mainThread));
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls.size() == 4);
 
     calls.clear();
@@ -83,5 +80,6 @@ int main() {
     Require(DestructorsThrow());
     Require(calls.empty());
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls == std::vector<std::intptr_t>{6});
 }
diff --git a/core/libs/tests/GuestThreadCallbackAbi.cpp b/core/libs/tests/GuestThreadCallbackAbi.cpp
index 4fe7aa04ca..a5e6abb9f6 100644
--- a/core/libs/tests/GuestThreadCallbackAbi.cpp
+++ b/core/libs/tests/GuestThreadCallbackAbi.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -12,12 +13,6 @@
 
 using GuestDestructor = void(APS5_VABI *)(void*);
 
-extern "C" {
-int APS5_VABI __cxa_thread_atexit_impl_nid_postfix(GuestDestructor, void*, void*);
-int APS5_VABI __cxa_thread_atexit_nid_postfix(GuestDestructor, void*, void*);
-int APS5_VABI LibcInternalExtCxaThreadAtexit_nid_postfix(GuestDestructor, void*, void*);
-}
-
 namespace {
 
 struct Call {
diff --git a/core/libs/tests/GuestThreadCpuClock.cpp b/core/libs/tests/GuestThreadCpuClock.cpp
index 15946c4aec..952c0652ea 100644
--- a/core/libs/tests/GuestThreadCpuClock.cpp
+++ b/core/libs/tests/GuestThreadCpuClock.cpp
@@ -1,26 +1,21 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
+#include <initializer_list>
 #include <thread>
 
-extern "C" {
-int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId);
-Pthread APS5_VABI pthread_self_nid_postfix(void);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI clock_getres_nid_postfix(int clockId, KernelTimespec* res);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int GUEST_CLOCK_MONOTONIC = 4;
 static constexpr int GUEST_CLOCK_THREAD_CPUTIME_ID = 14;
+static constexpr int GUEST_CLOCK_PROCESS_CPUTIME_ID = 15;
+static constexpr std::uint32_t PROCESS_CPU_CLOCK = 0xC0000000u;
 static constexpr std::int64_t NANOS_PER_SECOND = 1000000000LL;
 static constexpr std::int64_t NANOS_PER_MILLISECOND = 1000000LL;
 static constexpr std::int64_t BURN_NANOS = 200 * NANOS_PER_MILLISECOND;
@@ -107,10 +102,36 @@ static void OtherThreadClockReadsThatThread() {
     Require(*__error_nid_postfix() == GUEST_EINVAL);
 }
 
+static void ProcessClocksNameOnlyTheGuest() {
+    const int self = getpid_nid_postfix();
+    const int own = static_cast<int>(PROCESS_CPU_CLOCK | static_cast<std::uint32_t>(self));
+    const int other = static_cast<int>(PROCESS_CPU_CLOCK | static_cast<std::uint32_t>(self + 1));
+    const std::int64_t start = Nanos(own);
+    BurnOwnCpu(BURN_NANOS);
+    const std::int64_t before = Nanos(own);
+    const std::int64_t reference = Nanos(GUEST_CLOCK_PROCESS_CPUTIME_ID);
+    const std::int64_t after = Nanos(own);
+    Require(before - start >= BURN_NANOS - TICK_MARGIN_NANOS);
+    Require(before <= reference + TICK_MARGIN_NANOS && reference <= after + TICK_MARGIN_NANOS);
+    KernelTimespec time{-1, -1};
+    *__error_nid_postfix() = 0;
+    Require(clock_gettime_nid_postfix(other, &time) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    Require(time.tv_sec == -1 && time.tv_nsec == -1);
+    Require(sceKernelClockGettime(other, &time) == SCE_KERNEL_ERROR_EINVAL);
+    KernelTimespec threadResolution{-1, -1};
+    Require(clock_getres_nid_postfix(GUEST_CLOCK_THREAD_CPUTIME_ID, &threadResolution) == 0);
+    for (const int clockId : {own, other}) {
+        KernelTimespec resolution{-1, -1};
+        Require(clock_getres_nid_postfix(clockId, &resolution) == 0);
+        Require(resolution.tv_sec == threadResolution.tv_sec && resolution.tv_nsec == threadResolution.tv_nsec);
+    }
+}
+
 int main() {
     int clockId = 0;
     Require(pthread_getcpuclockid_nid_postfix(nullptr, &clockId) == GUEST_EINVAL);
     Require(pthread_getcpuclockid_nid_postfix(pthread_self_nid_postfix(), nullptr) == GUEST_EFAULT);
     OwnClockFollowsThreadCpuTime();
     OtherThreadClockReadsThatThread();
+    ProcessClocksNameOnlyTheGuest();
 }
diff --git a/core/libs/tests/GuestThreadSanitizer.cpp b/core/libs/tests/GuestThreadSanitizer.cpp
index 4403a31564..7c69247cd9 100644
--- a/core/libs/tests/GuestThreadSanitizer.cpp
+++ b/core/libs/tests/GuestThreadSanitizer.cpp
@@ -1,8 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 
-extern "C" int APS5_VABI sceKernelIsThreadSanitizerEnabled(void);
-
 int main() {
     if (sceKernelIsThreadSanitizerEnabled() != 0) std::abort();
     return 0;
diff --git a/core/libs/tests/GuestThreadSelf.cpp b/core/libs/tests/GuestThreadSelf.cpp
index 87e38f6c0a..ae09ff38d4 100644
--- a/core/libs/tests/GuestThreadSelf.cpp
+++ b/core/libs/tests/GuestThreadSelf.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -9,38 +13,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadDetach(Pthread thread);
-int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** value);
-int APS5_VABI pthread_detach_nid_postfix(Pthread thread);
-void APS5_VABI scePthreadExit(void* retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetthreadid(void);
-int APS5_VABI pthread_getthreadid_np_nid_postfix(void);
-void APS5_VABI scePthreadTestcancel();
-void APS5_VABI pthread_testcancel_nid_postfix(void);
-int APS5_VABI scePthreadSetcancelstate(int state, int* old_state);
-int APS5_VABI scePthreadSetcanceltype(int type, int* old_type);
-void APS5_VABI pthread_set_name_np_nid_postfix(Pthread thread, const char* name);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetstackaddr(const PthreadAttr* attr, void** stack_addr);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, size_t* stack_size);
-int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
-int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
-}
-
 static bool StackContains(Pthread thread, const void* address) {
     PthreadAttr attr = nullptr;
     if (scePthreadAttrInit(&attr) != 0 || scePthreadAttrGet(thread, &attr) != 0) return false;
@@ -48,20 +20,18 @@ static bool StackContains(Pthread thread, const void* address) {
     size_t size = 0;
     const bool queried = scePthreadAttrGetstackaddr(&attr, &stack) == 0 && scePthreadAttrGetstacksize(&attr, &size) == 0;
     scePthreadAttrDestroy(&attr);
+
     const auto begin = reinterpret_cast<std::uintptr_t>(stack);
     const auto value = reinterpret_cast<std::uintptr_t>(address);
     return queried && stack != nullptr && size != 0 && value >= begin && value - begin < size;
 }
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
-static constexpr int SCE_KERNEL_ERROR_EPERM = 0x80020001;
-static constexpr int SCE_KERNEL_ERROR_EDEADLK = 0x8002000b;
 static constexpr int GUEST_EDEADLK = 11;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int MUTEX_TYPE_RECURSIVE = 2;
-static constexpr int PTHREAD_CANCEL_ENABLE = 0;
-static constexpr int PTHREAD_CANCEL_ASYNCHRONOUS = 2;
+static constexpr int GuestPthread_Cancel_Enable = 0;
+static constexpr int GuestPthread_Cancel_Asynchronous = 2;
 static constexpr std::intptr_t WorkerRetval = 0x1234;
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -78,6 +48,7 @@ static void ReportedStack(Pthread thread, std::uintptr_t* begin, std::uintptr_t*
     size_t size = 0;
     Require(scePthreadAttrGetstackaddr(&attr, &stack) == SCE_OK && scePthreadAttrGetstacksize(&attr, &size) == SCE_OK);
     scePthreadAttrDestroy(&attr);
+
     *begin = reinterpret_cast<std::uintptr_t>(stack);
     *end = *begin + size;
 }
@@ -165,12 +136,14 @@ static void* APS5_VABI Worker(void* arg) {
     context.posixJoinSelf = pthread_join_nid_postfix(context.selfFromWorker, nullptr);
     int oldState = -1;
     int oldType = -1;
-    context.testcancelReturned = scePthreadSetcancelstate(PTHREAD_CANCEL_ENABLE, &oldState) == SCE_OK &&
-        scePthreadSetcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, &oldType) == SCE_OK;
+    context.testcancelReturned = scePthreadSetcancelstate(GuestPthread_Cancel_Enable, &oldState) == SCE_OK &&
+        scePthreadSetcanceltype(GuestPthread_Cancel_Asynchronous, &oldType) == SCE_OK;
     scePthreadTestcancel();
     pthread_testcancel_nid_postfix();
-    context.testcancelReturned = context.testcancelReturned && oldState == PTHREAD_CANCEL_ENABLE;
+
+    context.testcancelReturned = context.testcancelReturned && oldState == GuestPthread_Cancel_Enable;
     scePthreadExit(reinterpret_cast<void*>(WorkerRetval));
+
     return nullptr;
 }
 
@@ -229,14 +202,15 @@ int main() {
 
     scePthreadTestcancel();
     pthread_testcancel_nid_postfix();
-
     Require(scePthreadMutexUnlock(&mutex) == SCE_OK);
     Require(scePthreadMutexDestroy(&mutex) == SCE_OK);
 
     char name[32] = {'x'};
     pthread_set_name_np_nid_postfix(mainSelf, "q2-main");
+
     Require(scePthreadGetname(mainSelf, name) == SCE_OK && std::strcmp(name, "q2-main") == 0);
     pthread_set_name_np_nid_postfix(mainSelf, nullptr);
+
     Require(scePthreadGetname(mainSelf, name) == SCE_OK && name[0] == '\0');
     pthread_set_name_np_nid_postfix(nullptr, "ignored");
 
diff --git a/core/libs/tests/GuestTimeConversion.cpp b/core/libs/tests/GuestTimeConversion.cpp
index 7b11ebe2ef..abc96e55f2 100644
--- a/core/libs/tests/GuestTimeConversion.cpp
+++ b/core/libs/tests/GuestTimeConversion.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include <array>
@@ -15,24 +17,11 @@
 #include <thread>
 
 extern "C" {
-GuestTm* APS5_VABI libc_gmtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI gmtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI libc_localtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI localtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-char* APS5_VABI asctime_nid_postfix(const GuestTm*);
-std::int64_t APS5_VABI mktime_nid_postfix(GuestTm*);
-std::size_t APS5_VABI strftime_nid_postfix(char*, std::size_t, const char*, const GuestTm*);
-void APS5_VABI tzset_nid_postfix(void);
+
 extern char* tzname_nid_postfix[2];
 extern std::int64_t timezone_nid_postfix;
 extern int daylight_nid_postfix;
-char* APS5_VABI ctime_nid_postfix(const std::int64_t*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-double APS5_VABI libc_difftime_nid_postfix(std::int64_t, std::int64_t);
-double APS5_VABI difftime_nid_postfix(std::int64_t, std::int64_t);
+
 }
 
 using Converter = GuestTm* (APS5_VABI *)(const std::int64_t*);
@@ -140,75 +129,41 @@ static void CheckBufferSize(const GuestTm& guest, const char* format, std::size_
     Require(strftime_nid_postfix(buffer, 1, format, &guest) == 0, "strftime accepted a one byte buffer");
 }
 
-static const char* HostZoneName(int isdst) {
-#ifdef _WIN32
-    return _tzname[isdst != 0 ? 1 : 0];
-#else
-    return tzname[isdst != 0 ? 1 : 0];
-#endif
-}
 
-static void CheckFreeBsdConversions() {
+static void CheckConsoleConversions() {
     const std::int64_t timer = 1700000000;
     GuestTm guest{};
     Require(gmtime_s_nid_postfix(&timer, &guest) == &guest, "UTC conversion failed");
-    CheckFormat(guest, "%k|%l", "22|10");
-    CheckFormat(guest, "%v", "14-Nov-2023");
-    CheckFormat(guest, "%+", "Tue Nov 14 22:13:20 UTC 2023");
-    CheckFormat(guest, "%s", "1699992800");
+    CheckFormat(guest, "%k|%l|%v|%+|%s", "%k|%l|%v|%+|%s");
     CheckFormat(guest, "%%k %%l %%s %%v %%+", "%k %l %s %v %+");
-    CheckFormat(guest, "%%%k", "%22");
-    CheckFormat(guest, "[%k][%l]", "[22][10]");
-    CheckFormat(guest, "%Ek|%Ol|%Os|%Ev|%O+", "22|10|1699992800|14-Nov-2023|Tue Nov 14 22:13:20 UTC 2023");
-    CheckFormat(guest, "%E%k", "%k");
-    CheckFormat(guest, "%O%l", "%l");
-    CheckFormat(guest, "%E%s", "%s");
-    CheckFormat(guest, "%E%v", "%v");
-    CheckFormat(guest, "%O%+", "%+");
-    CheckFormat(guest, "%k|%E%l|%l", "22|%l|10");
-    CheckFormat(guest, "%E%", "%");
-    CheckFormat(guest, "%O%%k", "%22");
-    CheckFormat(guest, "%E%k%k", "%k22");
+    CheckFormat(guest, "%Ek|%Ol|%Os|%Ev|%O+", "%k|%l|%s|%v|%+");
+    CheckFormat(guest, "%Ec|%Ox|%EY|%Om", "Tue Nov 14 22:13:20 2023|11/14/23|2023|11");
+    CheckFormat(guest, "%EE|%OO|%EO", "%E|%O|%O");
     CheckBufferSize(guest, "%k", 2);
-    CheckBufferSize(guest, "%k:%l", 5);
-    CheckBufferSize(guest, "%+", 28);
+    CheckBufferSize(guest, "%c", 24);
     CheckBufferSize(guest, "%Ek", 2);
+    bool threw = false;
+    try {
+        char buffer[16];
+        strftime_nid_postfix(buffer, sizeof(buffer), "ab%O", &guest);
+    } catch (const std::invalid_argument&) {
+        threw = true;
+    }
+    Require(threw, "strftime accepted a format ending after a modifier");
 
     guest.tm_zone = "XYZ";
-    CheckFormat(guest, "%+", "Tue Nov 14 22:13:20 XYZ 2023");
-    CheckFormat(guest, "%O+", "Tue Nov 14 22:13:20 XYZ 2023");
-    guest.tm_zone = "A%B";
-    CheckFormat(guest, "%+", "Tue Nov 14 22:13:20 A%B 2023");
-    guest.tm_zone = nullptr;
     guest.tm_isdst = 0;
-    char expected[96];
-    std::snprintf(expected, sizeof(expected), "Tue Nov 14 22:13:20 %s 2023", HostZoneName(0));
-    CheckFormat(guest, "%+", expected);
+    CheckFormat(guest, "%Z", tzname_nid_postfix[0]);
     guest.tm_isdst = 1;
-    std::snprintf(expected, sizeof(expected), "Tue Nov 14 22:13:20 %s 2023", HostZoneName(1));
-    CheckFormat(guest, "%+", expected);
+    CheckFormat(guest, "%Z", tzname_nid_postfix[1]);
     guest.tm_isdst = 0;
 
-    GuestTm local{};
-    Require(localtime_s_nid_postfix(&timer, &local) == &local, "Local conversion failed");
-    GuestTm normalized = local;
-    const std::int64_t mktimeResult = mktime_nid_postfix(&normalized);
-    Require(mktimeResult == timer, "mktime did not invert localtime");
-    std::snprintf(expected, sizeof(expected), "%lld", static_cast<long long>(mktimeResult));
-    CheckFormat(local, "%s", expected);
-    CheckFormat(local, "%Os", expected);
-
     guest.tm_hour = 0;
-    CheckFormat(guest, "%k|%l", " 0|12");
+    CheckFormat(guest, "%I|%p", "12|AM");
     guest.tm_hour = 12;
-    CheckFormat(guest, "%k|%l", "12|12");
-    guest.tm_hour = 5;
-    guest.tm_mday = 5;
-    CheckFormat(guest, "%k|%l|%v", " 5| 5| 5-Nov-2023");
+    CheckFormat(guest, "%I|%p", "12|PM");
     guest.tm_hour = 13;
-    CheckFormat(guest, "%k|%l", "13| 1");
-    char tooSmall[4]{};
-    Require(strftime_nid_postfix(tooSmall, sizeof(tooSmall), "%k:%l", &guest) == 0, "strftime accepted an undersized buffer");
+    CheckFormat(guest, "%I|%p", "01|PM");
 }
 
 static void CheckLiteralConversions() {
@@ -220,31 +175,18 @@ static void CheckLiteralConversions() {
         const char* expected;
     };
     constexpr FormatCase cases[]{
-        {"%Q", "Q"},
-        {"%P|%f|%N|%1|%#Y", "P|f|N|1|#Y"},
-        {"[%Q] %Y-%m-%d", "[Q] 2023-11-14"},
-        {"%EQ|%OQ|%_Q|%-Q|%0Q", "Q|Q|Q|Q|Q"},
-        {"%E_Q|%_EQ|%O0Q|%-OQ", "Q|Q|Q|Q"},
-        {"%EEY|%EOY|%OEY|%OOY", "EY|OY|EY|OY"},
-        {"%EE%Y|%OO%k", "E2023|O22"},
-        {"%--Y|%__Y|%00Y|%_0Y|%0-Y", "-Y|_Y|0Y|0Y|-Y"},
-        {"%E_EY|%_EOY|%O0OY", "EY|OY|OY"},
+        {"%Q", "%Q"},
+        {"%P|%f|%N|%1|%#Y", "%P|%f|%N|%1|%#Y"},
+        {"[%Q] %Y-%m-%d", "[%Q] 2023-11-14"},
+        {"%EQ|%OQ|%_Q|%-Q|%0Q", "%Q|%Q|%_Q|%-Q|%0Q"},
+        {"%--Y|%__Y|%00Y", "%--Y|%__Y|%00Y"},
         {"%", "%"},
         {"text%", "text%"},
-        {"%E", "E"},
-        {"%O", "O"},
-        {"%_", "_"},
-        {"%-", "-"},
-        {"%0", "0"},
-        {"%E_", "_"},
-        {"%_E", "E"},
-        {"%Q%", "Q%"},
-        {"%k%", "22%"},
-        {"%%Q|%%%Q|%%%%Q", "%Q|%Q|%%Q"},
-        {"%E%Q|%O%Q|%_%Q|%0%Q|%-%Q", "%Q|%Q|%Q|%Q|%Q"},
-        {"%E%%Q|%O%%%Q", "%Q|%%Q"},
-        {"%Q|%Ek|%Ol|%Ev|%Y", "Q|22|10|14-Nov-2023|2023"},
-        {"%\xc3\xa5", "\xc3\xa5"},
+        {"%_", "%_"},
+        {"%Q%", "%Q%"},
+        {"%Y%", "2023%"},
+        {"%%Q|%%%Q|%%%%Q", "%Q|%%Q|%%Q"},
+        {"%\xc3\xa5", "%\xc3\xa5"},
         {"%%", "%"},
         {"literal text", "literal text"},
     };
@@ -302,13 +244,70 @@ static void CheckLocalRange() {
     Require(localtime_s_nid_postfix(&overflow, &scratch) == nullptr, "Unrepresentable negative local time was accepted");
 }
 
-#ifndef _WIN32
+#ifdef _WIN32
+extern "C" long* __cdecl __dstbias(void);
+
+struct DaylightBiasFixture {
+    long saved = *__dstbias();
+    ~DaylightBiasFixture() { *__dstbias() = saved; }
+    void Apply() const { *__dstbias() = -3600; }
+};
+
+struct ZoneOffset {
+    const char* zone;
+    std::int64_t timer;
+    long offset;
+    int isdst;
+};
+
+static void CheckPosixFormZoneOffsets() {
+    DaylightBiasFixture bias;
+    constexpr std::array<ZoneOffset, 4> expectations{{
+        {"PST8PDT", 979560000, -28800, 0},
+        {"PST8PDT", 995198400, -25200, 1},
+        {"EST5EDT", 979560000, -18000, 0},
+        {"EST5EDT", 995198400, -14400, 1},
+    }};
+    for (const ZoneOffset& expected : expectations) {
+        Require(setenv_nid_postfix("TZ", expected.zone, 1) == 0, "Could not set the POSIX-form time zone");
+        tzset_nid_postfix();
+        bias.Apply();
+        GuestTm local{};
+        Require(localtime_s_nid_postfix(&expected.timer, &local) == &local, "Local conversion in a POSIX-form zone failed");
+        if (local.tm_gmtoff != expected.offset || local.tm_isdst != expected.isdst) {
+            long hostTimezone = -1;
+            long hostDstBias = -1;
+            _get_timezone(&hostTimezone);
+            _get_dstbias(&hostDstBias);
+            std::tm hostLocal{};
+            const __time64_t hostTimer = expected.timer;
+            _localtime64_s(&hostLocal, &hostTimer);
+            std::fprintf(stderr, "%s at %lld: offset %ld daylight %d, expected %ld daylight %d (host timezone %ld dstbias %ld daylight %d)\n", expected.zone, static_cast<long long>(expected.timer), static_cast<long>(local.tm_gmtoff), local.tm_isdst, expected.offset, expected.isdst, hostTimezone, hostDstBias, hostLocal.tm_isdst);
+            std::abort();
+        }
+    }
+    Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
+    tzset_nid_postfix();
+}
+#endif
+
 static void CheckRegionZones() {
+#ifdef _WIN32
+    constexpr std::array<const char*, 2> zones{"PST8PDT", "EST5EDT"};
+    constexpr std::array<std::int64_t, 11> timers{-62135553600, -12609691200, -5016340800, -5000011200, -2732356800, -2209032000, -2208988800, -2208945600, -631108800, 979560000, 995198400};
+#else
     constexpr std::array<const char*, 4> zones{"America/Los_Angeles", "Europe/Berlin", "Asia/Kolkata", "America/Argentina/Buenos_Aires"};
     constexpr std::array<std::int64_t, 9> timers{-62135553600, -12609691200, -5016340800, -5000011200, -2732356800, -2209032000, -2208988800, -2208945600, -631108800};
+#endif
+#ifdef _WIN32
+    DaylightBiasFixture bias;
+#endif
     for (const char* zone : zones) {
         Require(setenv_nid_postfix("TZ", zone, 1) == 0, "Could not set the region time zone");
         tzset_nid_postfix();
+#ifdef _WIN32
+        bias.Apply();
+#endif
         for (const std::int64_t timer : timers) {
             GuestTm local{};
             Require(localtime_s_nid_postfix(&timer, &local) == &local, "Local conversion in a region zone failed");
@@ -326,8 +325,8 @@ static void CheckRegionZones() {
     }
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
 }
-#endif
 
 static void CheckGuestZone() {
     const std::int64_t moment = 172800;
@@ -343,35 +342,40 @@ static void CheckGuestZone() {
     Require(mktime_nid_postfix(&calendar) == moment, "mktime ignored the guest TZ");
     Require(setenv_nid_postfix("TZ", "UTC+3", 1) == 0, "Could not change the guest time zone");
     tzset_nid_postfix();
+
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_hour == 21 && result.tm_mday == 2 && result.tm_gmtoff == -10800,
         "tzset ignored the guest TZ");
     Require(timezone_nid_postfix == 10800 && daylight_nid_postfix == 1, "tzset did not set timezone and daylight for UTC+3");
     Require(setenv_nid_postfix("TZ", "", 1) == 0, "Could not empty the guest time zone");
     tzset_nid_postfix();
+
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_hour == 0 && result.tm_mday == 3 && result.tm_gmtoff == 0,
         "An empty guest TZ was not treated as UTC");
     Require(timezone_nid_postfix == 0 && daylight_nid_postfix == 1, "tzset did not set timezone and daylight for UTC");
     Require(setenv_nid_postfix("TZ", "EST5EDT", 1) == 0, "Could not set a daylight saving guest time zone");
     tzset_nid_postfix();
+
     Require(timezone_nid_postfix == 18000 && daylight_nid_postfix == 1, "timezone is not the standard offset of a daylight saving zone");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
     Require(setenv_nid_postfix("TZ", "EST5", 1) == 0, "Could not set the guest time zone without tzset");
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_hour == 19 && result.tm_gmtoff == -18000,
         "localtime ignored a guest TZ change made without tzset");
-    Require(std::strcmp(tzname_nid_postfix[0], "EST") == 0, "Implicit guest TZ update did not refresh tzname");
+    Require(std::strcmp(tzname_nid_postfix[0], "EST") == 0 && std::strcmp(tzname_nid_postfix[1], "   ") == 0,
+        "Implicit guest TZ update did not refresh tzname");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
 }
 
 static bool ZoneFieldsConsistent(const GuestTm& time, std::int64_t instant, int hour) {
     const std::int64_t localSeconds = ((instant + time.tm_gmtoff) % 86400 + 86400) % 86400;
     if (time.tm_hour * 3600 + time.tm_min * 60 + time.tm_sec != localSeconds || time.tm_hour != hour) return false;
-    char expected[16];
-    const std::int64_t offset = time.tm_gmtoff < 0 ? -time.tm_gmtoff : time.tm_gmtoff;
-    std::snprintf(expected, sizeof(expected), "%02d %c%04d", hour, time.tm_gmtoff < 0 ? '-' : '+', static_cast<int>(offset / 3600 * 100));
-    char formatted[16]{};
-    return strftime_nid_postfix(formatted, sizeof(formatted), "%H %z", &time) == 8 && std::strcmp(formatted, expected) == 0;
+    char expected[4];
+    std::snprintf(expected, sizeof(expected), "%02d", hour);
+    char formatted[4]{};
+    return strftime_nid_postfix(formatted, sizeof(formatted), "%H", &time) == 2 && std::strcmp(formatted, expected) == 0;
 }
 
 static void CheckZoneRace() {
@@ -379,7 +383,11 @@ static void CheckZoneRace() {
     std::atomic<bool> stop{false};
     std::atomic<int> torn{0};
     std::thread flipper([&] {
-        for (bool west = false; !stop.load(); west = !west) setenv_nid_postfix("TZ", west ? "UTC-5" : "UTC+3", 1);
+        for (bool west = false; !stop.load(); west = !west) {
+            setenv_nid_postfix("TZ", west ? "UTC-5" : "UTC+3", 1);
+
+            std::this_thread::yield();
+        }
     });
     std::array<std::thread, 6> readers;
     for (auto& reader : readers) {
@@ -403,6 +411,7 @@ static void CheckZoneRace() {
     Require(torn == 0, "A time conversion mixed the fields of two time zones while TZ changed");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
 }
 
 #ifdef _WIN32
@@ -414,12 +423,14 @@ static void CheckRejectedZone() {
     bool thrown = false;
     try {
         localtime_s_nid_postfix(&moment, &result);
+
     } catch (const std::runtime_error&) {
         thrown = true;
     }
     Require(thrown, "localtime accepted a TZ the host cannot hold");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_gmtoff == 7200, "localtime did not recover after a rejected TZ");
 }
 #endif
@@ -427,6 +438,7 @@ static void CheckRejectedZone() {
 int main() {
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not set the guest time zone");
     tzset_nid_postfix();
+
     constexpr std::array<UtcCase, 7> utcCases{{
         {0, 70, 0, 1, 0, 0, 0, 4, 0},
         {-1, 69, 11, 31, 23, 59, 59, 3, 364},
@@ -506,10 +518,11 @@ int main() {
     Require(strftime_nid_postfix(formatted, sizeof(formatted), "%Y-%m-%d %H:%M:%S", &utc) == 19
         && std::strcmp(formatted, "1970-01-01 00:00:00") == 0, "strftime did not read the guest tm");
 
-    CheckFreeBsdConversions();
+    CheckConsoleConversions();
     CheckLocalRange();
-#ifndef _WIN32
     CheckRegionZones();
+#ifdef _WIN32
+    CheckPosixFormZoneOffsets();
 #endif
     CheckLiteralConversions();
 
@@ -524,13 +537,16 @@ int main() {
 #endif
     Require(setenv_nid_postfix("TZ", "UTC-5", 1) == 0, "Could not set the guest time zone");
     tzset_nid_postfix();
+
     GuestTm shifted{};
     Require(localtime_s_nid_postfix(&epoch, &shifted) == &shifted && shifted.tm_hour == 5 && shifted.tm_gmtoff == 18000,
         "tzset did not pick up the new TZ");
-    Require(tzname_nid_postfix[0] != nullptr && std::strcmp(tzname_nid_postfix[0], "UTC") == 0 && tzname_nid_postfix[1] != nullptr,
-        "tzname does not name the zone tzset set");
+    Require(tzname_nid_postfix[0] != nullptr && std::strcmp(tzname_nid_postfix[0], "UTC") == 0 && tzname_nid_postfix[1] != nullptr &&
+            std::strcmp(tzname_nid_postfix[1], "   ") == 0,
+        "tzname does not name the zone tzset set and leave the daylight name blank");
     Require(setenv_nid_postfix("TZ", "EST5EDT", 1) == 0, "Could not set the guest time zone");
     tzset_nid_postfix();
+
     Require(std::strcmp(tzname_nid_postfix[0], "EST") == 0 && std::strcmp(tzname_nid_postfix[1], "EDT") == 0,
         "tzname does not name the standard and daylight zones");
 }
diff --git a/core/libs/tests/GuestTimeExtras.cpp b/core/libs/tests/GuestTimeExtras.cpp
index 6fc9d4cde0..f03c36ce64 100644
--- a/core/libs/tests/GuestTimeExtras.cpp
+++ b/core/libs/tests/GuestTimeExtras.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include <cstdint>
@@ -7,24 +9,6 @@
 #include <limits>
 #include <random>
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
-extern "C" {
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI gmtime_r_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI localtime_r_nid_postfix(const std::int64_t*, GuestTm*);
-std::int64_t APS5_VABI timegm_nid_postfix(GuestTm*);
-void APS5_VABI tzset_nid_postfix();
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI xtime_get_nid_postfix(Xtime*, int);
-Xtime APS5_VABI _Xtime_to_ts_nid_postfix(const Xtime*);
-Xtime APS5_VABI _Xtime_diff_to_ts_nid_postfix(const Xtime*);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -156,6 +140,7 @@ static void CheckXtime() {
 int main() {
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not set the time zone");
     tzset_nid_postfix();
+
     CheckReentrantConversions();
     CheckTimegmCases();
     CheckXtime();
diff --git a/core/libs/tests/GuestTimedJoin.cpp b/core/libs/tests/GuestTimedJoin.cpp
index 34ce27fdf0..928c3bb73b 100644
--- a/core/libs/tests/GuestTimedJoin.cpp
+++ b/core/libs/tests/GuestTimedJoin.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
 #include <chrono>
@@ -13,30 +16,21 @@
 #include <dlfcn.h>
 #endif
 
-struct Timespec { std::int64_t seconds, nanoseconds; };
-static_assert(sizeof(Timespec)==16 && alignof(Timespec)==8 && offsetof(Timespec,nanoseconds)==8);
-extern "C" {
-int APS5_VABI pthread_create_nid_postfix(void**,const void*,void* (APS5_VABI*)(void*),void*);
-int APS5_VABI pthread_join_nid_postfix(void*,void**);
-int APS5_VABI pthread_detach_nid_postfix(void*);
-int APS5_VABI pthread_cancel_nid_postfix(void*);
-void* APS5_VABI pthread_self_nid_postfix();
-int APS5_VABI clock_gettime_nid_postfix(int,Timespec*);
-int* APS5_VABI __error_nid_postfix();
-}
-using TimedJoin=int (APS5_VABI*)(void*,void**,const Timespec*);
+static_assert(sizeof(KernelTimespec)==16 && alignof(KernelTimespec)==8 && offsetof(KernelTimespec,tv_nsec)==8);
+
+using TimedJoin = decltype(&pthread_timedjoin_np_nid_postfix);
 static TimedJoin timedJoin;
 
 void Require(bool value,const char* message) {
     if (!value) { std::fprintf(stderr,"timed join: %s\n",message); std::abort(); }
 }
 
-Timespec After(int milliseconds) {
-    Timespec result{};
+KernelTimespec After(int milliseconds) {
+    KernelTimespec result{};
     Require(clock_gettime_nid_postfix(0,&result)==0,"read realtime");
-    result.nanoseconds+=static_cast<std::int64_t>(milliseconds)*1000000;
-    result.seconds+=result.nanoseconds/1000000000;
-    result.nanoseconds%=1000000000;
+    result.tv_nsec+=static_cast<std::int64_t>(milliseconds)*1000000;
+    result.tv_sec+=result.tv_nsec/1000000000;
+    result.tv_nsec%=1000000000;
     return result;
 }
 
@@ -57,14 +51,14 @@ void Wait(const std::atomic<bool>& flag) {
     }
 }
 
-void* Start(Gate& gate) {
-    void* thread=nullptr;
+Pthread Start(Gate& gate) {
+    Pthread thread=nullptr;
     Require(pthread_create_nid_postfix(&thread,nullptr,Worker,&gate)==0,"create worker");
     Wait(gate.entered);
     return thread;
 }
 
-struct JoinTask { void* target; std::atomic<bool> entered{false}; int result=-1; void* value=reinterpret_cast<void*>(std::uintptr_t{0x55}); };
+struct JoinTask { Pthread target; std::atomic<bool> entered{false}; int result=-1; void* value=reinterpret_cast<void*>(std::uintptr_t{0x55}); };
 void* APS5_VABI Joiner(void* argument) {
     auto& task=*static_cast<JoinTask*>(argument);
     const auto deadline=After(3000);
@@ -73,8 +67,8 @@ void* APS5_VABI Joiner(void* argument) {
     return nullptr;
 }
 
-void AwaitClaim(void* target) {
-    const Timespec past{0,0};
+void AwaitClaim(Pthread target) {
+    const KernelTimespec past{0,0};
     const auto until=std::chrono::steady_clock::now()+std::chrono::seconds(2);
     for (;;) {
         const int result=timedJoin(target,nullptr,&past);
@@ -86,8 +80,8 @@ void AwaitClaim(void* target) {
 }
 
 void Basic() {
-    const Timespec valid=After(1000);
-    for (const Timespec invalid: {Timespec{-1,0},Timespec{0,-1},Timespec{0,1000000000}}) {
+    const KernelTimespec valid=After(1000);
+    for (const KernelTimespec invalid: {KernelTimespec{-1,0},KernelTimespec{0,-1},KernelTimespec{0,1000000000}}) {
         Require(timedJoin(nullptr,nullptr,&invalid)==22,"invalid deadline precedes null thread");
         Require(timedJoin(pthread_self_nid_postfix(),nullptr,&invalid)==22,"invalid deadline precedes self join");
     }
@@ -95,9 +89,9 @@ void Basic() {
     Require(timedJoin(nullptr,nullptr,&valid)==22,"null thread");
     Require(timedJoin(pthread_self_nid_postfix(),nullptr,&valid)==11,"self join");
     Gate gate;
-    void* thread=Start(gate);
+    Pthread thread=Start(gate);
     struct { std::uint64_t before=0xa5a5a5a5; void* value=reinterpret_cast<void*>(std::uintptr_t{0x55}); std::uint64_t after=0x5a5a5a5a; } result;
-    const Timespec past{0,0};
+    const KernelTimespec past{0,0};
     *__error_nid_postfix()=123;
     Require(timedJoin(thread,&result.value,&past)==60,"past deadline expires");
     Require(result.value==reinterpret_cast<void*>(std::uintptr_t{0x55}),"timeout preserves return slot");
@@ -107,16 +101,16 @@ void Basic() {
     const auto started=std::chrono::steady_clock::now();
     Require(timedJoin(thread,&result.value,&deadline)==60,"future deadline expires");
     Require(std::chrono::steady_clock::now()-started>=std::chrono::milliseconds(25),"wait did not expire immediately");
-    Require(deadline.seconds==originalDeadline.seconds && deadline.nanoseconds==originalDeadline.nanoseconds,"deadline input is unchanged");
+    Require(deadline.tv_sec==originalDeadline.tv_sec && deadline.tv_nsec==originalDeadline.tv_nsec,"deadline input is unchanged");
     gate.release.store(true,std::memory_order_release);
-    const Timespec distant{std::numeric_limits<std::int64_t>::max(),999999999};
+    const KernelTimespec distant{std::numeric_limits<std::int64_t>::max(),999999999};
     Require(timedJoin(thread,&result.value,&distant)==0,"timeout leaves target joinable; distant deadline does not overflow");
     Require(result.value==reinterpret_cast<void*>(std::uintptr_t{0x12345678}),"joined return value");
     Require(result.before==0xa5a5a5a5 && result.after==0x5a5a5a5a,"return-slot bounds");
     Require(timedJoin(thread,nullptr,&valid)==3,"already joined target");
     Require(timedJoin(thread,nullptr,nullptr)==22,"deadline validation precedes joined state");
     Gate done;
-    void* completed=Start(done);
+    Pthread completed=Start(done);
     done.release.store(true,std::memory_order_release);
     Wait(done.leaving);
     const auto until=std::chrono::steady_clock::now()+std::chrono::seconds(2);
@@ -127,7 +121,7 @@ void Basic() {
         std::this_thread::yield();
     }
     Gate detached;
-    void* detachedThread=Start(detached);
+    Pthread detachedThread=Start(detached);
     Require(pthread_detach_nid_postfix(detachedThread)==0,"detach worker");
     Require(timedJoin(detachedThread,nullptr,&valid)==22,"detached target");
     detached.release.store(true,std::memory_order_release);
@@ -136,9 +130,9 @@ void Basic() {
 
 void Contention(bool cancel) {
     Gate gate;
-    void* target=Start(gate);
+    Pthread target=Start(gate);
     JoinTask task{target};
-    void* joiner=nullptr;
+    Pthread joiner=nullptr;
     Require(pthread_create_nid_postfix(&joiner,nullptr,Joiner,&task)==0,"create competing joiner");
     Wait(task.entered);
     AwaitClaim(target);
@@ -147,7 +141,7 @@ void Contention(bool cancel) {
         void* canceled=nullptr;
         Require(pthread_join_nid_postfix(joiner,&canceled)==0 && canceled==reinterpret_cast<void*>(std::uintptr_t{1}),"joiner is canceled");
         Require(task.result==-1 && task.value==reinterpret_cast<void*>(std::uintptr_t{0x55}),"canceled join did not return or write result");
-        const Timespec past{0,0};
+        const KernelTimespec past{0,0};
         Require(timedJoin(target,nullptr,&past)==60,"cancellation releases join claim");
         gate.release.store(true,std::memory_order_release);
         const auto deadline=After(1000);
diff --git a/core/libs/tests/GuestTlsGetAddr.cpp b/core/libs/tests/GuestTlsGetAddr.cpp
new file mode 100644
index 0000000000..e13ef11bde
--- /dev/null
+++ b/core/libs/tests/GuestTlsGetAddr.cpp
@@ -0,0 +1,86 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <stdexcept>
+#include <thread>
+#if defined(_WIN32)
+#include <windows.h>
+#else
+#include <link.h>
+#endif
+
+#if defined(_WIN32)
+extern "C" ULONG _tls_index;
+
+namespace {
+
+using Cell = char;
+constexpr Cell Initial = 0;
+
+KernelTlsIndex CellIndex() { return {reinterpret_cast<std::uintptr_t>(&_tls_index), 0}; }
+
+Cell* ThreadCell() {
+    auto* blocks = *reinterpret_cast<char***>(reinterpret_cast<char*>(NtCurrentTeb()) + 0x58);
+    return blocks[_tls_index];
+}
+
+}
+#else
+namespace {
+
+using Cell = std::uint32_t;
+constexpr Cell Initial = 0x5ca1ab1e;
+thread_local Cell Value = Initial;
+
+struct Module {
+    std::size_t id = 0;
+    void* data = nullptr;
+};
+
+Module MainModule() {
+    Module module;
+    dl_iterate_phdr([](dl_phdr_info* info, std::size_t, void* out) {
+        auto& found = *static_cast<Module*>(out);
+        found = {info->dlpi_tls_modid, info->dlpi_tls_data};
+        return 1;
+    }, &module);
+    return module;
+}
+
+KernelTlsIndex CellIndex() {
+    const auto module = MainModule();
+    return {module.id, static_cast<std::uint64_t>(reinterpret_cast<char*>(&Value) - static_cast<char*>(module.data))};
+}
+
+Cell* ThreadCell() { return &Value; }
+
+}
+#endif
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+}
+
+int main() {
+    const auto index = CellIndex();
+    auto* own = static_cast<Cell*>(__tls_get_addr_nid_postfix(&index));
+    Require(own == ThreadCell() && *own == Initial);
+    *own = 7;
+    Cell* other = nullptr;
+    Cell seen = 1;
+    std::thread([&] {
+        other = static_cast<Cell*>(__tls_get_addr_nid_postfix(&index));
+        Require(other == ThreadCell());
+        seen = *other;
+        *other = 9;
+    }).join();
+    Require(other != own && seen == Initial && *own == 7);
+    *own = Initial;
+    bool threw = false;
+    try { __tls_get_addr_nid_postfix(nullptr); } catch (const std::invalid_argument&) { threw = true; }
+    Require(threw);
+}
diff --git a/core/libs/tests/GuestTruncate.cpp b/core/libs/tests/GuestTruncate.cpp
index 1e037fd9d8..732a8394be 100644
--- a/core/libs/tests/GuestTruncate.cpp
+++ b/core/libs/tests/GuestTruncate.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -18,16 +21,6 @@ extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handle
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI truncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI sceKernelFtruncate(int, std::int64_t);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int GuestEnoent = 2;
diff --git a/core/libs/tests/GuestTruncateExtend.cpp b/core/libs/tests/GuestTruncateExtend.cpp
index 66dcffd80e..789105ba61 100644
--- a/core/libs/tests/GuestTruncateExtend.cpp
+++ b/core/libs/tests/GuestTruncateExtend.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -8,18 +10,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::uint64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::uint64_t, std::int64_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI truncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI unlink_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ReadOnly = 0;
@@ -30,6 +20,7 @@ constexpr char FileName[] = "anyps5_truncate_extend_file";
 
 void Cleanup() {
     unlink_nid_postfix(FileName);
+
 }
 
 void Require(bool condition, const char* what) {
diff --git a/core/libs/tests/GuestTruncateRace.cpp b/core/libs/tests/GuestTruncateRace.cpp
index 29f2f3a3e1..e4602f6415 100644
--- a/core/libs/tests/GuestTruncateRace.cpp
+++ b/core/libs/tests/GuestTruncateRace.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <barrier>
@@ -11,18 +13,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelFtruncate(int, std::int64_t);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI dup_nid_postfix(int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Truncate race check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestUdp.cpp b/core/libs/tests/GuestUdp.cpp
index 7efa4731f4..346f8c1a69 100644
--- a/core/libs/tests/GuestUdp.cpp
+++ b/core/libs/tests/GuestUdp.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -7,47 +9,37 @@
 #include <initializer_list>
 #include <thread>
 #include <chrono>
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI ioctl_nid_postfix(int, std::uint64_t, void*);
-int APS5_VABI _ioctl_nid_postfix(int, std::uint64_t, void*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-const char* APS5_VABI inet_ntop_nid_postfix(int, const void*, char*, std::uint32_t);
-int APS5_VABI inet_pton_nid_postfix(int, const char*, void*);
-int* APS5_VABI __error_nid_postfix();
-}
-struct Iovec {
-    void* base;
-    std::uint64_t length;
-};
-struct Msghdr {
-    void* name;
-    std::uint32_t nameLength;
-    Iovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-extern "C" {
-std::int64_t APS5_VABI sendmsg_nid_postfix(int, const Msghdr*, int);
-std::int64_t APS5_VABI recvmsg_nid_postfix(int, Msghdr*, int);
-std::int64_t APS5_VABI sceKernelReadv(int, const Iovec*, int);
-std::int64_t APS5_VABI sceKernelWritev(int, const Iovec*, int);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 
+static void CheckUnreachablePortIgnored() {
+    const int closing = socket_nid_postfix(2, 2, 0);
+    Require(closing >= 0);
+    std::array<unsigned char, 16> unreachable{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(bind_nid_postfix(closing, unreachable.data(), unreachable.size()) == 0);
+    std::uint32_t size = unreachable.size();
+    Require(getsockname_nid_postfix(closing, unreachable.data(), &size) == 0 && size == unreachable.size());
+    const int receiver = socket_nid_postfix(2, 2 | 0x20000000, 0);
+    const int sender = socket_nid_postfix(2, 2, 0);
+    Require(receiver >= 0 && sender >= 0);
+    std::array<unsigned char, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(bind_nid_postfix(receiver, address.data(), address.size()) == 0);
+    size = address.size();
+    Require(getsockname_nid_postfix(receiver, address.data(), &size) == 0);
+    Require(close_nid_postfix(closing) == 0);
+    Require(sendto_nid_postfix(receiver, "x", 1, 0, unreachable.data(), unreachable.size()) == 1);
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    char received[4]{};
+    for (int attempt = 0; attempt < 3; ++attempt) {
+        Require(recvfrom_nid_postfix(receiver, received, sizeof(received), 0, nullptr, nullptr) == -1 && *__error_nid_postfix() == 35);
+        std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    }
+    Require(sendto_nid_postfix(sender, "ok", 2, 0, address.data(), address.size()) == 2);
+    std::this_thread::sleep_for(std::chrono::milliseconds(50));
+    Require(recvfrom_nid_postfix(receiver, received, sizeof(received), 0, nullptr, nullptr) == 2 && received[0] == 'o');
+    Require(close_nid_postfix(sender) == 0 && close_nid_postfix(receiver) == 0);
+}
+
 static void CheckAddressLengths(int family) {
     const std::uint32_t addressSize = family == 2 ? 16 : 28;
     const int receiver = socket_nid_postfix(family, 2, 0);
@@ -89,8 +81,8 @@ static void CheckAddressLengths(int family) {
         Require(size == copied && std::memcmp(address.data(), expected.data(), copied) == 0);
         Require(std::all_of(address.begin() + copied, address.end(), [](auto byte) { return byte == 0xa5; }));
         address.fill(0xa5);
-        Iovec vector{received, sizeof(received)};
-        Msghdr message{address.data(), capacity, &vector, 1, nullptr, 0, -1};
+        KernelIovec vector{received, sizeof(received)};
+        GuestMsghdr message{address.data(), capacity, &vector, 1, nullptr, 0, -1};
         Require(recvmsg_nid_postfix(receiver, &message, 0) == sizeof(payload));
         Require(message.nameLength == copied && std::memcmp(received, payload, sizeof(payload)) == 0);
         Require(std::memcmp(address.data(), expected.data(), copied) == 0);
@@ -133,8 +125,8 @@ static void CheckDontWait() {
     std::uint32_t size = address.size();
     Require(getsockname_nid_postfix(receiver, address.data(), &size) == 0);
     char buffer[16]{};
-    Iovec vector{buffer, sizeof(buffer)};
-    Msghdr message{nullptr, 0, &vector, 1, nullptr, 0, 0};
+    KernelIovec vector{buffer, sizeof(buffer)};
+    GuestMsghdr message{nullptr, 0, &vector, 1, nullptr, 0, 0};
     const auto start = std::chrono::steady_clock::now();
     Require(recv_nid_postfix(receiver, buffer, sizeof(buffer), 0x80) == -1 && *__error_nid_postfix() == 35);
     Require(recvfrom_nid_postfix(receiver, buffer, sizeof(buffer), 0x80, nullptr, nullptr) == -1 && *__error_nid_postfix() == 35);
@@ -173,11 +165,11 @@ int main() {
     Require(connect_nid_postfix(sender, destination.data(), destination.size()) == 0);
     char vectorHead[] = "atomic ";
     char vectorTail[] = "datagram";
-    Iovec vectorOutput[]{{vectorHead, sizeof(vectorHead) - 1}, {vectorTail, sizeof(vectorTail)}};
+    KernelIovec vectorOutput[]{{vectorHead, sizeof(vectorHead) - 1}, {vectorTail, sizeof(vectorTail)}};
     Require(sceKernelWritev(sender, vectorOutput, 2) == sizeof(vectorHead) + sizeof(vectorTail) - 1);
     char vectorFirst[sizeof(vectorHead) - 1]{};
     char vectorSecond[sizeof(vectorTail)]{};
-    Iovec vectorInput[]{{vectorFirst, sizeof(vectorFirst)}, {vectorSecond, sizeof(vectorSecond)}};
+    KernelIovec vectorInput[]{{vectorFirst, sizeof(vectorFirst)}, {vectorSecond, sizeof(vectorSecond)}};
     Require(sceKernelReadv(receiver, vectorInput, 2) == sizeof(vectorHead) + sizeof(vectorTail) - 1);
     Require(std::memcmp(vectorFirst, "atomic ", sizeof(vectorFirst)) == 0 && std::strcmp(vectorSecond, "datagram") == 0);
     int enabled = 1;
@@ -237,8 +229,8 @@ int main() {
     Require(_ioctl_nid_postfix(receiver, 123, &queued) == -1 && *__error_nid_postfix() == 25);
     char head[] = "scatter ";
     char tail[] = "gather";
-    Iovec parts[2]{{head, 8}, {tail, 6}};
-    Msghdr outgoing{nullptr, 0, parts, 2, nullptr, 0, 0};
+    KernelIovec parts[2]{{head, 8}, {tail, 6}};
+    GuestMsghdr outgoing{nullptr, 0, parts, 2, nullptr, 0, 0};
     Require(sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
     const auto wait = [&] {
         queued = 0;
@@ -250,22 +242,31 @@ int main() {
     };
     wait();
     char first[4]{}, second[16]{};
-    Iovec pieces[2]{{first, sizeof(first)}, {second, sizeof(second)}};
+    KernelIovec pieces[2]{{first, sizeof(first)}, {second, sizeof(second)}};
     source.fill(0);
     unsigned char control[8]{};
-    Msghdr incoming{source.data(), static_cast<std::uint32_t>(source.size()), pieces, 2, control, sizeof(control), -1};
+    GuestMsghdr incoming{source.data(), static_cast<std::uint32_t>(source.size()), pieces, 2, control, sizeof(control), -1};
+    Require(recvmsg_nid_postfix(receiver, &incoming, 2) == 14 && incoming.flags == 2);
+    incoming.nameLength = static_cast<std::uint32_t>(source.size());
+    incoming.controlLength = sizeof(control);
     Require(recvmsg_nid_postfix(receiver, &incoming, 0) == 14);
     Require(std::memcmp(first, "scat", 4) == 0 && std::memcmp(second, "ter gather", 10) == 0);
     Require(incoming.flags == 0 && incoming.controlLength == 0 && incoming.nameLength == 16 && source[1] == 2 && source[4] == 127);
     Require(sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
     wait();
     char shortBuffer[5]{};
-    Iovec single{shortBuffer, sizeof(shortBuffer)};
-    Msghdr truncated{nullptr, 0, &single, 1, nullptr, 0, 0};
-    Require(recvmsg_nid_postfix(receiver, &truncated, 0) == 5);
-    Require(std::memcmp(shortBuffer, "scatt", 5) == 0 && truncated.flags == 0x10);
+    KernelIovec single{shortBuffer, sizeof(shortBuffer)};
+    GuestMsghdr truncated{nullptr, 0, &single, 1, nullptr, 0, 0};
+    Require(recvmsg_nid_postfix(receiver, &truncated, 2) == 5 && truncated.flags == 0x12);
+    Require(recvmsg_nid_postfix(receiver, &truncated, 0x80) == 5);
+    Require(std::memcmp(shortBuffer, "scatt", 5) == 0 && truncated.flags == 0x90);
     Require(recvmsg_nid_postfix(receiver, &truncated, 0) == -1 && *__error_nid_postfix() == 35);
-    Msghdr oversized{nullptr, 0, parts, 1025, nullptr, 0, 0};
+    KernelIovec none{shortBuffer, 0};
+    GuestMsghdr empty{nullptr, 0, &none, 1, nullptr, 0, -1};
+    Require(fcntl_nid_postfix(receiver, 4, 2) == 0);
+    Require(recvmsg_nid_postfix(receiver, &empty, 0) == 0 && empty.flags == 0);
+    Require(fcntl_nid_postfix(receiver, 4, 6) == 0);
+    GuestMsghdr oversized{nullptr, 0, parts, 1025, nullptr, 0, 0};
     Require(sendmsg_nid_postfix(sender, &oversized, 0) == -1 && *__error_nid_postfix() == 40);
     Require(recvmsg_nid_postfix(receiver, nullptr, 0) == -1 && *__error_nid_postfix() == 14);
     Require(close_nid_postfix(receiver) == 0);
@@ -337,4 +338,5 @@ int main() {
     Require(closeOnExec >= 0 && fcntl_nid_postfix(closeOnExec, 3) == 2);
     Require(close_nid_postfix(closeOnExec) == 0);
     Require(socket_nid_postfix(2, 0x20000000, 0) == -1 && *__error_nid_postfix() == 43);
+    CheckUnreachablePortIgnored();
 }
diff --git a/core/libs/tests/GuestUlobjmgr.cpp b/core/libs/tests/GuestUlobjmgr.cpp
index 0fd79500f7..3f6795a979 100644
--- a/core/libs/tests/GuestUlobjmgr.cpp
+++ b/core/libs/tests/GuestUlobjmgr.cpp
@@ -1,12 +1,8 @@
+#include "prx/ulobjmgr/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI _sceUlobjmgrRegisterObject(std::uint64_t object, std::int32_t kind, std::uint32_t* id);
-int APS5_VABI _sceUlobjmgrUnregisterObject(std::uint32_t id);
-}
-
 namespace {
 
 constexpr int einval = 22;
diff --git a/core/libs/tests/GuestUltCondition.cpp b/core/libs/tests/GuestUltCondition.cpp
index 3922c753ef..2f5c980fe4 100644
--- a/core/libs/tests/GuestUltCondition.cpp
+++ b/core/libs/tests/GuestUltCondition.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
@@ -9,19 +10,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceUltFinalize();
-int APS5_VABI sceUltMutexCreate(void*, const char*, void*, const UltMutexOptParam*, std::uint32_t);
-int APS5_VABI sceUltMutexLock(void*);
-int APS5_VABI sceUltMutexUnlock(void*);
-int APS5_VABI sceUltMutexDestroy(void*);
-int APS5_VABI sceUltConditionVariableCreate(void*, const char*, void*, const void*, std::uint32_t);
-int APS5_VABI _sceUltConditionVariableCreate(void*, const char*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltConditionVariableWait(void*);
-int APS5_VABI sceUltConditionVariableSignal(void*);
-int APS5_VABI sceUltConditionVariableDestroy(void*);
-}
-
 constexpr int Null = -2139029503;
 constexpr int Invalid = -2139029500;
 constexpr int Permission = -2139029499;
diff --git a/core/libs/tests/GuestUltQueue.cpp b/core/libs/tests/GuestUltQueue.cpp
index 4cfcf13881..7a2a1ef562 100644
--- a/core/libs/tests/GuestUltQueue.cpp
+++ b/core/libs/tests/GuestUltQueue.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
@@ -10,21 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceUltInitialize();
-int APS5_VABI sceUltFinalize();
-std::uint64_t APS5_VABI sceUltWaitingQueueResourcePoolGetWorkAreaSize(std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI sceUltQueueDataResourcePoolGetWorkAreaSize(std::uint32_t, std::uint64_t, std::uint32_t);
-int APS5_VABI sceUltQueueDataResourcePoolCreate(void*, const char*, std::uint32_t, std::uint64_t, std::uint32_t, void*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltQueueDataResourcePoolDestroy(void*);
-int APS5_VABI sceUltQueueCreate(void*, const char*, std::uint64_t, void*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltQueueDestroy(void*);
-int APS5_VABI sceUltQueuePush(void*, const void*);
-int APS5_VABI sceUltQueueTryPush(void*, const void*);
-int APS5_VABI sceUltQueuePop(void*, void*);
-int APS5_VABI sceUltQueueTryPop(void*, void*);
-}
-
 static constexpr int Null = -2139029503;
 static constexpr int Alignment = -2139029502;
 static constexpr int Range = -2139029501;
diff --git a/core/libs/tests/GuestUltSync.cpp b/core/libs/tests/GuestUltSync.cpp
index 7b2e1e51ed..f8e54452d0 100644
--- a/core/libs/tests/GuestUltSync.cpp
+++ b/core/libs/tests/GuestUltSync.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceUlt/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -6,46 +8,10 @@
 #include <cstdlib>
 #include <cstring>
 #include <initializer_list>
+#include <stdexcept>
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceUltInitialize();
-int APS5_VABI sceUltFinalize();
-int APS5_VABI sceUltMutexCreate(void*, const char*, void*, const UltMutexOptParam*, std::uint32_t);
-int APS5_VABI sceUltMutexLock(void*);
-int APS5_VABI sceUltMutexTryLock(void*);
-int APS5_VABI sceUltMutexUnlock(void*);
-int APS5_VABI sceUltMutexDestroy(void*);
-int APS5_VABI sceUltSemaphoreOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltQueueOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltQueueDataResourcePoolOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltWaitingQueueResourcePoolOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI _sceUltWaitingQueueResourcePoolCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*);
-int APS5_VABI sceUltWaitingQueueResourcePoolDestroy(void*);
-int APS5_VABI sceUltReaderWriterLockOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltConditionVariableOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI _sceUltConditionVariableOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltReaderWriterLockCreate(void*, const char*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltReaderWriterLockDestroy(void*);
-int APS5_VABI sceUltReaderWriterLockLockRead(void*);
-int APS5_VABI sceUltReaderWriterLockTryLockRead(void*);
-int APS5_VABI sceUltReaderWriterLockUnlockRead(void*);
-int APS5_VABI sceUltReaderWriterLockLockWrite(void*);
-int APS5_VABI sceUltReaderWriterLockTryLockWrite(void*);
-int APS5_VABI sceUltReaderWriterLockUnlockWrite(void*);
-std::uint64_t APS5_VABI sceUltUlthreadRuntimeGetWorkAreaSize(std::uint32_t, std::uint32_t);
-int APS5_VABI sceUltUlthreadRuntimeCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadRuntimeDestroy(void*);
-int APS5_VABI sceUltUlthreadCreate(void*, const char*, UltUlthreadEntry, std::uint64_t, void*, std::uint64_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadTryJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadGetSelf(void**);
-int APS5_VABI sceUltUlthreadYield();
-int APS5_VABI sceUltUlthreadExit(std::int32_t);
-}
-
 namespace {
 
 constexpr int Ok = 0;
@@ -98,20 +64,19 @@ void MutexTryLock() {
 }
 
 void OptParams() {
-    using Initializer = int (APS5_VABI *)(void*, std::uint32_t);
+    using Initializer = decltype(&sceUltSemaphoreOptParamInitialize);
     for (const Initializer initialize : {sceUltSemaphoreOptParamInitialize, sceUltQueueOptParamInitialize, sceUltQueueDataResourcePoolOptParamInitialize,
                                          sceUltWaitingQueueResourcePoolOptParamInitialize, sceUltUlthreadOptParamInitialize, sceUltReaderWriterLockOptParamInitialize,
                                          sceUltConditionVariableOptParamInitialize, _sceUltConditionVariableOptParamInitialize}) {
-        std::uint8_t bytes[136];
+        alignas(UltOptParam) std::uint8_t bytes[136];
         std::memset(bytes, 0xa5, sizeof(bytes));
         CHECK(initialize(nullptr, 0) == Null);
-        CHECK(initialize(bytes, 0) == Ok);
+        CHECK(initialize(reinterpret_cast<UltOptParam*>(bytes), 0) == Ok);
         for (std::size_t index = 0; index < 128; ++index) CHECK(bytes[index] == 0);
         for (std::size_t index = 128; index < sizeof(bytes); ++index) CHECK(bytes[index] == 0xa5);
     }
 }
 
-
 void WaitUntil(const std::atomic<bool>& flag) {
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
     while (!flag.load() && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
@@ -273,6 +238,7 @@ std::int32_t APS5_VABI ExitingEntry(std::uint64_t status) {
     if (sceUltUlthreadGetSelf(&self) == Ok) gSelf = self;
     gYield = sceUltUlthreadYield();
     sceUltUlthreadExit(static_cast<std::int32_t>(status));
+
     gPastExit = true;
     return -1;
 }
@@ -305,6 +271,406 @@ void Ulthreads() {
     CHECK(sceUltUlthreadRuntimeDestroy(&runtime) == Ok);
 }
 
+void* CurrentThreadId() {
+    std::uintptr_t id;
+    const auto self = scePthreadSelf();
+    std::memcpy(&id, self, sizeof(id));
+    return reinterpret_cast<void*>(id);
+}
+
+template<typename TInfo, typename TQuery>
+void CheckUnsupportedInfo(TQuery query, void* object, std::uint32_t capacity = 4) {
+    TInfo info;
+    std::memset(&info, 0xEE, sizeof(info));
+    UltWaitingThreadInfo waiters[4];
+    std::memset(waiters, 0xAA, sizeof(waiters));
+    for (auto& waiter : waiters) waiter.size = sizeof(UltWaitingThreadInfo);
+    std::uint8_t savedWaiters[sizeof(waiters)];
+    std::memcpy(savedWaiters, waiters, sizeof(waiters));
+    bool threw = false;
+    try {
+        query(object, &info, waiters, capacity);
+    } catch (const std::runtime_error&) {
+        threw = true;
+    }
+    CHECK(threw);
+    const auto* bytes = reinterpret_cast<const std::uint8_t*>(&info);
+    for (std::size_t index = 0; index < sizeof(info); ++index) CHECK(bytes[index] == 0xEE);
+    CHECK(std::memcmp(waiters, savedWaiters, sizeof(waiters)) == 0);
+}
+
+template<typename TInfo, typename TQuery>
+void CheckWaitingRecordSizes(TQuery query, void* object) {
+    TInfo info;
+    UltWaitingThreadInfo waiters[4];
+    for (std::size_t invalid = 0; invalid < 4; ++invalid) {
+        for (const std::uint64_t size : {std::uint64_t{0}, std::uint64_t{63}, std::uint64_t{65}, UINT64_MAX}) {
+            std::memset(&info, 0xEE, sizeof(info));
+            std::memset(waiters, 0xAA, sizeof(waiters));
+            for (auto& waiter : waiters) waiter.size = sizeof(UltWaitingThreadInfo);
+            waiters[invalid].size = size;
+            std::uint8_t savedWaiters[sizeof(waiters)];
+            std::memcpy(savedWaiters, waiters, sizeof(waiters));
+            CHECK(query(object, &info, waiters, 4) == Invalid);
+            const auto* bytes = reinterpret_cast<const std::uint8_t*>(&info);
+            for (std::size_t index = 0; index < sizeof(info); ++index) CHECK(bytes[index] == 0xEE);
+            CHECK(std::memcmp(waiters, savedWaiters, sizeof(waiters)) == 0);
+        }
+    }
+    CHECK(query(object, &info, waiters, 0) == Ok);
+    for (auto& waiter : waiters) waiter.size = sizeof(UltWaitingThreadInfo);
+    std::uint8_t savedWaiters[sizeof(waiters)];
+    std::memcpy(savedWaiters, waiters, sizeof(waiters));
+    CHECK(query(object, &info, waiters, 4) == Ok);
+    CHECK(std::memcmp(waiters, savedWaiters, sizeof(waiters)) == 0);
+}
+
+void GetInfoTests() {
+    alignas(8) std::uint8_t dummy[512]{};
+    alignas(8) std::uint8_t poolObj[256]{};
+    alignas(8) std::uint8_t mutexObj[256]{};
+    alignas(8) std::uint8_t condObj[256]{};
+    alignas(8) std::uint8_t semObj[256]{};
+    alignas(8) std::uint8_t rwObj[256]{};
+    alignas(8) std::uint8_t dataPoolObj[512]{};
+    alignas(8) std::uint8_t queueObj[512]{};
+    alignas(8) std::uint8_t rtObj[4096]{};
+
+    UltMutexInfo mutexInfo{};
+    UltConditionVariableInfo condInfo{};
+    UltSemaphoreInfo semInfo{};
+    UltReaderWriterLockInfo rwInfo{};
+    UltWaitingQueueResourcePoolInfo poolInfo{};
+    UltQueueDataResourcePoolInfo dataPoolInfo{};
+    UltQueueInfo queueInfo{};
+    UltUlthreadRuntimeInfo rtInfo{};
+    UltUlthreadInfo threadInfo{};
+    UltWaitingThreadInfo waitThreads[4]{};
+    for (auto& waiter : waitThreads) waiter.size = sizeof(UltWaitingThreadInfo);
+
+    CHECK(sceUltGetMutexInfo(nullptr, nullptr, nullptr, 0) == Null);
+    CHECK(sceUltGetMutexInfo(mutexObj, nullptr, nullptr, 0) == Null);
+    CHECK(sceUltGetMutexInfo(nullptr, &mutexInfo, nullptr, 0) == Null);
+    CHECK(sceUltGetMutexInfo(mutexObj, &mutexInfo, nullptr, 1) == Null);
+    CHECK(sceUltGetConditionVariableInfo(nullptr, nullptr, nullptr, 0) == Null);
+    CHECK(sceUltGetSemaphoreInfo(nullptr, nullptr, nullptr, 0) == Null);
+    CHECK(sceUltGetReaderWriterLockInfo(nullptr, nullptr, nullptr, 0) == Null);
+    CHECK(sceUltGetQueueInfo(nullptr, nullptr, nullptr, 0) == Null);
+    CHECK(sceUltGetWaitingQueueResourcePoolInfo(nullptr, nullptr) == Null);
+    CHECK(sceUltGetQueueDataResourcePoolInfo(nullptr, nullptr) == Null);
+    CHECK(sceUltGetUlthreadInfo(nullptr, nullptr) == Null);
+    CHECK(sceUltGetUlthreadRuntimeInfo(nullptr, nullptr, nullptr, 0, nullptr, 0) == Null);
+    CHECK(sceUltGetUlthreadRuntimeInfo(nullptr, &rtInfo, nullptr, 1, nullptr, 0) == Null);
+    CHECK(sceUltGetUlthreadRuntimeInfo(nullptr, &rtInfo, nullptr, 0, nullptr, 1) == Null);
+
+    CHECK(sceUltGetMutexInfo(dummy, &mutexInfo, nullptr, 0) == State);
+    CHECK(sceUltGetConditionVariableInfo(dummy, &condInfo, nullptr, 0) == State);
+    CHECK(sceUltGetSemaphoreInfo(dummy, &semInfo, nullptr, 0) == State);
+    CHECK(sceUltGetReaderWriterLockInfo(dummy, &rwInfo, nullptr, 0) == State);
+    CHECK(sceUltGetWaitingQueueResourcePoolInfo(dummy, &poolInfo) == State);
+    CHECK(sceUltGetQueueDataResourcePoolInfo(dummy, &dataPoolInfo) == State);
+    CHECK(sceUltGetQueueInfo(dummy, &queueInfo, nullptr, 0) == State);
+    CHECK(sceUltGetUlthreadInfo(dummy, &threadInfo) == State);
+    CHECK(sceUltGetUlthreadRuntimeInfo(dummy, &rtInfo, nullptr, 0, nullptr, 0) == State);
+
+    CHECK(sceUltWaitingQueueResourcePoolCreate(poolObj, "test-pool", 4, 4, nullptr, nullptr, 0) == Ok);
+    CHECK(sceUltGetWaitingQueueResourcePoolInfo(poolObj, &poolInfo) == Ok);
+    CHECK(poolInfo.size == sizeof(UltWaitingQueueResourcePoolInfo));
+    CHECK(poolInfo.object == poolObj);
+    CHECK(std::strcmp(poolInfo.name, "test-pool") == 0);
+    CHECK(poolInfo.maxThreads == 4);
+    CHECK(poolInfo.maxSyncObjects == 4);
+
+    CHECK(sceUltMutexCreate(mutexObj, "test-mutex", poolObj, nullptr, 0) == Ok);
+    CHECK(sceUltGetMutexInfo(mutexObj, &mutexInfo, waitThreads, 4) == Ok);
+    CHECK(mutexInfo.size == sizeof(UltMutexInfo));
+    CHECK(mutexInfo.object == mutexObj);
+    CHECK(std::strcmp(mutexInfo.name, "test-mutex") == 0);
+    CHECK(mutexInfo.waitingQueuePool == poolObj);
+    CHECK(mutexInfo.lockCount == 0);
+    CHECK(mutexInfo.waitingThreads == 0);
+    CHECK(mutexInfo.owner == nullptr && mutexInfo.ownerType == 0);
+    CheckWaitingRecordSizes<UltMutexInfo>(sceUltGetMutexInfo, mutexObj);
+
+    CHECK(sceUltMutexLock(mutexObj) == Ok);
+    CHECK(sceUltGetMutexInfo(mutexObj, &mutexInfo, nullptr, 0) == Ok);
+    CHECK(mutexInfo.lockCount == 0);
+    const auto owner = CurrentThreadId();
+    CHECK(owner != nullptr && mutexInfo.owner == owner && mutexInfo.ownerType == 1);
+    std::thread([&] {
+        CHECK(CurrentThreadId() != owner);
+        UltMutexInfo held{};
+        CHECK(sceUltGetMutexInfo(mutexObj, &held, nullptr, 0) == Ok);
+        CHECK(held.owner == owner && held.ownerType == 1 && held.lockCount == 0);
+    }).join();
+    CHECK(sceUltMutexUnlock(mutexObj) == Ok);
+    CHECK(sceUltGetMutexInfo(mutexObj, &mutexInfo, nullptr, 0) == Ok);
+    CHECK(mutexInfo.owner == nullptr && mutexInfo.ownerType == 0 && mutexInfo.lockCount == 0);
+
+    Object recursiveMutex{};
+    UltMutexOptParam recursiveOptions{};
+    recursiveOptions.attribute = 1;
+    CHECK(sceUltMutexCreate(&recursiveMutex, "recursive-info", poolObj, &recursiveOptions, 0) == Ok);
+    CHECK(sceUltMutexLock(&recursiveMutex) == Ok);
+    CheckUnsupportedInfo<UltMutexInfo>(sceUltGetMutexInfo, &recursiveMutex, 0);
+    CHECK(sceUltMutexUnlock(&recursiveMutex) == Ok);
+    CHECK(sceUltMutexDestroy(&recursiveMutex) == Ok);
+
+    CHECK(sceUltConditionVariableCreate(condObj, "test-cnd", mutexObj, nullptr, 0) == Ok);
+    CHECK(sceUltGetConditionVariableInfo(condObj, &condInfo, waitThreads, 4) == Ok);
+    CHECK(condInfo.size == sizeof(UltConditionVariableInfo));
+    CHECK(condInfo.object == condObj);
+    CHECK(condInfo.mutex == mutexObj);
+    CHECK(std::strcmp(condInfo.name, "test-cnd") == 0);
+    CHECK(condInfo.waitingThreads == 0);
+
+    CHECK(sceUltSemaphoreCreate(semObj, "test-sem", 3, poolObj, nullptr, 0) == Ok);
+    CHECK(sceUltGetSemaphoreInfo(semObj, &semInfo, waitThreads, 4) == Ok);
+    CHECK(semInfo.size == sizeof(UltSemaphoreInfo));
+    CHECK(semInfo.object == semObj);
+    CHECK(std::strcmp(semInfo.name, "test-sem") == 0);
+    CHECK(semInfo.waitingQueuePool == poolObj);
+    CHECK(semInfo.resources == 3);
+
+    CHECK(sceUltReaderWriterLockCreate(rwObj, "test-rw", poolObj, nullptr, 0) == Ok);
+    CHECK(sceUltGetReaderWriterLockInfo(rwObj, &rwInfo, waitThreads, 4) == Ok);
+    CHECK(rwInfo.size == sizeof(UltReaderWriterLockInfo));
+    CHECK(rwInfo.object == rwObj);
+    CHECK(std::strcmp(rwInfo.name, "test-rw") == 0);
+    CHECK(rwInfo.waitingQueuePool == poolObj);
+    CHECK(rwInfo.readers == 0);
+    CHECK(rwInfo.lockType == 0);
+    CHECK(rwInfo.owner == nullptr && rwInfo.ownerType == 0);
+    CheckWaitingRecordSizes<UltReaderWriterLockInfo>(sceUltGetReaderWriterLockInfo, rwObj);
+
+    CHECK(sceUltReaderWriterLockLockRead(rwObj) == Ok);
+    CHECK(sceUltGetReaderWriterLockInfo(rwObj, &rwInfo, nullptr, 0) == Ok);
+    CHECK(rwInfo.readers == 1);
+    CHECK(rwInfo.lockType == 1);
+    CHECK(rwInfo.owner == nullptr && rwInfo.ownerType == 0);
+    CHECK(sceUltReaderWriterLockLockRead(rwObj) == Ok);
+    CHECK(sceUltGetReaderWriterLockInfo(rwObj, &rwInfo, nullptr, 0) == Ok);
+    CHECK(rwInfo.lockType == 1 && rwInfo.readers == 2 && rwInfo.owner == nullptr && rwInfo.ownerType == 0);
+    CHECK(sceUltReaderWriterLockUnlockRead(rwObj) == Ok);
+    CHECK(sceUltReaderWriterLockUnlockRead(rwObj) == Ok);
+    CHECK(sceUltGetReaderWriterLockInfo(rwObj, &rwInfo, nullptr, 0) == Ok);
+    CHECK(rwInfo.lockType == 0 && rwInfo.readers == 0 && rwInfo.owner == nullptr && rwInfo.ownerType == 0);
+    for (const auto writeLock : {sceUltReaderWriterLockLockWrite, sceUltReaderWriterLockTryLockWrite}) {
+        CHECK(writeLock(rwObj) == Ok);
+        std::thread([&] {
+            UltReaderWriterLockInfo held{};
+            CHECK(sceUltGetReaderWriterLockInfo(rwObj, &held, nullptr, 0) == Ok);
+            CHECK(held.lockType == 2 && held.readers == 0 && held.owner == owner && held.ownerType == 1);
+        }).join();
+        CHECK(sceUltReaderWriterLockUnlockWrite(rwObj) == Ok);
+        CHECK(sceUltGetReaderWriterLockInfo(rwObj, &rwInfo, nullptr, 0) == Ok);
+        CHECK(rwInfo.lockType == 0 && rwInfo.owner == nullptr && rwInfo.ownerType == 0);
+    }
+
+    CHECK(sceUltQueueDataResourcePoolCreate(dataPoolObj, "test-datapool", 8, 64, 2, poolObj, nullptr, nullptr, 0) == Ok);
+    CHECK(sceUltGetQueueDataResourcePoolInfo(dataPoolObj, &dataPoolInfo) == Ok);
+    CHECK(dataPoolInfo.size == sizeof(UltQueueDataResourcePoolInfo));
+    CHECK(dataPoolInfo.object == dataPoolObj);
+    CHECK(std::strcmp(dataPoolInfo.name, "test-datapool") == 0);
+    CHECK(dataPoolInfo.waitingQueuePool == poolObj);
+    CHECK(dataPoolInfo.dataSize == 64);
+    CHECK(dataPoolInfo.maxItems == 8);
+    CHECK(dataPoolInfo.availableItems == 8);
+    CHECK(dataPoolInfo.maxQueues == 2);
+
+    CHECK(sceUltQueueCreate(queueObj, "test-queue", 64, poolObj, dataPoolObj, nullptr, 0) == Ok);
+    CHECK(sceUltGetQueueInfo(queueObj, &queueInfo, waitThreads, 4) == Ok);
+    CHECK(queueInfo.size == sizeof(UltQueueInfo));
+    CHECK(queueInfo.object == queueObj);
+    CHECK(std::strcmp(queueInfo.name, "test-queue") == 0);
+    CHECK(queueInfo.waitingQueuePool == poolObj);
+    CHECK(queueInfo.dataPool == dataPoolObj);
+    CHECK(queueInfo.dataSize == 64);
+    CHECK(queueInfo.queuedItems == 0);
+
+    std::uint8_t itemData[64]{0x42};
+    CHECK(sceUltQueuePush(queueObj, itemData) == Ok);
+    CHECK(sceUltGetQueueInfo(queueObj, &queueInfo, nullptr, 0) == Ok);
+    CHECK(queueInfo.queuedItems == 1);
+    CHECK(sceUltQueuePop(queueObj, itemData) == Ok);
+    CHECK(sceUltGetQueueInfo(queueObj, &queueInfo, nullptr, 0) == Ok);
+    CHECK(queueInfo.queuedItems == 0);
+
+    CHECK(sceUltUlthreadRuntimeCreate(rtObj, "test-rt", 2, 1, nullptr, nullptr, 0) == Ok);
+    void* activeThreads[4]{};
+    CHECK(sceUltGetUlthreadRuntimeInfo(rtObj, &rtInfo, activeThreads, 4, nullptr, 0) == Ok);
+    CHECK(rtInfo.size == sizeof(UltUlthreadRuntimeInfo));
+    CHECK(rtInfo.object == rtObj);
+    CHECK(std::strcmp(rtInfo.name, "test-rt") == 0);
+    CHECK(rtInfo.maxUlthreads == 2);
+    CHECK(rtInfo.workerThreads == 1);
+    CHECK(rtInfo.activeUlthreads == 0);
+
+    Pthread workerHandles[2]{};
+    bool workerQueryThrew = false;
+    try {
+        sceUltGetUlthreadRuntimeInfo(rtObj, &rtInfo, nullptr, 0, workerHandles, 2);
+    } catch (const std::runtime_error&) {
+        workerQueryThrew = true;
+    }
+    CHECK(workerQueryThrew);
+
+    UltUlthreadRuntimeInfo untouchedInfo{};
+    std::memset(&untouchedInfo, 0xEE, sizeof(untouchedInfo));
+    CHECK(sceUltGetUlthreadRuntimeInfo(rtObj, &untouchedInfo, nullptr, 0, nullptr, 1) == Null);
+    const auto* infoBytes = reinterpret_cast<const std::uint8_t*>(&untouchedInfo);
+    for (std::size_t i = 0; i < sizeof(untouchedInfo); ++i) {
+        CHECK(infoBytes[i] == 0xEE);
+    }
+
+    CHECK(sceUltConditionVariableDestroy(condObj) == Ok);
+    CHECK(sceUltMutexDestroy(mutexObj) == Ok);
+    CHECK(sceUltSemaphoreDestroy(semObj) == Ok);
+    CHECK(sceUltReaderWriterLockDestroy(rwObj) == Ok);
+    CHECK(sceUltQueueDestroy(queueObj) == Ok);
+    CHECK(sceUltQueueDataResourcePoolDestroy(dataPoolObj) == Ok);
+    CHECK(sceUltWaitingQueueResourcePoolDestroy(poolObj) == Ok);
+    CHECK(sceUltUlthreadRuntimeDestroy(rtObj) == Ok);
+}
+
+void WaitForQueueWaiters(std::uint8_t* queue, UltQueueInfo* info, std::uint32_t pushers, std::uint32_t poppers) {
+    for (int attempt = 0; attempt < 4000; ++attempt) {
+        CHECK(sceUltGetQueueInfo(queue, info, nullptr, 0) == Ok);
+        if (info->waitingPushers == pushers && info->waitingPoppers == poppers) return;
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    CHECK(false);
+}
+
+void QueueWaiters() {
+    alignas(8) std::uint8_t poolObj[256]{};
+    alignas(8) std::uint8_t dataPoolObj[512]{};
+    alignas(8) std::uint8_t queueObj[512]{};
+    UltQueueInfo info{};
+    UltWaitingThreadInfo waiters[4]{};
+
+    CHECK(sceUltWaitingQueueResourcePoolCreate(poolObj, "waiter-pool", 4, 4, nullptr, nullptr, 0) == Ok);
+    CHECK(sceUltQueueDataResourcePoolCreate(dataPoolObj, "waiter-data", 2, 64, 1, poolObj, nullptr, nullptr, 0) == Ok);
+    CHECK(sceUltQueueCreate(queueObj, "waiter-queue", 64, poolObj, dataPoolObj, nullptr, 0) == Ok);
+
+    std::uint8_t item[64]{0x11};
+    std::uint8_t popped[64]{};
+
+    std::atomic<int> popResult{1};
+    std::thread popper([&] { popResult.store(sceUltQueuePop(queueObj, popped)); });
+    WaitForQueueWaiters(queueObj, &info, 0, 1);
+    CHECK(info.queuedItems == 0);
+    std::memset(waiters, 0xAA, sizeof(waiters));
+    CheckUnsupportedInfo<UltQueueInfo>(sceUltGetQueueInfo, queueObj, 1);
+    CheckUnsupportedInfo<UltQueueInfo>(sceUltGetQueueInfo, queueObj);
+    CHECK(sceUltGetQueueInfo(queueObj, &info, waiters, 0) == Ok);
+    const auto* waiterBytes = reinterpret_cast<const std::uint8_t*>(waiters);
+    for (std::size_t index = 0; index < sizeof(waiters); ++index) CHECK(waiterBytes[index] == 0xAA);
+    CHECK(sceUltQueueDestroy(queueObj) == State);
+    CHECK(sceUltQueuePush(queueObj, item) == Ok);
+    popper.join();
+    CHECK(popResult.load() == Ok);
+    CHECK(popped[0] == 0x11);
+    WaitForQueueWaiters(queueObj, &info, 0, 0);
+
+    CHECK(sceUltQueuePush(queueObj, item) == Ok);
+    CHECK(sceUltQueuePush(queueObj, item) == Ok);
+
+    std::atomic<int> pushResult{1};
+    std::thread pusher([&] { pushResult.store(sceUltQueuePush(queueObj, item)); });
+    WaitForQueueWaiters(queueObj, &info, 1, 0);
+    CHECK(info.queuedItems == 2);
+    CheckUnsupportedInfo<UltQueueInfo>(sceUltGetQueueInfo, queueObj, 1);
+    CheckUnsupportedInfo<UltQueueInfo>(sceUltGetQueueInfo, queueObj);
+    CHECK(sceUltGetQueueInfo(queueObj, &info, waiters, 0) == Ok);
+    CHECK(info.waitingPushers == 1);
+    CHECK(info.waitingPoppers == 0);
+    CHECK(sceUltQueuePop(queueObj, popped) == Ok);
+    pusher.join();
+    CHECK(pushResult.load() == Ok);
+    WaitForQueueWaiters(queueObj, &info, 0, 0);
+    CHECK(info.queuedItems == 2);
+
+    CHECK(sceUltQueuePop(queueObj, popped) == Ok);
+    CHECK(sceUltQueuePop(queueObj, popped) == Ok);
+    CHECK(sceUltQueueDestroy(queueObj) == Ok);
+    CHECK(sceUltQueueDataResourcePoolDestroy(dataPoolObj) == Ok);
+    CHECK(sceUltWaitingQueueResourcePoolDestroy(poolObj) == Ok);
+}
+
+template<typename TInfo, typename TQuery>
+void WaitForInfoWaiters(TQuery query, void* object) {
+    for (int attempt = 0; attempt < 4000; ++attempt) {
+        TInfo info{};
+        CHECK(query(object, &info, nullptr, 0) == Ok);
+        if (info.waitingThreads == 1) return;
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    CHECK(false);
+}
+
+void InfoWaiters() {
+    Object pool{};
+    Object mutex{};
+    Object condition{};
+    Object semaphore{};
+    Object rwlock{};
+    CHECK(sceUltWaitingQueueResourcePoolCreate(&pool, "info-pool", 4, 4, nullptr, nullptr, 0) == Ok);
+    CHECK(sceUltMutexCreate(&mutex, "info-mutex", &pool, nullptr, 0) == Ok);
+    CHECK(sceUltConditionVariableCreate(&condition, "info-condition", &mutex, nullptr, 0) == Ok);
+    CHECK(sceUltSemaphoreCreate(&semaphore, "info-semaphore", 0, &pool, nullptr, 0) == Ok);
+    CHECK(sceUltReaderWriterLockCreate(&rwlock, "info-rwlock", &pool, nullptr, 0) == Ok);
+
+    CHECK(sceUltMutexLock(&mutex) == Ok);
+    std::thread mutexWaiter([&] {
+        CHECK(sceUltMutexLock(&mutex) == Ok);
+        CHECK(sceUltMutexUnlock(&mutex) == Ok);
+    });
+    WaitForInfoWaiters<UltMutexInfo>(sceUltGetMutexInfo, &mutex);
+    CheckUnsupportedInfo<UltMutexInfo>(sceUltGetMutexInfo, &mutex, 1);
+    CheckUnsupportedInfo<UltMutexInfo>(sceUltGetMutexInfo, &mutex);
+    CHECK(sceUltMutexUnlock(&mutex) == Ok);
+    mutexWaiter.join();
+
+    std::thread conditionWaiter([&] {
+        CHECK(sceUltMutexLock(&mutex) == Ok);
+        CHECK(sceUltConditionVariableWait(&condition) == Ok);
+        UltMutexInfo info{};
+        CHECK(sceUltGetMutexInfo(&mutex, &info, nullptr, 0) == Ok);
+        CHECK(info.owner == CurrentThreadId() && info.ownerType == 1);
+        CHECK(sceUltMutexUnlock(&mutex) == Ok);
+    });
+    WaitForInfoWaiters<UltConditionVariableInfo>(sceUltGetConditionVariableInfo, &condition);
+    CheckUnsupportedInfo<UltConditionVariableInfo>(sceUltGetConditionVariableInfo, &condition, 1);
+    CheckUnsupportedInfo<UltConditionVariableInfo>(sceUltGetConditionVariableInfo, &condition);
+    CHECK(sceUltConditionVariableSignal(&condition) == Ok);
+    conditionWaiter.join();
+
+    std::thread semaphoreWaiter([&] { CHECK(sceUltSemaphoreAcquire(&semaphore, 1) == Ok); });
+    WaitForInfoWaiters<UltSemaphoreInfo>(sceUltGetSemaphoreInfo, &semaphore);
+    CheckUnsupportedInfo<UltSemaphoreInfo>(sceUltGetSemaphoreInfo, &semaphore, 1);
+    CheckUnsupportedInfo<UltSemaphoreInfo>(sceUltGetSemaphoreInfo, &semaphore);
+    CHECK(sceUltSemaphoreRelease(&semaphore, 1) == Ok);
+    semaphoreWaiter.join();
+
+    CHECK(sceUltReaderWriterLockLockWrite(&rwlock) == Ok);
+    std::thread reader([&] {
+        CHECK(sceUltReaderWriterLockLockRead(&rwlock) == Ok);
+        CHECK(sceUltReaderWriterLockUnlockRead(&rwlock) == Ok);
+    });
+    WaitForInfoWaiters<UltReaderWriterLockInfo>(sceUltGetReaderWriterLockInfo, &rwlock);
+    CheckUnsupportedInfo<UltReaderWriterLockInfo>(sceUltGetReaderWriterLockInfo, &rwlock, 1);
+    CheckUnsupportedInfo<UltReaderWriterLockInfo>(sceUltGetReaderWriterLockInfo, &rwlock);
+    CHECK(sceUltReaderWriterLockUnlockWrite(&rwlock) == Ok);
+    reader.join();
+
+    CHECK(sceUltReaderWriterLockDestroy(&rwlock) == Ok);
+    CHECK(sceUltSemaphoreDestroy(&semaphore) == Ok);
+    CHECK(sceUltConditionVariableDestroy(&condition) == Ok);
+    CHECK(sceUltMutexDestroy(&mutex) == Ok);
+    CHECK(sceUltWaitingQueueResourcePoolDestroy(&pool) == Ok);
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -318,6 +684,9 @@ int main(int argc, char** argv) {
     else if (std::strcmp(argv[1], "rwlock-pool") == 0) ReaderWriterPool();
     else if (std::strcmp(argv[1], "rwlock-finalize") == 0) ReaderWriterFinalize();
     else if (std::strcmp(argv[1], "ulthreads") == 0) Ulthreads();
+    else if (std::strcmp(argv[1], "get-info") == 0) GetInfoTests();
+    else if (std::strcmp(argv[1], "queue-waiters") == 0) QueueWaiters();
+    else if (std::strcmp(argv[1], "info-waiters") == 0) InfoWaiters();
     else return 2;
     CHECK(sceUltFinalize() == Ok);
     std::puts("ULT sync tests passed");
diff --git a/core/libs/tests/GuestUltThread.cpp b/core/libs/tests/GuestUltThread.cpp
index 32b8be2972..23b0e358fb 100644
--- a/core/libs/tests/GuestUltThread.cpp
+++ b/core/libs/tests/GuestUltThread.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdio>
@@ -11,41 +12,6 @@
 struct UltConditionVariableInfo;
 struct UltWaitingThreadInfo;
 
-extern "C" {
-int APS5_VABI sceUltInitialize();
-int APS5_VABI sceUltFinalize();
-std::uint64_t APS5_VABI sceUltUlthreadRuntimeGetWorkAreaSize(std::uint32_t, std::uint32_t);
-int APS5_VABI sceUltUlthreadRuntimeCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadCreate(void*, const char*, UltUlthreadEntry, std::uint64_t, void*, std::uint64_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadTryJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadRuntimeDestroy(void*);
-int APS5_VABI _sceUltUlthreadRuntimeOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI _sceUltUlthreadRuntimeCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*);
-int APS5_VABI _sceUltUlthreadCreate(void*, const char*, UltUlthreadEntry, std::uint64_t, void*, std::uint64_t, void*, const void*);
-int APS5_VABI _sceUltWaitingQueueResourcePoolCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*);
-int APS5_VABI _sceUltSemaphoreCreate(void*, const char*, std::uint32_t, void*, const void*);
-int APS5_VABI sceUltSemaphoreTryAcquire(void*, std::int32_t);
-int APS5_VABI sceUltSemaphoreAcquire(void*, std::int32_t);
-int APS5_VABI sceUltSemaphoreRelease(void*, std::int32_t);
-int APS5_VABI _sceUltMutexOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI _sceUltMutexCreate(void*, const char*, void*, const void*);
-int APS5_VABI sceUltMutexLock(void*);
-int APS5_VABI sceUltMutexUnlock(void*);
-int APS5_VABI _sceUltQueueDataResourcePoolCreate(void*, const char*, std::uint32_t, std::uint64_t, std::uint32_t, void*, void*, const void*);
-int APS5_VABI _sceUltQueueCreate(void*, const char*, std::uint64_t, void*, void*, const void*);
-int APS5_VABI sceUltQueuePush(void*, const void*);
-int APS5_VABI sceUltQueuePop(void*, void*);
-int APS5_VABI sceUltMutexDestroy(void*);
-int APS5_VABI sceUltWaitingQueueResourcePoolDestroy(void*);
-int APS5_VABI sceUltSemaphoreDestroy(void*);
-int APS5_VABI sceUltQueueDestroy(void*);
-int APS5_VABI sceUltQueueDataResourcePoolDestroy(void*);
-int APS5_VABI sceUltConditionVariableDestroy(void*);
-int APS5_VABI sceUltReaderWriterLockDestroy(void*);
-int APS5_VABI sceUltGetConditionVariableInfo(void*, UltConditionVariableInfo*, UltWaitingThreadInfo*, std::uint32_t);
-}
-
 static constexpr int Ok = 0;
 static constexpr int Null = -2139029503;
 static constexpr int Alignment = -2139029502;
@@ -120,13 +86,7 @@ static void Validation() {
     CHECK(sceUltUlthreadRuntimeGetWorkAreaSize(1, 1) == 1184);
     CHECK(sceUltConditionVariableDestroy(nullptr) == -2139029503);
     CHECK(sceUltReaderWriterLockDestroy(nullptr) == Null);
-    bool threwInfo = false;
-    try {
-        sceUltGetConditionVariableInfo(nullptr, nullptr, nullptr, 0);
-    } catch (const std::runtime_error&) {
-        threwInfo = true;
-    }
-    CHECK(threwInfo);
+    CHECK(sceUltGetConditionVariableInfo(nullptr, nullptr, nullptr, 0) == Null);
 }
 
 static void TryJoin() {
@@ -139,7 +99,7 @@ static void TryJoin() {
     std::uint8_t optParam[128];
     std::memset(optParam, 0xff, sizeof(optParam));
     CHECK(_sceUltUlthreadRuntimeOptParamInitialize(nullptr, 0) == Null);
-    CHECK(_sceUltUlthreadRuntimeOptParamInitialize(optParam, 0) == Ok && optParam[0] == 0);
+    CHECK(_sceUltUlthreadRuntimeOptParamInitialize(reinterpret_cast<UltUlthreadRuntimeOptParam*>(optParam), 0) == Ok && optParam[0] == 0);
     CHECK(_sceUltUlthreadRuntimeCreate(&runtime, "runtime", 1, 1, nullptr, nullptr) == Ok);
     CHECK(_sceUltUlthreadCreate(&thread, "parked", Parked, 0x3C, nullptr, 0, &runtime, nullptr) == Ok);
     while (!gStarted.load(std::memory_order_acquire)) std::this_thread::yield();
@@ -217,29 +177,29 @@ static void UnderscoredCreate() {
     alignas(8) static std::uint8_t mutex[256];
     std::memset(mutexOptParam, 0xFF, sizeof(mutexOptParam));
     CHECK(_sceUltMutexOptParamInitialize(nullptr, 0) == Null);
-    CHECK(_sceUltMutexOptParamInitialize(mutexOptParam + 1, 0) == Alignment);
+    CHECK(_sceUltMutexOptParamInitialize(reinterpret_cast<UltMutexOptParam*>(mutexOptParam + 1), 0) == Alignment);
     CHECK(mutexOptParam[0] == 0xFF && mutexOptParam[127] == 0xFF);
-    CHECK(_sceUltMutexOptParamInitialize(mutexOptParam, 0x12345678) == Ok);
+    CHECK(_sceUltMutexOptParamInitialize(reinterpret_cast<UltMutexOptParam*>(mutexOptParam), 0x12345678) == Ok);
     UltMutexOptParam options{};
     std::memcpy(&options, mutexOptParam, sizeof(options));
     CHECK(options.header[0] == 0x6C696275 && options.header[1] == 0x6C746D61 && options.header[2] == 0x67696300);
     CHECK(options.buildVersion == 0x12345678 && options.attribute == 0);
     for (std::size_t index = 16; index < 128; ++index) CHECK(mutexOptParam[index] == 0);
     for (std::size_t index = 128; index < sizeof(mutexOptParam); ++index) CHECK(mutexOptParam[index] == 0xFF);
-    CHECK(_sceUltMutexCreate(mutex, nullptr, pool, mutexOptParam) == Null);
-    CHECK(_sceUltMutexCreate(mutex, "mutex", nullptr, mutexOptParam) == Null);
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam + 1) == Alignment);
+    CHECK(_sceUltMutexCreate(mutex, nullptr, pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Null);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", nullptr, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Null);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam + 1)) == Alignment);
     mutexOptParam[127] = 1;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Invalid);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Invalid);
     mutexOptParam[127] = 0;
     mutexOptParam[16] = 2;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Invalid);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Invalid);
     mutexOptParam[16] = 0;
     mutexOptParam[0] = 0;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Invalid);
-    CHECK(_sceUltMutexOptParamInitialize(mutexOptParam, 0) == Ok);
-    CHECK(_sceUltMutexCreate(nullptr, "mutex", pool, mutexOptParam) == Null);
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Ok);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Invalid);
+    CHECK(_sceUltMutexOptParamInitialize(reinterpret_cast<UltMutexOptParam*>(mutexOptParam), 0) == Ok);
+    CHECK(_sceUltMutexCreate(nullptr, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Null);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Ok);
     CHECK(sceUltMutexLock(mutex) == Ok);
     CHECK(sceUltMutexLock(mutex) == State);
     std::thread foreignUnlock([&] { CHECK(sceUltMutexUnlock(mutex) == Permission); });
@@ -248,7 +208,7 @@ static void UnderscoredCreate() {
     CHECK(sceUltMutexUnlock(mutex) == Permission);
     CHECK(sceUltMutexDestroy(mutex) == Ok);
     mutexOptParam[16] = 1;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Ok);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Ok);
     CHECK(sceUltMutexLock(mutex) == Ok);
     CHECK(sceUltMutexLock(mutex) == Ok);
     CHECK(sceUltMutexUnlock(mutex) == Ok);
diff --git a/core/libs/tests/GuestUmtxOp.cpp b/core/libs/tests/GuestUmtxOp.cpp
index 97eef1d837..ee4befc68f 100644
--- a/core/libs/tests/GuestUmtxOp.cpp
+++ b/core/libs/tests/GuestUmtxOp.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -8,12 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI _umtx_op_nid_postfix(void* object, int operation, std::uint64_t value, void* sizeArgument, void* timeArgument);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-}
-
 static constexpr int UMTX_OP_WAIT = 2;
 static constexpr int UMTX_OP_WAKE = 3;
 static constexpr int UMTX_OP_MUTEX_LOCK = 5;
diff --git a/core/libs/tests/GuestUnderflowError.cpp b/core/libs/tests/GuestUnderflowError.cpp
new file mode 100644
index 0000000000..b1bfda125c
--- /dev/null
+++ b/core/libs/tests/GuestUnderflowError.cpp
@@ -0,0 +1,36 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdlib>
+#include <cstring>
+
+struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
+struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const void* what; };
+
+extern "C" {
+extern const TypeRecord _ZTISt13runtime_error_nid_postfix;
+extern const TypeRecord _ZTISt15underflow_error_nid_postfix;
+extern const Vtable _ZTVSt13runtime_error_nid_postfix;
+extern const Vtable _ZTVSt15underflow_error_nid_postfix;
+}
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+int main() {
+    const auto& type = _ZTISt15underflow_error_nid_postfix;
+    const auto& runtimeType = _ZTISt13runtime_error_nid_postfix;
+    Require(std::strcmp(type.name, "St15underflow_error") == 0);
+    Require(type.base == &runtimeType && type.vtable == runtimeType.vtable);
+    const auto& table = _ZTVSt15underflow_error_nid_postfix;
+    const auto& runtimeTable = _ZTVSt13runtime_error_nid_postfix;
+    Require(table.offset == 0 && table.type == &type);
+    Require(table.destroy == runtimeTable.destroy && table.deleteObject == runtimeTable.deleteObject && table.what == runtimeTable.what);
+    LibcException::ExceptionObject object{};
+    _ZNSt13runtime_errorC1EPKc_nid_postfix(&object, "value too small");
+    Require(object.message != nullptr && std::strcmp(object.message, "value too small") == 0);
+    _ZNSt15underflow_errorD1Ev_nid_postfix(&object);
+    Require(object.message == nullptr);
+    _ZNSt15underflow_errorD1Ev_nid_postfix(&object);
+    Require(object.message == nullptr);
+    return 0;
+}
diff --git a/core/libs/tests/GuestUnderscoreEntries.cpp b/core/libs/tests/GuestUnderscoreEntries.cpp
index edb44de05b..6d62580b8f 100644
--- a/core/libs/tests/GuestUnderscoreEntries.cpp
+++ b/core/libs/tests/GuestUnderscoreEntries.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <algorithm>
@@ -13,56 +16,9 @@
 #include <set>
 #include <string>
 
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-struct GuestSigaction {
-    std::uintptr_t handler;
-    int flags;
-    GuestSignalSet mask;
-};
 static_assert(sizeof(GuestSigaction) == 32);
-struct Iovec {
-    void* base;
-    std::uint64_t length;
-};
-struct Msghdr {
-    void* name;
-    std::uint32_t nameLength;
-    Iovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-static_assert(sizeof(Msghdr) == 48);
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI _bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI _listen_nid_postfix(int, int);
-int APS5_VABI _accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI _connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI _getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI _getpeername_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI _setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI _getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI _sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI _recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI _sendmsg_nid_postfix(int, const Msghdr*, int);
-std::int64_t APS5_VABI _recvmsg_nid_postfix(int, Msghdr*, int);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI getdirentries_nid_postfix(int, char*, int, std::int64_t*);
-int APS5_VABI _getdirentries_nid_postfix(int, char*, int, std::int64_t*);
-int APS5_VABI raise_nid_postfix(int);
-int APS5_VABI sigprocmask_nid_postfix(int, const void*, void*);
-int APS5_VABI _sigaction_nid_postfix(int, const GuestSigaction*, GuestSigaction*);
-int APS5_VABI _sigsuspend_nid_postfix(const GuestSignalSet*);
-}
+static_assert(sizeof(GuestMsghdr) == 48);
 
 static void Check(bool value, int line) {
     if (!value) {
@@ -77,7 +33,7 @@ constexpr int Stream = 1;
 constexpr int Datagram = 2;
 constexpr int TcpLevel = 6;
 constexpr int TcpNoDelay = 1;
-constexpr int TcpMaximumSegment = 2;
+constexpr int UnknownTcpOption = 0x7777;
 constexpr int OutOfBand = 0x1;
 constexpr int Truncated = 0x10;
 constexpr int Interrupted = 4;
@@ -134,7 +90,7 @@ static void StreamSockets() {
     Require(_setsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &enabled, sizeof(enabled)) == 0);
     valueSize = sizeof(value);
     Require(_getsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &value, &valueSize) == 0 && value == 4 && valueSize == sizeof(value));
-    Require(Fails(_setsockopt_nid_postfix(client, TcpLevel, TcpMaximumSegment, &enabled, sizeof(enabled)), NoProtocolOption));
+    Require(Fails(_setsockopt_nid_postfix(client, TcpLevel, UnknownTcpOption, &enabled, sizeof(enabled)), NoProtocolOption));
 
     const char text[] = "underscore stream";
     Require(_sendto_nid_postfix(client, text, sizeof(text), 0, nullptr, 0) == sizeof(text));
@@ -183,21 +139,21 @@ static void DatagramSockets() {
 
     char head[] = "scatter ";
     char tail[] = "gather";
-    Iovec parts[2]{{head, 8}, {tail, 6}};
-    Msghdr outgoing{destination.data(), static_cast<std::uint32_t>(destination.size()), parts, 2, nullptr, 0, 0};
+    KernelIovec parts[2]{{head, 8}, {tail, 6}};
+    GuestMsghdr outgoing{destination.data(), static_cast<std::uint32_t>(destination.size()), parts, 2, nullptr, 0, 0};
     Require(_sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
     char first[4]{};
     char second[16]{};
-    Iovec pieces[2]{{first, sizeof(first)}, {second, sizeof(second)}};
+    KernelIovec pieces[2]{{first, sizeof(first)}, {second, sizeof(second)}};
     source.fill(0);
-    Msghdr incoming{source.data(), static_cast<std::uint32_t>(source.size()), pieces, 2, nullptr, 0, -1};
+    GuestMsghdr incoming{source.data(), static_cast<std::uint32_t>(source.size()), pieces, 2, nullptr, 0, -1};
     Require(_recvmsg_nid_postfix(receiver, &incoming, 0) == 14);
     Require(std::memcmp(first, "scat", 4) == 0 && std::memcmp(second, "ter gather", 10) == 0);
     Require(incoming.flags == 0 && incoming.nameLength == 16 && source[2] == senderName[2] && source[3] == senderName[3] && source[4] == 127);
     Require(_sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
     char shortBuffer[5]{};
-    Iovec single{shortBuffer, sizeof(shortBuffer)};
-    Msghdr truncated{nullptr, 0, &single, 1, nullptr, 0, 0};
+    KernelIovec single{shortBuffer, sizeof(shortBuffer)};
+    GuestMsghdr truncated{nullptr, 0, &single, 1, nullptr, 0, 0};
     Require(_recvmsg_nid_postfix(receiver, &truncated, 0) == 5 && std::memcmp(shortBuffer, "scatt", 5) == 0 && truncated.flags == Truncated);
     Require(Fails(_sendmsg_nid_postfix(sender, nullptr, 0), BadAddress));
     Require(Fails(_recvmsg_nid_postfix(receiver, nullptr, 0), BadAddress));
diff --git a/core/libs/tests/GuestUnwindModuleInfo.cpp b/core/libs/tests/GuestUnwindModuleInfo.cpp
index d0519e368b..d863dcfea1 100644
--- a/core/libs/tests/GuestUnwindModuleInfo.cpp
+++ b/core/libs/tests/GuestUnwindModuleInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "tests/GuestUnwindModuleInfoFixture.hpp"
 #include <cstdint>
@@ -9,17 +10,13 @@
 #include <windows.h>
 #include <psapi.h>
 
-extern "C" int APS5_VABI sceKernelGetModuleInfoForUnwind(uint64_t addr, int flags, ModuleInfoForUnwind* info);
-extern "C" void* APS5_VABI dlopen_nid_postfix(const char*, int);
-extern "C" void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-extern "C" int APS5_VABI dlclose_nid_postfix(void*);
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool Throws(std::uint64_t address) {
     ModuleInfoForUnwind info{};
     try {
         sceKernelGetModuleInfoForUnwind(address, 0, &info);
+
     } catch (const std::runtime_error&) {
         return true;
     }
diff --git a/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp b/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp
index 222fa17660..da327fc32d 100644
--- a/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp
+++ b/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstdint>
@@ -5,8 +6,6 @@
 #include <stdexcept>
 #include <string_view>
 
-extern "C" int APS5_VABI sceKernelGetModuleInfoForUnwind(std::uint64_t address, int flags, ModuleInfoForUnwind* info);
-
 static std::uint64_t expectedAddress = 0;
 static int calls = 0;
 
@@ -16,7 +15,7 @@ static void Require(bool value, const char* message) {
 
 extern "C" int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info) {
     Require(address == expectedAddress, "module lookup received the wrong address");
-    Require(flags == 2, "module lookup received the wrong flags");
+    Require(flags == 1, "module lookup received the wrong flags");
     Require(info != nullptr && info->st_size == sizeof(ModuleInfoEx), "module lookup received the wrong structure size");
     ++calls;
     return SCE_KERNEL_ERROR_ESRCH;
@@ -29,6 +28,7 @@ int main() {
         bool threw = false;
         try {
             sceKernelGetModuleInfoForUnwind(expectedAddress, 1, &info);
+
         } catch (const std::runtime_error& error) {
             threw = std::string_view(error.what()) == "sceKernelGetModuleInfoForUnwind: failed to query guest module information";
         }
diff --git a/core/libs/tests/GuestUnwindModuleInfoLinux.cpp b/core/libs/tests/GuestUnwindModuleInfoLinux.cpp
index c7c126b26d..22aae73eb4 100644
--- a/core/libs/tests/GuestUnwindModuleInfoLinux.cpp
+++ b/core/libs/tests/GuestUnwindModuleInfoLinux.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,13 +6,6 @@
 #include <link.h>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceKernelGetModuleInfoForUnwind(uint64_t addr, int flags, ModuleInfoForUnwind* info);
-void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
-void* APS5_VABI dlsym_nid_postfix(void* handle, const char* name);
-int APS5_VABI dlclose_nid_postfix(void* handle);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) throw std::runtime_error(message);
 }
diff --git a/core/libs/tests/GuestUpdateEnv.cpp b/core/libs/tests/GuestUpdateEnv.cpp
new file mode 100644
index 0000000000..5de6f53321
--- /dev/null
+++ b/core/libs/tests/GuestUpdateEnv.cpp
@@ -0,0 +1,275 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <barrier>
+#include <csignal>
+#include <stdexcept>
+#include <thread>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <xmmintrin.h>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+struct Environment {
+    std::array<std::uint32_t,7> x87;
+    std::uint32_t mxcsr;
+};
+static_assert(sizeof(Environment)==32 && offsetof(Environment,mxcsr)==28);
+using UpdateEnvironment=int (APS5_VABI*)(const Environment*);
+
+UpdateEnvironment updateEnvironment;
+
+void Require(bool condition,const char* message) {
+    if(!condition) { std::fprintf(stderr,"feupdateenv: %s\n",message); std::exit(1); }
+}
+Environment Read() {
+    Environment result;
+    asm volatile("fnstenv %0\n\tfldcw %0" : "=m"(result.x87));
+    result.mxcsr=_mm_getcsr();
+    return result;
+}
+void Write(const Environment& value) {
+    asm volatile("fldenv %0" : : "m"(value.x87) : "st","st(1)","st(2)","st(3)","st(4)","st(5)","st(6)","st(7)");
+    _mm_setcsr(value.mxcsr);
+}
+bool Same(const Environment& a,const Environment& b){return a.x87==b.x87 && a.mxcsr==b.mxcsr;}
+void Matrix() {
+    const auto original=Read();
+    auto clean=original;
+    clean.x87[0]|=0x3f;
+    clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    unsigned cases=0;
+    for(unsigned x87=0;x87<64;++x87)
+        for(unsigned sse=0;sse<64;++sse)
+            for(unsigned pattern=0;pattern<4;++pattern)
+                for(unsigned rounding=0;rounding<16;++rounding) {
+                    auto saved=clean;
+                    constexpr unsigned precisions[]{0u,0x200u,0x300u,0u};
+                    saved.x87[0]=(saved.x87[0]&~0x300u)|precisions[pattern];
+                    saved.x87[0]=(saved.x87[0]&~0xc00u)|((rounding&3)<<10);
+                    saved.mxcsr=(saved.mxcsr&~0x6000u)|((rounding>>2)<<13);
+                    const unsigned savedX87=pattern==0?0:pattern==1?0x15:pattern==2?0x2a:0x3f;
+                    const unsigned savedSse=pattern==0?0x3f:pattern==1?0x2a:pattern==2?0x15:0;
+                    saved.x87[1]|=savedX87;
+                    saved.mxcsr|=savedSse;
+                    Write(saved);
+                    saved=Read();
+                    auto pending=clean;
+                    pending.x87[1]|=x87;
+                    pending.mxcsr|=sse;
+                    Write(pending);
+                    const auto input=saved;
+                    *__error_nid_postfix()=123;
+                    const int result=updateEnvironment(&saved);
+                    const auto after=Read();
+                    const int error=*__error_nid_postfix();
+                    Write(clean);
+                    auto expected=input;
+                    expected.x87[1]|=x87|sse;
+                    expected.mxcsr|=x87|sse;
+                    Require(result==0 && error==123,"return/errno");
+                    Require(after.x87==expected.x87 && after.mxcsr==expected.mxcsr,"restore saved controls and raise old union in both units");
+                    Require(std::memcmp(&input,&saved,sizeof(input))==0,"input unchanged");
+                    ++cases;
+                }
+    Write(original);
+    std::printf("feupdateenv: %u flag/rounding combinations passed\n",cases);
+}
+
+void TagsAndPointers() {
+    const auto entry=Read();
+    auto clean=entry;
+    clean.x87[0]|=0x3f; clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    Write(clean);
+    const auto original=Read();
+    asm volatile("fninit\n\tfld1\n\tfldpi" : : : "st","st(1)");
+    const auto desired=Read();
+    asm volatile("fninit" : : : "st","st(1)","st(2)","st(3)","st(4)","st(5)","st(6)","st(7)");
+    const int result=updateEnvironment(&desired);
+    const auto after=Read();
+    Write(original);
+    Require(result==0 && Same(after,desired),"nonempty x87 tag/TOP and instruction pointer restored");
+    GuestFloatingPointEnvironment guestSaved;
+    Require(fegetenv_nid_postfix(&guestSaved)==0,"save using existing guest fegetenv");
+    asm volatile("fninit" : : : "st","st(1)","st(2)","st(3)","st(4)","st(5)","st(6)","st(7)");
+    Environment saved;
+    std::memcpy(&saved, &guestSaved, sizeof(saved));
+    Require(updateEnvironment(&saved)==0,"restore guest fegetenv output");
+    const auto restored=Read();
+    Write(original);
+    Require(Same(saved,restored),"guest fegetenv round trip");
+    Write(entry);
+}
+
+void BoundsAndErrors() {
+    const auto entry=Read();
+    auto clean=entry;
+    clean.x87[0]|=0x3f; clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    Write(clean);
+    const auto original=Read();
+#ifdef _WIN32
+    SYSTEM_INFO info{};
+    GetSystemInfo(&info);
+    const auto page=static_cast<std::size_t>(info.dwPageSize);
+    auto* memory=static_cast<unsigned char*>(VirtualAlloc(nullptr,2*page,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE));
+    Require(memory!=nullptr,"allocate guard pages");
+    DWORD previous;
+    Require(VirtualProtect(memory+page,page,PAGE_NOACCESS,&previous)!=0,"protect trailing page");
+#else
+    const auto page=static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+    auto* memory=static_cast<unsigned char*>(mmap(nullptr,2*page,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0));
+    Require(memory!=MAP_FAILED,"allocate guard pages");
+    Require(mprotect(memory+page,page,PROT_NONE)==0,"protect trailing page");
+#endif
+    auto* end=reinterpret_cast<Environment*>(memory+page-sizeof(Environment));
+    std::memcpy(end,&original,sizeof(original));
+#ifdef _WIN32
+    Require(VirtualProtect(memory,page,PAGE_READONLY,&previous)!=0,"input read-only");
+#else
+    Require(mprotect(memory,page,PROT_READ)==0,"input read-only");
+#endif
+    const int result=updateEnvironment(end);
+    const auto after=Read();
+    Require(result==0 && Same(after,original),"exact32-byte read at guard-page boundary");
+#ifdef _WIN32
+    Require(VirtualFree(memory,0,MEM_RELEASE)!=0,"release guard pages");
+#else
+    Require(munmap(memory,2*page)==0,"release guard pages");
+#endif
+    bool rejected=false;
+    *__error_nid_postfix()=123;
+    try { updateEnvironment(nullptr); } catch(const std::invalid_argument&) { rejected=true; }
+    Require(rejected && Same(Read(),original) && *__error_nid_postfix()==123,"null rejected without state or errno change");
+    alignas(16) std::array<std::uint32_t,128> extended;
+    asm volatile("fxsave %0" : "=m"(extended));
+    const auto supported=extended[7] ? extended[7] : 0xffbfu;
+    for(unsigned bit=0;bit<32;++bit) {
+        const auto reserved=1u<<bit;
+        if((supported&reserved)!=0) continue;
+        auto desired=original;
+        desired.x87[0]^=0xc00;
+        desired.mxcsr|=reserved;
+        rejected=false;
+        try { updateEnvironment(&desired); } catch(const std::invalid_argument&) { rejected=true; }
+        Require(rejected && Same(Read(),original) && *__error_nid_postfix()==123,"host-unsupported MXCSR rejected before x87 changes");
+    }
+    Write(entry);
+}
+
+void MasksAndThreads() {
+    const auto original=Read();
+    auto clean=original;
+    clean.x87[0]|=0x3f; clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    for(unsigned a=0;a<64;++a) for(unsigned b=0;b<64;++b) {
+        auto desired=clean;
+        desired.x87[0]=(desired.x87[0]&~0x3fu)|a;
+        desired.mxcsr=(desired.mxcsr&~(0x3fu<<7))|(b<<7);
+        Write(clean);
+        Require(updateEnvironment(&desired)==0,"independent exception masks");
+        const auto actual=Read(); Write(clean);
+        Require(Same(actual,desired),"exception masks preserved");
+    }
+    alignas(16) std::array<std::uint32_t,128> state;
+    asm volatile("fxsave %0" : "=m"(state));
+    const auto supported=state[7]?state[7]:0xffbfu;
+    for(unsigned mode:{0u,0x40u,0x8000u,0x8040u}) {
+        if(mode&~supported) continue;
+        auto desired=clean; desired.mxcsr=(desired.mxcsr&~0x8040u)|mode;
+        Require(updateEnvironment(&desired)==0,"supported DAZ/FTZ return");
+        const auto actual=Read(); Write(clean);
+        Require(Same(actual,desired),"supported DAZ/FTZ restored");
+    }
+    std::barrier ready(2);
+    auto worker=[&](unsigned rounding,unsigned flags) {
+        const auto entry=Read();
+        auto desired=clean;
+        desired.x87[0]=(desired.x87[0]&~0xc00u)|(rounding<<10);
+        desired.mxcsr=(desired.mxcsr&~0x6000u)|(rounding<<13);
+        auto pending=clean; pending.mxcsr|=flags;
+        ready.arrive_and_wait();
+        Write(pending);
+        *__error_nid_postfix()=static_cast<int>(flags);
+        const int result=updateEnvironment(&desired);
+        const int error=*__error_nid_postfix();
+        const auto after=Read();
+        ready.arrive_and_wait();
+        Write(entry);
+        desired.x87[1]|=flags; desired.mxcsr|=flags;
+        Require(result==0 && error==static_cast<int>(flags),"thread return/errno");
+        Require(Same(after,desired),"thread environment and flag union");
+    };
+    std::thread a(worker,1,4),b(worker,2,8);a.join();b.join();
+    Write(original);
+}
+volatile std::sig_atomic_t entered=0;
+#ifdef _WIN32
+unsigned expectedFlag;
+DWORD expectedException;
+LONG CALLBACK Trap(EXCEPTION_POINTERS* exception) {
+    const auto& state=exception->ContextRecord->FltSave;
+    const auto active=state.StatusWord&~state.ControlWord&0x3f;
+    const auto code=exception->ExceptionRecord->ExceptionCode;
+    const bool denormal=expectedFlag==2 && code==EXCEPTION_FLT_INVALID_OPERATION;
+    if(entered && active==expectedFlag && (code==expectedException || denormal)) std::_Exit(0);
+    return EXCEPTION_CONTINUE_SEARCH;
+}
+#else
+void Trap(int){std::_Exit(entered?0:1);}
+#endif
+void Pending(unsigned bit,unsigned source) {
+    Require(bit<6 && source<3,"trap arguments");
+#ifdef _WIN32
+    constexpr DWORD codes[]{EXCEPTION_FLT_INVALID_OPERATION,EXCEPTION_FLT_DENORMAL_OPERAND,EXCEPTION_FLT_DIVIDE_BY_ZERO,EXCEPTION_FLT_OVERFLOW,EXCEPTION_FLT_UNDERFLOW,EXCEPTION_FLT_INEXACT_RESULT};
+    expectedFlag=1u<<bit;expectedException=codes[bit];
+    Require(AddVectoredExceptionHandler(1,Trap)!=nullptr,"install trap handler");
+#else
+    Require(std::signal(SIGFPE,Trap)!=SIG_ERR,"install trap handler");
+#endif
+    auto desired=Read();
+    desired.x87[0]=(desired.x87[0]|0x3f)&~(1u<<bit);
+    desired.x87[1]&=~0xffu;
+    desired.mxcsr=(desired.mxcsr&~0x3fu)|(0x3f<<7);
+    auto pending=desired;pending.x87[0]|=0x3f;
+    if(source==0) pending.x87[1]|=1u<<bit;
+    else if(source==1) pending.mxcsr|=1u<<bit;
+    else desired.x87[1]|=1u<<bit;
+    Write(pending);
+    entered=1;
+    updateEnvironment(&desired);
+    entered=0;
+    Require(false,"enabled pending exception did not trap during feupdateenv");
+}
+
+int main(int argc,char** argv) {
+    Require(argc==2 || argc==4,"expected libc path and optional trap bit/source");
+#ifdef _WIN32
+    const auto library=LoadLibraryA(argv[1]);
+    Require(library!=nullptr,"load libc");
+    updateEnvironment=reinterpret_cast<UpdateEnvironment>(GetProcAddress(library,"feupdateenv_nid_postfix"));
+#else
+    const auto library=dlopen(argv[1],RTLD_NOW);
+    Require(library!=nullptr,"load libc");
+    updateEnvironment=reinterpret_cast<UpdateEnvironment>(dlsym(library,"feupdateenv_nid_postfix"));
+#endif
+    Require(updateEnvironment!=nullptr,"export is missing");
+    if(argc==4) Pending(static_cast<unsigned>(std::atoi(argv[2])),static_cast<unsigned>(std::atoi(argv[3])));
+    Matrix(); TagsAndPointers(); BoundsAndErrors(); MasksAndThreads();
+#ifdef _WIN32
+    Require(FreeLibrary(library)!=0,"release library lookup handle");
+#else
+    Require(dlclose(library)==0,"release library lookup handle");
+#endif
+}
diff --git a/core/libs/tests/GuestUsbStorage.cpp b/core/libs/tests/GuestUsbStorage.cpp
new file mode 100644
index 0000000000..43a173d247
--- /dev/null
+++ b/core/libs/tests/GuestUsbStorage.cpp
@@ -0,0 +1,242 @@
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string_view>
+
+namespace {
+
+int g_attr = 0;
+
+void APS5_VABI CallbackStub(const UsbStorageEvent*, void*) {}
+
+UsbStorageCallback Callback() {
+    return &CallbackStub;
+}
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "USBSTORAGE: %s\n", message);
+        std::abort();
+    }
+}
+
+void TestInitializeAndTerminate() {
+    Require(sceUsbStorageInit(nullptr) == 0, "initialize with a null attribute");
+    Require(sceUsbStorageInit(&g_attr) == 0, "initialize with an attribute");
+    Require(sceUsbStorageTerm() == 0, "terminate");
+    Require(sceUsbStorageInit(nullptr) == 0, "initialize after terminate");
+    Require(sceUsbStorageTerm() == 0, "terminate again");
+}
+
+void TestRegisterCallbacks() {
+    bool threw = false;
+    try {
+        sceUsbStorageRegisterCallback(1, Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallback not implemented";
+    }
+    Require(threw, "register callback of event type 1 did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageRegisterCallback(2, Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallback not implemented";
+    }
+    Require(threw, "register callback of event type 2 did not throw its marker");
+    Require(sceUsbStorageRegisterCallback(1, nullptr, nullptr) == UsbStorage::InvalidArgument, "register a null callback");
+    Require(sceUsbStorageRegisterCallback(0, Callback(), nullptr) == UsbStorage::InvalidArgument, "register callback of event type 0");
+    Require(sceUsbStorageRegisterCallback(3, Callback(), nullptr) == UsbStorage::InvalidArgument, "register callback of event type 3");
+    Require(sceUsbStorageRegisterCallback(-1, Callback(), nullptr) == UsbStorage::InvalidArgument, "register callback of a negative event type");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallback(1, Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallback not implemented";
+    }
+    Require(threw, "unregister callback of event type 1 did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallback(2, Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallback not implemented";
+    }
+    Require(threw, "unregister callback of event type 2 did not throw its marker");
+    Require(sceUsbStorageUnregisterCallback(1, nullptr) == UsbStorage::InvalidArgument, "unregister a null callback");
+    Require(sceUsbStorageUnregisterCallback(0, Callback()) == UsbStorage::InvalidArgument, "unregister callback of event type 0");
+}
+
+void TestMapCallbacks() {
+    bool threw = false;
+    try {
+        sceUsbStorageRegisterCallbackForMapAvailable(0, "/data", Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallbackForMapAvailable not implemented";
+    }
+    Require(threw, "register map-available callback did not throw its marker");
+    Require(sceUsbStorageRegisterCallbackForMapAvailable(0, nullptr, Callback(), nullptr) == UsbStorage::InvalidArgument, "register map-available callback with a null directory");
+    Require(sceUsbStorageRegisterCallbackForMapAvailable(0, "/data", nullptr, nullptr) == UsbStorage::InvalidArgument, "register a null map-available callback");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallbackForMapAvailable(0, "/data", Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallbackForMapAvailable not implemented";
+    }
+    Require(threw, "unregister map-available callback did not throw its marker");
+    Require(sceUsbStorageUnregisterCallbackForMapAvailable(0, nullptr, Callback()) == UsbStorage::InvalidArgument, "unregister map-available callback with a null directory");
+    Require(sceUsbStorageUnregisterCallbackForMapAvailable(0, "/data", nullptr) == UsbStorage::InvalidArgument, "unregister a null map-available callback");
+    threw = false;
+    try {
+        sceUsbStorageRegisterCallbackForMapUnavailable(0, "/data", Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallbackForMapUnavailable not implemented";
+    }
+    Require(threw, "register map-unavailable callback did not throw its marker");
+    Require(sceUsbStorageRegisterCallbackForMapUnavailable(0, nullptr, Callback(), nullptr) == UsbStorage::InvalidArgument, "register map-unavailable callback with a null directory");
+    Require(sceUsbStorageRegisterCallbackForMapUnavailable(0, "/data", nullptr, nullptr) == UsbStorage::InvalidArgument, "register a null map-unavailable callback");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallbackForMapUnavailable(0, "/data", Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallbackForMapUnavailable not implemented";
+    }
+    Require(threw, "unregister map-unavailable callback did not throw its marker");
+    Require(sceUsbStorageUnregisterCallbackForMapUnavailable(0, nullptr, Callback()) == UsbStorage::InvalidArgument, "unregister map-unavailable callback with a null directory");
+    Require(sceUsbStorageUnregisterCallbackForMapUnavailable(0, "/data", nullptr) == UsbStorage::InvalidArgument, "unregister a null map-unavailable callback");
+}
+
+void TestNoDevice() {
+    std::uint32_t devices[4]{0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::int32_t count = -1;
+    Require(sceUsbStorageGetDeviceList(devices, &count) == 0, "get the device list");
+    Require(count == 0, "no usb storage device is attached");
+    Require(devices[0] == 0x5a5a5a5a && devices[3] == 0x5a5a5a5a, "the device list was written");
+    Require(sceUsbStorageGetDeviceList(nullptr, &count) == UsbStorage::InvalidArgument, "get the device list without a device array");
+    Require(sceUsbStorageGetDeviceList(devices, nullptr) == UsbStorage::InvalidArgument, "get the device list without a count");
+
+    std::uint8_t info[16];
+    std::memset(info, 0x5a, sizeof(info));
+    auto* const infoRecord = reinterpret_cast<UsbStorageDeviceInfo*>(info);
+    Require(sceUsbStorageGetDeviceInfo(0, infoRecord) == UsbStorage::DeviceNotFound, "get device info of device 0");
+    Require(sceUsbStorageGetDeviceInfo(1, infoRecord) == UsbStorage::DeviceNotFound, "get device info of device 1");
+    Require(info[0] == 0x5a && info[15] == 0x5a, "device info was written");
+    Require(sceUsbStorageGetDeviceInfo(0, nullptr) == UsbStorage::InvalidArgument, "get device info without an info buffer");
+
+    std::uint8_t exists = 1;
+    Require(sceUsbStorageIsExist(0, "/mnt/usb0", &exists) == true && exists == 0, "device 0 does not exist");
+    exists = 1;
+    Require(sceUsbStorageIsExist(1, nullptr, &exists) == true && exists == 0, "device 1 does not exist");
+    exists = 1;
+    Require(sceUsbStorageIsExist(0xffffffffu, "/mnt/usb0", &exists) == true && exists == 0, "no device id exists");
+}
+
+void TestMapRequests() {
+    char mountPoint[16];
+    std::uint64_t mountId = 0x5a5a5a5a5a5a5a5aull;
+    std::int32_t status = 0x5a5a5a5a;
+    std::memset(mountPoint, 0x5a, sizeof(mountPoint));
+    Require(sceUsbStorageRequestMap(0, "/data", 0, 0, mountPoint, &mountId) == UsbStorage::DeviceNotFound, "request a map of device 0");
+    Require(sceUsbStorageRequestMap(1, nullptr, 0, 0, nullptr, nullptr) == UsbStorage::DeviceNotFound, "request a map of device 1");
+    Require(mountId == 0x5a5a5a5a5a5a5a5aull && mountPoint[0] == static_cast<char>(0x5a), "the map request wrote its outputs");
+    std::memset(mountPoint, 0x5a, sizeof(mountPoint));
+    Require(sceUsbStorageRequestMapWSB(0, "/data", 0, 0, mountPoint, &status) == UsbStorage::DeviceNotFound, "request a WSB map of device 0");
+    Require(sceUsbStorageRequestMapWSB(0, nullptr, 0, 0, nullptr, nullptr) == UsbStorage::DeviceNotFound, "request a WSB map without a subpath");
+    Require(mountPoint[0] == static_cast<char>(0x5a) && status == 0x5a5a5a5a, "the WSB map request wrote its outputs");
+    Require(sceUsbStorageRequestUnmap(0, nullptr) == UsbStorage::InvalidArgument, "unmap a null directory");
+    bool threw = false;
+    try {
+        sceUsbStorageRequestUnmap(0, "/mnt/usb0");
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRequestUnmap not implemented";
+    }
+    Require(threw, "unmap a directory did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageRequestUnmap(7, "/mnt/usb7");
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRequestUnmap not implemented";
+    }
+    Require(threw, "unmap a directory of another device did not throw its marker");
+}
+
+void TestGetdents() {
+    std::int32_t fd = -1;
+    std::uint64_t bufferSize = 0x5a5a5a5a5a5a5a5aull;
+    Require(sceUsbStorageGetdentsOpen(0, &fd, &bufferSize) == UsbStorage::DeviceNotFound, "open a getdents scan of device 0");
+    Require(sceUsbStorageGetdentsOpen(3, &fd, &bufferSize) == UsbStorage::DeviceNotFound, "open a getdents scan of device 3");
+    Require(fd == -1 && bufferSize == 0x5a5a5a5a5a5a5a5aull, "the getdents open wrote its outputs");
+    Require(sceUsbStorageGetdentsOpen(0, nullptr, &bufferSize) == UsbStorage::InvalidArgument, "open a getdents scan without a descriptor");
+    Require(sceUsbStorageGetdentsOpen(0, &fd, nullptr) == UsbStorage::InvalidArgument, "open a getdents scan without a buffer size");
+
+    std::uint8_t buffer[64];
+    std::uint64_t bytesRead = 0x5a5a5a5a5a5a5a5aull;
+    std::memset(buffer, 0x5a, sizeof(buffer));
+    Require(sceUsbStorageGetdentsRead(1, buffer, sizeof(buffer), &bytesRead) == UsbStorage::NotSupported, "read a getdents scan that was never opened");
+    Require(bytesRead == 0, "the getdents read did not answer zero bytes");
+    Require(buffer[0] == 0x5a, "the getdents read wrote the buffer");
+    Require(sceUsbStorageGetdentsRead(1, nullptr, sizeof(buffer), &bytesRead) == UsbStorage::InvalidArgument, "read a getdents scan without a buffer");
+    Require(sceUsbStorageGetdentsRead(1, buffer, sizeof(buffer), nullptr) == UsbStorage::InvalidArgument, "read a getdents scan without a byte count");
+
+    bool threw = false;
+    try {
+        sceUsbStorageGetdentsClose(1);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageGetdentsClose not implemented";
+    }
+    Require(threw, "close a getdents scan that was never opened did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageGetdentsClose(0);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageGetdentsClose not implemented";
+    }
+    Require(threw, "close descriptor 0 did not throw its marker");
+}
+
+void TestThrowingExports() {
+    char mountPoint[8]{};
+    bool threw = false;
+    try {
+        sceUsbStorageGetMountPointOfShellCore(0, mountPoint);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageGetMountPointOfShellCore not implemented";
+    }
+    Require(threw, "get the mount point of shell core did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageClearFakeWriteProtection();
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageClearFakeWriteProtection not implemented";
+    }
+    Require(threw, "clear fake write protection did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageSetFakeMapLockForDebug();
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageSetFakeMapLockForDebug not implemented";
+    }
+    Require(threw, "set fake map lock for debug did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageSetFakeWriteProtection();
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageSetFakeWriteProtection not implemented";
+    }
+    Require(threw, "set fake write protection did not throw its marker");
+}
+
+}
+
+int main() {
+    TestInitializeAndTerminate();
+    TestRegisterCallbacks();
+    TestMapCallbacks();
+    TestNoDevice();
+    TestMapRequests();
+    TestGetdents();
+    TestThrowingExports();
+    return 0;
+}
diff --git a/core/libs/tests/GuestUsbStorageDialog.cpp b/core/libs/tests/GuestUsbStorageDialog.cpp
index e21bcc50eb..56615792bb 100644
--- a/core/libs/tests/GuestUsbStorageDialog.cpp
+++ b/core/libs/tests/GuestUsbStorageDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUsbStorageDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -8,18 +9,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceUsbStorageDialogInitialize(void);
-int APS5_VABI sceUsbStorageDialogOpen(const UsbStorageDialogParam* param);
-int APS5_VABI sceUsbStorageDialogUpdateStatus(void);
-int APS5_VABI sceUsbStorageDialogGetStatus(void);
-int APS5_VABI sceUsbStorageDialogGetResult(UsbStorageDialogResult* result);
-int APS5_VABI sceUsbStorageDialogClose(void);
-int APS5_VABI sceUsbStorageDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestUsbd.cpp b/core/libs/tests/GuestUsbd.cpp
index 358e369eea..eb6cc9af44 100644
--- a/core/libs/tests/GuestUsbd.cpp
+++ b/core/libs/tests/GuestUsbd.cpp
@@ -1,5 +1,7 @@
+#include "prx/libSceUsbd/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
+#include <algorithm>
 #include <chrono>
 #include <cstdint>
 #include <cstdio>
@@ -12,50 +14,15 @@
 
 namespace {
 
-struct UsbdTimeval {
-    std::int64_t seconds;
-    std::int64_t microseconds;
-};
-
-}
-
-extern "C" {
-std::int32_t APS5_VABI sceUsbdInit();
-void APS5_VABI sceUsbdExit();
-std::int64_t APS5_VABI sceUsbdGetDeviceList(void*** list);
-void APS5_VABI sceUsbdFreeDeviceList(void** list, std::int32_t unrefDevices);
-std::int32_t APS5_VABI sceUsbdHandleEventsTimeout(const UsbdTimeval* timeout);
-std::int32_t APS5_VABI sceUsbdOpen(void* device, void** deviceHandle);
-void APS5_VABI sceUsbdClose(void* deviceHandle);
-void* APS5_VABI sceUsbdRefDevice(void* device);
-void APS5_VABI sceUsbdUnrefDevice(void* device);
-std::uint8_t APS5_VABI sceUsbdGetBusNumber(void* device);
-std::uint8_t APS5_VABI sceUsbdGetDeviceAddress(void* device);
-std::int32_t APS5_VABI sceUsbdGetDeviceDescriptor(void* device, void* descriptor);
-std::int32_t APS5_VABI sceUsbdGetConfigDescriptor(void* device, std::uint8_t configIndex, void** config);
-std::int32_t APS5_VABI sceUsbdGetActiveConfigDescriptor(void* device, void** config);
-std::int32_t APS5_VABI sceUsbdClaimInterface(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdReleaseInterface(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdSetConfiguration(void* deviceHandle, std::int32_t configuration);
-std::int32_t APS5_VABI sceUsbdResetDevice(void* deviceHandle);
-std::int32_t APS5_VABI sceUsbdCheckConnected(void* deviceHandle);
-std::int32_t APS5_VABI sceUsbdKernelDriverActive(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdAttachKernelDriver(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdControlTransfer(void* deviceHandle, std::uint8_t requestType, std::uint8_t request, std::uint16_t value, std::uint16_t index, std::uint8_t* data, std::uint16_t length, std::uint32_t timeout);
-std::int32_t APS5_VABI sceUsbdGetStringDescriptor(void* deviceHandle, std::uint8_t descriptorIndex, std::uint16_t languageId, std::uint8_t* data, std::int32_t length);
-std::int32_t APS5_VABI sceUsbdSubmitTransfer(void* transfer);
-void* APS5_VABI sceUsbdAllocTransfer(std::int32_t isoPackets);
-void APS5_VABI sceUsbdFreeTransfer(void* transfer);
-void APS5_VABI sceUsbdFillInterruptTransfer(void* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, void* callback, void* userData, std::uint32_t timeout);
-std::int32_t APS5_VABI sceUsbdCancelTransfer(void* transfer);
-std::int32_t APS5_VABI sceUsbdEventHandlingOk();
-void APS5_VABI sceUsbdFreeConfigDescriptor(void* config);
-void APS5_VABI sceUsbdFillControlSetup(std::uint8_t* buffer, std::uint8_t requestType, std::uint8_t request, std::uint16_t value, std::uint16_t index, std::uint16_t length);
 }
 
 namespace {
 
 constexpr std::int32_t invalidArgument = static_cast<std::int32_t>(0x80240002);
+constexpr std::int32_t noDevice = static_cast<std::int32_t>(0x80240004);
+constexpr std::int32_t notFound = static_cast<std::int32_t>(0x80240005);
+constexpr std::int32_t otherError = static_cast<std::int32_t>(0x802400FF);
+constexpr std::uint8_t absentEndpoint = 0x70;
 
 void Require(bool condition, const char* message) {
     if (!condition) {
@@ -74,26 +41,11 @@ bool Throws(TCall call) {
     return false;
 }
 
-struct HostTransfer {
-    void* deviceHandle;
-    std::uint8_t flags;
-    std::uint8_t endpoint;
-    std::uint8_t type;
-    std::uint32_t timeout;
-    std::int32_t status;
-    std::int32_t length;
-    std::int32_t actualLength;
-    void (APS5_VABI* callback)(HostTransfer*);
-    void* userData;
-    std::uint8_t* buffer;
-    std::int32_t numIsoPackets;
-};
-
-void APS5_VABI MarkDone(HostTransfer* transfer) {
+void APS5_VABI MarkDone(UsbdTransfer* transfer) {
     *static_cast<int*>(transfer->userData) += 1;
 }
 
-void APS5_VABI MarkDoneThenSignal(HostTransfer* transfer) {
+void APS5_VABI MarkDoneThenSignal(UsbdTransfer* transfer) {
     auto* notified = static_cast<std::atomic<bool>*>(transfer->userData);
     notified->store(true, std::memory_order_release);
 }
@@ -119,6 +71,7 @@ void Device() {
         if ((descriptor[8] | descriptor[9] << 8) == vendor && (descriptor[10] | descriptor[11] << 8) == product) device = sceUsbdRefDevice(list[index]);
     }
     sceUsbdFreeDeviceList(list, 1);
+
     Require(device != nullptr, "the APS5_USBD_DEVICE device was not listed");
     std::printf("device bus %u address %u\n", sceUsbdGetBusNumber(device), sceUsbdGetDeviceAddress(device));
     void* config = nullptr;
@@ -126,13 +79,25 @@ void Device() {
     const auto* raw = static_cast<const std::uint8_t*>(config);
     Require(raw[1] == 2 && raw[4] > 0, "active config descriptor is not a configuration with interfaces");
     const std::uint8_t interfaces = raw[4];
+    const std::uint8_t activeValue = raw[5];
     sceUsbdFreeConfigDescriptor(config);
+
     Require(Throws([&] { sceUsbdFreeConfigDescriptor(config); }), "a config descriptor was freed twice");
     Require(sceUsbdGetConfigDescriptor(device, 0, &config) == 0, "config descriptor 0 failed");
     sceUsbdFreeConfigDescriptor(config);
+    Require(sceUsbdGetConfigDescriptorByValue(device, activeValue, &config) == 0 && config != nullptr, "config descriptor by value failed");
+    Require(static_cast<const std::uint8_t*>(config)[5] == activeValue, "config descriptor by value has another configuration value");
+    sceUsbdFreeConfigDescriptor(config);
+    Require(sceUsbdGetConfigDescriptorByValue(device, 0, &config) == static_cast<std::int32_t>(0x80240005) && config == nullptr, "configuration value 0 was found");
     void* handle = nullptr;
     Require(sceUsbdOpen(device, &handle) == 0 && handle != nullptr, "opening the device failed");
     Require(sceUsbdCheckConnected(handle) == 0, "an open device was reported disconnected");
+    Require(sceUsbdGetDevice(handle) == device, "the device of an open handle is not the device it was opened from");
+    const int speed = sceUsbdGetDeviceSpeed(device);
+    Require(speed >= 1 && speed <= 4, "the device speed is not low, full, high or super speed");
+    std::printf("device speed %d\n", speed);
+    std::int32_t configuration = -1;
+    Require(sceUsbdGetConfiguration(handle, &configuration) == 0 && configuration == activeValue, "configuration differs from the active config descriptor");
     std::uint8_t text[256] = {};
     if (descriptor[15] != 0) {
         const std::int32_t length = sceUsbdGetStringDescriptor(handle, descriptor[15], 0x409, text, sizeof(text));
@@ -140,10 +105,31 @@ void Device() {
         std::string product_name;
         for (std::int32_t index = 2; index + 1 < length; index += 2) product_name += static_cast<char>(text[index]);
         std::printf("product \"%s\"\n", product_name.c_str());
+        char ascii[256] = {};
+        const std::int32_t asciiLength = sceUsbdGetStringDescriptorAscii(handle, descriptor[15], reinterpret_cast<std::uint8_t*>(ascii), sizeof(ascii));
+        Require(asciiLength >= 0 && std::strlen(ascii) == static_cast<std::size_t>(asciiLength), "ASCII product string length differs from its terminated length");
+        std::printf("ASCII product \"%s\"\n", ascii);
+        std::uint8_t languages[4] = {};
+        Require(sceUsbdGetStringDescriptor(handle, 0, 0, languages, sizeof(languages)) == 4, "language ID string descriptor failed");
+        std::uint8_t first[256] = {};
+        const std::int32_t firstLength = sceUsbdGetStringDescriptor(handle, descriptor[15], static_cast<std::uint16_t>(languages[2] | languages[3] << 8), first, sizeof(first));
+        Require(firstLength >= 2 && first[1] == 3, "product string descriptor in the first language failed");
+        const std::int32_t end = first[0] < firstLength ? first[0] : firstLength;
+        std::string printable;
+        for (std::int32_t index = 2; index + 1 < end; index += 2) {
+            if (first[index + 1] == 0 && first[index] >= 0x20 && first[index] <= 0x7E && first[index] != '<' && first[index] != '>') printable += static_cast<char>(first[index]);
+        }
+        Require(printable == ascii, "ASCII product string differs from the printable characters of the product string");
+        char shortAscii[4] = {'x', 'x', 'x', 'x'};
+        const std::int32_t shortLength = sceUsbdGetStringDescriptorAscii(handle, descriptor[15], reinterpret_cast<std::uint8_t*>(shortAscii), sizeof(shortAscii));
+        Require(shortLength >= 0 && shortLength <= 3 && shortAscii[shortLength] == 0 && std::strncmp(shortAscii, ascii, static_cast<std::size_t>(shortLength)) == 0, "a short ASCII buffer was not filled with a terminated prefix");
     }
     std::uint8_t again[18] = {};
     Require(sceUsbdControlTransfer(handle, 0x80, 6, 0x0100, 0, again, sizeof(again), 1000) == 18, "synchronous device descriptor request failed");
     Require(std::memcmp(again, descriptor, sizeof(again)) == 0, "device descriptor read over the wire differs from the cached one");
+    std::uint8_t wire[18] = {};
+    Require(sceUsbdGetDescriptor(handle, 1, 0, wire, sizeof(wire)) == 18, "device descriptor request through sceUsbdGetDescriptor failed");
+    Require(std::memcmp(wire, descriptor, sizeof(wire)) == 0, "device descriptor read through sceUsbdGetDescriptor differs from the cached one");
     for (std::int32_t interfaceNumber = 0; interfaceNumber < interfaces; ++interfaceNumber) {
         Require(sceUsbdClaimInterface(handle, interfaceNumber) == 0, "claiming an interface failed");
         Require(sceUsbdReleaseInterface(handle, interfaceNumber) == 0, "releasing an interface failed");
@@ -154,6 +140,7 @@ void Device() {
     const std::uint8_t* interfaceArray = *reinterpret_cast<const std::uint8_t* const*>(config0 + 16);
     std::uint8_t interruptAddress = 0;
     std::uint16_t interruptMax = 0;
+    std::uint8_t interruptInterface = 0;
     if (interfaceArray == nullptr) {
         Require(false, "the active config descriptor has no interface array");
     }
@@ -167,13 +154,31 @@ void Device() {
             if ((item[2] & 0x80) != 0 && (item[3] & 3) == 3) {
                 interruptAddress = item[2];
                 interruptMax = static_cast<std::uint16_t>(item[4] | item[5] << 8);
+                interruptInterface = alternate[2];
             }
         }
     }
     Require(interruptAddress != 0 && interruptMax != 0, "the device has no interrupt IN endpoint");
     sceUsbdFreeConfigDescriptor(config);
+    Require(sceUsbdGetMaxPacketSize(device, interruptAddress) == interruptMax, "the max packet size differs from the endpoint descriptor");
+    const int expectedIso = speed <= 2 ? interruptMax : (interruptMax & 0x7FF) * std::min(1 + ((interruptMax >> 11) & 3), 3);
+    Require(sceUsbdGetMaxIsoPacketSize(device, interruptAddress) == expectedIso, "the max iso packet size differs from the endpoint descriptor");
+    Require(sceUsbdGetMaxPacketSize(device, absentEndpoint) == notFound && sceUsbdGetMaxIsoPacketSize(device, absentEndpoint) == notFound, "an absent endpoint has a max packet size");
+    Require(sceUsbdSetInterfaceAltSetting(handle, interruptInterface, 0) == notFound, "an unclaimed interface took an alternate setting");
+    Require(sceUsbdSetInterfaceAltSetting(handle, 32, 0) == invalidArgument && sceUsbdSetInterfaceAltSetting(handle, -1, 0) == invalidArgument, "an interface number outside 0 to 31 was accepted");
+    Require(sceUsbdClaimInterface(handle, interruptInterface) == 0, "claiming the interrupt endpoint's interface failed");
+    const std::int32_t alternate = sceUsbdSetInterfaceAltSetting(handle, interruptInterface, 0);
+    Require(alternate == 0 || alternate == otherError, "alternate setting 0 returned neither success nor the other error");
+    std::printf("alternate setting 0 of interface %u: %d\n", interruptInterface, alternate);
+    Require(sceUsbdClearHalt(handle, interruptAddress) == 0, "clearing the interrupt endpoint's halt failed");
+    Require(sceUsbdClearHalt(handle, absentEndpoint) == otherError, "clearing the halt of an absent endpoint did not return the other error");
+    const std::int32_t detached = sceUsbdDetachKernelDriver(handle, interruptInterface);
+    Require(detached == 0 || detached == otherError, "detaching the kernel driver returned neither success nor the other error");
+    std::printf("kernel driver detach: %d\n", detached);
+    Require(sceUsbdReleaseInterface(handle, interruptInterface) == 0, "releasing the interrupt endpoint's interface failed");
+    Require(sceUsbdSetInterfaceAltSetting(handle, interruptInterface, 0) == notFound, "a released interface took an alternate setting");
 
-    auto* transfer = static_cast<HostTransfer*>(sceUsbdAllocTransfer(0));
+    auto* transfer = reinterpret_cast<UsbdTransfer*>(sceUsbdAllocTransfer(0));
     std::uint8_t setup[8 + 18] = {0x80, 6, 0x00, 0x01, 0x00, 0x00, 18, 0};
     int done = 0;
     transfer->deviceHandle = handle;
@@ -183,8 +188,8 @@ void Device() {
     transfer->length = sizeof(setup);
     transfer->callback = MarkDone;
     transfer->userData = &done;
-    Require(sceUsbdSubmitTransfer(transfer) == 0, "submitting an asynchronous control transfer failed");
-    Require(Throws([&] { sceUsbdFreeTransfer(transfer); }), "an in-flight transfer was freed");
+    Require(sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == 0, "submitting an asynchronous control transfer failed");
+    Require(Throws([&] { sceUsbdFreeTransfer(reinterpret_cast<UsbdTransfer*>(transfer)); }), "an in-flight transfer was freed");
     Pump(done);
     Require(done == 1 && transfer->status == 0 && transfer->actualLength == 18, "asynchronous control transfer did not complete");
     Require(std::memcmp(setup + 8, descriptor, 18) == 0, "asynchronous device descriptor differs from the cached one");
@@ -194,14 +199,15 @@ void Device() {
         for (int round = 0; round < 300 && !broken; ++round) {
             std::atomic<bool> notified{false};
             std::uint8_t blink[64] = {};
-            sceUsbdFillInterruptTransfer(transfer, handle, interruptAddress, blink, interruptMax, reinterpret_cast<void*>(&MarkDoneThenSignal), &notified, 0);
-            const int submitResult = sceUsbdSubmitTransfer(transfer);
+            sceUsbdFillInterruptTransfer(reinterpret_cast<UsbdTransfer*>(transfer), handle, interruptAddress, blink, interruptMax, &MarkDoneThenSignal, &notified, 0);
+
+            const int submitResult = sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
             if (submitResult != 0) {
                 broken = true;
                 break;
             }
             std::thread canceller([&] {
-                const int outcome = sceUsbdCancelTransfer(transfer);
+                const int outcome = sceUsbdCancelTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
                 if (outcome != 0 && outcome != static_cast<std::int32_t>(0x80240005)) broken = true;
             });
             while (!notified.load(std::memory_order_acquire)) {
@@ -213,11 +219,23 @@ void Device() {
     }
     Require(!broken, "the cancel race failed");
 
-    Require(sceUsbdCancelTransfer(transfer) == static_cast<std::int32_t>(0x80240005), "cancelling a completed transfer did not report not found");
-    sceUsbdFreeTransfer(transfer);
+    Require(sceUsbdCancelTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == static_cast<std::int32_t>(0x80240005), "cancelling a completed transfer did not report not found");
+    sceUsbdFreeTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
     sceUsbdClose(handle);
+
     Require(Throws([&] { sceUsbdClose(handle); }), "a handle was closed twice");
+    Require(Throws([&] { sceUsbdGetDevice(handle); }), "the device of a closed handle was returned");
     sceUsbdUnrefDevice(device);
+    void* byId = sceUsbdOpenDeviceWithVidPid(static_cast<std::uint16_t>(vendor), static_cast<std::uint16_t>(product));
+    Require(byId != nullptr, "opening the device by vendor and product failed");
+    void* byIdDevice = sceUsbdGetDevice(byId);
+    std::uint8_t byIdDescriptor[18] = {};
+    Require(sceUsbdGetDeviceDescriptor(byIdDevice, byIdDescriptor) == 0, "the device of a handle opened by vendor and product has no descriptor");
+    Require((byIdDescriptor[8] | byIdDescriptor[9] << 8) == vendor && (byIdDescriptor[10] | byIdDescriptor[11] << 8) == product, "the device opened by vendor and product has another vendor or product");
+    Require(sceUsbdGetMaxPacketSize(byIdDevice, interruptAddress) == interruptMax, "the max packet size through a handle's device differs");
+    sceUsbdClose(byId);
+    Require(Throws([&] { sceUsbdGetDeviceDescriptor(byIdDevice, byIdDescriptor); }), "the device of a closed handle stayed known");
+
     std::puts("USBD device tests passed");
 }
 
@@ -233,8 +251,10 @@ int main(int argc, char** argv) {
         Require(sceUsbdGetDeviceDescriptor(list[index], deviceDescriptor) == 0 && deviceDescriptor[0] == 18 && deviceDescriptor[1] == 1, "listed device has no device descriptor");
         Require(sceUsbdRefDevice(list[index]) == list[index], "listed device was not referenced");
         sceUsbdUnrefDevice(list[index]);
+
     }
     sceUsbdFreeDeviceList(list, 1);
+
     Require(Throws([&] { sceUsbdFreeDeviceList(list, 1); }), "a device list was freed twice");
     Require(sceUsbdGetDeviceList(nullptr) == invalidArgument, "null list accepted");
     Require(sceUsbdHandleEventsTimeout(nullptr) == invalidArgument, "null timeout accepted");
@@ -250,9 +270,11 @@ int main(int argc, char** argv) {
     Require(Throws([&] { sceUsbdOpen(nullptr, &handle); }), "opening a null device did not throw");
     Require(Throws([&] { sceUsbdOpen(&foreign, &handle); }), "opening a device that was never listed did not throw");
     sceUsbdClose(nullptr);
+
     Require(Throws([&] { sceUsbdClose(&foreign); }), "closing a handle that was never opened did not throw");
     Require(sceUsbdRefDevice(nullptr) == nullptr, "null device was referenced");
     sceUsbdUnrefDevice(nullptr);
+
     Require(Throws([&] { sceUsbdRefDevice(&foreign); }), "referencing a device that was never listed did not throw");
     Require(Throws([&] { sceUsbdUnrefDevice(&foreign); }), "unreferencing a device that was never listed did not throw");
     Require(sceUsbdGetBusNumber(nullptr) == 0 && sceUsbdGetDeviceAddress(nullptr) == 0, "null device reported a bus or address");
@@ -274,35 +296,71 @@ int main(int argc, char** argv) {
     Require(Throws([&] { sceUsbdControlTransfer(&foreign, 0x80, 6, 0x100, 0, descriptor, 18, 1000); }), "control transfer on a handle that was never opened did not throw");
     Require(sceUsbdGetStringDescriptor(nullptr, 1, 0x409, descriptor, 18) == invalidArgument, "null handle string descriptor accepted");
     Require(sceUsbdGetStringDescriptor(&foreign, 1, 0x409, descriptor, 0) == invalidArgument, "empty string descriptor buffer accepted");
+    descriptor[0] = 0x55;
+    Require(sceUsbdGetStringDescriptorAscii(nullptr, 1, descriptor, 18) == invalidArgument, "null handle ASCII string descriptor accepted");
+    Require(sceUsbdGetStringDescriptorAscii(&foreign, 1, nullptr, 18) == invalidArgument && sceUsbdGetStringDescriptorAscii(&foreign, 1, descriptor, 0) == invalidArgument, "missing ASCII string buffer accepted");
+    Require(descriptor[0] == 0x55, "a rejected ASCII string request wrote the buffer");
+    Require(Throws([&] { sceUsbdGetStringDescriptorAscii(&foreign, 1, descriptor, 18); }), "ASCII string request on a handle that was never opened did not throw");
+    Require(sceUsbdGetDescriptor(nullptr, 1, 0, descriptor, 18) == invalidArgument, "null handle descriptor request accepted");
+    Require(sceUsbdGetDescriptor(&foreign, 1, 0, nullptr, 18) == invalidArgument && sceUsbdGetDescriptor(&foreign, 1, 0, descriptor, 0) == invalidArgument, "missing descriptor buffer accepted");
+    Require(Throws([&] { sceUsbdGetDescriptor(&foreign, 1, 0, descriptor, 18); }), "descriptor request on a handle that was never opened did not throw");
+    std::int32_t configuration = -1;
+    Require(sceUsbdGetConfiguration(nullptr, &configuration) == invalidArgument && sceUsbdGetConfiguration(&foreign, nullptr) == invalidArgument, "null configuration query accepted");
+    Require(configuration == -1, "a rejected configuration query wrote the output");
+    Require(Throws([&] { sceUsbdGetConfiguration(&foreign, &configuration); }), "configuration of a handle that was never opened did not throw");
+    Require(sceUsbdGetConfigDescriptorByValue(nullptr, 1, &config) == invalidArgument && sceUsbdGetConfigDescriptorByValue(&foreign, 1, nullptr) == invalidArgument, "null config by value argument accepted");
+    Require(Throws([&] { sceUsbdGetConfigDescriptorByValue(&foreign, 1, &config); }), "config by value of a device that was never listed did not throw");
     Require(Throws([&] { sceUsbdClaimInterface(&foreign, 0); }), "claiming on a handle that was never opened did not throw");
-    auto* transfer = static_cast<std::uint8_t*>(sceUsbdAllocTransfer(2));
+    auto* transfer = reinterpret_cast<std::uint8_t*>(sceUsbdAllocTransfer(2));
     Require(transfer != nullptr, "transfer allocation failed");
     Require(*reinterpret_cast<std::int32_t*>(transfer + 56) == 2, "iso packet count not stored");
     Require(sceUsbdAllocTransfer(-1) == nullptr, "negative iso packet count accepted");
     std::uint8_t buffer[8] = {};
     int user = 0;
-    sceUsbdFillInterruptTransfer(transfer, nullptr, 0x81, buffer, 8, reinterpret_cast<void*>(&Require), &user, 250);
+    sceUsbdFillInterruptTransfer(reinterpret_cast<UsbdTransfer*>(transfer), nullptr, 0x81, buffer, 8, reinterpret_cast<UsbdTransferCallback>(&Require), &user, 250);
+
     Require(transfer[9] == 0x81 && transfer[10] == 3, "endpoint or interrupt type not filled");
     Require(*reinterpret_cast<std::uint32_t*>(transfer + 12) == 250 && *reinterpret_cast<std::int32_t*>(transfer + 20) == 8, "timeout or length not filled");
     Require(*reinterpret_cast<void**>(transfer + 40) == &user && *reinterpret_cast<std::uint8_t**>(transfer + 48) == buffer, "user data or buffer not filled");
-    Require(sceUsbdCancelTransfer(transfer) == static_cast<std::int32_t>(0x80240005), "cancelling an unsubmitted transfer did not report not found");
+    Require(sceUsbdCancelTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == static_cast<std::int32_t>(0x80240005), "cancelling an unsubmitted transfer did not report not found");
     Require(sceUsbdSubmitTransfer(nullptr) == invalidArgument, "null transfer submitted");
-    Require(sceUsbdSubmitTransfer(transfer) == invalidArgument, "transfer without a handle submitted");
-    sceUsbdFillInterruptTransfer(transfer, &foreign, 0x81, buffer, 8, reinterpret_cast<void*>(&Require), &user, 250);
-    Require(Throws([&] { sceUsbdSubmitTransfer(transfer); }), "submitting on a handle that was never opened did not throw");
-    sceUsbdFreeTransfer(transfer);
+    Require(sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == invalidArgument, "transfer without a handle submitted");
+    sceUsbdFillInterruptTransfer(reinterpret_cast<UsbdTransfer*>(transfer), &foreign, 0x81, buffer, 8, reinterpret_cast<UsbdTransferCallback>(&Require), &user, 250);
+
+    Require(Throws([&] { sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer)); }), "submitting on a handle that was never opened did not throw");
+    sceUsbdFreeTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
+    Require(Throws([&] { sceUsbdClearHalt(nullptr, 0x81); }), "clearing a halt on a null handle did not throw");
+    Require(Throws([&] { sceUsbdClearHalt(&foreign, 0x81); }), "clearing a halt on a handle that was never opened did not throw");
+    Require(sceUsbdDetachKernelDriver(nullptr, 0) == invalidArgument, "null handle kernel driver detach accepted");
+    Require(Throws([&] { sceUsbdDetachKernelDriver(&foreign, 0); }), "kernel driver detach on a handle that was never opened did not throw");
+    Require(sceUsbdGetDevice(nullptr) == nullptr, "a null handle has a device");
+    Require(Throws([&] { sceUsbdGetDevice(&foreign); }), "the device of a handle that was never opened did not throw");
+    Require(sceUsbdGetDeviceSpeed(nullptr) == 0, "a null device has a speed");
+    Require(Throws([&] { sceUsbdGetDeviceSpeed(&foreign); }), "the speed of a device that was never listed did not throw");
+    Require(sceUsbdGetMaxPacketSize(nullptr, 0x81) == noDevice, "a null device has a max packet size");
+    Require(Throws([&] { sceUsbdGetMaxPacketSize(&foreign, 0x81); }), "the max packet size of a device that was never listed did not throw");
+    Require(Throws([&] { sceUsbdGetMaxIsoPacketSize(nullptr, 0x81); }), "the max iso packet size of a null device did not throw");
+    Require(Throws([&] { sceUsbdGetMaxIsoPacketSize(&foreign, 0x81); }), "the max iso packet size of a device that was never listed did not throw");
+    Require(sceUsbdSetInterfaceAltSetting(nullptr, 0, 0) == invalidArgument, "null handle alternate setting accepted");
+    Require(Throws([&] { sceUsbdSetInterfaceAltSetting(&foreign, 0, 0); }), "an alternate setting on a handle that was never opened did not throw");
+    Require(sceUsbdOpenDeviceWithVidPid(0, 0) == nullptr, "a device with vendor and product 0 was opened");
     sceUsbdFreeTransfer(nullptr);
+
     Require(sceUsbdEventHandlingOk() == 1, "event handling not allowed");
     sceUsbdFreeConfigDescriptor(nullptr);
+
     Require(Throws([] { sceUsbdFillControlSetup(nullptr, 0x80, 6, 0x0100, 0, 18); }), "null control setup buffer accepted");
     std::uint8_t setupBuffer[8] = {};
     sceUsbdFillControlSetup(setupBuffer, 0x80, 6, 0x0100, 0x0409, 18);
+
     Require(setupBuffer[0] == 0x80 && setupBuffer[1] == 6, "request type or request not filled");
     Require(setupBuffer[2] == 0x00 && setupBuffer[3] == 0x01, "value not filled little-endian");
     Require(setupBuffer[4] == 0x09 && setupBuffer[5] == 0x04, "index not filled little-endian");
     Require(setupBuffer[6] == 18 && setupBuffer[7] == 0, "length not filled little-endian");
     if (argc == 2 && std::strcmp(argv[1], "device") == 0) Device();
     sceUsbdExit();
+    Require(sceUsbdOpenDeviceWithVidPid(0, 0) == nullptr, "a device was opened after the library exited");
+
     std::puts("USBD tests passed");
     return 0;
 }
diff --git a/core/libs/tests/GuestUserContext.cpp b/core/libs/tests/GuestUserContext.cpp
index c616e2260d..46fb68c1d5 100644
--- a/core/libs/tests/GuestUserContext.cpp
+++ b/core/libs/tests/GuestUserContext.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/System/include/UserContext.hpp"
@@ -16,15 +19,6 @@
 using ContextEntry = void (APS5_VABI*)();
 
 extern "C" {
-[[gnu::returns_twice]] int APS5_VABI getcontext_nid_postfix(UserUcontext* context);
-int APS5_VABI setcontext_nid_postfix(const UserUcontext* context);
-void APS5_VABI makecontext_nid_postfix(UserUcontext* context, ContextEntry entry, int count, ...);
-[[gnu::returns_twice]] int APS5_VABI setjmp_nid_postfix(std::uint64_t* buffer);
-[[noreturn]] void APS5_VABI longjmp_nid_postfix(std::uint64_t* buffer, int value);
-[[gnu::returns_twice]] int APS5_VABI sigsetjmp_nid_postfix(std::uint64_t* buffer, int saveMask);
-[[noreturn]] void APS5_VABI siglongjmp_nid_postfix(std::uint64_t* buffer, int value);
-int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
-int* APS5_VABI __error_nid_postfix();
 
 int APS5_VABI CaptureKnownRegisters(UserUcontext* context);
 void CaptureReturnAddress();
@@ -238,24 +232,29 @@ void CheckErrors() {
     invalid.stackPointer = g_contextStack.bytes;
     invalid.stackSize = StackBytes;
     makecontext_nid_postfix(&invalid, &EntryThunk, 7);
+
     Require(invalid.mcontext.len == 0, "makecontext invalidates a context with more than six arguments");
     invalid = context;
     invalid.stackPointer = g_contextStack.bytes;
     invalid.stackSize = 2047;
     makecontext_nid_postfix(&invalid, &EntryThunk, 0);
+
     Require(invalid.mcontext.len == 0, "makecontext invalidates a context with a stack below MINSIGSTKSZ");
     invalid = context;
     invalid.stackPointer = nullptr;
     invalid.stackSize = StackBytes;
     makecontext_nid_postfix(&invalid, &EntryThunk, 0);
+
     Require(invalid.mcontext.len == 0, "makecontext invalidates a context without a stack");
     invalid = context;
     invalid.stackPointer = g_contextStack.bytes;
     invalid.stackSize = StackBytes;
     invalid.mcontext.len = 0;
     makecontext_nid_postfix(&invalid, &EntryThunk, 0);
+
     Require(invalid.mcontext.len == 0 && invalid.mcontext.rip == context.mcontext.rip, "makecontext leaves a context without a valid mc_len untouched");
     makecontext_nid_postfix(nullptr, &EntryThunk, 0);
+
 }
 
 void CheckCapture() {
@@ -331,6 +330,7 @@ void CheckRestore() {
             std::memcpy(image + FxsaveXmm + index * 8, &value, sizeof(value));
         }
         setcontext_nid_postfix(&target);
+
         Require(false, "setcontext returned from a valid context");
     }
     const auto& machine = target.mcontext;
@@ -374,6 +374,7 @@ namespace {
         if (sigsetjmp_nid_postfix(from->jump, 1) == 0) {
             if (to->started) siglongjmp_nid_postfix(to->jump, 1);
             setcontext_nid_postfix(&to->context);
+
             Require(false, "setcontext into the job returned");
         }
         return;
@@ -381,6 +382,7 @@ namespace {
     if (setjmp_nid_postfix(from->jump) == 0) {
         if (to->started) longjmp_nid_postfix(to->jump, 1);
         setcontext_nid_postfix(&to->context);
+
         Require(false, "setcontext into the job returned");
     }
 }
@@ -415,8 +417,10 @@ void CheckMakecontext() {
         context.stackSize = StackBytes;
         context.link = &caller;
         makecontext_nid_postfix(&context, &EntryThunk, 6, 0x8000000000000001ull, 0x8000000000000002ull, 0x8000000000000003ull, 0x8000000000000004ull, 0x8000000000000005ull, 0x8000000000000006ull);
+
         Require(context.mcontext.len == sizeof(UserMcontext), "makecontext keeps the context valid");
         setcontext_nid_postfix(&context);
+
         Require(false, "setcontext into the made context returned");
     }
     Require(g_entries == 1, "the made context runs once and resumes uc_link");
@@ -448,6 +452,7 @@ void CheckJumpBuffers(bool signalJumps) {
     g_job.context.stackSize = StackBytes;
     g_job.context.link = nullptr;
     makecontext_nid_postfix(&g_job.context, &JobEntry, 0);
+
     for (int round = 1; round <= 4; ++round) {
         Switch(&g_dispatcher, &g_job);
         Require(g_jobRuns == round, "the job runs once per switch");
@@ -473,6 +478,7 @@ void CheckSignalMask() {
         phase = 1;
         Require(sigprocmask_nid_postfix(GuestSigSetmask, second, nullptr) == 0, "set the second mask");
         setcontext_nid_postfix(&context);
+
         Require(false, "setcontext returned from a valid context");
     }
     std::uint32_t current[4] = {};
@@ -488,6 +494,7 @@ int ExitFromContext() {
     context.link = nullptr;
     makecontext_nid_postfix(&context, &ReturnWithoutLink, 0);
     setcontext_nid_postfix(&context);
+
     return 1;
 }
 
diff --git a/core/libs/tests/GuestUserService.cpp b/core/libs/tests/GuestUserService.cpp
index db457f47f3..9b46dffc13 100644
--- a/core/libs/tests/GuestUserService.cpp
+++ b/core/libs/tests/GuestUserService.cpp
@@ -2,31 +2,11 @@
 #include "prx/libSceUserService/UserService.hpp"
 #include <cstdint>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 #include <string>
 #include <utility>
 
-extern "C" {
-int APS5_VABI sceUserServiceGetUserNumber(int user_id, int32_t* number);
-int APS5_VABI sceUserServiceGetPlatformPrivacyWs1(int32_t user_id, int32_t* value);
-int APS5_VABI sceUserServiceGetForegroundUser(int* user_id);
-int APS5_VABI sceUserServiceGetRegisteredUserIdList(UserServiceRegisteredUserIdList* user_id_list);
-int APS5_VABI sceUserServiceGetUserColor(int user_id, int* color);
-int APS5_VABI sceUserServiceGetKeyboardType(int user_id, std::int32_t* type);
-int APS5_VABI sceUserServiceGetJapaneseInputType(int user_id, std::int32_t* type);
-int APS5_VABI sceUserServiceGetTraditionalChineseInputType(int user_id, std::int32_t* type);
-int APS5_VABI sceUserServiceGetNpAccountId(int user_id, std::uint64_t* account_id);
-int APS5_VABI sceUserServiceGetAgeLevel(int user_id, std::uint32_t* age_level);
-int APS5_VABI sceUserServiceGetAccessibilityChatTranscription(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityKeyremapEnable();
-int APS5_VABI sceUserServiceGetAccessibilityPressAndHoldDelay(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityTriggerEffect(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityVibration(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityZoom();
-int APS5_VABI sceUserServiceGetAccessibilityZoomEnabled(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityZoomFollowFocus(int user_id, std::int32_t* value);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -154,9 +134,18 @@ int main() {
         Require(setting.get(USER_SERVICE_INITIAL_USER_ID, &value) == USER_SERVICE_OK);
         Require(value == setting.value);
     }
+    int initialUser = -1;
+    Require(sceUserServiceGetInitialUser(nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetInitialUser(&initialUser) == USER_SERVICE_OK && initialUser == USER_SERVICE_INITIAL_USER_ID);
+    Require(sceUserServiceGetGamePresets(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    UserServiceGamePresets presets{};
+    presets.difficulty = 0x5a;
+    Require(sceUserServiceGetGamePresets(0, &presets) == USER_SERVICE_ERROR_INVALID_ARGUMENT && presets.difficulty == 0x5a);
+    Require(sceUserServiceGetGamePresets(USER_SERVICE_INITIAL_USER_ID, &presets) == USER_SERVICE_OK && presets.difficulty == 0);
+    std::int32_t accessibilityValue = 0;
     bool threwKeyremap = false;
     try {
-        sceUserServiceGetAccessibilityKeyremapEnable();
+        sceUserServiceGetAccessibilityKeyremapEnable(USER_SERVICE_INITIAL_USER_ID, &accessibilityValue);
     } catch (const std::runtime_error&) {
         threwKeyremap = true;
     }
@@ -164,9 +153,68 @@ int main() {
 
     bool threwZoom = false;
     try {
-        sceUserServiceGetAccessibilityZoom();
+        sceUserServiceGetAccessibilityZoom(USER_SERVICE_INITIAL_USER_ID, &accessibilityValue);
     } catch (const std::runtime_error&) {
         threwZoom = true;
     }
     Require(threwZoom);
+
+    char name[32]{};
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID, nullptr, sizeof(name)) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserName(123, name, sizeof(name)) == USER_SERVICE_ERROR_UNKNOWN_USER);
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID, name, 5) == USER_SERVICE_ERROR_BUFFER_TOO_SHORT);
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID, name, sizeof(name)) == USER_SERVICE_OK);
+    Require(std::strcmp(name, "Player") == 0);
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID + 1, name, sizeof(name)) == USER_SERVICE_OK);
+    Require(std::strcmp(name, "Player2") == 0);
+
+    std::int32_t number = -1;
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserNumber(123, &number) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID, &number) == USER_SERVICE_OK);
+    Require(number == 1);
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID + 1, &number) == USER_SERVICE_OK);
+    Require(number == 2);
+
+    Require(sceUserServiceGetUserColor(USER_SERVICE_INITIAL_USER_ID + 1, &color) == USER_SERVICE_OK);
+    Require(color == 1);
+
+    Require(sceUserServiceGetAgeLevel(USER_SERVICE_INITIAL_USER_ID + 1, &age_level) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+    Require(sceUserServiceGetAgeLevel(USER_SERVICE_INITIAL_USER_ID + 1, nullptr) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+    for (const Setting& setting : settings) {
+        std::int32_t value = 0x5a5a5a5a;
+        Require(setting.get(USER_SERVICE_INITIAL_USER_ID + 1, &value) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+        Require(value == 0x5a5a5a5a);
+        Require(setting.get(USER_SERVICE_INITIAL_USER_ID + 1, nullptr) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+    }
+
+    UserServiceSetUserConnected_nid_postfix(1, true);
+    Require(sceUserServiceGetRegisteredUserIdList(&registered) == USER_SERVICE_OK);
+    Require(registered.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    Require(registered.user_id[1] == USER_SERVICE_INITIAL_USER_ID + 1);
+    for (int i = 2; i < 16; ++i) {
+        Require(registered.user_id[i] == USER_SERVICE_USER_ID_INVALID);
+    }
+    Require(sceUserServiceGetAgeLevel(USER_SERVICE_INITIAL_USER_ID + 1, &age_level) == USER_SERVICE_OK);
+    Require(age_level == 0xffffffffu);
+    for (const Setting& setting : settings) {
+        std::int32_t value = 0x5a5a5a5a;
+        Require(setting.get(USER_SERVICE_INITIAL_USER_ID + 1, &value) == USER_SERVICE_OK);
+        Require(value == setting.value);
+    }
+
+    UserServiceSetUserConnected_nid_postfix(1, false);
+    Require(sceUserServiceGetRegisteredUserIdList(&registered) == USER_SERVICE_OK);
+    Require(registered.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    for (int i = 1; i < 16; ++i) {
+        Require(registered.user_id[i] == USER_SERVICE_USER_ID_INVALID);
+    }
+    Require(sceUserServiceGetAgeLevel(USER_SERVICE_INITIAL_USER_ID + 1, &age_level) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+    Require(sceUserServiceGetAgeLevel(USER_SERVICE_INITIAL_USER_ID + 1, nullptr) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+    for (const Setting& setting : settings) {
+        std::int32_t value = 0x5a5a5a5a;
+        Require(setting.get(USER_SERVICE_INITIAL_USER_ID + 1, &value) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+        Require(value == 0x5a5a5a5a);
+        Require(setting.get(USER_SERVICE_INITIAL_USER_ID + 1, nullptr) == USER_SERVICE_ERROR_NOT_LOGGED_IN);
+    }
 }
diff --git a/core/libs/tests/GuestUserServiceLifecycle.cpp b/core/libs/tests/GuestUserServiceLifecycle.cpp
index 550acb5353..99a61cc97b 100644
--- a/core/libs/tests/GuestUserServiceLifecycle.cpp
+++ b/core/libs/tests/GuestUserServiceLifecycle.cpp
@@ -4,14 +4,6 @@
 #include <cstring>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* params);
-int APS5_VABI sceUserServiceInitialize2(std::int32_t priority, KernelCpumask affinityMask);
-int APS5_VABI sceUserServiceTerminate(void);
-int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* user_id_list);
-int APS5_VABI sceUserServiceGetEvent(SceUserServiceEvent* event);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -82,6 +74,42 @@ int main() {
 
     Require(sceUserServiceInitialize(nullptr) == USER_SERVICE_OK);
     RequireLoginOnce();
+
+    UserServiceSetUserConnected_nid_postfix(1, true);
+    SceUserServiceEvent event{};
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 0 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 1);
+    Require(sceUserServiceGetLoginUserIdList(&list) == USER_SERVICE_OK);
+    Require(list.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    Require(list.user_id[1] == USER_SERVICE_INITIAL_USER_ID + 1);
+
+    UserServiceSetUserConnected_nid_postfix(1, false);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 1 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 1);
+    Require(sceUserServiceGetLoginUserIdList(&list) == USER_SERVICE_OK);
+    Require(list.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    Require(list.user_id[1] == USER_SERVICE_USER_ID_INVALID);
+
+    for (int i = 0; i < 50; ++i) {
+        UserServiceSetUserConnected_nid_postfix(1, true);
+        UserServiceSetUserConnected_nid_postfix(1, false);
+    }
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_ERROR_NO_EVENT);
+
+    UserServiceSetUserConnected_nid_postfix(2, true);
+    UserServiceSetUserConnected_nid_postfix(2, false);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_ERROR_NO_EVENT);
+
+    UserServiceSetUserConnected_nid_postfix(2, true);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 0 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 2);
+    UserServiceSetUserConnected_nid_postfix(2, false);
+    UserServiceSetUserConnected_nid_postfix(2, true);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_ERROR_NO_EVENT);
+    UserServiceSetUserConnected_nid_postfix(2, false);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 1 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 2);
+
     Require(sceUserServiceTerminate() == USER_SERVICE_OK);
 
     TestThreadPriority();
diff --git a/core/libs/tests/GuestUserServiceUserName.cpp b/core/libs/tests/GuestUserServiceUserName.cpp
index f755162970..15ad3469e3 100644
--- a/core/libs/tests/GuestUserServiceUserName.cpp
+++ b/core/libs/tests/GuestUserServiceUserName.cpp
@@ -5,10 +5,6 @@
 #include <cstring>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceUserServiceGetUserName(int user_id, char* name, std::size_t size);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestUtime.cpp b/core/libs/tests/GuestUtime.cpp
index 884cff4e47..48417ce88f 100644
--- a/core/libs/tests/GuestUtime.cpp
+++ b/core/libs/tests/GuestUtime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -12,17 +14,8 @@
 #include <sys/stat.h>
 #endif
 
-struct LibcUtimbuf {
-    std::int64_t actime;
-    std::int64_t modtime;
-};
 static_assert(sizeof(LibcUtimbuf) == 16);
 
-extern "C" {
-int APS5_VABI utime_nid_postfix(const char*, const LibcUtimbuf*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "Utime check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestUtimeForwarding.cpp b/core/libs/tests/GuestUtimeForwarding.cpp
index 870d83d404..146ca8f7bd 100644
--- a/core/libs/tests/GuestUtimeForwarding.cpp
+++ b/core/libs/tests/GuestUtimeForwarding.cpp
@@ -1,15 +1,9 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <initializer_list>
 
-struct LibcUtimbuf {
-    std::int64_t actime;
-    std::int64_t modtime;
-};
-
-extern "C" int APS5_VABI utime_nid_postfix(const char*, const LibcUtimbuf*);
-
 namespace {
 int guestError;
 int backendResult;
diff --git a/core/libs/tests/GuestVdecsw.cpp b/core/libs/tests/GuestVdecsw.cpp
index 6bb929a1e0..0990141df2 100644
--- a/core/libs/tests/GuestVdecsw.cpp
+++ b/core/libs/tests/GuestVdecsw.cpp
@@ -1,8 +1,11 @@
+#include "prx/libSceVdecsw/libSceVdecsw.hpp"
+#include <algorithm>
 #include <array>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
+#include <limits>
 #include <stdexcept>
 #include <string>
 #include <vector>
@@ -11,198 +14,17 @@
 #include "H264Fixture.hpp"
 #include "HevcFixture.hpp"
 
-struct ComputeMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-};
+using namespace SceVdecsw;
 
-struct ComputeConfigInfo {
-    std::uint64_t thisSize;
-    std::uint16_t computePipeId;
-    std::uint16_t computeQueueId;
-    bool checkMemoryType;
-};
-
-struct DecoderConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-    std::uint64_t computeQueue;
-    std::uint64_t cpuAffinityMask;
-    std::int32_t cpuThreadPriority;
-    bool optimizeProgressiveVideo;
-    std::uint8_t reserved[19];
-};
-
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct InputResult {
-    std::uint64_t thisSize;
-    const void* decodedAu;
-    std::uint32_t outputFrameCount;
-    std::uint32_t reserved;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isLastFrame;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    bool isDiscardedFrame;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
-
-static_assert(sizeof(Vp9PictureInfo) == 0x58 && offsetof(Vp9PictureInfo, ptsData) == 0x10 && offsetof(Vp9PictureInfo, profile) == 0x28 && offsetof(Vp9PictureInfo, bitDepth) == 0x38 && offsetof(Vp9PictureInfo, colorSpace) == 0x3c && offsetof(Vp9PictureInfo, renderHeight) == 0x50);
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInMbsMinus1;
-    std::uint32_t picHeightInMapUnitsMinus1;
-    std::uint8_t frameMbsOnlyFlag;
-    std::uint8_t frameCroppingFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-    std::uint8_t vui[44];
-};
-
-struct HevcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-    std::uint8_t bitDepthLumaMinus8;
-    std::uint8_t bitDepthChromaMinus8;
-    std::uint8_t timingInfoPresentFlag;
-    std::uint32_t numUnitsInTick;
-    std::uint32_t timeScale;
-    std::uint32_t aspectRatioInfoPresentFlag;
-    std::uint8_t aspectRatioIdc;
-    std::uint16_t sarWidth;
-    std::uint16_t sarHeight;
-    std::uint8_t videoSignal[8];
-    std::uint32_t picStruct;
-    std::uint32_t sourceScanType;
-    std::uint32_t duplicateFlag;
-    std::uint32_t conformanceWindowFlag;
-    std::uint32_t confWinLeftOffset;
-    std::uint32_t confWinRightOffset;
-    std::uint32_t confWinTopOffset;
-    std::uint32_t confWinBottomOffset;
-    std::uint32_t defaultDisplayWindow[5];
-    std::uint8_t chromaLocation[4];
-    std::uint8_t presentFlags[11];
-    std::uint8_t idrPictureFlag;
-    std::uint8_t irapPictureFlag;
-    std::uint8_t generalProfileSpace;
-    std::uint8_t generalTierFlag;
-    std::uint8_t generalProfileIdc;
-    std::uint8_t generalSourceFlags[3];
-    std::uint8_t generalLevelIdc;
-    std::uint8_t subLayer[9];
-    std::uint8_t frameCroppingFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-};
+static_assert(sizeof(SceVideodec2::Vp9PictureInfo) == 0x58 && offsetof(SceVideodec2::Vp9PictureInfo, ptsData) == 0x10 && offsetof(SceVideodec2::Vp9PictureInfo, profile) == 0x28 && offsetof(SceVideodec2::Vp9PictureInfo, bitDepth) == 0x38 && offsetof(SceVideodec2::Vp9PictureInfo, colorSpace) == 0x3c && offsetof(SceVideodec2::Vp9PictureInfo, renderHeight) == 0x50);
 
 static_assert(sizeof(HevcPictureInfo) == 0xb8 && offsetof(HevcPictureInfo, idrPictureFlag) == 0x93 && offsetof(HevcPictureInfo, frameCroppingFlag) == 0xa5);
-static_assert(sizeof(DecoderConfigInfo) == 0x50 && sizeof(OutputInfo) == 0x38 && offsetof(OutputInfo, isLastFrame) == 9 && offsetof(OutputInfo, pictureCount) == 0xb && sizeof(AvcPictureInfo) == 0x78);
-
-extern "C" {
-int APS5_VABI sceVdecswQueryComputeMemoryInfo(ComputeMemoryInfo*);
-int APS5_VABI sceVdecswAllocateComputeQueue(const ComputeConfigInfo*, const ComputeMemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVdecswReleaseComputeQueue(std::uint64_t);
-int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const DecoderConfigInfo*, DecoderMemoryInfo*);
-int APS5_VABI sceVdecswCreateDecoder(const DecoderConfigInfo*, const DecoderMemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVdecswDeleteDecoder(std::uint64_t);
-int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t, const InputData*);
-int APS5_VABI sceVdecswTrySyncDecodeInput(std::uint64_t, InputResult*);
-int APS5_VABI sceVdecswSyncDecodeInput(std::uint64_t, InputResult*);
-int APS5_VABI sceVdecswSetDecodeOutput(std::uint64_t, const FrameBuffer*);
-int APS5_VABI sceVdecswTrySyncDecodeOutput(std::uint64_t, OutputInfo*);
-int APS5_VABI sceVdecswSyncDecodeOutput(std::uint64_t, OutputInfo*);
-int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo*, Vp9PictureInfo*);
-int APS5_VABI sceVdecswGetAvcPictureInfo(const OutputInfo*, AvcPictureInfo*, AvcPictureInfo*);
-int APS5_VABI sceVdecswGetHevcPictureInfo(const OutputInfo*, HevcPictureInfo*);
-int APS5_VABI sceVdecswFinalizeDecodeSequence(std::uint64_t);
-int APS5_VABI sceVdecswResetDecoder(std::uint64_t);
-}
+static_assert(sizeof(SceVdecsw::DecoderConfigInfo) == 0x50 && sizeof(OutputInfo) == 0x38 && offsetof(OutputInfo, isLastFrame) == 9 && offsetof(OutputInfo, pictureCount) == 0xb && sizeof(AvcPictureInfo) == 0x78);
 
 namespace {
 
+using namespace SceVdecsw;
+
 using namespace H264Fixture;
 using namespace HevcFixture;
 using namespace Vp9Fixture;
@@ -221,14 +43,14 @@ void check(bool condition, const std::string& message) {
 struct Session {
     std::uint64_t queue = 0;
     std::uint64_t decoder = 0;
-    DecoderMemoryInfo memory{sizeof(DecoderMemoryInfo)};
+    SceVideodec2::DecoderMemoryInfo memory{sizeof(SceVideodec2::DecoderMemoryInfo)};
 
     explicit Session(std::uint32_t codec = CodecAvc, std::uint32_t profile = 100, std::uint32_t level = 42) {
-        ComputeMemoryInfo compute{sizeof(ComputeMemoryInfo)};
+        SceVideodec2::ComputeMemoryInfo compute{sizeof(SceVideodec2::ComputeMemoryInfo)};
         check(sceVdecswQueryComputeMemoryInfo(&compute) == 0 && compute.cpuGpuMemorySize != 0, "compute memory query failed");
-        const ComputeConfigInfo computeConfig{sizeof(ComputeConfigInfo), 3, 3, true};
+        const SceVideodec2::ComputeConfigInfo computeConfig{sizeof(SceVideodec2::ComputeConfigInfo), 3, 3, true};
         check(sceVdecswAllocateComputeQueue(&computeConfig, &compute, &queue) == 0, "compute queue allocation failed");
-        DecoderConfigInfo config{sizeof(DecoderConfigInfo), 1, codec, profile, level, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3, queue, 0x3f, 0, true, {}};
+        SceVdecsw::DecoderConfigInfo config{{sizeof(SceVdecsw::DecoderConfigInfo), 1, codec, profile, level, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3}, queue, 0x3f, 0, true, {}};
         check(sceVdecswQueryDecoderMemoryInfo(&config, &memory) == 0 && memory.maxFrameBufferSize != 0, "decoder memory query failed");
         check(sceVdecswCreateDecoder(&config, &memory, &decoder) == 0, "decoder creation failed");
     }
@@ -236,9 +58,106 @@ struct Session {
     ~Session() {
         sceVdecswDeleteDecoder(decoder);
         sceVdecswReleaseComputeQueue(queue);
+
     }
 };
 
+template <typename TAction>
+bool throws(TAction action) {
+    try {
+        action();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+template <typename TInfo>
+void checkGenericPictureInfo(const OutputInfo& output, const TInfo& typed) {
+    const std::array<std::uint64_t, 7> sizes{8, 9, 0x28, sizeof(TInfo) - 1, sizeof(TInfo), sizeof(TInfo) + 16, std::numeric_limits<std::uint64_t>::max()};
+    for (const auto size : sizes) {
+        std::array<std::uint8_t, sizeof(TInfo) + 32> storage;
+        storage.fill(0xcc);
+        std::memcpy(storage.data() + 1, &size, sizeof(size));
+        auto expected = storage;
+        const auto copied = std::min<std::uint64_t>(size, sizeof(TInfo)) - sizeof(size);
+        std::memcpy(expected.data() + 1 + sizeof(size), reinterpret_cast<const std::uint8_t*>(&typed) + sizeof(size), copied);
+        auto second = storage;
+        const auto secondBefore = second;
+        check(sceVdecswGetPictureInfo(&output, storage.data() + 1, second.data()) == 0, "generic picture info query failed");
+        check(storage == expected && second == secondBefore, "generic picture info bytes, size or guards differ");
+    }
+    for (std::uint64_t size = 0; size < sizeof(size); ++size) {
+        auto tooSmall = typed;
+        tooSmall.thisSize = size;
+        const auto before = tooSmall;
+        check(throws([&] { sceVdecswGetPictureInfo(&output, &tooSmall, nullptr); }), "generic picture info accepted an undersized size field");
+        check(std::memcmp(&tooSmall, &before, sizeof(tooSmall)) == 0, "an invalid generic query changed its output");
+    }
+    auto second = typed;
+    const auto secondBefore = second;
+    check(sceVdecswGetPictureInfo(&output, nullptr, &second) == 0, "generic picture info rejected a null first output");
+    check(std::memcmp(&second, &secondBefore, sizeof(second)) == 0, "generic picture info wrote a nonexistent second picture");
+    auto shorter = output;
+    shorter.thisSize = sizeof(OutputInfo) - 8;
+    auto actual = typed;
+    check(sceVdecswGetPictureInfo(&shorter, &actual, nullptr) == 0 && std::memcmp(&actual, &typed, sizeof(actual)) == 0, "generic picture info rejected the shorter output descriptor");
+}
+
+void testGenericPictureInfoValidation() {
+    OutputInfo output{sizeof(OutputInfo)};
+    std::array<std::uint64_t, 8> first;
+    first.fill(0xccccccccccccccccull);
+    const auto before = first;
+    auto second = first;
+    check(throws([&] { sceVdecswGetPictureInfo(nullptr, first.data(), second.data()); }), "generic picture info accepted a null output descriptor");
+    check(first == before && second == before, "a null descriptor changed picture info");
+    check(sceVdecswGetPictureInfo(&output, first.data(), second.data()) == 0 && first == before && second == before, "an empty output changed picture info");
+    check(sceVdecswGetPictureInfo(&output, nullptr, nullptr) == 0, "an empty output required picture-info pointers");
+    for (const auto size : {0ull, 0x28ull, 0x31ull, 0x40ull, 0x100000038ull}) {
+        output.thisSize = size;
+        check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), second.data()); }) && first == before && second == before, "generic picture info accepted an invalid descriptor size");
+    }
+    output.thisSize = sizeof(OutputInfo);
+    first[0] = sizeof(first);
+    const auto firstBefore = first;
+    output.pictureCount = 1;
+    output.frameBuffer = first.data();
+    check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), nullptr); }) && first == firstBefore, "generic picture info accepted a foreign frame buffer");
+    output.frameBuffer = nullptr;
+    check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), nullptr); }) && first == firstBefore, "generic picture info accepted a null frame buffer");
+}
+
+void testGenericPictureInfoLifetime() {
+    OutputInfo output{sizeof(OutputInfo)};
+    std::vector<std::uint8_t> buffer;
+    {
+        Session session;
+        buffer.resize(session.memory.maxFrameBufferSize);
+        const auto units = accessUnits(false);
+        for (std::uint64_t iteration = 0; iteration < 2; ++iteration) {
+            const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000 + iteration, iteration, 0xa0 + iteration};
+            check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "generic lifetime input failed");
+            InputResult consumed{sizeof(InputResult)};
+            check(sceVdecswSyncDecodeInput(session.decoder, &consumed) == 0, "generic lifetime input was not consumed");
+            const FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size()};
+            check(sceVdecswSetDecodeOutput(session.decoder, &frame) == 0, "generic lifetime buffer failed");
+            check(sceVdecswFinalizeDecodeSequence(session.decoder) == 0, "generic lifetime finalize failed");
+            check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid, "generic lifetime picture missing");
+            AvcPictureInfo info{sizeof(AvcPictureInfo)};
+            check(sceVdecswGetPictureInfo(&output, &info, nullptr) == 0 && info.ptsData == input.ptsData && info.dtsData == iteration && info.attachedData == input.attachedData, "generic picture info retained stale timestamps");
+            if (iteration == 0) {
+                check(sceVdecswResetDecoder(session.decoder) == 0, "generic lifetime reset failed");
+                const auto before = info;
+                check(throws([&] { sceVdecswGetPictureInfo(&output, &info, nullptr); }) && std::memcmp(&info, &before, sizeof(info)) == 0, "generic AVC picture info survived a decoder reset");
+            }
+        }
+    }
+    AvcPictureInfo info{sizeof(AvcPictureInfo)};
+    const auto before = info;
+    check(throws([&] { sceVdecswGetPictureInfo(&output, &info, nullptr); }) && std::memcmp(&info, &before, sizeof(info)) == 0, "generic picture info survived decoder destruction");
+}
+
 void testDecode() {
     Session session;
     const auto units = accessUnits(false);
@@ -271,6 +190,7 @@ void testDecode() {
             check(!output.isErrorFrame && !output.isDiscardedFrame && output.pictureCount == 1 && output.frameWidth == Width && output.frameHeight == CodedHeight && output.frameBuffer == buffers[pictures % 2].data(), "unexpected picture geometry");
             AvcPictureInfo info{sizeof(AvcPictureInfo)};
             check(sceVdecswGetAvcPictureInfo(&output, &info, nullptr) == 0 && info.isValid, "picture info missing");
+            checkGenericPictureInfo(output, info);
             const auto unit = DisplayOrderUnits[pictures];
             check(info.ptsData == 1000 + unit && info.dtsData == unit && info.attachedData == 0xa0 + unit && info.idrPictureFlag == (pictures == 0 ? 1 : 0) && info.profileIdc == 100, "pictures out of display order");
             check(info.picWidthInMbsMinus1 == Width / 16 - 1 && info.picHeightInMapUnitsMinus1 == CodedHeight / 16 - 1 && info.frameMbsOnlyFlag == 1 && info.frameCroppingFlag == 1 && info.frameCropLeftOffset == 0 && info.frameCropRightOffset == 0 && info.frameCropTopOffset == 0 && info.frameCropBottomOffset == (CodedHeight - Height) / 2, "picture geometry in the picture info is wrong");
@@ -280,7 +200,7 @@ void testDecode() {
     };
     std::uint32_t produced = 0;
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
         InputResult consumed{sizeof(InputResult)};
         check(sceVdecswTrySyncDecodeInput(session.decoder, &consumed) == 0 && consumed.decodedAu == units[unit].data(), "an access unit was not consumed");
@@ -317,6 +237,7 @@ void testHevc() {
             check(pictures < HevcHashes.size() && output.codecType == CodecHevc && output.pictureCount == 1 && output.frameWidth == Width && output.frameHeight == Height, "unexpected HEVC picture geometry");
             HevcPictureInfo info{sizeof(HevcPictureInfo)};
             check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "HEVC picture info missing");
+            checkGenericPictureInfo(output, info);
             const auto unit = HevcDisplayOrderUnits[pictures];
             check(info.ptsData == 1000 + unit && info.dtsData == unit && info.attachedData == 0xa0 + unit, "HEVC pictures out of display order");
             check(info.idrPictureFlag == (pictures == 0 ? 1 : 0) && info.irapPictureFlag == (pictures == 0 ? 1 : 0), "HEVC random access flags differ");
@@ -326,6 +247,7 @@ void testHevc() {
             bool avcThrows = false;
             try {
                 sceVdecswGetAvcPictureInfo(&output, &avc, nullptr);
+
             } catch (const std::exception&) {
                 avcThrows = true;
             }
@@ -335,7 +257,7 @@ void testHevc() {
         }
     };
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "HEVC decode input was rejected");
         InputResult consumed{sizeof(InputResult)};
         check(sceVdecswTrySyncDecodeInput(session.decoder, &consumed) == 0 && consumed.decodedAu == units[unit].data(), "an HEVC access unit was not consumed");
@@ -351,7 +273,7 @@ void testHevcCrop() {
     std::vector<std::uint8_t> buffer(session.memory.maxFrameBufferSize);
     const FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size()};
     check(sceVdecswSetDecodeOutput(session.decoder, &frame) == 0, "cropped HEVC output buffer was rejected");
-    const InputData input{sizeof(InputData), HevcCroppedStream.data(), HevcCroppedStream.size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), HevcCroppedStream.data(), HevcCroppedStream.size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "cropped HEVC decode input was rejected");
     InputResult consumed{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &consumed) == 0, "the cropped HEVC access unit was not consumed");
@@ -360,6 +282,7 @@ void testHevcCrop() {
     check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid && output.frameWidth == 64 && output.frameHeight == 40, "unexpected cropped HEVC picture geometry");
     HevcPictureInfo info{sizeof(HevcPictureInfo)};
     check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "cropped HEVC picture info missing");
+    checkGenericPictureInfo(output, info);
     check(info.picWidthInLumaSamples == 64 && info.picHeightInLumaSamples == 40, "cropped HEVC coded size differs");
     check(info.conformanceWindowFlag == 1 && info.confWinLeftOffset == 0 && info.confWinRightOffset == 0 && info.confWinTopOffset == 0 && info.confWinBottomOffset == 2, "HEVC conformance window differs");
     check(info.frameCroppingFlag == 1 && info.frameCropLeftOffset == 0 && info.frameCropRightOffset == 0 && info.frameCropTopOffset == 0 && info.frameCropBottomOffset == 2, "HEVC frame cropping differs");
@@ -368,7 +291,7 @@ void testHevcCrop() {
 void testWithoutOutput() {
     Session session;
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
     InputResult result{sizeof(InputResult)};
     check(sceVdecswTrySyncDecodeInput(session.decoder, &result) == 0 && result.decodedAu == units[0].data(), "an input was not decoded before an output buffer was set");
@@ -388,7 +311,7 @@ void testSyncWrappers() {
     InputResult idle{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &idle) == InputQueueEmpty, "sync input on an idle decoder did not report an empty queue");
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
     InputResult result{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &result) == 0 && result.decodedAu == units[0].data(), "sync input did not consume the access unit");
@@ -402,6 +325,7 @@ void testSyncWrappers() {
     bool hevcThrows = false;
     try {
         sceVdecswGetHevcPictureInfo(&output, &hevc);
+
     } catch (const std::exception&) {
         hevcThrows = true;
     }
@@ -411,14 +335,14 @@ void testSyncWrappers() {
 struct Vp9Session {
     std::uint64_t queue = 0;
     std::uint64_t decoder = 0;
-    DecoderMemoryInfo memory{sizeof(DecoderMemoryInfo)};
+    SceVideodec2::DecoderMemoryInfo memory{sizeof(SceVideodec2::DecoderMemoryInfo)};
 
     Vp9Session() {
-        ComputeMemoryInfo compute{sizeof(ComputeMemoryInfo)};
+        SceVideodec2::ComputeMemoryInfo compute{sizeof(SceVideodec2::ComputeMemoryInfo)};
         check(sceVdecswQueryComputeMemoryInfo(&compute) == 0 && compute.cpuGpuMemorySize != 0, "compute memory query failed");
-        const ComputeConfigInfo computeConfig{sizeof(ComputeConfigInfo), 3, 3, true};
+        const SceVideodec2::ComputeConfigInfo computeConfig{sizeof(SceVideodec2::ComputeConfigInfo), 3, 3, true};
         check(sceVdecswAllocateComputeQueue(&computeConfig, &compute, &queue) == 0, "compute queue allocation failed");
-        DecoderConfigInfo config{sizeof(DecoderConfigInfo), 1, CodecVp9, 0, 0, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3, queue, 0x3f, 0, true, {}};
+        SceVdecsw::DecoderConfigInfo config{{sizeof(SceVdecsw::DecoderConfigInfo), 1, CodecVp9, 0, 0, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3}, queue, 0x3f, 0, true, {}};
         check(sceVdecswQueryDecoderMemoryInfo(&config, &memory) == 0 && memory.maxFrameBufferSize != 0, "VP9 decoder memory query failed");
         check(sceVdecswCreateDecoder(&config, &memory, &decoder) == 0, "VP9 decoder creation failed");
     }
@@ -426,33 +350,24 @@ struct Vp9Session {
     ~Vp9Session() {
         sceVdecswDeleteDecoder(decoder);
         sceVdecswReleaseComputeQueue(queue);
+
     }
 };
 
-template <typename TAction>
-bool throws(TAction action) {
-    try {
-        action();
-    } catch (const std::exception&) {
-        return true;
-    }
-    return false;
-}
-
-Vp9PictureInfo sentinelVp9Info(std::uint64_t size = sizeof(Vp9PictureInfo)) {
-    Vp9PictureInfo info;
+SceVideodec2::Vp9PictureInfo sentinelVp9Info(std::uint64_t size = sizeof(SceVideodec2::Vp9PictureInfo)) {
+    SceVideodec2::Vp9PictureInfo info;
     std::memset(&info, 0xcc, sizeof(info));
     info.thisSize = size;
     return info;
 }
 
-bool sameBytes(const Vp9PictureInfo& left, const Vp9PictureInfo& right) {
-    return std::memcmp(&left, &right, sizeof(Vp9PictureInfo)) == 0;
+bool sameBytes(const SceVideodec2::Vp9PictureInfo& left, const SceVideodec2::Vp9PictureInfo& right) {
+    return std::memcmp(&left, &right, sizeof(SceVideodec2::Vp9PictureInfo)) == 0;
 }
 
-void checkVp9Info(const Vp9PictureInfo& info, std::size_t picture) {
+void checkVp9Info(const SceVideodec2::Vp9PictureInfo& info, std::size_t picture) {
     const std::string name = "VP9 picture " + std::to_string(picture);
-    check(info.thisSize == sizeof(Vp9PictureInfo) && info.isValid, name + " has no picture info");
+    check(info.thisSize == sizeof(SceVideodec2::Vp9PictureInfo) && info.isValid, name + " has no picture info");
     check(info.ptsData == 1000 + picture && info.dtsData == picture && info.attachedData == 0xa0 + picture, name + " timestamps differ");
     check(info.profile == 0 && info.bitDepth == 8 && info.colorRange == 0 && info.colorSpace == 0 && info.numFrames == 1 && info.intraOnly == 0, name + " coded header fields differ");
     check(info.keyFrameFlag == (picture == 0 ? 1u : 0u), name + " key frame flag differs");
@@ -490,6 +405,7 @@ void testVp9PictureInfo() {
             check(output.codecType == CodecVp9 && output.pictureCount == 1 && output.frameWidth == Width && output.frameHeight == Height && output.frameBuffer == target.data(), "unexpected VP9 picture geometry");
             auto info = sentinelVp9Info();
             check(sceVdecswGetVp9PictureInfo(&output, &info) == 0, "VP9 picture info query failed");
+            checkGenericPictureInfo(output, info);
             checkVp9Info(info, pictures);
             check(hashNv12(target.data(), output.framePitch, output.frameHeight) == Vp9Hashes[pictures], "VP9 picture " + std::to_string(pictures) + " differs from the reference");
             outputs[pictures] = output;
@@ -497,7 +413,7 @@ void testVp9PictureInfo() {
         }
     };
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "VP9 decode input was rejected");
         InputResult consumed{sizeof(InputResult)};
         check(sceVdecswTrySyncDecodeInput(session.decoder, &consumed) == 0 && consumed.decodedAu == units[unit].data(), "a VP9 access unit was not consumed");
@@ -511,6 +427,7 @@ void testVp9PictureInfo() {
         auto info = sentinelVp9Info();
         check(sceVdecswGetVp9PictureInfo(&outputs[picture], &info) == 0, "VP9 picture info of an earlier picture was lost");
         checkVp9Info(info, picture);
+        checkGenericPictureInfo(outputs[picture], info);
     }
 
     const auto unchanged = sentinelVp9Info();
@@ -533,21 +450,21 @@ void testVp9PictureInfo() {
     unknown.frameBuffer = nullptr;
     check(throws([&] { sceVdecswGetVp9PictureInfo(&unknown, &info); }) && sameBytes(info, unchanged), "a null frame buffer was accepted");
 
-    const auto head = offsetof(Vp9PictureInfo, profile);
+    const auto head = offsetof(SceVideodec2::Vp9PictureInfo, profile);
     auto partial = sentinelVp9Info(head);
     check(sceVdecswGetVp9PictureInfo(&outputs[2], &partial) == 0, "a VP9 picture info with a short size field was rejected");
     check(partial.thisSize == head && partial.isValid && partial.ptsData == 1002 && partial.dtsData == 2 && partial.attachedData == 0xa2, "the leading VP9 picture info fields were not written");
     check(partial.profile == unchanged.profile && partial.frameWidth == unchanged.frameWidth && partial.renderHeight == unchanged.renderHeight, "a VP9 picture info with a short size field was written beyond it");
 
     struct Oversized {
-        Vp9PictureInfo info;
+        SceVideodec2::Vp9PictureInfo info;
         std::uint8_t tail[64];
     } oversized;
     std::memset(&oversized, 0xcc, sizeof(oversized));
     oversized.info.thisSize = sizeof(Oversized);
     check(sceVdecswGetVp9PictureInfo(&outputs[3], &oversized.info) == 0, "a VP9 picture info with a long size field was rejected");
     check(oversized.info.thisSize == sizeof(Oversized), "a long VP9 picture info size field was changed");
-    oversized.info.thisSize = sizeof(Vp9PictureInfo);
+    oversized.info.thisSize = sizeof(SceVideodec2::Vp9PictureInfo);
     checkVp9Info(oversized.info, 3);
     for (const auto byte : oversized.tail) check(byte == 0xcc, "a VP9 picture info with a long size field was written beyond the structure");
 
@@ -556,12 +473,13 @@ void testVp9PictureInfo() {
 
     check(sceVdecswResetDecoder(session.decoder) == 0, "VP9 reset failed");
     check(throws([&] { sceVdecswGetVp9PictureInfo(&outputs[0], &info); }) && sameBytes(info, unchanged), "VP9 picture info survived a decoder reset");
+    check(throws([&] { sceVdecswGetPictureInfo(&outputs[0], &info, nullptr); }) && sameBytes(info, unchanged), "generic picture info survived a decoder reset");
 }
 
 void testVp9PictureInfoOfAvcPicture() {
     Session session;
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
     InputResult result{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &result) == 0, "the access unit was not consumed");
@@ -583,7 +501,7 @@ void testHevcMain10() {
     std::vector<std::uint8_t> buffer(session.memory.maxFrameBufferSize);
     const FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size()};
     check(sceVdecswSetDecodeOutput(session.decoder, &frame) == 0, "Main 10 HEVC output buffer was rejected");
-    const InputData input{sizeof(InputData), HevcMain10Stream.data(), HevcMain10Stream.size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), HevcMain10Stream.data(), HevcMain10Stream.size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "Main 10 HEVC decode input was rejected");
     InputResult consumed{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &consumed) == 0, "the Main 10 HEVC access unit was not consumed");
@@ -592,11 +510,14 @@ void testHevcMain10() {
     check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid, "the Main 10 HEVC picture was not output");
     HevcPictureInfo info{sizeof(HevcPictureInfo)};
     check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "Main 10 HEVC picture info missing");
+    checkGenericPictureInfo(output, info);
     check(info.generalProfileIdc == 2 && info.bitDepthLumaMinus8 == 2 && info.bitDepthChromaMinus8 == 2, "Main 10 HEVC profile or bit depth differs");
 }
 
 int main() {
     try {
+        testGenericPictureInfoValidation();
+        testGenericPictureInfoLifetime();
         testDecode();
         testHevc();
         testHevcCrop();
diff --git a/core/libs/tests/GuestVectorAlgorithms.cpp b/core/libs/tests/GuestVectorAlgorithms.cpp
index c3b858bac6..99eaebf937 100644
--- a/core/libs/tests/GuestVectorAlgorithms.cpp
+++ b/core/libs/tests/GuestVectorAlgorithms.cpp
@@ -1,30 +1,47 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-struct MinMaxPointers {
-    const void* minimum;
-    const void* maximum;
-};
-
-extern "C" {
-const void* APS5_VABI __std_find_trivial_2_nid_postfix(const void*, const void*, std::uint16_t);
-const void* APS5_VABI __std_find_trivial_unsized_1_nid_postfix(const void*, std::uint8_t);
-const void* APS5_VABI __std_find_trivial_unsized_4_nid_postfix(const void*, std::uint32_t);
-std::size_t APS5_VABI __std_count_trivial_8_nid_postfix(const void*, const void*, std::uint64_t);
-const void* APS5_VABI __std_min_element_1_nid_postfix(const void*, const void*, bool);
-const void* APS5_VABI __std_max_element_4_nid_postfix(const void*, const void*, bool);
-MinMaxPointers APS5_VABI __std_minmax_element_2_nid_postfix(const void*, const void*, bool);
-MinMaxPointers APS5_VABI __std_minmax_element_8_nid_postfix(const void*, const void*, bool);
-void APS5_VABI __std_reverse_trivially_swappable_2_nid_postfix(void*, void*);
-void APS5_VABI __std_reverse_copy_trivially_copyable_8_nid_postfix(const void*, const void*, void*);
-void APS5_VABI __std_swap_ranges_trivially_swappable_noalias_nid_postfix(void*, void*, void*);
-}
 
 static void Require(bool value) { if (!value) std::abort(); }
 
+static void CheckSizedHelpers() {
+    const std::uint8_t bytes[] = {3, 0xff, 3, 9, 0xff};
+    Require(__std_find_trivial_1_nid_postfix(bytes, bytes + 5, 0xff) == bytes + 1);
+    Require(__std_find_trivial_1_nid_postfix(bytes, bytes + 5, 4) == bytes + 5);
+    Require(__std_find_trivial_1_nid_postfix(bytes, bytes, 3) == bytes);
+    Require(__std_count_trivial_1_nid_postfix(bytes, bytes + 5, 3) == 2 && __std_count_trivial_1_nid_postfix(bytes, bytes + 5, 7) == 0);
+    Require(__std_max_element_1_nid_postfix(bytes, bytes + 5, false) == bytes + 1);
+    Require(__std_max_element_1_nid_postfix(bytes, bytes + 5, true) == bytes + 3);
+
+    const std::uint16_t halves[] = {0x8000, 5, 0x7fff, 5, 0x8000};
+    Require(__std_count_trivial_2_nid_postfix(halves, halves + 5, 5) == 2 && __std_count_trivial_2_nid_postfix(halves, halves, 5) == 0);
+    Require(__std_min_element_2_nid_postfix(halves, halves + 5, false) == halves + 1);
+    Require(__std_min_element_2_nid_postfix(halves, halves + 5, true) == halves);
+    Require(__std_max_element_2_nid_postfix(halves, halves + 5, false) == halves);
+    Require(__std_max_element_2_nid_postfix(halves, halves + 5, true) == halves + 2);
+
+    const std::uint32_t words[] = {7, 0xfffffff0u, 1, 1, 0xfffffff0u};
+    Require(__std_find_trivial_4_nid_postfix(words, words + 5, 1) == words + 2);
+    Require(__std_find_trivial_4_nid_postfix(words, words + 5, 2) == words + 5);
+    Require(__std_count_trivial_4_nid_postfix(words, words + 5, 0xfffffff0u) == 2);
+    Require(__std_min_element_4_nid_postfix(words, words + 5, false) == words + 2);
+    Require(__std_min_element_4_nid_postfix(words, words + 5, true) == words + 1);
+    Require(__std_min_element_4_nid_postfix(words, words, true) == words);
+
+    const std::uint64_t wides[] = {0x8000000000000000ull, 2, 0x7fffffffffffffffull, 0x8000000000000000ull};
+    Require(__std_find_trivial_8_nid_postfix(wides, wides + 4, 0x8000000000000000ull) == wides);
+    Require(__std_find_trivial_8_nid_postfix(wides + 1, wides + 4, 0x8000000000000000ull) == wides + 3);
+    Require(__std_min_element_8_nid_postfix(wides, wides + 4, true) == wides);
+    Require(__std_min_element_8_nid_postfix(wides, wides + 4, false) == wides + 1);
+    Require(__std_max_element_8_nid_postfix(wides, wides + 4, false) == wides);
+    Require(__std_max_element_8_nid_postfix(wides, wides + 4, true) == wides + 2);
+    Require(__std_max_element_8_nid_postfix(wides, wides, false) == wides);
+}
+
 static void CheckFindAndCount() {
     const std::uint16_t halves[] = {5, 7, 9, 7};
     Require(__std_find_trivial_2_nid_postfix(halves, halves + 4, 7) == halves + 1);
@@ -48,6 +65,36 @@ static void CheckUnsizedRescan() {
     bytes[3] = 0;
     bytes[20] = 0;
     Require(__std_find_trivial_unsized_1_nid_postfix(bytes + 8, 'x') == bytes + 70);
+
+    alignas(32) std::uint16_t halves[32] = {};
+    halves[0] = 17;
+    halves[4] = 17;
+    halves[20] = 17;
+    Require(__std_find_trivial_unsized_2_nid_postfix(halves + 1, 17) == halves + 4);
+    halves[4] = 0;
+    Require(__std_find_trivial_unsized_2_nid_postfix(halves + 1, 17) == halves);
+    halves[0] = 0;
+    Require(__std_find_trivial_unsized_2_nid_postfix(halves + 1, 17) == halves + 20);
+
+    alignas(32) std::uint32_t quads[16] = {};
+    quads[0] = 42;
+    quads[5] = 42;
+    quads[12] = 42;
+    Require(__std_find_trivial_unsized_4_nid_postfix(quads + 1, 42) == quads + 5);
+    quads[5] = 0;
+    Require(__std_find_trivial_unsized_4_nid_postfix(quads + 1, 42) == quads);
+    quads[0] = 0;
+    Require(__std_find_trivial_unsized_4_nid_postfix(quads + 1, 42) == quads + 12);
+
+    alignas(32) std::uint64_t wides[8] = {};
+    wides[0] = 99;
+    wides[2] = 99;
+    wides[6] = 99;
+    Require(__std_find_trivial_unsized_8_nid_postfix(wides + 1, 99) == wides + 2);
+    wides[2] = 0;
+    Require(__std_find_trivial_unsized_8_nid_postfix(wides + 1, 99) == wides);
+    wides[0] = 0;
+    Require(__std_find_trivial_unsized_8_nid_postfix(wides + 1, 99) == wides + 6);
 }
 
 static void CheckMinMax() {
@@ -73,10 +120,12 @@ static void CheckMinMax() {
 static void CheckReverseAndSwap() {
     std::uint16_t halves[] = {1, 2, 3, 4, 5};
     __std_reverse_trivially_swappable_2_nid_postfix(halves, halves + 5);
+
     Require(halves[0] == 5 && halves[1] == 4 && halves[2] == 3 && halves[3] == 2 && halves[4] == 1);
     const std::uint64_t wides[] = {1, 2, 3};
     std::uint64_t reversed[4] = {9, 9, 9, 9};
     __std_reverse_copy_trivially_copyable_8_nid_postfix(wides, wides + 3, reversed);
+
     Require(reversed[0] == 3 && reversed[1] == 2 && reversed[2] == 1 && reversed[3] == 9);
     unsigned char left[37], right[37];
     for (int i = 0; i < 37; ++i) {
@@ -84,10 +133,12 @@ static void CheckReverseAndSwap() {
         right[i] = static_cast<unsigned char>(100 + i);
     }
     __std_swap_ranges_trivially_swappable_noalias_nid_postfix(left, left + 37, right);
+
     for (int i = 0; i < 37; ++i) Require(left[i] == 100 + i && right[i] == i);
 }
 
 int main() {
+    CheckSizedHelpers();
     CheckFindAndCount();
     CheckUnsizedRescan();
     CheckMinMax();
diff --git a/core/libs/tests/GuestVideoOutColorSpace.cpp b/core/libs/tests/GuestVideoOutColorSpace.cpp
index 1c081f65f9..d794feff72 100644
--- a/core/libs/tests/GuestVideoOutColorSpace.cpp
+++ b/core/libs/tests/GuestVideoOutColorSpace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -8,18 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option);
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutColorSpaceConversionSettings* settings);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size);
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
-int APS5_VABI sceVideoOutSetGlobalBlendSpace(int handle, uint32_t space, uint32_t option);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 
diff --git a/core/libs/tests/GuestVideoOutCursor.cpp b/core/libs/tests/GuestVideoOutCursor.cpp
index 214293bdd2..283d91bccf 100644
--- a/core/libs/tests/GuestVideoOutCursor.cpp
+++ b/core/libs/tests/GuestVideoOutCursor.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -6,13 +7,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceVideoOutCursorEnable(std::int32_t handle, std::int32_t index, const void* address);
-int APS5_VABI sceVideoOutCursorDisable(std::int32_t handle, std::int32_t index);
-int APS5_VABI sceVideoOutCursorSetImageAddress(std::int32_t handle, std::int32_t index, const void* address);
-int APS5_VABI sceVideoOutCursorSetPosition(std::int32_t handle, std::int32_t index, std::uint32_t x, std::uint32_t y);
-}
-
 static bool ReportsNotImplemented(const std::string& name, const std::function<int()>& call) {
     try {
         call();
diff --git a/core/libs/tests/GuestVideoOutHdr.cpp b/core/libs/tests/GuestVideoOutHdr.cpp
index a6e78ed34d..08fc189878 100644
--- a/core/libs/tests/GuestVideoOutHdr.cpp
+++ b/core/libs/tests/GuestVideoOutHdr.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceVideoOut/include/Output.hpp"
+#include "prx/libSceVideoOut/include/Event.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
@@ -14,19 +18,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutGetOutputStatus(int handle, VideoOutOutputStatus* status);
-int APS5_VABI sceVideoOutGetOutputStatusWithVrr(int handle, void* status);
-int APS5_VABI sceVideoOutAddOutputModeEvent(KernelEqueue eq, int handle, void* udata);
-int APS5_VABI sceVideoOutGetEventId(const KernelEvent* ev);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceSystemServiceGetHdrToneMapLuminance(SystemServiceHdrToneMapLuminance* luminance);
-}
-
 namespace {
 
 constexpr int SystemUser = 255;
diff --git a/core/libs/tests/GuestVideoOutHighFrameRate.cpp b/core/libs/tests/GuestVideoOutHighFrameRate.cpp
index 3e4f4c4437..541436b236 100644
--- a/core/libs/tests/GuestVideoOutHighFrameRate.cpp
+++ b/core/libs/tests/GuestVideoOutHighFrameRate.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -7,16 +8,6 @@
 #include <fstream>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int, int, int, const void*);
-int APS5_VABI sceVideoOutClose(int);
-int APS5_VABI sceVideoOutIsOutputSupported(int, std::uint64_t, const VideoOutOutputOptions*, void*, std::uint64_t);
-int APS5_VABI sceVideoOutConfigureOutput(int, std::uint64_t, const VideoOutOutputOptions*, void*, std::uint64_t);
-int APS5_VABI sceVideoOutWaitVblank(int);
-int APS5_VABI sceVideoOutGetOutputStatus(int, VideoOutOutputStatus*);
-int APS5_VABI sceVideoOutGetResolutionStatus(int, VideoOutResolutionStatus*);
-}
-
 static constexpr int Unsupported = static_cast<int>(0x80290016u);
 
 static void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestVideoOutOutputMode.cpp b/core/libs/tests/GuestVideoOutOutputMode.cpp
index 82ce4bc2fa..7c86474ea9 100644
--- a/core/libs/tests/GuestVideoOutOutputMode.cpp
+++ b/core/libs/tests/GuestVideoOutOutputMode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -8,14 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutInitializeOutputOptions(VideoOutOutputOptions* options);
-int APS5_VABI sceVideoOutIsOutputSupported(int handle, std::uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, std::uint64_t reserved);
-int APS5_VABI sceVideoOutConfigureOutput(int handle, std::uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, std::uint64_t reserved);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 static constexpr int HMD2_MAIN_BUS = 0x20;
diff --git a/core/libs/tests/GuestVideoOutResolutionStatus.cpp b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
index e401ad3023..97f0a119a0 100644
--- a/core/libs/tests/GuestVideoOutResolutionStatus.cpp
+++ b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -8,14 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutGetOutputStatus(int handle, VideoOutOutputStatus* status);
-int APS5_VABI sceVideoOutGetOutputStatusWithVrr(int handle, void* status);
-int APS5_VABI sceVideoOutGetResolutionStatus(int handle, VideoOutResolutionStatus* status);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 static constexpr int NEVER_OPENED_HANDLE = 2;
@@ -68,6 +61,7 @@ int main() {
     for (const auto byte : vrr) Require(byte == std::byte{0xff});
 
     Require(Rejects(handle, nullptr));
+    Require(Rejects(-1, nullptr));
     Require(Rejects(0, &status));
     Require(Rejects(-1, &status));
     Require(Rejects(NEVER_OPENED_HANDLE, &status));
diff --git a/core/libs/tests/GuestVideoOutWqhdDetection.cpp b/core/libs/tests/GuestVideoOutWqhdDetection.cpp
index c0e68b0c49..0e543eaade 100644
--- a/core/libs/tests/GuestVideoOutWqhdDetection.cpp
+++ b/core/libs/tests/GuestVideoOutWqhdDetection.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -6,13 +7,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutGetOutputStatus(int handle, VideoOutOutputStatus* status);
-int APS5_VABI sceVideoOutAllowOutputResolutionWqhdDetection(int handle);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 static constexpr int NEVER_OPENED_HANDLE = 2;
diff --git a/core/libs/tests/GuestVideoRecording.cpp b/core/libs/tests/GuestVideoRecording.cpp
index 3338094cac..ff7b12233e 100644
--- a/core/libs/tests/GuestVideoRecording.cpp
+++ b/core/libs/tests/GuestVideoRecording.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,16 +7,6 @@
 #include <cstdlib>
 #include <exception>
 
-extern "C" {
-void APS5_VABI _sceVideoRecordingQueryParam_nid_postfix(void* param);
-int APS5_VABI sceVideoRecordingGetStatus(void);
-int APS5_VABI sceVideoRecordingQueryMemSize(const void* param);
-int APS5_VABI sceVideoRecordingOpen(const char* path, const void* param, void* heap, int heapSize);
-int APS5_VABI sceVideoRecordingStart(void);
-int APS5_VABI sceVideoRecordingStop(void);
-int APS5_VABI sceVideoRecordingClose(int discard);
-}
-
 namespace {
 
 constexpr int StatusNone = 0;
@@ -49,10 +40,10 @@ int main() {
     std::array<std::uint8_t, 64> heap{};
     heap.fill(Sentinel);
 
-    Require(Throws([&] { _sceVideoRecordingQueryParam_nid_postfix(param.data()); }), "the default parameters were produced");
-    Require(Throws([&] { sceVideoRecordingQueryMemSize(param.data()); }), "a heap size was reported");
+    Require(Throws([&] { _sceVideoRecordingQueryParam_nid_postfix(reinterpret_cast<VideoRecordingQueryParam*>(param.data())); }), "the default parameters were produced");
+    Require(Throws([&] { sceVideoRecordingQueryMemSize(reinterpret_cast<const VideoRecordingParam*>(param.data())); }), "a heap size was reported");
     Require(Throws([&] { sceVideoRecordingQueryMemSize(nullptr); }), "a heap size was reported for no parameters");
-    Require(Throws([&] { sceVideoRecordingOpen("clip.mp4", param.data(), heap.data(), static_cast<int>(heap.size())); }), "the recorder opened");
+    Require(Throws([&] { sceVideoRecordingOpen("clip.mp4", reinterpret_cast<const VideoRecordingParam*>(param.data()), heap.data(), static_cast<int>(heap.size())); }), "the recorder opened");
     Require(Throws([&] { sceVideoRecordingStart(); }), "the encoder started");
     Require(Throws([&] { sceVideoRecordingStop(); }), "the encoder stopped");
     Require(Throws([&] { sceVideoRecordingClose(0); }), "the recorder closed");
@@ -62,6 +53,9 @@ int main() {
     for (const std::uint8_t value : heap) Require(value == Sentinel, "the heap was written");
     Require(sceVideoRecordingGetStatus() == StatusNone, "a failed open changed the status");
 
+    Require(sceVideoRecordingGetInfo(0xa001, nullptr, 0) == static_cast<int>(0x80a80006), "info 0xa001 validation");
+    Require(sceVideoRecordingGetInfo(0xa005, nullptr, 0) == static_cast<int>(0x80a80006), "info 0xa005 validation");
+    Require(sceVideoRecordingGetInfo(0, nullptr, 0) == static_cast<int>(0x80a80003), "unknown info validation");
     std::puts("VideoRecording tests passed");
     return 0;
 }
diff --git a/core/libs/tests/GuestVideodec.cpp b/core/libs/tests/GuestVideodec.cpp
index 894d6f96ee..236336d978 100644
--- a/core/libs/tests/GuestVideodec.cpp
+++ b/core/libs/tests/GuestVideodec.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#include "prx/libSceVideodec/include/Api.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <stdexcept>
@@ -6,123 +8,16 @@
 #include "prx/libc/include/General.hpp"
 #include "H264Fixture.hpp"
 
-struct ConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint64_t videodecFlags;
-};
-
-struct ResourceInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct Ctrl {
-    std::uint64_t thisSize;
-    void* handle;
-    std::uint64_t version;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct AvcInfo {
-    std::uint32_t numUnitsInTick;
-    std::uint32_t timeScale;
-    std::uint8_t fixedFrameRateFlag;
-    std::uint8_t aspectRatioIdc;
-    std::uint16_t sarWidth;
-    std::uint16_t sarHeight;
-    std::uint8_t colourPrimaries;
-    std::uint8_t transferCharacteristics;
-    std::uint8_t matrixCoefficients;
-    std::uint8_t videoFullRangeFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-};
-
-union CodecInfo {
-    std::uint8_t reserved[64];
-    AvcInfo avc;
-};
-
-struct PictureInfo {
-    std::uint64_t thisSize;
-    std::uint32_t isValid;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    std::uint32_t isErrorPic;
-    std::uint64_t ptsData;
-    std::uint64_t attachedData;
-    CodecInfo codec;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct Decoder2ConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-};
-
-struct Decoder2MemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
+using namespace SceVideodec;
 
 static_assert(sizeof(PictureInfo) == 112 && sizeof(AvcInfo) == 36);
 static_assert(sizeof(ConfigInfo) == 40 && sizeof(ResourceInfo) == 56 && sizeof(Ctrl) == 24);
-static_assert(sizeof(Decoder2ConfigInfo) == 40 && sizeof(Decoder2MemoryInfo) == 72);
-
-extern "C" {
-int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo*, const ResourceInfo*, Ctrl*);
-int APS5_VABI sceVideodecDecode(Ctrl*, const InputData*, FrameBuffer*, PictureInfo*);
-int APS5_VABI sceVideodecDeleteDecoder(Ctrl*);
-int APS5_VABI sceVideodecFlush(Ctrl*, FrameBuffer*, PictureInfo*);
-int APS5_VABI sceVideodecReset(Ctrl*);
-int APS5_VABI sceVideodecQueryResourceInfo(const ConfigInfo*, ResourceInfo*);
-int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const Decoder2ConfigInfo*, Decoder2MemoryInfo*);
-}
+static_assert(sizeof(SceVideodec2::DecoderConfigInfo) == 40 && sizeof(SceVideodec2::DecoderMemoryInfo) == 72);
 
 namespace {
 
+using namespace SceVideodec;
+
 using namespace H264Fixture;
 
 constexpr int ErrorApiFail = static_cast<int>(0x80C10000);
@@ -176,7 +71,7 @@ void testDecode(const std::vector<std::vector<std::uint8_t>>& units, std::uint32
         timestamps.push_back(picture.ptsData);
     };
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         auto target = session.MakeTarget();
         PictureInfo picture{sizeof(PictureInfo)};
         const auto status = sceVideodecDecode(&session.ctrl, &input, &target, &picture);
@@ -221,22 +116,22 @@ void testErrors() {
     foreign.handle = reinterpret_cast<void*>(static_cast<std::uintptr_t>(0x1234));
     check(sceVideodecDeleteDecoder(&foreign) == ErrorHandle, "an unknown decoder was deleted");
     check(sceVideodecReset(&foreign) == ErrorHandle, "an unknown decoder was reset");
-    const InputData empty{sizeof(InputData), nullptr, 0, 0, 0, 0};
+    const SceVideodec2::InputData empty{sizeof(SceVideodec2::InputData), nullptr, 0, 0, 0, 0};
     FrameBuffer frame{sizeof(FrameBuffer), nullptr, 0};
     PictureInfo picture{sizeof(PictureInfo)};
     check(sceVideodecDecode(nullptr, &empty, &frame, &picture) == ErrorArgumentPointer, "a null control block was accepted");
     check(sceVideodecDecode(&ctrl, &empty, &frame, &picture) == ErrorAuPointer, "a null access unit was accepted");
-    const InputData sized{sizeof(InputData), reinterpret_cast<const std::uint8_t*>(&config), 0, 0, 0, 0};
+    const SceVideodec2::InputData sized{sizeof(SceVideodec2::InputData), reinterpret_cast<const std::uint8_t*>(&config), 0, 0, 0, 0};
     check(sceVideodecDecode(&ctrl, &sized, &frame, &picture) == ErrorAuSize, "an empty access unit was accepted");
     FrameBuffer missing{sizeof(FrameBuffer), nullptr, FrameBytes};
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 0, 0, 0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 0, 0, 0};
     check(sceVideodecDecode(&ctrl, &input, &missing, &picture) == ErrorFrameBufferPointer, "a null frame buffer was accepted");
     std::vector<std::uint8_t> storage(static_cast<std::size_t>(FrameBytes));
     FrameBuffer shortBuffer{sizeof(FrameBuffer), storage.data(), FrameBytes - 1};
     int refusals = 0;
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData unit0{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData unit0{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         const auto status = sceVideodecDecode(&ctrl, &unit0, &shortBuffer, &picture);
         check(status == 0 || status == ErrorFrameBufferSize, "a decode failed");
         if (status == ErrorFrameBufferSize) ++refusals;
@@ -249,7 +144,7 @@ void testErrors() {
 void testReset() {
     Session session;
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     auto target = session.MakeTarget();
     PictureInfo picture{sizeof(PictureInfo)};
     check(sceVideodecDecode(&session.ctrl, &input, &target, &picture) == 0, "decode failed");
@@ -262,8 +157,8 @@ void testQueryResourceInfo(std::int32_t width, std::int32_t height, std::uint32_
     const ConfigInfo config{sizeof(ConfigInfo), 1, profile, level, width, height, 4, 0};
     ResourceInfo resource{sizeof(ResourceInfo)};
     check(sceVideodecQueryResourceInfo(&config, &resource) == 0, "the resource query failed");
-    const Decoder2ConfigInfo mapped{sizeof(Decoder2ConfigInfo), 1, 1, profile, level, width, height, 4, 1};
-    Decoder2MemoryInfo memory{sizeof(Decoder2MemoryInfo)};
+    const SceVideodec2::DecoderConfigInfo mapped{sizeof(SceVideodec2::DecoderConfigInfo), 1, 1, profile, level, width, height, 4, 1};
+    SceVideodec2::DecoderMemoryInfo memory{sizeof(SceVideodec2::DecoderMemoryInfo)};
     check(sceVideodec2QueryDecoderMemoryInfo_nid_postfix(&mapped, &memory) == 0, "the Videodec2 memory query failed");
     check(resource.thisSize == sizeof(ResourceInfo), "the resource information size was changed");
     check(resource.cpuMemorySize == memory.cpuMemorySize, "the CPU memory size differs from libSceVideodec2");
diff --git a/core/libs/tests/GuestVideodec2.cpp b/core/libs/tests/GuestVideodec2.cpp
index 565f4454b4..f6caa14b4b 100644
--- a/core/libs/tests/GuestVideodec2.cpp
+++ b/core/libs/tests/GuestVideodec2.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -14,111 +15,15 @@
 #include "HevcFixture.hpp"
 #include "Vp9Fixture.hpp"
 
-struct DecoderConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-};
-
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
+using namespace SceVideodec2;
 
 static_assert(sizeof(Vp9PictureInfo) == 88);
 static_assert(offsetof(Vp9PictureInfo, colorSpace) == 60);
 
-extern "C" {
-int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const DecoderConfigInfo*, DecoderMemoryInfo*);
-int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const DecoderConfigInfo*, const DecoderMemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t, const InputData*, FrameBuffer*, OutputInfo*);
-int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t, FrameBuffer*, OutputInfo*);
-int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2GetPictureInfo_nid_postfix(const OutputInfo*, AvcPictureInfo*, void*);
-int APS5_VABI sceVideodec2GetVp9PictureInfo_nid_postfix(const OutputInfo*, Vp9PictureInfo*);
-int APS5_VABI sceVideodec2GetAvcPictureInfo_nid_postfix(const OutputInfo*, AvcPictureInfo*, AvcPictureInfo*);
-}
-
 namespace {
 
+using namespace SceVideodec2;
+
 using namespace H264Fixture;
 using namespace HevcFixture;
 
@@ -173,7 +78,6 @@ void check(bool condition, const std::string& message) {
     if (!condition) throw std::runtime_error(message);
 }
 
-
 template <typename TAction>
 void checkThrows(TAction action) {
     bool threw = false;
@@ -217,8 +121,10 @@ void testFailures() {
             input.auData = unit.data();
             input.auSize = unit.size();
             sceVideodec2Decode_nid_postfix(handle, &input, &frame, &output);
+
         }
         sceVideodec2Flush_nid_postfix(handle, &frame, &output);
+
     });
     check(sceVideodec2DeleteDecoder_nid_postfix(handle) == 0, "delete failed");
 }
diff --git a/core/libs/tests/GuestVideodec2Unimplemented.cpp b/core/libs/tests/GuestVideodec2Unimplemented.cpp
index 6f2fc0ef0a..25eb1d8a77 100644
--- a/core/libs/tests/GuestVideodec2Unimplemented.cpp
+++ b/core/libs/tests/GuestVideodec2Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
@@ -5,22 +6,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceVideodec2TermLibrary();
-int APS5_VABI sceVideodec2QueryLibraryInfo();
-int APS5_VABI sceVideodec2QueryDecoderInfo();
-int APS5_VABI sceVideodec2MapMemory();
-int APS5_VABI sceVideodec2MapDirectMemory(void* decoder, const void* memory);
-int APS5_VABI sceVideodec2PresetDecoderConfigInfo();
-int APS5_VABI sceVideodec2PresetDecoderConfigInfoAvc();
-int APS5_VABI sceVideodec2PresetDecoderConfigInfoHevc();
-int APS5_VABI sceVideodec2PresetDecoderConfigInfoVp9();
-int APS5_VABI sceVideodec2CreateDecoderBid();
-int APS5_VABI sceVideodec2CreateHevcDecoder();
-int APS5_VABI sceVideodec2QueryHevcDecoderMemoryInfo();
-int APS5_VABI sceVideodec2GetHevcPictureInfo();
-}
-
 static bool ReportsNotImplemented(const std::string& name, const std::function<int()>& call) {
     try {
         call();
diff --git a/core/libs/tests/GuestVoice.cpp b/core/libs/tests/GuestVoice.cpp
index 2b9e024dcc..112adf8c4d 100644
--- a/core/libs/tests/GuestVoice.cpp
+++ b/core/libs/tests/GuestVoice.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoice/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -9,38 +10,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceVoiceInit(const VoiceInitParam*, std::int32_t);
-int APS5_VABI sceVoiceSetThreadsParams(const VoiceThreadsParams*);
-int APS5_VABI sceVoiceStart(const VoiceStartParam*);
-int APS5_VABI sceVoiceStop();
-int APS5_VABI sceVoiceEnd_nid_postfix();
-int APS5_VABI sceVoiceCreatePort(std::uint32_t*, const VoicePortParam*);
-int APS5_VABI sceVoiceDeletePort(std::uint32_t);
-int APS5_VABI sceVoiceConnectIPortToOPort(std::uint32_t, std::uint32_t);
-int APS5_VABI sceVoiceDisconnectIPortFromOPort(std::uint32_t, std::uint32_t);
-int APS5_VABI sceVoiceGetVolume(std::uint32_t, float*);
-int APS5_VABI sceVoiceSetMuteFlag(std::uint32_t, std::uint8_t);
-int APS5_VABI sceVoiceSetVolume(std::uint32_t, float);
-int APS5_VABI sceVoiceGetBitRate(std::uint32_t, std::uint32_t*);
-int APS5_VABI sceVoiceGetMuteFlag(std::uint32_t, bool*);
-int APS5_VABI sceVoiceGetPortInfo(std::uint32_t, VoicePortInfo*);
-int APS5_VABI sceVoiceReadFromOPort(std::uint32_t, void*, std::uint32_t*);
-int APS5_VABI sceVoiceResetPort(std::uint32_t);
-int APS5_VABI sceVoicePausePort(std::uint32_t);
-int APS5_VABI sceVoiceResumePort(std::uint32_t);
-int APS5_VABI sceVoicePausePortAll(void);
-int APS5_VABI sceVoiceResumePortAll(void);
-int APS5_VABI sceVoiceGetResourceInfo(VoiceResourceInfo*);
-int APS5_VABI sceVoiceEnableChat(void);
-int APS5_VABI sceVoiceDisableChat(void);
-int APS5_VABI sceVoiceInitHQ(const VoiceInitParam*, std::int32_t);
-int APS5_VABI sceVoiceVADSetVersion(std::int32_t);
-int APS5_VABI sceVoiceSetMuteFlagAll(bool);
-int APS5_VABI sceVoiceSetBitRate(std::uint32_t, std::uint32_t);
-int APS5_VABI sceVoiceUpdatePort(std::uint32_t, const VoicePortParam*);
-}
-
 namespace {
 
 constexpr int NotInitialized = static_cast<int>(0x804E0801u);
diff --git a/core/libs/tests/GuestVoiceChat.cpp b/core/libs/tests/GuestVoiceChat.cpp
index 0a94bcefa8..0b80ea67e8 100644
--- a/core/libs/tests/GuestVoiceChat.cpp
+++ b/core/libs/tests/GuestVoiceChat.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoiceChat/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,22 +6,9 @@
 #include <cstdlib>
 
 extern "C" {
-int APS5_VABI sceVoiceChatInitialize(void* param);
-int APS5_VABI sceVoiceChatTerminate(void);
-int APS5_VABI sceVoiceChatRegisterHandlers(void* a);
-int APS5_VABI sceVoiceChatRegisterMicEventHandler(void* a, void* b);
-int APS5_VABI sceVoiceChatRegisterChannelEventHandler(void* a, void* b);
-int APS5_VABI sceVoiceChatUnregisterMicEventHandler(void* a);
-int APS5_VABI sceVoiceChatProcessEvent(void);
-int APS5_VABI sceVoiceChatStartChannelEvent(void* a);
-int APS5_VABI sceVoiceChatStopChannelEvent(void* a);
-int APS5_VABI sceVoiceChatGetMicState(int32_t* state);
-int APS5_VABI sceVoiceChatGetUserVoiceVolumeGain(void* a, int32_t* gain);
-int APS5_VABI sceVoiceChatSetUserVoiceVolumeGain(void* a, int32_t gain);
-int APS5_VABI sceVoiceChatGetActiveChannel(void* channel);
-int APS5_VABI sceVoiceChatCreateRequest(void* a, void* b);
+
 int APS5_VABI sceVoiceChatRequestAcsTts(int requestId, void* a, void* b);
-int APS5_VABI sceVoiceChatAbortRequest(int requestId);
+
 }
 
 static void Require(bool value, const char* what) {
diff --git a/core/libs/tests/GuestVoicePortAttr.cpp b/core/libs/tests/GuestVoicePortAttr.cpp
index ceaa036b65..3bdcc5e6de 100644
--- a/core/libs/tests/GuestVoicePortAttr.cpp
+++ b/core/libs/tests/GuestVoicePortAttr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoice/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -8,14 +9,6 @@
 #include <stdexcept>
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceVoiceInit(const VoiceInitParam*, int32_t);
-int APS5_VABI sceVoiceEnd_nid_postfix(void);
-int APS5_VABI sceVoiceCreatePort(uint32_t*, const VoicePortParam*);
-int APS5_VABI sceVoiceDeletePort(uint32_t);
-int APS5_VABI sceVoiceGetPortAttr(uint32_t, int32_t, void*, int32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
diff --git a/core/libs/tests/GuestVoiceQoS.cpp b/core/libs/tests/GuestVoiceQoS.cpp
index b4d318548e..ebd15d8af0 100644
--- a/core/libs/tests/GuestVoiceQoS.cpp
+++ b/core/libs/tests/GuestVoiceQoS.cpp
@@ -1,36 +1,10 @@
+#include "prx/libSceVoiceQoS/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceVoiceQoSInit(void*, std::uint32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSEnd();
-int APS5_VABI sceVoiceQoSCreateLocalEndpoint(std::int32_t*, std::int32_t, std::int32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSDeleteLocalEndpoint(std::int32_t);
-int APS5_VABI sceVoiceQoSCreateRemoteEndpoint(std::int32_t*);
-int APS5_VABI sceVoiceQoSDeleteRemoteEndpoint(std::int32_t);
-int APS5_VABI sceVoiceQoSConnect(std::int32_t*, std::int32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSDisconnect(std::int32_t);
-int APS5_VABI sceVoiceQoSSetLocalEndpointAttribute(std::int32_t, std::int32_t, const void*, std::int32_t);
-int APS5_VABI sceVoiceQoSSetRemoteEndpointAttribute(std::int32_t, std::int32_t, const void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetLocalEndpointAttribute(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetRemoteEndpointAttribute(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetConnectionAttribute(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetLocalEndpoint(std::int32_t, std::int32_t*);
-int APS5_VABI sceVoiceQoSGetRemoteEndpoint(std::int32_t, std::int32_t*);
-int APS5_VABI sceVoiceQoSEnableChat();
-int APS5_VABI sceVoiceQoSDisableChat();
-int APS5_VABI sceVoiceQoSGetStatus(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSDebugGetStatus(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSInitHQ(void*, std::uint32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSSetMode();
-int APS5_VABI sceVoiceQoSTerminate();
-int APS5_VABI sceVoiceQoSReadPacket(std::int32_t, void*, std::uint32_t*);
-int APS5_VABI sceVoiceQoSWritePacket(std::int32_t, const void*, std::uint32_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
diff --git a/core/libs/tests/GuestVorbisDec.cpp b/core/libs/tests/GuestVorbisDec.cpp
index d34eb5d9ad..9b44ce165b 100644
--- a/core/libs/tests/GuestVorbisDec.cpp
+++ b/core/libs/tests/GuestVorbisDec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVorbisDec/include/Api.hpp"
 #include "prx/libSceVorbisDec/include/GuestVorbisFile.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -17,43 +18,6 @@
 
 using namespace VorbisDec;
 
-extern "C" {
-int APS5_VABI sceVorbisDecOpenCallbacks(void* datasource, void* vf, const char* initial, std::int64_t ibytes, GuestCallbacks callbacks);
-int APS5_VABI sceVorbisDecClear(void* vf);
-std::int64_t APS5_VABI sceVorbisDecBitrate(void* vf, int link);
-std::int64_t APS5_VABI sceVorbisDecBitrateInstant(void* vf);
-std::int64_t APS5_VABI sceVorbisDecStreams(void* vf);
-std::int64_t APS5_VABI sceVorbisDecSeekable(void* vf);
-std::int64_t APS5_VABI sceVorbisDecSerialNumber(void* vf, int link);
-std::int64_t APS5_VABI sceVorbisDecRawTotal(void* vf, int link);
-std::int64_t APS5_VABI sceVorbisDecPcmTotal(void* vf, int link);
-double APS5_VABI sceVorbisDecTimeTotal(void* vf, int link);
-int APS5_VABI sceVorbisDecRawSeek(void* vf, std::int64_t position);
-int APS5_VABI sceVorbisDecPcmSeek(void* vf, std::int64_t position);
-int APS5_VABI sceVorbisDecPcmSeekPage(void* vf, std::int64_t position);
-int APS5_VABI sceVorbisDecTimeSeek(void* vf, double position);
-int APS5_VABI sceVorbisDecTimeSeekPage(void* vf, double position);
-int APS5_VABI sceVorbisDecRawSeekLap(void* vf, std::int64_t position);
-int APS5_VABI sceVorbisDecPcmSeekLap(void* vf, std::int64_t position);
-int APS5_VABI sceVorbisDecPcmSeekPageLap(void* vf, std::int64_t position);
-int APS5_VABI sceVorbisDecTimeSeekLap(void* vf, double position);
-int APS5_VABI sceVorbisDecTimeSeekPageLap(void* vf, double position);
-std::int64_t APS5_VABI sceVorbisDecRawTell(void* vf);
-std::int64_t APS5_VABI sceVorbisDecPcmTell(void* vf);
-double APS5_VABI sceVorbisDecTimeTell(void* vf);
-GuestInfo* APS5_VABI sceVorbisDecInfo(void* vf, int link);
-GuestComment* APS5_VABI sceVorbisDecComment(void* vf, int link);
-std::int64_t APS5_VABI sceVorbisDecRead(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream);
-std::int64_t APS5_VABI sceVorbisDecReadFloat(void* vf, float*** pcmChannels, int samples, int* bitstream);
-std::int64_t APS5_VABI sceVorbisDecReadFilter(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream, GuestFilter filter, void* filterParam);
-int APS5_VABI sceVorbisDecCrossLap(void* first, void* second);
-int APS5_VABI sceVorbisDecHalfrate(void* vf, int flag);
-int APS5_VABI sceVorbisDecHalfrateP(void* vf);
-int APS5_VABI sceVorbisDecGetDecodePriority(void);
-int APS5_VABI sceVorbisDecSetDecodePriority(void);
-int APS5_VABI sceVorbisDecGetLastDecodeError(void);
-}
-
 namespace {
 
 constexpr int FirstSerial = 0x1234abcd;
diff --git a/core/libs/tests/GuestVrServiceDialog.cpp b/core/libs/tests/GuestVrServiceDialog.cpp
index 8d72100186..95f074d84c 100644
--- a/core/libs/tests/GuestVrServiceDialog.cpp
+++ b/core/libs/tests/GuestVrServiceDialog.cpp
@@ -1,17 +1,8 @@
+#include "prx/libSceVrServiceDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceVrServiceDialogInitialize(void);
-int APS5_VABI sceVrServiceDialogOpen(const void* param);
-int APS5_VABI sceVrServiceDialogUpdateStatus(void);
-int APS5_VABI sceVrServiceDialogGetStatus(void);
-int APS5_VABI sceVrServiceDialogGetResult(void* result);
-int APS5_VABI sceVrServiceDialogClose(void);
-int APS5_VABI sceVrServiceDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestVrSetupDialog.cpp b/core/libs/tests/GuestVrSetupDialog.cpp
index decf0c81e2..3297365257 100644
--- a/core/libs/tests/GuestVrSetupDialog.cpp
+++ b/core/libs/tests/GuestVrSetupDialog.cpp
@@ -1,18 +1,9 @@
+#include "prx/libSceVrSetupDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 
-extern "C" {
-int APS5_VABI sceVrSetupDialogInitialize(void);
-int APS5_VABI sceVrSetupDialogOpen(const VrSetupDialogParam* param);
-int APS5_VABI sceVrSetupDialogUpdateStatus(void);
-int APS5_VABI sceVrSetupDialogGetStatus(void);
-int APS5_VABI sceVrSetupDialogGetResult(std::int32_t* result);
-int APS5_VABI sceVrSetupDialogClose(void);
-int APS5_VABI sceVrSetupDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestVrTracker2.cpp b/core/libs/tests/GuestVrTracker2.cpp
index 0bbe3a869e..a1e4b0693a 100644
--- a/core/libs/tests/GuestVrTracker2.cpp
+++ b/core/libs/tests/GuestVrTracker2.cpp
@@ -1,26 +1,21 @@
-#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libSceVrTracker2/include/Api.hpp"
+#include "prx/libkernel/libkernel.hpp"
 #include "ProcessParametersFixture.hpp"
 
+#include <algorithm>
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <random>
 #include <stdexcept>
+#include <string>
+#include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI VrTracker2NotInitialized();
-std::int32_t APS5_VABI sceVrTracker2Finalize();
-std::int32_t APS5_VABI VrTracker2ClearWideResult(void* result);
-std::int32_t APS5_VABI VrTracker2ClearNarrowResult(void* result);
-std::int32_t APS5_VABI VrTracker2CheckSecondThenReportNotInitialized(const void* first, const void* second);
-std::int32_t APS5_VABI VrTracker2Accept();
-std::int32_t APS5_VABI VrTracker2FillDefaults(void* output);
-std::int32_t APS5_VABI VrTracker2ClearWord(void* output);
-std::int32_t APS5_VABI sceVrTracker2QueryMemory(const void* parameter, void* requirement);
-struct VrTracker2InitializeParameter;
-std::int32_t APS5_VABI sceVrTracker2Initialize(const VrTracker2InitializeParameter* parameter);
-}
+static_assert(sizeof(VrTracker2InitializeParameter) == 72);
 
 namespace {
 
@@ -28,6 +23,8 @@ alignas(16) std::array<std::byte, 0x40> process{};
 
 constexpr std::int32_t NotInitialized = static_cast<std::int32_t>(0x8A740001u);
 constexpr std::int32_t InvalidArgument = static_cast<std::int32_t>(0x8A740006u);
+constexpr std::uint32_t TrackerMemory = 32u << 20;
+constexpr std::size_t WorkMemoryTail = 64u << 10;
 
 void Require(bool condition, const char* message) {
     if (!condition) {
@@ -58,6 +55,118 @@ bool Throws(TCall call) {
     return false;
 }
 
+VrTracker2InitializeParameter TrackerParameter(std::vector<std::uint8_t>& memory) {
+    VrTracker2InitializeParameter parameter{};
+    parameter.size = sizeof(parameter);
+    parameter.threadPriorities[0] = 256;
+    parameter.threadPriorities[1] = 767;
+    parameter.threadAffinityMasks[0] = 0x1fff;
+    parameter.workMemory = memory.data();
+    parameter.workMemorySize = static_cast<std::uint32_t>(memory.size());
+    parameter.workMemoryAlignment = 0x10000;
+    return parameter;
+}
+
+bool WorkMemoryCleared(const std::vector<std::uint8_t>& memory) {
+    return AllEqual(memory.data(), memory.data() + TrackerMemory, 0) && AllEqual(memory.data() + TrackerMemory, memory.data() + memory.size(), 0xAA);
+}
+
+bool WorkMemoryUntouched(const std::vector<std::uint8_t>& memory) {
+    return AllEqual(memory.data(), memory.data() + memory.size(), 0xAA);
+}
+
+std::int32_t InitializeFresh(std::vector<std::uint8_t>& memory, const VrTracker2InitializeParameter& parameter) {
+    std::fill(memory.begin(), memory.end(), 0xAA);
+    return sceVrTracker2Initialize(&parameter);
+}
+
+void CheckInitializeValidation(std::vector<std::uint8_t>& memory) {
+    const auto valid = TrackerParameter(memory);
+    Require(sceVrTracker2Initialize(nullptr) == InvalidArgument, "initialize null");
+    for (const std::uint32_t size : {0u, 71u, 73u}) {
+        auto parameter = valid;
+        parameter.size = size;
+        parameter.mode = 1000;
+        Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize size before mode");
+    }
+    for (const std::uint32_t mode : {1u, 999u, 1002u, 0xffffffffu}) {
+        auto parameter = valid;
+        parameter.mode = mode;
+        Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize mode");
+    }
+    auto parameter = valid;
+    parameter.workMemory = nullptr;
+    Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize work memory null");
+    parameter = valid;
+    parameter.workMemorySize = TrackerMemory - 1;
+    Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize work memory size");
+    parameter = valid;
+    parameter.workMemoryAlignment = 0xffff;
+    Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize alignment");
+    for (std::size_t index = 0; index < sizeof(parameter.reserved); ++index) {
+        parameter = valid;
+        parameter.reserved[index] = 1;
+        Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize reserved byte");
+    }
+    for (std::size_t index = 0; index < 2; ++index) {
+        for (const std::int32_t priority : {255, 768, -1}) {
+            parameter = valid;
+            parameter.threadPriorities[index] = priority;
+            Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize thread priority");
+        }
+        for (const std::uint64_t mask : {std::uint64_t{0x2000}, std::uint64_t{0x3fff}, std::uint64_t{1} << 63}) {
+            parameter = valid;
+            parameter.threadAffinityMasks[index] = mask;
+            Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize affinity mask");
+        }
+    }
+    Require(WorkMemoryUntouched(memory), "initialize validation leaves work memory");
+}
+
+void CheckInitializeTracking(std::vector<std::uint8_t>& memory, std::uint32_t sdkVersion) {
+    const auto valid = TrackerParameter(memory);
+    Require(InitializeFresh(memory, valid) == -1, "initialize tracking start result");
+    Require(WorkMemoryCleared(memory), "initialize clears tracker memory");
+    Require(sceVrTracker2Finalize() == NotInitialized, "initialize failure leaves module uninitialized");
+    Require(VrTracker2NotInitialized() == NotInitialized, "initialize failure keeps uninitialized answers");
+    Require(InitializeFresh(memory, valid) == -1, "initialize retry after failure");
+    auto parameter = valid;
+    parameter.workMemoryAlignment = 0x10001;
+    parameter.option = 0xffffffffu;
+    parameter.coordinateSystem = 2;
+    parameter.disableOption = 1;
+    parameter.threadAffinityMasks[1] = 0x1fff;
+    Require(InitializeFresh(memory, parameter) == -1, "initialize late checks follow tracking");
+    for (const std::int8_t optionMode : {std::int8_t{-1}, std::int8_t{0}}) {
+        parameter = valid;
+        parameter.optionMode = optionMode;
+        Require(InitializeFresh(memory, parameter) == -1, "initialize accepted option mode");
+    }
+    for (const std::int8_t optionMode : {std::int8_t{2}, std::int8_t{-2}, std::int8_t{127}}) {
+        parameter = valid;
+        parameter.optionMode = optionMode;
+        Require(InitializeFresh(memory, parameter) == InvalidArgument, "initialize option mode");
+        Require(WorkMemoryCleared(memory), "initialize option mode follows clearing");
+    }
+    parameter = valid;
+    parameter.optionMode = 1;
+    Require(InitializeFresh(memory, parameter) == (sdkVersion >= 0x7000000 ? -1 : InvalidArgument), "initialize SDK option mode");
+    Require(sceVrTracker2Finalize() == NotInitialized, "initialize leaves module uninitialized");
+}
+
+std::filesystem::path EnterApplicationRoot() {
+    std::random_device device;
+    std::filesystem::path root;
+    do {
+        root = std::filesystem::temp_directory_path() /
+            ("guest_vr_tracker2_" + std::to_string(getpid_nid_postfix()) + "_" + std::to_string(device()));
+    } while (!std::filesystem::create_directory(root));
+    std::filesystem::create_directories(root / "app0" / "sce_sys");
+    std::ofstream(root / "app0" / "sce_sys" / "param.json") << "{\n  \"contentId\": \"IV0000-ABCD00000_00-VRTRACKER2000000\",\n  \"localizedParameters\": {\"defaultLanguage\": \"en-US\", \"en-US\": {\"titleName\": \"VrTracker2\"}},\n  \"titleId\": \"ABCD00000\"\n}\n";
+    std::filesystem::current_path(root);
+    return root;
+}
+
 }
 
 int main() {
@@ -98,17 +207,17 @@ int main() {
     parameter.back() = 0xAA;
     std::array<std::uint8_t, 40> requirement{};
     requirement.fill(0xAA);
-    Require(sceVrTracker2QueryMemory(parameter.data(), requirement.data()) == 0, "query return");
+    Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == 0, "query return");
     const std::array<std::uint8_t, 12> fields{0x20, 0, 0, 0, 0, 0, 0, 0x02, 0, 0, 0x01, 0};
     Require(std::memcmp(requirement.data(), fields.data(), fields.size()) == 0, "query fields");
     Require(AllEqual(requirement.data() + 12, requirement.data() + 32, 0) && AllEqual(requirement.data() + 32, requirement.data() + 40, 0xAA), "query writes 32 bytes");
-    Require(sceVrTracker2QueryMemory(nullptr, requirement.data()) == InvalidArgument, "query null parameter");
-    Require(sceVrTracker2QueryMemory(parameter.data(), nullptr) == InvalidArgument, "query null requirement");
+    Require(sceVrTracker2QueryMemory(nullptr, reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == InvalidArgument, "query null parameter");
+    Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), nullptr) == InvalidArgument, "query null requirement");
     for (std::size_t offset = 4; offset < 32; ++offset) {
         auto rejected = parameter;
         rejected[offset] = 1;
         requirement.fill(0xAA);
-        Require(sceVrTracker2QueryMemory(rejected.data(), requirement.data()) == InvalidArgument, "query reserved byte");
+        Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(rejected.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == InvalidArgument, "query reserved byte");
         Require(AllEqual(requirement.data(), requirement.data() + 40, 0xAA), "query rejection leaves output");
     }
     const std::uint64_t processSize = process.size();
@@ -121,7 +230,7 @@ int main() {
         for (const std::uint32_t mode : {1000u, 1001u}) {
             std::memcpy(parameter.data() + 4, &mode, sizeof(mode));
             requirement.fill(0xAA);
-            const auto result = sceVrTracker2QueryMemory(parameter.data(), requirement.data());
+            const auto result = sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data()));
             if (version < 0x1000000) {
                 Require(result == InvalidArgument, "query SDK restriction");
                 Require(AllEqual(requirement.data(), requirement.data() + requirement.size(), 0xAA), "SDK rejection preserves output");
@@ -136,8 +245,17 @@ int main() {
         }
     }
     parameter[0] = 0x21;
-    Require(sceVrTracker2QueryMemory(parameter.data(), requirement.data()) == InvalidArgument, "query size");
+    Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == InvalidArgument, "query size");
 
-    Require(Throws([] { sceVrTracker2Initialize(nullptr); }), "unknown export");
+    std::vector<std::uint8_t> memory(TrackerMemory + WorkMemoryTail);
+    CheckInitializeValidation(memory);
+    const auto previous = std::filesystem::current_path();
+    const auto root = EnterApplicationRoot();
+    for (const std::uint32_t version : {0x6ffffffu, 0x7000000u}) {
+        std::memcpy(process.data() + 0x10, &version, sizeof(version));
+        CheckInitializeTracking(memory, version);
+    }
+    std::filesystem::current_path(previous);
+    std::filesystem::remove_all(root);
     return 0;
 }
diff --git a/core/libs/tests/GuestVrTrackerDevices.cpp b/core/libs/tests/GuestVrTrackerDevices.cpp
index bfffa872c9..d34384fa7a 100644
--- a/core/libs/tests/GuestVrTrackerDevices.cpp
+++ b/core/libs/tests/GuestVrTrackerDevices.cpp
@@ -1,21 +1,9 @@
+#include "prx/libSceVrTracker/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVrTrackerQueryMemory(const void*, void*);
-int APS5_VABI sceVrTrackerInit(const void*);
-int APS5_VABI sceVrTrackerTerm();
-int APS5_VABI sceVrTrackerRegisterDevice(int, int);
-int APS5_VABI sceVrTrackerRegisterDevice2(int, int);
-int APS5_VABI sceVrTrackerRegisterDeviceInternal(int, int, int, int);
-int APS5_VABI sceVrTrackerUnregisterDevice(int);
-int APS5_VABI sceVrTrackerRecalibrate(const void*);
-int APS5_VABI sceVrTrackerSetDurationUntilStatusNotTracking(int, std::uint32_t);
-int APS5_VABI sceVrTrackerGpuWaitAndCpuProcess();
-}
-
 namespace {
 
 constexpr int NotInit = static_cast<int>(0x81260801u);
@@ -30,50 +18,10 @@ constexpr int Pad = 1;
 constexpr int Move = 2;
 constexpr int Gun = 3;
 
-struct Calibration {
-    std::uint32_t hmd, pad, move, gun;
-    std::uint32_t reserved[4];
-};
-
-struct QueryParam {
-    std::uint32_t size = sizeof(QueryParam);
-    std::uint32_t profile = 0;
-    std::uint32_t reserved[6]{};
-    Calibration calibration{};
-};
-
 struct QueryResult {
     std::uint32_t words[16];
 };
 
-struct InitParam {
-    std::uint32_t size = sizeof(InitParam);
-    std::uint32_t profile = 0;
-    std::uint32_t executionMode = 0;
-    std::int32_t priorities[4]{};
-    std::int32_t reserved = 0;
-    std::uint64_t cpuMask = 0;
-    Calibration calibration{};
-    void* onion = nullptr;
-    std::uint32_t onionSize = 0x400000;
-    std::uint32_t onionAlignment = 0x10000;
-    void* garlic = nullptr;
-    std::uint32_t garlicSize = 0x3000000;
-    std::uint32_t garlicAlignment = 0x10000;
-    void* work = nullptr;
-    std::uint32_t workSize = 0x1000000;
-    std::uint32_t workAlignment = 0x10000;
-    std::int32_t pipe = 0;
-    std::int32_t queue = 0;
-};
-
-struct RecalibrateParam {
-    std::uint32_t size = sizeof(RecalibrateParam);
-    std::uint32_t deviceType = 0;
-    std::uint32_t calibrationType = 0;
-    std::uint32_t reserved[5]{};
-};
-
 std::uint8_t g_onion[16];
 std::uint8_t g_garlic[16];
 std::uint8_t g_work[16];
@@ -92,23 +40,30 @@ QueryResult FreshResult() {
     return result;
 }
 
-InitParam ValidInit() {
-    InitParam init;
-    init.onion = g_onion;
-    init.garlic = g_garlic;
-    init.work = g_work;
+VrTrackerLegacy::InitParam ValidInit() {
+    VrTrackerLegacy::InitParam init{};
+    init.size = sizeof(init);
+    init.direct_memory_onion_size = 0x400000;
+    init.direct_memory_onion_alignment = 0x10000;
+    init.direct_memory_garlic_size = 0x3000000;
+    init.direct_memory_garlic_alignment = 0x10000;
+    init.work_memory_size = 0x1000000;
+    init.work_memory_alignment = 0x10000;
+    init.direct_memory_onion = g_onion;
+    init.direct_memory_garlic = g_garlic;
+    init.work_memory = g_work;
     return init;
 }
 
-int Recalibrate(std::uint32_t deviceType, std::uint32_t size = sizeof(RecalibrateParam)) {
-    RecalibrateParam param;
+int Recalibrate(std::uint32_t deviceType, std::uint32_t size = sizeof(VrTrackerLegacy::RecalibrateParam)) {
+    VrTrackerLegacy::RecalibrateParam param{};
     param.size = size;
-    param.deviceType = deviceType;
+    param.device_type = deviceType;
     return sceVrTrackerRecalibrate(&param);
 }
 
 void CheckQueryMemory() {
-    QueryParam query;
+    VrTrackerLegacy::QueryMemoryParam query{sizeof(VrTrackerLegacy::QueryMemoryParam)};
     auto result = FreshResult();
     Require(sceVrTrackerQueryMemory(&query, &result) == 0);
     Require(result.words[0] == Untouched);
@@ -117,22 +72,22 @@ void CheckQueryMemory() {
     Require(result.words[5] == 0x1000000 && result.words[6] == 0x10000);
     Require(result.words[7] == Untouched);
 
-    query.calibration.move = 1;
+    query.calibration_settings.move_position = 1;
     query.profile = 100;
     Require(sceVrTrackerQueryMemory(&query, &result) == 0 && result.words[1] == 0x800000);
 
     auto rejected = FreshResult();
-    QueryParam bad = query;
+    VrTrackerLegacy::QueryMemoryParam bad = query;
     bad.profile = 1;
     Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
     bad = query;
-    bad.calibration.hmd = 1;
+    bad.calibration_settings.hmd_position = 1;
     Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
     bad = query;
-    bad.calibration.pad = 2;
+    bad.calibration_settings.pad_position = 2;
     Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
     bad = query;
-    bad.size = sizeof(QueryParam) - 1;
+    bad.size = sizeof(VrTrackerLegacy::QueryMemoryParam) - 1;
     Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
     Require(sceVrTrackerQueryMemory(nullptr, &rejected) == ArgumentInvalid);
     Require(sceVrTrackerQueryMemory(&query, nullptr) == ArgumentInvalid);
@@ -150,31 +105,31 @@ void CheckBeforeInit() {
 
 void CheckInit() {
     auto bad = ValidInit();
-    bad.size = sizeof(InitParam) - 8;
-    Require(sceVrTrackerInit(&bad) == ArgumentInvalid);
+    bad.size = sizeof(VrTrackerLegacy::InitParam) - 8;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
     bad.size = 144;
-    RequireThrows([&] { sceVrTrackerInit(&bad); });
+    RequireThrows([&] { sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)); });
     bad = ValidInit();
-    bad.calibration.move = 1;
-    Require(sceVrTrackerInit(&bad) == ArgumentInvalid);
-    bad.onionSize = 0x800000;
-    bad.pipe = 7;
-    Require(sceVrTrackerInit(&bad) == ArgumentInvalid);
-    bad.pipe = 0;
-    bad.queue = 8;
-    Require(sceVrTrackerInit(&bad) == ArgumentInvalid);
-    bad.queue = 0;
-    bad.work = nullptr;
-    Require(sceVrTrackerInit(&bad) == ArgumentInvalid);
-    bad.work = g_work;
-    bad.garlicAlignment = 0x1000;
-    Require(sceVrTrackerInit(&bad) == ArgumentInvalid);
+    bad.calibration_settings.move_position = 1;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.direct_memory_onion_size = 0x800000;
+    bad.gpu_pipe_id = 7;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.gpu_pipe_id = 0;
+    bad.gpu_queue_id = 8;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.gpu_queue_id = 0;
+    bad.work_memory = nullptr;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.work_memory = g_work;
+    bad.direct_memory_garlic_alignment = 0x1000;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
     Require(sceVrTrackerInit(nullptr) == ArgumentInvalid);
     Require(sceVrTrackerTerm() == NotInit);
 
     const auto init = ValidInit();
-    Require(sceVrTrackerInit(&init) == 0);
-    Require(sceVrTrackerInit(&init) == AlreadyInitialized);
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&init)) == 0);
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&init)) == AlreadyInitialized);
     Require(sceVrTrackerInit(nullptr) == AlreadyInitialized);
     Require(sceVrTrackerGpuWaitAndCpuProcess() == NotExecuteGpuSubmit);
 }
@@ -193,7 +148,7 @@ void CheckDevices() {
     Require(Recalibrate(Hmd) == DeviceNotRegistered);
     Require(Recalibrate(Gun) == DeviceNotRegistered);
     Require(Recalibrate(4) == ArgumentInvalid);
-    Require(Recalibrate(Pad, sizeof(RecalibrateParam) + 4) == ArgumentInvalid);
+    Require(Recalibrate(Pad, sizeof(VrTrackerLegacy::RecalibrateParam) + 4) == ArgumentInvalid);
     Require(sceVrTrackerRecalibrate(nullptr) == ArgumentInvalid);
 
     Require(sceVrTrackerSetDurationUntilStatusNotTracking(Gun, 10) == 0);
@@ -212,7 +167,7 @@ void CheckTerm() {
     Require(sceVrTrackerTerm() == NotInit);
     Require(sceVrTrackerRegisterDevice(Gun, 8) == NotInit);
     const auto init = ValidInit();
-    Require(sceVrTrackerInit(&init) == 0);
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&init)) == 0);
     Require(sceVrTrackerRegisterDevice(Move, 11) == DeviceAlreadyRegistered);
     Require(sceVrTrackerTerm() == 0);
 }
diff --git a/core/libs/tests/GuestWaitpid.cpp b/core/libs/tests/GuestWaitpid.cpp
index 8ef90e7b19..9b958641cb 100644
--- a/core/libs/tests/GuestWaitpid.cpp
+++ b/core/libs/tests/GuestWaitpid.cpp
@@ -1,12 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <initializer_list>
-extern "C" {
-int APS5_VABI wait_nid_postfix(int*);
-int APS5_VABI waitpid_nid_postfix(int, int*, int);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
-}
+
 constexpr int noChild = 10;
 constexpr int invalidArgument = 22;
 constexpr int untouched = 0x5a5a5a5a;
diff --git a/core/libs/tests/GuestWcsrtombs.cpp b/core/libs/tests/GuestWcsrtombs.cpp
index 794748e08b..b9139ceaa8 100644
--- a/core/libs/tests/GuestWcsrtombs.cpp
+++ b/core/libs/tests/GuestWcsrtombs.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,9 +6,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" std::size_t APS5_VABI wcsrtombs_nid_postfix(char*, const std::uint16_t**, std::size_t, void*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/tests/GuestWcsrtombsS.cpp b/core/libs/tests/GuestWcsrtombsS.cpp
index 41095b7dde..2169489807 100644
--- a/core/libs/tests/GuestWcsrtombsS.cpp
+++ b/core/libs/tests/GuestWcsrtombsS.cpp
@@ -1,11 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" int APS5_VABI wcsrtombs_s_nid_postfix(
-    std::size_t*, char*, std::size_t, const std::uint16_t**, std::size_t, void*);
-extern "C" int APS5_VABI wcstombs_s_nid_postfix(std::size_t*, char*, std::size_t, const std::uint16_t*, std::size_t);
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr auto Failed = static_cast<std::size_t>(-1);
diff --git a/core/libs/tests/GuestWebBrowserDialog.cpp b/core/libs/tests/GuestWebBrowserDialog.cpp
index bb391077a8..01fdca210e 100644
--- a/core/libs/tests/GuestWebBrowserDialog.cpp
+++ b/core/libs/tests/GuestWebBrowserDialog.cpp
@@ -1,19 +1,9 @@
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceWebBrowserDialogInitialize(void);
-int APS5_VABI sceWebBrowserDialogTerminate(void);
-int APS5_VABI sceWebBrowserDialogOpen(const void* param);
-int APS5_VABI sceWebBrowserDialogOpenForPredeterminedContent(const void* param, const WebBrowserDialogAllowList* allowList);
-int APS5_VABI sceWebBrowserDialogClose(void);
-int APS5_VABI sceWebBrowserDialogGetStatus(void);
-int APS5_VABI sceWebBrowserDialogUpdateStatus(void);
-int APS5_VABI sceWebBrowserDialogGetResult(WebBrowserDialogResult* result);
-}
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
@@ -37,6 +27,8 @@ int main() {
     result.result = 0x5a5a5a5a;
 
     Require(sceWebBrowserDialogTerminate() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
+    Require(sceWebBrowserDialogSetCookie(nullptr) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
+    Require(sceWebBrowserDialogResetCookie(nullptr) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(sceWebBrowserDialogGetStatus() == COMMON_DIALOG_STATUS_NONE);
     Require(sceWebBrowserDialogClose() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(sceWebBrowserDialogOpen(param) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
diff --git a/core/libs/tests/GuestWebBrowserDialogCookies.cpp b/core/libs/tests/GuestWebBrowserDialogCookies.cpp
index 723bada25d..32deb3db57 100644
--- a/core/libs/tests/GuestWebBrowserDialogCookies.cpp
+++ b/core/libs/tests/GuestWebBrowserDialogCookies.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,28 +6,6 @@
 #include <cstring>
 #include <string>
 
-struct ResetCookieParam {
-    std::uint64_t size;
-    std::uint8_t reserved[256];
-};
-
-struct SetCookieParam {
-    std::uint64_t size;
-    const char* url;
-    const char* cookie;
-    std::uint8_t reserved[256];
-};
-
-extern "C" {
-int APS5_VABI sceWebBrowserDialogInitialize(void);
-int APS5_VABI sceWebBrowserDialogTerminate(void);
-int APS5_VABI sceWebBrowserDialogOpen(const void* param);
-int APS5_VABI sceWebBrowserDialogClose(void);
-int APS5_VABI sceWebBrowserDialogUpdateStatus(void);
-int APS5_VABI sceWebBrowserDialogSetCookie(const SetCookieParam* param);
-int APS5_VABI sceWebBrowserDialogResetCookie(const ResetCookieParam* param);
-}
-
 namespace {
 
 constexpr int NOT_INITIALIZED = static_cast<int>(0x80B80003u);
@@ -41,16 +20,16 @@ void Require(bool value, const char* what) {
     std::abort();
 }
 
-SetCookieParam Cookie(const char* url, const char* cookie) {
-    SetCookieParam param {};
+WebBrowserDialogCookieParam Cookie(const char* url, const char* cookie) {
+    WebBrowserDialogCookieParam param {};
     param.size = sizeof(param);
-    param.url = url;
+    param.address = url;
     param.cookie = cookie;
     return param;
 }
 
-ResetCookieParam Reset() {
-    ResetCookieParam param {};
+WebBrowserDialogResetCookieParam Reset() {
+    WebBrowserDialogResetCookieParam param {};
     param.size = sizeof(param);
     return param;
 }
@@ -61,7 +40,7 @@ void CheckSetCookieParameters() {
     Require(sceWebBrowserDialogSetCookie(nullptr) == ARG_NULL, "SetCookie null");
 
     auto wrongSize = valid;
-    wrongSize.size = sizeof(ResetCookieParam);
+    wrongSize.size = sizeof(WebBrowserDialogResetCookieParam);
     Require(sceWebBrowserDialogSetCookie(&wrongSize) == PARAM_INVALID, "SetCookie size");
     auto noUrl = Cookie(nullptr, "a=b");
     Require(sceWebBrowserDialogSetCookie(&noUrl) == PARAM_INVALID, "SetCookie null url");
@@ -96,7 +75,7 @@ void CheckResetCookieParameters() {
     Require(sceWebBrowserDialogResetCookie(&valid) == 0, "valid ResetCookie");
     Require(sceWebBrowserDialogResetCookie(nullptr) == ARG_NULL, "ResetCookie null");
     auto wrongSize = valid;
-    wrongSize.size = sizeof(SetCookieParam);
+    wrongSize.size = sizeof(WebBrowserDialogCookieParam);
     Require(sceWebBrowserDialogResetCookie(&wrongSize) == PARAM_INVALID, "ResetCookie size");
     auto reserved = valid;
     reserved.reserved[0] = 1;
diff --git a/core/libs/tests/GuestWideConversion.cpp b/core/libs/tests/GuestWideConversion.cpp
index b56da38d8d..5590c6124a 100644
--- a/core/libs/tests/GuestWideConversion.cpp
+++ b/core/libs/tests/GuestWideConversion.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
 #include <cstddef>
@@ -8,25 +9,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-std::uint64_t APS5_VABI _WStoul_nid_postfix(const char16_t*, char16_t**, int);
-int APS5_VABI _Iswctype_nid_postfix(std::uint32_t, std::uint64_t);
-int APS5_VABI swscanf_nid_postfix(const char16_t*, const char16_t*, ...);
-int APS5_VABI swscanf_s_nid_postfix(const char16_t*, const char16_t*, ...);
-int APS5_VABI iswalnum_nid_postfix(std::uint32_t);
-int APS5_VABI iswalpha_nid_postfix(std::uint32_t);
-int APS5_VABI iswcntrl_nid_postfix(std::uint32_t);
-int APS5_VABI iswdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswgraph_nid_postfix(std::uint32_t);
-int APS5_VABI iswlower_nid_postfix(std::uint32_t);
-int APS5_VABI iswprint_nid_postfix(std::uint32_t);
-int APS5_VABI iswpunct_nid_postfix(std::uint32_t);
-int APS5_VABI iswspace_nid_postfix(std::uint32_t);
-int APS5_VABI iswupper_nid_postfix(std::uint32_t);
-int APS5_VABI iswxdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswblank_nid_postfix(std::uint32_t);
-}
-
 static int failures = 0;
 
 static void Require(bool condition, const char* message) {
@@ -134,6 +116,11 @@ static void CheckScan() {
     Require(swscanf_s_nid_postfix(u"x", u"%2lc", pair, std::size_t{2}) == 0, "%2lc short input");
     Require(swscanf_s_nid_postfix(u"cab12", u"%l[abc]%d", text, std::size_t{6}, &first) == 2 && std::u16string(text) == u"cab" && first == 12, "%l[");
     Require(swscanf_s_nid_postfix(u"été!", u"%l[^!]", text, std::size_t{6}) == 1 && std::u16string(text) == u"été", "%l[^");
+    char16_t untouched[4] = {u'?', u'?', u'?', u'?'};
+    Require(swscanf_s_nid_postfix(u"Āb cd", u"%S", untouched, std::size_t{4}) == 0 && untouched[0] == u'?', "%S is an invalid conversion");
+    Require(swscanf_s_nid_postfix(u"7 Āb", u"%d%lS", &first, untouched, std::size_t{4}) == 1 && first == 7 && untouched[0] == u'?', "%lS stops after the earlier assignment");
+    Require(swscanf_s_nid_postfix(u"Āyz", u"%2C", untouched, std::size_t{4}) == 0 && untouched[0] == u'?', "%C is an invalid conversion");
+    Require(swscanf_s_nid_postfix(u"5 6", u"%hC%d", &first) == 0 && first == 7, "%hC stops before later conversions");
     std::int64_t count = -1;
     Require(swscanf_s_nid_postfix(u" 12 ab", u"%d %ln", &first, &count) == 1 && count == 4, "%ln");
 
@@ -195,6 +182,11 @@ static void CheckUnsizedScan() {
     Require(swscanf_nid_postfix(u" q7", u"%c%d", &letter, &first) == 1 && letter == ' ', "swscanf %c does not skip white space");
     Require(swscanf_nid_postfix(u"cab12", u"%l[abc]%d", text, &first) == 2 && std::u16string(text) == u"cab" && first == 12, "swscanf %l[");
     Require(swscanf_nid_postfix(u"été!", u"%l[^!]", text) == 1 && std::u16string(text) == u"été", "swscanf %l[^");
+    char16_t untouched[4] = {u'?', u'?', u'?', u'?'};
+    Require(swscanf_nid_postfix(u"Āb cd", u"%S", untouched) == 0 && untouched[0] == u'?', "swscanf %S is an invalid conversion");
+    Require(swscanf_nid_postfix(u"7 Āb 9", u"%d%3S%d", &first, untouched, &second) == 1 && first == 7 && untouched[0] == u'?', "swscanf stops at %S");
+    Require(swscanf_nid_postfix(u"Āyz", u"%lC", untouched) == 0 && untouched[0] == u'?', "swscanf %lC is an invalid conversion");
+    Require(swscanf_nid_postfix(u"abc", u"%*S") == 0, "swscanf suppressed %S is an invalid conversion");
     Require(swscanf_nid_postfix(u"key=val", u"%[^=]=%s", narrow, narrow + 4) == 2 && std::strcmp(narrow, "key") == 0 && std::strcmp(narrow + 4, "val") == 0, "swscanf %[^");
     std::int64_t count = -1;
     Require(swscanf_nid_postfix(u" 12 ab", u"%d %ln", &first, &count) == 1 && count == 4, "swscanf %ln");
diff --git a/core/libs/tests/GuestWideFormatting.cpp b/core/libs/tests/GuestWideFormatting.cpp
index 30f62dc841..a317dcfb9e 100644
--- a/core/libs/tests/GuestWideFormatting.cpp
+++ b/core/libs/tests/GuestWideFormatting.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
@@ -8,16 +9,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI vswprintf_nid_postfix(char16_t*, std::size_t, const char16_t*, VaList*);
-extern "C" int APS5_VABI snwprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, ...);
-extern "C" int APS5_VABI vswprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, VaList*);
-extern "C" int APS5_VABI swprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, ...);
-extern "C" int APS5_VABI vsnwprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, VaList*);
-extern "C" int APS5_VABI swprintf_nid_postfix(char16_t*, std::size_t, const char16_t*, ...);
-extern "C" std::size_t APS5_VABI strftime_nid_postfix(char*, std::size_t, const char*, const GuestTm*);
-extern "C" std::size_t APS5_VABI wcsftime_nid_postfix(char16_t*, std::size_t, const char16_t*, const GuestTm*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static int APS5_VABI Format(char16_t* buffer, std::size_t size, const char16_t* format, ...) {
 #ifdef _WIN32
     __builtin_sysv_va_list args;
@@ -186,6 +177,17 @@ static void CheckSecureWideBoundary() {
         "vsnwprintf_s oversized size leaves the buffer untouched");
 }
 
+static void CheckFloat() {
+    char16_t buffer[64];
+    Require(swprintf_nid_postfix(buffer, 64, u"[%.0f|%.1f|%#.3g|%.20f]", 2.5, 0.25, 2025.0, 0.1) == 39 &&
+        buffer == std::u16string(u"[3|0.3|2.03e+03|0.10000000000000000555]"), "swprintf rounds and caps decimal digits");
+    Require(swprintf_nid_postfix(buffer, 64, u"[%.0f|%-8.2e]", 67108865.5, 1125.0) == 19 && buffer == std::u16string(u"[67108865|1.13e+03]"),
+        "swprintf rounds a large tie down");
+    Require(swprintf_nid_postfix(buffer, 64, u"[%a|%.3a]", 0x1p-1074, 0x0.fffffffffffffp-1022) == 25 &&
+        buffer == std::u16string(u"[0x1p-1074|0x2.000p-1023]"), "swprintf normalises subnormal hexadecimal floats");
+    Require(swprintf_nid_postfix(buffer, 64, u"[%.2Lf]", 0.125L) == 6 && buffer == std::u16string(u"[0.13]"), "swprintf long double rounding");
+}
+
 static void CheckSwprintf() {
     char16_t buffer[8];
     for (auto& unit : buffer) unit = u'x';
@@ -212,7 +214,8 @@ static void CheckSwprintf() {
 
 static bool WcsftimeThrows(char16_t* buffer, const char16_t* format, const GuestTm* time) {
     try {
-        wcsftime_nid_postfix(buffer, 16, format, time);
+        wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 16, reinterpret_cast<const std::uint16_t*>(format), time);
+
     } catch (const std::invalid_argument&) {
         return true;
     }
@@ -246,33 +249,33 @@ static void CheckWcsftime() {
         char16_t wide[128];
         const std::size_t length = strftime_nid_postfix(narrow, sizeof(narrow), item.narrow, &time);
         Require(length != 0, "wcsftime reference strftime");
-        Require(wcsftime_nid_postfix(wide, 128, item.wide, &time) == length, "wcsftime length matches strftime");
+        Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(wide), 128, reinterpret_cast<const std::uint16_t*>(item.wide), &time) == length, "wcsftime length matches strftime");
         for (std::size_t index = 0; index <= length; ++index)
             Require(wide[index] == static_cast<unsigned char>(narrow[index]), "wcsftime output matches strftime");
     }
     char16_t buffer[32];
-    Require(wcsftime_nid_postfix(buffer, 32, u"%Y-%m-%d %H:%M:%S", &time) == 19
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%Y-%m-%d %H:%M:%S"), &time) == 19
         && buffer == std::u16string(u"2024-02-29 13:05:09"), "wcsftime date and time");
-    Require(wcsftime_nid_postfix(buffer, 32, u"%a %b %j %p", &time) == 14
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%a %b %j %p"), &time) == 14
         && buffer == std::u16string(u"Thu Feb 060 PM"), "wcsftime names");
-    Require(wcsftime_nid_postfix(buffer, 32, u"%%", &time) == 1 && buffer == std::u16string(u"%"), "wcsftime percent");
-    Require(wcsftime_nid_postfix(buffer, 20, u"%Y-%m-%d %H:%M:%S", &time) == 19, "wcsftime exact fit");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%%"), &time) == 1 && buffer == std::u16string(u"%"), "wcsftime percent");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 20, reinterpret_cast<const std::uint16_t*>(u"%Y-%m-%d %H:%M:%S"), &time) == 19, "wcsftime exact fit");
 
     int& error = *__error_nid_postfix();
     for (auto& unit : buffer) unit = u'x';
     error = 5;
-    Require(wcsftime_nid_postfix(buffer, 19, u"%Y-%m-%d %H:%M:%S", &time) == 0 && error == 5 && buffer[0] == u'x',
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 19, reinterpret_cast<const std::uint16_t*>(u"%Y-%m-%d %H:%M:%S"), &time) == 0 && error == 5 && buffer[0] == u'x',
         "wcsftime overflow");
-    Require(wcsftime_nid_postfix(buffer, 1, u"%Y", &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime one unit");
-    Require(wcsftime_nid_postfix(buffer, 0, u"%Y", &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime zero size");
-    Require(wcsftime_nid_postfix(buffer, 32, u"", &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime empty format");
-    Require(wcsftime_nid_postfix(nullptr, 32, u"%Y", &time) == 0 && error == 5, "wcsftime null buffer");
-    Require(wcsftime_nid_postfix(buffer, 32, u"%Y \u20ac", &time) == 6 && buffer == std::u16string(u"2024 \u20ac"),
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 1, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime one unit");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 0, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime zero size");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u""), &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime empty format");
+    Require(wcsftime_nid_postfix(nullptr, 32, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 5, "wcsftime null buffer");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%Y \u20ac"), &time) == 6 && buffer == std::u16string(u"2024 \u20ac"),
         "wcsftime passes a character above 0xff through UTF-8");
-    Require(wcsftime_nid_postfix(buffer, 7, u"%Y \u20ac", &time) == 6, "wcsftime sizes the narrow buffer for three-byte characters");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 7, reinterpret_cast<const std::uint16_t*>(u"%Y \u20ac"), &time) == 6, "wcsftime sizes the narrow buffer for three-byte characters");
     for (auto& unit : buffer) unit = u'x';
     error = 5;
-    Require(wcsftime_nid_postfix(buffer, SIZE_MAX, u"%Y", &time) == 0 && error == 22 && buffer[0] == u'x',
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), SIZE_MAX, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 22 && buffer[0] == u'x',
         "wcsftime oversized buffer");
     Require(WcsftimeThrows(buffer, nullptr, &time), "wcsftime null format");
     Require(WcsftimeThrows(buffer, u"%Y", nullptr), "wcsftime null time");
@@ -310,6 +313,7 @@ int main() {
     CheckPointer();
     CheckCount();
     CheckSwprintf();
+    CheckFloat();
     CheckSecureWideBoundary();
     CheckWcsftime();
     Check(u"%.2s", "\xc3\xa9\xc3\xa8", u"\u00e9\u00e8");
diff --git a/core/libs/tests/GuestWideStreamScan.cpp b/core/libs/tests/GuestWideStreamScan.cpp
index 632a989759..857a72001f 100644
--- a/core/libs/tests/GuestWideStreamScan.cpp
+++ b/core/libs/tests/GuestWideStreamScan.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdarg>
@@ -8,15 +9,7 @@
 
 extern "C" {
 extern FileStream* __stdinp_nid_postfix;
-int APS5_VABI vfwscanf_nid_postfix(FileStream*, const char16_t*, void*);
-int APS5_VABI vfwscanf_s_nid_postfix(FileStream*, const char16_t*, void*);
-int APS5_VABI vwscanf_nid_postfix(const char16_t*, void*);
-int APS5_VABI vwscanf_s_nid_postfix(const char16_t*, void*);
-int APS5_VABI fwscanf_nid_postfix(FileStream*, const char16_t*, ...);
-int APS5_VABI fwscanf_s_nid_postfix(FileStream*, const char16_t*, ...);
-int APS5_VABI wscanf_nid_postfix(const char16_t*, ...);
-int APS5_VABI wscanf_s_nid_postfix(const char16_t*, ...);
-std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream*);
+
 }
 
 #ifdef _WIN32
@@ -35,28 +28,28 @@ static void Require(bool value, const char* what) {
 
 static int APS5_VABI ScanStream(FileStream* stream, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfwscanf_nid_postfix(stream, format, args);
+    const int result = vfwscanf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanStreamSized(FileStream* stream, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfwscanf_s_nid_postfix(stream, format, args);
+    const int result = vfwscanf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanInput(const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vwscanf_nid_postfix(format, args);
+    const int result = vwscanf_nid_postfix(format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanInputSized(const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vwscanf_s_nid_postfix(format, args);
+    const int result = vwscanf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
diff --git a/core/libs/tests/GuestWideStrings.cpp b/core/libs/tests/GuestWideStrings.cpp
index 9137e19649..db3553fee9 100644
--- a/core/libs/tests/GuestWideStrings.cpp
+++ b/core/libs/tests/GuestWideStrings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <climits>
 #include <cstddef>
@@ -10,58 +11,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-std::size_t APS5_VABI c32rtomb_nid_postfix(char* destination, std::uint32_t value, void* state);
-std::size_t APS5_VABI c16rtomb_nid_postfix(char* destination, std::uint16_t unit, void* state);
-std::size_t APS5_VABI mbrtoc32_nid_postfix(std::uint32_t* destination, const char* source, std::size_t count, void* state);
-std::size_t APS5_VABI mbrtoc16_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
-int APS5_VABI mblen_nid_postfix(const char* source, std::size_t count);
-int APS5_VABI wctomb_nid_postfix(char* destination, std::uint16_t value);
-int* APS5_VABI __error_nid_postfix();
-const char16_t* APS5_VABI wmemchr_nid_postfix(const char16_t* s, char16_t c, std::size_t n);
-int APS5_VABI wmemcmp_nid_postfix(const char16_t* s1, const char16_t* s2, std::size_t n);
-char16_t* APS5_VABI wmemcpy_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-char16_t* APS5_VABI wmemmove_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-std::size_t APS5_VABI wcslen_nid_postfix(const char16_t* s);
-std::size_t APS5_VABI wcsnlen_s_nid_postfix(const char16_t* s, std::size_t maxlen);
-int APS5_VABI wcscmp_nid_postfix(const char16_t* s1, const char16_t* s2);
-int APS5_VABI wcsncmp_nid_postfix(const char16_t* s1, const char16_t* s2, std::size_t n);
-char16_t* APS5_VABI wcscpy_nid_postfix(char16_t* dest, const char16_t* src);
-char16_t* APS5_VABI wcscat_nid_postfix(char16_t* dest, const char16_t* src);
-char16_t* APS5_VABI wcsncpy_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-int APS5_VABI wmemmove_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-int APS5_VABI wcsncpy_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-int APS5_VABI wcscpy_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src);
-void* APS5_VABI set_constraint_handler_s_nid_postfix(void* handler);
-void APS5_VABI ignore_handler_s_nid_postfix(const char* message, void* pointer, int error);
-char16_t* APS5_VABI wcsncat_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-int APS5_VABI wcsncat_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-int APS5_VABI wcscat_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src);
-const char16_t* APS5_VABI wcschr_nid_postfix(const char16_t* s, char16_t c);
-const char16_t* APS5_VABI wcsrchr_nid_postfix(const char16_t* s, char16_t c);
-const char16_t* APS5_VABI wcsstr_nid_postfix(const char16_t* haystack, const char16_t* needle);
-const char16_t* APS5_VABI wcspbrk_nid_postfix(const char16_t* s, const char16_t* accept);
-std::size_t APS5_VABI wcsspn_nid_postfix(const char16_t* s, const char16_t* accept);
-std::size_t APS5_VABI wcscspn_nid_postfix(const char16_t* s, const char16_t* reject);
-char16_t* APS5_VABI wcstok_nid_postfix(char16_t* text, const char16_t* delimiters, char16_t** last);
-char16_t* APS5_VABI wmemset_nid_postfix(char16_t* s, char16_t c, std::size_t n);
-double APS5_VABI wcstod_nid_postfix(const char16_t* str, char16_t** endptr);
-float APS5_VABI wcstof_nid_postfix(const char16_t* str, char16_t** endptr);
-long double APS5_VABI wcstold_nid_postfix(const char16_t* str, char16_t** endptr);
-long long APS5_VABI wcstol_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-long long APS5_VABI wcstoll_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-long long APS5_VABI wcstoimax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-unsigned long long APS5_VABI wcstoumax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-unsigned long long APS5_VABI strtouq_nid_postfix(const char* str, char** endptr, int base);
-char* APS5_VABI rindex_nid_postfix(const char* s, int c);
-int APS5_VABI flsl_nid_postfix(std::int64_t mask);
-unsigned long long APS5_VABI wcstoul_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-unsigned long long APS5_VABI wcstoull_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-int APS5_VABI wcscoll_nid_postfix(const char16_t* first, const char16_t* second);
-std::size_t APS5_VABI wcsxfrm_nid_postfix(char16_t* destination, const char16_t* source, std::size_t count);
-}
-
 namespace {
 
 void require(bool condition) {
@@ -151,11 +100,13 @@ int main() {
 
     char16_t buffer[8];
     wmemset_nid_postfix(buffer, 0xaaaa, 8);
+
     require(wcscpy_nid_postfix(buffer, u"wide") == buffer);
     require(same(buffer, u"wide", 5) && buffer[5] == 0xaaaa);
 
     char16_t concatenated[8];
     wmemset_nid_postfix(concatenated, 0xaaaa, 8);
+
     concatenated[0] = 0;
     require(wcscat_nid_postfix(concatenated, u"ab") == concatenated);
     require(wcscat_nid_postfix(concatenated, u"世") == concatenated);
@@ -168,6 +119,7 @@ int main() {
     require(same(buffer, padded, 6));
     wmemset_nid_postfix(buffer, 0xaaaa, 8);
     wcsncpy_nid_postfix(buffer, u"abcdef", 3);
+
     const char16_t truncated[] = {u'a', u'b', u'c', 0xaaaa};
     require(same(buffer, truncated, 4));
 
@@ -177,9 +129,11 @@ int main() {
     require(wmemcpy_s_nid_postfix(nullptr, 16, u"abc", 3) == 22);
     require(wmemcpy_s_nid_postfix(memBuf, 16, nullptr, 3) == 22 && memBuf[0] == 0);
     wmemset_nid_postfix(memBuf, u'Z', 16);
+
     require(wmemcpy_s_nid_postfix(memBuf, 4, u"12345", 5) == 34 && memBuf[0] == 0 && memBuf[3] == 0);
     require(wmemcpy_s_nid_postfix(memBuf, ((SIZE_MAX >> 1) / sizeof(char16_t)) + 1, u"a", 1) == 34);
     wmemcpy_s_nid_postfix(memBuf, 16, u"abcdefgh", 8);
+
     require(wmemcpy_s_nid_postfix(memBuf + 2, 8, memBuf, 4) == 22 && memBuf[2] == 0);
 
     wmemcpy_s_nid_postfix(memBuf, 16, u"0123456789", 10);
@@ -206,23 +160,26 @@ int main() {
     require(wcsncpy_s_nid_postfix(strBuf, 5, u"hello", 5) == 34 && strBuf[0] == 0);
     require(wcsncpy_s_nid_postfix(strBuf, ((SIZE_MAX >> 1) / sizeof(char16_t)) + 1, u"a", 1) == 34);
     wcsncpy_s_nid_postfix(strBuf, 16, u"abcdef", 6);
+
     require(wcsncpy_s_nid_postfix(strBuf + 1, 10, strBuf, 3) == 22 && strBuf[1] == 0);
 
     char16_t cpyBuf[16];
-    require(wcscpy_s_nid_postfix(cpyBuf, 16, u"wide") == 0 && same(cpyBuf, u"wide", 5));
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 16, reinterpret_cast<const std::uint16_t*>(u"wide")) == 0 && same(cpyBuf, u"wide", 5));
     void* previousHandler = set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(&ignore_handler_s_nid_postfix));
-    require(wcscpy_s_nid_postfix(nullptr, 16, u"wide") == 22);
-    require(wcscpy_s_nid_postfix(cpyBuf, 0, u"wide") == 22);
-    require(wcscpy_s_nid_postfix(cpyBuf, 16, nullptr) == 22 && cpyBuf[0] == 0);
-    require(wcscpy_s_nid_postfix(cpyBuf, 4, u"wide") == 34 && cpyBuf[0] == 0);
+    require(wcscpy_s_nid_postfix(nullptr, 16, reinterpret_cast<const std::uint16_t*>(u"wide")) == 22);
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 0, reinterpret_cast<const std::uint16_t*>(u"wide")) == 22);
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 16, nullptr) == 22 && cpyBuf[0] == 0);
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 4, reinterpret_cast<const std::uint16_t*>(u"wide")) == 34 && cpyBuf[0] == 0);
     cpyBuf[0] = 0x1234;
-    require(wcscpy_s_nid_postfix(cpyBuf, ((SIZE_MAX >> 1) / sizeof(char16_t)) + 1, u"a") == 34 && cpyBuf[0] == 0x1234);
-    wcscpy_s_nid_postfix(cpyBuf, 16, u"abcdef");
-    require(wcscpy_s_nid_postfix(cpyBuf + 1, 10, cpyBuf) == 22 && cpyBuf[1] == 0);
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), ((SIZE_MAX >> 1) / sizeof(char16_t)) + 1, reinterpret_cast<const std::uint16_t*>(u"a")) == 34 && cpyBuf[0] == 0x1234);
+    wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 16, reinterpret_cast<const std::uint16_t*>(u"abcdef"));
+
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf + 1), 10, reinterpret_cast<const std::uint16_t*>(cpyBuf)) == 22 && cpyBuf[1] == 0);
     set_constraint_handler_s_nid_postfix(previousHandler);
 
     char16_t ncatBuf[16];
     wmemset_nid_postfix(ncatBuf, 0xaaaa, 16);
+
     ncatBuf[0] = 0;
     require(wcsncat_nid_postfix(ncatBuf, u"hello", 3) == ncatBuf);
     require(same(ncatBuf, u"hel", 4) && ncatBuf[4] == 0xaaaa);
@@ -232,19 +189,32 @@ int main() {
     wcsncpy_s_nid_postfix(strBuf, 16, u"hello", 5);
     require(wcsncat_s_nid_postfix(strBuf, 16, u" world", 6) == 0 && same(strBuf, u"hello world", 12));
     wcsncpy_s_nid_postfix(strBuf, 16, u"foo", 3);
+
     require(wcsncat_s_nid_postfix(strBuf, 16, u"barbaz", 3) == 0 && same(strBuf, u"foobar", 7));
     wcsncpy_s_nid_postfix(strBuf, 8, u"abc", 3);
+
     require(wcsncat_s_nid_postfix(strBuf, 8, u"1234", 4) == 0 && same(strBuf, u"abc1234", 8));
     wcsncpy_s_nid_postfix(strBuf, 8, u"abc", 3);
+
     require(wcsncat_s_nid_postfix(strBuf, 8, u"12345", 5) == 34 && strBuf[0] == 0);
     wmemset_nid_postfix(strBuf, u'x', 4);
+
     require(wcsncat_s_nid_postfix(strBuf, 4, u"a", 1) == 34 && strBuf[0] == 0);
     wcsncpy_s_nid_postfix(strBuf, 16, u"abc", 3);
+
+    require(wcsncat_s_nid_postfix(strBuf, 16, strBuf + 1, 2) == 0 && same(strBuf, u"abcbc", 6));
+    const char16_t splitSource[] = u"abc\0xyz";
+    std::memcpy(strBuf, splitSource, sizeof(splitSource));
+    require(wcsncat_s_nid_postfix(strBuf, 16, strBuf + 4, 3) == 22 && strBuf[0] == 0);
+    wcsncpy_s_nid_postfix(strBuf, 16, u"abc", 3);
+
     require(wcscat_s_nid_postfix(strBuf, 16, u"def") == 0 && same(strBuf, u"abcdef", 7));
     wcsncpy_s_nid_postfix(strBuf, 8, u"12345", 5);
+
     require(wcscat_s_nid_postfix(strBuf, 8, u"6789") == 34 && strBuf[0] == 0);
     require(wcscat_s_nid_postfix(nullptr, 8, u"a") == 22);
     wcsncpy_s_nid_postfix(strBuf, 8, u"123", 3);
+
     require(wcscat_s_nid_postfix(strBuf, 8, nullptr) == 22 && strBuf[0] == 0);
 
     const char16_t* text = u"a世b世c";
@@ -357,11 +327,23 @@ int main() {
     require(wcstod_nid_postfix(scientific, &end) == 350.0 && end == scientific + 5);
     require(wcstod_nid_postfix(letters, &end) == 0.0 && end == letters);
     require(wcstof_nid_postfix(u"0.25", nullptr) == 0.25f);
+    const char16_t* sign = u" -x";
+    require(std::signbit(wcstof_nid_postfix(sign, &end)) && end == sign && std::signbit(wcstold_nid_postfix(sign, &end)) && !std::signbit(wcstod_nid_postfix(sign, &end)));
+    *__error_nid_postfix() = 0;
+    require(wcstof_nid_postfix(u"0x1p+200", nullptr) == HUGE_VALF && *__error_nid_postfix() == ERANGE);
+    *__error_nid_postfix() = 0;
+    require(wcstof_nid_postfix(u"1e-45", nullptr) == 0x1p-149f && *__error_nid_postfix() == ERANGE);
+    *__error_nid_postfix() = 0;
+    require(wcstof_nid_postfix(u"0x1p-149", nullptr) == 0x1p-149f && *__error_nid_postfix() == 0);
+    require(wcstof_nid_postfix(u"0x1.8p-150", nullptr) == 0x1p-149f && *__error_nid_postfix() == ERANGE);
+    const char16_t* loneSign = u" -";
+    const float loneSignValue = wcstof_nid_postfix(loneSign, &end);
+    require(loneSignValue == 0.f && !std::signbit(loneSignValue) && end == loneSign && std::signbit(wcstold_nid_postfix(loneSign, &end)));
     const char16_t* half = u"-1.5é";
     require(wcstold_nid_postfix(half, &end) == -1.5L && end == half + 4);
     const char16_t* wideNan = u" -nan(0x123)é";
     require(std::bit_cast<std::uint64_t>(wcstod_nid_postfix(wideNan, &end)) == 0xfff8000000000123u && end == wideNan + 12);
-    require(std::bit_cast<std::uint32_t>(wcstof_nid_postfix(wideNan, &end)) == 0x7fc00000u && end == wideNan + 12);
+    require(std::bit_cast<std::uint32_t>(wcstof_nid_postfix(wideNan, &end)) == 0xffc00000u && end == wideNan + 12);
     const long double wideExtended = wcstold_nid_postfix(wideNan, &end);
     std::uint64_t significand;
     std::memcpy(&significand, &wideExtended, sizeof(significand));
@@ -373,8 +355,10 @@ int main() {
 
     char16_t transformed[8];
     wmemset_nid_postfix(transformed, 0xaaaa, 8);
+
     require(wcsxfrm_nid_postfix(transformed, u"wide", 8) == 4 && same(transformed, u"wide", 5) && transformed[5] == 0xaaaa);
     wmemset_nid_postfix(transformed, 0xaaaa, 8);
+
     require(wcsxfrm_nid_postfix(transformed, u"much too long", 4) == 13);
     if (!same(transformed, u"muc", 4)) std::fputs("wcsxfrm did not copy and terminate its truncated result\n", stderr);
     require(same(transformed, u"muc", 4) && transformed[4] == 0xaaaa);
@@ -398,6 +382,7 @@ int main() {
         TransformCase{u"\x7fff\x8000\xffff\xd83d\xde00", 6, 5, u"\x7fff\x8000\xffff\xd83d\xde00", 6}
     }) {
         wmemset_nid_postfix(transformed, 0xaaaa, 8);
+
         require(wcsxfrm_nid_postfix(transformed, test.source, test.count) == test.length);
         require(same(transformed, test.expected, test.written));
         for (std::size_t index = test.written; index < 8; ++index) require(transformed[index] == 0xaaaa);
diff --git a/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
new file mode 100644
index 0000000000..1c5227b3f8
--- /dev/null
+++ b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
@@ -0,0 +1,197 @@
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/File/include/FileFlags.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include <windows.h>
+#include <winioctl.h>
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <map>
+#include <string>
+#include <vector>
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "Directory link type check failed at line %d\n", line);
+        std::exit(1);
+    }
+}
+
+#define Require(value) Check((value), __LINE__)
+
+static void Junction(const std::filesystem::path& link, const std::filesystem::path& target) {
+    Require(std::filesystem::create_directory(link));
+    const auto printName = std::filesystem::absolute(target).make_preferred().wstring();
+    const auto substituteName = L"\\??\\" + printName;
+    struct MountPoint {
+        ULONG tag;
+        USHORT dataLength;
+        USHORT reserved;
+        USHORT substituteOffset;
+        USHORT substituteLength;
+        USHORT printOffset;
+        USHORT printLength;
+        wchar_t names[2048];
+    } data{};
+    Require(substituteName.size() + printName.size() + 2 <= std::size(data.names));
+    data.tag = IO_REPARSE_TAG_MOUNT_POINT;
+    data.substituteLength = static_cast<USHORT>(substituteName.size() * sizeof(wchar_t));
+    data.printOffset = static_cast<USHORT>((substituteName.size() + 1) * sizeof(wchar_t));
+    data.printLength = static_cast<USHORT>(printName.size() * sizeof(wchar_t));
+    data.dataLength = static_cast<USHORT>(8 + data.printOffset + data.printLength + sizeof(wchar_t));
+    std::memcpy(data.names, substituteName.c_str(), data.substituteLength + sizeof(wchar_t));
+    std::memcpy(reinterpret_cast<char*>(data.names) + data.printOffset, printName.c_str(), data.printLength + sizeof(wchar_t));
+    const auto handle = CreateFileW(link.c_str(), GENERIC_WRITE, 0, nullptr, OPEN_EXISTING,
+        FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    Require(handle != INVALID_HANDLE_VALUE);
+    DWORD returned = 0;
+    const auto result = DeviceIoControl(handle, FSCTL_SET_REPARSE_POINT, &data, 8 + data.dataLength, nullptr, 0, &returned, nullptr);
+    Require(CloseHandle(handle) != 0);
+    Require(result != 0);
+}
+
+static void OutsideApp0() {
+    const auto root = std::filesystem::absolute("anyps5-directory-links-" +
+        std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directory(root));
+    Require(std::filesystem::create_directory(root / "directory"));
+    { std::ofstream file(root / "regular"); file << "data"; }
+    std::vector<std::string> links{"junction", "dangling-junction", "loop-junction"};
+    Junction(root / links[0], root / "directory");
+    Junction(root / links[1], root / "missing");
+    Junction(root / links[2], root / links[2]);
+    if (CreateSymbolicLinkW((root / "file-link").c_str(), L"regular", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)) {
+        links.push_back("file-link");
+        Require(CreateSymbolicLinkW((root / "directory-link").c_str(), L"directory",
+            SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        links.push_back("directory-link");
+        Require(CreateSymbolicLinkW((root / "dangling-link").c_str(), L"missing", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        links.push_back("dangling-link");
+    } else {
+        Require(GetLastError() == ERROR_PRIVILEGE_NOT_HELD);
+        std::fprintf(stderr, "Symbolic-link cases require Windows developer mode or symbolic-link privilege; junction cases still run\n");
+    }
+    const int descriptor = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(descriptor >= 0);
+    std::map<std::string, std::uint8_t> entries;
+    std::array<char, 64> buffer{};
+    for (;;) {
+        const int bytes = sceKernelGetdents(descriptor, buffer.data(), static_cast<int>(buffer.size()));
+        Require(bytes >= 0 && bytes <= static_cast<int>(buffer.size()));
+        if (bytes == 0) break;
+        for (int offset = 0; offset < bytes;) {
+            std::uint16_t length = 0;
+            std::memcpy(&length, buffer.data() + offset + 4, sizeof(length));
+            const auto nameLength = static_cast<std::uint8_t>(buffer[offset + 7]);
+            Require(length >= 8 + nameLength + 1 && offset + length <= bytes);
+            const std::string name(buffer.data() + offset + 8, nameLength);
+            Require(entries.emplace(name, static_cast<std::uint8_t>(buffer[offset + 6])).second);
+            offset += length;
+        }
+    }
+    Require(sceKernelClose(descriptor) == 0);
+    Require(entries.size() == links.size() + 4);
+    Require(entries.at(".") == 4 && entries.at("..") == 4);
+    Require(entries.at("directory") == 4 && entries.at("regular") == 8);
+    for (const auto& name : links) {
+        if (entries.at(name) != 10)
+            std::fprintf(stderr, "%s: getdents type %u, expected DT_LNK (10)\n", name.c_str(), entries.at(name));
+        Require(entries.at(name) == 10);
+        const auto path = root / name;
+        FileStat status{};
+        Require(lstat_nid_postfix(path.string().c_str(), &status) == 0);
+        Require((status.st_mode & 0170000) == 0120000);
+    }
+    for (const auto& name : links) Require(RemoveDirectoryW((root / name).c_str()) != 0 || DeleteFileW((root / name).c_str()) != 0);
+    Require(std::filesystem::remove_all(root) == 3);
+}
+
+
+static std::map<std::string, std::uint8_t> Types(const char* path) {
+    const int descriptor = sceKernelOpen(path, SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(descriptor >= 0);
+    std::map<std::string, std::uint8_t> entries;
+    std::array<char, 64> buffer{};
+    for (;;) {
+        const int bytes = sceKernelGetdents(descriptor, buffer.data(), static_cast<int>(buffer.size()));
+        Require(bytes >= 0 && bytes <= static_cast<int>(buffer.size()));
+        if (bytes == 0) break;
+        for (int offset = 0; offset < bytes;) {
+            std::uint16_t length = 0;
+            std::memcpy(&length, buffer.data() + offset + 4, sizeof(length));
+            const auto nameLength = static_cast<std::uint8_t>(buffer[offset + 7]);
+            Require(length >= 8 + nameLength + 1 && offset + length <= bytes);
+            Require(entries.emplace(std::string(buffer.data() + offset + 8, nameLength),
+                static_cast<std::uint8_t>(buffer[offset + 6])).second);
+            offset += length;
+        }
+    }
+    Require(sceKernelClose(descriptor) == 0);
+    return entries;
+}
+
+int main() {
+    const auto previous = std::filesystem::current_path();
+    const auto root = previous / ("anyps5-app0-links-" +
+        std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directories(root / "app0" / "real"));
+    Require(std::filesystem::create_directories(root / "external"));
+    Require(std::filesystem::create_directories(root / "data"));
+    Require(std::filesystem::create_directories(root / "app0-sibling"));
+    std::filesystem::current_path(root);
+    OutsideApp0();
+    std::vector<std::filesystem::path> links;
+    const auto junction = [&](const std::filesystem::path& link, const std::filesystem::path& target) {
+        Junction(root / link, root / target);
+        links.push_back(link);
+    };
+    junction("app0/packed", "external");
+    junction("app0/chain", "app0/packed");
+    junction("app0/dangling", "missing");
+    junction("app0/loop", "app0/loop");
+    junction("app0/real/nested", "external");
+    junction("external/nested", "app0/real");
+    junction("data/saved", "external");
+    junction("app0-sibling/saved", "external");
+    { std::ofstream file(root / "external/regular"); file << "data"; }
+    const bool symbolic = CreateSymbolicLinkW((root / "app0/file-link").c_str(), L"..\\external\\regular",
+        SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0;
+    if (symbolic) {
+        links.push_back("app0/file-link");
+        Require(CreateSymbolicLinkW((root / "app0/relative").c_str(), L"..\\external",
+            SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        links.push_back("app0/relative");
+    } else {
+        Require(GetLastError() == ERROR_PRIVILEGE_NOT_HELD);
+        std::fprintf(stderr, "app0 symbolic-link subcases skipped: privilege unavailable\n");
+    }
+    auto app0 = Types("/app0");
+    std::fprintf(stderr, "app0 packed/chain/real types: %u/%u/%u (expected 4/4/4)\n", app0.at("packed"), app0.at("chain"), app0.at("real"));
+    Require(app0.at("real") == 4 && app0.at("packed") == 4 && app0.at("chain") == 4);
+    Require(app0.at("dangling") == 10 && app0.at("loop") == 10);
+    if (symbolic) Require(app0.at("file-link") == 8 && app0.at("relative") == 4);
+    Require(Types("/app0/real").at("nested") == 4);
+    Require(Types("/app0/packed").at("nested") == 10);
+    Require(Types("/data").at("saved") == 10);
+    Require(Types((root / "app0-sibling").string().c_str()).at("saved") == 10);
+    FileStat status{};
+    Require(lstat_nid_postfix("/app0/packed", &status) == 0 && (status.st_mode & 0170000) == 0120000);
+    for (auto it = links.rbegin(); it != links.rend(); ++it) Require(RemoveDirectoryW((root / *it).c_str()) != 0 || DeleteFileW((root / *it).c_str()) != 0);
+    std::filesystem::rename(root / "app0", root / "application");
+    Junction(root / "app0", root / "application");
+    Junction(root / "application/packed", root / "external");
+    Require(Types("/app0").at("packed") == 4);
+    Require(std::filesystem::remove(root / "application/packed"));
+    Require(std::filesystem::remove(root / "app0"));
+    std::filesystem::current_path(previous);
+    Require(root.parent_path() == previous && root.filename().string().starts_with("anyps5-app0-links-"));
+    std::filesystem::remove_all(root);
+    std::puts("Windows directory link type tests passed");
+}
diff --git a/core/libs/tests/GuestWorkingDirectory.cpp b/core/libs/tests/GuestWorkingDirectory.cpp
index de3ea75fc1..f14f721431 100644
--- a/core/libs/tests/GuestWorkingDirectory.cpp
+++ b/core/libs/tests/GuestWorkingDirectory.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
@@ -8,11 +9,7 @@
 #include <cstring>
 #include <fstream>
 #include <limits>
-extern "C" {
-int APS5_VABI chdir_nid_postfix(const char*);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static int allocations = 0;
 static int releases = 0;
diff --git a/core/libs/tests/GuestZlib.cpp b/core/libs/tests/GuestZlib.cpp
index e893ab95e5..9f8a857137 100644
--- a/core/libs/tests/GuestZlib.cpp
+++ b/core/libs/tests/GuestZlib.cpp
@@ -1,20 +1,15 @@
+#include "prx/libSceZlib/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
+#include <chrono>
 #include <cstdint>
 #include <cstdlib>
 #include <cstdio>
 #include <source_location>
 #include <cstring>
 #include <stdexcept>
-
-extern "C" {
-std::int32_t APS5_VABI sceZlibInitialize(const void*, std::uint64_t);
-std::int32_t APS5_VABI sceZlibFinalize();
-std::int32_t APS5_VABI sceZlibInflate(const void*, std::uint32_t, void*, std::uint32_t, std::uint64_t*);
-std::int32_t APS5_VABI sceZlibWaitForDone(std::uint64_t*, std::uint32_t*);
-std::int32_t APS5_VABI sceZlibGetResult(std::uint64_t, std::uint32_t*, std::int32_t*);
-}
+#include <thread>
 
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (value) return;
@@ -59,17 +54,20 @@ int main() {
         Require(sceZlibInflate(input, inputLength, output, capacity, &id) == 0);
         Require(id > previous);
         previous = id;
-        RequireThrows([&] { sceZlibInflate(input, inputLength, output, capacity, &id); });
-        std::uint32_t timeout = 0;
-        RequireThrows([&] { sceZlibWaitForDone(&id, &timeout); });
         std::uint64_t completed;
         Require(sceZlibWaitForDone(&completed, nullptr) == 0);
         Require(completed == id);
+        std::uint32_t timeout = 0;
+        Require(sceZlibWaitForDone(&completed, &timeout) == static_cast<std::int32_t>(0x81120027));
         Require(sceZlibGetResult(id + 1, &produced, &status) == static_cast<std::int32_t>(0x81120002));
+        Require(sceZlibGetResult(id, nullptr, &status) == static_cast<std::int32_t>(0x81120016));
         Require(sceZlibGetResult(id, &produced, &status) == 0);
         if (status != expectedStatus) std::fprintf(stderr, "input=%u capacity=%u status=%x expected=%x produced=%u\n", inputLength, capacity, static_cast<unsigned>(status), static_cast<unsigned>(expectedStatus), produced);
         Require(status == expectedStatus && produced <= capacity);
-        RequireThrows([&] { sceZlibGetResult(id, &produced, &status); });
+        std::uint32_t producedAgain = 0;
+        std::int32_t statusAgain = 0;
+        Require(sceZlibGetResult(id, &producedAgain, &statusAgain) == 0);
+        Require(producedAgain == produced && statusAgain == status);
         Require(std::all_of(storage.begin(), storage.begin() + 2048, [](auto byte) { return byte == 0xA5; }));
         Require(std::all_of(storage.begin() + 2048 + capacity, storage.end(), [](auto byte) { return byte == 0xA5; }));
     };
@@ -84,7 +82,55 @@ int main() {
     decode(compressed.data(), compressed.size() - 1, 65536, static_cast<std::int32_t>(0x811200FF));
     decode(compressed.data(), compressed.size() - 4, 8192, static_cast<std::int32_t>(0x811200FF));
     decode(compressed.data(), compressed.size() - 1, 8192, static_cast<std::int32_t>(0x811200FF));
+    alignas(2048) std::array<std::uint8_t, 3 * 8192> batch{};
+    std::array<std::uint64_t, 3> ids{};
+    for (std::size_t index = 0; index < ids.size(); ++index)
+        Require(sceZlibInflate(compressed.data(), compressed.size(), batch.data() + index * 8192, 8192, &ids[index]) == 0);
+    Require(ids[0] < ids[1] && ids[1] < ids[2]);
+    for (std::uint64_t expected : ids) {
+        std::uint64_t completed = 0;
+        Require(sceZlibWaitForDone(&completed, nullptr) == 0);
+        Require(completed == expected);
+    }
+    for (std::size_t index = 0; index < ids.size(); ++index) {
+        Require(sceZlibGetResult(ids[index], &produced, &status) == 0);
+        Require(status == 0 && produced == expectedLength);
+        Require(std::memcmp(batch.data() + index * 8192, text, sizeof(text) - 1) == 0);
+    }
+    std::uint64_t completed = 0;
+    std::uint32_t timeout = 0;
+    Require(sceZlibInflate(compressed.data(), compressed.size(), output, 8192, &id) == 0);
+    Require(sceZlibWaitForDone(&completed, &timeout) == 0);
+    Require(completed == id);
+    timeout = 20000;
+    const auto start = std::chrono::steady_clock::now();
+    Require(sceZlibWaitForDone(&completed, &timeout) == static_cast<std::int32_t>(0x81120027));
+    const auto waited = std::chrono::steady_clock::now() - start;
+    Require(waited >= std::chrono::microseconds(20000) && waited < std::chrono::seconds(1));
+    std::thread waiter([&] { Require(sceZlibWaitForDone(&completed, nullptr) == 0); });
+    std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    Require(sceZlibInflate(compressed.data(), compressed.size(), output, 8192, &id) == 0);
+    waiter.join();
+    Require(completed == id);
+    Require(sceZlibInflate(compressed.data(), compressed.size(), output, 8192, &id) == 0);
     Require(sceZlibFinalize() == 0);
+    Require(sceZlibInitialize(nullptr, 0) == 0);
+    Require(sceZlibGetResult(id, &produced, &status) == static_cast<std::int32_t>(0x81120002));
+    bool interrupted = false;
+    std::thread interruptedWaiter([&] {
+        std::uint32_t longTimeout = 5000000;
+        const auto waitStart = std::chrono::steady_clock::now();
+        try {
+            interrupted = sceZlibWaitForDone(&completed, &longTimeout) == static_cast<std::int32_t>(0x81120032);
+        } catch (const std::runtime_error&) {
+            interrupted = true;
+        }
+        Require(std::chrono::steady_clock::now() - waitStart < std::chrono::seconds(1));
+    });
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    Require(sceZlibFinalize() == 0);
+    interruptedWaiter.join();
+    Require(interrupted);
     Require(sceZlibGetResult(id, &produced, &status) == static_cast<std::int32_t>(0x81120032));
     std::array<std::uint8_t, 65536> scratch{};
     RequireThrows([&] { sceZlibInitialize(scratch.data(), scratch.size()); });
diff --git a/core/libs/tests/ImageSampleGather.cpp b/core/libs/tests/ImageSampleGather.cpp
index 3d3b40d608..2182e4d5cd 100644
--- a/core/libs/tests/ImageSampleGather.cpp
+++ b/core/libs/tests/ImageSampleGather.cpp
@@ -62,6 +62,21 @@ static void CheckPckRejectsZeroMask(std::uint32_t encoding) {
     }
     Require(rejected);
 }
+static void CheckGatherCompareAdjust(std::uint32_t word0, std::uint32_t opcodeId, RdnaOpcode opcode, std::uint32_t flags, std::uint32_t addressComponents) {
+    const std::array<std::uint32_t, 2> code{word0, 0x00801e33u};
+    const RdnaInstruction instruction = DecodeRdnaMimg(0u, code, 0u);
+    Require(instruction.op == opcode);
+    Require(instruction.imageOpcodeId == opcodeId);
+    Require(instruction.imageSampleFlags == flags);
+    Require(instruction.imageAddressComponents == addressComponents);
+    IrProgram program;
+    auto& block = program.CreateBlock();
+    program.SetEntryBlock(block);
+    TranslationContext context(program, block, 256);
+    context.TranslateInstruction(instruction);
+    Require(program.Resources().memoryInfo.size() == 1u);
+    Require(program.Resources().memoryInfo.back().imageSampleFlags == flags);
+}
 static void CheckUnsupportedOpcodeDiagnostic(std::uint32_t encoding, std::string_view expected) {
     const std::array<std::uint32_t, 2> code{(0x3cu << 26u) | ((encoding & 0x7fu) << 18u) | (encoding >> 7u), 0u};
     try {
@@ -142,6 +157,8 @@ int main() {
     CheckPck(0x63u, RdnaOpcode::ImageGather8hPck, 0xFu, 4u);
     CheckPckRejectsZeroMask(0x62u);
     CheckPckRejectsZeroMask(0x63u);
+    CheckGatherCompareAdjust(0xf1200109u, 0xc8u, RdnaOpcode::ImageGather4C, RdnaImageSampleFlagCompare | RdnaImageSampleFlagAdjust, 3u);
+    CheckGatherCompareAdjust(0xf1600109u, 0xd8u, RdnaOpcode::ImageGather4CO, RdnaImageSampleFlagCompare | RdnaImageSampleFlagOffset | RdnaImageSampleFlagAdjust, 4u);
     CheckUnsupportedOpcodeDiagnostic(0x06u, "MIMG opcode 0x06");
     CheckUnsupportedOpcodeDiagnostic(0xffu, "MIMG opcode 0xff");
 }
diff --git a/core/libs/tests/IrDumpMemory.cpp b/core/libs/tests/IrDumpMemory.cpp
new file mode 100644
index 0000000000..e68b9567f0
--- /dev/null
+++ b/core/libs/tests/IrDumpMemory.cpp
@@ -0,0 +1,96 @@
+#include "Translation/TranslationContext.hpp"
+#include "RdnaDecoder/RdnaMemoryOpDecoder.hpp"
+#include <array>
+#include <cstdio>
+#include <initializer_list>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+using namespace ShaderRecompiler;
+
+static void Require(bool value, const std::string& message) {
+    if (!value) throw std::runtime_error(message);
+}
+
+static RdnaInstruction Smem(std::uint32_t pc, std::uint32_t opcode, std::uint32_t destination, std::uint32_t base, std::uint32_t offset) {
+    const std::array<std::uint32_t, 2> code{(0x3du << 26u) | (opcode << 18u) | (destination << 6u) | (base / 2u), (125u << 25u) | offset};
+    return DecodeRdnaSmem(pc, code, 0u);
+}
+
+static RdnaInstruction Ds(std::uint32_t pc, std::uint32_t opcode, std::uint32_t offset0, std::uint32_t offset1, std::uint32_t address, std::uint32_t destination) {
+    const std::array<std::uint32_t, 2> code{(0x36u << 26u) | (opcode << 18u) | (offset1 << 8u) | offset0, (destination << 24u) | address};
+    return DecodeRdnaDs(pc, code, 0u);
+}
+
+static void Translate(IrProgram& program, std::initializer_list<RdnaInstruction> instructions) {
+    auto& block = program.CreateBlock();
+    program.SetEntryBlock(block);
+    program.BlockOrder() = {&block};
+    program.Metadata().blockInfo.resize(1);
+    TranslationContext context(program, block, 256);
+    for (const auto& instruction : instructions) {
+        context.TranslateInstruction(instruction);
+    }
+}
+
+static std::vector<std::string> Lines(const std::string& dump, const std::string& opcode) {
+    std::vector<std::string> lines;
+    std::istringstream stream(dump);
+    for (std::string line; std::getline(stream, line);) {
+        if (line.find(" " + opcode + " ") != std::string::npos) lines.push_back(line);
+    }
+    return lines;
+}
+
+static void RequireLines(const std::string& dump, const std::string& opcode, std::initializer_list<const char*> suffixes) {
+    const auto lines = Lines(dump, opcode);
+    Require(lines.size() == suffixes.size(), dump + "\nexpected " + std::to_string(suffixes.size()) + " " + opcode + " lines, found " + std::to_string(lines.size()));
+    std::size_t index = 0;
+    for (const std::string suffix : suffixes) {
+        const auto& line = lines[index++];
+        Require(line.size() >= suffix.size() && line.compare(line.size() - suffix.size(), suffix.size(), suffix) == 0, dump + "\nexpected \"" + line + "\" to end with \"" + suffix + "\"");
+    }
+}
+
+static void CheckOffsets() {
+    IrProgram program;
+    Translate(program, {
+        Smem(0x12de0u, 0x00u, 4u, 0u, 0x54u),
+        Smem(0x12de8u, 0x0au, 12u, 8u, 0x60u),
+        Ds(0x12df0u, 0x37u, 3u, 9u, 1u, 2u),
+    });
+    const auto dump = ProgramToString(program);
+    RequireLines(dump, "LoadAddressU32", {" [pc=0x00012de0 off=0x54]"});
+    RequireLines(dump, "ReadConstBuffer", {" [pc=0x00012de8 off=0x60]", " [pc=0x00012de8 off=0x64]", " [pc=0x00012de8 off=0x68]", " [pc=0x00012de8 off=0x6c]"});
+    RequireLines(dump, "LoadSharedU32", {" [pc=0x00012df0 off=0xc]", " [pc=0x00012df0 off=0x24]"});
+    Require(dump.find("  %1 = GetScalarRegister s0 (U32; uses=1)\n") != std::string::npos, dump + "\nexpected register reads without memory fields");
+}
+
+static void CheckMissingMemoryInfo() {
+    IrProgram program;
+    Translate(program, {Smem(0x40u, 0x00u, 4u, 0u, 0x54u)});
+    program.Resources().memoryInfo.clear();
+    const auto dump = ProgramToString(program);
+    RequireLines(dump, "LoadAddressU32", {" [pc=0x00000040 mem=?]"});
+    bool rejected = false;
+    try {
+        ValidateProgram(program, false);
+    } catch (const std::runtime_error& error) {
+        rejected = std::string(error.what()) == "LoadAddressU32 has an invalid memory-info index";
+        Require(rejected, std::string("unexpected validation failure: ") + error.what());
+    }
+    Require(rejected, "validation accepted a memory instruction without memory info");
+}
+
+int main() {
+    try {
+        CheckOffsets();
+        CheckMissingMemoryInfo();
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+    return 0;
+}
diff --git a/core/libs/tests/JobManagerComputeProgress.cpp b/core/libs/tests/JobManagerComputeProgress.cpp
new file mode 100644
index 0000000000..fb0d90da1c
--- /dev/null
+++ b/core/libs/tests/JobManagerComputeProgress.cpp
@@ -0,0 +1,27 @@
+#include "prx/libSceJobManager/ComputeProgress.hpp"
+#include <cstdint>
+#include <iostream>
+#include <stdexcept>
+
+int main() {
+    try {
+        JobManager::ComputeProgress progress;
+        if (progress.Publish(0xfffffffd) != 0xfffffffd || progress.Collect(0xfffffffc) != 0xfffffffc)
+            throw std::runtime_error("partial retirement before wrap failed");
+        if (progress.Publish(5) != 2 || progress.Collect(2) != 6 || progress.Collect(2) != 0)
+            throw std::runtime_error("batched completion across wrap failed");
+        if (progress.Publish(9) != 11 || progress.Collect(5) != 3 || progress.Collect(11) != 6)
+            throw std::runtime_error("partial retirement after wrap failed");
+        bool rejected = false;
+        try {
+            progress.Collect(12);
+        } catch (const std::runtime_error&) {
+            rejected = true;
+        }
+        if (!rejected || progress.Collect(11) != 0) throw std::runtime_error("an invalid completion changed retirement state");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/tests/JobManagerFailures.cpp b/core/libs/tests/JobManagerFailures.cpp
new file mode 100644
index 0000000000..d6586fcb9b
--- /dev/null
+++ b/core/libs/tests/JobManagerFailures.cpp
@@ -0,0 +1,156 @@
+#include "prx/libSceJobManager/libSceJobManager.hpp"
+#include "SceTypes.hpp"
+#include <condition_variable>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <mutex>
+#include <new>
+#include <stdexcept>
+#include <thread>
+
+namespace {
+
+int failure = 0;
+int calls = 0;
+int attributes = 0;
+int threads = 0;
+int queues = 0;
+int registrations = 0;
+
+bool Fail() { return ++calls == failure; }
+
+void Check(bool condition) {
+    if (!condition) std::abort();
+}
+
+struct EventQueue {
+    std::mutex lock;
+    std::condition_variable ready;
+    bool triggered = false;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI scePthreadAttrInit(PthreadAttr* value) {
+    if (Fail()) return 12;
+    *value = reinterpret_cast<PthreadAttr>(new int);
+    ++attributes;
+    return 0;
+}
+
+int APS5_VABI scePthreadAttrDestroy(PthreadAttr* value) {
+    delete reinterpret_cast<int*>(*value);
+    *value = nullptr;
+    --attributes;
+    return 0;
+}
+
+int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr*, int) { return Fail() ? 22 : 0; }
+int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr*, const KernelSchedParam*) { return Fail() ? 22 : 0; }
+int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr*, std::size_t) { return Fail() ? 22 : 0; }
+int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr*, KernelCpumask) { return Fail() ? 22 : 0; }
+
+int APS5_VABI scePthreadCreate(Pthread* value, const PthreadAttr*, PthreadEntry entry, void* argument, const char*) {
+    if (Fail()) return 11;
+    *value = reinterpret_cast<Pthread>(new std::thread([=] { entry(argument); }));
+    ++threads;
+    return 0;
+}
+
+int APS5_VABI scePthreadJoin(Pthread value, void**) {
+    auto* thread = reinterpret_cast<std::thread*>(value);
+    thread->join();
+    delete thread;
+    --threads;
+    return 0;
+}
+
+int APS5_VABI sceKernelCreateEqueue(KernelEqueue* value, const char*) {
+    if (Fail()) return 12;
+    *value = reinterpret_cast<KernelEqueue>(new EventQueue);
+    ++queues;
+    return 0;
+}
+
+int APS5_VABI sceKernelDeleteEqueue(KernelEqueue value) {
+    delete reinterpret_cast<EventQueue*>(value);
+    --queues;
+    return 0;
+}
+
+int APS5_VABI sceKernelWaitEqueue(KernelEqueue value, KernelEvent* event, int, int* count, const KernelUseconds*) {
+    auto& queue = *reinterpret_cast<EventQueue*>(value);
+    std::unique_lock guard(queue.lock);
+    queue.ready.wait(guard, [&queue] { return queue.triggered; });
+    event->filter = -11;
+    event->ident = 0;
+    *count = 1;
+    return 0;
+}
+
+int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue, int) { return 0; }
+
+int APS5_VABI sceKernelTriggerUserEvent(KernelEqueue value, int, void*) {
+    auto& queue = *reinterpret_cast<EventQueue*>(value);
+    const std::lock_guard guard(queue.lock);
+    queue.triggered = true;
+    queue.ready.notify_all();
+    return 0;
+}
+
+int APS5_VABI sceKernelGetEventFilter(const KernelEvent* event) { return event->filter; }
+std::uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* event) { return event->ident; }
+
+int APS5_VABI sceAgcDriverAddEqEvent(KernelEqueue, int, void*) {
+    if (Fail()) return 22;
+    ++registrations;
+    return 0;
+}
+
+int APS5_VABI sceAgcDriverDeleteEqEvent(KernelEqueue, int) {
+    --registrations;
+    return 0;
+}
+
+
+}
+
+int main() {
+    constexpr std::size_t size = 1024 * 1024;
+    void* memory = ::operator new(size, std::align_val_t{256});
+    for (const std::uint32_t computeSequences : {0u, 2u}) {
+        int failures = 0;
+        for (failure = 1; failure < 40; ++failure) {
+            alignas(64) unsigned char manager[0x100]{};
+            _ZN3sce3Job10JobManagerC1Ev(manager);
+            calls = 0;
+            bool threw = false;
+            try {
+                Check(_ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(manager, memory, size, 3, 2, computeSequences, computeSequences ? 5 : 0, nullptr) == 0);
+            } catch (const std::runtime_error&) {
+                threw = true;
+                ++failures;
+            }
+            if (threw) {
+                Check(_ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(manager, 0) == nullptr);
+                Check(_ZN3sce3Job10JobManager8shutdownEv(manager) == static_cast<int>(0x81581010u));
+            } else {
+                Check(_ZN3sce3Job10JobManager8shutdownEv(manager) == 0);
+            }
+            Check(attributes == 0 && threads == 0 && queues == 0 && registrations == 0);
+            if (!threw) break;
+            const int injected = failure;
+            failure = 0;
+            Check(_ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(manager, memory, size, 3, 2, computeSequences, computeSequences ? 5 : 0, nullptr) == 0);
+            Check(_ZN3sce3Job10JobManager8shutdownEv(manager) == 0);
+            Check(attributes == 0 && threads == 0 && queues == 0 && registrations == 0);
+            failure = injected;
+        }
+        Check(failures == (computeSequences ? 27 : 18));
+        std::printf("initialization failures recovered: %d\n", failures);
+    }
+    ::operator delete(memory, std::align_val_t{256});
+}
diff --git a/core/libs/tests/JobManagerProfiler.cpp b/core/libs/tests/JobManagerProfiler.cpp
new file mode 100644
index 0000000000..a2a4bebb5e
--- /dev/null
+++ b/core/libs/tests/JobManagerProfiler.cpp
@@ -0,0 +1,394 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceJobManager/libSceJobManager.hpp"
+#include "prx/libSceAgcDriver/libSceAgcDriver.hpp"
+#include "prx/libSceAgc/libSceAgc.hpp"
+#include "SceTypes.hpp"
+#include "prx/libSceAgcDriver/tests/execution/VulkanTestDevice.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <immintrin.h>
+#include <mutex>
+#include <thread>
+#include <vector>
+
+
+namespace {
+
+enum class Kind { Sequence, Job, Dispatch, Body };
+
+struct Event {
+    Kind kind;
+    const char* name;
+    std::uint16_t manager;
+    std::uint16_t sequence;
+    std::uint16_t dispatch;
+    std::uint16_t value;
+    std::uint16_t event;
+    std::uint64_t entry;
+    std::uint64_t argument;
+};
+
+std::mutex eventLock;
+std::vector<Event> events;
+
+void Check(bool condition, int line) {
+    if (!condition) {
+        std::fprintf(stderr, "job manager profiler check failed at line %d\n", line);
+        std::abort();
+    }
+}
+
+#define Require(value) Check((value), __LINE__)
+
+void Record(Event event) {
+    const std::lock_guard guard(eventLock);
+    events.push_back(event);
+}
+
+std::vector<Event> Snapshot() {
+    const std::lock_guard guard(eventLock);
+    return events;
+}
+
+void Clear() {
+    const std::lock_guard guard(eventLock);
+    events.clear();
+}
+
+struct Fixture {
+    alignas(256) std::array<std::uint8_t, 0x100000> memory{};
+    alignas(64) std::array<std::uint8_t, 0x100> object{};
+    ISequenceFactory* factory = nullptr;
+    std::uint16_t id = 0;
+
+    explicit Fixture(std::uint32_t workers = 1) {
+        _ZN3sce3Job10JobManagerC1Ev(object.data());
+        Require(_ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(object.data(), memory.data(), memory.size(), workers, 2, 2, 0x122, nullptr) == 0);
+        factory = _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(object.data(), 0);
+        id = static_cast<std::uint16_t>(_mm_crc32_u64(0, reinterpret_cast<std::uintptr_t>(memory.data())) >> 16);
+        Clear();
+    }
+
+    void Stop() {
+        Require(_ZN3sce3Job10JobManager8shutdownEv(object.data()) == 0);
+    }
+
+    ISequence* Create(const char* name, bool compute = false) {
+        ISequence* sequence = nullptr;
+        if (compute) Require(factory->CreateCompute(&sequence, 16, 8, 8, 4, name) == 0);
+        else Require(factory->Create(&sequence, 16, 8, 8, 4, name) == 0);
+        return sequence;
+    }
+};
+
+struct Context {
+    std::atomic<bool> entered{false};
+    std::atomic<std::uint32_t> calls{0};
+    std::atomic<bool> released{true};
+};
+
+void APS5_VABI Job(void* argument, std::uint32_t index) {
+    Record({Kind::Body, nullptr, 0, 0, 0, static_cast<std::uint16_t>(index), 0, 0, reinterpret_cast<std::uint64_t>(argument)});
+    auto& context = *static_cast<Context*>(argument);
+    ++context.calls;
+    context.entered.store(true);
+    while (!context.released.load()) std::this_thread::yield();
+}
+
+void Await(const std::atomic<bool>& flag) {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+    while (!flag.load() && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(flag.load());
+}
+
+struct Reader {
+    std::vector<Event> records = Snapshot();
+    std::size_t next = 0;
+    std::uint16_t manager;
+
+    explicit Reader(std::uint16_t id) : manager(id) {}
+
+    Event Take(Kind kind) {
+        Require(next < records.size());
+        const Event result = records[next++];
+        Require(result.kind == kind);
+        if (kind != Kind::Body) Require(result.manager == manager);
+        return result;
+    }
+
+    void Sequence(const char* name, std::uint16_t id, std::uint16_t event) {
+        const Event result = Take(Kind::Sequence);
+        Require(result.name == name && result.sequence == id && result.event == event);
+    }
+
+    std::uint16_t Dispatch(const char* name, Context& context, std::uint16_t count, std::uint16_t sequence = 0) {
+        std::uint16_t dispatch = 0;
+        for (std::uint16_t index = 0; index < count; ++index) {
+            const Event begin = Take(Kind::Job);
+            if (index == 0) dispatch = begin.dispatch;
+            Require(begin.dispatch == dispatch && begin.value == index && begin.event == 16);
+            const Event body = Take(Kind::Body);
+            Require(body.value == index && body.argument == reinterpret_cast<std::uint64_t>(&context));
+            const Event end = Take(Kind::Job);
+            Require(end.dispatch == dispatch && end.value == index && end.event == 32);
+        }
+        const Event result = Take(Kind::Dispatch);
+        Require(result.name == name && result.sequence == sequence && result.dispatch == dispatch && result.value == count);
+        Require(result.entry == reinterpret_cast<std::uint64_t>(&Job) && result.argument == reinterpret_cast<std::uint64_t>(&context));
+        return dispatch;
+    }
+
+    void Done() const { Require(next == records.size()); }
+};
+
+void EmptyAndIdentityCase() {
+    Fixture fixture;
+    const char* cpuName = "cpu";
+    const char* gpuName = "compute";
+    ISequence* cpu0 = fixture.Create(cpuName);
+    ISequence* cpu1 = fixture.Create(nullptr);
+    ISequence* gpu0 = fixture.Create(gpuName, true);
+    ISequence* gpu1 = fixture.Create(nullptr, true);
+    ISequence* unused = nullptr;
+    Require(fixture.factory->Create(&unused, 1, 1, 0, 1, "overflow") == static_cast<int>(0x81580006u));
+    Require(fixture.factory->Create(nullptr, 1, 1, 0, 1, "null") == static_cast<int>(0x81580001u));
+    for (ISequence* sequence : {cpu0, cpu1, gpu0, gpu1}) {
+        Require(sequence->SyncPoint() == 0);
+        Require(sequence->Wait() == 0);
+    }
+    Require(fixture.factory->Destroy(cpu0) == 0);
+    Require(fixture.factory->Destroy(cpu1) == 0);
+    Require(fixture.factory->DestroyCompute(gpu0) == 0);
+    Require(fixture.factory->DestroyCompute(gpu1) == 0);
+    ISequence* reused = fixture.Create(nullptr);
+    Require(fixture.factory->Destroy(reused) == 0);
+    fixture.Stop();
+    Reader reader(fixture.id);
+    reader.Sequence(cpuName, 0, 1);
+    reader.Sequence(nullptr, 1, 1);
+    reader.Sequence(gpuName, 0, 1);
+    reader.Sequence(nullptr, 1, 1);
+    reader.Sequence(cpuName, 0, 2);
+    reader.Sequence(nullptr, 1, 2);
+    reader.Sequence(gpuName, 0, 2);
+    reader.Sequence(nullptr, 1, 2);
+    reader.Sequence(nullptr, 0, 1);
+    reader.Sequence(nullptr, 0, 2);
+    reader.Done();
+}
+
+void BatchCase(bool sync, bool wait, bool compute = false) {
+    Fixture fixture;
+    const char* name = "sequence";
+    const char* firstName = "first";
+    const char* secondName = "second";
+    ISequence* sequence = fixture.Create(name, compute);
+    const std::uint16_t id = compute ? 2 : 0;
+    Context first;
+    Context second;
+    first.released.store(false);
+    Require(sequence->Dispatch(Job, &first, 1, firstName) == 0);
+    Await(first.entered);
+    if (sync) Require(sequence->SyncPoint() == 0);
+    if (wait) {
+        first.released.store(true);
+        Require(sequence->Wait() == 0);
+    }
+    Require(sequence->Dispatch(Job, &second, 4, secondName) == 0);
+    first.released.store(true);
+    Require(sequence->Wait() == 0);
+    if (compute) Require(fixture.factory->DestroyCompute(sequence) == 0);
+    else Require(fixture.factory->Destroy(sequence) == 0);
+    fixture.Stop();
+    Reader reader(fixture.id);
+    reader.Sequence(name, 0, 1);
+    reader.Sequence(name, id, 3);
+    const auto firstId = reader.Dispatch(firstName, first, 1, id);
+    if (sync || wait) {
+        reader.Sequence(name, id, 4);
+        reader.Sequence(name, id, 3);
+    }
+    const auto secondId = reader.Dispatch(secondName, second, 4, id);
+    if (!wait) Require(firstId != secondId);
+    reader.Sequence(name, id, 4);
+    reader.Sequence(name, 0, 2);
+    reader.Done();
+}
+
+void ConcurrentCase() {
+    Fixture fixture(4);
+    ISequence* sequence = fixture.Create(nullptr);
+    Context context;
+    context.released.store(false);
+    Require(sequence->Dispatch(Job, &context, 8, nullptr) == 0);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+    while (context.calls.load() < 4 && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(context.calls.load() == 4);
+    context.released.store(true);
+    Require(sequence->Wait() == 0);
+    Require(fixture.factory->Destroy(sequence) == 0);
+    fixture.Stop();
+    Reader reader(fixture.id);
+    reader.Sequence(nullptr, 0, 1);
+    reader.Sequence(nullptr, 0, 3);
+    std::array<std::uint16_t, 8> states{};
+    std::uint16_t dispatch = 0;
+    for (std::size_t index = 0; index < states.size() * 3; ++index) {
+        Require(reader.next < reader.records.size());
+        const Event event = reader.records[reader.next++];
+        Require(event.value < states.size());
+        auto& state = states[event.value];
+        if (event.kind == Kind::Job) {
+            if (index == 0) dispatch = event.dispatch;
+            Require(event.manager == fixture.id && event.dispatch == dispatch);
+            Require((state == 0 && event.event == 16) || (state == 2 && event.event == 32));
+        } else {
+            Require(event.kind == Kind::Body && state == 1 && event.argument == reinterpret_cast<std::uint64_t>(&context));
+        }
+        ++state;
+    }
+    for (const auto state : states) Require(state == 3);
+    const Event metadata = reader.Take(Kind::Dispatch);
+    Require(metadata.dispatch == dispatch && metadata.value == 8 && metadata.sequence == 0 && metadata.name == nullptr);
+    Require(metadata.entry == reinterpret_cast<std::uint64_t>(&Job) && metadata.argument == reinterpret_cast<std::uint64_t>(&context));
+    reader.Sequence(nullptr, 0, 4);
+    reader.Sequence(nullptr, 0, 2);
+    reader.Done();
+}
+
+void GpuBarrierCase(bool mixed, bool cpuAfter) {
+    Fixture fixture;
+    ISequence* sequence = fixture.Create(nullptr, true);
+    alignas(256) static const std::array<std::uint32_t, 1> code{0xbf810000u};
+    const auto address = reinterpret_cast<std::uint64_t>(code.data());
+    const std::array<ShaderRegister, 7> registers{{{0x20c, static_cast<std::uint32_t>(address >> 8)}, {0x20d, static_cast<std::uint32_t>(address >> 40) & 0xff}, {0x207, 1}, {0x208, 1}, {0x209, 1}, {0x212, 0}, {0x213, 0}}};
+    const std::array<std::uint32_t, 8> specials{0, 0, 0, 0, 1, 0, 0, 0};
+    const ShaderRegister* registerPointer = registers.data();
+    const std::uint32_t* specialPointer = specials.data();
+    std::array<std::uint8_t, 0x80> shader{};
+    std::memcpy(shader.data() + 0x20, &registerPointer, sizeof(registerPointer));
+    std::memcpy(shader.data() + 0x28, &specialPointer, sizeof(specialPointer));
+    shader[0x5c] = static_cast<std::uint8_t>(registers.size());
+    alignas(64) std::uint32_t gate = 0;
+    alignas(256) std::array<std::uint32_t, 32> commands{};
+    CommandBuffer buffer{commands.data(), commands.data() + commands.size(), commands.data(), commands.data() + commands.size(), nullptr, nullptr, 0};
+    Require(sceAgcAcbWaitRegMem(&buffer, 0, 3, 3, &gate, 1, 0xffffffffu, 0x190) != nullptr);
+    const Packet packet{commands.data(), static_cast<std::uint32_t>(buffer.cursor_up - commands.data()), 0, {}};
+    Require(sceAgcDriverSubmitAcb(0x21, &packet) == 0);
+    Context context;
+    if (mixed) {
+        context.released.store(false);
+        Require(sequence->Dispatch(Job, &context, 1, nullptr) == 0);
+        Await(context.entered);
+    }
+    Require(sequence->DispatchCompute(shader.data(), nullptr, 1, 1, 1, nullptr) == 0);
+    Require(sequence->SyncPoint() == 0);
+    if (cpuAfter) {
+        Require(sequence->Dispatch(Job, &context, 1, nullptr) == 0);
+        Require(sequence->SyncPoint() == 0);
+    }
+    Require(sequence->DispatchCompute(shader.data(), nullptr, 1, 1, 1, nullptr) == 0);
+    context.released.store(true);
+    std::atomic_ref<std::uint32_t>(gate).store(1);
+    Require(sequence->Wait() == 0);
+    Require(fixture.factory->DestroyCompute(sequence) == 0);
+    fixture.Stop();
+    Reader reader(fixture.id);
+    reader.Sequence(nullptr, 0, 1);
+    reader.Sequence(nullptr, 2, 3);
+    if (cpuAfter) {
+        reader.Sequence(nullptr, 2, 4);
+        reader.Sequence(nullptr, 2, 3);
+    }
+    if (mixed || cpuAfter) {
+        reader.Dispatch(nullptr, context, 1, 2);
+        reader.Sequence(nullptr, 2, 4);
+        reader.Sequence(nullptr, 2, 3);
+    }
+    reader.Sequence(nullptr, 2, 4);
+    reader.Sequence(nullptr, 0, 2);
+    reader.Done();
+}
+
+void ShutdownCase(bool queued) {
+    Fixture fixture;
+    ISequence* sequence = fixture.Create(nullptr);
+    Context first;
+    Context canceled;
+    first.released.store(false);
+    Require(sequence->Dispatch(Job, &first, 1, nullptr) == 0);
+    Await(first.entered);
+    if (queued) {
+        Require(sequence->SyncPoint() == 0);
+        Require(sequence->Dispatch(Job, &canceled, 1, "canceled") == 0);
+    }
+    std::atomic<bool> stopping{false};
+    std::thread stopper([&] {
+        stopping.store(true);
+        fixture.Stop();
+    });
+    Await(stopping);
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    first.released.store(true);
+    stopper.join();
+    Require(!canceled.entered.load());
+    Reader reader(fixture.id);
+    reader.Sequence(nullptr, 0, 1);
+    reader.Sequence(nullptr, 0, 3);
+    reader.Dispatch(nullptr, first, 1);
+    if (queued) {
+        reader.Sequence(nullptr, 0, 4);
+        reader.Sequence(nullptr, 0, 3);
+    }
+    reader.Done();
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI sceRazorCpuJobManagerSequence(const char* name, std::uint16_t manager, std::uint16_t sequence, std::uint16_t event) {
+    Record({Kind::Sequence, name, manager, sequence, 0, 0, event, 0, 0});
+    return -1;
+}
+
+int APS5_VABI sceRazorCpuJobManagerJob(std::uint16_t manager, std::uint16_t dispatch, std::uint16_t index, std::uint16_t event) {
+    Record({Kind::Job, nullptr, manager, 0, dispatch, index, event, 0, 0});
+    return -1;
+}
+
+int APS5_VABI sceRazorCpuJobManagerDispatch(const char* name, std::uint16_t manager, std::uint16_t sequence, std::uint16_t dispatch, std::uint16_t count, std::uint64_t entry, std::uint64_t argument) {
+    Record({Kind::Dispatch, name, manager, sequence, dispatch, count, 0, entry, argument});
+    return -1;
+}
+
+}
+
+int main(int argc, char** argv) {
+    if (argc == 2 && std::strcmp(argv[1], "gpu") == 0) {
+        auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        device.reset();
+        GpuBarrierCase(false, false);
+        GpuBarrierCase(false, true);
+        GpuBarrierCase(true, false);
+        AgcDriverShutdown_nid_postfix();
+        std::puts("job manager GPU profiler tests passed");
+        return 0;
+    }
+    if (argc != 1) return 2;
+    EmptyAndIdentityCase();
+    BatchCase(false, false);
+    BatchCase(true, false);
+    BatchCase(false, true);
+    BatchCase(true, false, true);
+    ConcurrentCase();
+    ShutdownCase(false);
+    ShutdownCase(true);
+    std::puts("job manager profiler tests passed");
+}
diff --git a/core/libs/tests/JobManagerReference.cpp b/core/libs/tests/JobManagerReference.cpp
new file mode 100644
index 0000000000..f3934c5cf6
--- /dev/null
+++ b/core/libs/tests/JobManagerReference.cpp
@@ -0,0 +1,97 @@
+#include "prx/libSceJobManager/libSceJobManager.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#include <string>
+#endif
+
+
+int RunJobManagerCase(const char* name);
+
+template <typename T>
+static T Resolve(const char* nid) {
+    const bool host = std::getenv("ANYPS5_JOB_MANAGER_HOST") != nullptr;
+    const char* library = host ? "libSceJobManager.prx" : "libSceJobManager.prx.guest.prx";
+#ifdef _WIN32
+    HMODULE module = GetModuleHandleA(library);
+    if (module == nullptr && host) module = LoadLibraryA("libs\\libSceJobManager.prx");
+    const FARPROC symbol = module != nullptr ? GetProcAddress(module, nid) : nullptr;
+    if (symbol == nullptr) {
+        std::fprintf(stderr, "JobManager reference: missing %s in %s (Windows error %lu)\n", nid, library, GetLastError());
+        std::exit(3);
+    }
+#else
+    static void* module = dlopen(host ? "libs/libSceJobManager.prx" : "app0/sce_module/libSceJobManager.prx.guest.prx", RTLD_NOW | RTLD_LOCAL);
+    const std::string name = host ? nid : std::string(nid) + "#guest";
+    void* symbol = module != nullptr ? dlsym(module, name.c_str()) : nullptr;
+    if (symbol == nullptr) {
+        std::fprintf(stderr, "JobManager reference: missing %s in %s (%s)\n", name.c_str(), library, dlerror());
+        std::exit(3);
+    }
+#endif
+    return reinterpret_cast<T>(symbol);
+}
+
+extern "C" {
+
+void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void* self) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManagerC1Ev)>("cwMzzdesLlY");
+    call(self);
+}
+
+void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManagerD1Ev)>("4g1ee34TMH8");
+    call(self);
+}
+
+std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams* query) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE)>("Nm2BhAwYNFk");
+    return call(query);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeSequences, std::uint64_t mask, const ConfigParams* config) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE)>("GS9DSbzC+MY");
+    return call(self, memory, size, workers, sequences, computeSequences, mask, config);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, const ConfigParams* config) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE)>("d205iUFMyyE");
+    return call(self, memory, size, workers, sequences, config);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager8shutdownEv)>("chxnvsxxfBY");
+    return call(self);
+}
+
+ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE)>("W-yXgQmaozU");
+    return call(self, priority);
+}
+
+ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE)>("L5jTAtk3HKA");
+    return call(self, priority);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager24setPersistentThreadCountEj)>("VTKezfYu-v4");
+    return call(self, count);
+}
+
+int APS5_VABI Run_nid_no_patch() {
+    const char* name = std::getenv("ANYPS5_JOB_MANAGER_CASE");
+    const int result = name != nullptr ? RunJobManagerCase(name) : 2;
+#ifdef _WIN32
+    return result;
+#else
+    std::exit(result);
+#endif
+}
+
+}
diff --git a/core/libs/tests/JobManagerRegistration.cpp b/core/libs/tests/JobManagerRegistration.cpp
new file mode 100644
index 0000000000..056b51a6b3
--- /dev/null
+++ b/core/libs/tests/JobManagerRegistration.cpp
@@ -0,0 +1,86 @@
+#include "prx/libSceJobManager/libSceJobManager.hpp"
+#include "SceTypes.hpp"
+#include <array>
+#include <atomic>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+namespace {
+
+alignas(256) std::array<std::uint8_t, 0x4000> workArea{};
+alignas(64) std::array<std::uint8_t, 0x100> manager{};
+std::uint32_t registrationCalls = 0;
+std::uint32_t unregistrationCalls = 0;
+std::uint32_t assignedId = 0;
+bool writeId = true;
+int registrationResult = 0;
+std::atomic<std::uint32_t> jobs{0};
+
+void Require(bool condition) {
+    if (!condition) std::abort();
+}
+
+int Initialize(bool unified, void* memory) {
+    if (unified) return _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(manager.data(), memory, workArea.size(), 1, 1, 0, 0, nullptr);
+    return _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(manager.data(), memory, workArea.size(), 1, 1, nullptr);
+}
+
+void APS5_VABI Count(void*, std::uint32_t) {
+    ++jobs;
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI _sceUlobjmgrRegisterObject_nid_postfix(std::uint64_t object, std::int32_t kind, std::uint32_t* id) {
+    Require(object == reinterpret_cast<std::uintptr_t>(workArea.data()) && kind == 0x21 && id != nullptr);
+    Require(workArea[0] == 0x4a && workArea[1] == 0x4d);
+    Require(_ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(manager.data(), 0) != nullptr);
+    ++registrationCalls;
+    if (writeId) *id = assignedId;
+    return registrationResult;
+}
+
+int APS5_VABI _sceUlobjmgrUnregisterObject_nid_postfix(std::uint32_t id) {
+    Require(id == (writeId ? assignedId : 0));
+    Require(_ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(manager.data(), 0) != nullptr);
+    ++unregistrationCalls;
+    return 37;
+}
+
+}
+
+int main() {
+    for (const bool unified : {false, true}) {
+        for (const auto [result, assignsId] : std::array<std::pair<int, bool>, 5>{{{0, true}, {22, true}, {static_cast<int>(0x8002000cu), true}, {22, false}, {static_cast<int>(0x8002000cu), false}}}) {
+            for (const bool destructor : {false, true}) {
+                _ZN3sce3Job10JobManagerC1Ev(manager.data());
+                const auto before = registrationCalls;
+                Require(Initialize(unified, nullptr) == static_cast<int>(0x81581001u));
+                Require(registrationCalls == before);
+                registrationResult = result;
+                writeId = assignsId;
+                assignedId = 101 + before;
+                Require(Initialize(unified, workArea.data()) == result);
+                Require(registrationCalls == before + 1 && unregistrationCalls == before);
+                Require(Initialize(unified, workArea.data()) == static_cast<int>(0x81581020u));
+                Require(registrationCalls == before + 1);
+                auto* factory = _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(manager.data(), 0);
+                ISequence* sequence = nullptr;
+                Require(factory->Create(&sequence, 3, 1, 0, 1, nullptr) == 0);
+                jobs = 0;
+                Require(sequence->Dispatch(Count, nullptr, 3, nullptr) == 0);
+                Require(factory->Destroy(sequence) == 0 && jobs == 3);
+                if (destructor) _ZN3sce3Job10JobManagerD1Ev(manager.data());
+                else Require(_ZN3sce3Job10JobManager8shutdownEv(manager.data()) == 0);
+                Require(unregistrationCalls == before + 1);
+                Require(_ZN3sce3Job10JobManager8shutdownEv(manager.data()) == static_cast<int>(0x81581010u));
+                _ZN3sce3Job10JobManagerD1Ev(manager.data());
+                Require(unregistrationCalls == before + 1);
+            }
+        }
+    }
+    std::puts("job manager registration tests passed");
+}
diff --git a/core/libs/tests/JsonCopyFailure.cpp b/core/libs/tests/JsonCopyFailure.cpp
index 6f95b142e3..b8e2562656 100644
--- a/core/libs/tests/JsonCopyFailure.cpp
+++ b/core/libs/tests/JsonCopyFailure.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJson2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,58 +6,10 @@
 #include <cstdlib>
 #include <cstring>
 #include <new>
+#include <type_traits>
 #include <initializer_list>
 
-struct Value { void* node; };
-struct String { void* text; };
-struct Array { void* items; };
-struct Object { void* items; };
-struct Iterator { void* state; };
-struct Pair { String key; std::uint64_t reserved; Value value; };
-
-extern "C" {
-Iterator* APS5_VABI _ZNK3sce4Json5Array5beginEv(Iterator*, const Array*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object5beginEv(Iterator*, const Object*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorC1ERKS2_(Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorC1ERKS2_(Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorD1Ev(Iterator*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorD1Ev(Iterator*);
-void APS5_VABI _ZN3sce4Json5Value4swapERS1_(Value*, Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1Ev(Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1EPKc(Value*, const char*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6StringE(Value*, const String*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_5ArrayE(Value*, const Array*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(Value*, const Object*);
-void APS5_VABI _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(Value*, std::int32_t);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKS1_(Value*, const Value*);
-void APS5_VABI _ZN3sce4Json5ValueD1Ev(Value*);
-Value* APS5_VABI _ZN3sce4Json5ValueaSERKS1_(Value*, const Value*);
-int APS5_VABI _ZN3sce4Json5Value3setERKNS0_5ArrayE(Value*, const Array*);
-int APS5_VABI _ZN3sce4Json5Value3setERKNS0_6ObjectE(Value*, const Object*);
-int APS5_VABI _ZN3sce4Json5Value3setENS0_9ValueTypeE(Value*, std::int32_t);
-std::int32_t APS5_VABI _ZNK3sce4Json5Value7getTypeEv(const Value*);
-const Array* APS5_VABI _ZNK3sce4Json5Value8getArrayEv(const Value*);
-const Object* APS5_VABI _ZNK3sce4Json5Value9getObjectEv(const Value*);
-int APS5_VABI _ZN3sce4Json5Value9serializeERNS0_6StringE(Value*, String*);
-int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(Value*, const char*, std::size_t);
-void APS5_VABI _ZN3sce4Json6StringC1Ev(String*);
-void APS5_VABI _ZN3sce4Json6StringC1EPKc(String*, const char*);
-void APS5_VABI _ZN3sce4Json6StringD1Ev(String*);
-const char* APS5_VABI _ZNK3sce4Json6String5c_strEv(const String*);
-void APS5_VABI _ZN3sce4Json5ArrayC1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(Array*, const Array*);
-void APS5_VABI _ZN3sce4Json5ArrayD1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(Array*, const Value*);
-std::size_t APS5_VABI _ZNK3sce4Json5Array4sizeEv(const Array*);
-const Value* APS5_VABI _ZNK3sce4Json5Array5frontEv(const Array*);
-void APS5_VABI _ZN3sce4Json6ObjectC1Ev(Object*);
-void APS5_VABI _ZN3sce4Json6ObjectC1ERKS1_(Object*, const Object*);
-void APS5_VABI _ZN3sce4Json6ObjectD1Ev(Object*);
-Object* APS5_VABI _ZN3sce4Json6ObjectaSERKS1_(Object*, const Object*);
-std::size_t APS5_VABI _ZNK3sce4Json6Object4sizeEv(const Object*);
-void APS5_VABI _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(Pair*, const String*, const Value*);
-void APS5_VABI _ZN3sce4Json6Object4PairD1Ev(Pair*);
-}
+using namespace SceJson2;
 
 static std::ptrdiff_t allocationBudget = -1;
 static std::size_t liveAllocations = 0;
@@ -95,9 +48,112 @@ static void Require(bool condition, const char* message) {
 static void CheckValue(const Value& value, const char* expected) {
     String output{};
     _ZN3sce4Json6StringC1Ev(&output);
+
     Require(_ZN3sce4Json5Value9serializeERNS0_6StringE(const_cast<Value*>(&value), &output) == 0, "serialization failed");
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&output), expected) == 0, "value changed");
     _ZN3sce4Json6StringD1Ev(&output);
+
+}
+
+struct HandlerContext {
+    Value fallback{};
+    const Value* parent = nullptr;
+    unsigned calls = 0;
+};
+
+static const Value& APS5_VABI OnTypeMismatch(ValueType requested, const Value* value, const Value* second, void* context) {
+    auto& handler = *static_cast<HandlerContext*>(context);
+    Require(requested == 2 && value == handler.parent && second == nullptr, "handler arguments changed");
+    ++handler.calls;
+    return handler.fallback;
+}
+
+static void CheckHandler(HandlerContext& handler) {
+    Require(*_ZNK3sce4Json5Value10getIntegerEv(handler.parent) == 77 && handler.calls == 1, "handler was lost");
+}
+
+static int APS5_VABI ReadNext(char& character, void* context) {
+    auto& cursor = *static_cast<const char**>(context);
+    character = *cursor;
+    if (!character) return -1;
+    ++cursor;
+    return 0;
+}
+
+static bool Parse(const char* document, bool valid, bool callback, const char* expected = nullptr) {
+    Value result{};
+    HandlerContext handler{};
+    _ZN3sce4Json5ValueC1EPKc(&result, "previous");
+    _ZN3sce4Json5ValueC1El(&handler.fallback, 77);
+    handler.parent = &result;
+    Require(_ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(&result, OnTypeMismatch, &handler) == 0, "set handler failed");
+    bool completed = false;
+    allocationBudget = activeBudget;
+    try {
+        const char* cursor = document;
+        const int status = callback ? _ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(&result, ReadNext, &cursor)
+                                    : _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&result, document, std::strlen(document));
+        Require(status == (valid ? 0 : (callback ? -1 : static_cast<int>(0x80848101))), "unexpected parse result");
+        completed = true;
+    } catch (const std::bad_alloc&) {
+    }
+    allocationBudget = -1;
+    CheckValue(result, completed && valid ? (expected ? expected : document) : "\"previous\"");
+    CheckHandler(handler);
+    _ZN3sce4Json5ValueD1Ev(&result);
+    _ZN3sce4Json5ValueD1Ev(&handler.fallback);
+    return completed;
+}
+
+static bool ObjectEntry(const char* keyText) {
+    Object object{};
+    String oldKey{}, newKey{};
+    HandlerContext handler{};
+    _ZN3sce4Json6ObjectC1Ev(&object);
+    _ZN3sce4Json6StringC1EPKc(&oldKey, "kept");
+    _ZN3sce4Json6StringC1EPKc(&newKey, keyText);
+    Value* kept = _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &oldKey);
+    Require(_ZN3sce4Json5Value3setEPKc(kept, "previous") == 0, "prepare entry failed");
+    _ZN3sce4Json5ValueC1El(&handler.fallback, 77);
+    handler.parent = kept;
+    Require(_ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(kept, OnTypeMismatch, &handler) == 0, "set handler failed");
+    bool completed = false;
+    Value* inserted = nullptr;
+    allocationBudget = activeBudget;
+    try {
+        inserted = _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &newKey);
+        completed = true;
+    } catch (const std::bad_alloc&) {
+    }
+    allocationBudget = 0;
+    Require(_ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &oldKey) == kept, "existing entry changed");
+    allocationBudget = -1;
+    Require(_ZNK3sce4Json6Object4sizeEv(&object) == (completed ? 2 : 1), "failed insertion changed object size");
+    if (completed) Require(inserted && _ZNK3sce4Json5Value7getTypeEv(inserted) == 0, "new entry is not null");
+    CheckValue(*kept, "\"previous\"");
+    CheckHandler(handler);
+    _ZN3sce4Json6ObjectD1Ev(&object);
+    _ZN3sce4Json6StringD1Ev(&newKey);
+    _ZN3sce4Json6StringD1Ev(&oldKey);
+    _ZN3sce4Json5ValueD1Ev(&handler.fallback);
+    return completed;
+}
+
+template<typename TOperation>
+static unsigned CheckFailures(const char* name, TOperation operation) {
+    activeCase = name;
+    bool succeeded = false;
+    unsigned failures = 0;
+    for (activeBudget = 0; activeBudget < 256 && !succeeded; ++activeBudget) {
+        const auto before = liveAllocations;
+        succeeded = operation();
+        if (liveAllocations != before) std::fprintf(stderr, "expected %zu live allocations, got %zu\n", before, liveAllocations);
+        Require(liveAllocations == before, "operation leaked allocations");
+        failures += !succeeded;
+    }
+    Require(succeeded, "operation never succeeded");
+    std::printf("%s: %u allocation failures, no leaks\n", name, failures);
+    return failures;
 }
 
 enum class Operation {
@@ -115,6 +171,7 @@ static bool Run(Operation operation, const Value& source, const char* expected,
     const bool typeSetter = operation == Operation::SetTypeArray || operation == Operation::SetTypeObject || operation == Operation::SetTypeString;
     if (operation == Operation::ValueAssign || operation == Operation::SetArray || operation == Operation::SetObject || typeSetter) {
         _ZN3sce4Json5ValueC1EPKc(&result, "previous");
+
         valueReady = true;
     }
     if (operation == Operation::ArrayAppend) { _ZN3sce4Json5ArrayC1Ev(&arrayResult); arrayReady = true; }
@@ -133,14 +190,14 @@ static bool Run(Operation operation, const Value& source, const char* expected,
             case Operation::ValueObject: _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(&result, &object); valueReady = true; break;
             case Operation::ValueString: _ZN3sce4Json5ValueC1ERKNS0_6StringE(&result, &text); valueReady = true; break;
             case Operation::ValueText: _ZN3sce4Json5ValueC1EPKc(&result, _ZNK3sce4Json6String5c_strEv(&text)); valueReady = true; break;
-            case Operation::ValueTypeString: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, 5); valueReady = true; break;
-            case Operation::ValueTypeArray: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, 6); valueReady = true; break;
-            case Operation::ValueTypeObject: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, 7); valueReady = true; break;
+            case Operation::ValueTypeString: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, static_cast<ValueType>(5)); valueReady = true; break;
+            case Operation::ValueTypeArray: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, static_cast<ValueType>(6)); valueReady = true; break;
+            case Operation::ValueTypeObject: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, static_cast<ValueType>(7)); valueReady = true; break;
             case Operation::SetArray: _ZN3sce4Json5Value3setERKNS0_5ArrayE(&result, &array); break;
             case Operation::SetObject: _ZN3sce4Json5Value3setERKNS0_6ObjectE(&result, &object); break;
-            case Operation::SetTypeArray: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, 6); break;
-            case Operation::SetTypeObject: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, 7); break;
-            case Operation::SetTypeString: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, 5); break;
+            case Operation::SetTypeArray: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, static_cast<ValueType>(6)); break;
+            case Operation::SetTypeObject: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, static_cast<ValueType>(7)); break;
+            case Operation::SetTypeString: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, static_cast<ValueType>(5)); break;
             case Operation::PairCopy: _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&pair, &text, &source); pairReady = true; break;
         }
         succeeded = true;
@@ -154,16 +211,19 @@ static bool Run(Operation operation, const Value& source, const char* expected,
             CheckValue(result, "\"previous\"");
         }
         _ZN3sce4Json5ValueD1Ev(&result);
+
     }
     if (arrayReady) {
         const auto count = _ZNK3sce4Json5Array4sizeEv(&arrayResult);
         Require(count == (succeeded ? (operation == Operation::ArrayAppend ? 1 : 3) : 0), "array contents changed");
         if (succeeded && operation == Operation::ArrayAppend) CheckValue(*_ZNK3sce4Json5Array5frontEv(&arrayResult), expected);
         _ZN3sce4Json5ArrayD1Ev(&arrayResult);
+
     }
     if (objectReady) {
         Require(_ZNK3sce4Json6Object4sizeEv(&objectResult) == (succeeded ? 2 : 0), "object contents changed");
         _ZN3sce4Json6ObjectD1Ev(&objectResult);
+
     }
     if (pairReady) { CheckValue(pair.value, expected); _ZN3sce4Json6Object4PairD1Ev(&pair); }
     return succeeded;
@@ -178,9 +238,11 @@ int main() {
     String text{};
     _ZN3sce4Json5ValueC1Ev(&objectValue);
     _ZN3sce4Json5ValueC1Ev(&arrayValue);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&objectValue, objectJson, std::strlen(objectJson)) == 0, "prepare object");
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&arrayValue, arrayJson, std::strlen(arrayJson)) == 0, "prepare array");
     _ZN3sce4Json6StringC1EPKc(&text, "a sufficiently long string to require its own allocation");
+
     const auto* array = _ZNK3sce4Json5Value8getArrayEv(&arrayValue);
     const auto* object = _ZNK3sce4Json5Value9getObjectEv(&objectValue);
     struct Case { const char* name; Operation operation; const Value* source; const char* expected; };
@@ -208,31 +270,27 @@ int main() {
     };
     unsigned failures = 0;
     for (const auto& test : cases) {
-        activeCase = test.name;
-        bool succeeded = false;
-        for (activeBudget = 0; activeBudget < 256 && !succeeded; ++activeBudget) {
-            const auto before = liveAllocations;
-            succeeded = Run(test.operation, *test.source, test.expected, *array, *object, text);
-            if (liveAllocations != before) std::fprintf(stderr, "expected %zu live allocations, got %zu\n", before, liveAllocations);
-            Require(liveAllocations == before, "copy leaked allocations");
-            failures += !succeeded;
+        failures += CheckFailures(test.name, [&] {
+            const bool succeeded = Run(test.operation, *test.source, test.expected, *array, *object, text);
             CheckValue(objectValue, objectJson);
             CheckValue(arrayValue, arrayJson);
-        }
-        Require(succeeded, "copy never succeeded");
+            return succeeded;
+        });
     }
-    for (bool objectIterator : {false, true}) {
+    const auto checkIterator = [&]<bool TObject>() {
+        constexpr bool objectIterator = TObject;
+        using TIterator = std::conditional_t<TObject, ObjectIterator, ArrayIterator>;
         activeCase = objectIterator ? "object iterator copy" : "array iterator copy";
         const auto before = liveAllocations;
-        Iterator source{};
-        if (objectIterator) _ZNK3sce4Json6Object5beginEv(&source, object);
+        TIterator source{};
+        if constexpr (objectIterator) _ZNK3sce4Json6Object5beginEv(&source, object);
         else _ZNK3sce4Json5Array5beginEv(&source, array);
         for (activeBudget = 0; activeBudget <= 1; ++activeBudget) {
-            Iterator copy{};
+            TIterator copy{};
             bool succeeded = false;
             allocationBudget = activeBudget;
             try {
-                if (objectIterator) _ZN3sce4Json6Object8iteratorC1ERKS2_(&copy, &source);
+                if constexpr (objectIterator) _ZN3sce4Json6Object8iteratorC1ERKS2_(&copy, &source);
                 else _ZN3sce4Json5Array8iteratorC1ERKS2_(&copy, &source);
                 succeeded = true;
             } catch (const std::bad_alloc&) {
@@ -241,13 +299,15 @@ int main() {
             allocationBudget = -1;
             Require(succeeded == (activeBudget == 1), "iterator allocation failure ignored");
             if (succeeded) Require(copy.state != source.state, "iterator copy shares owned storage");
-            if (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&copy);
+            if constexpr (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&copy);
             else _ZN3sce4Json5Array8iteratorD1Ev(&copy);
         }
-        if (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&source);
+        if constexpr (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&source);
         else _ZN3sce4Json5Array8iteratorD1Ev(&source);
         Require(liveAllocations == before, "iterator copy leaked allocations");
-    }
+    };
+    checkIterator.operator()<false>();
+    checkIterator.operator()<true>();
     activeCase = "value swap";
     bool swapSucceeded = false;
     for (activeBudget = 0; activeBudget < 256 && !swapSucceeded; ++activeBudget) {
@@ -255,9 +315,11 @@ int main() {
         Value first{}, second{};
         _ZN3sce4Json5ValueC1ERKS1_(&first, &objectValue);
         _ZN3sce4Json5ValueC1ERKS1_(&second, &arrayValue);
+
         allocationBudget = activeBudget;
         try {
             _ZN3sce4Json5Value4swapERS1_(&first, &second);
+
             swapSucceeded = true;
         } catch (const std::bad_alloc&) {
             ++failures;
@@ -269,14 +331,36 @@ int main() {
         }
         _ZN3sce4Json5ValueD1Ev(&first);
         _ZN3sce4Json5ValueD1Ev(&second);
+
         Require(liveAllocations == before, "swap leaked allocations");
         CheckValue(objectValue, objectJson);
         CheckValue(arrayValue, arrayJson);
     }
     Require(swapSucceeded, "swap never succeeded");
+    struct ParseCase { const char* name; const char* document; bool valid; bool callback; const char* expected = nullptr; };
+    const ParseCase parseCases[] = {
+        {"parse empty array", "[]", true, false},
+        {"parse empty object", "{}", true, false},
+        {"parse array", "[1]", true, false},
+        {"parse object", "{\"a\":1}", true, false},
+        {"parse nested array", arrayJson, true, false},
+        {"parse nested object", objectJson, true, false},
+        {"parse long key", "{\"a sufficiently long key to require its own allocation\":{\"child\":[1,2]}}", true, false},
+        {"parse invalid array", "[1,{\"a\":[true,null]}", false, false},
+        {"parse invalid object", "{\"a\":[{\"b\":\"a sufficiently long string allocation\"},[true,null,17]]", false, false},
+        {"parse trailing input", "{\"a\":[1]}x", true, false, "{\"a\":[1]}"},
+        {"parse callback", objectJson, true, true},
+        {"parse invalid callback", "[{\"a\":[1]}", false, true},
+    };
+    for (const auto& test : parseCases)
+        failures += CheckFailures(test.name, [&] { return Parse(test.document, test.valid, test.callback, test.expected); });
+    failures += CheckFailures("insert short key", [] { return ObjectEntry("missing"); });
+    failures += CheckFailures("insert long key", [&] { return ObjectEntry(_ZNK3sce4Json6String5c_strEv(&text)); });
     _ZN3sce4Json6StringD1Ev(&text);
     _ZN3sce4Json5ValueD1Ev(&arrayValue);
     _ZN3sce4Json5ValueD1Ev(&objectValue);
+
     Require(liveAllocations == initial, "source cleanup leaked allocations");
-    std::printf("JSON copy cleanup: %zu operations, %u allocation failures, no leaks\n", sizeof(cases) / sizeof(cases[0]) + 3, failures);
+    std::printf("JSON allocation cleanup: %zu operations, %u allocation failures, no leaks\n",
+                sizeof(cases) / sizeof(cases[0]) + sizeof(parseCases) / sizeof(parseCases[0]) + 5, failures);
 }
diff --git a/core/libs/tests/JxrStream.cpp b/core/libs/tests/JxrStream.cpp
new file mode 100644
index 0000000000..b847bbb8d8
--- /dev/null
+++ b/core/libs/tests/JxrStream.cpp
@@ -0,0 +1,236 @@
+#include "prx/libSceJxr/libSceJxr.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+#include <span>
+#include <stdexcept>
+#include <vector>
+
+
+
+namespace {
+
+constexpr std::size_t PacketSize = 4096;
+alignas(8192) std::array<std::uint8_t, 16384> ringStorage;
+std::span<std::uint8_t, 8192> ring(reinterpret_cast<std::uint8_t*>((reinterpret_cast<std::uintptr_t>(ringStorage.data()) + 16383) & ~std::uintptr_t{16383}), 8192);
+std::array<std::uint8_t, PacketSize> output;
+std::vector<char> calls;
+void* lastBuffer;
+std::size_t lastSize;
+std::size_t lastPosition;
+std::int64_t readResult;
+std::int64_t writeResult;
+std::int64_t seekResult;
+Jxr::Stream* lastStream;
+
+struct Mutation {
+    Jxr::BitIo* io = nullptr;
+    std::uint8_t* afterSeek = nullptr;
+    Jxr::Stream* afterSeekStream = nullptr;
+    std::uint8_t* afterRead = nullptr;
+    std::uint8_t* afterWrite = nullptr;
+} mutation;
+
+void Require(bool result, const char* message) {
+    if (result) return;
+    std::fprintf(stderr, "JXR stream: %s\n", message);
+    std::abort();
+}
+
+std::int64_t APS5_VABI Read(Jxr::Stream* stream, void* buffer, std::size_t size) {
+    calls.push_back('r');
+    lastStream = stream;
+    lastBuffer = buffer;
+    lastSize = size;
+    auto* bytes = static_cast<std::uint8_t*>(buffer);
+    for (std::size_t i = 0; i < size; ++i) bytes[i] = static_cast<std::uint8_t>(i * 17 + lastPosition);
+    if (mutation.afterRead) mutation.io->start = mutation.afterRead;
+    return readResult;
+}
+
+std::int64_t APS5_VABI Write(Jxr::Stream*, const void* buffer, std::size_t size) {
+    calls.push_back('w');
+    lastBuffer = const_cast<void*>(buffer);
+    lastSize = size;
+    Require(size == output.size(), "write length differs from one packet");
+    std::memcpy(output.data(), buffer, size);
+    if (mutation.afterWrite) mutation.io->start = mutation.afterWrite;
+    return writeResult;
+}
+
+std::int64_t APS5_VABI SetPosition(Jxr::Stream*, std::size_t position) {
+    calls.push_back('s');
+    lastPosition = position;
+    if (mutation.afterSeek) mutation.io->start = mutation.afterSeek;
+    if (mutation.afterSeekStream) mutation.io->stream = mutation.afterSeekStream;
+    return seekResult;
+}
+
+void Reads(Jxr::Stream& stream) {
+    for (std::size_t half : {std::size_t{0}, PacketSize}) {
+        for (std::size_t position : {std::size_t{0}, std::size_t{91}, std::numeric_limits<std::size_t>::max() - 100}) {
+            for (std::int64_t result : {std::int64_t{0}, std::int64_t{-73}, std::int64_t{0x100000001}}) {
+                std::fill(ring.begin(), ring.end(), 0xcc);
+                calls.clear();
+                readResult = result;
+                seekResult = -99;
+                Jxr::BitIo io{0x77777777, 0x12345678, 11, ~8192, ring.data() + half, ring.data() + (half ^ PacketSize), &stream, position};
+                const auto initial = io;
+                Require(readIS_nid_postfix(nullptr, &io) == 0, "read helper propagated an ignored callback error");
+                Require(calls == std::vector<char>({'s', 'r'}), "read callbacks are absent or out of order");
+                Require(lastPosition == position && lastSize == PacketSize && lastBuffer == initial.start, "read callback arguments differ");
+                Require(io.referenceOffset == position + PacketSize && io.start == ring.data() + (half ^ PacketSize), "read cursor did not advance and wrap");
+                Require(io.current == initial.current && io.accumulator == initial.accumulator && io.bitsUsed == initial.bitsUsed && io.mask == initial.mask && io.stream == initial.stream, "read changed unrelated bit state");
+                std::uint32_t shadow;
+                std::memcpy(&shadow, initial.start, sizeof(shadow));
+                Require(io.shadow == shadow, "read shadow is not the first four bytes in host order");
+                for (std::size_t i = 0; i < PacketSize; ++i) {
+                    Require(initial.start[i] == static_cast<std::uint8_t>(i * 17 + position), "refill data differs");
+                    Require(ring[(half ^ PacketSize) + i] == 0xcc, "refill changed the other half of the ring");
+                }
+            }
+        }
+    }
+}
+
+void Writes(Jxr::Stream& stream) {
+    for (std::size_t i = 0; i < ring.size(); ++i) ring[i] = static_cast<std::uint8_t>(i * 23);
+    for (std::size_t half : {std::size_t{0}, PacketSize}) {
+        for (std::int64_t result : {std::int64_t{0}, std::int64_t{-73}, std::int64_t{0x100000001}, std::numeric_limits<std::int64_t>::min()}) {
+            calls.clear();
+            writeResult = result;
+            Jxr::BitIo io{7, 19, 13, ~8192, ring.data() + half, ring.data() + (half ^ PacketSize), &stream, 1234};
+            const auto initial = io;
+            Require(writeIS_nid_postfix(nullptr, &io) == result, "write result was truncated or changed");
+            Require(calls == std::vector<char>({'w'}) && lastBuffer == initial.start && lastSize == PacketSize, "write callback arguments differ");
+            Require(std::equal(output.begin(), output.end(), initial.start), "write data differs from buffered bytes");
+            Require(io.start == (result < 0 ? initial.start : ring.data() + (half ^ PacketSize)), "failed write advanced or successful write did not wrap");
+            Require(io.shadow == initial.shadow && io.accumulator == initial.accumulator && io.bitsUsed == initial.bitsUsed && io.mask == initial.mask && io.current == initial.current && io.stream == initial.stream && io.referenceOffset == initial.referenceOffset, "write changed unrelated bit state");
+        }
+    }
+}
+
+void Buffered() {
+    for (std::size_t half : {std::size_t{0}, PacketSize}) {
+        for (std::size_t consumed : {std::size_t{0}, PacketSize - 1}) {
+            Jxr::BitIo io{123, 456, 7, ~8192, ring.data() + half, ring.data() + half + consumed, nullptr, 789};
+            const auto initial = io;
+            calls.clear();
+            Require(readIS_nid_postfix(nullptr, &io) == 0 && writeIS_nid_postfix(nullptr, &io) == 0, "buffered data unexpectedly required a stream");
+            Require(calls.empty() && std::memcmp(&initial, &io, sizeof(io)) == 0, "buffered operation mutated state or performed I/O");
+        }
+    }
+}
+
+void CallbackMutation(Jxr::Stream& stream) {
+    Jxr::Stream replacement{};
+    readResult = -73;
+    seekResult = -99;
+    std::fill(ring.begin(), ring.end(), 0xcc);
+    calls.clear();
+    Jxr::BitIo io{7, 19, 13, ~8192, ring.data(), ring.data() + PacketSize, &stream, 91};
+    mutation = {&io, ring.data() + PacketSize, &replacement, nullptr, nullptr};
+    Require(readIS_nid_postfix(nullptr, &io) == 0, "seek mutation read failed");
+    Require(calls == std::vector<char>({'s', 'r'}) && lastStream == &stream, "read did not retain the stream selected before seek");
+    Require(lastBuffer == ring.data() + PacketSize && lastSize == PacketSize, "read did not use the buffer selected by seek");
+    Require(io.stream == &replacement && io.start == ring.data() && io.referenceOffset == 91 + PacketSize, "seek mutation was lost before wrapping");
+    std::uint32_t shadow;
+    std::memcpy(&shadow, ring.data() + PacketSize, sizeof(shadow));
+    Require(io.shadow == shadow && ring.front() == 0xcc, "seek-selected buffer shadow differs");
+
+    std::fill(ring.begin(), ring.end(), 0xab);
+    calls.clear();
+    io = {7, 19, 13, ~8192, ring.data(), ring.data() + PacketSize, &stream, 123};
+    mutation = {&io, nullptr, nullptr, ring.data() + PacketSize, nullptr};
+    Require(readIS_nid_postfix(nullptr, &io) == 0, "read mutation failed");
+    Require(lastBuffer == ring.data() && io.start == ring.data(), "read mutation did not precede final wrap");
+    Require(io.shadow == 0xabababab && io.referenceOffset == 123 + PacketSize, "shadow did not use the pointer changed by read");
+
+    for (std::int64_t result : {std::int64_t{0}, std::int64_t{0x100000001}, std::int64_t{-73}}) {
+        std::fill(ring.begin(), ring.end(), 0xef);
+        calls.clear();
+        io = {7, 19, 13, ~8192, ring.data(), ring.data() + PacketSize, &stream, 789};
+        mutation = {&io, nullptr, nullptr, nullptr, ring.data() + PacketSize};
+        writeResult = result;
+        Require(writeIS_nid_postfix(nullptr, &io) == result, "mutating write result differs");
+        Require(calls == std::vector<char>({'w'}) && lastBuffer == ring.data(), "mutating write buffer differs");
+        Require(io.start == ring.data() + (result < 0 ? PacketSize : 0), "write callback mutation did not precede success wrap or failed return");
+        Require(io.referenceOffset == 789 && io.shadow == 7, "mutating write changed unrelated state");
+    }
+    mutation = {};
+}
+
+#ifdef _WIN32
+std::int64_t APS5_VABI ObserveRead(Jxr::Stream*, void*, std::size_t) {
+    calls.push_back('r');
+    return 0;
+}
+#endif
+
+void GuestMapping(Jxr::Stream& stream) {
+    constexpr std::size_t mappingSize = 0x4000;
+    std::int64_t physical = 0;
+    Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, mappingSize, 0, 0, &physical) == 0, "allocate guest packet backing");
+    void* mapping = nullptr;
+    Require(sceKernelMapDirectMemory(&mapping, mappingSize, 3, 0, physical, 0) == 0 && mapping, "map guest packet backing");
+    Require(GuestArena::GuestArenaContains_nid_postfix(mapping, mappingSize), "packet mapping is outside the guest arena");
+    auto* bytes = static_cast<std::uint8_t*>(mapping);
+    std::fill_n(bytes, mappingSize, 0xcc);
+    calls.clear();
+    readResult = 0;
+    seekResult = 0;
+    Jxr::BitIo io{7, 19, 13, ~8192, bytes, bytes + PacketSize, &stream, 91};
+    Require(readIS_nid_postfix(nullptr, &io) == 0, "guest packet refill failed");
+    Require(calls == std::vector<char>({'s', 'r'}) && lastBuffer == bytes && lastSize == PacketSize, "guest packet callback arguments differ");
+    Require(io.start == bytes + PacketSize && io.referenceOffset == 91 + PacketSize, "guest packet refill did not advance");
+    for (std::size_t i = 0; i < mappingSize; ++i) {
+        Require(bytes[i] == (i < PacketSize ? static_cast<std::uint8_t>(i * 17 + 91) : 0xcc), "guest packet refill changed unexpected bytes");
+    }
+#ifdef _WIN32
+    Require(sceKernelMprotect(mapping, mappingSize, 1) == 0, "protect guest packet backing read-only");
+    {
+        GuestArena::HostWrite access(bytes, PacketSize);
+        Require(!access.Open(), "read-only guest packet backing accepted a host write");
+    }
+    Jxr::Stream observedStream = stream;
+    observedStream.read = ObserveRead;
+    io = {7, 19, 13, ~8192, bytes, bytes + PacketSize, &observedStream, 91};
+    const auto initial = io;
+    std::array<std::uint8_t, mappingSize> before;
+    std::copy_n(bytes, mappingSize, before.begin());
+    calls.clear();
+    bool rejected = false;
+    try {
+        readIS_nid_postfix(nullptr, &io);
+    } catch (const std::runtime_error&) {
+        rejected = true;
+    }
+    Require(rejected && calls == std::vector<char>({'s'}), "rejected guest packet write invoked the read callback");
+    Require(std::memcmp(&io, &initial, sizeof(io)) == 0 && std::equal(before.begin(), before.end(), bytes), "rejected guest packet write mutated state or backing");
+    Require(sceKernelMprotect(mapping, mappingSize, 3) == 0, "restore writable guest packet backing");
+#endif
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), mappingSize) == 0, "unmap guest packet backing");
+    Require(sceKernelReleaseDirectMemory(physical, mappingSize) == 0, "release guest packet backing");
+}
+
+}
+
+int main() {
+    Jxr::Stream stream{};
+    stream.read = Read;
+    stream.write = Write;
+    stream.setPosition = SetPosition;
+    Reads(stream);
+    Writes(stream);
+    Buffered();
+    CallbackMutation(stream);
+    GuestMapping(stream);
+    return 0;
+}
diff --git a/core/libs/tests/KernelError.cpp b/core/libs/tests/KernelError.cpp
index 9355bd4b64..d0c1aa0bac 100644
--- a/core/libs/tests/KernelError.cpp
+++ b/core/libs/tests/KernelError.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <array>
@@ -6,21 +8,21 @@
 #include <stdexcept>
 #include <utility>
 
-extern "C" std::int32_t APS5_VABI sceKernelError(std::int32_t);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Require(bool value) { if (!value) throw std::runtime_error("Kernel error conversion check failed"); }
 
 int main() {
     *__error_nid_postfix() = 123;
-    const std::array<std::pair<std::int32_t, std::int32_t>, 6> cases{{
+    const std::array<std::pair<std::int32_t, std::int32_t>, 8> cases{{
         {0, 0}, {1, SCE_KERNEL_ERROR_EPERM}, {2, SCE_KERNEL_ERROR_ENOENT},
-        {4, SCE_KERNEL_ERROR_EINTR}, {14, SCE_KERNEL_ERROR_EFAULT}, {22, SCE_KERNEL_ERROR_EINVAL}
+        {4, SCE_KERNEL_ERROR_EINTR}, {14, SCE_KERNEL_ERROR_EFAULT}, {22, SCE_KERNEL_ERROR_EINVAL},
+        {95, SCE_KERNEL_ERROR_ENOTRECOVERABLE}, {96, SCE_KERNEL_ERROR_EOWNERDEAD}
     }};
     for (const auto [input, expected] : cases) {
         Require(sceKernelError(input) == expected);
         Require(*__error_nid_postfix() == 123);
     }
+    Require(SCE_KERNEL_ERROR_ENOTRECOVERABLE == static_cast<std::int32_t>(0x8002005fu));
+    Require(SCE_KERNEL_ERROR_EOWNERDEAD == static_cast<std::int32_t>(0x80020060u));
     Require(sceKernelError(-1) == static_cast<std::int32_t>(0x8001ffffu));
     Require(sceKernelError(std::numeric_limits<std::int32_t>::max()) == 0x1ffff);
     Require(sceKernelError(std::numeric_limits<std::int32_t>::min()) == 0x20000);
diff --git a/core/libs/tests/Mspace.cpp b/core/libs/tests/Mspace.cpp
index 0741744299..a50f82f104 100644
--- a/core/libs/tests/Mspace.cpp
+++ b/core/libs/tests/Mspace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -8,42 +9,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-void* APS5_VABI sceLibcMspaceCreate_nid_postfix(const char*, void*, std::size_t, unsigned);
-int APS5_VABI sceLibcMspaceDestroy_nid_postfix(void*);
-void* APS5_VABI sceLibcMspaceMalloc_nid_postfix(void*, std::size_t);
-void* APS5_VABI sceLibcMspaceCalloc_nid_postfix(void*, std::size_t, std::size_t);
-void* APS5_VABI sceLibcMspaceRealloc_nid_postfix(void*, void*, std::size_t);
-void APS5_VABI sceLibcMspaceFree_nid_postfix(void*, void*);
-int APS5_VABI sceLibcMspacePosixMemalign_nid_postfix(void*, void**, std::size_t, std::size_t);
-std::size_t APS5_VABI sceLibcMspaceMallocUsableSize_nid_postfix(const void*);
-void* APS5_VABI sceLibcMspaceMemalign_nid_postfix(void*, std::size_t, std::size_t);
-void* APS5_VABI sceLibcMspaceAlignedAlloc_nid_postfix(void*, std::size_t, std::size_t);
-void* APS5_VABI sceLibcMspaceReallocalign_nid_postfix(void*, void*, std::size_t, std::size_t);
-int APS5_VABI sceLibcMspaceMallocStats_nid_postfix(void*, void*);
-int APS5_VABI sceLibcMspaceMallocStatsFast_nid_postfix(void*, void*);
-void* APS5_VABI sceLibcPafMspaceCreate_nid_postfix(const char*, void*, std::size_t, unsigned, const void*);
-int APS5_VABI sceLibcPafMspaceDestroy_nid_postfix(void*);
-void* APS5_VABI sceLibcPafMspaceMalloc_nid_postfix(void*, std::size_t, const void*);
-void APS5_VABI sceLibcPafMspaceFree_nid_postfix(void*, void*, const void*);
-void* APS5_VABI sceLibcPafMspaceCalloc_nid_postfix(void*, std::size_t, std::size_t, const void*);
-void* APS5_VABI sceLibcPafMspaceRealloc_nid_postfix(void*, void*, std::size_t, const void*);
-void* APS5_VABI sceLibcPafMspaceReallocalign_nid_postfix(void*, void*, std::size_t, std::size_t, const void*);
-void* APS5_VABI sceLibcPafMspaceMemalign_nid_postfix(void*, std::size_t, std::size_t, const void*);
-int APS5_VABI sceLibcPafMspacePosixMemalign_nid_postfix(void*, void**, std::size_t, std::size_t, const void*);
-int APS5_VABI sceLibcPafMspaceMallocStats_nid_postfix(void*, void*);
-int APS5_VABI sceLibcPafMspaceMallocStatsFast_nid_postfix(void*, void*);
-}
-struct MallocManagedSize {
-    std::uint16_t size;
-    std::uint16_t version;
-    std::uint32_t reserved;
-    std::size_t maxSystemSize;
-    std::size_t currentSystemSize;
-    std::size_t maxInuseSize;
-    std::size_t currentInuseSize;
-};
 static void Require(bool value) {
     if (!value) { std::fputs("Mspace check failed\n", stderr); std::abort(); }
 }
@@ -87,6 +52,7 @@ static void CheckPaf() {
     sceLibcPafMspaceFree_nid_postfix(arena, aligned, &owner);
     sceLibcPafMspaceFree_nid_postfix(arena, posixAligned, &owner);
     sceLibcPafMspaceFree_nid_postfix(arena, nullptr, &owner);
+
     Require(sceLibcPafMspaceDestroy_nid_postfix(arena) == 0);
     Require(sceLibcPafMspaceDestroy_nid_postfix(arena) == -1);
 }
@@ -205,14 +171,17 @@ int main() {
     Require(sceLibcMspaceCalloc_nid_postfix(arena, std::numeric_limits<std::size_t>::max(), 2) == nullptr);
     sceLibcMspaceFree_nid_postfix(arena, blocker);
     sceLibcMspaceFree_nid_postfix(arena, aligned);
+
     Require(sceLibcMspaceRealloc_nid_postfix(arena, grown, 0) == nullptr);
     void* large = sceLibcMspaceMalloc_nid_postfix(arena, storage.size() - 256);
     Require(large != nullptr); // freeing coalesced all the fragmented blocks
     sceLibcMspaceFree_nid_postfix(arena, large);
+
     void* head = sceLibcMspaceMalloc_nid_postfix(arena, 64);
     Require(head != nullptr && sceLibcMspaceRealloc_nid_postfix(arena, head, 1024) == head);
     Require(sceLibcMspaceMallocUsableSize_nid_postfix(head) == 1024);
     sceLibcMspaceFree_nid_postfix(arena, head);
+
     std::array<void*, 2000> small{};
     for (auto& pointer : small) {
         pointer = sceLibcMspaceMalloc_nid_postfix(arena, 16);
@@ -224,6 +193,7 @@ int main() {
     large = sceLibcMspaceMalloc_nid_postfix(arena, storage.size() - 256);
     Require(large != nullptr);
     sceLibcMspaceFree_nid_postfix(arena, large);
+
     std::array<std::thread, 4> workers;
     for (auto& worker : workers) worker = std::thread([&] {
         for (int i = 0; i < 1000; ++i) {
@@ -232,6 +202,7 @@ int main() {
             std::memset(pointer, 42, 97);
             Require(sceLibcMspaceMallocUsableSize_nid_postfix(pointer) >= 97);
             sceLibcMspaceFree_nid_postfix(arena, pointer);
+
         }
     });
     for (auto& worker : workers) worker.join();
@@ -263,6 +234,7 @@ int main() {
     Require(rounded && (reinterpret_cast<std::uintptr_t>(rounded) & 127) == 0);
     Require(sceLibcMspaceMallocStatsFast_nid_postfix(arena, &stats) == 0 && stats.currentInuseSize >= 100);
     sceLibcMspaceFree_nid_postfix(arena, memaligned);
+
     void* region = sceLibcMspaceMalloc_nid_postfix(arena, 8192);
     Require(region != nullptr);
     Require(sceLibcMspaceCreate_nid_postfix("outside", static_cast<unsigned char*>(region) + 8192, 4096, 0) == nullptr);
@@ -274,6 +246,7 @@ int main() {
     Require(sceLibcMspaceCreate_nid_postfix("flags", storage.data(), storage.size(), 2) == nullptr);
     Require(sceLibcMspaceDestroy_nid_postfix(nested) == 0);
     sceLibcMspaceFree_nid_postfix(arena, region);
+
     Require(sceLibcMspaceDestroy_nid_postfix(arena) == 0);
     Require(sceLibcMspaceMalloc_nid_postfix(arena, 8) == nullptr);
     Require(sceLibcMspaceCreate_nid_postfix("reuse", storage.data(), storage.size(), 0) == arena);
diff --git a/core/libs/tests/NetBlockingSend.cpp b/core/libs/tests/NetBlockingSend.cpp
index 466cbc279a..6dba4d4900 100644
--- a/core/libs/tests/NetBlockingSend.cpp
+++ b/core/libs/tests/NetBlockingSend.cpp
@@ -130,6 +130,14 @@ int main(int argc, char** argv) {
     {
         Connection connection;
         auto sending = std::async(std::launch::async, [&] { return Send(api, connection.sender, bytes); });
+        const auto entered = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+        char peeked = 0;
+        bool arrived = false;
+        while (!arrived && std::chrono::steady_clock::now() < entered) {
+            arrived = sceNetRecv(connection.receiver, &peeked, 1, NET_MSG_PEEK | NET_MSG_DONTWAIT) > 0;
+            if (!arrived) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        }
+        Require(arrived, "send did not reach the receiver before abort");
         Require(sending.wait_for(std::chrono::milliseconds(50)) == std::future_status::timeout, "send did not wait before abort");
         Require(sceNetSocketAbort(connection.sender, 0) == 0, "abort a blocked send");
         Require(sending.wait_for(std::chrono::seconds(2)) == std::future_status::ready, "abort did not wake a blocked send");
diff --git a/core/libs/tests/NetDontWait.cpp b/core/libs/tests/NetDontWait.cpp
index 7507f2fde5..c91b7d0bb7 100644
--- a/core/libs/tests/NetDontWait.cpp
+++ b/core/libs/tests/NetDontWait.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -12,42 +14,6 @@
 #include <utility>
 #include <vector>
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t nameLength;
-    NetIovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-
-extern "C" {
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetSocketClose(int);
-int APS5_VABI sceNetSocketAbort(int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetListen(int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetAccept(int, void*, std::uint32_t*);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockopt(int, int, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetSend(int, const void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetSendmsg(int, const NetMsghdr*, int);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetRecvmsg(int, NetMsghdr*, int);
-int* APS5_VABI sceNetErrnoLoc();
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-}
-
 namespace {
 
 constexpr int DontWait = 0x80;
diff --git a/core/libs/tests/NetEmptyStream.cpp b/core/libs/tests/NetEmptyStream.cpp
new file mode 100644
index 0000000000..5757b2bdb1
--- /dev/null
+++ b/core/libs/tests/NetEmptyStream.cpp
@@ -0,0 +1,145 @@
+#include "prx/libSceNet/libSceNet.hpp"
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <future>
+#include <string_view>
+
+namespace {
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "empty stream: %s\n", message);
+    std::exit(1);
+}
+
+void SetOption(int descriptor, int option, int value) {
+    Require(sceNetSetsockopt(descriptor, 0xffff, option, &value, sizeof(value)) == 0, "set option");
+}
+
+struct Pair {
+    int sender;
+    int receiver;
+
+    explicit Pair(bool datagram) {
+        const int listener = sceNetSocket("empty-listener", 2, datagram ? 2 : 1, 0);
+        sender = sceNetSocket("empty-sender", 2, datagram ? 2 : 1, 0);
+        Require(listener >= 0 && sender >= 0, "create sockets");
+        std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+        Require(sceNetBind_nid_postfix(listener, address.data(), address.size()) == 0, "bind receiver");
+        std::uint32_t size = address.size();
+        Require(sceNetGetsockname(listener, address.data(), &size) == 0, "get receiver name");
+        if (!datagram) Require(sceNetListen(listener, 1) == 0, "listen");
+        Require(sceNetConnect(sender, address.data(), size) == 0, "connect sender");
+        if (datagram) receiver = listener;
+        else {
+            receiver = sceNetAccept(listener, nullptr, nullptr);
+            Require(receiver >= 0, "accept");
+            Require(sceNetSocketClose(listener) == 0, "close listener");
+        }
+        SetOption(receiver, 0x1106, 2000000);
+    }
+
+    ~Pair() {
+        Require(sceNetSocketClose(receiver) == 0 && sceNetSocketClose(sender) == 0, "close pair");
+    }
+
+    void Send() {
+        Require(sceNetSend(sender, "x", 1, 0) == 1, "send byte");
+    }
+};
+
+struct Result {
+    std::int64_t count;
+    int error;
+};
+
+Result Receive(std::string_view api, int descriptor, int flags, bool nullBuffer, bool datagram) {
+    char payload = 'p';
+    char control = 'c';
+    std::array<unsigned char, 16> address;
+    address.fill(0xaa);
+    std::uint32_t addressLength = address.size();
+    std::int64_t count;
+    if (api == "recv") count = sceNetRecv(descriptor, nullBuffer ? nullptr : &payload, 0, flags);
+    else if (api == "recvfrom")
+        count = sceNetRecvfrom(descriptor, nullBuffer ? nullptr : &payload, 0, flags, address.data(), &addressLength);
+    else {
+        NetIovec vector{&payload, 0};
+        NetMsghdr message{address.data(), addressLength, nullBuffer ? nullptr : &vector, nullBuffer ? 0 : 1, &control, 1, 0x4000};
+        count = sceNetRecvmsg(descriptor, &message, flags);
+        if (count >= 0) {
+            Require(message.control_length == 0, "control length is not zero");
+            Require(message.flags == (datagram ? 0x10 : 0), "unexpected output flags");
+            addressLength = message.name_length;
+        }
+    }
+    const int error = *sceNetErrnoLoc();
+    Require(payload == 'p' && control == 'c', "empty receive modified payload or control storage");
+    if (count >= 0 && api != "recv") {
+        Require(addressLength == (datagram ? 16u : 0u), "wrong sender length for an empty receive");
+        if (!datagram) Require(std::all_of(address.begin(), address.end(), [](unsigned char byte) { return byte == 0xaa; }),
+            "empty stream receive wrote a sender address");
+    }
+    return {count, error};
+}
+
+void Check(std::string_view api, std::string_view mode) {
+    const bool datagram = mode == "datagram";
+    Pair pair(datagram);
+    if (mode == "errors") {
+        auto result = Receive(api, -1, 0, false, false);
+        Require(result.count < 0 && result.error == 9, "invalid descriptor became an empty success");
+        result = Receive(api, pair.receiver, 1, false, false);
+        Require(result.count < 0 && result.error == 45, "unsupported flags became an empty success");
+        const int fresh = sceNetSocket("empty-unconnected", 2, 1, 0);
+        Require(fresh >= 0, "create unconnected socket");
+        result = Receive(api, fresh, 0, false, false);
+        std::fprintf(stderr, "unconnected result=%lld errno=%d\n", static_cast<long long>(result.count), result.error);
+        Require(result.count < 0 && result.error == 57, "fresh stream socket did not report ENOTCONN");
+        std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+        Require(sceNetBind_nid_postfix(fresh, address.data(), address.size()) == 0, "bind unconnected socket");
+        result = Receive(api, fresh, 0, false, false);
+        Require(result.count < 0 && result.error == 57, "bound stream socket did not report ENOTCONN");
+        Require(sceNetListen(fresh, 1) == 0, "listen on unconnected socket");
+        result = Receive(api, fresh, 0, false, false);
+        Require(result.count < 0 && result.error == 57, "listening socket did not report ENOTCONN");
+        Require(sceNetSocketClose(fresh) == 0, "close unconnected socket");
+        return;
+    }
+    if (mode == "queued" || datagram) pair.Send();
+    if (mode == "nonblocking") SetOption(pair.receiver, 0x1200, 1);
+    const int flags = mode == "dontwait" ? 0x80 : mode == "peek" ? 0x82 : 0;
+    auto pending = std::async(std::launch::async, [&] { return Receive(api, pair.receiver, flags, mode == "nullbuf", datagram); });
+    const bool ready = pending.wait_for(std::chrono::milliseconds(500)) == std::future_status::ready;
+    if (!ready) {
+        pair.Send();
+        Require(pending.wait_for(std::chrono::seconds(2)) == std::future_status::ready, "cleanup receive did not finish");
+    }
+    const auto result = pending.get();
+    Require(ready, "zero-length receive waited for peer data");
+    Require(result.count == 0, "zero-length receive did not return zero");
+    if (mode == "queued") {
+        char byte = 0;
+        Require(sceNetRecv(pair.receiver, &byte, 1, 0) == 1 && byte == 'x', "empty stream receive consumed data");
+    }
+    if (datagram) {
+        char byte = 0;
+        Require(sceNetRecv(pair.receiver, &byte, 1, 0x80) < 0 && *sceNetErrnoLoc() == 35,
+            "zero-length datagram receive did not consume its packet");
+    }
+    std::printf("%.*s/%.*s: zero return, output sentinels and transport semantics preserved\n",
+        static_cast<int>(api.size()), api.data(), static_cast<int>(mode.size()), mode.data());
+}
+
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 3, "expected API and mode");
+    const std::string_view api(argv[1]);
+    Require(api == "recv" || api == "recvfrom" || api == "recvmsg", "unknown API");
+    Check(api, argv[2]);
+}
diff --git a/core/libs/tests/PthreadStart.cpp b/core/libs/tests/PthreadStart.cpp
index 8750d5eb5e..8dac3f063a 100644
--- a/core/libs/tests/PthreadStart.cpp
+++ b/core/libs/tests/PthreadStart.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <future>
 #include <iostream>
@@ -6,17 +8,6 @@
 #include <windows.h>
 #endif
 
-extern "C" int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-extern "C" int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-extern "C" int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-extern "C" int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-extern "C" int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-extern "C" int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t size);
-extern "C" int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** address, std::size_t* size);
-extern "C" Pthread APS5_VABI scePthreadSelf();
-extern "C" void APS5_VABI scePthreadExit(void* retval);
-extern "C" int APS5_VABI scePthreadDetach(Pthread thread);
-
 struct ThreadContext {
     Pthread thread = nullptr;
     std::promise<void> checked;
diff --git a/core/libs/tests/SaveDataMemoryGrowth.cpp b/core/libs/tests/SaveDataMemoryGrowth.cpp
index 87d06e2a33..908bc48688 100644
--- a/core/libs/tests/SaveDataMemoryGrowth.cpp
+++ b/core/libs/tests/SaveDataMemoryGrowth.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
@@ -12,12 +13,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Save-data memory growth check failed at line %d\n", line);
diff --git a/core/libs/tests/SaveDataMemoryJournal.cpp b/core/libs/tests/SaveDataMemoryJournal.cpp
index e661a1fd1f..b1af602123 100644
--- a/core/libs/tests/SaveDataMemoryJournal.cpp
+++ b/core/libs/tests/SaveDataMemoryJournal.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -13,14 +14,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-int APS5_VABI sceSaveDataGetSaveDataMemory2(SaveDataMemoryGet2*);
-int APS5_VABI sceSaveDataSetSaveDataMemory2(const SaveDataMemorySet2*);
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Save-data memory journal check failed at line %d\n", line);
diff --git a/core/libs/tests/SaveDataMemoryMetadata.cpp b/core/libs/tests/SaveDataMemoryMetadata.cpp
index b3acb20559..f498a26fef 100644
--- a/core/libs/tests/SaveDataMemoryMetadata.cpp
+++ b/core/libs/tests/SaveDataMemoryMetadata.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -25,16 +27,6 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-int APS5_VABI sceSaveDataCreateTransactionResource(std::uint32_t);
-int APS5_VABI sceSaveDataDeleteTransactionResource(std::int32_t);
-int APS5_VABI sceSaveDataSetSaveDataMemory2(const SaveDataMemorySet2*);
-int APS5_VABI sceSaveDataSyncSaveDataMemory(const void*);
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
-}
-
 namespace {
 constexpr int kSaveDataNotInitialized = -2137063423;
 }
diff --git a/core/libs/tests/SaveDataWriteReplacement.cpp b/core/libs/tests/SaveDataWriteReplacement.cpp
index e874060c9f..ef57bfe136 100644
--- a/core/libs/tests/SaveDataWriteReplacement.cpp
+++ b/core/libs/tests/SaveDataWriteReplacement.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -13,11 +14,9 @@
 #include <vector>
 
 extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate(void);
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
+
 #ifndef SAVEDATA_NATIVE_BACKEND
-int APS5_VABI sceSaveDataSyncSaveDataMemory(const void*);
+
 #endif
 }
 
diff --git a/core/libs/tests/ScalarCall.cpp b/core/libs/tests/ScalarCall.cpp
index c4d38b87c4..0faf175176 100644
--- a/core/libs/tests/ScalarCall.cpp
+++ b/core/libs/tests/ScalarCall.cpp
@@ -5,6 +5,7 @@
 #include "RdnaDecoder/RdnaMemoryOpDecoder.hpp"
 #include "ControlFlow/GraphBuilder.hpp"
 #include <array>
+#include <cstdint>
 #include <cstdio>
 #include <algorithm>
 #include <initializer_list>
@@ -12,6 +13,7 @@
 #include <span>
 #include <stdexcept>
 #include <string>
+#include <tuple>
 #include <vector>
 
 using namespace ShaderRecompiler;
@@ -43,6 +45,11 @@ static RdnaInstruction Sop1(std::uint32_t pc, std::uint32_t destination, std::ui
     return DecodeRdnaSop1(pc, code, 0u);
 }
 
+static RdnaInstruction Sop2(std::uint32_t pc, std::uint32_t destination, std::uint32_t op, std::uint32_t source0, std::uint32_t source1) {
+    const std::array<std::uint32_t, 1> code{0x80000000u | (op << 23u) | (destination << 16u) | (source1 << 8u) | source0};
+    return DecodeRdnaSop2(pc, code, 0u);
+}
+
 static RdnaInstruction Sopp(std::uint32_t pc, std::uint32_t op, std::uint32_t immediate = 0u) {
     const std::array<std::uint32_t, 1> code{0xbf800000u | (op << 16u) | immediate};
     return DecodeRdnaSopp(pc, code, 0u);
@@ -236,6 +243,21 @@ static void CheckTableCalls() {
     Require(table(10u, 0xbf810000u, 12u).empty());
     Require(table(5u, 0x28000008u).size() == 1u && table(5u, 0x28000008u)[0].entryOffset == 8u);
     Require(table(0u, 0xbe940380u).empty());
+    const auto slice = [&](std::uint32_t load, std::uint32_t bufferLoad) {
+        auto code = caller;
+        code[1] = load;
+        code[4] = bufferLoad;
+        return FindTableCalls(RdnaInstructionDecoder{}.Decode(code), swappc);
+    };
+    for (const auto& [load, bufferLoad, offset] : {std::tuple{0xf40c0606u, 0xf428020cu, 0x270u}, std::tuple{0xf40c0606u, 0xf428020eu, 0x280u}, std::tuple{0xf4100606u, 0xf4280210u, 0x290u}, std::tuple{0xf4100606u, 0xf4280212u, 0x2a0u}}) {
+        const auto sliced = slice(load, bufferLoad);
+        Require(sliced.size() == 1u && sliced[0].userDataRegister == 12u && sliced[0].descriptorOffset == offset && sliced[0].entryOffset == 0u && sliced[0].entryStride == 16u);
+    }
+    Require(slice(0xf40c0606u, 0xf4280210u).empty());
+    Require(slice(0xf40c0606u, 0xf428020du).empty());
+    Require(slice(0xf40c0686u, 0xf428020eu).empty());
+    Require(slice(0xf40c0686u, 0xf428020cu).empty());
+    Require(slice(0xf40c0586u, 0xf428020eu).empty());
     auto readsLane = caller;
     readsLane.insert(readsLane.begin(), {0xd4c2000bu, 0x00020300u});
     const auto readsLaneProgram = RdnaInstructionDecoder{}.Decode(readsLane);
@@ -255,27 +277,69 @@ static void CheckTableCalls() {
     const std::vector<std::vector<TableCallee>> callees{{{0x1122334455ull, first}, {0x66778899aaull, second}}};
     const auto linkedCalls = LinkCalls(program, {}, {}, calls, callees);
     const auto& linked = linkedCalls.code;
-    Require(linkedCalls.fallbacks == std::vector<std::uint32_t>{50u * 4u});
+    Require(linkedCalls.fallbacks == std::vector<std::uint32_t>{53u * 4u});
     ExpectThrow("is shared with another call", [&] { static_cast<void>(BuildCode(linked, swappc)); });
     SwappcInfo linkedSwappc = swappc;
     linkedSwappc.linkedCallFallbacks = linkedCalls.fallbacks;
-    Require(linked.size() == 59u && linked[9] == 0xbf820001u && linked[11] == 0xbf850010u && linked[58] == 0xbf9f0000u);
-    Require(linked[12] == 0xbf07ff0eu && linked[13] == 0x22334455u && linked[14] == 0xbf850004u && linked[15] == 0xbf07ff0fu && linked[16] == 0x11u && linked[17] == 0xbf850001u && linked[18] == 0xbf82001bu);
-    Require(linked[20] == 0x778899aau && linked[26] == 0xbf078080u && linked[27] == 0xbf820016u && linked[34] == 0xbf068080u && linked[35] == 0xbf82000au && linked[44] == 0xbf068080u && linked[45] == 0xbf820004u);
-    Require(linked[46] == 0xbb0e0005u && linked[47] == 0xbf82ffdau && linked[48] == 0xbb0e0006u && linked[49] == 0xbf82ffd8u && linked[50] == 0xbe8e210eu && linked[51] == 0xbf82ffd6u);
-    Require(std::equal(first.begin(), first.end(), linked.begin() + 52) && std::equal(second.begin(), second.end(), linked.begin() + 55));
+    Require(linked.size() == 56u && linked[9] == 0xbf820001u && linked[11] == 0xbf850007u && linked[55] == 0xbf9f0000u);
+    Require(linked[12] == 0xbf07ff0eu && linked[13] == 0x22334455u && linked[14] == 0xbf850010u && linked[15] == 0xbf07ff0fu && linked[16] == 0x11u && linked[17] == 0xbf85000du && linked[18] == 0xbf820007u);
+    Require(linked[19] == 0xbf07ff0eu && linked[21] == 0xbf850010u && linked[24] == 0xbf85000du && linked[25] == 0xbf068080u && linked[26] == 0xbb0e0001u && linked[27] == 0xbf82ffeeu);
+    Require(linked[32] == 0x778899aau && linked[33] == 0xbf850010u && linked[37] == 0xbf820007u && linked[40] == 0xbf85000bu && linked[43] == 0xbf850008u && linked[45] == 0xbb0e0001u && linked[46] == 0xbf82ffecu);
+    Require(linked[50] == 0xbf078080u && linked[51] == 0xbf820001u && linked[52] == 0xbf068080u && linked[53] == 0xbe8e210eu && linked[54] == 0xbf82fff7u);
+    Require(std::equal(first.begin(), first.end(), linked.begin() + 28) && std::equal(second.begin(), second.end(), linked.begin() + 47));
     const auto cfg = BuildCode(linked, linkedSwappc);
     const auto block = [&](std::uint32_t word) { return cfg.FindBlockByProgramCounter(word * 4u).id; };
-    Require(cfg.FindBlockByProgramCounter(46u * 4u).terminator.trueBlock == block(52u));
-    Require(cfg.FindBlockByProgramCounter(52u * 4u).terminator.trueBlock == block(47u));
-    Require(cfg.FindBlockByProgramCounter(48u * 4u).terminator.trueBlock == block(55u));
-    Require(cfg.FindBlockByProgramCounter(55u * 4u).terminator.trueBlock == block(49u));
-    Require(cfg.unlinkedCallProgramCounters == std::vector<std::uint32_t>{50u * 4u});
+    Require(cfg.FindBlockByProgramCounter(26u * 4u).terminator.trueBlock == block(28u));
+    Require(cfg.FindBlockByProgramCounter(28u * 4u).terminator.trueBlock == block(27u));
+    Require(cfg.FindBlockByProgramCounter(45u * 4u).terminator.trueBlock == block(47u));
+    Require(cfg.FindBlockByProgramCounter(47u * 4u).terminator.trueBlock == block(46u));
+    Require(cfg.unlinkedCallProgramCounters == std::vector<std::uint32_t>{53u * 4u});
     static_cast<void>(TranslateCode(linked, linkedSwappc));
 
-    std::vector<std::uint32_t> large(0x8000u, 0xbf800000u);
-    const std::vector<std::vector<TableCallee>> far{{{0x10ull, large}, {0x20ull, first}}};
-    ExpectThrow("out of s_call_b64 range", [&] { static_cast<void>(LinkCalls(program, {}, {}, calls, far)); });
+    std::vector<std::uint32_t> large(0x3000u, 0xbf800000u);
+    large.push_back(0xbe80200eu);
+    const std::vector<std::vector<TableCallee>> far{{{0x10ull, large}, {0x20ull, large}, {0x30ull, large}, {0x40ull, first}}};
+    const auto farLinked = LinkCalls(program, {}, {}, calls, far);
+    const auto farCall = 12u + 3u * (16u + 0x3001u) + 14u;
+    Require(farLinked.code[farCall] == 0xbb0e0001u && std::equal(first.begin(), first.end(), farLinked.code.begin() + farCall + 2u));
+    SwappcInfo farSwappc = swappc;
+    farSwappc.linkedCallFallbacks = farLinked.fallbacks;
+    const auto farCfg = BuildCode(farLinked.code, farSwappc);
+    Require(farCfg.FindBlockByProgramCounter(farCall * 4u).terminator.trueBlock == farCfg.FindBlockByProgramCounter((farCall + 2u) * 4u).id);
+    Require(farCfg.FindBlockByProgramCounter((farCall + 2u) * 4u).terminator.trueBlock == farCfg.FindBlockByProgramCounter((farCall + 1u) * 4u).id);
+    auto twoCallers = caller;
+    twoCallers.pop_back();
+    twoCallers.insert(twoCallers.end(), caller.begin(), caller.end());
+    const auto twoProgram = RdnaInstructionDecoder{}.Decode(twoCallers);
+    auto secondCall = calls[0];
+    secondCall.programCounter += 40u;
+    const std::array<TableCall, 2> twoCalls{calls[0], secondCall};
+    const std::vector<std::vector<TableCallee>> twoCallees{far[0], {{0x50ull, first}, {0x60ull, second}}};
+    const auto twoLinked = LinkCalls(twoProgram, {}, {}, twoCalls, twoCallees);
+    const auto& two = twoLinked.code;
+    const auto follow = [&](std::size_t word, std::size_t& hops) {
+        hops = 0;
+        while (two[word] >> 16u == 0xbf82u) {
+            word = static_cast<std::size_t>(static_cast<std::int64_t>(word) + 1 + static_cast<std::int16_t>(two[word] & 0xffffu));
+            ++hops;
+        }
+        return word;
+    };
+    std::size_t hops = 0;
+    Require(follow(9u, hops) == 23u && hops == 1u && two[21] >> 16u == 0xbf82u && two[22] >> 16u == 0xbf82u);
+    Require(follow(39u, hops) == 10u && hops == 1u);
+    const auto secondChain = follow(19u, hops);
+    Require(hops == 6u && two[secondChain] == 0xbf850007u && two[secondChain + 1u] == 0xbf07ff0eu && two[secondChain + 2u] == 0x50u);
+    Require(two[secondChain + 15u] == 0xbb0e0001u && std::equal(first.begin(), first.end(), two.begin() + static_cast<std::ptrdiff_t>(secondChain + 17u)));
+    Require(follow(secondChain + 16u, hops) == 20u && hops == 6u);
+    SwappcInfo twoSwappc = swappc;
+    twoSwappc.linkedCallFallbacks = twoLinked.fallbacks;
+    const auto twoCfg = BuildCode(two, twoSwappc);
+    Require(twoCfg.FindBlockByProgramCounter(static_cast<std::uint32_t>(secondChain + 15u) * 4u).terminator.trueBlock == twoCfg.FindBlockByProgramCounter(static_cast<std::uint32_t>(secondChain + 17u) * 4u).id);
+    Require(twoCfg.unlinkedCallProgramCounters.size() == 2u);
+    std::vector<std::uint32_t> oversized(0x8000u, 0xbf800000u);
+    const std::vector<std::vector<TableCallee>> overflows{{{0x10ull, oversized}, {0x20ull, first}}};
+    ExpectThrow("out of the 16-bit branch range", [&] { static_cast<void>(LinkCalls(program, {}, {}, calls, overflows)); });
 
     const std::vector<std::uint32_t> jumpTable{
         0xbe8c1f00u, 0x800cff0cu, 0x00000058u, 0x820d800du, 0x83928202u, 0xd4c40016u, 0x02000500u, 0x8f128212u, 0xf4000386u, 0x24000000u,
@@ -290,6 +354,10 @@ static void CheckTableCalls() {
     ExpectThrow("escapes the constant-offset call/return model", [] {
         Build({Sop1(0u, 0u, 3u, 8u), Call(4u, 8u, 2u), Sopp(8u, 2u, 0xfffdu), Sopp(12u, 1u), Sop1(16u, 0u, 0x20u, 8u)});
     });
+    static_cast<void>(Build({Call(0u, 8u, 3u), Sop2(4u, 8u, 0x15u, 0u, 2u), Sop2(8u, 10u, 0x1bu, 8u, 2u), Sopp(12u, 1u), Sop1(16u, 0u, 0x20u, 8u)}));
+    ExpectThrow("escapes the constant-offset call/return model", [] {
+        Build({Call(0u, 8u, 3u), Sop2(4u, 8u, 0x0eu, 0u, 2u), Sop2(8u, 10u, 0x1bu, 8u, 2u), Sopp(12u, 1u), Sop1(16u, 0u, 0x20u, 8u)});
+    });
 }
 
 enum class HoistedShape { InLoop, Hoisted, SecondWriterOnArm, LoadOnArmOnly, WriterAfterCall, WriterAfterLoop, CallOnArm, ConstantPointer, SkipsNullTarget, LongBranchWriter };
diff --git a/core/libs/tests/SslContextLifetime.cpp b/core/libs/tests/SslContextLifetime.cpp
new file mode 100644
index 0000000000..198e1c7cbe
--- /dev/null
+++ b/core/libs/tests/SslContextLifetime.cpp
@@ -0,0 +1,182 @@
+#include "prx/libSceSsl/Export.cpp"
+
+#include <array>
+#include <atomic>
+#include <barrier>
+#include <cstdio>
+#include <latch>
+#include <thread>
+
+extern "C" bool KernelLookupSocketNative_nid_no_patch(int, std::shared_ptr<void>*, std::uintptr_t*) {
+    std::fputs("unexpected native socket lookup in SSL lifetime test\n", stderr);
+    std::abort();
+}
+
+namespace {
+
+void Check(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+int CreateContext() {
+    const int id = sceSslInit_nid_postfix(1024 * 1024);
+    Check(id > 0, "context creation failed");
+    return id;
+}
+
+int CreateConnection(int context) {
+    const int id = sceSslCreateConnection(context, -1, "localhost");
+    Check(id > 0, "connection creation failed");
+    return id;
+}
+
+void DeleteBeforeTerm() {
+    for (int cycle = 0; cycle < 3; ++cycle) {
+        const int context = CreateContext();
+        const int connection = CreateConnection(context);
+        Check(sceSslDeleteConnection(connection) == 0, "delete before term failed");
+        Check(sceSslTerm_nid_postfix(context) == 0, "term after delete failed");
+        Check(State().connections.empty() && State().contexts.empty(), "delete-first cycle retained records");
+    }
+    std::puts("SSL delete-first control: 3 cycles, no retained records");
+}
+
+void TermBeforeDelete() {
+    bool clean = true;
+    for (int cycle = 0; cycle < 3; ++cycle) {
+        const auto before = State().connections.size();
+        const int context = CreateContext();
+        const int connection = CreateConnection(context);
+        const auto created = State().connections.size();
+        Check(sceSslTerm_nid_postfix(context) == 0, "term before delete failed");
+        const auto terminated = State().connections.size();
+        Check(sceSslDeleteConnection(connection) == ErrorInvalidId, "post-term delete result changed");
+        const auto deleted = State().connections.size();
+        Check(State().contexts.empty(), "context survived termination");
+        clean = clean && before == 0 && created == 1 && terminated == 0 && deleted == 0;
+        std::printf("SSL term-first cycle %d: connections %zu -> %zu -> %zu -> %zu\n", cycle + 1, before, created, terminated, deleted);
+    }
+    Check(clean, "termination retained orphan connection records");
+}
+
+void SeparateContexts() {
+    const int first = CreateContext();
+    const int second = CreateContext();
+    const int firstConnection = CreateConnection(first);
+    const int secondConnection = CreateConnection(second);
+    const int extraConnection = CreateConnection(first);
+    std::weak_ptr<Context> lifetime = State().contexts.at(first);
+    Check(sceSslTerm_nid_postfix(first) == 0, "selective term failed");
+    Check(lifetime.expired(), "idle terminated context survived");
+    Check(State().connections.size() == 1 && State().connections.contains(secondConnection), "term did not isolate connection ownership");
+    Check(!State().connections.contains(firstConnection) && !State().connections.contains(extraConnection), "term retained a child connection");
+    Check(sceSslTerm_nid_postfix(first) == ErrorInvalidId, "repeated term result changed");
+    Check(sceSslCreateConnection(first, -1, "localhost") == ErrorInvalidId, "create accepted a terminated context");
+    Check(sceSslDeleteConnection(firstConnection) == ErrorInvalidId, "delete accepted a terminated connection");
+    Check(sceSslSetVerifyCallback(firstConnection, nullptr, nullptr) == ErrorInvalidId, "callback accepted a terminated connection");
+    Check(sceSslConnect(firstConnection) == ErrorInvalidId && sceSslClose(firstConnection) == ErrorInvalidId, "I/O accepted a terminated connection");
+    Check(sceSslSetVerifyCallback(secondConnection, nullptr, nullptr) == 0, "term invalidated another context's connection");
+    Check(sceSslDeleteConnection(secondConnection) == 0 && sceSslTerm_nid_postfix(second) == 0, "unrelated context cleanup failed");
+    Check(State().connections.empty() && State().contexts.empty(), "selective term retained records");
+}
+
+void ConcurrentLifecycle() {
+    for (int cycle = 0; cycle < 32; ++cycle) {
+        const int context = CreateContext();
+        std::array<int, 8> connections{};
+        for (auto& id : connections) id = CreateConnection(context);
+        std::barrier start(3);
+        std::atomic<bool> valid{true};
+        std::thread creator([&] {
+            start.arrive_and_wait();
+            for (int attempt = 0; attempt < 16; ++attempt) {
+                const int id = sceSslCreateConnection(context, -1, "localhost");
+                if (id == ErrorInvalidId) continue;
+                if (id <= 0) { valid = false; continue; }
+                const int result = sceSslDeleteConnection(id);
+                if (result != 0 && result != ErrorInvalidId) valid = false;
+            }
+        });
+        std::thread deleter([&] {
+            start.arrive_and_wait();
+            for (const auto id : connections) {
+                const int result = sceSslDeleteConnection(id);
+                if (result != 0 && result != ErrorInvalidId) valid = false;
+            }
+        });
+        start.arrive_and_wait();
+        const int result = sceSslTerm_nid_postfix(context);
+        creator.join();
+        deleter.join();
+        Check(result == 0 && valid, "concurrent lifecycle returned an unexpected error");
+        Check(State().connections.empty() && State().contexts.empty(), "concurrent termination retained records");
+    }
+    std::puts("SSL concurrent create/delete/term: 32 cycles, no retained records");
+}
+
+struct CallbackState {
+    std::latch entered{1};
+    std::latch resume{1};
+    int context = 0;
+    bool valid = false;
+};
+
+int APS5_VABI PendingCallback(int context, unsigned int, void**, int count, void* argument) {
+    auto& state = *static_cast<CallbackState*>(argument);
+    state.valid = context == state.context && count == 0;
+    state.entered.count_down();
+    state.resume.wait();
+    return 0;
+}
+
+void InFlightSession() {
+    const int context = CreateContext();
+    const int connection = CreateConnection(context);
+    auto owner = State().contexts.at(context);
+    std::weak_ptr<Context> contextLifetime = owner;
+    auto session = std::make_shared<Session>(context, owner, std::shared_ptr<void>{}, 0);
+    {
+        PoolScope scope(owner->pool);
+        session->Configure("localhost", "", InitialVerifyOptions);
+    }
+    Check(owner->pool.current > 0, "session did not allocate backend state");
+    session->verified = true;
+    session->verifyResult = ErrorCallbackCheck;
+    State().connections.at(connection).session = session;
+    std::weak_ptr<Session> sessionLifetime = session;
+    CallbackState callback;
+    callback.context = context;
+    Check(sceSslSetVerifyCallback(connection, PendingCallback, &callback) == 0, "callback setup failed");
+    owner.reset();
+    session.reset();
+    int operationResult = ErrorInvalidId;
+    std::thread operation([&] { operationResult = sceSslConnect(connection); });
+    callback.entered.wait();
+    const int result = sceSslTerm_nid_postfix(context);
+    const bool removed = State().connections.empty() && State().contexts.empty();
+    const bool retained = !sessionLifetime.expired() && !contextLifetime.expired();
+    callback.resume.count_down();
+    operation.join();
+    Check(result == 0 && removed, "term did not remove the in-flight connection");
+    Check(retained, "term destroyed an in-flight session or its pool");
+    Check(callback.valid && operationResult == 0, "in-flight verification callback did not finish");
+    Check(sessionLifetime.expired() && contextLifetime.expired(), "finished operation retained its session or pool");
+    Check(sceSslConnect(connection) == ErrorInvalidId && sceSslDeleteConnection(connection) == ErrorInvalidId, "post-term connection became usable");
+    std::puts("SSL in-flight callback completed; session and pool released after completion");
+}
+
+}
+
+int main() {
+    try {
+        DeleteBeforeTerm();
+        TermBeforeDelete();
+        SeparateContexts();
+        ConcurrentLifecycle();
+        InFlightSession();
+        std::puts("SSL context lifetime passed");
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "SSL context lifetime failed: %s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/tests/UltFinalizeAllocation.cpp b/core/libs/tests/UltFinalizeAllocation.cpp
new file mode 100644
index 0000000000..c5730d7f4a
--- /dev/null
+++ b/core/libs/tests/UltFinalizeAllocation.cpp
@@ -0,0 +1,72 @@
+#include "prx/libSceUlt/libSceUlt.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <new>
+
+static int allocationBudget = -1;
+static unsigned allocationAttempts = 0;
+
+void* operator new(std::size_t size) {
+    if (allocationBudget >= 0) {
+        ++allocationAttempts;
+        if (allocationBudget == 0) {
+            allocationBudget = -1;
+            throw std::bad_alloc();
+        }
+        --allocationBudget;
+    }
+    if (void* memory = std::malloc(size ? size : 1)) return memory;
+    throw std::bad_alloc();
+}
+
+void operator delete(void* memory) noexcept { std::free(memory); }
+void operator delete(void* memory, std::size_t) noexcept { ::operator delete(memory); }
+
+struct alignas(8) Object { std::uint8_t bytes[256]{}; };
+
+static void Require(bool passed, const char* message) {
+    if (!passed) {
+        std::fprintf(stderr, "%s\n", message);
+        std::abort();
+    }
+}
+
+int main() {
+    Require(sceUltInitialize() == ULT_OK, "initialization failed");
+    unsigned failures = 0;
+    unsigned rejectedCases = 0;
+    for (int budget = 0; budget < 8; ++budget) {
+        Object semaphore{};
+        Object mutex{};
+        Require(sceUltSemaphoreCreate(&semaphore, "semaphore", 1, nullptr, nullptr, 0) == ULT_OK, "semaphore creation failed");
+        Require(sceUltMutexCreate(&mutex, "mutex", nullptr, nullptr, 0) == ULT_OK, "mutex creation failed");
+        allocationAttempts = 0;
+        allocationBudget = budget;
+        bool rejected = false;
+        int outcome = ULT_OK;
+        try { outcome = sceUltFinalize(); }
+        catch (const std::bad_alloc&) { rejected = true; }
+        allocationBudget = -1;
+
+        rejectedCases += rejected;
+        const int semaphoreResult = sceUltSemaphoreTryAcquire(&semaphore, 1);
+        const int mutexResult = sceUltMutexTryLock(&mutex);
+        if (semaphoreResult == ULT_OK) Require(sceUltSemaphoreRelease(&semaphore, 1) == ULT_OK, "semaphore release failed");
+        if (mutexResult == ULT_OK) Require(sceUltMutexUnlock(&mutex) == ULT_OK, "mutex unlock failed");
+        const int expected = rejected ? ULT_OK : ULT_ERROR_STATE;
+        if (outcome != ULT_OK || semaphoreResult != expected || mutexResult != expected) {
+            std::fprintf(stderr, "budget=%d rejected=%d attempts=%u semaphore=%d mutex=%d\n",
+                         budget, rejected, allocationAttempts, semaphoreResult, mutexResult);
+            ++failures;
+        }
+        if (rejected) Require(sceUltFinalize() == ULT_OK, "finalization retry failed");
+        Require(sceUltSemaphoreTryAcquire(&semaphore, 1) == ULT_ERROR_STATE, "finalized semaphore is still live");
+        Require(sceUltMutexTryLock(&mutex) == ULT_ERROR_STATE, "finalized mutex is still live");
+    }
+    std::printf("finalization allocation budgets: 8 cases, %u rejections, %u incorrect lifecycles\n", rejectedCases, failures);
+    Require(rejectedCases > 0, "no allocation failure was injected");
+    Require(rejectedCases < 8, "no finalization succeeded without a retry");
+    return failures == 0 ? 0 : 1;
+}
diff --git a/core/libs/tests/UnwindCallbackAbi.cpp b/core/libs/tests/UnwindCallbackAbi.cpp
index 18fb85df1d..c0fbcbbc2b 100644
--- a/core/libs/tests/UnwindCallbackAbi.cpp
+++ b/core/libs/tests/UnwindCallbackAbi.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/exceptions/Runtime.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Unwind.hpp"
 
 #include <cstdint>
@@ -5,11 +7,6 @@
 #include <cstdlib>
 #include <string>
 
-extern "C" _Unwind_Reason_Code APS5_VABI _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn trace, void* argument);
-extern "C" _Unwind_Reason_Code APS5_VABI _Unwind_ForcedUnwind_nid_postfix(_Unwind_Exception* exception, _Unwind_Stop_Fn stop, void* argument);
-extern "C" _Unwind_Ptr APS5_VABI _Unwind_GetRegionStart_nid_postfix(_Unwind_Context* context);
-extern "C" void* APS5_VABI __cxa_begin_catch_nid_postfix(void* exception);
-extern "C" void APS5_VABI __cxa_end_catch_nid_postfix();
 extern "C" [[gnu::noinline]] void BacktraceFromHere();
 extern "C" [[gnu::noinline]] void ForceUnwindFromHere();
 
@@ -85,6 +82,7 @@ void CheckDeleteException() {
     exception.exception_class = ForeignClass;
     exception.exception_cleanup = GuestCleanup;
     _Unwind_DeleteException_nid_postfix(&exception);
+
     CheckCleanup(exception);
 }
 
@@ -94,6 +92,7 @@ void CheckEndCatch(std::uint64_t exceptionClass, Cleanup function) {
     exception.exception_cleanup = function;
     __cxa_begin_catch_nid_postfix(&exception);
     __cxa_end_catch_nid_postfix();
+
     CheckCleanup(exception);
 }
 
@@ -110,6 +109,7 @@ extern "C" void ForceUnwindFromHere() {
     _Unwind_Exception exception {};
     exception.exception_class = ForeignClass;
     _Unwind_ForcedUnwind_nid_postfix(&exception, Stop, &stopArgument);
+
     Require(stop.count == 1, "_Unwind_ForcedUnwind calls the stop function once");
     Require(stop.version == 1, "the stop function gets version 1");
     Require(stop.actions == (_UA_CLEANUP_PHASE | _UA_FORCE_UNWIND), "the stop function gets _UA_CLEANUP_PHASE | _UA_FORCE_UNWIND");
diff --git a/core/libs/tests/WindowsBacktraceReport.cpp b/core/libs/tests/WindowsBacktraceReport.cpp
index d16340e2b3..b7c91f7aa4 100644
--- a/core/libs/tests/WindowsBacktraceReport.cpp
+++ b/core/libs/tests/WindowsBacktraceReport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -6,8 +7,6 @@
 #include "../prx/libc/include/general/VabiMacros.hpp"
 #include "../prx/libc/include/FailureReport.hpp"
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 void KeptReport() noexcept {
diff --git a/core/libs/tests/WindowsExceptions.cpp b/core/libs/tests/WindowsExceptions.cpp
index c83acd49c2..5adb55cac4 100644
--- a/core/libs/tests/WindowsExceptions.cpp
+++ b/core/libs/tests/WindowsExceptions.cpp
@@ -56,6 +56,17 @@ static void TestTypeInfoVtables() {
     if (!upcastType(&multiple, &base, &object) || object != storage.data() + 16) throw std::runtime_error("multiple RTTI upcast failed");
     object = storage.data();
     if (catchType(&other, &single, &object, 0)) throw std::runtime_error("unrelated RTTI catch succeeded");
+    TypeRecord shared {classTable + 2 * sizeof(void*), "6Shared"};
+    SingleRecord publicPath {{singleTable + 2 * sizeof(void*), "10PublicPath"}, &shared};
+    SingleRecord privatePath {{singleTable + 2 * sizeof(void*), "11PrivatePath"}, &shared};
+    MultipleRecord mixed {{multipleTable + 2 * sizeof(void*), "5Mixed"}, 1, 2, {{&publicPath.type, 2}, {&privatePath.type, 16 << 8}}};
+    MultipleRecord hidden {{multipleTable + 2 * sizeof(void*), "6Hidden"}, 0, 1, {{&privatePath.type, 0}, {}}};
+    object = storage.data();
+    if (catchType(&shared, &mixed, &object, 0) || object != storage.data()) throw std::runtime_error("RTTI catch of a base repeated through a private path succeeded");
+    if (upcastType(&mixed, &shared, &object) || object != storage.data()) throw std::runtime_error("RTTI upcast to a base repeated through a private path succeeded");
+    if (!catchType(&publicPath, &mixed, &object, 0) || object != storage.data()) throw std::runtime_error("RTTI catch of the public path failed");
+    object = storage.data();
+    if (catchType(&shared, &hidden, &object, 0)) throw std::runtime_error("RTTI catch of a privately inherited base succeeded");
 }
 
 extern "C" [[noreturn]] void NotImplemented_nid_no_patch(const char*);
diff --git a/core/libs/tests/WindowsSharedMapCost.cpp b/core/libs/tests/WindowsSharedMapCost.cpp
new file mode 100644
index 0000000000..ce6c25b6e7
--- /dev/null
+++ b/core/libs/tests/WindowsSharedMapCost.cpp
@@ -0,0 +1,78 @@
+#define NOMINMAX
+#include "prx/libc/include/WindowsMappings.hpp"
+#include <algorithm>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <set>
+#include <vector>
+
+namespace {
+using Mappings = GuestArena::WindowsMappings;
+constexpr std::size_t PageBytes = 16384;
+constexpr int Rounds = 5;
+
+[[noreturn]] void Fail(const char* what) {
+    std::fprintf(stderr, "windows shared map cost: %s (error %lu)\n", what, GetLastError());
+    std::exit(1);
+}
+
+std::size_t MappedViews(const unsigned char* begin, std::size_t bytes) {
+    std::set<void*> bases;
+    for (auto cursor = begin; cursor < begin + bytes;) {
+        MEMORY_BASIC_INFORMATION info{};
+        if (VirtualQuery(cursor, &info, sizeof(info)) != sizeof(info)) Fail("view query failed");
+        if (info.Type == MEM_MAPPED) bases.insert(info.AllocationBase);
+        cursor = static_cast<const unsigned char*>(info.BaseAddress) + info.RegionSize;
+    }
+    return bases.size();
+}
+
+struct Sample {
+    double mapMs = 0;
+    double releaseMs = 0;
+    std::size_t views = 0;
+};
+
+Sample MapOnce(std::size_t pages) {
+    const auto bytes = pages * PageBytes;
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, static_cast<DWORD>(static_cast<std::uint64_t>(bytes) >> 32), static_cast<DWORD>(bytes), nullptr);
+    auto* memory = static_cast<unsigned char*>(Mappings::Get().Reserve(nullptr, bytes));
+    if (section == nullptr || memory == nullptr) Fail("cannot allocate shared memory");
+    const auto start = std::chrono::steady_clock::now();
+    Mappings::Get().Map(memory, bytes, section, 0, PAGE_READWRITE);
+    Sample sample;
+    sample.mapMs = std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - start).count();
+    sample.views = MappedViews(memory, bytes);
+    memory[0] = 1;
+    memory[bytes - 1] = 1;
+    const auto released = std::chrono::steady_clock::now();
+    Mappings::Get().Reset(memory, bytes);
+    sample.releaseMs = std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - released).count();
+    VirtualFree(memory, 0, MEM_RELEASE);
+    CloseHandle(section);
+    return sample;
+}
+
+double Median(std::vector<double> values) {
+    std::sort(values.begin(), values.end());
+    return values[values.size() / 2];
+}
+
+}
+
+int main() {
+    for (const std::size_t pages : {std::size_t{256}, std::size_t{16384}, std::size_t{65536}}) {
+        std::vector<double> map;
+        std::vector<double> release;
+        std::size_t views = 0;
+        for (int round = 0; round < Rounds; ++round) {
+            const auto sample = MapOnce(pages);
+            map.push_back(sample.mapMs);
+            release.push_back(sample.releaseMs);
+            views = sample.views;
+        }
+        std::printf("shared map of %zu pages (%zu MiB): map median %.2f ms (%.2f us per page), release median %.2f ms, %zu views\n", pages, pages * PageBytes >> 20, Median(map), Median(map) * 1000.0 / static_cast<double>(pages), Median(release), views);
+    }
+    return 0;
+}
diff --git a/core/libs/tests/WindowsWriteWatch.cpp b/core/libs/tests/WindowsWriteWatch.cpp
index b44c48af61..65d98f68e2 100644
--- a/core/libs/tests/WindowsWriteWatch.cpp
+++ b/core/libs/tests/WindowsWriteWatch.cpp
@@ -172,6 +172,149 @@ void CheckPrivate() {
     VirtualFree(memory, 0, MEM_RELEASE);
 }
 
+MEMORY_BASIC_INFORMATION RegionAt(const void* address) {
+    MEMORY_BASIC_INFORMATION info{};
+    Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "private commit query failed");
+    return info;
+}
+
+void CheckPrivateCommitCarvesPlaceholders() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    constexpr std::size_t Pages = 256;
+    constexpr std::size_t Span = Pages * Page;
+    constexpr std::size_t Reserved = std::size_t{1} << 30;
+    auto* holder = static_cast<unsigned char*>(mappings.Reserve(nullptr, Reserved));
+    Require(holder != nullptr, "cannot reserve a placeholder for private commits");
+    auto* memory = holder + Page;
+    const auto page = [&](std::size_t index) { return memory + index * Page; };
+    const auto at = [](const unsigned char* pointer) { return reinterpret_cast<std::uintptr_t>(pointer); };
+    auto before = Mappings::MemoryQueries();
+    auto created = mappings.Commit(memory, Span, PAGE_READWRITE, Page, true);
+    const auto queries = Mappings::MemoryQueries() - before;
+    Require(queries == 1, ("committing 256 fresh pages queried the address space " + std::to_string(queries) + " times").c_str());
+    Require(created.size() == 1 && created[0].first == at(memory) && created[0].second == Span, "a fresh commit did not report its range as one created range");
+    for (std::size_t index = 0; index < Pages; ++index) {
+        const auto info = RegionAt(page(index));
+        Require(info.State == MEM_COMMIT && info.Type == MEM_PRIVATE && info.AllocationBase == page(index) && info.RegionSize == Page && info.Protect == PAGE_READWRITE, "a committed page is not a read-write allocation of its own");
+    }
+    const auto prefix = RegionAt(holder);
+    Require(prefix.State == MEM_RESERVE && prefix.AllocationBase == holder && prefix.RegionSize == Page, "the placeholder before the commit changed");
+    const auto suffix = RegionAt(page(Pages));
+    Require(suffix.State == MEM_RESERVE && suffix.AllocationBase == page(Pages) && suffix.RegionSize == Reserved - Page - Span, "the placeholder after the commit changed");
+    for (std::size_t index = 0; index < Pages; ++index) page(index)[8] = static_cast<unsigned char>(index + 1);
+    mappings.Reset(page(11), Page);
+    const auto released = RegionAt(page(11));
+    Require(released.State == MEM_RESERVE && released.AllocationBase == page(11) && released.RegionSize == Page, "a released page did not become a placeholder of its own");
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(11), Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0].first == at(page(11)) && created[0].second == Page && page(11)[8] == 0, "recommitting a released page was not one fresh allocation");
+    for (std::size_t index = 0; index < Pages; ++index) {
+        if (index != 11) Require(page(index)[8] == static_cast<unsigned char>(index + 1), "a release or commit changed a neighbouring page");
+    }
+    created = mappings.Commit(memory, Span, PAGE_READONLY, Page, true);
+    Require(created.empty() && RegionAt(page(0)).Protect == PAGE_READONLY && RegionAt(page(Pages - 1)).Protect == PAGE_READONLY, "a protection change reported fresh memory or missed a page");
+    mappings.Commit(memory, Span, PAGE_READWRITE, Page, true);
+    std::array<void*, 32> written{};
+    std::size_t count = written.size();
+    mappings.Collect(at(page(40)), 4 * Page, written.data(), &count, true);
+    page(41)[4096 + 3] = 1;
+    count = written.size();
+    Require(mappings.Collect(at(page(40)), 4 * Page, written.data(), &count, true, Collection::Armed) && count == 1 && written[0] == page(41) + 4096, "a carved page lost its write watch");
+    mappings.Reset(page(20), 2 * Page);
+    mappings.Reset(page(22), 2 * Page);
+    created = mappings.Commit(page(20), 4 * Page, PAGE_READWRITE, 4 * Page, true);
+    Require(created.size() == 1 && created[0].second == 4 * Page && RegionAt(page(23)).AllocationBase == page(20), "a commit over two placeholders was not one allocation");
+    mappings.Reset(memory, Span);
+    Require(VirtualFree(holder, Reserved, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(holder, 0, MEM_RELEASE), "cannot release the private commit placeholder");
+}
+
+void CheckPrivateCommitEdgeLayouts() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    constexpr std::size_t Pages = 32;
+    auto* memory = static_cast<unsigned char*>(mappings.Reserve(nullptr, Pages * Page));
+    Require(memory != nullptr, "cannot reserve a placeholder for private commit edges");
+    const auto page = [&](std::size_t index) { return memory + index * Page; };
+    const auto range = [&](std::size_t first, std::size_t count) { return std::make_pair(reinterpret_cast<std::uintptr_t>(page(first)), count * Page); };
+    const auto region = [&](std::size_t first, std::size_t count, DWORD state) {
+        const auto info = RegionAt(page(first));
+        return info.State == state && info.AllocationBase == page(first) && info.RegionSize == count * Page;
+    };
+    const auto ownPages = [&](std::size_t first, std::size_t count) {
+        for (auto index = first; index < first + count; ++index) {
+            if (!region(index, 1, MEM_COMMIT)) return false;
+        }
+        return true;
+    };
+    auto before = Mappings::MemoryQueries();
+    auto created = mappings.Commit(page(2), 4 * Page, PAGE_READWRITE, 4 * Page, true);
+    Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0] == range(2, 4), "a whole-range granule inside a placeholder was not one created range from one query");
+    Require(region(0, 2, MEM_RESERVE) && region(2, 4, MEM_COMMIT) && region(6, Pages - 6, MEM_RESERVE), "a whole-range granule inside a placeholder was not one allocation between two placeholders");
+    page(2)[8] = 0x5a;
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(0), 8 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 3 && created.size() == 2 && created[0] == range(0, 2) && created[1] == range(6, 2), "a commit around a committed piece did not create exactly the placeholders around it");
+    Require(ownPages(0, 2) && region(2, 4, MEM_COMMIT) && page(2)[8] == 0x5a && ownPages(6, 2) && region(8, Pages - 8, MEM_RESERVE), "a commit around a committed piece changed the piece or the layout");
+    for (std::size_t index = 0; index < 8; ++index) page(index)[8] = static_cast<unsigned char>(index + 1);
+    mappings.Reset(page(6), 2 * Page);
+    Require(region(6, 2, MEM_RESERVE) && ownPages(0, 2) && region(2, 4, MEM_COMMIT) && page(1)[8] == 2 && page(5)[8] == 6 && region(8, Pages - 8, MEM_RESERVE), "a partial release of carved pages changed a neighbour");
+    mappings.Reset(page(2), 4 * Page);
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(2), 4 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0] == range(2, 4) && ownPages(2, 4) && page(2)[8] == 0 && page(5)[8] == 0, "a fixed remap was not carved into fresh pages");
+    Require(page(1)[8] == 2 && region(6, 2, MEM_RESERVE), "a fixed remap changed a neighbour");
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(6), 4 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 2 && created.size() == 1 && created[0] == range(6, 4) && ownPages(6, 4) && region(10, Pages - 10, MEM_RESERVE), "a commit over adjacent placeholders was not carved page by page");
+    bool refused = false;
+    try {
+        mappings.Commit(page(12), Page, PAGE_READWRITE, 0, true);
+    } catch (const std::invalid_argument&) {
+        refused = true;
+    }
+    Require(refused && region(10, Pages - 10, MEM_RESERVE), "a zero commit granule was accepted or changed the placeholder");
+    mappings.Commit(page(10), 3 * Page, PAGE_READWRITE, 3 * Page, true);
+    mappings.Reset(page(10), 3 * Page);
+    created = mappings.Commit(page(10), 4 * Page, PAGE_READWRITE, 2 * Page, true);
+    Require(created.size() == 1 && created[0] == range(10, 4) && region(10, 2, MEM_COMMIT) && region(12, 2, MEM_COMMIT) && region(14, Pages - 14, MEM_RESERVE), "a granule crossing the end of a carved placeholder did not take the coalescing path");
+    mappings.Reset(memory, 14 * Page);
+    Require(VirtualFree(memory, Pages * Page, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(memory, 0, MEM_RELEASE), "cannot release the private commit edge placeholder");
+}
+
+void CheckPrivateCommitTails() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    constexpr std::size_t Pages = 8;
+    auto* memory = static_cast<unsigned char*>(mappings.Reserve(nullptr, Pages * Page));
+    Require(memory != nullptr, "cannot reserve a placeholder for private commit tails");
+    const auto page = [&](std::size_t index) { return memory + index * Page; };
+    const auto at = [](const unsigned char* pointer) { return reinterpret_cast<std::uintptr_t>(pointer); };
+    const auto allocation = [](const unsigned char* base, std::size_t bytes, DWORD state) {
+        const auto info = RegionAt(base);
+        return info.State == state && info.AllocationBase == base && info.RegionSize == bytes;
+    };
+    const auto unwatched = [](unsigned char* base) {
+        std::array<void*, 4> written{};
+        ULONG_PTR count = written.size();
+        DWORD granularity = 0;
+        return GetWriteWatch(0, base, Small, written.data(), &count, &granularity) != 0;
+    };
+    auto before = Mappings::MemoryQueries();
+    auto created = mappings.Commit(page(1), 2 * Page + Small, PAGE_READWRITE, Page, false);
+    Require(Mappings::MemoryQueries() - before == 1 && created.size() == 1 && created[0].first == at(page(1)) && created[0].second == 2 * Page + Small, "a commit with a short last piece was not one created range from one query");
+    Require(allocation(page(0), Page, MEM_RESERVE) && allocation(page(1), Page, MEM_COMMIT) && allocation(page(2), Page, MEM_COMMIT) && allocation(page(3), Small, MEM_COMMIT) && allocation(page(3) + Small, (Pages - 3) * Page - Small, MEM_RESERVE), "a short last piece was not its own allocation before the rest of the placeholder");
+    page(3)[Small - 1] = 7;
+    Require(unwatched(page(1)) && unwatched(page(3)), "an unwatched commit carved write-watched pages");
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(5), 3 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before == 1 && created.size() == 1 && created[0].first == at(page(5)) && created[0].second == 3 * Page, "a commit to the end of a placeholder was not one created range from one query");
+    Require(allocation(page(3) + Small, 2 * Page - Small, MEM_RESERVE) && allocation(page(5), Page, MEM_COMMIT) && allocation(page(6), Page, MEM_COMMIT) && allocation(page(7), Page, MEM_COMMIT) && page(3)[Small - 1] == 7, "a commit to the end of a placeholder changed the placeholder before it or a neighbour");
+    mappings.Reset(page(1), 2 * Page + Small);
+    mappings.Reset(page(5), 3 * Page);
+    Require(VirtualFree(memory, Pages * Page, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(memory, 0, MEM_RELEASE), "cannot release the private commit tail placeholder");
+}
+
 void CheckForgottenSectionKeepsNoPages() {
     auto& mappings = Mappings::Get();
     HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Bytes, nullptr);
@@ -216,6 +359,277 @@ void CheckConcurrentWrites() {
     region.Collect(Collection::Armed);
     Require(region.Collect(Collection::Armed).empty(), "concurrent writes did not settle");
 }
+
+void CheckComparedWhenShared() {
+    auto& mappings = Mappings::Get();
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, 2 * Bytes, nullptr);
+    auto* first = static_cast<unsigned char*>(mappings.Reserve(nullptr, 2 * Bytes));
+    auto* second = static_cast<unsigned char*>(mappings.Reserve(nullptr, 2 * Bytes));
+    Require(section && first && second, "cannot allocate compared sharing test memory");
+    mappings.ForgetSection(section);
+    const auto collect = [&](unsigned char* address, std::size_t bytes) {
+        std::array<void*, 32> pages{};
+        std::size_t count = pages.size();
+        return mappings.Collect(reinterpret_cast<std::uintptr_t>(address), bytes, pages.data(), &count, true);
+    };
+    const auto protection = [](unsigned char* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "compared sharing protection query failed");
+        return info;
+    };
+    mappings.Map(first, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(protection(first).Type == MEM_PRIVATE, "the compared sharing test memory is not resident");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes);
+    Require(collect(first, 2 * Bytes), "a resident page to be compared when shared stopped being collected");
+    mappings.Map(second, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(protection(first).Type == MEM_MAPPED && protection(second).Type == MEM_MAPPED, "a second mapping kept the first resident");
+    Require(!collect(first, Bytes) && !collect(second, Bytes), "a page to be compared when shared was collected once shared");
+    Require(!collect(first, 2 * Bytes), "a collect over a page to be compared when shared succeeded once shared");
+    Require(protection(first).Protect == PAGE_READWRITE && protection(second).Protect == PAGE_READWRITE, "a page to be compared when shared was armed once shared");
+    const auto before = faults.load();
+    first[8] = 0x5a;
+    second[Small + 8] = 0xa5;
+    Require(faults.load() == before && second[8] == 0x5a && first[Small + 8] == 0xa5, "a store into a page to be compared when shared faulted once shared");
+    Require(collect(first + Bytes, Bytes), "a shared page that was never to be compared stopped being collected");
+    mappings.Reset(first, 2 * Bytes);
+    mappings.Reset(second, 2 * Bytes);
+    for (auto* reserved : {first, second}) {
+        VirtualFree(reserved, 2 * Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(reserved, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+}
+
+void CheckResidentOnlyComparedWhenShared() {
+    auto& mappings = Mappings::Get();
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Bytes, nullptr);
+    auto* first = static_cast<unsigned char*>(mappings.Reserve(nullptr, Bytes));
+    auto* second = static_cast<unsigned char*>(mappings.Reserve(nullptr, Bytes));
+    Require(section && first && second, "cannot allocate resident-only sharing test memory");
+    mappings.ForgetSection(section);
+    mappings.Map(first, Bytes, section, 0, PAGE_READWRITE, true, true);
+    MEMORY_BASIC_INFORMATION info{};
+    Require(VirtualQuery(first, &info, sizeof(info)) == sizeof(info) && info.Type == MEM_PRIVATE, "the resident-only sharing test memory is not resident");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes, true);
+    mappings.Map(second, Bytes, section, 0, PAGE_READWRITE, true, true);
+    std::array<void*, 32> pages{};
+    std::size_t count = pages.size();
+    Require(!mappings.Collect(reinterpret_cast<std::uintptr_t>(first), Bytes, pages.data(), &count, true), "a resident page marked to be compared was collected once shared");
+    const auto before = faults.load();
+    first[8] = 0x3c;
+    Require(faults.load() == before && second[8] == 0x3c, "a store into a resident page marked to be compared faulted once shared");
+    mappings.Reset(first, Bytes);
+    mappings.Reset(second, Bytes);
+    for (auto* reserved : {first, second}) {
+        VirtualFree(reserved, Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(reserved, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+    Region region;
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(region.first), Bytes, true);
+    Require(region.Collect(Collection::All, 0, 1) == Pages(0, 1), "marking only resident pages changed a shared view");
+    Require(region.Protection(0) == PAGE_READONLY, "a shared view outside a resident-only mark was not armed");
+}
+
+void CheckComparedWhenSharedRemapped() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Bytes, nullptr);
+    std::array<unsigned char*, 3> reserved{};
+    for (auto& address : reserved) address = static_cast<unsigned char*>(mappings.Reserve(nullptr, Bytes));
+    Require(section && reserved[0] && reserved[1] && reserved[2], "cannot allocate remapped compared sharing test memory");
+    mappings.ForgetSection(section);
+    const auto collect = [&](unsigned char* address) {
+        std::array<void*, 32> pages{};
+        std::size_t count = pages.size();
+        return mappings.Collect(reinterpret_cast<std::uintptr_t>(address), Page, pages.data(), &count, true);
+    };
+    const auto memory = [](unsigned char* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "remapped compared sharing query failed");
+        return info;
+    };
+    const auto share = [&] {
+        mappings.Map(reserved[1], Page, section, 0, PAGE_READWRITE, true, true);
+        mappings.Map(reserved[2], Page, section, 0, PAGE_READWRITE, true, true);
+        Require(memory(reserved[1]).Type == MEM_MAPPED && memory(reserved[2]).Type == MEM_MAPPED, "the remapped page is not shared");
+    };
+    const auto unmapShared = [&] {
+        mappings.Reset(reserved[1], Page);
+        mappings.Reset(reserved[2], Page);
+    };
+    mappings.Map(reserved[0], Page, section, 0, PAGE_READWRITE, true, true);
+    Require(memory(reserved[0]).Type == MEM_PRIVATE, "the remapped compared sharing test memory is not resident");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(reserved[0]), Page);
+    mappings.Reset(reserved[0], Page);
+    share();
+    Require(!collect(reserved[1]) && !collect(reserved[2]), "a page to be compared when shared was collected after every view was unmapped and it was mapped again");
+    Require(memory(reserved[1]).Protect == PAGE_READWRITE && memory(reserved[2]).Protect == PAGE_READWRITE, "a page to be compared when shared was armed after every view was unmapped and it was mapped again");
+    const auto before = faults.load();
+    reserved[1][8] = 0x6b;
+    Require(faults.load() == before && reserved[2][8] == 0x6b, "a store into a remapped page to be compared faulted once shared");
+    unmapShared();
+    mappings.ForgetSection(section);
+    share();
+    Require(collect(reserved[1]) && memory(reserved[2]).Protect == PAGE_READONLY, "a forgotten section's handle value kept its pages compared when shared");
+    unmapShared();
+    for (auto* address : reserved) {
+        VirtualFree(address, Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(address, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+}
+
+void CheckComparedPagesReportedOnce() {
+    auto& mappings = Mappings::Get();
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, 2 * Bytes, nullptr);
+    std::array<unsigned char*, 3> reserved{};
+    for (auto& address : reserved) address = static_cast<unsigned char*>(mappings.Reserve(nullptr, 2 * Bytes));
+    Require(section && reserved[0] && reserved[1] && reserved[2], "cannot allocate compared page report test memory");
+    mappings.ForgetSection(section);
+    const auto listed = [&](unsigned char* base, std::size_t begin, std::size_t count, bool unreported) {
+        const auto address = reinterpret_cast<std::uintptr_t>(base);
+        auto cursor = address + begin * Small;
+        const auto end = cursor + count * Small;
+        std::set<std::size_t> result;
+        while (cursor < end) {
+            std::array<void*, 3> pages{};
+            std::size_t available = pages.size();
+            mappings.ComparedPages(cursor, end - cursor, pages.data(), &available, unreported);
+            for (std::size_t i = 0; i < available; ++i) result.insert((reinterpret_cast<std::uintptr_t>(pages[i]) - address) / Small);
+            if (available < pages.size()) break;
+            cursor = reinterpret_cast<std::uintptr_t>(pages[available - 1]) + Small;
+        }
+        return result;
+    };
+    auto* first = reserved[0];
+    auto* second = reserved[1];
+    mappings.Map(first, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes);
+    Require(listed(first, 0, 32, false).empty() && listed(first, 0, 32, true).empty(), "a resident page to be compared was listed before it was shared");
+    mappings.Map(second, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(listed(first, 0, 32, false) == Pages(0, 16) && listed(second, 0, 32, false) == Pages(0, 16), "the compared pages of both mappings were not listed once shared");
+    Require(listed(first, 2, 4, true) == Pages(2, 6), "a partial take did not report exactly its compared pages");
+    std::set<std::size_t> rest = Pages(0, 2);
+    rest.insert(6);
+    for (std::size_t page = 7; page < 16; ++page) rest.insert(page);
+    Require(listed(first, 0, 32, true) == rest, "a compared page was reported twice or not at all");
+    Require(listed(first, 0, 32, true).empty() && listed(first, 0, 32, false) == Pages(0, 16), "a compared page was reported again, or a listing consumed its mark");
+    Require(listed(second, 0, 32, true) == Pages(0, 16) && listed(second, 0, 32, true).empty(), "the second mapping's compared pages were not reported exactly once");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes);
+    Require(listed(first, 0, 32, true).empty() && listed(second, 0, 32, true).empty(), "marking compared pages again reported them again");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first + Bytes), Bytes);
+    Require(listed(first, 16, 16, true) == Pages(16, 32) && listed(second, 16, 16, true) == Pages(16, 32), "shared pages newly marked to be compared were not reported in every mapping");
+    mappings.Map(reserved[2], 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(listed(reserved[2], 0, 32, true) == Pages(0, 32) && listed(first, 0, 32, true).empty(), "a new mapping of compared pages was not reported, or reported the others again");
+    for (auto* address : reserved) mappings.Reset(address, 2 * Bytes);
+    for (auto* address : reserved) {
+        VirtualFree(address, 2 * Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(address, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+}
+}
+
+namespace {
+void CheckSharedMapQueriesPerMapping() {
+    constexpr std::size_t Pages = 256;
+    constexpr std::size_t Span = Pages * 16384;
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Span, nullptr);
+    auto* memory = static_cast<unsigned char*>(Mappings::Get().Reserve(nullptr, Span));
+    Require(section && memory, "cannot allocate shared test memory");
+    const auto before = Mappings::MemoryQueries();
+    Mappings::Get().Map(memory, Span, section, 0, PAGE_READWRITE);
+    const auto queries = Mappings::MemoryQueries() - before;
+    for (std::size_t page = 0; page < Pages; ++page) memory[page * 16384 + 8] = static_cast<unsigned char>(page);
+    for (std::size_t page = 0; page < Pages; ++page) Require(memory[page * 16384 + 8] == static_cast<unsigned char>(page), "a shared page lost its store");
+    Mappings::Get().Reset(memory, Span);
+    VirtualFree(memory, 0, MEM_RELEASE);
+    CloseHandle(section);
+    Require(queries < Pages, ("a shared mapping queried the address space for every page: " + std::to_string(queries) + " queries for " + std::to_string(Pages) + " pages").c_str());
+}
+
+std::size_t MappedViews(const unsigned char* begin, std::size_t bytes) {
+    std::set<void*> bases;
+    for (auto cursor = begin; cursor < begin + bytes;) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(cursor, &info, sizeof(info)) == sizeof(info), "view query failed");
+        if (info.Type == MEM_MAPPED) bases.insert(info.AllocationBase);
+        cursor = static_cast<const unsigned char*>(info.BaseAddress) + info.RegionSize;
+    }
+    return bases.size();
+}
+
+DWORD ProtectionAt(const unsigned char* address) {
+    MEMORY_BASIC_INFORMATION info{};
+    Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "protection query failed");
+    return info.State == MEM_COMMIT ? info.Protect : 0;
+}
+
+void CheckSharedRunIsOneView() {
+    constexpr std::size_t Gib = std::size_t{1} << 30;
+    HANDLE large = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, static_cast<DWORD>(Gib), nullptr);
+    auto* whole = static_cast<unsigned char*>(Mappings::Get().Reserve(nullptr, Gib));
+    Require(large && whole, "cannot allocate a shared gibibyte");
+    Mappings::Get().Map(whole, Gib, large, 0, PAGE_READWRITE);
+    const auto wholeViews = MappedViews(whole, Gib);
+    whole[Gib - 1] = 1;
+    Mappings::Get().Reset(whole, Gib);
+    VirtualFree(whole, 0, MEM_RELEASE);
+    CloseHandle(large);
+    Require(wholeViews == 1, ("a shared gibibyte was mapped as " + std::to_string(wholeViews) + " views instead of one").c_str());
+
+    constexpr std::size_t Page = 16384;
+    constexpr std::size_t Pages = 64;
+    constexpr std::size_t Span = Pages * Page;
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Span + Page, nullptr);
+    auto* memory = static_cast<unsigned char*>(Mappings::Get().Reserve(nullptr, Span));
+    auto* other = static_cast<unsigned char*>(Mappings::Get().Reserve(nullptr, Page));
+    Require(section && memory && other, "cannot allocate shared test memory");
+    Mappings::Get().Map(memory, Span, section, 0, PAGE_READWRITE);
+    for (std::size_t page = 0; page < Pages; ++page) memory[page * Page + 8] = static_cast<unsigned char>(page + 1);
+    Require(MappedViews(memory, Span) == 1, "a shared run was not mapped as one view");
+    Mappings::Get().SetProtection(reinterpret_cast<std::uintptr_t>(memory + 5 * Page), Page, PAGE_READONLY);
+    DWORD previous;
+    Require(VirtualProtect(memory + 5 * Page, Page, PAGE_READONLY, &previous), "guest protection of one page failed");
+    Require(MappedViews(memory, Span) == 1, "a per-page protection split the run");
+    Mappings::Get().Map(other, Page, section, 30 * Page, PAGE_READWRITE);
+    Require(MappedViews(memory, Span) == 1, "an alias of one page split the run");
+    other[16] = 0x5a;
+    Require(memory[30 * Page + 16] == 0x5a, "an alias store did not reach the run");
+    std::array<void*, 32> collected{};
+    std::size_t available = collected.size();
+    Require(Mappings::Get().Collect(reinterpret_cast<std::uintptr_t>(memory + 50 * Page), Page, collected.data(), &available, true, Collection::All), "run collection failed");
+    Require(ProtectionAt(memory + 50 * Page) == PAGE_READONLY, "collection did not arm the run's page");
+    Mappings::Get().Reset(memory + 10 * Page, Page);
+    Require(MappedViews(memory, Span) == 2, ("a partial unmap left " + std::to_string(MappedViews(memory, Span)) + " views instead of two").c_str());
+    Require(ProtectionAt(memory + 10 * Page) == 0, "the unmapped page is still mapped");
+    Mappings::Get().Map(memory + 20 * Page, Page, section, Span, PAGE_READWRITE);
+    Require(MappedViews(memory, Span) == 4, ("a remap of one page left " + std::to_string(MappedViews(memory, Span)) + " views instead of four").c_str());
+    Require(memory[20 * Page + 8] == 0, "the remapped page shows the old page");
+    for (std::size_t page = 0; page < Pages; ++page) {
+        if (page == 10 || page == 20) continue;
+        Require(memory[page * Page + 8] == static_cast<unsigned char>(page + 1), ("a split lost page " + std::to_string(page)).c_str());
+    }
+    Require(ProtectionAt(memory + 5 * Page) == PAGE_READONLY && ProtectionAt(memory + 6 * Page) == PAGE_READWRITE, "a split lost a page protection");
+    Require(ProtectionAt(memory + 50 * Page) == PAGE_READONLY, "a split dropped a write-tracking protection");
+    const auto before = faults.load();
+    memory[50 * Page + 8] = 0x77;
+    Require(faults == before + 1, "a write to an armed page of a split run did not fault");
+    memory[51 * Page + 8] = 0x78;
+    available = collected.size();
+    Require(Mappings::Get().Collect(reinterpret_cast<std::uintptr_t>(memory + 50 * Page), 2 * Page, collected.data(), &available, true, Collection::Armed), "armed collection failed");
+    Require(available == 1 && collected[0] == memory + 50 * Page, "the split run lost a tracked write");
+    Mappings::Get().Reset(memory, Span);
+    Mappings::Get().Reset(other, Page);
+    VirtualFree(memory, 0, MEM_RELEASE);
+    VirtualFree(other, 0, MEM_RELEASE);
+    CloseHandle(section);
+}
 }
 
 int main() {
@@ -230,6 +644,15 @@ int main() {
         CheckPrivate();
         CheckConcurrentWrites();
         CheckForgottenSectionKeepsNoPages();
+        CheckSharedMapQueriesPerMapping();
+        CheckSharedRunIsOneView();
+        CheckComparedWhenShared();
+        CheckResidentOnlyComparedWhenShared();
+        CheckComparedWhenSharedRemapped();
+        CheckComparedPagesReportedOnce();
+        CheckPrivateCommitCarvesPlaceholders();
+        CheckPrivateCommitEdgeLayouts();
+        CheckPrivateCommitTails();
         std::cout << "Windows deferred write-watch tests passed\n";
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/tests/test_public_headers.py b/core/libs/tests/test_public_headers.py
new file mode 100644
index 0000000000..2511659765
--- /dev/null
+++ b/core/libs/tests/test_public_headers.py
@@ -0,0 +1,237 @@
+import argparse
+import concurrent.futures
+import importlib.util
+import json
+import re
+import subprocess
+import sys
+import tempfile
+from functools import cache
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+LIBS = ROOT / "core/libs"
+sys.dont_write_bytecode = True
+SPEC = importlib.util.spec_from_file_location("nid_names", ROOT / "tools/nid_names.py")
+NIDS = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(NIDS)
+DECLARATION = re.compile(r"(?:\bAPS5_VABI\s+|^[ \t]*[A-Za-z_][\w:*&<> \t]*?[ \t]+)(\w+)\s*\([^;{}]*\)\s*(?:noexcept\s*)?;", re.M)
+INCLUDE = re.compile(r'^\s*#\s*include\s*"([^"]+)"', re.M)
+TYPE_TOKEN = re.compile(r"\bnamespace\s*([\w:]*)\s*\{|\bextern\s*\{|\b(?:struct|union|class)\s+(\w+)\s*([;{])|\busing\s+(\w+)\s*=|[{}]")
+
+
+@cache
+def code(text):
+    return NIDS.CPP_TOKEN.sub(lambda match: match.group() if match.group("code") else re.sub(r"[^\n]", " ", match.group()), text)
+
+
+def declared_types(text):
+    scopes = []
+    result = set()
+    for token in TYPE_TOKEN.finditer(text):
+        namespace, name, ending, alias = token.groups()
+        if namespace is not None:
+            scopes.append(namespace or None)
+        elif name or alias:
+            if None not in scopes:
+                result.add("::".join([scope for scope in scopes if scope] + [name or alias]))
+            if ending == "{":
+                scopes.append(name)
+        elif token.group().startswith("extern"):
+            scopes.append("")
+        elif token.group() == "{":
+            scopes.append(None)
+        elif scopes:
+            scopes.pop()
+    return result
+
+
+@cache
+def source_text(path):
+    return path.read_text(encoding="utf-8")
+
+
+@cache
+def included_headers(header):
+    result = []
+    for name in INCLUDE.findall(source_text(header)):
+        candidates = {path.resolve() for path in (header.parent / name, LIBS / name) if path.is_file()}
+        if len(candidates) != 1:
+            raise RuntimeError(f"{header}: include {name} resolves to {len(candidates)} files")
+        result.append(candidates.pop())
+    return result
+
+
+def reachable(header, visited):
+    if header in visited:
+        return
+    visited.add(header)
+    for included in included_headers(header):
+        reachable(included, visited)
+
+
+def exported_definitions(text):
+    text = text.replace("\\\n", "").replace("\\\r\n", "")
+    masked = code(text)
+    ranges = []
+    for match in re.finditer(r"\bnamespace\s*\{", masked):
+        depth = 1
+        end = match.end()
+        while depth and end < len(masked):
+            depth += (masked[end] == "{") - (masked[end] == "}")
+            end += 1
+        ranges.append((match.start(), end))
+    result = set()
+    position = 0
+    parentheses = 0
+    for match in NIDS.DEFINITION.finditer(masked):
+        prefix = masked[position:match.start()]
+        parentheses += prefix.count("(") - prefix.count(")")
+        position = match.start()
+        if parentheses:
+            continue
+        if any(start < match.start() < end for start, end in ranges):
+            continue
+        start = max(masked.rfind(delimiter, 0, match.start()) for delimiter in ";{}") + 1
+        if re.search(r"\b(?:static|GCC_HIDDEN_FN)\b", masked[start:match.start()]):
+            continue
+        result.add(match.group(1))
+    return result
+
+
+def audit():
+    umbrellas = sorted(path / f"{path.name}.hpp" for path in (LIBS / "prx").iterdir() if path.is_dir())
+    if not umbrellas:
+        raise RuntimeError("No library umbrella headers found")
+    missing = [str(path.relative_to(ROOT)) for path in umbrellas if not path.is_file()]
+    if missing:
+        raise RuntimeError("Missing library umbrella headers: " + ", ".join(missing))
+    exports = {}
+    for umbrella in umbrellas:
+        included = set()
+        reachable(umbrella.resolve(), included)
+        for source in NIDS.source_files(umbrella.parent):
+            if "tools" in source.relative_to(umbrella.parent).parts:
+                continue
+            text = source_text(source).replace("\\\n", "").replace("\\\r\n", "")
+            aliases = {name for nid, name in NIDS.source_aliases(text)} if "APS5_EXPORT" in text else set()
+            definitions = exported_definitions(text)
+            if any(macro in text for macro in NIDS.ASM_FUNCTION_MACROS):
+                definitions.update(NIDS.source_assembly_definitions(text))
+            for name in definitions | aliases:
+                if name.endswith(("_nid_no_patch", "_nid_no_patch_cut")):
+                    continue
+                exports.setdefault(name, []).append((source, included))
+    declarations = {name: [] for name in exports}
+    for source in sorted((ROOT / "core").rglob("*")):
+        if source.suffix not in {".cpp", ".h", ".hpp"}:
+            continue
+        text = code(source_text(source))
+        resolved = source.resolve()
+        for match in DECLARATION.finditer(text):
+            if match.group(1) not in declarations:
+                continue
+            prefix = match.group()[:match.start(1) - match.start()]
+            if re.search(r"\b(?:return|co_return|throw|else|case)\b|&&|\|\|", prefix):
+                continue
+            declarations[match.group(1)].append((resolved, text.count("\n", 0, match.start()) + 1))
+    errors = []
+    headers = set(umbrellas)
+    for name, definitions in exports.items():
+        found = declarations[name]
+        if len(found) != 1 or found[0][0].suffix not in {".h", ".hpp"}:
+            locations = ", ".join(f"{path.relative_to(ROOT)}:{line}" for path, line in found)
+            errors.append(f"{name}: expected exactly one header declaration; found {len(found)}: {locations}")
+            continue
+        header = found[0][0]
+        headers.add(header)
+        for source, included in definitions:
+            if header not in included:
+                errors.append(f"{name}: {header.relative_to(ROOT)} is not included by {source.parent} library umbrella")
+    if errors:
+        raise RuntimeError("\n".join(errors))
+    public_types = set()
+    for header in headers:
+        text = code(source_text(header))
+        public_types.update(declared_types(text))
+    for source in sorted((ROOT / "core").rglob("*.cpp")):
+        text = code(source_text(source))
+        types = declared_types(text)
+        for name in sorted(public_types & types):
+            errors.append(f"{source.relative_to(ROOT)}: duplicate public type {name}; include its header")
+    if errors:
+        raise RuntimeError("\n".join(errors))
+    return umbrellas, sorted(headers), len(exports)
+
+
+def compile_headers(compiler, compiler_args, groups, workers=4):
+    macros = subprocess.run([compiler, *compiler_args, "-dM", "-E", "-x", "c++", "-"], input="", text=True, capture_output=True, check=True).stdout
+    warnings = ["-Werror"]
+    if re.search(r"^#define __clang__\b", macros, re.M):
+        warnings.append("-Wno-return-type-c-linkage")
+
+    def compile_one(group):
+        includes = "".join(f'#include "{header.relative_to(LIBS).as_posix()}"\n' for header in group)
+        with tempfile.TemporaryDirectory() as directory:
+            dependencies = Path(directory) / "headers.d"
+            result = subprocess.run([compiler, *compiler_args, "-std=c++20", *warnings, "-fsyntax-only", "-MD", "-MF", str(dependencies), "-MT", "public_headers", "-x", "c++", f"-I{LIBS}", f"-I{ROOT / '3rdparty/freetype/include'}", "-"], input=includes * 2, text=True, capture_output=True)
+            if result.returncode:
+                raise RuntimeError(f"Header compilation failed: {group}\n{result.stdout}{result.stderr}")
+            text = dependencies.read_text(encoding="utf-8").replace("\\\n", "")
+            if not text.startswith("public_headers:"):
+                raise RuntimeError(f"Invalid compiler dependency output: {dependencies}")
+            names = re.findall(r"(?:\\[ \t]|[^\s])+", text.removeprefix("public_headers:"))
+            paths = [Path(re.sub(r"\\([ \t#\\])", r"\1", name).replace("$$", "$")).resolve() for name in names]
+            forbidden = [path for path in paths if path.is_relative_to((ROOT / "3rdparty").resolve())]
+            if forbidden:
+                raise RuntimeError(f"Public headers depend on 3rdparty: {group}\n" + "\n".join(map(str, forbidden)))
+
+    errors = []
+    with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as pool:
+        futures = [(group, pool.submit(compile_one, group)) for group in groups]
+        for group, future in futures:
+            try:
+                future.result()
+            except Exception as error:
+                errors.append(f"{group}: {error}")
+    if errors:
+        raise RuntimeError(f"{len(errors)} header compilation units failed:\n\n" + "\n\n".join(errors))
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--compiler")
+    parser.add_argument("--compiler-arg", action="append", default=[])
+    parser.add_argument("--manifest", type=Path)
+    parser.add_argument("--audit-only", action="store_true")
+    parser.add_argument("--batch-index", type=int)
+    parser.add_argument("--batch-count", type=int, default=64)
+    args = parser.parse_args()
+    if args.batch_count < 1:
+        parser.error("--batch-count must be positive")
+    if args.audit_only and args.batch_index is not None:
+        parser.error("--audit-only cannot be combined with --batch-index")
+    if not args.audit_only and not args.compiler:
+        parser.error("--compiler is required for header compilation")
+    if args.batch_index is not None:
+        if not args.manifest or not 0 <= args.batch_index < args.batch_count:
+            parser.error("a batch requires --manifest and an index within --batch-count")
+        groups = [[LIBS / name for name in group] for group in json.loads(args.manifest.read_text(encoding="utf-8"))]
+        selected = groups[args.batch_index::args.batch_count]
+        if not selected:
+            raise RuntimeError("Header compilation batch is empty")
+        compile_headers(args.compiler, args.compiler_arg, selected, workers=1)
+        print(f"Batch {args.batch_index}: {len(selected)} header compilation units verified")
+        return
+    umbrellas, headers, count = audit()
+    groups = [[header] for header in headers] + [umbrellas]
+    if args.manifest:
+        args.manifest.write_text(json.dumps([[header.relative_to(LIBS).as_posix() for header in group] for group in groups]), encoding="utf-8")
+    print(f"{len(umbrellas)} libraries, {count} exports: unique declarations and umbrella coverage verified", flush=True)
+    if not args.audit_only:
+        compile_headers(args.compiler, args.compiler_arg, groups)
+        print("Standalone headers verified")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/libs/tests/test_windows_timed_join_imports.py b/core/libs/tests/test_windows_timed_join_imports.py
new file mode 100644
index 0000000000..4a5eeef09c
--- /dev/null
+++ b/core/libs/tests/test_windows_timed_join_imports.py
@@ -0,0 +1,86 @@
+import os
+import shutil
+import struct
+import subprocess
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[2] / 'relinker' / 'relinker' / 'tests'))
+from guest_import_fixtures import executable, fixture_directory
+
+
+def call(code, slot):
+    code.extend(b'\xff\x15' + struct.pack('<i', slot - (0x4000 + len(code) + 6)))
+
+
+def fixture(variant, label):
+    image = executable(variant, 'PkS44IGrDkM#A#B', extra_symbols=('OxhIB8LB-PQ#A#B',))
+    code = bytearray(b'\x48\x83\xec\x38')
+    if label == 'join':
+        code.extend(b'\x48\x8d\x3c\x24\x31\xf6')
+        code.extend(b'\x48\x8d\x15' + struct.pack('<i', 0x4300 - (0x4000 + len(code) + 7)))
+        code.extend(b'\x48\xb9' + struct.pack('<Q', 0x123456789abcdef))
+        call(code, 0x4a28)
+        code.extend(b'\x85\xc0\x0f\x85')
+        create_failure = len(code)
+        code.extend(bytes(4))
+        code.extend(b'\x48\x8b\x3c\x24\x48\x8d\x74\x24\x08')
+        code.extend(b'\x48\xb8' + struct.pack('<Q', 0x7fffffffffffffff))
+        code.extend(b'\x48\x89\x44\x24\x10')
+        code.extend(b'\x48\xc7\x44\x24\x18' + struct.pack('<I', 999999999))
+        code.extend(b'\x48\x8d\x54\x24\x10')
+        call(code, 0x4a20)
+        code.extend(b'\x85\xc0\x0f\x85')
+        join_failure = len(code)
+        code.extend(bytes(4))
+        code.extend(b'\x48\xba' + struct.pack('<Q', 0x123456789abcdef))
+        code.extend(b'\x48\x39\x54\x24\x08\x0f\x85')
+        value_failure = len(code)
+        code.extend(bytes(4))
+        code.extend(b'\x31\xc0\x48\x83\xc4\x38\xc3')
+        failure = len(code)
+        code.extend(b'\xb8\x63\x00\x00\x00\x48\x83\xc4\x38\xc3')
+        for offset in (create_failure, join_failure, value_failure):
+            struct.pack_into('<i', code, offset, failure - offset - 4)
+        image[0x4300:0x4304] = b'\x48\x89\xf8\xc3'
+    else:
+        thread = 1 if label == 'invalid-deadline' else 0
+        code.extend(b'\xbf' + struct.pack('<I', thread) + b'\x31\xf6\x31\xd2')
+        if label != 'null-deadline':
+            code.extend(b'\x48\xc7\x44\x24\x10' + struct.pack('<i', -1 if thread else 0))
+            code.extend(b'\x48\xc7\x44\x24\x18\x00\x00\x00\x00')
+            code.extend(b'\x48\x8d\x54\x24\x10')
+        call(code, 0x4a20)
+        code.extend(b'\x48\x83\xc4\x38\xc3')
+    image[0x4000:0x4000 + len(code)] = code
+    return image
+
+
+def main():
+    assert os.name == 'nt'
+    relinker, libraries = (Path(value).resolve() for value in sys.argv[1:3])
+    variant = sys.argv[3]
+    runtime = Path(sys.argv[4]).resolve()
+    assert variant in ('libkernel_sys.prx', 'libkernel_web.prx')
+    with fixture_directory('anyps5-timed-join-') as directory:
+        work = Path(directory)
+        (work / 'libs').mkdir()
+        (work / 'prx').mkdir()
+        for name in (variant, 'libkernel.prx', 'libc.prx'):
+            shutil.copy2(libraries / name, work / 'libs' / name)
+        for name in ('libgcc_s_seh-1.dll', 'libstdc++-6.dll', 'libwinpthread-1.dll'):
+            shutil.copy2(runtime / name, work / 'libs' / name)
+        for label, expected in (('null-deadline', 22), ('invalid-deadline', 22), ('null-thread', 22), ('join', 0)):
+            source = work / 'input.elf'
+            source.write_bytes(fixture(variant, label))
+            output = work / (label + '.exe')
+            result = subprocess.run([str(relinker), '--windows', str(source), str(output)],
+                                    capture_output=True, text=True, timeout=10)
+            assert result.returncode == 0, (variant, label, result.stderr)
+            result = subprocess.run([str(output)], cwd=work, capture_output=True, text=True, timeout=10)
+            assert result.returncode == expected, (variant, label, result.returncode, result.stderr)
+    print(variant + ': scoped timed-join validation and shared thread lifecycle passed')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt
index 5c4b89dfa8..a33e0cd96c 100644
--- a/core/relinker/CMakeLists.txt
+++ b/core/relinker/CMakeLists.txt
@@ -33,6 +33,7 @@ add_library(relinker_core STATIC
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/NativePath.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/FileIdentity.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/Amd64OnlyConverter.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/RedZoneFramer.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/InstructionScanner.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/X64InstructionDecoder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/X64InstructionRewriter.cpp
@@ -52,6 +53,7 @@ add_library(relinker_core STATIC
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreOperands.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/ScalarCompareOperands.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/MaskedStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/AndnLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/relinker/src/parsing/ElfReader.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/relinker/src/analysis/SyscallScanner.cpp
@@ -98,14 +100,34 @@ if(BUILD_TESTING)
     add_test(NAME andn_lowering COMMAND andn_lowering_tests)
     set_tests_properties(andn_lowering PROPERTIES TIMEOUT 20)
 
+    add_test_executable(masked_store_lowering_tests ${CMAKE_CURRENT_SOURCE_DIR}/codegen/tests/MaskedStoreLoweringTests.cpp)
+    target_link_libraries(masked_store_lowering_tests PRIVATE relinker_core)
+    add_test(NAME masked_store_lowering COMMAND masked_store_lowering_tests)
+    set_tests_properties(masked_store_lowering PROPERTIES TIMEOUT 20)
+
     add_test_executable(relinker_conversion_tests ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/ConversionTests.cpp)
     target_link_libraries(relinker_conversion_tests PRIVATE relinker_core)
     add_test(NAME relinker_conversion COMMAND relinker_conversion_tests)
     set_tests_properties(relinker_conversion PROPERTIES TIMEOUT 20)
+
+    add_test_executable(native_path_tests
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/tests/NativePathTests.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/src/NativePath.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/src/FileReader.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/src/FileWriter.cpp)
+    target_include_directories(native_path_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/io/include ${CMAKE_CURRENT_SOURCE_DIR}/domain/include)
+    add_test(NAME native_path COMMAND native_path_tests)
+    set_tests_properties(native_path PROPERTIES TIMEOUT 20)
+
     add_test_executable(relinker_game_patch_tests ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/GamePatchTests.cpp)
     target_link_libraries(relinker_game_patch_tests PRIVATE relinker_core)
     add_test(NAME relinker_game_patch COMMAND relinker_game_patch_tests)
     set_tests_properties(relinker_game_patch PROPERTIES TIMEOUT 30)
+
+    add_test_executable(call_registry_writer_tests ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/CallRegistryWriterTests.cpp)
+    target_link_libraries(call_registry_writer_tests PRIVATE relinker_core)
+    add_test(NAME call_registry_writer COMMAND call_registry_writer_tests)
+    set_tests_properties(call_registry_writer PROPERTIES TIMEOUT 20)
 endif()
 
 if(ANYPS5_BUILD_WASM)
@@ -198,6 +220,7 @@ if(WIN32)
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreOperands.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/ScalarCompareOperands.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/MaskedStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/AndnLowering.cpp
     )
     target_include_directories(amd64_only_windows_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/include ${CMAKE_CURRENT_SOURCE_DIR}/domain/include ${CMAKE_CURRENT_SOURCE_DIR}/io/include ${CMAKE_CURRENT_SOURCE_DIR}/codegen/include ${CMAKE_CURRENT_SOURCE_DIR}/../libs/prx/libc/src/specifics/windows)
@@ -248,6 +271,19 @@ if(BUILD_TESTING)
     add_test(NAME sdk_mman_syscall COMMAND sdk_mman_syscall_tests)
     set_tests_properties(sdk_mman_syscall PROPERTIES TIMEOUT 20)
 
+    add_test_executable(code_data_scanning_tests
+        ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/CodeDataScanningTests.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/relinker/src/analysis/SyscallScanner.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/InstructionScanner.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/X64InstructionDecoder.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/DecodedInstruction.cpp)
+    target_include_directories(code_data_scanning_tests PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}/domain/include
+        ${CMAKE_CURRENT_SOURCE_DIR}/relinker/include
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/include)
+    add_test(NAME code_data_scanning COMMAND code_data_scanning_tests)
+    set_tests_properties(code_data_scanning PROPERTIES TIMEOUT 20)
+
     add_test_executable(runtime_layout_tests ${CMAKE_CURRENT_SOURCE_DIR}/cli/tests/RuntimeLayoutTests.cpp)
     target_include_directories(runtime_layout_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/cli/include)
     add_test(NAME runtime_layout COMMAND runtime_layout_tests)
@@ -276,6 +312,16 @@ if(BUILD_TESTING)
     add_test(NAME rewrite_boundaries COMMAND rewrite_boundaries_tests)
     set_tests_properties(rewrite_boundaries PROPERTIES TIMEOUT 20)
 
+    add_test_executable(red_zone_framer_tests ${CMAKE_CURRENT_SOURCE_DIR}/codegen/tests/RedZoneFramerTests.cpp)
+    target_link_libraries(red_zone_framer_tests PRIVATE relinker_core)
+    add_test(NAME red_zone_framer COMMAND red_zone_framer_tests)
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|AMD64")
+        add_test_executable(red_zone_framer_execution_tests ${CMAKE_CURRENT_SOURCE_DIR}/codegen/tests/RedZoneFramerExecutionTests.cpp)
+        target_link_libraries(red_zone_framer_execution_tests PRIVATE relinker_core)
+        add_test(NAME red_zone_framer_execution COMMAND red_zone_framer_execution_tests)
+        set_tests_properties(red_zone_framer_execution PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 60)
+    endif()
+
     add_test_executable(cli_args_tests
         ${CMAKE_CURRENT_SOURCE_DIR}/cli/tests/CliArgsTests.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/cli/src/CliArgs.cpp
@@ -414,6 +460,7 @@ if(BUILD_TESTING)
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreOperands.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/ScalarCompareOperands.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/MaskedStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/AndnLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/src/linux/LinuxElfPatcher.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/src/general/SegmentFilter.cpp
@@ -511,7 +558,7 @@ if(BUILD_TESTING)
         foreach(opcode IN ITEMS add or adc sbb and sub xor cmp)
             list(APPEND tlsCoverageGroups alu_${opcode})
         endforeach()
-        list(APPEND tlsCoverageGroups gs_traps gs_traps_implicit)
+        list(APPEND tlsCoverageGroups gs_traps gs_traps_implicit gs_non_memory)
         foreach(group IN LISTS tlsCoverageGroups)
             add_test(NAME tls_function_coverage_${group} COMMAND ${Python3_EXECUTABLE}
                 ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_tls_function_coverage.py $<TARGET_FILE:relinker> ${group})
@@ -527,6 +574,8 @@ if(BUILD_TESTING)
         set_tests_properties(macos_tls_alu PROPERTIES TIMEOUT 60)
         add_test(NAME linux_load_alignment COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_load_alignment.py $<TARGET_FILE:relinker>)
+        add_test(NAME linux_load_bounds COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_load_bounds.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_eh_frame_header COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_eh_frame_header.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_dynamic_strings COMMAND ${Python3_EXECUTABLE}
@@ -539,6 +588,8 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_executable_exports.py $<TARGET_FILE:relinker>)
         add_test(NAME executable_tls_relocations COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_executable_tls_relocations.py $<TARGET_FILE:relinker>)
+        add_test(NAME executable_export_bounds COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_executable_export_bounds.py $<TARGET_FILE:relinker>)
         add_test(NAME macos_empty_tls COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_macos_empty_tls.py $<TARGET_FILE:relinker>)
         set_tests_properties(macos_empty_tls PROPERTIES TIMEOUT 60)
@@ -561,6 +612,8 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_trace_imports.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_trace_imports COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_trace_imports.py $<TARGET_FILE:relinker>)
+        add_test(NAME macos_trace_imports COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_macos_trace_imports.py $<TARGET_FILE:relinker>)
         add_test(NAME windows_address_space COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_address_space.py $<TARGET_FILE:relinker>)
         add_test(NAME windows_tls_thread_pointer COMMAND ${Python3_EXECUTABLE}
@@ -579,22 +632,36 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_syscall_trap.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_tls COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_tls.py $<TARGET_FILE:relinker>)
+        add_test(NAME guest_tls_export_references COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_tls_export_references.py $<TARGET_FILE:relinker>)
+        set_tests_properties(guest_tls_export_references PROPERTIES TIMEOUT 30)
         add_test(NAME guest_needed_modules COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_needed_modules.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_module_dir COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_module_dir.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_module_directories COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_module_directories.py $<TARGET_FILE:relinker>)
+        add_test(NAME guest_trailing_note COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_trailing_note.py $<TARGET_FILE:relinker>)
         add_test(NAME relinker_executables COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_executables.py $<TARGET_FILE:relinker>)
         add_test(NAME game_patches COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_game_patches.py $<TARGET_FILE:relinker>)
+        if(Python3_VERSION VERSION_GREATER_EQUAL 3.11)
+            add_test(NAME patch_advisor_unit COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_SOURCE_DIR}/tools/tests/test_suggest_patches.py)
+            add_test(NAME patch_advisor_integration COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_patch_advisor.py $<TARGET_FILE:relinker>)
+            set_tests_properties(patch_advisor_integration PROPERTIES TIMEOUT 40)
+        endif()
         add_test(NAME sce_module_path COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_sce_module_path.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_guest_stack COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_guest_stack.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_symbol_names COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_symbol_names.py $<TARGET_FILE:relinker>)
+        add_test(NAME import_symbol_types COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_import_symbol_types.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_registry COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_registry.py $<TARGET_FILE:relinker>)
         add_test(NAME needed_libraries COMMAND ${Python3_EXECUTABLE}
@@ -634,6 +701,7 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_unused_import_dependencies.py
             $<TARGET_FILE:relinker> $<TARGET_FILE:guest_module_args_host>)
         set_property(TEST guest_unused_import_dependencies APPEND PROPERTY LABELS relinker)
+        add_asan_test_options(guest_unused_import_dependencies verify_asan_link_order=0)
         add_test(NAME guest_export_lookup COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_export_lookup.py $<TARGET_FILE:relinker>)
         set_tests_properties(guest_export_lookup PROPERTIES TIMEOUT 30)
@@ -643,6 +711,7 @@ if(BUILD_TESTING)
         add_asan_test_options(guest_module_args verify_asan_link_order=0)
         add_asan_test_options(guest_deferred_dependencies verify_asan_link_order=0)
         add_asan_test_options(guest_module_fini verify_asan_link_order=0)
+        add_asan_test_options(guest_unused_import_dependencies verify_asan_link_order=0)
         add_test(NAME guest_needed_nested_modules COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_needed_nested_modules.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_zero_initializer COMMAND ${Python3_EXECUTABLE}
@@ -650,6 +719,10 @@ if(BUILD_TESTING)
             $<TARGET_FILE:relinker> $<TARGET_FILE:guest_module_args_host>)
         set_tests_properties(guest_zero_initializer PROPERTIES TIMEOUT 30)
         add_asan_test_options(guest_zero_initializer verify_asan_link_order=0)
+        add_test(NAME linux_guest_named_imports COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_guest_named_imports.py
+            $<TARGET_FILE:relinker> $<TARGET_FILE:guest_module_args_host>)
+        add_asan_test_options(linux_guest_named_imports verify_asan_link_order=0)
         set(windows_stdio_host_arguments)
         if(WIN32)
             if(MINGW)
@@ -667,7 +740,7 @@ if(BUILD_TESTING)
                 set(msvcrtImportLibrary "${CMAKE_CURRENT_BINARY_DIR}/windows_stdio_msvcrt_import.a")
                 add_custom_command(OUTPUT "${msvcrtImportLibrary}"
                     COMMAND "${mingwDlltoolExecutable}" -d "${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/tests/WindowsMsvcrt.def"
-                        -l "${msvcrtImportLibrary}" -D msvcrt.dll
+                        -l "${msvcrtImportLibrary}" -D msvcrt.dll --temp-prefix windows_stdio_msvcrt_import
                     DEPENDS elfpatcher/tests/WindowsMsvcrt.def
                     VERBATIM)
                 add_custom_target(windows_stdio_msvcrt_import DEPENDS "${msvcrtImportLibrary}")
@@ -687,6 +760,14 @@ if(BUILD_TESTING)
         add_test(NAME windows_import_modules COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_import_modules.py
             $<TARGET_FILE:relinker> ${windows_stdio_host_arguments})
+        if(WIN32)
+            foreach(kernelVariant IN ITEMS sys web)
+                add_test(NAME windows_kernel_variant_${kernelVariant} COMMAND ${Python3_EXECUTABLE}
+                    ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_kernel_variant_imports.py
+                    $<TARGET_FILE:relinker> libkernel_${kernelVariant}.prx)
+                set_tests_properties(windows_kernel_variant_${kernelVariant} PROPERTIES TIMEOUT 30)
+            endforeach()
+        endif()
         add_test(NAME elf_header COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_elf_header.py $<TARGET_FILE:relinker>)
         add_test(NAME weak_imports COMMAND ${Python3_EXECUTABLE}
@@ -695,6 +776,7 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_guest_weak_imports.py $<TARGET_FILE:relinker>)
         add_test(NAME input_magic COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_input_magic.py $<TARGET_FILE:relinker>)
+        add_asan_test_options(input_magic max_allocation_size_mb=512)
         add_test(NAME input_preservation COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_input_preservation.py $<TARGET_FILE:relinker>)
         add_test(NAME output_collisions COMMAND ${Python3_EXECUTABLE}
@@ -724,6 +806,8 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_call_registry.py $<TARGET_FILE:relinker>)
         add_test(NAME jmprel_table_bounds COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_jmprel_table_bounds.py $<TARGET_FILE:relinker>)
+        add_test(NAME copy_relocations COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_copy_relocations.py $<TARGET_FILE:relinker>)
         if(WIN32)
             add_test(NAME windows_diagnostic_fixture_isolation COMMAND ${Python3_EXECUTABLE}
                 ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/tests/test_windows_diagnostic_fixture_isolation.py $<TARGET_FILE:windows_dependency_diagnostics_tests>)
diff --git a/core/relinker/cli/include/Cli.hpp b/core/relinker/cli/include/Cli.hpp
index cb379408f0..2625b44aac 100644
--- a/core/relinker/cli/include/Cli.hpp
+++ b/core/relinker/cli/include/Cli.hpp
@@ -16,6 +16,7 @@ struct Args {
     bool skipSceModule = false;
     bool toIntel = false;
     bool toRosetta = false;
+    bool frameRedZone = false;
     bool writeRegistry = false;
     bool toWindows = false;
     bool toMacos = false;
diff --git a/core/relinker/cli/include/NativeModules.hpp b/core/relinker/cli/include/NativeModules.hpp
index 66139266ca..862acfcf0c 100644
--- a/core/relinker/cli/include/NativeModules.hpp
+++ b/core/relinker/cli/include/NativeModules.hpp
@@ -1,11 +1,13 @@
 #pragma once
 
 #include <relinker/guest/GuestImage.hpp>
+#include <iosfwd>
 
 namespace Cli {
 
 struct NativeModules {
     std::filesystem::path Root;
+    std::vector<std::filesystem::path> Directories;
     std::vector<std::filesystem::path> RuntimeDirectories;
     std::vector<Relinker::GuestModuleInput> Modules;
 };
@@ -14,4 +16,6 @@ bool SameDirectory(const std::filesystem::path& first, const std::filesystem::pa
 
 NativeModules ReadModules(const std::filesystem::path& inputPath, const std::filesystem::path& sceModulePath, const std::set<std::string>& excludedModules, const std::vector<std::string>& moduleDirectories);
 
+void ReportUnconvertedNeeded(const NativeModules& modules, const std::vector<std::string>& neededLibraries, bool foldCase, std::ostream& out);
+
 }
diff --git a/core/relinker/cli/src/Autorun.cpp b/core/relinker/cli/src/Autorun.cpp
index aa54150b47..e6e6defd69 100644
--- a/core/relinker/cli/src/Autorun.cpp
+++ b/core/relinker/cli/src/Autorun.cpp
@@ -16,11 +16,10 @@ namespace Cli {
 
 int Autorun(const std::string& absPath, bool toWindows) {
     if (!toWindows) {
-        std::filesystem::permissions(Io::NativePath(absPath),
-            std::filesystem::perms::owner_exec |
-            std::filesystem::perms::group_exec |
-            std::filesystem::perms::others_exec,
-            std::filesystem::perm_options::add);
+        const auto path = Io::NativePath(absPath);
+        constexpr auto executable = std::filesystem::perms::owner_exec | std::filesystem::perms::group_exec | std::filesystem::perms::others_exec;
+        if ((std::filesystem::status(path).permissions() & executable) != executable)
+            std::filesystem::permissions(path, executable, std::filesystem::perm_options::add);
     }
 
     int rawCode = 0;
diff --git a/core/relinker/cli/src/CliArgs.cpp b/core/relinker/cli/src/CliArgs.cpp
index 3fa915c6d2..f117c9e040 100644
--- a/core/relinker/cli/src/CliArgs.cpp
+++ b/core/relinker/cli/src/CliArgs.cpp
@@ -13,7 +13,7 @@
 namespace Cli {
 
 const char* Usage() {
-    return "Usage: relinker [--help] [--windows | --macos] [--windows-diagnostics] [--windows-gui] [--trace-imports] [--windows-fixed-base <address>] [--linux-fixed-base <address>] [--macos-fixed-base <address>] [--skip-syscall-check | --trap-sdk-syscall-stubs] [--skip-sce-module | --sce-module-path <path>] [--exclude-sce-module <file>]... [--module-dir <dir>]... [--executable <path>]... [--to-intel] [--to-rosetta] [unused-filter=0|1|2] [--registry] [--rpath <path>] [--lazy-binding] [--autorun] [--patches <file> | --no-patches] <input.elf> <output.elf>\n"
+    return "Usage: relinker [--help] [--windows | --macos] [--windows-diagnostics] [--windows-gui] [--trace-imports] [--windows-fixed-base <address>] [--linux-fixed-base <address>] [--macos-fixed-base <address>] [--skip-syscall-check | --trap-sdk-syscall-stubs] [--skip-sce-module | --sce-module-path <path>] [--exclude-sce-module <file>]... [--module-dir <dir>]... [--executable <path>]... [--to-intel] [--to-rosetta] [--frame-red-zone] [unused-filter=0|1|2] [--registry] [--rpath <path>] [--lazy-binding] [--autorun] [--patches <file> | --no-patches] <input.elf> <output.elf>\n"
            "       relinker --verify-patches <file> [--verify-output] [--skip-sce-module | --sce-module-path <path>] [--exclude-sce-module <file>]... [--module-dir <dir>]... [--executable <path>]... <path>\n"
            "Example: relinker input.elf output.elf";
 }
@@ -22,7 +22,7 @@ namespace {
 
 constexpr std::string_view kVerifyRejectedOptions[] = {
     "--windows", "--macos", "--windows-gui", "--windows-diagnostics", "--windows-fixed-base", "--trace-imports", "--linux-fixed-base", "--macos-fixed-base",
-    "--to-intel", "--to-rosetta", "--skip-syscall-check", "--trap-sdk-syscall-stubs", "unused-filter=",
+    "--to-intel", "--to-rosetta", "--frame-red-zone", "--skip-syscall-check", "--trap-sdk-syscall-stubs", "unused-filter=",
     "--rpath", "--registry", "--lazy-binding", "--autorun", "--patches", "--no-patches",
 };
 
@@ -105,6 +105,8 @@ Args ParseArgs(int argc, char* argv[]) {
             args.executables.push_back(argv[++i]);
         } else if (arg == "--to-intel") {
             args.toIntel = true;
+        } else if (arg == "--frame-red-zone") {
+            args.frameRedZone = true;
         } else if (arg == "--to-rosetta") {
             args.toRosetta = true;
             args.toIntel = true;
@@ -197,8 +199,6 @@ Args ParseArgs(int argc, char* argv[]) {
 
     if (args.windowsFixedBase && !args.toWindows)
         throw std::runtime_error("--windows-fixed-base requires --windows");
-    if (args.traceImports && args.toMacos)
-        throw std::runtime_error("--trace-imports cannot be used with --macos");
     if (args.traceImports && args.lazyBinding)
         throw std::runtime_error("--trace-imports conflicts with --lazy-binding");
     if (args.linuxFixedBase && (args.toWindows || args.toMacos))
diff --git a/core/relinker/cli/src/NativeModules.cpp b/core/relinker/cli/src/NativeModules.cpp
index f01ac374d4..6163063c69 100644
--- a/core/relinker/cli/src/NativeModules.cpp
+++ b/core/relinker/cli/src/NativeModules.cpp
@@ -2,13 +2,59 @@
 #include <io/FileReader.hpp>
 #include <io/NativePath.hpp>
 #include <io/FileIdentity.hpp>
+#include <domain/ImportModule.hpp>
 #include <algorithm>
+#include <cstdint>
 #include <fstream>
 #include <iostream>
 #include <map>
+#include <optional>
+#include <string_view>
+#include <system_error>
+#include <tuple>
 
 namespace Cli {
 
+namespace {
+
+struct CandidateHeader {
+    bool Elf = false;
+    bool Self = false;
+    std::uint16_t Type = 0;
+};
+
+std::optional<CandidateHeader> TryReadCandidateHeader(const std::filesystem::path& path) {
+    std::ifstream stream(path, std::ios::binary);
+    if (!stream) return std::nullopt;
+    char header[18]{};
+    stream.read(header, sizeof header);
+    if (stream.bad()) return std::nullopt;
+    CandidateHeader result;
+    if (stream.gcount() < 4) return result;
+    const auto byte = [&](const std::size_t index) { return static_cast<unsigned char>(header[index]); };
+    result.Self = (byte(0) == 0x4f && byte(1) == 0x15 && byte(2) == 0x3d && byte(3) == 0x1d) || (byte(0) == 0x54 && byte(1) == 0x14 && byte(2) == 0xf5 && byte(3) == 0xee);
+    result.Elf = byte(0) == 0x7f && header[1] == 'E' && header[2] == 'L' && header[3] == 'F';
+    if (result.Elf && stream.gcount() == sizeof header) result.Type = static_cast<std::uint16_t>(byte(16) | (byte(17) << 8));
+    return result;
+}
+
+CandidateHeader ReadCandidateHeader(const std::filesystem::path& path) {
+    const auto header = TryReadCandidateHeader(path);
+    if (!header) throw Domain::RelinkerException("Cannot read guest candidate: " + Io::Utf8Path(path));
+    return *header;
+}
+
+std::string FoldedName(std::string name, const bool foldCase) {
+    if (foldCase) for (auto& character : name) if (character >= 'A' && character <= 'Z') character = static_cast<char>(character + ('a' - 'A'));
+    return name;
+}
+
+std::string_view ModuleStem(const std::string_view name) {
+    return name.substr(0, name.size() - Domain::ModuleSuffix(name).size());
+}
+
+}
+
 bool SameDirectory(const std::filesystem::path& first, const std::filesystem::path& second) {
     if (std::filesystem::exists(first) && std::filesystem::exists(second)) return std::filesystem::equivalent(first, second);
     return std::filesystem::weakly_canonical(first) == std::filesystem::weakly_canonical(second);
@@ -45,17 +91,6 @@ NativeModules ReadModules(const std::filesystem::path& inputPath, const std::fil
     }
     std::vector<std::filesystem::path> paths;
     std::set<std::string> unmatchedExclusions = excludedModules;
-    const auto isElf = [](const std::filesystem::path& path, bool& self) {
-        std::ifstream stream(path, std::ios::binary);
-        if (!stream) throw Domain::RelinkerException("Cannot read guest candidate: " + Io::Utf8Path(path));
-        char magic[4]{};
-        stream.read(magic, 4);
-        if (stream.bad()) throw Domain::RelinkerException("Cannot read guest candidate magic: " + Io::Utf8Path(path));
-        if (stream.gcount() != 4) return false;
-        const auto byte = [&](const std::size_t index) { return static_cast<unsigned char>(magic[index]); };
-        self = (byte(0) == 0x4f && byte(1) == 0x15 && byte(2) == 0x3d && byte(3) == 0x1d) || (byte(0) == 0x54 && byte(1) == 0x14 && byte(2) == 0xf5 && byte(3) == 0xee);
-        return byte(0) == 0x7f && magic[1] == 'E' && magic[2] == 'L' && magic[3] == 'F';
-    };
     for (const auto& directory : directories) {
         if (!std::filesystem::is_directory(directory)) throw Domain::RelinkerException("Guest module path is not a directory: " + Io::Utf8Path(directory));
         for (const auto& entry : std::filesystem::directory_iterator(directory)) {
@@ -66,9 +101,9 @@ NativeModules ReadModules(const std::filesystem::path& inputPath, const std::fil
             }
             if (!entry.is_regular_file()) continue;
             if (Io::SameFile(entry.path(), inputPath)) continue;
-            bool self = false;
-            if (isElf(entry.path(), self)) paths.push_back(entry.path());
-            else if (self)
+            const auto header = ReadCandidateHeader(entry.path());
+            if (header.Elf) paths.push_back(entry.path());
+            else if (header.Self)
                 std::cout << "Skipping SELF container: " << entry.path().lexically_relative(root).generic_string()
                           << " (unwrap it before relinking)\n";
         }
@@ -77,6 +112,7 @@ NativeModules ReadModules(const std::filesystem::path& inputPath, const std::fil
     std::sort(paths.begin(), paths.end());
     NativeModules result;
     result.Root = root;
+    result.Directories = std::move(directories);
     result.RuntimeDirectories = std::move(runtimeDirectories);
     for (const auto& path : paths) result.Modules.push_back({path, Io::FileReader().Read(Io::Utf8Path(path))});
     std::map<std::size_t, std::string> sonames;
@@ -107,4 +143,49 @@ NativeModules ReadModules(const std::filesystem::path& inputPath, const std::fil
     return result;
 }
 
+void ReportUnconvertedNeeded(const NativeModules& modules, const std::vector<std::string>& neededLibraries, const bool foldCase, std::ostream& out) {
+    std::map<std::string, std::vector<std::string>> stems;
+    for (const auto& name : neededLibraries) {
+        const auto folded = FoldedName(name, foldCase);
+        if (!Domain::ModuleSuffix(folded).empty()) stems[std::string(ModuleStem(folded))].push_back(name);
+    }
+    if (stems.empty()) return;
+    struct Found {
+        std::filesystem::path Relative;
+        std::string Name;
+        bool Self;
+    };
+    std::vector<Found> found;
+    std::error_code error;
+    for (auto entry = std::filesystem::recursive_directory_iterator(modules.Root, std::filesystem::directory_options::skip_permission_denied, error); !error && entry != std::filesystem::recursive_directory_iterator(); entry.increment(error)) {
+        const bool directory = entry->is_directory(error);
+        if (error) {
+            error.clear();
+            continue;
+        }
+        if (directory) {
+            if (std::any_of(modules.Directories.begin(), modules.Directories.end(), [&](const auto& scanned) { return std::filesystem::equivalent(scanned, entry->path(), error) && !error; })) entry.disable_recursion_pending();
+            error.clear();
+            continue;
+        }
+        const auto filename = FoldedName(Io::Utf8Path(entry->path().filename()), foldCase);
+        if (Domain::ModuleSuffix(filename).empty()) continue;
+        const auto stem = stems.find(std::string(ModuleStem(filename)));
+        if (stem == stems.end()) continue;
+        if (!entry->is_regular_file(error) || error) {
+            error.clear();
+            continue;
+        }
+        const auto header = TryReadCandidateHeader(entry->path());
+        if (!header || (!header->Self && !(header->Elf && header->Type == 0xfe18))) continue;
+        for (const auto& name : stem->second) found.push_back({entry->path().lexically_relative(modules.Root), name, header->Self});
+    }
+    std::sort(found.begin(), found.end(), [](const auto& left, const auto& right) { return std::tie(left.Relative, left.Name) < std::tie(right.Relative, right.Name); });
+    for (const auto& [relative, name, self] : found) {
+        const auto directory = relative.parent_path().generic_string();
+        out << "Needed module not converted: " << name << " at " << relative.generic_string() << "; add --module-dir " << (directory.empty() ? "." : directory)
+            << (self ? " and unwrap the SELF container" : "") << '\n';
+    }
+}
+
 }
diff --git a/core/relinker/cli/tests/AutorunExitTests.cpp b/core/relinker/cli/tests/AutorunExitTests.cpp
index c4883221a5..798fb129db 100644
--- a/core/relinker/cli/tests/AutorunExitTests.cpp
+++ b/core/relinker/cli/tests/AutorunExitTests.cpp
@@ -3,15 +3,38 @@
 #include <cerrno>
 #include <chrono>
 #include <csignal>
+#ifndef _WIN32
+#include <sys/stat.h>
+#endif
 #include <filesystem>
+#include <fstream>
 #include <iostream>
 #include <sstream>
 #include <stdexcept>
 #include <string>
 #include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+std::filesystem::path ExecutablePath(const char* argument) {
+#ifdef _WIN32
+    static_cast<void>(argument);
+    std::vector<wchar_t> filename(32768);
+    const auto size = GetModuleFileNameW(nullptr, filename.data(), static_cast<DWORD>(filename.size()));
+    if (size == 0 || size >= filename.size()) throw std::runtime_error("Cannot locate the autorun test executable");
+    return std::filesystem::path(filename.data());
+#else
+    return std::filesystem::absolute(argument);
+#endif
+}
+
+}
 
 int main(int, char* argv[]) {
-    const auto executable = std::filesystem::absolute(argv[0]);
+    const auto executable = ExecutablePath(argv[0]);
     const auto name = executable.stem().string();
     if (name.starts_with("anyps5-autorun-child-")) {
         if (name.find("signal") != std::string::npos) std::raise(SIGILL);
@@ -21,26 +44,43 @@ int main(int, char* argv[]) {
         std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + " with spaces" + executable.extension().string());
 #ifndef _WIN32
     const auto signaled = child.parent_path() / ("anyps5-autorun-child-signal-" + child.filename().string());
+    const auto script = child.parent_path() / ("anyps5-autorun-script-" + child.filename().string());
+    const auto changeTime = [](const std::filesystem::path& path) {
+        struct stat info {};
+        if (stat(path.c_str(), &info) != 0) throw std::runtime_error("Cannot stat " + path.string());
+#ifdef __APPLE__
+        return info.st_ctimespec.tv_sec * 1000000000LL + info.st_ctimespec.tv_nsec;
+#else
+        return info.st_ctim.tv_sec * 1000000000LL + info.st_ctim.tv_nsec;
+#endif
+    };
 #endif
     std::istringstream input("\n\n\n");
     auto* savedInput = std::cin.rdbuf(input.rdbuf());
     int result = 0;
+    std::vector<std::filesystem::path> aliases;
     try {
+#ifdef _WIN32
         std::filesystem::copy_file(executable, child);
+#else
+        std::filesystem::create_symlink(executable, child);
+        const auto changed = changeTime(executable);
+#endif
         std::vector<std::string> suffixes{""};
 #ifndef _WIN32
         suffixes.insert(suffixes.end(), {" $HOME", " $(printf substituted)", " `printf substituted`",
             " 'single'", " \"double\"", " \\backslash", " line\nbreak"});
 #endif
-        const auto originalChild = child;
         for (const auto& suffix : suffixes) {
-            const auto renamed = std::filesystem::path(originalChild.string() + suffix);
-            if (renamed != child) std::filesystem::rename(child, renamed);
-            child = renamed;
+            const auto alias = std::filesystem::path(child.string() + suffix);
+            if (alias != child) {
+                std::filesystem::create_symlink(child, alias);
+                aliases.push_back(alias);
+            }
             for (const bool windows : {false, true}) {
-                const int code = Cli::Autorun(child.string(), windows);
+                const int code = Cli::Autorun(alias.string(), windows);
                 if (code != 42) throw std::runtime_error("Autorun changed exit code 42 to " +
-                    std::to_string(code) + " for " + child.string());
+                    std::to_string(code) + " for " + alias.string());
             }
         }
 #ifndef _WIN32
@@ -66,18 +106,24 @@ int main(int, char* argv[]) {
         }
         if (std::signal(SIGCHLD, savedHandler) == SIG_ERR)
             throw std::runtime_error("Cannot restore SIGCHLD after the autorun failure test");
-        std::filesystem::rename(child, signaled);
+        std::filesystem::create_symlink(child, signaled);
         const int code = Cli::Autorun(signaled.string(), false);
         if (code != 128 + SIGILL) throw std::runtime_error("Autorun lost the child signal");
+        if (changeTime(executable) != changed) throw std::runtime_error("Autorun changed the mode of an output that was already executable");
+        std::ofstream(script) << "#!/bin/sh\nexit 42\n";
+        std::filesystem::permissions(script, std::filesystem::perms::owner_read | std::filesystem::perms::owner_write);
+        if (Cli::Autorun(script.string(), false) != 42) throw std::runtime_error("Autorun did not make a non-executable output executable");
 #endif
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
         result = 1;
     }
     std::cin.rdbuf(savedInput);
+    for (const auto& alias : aliases) std::filesystem::remove(alias);
     std::filesystem::remove(child);
 #ifndef _WIN32
     std::filesystem::remove(signaled);
+    std::filesystem::remove(script);
 #endif
     return result;
 }
diff --git a/core/relinker/cli/tests/CliArgsTests.cpp b/core/relinker/cli/tests/CliArgsTests.cpp
index 8f18c4c963..3cd3069dc1 100644
--- a/core/relinker/cli/tests/CliArgsTests.cpp
+++ b/core/relinker/cli/tests/CliArgsTests.cpp
@@ -322,7 +322,7 @@ void verifyMode() {
     expectThrows({"--verify-patches", "p.toml", "--verify-output", "out.elf", "--exclude-sce-module", "x.prx"}, noEffect);
     expectThrows({"--verify-patches", "p.toml", "--verify-output", "out.elf", "--skip-sce-module"}, noEffect);
     expectThrows({"--verify-patches", "p.toml", "in.elf", "extra"}, "unexpected argument: extra");
-    for (const auto* option : {"--windows", "--macos", "--to-intel", "--to-rosetta", "--trace-imports", "--lazy-binding", "--autorun", "--registry", "--skip-syscall-check", "--no-patches"})
+    for (const auto* option : {"--windows", "--macos", "--to-intel", "--to-rosetta", "--frame-red-zone", "--trace-imports", "--lazy-binding", "--autorun", "--registry", "--skip-syscall-check", "--no-patches"})
         expectThrows({"--verify-patches", "p.toml", option, "in.elf"}, std::string(option) + " cannot be used with --verify-patches");
     expectThrows({"--verify-patches", "p.toml", "--rpath", "x", "in.elf"}, "--rpath cannot be used with --verify-patches");
     expectThrows({"--verify-patches", "p.toml", "--patches", "q.toml", "in.elf"}, "--patches cannot be used with --verify-patches");
diff --git a/core/relinker/codegen/include/codegen/CodegenTypes.hpp b/core/relinker/codegen/include/codegen/CodegenTypes.hpp
index 021f2bf059..9b116f3657 100644
--- a/core/relinker/codegen/include/codegen/CodegenTypes.hpp
+++ b/core/relinker/codegen/include/codegen/CodegenTypes.hpp
@@ -76,6 +76,7 @@ struct DecodedInstructionInfo {
     bool IsTwoByteOpcode;
     std::uint8_t Opcode;
     std::uint8_t ModRmRegField;
+    std::size_t ModRmOffset = 0;
 };
 
 }
diff --git a/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp b/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp
index c3df3388cc..8f71e35555 100644
--- a/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp
+++ b/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp
@@ -42,6 +42,7 @@ inline constexpr Entry kRdseed = {"RDSEED", nullptr, 0};
 inline constexpr Entry kRdpid = {"RDPID", nullptr, 0};
 inline constexpr Entry kRdtscp = {"RDTSCP", nullptr, 0};
 inline constexpr Entry kClwb = {"CLWB", nullptr, 0};
+inline constexpr Entry kXsaveopt = {"XSAVEOPT", nullptr, 0};
 inline constexpr Entry kWideStore = {"256-bit store", nullptr, 0};
 inline constexpr Entry kScalarCompare = {"scalar compare", nullptr, 0};
 inline constexpr Entry kExtrq = {"EXTRQ", nullptr, 0};
diff --git a/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp b/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp
index 4176cc4cff..d1c86aff41 100644
--- a/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp
+++ b/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp
@@ -27,6 +27,7 @@ struct DecodedInstruction {
     [[nodiscard]] bool IsRdpid() const;
     [[nodiscard]] bool IsRdtscp() const;
     [[nodiscard]] bool IsClwb() const;
+    [[nodiscard]] bool IsXsaveopt() const;
 
 private:
     [[nodiscard]] std::size_t _skipPrefixesAndRex(bool* outHasOperandSizePrefix, bool* outHasRepnePrefix, bool* outHasRepPrefix) const;
diff --git a/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp b/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp
index 9986e79286..998c321b29 100644
--- a/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp
+++ b/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp
@@ -27,7 +27,8 @@ public:
 
     virtual void EmitOutOfLine(
         StubBodyBuilder& body,
-        std::span<const std::uint8_t> instruction
+        std::span<const std::uint8_t> instruction,
+        bool allowInPlace = false
     ) const = 0;
 };
 
diff --git a/core/relinker/codegen/include/codegen/x86/MaskedStoreLowering.hpp b/core/relinker/codegen/include/codegen/x86/MaskedStoreLowering.hpp
new file mode 100644
index 0000000000..d03957a542
--- /dev/null
+++ b/core/relinker/codegen/include/codegen/x86/MaskedStoreLowering.hpp
@@ -0,0 +1,27 @@
+#ifndef CODEGEN_X86_MASKEDSTORELOWERING_HPP
+#define CODEGEN_X86_MASKEDSTORELOWERING_HPP
+
+#include <codegen/x86/StubBodyBuilder.hpp>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <vector>
+
+namespace Codegen {
+
+struct MaskedStoreOperands {
+    const char* Name;
+    std::uint8_t ElementSize;
+    bool Wide;
+    std::uint8_t Mask;
+    MemoryOperand Memory;
+    std::vector<std::uint8_t> Instruction;
+    std::size_t DisplacementOffset;
+};
+
+[[nodiscard]] std::optional<MaskedStoreOperands> DecodeMaskedStore(const std::uint8_t* data, std::size_t length);
+void EmitMaskedStore(StubBodyBuilder& body, const MaskedStoreOperands& operands);
+
+}
+
+#endif
diff --git a/core/relinker/codegen/include/codegen/x86/RedZoneFramer.hpp b/core/relinker/codegen/include/codegen/x86/RedZoneFramer.hpp
new file mode 100644
index 0000000000..a23fa23206
--- /dev/null
+++ b/core/relinker/codegen/include/codegen/x86/RedZoneFramer.hpp
@@ -0,0 +1,47 @@
+#ifndef CODEGEN_X86_REDZONEFRAMER_HPP
+#define CODEGEN_X86_REDZONEFRAMER_HPP
+
+#include <codegen/CodegenTypes.hpp>
+#include <domain/Types.hpp>
+#include <cstddef>
+#include <cstdint>
+#include <map>
+#include <string>
+#include <vector>
+
+namespace Codegen {
+
+struct RedZoneFunction {
+    std::uint64_t Begin = 0;
+    std::uint64_t End = 0;
+};
+
+struct RedZoneFrameReport {
+    std::size_t Functions = 0;
+    std::size_t RedZoneFunctions = 0;
+    std::size_t Framed = 0;
+    std::size_t FramedWithoutFramePointer = 0;
+    std::size_t Exits = 0;
+    std::size_t MovedOperands = 0;
+    std::size_t OperandStubs = 0;
+    std::size_t StubbedOperands = 0;
+    std::map<std::string, std::size_t> Skipped;
+};
+
+struct RedZoneDisplacement {
+    Domain::FileByteOffset Offset;
+    std::vector<std::uint8_t> Bytes;
+};
+
+std::vector<TrampolineSite> FrameRedZoneFunctions(
+    const std::vector<std::uint8_t>& fileBytes,
+    const std::vector<Domain::ProgramHeader>& codeSegments,
+    const std::vector<RedZoneFunction>& functions,
+    const std::vector<TrampolineSite>& existing,
+    RedZoneFrameReport& report,
+    std::vector<RedZoneDisplacement>& displacements
+);
+
+}
+
+#endif
diff --git a/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp b/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp
index c6db778a9e..e2c581eb24 100644
--- a/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp
+++ b/core/relinker/codegen/include/codegen/x86/X64OpcodeConstants.hpp
@@ -43,6 +43,7 @@ inline constexpr std::uint8_t OneByteArpl = 0x62;
 inline constexpr std::uint8_t OneByteMovsxd = 0x63;
 inline constexpr std::uint8_t OneByteModRmRangeIMin = 0x84;
 inline constexpr std::uint8_t OneByteModRmRangeIMax = 0x8F;
+inline constexpr std::uint8_t OneByteLea = 0x8D;
 inline constexpr std::uint8_t OneByteGrp2Rm8Imm8 = 0xC0;
 inline constexpr std::uint8_t OneByteGrp2RmImm8 = 0xC1;
 inline constexpr std::uint8_t OneByteVex3 = 0xC4;
diff --git a/core/relinker/codegen/src/Amd64OnlyConverter.cpp b/core/relinker/codegen/src/Amd64OnlyConverter.cpp
index 8f312031fe..de510c4224 100644
--- a/core/relinker/codegen/src/Amd64OnlyConverter.cpp
+++ b/core/relinker/codegen/src/Amd64OnlyConverter.cpp
@@ -56,6 +56,7 @@ public:
     ) : _seg(seg), _matches(matches), _ph(ph), _branchTargets(branchTargets), _pending(pending), _claimed(claimed), _matcher(matcher) {}
 
     [[nodiscard]] std::optional<Placement> Window(const std::size_t index) const {
+        std::optional<Placement> fallback;
         for (const bool avoidSegment : {true, false}) {
             if (index + 1 < _matches.size() && (_pending.contains(index + 1) || _movable(index + 1, true, avoidSegment))) {
                 if (auto placement = _relocate(index, index, index + 1))
@@ -65,8 +66,10 @@ public:
                 if (auto placement = _relocate(index, index - 1, index))
                     return placement;
             }
+            if (!fallback && index + 1 < _matches.size() && _pending.contains(index + 1))
+                fallback = _relocate(index, index, index + 1, true);
         }
-        return std::nullopt;
+        return fallback;
     }
 
     [[nodiscard]] std::optional<Placement> Island(const std::size_t index) {
@@ -130,7 +133,7 @@ private:
         };
     }
 
-    [[nodiscard]] std::optional<Placement> _relocate(const std::size_t index, const std::size_t first, const std::size_t last) const {
+    [[nodiscard]] std::optional<Placement> _relocate(const std::size_t index, const std::size_t first, const std::size_t last, const bool allowInPlace = false) const {
         if (_entered(_address(first), _end(last)))
             return std::nullopt;
         StubBodyBuilder body;
@@ -138,7 +141,7 @@ private:
         try {
             for (auto k = first; k <= last; ++k) {
                 if (_pending.contains(k)) {
-                    _matcher.EmitOutOfLine(body, _bytes(k));
+                    _matcher.EmitOutOfLine(body, _bytes(k), allowInPlace);
                     if (k != index)
                         placement.Consumed.push_back(k);
                 } else {
diff --git a/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp b/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp
index 739a3aea7f..ecbe487147 100644
--- a/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp
+++ b/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp
@@ -15,6 +15,7 @@
 #include <codegen/x86/ScalarCompareOperands.hpp>
 #include <codegen/x86/WideStoreLowering.hpp>
 #include <codegen/x86/WideStoreOperands.hpp>
+#include <codegen/x86/MaskedStoreLowering.hpp>
 #include <codegen/x86/AndnLowering.hpp>
 #include <codegen/x86/X64InstructionDecoder.hpp>
 #include <codegen/x86/X64OpcodeConstants.hpp>
@@ -172,7 +173,8 @@ public:
 
     void EmitOutOfLine(
         StubBodyBuilder& body,
-        std::span<const std::uint8_t> instruction
+        std::span<const std::uint8_t> instruction,
+        bool allowInPlace = false
     ) const override;
 
 private:
@@ -199,6 +201,8 @@ private:
 Amd64OnlyMatch Amd64OnlyInstructionMatcher::_matchMovnts(const DecodedInstruction& instr, const Entry& entry) const {
     using namespace X64OpcodeConstants;
     const auto opcodeOffset = instr.OpcodeOffset();
+    if (std::find(instr.Data, instr.Data + opcodeOffset, PrefixLock) != instr.Data + opcodeOffset)
+        throw CodegenException("MOVNTSS/MOVNTSD with a LOCK prefix");
     if (opcodeOffset + 2 >= instr.Length)
         throw CodegenException("MOVNTSS/MOVNTSD truncated before its ModRM byte");
     const auto modrm = instr.Data[opcodeOffset + 2];
@@ -258,6 +262,11 @@ std::optional<Amd64OnlyMatch> Amd64OnlyInstructionMatcher::_matchRosetta(const D
     }
     if (instr.IsClwb())
         return _inPlace(kClwb, instr.Length, {});
+    if (instr.IsXsaveopt()) {
+        std::vector<std::uint8_t> replacement(instr.Data, instr.Data + instr.Length);
+        replacement[instr.OpcodeOffset() + 2] &= static_cast<std::uint8_t>(~(2u << X64OpcodeConstants::ModRmRegShift));
+        return Amd64OnlyMatch{kXsaveopt.Name, instr.Length, Amd64OnlyLowering::InPlace, std::move(replacement), {}, 0};
+    }
     if (instr.IsRdpid())
         return _trampoline(kRdpid.Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { body.Raw(_rdpidReplacement(instr)); }), true);
     if (instr.IsRdtscp())
@@ -266,6 +275,8 @@ std::optional<Amd64OnlyMatch> Amd64OnlyInstructionMatcher::_matchRosetta(const D
         return _trampoline(kWideStore.Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { _wideStoreLowering.EmitOutOfLine(body, *wide); }), false, true);
     if (const auto compare = DecodeScalarCompare(instr.Data, instr.Length))
         return _trampoline(kScalarCompare.Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { _emitScalarCompare(body, instr, *compare); }), true);
+    if (const auto masked = DecodeMaskedStore(instr.Data, instr.Length))
+        return _trampoline(masked->Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { EmitMaskedStore(body, *masked); }));
     return std::nullopt;
 }
 
@@ -325,6 +336,10 @@ const char* Amd64OnlyInstructionMatcher::_emitOutOfLine(StubBodyBuilder& body, c
         _emitScalarCompare(body, instr, *compare);
         return kScalarCompare.Name;
     }
+    if (const auto masked = _target == Amd64OnlyTarget::Rosetta ? DecodeMaskedStore(instr.Data, instr.Length) : std::nullopt) {
+        EmitMaskedStore(body, *masked);
+        return masked->Name;
+    }
     return nullptr;
 }
 
@@ -355,8 +370,12 @@ const char* Amd64OnlyInstructionMatcher::_emitInPlace(StubBodyBuilder& body, con
     return nullptr;
 }
 
-void Amd64OnlyInstructionMatcher::EmitOutOfLine(StubBodyBuilder& body, const std::span<const std::uint8_t> instruction) const {
-    if (_emitOutOfLine(body, DecodedInstruction{instruction.data(), instruction.size()}) == nullptr)
+void Amd64OnlyInstructionMatcher::EmitOutOfLine(StubBodyBuilder& body, const std::span<const std::uint8_t> instruction, const bool allowInPlace) const {
+    const DecodedInstruction instr{instruction.data(), instruction.size()};
+    const auto* emitted = _emitOutOfLine(body, instr);
+    if (emitted == nullptr && allowInPlace)
+        emitted = _emitInPlace(body, instr);
+    if (emitted == nullptr)
         throw CodegenException("AMD-only instruction has no out-of-line lowering");
     body.Advance(instruction.size());
 }
diff --git a/core/relinker/codegen/src/x86/DecodedInstruction.cpp b/core/relinker/codegen/src/x86/DecodedInstruction.cpp
index d54ce541bc..fa32c87812 100644
--- a/core/relinker/codegen/src/x86/DecodedInstruction.cpp
+++ b/core/relinker/codegen/src/x86/DecodedInstruction.cpp
@@ -324,6 +324,21 @@ bool DecodedInstruction::IsClwb() const {
            ((modrm >> ModRmModShift) & ModRmModMask) != ModRmModRegister && ((modrm >> ModRmRegShift) & ModRmRegMask) == 6;
 }
 
+bool DecodedInstruction::IsXsaveopt() const {
+    bool operandSizeOverride = false;
+    bool repnePrefix = false;
+    bool repPrefix = false;
+    const std::size_t pos = _skipPrefixesAndRex(&operandSizeOverride, &repnePrefix, &repPrefix);
+
+    if (operandSizeOverride || repnePrefix || repPrefix || pos + 2 >= Length) {
+        return false;
+    }
+
+    const auto modrm = Data[pos + 2];
+    return Data[pos] == TwoByteOpcodeEscape && Data[pos + 1] == TwoByteGrp15 &&
+           ((modrm >> ModRmModShift) & ModRmModMask) != ModRmModRegister && ((modrm >> ModRmRegShift) & ModRmRegMask) == 6;
+}
+
 bool DecodedInstruction::IsMovntss() const {
     bool operandSizeOverride = false;
     bool repnePrefix = false;
diff --git a/core/relinker/codegen/src/x86/MaskedStoreLowering.cpp b/core/relinker/codegen/src/x86/MaskedStoreLowering.cpp
new file mode 100644
index 0000000000..642cee81ff
--- /dev/null
+++ b/core/relinker/codegen/src/x86/MaskedStoreLowering.cpp
@@ -0,0 +1,102 @@
+#include <codegen/x86/MaskedStoreLowering.hpp>
+#include <codegen/CodegenException.hpp>
+#include <algorithm>
+#include <array>
+#include <limits>
+
+namespace Codegen {
+
+namespace {
+
+constexpr std::int32_t kFrameSize = 128 + 3 * 8;
+constexpr std::uint8_t kAddress = 0;
+constexpr std::uint8_t kVexMap0F38 = 0x02;
+constexpr std::uint8_t kVexPp66 = 0x01;
+
+bool _prefix(std::uint8_t value) {
+    return value == 0x2E || value == 0x36 || value == 0x3E || value == 0x26 || value == 0x64 || value == 0x65 || value == 0x67;
+}
+
+void _append32(std::vector<std::uint8_t>& bytes, std::int32_t value) {
+    for (unsigned shift = 0; shift < 32; shift += 8)
+        bytes.push_back(static_cast<std::uint8_t>(static_cast<std::uint32_t>(value) >> shift));
+}
+
+void _address(StubBodyBuilder& body, const MemoryOperand& memory) {
+    auto displacement = static_cast<std::int64_t>(memory.Displacement);
+    if (memory.StackBase) displacement += kFrameSize;
+    const bool address32 = std::find(memory.Prefixes.begin(), memory.Prefixes.end(), 0x67) != memory.Prefixes.end();
+    if (!address32 && displacement > std::numeric_limits<std::int32_t>::max())
+        throw CodegenException("Masked store stack displacement does not fit after spilling");
+    const auto mod = memory.StackBase ? 2 : memory.Mod;
+    auto bytes = memory.Prefixes;
+    bytes.push_back(static_cast<std::uint8_t>(0x48 | memory.RexIndexBase));
+    bytes.push_back(0x8D);
+    bytes.push_back(static_cast<std::uint8_t>((mod << 6) | (kAddress << 3) | memory.Rm));
+    if (memory.Rm == 4) bytes.push_back(memory.Sib);
+    const auto offset = bytes.size();
+    if (mod == 1) bytes.push_back(static_cast<std::uint8_t>(displacement));
+    if (mod == 2 || (mod == 0 && (memory.RipRelative || (memory.Rm == 4 && (memory.Sib & 7) == 5))))
+        _append32(bytes, static_cast<std::int32_t>(displacement));
+    if (memory.RipRelative)
+        body.RipRelative(bytes, offset, static_cast<std::int64_t>(memory.InstructionLength) + memory.Displacement);
+    else
+        body.Raw(bytes);
+}
+
+}
+
+std::optional<MaskedStoreOperands> DecodeMaskedStore(const std::uint8_t* data, const std::size_t length) {
+    std::size_t vex = 0;
+    while (vex < length && _prefix(data[vex])) ++vex;
+    if (vex + 5 > length || data[vex] != 0xC4 || (data[vex + 1] & 0x1F) != kVexMap0F38 || (data[vex + 2] & 3) != kVexPp66 || (data[vex + 4] >> 6) == 3)
+        return std::nullopt;
+    const bool w = (data[vex + 2] & 0x80) != 0;
+    const char* name = nullptr;
+    std::uint8_t elementSize = 4;
+    if (data[vex + 3] == 0x2E && !w) {
+        name = "VMASKMOVPS";
+    } else if (data[vex + 3] == 0x2F && !w) {
+        name = "VMASKMOVPD";
+        elementSize = 8;
+    } else if (data[vex + 3] == 0x8E) {
+        name = w ? "VPMASKMOVQ" : "VPMASKMOVD";
+        elementSize = w ? 8 : 4;
+    } else {
+        return std::nullopt;
+    }
+    const auto extensions = static_cast<std::uint8_t>(~data[vex + 1]);
+    const auto rex = static_cast<std::uint8_t>(((extensions & 0x20) >> 5) | ((extensions & 0x40) >> 5));
+    auto memory = DecodeMemoryOperand(data, length, vex + 4, rex, {data, data + vex});
+    if (vex + 4 + memory.EncodedSize != length)
+        throw CodegenException("Masked store memory operand has trailing bytes");
+    const auto displacementOffset = vex + 5 + (memory.Rm == 4 ? 1 : 0);
+    return MaskedStoreOperands{name, elementSize, (data[vex + 2] & 4) != 0, static_cast<std::uint8_t>((~data[vex + 2] >> 3) & 15),
+        std::move(memory), std::vector<std::uint8_t>(data, data + length), displacementOffset};
+}
+
+void EmitMaskedStore(StubBodyBuilder& body, const MaskedStoreOperands& operands) {
+    const auto& memory = operands.Memory;
+    body.Raw(std::array<std::uint8_t, 8>{0x48, 0x8D, 0x64, 0x24, 0x80, 0x9C, 0x50, 0x51});
+    _address(body, memory);
+    body.Raw(std::array<std::uint8_t, 5>{0xC4, static_cast<std::uint8_t>(operands.Mask >= 8 ? 0xC1 : 0xE1),
+        static_cast<std::uint8_t>(0x78 | (operands.Wide ? 4 : 0) | (operands.ElementSize == 8 ? 1 : 0)), 0x50,
+        static_cast<std::uint8_t>(0xC8 | (operands.Mask & 7))});
+    const auto elements = (operands.Wide ? 32u : 16u) / operands.ElementSize;
+    for (unsigned element = 0; element < elements; ++element) {
+        std::vector<std::uint8_t> probes;
+        for (const auto offset : {element * operands.ElementSize, element * operands.ElementSize + operands.ElementSize - 1u}) {
+            probes.insert(probes.end(), memory.Prefixes.begin(), memory.Prefixes.end());
+            probes.insert(probes.end(), {0xF0, 0x80, 0x48, static_cast<std::uint8_t>(offset), 0x00});
+        }
+        body.Raw(std::array<std::uint8_t, 5>{0xF6, 0xC1, static_cast<std::uint8_t>(1u << element), 0x74, static_cast<std::uint8_t>(probes.size())});
+        body.Raw(probes);
+    }
+    body.Raw(std::array<std::uint8_t, 11>{0x59, 0x58, 0x9D, 0x48, 0x8D, 0xA4, 0x24, 0x80, 0x00, 0x00, 0x00});
+    if (memory.RipRelative)
+        body.RipRelative(operands.Instruction, operands.DisplacementOffset, static_cast<std::int64_t>(memory.InstructionLength) + memory.Displacement);
+    else
+        body.Raw(operands.Instruction);
+}
+
+}
diff --git a/core/relinker/codegen/src/x86/RedZoneFramer.cpp b/core/relinker/codegen/src/x86/RedZoneFramer.cpp
new file mode 100644
index 0000000000..cfe714faef
--- /dev/null
+++ b/core/relinker/codegen/src/x86/RedZoneFramer.cpp
@@ -0,0 +1,441 @@
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <codegen/IInstructionScanner.hpp>
+#include <codegen/x86/X64InstructionDecoder.hpp>
+#include <algorithm>
+#include <cstring>
+#include <iterator>
+#include <limits>
+#include <map>
+#include <optional>
+#include <set>
+
+namespace Codegen {
+
+namespace {
+
+constexpr std::uint8_t kRegRsp = 4;
+constexpr std::uint8_t kRegRbp = 5;
+constexpr std::size_t kJumpBytes = 5;
+constexpr std::int64_t kRedZoneBytes = 0x80;
+constexpr std::int64_t kStackAlignment = 16;
+constexpr std::uint8_t kJumpBack[] = {0xe9, 0x00, 0x00, 0x00, 0x00};
+
+std::vector<std::uint8_t> lowerRsp(const std::int64_t shift) {
+    return {0x48, 0x8d, 0x64, 0x24, static_cast<std::uint8_t>(-shift)};
+}
+
+std::vector<std::uint8_t> raiseRsp(const std::int64_t shift) {
+    const auto value = static_cast<std::uint32_t>(shift);
+    return {0x48, 0x8d, 0xa4, 0x24, static_cast<std::uint8_t>(value), static_cast<std::uint8_t>(value >> 8), static_cast<std::uint8_t>(value >> 16), static_cast<std::uint8_t>(value >> 24)};
+}
+
+struct Insn {
+    std::size_t Offset;
+    std::size_t Length;
+    DecodedInstructionInfo Info;
+};
+
+std::optional<std::uint8_t> pushedRegister(const std::uint8_t* code, const Insn& insn) {
+    if (insn.Length == 1 && code[0] >= 0x50 && code[0] <= 0x57 && code[0] != 0x50 + kRegRsp) return static_cast<std::uint8_t>(code[0] - 0x50);
+    if (insn.Length == 2 && code[0] == 0x41 && code[1] >= 0x50 && code[1] <= 0x57) return static_cast<std::uint8_t>(code[1] - 0x50 + 8);
+    return std::nullopt;
+}
+
+std::optional<std::uint8_t> poppedRegister(const std::uint8_t* code, const Insn& insn) {
+    if (insn.Length == 1 && code[0] >= 0x58 && code[0] <= 0x5f && code[0] != 0x58 + kRegRsp) return static_cast<std::uint8_t>(code[0] - 0x58);
+    if (insn.Length == 2 && code[0] == 0x41 && code[1] >= 0x58 && code[1] <= 0x5f) return static_cast<std::uint8_t>(code[1] - 0x58 + 8);
+    return std::nullopt;
+}
+
+std::optional<std::int64_t> rspAdjustment(const std::uint8_t* code, const Insn& insn) {
+    std::int32_t value = 0;
+    if (insn.Length == 4 && code[0] == 0x48 && code[1] == 0x83 && (code[2] == 0xec || code[2] == 0xc4)) {
+        const std::int64_t amount = static_cast<std::int8_t>(code[3]);
+        return code[2] == 0xec ? -amount : amount;
+    }
+    if (insn.Length == 7 && code[0] == 0x48 && code[1] == 0x81 && (code[2] == 0xec || code[2] == 0xc4)) {
+        std::memcpy(&value, code + 3, 4);
+        return code[2] == 0xec ? -std::int64_t{value} : std::int64_t{value};
+    }
+    if (insn.Length == 5 && std::memcmp(code, "\x48\x8d\x64\x24", 4) == 0) return static_cast<std::int8_t>(code[4]);
+    if (insn.Length == 8 && std::memcmp(code, "\x48\x8d\xa4\x24", 4) == 0) {
+        std::memcpy(&value, code + 4, 4);
+        return value;
+    }
+    return std::nullopt;
+}
+
+struct MemoryUse {
+    bool UsesRsp = false;
+    bool RegisterRsp = false;
+    bool RbpBased = false;
+    std::int64_t RbpDisp = 0;
+    bool RspBased = false;
+    std::int64_t RspDisp = 0;
+    std::uint8_t Mod = 0;
+    std::size_t DispOffset = 0;
+    bool Indexed = false;
+    bool Address = false;
+};
+
+void extensionBits(const std::uint8_t* code, const Insn& insn, bool& r, bool& x, bool& b) {
+    const auto& info = insn.Info;
+    r = x = b = false;
+    if (info.RexPrefix != 0) {
+        r = (info.RexPrefix & 4) != 0;
+        x = (info.RexPrefix & 2) != 0;
+        b = (info.RexPrefix & 1) != 0;
+        return;
+    }
+    const auto lead = code[info.OpcodeOffset];
+    if ((lead == 0xc4 || lead == 0x8f || lead == 0x62) && info.OpcodeOffset + 1 < insn.Length) {
+        r = (code[info.OpcodeOffset + 1] & 0x80) == 0;
+        x = (code[info.OpcodeOffset + 1] & 0x40) == 0;
+        b = (code[info.OpcodeOffset + 1] & 0x20) == 0;
+    } else if (lead == 0xc5 && info.OpcodeOffset + 1 < insn.Length) {
+        r = (code[info.OpcodeOffset + 1] & 0x80) == 0;
+    }
+}
+
+bool twoByteRegisterIsGeneral(const std::uint8_t op) {
+    return (op >= 0x40 && op <= 0x4f) || op == 0xa3 || op == 0xa4 || op == 0xa5 || op == 0xab || op == 0xac || op == 0xad || op == 0xaf || op == 0xb0 || op == 0xb1 || op == 0xb3 || op == 0xb6 || op == 0xb7 || op == 0xb8 || (op >= 0xbb && op <= 0xbf) || op == 0xc0 || op == 0xc1 || op == 0xc3;
+}
+
+bool twoByteRmIsGeneral(const std::uint8_t op) {
+    return twoByteRegisterIsGeneral(op) || op == 0x6e || op == 0x7e || op == 0xba;
+}
+
+bool vexGeneralUsesRsp(const std::uint8_t* code, const Insn& insn, const std::uint8_t mod, const std::uint8_t reg, const std::uint8_t rm, const bool r, const bool b) {
+    const auto at = insn.Info.OpcodeOffset;
+    const auto lead = code[at];
+    if ((lead != 0xc4 && lead != 0xc5) || at + 3 >= insn.Length) return false;
+    const auto map = lead == 0xc5 ? std::uint8_t{1} : static_cast<std::uint8_t>(code[at + 1] & 0x1f);
+    const auto vvvv = static_cast<std::uint8_t>((~code[lead == 0xc5 ? at + 1 : at + 2] >> 3) & 0xf);
+    const auto op = code[lead == 0xc5 ? at + 2 : at + 3];
+    const bool general = (map == 2 && (op == 0xf2 || op == 0xf3 || op == 0xf5 || op == 0xf6 || op == 0xf7)) || (map == 3 && op == 0xf0);
+    return general && ((reg == kRegRsp && !r) || (mod == 3 && rm == kRegRsp && !b) || vvvv == kRegRsp);
+}
+
+MemoryUse memoryUse(const std::uint8_t* code, const Insn& insn) {
+    MemoryUse use;
+    const auto& info = insn.Info;
+    if (!info.HasModRm || info.ModRmOffset == 0 || info.ModRmOffset >= insn.Length) return use;
+    bool r = false;
+    bool x = false;
+    bool b = false;
+    extensionBits(code, insn, r, x, b);
+    const auto modrm = info.ModRmByte;
+    const auto mod = static_cast<std::uint8_t>(modrm >> 6);
+    const auto reg = static_cast<std::uint8_t>((modrm >> 3) & 7);
+    const auto rm = static_cast<std::uint8_t>(modrm & 7);
+    const bool vex = info.RexPrefix == 0 && (code[info.OpcodeOffset] == 0xc4 || code[info.OpcodeOffset] == 0xc5 || code[info.OpcodeOffset] == 0x62 || code[info.OpcodeOffset] == 0x8f);
+    if (!vex && !info.IsTwoByteOpcode && reg == kRegRsp && !r) {
+        const auto op = info.Opcode;
+        if ((op <= 0x3f && (op & 7) <= 3) || (op >= 0x84 && op <= 0x8b) || op == 0x8d) use.UsesRsp = use.RegisterRsp = true;
+    }
+    if (!vex && info.IsTwoByteOpcode && ((reg == kRegRsp && !r && twoByteRegisterIsGeneral(info.Opcode)) || (mod == 3 && rm == kRegRsp && !b && twoByteRmIsGeneral(info.Opcode)))) use.UsesRsp = use.RegisterRsp = true;
+    if (vex && vexGeneralUsesRsp(code, insn, mod, reg, rm, r, b)) use.UsesRsp = use.RegisterRsp = true;
+    if (mod == 3) {
+        const bool generalPurpose = !vex && !info.IsTwoByteOpcode && !(info.Opcode >= 0xd8 && info.Opcode <= 0xdf);
+        if (generalPurpose && rm == kRegRsp && !b) use.UsesRsp = use.RegisterRsp = true;
+        return use;
+    }
+    std::size_t at = info.ModRmOffset + 1;
+    std::uint8_t base = rm;
+    bool baseExtended = b;
+    bool indexed = false;
+    if (rm == 4) {
+        if (at >= insn.Length) return use;
+        const auto sib = code[at++];
+        base = sib & 7;
+        indexed = ((sib >> 3) & 7) != 4 || x;
+        if (mod == 0 && base == 5) return use;
+    } else if (mod == 0 && rm == 5) {
+        return use;
+    }
+    std::int64_t disp = 0;
+    if (mod == 1 && at < insn.Length) disp = static_cast<std::int8_t>(code[at]);
+    if (mod == 2 && at + 4 <= insn.Length) {
+        std::int32_t value = 0;
+        std::memcpy(&value, code + at, 4);
+        disp = value;
+    }
+    if (base == kRegRsp && !baseExtended) {
+        use.UsesRsp = true;
+        use.RspBased = true;
+        use.RspDisp = disp;
+        use.Mod = mod;
+        use.DispOffset = at;
+        use.Indexed = indexed;
+        use.Address = !vex && !info.IsTwoByteOpcode && info.Opcode == 0x8d;
+    }
+    if (base == kRegRbp && !baseExtended && mod != 0) {
+        use.RbpBased = true;
+        use.RbpDisp = disp;
+    }
+    return use;
+}
+
+std::optional<std::vector<std::uint8_t>> movedDisplacement(const MemoryUse& use, const std::int64_t shift) {
+    const auto moved = use.RspDisp + shift;
+    if (use.Mod == 1 && moved <= std::numeric_limits<std::int8_t>::max()) return std::vector<std::uint8_t>{static_cast<std::uint8_t>(moved)};
+    if (use.Mod == 2 && moved <= std::numeric_limits<std::int32_t>::max()) {
+        const auto value = static_cast<std::uint32_t>(static_cast<std::int32_t>(moved));
+        return std::vector<std::uint8_t>{static_cast<std::uint8_t>(value), static_cast<std::uint8_t>(value >> 8), static_cast<std::uint8_t>(value >> 16), static_cast<std::uint8_t>(value >> 24)};
+    }
+    return std::nullopt;
+}
+
+std::optional<std::vector<std::uint8_t>> withDisplacement(const std::uint8_t* code, const Insn& insn, const MemoryUse& use, const std::int64_t disp) {
+    if (disp < std::numeric_limits<std::int32_t>::min() || disp > std::numeric_limits<std::int32_t>::max()) return std::nullopt;
+    const std::size_t oldBytes = use.Mod == 1 ? 1 : use.Mod == 2 ? 4 : 0;
+    if (use.DispOffset + oldBytes > insn.Length) return std::nullopt;
+    const bool narrow = disp >= std::numeric_limits<std::int8_t>::min() && disp <= std::numeric_limits<std::int8_t>::max();
+    std::vector<std::uint8_t> bytes(code, code + use.DispOffset);
+    bytes[insn.Info.ModRmOffset] = static_cast<std::uint8_t>((bytes[insn.Info.ModRmOffset] & 0x3f) | (narrow ? 0x40 : 0x80));
+    const auto value = static_cast<std::uint32_t>(static_cast<std::int32_t>(disp));
+    for (std::size_t index = 0; index < (narrow ? 1u : 4u); ++index) bytes.push_back(static_cast<std::uint8_t>(value >> (8 * index)));
+    bytes.insert(bytes.end(), code + use.DispOffset + oldBytes, code + insn.Length);
+    return bytes;
+}
+
+struct OperandStub {
+    std::size_t First;
+    std::size_t Last;
+    std::size_t Begin;
+    std::size_t End;
+    std::vector<std::uint8_t> Body;
+    std::size_t Operands = 0;
+};
+
+void frameSegment(
+    const std::vector<std::uint8_t>& fileBytes,
+    const Domain::ProgramHeader& ph,
+    const std::vector<RedZoneFunction>& functions,
+    const std::vector<TrampolineSite>& existing,
+    std::vector<TrampolineSite>& sites,
+    std::vector<RedZoneDisplacement>& displacements,
+    RedZoneFrameReport& report
+) {
+    const auto segOffset = static_cast<std::size_t>(ph.Offset);
+    const auto segSize = static_cast<std::size_t>(ph.FileSize);
+    if (segOffset > fileBytes.size() || segSize > fileBytes.size() - segOffset) return;
+    const std::vector<std::uint8_t> seg(fileBytes.begin() + static_cast<std::ptrdiff_t>(segOffset), fileBytes.begin() + static_cast<std::ptrdiff_t>(segOffset + segSize));
+    const auto scanner = MakeInstructionScanner();
+    const X64InstructionDecoder decoder;
+
+    std::set<std::size_t> targets;
+    for (const auto& match : scanner->ScanCodeSection(seg, 0, seg.size())) {
+        const auto info = decoder.DecodeInstruction(seg.data() + match.Offset, match.Length);
+        if (!info.HasBranchTarget || info.HasRipRelativeDisp || info.FlowKind == ControlFlowKind::Call) continue;
+        const auto target = static_cast<std::int64_t>(match.Offset + match.Length) + info.BranchDisp;
+        if (target >= 0 && static_cast<std::size_t>(target) < seg.size()) targets.insert(static_cast<std::size_t>(target));
+    }
+    std::vector<std::pair<std::size_t, std::size_t>> taken;
+    for (const auto& site : existing) {
+        if (site.Address < ph.MappedAddress || site.Address >= ph.MappedAddress + segSize) continue;
+        const auto at = static_cast<std::size_t>(site.Address - ph.MappedAddress);
+        taken.emplace_back(at, at + site.Length);
+    }
+    const auto overlapsExisting = [&](const std::size_t begin, const std::size_t end) {
+        return std::any_of(taken.begin(), taken.end(), [&](const auto& range) { return begin < range.second && range.first < end; });
+    };
+    const auto targetInside = [&](const std::size_t begin, const std::size_t end) {
+        const auto hit = targets.upper_bound(begin);
+        return hit != targets.end() && *hit < end;
+    };
+    for (const auto& function : functions) {
+        if (function.Begin < ph.MappedAddress || function.End <= function.Begin || function.End - ph.MappedAddress > segSize) continue;
+        const auto start = static_cast<std::size_t>(function.Begin - ph.MappedAddress);
+        const auto limit = static_cast<std::size_t>(function.End - ph.MappedAddress);
+        ++report.Functions;
+        const auto skip = [&](const char* reason) { ++report.Skipped[reason]; };
+
+        const std::vector<std::uint8_t> code(seg.begin() + static_cast<std::ptrdiff_t>(start), seg.begin() + static_cast<std::ptrdiff_t>(limit));
+        std::vector<Insn> body;
+        for (const auto& match : scanner->ScanCodeSection(code, 0, code.size())) {
+            if (code[match.Offset] == 0xcc && match.Length == 1) break;
+            body.push_back({start + static_cast<std::size_t>(match.Offset), match.Length, decoder.DecodeInstruction(code.data() + match.Offset, match.Length)});
+        }
+        if (body.size() < 3) continue;
+        const auto at = [&](const std::size_t k) { return seg.data() + body[k].Offset; };
+        const bool rbpPrologue = body[0].Length == 1 && at(0)[0] == 0x55 && body[1].Length == 3 && std::memcmp(at(1), "\x48\x89\xe5", 3) == 0;
+        std::vector<std::uint8_t> pushed;
+        std::size_t p = rbpPrologue ? 2 : 0;
+        while (p < body.size())
+            if (const auto reg = pushedRegister(at(p), body[p])) { pushed.push_back(*reg); ++p; } else break;
+        std::int64_t allocation = 0;
+        if (!rbpPrologue && p < body.size())
+            if (const auto adjustment = rspAdjustment(at(p), body[p]); adjustment && *adjustment < 0) { allocation = -*adjustment; ++p; }
+        std::vector<std::uint8_t> expected(pushed.begin(), pushed.end());
+        if (rbpPrologue) expected.insert(expected.begin(), kRegRbp);
+        const auto popsBefore = [&](const std::size_t k) -> std::optional<std::size_t> {
+            std::size_t q = k;
+            std::vector<std::uint8_t> popped;
+            while (q > p && popped.size() < expected.size())
+                if (const auto reg = poppedRegister(at(q - 1), body[q - 1])) { popped.push_back(*reg); --q; } else break;
+            if (popped != expected) return std::nullopt;
+            return q;
+        };
+        std::set<std::size_t> frees;
+        if (allocation > 0)
+            for (std::size_t k = p; k < body.size(); ++k)
+                if (body[k].Info.FlowKind == ControlFlowKind::Return)
+                    if (const auto q = popsBefore(k); q && *q > p && rspAdjustment(at(*q - 1), body[*q - 1]) == allocation) frees.insert(*q - 1);
+
+        bool leaf = true;
+        bool redZone = false;
+        const char* reason = nullptr;
+        std::vector<std::pair<std::size_t, std::size_t>> exits;
+        std::map<std::size_t, std::pair<std::size_t, std::vector<std::uint8_t>>> moves;
+        std::vector<std::size_t> stubbed;
+        const auto functionEnd = limit;
+        std::int64_t depth = 0;
+        bool wholeRedZone = rbpPrologue;
+        for (std::size_t k = p; k < body.size(); ++k) {
+            const auto use = memoryUse(at(k), body[k]);
+            if (!use.RspBased) continue;
+            if (use.RspDisp < 0) depth = std::max(depth, -use.RspDisp);
+            if (use.Indexed || (use.Address && use.RspDisp < 0)) wholeRedZone = true;
+        }
+        const auto shift = wholeRedZone ? kRedZoneBytes : std::min(kRedZoneBytes, (depth + kStackAlignment - 1) / kStackAlignment * kStackAlignment);
+        for (std::size_t k = p; k < body.size(); ++k) {
+            const auto& insn = body[k];
+            const auto* code = at(k);
+            const auto flow = insn.Info.FlowKind;
+            if (flow == ControlFlowKind::Call || flow == ControlFlowKind::IndirectCall) { leaf = false; break; }
+            if (frees.contains(k)) continue;
+            const auto use = memoryUse(code, insn);
+            if (use.RbpBased && rbpPrologue && use.RbpDisp < -static_cast<std::int64_t>(8 * pushed.size())) redZone = true;
+            if (use.RspBased && use.RspDisp < 0) redZone = true;
+            if (reason != nullptr) continue;
+            if (code[insn.Info.OpcodeOffset] == 0xc9 || code[insn.Info.OpcodeOffset] == 0xc8) { reason = "leave or enter"; continue; }
+            if (rbpPrologue) {
+                if (use.UsesRsp) { reason = "other use of rsp"; continue; }
+            } else {
+                if (use.RegisterRsp) { reason = "other use of rsp"; continue; }
+                if (use.RspBased) {
+                    if (code[insn.Info.OpcodeOffset] == 0x62) { reason = "rsp operand that cannot move with rsp"; continue; }
+                    if (overlapsExisting(insn.Offset, insn.Offset + insn.Length)) { reason = "overlaps another stub"; continue; }
+                    if (auto moved = movedDisplacement(use, shift)) moves.emplace(k, std::pair{insn.Offset + use.DispOffset, std::move(*moved)});
+                    else stubbed.push_back(k);
+                }
+            }
+            if (flow == ControlFlowKind::IndirectJump) { reason = "indirect jump"; continue; }
+            if ((flow == ControlFlowKind::UnconditionalJump || flow == ControlFlowKind::ConditionalBranch) && insn.Info.HasBranchTarget) {
+                const auto target = static_cast<std::int64_t>(insn.Offset + insn.Length) + insn.Info.BranchDisp;
+                if (insn.Info.HasRipRelativeDisp || target < static_cast<std::int64_t>(start) || target >= static_cast<std::int64_t>(functionEnd)) { reason = "branch leaves the function"; continue; }
+            }
+            if (flow == ControlFlowKind::Return) {
+                if (insn.Length != 1 || code[0] != 0xc3) { reason = "ret with an immediate"; continue; }
+                const auto pops = popsBefore(k);
+                if (!pops) { reason = "exit does not pop the prologue's registers"; continue; }
+                auto q = *pops;
+                if (allocation > 0) {
+                    if (q == p || !frees.contains(q - 1)) { reason = "exit does not free the prologue's allocation"; continue; }
+                    --q;
+                }
+                const auto siteStart = body[q].Offset;
+                const auto siteEnd = insn.Offset + 1;
+                if (siteEnd - siteStart < kJumpBytes) { reason = "exit shorter than a jump"; continue; }
+                if (targetInside(siteStart, siteEnd)) { reason = "branch into an exit"; continue; }
+                exits.emplace_back(siteStart, siteEnd);
+            }
+        }
+        if (!leaf || !redZone) continue;
+        ++report.RedZoneFunctions;
+        const auto prologueEnd = p > 0 ? body[p - 1].Offset + body[p - 1].Length : start;
+        if (reason == nullptr && ((pushed.empty() && allocation == 0) || prologueEnd - start < kJumpBytes)) reason = "prologue shorter than a jump";
+        if (reason == nullptr && targetInside(start, prologueEnd)) reason = "branch into the prologue";
+        if (reason == nullptr && exits.empty()) reason = "no ret exit";
+        if (reason == nullptr && (overlapsExisting(start, prologueEnd) || std::any_of(exits.begin(), exits.end(), [&](const auto& exit) { return overlapsExisting(exit.first, exit.second); }))) reason = "overlaps another stub";
+        std::vector<OperandStub> stubs;
+        const auto overlapsSite = [&](const std::size_t begin, const std::size_t end) {
+            if (begin < prologueEnd && start < end) return true;
+            if (std::any_of(exits.begin(), exits.end(), [&](const auto& exit) { return begin < exit.second && exit.first < end; })) return true;
+            return std::any_of(stubs.begin(), stubs.end(), [&](const OperandStub& stub) { return begin < stub.End && stub.Begin < end; });
+        };
+        for (const auto k : stubbed) {
+            if (reason != nullptr) break;
+            if (!stubs.empty() && k < stubs.back().Last) continue;
+            OperandStub stub{k, k, body[k].Offset, body[k].Offset, {}};
+            while (stub.Last < body.size() && stub.End - stub.Begin < kJumpBytes) {
+                const auto& covered = body[stub.Last];
+                if (covered.Offset != stub.End || covered.Info.FlowKind != ControlFlowKind::Sequential || covered.Info.HasRipRelativeDisp || frees.contains(stub.Last)) break;
+                const auto use = memoryUse(at(stub.Last), covered);
+                const auto bytes = use.RspBased ? withDisplacement(at(stub.Last), covered, use, use.RspDisp + shift) : std::vector<std::uint8_t>(at(stub.Last), at(stub.Last) + covered.Length);
+                if (!bytes) break;
+                stub.Body.insert(stub.Body.end(), bytes->begin(), bytes->end());
+                if (use.RspBased) ++stub.Operands;
+                stub.End += covered.Length;
+                ++stub.Last;
+            }
+            while (stub.End - stub.Begin < kJumpBytes && stub.First > p) {
+                const auto j = stub.First - 1;
+                const auto& prior = body[j];
+                if (prior.Offset + prior.Length != stub.Begin || prior.Info.FlowKind != ControlFlowKind::Sequential || prior.Info.HasRipRelativeDisp || frees.contains(j)) break;
+                const auto use = memoryUse(at(j), prior);
+                const auto bytes = use.RspBased ? withDisplacement(at(j), prior, use, use.RspDisp + shift) : std::vector<std::uint8_t>(at(j), at(j) + prior.Length);
+                if (!bytes) break;
+                stub.Body.insert(stub.Body.begin(), bytes->begin(), bytes->end());
+                if (use.RspBased) ++stub.Operands;
+                stub.Begin = prior.Offset;
+                stub.First = j;
+            }
+            if (stub.End - stub.Begin < kJumpBytes || targetInside(stub.Begin, stub.End) || overlapsSite(stub.Begin, stub.End) || overlapsExisting(stub.Begin, stub.End)) reason = "rsp operand that cannot move and has no room for a stub";
+            else stubs.push_back(std::move(stub));
+        }
+        if (reason != nullptr) { skip(reason); continue; }
+        for (const auto& stub : stubs)
+            for (auto k = stub.First; k < stub.Last; ++k) moves.erase(k);
+
+        const auto addSite = [&](const std::size_t begin, const std::size_t end, std::vector<std::uint8_t> code) {
+            TrampolineSite site;
+            site.Offset = ph.Offset + begin;
+            site.Address = ph.MappedAddress + begin;
+            site.Length = end - begin;
+            site.OriginalBytes.assign(seg.begin() + static_cast<std::ptrdiff_t>(begin), seg.begin() + static_cast<std::ptrdiff_t>(end));
+            site.ReturnBranchOffset = code.size();
+            code.insert(code.end(), std::begin(kJumpBack), std::end(kJumpBack));
+            site.Body = std::move(code);
+            taken.emplace_back(begin, end);
+            sites.push_back(std::move(site));
+        };
+        const auto original = [&](const std::size_t begin, const std::size_t end) { return std::vector<std::uint8_t>(seg.begin() + static_cast<std::ptrdiff_t>(begin), seg.begin() + static_cast<std::ptrdiff_t>(end)); };
+        auto entry = original(start, prologueEnd);
+        const auto lower = lowerRsp(shift);
+        entry.insert(entry.end(), lower.begin(), lower.end());
+        addSite(start, prologueEnd, std::move(entry));
+        for (const auto& exit : exits) {
+            auto code = raiseRsp(shift);
+            const auto tail = original(exit.first, exit.second);
+            code.insert(code.end(), tail.begin(), tail.end());
+            addSite(exit.first, exit.second, std::move(code));
+        }
+        for (auto& stub : stubs) addSite(stub.Begin, stub.End, std::move(stub.Body));
+        for (auto& [k, move] : moves) displacements.push_back({ph.Offset + move.first, std::move(move.second)});
+        ++report.Framed;
+        if (!rbpPrologue) ++report.FramedWithoutFramePointer;
+        report.Exits += exits.size();
+        report.MovedOperands += moves.size();
+        report.OperandStubs += stubs.size();
+        for (const auto& stub : stubs) report.StubbedOperands += stub.Operands;
+    }
+}
+
+}
+
+std::vector<TrampolineSite> FrameRedZoneFunctions(
+    const std::vector<std::uint8_t>& fileBytes,
+    const std::vector<Domain::ProgramHeader>& codeSegments,
+    const std::vector<RedZoneFunction>& functions,
+    const std::vector<TrampolineSite>& existing,
+    RedZoneFrameReport& report,
+    std::vector<RedZoneDisplacement>& displacements
+) {
+    std::vector<TrampolineSite> sites;
+    for (const auto& ph : codeSegments) frameSegment(fileBytes, ph, functions, existing, sites, displacements, report);
+    return sites;
+}
+
+}
diff --git a/core/relinker/codegen/src/x86/Sha1Operands.cpp b/core/relinker/codegen/src/x86/Sha1Operands.cpp
index 69ea10a68a..aa49ed27d5 100644
--- a/core/relinker/codegen/src/x86/Sha1Operands.cpp
+++ b/core/relinker/codegen/src/x86/Sha1Operands.cpp
@@ -20,16 +20,18 @@ Sha1Operands DecodeSha1(const std::uint8_t* data, const std::size_t length) {
             pos += 1;
             continue;
         }
+        if (b == PrefixLock) {
+            throw CodegenException("SHA-1 instruction with a LOCK prefix");
+        }
         if (b == PrefixOperandSize || b == PrefixRepne || b == PrefixRep) {
             throw CodegenException("Not a SHA-1 instruction");
         }
-        if (b != PrefixLock && b != PrefixAddressSize &&
+        if (b != PrefixAddressSize &&
             b != PrefixSegCs && b != PrefixSegSs && b != PrefixSegDs &&
             b != PrefixSegEs && b != PrefixSegFs && b != PrefixSegGs) {
             break;
         }
-        if (b != PrefixLock)
-            prefixes.push_back(b);
+        prefixes.push_back(b);
         rex = 0;
         pos += 1;
     }
diff --git a/core/relinker/codegen/src/x86/Sha256Operands.cpp b/core/relinker/codegen/src/x86/Sha256Operands.cpp
index a090514a15..51af8ec376 100644
--- a/core/relinker/codegen/src/x86/Sha256Operands.cpp
+++ b/core/relinker/codegen/src/x86/Sha256Operands.cpp
@@ -20,16 +20,18 @@ Sha256Operands DecodeSha256(const std::uint8_t* data, const std::size_t length)
             pos += 1;
             continue;
         }
+        if (b == PrefixLock) {
+            throw CodegenException("SHA-256 instruction with a LOCK prefix");
+        }
         if (b == PrefixOperandSize || b == PrefixRepne || b == PrefixRep) {
             throw CodegenException("Not a SHA-256 instruction");
         }
-        if (b != PrefixLock && b != PrefixAddressSize &&
+        if (b != PrefixAddressSize &&
             b != PrefixSegCs && b != PrefixSegSs && b != PrefixSegDs &&
             b != PrefixSegEs && b != PrefixSegFs && b != PrefixSegGs) {
             break;
         }
-        if (b != PrefixLock)
-            prefixes.push_back(b);
+        prefixes.push_back(b);
         rex = 0;
         pos += 1;
     }
diff --git a/core/relinker/codegen/src/x86/Sse4aOperands.cpp b/core/relinker/codegen/src/x86/Sse4aOperands.cpp
index cf492728c2..2a664f1140 100644
--- a/core/relinker/codegen/src/x86/Sse4aOperands.cpp
+++ b/core/relinker/codegen/src/x86/Sse4aOperands.cpp
@@ -19,11 +19,14 @@ Sse4aOperands DecodeSse4a(const std::uint8_t* data, const std::size_t length) {
             pos += 1;
             continue;
         }
+        if (b == PrefixLock) {
+            throw CodegenException("SSE4a instruction with a LOCK prefix");
+        }
         if (b == PrefixOperandSize) {
             operandSizeOverride = true;
         } else if (b == PrefixRepne) {
             repnePrefix = true;
-        } else if (b != PrefixLock && b != PrefixRep && b != PrefixAddressSize &&
+        } else if (b != PrefixRep && b != PrefixAddressSize &&
                    b != PrefixSegCs && b != PrefixSegSs && b != PrefixSegDs &&
                    b != PrefixSegEs && b != PrefixSegFs && b != PrefixSegGs) {
             break;
diff --git a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
index b22c3f8726..78936363b4 100644
--- a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
@@ -393,6 +393,7 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
         const std::uint8_t modrm = data[modrmPos];
         info.HasModRm = true;
         info.ModRmByte = modrm;
+        info.ModRmOffset = modrmPos;
         info.ModRmRegField = (modrm >> ModRmRegShift) & ModRmRegMask;
         const std::uint8_t mod = registerOnly ? ModRmModRegister : (modrm >> ModRmModShift) & ModRmModMask;
         const std::uint8_t rm = modrm & ModRmRmMask;
@@ -489,6 +490,7 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
             std::uint8_t modrm = data[pos];
             info.HasModRm = true;
             info.ModRmByte = modrm;
+            info.ModRmOffset = pos;
             std::uint8_t reg = (modrm >> ModRmRegShift) & ModRmRegMask;
             info.ModRmRegField = reg;
             std::uint8_t mod = (modrm >> ModRmModShift) & ModRmModMask;
@@ -622,6 +624,9 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
                            (op >= 0xaa && op <= 0xaf) || op == 0xd7))
         info.HasMemoryOperand = true;
 
+    if ((!twoByteOpcode && op == OneByteLea) || (twoByteOpcode && op == TwoByteNopModRm))
+        info.HasMemoryOperand = false;
+
     info.FlowKind = ControlFlowKind::Sequential;
     return info;
 }
diff --git a/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp b/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp
index 212bdaee22..e17dde61e9 100644
--- a/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp
@@ -54,6 +54,12 @@ std::int64_t X64InstructionRewriter::AdjustedDelta(
     std::int64_t sliceSize,
     std::int64_t delta
 ) {
+    const bool targetInsideCut = targetPosition > cutStart && targetPosition < cutEnd;
+
+    if (targetInsideCut) {
+        throw CodegenException("Branch target inside rewritten instruction", static_cast<Domain::FileByteOffset>(instrPosition));
+    }
+
     const bool instrShifts = instrPosition >= cutEnd && instrPosition < sliceSize;
     const bool targetShifts = targetPosition >= cutEnd && targetPosition < sliceSize;
 
@@ -96,6 +102,66 @@ RewriteResult X64InstructionRewriter::Rewrite(
     const auto cutStart = static_cast<std::int64_t>(offset);
     const std::int64_t cutEnd = cutStart + oldLength;
 
+    if (delta != 0) {
+        const auto sectionSize = static_cast<std::int64_t>(codeSection.size());
+
+        for (const auto& match : matches) {
+            const auto matchOffset = static_cast<std::int64_t>(match.Offset);
+            if (matchOffset >= cutStart && matchOffset < cutEnd)
+                continue;
+
+            const auto info = decoder.DecodeInstruction(
+                codeSection.data() + match.Offset, match.Length);
+
+            if (!info.TruncatesBranchTarget)
+                continue;
+
+            const auto opcodeLength = info.IsTwoByteOpcode ? 2u : 1u;
+            const auto displacementSize =
+                info.Length - info.OpcodeOffset - opcodeLength;
+            const auto displacementOffset =
+                match.Offset + info.Length - displacementSize;
+
+            std::int64_t branchDisplacement = 0;
+
+            if (displacementSize == 1) {
+                branchDisplacement =
+                    static_cast<std::int8_t>(codeSection[displacementOffset]);
+            } else if (displacementSize == 2) {
+                const auto raw = static_cast<std::uint16_t>(
+                    static_cast<std::uint16_t>(codeSection[displacementOffset]) |
+                    (static_cast<std::uint16_t>(
+                        codeSection[displacementOffset + 1]) << 8));
+                branchDisplacement = static_cast<std::int16_t>(raw);
+            } else {
+                throw CodegenException(
+                    "Unexpected displacement size for truncated relative branch",
+                    match.Offset);
+            }
+
+            const auto rawTargetPosition =
+                matchOffset + static_cast<std::int64_t>(info.Length)
+                + branchDisplacement;
+            if (rawTargetPosition < 0 || rawTargetPosition > 0xFFFF) {
+                throw CodegenException(
+                    "Cannot change code length while a truncated relative branch target wraps at 16 bits",
+                    match.Offset);
+            }
+            const auto targetPosition = rawTargetPosition;
+
+            const bool instrShifts =
+                matchOffset >= cutEnd && matchOffset < sectionSize;
+            const bool targetShifts =
+                targetPosition >= cutEnd && targetPosition < sectionSize;
+
+            if (instrShifts != targetShifts) {
+                throw CodegenException(
+                    "Cannot change code length while a truncated relative branch moves",
+                    match.Offset);
+            }
+        }
+    }
+
     std::vector<std::uint8_t> rewritten;
     rewritten.reserve(codeSection.size() + static_cast<std::size_t>(delta > 0 ? delta : 0));
     rewritten.insert(rewritten.end(), codeSection.begin(), codeSection.begin() + offset);
diff --git a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
index a03384cea7..998fc11443 100644
--- a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
+++ b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
@@ -21,7 +21,9 @@
 #include <elfpatcher/general/SegmentFilter.hpp>
 #include <elfpatcher/linux/LinuxElfPatcher.hpp>
 #include <io/ByteWriter.hpp>
+#include <algorithm>
 #include <array>
+#include <bit>
 #include <cmath>
 #include <cstring>
 #include <cstdint>
@@ -207,6 +209,8 @@ void decoderTwoByteOpcodeLengths() {
 }
 
 void sse4aOperands() {
+    requireFailure([] { const Bytes bytes = {0xF0, 0x66, 0x0F, 0x78, 0xC0, 0x08, 0x00}; (void)Codegen::DecodeSse4a(bytes.data(), bytes.size()); }, "LOCK EXTRQ was accepted");
+    requireFailure([] { const Bytes bytes = {0xF2, 0xF0, 0x0F, 0x79, 0xC1}; (void)Codegen::DecodeSse4a(bytes.data(), bytes.size()); }, "LOCK INSERTQ was accepted");
     const auto check = [](const Bytes& site, const bool insertq, const int dst, const int src, const int length, const int index) {
         const auto operands = Codegen::DecodeSse4a(site.data(), site.size());
         require(operands.Insertq == insertq && !operands.RegisterForm && operands.Destination == dst && operands.Source == src && operands.Length == length && operands.Index == index, "SSE4a operands were decoded incorrectly");
@@ -230,6 +234,8 @@ void sse4aOperands() {
 }
 
 void sha256Operands() {
+    requireFailure([] { const Bytes bytes = {0xF0, 0x0F, 0x38, 0xCB, 0xCA}; (void)Codegen::DecodeSha256(bytes.data(), bytes.size()); }, "LOCK SHA256RNDS2 was accepted");
+    requireFailure([] { const Bytes bytes = {0x2E, 0xF0, 0x0F, 0x38, 0xCC, 0x08}; (void)Codegen::DecodeSha256(bytes.data(), bytes.size()); }, "LOCK SHA256MSG1 memory form was accepted");
     const auto check = [](const Bytes& site, const Codegen::Sha256Operation operation, const int dst, const int src) {
         const auto operands = Codegen::DecodeSha256(site.data(), site.size());
         require(operands.Operation == operation && operands.Destination == dst && operands.Source == src, "SHA-256 operands were decoded incorrectly");
@@ -260,6 +266,8 @@ void sha256Operands() {
 }
 
 void sha1Operands() {
+    requireFailure([] { const Bytes bytes = {0xF0, 0x0F, 0x3A, 0xCC, 0xCA, 0x00}; (void)Codegen::DecodeSha1(bytes.data(), bytes.size()); }, "LOCK SHA1RNDS4 was accepted");
+    requireFailure([] { const Bytes bytes = {0x2E, 0xF0, 0x0F, 0x38, 0xC9, 0x08}; (void)Codegen::DecodeSha1(bytes.data(), bytes.size()); }, "LOCK SHA1MSG1 memory form was accepted");
     const auto check = [](const Bytes& site, const Codegen::Sha1Operation operation, const int dst, const int src, const int function) {
         const auto operands = Codegen::DecodeSha1(site.data(), site.size());
         require(operands.Operation == operation && operands.Destination == dst && operands.Source == src && operands.Function == function, "SHA-1 operands were decoded incorrectly");
@@ -321,6 +329,8 @@ void matcherSubstitutions() {
     const auto movntsd = match({0xF2, 0x44, 0x0F, 0x2B, 0x4C, 0x24, 0x10});
     require(movntsd && movntsd->Lowering == Codegen::Amd64OnlyLowering::InPlace && movntsd->ReplacementBytes == Bytes{0xF2, 0x44, 0x0F, 0x11, 0x4C, 0x24, 0x10} && movntsd->InstructionName == "MOVNTSD", "MOVNTSD was not rewritten to MOVSD");
     requireFailure([&] { (void)match({0xF3, 0x0F, 0x2B, 0xC1}); }, "MOVNTSS with a register operand was accepted");
+    const auto movntssDisplacement = match({0xF3, 0x0F, 0x2B, 0x47, 0xF0});
+    require(movntssDisplacement && movntssDisplacement->ReplacementBytes == Bytes{0xF3, 0x0F, 0x11, 0x47, 0xF0}, "MOVNTSS displacement byte was treated as a LOCK prefix");
     const auto monitorx = match({0x0F, 0x01, 0xFA});
     require(monitorx && monitorx->Lowering == Codegen::Amd64OnlyLowering::InPlace && monitorx->ReplacementBytes == Bytes{0x0F, 0x1F, 0x00} && monitorx->InstructionName == "MONITORX", "MONITORX was not replaced by a NOP");
     const auto mwaitx = match({0x0F, 0x01, 0xFB});
@@ -505,6 +515,13 @@ void converterSegment() {
     lockedRdpru[0x211] = 0x01;
     lockedRdpru[0x212] = 0xFD;
     requireFailure([&] { (void)converter->Convert(lockedRdpru, {segmentHeader(20)}); }, "LOCK RDPRU was accepted");
+    for (const Bytes& instruction : {Bytes{0xF0, 0xF3, 0x0F, 0x2B, 0x07}, Bytes{0xF3, 0xF0, 0x0F, 0x2B, 0x07},
+                                     Bytes{0xF0, 0xF2, 0x0F, 0x2B, 0x07}, Bytes{0xF2, 0xF0, 0x0F, 0x2B, 0x07}}) {
+        auto lockedMovnts = file;
+        std::copy(instruction.begin(), instruction.end(), lockedMovnts.begin() + 0x20F);
+        lockedMovnts[0x214] = 0xC3;
+        require(failureOffset([&] { (void)converter->Convert(lockedMovnts, {segmentHeader(21)}); }, "LOCK MOVNTSS/MOVNTSD was accepted") == 0x20F, "LOCK MOVNTSS/MOVNTSD failure does not carry the file offset");
+    }
     auto registerForm = file;
     const Bytes extrqRegister = {0x66, 0x0F, 0x79, 0xCA};
     std::copy(extrqRegister.begin(), extrqRegister.end(), registerForm.begin() + 0x20F);
@@ -560,6 +577,9 @@ void converterSha256() {
         0x90,
         0xC3};
     std::copy(text.begin(), text.end(), file.begin() + 0x200);
+    auto locked = file;
+    locked.insert(locked.begin() + 0x200, 0xF0);
+    require(failureOffset([&] { (void)converter->Convert(locked, {segmentHeader(text.size() + 1)}); }, "LOCK SHA-256 was accepted") == 0x200, "LOCK SHA-256 failure does not carry the file offset");
     const auto result = converter->Convert(file, {segmentHeader(text.size())});
     require(result.Trampolines.size() == 2 && result.Reports.size() == 2 && result.Bytes == file, "SHA-256 sites were not lowered through stubs");
     const auto& rounds = result.Trampolines[0];
@@ -595,6 +615,9 @@ void converterSha1() {
         0x90,
         0xC3};
     std::copy(text.begin(), text.end(), file.begin() + 0x200);
+    auto locked = file;
+    locked.insert(locked.begin() + 0x200, 0xF0);
+    require(failureOffset([&] { (void)converter->Convert(locked, {segmentHeader(text.size() + 1)}); }, "LOCK SHA-1 was accepted") == 0x200, "LOCK SHA-1 failure does not carry the file offset");
     const auto result = converter->Convert(file, {segmentHeader(text.size())});
     require(result.Trampolines.size() == 3 && result.Reports.size() == 3 && result.Bytes == file, "SHA-1 sites were not lowered through stubs");
     require(result.Trampolines[0].Offset == 0x200 && result.Trampolines[0].Length == 5 && result.Reports[0].InstructionName == "SHA1RNDS4", "SHA1RNDS4 was not lowered as one site");
@@ -689,8 +712,8 @@ void rosettaSubstitutions() {
     const auto intel = Codegen::MakeAmd64OnlyInstructionMatcher();
     const auto rosetta = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
     const auto match = [](const auto& matcher, const Bytes& bytes) { return matcher->Match(bytes.data(), bytes.size()); };
-    for (const auto& bytes : {Bytes{0x0F, 0xC7, 0xF8}, Bytes{0xF3, 0x0F, 0xC7, 0xF8}, Bytes{0x66, 0x0F, 0xAE, 0x30}, Bytes{0x0F, 0x01, 0xF9}})
-        require(!match(intel, bytes).has_value(), "RDSEED, RDPID, CLWB or RDTSCP was converted for an Intel host");
+    for (const auto& bytes : {Bytes{0x0F, 0xC7, 0xF8}, Bytes{0xF3, 0x0F, 0xC7, 0xF8}, Bytes{0x66, 0x0F, 0xAE, 0x30}, Bytes{0x0F, 0x01, 0xF9}, Bytes{0x0F, 0xAE, 0x37}})
+        require(!match(intel, bytes).has_value(), "RDSEED, RDPID, CLWB, RDTSCP or XSAVEOPT was converted for an Intel host");
     const auto rdseed = match(rosetta, {0x48, 0x0F, 0xC7, 0xF9});
     require(rdseed && rdseed->Lowering == Amd64OnlyLowering::InPlace && rdseed->ReplacementBytes == Bytes{0x48, 0x0F, 0xC7, 0xF1} && rdseed->InstructionName == "RDSEED", "RDSEED was not rewritten to RDRAND");
     const auto rdseed16 = match(rosetta, {0x66, 0x41, 0x0F, 0xC7, 0xFA});
@@ -700,6 +723,18 @@ void rosettaSubstitutions() {
     require(clwb && clwb->Lowering == Amd64OnlyLowering::InPlace && clwb->ReplacementBytes == Bytes{0x66, 0x0F, 0x1F, 0x44, 0x00, 0x00} && clwb->InstructionName == "CLWB", "CLWB was not replaced by a NOP");
     require(!match(rosetta, {0x66, 0x0F, 0xAE, 0xF1}).has_value(), "TPAUSE (the register form of 66 0F AE /6) was taken for CLWB");
     require(!match(rosetta, {0x66, 0x0F, 0xAE, 0x38}).has_value(), "CLFLUSHOPT was taken for CLWB");
+    const auto xsaveopt = match(rosetta, {0x0F, 0xAE, 0x37});
+    require(xsaveopt && xsaveopt->Lowering == Amd64OnlyLowering::InPlace && xsaveopt->ReplacementBytes == Bytes{0x0F, 0xAE, 0x27} && xsaveopt->InstructionName == "XSAVEOPT", "XSAVEOPT was not rewritten to XSAVE");
+    const auto xsaveopt64 = match(rosetta, {0x48, 0x0F, 0xAE, 0x74, 0x24, 0x40});
+    require(xsaveopt64 && xsaveopt64->ReplacementBytes == Bytes{0x48, 0x0F, 0xAE, 0x64, 0x24, 0x40}, "XSAVEOPT64 with an RSP-relative operand was not rewritten to XSAVE64");
+    const auto xsaveoptR12 = match(rosetta, {0x41, 0x0F, 0xAE, 0x34, 0x24});
+    require(xsaveoptR12 && xsaveoptR12->ReplacementBytes == Bytes{0x41, 0x0F, 0xAE, 0x24, 0x24}, "XSAVEOPT with an extended base register was not rewritten to XSAVE");
+    const auto xsaveoptRip = match(rosetta, {0x0F, 0xAE, 0x35, 0x00, 0x01, 0x00, 0x00});
+    require(xsaveoptRip && xsaveoptRip->ReplacementBytes == Bytes{0x0F, 0xAE, 0x25, 0x00, 0x01, 0x00, 0x00}, "RIP-relative XSAVEOPT was not rewritten to XSAVE with the same displacement");
+    const auto xsaveoptFs = match(rosetta, {0x64, 0x0F, 0xAE, 0x34, 0x25, 0x40, 0x00, 0x00, 0x00});
+    require(xsaveoptFs && xsaveoptFs->ReplacementBytes == Bytes{0x64, 0x0F, 0xAE, 0x24, 0x25, 0x40, 0x00, 0x00, 0x00}, "FS-relative XSAVEOPT was not rewritten to XSAVE");
+    for (const auto& other : {Bytes{0x0F, 0xAE, 0x27}, Bytes{0x0F, 0xAE, 0x2F}, Bytes{0x0F, 0xAE, 0x3F}, Bytes{0x0F, 0xAE, 0xF0}, Bytes{0xF3, 0x0F, 0xAE, 0xF0}, Bytes{0xF2, 0x0F, 0xAE, 0xF1}, Bytes{0xF3, 0x0F, 0xAE, 0x37}})
+        require(!match(rosetta, other).has_value(), "XSAVE, XRSTOR, CLFLUSH, MFENCE, UMONITOR, UMWAIT or a prefixed 0F AE /6 was taken for XSAVEOPT");
     const auto rdpid = match(rosetta, {0xF3, 0x41, 0x0F, 0xC7, 0xFB});
     require(rdpid && rdpid->Lowering == Amd64OnlyLowering::Trampoline && rdpid->Optional && rdpid->InstructionName == "RDPID", "RDPID was not lowered through an optional stub");
     require(rdpid->ReturnBranchOffset == 6 && Bytes(rdpid->StubBody.begin(), rdpid->StubBody.begin() + 7) == Bytes{0x41, 0xBB, 0, 0, 0, 0, 0xE9}, "RDPID r11 stub does not load 0 before returning");
@@ -836,6 +871,21 @@ void converterWideStoreWindows() {
     expected.insert(expected.end(), {0xC5, 0xF8, 0x11, 0x0E, 0xC4, 0xE3, 0x7D, 0x19, 0x4E, 0x10, 0x01});
     require(paired.Trampolines.size() == 1 && paired.Trampolines[0].Length == 8 && body(paired.Trampolines[0]) == expected && paired.Reports.size() == 1, "A 256-bit store followed by another was not lowered with it in one stub");
 
+    const auto withRdseed = convert(withStore({}, {0x0F, 0xC7, 0xF8, 0xC3}));
+    expected = halves;
+    expected.insert(expected.end(), {0x0F, 0xC7, 0xF0});
+    require(withRdseed.Trampolines.size() == 1 && withRdseed.Trampolines[0].Length == 7 && body(withRdseed.Trampolines[0]) == expected && withRdseed.Reports.size() == 1, "A 256-bit store followed by an in-place site did not move its replacement into the stub");
+
+    const auto withClwb = convert(withStore({}, {0x66, 0x0F, 0xAE, 0x37, 0xC3}));
+    expected = halves;
+    expected.insert(expected.end(), {0x0F, 0x1F, 0x40, 0x00});
+    require(withClwb.Trampolines.size() == 1 && withClwb.Trampolines[0].Length == 8 && body(withClwb.Trampolines[0]) == expected, "A 256-bit store followed by CLWB did not move its replacement into the stub");
+
+    const auto withRipStore = convert(withStore({}, {0xF3, 0x0F, 0x2B, 0x05, 0x40, 0x00, 0x00, 0x00, 0xC3}));
+    expected = halves;
+    expected.insert(expected.end(), {0xF3, 0x0F, 0x11, 0x05, 0x00, 0x00, 0x00, 0x00});
+    require(withRipStore.Trampolines.size() == 1 && withRipStore.Trampolines[0].Length == 12 && body(withRipStore.Trampolines[0]) == expected && withRipStore.Trampolines[0].Relocations.size() == 1 && withRipStore.Trampolines[0].Relocations[0].SiteTarget == 0x4C && withRipStore.Trampolines[0].Relocations[0].InstructionEnd == 19, "A 256-bit store followed by a RIP-relative in-place site did not relocate its replacement");
+
     const Bytes push = {0x48, 0x8D, 0x64, 0x24, 0xF8, 0x50, 0x48, 0x8D, 0x05, 0, 0, 0, 0, 0x48, 0x89, 0x44, 0x24, 0x08, 0x58};
     const auto ripCalled = convert(withStore({}, {0xFF, 0x15, 0x10, 0x00, 0x00, 0x00}));
     expected = halves;
@@ -1958,6 +2008,203 @@ void mcommitExecution() {
     }
     munmap(code, 4096);
 }
+
+void wideStoreExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0xC5, 0xFC, 0x11, 0x00};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline, "256-bit store stub was not produced");
+    auto body = match->StubBody;
+    body[match->ReturnBranchOffset] = 0xC3;
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the stub");
+    std::memcpy(code, body.data(), body.size());
+    alignas(32) std::uint8_t source[32];
+    for (std::size_t index = 0; index < sizeof(source); ++index) source[index] = static_cast<std::uint8_t>(index + 1);
+    auto* pages = static_cast<std::uint8_t*>(mmap(nullptr, 8192, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+    require(pages != MAP_FAILED, "cannot map the destination pages");
+    for (const std::size_t offset : {std::size_t{0}, std::size_t{1}, std::size_t{4080}}) {
+        std::memset(pages, 0, 8192);
+        auto* destination = pages + offset;
+        asm volatile(
+            "vmovups (%[source]), %%ymm0\n\t"
+            "sub $128, %%rsp\n\t"
+            "call *%[code]\n\t"
+            "add $128, %%rsp\n\t"
+            :
+            : [source] "r"(source), [code] "r"(code), "a"(destination)
+            : "memory", "ymm0");
+        require(std::memcmp(destination, source, sizeof(source)) == 0, "256-bit store stub did not write both halves");
+        require(std::all_of(pages, destination, [](const std::uint8_t value) { return value == 0; }), "256-bit store stub wrote before its operand");
+        require(std::all_of(destination + sizeof(source), pages + 8192, [](const std::uint8_t value) { return value == 0; }),
+                "256-bit store stub wrote past its operand");
+    }
+    munmap(pages, 8192);
+    munmap(code, 4096);
+}
+
+void xsaveoptExecution() {
+    const Bytes site = {0x48, 0x0F, 0xAE, 0x37};
+    const auto match = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta)->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::InPlace, "XSAVEOPT64 was not rewritten in place");
+    auto body = match->ReplacementBytes;
+    body.push_back(0xC3);
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the XSAVEOPT replacement");
+    std::memcpy(code, body.data(), body.size());
+    alignas(64) std::uint8_t area[1024] = {};
+    alignas(32) std::uint8_t pattern[32];
+    alignas(32) std::uint8_t restored[32] = {};
+    for (std::size_t i = 0; i < sizeof(pattern); ++i)
+        pattern[i] = static_cast<std::uint8_t>(0xA0 + i);
+    asm volatile(
+        "vmovdqu (%[pattern]), %%ymm3\n\t"
+        "mov %[area], %%rdi\n\t"
+        "mov $7, %%eax\n\t"
+        "xor %%edx, %%edx\n\t"
+        "sub $128, %%rsp\n\t"
+        "call *%[code]\n\t"
+        "add $128, %%rsp\n\t"
+        "vpxor %%ymm3, %%ymm3, %%ymm3\n\t"
+        "mov $7, %%eax\n\t"
+        "xor %%edx, %%edx\n\t"
+        "xrstor64 (%%rdi)\n\t"
+        "vmovdqu %%ymm3, (%[restored])\n\t"
+        "vzeroupper\n\t"
+        :
+        : [pattern] "r"(pattern), [area] "r"(area), [code] "r"(code), [restored] "r"(restored)
+        : "rax", "rdx", "rdi", "xmm3", "memory");
+    munmap(code, 4096);
+    std::uint64_t components = 0;
+    std::memcpy(&components, area + 512, sizeof(components));
+    require((components & 6) == 6, "XSAVE did not mark the SSE and AVX state as saved");
+    require(std::memcmp(area + 160 + 3 * 16, pattern, 16) == 0 && std::memcmp(area + 576 + 3 * 16, pattern + 16, 16) == 0, "XSAVE did not store YMM3 in the standard format");
+    require(std::memcmp(restored, pattern, sizeof(pattern)) == 0, "XRSTOR did not restore YMM3 from the area XSAVE wrote");
+}
+
+void scalarCompareExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0xF3, 0x0F, 0xC2, 0xC1, 0x05};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline, "scalar compare stub was not produced");
+    auto body = match->StubBody;
+    body[match->ReturnBranchOffset] = 0xC3;
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the stub");
+    std::memcpy(code, body.data(), body.size());
+    struct Case {
+        float left;
+        float right;
+        std::uint32_t mask;
+        const char* name;
+    };
+    for (const auto& item : std::vector<Case>{{309.0f, 309.0f, 0xFFFFFFFFu, "309 is not less than 309"},
+                                              {309.0f, 310.0f, 0u, "309 is less than 310"}}) {
+        alignas(16) float left[4] = {item.left, 1.0f, 2.0f, 3.0f};
+        alignas(16) float right[4] = {item.right, 0.0f, 0.0f, 0.0f};
+        alignas(16) std::uint32_t result[4] = {};
+        asm volatile(
+            "movaps (%[left]), %%xmm0\n\t"
+            "movaps (%[right]), %%xmm1\n\t"
+            "sub $128, %%rsp\n\t"
+            "call *%[code]\n\t"
+            "add $128, %%rsp\n\t"
+            "movaps %%xmm0, (%[result])\n\t"
+            :
+            : [left] "r"(left), [right] "r"(right), [result] "r"(result), [code] "r"(code)
+            : "memory", "xmm0", "xmm1");
+        require(result[0] == item.mask, item.name);
+        require(result[1] == std::bit_cast<std::uint32_t>(1.0f) && result[2] == std::bit_cast<std::uint32_t>(2.0f)
+                    && result[3] == std::bit_cast<std::uint32_t>(3.0f),
+                "scalar compare stub changed the upper lanes of its destination");
+    }
+    munmap(code, 4096);
+}
+
+void rdpidExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0xF3, 0x0F, 0xC7, 0xF8};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline, "RDPID stub was not produced");
+    auto body = match->StubBody;
+    body[match->ReturnBranchOffset] = 0xC3;
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the stub");
+    std::memcpy(code, body.data(), body.size());
+    std::uint64_t processor = ~std::uint64_t{0};
+    std::uint8_t carry = 0;
+    asm volatile(
+        "sub $128, %%rsp\n\t"
+        "stc\n\t"
+        "call *%[code]\n\t"
+        "setc %[carry]\n\t"
+        "add $128, %%rsp\n\t"
+        : "=&a"(processor), [carry] "=&q"(carry)
+        : [code] "r"(code)
+        : "memory", "cc");
+    munmap(code, 4096);
+    require(processor == 0, "RDPID stub left a value other than processor 0 in RAX");
+    require(carry == 1, "RDPID stub changed the flags");
+}
+
+void rdseedExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0x0F, 0xC7, 0xF8};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::InPlace, "RDSEED replacement was not produced");
+    require(match->ReplacementBytes.size() == site.size(), "RDSEED replacement changed the instruction length");
+    auto body = match->ReplacementBytes;
+    body.push_back(0xC3);
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the replacement");
+    std::memcpy(code, body.data(), body.size());
+    bool produced = false;
+    for (unsigned attempt = 0; attempt < 16 && !produced; ++attempt) {
+        std::uint64_t value = 0;
+        std::uint8_t carry = 0;
+        asm volatile(
+            "sub $128, %%rsp\n\t"
+            "call *%[code]\n\t"
+            "setc %[carry]\n\t"
+            "add $128, %%rsp\n\t"
+            : "=&a"(value), [carry] "=&q"(carry)
+            : [code] "r"(code)
+            : "memory", "cc");
+        produced = carry == 1;
+    }
+    munmap(code, 4096);
+    require(produced, "RDSEED replacement never reported a random value");
+}
+
+void clwbExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0x66, 0x0F, 0xAE, 0x30};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::InPlace, "CLWB replacement was not produced");
+    require(match->ReplacementBytes.size() == site.size(), "CLWB replacement changed the instruction length");
+    auto body = match->ReplacementBytes;
+    body.push_back(0xC3);
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the replacement");
+    std::memcpy(code, body.data(), body.size());
+    std::uint8_t line[64] = {};
+    std::uint64_t address = reinterpret_cast<std::uint64_t>(line);
+    std::uint64_t kept = 0x5A5A5A5A5A5A5A5Aull;
+    std::uint8_t carry = 0;
+    asm volatile(
+        "sub $128, %%rsp\n\t"
+        "stc\n\t"
+        "call *%[code]\n\t"
+        "setc %[carry]\n\t"
+        "add $128, %%rsp\n\t"
+        : "+a"(address), "+b"(kept), [carry] "=&q"(carry)
+        : [code] "r"(code)
+        : "memory", "cc");
+    munmap(code, 4096);
+    require(address == reinterpret_cast<std::uint64_t>(line), "CLWB replacement changed its address register");
+    require(kept == 0x5A5A5A5A5A5A5A5Aull, "CLWB replacement changed an unrelated register");
+    require(carry == 1, "CLWB replacement changed the flags");
+}
 #else
 void reciprocalExecution() {}
 void registerFormExecution() {}
@@ -1968,6 +2215,7 @@ void immediateFormExecution() {}
 void ripRelativeExecution() {}
 void rdpruExecution() {}
 void mcommitExecution() {}
+void xsaveoptExecution() {}
 #endif
 
 #if defined(__x86_64__) && (defined(__linux__) || defined(__APPLE__))
@@ -2002,6 +2250,11 @@ void rdtscpExecution() {
 }
 #else
 void rdtscpExecution() {}
+void wideStoreExecution() {}
+void scalarCompareExecution() {}
+void rdpidExecution() {}
+void rdseedExecution() {}
+void clwbExecution() {}
 #endif
 
 void scannerZeroTail() {
@@ -2055,12 +2308,18 @@ int main() {
         converterInPlaceFollower();
         converterClzero();
         rosettaSubstitutions();
+        xsaveoptExecution();
         converterRosetta();
         rosettaScalarCompares();
         converterRosettaScalarCompare();
         rosettaLegacyScalarCompares();
         converterRosettaLegacyScalarCompare();
         rdtscpExecution();
+        wideStoreExecution();
+        scalarCompareExecution();
+        rdpidExecution();
+        rdseedExecution();
+        clwbExecution();
         wideStoreSplit();
         converterWideStoreWindows();
         converterClaimedFollower();
diff --git a/core/relinker/codegen/tests/DecoderLengthTests.cpp b/core/relinker/codegen/tests/DecoderLengthTests.cpp
index 3ad1299b0d..95c85168d7 100644
--- a/core/relinker/codegen/tests/DecoderLengthTests.cpp
+++ b/core/relinker/codegen/tests/DecoderLengthTests.cpp
@@ -120,6 +120,8 @@ int main() {
         for (const auto& testCase : std::vector<std::pair<const char*, bool>>{
             {"6590", false},
             {"654889c8", false},
+            {"658d0511111111", false},
+            {"650f1f0511111111", false},
             {"65488b0c2578030000", true},
             {"65a4", true},
             {"650fa2", false},
diff --git a/core/relinker/codegen/tests/MaskedStoreLoweringTests.cpp b/core/relinker/codegen/tests/MaskedStoreLoweringTests.cpp
new file mode 100644
index 0000000000..5517011feb
--- /dev/null
+++ b/core/relinker/codegen/tests/MaskedStoreLoweringTests.cpp
@@ -0,0 +1,368 @@
+#include <codegen/x86/MaskedStoreLowering.hpp>
+#include <codegen/x86/IAmd64OnlyInstructionMatcher.hpp>
+#include <codegen/CodegenException.hpp>
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <vector>
+#if (defined(__linux__) || defined(__APPLE__)) && defined(__x86_64__)
+#include <signal.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+void require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+struct Form {
+    std::uint8_t Opcode;
+    bool W;
+    const char* Name;
+    std::uint8_t ElementSize;
+};
+
+constexpr std::array kForms{
+    Form{0x2E, false, "VMASKMOVPS", 4},
+    Form{0x2F, false, "VMASKMOVPD", 8},
+    Form{0x8E, false, "VPMASKMOVD", 4},
+    Form{0x8E, true, "VPMASKMOVQ", 8},
+};
+
+Bytes maskedStore(const Form& form, bool wide, std::uint8_t mask, std::uint8_t source, std::uint8_t rexIndexBase, Bytes memory, const Bytes& prefixes = {}) {
+    Bytes bytes = prefixes;
+    bytes.insert(bytes.end(), {0xC4,
+        static_cast<std::uint8_t>(((source & 8) != 0 ? 0 : 0x80) | ((rexIndexBase & 2) != 0 ? 0 : 0x40) | ((rexIndexBase & 1) != 0 ? 0 : 0x20) | 0x02),
+        static_cast<std::uint8_t>((form.W ? 0x80 : 0) | ((~mask & 15) << 3) | (wide ? 4 : 0) | 0x01), form.Opcode});
+    memory.at(0) = static_cast<std::uint8_t>(memory[0] | ((source & 7) << 3));
+    bytes.insert(bytes.end(), memory.begin(), memory.end());
+    return bytes;
+}
+
+bool rejected(const Bytes& bytes) {
+    try {
+        (void)Codegen::DecodeMaskedStore(bytes.data(), bytes.size());
+    } catch (const Codegen::CodegenException&) {
+        return true;
+    }
+    return false;
+}
+
+void decoding() {
+    for (const auto& form : kForms) {
+        for (const bool wide : {false, true}) {
+            for (std::uint8_t mask = 0; mask < 16; ++mask) {
+                for (std::uint8_t source = 0; source < 16; ++source) {
+                    const auto bytes = maskedStore(form, wide, mask, source, 0, {0x07});
+                    const auto operands = Codegen::DecodeMaskedStore(bytes.data(), bytes.size());
+                    require(operands && std::string(operands->Name) == form.Name && operands->ElementSize == form.ElementSize && operands->Wide == wide && operands->Mask == mask, "Masked store decoding changed the form, width or mask register");
+                    require(operands->Memory.Rm == 7 && operands->Memory.Mod == 0 && operands->Memory.RexIndexBase == 0 && operands->Instruction == bytes, "Masked store decoding changed the memory operand");
+                }
+            }
+        }
+    }
+    const auto extended = maskedStore(kForms[0], true, 3, 4, 3, {0x84, 0xD1, 0x78, 0x56, 0x34, 0x12}, {0x64, 0x67});
+    const auto operands = Codegen::DecodeMaskedStore(extended.data(), extended.size());
+    require(operands && operands->Memory.RexIndexBase == 3 && operands->Memory.Sib == 0xD1 && operands->Memory.Displacement == 0x12345678 && operands->Memory.Prefixes == Bytes{0x64, 0x67}, "Masked store extensions, SIB or prefixes were lost");
+    const auto rip = maskedStore(kForms[1], false, 1, 2, 0, {0x05, 0x10, 0x00, 0x00, 0x00});
+    const auto ripOperands = Codegen::DecodeMaskedStore(rip.data(), rip.size());
+    require(ripOperands && ripOperands->Memory.RipRelative && ripOperands->DisplacementOffset == 5 && ripOperands->Memory.Displacement == 0x10, "RIP-relative masked store was not recognised");
+    const auto stack = maskedStore(kForms[2], false, 1, 2, 0, {0x44, 0x24, 0x08});
+    const auto stackOperands = Codegen::DecodeMaskedStore(stack.data(), stack.size());
+    require(stackOperands && stackOperands->Memory.StackBase && stackOperands->DisplacementOffset == 6, "RSP-based masked store was not recognised");
+    for (const auto& bytes : {
+             Bytes{0xC4, 0xE2, 0x75, 0x2C, 0x07}, Bytes{0xC4, 0xE2, 0x75, 0x2D, 0x07}, Bytes{0xC4, 0xE2, 0x75, 0x8C, 0x07},
+             Bytes{0xC4, 0xE2, 0xF5, 0x2E, 0x07}, Bytes{0xC4, 0xE2, 0xF5, 0x2F, 0x07}, Bytes{0xC4, 0xE2, 0x75, 0x2E, 0xC7},
+             Bytes{0xC4, 0xE1, 0x75, 0x2E, 0x07}, Bytes{0xC4, 0xE2, 0x74, 0x2E, 0x07}, Bytes{0xC5, 0xF5, 0x2E, 0x07},
+             Bytes{0xC4, 0xE2, 0x75, 0x2E}, Bytes{0x66, 0xC4, 0xE2, 0x75, 0x2E, 0x07}})
+        require(!Codegen::DecodeMaskedStore(bytes.data(), bytes.size()), "A load, register form, other map or prefix matched a masked store");
+    require(rejected(Bytes{0xC4, 0xE2, 0x75, 0x2E, 0x07, 0x00}), "A masked store with trailing bytes was accepted");
+    require(rejected(Bytes{0xC4, 0xE2, 0x75, 0x2E, 0x47}), "A truncated masked store was accepted");
+}
+
+void body() {
+    const auto site = maskedStore(kForms[1], false, 1, 2, 0, {0x07});
+    Codegen::StubBodyBuilder builder;
+    Codegen::EmitMaskedStore(builder, *Codegen::DecodeMaskedStore(site.data(), site.size()));
+    const auto lowered = builder.Finish();
+    const Bytes expected{
+        0x48, 0x8D, 0x64, 0x24, 0x80, 0x9C, 0x50, 0x51, 0x48, 0x8D, 0x07, 0xC4, 0xE1, 0x79, 0x50, 0xC9,
+        0xF6, 0xC1, 0x01, 0x74, 0x0A, 0xF0, 0x80, 0x48, 0x00, 0x00, 0xF0, 0x80, 0x48, 0x07, 0x00,
+        0xF6, 0xC1, 0x02, 0x74, 0x0A, 0xF0, 0x80, 0x48, 0x08, 0x00, 0xF0, 0x80, 0x48, 0x0F, 0x00,
+        0x59, 0x58, 0x9D, 0x48, 0x8D, 0xA4, 0x24, 0x80, 0x00, 0x00, 0x00, 0xC4, 0xE2, 0x71, 0x2F, 0x17};
+    require(Bytes(lowered.Bytes.begin(), lowered.Bytes.begin() + static_cast<std::ptrdiff_t>(lowered.ReturnBranchOffset)) == expected, "VMASKMOVPD stub does not probe its elements before the store");
+    const auto segment = maskedStore(kForms[0], true, 9, 2, 0, {0x44, 0x24, 0x08}, {0x64});
+    Codegen::StubBodyBuilder segmentBuilder;
+    Codegen::EmitMaskedStore(segmentBuilder, *Codegen::DecodeMaskedStore(segment.data(), segment.size()));
+    const auto segmentBody = segmentBuilder.Finish().Bytes;
+    const Bytes lea{0x64, 0x48, 0x8D, 0x84, 0x24, 0xA0, 0x00, 0x00, 0x00, 0xC4, 0xC1, 0x7C, 0x50, 0xC9};
+    require(std::search(segmentBody.begin(), segmentBody.end(), lea.begin(), lea.end()) == segmentBody.begin() + 8, "RSP-based masked store address does not skip the spill frame");
+    const Bytes probe{0x64, 0xF0, 0x80, 0x48, 0x1F, 0x00};
+    require(std::search(segmentBody.begin(), segmentBody.end(), probe.begin(), probe.end()) != segmentBody.end(), "Masked store probes lost the segment prefix");
+    const auto overflow = maskedStore(kForms[0], false, 1, 2, 0, {0x84, 0x24, 0xFF, 0xFF, 0xFF, 0x7F});
+    bool thrown = false;
+    try {
+        Codegen::StubBodyBuilder overflowBuilder;
+        Codegen::EmitMaskedStore(overflowBuilder, *Codegen::DecodeMaskedStore(overflow.data(), overflow.size()));
+    } catch (const Codegen::CodegenException&) {
+        thrown = true;
+    }
+    require(thrown, "An overflowing stack displacement was silently wrapped");
+}
+
+void matching() {
+    const auto intel = Codegen::MakeAmd64OnlyInstructionMatcher();
+    const auto rosetta = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    for (const auto& form : kForms) {
+        const auto bytes = maskedStore(form, true, 1, 0, 0, {0x00});
+        require(!intel->Match(bytes.data(), bytes.size()), "Intel mode lowered a masked store");
+        const auto match = rosetta->Match(bytes.data(), bytes.size());
+        require(match && match->InstructionName == form.Name && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline && !match->Optional, "Rosetta mode did not require a masked store trampoline");
+        const std::array<std::span<const std::uint8_t>, 2> sequence{bytes, bytes};
+        require(rosetta->MatchSequence(sequence, {}).has_value(), "A masked store sequence could not move out of line");
+    }
+    const Bytes load{0xC4, 0xE2, 0x75, 0x2C, 0x00};
+    require(!rosetta->Match(load.data(), load.size()), "Rosetta mode lowered a masked load");
+}
+
+#if (defined(__linux__) || defined(__APPLE__)) && defined(__x86_64__)
+
+constexpr std::size_t kPage = 4096;
+constexpr std::size_t kDataPages = 16;
+constexpr std::uint8_t kFill = 0xA5;
+constexpr std::uint8_t kSentinel = 0x5A;
+
+std::uint8_t* protectedPage = nullptr;
+volatile sig_atomic_t faults = 0;
+
+void onFault(int number, siginfo_t* info, void*) {
+    const auto* address = static_cast<const std::uint8_t*>(info->si_addr);
+    if (address < protectedPage || address >= protectedPage + kPage) {
+        signal(number, SIG_DFL);
+        return;
+    }
+    faults = faults + 1;
+    mprotect(protectedPage, kPage, PROT_READ | PROT_WRITE);
+}
+
+struct alignas(32) Machine {
+    std::uint8_t Ymm[16][32];
+    std::uint64_t Gpr[7];
+    std::uint64_t Flags;
+    std::uint64_t Stack;
+    std::uint64_t Code;
+};
+
+static_assert(offsetof(Machine, Gpr) == 512 && offsetof(Machine, Flags) == 568 && offsetof(Machine, Stack) == 576 && offsetof(Machine, Code) == 584);
+
+void run(Machine& machine) {
+    asm volatile(
+        "mov %%rsp, %%r12\n\t"
+        "mov %[machine], %%r13\n\t"
+        "vmovdqu 0(%%r13), %%ymm0\n\t"
+        "vmovdqu 32(%%r13), %%ymm1\n\t"
+        "vmovdqu 64(%%r13), %%ymm2\n\t"
+        "vmovdqu 96(%%r13), %%ymm3\n\t"
+        "vmovdqu 128(%%r13), %%ymm4\n\t"
+        "vmovdqu 160(%%r13), %%ymm5\n\t"
+        "vmovdqu 192(%%r13), %%ymm6\n\t"
+        "vmovdqu 224(%%r13), %%ymm7\n\t"
+        "vmovdqu 256(%%r13), %%ymm8\n\t"
+        "vmovdqu 288(%%r13), %%ymm9\n\t"
+        "vmovdqu 320(%%r13), %%ymm10\n\t"
+        "vmovdqu 352(%%r13), %%ymm11\n\t"
+        "vmovdqu 384(%%r13), %%ymm12\n\t"
+        "vmovdqu 416(%%r13), %%ymm13\n\t"
+        "vmovdqu 448(%%r13), %%ymm14\n\t"
+        "vmovdqu 480(%%r13), %%ymm15\n\t"
+        "mov 512(%%r13), %%rax\n\t"
+        "mov 520(%%r13), %%rcx\n\t"
+        "mov 528(%%r13), %%rbx\n\t"
+        "mov 536(%%r13), %%rsi\n\t"
+        "mov 544(%%r13), %%rdi\n\t"
+        "mov 552(%%r13), %%r9\n\t"
+        "mov 560(%%r13), %%r10\n\t"
+        "mov 576(%%r13), %%rsp\n\t"
+        "pushq 568(%%r13)\n\t"
+        "popfq\n\t"
+        "call *584(%%r13)\n\t"
+        "pushfq\n\t"
+        "popq 568(%%r13)\n\t"
+        "mov %%rsp, 576(%%r13)\n\t"
+        "mov %%r12, %%rsp\n\t"
+        "mov %%rax, 512(%%r13)\n\t"
+        "mov %%rcx, 520(%%r13)\n\t"
+        "mov %%rbx, 528(%%r13)\n\t"
+        "mov %%rsi, 536(%%r13)\n\t"
+        "mov %%rdi, 544(%%r13)\n\t"
+        "mov %%r9, 552(%%r13)\n\t"
+        "mov %%r10, 560(%%r13)\n\t"
+        "vmovdqu %%ymm0, 0(%%r13)\n\t"
+        "vmovdqu %%ymm1, 32(%%r13)\n\t"
+        "vmovdqu %%ymm2, 64(%%r13)\n\t"
+        "vmovdqu %%ymm3, 96(%%r13)\n\t"
+        "vmovdqu %%ymm4, 128(%%r13)\n\t"
+        "vmovdqu %%ymm5, 160(%%r13)\n\t"
+        "vmovdqu %%ymm6, 192(%%r13)\n\t"
+        "vmovdqu %%ymm7, 224(%%r13)\n\t"
+        "vmovdqu %%ymm8, 256(%%r13)\n\t"
+        "vmovdqu %%ymm9, 288(%%r13)\n\t"
+        "vmovdqu %%ymm10, 320(%%r13)\n\t"
+        "vmovdqu %%ymm11, 352(%%r13)\n\t"
+        "vmovdqu %%ymm12, 384(%%r13)\n\t"
+        "vmovdqu %%ymm13, 416(%%r13)\n\t"
+        "vmovdqu %%ymm14, 448(%%r13)\n\t"
+        "vmovdqu %%ymm15, 480(%%r13)\n\t"
+        "vzeroupper\n\t"
+        :
+        : [machine] "r"(&machine)
+        : "rax", "rcx", "rbx", "rsi", "rdi", "r9", "r10", "r12", "r13",
+          "xmm0", "xmm1", "xmm2", "xmm3", "xmm4", "xmm5", "xmm6", "xmm7",
+          "xmm8", "xmm9", "xmm10", "xmm11", "xmm12", "xmm13", "xmm14", "xmm15", "memory", "cc");
+}
+
+struct Addressing {
+    Bytes Memory;
+    std::uint8_t RexIndexBase;
+    std::uint8_t Mask;
+    std::uint8_t Source;
+};
+
+enum Register { Rax, Rcx, Rbx, Rsi, Rdi, R9, R10 };
+
+const std::array kAddressings{
+    Addressing{{0x07}, 0, 1, 2},
+    Addressing{{0x44, 0x5E, 0x7F}, 0, 9, 14},
+    Addressing{{0x84, 0x88, 0x00, 0xF0, 0xFF, 0xFF}, 0, 15, 0},
+    Addressing{{0x04, 0xD1}, 3, 3, 8},
+    Addressing{{0x44, 0x24, 0x40}, 0, 12, 5},
+    Addressing{{0x05, 0x00, 0x00, 0x00, 0x00}, 0, 6, 11},
+};
+
+void execution() {
+    const auto region = static_cast<std::uint8_t*>(mmap(nullptr, (kDataPages + 2) * kPage, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+    require(region != MAP_FAILED, "Cannot map masked store test pages");
+    auto* const code = region;
+    auto* const data = region + kPage;
+    protectedPage = data + kDataPages * kPage;
+    struct sigaction action {};
+    action.sa_sigaction = onFault;
+    action.sa_flags = SA_SIGINFO;
+    sigemptyset(&action.sa_mask);
+    struct sigaction previousSegv {};
+    struct sigaction previousBus {};
+    sigaction(SIGSEGV, &action, &previousSegv);
+    sigaction(SIGBUS, &action, &previousBus);
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const std::array<std::uint8_t, 6> patterns{0xFF, 0x00, 0x01, 0x80, 0x55, 0xFE};
+    std::uint64_t runs = 0;
+    for (const auto& form : kForms) {
+        for (const bool wide : {false, true}) {
+            const auto elements = (wide ? 32u : 16u) / form.ElementSize;
+            for (std::size_t mode = 0; mode < kAddressings.size(); ++mode) {
+                const auto& addressing = kAddressings[mode];
+                const auto site = maskedStore(form, wide, addressing.Mask, addressing.Source, addressing.RexIndexBase, addressing.Memory);
+                const auto match = matcher->Match(site.data(), site.size());
+                require(match && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline, "Masked store stub was not produced");
+                for (const int offset : {-40, -16, -4, -2, 0, 8}) {
+                    auto* const target = protectedPage + offset;
+                    const bool stackBased = mode == 4;
+                    auto* const stack = stackBased ? target + 8 - 0x40 : data + kDataPages / 2 * kPage;
+                    auto body = match->StubBody;
+                    const auto siteAddress = mode == 5 ? reinterpret_cast<std::uint64_t>(target) - site.size() : reinterpret_cast<std::uint64_t>(code);
+                    Codegen::ApplyStubRelocations(body, match->Relocations, siteAddress, reinterpret_cast<std::uint64_t>(code), 0);
+                    body.at(match->ReturnBranchOffset) = 0xC3;
+                    require(body.size() <= kPage, "Masked store stub exceeds its code page");
+                    std::memcpy(code, body.data(), body.size());
+                    for (const auto pattern : patterns) {
+                        Machine machine{};
+                        for (unsigned reg = 0; reg < 16; ++reg)
+                            for (unsigned byte = 0; byte < 32; ++byte)
+                                machine.Ymm[reg][byte] = static_cast<std::uint8_t>(reg * 37 + byte * 11 + 1);
+                        for (unsigned element = 0; element < 32u / form.ElementSize; ++element) {
+                            const bool active = element >= elements || (pattern >> element & 1) != 0;
+                            auto* lane = machine.Ymm[addressing.Mask] + element * form.ElementSize;
+                            std::memset(lane, active ? 0x00 : 0xFF, form.ElementSize);
+                            lane[0] = 0x01;
+                            lane[form.ElementSize - 1] = active ? 0x80 : 0x7F;
+                        }
+                        machine.Gpr[Rax] = 0x1111111111111111ull;
+                        machine.Gpr[Rcx] = 0x2222222222222222ull;
+                        machine.Gpr[Rbx] = 8;
+                        machine.Gpr[Rsi] = reinterpret_cast<std::uint64_t>(target) - 0x7F - 16;
+                        machine.Gpr[Rdi] = reinterpret_cast<std::uint64_t>(target);
+                        machine.Gpr[R9] = reinterpret_cast<std::uint64_t>(target) - 5 * 8;
+                        machine.Gpr[R10] = 5;
+                        if (mode == 2) {
+                            machine.Gpr[Rcx] = 3;
+                            machine.Gpr[Rax] = reinterpret_cast<std::uint64_t>(target) + 0x1000 - 12;
+                        }
+                        machine.Flags = (runs & 1) != 0 ? 0x8D7 : 0x002;
+                        machine.Stack = reinterpret_cast<std::uint64_t>(stack);
+                        machine.Code = reinterpret_cast<std::uint64_t>(code);
+                        const auto input = machine;
+                        require(mprotect(protectedPage, kPage, PROT_READ | PROT_WRITE) == 0, "Cannot unprotect the watched page");
+                        std::memset(target - 16, kFill, 64);
+                        std::memset(stack - 8 - 128, kSentinel, 128);
+                        require(mprotect(protectedPage, kPage, PROT_READ) == 0, "Cannot protect the watched page");
+                        faults = 0;
+                        run(machine);
+                        ++runs;
+                        bool touchesProtected = false;
+                        for (unsigned element = 0; element < elements; ++element) {
+                            const bool active = (pattern >> element & 1) != 0;
+                            for (unsigned byte = 0; byte < form.ElementSize; ++byte) {
+                                const auto at = element * form.ElementSize + byte;
+                                require(target[at] == (active ? input.Ymm[addressing.Source][at] : kFill), "Masked store wrote an inactive element or lost an active one");
+                                touchesProtected = touchesProtected || (active && target + at >= protectedPage);
+                            }
+                        }
+                        for (int at = -16; at < 0; ++at)
+                            require(target[at] == kFill, "Masked store wrote before its operand");
+                        for (unsigned at = elements * form.ElementSize; at < 48; ++at)
+                            require(target[at] == kFill, "Masked store wrote past its operand");
+                        require(faults == (touchesProtected ? 1 : 0), "Masked store stub did not fault exactly once on the protected page");
+                        for (unsigned at = 0; at < 128; ++at)
+                            require(stack[-8 - 128 + static_cast<int>(at)] == kSentinel, "Masked store stub wrote into the red zone");
+                        require(std::memcmp(machine.Ymm, input.Ymm, sizeof(input.Ymm)) == 0, "Masked store stub changed a vector register");
+                        require(std::memcmp(machine.Gpr, input.Gpr, sizeof(input.Gpr)) == 0, "Masked store stub changed a general register");
+                        require((machine.Flags & 0x8D5) == (input.Flags & 0x8D5), "Masked store stub changed the flags");
+                        require(machine.Stack == input.Stack, "Masked store stub did not restore RSP");
+                    }
+                }
+            }
+        }
+    }
+    sigaction(SIGSEGV, &previousSegv, nullptr);
+    sigaction(SIGBUS, &previousBus, nullptr);
+    munmap(region, (kDataPages + 2) * kPage);
+    std::cout << runs << " masked store executions\n";
+}
+#else
+void execution() { std::cout << "Masked store execution checks require a Linux/macOS x86-64 build\n"; }
+#endif
+
+}
+
+int main() {
+    try {
+        decoding();
+        body();
+        matching();
+        execution();
+        std::cout << "Masked store lowering checks passed\n";
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/codegen/tests/RedZoneFramerExecutionTests.cpp b/core/relinker/codegen/tests/RedZoneFramerExecutionTests.cpp
new file mode 100644
index 0000000000..7d940524b9
--- /dev/null
+++ b/core/relinker/codegen/tests/RedZoneFramerExecutionTests.cpp
@@ -0,0 +1,286 @@
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <codegen/x86/StubBodyBuilder.hpp>
+#include <algorithm>
+#include <cstdint>
+#include <cstring>
+#include <iostream>
+#include <limits>
+#include <span>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+#if defined(__linux__) && defined(__x86_64__)
+#include <signal.h>
+#include <sys/mman.h>
+#include <ucontext.h>
+#endif
+
+#if defined(__linux__) && defined(__x86_64__)
+
+namespace {
+
+void require(const bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+constexpr std::size_t kArenaBytes = 0x10000;
+constexpr std::size_t kStubBase = 0x4000;
+constexpr std::size_t kRunnerBase = 0xc000;
+constexpr std::uint8_t kClobber = 0xa5;
+constexpr std::uint64_t kA = 0x1111, kB = 0x2222, kC = 0x3333, kD = 0x4444;
+
+std::uint8_t* arena = nullptr;
+volatile sig_atomic_t steps = 0;
+
+void clobberBelowRsp(int, siginfo_t*, void* context) {
+    auto& registers = static_cast<ucontext_t*>(context)->uc_mcontext.gregs;
+    const auto rip = static_cast<std::uintptr_t>(registers[REG_RIP]);
+    const auto base = reinterpret_cast<std::uintptr_t>(arena);
+    if (rip < base || rip >= base + kArenaBytes) {
+        registers[REG_EFL] &= ~static_cast<greg_t>(0x100);
+        return;
+    }
+    std::memset(reinterpret_cast<void*>(static_cast<std::uintptr_t>(registers[REG_RSP]) - 0x80), kClobber, 0x80);
+    steps = steps + 1;
+}
+
+const std::vector<std::uint8_t> Runner{
+    0x53, 0x4c, 0x89, 0xc3, 0x48, 0x89, 0xf8, 0x48, 0x89, 0xf7, 0x48, 0x89, 0xd6, 0x48, 0x89, 0xca,
+    0x4d, 0x85, 0xc9, 0x74, 0x0a, 0x9c, 0x48, 0x81, 0x0c, 0x24, 0x00, 0x01, 0x00, 0x00, 0x9d,
+    0xff, 0xd0, 0x9c, 0x48, 0x81, 0x24, 0x24, 0xff, 0xfe, 0xff, 0xff, 0x9d, 0x5b, 0xc3,
+};
+
+struct Leaf {
+    const char* Name;
+    std::vector<std::uint8_t> Code;
+    std::uint64_t Expected;
+};
+
+const std::vector<std::uint8_t> FramelessPushes{0x53, 0x41, 0x56, 0x41, 0x57};
+const std::vector<std::uint8_t> FramelessPops{0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xc3};
+
+std::vector<std::uint8_t> frameless(const std::vector<std::uint8_t>& body) {
+    std::vector<std::uint8_t> bytes = FramelessPushes;
+    bytes.insert(bytes.end(), body.begin(), body.end());
+    bytes.insert(bytes.end(), FramelessPops.begin(), FramelessPops.end());
+    return bytes;
+}
+
+std::vector<Leaf> framedLeaves() {
+    return {
+        {"frameless leaf spilling 0x10 below rsp", frameless({
+            0x48, 0x89, 0x7c, 0x24, 0xf0, 0x48, 0x89, 0x74, 0x24, 0xf8, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x48, 0x03, 0x44, 0x24, 0xf0, 0x48, 0x03, 0x44, 0x24, 0xf8, 0xff, 0xc9, 0x75, 0xf2,
+        }), 8 * (kA + kB)},
+        {"leaf reaching 0x28 below rsp", frameless({
+            0x48, 0x89, 0x7c, 0x24, 0xd8, 0x48, 0x89, 0x74, 0x24, 0xe8, 0x48, 0x89, 0x54, 0x24, 0xf0, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x48, 0x03, 0x44, 0x24, 0xd8, 0x48, 0x03, 0x44, 0x24, 0xe8, 0x48, 0x03, 0x44, 0x24, 0xf0, 0xff, 0xc9, 0x75, 0xed,
+        }), 8 * (kA + kB + kC)},
+        {"leaf reading its saved rbx at +0x10 moved in place", frameless({
+            0x48, 0x89, 0x7c, 0x24, 0xf0, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x48, 0x03, 0x44, 0x24, 0xf0, 0x48, 0x03, 0x44, 0x24, 0x10, 0xff, 0xc9, 0x75, 0xf2,
+        }), 8 * (kA + kD)},
+        {"leaf taking the address of a slot 0x20 below rsp", frameless({
+            0x4c, 0x8d, 0x74, 0x24, 0xe0, 0x49, 0x89, 0x3e, 0x49, 0x89, 0x76, 0x08, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x49, 0x03, 0x06, 0x49, 0x03, 0x46, 0x08, 0xff, 0xc9, 0x75, 0xf5,
+        }), 8 * (kA + kB)},
+        {"inflate_fast-shaped leaf allocating 0x40 after six pushes", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x7c, 0x24, 0x00, 0x48, 0x89, 0x74, 0x24, 0x08, 0x48, 0x89, 0x54, 0x24, 0x38,
+            0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0, 0x48, 0x03, 0x44, 0x24, 0x08, 0x48, 0x03, 0x44, 0x24, 0xe0, 0x48, 0x03, 0x44, 0x24, 0x00,
+            0xff, 0xc9, 0x75, 0xed, 0x48, 0x8b, 0x54, 0x24, 0x38,
+            0x48, 0x83, 0xc4, 0x40, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kB + 2 * kA)},
+    };
+}
+
+std::vector<Leaf> stubbedLeaves() {
+    return {
+        {"inflate_fast-shaped leaf with operands at rsp and at 0x60 shifted by 0x20", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x70,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x34, 0x24, 0x48, 0x89, 0x54, 0x24, 0x60, 0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0,
+            0x48, 0x03, 0x44, 0x24, 0xe0, 0x48, 0x03, 0x04, 0x24, 0x48, 0x03, 0x44, 0x24, 0x60, 0xff, 0xc9, 0x75, 0xee,
+            0x48, 0x83, 0xc4, 0x70, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kA + kB + kC)},
+        {"leaf shifted by the whole red zone reading its saved rbx at +0x8", {
+            0x41, 0x57, 0x53, 0x41, 0x56, 0x4c, 0x8d, 0x74, 0x24, 0xe0, 0x49, 0x89, 0x3e, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x49, 0x03, 0x06, 0x48, 0x03, 0x44, 0x24, 0x08, 0xff, 0xc9, 0x75, 0xf4, 0x41, 0x5e, 0x5b, 0x41, 0x5f, 0xc3,
+        }, 8 * (kA + kD)},
+    };
+}
+
+std::vector<Leaf> backwardStubbedLeaves() {
+    return {
+        {"inflate_fast-shaped leaf comparing at rsp between an add and a jne", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x7c, 0x24, 0x00, 0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0,
+            0x48, 0x03, 0x44, 0x24, 0xe0, 0x49, 0x01, 0xf8, 0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xeb,
+            0x48, 0x83, 0xc4, 0x40, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kA + kB)},
+        {"leaf comparing at rsp after a load below rsp that heads its loop", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x7c, 0x24, 0x00, 0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0,
+            0x48, 0x03, 0x44, 0x24, 0xe0, 0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xee,
+            0x48, 0x83, 0xc4, 0x40, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kA + kB)},
+    };
+}
+
+void writeRel32(std::uint8_t* at, const std::uint64_t target, const std::uint64_t next) {
+    const auto displacement = static_cast<std::int64_t>(target) - static_cast<std::int64_t>(next);
+    require(displacement >= std::numeric_limits<std::int32_t>::min() && displacement <= std::numeric_limits<std::int32_t>::max(), "a stub jump is out of rel32 range");
+    const auto value = static_cast<std::uint32_t>(static_cast<std::int32_t>(displacement));
+    for (std::size_t index = 0; index < 4; ++index) at[index] = static_cast<std::uint8_t>(value >> (index * 8));
+}
+
+std::vector<std::uint8_t> callTo(const std::size_t from, const std::size_t target) {
+    std::vector<std::uint8_t> bytes{0xe8, 0, 0, 0, 0};
+    const auto displacement = static_cast<std::uint32_t>(static_cast<std::int32_t>(target) - static_cast<std::int32_t>(from + 5));
+    for (std::size_t index = 0; index < 4; ++index) bytes[1 + index] = static_cast<std::uint8_t>(displacement >> (index * 8));
+    return bytes;
+}
+
+struct Image {
+    std::vector<std::uint8_t> Bytes;
+    std::vector<std::size_t> Starts;
+    std::vector<std::size_t> Ends;
+};
+
+Image place(const std::vector<Leaf>& leaves) {
+    Image image;
+    std::size_t at = 0x40;
+    for (const auto& leaf : leaves) {
+        image.Starts.push_back(at);
+        at += (leaf.Code.size() + 15) / 16 * 16 + 16;
+    }
+    for (const auto start : image.Starts) {
+        const auto call = callTo(image.Bytes.size(), start);
+        image.Bytes.insert(image.Bytes.end(), call.begin(), call.end());
+    }
+    image.Bytes.push_back(0xc3);
+    for (std::size_t index = 0; index < leaves.size(); ++index) {
+        image.Bytes.resize(image.Starts[index], 0xcc);
+        image.Bytes.insert(image.Bytes.end(), leaves[index].Code.begin(), leaves[index].Code.end());
+        image.Ends.push_back(image.Bytes.size());
+    }
+    image.Bytes.resize((image.Bytes.size() + 15) / 16 * 16 + 16, 0xcc);
+    require(image.Bytes.size() <= kStubBase, "the leaves do not fit before the stubs");
+    return image;
+}
+
+struct Framing {
+    Codegen::RedZoneFrameReport Report;
+    std::vector<Codegen::TrampolineSite> Sites;
+    std::vector<Codegen::RedZoneDisplacement> Displacements;
+};
+
+Framing load(const Image& image, const bool frame) {
+    std::fill_n(arena, kArenaBytes, 0xcc);
+    std::copy(image.Bytes.begin(), image.Bytes.end(), arena);
+    std::copy(Runner.begin(), Runner.end(), arena + kRunnerBase);
+    Framing framing;
+    if (!frame) return framing;
+    const auto base = reinterpret_cast<std::uint64_t>(arena);
+    const std::vector<Domain::ProgramHeader> segments{{1, 5, 0, base, base, image.Bytes.size(), image.Bytes.size(), 16}};
+    std::vector<Codegen::RedZoneFunction> functions;
+    for (std::size_t index = 0; index < image.Starts.size(); ++index) functions.push_back({base + image.Starts[index], base + image.Ends[index]});
+    framing.Sites = Codegen::FrameRedZoneFunctions(image.Bytes, segments, functions, {}, framing.Report, framing.Displacements);
+    for (const auto& moved : framing.Displacements) std::copy(moved.Bytes.begin(), moved.Bytes.end(), arena + moved.Offset);
+    std::size_t cursor = kStubBase;
+    for (const auto& site : framing.Sites) {
+        const auto at = static_cast<std::size_t>(site.Address - base);
+        require(std::equal(site.OriginalBytes.begin(), site.OriginalBytes.end(), arena + at), "a framed site's bytes changed before it was patched");
+        cursor = (cursor + 15) / 16 * 16;
+        require(cursor + site.Body.size() <= kRunnerBase, "the stubs do not fit before the runner");
+        auto* stub = arena + cursor;
+        std::copy(site.Body.begin(), site.Body.end(), stub);
+        Codegen::ApplyStubRelocations(std::span<std::uint8_t>(stub, site.ReturnBranchOffset), site.Relocations, site.Address, base + cursor, site.Offset);
+        writeRel32(stub + site.ReturnBranchOffset + 1, site.Address + site.Length, base + cursor + site.ReturnBranchOffset + 5);
+        std::fill_n(arena + at, site.Length, 0x90);
+        arena[at] = 0xe9;
+        writeRel32(arena + at + 1, base + cursor, site.Address + 5);
+        cursor += site.Body.size();
+    }
+    return framing;
+}
+
+struct Run {
+    std::uint64_t Result;
+    int Steps;
+};
+
+Run run(const std::size_t start, const bool clobber) {
+    using Entry = std::uint64_t (*)(std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t);
+    const auto entry = reinterpret_cast<Entry>(arena + kRunnerBase);
+    steps = 0;
+    const auto result = entry(reinterpret_cast<std::uint64_t>(arena + start), kA, kB, kC, kD, clobber ? 1 : 0);
+    return {result, static_cast<int>(steps)};
+}
+
+std::string hex(const std::uint64_t value) {
+    std::ostringstream text;
+    text << "0x" << std::hex << value;
+    return text.str();
+}
+
+Codegen::RedZoneFrameReport runLeaves(const std::vector<Leaf>& leaves) {
+    const auto image = place(leaves);
+    load(image, false);
+    std::vector<Run> plain, clobbered;
+    for (std::size_t index = 0; index < leaves.size(); ++index) {
+        plain.push_back(run(image.Starts[index], false));
+        clobbered.push_back(run(image.Starts[index], true));
+        require(plain.back().Result == leaves[index].Expected, std::string(leaves[index].Name) + ": the unframed leaf returned " + hex(plain.back().Result) + " without the clobber, not " + hex(leaves[index].Expected));
+        require(clobbered.back().Steps > 0, std::string(leaves[index].Name) + ": the clobber did not run");
+        require(clobbered.back().Result != leaves[index].Expected, std::string(leaves[index].Name) + ": the unframed leaf survived writes below rsp, so the case proves nothing");
+    }
+    const auto framing = load(image, true);
+    require(framing.Report.Framed == leaves.size(), "only " + std::to_string(framing.Report.Framed) + " of " + std::to_string(leaves.size()) + " leaves were framed");
+    for (std::size_t index = 0; index < leaves.size(); ++index) {
+        const auto calm = run(image.Starts[index], false);
+        const auto framed = run(image.Starts[index], true);
+        require(calm.Result == leaves[index].Expected, std::string(leaves[index].Name) + ": the framed leaf returned " + hex(calm.Result) + " without the clobber, not " + hex(leaves[index].Expected));
+        require(framed.Steps > 0, std::string(leaves[index].Name) + ": the clobber did not run over the framed leaf");
+        require(framed.Result == leaves[index].Expected, std::string(leaves[index].Name) + ": the framed leaf returned " + hex(framed.Result) + " under writes below rsp, not " + hex(leaves[index].Expected));
+        std::cout << leaves[index].Name << ": unframed " << hex(plain[index].Result) << " alone and " << hex(clobbered[index].Result) << " under the clobber (" << clobbered[index].Steps << " steps); framed " << hex(framed.Result) << " under the clobber (" << framed.Steps << " steps)\n";
+    }
+    return framing.Report;
+}
+
+}
+
+int main() {
+    try {
+        struct sigaction action {};
+        action.sa_sigaction = clobberBelowRsp;
+        action.sa_flags = SA_SIGINFO;
+        sigemptyset(&action.sa_mask);
+        require(sigaction(SIGTRAP, &action, nullptr) == 0, "cannot install the SIGTRAP handler");
+        void* mapped = mmap(nullptr, kArenaBytes, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (mapped == MAP_FAILED) {
+            std::cout << "skipped: no writable and executable memory\n";
+            return 77;
+        }
+        arena = static_cast<std::uint8_t*>(mapped);
+        runLeaves(framedLeaves());
+        const auto stubbed = runLeaves(stubbedLeaves());
+        require(stubbed.OperandStubs == 3 && stubbed.StubbedOperands == 5, "the leaves were framed with " + std::to_string(stubbed.OperandStubs) + " operand stubs carrying " + std::to_string(stubbed.StubbedOperands) + " rsp operands, not 3 carrying 5");
+        const auto backward = runLeaves(backwardStubbedLeaves());
+        require(backward.OperandStubs == 2 && backward.StubbedOperands == 3 && backward.MovedOperands == 5, "the leaves comparing at rsp before a branch were framed with " + std::to_string(backward.OperandStubs) + " operand stubs carrying " + std::to_string(backward.StubbedOperands) + " rsp operands and " + std::to_string(backward.MovedOperands) + " moved in place, not 2 carrying 3 and 5");
+        std::cout << "red-zone framer execution tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << "red-zone framer execution tests failed: " << error.what() << '\n';
+        return 1;
+    }
+}
+
+#else
+
+int main() {
+    std::cout << "skipped: the red-zone framer execution tests single-step x86-64 code on Linux\n";
+    return 77;
+}
+
+#endif
diff --git a/core/relinker/codegen/tests/RedZoneFramerTests.cpp b/core/relinker/codegen/tests/RedZoneFramerTests.cpp
new file mode 100644
index 0000000000..31466fcfdb
--- /dev/null
+++ b/core/relinker/codegen/tests/RedZoneFramerTests.cpp
@@ -0,0 +1,625 @@
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <cstdint>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+void require(const bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+constexpr std::uint64_t Base = 0x1000;
+
+std::vector<std::uint8_t> padTo(std::vector<std::uint8_t> bytes, const std::size_t size) {
+    bytes.resize(size, 0xcc);
+    return bytes;
+}
+
+void append(std::vector<std::uint8_t>& bytes, const std::vector<std::uint8_t>& more) {
+    bytes.insert(bytes.end(), more.begin(), more.end());
+}
+
+std::vector<std::uint8_t> callTo(const std::size_t from, const std::size_t target) {
+    const auto displacement = static_cast<std::int32_t>(target) - static_cast<std::int32_t>(from + 5);
+    return {0xe8, static_cast<std::uint8_t>(displacement), static_cast<std::uint8_t>(displacement >> 8), static_cast<std::uint8_t>(displacement >> 16), static_cast<std::uint8_t>(displacement >> 24)};
+}
+
+const std::vector<std::uint8_t> Prologue{0x55, 0x48, 0x89, 0xe5, 0x41, 0x57, 0x53};
+const std::vector<std::uint8_t> Exit{0x5b, 0x41, 0x5f, 0x5d, 0xc3};
+const std::vector<std::uint8_t> StoreBelowPushes{0x48, 0x89, 0x7d, 0xe8};
+const std::vector<std::uint8_t> LoadBelowPushes{0x48, 0x8b, 0x45, 0xe8};
+const std::vector<std::uint8_t> LoadAbovePushes{0x48, 0x8b, 0x45, 0x08};
+
+std::vector<std::uint8_t> leaf(const std::vector<std::uint8_t>& body) {
+    std::vector<std::uint8_t> bytes = Prologue;
+    append(bytes, body);
+    append(bytes, Exit);
+    return bytes;
+}
+
+struct Image {
+    std::vector<std::uint8_t> bytes;
+    std::vector<Domain::ProgramHeader> segments;
+    std::vector<Codegen::RedZoneFunction> functions;
+};
+
+Image image(const std::vector<std::vector<std::uint8_t>>& functions) {
+    Image result;
+    std::vector<std::size_t> starts;
+    std::size_t at = 0x40;
+    for (const auto& function : functions) {
+        starts.push_back(at);
+        at += (function.size() + 15) / 16 * 16 + 16;
+    }
+    std::vector<std::uint8_t> caller;
+    for (const auto start : starts) append(caller, callTo(caller.size(), start));
+    caller.push_back(0xc3);
+    result.bytes = padTo(caller, 0x40);
+    for (std::size_t index = 0; index < functions.size(); ++index) {
+        result.bytes = padTo(result.bytes, starts[index]);
+        append(result.bytes, functions[index]);
+        result.functions.push_back({Base + starts[index], Base + starts[index] + functions[index].size()});
+    }
+    result.bytes = padTo(result.bytes, (result.bytes.size() + 15) / 16 * 16 + 16);
+    result.segments.push_back({1, 5, 0, Base, Base, result.bytes.size(), result.bytes.size(), 16});
+    return result;
+}
+
+void framesRedZoneLeaf() {
+    std::vector<std::uint8_t> body = StoreBelowPushes;
+    append(body, LoadBelowPushes);
+    const auto input = image({leaf(body)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.RedZoneFunctions == 1 && report.Framed == 1 && report.Exits == 1, "a red-zone leaf was not framed");
+    require(sites.size() == 2, "a framed leaf needs one prologue and one exit site");
+    require(displacements.empty() && report.FramedWithoutFramePointer == 0, "a leaf with a frame pointer had rsp operands moved");
+
+    const auto& entry = sites[0];
+    require(entry.Address == Base + 0x40 && entry.Length == Prologue.size(), "the prologue site does not cover the pushes");
+    require(entry.OriginalBytes == Prologue, "the prologue site lost its bytes");
+    std::vector<std::uint8_t> entryBody = Prologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0x80, 0xe9, 0, 0, 0, 0});
+    require(entry.Body == entryBody && entry.ReturnBranchOffset == Prologue.size() + 5, "the prologue stub does not lower rsp after the pushes");
+
+    const auto& exit = sites[1];
+    require(exit.Address == Base + 0x40 + Prologue.size() + body.size() && exit.Length == Exit.size(), "the exit site does not cover the pops and ret");
+    std::vector<std::uint8_t> exitBody{0x48, 0x8d, 0xa4, 0x24, 0x80, 0, 0, 0};
+    append(exitBody, Exit);
+    append(exitBody, {0xe9, 0, 0, 0, 0});
+    require(exit.Body == exitBody && exit.ReturnBranchOffset == 8 + Exit.size(), "the exit stub does not raise rsp before the pops");
+}
+
+const std::vector<std::uint8_t> FramelessPrologue{0x53, 0x41, 0x56, 0x41, 0x57};
+const std::vector<std::uint8_t> FramelessExit{0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xc3};
+const std::vector<std::uint8_t> StoreBelowRsp{0x48, 0x89, 0x7c, 0x24, 0xf0};
+const std::vector<std::uint8_t> LoadBelowRsp{0x48, 0x8b, 0x44, 0x24, 0xf0};
+const std::vector<std::uint8_t> LoadAboveRsp{0x48, 0x8b, 0x44, 0x24, 0x08};
+const std::vector<std::uint8_t> LoadFarAboveRsp{0x48, 0x8b, 0x44, 0x24, 0x78};
+const std::vector<std::uint8_t> LoadAtRsp{0x48, 0x8b, 0x04, 0x24};
+const std::vector<std::uint8_t> StoreDeepBelowRsp{0x48, 0x89, 0x74, 0x24, 0xd8};
+const std::vector<std::uint8_t> LoadDeepBelowRsp{0x48, 0x8b, 0x44, 0x24, 0xd8};
+const std::vector<std::uint8_t> AddressBelowRsp{0x48, 0x8d, 0x44, 0x24, 0xe0};
+const std::vector<std::uint8_t> AddressAboveRsp{0x48, 0x8d, 0x44, 0x24, 0x08};
+const std::vector<std::uint8_t> StoreIndexedBelowRsp{0x48, 0x89, 0x7c, 0xcc, 0xf0};
+const std::vector<std::uint8_t> StoreImmediateFarAboveRsp{0xc7, 0x44, 0x24, 0x7c, 0x78, 0x56, 0x34, 0x12};
+const std::vector<std::uint8_t> LoadIndexedAtRsp{0x48, 0x8b, 0x04, 0xcc};
+const std::vector<std::uint8_t> AddRdxToRax{0x48, 0x01, 0xd0};
+const std::vector<std::uint8_t> VexStoreAtRsp{0xc5, 0xf8, 0x11, 0x04, 0x24};
+const std::vector<std::uint8_t> EvexStoreBelowRsp{0x62, 0xf1, 0x7c, 0x48, 0x11, 0x44, 0x24, 0xff};
+const std::vector<std::uint8_t> LoadRipRelative{0x48, 0x8b, 0x05, 0x00, 0x00, 0x00, 0x00};
+
+std::vector<std::uint8_t> stubBody(std::vector<std::uint8_t> code) {
+    append(code, {0xe9, 0, 0, 0, 0});
+    return code;
+}
+
+std::vector<std::uint8_t> framelessLeaf(const std::vector<std::uint8_t>& prologue, const std::vector<std::uint8_t>& body, const std::vector<std::uint8_t>& exit) {
+    std::vector<std::uint8_t> bytes = prologue;
+    append(bytes, body);
+    append(bytes, exit);
+    return bytes;
+}
+
+void framesLeafWithoutFramePointer() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadBelowRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.RedZoneFunctions == 1 && report.Framed == 1 && report.FramedWithoutFramePointer == 1 && report.MovedOperands == 2, "a leaf that only pushes was not framed");
+    require(sites.size() == 2, "a framed leaf needs one prologue and one exit site");
+    const auto& entry = sites[0];
+    require(entry.Address == Base + 0x40 && entry.Length == FramelessPrologue.size(), "the prologue site does not cover the pushes");
+    std::vector<std::uint8_t> entryBody = FramelessPrologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0xf0, 0xe9, 0, 0, 0, 0});
+    require(entry.Body == entryBody, "the prologue stub does not lower rsp by the leaf's depth below rsp after the pushes");
+    const auto& exit = sites[1];
+    require(exit.Address == Base + 0x40 + FramelessPrologue.size() + body.size() && exit.OriginalBytes == FramelessExit, "the exit site does not cover the pops and ret");
+    std::vector<std::uint8_t> exitBody{0x48, 0x8d, 0xa4, 0x24, 0x10, 0, 0, 0};
+    append(exitBody, FramelessExit);
+    append(exitBody, {0xe9, 0, 0, 0, 0});
+    require(exit.Body == exitBody, "the exit stub does not raise rsp by the leaf's depth below rsp before the pops");
+    const auto storeDisplacement = 0x40 + FramelessPrologue.size() + 4;
+    const auto loadDisplacement = storeDisplacement + StoreBelowRsp.size();
+    require(displacements.size() == 2, "both rsp operands must move");
+    require(displacements[0].Offset == storeDisplacement && displacements[0].Bytes == std::vector<std::uint8_t>{0x00}, "the store below rsp was not moved to the lowered rsp");
+    require(displacements[1].Offset == loadDisplacement && displacements[1].Bytes == std::vector<std::uint8_t>{0x00}, "the load below rsp was not moved to the lowered rsp");
+}
+
+void shiftsByTheDeepestOperandBelowRsp() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, StoreDeepBelowRsp);
+    append(body, LoadDeepBelowRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && sites.size() == 2 && displacements.size() == 3, "a leaf reaching 0x28 bytes below rsp was not framed");
+    std::vector<std::uint8_t> entryBody = FramelessPrologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0xd0, 0xe9, 0, 0, 0, 0});
+    require(sites[0].Body == entryBody, "rsp is not lowered by the deepest displacement rounded up to 16");
+    require(std::vector<std::uint8_t>(sites[1].Body.begin(), sites[1].Body.begin() + 8) == std::vector<std::uint8_t>{0x48, 0x8d, 0xa4, 0x24, 0x30, 0, 0, 0}, "rsp is not raised by the shift it was lowered by");
+    require(displacements[0].Bytes == std::vector<std::uint8_t>{0x20} && displacements[1].Bytes == std::vector<std::uint8_t>{0x08} && displacements[2].Bytes == std::vector<std::uint8_t>{0x08}, "the operands below rsp were not moved by the shift");
+}
+
+void movesPositiveOperandsThatFitAfterTheShift() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadAboveRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.MovedOperands == 2 && sites.size() == 2, "a leaf with an 8-bit displacement above rsp that fits after the shift was not framed");
+    const auto loadDisplacement = 0x40 + FramelessPrologue.size() + StoreBelowRsp.size() + 4;
+    require(displacements.size() == 2 && displacements[1].Offset == loadDisplacement && displacements[1].Bytes == std::vector<std::uint8_t>{0x18}, "the load above rsp was not moved in place by the shift");
+}
+
+void shiftsByTheWholeRedZoneForAddressesBelowRsp() {
+    std::vector<std::uint8_t> below = StoreBelowRsp;
+    append(below, AddressBelowRsp);
+    std::vector<std::uint8_t> above = StoreBelowRsp;
+    append(above, AddressAboveRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, below, FramelessExit), framelessLeaf(FramelessPrologue, above, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && sites.size() == 4 && displacements.size() == 4, "leaves that take the address of a stack slot were not framed");
+    require(sites[0].Body[FramelessPrologue.size() + 4] == 0x80 && displacements[0].Bytes == std::vector<std::uint8_t>{0x70} && displacements[1].Bytes == std::vector<std::uint8_t>{0x60}, "a leaf that takes the address of a slot below rsp was not shifted by the whole red zone");
+    require(sites[2].Body[FramelessPrologue.size() + 4] == 0xf0 && displacements[2].Bytes == std::vector<std::uint8_t>{0x00} && displacements[3].Bytes == std::vector<std::uint8_t>{0x18}, "a leaf that only takes the address of a slot above rsp was shifted by more than its depth");
+}
+
+void shiftsByTheWholeRedZoneForIndexedOperands() {
+    std::vector<std::uint8_t> body = StoreIndexedBelowRsp;
+    append(body, LoadBelowRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && sites.size() == 2 && displacements.size() == 2, "a leaf with an indexed operand below rsp was not framed");
+    require(sites[0].Body[FramelessPrologue.size() + 4] == 0x80 && displacements[0].Bytes == std::vector<std::uint8_t>{0x70} && displacements[1].Bytes == std::vector<std::uint8_t>{0x70}, "a leaf whose indexed operand can reach deeper than its displacement was not shifted by the whole red zone");
+}
+
+void stubsOperandsWhoseDisplacementOverflows() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadFarAboveRsp);
+    append(body, StoreImmediateFarAboveRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.MovedOperands == 1 && report.OperandStubs == 2 && report.StubbedOperands == 2 && sites.size() == 4, "a leaf whose 8-bit displacements above rsp overflow after the shift was not framed with operand stubs");
+    const auto load = Base + 0x40 + FramelessPrologue.size() + StoreBelowRsp.size();
+    require(sites[2].Address == load && sites[2].Length == LoadFarAboveRsp.size() && sites[2].OriginalBytes == LoadFarAboveRsp, "the stub site does not cover the load that cannot move in place");
+    require(sites[2].Body == stubBody({0x48, 0x8b, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00}) && sites[2].ReturnBranchOffset == 8, "the load was not re-encoded with a 32-bit displacement moved by the shift");
+    require(sites[3].Address == load + LoadFarAboveRsp.size() && sites[3].OriginalBytes == StoreImmediateFarAboveRsp, "the stub site does not cover the store of an immediate that cannot move in place");
+    require(sites[3].Body == stubBody({0xc7, 0x84, 0x24, 0x8c, 0x00, 0x00, 0x00, 0x78, 0x56, 0x34, 0x12}), "the store lost its immediate when its displacement was widened");
+    require(displacements.size() == 1 && displacements[0].Bytes == std::vector<std::uint8_t>{0x00}, "the store below rsp was not moved in place");
+}
+
+void stubsOperandsAtRspWithTheInstructionsAfterThem() {
+    std::vector<std::uint8_t> atRsp = StoreBelowRsp;
+    append(atRsp, LoadAtRsp);
+    append(atRsp, LoadAboveRsp);
+    std::vector<std::uint8_t> indexed = StoreBelowRsp;
+    append(indexed, LoadIndexedAtRsp);
+    append(indexed, AddRdxToRax);
+    const auto input = image({framelessLeaf(FramelessPrologue, atRsp, FramelessExit), framelessLeaf(FramelessPrologue, indexed, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && report.MovedOperands == 2 && report.OperandStubs == 2 && report.StubbedOperands == 3 && sites.size() == 6, "leaves with operands at rsp were not framed with operand stubs");
+    const auto first = 0x40 + FramelessPrologue.size() + StoreBelowRsp.size();
+    require(sites[2].Address == Base + first && sites[2].Length == LoadAtRsp.size() + LoadAboveRsp.size(), "the stub site does not run on to the next instruction to make room for its jump");
+    require(sites[2].Body == stubBody({0x48, 0x8b, 0x44, 0x24, 0x10, 0x48, 0x8b, 0x44, 0x24, 0x18}), "the load at rsp and the load the stub covers after it were not both moved by the shift");
+    for (const auto& displacement : displacements) require(displacement.Offset < first || displacement.Offset >= first + sites[2].Length, "an rsp operand inside a stub site was also moved in place");
+    require(sites[3].Body[FramelessPrologue.size() + 4] == 0x80, "a leaf with an indexed operand at rsp was not shifted by the whole red zone");
+    require(sites[5].OriginalBytes.size() == LoadIndexedAtRsp.size() + AddRdxToRax.size() && sites[5].Body == stubBody({0x48, 0x8b, 0x84, 0xcc, 0x80, 0x00, 0x00, 0x00, 0x48, 0x01, 0xd0}), "the indexed load at rsp was not re-encoded with a 32-bit displacement of 0x80 ahead of the add it covers");
+}
+
+void stubsVexOperandsAtRsp() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, VexStoreAtRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.OperandStubs == 1 && report.StubbedOperands == 1 && sites.size() == 3, "a leaf with a VEX store at rsp was not framed with an operand stub");
+    require(sites[2].OriginalBytes == VexStoreAtRsp && sites[2].Body == stubBody({0xc5, 0xf8, 0x11, 0x44, 0x24, 0x10}), "the VEX store at rsp was not re-encoded with an 8-bit displacement moved by the shift");
+}
+
+void stubsOperandsAtRspWithTheInstructionsBeforeThem() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadAtRsp);
+    append(body, LoadRipRelative);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.MovedOperands == 0 && report.OperandStubs == 1 && report.StubbedOperands == 2 && sites.size() == 3 && displacements.empty(), "a leaf whose short operand at rsp sits before a rip-relative instruction was not framed with a stub over the instruction before it");
+    const auto store = Base + 0x40 + FramelessPrologue.size();
+    require(sites[2].Address == store && sites[2].Length == StoreBelowRsp.size() + LoadAtRsp.size(), "the stub site does not start at the store before the operand at rsp");
+    require(sites[2].Body == stubBody({0x48, 0x89, 0x7c, 0x24, 0x00, 0x48, 0x8b, 0x44, 0x24, 0x10}), "the store before the operand and the operand at rsp were not both moved by the shift");
+}
+
+void skipsLeavesWithOperandsThatCannotMove() {
+    std::vector<std::uint8_t> evex = StoreBelowRsp;
+    append(evex, EvexStoreBelowRsp);
+    std::vector<std::uint8_t> beforeExit = StoreBelowRsp;
+    append(beforeExit, LoadAtRsp);
+    std::vector<std::uint8_t> beforeTarget = StoreBelowRsp;
+    append(beforeTarget, LoadAtRsp);
+    append(beforeTarget, {0xff, 0xc0, 0x3b, 0x44, 0x24, 0xf0, 0x72, 0xf8});
+    const auto input = image({framelessLeaf(FramelessPrologue, evex, FramelessExit), framelessLeaf(FramelessPrologue, beforeExit, FramelessExit), framelessLeaf(FramelessPrologue, beforeTarget, FramelessExit), framelessLeaf({0x41, 0x56, 0x41, 0x57}, StoreBelowRsp, {0x41, 0x5f, 0x41, 0x5e, 0xc3})});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.RedZoneFunctions == 4, "a leaf whose rsp operands can neither move nor be stubbed, or whose prologue is too short, was framed");
+    require(report.Skipped.at("rsp operand that cannot move with rsp") == 1, "an EVEX operand, whose 8-bit displacement is scaled, was not refused");
+    require(report.Skipped.at("rsp operand that cannot move and has no room for a stub") == 2, "an operand at rsp followed by an exit or a branch target was not refused for want of room");
+    require(report.Skipped.at("prologue shorter than a jump") == 1, "the leaf with a short prologue was not reported with its reason");
+}
+
+void skipsLeavesThatCopyRsp() {
+    std::vector<std::uint8_t> withCmov = StoreBelowRsp;
+    append(withCmov, {0x48, 0x0f, 0x45, 0xc4});
+    std::vector<std::uint8_t> withShlx = StoreBelowRsp;
+    append(withShlx, {0xc4, 0xe2, 0xf1, 0xf7, 0xc4});
+    const auto input = image({framelessLeaf(FramelessPrologue, withCmov, FramelessExit), framelessLeaf(FramelessPrologue, withShlx, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.Skipped.at("other use of rsp") == 2, "a leaf that copies rsp into another register was framed");
+}
+
+const std::vector<std::uint8_t> InflatePrologue{0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40};
+const std::vector<std::uint8_t> InflatePops{0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3};
+const std::vector<std::uint8_t> InflateFree{0x48, 0x83, 0xc4, 0x40};
+
+std::vector<std::uint8_t> inflateExit() {
+    std::vector<std::uint8_t> bytes = InflateFree;
+    append(bytes, InflatePops);
+    return bytes;
+}
+
+std::vector<std::uint8_t> inflateBody() {
+    return {
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0x48, 0x89, 0x74, 0x24, 0x08,
+        0x48, 0x89, 0x54, 0x24, 0x38,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+        0x48, 0x03, 0x44, 0x24, 0x08,
+        0x48, 0x03, 0x44, 0x24, 0xe0,
+        0x48, 0x03, 0x44, 0x24, 0x00,
+        0xff, 0xc9,
+        0x75, 0xed,
+        0x48, 0x8b, 0x54, 0x24, 0x38,
+    };
+}
+
+std::vector<std::uint8_t> inflateCompareBody(const std::vector<std::uint8_t>& prior, const std::uint8_t back) {
+    std::vector<std::uint8_t> bytes{
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+        0x48, 0x03, 0x44, 0x24, 0xe0,
+    };
+    append(bytes, prior);
+    append(bytes, {0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, back});
+    return bytes;
+}
+
+const std::vector<std::uint8_t> AddRdiToR8{0x49, 0x01, 0xf8};
+const std::vector<std::uint8_t> CompareRdiAtRspShifted{0x48, 0x39, 0x7c, 0x24, 0x20};
+
+void stubsShortOperandsAtRspBeforeABranchWithTheInstructionsBeforeThem() {
+    const auto withAdd = inflateCompareBody(AddRdiToR8, 0xeb);
+    std::vector<std::uint8_t> withLoad{
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+        0x48, 0x03, 0x44, 0x24, 0xe0,
+        0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xee,
+    };
+    const auto input = image({framelessLeaf(InflatePrologue, withAdd, inflateExit()), framelessLeaf(InflatePrologue, withLoad, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && report.OperandStubs == 2 && report.StubbedOperands == 3 && report.MovedOperands == 5 && sites.size() == 6 && report.Skipped.empty(), "inflate_fast's 4-byte cmp at rsp between an instruction and a branch was not framed with a stub over the instruction before it");
+    const auto add = input.functions[0].Begin + InflatePrologue.size() + 22;
+    require(sites[2].Address == add && sites[2].Length == AddRdiToR8.size() + 4, "the stub site does not start at the add before the cmp at rsp");
+    std::vector<std::uint8_t> addBody = AddRdiToR8;
+    append(addBody, CompareRdiAtRspShifted);
+    require(sites[2].Body == stubBody(addBody), "the add was not copied ahead of the cmp re-encoded with a displacement of the shift");
+    const auto load = input.functions[1].Begin + InflatePrologue.size() + 17;
+    require(sites[5].Address == load && sites[5].Length == 9, "the stub site does not start at the load before the cmp at rsp");
+    std::vector<std::uint8_t> loadBody{0x48, 0x03, 0x44, 0x24, 0x00};
+    append(loadBody, CompareRdiAtRspShifted);
+    require(sites[5].Body == stubBody(loadBody), "the load before the cmp, itself an rsp operand, was not moved by the shift in the stub");
+    for (const auto& displacement : displacements) {
+        const auto at = Base + displacement.Offset;
+        require((at < sites[2].Address || at >= sites[2].Address + sites[2].Length) && (at < sites[5].Address || at >= sites[5].Address + sites[5].Length), "an rsp operand inside a stub site was also moved in place");
+    }
+}
+
+void skipsShortOperandsAtRspWhoseWidenedStubCoversABranchTarget() {
+    std::vector<std::uint8_t> body{
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+    };
+    append(body, AddRdiToR8);
+    append(body, {0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xf3});
+    const auto input = image({framelessLeaf(InflatePrologue, body, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.RedZoneFunctions == 1 && report.Skipped.at("rsp operand that cannot move and has no room for a stub") == 1, "a cmp at rsp whose loop branches back to it was framed with a stub that starts at the add before it");
+}
+
+void framesLeavesThatAllocateBelowTheirPushes() {
+    const auto body = inflateBody();
+    const auto input = image({framelessLeaf(InflatePrologue, body, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.RedZoneFunctions == 1 && report.Framed == 1 && report.FramedWithoutFramePointer == 1 && report.Exits == 1 && sites.size() == 2, "a leaf that allocates with sub after its pushes and spills below its allocation was not framed");
+    const auto& entry = sites[0];
+    require(entry.Address == Base + 0x40 && entry.OriginalBytes == InflatePrologue, "the prologue site does not cover the pushes and the sub");
+    std::vector<std::uint8_t> entryBody = InflatePrologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0xe0, 0xe9, 0, 0, 0, 0});
+    require(entry.Body == entryBody, "the prologue stub does not lower rsp by 0x20 after the sub");
+    const auto& exit = sites[1];
+    require(exit.Address == Base + 0x40 + InflatePrologue.size() + body.size() && exit.OriginalBytes == inflateExit(), "the exit site does not cover the add, the pops and the ret");
+    std::vector<std::uint8_t> exitBody{0x48, 0x8d, 0xa4, 0x24, 0x20, 0, 0, 0};
+    append(exitBody, inflateExit());
+    append(exitBody, {0xe9, 0, 0, 0, 0});
+    require(exit.Body == exitBody, "the exit stub does not raise rsp by 0x20 before the add");
+    const std::vector<std::uint8_t> moved{0x00, 0x20, 0x28, 0x58, 0x28, 0x00, 0x20, 0x58};
+    require(displacements.size() == moved.size() && report.MovedOperands == moved.size(), "not every rsp operand of the allocating leaf was moved");
+    for (std::size_t index = 0; index < moved.size(); ++index)
+        require(displacements[index].Bytes == std::vector<std::uint8_t>{moved[index]}, "an rsp operand of the allocating leaf was not moved by 0x20 from the post-sub rsp");
+    require(displacements[0].Offset == 0x40 + InflatePrologue.size() + 4, "the spill below the allocation was not the first operand moved");
+}
+
+void framesLeavesThatAllocateWithLeaOrALargeSub() {
+    const std::vector<std::uint8_t> leaPrologue{0x53, 0x41, 0x56, 0x48, 0x8d, 0x64, 0x24, 0xc0};
+    const std::vector<std::uint8_t> leaExit{0x48, 0x8d, 0x64, 0x24, 0x40, 0x41, 0x5e, 0x5b, 0xc3};
+    const std::vector<std::uint8_t> largePrologue{0x53, 0x48, 0x81, 0xec, 0x00, 0x01, 0x00, 0x00};
+    const std::vector<std::uint8_t> largeExit{0x48, 0x81, 0xc4, 0x00, 0x01, 0x00, 0x00, 0x5b, 0xc3};
+    std::vector<std::uint8_t> largeBody = StoreBelowRsp;
+    append(largeBody, {0x48, 0x8b, 0x84, 0x24, 0x80, 0x00, 0x00, 0x00});
+    const auto input = image({framelessLeaf(leaPrologue, StoreBelowRsp, leaExit), framelessLeaf(largePrologue, largeBody, largeExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && sites.size() == 4 && displacements.size() == 3, "leaves that allocate with lea or a 32-bit sub were not framed");
+    require(sites[0].OriginalBytes == leaPrologue && sites[1].OriginalBytes == leaExit, "the lea allocation and free are not part of the prologue and exit sites");
+    require(sites[2].OriginalBytes == largePrologue && sites[3].OriginalBytes == largeExit, "the 32-bit sub and add are not part of the prologue and exit sites");
+    require(displacements[2].Bytes == std::vector<std::uint8_t>{0x90, 0x00, 0x00, 0x00}, "the 32-bit displacement into the allocation was not moved by the shift");
+}
+
+void skipsAllocatingLeavesWithoutAMatchingFree() {
+    const std::vector<std::uint8_t> otherFree{0x48, 0x83, 0xc4, 0x30};
+    std::vector<std::uint8_t> wrongFree = otherFree;
+    append(wrongFree, InflatePops);
+    std::vector<std::uint8_t> moreRsp = StoreBelowRsp;
+    append(moreRsp, {0x48, 0x83, 0xec, 0x08});
+    const auto input = image({framelessLeaf(InflatePrologue, StoreBelowRsp, InflatePops), framelessLeaf(InflatePrologue, StoreBelowRsp, wrongFree), framelessLeaf(InflatePrologue, moreRsp, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.RedZoneFunctions == 3, "an allocating leaf without a matching free, or with more rsp arithmetic, was framed");
+    require(report.Skipped.at("exit does not free the prologue's allocation") == 1, "an exit that does not free the allocation was not reported with its own reason");
+    require(report.Skipped.at("other use of rsp") == 2, "an add of another size before the pops, or more rsp arithmetic in the body, was not reported as another use of rsp");
+}
+
+Image calledThenUncalled(const std::vector<std::uint8_t>& called, const std::vector<std::uint8_t>& uncalled) {
+    Image result;
+    result.bytes = callTo(0, 0x40);
+    result.bytes.push_back(0xc3);
+    result.bytes = padTo(result.bytes, 0x40);
+    append(result.bytes, called);
+    result.bytes.resize(0x60, 0x90);
+    append(result.bytes, uncalled);
+    result.bytes = padTo(result.bytes, 0x80);
+    result.segments.push_back({1, 5, 0, Base, Base, result.bytes.size(), result.bytes.size(), 16});
+    result.functions.push_back({Base + 0x40, Base + 0x40 + called.size()});
+    result.functions.push_back({Base + 0x60, Base + 0x60 + uncalled.size()});
+    return result;
+}
+
+void framesEachFunctionFromItsOwnFde() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadBelowRsp);
+    const auto input = calledThenUncalled(framelessLeaf(FramelessPrologue, body, FramelessExit), framelessLeaf(FramelessPrologue, StoreBelowRsp, FramelessExit));
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Functions == 2 && report.Framed == 2 && report.Exits == 2 && sites.size() == 4 && displacements.size() == 3, "two adjacent functions were not framed each by its own FDE");
+    require(sites[0].Address < Base + 0x60 && sites[1].Address + sites[1].Length <= Base + 0x60 && displacements[0].Offset < 0x60 && displacements[1].Offset < 0x60, "the first function's frame runs past its FDE end");
+    require(sites[2].Address == Base + 0x60 && sites[2].OriginalBytes == FramelessPrologue && displacements[2].Offset > 0x60, "the function reached without a call was not framed from its own FDE start");
+}
+
+void treatsATailCallPastTheFdeEndAsLeaving() {
+    std::vector<std::uint8_t> called = FramelessPrologue;
+    append(called, StoreBelowRsp);
+    append(called, {0x85, 0xff, 0x75, 0x06});
+    append(called, FramelessExit);
+    append(called, {0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xe9, 0x02, 0x00, 0x00, 0x00});
+    const auto input = calledThenUncalled(called, framelessLeaf(FramelessPrologue, StoreBelowRsp, FramelessExit));
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Skipped.at("branch leaves the function") == 1, "the tail call past the FDE end was not reported as leaving the function");
+    require(report.Framed == 1 && sites.size() == 2 && sites[0].Address == Base + 0x60, "the tail-called function was not framed from its own FDE start");
+}
+
+void framesALeafAfterAJumpWithoutInt3FromItsOwnFde() {
+    std::vector<std::uint8_t> first = FramelessPrologue;
+    append(first, StoreBelowRsp);
+    append(first, {0x31, 0xc0, 0xeb, 0x06});
+    append(first, FramelessExit);
+    append(first, {0x48, 0x3b, 0x44, 0x24, 0xf0, 0x73, 0xf3, 0x48, 0xff, 0xc0, 0xeb, 0xf4});
+    require(first.size() == 0x20, "the first leaf must end where the second starts");
+    std::vector<std::uint8_t> second = StoreBelowRsp;
+    append(second, LoadBelowRsp);
+    const auto input = calledThenUncalled(first, framelessLeaf(FramelessPrologue, second, FramelessExit));
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && report.Exits == 2 && sites.size() == 4 && displacements.size() == 4, "a leaf right after a jmp without int3 padding was not framed on its own");
+    require(sites[1].Address + sites[1].Length <= Base + 0x60 && displacements[1].Offset < 0x60, "the leaf ending in a jmp took the next leaf into its body");
+    require(sites[2].Address == Base + 0x60 && sites[2].OriginalBytes == FramelessPrologue && displacements[2].Offset > 0x60, "the leaf after the jmp was not framed from its own FDE start");
+}
+
+void keepsColdBlocksAfterARetInsideTheFde() {
+    std::vector<std::uint8_t> leaf = FramelessPrologue;
+    append(leaf, StoreBelowRsp);
+    append(leaf, {0x85, 0xff, 0x74, 0x12});
+    append(leaf, LoadBelowRsp);
+    append(leaf, FramelessExit);
+    append(leaf, {0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00});
+    append(leaf, {0x48, 0x8b, 0x54, 0x24, 0xf0});
+    append(leaf, FramelessExit);
+    const auto input = image({leaf});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.Exits == 2 && sites.size() == 3, "the exit of a cold block after the ret inside the FDE was not framed");
+    require(displacements.size() == 3 && displacements[2].Offset == 0x40 + 0x20 + 4 && displacements[2].Bytes == std::vector<std::uint8_t>{0x00}, "the rsp operand of a cold block after the ret inside the FDE was not moved");
+}
+
+void keepsLoopsAlignedAfterAJump() {
+    std::vector<std::uint8_t> loop = FramelessPrologue;
+    append(loop, StoreBelowRsp);
+    append(loop, {0x31, 0xc0, 0xeb, 0x04, 0x66, 0x90, 0xff, 0xc0, 0x3b, 0x44, 0x24, 0xf0, 0x72, 0xf8});
+    append(loop, FramelessExit);
+    const auto input = image({loop});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && sites.size() == 2 && displacements.size() == 2, "a leaf whose loop header is aligned after a jump was not framed");
+}
+
+void leavesOtherFunctions() {
+    std::vector<std::uint8_t> nonLeaf = Prologue;
+    append(nonLeaf, StoreBelowPushes);
+    append(nonLeaf, {0xff, 0xd0});
+    append(nonLeaf, Exit);
+    const auto input = image({leaf(LoadAbovePushes), nonLeaf});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && report.RedZoneFunctions == 0, "a leaf without red-zone use or a function that calls was framed");
+}
+
+void skipsSitesTakenByOtherStubs() {
+    const auto input = image({leaf(StoreBelowPushes)});
+    Codegen::TrampolineSite other{};
+    other.Address = Base + 0x40;
+    other.Length = 5;
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {other}, report, displacements);
+    require(sites.empty() && report.Skipped.at("overlaps another stub") == 1, "a site over another stub was framed");
+}
+
+void framesAPointerOnlyFunctionByItsOwnBounds() {
+    const auto first = leaf(StoreBelowPushes);
+    std::vector<std::uint8_t> secondBody = StoreBelowPushes;
+    append(secondBody, LoadBelowPushes);
+    const auto second = leaf(secondBody);
+    std::vector<std::uint8_t> bytes = callTo(0, 0x40);
+    bytes.push_back(0xc3);
+    bytes = padTo(bytes, 0x40);
+    append(bytes, first);
+    const auto secondStart = bytes.size();
+    append(bytes, second);
+    bytes = padTo(bytes, (bytes.size() + 15) / 16 * 16 + 16);
+    const std::vector<Domain::ProgramHeader> segments{{1, 5, 0, Base, Base, bytes.size(), bytes.size(), 16}};
+    const std::vector<Codegen::RedZoneFunction> functions{{Base + 0x40, Base + 0x40 + first.size()}, {Base + secondStart, Base + secondStart + second.size()}};
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(bytes, segments, functions, {}, report, displacements);
+    require(report.Functions == 2 && report.Framed == 2 && report.Exits == 2, "a function reached only through a pointer was not framed by its own bounds");
+    require(sites.size() == 4, "two framed leaves need two prologue and two exit sites");
+    require(sites[2].Address == Base + secondStart && sites[2].OriginalBytes == Prologue, "the second function's prologue site is not at its own start");
+    require(sites[1].Address + sites[1].Length == Base + 0x40 + first.size(), "the first function's exit runs past its end");
+}
+
+void leavesCodeWithoutAFunctionRange() {
+    const auto input = image({leaf(StoreBelowPushes)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, {}, {}, report, displacements);
+    require(sites.empty() && report.Functions == 0, "code without a function range was framed");
+}
+
+}
+
+int main() {
+    try {
+        framesRedZoneLeaf();
+        leavesOtherFunctions();
+        skipsSitesTakenByOtherStubs();
+        framesLeafWithoutFramePointer();
+        shiftsByTheDeepestOperandBelowRsp();
+        movesPositiveOperandsThatFitAfterTheShift();
+        shiftsByTheWholeRedZoneForAddressesBelowRsp();
+        shiftsByTheWholeRedZoneForIndexedOperands();
+        framesLeavesThatAllocateBelowTheirPushes();
+        framesLeavesThatAllocateWithLeaOrALargeSub();
+        skipsAllocatingLeavesWithoutAMatchingFree();
+        stubsOperandsWhoseDisplacementOverflows();
+        stubsOperandsAtRspWithTheInstructionsAfterThem();
+        stubsVexOperandsAtRsp();
+        stubsOperandsAtRspWithTheInstructionsBeforeThem();
+        stubsShortOperandsAtRspBeforeABranchWithTheInstructionsBeforeThem();
+        skipsShortOperandsAtRspWhoseWidenedStubCoversABranchTarget();
+        skipsLeavesWithOperandsThatCannotMove();
+        skipsLeavesThatCopyRsp();
+        framesEachFunctionFromItsOwnFde();
+        treatsATailCallPastTheFdeEndAsLeaving();
+        framesALeafAfterAJumpWithoutInt3FromItsOwnFde();
+        keepsColdBlocksAfterARetInsideTheFde();
+        keepsLoopsAlignedAfterAJump();
+        framesAPointerOnlyFunctionByItsOwnBounds();
+        leavesCodeWithoutAFunctionRange();
+        std::cout << "red-zone framer tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << "red-zone framer tests failed: " << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/codegen/tests/RewriteBoundaryTests.cpp b/core/relinker/codegen/tests/RewriteBoundaryTests.cpp
index fa9ee00553..66a6ed2fc6 100644
--- a/core/relinker/codegen/tests/RewriteBoundaryTests.cpp
+++ b/core/relinker/codegen/tests/RewriteBoundaryTests.cpp
@@ -2,26 +2,124 @@
 #include <iostream>
 #include <stdexcept>
 
-static void Require(bool ok) { if (!ok) throw std::runtime_error("Invalid rewrite boundary accepted"); }
+static void Require(bool ok) {
+    if (!ok)
+        throw std::runtime_error("Invalid rewrite boundary accepted");
+}
+
+static void RequireTruncatedBranchRejected(bool ok) {
+    if (!ok)
+        throw std::runtime_error(
+            "Length-changing rewrite accepted a section with a truncated relative branch");
+}
 
 int main() {
     try {
         const Codegen::X64InstructionRewriter rewriter;
-        for (const auto& code : {std::vector<std::uint8_t>{0xB8, 0x90, 0x90, 0x90, 0x90, 0xC3},
-                               std::vector<std::uint8_t>{0x48, 0x8B, 0x05, 0x90, 0x90, 0x90, 0x90, 0xC3},
-                               std::vector<std::uint8_t>{0xE8, 0x90, 0x90, 0x90, 0x90, 0xC3}}) {
+
+        for (const auto& code : {
+                 std::vector<std::uint8_t>{
+                     0xB8, 0x90, 0x90, 0x90, 0x90, 0xC3},
+                 std::vector<std::uint8_t>{
+                     0x48, 0x8B, 0x05, 0x90, 0x90, 0x90, 0x90, 0xC3},
+                 std::vector<std::uint8_t>{
+                     0xE8, 0x90, 0x90, 0x90, 0x90, 0xC3}
+             }) {
             const auto original = code;
-            for (std::size_t offset = 1; offset + 1 < code.size(); ++offset) {
+
+            for (std::size_t offset = 1;
+                 offset + 1 < code.size();
+                 ++offset) {
                 bool rejected = false;
-                try { (void)rewriter.Rewrite(code, {offset, {0x90}}); }
-                catch (const std::exception&) { rejected = true; }
+
+                try {
+                    (void)rewriter.Rewrite(code, {offset, {0x90}});
+                } catch (const std::exception&) {
+                    rejected = true;
+                }
+
                 Require(rejected && code == original);
             }
+
             const auto result = rewriter.Rewrite(code, {0, {0x90}});
-            Require(result.Bytes == std::vector<std::uint8_t>{0x90, 0xC3});
+
+            Require(result.Bytes == std::vector<std::uint8_t>{
+                0x90, 0xC3});
         }
-        const auto result = rewriter.Rewrite({0x90, 0x90, 0xC3}, {1, {0x90, 0x90}});
-        Require(result.Bytes == std::vector<std::uint8_t>{0x90, 0x90, 0x90, 0xC3});
-        std::cout << "18 rewrite boundary cases passed\n";
-    } catch (const std::exception& error) { std::cerr << error.what() << '\n'; return 1; }
+
+        const auto result = rewriter.Rewrite(
+            {0x90, 0x90, 0xC3},
+            {1, {0x90, 0x90}});
+
+        Require(result.Bytes == std::vector<std::uint8_t>{
+            0x90, 0x90, 0x90, 0xC3});
+
+        bool targetInsideCutRejected = false;
+        try {
+            (void)rewriter.Rewrite(
+                {0xEB, 0x01, 0xB8, 0x11, 0x22, 0x33, 0x44, 0xC3},
+                {2, {0x90}});
+        } catch (const std::exception&) {
+            targetInsideCutRejected = true;
+        }
+        Require(targetInsideCutRejected);
+
+        for (const auto& code : {
+                 std::vector<std::uint8_t>{
+                     0x66, 0xEB, 0x01, 0x90, 0xC3},
+                 std::vector<std::uint8_t>{
+                     0x90, 0x66, 0xEB, 0xFC, 0xC3}
+             }) {
+            bool rejected = false;
+
+            try {
+                const auto offset =
+                    code[0] == 0x66 ? std::size_t{3} : std::size_t{0};
+
+                (void)rewriter.Rewrite(code, {offset, {0x66, 0x90}});
+            } catch (const std::exception&) {
+                rejected = true;
+            }
+
+            RequireTruncatedBranchRejected(rejected);
+        }
+
+        const auto unaffected = rewriter.Rewrite(
+            {0x66, 0xEB, 0x00, 0x90, 0x90, 0xC3},
+            {4, {0x66, 0x90}});
+
+        Require(unaffected.Bytes == std::vector<std::uint8_t>{
+            0x66, 0xEB, 0x00, 0x90, 0x66, 0x90, 0xC3});
+
+        std::vector<std::uint8_t> forwardWraparound(0x10004, 0x90);
+        forwardWraparound[0xFFFA] = 0x66;
+        forwardWraparound[0xFFFB] = 0xEB;
+        forwardWraparound[0xFFFC] = 0x03;
+
+        bool forwardWraparoundRejected = false;
+        try {
+            (void)rewriter.Rewrite(forwardWraparound, {10, {0x66, 0x90}});
+        } catch (const std::exception&) {
+            forwardWraparoundRejected = true;
+        }
+        RequireTruncatedBranchRejected(forwardWraparoundRejected);
+
+        std::vector<std::uint8_t> backwardWraparound(0x10004, 0x90);
+        backwardWraparound[0] = 0x66;
+        backwardWraparound[1] = 0xEB;
+        backwardWraparound[2] = 0xFC;
+
+        bool backwardWraparoundRejected = false;
+        try {
+            (void)rewriter.Rewrite(backwardWraparound, {0xFFFE, {0x66, 0x90}});
+        } catch (const std::exception&) {
+            backwardWraparoundRejected = true;
+        }
+        RequireTruncatedBranchRejected(backwardWraparoundRejected);
+
+        std::cout << "22 rewrite boundary cases passed\n";
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
 }
diff --git a/core/relinker/domain/include/domain/Types.hpp b/core/relinker/domain/include/domain/Types.hpp
index 6757f8507a..d08f990328 100644
--- a/core/relinker/domain/include/domain/Types.hpp
+++ b/core/relinker/domain/include/domain/Types.hpp
@@ -69,6 +69,7 @@ struct NidReference {
     std::int64_t Addend;
     bool Weak = false;
     bool Function = false;
+    std::uint8_t SymbolType = 0;
 };
 
 struct CallSiteInfo {
diff --git a/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp b/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp
index 9da009bc08..b8b6b853b6 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp
@@ -139,20 +139,14 @@ inline constexpr std::int64_t DT_OS_SYMTABSZ = 0x6100003f;
 inline constexpr std::uint32_t R_X86_64_NONE = 0;
 inline constexpr std::uint32_t R_X86_64_64 = 1;
 inline constexpr std::uint32_t R_X86_64_PC32 = 2;
-inline constexpr std::uint32_t R_X86_64_GOT32 = 3;
-inline constexpr std::uint32_t R_X86_64_PLT32 = 4;
 inline constexpr std::uint32_t R_X86_64_COPY = 5;
 inline constexpr std::uint32_t R_X86_64_GLOB_DAT = 6;
 inline constexpr std::uint32_t R_X86_64_JUMP_SLOT = 7;
 inline constexpr std::uint32_t R_X86_64_RELATIVE = 8;
-inline constexpr std::uint32_t R_X86_64_GOTPCREL = 9;
 inline constexpr std::uint32_t R_X86_64_32 = 10;
-inline constexpr std::uint32_t R_X86_64_32S = 11;
 inline constexpr std::uint32_t R_X86_64_DTPMOD64 = 16;
 inline constexpr std::uint32_t R_X86_64_DTPOFF64 = 17;
 inline constexpr std::uint32_t R_X86_64_TPOFF64 = 18;
-inline constexpr std::uint32_t R_X86_64_GOTPCRELX = 41;
-inline constexpr std::uint32_t R_X86_64_REX_GOTPCRELX = 42;
 inline constexpr std::uint32_t R_X86_64_IRELATIVE = 37;
 
 inline constexpr std::uint8_t STB_GLOBAL = 1;
@@ -170,6 +164,7 @@ inline constexpr std::uint32_t SHT_PROGBITS = 1;
 inline constexpr std::uint32_t SHT_SYMTAB = 2;
 inline constexpr std::uint32_t SHT_STRTAB = 3;
 inline constexpr std::uint32_t SHT_DYNAMIC = 6;
+inline constexpr std::uint32_t SHT_NOBITS = 8;
 inline constexpr std::uint32_t SHT_DYNSYM = 11;
 inline constexpr std::uint32_t SHF_WRITE = 0x1;
 inline constexpr std::uint32_t SHF_ALLOC = 0x2;
diff --git a/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp b/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp
index 5ca491e9bf..1dcc28bbd0 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp
@@ -9,7 +9,7 @@ namespace Elfpatcher {
 
 class GuestModuleWriter {
 public:
-    std::vector<std::uint8_t> WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath) const;
+    std::vector<std::uint8_t> WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath, bool deferInitialization = false) const;
     std::vector<std::uint8_t> WriteWindows(const Relinker::GuestImage& image, Domain::GuestRuntime& runtime, const std::function<void(std::string_view)>& message = {}) const;
     std::vector<std::uint8_t> WriteMacOs(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath, const std::function<void(std::string_view)>& message = {}) const;
 };
diff --git a/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsImage.hpp b/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsImage.hpp
index 99bc214e54..a93699a4bf 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsImage.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsImage.hpp
@@ -41,6 +41,12 @@ struct MacOsTlsExport {
     std::uint64_t Flags = 0;
 };
 
+struct MacOsTraceImport {
+    std::uint32_t Rva;
+    std::string Name;
+    std::string Library;
+};
+
 struct MacOsImageInput {
     bool Executable = true;
     std::string InstallName;
@@ -61,6 +67,8 @@ struct MacOsImageInput {
     std::vector<MacOsTlsImport> TlsImports;
     std::vector<MacOsTlsExport> TlsExports;
     const std::vector<Codegen::TrampolineSite>* Trampolines = nullptr;
+    bool TraceImports = false;
+    std::vector<MacOsTraceImport> Traced;
     std::function<void(std::string_view)> Message;
 };
 
diff --git a/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsMachOPatcher.hpp b/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsMachOPatcher.hpp
index 2f2ffbc485..78b0e33997 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsMachOPatcher.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/macos/MacOsMachOPatcher.hpp
@@ -11,7 +11,7 @@ namespace Elfpatcher::MacOs {
 
 class MacOsMachOPatcher final : public IElfPatcher {
 public:
-    explicit MacOsMachOPatcher(std::optional<std::uint64_t> fixedBase = std::nullopt, std::function<void(std::string_view)> message = {});
+    explicit MacOsMachOPatcher(std::optional<std::uint64_t> fixedBase = std::nullopt, std::function<void(std::string_view)> message = {}, bool traceImports = false);
 
     std::vector<std::uint8_t> Patch(
         std::vector<std::uint8_t> sourceElf,
@@ -27,6 +27,7 @@ public:
 private:
     std::optional<std::uint64_t> fixedBase;
     std::function<void(std::string_view)> message;
+    bool traceImports;
 };
 
 }
diff --git a/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeFormat.hpp b/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeFormat.hpp
index 790dfdf3ae..c9436e4915 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeFormat.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeFormat.hpp
@@ -13,6 +13,7 @@ inline constexpr std::uint32_t SectionAlignment = 0x1000;
 inline constexpr std::uint32_t FileAlignment = 0x200;
 inline constexpr std::uint32_t LoadRva = 0x10000;
 inline constexpr std::uint64_t ImageBase = 0x140000000;
+inline constexpr std::uint64_t ExecutableBase = 0x400000;
 inline constexpr std::uint32_t SectionRead = 0x40000000;
 inline constexpr std::uint32_t SectionWrite = 0x80000000;
 inline constexpr std::uint32_t SectionExecute = 0x20000000;
diff --git a/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeWriter.hpp b/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeWriter.hpp
index db44e19058..46e9e66fed 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeWriter.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/windows/WindowsPeWriter.hpp
@@ -2,13 +2,12 @@
 #define ELFPATCHER_WINDOWS_PEWRITER_HPP
 
 #include <elfpatcher/windows/WindowsPeFormat.hpp>
-#include <optional>
 
 namespace Elfpatcher::Windows {
 
 class WindowsPeWriter {
 public:
-    std::vector<std::uint8_t> Write(const std::vector<PeSection>& sections, std::uint32_t entryRva, const std::array<PeDirectory, 16>& directories, bool windowsGui = false, std::optional<std::uint64_t> fixedImageBase = std::nullopt, bool dynamicBase = true) const;
+    std::vector<std::uint8_t> Write(const std::vector<PeSection>& sections, std::uint32_t entryRva, const std::array<PeDirectory, 16>& directories, bool windowsGui = false, std::uint64_t imageBase = ImageBase, bool fixedBase = false, bool dynamicBase = true) const;
 };
 
 }
diff --git a/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp b/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp
index fc23e28dea..f53da5a100 100644
--- a/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp
+++ b/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp
@@ -13,6 +13,8 @@ namespace Elfpatcher {
 
 namespace {
 
+constexpr std::size_t kExtendedProgramHeaderCount = 0xffff;
+
 bool hasWritableLoadCoverage(
     const std::vector<Domain::ProgramHeader>& headers,
     const Domain::ProgramHeader& relro
@@ -152,6 +154,8 @@ std::vector<Domain::ProgramHeader> ProgramHeaderLayoutBuilder::_outputHeaders(co
     auto kept = _keptHeaders(originalHeaders);
     if (std::none_of(kept.begin(), kept.end(), [](const Domain::ProgramHeader& ph) { return ph.Type == PT_GNU_STACK; }))
         kept.push_back(Domain::ProgramHeader{PT_GNU_STACK, PF_R | PF_W, 0, 0, 0, 0, 0, 16});
+    if (kept.size() >= kExtendedProgramHeaderCount - kSyntheticProgramHeaderCount)
+        throw Domain::RelinkerException("Extended program header counts are not supported");
     return kept;
 }
 
diff --git a/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp b/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp
index e07068514f..ec6ea6cb35 100644
--- a/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp
+++ b/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp
@@ -103,6 +103,7 @@ void SectionHeaderTableBuilder::WriteTable(
     for (const char i : kShStrTabBlob)
         buf.push_back(static_cast<std::uint8_t>(i));
 
+    Io::AlignBuffer(buf, std::size_t{8});
     const auto shOff = static_cast<std::uint64_t>(buf.size());
     buf.resize(buf.size() + kShdrEntrySize * kSectionHeaderCount, 0);
 
diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index 7453d82aca..c2e89787cc 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -22,6 +22,8 @@ namespace Elfpatcher::Linux {
 namespace {
 
 constexpr std::uint64_t kLinuxUserAddressEnd = 0x800000000000;
+constexpr std::uint64_t kLazyPltGotBytes = 24;
+constexpr std::uint64_t kPltGotEntryBytes = 8;
 
 std::string Hex(const std::uint64_t value) {
     std::ostringstream text;
@@ -81,11 +83,9 @@ std::vector<std::uint8_t> RebasedRelocations(const std::vector<std::uint8_t>& ta
         }
         case R_X86_64_64:
         case R_X86_64_PC32:
-        case R_X86_64_COPY:
         case R_X86_64_GLOB_DAT:
         case R_X86_64_JUMP_SLOT:
         case R_X86_64_32:
-        case R_X86_64_32S:
         case R_X86_64_DTPMOD64:
         case R_X86_64_DTPOFF64:
         case R_X86_64_TPOFF64:
@@ -103,6 +103,19 @@ void RequireFileRange(const std::vector<std::uint8_t>& buf, const Domain::Progra
         throw Domain::RelinkerException("PT_LOAD at " + Hex(load.MappedAddress) + " has file bytes outside the input");
 }
 
+void RequireLoaded(const std::vector<Domain::ProgramHeader>& headers, const std::uint64_t address, const std::uint64_t size, const std::uint32_t flags, const std::string& what) {
+    for (const auto& header : headers)
+        if (header.Type == PT_LOAD && (header.Flags == 0 || (header.Flags & flags) == flags) && address >= header.MappedAddress && address - header.MappedAddress < header.MemorySize && size <= header.MemorySize - (address - header.MappedAddress))
+            return;
+    const auto range = size > 1 ? " (" + std::to_string(size) + " bytes) does not fit inside " : std::string(" is not inside ");
+    throw Domain::RelinkerException(what + " " + Hex(address) + range + ((flags & PF_X) != 0 ? "an executable" : "a") + " PT_LOAD segment");
+}
+
+std::uint64_t RelocationWidth(const std::vector<std::uint8_t>& relocations, const std::size_t entry) {
+    const auto type = static_cast<std::uint32_t>(Io::ReadU64(relocations, entry + 8));
+    return type == R_X86_64_PC32 || type == R_X86_64_32 ? 4 : 8;
+}
+
 void SeparateSharedLoadPages(std::vector<std::uint8_t>& buf, std::vector<Domain::ProgramHeader>& headers) {
     std::vector<std::size_t> loads;
     for (std::size_t index = 0; index < headers.size(); ++index) {
@@ -114,6 +127,11 @@ void SeparateSharedLoadPages(std::vector<std::uint8_t>& buf, std::vector<Domain:
     std::stable_sort(loads.begin(), loads.end(), [&headers](const std::size_t left, const std::size_t right) {
         return headers[left].MappedAddress < headers[right].MappedAddress;
     });
+    for (std::size_t position = 1; position < loads.size(); ++position) {
+        const auto& previous = headers[loads[position - 1]];
+        if (headers[loads[position]].MappedAddress - previous.MappedAddress < previous.MemorySize)
+            throw Domain::RelinkerException("Overlapping PT_LOAD memory ranges", headers[loads[position]].MappedAddress);
+    }
     for (std::size_t position = 0; position < loads.size(); ++position) {
         auto& load = headers[loads[position]];
         const auto prefix = load.MappedAddress % kDefaultLoadAlignment;
@@ -348,6 +366,8 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
     const std::vector<Codegen::TrampolineSite>& trampolines)
 {
     const auto dynSection = ImportsByNid(sourceDynSection);
+    if (runPath.empty() || runPath.front() == ':' || runPath.back() == ':' || runPath.find("::") != std::string::npos)
+        throw Domain::RelinkerException("Empty Linux run path component is not supported");
     if (dependencyDiagnostics)
         throw Domain::RelinkerException("Linux target does not support --windows-diagnostics");
     if (_fixedBase && lazyBinding)
@@ -358,6 +378,12 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
         throw Domain::RelinkerException("--trace-imports requires libc.prx among the libraries");
     if (_fixedBase)
         RequireOnlyDependencies(dynSection.DynamicSegmentData);
+    RequireLoaded(originalHeaders, Io::ReadU64(sourceElf, kEhdrEntryOffset), 1, PF_X, "e_entry");
+    for (const auto& [relocationTable, name] : {std::pair{&dynSection.RelaData, "RELA r_offset"}, std::pair{&dynSection.RelaPltData, "JMPREL r_offset"}})
+        for (std::size_t entry = 0; entry < relocationTable->size(); entry += kRelaEntrySize)
+            RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry), 0, name);
+    if (!dynSection.RelaPltData.empty())
+        RequireLoaded(originalHeaders, originalPltGotVaddr, lazyBinding ? kLazyPltGotBytes : kPltGotEntryBytes, 0, "DT_PLTGOT");
     const auto traced = _traceImports ? TracedImports(dynSection) : std::vector<TracedImport>{};
     const std::uint64_t base = _fixedBase.value_or(0);
     const auto address = [this, base](const std::uint64_t vaddr) {
diff --git a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp
index 76b91f97dc..316a1cc318 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp
@@ -9,7 +9,7 @@
 
 namespace Elfpatcher {
 
-std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath) const {
+std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath, const bool deferInitialization) const {
     auto bytes = image.Bytes;
     std::vector<Domain::ProgramHeader> headers;
     std::uint64_t end = 0;
@@ -35,7 +35,7 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
     const auto extraOffset = bytes.size();
     const auto extraAddress = Io::AlignUp64(end, 0x4000);
     const auto address = [&] { return extraAddress + bytes.size() - extraOffset; };
-    const bool passesModuleArgs = image.HasInit;
+    const bool passesModuleArgs = image.HasInit && !deferInitialization;
     std::uint64_t argsSlot = 0;
     std::uint64_t resultSlot = 0;
     if (passesModuleArgs) {
@@ -83,6 +83,39 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
         Io::WriteU64(relaData, entry, slot);
         Io::WriteU64(relaData, entry + 8, (symbol << 32) | kGlobDat);
     };
+    std::uint64_t lifecycleTable = 0;
+    if (deferInitialization) {
+        constexpr char exportName[] = "__aps5_guest_lifecycle_nid_no_patch";
+        if (std::any_of(image.Symbols.begin(), image.Symbols.end(), [&](const auto& symbol) { return symbol.Name == exportName; }))
+            throw Domain::RelinkerException("Reserved guest lifecycle export is already present");
+        Io::AlignBuffer(bytes, 8);
+        lifecycleTable = address();
+        const auto pointer = [&](std::uint64_t target, bool relocate = true) {
+            const auto slot = address();
+            Io::AppendU64(bytes, 0);
+            if (!relocate) return;
+            Io::AppendU64(relaData, slot);
+            Io::AppendU64(relaData, 8);
+            Io::AppendU64(relaData, target);
+        };
+        Io::AppendU64(bytes, 0x415053354c494658ull);
+        pointer(0);
+        pointer(image.Init, image.HasInit);
+        pointer(image.Fini, image.Fini != 0);
+        Io::AppendU64(bytes, image.InitArray.size());
+        Io::AppendU64(bytes, image.FiniArray.size());
+        Io::AppendU64(bytes, 0);
+        Io::AppendU64(bytes, 0);
+        for (const auto slot : image.InitArray) pointer(slot);
+        for (const auto slot : image.FiniArray) pointer(slot);
+        const auto entry = symbols.size();
+        symbols.resize(entry + 24, 0);
+        Io::WriteU32(symbols, entry, addString(exportName));
+        symbols[entry + 4] = 0x11;
+        Io::WriteU16(symbols, entry + 6, 1);
+        Io::WriteU64(symbols, entry + 8, lifecycleTable);
+        Io::WriteU64(symbols, entry + 16, address() - lifecycleTable);
+    }
     if (passesModuleArgs) {
         argsImport = addUndefinedImport("__aps5_get_pending_module_args_nid_no_patch");
         resultImport = addUndefinedImport("__aps5_set_module_init_result_nid_no_patch");
@@ -156,8 +189,33 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
         Io::AppendU32(bytes, static_cast<std::uint32_t>(distance));
         return start;
     };
-    const auto init = lifecycle(image.Init);
-    const auto fini = finalizer(image.Fini);
+    const auto init = deferInitialization ? 0 : lifecycle(image.Init);
+    auto fini = deferInitialization ? 0 : finalizer(image.Fini);
+    if (deferInitialization && (image.Fini != 0 || !image.FiniArray.empty())) {
+        fini = address();
+        bytes.insert(bytes.end(), {0x48, 0x83, 0x3d});
+        Io::AppendU32(bytes, stubDisplacement(lifecycleTable + 48, address() + 5));
+        bytes.push_back(2);
+        bytes.insert(bytes.end(), {0x0f, 0x85});
+        const auto skip = bytes.size();
+        Io::AppendU32(bytes, 0);
+        bytes.insert(bytes.end(), {0x48, 0xc7, 0x05});
+        Io::AppendU32(bytes, stubDisplacement(lifecycleTable + 48, address() + 8));
+        Io::AppendU32(bytes, 4);
+        bytes.insert(bytes.end(), {0x48, 0x83, 0xec, 8});
+        for (auto slot = image.FiniArray.rbegin(); slot != image.FiniArray.rend(); ++slot) {
+            bytes.insert(bytes.end(), {0x48, 0x8b, 0x05});
+            Io::AppendU32(bytes, stubDisplacement(*slot, address() + 4));
+            bytes.insert(bytes.end(), {0x48, 0x85, 0xc0, 0x74, 8, 0x31, 0xff, 0x31, 0xf6, 0x31, 0xd2, 0xff, 0xd0});
+        }
+        if (image.Fini != 0) {
+            bytes.insert(bytes.end(), {0x31, 0xff, 0x31, 0xf6, 0x31, 0xd2, 0xe8});
+            Io::AppendU32(bytes, stubDisplacement(image.Fini, address() + 4));
+        }
+        bytes.insert(bytes.end(), {0x48, 0x83, 0xc4, 8});
+        Io::WriteU32(bytes, skip, static_cast<std::uint32_t>(bytes.size() - skip - 4));
+        bytes.push_back(0xc3);
+    }
     Io::AlignBuffer(bytes, 8);
     const auto dynamicOffset = bytes.size();
     const auto dynamicAddress = address();
@@ -181,8 +239,8 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
         tag(20, 7);
         tag(3, image.Got);
     }
-    if (!image.InitArray.empty()) { tag(25, image.InitArray.front()); tag(27, image.InitArray.size() * 8); }
-    if (!image.FiniArray.empty()) { tag(26, image.FiniArray.front()); tag(28, image.FiniArray.size() * 8); }
+    if (!deferInitialization && !image.InitArray.empty()) { tag(25, image.InitArray.front()); tag(27, image.InitArray.size() * 8); }
+    if (!deferInitialization && !image.FiniArray.empty()) { tag(26, image.FiniArray.front()); tag(28, image.FiniArray.size() * 8); }
     if (init != 0) tag(12, init);
     if (fini != 0) tag(13, fini);
     tag(30, DF_BIND_NOW | (image.Symbolic ? DF_SYMBOLIC : 0));
diff --git a/core/relinker/elfpatcher/src/macos/MacOsImage.cpp b/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
index 43a00cd7af..e0e2648f1f 100644
--- a/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
+++ b/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
@@ -8,6 +8,7 @@
 #include <algorithm>
 #include <bit>
 #include <iomanip>
+#include <initializer_list>
 #include <limits>
 #include <map>
 #include <memory>
@@ -87,11 +88,47 @@ constexpr std::uint8_t EntryStub[] = {
     0x4c, 0xc4, 0x08, 0x49, 0xff, 0xc0, 0xeb, 0xed, 0x48, 0xc7, 0x44, 0xfc, 0x08, 0x00, 0x00, 0x00,
     0x00, 0x4c, 0x8d, 0x54, 0xfc, 0x10, 0x45, 0x31, 0xc0, 0x49, 0x39, 0xc8, 0x74, 0x0d, 0x4e, 0x8b,
     0x0c, 0xc2, 0x4f, 0x89, 0x0c, 0xc2, 0x49, 0xff, 0xc0, 0xeb, 0xee, 0x49, 0xc7, 0x04, 0xca, 0x00,
-    0x00, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x48, 0x8d, 0x3d, 0x00, 0x00, 0x00, 0x00, 0xff, 0x15, 0x00,
-    0x00, 0x00, 0x00, 0x0f, 0x0b,
+    0x00, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x48, 0x8d, 0x3d, 0x00, 0x00, 0x00, 0x00, 0x48, 0x83, 0xec,
+    0x10, 0x0f, 0xae, 0x1c, 0x24, 0xc7, 0x44, 0x24, 0x04, 0xc0, 0x9f, 0x00, 0x00, 0x0f, 0xae, 0x54,
+    0x24, 0x04, 0xff, 0x15, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xae, 0x14, 0x24, 0x48, 0x83, 0xc4, 0x10,
+    0x0f, 0x0b,
 };
 constexpr std::size_t EntryStubEntryDisplacement = 0x69;
-constexpr std::size_t EntryStubStartDisplacement = 0x6f;
+constexpr std::size_t EntryStubStartDisplacement = 0x84;
+
+struct MacOsTracePrologue {
+    std::vector<std::uint8_t> Bytes;
+    std::size_t EntryDisplacement;
+};
+
+MacOsTracePrologue BuildTracePrologue(const std::uint32_t prologueRva, const std::uint32_t tableRva, const std::uint32_t tableEndRva, const std::uint32_t functionSlotRva) {
+    std::vector<std::uint8_t> code = {0x57, 0x56, 0x52, 0x51, 0x53, 0x41, 0x54, 0x48, 0x83, 0xec, 0x08};
+    const auto rip = [&](const std::initializer_list<std::uint8_t> opcode, const std::uint32_t target) {
+        code.insert(code.end(), opcode);
+        const auto displacement = static_cast<std::int64_t>(target) - static_cast<std::int64_t>(prologueRva + code.size() + 4);
+        if (displacement < std::numeric_limits<std::int32_t>::min() || displacement > std::numeric_limits<std::int32_t>::max())
+            throw Domain::RelinkerException("Import trace stub exceeds rel32 range");
+        Io::AppendU32(code, static_cast<std::uint32_t>(displacement));
+    };
+    rip({0x48, 0x8d, 0x1d}, tableRva);
+    rip({0x4c, 0x8d, 0x25}, tableEndRva);
+    const auto loop = code.size();
+    code.insert(code.end(), {0x4c, 0x39, 0xe3, 0x73, 0x00});
+    const auto exit = code.size();
+    code.insert(code.end(), {0x48, 0x8b, 0x03, 0x48, 0x8b, 0x3c, 0x03, 0x48, 0x8b, 0x73, 0x08, 0x48, 0x01, 0xde, 0x48, 0x8b, 0x53, 0x10, 0x48, 0x01, 0xda});
+    rip({0xff, 0x15}, functionSlotRva);
+    code.insert(code.end(), {0x48, 0x8b, 0x0b, 0x48, 0x89, 0x04, 0x0b, 0x48, 0x83, 0xc3, 0x18, 0xeb});
+    const auto back = static_cast<std::int64_t>(loop) - static_cast<std::int64_t>(code.size() + 1);
+    if (back < -128 || back > 127)
+        throw Domain::RelinkerException("Import trace loop exceeds rel8 range");
+    code.push_back(static_cast<std::uint8_t>(static_cast<std::int8_t>(back)));
+    if (code.size() - exit > 127)
+        throw Domain::RelinkerException("Import trace loop exceeds rel8 range");
+    code[exit - 1] = static_cast<std::uint8_t>(code.size() - exit);
+    code.insert(code.end(), {0x48, 0x83, 0xc4, 0x08, 0x41, 0x5c, 0x5b, 0x59, 0x5a, 0x5e, 0x5f, 0xe9, 0x00, 0x00, 0x00, 0x00});
+    const auto entry = code.size() - 4;
+    return {std::move(code), entry};
+}
 
 struct Section {
     std::string Name;
@@ -423,6 +460,9 @@ std::vector<std::uint8_t> WriteMacOsImage(MacOsImageInput& input) {
     const auto guestSegments = segments.size();
     auto sections = image.BuildSections();
     for (const auto& trap : tls.GsTraps) {
+        const auto target = tls.BranchTargets.upper_bound(trap.Rva);
+        if (target != tls.BranchTargets.end() && *target < trap.Rva + trap.Length)
+            throw Domain::RelinkerException("Branch enters a guest GS instruction", *target);
         if (input.Trampolines != nullptr) {
             for (const auto& site : *input.Trampolines) {
                 const auto siteRva = image.GetRva(site.Address, site.Length);
@@ -486,7 +526,8 @@ std::vector<std::uint8_t> WriteMacOsImage(MacOsImageInput& input) {
     const auto descriptor = metaRva + static_cast<std::uint32_t>(MetaTlsDescriptor);
     const auto initPointer = AlignUp(metaSize, 8);
     const auto startSlot = initPointer + 8;
-    const auto tlsExports = startSlot + 8;
+    const auto traceFunctionSlot = input.TraceImports ? startSlot + 8 : startSlot;
+    const auto tlsExports = traceFunctionSlot + 8;
     std::map<std::string, std::uint64_t> tlsImportSlots;
     for (const auto& import : input.TlsImports) tlsImportSlots.emplace(import.Symbol, 0);
     auto metaEnd = tlsExports + input.TlsExports.size() * 16;
@@ -661,6 +702,44 @@ std::vector<std::uint8_t> WriteMacOsImage(MacOsImageInput& input) {
     }
     if (input.Executable) {
         input.Binds.push_back({"_Aps5StartGuest_nid_no_patch", metaRva + static_cast<std::uint32_t>(startSlot)});
+        if (input.TraceImports)
+            input.Binds.push_back({"_TraceImport_nid_no_patch", metaRva + static_cast<std::uint32_t>(traceFunctionSlot)});
+    }
+    std::size_t traceEntryPatch = 0;
+    std::uint32_t tracePrologueRva = 0;
+    if (input.Executable && input.TraceImports) {
+        const auto tableRva = code.GetRva();
+        const auto tableEnd = tableRva + static_cast<std::uint32_t>(input.Traced.size() * 24);
+        std::map<std::string, std::uint32_t> stringRva;
+        std::vector<std::string> stringOrder;
+        auto cursor = tableEnd;
+        const auto intern = [&](const std::string& text) {
+            const auto existing = stringRva.find(text);
+            if (existing != stringRva.end()) return existing->second;
+            stringRva.emplace(text, cursor);
+            stringOrder.push_back(text);
+            cursor += static_cast<std::uint32_t>(text.size() + 1);
+            return stringRva.at(text);
+        };
+        std::vector<std::uint8_t> table;
+        for (std::size_t index = 0; index < input.Traced.size(); ++index) {
+            const auto entry = tableRva + static_cast<std::uint32_t>(index * 24);
+            const auto relative = [entry](const std::uint32_t target) { return static_cast<std::uint64_t>(static_cast<std::int64_t>(target) - static_cast<std::int64_t>(entry)); };
+            Io::AppendU64(table, relative(input.Traced[index].Rva));
+            Io::AppendU64(table, relative(intern(input.Traced[index].Name)));
+            Io::AppendU64(table, relative(intern(input.Traced[index].Library)));
+        }
+        for (const auto byte : table) code.Emit({byte});
+        for (const auto& text : stringOrder) {
+            if (code.GetRva() != stringRva.at(text)) throw Domain::RelinkerException("Import trace string was placed at the wrong address");
+            for (const auto character : text) code.Emit({static_cast<std::uint8_t>(character)});
+            code.Emit({0});
+        }
+        if (code.GetRva() != cursor) throw Domain::RelinkerException("Import trace table size changed while it was written");
+        tracePrologueRva = cursor;
+        const auto prologue = BuildTracePrologue(cursor, tableRva, tableEnd, metaRva + static_cast<std::uint32_t>(traceFunctionSlot));
+        traceEntryPatch = static_cast<std::size_t>(code.GetRva() - codeRva) + prologue.EntryDisplacement;
+        for (const auto byte : prologue.Bytes) code.Emit({byte});
     }
     const auto metaBytes = meta.size();
     segments.push_back({"__APS5DATA", metaRva, metaBytes, VmProtRead | VmProtWrite, std::move(meta), std::move(dataSections)});
@@ -675,6 +754,8 @@ std::vector<std::uint8_t> WriteMacOsImage(MacOsImageInput& input) {
             while (used != 0 && data[used - 1] == 0) --used;
             data.resize(used);
         }
+        if (segments[index].Name == "__APS5TEXT" && traceEntryPatch != 0 && data.size() < traceEntryPatch + 4)
+            data.resize(traceEntryPatch + 4, 0);
         data.resize(AlignUp(data.size(), PageSize), 0);
     }
 
@@ -812,16 +893,32 @@ std::vector<std::uint8_t> WriteMacOsImage(MacOsImageInput& input) {
     std::vector<std::uint8_t> file;
     constexpr std::size_t HeaderSize = 32;
     const auto stubOffset = AlignUp(HeaderSize + commands.size(), 16);
-    if (stubOffset + (input.Executable ? sizeof(EntryStub) : 0) > LoadRva)
+    const auto traceJump = input.Executable && input.TraceImports;
+    const auto entryOffset = stubOffset + (traceJump ? 5 : 0);
+    if (entryOffset + (input.Executable ? sizeof(EntryStub) : 0) > LoadRva)
         throw Domain::RelinkerException("Mach-O load commands do not fit before the guest image");
     file.resize(LoadRva, 0);
     if (input.Executable) {
-        std::copy(std::begin(EntryStub), std::end(EntryStub), file.begin() + static_cast<std::ptrdiff_t>(stubOffset));
-        const auto writeDisplacement = [&](const std::size_t field, const std::uint64_t targetRva) {
-            const auto displacement = static_cast<std::int64_t>(targetRva) - static_cast<std::int64_t>(stubOffset + field + 4);
+        if (traceJump) {
+            const auto text = std::find_if(segments.begin(), segments.end(), [](const Segment& segment) { return segment.Name == "__APS5TEXT"; });
+            if (text == segments.end() || traceEntryPatch + 4 > text->Data.size())
+                throw Domain::RelinkerException("Import trace prologue is missing from the Mach-O image");
+            const auto displacement = static_cast<std::int64_t>(entryOffset) - static_cast<std::int64_t>(codeRva + traceEntryPatch + 4);
             if (displacement < std::numeric_limits<std::int32_t>::min() || displacement > std::numeric_limits<std::int32_t>::max())
                 throw Domain::RelinkerException("macOS entry stub target is out of rel32 range");
-            Io::WriteU32(file, stubOffset + field, static_cast<std::uint32_t>(static_cast<std::int32_t>(displacement)));
+            Io::WriteU32(text->Data, traceEntryPatch, static_cast<std::uint32_t>(static_cast<std::int32_t>(displacement)));
+            const auto jump = static_cast<std::int64_t>(tracePrologueRva) - static_cast<std::int64_t>(stubOffset + 5);
+            if (jump < std::numeric_limits<std::int32_t>::min() || jump > std::numeric_limits<std::int32_t>::max())
+                throw Domain::RelinkerException("Import trace prologue is out of rel32 range");
+            file[stubOffset] = 0xe9;
+            Io::WriteU32(file, stubOffset + 1, static_cast<std::uint32_t>(static_cast<std::int32_t>(jump)));
+        }
+        std::copy(std::begin(EntryStub), std::end(EntryStub), file.begin() + static_cast<std::ptrdiff_t>(entryOffset));
+        const auto writeDisplacement = [&](const std::size_t field, const std::uint64_t targetRva) {
+            const auto displacement = static_cast<std::int64_t>(targetRva) - static_cast<std::int64_t>(entryOffset + field + 4);
+            if (displacement < std::numeric_limits<std::int32_t>::min() || displacement > std::numeric_limits<std::int32_t>::max())
+                throw Domain::RelinkerException("macOS entry stub target is out of rel32 range");
+            Io::WriteU32(file, entryOffset + field, static_cast<std::uint32_t>(static_cast<std::int32_t>(displacement)));
         };
         writeDisplacement(EntryStubEntryDisplacement, input.EntryRva);
         writeDisplacement(EntryStubStartDisplacement, metaRva + startSlot);
diff --git a/core/relinker/elfpatcher/src/macos/MacOsMachOPatcher.cpp b/core/relinker/elfpatcher/src/macos/MacOsMachOPatcher.cpp
index ff62ba6e2d..3cb70284e7 100644
--- a/core/relinker/elfpatcher/src/macos/MacOsMachOPatcher.cpp
+++ b/core/relinker/elfpatcher/src/macos/MacOsMachOPatcher.cpp
@@ -51,7 +51,7 @@ std::string MachODependency(const std::string& name, const std::string& origin)
     return "@rpath/" + name;
 }
 
-MacOsMachOPatcher::MacOsMachOPatcher(const std::optional<std::uint64_t> fixedBase, std::function<void(std::string_view)> message) : fixedBase(fixedBase), message(std::move(message)) {
+MacOsMachOPatcher::MacOsMachOPatcher(const std::optional<std::uint64_t> fixedBase, std::function<void(std::string_view)> message, const bool traceImports) : fixedBase(fixedBase), message(std::move(message)), traceImports(traceImports) {
     if (fixedBase && (*fixedBase < 0x20000 || *fixedBase > 0x7fffffff0000 || (*fixedBase & 0xffff) != 0))
         throw Domain::RelinkerException("Invalid fixed macOS guest image base");
 }
@@ -65,6 +65,9 @@ std::vector<std::uint8_t> MacOsMachOPatcher::Patch(std::vector<std::uint8_t> sou
     if (originalPltGotVaddr != 0)
         image.GetRva(originalPltGotVaddr, 8);
     const auto relocations = Windows::WindowsRelocationBuilder().Apply(image, dynamicSection, originalHeaders);
+    const auto needed = ReadNeededLibraries(dynamicSection);
+    if (traceImports && std::find(needed.begin(), needed.end(), "libc.prx") == needed.end())
+        throw Domain::RelinkerException("--trace-imports requires libc.prx among the libraries");
 
     MacOsImageInput input;
     input.Executable = true;
@@ -98,9 +101,13 @@ std::vector<std::uint8_t> MacOsMachOPatcher::Patch(std::vector<std::uint8_t> sou
         }
     }
     input.Rebases = relocations.BaseRelocations;
-    for (const auto& import : relocations.Imports)
+    for (const auto& import : relocations.Imports) {
         input.Binds.push_back({"_" + import.Name, import.TargetRva, static_cast<std::int64_t>(import.Addend), import.Weak});
-    for (const auto& library : ReadNeededLibraries(dynamicSection))
+        if (traceImports && import.Function && !import.Weak && import.Addend == 0 && !import.Name.empty())
+            input.Traced.push_back({import.TargetRva, import.Name, import.Library});
+    }
+    input.TraceImports = traceImports;
+    for (const auto& library : needed)
         input.Dylibs.push_back(MachODependency(library, "@executable_path"));
     for (const auto* library : {"@rpath/libkernel.prx", "@rpath/libc.prx"})
         if (std::find(input.Dylibs.begin(), input.Dylibs.end(), library) == input.Dylibs.end())
diff --git a/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp b/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp
index dbcca232a2..012c397f06 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp
@@ -114,6 +114,15 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
     const auto logName = addWideString(logFileName);
     const auto shellLibrary = addString("shell32.dll");
     const auto parseArguments = addString("CommandLineToArgvW");
+    const auto runtimeModule = reserve(8);
+    const auto runtimeIobFunction = reserve(8);
+    const auto runtimeFreopenFunction = reserve(8);
+    const auto msvcrtLibrary = addWideString(u"msvcrt.dll");
+    const auto ucrtbaseLibrary = addWideString(u"ucrtbase.dll");
+    const auto msvcrtIobFunctionName = addString("__iob_func");
+    const auto ucrtbaseIobFunctionName = addString("__acrt_iob_func");
+    const auto runtimeFreopenName = addString("_wfreopen");
+    const auto runtimeAppendMode = addWideString(u"a");
     const auto handles = reserve(libraries.size() * 8);
     const auto guestFinished = reserve(4);
     const WindowsGuestStartup guestStartup;
@@ -157,6 +166,7 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
     std::vector<std::uint32_t> searchCounts;
     std::vector<bool> platformTlsResolvers;
     std::vector<bool> imported(libraries.size());
+    std::vector<bool> executableImports(guestModules.size());
     const bool unscopedImports = std::any_of(imports.begin(), imports.end(), [](const auto& import) { return import.Library.empty(); });
     for (const auto& import : imports) {
         const auto library = Domain::NeededLibraryName(import.Library);
@@ -167,6 +177,7 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
             const bool guestName = index < guestModules.size() &&
                 std::find(guestModules[index].Names.begin(), guestModules[index].Names.end(), import.Library) != guestModules[index].Names.end();
             if (import.Library.empty() || name == library || guestName) order.push_back(CheckedRva(index));
+            if (import.TargetModule < 0 && !import.Library.empty() && index < guestModules.size() && (name == library || guestName)) executableImports[index] = true;
         }
         if (order.empty()) throw Domain::RelinkerException("Import module is not a dependency: " + import.Library);
         const bool hostModule = !import.Library.empty() &&
@@ -249,6 +260,11 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
     const auto searched = addString("Searched libraries:\n");
     const auto indent = addString("  ");
     const auto enteringElf = addString("Transferring control to ELF entry point\n");
+    std::vector<std::uint32_t> deferredImports;
+    for (std::size_t index = 0; index < guestModules.size(); ++index) {
+        if (guestModules[index].DeferInitialization && executableImports[index])
+            deferredImports.push_back(addString("Deferred module " + guestModules[index].Path + ": the executable imports from it, but it starts only when the title loads it\n"));
+    }
     std::vector<std::uint32_t> resolvedPaths;
     for (std::size_t index = 0; index < libraries.size(); ++index)
         resolvedPaths.push_back(reserve(PathCapacity));
@@ -406,7 +422,7 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
         code.U32(units);
         code.Emit({0x66, 0xf3, 0xa5});
         code.Rip({0x48, 0x8d, 0x0d}, modulePath);
-        code.Emit({0xba, 0, 0, 0, 0x40, 0x41, 0xb8, 3, 0, 0, 0, 0x45, 0x31, 0xc9});
+        code.Emit({0xba, 4, 0, 0, 0, 0x41, 0xb8, 3, 0, 0, 0, 0x45, 0x31, 0xc9});
         code.Emit({0x48, 0xc7, 0x44, 0x24, 0x20, 2, 0, 0, 0, 0x48, 0xc7, 0x44, 0x24, 0x28, 0x80, 0, 0, 0, 0x48, 0xc7, 0x44, 0x24, 0x30, 0, 0, 0, 0});
         call("CreateFileW");
         code.Emit({0x66, 0x41, 0xc7, 0x04, 0x24, 0x00, 0x00});
@@ -424,6 +440,51 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
         code.PatchBranch(failed, done);
     };
 
+    const auto rebindPreloadedRuntimeLog = [&](const std::uint32_t runtimeLibrary, const std::uint32_t iobFunctionName, const bool indexedIob) {
+        code.Rip({0x48, 0x8d, 0x0d}, runtimeLibrary);
+        call("GetModuleHandleW");
+        code.Emit({0x48, 0x85, 0xc0});
+        std::vector<std::size_t> absent = {code.Branch({0x0f, 0x84})};
+        code.Rip({0x48, 0x89, 0x05}, runtimeModule);
+        code.Emit({0x48, 0x89, 0xc1});
+        code.Rip({0x48, 0x8d, 0x15}, iobFunctionName);
+        call("GetProcAddress");
+        code.Emit({0x48, 0x85, 0xc0});
+        absent.push_back(code.Branch({0x0f, 0x84}));
+        code.Rip({0x48, 0x89, 0x05}, runtimeIobFunction);
+        code.Rip({0x48, 0x8b, 0x0d}, runtimeModule);
+        code.Rip({0x48, 0x8d, 0x15}, runtimeFreopenName);
+        call("GetProcAddress");
+        code.Emit({0x48, 0x85, 0xc0});
+        absent.push_back(code.Branch({0x0f, 0x84}));
+        code.Rip({0x48, 0x89, 0x05}, runtimeFreopenFunction);
+        for (const auto& stream : {std::pair<std::uint32_t, std::uint8_t>{0xfffffff5u, 1}, {0xfffffff4u, 2}}) {
+            code.Emit({0xb9});
+            code.U32(stream.first);
+            call("GetStdHandle");
+            code.Emit({0x48, 0x85, 0xc0});
+            const auto missing = code.Branch({0x0f, 0x84});
+            code.Rip({0x48, 0x3b, 0x05}, logHandle);
+            const auto notRedirected = code.Branch({0x0f, 0x85});
+            if (indexedIob) {
+                code.Emit({0xb9, stream.second, 0, 0, 0});
+                code.Rip({0xff, 0x15}, runtimeIobFunction);
+                code.Emit({0x49, 0x89, 0xc0});
+            } else {
+                code.Rip({0xff, 0x15}, runtimeIobFunction);
+                code.Emit({0x4c, 0x8d, 0x40, static_cast<std::uint8_t>(48 * stream.second)});
+            }
+            code.Rip({0x48, 0x8d, 0x0d}, logName);
+            code.Rip({0x48, 0x8d, 0x15}, runtimeAppendMode);
+            code.Rip({0xff, 0x15}, runtimeFreopenFunction);
+            const auto next = code.GetRva();
+            code.PatchBranch(missing, next);
+            code.PatchBranch(notRedirected, next);
+        }
+        const auto done = code.GetRva();
+        for (const auto branch : absent) code.PatchBranch(branch, done);
+    };
+
     code.Emit({0x53, 0x55, 0x56, 0x57, 0x41, 0x54, 0x48, 0x83, 0xec, 0x60});
     code.Rip({0x48, 0x8d, 0x0d}, parentVariable);
     code.Rip({0x48, 0x8d, 0x15}, parentText);
@@ -498,6 +559,8 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
     code.Rip({0x48, 0x8d, 0x0d}, modulePath);
     call("SetCurrentDirectoryW");
     requireNonzero(directoryError, 0xc000000du);
+    rebindPreloadedRuntimeLog(msvcrtLibrary, msvcrtIobFunctionName, false);
+    rebindPreloadedRuntimeLog(ucrtbaseLibrary, ucrtbaseIobFunctionName, true);
     if (dependencyDiagnostics) {
         code.Rip({0x4c, 0x8d, 0x05}, programPath);
         writeUtf8(programText);
@@ -717,6 +780,7 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
         code.Emit({0x85, 0xc0});
         unresolvedBranches.push_back(code.Branch({0x0f, 0x85}));
     }
+    for (const auto message : deferredImports) writeString(message);
     guestStartup.Initialize(code, guestModules, handles);
     writeString(enteringElf);
     code.Rip({0x48, 0x8d, 0x0d}, shellLibrary);
diff --git a/core/relinker/elfpatcher/src/windows/WindowsPePatcher.cpp b/core/relinker/elfpatcher/src/windows/WindowsPePatcher.cpp
index 063af7924b..36e88bf315 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsPePatcher.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsPePatcher.cpp
@@ -39,7 +39,7 @@ std::vector<std::uint8_t> WindowsPePatcher::Patch(std::vector<std::uint8_t> sour
     const auto report = [&](std::uint64_t completed) { if (progress) progress(completed, 10000); };
     report(0);
     diagnostics.clear();
-    WindowsLoadImage image(sourceElf, originalHeaders, true, fixedBase ? *fixedBase - LoadRva : ImageBase);
+    WindowsLoadImage image(sourceElf, originalHeaders, true, fixedBase.value_or(ExecutableBase) - LoadRva);
     if (originalPltGotVaddr != 0)
         image.GetRva(originalPltGotVaddr, 8);
     report(500);
@@ -111,7 +111,7 @@ std::vector<std::uint8_t> WindowsPePatcher::Patch(std::vector<std::uint8_t> sour
     }
     directories[2] = icon ? WindowsIconResourceBuilder().Build(*icon, iconName, sections, nextRva) : PeDirectory{};
     report(9500);
-    auto result = WindowsPeWriter().Write(sections, entryRva, directories, windowsGui, fixedBase ? std::optional<std::uint64_t>(image.GetImageBase()) : std::nullopt, false);
+    auto result = WindowsPeWriter().Write(sections, entryRva, directories, windowsGui, image.GetImageBase(), fixedBase.has_value(), false);
     report(10000);
     return result;
 }
diff --git a/core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp b/core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp
index 48d867f0f5..96dfbf91b3 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp
@@ -5,7 +5,7 @@
 
 namespace Elfpatcher::Windows {
 
-std::vector<std::uint8_t> WindowsPeWriter::Write(const std::vector<PeSection>& sections, const std::uint32_t entryRva, const std::array<PeDirectory, 16>& directories, const bool windowsGui, const std::optional<std::uint64_t> fixedImageBase, const bool dynamicBase) const {
+std::vector<std::uint8_t> WindowsPeWriter::Write(const std::vector<PeSection>& sections, const std::uint32_t entryRva, const std::array<PeDirectory, 16>& directories, const bool windowsGui, const std::uint64_t imageBase, const bool fixedBase, const bool dynamicBase) const {
     constexpr std::size_t peOffset = 0x80;
     constexpr std::size_t optionalOffset = peOffset + 24;
     constexpr std::size_t sectionTable = optionalOffset + 240;
@@ -18,12 +18,12 @@ std::vector<std::uint8_t> WindowsPeWriter::Write(const std::vector<PeSection>& s
     Io::WriteU16(result, peOffset + 4, 0x8664);
     Io::WriteU16(result, peOffset + 6, static_cast<std::uint16_t>(sections.size()));
     Io::WriteU16(result, peOffset + 20, 240);
-    if (fixedImageBase && (directories[5].Size != 0 || *fixedImageBase < 0x10000 || (*fixedImageBase & 0xffff) != 0))
-        throw Domain::RelinkerException("Invalid fixed Windows image base or base relocations");
-    Io::WriteU16(result, peOffset + 22, fixedImageBase ? 0x23 : 0x22);
+    if (imageBase < 0x10000 || (imageBase & 0xffff) != 0 || (fixedBase && directories[5].Size != 0))
+        throw Domain::RelinkerException("Invalid Windows image base or base relocations");
+    Io::WriteU16(result, peOffset + 22, fixedBase ? 0x23 : 0x22);
     Io::WriteU16(result, optionalOffset, 0x20b);
     Io::WriteU32(result, optionalOffset + 16, entryRva);
-    Io::WriteU64(result, optionalOffset + 24, fixedImageBase.value_or(ImageBase));
+    Io::WriteU64(result, optionalOffset + 24, imageBase);
     Io::WriteU32(result, optionalOffset + 32, SectionAlignment);
     Io::WriteU32(result, optionalOffset + 36, FileAlignment);
     Io::WriteU16(result, optionalOffset + 40, 6);
@@ -72,7 +72,7 @@ std::vector<std::uint8_t> WindowsPeWriter::Write(const std::vector<PeSection>& s
     }
     if (!foundEntry)
         throw Domain::RelinkerException("PE entry point is not inside executable section data", entryRva);
-    if (fixedImageBase && *fixedImageBase > 0x7fffffffffff - static_cast<std::uint64_t>(endRva))
+    if (fixedBase && imageBase > 0x7fffffffffff - static_cast<std::uint64_t>(endRva))
         throw Domain::RelinkerException("Fixed Windows image exceeds the user address space");
     Io::WriteU32(result, optionalOffset + 4, codeSize);
     Io::WriteU32(result, optionalOffset + 8, dataSize);
diff --git a/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp b/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp
index 71b149d37f..7bd368ac26 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp
@@ -86,8 +86,6 @@ PeRelocations WindowsRelocationBuilder::Apply(WindowsLoadImage& image, const Dom
 std::vector<std::uint8_t> WindowsRelocationBuilder::BuildBaseRelocations(const std::vector<std::uint32_t>& targets) const {
     std::map<std::uint32_t, std::vector<std::uint16_t>> pages;
     for (const auto target : targets) {
-        if ((target & 0xfffu) > 0x1000u - 8)
-            throw Domain::RelinkerException("Base relocation target crosses a page boundary", target);
         auto& entries = pages[target & ~0xfffu];
         const auto entry = static_cast<std::uint16_t>(0xa000u | (target & 0xfffu));
         if (std::find(entries.begin(), entries.end(), entry) == entries.end())
diff --git a/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp b/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp
index b78a010b40..f923bafd63 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp
@@ -221,8 +221,14 @@ PeDirectory WindowsTlsBuilder::Build(const std::vector<std::uint8_t>& source, co
     }
 
     report(9000);
-    for (const auto& [rva, length] : gsTraps)
+    std::sort(branchTargets.begin(), branchTargets.end());
+    branchTargets.erase(std::unique(branchTargets.begin(), branchTargets.end()), branchTargets.end());
+    for (const auto& [rva, length] : gsTraps) {
+        const auto target = std::upper_bound(branchTargets.begin(), branchTargets.end(), rva);
+        if (target != branchTargets.end() && *target < rva + length)
+            throw Domain::RelinkerException("Branch enters a guest GS instruction", *target);
         trapInstruction(sections, rva, length);
+    }
     if (tls == nullptr) {
         if (!accesses.empty())
             throw Domain::RelinkerException("Guest TLS access without PT_TLS");
@@ -274,9 +280,6 @@ PeDirectory WindowsTlsBuilder::Build(const std::vector<std::uint8_t>& source, co
     code.PatchBranch(skipCallback, code.GetRva());
     code.Emit({0xc3});
 
-    std::sort(branchTargets.begin(), branchTargets.end());
-    branchTargets.erase(std::unique(branchTargets.begin(), branchTargets.end()), branchTargets.end());
-
     std::uint64_t patched = 0;
     for (const auto& access : accesses) {
         if (patched % 256 == 0) report(9000 + 900 * patched / accesses.size());
diff --git a/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp b/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp
index 18748830de..c86b61da23 100644
--- a/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp
+++ b/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp
@@ -149,6 +149,27 @@ int main() {
         bool stackSlotRejected = false;
         try { (void)writeSingle(6); } catch (const std::exception&) { stackSlotRejected = true; }
         Require(stackSlotRejected, "layout must refuse to drop the synthetic stack when its slot is missing");
-        std::cout << "21 program layout cases passed\n";
+        constexpr std::uint16_t extendedCount = 0xffff;
+        std::vector<Domain::ProgramHeader> manyHeaders(extendedCount - Elfpatcher::kSyntheticProgramHeaderCount - 2);
+        manyHeaders.front() = singleLoad.front();
+        Require(builder.RequiredProgramHeaderCount(manyHeaders) == extendedCount - 1, "largest ordinary count changed");
+        const auto writeMany = [&builder](const std::vector<Domain::ProgramHeader>& headers, std::vector<std::uint8_t>& bytes, std::uint16_t count) {
+            const std::uint64_t extraOffset = 0x1000;
+            const std::uint64_t extraSize = static_cast<std::uint64_t>(count) * 56;
+            Elfpatcher::ProgramHeaderLayoutRequest request{extraOffset, 56, count, headers, extraOffset,
+                builder.ComputeExtraBlockVaddr(headers, extraOffset), extraSize, extraOffset, 16, extraOffset + 16, 8};
+            return builder.WriteLayout(bytes, request);
+        };
+        std::vector<std::uint8_t> largeOutput(0x1000 + static_cast<std::uint64_t>(extendedCount) * 56, 0xA5);
+        Require(writeMany(manyHeaders, largeOutput, extendedCount - 1) == extendedCount - 1, "largest ordinary layout rejected");
+        manyHeaders.push_back({});
+        rejected = false;
+        try { builder.RequiredProgramHeaderCount(manyHeaders); } catch (const Domain::RelinkerException&) { rejected = true; }
+        Require(rejected, "extended program header count accepted");
+        const auto beforeLarge = largeOutput;
+        rejected = false;
+        try { writeMany(manyHeaders, largeOutput, extendedCount); } catch (const Domain::RelinkerException&) { rejected = true; }
+        Require(rejected && largeOutput == beforeLarge, "extended count written without section-zero encoding");
+        std::cout << "25 program layout cases passed\n";
     } catch (const std::exception& error) { std::cerr << error.what() << '\n'; return 1; }
 }
diff --git a/core/relinker/elfpatcher/tests/SectionRangeTests.cpp b/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
index c75c4e9773..b5ff0514a0 100644
--- a/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
+++ b/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
@@ -1,6 +1,8 @@
 #include <elfpatcher/general/SectionHeaderTableBuilder.hpp>
+#include <elfpatcher/general/ElfConstants.hpp>
 #include <io/ByteWriter.hpp>
 #include <io/BufferUtils.hpp>
+#include <algorithm>
 #include <iostream>
 #include <limits>
 #include <stdexcept>
@@ -29,6 +31,30 @@ int main() {
         auto empty = valid; empty.StubOffset = 384; empty.StubSize = 0;
         bytes = Fixture(); builder.WriteTable(bytes, empty);
         Require(Io::ReadU64(bytes, Io::ReadU64(bytes, 40) + 5 * 64 + 16) == 0x1100);
+        for (std::size_t tail = 0; tail < 8; ++tail) {
+            bytes = Fixture();
+            bytes.resize(512 + tail, 0xa5);
+            const auto original = bytes;
+            const auto originalSize = bytes.size();
+            builder.WriteTable(bytes, valid);
+            const auto alignedTable = Io::ReadU64(bytes, 40);
+            if (alignedTable % 8 != 0)
+                throw std::runtime_error("ELF64 section header table is not 8-byte aligned");
+            const auto stringOffset = Io::ReadU64(bytes, alignedTable + 64 + 24);
+            const auto stringSize = Io::ReadU64(bytes, alignedTable + 64 + 32);
+            const auto stringEnd = stringOffset + stringSize;
+            Require(stringOffset == originalSize && stringSize == sizeof(Elfpatcher::kShStrTabBlob));
+            Require(stringEnd <= alignedTable && alignedTable - stringEnd < 8);
+            Require(bytes[stringOffset] == 0 && bytes[stringEnd - 1] == 0);
+            Require(std::equal(original.begin() + 64, original.end(), bytes.begin() + 64));
+            Require(std::all_of(bytes.begin() + stringEnd, bytes.begin() + alignedTable,
+                                [](const auto byte) { return byte == 0; }));
+            Require(bytes.size() == alignedTable + Io::ReadU16(bytes, 60) * 64);
+            Require(Io::ReadU64(bytes, alignedTable + 2 * 64 + 24) == valid.DynStrOffset);
+            Require(Io::ReadU64(bytes, alignedTable + 3 * 64 + 24) == valid.DynSymOffset);
+            Require(Io::ReadU64(bytes, alignedTable + 4 * 64 + 24) == valid.DynamicSegmentOffset);
+            Require(Io::ReadU64(bytes, alignedTable + 5 * 64 + 24) == valid.StubOffset);
+        }
         for (int kind = 0; kind < 11; ++kind) {
             bytes = Fixture(); auto request = valid;
             switch (kind) {
@@ -49,6 +75,6 @@ int main() {
             try { builder.WriteTable(bytes, request); } catch (const std::runtime_error&) { rejected = true; }
             Require(rejected && bytes == before);
         }
-        std::cout << "13 section range cases passed\n";
+        std::cout << "21 section range and alignment cases passed\n";
     } catch (const std::exception& error) { std::cerr << error.what() << '\n'; return 1; }
 }
diff --git a/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp b/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp
index 15197aa868..45ce2bf954 100644
--- a/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp
+++ b/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp
@@ -242,8 +242,8 @@ void expectDiagnostic(const Fs::path& runner, const std::vector<std::string>& ex
 int main() {
     try {
         checkRuntimeDependencies();
-        std::vector<char> filename(32768);
-        const auto size = GetModuleFileNameA(nullptr, filename.data(), static_cast<DWORD>(filename.size()));
+        std::vector<wchar_t> filename(32768);
+        const auto size = GetModuleFileNameW(nullptr, filename.data(), static_cast<DWORD>(filename.size()));
         if (size == 0 || size >= filename.size())
             throw std::runtime_error("Cannot locate diagnostic tests");
         const auto directory = createFixtureDirectory(Fs::path(filename.data()).parent_path());
diff --git a/core/relinker/elfpatcher/tests/WindowsImportIdentityTests.cpp b/core/relinker/elfpatcher/tests/WindowsImportIdentityTests.cpp
index ffe753bfaf..03243cea6b 100644
--- a/core/relinker/elfpatcher/tests/WindowsImportIdentityTests.cpp
+++ b/core/relinker/elfpatcher/tests/WindowsImportIdentityTests.cpp
@@ -74,7 +74,7 @@ void generateProbe(const Fs::path& file, const std::string& libraries, const std
     directories[1] = imports.Directory;
     directories[3] = startup.ExceptionDirectory;
     directories[12] = imports.AddressTable;
-    const auto image = WindowsPeWriter().Write({entry, got, imports.Section, startup.Data, startup.Code}, startup.Code.Rva, directories, false, ImageBase, false);
+    const auto image = WindowsPeWriter().Write({entry, got, imports.Section, startup.Data, startup.Code}, startup.Code.Rva, directories, false, ImageBase, true, false);
     std::ofstream stream(file, std::ios::binary);
     stream.write(reinterpret_cast<const char*>(image.data()), static_cast<std::streamsize>(image.size()));
     require(static_cast<bool>(stream), "Cannot write " + file.string());
diff --git a/core/relinker/elfpatcher/tests/WindowsMsvcrt.def b/core/relinker/elfpatcher/tests/WindowsMsvcrt.def
index c163db8f44..741b17b119 100644
--- a/core/relinker/elfpatcher/tests/WindowsMsvcrt.def
+++ b/core/relinker/elfpatcher/tests/WindowsMsvcrt.def
@@ -2,3 +2,4 @@ LIBRARY msvcrt.dll
 EXPORTS
     __iob_func
     fputs
+    fflush
diff --git a/core/relinker/elfpatcher/tests/WindowsMsvcrtStdioHost.cpp b/core/relinker/elfpatcher/tests/WindowsMsvcrtStdioHost.cpp
index 4c370e0924..2a77b5b41f 100644
--- a/core/relinker/elfpatcher/tests/WindowsMsvcrtStdioHost.cpp
+++ b/core/relinker/elfpatcher/tests/WindowsMsvcrtStdioHost.cpp
@@ -13,10 +13,13 @@ static_assert(sizeof(_iobuf) == 48);
 
 extern "C" _iobuf* __cdecl __iob_func();
 extern "C" int __cdecl fputs(const char*, _iobuf*);
+extern "C" int __cdecl fflush(_iobuf*);
 
 extern "C" int shared() {
     auto* streams = __iob_func();
     fputs("Windows DLL stdout probe\n", streams + 1);
     fputs("Windows DLL stderr probe\n", streams + 2);
+    fflush(streams + 1);
+    fflush(streams + 2);
     return 11;
 }
diff --git a/core/relinker/elfpatcher/tests/WindowsStdioHost.cpp b/core/relinker/elfpatcher/tests/WindowsStdioHost.cpp
index 72a29373f4..3d996c8df4 100644
--- a/core/relinker/elfpatcher/tests/WindowsStdioHost.cpp
+++ b/core/relinker/elfpatcher/tests/WindowsStdioHost.cpp
@@ -3,5 +3,7 @@
 extern "C" int shared() {
     std::fputs("Windows DLL stdout probe\n", stdout);
     std::fputs("Windows DLL stderr probe\n", stderr);
+    std::fflush(stdout);
+    std::fflush(stderr);
     return 11;
 }
diff --git a/core/relinker/io/src/FileIdentity.cpp b/core/relinker/io/src/FileIdentity.cpp
index 351058935a..5f2b5cc967 100644
--- a/core/relinker/io/src/FileIdentity.cpp
+++ b/core/relinker/io/src/FileIdentity.cpp
@@ -47,6 +47,18 @@ bool SameFile(const std::filesystem::path& first, const std::filesystem::path& s
 #ifdef _WIN32
     return FileIdentity(first) == FileIdentity(second);
 #else
+    for (const auto* path : {&first, &second}) {
+        std::error_code error;
+        const auto status = std::filesystem::status(*path, error);
+        if (error) throw std::filesystem::filesystem_error("Cannot determine file identity", *path, error);
+        if (!std::filesystem::exists(status)) {
+            throw std::filesystem::filesystem_error(
+                "Cannot determine file identity",
+                *path,
+                std::make_error_code(std::errc::no_such_file_or_directory)
+            );
+        }
+    }
     return std::filesystem::equivalent(first, second);
 #endif
 }
diff --git a/core/relinker/io/src/FileWriter.cpp b/core/relinker/io/src/FileWriter.cpp
index 49df133411..10606d09bb 100644
--- a/core/relinker/io/src/FileWriter.cpp
+++ b/core/relinker/io/src/FileWriter.cpp
@@ -33,11 +33,10 @@ int createTemporary(const std::filesystem::path& target, const mode_t mode, std:
     constexpr std::string_view characters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
     std::random_device device;
     for (int attempt = 0; attempt < 100; ++attempt) {
-        std::string suffix = ".";
+        std::string suffix = ".anyps5-";
         for (int index = 0; index < 6; ++index)
             suffix += characters[device() % characters.size()];
-        temporary = target;
-        temporary += suffix;
+        temporary = target.parent_path() / suffix;
         const int descriptor = open(temporary.c_str(), O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC, mode);
         if (descriptor >= 0 || errno != EEXIST)
             return descriptor;
diff --git a/core/relinker/io/src/NativePath.cpp b/core/relinker/io/src/NativePath.cpp
index 13b11fa505..ad603ef310 100644
--- a/core/relinker/io/src/NativePath.cpp
+++ b/core/relinker/io/src/NativePath.cpp
@@ -1,8 +1,11 @@
 #include <io/NativePath.hpp>
+#include <stdexcept>
 
 namespace Io {
 
 std::filesystem::path NativePath(const std::string& path) {
+    if (path.find('\0') != std::string::npos)
+        throw std::invalid_argument("File path contains a NUL byte");
     const std::u8string utf8(path.begin(), path.end());
     return std::filesystem::path(utf8);
 }
diff --git a/core/relinker/io/tests/FileIdentityTests.cpp b/core/relinker/io/tests/FileIdentityTests.cpp
index 41e6bdc5e7..763b71af1c 100644
--- a/core/relinker/io/tests/FileIdentityTests.cpp
+++ b/core/relinker/io/tests/FileIdentityTests.cpp
@@ -17,10 +17,16 @@ void write(const std::filesystem::path& path, const std::string& text) {
     require(std::filesystem::is_regular_file(path), "Cannot create " + path.string());
 }
 
-void requireMissing(const std::filesystem::path& first, const std::filesystem::path& second) {
+void requireMissing(
+    const std::filesystem::path& first,
+    const std::filesystem::path& second,
+    const std::filesystem::path& missing
+) {
     try {
         Io::SameFile(first, second);
-    } catch (const std::filesystem::filesystem_error&) {
+    } catch (const std::filesystem::filesystem_error& error) {
+        require(error.code() == std::errc::no_such_file_or_directory, "SameFile reported the wrong error for a missing path");
+        require(error.path1() == missing, "SameFile reported the wrong missing path");
         return;
     }
     throw std::runtime_error("SameFile accepted a missing file");
@@ -41,8 +47,9 @@ void run(const std::filesystem::path& directory) {
     require(!Io::SameFile(first, copy), "A copy with the same contents is the same file");
     require(Io::SameFile(folder, directory / "folder" / "."), "Two spellings of one directory differ");
     require(!Io::SameFile(first, folder), "A file is the same as a directory");
-    requireMissing(directory / "missing.bin", first);
-    requireMissing(first, directory / "missing.bin");
+    const auto missing = directory / "missing.bin";
+    requireMissing(missing, first, missing);
+    requireMissing(first, missing, missing);
 }
 
 }
diff --git a/core/relinker/io/tests/FileWriterTests.cpp b/core/relinker/io/tests/FileWriterTests.cpp
index 8ec3b79abd..7ab1724d30 100644
--- a/core/relinker/io/tests/FileWriterTests.cpp
+++ b/core/relinker/io/tests/FileWriterTests.cpp
@@ -40,15 +40,15 @@ std::vector<std::string> siblings(const std::filesystem::path& output) {
     std::vector<std::string> names;
     for (const auto& entry : std::filesystem::directory_iterator(output.parent_path())) {
         const auto name = entry.path().filename().string();
-        if (name.starts_with(output.filename().string() + "."))
+        if (name.starts_with(output.filename().string() + ".") || name.starts_with(".anyps5-"))
             names.push_back(name);
     }
     return names;
 }
 
 template<typename TValue>
-void requireRunningReplacement(const std::filesystem::path& directory, const TValue& data, const bool leftover) {
-    const auto output = directory / (leftover ? "leftover" : "running");
+void requireRunningReplacement(const std::filesystem::path& directory, const TValue& data, const bool leftover, const std::string& name = "running") {
+    const auto output = directory / (leftover ? "leftover" : name);
     if (leftover)
         std::ofstream(directory / "leftover.tmp", std::ios::binary) << "killed";
     std::filesystem::copy_file(std::filesystem::read_symlink("/proc/self/exe"), output);
@@ -107,8 +107,8 @@ void requireRunningReplacement(const std::filesystem::path& directory, const TVa
 }
 
 template<typename TValue>
-void requireFailedReplacement(const std::filesystem::path& directory, const TValue& data) {
-    const auto output = directory / "limited";
+void requireFailedReplacement(const std::filesystem::path& directory, const TValue& data, const std::string& name = "limited") {
+    const auto output = directory / name;
     std::ofstream(output, std::ios::binary) << "previous";
     rlimit limit{};
     getrlimit(RLIMIT_FSIZE, &limit);
@@ -158,6 +158,11 @@ void requireReplacement(const TValue& data) {
         requireRunningReplacement(directory, data, false);
         requireRunningReplacement(directory, data, true);
         requireFailedReplacement(directory, data);
+        const auto maximumName = pathconf(directory.c_str(), _PC_NAME_MAX);
+        if (maximumName <= 0)
+            throw std::runtime_error("Cannot determine the output filename limit");
+        requireFailedReplacement(directory, data, std::string(static_cast<std::size_t>(maximumName), 'f'));
+        requireRunningReplacement(directory, data, false, std::string(static_cast<std::size_t>(maximumName), 'r'));
         requireInPlaceWrites(directory, data);
     } catch (...) {
         std::filesystem::remove_all(directory, error);
diff --git a/core/relinker/io/tests/NativePathTests.cpp b/core/relinker/io/tests/NativePathTests.cpp
new file mode 100644
index 0000000000..e40cd5f3cf
--- /dev/null
+++ b/core/relinker/io/tests/NativePathTests.cpp
@@ -0,0 +1,74 @@
+#include <io/FileReader.hpp>
+#include <io/FileWriter.hpp>
+#include <io/NativePath.hpp>
+#include <chrono>
+#include <filesystem>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+template<typename TAction>
+void RequireInvalidPath(TAction action) {
+    try {
+        action();
+    } catch (const std::invalid_argument& error) {
+        Require(std::string(error.what()).find("NUL") != std::string::npos, "Path error does not identify the NUL byte");
+        return;
+    }
+    throw std::runtime_error("A path containing a NUL byte was accepted");
+}
+
+void Conversions() {
+    for (const std::string path : {"", "relative/file.bin", "a path with spaces", "caf\xc3\xa9/\xe6\x97\xa5\xe6\x9c\xac.bin"})
+        Require(Io::Utf8Path(Io::NativePath(path)) == path, "Valid path did not round-trip");
+    for (const std::string prefix : {"", "file", "directory/file"}) {
+        for (const auto& suffix : std::vector<std::string>{"", "suffix", std::string(1, '\0')}) {
+            const auto path = prefix + '\0' + suffix;
+            RequireInvalidPath([&] { Io::NativePath(path); });
+        }
+    }
+}
+
+void FileAccess(const std::filesystem::path& directory) {
+    const auto original = directory / Io::NativePath("caf\xc3\xa9-\xe6\x97\xa5\xe6\x9c\xac.bin");
+    const auto originalPath = Io::Utf8Path(original);
+    const std::vector<std::uint8_t> expected{0, 1, 10, 13, 127, 128, 255};
+    Io::FileWriter().Write(originalPath, expected);
+    Require(Io::FileReader().Read(originalPath) == expected, "Valid UTF-8 file path did not preserve binary data");
+    const auto missingPath = Io::Utf8Path(directory / "missing.bin");
+    for (const auto& prefix : {originalPath, missingPath}) {
+        for (const std::string suffix : {"", ".other", "/other.bin"}) {
+            const auto path = prefix + '\0' + suffix;
+            RequireInvalidPath([&] { Io::FileReader().Read(path); });
+            RequireInvalidPath([&] { Io::FileWriter().Write(path, std::vector<std::uint8_t>{42}); });
+            RequireInvalidPath([&] { Io::FileWriter().Write(path, std::string("replacement")); });
+            Require(Io::FileReader().Read(originalPath) == expected, "Invalid path changed the file named before the NUL byte");
+            Require(!std::filesystem::exists(Io::NativePath(missingPath)), "Invalid path created the file named before the NUL byte");
+        }
+    }
+}
+
+}
+
+int main() {
+    const auto directory = std::filesystem::temp_directory_path() /
+        ("anyps5-native-path-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    try {
+        Conversions();
+        std::filesystem::create_directory(directory);
+        FileAccess(directory);
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        std::error_code ignored;
+        std::filesystem::remove_all(directory, ignored);
+        return 1;
+    }
+    std::filesystem::remove_all(directory);
+}
diff --git a/core/relinker/main.cpp b/core/relinker/main.cpp
index 98bca27396..81b6e3d359 100644
--- a/core/relinker/main.cpp
+++ b/core/relinker/main.cpp
@@ -45,11 +45,12 @@ ConvertedExecutable Convert(const Cli::Args& args, const std::string& inputPath,
     input.Executable = fileReader.Read(inputPath);
     input.InputPath = std::filesystem::absolute(Io::NativePath(inputPath)).lexically_normal();
     input.OutputPath = Io::NativePath(absPath);
+    Cli::NativeModules modules;
     if (!args.skipSceModule) {
-        auto modules = Cli::ReadModules(std::filesystem::absolute(Io::NativePath(args.inputPath)).lexically_normal(), Io::NativePath(args.sceModulePath), args.excludedSceModules, args.moduleDirectories);
-        input.ModuleRoot = std::move(modules.Root);
+        modules = Cli::ReadModules(std::filesystem::absolute(Io::NativePath(args.inputPath)).lexically_normal(), Io::NativePath(args.sceModulePath), args.excludedSceModules, args.moduleDirectories);
+        input.ModuleRoot = modules.Root;
         input.Modules = std::move(modules.Modules);
-        input.RuntimeDirectories = std::move(modules.RuntimeDirectories);
+        input.RuntimeDirectories = modules.RuntimeDirectories;
     }
     const auto iconPath = Io::NativePath(args.inputPath).parent_path() / "sce_sys" / "icon0.png";
     if (args.toWindows && std::filesystem::exists(iconPath)) input.Icon = fileReader.Read(Io::Utf8Path(iconPath));
@@ -57,6 +58,7 @@ ConvertedExecutable Convert(const Cli::Args& args, const std::string& inputPath,
     options.Target = args.toWindows ? Relinker::TargetSystem::Windows : args.toMacos ? Relinker::TargetSystem::MacOs : Relinker::TargetSystem::Linux;
     options.ToIntel = args.toIntel;
     options.ToRosetta = args.toRosetta;
+    options.FrameRedZone = args.frameRedZone;
     options.SkipSyscallCheck = args.skipSyscallCheck;
     options.TrapSdkSyscallStubs = args.trapSdkSyscallStubs;
     options.UnusedFilterLevel = args.unusedFilterLevel;
@@ -75,6 +77,7 @@ ConvertedExecutable Convert(const Cli::Args& args, const std::string& inputPath,
     progress.IncludeFile(Io::Utf8Path(input.OutputPath));
     for (const auto& module : input.Modules) progress.IncludeFile(Io::Utf8Path(module.Path));
     auto converted = Relinker::Conversion(progress).Convert(std::move(input), options);
+    if (!args.skipSceModule) Cli::ReportUnconvertedNeeded(modules, converted.Analysis.DynamicSection.NeededLibraries, args.toWindows, std::cout);
     return {inputPath, absPath, std::move(converted.Analysis), std::move(converted.Modules), std::move(converted.Executable), std::move(converted.WindowsDiagnostics), std::move(converted.AppliedPatches), converted.LinuxBase};
 }
 
@@ -122,9 +125,10 @@ bool SameOutputFile(const std::filesystem::path& first, const std::filesystem::p
     return Io::SameFile(first, second);
 }
 
-bool SameOutputDestination(const std::filesystem::path& first, const std::filesystem::path& second) {
-    const auto firstPath = std::filesystem::weakly_canonical(first);
-    const auto secondPath = std::filesystem::weakly_canonical(second);
+bool SameOutputDestination(const std::filesystem::path& first, const std::filesystem::path& second,
+                           std::filesystem::path& firstPath, std::filesystem::path& secondPath) {
+    if (firstPath.empty()) firstPath = std::filesystem::weakly_canonical(first);
+    if (secondPath.empty()) secondPath = std::filesystem::weakly_canonical(second);
     if (firstPath == secondPath) return true;
     if (std::filesystem::exists(first) && std::filesystem::exists(second)) return SameOutputFile(first, second);
 #ifdef _WIN32
@@ -337,10 +341,17 @@ int Run(const int argc, char* argv[]) {
         if (!manifestPath.empty()) manifestText = Relinker::GamePatch::WriteManifest(appliedPatches, mainTarget, Io::Utf8Path(patchFile), executables.front().LinuxBase);
 
         const Elfpatcher::Linux::LinuxDesktopEntryWriter desktopEntryWriter;
-        const auto desktopEntry = args.toWindows || args.toMacos ? std::nullopt : desktopEntryWriter.Prepare(Io::NativePath(args.inputPath).parent_path() / "sce_sys", Io::NativePath(absPath));
+        const auto metadataRoot = Io::NativePath(args.inputPath).parent_path() / "sce_sys";
+        const auto desktopEntry = args.toWindows || args.toMacos ? std::nullopt : desktopEntryWriter.Prepare(metadataRoot, Io::NativePath(absPath));
+        std::vector<std::filesystem::path> metadataInputs;
+        if (args.toWindows || desktopEntry) metadataInputs.push_back(metadataRoot / "icon0.png");
+        if (desktopEntry) metadataInputs.push_back(metadataRoot / "param.json");
 
         const auto checkOutputInputs = [&](const std::filesystem::path& path, const char* kind) {
             if (!std::filesystem::exists(path)) return;
+            for (const auto& input : metadataInputs)
+                if (std::filesystem::exists(input) && SameOutputFile(input, path))
+                    throw Domain::RelinkerException(std::string(kind) + " output would overwrite input metadata: " + Io::Utf8Path(path));
             for (const auto& executable : executables)
                 if (SameOutputFile(Io::NativePath(executable.InputPath), path))
                     throw Domain::RelinkerException(std::string(kind) + " output would overwrite the input executable: " + Io::Utf8Path(path));
@@ -394,11 +405,12 @@ int Run(const int argc, char* argv[]) {
             outputPaths.push_back(desktopEntry->EntryPath);
         }
         if (args.windowsDiagnostics) outputPaths.push_back(std::filesystem::absolute("windows-diagnostics-imports.txt"));
+        std::vector<std::filesystem::path> canonicalOutputPaths(outputPaths.size());
         for (std::size_t index = 0; index < outputPaths.size(); ++index) {
             for (std::size_t previous = 0; previous < index; ++previous) {
                 const auto& first = outputPaths[index];
                 const auto& second = outputPaths[previous];
-                if (SameOutputDestination(first, second))
+                if (SameOutputDestination(first, second, canonicalOutputPaths[index], canonicalOutputPaths[previous]))
                     throw Domain::RelinkerException("Output paths collide: " + Io::Utf8Path(first) + " and " + Io::Utf8Path(second));
             }
         }
diff --git a/core/relinker/relinker/include/relinker/guest/GuestImage.hpp b/core/relinker/relinker/include/relinker/guest/GuestImage.hpp
index 6be45157af..8fe4507a89 100644
--- a/core/relinker/relinker/include/relinker/guest/GuestImage.hpp
+++ b/core/relinker/relinker/include/relinker/guest/GuestImage.hpp
@@ -57,6 +57,7 @@ struct GuestImage {
     std::uint64_t Got = 0;
     bool UsePlatformTlsResolver = true;
     bool Symbolic = false;
+    std::vector<std::size_t> NamedImports;
 };
 
 class GuestImageReader {
diff --git a/core/relinker/relinker/include/relinker/patching/GamePatch.hpp b/core/relinker/relinker/include/relinker/patching/GamePatch.hpp
index 6b76048dfb..e04f9605e3 100644
--- a/core/relinker/relinker/include/relinker/patching/GamePatch.hpp
+++ b/core/relinker/relinker/include/relinker/patching/GamePatch.hpp
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <codegen/CodegenTypes.hpp>
+#include <codegen/x86/RedZoneFramer.hpp>
 #include <relinker/domain/RelinkResult.hpp>
 #include <relinker/parsing/ElfReader.hpp>
 #include <cstdint>
@@ -83,6 +84,8 @@ struct WriterSites {
     std::span<const WriterRange> Traps;
     std::span<const std::uint8_t> RelaData;
     std::span<const std::uint8_t> RelaPltData;
+    std::span<const Codegen::TrampolineSite> RedZoneSites = {};
+    std::span<const Codegen::RedZoneDisplacement> RedZoneDisplacements = {};
 };
 
 enum class VerifyStatus { Applicable, Applied, NotChecked, Mismatch };
diff --git a/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp b/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp
index 6998e95873..3a45a1ea10 100644
--- a/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp
+++ b/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp
@@ -15,6 +15,7 @@ struct ConversionOptions {
     std::uint32_t UnusedFilterLevel = 0;
     bool ToIntel = false;
     bool ToRosetta = false;
+    bool FrameRedZone = false;
     bool SkipSyscallCheck = false;
     bool TrapSdkSyscallStubs = false;
     bool LazyBinding = false;
diff --git a/core/relinker/relinker/src/analysis/CallSiteResolver.cpp b/core/relinker/relinker/src/analysis/CallSiteResolver.cpp
index 91fe531f9c..a99edf14ee 100644
--- a/core/relinker/relinker/src/analysis/CallSiteResolver.cpp
+++ b/core/relinker/relinker/src/analysis/CallSiteResolver.cpp
@@ -26,7 +26,12 @@ std::optional<std::size_t> ripRelativeDispOffset(const std::vector<std::uint8_t>
     while (cur < end) {
         std::uint8_t b = text[cur];
         if (b >= RexMin && b <= RexMax) {
-            if (b & RexWBit) hasRexW = true;
+            hasRexW = (b & RexWBit) != 0;
+            ++cur;
+            continue;
+        }
+        if (b == PrefixRepne || b == PrefixSegDs) {
+            hasRexW = false;
             ++cur;
             continue;
         }
diff --git a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
index 645dd46f3a..14fd038f7a 100644
--- a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
+++ b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
@@ -6,6 +6,7 @@
 #include <codegen/IInstructionScanner.hpp>
 #include <codegen/x86/X64InstructionDecoder.hpp>
 #include <codegen/CodegenException.hpp>
+#include <elfpatcher/general/ElfConstants.hpp>
 #include <io/BufferUtils.hpp>
 #include <algorithm>
 #include <bit>
@@ -272,7 +273,8 @@ std::set<Domain::VirtualAddress> CodeInstructionCollector::Collect(const std::ve
         symbols = table(6, 0x61000039, symbolCount * 24);
         for (std::uint64_t index = 0; index < symbolCount; ++index) {
             const auto offset = symbols + index * 24;
-            if ((bytes[offset + 4] & 15) == 2 && Io::ReadU16(bytes, offset + 6) != 0) {
+            const auto section = Io::ReadU16(bytes, offset + 6);
+            if ((bytes[offset + 4] & 15) == 2 && section != 0 && section != Elfpatcher::SHN_ABS) {
                 const auto address = Io::ReadU64(bytes, offset + 8);
                 addRoot(address);
                 addFunction(address, Io::ReadU64(bytes, offset + 16), true);
@@ -344,7 +346,7 @@ std::set<Domain::VirtualAddress> CodeInstructionCollector::Collect(const std::ve
         addFunction(function.Begin, function.End - function.Begin, false);
         for (const auto target : function.ExtraTargets) addRoot(target);
     }
-    if (sceBase) {
+    if (sceBase || !functions.empty()) {
         const std::vector<std::pair<std::uint64_t, std::uint64_t>> ranges(functions.begin(), functions.end());
         for (const auto& header : codeHeaders) {
             if (header.Type != 1 || (header.Flags & 1) == 0) continue;
diff --git a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
index 7c99111960..0171c49c9b 100644
--- a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
+++ b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
@@ -3,6 +3,8 @@
 #include <codegen/CodegenException.hpp>
 #include <algorithm>
 #include <cstring>
+#include <optional>
+#include <set>
 
 namespace Relinker {
 
@@ -67,6 +69,183 @@ std::size_t TablesEnd(std::span<const std::uint8_t> code, std::size_t firstTable
     return table;
 }
 
+bool IsInvalid64BitSingleByteOpcode(std::uint8_t opcode) {
+    switch (opcode) {
+    case 0x06:
+    case 0x07:
+    case 0x0e:
+    case 0x16:
+    case 0x17:
+    case 0x1e:
+    case 0x1f:
+    case 0x27:
+    case 0x2f:
+    case 0x37:
+    case 0x3f:
+    case 0x60:
+    case 0x61:
+    case 0x82:
+    case 0x9a:
+    case 0xce:
+    case 0xd4:
+    case 0xd5:
+    case 0xd6:
+    case 0xea:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool IsForbiddenSyscallInstruction(std::span<const std::uint8_t> code, std::size_t pos, const Codegen::DecodedInstructionInfo& info) {
+    const auto opPos = pos + info.OpcodeOffset;
+    if (opPos + 1 >= pos + info.Length || opPos + 1 >= code.size()) return false;
+    const auto b0 = code[opPos];
+    const auto b1 = code[opPos + 1];
+    return (b0 == 0x0f && (b1 == 0x05 || b1 == 0x34 || b1 == 0x07)) || (b0 == 0xcd && b1 == 0x80);
+}
+
+bool IsValid64BitInstruction(std::span<const std::uint8_t> code, std::size_t pos, const Codegen::DecodedInstructionInfo& info, VirtualAddress baseVAddr, VirtualAddress segmentVAddr, VirtualAddress segmentEnd) {
+    if (info.Length == 0 || info.Length > code.size() - pos) return false;
+    if (!info.IsTwoByteOpcode && IsInvalid64BitSingleByteOpcode(info.Opcode)) return false;
+    if (info.HasBranchTarget && !info.HasRipRelativeDisp) {
+        const auto target = static_cast<std::int64_t>(baseVAddr + pos + info.Length) + info.BranchDisp;
+        if (target < static_cast<std::int64_t>(segmentVAddr) || target >= static_cast<std::int64_t>(segmentEnd)) return false;
+    }
+    return true;
+}
+
+bool EndsControlFlow(const Codegen::DecodedInstructionInfo& info, bool isSyscall) {
+    return info.FlowKind == Codegen::ControlFlowKind::Return
+        || info.FlowKind == Codegen::ControlFlowKind::UnconditionalJump
+        || info.FlowKind == Codegen::ControlFlowKind::IndirectJump
+        || info.FlowKind == Codegen::ControlFlowKind::Trap || isSyscall;
+}
+
+class GapAnalysis {
+    enum class Trailing { Invalid, Padding, Terminator, NonTerminator };
+
+public:
+    GapAnalysis(std::span<const std::uint8_t> code, VirtualAddress baseVAddr, VirtualAddress segmentVAddr, VirtualAddress segmentEnd, const Codegen::X64InstructionDecoder& decoder)
+        : code(code), padding(code.size() + 1), trailing(code.size() + 1), syscalls(code.size() + 1) {
+        padding.back() = true;
+        trailing.back() = Trailing::Padding;
+        for (std::size_t end = code.size(); end != 0;) {
+            const auto pos = --end;
+            const bool bytePadding = code[pos] == 0x00 || code[pos] == 0xcc || code[pos] == 0x90;
+            if (bytePadding && padding[pos + 1]) {
+                padding[pos] = true;
+                trailing[pos] = Trailing::Padding;
+                continue;
+            }
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(code.data() + pos, code.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                continue;
+            }
+            if (info.Length == 0 || info.Length > code.size() - pos) continue;
+            const bool nop = IsNop(code, pos, info.Length);
+            if (nop && padding[pos + info.Length]) {
+                padding[pos] = true;
+                trailing[pos] = Trailing::Padding;
+                continue;
+            }
+            if (!IsValid64BitInstruction(code, pos, info, baseVAddr, segmentVAddr, segmentEnd)) continue;
+            const auto next = pos + info.Length;
+            const bool isSyscall = IsForbiddenSyscallInstruction(code, pos, info);
+            syscalls[pos] = isSyscall || syscalls[next];
+            if (EndsControlFlow(info, isSyscall)) {
+                trailing[pos] = isSyscall || trailing[next] == Trailing::Padding ? Trailing::Terminator : Trailing::NonTerminator;
+                continue;
+            }
+            if (trailing[next] != Trailing::Padding) {
+                trailing[pos] = trailing[next];
+                continue;
+            }
+            trailing[pos] = nop || code[pos] == 0xcc || code[pos] == 0x00 ? Trailing::Padding : Trailing::NonTerminator;
+        }
+    }
+
+    bool OnlyPadding(std::size_t from) const { return padding[from]; }
+
+    bool DecodesAsTrailingCodeBlock(std::size_t from, bool* outHasSyscall = nullptr) const {
+        if (outHasSyscall != nullptr) *outHasSyscall = false;
+        if (from >= code.size() || code[from] == 0x00 || code[from] == 0xcc || code[from] == 0x90) return false;
+        if (outHasSyscall != nullptr) *outHasSyscall = syscalls[from];
+        return trailing[from] == Trailing::Terminator;
+    }
+
+private:
+    std::span<const std::uint8_t> code;
+    std::vector<bool> padding;
+    std::vector<Trailing> trailing;
+    std::vector<bool> syscalls;
+};
+
+std::size_t FindEmbeddedDataTableEnd(std::span<const std::uint8_t> code, VirtualAddress tableVAddr, VirtualAddress segmentVAddr, VirtualAddress segmentEnd, const Codegen::X64InstructionDecoder& decoder) {
+    const GapAnalysis analysis(code, tableVAddr, segmentVAddr, segmentEnd, decoder);
+    std::optional<std::size_t> firstInvalidPos;
+    for (std::size_t pos = 0; pos < code.size();) {
+        if (analysis.OnlyPadding(pos)) break;
+        Codegen::DecodedInstructionInfo info;
+        try {
+            info = decoder.DecodeInstruction(code.data() + pos, code.size() - pos);
+        } catch (const Codegen::CodegenException&) {
+            firstInvalidPos = pos;
+            break;
+        }
+        if (!IsValid64BitInstruction(code, pos, info, tableVAddr, segmentVAddr, segmentEnd)) {
+            firstInvalidPos = pos;
+            break;
+        }
+        if (IsForbiddenSyscallInstruction(code, pos, info) || info.FlowKind != Codegen::ControlFlowKind::Sequential) return 0;
+        pos += info.Length;
+    }
+    if (!firstInvalidPos) return 0;
+    const bool duplicatedEightByteRow = code.size() >= 16 && std::memcmp(code.data(), code.data() + 8, 8) == 0;
+    if (*firstInvalidPos != 0 && (!duplicatedEightByteRow || *firstInvalidPos > 4)) return 0;
+
+    std::optional<std::size_t> firstDecodeFailure;
+    for (std::size_t pos = 0; pos < code.size();) {
+        if (analysis.OnlyPadding(pos)) break;
+        try {
+            const auto info = decoder.DecodeInstruction(code.data() + pos, code.size() - pos);
+            if (info.Length == 0 || info.Length > code.size() - pos) {
+                firstDecodeFailure = pos;
+                break;
+            }
+            if (IsForbiddenSyscallInstruction(code, pos, info)) return 0;
+            pos += info.Length;
+        } catch (const Codegen::CodegenException&) {
+            firstDecodeFailure = pos;
+            break;
+        }
+    }
+    if (!firstDecodeFailure) return 0;
+
+    for (std::size_t pos = *firstDecodeFailure + 1; pos < code.size();) {
+        if (code[pos] != 0xcc && code[pos] != 0x90 && code[pos] != 0x00) {
+            ++pos;
+            continue;
+        }
+        const auto padStart = pos;
+        bool hasZeroPad = false;
+        while (pos < code.size() && (code[pos] == 0xcc || code[pos] == 0x90 || code[pos] == 0x00)) {
+            if (code[pos] == 0x00) hasZeroPad = true;
+            ++pos;
+        }
+        if (pos < code.size() && analysis.DecodesAsTrailingCodeBlock(pos))
+            return hasZeroPad ? pos : padStart;
+    }
+    for (std::size_t pos = *firstDecodeFailure + 1; pos < code.size(); ++pos) {
+        bool hasSyscall = false;
+        if (analysis.DecodesAsTrailingCodeBlock(pos, &hasSyscall) && hasSyscall)
+            return pos;
+    }
+    return code.size();
+}
+
 }
 
 std::size_t FindTrailingRelativeJumpTable(std::span<const std::uint8_t> code, VirtualAddress codeAddress, std::size_t* tableEnd, std::size_t unwindEnd) {
@@ -121,6 +300,68 @@ std::size_t FindTrailingRelativeJumpTable(std::span<const std::uint8_t> code, Vi
 std::vector<RelativeJumpTable> FindRelativeJumpTables(std::span<const std::uint8_t> segment, VirtualAddress segmentVAddr, const std::vector<std::pair<VirtualAddress, VirtualAddress>>& functions) {
     std::vector<RelativeJumpTable> tables;
     const auto segmentEnd = segmentVAddr + segment.size();
+    const Codegen::X64InstructionDecoder decoder;
+    std::set<VirtualAddress> branchTargets;
+    for (const auto& [funcBegin, funcEnd] : functions) {
+        if (funcBegin < segmentVAddr || funcBegin >= segmentEnd || funcEnd <= funcBegin) continue;
+        const auto inspectFuncEnd = std::min(funcEnd, segmentEnd);
+        const auto funcCode = segment.subspan(funcBegin - segmentVAddr, inspectFuncEnd - funcBegin);
+        for (std::size_t pos = 0; pos < funcCode.size();) {
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(funcCode.data() + pos, funcCode.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                break;
+            }
+            if (info.Length == 0 || info.Length > funcCode.size() - pos) break;
+            if (info.HasBranchTarget && !info.HasRipRelativeDisp) {
+                const auto target = static_cast<std::int64_t>(funcBegin + pos + info.Length) + info.BranchDisp;
+                if (target >= static_cast<std::int64_t>(segmentVAddr) && target < static_cast<std::int64_t>(segmentEnd))
+                    branchTargets.insert(static_cast<VirtualAddress>(target));
+            }
+            pos += info.Length;
+        }
+    }
+    auto knownFunctions = functions;
+    std::erase_if(knownFunctions, [](const auto& range) { return range.first >= range.second; });
+    std::sort(knownFunctions.begin(), knownFunctions.end());
+    std::vector<std::pair<VirtualAddress, VirtualAddress>> mergedFunctions;
+    for (const auto& range : knownFunctions) {
+        if (!mergedFunctions.empty() && range.first <= mergedFunctions.back().second)
+            mergedFunctions.back().second = std::max(mergedFunctions.back().second, range.second);
+        else
+            mergedFunctions.emplace_back(range);
+    }
+    std::vector<VirtualAddress> pendingTargets(branchTargets.begin(), branchTargets.end());
+    std::set<VirtualAddress> exploredGaps;
+    while (!pendingTargets.empty()) {
+        const auto current = pendingTargets.back();
+        pendingTargets.pop_back();
+        if (current < segmentVAddr || current >= segmentEnd) continue;
+        const auto after = std::upper_bound(mergedFunctions.begin(), mergedFunctions.end(), current,
+            [](VirtualAddress value, const auto& range) { return value < range.first; });
+        const bool inKnownFunction = after != mergedFunctions.begin() && current < std::prev(after)->second;
+        if (inKnownFunction || !exploredGaps.insert(current).second) continue;
+        auto pos = static_cast<std::size_t>(current - segmentVAddr);
+        while (pos < segment.size()) {
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(segment.data() + pos, segment.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                break;
+            }
+            if (info.Length == 0 || info.Length > segment.size() - pos) break;
+            if (info.HasBranchTarget && !info.HasRipRelativeDisp) {
+                const auto target = static_cast<std::int64_t>(segmentVAddr + pos + info.Length) + info.BranchDisp;
+                if (target >= static_cast<std::int64_t>(segmentVAddr) && target < static_cast<std::int64_t>(segmentEnd)) {
+                    const auto targetVAddr = static_cast<VirtualAddress>(target);
+                    if (branchTargets.insert(targetVAddr).second) pendingTargets.push_back(targetVAddr);
+                }
+            }
+            if (info.FlowKind == Codegen::ControlFlowKind::Return || info.FlowKind == Codegen::ControlFlowKind::IndirectJump || info.FlowKind == Codegen::ControlFlowKind::Trap) break;
+            pos += info.Length;
+        }
+    }
     for (std::size_t index = 0; index < functions.size(); ++index) {
         const auto [begin, end] = functions[index];
         if (begin < segmentVAddr || begin >= segmentEnd || end <= begin) continue;
@@ -129,8 +370,45 @@ std::vector<RelativeJumpTable> FindRelativeJumpTables(std::span<const std::uint8
             inspectEnd = std::min(functions[index + 1].first, segmentEnd);
         const auto code = segment.subspan(begin - segmentVAddr, inspectEnd - begin);
         std::size_t tableEnd = code.size();
-        if (const auto tail = FindTrailingRelativeJumpTable(code, begin, &tableEnd, std::min(end, segmentEnd) - begin); tail != 0 && tail < code.size())
+        if (const auto tail = FindTrailingRelativeJumpTable(code, begin, &tableEnd, std::min(end, segmentEnd) - begin); tail != 0 && tail < code.size()) {
             tables.push_back({begin, begin + tail, begin + tableEnd});
+            continue;
+        }
+        if (inspectEnd <= end) continue;
+        const auto funcCode = segment.subspan(begin - segmentVAddr, end - begin);
+        std::optional<VirtualAddress> candidateTable;
+        bool sawIndirectJump = false;
+        for (std::size_t pos = 0; pos < funcCode.size();) {
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(funcCode.data() + pos, funcCode.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                break;
+            }
+            if (info.Length == 0 || info.Length > funcCode.size() - pos) break;
+            if (info.FlowKind == Codegen::ControlFlowKind::IndirectJump) sawIndirectJump = true;
+            const auto next = pos + info.Length;
+            if (info.HasRipRelativeDisp && !info.IsTwoByteOpcode && info.OpcodeOffset < info.Length && info.Length >= 4 && funcCode[pos + info.OpcodeOffset] == 0x8d) {
+                std::int32_t displacement = 0;
+                std::memcpy(&displacement, funcCode.data() + next - 4, sizeof(displacement));
+                const auto target = static_cast<std::int64_t>(begin + next) + displacement;
+                if (target >= static_cast<std::int64_t>(end) && target < static_cast<std::int64_t>(inspectEnd)) {
+                    const auto targetVAddr = static_cast<VirtualAddress>(target);
+                    candidateTable = candidateTable ? std::min(*candidateTable, targetVAddr) : targetVAddr;
+                }
+            }
+            pos = next;
+        }
+        if (sawIndirectJump || !candidateTable) continue;
+        const auto tableVAddr = *candidateTable;
+        const auto paddingCode = segment.subspan(end - segmentVAddr, tableVAddr - end);
+        if (!OnlyPadding(paddingCode, 0, paddingCode.size(), decoder)) continue;
+        const auto it = branchTargets.lower_bound(tableVAddr);
+        if (it != branchTargets.end() && *it < inspectEnd) continue;
+        const auto tableCode = segment.subspan(tableVAddr - segmentVAddr, inspectEnd - tableVAddr);
+        const auto tableSize = FindEmbeddedDataTableEnd(tableCode, tableVAddr, segmentVAddr, segmentEnd, decoder);
+        if (tableSize == 0) continue;
+        tables.push_back({begin, tableVAddr, tableVAddr + tableSize});
     }
     return tables;
 }
diff --git a/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp b/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp
index da812ba58e..d8c89bcffb 100644
--- a/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp
+++ b/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp
@@ -103,13 +103,16 @@ void buildGraph(std::span<const std::uint8_t> text, VirtualAddress textVaddr, Vi
             if (followCodeAddresses && info.HasRipRelativeDisp && text[bufOff + info.OpcodeOffset] == 0x8d && (info.RexPrefix & 8)) {
                 std::int32_t displacement = 0;
                 std::memcpy(&displacement, text.data() + bufOff + info.RipRelativeDispOffset, 4);
-                enqueue(nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement)));
+                auto target = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement));
+                if (info.AddressSize32) target = static_cast<std::uint32_t>(target);
+                enqueue(target);
             }
 
             if (data != nullptr && info.HasRipRelativeDisp && !info.IsTwoByteOpcode && info.Opcode == 0x8D) {
                 std::int32_t displacement = 0;
                 std::memcpy(&displacement, text.data() + bufOff + info.RipRelativeDispOffset, 4);
-                const auto base = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement));
+                auto base = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement));
+                if (info.AddressSize32) base = static_cast<std::uint32_t>(base);
                 takeAddress(base);
                 for (VirtualAddress target : ReadRelativeTableTargets(*data, base, textVaddr, text.size())) takeAddress(target);
             }
@@ -129,6 +132,7 @@ void buildGraph(std::span<const std::uint8_t> text, VirtualAddress textVaddr, Vi
                         std::int32_t disp = 0;
                         std::memcpy(&disp, text.data() + bufOff + info.RipRelativeDispOffset, 4);
                         VirtualAddress slotVaddr = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(disp));
+                        if (info.AddressSize32) slotVaddr = static_cast<std::uint32_t>(slotVaddr);
                         auto resolved = relativeRelocations.TargetOfSlot(slotVaddr);
                         if (resolved.has_value())
                             enqueue(*resolved);
@@ -141,6 +145,7 @@ void buildGraph(std::span<const std::uint8_t> text, VirtualAddress textVaddr, Vi
                         std::int32_t disp = 0;
                         std::memcpy(&disp, text.data() + bufOff + info.RipRelativeDispOffset, 4);
                         VirtualAddress slotVaddr = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(disp));
+                        if (info.AddressSize32) slotVaddr = static_cast<std::uint32_t>(slotVaddr);
                         auto resolved = relativeRelocations.TargetOfSlot(slotVaddr);
                         if (resolved.has_value())
                             enqueue(*resolved);
diff --git a/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp b/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp
index 9d1e5a3c2e..18dc887f88 100644
--- a/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp
+++ b/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp
@@ -43,8 +43,10 @@ std::unique_ptr<IGotAccessIndex> BuildGotAccessIndex(
         VirtualAddress nextVaddr = va + static_cast<VirtualAddress>(info.Length);
         std::int32_t disp = 0;
         std::memcpy(&disp, text.data() + bufOff + info.RipRelativeDispOffset, 4);
-        if (disp < 0 && nextVaddr < static_cast<VirtualAddress>(-static_cast<std::int64_t>(disp))) continue;
-        if (disp > 0 && std::numeric_limits<VirtualAddress>::max() - nextVaddr < static_cast<VirtualAddress>(disp)) continue;
+        if (!info.AddressSize32) {
+            if (disp < 0 && nextVaddr < static_cast<VirtualAddress>(-static_cast<std::int64_t>(disp))) continue;
+            if (disp > 0 && std::numeric_limits<VirtualAddress>::max() - nextVaddr < static_cast<VirtualAddress>(disp)) continue;
+        }
         VirtualAddress target = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(disp));
         if (info.AddressSize32) target = static_cast<std::uint32_t>(target);
         accessed.insert(target);
diff --git a/core/relinker/relinker/src/analysis/ValidationPolicy.cpp b/core/relinker/relinker/src/analysis/ValidationPolicy.cpp
index dfd0a11798..b9d67a3069 100644
--- a/core/relinker/relinker/src/analysis/ValidationPolicy.cpp
+++ b/core/relinker/relinker/src/analysis/ValidationPolicy.cpp
@@ -11,20 +11,13 @@ void ValidationPolicy::_initializeSupportedRelocationTypes() {
         R_X86_64_NONE,
         R_X86_64_64,
         R_X86_64_PC32,
-        R_X86_64_GOT32,
-        R_X86_64_PLT32,
-        R_X86_64_COPY,
         R_X86_64_GLOB_DAT,
         R_X86_64_JUMP_SLOT,
         R_X86_64_RELATIVE,
-        R_X86_64_GOTPCREL,
         R_X86_64_32,
-        R_X86_64_32S,
         R_X86_64_DTPMOD64,
         R_X86_64_DTPOFF64,
         R_X86_64_TPOFF64,
-        R_X86_64_GOTPCRELX,
-        R_X86_64_REX_GOTPCRELX,
     };
 }
 
diff --git a/core/relinker/relinker/src/guest/GuestImageReader.cpp b/core/relinker/relinker/src/guest/GuestImageReader.cpp
index 49a209c9d4..66ac129902 100644
--- a/core/relinker/relinker/src/guest/GuestImageReader.cpp
+++ b/core/relinker/relinker/src/guest/GuestImageReader.cpp
@@ -38,8 +38,10 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
     std::map<std::uint64_t, std::uint64_t> loads;
     constexpr std::uint32_t sceComment = 0x6fffff00;
     constexpr std::uint32_t sceLibVersion = 0x6fffff01;
+    constexpr std::uint32_t note = 4;
     for (const auto& header : image.Headers) {
         if (header.Type == sceComment || header.Type == sceLibVersion) continue;
+        if (header.Type == note && header.MappedAddress == 0 && header.MemorySize == 0) continue;
         range(header.Offset, header.FileSize);
         if (header.Type == 1) {
             if (header.FileSize > header.MemorySize || header.MemorySize > std::numeric_limits<std::uint64_t>::max() - header.MappedAddress || (header.Flags & ~7u) != 0) fail("Invalid load segment");
@@ -162,6 +164,8 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
         if (!importModules.emplace(value >> 48, string(value & 0xffffffffu)).second) fail("Duplicate import module ID");
     std::vector<std::string> neededLibraries;
     for (const auto offset : needed) neededLibraries.push_back(string(offset));
+    const bool consoleFileNames = std::any_of(neededLibraries.begin(), neededLibraries.end(),
+        [](const std::string& name) { return Domain::NeededLibraryName(name) != name; });
     std::map<std::string, std::size_t> exports;
     for (std::uint64_t offset = 0; offset < symSize; offset += 24) {
         auto name = string(Io::ReadU32(bytes, symOffset + offset));
@@ -187,14 +191,13 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
             const auto [found, inserted] = exports.emplace(name, image.Symbols.size());
             if (name.empty() || (!inserted && (!windows || !IdenticalOrdinaryFunctionExport(image.Symbols[found->second], symbol)))) fail("Duplicate or empty export after stripping #: " + name);
         }
+        if (section >= 0xff00 && (section != AbsoluteSection || (info & 15) == 6)) fail("Unsupported special symbol section: " + name);
         if ((info & 15) == 6 && section != 0 && (tls == nullptr || value > tls->MemorySize || size > tls->MemorySize - value)) fail("TLS symbol exceeds TLS segment: " + name);
-        if (section != 0 && section != AbsoluteSection && (info & 15) != 6) {
-            if (section >= 0xff00) fail("Unsupported special symbol section: " + name);
-            mapped(value, std::max<std::uint64_t>(size, 1), (info & 15) == 2 ? 1 : 0);
-        }
+        if (section != 0 && section != AbsoluteSection && (info & 15) != 6) mapped(value, std::max<std::uint64_t>(size, 1), (info & 15) == 2 ? 1 : 0);
         if (image.Dynamic.DynStrData.size() > std::numeric_limits<std::uint32_t>::max()) fail("String table too large");
         Io::WriteU32(image.Dynamic.DynSymData, offset, static_cast<std::uint32_t>(image.Dynamic.DynStrData.size()));
         Io::AppendString(image.Dynamic.DynStrData, name);
+        if (consoleFileNames && section == 0 && !name.empty() && name == qualifiedName) image.NamedImports.push_back(image.Symbols.size());
         image.Symbols.push_back(symbol);
     }
     if (tags.contains(14)) {
@@ -283,8 +286,8 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
     if (image.HasInit) mapped(image.Init, 1, 1);
     if (image.Fini != 0) mapped(image.Fini, 1, 1);
     const auto readLifecycleArray = [&](std::uint64_t addressTag, std::uint64_t sizeTag, std::vector<std::uint64_t>& entries) {
-        if (!tags.contains(addressTag) && !tags.contains(sizeTag)) return;
-        if (!tags.contains(sizeTag) || (tags.at(sizeTag) != 0 && !tags.contains(addressTag))) fail("Incomplete guest lifecycle array");
+        if (!tags.contains(sizeTag)) return;
+        if (tags.at(sizeTag) != 0 && !tags.contains(addressTag)) fail("Incomplete guest lifecycle array");
         const auto size = tags.at(sizeTag);
         if (size == 0) return;
         if (size % 8 != 0) fail("Unaligned guest lifecycle array size");
diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
index 1ffd34e19d..d234bbe4db 100644
--- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
+++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
@@ -1,4 +1,5 @@
 #include <relinker/guest/GuestImage.hpp>
+#include <relinker/analysis/RelativeJumpTables.hpp>
 #include <relinker/analysis/SceCodeExtent.hpp>
 #include <relinker/analysis/UnusedNidFilter/EhFrameReader.hpp>
 #include <elfpatcher/general/GuestModuleWriter.hpp>
@@ -6,6 +7,7 @@
 #include <domain/ImportModule.hpp>
 #include <io/NativePath.hpp>
 #include <io/BufferUtils.hpp>
+#include <nid/NidCompute.hpp>
 #include <algorithm>
 #include <functional>
 #include <limits>
@@ -42,6 +44,37 @@ std::vector<std::string> ReadNeededNames(const Domain::SysVDynamicSection& dynam
     return names;
 }
 
+std::string SymbolName(const Domain::SysVDynamicSection& dynamic, const std::size_t index) {
+    if (dynamic.DynSymData.size() % 24 != 0 || index >= dynamic.DynSymData.size() / 24) throw Domain::RelinkerException("Invalid symbol index");
+    const auto nameOffset = Io::ReadU32(dynamic.DynSymData, index * 24);
+    if (nameOffset >= dynamic.DynStrData.size()) throw Domain::RelinkerException("Invalid symbol name offset");
+    const auto start = dynamic.DynStrData.begin() + nameOffset;
+    const auto end = std::find(start, dynamic.DynStrData.end(), 0);
+    if (end == dynamic.DynStrData.end()) throw Domain::RelinkerException("Unterminated symbol name");
+    return std::string(start, end);
+}
+
+std::set<std::string> ExportedNames(const Domain::SysVDynamicSection& dynamic) {
+    std::set<std::string> names;
+    for (std::size_t index = 1; index < dynamic.DynSymData.size() / 24; ++index) {
+        const auto info = dynamic.DynSymData[index * 24 + 4];
+        const auto visibility = dynamic.DynSymData[index * 24 + 5] & 3;
+        if (Io::ReadU16(dynamic.DynSymData, index * 24 + 6) != 0 && (info >> 4) != 0 && visibility != 1 && visibility != 2)
+            names.insert(SymbolName(dynamic, index));
+    }
+    return names;
+}
+
+void BindNamedImportsByNid(GuestImage& image, const std::set<std::string>& kept) {
+    for (const auto index : image.NamedImports) {
+        const auto name = SymbolName(image.Dynamic, index);
+        if (name.ends_with(GuestSymbolSuffix) || kept.contains(name)) continue;
+        if (image.Dynamic.DynStrData.size() > std::numeric_limits<std::uint32_t>::max()) throw Domain::RelinkerException("Guest string table too large");
+        Io::WriteU32(image.Dynamic.DynSymData, index * 24, static_cast<std::uint32_t>(image.Dynamic.DynStrData.size()));
+        Io::AppendString(image.Dynamic.DynStrData, Nid::ComputeNid(name, ""));
+    }
+}
+
 std::string FoldFilename(std::string name) {
     for (auto& character : name) if (character >= 'A' && character <= 'Z') character = static_cast<char>(character + ('a' - 'A'));
     return name;
@@ -257,6 +290,7 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
             }
             if (provider != nullptr) {
                 if ((symbol.Info & 15) != 0 && (symbol.Info & 15) != provider->Type) throw Domain::RelinkerException("Guest import/export type mismatch: " + symbol.Name);
+                if (provider->Type == 6 && (symbol.Info & 15) == 0 && referencedSymbols.contains(symbolIndex)) throw Domain::RelinkerException("Non-TLS relocation against guest TLS export: " + symbol.Name);
                 if (provider->Provider != index && referencedSymbols.contains(symbolIndex)) dependencies[index].insert(provider->Provider);
             } else if (windows && (symbol.Info & 15) == 6) throw Domain::RelinkerException("Windows guest TLS import requires a guest TLS export: " + symbol.Name);
             if (provider == nullptr) systemImports[index].insert(symbolIndex);
@@ -292,12 +326,14 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
         return directory == "." ? std::string("app0") : "app0/" + directory;
     };
     if (!windows) {
+        const auto executableExports = macos ? std::set<std::string>{} : ExportedNames(dynamic);
         for (auto& image : images) {
             for (std::size_t index = 1; index < image.Symbols.size(); ++index) {
                 const auto& symbol = image.Symbols[index];
                 const bool exported = symbol.Section != 0 && (symbol.Info >> 4) != 0 && symbol.Visibility != 1 && symbol.Visibility != 2;
                 if (((symbol.Section == 0 && !declaresHost(symbol.Library)) || exported) && exports.contains(symbol.Name)) rename(image.Dynamic.DynSymData, image.Dynamic.DynStrData, index, symbol.Name);
             }
+            if (!macos) BindNamedImportsByNid(image, executableExports);
         }
     }
     std::vector<std::size_t> order;
@@ -314,17 +350,18 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
     std::vector<std::string> hostLibraries;
     std::vector<std::vector<std::string>> moduleHostLibraries(images.size());
     std::set<std::string> uniqueHosts;
+    const auto hostLibrary = [&](const std::string& name) { return windows || macos ? name : Domain::NeededLibraryName(name); };
     const auto addHost = [&](const std::string& name, const bool startup) {
         if (findGuest(name) != guestNames.end()) return;
         if (name.empty() || name.find_first_of("/\\:$") != std::string::npos) throw Domain::RelinkerException("Invalid host dependency: " + name);
-        if (startup && uniqueHosts.insert(name).second) hostLibraries.push_back(name);
+        if (const auto host = hostLibrary(name); startup && uniqueHosts.insert(host).second) hostLibraries.push_back(host);
     };
     for (const auto& name : neededNames) addHost(name, true);
     for (std::size_t index = 0; index < images.size(); ++index) {
         auto& hosts = moduleHostLibraries[index];
         for (const auto& dependency : images[index].Dependencies) {
             addHost(dependency, windows || !deferred(index));
-            if (findGuest(dependency) == guestNames.end()) hosts.push_back(dependency);
+            if (findGuest(dependency) == guestNames.end()) hosts.push_back(hostLibrary(dependency));
         }
         if (!windows && !macos && images[index].HasInit) {
             if (std::find(hosts.begin(), hosts.end(), "libkernel.prx") == hosts.end()) hosts.push_back("libkernel.prx");
@@ -343,7 +380,12 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
     };
     for (const auto index : order) if (!windows && !deferred(index)) addNeeded("$ORIGIN/" + appDirectory(images[index]) + "/" + images[index].OutputName);
     for (const auto& name : hostLibraries) addNeeded(name);
-    if (!windows && runPath != "$ORIGIN" && !runPath.starts_with("$ORIGIN/") && !runPath.starts_with("$ORIGIN:") && !runPath.starts_with('/')) throw Domain::RelinkerException("Guest Linux run path must be absolute or begin with $ORIGIN");
+    if (!windows) for (std::size_t begin = 0; begin <= runPath.size();) {
+        const auto end = std::min(runPath.find(':', begin), runPath.size());
+        const auto component = std::string_view(runPath).substr(begin, end - begin);
+        if (component != "$ORIGIN" && !component.starts_with("$ORIGIN/") && !component.starts_with('/')) throw Domain::RelinkerException("Guest Linux run path must be absolute or begin with $ORIGIN");
+        begin = end + 1;
+    }
     const auto outputDirectory = outputPath.parent_path().lexically_normal();
     std::vector<GuestArtifact> artifacts;
     for (const auto index : order) {
@@ -359,14 +401,26 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
         }
         if (!image.PatchedRanges.empty()) GamePatch::CheckOverlaps(Io::Utf8Path(image.SourcePath), image.PatchedRanges, {.RelaData = image.Dynamic.RelaData, .RelaPltData = image.Dynamic.RelaPltData});
         const bool sceImage = std::any_of(image.Headers.begin(), image.Headers.end(), [](const Domain::ProgramHeader& header) { return header.Type == 0x61000000; });
-        const auto unwindFunctions = sceImage ? UnusedNidFilter::ReadExceptionFunctions(image.Bytes, image.Headers, {}, {}) : std::vector<UnusedNidFilter::StrictCodeRegion>{};
+        const bool hasEhFrame = sceImage || std::any_of(image.Headers.begin(), image.Headers.end(), [](const Domain::ProgramHeader& header) { return header.Type == 0x6474e550; });
+        const auto unwindFunctions = hasEhFrame ? UnusedNidFilter::ReadExceptionFunctions(image.Bytes, image.Headers, {}, {}) : std::vector<UnusedNidFilter::StrictCodeRegion>{};
+        std::vector<std::pair<VirtualAddress, VirtualAddress>> unwindRanges;
+        for (const auto& function : unwindFunctions) unwindRanges.emplace_back(function.Begin, function.End);
+        std::sort(unwindRanges.begin(), unwindRanges.end());
         for (const auto& header : codeHeaders) {
             std::vector<std::uint8_t> code(image.Bytes.begin() + header.Offset, image.Bytes.begin() + header.Offset + header.FileSize);
             if (sceImage)
                 if (const auto end = FindSceCodeEnd(code, header.MappedAddress, unwindFunctions, image.Got, image.Dynamic.RelaPltData.size()))
                     code.resize(*end - header.MappedAddress);
-            const auto unwindRanges = sceImage ? SceUnwindRanges(code, header.MappedAddress, unwindFunctions) : std::vector<CodeRange>{};
-            for (const auto offset : syscallScanner.ScanCodeSectionForSyscalls(code, header.MappedAddress, code.size(), Io::Utf8Path(image.SourcePath), unwindRanges)) {
+            auto scanCode = code;
+            for (const auto& table : FindRelativeJumpTables(code, header.MappedAddress, unwindRanges)) {
+                if (table.Begin >= header.MappedAddress && table.End >= table.Begin) {
+                    const auto maskEnd = std::min<std::size_t>(table.End - header.MappedAddress, scanCode.size());
+                    const auto maskBegin = std::min<std::size_t>(table.Begin - header.MappedAddress, maskEnd);
+                    std::fill(scanCode.begin() + static_cast<std::ptrdiff_t>(maskBegin), scanCode.begin() + static_cast<std::ptrdiff_t>(maskEnd), std::uint8_t{0x90});
+                }
+            }
+            const auto scanUnwindRanges = sceImage ? SceUnwindRanges(code, header.MappedAddress, unwindFunctions) : std::vector<CodeRange>{};
+            for (const auto offset : syscallScanner.ScanCodeSectionForSyscalls(scanCode, header.MappedAddress, scanCode.size(), Io::Utf8Path(image.SourcePath), scanUnwindRanges)) {
                 if (offset > code.size() || code.size() - offset < 2u)
                     throw Domain::RelinkerException("Syscall trap patch exceeds guest executable segment", header.MappedAddress + offset);
                 if (!image.PatchedRanges.empty()) {
@@ -404,7 +458,10 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
                 needed.push_back("$ORIGIN/" + dependencyPath.lexically_relative(image.SourcePath.parent_path()).generic_string());
             }
             needed.insert(needed.end(), moduleHostLibraries[index].begin(), moduleHostLibraries[index].end());
-            output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath);
+            const auto directory = image.SourcePath.parent_path();
+            const bool deferLinuxStart = isRuntime(index) && directory != root / "sce_module" &&
+                directory != root / "sce_modules" && directory != root / "prx";
+            output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath, deferLinuxStart);
         }
         if (windows) {
             for (const auto& [name, provider] : guestNames) {
@@ -425,7 +482,7 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
         dynamic.GuestModules.push_back(std::move(runtime));
         std::vector<std::string> neededLibraries;
         for (const auto& name : image.Dependencies)
-            if (findGuest(name) == guestNames.end()) neededLibraries.push_back(name);
+            if (findGuest(name) == guestNames.end()) neededLibraries.push_back(hostLibrary(name));
         artifacts.push_back({target, std::move(output), std::move(imports), image.SourcePath, std::move(neededLibraries)});
         progress.Report({Domain::ProgressStage::Modules, Io::Utf8Path(image.SourcePath), artifacts.size(), order.size()});
     }
diff --git a/core/relinker/relinker/src/output/CallRegistryWriter.cpp b/core/relinker/relinker/src/output/CallRegistryWriter.cpp
index 8878c6496c..f79f7fa68b 100644
--- a/core/relinker/relinker/src/output/CallRegistryWriter.cpp
+++ b/core/relinker/relinker/src/output/CallRegistryWriter.cpp
@@ -1,5 +1,6 @@
 #include <relinker/output/CallRegistryWriter.hpp>
 #include <cstdint>
+#include <locale>
 #include <sstream>
 
 namespace Relinker {
@@ -66,6 +67,7 @@ static std::string _jsonString(const std::string& s) {
 
 static std::string _hexOffset(FileByteOffset v) {
     std::ostringstream oss;
+    oss.imbue(std::locale::classic());
     oss << "\"0x" << std::hex << std::uppercase << v << "\"";
     return oss.str();
 }
diff --git a/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp b/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp
index a0044b4765..5c2881d32b 100644
--- a/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp
+++ b/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp
@@ -92,7 +92,8 @@ SysVDynamicSection SysVDynamicSectionBuilder::BuildDynamicSection(
         if (ref.Nid.empty()) return static_cast<std::uint8_t>((STB_WEAK << 4) | STT_NOTYPE);
         const bool tls = ref.RelocationTypeValue == R_X86_64_DTPMOD64 || ref.RelocationTypeValue == R_X86_64_DTPOFF64
             || ref.RelocationTypeValue == R_X86_64_TPOFF64;
-        return static_cast<std::uint8_t>(((ref.Weak ? STB_WEAK : STB_GLOBAL) << 4) | (tls ? STT_TLS : STT_FUNC));
+        const auto type = tls ? STT_TLS : ref.SymbolType;
+        return static_cast<std::uint8_t>(((ref.Weak ? STB_WEAK : STB_GLOBAL) << 4) | type);
     };
 
     static constexpr std::size_t kRelaEntSize = 24;
diff --git a/core/relinker/relinker/src/parsing/ElfReader.cpp b/core/relinker/relinker/src/parsing/ElfReader.cpp
index 3f9da02d4c..82f5e304ae 100644
--- a/core/relinker/relinker/src/parsing/ElfReader.cpp
+++ b/core/relinker/relinker/src/parsing/ElfReader.cpp
@@ -220,6 +220,12 @@ std::vector<SectionHeader> ElfReader::ReadSectionHeaders() const {
         sh.Info = _readU32At(offset + 0x2c);
         sh.EntrySize = _readU64At(offset + kShdrEntSizeOffset);
 
+        if (sh.Type != SHT_NULL && sh.Type != SHT_NOBITS && sh.SectionSize != 0) {
+            if (!_rangeFits(sh.Offset, sh.SectionSize, _fileBuffer.size())) {
+                throw RelinkerException("Section offset out of bounds", sh.Offset);
+            }
+        }
+
         sh.Name = _resolveShdrName(nameOffset, header);
 
         headers.push_back(sh);
diff --git a/core/relinker/relinker/src/patching/GamePatch.cpp b/core/relinker/relinker/src/patching/GamePatch.cpp
index 403264c79b..12f6451372 100644
--- a/core/relinker/relinker/src/patching/GamePatch.cpp
+++ b/core/relinker/relinker/src/patching/GamePatch.cpp
@@ -240,6 +240,15 @@ PatchEntry BuildEntry(const Table& table, const std::size_t headerLine, std::set
     return entry;
 }
 
+std::string Describe(const PatchEntry& entry) {
+    return "patch " + entry.Target + " va=" + HexValue(entry.VirtualAddress) + " (line " + std::to_string(entry.Line) + ")";
+}
+
+void ValidateWidth(const PatchEntry& entry) {
+    if (entry.Expected.empty() || entry.Expected.size() != entry.Value.size())
+        throw Domain::RelinkerException(Describe(entry) + ": expected and value must have the same nonzero width");
+}
+
 struct EntryRange {
     std::optional<PatchedRange> Range;
     std::string Reason;
@@ -275,14 +284,13 @@ std::vector<EntryRange> ResolveEach(const ElfReader& reader, const std::vector<P
     const auto segments = reader.ReadProgramHeaders();
     const auto header = reader.ReadHeader();
     std::vector<EntryRange> resolved;
-    for (const auto& entry : entries) resolved.push_back(ResolveEntry(segments, reader.GetFileSize(), header, entry));
+    for (const auto& entry : entries) {
+        ValidateWidth(entry);
+        resolved.push_back(ResolveEntry(segments, reader.GetFileSize(), header, entry));
+    }
     return resolved;
 }
 
-std::string Describe(const PatchEntry& entry) {
-    return "patch " + entry.Target + " va=" + HexValue(entry.VirtualAddress) + " (line " + std::to_string(entry.Line) + ")";
-}
-
 bool Overlaps(const std::uint64_t firstOffset, const std::uint64_t firstLength, const std::uint64_t secondOffset, const std::uint64_t secondLength) {
     return firstOffset < secondOffset + secondLength && secondOffset < firstOffset + firstLength;
 }
@@ -431,7 +439,10 @@ std::vector<PatchedRange> ResolveRanges(const ElfReader& reader, const std::vect
 std::vector<AppliedPatch> ApplyPatches(std::vector<std::uint8_t>& bytes, const std::string& target, const std::vector<PatchEntry>& entries, const std::vector<PatchedRange>& ranges) {
     if (entries.size() != ranges.size()) throw Domain::RelinkerException("Patch ranges do not match patch entries");
     for (std::size_t index = 0; index < entries.size(); ++index) {
+        ValidateWidth(entries[index]);
         const auto& range = ranges[index];
+        if (range.Length != entries[index].Expected.size())
+            throw Domain::RelinkerException(Describe(entries[index]) + ": range length does not match the patch width", range.Offset);
         if (range.Offset > bytes.size() || range.Length > bytes.size() - range.Offset) throw Domain::RelinkerException(Describe(entries[index]) + ": range exceeds the image", range.Offset);
         const auto first = bytes.begin() + static_cast<std::ptrdiff_t>(range.Offset);
         if (!std::equal(entries[index].Expected.begin(), entries[index].Expected.end(), first))
@@ -470,6 +481,8 @@ void CheckOverlaps(const std::string& target, const std::vector<PatchedRange>& p
     for (const auto& site : writers.Trampolines) sites.push_back({site.Offset, site.Length, "Intel trampoline site"});
     for (const auto& patch : writers.RelinkPatches) sites.push_back({patch.Offset, patch.Bytes.size(), "relinker patch"});
     sites.insert(sites.end(), writers.Traps.begin(), writers.Traps.end());
+    for (const auto& site : writers.RedZoneSites) sites.push_back({site.Offset, site.Length, "red-zone frame site"});
+    for (const auto& moved : writers.RedZoneDisplacements) sites.push_back({moved.Offset, moved.Bytes.size(), "red-zone moved displacement"});
     const auto relaViolation = [&](const std::span<const std::uint8_t> table, const char* name, const PatchedRange& range) {
         for (std::size_t position = 0; position + 24 <= table.size(); position += 24) {
             std::uint64_t relocation = 0;
diff --git a/core/relinker/relinker/src/pipeline/Conversion.cpp b/core/relinker/relinker/src/pipeline/Conversion.cpp
index 1cf1879466..79a03f23bc 100644
--- a/core/relinker/relinker/src/pipeline/Conversion.cpp
+++ b/core/relinker/relinker/src/pipeline/Conversion.cpp
@@ -18,6 +18,8 @@
 #include <relinker/pipeline/RelinkerPipeline.hpp>
 #include <relinker/guest/GuestImage.hpp>
 #include <codegen/IAmd64OnlyConverter.hpp>
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <relinker/analysis/UnusedNidFilter/EhFrameReader.hpp>
 #include <map>
 #include <codegen/CodegenException.hpp>
 #include <algorithm>
@@ -41,6 +43,7 @@ ConversionOutput Conversion::Convert(ConversionInput input, const ConversionOpti
     if (options.Target != TargetSystem::Linux && options.Target != TargetSystem::Windows && options.Target != TargetSystem::MacOs) throw Domain::RelinkerException("Unknown target system");
     if (options.ToRosetta && (!options.ToIntel || options.Target == TargetSystem::Windows)) throw Domain::RelinkerException("Rosetta conversion requires Intel lowering and a non-Windows target");
     if (options.UnusedFilterLevel > 2) throw Domain::RelinkerException("Unused NID filter level must be 0, 1 or 2");
+    if (options.FrameRedZone && options.Target != TargetSystem::Windows) throw Domain::RelinkerException("Red-zone framing requires a Windows target: only Windows exception dispatch writes below RSP");
     if (input.InputPath.empty() || input.OutputPath.empty()) throw Domain::RelinkerException("Input and output names are required");
     if (input.InputPath.lexically_normal() == input.OutputPath.lexically_normal()) throw Domain::RelinkerException("Executable output would overwrite the input executable");
     if (!input.Modules.empty() && input.ModuleRoot.empty()) throw Domain::RelinkerException("Module root is required");
@@ -105,7 +108,27 @@ ConversionOutput Conversion::Convert(ConversionInput input, const ConversionOpti
             throw Domain::RelinkerException("Relinker patch exceeds source image", patch.Offset);
         for (std::size_t index = 0; index < patch.Bytes.size(); ++index) sourceBytes[patch.Offset + index] = patch.Bytes[index];
     }
-    GamePatch::CheckOverlaps(options.TargetName, patchedRanges, {.RelinkPatches = result.Patches, .RelaData = result.DynamicSection.RelaData, .RelaPltData = result.DynamicSection.RelaPltData});
+    const auto intelSites = trampolines.size();
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    if (options.FrameRedZone) {
+        const auto headers = Relinker::ElfReader(sourceBytes).ReadProgramHeaders();
+        std::vector<Domain::ProgramHeader> codeSegments;
+        for (const auto& header : headers) if (header.Type == 1 && (header.Flags & 1) != 0) codeSegments.push_back(header);
+        std::vector<Codegen::RedZoneFunction> functions;
+        for (const auto& region : Relinker::UnusedNidFilter::ReadExceptionFunctions(sourceBytes, headers, {}, {})) functions.push_back({region.Begin, region.End});
+        if (functions.empty()) throw Domain::RelinkerException("Red-zone framing needs function bounds from the executable's .eh_frame, and it has none");
+        Codegen::RedZoneFrameReport report;
+        auto framed = Codegen::FrameRedZoneFunctions(sourceBytes, codeSegments, functions, trampolines, report, displacements);
+        for (const auto& moved : displacements) {
+            if (moved.Offset > sourceBytes.size() || moved.Bytes.size() > sourceBytes.size() - moved.Offset)
+                throw Domain::RelinkerException("Red-zone displacement exceeds source image", moved.Offset);
+            std::copy(moved.Bytes.begin(), moved.Bytes.end(), sourceBytes.begin() + static_cast<std::ptrdiff_t>(moved.Offset));
+        }
+        { std::ostringstream message; message << "Red-zone framing: " << report.Functions << " functions, " << report.RedZoneFunctions << " leaf functions keep values below RSP, " << report.Framed << " framed (" << report.FramedWithoutFramePointer << " without a frame pointer, " << report.MovedOperands << " rsp operands moved, " << report.StubbedOperands << " in " << report.OperandStubs << " operand stubs; " << report.Exits << " exits)\n"; inputProgress.Message(message.str()); }
+        for (const auto& [reason, count] : report.Skipped) { std::ostringstream message; message << "Red-zone framing: skipped " << count << ": " << reason << '\n'; inputProgress.Message(message.str()); }
+        trampolines.insert(trampolines.end(), std::make_move_iterator(framed.begin()), std::make_move_iterator(framed.end()));
+    }
+    GamePatch::CheckOverlaps(options.TargetName, patchedRanges, {.RelinkPatches = result.Patches, .RelaData = result.DynamicSection.RelaData, .RelaPltData = result.DynamicSection.RelaPltData, .RedZoneSites = std::span<const Codegen::TrampolineSite>(trampolines).subspan(intelSites), .RedZoneDisplacements = displacements});
 
     if (!options.Patches.empty()) {
         for (auto& module : input.Modules) {
@@ -132,7 +155,7 @@ ConversionOutput Conversion::Convert(ConversionInput input, const ConversionOpti
         inputProgress.Message("Warning: with --lazy-binding the Linux executable stays position independent and is not placed at 0x400000; a title whose own sceLibcMspaceCreate checks the 40-bit address window stops at start-up\n");
     std::shared_ptr<Elfpatcher::IElfPatcher> patcher;
     if (macos) {
-        patcher = std::make_shared<Elfpatcher::MacOs::MacOsMachOPatcher>(options.MacosFixedBase, [&](std::string_view text) { inputProgress.Message(text); });
+        patcher = std::make_shared<Elfpatcher::MacOs::MacOsMachOPatcher>(options.MacosFixedBase, [&](std::string_view text) { inputProgress.Message(text); }, options.TraceImports);
     } else if (windows) {
         patcher = std::make_shared<Elfpatcher::Windows::WindowsPePatcher>(options.WindowsGui, std::move(input.Icon), input.InputPath.parent_path() / "sce_sys" / "icon0.png", [&](auto completed, auto total) { inputProgress.Report({Domain::ProgressStage::Image, {}, completed, total}); }, options.WindowsFixedBase, options.TraceImports, [&](std::string_view text) { inputProgress.Message(text); });
     } else {
diff --git a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
index 78ce7cd35a..3ce5e70cb7 100644
--- a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
+++ b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
@@ -103,10 +103,11 @@ RelinkResult RelinkerPipeline::Relink() {
     for (const auto& ph : programHeaders) {
         if (ph.Type != PT_DYNAMIC)
             continue;
+        if (hasDynamicSegment)
+            throw RelinkerException("Multiple PT_DYNAMIC segments", ph.Offset);
 
         hasDynamicSegment = true;
         dynTags = elfReader->ReadDynamicTags(ph);
-        break;
     }
 
     if (!hasDynamicSegment)
@@ -120,9 +121,6 @@ RelinkResult RelinkerPipeline::Relink() {
     };
 
     auto getTagValue = [&](const std::int64_t tag) -> std::uint64_t {
-        for (const auto& t : dynTags)
-            if (t.Tag == tag)
-                return t.Value;
         const char* name = "unknown";
         switch (tag) {
         case DT_OS_STRTAB: name = "DT_OS_STRTAB"; break;
@@ -149,6 +147,16 @@ RelinkResult RelinkerPipeline::Relink() {
         case DT_RELAENT: name = "DT_RELAENT"; break;
         case DT_OS_SYMTABSZ: name = "DT_OS_SYMTABSZ"; break;
         }
+        std::optional<std::uint64_t> value;
+        for (const auto& t : dynTags) {
+            if (t.Tag != tag)
+                continue;
+            if (value && *value != t.Value)
+                throw RelinkerException(std::string("Conflicting duplicate ") + name + " tags");
+            value = t.Value;
+        }
+        if (value)
+            return *value;
         std::ostringstream message;
         message << "Required dynamic tag " << name << " (0x" << std::hex << tag << ") not found";
         throw RelinkerException(message.str());
@@ -277,6 +285,8 @@ RelinkResult RelinkerPipeline::Relink() {
 
     for (auto& [fst, snd] : neededLibraryNamesByStrOffset) {
         snd = readCStr(fst);
+        if (snd.empty() || snd.find_first_of("\\:$\r\n") != std::string::npos)
+            throw RelinkerException("Invalid dependency: " + snd, dynStrTabOffset + fst);
         neededLibraries.push_back(snd);
     }
 
@@ -312,8 +322,9 @@ RelinkResult RelinkerPipeline::Relink() {
         return type == R_X86_64_DTPMOD64 || type == R_X86_64_DTPOFF64 || type == R_X86_64_TPOFF64;
     };
 
-    const bool hasTlsSegment = std::any_of(programHeaders.begin(), programHeaders.end(),
-                                           [](const ProgramHeader& ph) { return ph.Type == PT_TLS; });
+    const auto tlsSegment = std::find_if(programHeaders.begin(), programHeaders.end(),
+                                         [](const ProgramHeader& ph) { return ph.Type == PT_TLS && ph.MemorySize != 0; });
+    const bool hasNonEmptyTlsSegment = tlsSegment != programHeaders.end();
 
     const auto definedTlsSymbolValue = [&](const std::uint32_t symIdx, const FileByteOffset pos) -> std::optional<std::uint64_t> {
         const FileByteOffset symOff = symbolEntryPos(symIdx);
@@ -325,6 +336,10 @@ RelinkResult RelinkerPipeline::Relink() {
             throw RelinkerException("TLS relocation names a defined symbol that is not STT_TLS", pos);
         std::uint64_t value = 0;
         std::memcpy(&value, raw.data() + symOff + 8, sizeof(value));
+        std::uint64_t size = 0;
+        std::memcpy(&size, raw.data() + symOff + 16, sizeof(size));
+        if (hasNonEmptyTlsSegment && (value > tlsSegment->MemorySize || size > tlsSegment->MemorySize - value))
+            throw RelinkerException("TLS symbol exceeds TLS segment", pos);
         return value;
     };
     const auto definedTlsSymbol = [&](const std::uint32_t symIdx, const FileByteOffset pos) {
@@ -346,9 +361,14 @@ RelinkResult RelinkerPipeline::Relink() {
             const std::uint32_t symIdx = static_cast<std::uint32_t>(rInfo >> 32);
             const std::uint32_t relType = static_cast<std::uint32_t>(rInfo & 0xffffffff);
 
+            validationPolicy->ValidateRelocationTypeSupported(relType, pos);
+
             if (relType == R_X86_64_NONE)
                 continue;
 
+            if (plt && relType != R_X86_64_JUMP_SLOT)
+                throw RelinkerException("Unsupported PLT relocation type", pos);
+
             if (relType == 8) {
                 if (symIdx != 0 && !isZeroSectionSymbol(symIdx))
                     throw RelinkerException("RELATIVE relocation has a nonzero symbol index", pos);
@@ -369,30 +389,31 @@ RelinkResult RelinkerPipeline::Relink() {
                                                 [](const std::uint8_t byte) { return byte != 0; })))
                 throw RelinkerException("Unnamed import symbol is not a null symbol entry", symOff);
             const bool weak = (raw[symOff + 4] >> 4) == STB_WEAK;
-            const bool function = (raw[symOff + 4] & 15) == STT_FUNC;
-            nidRefs.push_back({name, Domain::ImportModule(name, importModules, neededLibraries), relType, pos, rOffset, rAddend, weak, function});
+            const auto symbolType = static_cast<std::uint8_t>(raw[symOff + 4] & 15);
+            const bool function = symbolType == STT_FUNC;
+            nidRefs.push_back({name, Domain::ImportModule(name, importModules, neededLibraries), relType, pos, rOffset, rAddend, weak, function, symbolType});
         }
     };
 
     extractRela(dynRelaOffset, dynRelaSize, false);
     extractRela(dynJmpRelOffset, dynJmpRelSize, true);
 
-    for (const auto& ref : nidRefs)
-        validationPolicy->ValidateRelocationTypeSupported(ref.RelocationTypeValue, ref.RelocationTableOffset);
-
     std::vector<std::pair<VirtualAddress, VirtualAddress>> unwindRanges;
     std::vector<std::vector<CodeRange>> segmentUnwindRanges(executableSegments.size());
-    if (std::any_of(programHeaders.begin(), programHeaders.end(), [](const ProgramHeader& ph) { return ph.Type == PT_SCE_DYNLIBDATA; })) {
+    const bool sceImage = std::any_of(programHeaders.begin(), programHeaders.end(), [](const ProgramHeader& ph) { return ph.Type == PT_SCE_DYNLIBDATA; });
+    const bool hasEhFrame = sceImage || std::any_of(programHeaders.begin(), programHeaders.end(), [](const ProgramHeader& ph) { return ph.Type == PT_GNU_EH_FRAME; });
+    if (hasEhFrame) {
         const auto functions = UnusedNidFilter::ReadExceptionFunctions(raw, programHeaders, {}, {});
         for (const auto& function : functions) unwindRanges.emplace_back(function.Begin, function.End);
         std::sort(unwindRanges.begin(), unwindRanges.end());
-        for (std::size_t index = 0; index < executableSegments.size(); ++index) {
-            auto& [segment, segmentVAddr, segmentFileOffset] = executableSegments[index];
-            static_cast<void>(segmentFileOffset);
-            if (const auto codeEnd = FindSceCodeEnd(segment, segmentVAddr, functions, gotVAddr, dynJmpRelSize))
-                segment.resize(*codeEnd - segmentVAddr);
-            segmentUnwindRanges[index] = SceUnwindRanges(segment, segmentVAddr, functions);
-        }
+        if (sceImage)
+            for (std::size_t index = 0; index < executableSegments.size(); ++index) {
+                auto& [segment, segmentVAddr, segmentFileOffset] = executableSegments[index];
+                static_cast<void>(segmentFileOffset);
+                if (const auto codeEnd = FindSceCodeEnd(segment, segmentVAddr, functions, gotVAddr, dynJmpRelSize))
+                    segment.resize(*codeEnd - segmentVAddr);
+                segmentUnwindRanges[index] = SceUnwindRanges(segment, segmentVAddr, functions);
+            }
     }
 
     std::vector<std::vector<std::uint8_t>> scanSegments;
@@ -432,13 +453,42 @@ RelinkResult RelinkerPipeline::Relink() {
             std::memcpy(&sourceName, symbol, sizeof(sourceName));
             auto name = readCStr(sourceName);
             name.resize(name.find('#') == std::string::npos ? name.size() : name.find('#'));
+            const FileByteOffset entryOffset = dynSymTabOffset + off;
+            const auto type = symbol[4] & 15;
+            std::uint64_t value = 0;
+            std::uint64_t size = 0;
+            std::memcpy(&value, symbol + 8, sizeof(value));
+            std::memcpy(&size, symbol + 16, sizeof(size));
+            if (type == STT_TLS) {
+                if (section >= SHN_LORESERVE)
+                    throw RelinkerException("Unsupported executable TLS export section: " + name, entryOffset);
+                const auto tls = std::find_if(programHeaders.begin(), programHeaders.end(),
+                                              [](const ProgramHeader& ph) { return ph.Type == PT_TLS; });
+                if (tls == programHeaders.end())
+                    throw RelinkerException("Executable TLS export has no PT_TLS segment: " + name, entryOffset);
+                if (value > tls->MemorySize || size > tls->MemorySize - value)
+                    throw RelinkerException("Executable TLS export exceeds PT_TLS: " + name, entryOffset);
+            } else if (section != SHN_ABS) {
+                if (section >= SHN_LORESERVE)
+                    throw RelinkerException("Unsupported executable export section: " + name, entryOffset);
+                const std::uint32_t flags = type == STT_FUNC ? PF_X : 0;
+                const auto extent = std::max<std::uint64_t>(size, 1);
+                const bool mapped = std::any_of(programHeaders.begin(), programHeaders.end(), [&](const ProgramHeader& ph) {
+                    return ph.Type == PT_LOAD && (ph.Flags & flags) == flags && value >= ph.MappedAddress &&
+                           value - ph.MappedAddress < ph.MemorySize && extent <= ph.MemorySize - (value - ph.MappedAddress);
+                });
+                if (!mapped) {
+                    std::ostringstream message;
+                    message << "Executable export " << name << " at 0x" << std::hex << value
+                            << (size > 1 ? " (" + std::to_string(size) + " bytes) does not fit inside " : " is not inside ")
+                            << (flags != 0 ? "an executable" : "a") << " PT_LOAD segment";
+                    throw RelinkerException(message.str(), entryOffset);
+                }
+            }
             exportedSymbols.emplace_back(off, std::move(name));
             const auto binding = symbol[4] >> 4;
-            if ((binding == STB_GLOBAL || binding == STB_WEAK) && (symbol[4] & 15) == STT_FUNC) {
-                VirtualAddress address = 0;
-                std::memcpy(&address, symbol + 8, sizeof(address));
-                exportedFunctions.push_back(address);
-            }
+            if ((binding == STB_GLOBAL || binding == STB_WEAK) && type == STT_FUNC)
+                exportedFunctions.push_back(value);
         }
     }
 
@@ -543,8 +593,8 @@ RelinkResult RelinkerPipeline::Relink() {
                     continue;
                 offset = *value;
             }
-            if (!hasTlsSegment)
-                throw RelinkerException("TLS relocation in an executable without a PT_TLS segment", pos);
+            if (!hasNonEmptyTlsSegment)
+                throw RelinkerException("TLS relocation in an executable without a non-empty PT_TLS segment", pos);
             if (relType == R_X86_64_DTPMOD64 && rAddend != 0)
                 throw RelinkerException("DTPMOD64 relocation has a nonzero addend", pos);
             const auto addend = relType == R_X86_64_DTPMOD64 ? 0 : static_cast<std::int64_t>(offset + static_cast<std::uint64_t>(rAddend));
diff --git a/core/relinker/relinker/tests/CallRegistryWriterTests.cpp b/core/relinker/relinker/tests/CallRegistryWriterTests.cpp
new file mode 100644
index 0000000000..542f386b46
--- /dev/null
+++ b/core/relinker/relinker/tests/CallRegistryWriterTests.cpp
@@ -0,0 +1,81 @@
+#include <relinker/output/CallRegistryWriter.hpp>
+#include <iostream>
+#include <locale>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+class GroupedPunctuation : public std::numpunct<char> {
+public:
+    explicit GroupedPunctuation(char separator) : separator(separator) {}
+
+protected:
+    char do_thousands_sep() const override { return separator; }
+    std::string do_grouping() const override { return "\3"; }
+
+private:
+    char separator;
+};
+
+class ScopedLocale {
+public:
+    explicit ScopedLocale(const std::locale& locale) : previous(std::locale::global(locale)) {}
+    ~ScopedLocale() { std::locale::global(previous); }
+
+private:
+    std::locale previous;
+};
+
+void RegistryOffsets() {
+    Relinker::CallRegistryWriter writer;
+    Relinker::CallRegistryEntry entry;
+    entry.Nid = "testNid";
+    entry.Library = "test.prx";
+    entry.RelocationTypeString = "R_X86_64_JUMP_SLOT";
+    entry.RelocationOffset = 0x12345678;
+    entry.TargetSection = ".text";
+    entry.TargetOffset = 0xabcdef0123456789ULL;
+    entry.CallSites = {0, 0xfff, 0x1000, 0xffffffffffffffffULL};
+    entry.CallSitesResolved = true;
+    entry.Weak = true;
+    std::string registry;
+    std::string imports;
+    std::string libraries;
+    {
+        const ScopedLocale classic(std::locale::classic());
+        registry = writer.WriteCallRegistry({entry});
+        imports = writer.WriteModuleImports({entry});
+        libraries = writer.WriteNeededLibraries({entry.Library});
+    }
+    Require(registry.find("\"relocationOffset\": \"0x12345678\"") != std::string::npos, "relocation offset is not canonical hexadecimal");
+    Require(registry.find("\"targetOffset\": \"0xABCDEF0123456789\"") != std::string::npos, "target offset is not canonical hexadecimal");
+    Require(registry.find("\"callSites\": [\"0x0\", \"0xFFF\", \"0x1000\", \"0xFFFFFFFFFFFFFFFF\"]") != std::string::npos, "call sites are not canonical hexadecimal");
+    Require(imports.find("\"targetOffset\": \"0xABCDEF0123456789\"") != std::string::npos, "module target offset is not canonical hexadecimal");
+    for (const char separator : {',', '.'}) {
+        const ScopedLocale grouped(std::locale(std::locale::classic(), new GroupedPunctuation(separator)));
+        std::ostringstream control;
+        control << std::hex << 0x12345678;
+        Require(control.str().find(separator) != std::string::npos, "grouping locale is not active");
+        Require(writer.WriteCallRegistry({entry}) == registry, "call registry depends on the host locale");
+        Require(writer.WriteModuleImports({entry}) == imports, "module imports depend on the host locale");
+        Require(writer.WriteNeededLibraries({entry.Library}) == libraries, "needed libraries depend on the host locale");
+        Require(std::use_facet<std::numpunct<char>>(std::locale()).thousands_sep() == separator, "registry writer changed the global locale");
+    }
+}
+
+}
+
+int main() {
+    try {
+        RegistryOffsets();
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/relinker/tests/CallSiteResolverTests.cpp b/core/relinker/relinker/tests/CallSiteResolverTests.cpp
index f06fab07fa..16ca224079 100644
--- a/core/relinker/relinker/tests/CallSiteResolverTests.cpp
+++ b/core/relinker/relinker/tests/CallSiteResolverTests.cpp
@@ -31,6 +31,30 @@ int main() {
         check("RIP-relative function pointer load", {0x48, 0x8b, 0x05, 0xf9, 0, 0, 0}, true);
         check("REX-prefixed indirect call", {0x48, 0xff, 0x15, 0xf9, 0, 0, 0}, true);
         check("multiple REX prefixes on pointer load", {0x40, 0x48, 0x8b, 0x05, 0xf8, 0, 0, 0}, true);
+        check("earlier REX.W does not widen a pointer load", {0x48, 0x40, 0x8b, 0x05, 0xf8, 0, 0, 0}, false);
+        check("final REX.W widens a pointer load", {0x48, 0x40, 0x48, 0x8b, 0x05, 0xf7, 0, 0, 0}, true);
+        check("BND indirect call", {0xf2, 0xff, 0x15, 0xf9, 0, 0, 0}, true);
+        check("BND indirect tail jump", {0xf2, 0xff, 0x25, 0xf9, 0, 0, 0}, true);
+        check("NOTRACK indirect call", {0x3e, 0xff, 0x15, 0xf9, 0, 0, 0}, true);
+        check("NOTRACK indirect tail jump", {0x3e, 0xff, 0x25, 0xf9, 0, 0, 0}, true);
+        check("NOTRACK BND indirect call", {0x3e, 0xf2, 0xff, 0x15, 0xf8, 0, 0, 0}, true);
+        check("BND NOTRACK indirect tail jump", {0xf2, 0x3e, 0xff, 0x25, 0xf8, 0, 0, 0}, true);
+        check("BND REX indirect call", {0xf2, 0x48, 0xff, 0x15, 0xf8, 0, 0, 0}, true);
+        check("NOTRACK REX indirect tail jump", {0x3e, 0x48, 0xff, 0x25, 0xf8, 0, 0, 0}, true);
+        check("NOTRACK-prefixed pointer load", {0x3e, 0x48, 0x8b, 0x05, 0xf8, 0, 0, 0}, true);
+        check("REPNE-prefixed pointer load", {0xf2, 0x48, 0x8b, 0x05, 0xf8, 0, 0, 0}, true);
+        check("DS after REX.W leaves a narrow load", {0x48, 0x3e, 0x8b, 0x05, 0xf8, 0, 0, 0}, false);
+        check("REPNE after REX.W leaves a narrow load", {0x48, 0xf2, 0x8b, 0x05, 0xf8, 0, 0, 0}, false);
+        check("final REX.W after DS widens a load", {0x48, 0x3e, 0x48, 0x8b, 0x05, 0xf7, 0, 0, 0}, true);
+        check("final REX.W after REPNE widens a load", {0x48, 0xf2, 0x48, 0x8b, 0x05, 0xf7, 0, 0, 0}, true);
+        check("NOTRACK preserves final narrow REX", {0x3e, 0x48, 0x40, 0x8b, 0x05, 0xf7, 0, 0, 0}, false);
+        check("FS call is not a flat GOT reference", {0x64, 0xf2, 0xff, 0x15, 0xf8, 0, 0, 0}, false);
+        check("GS jump is not a flat GOT reference", {0x3e, 0x65, 0xff, 0x25, 0xf8, 0, 0, 0}, false);
+        check("address-size override is not a RIP64 reference", {0x3e, 0x67, 0xff, 0x15, 0xf8, 0, 0, 0}, false);
+        check("BND register call has no RIP operand", {0xf2, 0xff, 0xd0}, false);
+        check("NOTRACK register jump has no RIP operand", {0x3e, 0xff, 0xe0}, false);
+        check("BND-prefixed increment is not an import access", {0xf2, 0xff, 0x05, 0xf9, 0, 0, 0}, false);
+        check("DS-prefixed decrement is not an import access", {0x3e, 0xff, 0x0d, 0xf9, 0, 0, 0}, false);
         check("pointer load without REX.W", {0x40, 0x8b, 0x05, 0xf9, 0, 0, 0}, false);
         check("register pointer load", {0x48, 0x8b, 0x00}, false);
         check("increment memory", {0xff, 0x05, 0xfa, 0, 0, 0}, false);
diff --git a/core/relinker/relinker/tests/CodeDataScanningTests.cpp b/core/relinker/relinker/tests/CodeDataScanningTests.cpp
new file mode 100644
index 0000000000..0b2e06c47c
--- /dev/null
+++ b/core/relinker/relinker/tests/CodeDataScanningTests.cpp
@@ -0,0 +1,86 @@
+#include "TestProgress.hpp"
+#include <relinker/analysis/SyscallScanner.hpp>
+#include <codegen/CodegenException.hpp>
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+constexpr std::size_t DataOffset = 6;
+constexpr std::size_t RoutineOffset = 14;
+constexpr std::array<std::uint8_t, 8> UndecodableData{0x0f, 0x78, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55};
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+Bytes Fixture(bool syscall) {
+    constexpr std::array<std::uint8_t, DataOffset> entry{0xe8, 0x09, 0x00, 0x00, 0x00, 0xc3};
+    Bytes code(RoutineOffset, 0x90);
+    std::copy(entry.begin(), entry.end(), code.begin());
+    if (syscall) code.insert(code.end(), {0xb8, 0x09, 0x00, 0x00, 0x00, 0x0f, 0x05});
+    code.push_back(0xc3);
+    return code;
+}
+
+void CheckUndecodableData(Domain::FileByteOffset origin) {
+    TestProgress progress;
+    const auto scanner = Relinker::MakeSyscallScanner(progress);
+    auto code = Fixture(false);
+    Require(scanner->ScanCodeSectionForSyscalls(code, origin, code.size()).empty(), "Valid code across a padding gap was rejected");
+    std::copy(UndecodableData.begin(), UndecodableData.end(), code.begin() + DataOffset);
+    try {
+        scanner->ScanCodeSectionForSyscalls(code, origin, code.size());
+    } catch (const Codegen::CodegenException& error) {
+        Require(error.FailureOffset == origin + DataOffset, "Decode failure did not identify the embedded data");
+        Require(std::string(error.what()).find("Cannot decode instruction: Unsupported 0F 78 opcode without SSE4A prefix") != std::string::npos, "Unexpected embedded-data decode failure");
+        std::cout << "Embedded-data decode rejection reproduced at " << error.FailureOffset << '\n';
+        return;
+    }
+    throw std::runtime_error("Embedded-data scanning changed; update the known-gap fixture and debt entry");
+}
+
+void CheckForbiddenInstruction(const Bytes& code, Domain::FileByteOffset origin, std::size_t offset, const std::string& number) {
+    for (const bool trap : {false, true}) {
+        TestProgress progress;
+        try {
+            Relinker::MakeSyscallScanner(progress, trap)->ScanCodeSectionForSyscalls(code, origin, code.size());
+        } catch (const Domain::RelinkerException& error) {
+            Require(error.FailureOffset == origin + offset, "Forbidden instruction reported at the wrong offset");
+            Require(std::string(error.what()).find("Forbidden syscall instruction at code offset 0x") != std::string::npos, "Unexpected syscall rejection");
+            Require(number.empty() || std::string(error.what()).find(number) != std::string::npos, "Lost the reachable routine's syscall number");
+            continue;
+        }
+        throw std::runtime_error("Forbidden instruction was not reported");
+    }
+}
+
+void CheckGapAndReachableRoutine(Domain::FileByteOffset origin) {
+    auto code = Fixture(false);
+    code[DataOffset] = 0x0f;
+    code[DataOffset + 1] = 0x05;
+    CheckForbiddenInstruction(code, origin, DataOffset, {});
+    CheckForbiddenInstruction(Fixture(true), origin, RoutineOffset + 5, "syscall number 9");
+}
+
+}
+
+int main() {
+    try {
+        for (const auto origin : {std::uint64_t{0}, std::uint64_t{0x123400}, std::uint64_t{0x100000000}}) {
+            CheckUndecodableData(origin);
+            CheckGapAndReachableRoutine(origin);
+        }
+        std::cout << "Embedded-code-data known-gap and reachable-code controls passed\n";
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index 94a34990c1..aa79bae7f0 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -8,6 +8,7 @@
 #include <stdexcept>
 #include <string>
 #include <limits>
+#include <chrono>
 
 namespace {
 
@@ -142,6 +143,26 @@ void CheckRelocatedTransfers() {
     RequireOffsets(*unresolved, {0, 6, 7, 8});
 }
 
+void CheckAddressSizeOverride() {
+    constexpr auto slot = TextAddress + 0x1000;
+    Bytes text{0x67, 0xff, 0x15, 0, 0, 0, 0, 0x90, 0xc3, 0x67, 0xff, 0x25, 0, 0, 0, 0, 0x90, 0x90, 0xc3};
+    SetDisplacement(text, 3, 7, slot);
+    SetDisplacement(text, 12, 16, slot + 8);
+    Pointers pointers;
+    pointers.Slots = {{static_cast<std::uint32_t>(slot), TextAddress + 9}, {static_cast<std::uint32_t>(slot + 8), TextAddress + 18}};
+    RequireOffsets(*BuildControlFlowGraph(text, TextAddress, TextAddress, {}, pointers), {0, 7, 8, 9, 18});
+    RequireOffsets(*BuildControlFlowGraph(text, TextAddress, TextAddress + 9, {}, pointers), {9, 18});
+
+    Bytes lea(17, 0x90);
+    const Bytes opcode{0x67, 0x48, 0x8d, 0x05};
+    std::copy(opcode.begin(), opcode.end(), lea.begin());
+    SetDisplacement(lea, 4, 8, TextAddress + 16);
+    lea[8] = lea[16] = 0xc3;
+    const Pointers missing;
+    RequireOffsets(*BuildControlFlowGraph(lea, TextAddress, TextAddress, {}, missing, true), {0, 8});
+    RequireOffsets(*BuildAddressTakenControlFlowGraph(lea, TextAddress, TextAddress, {}, missing, {}), {0, 8});
+}
+
 void CheckCodeAddresses() {
     Bytes text(17, 0x90);
     text[0] = 0x48;
@@ -344,6 +365,257 @@ void CheckRelativeJumpTables() {
     Require(Relinker::FindRelativeJumpTables(cutShort, TextAddress, {{TextAddress, TextAddress + cutShort.size()}}).empty(), "Table followed by more of its function was accepted");
 }
 
+void CheckEmbeddedDataTables() {
+    constexpr std::size_t tableOffset = 24;
+    Bytes text(48, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + tableOffset);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < tableOffset; ++i) text[i] = 0xcc;
+    text[tableOffset] = 0x0f;
+    text[tableOffset + 1] = 0x78;
+    text[tableOffset + 2] = 0x33;
+    text[tableOffset + 3] = 0x1e;
+
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + text.size(), TextAddress + text.size() + 8}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected one embedded data table");
+    Require(tables[0].Function == TextAddress && tables[0].Begin == TextAddress + tableOffset && tables[0].End == TextAddress + text.size(), "Embedded data table range was incorrect");
+
+    Bytes withBranch = text;
+    withBranch[7] = 0xe8;
+    SetDisplacement(withBranch, 8, 12, TextAddress + tableOffset);
+    withBranch[12] = 0xc3;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsWithBranch{
+        {TextAddress, TextAddress + 13},
+        {TextAddress + withBranch.size(), TextAddress + withBranch.size() + 8}
+    };
+    const auto tablesWithBranch = Relinker::FindRelativeJumpTables(withBranch, TextAddress, functionsWithBranch);
+    Require(tablesWithBranch.empty(), "Branch target was incorrectly recognized as a data table");
+
+    Bytes withValidCode = text;
+    withValidCode[tableOffset] = 0x48;
+    withValidCode[tableOffset + 1] = 0x89;
+    withValidCode[tableOffset + 2] = 0xc0;
+    withValidCode[tableOffset + 3] = 0xc3;
+    for (std::size_t i = tableOffset + 4; i < withValidCode.size(); ++i) withValidCode[i] = 0xcc;
+    const auto tablesWithValidCode = Relinker::FindRelativeJumpTables(withValidCode, TextAddress, functions);
+    Require(tablesWithValidCode.empty(), "Valid unannotated code in gap was incorrectly recognized as a data table");
+
+    Bytes withTransitiveBranch = text;
+    withTransitiveBranch[7] = 0xe8;
+    SetDisplacement(withTransitiveBranch, 8, 12, TextAddress + 16);
+    withTransitiveBranch[12] = 0xc3;
+    for (std::size_t i = 13; i < 16; ++i) withTransitiveBranch[i] = 0xcc;
+    withTransitiveBranch[16] = 0xe9;
+    SetDisplacement(withTransitiveBranch, 17, 21, TextAddress + tableOffset);
+    for (std::size_t i = 21; i < tableOffset; ++i) withTransitiveBranch[i] = 0xcc;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsTransitive{
+        {TextAddress, TextAddress + 13},
+        {TextAddress + withTransitiveBranch.size(), TextAddress + withTransitiveBranch.size() + 8}
+    };
+    const auto tablesTransitive = Relinker::FindRelativeJumpTables(withTransitiveBranch, TextAddress, functionsTransitive);
+    Require(tablesTransitive.empty(), "Transitive branch target was incorrectly recognized as a data table");
+
+    Bytes withTrailingCode(64, 0x90);
+    withTrailingCode[0] = 0x48;
+    withTrailingCode[1] = 0x8d;
+    withTrailingCode[2] = 0x05;
+    SetDisplacement(withTrailingCode, 3, 7, TextAddress + 16);
+    withTrailingCode[7] = 0xc3;
+    for (std::size_t i = 8; i < 16; ++i) withTrailingCode[i] = 0xcc;
+    withTrailingCode[16] = 0x0f;
+    withTrailingCode[17] = 0x78;
+    withTrailingCode[18] = 0x11;
+    withTrailingCode[19] = 0x22;
+    withTrailingCode[20] = 0x33;
+    withTrailingCode[21] = 0x44;
+    for (std::size_t i = 22; i < 32; ++i) withTrailingCode[i] = 0xcc;
+    withTrailingCode[32] = 0xb8;
+    withTrailingCode[33] = 0x3b;
+    withTrailingCode[34] = 0x00;
+    withTrailingCode[35] = 0x00;
+    withTrailingCode[36] = 0x00;
+    withTrailingCode[37] = 0x0f;
+    withTrailingCode[38] = 0x05;
+    withTrailingCode[39] = 0xc3;
+    for (std::size_t i = 40; i < withTrailingCode.size(); ++i) withTrailingCode[i] = 0x90;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsTrailing{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + withTrailingCode.size(), TextAddress + withTrailingCode.size() + 8}
+    };
+    const auto tablesTrailing = Relinker::FindRelativeJumpTables(withTrailingCode, TextAddress, functionsTrailing);
+    Require(tablesTrailing.size() == 1, "Expected one bounded data table before trailing code");
+    Require(tablesTrailing[0].Begin == TextAddress + 16 && tablesTrailing[0].End <= TextAddress + 32, "Mask overran into trailing code");
+
+    Bytes withCallbackSyscall(48, 0x90);
+    withCallbackSyscall[0] = 0x48;
+    withCallbackSyscall[1] = 0x8d;
+    withCallbackSyscall[2] = 0x05;
+    SetDisplacement(withCallbackSyscall, 3, 7, TextAddress + 16);
+    withCallbackSyscall[7] = 0xc3;
+    for (std::size_t i = 8; i < 16; ++i) withCallbackSyscall[i] = 0xcc;
+    withCallbackSyscall[16] = 0xb8;
+    withCallbackSyscall[17] = 0x3b;
+    withCallbackSyscall[18] = 0x00;
+    withCallbackSyscall[19] = 0x00;
+    withCallbackSyscall[20] = 0x00;
+    withCallbackSyscall[21] = 0x0f;
+    withCallbackSyscall[22] = 0x05;
+    withCallbackSyscall[23] = 0x0f;
+    withCallbackSyscall[24] = 0x78;
+    withCallbackSyscall[25] = 0x11;
+    withCallbackSyscall[26] = 0x22;
+    withCallbackSyscall[27] = 0x33;
+    withCallbackSyscall[28] = 0x44;
+    withCallbackSyscall[29] = 0xc3;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsCallback{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + withCallbackSyscall.size(), TextAddress + withCallbackSyscall.size() + 8}
+    };
+    const auto tablesCallback = Relinker::FindRelativeJumpTables(withCallbackSyscall, TextAddress, functionsCallback);
+    Require(tablesCallback.empty(), "Callback with syscall and undecodable tail was incorrectly recognized as a data table");
+
+    Bytes whirlpoolText(4224, 0x90);
+    whirlpoolText[0] = 0x48;
+    whirlpoolText[1] = 0x8d;
+    whirlpoolText[2] = 0x2d;
+    SetDisplacement(whirlpoolText, 3, 7, TextAddress + 32);
+    whirlpoolText[7] = 0xc3;
+    for (std::size_t i = 8; i < 32; ++i) whirlpoolText[i] = 0xcc;
+    static constexpr std::uint8_t whirlpoolPrefix[]{
+        0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8, 0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8,
+        0x0f, 0x78, 0x33, 0x1e
+    };
+    std::memcpy(whirlpoolText.data() + 32, whirlpoolPrefix, sizeof(whirlpoolPrefix));
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsWhirlpool{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + whirlpoolText.size(), TextAddress + whirlpoolText.size() + 8}
+    };
+    const auto tablesWhirlpool = Relinker::FindRelativeJumpTables(whirlpoolText, TextAddress, functionsWhirlpool);
+    Require(tablesWhirlpool.size() == 1, "Expected Whirlpool-style table to be recognized");
+    Require(tablesWhirlpool[0].Begin == TextAddress + 32, "Whirlpool table start was incorrect");
+}
+
+void CheckDecodedPaddingSuffix() {
+    Bytes text(0x38, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + 0x10);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < 0x10; ++i) text[i] = 0xcc;
+    static constexpr std::uint8_t suffix[]{0x0f, 0x78, 0xcc, 0xb8, 0x09, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x00, 0x01, 0x90};
+    std::memcpy(text.data() + 0x10, suffix, sizeof(suffix));
+    text[0x30] = 0xc3;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + 0x30, TextAddress + 0x38}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected one decoded data table before a padding-suffixed syscall");
+    Require(tables[0].Begin == TextAddress + 0x10 && tables[0].End == TextAddress + 0x12, "Mask extended over the syscall after a decoded padding suffix");
+}
+
+void CheckStubBeforeUndecodableData() {
+    Bytes text(0x38, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + 0x10);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < 0x10; ++i) text[i] = 0xcc;
+    static constexpr std::uint8_t suffix[]{
+        0x0f, 0x78, 0xcc, 0xb8, 0x09, 0x00, 0x00, 0x00,
+        0x0f, 0x05, 0xc3, 0x0f, 0x78, 0x33, 0x1e
+    };
+    std::memcpy(text.data() + 0x10, suffix, sizeof(suffix));
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + text.size(), TextAddress + text.size() + 8}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected one data table before a syscall stub followed by undecodable data");
+    Require(tables[0].Begin == TextAddress + 0x10, "Data table start before a syscall stub was incorrect");
+    Require(tables[0].End <= TextAddress + 0x13, "Mask covered the syscall stub before undecodable data");
+}
+
+void CheckTableWithPaddingAndReturnBytes() {
+    constexpr std::size_t gap = 0x800;
+    Bytes text(0x10 + gap, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + 0x10);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < 0x10; ++i) text[i] = 0xcc;
+    static constexpr std::uint8_t row[]{
+        0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8,
+        0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8,
+        0x0f, 0x78, 0x33, 0x1e
+    };
+    for (std::size_t at = 0x10; at + sizeof(row) <= text.size(); at += sizeof(row))
+        std::memcpy(text.data() + at, row, sizeof(row));
+    static constexpr std::uint8_t paddedChain[]{0x00, 0xcc, 0x90, 0x48, 0x89, 0xc0, 0xc3};
+    static constexpr std::uint8_t alignedChain[]{0x00, 0xcc, 0x90, 0x00, 0x48, 0x89, 0xc0, 0xc3};
+    std::memcpy(text.data() + 0x10 + 0x3b8, paddedChain, sizeof(paddedChain));
+    std::memcpy(text.data() + 0x10 + 0x4ac, alignedChain, sizeof(alignedChain));
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + text.size(), TextAddress + text.size() + 8}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected a table with padding and return bytes to be recognized");
+    Require(tables[0].Begin == TextAddress + 0x10, "Table with padding and return bytes started at the wrong address");
+    Require(tables[0].End == TextAddress + text.size(), "Mask stopped inside a table with padding and return bytes");
+}
+
+void CheckLargeZeroGaps() {
+    constexpr std::size_t stride = 0x10000;
+    constexpr std::size_t count = 32;
+    constexpr std::size_t functionSize = 8;
+    constexpr std::size_t codeFill = 0x8000;
+    Bytes text(stride * count, 0x00);
+    std::vector<std::pair<VirtualAddress, VirtualAddress>> functions;
+    for (std::size_t index = 0; index < count; ++index) {
+        const auto begin = index * stride;
+        text[begin] = 0x48;
+        text[begin + 1] = 0x8d;
+        text[begin + 2] = 0x05;
+        SetDisplacement(text, begin + 3, begin + 7, TextAddress + begin + functionSize);
+        text[begin + 7] = 0xc3;
+        const auto table = begin + functionSize;
+        text[table] = 0x0f;
+        text[table + 1] = 0x78;
+        text[table + 2] = 0x33;
+        text[table + 3] = 0x1e;
+        for (auto at = table + 4; at + 2 < begin + codeFill; at += 3) {
+            text[at] = 0x48;
+            text[at + 1] = 0x89;
+            text[at + 2] = 0xc0;
+        }
+        functions.emplace_back(TextAddress + begin, TextAddress + begin + functionSize);
+    }
+    functions.emplace_back(TextAddress + stride * count, TextAddress + stride * count + functionSize);
+
+    const auto started = std::chrono::steady_clock::now();
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    const auto elapsed = std::chrono::steady_clock::now() - started;
+
+    Require(tables.size() == count, "Expected one data table per large gap");
+    for (std::size_t index = 0; index < tables.size(); ++index) {
+        Require(tables[index].Function == TextAddress + index * stride, "Large gap table was attached to the wrong function");
+        Require(tables[index].Begin == TextAddress + index * stride + functionSize, "Large gap table start was incorrect");
+        Require(tables[index].End == TextAddress + (index + 1) * stride, "Large gap table end was incorrect");
+    }
+    Require(elapsed < std::chrono::seconds(10), "Large gap analysis took too long");
+}
+
 }
 
 int main() {
@@ -354,6 +626,7 @@ int main() {
         CheckCallsBeforeZeroPadding();
         CheckCallsThatStillFallThrough();
         CheckRelocatedTransfers();
+        CheckAddressSizeOverride();
         CheckCodeAddresses();
         CheckSpeculativeRoots();
         CheckTrailingZeroRoots();
@@ -361,6 +634,11 @@ int main() {
         CheckAddressOverflow();
         CheckHighVirtualAddress();
         CheckRelativeJumpTables();
+        CheckEmbeddedDataTables();
+        CheckDecodedPaddingSuffix();
+        CheckStubBeforeUndecodableData();
+        CheckTableWithPaddingAndReturnBytes();
+        CheckLargeZeroGaps();
         std::cout << "Control-flow graph tests passed\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/relinker/relinker/tests/ConversionTests.cpp b/core/relinker/relinker/tests/ConversionTests.cpp
index 3357892f5e..4b27916736 100644
--- a/core/relinker/relinker/tests/ConversionTests.cpp
+++ b/core/relinker/relinker/tests/ConversionTests.cpp
@@ -127,6 +127,35 @@ void convert() {
     require(progress.Events.back().Completed != 1 || progress.Events.back().Stage != Domain::ProgressStage::Executable, "Failed conversion reported completion");
 }
 
+void runtimeLifecyclePolicy() {
+    TestProgress progress;
+    const Relinker::Conversion converter(progress);
+    for (const auto* directory : {"sce_module", "sce_modules", "prx", "Media/Plugins"}) {
+        auto source = input();
+        const auto parent = source.ModuleRoot / directory;
+        auto module = fixture();
+        Io::WriteU64(module, 0x2080, 12);
+        Io::WriteU64(module, 0x2088, 0x1000);
+        Io::WriteU64(module, 208, 160);
+        Io::WriteU64(module, 216, 160);
+        source.Modules.push_back({parent / "plugin.prx", std::move(module)});
+        source.RuntimeDirectories.push_back(parent);
+        const auto output = converter.Convert(std::move(source), {});
+        const auto& bytes = output.Modules.at(0).Bytes;
+        const auto headers = Io::ReadU64(bytes, 32);
+        bool initializesOnMapping = false;
+        for (std::uint16_t index = 0; index < Io::ReadU16(bytes, 56); ++index) {
+            const auto header = headers + index * 56;
+            if (Io::ReadU32(bytes, header) != 2) continue;
+            const auto dynamic = Io::ReadU64(bytes, header + 8);
+            const auto end = dynamic + Io::ReadU64(bytes, header + 32);
+            for (auto offset = dynamic; offset < end; offset += 16)
+                if (Io::ReadU64(bytes, offset) == 12) initializesOnMapping = Io::ReadU64(bytes, offset + 8) != 0;
+        }
+        require(initializesOnMapping == (std::string_view(directory) != "Media/Plugins"), "Default SDK directories lost their mapping initializer");
+    }
+}
+
 void fixedBase() {
     TestProgress progress;
     const Relinker::Conversion converter(progress);
@@ -256,9 +285,9 @@ void baseRelocations() {
     require(Io::ReadU32(relocs, 4) == 12, "Wrong base relocation block size");
     require(Io::ReadU16(relocs, 8) == 0xa000, "Wrong first relocation entry");
     require(Io::ReadU16(relocs, 10) == 0xa008, "Wrong second relocation entry");
-    reject([&] { (void)builder.BuildBaseRelocations({0x10ffc}); });
-    reject([&] { (void)builder.BuildBaseRelocations({0x10ffd}); });
-    reject([&] { (void)builder.BuildBaseRelocations({0x10fff}); });
+    const auto spanning = builder.BuildBaseRelocations({0x10ffc, 0x10fff});
+    require(spanning.size() == 12 && Io::ReadU32(spanning, 0) == 0x10000, "A page-spanning base relocation was not placed in its first page");
+    require(Io::ReadU16(spanning, 8) == 0xaffc && Io::ReadU16(spanning, 10) == 0xafff, "Wrong page-spanning base relocation entries");
 }
 
 std::size_t fileOffset(const std::vector<std::uint8_t>& pe, std::uint32_t address) {
@@ -300,17 +329,62 @@ void runtimeDirectories() {
     }
 }
 
+void relocationValidation() {
+    TestProgress progress;
+    const Relinker::Conversion converter(progress);
+    {
+        auto source = input();
+        Io::WriteU64(source.Executable, 0x2058, 24);
+        Io::WriteU64(source.Executable, 0x2700, 0x2000);
+        Io::WriteU64(source.Executable, 0x2708, (static_cast<std::uint64_t>(0x9999) << 32) | 0x99);
+        Io::WriteU64(source.Executable, 0x2710, 0);
+        try {
+            converter.Convert(source, {});
+            throw std::runtime_error("Unsupported relocation type was accepted");
+        } catch (const Domain::RelinkerException& error) {
+            require(std::string(error.what()).find("Unsupported relocation type 0x99") != std::string::npos, "Wrong error for unsupported relocation");
+            require(error.FailureOffset == 0x2700, "Wrong failure offset for unsupported relocation");
+        }
+    }
+    {
+        auto source = input();
+        const std::vector<std::pair<std::uint64_t, std::uint64_t>> tags{
+            {5, 0x2600}, {10, 1}, {6, 0x2620}, {11, 24}, {7, 0x2700}, {8, 0}, {9, 24}, {4, 0x2680},
+            {3, 0x2000}, {20, 7}, {23, 0x2780}, {2, 24}, {0, 0}
+        };
+        const auto at = 64 + 2 * 56;
+        Io::WriteU64(source.Executable, at + 32, tags.size() * 16);
+        Io::WriteU64(source.Executable, at + 40, tags.size() * 16);
+        for (std::size_t index = 0; index < tags.size(); ++index) {
+            Io::WriteU64(source.Executable, 0x2000 + index * 16, tags[index].first);
+            Io::WriteU64(source.Executable, 0x2008 + index * 16, tags[index].second);
+        }
+        Io::WriteU64(source.Executable, 0x2780, 0x2000);
+        Io::WriteU64(source.Executable, 0x2788, (static_cast<std::uint64_t>(1) << 32) | 8);
+        Io::WriteU64(source.Executable, 0x2790, 0);
+        try {
+            converter.Convert(source, {});
+            throw std::runtime_error("Unsupported PLT relocation type was accepted");
+        } catch (const Domain::RelinkerException& error) {
+            require(std::string(error.what()) == "Unsupported PLT relocation type", "Wrong error for unsupported PLT relocation");
+            require(error.FailureOffset == 0x2780, "Wrong failure offset for unsupported PLT relocation");
+        }
+    }
+}
+
 }
 
 int main() {
     try {
         convert();
+        runtimeLifecyclePolicy();
         fixedBase();
         scanning();
         diagnosticContext();
         cancellation();
         baseRelocations();
         runtimeDirectories();
+        relocationValidation();
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
         return 1;
diff --git a/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp b/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp
index 154238155d..b1122ee8a7 100644
--- a/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp
+++ b/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp
@@ -233,6 +233,41 @@ int main() {
             bytes.resize(128 + 3 * 64 - 1);
             RejectSections(std::move(bytes));
         }},
+        {"section file range past end of file", [] {
+            auto bytes = Fixture();
+            Write<std::uint64_t>(bytes, 216, 0x2f0);
+            RejectSections(std::move(bytes));
+        }},
+        {"section file range offset overflow", [] {
+            auto bytes = Fixture();
+            Write<std::uint64_t>(bytes, 216, std::numeric_limits<std::uint64_t>::max() - 15);
+            RejectSections(std::move(bytes));
+        }},
+        {"section ending at end of file", [] {
+            auto bytes = Fixture();
+            Write<std::uint64_t>(bytes, 216, 0x2e0);
+            Write<std::uint64_t>(bytes, 224, 32);
+            const auto sections = Relinker::ElfReader(std::move(bytes)).ReadSectionHeaders();
+            Require(sections.size() == 3 && sections[1].Offset + sections[1].SectionSize == 0x300);
+        }},
+        {"unbacked SHT_NOBITS section with range past end of file", [] {
+            auto bytes = Fixture();
+            Write<std::uint32_t>(bytes, 196, 8);
+            Write<std::uint64_t>(bytes, 216, 0x2f0);
+            Write<std::uint64_t>(bytes, 224, 0x1000);
+            const auto sections = Relinker::ElfReader(std::move(bytes)).ReadSectionHeaders();
+            Require(sections.size() == 3 && sections[1].Type == 8);
+        }},
+        {"empty section beyond end of file", [] {
+            constexpr std::uint64_t offsets[] = {0x300, 0x301, std::numeric_limits<std::uint64_t>::max()};
+            for (const std::uint64_t offset : offsets) {
+                auto bytes = Fixture();
+                Write<std::uint64_t>(bytes, 216, offset);
+                Write<std::uint64_t>(bytes, 224, 0);
+                const auto sections = Relinker::ElfReader(std::move(bytes)).ReadSectionHeaders();
+                Require(sections.size() == 3 && sections[1].Offset == offset && sections[1].SectionSize == 0);
+            }
+        }},
         {"translation program header stride", [] {
             for (const std::uint16_t stride : {0, 48, 64}) {
                 auto bytes = Fixture();
diff --git a/core/relinker/relinker/tests/GamePatchTests.cpp b/core/relinker/relinker/tests/GamePatchTests.cpp
index bde267682d..0b6ab99a13 100644
--- a/core/relinker/relinker/tests/GamePatchTests.cpp
+++ b/core/relinker/relinker/tests/GamePatchTests.cpp
@@ -282,6 +282,54 @@ void applyAndMismatch() {
     require(PatchTarget(bytes, "other", entries).Applied.empty() && bytes == original, "entry hit another target");
 }
 
+void programmaticWidths() {
+    auto bytes = twoSegmentFixture();
+    const auto original = bytes;
+    const ElfReader reader(original);
+    const std::vector<PatchEntry> invalid{
+        entry("t", 0x1000, {0}, {9, 8}),
+        entry("t", 0x1000, {0, 1}, {9}),
+        entry("t", 0x1000, {}, {}),
+        entry("t", 0x1000, {}, {9}),
+        entry("t", 0x1000, {0}, {}),
+    };
+    for (const auto& patch : invalid) {
+        const std::vector<PatchEntry> entries{entry("t", 0x1100, {0x80}, {1}), patch};
+        rejects([&] { ResolveRanges(reader, entries); }, "same nonzero width");
+        rejects([&] { PatchTarget(bytes, "t", entries); }, "same nonzero width");
+        require(bytes == original, "an invalid patch width wrote bytes");
+        rejects([&] { ApplyPatches(bytes, "t", entries, {{0x2000, 1, 0x1100}, {0x1000, patch.Expected.size(), 0x1000}}); }, "same nonzero width");
+        require(bytes == original, "direct application of an invalid patch width wrote bytes");
+        for (const bool outputMode : {false, true}) {
+            PatchFile file;
+            file.MainTarget = "t";
+            file.Entries = entries;
+            rejects([&] { VerifyPatches(file, {{"t", original}}, {}, outputMode); }, "same nonzero width");
+        }
+    }
+}
+
+void applicationRangeWidths() {
+    const std::vector<std::uint8_t> original{0, 1, 2, 3};
+    auto bytes = original;
+    const std::vector<PatchEntry> entries{entry("t", 0x1000, {0}, {9}), entry("t", 0x1002, {2, 3}, {8, 7})};
+    for (const std::uint64_t length : {0u, 1u, 3u}) {
+        rejects([&] { ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}, {2, length, 0x1002}}); }, "range length does not match");
+        require(bytes == original, "a mismatched range length wrote bytes");
+    }
+    rejects([&] { ApplyPatches(bytes, "t", {entry("t", 0x1003, {3, 4}, {8, 7})}, {{3, 1, 0x1003}}); }, "range length does not match");
+    require(bytes == original, "a truncated comparison range wrote bytes");
+    for (const std::uint64_t offset : std::array<std::uint64_t, 4>{3, 4, 5, UINT64_MAX}) {
+        rejects([&] { ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}, {offset, 2, 0x1002}}); }, "range exceeds the image");
+        require(bytes == original, "an out-of-bounds patch wrote bytes");
+    }
+    rejects([&] { ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}}); }, "ranges do not match");
+    require(bytes == original, "a missing range wrote bytes");
+    const auto applied = ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}, {2, 2, 0x1002}});
+    require(bytes == std::vector<std::uint8_t>({9, 1, 8, 7}) && applied.size() == 2, "valid boundary patches failed");
+    require(ApplyPatches(bytes, "t", {}, {}).empty(), "empty patch list was rejected");
+}
+
 void overlapWithWriters() {
     const std::vector<PatchedRange> patched{{0x1010, 2, 0x401010}};
     const auto reject = [&](const WriterSites& sites, const std::string& writer) { rejects([&] { CheckOverlaps("t", patched, sites); }, writer); };
@@ -305,6 +353,14 @@ void overlapWithWriters() {
     CheckOverlaps("t", patched, {.Traps = trapBefore});
     const std::vector<WriterRange> window{{0x100f, 4, "window"}};
     reject({.Traps = window}, "window");
+    const std::vector<Codegen::TrampolineSite> frame{{0x1011, 0x401011, 5, {}, {}, 0}};
+    reject({.RedZoneSites = frame}, "red-zone frame site");
+    const std::vector<Codegen::TrampolineSite> frameBefore{{0x100b, 0x40100b, 5, {}, {}, 0}};
+    CheckOverlaps("t", patched, {.RedZoneSites = frameBefore});
+    const std::vector<Codegen::RedZoneDisplacement> moved{{0x100f, {0x10, 0, 0, 0}}};
+    reject({.RedZoneDisplacements = moved}, "red-zone moved displacement");
+    const std::vector<Codegen::RedZoneDisplacement> movedBefore{{0x100f, {0x10}}};
+    CheckOverlaps("t", patched, {.RedZoneDisplacements = movedBefore});
 }
 
 void conversion() {
@@ -340,11 +396,68 @@ void conversion() {
     rejects([&] { converter.Convert(conversionInput(executable), failing); }, "expected 07 found 00");
     failing.Patches = {entry("custom-name.bin", 0x1000, {0xc3, 0}, {0, 0}), entry("custom-name.bin", 0x1001, {0}, {1})};
     rejects([&] { converter.Convert(conversionInput(executable), failing); }, "overlaps");
+    for (const auto target : {TargetSystem::Linux, TargetSystem::Windows, TargetSystem::MacOs}) {
+        failing.Target = target;
+        for (const char* name : {"custom-name.bin", "sce_module/plugin.prx"}) {
+            failing.Patches = {entry(name, 0x1001, {0}, {9, 8})};
+            rejects([&] { converter.Convert(conversionInput(executable), failing); }, "same nonzero width");
+        }
+    }
 
     const auto repeated = converter.Convert(conversionInput(executable), plain);
     require(repeated.Executable == baseline.Executable && repeated.Modules.front().Bytes == baseline.Modules.front().Bytes, "no entries changed the output");
 }
 
+std::vector<std::uint8_t> framedLeafFixture() {
+    auto bytes = conversionFixture();
+    Io::WriteU64(bytes, 64 + 32, 0x80);
+    Io::WriteU64(bytes, 64 + 40, 0x80);
+    std::fill(bytes.begin() + 0x1000, bytes.begin() + 0x1080, 0xcc);
+    const std::vector<std::uint8_t> caller{0xe8, 0x3b, 0x00, 0x00, 0x00, 0xc3};
+    const std::vector<std::uint8_t> leaf{0x53, 0x41, 0x56, 0x41, 0x57, 0x48, 0x89, 0x7c, 0x24, 0xf0, 0x48, 0x8b, 0x04, 0x24, 0x48, 0x8b, 0x44, 0x24, 0x08, 0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xc3};
+    std::copy(caller.begin(), caller.end(), bytes.begin() + 0x1000);
+    std::copy(leaf.begin(), leaf.end(), bytes.begin() + 0x1040);
+    const auto ehFrameHeader = 64 + 7 * 56;
+    Io::WriteU32(bytes, ehFrameHeader, 0x6474e550);
+    Io::WriteU32(bytes, ehFrameHeader + 4, 4);
+    for (const auto field : {8, 16, 24}) Io::WriteU64(bytes, ehFrameHeader + field, 0x2900);
+    Io::WriteU64(bytes, ehFrameHeader + 32, 32);
+    Io::WriteU64(bytes, ehFrameHeader + 40, 32);
+    Io::WriteU64(bytes, ehFrameHeader + 48, 4);
+    Io::WriteU32(bytes, 0x2800, 9);
+    const std::vector<std::uint8_t> cie{1, 0, 1, 0x78, 16};
+    std::copy(cie.begin(), cie.end(), bytes.begin() + 0x2808);
+    Io::WriteU32(bytes, 0x2840, 20);
+    Io::WriteU32(bytes, 0x2844, 0x44);
+    Io::WriteU64(bytes, 0x2848, 0x1040);
+    Io::WriteU64(bytes, 0x2850, leaf.size());
+    bytes[0x2900] = 1;
+    bytes[0x2902] = 3;
+    Io::WriteU64(bytes, 0x2904, 0x2800);
+    Io::WriteU32(bytes, 0x290c, 1);
+    Io::WriteU64(bytes, 0x2910, 0x1040);
+    Io::WriteU64(bytes, 0x2918, 0x2840);
+    return bytes;
+}
+
+void framedLeafPatches() {
+    TestProgress progress;
+    const Conversion converter(progress);
+    const auto executable = framedLeafFixture();
+    ConversionOptions options;
+    options.TargetName = "custom-name.bin";
+    options.Target = TargetSystem::Windows;
+    options.FrameRedZone = true;
+    converter.Convert(conversionInput(executable), options);
+    require(progress.Messages.find("1 framed (1 without a frame pointer, 1 rsp operands moved, 2 in 1 operand stubs; 1 exits)") != std::string::npos, "the fixture's leaf was not framed with a moved displacement and an operand stub: " + progress.Messages);
+    options.Patches = {entry("custom-name.bin", 0x1010, {0xcc}, {0x90})};
+    require(converter.Convert(conversionInput(executable), options).AppliedPatches.size() == 1, "a patch outside the framed leaf was not applied");
+    options.Patches = {entry("custom-name.bin", 0x1049, {0xf0}, {0xe8})};
+    rejects([&] { converter.Convert(conversionInput(executable), options); }, "overlaps red-zone moved displacement at off=0x1049 length 1");
+    options.Patches = {entry("custom-name.bin", 0x104c, {0x04}, {0x0c})};
+    rejects([&] { converter.Convert(conversionInput(executable), options); }, "overlaps red-zone frame site at off=0x104a length 9");
+}
+
 void targets() {
     const std::vector<PatchEntry> entries{entry("a.elf", 1, {0}, {1}), entry("sce_module/libc.prx", 1, {0}, {1})};
     MatchTargets(entries, {"a.elf", "b.elf", "sce_module/libc.prx"});
@@ -529,8 +642,11 @@ int main() {
         ranges();
         headerRange();
         applyAndMismatch();
+        programmaticWidths();
+        applicationRangeWidths();
         overlapWithWriters();
         conversion();
+        framedLeafPatches();
         targets();
         verify();
         rangeFailureInVerify();
diff --git a/core/relinker/relinker/tests/test_copy_relocations.py b/core/relinker/relinker/tests/test_copy_relocations.py
new file mode 100644
index 0000000000..5a1677e26e
--- /dev/null
+++ b/core/relinker/relinker/tests/test_copy_relocations.py
@@ -0,0 +1,62 @@
+"""R_X86_64_COPY relocations in DT_RELA and in the PLT table are rejected by validation, before any
+target code runs, with the same error for every output target; GLOB_DAT and JUMP_SLOT are accepted. The
+Linux output gives every import symbol st_size 0, so a dynamic loader would copy MIN(st_size of the
+definition, 0) = 0 bytes and the variable would stay zero."""
+
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+from test_jmprel_table_bounds import fixture
+
+R_X86_64_COPY = 5
+TARGETS = {(): "linux", ("--lazy-binding",): "lazy", ("--windows",): "windows", ("--macos",): "macos"}
+ERROR = "Unsupported relocation type 0x5"
+
+CASES = [
+    ("copy-rela", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY), True),
+    ("copy-jmprel", fixture(linux=True, relocation_type=R_X86_64_COPY), True),
+    ("glob-dat-rela", fixture(linux=True, data_relocations=True), False),
+    ("jump-slot-jmprel", fixture(linux=True), False),
+]
+
+
+def relink(relinker, work, name, image, flags):
+    source = work / (name + ".elf")
+    output = work / (name + ".out")
+    source.write_bytes(image)
+    result = subprocess.run([str(relinker), "--skip-sce-module", *flags, str(source), str(output)],
+                            capture_output=True, text=True, timeout=20)
+    return result, output
+
+
+def fail_lines(result):
+    return [line for line in result.stderr.splitlines() if line.startswith("FAIL: ")]
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    with tempfile.TemporaryDirectory(prefix="anyps5-copy-") as directory:
+        work = Path(directory)
+        for case, image, rejected in CASES:
+            failures = {}
+            for flags, target in TARGETS.items():
+                name = f"{case}-{target}"
+                result, output = relink(relinker, work, name, image, flags)
+                if rejected:
+                    assert result.returncode == 2 and ERROR in result.stderr and not output.exists(), (
+                        name, result.returncode, result.stdout, result.stderr)
+                    failures[target] = fail_lines(result)
+                else:
+                    assert result.returncode == 0 and output.exists(), (
+                        name, result.returncode, result.stdout, result.stderr)
+                    output.unlink()
+            if rejected:
+                assert failures["linux"] and all(lines == failures["linux"] for lines in failures.values()), (
+                    case, failures)
+    print("COPY relocation test passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_dynamic_segment.py b/core/relinker/relinker/tests/test_dynamic_segment.py
index 8822738f38..8045014d4e 100644
--- a/core/relinker/relinker/tests/test_dynamic_segment.py
+++ b/core/relinker/relinker/tests/test_dynamic_segment.py
@@ -22,10 +22,10 @@ def main():
     with tempfile.TemporaryDirectory(prefix="anyps5-dynamic-segment-") as directory:
         work = Path(directory)
 
-        def convert(name, image, error=None):
+        def convert(name, image, error=None, modes=([], ["--windows"])):
             source = work / (name + ".elf")
             source.write_bytes(image)
-            for mode in ([], ["--windows"]):
+            for mode in modes:
                 output = work / (name + (".exe" if mode else ".out"))
                 result = subprocess.run([str(relinker), "--skip-sce-module", *mode, str(source), str(output)],
                                         capture_output=True, text=True, timeout=20)
@@ -72,6 +72,10 @@ def main():
         struct.pack_into("<QQ", empty, 120 + 32, 0, 0)
         convert("empty", empty, "Unterminated dynamic segment")
 
+        duplicate = fixture()
+        duplicate[64 + 2 * 56:64 + 3 * 56] = duplicate[120:176]
+        convert("duplicate", duplicate, "Multiple PT_DYNAMIC segments", ([], ["--windows"], ["--macos"]))
+
     if failures:
         raise AssertionError(failures)
     print("Dynamic segment tests passed")
diff --git a/core/relinker/relinker/tests/test_executable_export_bounds.py b/core/relinker/relinker/tests/test_executable_export_bounds.py
new file mode 100644
index 0000000000..0b5ea1a71c
--- /dev/null
+++ b/core/relinker/relinker/tests/test_executable_export_bounds.py
@@ -0,0 +1,129 @@
+"""An exported symbol of the executable must lie inside the image it is exported from, the rule
+GuestImageReader applies to every symbol of a guest module and the macOS target applied to the executable
+alone. A defined symbol that is not local, hidden or internal must lie inside a PT_LOAD segment that is
+executable for STT_FUNC, together with its size and at least one byte; a non-TLS export in SHN_ABS is exempt,
+any other special section index is rejected, and an STT_TLS export must lie inside PT_TLS with a regular
+section index. Symbols that are not exports are not checked. The check runs before any target-specific code,
+so an export it rejects fails with the same line, at the symbol entry's file offset, on every target."""
+
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+
+from test_linux_load_alignment import fixture
+
+PT_LOAD = 1
+PT_TLS = 7
+NOTYPE, OBJECT, FUNC, TLS = 0, 1, 2, 6
+LOCAL, GLOBAL, WEAK = 0, 1, 2
+SHN_ABS = 0xfff1
+SHN_SPECIAL = 0xff01
+TARGETS = {(): "linux", ("--lazy-binding",): "lazy", ("--windows",): "windows", ("--macos",): "macos"}
+SYMBOL_OFFSET = 0x4900 + 24
+TLS_MEMSZ, TLS_ALIGN = 0x24, 16
+
+
+def case(name, kind, value, size, message=None, binding=GLOBAL, section=1, visibility=0, tls=False):
+    return name, kind, value, size, message, binding, section, visibility, tls
+
+
+CASES = [
+    case("func_in_text", FUNC, 0x200, 6),
+    case("object_in_data", OBJECT, 0x1100, 8),
+    case("object_fills_load_end", OBJECT, 0x1ff8, 8),
+    case("notype_zero_size_inside", NOTYPE, 0x1ff0, 0),
+    case("func_last_byte", FUNC, 0xfff, 0),
+    case("weak_object", OBJECT, 0x1100, 8, binding=WEAK),
+    case("absolute", OBJECT, 0x123456789, 8, section=SHN_ABS),
+    case("tls_inside", TLS, 0x10, 4, tls=True),
+    case("hidden_outside_ignored", OBJECT, 0x9000, 8, visibility=2),
+    case("local_outside_ignored", OBJECT, 0x9000, 8, binding=LOCAL),
+    case("internal_outside_ignored", OBJECT, 0x9000, 8, visibility=1),
+    case("tls_fills", TLS, 0x20, 4, tls=True),
+    case("func_outside", FUNC, 0x9000, 6,
+         "Executable export {} at 0x9000 (6 bytes) does not fit inside an executable PT_LOAD segment"),
+    case("object_outside", OBJECT, 0x9000, 8,
+         "Executable export {} at 0x9000 (8 bytes) does not fit inside a PT_LOAD segment"),
+    case("object_past_end", OBJECT, 0x1ffc, 8,
+         "Executable export {} at 0x1ffc (8 bytes) does not fit inside a PT_LOAD segment"),
+    case("object_straddles_text_end", OBJECT, 0xffc, 8,
+         "Executable export {} at 0xffc (8 bytes) does not fit inside a PT_LOAD segment"),
+    case("protected_outside", OBJECT, 0x9000, 8,
+         "Executable export {} at 0x9000 (8 bytes) does not fit inside a PT_LOAD segment", visibility=3),
+    case("marker_at_end", NOTYPE, 0x2000, 0,
+         "Executable export {} at 0x2000 is not inside a PT_LOAD segment"),
+    case("func_in_data", FUNC, 0x1100, 6,
+         "Executable export {} at 0x1100 (6 bytes) does not fit inside an executable PT_LOAD segment"),
+    case("func_straddles_text_end", FUNC, 0xffc, 8,
+         "Executable export {} at 0xffc (8 bytes) does not fit inside an executable PT_LOAD segment"),
+    case("func_zero_in_data", FUNC, 0x1100, 0,
+         "Executable export {} at 0x1100 is not inside an executable PT_LOAD segment"),
+    case("special_section", OBJECT, 0x1100, 8,
+         "Unsupported executable export section: {}", section=SHN_SPECIAL),
+    case("tls_beyond", TLS, 0x20, 8,
+         "Executable TLS export exceeds PT_TLS: {}", tls=True),
+    case("tls_without_segment", TLS, 0x10, 4,
+         "Executable TLS export has no PT_TLS segment: {}"),
+    case("tls_special_section", TLS, 0x10, 4,
+         "Unsupported executable TLS export section: {}", section=SHN_ABS, tls=True),
+]
+
+
+def image(name, kind, value, size, binding, section, visibility, tls):
+    strings = b"\0" + name.encode("ascii") + b"\0"
+    data = fixture()
+    struct.pack_into("<Q", data, 24, 0x200)
+    data[0x4200:0x4206] = b"\xb8\x2a\x00\x00\x00\xc3"
+    data[0x4fff] = 0xc3
+    struct.pack_into("<IIQQQQQQ", data, 64 + 2 * 56, PT_LOAD, 6, 0x5000, 0x1000, 0x1000, 0x1000, 0x1000, 0x4000)
+    if tls:
+        struct.pack_into("<IIQQQQQQ", data, 64 + 3 * 56, PT_TLS, 4, 0x5800, 0x1800, 0x1800, 8, TLS_MEMSZ, TLS_ALIGN)
+    data[0x4600:0x4600 + len(strings)] = strings
+    struct.pack_into("<IBBHQQ", data, 0x4900 + 24, 1, binding << 4 | kind, visibility, section, value, size)
+    tags = [(5, 0x600), (10, len(strings)), (6, 0x900), (11, 24), (7, 0x700), (8, 0), (9, 24), (0x6100003F, 48), (0, 0)]
+    struct.pack_into("<IIQQQQQQ", data, 120, 2, 6, 0x4800, 0x800, 0x800, len(tags) * 16, len(tags) * 16, 8)
+    for index, tag in enumerate(tags):
+        struct.pack_into("<qQ", data, 0x4800 + index * 16, *tag)
+    return data
+
+
+def relink(relinker, directory, name, data, flags):
+    source = Path(directory) / (name + ".elf")
+    output = Path(directory) / (name + ".out")
+    source.write_bytes(data)
+    result = subprocess.run([str(relinker), "--skip-sce-module", *flags, str(source), str(output)],
+                            capture_output=True, text=True, timeout=20)
+    return result, output
+
+
+def fail_lines(stderr):
+    return [line for line in stderr.splitlines() if line.startswith("FAIL: ")]
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    with tempfile.TemporaryDirectory(prefix="anyps5-export-bounds-") as directory:
+        for name, kind, value, size, message, binding, section, visibility, tls in CASES:
+            data = image(name, kind, value, size, binding, section, visibility, tls)
+            reported = {}
+            for flags, target in TARGETS.items():
+                run = f"{name}-{target}"
+                result, output = relink(relinker, directory, run, data, flags)
+                if message is None:
+                    assert result.returncode == 0, (run, result.returncode, result.stdout, result.stderr)
+                    assert output.exists(), run
+                    output.unlink()
+                    continue
+                assert result.returncode == 2, (run, result.returncode, result.stdout, result.stderr)
+                assert not output.exists(), run
+                reported[target] = fail_lines(result.stderr)
+            if message is not None:
+                expected = [f"FAIL: {message.format(name)} (offset {SYMBOL_OFFSET:#x})"]
+                assert reported == {target: expected for target in TARGETS.values()}, (name, reported)
+    print("Executable export bounds test passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_executable_segments.py b/core/relinker/relinker/tests/test_executable_segments.py
index 34e3d1ae4b..862ff1f962 100644
--- a/core/relinker/relinker/tests/test_executable_segments.py
+++ b/core/relinker/relinker/tests/test_executable_segments.py
@@ -118,15 +118,19 @@ def main():
         result, output = run_case(relinker, work, "strict", ["unused-filter=2"], b"\x90\xc3")
         assert result.returncode == 2 and "multiple executable segments" in result.stderr and not output.exists(), result
 
-        for name, memory_size in (("overlap-past-end", 0x10000000000000), ("overlap-next", 0x1300)):
+        image_targets = ([], ["--lazy-binding"], ["--linux-fixed-base", "0x400000"], ["--windows"], ["--macos"])
+        for name, memory_size, targets in (("overlap-past-end", 0x10000000000000, image_targets[3:]),
+                                           ("overlap-next", 0x1300, image_targets)):
             image = fixture(b"\x90\xc3")
             struct.pack_into("<Q", image, 64 + 40, memory_size)
             source = work / (name + ".elf")
-            output = work / (name + ".exe")
             source.write_bytes(image)
-            result = subprocess.run([str(relinker), "--skip-sce-module", "--windows", str(source), str(output)],
-                                    capture_output=True, text=True, timeout=20)
-            assert result.returncode == 2 and "Overlapping PT_LOAD memory ranges" in result.stderr and not output.exists(), (name, result)
+            output = work / (name + ".out")
+            for options in targets:
+                result = subprocess.run([str(relinker), "--skip-sce-module", *options, str(source), str(output)],
+                                        capture_output=True, text=True, timeout=20)
+                assert result.returncode == 2 and "Overlapping PT_LOAD memory ranges" in result.stderr, (name, options, result)
+                assert not output.exists(), (name, options)
     print("Executable segment tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_executable_tls_relocations.py b/core/relinker/relinker/tests/test_executable_tls_relocations.py
index 5ce918047b..8df8d4232f 100644
--- a/core/relinker/relinker/tests/test_executable_tls_relocations.py
+++ b/core/relinker/relinker/tests/test_executable_tls_relocations.py
@@ -3,7 +3,9 @@ has them in its GOT. The Linux ELF keeps them dynamic and symbolless, with the v
 TLS block as the addend, for the dynamic loader to resolve against where it puts the block; a named one
 against a defined STT_TLS symbol is folded the same way, and one against an import stays named, typed
 STT_TLS. The Windows and macOS images resolve TPOFF64 and DTPOFF64 statically against their block,
-AlignUp(p_memsz, p_align) below the thread pointer, and reject what they cannot express."""
+AlignUp(p_memsz, p_align) below the thread pointer, and reject what they cannot express. Every target
+rejects the link-time types GOT32, PLT32, GOTPCREL, 32S, GOTPCRELX and REX_GOTPCRELX, which glibc's
+ld.so does not apply."""
 
 from pathlib import Path
 import struct
@@ -18,6 +20,8 @@ from test_tls_function_coverage import pe_bytes_at
 PT_LOAD = 1
 PT_TLS = 7
 DTPMOD64, DTPOFF64, TPOFF64, TPOFF32 = 16, 17, 18, 23
+LINK_TIME = {3: "got32", 4: "plt32", 9: "gotpcrel", 11: "32s", 41: "gotpcrelx", 42: "rex-gotpcrelx"}
+TARGETS = {(): "linux", ("--lazy-binding",): "lazy", ("--windows",): "windows", ("--macos",): "macos"}
 TLS_MEMSZ, TLS_ALIGN = 0x24, 16
 TLS_BLOCK = 0x30
 DEFAULT_BASE = 0x400000
@@ -27,15 +31,16 @@ TLS_NAME, DATA_NAME, IMPORT_NAME = 1, 5, 10
 NULL, TLS_SYMBOL, DATA_SYMBOL, IMPORTED = 0, 1, 2, 3
 
 
-def image(relocations, tls=True, symbol_bytes=None):
-    """The load-alignment fixture with a writable segment (vaddr 0x1000) holding a GOT and an 8-byte
-    TLS template, a symbol table and the given (offset, type, symbol, addend) relocations."""
+def image(relocations, tls=True, symbol_bytes=None, tls_memsz=TLS_MEMSZ):
+    """The load-alignment fixture with a writable segment (vaddr 0x1000) holding a GOT and a PT_TLS of
+    tls_memsz bytes with an up to 8-byte template, a symbol table and the given (offset, type, symbol,
+    addend) relocations."""
     data = fixture()
     struct.pack_into("<Q", data, 24, 0x200)
     data[0x4200:0x4206] = b"\xb8\x2a\x00\x00\x00\xc3"
     struct.pack_into("<IIQQQQQQ", data, 64 + 2 * 56, PT_LOAD, 6, 0x5000, 0x1000, 0x1000, 0x1000, 0x1000, 0x4000)
     if tls:
-        struct.pack_into("<IIQQQQQQ", data, 64 + 3 * 56, PT_TLS, 4, 0x5800, 0x1800, 0x1800, 8, TLS_MEMSZ, TLS_ALIGN)
+        struct.pack_into("<IIQQQQQQ", data, 64 + 3 * 56, PT_TLS, 4, 0x5800, 0x1800, 0x1800, min(8, tls_memsz), tls_memsz, TLS_ALIGN)
     data[0x5800:0x5808] = bytes(range(1, 9))
     data[0x4600:0x4600 + len(STRINGS)] = STRINGS
     struct.pack_into("<IBBHQQ", data, 0x4900 + TLS_SYMBOL * 24, TLS_NAME, 0x16, 0, 1, 0x10, 4)
@@ -114,6 +119,18 @@ def main():
         assert any(struct.unpack_from("<I", elf, 64 + index * 56)[0] == PT_TLS
                    for index in range(struct.unpack_from("<H", elf, 0x38)[0])), "PT_TLS must be kept"
 
+        for value, size in ((TLS_MEMSZ - 4, 4), (TLS_MEMSZ, 0), (TLS_MEMSZ + 1, 0), (TLS_MEMSZ - 1, 2), (0xffffffffffffffff, 1)):
+            for flags, target in TARGETS.items():
+                data = image([(0x1000, TPOFF64, TLS_SYMBOL, 0)])
+                struct.pack_into("<QQ", data, 0x4900 + TLS_SYMBOL * 24 + 8, value, size)
+                result, output = relink(relinker, directory, f"tls-bounds-{target}-{value}-{size}", data, *flags)
+                if value <= TLS_MEMSZ and size <= TLS_MEMSZ - value:
+                    assert result.returncode == 0 and output.exists(), (target, value, size, result.stderr)
+                else:
+                    assert result.returncode == 2 and "TLS symbol exceeds TLS segment" in result.stderr, (
+                        target, value, size, result.returncode, result.stderr)
+                    assert not output.exists()
+
         result, output = relink(relinker, directory, "windows", image(local), "--windows")
         assert result.returncode == 0, (result.stdout, result.stderr)
         pe = output.read_bytes()
@@ -137,18 +154,34 @@ def main():
 
         failures = [
             ("tpoff32", [(0x1000, TPOFF32, NULL, 0)], True, (), "Unsupported relocation type 0x17"),
+            ("tpoff32-invalid-sym", [(0x1000, TPOFF32, 0x1234, 0)], True, (), "Unsupported relocation type 0x17"),
+            ("unknown-reloc-invalid-sym", [(0x1000, 0x99, 0x1234, 0)], True, (), "Unsupported relocation type 0x99"),
             ("not-tls-symbol", [(0x1000, TPOFF64, DATA_SYMBOL, 0)], True, (), "not STT_TLS"),
-            ("no-tls-segment", [(0x1000, TPOFF64, NULL, 0)], False, (), "without a PT_TLS segment"),
+            ("no-tls-segment", [(0x1000, TPOFF64, NULL, 0)], False, (), "without a non-empty PT_TLS segment"),
             ("dtpmod-addend", [(0x1000, DTPMOD64, NULL, 1)], True, (), "DTPMOD64 relocation has a nonzero addend"),
             ("windows-dtpmod", [(0x1000, DTPMOD64, NULL, 0)], True, ("--windows",), "DTPMOD64 relocation is not supported"),
             ("windows-import", [(0x1000, TPOFF64, IMPORTED, 0)], True, ("--windows",), "Imported TLS relocation"),
             ("macos-dtpmod", [(0x1000, DTPMOD64, NULL, 0)], True, ("--macos",), "DTPMOD64 relocation is not supported"),
             ("macos-import", [(0x1000, TPOFF64, IMPORTED, 0)], True, ("--macos",), "Imported TLS relocation"),
-        ]
+        ] + [(f"{target}-{name}", [(0x1000, kind, NULL, 0)], True, flags, f"Unsupported relocation type {kind:#x}")
+             for kind, name in LINK_TIME.items() for flags, target in TARGETS.items()]
         for name, relocations, has_tls, flags, error in failures:
             result, output = relink(relinker, directory, name, image(relocations, has_tls), *flags)
             assert result.returncode == 2 and error in result.stderr, (name, result.returncode, result.stderr)
             assert not output.exists(), name
+
+        empty_tls = "FAIL: TLS relocation in an executable without a non-empty PT_TLS segment (offset 0x4700)"
+        for kind, addend in ((TPOFF64, 4), (DTPOFF64, 4), (DTPMOD64, 0)):
+            for symbol in (NULL, TLS_SYMBOL):
+                for flags, target in TARGETS.items():
+                    name = f"{target}-empty-tls-{kind}-{symbol}"
+                    data = image([(0x1000, kind, symbol, addend)], tls_memsz=0)
+                    result, output = relink(relinker, directory, name, data, *flags)
+                    assert result.returncode == 2 and empty_tls in result.stderr, (name, result.returncode, result.stderr)
+                    assert not output.exists(), name
+
+        result, output = relink(relinker, directory, "linux-empty-tls-import", image([(0x1000, TPOFF64, IMPORTED, 0)], tls_memsz=0))
+        assert result.returncode == 0 and output.exists(), (result.stdout, result.stderr)
     print("Executable TLS relocation test passed")
 
 
diff --git a/core/relinker/relinker/tests/test_executables.py b/core/relinker/relinker/tests/test_executables.py
index 844c33eb10..b58acc9317 100644
--- a/core/relinker/relinker/tests/test_executables.py
+++ b/core/relinker/relinker/tests/test_executables.py
@@ -27,7 +27,7 @@ def main():
             output = case / "out" / ("app.exe" if windows else "app.elf")
             output.parent.mkdir(exist_ok=True)
             result = subprocess.run([str(relinker), *(["--windows"] if windows else []), "--registry", *options, str(source), str(output)],
-                                    capture_output=True, text=True, timeout=60)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=60)
             return result, output
 
         for windows in (False, True):
diff --git a/core/relinker/relinker/tests/test_game_patches.py b/core/relinker/relinker/tests/test_game_patches.py
index 4fb2fd064a..960ea15692 100644
--- a/core/relinker/relinker/tests/test_game_patches.py
+++ b/core/relinker/relinker/tests/test_game_patches.py
@@ -36,7 +36,7 @@ def main():
         work = Path(directory)
 
         def run(*arguments):
-            return subprocess.run([str(relinker), *arguments], capture_output=True, text=True, timeout=60)
+            return subprocess.run([str(relinker), *arguments], capture_output=True, text=True, encoding="utf-8", timeout=60)
 
         def case(name):
             root = work / name
@@ -64,7 +64,7 @@ def main():
         assert f"Patch: eboot.bin [flip_bit] va={address:#x} off=" in result.stdout, result.stdout
         assert f"{expected:02x} -> {expected ^ 1:02x} (flip one bit)\n" in result.stdout, result.stdout
         manifest = output.parent / "app.patches.toml"
-        text = manifest.read_text()
+        text = manifest.read_text(encoding="utf-8")
         assert 'main_target = "eboot.bin"' in text and 'name = "flip_bit"' in text, text
         assert 'main_target = "eboot.bin"\nlinux_base = 0x400000\n' in text, text
         assert f"Patch manifest: {manifest}\n" in result.stdout
@@ -154,7 +154,7 @@ def main():
 
 def relocation_overlap(relinker, work):
     def run(*arguments):
-        return subprocess.run([str(relinker), *arguments], capture_output=True, text=True, timeout=60)
+        return subprocess.run([str(relinker), *arguments], capture_output=True, text=True, encoding="utf-8", timeout=60)
 
     def patch_file(path, target, address, expected):
         path.write_text(f'format = 1\n\n[[patch]]\ntarget = "{target}"\nva = {address:#x}\nexpected = "{expected}"\nvalue = "ffff"\n')
@@ -196,7 +196,7 @@ def relocation_overlap(relinker, work):
 
 def writer_overlap(relinker, work):
     def run(*arguments):
-        return subprocess.run([str(relinker), *arguments], capture_output=True, text=True, timeout=60)
+        return subprocess.run([str(relinker), *arguments], capture_output=True, text=True, encoding="utf-8", timeout=60)
 
     def attempt(name, module, options, address, expected, value="ff", target="sce_module/sample.prx"):
         case = work / name
diff --git a/core/relinker/relinker/tests/test_guest_absolute_symbols.py b/core/relinker/relinker/tests/test_guest_absolute_symbols.py
index a0c0056e57..67fc6810a2 100644
--- a/core/relinker/relinker/tests/test_guest_absolute_symbols.py
+++ b/core/relinker/relinker/tests/test_guest_absolute_symbols.py
@@ -12,18 +12,30 @@ from test_macos_output import MachO
 ABSOLUTE = 0xFFF1
 COMMON = 0xFFF2
 VALUE = 0x1234
+SIZE = 0x10
 ADDEND = 0x10
 TARGET = 0x2320
+TLS_SECTIONS = (ABSOLUTE, COMMON, 0xFF00, 0xFFFF)
 
 
-def module_with_section(section):
+def module_with_section(section, size=0):
     image = module_with_symbol(True)
-    struct.pack_into("<HQQ", image, 0x898 + 6, section, VALUE, 0)
+    struct.pack_into("<HQQ", image, 0x898 + 6, section, VALUE, size)
     struct.pack_into("<Q", image, 0x668, 24)
     struct.pack_into("<QQq", image, 0x900, TARGET, (1 << 32) | 1, ADDEND)
     return image
 
 
+def tls_module(section, binding):
+    image = module_with_symbol(True)
+    struct.pack_into("<H", image, 56, 4)
+    struct.pack_into("<IIQQQQQQ", image, 232, 7, 4, 0x980, 0x2380, 0x2380, 8, 0x40, 16)
+    struct.pack_into("<BBHQQ", image, 0x898 + 4, binding << 4 | 6, 0, section, 0, 8)
+    struct.pack_into("<Q", image, 0x668, 24)
+    struct.pack_into("<QQq", image, 0x900, TARGET, (1 << 32) | 17, 0)
+    return image
+
+
 def pe_qwords(data):
     for name, rva, raw_size, raw_offset, _ in pe_sections(data):
         for position in range(0, raw_size - 7, 8):
@@ -73,10 +85,10 @@ def main():
     with tempfile.TemporaryDirectory(prefix="anyps5-guest-absolute-") as directory:
         work = Path(directory)
 
-        def convert(name, system, section):
+        def convert(name, system, image):
             case = work / f"{name}-{system}"
             (case / "sce_module").mkdir(parents=True)
-            (case / "sce_module" / "module.prx").write_bytes(module_with_section(section))
+            (case / "sce_module" / "module.prx").write_bytes(image)
             source = case / "input.elf"
             source.write_bytes(main_fixture())
             output = case / ("output.exe" if system == "windows" else "output.elf")
@@ -86,19 +98,28 @@ def main():
             return result, case / "app0" / "sce_module" / "module.prx.guest.prx"
 
         for system in ("linux", "windows", "macos"):
-            result, artifact = convert("absolute", system, ABSOLUTE)
-            assert result.returncode == 0, (system, result.stdout, result.stderr)
-            data = artifact.read_bytes()
-            if system == "windows":
-                assert any(value == VALUE + ADDEND for _, value in pe_qwords(data)), "absolute relocation value missing"
-            elif system == "macos":
-                assert any(value == VALUE + ADDEND for _, value in macho_qwords(data)), "absolute relocation value missing"
-            else:
-                assert elf_relocation(data) == (1, ABSOLUTE, VALUE, ADDEND)
+            for size in (0, SIZE):
+                result, artifact = convert(f"absolute-{size}", system, module_with_section(ABSOLUTE, size))
+                assert result.returncode == 0, (system, size, result.stdout, result.stderr)
+                data = artifact.read_bytes()
+                if system == "windows":
+                    assert any(value == VALUE + ADDEND for _, value in pe_qwords(data)), "absolute relocation value missing"
+                elif system == "macos":
+                    assert any(value == VALUE + ADDEND for _, value in macho_qwords(data)), "absolute relocation value missing"
+                else:
+                    assert elf_relocation(data) == (1, ABSOLUTE, VALUE, ADDEND)
 
-            result, artifact = convert("common", system, COMMON)
+            result, artifact = convert("common", system, module_with_section(COMMON))
             assert result.returncode == 2 and "Unsupported special symbol section" in result.stderr, result.stderr
             assert not artifact.exists(), artifact
+
+            for binding in (0, 1):
+                result, artifact = convert(f"tls-1-{binding}", system, tls_module(1, binding))
+                assert result.returncode == 0 and artifact.exists(), (system, binding, result.stderr)
+                for section in TLS_SECTIONS:
+                    result, artifact = convert(f"tls-{section:x}-{binding}", system, tls_module(section, binding))
+                    assert result.returncode == 2 and "Unsupported special symbol section" in result.stderr, (system, hex(section), binding, result.stderr)
+                    assert not artifact.exists(), artifact
     print("Guest absolute symbol tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_guest_deferred_dependencies.py b/core/relinker/relinker/tests/test_guest_deferred_dependencies.py
index 7d27de5530..1a155bc31e 100644
--- a/core/relinker/relinker/tests/test_guest_deferred_dependencies.py
+++ b/core/relinker/relinker/tests/test_guest_deferred_dependencies.py
@@ -124,8 +124,8 @@ def main():
                                      env={**os.environ, "ANYPS5_GUEST_MODULE_ARGS": str(events)})
                 assert run.returncode == 42, (root, run.returncode, run.stdout, run.stderr)
                 recorded = events.read_text() if events.exists() else ""
-                assert recorded.count("args=") == (1 if root in ("executable", "bundled", "imported") else 0), (root, recorded)
-                load_and_record(case, libraries / "libc.prx", runtime / "plugin.prx.guest.prx")
+                assert recorded.count("args=") == 0, (root, recorded)
+                load_and_record(case, libraries / "libc.prx", runtime / "provider.prx.guest.prx")
     print("Guest deferred dependency tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_guest_module_args.py b/core/relinker/relinker/tests/test_guest_module_args.py
index ea9ecf0f18..0ee80ca6f3 100644
--- a/core/relinker/relinker/tests/test_guest_module_args.py
+++ b/core/relinker/relinker/tests/test_guest_module_args.py
@@ -105,6 +105,11 @@ def check_lifecycle_host(relinker, host, work, linux, deferred):
                                  env={**os.environ, 'ANYPS5_GUEST_MODULE_ARGS': str(events)},
                                  capture_output=True, text=True, timeout=30)
             assert run.returncode == 0, (run.returncode, run.stdout, run.stderr)
+            assert not events.exists(), events.read_text()
+            run = subprocess.run([sys.executable, __file__, '--load', str(libraries / 'libkernel.prx'), str(initializer)],
+                                 env={**os.environ, 'ANYPS5_GUEST_MODULE_ARGS': str(events)},
+                                 capture_output=True, text=True, timeout=30)
+            assert run.returncode == 0, (run.returncode, run.stdout, run.stderr)
         assert events.read_text() == 'result=0\n', events.read_text()
 
 
@@ -161,7 +166,20 @@ def main():
         host = ctypes.CDLL(sys.argv[2], mode=ctypes.RTLD_GLOBAL if sys.platform == 'darwin' else ctypes.DEFAULT_MODE)
         host.SetPendingArgs.argtypes = [ctypes.c_size_t, ctypes.c_void_p]
         host.SetPendingArgs(ARGS, ARGP)
-        ctypes.CDLL(sys.argv[3])
+        module = ctypes.CDLL(sys.argv[3])
+        try:
+            table = (ctypes.c_uint64 * 8).in_dll(module, '__aps5_guest_lifecycle_nid_no_patch')
+        except ValueError:
+            return
+        assert table[0] == 0x415053354c494658 and table[6] == 0
+        table[6] = 1
+        returned = ctypes.CFUNCTYPE(ctypes.c_int, ctypes.c_size_t, ctypes.c_void_p, ctypes.c_void_p)(table[2])(ARGS, ARGP, None) if table[2] else 0
+        for index in range(table[4]):
+            callback = ctypes.c_void_p.from_address(ctypes.c_uint64.from_address(ctypes.addressof(table) + 64 + index * 8).value).value
+            if callback:
+                ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_void_p, ctypes.c_void_p)(callback)(0, None, None)
+        host.__aps5_set_module_init_result_nid_no_patch(returned)
+        table[6] = 2
         return
     relinker = Path(sys.argv[1]).resolve()
     host = Path(sys.argv[2]).resolve()
diff --git a/core/relinker/relinker/tests/test_guest_module_dir.py b/core/relinker/relinker/tests/test_guest_module_dir.py
index 7f2022a918..95e4f087ac 100644
--- a/core/relinker/relinker/tests/test_guest_module_dir.py
+++ b/core/relinker/relinker/tests/test_guest_module_dir.py
@@ -10,6 +10,7 @@ from test_guest_intel_trampolines import main_fixture, pe_sections
 from test_guest_module_directories import module_with_symbol, needed_libraries
 from test_guest_needed_modules import executable_with_needed, module_with_needed
 from test_macos_output import MachO
+from test_windows_import_modules import executable, provider
 
 
 def pe_export_names(data):
@@ -199,6 +200,21 @@ def main():
             else:
                 assert "$ORIGIN/app0/Media/Modules/needed.prx.guest.prx" in needed_libraries(output.read_bytes()), needed_libraries(output.read_bytes())
 
+            for directory, deferred in (("Media/Modules", True), ("sce_module", False)):
+                case = work / f"{windows}-imported-{deferred}"
+                (case / directory).mkdir(parents=True)
+                (case / directory / "needed.prx").write_bytes(provider(42))
+                result, output = convert(case, windows, ["--module-dir", directory] if deferred else [], executable("needed.prx"))
+                assert result.returncode == 0, (result.stdout, result.stderr)
+                line = f"Deferred module app0/{directory}/needed.prx.guest.prx: the executable imports from it, but it starts only when the title loads it\n"
+                if windows:
+                    assert (line.encode() in output.read_bytes()) == deferred, directory
+                    if os.name == "nt":
+                        run = subprocess.run([str(output)], capture_output=True, text=True, timeout=30)
+                        assert run.returncode == 42 and (line in run.stdout) == deferred, (directory, run.returncode, run.stdout, run.stderr)
+                else:
+                    assert f"$ORIGIN/app0/{directory}/needed.prx.guest.prx" in needed_libraries(output.read_bytes()), needed_libraries(output.read_bytes())
+
             case = work / f"{windows}-root"
             case.mkdir()
             (case / "root.prx").write_bytes(module_with_symbol(True))
diff --git a/core/relinker/relinker/tests/test_guest_needed_modules.py b/core/relinker/relinker/tests/test_guest_needed_modules.py
index 6388feb414..d2bd13f0ae 100644
--- a/core/relinker/relinker/tests/test_guest_needed_modules.py
+++ b/core/relinker/relinker/tests/test_guest_needed_modules.py
@@ -63,7 +63,7 @@ def check_guest_needed(relinker, work):
             (case / "prx" / "consumer.prx").write_bytes(module_with_needed(names, entries))
             output = case / ("output.exe" if windows else "output.elf")
             result = subprocess.run([str(relinker), *(["--windows"] if windows else []), str(source), str(output)],
-                                    capture_output=True, text=True, timeout=30)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=30)
             assert result.returncode == 0, (label, windows, result.stdout, result.stderr)
             artifact = case / "app0" / "prx" / "consumer.prx.guest.prx"
             assert artifact.read_bytes().startswith(b"MZ" if windows else b"\x7fELF"), artifact
@@ -81,16 +81,115 @@ def check_guest_needed(relinker, work):
             module.write_bytes(module_with_needed((first, invalid), (0, 0, 1)))
             output = case / ("output.exe" if windows else "output.elf")
             result = subprocess.run([str(relinker), *(["--windows"] if windows else []), str(source), str(output)],
-                                    capture_output=True, text=True, timeout=30)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=30)
             assert result.returncode == 2 and f"{module}: Invalid dependency: {invalid.decode()}\n" in result.stderr, result.stderr
             assert not output.exists() and not (case / "app0").exists(), output
 
 
+def check_needed_outside(relinker, work):
+    self_container = bytes.fromhex("4f153d1d") + b"\0" * 60
+    sce_module = module_with_symbol(True)
+    struct.pack_into("<H", sce_module, 16, 0xFE18)
+    message = "Needed module not converted: "
+
+    def convert(case, options=(), needed=NEEDED):
+        source = case / "input.elf"
+        source.write_bytes(executable_with_needed(needed))
+        result = subprocess.run([str(relinker), *options, str(source), str(case / "output.elf")],
+                                capture_output=True, text=True, timeout=30)
+        assert result.returncode == 0, (case.name, result.stdout, result.stderr)
+        return [line for line in result.stdout.splitlines() if line.startswith(message)]
+
+    case = work / "outside-self-root"
+    (case / "sce_module").mkdir(parents=True)
+    (case / "sce_module" / "wrapped.prx").write_bytes(self_container)
+    (case / "needed.prx").write_bytes(self_container)
+    assert convert(case) == [message + "needed.prx at needed.prx; add --module-dir . and unwrap the SELF container"]
+
+    case = work / "outside-alias-nested"
+    (case / "sce_module").mkdir(parents=True)
+    (case / "Media" / "Modules").mkdir(parents=True)
+    (case / "Media" / "Modules" / "needed.sprx").write_bytes(sce_module)
+    (case / "Media" / "Modules" / "needed.prx.guest.prx").write_bytes(sce_module)
+    (case / "Media" / "other.prx").write_bytes(sce_module)
+    assert convert(case) == [message + "needed.prx at Media/Modules/needed.sprx; add --module-dir Media/Modules"]
+    assert convert(case, ["--module-dir", "Media/Modules"]) == []
+    assert (case / "app0" / "Media" / "Modules" / "needed.sprx.guest.prx").is_file()
+
+    case = work / "outside-two-copies"
+    (case / "sce_module").mkdir(parents=True)
+    for name in ("first", "second"):
+        (case / name).mkdir()
+        (case / name / "needed.prx").write_bytes(sce_module)
+    assert convert(case) == [message + "needed.prx at first/needed.prx; add --module-dir first",
+                             message + "needed.prx at second/needed.prx; add --module-dir second"]
+
+    case = work / "outside-not-sce"
+    (case / "sce_module").mkdir(parents=True)
+    (case / "libs").mkdir()
+    (case / "libs" / "needed.prx").write_bytes(module_with_symbol(True))
+    (case / "needed.prx").write_text("not ELF")
+    (case / "sce_module" / "needed.prx").mkdir()
+    assert convert(case) == []
+
+    case = work / "outside-converted"
+    (case / "sce_module").mkdir(parents=True)
+    (case / "sce_module" / "needed.prx").write_bytes(sce_module)
+    (case / "needed.prx").write_bytes(sce_module)
+    assert convert(case) == []
+
+    case = work / "outside-skipped"
+    case.mkdir()
+    (case / "needed.prx").write_bytes(sce_module)
+    assert convert(case, ["--skip-sce-module"]) == []
+
+    case = work / "outside-case"
+    (case / "sce_module").mkdir(parents=True)
+    (case / "Media").mkdir()
+    (case / "Media" / "NEEDED.PRX").write_bytes(sce_module)
+    assert convert(case) == []
+    assert convert(case, ["--windows"]) == [message + "needed.prx at Media/NEEDED.PRX; add --module-dir Media"]
+
+    if os.name != "nt" and os.geteuid() != 0:
+        case = work / "outside-unreadable"
+        (case / "sce_module").mkdir(parents=True)
+        (case / "Media").mkdir()
+        (case / "Media" / "needed.prx").write_bytes(sce_module)
+        (case / "needed.prx").write_bytes(self_container)
+        (case / "needed.prx").chmod(0)
+        try:
+            assert convert(case) == [message + "needed.prx at Media/needed.prx; add --module-dir Media"]
+        finally:
+            (case / "needed.prx").chmod(0o644)
+
+    if os.name != "nt":
+        case = work / "outside-loops"
+        (case / "sce_module").mkdir(parents=True)
+        (case / "Media").mkdir()
+        (case / "Media" / "needed.prx").write_bytes(sce_module)
+        os.symlink("loop", case / "loop")
+        os.symlink("needed.prx", case / "needed.prx")
+        os.symlink("missing.prx", case / "Media" / "needed.sprx")
+        (case / "Media" / "Nested").mkdir()
+        os.symlink("..", case / "Media" / "Nested" / "needed.suprx")
+        expected = [message + "needed.prx at Media/needed.prx; add --module-dir Media"]
+        assert convert(case) == expected
+        if os.geteuid() != 0:
+            (case / "locked").mkdir()
+            (case / "locked" / "needed.prx").write_bytes(sce_module)
+            (case / "locked").chmod(0)
+            try:
+                assert convert(case) == expected
+            finally:
+                (case / "locked").chmod(0o755)
+
+
 def main():
     relinker = Path(sys.argv[1]).resolve()
     with tempfile.TemporaryDirectory(prefix="anyps5-needed-modules-") as directory:
         work = Path(directory)
         check_guest_needed(relinker, work)
+        check_needed_outside(relinker, work)
 
         def convert(case, windows, needed=NEEDED, repeats=1):
             if not (case / "sce_modules").exists():
@@ -99,7 +198,7 @@ def main():
             source.write_bytes(executable_with_needed(needed, repeats))
             output = case / ("output.exe" if windows else "output.elf")
             result = subprocess.run([str(relinker), *(["--windows"] if windows else []), str(source), str(output)],
-                                    capture_output=True, text=True, timeout=30)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=30)
             return result, output
 
         for windows in (False, True):
@@ -118,7 +217,7 @@ def main():
             assert layout in result.stdout, result.stdout
             for spelling in (os.path.join(".", output.name), os.path.join("..", case.name, output.name)):
                 relative = subprocess.run([str(relinker), *(["--windows"] if windows else []), "input.elf", spelling], cwd=case,
-                                          capture_output=True, text=True, timeout=30)
+                                          capture_output=True, text=True, encoding="utf-8", timeout=30)
                 assert relative.returncode == 0 and layout in relative.stdout, (spelling, relative.stdout, relative.stderr)
             if windows and os.name == "nt":
                 run = subprocess.run([str(output)], capture_output=True, text=True, timeout=30)
@@ -203,7 +302,7 @@ def main():
         source = case / "input.elf"
         source.write_bytes(executable_with_needed(b"libSceVideoOut.prx", 2))
         result = subprocess.run([str(relinker), "--macos", str(source), str(case / "output")],
-                                capture_output=True, text=True, timeout=30)
+                                capture_output=True, text=True, encoding="utf-8", timeout=30)
         assert result.returncode == 0, (result.stdout, result.stderr)
     print("Guest needed module tests passed")
 
diff --git a/core/relinker/relinker/tests/test_guest_none_relocations.py b/core/relinker/relinker/tests/test_guest_none_relocations.py
index 44d55ed646..9ebc28509d 100644
--- a/core/relinker/relinker/tests/test_guest_none_relocations.py
+++ b/core/relinker/relinker/tests/test_guest_none_relocations.py
@@ -76,6 +76,11 @@ def change_tag(image, tag, value=None, replacement=None):
     raise AssertionError(f"Missing dynamic tag {tag:#x}")
 
 
+def unsized_lifecycle(rela, sce, initial):
+    image = module(rela, sce=sce, lifecycle=True, initial=initial)
+    return change_tag(change_tag(image, 27, replacement=0x61000001), 28, replacement=0x61000001)
+
+
 def check_output(data, system, rela, plt, initial):
     expected_rela = [(entry[0], entry[1] & 0xffffffff, entry[2])
                      if (entry[1] & 0xffffffff) == 8 and entry[1] >> 32 else entry
@@ -123,6 +128,7 @@ def invalid_cases(sce):
     entry = 0x61000033 if sce else 9
     address = 0x6100002f if sce else 7
     plt_format = 0x6100002b if sce else 20
+    yield "lifecycle-without-address", change_tag(module([RELATIVE], sce=sce, lifecycle=True, initial=0), 25, replacement=0x61000001), "Incomplete guest lifecycle array"
     yield "partial-entry", change_tag(module([NOOP], sce=sce), size, 23), "Invalid relocation table size"
     yield "entry-size", change_tag(module([NOOP], sce=sce), entry, 16), "Invalid RELA entry size"
     yield "unmapped-table", change_tag(module([NOOP], sce=sce), address, 0xffffffffffffffff), ("SCE table exceeds" if sce else "Unmapped ELF address")
@@ -186,6 +192,15 @@ def main():
                             executed = subprocess.run([sys.executable, __file__, "--load", str(artifact)],
                                                       capture_output=True, text=True, timeout=10)
                             assert executed.returncode == 0, (executed.stdout, executed.stderr)
+            for name, rela, initial in (("unsized-lifecycle", [RELATIVE], UNCHANGED),
+                                        ("unsized-lifecycle-unread", [(TARGET, 0, FUNCTION)], FUNCTION)):
+                image = unsized_lifecycle(rela, sce, initial)
+                for system in ("linux", "windows", "macos"):
+                    result, artifact, output = convert(f"{sce}-{name}", system, image)
+                    assert result.returncode == 0, (sce, name, system, result.stdout, result.stderr)
+                    check_output(artifact.read_bytes(), system, rela, [], initial)
+                    if system == "linux":
+                        assert not {25, 26, 27, 28} & set(dynamic_tags(artifact.read_bytes())), name
             for name, image, error in invalid_cases(sce):
                 result, artifact, output = convert(f"{sce}-{name}", "linux", image)
                 assert result.returncode == 2 and error in result.stderr, (sce, name, result.stderr)
diff --git a/core/relinker/relinker/tests/test_guest_runpath.py b/core/relinker/relinker/tests/test_guest_runpath.py
index e5238ab66f..b5ad7d3701 100644
--- a/core/relinker/relinker/tests/test_guest_runpath.py
+++ b/core/relinker/relinker/tests/test_guest_runpath.py
@@ -52,7 +52,8 @@ def main():
                     if resolved != expected or (label.startswith("absolute") and actual != run_path):
                         failures.append((str(relative), label, actual, str(resolved), str(expected)))
                     checked += 1
-        for index, run_path in enumerate(("relative/libs", "C:/host/libs", "C:\\host\\libs", "\\\\server\\share")):
+        for index, run_path in enumerate(("relative/libs", "C:/host/libs", "C:\\host\\libs", "\\\\server\\share",
+                                          "$ORIGIN/libs:", "$ORIGIN::/opt/libs", "$ORIGIN:relative/libs", "/opt/libs:")):
             output = work / f"invalid-{index}.elf"
             result = subprocess.run([str(relinker), "--rpath", run_path, str(source), str(output)],
                                     capture_output=True, text=True, timeout=20)
diff --git a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py
new file mode 100644
index 0000000000..d7bd720160
--- /dev/null
+++ b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py
@@ -0,0 +1,57 @@
+from pathlib import Path
+import os
+import struct
+import subprocess
+import sys
+import tempfile
+
+from test_guest_module_args import args_module
+
+
+def lifecycle_module():
+    image = args_module()
+    tags = []
+    for offset in range(0x2000, 0x2300, 16):
+        tag, value = struct.unpack_from("<qQ", image, offset)
+        if tag == 0:
+            break
+        tags.append((tag, 72 if tag == 8 else value))
+    tags += [(13, 0x1080), (25, 0x2880), (27, 8), (26, 0x2888), (28, 8), (0, 0)]
+    for index, tag in enumerate(tags):
+        struct.pack_into("<qQ", image, 0x2000 + index * 16, *tag)
+    struct.pack_into("<QQ", image, 120 + 32, len(tags) * 16, len(tags) * 16)
+    struct.pack_into("<QQq", image, 0x2718, 0x2880, 8, 0x10c0)
+    struct.pack_into("<QQq", image, 0x2730, 0x2888, 8, 0x1100)
+    for address, marker in ((0x1080, 0xfe), (0x10c0, 0xa1), (0x1100, 0xf1)):
+        code = b"\x48\x83\xec\x08\xbf" + struct.pack("<I", marker) + b"\x31\xf6\xff\x15"
+        code += struct.pack("<i", 0x2820 - address - len(code) - 4)
+        code += b"\x48\x83\xc4\x08\xc3"
+        image[address:address + len(code)] = code
+    return image
+
+
+def main():
+    relinker, executable, libraries = map(lambda p: Path(p).resolve(), sys.argv[1:4])
+    with tempfile.TemporaryDirectory(prefix="anyps5-runtime-lifecycle-") as directory:
+        root = Path(directory)
+        plugins = root / "Media" / "Plugins"
+        plugins.mkdir(parents=True)
+        (plugins / "args.prx").write_bytes(lifecycle_module())
+        from test_guest_module_directories import module_with_symbol
+        bundled = root / "sce_module"
+        bundled.mkdir()
+        (bundled / "dummy.prx").write_bytes(module_with_symbol(False))
+        source = root / "main.elf"
+        from test_guest_intel_trampolines import main_fixture
+        source.write_bytes(main_fixture())
+        run = subprocess.run([str(relinker), "--skip-syscall-check", "--module-dir", "Media/Plugins", "--rpath", str(libraries), str(source), str(root / "app.elf")], capture_output=True, text=True, timeout=30)
+        assert run.returncode == 0, (run.stdout, run.stderr)
+        module = root / "app0/Media/Plugins/args.prx.guest.prx"
+        for mode in ("never-start", "start", "zero-start", "concurrent", "reentrant", "reload"):
+            run = subprocess.run([str(executable), "./" + module.name, mode], cwd=module.parent, env=os.environ, capture_output=True, text=True, timeout=10)
+            assert run.returncode == 0, (mode, run.returncode, run.stdout, run.stderr)
+    print("Runtime module initialization and finalization passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_guest_symbol_names.py b/core/relinker/relinker/tests/test_guest_symbol_names.py
index 3580b83e32..e41660d237 100644
--- a/core/relinker/relinker/tests/test_guest_symbol_names.py
+++ b/core/relinker/relinker/tests/test_guest_symbol_names.py
@@ -148,7 +148,7 @@ def relink(relinker, case, executable, modules):
     for name, image in modules.items():
         (case / "sce_module" / name).write_bytes(image)
     output = case / "output.elf"
-    result = subprocess.run([str(relinker), str(source), str(output)], capture_output=True, text=True, timeout=30)
+    result = subprocess.run([str(relinker), str(source), str(output)], capture_output=True, text=True, encoding="utf-8", timeout=30)
     assert result.returncode == 0, (result.stdout, result.stderr)
     return output
 
@@ -192,7 +192,7 @@ def main():
         for name, image in twins.items():
             (work / "needed-both" / "sce_module" / name).write_bytes(image)
         result = subprocess.run([str(relinker), str(work / "needed-both" / "input.elf"), str(work / "needed-both" / "output.elf")],
-                                capture_output=True, text=True, timeout=30)
+                                capture_output=True, text=True, encoding="utf-8", timeout=30)
         assert result.returncode != 0 and "Ambiguous guest import AAAAAAAAAAA" in result.stderr, (result.stdout, result.stderr)
 
         guests = relink(relinker, work / "guest-declared", importing_executable([]), {
@@ -222,7 +222,7 @@ def main():
                     needed_module_import("YYYYYYYYYYY", "XXXXXXXXXXX#A#B", "libc.prx", (tag,)))
                 output = case / ("output.exe" if windows else "output.elf")
                 result = subprocess.run([str(relinker), *(["--windows"] if windows else []), str(case / "input.elf"), str(output)],
-                                        capture_output=True, text=True, timeout=30)
+                                        capture_output=True, text=True, encoding="utf-8", timeout=30)
                 assert result.returncode == 0, (windows, hex(tag), result.stdout, result.stderr)
                 if not windows:
                     modules = case / "app0" / "sce_module"
@@ -240,7 +240,7 @@ def main():
         module = case / "sce_module" / "libc.prx"
         module.write_bytes(needed_module_import("XXXXXXXXXXX", "YYYYYYYYYYY#A#B", "libkernel.prx", (0x6100000F, 0x61000045)))
         result = subprocess.run([str(relinker), str(case / "input.elf"), str(case / "output.elf")],
-                                capture_output=True, text=True, timeout=30)
+                                capture_output=True, text=True, encoding="utf-8", timeout=30)
         assert result.returncode == 2 and f"{module}: Guest module mixes PS4 and PS5 needed-module tags\n" in result.stderr, result.stderr
         assert not (case / "output.elf").exists()
 
@@ -250,7 +250,7 @@ def main():
         module = case / "sce_module" / "libc.prx"
         module.write_bytes(needed_module_import("XXXXXXXXXXX", "YYYYYYYYYYY#A#C", "libkernel.prx"))
         result = subprocess.run([str(relinker), str(case / "input.elf"), str(case / "output.elf")],
-                                capture_output=True, text=True, timeout=30)
+                                capture_output=True, text=True, encoding="utf-8", timeout=30)
         assert result.returncode == 2 and "Unknown import module ID: YYYYYYYYYYY#A#C\n" in result.stderr \
             and f"Input: {module}\n" in result.stderr, result.stderr
         assert not (case / "output.elf").exists()
diff --git a/core/relinker/relinker/tests/test_guest_tls_export_references.py b/core/relinker/relinker/tests/test_guest_tls_export_references.py
new file mode 100644
index 0000000000..d5401da429
--- /dev/null
+++ b/core/relinker/relinker/tests/test_guest_tls_export_references.py
@@ -0,0 +1,89 @@
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+
+from guest_import_fixtures import dynamic
+from test_guest_intel_trampolines import PLAIN_SITE, guest_fixture, main_fixture
+
+
+STRINGS = b"\0tls_value\0a.prx\0"
+SLOT = 0x2340
+GLOB_DAT = 6
+JUMP_SLOT = 7
+DTPMOD64 = 16
+DTPOFF64 = 17
+REJECTED = "Non-TLS relocation against guest TLS export: tls_value"
+MISMATCH = "Guest import/export type mismatch: tls_value"
+
+
+def symbol_table(image, info, section, size, value=0):
+    image[0x800:0x800 + len(STRINGS)] = STRINGS
+    struct.pack_into("<IIIII", image, 0x840, 1, 2, 1, 0, 0)
+    struct.pack_into("<IBBHQQ", image, 0x898, 1, info, 0, section, value, size)
+
+
+def provider(tls=True):
+    image = guest_fixture(PLAIN_SITE)
+    if tls:
+        struct.pack_into("<H", image, 56, 4)
+        struct.pack_into("<IIQQQQQQ", image, 232, 7, 4, 0x980, 0x2380, 0x2380, 8, 0x40, 16)
+        symbol_table(image, 0x16, 1, 8)
+    else:
+        symbol_table(image, 0x11, 2, 8, 0x2380)
+    dynamic(image, 0x600, 176, [(5, 0x2200), (10, len(STRINGS)), (6, 0x2280), (11, 24),
+                                (4, 0x2240), (7, 0x2300), (8, 0), (9, 24)])
+    return image
+
+
+def consumer(info, kinds, plt=False):
+    image = guest_fixture(PLAIN_SITE)
+    symbol_table(image, info, 0, 0)
+    for index, kind in enumerate(kinds):
+        struct.pack_into("<QQq", image, 0x900 + index * 24, SLOT + index * 8, (1 << 32) | kind, 0)
+    size = len(kinds) * 24
+    tags = [(5, 0x2200), (10, len(STRINGS)), (6, 0x2280), (11, 24), (4, 0x2240),
+            (7, 0x2300), (8, 0 if plt else size), (9, 24), (1, 11)]
+    if plt:
+        tags += [(23, 0x2300), (2, size), (20, 7)]
+    dynamic(image, 0x600, 176, tags)
+    return image
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    cases = (("notype-glob-dat", provider(), consumer(0x10, (GLOB_DAT,)), REJECTED),
+             ("notype-64", provider(), consumer(0x10, (1,)), REJECTED),
+             ("notype-jump-slot", provider(), consumer(0x10, (JUMP_SLOT,), plt=True), REJECTED),
+             ("object-glob-dat", provider(), consumer(0x11, (GLOB_DAT,)), MISMATCH),
+             ("notype-unreferenced", provider(), consumer(0x10, ()), None),
+             ("notype-object-export", provider(False), consumer(0x10, (GLOB_DAT,)), None),
+             ("tls-dtpmod-dtpoff", provider(), consumer(0x16, (DTPMOD64, DTPOFF64)), None))
+    with tempfile.TemporaryDirectory(prefix="anyps5-guest-tls-export-references-") as directory:
+        work = Path(directory)
+        for name, exporter, image, message in cases:
+            for system in ("linux", "windows", "macos"):
+                case = work / name / system
+                modules = case / "sce_module"
+                modules.mkdir(parents=True)
+                (modules / "a.prx").write_bytes(exporter)
+                (modules / "b.prx").write_bytes(image)
+                source = case / "input.elf"
+                source.write_bytes(main_fixture())
+                output = case / ("output.exe" if system == "windows" else "output.elf")
+                flags = {"linux": [], "windows": ["--windows"], "macos": ["--macos"]}[system]
+                result = subprocess.run([str(relinker), *flags, str(source), str(output)],
+                                        capture_output=True, text=True, timeout=10)
+                artifacts = case / "app0" / "sce_module"
+                if message is None:
+                    assert result.returncode == 0, (name, system, result.stdout, result.stderr)
+                    assert output.exists() and (artifacts / "b.prx.guest.prx").exists(), (name, system)
+                else:
+                    assert result.returncode == 2 and message in result.stderr, (name, system, result.returncode, result.stderr)
+                    assert not output.exists() and not artifacts.exists(), (name, system)
+    print("Guest TLS export reference tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_guest_trailing_note.py b/core/relinker/relinker/tests/test_guest_trailing_note.py
new file mode 100644
index 0000000000..5601a84caa
--- /dev/null
+++ b/core/relinker/relinker/tests/test_guest_trailing_note.py
@@ -0,0 +1,48 @@
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+
+from test_guest_intel_trampolines import main_fixture
+from test_guest_module_directories import module_with_symbol
+
+
+def module_with_note(offset, address, memory_size):
+    image = module_with_symbol(True)
+    struct.pack_into("<H", image, 56, 4)
+    struct.pack_into("<IIQQQQQQ", image, 232, 4, 4, offset, address, address, 0x48, memory_size, 4)
+    return image
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    with tempfile.TemporaryDirectory(prefix="anyps5-trailing-note-") as directory:
+        work = Path(directory)
+        size = len(module_with_symbol(True))
+        cases = (
+            ("unmapped-past-eof", module_with_note(size, 0, 0), None),
+            ("unmapped-in-file", module_with_note(size - 0x48, 0, 0), None),
+            ("mapped-past-eof", module_with_note(size, 0x3000, 0x48), "ELF range exceeds file"),
+        )
+        for name, module, error in cases:
+            for windows in (False, True):
+                case = work / f"{name}-{windows}"
+                (case / "sce_module").mkdir(parents=True)
+                (case / "sce_module" / "noted.prx").write_bytes(module)
+                source = case / "input.elf"
+                source.write_bytes(main_fixture())
+                output = case / ("output.exe" if windows else "output.elf")
+                result = subprocess.run([str(relinker), *(["--windows"] if windows else []), str(source), str(output)],
+                                        capture_output=True, text=True, timeout=30)
+                artifact = case / "app0" / "sce_module" / "noted.prx.guest.prx"
+                if error is None:
+                    assert result.returncode == 0 and artifact.exists(), (name, windows, result.stdout, result.stderr)
+                else:
+                    assert result.returncode == 2 and error in result.stderr and not artifact.exists(), (
+                        name, windows, result.returncode, result.stdout, result.stderr)
+    print("Guest trailing note tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py b/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py
index f3054ee7bd..264c6a251e 100644
--- a/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py
+++ b/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py
@@ -9,7 +9,7 @@ import tempfile
 from guest_import_fixtures import dynamic
 from test_guest_deferred_dependencies import page_aligned
 from test_guest_intel_trampolines import main_fixture
-from test_guest_module_args import args_module
+from test_guest_module_args import args_module, load_and_record
 from test_guest_module_directories import module_with_symbol, needed_libraries
 from test_guest_module_dir import pe_export_names
 from test_guest_needed_modules import module_with_needed
@@ -98,7 +98,8 @@ def main():
                     else:
                         assert run.returncode == 42, (kind, run.returncode, run.stdout, run.stderr)
                         recorded = events.read_text() if events.exists() else ''
-                        assert recorded.count('args=') == (1 if kind in ('referenced', 'weak-referenced', 'plt', 'needed') else 0), (kind, recorded)
+                        assert recorded.count('args=') == 0, (kind, recorded)
+                        load_and_record(case, libraries / 'libc.prx', case / provider)
                 cases += 1
             cycle = Path(directory) / f'{system}-cycle'
             (cycle / 'sce_module').mkdir(parents=True)
diff --git a/core/relinker/relinker/tests/test_guest_zero_initializer.py b/core/relinker/relinker/tests/test_guest_zero_initializer.py
index 7cc9a40ef7..8d8a5d14d0 100644
--- a/core/relinker/relinker/tests/test_guest_zero_initializer.py
+++ b/core/relinker/relinker/tests/test_guest_zero_initializer.py
@@ -8,10 +8,10 @@ import tempfile
 
 from guest_import_fixtures import executable
 from test_guest_intel_trampolines import main_fixture, pe_sections
-from test_guest_module_args import ARGP, ARGS, GETTER, RETURNED, SETTER, macho_binds
+from test_guest_module_args import ARGP, ARGS, GETTER, RETURNED, SETTER, load_and_record, macho_binds
 from test_guest_module_directories import needed_libraries
 from test_guest_module_dir import pe_export_names
-from test_guest_symbol_names import dynamic_tags, imported_symbols
+from test_guest_symbol_names import dynamic_tags, file_offset, imported_symbols, module_symbols
 
 PREINIT_SLOT = 0x2900
 SHARED = 0x100
@@ -85,6 +85,46 @@ def convert(relinker, work, preinit, options, base=0):
     return output, work / 'app0' / 'sce_module' / (name + '.guest.prx')
 
 
+def check_deferred_linux(relinker, work, host, preinit, has_init, native):
+    (work / 'sce_module').mkdir(parents=True)
+    plugins = work / 'plugins'
+    plugins.mkdir()
+    source = work / 'input.elf'
+    source.write_bytes(main_fixture())
+    image = zero_init_module(preinit)
+    if not has_init:
+        for position in range(0x2000, 0x2300, 16):
+            if struct.unpack_from('<q', image, position)[0] == 12:
+                struct.pack_into('<q', image, position, 21)
+                break
+        else:
+            raise AssertionError('Fixture has no DT_INIT tag to remove')
+    (plugins / 'zero.prx').write_bytes(image)
+    libraries = work / 'libs'
+    libraries.mkdir()
+    provider = libraries / 'libc.prx'
+    shutil.copyfile(host, provider)
+    shutil.copyfile(host, libraries / 'libkernel.prx')
+    result = subprocess.run([str(relinker), '--skip-syscall-check', '--module-dir', 'plugins',
+                             '--rpath', '$ORIGIN/libs', str(source), str(work / 'output.elf')],
+                            capture_output=True, text=True, timeout=30)
+    assert result.returncode == 0, (preinit, has_init, result.stdout, result.stderr)
+    converted = work / 'app0/plugins/zero.prx.guest.prx'
+    image = converted.read_bytes()
+    assert ('libkernel.prx' in needed_libraries(image)) == has_init, 'Deferred initializer dependency does not match DT_INIT presence'
+    tags = dynamic_tags(image)
+    assert tags.get(12, 0) == 0 and tags.get(25, 0) == 0, 'Deferred Linux module has an eager initializer'
+    index = module_symbols(image).index('__aps5_guest_lifecycle_nid_no_patch') + 1
+    table, = struct.unpack_from('<Q', image, file_offset(image, tags[6]) + index * 24 + 8)
+    relocations = [struct.unpack_from('<QQq', image, file_offset(image, tags[7]) + offset)
+                   for offset in range(0, tags[8], tags[9])]
+    init_relocations = [entry for entry in relocations if entry[0] == table + 16]
+    expected = [(table + 16, 8, 0)] if has_init else []
+    assert init_relocations == expected, (preinit, has_init, init_relocations, expected)
+    if native and has_init:
+        load_and_record(work, provider, converted)
+
+
 def main():
     if sys.argv[1] == '--load':
         import ctypes
@@ -138,6 +178,9 @@ def main():
                 assert run.returncode == 0, (preinit, run.returncode, run.stdout, run.stderr)
                 recorded = events.read_text()
                 assert f'args={ARGS:016x} argp={ARGP:016x}\nresult={RETURNED}\n' == recorded, (preinit, recorded)
+        for preinit, has_init in ((False, True), (True, True), (False, False)):
+            check_deferred_linux(relinker, work / f'linux-runtime-{preinit}-{has_init}',
+                                 host, preinit, has_init, linux)
         for index, options in enumerate(([], ['--macos'], ['--windows'])):
             convert(relinker, work / f'outside-{index}', False, options, 0x1000)
     print('Guest zero initializer tests passed' if linux else 'Guest zero initializer tests passed: native execution skipped')
diff --git a/core/relinker/relinker/tests/test_import_symbol_types.py b/core/relinker/relinker/tests/test_import_symbol_types.py
new file mode 100644
index 0000000000..6bced0ee07
--- /dev/null
+++ b/core/relinker/relinker/tests/test_import_symbol_types.py
@@ -0,0 +1,62 @@
+from pathlib import Path
+import struct
+import sys
+import tempfile
+
+from test_guest_symbol_names import (DYNAMIC, GOT, RELOCATIONS, STRINGS, SYMBOLS, dynamic_tags, file_offset, relink,
+                                     string_table, symbol_name)
+from test_guest_intel_trampolines import main_fixture
+
+def importing_executable(imports, binding=1, relocation_type=6):
+    image = main_fixture()
+    strings, offsets = string_table(name for name, _ in imports)
+    image[STRINGS:STRINGS + len(strings)] = strings
+    for index, (offset, (_, kind)) in enumerate(zip(offsets, imports), 1):
+        struct.pack_into("<IBBHQQ", image, SYMBOLS + index * 24, offset, (binding << 4) | kind, 0, 0, 0, 0)
+        struct.pack_into("<QQq", image, RELOCATIONS + (index - 1) * 24, GOT + (index - 1) * 8, (index << 32) | relocation_type, 0)
+    tags = [(5, STRINGS), (10, len(strings)), (6, SYMBOLS), (11, 24)]
+    if relocation_type == 7:
+        tags += [(3, GOT), (23, RELOCATIONS), (2, len(imports) * 24), (20, 7)]
+    else:
+        tags += [(7, RELOCATIONS), (8, len(imports) * 24), (9, 24)]
+    tags.append((0, 0))
+    for index, tag in enumerate(tags):
+        struct.pack_into("<qQ", image, DYNAMIC + index * 16, *tag)
+    struct.pack_into("<QQQQQ", image, 120 + 8, DYNAMIC, DYNAMIC, DYNAMIC, len(tags) * 16, len(tags) * 16)
+    return image
+
+
+def imported_symbols(image):
+    tags = dynamic_tags(image)
+    symbols = file_offset(image, tags[6])
+    types = {}
+    for address, size in ((7, 8), (23, 2)):
+        if address not in tags or tags.get(size, 0) == 0:
+            continue
+        table = file_offset(image, tags[address])
+        for position in range(table, table + tags[size], 24):
+            info, = struct.unpack_from("<Q", image, position + 8)
+            index = info >> 32
+            if index:
+                types[symbol_name(image, tags, index)] = image[symbols + index * 24 + 4]
+    return types
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    with tempfile.TemporaryDirectory(prefix="anyps5-import-types-") as directory:
+        for relocation_type in (6, 7):
+            for binding in (1, 2):
+                for kind in range(16):
+                    imports = [("FFFFFFFFFFF", 2), ("DDDDDDDDDDD", 1), ("NNNNNNNNNNN", kind)]
+                    case = Path(directory) / f"{relocation_type}-{binding}-{kind}"
+                    case.mkdir()
+                    output = relink(relinker, case, importing_executable(imports, binding, relocation_type), {})
+                    symbols = imported_symbols(output.read_bytes())
+                    expected = {name: (binding << 4) | symbol_type for name, symbol_type in imports}
+                    assert symbols == expected, (relocation_type, binding, kind, symbols, expected)
+    print("Import symbol type tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_input_file.py b/core/relinker/relinker/tests/test_input_file.py
index 6146103953..2124c7395e 100644
--- a/core/relinker/relinker/tests/test_input_file.py
+++ b/core/relinker/relinker/tests/test_input_file.py
@@ -21,7 +21,7 @@ def main():
             output = work / (name + ".out")
             registry = work / (name + ".registry.json")
             result = subprocess.run([str(relinker), "--skip-sce-module", "--registry", *flags, str(source), str(output)],
-                                    capture_output=True, text=True, timeout=20)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=20)
             assert result.returncode == 2 and error in result.stderr and "bad_alloc" not in result.stderr, (name, flags, result)
             assert not output.exists() and not registry.exists(), (name, flags, result)
 
diff --git a/core/relinker/relinker/tests/test_input_magic.py b/core/relinker/relinker/tests/test_input_magic.py
index e26ccf337c..5a0292feb0 100644
--- a/core/relinker/relinker/tests/test_input_magic.py
+++ b/core/relinker/relinker/tests/test_input_magic.py
@@ -1,6 +1,7 @@
 """Reject inputs that are not plain ELF files with a message that names what was read."""
 
 from pathlib import Path
+import os
 import platform
 import subprocess
 import sys
@@ -42,8 +43,10 @@ def main():
                 resource.setrlimit(resource.RLIMIT_AS, (512 * 1024**2, 512 * 1024**2))
                 resource.setrlimit(resource.RLIMIT_CORE, (0, 0))
 
+            bounded_by_asan = "max_allocation_size_mb=" in os.environ.get("ASAN_OPTIONS", "")
             result = subprocess.run([str(relinker), "--skip-sce-module", str(source), str(output)],
-                                    capture_output=True, text=True, timeout=20, preexec_fn=limit_address_space)
+                                    capture_output=True, text=True, timeout=20,
+                                    preexec_fn=None if bounded_by_asan else limit_address_space)
             assert result.returncode == 2 and "Invalid ELF magic number: 7f 46 49 48" in result.stderr and not output.exists(), result
     print("Input magic diagnostics tests passed")
 
diff --git a/core/relinker/relinker/tests/test_input_preservation.py b/core/relinker/relinker/tests/test_input_preservation.py
index 241dd1f4bc..37f9ba92e9 100644
--- a/core/relinker/relinker/tests/test_input_preservation.py
+++ b/core/relinker/relinker/tests/test_input_preservation.py
@@ -30,7 +30,7 @@ def check_executable_hardlinks(relinker, work):
                     links = protected.stat().st_nlink
                     try:
                         result = subprocess.run([str(relinker), *command], cwd=case,
-                                                capture_output=True, text=True, timeout=20)
+                                                capture_output=True, text=True, encoding="utf-8", timeout=20)
                         assert result.returncode == 2 and "output would overwrite" in result.stderr, (
                             windows, output_name, input_name, readonly, result.stdout, result.stderr)
                         for path, original in inputs.items():
@@ -61,7 +61,7 @@ def check_executable_hardlinks(relinker, work):
                 path.chmod(stat.S_IREAD)
         try:
             result = subprocess.run([str(relinker), *command], cwd=case,
-                                    capture_output=True, text=True, timeout=20)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=20)
             assert result.returncode == 0, (readonly, result.stdout, result.stderr)
             for name in ("executable", "secondary-one", "secondary-two"):
                 assert outputs[name].read_bytes().startswith(b"MZ")
@@ -111,7 +111,7 @@ def check_diagnostic_inputs(relinker, work):
                     options.append("--registry")
                 result = subprocess.run([str(relinker), "--windows", "--windows-diagnostics", *options,
                                          str(source), str(output)], cwd=diagnostics.parent,
-                                        capture_output=True, text=True, timeout=20)
+                                        capture_output=True, text=True, encoding="utf-8", timeout=20)
                 owner = "an input module" if bundled else "the input executable"
                 assert result.returncode == 2 and f"Windows import diagnostics output would overwrite {owner}" in result.stderr, (result.stdout, result.stderr)
                 assert str(diagnostics) in result.stderr, result.stderr
@@ -134,7 +134,7 @@ def check_diagnostic_inputs(relinker, work):
             options = ["--windows-diagnostics"] if enabled else []
             result = subprocess.run([str(relinker), "--windows", "--skip-sce-module", *options,
                                      str(source), str(output)], cwd=case,
-                                    capture_output=True, text=True, timeout=20)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=20)
             assert result.returncode == 0 and output.read_bytes().startswith(b"MZ"), (result.stdout, result.stderr)
             assert source.read_bytes() == original
             assert diagnostics.read_bytes() == (b"" if enabled else original)
@@ -177,7 +177,7 @@ def check_registry_inputs(relinker, work, windows, needed=False):
                 previous_output = b"previous executable"
                 output.write_bytes(previous_output)
                 result = subprocess.run([str(relinker), *options, "--registry", str(source), str(output)],
-                                        capture_output=True, text=True, timeout=20)
+                                        capture_output=True, text=True, encoding="utf-8", timeout=20)
                 kind = "Needed libraries" if needed else "Registry"
                 expected = f"{kind} output would overwrite an input module" if bundled else f"{kind} output would overwrite the input executable"
                 assert result.returncode == 2 and expected in result.stderr, (result.returncode, result.stdout, result.stderr)
@@ -204,7 +204,7 @@ def check_registry_after_failed_patch(relinker, work):
     for registry in registries:
         registry.write_bytes(previous_registry)
     result = subprocess.run([str(relinker), "--windows", "--registry", str(source), str(output)],
-                            capture_output=True, text=True, timeout=20)
+                            capture_output=True, text=True, encoding="utf-8", timeout=20)
     assert result.returncode == 2 and "Invalid Windows icon PNG" in result.stderr, (result.stdout, result.stderr)
     assert output.read_bytes() == previous_output
     assert all(registry.read_bytes() == previous_registry for registry in registries)
@@ -225,7 +225,7 @@ def check_output_directory(relinker, work):
             output = str(target) if existing else str(target) + os.sep
             options = ["--windows"] if windows else []
             result = subprocess.run([str(relinker), *options, str(source), output], cwd=case,
-                                    capture_output=True, text=True, timeout=20)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=20)
             assert result.returncode == 2 and "Executable output is a directory" in result.stderr, (result.stdout, result.stderr)
             assert not (case / "app0").exists() and not (target / "app0").exists()
             assert target.exists() == existing
@@ -273,7 +273,7 @@ def check_desktop_inputs(relinker, work):
                     registry_path.write_bytes(previous_registry)
                     options = ["--registry"] if registry else []
                     result = subprocess.run([str(relinker), *options, str(source), str(output)],
-                                            capture_output=True, text=True, timeout=20)
+                                            capture_output=True, text=True, encoding="utf-8", timeout=20)
                     kind = "Desktop entry" if desktop else "Icon"
                     owner = "an input module" if bundled else "the input executable"
                     assert result.returncode == 2 and f"{kind} output would overwrite {owner}" in result.stderr, (result.stdout, result.stderr)
@@ -332,7 +332,7 @@ def main():
                     arguments = [] if bundled else ["--skip-sce-module"]
                     result = subprocess.run([str(relinker), *options, *arguments, "--registry",
                                              str(source), str(output)],
-                                            capture_output=True, text=True, timeout=20)
+                                            capture_output=True, text=True, encoding="utf-8", timeout=20)
                     expected = "Executable output would overwrite an input module" if bundled else "Executable output would overwrite the input executable"
                     if (result.returncode != 2 or expected not in result.stderr
                             or source.read_bytes() != original
@@ -365,7 +365,7 @@ def main():
                 if existing:
                     output.write_bytes(b"previous output")
                 result = subprocess.run([str(relinker), *options, "--registry", str(source), str(output)],
-                                        capture_output=True, text=True, timeout=20)
+                                        capture_output=True, text=True, encoding="utf-8", timeout=20)
                 converted = case / "app0" / "sce_module" / "sample.prx.guest.prx"
                 magic = b"MZ" if windows else b"\x7fELF"
                 if (result.returncode != 0 or not output.read_bytes().startswith(magic)
@@ -375,7 +375,7 @@ def main():
                     raise AssertionError((windows, existing, result.returncode, result.stdout, result.stderr))
                 if not windows:
                     assert Path(f"{output}.png").read_bytes() == image
-                    assert Path(f"{output}.desktop").read_text().startswith("[Desktop Entry]\n")
+                    assert Path(f"{output}.desktop").read_text(encoding="utf-8").startswith("[Desktop Entry]\n")
     print("Input preservation tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_jmprel_table_bounds.py b/core/relinker/relinker/tests/test_jmprel_table_bounds.py
index 504e1f9109..ed7bb8f41e 100644
--- a/core/relinker/relinker/tests/test_jmprel_table_bounds.py
+++ b/core/relinker/relinker/tests/test_jmprel_table_bounds.py
@@ -124,6 +124,11 @@ def main():
                         "Symbol table entry out of bounds", target=output_target)
                     run(relinker, work, prefix + "-none", fixture(symbol_bytes=0, symbol_index=0xFFFFFFFF,
                                                                  relocation_type=0, **options), target=output_target)
+                else:
+                    run(relinker, work, prefix + "-unsupported-plt-type", fixture(relocation_type=6, **options),
+                        "Unsupported PLT relocation type", target=output_target)
+                    run(relinker, work, prefix + "-relative-in-plt", fixture(relocation_type=8, **options),
+                        "Unsupported PLT relocation type", target=output_target)
     print("Jump relocation table bounds tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_linux_dynamic_strings.py b/core/relinker/relinker/tests/test_linux_dynamic_strings.py
index 82c72cbbef..4dd3e1a453 100644
--- a/core/relinker/relinker/tests/test_linux_dynamic_strings.py
+++ b/core/relinker/relinker/tests/test_linux_dynamic_strings.py
@@ -56,7 +56,8 @@ def main():
         source = Path(directory) / "input.elf"
         source.write_bytes(fixture())
         for name, options, expected in (("default", [], b"$ORIGIN/libs"),
-                                        ("custom", ["--rpath", "/opt/anyps5/lib"], b"/opt/anyps5/lib")):
+                                        ("custom", ["--rpath", "/opt/anyps5/lib"], b"/opt/anyps5/lib"),
+                                        ("list", ["--rpath", "/opt/anyps5/lib:$ORIGIN/libs"], b"/opt/anyps5/lib:$ORIGIN/libs")):
             output = Path(directory) / (name + ".elf")
             result = subprocess.run([str(relinker), "--skip-sce-module", *options, str(source), str(output)],
                                     capture_output=True, text=True, timeout=20)
@@ -70,6 +71,15 @@ def main():
                 raise AssertionError((name, "DT_RUNPATH is outside DT_STRSZ", run_path, tags[DT_STRSZ]))
             if dynstr_section_size(elf) != tags[DT_STRSZ]:
                 raise AssertionError((name, ".dynstr size differs from DT_STRSZ", dynstr_section_size(elf), tags[DT_STRSZ]))
+        for index, run_path in enumerate(("", ":$ORIGIN/libs", "$ORIGIN/libs:", "/opt/a::/opt/b")):
+            for target in ([], ["--lazy-binding"]):
+                output = Path(directory) / f"empty-{index}-{len(target)}.elf"
+                result = subprocess.run([str(relinker), "--skip-sce-module", *target, "--rpath", run_path, str(source), str(output)],
+                                        capture_output=True, text=True, timeout=20)
+                if result.returncode != 2 or "Empty Linux run path component" not in result.stderr:
+                    raise AssertionError((run_path, target, result.returncode, result.stdout, result.stderr))
+                if output.exists():
+                    raise AssertionError((run_path, target, "an empty run path component created an output"))
     print("Linux dynamic string tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_linux_eh_frame_header.py b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
index a80a1eb1ed..cfe4cf6053 100644
--- a/core/relinker/relinker/tests/test_linux_eh_frame_header.py
+++ b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
@@ -18,7 +18,7 @@ def fixture(header_count, with_frame=True):
     image = bytearray(0x8000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16,
-                     3, 62, 1, 0x4000, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
+                     3, 62, 1, 0, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
     image[0x4000:0x4006] = b"\xb8\x2a\x00\x00\x00\xc3"
     tags = [(5, 0x600), (10, 1), (6, 0x620), (11, 24), (7, 0x700), (8, 0), (9, 24), (0, 0)]
     struct.pack_into("<IIQQQQQQ", image, 64,
@@ -131,19 +131,25 @@ def main():
             assert struct.unpack_from("<Q", elf, 0x20)[0] >= len(image), "The grown program header table must be moved past the input"
             assert elf[64 + 5 * 56:64 + 6 * 56] == image[64 + 5 * 56:64 + 6 * 56], "Bytes after the input program header table changed"
 
-        image = fixture(5, with_frame=False)
-        headers = image[64:64 + 4 * 56]
-        headers += struct.pack("<IIQQQQQQ", 4, 0, 0, 0, 0, 0, 0, 1) * 65530
-        struct.pack_into("<Q", image, 32, len(image))
-        struct.pack_into("<H", image, 56, 65534)
-        image += headers
-        source = Path(directory) / "overflowing-header-count.elf"
-        output = source.with_suffix(".out")
-        source.write_bytes(image)
-        result = subprocess.run([str(relinker), "--skip-sce-module", str(source), str(output)], capture_output=True, text=True, timeout=20)
-        assert result.returncode == 2, (result.returncode, result.stdout, result.stderr)
-        assert "Not enough program header slots: need 65537, available 65534" in result.stderr, result.stderr
-        assert not output.exists(), "An unrepresentable header count must not produce an executable"
+        for padding_count in (65527, 65528, 65530):
+            image = fixture(5, with_frame=False)
+            headers = image[64:64 + 4 * 56]
+            headers += struct.pack("<IIQQQQQQ", 4, 0, 0, 0, 0, 0, 0, 1) * padding_count
+            struct.pack_into("<Q", image, 32, len(image))
+            struct.pack_into("<H", image, 56, 4 + padding_count)
+            image += headers
+            source = Path(directory) / f"header-count-{padding_count}.elf"
+            output = source.with_suffix(".out")
+            source.write_bytes(image)
+            result = subprocess.run([str(relinker), "--skip-sce-module", str(source), str(output)], capture_output=True, text=True, timeout=20)
+            if padding_count == 65527:
+                assert result.returncode == 0, (result.returncode, result.stdout, result.stderr)
+                assert len(program_headers(output.read_bytes())) == 65534
+            else:
+                assert result.returncode == 2, (result.returncode, result.stdout, result.stderr)
+                assert "Extended program header counts are not supported" in result.stderr, result.stderr
+                assert not output.exists(), "An unsupported extended count must not produce an executable"
+            assert source.read_bytes() == image, "Source changed"
     print("Linux eh_frame header test passed")
 
 
diff --git a/core/relinker/relinker/tests/test_linux_executable_exports.py b/core/relinker/relinker/tests/test_linux_executable_exports.py
index bc27b67838..d8cf1b8852 100644
--- a/core/relinker/relinker/tests/test_linux_executable_exports.py
+++ b/core/relinker/relinker/tests/test_linux_executable_exports.py
@@ -16,7 +16,7 @@ def main():
         work = Path(directory)
         probe = work / "probe.c"
         probe.write_text(
-            "#include <dlfcn.h>\n"
+            "#define _GNU_SOURCE\n#include <dlfcn.h>\n"
             "#include <unistd.h>\n"
             "void check(void) {\n"
             "    int (*function)(void) = dlsym(RTLD_DEFAULT, \"FixtureExport\");\n"
diff --git a/core/relinker/relinker/tests/test_linux_fixed_base.py b/core/relinker/relinker/tests/test_linux_fixed_base.py
index ee31ad59ef..ce9f4118c5 100644
--- a/core/relinker/relinker/tests/test_linux_fixed_base.py
+++ b/core/relinker/relinker/tests/test_linux_fixed_base.py
@@ -186,7 +186,7 @@ def main():
         for name, image, base, error in (
             ("unaligned", fixture(alignment=0x20000), 0x410000, "is not a multiple of the PT_LOAD alignment 0x20000"),
             ("beyond-user-space", fixture(memory_size=0x100000), 0x7FFFFFFF0000, "outside the Linux user address space"),
-            ("unsupported-type", fixture(relocation_type=9), BASE, "Relocation type 9 cannot be placed at a fixed Linux base"),
+            ("unsupported-type", fixture(relocation_type=11), BASE, "Unsupported relocation type 0xb"),
             ("negative-target", fixture(addend=-16), BASE, "Relocation target -16 lies below the image at a fixed Linux base"),
         ):
             result, output = relink(relinker, work, name, image, "--linux-fixed-base", hex(base))
diff --git a/core/relinker/relinker/tests/test_linux_guest_named_imports.py b/core/relinker/relinker/tests/test_linux_guest_named_imports.py
new file mode 100644
index 0000000000..7f087e7343
--- /dev/null
+++ b/core/relinker/relinker/tests/test_linux_guest_named_imports.py
@@ -0,0 +1,128 @@
+import os
+from pathlib import Path
+import platform
+import shutil
+import struct
+import subprocess
+import sys
+import tempfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent / "macos"))
+
+from guest_import_fixtures import executable
+from nid import nid
+from test_guest_deferred_dependencies import page_aligned
+from test_guest_intel_trampolines import main_fixture
+from test_guest_module_directories import needed_libraries
+from test_guest_needed_modules import module_with_needed
+from test_guest_symbol_names import guest_module, imported_symbols, module_symbols, relink
+from test_linux_load_alignment import fixture
+from test_windows_import_modules import consumer
+
+PROVIDER = "int provided(void) __asm__(\"\\\"%s\\\"\");\nint provided(void) { return 22; }\n"
+
+
+def guest_with_needed(symbols, needed):
+    image = guest_module(symbols)
+    size, = struct.unpack_from("<Q", image, 0x618)
+    name = needed.encode() + b"\0"
+    assert size + len(name) <= 0x40
+    image[0x800 + size:0x800 + size + len(name)] = name
+    struct.pack_into("<Q", image, 0x618, size + len(name))
+    struct.pack_into("<qQqQ", image, 0x680, 1, size, 0, 0)
+    struct.pack_into("<QQ", image, 176 + 32, 10 * 16, 10 * 16)
+    return image
+
+
+def exporting_executable(name, info=0x12, other=0):
+    image = fixture()
+    strings = b"\0" + name.encode() + b"\0"
+    image[0x4600:0x4600 + len(strings)] = strings
+    image[0x4210:0x4216] = bytes.fromhex("b82a000000c3")
+    struct.pack_into("<IBBHQQ", image, 0x4900, 0, 0, 0, 0, 0, 0)
+    struct.pack_into("<IBBHQQ", image, 0x4918, 1, info, other, 1, 0x210, 6)
+    tags = [(5, 0x600), (10, len(strings)), (6, 0x900), (11, 24), (7, 0x700), (8, 0), (9, 24), (0x6100003f, 48), (0, 0)]
+    struct.pack_into("<IIQQQQQQ", image, 120, 2, 6, 0x4800, 0x800, 0x800, len(tags) * 16, len(tags) * 16, 8)
+    for index, tag in enumerate(tags):
+        struct.pack_into("<qQ", image, 0x4800 + index * 16, *tag)
+    return image
+
+
+def provider(work, name, symbol):
+    source = work / (name + ".c")
+    source.write_text(PROVIDER % symbol)
+    library = work / (name + ".so")
+    subprocess.run([os.environ.get("CC", "cc"), "-shared", "-fPIC", str(source), "-o", str(library)], check=True)
+    return library
+
+
+def run_consumer(relinker, host, case, library):
+    (case / "sce_module").mkdir(parents=True)
+    (case / "sce_module" / "consumer.prx").write_bytes(page_aligned(consumer("available.sprx", symbol="shared")))
+    image = main_fixture()
+    code = bytes.fromhex("b83c000000bf2a0000000f05")
+    image[0x4000:0x4000 + len(code)] = code
+    source = case / "input.elf"
+    source.write_bytes(image)
+    output = case / "output.elf"
+    result = subprocess.run([str(relinker), "--skip-syscall-check", str(source), str(output)],
+                            capture_output=True, text=True, timeout=30)
+    assert result.returncode == 0, (result.stdout, result.stderr)
+    module = case / "app0" / "sce_module" / "consumer.prx.guest.prx"
+    assert "available.prx" in needed_libraries(module.read_bytes()), needed_libraries(module.read_bytes())
+    assert nid("shared") in module_symbols(module.read_bytes()), module_symbols(module.read_bytes())
+    libraries = case / "libs"
+    libraries.mkdir()
+    for name in ("libc.prx", "libkernel.prx"):
+        shutil.copyfile(host, libraries / name)
+    shutil.copyfile(library, libraries / "available.prx")
+    output.chmod(0o755)
+    return subprocess.run([str(output)], capture_output=True, text=True, timeout=30,
+                          env={**os.environ, "ANYPS5_GUEST_MODULE_ARGS": str(case / "events.txt")})
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    host = Path(sys.argv[2]).resolve()
+    runnable = sys.platform.startswith("linux") and platform.machine() in ("x86_64", "AMD64")
+    with tempfile.TemporaryDirectory(prefix="anyps5-linux-guest-named-imports-") as directory:
+        work = Path(directory)
+
+        guest = relink(relinker, work / "guest", executable("libkernel_web.sprx", "shared"), {
+            "user.sprx": guest_with_needed([("shared", True), ("BBBBBBBBBBB", False), ("CCCCCCCCCCC#C#C", False)], "libkernel_web.sprx"),
+            "plain.prx": guest_module([("DDDDDDDDDDD", False)]),
+        })
+        assert imported_symbols(guest.read_bytes()) == {"shared#guest"}, imported_symbols(guest.read_bytes())
+        modules = guest.parent / "app0" / "sce_module"
+        symbols = module_symbols((modules / "user.sprx.guest.prx").read_bytes())
+        assert symbols == ["shared#guest", nid("BBBBBBBBBBB"), "CCCCCCCCCCC"], symbols
+        symbols = module_symbols((modules / "plain.prx.guest.prx").read_bytes())
+        assert symbols == ["DDDDDDDDDDD"], symbols
+
+        dependencies = relink(relinker, work / "dependencies", executable("available.prx"), {
+            "user.prx": module_with_needed((b"libSceLibcInternal.sprx", b"libkernel_web.sprx"), (0, 1)),
+        })
+        needed = needed_libraries(dependencies.read_bytes())
+        assert needed == ["$ORIGIN/app0/sce_module/user.prx.guest.prx", "available.prx", "libSceLibcInternal.prx", "libkernel_web.prx", "libc.prx"], needed
+        needed = needed_libraries((dependencies.parent / "app0" / "sce_module" / "user.prx.guest.prx").read_bytes())
+        assert needed == ["libSceLibcInternal.prx", "libkernel_web.prx", "libc.prx"], needed
+
+        for label, info, other, kept in (("global", 0x12, 0, True), ("weak", 0x22, 0, True), ("protected", 0x12, 3, True),
+                                         ("internal", 0x12, 1, False), ("hidden", 0x12, 2, False), ("local", 0x02, 0, False)):
+            exported = relink(relinker, work / ("executable-" + label), exporting_executable("FixtureExport#A#B", info, other), {
+                "user.prx": guest_with_needed([("FixtureExport", False), ("BBBBBBBBBBB", False)], "libkernel_web.sprx"),
+            })
+            symbols = module_symbols((exported.parent / "app0" / "sce_module" / "user.prx.guest.prx").read_bytes())
+            expected = "FixtureExport" if kept else nid("FixtureExport")
+            assert symbols == [expected, nid("BBBBBBBBBBB")], (label, symbols)
+
+        if runnable:
+            result = run_consumer(relinker, host, work / "by-nid", provider(work, "by-nid", nid("shared")))
+            assert result.returncode == 42, (result.returncode, result.stdout, result.stderr)
+            result = run_consumer(relinker, host, work / "by-name", provider(work, "by-name", "shared"))
+            assert result.returncode != 0 and nid("shared") in result.stderr, (result.returncode, result.stdout, result.stderr)
+    print("Linux guest named import tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_linux_load_alignment.py b/core/relinker/relinker/tests/test_linux_load_alignment.py
index 51008e9392..0a549b05ec 100644
--- a/core/relinker/relinker/tests/test_linux_load_alignment.py
+++ b/core/relinker/relinker/tests/test_linux_load_alignment.py
@@ -14,7 +14,7 @@ def fixture():
     image = bytearray(0x8000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16,
-                     3, 62, 1, 0x4000, 64, 0, 0, 64, 56, 6, 64, 0, 0)
+                     3, 62, 1, 0, 64, 0, 0, 64, 56, 6, 64, 0, 0)
     image[0x4000:0x4006] = b"\xb8\x2a\x00\x00\x00\xc3"
     tags = [(5, 0x600), (10, 1), (6, 0x620), (11, 24), (7, 0x700), (8, 0), (9, 24), (0, 0)]
     struct.pack_into("<IIQQQQQQ", image, 64,
diff --git a/core/relinker/relinker/tests/test_linux_load_bounds.py b/core/relinker/relinker/tests/test_linux_load_bounds.py
new file mode 100644
index 0000000000..687e95ae2b
--- /dev/null
+++ b/core/relinker/relinker/tests/test_linux_load_bounds.py
@@ -0,0 +1,122 @@
+"""Check that a Linux relink rejects an entry point, relocation offset or DT_PLTGOT outside PT_LOAD memory."""
+
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from test_jmprel_table_bounds import fixture
+
+PT_LOAD = 1
+PT_SCE_RELRO = 0x61000010
+PF_X = 1
+PF_W = 2
+PF_R = 4
+R_X86_64_PC32 = 2
+R_X86_64_32 = 10
+E_ENTRY = 24
+FIRST_LOAD_FLAGS = 64 + 4
+SPARE_HEADER = 64 + 3 * 56
+PLTGOT_VALUE = 0x400 + 9 * 16 + 8
+OUTSIDE = 0x2000
+ENTRY = 0x200
+FIXED_BASE = 0x400000
+
+
+def with_bss(image):
+    struct.pack_into("<IIQQQQQQ", image, SPARE_HEADER, PT_LOAD, PF_R | PF_W, 0x1000, 0x1000, 0x1000, 0, 0x1000, 0x1000)
+    return image
+
+
+def with_relro(image):
+    struct.pack_into("<IIQQQQQQ", image, SPARE_HEADER, PT_SCE_RELRO, PF_R, 0, 0x1000, 0x1000, 0, 0x1000, 1)
+    return with_pltgot(image, 0x1800)
+
+
+def with_entry(image, entry):
+    struct.pack_into("<Q", image, E_ENTRY, entry)
+    return image
+
+
+def with_pltgot(image, value):
+    struct.pack_into("<Q", image, PLTGOT_VALUE, value)
+    return image
+
+
+def without_load_flags(image):
+    struct.pack_into("<I", image, FIRST_LOAD_FLAGS, 0)
+    return image
+
+
+def load_flags_at(elf, address):
+    phoff, = struct.unpack_from("<Q", elf, 0x20)
+    phentsize, phnum = struct.unpack_from("<HH", elf, 0x36)
+    headers = [struct.unpack_from("<IIQQQQQQ", elf, phoff + index * phentsize) for index in range(phnum)]
+    return [header[1] for header in headers if header[0] == PT_LOAD and header[3] <= address < header[3] + header[6]]
+
+
+def relink(relinker, work, name, image, options, error):
+    source = work / (name + ".elf")
+    output = work / (name + ".out")
+    source.write_bytes(image)
+    result = subprocess.run([str(relinker), "--skip-sce-module", *options, str(source), str(output)],
+                            capture_output=True, text=True, timeout=20)
+    if error is None:
+        assert result.returncode == 0 and output.exists(), (name, options, result.returncode, result.stdout, result.stderr)
+        elf = output.read_bytes()
+        output.unlink()
+        return elf
+    assert result.returncode == 2 and error in result.stderr and not output.exists(), (
+        name, options, result.returncode, result.stdout, result.stderr)
+    return None
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    cases = [
+        ("plt-valid", fixture(linux=True), None),
+        ("rela-valid", fixture(linux=True, data_relocations=True), None),
+        ("rela-in-bss", with_bss(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
+        ("rela-in-relro", with_relro(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
+        ("jmprel-in-relro", with_relro(fixture(linux=True, target=0x1ff8)), None),
+        ("pc32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_PC32, target=0xFFC), None),
+        ("abs32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFC), None),
+        ("entry-outside", with_entry(fixture(linux=True), 0x7FFFF000),
+         "e_entry 0x7ffff000 is not inside an executable PT_LOAD segment"),
+        ("entry-not-executable", with_entry(with_bss(fixture(linux=True)), 0x1000),
+         "e_entry 0x1000 is not inside an executable PT_LOAD segment"),
+        ("rela-outside", fixture(linux=True, data_relocations=True, target=OUTSIDE),
+         "RELA r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
+        ("rela-past-load-end", fixture(linux=True, data_relocations=True, target=0xFFC),
+         "RELA r_offset 0xffc (8 bytes) does not fit inside a PT_LOAD segment"),
+        ("abs32-past-load-end", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFE),
+         "RELA r_offset 0xffe (4 bytes) does not fit inside a PT_LOAD segment"),
+        ("jmprel-outside", fixture(linux=True, target=OUTSIDE),
+         "JMPREL r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
+    ]
+    with tempfile.TemporaryDirectory(prefix="anyps5-linux-load-bounds-") as directory:
+        work = Path(directory)
+        for name, image, error in cases:
+            for options in ([], ["--lazy-binding"]):
+                relink(relinker, work, name, image, options, error)
+        for options, base in (([], FIXED_BASE), (["--lazy-binding"], 0)):
+            elf = relink(relinker, work, "entry-in-flagless-load", without_load_flags(fixture(linux=True)), options, None)
+            flags = load_flags_at(elf, base + ENTRY)
+            assert flags == [PF_R | PF_W | PF_X], ("entry-in-flagless-load", options, flags)
+        pltgot_cases = [
+            ("pltgot-outside", OUTSIDE, "DT_PLTGOT 0x2000 (8 bytes) does not fit inside a PT_LOAD segment",
+             "DT_PLTGOT 0x2000 (24 bytes) does not fit inside a PT_LOAD segment"),
+            ("pltgot-load-tail", 0xFF0, None, "DT_PLTGOT 0xff0 (24 bytes) does not fit inside a PT_LOAD segment"),
+            ("pltgot-lazy-fits", 0xFE8, None, None),
+        ]
+        for name, pltgot, eager_error, lazy_error in pltgot_cases:
+            image = with_pltgot(fixture(linux=True), pltgot)
+            relink(relinker, work, name, image, [], eager_error)
+            relink(relinker, work, name, image, ["--lazy-binding"], lazy_error)
+    print("Linux load bounds tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_linux_trace_imports.py b/core/relinker/relinker/tests/test_linux_trace_imports.py
index f8febde7c2..e9fb5f1cb6 100644
--- a/core/relinker/relinker/tests/test_linux_trace_imports.py
+++ b/core/relinker/relinker/tests/test_linux_trace_imports.py
@@ -80,7 +80,7 @@ def main():
         result = relink(relinker, source, case / "output.elf", "--trace-imports", "--lazy-binding")
         assert result.returncode != 0 and "--trace-imports conflicts with --lazy-binding" in result.stderr, (result.returncode, result.stderr)
         result = relink(relinker, source, case / "output", "--trace-imports", "--macos")
-        assert result.returncode != 0 and "--trace-imports cannot be used with --macos" in result.stderr, (result.returncode, result.stderr)
+        assert result.returncode == 2 and "--trace-imports requires libc.prx" in result.stderr, (result.returncode, result.stderr)
 
     print("Linux import tracing tests passed")
 
diff --git a/core/relinker/relinker/tests/test_macos_executable_exports.py b/core/relinker/relinker/tests/test_macos_executable_exports.py
index 3a8640e806..2b5b92c45e 100644
--- a/core/relinker/relinker/tests/test_macos_executable_exports.py
+++ b/core/relinker/relinker/tests/test_macos_executable_exports.py
@@ -155,11 +155,11 @@ def main():
             assert struct.unpack_from('<QQ', data, slot) == (meta['vmaddr'] + 0x20, 4)
         for name, symbols, tls, error in (
                 ('duplicate', SYMBOLS + (SYMBOLS[0],), False, 'Duplicate Mach-O export'),
-                ('unmapped', (('Unmapped', 0x12, 0, 1, 0x100000, 6),), False, 'not contained in PT_LOAD'),
+                ('unmapped', (('Unmapped', 0x12, 0, 1, 0x100000, 6),), False, 'does not fit inside an executable PT_LOAD segment'),
                 ('tls-outside', (('Tls', 0x16, 0, 1, 16, 1),), True, 'exceeds PT_TLS'),
                 ('tls-size', (('Tls', 0x16, 0, 1, 4, 13),), True, 'exceeds PT_TLS'),
-                ('tls-missing', tls_symbols, False, 'has no TLS block'),
-                ('reserved', (('Common', 0x11, 0, 0xFFF2, 0, 4),), False, 'Unsupported macOS executable export section'),
+                ('tls-missing', tls_symbols, False, 'has no PT_TLS segment'),
+                ('reserved', (('Common', 0x11, 0, 0xFFF2, 0, 4),), False, 'Unsupported executable export section'),
                 ('attributes', (('Indirect', 0x1A, 0, 1, 0x210, 6),), False, 'Unsupported macOS executable export attributes')):
             run, output = convert(relinker, work, name, executable(symbols, tls))
             assert run.returncode == 2 and error in run.stderr, (name, run.returncode, run.stderr)
diff --git a/core/relinker/relinker/tests/test_macos_gs_traps.py b/core/relinker/relinker/tests/test_macos_gs_traps.py
index de0426bc5f..62898f5176 100644
--- a/core/relinker/relinker/tests/test_macos_gs_traps.py
+++ b/core/relinker/relinker/tests/test_macos_gs_traps.py
@@ -26,6 +26,8 @@ FORMS = {
 
 NON_MEMORY_FORMS = {
     "gs-nop": bytes.fromhex("65 90"),
+    "gs-nop-memory": bytes.fromhex("65 0f 1f 05 11 11 11 11"),
+    "gs-lea": bytes.fromhex("65 8d 05 11 11 11 11"),
     "gs-register-move": bytes.fromhex("65 48 89 c8"),
     "gs-cpuid": bytes.fromhex("65 0f a2"),
     "gs-mwait": bytes.fromhex("65 0f 01 c9"),
@@ -54,6 +56,15 @@ def check_trapped(name, code, instruction):
         raise SystemExit(f"{name}: the GS access was left in the code")
 
 
+def check_refused(relinker, directory, name, body, message):
+    source = Path(directory) / f"{name}.elf"
+    source.write_bytes(bytes(make_image("register", "unwind", body=body)))
+    result = subprocess.run([str(relinker), "--macos", "--skip-sce-module", str(source), str(Path(directory) / name)],
+                            capture_output=True, text=True, timeout=60)
+    if result.returncode == 0 or message not in result.stdout + result.stderr:
+        raise SystemExit(f"{name}: expected the relinker to refuse with {message!r}: {result.stdout}{result.stderr}")
+
+
 def check_untouched(name, code, instruction):
     if instruction + b"\xc3" not in code:
         raise SystemExit(f"{name}: a non-memory GS instruction was replaced")
@@ -72,6 +83,8 @@ def main():
         image = make_image("register", "unwind", body=instruction + b"\xc3")
         struct.pack_into("<I", image, 176, 0)
         check_trapped("gs-without-pt-tls", convert(relinker, directory, "gs-without-pt-tls", image), instruction)
+        check_refused(relinker, directory, "branch-into-gs", bytes.fromhex("74 01 65 48 8b 0c 25 78 03 00 00 c3"),
+                      "Branch enters a guest GS instruction")
     print("macOS GS trap checks passed")
 
 
diff --git a/core/relinker/relinker/tests/test_macos_output.py b/core/relinker/relinker/tests/test_macos_output.py
index 694ed2e2eb..fd9407a851 100644
--- a/core/relinker/relinker/tests/test_macos_output.py
+++ b/core/relinker/relinker/tests/test_macos_output.py
@@ -114,8 +114,26 @@ def check_structure(name, data):
     return macho
 
 
+def check_main_entry_mxcsr(macho, data):
+    stub = data[macho.entryoff:]
+    setup = bytes.fromhex("4883ec100fae1c24c7442404c09f00000fae542404")
+    call = stub.find(bytes.fromhex("ff15"))
+    check(call >= len(setup), "entry stub does not initialize guest MXCSR before its start call")
+    check(stub[call - len(setup):call] == setup, "entry stub does not save host MXCSR and load guest MXCSR 0x9fc0")
+    entry = stub.find(bytes.fromhex("488d3d"))
+    entry_target = IMAGE_BASE + macho.entryoff + entry + 7 + struct.unpack_from("<i", stub, entry + 3)[0]
+    check(any(segment["initprot"] & PROT_EXEC and segment["vmaddr"] <= entry_target < segment["vmaddr"] + segment["vmsize"] for segment in macho.segments),
+          "entry stub does not point at executable guest code")
+    start_target = IMAGE_BASE + macho.entryoff + call + 6 + struct.unpack_from("<i", stub, call + 2)[0]
+    meta_segment = macho.segment("__APS5DATA")
+    check(meta_segment["vmaddr"] <= start_target < meta_segment["vmaddr"] + meta_segment["vmsize"], "entry stub start call does not point at its bound start slot")
+    restore = bytes.fromhex("0fae14244883c4100f0b")
+    check(stub[call + 6:call + 6 + len(restore)] == restore, "entry stub does not restore host MXCSR after the guest start call")
+
+
 def check_imports(data):
     macho = check_structure("import", data)
+    check_main_entry_mxcsr(macho, data)
     check("@rpath/libc.prx" in macho.dylibs, f"import: libc.prx is not a dependency: {macho.dylibs}")
     linkedit = macho.segment("__LINKEDIT")
     binds = data[linkedit["fileoff"]:linkedit["fileoff"] + linkedit["filesize"]]
diff --git a/core/relinker/relinker/tests/test_macos_trace_imports.py b/core/relinker/relinker/tests/test_macos_trace_imports.py
new file mode 100644
index 0000000000..182cc1f85e
--- /dev/null
+++ b/core/relinker/relinker/tests/test_macos_trace_imports.py
@@ -0,0 +1,102 @@
+"""--trace-imports passes each macOS function import through libc.prx's TraceImport_nid_no_patch before the guest entry."""
+
+import os
+from pathlib import Path
+import platform
+import subprocess
+import sys
+import tempfile
+
+from guest_import_fixtures import executable
+
+
+PROVIDER = "#include <unistd.h>\nint shared(void) { _exit(11); }\n"
+HOOK = ("#include <string.h>\n"
+        "#include <unistd.h>\n"
+        "static int replacement(void) { _exit(77); }\n"
+        "void* TraceImport_nid_no_patch(void* target, const char* name, const char* library) {\n"
+        "    if (((unsigned long)__builtin_frame_address(0) & 15) != 0) _exit(13);\n"
+        "    return strcmp(name, \"shared\") == 0 && strcmp(library, \"a.prx\") == 0 ? (void*)replacement : target;\n"
+        "}\n")
+PLAIN = "int Unrelated(void) { return 0; }\n"
+START = "void Aps5StartGuest_nid_no_patch(void (*entry)(void)) { entry(); }\n"
+
+
+def relink(relinker, source, output, *options):
+    return subprocess.run([str(relinker), "--macos", "--skip-sce-module", *options, str(source), str(output)],
+                          capture_output=True, text=True, timeout=30)
+
+
+def library(work, name, code):
+    source = work / (name + ".c")
+    source.write_text(code)
+    output = work / (name + ".dylib")
+    subprocess.run(["xcrun", "clang", "-arch", "x86_64", "-dynamiclib", str(source),
+                    "-Wl,-install_name,@rpath/" + name + ".prx", "-o", str(output)],
+                   check=True, capture_output=True, timeout=20)
+    return output.read_bytes()
+
+
+def run_binary(output):
+    command = (["/usr/bin/arch", "-x86_64"] if platform.machine() == "arm64" else []) + [str(output)]
+    return subprocess.run(command, capture_output=True, text=True, timeout=30)
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    runnable = sys.platform == "darwin" and platform.machine() in ("x86_64", "arm64")
+    with tempfile.TemporaryDirectory(prefix="anyps5-macos-trace-imports-") as directory:
+        work = Path(directory)
+        libraries = {}
+        if runnable:
+            libraries = {name: library(work, name, code) for name, code in (
+                ("a", PROVIDER), ("hook", HOOK), ("plain", PLAIN), ("libkernel", START))}
+
+        for name, options, libc, symbol_info, expected in (
+                ("untraced", (), "hook", 0x12, 11),
+                ("traced", ("--trace-imports",), "hook", 0x12, 77),
+                ("fixed-base", ("--trace-imports", "--macos-fixed-base", "0x400000"), "hook", 0x12, 77),
+                ("data", ("--trace-imports",), "hook", 0x11, 11),
+                ("weak", ("--trace-imports",), "hook", 0x22, 11),
+                ("unsupported", ("--trace-imports",), "plain", 0x12, None)):
+            case = work / name
+            case.mkdir()
+            image = executable("a.prx", extra_dependencies=("libc.prx",))
+            image[0x4898 + 4] = symbol_info
+            source = case / "input.elf"
+            source.write_bytes(image)
+            output = case / "output"
+            result = relink(relinker, source, output, *options)
+            assert result.returncode == 0, (name, result.stdout, result.stderr)
+            if not runnable:
+                continue
+            (case / "libs").mkdir()
+            (case / "libs" / "a.prx").write_bytes(libraries["a"])
+            (case / "libs" / "libc.prx").write_bytes(libraries[libc])
+            (case / "libs" / "libkernel.prx").write_bytes(libraries["libkernel"])
+            output.chmod(0o755)
+            run = run_binary(output)
+            if run.returncode != expected and "Bad CPU type in executable" in run.stderr:
+                assert os.environ.get("GITHUB_ACTIONS") != "true", "macOS CI must execute the x86_64 import trace"
+                runnable = False
+                continue
+            if expected is None:
+                assert run.returncode != 0 and "TraceImport_nid_no_patch" in run.stderr, (name, run.returncode, run.stdout, run.stderr)
+            else:
+                assert run.returncode == expected, (name, run.returncode, run.stdout, run.stderr)
+
+        case = work / "without-libc"
+        case.mkdir()
+        source = case / "input.elf"
+        source.write_bytes(executable("a.prx"))
+        result = relink(relinker, source, case / "output", "--trace-imports")
+        assert result.returncode == 2 and "--trace-imports requires libc.prx" in result.stderr, (result.returncode, result.stderr)
+        assert not (case / "output").exists()
+        result = relink(relinker, source, case / "output", "--trace-imports", "--lazy-binding")
+        assert result.returncode != 0 and "--trace-imports conflicts with --lazy-binding" in result.stderr, (result.returncode, result.stderr)
+
+    print("macOS import tracing tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_needed_libraries.py b/core/relinker/relinker/tests/test_needed_libraries.py
index 9bf39efb8f..06a4ddb1d5 100644
--- a/core/relinker/relinker/tests/test_needed_libraries.py
+++ b/core/relinker/relinker/tests/test_needed_libraries.py
@@ -6,15 +6,15 @@ import sys
 import tempfile
 
 from test_guest_intel_trampolines import PLAIN_SITE, guest_fixture
-from test_guest_symbol_names import importing_executable
+from test_guest_symbol_names import DYNAMIC, RELOCATIONS, STRINGS, SYMBOLS, importing_executable
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[4] / "tools"))
 import import_audit
 
 
-def named_module(tag):
+def named_module(tag, name="Party.prx"):
     image = guest_fixture(PLAIN_SITE)
-    strings = b"\0Party.prx\0"
+    strings = b"\0" + name.encode() + b"\0"
     image[0x800:0x800 + len(strings)] = strings
     struct.pack_into("<Q", image, 0x618, len(strings))
     struct.pack_into("<qQqQ", image, 0x680, tag, 1, 0, 0)
@@ -30,10 +30,56 @@ def executable_with_dependencies(libraries):
     return image
 
 
+def executable_needing(name):
+    image = importing_executable([])
+    strings = b"\0" + name.encode() + b"\0"
+    image[STRINGS:STRINGS + len(strings)] = strings
+    tags = [(1, 1), (5, STRINGS), (10, len(strings)), (6, SYMBOLS), (11, 24),
+            (7, RELOCATIONS), (8, 0), (9, 24), (0, 0)]
+    for index, tag in enumerate(tags):
+        struct.pack_into("<qQ", image, DYNAMIC + index * 16, *tag)
+    struct.pack_into("<QQ", image, 152, len(tags) * 16, len(tags) * 16)
+    return image
+
+
+def dependency_names(relinker, work):
+    names = ("Party.prx", "", "$LIB.prx", "$ORIGIN/x.prx", "a:b.prx", "a\\b.prx", "a\nb.prx", "a\rb.prx")
+    for index, name in enumerate(names):
+        source = work / f"dependency-{index}.elf"
+        source.write_bytes(executable_needing(name))
+        for target, flags in enumerate(([], ["--lazy-binding"], ["--windows"], ["--macos"])):
+            output = work / f"dependency-{index}-{target}.out"
+            result = subprocess.run([str(relinker), "--skip-sce-module", *flags, str(source), str(output)],
+                                    capture_output=True, timeout=20)
+            stderr = result.stderr.replace(b"\r\n", b"\n")
+            if index == 0:
+                assert result.returncode == 0 and output.is_file(), (flags, result.stdout, stderr)
+                continue
+            expected = f"FAIL: Invalid dependency: {name} (offset {STRINGS + 1:#x})\n".encode()
+            assert result.returncode == 2 and stderr.startswith(expected) and not output.exists(), (
+                name, flags, result.returncode, stderr)
+
+
+def slash_dependency(relinker, work):
+    for target, flags in enumerate(([], ["--windows"], ["--macos"])):
+        case = work / f"slash-{target}"
+        modules = case / "sce_module"
+        modules.mkdir(parents=True)
+        (modules / "engine.prx").write_bytes(named_module(14, "dir/Party.prx"))
+        source = case / "input.elf"
+        source.write_bytes(executable_needing("dir/Party.prx"))
+        output = case / "output.out"
+        result = subprocess.run([str(relinker), *flags, str(source), str(output)],
+                                capture_output=True, timeout=20)
+        assert result.returncode == 0 and output.is_file(), (flags, result.stdout, result.stderr)
+
+
 def main():
     relinker = Path(sys.argv[1]).resolve()
     with tempfile.TemporaryDirectory(prefix="anyps5-needed-libraries-") as directory:
         work = Path(directory)
+        dependency_names(relinker, work)
+        slash_dependency(relinker, work)
         for windows in (False, True):
             for bundled in (False, True):
                 case = work / f"{windows}-{bundled}"
diff --git a/core/relinker/relinker/tests/test_none_relocations.py b/core/relinker/relinker/tests/test_none_relocations.py
index ca10af8fd0..d541f0a9c5 100644
--- a/core/relinker/relinker/tests/test_none_relocations.py
+++ b/core/relinker/relinker/tests/test_none_relocations.py
@@ -127,16 +127,39 @@ def main():
         assert overflow_result.returncode == 2 and "Relocation target address overflow" in overflow_result.stderr, overflow_result.stderr
         assert not overflow_output.exists()
         page_image = image_with_relocations([(0xffc, 8, 0x210)], False, False)
+        page_image[0x200:0x206] = b"\xff\x25" + struct.pack("<i", 0xffc - 0x206)
         page_image.extend(bytes(0x1000))
         struct.pack_into("<QQ", page_image, 64 + 32, len(page_image), len(page_image))
-        page_source = work / "invalid-base-relocation-page-crossing.elf"
+        page_source = work / "base-relocation-page-crossing.elf"
         page_source.write_bytes(page_image)
-        page_output = work / "invalid-base-relocation-page-crossing.exe"
+        page_output = work / "base-relocation-page-crossing.exe"
         page_result = subprocess.run([str(relinker), "--skip-sce-module", "--windows",
                                       str(page_source), str(page_output)],
                                      capture_output=True, text=True, timeout=20)
-        assert page_result.returncode == 2 and "Base relocation target crosses a page boundary" in page_result.stderr, page_result.stderr
-        assert not page_output.exists()
+        assert page_result.returncode == 0 and page_output.read_bytes().startswith(b"MZ"), page_result.stderr
+        if os.name == "nt":
+            run = subprocess.run([str(page_output)], capture_output=True, timeout=20)
+            assert run.returncode == 42, ("page-crossing relocation", run.returncode, run.stderr)
+            moved = bytearray(page_output.read_bytes())
+            optional_header = struct.unpack_from("<I", moved, 0x3c)[0] + 24
+            characteristics = struct.unpack_from("<H", moved, optional_header + 70)[0]
+            struct.pack_into("<H", moved, optional_header + 70, characteristics | 0x40)
+            moved_output = work / "base-relocation-page-crossing-moved.exe"
+            moved_output.write_bytes(moved)
+            for _ in range(3):
+                run = subprocess.run([str(moved_output)], capture_output=True, timeout=20)
+                assert run.returncode == 42, ("page-crossing relocation after the loader moved the image", run.returncode, run.stderr)
+        past_end_image = image_with_relocations([(0x1ffc, 8, 0x210)], False, False)
+        past_end_image.extend(bytes(0x1000))
+        struct.pack_into("<QQ", past_end_image, 64 + 32, len(past_end_image), len(past_end_image))
+        past_end_source = work / "invalid-base-relocation-past-end.elf"
+        past_end_source.write_bytes(past_end_image)
+        past_end_output = work / "invalid-base-relocation-past-end.exe"
+        past_end_result = subprocess.run([str(relinker), "--skip-sce-module", "--windows",
+                                          str(past_end_source), str(past_end_output)],
+                                         capture_output=True, text=True, timeout=20)
+        assert past_end_result.returncode == 2 and "ELF address is not contained in PT_LOAD memory" in past_end_result.stderr, past_end_result.stderr
+        assert not past_end_output.exists()
     print("No-op executable relocation tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_output_collisions.py b/core/relinker/relinker/tests/test_output_collisions.py
index 4213674c46..0361c30544 100644
--- a/core/relinker/relinker/tests/test_output_collisions.py
+++ b/core/relinker/relinker/tests/test_output_collisions.py
@@ -50,6 +50,93 @@ def case_sensitive(directory):
     return sensitive
 
 
+def metadata_case(case, windows):
+    command, outputs, inputs = prepare(case, windows)
+    metadata = case / "sce_sys"
+    metadata.mkdir(exist_ok=True)
+    icon = metadata / "icon0.png"
+    param = metadata / "param.json"
+    icon.write_bytes(png(1, 1))
+    param.write_text(json.dumps({"titleId": "PPSA00000", "defaultLanguage": "en-US",
+                                "localizedParameters": {"en-US": {"titleName": "Sample Title"}}}), encoding="utf-8")
+    for path in outputs.values():
+        path.write_bytes(b"previous output")
+    inputs.update({icon: icon.read_bytes(), param: param.read_bytes()})
+    return command, outputs, inputs
+
+
+def tree_snapshot(root):
+    return {path.relative_to(root): ("link", os.readlink(path)) if path.is_symlink()
+            else ("directory", None) if path.is_dir() else ("file", path.read_bytes())
+            for path in root.rglob("*")}
+
+
+def metadata_inputs(relinker, work):
+    checked = 0
+
+    def rejected(case, command):
+        before = tree_snapshot(case)
+        result = subprocess.run([str(relinker), *command], cwd=case,
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        assert result.returncode == 2 and "output would overwrite input metadata" in result.stderr, (
+            case.name, result.returncode, result.stdout, result.stderr)
+        assert tree_snapshot(case) == before, case
+
+    for windows in (False, True):
+        for name in (("icon0.png",) if windows else ("icon0.png", "param.json")):
+            case = work / f"metadata-direct-{windows}-{name}"
+            command, _, _ = metadata_case(case, windows)
+            rejected(case, [*command[:-1], str(case / "sce_sys" / name)])
+            checked += 1
+            outputs = ("executable", "module", "registry", "module-registry", "needed", "module-needed")
+            outputs += ("diagnostics",) if windows else ("icon", "desktop")
+            for alias in ("hardlink", "symlink"):
+                for output in outputs:
+                    case = work / f"metadata-{windows}-{name}-{alias}-{output}"
+                    command, paths, _ = metadata_case(case, windows)
+                    destination = paths[output]
+                    destination.unlink()
+                    metadata = case / "sce_sys" / name
+                    if alias == "hardlink":
+                        os.link(metadata, destination)
+                    else:
+                        try:
+                            destination.symlink_to(metadata)
+                        except (OSError, NotImplementedError) as error:
+                            print(f"Metadata symlink case skipped: {error}")
+                            continue
+                    rejected(case, command)
+                    checked += 1
+        case = work / f"metadata-distinct-{windows}"
+        command, paths, inputs = metadata_case(case, windows)
+        result = subprocess.run([str(relinker), *command], cwd=case,
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        assert result.returncode == 0, (result.stdout, result.stderr)
+        for path, original in inputs.items():
+            assert path.read_bytes() == original, path
+        assert paths["executable"].read_bytes().startswith(b"MZ" if windows else b"\x7fELF")
+
+    for format, name in (("windows", "param.json"), ("macos", "icon0.png"), ("linux-no-icon", "param.json")):
+        case = work / f"metadata-unused-{format}"
+        command, _, inputs = metadata_case(case, format == "windows")
+        if format == "macos":
+            command.insert(0, "--macos")
+        if format == "linux-no-icon":
+            icon = case / "sce_sys/icon0.png"
+            icon.unlink()
+            inputs.pop(icon)
+        output = case / "sce_sys" / name
+        result = subprocess.run([str(relinker), *command[:-1], str(output)], cwd=case,
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        assert result.returncode == 0, (format, result.stdout, result.stderr)
+        magic = b"MZ" if format == "windows" else b"\xcf\xfa\xed\xfe" if format == "macos" else b"\x7fELF"
+        assert output.read_bytes().startswith(magic), output
+        for path, original in inputs.items():
+            if path != output:
+                assert path.read_bytes() == original, path
+    return checked
+
+
 def filesystem_aliases(relinker, work):
     if os.name == "nt":
         return
@@ -91,6 +178,7 @@ def main():
     checked = 0
     with tempfile.TemporaryDirectory(prefix="anyps5-output-collisions-") as directory:
         work = Path(directory)
+        metadata_checked = metadata_inputs(relinker, work)
         filesystem_aliases(relinker, work)
         for windows, existing in itertools.product((False, True), repeat=2):
             case = work / f"needed-secondary-{windows}-{existing}"
@@ -213,7 +301,7 @@ def main():
                 assert not list(case.rglob(".anyps5-output-identity-*"))
             finally:
                 output.chmod(stat.S_IWRITE)
-    print(f"Output collision tests passed: {checked} hard-link pairs, direct paths, and identity controls")
+    print(f"Output collision tests passed: {checked} hard-link pairs, {metadata_checked} metadata protections, direct paths, and identity controls")
 
 
 if __name__ == "__main__":
diff --git a/core/relinker/relinker/tests/test_patch_advisor.py b/core/relinker/relinker/tests/test_patch_advisor.py
new file mode 100644
index 0000000000..f31bbd882c
--- /dev/null
+++ b/core/relinker/relinker/tests/test_patch_advisor.py
@@ -0,0 +1,71 @@
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+from test_game_patches import patch_site, patch_text
+from test_guest_intel_trampolines import main_fixture
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    advisor = Path(__file__).resolve().parents[4] / "tools" / "suggest_patches.py"
+    image = bytes(main_fixture())
+    address, expected = patch_site(image)
+    with tempfile.TemporaryDirectory(prefix="anyps5-patch-advisor-") as directory:
+        root = Path(directory)
+        source = root / "eboot.bin"
+        source.write_bytes(image)
+        catalog = root / "catalog"
+        catalog.mkdir()
+        patch = catalog / "patch.toml"
+        patch.write_text(patch_text(address, expected, "flip_bit"))
+        metadata = root / "param.json"
+        metadata.write_text(json.dumps({"titleId": "TEST00001", "contentVersion": "01.000.000"}))
+
+        def advise(digest, patches=("patch.toml",), *options):
+            (catalog / "index.json").write_text(json.dumps({"format": 1, "entries": [{
+                "titleId": "TEST00001", "contentVersion": "01.000.000", "patch": name,
+                "targets": {"eboot.bin": digest}
+            } for name in patches]}))
+            return subprocess.run([sys.executable, str(advisor), "--catalog", str(catalog),
+                                   "--param-json", str(metadata), "--input", str(source),
+                                   "--relinker", f"./{relinker.name}", "--skip-sce-module", *options],
+                                  cwd=relinker.parent, capture_output=True, text=True, timeout=30)
+
+        digest = hashlib.sha256(image).hexdigest()
+        result = advise(digest)
+        assert result.returncode == 0 and f"Recommended: {patch}" in result.stdout, (result.stdout, result.stderr)
+        second = catalog / "second patch.toml"
+        second.write_text(patch_text(address, expected, "flip_bit"))
+        result = advise(digest, ("patch.toml", second.name))
+        assert result.returncode == 1 and "multiple verified catalog entries match; use --list-verified to see them" in result.stdout, (result.stdout, result.stderr)
+        result = advise(digest, ("patch.toml", second.name), "--list-verified")
+        assert result.returncode == 0 and "Verified catalog entries: 2" in result.stdout, (result.stdout, result.stderr)
+        assert "Choose one patch file; listed entries are not combined." in result.stdout, (result.stdout, result.stderr)
+        assert f"Catalog entry 1: {patch}" in result.stdout and f"Catalog entry 2: {second}" in result.stdout, (result.stdout, result.stderr)
+        assert "Recommended:" not in result.stdout, (result.stdout, result.stderr)
+        assert source.read_bytes() == image
+        broken = catalog / "broken.toml"
+        broken.write_text(patch_text(address, expected, "broken").replace('description = "flip one bit"',
+                                                                     r'description = "flip \"one\" bit"'))
+        result = advise(digest, ("broken.toml", "patch.toml"))
+        assert result.returncode == 0 and "relinker error (exit 2)" in result.stdout and f"Recommended: {patch}" in result.stdout, (result.stdout, result.stderr)
+        result = advise(digest, ("broken.toml", "patch.toml"), "--list-verified")
+        assert result.returncode == 0 and "relinker error (exit 2)" in result.stdout and "Verified catalog entries: 1" in result.stdout, (result.stdout, result.stderr)
+        result = advise(digest, ("broken.toml",), "--list-verified")
+        assert result.returncode == 2 and "relinker error (exit 2)" in result.stdout, (result.stdout, result.stderr)
+        patch.write_text(patch_text(address, expected ^ 1, "wrong_byte"))
+        result = advise(digest)
+        assert result.returncode == 1 and "rejected by relinker" in result.stdout, (result.stdout, result.stderr)
+        result = advise(digest, ("patch.toml",), "--list-verified")
+        assert result.returncode == 1 and "rejected by relinker" in result.stdout and "Catalog entry 1:" not in result.stdout, (result.stdout, result.stderr)
+        patch.write_text(patch_text(address, expected, "flip_bit"))
+        result = advise(hashlib.sha256(b"other build").hexdigest())
+        assert result.returncode == 1 and "SHA-256 mismatch" in result.stdout, (result.stdout, result.stderr)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_rela_size.py b/core/relinker/relinker/tests/test_rela_size.py
index d010e23814..9d7bd5d6e8 100644
--- a/core/relinker/relinker/tests/test_rela_size.py
+++ b/core/relinker/relinker/tests/test_rela_size.py
@@ -7,6 +7,24 @@ import tempfile
 from test_dynamic_segment import fixture
 
 
+def output_tags(output):
+    data = output.read_bytes()
+    header_offset = struct.unpack_from("<Q", data, 32)[0]
+    header_size, header_count = struct.unpack_from("<HH", data, 54)
+    dynamic = next(struct.unpack_from("<IIQQQQQQ", data, header_offset + index * header_size)
+                   for index in range(header_count)
+                   if struct.unpack_from("<I", data, header_offset + index * header_size)[0] == 2)
+    return dict(struct.unpack_from("<QQ", data, offset)
+                for offset in range(dynamic[2], dynamic[2] + dynamic[5], 16))
+
+
+def with_entries(image, *entries):
+    for index, entry in enumerate((*entries, (0, 0))):
+        struct.pack_into("<qQ", image, 0x470 + index * 16, *entry)
+    struct.pack_into("<QQ", image, 120 + 32, 0x80 + len(entries) * 16, 0x80 + len(entries) * 16)
+    return image
+
+
 def main():
     relinker = Path(sys.argv[1]).resolve()
     failures = []
@@ -29,15 +47,7 @@ def main():
                         magic = b"MZ" if mode else b"\x7fELF"
                         valid = result.returncode == 0 and output.exists() and output.read_bytes().startswith(magic)
                         if valid and not mode:
-                            data = output.read_bytes()
-                            header_offset = struct.unpack_from("<Q", data, 32)[0]
-                            header_size, header_count = struct.unpack_from("<HH", data, 54)
-                            dynamic = next(struct.unpack_from("<IIQQQQQQ", data, header_offset + index * header_size)
-                                           for index in range(header_count)
-                                           if struct.unpack_from("<I", data, header_offset + index * header_size)[0] == 2)
-                            tags = dict(struct.unpack_from("<QQ", data, offset)
-                                        for offset in range(dynamic[2], dynamic[2] + dynamic[5], 16))
-                            valid = tags.get(8, 0) == size
+                            valid = output_tags(output).get(8, 0) == size
                     if not valid:
                         failures.append((tag, size, mode, result.returncode, result.stdout, result.stderr))
 
@@ -72,6 +82,48 @@ def main():
             if struct.unpack_from("<q", both_rela_image, offset)[0] == 9:
                 struct.pack_into("<q", both_rela_image, offset, 0x6100002F)
         verify_failure("both-rela-variants", both_rela_image, "Both DT_OS_ and DT_ variants present for DT_RELA")
+
+        def relink(name, image, options):
+            source = work / f"{name}.elf"
+            output = work / f"{name}.out"
+            source.write_bytes(image)
+            result = subprocess.run([str(relinker), "--skip-sce-module", *options, str(source), str(output)],
+                                    capture_output=True, text=True, timeout=20)
+            return result, output
+
+        targets = ([], ["--lazy-binding"], ["--windows"], ["--macos"])
+        for name, tag, slot, first, second in (("DT_RELASZ", 8, 0x450, 0, 24), ("DT_RELASZ", 8, 0x450, 24, 0),
+                                               ("DT_OS_RELASZ", 0x61000031, 0x450, 0, 24),
+                                               ("DT_STRTAB", 5, 0x400, 0x600, 0x700)):
+            image = fixture()
+            struct.pack_into("<qQ", image, slot, tag, first)
+            with_entries(image, (tag, second))
+            for index, options in enumerate((*targets, ["unused-filter=1"])):
+                case = f"conflicting-{tag:x}-{first:x}-{index}"
+                result, output = relink(case, image, options)
+                lines = [line for line in result.stderr.splitlines() if line.startswith("FAIL: ")]
+                if result.returncode != 2 or lines != [f"FAIL: Conflicting duplicate {name} tags"] or output.exists():
+                    failures.append((case, result.returncode, result.stdout, result.stderr))
+
+        same = with_entries(fixture(), (8, 24))
+        for index, options in enumerate(targets):
+            result, output = relink(f"same-relasz-{index}", same, options)
+            if options in (["--windows"], ["--macos"]):
+                valid = (result.returncode == 2 and "Code analysis: duplicate dynamic tag" in result.stderr
+                         and not output.exists())
+            else:
+                valid = result.returncode == 0 and output.exists() and output_tags(output).get(8, 0) == 24
+            if not valid:
+                failures.append(("same-relasz", options, result.returncode, result.stdout, result.stderr))
+
+        needed = fixture()
+        needed[0x600:0x613] = b"\0liba.prx\0libb.prx\0"
+        struct.pack_into("<qQ", needed, 0x410, 10, 19)
+        with_entries(needed, (1, 1), (1, 10))
+        for index, (options, magic) in enumerate(zip(targets, (b"\x7fELF", b"\x7fELF", b"MZ", b"\xcf\xfa\xed\xfe"))):
+            result, output = relink(f"repeated-needed-{index}", needed, options)
+            if result.returncode != 0 or not output.exists() or not output.read_bytes().startswith(magic):
+                failures.append(("repeated-needed", options, result.returncode, result.stdout, result.stderr))
     if failures:
         raise AssertionError(failures)
     print("RELA size tests passed")
diff --git a/core/relinker/relinker/tests/test_sce_code_extent.py b/core/relinker/relinker/tests/test_sce_code_extent.py
index 1f58fb585e..e7dafe53c9 100644
--- a/core/relinker/relinker/tests/test_sce_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_code_extent.py
@@ -26,17 +26,22 @@ UNSUPPORTED_TLS = bytes.fromhex("64 2d 65 6c 66 2e c3")
 INVALID = bytes.fromhex("41 41 41 41 41 41 66 66 66 66 2e 0f 1f 84 00 00 00 00 00")
 TLS_LOAD = bytes.fromhex("64 48 8b 04 25 00 00 00 00 c3")
 FS_SUBTRACT = bytes.fromhex("64 2d 65 6c 66 2e")
+LATER_FUNCTION = 0x300
 
 
 def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False, data_pointer=False, gap_entry=False,
             plt_at=None, early_function=False, function_tls=False, pointer_target=None, gap_bytes=None, functions=None,
-            tls=False):
-    plt = FUNCTION + FUNCTION_SIZE + gap if plt_at is None else plt_at
+            tls=False, gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False,
+            gap_decoded_padding_syscall=False, gap_stub_then_data=False):
+    has_gap_embedded = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall or gap_stub_then_data
+    plt = (LATER_FUNCTION + FUNCTION_SIZE + gap if has_gap_embedded else FUNCTION + FUNCTION_SIZE + gap) if plt_at is None else plt_at
     entry = FUNCTION + FUNCTION_SIZE if gap_entry else FUNCTION
     data = plt + 0x20 if plt > FUNCTION else FUNCTION + FUNCTION_SIZE
     if functions is None:
         functions = [(EARLY_FUNCTION, FUNCTION_SIZE)] if early_function else []
         functions.append((FUNCTION, FUNCTION_SIZE))
+        if has_gap_embedded:
+            functions.append((LATER_FUNCTION, FUNCTION_SIZE))
     interpreter = FUNCTION - len(INTERPRETER)
     image = bytearray(0x1000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
@@ -44,10 +49,10 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
     struct.pack_into("<HHIQQQIHHHHHH", image, 16, 3, 62, 1, entry, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
     tags = [
         (1, 1),
-        (0x61000035, 0x600), (0x61000037, 16),
-        (0x61000039, 0x620), (0x6100003B, 24), (0x6100003F, 48),
-        (0x6100002F, 0x700), (0x61000031, 24 if interpreter_pointer or pointer_target is not None else 0), (0x61000033, 24),
-        (0x61000027, GOT), (0x61000029, 0x720), (0x6100002B, 7), (0x6100002D, 24),
+        (0x61000035 if sce_block else 5, 0x600), (0x61000037 if sce_block else 10, 16),
+        (0x61000039 if sce_block else 6, 0x620), (0x6100003B if sce_block else 11, 24), (0x6100003F, 48),
+        (0x6100002F if sce_block else 7, 0x700), (0x61000031 if sce_block else 8, 24 if interpreter_pointer or pointer_target is not None else 0), (0x61000033 if sce_block else 9, 24),
+        (0x61000027 if sce_block else 3, GOT), (0x61000029 if sce_block else 23, 0x720), (0x6100002B, 7), (0x6100002D if sce_block else 2, 24),
         (0, 0),
     ]
     struct.pack_into("<IIQQQQQQ", image, 64, PT_LOAD, 7, 0, 0, 0, len(image), len(image), 0x1000)
@@ -73,7 +78,8 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
 
     for begin, size in functions:
         image[begin:begin + size] = b"\xc3" + b"\x90" * (size - 1)
-    image[FUNCTION + FUNCTION_SIZE:plt] = b"\x90" * gap
+    last_func = LATER_FUNCTION if has_gap_embedded else FUNCTION
+    image[last_func + FUNCTION_SIZE:plt] = b"\x90" * gap
     image[plt:plt + 2] = b"\xff\x35"
     struct.pack_into("<i", image, plt + 2, GOT + plt_push_offset - (plt + 6))
     image[plt + 6:plt + 8] = b"\xff\x25"
@@ -98,6 +104,28 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
         image[entry:entry + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
     if function_tls:
         image[FUNCTION:FUNCTION + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
+    if gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall or gap_stub_then_data:
+        table = FUNCTION + FUNCTION_SIZE + 0x10
+        image[FUNCTION:FUNCTION + 3] = b"\x48\x8d\x05"
+        struct.pack_into("<iB", image, FUNCTION + 3, table - (FUNCTION + 7), 0xC3)
+        image[FUNCTION + FUNCTION_SIZE:table] = b"\xcc" * 0x10
+        if gap_data_then_syscall:
+            image[table:table + 6] = b"\x0f\x78\x11\x22\x33\x44"
+            image[table + 6:table + 16] = b"\xcc" * 10
+            image[table + 16:table + 24] = b"\xb8\x3b\x00\x00\x00\x0f\x05\xc3"
+            image[table + 24:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 24))
+        elif gap_callback_syscall_undecodable:
+            image[table:table + 14] = b"\xb8\x3b\x00\x00\x00\x0f\x05\x0f\x78\x11\x22\x33\x44\xc3"
+            image[table + 14:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 14))
+        elif gap_decoded_padding_syscall:
+            image[table:table + 13] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\x00\x01\x90"
+            image[table + 13:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 13))
+        elif gap_stub_then_data:
+            image[table:table + 15] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\xc3\x0f\x78\x33\x1e"
+            image[table + 15:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 15))
+        else:
+            image[table:LATER_FUNCTION] = b"\x0f\x78\x33\x1e" * ((LATER_FUNCTION - table) // 4)
+        image[data:data + 0x30] = b"\x90" * 0x30
 
     cie = EH_FRAME
     cie_body = b"\x00\x00\x00\x00\x01zR\x00\x01\x78\x10\x01\x1b\x00\x00\x00"
@@ -215,6 +243,21 @@ def main():
                 fixture(plt_at=PLT_BEFORE_CODE, early_function=True), target=target)
             run(relinker, work, "sce-code-after-plt-" + target, fixture(plt_at=PLT_BEFORE_CODE, function_tls=True),
                 "Unsupported " + ("Windows" if target == "windows" else "macOS") + " guest TLS instruction", target)
+            run(relinker, work, "sce-gap-embedded-data-" + target,
+                fixture(sce_block=True, gap_embedded_data=True), target=target)
+            run(relinker, work, "sysv-gap-embedded-data-" + target,
+                fixture(sce_block=False, gap_embedded_data=True), target=target)
+            for name, sce_block in (("sce", True), ("sysv", False)):
+                run(relinker, work, name + "-gap-decoded-padding-syscall-" + target,
+                    fixture(sce_block=sce_block, gap_decoded_padding_syscall=True),
+                    "Forbidden syscall instruction", target=target)
+                run(relinker, work, name + "-gap-stub-then-data-" + target,
+                    fixture(sce_block=sce_block, gap_stub_then_data=True),
+                    "Forbidden syscall instruction", target=target)
+            run(relinker, work, "gap-data-then-syscall-" + target,
+                fixture(sce_block=False, gap_data_then_syscall=True), "Forbidden syscall instruction", target=target)
+            run(relinker, work, "gap-callback-syscall-" + target,
+                fixture(sce_block=False, gap_callback_syscall_undecodable=True), "Forbidden syscall instruction", target=target)
         run(relinker, work, "sce-tls-rewrite-over-lea-target", entry_overlap_fixture(),
             "TLS rewrite would overwrite an executable entry point (offset 0x304)")
     print("SCE code extent tests passed")
diff --git a/core/relinker/relinker/tests/test_sce_module_code_extent.py b/core/relinker/relinker/tests/test_sce_module_code_extent.py
index 9395a04db3..b2d52622cd 100644
--- a/core/relinker/relinker/tests/test_sce_module_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_module_code_extent.py
@@ -100,15 +100,31 @@ def unwind_table(text, base, function, size, header, frame):
                      frame - (header + 4), 1, function - header, fde - header)
 
 
-def sce_module():
+def unwind_table_multiple(text, base, functions, header, frame):
+    cie_body = b"\x00\x00\x00\x00\x01zR\x00\x01\x78\x10\x01\x1b\x00\x00\x00"
+    struct.pack_into("<I", text, frame - base, len(cie_body))
+    text[frame - base + 4:frame - base + 4 + len(cie_body)] = cie_body
+    fde = frame + 4 + len(cie_body)
+    struct.pack_into("<BBBBiI", text, header - base, 1, 0x1B, 0x03, 0x3B,
+                     frame - (header + 4), len(functions))
+    for index, (func_addr, func_size) in enumerate(functions):
+        struct.pack_into("<IIiiB3x", text, fde - base, 16, fde + 4 - frame, func_addr - (fde + 8), func_size, 0)
+        struct.pack_into("<ii", text, header - base + 12 + index * 8, func_addr - header, fde - header)
+        fde += 20
+    struct.pack_into("<I", text, fde - base, 0)
+
+
+def sce_module(gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False,
+               gap_decoded_padding_syscall=False, gap_stub_then_data=False):
     image = bytearray(0xC00)
     tags = [(0x61000035, 0), (0x61000037, 1), (0x61000039, 0x20), (0x6100003B, 24), (0x6100003F, 24), (0, 0)]
+    has_gap = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall or gap_stub_then_data
     headers = [
         (PT_LOAD, 5, 0x400, 0x1000, 0x100, 0x100, 0x100),
         (PT_LOAD, 6, 0x600, 0x2000, 0x400, 0x400, 0x100),
         (PT_DYNAMIC, 6, 0x600, 0x2000, len(tags) * 16, len(tags) * 16, 8),
         (PT_SCE_DYNLIBDATA, 4, 0xA00, 0, 0x200, 0, 0x10),
-        (PT_GNU_EH_FRAME, 4, 0x480, 0x1080, 20, 20, 4),
+        (PT_GNU_EH_FRAME, 4, 0x480, 0x1080, 48 if has_gap else 20, 48 if has_gap else 20, 4),
     ]
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16, 3, 62, 1, 0x1000, 64, 0, 0, 64, 56, len(headers), 64, 0, 0)
@@ -117,21 +133,47 @@ def sce_module():
     for index, tag in enumerate(tags):
         struct.pack_into("<qQ", image, 0x600 + index * 16, *tag)
     text = memoryview(image)[0x400:0x500]
-    text[0:FUNCTION_SIZE] = b"\xc3" + b"\x90" * (FUNCTION_SIZE - 1)
-    text[0x20:0x22] = b"\x0f\x05"
-    unwind_table(text, 0x1000, 0x1000, FUNCTION_SIZE, 0x1080, 0x10A0)
+    if has_gap:
+        text[0:8] = b"\x48\x8d\x05\x19\x00\x00\x00\xc3"
+        table = 0x20
+        if gap_data_then_syscall:
+            text[table:table + 6] = b"\x0f\x78\x11\x22\x33\x44"
+            text[table + 6:table + 16] = b"\xcc" * 10
+            text[table + 16:table + 24] = b"\xb8\x3b\x00\x00\x00\x0f\x05\xc3"
+            text[table + 24:0x40] = b"\x90" * 8
+        elif gap_callback_syscall_undecodable:
+            text[table:table + 14] = b"\xb8\x3b\x00\x00\x00\x0f\x05\x0f\x78\x11\x22\x33\x44\xc3"
+            text[table + 14:0x40] = b"\x90" * 18
+        elif gap_decoded_padding_syscall:
+            text[table:table + 13] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\x00\x01\x90"
+            text[table + 13:0x40] = b"\x90" * (0x40 - (table + 13))
+        elif gap_stub_then_data:
+            text[table:table + 15] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\xc3\x0f\x78\x33\x1e"
+            text[table + 15:0x40] = b"\x90" * (0x40 - (table + 15))
+        else:
+            text[table:0x40] = b"\x0f\x78\x33\x1e" * 8
+        text[0x40:0x48] = b"\xc3" + b"\x90" * 7
+        unwind_table_multiple(text, 0x1000, [(0x1000, 8), (0x1040, 8)], 0x1080, 0x10A0)
+    else:
+        text[0:FUNCTION_SIZE] = b"\xc3" + b"\x90" * (FUNCTION_SIZE - 1)
+        text[0x20:0x22] = b"\x0f\x05"
+        unwind_table(text, 0x1000, 0x1000, FUNCTION_SIZE, 0x1080, 0x10A0)
     return image
 
 
-def run_module(relinker, work, name, module, flags):
+def run_module(relinker, work, name, module, flags, expected_error=None):
     case = work / name
     (case / "sce_module").mkdir(parents=True)
     (case / "input.elf").write_bytes(importing_executable([]))
     (case / "sce_module" / "libExample.prx").write_bytes(module)
     result = subprocess.run([str(relinker), *flags, str(case / "input.elf"), str(case / "output.exe")],
                             capture_output=True, text=True, timeout=30)
-    assert result.returncode == 0 and (case / "app0" / "sce_module" / "libExample.prx.guest.prx").exists(), (
-        name, result.stdout, result.stderr)
+    if expected_error is None:
+        assert result.returncode == 0 and (case / "app0" / "sce_module" / "libExample.prx.guest.prx").exists(), (
+            name, result.stdout, result.stderr)
+    else:
+        assert result.returncode == 2 and expected_error in result.stderr, (
+            name, result.returncode, result.stdout, result.stderr)
 
 
 def run(relinker, work, name, image, flags, expected_error=None):
@@ -154,6 +196,11 @@ def main():
         for system, flags in (("linux", []), ("windows", ["--windows"]), ("macos", ["--macos"])):
             run(relinker, work, "sce-loader-path-without-interp-header-" + system, fixture(rodata_address=False, interp_header=False), flags)
             run_module(relinker, work, "sce-module-data-after-code-" + system, sce_module(), flags)
+            run_module(relinker, work, "sce-module-gap-embedded-data-" + system, sce_module(gap_embedded_data=True), flags)
+            run_module(relinker, work, "sce-module-gap-data-then-syscall-" + system, sce_module(gap_data_then_syscall=True), flags, "Forbidden syscall instruction")
+            run_module(relinker, work, "sce-module-gap-callback-syscall-" + system, sce_module(gap_callback_syscall_undecodable=True), flags, "Forbidden syscall instruction")
+            run_module(relinker, work, "sce-module-gap-decoded-padding-syscall-" + system, sce_module(gap_decoded_padding_syscall=True), flags, "Forbidden syscall instruction")
+            run_module(relinker, work, "sce-module-gap-stub-then-data-" + system, sce_module(gap_stub_then_data=True), flags, "Forbidden syscall instruction")
     print("SCE module code extent tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_tls_diagnostics.py b/core/relinker/relinker/tests/test_tls_diagnostics.py
index 51c9614bba..16a566ab08 100644
--- a/core/relinker/relinker/tests/test_tls_diagnostics.py
+++ b/core/relinker/relinker/tests/test_tls_diagnostics.py
@@ -21,7 +21,7 @@ def main():
 
         def check(input_path, offset, options):
             result = subprocess.run([str(relinker), "--windows", *options, str(source), str(output)],
-                                    capture_output=True, text=True, timeout=30)
+                                    capture_output=True, text=True, encoding="utf-8", timeout=30)
             assert result.returncode == 2, result
             assert "Unsupported Windows guest TLS instruction" in result.stderr, result.stderr
             assert f"(bytes: {TLS_INSTRUCTION.hex(' ')})" in result.stderr, result.stderr
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index 4687c088bf..d9c98c2670 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -531,7 +531,8 @@ def add_alias(image, size, begin=0x1200):
 
 def main():
     groups = ("metadata", "padding", "register_loads", "displacement_bounds", "alu_execution",
-              "register_address_loads", "moved_branch", "rejected", "gs_traps", "gs_traps_implicit")
+              "register_address_loads", "moved_branch", "rejected", "gs_traps", "gs_traps_implicit",
+              "gs_non_memory")
     groups += tuple(f"displacement_r{register}" for register in range(16) if register != 4)
     groups += tuple(f"alu_{name}" for name in ALU_READ)
     parser = argparse.ArgumentParser(description="Run Windows guest TLS function coverage fixtures")
@@ -777,6 +778,8 @@ def main():
             conflicting[232:344] = unwind[232:344]
             struct.pack_into("<H", conflicting, 56, 5)
             convert("conflicting-function-extents", conflicting, "Code analysis: conflicting function ranges")
+            convert("branch-into-gs", make_image("register", "unwind", body=bytes.fromhex("74 01 65 48 8b 0c 25 78 03 00 00 c3")),
+                    "Branch enters a guest GS instruction", error_offset=0x11243)
 
         def check_gs_traps(cases):
             for name, instruction, trapped in cases:
@@ -815,6 +818,11 @@ def main():
             assert result.returncode == 0, ("gs-without-pt-tls", result.stdout, result.stderr)
             patched = pe_bytes_at(output.read_bytes(), 0x11240, len(instruction) + 1)
             assert patched == b"\x0f\x0b" + b"\x90" * (len(instruction) - 2) + b"\xc3", ("gs-without-pt-tls", patched.hex())
+        if args.group in ("all", "gs_non_memory"):
+            check_gs_traps([
+                ("gs-lea", bytes.fromhex("65 8d 05 11 11 11 11"), False),
+                ("gs-nop-memory", bytes.fromhex("65 0f 1f 05 11 11 11 11"), False),
+            ])
         if args.group in ("all", "gs_traps_implicit"):
             check_gs_traps([
                 ("gs-maskmovdqu", bytes.fromhex("65 66 0f f7 c1"), True),
diff --git a/core/relinker/relinker/tests/test_to_rosetta.py b/core/relinker/relinker/tests/test_to_rosetta.py
index 72bc4640d8..ed0740868e 100644
--- a/core/relinker/relinker/tests/test_to_rosetta.py
+++ b/core/relinker/relinker/tests/test_to_rosetta.py
@@ -12,8 +12,10 @@ RDSEED = bytes.fromhex("0fc7f8")
 RDRAND = bytes.fromhex("0fc7f0")
 CLWB = bytes.fromhex("660fae37")
 NOP4 = bytes.fromhex("0f1f4000")
-SITES = RDSEED + CLWB + b"\xc3"
-LOWERED = RDRAND + NOP4 + b"\xc3"
+XSAVEOPT = bytes.fromhex("480fae37")
+XSAVE = bytes.fromhex("480fae27")
+SITES = RDSEED + CLWB + XSAVEOPT + b"\xc3"
+LOWERED = RDRAND + NOP4 + XSAVE + b"\xc3"
 
 
 def executable(code=SITES):
@@ -38,18 +40,18 @@ def main():
             result, output = relink(relinker, directory, "keep" + "".join(options), *options)
             assert result.returncode == 0, (options, result.stdout, result.stderr)
             data = output.read_bytes()
-            assert SITES in data and LOWERED not in data, f"{options or 'a plain relink'} changed RDSEED or CLWB"
+            assert SITES in data and LOWERED not in data, f"{options or 'a plain relink'} changed RDSEED, CLWB or XSAVEOPT"
         for options in (("--to-rosetta",), ("--to-rosetta", "--to-intel")):
             result, output = relink(relinker, directory, "lower" + "".join(options), *options)
             assert result.returncode == 0, (options, result.stdout, result.stderr)
             data = output.read_bytes()
-            assert LOWERED in data and SITES not in data, f"{options} did not lower RDSEED and CLWB"
+            assert LOWERED in data and SITES not in data, f"{options} did not lower RDSEED, CLWB and XSAVEOPT"
         for options, lowered in ((("--macos",), False), (("--macos", "--to-intel"), False), (("--macos", "--to-rosetta"), True)):
             result, output = relink(relinker, directory, "macos" + "".join(options), *options)
             assert result.returncode == 0, (options, result.stdout, result.stderr)
             data = output.read_bytes()
             assert data[:4] == bytes.fromhex("cffaedfe"), f"{options} did not write a Mach-O"
-            assert (LOWERED in data and SITES not in data) if lowered else (SITES in data and LOWERED not in data), f"{options} {'did not lower' if lowered else 'changed'} RDSEED and CLWB"
+            assert (LOWERED in data and SITES not in data) if lowered else (SITES in data and LOWERED not in data), f"{options} {'did not lower' if lowered else 'changed'} RDSEED, CLWB and XSAVEOPT"
         result, _ = relink(relinker, directory, "windows", "--to-rosetta", "--windows")
         assert result.returncode != 0 and "--to-rosetta conflicts with --windows" in result.stdout + result.stderr, "--to-rosetta together with --windows was accepted"
         andn = bytes.fromhex("c4e2f0f2c6c3")
@@ -62,6 +64,16 @@ def main():
                 assert (andn not in output.read_bytes()) == lowered, f"{options} {'did not lower' if lowered else 'changed'} ANDN"
                 if lowered:
                     assert "ANDN" in result.stdout, result.stdout
+        masked = bytes.fromhex("c4e2752e07c3")
+        for target in ((), ("--macos",)):
+            for conversion in ((), ("--to-intel",), ("--to-rosetta",)):
+                options = target + conversion
+                result, output = relink(relinker, directory, "masked" + "".join(options), *options, code=masked)
+                assert result.returncode == 0, (options, result.stdout, result.stderr)
+                lowered = conversion == ("--to-rosetta",)
+                assert (masked not in output.read_bytes()) == lowered, f"{options} {'did not lower' if lowered else 'changed'} VMASKMOVPS"
+                if lowered:
+                    assert "VMASKMOVPS" in result.stdout, result.stdout
     print("--to-rosetta integration tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_unused_filter_indirect.py b/core/relinker/relinker/tests/test_unused_filter_indirect.py
index eda91aa3a0..69e6e2f864 100644
--- a/core/relinker/relinker/tests/test_unused_filter_indirect.py
+++ b/core/relinker/relinker/tests/test_unused_filter_indirect.py
@@ -11,6 +11,8 @@ POINTER = 0x810
 TABLE = 0x820
 FUNCTION = CODE + 0x40
 SECOND_FUNCTION = CODE + 0x60
+REJECTED = {"got-slot-address-size-underflow":
+            "RELA r_offset 0xfffff008 (8 bytes) does not fit inside a PT_LOAD segment"}
 
 
 def rel(next_address, target):
@@ -62,6 +64,11 @@ def run(relinker, work, name, image, level=1):
     source.write_bytes(image)
     result = subprocess.run([str(relinker), "--skip-sce-module", "--registry", f"unused-filter={level}",
                              str(source), str(output)], capture_output=True, text=True, timeout=20)
+    if name in REJECTED:
+        assert result.returncode == 2 and REJECTED[name] in result.stderr and not output.exists(), (
+            name, result.returncode, result.stdout, result.stderr)
+        assert "CFG/GOT filtering: 1 -> 1;" in result.stdout, (name, result.stdout)
+        return True
     assert result.returncode == 0 and output.exists(), (name, result.returncode, result.stdout, result.stderr)
     registry = json.loads(output.with_suffix(".registry.json").read_text())
     kept = len(registry)
@@ -113,6 +120,9 @@ def cases():
     yield "got-slot-address-size", True, build(
         at_offset([(0, b"\x67\x48\x8d\x05" + struct.pack("<i", -2056) + b"\xc3")]),
         code_vaddr=0x100001000)
+    yield "got-slot-address-size-underflow", True, build(
+        at_offset([(0, b"\x67\x48\x8d\x05\x00\xe0\xff\xff\xc3")]),
+        slot_vaddr=(CODE + 8 - 0x2000) & 0xffffffff)
     yield "got-slot-underflow-discard", False, build(
         at_offset([(0, b"\x48\x8d\x05\x00\xe0\xff\xff\xc3")]),
         slot_vaddr=(CODE + 7 - 0x2000) & 0xffffffffffffffff)
diff --git a/core/relinker/relinker/tests/test_windows_fixed_base.py b/core/relinker/relinker/tests/test_windows_fixed_base.py
index 3d04fb54f9..3a10407df0 100644
--- a/core/relinker/relinker/tests/test_windows_fixed_base.py
+++ b/core/relinker/relinker/tests/test_windows_fixed_base.py
@@ -68,7 +68,7 @@ def main():
             assert result.returncode == 0, (name, result.returncode, result.stdout, result.stderr)
             data = output.read_bytes()
             pe, optional = pe_headers(data)
-            assert struct.unpack_from("<Q", data, optional + 24)[0] == (0x140000000 if base is None else base - 0x10000)
+            assert struct.unpack_from("<Q", data, optional + 24)[0] == (0x400000 if base is None else base) - 0x10000
             assert bool(struct.unpack_from("<H", data, pe + 22)[0] & 1) == (base is not None)
             characteristics = struct.unpack_from("<H", data, optional + 70)[0]
             assert characteristics & 0x100
@@ -85,6 +85,7 @@ def main():
         image[0x200:0x200 + len(code)] = code
         image[0x240:0x246] = bytes.fromhex("b8 2a 00 00 00 c3")
         struct.pack_into("<q", image, 0x710, 0x240)
+        run(convert("sce-dynexec-imports-offset-default", image))
         run(convert("sce-dynexec-imports-offset", image, 0x400000))
         for base in (0x400000, 0x800000, 0x400000000):
             image = fixture()
diff --git a/core/relinker/relinker/tests/test_windows_import_modules.py b/core/relinker/relinker/tests/test_windows_import_modules.py
index facc81da3c..f5ce379636 100644
--- a/core/relinker/relinker/tests/test_windows_import_modules.py
+++ b/core/relinker/relinker/tests/test_windows_import_modules.py
@@ -4,6 +4,7 @@ import struct
 import subprocess
 import sys
 import tempfile
+import time
 from ctypes import wintypes
 from pathlib import Path
 
@@ -260,6 +261,195 @@ def exit_code_without_standard_handles(executable_path):
         kernel32.CloseHandle(process.hProcess)
 
 
+def exit_code_with_preloaded_runtime(executable_path, runtime_library):
+    sem_failcriticalerrors = 0x0001
+    sem_nogpfaulterrorbox = 0x0002
+    startf_usestdhandles = 0x00000100
+    create_suspended = 0x00000004
+    mem_commit_and_reserve = 0x3000
+    mem_release = 0x8000
+    page_readwrite = 0x04
+    wait_object_0 = 0
+    wait_timeout = 0x00000102
+
+    class StartupInfo(ctypes.Structure):
+        _fields_ = [
+            ('cb', wintypes.DWORD),
+            ('lpReserved', wintypes.LPWSTR),
+            ('lpDesktop', wintypes.LPWSTR),
+            ('lpTitle', wintypes.LPWSTR),
+            ('dwX', wintypes.DWORD),
+            ('dwY', wintypes.DWORD),
+            ('dwXSize', wintypes.DWORD),
+            ('dwYSize', wintypes.DWORD),
+            ('dwXCountChars', wintypes.DWORD),
+            ('dwYCountChars', wintypes.DWORD),
+            ('dwFillAttribute', wintypes.DWORD),
+            ('dwFlags', wintypes.DWORD),
+            ('wShowWindow', wintypes.WORD),
+            ('cbReserved2', wintypes.WORD),
+            ('lpReserved2', wintypes.LPVOID),
+            ('hStdInput', wintypes.HANDLE),
+            ('hStdOutput', wintypes.HANDLE),
+            ('hStdError', wintypes.HANDLE),
+        ]
+
+    class ProcessInformation(ctypes.Structure):
+        _fields_ = [
+            ('hProcess', wintypes.HANDLE),
+            ('hThread', wintypes.HANDLE),
+            ('dwProcessId', wintypes.DWORD),
+            ('dwThreadId', wintypes.DWORD),
+        ]
+
+    kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
+    kernel32.GetErrorMode.restype = wintypes.UINT
+    kernel32.SetErrorMode.argtypes = [wintypes.UINT]
+    kernel32.SetErrorMode.restype = wintypes.UINT
+    kernel32.CreateProcessW.argtypes = [wintypes.LPCWSTR, wintypes.LPWSTR, wintypes.LPVOID, wintypes.LPVOID, wintypes.BOOL,
+                                        wintypes.DWORD, wintypes.LPVOID, wintypes.LPCWSTR, ctypes.POINTER(StartupInfo),
+                                        ctypes.POINTER(ProcessInformation)]
+    kernel32.CreateProcessW.restype = wintypes.BOOL
+    kernel32.GetModuleHandleW.argtypes = [wintypes.LPCWSTR]
+    kernel32.GetModuleHandleW.restype = wintypes.HMODULE
+    kernel32.GetProcAddress.argtypes = [wintypes.HMODULE, ctypes.c_char_p]
+    kernel32.GetProcAddress.restype = ctypes.c_void_p
+    kernel32.VirtualAllocEx.argtypes = [wintypes.HANDLE, ctypes.c_void_p, ctypes.c_size_t, wintypes.DWORD, wintypes.DWORD]
+    kernel32.VirtualAllocEx.restype = ctypes.c_void_p
+    kernel32.VirtualFreeEx.argtypes = [wintypes.HANDLE, ctypes.c_void_p, ctypes.c_size_t, wintypes.DWORD]
+    kernel32.VirtualFreeEx.restype = wintypes.BOOL
+    kernel32.WriteProcessMemory.argtypes = [wintypes.HANDLE, ctypes.c_void_p, ctypes.c_char_p, ctypes.c_size_t,
+                                            ctypes.POINTER(ctypes.c_size_t)]
+    kernel32.WriteProcessMemory.restype = wintypes.BOOL
+    kernel32.CreateRemoteThread.argtypes = [wintypes.HANDLE, ctypes.c_void_p, ctypes.c_size_t, ctypes.c_void_p,
+                                            ctypes.c_void_p, wintypes.DWORD, ctypes.c_void_p]
+    kernel32.CreateRemoteThread.restype = wintypes.HANDLE
+    kernel32.GetExitCodeThread.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.DWORD)]
+    kernel32.GetExitCodeThread.restype = wintypes.BOOL
+    kernel32.ResumeThread.argtypes = [wintypes.HANDLE]
+    kernel32.ResumeThread.restype = wintypes.DWORD
+    kernel32.WaitForSingleObject.argtypes = [wintypes.HANDLE, wintypes.DWORD]
+    kernel32.WaitForSingleObject.restype = wintypes.DWORD
+    kernel32.GetExitCodeProcess.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.DWORD)]
+    kernel32.GetExitCodeProcess.restype = wintypes.BOOL
+    kernel32.TerminateProcess.argtypes = [wintypes.HANDLE, wintypes.UINT]
+    kernel32.TerminateProcess.restype = wintypes.BOOL
+    kernel32.CloseHandle.argtypes = [wintypes.HANDLE]
+    kernel32.CloseHandle.restype = wintypes.BOOL
+    kernel32.SetErrorMode(kernel32.GetErrorMode() | sem_failcriticalerrors | sem_nogpfaulterrorbox)
+    info = StartupInfo()
+    info.cb = ctypes.sizeof(info)
+    info.dwFlags = startf_usestdhandles
+    process = ProcessInformation()
+    command = ctypes.create_unicode_buffer(f'"{executable_path}"')
+    if not kernel32.CreateProcessW(str(executable_path), command, None, None, False, create_suspended, None, None,
+                                   ctypes.byref(info), ctypes.byref(process)):
+        raise OSError(ctypes.get_last_error(), 'CreateProcessW failed')
+    child_exited = False
+    try:
+        load_library = kernel32.GetProcAddress(kernel32.GetModuleHandleW('kernel32.dll'), b'LoadLibraryA')
+        assert load_library, ctypes.get_last_error()
+        name = runtime_library.encode('ascii') + b'\0'
+        remote_name = kernel32.VirtualAllocEx(process.hProcess, None, len(name), mem_commit_and_reserve, page_readwrite)
+        assert remote_name, ctypes.get_last_error()
+        written = ctypes.c_size_t()
+        assert kernel32.WriteProcessMemory(process.hProcess, remote_name, name, len(name), ctypes.byref(written))
+        assert written.value == len(name), written.value
+        loader = kernel32.CreateRemoteThread(process.hProcess, None, 0, load_library, remote_name, 0, None)
+        assert loader, ctypes.get_last_error()
+        try:
+            if kernel32.WaitForSingleObject(loader, 30_000) != wait_object_0:
+                raise TimeoutError(f'{runtime_library} did not load in the suspended child')
+            loaded = wintypes.DWORD()
+            assert kernel32.GetExitCodeThread(loader, ctypes.byref(loaded))
+            assert loaded.value, (runtime_library, 'LoadLibraryA returned NULL in the suspended child')
+        finally:
+            kernel32.CloseHandle(loader)
+        assert kernel32.VirtualFreeEx(process.hProcess, remote_name, 0, mem_release), ctypes.get_last_error()
+        assert kernel32.ResumeThread(process.hThread) == 1
+        result = kernel32.WaitForSingleObject(process.hProcess, 30_000)
+        if result == wait_timeout:
+            raise TimeoutError('GUI child did not exit')
+        if result != wait_object_0:
+            raise OSError(f'WaitForSingleObject returned {result}')
+        child_exited = True
+        exit_code = wintypes.DWORD()
+        if not kernel32.GetExitCodeProcess(process.hProcess, ctypes.byref(exit_code)):
+            raise OSError(ctypes.get_last_error(), 'GetExitCodeProcess failed')
+        return exit_code.value
+    finally:
+        try:
+            if not child_exited:
+                terminated = kernel32.TerminateProcess(process.hProcess, 0xffffffff)
+                if kernel32.WaitForSingleObject(process.hProcess, 10_000) != wait_object_0:
+                    raise OSError(ctypes.get_last_error(),
+                                  f'child {process.dwProcessId} survived cleanup'
+                                  f' (TerminateProcess returned {terminated})')
+        finally:
+            kernel32.CloseHandle(process.hThread)
+            kernel32.CloseHandle(process.hProcess)
+
+
+def snapshot_children_named(snapshot, executable_name):
+    error_no_more_files = 18
+
+    class ProcessEntry(ctypes.Structure):
+        _fields_ = [
+            ('dwSize', wintypes.DWORD),
+            ('cntUsage', wintypes.DWORD),
+            ('th32ProcessID', wintypes.DWORD),
+            ('th32DefaultHeapID', ctypes.c_size_t),
+            ('th32ModuleID', wintypes.DWORD),
+            ('cntThreads', wintypes.DWORD),
+            ('th32ParentProcessID', wintypes.DWORD),
+            ('pcPriClassBase', wintypes.LONG),
+            ('dwFlags', wintypes.DWORD),
+            ('szExeFile', wintypes.WCHAR * 260),
+        ]
+
+    kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
+    kernel32.Process32FirstW.argtypes = [ctypes.c_void_p, ctypes.POINTER(ProcessEntry)]
+    kernel32.Process32FirstW.restype = wintypes.BOOL
+    kernel32.Process32NextW.argtypes = [ctypes.c_void_p, ctypes.POINTER(ProcessEntry)]
+    kernel32.Process32NextW.restype = wintypes.BOOL
+    children = []
+    entry = ProcessEntry()
+    entry.dwSize = ctypes.sizeof(entry)
+    found = kernel32.Process32FirstW(snapshot, ctypes.byref(entry))
+    while found:
+        if entry.th32ParentProcessID == os.getpid() and entry.szExeFile.lower() == executable_name.lower():
+            children.append(entry.th32ProcessID)
+        found = kernel32.Process32NextW(snapshot, ctypes.byref(entry))
+    error = ctypes.get_last_error()
+    if error != error_no_more_files:
+        raise OSError(error, 'process snapshot enumeration failed')
+    return children
+
+
+def live_children_named(executable_name):
+    th32cs_snapprocess = 0x00000002
+    kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
+    kernel32.CreateToolhelp32Snapshot.argtypes = [wintypes.DWORD, wintypes.DWORD]
+    kernel32.CreateToolhelp32Snapshot.restype = ctypes.c_void_p
+    kernel32.CloseHandle.argtypes = [ctypes.c_void_p]
+    kernel32.CloseHandle.restype = wintypes.BOOL
+    snapshot = kernel32.CreateToolhelp32Snapshot(th32cs_snapprocess, 0)
+    assert snapshot not in (None, ctypes.c_void_p(-1).value), ctypes.get_last_error()
+    try:
+        return snapshot_children_named(snapshot, executable_name)
+    finally:
+        kernel32.CloseHandle(snapshot)
+
+
+def lingering_children_named(executable_name, timeout_seconds=10.0):
+    deadline = time.monotonic() + timeout_seconds
+    children = live_children_named(executable_name)
+    while children and time.monotonic() < deadline:
+        time.sleep(0.1)
+        children = live_children_named(executable_name)
+    return children
+
+
 def run_with_standard_pipes(executable_path, capture_stdout, capture_stderr):
     startf_usestdhandles = 0x00000100
     handle_flag_inherit = 0x00000001
@@ -534,6 +724,13 @@ def main():
         assert not output.exists()
 
         if os.name == 'nt':
+            try:
+                snapshot_children_named(ctypes.c_void_p(-1).value, 'output.exe')
+            except OSError as error:
+                assert error.errno, error
+            else:
+                raise AssertionError('planted enumeration failure did not raise')
+
             for host_library in sys.argv[2:]:
                 library = Path(host_library).resolve()
                 runtime = library.stem.removeprefix('windows_stdio_host_')
@@ -544,16 +741,19 @@ def main():
                     assert {'__iob_func', 'fputs'} <= imports.get('msvcrt.dll', set()), (library, imports)
                     assert not any(name.startswith('api-ms-win-crt-') for name in imports), (library, imports)
 
-                def convert_stdio_case(case_name):
+                def convert_stdio_case(case_name, image=None, lazy_binding=False):
                     case = work / case_name
                     (case / 'prx').mkdir(parents=True)
                     libs = case / 'libs'
                     libs.mkdir()
                     source = case / 'input.elf'
-                    source.write_bytes(executable('a.prx', 'shared'))
+                    source.write_bytes(image if image is not None else executable('a.prx', 'shared'))
                     executable_path = case / 'output.exe'
-                    result = subprocess.run([str(relinker), '--windows', '--windows-gui', str(source), str(executable_path)],
-                                            capture_output=True, text=True, timeout=30)
+                    arguments = [str(relinker), '--windows', '--windows-gui']
+                    if lazy_binding:
+                        arguments.append('--lazy-binding')
+                    arguments.extend([str(source), str(executable_path)])
+                    result = subprocess.run(arguments, capture_output=True, text=True, timeout=30)
                     assert result.returncode == 0, result.stderr
                     (libs / 'a.prx').write_bytes(library.read_bytes())
                     return executable_path, executable_path.parent / 'anyps5.log'
@@ -591,6 +791,42 @@ def main():
                 assert 'Windows DLL stderr probe' in stderr, (runtime, stderr)
                 assert not log.exists(), (runtime, log)
 
+                preloaded_runtime = {'msvcrt': 'msvcrt.dll', 'ucrt': 'ucrtbase.dll'}.get(runtime)
+                if preloaded_runtime:
+                    executable_path, log = convert_stdio_case(f'gui-dll-{runtime}-preloaded-runtime')
+                    run_status = exit_code_with_preloaded_runtime(executable_path, preloaded_runtime)
+                    assert run_status == 11, (runtime, hex(run_status))
+                    assert log.is_file(), (runtime, log)
+                    content = log.read_text(errors='replace')
+                    assert 'Windows DLL stdout probe' in content, (runtime, content)
+                    assert 'Windows DLL stderr probe' in content, (runtime, content)
+
+                    executable_path, log = convert_stdio_case(f'gui-dll-{runtime}-preloaded-runtime-loader-failure')
+                    try:
+                        exit_code_with_preloaded_runtime(executable_path, 'anyps5_planted_missing_runtime.dll')
+                    except AssertionError as error:
+                        assert 'LoadLibraryA returned NULL' in str(error), error
+                    else:
+                        raise AssertionError('planted loader failure did not raise')
+                    assert not lingering_children_named(executable_path.name), (runtime, executable_path)
+                    assert not log.exists(), (runtime, log)
+
+                    image = executable('a.prx', 'shared', extra_symbols=('absent#A#B',))
+                    image[0x4000:0x400d] = (b'\xff\x15' + struct.pack('<i', 0x4a20 - 0x4006)
+                                            + b'\xff\x15' + struct.pack('<i', 0x4a28 - 0x400c) + b'\xc3')
+                    executable_path, log = convert_stdio_case(f'gui-dll-{runtime}-preloaded-runtime-stub-after-crt',
+                                                              image=image, lazy_binding=True)
+                    log.write_text('stale previous run', encoding='utf-8')
+                    run_status = exit_code_with_preloaded_runtime(executable_path, preloaded_runtime)
+                    assert run_status == 0xc0000139, (runtime, hex(run_status))
+                    assert log.is_file(), (runtime, log)
+                    content = log.read_text(errors='replace')
+                    assert 'stale previous run' not in content, (runtime, content)
+                    assert 'Transferring control to ELF entry point' in content, (runtime, content)
+                    assert 'Windows DLL stdout probe' in content, (runtime, content)
+                    assert 'Windows DLL stderr probe' in content, (runtime, content)
+                    assert 'unresolved ELF import absent' in content, (runtime, content)
+
             for name, owner, symbol, expected, message in [
                     ('missing-symbol-gui', 'a.prx', 'absent#A#B', 0xc0000139, 'unresolved ELF import absent'),
                     ('missing-dependency-gui', 'missing.prx', 'shared#A#B', 0xc0000135, 'Failed to load module')]:
diff --git a/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py b/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py
new file mode 100644
index 0000000000..2335566e12
--- /dev/null
+++ b/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py
@@ -0,0 +1,77 @@
+import os
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+from guest_import_fixtures import executable
+from test_windows_import_modules import provider
+
+
+def main():
+    assert os.name == 'nt', 'This test executes Windows startup stubs'
+    relinker = Path(sys.argv[1]).resolve()
+    variant = sys.argv[2]
+    assert variant in ('libkernel_sys.prx', 'libkernel_web.prx')
+    with tempfile.TemporaryDirectory(prefix='anyps5-kernel-variant-') as directory:
+        work = Path(directory)
+        modules = work / 'helpers' / 'prx'
+        modules.mkdir(parents=True)
+        for name, value in (('variant', 11), ('canonical', 22), ('runtime', 33), ('guest', 44)):
+            (modules / (name + '.prx')).write_bytes(provider(value))
+        empty = provider(0)
+        empty[0x800:0x80c] = b'\0other#A#B\0\0'
+        (modules / 'empty.prx').write_bytes(empty)
+        source = modules.parent / 'input.elf'
+        source.write_bytes(executable('variant.prx', 'shared#A#B'))
+        result = subprocess.run([str(relinker), '--windows', str(source), str(modules.parent / 'output.exe')],
+                                capture_output=True, text=True, timeout=30)
+        assert result.returncode == 0, result.stderr
+        converted = modules.parent / 'app0' / 'prx'
+        images = {name: (converted / (name + '.prx.guest.prx')).read_bytes()
+                  for name in ('variant', 'canonical', 'runtime', 'guest', 'empty')}
+        cases = (
+            ('runtime-fallback', 'empty', 'empty', 'runtime', 33),
+            ('variant-first', 'variant', 'canonical', 'runtime', 11),
+            ('canonical-before-runtime', 'empty', 'canonical', 'runtime', 22),
+            ('missing', 'empty', 'empty', 'empty', None),
+            ('guest-isolation', 'empty', 'empty', 'runtime', 33),
+            ('guest-cannot-fill-missing', 'empty', 'empty', 'empty', None),
+            ('unrelated-host', 'empty', 'empty', 'empty', None),
+            ('guest-requested-variant', 'variant', 'canonical', 'runtime', 44),
+            ('unqualified', 'variant', 'canonical', 'runtime', 11),
+        )
+        for label, requested, canonical, runtime, expected in cases:
+            case = work / label
+            libraries = case / 'libs'
+            libraries.mkdir(parents=True)
+            (case / 'prx').mkdir()
+            for name, image in ((variant, requested), ('libkernel.prx', canonical), ('libc.prx', runtime)):
+                (libraries / name).write_bytes(images[image])
+            if label.startswith('guest-'):
+                guests = case / 'sce_module'
+                guests.mkdir()
+                names = (variant,) if label == 'guest-requested-variant' else ('libkernel.prx', 'libc.prx')
+                for name in names:
+                    (guests / name).write_bytes(provider(44))
+            extra = ('unrelated.prx',) if label == 'unrelated-host' else ()
+            if extra:
+                (libraries / extra[0]).write_bytes(images['guest'])
+            source = case / 'input.elf'
+            symbol = 'shared' if label == 'unqualified' else 'shared#A#B'
+            source.write_bytes(executable(variant, symbol, extra_dependencies=extra))
+            output = case / 'output.exe'
+            result = subprocess.run([str(relinker), '--windows', str(source), str(output)],
+                                    capture_output=True, text=True, timeout=30)
+            assert result.returncode == 0, (variant, label, result.stderr)
+            result = subprocess.run([str(output)], capture_output=True, text=True, timeout=30)
+            if expected is None:
+                assert result.returncode & 0xffffffff == 0xc0000139, (label, result.returncode, result.stderr)
+                assert 'unresolved ELF import shared' in result.stderr, (label, result.stderr)
+            else:
+                assert result.returncode == expected, (variant, label, result.returncode, result.stderr)
+    print(variant + ': runtime, precedence and isolation checks passed')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/core/relinker/relinker/tests/test_windows_tls_protected_entries.py b/core/relinker/relinker/tests/test_windows_tls_protected_entries.py
index 4b7f2bd674..eb148df531 100644
--- a/core/relinker/relinker/tests/test_windows_tls_protected_entries.py
+++ b/core/relinker/relinker/tests/test_windows_tls_protected_entries.py
@@ -85,7 +85,7 @@ def main():
             pe = output.read_bytes()
             assert pe_bytes_at(pe, 0x10210, 1) == b"\xe9", name
             if name == "access-start":
-                assert struct.unpack("<Q", pe_bytes_at(pe, 0x10308, 8))[0] == 0x140010210, name
+                assert struct.unpack("<Q", pe_bytes_at(pe, 0x10308, 8))[0] == 0x400210, name
             if name == "after-patch":
                 assert pe_bytes_at(pe, 0x1021a, 6) == SEPARATE_FUNCTION, name
 
diff --git a/core/relinker/relinker/tests/test_windows_working_directory.py b/core/relinker/relinker/tests/test_windows_working_directory.py
index c3cc6bf964..2692c59082 100644
--- a/core/relinker/relinker/tests/test_windows_working_directory.py
+++ b/core/relinker/relinker/tests/test_windows_working_directory.py
@@ -50,7 +50,10 @@ def current_directory(pid):
         parameters = struct.unpack('<Q', read(information.PebBaseAddress + 0x20, 8))[0]
         length = struct.unpack('<H', read(parameters + 0x38, 2))[0]
         text = struct.unpack('<Q', read(parameters + 0x40, 8))[0]
-        return Path(read(text, length).decode('utf-16-le'))
+        directory = read(text, length).decode('utf-16-le')
+        if '\0' in directory:
+            raise OSError(0, 'the current directory is not written yet')
+        return Path(directory)
     finally:
         kernel32.CloseHandle(handle)
 
diff --git a/core/shader/recompiler/BdaAbi.hpp b/core/shader/recompiler/BdaAbi.hpp
index 0c84230b80..f5df5fcbcd 100644
--- a/core/shader/recompiler/BdaAbi.hpp
+++ b/core/shader/recompiler/BdaAbi.hpp
@@ -35,7 +35,7 @@ inline bool RangesOrdered(const Range* ranges, std::size_t count) {
 }
 
 enum class FaultState : std::uint32_t { Empty, Writing, Ready };
-enum class FaultReason : std::uint32_t { Unmapped = 1, Permission, Overflow, InvalidTable, InvalidRectangle, LoopLimit, Unaligned, InvalidDescriptor, ImageTable, UnlinkedCall };
+enum class FaultReason : std::uint32_t { Unmapped = 1, Permission, Overflow, InvalidTable, InvalidRectangle, LoopLimit, Unaligned, InvalidDescriptor, ImageTable, UnlinkedCall, WindowLaneSpill };
 
 struct Fault {
     FaultState state;
diff --git a/core/shader/recompiler/CMakeLists.txt b/core/shader/recompiler/CMakeLists.txt
index 0f83ea58a8..7ef4a942a8 100644
--- a/core/shader/recompiler/CMakeLists.txt
+++ b/core/shader/recompiler/CMakeLists.txt
@@ -101,6 +101,7 @@ function(add_shader_recompiler target runtimeTarget)
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/SsaBuilder/SsaRegisterStateCleanup.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/ConstantFolder.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/DeadCodeEliminator.cpp
+            ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/UnobservedPhiEliminator.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/HostInterpolationChecker.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/ReadLaneEliminator.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/MaskedSelectEliminator.cpp
@@ -130,6 +131,7 @@ function(add_shader_recompiler target runtimeTarget)
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAnalysis.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterFloat64.cpp
+            ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterRegisters.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvFlowEmitter.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvImageEmitter.cpp
@@ -176,6 +178,9 @@ function(add_shader_recompiler target runtimeTarget)
 
     if(ANYPS5_ENABLE_SPIRV_TOOLS)
         target_sources(${target} PRIVATE ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvOptimizer.cpp)
+        if(WIN32)
+            set_source_files_properties(${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvOptimizer.cpp TARGET_DIRECTORY ${target} PROPERTIES COMPILE_DEFINITIONS _WIN32_WINNT=0x0602)
+        endif()
     endif()
 
     set(shaderCacheGeneratedDir "${CMAKE_CURRENT_BINARY_DIR}/${target}_generated")
@@ -249,6 +254,7 @@ function(add_shader_recompiler target runtimeTarget)
             ImageTableAbi::PoisonCode
             ImageTableAbi::PoisonReasonName
             ImageTableAbi::TableHeader
+            FmaskLayoutOf
             IsFmaskTextureFormat
             PipelineSpecialization::IsWorkgroupOffset
             PipelineSpecialization::WorkgroupOffsetBase
diff --git a/core/shader/recompiler/CacheKey.hpp b/core/shader/recompiler/CacheKey.hpp
index fdcff33207..8c5d2b2678 100644
--- a/core/shader/recompiler/CacheKey.hpp
+++ b/core/shader/recompiler/CacheKey.hpp
@@ -4,8 +4,10 @@
 #include "Recompiler.hpp"
 #include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
+#include <algorithm>
 #include <bit>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 #include <type_traits>
 
@@ -218,6 +220,11 @@ private:
         append(key, value.positionLocation);
         append(key, value.sampleLocations);
         append(key, value.targetOutputMode);
+        append(key, value.targetMerge.target);
+        append(key, value.targetMerge.mask);
+        append(key, value.targetMerge.samples);
+        append(key, value.targetMerge.depthStencilWrites);
+        append(key, value.targetMerge.depthStencilTests);
         append(key, value.sampleOrder);
     }
 
@@ -270,13 +277,35 @@ private:
         append(key, value.maxEvaluationOutputComponents);
     }
 
+    static void appendFeatureDigest(std::vector<std::uint64_t>& key, std::span<const std::uint32_t> capabilities, std::span<const std::string_view> extensions) {
+        std::uint64_t low = 0xcbf29ce484222325ull;
+        std::uint64_t high = 0x6a09e667f3bcc909ull;
+        const auto mix = [&](std::uint64_t value) {
+            low = (low ^ value) * 0x100000001b3ull;
+            high = (high ^ (value * 0x9e3779b97f4a7c15ull)) * 0xff51afd7ed558ccdull;
+            high ^= high >> 29u;
+        };
+        mix(capabilities.size());
+        for (const auto capability : capabilities) mix(capability);
+        mix(extensions.size());
+        for (const auto extension : extensions) {
+            mix(extension.size());
+            for (std::size_t offset = 0; offset < extension.size(); offset += sizeof(std::uint64_t)) {
+                std::uint64_t chunk = 0;
+                std::memcpy(&chunk, extension.data() + offset, std::min(sizeof(std::uint64_t), extension.size() - offset));
+                mix(chunk);
+            }
+        }
+        key.push_back(low);
+        key.push_back(high);
+    }
+
     static void append(std::vector<std::uint64_t>& key, const SpirvTarget& value) {
         append(key, value.vulkanVersion);
         append(key, value.spirvVersion);
         append(key, value.subgroupSize);
         append(key, value.bdaAbiVersion);
-        append(key, value.supportedCapabilities);
-        append(key, value.supportedExtensions);
+        appendFeatureDigest(key, value.supportedCapabilities, value.supportedExtensions);
         append(key, value.fragmentShaderBarycentricEnabled);
         append(key, value.maxWorkgroupSize);
         append(key, value.maxWorkgroupInvocations);
@@ -298,6 +327,9 @@ private:
         append(key, value.waveLdsMemoryBarriers);
         append(key, value.float32DenormPreserve);
         append(key, value.fusedExactArithmetic);
+        append(key, value.largePixelFunctionLdsBuffer);
+        append(key, value.pixelFunctionStorageDwords);
+        append(key, value.deviceScopeLdsMemoryBarriers);
     }
 };
 
diff --git a/core/shader/recompiler/ControlFlow/include/ControlFlow/ControlFlowGraph.hpp b/core/shader/recompiler/ControlFlow/include/ControlFlow/ControlFlowGraph.hpp
index c9ee6e2fc7..3d744b0f68 100644
--- a/core/shader/recompiler/ControlFlow/include/ControlFlow/ControlFlowGraph.hpp
+++ b/core/shader/recompiler/ControlFlow/include/ControlFlow/ControlFlowGraph.hpp
@@ -68,6 +68,7 @@ struct BasicBlock {
     std::uint32_t instructionBegin = 0;
     std::uint32_t instructionEnd = 0;
     std::uint32_t estimatedSpirvWords = 0;
+    std::uint32_t immediatePostDominator = InvalidControlFlowId;
     std::vector<std::uint32_t> predecessors;
     std::vector<std::uint32_t> successors;
     std::vector<std::uint32_t> dominators;
diff --git a/core/shader/recompiler/ControlFlow/src/ControlFlowGraph.cpp b/core/shader/recompiler/ControlFlow/src/ControlFlowGraph.cpp
index 3f331f1ece..22fe11817d 100644
--- a/core/shader/recompiler/ControlFlow/src/ControlFlowGraph.cpp
+++ b/core/shader/recompiler/ControlFlow/src/ControlFlowGraph.cpp
@@ -2,6 +2,7 @@
 #include "ControlFlow/ControlFlowHelpers.hpp"
 #include <algorithm>
 #include <cstdio>
+#include <functional>
 #include <iterator>
 #include <stdexcept>
 #include <string>
@@ -20,6 +21,7 @@ bool contains(const std::vector<std::uint32_t>& values, std::uint32_t value) {
 
 std::vector<std::uint32_t> intersectSorted(const std::vector<std::uint32_t>& first, const std::vector<std::uint32_t>& second) {
     std::vector<std::uint32_t> result;
+    result.reserve(std::min(first.size(), second.size()));
     std::set_intersection(first.begin(), first.end(), second.begin(), second.end(), std::back_inserter(result));
     return result;
 }
@@ -43,7 +45,9 @@ void remapIds(std::vector<std::uint32_t>& values, const std::vector<std::uint32_
     for (auto& value : values) {
         value = remapId(value, idMap);
     }
-    sortUnique(values);
+    if (std::adjacent_find(values.begin(), values.end(), std::greater_equal<>()) != values.end()) {
+        sortUnique(values);
+    }
 }
 
 void rebuildPredecessors(ControlFlowGraph& graph) {
@@ -118,18 +122,37 @@ bool ControlFlowGraph::PostDominates(std::uint32_t postDominator, std::uint32_t
 std::uint32_t ControlFlowGraph::FindNearestCommonPostDominator(std::uint32_t firstBlock, std::uint32_t secondBlock) const {
     const auto& first = FindBlock(firstBlock);
     const auto& second = FindBlock(secondBlock);
+    if (first.immediatePostDominator != InvalidControlFlowId && second.immediatePostDominator != InvalidControlFlowId) {
+        const BasicBlock* left = &first;
+        const BasicBlock* right = &second;
+        while (left->postDominators.size() > right->postDominators.size()) left = &FindBlock(left->immediatePostDominator);
+        while (right->postDominators.size() > left->postDominators.size()) right = &FindBlock(right->immediatePostDominator);
+        while (left != right) {
+            if (left->immediatePostDominator == left->id) {
+                return InvalidControlFlowId;
+            }
+            left = &FindBlock(left->immediatePostDominator);
+            right = &FindBlock(right->immediatePostDominator);
+        }
+        return left->id;
+    }
     const auto common = intersectSorted(first.postDominators, second.postDominators);
     if (common.empty()) {
         return InvalidControlFlowId;
     }
+    if (common.size() == 1u) {
+        return common.front();
+    }
     for (const auto candidate : common) {
-        bool nearest = true;
-        for (const auto other : common) {
-            if (other != candidate && !PostDominates(other, candidate)) {
-                nearest = false;
-                break;
-            }
+        const auto& postDominators = FindBlock(candidate).postDominators;
+        if (postDominators.size() + 1u < common.size()) {
+            continue;
         }
+        auto member = postDominators.begin();
+        const bool nearest = std::all_of(common.begin(), common.end(), [&](std::uint32_t other) {
+            member = std::lower_bound(member, postDominators.end(), other);
+            return other == candidate || (member != postDominators.end() && *member == other);
+        });
         if (nearest) {
             return candidate;
         }
diff --git a/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp b/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp
index afe341bb79..6eb1bae337 100644
--- a/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp
+++ b/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp
@@ -503,11 +503,9 @@ bool overwritesScalar(const RdnaInstruction& instruction, std::uint32_t reg, std
                 case RdnaOpcode::SBitset1B64:
                 case RdnaOpcode::SSwappcB64:
                 case RdnaOpcode::SSetpcB64: return false;
-                case RdnaOpcode::SMovB64:
-                case RdnaOpcode::SGetpcB64: return first != NoScalarRegister && reg >= first && reg - first < 2u;
-                default: return first != NoScalarRegister && reg == first;
+                default: return first != NoScalarRegister && reg >= first && reg - first < std::max(instruction.dataDwordCount, 1u);
             }
-        case RdnaInstructionFamily::SOP2: return first != NoScalarRegister && reg == first;
+        case RdnaInstructionFamily::SOP2: return first != NoScalarRegister && reg >= first && reg - first < std::max(instruction.dataDwordCount, 1u);
         case RdnaInstructionFamily::SOPK: return instruction.op == RdnaOpcode::SMovkI32 && reg == first;
         case RdnaInstructionFamily::VOP1:
         case RdnaInstructionFamily::VOP2:
@@ -1528,7 +1526,9 @@ std::vector<TableCall> FindTableCalls(const RdnaProgram& program, const SwappcIn
         if (!sameBlockWriter && !reachingWriter(program, lowLoad, {descriptor, descriptor + 1u, descriptor + 2u, descriptor + 3u}, descriptorLoad, swappc.waveSize)) continue;
         const auto& table = program.instructions[descriptorLoad];
         const auto pointer = scalarIndex(table.source0);
-        if (table.op != RdnaOpcode::SLoadDwordx4 || !isScalar(table.destination, descriptor) || pointer == NoScalarRegister || pointer % 2u != 0u || table.source1.kind != RdnaOperandKind::Null ||
+        const auto loaded = scalarIndex(table.destination);
+        if ((table.op != RdnaOpcode::SLoadDwordx4 && table.op != RdnaOpcode::SLoadDwordx8 && table.op != RdnaOpcode::SLoadDwordx16) || loaded == NoScalarRegister || descriptor < loaded ||
+            (descriptor - loaded) % 4u != 0u || descriptor - loaded + 4u > table.dataDwordCount || pointer == NoScalarRegister || pointer % 2u != 0u || table.source1.kind != RdnaOperandKind::Null ||
             table.memoryOffset >= 0x100000u || (table.memoryOffset & 3u) != 0u) continue;
         std::optional<std::uint64_t> constantPointer;
         if (!(userData(pointer) && userData(pointer + 1u) && unchangedUntil(program, pointer, descriptorLoad, swappc.waveSize) && unchangedUntil(program, pointer + 1u, descriptorLoad, swappc.waveSize))) {
@@ -1550,7 +1550,7 @@ std::vector<TableCall> FindTableCalls(const RdnaProgram& program, const SwappcIn
             if (shifted.op != RdnaOpcode::SLshlB32 || !isScalar(shifted.destination, offset) || !isImmediate(shifted.source1, shift) || shift < 2u || shift > 24u) continue;
             stride = 1u << shift;
         }
-        calls.push_back({instruction.programCounter, link, target, constantPointer ? 0u : pointer, table.memoryOffset, load.memoryOffset + lowDword * 4u, stride, constantPointer});
+        calls.push_back({instruction.programCounter, link, target, constantPointer ? 0u : pointer, table.memoryOffset + (descriptor - loaded) * 4u, load.memoryOffset + lowDword * 4u, stride, constantPointer});
     }
     return calls;
 }
@@ -1582,6 +1582,7 @@ LinkedCalls LinkCalls(const RdnaProgram& program, std::span<const UserDataCall>
         linked[word] = 0xbb000000u | (userDataCalls[call].linkRegister << 16u) | static_cast<std::uint32_t>(offset);
         linked.insert(linked.end(), userDataCallees[call].begin(), userDataCallees[call].end());
     }
+    std::vector<std::pair<std::size_t, std::size_t>> stations;
     for (std::size_t call = 0; call < tableCalls.size(); ++call) {
         const auto& table = tableCalls[call];
         const auto& callees = tableCallees[call];
@@ -1589,41 +1590,50 @@ LinkedCalls LinkCalls(const RdnaProgram& program, std::span<const UserDataCall>
         const auto at = "the table callees of the call at program counter " + toHexString(table.programCounter);
         const auto original = linked[word];
         const auto count = callees.size();
-        const auto dispatch = linked.size();
-        const auto zero = dispatch + 1u;
-        const auto one = zero + count * 7u + 2u;
-        const auto calls = one + count * 8u + 2u;
-        const auto fault = calls + count * 2u;
+        const auto relays = 2u * (tableCalls.size() - call - 1u);
+        std::vector<std::size_t> path;
+        for (const auto& [position, block] : stations) path.push_back(position + 2u * (call - block - 1u));
+        const auto station = [&] {
+            if (relays == 0u) return;
+            stations.push_back({linked.size(), call});
+            linked.insert(linked.end(), relays, 0u);
+        };
+        station();
+        const auto start = linked.size();
+        std::vector<std::size_t> segments(count + 1u);
+        segments[0] = start + 1u;
+        for (std::size_t callee = 0; callee < count; ++callee) segments[callee + 1u] = segments[callee] + 16u + callees[callee].code.size() + relays;
+        const auto one = [&](std::size_t callee) { return segments[callee] + (callee < count ? 7u : 2u); };
+        const auto back = [&](std::size_t callee) { return callee != 0u ? segments[callee - 1u] + 15u : path.empty() ? word + 1u : path.back() + 1u; };
+        const auto fault = segments[count] + 3u;
         const auto branch = [&](std::uint32_t opcode, std::size_t target) { linked.push_back(branchWord(opcode, linked.size(), target, at.c_str())); };
-        linked[word] = branchWord(0xbf820000u, word, dispatch, at.c_str());
-        branch(0xbf850000u, one);
-        for (const bool sccOne : {false, true}) {
-            for (std::size_t callee = 0; callee < count; ++callee) {
-                const auto next = linked.size() + (sccOne ? 8u : 7u);
+        for (std::size_t hop = 0; hop < path.size(); ++hop) {
+            linked[path[hop]] = branchWord(0xbf820000u, path[hop], hop + 1u < path.size() ? path[hop + 1u] : start, at.c_str());
+            linked[path[hop] + 1u] = branchWord(0xbf820000u, path[hop] + 1u, hop == 0u ? word + 1u : path[hop - 1u] + 1u, at.c_str());
+        }
+        linked[word] = branchWord(0xbf820000u, word, path.empty() ? start : path.front(), at.c_str());
+        branch(0xbf850000u, one(0u));
+        for (std::size_t callee = 0; callee < count; ++callee) {
+            for (const bool sccOne : {false, true}) {
+                const auto next = sccOne ? one(callee + 1u) : segments[callee + 1u];
                 linked.insert(linked.end(), {0xbf07ff00u | table.targetRegister, static_cast<std::uint32_t>(callees[callee].target)});
                 branch(0xbf850000u, next);
                 linked.insert(linked.end(), {0xbf07ff00u | (table.targetRegister + 1u), static_cast<std::uint32_t>(callees[callee].target >> 32u)});
                 branch(0xbf850000u, next);
                 if (sccOne) linked.push_back(0xbf068080u);
-                branch(0xbf820000u, calls + callee * 2u);
+                else branch(0xbf820000u, segments[callee] + 14u);
             }
-            linked.push_back(sccOne ? 0xbf068080u : 0xbf078080u);
-            branch(0xbf820000u, fault);
-        }
-        for (std::size_t callee = 0; callee < count; ++callee) {
-            linked.push_back(0u);
-            branch(0xbf820000u, word + 1u);
+            linked.push_back(0xbb000001u | (table.linkRegister << 16u));
+            branch(0xbf820000u, back(callee));
+            linked.insert(linked.end(), callees[callee].code.begin(), callees[callee].code.end());
+            station();
         }
+        linked.push_back(0xbf078080u);
+        branch(0xbf820000u, fault);
+        linked.push_back(0xbf068080u);
         fallbacks.push_back(static_cast<std::uint32_t>(linked.size() * 4u));
         linked.push_back(original);
-        branch(0xbf820000u, word + 1u);
-        for (std::size_t callee = 0; callee < count; ++callee) {
-            const auto site = calls + callee * 2u;
-            const auto offset = static_cast<std::int64_t>(linked.size()) - static_cast<std::int64_t>(site) - 1;
-            if (offset > 0x7fff) throw std::invalid_argument(at + " land out of s_call_b64 range");
-            linked[site] = 0xbb000000u | (table.linkRegister << 16u) | static_cast<std::uint32_t>(offset);
-            linked.insert(linked.end(), callees[callee].code.begin(), callees[callee].code.end());
-        }
+        branch(0xbf820000u, back(count));
     }
     linked.push_back(0xbf9f0000u);
     return {std::move(linked), std::move(fallbacks)};
diff --git a/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp b/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp
index 96bb58e1a5..1a12c1702c 100644
--- a/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp
+++ b/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp
@@ -240,7 +240,7 @@ ConservativeZExport readConservativeZExport(Reader& reader) {
 
 ColorExportPacking readColorExportPacking(Reader& reader) {
     const auto value = reader.ReadU8();
-    if (value > static_cast<std::uint8_t>(ColorExportPacking::Float11_11_10)) {
+    if (value > static_cast<std::uint8_t>(ColorExportPacking::Uint)) {
         throw std::runtime_error("RequestSerializer: invalid ColorExportPacking value");
     }
     return static_cast<ColorExportPacking>(value);
@@ -357,6 +357,12 @@ void writePixelInfo(Writer& writer, const ShaderPixelStageInfo& info) {
     for (const std::uint8_t location : info.sampleLocations) writer.WriteU8(location);
     writer.WriteBool(info.stencilOperationValueExport);
     for (const std::uint32_t order : info.sampleOrder) writer.WriteU32(order);
+    writer.WriteU8(info.targetMerge.target);
+    writer.WriteU32(info.targetMerge.mask);
+    writer.WriteU8(info.targetMerge.samples);
+    for (const std::uint32_t word : info.targetMerge.descriptor) writer.WriteU32(word);
+    writer.WriteBool(info.targetMerge.depthStencilWrites);
+    writer.WriteBool(info.targetMerge.depthStencilTests);
 }
 
 ShaderPixelStageInfo readPixelInfo(Reader& reader, std::uint32_t version) {
@@ -428,6 +434,16 @@ ShaderPixelStageInfo readPixelInfo(Reader& reader, std::uint32_t version) {
     if (version >= 42u) {
         for (std::uint32_t& order : info.sampleOrder) order = reader.ReadU32();
     }
+    if (version >= 46u) {
+        info.targetMerge.target = reader.ReadU8();
+        const auto mask = reader.ReadU32();
+        if (mask > 0xffffu) throw std::runtime_error("invalid recompile request target merge mask");
+        info.targetMerge.mask = static_cast<std::uint16_t>(mask);
+        info.targetMerge.samples = reader.ReadU8();
+        for (std::uint32_t& word : info.targetMerge.descriptor) word = reader.ReadU32();
+        info.targetMerge.depthStencilWrites = reader.ReadBool();
+        info.targetMerge.depthStencilTests = reader.ReadBool();
+    }
     if (version < 5u) {
         const auto input = [](PixelInput value, bool present) { return present ? PixelInputBit(value) : 0u; };
         info.inputAddr = input(PixelInput::PerspectiveSample, info.hasPerspectiveCenterVgpr && inputAddrOrCenterVgpr == 2u) | input(PixelInput::PerspectiveCenter, info.hasPerspectiveCenterVgpr) |
@@ -832,7 +848,7 @@ std::string RequestSerializer::Serialize(const RecompileRequest& request) const
     std::string buffer;
     Writer writer(buffer);
     writer.WriteU32(0x41505335u);
-    writer.WriteU32(44u);
+    writer.WriteU32(46u);
     writeShaderBinary(writer, request.shader);
     writeGuestContext(writer, request.context);
     writeSpirvTarget(writer, request.target);
@@ -871,6 +887,8 @@ std::string RequestSerializer::Serialize(const RecompileRequest& request) const
         writer.WriteU32(std::bit_cast<std::uint32_t>(request.context.vertex->pointSizeMax));
     }
     writer.WriteBool(request.target.fusedExactArithmetic);
+    writer.WriteBool(request.target.largePixelFunctionLdsBuffer);
+    writer.WriteU32(request.target.pixelFunctionStorageDwords);
     return base64Encode(buffer);
 }
 
@@ -879,7 +897,7 @@ DeserializedRequest RequestSerializer::Deserialize(std::string_view text) const
     Reader reader(decoded);
     if (reader.ReadU32() != 0x41505335u) throw std::runtime_error("invalid recompile request signature");
     const auto version = reader.ReadU32();
-    if (version < 1u || version > 44u) throw std::runtime_error("unsupported recompile request serialization version");
+    if (version < 1u || version > 46u) throw std::runtime_error("unsupported recompile request serialization version");
     DeserializedRequest result{};
     result.request.shader = readShaderBinary(reader, result.shaderCode, result.shaderHeader);
     result.request.context = readGuestContext(reader, result, version);
@@ -934,6 +952,10 @@ DeserializedRequest RequestSerializer::Deserialize(std::string_view text) const
         result.vertex = vertex;
     }
     if (version >= 44u) result.request.target.fusedExactArithmetic = reader.ReadBool();
+    if (version >= 45u) {
+        result.request.target.largePixelFunctionLdsBuffer = reader.ReadBool();
+        result.request.target.pixelFunctionStorageDwords = reader.ReadU32();
+    }
     if (version >= 21u && reader.Remaining() != 0u) throw std::runtime_error("RequestSerializer: unexpected trailing data");
     return result;
 }
diff --git a/core/shader/recompiler/ControlFlow/src/Structurizer.cpp b/core/shader/recompiler/ControlFlow/src/Structurizer.cpp
index 3267461138..19da8b5235 100644
--- a/core/shader/recompiler/ControlFlow/src/Structurizer.cpp
+++ b/core/shader/recompiler/ControlFlow/src/Structurizer.cpp
@@ -52,6 +52,83 @@ bool inPlaceIntersections() {
     return enabled;
 }
 
+bool dominatorTrees() {
+    static const bool enabled = std::getenv("APS5_NO_PERF_DOMINATOR_TREE") == nullptr;
+    return enabled;
+}
+
+template <typename IncomingOf>
+bool assignTreeDominators(std::vector<BasicBlock>& blocks, const std::vector<std::uint32_t>& roots, IncomingOf incomingOf, std::vector<std::uint32_t> BasicBlock::*sets, std::uint32_t BasicBlock::*parent = nullptr) {
+    const auto count = static_cast<std::uint32_t>(blocks.size());
+    const auto virtualRoot = count;
+    std::vector<bool> isRoot(count, false);
+    std::vector<std::vector<std::uint32_t>> outgoing(count + 1u);
+    for (const auto root : roots) {
+        isRoot[root] = true;
+        outgoing[virtualRoot].push_back(root);
+    }
+    for (std::uint32_t id = 0; id < count; ++id) {
+        if (isRoot[id]) continue;
+        for (const auto from : incomingOf(id)) outgoing[from].push_back(id);
+    }
+    std::vector<std::uint32_t> postOrder(count + 1u, InvalidControlFlowId);
+    std::vector<std::uint32_t> order;
+    order.reserve(count + 1u);
+    std::vector<std::pair<std::uint32_t, std::size_t>> stack = {{virtualRoot, 0u}};
+    postOrder[virtualRoot] = 0;
+    while (!stack.empty()) {
+        auto& [node, next] = stack.back();
+        if (next < outgoing[node].size()) {
+            const auto target = outgoing[node][next++];
+            if (postOrder[target] == InvalidControlFlowId) {
+                postOrder[target] = 0;
+                stack.emplace_back(target, 0u);
+            }
+            continue;
+        }
+        postOrder[node] = static_cast<std::uint32_t>(order.size());
+        order.push_back(node);
+        stack.pop_back();
+    }
+    if (order.size() != count + 1u) {
+        return false;
+    }
+    std::vector<std::uint32_t> immediate(count + 1u, InvalidControlFlowId);
+    immediate[virtualRoot] = virtualRoot;
+    const auto intersect = [&](std::uint32_t first, std::uint32_t second) {
+        while (first != second) {
+            while (postOrder[first] < postOrder[second]) first = immediate[first];
+            while (postOrder[second] < postOrder[first]) second = immediate[second];
+        }
+        return first;
+    };
+    for (bool changed = true; changed;) {
+        changed = false;
+        for (auto position = order.size() - 1u; position-- > 0u;) {
+            const auto node = order[position];
+            auto next = isRoot[node] ? virtualRoot : InvalidControlFlowId;
+            if (!isRoot[node]) {
+                for (const auto from : incomingOf(node)) {
+                    if (immediate[from] != InvalidControlFlowId) next = next == InvalidControlFlowId ? from : intersect(from, next);
+                }
+            }
+            if (immediate[node] != next) {
+                immediate[node] = next;
+                changed = true;
+            }
+        }
+    }
+    for (auto position = order.size() - 1u; position-- > 0u;) {
+        const auto node = order[position];
+        auto& set = blocks[node].*sets;
+        if (immediate[node] == virtualRoot) set.clear();
+        else set = blocks[immediate[node]].*sets;
+        set.insert(std::upper_bound(set.begin(), set.end(), node), node);
+        if (parent != nullptr) blocks[node].*parent = immediate[node] == virtualRoot ? node : immediate[node];
+    }
+    return true;
+}
+
 struct BlockSet {
     std::vector<std::uint64_t> words;
 
@@ -91,6 +168,10 @@ struct BlockSet {
         words[static_cast<std::size_t>(id) / 64u] |= std::uint64_t{1} << (id % 64u);
     }
 
+    bool has(std::uint32_t id) const {
+        return (words[static_cast<std::size_t>(id) / 64u] >> (id % 64u) & 1u) != 0u;
+    }
+
     void intersect(const BlockSet& other) {
         for (std::size_t i = 0; i < words.size(); ++i) words[i] &= other.words[i];
     }
@@ -160,6 +241,10 @@ void addSortedUnique(std::vector<std::uint32_t>& values, std::uint32_t value) {
     }
 }
 
+bool containsSorted(const std::vector<std::uint32_t>& values, std::uint32_t value) {
+    return std::binary_search(values.begin(), values.end(), value);
+}
+
 bool replaceValue(std::vector<std::uint32_t>& values, std::uint32_t oldValue, std::uint32_t newValue) {
     bool changed = false;
     for (auto& value : values) {
@@ -203,6 +288,7 @@ std::vector<std::uint32_t> applyBlockOrder(ControlFlowGraph& graph, std::vector<
     graph.entryBlock = remapId(graph.entryBlock, idMap);
     for (auto& block : graph.blocks) {
         block.id = remapId(block.id, idMap);
+        block.immediatePostDominator = remapId(block.immediatePostDominator, idMap);
         remapIds(block.predecessors, idMap);
         remapIds(block.successors, idMap);
         remapIds(block.dominators, idMap);
@@ -248,10 +334,11 @@ std::uint32_t moveBlockBefore(ControlFlowGraph& graph, std::uint32_t blockId, st
 
 std::vector<std::uint32_t> dominatedBlocks(const ControlFlowGraph& graph, std::uint32_t headerBlock, std::uint32_t stopBlock = InvalidControlFlowId) {
     std::vector<std::uint32_t> blocks;
+    if (headerBlock == stopBlock || !graph.Dominates(headerBlock, headerBlock)) {
+        return blocks;
+    }
     std::vector<std::uint32_t> stack = {headerBlock};
     std::vector<bool> visited(graph.blocks.size());
-    blocks.reserve(graph.blocks.size());
-    stack.reserve(graph.blocks.size());
 
     while (!stack.empty()) {
         const auto blockId = stack.back();
@@ -259,7 +346,7 @@ std::vector<std::uint32_t> dominatedBlocks(const ControlFlowGraph& graph, std::u
         if (blockId >= visited.size()) {
             visited.resize(blockId + 1);
         }
-        if (blockId == stopBlock || visited[blockId] || !graph.Dominates(headerBlock, blockId)) {
+        if (visited[blockId]) {
             continue;
         }
 
@@ -267,7 +354,7 @@ std::vector<std::uint32_t> dominatedBlocks(const ControlFlowGraph& graph, std::u
         visited[blockId] = true;
         blocks.push_back(blockId);
         for (const auto successor : block.successors) {
-            if (successor != stopBlock && graph.Dominates(headerBlock, successor)) {
+            if (successor != stopBlock && (successor >= visited.size() || !visited[successor]) && graph.Dominates(headerBlock, successor)) {
                 stack.push_back(successor);
             }
         }
@@ -319,7 +406,7 @@ bool isolateSemanticLoopHeader(ControlFlowGraph& graph, std::uint32_t oldHeader,
 const NaturalLoop* findInnermostContainingLoop(const ControlFlowGraph& graph, std::uint32_t blockId) {
     const NaturalLoop* innermost = nullptr;
     for (const auto& loop : graph.naturalLoops) {
-        if (contains(loop.blocks, blockId) && (innermost == nullptr || loop.blocks.size() < innermost->blocks.size())) {
+        if (containsSorted(loop.blocks, blockId) && (innermost == nullptr || loop.blocks.size() < innermost->blocks.size())) {
             innermost = &loop;
         }
     }
@@ -811,8 +898,8 @@ bool isInnermostLoopControlConditional(const ControlFlowGraph& graph, const Basi
         };
         return isRepeatTarget(trueTarget) && isRepeatTarget(falseTarget);
     }
-    const bool trueInBody = contains(loop->blocks, trueTarget);
-    const bool falseInBody = contains(loop->blocks, falseTarget);
+    const bool trueInBody = containsSorted(loop->blocks, trueTarget);
+    const bool falseInBody = containsSorted(loop->blocks, falseTarget);
     if (trueInBody != falseInBody) {
         return true;
     }
@@ -832,8 +919,8 @@ std::uint32_t exitTailSelectionMerge(const ControlFlowGraph& graph, const BasicB
     }
     const auto trueTarget = block.terminator.trueBlock;
     const auto falseTarget = block.terminator.falseBlock;
-    const bool trueInBody = contains(loop->blocks, trueTarget);
-    if (trueInBody == contains(loop->blocks, falseTarget)) {
+    const bool trueInBody = containsSorted(loop->blocks, trueTarget);
+    if (trueInBody == containsSorted(loop->blocks, falseTarget)) {
         return InvalidControlFlowId;
     }
     const auto body = trueInBody ? trueTarget : falseTarget;
@@ -854,7 +941,7 @@ std::uint32_t exitTailSelectionMerge(const ControlFlowGraph& graph, const BasicB
             if (successor == loop->mergeBlock) {
                 continue;
             }
-            if (contains(loop->blocks, successor) || !graph.Dominates(tail, successor) || !isInsideLoopConstruct(graph, *loop, successor)) {
+            if (containsSorted(loop->blocks, successor) || !graph.Dominates(tail, successor) || !isInsideLoopConstruct(graph, *loop, successor)) {
                 return InvalidControlFlowId;
             }
             pending.push_back(successor);
@@ -886,8 +973,9 @@ bool mergeLeavesContainingLoop(const ControlFlowGraph& graph, std::uint32_t head
     return false;
 }
 
-bool splitSharedMergeBlock(ControlFlowGraph& graph, std::uint32_t merge, const std::vector<std::uint32_t>& constructBlocks, bool forceSplit = false) {
-    if (merge == InvalidControlFlowId || merge >= graph.blocks.size() || contains(constructBlocks, merge)) {
+template <typename InConstruct>
+bool splitSharedMergeBlock(ControlFlowGraph& graph, std::uint32_t merge, InConstruct inConstruct, bool forceSplit = false) {
+    if (merge == InvalidControlFlowId || merge >= graph.blocks.size() || inConstruct(merge)) {
         return false;
     }
 
@@ -895,7 +983,7 @@ bool splitSharedMergeBlock(ControlFlowGraph& graph, std::uint32_t merge, const s
     std::vector<std::uint32_t> constructPredecessors;
     bool hasExternalPredecessor = false;
     for (const auto predecessor : mergeBlock.predecessors) {
-        if (contains(constructBlocks, predecessor)) {
+        if (inConstruct(predecessor)) {
             addUnique(constructPredecessors, predecessor);
         } else {
             hasExternalPredecessor = true;
@@ -928,6 +1016,29 @@ bool splitSharedMergeBlock(ControlFlowGraph& graph, std::uint32_t merge, const s
     return true;
 }
 
+bool splitSharedMergeBlock(ControlFlowGraph& graph, std::uint32_t merge, const std::vector<std::uint32_t>& constructBlocks, bool forceSplit = false) {
+    return splitSharedMergeBlock(graph, merge, [&](std::uint32_t blockId) { return containsSorted(constructBlocks, blockId); }, forceSplit);
+}
+
+bool constructsFollowDominance(const ControlFlowGraph& graph) {
+    if (!inPlaceIntersections() || !dominatorTrees() || graph.entryBlock >= graph.blocks.size() || reversePostOrder(graph).size() != graph.blocks.size()) {
+        return false;
+    }
+    for (const auto& block : graph.blocks) {
+        for (const auto successor : block.successors) {
+            if (!containsSorted(graph.blocks[successor].predecessors, block.id)) {
+                return false;
+            }
+        }
+        for (const auto predecessor : block.predecessors) {
+            if (!contains(graph.blocks[predecessor].successors, block.id)) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+
 bool splitOneReturnJoin(ControlFlowGraph& graph, bool relaxReturnJoins) {
     for (const auto& block : graph.blocks) {
         if (block.terminator.kind != TerminatorKind::ConditionalBranch || findInnermostContainingLoop(graph, block.id) != nullptr || findSelectionMerge(graph, block) != InvalidControlFlowId) {
@@ -962,21 +1073,21 @@ bool splitOneLoopMerge(ControlFlowGraph& graph) {
 }
 
 std::vector<std::uint32_t> selectionRegion(const ControlFlowGraph& graph, const BasicBlock& header, std::uint32_t merge) {
-    std::vector<std::uint32_t> region;
+    const auto count = static_cast<std::uint32_t>(graph.blocks.size());
+    auto region = BlockSet::none(count);
     std::vector<std::uint32_t> pending = {header.terminator.trueBlock, header.terminator.falseBlock};
     const auto* loop = findInnermostContainingLoop(graph, header.id);
     while (!pending.empty()) {
         const auto blockId = pending.back();
         pending.pop_back();
-        if (blockId == merge || contains(region, blockId) || (loop != nullptr && (blockId == loop->mergeBlock || blockId == loop->continueBlock))) {
+        if (blockId == merge || (blockId < count && region.has(blockId)) || (loop != nullptr && (blockId == loop->mergeBlock || blockId == loop->continueBlock))) {
             continue;
         }
         const auto& block = graph.FindBlock(blockId);
-        addUnique(region, blockId);
+        region.add(blockId);
         pending.insert(pending.end(), block.successors.begin(), block.successors.end());
     }
-    sortUnique(region);
-    return region;
+    return region.ids();
 }
 
 constexpr std::uint32_t CloneWordLimit = 1024u;
@@ -1034,9 +1145,11 @@ using Edge = std::pair<std::uint32_t, std::uint32_t>;
 
 std::vector<Edge> externalEntryEdges(const ControlFlowGraph& graph, std::uint32_t header, const std::vector<std::uint32_t>& region) {
     std::vector<Edge> edges;
+    const auto count = static_cast<std::uint32_t>(graph.blocks.size());
+    const auto inRegion = BlockSet::fromIds(count, region);
     for (const auto member : region) {
         for (const auto predecessor : graph.FindBlock(member).predecessors) {
-            if (predecessor == header || contains(region, predecessor)) {
+            if (predecessor == header || (predecessor < count && inRegion.has(predecessor))) {
                 continue;
             }
             if (graph.Dominates(member, predecessor)) {
@@ -1050,6 +1163,7 @@ std::vector<Edge> externalEntryEdges(const ControlFlowGraph& graph, std::uint32_
 
 std::vector<std::uint32_t> reachableWithin(const ControlFlowGraph& graph, const std::vector<Edge>& entryEdges, const std::vector<std::uint32_t>& region) {
     std::vector<std::uint32_t> reached;
+    std::vector<bool> isReached(graph.blocks.size(), false);
     std::vector<std::uint32_t> pending;
     for (const auto& edge : entryEdges) {
         pending.push_back(edge.second);
@@ -1057,12 +1171,13 @@ std::vector<std::uint32_t> reachableWithin(const ControlFlowGraph& graph, const
     while (!pending.empty()) {
         const auto blockId = pending.back();
         pending.pop_back();
-        if (contains(reached, blockId)) {
+        if (isReached[blockId]) {
             continue;
         }
+        isReached[blockId] = true;
         reached.push_back(blockId);
         for (const auto successor : graph.FindBlock(blockId).successors) {
-            if (contains(region, successor)) {
+            if (containsSorted(region, successor)) {
                 pending.push_back(successor);
             }
         }
@@ -1131,6 +1246,7 @@ void cloneBlocks(ControlFlowGraph& graph, const std::vector<std::uint32_t>& bloc
         copy.predecessors.clear();
         copy.dominators.clear();
         copy.postDominators.clear();
+        copy.immediatePostDominator = InvalidControlFlowId;
         for (const auto& [original, clone] : cloneOf) {
             redirectEdge(copy, original, clone);
         }
@@ -1494,15 +1610,17 @@ bool splitOneSelectionMerge(ControlFlowGraph& graph, SplitBudget& budget, const
     std::vector<std::uint32_t> loopHeaders;
     loopHeaders.reserve(graph.naturalLoops.size());
     for (const auto& loop : graph.naturalLoops) {
-        addUnique(loopHeaders, loop.headerBlock);
+        loopHeaders.push_back(loop.headerBlock);
     }
+    sortUnique(loopHeaders);
 
     std::vector<std::uint32_t> selectionHeaders;
     for (const auto& block : graph.blocks) {
-        if (block.terminator.kind == TerminatorKind::ConditionalBranch && !contains(loopHeaders, block.id)) {
+        if (block.terminator.kind == TerminatorKind::ConditionalBranch && !containsSorted(loopHeaders, block.id)) {
             selectionHeaders.push_back(block.id);
         }
     }
+    const bool dominanceConstructs = constructsFollowDominance(graph);
     std::sort(selectionHeaders.begin(), selectionHeaders.end(), [&](std::uint32_t lhs, std::uint32_t rhs) {
         const auto lhsDepth = graph.FindBlock(lhs).dominators.size();
         const auto rhsDepth = graph.FindBlock(rhs).dominators.size();
@@ -1525,6 +1643,13 @@ bool splitOneSelectionMerge(ControlFlowGraph& graph, SplitBudget& budget, const
             return true;
         }
 
+        if (dominanceConstructs && merge != blockId && graph.Dominates(blockId, blockId) && !graph.Dominates(merge, blockId)) {
+            const auto inConstruct = [&](std::uint32_t member) { return member != merge && graph.Dominates(blockId, member) && !graph.Dominates(merge, member); };
+            if (splitSharedMergeBlock(graph, merge, inConstruct, mergeLeavesContainingLoop(graph, blockId, merge))) {
+                return true;
+            }
+            continue;
+        }
         const auto constructBlocks = dominatedBlocks(graph, blockId, merge);
         const auto forceSplit = mergeLeavesContainingLoop(graph, blockId, merge);
         if (splitSharedMergeBlock(graph, merge, constructBlocks, forceSplit)) {
@@ -1536,10 +1661,13 @@ bool splitOneSelectionMerge(ControlFlowGraph& graph, SplitBudget& budget, const
 
 std::vector<std::uint32_t> naturalLoopBody(const ControlFlowGraph& graph, std::uint32_t headerBlock, std::uint32_t latchBlock, bool& natural) {
     std::vector<std::uint32_t> body;
+    std::vector<bool> inBody(graph.blocks.size(), false);
     std::vector<std::uint32_t> stack;
     natural = true;
     addUnique(body, headerBlock);
     addUnique(body, latchBlock);
+    inBody[headerBlock] = true;
+    inBody[latchBlock] = true;
     if (latchBlock != headerBlock) {
         stack.push_back(latchBlock);
     }
@@ -1552,7 +1680,8 @@ std::vector<std::uint32_t> naturalLoopBody(const ControlFlowGraph& graph, std::u
             if (!graph.Dominates(headerBlock, predecessor)) {
                 natural = false;
             }
-            if (!contains(body, predecessor)) {
+            if (!inBody[predecessor]) {
+                inBody[predecessor] = true;
                 body.push_back(predecessor);
                 if (predecessor != headerBlock) {
                     stack.push_back(predecessor);
@@ -1575,27 +1704,7 @@ struct TarjanState {
     std::vector<StronglyConnectedComponent> components;
 };
 
-void tarjanVisit(TarjanState& state, std::uint32_t blockId) {
-    state.index[blockId] = state.nextIndex;
-    state.lowlink[blockId] = state.nextIndex;
-    ++state.nextIndex;
-    state.stack.push_back(blockId);
-    state.onStack[blockId] = true;
-
-    const auto& block = state.graph->FindBlock(blockId);
-    for (const auto successor : block.successors) {
-        if (state.index[successor] == InvalidControlFlowId) {
-            tarjanVisit(state, successor);
-            state.lowlink[blockId] = std::min(state.lowlink[blockId], state.lowlink[successor]);
-        } else if (state.onStack[successor]) {
-            state.lowlink[blockId] = std::min(state.lowlink[blockId], state.index[successor]);
-        }
-    }
-
-    if (state.lowlink[blockId] != state.index[blockId]) {
-        return;
-    }
-
+void emitComponent(TarjanState& state, std::uint32_t blockId) {
     StronglyConnectedComponent component;
     for (;;) {
         const auto member = state.stack.back();
@@ -1615,7 +1724,7 @@ void tarjanVisit(TarjanState& state, std::uint32_t blockId) {
             cyclic = true;
         }
         for (const auto predecessor : memberBlock.predecessors) {
-            if (!contains(component.blocks, predecessor)) {
+            if (!containsSorted(component.blocks, predecessor)) {
                 addUnique(component.entryBlocks, member);
             }
         }
@@ -1625,6 +1734,45 @@ void tarjanVisit(TarjanState& state, std::uint32_t blockId) {
     state.components.push_back(std::move(component));
 }
 
+void tarjanVisit(TarjanState& state, std::uint32_t root) {
+    struct Frame {
+        std::uint32_t blockId;
+        const std::vector<std::uint32_t>* successors;
+        std::size_t next;
+    };
+    std::vector<Frame> work;
+    const auto enter = [&](std::uint32_t blockId) {
+        state.index[blockId] = state.nextIndex;
+        state.lowlink[blockId] = state.nextIndex;
+        ++state.nextIndex;
+        state.stack.push_back(blockId);
+        state.onStack[blockId] = true;
+        work.push_back({blockId, &state.graph->FindBlock(blockId).successors, 0u});
+    };
+    enter(root);
+    while (!work.empty()) {
+        auto& frame = work.back();
+        const auto blockId = frame.blockId;
+        if (frame.next < frame.successors->size()) {
+            const auto successor = (*frame.successors)[frame.next++];
+            if (state.index[successor] == InvalidControlFlowId) {
+                enter(successor);
+            } else if (state.onStack[successor]) {
+                state.lowlink[blockId] = std::min(state.lowlink[blockId], state.index[successor]);
+            }
+            continue;
+        }
+        work.pop_back();
+        if (!work.empty()) {
+            auto& parent = state.lowlink[work.back().blockId];
+            parent = std::min(parent, state.lowlink[blockId]);
+        }
+        if (state.lowlink[blockId] == state.index[blockId]) {
+            emitComponent(state, blockId);
+        }
+    }
+}
+
 bool forcedFlagStructurization() {
     static const bool forced = std::getenv("APS5_FORCE_STRUCTURIZER_FALLBACK") != nullptr;
     return forced;
@@ -2143,6 +2291,9 @@ void Structurizer::structurize(ControlFlowGraph& graph, bool privatizeReturns, b
 
 void Structurizer::computeDominatorTree(ControlFlowGraph& graph) const {
     const auto count = static_cast<std::uint32_t>(graph.blocks.size());
+    if (inPlaceIntersections() && dominatorTrees() && graph.entryBlock < count && assignTreeDominators(graph.blocks, {graph.entryBlock}, [&](std::uint32_t id) -> const std::vector<std::uint32_t>& { return graph.blocks[id].predecessors; }, &BasicBlock::dominators)) {
+        return;
+    }
     const auto order = analysisOrder(graph, false);
     if (inPlaceIntersections()) {
         std::vector<BlockSet> sets;
@@ -2206,7 +2357,7 @@ void Structurizer::detectNaturalLoops(ControlFlowGraph& graph) const {
         for (const auto blockId : loop.blocks) {
             const auto& block = graph.FindBlock(blockId);
             for (const auto successor : block.successors) {
-                if (!contains(loop.blocks, successor)) {
+                if (!containsSorted(loop.blocks, successor)) {
                     addUnique(loop.exitBlocks, successor);
                 }
             }
@@ -2227,6 +2378,16 @@ void Structurizer::detectNaturalLoops(ControlFlowGraph& graph) const {
 
 void Structurizer::computePostDominators(ControlFlowGraph& graph) const {
     const auto count = static_cast<std::uint32_t>(graph.blocks.size());
+    if (inPlaceIntersections() && dominatorTrees()) {
+        std::vector<std::uint32_t> exits;
+        for (const auto& block : graph.blocks) {
+            if (block.successors.empty()) exits.push_back(block.id);
+        }
+        if (assignTreeDominators(graph.blocks, exits, [&](std::uint32_t id) -> const std::vector<std::uint32_t>& { return graph.blocks[id].successors; }, &BasicBlock::postDominators, &BasicBlock::immediatePostDominator)) {
+            return;
+        }
+    }
+    for (auto& block : graph.blocks) block.immediatePostDominator = InvalidControlFlowId;
     const auto order = analysisOrder(graph, true);
     if (inPlaceIntersections()) {
         std::vector<BlockSet> sets;
@@ -2335,7 +2496,8 @@ void Structurizer::canonicalizeNaturalLoops(ControlFlowGraph& graph, bool routeL
             });
             const auto& header = graph.FindBlock(loop.headerBlock);
             const bool semanticSelfLoop = latches.size() == 1u && latches.front() == header.id && header.instructionBegin != header.instructionEnd;
-            if (latches.size() <= 1u && !latchInInnerLoop && !semanticSelfLoop) {
+            const bool semanticLatch = latches.size() == 1u && graph.FindBlock(latches.front()).instructionBegin != graph.FindBlock(latches.front()).instructionEnd && graph.FindBlock(latches.front()).predecessors.size() == 1u;
+            if (latches.size() <= 1u && !latchInInnerLoop && !semanticSelfLoop && !semanticLatch) {
                 continue;
             }
 
@@ -2469,13 +2631,21 @@ void Structurizer::verifyReducibility(const ControlFlowGraph& graph) const {
 }
 
 bool Structurizer::hasStructuredConstructs(const ControlFlowGraph& graph) const {
+    std::vector<const BasicBlock*> loopHeaders;
+    for (const auto& block : graph.blocks) {
+        if (block.terminator.loopHeader) loopHeaders.push_back(&block);
+    }
+    const auto innermostLoop = [&](const ControlFlowGraph& analysis, std::uint32_t blockId) {
+        const BasicBlock* innermost = nullptr;
+        for (const auto* header : loopHeaders) {
+            if (analysis.Dominates(header->id, blockId) && !analysis.Dominates(header->terminator.mergeBlock, blockId) && (innermost == nullptr || analysis.Dominates(innermost->id, header->id))) innermost = header;
+        }
+        return innermost;
+    };
     for (const auto& block : graph.blocks) {
         const auto& terminator = block.terminator;
         if (terminator.kind != TerminatorKind::ConditionalBranch || terminator.loopHeader || terminator.mergeBlock != InvalidControlFlowId || terminator.trueBlock == terminator.falseBlock) continue;
-        const BasicBlock* loop = nullptr;
-        for (const auto& header : graph.blocks) {
-            if (header.terminator.loopHeader && graph.Dominates(header.id, block.id) && !graph.Dominates(header.terminator.mergeBlock, block.id) && (loop == nullptr || graph.Dominates(loop->id, header.id))) loop = &header;
-        }
+        const auto* loop = innermostLoop(graph, block.id);
         if (loop == nullptr || (terminator.trueBlock != loop->terminator.mergeBlock && terminator.trueBlock != loop->terminator.continueBlock && terminator.falseBlock != loop->terminator.mergeBlock && terminator.falseBlock != loop->terminator.continueBlock)) return false;
     }
     auto structural = graph;
@@ -2499,18 +2669,10 @@ bool Structurizer::hasStructuredConstructs(const ControlFlowGraph& graph) const
     const auto inConstruct = [&](const BasicBlock& header, std::uint32_t blockId) {
         return inRegion(header, blockId) && !(header.terminator.loopHeader && inContinue(header, blockId));
     };
-    const auto innermostLoop = [&](std::uint32_t blockId) {
-        const BasicBlock* innermost = nullptr;
-        for (const auto& header : graph.blocks) {
-            if (header.terminator.loopHeader && inRegion(header, blockId) && (innermost == nullptr || structural.Dominates(innermost->id, header.id))) {
-                innermost = &header;
-            }
-        }
-        return innermost;
-    };
     const auto exitsLoop = [](const BasicBlock* loop, std::uint32_t target) {
         return loop != nullptr && (target == loop->terminator.mergeBlock || target == loop->terminator.continueBlock);
     };
+    const bool walkConstructs = constructsFollowDominance(structural);
     for (const auto& block : graph.blocks) {
         const auto& terminator = block.terminator;
         for (const auto successor : block.successors) {
@@ -2520,7 +2682,7 @@ bool Structurizer::hasStructuredConstructs(const ControlFlowGraph& graph) const
             }
         }
         if (terminator.kind == TerminatorKind::ConditionalBranch && !terminator.loopHeader && terminator.mergeBlock == InvalidControlFlowId && terminator.trueBlock != terminator.falseBlock) {
-            const auto* loop = innermostLoop(block.id);
+            const auto* loop = innermostLoop(structural, block.id);
             if (!exitsLoop(loop, terminator.trueBlock) && !exitsLoop(loop, terminator.falseBlock)) {
                 return false;
             }
@@ -2534,8 +2696,8 @@ bool Structurizer::hasStructuredConstructs(const ControlFlowGraph& graph) const
         if (terminator.loopHeader && (terminator.continueBlock == terminator.mergeBlock || !structural.Dominates(block.id, terminator.continueBlock))) {
             return false;
         }
-        const auto* loop = terminator.loopHeader ? &block : innermostLoop(block.id);
-        for (const auto& member : graph.blocks) {
+        const auto* loop = terminator.loopHeader ? &block : innermostLoop(structural, block.id);
+        const auto memberFits = [&](const BasicBlock& member) {
             if (inConstruct(block, member.id)) {
                 if (member.id != block.id && member.terminator.mergeBlock != InvalidControlFlowId && !inConstruct(block, member.terminator.mergeBlock)) {
                     return false;
@@ -2551,6 +2713,20 @@ bool Structurizer::hasStructuredConstructs(const ControlFlowGraph& graph) const
                     return false;
                 }
             }
+            return true;
+        };
+        if (walkConstructs) {
+            auto members = dominatedBlocks(structural, block.id, terminator.mergeBlock);
+            if (terminator.loopHeader) {
+                const auto continueMembers = dominatedBlocks(structural, terminator.continueBlock);
+                members.insert(members.end(), continueMembers.begin(), continueMembers.end());
+                sortUnique(members);
+            }
+            if (!std::all_of(members.begin(), members.end(), [&](std::uint32_t memberId) { return memberFits(graph.FindBlock(memberId)); })) {
+                return false;
+            }
+        } else if (!std::all_of(graph.blocks.begin(), graph.blocks.end(), memberFits)) {
+            return false;
         }
         if (terminator.loopHeader) {
             const auto& predecessors = graph.FindBlock(terminator.continueBlock).predecessors;
diff --git a/core/shader/recompiler/FragmentOutputSpecialization.hpp b/core/shader/recompiler/FragmentOutputSpecialization.hpp
index 00894c6af1..515c9d635f 100644
--- a/core/shader/recompiler/FragmentOutputSpecialization.hpp
+++ b/core/shader/recompiler/FragmentOutputSpecialization.hpp
@@ -32,7 +32,7 @@ inline std::vector<std::uint32_t> SpecializeFragmentOutputs(std::vector<std::uin
             reversed = constant.value;
         }
         if (constant.id < PipelineSpecialization::ExportPackingBase || constant.id >= PipelineSpecialization::ExportPackingBase + 8u) continue;
-        if (constant.value > static_cast<std::uint32_t>(ColorExportPacking::Float11_11_10)) throw std::runtime_error("invalid prepared fragment export packing");
+        if (constant.value > static_cast<std::uint32_t>(ColorExportPacking::Uint)) throw std::runtime_error("invalid prepared fragment export packing");
         if (constant.value != static_cast<std::uint32_t>(ColorExportPacking::None)) packed.insert(constant.id - PipelineSpecialization::ExportPackingBase);
     }
     if (packed.empty() && !dualSource && reversed == 0u) return words;
diff --git a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp
index 307b83cdff..e639277ea3 100644
--- a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp
+++ b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp
@@ -96,6 +96,7 @@ struct ImageResource {
     bool volumeArraySampleCompatible = false;
     bool flatLineCompatible = true;
     bool flatVolumeLineCompatible = true;
+    bool dimensionQueryOnly = true;
     bool foldTexelOffsetsOnly = false;
     bool convertedSamples = false;
     bool remappedDepth1D = false;
@@ -105,6 +106,7 @@ struct ImageResource {
     std::uint32_t emulatedCompare = 0;
     std::uint32_t table = NoTable;
     TableOperation tableOperation = TableOperation::Supported;
+    bool targetMerge = false;
 
     bool operator==(const ImageResource& other) const = default;
 };
diff --git a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp
index c1ed5e72ed..c6b34841ba 100644
--- a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp
+++ b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp
@@ -74,6 +74,7 @@ enum class IrOpcode : std::uint16_t {
     Reference,
     ReferenceU32,
     UnlinkedCall,
+    WindowLaneGuard,
     GetUserData,
     GetShaderBase,
     ShaderClock,
diff --git a/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp b/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp
index b3622f4c6a..22ec648a27 100644
--- a/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp
@@ -115,6 +115,7 @@ constexpr std::array<OpcodeMeta, static_cast<std::size_t>(IrOpcode::Count)> Meta
     makeMeta("Reference", Void, U1),
     makeMeta("ReferenceU32", Void, U32),
     makeMeta("UnlinkedCall", Void, U32, U32, U32),
+    makeMeta("WindowLaneGuard", Void, U32, U32, U32, U32, U32),
     makeMeta("GetUserData", U32, ScalarReg),
     makeMeta("GetShaderBase", U64),
     makeMeta("ShaderClock", U64),
@@ -894,6 +895,7 @@ bool IrOpcodeHasSideEffects(IrOpcode opcode) {
         case IrOpcode::Reference:
         case IrOpcode::ReferenceU32:
         case IrOpcode::UnlinkedCall:
+        case IrOpcode::WindowLaneGuard:
         case IrOpcode::SetTessellationAttribute:
         case IrOpcode::InterpolateHostP2:
         case IrOpcode::SetThreadBitScalarRegister:
diff --git a/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp b/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp
index 08dba6b1d9..4278d1a771 100644
--- a/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp
@@ -173,6 +173,21 @@ std::string formatHex64(std::uint64_t value) {
     return stream.str();
 }
 
+bool carriesMemoryInfo(IrOpcode opcode) {
+    return opcode == IrOpcode::ReadConstBuffer || AddressOpcodeInfoOf(opcode).access != AddressAccess::None || BufferComponentCount(opcode) != 0u || SharedComponentCount(opcode) != 0u || ImageOpcodeInfoOf(opcode).access != ImageAccess::None;
+}
+
+std::string memoryToString(const IrProgram& program, const IrValue& inst) {
+    const auto flags = inst.Flags<MemoryFlags>();
+    const auto& memoryInfo = program.Resources().memoryInfo;
+    if (flags.index >= memoryInfo.size()) {
+        return " [pc=" + formatHex32(flags.pc) + " mem=?]";
+    }
+    std::ostringstream stream;
+    stream << " [pc=" << formatHex32(flags.pc) << " off=0x" << std::hex << memoryInfo[flags.index].offset << "]";
+    return stream.str();
+}
+
 std::string valueToString(const std::map<const IrValue*, std::size_t>& ids, const IrValue* value) {
     if (value == nullptr) {
         return "<null>";
@@ -404,7 +419,11 @@ std::string ProgramToString(const IrProgram& program) {
                     text += valueToString(ids, inst->Argument(index));
                 }
             }
-            text += " (" + TypeToString(inst->Type()) + "; uses=" + std::to_string(inst->UseCount()) + ")\n";
+            text += " (" + TypeToString(inst->Type()) + "; uses=" + std::to_string(inst->UseCount()) + ")";
+            if (carriesMemoryInfo(inst->Opcode())) {
+                text += memoryToString(program, *inst);
+            }
+            text += "\n";
         }
     }
     return text;
@@ -586,11 +605,11 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             if (fixedSignature && inst->ArgumentCount() != IrOpcodeOperandCount(inst->Opcode())) {
                 fail(std::string(IrOpcodeName(inst->Opcode())) + " has " + std::to_string(inst->ArgumentCount()) + " arguments, expected " + std::to_string(IrOpcodeOperandCount(inst->Opcode())));
             }
+            if (carriesMemoryInfo(inst->Opcode()) && inst->Flags<MemoryFlags>().index >= program.Resources().memoryInfo.size()) {
+                fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
+            }
             if (inst->Opcode() == IrOpcode::ReadConstBuffer) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (memory.kind != ResourceKind::ScalarBuffer) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid scalar-memory resource kind");
@@ -603,9 +622,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto addressInfo = AddressOpcodeInfoOf(inst->Opcode());
             if (addressInfo.access != AddressAccess::None) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (!IsAddressResourceKind(memory.kind) || (memory.kind == ResourceKind::ScalarAddress && inst->Opcode() != IrOpcode::LoadAddressU32)) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid address resource kind");
@@ -620,9 +636,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto bufferComponents = BufferComponentCount(inst->Opcode());
             if (bufferComponents != 0u) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (memory.kind != ResourceKind::Buffer && memory.kind != ResourceKind::ScalarBuffer) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has a non-buffer resource kind");
@@ -637,9 +650,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto sharedComponents = SharedComponentCount(inst->Opcode());
             if (sharedComponents != 0u) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if ((memory.kind != ResourceKind::Lds && memory.kind != ResourceKind::Gds) || memory.resource != 0u || memory.sampler != 0u || memory.componentCount == 0u || memory.componentIndex >= memory.componentCount) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has invalid shared-memory metadata");
@@ -657,9 +667,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto imageInfo = ImageOpcodeInfoOf(inst->Opcode());
             if (imageInfo.access != ImageAccess::None) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (memory.kind != ResourceKind::Image || imageInfo.resourceClass == ImageResourceClass::None) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has invalid image-memory metadata");
diff --git a/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp b/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp
index a7cc1db50d..6d1e69deb7 100644
--- a/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp
@@ -39,9 +39,11 @@ void IrValue::ReplaceArgument(std::size_t index, IrValue* argument) {
     }
     IrValue* previous = arguments[index];
     if (previous != nullptr) {
-        const auto operandIt = std::find_if(previous->operandUses.begin(), previous->operandUses.end(), [this, index](const IrUse& use) {
-            return use.user == this && use.operand == index;
-        });
+        const auto operandIt = !previous->operandUses.empty() && previous->operandUses.back() == IrUse{this, index}
+            ? previous->operandUses.end() - 1
+            : std::find_if(previous->operandUses.begin(), previous->operandUses.end(), [this, index](const IrUse& use) {
+                return use.user == this && use.operand == index;
+            });
         if (operandIt != previous->operandUses.end()) {
             previous->operandUses.erase(operandIt);
         }
diff --git a/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp b/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp
index 0849790845..f5a711b969 100644
--- a/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp
@@ -101,6 +101,23 @@ void CheckSimpleReplacement() {
     Require(source->Opcode() == IrOpcode::IAdd32 && source->Parent() == &graph.block);
 }
 
+void CheckTailArgumentRemoval() {
+    Graph graph(4);
+    auto* source = graph.Value(0);
+    auto* first = graph.Value(1);
+    auto* last = graph.Value(2);
+    first->AddArgument(source);
+    last->AddArgument(source);
+    last->AddArgument(source);
+    last->ReplaceArgument(0, nullptr);
+    Require(source->OperandUses() == std::vector<IrUse>({{first, 0}, {last, 1}}));
+    last->ReplaceArgument(1, graph.Value(3));
+    Require(source->OperandUses() == std::vector<IrUse>({{first, 0}}));
+    Require(graph.Value(3)->OperandUses() == std::vector<IrUse>({{last, 1}}));
+    first->Invalidate();
+    Require(!source->HasUses() && first->Argument(0) == nullptr);
+}
+
 void CheckSelfAndEmpty() {
     Graph graph(3);
     graph.Value(2)->AddArgument(graph.Value(0));
@@ -223,6 +240,7 @@ int main() {
     try {
         const std::pair<const char*, void (*)()> cases[] = {
             {"ordered duplicate operands", CheckSimpleReplacement},
+            {"tail argument removal", CheckTailArgumentRemoval},
             {"self and empty replacement", CheckSelfAndEmpty},
             {"phi and identity rewriting", CheckPhiAndIdentity},
             {"allocation failure integrity", CheckAllocationFailure},
@@ -234,7 +252,7 @@ int main() {
             current = name;
             test();
         }
-        std::puts("7 IR rewrite suites passed; 2000 differential use graphs and 48000 mutation comparisons");
+        std::puts("8 IR rewrite suites passed; 2000 differential use graphs and 48000 mutation comparisons");
         return 0;
     } catch (const std::exception& error) {
         failureAfter = -1;
diff --git a/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp b/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp
index 3aef0d5211..6e820d5fe3 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp
@@ -10,6 +10,7 @@ namespace ShaderRecompiler {
 class DeadCodeEliminator {
 public:
     void Eliminate(IrProgram& program) const;
+    void EliminateUnobservedPhis(IrProgram& program) const;
     void Eliminate(std::span<IrBlock* const> blocks) const;
     void RemoveIdentities(IrProgram& program) const;
     void RemoveIdentities(std::span<IrBlock* const> blocks) const;
diff --git a/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp b/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp
index a52432123a..8fdbe75a07 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp
@@ -8,6 +8,7 @@ namespace ShaderRecompiler {
 
 struct ReadLaneEliminationStats {
     std::uint32_t rewrittenReads = 0;
+    std::uint32_t guardedStores = 0;
 };
 
 class ReadLaneEliminator {
diff --git a/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp b/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp
index 1425a5ec58..ad1a0f01b5 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp
@@ -20,6 +20,8 @@ struct ImageTableElement {
     bool depthCompare = false;
     DescriptorBindingKind kind = DescriptorBindingKind::Buffers;
     std::uint32_t samplers = 0;
+    bool atomic = false;
+    bool atomic64 = false;
 };
 
 struct ImageTableSamplerElement {
diff --git a/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp b/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp
index 3a9286f578..299b838494 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp
@@ -199,6 +199,11 @@ struct ShaderPixelInputInfo {
     bool psIteratesSamples = false;
     PixelPositionLocation psPositionLocation = PixelPositionLocation::Center;
     std::array<std::uint8_t, 32> sampleLocations{};
+    std::uint8_t mergeTarget = 0;
+    std::uint16_t mergeMask = 0;
+    std::uint8_t mergeSamples = 1;
+    bool mergeDepthStencilWrites = false;
+    bool mergeDepthStencilTests = false;
     std::array<std::uint32_t, 4> sampleOrder{};
     ShaderStageRuntime stage;
 
diff --git a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp
index d666acd0f8..776a3c6dd9 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp
@@ -74,6 +74,12 @@ struct InaccessibleRead {
     std::uint64_t address = 0;
 };
 
+enum class EvaluatorReads : std::uint8_t {
+    Nothing,
+    Arguments,
+    Closure,
+};
+
 class DenseValues {
 public:
     struct Slot {
@@ -173,6 +179,8 @@ public:
     BasicEvaluator& operator=(const BasicEvaluator&) = delete;
 
     static bool MayEvaluate(const IrResourcePlan& program, IrValue* value, const IrValue* activeMask = nullptr);
+    static bool MayDecide(const IrResourcePlan& program, IrValue* value);
+    static EvaluatorReads Reads(const IrResourcePlan& program, const IrValue& value);
     bool Evaluate(TNode value, std::uint32_t& result);
     bool EvaluateWide(TNode value, std::uint64_t& result);
     void ReportInaccessibleReads(InaccessibleRead* sink) { _inaccessible = sink; }
diff --git a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp
index fa1310cff9..34a381669e 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp
@@ -10,6 +10,7 @@ namespace ShaderRecompiler::Detail {
 
 bool IsRawRead(const IrResourcePlan& program, const IrValue& inst);
 bool IsRawRead(const IrResourcePlan& program, IrOpcode op, std::uint32_t memoryIndex);
+bool IsMemoryRead(IrOpcode opcode);
 bool LoadedFromMemory(const IrValue& handle);
 bool IsDescriptorHandle(IrOpcode opcode);
 bool IsRuntimeSelect(IrOpcode opcode);
diff --git a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp
index 0dcb1a168d..2e833ba3e7 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp
@@ -26,7 +26,7 @@ private:
     static std::shared_ptr<const SrtTape> Compile(const IrResourcePlan& plan);
     enum class Op : std::uint8_t {
         Fail, Const, UserData, ShaderBase, Read, ReadConstBuffer, ExtractHalf, AddCarry, ConstructU64,
-        ConvertF32U32, ConvertU32F32, FPMul32, FPTrunc32, FPIsNan32, FPOrdLessThanEqual32, FPOrdGreaterThanEqual32,
+        ConvertF32U32, ConvertU32F32, FPMul32, FPTrunc32, FPIsNan32, FPOrdLessThanEqual32, FPOrdGreaterThanEqual32, FPUnordLessThanEqual32, FPUnordGreaterThanEqual32,
         IAdd32, IAdd64, ISub32, ISub64, IMul32, IMul64, SMin32, UMin32, BitwiseAnd32, BitwiseAnd64, BitwiseOr32, BitwiseXor32, BitwiseNot32,
         ShiftLeftLogical32, ShiftLeftLogical64, ShiftRightLogical32, ShiftRightLogical64, ShiftRightArithmetic32, ShiftRightArithmetic64,
         BitFieldUExtract, BitFieldSExtract, BitFieldInsert, Select, IEqual32, INotEqual32, SLessThan32, ULessThan32, UGreaterThan32,
diff --git a/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp b/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
index 170b97d6b8..576ac75a42 100644
--- a/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
+++ b/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
@@ -1,5 +1,6 @@
 #include "Optimization/DescriptorBindingBuilder.hpp"
 #include "Optimization/ResourceMaterializer.hpp"
+#include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include "SpirvBackend/SpirvEmitterHelpers.hpp"
 #include "SpirvBackend/SpirvBufferFormat.hpp"
 #include <spirv/unified1/spirv.hpp>
@@ -138,6 +139,7 @@ std::vector<std::uint32_t> GuestBuffersDescriptor(const std::vector<std::uint32_
 
 std::vector<std::uint32_t> GuestSamplersDescriptor(const std::vector<std::uint32_t>& resources, const ResourceSnapshot& snapshot) {
     std::vector<std::uint32_t> result;
+    result.reserve(resources.size() * 4u);
     std::uint32_t dwordCount = 0;
     for (std::size_t i = 0; i < resources.size(); i++) {
         const std::uint32_t r = resources[i];
@@ -342,7 +344,6 @@ DescriptorBindingPlan DescriptorBindingBuilder::Prepare(const IrBindingLayout& l
             const auto first = PipelineSpecialization::BufferBase + index * PipelineSpecialization::BufferWords;
             plan.specialization.push_back({first, descriptor.dwords[1] & 0xffff0000u});
             plan.specialization.push_back({first + 1u, descriptor.dwords[3]});
-            plan.specialization.push_back({first + 2u, present ? 1u : 0u});
             plan.specialization.push_back({first + 3u, misalignment});
         }
         if (buffer.formattedReadMask != 0u) {
@@ -355,6 +356,8 @@ DescriptorBindingPlan DescriptorBindingBuilder::Prepare(const IrBindingLayout& l
     }
     for (std::uint32_t index = 0; index < info.images.size() && !registrationModules; ++index) {
         if (info.images[index].table != NoTable) continue;
+        const auto& modes = info.runtimeImageModes.at(index);
+        if (std::ranges::any_of(modes, [](const ImageResource& mode) { return mode.conversionFormat == FmaskExpansion; })) plan.specialization.push_back({PipelineSpecialization::FmaskFormatBase + index, modes.at(imageModes[index]).conversionFormat == FmaskExpansion ? (snapshot.images.at(index).dwords[1] >> 20u) & 0x1ffu : 0u});
         const auto first = PipelineSpecialization::ImageBase + index * PipelineSpecialization::ImageWords;
         plan.specialization.push_back({first, imageModes[index]});
         for (std::uint32_t component = 0; component < 4u; ++component) plan.specialization.push_back({first + 1u + component, (snapshot.images.at(index).dwords[3] >> (component * 3u)) & 7u});
@@ -564,6 +567,7 @@ void DescriptorBindingBuilder::Populate(BindingAllocationResult& allocation, con
     auto shaderData = needsShaderData ? ShaderDataDwordsFor(layout, userDataBase, snapshot, partialThreads, plan.imageMetadata, plan.runtimeState) : std::vector<std::uint32_t>{};
     allocation.shaderDataUserWords.clear();
     if (needsShaderData) {
+        allocation.shaderDataUserWords.reserve(layout.userDataRegisters.size());
         for (const auto reg : layout.userDataRegisters) allocation.shaderDataUserWords.push_back(reg - userDataBase);
     }
     std::vector<DescriptorBinding> bindings;
@@ -610,7 +614,8 @@ void DescriptorBindingBuilder::Populate(BindingAllocationResult& allocation, con
                 physical.imageShapes.push_back(ImageShapeForResource(shape));
                 physical.imageDepthCompare.push_back(element.depthCompare);
                 physical.imageWritten.push_back(ImageBindingResourceClass(element.kind) == ImageResourceClass::Storage);
-                physical.imageAtomic.push_back(false);
+                physical.imageAtomic.push_back(element.atomic);
+                physical.imageAtomic64.push_back(element.atomic64);
                 std::uint32_t samplers = 0;
                 for (std::uint32_t sampler = 0; sampler < entry.tableSamplerMasks.size(); ++sampler) {
                     if ((element.samplers & (1u << sampler)) != 0u) samplers |= entry.tableSamplerMasks[sampler];
diff --git a/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp b/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp
index 97fbe47cb2..d2ebf74e9b 100644
--- a/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp
+++ b/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp
@@ -1,6 +1,8 @@
 #include "Optimization/ReadLaneEliminator.hpp"
 #include <algorithm>
 #include <list>
+#include <map>
+#include <set>
 #include <queue>
 #include <stdexcept>
 #include <unordered_map>
@@ -52,44 +54,13 @@ struct LaneFlow {
 
 struct WindowFlows {
     const IrProgram* program = nullptr;
-    std::unordered_set<std::uint32_t> spillSlots;
     std::unordered_map<std::uint64_t, LaneFlow> flows;
     std::unordered_set<std::uint64_t> computing;
+    std::vector<std::pair<IrValue*, std::uint32_t>>* folded = nullptr;
 };
 
 thread_local WindowFlows* windowFlows = nullptr;
 
-std::unordered_set<std::uint32_t> collectLaneSpillSlots(const IrProgram& program) {
-    std::unordered_set<std::uint32_t> candidates;
-    std::unordered_set<std::uint32_t> rejected;
-    const auto immediateSlot = [](const IrValue& inst, std::uint32_t& slot) {
-        const IrValue* index = inst.Argument(0)->Resolve();
-        if (!isImmediateU32(*index)) return false;
-        slot = index->ImmediateU32();
-        return true;
-    };
-    for (const auto& block : program.Blocks()) {
-        for (const IrValue* inst : block->Instructions()) {
-            std::uint32_t slot = 0;
-            if (inst->Opcode() == IrOpcode::StoreVectorWindow) {
-                if (!immediateSlot(*inst, slot)) continue;
-                candidates.insert(slot);
-                if (inst->Argument(1)->Resolve()->Opcode() != IrOpcode::WriteLane) rejected.insert(slot);
-            } else if (inst->Opcode() == IrOpcode::LoadVectorWindow) {
-                if (!immediateSlot(*inst, slot)) continue;
-                candidates.insert(slot);
-                for (const IrUse& use : inst->OperandUses()) {
-                    const bool laneRead = use.user->Opcode() == IrOpcode::ReadLane && use.operand == 0u;
-                    const bool chained = use.user->Opcode() == IrOpcode::WriteLane && use.operand == 2u;
-                    if (!laneRead && !chained) rejected.insert(slot);
-                }
-            }
-        }
-    }
-    for (const auto slot : rejected) candidates.erase(slot);
-    return candidates;
-}
-
 LaneState windowLoadLane(const IrValue* load, std::uint32_t lane, std::uint32_t waveSize);
 
 LaneState storedLane(IrValue* value, std::uint32_t slot, std::uint32_t lane, std::uint32_t waveSize, const LaneFlow& flow) {
@@ -117,7 +88,6 @@ const LaneFlow* laneFlow(std::uint32_t slot, std::uint32_t lane, std::uint32_t w
     if (const auto found = flows.flows.find(key); found != flows.flows.end()) return &found->second;
     if (!flows.computing.insert(key).second) return nullptr;
     LaneFlow flow;
-    const bool spill = flows.spillSlots.contains(slot);
     const auto& blocks = flows.program->Blocks();
     constexpr int MaxPasses = 64;
     bool settled = false;
@@ -144,11 +114,7 @@ const LaneFlow* laneFlow(std::uint32_t slot, std::uint32_t lane, std::uint32_t w
                     }
                 } else if (inst->Opcode() == IrOpcode::StoreVectorWindow) {
                     const IrValue* index = inst->Argument(0)->Resolve();
-                    if (!isImmediateU32(*index)) {
-                        if (!spill) running = {LaneState::Kind::Unknown, nullptr};
-                        continue;
-                    }
-                    if (index->ImmediateU32() != slot) continue;
+                    if (!isImmediateU32(*index) || index->ImmediateU32() != slot) continue;
                     running = storedLane(inst->Argument(1), slot, lane, waveSize, flow);
                 }
             }
@@ -177,8 +143,98 @@ LaneState windowLoadLane(const IrValue* load, std::uint32_t lane, std::uint32_t
 
 WindowLane windowLane(IrValue* load, std::uint32_t lane, std::uint32_t waveSize) {
     const LaneState state = windowLoadLane(load, lane, waveSize);
-    if (state.kind == LaneState::Kind::Known) return {state.value, true};
-    return {};
+    if (state.kind != LaneState::Kind::Known) return {};
+    if (windowFlows != nullptr && windowFlows->folded != nullptr) windowFlows->folded->emplace_back(load, lane);
+    return {state.value, true};
+}
+
+IrValue* laneSource(IrValue* value, std::uint32_t lane, std::uint32_t waveSize) {
+    for (;;) {
+        value = value->Resolve();
+        if (value->Opcode() == IrOpcode::WriteLane) {
+            const IrValue* selector = value->Argument(1)->Resolve();
+            if (!isImmediateU32(*selector) || selector->ImmediateU32() % waveSize == lane) return nullptr;
+            value = value->Argument(2);
+            continue;
+        }
+        if (value->Opcode() != IrOpcode::LoadVectorWindow || !isImmediateU32(*value->Argument(0)->Resolve())) return nullptr;
+        return value;
+    }
+}
+
+IrValue& immediate(IrProgram& program, std::uint32_t value) {
+    IrValue& constant = program.CreateValue(IrOpcode::Void, IrType::U32);
+    constant.SetImmediateU32(value);
+    return constant;
+}
+
+std::size_t guardSpilledLanes(IrProgram& program, const std::vector<std::pair<IrValue*, std::uint32_t>>& folded, std::uint32_t waveSize) {
+    const auto keyOf = [](std::uint32_t slot, std::uint32_t lane) { return (static_cast<std::uint64_t>(slot) << 32u) | lane; };
+    std::map<std::uint64_t, std::unordered_set<const IrValue*>> used;
+    std::vector<std::uint64_t> work;
+    const auto use = [&](IrValue* load, std::uint32_t lane) {
+        const auto key = keyOf(load->Argument(0)->Resolve()->ImmediateU32(), lane);
+        if (!used[key].insert(load).second) return false;
+        work.push_back(key);
+        return true;
+    };
+    for (const auto& [load, lane] : folded) use(load, lane);
+    std::unordered_map<const IrValue*, std::set<std::uint64_t>> guarded;
+    while (!work.empty()) {
+        const auto key = work.back();
+        work.pop_back();
+        const auto slot = static_cast<std::uint32_t>(key >> 32u);
+        const auto lane = static_cast<std::uint32_t>(key);
+        const auto& usedLoads = used[key];
+        std::unordered_map<const IrBlock*, bool> liveIn;
+        for (bool changed = true; changed;) {
+            changed = false;
+            for (auto block = program.Blocks().rbegin(); block != program.Blocks().rend(); ++block) {
+                bool live = false;
+                for (const IrBlock* successor : (*block)->Successors()) live = live || liveIn[successor];
+                for (auto inst = (*block)->Instructions().rbegin(); inst != (*block)->Instructions().rend(); ++inst) {
+                    IrValue* value = *inst;
+                    if (value->Opcode() == IrOpcode::LoadVectorWindow) {
+                        live = live || usedLoads.contains(value);
+                        continue;
+                    }
+                    if (value->Opcode() != IrOpcode::StoreVectorWindow) continue;
+                    const IrValue* index = value->Argument(0)->Resolve();
+                    if (!isImmediateU32(*index)) {
+                        if (live) guarded[value].insert(key);
+                        continue;
+                    }
+                    if (index->ImmediateU32() != slot) continue;
+                    if (live) {
+                        if (IrValue* source = laneSource(value->Argument(1), lane, waveSize); source != nullptr && use(source, lane)) changed = true;
+                    }
+                    live = false;
+                }
+                if (const auto found = liveIn.find(block->get()); found == liveIn.end() || found->second != live) {
+                    changed = changed || live || found != liveIn.end();
+                    liveIn[block->get()] = live;
+                }
+            }
+        }
+    }
+    std::size_t guards = 0;
+    for (const auto& block : program.Blocks()) {
+        for (IrValue* store : std::vector<IrValue*>(block->Instructions().begin(), block->Instructions().end())) {
+            const auto found = guarded.find(store);
+            if (found == guarded.end()) continue;
+            IrValue& current = program.CreateValue(IrOpcode::LoadVectorWindow, IrType::U32);
+            current.AddArgument(store->Argument(0));
+            block->InsertInstructionBefore(store, &current);
+            for (const auto key : found->second) {
+                IrValue& guard = program.CreateValue(IrOpcode::WindowLaneGuard, IrType::Void);
+                for (IrValue* argument : {store->Argument(0), store->Argument(1), &current, &immediate(program, static_cast<std::uint32_t>(key >> 32u)), &immediate(program, static_cast<std::uint32_t>(key))}) guard.AddArgument(argument);
+                block->InsertInstructionBefore(store, &guard);
+                ++guards;
+            }
+        }
+    }
+    if (guards != 0u) program.Info().usesFaultBuffer = true;
+    return guards;
 }
 
 ChainResult searchChain(IrValue* value, std::uint32_t lane, std::uint32_t waveSize) {
@@ -362,7 +418,7 @@ ReadLaneEliminationStats ReadLaneEliminator::Eliminate(IrProgram& program, std::
     }
     WindowFlows flows;
     flows.program = &program;
-    flows.spillSlots = collectLaneSpillSlots(program);
+    std::vector<std::pair<IrValue*, std::uint32_t>> folded;
     struct FlowScope {
         ~FlowScope() { windowFlows = nullptr; }
     } flowScope;
@@ -381,6 +437,7 @@ ReadLaneEliminationStats ReadLaneEliminator::Eliminate(IrProgram& program, std::
             const std::uint32_t lane = selector->ImmediateU32() % waveSize;
             const ChainResult chain = searchChain(inst->Argument(0), lane, waveSize);
             if (chain.write != nullptr) {
+                if (chain.value->Opcode() == IrOpcode::LoadVectorWindow) folded.emplace_back(chain.value, lane);
                 inst->ReplaceUsesWith(chain.scalar, true);
                 stats.rewrittenReads++;
                 continue;
@@ -397,10 +454,14 @@ ReadLaneEliminationStats ReadLaneEliminator::Eliminate(IrProgram& program, std::
             }
 
             PhiMap phiMap;
-            inst->ReplaceUsesWith(getRealValue(program, phiMap, chain.value, lane, waveSize), true);
+            flows.folded = &folded;
+            IrValue* real = getRealValue(program, phiMap, chain.value, lane, waveSize);
+            flows.folded = nullptr;
+            inst->ReplaceUsesWith(real, true);
             stats.rewrittenReads++;
         }
     }
+    stats.guardedStores = static_cast<std::uint32_t>(guardSpilledLanes(program, folded, waveSize));
     return stats;
 }
 
diff --git a/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp b/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp
index 6e8c4e269d..df61fa400d 100644
--- a/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp
+++ b/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp
@@ -122,12 +122,21 @@ bool Recomputable(IrOpcode opcode) {
         case IrOpcode::FPTrunc32:
         case IrOpcode::FPFract32:
         case IrOpcode::FPRoundEven32:
+        case IrOpcode::GetSrtResource:
+        case IrOpcode::ReadConst:
             return true;
         default:
             return false;
     }
 }
 
+bool ClobbersReadConst(IrOpcode opcode) {
+    const auto buffer = BufferAccessOf(opcode);
+    if (buffer == BufferAccess::Write || buffer == BufferAccess::Atomic) return true;
+    const auto address = AddressOpcodeInfoOf(opcode).access;
+    return address == AddressAccess::Write || address == AddressAccess::Atomic || opcode == IrOpcode::Barrier;
+}
+
 struct Operand {
     const IrValue* value;
     IrType type;
@@ -145,11 +154,12 @@ struct ValueKey {
     IrOpcode opcode;
     IrType type;
     std::uint64_t flags;
+    std::uint64_t memoryEpoch = 0;
     std::array<const IrValue*, 4> operands{};
     std::size_t operandCount = 0;
 
     bool operator==(const ValueKey& other) const {
-        if (opcode != other.opcode || type != other.type || flags != other.flags || operandCount != other.operandCount) return false;
+        if (opcode != other.opcode || type != other.type || flags != other.flags || memoryEpoch != other.memoryEpoch || operandCount != other.operandCount) return false;
         for (std::size_t index = 0; index < operandCount; ++index) {
             if (operands[index] != other.operands[index] && OperandOf(operands[index]) != OperandOf(other.operands[index])) return false;
         }
@@ -159,7 +169,7 @@ struct ValueKey {
 
 struct ValueKeyHash {
     std::size_t operator()(const ValueKey& key) const {
-        std::size_t hash = static_cast<std::size_t>(key.opcode) * 0x9e3779b97f4a7c15ull ^ static_cast<std::size_t>(key.type) ^ std::hash<std::uint64_t>{}(key.flags) * 31u;
+        std::size_t hash = static_cast<std::size_t>(key.opcode) * 0x9e3779b97f4a7c15ull ^ static_cast<std::size_t>(key.type) ^ std::hash<std::uint64_t>{}(key.flags) * 31u ^ std::hash<std::uint64_t>{}(key.memoryEpoch) * 131u;
         for (const auto* argument : std::span(key.operands).first(key.operandCount)) {
             const auto operand = OperandOf(argument);
             hash = hash * 1099511628211ull ^ std::hash<const void*>{}(operand.value) ^ std::hash<std::uint64_t>{}(operand.immediate) * 7u ^ static_cast<std::size_t>(operand.type);
@@ -222,13 +232,61 @@ std::vector<std::vector<IrBlock*>> DominatorChildren(const std::vector<IrBlock*>
 
 RedundantValueEliminationStats RedundantValueEliminator::Eliminate(IrProgram& program) const {
     RedundantValueEliminationStats stats;
+    if (program.BlockOrder().empty()) return stats;
+    const auto order = ReversePostOrder(*program.BlockOrder().front());
+    std::unordered_map<const IrBlock*, std::size_t> index;
+    const auto children = DominatorChildren(order, index);
+    for (const auto* block : program.BlockOrder()) {
+        if (!index.contains(block)) throw std::runtime_error("redundant value elimination: block " + std::to_string(block->Id()) + " is unreachable from the entry block");
+    }
+    std::uint64_t nextClobberEpoch = order.size() + 2u;
+    std::vector<std::uint64_t> firstClobber(order.size(), 0u);
+    std::vector<std::uint64_t> lastClobber(order.size(), 0u);
+    for (std::size_t position = 0; position < order.size(); ++position) {
+        firstClobber[position] = nextClobberEpoch;
+        for (const auto* inst : order[position]->Instructions()) {
+            if (ClobbersReadConst(inst->Opcode())) lastClobber[position] = nextClobberEpoch++;
+        }
+    }
+    std::vector<std::uint64_t> entryEpoch(order.size(), 0u);
+    const auto exitEpoch = [&](std::size_t position) -> std::uint64_t {
+        if (entryEpoch[position] == 0u) return 0u;
+        return lastClobber[position] != 0u ? lastClobber[position] : entryEpoch[position];
+    };
+    for (bool changed = true; changed;) {
+        changed = false;
+        for (std::size_t position = 0; position < order.size(); ++position) {
+            std::uint64_t candidate = position == 0u ? 1u : 0u;
+            for (const IrBlock* predecessor : order[position]->Predecessors()) {
+                const auto found = index.find(predecessor);
+                if (found == index.end()) continue;
+                const auto incoming = exitEpoch(found->second);
+                if (incoming == 0u) continue;
+                if (candidate == 0u) {
+                    candidate = incoming;
+                } else if (candidate != incoming) {
+                    candidate = position + 2u;
+                }
+            }
+            if (candidate != entryEpoch[position]) {
+                entryEpoch[position] = candidate;
+                changed = true;
+            }
+        }
+    }
     std::unordered_map<ValueKey, IrValue*, ValueKeyHash> available;
     std::vector<const ValueKey*> added;
     std::unordered_map<const IrValue*, IrValue*> replacements;
-    const auto visit = [&](IrBlock& block) {
-        for (auto* inst : block.Instructions()) {
+    const auto visit = [&](std::size_t position) {
+        std::uint64_t epoch = entryEpoch[position];
+        std::uint64_t nextClobber = firstClobber[position];
+        for (auto* inst : order[position]->Instructions()) {
+            if (ClobbersReadConst(inst->Opcode())) {
+                epoch = nextClobber++;
+                continue;
+            }
             if (!Recomputable(inst->Opcode()) || inst->HasImmediate() || !inst->HasUses()) continue;
-            ValueKey key{inst->Opcode(), inst->Type(), inst->Flags<std::uint64_t>()};
+            ValueKey key{inst->Opcode(), inst->Type(), inst->Flags<std::uint64_t>(), inst->Opcode() == IrOpcode::ReadConst ? epoch : 0u};
             key.operandCount = inst->ArgumentCount();
             if (key.operandCount > key.operands.size()) continue;
             for (std::size_t index = 0; index < key.operandCount; ++index) key.operands[index] = inst->Argument(index)->Resolve();
@@ -242,22 +300,15 @@ RedundantValueEliminationStats RedundantValueEliminator::Eliminate(IrProgram& pr
             ++stats.replacedValues;
         }
     };
-    if (program.BlockOrder().empty()) return stats;
-    const auto order = ReversePostOrder(*program.BlockOrder().front());
-    std::unordered_map<const IrBlock*, std::size_t> index;
-    const auto children = DominatorChildren(order, index);
-    for (const auto* block : program.BlockOrder()) {
-        if (!index.contains(block)) throw std::runtime_error("redundant value elimination: block " + std::to_string(block->Id()) + " is unreachable from the entry block");
-    }
     std::vector<std::pair<std::size_t, std::size_t>> stack{{0u, 0u}};
     std::vector<std::size_t> scopes{added.size()};
-    visit(*order[0]);
+    visit(0u);
     while (!stack.empty()) {
         auto& [position, next] = stack.back();
         if (next < children[position].size()) {
             const auto child = index.at(children[position][next++]);
             scopes.push_back(added.size());
-            visit(*order[child]);
+            visit(child);
             stack.emplace_back(child, 0u);
             continue;
         }
@@ -277,6 +328,9 @@ RedundantValueEliminationStats RedundantValueEliminator::Eliminate(IrProgram& pr
         replaced(info.indirectTarget);
     }
     for (auto*& read : program.Metadata().dynamicReads) replaced(read);
+    for (auto& descriptor : program.Resources().descriptorSources) {
+        for (auto*& dword : descriptor.dwords) replaced(dword);
+    }
     return stats;
 }
 
diff --git a/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp b/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
index 7e4fe6aea7..10202666a4 100644
--- a/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
+++ b/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
@@ -1,6 +1,7 @@
 #include "Optimization/ResourceMaterializer.hpp"
 #include "Optimization/SrtWalker/SrtFlatSlotClasses.hpp"
 #include "Optimization/SrtWalker/SrtEvaluator.hpp"
+#include "Optimization/SrtWalker/SrtInstructionPredicates.hpp"
 #include "Optimization/ShaderStageInputInfo.hpp"
 #include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include "RdnaDecoder/RdnaImageOpDecoder.hpp"
@@ -25,6 +26,7 @@
 #include <optional>
 #include <span>
 #include <unordered_map>
+#include <unordered_set>
 #include <stdexcept>
 #include <string>
 #include <utility>
@@ -128,6 +130,10 @@ std::uint32_t imageCoordinates(RdnaImageDimension dimension) {
     }
 }
 
+bool multisamplePlaneRead(const ImageResource& image) {
+    return image.dimension == RdnaImageDimension::Dim2D && image.resourceClass == ImageResourceClass::Sampled && image.table == NoTable && !image.depthCompare && !image.r128 && image.cubeFaceCompatible;
+}
+
 bool validImageDescriptor(const DescriptorValue& descriptor, bool r128) {
     const auto type = rawImageType(descriptor);
     const auto format = rawImageFormat(descriptor);
@@ -201,7 +207,8 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
     if (!validImageDescriptor(descriptor, base.r128)) {
         return rejectImage(invalidImageReason(descriptor), "image descriptor is invalid");
     }
-    decoded.dimension = descriptorDimension(descriptor, base.dimension);
+    const bool queryLayers = base.dimension == RdnaImageDimension::Dim1D && base.dimensionQueryOnly && rawImageType(descriptor) == ImageType::Color2DArray;
+    decoded.dimension = descriptorDimension(descriptor, queryLayers ? RdnaImageDimension::Dim2DArray : base.dimension);
     if (base.depthCompare) {
         if (decoded.dimension == RdnaImageDimension::Dim1D) {
             decoded.dimension = RdnaImageDimension::Dim2D;
@@ -214,6 +221,7 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
     }
     decoded.cube = descriptorIsCube(descriptor);
     const auto format = rawImageFormat(descriptor);
+    if (decoded.dimension == RdnaImageDimension::Dim2DMsaa && rawImageType(descriptor) == ImageType::Color2DMsaa && multisamplePlaneRead(base) && !IsFmaskTextureFormat(format) && !IsDepthBitsTexture(descriptor.dwords[1], descriptor.dwords[3])) decoded.dimension = RdnaImageDimension::Dim2D;
     if (base.atomic64 && format != IrBufferFormat::Format32_32UInt && format != IrBufferFormat::Format32_32SInt && format != IrBufferFormat::Format32_32Float) {
         return rejectImage(PoisonReason::InvalidFormat, "64-bit atomic image descriptor uses an unsupported format " + std::to_string(static_cast<std::uint32_t>(format)));
     }
@@ -227,9 +235,14 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
     if (decoded.fmask && (storage || base.depthCompare || table)) {
         return rejectImage(PoisonReason::Fmask, "FMASK requires a direct sampled image load");
     }
-    if (decoded.fmask && format != IrBufferFormat::Fmask32_S8_F8) return rejectImage(PoisonReason::Fmask, "FMASK format is not implemented");
+    if (decoded.fmask && !FmaskLayoutOf(format).has_value()) return rejectImage(PoisonReason::Fmask, "FMASK format is not implemented");
     if (decoded.fmask && ((descriptor.dwords[6] & (1u << 20u)) != 0u || ((descriptor.dwords[6] & (1u << 21u)) != 0u && (descriptor.dwords[6] >> 24u) == 0u && descriptor.dwords[7] == 0u))) return rejectImage(PoisonReason::Fmask, "FMASK CMASK compression is not implemented without readable metadata");
+    if (decoded.fmask && (descriptor.dwords[6] & (1u << 21u)) != 0u && format != IrBufferFormat::Fmask32_S8_F8) return rejectImage(PoisonReason::Fmask, "FMASK CMASK compression is implemented only for 8-sample, 8-fragment FMASK");
     if (decoded.fmask && (base.packed || base.byElements != 0u)) return rejectImage(PoisonReason::Fmask, "packed FMASK image reads are not implemented");
+    for (std::uint32_t component = 0; decoded.fmask && component < 4u; ++component) {
+        const auto selector = (descriptorImageSwizzle(descriptor) >> (component * 3u)) & 7u;
+        if (selector != 0u && selector != 1u && selector != 4u) return rejectImage(PoisonReason::Fmask, "FMASK destination channel selector is not implemented");
+    }
     if (base.packed) {
         if (table || (!storage && descriptorImageSwizzle(descriptor) != ShaderImageIdentitySwizzle)) {
             return rejectImage(PoisonReason::InvalidFormat, "packed image access requires a direct image, with identity swizzle when sampled");
@@ -249,11 +262,11 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
                                                                      : "MIMG BY2/BY4 requires a direct, identity-swizzled 2D image whose elements fill one dword: R8, R16 or RG8 for BY2, R8 for BY4");
         }
     }
-    const bool nativeRepacked = format == IrBufferFormat::Format10_11_11Float && !storage && !base.packed;
+    const bool nativeRepacked = (format == IrBufferFormat::Format10_11_11Float || format == IrBufferFormat::Format11_11_10Float) && !storage && !base.packed;
     const auto remappedFormat = storage ? RemapStorageTextureFormat(format) : RemapTextureFormat(format);
     decoded.conversionFormat = remappedFormat != format && !nativeRepacked ? format : IrBufferFormat::Invalid;
-    if (format == IrBufferFormat::Format11_11_10UNorm || (format == IrBufferFormat::Format10_11_11Float && !nativeRepacked)) {
-        const bool floating = format == IrBufferFormat::Format10_11_11Float;
+    if (format == IrBufferFormat::Format11_11_10UNorm || ((format == IrBufferFormat::Format10_11_11Float || format == IrBufferFormat::Format11_11_10Float) && !nativeRepacked)) {
+        const bool floating = format == IrBufferFormat::Format10_11_11Float || format == IrBufferFormat::Format11_11_10Float;
         if (!base.srgbDecodeCompatible) {
             if (floating) return rejectImage(PoisonReason::Conversion, "samples or gathers a converted float image, or queries its LOD, which is not implemented");
             if (storage || base.depthCompare || (base.emulatedCompare & EmulatedCompare::ConvertedSampleUnsupported) != 0u) return rejectImage(PoisonReason::Conversion, "sampling, gathering or querying LOD of a converted unorm image is not implemented");
@@ -266,6 +279,7 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
             if (((descriptorImageSwizzle(descriptor) >> (component * 3u)) & 7u) == 7u) return rejectImage(PoisonReason::Conversion, "selects a channel the converted image format does not have");
         }
     }
+    if (decoded.fmask && format != IrBufferFormat::Fmask32_S8_F8) decoded.conversionFormat = FmaskExpansion;
     decoded.srgbDecode = !storage && !base.depthCompare && (srgbDecodeFormats & SrgbDecodeBit(format)) != 0u;
     if (decoded.srgbDecode && !base.srgbDecodeCompatible) {
         return rejectImage(PoisonReason::SrgbUnsupported, "samples or gathers an sRGB image the device cannot sample, which is not implemented");
@@ -656,6 +670,7 @@ private:
 
 struct WordsIndexTag {};
 struct ElementIndexTag {};
+struct SamplerIndexTag {};
 struct PoisonIndexTag {};
 struct TableRecordsTag {};
 
@@ -1381,7 +1396,7 @@ void materializeForcedDegamma(const IrResourcePlan& plan, ResourceSnapshot& snap
 
 std::uint32_t colorCompareReference(IrBufferFormat format) {
     const auto value = static_cast<std::uint32_t>(format);
-    if (((value >= 1u && value <= 77u) || (value >= 128u && value <= 130u)) && SampledTextureNumericClass(format) == IrTextureNumericClass::Float && format != IrBufferFormat::Format11_11_10UNorm && format != IrBufferFormat::Format10_11_11Float) return EmulatedCompare::ReferenceZero;
+    if (((value >= 1u && value <= 77u) || (value >= 128u && value <= 130u)) && (SampledTextureNumericClass(format) == IrTextureNumericClass::Float || format == IrBufferFormat::Format11_11_10Float) && format != IrBufferFormat::Format11_11_10UNorm && format != IrBufferFormat::Format10_11_11Float) return EmulatedCompare::ReferenceZero;
     throw std::runtime_error("comparison sampling of a color texture is implemented only for floating-point, UNORM and SNORM formats (format " + std::to_string(value) + ")");
 }
 
@@ -1672,6 +1687,7 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
         return Abi::PoisonCode(*index);
     };
     HashScratchIndex elementIndex{threadScratch<HashSlot, ElementIndexTag>()};
+    HashScratchIndex samplerIndex{threadScratch<HashSlot, SamplerIndexTag>()};
     std::vector<std::uint32_t> directSamplers(info.images.size(), 0u);
     for (const auto& pair : info.sampledPairs) {
         if (info.samplers.at(pair.sampler).table == NoTable) directSamplers.at(pair.image) |= 1u << pair.sampler;
@@ -1700,17 +1716,17 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
                 auto element = words.dwords;
                 if (mode.conversionFormat != IrBufferFormat::Invalid || mode.depthBits) element[3] = (element[3] & ~0xfffu) | ShaderImageIdentitySwizzle;
                 const auto kind = DescriptorBindingForImage(mode);
-                const auto hash = hashWords(element, (static_cast<std::uint64_t>(mode.dimension) << 16u) ^ (static_cast<std::uint64_t>(mode.depthCompare) << 8u) ^ static_cast<std::uint64_t>(kind));
+                const auto hash = hashWords(element, (static_cast<std::uint64_t>(image.atomic64) << 25u) ^ (static_cast<std::uint64_t>(image.atomic) << 24u) ^ (static_cast<std::uint64_t>(mode.dimension) << 16u) ^ (static_cast<std::uint64_t>(mode.depthCompare) << 8u) ^ static_cast<std::uint64_t>(kind));
                 auto index = elementIndex.Find(hash, [&](std::uint32_t known) {
                     const auto& entry = out.elements[known];
-                    return entry.words == element && entry.dimension == mode.dimension && entry.depthCompare == mode.depthCompare && entry.kind == kind;
+                    return entry.words == element && entry.dimension == mode.dimension && entry.depthCompare == mode.depthCompare && entry.kind == kind && entry.atomic == image.atomic && entry.atomic64 == image.atomic64;
                 });
                 if (!index.has_value() && out.elements.size() >= Abi::ImageElementBudget) {
                     record[Abi::ImageRecordFlags] = poison(resource, PoisonReason::Budget, &words);
                 } else {
                     if (!index.has_value()) {
                         index = static_cast<std::uint32_t>(out.elements.size());
-                        out.elements.push_back({element, mode.dimension, mode.depthCompare, kind, 0u});
+                        out.elements.push_back({element, mode.dimension, mode.depthCompare, kind, 0u, image.atomic, image.atomic64});
                         elementIndex.Insert(hash, *index);
                     }
                     out.elements[*index].samplers |= directSamplers[resource];
@@ -1729,19 +1745,29 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
             record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Unnormalized, &words);
         } else if (((words.dwords[0] >> 29u) & 3u) != 0u) {
             record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Reduction, &words);
-        } else if (out.samplers.size() + Abi::SamplerEntryElements > Abi::SamplerElementBudget) {
-            record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Budget, &words);
         } else {
-            record[Abi::SamplerRecordElement] = static_cast<std::uint32_t>(out.samplers.size());
-            for (std::uint32_t variant = 0; variant < 2u; variant++) {
-                const bool compare = variant == 1u;
-                for (std::uint32_t point = 0; point < 2u; point++) {
-                    ImageTableSamplerElement element;
-                    std::copy_n(words.dwords.begin(), 4u, element.words.begin());
-                    element.compare = compare;
-                    element.point = point != 0u;
-                    out.samplers.push_back(element);
+            const auto hash = hashWords(std::span(words.dwords.data(), 4u), 0);
+            auto index = samplerIndex.Find(hash, [&](std::uint32_t known) {
+                return std::equal(words.dwords.begin(), words.dwords.begin() + 4u, out.samplers[known].words.begin());
+            });
+            if (!index.has_value() && out.samplers.size() + Abi::SamplerEntryElements > Abi::SamplerElementBudget) {
+                record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Budget, &words);
+            } else {
+                if (!index.has_value()) {
+                    index = static_cast<std::uint32_t>(out.samplers.size());
+                    for (std::uint32_t variant = 0; variant < 2u; variant++) {
+                        const bool compare = variant == 1u;
+                        for (std::uint32_t point = 0; point < 2u; point++) {
+                            ImageTableSamplerElement element;
+                            std::copy_n(words.dwords.begin(), 4u, element.words.begin());
+                            element.compare = compare;
+                            element.point = point != 0u;
+                            out.samplers.push_back(element);
+                        }
+                    }
+                    samplerIndex.Insert(hash, *index);
                 }
+                record[Abi::SamplerRecordElement] = *index;
             }
         }
         const auto offset = static_cast<std::uint32_t>(out.map.size());
@@ -1813,7 +1839,12 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
 }
 
 std::shared_ptr<const ResolvedImageTables> ResourceMaterializer::ResolveImageTablesShared(const ShaderInfo& info, const ResourceSnapshot& snapshot, std::uint64_t memoKey) {
-    if (memoKey == 0u || snapshot.tables.tables.empty() || !TableResolutionReuse()) return std::make_shared<const ResolvedImageTables>(ResolveImageTables(info, snapshot, memoKey));
+    if (snapshot.tables.tables.empty()) {
+        static const auto none = std::make_shared<const ResolvedImageTables>();
+        static_cast<void>(ResolveImageTables(info, snapshot, memoKey));
+        return none;
+    }
+    if (memoKey == 0u || !TableResolutionReuse()) return std::make_shared<const ResolvedImageTables>(ResolveImageTables(info, snapshot, memoKey));
     auto reducing = reducingSamplers(info, snapshot);
     auto& memo = resolutionMemo();
     auto& totals = tableReuseTotals();
@@ -1849,6 +1880,7 @@ std::shared_ptr<const ResolvedImageTables> ResourceMaterializer::ResolveImageTab
 }
 
 std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageResource& image) {
+    if (image.targetMerge) return {image};
     const bool table = image.table != NoTable;
     if (table && image.tableOperation == TableOperation::Unsupported) return {};
     std::vector<ImageResource> modes;
@@ -1863,9 +1895,9 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
         mode.cube = false;
         mode.mipCount = mode.mipMode == ImageMipMode::DynamicStorage ? RuntimeAbi::StorageMipSlots : 1u;
         mode.shaderSwizzle = ShaderImageIdentitySwizzle;
-        if (conversion == IrBufferFormat::Format11_11_10UNorm || conversion == IrBufferFormat::Format10_11_11Float) mode.shaderSwizzle = 0x2acu;
+        if (conversion == IrBufferFormat::Format11_11_10UNorm || conversion == IrBufferFormat::Format11_11_10Float || conversion == IrBufferFormat::Format10_11_11Float) mode.shaderSwizzle = 0x2acu;
         modes.push_back(mode);
-        const bool volumeLoad = (image.dimension == RdnaImageDimension::Dim2D || image.dimension == RdnaImageDimension::Dim2DArray) && image.fmaskCompatible;
+        const bool volumeLoad = (image.dimension == RdnaImageDimension::Dim2D || image.dimension == RdnaImageDimension::Dim2DArray) && image.fmaskCompatible && conversion != FmaskExpansion;
         const bool volumeStore = image.dimension == RdnaImageDimension::Dim2DArray && storage && image.written && !image.read && !image.atomic && image.mipMode != ImageMipMode::DynamicStorage;
         const bool volumePlaneBias = image.dimension == RdnaImageDimension::Dim2D && image.singleMipPlaneBiasCompatible && !storage && image.table == NoTable && conversion == IrBufferFormat::Invalid;
         const bool volumeArraySample = image.dimension == RdnaImageDimension::Dim2DArray && image.volumeArraySampleCompatible && !storage && image.table == NoTable && conversion == IrBufferFormat::Invalid;
@@ -1897,7 +1929,7 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
             line.dimension = RdnaImageDimension::Dim1D;
             modes.push_back(line);
         }
-        if (image.dimension == RdnaImageDimension::Dim2D && storage && image.written && !image.read && !image.atomic && image.mipMode != ImageMipMode::DynamicStorage && !depth && packed == IrBufferFormat::Invalid && image.byElements == 0u) {
+        if ((image.dimension == RdnaImageDimension::Dim2D || image.dimension == RdnaImageDimension::Dim2DArray) && storage && image.written && !image.read && !image.atomic && image.mipMode != ImageMipMode::DynamicStorage && !depth && packed == IrBufferFormat::Invalid && image.byElements == 0u) {
             auto line = mode;
             line.dimension = RdnaImageDimension::Dim1D;
             modes.push_back(line);
@@ -1914,11 +1946,24 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
             line.dimension = RdnaImageDimension::Dim1D;
             modes.push_back(line);
         }
-        if (image.dimension == RdnaImageDimension::Dim1D && !storage && !depth && conversion == IrBufferFormat::Invalid && packed == IrBufferFormat::Invalid) {
+        const bool planeAdded = image.dimension == RdnaImageDimension::Dim1D && !storage && !depth && conversion == IrBufferFormat::Invalid && packed == IrBufferFormat::Invalid;
+        if (planeAdded) {
             auto plane = mode;
             plane.dimension = RdnaImageDimension::Dim2D;
             modes.push_back(plane);
         }
+        if (image.dimension == RdnaImageDimension::Dim1D && image.dimensionQueryOnly && !storage) {
+            for (const auto dimension : {RdnaImageDimension::Dim2D, RdnaImageDimension::Dim2DArray, RdnaImageDimension::Dim3D}) {
+                if (dimension == RdnaImageDimension::Dim2D && planeAdded) continue;
+                auto view = mode;
+                view.dimension = dimension;
+                modes.push_back(view);
+            }
+            auto cube = mode;
+            cube.dimension = RdnaImageDimension::Dim2DArray;
+            cube.cube = true;
+            modes.push_back(cube);
+        }
         if (image.dimension == RdnaImageDimension::Dim1DArray || image.dimension == RdnaImageDimension::Dim2DArray || image.dimension == RdnaImageDimension::Dim2DMsaaArray) {
             auto plain = mode;
             plain.dimension = image.dimension == RdnaImageDimension::Dim1DArray ? RdnaImageDimension::Dim1D : image.dimension == RdnaImageDimension::Dim2DArray ? RdnaImageDimension::Dim2D : RdnaImageDimension::Dim2DMsaa;
@@ -1954,7 +1999,10 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
             if (!storage) append(IrTextureNumericClass::Sint, IrBufferFormat::Invalid, IrBufferFormat::Invalid, false, false);
             append(IrTextureNumericClass::Uint, IrBufferFormat::Format11_11_10UInt, IrBufferFormat::Invalid, false, false);
             if ((image.srgbDecodeCompatible || (image.convertedSamples && convertedSampleCompatible(image))) && image.depthBitsCompatible) append(IrTextureNumericClass::Uint, IrBufferFormat::Format11_11_10UNorm, IrBufferFormat::Invalid, false, false);
-            if (image.srgbDecodeCompatible && image.depthBitsCompatible) append(IrTextureNumericClass::Uint, IrBufferFormat::Format10_11_11Float, IrBufferFormat::Invalid, false, false);
+            if (image.srgbDecodeCompatible && image.depthBitsCompatible) {
+                append(IrTextureNumericClass::Uint, IrBufferFormat::Format11_11_10Float, IrBufferFormat::Invalid, false, false);
+                append(IrTextureNumericClass::Uint, IrBufferFormat::Format10_11_11Float, IrBufferFormat::Invalid, false, false);
+            }
             if (storage) {
                 for (const auto format : {IrBufferFormat::Format5_6_5UNorm, IrBufferFormat::Format5_5_5_1UNorm, IrBufferFormat::Format4_4_4_4UNorm}) {
                     append(IrTextureNumericClass::Uint, format, IrBufferFormat::Invalid, false, false);
@@ -1965,6 +2013,7 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
                     append(IrTextureNumericClass::Float, IrBufferFormat::Invalid, IrBufferFormat::Invalid, true, false);
                     append(IrTextureNumericClass::Float, IrBufferFormat::Invalid, IrBufferFormat::Invalid, true, true);
                 }
+                if (image.fmaskCompatible && !table) append(IrTextureNumericClass::Uint, FmaskExpansion, IrBufferFormat::Invalid, false, false);
             }
         }
     }
@@ -2174,63 +2223,141 @@ void ResourceMaterializer::PrepareImageModes(ShaderInfo& info) {
 
 namespace {
 
+std::vector<const IrValue*> pathToMemoryRead(const IrValue& handle) {
+    std::unordered_map<const IrValue*, const IrValue*> parents;
+    std::vector<const IrValue*> queue;
+    const auto visit = [&](const IrValue* argument, const IrValue* parent) {
+        if (argument == nullptr) return;
+        argument = argument->Resolve();
+        if (!argument->HasImmediate() && parents.emplace(argument, parent).second) queue.push_back(argument);
+    };
+    for (const auto* argument : handle.Arguments()) visit(argument, nullptr);
+    for (std::size_t index = 0; index < queue.size(); ++index) {
+        const auto* value = queue[index];
+        if (Detail::IsMemoryRead(value->Opcode())) {
+            std::vector<const IrValue*> path;
+            for (const auto* step = parents.at(value); step != nullptr; step = parents.at(step)) path.push_back(step);
+            return path;
+        }
+        for (const auto* argument : value->Arguments()) visit(argument, value);
+    }
+    return {};
+}
+
 void ownPlanValues(IrResourcePlan& plan) {
     std::vector<IrValue**> roots;
     for (auto& source : plan.descriptorSources) {
         for (auto& dword : source.dwords) roots.push_back(&dword);
     }
     for (auto& read : plan.srtReads) roots.push_back(&read.value);
-    for (auto& block : plan.controlFlow) roots.push_back(&block.condition);
     for (auto& value : plan.uniformFill.values) roots.push_back(&value);
+    const auto closures = roots.size();
+    for (auto& block : plan.controlFlow) roots.push_back(&block.condition);
 
-    std::unordered_map<const IrValue*, IrValue*> clones;
-    std::vector<const IrValue*> order;
-    std::vector<const IrValue*> pending;
-    for (const auto* root : roots) {
-        if (*root != nullptr) pending.push_back(*root);
-    }
-    while (!pending.empty()) {
-        const auto* value = pending.back();
-        pending.pop_back();
-        if (!clones.emplace(value, nullptr).second) continue;
-        order.push_back(value);
-        for (const auto* argument : value->Arguments()) {
-            if (argument != nullptr) pending.push_back(argument);
+    std::unordered_set<const IrValue*> whole;
+    std::unordered_set<const IrValue*> linked;
+    for (;;) {
+        std::unordered_map<const IrValue*, IrValue*> clones;
+        std::unordered_set<const IrValue*> closed;
+        std::unordered_set<const IrValue*> opened;
+        std::unordered_set<const IrValue*> handles;
+        std::vector<const IrValue*> phis;
+        std::vector<const IrValue*> order;
+        std::vector<std::pair<const IrValue*, bool>> pending;
+        for (std::size_t index = 0; index < roots.size(); ++index) {
+            if (*roots[index] != nullptr) pending.emplace_back(*roots[index], index < closures);
         }
-    }
-    plan.valueStorage.Reserve(order.size());
-    for (const auto* value : order) {
-        auto* clone = plan.valueStorage.Create(value->Opcode(), value->Type(), static_cast<std::uint32_t>(plan.valueStorage.Size()));
-        clone->SetFlags(value->Flags<std::uint64_t>());
-        if (value->HasImmediate()) clone->SetImmediateU64(value->ImmediateU64());
-        clone->SetRegister(value->Register());
-        clones[value] = clone;
-    }
-    std::unordered_map<const IrBlock*, IrBlock*> blocks;
-    const auto blockFor = [&](const IrBlock* block) {
-        auto& clone = blocks[block];
-        if (clone == nullptr) {
-            plan.blockStorage.push_back(std::make_unique<IrBlock>(block->Id()));
-            clone = plan.blockStorage.back().get();
+        while (!pending.empty()) {
+            const auto value = pending.back().first;
+            const auto closure = pending.back().second || whole.contains(value);
+            pending.pop_back();
+            if (clones.emplace(value, nullptr).second) order.push_back(value);
+            auto reads = closure ? Detail::EvaluatorReads::Closure : Detail::Evaluator::Reads(plan, *value);
+            if (reads == Detail::EvaluatorReads::Nothing && linked.contains(value)) reads = Detail::EvaluatorReads::Arguments;
+            if (reads == Detail::EvaluatorReads::Nothing || closed.contains(value)) continue;
+            if (closure) {
+                closed.insert(value);
+            } else if (!opened.insert(value).second) {
+                continue;
+            } else if (value->IsPhi()) {
+                phis.push_back(value);
+            }
+            for (const auto* argument : value->Arguments()) {
+                if (argument != nullptr) pending.emplace_back(argument, closure);
+            }
+            if (!closure && reads == Detail::EvaluatorReads::Closure && value->ArgumentCount() != 0u && value->Argument(0) != nullptr) {
+                const auto* handle = value->Argument(0)->Resolve();
+                handles.insert(handle);
+                if (opened.insert(handle).second) {
+                    for (const auto* argument : handle->Arguments()) {
+                        if (argument != nullptr) pending.emplace_back(argument, false);
+                    }
+                }
+            }
         }
-        return clone;
-    };
-    for (const auto* value : order) {
-        std::vector<IrValue*> arguments;
-        std::vector<IrBlock*> phiBlocks;
-        arguments.reserve(value->ArgumentCount());
-        if (value->IsPhi()) phiBlocks.reserve(value->ArgumentCount());
-        for (std::size_t index = 0; index < value->ArgumentCount(); index++) {
-            const auto* argument = value->Argument(index);
-            arguments.push_back(argument == nullptr ? nullptr : clones.at(argument));
-            if (value->IsPhi()) phiBlocks.push_back(blockFor(value->PhiBlock(index)));
+        IrValueArena storage;
+        storage.Reserve(order.size());
+        for (const auto* value : order) {
+            auto* clone = storage.Create(value->Opcode(), value->Type(), static_cast<std::uint32_t>(storage.Size()));
+            clone->SetFlags(value->Flags<std::uint64_t>());
+            if (value->HasImmediate()) clone->SetImmediateU64(value->ImmediateU64());
+            clone->SetRegister(value->Register());
+            clones[value] = clone;
         }
-        clones.at(value)->SetDetachedOperands(std::move(arguments), std::move(phiBlocks));
+        std::vector<std::unique_ptr<IrBlock>> blockStorage;
+        std::unordered_map<const IrBlock*, IrBlock*> blocks;
+        const auto blockFor = [&](const IrBlock* block) {
+            auto& clone = blocks[block];
+            if (clone == nullptr) {
+                blockStorage.push_back(std::make_unique<IrBlock>(block->Id()));
+                clone = blockStorage.back().get();
+            }
+            return clone;
+        };
+        for (const auto* value : order) {
+            const auto count = closed.contains(value) || opened.contains(value) ? value->ArgumentCount() : 0u;
+            std::vector<IrValue*> arguments;
+            std::vector<IrBlock*> phiBlocks;
+            arguments.reserve(count);
+            if (value->IsPhi()) phiBlocks.reserve(count);
+            for (std::size_t index = 0; index < count; index++) {
+                const auto* argument = value->Argument(index);
+                arguments.push_back(argument == nullptr ? nullptr : clones.at(argument));
+                if (value->IsPhi()) phiBlocks.push_back(blockFor(value->PhiBlock(index)));
+            }
+            clones.at(value)->SetDetachedOperands(std::move(arguments), std::move(phiBlocks));
+        }
+        const auto resolvesAlike = [&](const IrValue* phi) {
+            try {
+                const auto* expected = ResolveInvariantPhi(plan, const_cast<IrValue*>(phi));
+                const auto* copied = ResolveInvariantPhi(plan, clones.at(phi));
+                if (expected == nullptr) return copied == nullptr;
+                const auto found = clones.find(expected);
+                return found != clones.end() && found->second == copied;
+            } catch (const std::exception&) {
+                return false;
+            }
+        };
+        bool grown = false;
+        for (const auto* phi : phis) {
+            if (!closed.contains(phi) && !resolvesAlike(phi)) grown = whole.insert(phi).second || grown;
+        }
+        for (const auto* handle : handles) {
+            if (closed.contains(handle) || Detail::LoadedFromMemory(*clones.at(handle))) continue;
+            const auto path = pathToMemoryRead(*handle);
+            bool linkedStep = false;
+            for (const auto* step : path) linkedStep = linked.insert(step).second || linkedStep;
+            if (!path.empty()) grown = (linkedStep || whole.insert(handle).second) || grown;
+        }
+        if (grown) continue;
+        plan.valueStorage = std::move(storage);
+        plan.blockStorage = std::move(blockStorage);
+        for (auto* root : roots) {
+            if (*root != nullptr) *root = clones.at(*root);
+        }
+        plan.denseValueIds = true;
+        return;
     }
-    for (auto* root : roots) {
-        if (*root != nullptr) *root = clones.at(*root);
-    }
-    plan.denseValueIds = true;
 }
 
 void buildCompactPlan(IrResourcePlan& plan) {
@@ -2310,9 +2437,8 @@ IrResourcePlan ResourceMaterializer::ExtractPlan(const IrProgram& program) const
     PrepareImageModes(plan.info);
     plan.uniformFill = source.uniformFill;
     for (auto& block : plan.controlFlow) {
-        if (block.condition != nullptr && !Detail::Evaluator::MayEvaluate(source, block.condition)) block.condition = nullptr;
+        if (block.condition != nullptr && !Detail::Evaluator::MayDecide(source, block.condition)) block.condition = nullptr;
     }
-    ownPlanValues(plan);
     const auto addSource = [&plan](std::uint32_t index) {
         if (index >= plan.descriptorSources.size()) {
             throw std::runtime_error("ResourceMaterializer::ExtractPlan resource references an unknown descriptor source");
@@ -2339,6 +2465,7 @@ IrResourcePlan ResourceMaterializer::ExtractPlan(const IrProgram& program) const
     }
     plan.pureFlatSlots = Detail::ComputePureFlatSlots(plan);
     plan.guardedSrtSlots = Detail::ComputeGuardedFlatSlots(plan);
+    ownPlanValues(plan);
     buildCompactPlan(plan);
     return plan;
 }
diff --git a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp
index 0ffeb3be74..d0d0482387 100644
--- a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp
+++ b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp
@@ -751,6 +751,68 @@ private:
         return true;
     }
 
+    IrValue* UnwrapTableRead(IrValue* value) const {
+        if (value == nullptr) return nullptr;
+        value = value->Resolve();
+        if (!value->IsPhi()) return value;
+        IrValue* candidate = nullptr;
+        std::vector<IrValue*> pending{value};
+        std::unordered_set<const IrValue*> visited;
+        while (!pending.empty()) {
+            auto* current = pending.back()->Resolve();
+            pending.pop_back();
+            if (!visited.insert(current).second) continue;
+            if (current->IsPhi()) {
+                for (std::size_t i = 0; i < current->ArgumentCount(); i++) {
+                    pending.push_back(current->Argument(i));
+                }
+                continue;
+            }
+            std::uint32_t memoryIndex = 0;
+            IrValue* key = nullptr;
+            std::uint32_t stride = 0;
+            std::uint32_t addend = 0;
+            if (ScalarReadMemory(*current, memoryIndex) == nullptr || !MemoryIndexBelongsTo(memoryIndex, *current) ||
+                !MatchAffineOffset(current->Argument(1), key, stride, addend)) {
+                return nullptr;
+            }
+            if (candidate == nullptr) {
+                candidate = current;
+            } else if (!EquivalentValue(m_program.Resources(), candidate, current)) {
+                std::uint32_t candidateIndex = 0;
+                const auto* candMem = ScalarReadMemory(*candidate, candidateIndex);
+                const auto* curMem = ScalarReadMemory(*current, memoryIndex);
+                if (candMem == nullptr || curMem == nullptr || candMem->offset != curMem->offset ||
+                    !EquivalentValue(m_program.Resources(), candidate->Argument(0), current->Argument(0)) ||
+                    !EquivalentValue(m_program.Resources(), candidate->Argument(1), current->Argument(1))) {
+                    return nullptr;
+                }
+            }
+        }
+        return candidate;
+    }
+
+    bool BlockDominates(const IrBlock* dominator, const IrBlock* block) const {
+        if (dominator == block) return true;
+        std::vector<const IrBlock*> pending{block};
+        std::unordered_set<const IrBlock*> visited{block};
+        while (!pending.empty()) {
+            const IrBlock* current = pending.back();
+            pending.pop_back();
+            if (current->Predecessors().empty()) return false;
+            for (const IrBlock* predecessor : current->Predecessors()) {
+                if (predecessor != dominator && visited.insert(predecessor).second) pending.push_back(predecessor);
+            }
+        }
+        return true;
+    }
+
+    bool AvailableAt(IrValue* value, const IrBlock* block) const {
+        value = value->Resolve();
+        if (value->HasImmediate() || value->Parent() == nullptr) return true;
+        return BlockDominates(value->Parent(), block);
+    }
+
     bool TryMakeIndirectColumn(IrValue& handle, IrValue& descriptorPointer, bool sampler, std::uint32_t words, std::uint32_t descriptorOffset, std::uint32_t descriptorImmediate, TableColumnPlan& plan) {
         std::vector<PointerHop> hops;
         IrValue* pointer = &descriptorPointer;
@@ -788,7 +850,10 @@ private:
         IrValue* offset = nullptr;
         std::uint32_t first = 0;
         for (std::uint32_t dword = 0; dword < 2u; dword++) {
-            IrValue* read = pointer->Argument(dword)->Resolve();
+            IrValue* read = UnwrapTableRead(pointer->Argument(dword));
+            if (read == nullptr) {
+                return false;
+            }
             std::uint32_t memoryIndex = 0;
             const MemoryInfo* memory = ScalarReadMemory(*read, memoryIndex);
             if (memory == nullptr || !MemoryIndexBelongsTo(memoryIndex, *read)) {
@@ -802,6 +867,9 @@ private:
                 return false;
             }
         }
+        if (!AvailableAt(offset, handle.Parent())) {
+            return false;
+        }
         IrValue* key = nullptr;
         std::uint32_t stride = 0;
         std::uint32_t addend = 0;
@@ -1707,7 +1775,7 @@ private:
                 continue;
             }
             image.table = next++;
-            if (image.atomic || image.packed || image.byElements != 0u) {
+            if (image.packed || image.byElements != 0u) {
                 image.tableOperation = TableOperation::Unsupported;
             }
         }
@@ -1879,6 +1947,7 @@ private:
         const bool flatLineAccess = image.dimension == RdnaImageDimension::Dim2DArray ? flatLineLevelZero || flatLineExplicitLod : flatLineLoad || flatLineSample || flatLineExplicitLod;
         image.flatLineCompatible = image.flatLineCompatible && flatLineAccess && !memory.imagePacked && memory.imageByElements == 0u;
         image.flatVolumeLineCompatible = image.flatVolumeLineCompatible && (flatLineLoad || flatLineSample) && !memory.imagePacked && memory.imageByElements == 0u;
+        image.dimensionQueryOnly = image.dimensionQueryOnly && op == IrOpcode::ImageQueryDimensions;
         if ((memory.imageSampleFlags & RdnaImageSampleFlagCompare) != 0u) {
             constexpr auto unsupported = RdnaImageSampleFlagLod | RdnaImageSampleFlagDerivative;
             if (op == IrOpcode::ImageGatherRaw || (memory.imageSampleFlags & unsupported) != 0u) image.emulatedCompare |= EmulatedCompare::Unsupported;
diff --git a/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp b/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp
index d9c6fbcc3d..472ade83d6 100644
--- a/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp
+++ b/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp
@@ -1,4 +1,5 @@
 #include "Optimization/ShaderInfoCollector.hpp"
+#include "Optimization/ResourceMaterializer.hpp"
 #include <algorithm>
 #include <array>
 #include <cstdint>
@@ -555,6 +556,25 @@ std::uint16_t SamplerUseOf(IrOpcode opcode, std::uint32_t flags, IrShaderStage s
     return static_cast<std::uint16_t>(use);
 }
 
+void AddTargetMerge(const ShaderPixelInputInfo& pixel, ShaderInfo& info) {
+    if (info.runtimeImageModes.size() != info.images.size() || std::ranges::any_of(info.images, [](const ImageResource& image) { return image.targetMerge; })) {
+        return Fail("color target merge image cannot join the prepared images");
+    }
+    ImageResource image;
+    image.source = std::numeric_limits<std::uint32_t>::max();
+    image.resourceClass = ImageResourceClass::Storage;
+    image.numericClass = IrTextureNumericClass::Uint;
+    image.dimension = pixel.mergeSamples > 1u ? RdnaImageDimension::Dim2DMsaa : RdnaImageDimension::Dim2D;
+    image.read = true;
+    image.written = true;
+    image.fmaskCompatible = false;
+    image.targetMerge = true;
+    info.images.push_back(image);
+    info.runtimeImageModes.push_back(ResourceMaterializer::RuntimeImageModes(image));
+    AddInput(info, StageInputKind::FragCoord, 0, 4, "gl_FragCoord");
+    if (pixel.mergeSamples > 1u) AddInput(info, StageInputKind::SampleId, 0, 1, "gl_SampleID");
+}
+
 void CollectSamplerUses(const IrProgram& program, ShaderInfo& info) {
     for (auto& sampler : info.samplers) {
         sampler.uses = 0;
@@ -603,7 +623,7 @@ void ShaderInfoCollector::Collect(IrProgram& program, const ShaderStageInputInfo
             return SharedAccessOf(inst->Opcode()) == SharedAccess::Atomic && inst->Type() == IrType::U64;
         });
     });
-    next.usesFaultBuffer = next.usesFaultBuffer || (next.sharedMemoryBytes != 0u && ldsAtomic64);
+    next.usesFaultBuffer = next.usesFaultBuffer || ldsAtomic64;
     switch (program.Resources().stage) {
         case IrShaderStage::Vertex:
         case IrShaderStage::Local:
@@ -627,6 +647,7 @@ void ShaderInfoCollector::Collect(IrProgram& program, const ShaderStageInputInfo
     }
     CollectBuiltinInputs(program, next);
     CollectOutputs(program, inputInfo, next);
+    if (program.Resources().stage == IrShaderStage::Pixel && inputInfo.pixel->mergeMask != 0u) AddTargetMerge(*inputInfo.pixel, next);
     if ((program.Resources().stage == IrShaderStage::Vertex || program.Resources().stage == IrShaderStage::Mesh) && inputInfo.vertex != nullptr && inputInfo.vertex->pointList) AddOutput(next, StageOutputKind::PointSize, 0, 0, "gl_PointSize");
     CollectSamplerUses(program, next);
     program.Info() = std::move(next);
diff --git a/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp b/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp
index 3369a7457a..75d62f0546 100644
--- a/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp
+++ b/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp
@@ -289,6 +289,8 @@ std::optional<std::size_t> evaluatedArguments(IrOpcode opcode) {
         case IrOpcode::FPMul32:
         case IrOpcode::FPOrdLessThanEqual32:
         case IrOpcode::FPOrdGreaterThanEqual32:
+        case IrOpcode::FPUnordLessThanEqual32:
+        case IrOpcode::FPUnordGreaterThanEqual32:
         case IrOpcode::BitwiseAnd32:
         case IrOpcode::BitwiseAnd64:
         case IrOpcode::BitwiseOr32:
@@ -447,8 +449,53 @@ bool BasicEvaluator<TNode>::MayEvaluate(const IrResourcePlan& program, IrValue*
     return known.at(value->Resolve());
 }
 
+template<typename TNode>
+bool BasicEvaluator<TNode>::MayDecide(const IrResourcePlan& program, IrValue* value) {
+    if (value == nullptr) return false;
+    if (MayEvaluate(program, value)) return true;
+    value = value->Resolve();
+    const auto decides = [&program, value](std::size_t index) { return value->Argument(index) != nullptr && MayDecide(program, value->Argument(index)); };
+    switch (value->Opcode()) {
+        case IrOpcode::LogicalNot: return value->ArgumentCount() == 1u && decides(0);
+        case IrOpcode::LogicalAnd:
+        case IrOpcode::LogicalOr: return value->ArgumentCount() == 2u && (decides(0) || decides(1));
+        case IrOpcode::ULessThan32:
+        case IrOpcode::UGreaterThan32: return value->ArgumentCount() == 2u && (MayEvaluate(program, value->Argument(0)) || MayEvaluate(program, value->Argument(1)));
+        default: return false;
+    }
+}
+
+template<typename TNode>
+EvaluatorReads BasicEvaluator<TNode>::Reads(const IrResourcePlan& program, const IrValue& value) {
+    if (value.IsIdentity()) {
+        return EvaluatorReads::Arguments;
+    }
+    if (value.HasImmediate()) {
+        return EvaluatorReads::Nothing;
+    }
+    switch (value.Opcode()) {
+        case IrOpcode::LoadAddressU32:
+        case IrOpcode::ReadConstBuffer: return IsRawRead(program, value) ? EvaluatorReads::Closure : EvaluatorReads::Nothing;
+        case IrOpcode::CompositeConstructU32x2:
+        case IrOpcode::IAddCarry32:
+        case IrOpcode::GetUserData:
+        case IrOpcode::GetShaderBase:
+        case IrOpcode::Phi:
+        case IrOpcode::ReadFirstLane:
+        case IrOpcode::BitCastU32F32:
+        case IrOpcode::BitCastF32U32:
+        case IrOpcode::CompositeExtractU64:
+        case IrOpcode::CompositeExtractU32x2:
+        case IrOpcode::ReadConst: return EvaluatorReads::Arguments;
+        default: return evaluatedArguments(value.Opcode()) ? EvaluatorReads::Arguments : EvaluatorReads::Nothing;
+    }
+}
+
 template<typename TNode>
 bool BasicEvaluator<TNode>::EvaluateInst(const TNode& inst, std::uint64_t& result) {
+    if (Reads(_program, *inst.Value()) == EvaluatorReads::Nothing) {
+        return false;
+    }
     std::uint64_t a = 0;
     std::uint64_t b = 0;
     std::uint64_t c = 0;
@@ -599,6 +646,18 @@ bool BasicEvaluator<TNode>::EvaluateInst(const TNode& inst, std::uint64_t& resul
                 return true;
             }
             return false;
+        case IrOpcode::FPUnordLessThanEqual32:
+            if (binary()) {
+                result = !(Float32(a) > Float32(b)) ? 1u : 0u;
+                return true;
+            }
+            return false;
+        case IrOpcode::FPUnordGreaterThanEqual32:
+            if (binary()) {
+                result = !(Float32(a) < Float32(b)) ? 1u : 0u;
+                return true;
+            }
+            return false;
         case IrOpcode::BitwiseAnd32:
             if (binary()) {
                 result = static_cast<std::uint32_t>(a & b);
@@ -762,29 +821,41 @@ bool BasicEvaluator<TNode>::EvaluateInst(const TNode& inst, std::uint64_t& resul
             }
             return false;
         case IrOpcode::ULessThan32:
-            if (binary()) {
-                result = static_cast<std::uint32_t>(a) < static_cast<std::uint32_t>(b) ? 1u : 0u;
+        case IrOpcode::UGreaterThan32: {
+            const bool greater = inst.Opcode() == IrOpcode::UGreaterThan32;
+            const bool first = Arg(inst, 0, a);
+            if (first && static_cast<std::uint32_t>(a) == (greater ? 0u : 0xffffffffu)) {
+                result = 0u;
                 return true;
             }
-            return false;
-        case IrOpcode::UGreaterThan32:
-            if (binary()) {
-                result = static_cast<std::uint32_t>(a) > static_cast<std::uint32_t>(b) ? 1u : 0u;
+            const bool second = Arg(inst, 1, b);
+            if (second && static_cast<std::uint32_t>(b) == (greater ? 0xffffffffu : 0u)) {
+                result = 0u;
                 return true;
             }
-            return false;
+            if (!first || !second) return false;
+            const auto lhs = static_cast<std::uint32_t>(greater ? b : a);
+            const auto rhs = static_cast<std::uint32_t>(greater ? a : b);
+            result = lhs < rhs ? 1u : 0u;
+            return true;
+        }
         case IrOpcode::LogicalAnd:
-            if (binary()) {
-                result = (a != 0u) && (b != 0u) ? 1u : 0u;
+        case IrOpcode::LogicalOr: {
+            const bool decisive = inst.Opcode() == IrOpcode::LogicalOr;
+            const bool first = Arg(inst, 0, a);
+            if (first && (a != 0u) == decisive) {
+                result = decisive ? 1u : 0u;
                 return true;
             }
-            return false;
-        case IrOpcode::LogicalOr:
-            if (binary()) {
-                result = (a != 0u) || (b != 0u) ? 1u : 0u;
+            const bool second = Arg(inst, 1, b);
+            if (second && (b != 0u) == decisive) {
+                result = decisive ? 1u : 0u;
                 return true;
             }
-            return false;
+            if (!first || !second) return false;
+            result = decisive ? 0u : 1u;
+            return true;
+        }
         case IrOpcode::LogicalXor:
             if (binary()) {
                 result = (a != 0u) != (b != 0u) ? 1u : 0u;
diff --git a/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp b/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp
index 855fd960af..140e1e7a2b 100644
--- a/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp
+++ b/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp
@@ -20,6 +20,10 @@ bool IsRawRead(const IrResourcePlan& program, IrOpcode op, std::uint32_t index)
     return (op == IrOpcode::LoadAddressU32 && kind == ResourceKind::ScalarAddress) || (op == IrOpcode::ReadConstBuffer && kind == ResourceKind::ScalarBuffer);
 }
 
+bool IsMemoryRead(IrOpcode opcode) {
+    return opcode == IrOpcode::ReadConst || opcode == IrOpcode::LoadAddressU32 || opcode == IrOpcode::ReadConstBuffer;
+}
+
 bool LoadedFromMemory(const IrValue& handle) {
     std::vector<const IrValue*> pending;
     std::vector<const IrValue*> visited;
@@ -31,8 +35,7 @@ bool LoadedFromMemory(const IrValue& handle) {
         value = value->Resolve();
         if (value->HasImmediate() || std::find(visited.begin(), visited.end(), value) != visited.end()) continue;
         visited.push_back(value);
-        const auto opcode = value->Opcode();
-        if (opcode == IrOpcode::ReadConst || opcode == IrOpcode::LoadAddressU32 || opcode == IrOpcode::ReadConstBuffer) return true;
+        if (IsMemoryRead(value->Opcode())) return true;
         for (std::size_t index = 0; index < value->ArgumentCount(); ++index) pending.push_back(value->Argument(index));
     }
     return false;
diff --git a/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp b/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp
index b18206cf38..208b02d774 100644
--- a/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp
+++ b/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp
@@ -245,6 +245,8 @@ private:
             case IrOpcode::FPIsNan32: return operation(Op::FPIsNan32, value, context, depth, 1);
             case IrOpcode::FPOrdLessThanEqual32: return operation(Op::FPOrdLessThanEqual32, value, context, depth, 2);
             case IrOpcode::FPOrdGreaterThanEqual32: return operation(Op::FPOrdGreaterThanEqual32, value, context, depth, 2);
+            case IrOpcode::FPUnordLessThanEqual32: return operation(Op::FPUnordLessThanEqual32, value, context, depth, 2);
+            case IrOpcode::FPUnordGreaterThanEqual32: return operation(Op::FPUnordGreaterThanEqual32, value, context, depth, 2);
             case IrOpcode::BitwiseAnd32: return operation(Op::BitwiseAnd32, value, context, depth, 2);
             case IrOpcode::BitwiseAnd64: return operation(Op::BitwiseAnd64, value, context, depth, 2);
             case IrOpcode::BitwiseOr32: return operation(Op::BitwiseOr32, value, context, depth, 2);
@@ -343,6 +345,44 @@ bool SrtTape::evaluate(Frame& frame, std::uint32_t index, std::uint64_t& result)
 }
 
 bool SrtTape::compute(Frame& frame, const Node& node, std::uint64_t& result) const {
+    if (node.op == Op::LogicalAnd || node.op == Op::LogicalOr) {
+        const bool decisive = node.op == Op::LogicalOr;
+        std::uint64_t first = 0;
+        std::uint64_t second = 0;
+        const bool firstEvaluated = evaluate(frame, node.arguments[0], first);
+        if (firstEvaluated && (first != 0u) == decisive) {
+            result = decisive ? 1u : 0u;
+            return true;
+        }
+        const bool secondEvaluated = evaluate(frame, node.arguments[1], second);
+        if (secondEvaluated && (second != 0u) == decisive) {
+            result = decisive ? 1u : 0u;
+            return true;
+        }
+        if (!firstEvaluated || !secondEvaluated) return false;
+        result = decisive ? 0u : 1u;
+        return true;
+    }
+    if (node.op == Op::ULessThan32 || node.op == Op::UGreaterThan32) {
+        const bool greater = node.op == Op::UGreaterThan32;
+        std::uint64_t first = 0;
+        std::uint64_t second = 0;
+        const bool firstEvaluated = evaluate(frame, node.arguments[0], first);
+        if (firstEvaluated && static_cast<std::uint32_t>(first) == (greater ? 0u : 0xffffffffu)) {
+            result = 0u;
+            return true;
+        }
+        const bool secondEvaluated = evaluate(frame, node.arguments[1], second);
+        if (secondEvaluated && static_cast<std::uint32_t>(second) == (greater ? 0xffffffffu : 0u)) {
+            result = 0u;
+            return true;
+        }
+        if (!firstEvaluated || !secondEvaluated) return false;
+        const auto lhs = static_cast<std::uint32_t>(greater ? second : first);
+        const auto rhs = static_cast<std::uint32_t>(greater ? first : second);
+        result = lhs < rhs ? 1u : 0u;
+        return true;
+    }
     std::array<std::uint64_t, 5> operand{};
     std::int32_t origin = -1;
     for (std::uint8_t index = 0; index < node.argumentCount; ++index) {
@@ -426,6 +466,8 @@ bool SrtTape::compute(Frame& frame, const Node& node, std::uint64_t& result) con
         case Op::FPIsNan32: result = std::isnan(float32(a)) ? 1u : 0u; return true;
         case Op::FPOrdLessThanEqual32: result = float32(a) <= float32(b) ? 1u : 0u; return true;
         case Op::FPOrdGreaterThanEqual32: result = float32(a) >= float32(b) ? 1u : 0u; return true;
+        case Op::FPUnordLessThanEqual32: result = !(float32(a) > float32(b)) ? 1u : 0u; return true;
+        case Op::FPUnordGreaterThanEqual32: result = !(float32(a) < float32(b)) ? 1u : 0u; return true;
         case Op::IAdd32: result = static_cast<std::uint32_t>(a + b); return true;
         case Op::IAdd64: result = a + b; return true;
         case Op::ISub32: result = static_cast<std::uint32_t>(a - b); return true;
@@ -483,10 +525,10 @@ bool SrtTape::compute(Frame& frame, const Node& node, std::uint64_t& result) con
         case Op::IEqual32: result = static_cast<std::uint32_t>(a) == static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
         case Op::INotEqual32: result = static_cast<std::uint32_t>(a) != static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
         case Op::SLessThan32: result = std::bit_cast<std::int32_t>(static_cast<std::uint32_t>(a)) < std::bit_cast<std::int32_t>(static_cast<std::uint32_t>(b)) ? 1u : 0u; return true;
-        case Op::ULessThan32: result = static_cast<std::uint32_t>(a) < static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
-        case Op::UGreaterThan32: result = static_cast<std::uint32_t>(a) > static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
-        case Op::LogicalAnd: result = (a != 0u) && (b != 0u) ? 1u : 0u; return true;
-        case Op::LogicalOr: result = (a != 0u) || (b != 0u) ? 1u : 0u; return true;
+        case Op::ULessThan32:
+        case Op::UGreaterThan32: return false;
+        case Op::LogicalAnd:
+        case Op::LogicalOr: return false;
         case Op::LogicalXor: result = (a != 0u) != (b != 0u) ? 1u : 0u; return true;
         case Op::LogicalNot: result = a == 0u ? 1u : 0u; return true;
     }
diff --git a/core/shader/recompiler/Optimization/src/TessellationLowering.cpp b/core/shader/recompiler/Optimization/src/TessellationLowering.cpp
index 79a616db94..690d3bde1e 100644
--- a/core/shader/recompiler/Optimization/src/TessellationLowering.cpp
+++ b/core/shader/recompiler/Optimization/src/TessellationLowering.cpp
@@ -253,6 +253,82 @@ bool Implies(IrValue* rawPredicate, IrValue* rawCondition) {
     return predicate->Opcode() == IrOpcode::LogicalAnd && (Implies(predicate->Argument(0), condition) || Implies(predicate->Argument(1), condition));
 }
 
+bool ImpliesNot(IrValue* rawPredicate, IrValue* rawCondition) {
+    IrValue* predicate = rawPredicate->Resolve();
+    IrValue* condition = rawCondition->Resolve();
+    if (condition->HasImmediate() && condition->Type() == IrType::Bool && !condition->ImmediateBool()) return true;
+    if (condition->Opcode() == IrOpcode::LogicalNot) return Implies(predicate, condition->Argument(0));
+    if (predicate->Opcode() == IrOpcode::LogicalNot) return Implies(condition, predicate->Argument(0));
+    return predicate->Opcode() == IrOpcode::LogicalAnd && (ImpliesNot(predicate->Argument(0), condition) || ImpliesNot(predicate->Argument(1), condition));
+}
+
+bool CarriesRelativeBits(IrOpcode opcode) {
+    switch (opcode) {
+    case IrOpcode::Identity:
+    case IrOpcode::Phi:
+    case IrOpcode::IAdd32:
+    case IrOpcode::ISub32:
+    case IrOpcode::IMul32:
+    case IrOpcode::ShiftLeftLogical32:
+    case IrOpcode::ShiftRightLogical32:
+    case IrOpcode::ShiftRightArithmetic32:
+    case IrOpcode::BitwiseAnd32:
+    case IrOpcode::BitwiseOr32:
+    case IrOpcode::BitwiseXor32:
+    case IrOpcode::BitwiseNot32:
+    case IrOpcode::BitFieldUExtract:
+    case IrOpcode::BitFieldSExtract:
+    case IrOpcode::BitFieldInsert:
+    case IrOpcode::Select:
+    case IrOpcode::SelectU1:
+    case IrOpcode::SelectU32:
+    case IrOpcode::SelectF32:
+    case IrOpcode::BitCastU32F32:
+    case IrOpcode::BitCastF32U32:
+    case IrOpcode::BitCastU16F16:
+    case IrOpcode::BitCastF16U16:
+    case IrOpcode::ConvertF32U32:
+    case IrOpcode::ConvertU32F32:
+    case IrOpcode::ConvertF32S32:
+    case IrOpcode::ConvertS32F32:
+    case IrOpcode::ConvertFToU32:
+    case IrOpcode::ConvertUToF32:
+    case IrOpcode::ConvertFToI32:
+    case IrOpcode::ConvertIToF32:
+    case IrOpcode::ConvertF32F16:
+    case IrOpcode::ConvertF16F32:
+    case IrOpcode::ConvertU16U32:
+    case IrOpcode::ConvertU32U16:
+    case IrOpcode::ConvertU8U32:
+    case IrOpcode::ConvertU32U8:
+    case IrOpcode::FPAdd32:
+    case IrOpcode::FPSub32:
+    case IrOpcode::FPMul32:
+    case IrOpcode::FPMad32:
+    case IrOpcode::FPFma32:
+    case IrOpcode::FFma32:
+    case IrOpcode::FPMin32:
+    case IrOpcode::FPMax32:
+    case IrOpcode::FPNeg32:
+    case IrOpcode::FPAbs32:
+    case IrOpcode::CompositeConstructU64:
+    case IrOpcode::CompositeConstructU32x2:
+    case IrOpcode::CompositeConstructU32x3:
+    case IrOpcode::CompositeConstructU32x4:
+    case IrOpcode::CompositeExtractU64:
+    case IrOpcode::CompositeExtractU32x2:
+    case IrOpcode::CompositeExtractU32x3:
+    case IrOpcode::CompositeExtractU32x4:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool IsRelativeSelect(IrOpcode opcode) {
+    return opcode == IrOpcode::Select || opcode == IrOpcode::SelectU1 || opcode == IrOpcode::SelectU32 || opcode == IrOpcode::SelectF32;
+}
+
 class AddressEvaluator {
 public:
     AddressEvaluator(std::uint32_t vertexCount, std::int64_t relativeCount) : vertexCount(vertexCount), relativeCount(relativeCount) {}
@@ -784,33 +860,86 @@ private:
         return address && address->dynamic && address->relative == stride;
     }
 
+    bool dependsOnRelative(IrValue* raw, IrValue* rawPredicate) {
+        if (raw == nullptr) return false;
+        IrValue* value = raw->Resolve();
+        IrValue* predicate = rawPredicate == nullptr ? nullptr : rawPredicate->Resolve();
+        if (value->HasImmediate()) return false;
+        const auto key = std::pair<const IrValue*, const IrValue*>{value, predicate};
+        if (const auto found = dependence.find(key); found != dependence.end()) return found->second == Dependence::Yes;
+        const auto inserted = dependence.emplace(key, Dependence::Visiting);
+        if (!inserted.second) return false;
+        const bool result = [&] {
+            if (const auto form = evaluator.Evaluate(value, predicate)) return form->relative != 0;
+            if (IsRelativeSelect(value->Opcode()) && predicate != nullptr) {
+                IrValue* condition = value->Argument(0);
+                if (Implies(predicate, condition)) return dependsOnRelative(value->Argument(1), predicate);
+                if (ImpliesNot(predicate, condition)) return dependsOnRelative(value->Argument(2), predicate);
+            }
+            for (IrValue* argument : value->Arguments()) {
+                if (dependsOnRelative(argument, predicate)) return true;
+            }
+            return false;
+        }();
+        inserted.first->second = result ? Dependence::Yes : Dependence::No;
+        return result;
+    }
+
+    bool windowLoadObserves(IrValue* store) {
+        IrBlock* start = store->Parent();
+        if (start == nullptr) return true;
+        std::unordered_set<IrBlock*> seen;
+        std::vector<IrBlock*> pending = start->Successors();
+        bool loops = false;
+        while (!pending.empty()) {
+            IrBlock* block = pending.back();
+            pending.pop_back();
+            if (block == nullptr) continue;
+            if (block == start) {
+                loops = true;
+                continue;
+            }
+            if (!seen.insert(block).second) continue;
+            for (IrValue* inst : block->Instructions()) {
+                if (inst->Opcode() == IrOpcode::LoadVectorWindow) return true;
+            }
+            for (IrBlock* next : block->Successors()) pending.push_back(next);
+        }
+        bool after = false;
+        for (IrValue* inst : start->Instructions()) {
+            if (inst == store) {
+                after = true;
+                continue;
+            }
+            if (inst->Opcode() == IrOpcode::LoadVectorWindow && (after || loops)) return true;
+        }
+        return false;
+    }
+
+    IrValue* effectPredicate(IrValue* user) const {
+        if (!user->MayHaveSideEffects() || user->ArgumentCount() == 0u) return nullptr;
+        IrValue* last = user->Argument(user->ArgumentCount() - 1u);
+        if (last == nullptr || last->Resolve()->Type() != IrType::Bool) return nullptr;
+        return last;
+    }
+
     bool usedAsData(const std::vector<IrValue*>& bases) {
+        dependence.clear();
         std::vector<IrValue*> pending(bases.begin(), bases.end());
         std::unordered_set<IrValue*> visited(bases.begin(), bases.end());
         while (!pending.empty()) {
             IrValue* value = pending.back();
             pending.pop_back();
             for (IrValue* user : value->Uses()) {
-                switch (user->Opcode()) {
-                case IrOpcode::Identity:
-                case IrOpcode::IAdd32:
-                case IrOpcode::ISub32:
-                case IrOpcode::IMul32:
-                case IrOpcode::ShiftLeftLogical32:
-                case IrOpcode::ShiftRightLogical32:
-                case IrOpcode::BitwiseAnd32:
-                case IrOpcode::BitwiseOr32:
-                case IrOpcode::BitFieldUExtract:
-                case IrOpcode::SelectU32:
-                case IrOpcode::Phi:
+                if (user == nullptr) continue;
+                if (CarriesRelativeBits(user->Opcode())) {
                     if (visited.insert(user).second) pending.push_back(user);
                     continue;
-                default:
-                    break;
                 }
                 if (dynamicInputAddress(user, value)) continue;
-                const auto address = evaluator.Evaluate(value, nullptr);
-                if (!address || address->relative != 0) return true;
+                if (!dependsOnRelative(value, effectPredicate(user))) continue;
+                if (user->Opcode() == IrOpcode::StoreVectorWindow && !windowLoadObserves(user)) continue;
+                return true;
             }
         }
         return false;
@@ -1075,10 +1204,13 @@ private:
     bool merged;
     AddressEvaluator evaluator;
     std::vector<Access> accesses;
+    enum class Dependence : std::uint8_t { Visiting, No, Yes };
+
     std::uint32_t localStride;
     std::uint32_t controlStride = 0;
     std::uint32_t patchStride = 0;
     std::uint32_t sharedStride = 0;
+    std::map<std::pair<const IrValue*, const IrValue*>, Dependence> dependence;
 };
 
 }
diff --git a/core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp b/core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp
new file mode 100644
index 0000000000..a4ef3bc3f8
--- /dev/null
+++ b/core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp
@@ -0,0 +1,42 @@
+#include "Optimization/DeadCodeEliminator.hpp"
+#include <algorithm>
+#include <unordered_set>
+#include <vector>
+
+namespace ShaderRecompiler {
+
+void DeadCodeEliminator::EliminateUnobservedPhis(IrProgram& program) const {
+    std::unordered_set<IrValue*> phis;
+    for (IrBlock* block : program.BlockOrder()) {
+        for (IrValue* value : block->Instructions()) {
+            if (value->IsPhi()) phis.insert(value);
+        }
+    }
+    std::unordered_set<IrValue*> observed;
+    std::vector<IrValue*> pending;
+    for (IrValue* phi : phis) {
+        if (std::ranges::any_of(phi->Uses(), [&](IrValue* user) { return !phis.contains(user); })) {
+            observed.insert(phi);
+            pending.push_back(phi);
+        }
+    }
+    while (!pending.empty()) {
+        IrValue* value = pending.back();
+        pending.pop_back();
+        for (IrValue* argument : value->Arguments()) {
+            if (phis.contains(argument) && observed.insert(argument).second) pending.push_back(argument);
+        }
+    }
+    std::vector<IrValue*> unobserved;
+    for (IrValue* phi : phis) {
+        if (observed.contains(phi)) continue;
+        unobserved.push_back(phi);
+        for (std::size_t index = 0; index < phi->ArgumentCount(); ++index) phi->ReplaceArgument(index, nullptr);
+    }
+    for (IrValue* phi : unobserved) {
+        phi->Parent()->RemoveInstruction(phi);
+        phi->Invalidate();
+    }
+}
+
+}
diff --git a/core/shader/recompiler/PipelineSpecialization.hpp b/core/shader/recompiler/PipelineSpecialization.hpp
index ae9ec178cf..2adcd7e04a 100644
--- a/core/shader/recompiler/PipelineSpecialization.hpp
+++ b/core/shader/recompiler/PipelineSpecialization.hpp
@@ -42,6 +42,7 @@ inline constexpr std::uint32_t DescriptorIndexBase = 16384u;
 inline constexpr std::uint32_t DescriptorIndexStride = 128u;
 inline constexpr std::uint32_t FoldOffsetBase = 57344u;
 inline constexpr std::uint32_t UnnormalizedBaseLevelBase = 57408u;
+inline constexpr std::uint32_t FmaskFormatBase = 57472u;
 
 inline constexpr std::uint32_t DescriptorIndex(std::uint32_t binding, std::uint32_t element) {
     return DescriptorIndexBase + binding * DescriptorIndexStride + element;
diff --git a/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp b/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp
index e36217d958..83c1f217aa 100644
--- a/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp
+++ b/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp
@@ -4,6 +4,7 @@
 #include "IntermediateRepresentation/IrMetadata.hpp"
 #include <array>
 #include <cstdint>
+#include <optional>
 #include <span>
 
 namespace ShaderRecompiler {
@@ -21,6 +22,17 @@ enum class ImageType : std::uint32_t {
 
 [[nodiscard]] IrTextureNumericClass VertexInputNumericClass(IrBufferFormat format);
 [[nodiscard]] bool IsFmaskTextureFormat(IrBufferFormat format);
+
+struct FmaskLayout {
+    std::uint32_t samples;
+    std::uint32_t fragments;
+    std::uint32_t sampleBits;
+    std::uint32_t storageBits;
+};
+
+inline constexpr IrBufferFormat FmaskExpansion = IrBufferFormat::Fmask8_S2_F1;
+
+[[nodiscard]] std::optional<FmaskLayout> FmaskLayoutOf(IrBufferFormat format);
 [[nodiscard]] IrTextureNumericClass SampledTextureNumericClass(IrBufferFormat format);
 [[nodiscard]] IrBufferFormat RemapTextureFormat(IrBufferFormat format);
 [[nodiscard]] IrBufferFormat RemapStorageTextureFormat(IrBufferFormat format);
diff --git a/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp b/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp
index 763deb31fb..f84540b2f0 100644
--- a/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp
+++ b/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp
@@ -38,7 +38,7 @@ constexpr std::array<FormatInfo, 82> kFormatInfoTable {{
     {IrBufferFormat::Format16_16Float, true, false, false},
     {IrBufferFormat::Format11_11_10UNorm, true, true, false},
     {IrBufferFormat::Format11_11_10UInt, true, true, false},
-    {IrBufferFormat::Format11_11_10Float, true, false, false},
+    {IrBufferFormat::Format11_11_10Float, true, true, false},
     {IrBufferFormat::Format10_11_11Float, true, true, false},
     {IrBufferFormat::Format10_10_10_2UNorm, true, false, false},
     {IrBufferFormat::Format10_10_10_2SNorm, true, false, false},
@@ -112,6 +112,21 @@ bool IsFmaskTextureFormat(IrBufferFormat format) {
     return format >= IrBufferFormat::Fmask8_S2_F1 && format <= IrBufferFormat::Fmask64_S16_F8;
 }
 
+std::optional<FmaskLayout> FmaskLayoutOf(IrBufferFormat format) {
+    switch (format) {
+        case IrBufferFormat::Fmask8_S2_F1: return FmaskLayout{2u, 1u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S4_F1: return FmaskLayout{4u, 1u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S8_F1: return FmaskLayout{8u, 1u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S2_F2: return FmaskLayout{2u, 2u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S4_F2: return FmaskLayout{4u, 2u, 2u, 8u};
+        case IrBufferFormat::Fmask8_S4_F4: return FmaskLayout{4u, 4u, 2u, 8u};
+        case IrBufferFormat::Fmask16_S8_F2: return FmaskLayout{8u, 2u, 2u, 16u};
+        case IrBufferFormat::Fmask32_S8_F4: return FmaskLayout{8u, 4u, 4u, 32u};
+        case IrBufferFormat::Fmask32_S8_F8: return FmaskLayout{8u, 8u, 4u, 32u};
+        default: return std::nullopt;
+    }
+}
+
 IrTextureNumericClass SampledTextureNumericClass(IrBufferFormat format) {
     const FormatInfo* info = FindFormatInfo(format);
     if (info == nullptr || !info->sampled) {
@@ -124,7 +139,7 @@ IrTextureNumericClass SampledTextureNumericClass(IrBufferFormat format) {
 }
 
 IrBufferFormat RemapTextureFormat(IrBufferFormat format) {
-    return format == IrBufferFormat::Format11_11_10UNorm || format == IrBufferFormat::Format11_11_10UInt || format == IrBufferFormat::Format10_11_11Float ? IrBufferFormat::Format32UInt : format;
+    return format == IrBufferFormat::Format11_11_10UNorm || format == IrBufferFormat::Format11_11_10UInt || format == IrBufferFormat::Format11_11_10Float || format == IrBufferFormat::Format10_11_11Float ? IrBufferFormat::Format32UInt : format;
 }
 
 IrBufferFormat RemapStorageTextureFormat(IrBufferFormat format) {
diff --git a/core/shader/recompiler/RdnaDecoder/src/RdnaImageOpDecoder.cpp b/core/shader/recompiler/RdnaDecoder/src/RdnaImageOpDecoder.cpp
index e3be618395..e5a71be9c7 100644
--- a/core/shader/recompiler/RdnaDecoder/src/RdnaImageOpDecoder.cpp
+++ b/core/shader/recompiler/RdnaDecoder/src/RdnaImageOpDecoder.cpp
@@ -86,6 +86,8 @@ constexpr ImageOpcodeInfo imageOpcodes[] = {
     {0x4fu, RdnaOpcode::ImageGather4CLz, nullptr, RdnaImageSampleFlagCompare | RdnaImageSampleFlagLevelZero, false, true, false},
     {0x57u, RdnaOpcode::ImageGather4LzO, nullptr, RdnaImageSampleFlagLevelZero | RdnaImageSampleFlagOffset, false, true, false},
     {0x58u, RdnaOpcode::ImageGather4CO, nullptr, RdnaImageSampleFlagCompare | RdnaImageSampleFlagOffset, false, true, false},
+    {0xc8u, RdnaOpcode::ImageGather4C, "image_gather4_c_a", RdnaImageSampleFlagCompare | RdnaImageSampleFlagAdjust, false, true, false},
+    {0xd8u, RdnaOpcode::ImageGather4CO, "image_gather4_c_o_a", RdnaImageSampleFlagCompare | RdnaImageSampleFlagOffset | RdnaImageSampleFlagAdjust, false, true, false},
     {0x5fu, RdnaOpcode::ImageGather4CLzO, nullptr, RdnaImageSampleFlagCompare | RdnaImageSampleFlagLevelZero | RdnaImageSampleFlagOffset, false, true, false},
     {0x61u, RdnaOpcode::ImageGather4h, nullptr, RdnaImageSampleFlagGatherHorizontal, false, true, false},
     {0x62u, RdnaOpcode::ImageGather4hPck, nullptr, RdnaImageSampleFlagGatherHorizontal, false, true, false},
diff --git a/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp b/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp
index 98950f77cb..c1e192ce0b 100644
--- a/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp
+++ b/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp
@@ -935,6 +935,23 @@ RdnaInstruction DecodeRdnaFlat(std::uint32_t programCounter, std::span<const std
         instruction.sourceCount = 1;
         return instruction;
     }
+    if (seg == 1u) {
+        const RdnaOperand zero = scalarSource(128u);
+        instruction.source0 = saddr == 0x7Du ? vectorRegister(addr) : zero;
+        instruction.source1 = zero;
+        if (saddr != 0x7Du && saddr != 0x7Fu) {
+            instruction.source1 = scalarSource(saddr);
+            if (instruction.source1.kind != RdnaOperandKind::ScalarRegister &&
+                instruction.source1.kind != RdnaOperandKind::VccLo &&
+                instruction.source1.kind != RdnaOperandKind::VccHi &&
+                instruction.source1.kind != RdnaOperandKind::M0 &&
+                instruction.source1.kind != RdnaOperandKind::ExecLo) {
+                throw std::runtime_error("FLAT scratch scalar offset register is unsupported");
+            }
+        }
+        instruction.sourceCount = 2;
+        return instruction;
+    }
     instruction.source0 = vectorRegister(addr);
     if (seg == 0u || saddr == 0x7Du || saddr == 0x7Fu) {
         if (addr == 255u) {
diff --git a/core/shader/recompiler/RdnaDecoder/src/RdnaVectorOpDecoder.cpp b/core/shader/recompiler/RdnaDecoder/src/RdnaVectorOpDecoder.cpp
index 02ccb674b8..d3c9624463 100644
--- a/core/shader/recompiler/RdnaDecoder/src/RdnaVectorOpDecoder.cpp
+++ b/core/shader/recompiler/RdnaDecoder/src/RdnaVectorOpDecoder.cpp
@@ -2480,9 +2480,6 @@ RdnaInstruction DecodeRdnaVop3p(std::uint32_t programCounter, std::span<const st
     if (instruction.sourceCount > 2u) {
         instruction.source2 = DecodeRdnaScalarSource(src2, programCounter);
     }
-    if (instruction.op == RdnaOpcode::VDot2F32F16 && ((((opSel | negHi) >> 2u) & 1u) != 0u || ((opSelHi >> 2u) & 1u) == 0u)) {
-        throw std::invalid_argument("VOP3P v_dot2_f32_f16 accumulator op_sel, op_sel_hi and neg_hi are not implemented");
-    }
     if (instruction.op == RdnaOpcode::VFmaF32 || instruction.op == RdnaOpcode::VDot2F32F16 || isMadMixF16(instruction.op) || isPackedVop3p(instruction.op) || isVop3pIntegerSaturate(instruction.op)) {
         instruction.destination.clamp = clamp != 0u;
     } else if (clamp != 0u && instruction.op != RdnaOpcode::VPkMulLoU16) {
@@ -2493,6 +2490,12 @@ RdnaInstruction DecodeRdnaVop3p(std::uint32_t programCounter, std::span<const st
     } else {
         applyVop3pSourceModifiers(instruction, opSel, opSelHi, neg, negHi);
     }
+    if (instruction.op == RdnaOpcode::VDot2F32F16) {
+        instruction.source2.opSel = false;
+        instruction.source2.opSelHi = true;
+        instruction.source2.absolute = instruction.source2.negateHi;
+        instruction.source2.negateHi = false;
+    }
     if (instruction.op == RdnaOpcode::VMadMixloF16) {
         applyVop3pMixAbsModifiers(instruction);
         instruction.destination.sdwaSel = 4;
diff --git a/core/shader/recompiler/Recompiler.cpp b/core/shader/recompiler/Recompiler.cpp
index e0af0b427a..3aa81cb5d7 100644
--- a/core/shader/recompiler/Recompiler.cpp
+++ b/core/shader/recompiler/Recompiler.cpp
@@ -153,6 +153,10 @@ std::uint32_t DeviceMemoryLdsBytes(const RecompileRequest& request) {
     return bytes + 4u > request.target.maxWorkgroupSharedMemoryBytes ? static_cast<std::uint32_t>(bytes) : 0u;
 }
 
+bool HardwareFloat32Flush(const RecompileRequest& request) {
+    return request.target.float32FlushToZero && (!request.context.floatMode.has_value() || ((request.context.floatMode->floatMode >> 4u) & 3u) == 0u);
+}
+
 std::atomic<std::uint64_t> frontEndBuilds{0};
 
 }
@@ -169,7 +173,7 @@ struct PreparedControlFlow {
 
     bool Matches(const RecompileRequest& request, const SwappcInfo& swappcInfo) const {
         return stage == request.shader.stage && mergedHull == MergedHullStage(request) && swappc.fetchCallAllowed == swappcInfo.fetchCallAllowed &&
-               swappc.userDataBaseRegister == swappcInfo.userDataBaseRegister && swappc.userDataCount == swappcInfo.userDataCount &&
+               swappc.userDataBaseRegister == swappcInfo.userDataBaseRegister && swappc.userDataCount == swappcInfo.userDataCount && swappc.waveSize == swappcInfo.waveSize &&
                std::ranges::equal(fallbacks, swappcInfo.linkedCallFallbacks) && std::ranges::equal(code, request.shader.code);
     }
 
@@ -189,7 +193,7 @@ struct PreparedControlFlow {
 
 std::shared_ptr<const PreparedControlFlow> ShaderPreparationContext::AcquireFrontend(const RecompileRequest& request) {
     const auto inputInfo = RequestInputInfo(request);
-    const SwappcInfo swappc{inputInfo.vertex != nullptr, request.context.userDataBaseRegister, static_cast<std::uint32_t>(request.context.userData.size()), 0u, request.context.linkedCallFallbacks};
+    const SwappcInfo swappc{inputInfo.vertex != nullptr, request.context.userDataBaseRegister, static_cast<std::uint32_t>(request.context.userData.size()), request.context.waveSize, request.context.linkedCallFallbacks};
     static const bool reuse = std::getenv("APS5_NO_PERF_FRONTEND_PAIR") == nullptr;
     if (reuse && frontend != nullptr && frontend->Matches(request, swappc)) {
         return frontend;
@@ -240,8 +244,9 @@ IrProgram PrepareResourceProgram(const RecompileRequest& request, ShaderPreparat
     translateOptions.nativeFloat16 = supports(spv::CapabilityFloat16) && supports(spv::CapabilityRoundingModeRTE) && supports(spv::CapabilityDenormPreserve);
     translateOptions.interpolationFunctions = supports(spv::CapabilityInterpolationFunction);
     translateOptions.floatMode = request.context.floatMode;
-    translateOptions.float32FlushToZero = request.target.float32FlushToZero;
+    translateOptions.float32FlushToZero = HardwareFloat32Flush(request);
     translateOptions.inputInfo = inputInfo;
+    translateOptions.float32DenormPreserve = request.target.float32DenormPreserve;
 
     constexpr InstructionTranslator translator;
 
@@ -326,6 +331,8 @@ IrProgram PrepareResourceProgram(const RecompileRequest& request, ShaderPreparat
         tessellationLowering.Lower(program, inputInfo.vertex->tess, request.target.tessellation ? &*request.target.tessellation : nullptr);
     }
 
+    deadCodeEliminator.EliminateUnobservedPhis(program);
+    deadCodeEliminator.Eliminate(program);
     constexpr SrtWalker srtWalker;
     srtWalker.BuildPlan(program);
     deadCodeEliminator.Eliminate(program);
@@ -346,11 +353,23 @@ IrProgram PrepareResourceProgram(const RecompileRequest& request, ShaderPreparat
 // A materialized result of one variant over one snapshot (Recompile(request, capture)): the
 // shared immutable object every later capture that reproduces the snapshot receives, so Populate
 // and the per-request copy run once per distinct snapshot.
+struct MemoPatch {
+    static constexpr std::uint32_t NoBinding = ~0u;
+    std::vector<std::pair<std::uint32_t, std::vector<std::uint32_t>>> buffers;
+    std::vector<std::uint32_t> userWords;
+    std::uint32_t shaderData = NoBinding;
+    std::uint32_t flattenedSrt = NoBinding;
+    bool pushData = false;
+    bool valid = false;
+};
+
 struct ResultMemoEntry {
     std::uint64_t variantId = 0;
     std::uint64_t hash = 0;
     std::shared_ptr<const RecompileResult> result;
     std::uint64_t used = 0;
+    std::shared_ptr<const MemoPatch> patch;
+    std::uint64_t bytes = 0;
 };
 
 struct EmissionFailure {
@@ -380,7 +399,7 @@ struct SourceEntry : std::enable_shared_from_this<SourceEntry> {
     std::vector<std::shared_ptr<const CompiledVariant>> variants;
     std::vector<EmissionFailure> emissionFailures;
     std::unique_ptr<ResultMemoTable> memo;
-    std::uint64_t memoClock = 0;
+    std::unique_ptr<ResultMemoTable> maskedMemo;
 };
 
 namespace {
@@ -493,11 +512,7 @@ std::shared_ptr<SourceEntry> getSource(const RecompileRequest& request, ShaderPr
             std::vector<std::byte> planKey;
             if (disk) {
                 ShaderDiskCache::BuildPlanKey(request, HostSubgroupSize(request), planKey);
-                IrResourcePlan loaded;
-                if (ShaderDiskCache::LoadPlan(planKey, loaded)) {
-                    loaded.shaderHash = request.shader.codeAddress;
-                    source->plan = std::make_shared<const IrResourcePlan>(std::move(loaded));
-                }
+                source->plan = ShaderDiskCache::LoadSharedPlan(planKey, request.shader.codeAddress);
             }
             if (source->plan == nullptr) {
                 try {
@@ -603,9 +618,11 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program)
     targetOptions.float16DenormPreserve = request.target.float16DenormPreserve;
     targetOptions.spannedWaves = request.target.spannedWaves;
     targetOptions.robustBufferAccess2 = request.target.robustBufferAccess2;
-    targetOptions.float32FlushToZero = request.target.float32FlushToZero;
+    targetOptions.float32FlushToZero = HardwareFloat32Flush(request);
     targetOptions.float32DenormPreserve = request.target.float32DenormPreserve;
     targetOptions.fusedExactArithmetic = request.target.fusedExactArithmetic;
+    targetOptions.largePixelFunctionLdsBuffer = request.target.largePixelFunctionLdsBuffer;
+    targetOptions.pixelFunctionStorageDwords = request.target.pixelFunctionStorageDwords;
     targetOptions.meshBarycentricPixel = request.shader.stage == ShaderStage::Fragment && request.graphics && request.graphics->mesh;
     if (request.shader.stage == ShaderStage::Mesh && request.graphics && request.graphics->meshBarycentrics) {
         const auto& paired = *request.graphics->meshBarycentrics;
@@ -640,6 +657,7 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program)
         if (budget.bytes > limits.maxOutputMemoryBytes) throw std::runtime_error("barycentric emulation on the mesh path needs " + std::to_string(budget.bytes) + " bytes of mesh output memory, the device allows " + std::to_string(limits.maxOutputMemoryBytes));
     }
     targetOptions.waveLdsMemoryBarriers = request.target.waveLdsMemoryBarriers;
+    targetOptions.deviceScopeLdsMemoryBarriers = request.target.deviceScopeLdsMemoryBarriers;
 
     constexpr SpirvEmitter spirvEmitter;
     CompiledShaderArtifact result;
@@ -650,30 +668,34 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program)
     } catch (const SpannedWaveUnsupported& error) {
         std::fprintf(stderr, "[spanned-wave] 0x%llx falls back to two lanes per invocation: %s\n", static_cast<unsigned long long>(request.shader.codeAddress), error.what());
         targetOptions.spannedWaves = false;
-        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions);
+        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions, &emitted);
     }
     if (registration && result.spirv.size() > request.target.registrationWordLimit) {
         registration = false;
         program.Metadata().bindingLayoutComplete = false;
         bindings = bindingAllocator.Allocate(program, request.layout, false, stencilReplay);
         targetOptions.registrationModules = false;
-        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions);
+        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions, &emitted);
     }
     result.registrationModule = registration;
     if (request.shader.stage == ShaderStage::Mesh && request.graphics) result.meshBarycentrics = request.graphics->meshBarycentrics;
     result.stencilReplaySafe = (request.shader.stage == ShaderStage::Vertex || stencilReplay) && StencilReplaySafe(program);
+    result.bdaWrites = program.Info().bdaWrites;
     if (stencilReplay) {
         result.stencilReferences = StencilReferenceValues(program, request.context.pixel.has_value() && request.context.pixel->stencilOperationValueExport ? 8u : 0u);
         result.stencilReferenceDword = bindings.layout.stencilReferenceDword;
     }
 
     result.bdaAbiVersion = program.Info().usesDma || program.Info().usesFaultBuffer ? request.target.bdaAbiVersion : 0u;
+    result.windowLaneGuards = 0;
+    for (const auto& block : program.Blocks()) result.windowLaneGuards += static_cast<std::uint32_t>(std::ranges::count_if(block->Instructions(), [](const IrValue* value) { return value->Opcode() == IrOpcode::WindowLaneGuard; }));
     result.memoryOffsetDword = bindings.layout.memoryOffsetDword;
     result.shaderDataDwords = bindings.layout.ShaderDataDwords();
     result.imageMetadataDword = bindings.layout.ImageMetadataDword();
     result.runtimeImageCount = bindings.layout.runtimeImageCount;
     result.hostSubgroupSize = HostSubgroupSize(request);
     result.fullSubgroups = emitted.fullSubgroups;
+    result.functionLdsBuffer = emitted.functionLdsBuffer;
     result.vertexOffsetSgpr = program.Info().vertexOffsetSgpr;
     result.instanceOffsetSgpr = program.Info().instanceOffsetSgpr;
     result.vertexOffsetShared = program.Info().vertexOffsetShared;
@@ -733,12 +755,19 @@ CompiledVariant compileVariant(const RecompileRequest& request, IrProgram progra
 
 struct SpecializedModule {
     std::uint64_t specializationId = 0;
-    SharedSpirv spirv;
     std::vector<std::uint32_t> bindings;
     bool pushData = false;
+    SpirvContentHash hash;
+    mutable std::mutex mutex;
+    mutable SharedSpirv::Weak spirv;
 };
 
-std::shared_ptr<const SpecializedModule> buildSpecializedModule(const CompiledShaderArtifact& artifact, std::span<const std::uint32_t> classes, std::span<const PipelineSpecializationConstant> constants, const SpirvTarget& target) {
+struct SpecializedSpirv {
+    std::shared_ptr<const SpecializedModule> module;
+    SharedSpirv spirv;
+};
+
+std::vector<std::uint32_t> specializeWords(const CompiledShaderArtifact& artifact, std::span<const std::uint32_t> classes, std::span<const PipelineSpecializationConstant> constants, const SpirvTarget& target) {
     auto source = SpecializeVertexInputTypes(artifact, classes);
     std::map<std::uint32_t, std::uint32_t> supplied;
     for (const auto& constant : constants) {
@@ -832,21 +861,39 @@ std::shared_ptr<const SpecializedModule> buildSpecializedModule(const CompiledSh
 #if ANYPS5_ENABLE_SPIRV_TOOLS
     materialized = ValidateAndOptimizeSpirv(materialized, target.vulkanVersion, target.spirvVersion, target.nonConstantImageOffsets, false);
 #endif
+    return materialized;
+}
+
+SpecializedSpirv buildSpecializedModule(const CompiledShaderArtifact& artifact, std::span<const std::uint32_t> classes, std::span<const PipelineSpecializationConstant> constants, const SpirvTarget& target) {
+    auto materialized = specializeWords(artifact, classes, constants, target);
     auto module = std::make_shared<SpecializedModule>();
     std::map<std::uint32_t, std::uint32_t> bindingNumbers;
+    std::unordered_set<std::uint32_t> functionLdsBuffer;
     for (std::size_t cursor = 5; cursor < materialized.size();) {
         const auto count = materialized[cursor] >> 16u;
         const auto op = static_cast<spv::Op>(materialized[cursor] & 0xffffu);
         if (op == spv::OpDecorate && count == 4u && materialized[cursor + 2u] == spv::DecorationBinding) bindingNumbers.emplace(materialized[cursor + 1u], materialized[cursor + 3u]);
-        if (op == spv::OpVariable && count >= 4u) {
+        if (op == spv::OpDecorate && count == 4u && materialized[cursor + 2u] == spv::DecorationDescriptorSet && materialized[cursor + 3u] == PixelFunctionLdsDescriptorSet) functionLdsBuffer.insert(materialized[cursor + 1u]);
+        if (op == spv::OpVariable && count >= 4u && !functionLdsBuffer.contains(materialized[cursor + 2u])) {
             if (const auto found = bindingNumbers.find(materialized[cursor + 2u]); found != bindingNumbers.end()) module->bindings.push_back(found->second);
             module->pushData |= materialized[cursor + 3u] == spv::StorageClassPushConstant;
         }
         cursor += count;
     }
-    module->spirv = std::move(materialized);
+    auto spirv = InternSpirv(std::move(materialized));
+    module->hash = spirv.ContentHash();
+    module->spirv = spirv.Weaken();
     module->specializationId = constants.empty() ? 0u : nextVariantId();
-    return module;
+    return {std::move(module), std::move(spirv)};
+}
+
+SharedSpirv specializedWords(const SpecializedModule& module, const CompiledShaderArtifact& artifact, std::span<const std::uint32_t> classes, std::span<const PipelineSpecializationConstant> constants, const SpirvTarget& target) {
+    std::lock_guard lock(module.mutex);
+    if (auto spirv = module.spirv.Lock(); !spirv.empty()) return spirv;
+    auto spirv = InternSpirv(specializeWords(artifact, classes, constants, target));
+    if (spirv.ContentHash() != module.hash) throw std::runtime_error("ShaderRecompiler: a specialized module built again from its key differs from its first build");
+    module.spirv = spirv.Weaken();
+    return spirv;
 }
 
 struct SpecializedModuleEntry {
@@ -876,7 +923,12 @@ struct RegistrationModuleEntry {
     std::shared_ptr<const SpecializedModule> module;
 };
 
-std::shared_ptr<const SpecializedModule> registrationModule(std::uint64_t variantId, std::span<const std::uint32_t> moduleKey, const std::function<std::shared_ptr<const SpecializedModule>()>& specialize) {
+SharedSpirv lockedWords(const SpecializedModule& module) {
+    std::lock_guard lock(module.mutex);
+    return module.spirv.Lock();
+}
+
+SpecializedSpirv registrationModule(std::uint64_t variantId, std::span<const std::uint32_t> moduleKey, const std::function<SpecializedSpirv()>& specialize) {
     std::vector<std::uint64_t> key{variantId};
     key.insert(key.end(), moduleKey.begin(), moduleKey.end());
     static PrimedSharedMutex mutex;
@@ -891,15 +943,20 @@ std::shared_ptr<const SpecializedModule> registrationModule(std::uint64_t varian
         const auto found = modules.find(key);
         entry = found != modules.end() ? found->second : modules.emplace(key, std::make_shared<RegistrationModuleEntry>()).first->second;
     }
+    SharedSpirv built;
     std::call_once(entry->ready, [&] {
         try {
-            entry->module = specialize();
+            auto specialized = specialize();
+            entry->module = std::move(specialized.module);
+            built = std::move(specialized.spirv);
         } catch (...) {
             entry->failure = std::current_exception();
         }
     });
     if (entry->failure) std::rethrow_exception(entry->failure);
-    return entry->module;
+    if (built.empty()) built = lockedWords(*entry->module);
+    if (built.empty()) built = specialize().spirv;
+    return {entry->module, std::move(built)};
 }
 
 std::shared_ptr<PreparedBindingPlan> preparedBindingPlan(const CompiledVariant& variant, const ResourceSnapshot& snapshot, std::span<const std::uint8_t> exports, bool fragmentDescriptorSet) {
@@ -952,7 +1009,7 @@ std::shared_ptr<PreparedBindingPlan> preparedBindingPlan(const CompiledVariant&
     return plan;
 }
 
-std::shared_ptr<const SpecializedModule> specializeModule(const CompiledShaderArtifact& artifact, std::span<const std::uint32_t> classes, std::span<const PipelineSpecializationConstant> constants, const SpirvTarget& target) {
+SpecializedSpirv specializeModule(const CompiledShaderArtifact& artifact, std::span<const std::uint32_t> classes, std::span<const PipelineSpecializationConstant> constants, const SpirvTarget& target) {
     struct ModuleKeyStorage {};
     auto& key = HostThreadLocal<std::vector<std::uint64_t>, ModuleKeyStorage>();
     key.clear();
@@ -970,18 +1027,60 @@ std::shared_ptr<const SpecializedModule> specializeModule(const CompiledShaderAr
         const auto found = modules.find(key);
         entry = found != modules.end() ? found->second : modules.emplace(key, std::make_shared<SpecializedModuleEntry>()).first->second;
     }
+    SharedSpirv built;
     std::call_once(entry->ready, [&] {
         try {
-            entry->module = buildSpecializedModule(artifact, classes, constants, target);
+            auto specialized = buildSpecializedModule(artifact, classes, constants, target);
+            entry->module = std::move(specialized.module);
+            built = std::move(specialized.spirv);
         } catch (...) {
             entry->failure = std::current_exception();
         }
     });
     if (entry->failure) std::rethrow_exception(entry->failure);
-    return entry->module;
+    if (built.empty()) built = specializedWords(*entry->module, artifact, classes, constants, target);
+    return {entry->module, std::move(built)};
 }
 
-RecompileResult materializeResult(const CompiledVariant& variant, const RecompileRequest& request, const ResourceSnapshot& snapshot, bool registrationDefaults = false) {
+const ResourceSnapshot& mergeTargetImage(const CompiledVariant& variant, const RecompileRequest& request, const ResourceSnapshot& snapshot, bool registrationDefaults, ResourceSnapshot& merged) {
+    const auto& images = variant.info.info.images;
+    const auto image = std::ranges::find_if(images, [](const ImageResource& candidate) { return candidate.targetMerge; });
+    if (image == images.end() || registrationDefaults) return snapshot;
+    if (!request.context.pixel || request.context.pixel->targetMerge.mask == 0u) throw std::runtime_error("ShaderRecompiler: a color target merge variant was materialized without the merged target");
+    if (image + 1 != images.end() || snapshot.images.size() + 1u != images.size()) throw std::runtime_error("ShaderRecompiler: the captured images do not precede the color target merge image");
+    merged = snapshot;
+    DescriptorValue descriptor;
+    std::ranges::copy(request.context.pixel->targetMerge.descriptor, descriptor.dwords.begin());
+    descriptor.dwordCount = 8u;
+    descriptor.availableDwordMask = 0xffu;
+    merged.images.push_back(descriptor);
+    return merged;
+}
+
+void recordMemoPatch(MemoPatch& patch, const DescriptorBindingPlan& plan, const CompiledVariant& variant) {
+    const auto& layout = variant.bindings.layout;
+    patch = {};
+    for (std::size_t index = 0; index < plan.bindings.size(); ++index) {
+        const auto& binding = plan.bindings[index];
+        const auto position = static_cast<std::uint32_t>(index);
+        if (binding.descriptor.role == DescriptorRole::GuestBuffers) {
+            patch.buffers.push_back({position, binding.resources});
+        } else if (binding.descriptor.role == DescriptorRole::FlattenedSrt) {
+            patch.flattenedSrt = position;
+        } else if (binding.descriptor.role == DescriptorRole::ShaderData) {
+            patch.shaderData = position;
+        }
+    }
+    patch.pushData = layout.UsesPushData();
+    if (patch.pushData || plan.storageData) {
+        for (const auto reg : layout.userDataRegisters) patch.userWords.push_back(reg - variant.info.userDataBase);
+    }
+    patch.valid = layout.userDataRegisters.size() <= layout.DispatchThreadLimitDword() && (patch.userWords.empty() || patch.pushData || patch.shaderData != MemoPatch::NoBinding);
+}
+
+RecompileResult materializeResult(const CompiledVariant& variant, const RecompileRequest& request, const ResourceSnapshot& captured, bool registrationDefaults = false, MemoPatch* patch = nullptr) {
+    ResourceSnapshot merged;
+    const auto& snapshot = mergeTargetImage(variant, request, captured, registrationDefaults, merged);
     RecompileResult result;
     const auto& artifact = variant.artifact;
     static_cast<CompiledShaderArtifact&>(result) = {
@@ -1002,12 +1101,14 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
         .instanceOffsetConflict = artifact.instanceOffsetConflict,
         .hostSubgroupSize = artifact.hostSubgroupSize,
         .fullSubgroups = artifact.fullSubgroups,
+        .functionLdsBuffer = artifact.functionLdsBuffer,
         .parameterExports = artifact.parameterExports,
         .fragmentParameters = artifact.fragmentParameters,
         .barycentricEmulation = artifact.barycentricEmulation,
         .meshBarycentrics = artifact.meshBarycentrics,
         .stencilReferences = artifact.stencilReferences,
         .stencilReplaySafe = artifact.stencilReplaySafe,
+        .bdaWrites = artifact.bdaWrites,
         .stencilReferenceDword = artifact.stencilReferenceDword,
         .variantId = artifact.variantId
     };
@@ -1057,7 +1158,13 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
             formatComponents = 1u;
             for (std::uint32_t component = 0; component < 4u; ++component) {
                 const auto selector = (input.outputMask & (1u << component)) != 0u ? (resource.fields[3] >> (component * 3u)) & 7u : 0u;
-                if (selector == 2u || selector == 3u) throw std::runtime_error("reserved prepared vertex component selector");
+                if (selector == 2u || selector == 3u) {
+                    const auto& fields = resource.fields;
+                    char message[192];
+                    std::snprintf(message, sizeof(message), "reserved prepared vertex component selector %u at location %u component %u (V#=[%08x %08x %08x %08x])",
+                        selector, input.location, component, fields[0], fields[1], fields[2], fields[3]);
+                    throw std::runtime_error(message);
+                }
                 if (selector >= 4u) formatComponents = std::max(formatComponents, selector - 3u);
                 selectors |= selector << (component * 3u);
             }
@@ -1075,7 +1182,7 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
             const auto found = plan->modules.find(moduleKey);
             entry = found != plan->modules.end() ? found->second : plan->modules.emplace(moduleKey, std::make_shared<PreparedModuleEntry>()).first->second;
         }
-        const auto prepare = [&] {
+        const auto specialize = [&] {
             auto constants = plan->bindings.specialization;
             std::size_t index = 0;
             if (variant.bindings.layout.UsesPushData()) constants.push_back({PipelineSpecialization::PushDataOffset, moduleKey[index++]});
@@ -1100,11 +1207,17 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
                     constants.push_back({first + 5u, kind});
                 }
             }
-            const auto module = artifact.registrationModule && plan->bindings.specialization.empty() ? registrationModule(artifact.variantId, moduleKey, [&] { return specializeModule(variant.artifact, vertexClasses, constants, request.target); }) : specializeModule(variant.artifact, vertexClasses, constants, request.target);
+            return artifact.registrationModule && plan->bindings.specialization.empty() ? registrationModule(artifact.variantId, moduleKey, [&] { return specializeModule(variant.artifact, vertexClasses, constants, request.target); }) : specializeModule(variant.artifact, vertexClasses, constants, request.target);
+        };
+        SharedSpirv built;
+        const auto prepare = [&] {
+            auto specialized = specialize();
+            const auto& module = specialized.module;
             if (variant.bindings.layout.UsesPushData() && !module->pushData) throw std::runtime_error("specialization removed the prepared push constant interface");
             auto selected = DescriptorBindingBuilder{}.Select(plan->bindings, module->bindings);
             entry->bindings = std::move(selected);
             entry->module = module;
+            built = std::move(specialized.spirv);
         };
         std::call_once(entry->ready, [&] {
             try {
@@ -1115,8 +1228,10 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
         });
         if (entry->failure) std::rethrow_exception(entry->failure);
         const auto& module = entry->module;
+        if (built.empty()) built = lockedWords(*module);
+        if (built.empty()) built = specialize().spirv;
         result.specializationId = module->specializationId;
-        result.spirv = module->spirv;
+        result.spirv = std::move(built);
         bindingPlan = &entry->bindings;
     } else {
         result.spirv = artifact.spirv;
@@ -1125,6 +1240,7 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
     const auto& tables = *resolved;
     BindingAllocationResult bindings;
     DescriptorBindingBuilder{}.Populate(bindings, variant.bindings, *bindingPlan, variant.info.userDataBase, snapshot, partialThreads(request), &tables);
+    if (patch != nullptr) recordMemoPatch(*patch, *bindingPlan, variant);
     result.workgroupMemoryDwords = WorkgroupMemoryStrideDwords(variant.info.info);
     result.bindings = std::move(bindings.bindings);
     if (std::ranges::none_of(result.bindings, [](const DescriptorBinding& binding) { return binding.role == DescriptorRole::BdaPagetable || binding.role == DescriptorRole::FaultBuffer; })) result.bdaAbiVersion = 0u;
@@ -1170,6 +1286,23 @@ bool sameLayout(const BindingLayout& left, const BindingLayout& right) {
 
 }
 
+SharedSpirv InternSpirv(std::vector<std::uint32_t> words) {
+    SharedSpirv spirv(std::move(words));
+    const auto hash = spirv.ContentHash();
+    static std::mutex mutex;
+    static std::unordered_map<std::uint64_t, std::vector<SharedSpirv::Weak>> interned;
+    std::lock_guard lock(mutex);
+    const auto bucket = hash.low ^ (hash.high * 0x9e3779b97f4a7c15ull);
+    auto& candidates = interned[bucket];
+    std::erase_if(candidates, [](const SharedSpirv::Weak& candidate) { return candidate.Expired(); });
+    for (const auto& weak : candidates) {
+        const auto candidate = weak.Lock();
+        if (candidate.ContentHash() == hash && candidate == spirv) return candidate;
+    }
+    candidates.push_back(spirv.Weaken());
+    return spirv;
+}
+
 MeshOutputBudget MeshBarycentricOutputBudget(const MeshConfiguration& mesh, const MeshTargetLimits& limits, const MeshOutputUse& use) {
     const auto alignUp = [](std::uint64_t value, std::uint64_t granularity) { return granularity <= 1u ? value : (value + granularity - 1u) / granularity * granularity; };
     MeshOutputBudget budget;
@@ -1306,21 +1439,196 @@ bool ResultMemo() {
     return resultMemo;
 }
 
-ResultMemoEntry* memoSet(SourceEntry& source, std::uint64_t index) {
-    if (source.memo == nullptr) return nullptr;
-    return source.memo->data() + static_cast<std::size_t>((index ^ (index >> 32u)) % ResultMemoSets) * ResultMemoWays;
+bool MaskedResultMemo() {
+    static const bool masked = std::getenv("APS5_NO_MASKED_RESULT_MEMO") == nullptr;
+    return masked;
+}
+
+bool VerifyMaskedResultMemo() {
+    static const bool verify = std::getenv("APS5_VERIFY_MASKED_RESULT_MEMO") != nullptr;
+    return verify;
+}
+
+ResultMemoEntry* memoSet(const std::unique_ptr<ResultMemoTable>& table, std::uint64_t index) {
+    if (table == nullptr) return nullptr;
+    return table->data() + static_cast<std::size_t>((index ^ (index >> 32u)) % ResultMemoSets) * ResultMemoWays;
 }
 
 struct ResultMemoCounters {
-    std::atomic<std::uint64_t> hits{0}, misses{0}, evictions{0}, populateNanoseconds{0};
+    std::atomic<std::uint64_t> hits{0}, patched{0}, misses{0}, evictions{0}, trimmed{0}, populateNanoseconds{0}, patchNanoseconds{0}, mismatches{0};
     std::atomic<std::int64_t> lastReport{0};
+    std::atomic<std::uint64_t> clock{0}, heldBytes{0}, heldEntries{0};
 };
 
+void applyMemoPatch(RecompileResult& result, const MemoPatch& patch, const ResourceSnapshot& snapshot) {
+    for (const auto& [binding, resources] : patch.buffers) {
+        auto& words = result.bindings.at(binding).guestDescriptor;
+        if (words.size() != resources.size() * 4u) throw std::runtime_error("a patched guest buffer binding changed its width");
+        for (std::size_t element = 0; element < resources.size(); ++element) std::copy_n(snapshot.buffers.at(resources[element]).dwords.begin(), 4u, words.begin() + element * 4u);
+    }
+    if (!patch.userWords.empty()) {
+        if (patch.pushData) {
+            if (patch.userWords.size() * sizeof(std::uint32_t) > result.pushConstants.size()) throw std::runtime_error("patched user data lies outside the push data");
+            for (std::size_t word = 0; word < patch.userWords.size(); ++word) std::memcpy(result.pushConstants.data() + word * sizeof(std::uint32_t), &snapshot.userData.at(patch.userWords[word]), sizeof(std::uint32_t));
+        } else {
+            auto& words = result.bindings.at(patch.shaderData).guestDescriptor;
+            if (patch.userWords.size() > words.size()) throw std::runtime_error("patched user data lies outside the shader data");
+            for (std::size_t word = 0; word < patch.userWords.size(); ++word) words[word] = snapshot.userData.at(patch.userWords[word]);
+        }
+    }
+    if (patch.flattenedSrt != MemoPatch::NoBinding) result.bindings.at(patch.flattenedSrt).guestDescriptor = snapshot.flattenedSrt;
+    result.poisonedSrtReads = static_cast<std::uint32_t>(snapshot.srtPoison.size()) + snapshot.nullRootReads;
+}
+
+const char* patchedResultDifference(const RecompileResult& patched, const RecompileResult& full) {
+    if (patched.bindings.size() != full.bindings.size()) return "binding count";
+    if (patched.pushConstants != full.pushConstants) return "push constants";
+    if (patched.specializationId != full.specializationId || patched.spirv.ContentHash() != full.spirv.ContentHash()) return "module";
+    if (patched.poisonedSrtReads != full.poisonedSrtReads) return "poisoned SRT reads";
+    if (patched.shaderDataUserWords != full.shaderDataUserWords) return "shader data user words";
+    if (patched.specialization.size() != full.specialization.size()) return "specialization";
+    for (std::size_t index = 0; index < patched.specialization.size(); ++index) {
+        if (patched.specialization[index].id != full.specialization[index].id || patched.specialization[index].value != full.specialization[index].value) return "specialization";
+    }
+    for (std::size_t index = 0; index < patched.bindings.size(); ++index) {
+        const auto& left = patched.bindings[index];
+        const auto& right = full.bindings[index];
+        if (left.role != right.role || left.binding != right.binding || left.count != right.count) return "binding shape";
+        if (left.guestDescriptor != right.guestDescriptor) return "binding words";
+    }
+    return nullptr;
+}
+
 ResultMemoCounters& resultMemoCounters() {
     static ResultMemoCounters counters;
     return counters;
 }
 
+std::uint64_t nextMemoUse() {
+    return resultMemoCounters().clock.fetch_add(1, std::memory_order_relaxed) + 1u;
+}
+
+template <typename T>
+std::uint64_t vectorBytes(const std::vector<T>& values) {
+    return static_cast<std::uint64_t>(values.capacity()) * sizeof(T);
+}
+
+std::uint64_t vectorBytes(const std::vector<bool>& values) {
+    return static_cast<std::uint64_t>(values.capacity() + 7u) / 8u;
+}
+
+std::uint64_t descriptorBindingBytes(const DescriptorBinding& binding) {
+    return vectorBytes(binding.guestDescriptor) + vectorBytes(binding.imageShapes) + vectorBytes(binding.imageSamplers) + vectorBytes(binding.bufferExtent) + vectorBytes(binding.samplerDepthCompare) + vectorBytes(binding.imageWritten) + vectorBytes(binding.imageDepthCompare) + vectorBytes(binding.imageAtomic) + vectorBytes(binding.imageAtomic64) + vectorBytes(binding.bufferAtomic) + vectorBytes(binding.bufferWritten) + vectorBytes(binding.samplerUnnormalized) + vectorBytes(binding.samplerIntegerBorder) + vectorBytes(binding.samplerCoordinatesIgnored) + vectorBytes(binding.imageUnnormalized) + vectorBytes(binding.imageUnnormalizedBaseLevel) + vectorBytes(binding.bufferRead);
+}
+
+std::uint64_t resultBytes(const RecompileResult& result) {
+    const auto bytes = [](const auto& values) { return vectorBytes(values); };
+    auto total = static_cast<std::uint64_t>(sizeof(RecompileResult)) + bytes(result.vertexInputPatches) + bytes(result.runtimeImageResources) + bytes(result.vertexInputs) + bytes(result.parameterExports) + bytes(result.fragmentParameters) + bytes(result.stencilReferences) + bytes(result.shaderDataUserWords) + bytes(result.specialization) + bytes(result.bindings) + bytes(result.pushConstants) + bytes(result.vertexAttributes) + bytes(result.imageTablePoison) + bytes(result.imageTableRanges) + bytes(result.imageTableReadRanges);
+    for (const auto& ranges : result.imageTableReadRanges) total += bytes(ranges);
+    for (const auto& binding : result.bindings) total += descriptorBindingBytes(binding);
+    return total;
+}
+
+std::uint64_t patchBytes(const MemoPatch& patch) {
+    auto total = static_cast<std::uint64_t>(sizeof(MemoPatch)) + vectorBytes(patch.buffers) + vectorBytes(patch.userWords);
+    for (const auto& buffer : patch.buffers) total += vectorBytes(buffer.second);
+    return total;
+}
+
+std::atomic<std::uint64_t>& resultMemoBudgetBytes() {
+    static std::atomic<std::uint64_t> budget{[] {
+        const char* value = std::getenv("APS5_RESULT_MEMO_MB");
+        const std::uint64_t megabytes = value == nullptr || *value == '\0' ? 256u : std::strtoull(value, nullptr, 10);
+        return megabytes << 20u;
+    }()};
+    return budget;
+}
+
+std::uint64_t resultMemoBudget() {
+    return resultMemoBudgetBytes().load(std::memory_order_relaxed);
+}
+
+struct ResultMemoRegistry {
+    std::mutex mutex;
+    std::vector<std::weak_ptr<SourceEntry>> sources;
+};
+
+ResultMemoRegistry& resultMemoRegistry() {
+    static ResultMemoRegistry registry;
+    return registry;
+}
+
+std::mutex& resultMemoTrimMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+std::function<void()>& resultMemoTrimHook() {
+    static std::function<void()> hook;
+    return hook;
+}
+
+void trimResultMemo(std::uint64_t budget) {
+    std::lock_guard trim(resultMemoTrimMutex());
+    auto& counters = resultMemoCounters();
+    for (auto held = counters.heldBytes.load(std::memory_order_relaxed); held > budget; held = counters.heldBytes.load(std::memory_order_relaxed)) {
+        if (auto hook = std::exchange(resultMemoTrimHook(), nullptr)) hook();
+        std::vector<std::shared_ptr<SourceEntry>> sources;
+        {
+            auto& registry = resultMemoRegistry();
+            std::lock_guard lock(registry.mutex);
+            sources.reserve(registry.sources.size());
+            for (const auto& weak : registry.sources) {
+                if (auto source = weak.lock()) sources.push_back(std::move(source));
+            }
+        }
+        std::vector<std::pair<std::uint64_t, std::uint64_t>> stamps;
+        for (const auto& source : sources) {
+            std::lock_guard lock(source->mutex);
+            for (const auto* table : {source->memo.get(), source->maskedMemo.get()}) {
+                if (table == nullptr) continue;
+                for (const auto& entry : *table) {
+                    if (entry.result != nullptr) stamps.emplace_back(entry.used, entry.bytes);
+                }
+            }
+        }
+        if (stamps.empty()) return;
+        std::sort(stamps.begin(), stamps.end());
+        const auto excess = held - budget / 4u * 3u;
+        std::uint64_t freed = 0;
+        std::uint64_t threshold = 0;
+        for (const auto& [used, bytes] : stamps) {
+            threshold = used;
+            freed += bytes;
+            if (freed >= excess) break;
+        }
+        std::uint64_t dropped = 0;
+        for (const auto& source : sources) {
+            std::lock_guard lock(source->mutex);
+            for (auto* table : {source->memo.get(), source->maskedMemo.get()}) {
+                if (table == nullptr) continue;
+                for (auto& entry : *table) {
+                    if (entry.result == nullptr || entry.used > threshold) continue;
+                    counters.heldBytes.fetch_sub(entry.bytes, std::memory_order_relaxed);
+                    counters.heldEntries.fetch_sub(1, std::memory_order_relaxed);
+                    counters.trimmed.fetch_add(1, std::memory_order_relaxed);
+                    entry = {};
+                    ++dropped;
+                }
+            }
+        }
+        if (dropped == 0) return;
+    }
+}
+
+void verifyPatchedResult(const RecompileResult& patched, const RecompileResult& full, std::uint64_t variantId) {
+    const auto* difference = patchedResultDifference(patched, full);
+    if (difference == nullptr) return;
+    resultMemoCounters().mismatches.fetch_add(1, std::memory_order_relaxed);
+    static std::atomic<std::uint32_t> printed{0};
+    if (const auto index = printed.fetch_add(1, std::memory_order_relaxed); index < 20u) std::fprintf(stderr, "[recompile] masked result memo mismatch %u: variant %016llx differs in its %s\n", index + 1u, static_cast<unsigned long long>(variantId), difference);
+}
+
 void reportResultMemo() {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     if (!profile) return;
@@ -1333,16 +1641,21 @@ void reportResultMemo() {
     }
     if (now - last < 10'000'000'000ll || !counters.lastReport.compare_exchange_strong(last, now, std::memory_order_relaxed)) return;
     const auto hits = counters.hits.exchange(0, std::memory_order_relaxed);
+    const auto patched = counters.patched.exchange(0, std::memory_order_relaxed);
     const auto misses = counters.misses.exchange(0, std::memory_order_relaxed);
     const auto evictions = counters.evictions.exchange(0, std::memory_order_relaxed);
+    const auto trimmed = counters.trimmed.exchange(0, std::memory_order_relaxed);
     const auto populate = counters.populateNanoseconds.exchange(0, std::memory_order_relaxed);
-    std::fprintf(stderr, "[recompile] result memo (10 s): %llu hits, %llu misses (%.1f%% hits), Populate %.1f us per miss / %.1f ms in total, %llu evictions\n", static_cast<unsigned long long>(hits), static_cast<unsigned long long>(misses), hits + misses != 0 ? 100.0 * static_cast<double>(hits) / static_cast<double>(hits + misses) : 0.0, misses != 0 ? static_cast<double>(populate) / 1000.0 / static_cast<double>(misses) : 0.0, static_cast<double>(populate) / 1e6, static_cast<unsigned long long>(evictions));
+    const auto patching = counters.patchNanoseconds.exchange(0, std::memory_order_relaxed);
+    const auto mismatches = counters.mismatches.exchange(0, std::memory_order_relaxed);
+    const auto total = static_cast<double>(hits + patched + misses);
+    std::fprintf(stderr, "[recompile] result memo (10 s): %llu hits, %llu patched, %llu misses (%.1f%% hits, %.1f%% patched), Populate %.1f us per miss / %.1f ms in total, patch %.1f us each / %.1f ms in total, %llu evictions, %llu patch mismatches, %llu trimmed; %llu results held, %.1f MiB\n", static_cast<unsigned long long>(hits), static_cast<unsigned long long>(patched), static_cast<unsigned long long>(misses), total != 0.0 ? 100.0 * static_cast<double>(hits) / total : 0.0, total != 0.0 ? 100.0 * static_cast<double>(patched) / total : 0.0, misses != 0 ? static_cast<double>(populate) / 1000.0 / static_cast<double>(misses) : 0.0, static_cast<double>(populate) / 1e6, patched != 0 ? static_cast<double>(patching) / 1000.0 / static_cast<double>(patched) : 0.0, static_cast<double>(patching) / 1e6, static_cast<unsigned long long>(evictions), static_cast<unsigned long long>(mismatches), static_cast<unsigned long long>(trimmed), static_cast<unsigned long long>(counters.heldEntries.load(std::memory_order_relaxed)), static_cast<double>(counters.heldBytes.load(std::memory_order_relaxed)) / 1048576.0);
 }
 
 // Everything materializeResult reads besides the variant: the snapshot (the descriptor words, the
 // flattened SRT, the user data, the uniform fill) and, for the vertex family, the V# table the
 // attributes are resolved from.
-std::uint64_t snapshotHash(const RecompileRequest& request, const ResourceSnapshot& snapshot) {
+std::uint64_t snapshotHash(const RecompileRequest& request, const ResourceSnapshot& snapshot, bool masked) {
     std::uint64_t hash = 0xcbf29ce484222325ull;
     const auto mix = [&](std::uint64_t value) {
         hash ^= value;
@@ -1360,11 +1673,28 @@ std::uint64_t snapshotHash(const RecompileRequest& request, const ResourceSnapsh
             for (std::uint32_t i = 0; i < value.dwordCount && i < value.dwords.size(); ++i) mix(value.dwords[i]);
         }
     };
-    mixDescriptors(snapshot.buffers);
+    if (masked) {
+        mix(snapshot.buffers.size());
+        for (const auto& value : snapshot.buffers) {
+            mix(value.dwordCount);
+            mix(value.availableDwordMask);
+            const bool present = value.dwords[2] != 0u && (value.dwords[0] != 0u || (value.dwords[1] & 0xffffu) != 0u);
+            mix(present ? 4u | (value.dwords[0] & 3u) : 0u);
+            mix(value.dwords[1] & 0xffff0000u);
+            for (std::uint32_t i = 3; i < value.dwordCount && i < value.dwords.size(); ++i) mix(value.dwords[i]);
+        }
+    } else {
+        mixDescriptors(snapshot.buffers);
+    }
     mixDescriptors(snapshot.images);
     mixDescriptors(snapshot.samplers);
-    mixWords(snapshot.flattenedSrt);
-    mixWords(snapshot.userData);
+    if (masked) {
+        mix(snapshot.flattenedSrt.size());
+        mix(snapshot.userData.size());
+    } else {
+        mixWords(snapshot.flattenedSrt);
+        mixWords(snapshot.userData);
+    }
     mix(static_cast<std::uint64_t>(snapshot.uniformFill.kind));
     mix(snapshot.uniformFill.resource);
     for (const auto stride : snapshot.uniformFill.groupStride) mix(stride);
@@ -1398,6 +1728,11 @@ std::uint64_t snapshotHash(const RecompileRequest& request, const ResourceSnapsh
         mix(request.context.pixel->reversedBlend);
         mix(static_cast<std::uint64_t>(request.context.pixel->rasterPrimitive));
         mix(request.context.pixel->layerExported);
+        const auto& merge = request.context.pixel->targetMerge;
+        mix(merge.target);
+        mix(merge.mask);
+        mix(merge.samples);
+        for (const auto word : merge.descriptor) mix(word);
     }
     if (request.context.vertex) {
         const auto& vertex = *request.context.vertex;
@@ -1418,17 +1753,17 @@ std::uint64_t snapshotHash(const RecompileRequest& request, const ResourceSnapsh
 // as good). `memoHit` reports the hit.
 std::shared_ptr<const RecompileResult> materializePreparedMemoized(SourceEntry& source, const std::shared_ptr<const CompiledVariant>& variant, const RecompileRequest& request, const ResourceSnapshot& snapshot, bool cacheHit, bool* memoHit) {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
-    const auto hash = snapshotHash(request, snapshot);
-    std::uint64_t index = 0;
+    const auto variantId = variant->artifact.variantId;
+    const auto hash = snapshotHash(request, snapshot, false);
+    const auto index = (variantId * 0x9e3779b97f4a7c15ull) ^ hash;
     auto& counters = resultMemoCounters();
     {
         std::lock_guard lock(source.mutex);
-        index = (variant->artifact.variantId * 0x9e3779b97f4a7c15ull) ^ hash;
-        if (auto* set = memoSet(source, index)) {
+        if (auto* set = memoSet(source.memo, index)) {
             for (std::size_t way = 0; way < ResultMemoWays; ++way) {
                 auto& entry = set[way];
-                if (entry.result == nullptr || entry.variantId != variant->artifact.variantId || entry.hash != hash) continue;
-                entry.used = ++source.memoClock;
+                if (entry.result == nullptr || entry.variantId != variantId || entry.hash != hash) continue;
+                entry.used = nextMemoUse();
                 counters.hits.fetch_add(1, std::memory_order_relaxed);
                 if (memoHit != nullptr) *memoHit = true;
                 reportResultMemo();
@@ -1436,33 +1771,78 @@ std::shared_ptr<const RecompileResult> materializePreparedMemoized(SourceEntry&
             }
         }
     }
-    const auto started = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
-    auto result = std::make_shared<RecompileResult>(materializeResult(*variant, request, snapshot));
-    result->cacheHit = cacheHit;
-    if (profile) counters.populateNanoseconds.fetch_add(static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - started).count()), std::memory_order_relaxed);
-    counters.misses.fetch_add(1, std::memory_order_relaxed);
-    std::shared_ptr<const RecompileResult> shared = std::move(result);
-    {
+    const bool masking = MaskedResultMemo();
+    const auto maskedHash = masking ? snapshotHash(request, snapshot, true) : 0u;
+    const auto maskedIndex = (variantId * 0x9e3779b97f4a7c15ull) ^ maskedHash;
+    std::shared_ptr<const RecompileResult> donor;
+    std::shared_ptr<const MemoPatch> donorPatch;
+    if (masking) {
         std::lock_guard lock(source.mutex);
-        if (source.memo == nullptr) source.memo = std::make_unique<ResultMemoTable>();
-        auto* set = memoSet(source, index);
-        auto* victim = set;
-        bool present = false;
-        for (std::size_t way = 0; way < ResultMemoWays && !present; ++way) {
-            auto& entry = set[way];
-            if (entry.result != nullptr && entry.variantId == variant->artifact.variantId && entry.hash == hash) {
-                entry.used = ++source.memoClock;
-                shared = entry.result;
-                present = true;
-            } else if (entry.used < victim->used) {
-                victim = &entry;
+        if (auto* set = memoSet(source.maskedMemo, maskedIndex)) {
+            for (std::size_t way = 0; way < ResultMemoWays; ++way) {
+                auto& entry = set[way];
+                if (entry.result == nullptr || entry.variantId != variantId || entry.hash != maskedHash) continue;
+                entry.used = nextMemoUse();
+                donor = entry.result;
+                donorPatch = entry.patch;
+                break;
             }
         }
-        if (!present) {
-            if (victim->result != nullptr) counters.evictions.fetch_add(1, std::memory_order_relaxed);
-            *victim = {variant->artifact.variantId, hash, shared, ++source.memoClock};
-        }
     }
+    const auto started = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
+    std::shared_ptr<RecompileResult> result;
+    std::shared_ptr<MemoPatch> patch;
+    if (donor != nullptr) {
+        result = std::make_shared<RecompileResult>(*donor);
+        applyMemoPatch(*result, *donorPatch, snapshot);
+        if (VerifyMaskedResultMemo()) verifyPatchedResult(*result, materializeResult(*variant, request, snapshot), variantId);
+        if (profile) counters.patchNanoseconds.fetch_add(static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - started).count()), std::memory_order_relaxed);
+        counters.patched.fetch_add(1, std::memory_order_relaxed);
+    } else {
+        if (masking) patch = std::make_shared<MemoPatch>();
+        result = std::make_shared<RecompileResult>(materializeResult(*variant, request, snapshot, false, patch.get()));
+        if (profile) counters.populateNanoseconds.fetch_add(static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - started).count()), std::memory_order_relaxed);
+        counters.misses.fetch_add(1, std::memory_order_relaxed);
+    }
+    result->cacheHit = cacheHit;
+    std::shared_ptr<const RecompileResult> shared = std::move(result);
+    const auto bytes = resultBytes(*shared);
+    const auto insert = [&](std::unique_ptr<ResultMemoTable>& table, std::uint64_t at, std::uint64_t key, std::shared_ptr<const MemoPatch> recipe, bool count) {
+        if (table == nullptr) {
+            table = std::make_unique<ResultMemoTable>();
+            if (source.memo == nullptr || source.maskedMemo == nullptr) {
+                auto& registry = resultMemoRegistry();
+                std::lock_guard registryLock(registry.mutex);
+                registry.sources.push_back(source.weak_from_this());
+            }
+        }
+        auto* set = memoSet(table, at);
+        auto* victim = set;
+        for (std::size_t way = 0; way < ResultMemoWays; ++way) {
+            auto& entry = set[way];
+            if (entry.result != nullptr && entry.variantId == variantId && entry.hash == key) {
+                entry.used = nextMemoUse();
+                return entry.result;
+            }
+            if (entry.used < victim->used) victim = &entry;
+        }
+        if (victim->result != nullptr) {
+            if (count) counters.evictions.fetch_add(1, std::memory_order_relaxed);
+            counters.heldBytes.fetch_sub(victim->bytes, std::memory_order_relaxed);
+            counters.heldEntries.fetch_sub(1, std::memory_order_relaxed);
+        }
+        const auto held = bytes + (recipe != nullptr ? patchBytes(*recipe) : 0u);
+        *victim = {variantId, key, shared, nextMemoUse(), std::move(recipe), held};
+        counters.heldBytes.fetch_add(held, std::memory_order_relaxed);
+        counters.heldEntries.fetch_add(1, std::memory_order_relaxed);
+        return shared;
+    };
+    {
+        std::lock_guard lock(source.mutex);
+        shared = insert(source.memo, index, hash, nullptr, true);
+        if (patch != nullptr && patch->valid) static_cast<void>(insert(source.maskedMemo, maskedIndex, maskedHash, patch, false));
+    }
+    if (const auto budget = resultMemoBudget(); budget != 0 && counters.heldBytes.load(std::memory_order_relaxed) > budget) trimResultMemo(budget);
     reportResultMemo();
     return shared;
 }
@@ -1695,4 +2075,18 @@ std::shared_ptr<const RecompileResult> Recompile(const RecompileRequest& request
     return recompileReporting(request, [&] { return RecompileImpl(request, capture, memoHit); });
 }
 
+void SetResultMemoBudget(std::uint64_t bytes) {
+    resultMemoBudgetBytes().store(bytes, std::memory_order_relaxed);
+    if (bytes != 0 && resultMemoCounters().heldBytes.load(std::memory_order_relaxed) > bytes) trimResultMemo(bytes);
+}
+
+void SetResultMemoTrimHook(std::function<void()> hook) {
+    std::lock_guard lock(resultMemoTrimMutex());
+    resultMemoTrimHook() = std::move(hook);
+}
+
+std::uint64_t ResultMemoBytes() {
+    return resultMemoCounters().heldBytes.load(std::memory_order_relaxed);
+}
+
 }
diff --git a/core/shader/recompiler/Recompiler.hpp b/core/shader/recompiler/Recompiler.hpp
index 1a90745c62..6d3cc50544 100644
--- a/core/shader/recompiler/Recompiler.hpp
+++ b/core/shader/recompiler/Recompiler.hpp
@@ -13,6 +13,8 @@
 #include <memory>
 #include <optional>
 #include <span>
+#include <ranges>
+#include <functional>
 #include <utility>
 #include <string_view>
 #include <vector>
@@ -35,6 +37,17 @@ struct MemoryRegion {
     std::span<const std::byte> bytes;
 };
 
+class MemoryRegionView : public std::span<const MemoryRegion> {
+    using Base = std::span<const MemoryRegion>;
+public:
+    using Base::Base;
+    constexpr MemoryRegionView() noexcept = default;
+    constexpr MemoryRegionView(Base value) noexcept : Base(value) {}
+    template <std::ranges::contiguous_range TRange>
+        requires (!std::ranges::borrowed_range<TRange>)
+    MemoryRegionView(TRange&&) = delete;
+};
+
 struct ShaderBinary {
     ShaderStage stage;
     std::uint64_t codeAddress;
@@ -114,7 +127,9 @@ enum class ConservativeZExport : std::uint8_t {
 enum class ColorExportPacking : std::uint8_t {
     None,
     Unorm10_11_11,
-    Float11_11_10
+    Float11_11_10,
+    Unorm4_4_4_4,
+    Uint
 };
 
 enum class RasterPrimitive : std::uint8_t {
@@ -151,6 +166,17 @@ inline constexpr std::uint32_t One = 3u;
 
 }
 
+struct TargetMerge {
+    std::uint8_t target = 0;
+    std::uint16_t mask = 0;
+    std::uint8_t samples = 1;
+    std::array<std::uint32_t, 8> descriptor{};
+    bool depthStencilWrites = false;
+    bool depthStencilTests = false;
+
+    bool operator==(const TargetMerge&) const = default;
+};
+
 struct ShaderPixelStageInfo {
     std::uint32_t interpolatorCount;
     std::array<std::uint32_t, 32> interpolatorSettings;
@@ -191,6 +217,7 @@ struct ShaderPixelStageInfo {
     bool iteratesSamples = false;
     PixelPositionLocation positionLocation = PixelPositionLocation::Center;
     std::array<std::uint8_t, 32> sampleLocations{};
+    TargetMerge targetMerge{};
     std::array<std::uint32_t, 4> sampleOrder{};
 };
 
@@ -242,7 +269,7 @@ struct GuestContext {
     std::optional<ShaderComputeStageInfo> compute;
     std::optional<ShaderPixelStageInfo> pixel;
     std::optional<ShaderVertexStageInfo> vertex;
-    std::span<const MemoryRegion> memory;
+    MemoryRegionView memory;
     std::optional<ShaderFloatMode> floatMode;
     std::span<const std::uint32_t> linkedCallFallbacks;
     bool convertedSamples = false;
@@ -299,6 +326,9 @@ struct SpirvTarget {
     bool waveLdsMemoryBarriers = false;
     bool float32DenormPreserve = false;
     bool fusedExactArithmetic = false;
+    bool largePixelFunctionLdsBuffer = false;
+    std::uint32_t pixelFunctionStorageDwords = 4096u;
+    bool deviceScopeLdsMemoryBarriers = false;
 };
 
 struct BindingLayout {
@@ -575,6 +605,8 @@ inline std::uint64_t HashSpirvWords(std::span<const std::uint32_t> words, std::u
 // reference, or the per-dispatch copy this class removes comes back without a compiler hint.
 // ContentHash is computed once per shared holder, on first use, and dropped by a write.
 class SharedSpirv {
+    struct Holder;
+
 public:
     SharedSpirv() = default;
     SharedSpirv(std::vector<std::uint32_t> words) : holder(std::make_shared<Holder>(std::move(words), nullptr, std::span<const std::uint32_t>{})) {}
@@ -611,6 +643,25 @@ public:
     std::vector<std::uint32_t>::iterator insert(std::vector<std::uint32_t>::const_iterator where, std::initializer_list<std::uint32_t> values) { return Mutable().insert(where, values); }
     friend bool operator==(const SharedSpirv& left, const SharedSpirv& right) { return std::ranges::equal(left.Words(), right.Words()); }
 
+    class Weak {
+    public:
+        [[nodiscard]] SharedSpirv Lock() const {
+            SharedSpirv spirv;
+            spirv.holder = holder.lock();
+            return spirv;
+        }
+        [[nodiscard]] bool Expired() const { return holder.expired(); }
+
+    private:
+        friend class SharedSpirv;
+        std::weak_ptr<Holder> holder;
+    };
+    [[nodiscard]] Weak Weaken() const {
+        Weak weak;
+        weak.holder = holder;
+        return weak;
+    }
+
 private:
     struct Holder {
         Holder(std::vector<std::uint32_t> words, std::shared_ptr<const void> owner, std::span<const std::uint32_t> view) : words(std::move(words)), owner(std::move(owner)), view(view) {}
@@ -635,6 +686,8 @@ private:
     std::shared_ptr<Holder> holder;
 };
 
+[[nodiscard]] SharedSpirv InternSpirv(std::vector<std::uint32_t> words);
+
 struct VertexInput {
     std::uint32_t location;
     std::uint32_t components;
@@ -662,6 +715,7 @@ struct CompiledShaderArtifact {
     std::vector<std::uint32_t> runtimeImageResources;
     bool registrationModule = false;
     std::uint32_t bdaAbiVersion = 0;
+    std::uint32_t windowLaneGuards = 0;
     std::uint32_t runtimeAbiVersion = RuntimeAbi::Version;
     std::vector<VertexInput> vertexInputs;
     std::int32_t vertexOffsetSgpr = -1;
@@ -672,12 +726,14 @@ struct CompiledShaderArtifact {
     bool instanceOffsetConflict = false;
     std::uint32_t hostSubgroupSize = 0;
     bool fullSubgroups = false;
+    bool functionLdsBuffer = false;
     std::vector<std::uint32_t> parameterExports;
     std::vector<FragmentParameter> fragmentParameters;
     BarycentricEmulation barycentricEmulation;
     std::optional<MeshBarycentricLayout> meshBarycentrics;
     std::vector<std::uint32_t> stencilReferences;
     bool stencilReplaySafe = false;
+    bool bdaWrites = false;
     std::uint32_t stencilReferenceDword = 0xffffffffu;
     std::uint64_t variantId = 0;
 };
@@ -740,7 +796,7 @@ struct RecompileResult : CompiledShaderArtifact, ShaderInvocation {
         };
         mix(specialization.size());
         for (const auto& constant : specialization) mix(constant.id | (static_cast<std::uint64_t>(constant.value) << 32u));
-        mix(hostSubgroupSize | (fullSubgroups ? 0x10000u : 0u) | (static_cast<std::uint64_t>(workgroupMemoryDwords) << 32u));
+        mix(hostSubgroupSize | (fullSubgroups ? 0x10000u : 0u) | (functionLdsBuffer ? 0x20000u : 0u) | (static_cast<std::uint64_t>(workgroupMemoryDwords) << 32u));
         mix(bindings.size());
         for (const auto& binding : bindings) mix(binding.descriptorSet | (static_cast<std::uint64_t>(binding.binding) << 16u) | (static_cast<std::uint64_t>(binding.kind) << 40u) | (static_cast<std::uint64_t>(binding.count) << 48u));
         if (identity.Empty()) identity.low = 1;
@@ -772,6 +828,9 @@ struct MeshOutputBudget {
 
 struct ResourceCapture;
 [[nodiscard]] std::shared_ptr<const RecompileResult> Recompile(const RecompileRequest& request, const ResourceCapture& capture, bool* memoHit = nullptr);
+void SetResultMemoBudget(std::uint64_t bytes);
+[[nodiscard]] std::uint64_t ResultMemoBytes();
+void SetResultMemoTrimHook(std::function<void()> hook);
 
 // Debug aid (see DebugProbe in Translation/TranslationContext.hpp): the APS5_PROBE register probe is
 // only applied while a driver has it active, so it can be limited to one dispatch; the recompile
diff --git a/core/shader/recompiler/ShaderCacheVersion.cmake b/core/shader/recompiler/ShaderCacheVersion.cmake
index 847a513496..b3cbea2c75 100644
--- a/core/shader/recompiler/ShaderCacheVersion.cmake
+++ b/core/shader/recompiler/ShaderCacheVersion.cmake
@@ -26,6 +26,7 @@ endforeach()
 list(SORT sources)
 list(SORT guard)
 get_filename_component(rootReal "${ROOT}" REALPATH)
+get_filename_component(recompilerReal "${RECOMPILER_DIR}" REALPATH)
 set(sourcesReal)
 foreach(source IN LISTS sources)
     get_filename_component(real "${source}" REALPATH)
@@ -35,12 +36,14 @@ endforeach()
 set(failures)
 set(manifest "${EXTRA}\n")
 set(switches)
-foreach(source IN LISTS sources)
+foreach(source sourceReal IN ZIP_LISTS sources sourcesReal)
     if(NOT EXISTS "${source}")
         continue()
     endif()
-    file(SHA256 "${source}" digest)
-    file(RELATIVE_PATH relative "${ROOT}" "${source}")
+    file(READ "${source}" text)
+    string(REPLACE "\r\n" "\n" text "${text}")
+    string(SHA256 digest "${text}")
+    file(RELATIVE_PATH relative "${rootReal}" "${sourceReal}")
     string(APPEND manifest "${relative} ${digest}\n")
     if(NOT source MATCHES "\\.(cpp|hpp|h)$")
         continue()
@@ -50,22 +53,26 @@ foreach(source IN LISTS sources)
         string(REGEX MATCHALL "\"APS5_[A-Z0-9_]+\"" names "${line}")
         list(APPEND switches ${names})
     endforeach()
-    string(FIND "${source}" "${RECOMPILER_DIR}/" inRecompiler)
+    string(FIND "${sourceReal}" "${recompilerReal}/" inRecompiler)
     if(NOT inRecompiler EQUAL 0)
         continue()
     endif()
-    get_filename_component(sourceDirectory "${source}" DIRECTORY)
+    get_filename_component(sourceDirectory "${sourceReal}" DIRECTORY)
     file(STRINGS "${source}" lines ENCODING UTF-8 REGEX "^[ \t]*#[ \t]*include[ \t]*\"[^\"]+\"")
     foreach(line IN LISTS lines)
         string(REGEX REPLACE "^[ \t]*#[ \t]*include[ \t]*\"([^\"]+)\".*$" "\\1" included "${line}")
         set(resolved)
         foreach(directory IN ITEMS "${sourceDirectory}" ${includeDirectories})
             if(EXISTS "${directory}/${included}" AND NOT IS_DIRECTORY "${directory}/${included}")
-                get_filename_component(resolved "${directory}/${included}" REALPATH)
+                string(SHA1 includedKey "${directory}/${included}")
+                if(NOT DEFINED includedReal_${includedKey})
+                    get_filename_component(includedReal_${includedKey} "${directory}/${included}" REALPATH)
+                endif()
+                set(resolved "${includedReal_${includedKey}}")
                 break()
             endif()
         endforeach()
-        file(RELATIVE_PATH relativeSource "${ROOT}" "${source}")
+        file(RELATIVE_PATH relativeSource "${rootReal}" "${sourceReal}")
         if(NOT resolved)
             continue()
         endif()
diff --git a/core/shader/recompiler/ShaderDiskCache.cpp b/core/shader/recompiler/ShaderDiskCache.cpp
index d08af4749a..ce6863e337 100644
--- a/core/shader/recompiler/ShaderDiskCache.cpp
+++ b/core/shader/recompiler/ShaderDiskCache.cpp
@@ -95,7 +95,7 @@ static_assert(sizeof(FragmentParameter) == 16, "FragmentParameter changed: updat
 static_assert(sizeof(CompiledShaderInfo) == 352, "CompiledShaderInfo changed: update the info encoder");
 static_assert(sizeof(ShaderInfo) == 232, "ShaderInfo changed: update the info encoder");
 static_assert(sizeof(BufferResource) == 32, "BufferResource changed: update the info encoder");
-static_assert(sizeof(ImageResource) == 92, "ImageResource changed: update the info encoder");
+static_assert(sizeof(ImageResource) == 96, "ImageResource changed: update the info encoder");
 static_assert(sizeof(SamplerResource) == 24, "SamplerResource changed: update the info encoder");
 static_assert(sizeof(SampledResourcePair) == 12, "SampledResourcePair changed: update the info encoder");
 static_assert(sizeof(StageInput) == 56, "StageInput changed: update the info encoder");
@@ -141,7 +141,7 @@ constexpr std::size_t fieldCount() {
 
 static_assert(fieldCount<ShaderInfo>() == 24, "ShaderInfo changed: update the info encoder");
 static_assert(fieldCount<BufferResource>() == 12, "BufferResource changed: update the info encoder");
-static_assert(fieldCount<ImageResource>() == 41, "ImageResource changed: update the info encoder");
+static_assert(fieldCount<ImageResource>() == 43, "ImageResource changed: update the info encoder");
 static_assert(fieldCount<SamplerResource>() == 8, "SamplerResource changed: update the info encoder");
 static_assert(fieldCount<SampledResourcePair>() == 3, "SampledResourcePair changed: update the info encoder");
 static_assert(fieldCount<StageInput>() == 5, "StageInput changed: update the info encoder");
@@ -174,6 +174,49 @@ std::size_t PayloadOffset(std::size_t keyBytes) {
     return (sizeof(FileHeader) + keyBytes + alignment - 1) / alignment * alignment;
 }
 
+class SharedPlanTable {
+public:
+    std::shared_ptr<const IrResourcePlan> Get(std::span<const std::byte> payload, std::uint64_t shaderHash) {
+        const Key key{HashBytes(payload), HashBytes(payload, 0x5eed0003ull), payload.size(), shaderHash};
+        {
+            std::lock_guard lock(mutex);
+            if (const auto found = plans.find(key); found != plans.end()) {
+                if (auto plan = found->second.lock()) return plan;
+            }
+        }
+        IrResourcePlan decoded;
+        if (!DecodePlan(payload, decoded)) return nullptr;
+        decoded.shaderHash = shaderHash;
+        auto plan = std::make_shared<const IrResourcePlan>(std::move(decoded));
+        std::lock_guard lock(mutex);
+        auto& slot = plans[key];
+        if (auto existing = slot.lock()) return existing;
+        slot = plan;
+        if (++inserts % 1024u == 0u) std::erase_if(plans, [](const auto& entry) { return entry.second.expired(); });
+        return plan;
+    }
+
+private:
+    struct Key {
+        std::uint64_t low;
+        std::uint64_t high;
+        std::uint64_t bytes;
+        std::uint64_t shaderHash;
+        bool operator==(const Key&) const = default;
+    };
+    struct KeyHash {
+        std::size_t operator()(const Key& key) const { return static_cast<std::size_t>(key.low ^ (key.high * 0x9e3779b97f4a7c15ull) ^ (key.shaderHash * 0xff51afd7ed558ccdull)); }
+    };
+    std::mutex mutex;
+    std::unordered_map<Key, std::weak_ptr<const IrResourcePlan>, KeyHash> plans;
+    std::uint64_t inserts = 0;
+};
+
+SharedPlanTable& sharedPlans() {
+    static SharedPlanTable table;
+    return table;
+}
+
 class MappedFile {
 public:
     MappedFile(const void* data, std::size_t size) : data(data), size(size) {}
@@ -470,6 +513,7 @@ void encodeArtifact(Writer& writer, const CompiledShaderArtifact& result) {
     writer.Value(result.runtimeAbiVersion);
     writer.Values(std::span<const std::uint32_t>(result.spirv.Words()));
     writer.Value(result.bdaAbiVersion);
+    writer.Value(result.windowLaneGuards);
     writer.Value(result.memoryOffsetDword);
     writer.Value(result.shaderDataDwords);
     writer.Value(result.imageMetadataDword);
@@ -495,6 +539,7 @@ void encodeArtifact(Writer& writer, const CompiledShaderArtifact& result) {
     writer.Value(result.instanceOffsetConflict);
     writer.Value(result.hostSubgroupSize);
     writer.Value(result.fullSubgroups);
+    writer.Value(result.functionLdsBuffer);
     writer.Values(std::span<const std::uint32_t>(result.parameterExports));
     writer.List(result.fragmentParameters, [](Writer& out, const FragmentParameter& parameter) {
         out.Value(parameter.location);
@@ -523,6 +568,7 @@ void encodeArtifact(Writer& writer, const CompiledShaderArtifact& result) {
     }
     writer.Values(std::span<const std::uint32_t>(result.stencilReferences));
     writer.Value(result.stencilReplaySafe);
+    writer.Value(result.bdaWrites);
     writer.Value(result.stencilReferenceDword);
 }
 
@@ -530,6 +576,7 @@ void decodeArtifact(Reader& reader, CompiledShaderArtifact& result) {
     reader.Value(result.runtimeAbiVersion);
     result.spirv = reader.Spirv();
     reader.Value(result.bdaAbiVersion);
+    reader.Value(result.windowLaneGuards);
     reader.Value(result.memoryOffsetDword);
     reader.Value(result.shaderDataDwords);
     reader.Value(result.imageMetadataDword);
@@ -555,6 +602,7 @@ void decodeArtifact(Reader& reader, CompiledShaderArtifact& result) {
     reader.Value(result.instanceOffsetConflict);
     reader.Value(result.hostSubgroupSize);
     reader.Value(result.fullSubgroups);
+    reader.Value(result.functionLdsBuffer);
     reader.Values(result.parameterExports);
     reader.List(result.fragmentParameters, 10, [](Reader& in, FragmentParameter& parameter) {
         in.Value(parameter.location);
@@ -587,6 +635,7 @@ void decodeArtifact(Reader& reader, CompiledShaderArtifact& result) {
     }
     reader.Values(result.stencilReferences);
     reader.Value(result.stencilReplaySafe);
+    reader.Value(result.bdaWrites);
     reader.Value(result.stencilReferenceDword);
     result.variantId = 0;
 }
@@ -750,6 +799,7 @@ void encodeShaderInfo(Writer& writer, const ShaderInfo& info) {
         out.Value(image.volumeArraySampleCompatible);
         out.Value(image.flatLineCompatible);
         out.Value(image.flatVolumeLineCompatible);
+        out.Value(image.dimensionQueryOnly);
         out.Value(image.foldTexelOffsetsOnly);
         out.Value(image.convertedSamples);
         out.Value(image.remappedDepth1D);
@@ -759,6 +809,7 @@ void encodeShaderInfo(Writer& writer, const ShaderInfo& info) {
         out.Value(image.emulatedCompare);
         out.Value(image.table);
         out.Value(image.tableOperation);
+        out.Value(image.targetMerge);
     });
     writer.Value(!info.runtimeImageModes.empty());
     writer.List(info.samplers, [](Writer& out, const SamplerResource& sampler) {
@@ -856,6 +907,7 @@ void decodeShaderInfo(Reader& reader, ShaderInfo& info) {
         in.Value(image.volumeArraySampleCompatible);
         in.Value(image.flatLineCompatible);
         in.Value(image.flatVolumeLineCompatible);
+        in.Value(image.dimensionQueryOnly);
         in.Value(image.foldTexelOffsetsOnly);
         in.Value(image.convertedSamples);
         in.Value(image.remappedDepth1D);
@@ -865,6 +917,7 @@ void decodeShaderInfo(Reader& reader, ShaderInfo& info) {
         in.Value(image.emulatedCompare);
         in.Value(image.table);
         in.Value(image.tableOperation);
+        in.Value(image.targetMerge);
     });
     bool preparedImageModes = false;
     reader.Value(preparedImageModes);
@@ -1327,6 +1380,7 @@ constexpr std::string_view NeutralSwitches[] = {
     "APS5_NO_RESULT_MEMO",
     "APS5_NO_TABLE_RESOLUTION_REUSE",
     "APS5_NO_TABLE_SNAPSHOT_REUSE",
+    "APS5_RESULT_MEMO_MB",
 };
 
 const std::vector<std::byte>& switchKey() {
@@ -1408,6 +1462,18 @@ public:
         return load(key, [&](std::span<const std::byte> file, std::shared_ptr<const void>) { return DecodePlanEntry(file, key, plan); }, planHits, planMisses, planLoadFailures);
     }
 
+    std::shared_ptr<const IrResourcePlan> LoadSharedPlan(std::span<const std::byte> key, std::uint64_t shaderHash) {
+        std::shared_ptr<const IrResourcePlan> plan;
+        load(key, [&](std::span<const std::byte> file, std::shared_ptr<const void>) {
+            std::span<const std::byte> payload;
+            const auto status = unwrapEntry(file, key, payload);
+            if (status != LoadStatus::Loaded) return status;
+            plan = sharedPlans().Get(payload, shaderHash);
+            return plan != nullptr ? LoadStatus::Loaded : LoadStatus::Rejected;
+        }, planHits, planMisses, planLoadFailures);
+        return plan;
+    }
+
     void Store(std::vector<std::byte> key, std::shared_ptr<const CompiledVariant> variant) {
         enqueue({std::move(key), std::move(variant), nullptr});
     }
@@ -1917,6 +1983,11 @@ bool LoadPlan(std::span<const std::byte> key, IrResourcePlan& plan) {
     return instance.Enabled() && instance.LoadPlan(key, plan);
 }
 
+std::shared_ptr<const IrResourcePlan> LoadSharedPlan(std::span<const std::byte> key, std::uint64_t shaderHash) {
+    auto& instance = store();
+    return instance.Enabled() ? instance.LoadSharedPlan(key, shaderHash) : nullptr;
+}
+
 void StorePlan(std::vector<std::byte> key, std::shared_ptr<const IrResourcePlan> plan) {
     auto& instance = store();
     if (instance.Enabled() && plan != nullptr) instance.StorePlan(std::move(key), std::move(plan));
diff --git a/core/shader/recompiler/ShaderDiskCache.hpp b/core/shader/recompiler/ShaderDiskCache.hpp
index abd799b205..d4cf9e2f30 100644
--- a/core/shader/recompiler/ShaderDiskCache.hpp
+++ b/core/shader/recompiler/ShaderDiskCache.hpp
@@ -13,7 +13,7 @@
 
 namespace ShaderRecompiler::ShaderDiskCache {
 
-inline constexpr std::uint32_t FormatVersion = 45;
+inline constexpr std::uint32_t FormatVersion = 47;
 
 enum class LoadStatus {
     Loaded,
@@ -71,6 +71,7 @@ void BuildPlanKey(const RecompileRequest& request, std::uint32_t hostSubgroupSiz
 void Store(std::vector<std::byte> key, std::shared_ptr<const CompiledVariant> variant);
 [[nodiscard]] std::shared_ptr<const CompiledVariant> Persist(std::span<const std::byte> key, const CompiledVariant& variant);
 [[nodiscard]] bool LoadPlan(std::span<const std::byte> key, IrResourcePlan& plan);
+[[nodiscard]] std::shared_ptr<const IrResourcePlan> LoadSharedPlan(std::span<const std::byte> key, std::uint64_t shaderHash);
 void StorePlan(std::vector<std::byte> key, std::shared_ptr<const IrResourcePlan> plan);
 void Flush();
 void Shutdown();
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp
index ee435ffc67..2dbe8f7d03 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp
@@ -39,6 +39,8 @@ struct SpirvRequirements {
 
 [[nodiscard]] SpirvRequirements AnalyzeProgramRequirements(const IrProgram& program);
 inline constexpr std::uint32_t FunctionLdsDwordLimit = 8192u;
+inline constexpr std::uint32_t PixelFunctionStorageDwords = 4096u;
+inline constexpr std::uint32_t PixelFunctionLdsDescriptorSet = 2u;
 [[nodiscard]] std::uint32_t FunctionLdsDwords(const IrProgram& program);
 [[nodiscard]] std::unordered_map<const IrValue*, std::uint32_t> FunctionLdsLaneAddresses(const IrProgram& program);
 [[nodiscard]] std::unordered_set<const IrValue*> WaveUniformValues(const IrProgram& program);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp
index 74d6b2e281..146fb2318a 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp
@@ -39,10 +39,14 @@ struct SpirvTargetOptions {
     std::vector<std::uint32_t> meshExportedLocations;
     std::vector<std::pair<std::uint32_t, std::uint32_t>> meshPerVertexLocations;
     bool waveLdsMemoryBarriers = false;
+    bool largePixelFunctionLdsBuffer = false;
+    std::uint32_t pixelFunctionStorageDwords = 4096u;
+    bool deviceScopeLdsMemoryBarriers = false;
 };
 
 struct SpirvEmitInfo {
     bool fullSubgroups = false;
+    bool functionLdsBuffer = false;
 };
 
 struct SpannedWaveUnsupported : std::runtime_error {
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp
index 96951cf815..4be0132c1d 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp
@@ -70,6 +70,7 @@ void DecorateTableNonUniform(SpirvEmitterState& state, std::uint32_t id);
 bool TablePointSampled(const ImageResource& image);
 bool TableModeEmitted(const ImageResource& mode);
 std::uint32_t StorageImageDescriptorPointer(SpirvEmitterState& state, std::uint32_t resource);
+std::uint32_t EmitStorageImageRead(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t coord, std::uint32_t sample);
 void EmitStorageImageWrite(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t mipLod, std::uint32_t coord, std::uint32_t texel, std::uint32_t sample);
 std::uint32_t ExecutionModelForStage(IrShaderStage stage);
 std::uint32_t ConstantI32(SpirvEmitterState& state, std::int32_t value);
@@ -100,6 +101,7 @@ DppTargetLane EmitDppMirrorTargetLane(SpirvEmitterState& state, std::uint32_t su
 DppTargetLane EmitDppTargetLane(SpirvEmitterState& state, std::uint32_t control);
 std::uint32_t InputVariableForKind(const SpirvEmitterState& state, StageInputKind kind);
 bool OrderedPixelShader(const SpirvEmitterState& state);
+void FlushColorTargetMerge(SpirvEmitterState& state);
 const SpirvInputBinding* SpirvInputBindingForParameter(const SpirvEmitterState& state, std::uint32_t location);
 std::uint32_t EmitVertexParameterComponentU32(SpirvEmitterState& state, const SpirvInputBinding& input, std::uint32_t component);
 std::uint32_t EmitInputComponentU32(SpirvEmitterState& state, StageInputKind kind, std::uint32_t component);
@@ -112,6 +114,7 @@ void EmitMemoryOffsets(SpirvEmitterState& state);
 std::uint32_t LdsDwordCount(const SpirvEmitterState& state);
 bool LdsInDeviceMemory(const SpirvEmitterState& state);
 std::uint32_t LdsMemorySemantics(const SpirvEmitterState& state);
+std::uint32_t LdsMemoryBarrierScope(const SpirvEmitterState& state);
 void EmitLdsBufferBase(SpirvEmitterState& state);
 std::uint32_t EmitLdsLockPointer(SpirvEmitterState& state);
 std::uint32_t EmitLdsBufferU64Pointer(SpirvEmitterState& state, std::uint32_t index);
@@ -154,6 +157,7 @@ std::uint32_t EmitF16BitsToF32Decoded(SpirvEmitterState& state, std::uint32_t bi
 void EmitProgram(SpirvEmitterState& state);
 void DefineGetBdaPointer(SpirvEmitterState& state);
 void DefineDot2F32F16Function(SpirvEmitterState& state);
+void DefineReciprocalCorrectionFunction(SpirvEmitterState& state);
 void EmitLabel(SpirvEmitterState& state, std::uint32_t label);
 std::uint32_t Unary(SpirvEmitterState& state, std::uint32_t opcode, std::uint32_t type, std::uint32_t value);
 std::uint32_t Binary(SpirvEmitterState& state, std::uint32_t opcode, std::uint32_t type, std::uint32_t lhs, std::uint32_t rhs);
@@ -161,8 +165,8 @@ std::uint32_t Select(SpirvEmitterState& state, std::uint32_t type, std::uint32_t
 std::uint32_t AtomicIncrement(SpirvEmitterState& state, std::uint32_t old, std::uint32_t limit);
 std::uint32_t AtomicDecrement(SpirvEmitterState& state, std::uint32_t old, std::uint32_t limit);
 std::uint32_t AtomicUSubSat(SpirvEmitterState& state, std::uint32_t old, std::uint32_t value);
-std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue);
-std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator);
+std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue, bool flush);
+std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator, bool flush);
 
 template<std::uint32_t TOpcode, IrType TValueType, typename... TArguments>
 std::uint32_t EmitNative(SpirvEmitterState& state, TArguments... arguments) {
@@ -276,7 +280,8 @@ std::uint32_t AtomicUpdateTyped(SpirvEmitterState& state, std::uint32_t pointer,
     EmitLabel(state, cont);
     state.module.AddFunction(spv::OpBranch, header);
     EmitLabel(state, merge);
-    if (kind != ResourceKind::Lds || !state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, scope), ConstantU32(state, spv::MemorySemanticsAcquireReleaseMask | memory));
+    const auto fenceScope = kind == ResourceKind::Lds ? LdsMemoryBarrierScope(state) : scope;
+    if (kind != ResourceKind::Lds || !state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, fenceScope), ConstantU32(state, spv::MemorySemanticsAcquireReleaseMask | memory));
     return observed;
 }
 
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp
index a8f03e192a..c442047480 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp
@@ -221,6 +221,7 @@ std::uint32_t EmitFPCmpClass32(SpirvEmitterState& state, std::uint32_t value, st
 void EmitReference(SpirvValueEmitContext& context);
 void EmitReferenceU32(SpirvValueEmitContext& context);
 void EmitUnlinkedCall(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint32_t low, std::uint32_t high, std::uint32_t programCounter);
+void EmitWindowLaneGuard(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint32_t index, std::uint32_t value, std::uint32_t current, std::uint32_t slot, std::uint32_t lane);
 void EmitControlNop(SpirvValueEmitContext& context);
 void EmitWaitcnt(SpirvValueEmitContext& context);
 void EmitSendmsg(SpirvValueEmitContext& context);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp
index 31a5981434..5c75b23f82 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp
@@ -129,6 +129,7 @@ struct SpirvEmitterState {
     std::uint32_t pixelFlatPositions = 0;
     std::map<std::pair<std::uint32_t, std::uint32_t>, std::uint32_t> solvedBarycentrics;
     bool waveLdsMemoryBarriers = false;
+    bool deviceScopeLdsMemoryBarriers = false;
     std::unordered_set<const IrValue*> sharedLaneValues;
     std::uint32_t laneHalf = 0;
     std::uint32_t spirvVersion = 0x00010300u;
@@ -167,6 +168,8 @@ struct SpirvEmitterState {
     bool nativeF16ModesEmitted = false;
     bool f16DenormPreserveEmitted = false;
     std::uint32_t dot2F32F16Function = 0;
+    std::uint32_t reciprocalCorrectionFunction = 0;
+    std::array<std::uint32_t, 3> reciprocalTables {};
     std::map<std::pair<bool, std::uint32_t>, std::uint32_t> interpolateFunctions;
     bool integerInterpolation = false;
     std::array<std::array<std::uint32_t, 2>, 2> bdaDwordReadFunctions {};
@@ -206,6 +209,7 @@ struct SpirvEmitterState {
     std::uint32_t ldsBufferVariable = 0;
     std::uint32_t ldsBufferU64Variable = 0;
     std::uint32_t ldsBufferBase = 0;
+    bool pixelFunctionLdsBuffer = false;
     std::uint32_t numWorkgroupsVariable = 0;
     std::array<std::uint32_t, 2> scratchVariable {};
     std::array<std::uint32_t, 2> vectorWindowVariable {};
@@ -229,6 +233,8 @@ struct SpirvEmitterState {
     std::uint32_t currentLabel = 0;
     const IrBlock* currentBlock = nullptr;
     std::uint32_t pixelValidMaskVariable = 0;
+    std::uint32_t mergeWordVariable = 0;
+    std::uint32_t mergePendingVariable = 0;
     std::uint32_t quadPixelUncovered = 0;
     std::uint32_t sampleMaskInputVariable = 0;
     std::uint32_t quadSampleCoverage = 0;
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp
index 53a851625b..18e703456f 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp
@@ -13,6 +13,7 @@ void EmitMemoryOffsets(SpirvEmitterState& state);
 std::uint32_t LdsDwordCount(const SpirvEmitterState& state);
 bool LdsInDeviceMemory(const SpirvEmitterState& state);
 std::uint32_t LdsMemorySemantics(const SpirvEmitterState& state);
+std::uint32_t LdsMemoryBarrierScope(const SpirvEmitterState& state);
 void EmitLdsBufferBase(SpirvEmitterState& state);
 std::uint32_t EmitLdsLockPointer(SpirvEmitterState& state);
 std::uint32_t EmitLdsBufferU64Pointer(SpirvEmitterState& state, std::uint32_t index);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp
index b38633af2e..5ff7152418 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp
@@ -21,6 +21,7 @@ void DecorateTableNonUniform(SpirvEmitterState& state, std::uint32_t id);
 bool TablePointSampled(const ImageResource& image);
 bool TableModeEmitted(const ImageResource& mode);
 std::uint32_t StorageImageDescriptorPointer(SpirvEmitterState& state, std::uint32_t resource);
+std::uint32_t EmitStorageImageRead(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t coord, std::uint32_t sample);
 void EmitStorageImageWrite(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t mipLod, std::uint32_t coord, std::uint32_t texel, std::uint32_t sample);
 const RdnaImageDimensionInfo& RdnaImageDimensionInfoFor(RdnaImageDimension dimension);
 [[noreturn]] void ExitDescriptorBindingFailure(const SpirvEmitterState& state, DescriptorBindingKind kind, std::uint32_t resource, const char* reason);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp
index 661caa053c..f50d5c6f37 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp
@@ -8,6 +8,7 @@
 namespace ShaderRecompiler {
 
 [[nodiscard]] std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand = false, bool optimize = true, bool specialize = false);
+[[nodiscard]] std::uint64_t OptimizerHostThreads();
 
 }
 
diff --git a/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp b/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp
index bbf6dcc0f6..ed3483d923 100644
--- a/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp
@@ -26,20 +26,32 @@ struct Parameter {
     bool missing = false;
 };
 
+struct PerVertexSource {
+    std::uint32_t inputLocation;
+    std::uint32_t outputLocation;
+};
+
+struct Emulation {
+    std::vector<std::uint32_t> barycentrics;
+    std::vector<PerVertexSource> perVertex;
+};
+
 void require(bool condition, const char* message) {
     if (!condition) throw std::runtime_error(std::string("Rect-list SPIR-V: ") + message);
 }
 
 class RectListEmitter {
 public:
-    RectListEmitter(const std::vector<Parameter>& parameters, spv::ExecutionModel model, std::uint32_t version, std::uint32_t faultBinding, std::uint32_t clipDistances) : builder(version), faultBinding(faultBinding), version(version), clipDistances(clipDistances), parameters(parameters) {
+    RectListEmitter(const std::vector<Parameter>& parameters, const Emulation& emulation, spv::ExecutionModel model, std::uint32_t version, std::uint32_t faultBinding, std::uint32_t clipDistances) : builder(version), faultBinding(faultBinding), version(version), clipDistances(clipDistances), parameters(parameters), emulation(emulation) {
         builder.AddMemoryModel(spv::AddressingModelLogical, spv::MemoryModelGLSL450);
 
         voidType = type(spv::OpTypeVoid);
         uintType = type(spv::OpTypeInt, 32u, 0u);
         intType = type(spv::OpTypeInt, 32u, 1u);
         floatType = type(spv::OpTypeFloat, 32u);
+        vec3FloatType = type(spv::OpTypeVector, floatType, 3u);
         vec4FloatType = type(spv::OpTypeVector, floatType, 4u);
+        vertexArrayType = array(vec4FloatType, 3u);
         functionType = type(spv::OpTypeFunction, voidType);
 
             perVertexType = builder.DecoratedType(spv::OpTypeStruct, {{spv::OpMemberDecorate, {0u, spv::DecorationBuiltIn, spv::BuiltInPosition}}, {spv::OpMemberDecorate, {0u, spv::DecorationInvariant}}, {spv::OpDecorate, {spv::DecorationBlock}}}, vec4FloatType);
@@ -51,13 +63,14 @@ public:
 
         ptrInputVec4Float = pointer(spv::StorageClassInput, vec4FloatType);
         ptrOutputVec4Float = pointer(spv::StorageClassOutput, vec4FloatType);
+        ptrInputVec3Float = pointer(spv::StorageClassInput, vec3FloatType);
+        ptrOutputVec3Float = pointer(spv::StorageClassOutput, vec3FloatType);
         if (model == spv::ExecutionModelTessellationControl) {
             boolType = type(spv::OpTypeBool);
             vec2BoolType = type(spv::OpTypeVector, boolType, 2u);
             vec2FloatType = type(spv::OpTypeVector, floatType, 2u);
             ptrOutputFloat = pointer(spv::StorageClassOutput, floatType);
         } else {
-            vec3FloatType = type(spv::OpTypeVector, floatType, 3u);
             ptrInputFloat = pointer(spv::StorageClassInput, floatType);
         }
     }
@@ -155,6 +168,22 @@ public:
             store(access(ptrOutputVec4Float, outputs[i], invocation), value);
         }
 
+        if (!emulation.barycentrics.empty()) {
+            const auto zero = constant(floatType, 0);
+            std::array<std::uint32_t, 3> weight {};
+            for (std::uint32_t i = 0; i < weight.size(); i++) {
+                const auto own = result(spv::OpSelect, floatType, result(spv::OpIEqual, boolType, index, intConstant(i)), floatOne, zero);
+                weight[i] = result(spv::OpSelect, floatType, fourth, barycentric[i], own);
+            }
+            const auto weights = result(spv::OpCompositeConstruct, vec3FloatType, weight[0], weight[1], weight[2]);
+            for (const auto output : barycentricOutputs) store(access(ptrOutputVec3Float, output, invocation), weights);
+        }
+        for (std::size_t i = 0; i < emulation.perVertex.size(); i++) {
+            for (std::uint32_t source = 0; source < 3u; source++) {
+                store(access(ptrOutputVec4Float, perVertexOutputs[i], invocation, intConstant(source)), load(vec4FloatType, access(ptrInputVec4Float, perVertexInputs[i], intConstant(source))));
+            }
+        }
+
         emit(spv::OpReturn);
         emit(spv::OpFunctionEnd);
         return builder.Finalize();
@@ -178,6 +207,8 @@ public:
         for (std::uint32_t i = 0; i < parameters.size(); i++) {
             store(outputs[i], load(vec4FloatType, access(ptrInputVec4Float, inputs[i], index)));
         }
+        for (std::size_t i = 0; i < barycentricOutputs.size(); i++) store(barycentricOutputs[i], load(vec3FloatType, access(ptrInputVec3Float, barycentricInputs[i], index)));
+        for (std::size_t i = 0; i < emulation.perVertex.size(); i++) store(perVertexOutputs[i], load(vertexArrayType, access(pointer(spv::StorageClassInput, vertexArrayType), perVertexInputs[i], index)));
 
         emit(spv::OpReturn);
         emit(spv::OpFunctionEnd);
@@ -344,6 +375,23 @@ private:
             decorate(inputs[i], spv::DecorationLocation, location);
             locations[location] = inputs[i];
         }
+        for (const auto location : emulation.barycentrics) {
+            if (tessControl) continue;
+            barycentricInputs.push_back(addInterface(spv::StorageClassInput, array(vec3FloatType, 4u)));
+            decorate(barycentricInputs.back(), spv::DecorationLocation, location);
+        }
+        for (const auto& source : emulation.perVertex) {
+            if (!tessControl) {
+                perVertexInputs.push_back(addInterface(spv::StorageClassInput, array(vertexArrayType, 4u)));
+                decorate(perVertexInputs.back(), spv::DecorationLocation, source.outputLocation);
+                continue;
+            }
+            if (locations[source.inputLocation] == 0) {
+                locations[source.inputLocation] = addInterface(spv::StorageClassInput, vertexArrayType);
+                decorate(locations[source.inputLocation], spv::DecorationLocation, source.inputLocation);
+            }
+            perVertexInputs.push_back(locations[source.inputLocation]);
+        }
     }
 
     void defineOutputs(spv::ExecutionModel model) {
@@ -367,6 +415,14 @@ private:
             outputs[i] = addInterface(spv::StorageClassOutput, tessControl ? array(vec4FloatType, 4u) : vec4FloatType);
             decorate(outputs[i], spv::DecorationLocation, parameters[i].outputLocation);
         }
+        for (const auto location : emulation.barycentrics) {
+            barycentricOutputs.push_back(addInterface(spv::StorageClassOutput, tessControl ? array(vec3FloatType, 4u) : vec3FloatType));
+            decorate(barycentricOutputs.back(), spv::DecorationLocation, location);
+        }
+        for (const auto& source : emulation.perVertex) {
+            perVertexOutputs.push_back(addInterface(spv::StorageClassOutput, tessControl ? array(vertexArrayType, 4u) : vertexArrayType));
+            decorate(perVertexOutputs.back(), spv::DecorationLocation, source.outputLocation);
+        }
     }
 
     std::uint32_t interpolate(std::uint32_t v0, std::uint32_t v1, std::uint32_t v2, const std::array<std::uint32_t, 3>& barycentric) {
@@ -382,9 +438,14 @@ private:
     std::uint32_t clipDistances;
     std::uint32_t fault = 0;
     const std::vector<Parameter>& parameters;
+    const Emulation& emulation;
     std::vector<std::uint32_t> interfaces;
     std::vector<std::uint32_t> inputs;
     std::vector<std::uint32_t> outputs;
+    std::vector<std::uint32_t> barycentricInputs;
+    std::vector<std::uint32_t> barycentricOutputs;
+    std::vector<std::uint32_t> perVertexInputs;
+    std::vector<std::uint32_t> perVertexOutputs;
     std::uint32_t main = 0;
     std::uint32_t voidType = 0;
     std::uint32_t boolType = 0;
@@ -395,6 +456,7 @@ private:
     std::uint32_t vec2FloatType = 0;
     std::uint32_t vec3FloatType = 0;
     std::uint32_t vec4FloatType = 0;
+    std::uint32_t vertexArrayType = 0;
     std::uint32_t functionType = 0;
     std::uint32_t perVertexType = 0;
     std::uint32_t clipArrayType = 0;
@@ -404,6 +466,8 @@ private:
     std::uint32_t ptrInputVec4Float = 0;
     std::uint32_t ptrOutputFloat = 0;
     std::uint32_t ptrOutputVec4Float = 0;
+    std::uint32_t ptrInputVec3Float = 0;
+    std::uint32_t ptrOutputVec3Float = 0;
     std::uint32_t glIn = 0;
     std::uint32_t glOut = 0;
     std::uint32_t clipIn = 0;
@@ -422,25 +486,42 @@ RectListShaders BuildRectListShaders(const RecompileResult& vertex, const Recomp
     require(target.spirvVersion >= 0x00010300u && target.spirvVersion <= 0x00010500u, "unsupported SPIR-V target version");
     require(std::find(target.supportedCapabilities.begin(), target.supportedCapabilities.end(), spv::CapabilityTessellation) != target.supportedCapabilities.end(), "tessellation capability is unavailable");
     std::vector<Parameter> parameters;
+    Emulation emulation;
+    BarycentricEmulationLayout layout;
+    if (fragment.barycentricEmulation.active) {
+        layout = LayoutBarycentricEmulation(fragment.fragmentParameters, fragment.barycentricEmulation);
+        for (const auto location : {layout.smoothLocation, layout.linearLocation}) {
+            if (location != BarycentricEmulationLayout::NoLocation) emulation.barycentrics.push_back(location);
+        }
+    }
     std::set<std::uint32_t> locations;
     for (const auto& input : fragment.fragmentParameters) {
         require(input.location < 32 && input.sourceLocation < 32 && locations.insert(input.location).second, "invalid fragment parameter location");
         require(!input.custom, "custom per-vertex interpolation is unsupported");
         const bool exported = std::find(vertex.parameterExports.begin(), vertex.parameterExports.end(), input.sourceLocation) != vertex.parameterExports.end();
+        if (fragment.barycentricEmulation.active && input.perVertex) {
+            require(exported, "an emulated per-vertex parameter is not exported by the vertex shader");
+            const auto relocated = std::find_if(layout.perVertexLocations.begin(), layout.perVertexLocations.end(), [&](const auto& entry) { return entry.first == input.location; });
+            require(relocated != layout.perVertexLocations.end(), "an emulated per-vertex parameter has no location");
+            emulation.perVertex.push_back({input.sourceLocation, relocated->second});
+            continue;
+        }
         parameters.push_back({input.sourceLocation, input.location, input.flat, !exported});
     }
+    const auto emulatedSlots = static_cast<std::uint32_t>(emulation.barycentrics.size() + emulation.perVertex.size() * 3u);
     const auto& limits = *target.tessellation;
     const std::uint32_t perVertexComponents = std::min({limits.maxControlPerVertexInputComponents, limits.maxControlPerVertexOutputComponents, limits.maxEvaluationInputComponents, limits.maxEvaluationOutputComponents});
-    if (const std::size_t capacity = perVertexComponents / 4u > 0u ? perVertexComponents / 4u - 1u : 0u; parameters.size() > capacity) {
+    require(emulatedSlots == 0u || perVertexComponents / 4u > emulatedSlots, "emulated barycentrics exceed the tessellation interface limits");
+    if (const std::size_t capacity = perVertexComponents / 4u > emulatedSlots ? perVertexComponents / 4u - 1u - emulatedSlots : 0u; parameters.size() > capacity) {
         parameters.resize(capacity);
     }
-    const auto components = static_cast<std::uint32_t>((parameters.size() + 1) * 4);
+    const auto components = static_cast<std::uint32_t>((parameters.size() + emulatedSlots + 1) * 4);
     require(limits.maxPatchSize >= 4 && components <= limits.maxControlPerVertexInputComponents && components <= limits.maxControlPerVertexOutputComponents && components <= limits.maxEvaluationInputComponents && components <= limits.maxEvaluationOutputComponents && limits.maxControlPerPatchOutputComponents >= 6 && components * 4 + 6 <= limits.maxControlTotalOutputComponents, "tessellation interface exceeds device limits");
     const auto clipDistances = VertexClipDistanceCount(vertex.spirv.Words());
     require(clipDistances == 0u || std::find(target.supportedCapabilities.begin(), target.supportedCapabilities.end(), spv::CapabilityClipDistance) != target.supportedCapabilities.end(), "the vertex clip distances need shaderClipDistance");
     const auto faultBinding = RuntimeAbi::BindingNumber(RuntimeAbi::Stage::TessellationControl, RuntimeAbi::Binding::FaultBuffer);
-    RectListEmitter control(parameters, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
-    RectListEmitter evaluation(parameters, spv::ExecutionModelTessellationEvaluation, target.spirvVersion, faultBinding, clipDistances);
+    RectListEmitter control(parameters, emulation, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
+    RectListEmitter evaluation(parameters, emulation, spv::ExecutionModelTessellationEvaluation, target.spirvVersion, faultBinding, clipDistances);
     RectListShaders shaders;
     shaders.control.spirv = control.EmitControl(0u);
     shaders.control.bindings.push_back({DescriptorKind::StorageBuffer, DescriptorRole::FaultBuffer, 0, faultBinding, 1, {}});
@@ -452,7 +533,7 @@ RectListShaders BuildRectListShaders(const RecompileResult& vertex, const Recomp
 #endif
     shaders.lastVertexControl = shaders.control;
     if (std::any_of(parameters.begin(), parameters.end(), [](const Parameter& parameter) { return parameter.flat && !parameter.missing; })) {
-        RectListEmitter lastVertexControl(parameters, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
+        RectListEmitter lastVertexControl(parameters, emulation, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
         shaders.lastVertexControl.spirv = lastVertexControl.EmitControl(2u);
 #if ANYPS5_ENABLE_SPIRV_TOOLS
         shaders.lastVertexControl.spirv = ValidateAndOptimizeSpirv(shaders.lastVertexControl.spirv, target.vulkanVersion, target.spirvVersion);
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
index 1ce65a7506..abf7b6fce4 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
@@ -983,14 +983,6 @@ std::uint32_t EmitFPMedTri32(SpirvEmitterState& state, std::uint32_t arg0, std::
     return value(Select(state, u32, anyNan, min3, median));
 }
 
-std::uint32_t EmitFPRecip32(SpirvEmitterState& state, std::uint32_t arg0) {
-    return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), arg0);
-}
-
-std::uint32_t EmitFPRecipIFlag32(SpirvEmitterState& state, std::uint32_t arg0) {
-    return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), arg0);
-}
-
 std::uint32_t EmitFPRecipSqrt32(SpirvEmitterState& state, std::uint32_t arg0) {
     return EmitExt(state, TypeF32(state), GLSLstd450InverseSqrt, {arg0});
 }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp
new file mode 100644
index 0000000000..69a21a884c
--- /dev/null
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp
@@ -0,0 +1,502 @@
+#include "SpirvBackend/SpirvEmitterHelpers.hpp"
+#include "SpirvBackend/SpirvEmitterInstructions.hpp"
+#include "IntermediateRepresentation/IrBlock.hpp"
+#include "IntermediateRepresentation/IrValue.hpp"
+#include <spirv/unified1/spirv.hpp>
+#include <array>
+#include <cstdint>
+#include <cstdlib>
+#include <span>
+
+namespace ShaderRecompiler {
+namespace {
+
+constexpr std::array<std::uint32_t, 32> ReciprocalConstant{
+    0x04000000u, 0x03e0f83eu, 0x03c3c3c3u, 0x03a83a83u, 0x038e38e3u, 0x03759f22u, 0x035e50d7u, 0x03483483u,
+    0x03333333u, 0x031f3831u, 0x030c30c3u, 0x02fa0be8u, 0x02e8ba2eu, 0x02d82d82u, 0x02c8590bu, 0x02b93105u,
+    0x02aaaaaau, 0x029cbc14u, 0x028f5c28u, 0x02828282u, 0x02762762u, 0x026a439fu, 0x025ed097u, 0x0253c825u,
+    0x02492492u, 0x023ee08fu, 0x0234f72cu, 0x022b63cbu, 0x02222222u, 0x02192e29u, 0x02108421u, 0x02082082u,
+};
+
+constexpr std::array<std::uint32_t, 32> ReciprocalLinear{
+    0x001ffff2u, 0x001e16feu, 0x001c588au, 0x001abfcfu, 0x001948a9u, 0x0017ef84u, 0x0016b143u, 0x00158b2cu,
+    0x00147adcu, 0x00137e3bu, 0x0012936eu, 0x0011b8d2u, 0x0010ecf2u, 0x00102e83u, 0x000f7c5cu, 0x000ed575u,
+    0x000e38e1u, 0x000da5cau, 0x000d1b6fu, 0x000c9924u, 0x000c1e4au, 0x000baa54u, 0x000b3cbfu, 0x000ad517u,
+    0x000a72efu, 0x000a15e6u, 0x0009bda3u, 0x000969d3u, 0x00091a2au, 0x0008ce64u, 0x00088642u, 0x00084187u,
+};
+
+constexpr std::array<std::uint32_t, 32> ReciprocalHigherOrder{
+    0x0785ffb6u, 0x06a9e92du, 0x05ecd536u, 0x0548c377u, 0x04bab3a2u, 0x043ea577u, 0x03d198c0u, 0x03728d4eu,
+    0x031e82f9u, 0x02d479a0u, 0x02927126u, 0x02576970u, 0x0223626au, 0x01f55c00u, 0x01cb5622u, 0x01a550c1u,
+    0x01844bd0u, 0x01654744u, 0x014a4313u, 0x01313f35u, 0x011a3ba2u, 0x01063852u, 0x00f33540u, 0x00e23266u,
+    0x00d22fbfu, 0x00c42d47u, 0x00b72afau, 0x00ab28d4u, 0x00a026d2u, 0x009624f2u, 0x008c232fu, 0x00832189u,
+};
+
+constexpr std::array<std::uint32_t, 1025> ReciprocalCorrectionStarts{
+    0x00000000u, 0x00020000u, 0x00040002u, 0x000a0008u, 0x0012000cu, 0x00160014u, 0x001a0018u, 0x0023001cu,
+    0x00280026u, 0x00290029u, 0x002f002cu, 0x00320031u, 0x00390038u, 0x0042003eu, 0x00480045u, 0x004a004au,
+    0x004f004du, 0x00550052u, 0x00570056u, 0x005d005bu, 0x005f005eu, 0x00640061u, 0x006b0069u, 0x0076006fu,
+    0x007d0077u, 0x0082007eu, 0x00850084u, 0x008d0088u, 0x00920090u, 0x00990097u, 0x00a0009cu, 0x00a400a3u,
+    0x00ab00a8u, 0x00ab00abu, 0x00b000adu, 0x00b700b5u, 0x00bb00b8u, 0x00be00bdu, 0x00c100c1u, 0x00c300c3u,
+    0x00c900c5u, 0x00d000cdu, 0x00d300d2u, 0x00d800d5u, 0x00db00dau, 0x00de00dcu, 0x00e100dfu, 0x00e900e3u,
+    0x00ea00e9u, 0x00ef00edu, 0x00f300f1u, 0x00fb00f7u, 0x00fb00fbu, 0x00ff00feu, 0x01060105u, 0x01080106u,
+    0x010c010au, 0x0112010fu, 0x01150112u, 0x011a0117u, 0x011c011bu, 0x01240120u, 0x012b0126u, 0x0132012fu,
+    0x01360135u, 0x013b0137u, 0x013f013du, 0x01490143u, 0x014a0149u, 0x014e014du, 0x014f014fu, 0x01540151u,
+    0x01580158u, 0x015b0158u, 0x0161015du, 0x01650163u, 0x01670166u, 0x016a0169u, 0x016d016bu, 0x0170016eu,
+    0x01730173u, 0x01750175u, 0x017b0179u, 0x01830181u, 0x01860184u, 0x01870187u, 0x018c018au, 0x0191018fu,
+    0x01970194u, 0x01a1019eu, 0x01a601a4u, 0x01ab01a8u, 0x01b001acu, 0x01b701b5u, 0x01c101bfu, 0x01c701c4u,
+    0x01cd01cbu, 0x01d001cfu, 0x01d501d4u, 0x01d701d6u, 0x01de01ddu, 0x01e301e2u, 0x01e601e5u, 0x01eb01eau,
+    0x01eb01ebu, 0x01ee01ecu, 0x01f001f0u, 0x01f601f4u, 0x01fa01f7u, 0x01fb01fbu, 0x020101feu, 0x02030201u,
+    0x020a0207u, 0x020e020cu, 0x02140212u, 0x02170217u, 0x021d021cu, 0x0220021du, 0x02210221u, 0x02280225u,
+    0x0230022bu, 0x02370233u, 0x023b023bu, 0x023f023bu, 0x02470241u, 0x024b0249u, 0x024f024cu, 0x02540250u,
+    0x02560255u, 0x025a0257u, 0x025a025au, 0x025f025cu, 0x0261025fu, 0x02660264u, 0x02670267u, 0x026d026bu,
+    0x026f026fu, 0x02710271u, 0x02740274u, 0x02760276u, 0x02790276u, 0x027e027cu, 0x0282027fu, 0x02830283u,
+    0x02850285u, 0x02880285u, 0x028d028du, 0x028f028eu, 0x0292028fu, 0x02960293u, 0x029b029au, 0x02a0029du,
+    0x02aa02a5u, 0x02b302acu, 0x02b602b4u, 0x02b902b8u, 0x02bc02bbu, 0x02be02bdu, 0x02c302c0u, 0x02c902c5u,
+    0x02ce02cau, 0x02d202d0u, 0x02d302d2u, 0x02d802d6u, 0x02db02dau, 0x02de02deu, 0x02e102deu, 0x02e102e1u,
+    0x02e602e2u, 0x02ec02eau, 0x02f002eeu, 0x02f502f2u, 0x02f602f6u, 0x02f802f7u, 0x02fc02fau, 0x030002fdu,
+    0x03040302u, 0x03060304u, 0x030a0309u, 0x030d030cu, 0x0310030fu, 0x03130311u, 0x03160316u, 0x031c0319u,
+    0x031f031du, 0x03260322u, 0x0330032au, 0x03350332u, 0x03380337u, 0x033c0339u, 0x0341033du, 0x03470344u,
+    0x034b0349u, 0x034d034cu, 0x034d034du, 0x03500350u, 0x03530350u, 0x03570354u, 0x035a0358u, 0x035b035bu,
+    0x0361035fu, 0x03620361u, 0x03660363u, 0x03680366u, 0x03690368u, 0x036b036au, 0x036d036cu, 0x0370036eu,
+    0x03720371u, 0x03750375u, 0x03790376u, 0x037f037bu, 0x03830382u, 0x03870384u, 0x038a0389u, 0x0390038du,
+    0x03950393u, 0x03960395u, 0x03990396u, 0x039e039bu, 0x039f039fu, 0x03a303a2u, 0x03a503a5u, 0x03ab03a8u,
+    0x03af03aeu, 0x03b103b0u, 0x03b403b3u, 0x03b603b4u, 0x03b803b8u, 0x03bc03b9u, 0x03c003beu, 0x03c303c0u,
+    0x03c503c3u, 0x03c503c5u, 0x03c603c5u, 0x03ca03c8u, 0x03ca03cau, 0x03cc03cbu, 0x03cf03cdu, 0x03d303d0u,
+    0x03d503d4u, 0x03d803d7u, 0x03da03d9u, 0x03dc03dbu, 0x03de03dcu, 0x03de03deu, 0x03e203e0u, 0x03e703e5u,
+    0x03e903e8u, 0x03ea03eau, 0x03ed03ebu, 0x03ef03eeu, 0x03f103efu, 0x03f503f2u, 0x03fb03f7u, 0x03fe03fbu,
+    0x04080401u, 0x040d040bu, 0x040e040eu, 0x040f040eu, 0x04130411u, 0x04130413u, 0x04150414u, 0x04160415u,
+    0x04180416u, 0x041b041au, 0x041e041du, 0x0420041fu, 0x04240421u, 0x04280428u, 0x042b042bu, 0x042d042bu,
+    0x042f042fu, 0x04330431u, 0x04330433u, 0x04350433u, 0x04380436u, 0x043d043bu, 0x043f043eu, 0x0441043fu,
+    0x04450443u, 0x04460445u, 0x04460446u, 0x044a0449u, 0x0450044eu, 0x04560454u, 0x04590457u, 0x045e045bu,
+    0x04640462u, 0x04650464u, 0x046b0466u, 0x046c046cu, 0x0470046eu, 0x04750473u, 0x04780477u, 0x047b047au,
+    0x0480047eu, 0x04810480u, 0x04830481u, 0x04850483u, 0x04870486u, 0x048b0488u, 0x048f048eu, 0x0490048fu,
+    0x04920492u, 0x04940492u, 0x04970497u, 0x049b049au, 0x049f049eu, 0x04a1049fu, 0x04a304a2u, 0x04a504a5u,
+    0x04a704a6u, 0x04a904a8u, 0x04ad04abu, 0x04b304afu, 0x04b504b5u, 0x04b604b5u, 0x04b804b7u, 0x04bc04bbu,
+    0x04c104beu, 0x04c204c2u, 0x04c404c3u, 0x04c404c4u, 0x04c504c5u, 0x04c704c6u, 0x04c804c7u, 0x04c904c9u,
+    0x04c904c9u, 0x04ce04cdu, 0x04d004cfu, 0x04d304d2u, 0x04d304d3u, 0x04d604d6u, 0x04d904d7u, 0x04dc04d9u,
+    0x04e004dfu, 0x04e004e0u, 0x04e104e0u, 0x04e204e1u, 0x04e404e4u, 0x04e404e4u, 0x04e704e7u, 0x04eb04e8u,
+    0x04ef04edu, 0x04f304f2u, 0x04f704f4u, 0x04fb04f9u, 0x04fd04fdu, 0x05030500u, 0x05090505u, 0x050d050bu,
+    0x05130510u, 0x05140514u, 0x05160515u, 0x05160516u, 0x051a0518u, 0x051d051bu, 0x051e051du, 0x0520051fu,
+    0x05260523u, 0x05280527u, 0x05290529u, 0x052d052au, 0x0531052eu, 0x05320531u, 0x05350533u, 0x053a0538u,
+    0x053d053bu, 0x053f053fu, 0x05420542u, 0x05420542u, 0x05440542u, 0x05480546u, 0x054c054bu, 0x054f054eu,
+    0x054f054fu, 0x0551054fu, 0x05530552u, 0x05550553u, 0x05570557u, 0x055c0559u, 0x055e055du, 0x055e055eu,
+    0x055f055fu, 0x0563055fu, 0x05660566u, 0x05690568u, 0x056c056bu, 0x056d056cu, 0x056e056du, 0x05710571u,
+    0x05720572u, 0x05720572u, 0x05730573u, 0x05750573u, 0x05760575u, 0x05790578u, 0x057f057cu, 0x05830581u,
+    0x05850585u, 0x05870587u, 0x058e0589u, 0x058f058eu, 0x05930592u, 0x05980595u, 0x059c059au, 0x05a205a0u,
+    0x05a205a2u, 0x05a305a3u, 0x05a805a6u, 0x05aa05a9u, 0x05ac05acu, 0x05ad05adu, 0x05b005adu, 0x05b705b2u,
+    0x05ba05b9u, 0x05bb05bbu, 0x05bd05bbu, 0x05bd05bdu, 0x05bf05bfu, 0x05c305c1u, 0x05c605c4u, 0x05c605c6u,
+    0x05c705c7u, 0x05c905c8u, 0x05ca05c9u, 0x05cd05ccu, 0x05cf05cdu, 0x05d105d0u, 0x05d305d2u, 0x05d605d4u,
+    0x05d805d6u, 0x05d905d8u, 0x05dc05dau, 0x05dc05dcu, 0x05de05dcu, 0x05df05deu, 0x05e005e0u, 0x05e405e3u,
+    0x05e705e5u, 0x05ec05eau, 0x05ee05edu, 0x05f205f1u, 0x05f305f2u, 0x05f705f4u, 0x05f905f8u, 0x05fb05fbu,
+    0x05fd05fcu, 0x06000600u, 0x06050604u, 0x06050605u, 0x06090609u, 0x060c060bu, 0x0610060fu, 0x06100610u,
+    0x06130610u, 0x06140613u, 0x061a0618u, 0x061b061au, 0x061d061cu, 0x06250622u, 0x06260625u, 0x06280628u,
+    0x062a0629u, 0x062b062bu, 0x062e062cu, 0x062e062eu, 0x06300630u, 0x06330632u, 0x06350635u, 0x06370636u,
+    0x06390638u, 0x063a063au, 0x063b063au, 0x063d063cu, 0x0641063eu, 0x06420641u, 0x06450643u, 0x06480646u,
+    0x064e064au, 0x064f064fu, 0x06510651u, 0x06530652u, 0x06570656u, 0x06580658u, 0x065a0659u, 0x065d065cu,
+    0x065e065eu, 0x0661065fu, 0x06630662u, 0x06640664u, 0x06660666u, 0x06670666u, 0x06690668u, 0x066b0669u,
+    0x066d066du, 0x066e066du, 0x06710670u, 0x06720671u, 0x06740673u, 0x06760676u, 0x06780678u, 0x067a0679u,
+    0x067c067cu, 0x067e067eu, 0x067f067eu, 0x06820680u, 0x06860685u, 0x068a0688u, 0x068c068cu, 0x068e068cu,
+    0x06990690u, 0x069b069au, 0x069b069bu, 0x069e069cu, 0x06a206a0u, 0x06a506a4u, 0x06a606a5u, 0x06ab06aau,
+    0x06ad06adu, 0x06b006afu, 0x06b406b1u, 0x06b406b4u, 0x06b606b5u, 0x06ba06b8u, 0x06ba06bau, 0x06be06bdu,
+    0x06c106c1u, 0x06c506c2u, 0x06c806c6u, 0x06c906c9u, 0x06ce06ccu, 0x06ce06ceu, 0x06d306d3u, 0x06d706d4u,
+    0x06dd06dcu, 0x06dd06ddu, 0x06de06ddu, 0x06e006deu, 0x06e406e1u, 0x06e506e5u, 0x06e806e8u, 0x06e906e8u,
+    0x06ed06ebu, 0x06ee06eeu, 0x06f106eeu, 0x06f206f2u, 0x06f606f3u, 0x06fa06f9u, 0x06fc06fbu, 0x06fd06fdu,
+    0x07000700u, 0x07020700u, 0x07070703u, 0x070a0709u, 0x070c070cu, 0x070d070cu, 0x070d070du, 0x070f070eu,
+    0x07100710u, 0x07120710u, 0x07120712u, 0x07140714u, 0x07150714u, 0x07160715u, 0x07170717u, 0x071a0719u,
+    0x0720071eu, 0x07230720u, 0x07260725u, 0x07290727u, 0x072a0729u, 0x072d072bu, 0x072f072eu, 0x0732072fu,
+    0x07340733u, 0x07370735u, 0x07370737u, 0x07380737u, 0x073a0739u, 0x073b073au, 0x073e073eu, 0x07410740u,
+    0x07420741u, 0x07440743u, 0x07450744u, 0x07460746u, 0x07480747u, 0x074b074au, 0x074b074bu, 0x074e074du,
+    0x0751074eu, 0x07520751u, 0x07550755u, 0x07580757u, 0x07590759u, 0x075c075bu, 0x075f075fu, 0x0760075fu,
+    0x07610760u, 0x07660766u, 0x07690769u, 0x076a0769u, 0x076d076bu, 0x076e076eu, 0x0771076fu, 0x07740772u,
+    0x07780774u, 0x077a0778u, 0x077d077cu, 0x077e077du, 0x0781077fu, 0x07830782u, 0x07830783u, 0x07840783u,
+    0x07870786u, 0x07890788u, 0x078a0789u, 0x078c078bu, 0x078d078du, 0x078d078du, 0x078e078eu, 0x07920792u,
+    0x07930792u, 0x07970796u, 0x07990799u, 0x079a0799u, 0x079d079au, 0x079e079eu, 0x07a007a0u, 0x07a007a0u,
+    0x07a207a0u, 0x07a407a3u, 0x07a507a5u, 0x07a507a5u, 0x07a807a6u, 0x07ac07abu, 0x07ad07adu, 0x07ad07adu,
+    0x07b207aeu, 0x07b407b3u, 0x07b607b6u, 0x07b907b9u, 0x07bd07bcu, 0x07be07bdu, 0x07bf07beu, 0x07c207bfu,
+    0x07c407c4u, 0x07c507c5u, 0x07c507c5u, 0x07c607c5u, 0x07c707c6u, 0x07c907c8u, 0x07ca07cau, 0x07cc07cau,
+    0x07d007ceu, 0x07d307d1u, 0x07d407d4u, 0x07d607d6u, 0x07d607d6u, 0x07d907d8u, 0x07db07dbu, 0x07dc07dbu,
+    0x07de07ddu, 0x07df07dfu, 0x07e207e0u, 0x07e807e5u, 0x07eb07e9u, 0x07eb07ebu, 0x07ee07eeu, 0x07ef07efu,
+    0x07f407f1u, 0x07f407f4u, 0x07f807f7u, 0x07f807f8u, 0x07f807f8u, 0x07fc07fau, 0x07fe07fcu, 0x080207ffu,
+    0x08040803u, 0x08060806u, 0x08080806u, 0x080a0809u, 0x080a080au, 0x080d080bu, 0x08120810u, 0x08130813u,
+    0x08160814u, 0x08180818u, 0x081b0819u, 0x081e081eu, 0x0821081eu, 0x08220821u, 0x08240824u, 0x08270826u,
+    0x08270827u, 0x082b0829u, 0x082e082cu, 0x082f082eu, 0x0830082fu, 0x08310830u, 0x08320832u, 0x08340833u,
+    0x08360834u, 0x08360836u, 0x08380837u, 0x08390839u, 0x083d083bu, 0x083f083du, 0x08410840u, 0x08410841u,
+    0x08420841u, 0x08440843u, 0x08450845u, 0x08470846u, 0x084a0849u, 0x084d084bu, 0x084e084eu, 0x084f084fu,
+    0x08530852u, 0x08540854u, 0x08550855u, 0x08570855u, 0x085a0858u, 0x085b085au, 0x085c085cu, 0x085d085cu,
+    0x085d085du, 0x08630861u, 0x08650864u, 0x08670865u, 0x086a0867u, 0x086e086cu, 0x08710871u, 0x08730872u,
+    0x08760873u, 0x08790878u, 0x08790879u, 0x087b087au, 0x087c087bu, 0x087c087cu, 0x087d087du, 0x0880087eu,
+    0x08810881u, 0x08830883u, 0x08870886u, 0x08890888u, 0x088d088cu, 0x088e088du, 0x088f088fu, 0x08900890u,
+    0x08920890u, 0x08960894u, 0x08970896u, 0x08970897u, 0x08990898u, 0x089d089cu, 0x089f089du, 0x08a208a2u,
+    0x08a408a4u, 0x08a808a7u, 0x08a908a8u, 0x08ab08aau, 0x08ae08acu, 0x08af08aeu, 0x08b108b0u, 0x08b208b2u,
+    0x08b408b2u, 0x08b608b4u, 0x08b808b7u, 0x08bb08b9u, 0x08bc08bcu, 0x08bd08bcu, 0x08bd08bdu, 0x08be08beu,
+    0x08c008bfu, 0x08c108c0u, 0x08c508c3u, 0x08ca08c8u, 0x08cd08ccu, 0x08ce08cdu, 0x08ce08ceu, 0x08d108d0u,
+    0x08d208d2u, 0x08d408d4u, 0x08d408d4u, 0x08d508d5u, 0x08d808d6u, 0x08dc08d9u, 0x08dc08dcu, 0x08dd08ddu,
+    0x08e008dfu, 0x08e408e2u, 0x08e408e4u, 0x08e508e4u, 0x08e708e6u, 0x08e808e7u, 0x08eb08e9u, 0x08f008eeu,
+    0x08f308f2u, 0x08f608f4u, 0x08f608f6u, 0x08f908f9u, 0x08fc08f9u, 0x08fe08fcu, 0x09010901u, 0x09020902u,
+    0x09040902u, 0x09050904u, 0x09060906u, 0x09080907u, 0x090b090au, 0x090d090du, 0x090f090eu, 0x09100910u,
+    0x09140913u, 0x09160915u, 0x09190917u, 0x091d091cu, 0x091f091eu, 0x09220920u, 0x09260926u, 0x092a0929u,
+    0x092d092bu, 0x092e092du, 0x09320931u, 0x09340933u, 0x09350935u, 0x093b0938u, 0x093e093du, 0x0943093fu,
+    0x09450945u, 0x09470946u, 0x09480947u, 0x094d0949u, 0x094f094fu, 0x09500950u, 0x09550951u, 0x09560955u,
+    0x09560956u, 0x09570957u, 0x09590957u, 0x095c095au, 0x095c095cu, 0x095e095eu, 0x09600960u, 0x09610960u,
+    0x09630962u, 0x09650964u, 0x09670967u, 0x096b096au, 0x096e096du, 0x09720970u, 0x09740974u, 0x09740974u,
+    0x09750975u, 0x09790978u, 0x097d097bu, 0x097f097fu, 0x097f097fu, 0x09810981u, 0x09820981u, 0x09850983u,
+    0x098b0985u, 0x098b098bu, 0x0990098du, 0x09920990u, 0x09940993u, 0x09950994u, 0x09990998u, 0x099e099cu,
+    0x099f099eu, 0x09a209a1u, 0x09a309a3u, 0x09a509a4u, 0x09a909a7u, 0x09ad09aau, 0x09b009adu, 0x09b209b0u,
+    0x09b209b2u, 0x09b409b2u, 0x09b509b4u, 0x09b509b5u, 0x09b609b5u, 0x09b609b6u, 0x09b909b8u, 0x09bb09bbu,
+    0x09be09bdu, 0x09bf09beu, 0x09c109c0u, 0x09c109c1u, 0x09c209c1u, 0x09c409c3u, 0x09c709c6u, 0x09c909c9u,
+    0x09ce09cbu, 0x09ce09ceu, 0x09cf09ceu, 0x09cf09cfu, 0x09d109d0u, 0x09d509d2u, 0x09d909d8u, 0x09d909d9u,
+    0x09de09ddu, 0x09e009dfu, 0x09e209e1u, 0x09e609e3u, 0x09e809e8u, 0x09e809e8u, 0x09ec09e9u, 0x09ef09eeu,
+    0x09f109f1u, 0x09f209f2u, 0x09f409f3u, 0x09f509f4u, 0x09f609f5u, 0x09f909f6u, 0x09fa09f9u, 0x09fd09fbu,
+    0x09fe09feu, 0x09ff09ffu, 0x0a030a02u, 0x0a060a05u, 0x0a090a08u, 0x0a0c0a0bu, 0x0a120a0eu, 0x0a140a13u,
+    0x0a170a16u, 0x0a190a18u, 0x0a1b0a1au, 0x0a1c0a1cu, 0x0a1d0a1du, 0x0a200a1fu, 0x0a220a20u, 0x0a250a24u,
+    0x0a280a27u, 0x0a2b0a2au, 0x0a2d0a2cu, 0x0a300a2du, 0x0a320a31u, 0x0a360a35u, 0x0a380a36u, 0x0a3c0a3au,
+    0x0a3d0a3cu, 0x0a3d0a3du, 0x0a3d0a3du, 0x0a3e0a3du, 0x0a400a3fu, 0x0a400a40u, 0x0a410a41u, 0x0a420a41u,
+    0x0a420a42u, 0x0a440a43u, 0x0a440a44u, 0x0a440a44u, 0x0a470a47u, 0x0a490a47u, 0x0a490a49u, 0x0a4b0a4au,
+    0x0a4e0a4cu, 0x0a500a4eu, 0x0a530a52u, 0x0a540a54u, 0x0a560a55u, 0x0a570a56u, 0x0a580a58u, 0x0a590a58u,
+    0x0a590a59u, 0x0a5d0a5cu, 0x0a5e0a5du, 0x0a5f0a5fu, 0x0a600a5fu, 0x0a640a62u, 0x0a660a64u, 0x0a670a66u,
+    0x0a6a0a68u, 0x0a6b0a6bu, 0x0a6e0a6eu, 0x0a700a6fu, 0x0a710a71u, 0x0a720a71u, 0x0a730a73u, 0x0a740a74u,
+    0x0a750a75u, 0x0a760a76u, 0x0a780a77u, 0x0a7b0a79u, 0x0a7c0a7bu, 0x0a7e0a7cu, 0x0a7e0a7eu, 0x0a7f0a7eu,
+    0x0a820a7fu, 0x0a840a83u, 0x0a860a85u, 0x0a880a86u, 0x0a8a0a89u, 0x0a8c0a8bu, 0x0a8f0a8du, 0x0a910a90u,
+    0x0a910a91u, 0x0a950a92u, 0x0a970a96u, 0x0a990a98u, 0x0a9b0a99u, 0x0a9d0a9du, 0x0a9f0a9du, 0x0aa00aa0u,
+    0x0aa40aa0u, 0x0aa50aa4u, 0x0aaa0aa6u, 0x0aab0aaau, 0x0aaf0aacu, 0x0ab00aafu, 0x0ab10ab1u, 0x0ab40ab1u,
+    0x0ab50ab4u, 0x0aba0ab9u, 0x0abd0abbu, 0x0abf0abeu, 0x0ac20ac0u, 0x0ac50ac3u, 0x0ac50ac5u, 0x0ac80ac8u,
+    0x00000ac9u,
+};
+
+constexpr std::array<std::uint32_t, 1381> ReciprocalCorrections{
+    0x09230922u, 0x0dcd0dccu, 0x01d101d0u, 0x04e704e6u, 0x0e8d0e8cu, 0x05df05deu, 0x07a507a4u, 0x085b085au,
+    0x0f7f0f7eu, 0x0e070e06u, 0x01a901a8u, 0x0bdf0bdeu, 0x06e306e2u, 0x04db04dau, 0x02650264u, 0x0a430a42u,
+    0x0fda0e3au, 0x039b0fdbu, 0x03df03deu, 0x0ca30ca2u, 0x096e0c74u, 0x0df5096fu, 0x0e7c0b2au, 0x09020e7du,
+    0x08c409abu, 0x005b005au, 0x096e072eu, 0x0e7d096fu, 0x04ff07a9u, 0x07530752u, 0x0a830a82u, 0x04670466u,
+    0x087f087eu, 0x06ef0524u, 0x02880cb3u, 0x05b70289u, 0x0d2b0d2au, 0x05d5013eu, 0x08fb0ef3u, 0x03020a8du,
+    0x0906042eu, 0x089f00d9u, 0x0f340ea5u, 0x03790f43u, 0x045b045au, 0x01b60f1fu, 0x02970938u, 0x062d0626u,
+    0x02b408cfu, 0x0f670c20u, 0x02b50068u, 0x0cdd0cdcu, 0x06e10ebeu, 0x00ab0c9eu, 0x08a7076du, 0x01230da0u,
+    0x02590258u, 0x056e051eu, 0x0ecb08ffu, 0x02ba06dcu, 0x03ac0396u, 0x03c303adu, 0x03720927u, 0x01250031u,
+    0x12f6018fu, 0x058e0035u, 0x001101e0u, 0x0a6f06a0u, 0x03c2017eu, 0x0975055fu, 0x06490f45u, 0x09520742u,
+    0x074d051fu, 0x087204f7u, 0x0c5a0a55u, 0x01650c5bu, 0x01f30dabu, 0x0d5b0364u, 0x087f0368u, 0x0e730953u,
+    0x036101bcu, 0x064a1e36u, 0x03a602d2u, 0x0d240954u, 0x081e002au, 0x06690e87u, 0x035b0e6bu, 0x0aa9058au,
+    0x044a0018u, 0x06f504f5u, 0x01160bbbu, 0x068101bfu, 0x02790121u, 0x033b0e62u, 0x0dc80b27u, 0x046b014du,
+    0x00a70cb1u, 0x03a10230u, 0x03320549u, 0x092708ddu, 0x00640c76u, 0x193b01acu, 0x02eb0998u, 0x0fa30e9du,
+    0x0d680286u, 0x0ae40808u, 0x03870f6du, 0x09fa0451u, 0x0a960098u, 0x09ef0cbeu, 0x031702c2u, 0x017d0185u,
+    0x02ed03c8u, 0x003e0453u, 0x068801c4u, 0x0f4d0d62u, 0x0b360fe3u, 0x0afb0293u, 0x064a0c79u, 0x042a0ed6u,
+    0x014e0c5du, 0x03530535u, 0x0499039fu, 0x02460953u, 0x086f0303u, 0x07b50d76u, 0x0dc40928u, 0x024e0a5au,
+    0x068304ecu, 0x07b2076au, 0x07750f6fu, 0x0d3c02a5u, 0x0c6c03bfu, 0x086a00c7u, 0x02b50270u, 0x00ad06cdu,
+    0x05b00515u, 0x097b063cu, 0x04d00df2u, 0x09890e9cu, 0x0d830992u, 0x0f40009au, 0x0d86022bu, 0x0ee70e34u,
+    0x09560897u, 0x0d240cf7u, 0x06650343u, 0x0488008fu, 0x06bf053cu, 0x0ba80c1cu, 0x0caf0c32u, 0x071f0d84u,
+    0x0ded0b02u, 0x07c40558u, 0x00220b18u, 0x018b04cdu, 0x098d05e3u, 0x0b1e0fb9u, 0x01710dc4u, 0x030b0accu,
+    0x0f4d0a1cu, 0x01b20fcbu, 0x0273021bu, 0x0b27092du, 0x0d640d14u, 0x08cb0258u, 0x06b10bb5u, 0x0ab506a2u,
+    0x01281af9u, 0x0eb00d04u, 0x06b102d1u, 0x0bc70b39u, 0x096b0783u, 0x062b0d74u, 0x01500e6fu, 0x1a11033bu,
+    0x09ad0f37u, 0x07150d85u, 0x0a480fabu, 0x081b098eu, 0x0c850be0u, 0x03fc04bfu, 0x0e160d48u, 0x0e130c66u,
+    0x075c01f8u, 0x03580e3du, 0x00bd0877u, 0x064602b4u, 0x052b0697u, 0x00bd0c4du, 0x02270179u, 0x096e06bbu,
+    0x011c0a9cu, 0x04f80a78u, 0x0fcb020bu, 0x17e301a8u, 0x0e9909d5u, 0x0cbf06abu, 0x072d019du, 0x07110d1eu,
+    0x03e60785u, 0x0f5807b7u, 0x076b0114u, 0x009f08b3u, 0x048b0153u, 0x09ed0879u, 0x0eeb0a69u, 0x05c500e7u,
+    0x06530d54u, 0x18010680u, 0x06b502c8u, 0x0a8209f2u, 0x062204f0u, 0x10440a5au, 0x042e0254u, 0x0ca908a8u,
+    0x0073003au, 0x074103a5u, 0x025a1908u, 0x02a10ce1u, 0x03e503c9u, 0x06ab043cu, 0x097008a3u, 0x05c20d91u,
+    0x03250b4cu, 0x0cc70a0fu, 0x071a006eu, 0x00710c41u, 0x0b5a00b4u, 0x00300e76u, 0x08fa0994u, 0x0dfa0973u,
+    0x054104cfu, 0x0d5c0d47u, 0x0abf0257u, 0x021d0bc4u, 0x043c03c3u, 0x0e16087fu, 0x09b30eafu, 0x17000164u,
+    0x07750726u, 0x02f208d3u, 0x03f306e3u, 0x06280379u, 0x0dce0ae4u, 0x02c400c3u, 0x09d6067cu, 0x0bf10552u,
+    0x09eb00bau, 0x0f890af0u, 0x03640035u, 0x00520f97u, 0x05590223u, 0x0c16028du, 0x0d840c21u, 0x068c0130u,
+    0x00360f87u, 0x0598018eu, 0x080f07c4u, 0x04110cc6u, 0x09e404eeu, 0x089802d2u, 0x0ed60c97u, 0x0cd10722u,
+    0x0ecf0dbbu, 0x0f6008f8u, 0x0b650931u, 0x06dc0cc0u, 0x0a9e07ddu, 0x0ed90ca7u, 0x01150058u, 0x0d020745u,
+    0x06e80cc6u, 0x086f072au, 0x013f0e21u, 0x0fc61bdeu, 0x06ff00cau, 0x061a0d5fu, 0x073b06cfu, 0x0f650a40u,
+    0x0bc60234u, 0x00280bd0u, 0x0bcd00c3u, 0x006e0f98u, 0x057e04c6u, 0x01ae07d0u, 0x09d7043du, 0x08710d0eu,
+    0x08220b46u, 0x0a3909c6u, 0x0c320ab3u, 0x02e70dd1u, 0x0d850f0bu, 0x027f0ddcu, 0x0599044cu, 0x07710a83u,
+    0x1b610ae2u, 0x0cca0b68u, 0x001c06aau, 0x002f08a7u, 0x0b990a66u, 0x04a4043du, 0x09c402d4u, 0x0ba20ba9u,
+    0x02680fe7u, 0x0b8908a8u, 0x09ce0491u, 0x01af0966u, 0x0c3e0797u, 0x02750f5cu, 0x02d70a0du, 0x0057064au,
+    0x0126018au, 0x0ed30792u, 0x0a5504c3u, 0x0cef04b9u, 0x07d10de6u, 0x0f5d0a98u, 0x0f8a0d52u, 0x03c60aebu,
+    0x0caf088fu, 0x06b406eau, 0x09040a91u, 0x0bbb0a57u, 0x08a6003au, 0x0f590de3u, 0x06020fb7u, 0x008e083du,
+    0x01940124u, 0x07a101bbu, 0x0f1e0c68u, 0x092c0310u, 0x09b4096du, 0x0d120297u, 0x02b70e2du, 0x0c2e19ceu,
+    0x118d00a9u, 0x0cf7067fu, 0x01790e25u, 0x0dd91421u, 0x0f040dfeu, 0x0b3c0133u, 0x033b013bu, 0x0ac2048eu,
+    0x0d050bcdu, 0x0da40eddu, 0x0ae2046fu, 0x0d1602a4u, 0x01d20669u, 0x0f9b0f24u, 0x04cb1b07u, 0x0d2f06feu,
+    0x0f4c0ad0u, 0x076e0fd4u, 0x039a0ea2u, 0x05b203a2u, 0x0cfe0fc6u, 0x00040000u, 0x0cee04a8u, 0x0a9313e9u,
+    0x08e60433u, 0x03370317u, 0x0f12092cu, 0x0e8e06b0u, 0x07191400u, 0x02480745u, 0x1bc10a4fu, 0x0930051du,
+    0x18de0e5fu, 0x069f051au, 0x0e8e0abbu, 0x09a10231u, 0x0fe10afbu, 0x02f70146u, 0x0a38020cu, 0x0b380995u,
+    0x0b420727u, 0x091a0494u, 0x07361c40u, 0x0c320376u, 0x09b10949u, 0x0a270370u, 0x059302c5u, 0x0f4a06cbu,
+    0x0e1e069eu, 0x0e0503f9u, 0x0df6017cu, 0x07cb0184u, 0x0c1d08bau, 0x0e3500b8u, 0x02730c99u, 0x0a3f06ebu,
+    0x063d06e2u, 0x05ff086cu, 0x0a8208b7u, 0x085f0660u, 0x02dd0f51u, 0x06130576u, 0x061a0581u, 0x00380e54u,
+    0x06b102dfu, 0x0752029eu, 0x1c810abbu, 0x0a4502dbu, 0x0ecb0d85u, 0x051a01a6u, 0x09ea0774u, 0x0e390cf0u,
+    0x04c40019u, 0x055100cfu, 0x037206c8u, 0x049403b8u, 0x005a153du, 0x0243011du, 0x00ac007cu, 0x088c06f7u,
+    0x0ce70b5cu, 0x0e7b0d84u, 0x040902a2u, 0x031a084bu, 0x002e064au, 0x0c9d0cd2u, 0x00c8036cu, 0x0f1a07a7u,
+    0x07420150u, 0x0b850f5du, 0x0bb20072u, 0x0cae0dbau, 0x06891371u, 0x04f40adfu, 0x08360659u, 0x12810f3bu,
+    0x019108fdu, 0x037e0c9du, 0x0f2f0b57u, 0x0cc405a8u, 0x064a07d5u, 0x08340f67u, 0x02410d1fu, 0x08c506cbu,
+    0x0d3e0d7fu, 0x088a0198u, 0x0d3b0eb6u, 0x08340031u, 0x01591f7du, 0x03e20cdfu, 0x0cf30c50u, 0x00fe1ef7u,
+    0x050f01c4u, 0x07ac0c36u, 0x0658057du, 0x02c80743u, 0x0d3e0d4cu, 0x06570264u, 0x01ee0e6eu, 0x0ab30a4bu,
+    0x01160098u, 0x00e307e3u, 0x07da050bu, 0x0349013eu, 0x00d10568u, 0x023014d7u, 0x0efa02a0u, 0x0b9f0f6au,
+    0x0ff50d0fu, 0x034e08b8u, 0x03f40a10u, 0x09d60958u, 0x09670336u, 0x02d70e9du, 0x08490548u, 0x073f0012u,
+    0x007c0b8fu, 0x19120fc8u, 0x0ed008dcu, 0x0d890533u, 0x030802fbu, 0x0e410c8du, 0x1cb80224u, 0x0e7d08fcu,
+    0x18c108beu, 0x06ef0e4bu, 0x0b0b0b85u, 0x02bb019cu, 0x09331414u, 0x01900342u, 0x063b1bf8u, 0x0d2a0d59u,
+    0x0b7a090du, 0x087f0e27u, 0x06dc046du, 0x05380a6du, 0x09070314u, 0x0ce40ee0u, 0x0a8d09b7u, 0x0e680367u,
+    0x0d920486u, 0x091b0288u, 0x0d010fb4u, 0x09d80eceu, 0x0ea6048au, 0x02da0b5du, 0x01570b88u, 0x016c078bu,
+    0x074d037cu, 0x08be078du, 0x025f0b3fu, 0x05360c4cu, 0x09b706f9u, 0x04b00b46u, 0x0c1208ebu, 0x1e8a0a46u,
+    0x00080f72u, 0x003a0021u, 0x13f402cfu, 0x0642053du, 0x00e700aau, 0x04b10ad4u, 0x0fa00e90u, 0x00970eb0u,
+    0x04740b05u, 0x16710ba9u, 0x0a3007d6u, 0x0b8a0a4fu, 0x0d2d0af9u, 0x02e109bbu, 0x0c650d75u, 0x0f5c01d9u,
+    0x01990f6fu, 0x0ea30ac5u, 0x0d1507b3u, 0x0f7a0ed1u, 0x05ec0455u, 0x01b609e8u, 0x04bd0cc1u, 0x07bd0bd0u,
+    0x02470b13u, 0x062a19afu, 0x04da0a7cu, 0x0ee308cau, 0x0be5000fu, 0x046d0ef7u, 0x050d0eccu, 0x04780947u,
+    0x0b141721u, 0x04a30c26u, 0x00f30e27u, 0x086a0034u, 0x0efb0e58u, 0x09470553u, 0x0f770bf9u, 0x0c100059u,
+    0x077b02e8u, 0x0e8507d0u, 0x0e3f075fu, 0x073601c9u, 0x05640dd8u, 0x075f0a4bu, 0x0ee60e3du, 0x057a0212u,
+    0x0db10c5au, 0x067f0008u, 0x039301bbu, 0x085e0565u, 0x0efa0bc3u, 0x03380f6fu, 0x0cba0034u, 0x14d7100fu,
+    0x096d006eu, 0x03d40d1au, 0x049609eeu, 0x0f7f0b78u, 0x0a0e08feu, 0x01e20b90u, 0x0e6705b0u, 0x0d3310c3u,
+    0x055f0302u, 0x096b08c2u, 0x1acc09c1u, 0x08aa0345u, 0x037602c2u, 0x057504d4u, 0x0f3b0ee8u, 0x0aa00f66u,
+    0x04fc0215u, 0x0e43005eu, 0x0ba60350u, 0x04c81cf9u, 0x0df707afu, 0x069707cbu, 0x0ed70965u, 0x007b05bcu,
+    0x0c960f1au, 0x05f60c04u, 0x0e800dcbu, 0x09c70f82u, 0x04b40612u, 0x04e30c57u, 0x09c508b9u, 0x045b1f4au,
+    0x0aa814d7u, 0x0c2b0ecbu, 0x180a1ef5u, 0x0ab0045du, 0x039100b3u, 0x0c7c0587u, 0x0d5b02a9u, 0x002d000eu,
+    0x09720c68u, 0x0ecf0231u, 0x03c70afau, 0x0d6c06f5u, 0x01320bcfu, 0x04e811cfu, 0x0cdf0f7bu, 0x06ca09deu,
+    0x0b0e06c8u, 0x01230562u, 0x0fb20b65u, 0x02c70882u, 0x08c40749u, 0x0d480b66u, 0x177103cfu, 0x06ca09f2u,
+    0x063c0456u, 0x0add00d5u, 0x0b3308afu, 0x0ea30f84u, 0x0b7204d7u, 0x04e70e35u, 0x043b0a95u, 0x18450cbfu,
+    0x0fd70a2bu, 0x0c8c03e2u, 0x087a008au, 0x1dd31d76u, 0x00300f35u, 0x0bd6084eu, 0x01050d8bu, 0x06600568u,
+    0x0c9e0c4du, 0x13550f6au, 0x15bc073au, 0x082306ddu, 0x02500c6cu, 0x15710e9bu, 0x084f1eedu, 0x0a5f0949u,
+    0x046a000eu, 0x092317f2u, 0x0cd11c78u, 0x05570228u, 0x061c008bu, 0x092d081du, 0x04b40b07u, 0x01b706ecu,
+    0x099414f2u, 0x120d0a3cu, 0x0e600a1bu, 0x1719049cu, 0x08da0984u, 0x0627033eu, 0x011a09c4u, 0x0727010du,
+    0x04f0082cu, 0x057a015du, 0x1a8509d7u, 0x0d2b1cccu, 0x097d0792u, 0x01c80e69u, 0x02bb0366u, 0x009b0c68u,
+    0x0a2909f7u, 0x0e7d071au, 0x0e941c04u, 0x03a911d3u, 0x0a240957u, 0x0c940bf4u, 0x0b5f0b28u, 0x028e0fc5u,
+    0x08ae0d84u, 0x05d20c71u, 0x05710aedu, 0x052e0a9cu, 0x054e0ac8u, 0x0f880c7eu, 0x0ef6083du, 0x006f0a28u,
+    0x19d50787u, 0x02ac0f28u, 0x0a5f033cu, 0x1e5c0c9bu, 0x0d2f0553u, 0x0fe60f84u, 0x08ae0214u, 0x09d1016au,
+    0x083d0d58u, 0x11e00e5du, 0x02ea0e50u, 0x0e27081du, 0x028002eau, 0x099205d2u, 0x0c5e0726u, 0x09ba1e66u,
+    0x00290ef6u, 0x05b50223u, 0x079305efu, 0x06e31f47u, 0x00b00e11u, 0x02b0028fu, 0x09fe0634u, 0x024901d1u,
+    0x07251586u, 0x0a681520u, 0x02571e25u, 0x0e8802c8u, 0x0f130029u, 0x1aa606ecu, 0x1c6015fau, 0x0f990ef3u,
+    0x089406f0u, 0x02b30befu, 0x0f1b0d89u, 0x04a60145u, 0x10980c5bu, 0x06a2017fu, 0x167f1e12u, 0x0b0c19a0u,
+    0x19a500ceu, 0x04f6018eu, 0x0e710c36u, 0x00120f15u, 0x00001e03u, 0x0156194fu, 0x14b80330u, 0x1e570bc2u,
+    0x01050f3du, 0x1af905a8u, 0x09eb0862u, 0x0d5f05b1u, 0x048c03ebu, 0x0963061au, 0x19dc019du, 0x04691bebu,
+    0x07f20e07u, 0x0fcf0bbbu, 0x1cc007fdu, 0x1e800b64u, 0x04651b38u, 0x0b9d0a7du, 0x0b720005u, 0x0fd6063du,
+    0x06ae11bau, 0x013816b1u, 0x082c021bu, 0x03221beau, 0x16f906f8u, 0x025001a2u, 0x009f1a20u, 0x0acd100fu,
+    0x0cbf0ef2u, 0x0569036du, 0x070e102bu, 0x06210b4du, 0x18fa0d3eu, 0x04fd0b06u, 0x084507b6u, 0x0bea1a45u,
+    0x08be0573u, 0x0d0a1be9u, 0x192700a4u, 0x0ad60a34u, 0x05410f23u, 0x08c40c2du, 0x08bf026du, 0x007e09bbu,
+    0x012c1041u, 0x0a5911b9u, 0x18a202c8u, 0x0b540a76u, 0x07af0530u, 0x040309e1u, 0x11f90406u, 0x0b5f032fu,
+    0x0db00d5eu, 0x081b07deu, 0x0e291f5eu, 0x1ab202d6u, 0x0ab60b13u, 0x0b3107b4u, 0x069c11f8u, 0x09a3163eu,
+    0x056b026cu, 0x042608b5u, 0x01c30788u, 0x079414e1u, 0x085f054fu, 0x02fd1d41u, 0x169e0794u, 0x0d5d1680u,
+    0x074f1ffcu, 0x192e091au, 0x1b411e08u, 0x0b4f0a9au, 0x0e570b1eu, 0x0288001fu, 0x078e05a2u, 0x01b01c0du,
+    0x069313e1u, 0x0ad708feu, 0x0ed01dcfu, 0x060b0a56u, 0x03c807e4u, 0x1fbc0d62u, 0x038c1d8du, 0x033609fcu,
+    0x09ca086au, 0x0a260bacu, 0x0f7708e4u, 0x0774040fu, 0x0e340e69u, 0x0cfe0e3fu, 0x0e9f0fbfu, 0x0a4f0715u,
+    0x01160fcdu, 0x075f0642u, 0x0a3f090du, 0x0dac0382u, 0x03b40ce9u, 0x16410523u, 0x0355003eu, 0x02590d33u,
+    0x0c6516bdu, 0x088f05c3u, 0x068a0971u, 0x0f4b0dd7u, 0x07d9004fu, 0x086a1548u, 0x07341000u, 0x068c0274u,
+    0x00090000u, 0x001b0012u, 0x002d0024u, 0x003f0036u, 0x03a006e2u, 0x0c7a0985u, 0x13a310f2u, 0x0b491025u,
+    0x033800d3u, 0x1c7206e3u, 0x0c691176u, 0x1a11016bu, 0x0cc20b72u, 0x05710df1u, 0x15680f1au, 0x0cd108aau,
+    0x04630ce6u, 0x0c35050eu, 0x046004afu, 0x0fed061du, 0x1be00967u, 0x0d1d16c4u, 0x0f640e55u, 0x07e00417u,
+    0x14190c5au, 0x1d921554u, 0x1df90ea5u, 0x0eb00a5eu, 0x110309cau, 0x0e5a0df9u, 0x0e690a65u, 0x075801eeu,
+    0x0db30a05u, 0x0ee30f7bu, 0x04cf02d1u, 0x008a094du, 0x08a51872u, 0x0e300bd0u, 0x09450f24u, 0x0fb7016cu,
+    0x00960bcbu, 0x0ade00f8u, 0x10940bfcu, 0x075e1465u, 0x031a0539u, 0x00111b10u, 0x0b15187bu, 0x035200b4u,
+    0x0a2e1bdeu, 0x112e195bu, 0x095a13eau, 0x09ce085eu, 0x18060f1du, 0x07130d9du, 0x182d0b88u, 0x1c990a9du,
+    0x1ac702fdu, 0x01cc0bf4u, 0x04ea04d7u, 0x05870cd2u, 0x0afe0a48u, 0x0d421cb2u, 0x02d71310u, 0x0df21bf7u,
+    0x0c0e165eu, 0x040a0165u, 0x015401adu, 0x11a0021bu, 0x0daa0d0eu, 0x07780545u, 0x0a3c098eu, 0x1f620f4bu,
+    0x04da034du, 0x038f1e83u, 0x01ef0a87u, 0x014e0b47u, 0x19c6028du, 0x1264026bu, 0x075b0a7eu, 0x0480044cu,
+    0x0c4a1acbu, 0x0024022fu, 0x11820dc5u, 0x08241f8fu, 0x07c00859u, 0x03f50058u, 0x0d1a0430u, 0x099306a9u,
+    0x00d60f4du, 0x0eb308b5u, 0x10360779u, 0x0c6e0606u, 0x05e603b3u, 0x032a0b25u, 0x11c00ea9u, 0x1632033eu,
+    0x0d40078bu, 0x022710a8u, 0x03530a0fu, 0x07f206edu, 0x02c209e0u, 0x0f9a0cd0u, 0x0e1f1817u, 0x099f0fc7u,
+    0x00331fbeu, 0x05a814f9u, 0x08cb16f3u, 0x0b0004ccu, 0x07430d5du, 0x04330e7eu, 0x17e20c33u, 0x03ec1ddcu,
+    0x03ea1604u, 0x0eac0c76u, 0x00210000u, 0x0d0d19dcu, 0x0ae615fcu, 0x1b300887u, 0x0a060fdbu, 0x1d4a08dau,
+    0x0ef51ff9u, 0x0514076fu, 0x0258005fu, 0x0d641050u, 0x015b0045u, 0x08090032u, 0x0c250a8du, 0x07030422u,
+    0x0d180a87u, 0x00860588u, 0x0e5608c4u, 0x11110c54u, 0x15110b74u, 0x096d0068u, 0x089c0b25u, 0x064102dau,
+    0x15cd048au, 0x00f308f1u, 0x0ddb1fb3u, 0x0d8e06aau, 0x07360644u, 0x02910f00u, 0x076e16bfu, 0x00420000u,
+    0x0f821945u, 0x1e1202c5u, 0x08170125u, 0x07d50672u, 0x03131806u, 0x1b5904beu, 0x0c5a03dau, 0x104908f8u,
+    0x0f6e1de5u, 0x1c2016a6u, 0x01ec02b7u, 0x0bbc11f9u, 0x1df102d1u, 0x0e880345u, 0x06190350u, 0x1935015eu,
+    0x0185006bu, 0x03640955u, 0x165711ceu, 0x0a3102fbu, 0x08d802fbu, 0x0c760ac8u, 0x07ed0103u, 0x02040b8eu,
+    0x0ff50cdcu, 0x1e6707c3u, 0x0d351edfu, 0x1ea41e21u, 0x00450603u, 0x055c0b12u, 0x0fab1f82u, 0x08430a7eu,
+    0x005419ddu, 0x076416beu, 0x08c3014au, 0x0b9d19a3u, 0x09a112b2u, 0x1b6906d8u, 0x0262011cu, 0x014715f9u,
+    0x076d15e0u, 0x0aae0380u, 0x086d022eu, 0x1fe3003eu, 0x01071660u, 0x135d0e1du, 0x070a16c5u, 0x0c7c0ad7u,
+    0x1f540663u, 0x061612b5u, 0x1ce40423u, 0x06561183u, 0x03b904ccu, 0x04470860u, 0x0c0e0a18u, 0x1a4f0997u,
+    0x00670b7du, 0x0e9f113du, 0x0a601481u, 0x05560d5bu, 0x08cb0a58u, 0x1e190c37u, 0x164301fbu, 0x03370418u,
+    0x04c20a9cu, 0x023918a4u, 0x079b0010u, 0x069f00a9u, 0x00a40146u, 0x141c0687u, 0x13d91a7eu, 0x10b81811u,
+    0x0b62170au, 0x1bc10fbbu, 0x017d00a1u, 0x04a707dcu, 0x019c08d3u, 0x03dd1ea4u, 0x0c190f3au, 0x071b028eu,
+    0x09990925u, 0x01570979u, 0x0529006fu, 0x03e118f1u, 0x1b7e01d2u, 0x14d609cbu, 0x11280c7eu, 0x01b90190u,
+    0x006b09b0u, 0x0f0c0566u, 0x043a0d40u, 0x055c05e4u, 0x0f510979u, 0x17a50103u, 0x0f3c0688u, 0x126c1269u,
+    0x05251cbfu, 0x000704d9u, 0x19910048u, 0x0fe21090u, 0x1ecb17b3u, 0x0f2e0c18u, 0x05460a35u, 0x07560314u,
+    0x0d68054du, 0x13291e85u, 0x0d751c10u, 0x1d4815b4u, 0x041d08f3u, 0x0f8107b4u, 0x0b520641u, 0x02f20cefu,
+    0x09e70742u, 0x19e004d9u, 0x0e2d0c5du, 0x00201b11u, 0x108e0118u, 0x03cf03ccu, 0x003b0b77u, 0x012a08d5u,
+    0x0aca09a4u, 0x0ed80807u, 0x18171265u, 0x057f097fu, 0x043d01cau, 0x005d0c51u, 0x1efd079au, 0x0c03012fu,
+    0x184e1258u, 0x00310000u, 0x1f960f23u, 0x11f00ff4u, 0x140f038du, 0x0a421607u, 0x01620388u, 0x0eee0d9bu,
+    0x0cd80a39u, 0x0aea0d38u, 0x05b90ba7u, 0x0d250730u, 0x07830276u, 0x0c2915f9u, 0x0ba20be3u, 0x0aa60303u,
+    0x0e861e0cu, 0x1fbb07aeu, 0x04bf0d1cu, 0x11b4005au, 0x10b11792u, 0x1d870202u, 0x023b0bfdu, 0x15b81f61u,
+    0x0b3008bcu, 0x0cf01148u, 0x10800ec6u, 0x0fd8018bu, 0x00e314c5u, 0x005805d4u, 0x08961309u, 0x15a400cbu,
+    0x1b481956u, 0x04770015u, 0x0d021957u, 0x16a713feu, 0x008b0876u, 0x1d5318c1u, 0x09a70279u, 0x08d703cau,
+    0x05310a00u, 0x0dba1a6bu, 0x03970e3eu, 0x00301562u, 0x1cc214d6u, 0x168c0949u, 0x1a0206b1u, 0x0def0f0cu,
+    0x02460055u, 0x03ca05c4u, 0x0b591ac3u, 0x188f128eu, 0x01980a22u, 0x156502a8u, 0x07cd100cu, 0x1a7004b2u,
+    0x0151007eu, 0x1863023du, 0x0ac10a73u, 0x05df1469u, 0x146f0666u, 0x0f27043bu, 0x17161f46u, 0x0a7314a8u,
+    0x05d90c56u, 0x0bb215d3u, 0x03ba0edeu, 0x08c716d7u, 0x14450138u, 0x02d01b31u, 0x0eea0cc4u, 0x016d0326u,
+    0x058404c4u, 0x03c5066du, 0x066105deu, 0x05ef014cu, 0x056d05a8u, 0x17c0165cu, 0x02b109a3u, 0x0382092cu,
+    0x13e707dcu, 0x0c8a143du, 0x05550d36u, 0x13b916adu, 0x0e9f0f47u, 0x0f3f137cu, 0x0c1010d1u, 0x04c80072u,
+    0x006403e8u, 0x06a20a4au, 0x0a3e004au, 0x03720f4eu, 0x0eae0d91u, 0x05980076u, 0x1bf10a5au, 0x15191332u,
+    0x1b980322u, 0x0bdc1ad4u, 0x121a1ef7u, 0x048f03feu, 0x17000b34u, 0x18fc0c20u, 0x04e61979u, 0x12241579u,
+    0x074a14d7u, 0x05860361u, 0x000e0be1u, 0x0030001fu, 0x00520041u, 0x00f61e9bu, 0x00130615u, 0x0c7e0964u,
+    0x045f00cdu, 0x14061a21u, 0x023d085bu, 0x093d06fbu, 0x046d0deau, 0x0a6407d6u, 0x194d1640u, 0x00a6085bu,
+    0x013009bcu, 0x058116a0u, 0x09541decu, 0x03c01dd0u, 0x0d240864u, 0x05950108u, 0x16761db9u, 0x0ef606a8u,
+    0x15fe05ebu, 0x0f7715e9u, 0x174d1f96u, 0x1e3504a6u, 0x0165004bu, 0x02130278u, 0x09a90a61u, 0x177d063cu,
+    0x09070105u, 0x05ca1855u, 0x1a051152u, 0x07851330u, 0x1df209a7u, 0x00001f55u, 0x07440007u, 0x1a5d1cbfu,
+    0x0cbc0885u, 0x089f00d2u, 0x02e91d3au, 0x0bf9092bu, 0x11551958u, 0x19b503cau, 0x06b40a1au, 0x18110ed0u,
+    0x05bf07a6u, 0x03cf07fdu, 0x1d4008f3u, 0x0bf312c8u, 0x000a070au, 0x0e1a0abeu, 0x1e5e1dc8u, 0x128006c2u,
+    0x0d861299u, 0x0ba303c8u, 0x07761fceu, 0x0b7409f7u, 0x09bd1efcu, 0x05ad184fu, 0x0aba1b89u, 0x00790713u,
+    0x0a631655u, 0x09640f98u, 0x132f196du, 0x043e0351u, 0x13c707c7u, 0x08630605u, 0x0ee30212u, 0x0e6e0397u,
+    0x0f0a1ebcu, 0x0fc41ec8u, 0x0c651a13u, 0x0ada1d6cu, 0x09571288u, 0x062a0916u, 0x087e14b4u, 0x0bd70e45u,
+    0x172611e8u, 0x0e6815b9u, 0x12850c43u, 0x17db14a3u, 0x0f9b1a71u, 0x07021de6u, 0x08f01334u, 0x1dba1ccbu,
+    0x07bd01d0u, 0x16440166u, 0x017a1ad3u, 0x1d210b61u, 0x160c1080u, 0x070c0405u, 0x0537192bu, 0x08d412acu,
+    0x0b1d0786u, 0x0a560117u, 0x04a20130u, 0x04ca0b7bu, 0x082709bfu, 0x0da50a93u, 0x19590007u, 0x16ba068bu,
+    0x1ed401c3u, 0x00b50f57u, 0x165c0a4fu, 0x0a680e76u, 0x010c1db6u, 0x0a7c07e9u, 0x12e818f3u, 0x1f991014u,
+    0x155c02f6u, 0x0e7600f4u, 0x0747008eu, 0x1a6413d0u, 0x0d0303b6u, 0x12d105e2u, 0x04bc03e6u, 0x01741353u,
+    0x12c1062du, 0x1a8c0f24u, 0x046606d9u, 0x11c106d6u, 0x18850fa7u, 0x0cce097au, 0x1f9b1509u, 0x000001eeu,
+    0x003e001fu, 0x1b2c08b8u, 0x152b0237u, 0x1deb04ebu, 0x14001b2fu, 0x11280499u, 0x006b1be7u, 0x160015e1u,
+    0x00f41df0u, 0x08181371u, 0x01530a86u, 0x0da20b03u, 0x0a820433u, 0x049c0ab5u, 0x0816059fu, 0x0d640e1fu,
+    0x0cd00303u, 0x1f9b1d50u, 0x0f040c3cu, 0x19e017dbu, 0x0fb20b51u, 0x18fa0384u, 0x0d4f08e4u, 0x0a890da6u,
+    0x07e7120fu, 0x1de00cf4u, 0x04e01320u, 0x0826070au, 0x1a740ff8u, 0x012a1619u, 0x1a2d0481u, 0x00741488u,
+    0x069d0388u, 0x11f00f3cu, 0x03ff1615u, 0x1720071eu, 0x00001486u,
+};
+
+template<std::size_t Size>
+std::uint32_t DefineTable(SpirvEmitterState& state, const std::array<std::uint32_t, Size>& values) {
+    std::array<std::uint32_t, Size> words{};
+    for (std::size_t index = 0; index < Size; ++index) words[index] = ConstantU32(state, values[index]);
+    const auto arrayType = state.module.Type(spv::OpTypeArray, TypeU32(state), ConstantU32(state, static_cast<std::uint32_t>(Size)));
+    const auto table = state.module.Constant(spv::OpConstantComposite, arrayType, std::span<const std::uint32_t>(words));
+    return state.module.DefineInitializedGlobalVariable(TypePointer(state, spv::StorageClassPrivate, arrayType), spv::StorageClassPrivate, table);
+}
+
+std::uint32_t LoadTable(SpirvEmitterState& state, std::uint32_t table, std::uint32_t index) {
+    const auto pointer = state.module.AllocateId();
+    state.module.AddFunction(spv::OpAccessChain, TypePointer(state, spv::StorageClassPrivate, TypeU32(state)), pointer, table, index);
+    const auto value = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, TypeU32(state), value, pointer);
+    return value;
+}
+
+std::array<std::uint32_t, 2> MultiplyExtended(SpirvEmitterState& state, std::uint32_t lhs, std::uint32_t rhs) {
+    const auto product = state.module.AllocateId();
+    state.module.AddFunction(spv::OpUMulExtended, TypeU32Pair(state), product, lhs, rhs);
+    std::array<std::uint32_t, 2> words{state.module.AllocateId(), state.module.AllocateId()};
+    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), words[0], product, 0u);
+    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), words[1], product, 1u);
+    return words;
+}
+
+std::uint32_t ReciprocalCorrection(SpirvEmitterState& state, std::uint32_t mantissa) {
+    const auto u32 = TypeU32(state);
+    const auto boolean = TypeBool(state);
+    const auto op = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t value) { return Binary(state, opcode, u32, lhs, ConstantU32(state, value)); };
+    const auto starts = DefineTable(state, ReciprocalCorrectionStarts);
+    const auto corrections = DefineTable(state, ReciprocalCorrections);
+    const auto halfword = [&](std::uint32_t table, std::uint32_t index, std::uint32_t last) {
+        const auto clamped = Select(state, u32, Binary(state, spv::OpULessThan, boolean, index, ConstantU32(state, last)), index, ConstantU32(state, last));
+        const auto word = LoadTable(state, table, op(spv::OpShiftRightLogical, clamped, 1u));
+        return op(spv::OpBitwiseAnd, Binary(state, spv::OpShiftRightLogical, u32, word, op(spv::OpShiftLeftLogical, op(spv::OpBitwiseAnd, clamped, 1u), 4u)), 0xffffu);
+    };
+    const auto lastStart = static_cast<std::uint32_t>(ReciprocalCorrectionStarts.size() * 2u - 1u);
+    const auto lastCorrection = static_cast<std::uint32_t>(ReciprocalCorrections.size() * 2u - 1u);
+    const auto bucket = op(spv::OpShiftRightLogical, mantissa, 12u);
+    const auto key = op(spv::OpBitwiseAnd, mantissa, 0xfffu);
+    const auto end = halfword(starts, op(spv::OpIAdd, bucket, 1u), lastStart);
+    auto first = halfword(starts, bucket, lastStart);
+    auto remaining = Binary(state, spv::OpISub, u32, end, first);
+    for (const std::uint32_t step : {8u, 4u, 2u, 1u}) {
+        const auto probe = op(spv::OpBitwiseAnd, halfword(corrections, op(spv::OpIAdd, first, step - 1u), lastCorrection), 0xfffu);
+        const auto inside = Binary(state, spv::OpULessThanEqual, boolean, ConstantU32(state, step), remaining);
+        const auto skip = Binary(state, spv::OpLogicalAnd, boolean, inside, Binary(state, spv::OpULessThan, boolean, probe, key));
+        first = Select(state, u32, skip, op(spv::OpIAdd, first, step), first);
+        remaining = Select(state, u32, skip, op(spv::OpISub, remaining, step), remaining);
+    }
+    const auto entry = halfword(corrections, first, lastCorrection);
+    const auto hit = Binary(state, spv::OpLogicalAnd, boolean, Binary(state, spv::OpULessThan, boolean, first, end), Binary(state, spv::OpIEqual, boolean, op(spv::OpBitwiseAnd, entry, 0xfffu), key));
+    const auto delta = Select(state, u32, Binary(state, spv::OpINotEqual, boolean, op(spv::OpBitwiseAnd, entry, 0x1000u), ConstantU32(state, 0u)), ConstantU32(state, 1u), ConstantU32(state, 0xffffffffu));
+    return Select(state, u32, hit, delta, ConstantU32(state, 0u));
+}
+
+bool ExactReciprocal() {
+    static const bool exact = std::getenv("APS5_EXACT_RCP") != nullptr;
+    return exact;
+}
+
+std::uint32_t DeviceReciprocal(SpirvEmitterState& state, std::uint32_t value) {
+    return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), value);
+}
+
+std::uint32_t HardwareReciprocal(SpirvEmitterState& state, std::uint32_t value) {
+    const auto u32 = TypeU32(state);
+    const auto f32 = TypeF32(state);
+    const auto boolean = TypeBool(state);
+    const auto op = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t constant) { return Binary(state, opcode, u32, lhs, ConstantU32(state, constant)); };
+    const auto add = [&](std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, spv::OpIAdd, u32, lhs, rhs); };
+    const auto sub = [&](std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, spv::OpISub, u32, lhs, rhs); };
+    const auto test = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, opcode, boolean, lhs, rhs); };
+    const auto pick = [&](std::uint32_t condition, std::uint32_t whenTrue, std::uint32_t whenFalse) { return Select(state, u32, condition, ConstantU32(state, whenTrue), ConstantU32(state, whenFalse)); };
+    if (state.reciprocalTables[0] == 0u) {
+        state.reciprocalTables = {DefineTable(state, ReciprocalConstant), DefineTable(state, ReciprocalLinear), DefineTable(state, ReciprocalHigherOrder)};
+    }
+    const auto bits = Unary(state, spv::OpBitcast, u32, value);
+    const auto exponent = op(spv::OpBitwiseAnd, op(spv::OpShiftRightLogical, bits, 23u), 0xffu);
+    const auto mantissa = op(spv::OpBitwiseAnd, bits, 0x7fffffu);
+    const auto segment = op(spv::OpShiftRightLogical, mantissa, 18u);
+    const auto fraction = op(spv::OpBitwiseAnd, mantissa, 0x3ffffu);
+    const auto constant = LoadTable(state, state.reciprocalTables[0], segment);
+    const auto linearFactor = LoadTable(state, state.reciprocalTables[1], segment);
+    const auto higherOrder = LoadTable(state, state.reciprocalTables[2], segment);
+
+    const auto linearProduct = MultiplyExtended(state, linearFactor, fraction);
+    const auto wide = test(spv::OpUGreaterThanEqual, linearProduct[1], ConstantU32(state, 64u));
+    const auto shift = pick(wide, 15u, 14u);
+    const auto quotient = Binary(state, spv::OpBitwiseOr, u32, Binary(state, spv::OpShiftLeftLogical, u32, linearProduct[1], sub(ConstantU32(state, 32u), shift)), Binary(state, spv::OpShiftRightLogical, u32, linearProduct[0], shift));
+    const auto midpoint = pick(wide, 0x4000u, 0x2000u);
+    const auto remainder = Binary(state, spv::OpBitwiseAnd, u32, linearProduct[0], pick(wide, 0x7fffu, 0x3fffu));
+    const auto odd = test(spv::OpINotEqual, op(spv::OpBitwiseAnd, quotient, 1u), ConstantU32(state, 0u));
+    const auto roundUp = Binary(state, spv::OpLogicalOr, boolean, test(spv::OpUGreaterThan, remainder, midpoint), Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpIEqual, remainder, midpoint), odd));
+    const auto rounded = add(quotient, pick(roundUp, 1u, 0u));
+    const auto linear = Binary(state, spv::OpShiftLeftLogical, u32, rounded, pick(wide, 1u, 0u));
+
+    const auto half = op(spv::OpShiftRightLogical, fraction, 1u);
+    const auto quadraticProduct = MultiplyExtended(state, op(spv::OpBitwiseAnd, higherOrder, 0xffffu), half);
+    const auto shiftedHigh = Binary(state, spv::OpBitwiseOr, u32, op(spv::OpShiftLeftLogical, quadraticProduct[1], 18u), op(spv::OpShiftRightLogical, quadraticProduct[0], 14u));
+    const auto shiftedLow = op(spv::OpShiftLeftLogical, quadraticProduct[0], 18u);
+    const auto cubicProduct = MultiplyExtended(state, Binary(state, spv::OpIMul, u32, op(spv::OpShiftRightLogical, higherOrder, 16u), fraction), half);
+    const auto innerLow = sub(shiftedLow, cubicProduct[0]);
+    const auto innerHigh = sub(sub(shiftedHigh, cubicProduct[1]), pick(test(spv::OpULessThan, shiftedLow, cubicProduct[0]), 1u, 0u));
+    const auto upper = MultiplyExtended(state, innerHigh, half);
+    const auto lower = MultiplyExtended(state, innerLow, half);
+    const auto upperPart = Binary(state, spv::OpBitwiseOr, u32, op(spv::OpShiftLeftLogical, upper[1], 15u), op(spv::OpShiftRightLogical, upper[0], 17u));
+    const auto carryPart = op(spv::OpShiftRightLogical, add(op(spv::OpBitwiseAnd, upper[0], 0x1ffffu), lower[1]), 17u);
+    const auto quadratic = add(upperPart, carryPart);
+
+    const auto sum = add(sub(op(spv::OpShiftLeftLogical, constant, 4u), linear), op(spv::OpIAdd, op(spv::OpShiftLeftLogical, quadratic, 1u), 32u));
+    const auto dropped = op(spv::OpBitwiseAnd, sum, 63u);
+    const auto nearCut = Binary(state, spv::OpLogicalOr, boolean, test(spv::OpULessThan, dropped, ConstantU32(state, 2u)), test(spv::OpUGreaterThanEqual, dropped, ConstantU32(state, 62u)));
+    const auto correction = EmitValueOrZeroIfCondition(state, nearCut, [&] {
+        const auto result = state.module.AllocateId();
+        state.module.AddFunction(spv::OpFunctionCall, u32, result, state.reciprocalCorrectionFunction, mantissa);
+        return result;
+    });
+    const auto normalized = add(op(spv::OpIAdd, op(spv::OpShiftRightLogical, sum, 6u), 0x3e800000u), correction);
+    const auto resultExponent = sub(op(spv::OpIAdd, op(spv::OpShiftRightLogical, normalized, 23u), 127u), exponent);
+    const auto exactBits = Binary(state, spv::OpBitwiseOr, u32, Binary(state, spv::OpBitwiseOr, u32, op(spv::OpBitwiseAnd, bits, 0x80000000u), op(spv::OpShiftLeftLogical, resultExponent, 23u)), op(spv::OpBitwiseAnd, normalized, 0x7fffffu));
+    const auto normalInput = Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpINotEqual, exponent, ConstantU32(state, 0u)), test(spv::OpINotEqual, exponent, ConstantU32(state, 0xffu)));
+    const auto normalResult = Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpSGreaterThan, resultExponent, ConstantU32(state, 0u)), test(spv::OpSLessThan, resultExponent, ConstantU32(state, 0xffu)));
+    const auto approximate = DeviceReciprocal(state, value);
+    return Select(state, f32, Binary(state, spv::OpLogicalAnd, boolean, normalInput, normalResult), Unary(state, spv::OpBitcast, f32, exactBits), approximate);
+}
+
+}
+
+void DefineReciprocalCorrectionFunction(SpirvEmitterState& state) {
+    bool used = false;
+    for (const IrBlock* block : state.program.BlockOrder()) {
+        for (const IrValue* inst : block->Instructions()) used = used || inst->Opcode() == IrOpcode::FPRecip32 || inst->Opcode() == IrOpcode::FPRecipIFlag32;
+    }
+    if (!used || !ExactReciprocal()) return;
+    const auto u32 = TypeU32(state);
+    state.reciprocalCorrectionFunction = state.module.AllocateId();
+    state.module.AddName(state.reciprocalCorrectionFunction, "rcp_f32_correction");
+    state.module.AddFunction(spv::OpFunction, u32, state.reciprocalCorrectionFunction, spv::FunctionControlDontInlineMask, state.module.Type(spv::OpTypeFunction, u32, u32));
+    const auto mantissa = state.module.AllocateId();
+    state.module.AddFunction(spv::OpFunctionParameter, u32, mantissa);
+    EmitLabel(state, state.module.AllocateId());
+    state.module.AddFunction(spv::OpReturnValue, ReciprocalCorrection(state, mantissa));
+    state.module.AddFunction(spv::OpFunctionEnd);
+}
+
+std::uint32_t EmitFPRecip32(SpirvEmitterState& state, std::uint32_t arg0) {
+    if (!ExactReciprocal()) return DeviceReciprocal(state, arg0);
+    if (state.reciprocalCorrectionFunction == 0u) FailEmit("v_rcp_f32 correction function was not defined before function emission");
+    return HardwareReciprocal(state, arg0);
+}
+
+std::uint32_t EmitFPRecipIFlag32(SpirvEmitterState& state, std::uint32_t arg0) {
+    if (!ExactReciprocal()) return DeviceReciprocal(state, arg0);
+    if (state.reciprocalCorrectionFunction == 0u) FailEmit("v_rcp_iflag_f32 correction function was not defined before function emission");
+    return HardwareReciprocal(state, arg0);
+}
+
+}
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp
index 55aa8b12a7..96ddd6f796 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp
@@ -280,7 +280,13 @@ std::vector<std::uint32_t> SpirvEmitter::Emit(const IrProgram& program, const Sh
     state.waveLdsMemoryBarriers = target.waveLdsMemoryBarriers;
     state.float32DenormPreserve = target.float32DenormPreserve;
     state.fusedExactArithmetic = target.fusedExactArithmetic;
+    state.deviceScopeLdsMemoryBarriers = target.deviceScopeLdsMemoryBarriers;
     state.hostSubgroupSize = target.subgroupSize;
+    if (target.largePixelFunctionLdsBuffer && program.Resources().stage == IrShaderStage::Pixel && state.requirements.functionLds && state.requirements.functionLdsDwords > target.pixelFunctionStorageDwords) {
+        state.pixelFunctionLdsBuffer = true;
+        state.requirements.subgroupLocalInvocationId = true;
+        state.requirements.subgroupBallot = true;
+    }
     if (state.requirements.ldsLock && LdsInDeviceMemory(state) && std::find(target.supportedCapabilities.begin(), target.supportedCapabilities.end(), static_cast<std::uint32_t>(spv::CapabilityInt64Atomics)) != target.supportedCapabilities.end()) {
         state.requirements.ldsLock = false;
         state.requirements.ldsBufferInt64Atomics = true;
@@ -319,7 +325,10 @@ std::vector<std::uint32_t> SpirvEmitter::Emit(const IrProgram& program, const Sh
     EmitModuleHeader(state, bindings);
     EmitProgram(state);
     state.module.EmitEntryPoint(ExecutionModelForStage(state.program.Resources().stage), state.mainFunc, "main", state.interfaceVariables);
-    if (info != nullptr) info->fullSubgroups = state.spannedWave;
+    if (info != nullptr) {
+        info->fullSubgroups = state.spannedWave;
+        info->functionLdsBuffer = state.pixelFunctionLdsBuffer;
+    }
     return state.module.Finalize();
 }
 
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp
index 0134281e44..60c9ac8779 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp
@@ -90,6 +90,7 @@ void EmitReturnTerminator(SpirvValueEmitContext& ctx) {
             RecordBdaFaultWords(state, ConstantU32(state, static_cast<std::uint32_t>(hash)), ConstantU32(state, static_cast<std::uint32_t>(hash >> 32u)), ConstantU32(state, state.loopGuardLimit), EmitBinaryU32(state, spv::OpISub, pc, ConstantU32(state, 1u)), BdaAbi::FaultReason::LoopLimit);
         });
     }
+    FlushColorTargetMerge(state);
     if (OrderedPixelShader(state)) {
         state.module.AddFunction(spv::OpEndInvocationInterlockEXT);
     }
@@ -308,6 +309,7 @@ void EmitDirectInstruction(SpirvValueEmitContext& ctx, const IrValue& inst) {
         case IrOpcode::Reference: return Invoke(EmitReference, ctx, inst);
         case IrOpcode::ReferenceU32: return Invoke(EmitReferenceU32, ctx, inst);
         case IrOpcode::UnlinkedCall: return Invoke(EmitUnlinkedCall, ctx, inst);
+        case IrOpcode::WindowLaneGuard: return Invoke(EmitWindowLaneGuard, ctx, inst);
         case IrOpcode::GetUserData: return Invoke(EmitGetUserData, ctx, inst);
         case IrOpcode::GetShaderBase: return Invoke(EmitGetShaderBase, ctx, inst);
         case IrOpcode::ShaderClock: return Invoke(EmitShaderClock, ctx, inst);
@@ -921,6 +923,15 @@ void EmitUnlinkedCall(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint
     StopBdaInvocationIf(state, ConstantBool(state, true));
 }
 
+void EmitWindowLaneGuard(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint32_t index, std::uint32_t value, std::uint32_t current, std::uint32_t slot, std::uint32_t lane) {
+    auto& state = ctx.state;
+    if (state.faultBufferVariable == 0) ctx.Fail(inst, "checks a spilled lane without a fault buffer");
+    const auto boolean = TypeBool(state);
+    const auto ownLane = Binary(state, spv::OpIEqual, boolean, EmitSubgroupLocalInvocationId(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), lane, ConstantU32(state, state.program.WaveSize() - 1u)));
+    const auto overwritten = Binary(state, spv::OpLogicalAnd, boolean, Binary(state, spv::OpIEqual, boolean, index, slot), Binary(state, spv::OpINotEqual, boolean, value, current));
+    EmitIfCondition(state, Binary(state, spv::OpLogicalAnd, boolean, ownLane, overwritten), [&] { RecordBdaFaultWords(state, slot, lane, value, ConstantU32(state, 0u), BdaAbi::FaultReason::WindowLaneSpill); });
+}
+
 void EmitControlNop(SpirvValueEmitContext& context) {
     EmitVoid(context);
 }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
index 804aeda284..cd5552084d 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
@@ -453,6 +453,10 @@ std::uint32_t QueryDimensions(SpirvValueEmitContext& ctx, const ImageEmitAccess&
     if (access.mem.imageDimension == RdnaImageDimension::Dim3D && dimension == RdnaImageDimension::Dim2D) {
         result[2] = ConstantU32(state, 1);
     }
+    const auto requested = access.mem.imageDimension;
+    if ((requested == RdnaImageDimension::Dim1D || requested == RdnaImageDimension::Dim2D || requested == RdnaImageDimension::Dim2DMsaa) && dimension != RdnaImageDimension::Dim3D) {
+        result[2] = ConstantU32(state, 0);
+    }
     if (info.multisampled == 0u) {
         result[3] = state.module.AllocateId();
         state.module.AddFunction(spv::OpImageQueryLevels, TypeU32(state), result[3], image);
@@ -558,11 +562,47 @@ void RequireConvertedUnormAccess(SpirvValueEmitContext& ctx, const ImageEmitAcce
     }
 }
 
+std::uint32_t ExpandFmaskTexel(SpirvEmitterState& state, const ImageEmitAccess& access, std::uint32_t texel) {
+    const auto resource = access.mem.resource;
+    const auto u32 = TypeU32(state);
+    const auto format = state.registrationModules
+        ? Binary(state, spv::OpBitwiseAnd, u32, Binary(state, spv::OpShiftRightLogical, u32, RuntimeImageDword(state, resource, offsetof(RuntimeAbi::ResourceMetadata, descriptor) / sizeof(std::uint32_t) + 1u), ConstantU32(state, 20u)), ConstantU32(state, 0x1ffu))
+        : state.module.SpecializationConstant(u32, PipelineSpecialization::FmaskFormatBase + resource, 0u);
+    auto layout = ConstantU32(state, 0u);
+    for (auto value = static_cast<std::uint32_t>(IrBufferFormat::Fmask8_S2_F1); value <= static_cast<std::uint32_t>(IrBufferFormat::Fmask64_S16_F8); ++value) {
+        const auto fmask = FmaskLayoutOf(static_cast<IrBufferFormat>(value));
+        if (!fmask.has_value()) continue;
+        layout = Select(state, u32, Binary(state, spv::OpIEqual, TypeBool(state), format, ConstantU32(state, value)), ConstantU32(state, fmask->sampleBits | (fmask->samples << 8u) | (fmask->fragments << 16u)), layout);
+    }
+    const auto sampleBits = Binary(state, spv::OpBitwiseAnd, u32, layout, ConstantU32(state, 0xffu));
+    const auto samples = Binary(state, spv::OpBitwiseAnd, u32, Binary(state, spv::OpShiftRightLogical, u32, layout, ConstantU32(state, 8u)), ConstantU32(state, 0xffu));
+    const auto fragments = Binary(state, spv::OpShiftRightLogical, u32, layout, ConstantU32(state, 16u));
+    const auto packed = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeExtract, u32, packed, texel, 0u);
+    auto expanded = ConstantU32(state, 0u);
+    for (std::uint32_t sample = 0; sample < 8u; ++sample) {
+        const auto field = state.module.AllocateId();
+        state.module.AddFunction(spv::OpBitFieldUExtract, u32, field, packed, Binary(state, spv::OpIMul, u32, sampleBits, ConstantU32(state, sample)), sampleBits);
+        const auto fragment = Select(state, u32, Binary(state, spv::OpUGreaterThanEqual, TypeBool(state), field, fragments), ConstantU32(state, 8u), field);
+        const auto nibble = Select(state, u32, Binary(state, spv::OpULessThan, TypeBool(state), ConstantU32(state, sample), samples), fragment, ConstantU32(state, 0u));
+        expanded = Binary(state, spv::OpBitwiseOr, u32, expanded, Binary(state, spv::OpShiftLeftLogical, u32, nibble, ConstantU32(state, sample * 4u)));
+    }
+    const std::array<std::uint32_t, 4> components{expanded, ConstantU32(state, 0u), ConstantU32(state, 0u), ConstantU32(state, 0u)};
+    std::uint32_t selected[4] = {};
+    for (std::uint32_t component = 0; component < 4u; component++) selected[component] = RuntimeSwizzledComponent(state, RuntimeImageSwizzle(state, resource, component), components);
+    const auto result = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeConstruct, TypeU32Vector(state, 4), result, selected[0], selected[1], selected[2], selected[3]);
+    return result;
+}
+
 std::uint32_t UnpackImageTexel(SpirvValueEmitContext& ctx, const ImageEmitAccess& access, std::uint32_t texel) {
     auto& state = ctx.state;
     if (access.image.srgbDecode) {
         return DecodeSrgbTexel(state, texel);
     }
+    if (access.image.conversionFormat == FmaskExpansion) {
+        return ExpandFmaskTexel(state, access, texel);
+    }
     const auto info = ImageConversionFormat(access.image);
     if (info.format == IrBufferFormat::Invalid) {
         return texel;
@@ -1093,6 +1133,9 @@ void EmitWriteOp(SpirvValueEmitContext& ctx, const ImageEmitAccess& access) {
     auto& state = ctx.state;
     const bool uintImage = access.image.numericClass == IrTextureNumericClass::Uint;
     auto condition = ctx.Arg(access.inst, 3);
+    if (access.mem.imageDimension == RdnaImageDimension::Dim2DArray && access.image.dimension == RdnaImageDimension::Dim1D) {
+        condition = Binary(state, spv::OpLogicalAnd, TypeBool(state), condition, Binary(state, spv::OpIEqual, TypeBool(state), AddressU32(ctx, access, 2u), ConstantU32(state, 0u)));
+    }
     if (VolumeSliceAddress(access) || ArraySliceAddress(access)) {
         if (access.image.mipMode == ImageMipMode::DynamicStorage) ctx.Fail(access.inst, "stores a 2D-array address to a 3D image or a 3D address to a 2D-array image with dynamic mips, which is not implemented");
         const auto image = state.module.AllocateId();
@@ -1142,13 +1185,13 @@ void EmitAtomicOp(SpirvValueEmitContext& ctx, const ImageEmitAccess& access) {
         }
         if (opcode == IrOpcode::ImageAtomicFMin32 || opcode == IrOpcode::ImageAtomicFMax32) {
             return AtomicUpdate(state, pointer, ResourceKind::Image, [&](std::uint32_t current) {
-                return AtomicFloatMinMax(state, current, value, opcode == IrOpcode::ImageAtomicFMax32);
+                return AtomicFloatMinMax(state, current, value, opcode == IrOpcode::ImageAtomicFMax32, access.mem.flushDenormals);
             });
         }
         if (opcode == IrOpcode::ImageAtomicFCmpSwap32) {
             const auto comparator = ctx.Arg(access.inst, 3);
             return AtomicUpdate(state, pointer, ResourceKind::Image, [&](std::uint32_t current) {
-                return AtomicFloatCompareSwap(state, current, value, comparator);
+                return AtomicFloatCompareSwap(state, current, value, comparator, access.mem.flushDenormals);
             });
         }
         const auto old = state.module.AllocateId();
@@ -2005,7 +2048,7 @@ void EmitImage(SpirvValueEmitContext& ctx, const IrValue& inst) {
     state.tableAccess = {};
     if (tables) {
         EmitLabel(state, invalid);
-        if (returnsValue) incoming.insert(incoming.end(), {ConstantU32CompositeZero(state, 4u), invalid});
+        if (returnsValue) incoming.insert(incoming.end(), {ZeroResult(ctx, inst), invalid});
         state.module.AddFunction(spv::OpBranch, merge);
     } else if (exits) {
         EmitLabel(state, invalid);
@@ -2022,7 +2065,7 @@ void EmitImage(SpirvValueEmitContext& ctx, const IrValue& inst) {
         EmitLabel(state, guardSkip);
         state.module.AddFunction(spv::OpBranch, guardMerge);
         EmitLabel(state, guardMerge);
-        if (returnsValue) state.module.AddFunction(spv::OpPhi, TypeId(state, inst.Type()), guardedId, resultId, merge, ConstantU32CompositeZero(state, 4u), guardSkip);
+        if (returnsValue) state.module.AddFunction(spv::OpPhi, TypeId(state, inst.Type()), guardedId, resultId, merge, ZeroResult(ctx, inst), guardSkip);
     }
     if (returnsValue) ctx.definitions.emplace(&inst, guardedId);
 }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp
index 192b60cc27..e2f95214ee 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp
@@ -70,10 +70,55 @@ bool LdsInDeviceMemory(const SpirvEmitterState& state) {
 }
 
 std::uint32_t LdsMemorySemantics(const SpirvEmitterState& state) {
-    return spv::MemorySemanticsWorkgroupMemoryMask | (LdsInDeviceMemory(state) ? spv::MemorySemanticsUniformMemoryMask : 0u);
+    return spv::MemorySemanticsWorkgroupMemoryMask | (LdsInDeviceMemory(state) || state.pixelFunctionLdsBuffer ? spv::MemorySemanticsUniformMemoryMask : 0u);
+}
+
+void EmitPixelFunctionLdsBase(SpirvEmitterState& state) {
+    if (!state.pixelFunctionLdsBuffer) return;
+    if (state.ldsBufferVariable == 0u || state.hostSubgroupSize == 0u) FailEmit("pixel function LDS buffer was not declared");
+    const auto element = [&](std::uint32_t dword) {
+        const auto pointer = state.module.AllocateId();
+        state.module.AddFunction(spv::OpAccessChain, TypeStorageBufferElementPointer(state), pointer, state.ldsBufferVariable, ConstantU32(state, 0u), ConstantU32(state, dword));
+        return pointer;
+    };
+    const auto slotVar = state.module.AllocateId();
+    state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), slotVar, spv::StorageClassFunction, ConstantU32(state, 0u));
+    const auto elected = state.module.AllocateId();
+    state.module.AddFunction(spv::OpGroupNonUniformElect, TypeBool(state), elected, ConstantU32(state, spv::ScopeSubgroup));
+    EmitIfCondition(state, elected, [&] {
+        const auto acquired = state.module.AllocateId();
+        state.module.AddFunction(spv::OpAtomicIAdd, TypeU32(state), acquired, element(0u), ConstantU32(state, spv::ScopeDevice), ConstantU32(state, spv::MemorySemanticsAcquireReleaseMask | spv::MemorySemanticsUniformMemoryMask), ConstantU32(state, 1u));
+        const auto capacity = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), capacity, element(2u));
+        const auto exhausted = state.module.AllocateId();
+        state.module.AddFunction(spv::OpUGreaterThanEqual, TypeBool(state), exhausted, acquired, capacity);
+        EmitIfCondition(state, exhausted, [&] {
+            state.module.AddFunction(spv::OpAtomicStore, element(1u), ConstantU32(state, spv::ScopeDevice), ConstantU32(state, spv::MemorySemanticsReleaseMask | spv::MemorySemanticsUniformMemoryMask), ConstantU32(state, 1u));
+        });
+        const auto claimed = state.module.AllocateId();
+        state.module.AddFunction(spv::OpSelect, TypeU32(state), claimed, exhausted, ConstantU32(state, 0u), acquired);
+        state.module.AddFunction(spv::OpStore, slotVar, claimed);
+    });
+    const auto local = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, TypeU32(state), local, slotVar);
+    const auto slot = state.module.AllocateId();
+    state.module.AddFunction(spv::OpGroupNonUniformBroadcastFirst, TypeU32(state), slot, ConstantU32(state, spv::ScopeSubgroup), local);
+    std::uint32_t lane;
+    if (state.splitSubgroup) {
+        if (state.subgroupLocalInvocationIdVariable == 0) FailEmit("pixel function LDS lane was not declared");
+        lane = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), lane, state.subgroupLocalInvocationIdVariable);
+    } else lane = EmitSubgroupLocalInvocationId(state);
+    const auto within = EmitAddU32(state, EmitBinaryU32(state, spv::OpIMul, slot, ConstantU32(state, state.hostSubgroupSize)), lane);
+    state.ldsBufferBase = EmitAddU32(state, EmitBinaryU32(state, spv::OpIMul, within, ConstantU32(state, FunctionLdsDwordLimit)), ConstantU32(state, 3u));
+}
+
+std::uint32_t LdsMemoryBarrierScope(const SpirvEmitterState& state) {
+    return state.deviceScopeLdsMemoryBarriers ? spv::ScopeDevice : spv::ScopeWorkgroup;
 }
 
 void EmitLdsBufferBase(SpirvEmitterState& state) {
+    EmitPixelFunctionLdsBase(state);
     if (!LdsInDeviceMemory(state)) {
         return;
     }
@@ -125,6 +170,12 @@ MemoryResourceAccess PrepareMemoryResourceAccess(SpirvEmitterState& state, const
     access.kind = mem.kind;
     switch (mem.kind) {
     case ResourceKind::Lds:
+        if (state.pixelFunctionLdsBuffer) {
+            if (state.ldsBufferVariable == 0u || state.ldsBufferBase == 0u) FailEmit("pixel function LDS buffer was not prepared at function entry");
+            access.objectPointer = state.ldsBufferVariable;
+            access.length = ConstantU32(state, LdsDwordCount(state));
+            return access;
+        }
         if (LdsInDeviceMemory(state)) {
             if (state.ldsBufferVariable == 0u || state.ldsBufferBase == 0u) {
                 FailEmit("device memory LDS was not prepared at function entry");
@@ -203,6 +254,9 @@ std::uint32_t GuardedElementIndex(SpirvEmitterState& state, const MemoryResource
 }
 
 std::uint32_t EmitMemoryElementPointer(SpirvEmitterState& state, const MemoryResourceAccess& access, std::uint32_t index) {
+    if (access.kind == ResourceKind::Lds && state.pixelFunctionLdsBuffer) {
+        return EmitStorageBufferElementPointer(state, access, EmitAddU32(state, state.ldsBufferBase, index), TypeStorageBufferElementPointer(state));
+    }
     if (access.kind == ResourceKind::Lds && LdsInDeviceMemory(state)) {
         return EmitStorageBufferElementPointer(state, access, EmitAddU32(state, state.ldsBufferBase, index), TypeStorageBufferElementPointer(state));
     }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp
index 946baa6068..7a5fe34450 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp
@@ -233,6 +233,27 @@ std::uint32_t StorageImageDescriptorPointer(SpirvEmitterState& state, std::uint3
     return DescriptorElementPointer(state, pointerType, variable, arrayIndex, kind, resource, "storage image descriptor array was not emitted");
 }
 
+std::uint32_t EmitStorageImageRead(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t coord, std::uint32_t sample) {
+    const auto& image = state.program.Info().images.at(resource);
+    if (image.resourceClass != ImageResourceClass::Storage || image.table != NoTable || image.mipMode == ImageMipMode::DynamicStorage || image.atomic) {
+        FailEmit("storage image read requested for an image that is not one plain storage descriptor");
+    }
+    if (std::ranges::find(state.supportedCapabilities, spv::CapabilityStorageImageReadWithoutFormat) == state.supportedCapabilities.end()) FailEmit("storage image reads without a format are unavailable on the target device");
+    state.module.EmitCapability(spv::CapabilityStorageImageReadWithoutFormat);
+    const auto imageType = ImageType(state, image);
+    const auto descriptor = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, imageType, descriptor, StorageImageDescriptorPointer(state, resource));
+    const auto texel = state.module.AllocateId();
+    const auto texelType = ImageVectorType(state, image.numericClass, 4u);
+    if (RdnaImageDimensionInfoFor(image.dimension).multisampled != 0u) {
+        if (sample == 0u) FailEmit("multisampled storage image read requires a sample");
+        state.module.AddFunction(spv::OpImageRead, texelType, texel, descriptor, coord, spv::ImageOperandsSampleMask, sample);
+    } else {
+        state.module.AddFunction(spv::OpImageRead, texelType, texel, descriptor, coord);
+    }
+    return texel;
+}
+
 void EmitStorageImageWrite(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t mipLod, std::uint32_t coord, std::uint32_t texel, std::uint32_t sample) {
     const auto& image = state.runtimeImage != nullptr ? *state.runtimeImage : state.program.Info().images.at(resource);
     if (image.resourceClass != ImageResourceClass::Storage) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp
index accb81d256..f71d15cbca 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp
@@ -552,6 +552,7 @@ void DefineDescriptors(SpirvEmitterState& state) {
             const auto& image = *selected;
             const auto name = "image_" + std::to_string(static_cast<std::uint32_t>(binding.kind));
             state.imageVariables.at(ImageBindingIndex(binding.kind)) = Define(ArrayType(ImageType(state, image)), name.c_str(), spv::StorageClassUniformConstant);
+            if (std::ranges::any_of(binding.resources, [&](std::uint32_t resource) { return state.program.Info().images.at(resource).targetMerge; })) state.module.AddAnnotation(spv::OpDecorate, state.imageVariables.at(ImageBindingIndex(binding.kind)), spv::DecorationCoherent);
             if (image.dimension == RdnaImageDimension::Dim1D || image.dimension == RdnaImageDimension::Dim1DArray) {
                 state.module.EmitCapability(image.resourceClass == ImageResourceClass::Sampled ? spv::CapabilitySampled1D : spv::CapabilityImage1D);
             }
@@ -574,6 +575,14 @@ void DefineDescriptors(SpirvEmitterState& state) {
             for (const auto variable : {state.ldsBufferVariable, state.ldsBufferU64Variable}) state.module.AddAnnotation(spv::OpDecorate, variable, spv::DecorationAliased);
         }
     }
+    if (state.pixelFunctionLdsBuffer) {
+        state.ldsBufferVariable = state.module.DefineGlobalVariable(TypePointer(state, spv::StorageClassStorageBuffer, StorageBufferBlockType(state)), spv::StorageClassStorageBuffer);
+        state.module.AddName(state.ldsBufferVariable, "pixel_function_lds");
+        state.module.AddAnnotation(spv::OpDecorate, state.ldsBufferVariable, spv::DecorationDescriptorSet, PixelFunctionLdsDescriptorSet);
+        state.module.AddAnnotation(spv::OpDecorate, state.ldsBufferVariable, spv::DecorationBinding, 0u);
+        state.module.AddAnnotation(spv::OpDecorate, state.ldsBufferVariable, spv::DecorationCoherent);
+        if (state.spirvVersion >= 0x00010400u) state.interfaceVariables.push_back(state.ldsBufferVariable);
+    }
 }
 
 }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp
index 645d3d1677..ed3215659b 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp
@@ -156,7 +156,7 @@ namespace ShaderRecompiler
     }
 
     bool OrderedPixelShader(const SpirvEmitterState& state) {
-        return state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && state.inputInfo.pixel->psOrderedPixelShader;
+        return state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && (state.inputInfo.pixel->psOrderedPixelShader || state.inputInfo.pixel->mergeMask != 0u);
     }
 
     const SpirvInputBinding* SpirvInputBindingForParameter(const SpirvEmitterState& state, std::uint32_t location) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp
index d997a174eb..78314c2247 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp
@@ -916,7 +916,7 @@ std::uint32_t Atomic32(SpirvValueEmitContext& ctx, const IrValue& inst, const Me
             const auto old = EmitAtomicOperation(ctx, inst, pointer, scope);
             if (lds) {
                 const std::uint32_t semantics = spv::MemorySemanticsAcquireReleaseMask | LdsMemorySemantics(state);
-                if (!state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, scope), ConstantU32(state, semantics));
+                if (!state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, LdsMemoryBarrierScope(state)), ConstantU32(state, semantics));
             } else {
                 EmitDeviceAtomicMemoryBarrier(state);
             }
@@ -957,6 +957,7 @@ std::uint32_t BufferAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst) {
 struct AtomicFloatBits {
     SpirvEmitterState& state;
     bool wide;
+    bool flushInputs = false;
     std::uint32_t type() const { return wide ? TypeScalarU64(state) : TypeU32(state); }
     std::uint32_t constant(std::uint64_t value) const {
         return wide ? state.module.Constant(spv::OpConstant, TypeScalarU64(state), static_cast<std::uint32_t>(value), static_cast<std::uint32_t>(value >> 32u)) : ConstantU32(state, static_cast<std::uint32_t>(value));
@@ -986,6 +987,8 @@ struct AtomicFloatBits {
         return Binary(state, spv::OpLogicalOr, TypeBool(state), same, zeros);
     }
     std::uint32_t minMax(std::uint32_t old, std::uint32_t source, bool maxValue) const {
+        old = flush(old, flushInputs);
+        source = flush(source, flushInputs);
         const auto better = test(maxValue ? spv::OpUGreaterThan : spv::OpULessThan, orderKey(source), orderKey(old));
         auto result = select(better, source, old);
         result = select(nan(old), source, result);
@@ -995,7 +998,7 @@ struct AtomicFloatBits {
         return select(signalingNan(source), op(spv::OpBitwiseOr, source, constant(quiet())), result);
     }
     std::uint32_t compareSwap(std::uint32_t old, std::uint32_t comparator, std::uint32_t desired) const {
-        return select(equal(old, comparator), desired, old);
+        return select(equal(flush(old, flushInputs), flush(comparator, flushInputs)), desired, old);
     }
     std::uint32_t increment(std::uint32_t old, std::uint32_t limit) const {
         return select(test(spv::OpUGreaterThanEqual, old, limit), constant(0u), op(spv::OpIAdd, old, constant(1u)));
@@ -1007,8 +1010,9 @@ struct AtomicFloatBits {
 };
 
 std::uint32_t BufferFloatAtomic(SpirvValueEmitContext& ctx, const IrValue& inst, bool maxValue) {
-    return EmitAtomicUpdate(ctx, inst, BufferMemory(ctx, inst), [maxValue](SpirvEmitterState& state, std::uint32_t old, std::uint32_t value) {
-        return AtomicFloatBits{state, false}.minMax(old, value, maxValue);
+    const auto& mem = BufferMemory(ctx, inst);
+    return EmitAtomicUpdate(ctx, inst, mem, [maxValue, flush = mem.flushDenormals](SpirvEmitterState& state, std::uint32_t old, std::uint32_t value) {
+        return AtomicFloatBits{state, false, flush}.minMax(old, value, maxValue);
     });
 }
 
@@ -1033,10 +1037,7 @@ std::uint32_t SharedAtomicUpdate(SpirvValueEmitContext& ctx, const IrValue& inst
     return EmitAtomicAccess(ctx, inst, mem, [&](std::uint32_t pointer) {
         const auto next = [&](std::uint32_t current) { return replacement(state, current); };
         if (InFunctionStorage(state, mem.kind)) return UpdateFunctionElement(state, pointer, next);
-        const auto old = AtomicUpdate(state, pointer, mem.kind, next);
-        const std::uint32_t semantics = spv::MemorySemanticsAcquireReleaseMask | LdsMemorySemantics(state);
-        if (!state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, spv::ScopeWorkgroup), ConstantU32(state, semantics));
-        return old;
+        return AtomicUpdate(state, pointer, mem.kind, next);
     });
 }
 
@@ -1044,8 +1045,7 @@ std::uint32_t SharedFloatMinMax(SpirvValueEmitContext& ctx, const IrValue& inst,
     const auto data = ctx.Arg(inst, 1);
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomicUpdate(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old) {
-        const AtomicFloatBits bits{state, false};
-        return bits.minMax(bits.flush(old, flush), bits.flush(data, flush), maxValue);
+        return AtomicFloatBits{state, false, flush}.minMax(old, data, maxValue);
     });
 }
 
@@ -1089,7 +1089,7 @@ std::uint32_t AddressAtomicOpcode(IrOpcode opcode) {
     }
 }
 
-std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator) {
+std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator, bool flush) {
     switch (opcode) {
     case IrOpcode::AddressAtomicSwap32:
     case IrOpcode::AddressAtomicCmpSwap32:
@@ -1110,11 +1110,11 @@ std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::u
     case IrOpcode::AddressAtomicUSubSat32:
         return AtomicUSubSat(state, old, value);
     case IrOpcode::AddressAtomicFMin32:
-        return AtomicFloatBits{state, false}.minMax(old, value, false);
+        return AtomicFloatBits{state, false, flush}.minMax(old, value, false);
     case IrOpcode::AddressAtomicFMax32:
-        return AtomicFloatBits{state, false}.minMax(old, value, true);
+        return AtomicFloatBits{state, false, flush}.minMax(old, value, true);
     case IrOpcode::AddressAtomicFCmpSwap32:
-        return AtomicFloatBits{state, false}.compareSwap(old, comparator, value);
+        return AtomicFloatBits{state, false, flush}.compareSwap(old, comparator, value);
     default:
         throw std::runtime_error("FlatAtomicNext32: opcode has no aperture lowering");
     }
@@ -1122,6 +1122,7 @@ std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::u
 
 std::uint32_t ApertureAtomic32(SpirvValueEmitContext& ctx, const IrValue& inst, ResourceKind kind, std::uint32_t address, std::uint32_t byteOffset, std::uint32_t value, std::uint32_t comparator) {
     auto& state = ctx.state;
+    const bool flush = ctx.Memory(inst).flushDenormals;
     const auto instruction = ConstantU32(state, inst.Flags<MemoryFlags>().pc);
     const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), byteOffset, ConstantU32(state, 3u)), ConstantU32(state, 0u));
     EmitIfCondition(state, unaligned, [&] { RecordBdaFault(state, address, ConstantU32(state, 4u), instruction, BdaAbi::FaultReason::Unaligned); });
@@ -1136,20 +1137,20 @@ std::uint32_t ApertureAtomic32(SpirvValueEmitContext& ctx, const IrValue& inst,
         return EmitValueOrZeroIfCondition(state, EmitMemoryElementInBounds(state, resource, index), [&] {
             const auto pointer = EmitMemoryElementPointer(state, resource, index);
             if (kind == ResourceKind::Lds) {
-                const auto update = [&]() { return AtomicUpdate(state, pointer, kind, [&](std::uint32_t current) { return FlatAtomicNext32(state, opcode, current, value, comparator); }); };
+                const auto update = [&]() { return AtomicUpdate(state, pointer, kind, [&](std::uint32_t current) { return FlatAtomicNext32(state, opcode, current, value, comparator, flush); }); };
                 return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU32(state), ConstantU32(state, 0u), update) : update();
             }
             const auto old = state.module.AllocateId();
             state.module.AddFunction(spv::OpLoad, TypeU32(state), old, pointer);
-            state.module.AddFunction(spv::OpStore, pointer, FlatAtomicNext32(state, opcode, old, value, comparator));
+            state.module.AddFunction(spv::OpStore, pointer, FlatAtomicNext32(state, opcode, old, value, comparator, flush));
             return old;
         });
     });
 }
 
-std::uint32_t FlatAtomicNext64(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator) {
+std::uint32_t FlatAtomicNext64(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator, bool flush) {
     const auto u64 = TypeScalarU64(state);
-    const AtomicFloatBits bits{state, true};
+    const AtomicFloatBits bits{state, true, flush};
     const auto winner = [&](spv::Op compare) {
         return Select(state, u64, Binary(state, compare, TypeBool(state), old, value), old, value);
     };
@@ -1193,6 +1194,7 @@ std::uint32_t FlatAtomicNext64(SpirvEmitterState& state, IrOpcode opcode, std::u
 
 std::uint32_t ApertureAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst, ResourceKind kind, std::uint32_t address, std::uint32_t byteOffset, std::uint32_t value, std::uint32_t comparator) {
     auto& state = ctx.state;
+    const bool flush = ctx.Memory(inst).flushDenormals;
     const auto instruction = ConstantU32(state, inst.Flags<MemoryFlags>().pc);
     const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), byteOffset, ConstantU32(state, 7u)), ConstantU32(state, 0u));
     EmitIfCondition(state, unaligned, [&] { RecordBdaFault(state, address, ConstantU32(state, 8u), instruction, BdaAbi::FaultReason::Unaligned); });
@@ -1207,7 +1209,7 @@ std::uint32_t ApertureAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst,
     const auto opcode = inst.Opcode();
     return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&] {
         return EmitValueOrDefaultIfCondition(state, EmitMemoryElementInBounds(state, resource, high), TypeU64(state), ConstantU64(state, 0u), [&] {
-            if (kind == ResourceKind::Lds && state.requirements.ldsBufferInt64Atomics) return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return FlatAtomicNext64(state, opcode, old, value, comparator); });
+            if (kind == ResourceKind::Lds && state.requirements.ldsBufferInt64Atomics) return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return FlatAtomicNext64(state, opcode, old, value, comparator, flush); });
             const auto update = [&]() {
                 const auto lowPointer = EmitMemoryElementPointer(state, resource, low);
                 const auto highPointer = EmitMemoryElementPointer(state, resource, high);
@@ -1217,7 +1219,7 @@ std::uint32_t ApertureAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst,
                 state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer);
                 const auto old = state.module.AllocateId();
                 state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue);
-                const auto next = Unary(state, spv::OpBitcast, TypeU64(state), FlatAtomicNext64(state, opcode, Unary(state, spv::OpBitcast, TypeScalarU64(state), old), value, comparator));
+                const auto next = Unary(state, spv::OpBitcast, TypeU64(state), FlatAtomicNext64(state, opcode, Unary(state, spv::OpBitcast, TypeScalarU64(state), old), value, comparator, flush));
                 const auto nextLow = state.module.AllocateId();
                 const auto nextHigh = state.module.AllocateId();
                 state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u);
@@ -1254,7 +1256,7 @@ std::uint32_t AddressAtomic(SpirvValueEmitContext& ctx, const IrValue& inst) {
             if (inst.Opcode() == IrOpcode::AddressAtomicUSubSat32) {
                 return AtomicUpdate(state, pointer, mem.kind, [&](std::uint32_t current) { return AtomicUSubSat(state, current, value); });
             }
-            const AtomicFloatBits bits{state, wide};
+            const AtomicFloatBits bits{state, wide, mem.flushDenormals};
             const auto update = [&](auto&& replacement) { return AtomicUpdateTyped(state, pointer, mem.kind, scalarType, replacement); };
             switch (inst.Opcode()) {
             case IrOpcode::AddressAtomicFCmpSwap32:
@@ -1439,31 +1441,31 @@ std::uint32_t SharedAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst, TR
         const auto low = EmitMemoryElementIndex(state, resource, rawIndex);
         const auto high = EmitMemoryElementIndex(state, resource, Binary(state, spv::OpIAdd, TypeU32(state), rawIndex, ConstantU32(state, 1u)));
         return EmitValueOrDefaultIfCondition(state, EmitMemoryElementInBounds(state, resource, high), TypeU64(state), ConstantU64(state, 0u), [&]() {
-            if (state.requirements.ldsBufferInt64Atomics) {
-                const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), low, ConstantU32(state, 1u)), ConstantU32(state, 0u));
-                EmitIfCondition(state, unaligned, [&] { RecordBdaFaultWords(state, Binary(state, spv::OpShiftLeftLogical, TypeU32(state), rawIndex, ConstantU32(state, 2u)), ConstantU32(state, 0u), ConstantU32(state, 8u), ConstantU32(state, inst.Flags<MemoryFlags>().pc), BdaAbi::FaultReason::Unaligned); });
-                const auto aligned = Unary(state, spv::OpLogicalNot, TypeBool(state), unaligned);
-                return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&]() { return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return replacement(state, old); }); });
-            }
-            const auto update = [&]() {
-                const auto lowPointer = EmitMemoryElementPointer(state, resource, low);
-                const auto highPointer = EmitMemoryElementPointer(state, resource, high);
-                const auto lowValue = state.module.AllocateId();
-                const auto highValue = state.module.AllocateId();
-                state.module.AddFunction(spv::OpLoad, TypeU32(state), lowValue, lowPointer);
-                state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer);
-                const auto old = state.module.AllocateId();
-                state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue);
-                const auto next = Unary(state, spv::OpBitcast, TypeU64(state), replacement(state, Unary(state, spv::OpBitcast, TypeScalarU64(state), old)));
-                const auto nextLow = state.module.AllocateId();
-                const auto nextHigh = state.module.AllocateId();
-                state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u);
-                state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextHigh, next, 1u);
-                state.module.AddFunction(spv::OpStore, lowPointer, nextLow);
-                state.module.AddFunction(spv::OpStore, highPointer, nextHigh);
-                return old;
-            };
-            return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU64(state), ConstantU64(state, 0u), update) : update();
+            const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), rawIndex, ConstantU32(state, 1u)), ConstantU32(state, 0u));
+            EmitIfCondition(state, unaligned, [&] { RecordBdaFaultWords(state, Binary(state, spv::OpShiftLeftLogical, TypeU32(state), rawIndex, ConstantU32(state, 2u)), ConstantU32(state, 0u), ConstantU32(state, 8u), ConstantU32(state, inst.Flags<MemoryFlags>().pc), BdaAbi::FaultReason::Unaligned); });
+            const auto aligned = Unary(state, spv::OpLogicalNot, TypeBool(state), unaligned);
+            return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&]() {
+                if (state.requirements.ldsBufferInt64Atomics) return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return replacement(state, old); });
+                const auto update = [&]() {
+                    const auto lowPointer = EmitMemoryElementPointer(state, resource, low);
+                    const auto highPointer = EmitMemoryElementPointer(state, resource, high);
+                    const auto lowValue = state.module.AllocateId();
+                    const auto highValue = state.module.AllocateId();
+                    state.module.AddFunction(spv::OpLoad, TypeU32(state), lowValue, lowPointer);
+                    state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer);
+                    const auto old = state.module.AllocateId();
+                    state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue);
+                    const auto next = Unary(state, spv::OpBitcast, TypeU64(state), replacement(state, Unary(state, spv::OpBitcast, TypeScalarU64(state), old)));
+                    const auto nextLow = state.module.AllocateId();
+                    const auto nextHigh = state.module.AllocateId();
+                    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u);
+                    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextHigh, next, 1u);
+                    state.module.AddFunction(spv::OpStore, lowPointer, nextLow);
+                    state.module.AddFunction(spv::OpStore, highPointer, nextHigh);
+                    return old;
+                };
+                return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU64(state), ConstantU64(state, 0u), update) : update();
+            });
         });
     });
 }
@@ -1491,8 +1493,7 @@ std::uint32_t SharedAtomic64Select(SpirvValueEmitContext& ctx, const IrValue& in
 std::uint32_t SharedFloatMinMax64(SpirvValueEmitContext& ctx, const IrValue& inst, bool maxValue) {
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomic64Binary(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old, std::uint32_t data) {
-        const AtomicFloatBits bits{state, true};
-        return bits.minMax(bits.flush(old, flush), bits.flush(data, flush), maxValue);
+        return AtomicFloatBits{state, true, flush}.minMax(old, data, maxValue);
     });
 }
 
@@ -1522,13 +1523,12 @@ std::uint32_t AtomicUSubSat(SpirvEmitterState& state, std::uint32_t old, std::ui
     return Select(state, TypeU32(state), fits, difference, ConstantU32(state, 0u));
 }
 
-std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue) {
-    return AtomicFloatBits{state, false}.minMax(old, source, maxValue);
+std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue, bool flush) {
+    return AtomicFloatBits{state, false, flush}.minMax(old, source, maxValue);
 }
 
-std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator) {
-    const AtomicFloatBits bits{state, false};
-    return bits.select(bits.equal(old, comparator), desired, old);
+std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator, bool flush) {
+    return AtomicFloatBits{state, false, flush}.compareSwap(old, comparator, desired);
 }
 
 std::uint32_t EmitReadConst(SpirvValueEmitContext& ctx, const IrValue& inst) {
@@ -1948,8 +1948,7 @@ std::uint32_t EmitSharedAtomicCmpstF32(SpirvValueEmitContext& ctx, const IrValue
     const auto source = ctx.Arg(inst, 2);
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomicUpdate(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old) {
-        const AtomicFloatBits bits{state, false};
-        return bits.select(bits.equal(bits.flush(old, flush), bits.flush(compare, flush)), source, old);
+        return AtomicFloatBits{state, false, flush}.compareSwap(old, compare, source);
     });
 }
 
@@ -2051,8 +2050,7 @@ std::uint32_t EmitSharedAtomicCmpstF64(SpirvValueEmitContext& ctx, const IrValue
     const auto source = ScalarU64Argument(ctx, inst, 2u);
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomic64(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old) {
-        const AtomicFloatBits bits{state, true};
-        return bits.select(bits.equal(bits.flush(old, flush), bits.flush(compare, flush)), source, old);
+        return AtomicFloatBits{state, true, flush}.compareSwap(old, compare, source);
     });
 }
 
@@ -2118,24 +2116,27 @@ std::uint32_t EmitBufferAtomicFCmpSwap32(SpirvValueEmitContext& ctx, const IrVal
     const auto comparator = ctx.Arg(inst, inst.ArgumentCount() - 2u);
     const auto& mem = BufferMemory(ctx, inst);
     return EmitAtomicAccess(ctx, inst, mem, [&](std::uint32_t pointer) {
-        return AtomicUpdate(ctx.state, pointer, mem.kind, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, false}.compareSwap(old, comparator, desired); });
+        return AtomicUpdate(ctx.state, pointer, mem.kind, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, false, mem.flushDenormals}.compareSwap(old, comparator, desired); });
     });
 }
 
 std::uint32_t EmitBufferAtomicFCmpSwap64(SpirvValueEmitContext& ctx, const IrValue& inst) {
     const auto desired = ScalarU64Argument(ctx, inst, 3u);
     const auto comparator = ScalarU64Argument(ctx, inst, 2u);
-    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true}.compareSwap(old, comparator, desired); });
+    const bool flush = BufferMemory(ctx, inst).flushDenormals;
+    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true, flush}.compareSwap(old, comparator, desired); });
 }
 
 std::uint32_t EmitBufferAtomicFMin64(SpirvValueEmitContext& ctx, const IrValue& inst) {
     const auto value = ScalarU64Argument(ctx, inst, 2u);
-    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true}.minMax(old, value, false); });
+    const bool flush = BufferMemory(ctx, inst).flushDenormals;
+    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true, flush}.minMax(old, value, false); });
 }
 
 std::uint32_t EmitBufferAtomicFMax64(SpirvValueEmitContext& ctx, const IrValue& inst) {
     const auto value = ScalarU64Argument(ctx, inst, 2u);
-    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true}.minMax(old, value, true); });
+    const bool flush = BufferMemory(ctx, inst).flushDenormals;
+    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true, flush}.minMax(old, value, true); });
 }
 
 std::uint32_t EmitBufferAtomicInc64(SpirvValueEmitContext& ctx, const IrValue& inst) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp
index ddde52c8e9..cab4d0b74c 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp
@@ -192,22 +192,46 @@ private:
     std::unordered_set<const IrValue*> active;
 };
 
-std::uint32_t IndexedWindowSlots(const IrProgram& program) {
+constexpr std::uint64_t MaxNarrowedSwitchCases = 4096;
+
+std::uint32_t IndexedWindowSlots(const IrProgram& program, std::uint32_t laneCount) {
     const auto window = program.Metadata().vectorWindowSize;
     WindowIndexBounds bounds;
     std::uint64_t reached = 0;
+    std::uint64_t dynamicAccesses = 0;
     for (const auto& block : program.Blocks()) {
         for (const IrValue* inst : block->Instructions()) {
             if (inst->Opcode() != IrOpcode::LoadVectorWindow && inst->Opcode() != IrOpcode::StoreVectorWindow) continue;
             const IrValue* index = inst->Argument(0)->Resolve();
             if (index->HasImmediate()) continue;
+            ++dynamicAccesses;
             const auto bound = bounds.Of(*index);
             if (bound && *bound < window / 2u) reached = std::max(reached, *bound + 1u);
         }
     }
+    if (reached == 0u || dynamicAccesses * (window - reached) * laneCount > MaxNarrowedSwitchCases) return 0u;
     return static_cast<std::uint32_t>(reached);
 }
 
+bool WritesGuestMemory(const IrProgram& program) {
+    const auto& info = program.Info();
+    const auto writtenImage = [](const ImageResource& image) { return !image.targetMerge && (image.written || image.atomic || image.atomic64); };
+    const auto writtenModes = [&](const std::vector<ImageResource>& modes) { return std::ranges::any_of(modes, writtenImage); };
+    const auto writtenBuffer = [](const BufferResource& buffer) { return buffer.written || buffer.atomic; };
+    if (info.bdaWrites || std::ranges::any_of(info.buffers, writtenBuffer) || std::ranges::any_of(info.images, writtenImage) || std::ranges::any_of(info.runtimeImageModes, writtenModes)) return true;
+    const auto& memory = program.Resources().memoryInfo;
+    for (const auto& block : program.Blocks()) {
+        for (const IrValue* inst : block->Instructions()) {
+            const auto access = SharedAccessOf(inst->Opcode());
+            if (access == SharedAccess::None || access == SharedAccess::Read) continue;
+            const auto index = inst->Flags<MemoryFlags>().index;
+            if (index >= memory.size()) FailEmit("a shared memory access has no memory metadata");
+            if (memory[index].kind == ResourceKind::Gds) return true;
+        }
+    }
+    return false;
+}
+
 }
 
 void DefineModule(SpirvEmitterState& state) {
@@ -216,7 +240,7 @@ void DefineModule(SpirvEmitterState& state) {
     DefineOutputs(state);
     DefineTessellationInterfaces(state);
     DefineDescriptors(state);
-    if (state.requirements.functionLds) {
+    if (state.requirements.functionLds && !state.pixelFunctionLdsBuffer) {
         state.ldsVariable = state.module.AllocateId();
     }
     if (state.requirements.functionScratch) {
@@ -226,7 +250,7 @@ void DefineModule(SpirvEmitterState& state) {
     }
     if (const auto window = state.program.Metadata().vectorWindowSize; window != 0u) {
         static const bool narrowWindow = std::getenv("APS5_NO_WINDOW_NARROWING") == nullptr;
-        state.vectorWindowIndexed = narrowWindow ? IndexedWindowSlots(state.program) : 0u;
+        state.vectorWindowIndexed = narrowWindow ? IndexedWindowSlots(state.program, state.laneCount) : 0u;
         for (std::uint32_t half = 0; half < state.laneCount; half++) {
             state.vectorWindowVariable.at(half) = state.module.AllocateId();
             if (state.vectorWindowIndexed == 0u) continue;
@@ -386,12 +410,22 @@ void DefineModule(SpirvEmitterState& state) {
             state.module.EmitExtension("SPV_EXT_shader_stencil_export");
             state.module.AddExecutionMode(state.mainFunc, spv::ExecutionModeStencilRefReplacingEXT);
         }
-        if (pixel.psEarlyZ && !pixel.psAlphaToCoverage && !pixel.QuadMasked()) {
+        const bool merge = pixel.mergeMask != 0u;
+        if (merge && (state.depthVariable != 0 || state.stencilRefVariable != 0 || pixel.psDepthExportEnable || pixel.psSampleMaskExportEnable || pixel.psStencilRefExportEnable || pixel.psAlphaToCoverage || pixel.QuadMasked() || (pixel.psPixelKillEnable && !pixel.psEarlyZ && pixel.mergeDepthStencilWrites))) {
+            throw std::runtime_error("a partial write of a packed color target merges inside the pixel shader after early depth and stencil tests, which a shader that kills pixels under late tests of a draw writing depth or stencil, exports depth, stencil or coverage, or runs with a quad sample mask cannot use");
+        }
+        if (merge && pixel.mergeSamples > 1u && WritesGuestMemory(state.program)) {
+            throw std::runtime_error("a partial write of a multisampled packed color target runs the pixel shader once per sample, which a shader that writes guest memory (stores, atomics or GDS) cannot use: each covered sample would repeat its writes");
+        }
+        if (merge && !pixel.psEarlyZ && pixel.mergeDepthStencilTests && WritesGuestMemory(state.program)) {
+            throw std::runtime_error("a partial write of a packed color target merges inside the pixel shader after early depth and stencil tests, which a shader that writes guest memory (stores, atomics or GDS) under late tests cannot use: the pixels the tests reject would still write it");
+        }
+        if ((pixel.psEarlyZ && !pixel.psAlphaToCoverage && !pixel.QuadMasked()) || merge) {
             state.module.AddExecutionMode(state.mainFunc, spv::ExecutionModeEarlyFragmentTests);
         }
-        if (pixel.psOrderedPixelShader) {
+        if (pixel.psOrderedPixelShader || merge) {
             if (std::find(state.supportedCapabilities.begin(), state.supportedCapabilities.end(), static_cast<std::uint32_t>(spv::CapabilityFragmentShaderPixelInterlockEXT)) == state.supportedCapabilities.end()) {
-                throw std::runtime_error("a primitive-ordered pixel shader needs the fragmentShaderPixelInterlock feature, which the device lacks");
+                throw std::runtime_error(merge ? "a partial write of a packed color target needs the fragmentShaderPixelInterlock feature, which the device lacks" : "a primitive-ordered pixel shader needs the fragmentShaderPixelInterlock feature, which the device lacks");
             }
             state.module.EmitCapability(spv::CapabilityFragmentShaderPixelInterlockEXT);
             state.module.EmitExtension("SPV_EXT_fragment_shader_interlock");
@@ -402,7 +436,7 @@ void DefineModule(SpirvEmitterState& state) {
         state.module.AddExecutionMode(state.mainFunc, spv::ExecutionModeDerivativeGroupLinearKHR);
     }
     state.module.AddName(state.mainFunc, "main");
-    if (state.requirements.functionLds) {
+    if (state.requirements.functionLds && !state.pixelFunctionLdsBuffer) {
         state.module.AddName(state.ldsVariable, "lds_dwords");
     }
     if (state.requirements.functionScratch) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp
index 4f558e43a1..e12ee79af6 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp
@@ -444,9 +444,12 @@ std::uint32_t PackExport(SpirvEmitterState& state, IrBufferFormat format, std::u
 
 std::uint32_t SelectExportPacking(SpirvEmitterState& state, std::uint32_t target, std::uint32_t color) {
     const auto packing = state.module.SpecializationConstant(TypeU32(state), PipelineSpecialization::ExportPackingBase + target, static_cast<std::uint32_t>(ColorExportPacking::None));
-    const auto packed = EmitCompareU32Constant(state, spv::OpINotEqual, packing, static_cast<std::uint32_t>(ColorExportPacking::None));
+    const auto unorm = EmitCompareU32Constant(state, spv::OpIEqual, packing, static_cast<std::uint32_t>(ColorExportPacking::Unorm10_11_11));
     const auto floating = EmitCompareU32Constant(state, spv::OpIEqual, packing, static_cast<std::uint32_t>(ColorExportPacking::Float11_11_10));
-    const auto word = Select(state, TypeU32(state), floating, PackExport(state, IrBufferFormat::Format10_11_11Float, color), PackExport(state, IrBufferFormat::Format11_11_10UNorm, color));
+    const auto small = EmitCompareU32Constant(state, spv::OpIEqual, packing, static_cast<std::uint32_t>(ColorExportPacking::Unorm4_4_4_4));
+    const auto wide = Select(state, TypeU32(state), floating, PackExport(state, IrBufferFormat::Format10_11_11Float, color), PackExport(state, IrBufferFormat::Format11_11_10UNorm, color));
+    const auto word = Select(state, TypeU32(state), small, PackExport(state, IrBufferFormat::Format4_4_4_4UNorm, color), wide);
+    const auto packed = Binary(state, spv::OpLogicalOr, TypeBool(state), Binary(state, spv::OpLogicalOr, TypeBool(state), unorm, floating), small);
     std::array<std::uint32_t, 4> components{};
     for (std::uint32_t component = 0; component < components.size(); ++component) {
         const auto unpacked = state.module.AllocateId();
@@ -458,6 +461,39 @@ std::uint32_t SelectExportPacking(SpirvEmitterState& state, std::uint32_t target
     return result;
 }
 
+struct MergeTexel {
+    std::uint32_t resource;
+    std::uint32_t coord;
+    std::uint32_t sample;
+};
+
+MergeTexel MergeTargetTexel(SpirvEmitterState& state) {
+    const auto& pixel = PixelInfo(state);
+    const auto& images = state.program.Info().images;
+    const auto image = std::ranges::find_if(images, [](const ImageResource& candidate) { return candidate.targetMerge; });
+    if (image == images.end()) FailEmit("the color target merge image was not collected");
+    if (InputVariableForKind(state, StageInputKind::FragCoord) == 0u || (pixel.mergeSamples > 1u && InputVariableForKind(state, StageInputKind::SampleId) == 0u)) FailEmit("the color target merge inputs were not declared");
+    if (state.mergeWordVariable == 0u || state.mergePendingVariable == 0u) FailEmit("the color target merge variables were not declared");
+    const auto position = [&](std::uint32_t component) { return Unary(state, spv::OpConvertFToU, TypeU32(state), Unary(state, spv::OpBitcast, TypeF32(state), EmitBuiltinU32(state, StageInputKind::FragCoord, component))); };
+    const auto x = position(0u);
+    const auto y = position(1u);
+    const auto coord = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeConstruct, TypeU32Vector(state, 2u), coord, x, y);
+    return {static_cast<std::uint32_t>(image - images.begin()), coord, pixel.mergeSamples > 1u ? EmitBuiltinU32(state, StageInputKind::SampleId, 0u) : 0u};
+}
+
+void MergeColorTarget(SpirvEmitterState& state, std::uint32_t color) {
+    const auto& pixel = PixelInfo(state);
+    const auto [resource, coord, sample] = MergeTargetTexel(state);
+    const auto stored = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), stored, EmitStorageImageRead(state, resource, coord, sample), 0u);
+    const auto word = PackExport(state, IrBufferFormat::Format4_4_4_4UNorm, color);
+    const auto kept = EmitBinaryU32(state, spv::OpBitwiseAnd, stored, ConstantU32(state, ~static_cast<std::uint32_t>(pixel.mergeMask)));
+    const auto merged = EmitOrU32(state, kept, EmitBinaryU32(state, spv::OpBitwiseAnd, word, ConstantU32(state, pixel.mergeMask)));
+    state.module.AddFunction(spv::OpStore, state.mergeWordVariable, merged);
+    state.module.AddFunction(spv::OpStore, state.mergePendingVariable, ConstantU32(state, 1u));
+}
+
 bool AlphaToCoverage(const SpirvEmitterState& state) {
     return state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && state.inputInfo.pixel->psAlphaToCoverage;
 }
@@ -772,6 +808,26 @@ std::uint32_t ConvertPositionToClipSpace(SpirvEmitterState& state, std::uint32_t
 
 }
 
+void FlushColorTargetMerge(SpirvEmitterState& state) {
+    if (state.mergePendingVariable == 0u) return;
+    const auto pending = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, TypeU32(state), pending, state.mergePendingVariable);
+    auto write = Binary(state, spv::OpINotEqual, TypeBool(state), pending, ConstantU32(state, 0u));
+    if (state.pixelValidMaskVariable != 0u) {
+        const auto valid = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), valid, state.pixelValidMaskVariable);
+        write = Binary(state, spv::OpLogicalAnd, TypeBool(state), write, Binary(state, spv::OpINotEqual, TypeBool(state), valid, ConstantU32(state, 0u)));
+    }
+    EmitIfCondition(state, write, [&] {
+        const auto [resource, coord, sample] = MergeTargetTexel(state);
+        const auto merged = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), merged, state.mergeWordVariable);
+        const auto texel = state.module.AllocateId();
+        state.module.AddFunction(spv::OpCompositeConstruct, TypeU32Vector(state, 4u), texel, merged, ConstantU32(state, 0u), ConstantU32(state, 0u), ConstantU32(state, 0u));
+        EmitStorageImageWrite(state, resource, 0u, coord, texel, sample);
+    });
+}
+
 namespace {
 
 std::uint32_t MeshArray(SpirvEmitterState& state, std::uint32_t storage, std::uint32_t type, std::uint32_t count) {
@@ -1526,12 +1582,17 @@ void EmitProgram(SpirvEmitterState& state) {
         state.pixelValidMaskVariable = state.module.AllocateId();
         state.module.AddName(state.pixelValidMaskVariable, "pixel_valid_mask_active");
     }
+    if (state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && state.inputInfo.pixel->mergeMask != 0u) {
+        state.mergeWordVariable = state.module.AllocateId();
+        state.mergePendingVariable = state.module.AllocateId();
+    }
     for (const IrBlock* block : program.BlockOrder()) {
         const auto label = state.module.AllocateId();
         state.labels.emplace(block, label);
     }
     DefineGetBdaPointer(state);
     DefineDot2F32F16Function(state);
+    DefineReciprocalCorrectionFunction(state);
     for (const IrBlock* block : program.BlockOrder()) {
         const bool needsScratch = std::any_of(block->Instructions().begin(), block->Instructions().end(), [](const IrValue* inst) {
             return inst->Opcode() == IrOpcode::SwizzleU32;
@@ -1552,7 +1613,7 @@ void EmitProgram(SpirvEmitterState& state) {
     }
     state.module.AddFunction(spv::OpFunction, TypeVoid(state), state.meshGuestFunc != 0u ? state.meshGuestFunc : state.pixelGuestFunc != 0u ? state.pixelGuestFunc : state.mainFunc, spv::FunctionControlMaskNone, TypeFunction(state));
     EmitLabel(state, state.entryLabel);
-    if (state.requirements.functionLds) {
+    if (state.requirements.functionLds && !state.pixelFunctionLdsBuffer) {
         state.module.AddFunction(spv::OpVariable, TypeU32ArrayPointer(state, spv::StorageClassFunction, LdsStorageDwords(state)), state.ldsVariable, spv::StorageClassFunction);
     }
     if (state.requirements.functionScratch) {
@@ -1574,6 +1635,10 @@ void EmitProgram(SpirvEmitterState& state) {
     if (state.pixelValidMaskVariable != 0u) {
         state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), state.pixelValidMaskVariable, spv::StorageClassFunction);
     }
+    if (state.mergePendingVariable != 0u) {
+        state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), state.mergeWordVariable, spv::StorageClassFunction);
+        state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), state.mergePendingVariable, spv::StorageClassFunction, ConstantU32(state, 0u));
+    }
     for (std::uint32_t half = 0; half < state.laneCount; half++) {
         auto& lane = half == 0u ? ctx : high;
         if (lane.scratchU32Variable != 0u) {
@@ -1670,6 +1735,7 @@ void EmitProgram(SpirvEmitterState& state) {
         if (state.quadSampleCoverage != 0u) StoreCoverage(state, ConstantI32(state, -1));
     }
     if (program.BlockOrder().empty()) {
+        FlushColorTargetMerge(state);
         if (OrderedPixelShader(state)) {
             state.module.AddFunction(spv::OpEndInvocationInterlockEXT);
         }
@@ -1957,6 +2023,10 @@ void EmitSetAttribute(SpirvValueEmitContext& ctx, const IrValue& inst) {
             value = mapped;
             if (exp.index == 0u && !uintOutput && AlphaToCoverage(state)) StoreAlphaCoverage(state, value);
             const auto mode = MrtOutputMode(state, exp);
+            if (PixelInfo(state).mergeMask != 0u && exp.index == PixelInfo(state).mergeTarget) {
+                if (uintOutput || mode == 5u || mode == 6u) FailEmit("a partial write of a packed color target cannot take an integer or 16-bit normalized export");
+                MergeColorTarget(state, value);
+            }
             if (!uintOutput && mode != 5u && mode != 6u) value = SelectExportPacking(state, exp.index, value);
         }
         if (exp.kind == ExportTargetKind::Position) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp
index 4a319c4f65..2b089a3e8f 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp
@@ -3,16 +3,59 @@
 #include <spirv-tools/optimizer.hpp>
 #include <spirv/unified1/spirv.hpp>
 #include <array>
+#include <atomic>
 #include <cstdlib>
+#include <exception>
 #include <map>
 #include <stdexcept>
 #include <string>
+#include <thread>
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <pthread.h>
+#endif
 
 namespace ShaderRecompiler {
 
 namespace {
 
 constexpr std::uint32_t ScalarReplacementLimit = 64;
+constexpr std::uintptr_t InlineOptimizerStackBytes = 256 * 1024;
+
+std::atomic<std::uint64_t> optimizerHostThreads{0};
+
+bool StackHoldsOptimizer() {
+#ifdef _WIN32
+    ULONG_PTR low = 0;
+    ULONG_PTR high = 0;
+    GetCurrentThreadStackLimits(&low, &high);
+#else
+    struct Bounds {
+        std::uintptr_t low = 0;
+        std::uintptr_t high = 0;
+        Bounds() {
+            pthread_attr_t attributes;
+            if (pthread_getattr_np(pthread_self(), &attributes) != 0) return;
+            void* base = nullptr;
+            std::size_t size = 0;
+            if (pthread_attr_getstack(&attributes, &base, &size) == 0 && base != nullptr) {
+                low = reinterpret_cast<std::uintptr_t>(base);
+                high = low + size;
+            }
+            pthread_attr_destroy(&attributes);
+        }
+    };
+    thread_local const Bounds bounds;
+    const auto low = bounds.low;
+    const auto high = bounds.high;
+#endif
+    const auto frame = reinterpret_cast<std::uintptr_t>(__builtin_frame_address(0));
+    return frame >= low && frame < high && frame - low >= InlineOptimizerStackBytes;
+}
 
 bool HasLimitedUseTypes(std::span<const std::uint32_t> spirv) {
     if (spirv.size() < 5) throw std::runtime_error("SPIRV-Tools: incomplete module header");
@@ -101,9 +144,7 @@ std::vector<std::uint32_t> CollapseBlockBallots(std::span<const std::uint32_t> s
     return collapsed;
 }
 
-}
-
-std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand, bool optimize, bool specialize) {
+std::vector<std::uint32_t> ValidateAndOptimizeSpirvInline(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand, bool optimize, bool specialize) {
     spv_target_env environment;
     const auto apiVersion = vulkanVersion & ~0xfffu;
     std::uint32_t maxSpirvVersion = 0;
@@ -222,3 +263,26 @@ std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_
 }
 
 }
+
+std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand, bool optimize, bool specialize) {
+    if (StackHoldsOptimizer()) return ValidateAndOptimizeSpirvInline(spirv, vulkanVersion, spirvVersion, allowOffsetTextureOperand, optimize, specialize);
+    std::vector<std::uint32_t> result;
+    std::exception_ptr failure;
+    std::thread host([&] {
+        try {
+            result = ValidateAndOptimizeSpirvInline(spirv, vulkanVersion, spirvVersion, allowOffsetTextureOperand, optimize, specialize);
+        } catch (...) {
+            failure = std::current_exception();
+        }
+    });
+    optimizerHostThreads.fetch_add(1, std::memory_order_relaxed);
+    host.join();
+    if (failure) std::rethrow_exception(failure);
+    return result;
+}
+
+std::uint64_t OptimizerHostThreads() {
+    return optimizerHostThreads.load(std::memory_order_relaxed);
+}
+
+}
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
index 234a832908..01fe275817 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
@@ -107,7 +107,9 @@ RuntimeDescriptor descriptor(SpirvValueEmitContext& context, const IrValue& inst
     }
     if (memory.gpuDescriptor) faultIf(context, instruction, invalid, base, 0u, BdaAbi::FaultReason::InvalidDescriptor);
     const auto stride = field(state, word1, 16u, 14u);
-    const auto present = runtime ? both(state, nonzero(state, context.Arg(*handle, 2u)), Binary(state, spv::OpLogicalOr, TypeBool(state), nonzero(state, context.Arg(*handle, 0u)), nonzero(state, field(state, word1, 0u, 16u)))) : nonzero(state, state.module.SpecializationConstant(u32, first + 2u, 0u));
+    auto baseHigh = runtime ? word1 : context.Arg(*handle, 1u);
+    if (!runtime && GcnGuestShaders()) baseHigh = Binary(state, spv::OpBitwiseAnd, u32, baseHigh, ConstantU32(state, GcnBufferWord1Mask));
+    const auto present = both(state, nonzero(state, context.Arg(*handle, 2u)), Binary(state, spv::OpLogicalOr, TypeBool(state), nonzero(state, context.Arg(*handle, 0u)), nonzero(state, field(state, baseHigh, 0u, 16u))));
     const auto valid = memory.gpuDescriptor ? both(state, Unary(state, spv::OpLogicalNot, TypeBool(state), invalid), Binary(state, spv::OpINotEqual, TypeBool(state), base, BdaConstant(state, 0u))) : present;
     return {base, context.Arg(*handle, 2u), stride, word3, both(state, nonzero(state, stride), nonzero(state, field(state, word1, 31u, 1u))), index, valid};
 }
@@ -480,7 +482,7 @@ std::uint32_t genericFormattedLoad(SpirvValueEmitContext& context, const IrValue
             const auto fromMemory = Binary(state, spv::OpUGreaterThanEqual, boolean, selectors[output], constant(4u));
             required[component] = Binary(state, spv::OpLogicalOr, boolean, required[component], both(state, fromMemory, equal(state, selected[output], constant(component))));
         }
-        required[component] = both(state, active[component], required[component]);
+        required[component] = Select(state, boolean, active[component], required[component], ConstantBool(state, false));
         const auto componentOffset = field(state, byteOffsets, component * 8u, 8u);
         const auto bytes = Select(state, u32, packed, constant(4u), Binary(state, spv::OpShiftRightLogical, u32, bits[component], constant(3u)));
         const auto offset = Binary(state, spv::OpIAdd, u32, resource.offset != 0u ? resource.offset : Binary(state, spv::OpIAdd, u32, context.Arg(instruction, 2u), constant(memory.offset)), componentOffset);
@@ -488,21 +490,23 @@ std::uint32_t genericFormattedLoad(SpirvValueEmitContext& context, const IrValue
         if (memory.gpuDescriptor) {
             const auto u64 = TypeScalarU64(state);
             const auto guest = Binary(state, spv::OpIAdd, u64, resource.base, Unary(state, spv::OpUConvert, u64, addresses[component].guest));
-            const auto overflow = both(state, active[component], Binary(state, spv::OpULessThan, boolean, guest, resource.base));
+            const auto overflow = Select(state, boolean, active[component], Binary(state, spv::OpULessThan, boolean, guest, resource.base), ConstantBool(state, false));
             EmitIfCondition(state, overflow, [&] { RecordBdaFault(state, resource.base, constant(0u), BdaInstructionPc(state, instruction), BdaAbi::FaultReason::Overflow); });
             StopBdaInvocationIf(state, overflow);
             addresses[component].guest = guest;
         }
-        inBounds = both(state, inBounds, Binary(state, spv::OpLogicalOr, boolean, Unary(state, spv::OpLogicalNot, boolean, required[component]), addresses[component].inBounds));
+        inBounds = Select(state, boolean, required[component], both(state, inBounds, addresses[component].inBounds), inBounds);
     }
     std::array<std::uint32_t, 4> values{};
     for (std::uint32_t component = 0; component < 4u; ++component) {
-        values[component] = EmitValueOrZeroIfCondition(state, both(state, inBounds, required[component]), [&] {
+        values[component] = EmitValueOrZeroIfCondition(state, Select(state, boolean, required[component], inBounds, ConstantBool(state, false)), [&] {
             const auto width = Select(state, u32, packed, constant(32u), bits[component]);
             const auto dword = equal(state, width, constant(32u));
-            const auto raw = EmitValueIfElse(state, dword, u32, [&] { return readBuffer(context, instruction, addresses[component].guest, 32u); }, [&] {
-                return EmitBdaReadBytes(context, instruction, addresses[component].guest, Binary(state, spv::OpShiftRightLogical, u32, width, constant(3u)));
-            });
+            const auto raw = memory.gpuDescriptor
+                ? EmitValueIfElse(state, dword, u32, [&] { return readBuffer(context, instruction, addresses[component].guest, 32u); }, [&] {
+                    return EmitBdaReadBytes(context, instruction, addresses[component].guest, Binary(state, spv::OpShiftRightLogical, u32, width, constant(3u)));
+                })
+                : Binary(state, spv::OpShiftRightLogical, u32, readBuffer(context, instruction, addresses[component].guest, 32u), Select(state, u32, dword, constant(0u), Binary(state, spv::OpShiftLeftLogical, u32, EmitAndConstant(state, addresses[component].guest, 3u), constant(3u))));
             const auto bitOffset = Select(state, u32, packed, field(state, bitOffsets, component * 8u, 8u), constant(0u));
             const auto unsignedField = EmitBitFieldUExtract(state, raw, bitOffset, bits[component]);
             const auto signedField = state.module.AllocateId();
@@ -574,15 +578,15 @@ std::uint32_t formatSwitch(SpirvValueEmitContext& context, const IrValue& instru
     const auto& memory = context.Memory(instruction);
     const auto format = field(state, resource.word3, 12u, 7u);
     constexpr std::uint32_t count = static_cast<std::uint32_t>(IrBufferFormat::Format32_32_32_32Float);
-    if (!store && memory.gpuDescriptor) {
+    if (!store) {
         const auto type = components == 1u ? TypeU32(state) : TypeU32Composite(state, components);
         const auto zero = components == 1u ? ConstantU32(state, 0u) : ConstantU32CompositeZero(state, components);
         const auto unsupported = Binary(state, spv::OpLogicalOr, TypeBool(state), equal(state, format, ConstantU32(state, 0u)), Binary(state, spv::OpUGreaterThan, TypeBool(state), format, ConstantU32(state, count)));
         const auto result = EmitValueIfElse(state, unsupported, type, [&] {
-            RecordBdaFault(state, resource.base, ConstantU32(state, 0u), BdaInstructionPc(state, instruction), BdaAbi::FaultReason::InvalidDescriptor);
+            if (memory.gpuDescriptor) RecordBdaFault(state, resource.base, ConstantU32(state, 0u), BdaInstructionPc(state, instruction), BdaAbi::FaultReason::InvalidDescriptor);
             return zero;
         }, [&] { return genericFormattedLoad(context, instruction, resource, components, format, count); });
-        StopBdaInvocationIf(state, unsupported);
+        if (memory.gpuDescriptor) StopBdaInvocationIf(state, unsupported);
         return result;
     }
     const auto merge = state.module.AllocateId();
@@ -666,8 +670,7 @@ std::uint32_t formattedCall(SpirvValueEmitContext& context, const IrValue& instr
             const auto word1 = state.module.SpecializationConstant(u32, first, 0u);
             const auto stride = field(state, word1, 16u, 14u);
             const auto swizzle = both(state, nonzero(state, stride), nonzero(state, field(state, word1, 31u, 1u)));
-            const auto valid = nonzero(state, state.module.SpecializationConstant(u32, first + 2u, 0u));
-            shared = {ConstantU32(state, 0u), parameters[3], stride, state.module.SpecializationConstant(u32, first + 1u, 0u), swizzle, parameters[0], valid, parameters[1], parameters[2]};
+            shared = {ConstantU32(state, 0u), parameters[3], stride, state.module.SpecializationConstant(u32, first + 1u, 0u), swizzle, parameters[0], nonzero(state, parameters[8]), parameters[1], parameters[2]};
         }
         const auto value = formatSwitch(context, instruction, shared, components, store, store ? parameters[9] : 0u);
         if (store) state.module.AddFunction(spv::OpReturn);
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp
index d77a063d72..a47da0f9dd 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp
@@ -580,6 +580,8 @@ public:
         vectorTypes.Reset(bound);
         removed.Reset(bound);
         aliases.Reset(bound);
+        composites.Reset(bound);
+        privateTables.Reset(bound);
         for (std::size_t cursor = 5; cursor < words.size();) {
             const auto count = words[cursor] >> 16u;
             if (count == 0u || count > words.size() - cursor) throw std::runtime_error("truncated prepared SPIR-V instruction");
@@ -596,8 +598,30 @@ public:
             if (op == spv::OpConstant && types.contains(instruction.at(1)) && types.at(instruction[1]).width <= 32u) values.emplace(instruction.at(2), instruction.at(3));
             if (op == spv::OpConstantTrue || op == spv::OpConstantFalse) values.emplace(instruction.at(2), op == spv::OpConstantTrue ? 1u : 0u);
             if ((op == spv::OpConstant || op == spv::OpConstantTrue || op == spv::OpConstantFalse) && values.contains(instruction.at(2))) canonical.emplace(std::pair{instruction.at(1), values.at(instruction[2])}, instruction[2]);
+            if (op == spv::OpConstantComposite && instruction.size() >= 3u) composites.emplace(instruction.at(2), std::vector<std::uint32_t>(instruction.begin() + 3, instruction.end()));
+            if (op == spv::OpVariable && instruction.size() == 5u && (instruction[3] == spv::StorageClassPrivate || instruction[3] == spv::StorageClassFunction) && composites.contains(instruction[4])) privateTables.emplace(instruction.at(2), instruction[4]);
             cursor += count;
         }
+        IdTable<std::uint32_t> tablePointers;
+        tablePointers.Reset(bound);
+        for (const auto& instruction : instructions) {
+            const auto op = Opcode(instruction);
+            if ((op == spv::OpAccessChain || op == spv::OpInBoundsAccessChain) && instruction.size() == 5u && privateTables.contains(instruction[3])) {
+                tablePointers.emplace(instruction[2], instruction[3]);
+                continue;
+            }
+            if (op == spv::OpLoad && instruction.size() == 4u && tablePointers.contains(instruction[3])) continue;
+            if (op == spv::OpVariable || op == spv::OpEntryPoint) continue;
+            std::uint32_t switchLiteralWords = 1u;
+            if (op == spv::OpSwitch && instruction.size() > 1u) {
+                const auto* selectorType = resultTypes.find(instruction[1]);
+                if (selectorType != nullptr && types.contains(*selectorType) && types.at(*selectorType).width == 64u) switchLiteralWords = 2u;
+            }
+            VisitIdOperands(instruction, switchLiteralWords, [&](std::size_t index) {
+                privateTables.erase(instruction[index]);
+                if (const auto* table = tablePointers.find(instruction[index])) privateTables.erase(*table);
+            });
+        }
     }
 
     std::vector<std::uint32_t> Run() {
@@ -637,11 +661,17 @@ private:
         return found != nullptr && *found == type;
     }
 
-    std::optional<std::uint32_t> evaluate(const Instruction& instruction) const {
+    std::optional<std::uint32_t> evaluate(const Instruction& instruction, const IdTable<std::pair<std::uint32_t, std::uint32_t>>& constPointers) const {
         const auto op = Opcode(instruction);
         if (instruction.size() < 4u) return std::nullopt;
         const auto* type = types.find(instruction[1]);
         if (type == nullptr || type->width > 32u) return std::nullopt;
+        if (op == spv::OpLoad && instruction.size() == 4u) {
+            const auto* pointer = constPointers.find(instruction[3]);
+            if (pointer == nullptr) return std::nullopt;
+            const auto& elements = composites.at(pointer->first);
+            return pointer->second < elements.size() ? value(elements[pointer->second]) : std::nullopt;
+        }
         const auto left = value(instruction[3]);
         if (!left) return std::nullopt;
         if (op == spv::OpCopyObject) return left;
@@ -690,16 +720,42 @@ private:
         extracts.Reset(bound);
         IdTable<std::uint32_t> bitcasts;
         bitcasts.Reset(bound);
+        IdTable<std::pair<std::uint32_t, std::uint32_t>> constPointers;
+        constPointers.Reset(bound);
         for (auto& instruction : instructions) {
             if (instruction.empty()) continue;
             auto op = Opcode(instruction);
             if (op == spv::OpFunction) function = true;
             if (op == spv::OpFunctionEnd) function = false;
             if (!function) continue;
+            if ((op == spv::OpAccessChain || op == spv::OpInBoundsAccessChain) && instruction.size() == 5u && privateTables.contains(instruction[3])) {
+                if (const auto index = value(instruction[4])) constPointers.emplace(instruction[2], std::pair{privateTables.at(instruction[3]), *index});
+            }
             if (op == spv::OpSelect && instruction.size() == 6u) {
                 if (const auto condition = value(instruction[3])) {
                     instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[*condition != 0u ? 4u : 5u]});
                     changed = true;
+                } else if (instruction[4] == instruction[5]) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[4]});
+                    changed = true;
+                }
+            }
+            if (op == spv::OpLogicalAnd && instruction.size() == 5u) {
+                if (const auto left = value(instruction[3]); left && *left != 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[4]});
+                    changed = true;
+                } else if (const auto right = value(instruction[4]); right && *right != 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[3]});
+                    changed = true;
+                }
+            }
+            if (op == spv::OpLogicalOr && instruction.size() == 5u) {
+                if (const auto left = value(instruction[3]); left && *left == 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[4]});
+                    changed = true;
+                } else if (const auto right = value(instruction[4]); right && *right == 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[3]});
+                    changed = true;
                 }
             }
             if (op == spv::OpVectorExtractDynamic && instruction.size() == 5u) {
@@ -742,7 +798,7 @@ private:
                 }
             }
             if (op == spv::OpCopyObject && values.contains(instruction.at(2))) continue;
-            const auto result = evaluate(instruction);
+            const auto result = evaluate(instruction, constPointers);
             if (!result) continue;
             const auto type = types.at(instruction[1]);
             const auto bits = type.width == 32u ? *result : *result & ((1u << type.width) - 1u);
@@ -1092,6 +1148,8 @@ private:
     IdSet vectorTypes;
     IdSet removed;
     IdTable<std::uint32_t> aliases;
+    IdTable<std::vector<std::uint32_t>> composites;
+    IdTable<std::uint32_t> privateTables;
     std::map<std::pair<std::uint32_t, std::uint32_t>, std::uint32_t> canonical;
 };
 
diff --git a/core/shader/recompiler/StencilReplay.cpp b/core/shader/recompiler/StencilReplay.cpp
index fae2057358..b72ffe0e3e 100644
--- a/core/shader/recompiler/StencilReplay.cpp
+++ b/core/shader/recompiler/StencilReplay.cpp
@@ -108,7 +108,7 @@ public:
         }
         for (const auto& info : program.Metadata().blockInfo) {
             if (info.terminator.kind != TerminatorKind::ConditionalBranch) continue;
-            if (!control(info)) return false;
+            if (!controlProven(info)) return false;
         }
         for (const auto& [value, mask] : ownMasks) if (helperObserved(value)) return false;
         for (const auto* block : program.BlockOrder()) {
@@ -132,6 +132,60 @@ private:
         if (value && !value->HasImmediate()) restricted.insert(value);
     }
 
+    void restrictSource(const IrValue* value, unsigned depth) {
+        value = value->Resolve();
+        if (depth > 64u || value->HasImmediate()) return;
+        restrict(value);
+        for (const auto* argument : value->Arguments()) restrictSource(argument, depth + 1u);
+    }
+
+    bool execEquivalent(const IrValue* left, const IrValue* right) const {
+        const IrBlock* block = left->Parent();
+        if (block == nullptr || block != right->Parent()) return false;
+        bool between = false;
+        for (const IrValue* instruction : block->Instructions()) {
+            if (instruction == left || instruction == right) {
+                if (between) return true;
+                between = true;
+                continue;
+            }
+            if (!between) continue;
+            switch (instruction->Opcode()) {
+                case IrOpcode::SetExec:
+                case IrOpcode::SetExecLo:
+                case IrOpcode::SetExecHi:
+                case IrOpcode::Discard:
+                case IrOpcode::Sendmsg:
+                case IrOpcode::SetThreadBitScalarRegister:
+                case IrOpcode::SetScalarMaskTag:
+                    return false;
+                default:
+                    break;
+            }
+        }
+        return false;
+    }
+
+    bool equivalentSource(const IrValue* left, const IrValue* right, unsigned depth) {
+        if (depth > 64u) return false;
+        left = left->Resolve();
+        right = right->Resolve();
+        if (left == right || sameValue(left, right)) return true;
+        if (left->HasImmediate() || right->HasImmediate()) return left->HasImmediate() && right->HasImmediate() && left->Type() == right->Type() && left->ImmediateU64() == right->ImmediateU64();
+        if (left->Opcode() != right->Opcode() || left->ArgumentCount() != right->ArgumentCount()) return false;
+        if (left->Opcode() == IrOpcode::Ballot && !execEquivalent(left, right)) return false;
+        for (std::size_t index = 0; index < left->ArgumentCount(); ++index) if (!equivalentSource(left->Argument(index), right->Argument(index), depth + 1u)) return false;
+        return true;
+    }
+
+    bool equivalentWqm(const IrValue* left, const IrValue* right, unsigned depth) {
+        left = left->Resolve();
+        right = right->Resolve();
+        if (left == right) return true;
+        if (left->Opcode() != IrOpcode::WqmU64 || right->Opcode() != IrOpcode::WqmU64 || left->ArgumentCount() != 1u || right->ArgumentCount() != 1u) return false;
+        return equivalentSource(left->Argument(0), right->Argument(0), depth + 1u);
+    }
+
     std::optional<ReplayMask> own(const IrValue* value) {
         value = value->Resolve();
         if (value->Opcode() != IrOpcode::INotEqual32) return std::nullopt;
@@ -189,7 +243,8 @@ private:
             valid = (maskStable(pair(0u, 0u), depth + 1u) && maskStable(pair(1u, 1u), depth + 1u)) || (waveSize != 32u && maskStable(pair(0u, 1u), depth + 1u) && maskStable(pair(1u, 0u), depth + 1u));
         } else if (mask.low->Opcode() == IrOpcode::CompositeExtractU64 && mask.low->ArgumentCount() == 2u && Immediate(mask.low->Argument(1), 0u)) {
             const IrValue* wqm = mask.low->Argument(0)->Resolve();
-            const bool paired = waveSize == 32u || (mask.high->Opcode() == IrOpcode::CompositeExtractU64 && mask.high->ArgumentCount() == 2u && mask.high->Argument(0)->Resolve() == wqm && Immediate(mask.high->Argument(1), 1u));
+            const IrValue* highWqm = mask.high->Opcode() == IrOpcode::CompositeExtractU64 && mask.high->ArgumentCount() == 2u ? mask.high->Argument(0)->Resolve() : nullptr;
+            const bool paired = waveSize == 32u || (highWqm != nullptr && Immediate(mask.high->Argument(1), 1u) && equivalentWqm(wqm, highWqm, depth));
             if (paired && wqm->Opcode() == IrOpcode::WqmU64 && wqm->ArgumentCount() == 1u) {
                 const IrValue* source = wqm->Argument(0)->Resolve();
                 valid = source->Opcode() == IrOpcode::CompositeConstructU64 && source->ArgumentCount() == 2u && maskStable(ReplayMask{source->Argument(0)->Resolve(), source->Argument(1)->Resolve()}, depth + 1u);
@@ -197,7 +252,11 @@ private:
                     const auto provenance = helpers(ReplayMask{source->Argument(0)->Resolve(), source->Argument(1)->Resolve()}, depth + 1u);
                     valid = provenance == HelperMask::RealOnly || provenance == HelperMask::QuadStable;
                 }
-                if (valid) { restrict(wqm); restrict(source); }
+                if (valid) {
+                    restrict(wqm);
+                    restrict(source);
+                    if (highWqm != wqm) restrictSource(highWqm, 0u);
+                }
             }
         } else if (mask.low->IsPhi() && mask.low->ArgumentCount() != 0u && mask.low->ArgumentCount() == mask.low->PhiBlockCount() && (waveSize == 32u || (mask.high->IsPhi() && mask.high->Parent() == mask.low->Parent() && mask.high->ArgumentCount() == mask.high->PhiBlockCount()))) {
             valid = true;
@@ -270,6 +329,7 @@ private:
             if (lowBallot && highBallot) {
                 const auto low = onHelper(lowBallot->Argument(0), depth + 1u), high = onHelper(highBallot->Argument(0), depth + 1u);
                 if (low && high && *low == 0u && *high == 0u) result = HelperMask::RealOnly;
+                else if (Boolean(lowBallot->Argument(0), true) && Boolean(highBallot->Argument(0), true)) result = HelperMask::QuadStable;
             } else if (mask.low->Opcode() == IrOpcode::BitwiseAnd32 && (waveSize == 32u || mask.high->Opcode() == IrOpcode::BitwiseAnd32)) {
                 const auto pair = [&](unsigned low, unsigned high) { return ReplayMask{mask.low->Argument(low)->Resolve(), waveSize == 32u ? mask.low->Argument(low)->Resolve() : mask.high->Argument(high)->Resolve()}; };
                 const auto combine = [&](unsigned firstHigh, unsigned secondHigh) {
@@ -287,7 +347,8 @@ private:
                 }
             } else if (mask.low->Opcode() == IrOpcode::CompositeExtractU64 && mask.low->ArgumentCount() == 2u && Immediate(mask.low->Argument(1), 0u)) {
                 const IrValue* wqm = mask.low->Argument(0)->Resolve();
-                const bool paired = waveSize == 32u || (mask.high->Opcode() == IrOpcode::CompositeExtractU64 && mask.high->ArgumentCount() == 2u && mask.high->Argument(0)->Resolve() == wqm && Immediate(mask.high->Argument(1), 1u));
+                const IrValue* highWqm = mask.high->Opcode() == IrOpcode::CompositeExtractU64 && mask.high->ArgumentCount() == 2u ? mask.high->Argument(0)->Resolve() : nullptr;
+                const bool paired = waveSize == 32u || (highWqm != nullptr && Immediate(mask.high->Argument(1), 1u) && equivalentWqm(wqm, highWqm, depth));
                 if (paired && wqm->Opcode() == IrOpcode::WqmU64 && wqm->ArgumentCount() == 1u) {
                     const IrValue* source = wqm->Argument(0)->Resolve();
                     if (source->Opcode() == IrOpcode::CompositeConstructU64 && source->ArgumentCount() == 2u) {
@@ -432,24 +493,88 @@ private:
         return left == right || (left->HasImmediate() && right->HasImmediate() && left->Type() == IrType::U32 && right->Type() == IrType::U32 && left->ImmediateU32() == right->ImmediateU32());
     }
 
-    bool inactiveEquals(const IrValue* value, const IrValue* other, const IrValue* predicate, unsigned depth = 0) {
+    bool inactiveEquals(const IrValue* value, const IrValue* other, const IrValue* predicate, const std::set<const IrBlock*>& region, unsigned depth = 0) {
         if (depth > 32u) return false;
         value = value->Resolve();
         if (sameValue(value, other)) return true;
-        if ((value->Opcode() == IrOpcode::SelectU32 || value->Opcode() == IrOpcode::SelectF32 || value->Opcode() == IrOpcode::SelectU1) && value->ArgumentCount() == 3u && (value->Argument(0)->Resolve() == predicate->Resolve() || GuardImplies(program, value->Argument(0), predicate))) return inactiveEquals(value->Argument(2), other, predicate, depth + 1u);
+        if ((value->Opcode() == IrOpcode::SelectU32 || value->Opcode() == IrOpcode::SelectF32 || value->Opcode() == IrOpcode::SelectU1) && value->ArgumentCount() == 3u && (value->Argument(0)->Resolve() == predicate->Resolve() || GuardImplies(program, value->Argument(0), predicate))) return inactiveEquals(value->Argument(2), other, predicate, region, depth + 1u);
+        if (value->IsPhi() && region.contains(value->Parent()) && value->ArgumentCount() != 0u && value->ArgumentCount() == value->PhiBlockCount()) {
+            return std::all_of(value->Arguments().begin(), value->Arguments().end(), [&](const IrValue* argument) { return inactiveEquals(argument, other, predicate, region, depth + 1u); });
+        }
         return false;
     }
 
-    bool quadObserved(const IrValue* value) const {
+    bool explicitLodSample(const IrValue* value) const {
+        if (value->Opcode() == IrOpcode::ImageSampleExplicitLod) return true;
+        if (value->Opcode() != IrOpcode::ImageSampleRaw && value->Opcode() != IrOpcode::ImageGatherRaw) return false;
+        const auto index = value->Flags<MemoryFlags>().index;
+        return index < program.Resources().memoryInfo.size() && ImageSampleExplicitLod(program.Resources().memoryInfo[index].imageSampleFlags, program.Resources().stage);
+    }
+
+    bool ownBitShifted(const IrValue* user, std::size_t operand, std::vector<const IrValue*>& terminals) const {
+        if (user->Opcode() != IrOpcode::ShiftRightLogical32 || user->ArgumentCount() != 2u || operand != 0u) return false;
+        const IrValue* amount = user->Argument(1)->Resolve();
+        if (amount->Opcode() != IrOpcode::BitwiseAnd32) return false;
+        const IrValue* lane = Other(amount, 31u);
+        if (lane == nullptr || lane->Opcode() != IrOpcode::LaneId) return false;
+        for (const auto& use : user->OperandUses()) {
+            const IrValue* isolated = use.user;
+            if (isolated->Opcode() != IrOpcode::BitwiseAnd32 || Other(isolated, 1u) != user) return false;
+            terminals.push_back(isolated);
+        }
+        return true;
+    }
+
+    bool ownBitSelected(const IrValue* user, std::size_t operand, unsigned half, std::vector<const IrValue*>& terminals) const {
+        if (user->Opcode() != IrOpcode::SelectU32 || user->ArgumentCount() != 3u || operand != half + 1u) return false;
+        const IrValue* condition = user->Argument(0)->Resolve();
+        if (condition->Opcode() != IrOpcode::ULessThan32 || condition->ArgumentCount() != 2u || condition->Argument(0)->Resolve()->Opcode() != IrOpcode::LaneId || !Immediate(condition->Argument(1), 32u)) return false;
+        for (const auto& use : user->OperandUses()) if (!ownBitShifted(use.user, use.operand, terminals)) return false;
+        return true;
+    }
+
+    bool ownBitBallot(const IrValue* ballot, std::vector<const IrValue*>& terminals) const {
+        if (ballot->Opcode() != IrOpcode::Ballot || ballot->ArgumentCount() != 1u) return false;
+        for (const auto& use : ballot->OperandUses()) {
+            const IrValue* extract = use.user;
+            if (extract->Opcode() != IrOpcode::CompositeExtractU32x4 || extract->ArgumentCount() != 2u || extract->Argument(0)->Resolve() != ballot) return false;
+            const IrValue* index = extract->Argument(1)->Resolve();
+            if (!index->HasImmediate() || index->ImmediateU32() >= (waveSize == 32u ? 1u : 2u)) return false;
+            const auto half = index->ImmediateU32();
+            for (const auto& euse : extract->OperandUses()) {
+                const IrValue* word = euse.user;
+                if (word->Opcode() == IrOpcode::BitwiseAnd32) {
+                    for (const auto& muse : word->OperandUses()) {
+                        const bool read = waveSize == 64u ? ownBitSelected(muse.user, muse.operand, half, terminals) : ownBitShifted(muse.user, muse.operand, terminals);
+                        if (!read) return false;
+                    }
+                } else {
+                    const bool read = waveSize == 64u ? ownBitSelected(word, euse.operand, half, terminals) : ownBitShifted(word, euse.operand, terminals);
+                    if (!read) return false;
+                }
+            }
+        }
+        return true;
+    }
+
+    bool quadObserved(const IrValue* value) {
         std::set<const IrValue*> visited;
         std::vector<const IrValue*> pending{value};
         while (!pending.empty()) {
             const IrValue* current = pending.back();
             pending.pop_back();
             if (!visited.insert(current).second) continue;
-            for (const auto& info : program.Metadata().blockInfo) if (info.condition && info.condition->Resolve() == current) return true;
+            for (const auto& info : program.Metadata().blockInfo) if (info.condition && info.condition->Resolve() == current && !controlProven(info)) return true;
             for (const auto& use : current->OperandUses()) {
                 const auto opcode = use.user->Opcode();
+                if (opcode == IrOpcode::Ballot) {
+                    std::vector<const IrValue*> terminals;
+                    if (ownBitBallot(use.user, terminals)) {
+                        pending.insert(pending.end(), terminals.begin(), terminals.end());
+                        continue;
+                    }
+                }
+                if (ImageOpcodeInfoOf(opcode).needsSampler && explicitLodSample(use.user)) { pending.push_back(use.user); continue; }
                 if (ImageOpcodeInfoOf(opcode).needsSampler || opcode == IrOpcode::Ballot || opcode == IrOpcode::WqmU64 || opcode == IrOpcode::ReadLane || opcode == IrOpcode::ReadFirstLane || opcode == IrOpcode::DppMoveU32 || opcode == IrOpcode::DppUpdateU32 || opcode == IrOpcode::SwizzleU32 || opcode == IrOpcode::PermuteU32 || opcode == IrOpcode::BpermuteU32 || opcode == IrOpcode::Permlane16U32 || opcode == IrOpcode::WriteLane || SharedAccessOf(opcode) != SharedAccess::None) return true;
                 if (opcode == IrOpcode::SetAttribute || opcode == IrOpcode::Reference || opcode == IrOpcode::ReferenceU32) continue;
                 pending.push_back(use.user);
@@ -472,6 +597,7 @@ private:
             }
             for (const auto& use : current->OperandUses()) {
                 const auto opcode = use.user->Opcode();
+                if (ImageOpcodeInfoOf(opcode).needsSampler && explicitLodSample(use.user)) { pending.push_back(use.user); continue; }
                 if (ImageOpcodeInfoOf(opcode).needsSampler) return true;
                 if (restricted.contains(use.user) || opcode == IrOpcode::SetAttribute || opcode == IrOpcode::Reference || opcode == IrOpcode::ReferenceU32) continue;
                 pending.push_back(use.user);
@@ -481,31 +607,58 @@ private:
     }
 
     bool optionalBody(const IrBlock* branch, const IrBlock* body, const IrBlock* merge, const IrValue* predicate) {
-        const auto& bodyInfo = program.Metadata().blockInfo[blockIndices.at(body)];
-        if (bodyInfo.terminator.kind != TerminatorKind::Branch || indices.at(bodyInfo.terminator.trueBlock) != blockIndices.at(merge)) return false;
+        if (body == merge) return false;
+        std::set<const IrBlock*> region;
+        std::vector<const IrBlock*> pending{body};
+        while (!pending.empty()) {
+            const IrBlock* block = pending.back();
+            pending.pop_back();
+            if (block == merge || !region.insert(block).second) continue;
+            if (block == branch || region.size() > 64u || program.Metadata().blockInfo[blockIndices.at(block)].terminator.kind == TerminatorKind::Return) return false;
+            for (const auto* successor : block->Successors()) pending.push_back(successor);
+        }
+        for (const auto* block : region) {
+            for (const auto* predecessor : block->Predecessors()) {
+                if (block == body ? predecessor != branch : !region.contains(predecessor)) return false;
+            }
+        }
         std::set<const IrValue*> merged;
         for (const auto* instruction : merge->Instructions()) {
             if (!instruction->IsPhi()) continue;
-            if (instruction->ArgumentCount() != 2u || instruction->PhiBlockCount() != 2u) return false;
+            if (instruction->ArgumentCount() < 2u || instruction->ArgumentCount() != instruction->PhiBlockCount()) return false;
             const IrValue* skipped = nullptr;
-            const IrValue* taken = nullptr;
-            for (std::size_t index = 0; index < 2u; ++index) {
+            std::vector<const IrValue*> taken;
+            for (std::size_t index = 0; index < instruction->PhiBlockCount(); ++index) {
                 if (instruction->PhiBlock(index) == branch) skipped = instruction->Argument(index)->Resolve();
-                if (instruction->PhiBlock(index) == body) taken = instruction->Argument(index)->Resolve();
+                else if (region.contains(instruction->PhiBlock(index))) taken.push_back(instruction->Argument(index)->Resolve());
+                else return false;
             }
-            if (!skipped || !taken || !inactiveEquals(taken, skipped, predicate) || quadObserved(instruction)) return false;
+            if (!skipped || taken.empty()) return false;
+            if (quadObserved(instruction)) return false;
+            for (const auto* value : taken) if (!inactiveEquals(value, skipped, predicate, region)) return false;
             merged.insert(instruction);
         }
-        for (const auto* instruction : body->Instructions()) {
-            if (instruction->Opcode() == IrOpcode::SetAttribute || instruction->Opcode() == IrOpcode::Discard) return false;
-            for (const auto& use : instruction->OperandUses()) {
-                if (use.user->Parent() == body || merged.contains(use.user) || use.user->Opcode() == IrOpcode::Reference || use.user->Opcode() == IrOpcode::ReferenceU32) continue;
-                return false;
+        for (const auto* block : region) {
+            for (const auto* instruction : block->Instructions()) {
+                if (instruction->Opcode() == IrOpcode::SetAttribute || instruction->Opcode() == IrOpcode::Discard) return false;
+                for (const auto& use : instruction->OperandUses()) {
+                    if (region.contains(use.user->Parent()) || merged.contains(use.user) || use.user->Opcode() == IrOpcode::Reference || use.user->Opcode() == IrOpcode::ReferenceU32) continue;
+                    return false;
+                }
             }
         }
         return !merged.empty();
     }
 
+    bool controlProven(const BlockInfo& info) {
+        if (const auto found = controlResults.find(info.id); found != controlResults.end()) return found->second;
+        if (!controlVisiting.insert(info.id).second) return false;
+        const bool result = control(info);
+        controlVisiting.erase(info.id);
+        controlResults[info.id] = result;
+        return result;
+    }
+
     bool control(const BlockInfo& info) {
         const auto* branch = program.BlockOrder()[indices.at(info.id)];
         const auto* trueBlock = program.BlockOrder()[indices.at(info.terminator.trueBlock)];
@@ -552,6 +705,8 @@ private:
     std::map<std::uint32_t, std::size_t> indices;
     std::map<const IrBlock*, std::size_t> blockIndices;
     std::vector<std::vector<const IrBlock*>> allPaths;
+    std::map<std::uint32_t, bool> controlResults;
+    std::set<std::uint32_t> controlVisiting;
 };
 
 std::optional<std::set<std::uint32_t>> Values(const IrProgram& program, const IrValue* value, std::set<const IrValue*>& visiting, unsigned depth, std::optional<unsigned> component = {}, const IrValue* active = nullptr) {
@@ -692,7 +847,7 @@ bool StencilReferenceDefinedForKeptInvocations(const IrProgram& program) {
 }
 
 bool StencilReplaySafe(const IrProgram& program) {
-    if (program.Info().sharedMemoryBytes != 0u || program.Info().bdaWrites || program.Info().usesDma || (program.Info().usesFaultBuffer && program.Resources().guardedSrtSlots.empty())) return false;
+    if (program.Info().sharedMemoryBytes != 0u || program.Info().bdaWrites || (program.Info().usesFaultBuffer && program.Resources().guardedSrtSlots.empty())) return false;
     if (program.Info().usesFaultBuffer && !FaultControlFlowAcyclic(program)) return false;
     for (const auto& input : program.Info().inputs) if (input.kind == StageInputKind::PrimitiveId) return false;
     bool masks = false;
diff --git a/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp b/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp
index 2c190b4239..21f6bc7e0e 100644
--- a/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp
+++ b/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp
@@ -36,6 +36,7 @@ struct TranslateOptions {
     bool interpolationFunctions = false;
     bool nativeFloat16 = false;
     bool float32FlushToZero = false;
+    bool float32DenormPreserve = false;
     bool gcnLegacyVertexInputs = false;
     std::optional<ShaderFloatMode> floatMode;
     ShaderStageInputInfo inputInfo;
diff --git a/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp b/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp
index a7748044c4..00da5a7db5 100644
--- a/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp
+++ b/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp
@@ -25,6 +25,7 @@ public:
     }
     void SetEntryRounding(const RoundingState& state) { setRounding(state); }
     void SetNativeFloat16(bool enabled) { nativeFloat16 = enabled; }
+    void SetFloat32DenormPreserve(bool enabled) { float32DenormPreserve = enabled; }
     void SetFloat32FlushToZero(bool enabled) { float32FlushToZero = enabled; }
     void AddBranchCondition(const BasicBlock& source, BlockInfo& info);
     void TranslateCodeTableLoad(const RdnaInstruction& instruction, const ControlFlowGraph::CodeTableLoad& table);
@@ -81,7 +82,7 @@ private:
     IrU32 flushTinyF16Conversion(IrF32 value, IrU32 bits);
     void writeF16Conversion(const RdnaOperand& operand, IrF32 value, std::initializer_list<IrValue*> sources);
     IrU32 readU32(const RdnaOperand& operand);
-    IrU32 flushF32Denormal(IrU32 bits);
+    IrU32 flushF32Denormal(IrU32 bits, std::uint32_t flushBit = 1u);
     IrF32 flushTinyProduct(IrValue* lhs, IrValue* rhs, IrValue* product, IrValue* addend = nullptr, bool afterRounding = true);
     IrU32 quietNan32(IrU32 bits);
     IrU32 quietNan16(IrU32 bits);
@@ -112,6 +113,7 @@ private:
     std::array<IrU32, 2> writeMask(const RdnaOperand& operand, IrU1 value, bool write64 = false);
     void writeCompareResult(const RdnaOperand& operand, IrU1 value);
     MemoryFlags addMemoryInfo(const MemoryInfo& memory, std::uint32_t pc);
+    bool floatAtomicFlush(IrOpcode opcode) const;
     ExportFlags addExportInfo(const RdnaInstruction& inst);
     AddressOperands readAddressOperands(const RdnaInstruction& inst, std::uint32_t firstSource);
     IrU32 getResourceDword(std::uint32_t index, std::uint32_t dword);
@@ -157,7 +159,6 @@ private:
     bool dsWrite2(const RdnaInstruction& inst);
     bool dsSrc2(const RdnaInstruction& inst, IrOpcode opcode);
     bool dsAtomic2(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue);
-    bool sharedFloatFlush(IrOpcode opcode) const;
     bool dsAtomic64(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue);
     bool dsCondxchg32(const RdnaInstruction& inst);
     bool dsAppendConsume(const RdnaInstruction& inst, IrOpcode opcode);
@@ -387,6 +388,7 @@ private:
     RdnaOpcode currentOpcode = RdnaOpcode::Unknown;
     std::uint32_t f32DenormalFlush = 0u;
     bool float32FlushToZero = false;
+    bool float32DenormPreserve = false;
     std::uint32_t currentProgramCounter = 0;
     std::uint32_t currentVectorLimit = 1;
 };
diff --git a/core/shader/recompiler/Translation/src/ConvertInstructions.cpp b/core/shader/recompiler/Translation/src/ConvertInstructions.cpp
index d14b698c77..4dfdf3ed3b 100644
--- a/core/shader/recompiler/Translation/src/ConvertInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/ConvertInstructions.cpp
@@ -215,15 +215,22 @@ void TranslationContext::vCvtPknormF32(const RdnaInstruction& inst, bool signedV
 }
 
 void TranslationContext::vCvtPkU8F32(const RdnaInstruction& inst) {
-    const IrF32 source(ir.BitCastF32(*readOperand(sourceAt(inst, 0u), IrType::U32)));
+    const IrU32 bits = flushF32Denormal(IrU32(*readOperand(sourceAt(inst, 0u), IrType::U32)));
+    const IrF32 source(ir.BitCastF32(bits.Value()));
     const IrF32 zero(ir.ConstantF32(0.0f));
     const IrU1 nan(ir.Emit(IrOpcode::FPIsNan32, IrType::U1, {&source.Value()}));
     const IrU1 low(ir.Emit(IrOpcode::FPOrdLessThanEqual32, IrType::U1, {&source.Value(), &zero.Value()}));
     const IrU1 high(ir.Emit(IrOpcode::FPOrdGreaterThanEqual32, IrType::U1, {&source.Value(), &ir.ConstantF32(255.0f)}));
-    const IrF32 rounded(ir.Emit(IrOpcode::FPRoundEven32, IrType::F32, {&source.Value()}));
+    const std::uint32_t roundMode = floatMode.has_value() ? floatMode->floatMode & 3u : 0u;
+    const IrOpcode rounding = roundMode == 1u ? IrOpcode::FPCeil32 : roundMode == 2u ? IrOpcode::FPFloor32 : roundMode == 3u ? IrOpcode::FPTrunc32 : IrOpcode::FPRoundEven32;
+    const IrF32 rounded(ir.Emit(rounding, IrType::F32, {&source.Value()}));
     const IrF32 bounded = selectF32(high, IrF32(ir.ConstantF32(255.0f)), rounded);
     const IrF32 safe = selectF32(IrU1(ir.LogicalOr(nan.Value(), low.Value())), zero, bounded);
-    const IrU32 byteValue(ir.Emit(IrOpcode::ConvertU32F32, IrType::U32, {&safe.Value()}));
+    IrU32 byteValue(ir.Emit(IrOpcode::ConvertU32F32, IrType::U32, {&safe.Value()}));
+    if (roundMode == 1u && (f32DenormalFlush & 1u) == 0u) {
+        const IrU1 positiveDenormal(ir.ULessThan(ir.ISub(bits.Value(), ir.Constant(1u)), ir.Constant(0x007fffffu)));
+        byteValue = IrU32(ir.Select(positiveDenormal.Value(), ir.Constant(1u), byteValue.Value()));
+    }
     const IrU32 index(ir.BitwiseAnd(readU32(sourceAt(inst, 1u)).Value(), ir.Constant(3u)));
     const IrU32 shift(ir.ShiftLeftLogical(index.Value(), ir.Constant(3u)));
     const IrU32 mask(ir.ShiftLeftLogical(ir.Constant(0xffu), shift.Value()));
diff --git a/core/shader/recompiler/Translation/src/InstructionTranslator.cpp b/core/shader/recompiler/Translation/src/InstructionTranslator.cpp
index 4a3849fbd6..08393a3942 100644
--- a/core/shader/recompiler/Translation/src/InstructionTranslator.cpp
+++ b/core/shader/recompiler/Translation/src/InstructionTranslator.cpp
@@ -367,6 +367,9 @@ void emitEntryPrologue(IrProgram& program, IrBlock& entryBlock, const TranslateO
         program.Metadata().pixelIteratesSamples = iterated;
         const bool offsets = options.interpolationFunctions && options.fragmentShaderBarycentricEnabled;
         const bool centers = iterated && offsets;
+        if (ps->mergeSamples > 1u && !offsets && ps->SampleLocationsOffCenter() && (loaded(PixelInput::PerspectiveCenter) || loaded(PixelInput::LinearCenter))) {
+            throw std::runtime_error("a partial write of a multisampled packed color target runs the pixel shader once per sample, and without interpolation functions and fragment shader barycentrics its centre-located barycentrics would follow the sample");
+        }
         const bool sampleOffsets = offsets && ps->SampleLocationsOffCenter();
         const auto smoothSample = sampleOffsets ? StageInputKind::BaryCoordSmoothSample : StageInputKind::BaryCoordSmooth;
         const auto linearSample = sampleOffsets ? StageInputKind::BaryCoordNoPerspectiveSample : StageInputKind::BaryCoordNoPerspective;
@@ -596,6 +599,7 @@ IrProgram InstructionTranslator::Translate(const RdnaProgram& decoded, const Con
         context.SetPixelInput(options.inputInfo.pixel, options.fragmentShaderBarycentricEnabled);
         context.SetFloatMode(options.floatMode);
         context.SetNativeFloat16(options.nativeFloat16);
+        context.SetFloat32DenormPreserve(options.float32DenormPreserve);
         context.SetFloat32FlushToZero(options.float32FlushToZero);
         context.SetEntryRounding(entryRounding.at(cfgBlock.id));
         for (std::uint32_t index = cfgBlock.instructionBegin; index < cfgBlock.instructionEnd; index++) {
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp
index 0b6d08a2c3..680ad0ab17 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp
@@ -203,7 +203,8 @@ bool TranslationContext::bufferStore(const RdnaInstruction& inst) {
 }
 
 bool TranslationContext::bufferAtomic(const RdnaInstruction& inst, IrOpcode opcode) {
-    const MemoryInfo memory = bufferMemoryInfoFromInstruction(inst);
+    MemoryInfo memory = bufferMemoryInfoFromInstruction(inst);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     IrValue* resource = getBufferResource(memory);
     const BufferAddress address = readBufferAddress(inst);
     const MemoryFlags flags = addMemoryInfo(memory, inst.programCounter);
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp
index 862c65f29b..1115a0615a 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp
@@ -179,7 +179,8 @@ bool TranslationContext::flatStore(const RdnaInstruction& inst) {
 }
 
 bool TranslationContext::flatAtomic(const RdnaInstruction& inst, IrOpcode opcode) {
-    const MemoryInfo memory = flatMemoryInfoFromInstruction(inst);
+    MemoryInfo memory = flatMemoryInfoFromInstruction(inst);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     const AddressOperands address = readAddressOperands(inst, 0u);
     const MemoryFlags flags = addMemoryInfo(memory, inst.programCounter);
     IrValue& active = ir.GetExec();
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp
index c20f9b798c..7815ee9ccd 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp
@@ -92,7 +92,8 @@ bool TranslationContext::imageAtomic(const RdnaInstruction& inst, IrOpcode opcod
     if (inst.dataBits == 64u) {
         opcode = imageAtomic64Opcode(opcode);
     }
-    const MemoryInfo memory = imageMemoryInfoFromInstruction(inst);
+    MemoryInfo memory = imageMemoryInfoFromInstruction(inst);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     IrValue* resource = getImageResource(memory);
     IrValue* address = makeImageAddress(inst, inst.source0);
     const MemoryFlags flags = addMemoryInfo(memory, inst.programCounter);
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp
index bff55b085e..75ec8a790c 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp
@@ -32,13 +32,44 @@ MemoryFlags TranslationContext::addMemoryInfo(const MemoryInfo& memory, std::uin
     return MemoryFlags{index, pc};
 }
 
+bool TranslationContext::floatAtomicFlush(IrOpcode opcode) const {
+    switch (opcode) {
+    case IrOpcode::SharedAtomicFMin32:
+    case IrOpcode::SharedAtomicFMax32:
+    case IrOpcode::SharedAtomicCmpstF32:
+    case IrOpcode::SharedAtomicFAdd32:
+    case IrOpcode::BufferAtomicFMin32:
+    case IrOpcode::BufferAtomicFMax32:
+    case IrOpcode::BufferAtomicFCmpSwap32:
+    case IrOpcode::AddressAtomicFMin32:
+    case IrOpcode::AddressAtomicFMax32:
+    case IrOpcode::AddressAtomicFCmpSwap32:
+    case IrOpcode::ImageAtomicFMin32:
+    case IrOpcode::ImageAtomicFMax32:
+    case IrOpcode::ImageAtomicFCmpSwap32:
+        return !floatMode.has_value() || ((floatMode->floatMode >> 4u) & 1u) == 0u;
+    case IrOpcode::SharedAtomicFMin64:
+    case IrOpcode::SharedAtomicFMax64:
+    case IrOpcode::SharedAtomicCmpstF64:
+    case IrOpcode::BufferAtomicFMin64:
+    case IrOpcode::BufferAtomicFMax64:
+    case IrOpcode::BufferAtomicFCmpSwap64:
+    case IrOpcode::AddressAtomicFMin64:
+    case IrOpcode::AddressAtomicFMax64:
+    case IrOpcode::AddressAtomicFCmpSwap64:
+        return floatMode.has_value() && ((floatMode->floatMode >> 6u) & 1u) == 0u;
+    default:
+        return false;
+    }
+}
+
 TranslationContext::AddressOperands TranslationContext::readAddressOperands(const RdnaInstruction& inst, std::uint32_t firstSource) {
     const ResourceKind kind = flatSegmentResourceKind(inst);
     const IrU32 low = readU32(sourceAt(inst, firstSource));
     const RdnaOperand& highOrBase = sourceAt(inst, firstSource + 1u);
     if (kind == ResourceKind::Scratch) {
         IrValue& resource = ir.Emit(IrOpcode::GetScratchResource, IrOpcodeType(IrOpcode::GetScratchResource), {});
-        IrValue& offset = highOrBase.kind != RdnaOperandKind::VectorRegister ? readU32(highOrBase).Value() : low.Value();
+        IrValue& offset = ir.IAdd(low.Value(), readU32(highOrBase).Value());
         return AddressOperands{&resource, &offset, &ir.Constant(0u)};
     }
     if (kind == ResourceKind::Global && highOrBase.kind != RdnaOperandKind::VectorRegister) {
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp
index a781713ddc..a79d94da4c 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp
@@ -32,7 +32,7 @@ MemoryInfo sharedMemoryInfoFromInstruction(const RdnaInstruction& inst) {
 
 bool TranslationContext::dsAtomic(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue) {
     MemoryInfo memory = sharedMemoryInfoFromInstruction(inst);
-    memory.flushDenormals = sharedFloatFlush(opcode);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     memory.flushDenormalResults = opcode == IrOpcode::SharedAtomicFAdd32 && (!floatMode.has_value() || ((floatMode->floatMode >> 5u) & 1u) == 0u);
     const IrU32 address = readU32(inst.source0);
     const IrU32 value = readU32(inst.source1);
@@ -213,25 +213,9 @@ bool TranslationContext::dsSrc2(const RdnaInstruction& inst, IrOpcode opcode) {
     return true;
 }
 
-bool TranslationContext::sharedFloatFlush(IrOpcode opcode) const {
-    switch (opcode) {
-    case IrOpcode::SharedAtomicFMin32:
-    case IrOpcode::SharedAtomicFMax32:
-    case IrOpcode::SharedAtomicCmpstF32:
-    case IrOpcode::SharedAtomicFAdd32:
-        return !floatMode.has_value() || ((floatMode->floatMode >> 4u) & 1u) == 0u;
-    case IrOpcode::SharedAtomicFMin64:
-    case IrOpcode::SharedAtomicFMax64:
-    case IrOpcode::SharedAtomicCmpstF64:
-        return floatMode.has_value() && ((floatMode->floatMode >> 6u) & 1u) == 0u;
-    default:
-        return false;
-    }
-}
-
 bool TranslationContext::dsAtomic2(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue) {
     MemoryInfo memory = sharedMemoryInfoFromInstruction(inst);
-    memory.flushDenormals = sharedFloatFlush(opcode);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     const IrU32 address = readU32(inst.source0);
     const IrU32 data0 = readU32(inst.source1);
     const IrU32 data1 = readU32(inst.source2);
@@ -246,7 +230,7 @@ bool TranslationContext::dsAtomic64(const RdnaInstruction& inst, IrOpcode opcode
         throw std::runtime_error("64-bit GDS atomics are not supported");
     }
     MemoryInfo memory = sharedMemoryInfoFromInstruction(inst);
-    memory.flushDenormals = sharedFloatFlush(opcode);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     const IrU32 address = readU32(inst.source0);
     const IrU64 data0 = readU64(inst.source1);
     IrValue& active = ir.GetExec();
diff --git a/core/shader/recompiler/Translation/src/RoundingMode.cpp b/core/shader/recompiler/Translation/src/RoundingMode.cpp
index 0edeca52f0..0e648acaa9 100644
--- a/core/shader/recompiler/Translation/src/RoundingMode.cpp
+++ b/core/shader/recompiler/Translation/src/RoundingMode.cpp
@@ -89,6 +89,7 @@ RoundingUse RoundingUseOf(RdnaOpcode opcode) {
     case RdnaOpcode::VCvtF32I32:
     case RdnaOpcode::VCvtF32U32:
     case RdnaOpcode::VLdexpF32:
+    case RdnaOpcode::VCvtPkU8F32:
         return {round32, RoundingUseKind::Directed32};
     case RdnaOpcode::VCvtF16F32:
     case RdnaOpcode::VCvtF16U16:
@@ -120,7 +121,6 @@ RoundingUse RoundingUseOf(RdnaOpcode opcode) {
     case RdnaOpcode::VMadmkF32:
     case RdnaOpcode::VMadakF32:
     case RdnaOpcode::VFractF32:
-    case RdnaOpcode::VCvtPkU8F32:
     case RdnaOpcode::VCvtF32F64:
     case RdnaOpcode::VDivScaleF32:
     case RdnaOpcode::VDivFmasF32:
diff --git a/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp b/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp
index f1f7de5a92..23ec115894 100644
--- a/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp
+++ b/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp
@@ -167,6 +167,12 @@ ShaderStageInputInfo BuildShaderStageInputInfo(ShaderStageKind stage, const Gues
         pixelStorage.psIteratesSamples = pixel.iteratesSamples;
         pixelStorage.psPositionLocation = pixel.positionLocation;
         pixelStorage.sampleLocations = pixel.sampleLocations;
+        if (pixel.targetMerge.mask != 0u && (pixel.targetMerge.target >= 8u || (pixel.targetMerge.samples != 1u && pixel.targetMerge.samples != 2u && pixel.targetMerge.samples != 4u && pixel.targetMerge.samples != 8u))) throw std::runtime_error("ShaderInputInfoBuilder: invalid color target merge");
+        pixelStorage.mergeTarget = pixel.targetMerge.target;
+        pixelStorage.mergeMask = pixel.targetMerge.mask;
+        pixelStorage.mergeSamples = pixel.targetMerge.samples;
+        pixelStorage.mergeDepthStencilWrites = pixel.targetMerge.depthStencilWrites;
+        pixelStorage.mergeDepthStencilTests = pixel.targetMerge.depthStencilTests;
         pixelStorage.sampleOrder = pixel.sampleOrder;
         ShaderStageInputInfo result;
         result.pixel = &pixelStorage;
diff --git a/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp b/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp
index d54715a372..ebec2355da 100644
--- a/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp
+++ b/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp
@@ -145,8 +145,8 @@ RdnaOperand TranslationContext::plainOperand(const RdnaOperand& operand) {
     return result;
 }
 
-IrU32 TranslationContext::flushF32Denormal(IrU32 bits) {
-    if ((f32DenormalFlush & 1u) == 0u) return bits;
+IrU32 TranslationContext::flushF32Denormal(IrU32 bits, std::uint32_t flushBit) {
+    if ((f32DenormalFlush & flushBit) == 0u) return bits;
     if (bits.Value().HasImmediate()) {
         const std::uint32_t value = bits.Value().ImmediateU32();
         return (value & 0x7f800000u) == 0u ? IrU32(ir.Constant(value & 0x80000000u)) : bits;
@@ -156,7 +156,7 @@ IrU32 TranslationContext::flushF32Denormal(IrU32 bits) {
 }
 
 IrF32 TranslationContext::flushTinyProduct(IrValue* lhs, IrValue* rhs, IrValue* product, IrValue* addend, bool afterRounding) {
-    if ((f32DenormalFlush & 2u) == 0u || keepsProductOutOfTinyRange(*lhs) || keepsProductOutOfTinyRange(*rhs)) return IrF32(*product);
+    if ((f32DenormalFlush & 2u) == 0u || ((f32DenormalFlush & 1u) != 0u && (keepsProductOutOfTinyRange(*lhs) || keepsProductOutOfTinyRange(*rhs)))) return IrF32(*product);
     IrValue& lhsBits = ir.BitCastU32(*lhs);
     IrValue& rhsBits = ir.BitCastU32(*rhs);
     const std::uint32_t roundMode = floatMode.has_value() ? floatMode->floatMode & 3u : 0u;
@@ -249,7 +249,7 @@ void TranslationContext::writeOperand(const RdnaOperand& operand, IrValue* value
     }
     IrType type = value->Type();
     if (type == IrType::F32) {
-        if ((f32DenormalFlush & 2u) != 0u) value = &ir.BitCastF32(flushF32Denormal(IrU32(ir.BitCastU32(*value))).Value());
+        if ((f32DenormalFlush & 2u) != 0u) value = &ir.BitCastF32(flushF32Denormal(IrU32(ir.BitCastU32(*value)), 2u).Value());
         value = &applyF32ResultModifiers(operand, IrF32(*value)).Value();
         type = IrType::F32;
     }
diff --git a/core/shader/recompiler/Translation/src/VectorInstructions.cpp b/core/shader/recompiler/Translation/src/VectorInstructions.cpp
index c02cdba51e..804535419f 100644
--- a/core/shader/recompiler/Translation/src/VectorInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/VectorInstructions.cpp
@@ -49,12 +49,30 @@ std::uint32_t TranslationContext::f32DenormalFlushFor(const RdnaInstruction& ins
     case RdnaOpcode::VSubrevF32:
     case RdnaOpcode::VMulF32:
     case RdnaOpcode::VMulLegacyF32:
+        if (floatMode.has_value() && (floatMode->floatMode & 3u) == 0u) {
+            const std::uint32_t denormals = (floatMode->floatMode >> 4u) & 3u;
+            if (denormals == 1u || denormals == 2u) {
+                if (!float32DenormPreserve || float32FlushToZero) {
+                    throw std::runtime_error("f32 denormal mode " + std::to_string(denormals) + " at pc " + std::to_string(inst.programCounter) + " needs DenormPreserve 32, which the device does not offer for this shader");
+                }
+                return denormals == 1u ? 2u : 1u;
+            }
+        }
+        flush = 3u;
+        break;
     case RdnaOpcode::VMullitF32:
+        flush = 3u;
+        break;
     case RdnaOpcode::VMinF32:
     case RdnaOpcode::VMaxF32:
     case RdnaOpcode::VMin3F32:
     case RdnaOpcode::VMax3F32:
     case RdnaOpcode::VMed3F32:
+        if (!floatMode.has_value() || ((floatMode->floatMode >> 4u) & 1u) == 0u) return 3u;
+        if (((floatMode->floatMode >> 4u) & 3u) == 1u && (!float32DenormPreserve || float32FlushToZero)) {
+            throw std::runtime_error("f32 denormal mode 1 at pc " + std::to_string(inst.programCounter) + " needs DenormPreserve 32, which the device does not offer for this shader");
+        }
+        return 0u;
     case RdnaOpcode::VFractF32:
     case RdnaOpcode::VFloorF32:
     case RdnaOpcode::VCeilF32:
@@ -93,7 +111,6 @@ std::uint32_t TranslationContext::f32DenormalFlushFor(const RdnaInstruction& ins
     case RdnaOpcode::VCmpxNleF32:
     case RdnaOpcode::VCmpxNlgF32:
     case RdnaOpcode::VCmpxNltF32:
-        return floatMode.has_value() && ((floatMode->floatMode >> 4u) & 1u) != 0u ? 0u : 1u;
     case RdnaOpcode::VCvtI32F32:
     case RdnaOpcode::VCvtU32F32:
     case RdnaOpcode::VCvtRpiI32F32:
@@ -105,6 +122,7 @@ std::uint32_t TranslationContext::f32DenormalFlushFor(const RdnaInstruction& ins
     case RdnaOpcode::VCvtPkU8F32:
     case RdnaOpcode::VCvtPkrtzF16F32:
     case RdnaOpcode::VCvtF16F32:
+        return floatMode.has_value() && ((floatMode->floatMode >> 4u) & 1u) != 0u ? 0u : 1u;
     case RdnaOpcode::VDivScaleF32:
     case RdnaOpcode::VDivFixupF32:
     case RdnaOpcode::VMadMixloF16:
@@ -119,6 +137,12 @@ std::uint32_t TranslationContext::f32DenormalFlushFor(const RdnaInstruction& ins
     }
     const std::uint32_t denormals = floatMode.has_value() ? (floatMode->floatMode >> 4u) & 3u : 0u;
     if (denormals == 1u || denormals == 2u) {
+        if (inst.op == RdnaOpcode::VMullitF32 && (denormals == 2u || (floatMode->floatMode & 3u) == 0u)) {
+            if (!float32DenormPreserve || float32FlushToZero) {
+                throw std::runtime_error("f32 denormal mode " + std::to_string(denormals) + " at pc " + std::to_string(inst.programCounter) + " needs DenormPreserve 32, which the device does not offer for this shader");
+            }
+            return denormals == 1u ? 2u : 1u;
+        }
         throw std::runtime_error("f32 denormal mode " + std::to_string(denormals) + " at pc " + std::to_string(inst.programCounter) + " is not implemented");
     }
     if (denormals != 0u) return 0u;
diff --git a/core/shader/recompiler/tests/RequestSerializerTests.cpp b/core/shader/recompiler/tests/RequestSerializerTests.cpp
index eb8d34ad6d..8229447e9e 100644
--- a/core/shader/recompiler/tests/RequestSerializerTests.cpp
+++ b/core/shader/recompiler/tests/RequestSerializerTests.cpp
@@ -7,6 +7,8 @@
 #include <stdexcept>
 #include <string>
 #include <string_view>
+#include <type_traits>
+#include <utility>
 #include <vector>
 
 namespace {
@@ -45,6 +47,62 @@ void Require(bool condition) {
     if (!condition) std::abort();
 }
 
+template <typename TRange>
+concept AssignableMemory = requires(ShaderRecompiler::GuestContext& context, TRange&& range) {
+    context.memory = std::forward<TRange>(range);
+};
+
+using Region = ShaderRecompiler::MemoryRegion;
+using Regions = std::vector<Region>;
+using RegionArray = std::array<Region, 1>;
+using RegionView = ShaderRecompiler::MemoryRegionView;
+
+static_assert(!AssignableMemory<Regions>);
+static_assert(!AssignableMemory<const Regions>);
+static_assert(!AssignableMemory<RegionArray>);
+static_assert(!AssignableMemory<std::initializer_list<Region>>);
+static_assert(AssignableMemory<Regions&> && AssignableMemory<const Regions&>);
+static_assert(AssignableMemory<RegionArray&> && AssignableMemory<const RegionArray&>);
+static_assert(AssignableMemory<std::span<const Region>> && AssignableMemory<RegionView>);
+static_assert(sizeof(RegionView) == sizeof(std::span<const Region>));
+static_assert(alignof(RegionView) == alignof(std::span<const Region>));
+static_assert(std::is_trivially_copyable_v<RegionView>);
+static_assert(std::is_nothrow_constructible_v<RegionView, std::span<const Region>>);
+static_assert([] {
+    const RegionArray owned{{{0x1000u, {}}}};
+    const RegionView view{std::span<const Region>(owned)};
+    return view.size() == 1u && view.front().guestAddress == 0x1000u;
+}());
+
+void VerifyMemoryView() {
+    const std::array<std::byte, 4> bytes{std::byte{1}, std::byte{2}, std::byte{3}, std::byte{4}};
+    Regions owned{{0x1000u, bytes}};
+    const Regions frozen = owned;
+    Region array[]{{0x2000u, bytes}};
+    RegionArray standard{{{0x3000u, bytes}}};
+    ShaderRecompiler::RecompileRequest request{};
+    request.context.memory = owned;
+    Require(request.context.memory.data() == owned.data());
+    owned.front().guestAddress = 0x4000u;
+    Require(request.context.memory.front().guestAddress == 0x4000u);
+    request.context.memory = frozen;
+    Require(request.context.memory.data() == frozen.data());
+    request.context.memory = array;
+    Require(request.context.memory.data() == array);
+    request.context.memory = standard;
+    Require(request.context.memory.data() == standard.data());
+    request.context.memory = std::span<const Region>(owned).first(1);
+    const auto copy = request;
+    Require(copy.context.memory.data() == owned.data() && copy.context.memory.front().bytes.data() == bytes.data());
+    request.context.memory = {owned.data(), owned.size()};
+    const ShaderRecompiler::RequestSerializer serializer;
+    const auto replay = serializer.Deserialize(serializer.Serialize(request));
+    Require(replay.request.context.memory.size() == 1u && replay.request.context.memory.front().guestAddress == 0x4000u);
+    Require(std::ranges::equal(replay.request.context.memory.front().bytes, bytes));
+    request.context.memory = {};
+    Require(request.context.memory.empty());
+}
+
 void InsertMeshBarycentricFlag(std::vector<std::uint8_t>& bytes) {
     constexpr std::array<std::uint8_t, 20> draw{0x00, 0x34, 0xef, 0xcd, 0xab, 0x00, 0x00, 0x00, 57u, 0u, 0u, 0u, 4u, 0u, 0u, 0u, 9u, 0u, 0u, 0u};
     const auto at = std::search(bytes.begin(), bytes.end(), draw.begin(), draw.end());
@@ -52,9 +110,29 @@ void InsertMeshBarycentricFlag(std::vector<std::uint8_t>& bytes) {
     bytes.insert(at + static_cast<std::ptrdiff_t>(draw.size()), 0u);
 }
 
-void InsertPixelDefaultsAfterFrontFace(std::vector<std::uint8_t>& bytes, bool sampleOrder = true) {
+// Pixel info bytes that follow the stencil operation value flag: the sample order (version 42),
+// then the default color target merge (version 46, 40 bytes with samples = 1 at offset 5).
+std::vector<std::uint8_t> PixelTailDefaults(bool sampleOrder, bool targetMerge) {
+    std::vector<std::uint8_t> tail(sampleOrder ? 16u : 0u, 0u);
+    if (targetMerge) {
+        tail.resize(tail.size() + 40u, 0u);
+        tail[tail.size() - 35u] = 1u;
+    }
+    return tail;
+}
+
+void EraseDefaultTargetMerge(std::vector<std::uint8_t>& bytes, std::ptrdiff_t offset) {
+    const auto merge = PixelTailDefaults(false, true);
+    const auto at = bytes.begin() + offset;
+    Require(bytes.end() - at > static_cast<std::ptrdiff_t>(merge.size()) && std::equal(merge.begin(), merge.end(), at));
+    bytes.erase(at, at + static_cast<std::ptrdiff_t>(merge.size()));
+}
+
+void InsertPixelDefaultsAfterFrontFace(std::vector<std::uint8_t>& bytes, bool sampleOrder = true, bool targetMerge = true) {
     bytes.insert(bytes.begin() + 261u, {0x0fu, 0xffu, 0xffu, 0u, 0u, 0xffu, 0xffu, 0u, 0u, 0xffu, 0xffu, 0u, 0u, 0xffu, 0xffu, 0u, 0u, 0u, 0u, 0u, 0u});
-    bytes.insert(bytes.begin() + 282u, sampleOrder ? 51u : 35u, 0u);
+    bytes.insert(bytes.begin() + 282u, 35u, 0u);
+    const auto tail = PixelTailDefaults(sampleOrder, targetMerge);
+    bytes.insert(bytes.begin() + 317u, tail.begin(), tail.end());
 }
 
 void AppendVertexTail(std::vector<std::uint8_t>& bytes) {
@@ -99,6 +177,7 @@ std::string EncodeBase64(const std::vector<std::uint8_t>& bytes) {
 }
 
 int main() {
+    VerifyMemoryView();
     const ShaderRecompiler::RequestSerializer serializer;
 
     const auto historical = serializer.Deserialize(kHistoricalVersion21);
@@ -219,13 +298,15 @@ int main() {
             Require(request.graphics->draw.indexAddress == 0xabcdef3400u && request.graphics->draw.indexCount == 57u && request.graphics->draw.indexElementBytes == 4u && request.graphics->draw.instanceCount == 9u);
             Require(request.target.float16DenormPreserve == preserve);
             auto upgraded = bytes;
-            upgraded[4] = 44u;
+            upgraded[4] = 46u;
             InsertMeshBarycentricFlag(upgraded);
             if (fixture.pixel) upgraded.insert(upgraded.begin() + 258u, {0u, 0u, 0u});
             if (fixture.pixel) InsertPixelDefaultsAfterFrontFace(upgraded);
             if (fixture.tessellation) upgraded.insert(upgraded.end() - 35u, 6u, 0u);
             AppendVertexTail(upgraded);
             upgraded.push_back(0u);
+            upgraded.push_back(0u);
+            upgraded.insert(upgraded.end(), {0u, 0x10u, 0u, 0u});
             Require(serializer.Serialize(request) == EncodeBase64(upgraded));
             auto truncated = bytes;
             truncated.pop_back();
@@ -260,13 +341,15 @@ int main() {
                     layerRejected = std::string_view(error.what()) == "RequestSerializer: truncated data";
                 }
                 Require(layerRejected);
-                layered[4] = 44u;
+                layered[4] = 46u;
                 InsertMeshBarycentricFlag(layered);
                 layered.insert(layered.begin() + 259u, {0u, 0u});
                 InsertPixelDefaultsAfterFrontFace(layered);
                 if (fixture.tessellation) layered.insert(layered.end() - 35u, 6u, 0u);
                 AppendVertexTail(layered);
                 layered.push_back(0u);
+                layered.push_back(0u);
+                layered.insert(layered.end(), {0u, 0x10u, 0u, 0u});
                 Require(serializer.Serialize(layerReplay.request) == EncodeBase64(layered));
             }
         }
@@ -287,12 +370,14 @@ int main() {
             Require(replay.request.context.pixel->rasterPrimitive == ShaderRecompiler::RasterPrimitive::Rectangle);
             Require(replay.request.context.vertex->paClVsOutCntl == 0x00050a05u);
             Require(replay.request.target.float16DenormPreserve == preserve);
-            bytes[4] = 44u;
+            bytes[4] = 46u;
             InsertMeshBarycentricFlag(bytes);
             bytes.insert(bytes.begin() + 259u, {0u, 0u});
             InsertPixelDefaultsAfterFrontFace(bytes);
             AppendVertexTail(bytes);
             bytes.push_back(0u);
+            bytes.push_back(0u);
+            bytes.insert(bytes.end(), {0u, 0x10u, 0u, 0u});
             Require(serializer.Serialize(replay.request) == EncodeBase64(bytes));
 
             auto truncated23 = DecodeBase64(encoded23);
@@ -416,14 +501,19 @@ int main() {
                 main38[4] = 38u;
                 InsertMeshBarycentricFlag(main38);
                 if (fixture.pixel) main38.insert(main38.begin() + 259u, {0u, 0u});
-                if (fixture.pixel) InsertPixelDefaultsAfterFrontFace(main38, false);
+                if (fixture.pixel) InsertPixelDefaultsAfterFrontFace(main38, false, false);
                 auto upgraded = main38;
-                upgraded[4] = 44u;
-                if (fixture.pixel) upgraded.insert(upgraded.begin() + 317u, 16u, 0u);
+                upgraded[4] = 46u;
+                if (fixture.pixel) {
+                    const auto tail = PixelTailDefaults(true, true);
+                    upgraded.insert(upgraded.begin() + 317u, tail.begin(), tail.end());
+                }
                 if (fixture.tessellation) upgraded.insert(upgraded.end() - 35u, 1u, 0u);
                 main38.insert(main38.end(), sizeof(std::uint64_t) + 1u + 5u + 1u, 0u);
                 AppendVertexTail(upgraded);
                 upgraded.push_back(0u);
+                upgraded.push_back(0u);
+                upgraded.insert(upgraded.end(), {0u, 0x10u, 0u, 0u});
                 Require(serializer.Serialize(request) == EncodeBase64(upgraded));
                 const auto replay38 = serializer.Deserialize(EncodeBase64(main38));
                 Require(replay38.request.graphics.has_value() && replay38.request.graphics->tessellation.has_value() == fixture.tessellation);
@@ -439,12 +529,22 @@ int main() {
                         pointed.context.vertex->pointSize = 3.0f;
                         pointed.context.vertex->pointSizeMin = 1.0f;
                         pointed.context.vertex->pointSizeMax = 8.0f;
-                        auto version44 = DecodeBase64(serializer.Serialize(pointed));
-                        Require(version44.size() > 15u && version44[4] == 44u);
+                        auto version46 = DecodeBase64(serializer.Serialize(pointed));
+                        Require(version46.size() > 15u && version46[4] == 46u);
+                        const auto replay46 = serializer.Deserialize(EncodeBase64(version46));
+                        Require(replay46.request.graphics->tessellation->mergedHull == merged && replay46.request.context.vertex->pointList && replay46.request.context.vertex->pointSize == 3.0f && replay46.request.context.vertex->pointSizeMin == 1.0f && replay46.request.context.vertex->pointSizeMax == 8.0f);
+                        auto version45 = version46;
+                        if (fixture.pixel) EraseDefaultTargetMerge(version45, 333);
+                        version45[4] = 45u;
+                        auto version44 = version45;
+                        version44.resize(version44.size() - 4u);
+                        version44.pop_back();
+                        version44[4] = 44u;
                         auto version43 = version44;
                         version43.pop_back();
                         version43[4] = 43u;
                         const auto replay43 = serializer.Deserialize(EncodeBase64(version43));
+                        Require(serializer.Serialize(replay43.request) == EncodeBase64(version46));
                         Require(replay43.request.graphics->tessellation->mergedHull == merged && replay43.request.context.vertex->pointList && replay43.request.context.vertex->pointSize == 3.0f && replay43.request.context.vertex->pointSizeMin == 1.0f && replay43.request.context.vertex->pointSizeMax == 8.0f);
                         auto version42 = version43;
                         version42.resize(version42.size() - 13u);
@@ -471,7 +571,7 @@ int main() {
                     const auto replay25 = serializer.Deserialize(EncodeBase64(main25));
                     Require(!fixture.pixel || (replay25.request.context.pixel->layerExported == layer && replay25.request.context.pixel->ditheredAlphaToCoverage == dither && replay25.request.context.pixel->reversedBlend == 0u));
                     Require(replay25.request.target.float16DenormPreserve == preserve && (!fixture.tessellation || replay25.request.graphics->tessellation->primitiveGroupSize == 37u));
-                    main25[4] = 44u;
+                    main25[4] = 46u;
                     InsertMeshBarycentricFlag(main25);
                     if (fixture.pixel) {
                         main25.insert(main25.begin() + 260u, 0u);
@@ -480,6 +580,8 @@ int main() {
                     if (fixture.tessellation) main25.insert(main25.end() - 35u, 1u, 0u);
                     AppendVertexTail(main25);
                     main25.push_back(0u);
+                    main25.push_back(0u);
+                    main25.insert(main25.end(), {0u, 0x10u, 0u, 0u});
                     Require(serializer.Serialize(replay25.request) == EncodeBase64(main25));
                 }
             }
@@ -491,19 +593,23 @@ int main() {
         request.target.float16DenormPreserve = preserve;
         request.target.float32FlushToZero = !preserve;
         request.target.float32DenormPreserve = preserve;
+        request.target.largePixelFunctionLdsBuffer = !preserve;
+        request.target.pixelFunctionStorageDwords = preserve ? 2048u : 4096u;
         const auto encoded = serializer.Serialize(request);
         const auto replay = serializer.Deserialize(encoded);
-        Require(replay.request.target.float16DenormPreserve == preserve && replay.request.target.float32FlushToZero == !preserve && replay.request.target.float32DenormPreserve == preserve);
+        Require(replay.request.target.float16DenormPreserve == preserve && replay.request.target.float32FlushToZero == !preserve && replay.request.target.float32DenormPreserve == preserve && replay.request.target.largePixelFunctionLdsBuffer == !preserve && replay.request.target.pixelFunctionStorageDwords == request.target.pixelFunctionStorageDwords);
         auto bytes = DecodeBase64(encoded);
-        Require(bytes.size() >= 8u && bytes[4] == 44u && bytes[5] == 0u && bytes[6] == 0u && bytes[7] == 0u);
+        Require(bytes.size() >= 8u && bytes[4] == 46u && bytes[5] == 0u && bytes[6] == 0u && bytes[7] == 0u);
         auto version40 = bytes;
+        version40.resize(version40.size() - sizeof(std::uint32_t));
+        version40.pop_back();
         version40.pop_back();
         version40.pop_back();
         version40[4] = 40u;
         const auto replay40 = serializer.Deserialize(EncodeBase64(version40));
         Require(!replay40.request.target.float32DenormPreserve && replay40.request.target.float32FlushToZero == !preserve);
         auto future = bytes;
-        future[4] = 45u;
+        future[4] = 47u;
         bool futureRejected = false;
         try {
             static_cast<void>(serializer.Deserialize(EncodeBase64(future)));
@@ -545,11 +651,21 @@ int main() {
     request.context.pixel = pixel;
     const auto orderEncoded = serializer.Serialize(request);
     Require(serializer.Deserialize(orderEncoded).request.context.pixel->sampleOrder == pixel.sampleOrder);
-    auto version41 = DecodeBase64(orderEncoded);
-    const auto order = std::search(version41.begin(), version41.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) + pixel.sampleLocations.size() + 1;
-    Require(version41.end() - order > static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)) && *order == 0x10u);
-    version41.erase(order, order + sizeof(pixel.sampleOrder));
-    version41.pop_back();
+    auto version42 = DecodeBase64(orderEncoded);
+    const auto orderOffset = std::search(version42.begin(), version42.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) - version42.begin() + static_cast<std::ptrdiff_t>(pixel.sampleLocations.size() + 1u);
+    Require(version42.end() - version42.begin() > orderOffset + static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)) && version42[static_cast<std::size_t>(orderOffset)] == 0x10u);
+    EraseDefaultTargetMerge(version42, orderOffset + static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)));
+    version42.resize(version42.size() - 4u);
+    version42.pop_back();
+    version42.pop_back();
+    version42[4] = 42u;
+    const auto replay42 = serializer.Deserialize(EncodeBase64(version42));
+    Require(replay42.request.context.pixel.has_value() && replay42.request.context.pixel->sampleOrder == pixel.sampleOrder && replay42.request.context.pixel->targetMerge == ShaderRecompiler::TargetMerge{});
+    auto upgraded42 = replay42.request;
+    upgraded42.target = request.target;
+    Require(serializer.Serialize(upgraded42) == orderEncoded);
+    auto version41 = version42;
+    version41.erase(version41.begin() + orderOffset, version41.begin() + orderOffset + static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)));
     version41[4] = 41u;
     const auto replay41 = serializer.Deserialize(EncodeBase64(version41));
     Require(replay41.request.context.pixel.has_value() && replay41.request.context.pixel->sampleLocations == pixel.sampleLocations && replay41.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{});
@@ -560,10 +676,13 @@ int main() {
         Require(serializer.Deserialize(serializer.Serialize(request)).request.target.spannedWaves == spanned);
         request.target.float32FlushToZero = true;
         auto version35 = DecodeBase64(serializer.Serialize(request));
+        version35.resize(version35.size() - sizeof(std::uint32_t));
+        version35.pop_back();
         version35.pop_back();
         const auto stencilOperationValue = std::search(version35.begin(), version35.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.begin() + 4) + pixel.sampleLocations.size();
         const auto pixelTail = static_cast<std::ptrdiff_t>(1u + sizeof(pixel.sampleOrder));
         Require(version35.end() - stencilOperationValue > pixelTail && std::all_of(stencilOperationValue, stencilOperationValue + pixelTail, [](std::uint8_t value) { return value == 0u; }));
+        EraseDefaultTargetMerge(version35, stencilOperationValue - version35.begin() + pixelTail);
         version35.erase(stencilOperationValue, stencilOperationValue + pixelTail);
         version35[4] = 35u;
         version35.pop_back();
@@ -605,7 +724,7 @@ int main() {
         for (const std::uint8_t version : {32u, 33u, 34u, 35u, 36u, 37u, 38u}) {
             pointRequest.target.spannedWaves = spanned;
             auto legacy = DecodeBase64(serializer.Serialize(pointRequest));
-            legacy.resize(legacy.size() - (version >= 36u ? 15u : version >= 35u ? 16u : 21u));
+            legacy.resize(legacy.size() - (version >= 36u ? 20u : version >= 35u ? 21u : 26u));
             legacy[4] = version;
             const auto replayLegacy = serializer.Deserialize(EncodeBase64(legacy));
             Require(replayLegacy.request.target.spannedWaves == spanned);
@@ -617,7 +736,7 @@ int main() {
             Require(!replayLegacy.request.context.vertex->pointList && replayLegacy.request.context.vertex->pointSize == 1.0f);
             Require(replayLegacy.request.context.vertex->pointSizeMin == 0.0f && replayLegacy.request.context.vertex->pointSizeMax == 0.0f);
             const auto upgradedLegacy = DecodeBase64(serializer.Serialize(replayLegacy.request));
-            Require(upgradedLegacy[4] == 44u && upgradedLegacy.size() == legacy.size() + (version >= 36u ? 15u : version >= 35u ? 16u : 21u));
+            Require(upgradedLegacy[4] == 46u && upgradedLegacy.size() == legacy.size() + (version >= 36u ? 20u : version >= 35u ? 21u : 26u));
         }
     }
 
@@ -625,18 +744,29 @@ int main() {
     pointRequest.context.pixel = pixel;
     const auto sampledPoint = serializer.Deserialize(serializer.Serialize(pointRequest));
     Require(sampledPoint.request.context.vertex->pointList && sampledPoint.request.context.pixel->sampleOrder == pixel.sampleOrder);
-    auto legacy42 = DecodeBase64(serializer.Serialize(pointRequest));
-    legacy42.resize(legacy42.size() - 14u);
+    auto legacy43 = DecodeBase64(serializer.Serialize(pointRequest));
+    const auto mergeOffset = std::search(legacy43.begin(), legacy43.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) - legacy43.begin() + static_cast<std::ptrdiff_t>(pixel.sampleLocations.size() + 1u + sizeof(pixel.sampleOrder));
+    EraseDefaultTargetMerge(legacy43, mergeOffset);
+    legacy43.resize(legacy43.size() - 4u);
+    legacy43.pop_back();
+    legacy43.pop_back();
+    legacy43[4] = 43u;
+    const auto pointReplay43 = serializer.Deserialize(EncodeBase64(legacy43));
+    Require(pointReplay43.request.context.pixel->sampleOrder == pixel.sampleOrder && pointReplay43.request.context.vertex->pointList && pointReplay43.request.context.vertex->pointSize == 4.0f);
+    Require(serializer.Serialize(pointReplay43.request) == serializer.Serialize(pointRequest));
+    auto legacy42 = legacy43;
+    legacy42.resize(legacy42.size() - 13u);
     legacy42[4] = 42u;
-    const auto replay42 = serializer.Deserialize(EncodeBase64(legacy42));
-    Require(replay42.request.context.pixel->sampleOrder == pixel.sampleOrder && !replay42.request.context.vertex->pointList && replay42.request.context.vertex->pointSize == 1.0f);
+    const auto pointReplay42 = serializer.Deserialize(EncodeBase64(legacy42));
+    Require(pointReplay42.request.context.pixel->sampleOrder == pixel.sampleOrder && !pointReplay42.request.context.vertex->pointList && pointReplay42.request.context.vertex->pointSize == 1.0f);
     pixel.sampleOrder = {};
     pointRequest.context.pixel = pixel;
     auto legacy34 = DecodeBase64(serializer.Serialize(pointRequest));
-    legacy34.resize(legacy34.size() - 21u);
+    legacy34.resize(legacy34.size() - 26u);
     const auto stencil34 = std::search(legacy34.begin(), legacy34.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.begin() + 4) + pixel.sampleLocations.size();
     const auto legacyPixelTail = static_cast<std::ptrdiff_t>(1u + sizeof(pixel.sampleOrder));
     Require(legacy34.end() - stencil34 > legacyPixelTail && std::all_of(stencil34, stencil34 + legacyPixelTail, [](std::uint8_t value) { return value == 0u; }));
+    EraseDefaultTargetMerge(legacy34, stencil34 - legacy34.begin() + legacyPixelTail);
     legacy34.erase(stencil34, stencil34 + legacyPixelTail);
     legacy34[4] = 34u;
     const auto replay34 = serializer.Deserialize(EncodeBase64(legacy34));
@@ -645,8 +775,15 @@ int main() {
 
     for (const bool fused : {false, true}) {
         request.target.fusedExactArithmetic = fused;
+        request.target.largePixelFunctionLdsBuffer = false;
         auto bytes = DecodeBase64(serializer.Serialize(request));
-        Require(serializer.Deserialize(EncodeBase64(bytes)).request.target.fusedExactArithmetic == fused && bytes.back() == (fused ? 1u : 0u));
+        Require(serializer.Deserialize(EncodeBase64(bytes)).request.target.fusedExactArithmetic == fused && bytes[bytes.size() - 6u] == (fused ? 1u : 0u) && bytes[bytes.size() - 5u] == 0u);
+        const auto fusedMerge = std::search(bytes.begin(), bytes.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) - bytes.begin() + static_cast<std::ptrdiff_t>(pixel.sampleLocations.size() + 1u + sizeof(pixel.sampleOrder));
+        EraseDefaultTargetMerge(bytes, fusedMerge);
+        bytes.resize(bytes.size() - 4u);
+        bytes.pop_back();
+        bytes[4] = 44u;
+        Require(serializer.Deserialize(EncodeBase64(bytes)).request.target.fusedExactArithmetic == fused);
         bytes[4] = 43u;
         bytes.pop_back();
         Require(!serializer.Deserialize(EncodeBase64(bytes)).request.target.fusedExactArithmetic);
diff --git a/core/shader/recompiler/tests/test_shader_cache_native_paths.py b/core/shader/recompiler/tests/test_shader_cache_native_paths.py
index b2f1e8c57f..9a28aab1e8 100644
--- a/core/shader/recompiler/tests/test_shader_cache_native_paths.py
+++ b/core/shader/recompiler/tests/test_shader_cache_native_paths.py
@@ -51,6 +51,24 @@ class ShaderCachePathTests(unittest.TestCase):
     def test_cjk(self):
         self.check_source_change('\u6e2c\u8a66 path')
 
+    def test_line_endings_keep_version(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary) / 'line endings'
+            source, listing, output = self.fixture(root)
+            text = '#include <cstdint>\nconst char* mode = "APS5_TEST_PATH";\nint value = 1;\n'
+            source.write_bytes(text.encode('utf-8'))
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            unix = output.read_bytes()
+            source.write_bytes(text.replace('\n', '\r\n').encode('utf-8'))
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertEqual(unix, output.read_bytes())
+            source.write_bytes(text.replace('= 1;', '= 2;').replace('\n', '\r\n').encode('utf-8'))
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertNotEqual(unix, output.read_bytes())
+
     def test_unicode_guard_rejects_unhashed_include(self):
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary) / '\u0441\u0431\u043e\u0440\u043a\u0430'
@@ -74,5 +92,34 @@ class ShaderCachePathTests(unittest.TestCase):
             self.assertIn('does not hash', result.stdout + result.stderr)
             self.assertFalse(output.exists())
 
+    @unittest.skipUnless(sys.platform == 'win32', 'Windows path separator semantics require Windows host')
+    def test_windows_path_separators(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary) / 'windows separators'
+            source, listing, output = self.fixture(root)
+            windows_path = str(source).replace('/', '\\')
+            listing.write_text(f'sources {windows_path}\n', encoding='utf-8')
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            windows_version = output.read_bytes()
+            listing.write_text(f'sources {source.as_posix()}\n', encoding='utf-8')
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertEqual(windows_version, output.read_bytes())
+
+    @unittest.skipUnless(sys.platform == 'win32', 'Windows path separator semantics require Windows host')
+    def test_windows_path_separators_reject_unhashed_include(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary) / 'windows separators'
+            source, listing, output = self.fixture(root)
+            windows_path = str(source).replace('/', '\\')
+            listing.write_text(f'sources {windows_path}\n', encoding='utf-8')
+            (root / 'shared.hpp').write_text('int example();\n', encoding='utf-8')
+            source.write_text('#include "../shared.hpp"\n', encoding='utf-8')
+            result = self.run_script(root, listing, output)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn('does not hash', result.stdout + result.stderr)
+            self.assertFalse(output.exists())
+
 
 unittest.main()
diff --git a/demo/web/app.mjs b/demo/web/app.mjs
index 4e0b534145..56e33dabf0 100644
--- a/demo/web/app.mjs
+++ b/demo/web/app.mjs
@@ -67,8 +67,9 @@ function update() {
     const totalBytes = sum(summaries.map(summary => summary.totalBytes));
     const modules = sum(summaries.map(summary => summary.modules));
     const sizeText = value => value === null ? "beyond the supported size range" : bytes(value);
+    const countText = value => value === null ? "beyond the supported range" : value;
     $("archive-info").textContent = multi
-      ? `${selectedInputs.length} apps · ${sizeText(totalFiles)} files · ${sizeText(totalBytes)} expanded · ${sizeText(modules)} modules · ${sizeText(selectedBytes)} ${target} conversion input`
+      ? `${selectedInputs.length} apps · ${countText(totalFiles)} files · ${sizeText(totalBytes)} expanded · ${countText(modules)} modules · ${sizeText(selectedBytes)} ${target} conversion input`
       : `${summaries[0].files} files · ${bytes(summaries[0].totalBytes)} expanded · ${summaries[0].modules} modules · ${bytes(target === "windows" ? summaries[0].windowsSelectedBytes : summaries[0].selectedBytes)} ${target} conversion input` + (summaries[0].root ? ` · Root: ${summaries[0].root}` : "");
   }
   $("save-note").textContent = multi ? $("save").value === "memory" ? "Creates one ZIP with each app in its own folder. The complete bundle must fit in the 256 MiB memory-download budget." : "Writes one compressed ZIP containing each app in its own folder, without holding the whole bundle in memory." : $("save").value === "disk" ? "Creates a subfolder with the executable, libs and app0. No ZIP compression. Incomplete output folders are removed after cancellation or failure. Browsers may block DLL and other restricted files; use ZIP for those apps." : $("save").value === "zip" ? "Writes a compressed ZIP directly to disk without holding the whole archive in memory." : "Up to 256 MiB including expanded files and output overhead.";
@@ -262,12 +263,16 @@ async function selectInputs(inputs) {
 $("choose").onclick = () => { $("file").value = ""; $("file").click(); };
 $("change").onclick = () => {
   if (working) return;
+  worker?.terminate();
+  worker = null;
   if (downloadUrl) { URL.revokeObjectURL(downloadUrl); downloadUrl = null; }
-  file = null;
-  summary = null;
+  selectedInputs = [];
+  summaries = [];
+  inspectionComplete = false;
   $("file").value = "";
   $("folder").value = "";
-  for (const id of ["selection", "warnings", "error", "done", "download"]) $(id).hidden = true;
+  $("app-list").replaceChildren();
+  for (const id of ["selection", "warnings", "error", "done", "download", "app-list"]) $(id).hidden = true;
   $("acknowledge").checked = false;
   $("drop").hidden = false;
   update();
diff --git a/demo/web/index.html b/demo/web/index.html
index e0d468febc..5d974cd58f 100644
--- a/demo/web/index.html
+++ b/demo/web/index.html
@@ -6,7 +6,7 @@
 <title>AnyPS5 · Converter</title><link rel="stylesheet" href="app.css"><script type="module" src="app.mjs"></script>
 </head>
 <body>
-<header><div class="bar"><a class="brand" href="./"><span class="mark" aria-hidden="true"><i></i><i></i><i></i><i></i></span>AnyPS5 <span>/ Converter</span></a><nav aria-label="Main navigation"><a href="https://alxcbtw.github.io/anyps5-roadmap/">Compatibility ↗</a><a href="https://github.com/boykopovar/AnyPS5">GitHub</a><a href="https://discord.gg/BHFztBPUe">Discord</a><button id="theme" class="plain" aria-label="Switch color theme">◐</button></nav></div></header>
+<header><div class="bar"><a class="brand" href="./"><span class="mark" aria-hidden="true"><i></i><i></i><i></i><i></i></span>AnyPS5 <span>/ Converter</span></a><nav aria-label="Main navigation"><a href="https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up">Game bring-up ↗</a><a href="https://github.com/boykopovar/AnyPS5">GitHub</a><a href="https://discord.gg/BHFztBPUe">Discord</a><button id="theme" class="plain" aria-label="Switch color theme">◐</button></nav></div></header>
 <main>
 <div class="intro"><p class="eyebrow">LOCAL CONVERSION</p><h1>PS5 apps to Windows/Linux converter</h1></div>
 <div id="browser-note" class="notice" role="status" hidden></div>
@@ -23,7 +23,7 @@
 <div id="done" class="done" hidden><h3>Ready to run.</h3><p id="result-info"></p><a id="download" class="button" hidden>Download ZIP</a><p id="result-note" class="fine">Extract the entire ZIP before launching the executable.</p></div>
 </section>
 <p class="limits">Memory downloads have a 256 MiB budget, checked against expanded files and output overhead. For multiple ZIPs, the limit applies to the combined bundle; larger batches require Save ZIP to disk in desktop Chrome or Edge. Executable and modules are limited to 256 MiB per app; the icon is also limited to 16 MiB and counts toward the Windows conversion limit. Use the native relinker for larger conversion inputs.</p>
-<p class="compatibility">Conversion does not guarantee that an app runs. Check the <a href="https://alxcbtw.github.io/anyps5-roadmap/">community compatibility list</a> for known blockers and reports.</p>
+<p class="compatibility">Conversion does not guarantee that an app runs. Check the <a href="https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up">Game bring-up discussions</a> for known blockers and reports.</p>
 </main><footer><span>AnyPS5</span><div><a href="progress.html">Implementation progress</a><a href="history.html">Progress history</a><a href="https://github.com/boykopovar/AnyPS5/releases/latest">Latest release</a></div></footer>
 <noscript><p class="notice">JavaScript is required. You can also use the native relinker from GitHub Releases.</p></noscript>
 </body></html>
diff --git a/demo/web/tests/app.test.mjs b/demo/web/tests/app.test.mjs
new file mode 100644
index 0000000000..a97a239ad6
--- /dev/null
+++ b/demo/web/tests/app.test.mjs
@@ -0,0 +1,140 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { setImmediate } from "node:timers/promises";
+import { test } from "node:test";
+
+class Element {
+  children = [];
+  listeners = new Map();
+  value = "";
+  checked = false;
+  disabled = false;
+  textContent = "";
+
+  constructor(hidden = false) { this.hidden = hidden; }
+  addEventListener(type, listener) { this.listeners.set(type, listener); }
+  removeAttribute(name) { delete this[name]; }
+  append(...children) { this.children.push(...children); }
+  replaceChildren(...children) { this.children = children; }
+}
+
+async function setup(t, name) {
+  const html = readFileSync(new URL("../index.html", import.meta.url), "utf8");
+  const elements = new Map([...html.matchAll(/<[^>]+\bid="([^"]+)"[^>]*>/gu)].map(match => [
+    match[1], new Element(/\shidden(?:\s|>)/u.test(match[0]))
+  ]));
+  const get = id => {
+    assert.ok(elements.has(id), `Missing element: ${id}`);
+    return elements.get(id);
+  };
+  const options = new Map(["disk", "zip", "memory"].map(value => [`[value="${value}"]`, new Element()]));
+  get("save").querySelector = selector => options.get(selector);
+  get("folder").webkitdirectory = true;
+  const workers = [];
+  class Worker {
+    messages = [];
+    terminated = false;
+    constructor() { workers.push(this); }
+    postMessage(message) { this.messages.push(message); }
+    terminate() { this.terminated = true; }
+  }
+  const globals = {
+    document: {
+      getElementById: get,
+      createElement: () => new Element(),
+      querySelector: selector => {
+        assert.equal(selector, 'input[name="target"]:checked');
+        return { value: "linux" };
+      }
+    },
+    window: { isSecureContext: true, Worker, WebAssembly, ReadableStream, WritableStream, crypto: { subtle: {} } },
+    Worker,
+    fetch: async () => ({
+      ok: true,
+      json: async () => ({ tag: "test-release", platforms: { linux: { expandedBytes: 1024 }, windows: { expandedBytes: 1024 } } })
+    })
+  };
+  for (const [key, value] of Object.entries(globals)) {
+    const original = Object.getOwnPropertyDescriptor(globalThis, key);
+    Object.defineProperty(globalThis, key, { value, configurable: true, writable: true });
+    t.after(() => {
+      if (original) Object.defineProperty(globalThis, key, original);
+      else delete globalThis[key];
+    });
+  }
+  await import(new URL(`../app.mjs?${name}`, import.meta.url));
+  await setImmediate();
+  return { get, workers };
+}
+
+async function inspect(worker, count) {
+  for (let index = 0; index < count; index++) {
+    await worker.onmessage({ data: {
+      type: "inspected", index,
+      summary: { files: 1, totalBytes: 1024, modules: 0, selectedBytes: 1024, windowsSelectedBytes: 1024, warnings: ["Test warning"] }
+    } });
+  }
+  await worker.onmessage({ data: { type: "inspection-complete" } });
+}
+
+for (const kind of ["zip", "batch", "folder"]) {
+  test(`Change resets an inspected ${kind} and permits a new conversion`, async t => {
+    const { get, workers } = await setup(t, kind);
+    assert.equal(get("convert").disabled, true);
+    if (kind === "folder") {
+      get("folder").files = [{ name: "eboot.bin", webkitRelativePath: "app/eboot.bin" }];
+      get("folder").onchange();
+    } else {
+      get("file").files = kind === "batch" ? [{ name: "first.zip" }, { name: "second.zip" }] : [{ name: "first.zip" }];
+      get("file").onchange();
+    }
+    const first = workers[0];
+    assert.equal(first.messages[0].type, "inspect");
+    assert.equal(first.messages[0].inputs.length, kind === "batch" ? 2 : 1);
+    get("change").onclick();
+    assert.equal(first.terminated, false);
+    await inspect(first, first.messages[0].inputs.length);
+    assert.equal(get("selection").hidden, false);
+    assert.equal(get("drop").hidden, true);
+    assert.equal(get("warnings").hidden, false);
+    assert.equal(get("app-list").children.length, first.messages[0].inputs.length);
+    assert.equal(get("app-list").hidden, kind !== "batch");
+    get("acknowledge").checked = true;
+    get("acknowledge").listeners.get("change")();
+    assert.equal(get("convert").disabled, false);
+
+    get("change").onclick();
+    assert.equal(first.terminated, true);
+    assert.equal(get("file").value, "");
+    assert.equal(get("folder").value, "");
+    assert.equal(get("selection").hidden, true);
+    assert.equal(get("warnings").hidden, true);
+    assert.equal(get("app-list").hidden, true);
+    assert.equal(get("app-list").children.length, 0);
+    assert.equal(get("drop").hidden, false);
+    assert.equal(get("acknowledge").checked, false);
+    assert.equal(get("convert").disabled, true);
+    get("acknowledge").checked = true;
+    get("acknowledge").listeners.get("change")();
+    assert.equal(get("convert").disabled, true);
+    get("change").onclick();
+
+    get("file").files = [{ name: "replacement.zip" }];
+    get("file").onchange();
+    assert.equal(workers.length, 2);
+    const replacement = workers[1];
+    assert.deepEqual(replacement.messages[0].inputs.map(input => input.name), ["replacement.zip"]);
+    assert.equal(get("convert").disabled, true);
+    await inspect(replacement, 1);
+    assert.equal(get("archive-name").textContent, "replacement.zip");
+    assert.equal(get("app-list").children.length, 1);
+    assert.equal(get("app-list").hidden, true);
+    assert.equal(get("convert").disabled, true);
+    get("acknowledge").checked = true;
+    get("acknowledge").listeners.get("change")();
+    assert.equal(get("convert").disabled, false);
+    await get("convert").onclick();
+    assert.equal(replacement.messages.at(-1).type, "convert");
+    assert.equal(replacement.terminated, false);
+  });
+}
diff --git a/docs/dev/ARCHITECTURE.md b/docs/dev/ARCHITECTURE.md
index 8676f9acff..e63cb8cf20 100644
--- a/docs/dev/ARCHITECTURE.md
+++ b/docs/dev/ARCHITECTURE.md
@@ -124,17 +124,17 @@ flowchart LR
 
 - [`Recompiler.cpp`](../../core/shader/recompiler/Recompiler.cpp) runs the stages in this order. With `ANYPS5_ENABLE_SPIRV_TOOLS`, the SPIR-V is also validated and optimized with SPIRV-Tools.
 - `ShaderRecompiler::Recompile` keeps compiled variants in memory, and `ShaderDiskCache` stores them on disk so later runs reuse them. Before the writable cache, a miss is also looked up in read-only prebuilt packs and loose entry folders under `shader_cache/prebuilt`; pack entries are ordinary encoded cache entries behind a sorted key-hash index, validated by magic, compiler source version and index checksum when mapped, and a miss or rejected entry falls through to the writable cache and the compiler. Cache format 35 also stores the finite stencil-reference set, its replay-safety proof and reserved push-data word in the artifact and binding layouts. Entries from formats 31 to 34 are rejected.
-- The Vulkan pipelines are journaled as well ([`PipelineJournal.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp)): a graphics pipeline the store builds (`CachedPipeline`) or a compute pipeline a dispatch builds is appended to `pipelines.journal` next to the shader cache entries, as the materialized result of each stage (the specialized SPIR-V, bindings and push constants, through `ShaderDiskCache::EncodeResult`) plus the recipe the pipeline was built from (`GraphicsPipelineRecipe`: the stages' identities, vertex input layout, descriptor set layout keys and the state fields the `Pipeline` constructor reads, `CanonicalPipelineState`). When a `VulkanDevice` is created, the journal is loaded and its pipelines are built on a pool of `hardware_concurrency() / 2` threads (`APS5_PIPELINE_JOURNAL_THREADS`) while the title loads, so the first draw or dispatch of a configuration seen on an earlier run finds its pipeline resident. The pipeline stores key on `RecompileResult::Identity`, a hash of the module words, specialization constants, subgroup width and bindings that is the same on every run (`SharedSpirv::ContentHash`, computed once per shared module), rather than on the process-lifetime variant ids, and a graphics pipeline is built outside the store's mutex, so the replay threads and the queue workers build in parallel. A draw that arrives before its replayed entry builds the pipeline itself; the first inserted wins. A replayed entry enters the store at its least recently used end and a full store takes none, so the title's own pipelines are never evicted for a replayed one, and the optimized relink of a replayed pipeline (`OptimizedPipeline::Schedule`) waits for the first draw that binds it, so the relink thread serves the title's pipelines first. A device created without a window starts its replay at its first draw or dispatch rather than at creation, since `Driver::AttachWindow` usually replaces it before the title draws. The journal records a pipeline once (modules and recipes are deduplicated by content), keeps at most `APS5_PIPELINE_JOURNAL_MAX_MIB` (1024), replays the first `APS5_PIPELINE_JOURNAL_ENTRIES` recorded (1024, the pipeline store's bound, `APS5_PIPELINE_STORE_ENTRIES`; a run reaches those first), and is disabled with `APS5_NO_PIPELINE_JOURNAL=1` or without a shader cache directory. The file header names the device (`PipelineJournalDeviceFingerprint`, the properties the driver's pipeline cache file is named by), so a journal written for another GPU or driver is started over rather than replayed; appends and reads hold `pipelines.journal.lock` against another process sharing the directory, and a device cancels its replay before it is replaced (`PrepareForReplacement`) or destroyed, so a replaced headless device never inserts entries the window's device then sweeps. `APS5_PROFILE_DRAW=1` prints a `[pipeline-journal]` summary when the replay finishes and at teardown.
+- The Vulkan pipelines are journaled as well ([`PipelineJournal.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp)): a graphics pipeline the store builds (`CachedPipeline`) or a compute pipeline a dispatch builds is appended to `pipelines.journal` next to the shader cache entries, as the materialized result of each stage (the specialized SPIR-V, bindings and push constants, through `ShaderDiskCache::EncodeResult`) plus the recipe the pipeline was built from (`GraphicsPipelineRecipe`: the stages' identities, vertex input layout, descriptor set layout keys and the state fields the `Pipeline` constructor reads, `CanonicalPipelineState`). When a `VulkanDevice` is created, the journal is loaded and its pipelines are built on a pool of `hardware_concurrency() / 2` threads (`APS5_PIPELINE_JOURNAL_THREADS`) while the title loads. The load parses the file a record at a time and keeps it open, and a replay thread reads an entry's modules from it when it builds that entry (a record that no longer reads back as loaded rejects the entry), so the replay holds the modules of the entries being built rather than the file, so the first draw or dispatch of a configuration seen on an earlier run finds its pipeline resident. The pipeline stores key on `RecompileResult::Identity`, a hash of the module words, specialization constants, subgroup width and bindings that is the same on every run (`SharedSpirv::ContentHash`, computed once per shared module), rather than on the process-lifetime variant ids, and a graphics pipeline is built outside the store's mutex, so the replay threads and the queue workers build in parallel. A draw that arrives before its replayed entry builds the pipeline itself; the first inserted wins. A replayed entry enters the store at its least recently used end and a full store takes none, so the title's own pipelines are never evicted for a replayed one, and the optimized relink of a replayed pipeline (`OptimizedPipeline::Schedule`) waits for the first draw that binds it, so the relink thread serves the title's pipelines first. A device created without a window starts its replay at its first draw or dispatch rather than at creation, since `Driver::AttachWindow` usually replaces it before the title draws. The journal records a pipeline once (modules and recipes are deduplicated by content), keeps at most `APS5_PIPELINE_JOURNAL_MAX_MIB` (1024), replays the last `APS5_PIPELINE_JOURNAL_ENTRIES` recorded (4096, the pipeline store's largest bound: a replayed pipeline that finds the store full grows its bound from 1024 instead of being dropped), and is disabled with `APS5_NO_PIPELINE_JOURNAL=1` or without a shader cache directory. The file header names the device (`PipelineJournalDeviceFingerprint`, the properties the driver's pipeline cache file is named by), so a journal written for another GPU or driver is started over rather than replayed; appends and reads hold `pipelines.journal.lock` against another process sharing the directory, and a device cancels its replay before it is replaced (`PrepareForReplacement`) or destroyed, so a replaced headless device never inserts entries the window's device then sweeps. `APS5_PROFILE_DRAW=1` prints a `[pipeline-journal]` summary when the replay finishes and at teardown.
 - A compute shader whose LDS plus its lock dword exceeds the host's `maxComputeSharedMemorySize` is not given a `Workgroup` array. `Recompile` sets `ShaderInfo::sharedMemoryBytes` for it and the SPIR-V backend addresses the LDS in a coherent storage buffer at descriptor set 1 (`WorkgroupMemoryDescriptorSet`), with a slice of `RecompileResult::workgroupMemoryDwords` per workgroup, indexed by `WorkgroupID` and `NumWorkGroups`. `VulkanDevice` keeps one such buffer, sized from the dispatch dimensions, and binds it after the resource set; programs that fit keep using shared memory.
 - `Driver::RegisterShader` splits shader preparation in two. `PlanRegistered` runs on the registering guest thread: it validates the registers and entry point, decodes the code and builds the recompile request, so invalid registrations still fail there. The RDNA to IR translation and resource plan (`PrepareShader`) run on a background pool of `hardware_concurrency() / 2` detached threads (at least 2, 64 MiB stacks).
 - A thread that needs the GPU mutex, the committer's next item or the end of the committer's queue spins before it blocks (`HandoffSpin.hpp`): `GpuMutexType::lock` retries `try_lock` for the window, the committer polls its item count, and `DrawPipeline::Drain` polls it for twice the window, so a hand-off that completes within the window costs no kernel wake-up. The window is 150 us when the process may run on more than 8 logical processors (its affinity mask, via `CpuTopology`) and 0 otherwise, where the spinning threads would compete with the holder; `APS5_HANDOFF_SPIN_US=<n>` sets it (0 turns it off, at most 10000). Ordering and the lock's semantics are unchanged.
-- Queue 0's packet worker decodes, captures and prepares a draw and hands its recording (`Graphics::Draw` under the GPU lock) to a committer thread in [`DrawPipeline.cpp`](../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp), so the next packet is decoded while the previous draw is recorded. Each queued item carries the guest ranges it will write (`DrawWriteRanges`: written buffers and storage images, color targets with their DCC and CMASK, depth and stencil). A later packet that reads or writes one of those ranges, or that the pipeline can't order, drains it first; labels, submission ends, buffer fills and (with `APS5_PIPELINE_DMA=1`) DMA packets are queued as items instead. With `APS5_PIPELINE_DISPATCH=1` (off by default), a `DISPATCH_DIRECT` whose dispatch-cache entry hits with a recipe is queued as an item too, carrying the dispatch's written buffers and storage images (`DispatchWriteRanges`); the capture and the cache lookup stay on the worker and the recipe is recorded on the committer. A dispatch still drains when its lookup misses, when what it reads overlaps a write still pending, when the hit is verified against data or when its writes cannot be ranged (bindless access, GDS, fault buffer). An indirect draw resolved on the CPU (its records read by the worker) drains only when its records or its count overlap a queued write; the records it draws inline drain first, and its last drawn record is queued like a direct draw (`APS5_NO_PIPELINED_INDIRECT=1` drains at every indirect draw). An exception thrown by a commit is rethrown on the worker at its next enqueue or drain, as an inline draw error would be. On by default; `APS5_PIPELINED_DRAWS=0` records every draw inline, and `APS5_EXACT_DRAW_WRITES=0` widens the color and depth ranges to estimates.
+- Queue 0's packet worker decodes, captures and prepares a draw and hands its recording (`Graphics::Draw` under the GPU lock) to a committer thread in [`DrawPipeline.cpp`](../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp), so the next packet is decoded while the previous draw is recorded. Each queued item carries the guest ranges it will write (`DrawWriteRanges`: written buffers and storage images, color targets with their DCC and CMASK, depth and stencil). A later packet that reads or writes one of those ranges, or that the pipeline can't order, drains it first; labels, submission ends, buffer fills and DMA packets are queued as items instead. With `APS5_PIPELINE_DISPATCH=1` (off by default), a `DISPATCH_DIRECT` whose dispatch-cache entry hits with a recipe is queued as an item too, carrying the dispatch's written buffers and storage images (`DispatchWriteRanges`); the capture and the cache lookup stay on the worker and the recipe is recorded on the committer. A dispatch still drains when its lookup misses, when what it reads overlaps a write still pending, when the hit is verified against data or when its writes cannot be ranged (bindless access, GDS, fault buffer). An indirect draw resolved on the CPU (its records read by the worker) drains only when its records or its count overlap a queued write; the records it draws inline drain first, and its last drawn record is queued like a direct draw (`APS5_NO_PIPELINED_INDIRECT=1` drains at every indirect draw). An exception thrown by a commit is rethrown on the worker at its next enqueue or drain, as an inline draw error would be. On by default; `APS5_PIPELINED_DRAWS=0` records every draw inline, and `APS5_EXACT_DRAW_WRITES=0` widens the color and depth ranges to estimates.
 - A dispatch's resource build runs stage A (binding plan, buffers, descriptor set) without the GPU lock and stage B (image lookups) under it. Between them `VulkanDevice::presync` waits, still without the lock, for recorded work that writes a surface stage B would read on the CPU and for recorded work that writes the DCC keys of an image the dispatch binds (`ShaderResources::PresyncSurfaces`), so the locked `WaitForKeyWriters` finds nothing pending to synchronize with. A key range is waited for only when recorded work writes it, the key-store memo does not give its value (`DccKeyWritersPending`, without the mutex) and the pending stores do not give it either (`DccKeyWriterNeedsSync`, under the mutex, the same test `WaitForKeyWriters` makes before it synchronizes). Stage A's own key scan runs before that wait, and stage B compares it with the keys it reads under the lock as before. `APS5_NO_DCC_PRESYNC=1` leaves the key ranges out; `APS5_NO_PRESYNC=1` disables the whole pre-sync.
 - `APS5_DRAW_PIPELINE=1` (off by default, meant with `APS5_PIPELINED_DRAWS=32 APS5_PIPELINE_DISPATCH=1`) takes more of a draw off the worker. A `DrawFinisher` thread runs the second half of a direct pipelined draw (stage materialization, the draw cache insert and the hand-off to the committer) while the worker reads the next packets; the worker drains it before the next draw's cache lookup, before packets other than register writes and draws, and before guest reads, and finishes in place a draw whose stages may write memory (`ProgramWritesMemory`) or write through the BDA page table. The committer skips the fragment-output validation and storage-image layer scans whose inputs match its last commit (`CommitTrims`), and a resource or storage image proved current keeps its proof for the rest of the collect epoch until `GuestMemory::BreakProofs` (a CPU write, a write-back, a recorded write) moves `ProofSerial`. Color metadata passes go through the pipeline with their write ranges (`PipelinedColorMetadataPassWrites`) instead of draining it. A data-only hit whose shape entry belongs to an older draw replaces that entry in place at the second sight of the same read user words. On Linux the main image's pages get a page table entry, and capture pages are pooled across threads. `APS5_VERIFY_DRAW_PIPELINE=1` runs a full check next to 1 in 64 reused proofs and prints `[epoch-proofs]` counts.
 - The shader registry maps a code address to every header registered for that code, in registration order. Static, graphics and rectangle ABI resolution pick the header at the bound address (or one equal to it, `SameHeader`, which also takes a hull header fused by `sceAgcFuseShaderHalves` (type 3) as the registered back half (type 7) it copies, the fused registers aside; graphics ABI resolution then uses the fused header's shader registers); draws and dispatches pick the program by the stage's binary type (`RegisteredProgram`), and a front entry matching both type 2 and type 4 throws. Within a type the last registration wins; re-registering an identical earlier header makes its snapshot current again without preparing it again, and changed code drops the older headers.
 - The snapshot is published as pending. `SourceHandleFor`, `InvocationFor` and `ShaderPreparationTransaction::Edit` / `Read` wait for the pending job before reading `PreparedShaders`, and rethrow its failure. `APS5_SYNC_SHADER_PREPARE=1` prepares on the registering thread instead.
-- `APS5_LAZY_SHADER_PREPARE=1` retains registration validation and decoding but discards the temporary plan without queueing preparation. The snapshot is deferred, not pending; draws and dispatches prepare and cache it on first use. Explicit ABI resolution still prepares its requested stages. This opt-in mode takes precedence over synchronous registration preparation and trades background CPU/memory use for possible first-use stalls; disk caches and shader output are unchanged.
-- On devices with graphics pipeline libraries (`SpirvTarget::registrationModules`), a vertex or pixel artifact is emitted in registration form: the buffer V# words, image modes, swizzles and mip ranges, depth-compare state, export mappings and vertex component selectors it used to specialize on per draw are read at run time (image `ResourceMetadata` and a few state dwords in the shader data), descriptor heaps keep every element in place (an unused one gets a null or placeholder descriptor), and the pixel stage's bindings live in descriptor set 1 so each stage's library depends only on its own set layout (`INDEPENDENT_SETS`). An artifact above `registrationWordLimit` SPIR-V words is re-emitted specialized, and `CompiledShaderArtifact::registrationModule` records which form it has. For artifacts in registration form, `RegistrationResult` materializes the module once, and `PrebuildStageLibrary` builds its pre-rasterization or fragment-shader library on a separate one-thread pool (`APS5_PREBUILD_THREADS`) with a fixed default state, pairing it with a stub stage. A later draw with that state finds both libraries in the store and only links.
+- `APS5_LAZY_SHADER_PREPARE=1` retains registration validation and decoding but discards the temporary plan without queueing preparation. The snapshot is deferred, not pending; draws and dispatches prepare and cache it on first use. A compute or pixel stage's explicit ABI resolution (`ResolveShaderAbi`) plans the stage with the ABI's state, records the ABI and leaves its preparation to the shader's first use, which prepares it with that state (`PreparedShaders::deferredAbis`), so a shader that never draws or dispatches stays unprepared; a graphics-stage ABI is still prepared when it is resolved. This opt-in mode takes precedence over synchronous registration preparation and trades background CPU/memory use for possible first-use stalls; disk caches and shader output are unchanged.
+- On devices with graphics pipeline libraries (`SpirvTarget::registrationModules`), a vertex or pixel artifact is emitted in registration form: the buffer V# words, image modes, swizzles and mip ranges, depth-compare state, export mappings and vertex component selectors it used to specialize on per draw are read at run time (image `ResourceMetadata` and a few state dwords in the shader data), descriptor heaps keep every element in place (an unused one gets a null or placeholder descriptor), and the pixel stage's bindings live in descriptor set 1 so each stage's library depends only on its own set layout (`INDEPENDENT_SETS`). An artifact above `registrationWordLimit` SPIR-V words is re-emitted specialized, and `CompiledShaderArtifact::registrationModule` records which form it has. For artifacts in registration form, `RegistrationResult` materializes the module once, and `PrebuildStageLibrary` builds its pre-rasterization or fragment-shader library on a separate one-thread pool (`APS5_PREBUILD_THREADS`) with a fixed default state, pairing it with a stub stage. A later draw with that state finds both libraries in the store and only links. Ahead-of-time dispatch resolution (`resolveGroupAhead` in [`DispatchAhead.cpp`](../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp)) scans the upcoming dispatch run up to the next wait or synchronization packet, moves still-pending registered compute shaders to the front of the registration preparation queue (`PrioritizeRegistrationPreparation`) and queues preparation (`SubmitRegistrationPreparation`) for registered compute shaders that have no prepared entries yet (such as under `APS5_LAZY_SHADER_PREPARE=1`) with the previewed register state and entry offset; when a dispatch resolved ahead misses the dispatch cache in [`Dispatch.cpp`](../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp), `PrebuildComputePipeline` is submitted to the same `APS5_PREBUILD_THREADS` pool so the compute `VkPipeline` is built before the worker reaches the packet.
 - A draw or dispatch whose state matches no artifact prepared at registration (a title that builds its static ABI state itself, without `sceAgcDriverResolve*Abi`) gets one prepared at use by `SourceHandleFor` or `InvocationFor`, logged once per artifact and kept in the snapshot for the next use.
 - A stage that `sceAgcDriverResolve*Abi` cannot prepare for the state the title creates its pipeline with (a compute shader that calls user-data pointers, a descriptor the resource plan rejects) is left to its first use like a stage deferred at registration: `ResolveShaderAbi` and `PrepareGraphicsStages` catch the failure inside their own preparation transaction, so the `ShaderPreparationScope` the title's call runs in still commits, log it once per shader, mark the shader deferred and record the ABI key, so a repeated call prepares nothing; `ResolvePreparedGraphics` skips a deferred stage's rectangles until a draw has prepared it. A draw or dispatch that cannot prepare the stage either fails as before. Driver failures, `ProcessShutdown` and a failure stored by the shader's registration preparation still propagate from the ABI call.
 - A compute shader whose `s_swappc_b64` calls a user-data pointer cannot be linked at registration, because the callee's address is only known at dispatch. `InvocationFor` in [`ShaderRegistry.cpp`](../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) reads each callee from guest memory, appends one copy per call after the caller (`LinkUserDataCalls`) and prepares that linked code, so a different callee gets its own prepared entry.
@@ -145,7 +145,7 @@ flowchart LR
 - Guest memory reaches the GPU through host imports (`VK_EXT_external_memory_host`) where the driver accepts them, and through copies otherwise ([`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp)). A registered range larger than the import window (64 MiB) is imported per window for buffer and fill accesses and whole for an address-based build. Live imports stay under a budget, with the least recently used import retired first (see TechnicalDebt, Host import windows and budget).
 - A guest protect or unmap that overlaps a plain host-pointer import retires the whole import before changing the guest range (`WaitForLeasesAndImports` in [`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp)). Later accesses import surviving registered ranges again; imports never keep the pages across a cut pinned in a trimmed state. `GuestAllocations::Range::backingSerial` distinguishes the original pages from replacements: untouched pieces of a split keep their serial, newly mapped or protected pieces get a fresh one, and every span passed to `RequireUnpinned` (including the other mappings of remapped direct memory and the resident runs touched by a 2 MiB unmap or remap) gets a fresh serial when the mutation ends.
 - A draw binds its vertex and index ranges in place from a host import, except with NVIDIA's Windows driver, which reads a host import of guest memory far slower than a buffer it allocated (Astro Bot at Crash Site on an RTX 5070 Ti: 164 against 45 ms of draws per frame), so they are copied there (`DrawInputsInPlaceUsable`, `Context::drawInputsInPlace`). `APS5_DRAW_INPUTS_IN_PLACE=1` binds them in place and `APS5_NO_DRAW_INPUTS_IN_PLACE=1` copies them on any device; the second wins.
-- On Windows, a host import of private `MEM_WRITE_WATCH` memory (singly mapped direct memory) stays on `GetWriteWatch` when `ProbeImportWriteProtection` shows the driver reports nothing written after the second GPU read and a GPU write, and a CPU store is collected (`decideImportWatch`). The driver marks every page of such an import written, asynchronously, until a GPU use of it completes (a read on the settle queue ends it even while main-queue work that used the import first is still running, and the first use of an earlier import of the same pages after that read marks nothing), so `settleImport` in [`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) copies 4 bytes out of the new import on a second queue of the graphics family, or on a queue of another copy-capable family when the graphics family has only one (`Context::settleQueue`, own pool and mutex) inside `ImportWatched`'s window and waits for it, for imports of 1 MiB or more; the main queue can't be used there because `importAllocation` holds the imports lock and `GpuMutex` comes before it in the lock order. A smaller import is compared when it is made, so a title that maps, imports and unmaps a small buffer around every submission does not block its mapping thread. Its 4-byte read is queued instead: the next import lookup that holds `GpuMutex` while the imports match the registry (`settleUnwatchedImports`) records the queued reads into one batch on the settle queue, and once the batch's fence has signalled a later lookup returns the import's whole 64 KiB blocks to the write watch (`GuestMemory::Rewatch` drops their marks and stamps every block as a CPU store), unless a live storage image overlaps them. Such an import stays compared: an image that took its generation before the stamp would take the stamp for a CPU store over the results it produces after it, and drop them. A settled import whose range had already left the watch returns the same way, and an import retired while its read is in flight is kept with that batch and freed once the batch has completed, without waiting for it; a guest unmap of its memory waits for the batch instead. `APS5_NO_DEFERRED_SETTLES` (any value) keeps every import under 1 MiB compared. Imports through a section alias keep tracking on the guest views, and every other Windows host import is compared. A device without such a queue keeps the comparisons. On Linux the settle queue is made when the device imports dma-buf memory, and every dma-buf import of 1 MiB or more is settled right after it is made, for another reason: the kernel maps an import's pages for the GPU at the first submission that uses it, which took about 2 s for a 3 GiB import on RADV and held up the title's frame. The import's buffer is shared with the settle queue's family instead of aliased, since a sparse import is bound to many memory objects.
+- On Windows, a host import of private `MEM_WRITE_WATCH` memory (singly mapped direct memory) stays on `GetWriteWatch` when `ProbeImportWriteProtection` shows the driver reports nothing written after the second GPU read and a GPU write, and a CPU store is collected (`decideImportWatch`). The driver marks every page of such an import written, asynchronously, until a GPU use of it completes (a read on the settle queue ends it even while main-queue work that used the import first is still running, and the first use of an earlier import of the same pages after that read marks nothing), so `settleImport` in [`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) copies 4 bytes out of the new import on a second queue of the graphics family, or on a queue of another copy-capable family when the graphics family has only one (`Context::settleQueue`, own pool and mutex) inside `ImportWatched`'s window and waits for it, for imports of 1 MiB or more; the main queue can't be used there because `importAllocation` holds the imports lock and `GpuMutex` comes before it in the lock order. A smaller import is compared when it is made, so a title that maps, imports and unmaps a small buffer around every submission does not block its mapping thread. Its 4-byte read is queued instead: the next import lookup that holds `GpuMutex` while the imports match the registry (`settleUnwatchedImports`) records the queued reads into one batch on the main queue, with barriers ordering earlier and later writes around the reads. Submission does not wait on the CPU, and once the batch's fence has signalled a later lookup returns the import's pages to the write watch (`GuestMemory::Rewatch` drops the marks of every 64 KiB block they touch and stamps those blocks as a CPU store; the rest of a block the import only partly covers stays unwatched), unless a live storage image overlaps those blocks. Such an import stays compared: an image that took its generation before the stamp would take the stamp for a CPU store over the results it produces after it, and drop them. A settled import whose range had already left the watch returns the same way, and an import retired while its read is in flight is kept with that batch and freed once the batch has completed, without waiting for it; a guest unmap of its memory waits for the batch instead. `APS5_NO_DEFERRED_SETTLES` (any value) keeps every import under 1 MiB compared. Imports through a section alias keep tracking on the guest views, and every other Windows host import is compared. A device without such a queue keeps the comparisons. On Linux the settle queue is made when the device imports dma-buf memory, and every dma-buf import of 1 MiB or more is settled right after it is made, for another reason: the kernel maps an import's pages for the GPU at the first submission that uses it, which took about 2 s for a 3 GiB import on RADV and held up the title's frame. The import's buffer is shared with the settle queue's family instead of aliased, since a sparse import is bound to many memory objects.
 
 ### Log output
 
diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md
index 26278a34ee..377205720b 100644
--- a/docs/dev/BUILD.md
+++ b/docs/dev/BUILD.md
@@ -12,7 +12,7 @@ ctest --test-dir build-relinker --output-on-failure
 
 Python must be found during CMake configuration for Python tests to be registered. List registered tests with `ctest --test-dir build-relinker -N` and look for `input_magic`, a Python-backed relinker test. If automatic discovery fails, add `-DPython3_EXECUTABLE="C:/path/to/python.exe"` to the configure command, using the path to your Python interpreter, then list the tests again.
 
-This mode builds the conversion tool and its tests on Linux, Windows and macOS, including Apple Silicon. macOS uses AppleClang from the Xcode command-line tools. Windows uses MinGW-w64 GCC with C++20 support and accepts distributions with static or shared runtimes; the full build also requires the exception support described below. The executable is `build-relinker/core/relinker/relinker` (`relinker.exe` on Windows with Ninja).
+This mode builds the conversion tool and its tests on Linux, Windows and macOS, including Apple Silicon. macOS uses AppleClang from the Xcode command-line tools (`xcode-select --install`); CMake and Ninja come from Homebrew (`brew install cmake ninja`). Windows uses MinGW-w64 GCC with C++20 support and accepts distributions with static or shared runtimes; the full build also requires the exception support described below. The executable is `build-relinker/core/relinker/relinker` (`relinker.exe` on Windows with Ninja).
 
 The output is x86-64: Linux ELF by default, Windows PE with `--windows` or Mach-O with `--macos` ([usage](../user/USAGE.md#input-and-conversion)). Converted games need system libraries built for the target OS and a compatible x86-64 host. This mode does not build those libraries, and releases ship them for Linux and Windows only. Tests inspect all three output formats; execution checks run only on their compatible hosts.
 
@@ -31,9 +31,14 @@ git submodule update --init --recursive
 - Linux: GCC, G++, binutils. SDL's X11 backend requires X11 and Xext development headers (`libx11-dev` and `libxext-dev` on Debian/Ubuntu). SDL's Wayland backend requires the Wayland, xkbcommon and EGL development files (`libwayland-dev`, `libxkbcommon-dev` and `libegl-dev` on Debian/Ubuntu; `wayland-devel`, `libxkbcommon-devel` and `mesa-libEGL-devel` on Fedora), and `libdecor-0-dev` (`libdecor-devel`) for window decorations on GNOME. SDL loads both backends at run time and prefers Wayland when `WAYLAND_DISPLAY` is set; `SDL_VIDEODRIVER=x11` selects X11 (XWayland). Titles that bundle their own SDL read `SDL_VIDEODRIVER` too, and some of them fail to start with `x11`. Without the Wayland files configuration still succeeds, and the build uses X11 only. Audio output needs SDL's PipeWire, PulseAudio or ALSA backend, built from their development files (`libpipewire-0.3-dev`, `libpulse-dev` and `libasound2-dev` on Debian/Ubuntu; `pipewire-devel`, `pulseaudio-libs-devel` and `alsa-lib-devel` on Fedora). SDL loads them at run time. Without any of them SDL keeps only its silent dummy and disk drivers, so configuration fails.
 - Fedora: if CMake reports `Could NOT find Threads`, install `glibc-static` and `libstdc++-static` with `sudo dnf install glibc-static libstdc++-static`, then rerun configuration. The project enables static executable linking, and FFmpeg's thread check needs these libraries.
 - Windows: x86-64 MinGW-w64 GCC with POSIX threads. The compiler must provide DWARF exceptions with `-fno-asynchronous-unwind-tables`, or SEH exceptions for System V ABI functions; CMake checks these capabilities. WinLibs GCC 15.2.0 (`x86_64-ucrt-posix-seh`, release [`15.2.0posix-14.0.0-ucrt-r7`](https://github.com/brechtsanders/winlibs_mingw/releases/tag/15.2.0posix-14.0.0-ucrt-r7)) uses DWARF. [MSYS2 UCRT64 GCC](https://packages.msys2.org/packages/mingw-w64-ucrt-x86_64-gcc) 16.2.0-6 uses SEH. Add the selected toolchain's `bin` directory to `PATH` before configuring.
-- Windows antivirus software can quarantine the executables that the relinker tests create in the temp directory, which fails `optional_plt`, `empty_tls`, `windows_address_space` and `windows_icon`. Set `TEMP` and `TMP` to a directory the scanner excludes before running `ctest`.
+- Windows antivirus software can block or quarantine the executables that the relinker tests create and run, which fails `optional_plt`, `empty_tls`, `windows_address_space`, `windows_bss`, `windows_fixed_base` and `windows_icon`. CTest sets `TMPDIR`, `TEMP` and `TMP` of the relinker tests to `core/relinker/test-temp` in the build directory, so setting them before running `ctest` does not move these files; add that directory to the scanner's exclusions instead.
 - Bitdefender Advanced Threat Defense hooks Windows calls that `sceKernelRaiseException` makes while its target thread is suspended. When the target is suspended inside ntdll's exception dispatch while it holds an ntdll lock, the hook waits for that lock and `guest_raise_exception` hangs until its timeout. A scanning exception for the build directory does not prevent it; add `guest_raise_exception_tests.exe` to the Advanced Threat Defense exceptions.
 - FFmpeg binaries are downloaded during configuration unless `FFMPEG_PREBUILT_DIR` is set. With the WinLibs CMake, the download fails with status 60 (`SSL peer certificate or SSH remote key was not OK`) unless `SSL_CERT_FILE` names a CA bundle, for example `C:\Program Files\Git\ucrt64\etc\ssl\certs\ca-bundle.crt` from Git for Windows 2.56 and later (`mingw64` instead of `ucrt64` before 2.56), as in CI.
+- Windows: libusb's `version_describe.h` is generated by `build-aux/gen-describe.ps1`, which CMake runs with `-ExecutionPolicy Bypass`. An execution policy set by Group Policy (`MachinePolicy` or `UserPolicy` in `Get-ExecutionPolicy -List`) takes precedence over that switch ([about_Execution_Policies](https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-5.1)); with `Restricted` or `AllSigned` the build stops at `version_describe.h` with `running scripts is disabled on this system`. The script only starts `build-aux/gen-describe.sh` with the `bash.exe` of Git for Windows, so a `.cmd` file that runs the shell script directly can replace PowerShell for this step without changing the policy. CMake passes it the `.ps1` path as the fifth argument and the source and output paths as the sixth and seventh; configure with `-DLIBUSB_POWERSHELL_EXECUTABLE=<path of the .cmd file>`:
+
+  ```bat
+  @"C:\Program Files\Git\bin\bash.exe" "%~dpn5.sh" %6 %7
+  ```
 
 ## Web converter releases
 
@@ -82,6 +87,8 @@ If configuration reports `Could NOT find Python3` or selects an unusable interpr
 cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++ -DPython3_EXECUTABLE="C:/path/to/python.exe"
 ```
 
+The documentation runs the Python tools as `python3`. With the python.org installer for Windows, which provides `python.exe` and the `py` launcher but no `python3.exe`, `python3` resolves to the Microsoft Store alias in `WindowsApps`, which prints `Python was not found` and exits with code 9009 (49 in Git Bash). Installs that provide `python3.exe`, such as the Python Install Manager, are not affected. In that case run these commands with `python` or `py -3`, for example `py -3 tools/check_conventions.py --base origin/main`.
+
 If `gen-describe.ps1` fails while generating libusb's `version_describe.h`, check the Bash path printed in the build output. A WindowsApps or System32 `bash.exe` can launch WSL and fail with `WSL_E_DEFAULT_DISTRO_NOT_FOUND` when no distribution is installed. Install Git for Windows with Bash, or use Portable Git, and put its `cmd` and `usr\bin` directories on `PATH` before retrying the build. Use Bash and `cygpath.exe` from the same Git installation.
 
 After `cmake --build build --target libs --parallel` succeeds, copy the toolchain's runtime DLLs beside the patched libraries:
@@ -157,7 +164,7 @@ On Windows MinGW frees `thread_local` objects before their destructors run, so t
 
 ## Compute pipeline replay
 
-Build `agc_compute_pipeline_replay` in the full build with `-DANYPS5_ENABLE_SPIRV_TOOLS=ON`; replay validates the captured module before calling Vulkan. Set `APS5_DUMP_COMPUTE_PIPELINES` to a dedicated empty directory before starting a title to save each uncached compute pipeline's final SPIR-V, descriptor layouts, push constant ranges, specialization values, subgroup size and creation flags before compilation. Files are named `compute-<identity>/capture.aps5cp`; identical records are deduplicated. Capture stops with an error at 128 records, 256 MiB total or 36 MiB per record (at most 8,388,608 SPIR-V words, or 32 MiB of shader code). Capture files contain shader code and device metadata, but no guest buffers or textures; review them before sharing.
+Build `agc_compute_pipeline_replay` in the full build with `-DANYPS5_ENABLE_SPIRV_TOOLS=ON`; replay validates the captured module before calling Vulkan. Set `APS5_DUMP_COMPUTE_PIPELINES` to a dedicated empty directory before starting a title to save each uncached compute pipeline's final SPIR-V, descriptor layouts, push constant ranges, specialization values, subgroup size and creation flags before compilation. Files are named `compute-<identity>/capture.aps5cp`; identical records are deduplicated. The pipelines of the start-up f32 denormal flush probe are not captured. Capture stops with an error at 128 records, 256 MiB total or 36 MiB per record (at most 8,388,608 SPIR-V words, or 32 MiB of shader code). Capture files contain shader code and device metadata, but no guest buffers or textures; review them before sharing.
 
 Set `APS5_DUMP_COMPUTE_MIN_WORDS` to capture only modules at or above that SPIR-V word count, for example `100000` when investigating large NVIDIA compilations. The default is `0` (all modules); values outside `0` through `8388608` fail. The filter applies only when capture is enabled.
 
@@ -186,6 +193,19 @@ build/core/libs/prx/libSceAgcDriver/agc_pm4_replay submits
 
 On Windows use `agc_pm4_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_driver_pm4_replay` captures submissions made with the libSceAgc command builders through the driver and checks the index, the held waits, the conditional ranges, the dwords, the decode and the outcome of each wait, then checks hand-made captures: each release route; a store of another queue to the awaited bytes that entered before or after the store of the waiting queue (unknown); the label history limit, with the stores after the label on the waiting queue or on another queue; a fill the history does not keep; a store in an earlier submission overwritten later; later stores, rejected values and a missing rewind tail (unreleased); the six captures of the reviews (a two-queue deadlock, a store of 0 behind a released wait on another queue, with and without that wait held at submit, and labels pushed out of the history by stores of another queue), none of whose waits may be released except the one held at submit; five groups of waits in eight submission orders with identical outcomes; an index without the held and conditional columns; corrupt captures; then a failed write. `agc_driver_pm4_replay_tool` runs the tool on the driver capture and checks its exit codes and report.
 
+## Frame capture and replay
+
+Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps), read once the submissions already accepted have completed (a recorded submission, flip or suspend point reaches the driver before the recorder takes its next call, so that wait covers every call recorded before the delta); an allocation the registry gained after the snapshot is recorded there as a new range with its nonzero 64 KiB blocks. A submission ends a frame only when it flips itself, not when another thread's submission flipped while it was being submitted. Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk.
+
+`agc_frame_replay <capture> [--no-pace] [--no-release] [--release-after-ms <n>] [--no-synthesize] [--strict] [--dump <address>:<bytes>:<file>]... [--frames <dir>]` maps the captured ranges at their addresses and registers them with their access (a range the replaying process already maps writable, such as the driver's fixed memory, is only refilled, and a non-GPU range it uses itself is skipped and counted), repeats the registrations, then replays the calls of each captured thread on a thread of its own, started in captured order. Before a call that hands work to the GPU it waits until no more submissions are in flight than when the title made it (`--no-pace` turns this off). Titles release GPU waits from threads that never call the driver, so when the driver completes nothing for 3 ms the replay reads the waits its queues are blocked on (`AgcDriverAwaitedWaits`) and writes the next recorded CPU value of the awaited dword that satisfies the compare, else the last earlier one, else a value derived from the reference (`--no-synthesize` turns this last step off). It prints one JSON line with the frame count and times, the submissions, the pacing wait, the released waits and how many were derived, the submissions that never completed and, for captures with reference images, the share of identical pixels and the largest channel difference of the replayed display buffers (`--frames` writes both images). Effects that depend on timing (temporal antialiasing, particles) make pixels differ, so expect a visual match rather than identical frames. Replay times follow the GPU clock state: lock the clocks (`nvidia-smi -lgc`, `-lmc`) when comparing two drivers.
+
+```sh
+cmake --build build --target agc_frame_replay
+build/core/libs/prx/libSceAgcDriver/agc_frame_replay capture
+```
+
+On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files), and `agc_driver_frame_capture_eop` reserves and submits six EOP flips with `APS5_FRAME_CAPTURE_FRAMES=3` and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each, then that a flipping submission on another thread leaves this thread's flip count unchanged, and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, the second from a block committed during the capture, replays them in `agc_frame_replay` and compares the copies.
+
 ## Pipeline statistics
 
 Set `APS5_PIPELINE_STATS=1` to capture and print driver statistics for each newly created graphics or compute pipeline. This requires `VK_KHR_pipeline_executable_properties` and `pipelineExecutableInfo`; an unsupported device fails with an error. Statistic names and units are driver-specific. Capturing statistics can increase pipeline compilation cost. The setting is disabled by default.
@@ -196,11 +216,11 @@ On a device that supports `VK_EXT_device_fault`, the first `VK_ERROR_DEVICE_LOST
 
 ## Worker sampler
 
-Set `APS5_SAMPLE_WORKER=<file>` to sample queue worker 0 every millisecond (in practice every timer tick). Every 20 s and at exit it writes `<file>`, one `module offset self inclusive` line per sampled address, and `<file stem>.collapsed.txt`, the worker's whole stacks in the collapsed format that speedscope.app and flamegraph.pl read: one `frame;...;frame count` line per distinct stack, root first, each frame as `module+0xRVA`. A walk that ends before the thread's root starts with `[truncated]`. The `#` lines give the samples, the walk depth (64 frames), the truncated walks, the mean and longest time the worker was suspended, and the size and PE timestamp of each module, to check the binary a file is symbolized against. A frame with `.pdata` is stepped by `RtlVirtualUnwind`; any other frame by its DWARF record in `.ehfram`, the unwind data the libraries are built with. Those steps read only inside the worker's stack, and a module is indexed after the worker resumes, the first time a walk meets it.
+Set `APS5_SAMPLE_WORKER=<file>` to sample queue worker 0 every millisecond (in practice every timer tick). Every 20 s and at exit it writes `<file>`, one `module offset self inclusive` line per sampled address, and `<file stem>.collapsed.txt`, the worker's whole stacks in the collapsed format that speedscope.app and flamegraph.pl read: one `frame;...;frame count` line per distinct stack, root first, each frame as `module+0xRVA`. A walk that ends before the thread's root starts with `[truncated]`. The `#` lines give the samples, the walk depth (64 frames), the truncated walks, the mean and longest time the worker was suspended, and the size and PE timestamp of each module, to check the binary a file is symbolized against. A frame with `.pdata` is stepped by `RtlVirtualUnwind`; any other frame by its DWARF record in `.ehfram`, the unwind data the libraries are built with. Those steps read only inside the worker's stack, and a module is indexed after the worker resumes, the first time a walk meets it. `python tools/symbolize_samples.py <file stem>.collapsed.txt --libs <libs directory>` names each frame from the COFF symbols of the module that ran, or from its export table when it has none, and leaves a module unsymbolized when its size or timestamp differs from its `# module` line or when it has none (`--unverified` symbolizes it anyway); `--since <earlier copy>` keeps only the samples taken after that copy, `--out` writes the named stacks and `--demangle` uses `c++filt`. Given `<file>`, it lists functions by self and by inclusive samples, where a function's inclusive count is the sum of its addresses' and overcounts a function that is on one stack more than once.
 
 `APS5_SAMPLE_COMMITTER=<file>` samples queue 0's draw committer the same way and writes the same two files. The committer records the draws the worker hands over (`APS5_PIPELINED_DRAWS`), so when the worker's stacks wait in `DrawPipeline::Enqueue`, its stacks show what bounds the frame. It starts with the first pipelined draw; with `APS5_PIPELINED_DRAWS=0` nothing is sampled.
 
-`APS5_SAMPLE_THREADS=<file>` samples every thread of the process every 2 ms and writes the 40 hottest addresses of each busy thread to `<file>`, 12 frames deep and through `.pdata` only. The samplers exist only on Windows; the addresses are symbolized offline, for example with `nm` on the `.prx`.
+`APS5_SAMPLE_THREADS=<file>` samples every thread of the process every 2 ms and writes the 40 hottest addresses of each busy thread to `<file>`, 12 frames deep and through `.pdata` only, under a `thread <id> samples <n>` line per thread and with the same `# module` lines. The samplers exist only on Windows; the addresses are symbolized offline with `tools/symbolize_samples.py`, which adds up all threads or, with `--thread <id>`, keeps one.
 
 ## Performance trace
 
@@ -228,7 +248,7 @@ The switch combines with `APS5_TRACE_FRAMES` or `APS5_TRACE_SECONDS`. The interv
 
 Set `APS5_TRACE_BENCH=1` together with `APS5_TRACE_SUMMARY_EVERY` to also keep every interval's frame times for a benchmark report. At each interval the presenter hands the kept intervals to a writer thread, which formats and compresses the file and rewrites `aps5-bench-<commit>-<pid>.json.gz` in `APS5_TRACE_DIR` or the working directory: one JSON object with `format` (`aps5-bench/1`), the identity fields of the summary line (`commit`, `dirty`, `env`, `gpu`, `driver`, `os`, `cpu`, `cpu_threads`, `memory_mib` and, with `param.json`, `title_id`, `title` and `content_version`), `intervals_dropped` and `intervals`. Each interval has `start_s`, `end_s`, `first_present`, `resolution`, `gpu_busy_ms` (the interval's total) and `frame_us`, the whole microseconds between consecutive presents. The file keeps the last 240 intervals; `intervals_dropped` counts older ones it no longer holds. Any other value, or the switch without `APS5_TRACE_SUMMARY_EVERY`, fails the first present. The file is written to `<name>.tmp` and then moved over the previous one, so a crash or kill during a rewrite leaves the last complete report. Only the newest report waits for the writer: one handed over while an older one is still pending replaces it. The frame times cost 4 bytes per present in memory.
 
-`python tools/trace_digest.py aps5-summary.jsonl` prints the interval lines of such a file as one row per interval (frame p50, p90, p99, max, GPU busy per present, the busiest queue worker and the largest phase) and a text sparkline of the frame p99 and of the GPU busy time; lines of window captures in the file are skipped, and a change of commit, environment, GPU, driver or OS between intervals is reported. `--json` prints the rows as JSON.
+`python tools/trace_digest.py aps5-summary.jsonl` prints the interval lines of such a file as one row per interval (frame p50, p90, p99, max, GPU busy per present, the busiest queue worker and the largest phase) and a text sparkline of the frame p99 and of the GPU busy time; lines of window captures in the file are skipped, and changes to build, environment, host, resolution or title metadata between intervals are reported. `--json` prints the rows, the first interval's identity and the indices of identity changes as JSON.
 
 With `APS5_TRACE_SUMMARY_EVERY` set, the recorder writes a timestamp pair per batch for the whole run and every `PerformanceTimer` scope adds its time to the thread's totals, two clock reads per scope. A thread's totals are read while it runs, so a scope that straddles an interval boundary is counted in one interval or the other.
 
diff --git a/docs/dev/CONVENTIONS.md b/docs/dev/CONVENTIONS.md
index 87c674dac4..fdf0b83768 100644
--- a/docs/dev/CONVENTIONS.md
+++ b/docs/dev/CONVENTIONS.md
@@ -20,7 +20,7 @@ There's no need to add image files to the repository. You can add images to the
 
 Host code that writes into guest memory through the kernel or a native library must hold a `GuestArena::HostWrite` ([GuestArena.hpp](../../core/libs/prx/libc/include/GuestArena.hpp)) over the destination range for the whole write. This covers file reads (`ReadFile`, `read`, `pread`), socket receives, `DeviceIoControl` and other calls that fill a caller's buffer.
 
-The write watch can leave guest pages read-only between collections: every watched page on macOS, and stable resident runs of at least 256 KiB on Windows (see the write-watch entries in [debt/libc.md](debt/libc.md)). A kernel-mode write into such a page doesn't fault into the watch. It fails instead, with `EFAULT` on macOS and `ERROR_NOACCESS` on Windows. `HostWrite` opens the pages and makes sure the write is recorded.
+The write watch can leave guest pages read-only between collections: every watched page on macOS, and on Windows the pages of shared views (shared memory, shared file mappings, and direct memory mapped at more than one guest address), which it tracks by write protection (see the write-watch and Windows direct-memory backing entries in [debt/libc.md](debt/libc.md)). A kernel-mode write into such a page doesn't fault into the watch. It fails instead, with `EFAULT` on macOS and `ERROR_NOACCESS` on Windows. `HostWrite` opens the pages and makes sure the write is recorded.
 
 - A write that completes later on another thread (overlapped I/O, completion ports, asynchronous reads) is bracketed where the bytes land, not where the request was issued.
 - Ordinary CPU stores from host C++ code need no bracket: the write watch records them (through a fault where the page is protected).
diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md
index ac824ed4c4..6beedd592e 100644
--- a/docs/dev/ENVIRONMENT.md
+++ b/docs/dev/ENVIRONMENT.md
@@ -1,13 +1,16 @@
 # Environment variables
 
-The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetting`, `MaskFromEnvironment`, `EnvInt`, `GetEnvironmentVariableA`, `GetEnvironmentVariableW` with a wide literal, `configured`, `PipelineSwitch`, `environmentCount` and `addWideString` (the wide names the Windows entry stub reads). This table lists every `APS5_*` and `ANYPS5_*` name it reads, its kind, the value used when it is unset and what it does, one table per library. Regenerate the names with `python3 tools/env_reference.py --table`; the Conventions check fails when a name the code reads has no row here, or a row's name is no longer read.
+The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetting`, `MaskFromEnvironment`, `EnvInt`, `GetEnvironmentVariableA`, `GetEnvironmentVariableW` with a wide literal, `configured`, `PipelineSwitch`, `environmentCount`, `EnvironmentNumber` and `addWideString` (the wide names the Windows entry stub reads). This table lists every `APS5_*` and `ANYPS5_*` name it reads, its kind, the value used when it is unset and what it does, one table per library. Regenerate the names with `python3 tools/env_reference.py --table`; the Conventions check fails when a name the code reads has no row here, or a row's name is no longer read.
 
 ### core/libs
 
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
+| `ANYPS5_JOB_MANAGER_CASE` | string | `core/libs/tests/JobManagerReference.cpp` |  | selects the CPU fixture run by `tools/run_job_manager_reference.py` |
+| `ANYPS5_JOB_MANAGER_HOST` | presence | `core/libs/tests/JobManagerReference.cpp` |  | runs the reference adapter against the host fallback instead of the loaded guest module |
 | `ANYPS5_LOADEXEC_PARENT` | string | `core/libs/tests/GuestLoadExecHost.cpp` |  | variable the Windows entry stub reads; its wide name is built in `core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp` |
 | `ANYPS5_LOADEXEC_TEST_ROOT` | string | `core/libs/tests/GuestLoadExecHost.cpp` |  | directory the load-exec host test reads its guest executable from |
+| `ANYPS5_POSIX_SPAWN_ROLE` | string | `core/libs/tests/GuestPosixSpawn.cpp` |  | role of the test's own copy spawned as a `posix_spawn` child, which exits or sleeps on it and otherwise fails |
 | `ANYPS5_TEST_QUOTED_ARGV0` | presence | `core/libs/tests/GuestLoadExecHost.cpp` |  | makes the load-exec test's first argument one with quotes, a backslash and non-ASCII text |
 | `APS5_EBOOT` | string | `core/libs/tests/GuestSystemExit.cpp` |  | host path of the executable launched for /app0/eboot.bin, defaulting to the running executable |
 | `APS5_SKIP_TIMING_TESTS` | presence | `core/libs/tests/PreciseWait.cpp` |  | treats the timing tests' runner as preempted, so they skip without probing the clock |
@@ -28,6 +31,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_BDA_BYTE_READS` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvBdaRead.cpp` |  | forces one address lookup and byte load per byte for BDA reads instead of a wide dword load |
 | `APS5_BDA_DWORD_STORES` | presence | `core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp` |  | reverts BDA writes to one address store per dword instead of a wide multi-dword store |
 | `APS5_DUMP_IR` | string | `core/shader/recompiler/Recompiler.cpp` |  | hex code address (or all) of the programs whose IR is printed after each front-end pass |
+| `APS5_EXACT_RCP` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp` |  | emits `v_rcp_f32` and `v_rcp_iflag_f32` as the RDNA hardware reciprocal (bit-exact for normal inputs and results) instead of the driver's division; adds about 13k SPIR-V words to each shader that uses them |
 | `APS5_GATHER_CONST` | integer | `core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp` |  | integer every non-depth gather returns in all four texels instead of the sampled value |
 | `APS5_IMAGE_TABLE_KEY_SCAN` | integer | `core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp` | 256 | number of image-table entries the key scan examines |
 | `APS5_IMAGE_TABLE_STRICT` | presence | `core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp` |  | sets image-table materialization to its strict form; 0 leaves it off |
@@ -36,7 +40,9 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_CODE_HASH_KEY` | presence | `core/shader/recompiler/CacheKey.hpp` |  | appends every code word to the cache key instead of hashing the code |
 | `APS5_NO_FAILURE_MEMO` | presence | `core/shader/recompiler/Recompiler.cpp` |  | rebuilds a program whose compilation failed instead of reusing the memoized failure |
 | `APS5_NO_IMAGE_TABLES` | presence | `core/shader/recompiler/Optimization/src/ResourceTracker.cpp` |  | disables image tables, leaving table-loaded descriptors unplanned |
+| `APS5_NO_MASKED_RESULT_MEMO` | presence | `core/shader/recompiler/Recompiler.cpp` |  | materializes every result memo miss instead of patching the buffer descriptors, user data and flattened SRT of a cached result whose snapshot differs only in those words |
 | `APS5_NO_PERF_DISK_PLANS` | presence | `core/shader/recompiler/Recompiler.cpp` |  | disables the disk cache of planning results |
+| `APS5_NO_PERF_DOMINATOR_TREE` | presence | `core/shader/recompiler/ControlFlow/src/Structurizer.cpp` |  | computes the structurizer's dominator and post-dominator sets with the set fixpoint instead of a dominator tree, walks every selection construct instead of testing its members by dominance, and tests every block against each construct when checking the structured constructs instead of walking the construct |
 | `APS5_NO_PERF_DOM_INTERSECTION` | presence | `core/shader/recompiler/ControlFlow/src/Structurizer.cpp` |  | computes dominator intersections into a fresh vector instead of intersecting in place |
 | `APS5_NO_PERF_ITERATION_SELECTION` | presence | `core/shader/recompiler/ControlFlow/src/Structurizer.cpp` |  | recomputes the post-dominator sets when finding a loop's iteration-selection merge instead of reusing them |
 | `APS5_NO_RESULT_MEMO` | presence | `core/shader/recompiler/Recompiler.cpp` |  | materializes a fresh result for every recompile instead of reusing the result memo |
@@ -46,12 +52,14 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_WINDOW_NARROWING` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp` |  | indexes every slot of the shader's vector window instead of only the slots the program uses |
 | `APS5_PROBE` | string | `core/shader/recompiler/Translation/src/DispatchInstructions.cpp` |  | pc:vgpr[:shift] probe that copies that VGPR into v255 after the instruction so image stores write it as a per-lane trace |
 | `APS5_RAYTRACING` | string | `core/shader/recompiler/Translation/src/DispatchInstructions.cpp` |  | selects the image_bvh_intersect_ray behaviour: strict throws and miss writes 0xffffffff |
+| `APS5_RESULT_MEMO_MB` | integer | `core/shader/recompiler/Recompiler.cpp` | 256 | MiB the result memos of all shader sources may hold before the least recently used results are dropped (0 keeps them until their set evicts them) |
 | `APS5_SAVEEXEC_WRITE_FIRST` | presence | `core/shader/recompiler/Translation/src/ControlFlowInstructions.cpp` |  | writes the saved exec to the destination before reading the source in s_*_saveexec |
 | `APS5_SINGLE_LANE` | string | `core/shader/recompiler/Recompiler.cpp` |  | hex code addresses (comma separated, or all) of wave64 programs kept at one guest lane per invocation |
 | `APS5_SRT_DEBUG` | presence | `core/shader/recompiler/Optimization/src/RequestMemoryView.cpp` |  | prints extra SRT descriptor-walk debug output, such as guest reads outside the request memory |
 | `APS5_TRACE_BDA` | presence | `core/shader/recompiler/Optimization/src/ResourceTracker.cpp` |  | prints the first few accesses that make a program take the address-based path |
 | `APS5_TRACE_BUFFER_WRITTEN` | presence | `core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp` |  | prints how many guest buffer elements a program may store to and how many it only loads |
 | `APS5_TRACE_IMAGE_TABLE` | presence | `core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp` |  | traces image-table resolution |
+| `APS5_VERIFY_MASKED_RESULT_MEMO` | presence | `core/shader/recompiler/Recompiler.cpp` |  | also materializes every patched result memo hit, prints the first twenty whose patched result differs and counts them in the result memo report of `APS5_PROFILE_DRAW` |
 | `APS5_VERIFY_SRT_COMPACT` | presence | `core/shader/recompiler/Optimization/src/SrtWalker/SrtDescriptorEvaluation.cpp` |  | walks every SRT descriptor a second time through the IR evaluator and throws when the two walks differ |
 | `APS5_VERIFY_SRT_TAPE` | presence | `core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp` |  | walks a plan's runtime sources a second time through the evaluator, adopts its answers where the two differ and prints the first twenty differences |
 | `APS5_WAVE_LDS_SUBGROUP` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp` |  | restores subgroup-scope LDS barriers for single-wave workgroups instead of workgroup scope |
@@ -60,7 +68,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
-| `APS5_TRACE_LABEL` | integer | `core/libs/prx/libSceAgc/Cb/src/Sync.cpp` | 0 | hex guest address of a RELEASE_MEM label whose packet is logged when recorded |
+| `APS5_TRACE_LABEL` | integer | `core/libs/prx/libSceAgc/Cb/src/Sync.cpp`, `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/LabelHistory.cpp` | 0 | hex guest address; logs a matching RELEASE_MEM when recorded, and nearby RELEASE_MEM, WRITE_DATA, COPY_DATA, DMA_DATA and WAIT_REG_MEM packets when executed |
 
 ### libSceAgcDriver
 
@@ -92,6 +100,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_CAPTURE_GPU_COPIES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | records GPU buffer copies in the capture trace (requires APS5_CAPTURE_TRACE) |
 | `APS5_CAPTURE_INPUTS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | records each draw's inputs in the capture trace (requires APS5_CAPTURE_TRACE) |
 | `APS5_CAPTURE_TRACE` | presence | `core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp` |  | writes capture events to capture-trace.log |
+| `APS5_CAPTURE_TRACE_PATH` | string | `core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp` | capture-trace.log | file path for the capture events log |
 | `APS5_CHECK_INDIRECT_ARGS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | reads GPU-side indirect draw records back on the CPU and prints the first ones |
 | `APS5_COMPLETION_STORE_SYNC` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | makes a store made by a completion action wait for later batches over its range |
 | `APS5_COPY_DESTINATION_STRICT` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | refuses a CPU copy whose destination has any pending writer, not only an unsettled one |
@@ -108,6 +117,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_CPU_STORES` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` |  | writes packet stores on the CPU instead of recording them on the GPU |
 | `APS5_DCC_KEYS_EACH` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records every DCC key store at once instead of batching them |
 | `APS5_DEPTH_COPY_MIN_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 1024 | minimum surface size in KiB for a depth target to take the depth-copy path |
+| `APS5_DEPTH_PLANE_COPY_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp` | 256 | budget in MiB of the sampled depth-plane copies kept for reuse (least recently used copies leave first); `0` keeps every copy |
 | `APS5_DEPTH_PLANE_WHOLE_STORE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp` |  | stores a stale depth plane whole when memory over it is read, instead of only the 64 KiB units the read overlaps |
 | `APS5_DISPATCH_CACHE_BYTES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 268435456 | size of the dispatch cache in bytes (0 keeps the default of 256 MiB) |
 | `APS5_DISPATCH_CACHE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 8192 | number of dispatch cache entries; 0 picks a default from the variant count |
@@ -115,7 +125,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_DISPATCH_VARIANTS` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 4 | number of dispatch variants kept per cache entry, clamped to the maximum |
 | `APS5_DISPMOVE_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` | 1024 | upper bound in KiB on the read-only buffers a dispatch-cache hit moves into its template, above which the dispatch is prepared again |
 | `APS5_DRAIN_ALL` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` |  | drains every packet, disabling the batched recording path |
-| `APS5_DRAIN_COMPLETION_LABELS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | records completion labels immediately instead of deferring them with the batch |
+| `APS5_DRAIN_COMPLETION_LABELS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | records completion labels immediately instead of deferring them with the batch, and drains a label recorded while a copied write-back is pending instead of storing it behind the write-backs |
 | `APS5_DRAW_CACHE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp` | 4096 | number of entries in the draw cache; 0 keeps the default 4096 |
 | `APS5_DRAW_DRAIN` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` |  | treats draw packets as drains, waiting for them instead of recording ahead |
 | `APS5_DRAW_INPUTS_IN_PLACE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | binds draw vertex and index ranges in place from host imports also with NVIDIA's Windows driver, which copies them by default |
@@ -147,6 +157,10 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_FLIP_READ_CHECK` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records the in-place reads of completed batches and checks them before the present blit's fence |
 | `APS5_FORCE_SDR` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/HostHdr.cpp` | unset | suppresses advertised HDR availability while retaining detected host capabilities; uses the existing SDR presentation path |
 | `APS5_FORCE_STRUCTURIZER_FALLBACK` | presence | `core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp` |  | makes the control-flow test expect the reach-flag fallback instead of no cloning |
+| `APS5_FRAME_CAPTURE` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` |  | directory in which the driver records a few frames of the title's driver calls and guest memory for `agc_frame_replay` |
+| `APS5_FRAME_CAPTURE_AT_FLIP` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 1 | frame boundary (CPU flip or submission that flips) at which the frame capture starts when no trigger file is set |
+| `APS5_FRAME_CAPTURE_FRAMES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 10 | number of frame boundaries the frame capture records |
+| `APS5_FRAME_CAPTURE_TRIGGER` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` |  | file whose appearance starts the frame capture at the next frame boundary; a number in it replaces the frame count |
 | `APS5_FULL_BARRIERS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records every barrier instead of merging redundant ones |
 | `APS5_GPU_CHECKPOINTS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | attaches device diagnostic checkpoints through VK_NV_device_diagnostic_checkpoints, or buffer markers through VK_AMD_buffer_marker on a device without it |
 | `APS5_GPU_COPY_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` | 1024 | size cap in KiB on a descriptor sub-range copied through the GPU path, larger ones staying on the CPU |
@@ -166,7 +180,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_KEPT_DESCRIPTOR_SETS` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 8 | number of freed dedicated image table descriptor sets kept for a later build with the same layout and sizes; 0 keeps none |
 | `APS5_KEYFLIP_DROP` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | drops a pending unit's results on a clear-code to uncompressed key flip, as before |
 | `APS5_KEYS_FILL_CLEAR` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | clears an image from DCC keys whose fill pattern it matches (only when set to 1) |
-| `APS5_LABEL_FLUSH_US` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` | 1000 | age in microseconds at which a pending label batch is recorded or submitted |
+| `APS5_LABEL_FLUSH_US` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | age in microseconds at which a pending label batch is recorded or submitted; unset is 1000 with batched label submission and 250 when `APS5_NO_LABEL_BATCH_SUBMIT` or `APS5_NO_LABEL_BATCHING` turns it off |
 | `APS5_LABEL_GATE_ALL` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | gates a label store on any pending completion, not only one overlapping the range |
 | `APS5_LABEL_LOCK_EACH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | records each label under the GpuMutex instead of deferring it |
 | `APS5_LABEL_OWN_LOCK` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketFlush.cpp` |  | makes a label flush take the GpuMutex itself instead of relying on a self-locking packet |
@@ -208,6 +222,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_CPU_COPY` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp` |  | disables the CPU copy path of the copy HLE |
 | `APS5_NO_DATA_HITS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` |  | disables dispatch-cache hits that differ only in ShaderData or FlattenedSrt words |
 | `APS5_NO_DCC_PRESYNC` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | leaves the DCC key ranges out of the surfaces a build pre-syncs, so only the surface itself waits for its producer |
+| `APS5_NO_DEFERRED_DESTRUCTION` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | on MoltenVK, destroys buffers and frees device memory as soon as the driver releases them, instead of while the graphics queue is idle (KhronosGroup/MoltenVK#2876) |
 | `APS5_NO_DCC_WORD_SCAN` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp` |  | restores the byte-by-byte DCC key scan instead of the word-at-a-time compare |
 | `APS5_NO_DEFERRED_EVICTION` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | destroys displaced resource-cache entries under the mutex instead of deferring them to the open batch |
 | `APS5_NO_DEFERRED_SETTLES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | settles watched private host imports as they open instead of through the deferred block-settling path (Windows only) |
@@ -334,18 +349,18 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_WRITE_EVIDENCE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/WriteEvidence.cpp` |  | disables the written-element evidence that lets a read skip the flush hook |
 | `APS5_NO_WRITE_ONLY_PASSES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | counts a buffer a draw only stores to as read and written, so the next draw storing to it begins a new render pass |
 | `APS5_NO_WRITTEN_SHADOW` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | binds written staging elements in place instead of through the written shadow |
+| `APS5_NV_DIAGNOSTICS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | creates the device with VK_NV_device_diagnostics_config and VK_NV_device_diagnostic_checkpoints where supported, for Nsight Aftermath crash dumps |
 | `APS5_PACKET_EPOCH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitStatistics.cpp` |  | makes queue workers bump the collect epoch before every packet |
 | `APS5_PIPELINED_DRAWS` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp` | 8 | depth of the queue-0 draw pipeline: 0 records draws inline, 1 selects the default depth of 8, and any other value is the depth capped at 256 |
 | `APS5_PIPELINE_DISPATCH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp` |  | records an eligible dispatch as an item in the queue-0 pipeline instead of running it inline |
-| `APS5_PIPELINE_DMA` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` |  | records a queue-0 DMA data packet in the draw pipeline instead of executing it inline |
 | `APS5_PIPELINE_DRAIN_FILLS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp` |  | runs queue-0 buffer fills through the draw pipeline to keep their order; any value stores them in place instead |
 | `APS5_PIPELINE_DRAIN_LABELS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | answers a queue-0 wait from the draw pipeline's own pending labels while it is busy; any value drains the pipeline at the wait |
 | `APS5_PIPELINE_DRAIN_SUBMISSIONS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | lets a submission end without submitting its recorded work, so it joins a later submit with the pipeline's queue; any value drains the pipeline and submits at the end of the submission |
-| `APS5_PIPELINE_JOURNAL_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 1024 | number of journal entries loaded at most; a longer journal is truncated to this count |
-| `APS5_PIPELINE_JOURNAL_MAX_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 1024 | size cap in MiB on the pipeline journal; later pipelines are not recorded once it is reached |
+| `APS5_PIPELINE_JOURNAL_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 4096 | number of journal entries loaded at most; a longer journal keeps its last entries, the ones recorded last |
+| `APS5_PIPELINE_JOURNAL_MAX_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 1024 | size cap in MiB on the pipeline journal; the file is rewritten down to three quarters of the cap when it is reached, keeping the newest pipelines and the modules they name and leaving room for later records |
 | `APS5_PIPELINE_JOURNAL_THREADS` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` |  | threads that replay the journal's pipelines, 0 disables the replay; unset uses half the hardware threads, at least one |
 | `APS5_PIPELINE_STATS` | string | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | captures and prints driver statistics for each new pipeline, requiring `VK_KHR_pipeline_executable_properties`; `1` enables |
-| `APS5_PIPELINE_STORE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp` | 1024 | LRU bound on the entries of the pipeline store; an entry is evicted only once no recorded draw holds it |
+| `APS5_PIPELINE_STORE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp` | adaptive | fixes the LRU bound on the entries of the pipeline store, which otherwise starts at 1024 and doubles up to 4096 for a journal replay that does not fit and while evicted pipelines keep coming back; an entry is evicted only once no recorded draw holds it |
 | `APS5_PM4_RING` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/SubmissionRing.cpp` | 16 | number of submissions the PM4 ring keeps for dumps, from 0 to 4096; 0 disables the ring |
 | `APS5_POLL_REAP` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp` |  | reaps completions on every poll tick |
 | `APS5_POLL_TRY_EACH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp` |  | tries the poll service on every tick instead of at the poll interval |
@@ -369,7 +384,8 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_SKIP_INVALID_INDIRECT_REGISTERS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | skips the entries whose offset dword is no register offset in a SET_*_REG_INDIRECT list read again where its packet executes, and writes its valid entries, instead of stopping |
 | `APS5_SKIP_REFUSED_DRAWS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp` |  | skips a draw whose graphics stage the recompiler refuses, reporting each refused shader once, instead of failing the queue |
 | `APS5_SKIP_REQUEST_DUMPS` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderDiagnostics.cpp` | 8 | caps RecompileRequest dumps per shader-skip reason |
-| `APS5_SKIP_SHADER` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp` | 0 | hex program address of a shader to skip preparing |
+| `APS5_SKIP_SHADER` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp` | 0 | hex program address of a shader whose draws and dispatches are dropped |
+| `APS5_SKIP_SHADER_FILE` | path | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp` |  | file of whitespace-separated hex program addresses (`#` starts a comment) whose draws and dispatches are dropped; re-read within 500 ms of a change; a token that is not a whole 64-bit hex number is reported and ignored |
 | `APS5_SNAPSHOT_CHECK_FATAL` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | throws on the first snapshot that differs from registered memory instead of only counting them |
 | `APS5_SPANNED_WAVE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | spans a single-wave wave64 compute program over two full 32-lane subgroups |
 | `APS5_SPIRV_OPT` | string | `core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp` |  | selects the SPIR-V optimization pipeline: `full` restores the performance pipeline, `none` skips optimization |
@@ -382,6 +398,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_STORE_AT_LABEL` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | flushes every pending storage-image result when a label is written on the GPU |
 | `APS5_SUBMISSION_EPOCH_EACH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | bumps the guest-memory collect epoch on every submission instead of only when the submission is newer than the last bump |
 | `APS5_SUBMIT_AT_END` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | submits recorded work at the end of a submission even when a worker is queued |
+| `APS5_SUBMIT_PROGRESS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp` |  | enables opt-in pacing for eligible queue-zero submission prefixes within a shared nominal two-millisecond acknowledgement/timeline budget; timeout retains asynchronous acceptance |
 | `APS5_SUSPEND_DRAIN` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | drains the device at a suspend point |
 | `APS5_SYNC_COMPLETION_DRAWS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | keeps every draw with completion work synchronous |
 | `APS5_SYNC_DISPATCH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | waits for every dispatch instead of batching it |
@@ -394,7 +411,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_TEMPLATE_AUDIT_MS` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 1000 | milliseconds after which a cached shader-resource object takes the full walk instead of the fast proof; `0` turns the audit off |
 | `APS5_TEXTURE_CACHE_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 0 | forced byte budget in MiB for the storage and sampled texture caches; `0` selects the budget automatically |
 | `APS5_THREAD_NICE` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp` | -10 | nice value the raised queue workers and presenter ask rtkit for (clamped to -20..19) |
-| `APS5_THREAD_PRIORITY` | string | `core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp` | off | raises the queue workers and presenter above the title's threads: `off`, `high` or `rt` |
+| `APS5_THREAD_PRIORITY` | string | `core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp` | off | raises the queue workers and presenter above the title's threads: `off`, `high` or `rt`; on macOS `high` is the user-interactive QoS class and `rt` a Mach time-constraint policy (period 1 ms, computation 0.5 ms) |
 | `APS5_THREAD_RT` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp` | 10 | realtime priority the raised threads ask rtkit for (clamped to 1..99) |
 | `APS5_THREAD_RTTIME_US` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp` | 200000 | hard RLIMIT_RTTIME the realtime plan lowers to, in microseconds |
 | `APS5_TRACE_BARRIERS` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | prints that many simulated hazard barriers before stopping |
@@ -422,6 +439,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_TRACE_QUERY` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp` |  | prints every 16th page query with its cost |
 | `APS5_TRACE_RESOURCE_KEY_MISSES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | reports shader-resource cache key misses |
 | `APS5_TRACE_SECONDS` | string | `core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp` |  | records from the first present `<start>` seconds after the first present for `<length>` seconds (whole numbers, `start:length`) |
+| `APS5_TRACE_SHADER_CORRELATION` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp` |  | traces shader selection and preparation failure tokens through draw batches |
 | `APS5_TRACE_SHADER_REGS` | string | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp` |  | prints a shader's registers for one hex program address, or `all` |
 | `APS5_TRACE_SHADOW` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/UnitShadow.cpp` |  | prints the first n shadow publishes, the first 64 seeds, every evict and retire |
 | `APS5_TRACE_SKIPS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderDiagnostics.cpp` |  | reports each distinct shader skip once |
@@ -518,7 +536,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
-| `ANYPS5_LANGUAGE` | integer | `core/libs/prx/libSceSystemService/Export.cpp` | 1 | console language number returned by sceSystemServiceParamGetInt, defaulting to English US |
+| `ANYPS5_LANGUAGE` | integer | `core/libs/prx/libSceSystemService/SystemService.hpp` | 1 | console language number returned by sceSystemServiceParamGetInt, defaulting to English US |
 
 ### libSceVideoOut
 
@@ -527,6 +545,8 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `ANYPS5_INPUT_CONFIG` | string | `core/libs/prx/libSceVideoOut/src/InputMapping.cpp` |  | path of the input mapping file that binds host keys and mouse to guest pad actions |
 | `ANYPS5_REQUIRE_DISPLAY` | presence | `core/libs/prx/libSceVideoOut/tests/Flip.cpp` |  | makes video-out tests fail instead of skipping when no display or Vulkan device is available |
 | `APS5_NO_PAD_INPUT` | presence | `core/libs/prx/libSceVideoOut/src/PadInput.cpp` |  | ignores keyboard and mouse input so a measurement run is not advanced by a stray press |
+| `APS5_NO_WGI` | presence | `core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp` |  | turns off SDL's Windows.Gaming.Input joystick backend at default hint priority, on Windows hosts where it faults a few seconds into every run |
+| `APS5_OUTPUT_RESOLUTION` | string | `core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp` |  | `<width>x<height>` in pixels that replaces the host display's size when `sceVideoOutGetOutputStatus` and `sceVideoOutGetOutputStatusWithVrr` report the output resolution: 1 for a size below 3840 wide and 2160 high, 2 otherwise, as for the display; unset or empty follows the display, and any other value makes those calls throw |
 | `APS5_VIDEOOUT_TELEMETRY_DIR` | string | `core/libs/prx/libSceVideoOut/src/Telemetry.cpp` |  | directory where videoout.jsonl is appended with the pad and present telemetry lines; nothing is opened when unset or empty |
 
 ### libSceVideodec2
@@ -539,17 +559,19 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
-| `APS5_CRASH_INDIRECT_MEMORY` | presence | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | dumps the words the faulting registers point at in the Windows crash report |
+| `APS5_CRASH_INDIRECT_MEMORY` | presence | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | adds to the Windows crash report up to 64 bytes from each pointer in the dump of the words the registers point at, as `[[reg+off]] @addr` lines; off when unset or empty |
+| `APS5_CRASH_STACK_BYTES` | integer | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` | 0 | bytes of the faulting thread's stack from rsp, decimal or 0x hexadecimal and at most 1048576, that the Windows crash report prints with the data at the stack words pointing outside the stack; 0 prints none |
 | `APS5_HANG_DUMP_SECS` | integer | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | seconds after which a watchdog dumps all threads and aborts |
 | `APS5_HEAP_CACHE_MIB` | integer | `core/libs/prx/libc/src/GuestHeap.cpp` | 4096 | size in MiB of the cache of freed large blocks before the oldest are decommitted |
 | `APS5_HELPER_AFFINITY_MASK` | integer | `core/libs/prx/libc/include/CpuTopology.hpp` |  | hex core mask that helper threads (deferred release, mirror refresh) are pinned to |
-| `APS5_LOG_TIMESTAMPS` | presence | `core/libs/prx/libc/include/general/LogMacros.hpp` |  | prefixes each log line with the milliseconds since the first log |
+| `APS5_LOG_TIMESTAMPS` | presence | `core/libs/prx/libc/include/general/LogMacros.hpp` |  | prefixes each log line with `[+S.UUUUUU s]`, the seconds with microsecond digits since the clock started at the first stamped line; on Windows each library has its own clock, started at that library's first stamped line |
 | `APS5_NO_PROCMAP_QUERY` | presence | `core/libs/prx/libc/include/specifics/linux/HostMapping.hpp` |  | skips the /proc/self/maps PROCMAP_QUERY ioctl and scans the maps file instead |
 | `APS5_NO_SSE4A_EMULATION` | presence | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | disables emulation of AMD-only SSE4a instructions, making such a fault fatal |
 | `APS5_NO_WRITE_WATCH` | presence | `core/libs/prx/libc/src/GuestArena.cpp` |  | disables write watching so guest buffers are fully re-read on every use |
 | `APS5_PIN_WAIT_MS` | integer | `core/libs/prx/libc/src/GuestAllocations.cpp` | 60000 | milliseconds to wait for a pinned allocation lease before failing |
 | `APS5_TRACE_AFFINITY` | presence | `core/libs/prx/libc/include/CpuTopology.hpp` |  | prints a line naming the role, tid and mask of every thread pinning |
 | `APS5_TRACE_CALLS` | string | `core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp` |  | comma-separated libraries (or all) whose guest calls are traced |
+| `APS5_TRACE_CALLS_FILE` | string | `core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp` |  | file rewritten every 10 seconds with each traced import called so far and its number of calls |
 | `APS5_TRACE_EXIT` | presence | `core/libs/prx/libc/src/Process.cpp` |  | prints a backtrace of the caller of exit, _Exit and the process-exit path |
 | `APS5_TRACE_SSE4A` | presence | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | prints each emulated SSE4a instruction once per rip |
 | `APS5_WATCH_ADDR` | integer | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | absolute hex address whose writes are reported after its page is committed |
@@ -567,7 +589,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_JOB_AFFINITY` | presence | `core/libs/prx/libkernel/Pthread/src/Thread.cpp` |  | disables pinning of job worker threads |
 | `APS5_NO_SLEEP_WAKE` | presence | `core/libs/prx/libkernel/Time/SleepWake.cpp` |  | keeps every sleep of 1 ms or less in full instead of ending it at a GPU batch, batch completion action or flip completion |
 | `APS5_NO_TIMER_RESOLUTION` | presence | `core/libs/prx/libkernel/Time/Time.cpp` |  | keeps the default 15.6 ms scheduler tick instead of raising it to 0.5 ms on Windows |
-| `APS5_TIME_SCALE` | integer | `core/libs/prx/libkernel/Time/Time.cpp` | 1 | factor applied to the guest monotonic clocks and TSC; sleeps still take real time |
+| `APS5_TIME_SCALE` | integer | `core/libs/prx/libkernel/Time/Time.cpp` | 1 | factor applied to the guest monotonic clocks and TSC; sleeps and host JobManager worker spin intervals still take real time |
 | `APS5_TRACE_APR` | presence | `core/libs/prx/libkernel/Apr/src/Apr.cpp` |  | logs every APR file read with its path, offset, size and destination |
 | `APS5_TRACE_MEMORY` | presence | `core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp` |  | logs direct-memory map, remap, protect, unmap and physical allocation operations |
 | `APS5_TRACE_SYNC` | presence | `core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp` |  | logs event-flag create, set and wait operations |
diff --git a/docs/dev/GAME_TESTING.md b/docs/dev/GAME_TESTING.md
index 6e74085f0e..de2c53b6f3 100644
--- a/docs/dev/GAME_TESTING.md
+++ b/docs/dev/GAME_TESTING.md
@@ -12,9 +12,12 @@ For user options see [USAGE](../user/USAGE.md); for internals see [ARCHITECTURE]
   - Linux: `relinker --registry src/eboot.elf app.elf`
   - Windows: `relinker --windows --registry src/eboot.elf app.exe`. Without `--windows` the output is an ELF file whatever its name, and Windows refuses to start it (exit code 216, "not compatible with the version of Windows").
 - A dump whose `app0` holds `ampr_assets.index` and `ampr_assets-*.pak` was repacked for [ampr_emu](https://github.com/drakmor/ampr_emu): the packed files were removed from `app0`, and only ampr_emu reads the packs. Restore them first with ampr_emu's `tools/ampr_pack.py unpack --index app0/ampr_assets.index --output <dir>` and copy the files missing from `app0`. Without them a Unity title stops at start-up on the missing `Media/Resources/unity default resources`.
-- Convert every module the title loads from its own folders (`sce_module/`, `Media/Modules/`, `Media/Plugins/`). Unity titles need `--module-dir Media/Modules --module-dir Media/Plugins`. Put each printed `Guest module:` file next to its original `.prx` in `app0/`, and keep the original there.
+- Convert every module the title loads from its own folders (`sce_module/`, `Media/Modules/`, `Media/Plugins/`). Unity titles need `--module-dir Media/Modules --module-dir Media/Plugins`. The relinker writes each converted module as `<name>.guest.prx` into `app0/` beside the output, in the module's own folder, and lists it in the `Arrange the files like this` tree it prints. Keep the original `.prx` next to it.
 - `libs/` holds only AnyPS5's own libraries, from `build/core/libs/libs` (not `unpatched/`). A game module placed there fails to load (error 193 on Windows). A self-built `libs/` on Windows also needs `libgcc_s_seh-1.dll`, `libstdc++-6.dll` and `libwinpthread-1.dll` from the toolchain's `mingw64/bin`, or every library fails with error 126 ([USAGE](../user/USAGE.md#input-and-conversion)).
 - Run `tools/import_audit.py` on the registries. Exit code 1 lists imports that will fail or throw.
+  `tools/audit_dump.py <app0> --relinker <relinker> --libs build/core/libs/libs` (`--windows` on Windows) does the
+  unwrapping, the conversion with `--registry` and the audit in one step, from every module folder above and `.prx`
+  files beside `eboot.bin`, into a temporary directory (or `--work <dir>`), reading the dump only.
 - Run one title at a time. Titles share the GPU and the controller file. Some titles start a second process (Peace Walker's `mgspw.mgspw.elf`) that can outlive a time cap on the first: check that every process of the previous run is gone.
 
 ## Launch
diff --git a/docs/dev/PROGRESS.md b/docs/dev/PROGRESS.md
index a1257f85a9..4e451630a3 100644
--- a/docs/dev/PROGRESS.md
+++ b/docs/dev/PROGRESS.md
@@ -22,6 +22,10 @@ Comparisons identify functions by library and name. When a head group becomes a
 
 Real removals and transitions back to stubs remain visible. Percentages retain the original snapshot totals, so eliminating duplicate accounting can change a percentage without changing available functionality. Older JSON snapshots without `shared_sources` are accepted.
 
+PR reports include a table of changed libraries with implemented export counts, declared totals, percentages before and after, and changes in percentage points (`pp`). The table uses the same two JSON snapshots as the global report. A library appears when its counts, export names or shared-source owner change, including when its counts stay equal. Unchanged libraries are omitted, and the table lists at most 100 libraries in name order with a count of omitted rows.
+
+New or removed libraries show `Not present` on the missing side. Libraries whose snapshots contain both counts and report zero exports show `No exports`; if either count is absent, the table shows `Counts unavailable`. Wrappers show `Shared sources` with the source library's name. These rows show `n/a` for the percentage change. The table retains the scanner's counting rules; it does not measure compatibility.
+
 Implemented definitions are also classified as behaviourally empty when their body holds only `(void)name;` discards and at most one constant return, bare `return;` or `throw`, including a return of a local `static` wrapper that is itself behaviourally empty; wrapper calls whose arguments contain calls do not qualify. Comparisons list newly implemented behaviourally empty functions without changing any count. Older JSON snapshots without `inert_names` are accepted.
 
 ## One library
diff --git a/docs/dev/TRACING.md b/docs/dev/TRACING.md
index 8cb84bb4a4..51854e22c3 100644
--- a/docs/dev/TRACING.md
+++ b/docs/dev/TRACING.md
@@ -11,7 +11,8 @@ Set a switch before starting the emulator. Unless noted, any value enables it. M
 | `APS5_TRACE_APR` | APR file reads, including path, offset, size and destination. |
 | `APS5_TRACE_AUDIOOUT` | Audio output port parameters when a port is opened. |
 | `APS5_TRACE_AUDIOOUT2` | AudioOut2 context and port parameters, attributes, pushes, queue polls and periodic queue summaries. |
-| `APS5_TRACE_CALLS` | On Windows and Linux, records calls to the imports selected by this comma-separated library list (or `all`); crash and abort reports (abort only on Linux) include the last 64 calls and most-called imports. The executable must be converted with `--trace-imports`; see [Usage](../user/USAGE.md#tracing-system-library-calls). |
+| `APS5_TRACE_CALLS` | On Windows, Linux and macOS, records calls to the imports selected by this comma-separated library list (or `all`); crash and abort reports (abort only on Linux and macOS) include the last 64 calls and most-called imports. The executable must be converted with `--trace-imports`; see [Usage](../user/USAGE.md#tracing-system-library-calls). |
+| `APS5_TRACE_CALLS_FILE` | With `APS5_TRACE_CALLS`, a file rewritten every 10 seconds with every traced import called so far, most called first: number of calls, library and import name. |
 | `APS5_TRACE_EXIT` | Guest `exit` and `_Exit` calls and process-exit backtraces. |
 | `APS5_TRACE_FIBER` | Fiber initialization, switches and returns. |
 | `APS5_TRACE_MEMORY` | Direct-memory allocation, mapping and protection operations. |
@@ -45,7 +46,7 @@ Set a switch before starting the emulator. Unless noted, any value enables it. M
 | `APS5_TRACE_HOST_IMPORT` | Host-import mapping attempts, memory-map details, failures and retirement. |
 | `APS5_TRACE_IMAGE_TABLE` | Image-table resource materialization and descriptor selection. |
 | `APS5_TRACE_INDIRECT_DRAWS` | Indirect draw packets that pass the draw precheck. |
-| `APS5_TRACE_LABEL` | `RELEASE_MEM` packets that target the address in this hexadecimal value. |
+| `APS5_TRACE_LABEL` | A matching `RELEASE_MEM` when recorded, and nearby `RELEASE_MEM`, `WRITE_DATA`, `COPY_DATA`, `DMA_DATA` and `WAIT_REG_MEM` packets when executed. Set the value to the guest address in hexadecimal. |
 | `APS5_TRACE_LATE_LABELS` | GPU label writes observed after their waiting submission was handled. |
 | `APS5_TRACE_QUERY` | Every sixteenth guest-memory page query, including cost and caller address. |
 | `APS5_TRACE_RESOURCE_KEY_MISSES` | Resource-content key changes that cause draw or dispatch resource-cache misses. |
diff --git a/docs/dev/TechnicalDebt.md b/docs/dev/TechnicalDebt.md
index ee2a2dfd75..a9bed3b21f 100644
--- a/docs/dev/TechnicalDebt.md
+++ b/docs/dev/TechnicalDebt.md
@@ -29,3 +29,4 @@ Throughout the project, every function at every stage either **does exactly what
 - `--to-intel` guest module trampolines are covered only by a synthetic relinker test; no game title has been verified with them on Linux or Windows.
 
 - [Quick syntax checks](../../tools/check_compile.py) reject unexpanded `@response` arguments rather than parse compiler-specific quoting and risk retaining output flags. Expand response files in `compile_commands.json` before checking; the Ninja fallback expands them with `ninja -t compdb -x`.
+- [Quick syntax checks](../../tools/check_compile.py) do not model every compiler option's operand count. A preprocessing mode following an unrecognized option without a joined value is rejected rather than risk removing that option's operand. Compiler wrappers with their own option grammar are not covered. Forwarded frontend actions (`-Xclang`, `-Xpreprocessor` and their joined forms) are rejected. Comma-forwarded options (`-Wp,`) allow only recognized macro/include operands; response-file tokens are rejected even as operands, and other options are rejected because unmodeled actions or output operands could bypass syntax analysis or write outputs. See the [Clang option grammar](https://clang.llvm.org/docs/ClangCommandLineReference.html).
diff --git a/docs/dev/debt/libSceAgc.md b/docs/dev/debt/libSceAgc.md
index 669e463fcf..43c8c621b4 100644
--- a/docs/dev/debt/libSceAgc.md
+++ b/docs/dev/debt/libSceAgc.md
@@ -19,14 +19,16 @@
 - [sceAgcDcbContextStateOp](../../../core/libs/prx/libSceAgc/DcbState/src/ContextState.cpp) (libSceAgc) - delegates to `sceAgcDcbContextStateOp_0100` (same packets as KytyPS5's `AgcDcbContextStateOp`); KytyPS5 returns nullptr for an operation above 3, here it throws; the packet words were not compared with a real console
 - [sceAgcBranchPatchSetThenTarget_0300, sceAgcBranchPatchSetElseTarget_0300](../../../core/libs/prx/libSceAgc/Patch/src/Branch.cpp) (libSceAgc) - names from their NIDs (`7Wa3aeJgeVU`, `rP5xLdOf26k`); the `(packet, cachePolicy, target, sizeInDwords)` signature is inferred from PPSA28416's calls (a branch packet, 0, an aligned target, 4), with the policy stored where `sceAgcCbBranch` puts it
 - [sceAgcDcbSet{Cx,Sh,Uc}RegistersIndirectGetSize](../../../core/libs/prx/libSceAgc/DcbState/src/Registers.cpp) (libSceAgc) - the count argument is ignored: PPSA28416 calls them with leftover register contents (0xf5f5039c), so the real functions likely take none; the size is 20 bytes either way
+- [sceAgcCbSetShRegistersDirect, sceAgcCbSetUcRegistersDirect](../../../core/libs/prx/libSceAgc/Cb/src/Registers.cpp) (libSceAgc) - a register list may start at any byte address, and its 8-byte `{offset, value}` entries are copied byte for byte. PPSA26344 (02.002.000) passes the `sh_registers` lists of compute shader headers that sit 1 byte past an 8-byte boundary in `core_common_subcore.core_b1_fx.sprig.xpps` ([#902](https://github.com/boykopovar/AnyPS5/pull/902)), so those lists start at 1 mod 4 (0x8021363131 in an open-world run). The title runs on the console with these lists, but how the console reads an unaligned list (at the given address, or at a rounded-down one) is not measured
 - [sceAgcUpdateInterpolantMapping_0100](../../../core/libs/prx/libSceAgc/Misc/src/ShaderFusion.cpp) (libSceAgc) - name from its NID (`k0E7vkgqAuE`); the `(regs, vs, ps)` arguments are the declared ones, behaviour unknown
 - [sceAgcWriteDataPatchSetDst, sceAgcWriteDataPatchSetCachePolicy and their Async forms](../../../core/libs/prx/libSceAgc/Patch/src/WaitRegMem.cpp) (libSceAgc) - the signatures `(packet, uint8 value)` are inferred from the other patch functions, as no public declaration was found; the value is taken in the encoding of the `dst` and `cachePolicy` arguments of `sceAgcDcbWriteData` (graphics) and `sceAgcAcbWriteData` (Async, compute), and the patched packet is the one those calls would write. `sceAgcAsyncWriteDataPatchSetAddressOrOffset` is assumed to patch the address like `sceAgcWriteDataPatchSetAddressOrOffset`, as the compute WRITE_DATA packet keeps it in the same dwords
 - [sceAgcCreateInterpolantMapping_10000](../../../core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp) (libSceAgc) - name from its NID (`dbOlWdppb4o`); same arguments as `sceAgcCreateInterpolantMapping_0100`; PPSA26344 passes three pointers at each of nine observed call sites (`0x9F914E`, `0x9F91E2`, `0x9F9216`, `0x1604BBD`, `0x16122D7`, `0x1618285`, `0x161838C`, `0x16184EE`, `0x1618607`), consistent with that argument assumption, but does not read the return value there, so its return type is not established.
 - [sceAgcGetDataPacketPayloadRange](../../../core/libs/prx/libSceAgc/Misc/src/PacketInfo.cpp) (libSceAgc) - signature, the `{base, size in bytes}` output and the type 0 range (header + 1, one dword longer than the type 1 payload) from KytyPS5 only, matching `sceAgcGetDataPacketPayloadAddress_0090`; prosper returns header + 2 for both types from that address function
 - [sceAgcGetDataPacketPayloadAddress](../../../core/libs/prx/libSceAgc/Misc/src/PacketInfo.cpp) (libSceAgc) - forward to `sceAgcGetDataPacketPayloadAddress_0090` and the inferred (addr, cmd, type) parameters follow SharpProspero and decrypted firmware 3.20 NID mapping; not verified on console hardware
+- [sceAgcAcbMemSemaphore, sceAgcDcbMemSemaphore](../../../core/libs/prx/libSceAgc/Acb/src/Sync.cpp) (libSceAgc) - signature (cb, semaphoreAddr, waitForMailbox, signalType, operation) inferred from PPSA03396, whose wrapper passes the address second and operation 6 (signal) or 7 (wait) last; the three trailing arguments go to the packet as-is
 - [sceAgcCbMemSemaphore](../../../core/libs/prx/libSceAgc/Cb/src/Sync.cpp) (libSceAgc) - signature (cb, semaphoreAddr, operation, modifier, value) follows SharpProspero; writes 4-dword PM4 0x39 packet with control word 0x80100000 following console oracle measurements in prosper (cases agcbuild_CbMemSemaphore_a/b/c); operation, modifier and value are unused
 - [sceAgcAsyncCondExecPatchSetCommandAddress, sceAgcAsyncCondExecPatchSetEnd](../../../core/libs/prx/libSceAgc/Patch/src/CondExec.cpp) (libSceAgc) - no reference has a body for them; they are assumed to patch the COND_EXEC packet like `sceAgcCondExecPatchSetCommandAddress` and `sceAgcCondExecPatchSetEnd`, since `sceAgcAcbCondExec` writes the same packet as `sceAgcDcbCondExec`, as `sceAgcAsyncRewindPatchSetRewindState` does for REWIND
-- [sceAgcAcbAtomicGds_0900](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - name from its NID (`gQkqkLttcpw`), signature unknown
+- [sceAgcAcbAtomicGds_0900](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - name from its NID (`gQkqkLttcpw`)
 - [sceAgcDcbPrimeUtcl2](../../../core/libs/prx/libSceAgc/DcbState/src/Display.cpp) (libSceAgc) - assumed to write the packet `sceAgcAcbPrimeUtcl2` writes: PRIME_UTCL2 has the same 5 dwords on the graphics and compute rings. Not confirmed on a title. Both write a NOP of that size, as there is no TLB to prime
 - [sceAgcDcbQueueEndOfShaderActionGetSize](../../../core/libs/prx/libSceAgc/DcbState/src/ContextState.cpp) (libSceAgc) - the builder is inline in the SDK and not exported; the size is assumed to be that of the RELEASE_MEM packet `sceAgcCbReleaseMem` writes (32 bytes), the same as `sceAgcAcbQueueEndOfShaderActionGetSize`, as in [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/main/src/game_compat.c) and [REmu](https://github.com/xnetcat/REmu/blob/main/crates/remu-runtime/src/agc_dcb.rs)
 - [sceAgcDcbSetZPassPredicationEnableGetSize, sceAgcDcbSetPredicationDisableGetSize, sceAgcDcbSetBoolPredicationEnableGetSize](../../../core/libs/prx/libSceAgc/DcbState/src/Predication.cpp) (libSceAgc) - the builders are inline in the SDK and not exported; the size is assumed to be that of the SET_PREDICATION packet `sceAgcDcbSetPredication` writes (16 bytes)
@@ -39,8 +41,12 @@
 ### Functional
 
 - [sceAgcDebugRaiseException](../../../core/libs/prx/libSceAgc/Misc/src/Debug.cpp) (libSceAgc) - logs the exception id and returns 0, as retail hardware does nothing per [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c); the trap (`ud2`) OpenAGC describes for development hardware is not reproduced. Neither is verified on a console. The `uint32` exception id is [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/6f0cddd4404ec5203e71fea77e75fc373299ba3f/src/libs/agc.cpp)'s claim; OpenAGC declares no arguments, so the logged id may be leftover register contents
-- [sceAgcSetAmmSemaphoreMemory](../../../core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp) - native registration first invokes a kernel ioctl and driver registration; host registration does not reproduce their memory-access checks or error propagation. Null, empty and address-wrapping ranges throw. The full range is cleared after successful registration; duplicate registration, alignment and label-range errors match the native wrapper.
-- [sceAgcDcbSetWorkloadsActive and sceAgcDcbSetWorkloadComplete](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) (libSceAgc) and [sceAgcDriverRegisterWorkloadStream](../../../core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp) (libSceAgcDriver) - the driver call records only the stream id (1 to 31; it returns 0 for any argument and keeps no stream record), and the DCB calls write the packets [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/agc.cpp) writes: an 18-dword (active) or 12-dword (complete) `IT_NOP` packet with the stream id, and for active the 64-bit mask of the workload ids, for complete the workload id and the 64-bit clear mask of that id. Both return null for a null command buffer, an unregistered or out-of-range stream, a workload id above 63, and for active a duplicate id or a count of 0 or above 63. The layouts and checks come from KytyPS5 alone; the console oracle in [prosper](https://github.com/mattias800/prosper/blob/main/prosper/tests/data/console_oracle/agcbuild.golden.tsv) measures the null return only for unregistered streams, not the packet contents of a registered one. The error codes the console driver returns for an invalid or repeated registration are unknown, so registration never fails here. PPSA29866 calls sceAgcDcbSetWorkloadsActive while building its command buffers (sceAgcDcbSetWorkloadComplete was not observed); nothing else was observed.
+- [sceAgcSetAmmSemaphoreMemory, sceAgcSetSemaphoreMemory, sceAgcGetSemaphoreLabel](../../../core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp) (libSceAgc) - the checks, error codes and clearing are the firmware's, but two firmware steps are not reproduced. After its checks, the firmware validates the memory with libkernel `qSleeVC6lwI`: an ioctl `0xc018ac15` taking `{memory, size, 1}`. The AMM call always does this; the non-AMM call only for memory from 8 TiB up that ends below 15 TiB. The firmware then sends `{7: memory, 8: size, 0xb: 0 for AMM, 1 otherwise}` through sceAgcDriverPassInfoDownward. Neither step happens here, so a registration that the kernel or driver would refuse succeeds. A null memory with a non-zero size and a range that wraps the address space throw where the firmware would fault
+- [sceAgcDcbSetWorkloadsActive and sceAgcDcbSetWorkloadComplete](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) (libSceAgc) - the DCB calls write the packets [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/agc.cpp) writes: an 18-dword (active) or 12-dword (complete) `IT_NOP` packet with the stream id, and for active the 64-bit mask of the workload ids, for complete the workload id and the 64-bit clear mask of that id. Both return null for a null command buffer, an unregistered or out-of-range stream, a workload id above 63, and for active a duplicate id or a count of 0 or above 63. The layouts and checks come from KytyPS5 alone; the console oracle in [prosper](https://github.com/mattias800/prosper/blob/main/prosper/tests/data/console_oracle/agcbuild.golden.tsv) measures the null return only for unregistered streams, not the packet contents of a registered one. PPSA29866 calls sceAgcDcbSetWorkloadsActive while building its command buffers (sceAgcDcbSetWorkloadComplete was not observed); nothing else was observed.
 - [sceAgcDcbSetWorkloadStreamInactive](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) and [sceAgcAcbSetWorkloadsActive, sceAgcAcbSetWorkloadComplete, sceAgcAcbSetWorkloadStreamInactive](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - return null without writing to the buffer for a null command buffer or a stream that is not registered (out-of-range ids included), and throw for a registered stream. The console oracle in prosper measured only that null return, with no stream registered, three argument patterns each and nothing written ([ACB](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L48-L56), [DCB](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L196-L204)); the packet a registered stream gets is not measured. KytyPS5 has no body for these four, and its `IT_NOP` layout for the DCB active and complete calls differs from the SET_UCONFIG_REG, WRITE_DATA and SET_WORKLOAD sequence [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/agc_workload_packet.c) derives from the driver, so neither is taken. The `(buf, streamId)`, `(buf, streamId, workloadId)` and `(buf, streamId, workloadIds, workloadCount)` signatures are those of the DCB calls in [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L2317-L2384), which says the ACB calls use the same driver builders; no ACB declaration was found. `sceAgcDcbSetWorkloadsActive` checks the stream before it reads the workload ids, as OpenAGC does: the console returned null for stream 1 with the ids at address 2 ([measured](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L203)) without faulting
+- [sceAgcDcbSetWorkload*](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) and [sceAgcAcbSetWorkload*](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - the console's packets are not written: the executor has no ATOMIC_MEM or mask table. In `libSceAgc.sprx` (firmware 12.00, read from disassembly) all six write a SET_UCONFIG_REG to 0x342 (tag `0xCC000000 | stream`, or `0xCD000000 + workload * 32 + stream` for complete) and a WRITE_DATA to 0xC343, and active and complete add an ATOMIC_MEM (header `0xC0071E00`) on the stream's 64-bit mask. [Measured on a PS5](https://gist.github.com/orezraey/befe7632b827421988b47a6c04e89e1d) (firmware 13.60): WRITE_DATA dwords 5 to 8 are `0x06010000`, `0xC343`, 0 and the mask's high half (0 for inactive); the header low byte is 0x04 on the DCB SET_UCONFIG_REG and WRITE_DATA and 0x00 on the ACB ones; the table was at `0xFE003A000 + 8 * stream`; the pointer passed to `sceAgcDriverRegisterWorkloadStream` is never written
 - [sceAgcCreatePrimState](../../../core/libs/prx/libSceAgc/Shader/src/PrimState.cpp) (libSceAgc) - the `ge_user_vgpr_en` special is passed to the user configuration registers at whatever offset the shader header stores, as the SPRX does according to [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L1181-L1252), which copies all four specials verbatim (KytyPS5 stops on any other offset). PPSA99039, PPSA99505, PPSA99515 and PPSA99997 build their headers by hand with it at 0x25c (`GE_USER_VGPR1`) instead of 0x262 (`GE_USER_VGPR_EN`), value 0, and run on the console; it is not moved to 0x262, and the driver reads neither register. `ge_cntl`, `vgt_shader_stages_en` and a used `vgt_gs_out_prim_type` must still be at their own offsets, since the driver reads those registers there, so a header that stores one elsewhere throws naming the offset, although by OpenAGC the SPRX would copy it as well
 - [sceAgcDcbEventWrite](../../../core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp) (libSceAgc) - non-sample-dump event types (any event other than 0x38 and 0x39) emit a 2-dword PM4 packet 0x46 without address dwords; the address argument is ignored for these events. Void Terrarium (PPSA03061, #5055) passes a non-null address buffer (0x00000002d2a10000) with event type 0x16 (cache flush).
+
+- This pending declaration has an unverified signature and behavior; it is a parameterless import-resolution declaration that throws through `NotImplemented_nid_no_patch`: [`sceAgcAcbInitializeDefaultHardwareState`](../../../core/libs/prx/libSceAgc/Unimplemented.cpp).
+- [sceAgcAcquireMemSetEngine, sceAgcCbMemsetExclusive](../../../core/libs/prx/libSceAgc/Unimplemented.cpp) (libSceAgc) - declared with canonical signatures from decrypted headers; behavior on retail consoles remains unmeasured. Both throw through `NotImplemented_nid_no_patch`.
diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index 475aa11fb0..90920465e6 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -11,7 +11,8 @@
 
 - [sceAgcDriverSubmitAcb, sceAgcDriverSubmitMultiAcbs](../../../core/libs/prx/libSceAgcDriver/Submit/src/Acb.cpp) (libSceAgcDriver) accept compute queues 0x20 to 0x57 and throw for any other. On a PS5 (firmware 13.40, measured 2026-10-19 from inside a retail title) `sceAgcDriverSubmitAcb` returned 0 and ran a label-only buffer on queues 0x20, 0x30, 0x40, 0x50, 0x57 and also 0x58, which throws here; queue 0x1F faulted inside the console's driver (SIGSEGV in libkernel on the calling thread), which throws here too. Queues above 0x58 and `sceAgcDriverSubmitMultiAcbs` were not measured. Closes when: the console's highest accepted compute queue is measured
 
-- [sceAgcDriverAcquireHDRScopesACQ, sceAgcDriverHp3dLockEnd, sceAgcDriverHp3dLockStart, sceAgcDriverIsEsvmProcess, sceAgcDriverNopDataWritePacket, sceAgcDriverReleaseHDRScopesACQ, sceAgcDriverSetValueToSharedGds, sceAgcDriverSetWorkloadStreamInactive, sceAgcDriverSubmitReprojectionAcb, sceAgcDriverSuspendPointSubmitCdbg, sceAgcDriverSysGetGfxAppGpuResetStatus](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - signatures and behavior are unverified; these parameterless declarations only resolve imports and throw through `NotImplemented_nid_no_patch`.
+- [sceAgcDriverAcquireHDRScopesACQ, sceAgcDriverHp3dLockEnd, sceAgcDriverHp3dLockStart, sceAgcDriverIsEsvmProcess, sceAgcDriverReleaseHDRScopesACQ, sceAgcDriverSetValueToSharedGds, sceAgcDriverSetWorkloadStreamInactive, sceAgcDriverSubmitReprojectionAcb, sceAgcDriverSuspendPointSubmitCdbg, sceAgcDriverSysGetGfxAppGpuResetStatus](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - signatures and behavior are unverified; these parameterless declarations only resolve imports and throw through `NotImplemented_nid_no_patch`.
+- [sceAgcDriverNopDataWritePacket](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - writes an IT_NOP packet with 32-bit address at dword 1 and payload at dword 2, returning 2 dwords for null data or zero bytes, and total dwords otherwise. Console behavior for null or unaligned destination remains unmeasured.
 - [sceAgcDriverGetCoredumpAddress](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) returns the driver's shared coredump-area pointer, which is null when no coredump area is allocated. AnyPS5 reports coredump mode disabled and does not allocate this area; the export returns null. Enabling and populating an AGC coredump area is not implemented.
 - [sceAgcDriverSetTargetRingForDiag](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) returns `0x8A6D0001` (`DRIVER_FEATURE_UNAVAILABLE`), matching the retail PS5 export. The retail diagnostic log message is not reproduced.
 
@@ -23,6 +24,7 @@
 
 - [Inactive vertex point size](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) - `PA_CL_VS_OUT_CNTL.USE_VTX_POINT_SIZE` is accepted for lines, triangles and rectangles with `GS_EN` and `HS_EN` clear, when polygon mode is disabled or both faces are filled. Patches and absent routing or rasterization registers still throw; point lists on that routing use it (next entry). Bit 16 selects the misc export's X component as PointSize ([AMD CIK register reference](https://www.amd.com/content/dam/amd/en/documents/radeon-tech-docs/programmer-references/CIK_3D_registers_v2.pdf), PA_CL_VS_OUT_CNTL); ignoring it for non-point rasterization follows [Vulkan PointSize](https://docs.vulkan.org/refpages/latest/refpages/source/PointSize.html). This is inferred, not measured on console hardware. XashPS5 (PPSA19111 v1.3) sets `0x01210000` on a filled triangle draw.
 - [Vertex-path point lists](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - throws for a register size of 0, a clamp maximum of 0 with `USE_VTX_POINT_SIZE`, unequal register width and height, a clamp minimum above its maximum, `USE_VTX_POINT_SIZE` without `VS_OUT_MISC_VEC_ENA`, and point sprite coordinates; sizes above one pixel need `largePoints`. Inferred, not measured: that `PA_SU_POINT_MINMAX` clamps the exported size and not the register size ([radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state.c#L1047-1064)), and that an exported size of 0 or less covers nothing (here: the smallest point). A point list with `GS_EN` and `HS_EN` clear draws as Vulkan points, and the vertex program [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `PointSize`: the misc export's X, clamped, under `USE_VTX_POINT_SIZE`, else the `PA_SU_POINT_SIZE` height (12.4 fixed-point half sizes).
+- [MEM_SEMAPHORE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (AGC driver) - the semaphore is taken as a 64-bit word, as the 8-byte address alignment `sceAgcAcbMemSemaphore` checks suggests: a signal (operation 6) writes 1 with signal type 1 and adds 1 with signal type 0, and a wait (operation 7) polls until the word is non-zero and then subtracts 1. Signals and the decrement of a wait are atomic 64-bit operations on the guest word, so CPU threads and other queues updating it concurrently are not lost. Mailbox waits throw. The width and both signal types are inferred from the AMD PM4 field names, not measured on hardware; PPSA03396 signals with type 1 after compute dispatches.
 - [RELEASE_MEM of the system counter](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (AGC driver) - a `RELEASE_MEM` with `DATA_SEL = 4` throws: the frequency and epoch of the console's 64-bit system counter are not known. [amdgpu's GFX10 packet header](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/amdgpu/nvd.h) names the value "send 64bit sys counter value", beside 3, the GPU counter, which the driver writes as a 100 MHz count of the host's steady clock. An older KFD header names 4 a CP performance counter instead. A PS4 title through #6977 writes it at the end of each frame.
 - [Point and line polygon modes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - front and back polygon types that differ while both faces are drawn throw, as Vulkan has one `polygonMode` per draw. Points are drawn only one pixel wide (`PA_SU_POINT_SIZE = 0x00080008` inside `PA_SU_POINT_MINMAX`, the `VK_KHR_maintenance5` size of a point whose shader does not write `PointSize`); other sizes, a per-vertex size and devices without `maintenance5` throw. Lines must be one pixel wide (`PA_SU_LINE_CNTL`) and use Vulkan's default line rasterization. Depth bias with a point or line polygon mode, and such a mode on a rectangle list, throw. The fields follow the [AMD CIK register reference](https://www.amd.com/content/dam/amd/en/documents/radeon-tech-docs/programmer-references/CIK_3D_registers_v2.pdf); the console's rasterization of these points and lines is not measured.
 - [Native multisampled depth clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) accept the recognized HTILE mask kernel's direct full-range dispatch after its GPU writes complete. Every metadata byte needs tracked driver-store coverage since notification, no intervening CPU or depth write, and HTILE words proving the current clear value of zero or one. Partial, overlapping, indirect and unproven producers remain unsupported. Existing sampled views retain the native image; guest depth publication and metadata-fill transitions remain unimplemented. Windows shared imports retain write tracking through separate aliases; private host imports that lose tracking and copied or mirrored HTILE uploads remain unsupported. Clear-word encoding and console equivalence remain unmeasured on PS5 hardware.
@@ -32,19 +34,21 @@
 - [sceAgcDriverSetSubmitValidationMode, sceAgcDriverGetSubmitValidationMode, sceAgcDriverSetSubmitValidationConfig, sceAgcDriverGetSubmitValidationConfig, sceAgcDriverSetValidationErrorOutputFrequency, sceAgcDriverGetShaderDebuggingStatus](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - the five validation calls return `0x8A6C1000` without reading their arguments or writing caller memory, and `sceAgcDriverGetShaderDebuggingStatus` returns 1, as [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L250-L291) reads them from Sony's libSceAgcDriver.sprx: each validation export is `mov eax, 0x8a6c1000; ret` in the copy Dragon Quest VII Reimagined bundles (0x7bb0-0x7bf0), and the debugging status is 1 in the firmware 5.50 library (0x6740). The parameters (a 32-bit mode or frequency, a mode output, a configuration pointer) follow OpenAGC and are never read. Whether later retail firmware enables submit validation or shader debugging is unverified; no title in this repository is known to call them
 - [sceAgcDriver retail constant results](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - the debug, capture, GPU printf, register access, GPU reset, suspend point and user data exports taken from the retail `libSceAgcDriver.sprx`, and `sceAgcDriverRegisterOwnerForSystem`, `sceAgcDriverInitResourceRegistrationInterface` and `sceAgcDriverSetResourceRegistrationInfo` in [Registration.cpp](../../../core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp), are declared without parameters: the console bodies return a constant without reading any argument, so their signatures are unknown. `sceAgcDriverAllocateToolMemoryForGpuReset` and `sceAgcDriverGetAllocatedToolMemoryForGpuReset` read only the output pointer (fourth and second argument, a 12-byte range the console zeroes); the other arguments are declared as `uint64_t`.
 - [Indices far past every vertex fetch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - when a draw's highest index is at least 64Ki vertices past the largest per-vertex record count, every index past that count is moved to it in a copy of the indices, so the zero-padded vertex copies are not sized to the original index (PPSA04159 draws a list of `0xffffffff` with primitive restart off, which asked for 160 GiB). Each attribute fetched by vertex index reads zeros there as at the original index (out-of-bounds select 0 or 1); a draw with another out-of-bounds select keeps its indices. The vertex index the shader sees changes for the moved indices, which a shader that reads it directly would notice
+- [Depth bounds without the depthBounds feature](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - on a device without `depthBounds` (MoltenVK), a depth bounds draw with no depth test or write, a 32-bit float depth target, a pixel program that neither reads nor exports depth, and no stencil write on a failed test is drawn with a read-only depth test against one bound pinned as the viewport depth range: `GREATER_OR_EQUAL` against the upper bound when the lower one is 0, `LESS_OR_EQUAL` against the lower bound when the upper one is 1. This takes stored depth to stay in [0, 1], as it does without `VK_EXT_depth_range_unrestricted`. Both bounds inside (0, 1), depth testing, normalized depth targets and the other cases still need the feature and throw.
 - [Depth clear draws](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a draw with `DB_RENDER_CONTROL.DEPTH_CLEAR_ENABLE` is taken to write `DB_DEPTH_CLEAR` to every pixel it covers whatever the depth test, depth bounds and depth bias say: it is drawn with an always-passing depth write and the viewport depth range pinned to the clear value. The draw is rasterized as submitted, so its coverage is the draw's own. Whether the DB still applies the depth test or HiZ to such a draw is not measured
 - [GS_FAST_LAUNCH geometry](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `VGT_SHADER_STAGES_EN.GS_FAST_LAUNCH = 1` with a point list and `GE_CNTL` groups of one vertex and one primitive decodes as one point per subgroup, with the primitive limit taken from `GE_NGG_SUBGRP_CNTL.PRIM_AMP_FACTOR` and the GS/ES VGPR counts not required. Follows how RADV drives mesh shaders on gfx10.3 (`ac_nir_lower_ngg.c`, the workgroup index comes from the vertex id of the first thread), not measured on the console. Fast launch 2, other group sizes or input primitives and indexed fast-launch draws still throw. PPSA03671's fast-launch draws decode, but the title stops earlier in a wave64 vertex program, so they have not reached the GPU yet.
 - [Point geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 0` emits mesh points with `OutputPoints` and scalar `PrimitivePointIndicesEXT` as required by [SPV_EXT_mesh_shader](https://github.khronos.org/SPIRV-Registry/extensions/EXT/SPV_EXT_mesh_shader.html). Each packed primitive export contributes its first 9-bit vertex index and its null bit, using the same NGG primitive packing as line and triangle outputs. The subgroup reserves at least `GE_MAX_OUTPUT_PER_SUBGROUP` point slots, as the line path does; the console budget is not measured. Points use the register size or the misc-X point-size export and clamp interpreted by the vertex-point path; those register, clamp and rasterization inferences remain unmeasured on the console. Point sprites remain unsupported. Point output from a vertex workgroup still throws. Cocoon (PPSA08766) reaches this path with triangle-strip input.
 - [Line-strip geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 1` (line strip) runs as a mesh shader with `OutputLinesEXT`: each primitive export is one line whose two vertex indices are packed like the three of a triangle, as Mesa's NGG lowering exports line strips (`ac_nir_lower_ngg_gs.c`), and each input primitive gets `VGT_GS_MAX_VERT_OUT - 1` lines where a triangle strip gets `- 2` triangles. A subgroup gets at least `GE_MAX_OUTPUT_PER_SUBGROUP` line slots; whether the console does the same is unmeasured. A fast-launch subgroup takes its line count from `GE_NGG_SUBGRP_CNTL.PRIM_AMP_FACTOR`. Line output counts as lines for polygon offset decode. The lines are drawn 1 pixel wide with Vulkan default rasterization; `PA_SU_LINE_CNTL` is not read, and console line rules are not measured.
-- [Alpha-to-coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - only `DB_ALPHA_TO_MASK = 0xaa01` is accepted: the enable bit with the four quad offsets at 2 and no `OFFSET_ROUND`, the undithered setting [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/gallium/drivers/radeonsi/si_state.c#L371-L381) programs. Draws are single-sampled, so the pixel shader [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `SampleMask` 0 when its MRT0 alpha is below one half or NaN and all ones otherwise, and runs with late fragment tests. That rule was measured on a Radeon 660M (gfx1035, RADV with `RADV_DEBUG=noatocdithering`, which programs the same register) for 0, -0, 0.25, the two floats below one half, one half, the two above, 0.75, 1, 2, -1, both infinities and both NaNs, and is pinned in [AlphaToCoverage.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp); it is not measured on gfx1013. Vulkan's `alphaToCoverageEnable` is not used: the NVIDIA driver 615.78.08 dithers single-sample coverage (an alpha of 0.25 writes half the pixels of an RTX 3050 Laptop target). Other offsets, `OFFSET_ROUND`, a sample-mask export, and an MRT0 that is missing, swizzled, packed or exported without a floating-point alpha throw. A draw without a color target on MRT0 keeps alpha-to-coverage from its MRT0 export, as [radeonsi exports MRT0 as `32_AR` for alpha-to-coverage without a color buffer](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state_shaders.cpp#L2425-L2431). A draw that enables alpha-to-coverage with no MRT0 export still throws: what the console covers then is not measured. Default dithered `DB_ALPHA_TO_MASK = 0x18701` additionally uses a per-quad sample-mask table [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/4451#issuecomment-6124848921) for eight standard samples with FP16_ABGR or 32_ABGR exports; other sample counts, custom locations, EQAA combinations and dithered UNORM16/SNORM16 exports throw. The dithered rule is not measured on gfx1013.
-- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs, and so does `PS_ITER_SAMPLE` with one-sample color targets and no depth target, because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. With a one-sample depth target, a pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. Points and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, line and point lists (`VGT_PRIMITIVE_TYPE` 1-3, even when a geometry program turns them into triangles), `DB_EQAA` Z interpolation (`INTERPOLATE_COMP_Z`, `INTERPOLATE_SRC_Z`) and overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) also throw. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration.
+- [Alpha-to-coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `DB_ALPHA_TO_MASK = 0xaa01` is accepted: the enable bit with the four quad offsets at 2 and no `OFFSET_ROUND`, the undithered setting [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/gallium/drivers/radeonsi/si_state.c#L371-L381) programs. Draws are single-sampled, so the pixel shader [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `SampleMask` 0 when its MRT0 alpha is below one half or NaN and all ones otherwise, and runs with late fragment tests. That rule was measured on a Radeon 660M (gfx1035, RADV with `RADV_DEBUG=noatocdithering`, which programs the same register) for 0, -0, 0.25, the two floats below one half, one half, the two above, 0.75, 1, 2, -1, both infinities and both NaNs, and is pinned in [AlphaToCoverage.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp); it is not measured on gfx1013. Vulkan's `alphaToCoverageEnable` is not used: the NVIDIA driver 615.78.08 dithers single-sample coverage (an alpha of 0.25 writes half the pixels of an RTX 3050 Laptop target). Other offsets, `OFFSET_ROUND`, a sample-mask export, and an MRT0 that is missing, swizzled, packed or exported without a floating-point alpha throw. A draw without a color target on MRT0 keeps alpha-to-coverage from its MRT0 export, as [radeonsi exports MRT0 as `32_AR` for alpha-to-coverage without a color buffer](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state_shaders.cpp#L2425-L2431). A draw that enables alpha-to-coverage with no MRT0 export still throws: what the console covers then is not measured. Default dithered `DB_ALPHA_TO_MASK = 0x18701` additionally uses a per-quad sample-mask table [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/4451#issuecomment-6124848921) for eight standard samples with FP16_ABGR or 32_ABGR exports; other sample counts, custom locations, EQAA combinations and dithered UNORM16/SNORM16 exports throw. The dithered rule is not measured on gfx1013.
+- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs (with a one-sample depth target, `ANCILLARY` only under `PS_ITER_SAMPLE`), because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. A pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. With a one-sample depth target and without `PS_ITER_SAMPLE`, the [packed ancillary word](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) gives a program that reads `ANCILLARY` sample index 0, inferred for a pixel the guest does not iterate, and that is the sample the one-sample draw keeps. Points and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, `DB_EQAA.INTERPOLATE_COMP_Z` is accepted: with every sample at the pixel center, Z interpolated to any sample position is the center's Z, which the one-sample draw tests. That rests on the same inference; neither [PAL](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9MsaaState.cpp#L117-L118) nor [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/761d5c8a54f93b3d43608f718910ed742983dd0b/src/gallium/drivers/radeonsi/si_state.c#L3314-L3316) sets the bit, and its meaning is not documented. Line and point lists (`VGT_PRIMITIVE_TYPE` 1-3, even when a geometry program turns them into triangles), `INTERPOLATE_SRC_Z` and overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) still throw. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration. Gran Turismo 7 (PPSA01317) draws its main pass with a one-sample depth target, `DB_EQAA` 0x00050000 and a 4x configuration.
+- [One-fragment multisampled color target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a color target with `CB_COLOR_ATTRIB` 4 samples and 1 fragment is decoded as one sample that keeps its coverage sample count and draws sample 0's coverage. Measured only on radeonsi GL (Radeon 610M and 680M); console behaviour is not measured. It requires static `DB_EQAA` anchors at the depth target's sample count and CMASK code 0 or 0xc-0xf. More than one but fewer fragments than samples, more fragments than samples, other CMASK codes and any guest read of the FMASK of a target the host drew still throw.
 - [MSAA_ENABLE on a single-sample target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_MODE_CNTL_0.MSAA_ENABLE` with `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES = 0` is drawn like the same state without the bit when sample 0 of the four `PA_SC_AA_SAMPLE_LOCS_PIXEL_*_0` registers is at the pixel center and the draw rasterizes filled triangles or rectangles (`VGT_PRIMITIVE_TYPE` 7 or 17 as well as the triangle types) with alpha-to-coverage and conservative rasterization off. [RADV](https://gitlab.freedesktop.org/mesa/mesa/-/blob/745709a000482a4a24c91faef5c5a40bd653a863/src/amd/vulkan/radv_cmd_buffer.c#L13606-13609) programs this state for one-sample custom sample locations on GFX10 and later, where the bit makes the rasterizer use the programmed location of sample 0 ([061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11597f720535f00e79a5752e24aff6)); that the bit changes nothing else for such a draw is inferred from that and is not measured on hardware. EA Sports UFC 5 (PPSA03541) reaches a rect-list draw in this state. Other locations of sample 0, absent location registers, points, lines, alpha-to-coverage and conservative rasterization throw
 - [A multisampled target rasterized without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - not measured on hardware: `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear puts every color, depth and stencil sample at the pixel center, as in GL without multisampling ([ARB_multisample](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089/extensions/ARB/ARB_multisample.txt#L185), [RADV 061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11)). Lines cover whole pixels by the host's line rule, not the console's aliased one ([D3D11.3](https://github.com/microsoft/DirectX-Specs/blob/f37b0d6033a1/d3d/archive/D3D11_3_FunctionalSpec.htm#L13705)). Depth sample tests and occlusion counts are unknown. Rasterized points, alpha-to-coverage, and Z interpolation, overrasterization or a sample-mask export with depth throw. PPSA06888 draws a 2x target, PPSA18216 a 4x depth and color pair and 4x lines.
 - [sceAgcDriverGetEqContextId](../../../core/libs/prx/libSceAgcDriver/Eq/src/Query.cpp) (libSceAgcDriver) - returns `ident`: an end-of-pipe interrupt is delivered only to the registration whose id equals the raising queue, so `ident` is that context's id (titles register 0 or 1 for graphics and `0x20 + 8 * pipe + queue` for compute). The console's value is not known; KytyPS5 returns the event's `data`, which it fills with the interrupt's context id, whereas `data` here is the EV_CLEAR trigger count. Other event filters throw
 - [User data registers](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp) (AGC driver) - a `SPI_SHADER_USER_DATA_*` or `COMPUTE_USER_DATA_*` register the title never wrote reads as 0 when a stage's RSRC2 count covers it, as Kyty (zeroed `UserSgprInfo`) and SharpEmu (missing registers read 0) do, and as AMD PAL and Mesa initialize them; the console's value is not confirmed
 - [SET_PREDICATION](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (AGC driver) - boolean predication follows the AMD PM4 encoding [Mesa](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/amd/common/sid.h) uses: operation 3 reads 64 bits and 4 reads 32 bits, and bit 8 runs predicated packets when the value is non-zero (clear: when it is zero); the bit 12 hint is ignored. The address must have its low 4 bits clear, as `sceAgcDcbSetPredication` writes it. Query predication (Z-pass, primitive count), a predicated COND_EXEC, predicated command buffer chains and flips in predicated command buffers throw
 - [Barycentrics without mesh shaders](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp) (AGC driver) - a pixel shader that reads barycentrics on the mesh path is emulated only on a device with `VK_EXT_mesh_shader`; a device with neither it nor `VK_KHR_fragment_shader_barycentric` (reported on Linux RADV with a GCN 5 GPU) throws that the device has neither the barycentric extension nor mesh shaders, because a geometry stage cannot follow a mesh stage and no other route is implemented. `VK_AMD_shader_explicit_vertex_parameter`, which a GCN 5 device on RADV exposes, is an unexplored option.
-- [NGG vertex programs on the mesh path](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - an unregistered vertex program with `PRIMGEN_EN` that uses LDS or `s_barrier` runs on the geometry (mesh) path. Each input primitive is assumed to yield at most one output primitive, the subgroup is bounded by `GE_MAX_OUTPUT_PER_SUBGROUP` as a vertex budget, and the GS/ES VGPR count checks are skipped, because the merged inputs keep their positions. Taken from the code Mesa's ACO emits for NGG culling and from PPSA59322 and PPSA99010 draws, not measured on hardware. Registered programs keep the vertex path
+- [NGG vertex programs on the mesh path](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a vertex program with `PRIMGEN_EN` that uses LDS or `s_barrier` runs on the geometry (mesh) path. Each input primitive is assumed to yield at most one output primitive, the subgroup is bounded by `GE_MAX_OUTPUT_PER_SUBGROUP` as a vertex budget, and the GS/ES VGPR count checks are skipped, because the merged inputs keep their positions. Taken from the code Mesa's ACO emits for NGG culling and from PPSA59322 and PPSA99010 draws, not measured on hardware.
 - [VGT_SHADER_STAGES_EN 0x02002008](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - this one value, `ES_EN` = 1 without `HS_EN` on a non-patch draw, is drawn as the vertex path. AMD's CIK register reference calls `ES_EN` = 1 `ES_STAGE_DS` (the ES stage runs the tessellation evaluation shader), which does not explain it on a non-patch draw. Seen only on PPSA29413 and not verified on the console; other vertex-path values with `ES_EN` set still throw.
 - [Strided buffer overhang](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - a strided buffer descriptor that ends less than one stride past the end of the readable registered allocation holding its base is bound only up to that allocation's end, even when another readable allocation starts right there. This assumes the bytes past the end are the rounded-up `num_records` of the last record (RADV rounds it up), which no fetch inside the buffer reads; a guest that really keeps a vertex split across two adjacent allocations would read zeros for the cut tail. The same holds for a read-only strided buffer that starts below the render target and runs less than one stride into it: it is bound only up to the target, as a vertex fetch whose attribute descriptor starts at the attribute's offset reaches that far past the attribute's last bytes. Taken from the RetroArch Dolphin core case in #2912, not measured on hardware.
 - [Buffer descriptor CACHE_SWIZZLE hint](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - bit 30 of word 1 in a buffer resource descriptor (`words[1] & 0x40000000u`) is normalized to zero when binding guest buffers in `ShaderResources::addGuestBuffer`. On GFX10 (gfx1013), bit 30 of V# word 1 is `CACHE_SWIZZLE` (Mesa's `gfx10-rsrc.json`: STRIDE [29:16], CACHE_SWIZZLE [30], SWIZZLE_ENABLE [31]), a cache-bank hint with no effect on the address or data, which is dropped here.
@@ -68,25 +72,33 @@
 ### Functional
 
 - [Written staging window on discrete GPUs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) - a written buffer element of a dispatch that is not swept is staged device-local up to 8 MiB on a discrete GPU (`Context::discreteGpu`) and up to 2 MiB otherwise; `APS5_WRITTEN_SHADOW_MAX_KIB` replaces either bound. The 8 MiB figure comes from one title on one NVIDIA Windows system (PPSA09911: a 2.5 and a 3.3 MiB skin-cache output written in place cost 55 ms of GPU time per frame, 1.8 ms of extra staging copies once staged); the point where the two copies of a larger element cost more than its in-place stores, and whether AMD or Linux drivers move it, has not been measured. The window is per element and per use, so a kernel that streams once through an element inside the window pays the copy-in and the copy-back on every dispatch.
+- [Frame capture](../../../core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp) (libSceAgcDriver) records guest memory on Windows only (a VirtualQuery walk of the registry allocations and the Windows write tracker); elsewhere a capture throws when it starts. Ranges are captured by allocation and protection, not by mapping: section views, aliases of one direct memory block and file views are snapshotted and replayed as separate private memory, so a store through one alias is not seen through another, and CPU stores to them during the captured frames are not recorded (only write-watched private memory is). Pages of the title's image are recorded during the frames only when a shader header or an array it points to lies in them and their content changed. A capture starts only at a frame boundary where the driver goes idle within 10 s, and gives up after five boundaries that do not. A capture also stops when GPU work in flight at a delta waits on a later CPU store.
+- [Frame replay](../../../core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp) (libSceAgcDriver) orders the calls of different captured threads only by their start (a call starts once every earlier call has started), so the driver sees a schedule the title could have produced, not necessarily the one it did. CPU stores a title made from threads that never call the driver are known only by the next recorded call, so the replay applies them early or late when a GPU wait needs them and derives a value from the wait's reference when no recorded store satisfies it (`of_them_synthesized`). Pacing compares the number of submissions in flight, not what they hold. Prologue registrations of shaders whose memory the title reused after registering them fail and are counted (`stale_registrations`). The title's image range must be free in the replaying process, so the tool is linked at a high image base on Windows.
 - [Workgroup count split](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - a direct dispatch over `maxComputeWorkGroupCount` runs as `vkCmdDispatch` chunks, each bound to a pipeline variant whose workgroup offset specialization constants add the chunk's base to `WorkgroupId` and `GlobalInvocationId`. A variant is built when its chunk base is first recorded, not when the dispatch is prepared. A split of a shader with device-memory LDS throws: its slot base reads the chunk's `NumWorkgroups`, not the dispatch's. Chunks are ordered by a compute barrier, which the console does not have between workgroups of one dispatch.
+- [Experimental submission progress](../../../core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp) (AGC driver) - the opt-in two-millisecond pacing budget is not derived from console hardware. Cross-title performance remains unvalidated; host scheduling can overshoot the timeout and pacing can reduce CPU/GPU overlap.
+- [GPU allocation recovery](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - recovery may free too little and still throw: caller-held sampled images, pending storage results and recorder references stay alive. Budgets remain floors rather than hard device limits. Image and buffer allocation failures trim idle buffers, then sampled and clean storage cache entries. A held cache lock is reused only for a new image's allocation after lookup iterators are no longer used; hit refreshes and flushes skip that cache. Other cache, resource and device locks are tried without waiting.
+- [UINT color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - what the console's CB does with a raw 32-bit export into an 8- or 16-bit UINT channel (clamp or truncate) and whether it blends into integer targets at all is not measured. Here a raw 32-bit export (`32_R`, `32_GR`, `32_AR`, `32_ABGR`) into a UINT target is passed as the exported bits through the `Uint` export packing and the target's blend is dropped; the execution test draws `32_R` into `R32_UINT`, `32_GR` into `R32G32_UINT` and `32_AR` and `32_ABGR` into `R32G32B32A32_UINT` (tiled and linear) and reads every written channel back bit for bit, and draws `32_R` values from 0 to 255 into `R8_UINT`; a value an 8- or 16-bit channel cannot hold is left to the Vulkan attachment's conversion, which Vulkan leaves undefined, and is not tested. On lavapipe (Mesa, LLVM 20) a constant export of exactly 1.0 in the first channel and -0.0 in the second stores +0.0 in the second although the module declares `SignedZeroInfNanPreserve`, so the test leaves that pair out. The blend is dropped since Vulkan's framebuffer chapter says blending is only defined for floating-point, UNORM, SNORM and sRGB formats and Metal refuses both the float output and the blend on integer attachments (#9783). `FP16_ABGR`, `UNORM16_ABGR`, `SNORM16_ABGR` and `SINT16_ABGR` exports into UINT targets throw.
 - [Scan-resistant sampled texture admission](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - while the sampled texture cache is over its budget but within a quarter over it, the first use of a texture it does not hold in a present is refused (used for its draw, then released, never cached) when its least recently used entry was used in the current or previous present, and a later use in the same present is refused when that entry was used in the current present. So a working set larger than the budget keeps a stable subset: a texture used more than once in a present still evicts an entry not yet used in that present, so a working set with interleaved multi-use textures rotates as on main, and the textures that arrive after the cache fills are created again at each use for as long as the least recently used entry is from the current present, including in the transition present after a scene change. Past a quarter over the budget the entries are evicted as before, so after the budget falls the cache can sit at up to 125% of the reduced budget until entries stop being used. Entries unused for two presents are evicted as before. A later use can evict an entry from the previous present and then be refused when the next least recently used entry is from the current present, so that entry is created again in the next present. The "current or previous present" window is an unmeasured threshold: it was chosen, not derived. Measured once, as one A-B-A series on one title (loading phase about 33000 textures per frame against a 5.4 GiB budget) on one RTX 4090, 3600 s each: 932 / 968 / 941 frames, evictions after frame 620 2.72M -> 1.17M, texture creations unchanged (about 5.8M). Nothing is measured on other titles or GPUs, and a title whose per-present working set only slightly exceeds the budget now re-creates the excess textures at every use.
-- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache's budget is what the reported heap budget leaves after the heap's use other than the cached storage images (at least the sampled textures alive) and an eighth of the budget, capped at a quarter of the budget and at `TextureCacheBudget` (a quarter of the heap's size, at least 2 GiB), never below 512 MiB; the sampled cache's budget reserves `TextureCacheBudget` for the storage cache and never falls below 2 GiB. The storage budget keeps no room for the part of that 2 GiB floor the sampled textures alive do not use: it gives room back as they grow, at its next read. As the heap's other use grows the sampled budget reaches its floor first, then the storage budget falls. Each cache trims only at its next insert, a storage image is allocated before its insert reads the budget, and both budgets read the heap at most once a second, so a burst between two reads, sampled textures included, can still exceed the reported budget. The eighth is the sampled formula's value reused and the 512 MiB floor and the caps the earlier ones; none was measured beyond PPSA11386 on one 10 GB GPU and PPSA16064 on one 8 GB GPU, and a title whose storage working set exceeds the shrunk budget re-creates storage images at each use.
+- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache gets what the reported heap budget leaves after the heap's other use, the live sampled textures and an eighth of the budget, capped at half of the budget and of the heap, at least 512 MiB; the sampled cache reserves the larger of `TextureCacheBudget` and the storage images held, and keeps at least 2 GiB; above the floors neither budget plus the other cache's bytes exceeds the budget less its eighth. Both read the heap at most once a second and trim at their next insert, so a burst can exceed the budget. The storage budget gives back the part of the sampled floor not in use. The eighth and the floors were checked only on PPSA11386 (10 GB GPU) and PPSA16064 (8 GB GPU); the halves come from PPSA25636 on one 8 GB GPU (a 3.5-4 GiB storage working set). A title whose storage working set exceeds its budget re-creates storage images at each use.
 - [Polygon primitive type](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `VGT_PRIMITIVE_TYPE` 21 (`PrimitiveType::Polygon`) decodes to `VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN` and is treated as inactive for vertex point size, like triangle fans and strips. PPSA01317 (Gran Turismo 7) submits polygon draws; whether the console performs polygon-mode decomposition or custom vertex routing is unverified.
-- [Native multisampled DCC fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) import uniform 0000/0001/1110/1111 keys into a single-layer, level-zero SW_64KB_R_X color image with 2, 4 or 8 fragments. Color and DCC/CMASK ranges must stay write-watched and unchanged; expanded or mixed initial DCC, register CMASK clears, compressed payloads, color transforms, lossy modes, other metadata changes, guest publication and writes over a live owner throw. A whole-range DCC fill with one of those keys, landed or still recorded, is taken as its fast clear; a partial fill, or a CMASK changed without a whole fill, throws. Driver-mediated reads of the color and metadata stay guarded. The metadata extent follows [AMD Addrlib](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L347-L454) with the [PS5 Mesa model](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/winsys/ps5/radv_ps5_winsys.c): GFX10.1, 16 pipes, 256-byte interleave, two maximum compressed fragments. Console geometry, concurrent guest mutation and transitions outside this subset are unverified.
+- [Native multisampled DCC fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) take only uniform 0000/0001/1110/1111 keys, or a whole-range DCC fill of one, into a single-layer, level-zero SW_64KB_R_X image of 2, 4 or 8 fragments. Other initial DCC, register CMASK clears, compressed payloads, color transforms, lossy modes, partial fills, a CMASK changed without a whole fill, a range compared only after its import unless a whole fill follows, guest publication and writes over a live owner throw. Color and metadata must stay write-watched or lie in a host import the Linux probe compares, where a same-value CPU store is not seen; compared Windows imports throw. The metadata extent follows [AMD Addrlib](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L347-L454) for GFX10.1 with 16 pipes; console geometry is unverified.
 
 - [Initial stencil state](../../../core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp) uses zero for `DB_STENCIL_CONTROL`, `DB_STENCILREFMASK` and `DB_STENCILREFMASK_BF` (context `0x10b`-`0x10d`), including after `CLEAR_STATE`. The public V0, V4, V5 and V7-V11 [register-default tables](../../../core/libs/prx/libSceAgc/Command/include/RegisterDefaultsData.hpp) supply these values. Linux's [GFX10 clear-state table](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/amdgpu/clearstate_gfx10.h) agrees on the control register but uses `0x01000000` for the reference masks; the console reset values have not been measured. Planet Coaster (PPSA01736 v01.017) enables stencil tests without writing the control register.
 - [Multisampled DCC comp-to-single clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (AGC driver) - RADV's multisampled comp-to-single clear dispatch ([`radv_clear_dcc_comp_to_single`](https://github.com/mihawk-99/PS5_Mesa/blob/1ba9874f478657ccf6da72ce55f0260164cc0bd0/src/amd/vulkan/meta/radv_meta_clear.c#L954)) is recognized by its code and not run. Its clear color (user data 5 to 8, which the shader stores as the four dwords of sample 0's texel) is recorded for the surface its image descriptor names, and DCC keys of 0x10 on a multisampled target of that surface, pipe-bank XOR, size and sample count import as a clear to it, for texels of 8 to 128 bits. A record is dropped when an unmap or allocation removal covers its surface's base. The guest's color memory doesn't get the color at the blocks' first pixels, and the recorded color is assumed to be the one the keys refer to: RADV writes 0x10 keys only in a fast clear that runs this dispatch for the same image right after, and initializes DCC to 0x00 or 0xff on an image's first use ([`radv_init_color_image_metadata`](https://github.com/mihawk-99/PS5_Mesa/blob/1ba9874f478657ccf6da72ce55f0260164cc0bd0/src/amd/vulkan/radv_cmd_buffer.c#L16894)). A new image on memory reused within one mapping, with the same address, XOR, size and sample count, whose clear runs a comp-to-single shader other than the recognized one, would still import the old color.
 - [Initial depth and stencil planes](../../../core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp) - the console's reset values of `DB_Z_INFO` and `DB_STENCIL_INFO` (context `0x010`-`0x011`) are not measured. Both start, and return after `CLEAR_STATE`, at zero (formats `INVALID`), the value of Linux's [GFX10 clear-state table](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/amdgpu/clearstate_gfx10.h). The public [register-default tables](../../../core/libs/prx/libSceAgc/Command/include/RegisterDefaultsData.hpp) write `0x80000180` and `0x20000180` instead, also with formats `INVALID`; of their other bits, only `TILE_STENCIL_DISABLE` would change a result: the HTILE layout of a multisampled depth plane whose `DB_STENCIL_INFO` was never written.
-- [Type-0 and type-1 texture descriptors](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp) (`TYPE` = 0 or 1 in dword 3) with a nonzero base are bound as null images, like a zero base. TYPE 0 comes from a gfx1036 (RDNA2) measurement in issue #4139 (image sample, load and resinfo return zero, no fault). TYPE 1 comes from a gfx1010 (RDNA1) measurement in #4139 and #5828 (`image_sample_lz`, `image_sample_b`, `image_load` and `image_get_resinfo` return zero, no fault) with format 22 only; TYPE 1 is not measured on RDNA2, with other formats or with depth-compare reads (`image_sample_c*`). Neither type was measured on the console's gfx1013.
-- [Multisampled color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) lose their guest-read guards and cannot be reused after a successful allocation removal or unmap covers their full guarded range. The next target, sampled or storage lookup removes retired cache owners; recorded work and sampled views keep their images alive until their last reference is released. Partial unmaps keep the guard; partial allocation reuse and guest access to live multisampled data remain unsupported.
-- [Stencil reference export replay](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) on devices without `VK_EXT_shader_stencil_export` replays the low eight bits of the values proved from constant, select and phi exports, with an export proved on every kept path. An export the prover cannot bound replays all 256 eight-bit values, one pass per value per triangle (logged once per process). It records instances, then their triangles, then the reference classes of each triangle. One pipeline filters fragments at shader termination against a dynamic push value before late stencil and depth tests. The [Vulkan stencil-reference replacement rule](https://docs.vulkan.org/refpages/latest/refpages/source/FragStencilRefEXT.html) discards bits above the attachment's stencil width; supported stencil attachments have eight bits. Numeric subgroup observations throw except bounded own-lane mask plumbing and group control with kept-lane and derivative-helper coverage proved. WQM inputs must exclude helper contributions, since [non-quad subgroup operations may treat helpers as inactive](https://docs.vulkan.org/glslext/latest/glslext/khr/GL_KHR_shader_subgroup.html). Readonly guarded SRT reads may report internal host faults; these draws wait and check faults before publishing results, and loops throw. Indirect draws, restart, strips, fans, tessellation, mesh, multisampling, early tests, ordered pixel execution, guest shader memory writes, other fault-producing memory access, clocks, primitive ID inputs, attachment feedback and pipeline face/channel splits throw. An exhausted stage push range throws. Equivalence to console ordering has not been measured on console hardware.
+- [Type-0 and type-1 texture descriptors](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp) (`TYPE` = 0 or 1 in dword 3) with a nonzero base are bound as null images, like a zero base. TYPE 0 comes from a gfx1036 (RDNA2) measurement in issue #4139, TYPE 1 from a gfx1010 (RDNA1) measurement in #4139 and #5828 with format 22 only. On a gfx1100 (RDNA3, RADV Mesa 25.2.8) both types answer zero with no fault from `image_sample_lz`, `image_sample_b`, `image_load`, `image_sample_c_lz` and `image_get_resinfo`, for formats 32_FLOAT, 16_SSCALED, 2_10_10_10_SNORM and 8_UNORM (GFX11 codes 22, 10, 37, 1), over a readable nonzero base and a zero base ([hardware oracle](../HW_ORACLE.md), 2D T# declared 64x32). The TYPE 9 control answers the stored texel, 64 and 32 from resinfo, and 1.0 from an ALWAYS `image_sample_c_lz` at 32_FLOAT, the only one of these formats gfx1100 compares. TYPE 1 is not measured on RDNA2, and neither type on the console's gfx1013.
+- [Multisampled color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) lose their guest-read guards and cannot be reused after a successful allocation removal or unmap covers their full guarded range. The next target, sampled or storage lookup removes retired cache owners; recorded work and sampled views keep their images alive until their last reference is released. A target made from a multisampled texture that a sample reads before any draw is retired instead when a guest access overlaps it, until a draw, a dispatch's storage write or an absorbed color fill puts samples on the host only; it is rebuilt from guest memory at its next use. Partial unmaps keep the guard; partial allocation reuse and guest access to live multisampled data remain unsupported.
+- [Stencil reference export replay](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) on devices without `VK_EXT_shader_stencil_export` replays the low eight bits of the values proved from constant, select and phi exports, with an export proved on every kept path. An export the prover cannot bound replays all 256 eight-bit values, one pass per value per triangle (logged once per process). It records instances, then their triangles, then the reference classes of each triangle. One pipeline filters fragments at shader termination against a dynamic push value before late stencil and depth tests. The [Vulkan stencil-reference replacement rule](https://docs.vulkan.org/refpages/latest/refpages/source/FragStencilRefEXT.html) discards bits above the attachment's stencil width; supported stencil attachments have eight bits. Numeric subgroup observations throw except bounded own-lane mask plumbing and group control with kept-lane and derivative-helper coverage proved. WQM inputs must exclude helper contributions (a ballot of the active lanes, as in an EXEC copy, covers whole quads and is accepted), since [non-quad subgroup operations may treat helpers as inactive](https://docs.vulkan.org/glslext/latest/glslext/khr/GL_KHR_shader_subgroup.html). Readonly guarded SRT reads may report internal host faults, and read-only BDA reads may report faults; these draws wait and check faults before publishing results, and loops throw. Indirect draws, restart, strips, fans, tessellation, mesh, multisampling, early tests, ordered pixel execution, guest shader memory writes, other fault-producing memory access, clocks, primitive ID inputs, attachment feedback and pipeline face/channel splits throw. An exhausted stage push range throws. Equivalence to console ordering has not been measured on console hardware.
 
 - [32-bit depth-bits reads of guest memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver): a sampled 32_UINT or 32_SINT T# with a depth swizzle mode that no live depth surface matches reads the guest bytes through an R32_SFLOAT image, as the recompiler's depth-bits read expects, and the shader casts the fetched value back to the stored dword. On RX 6700 XT (gfx1031, AMD Windows driver 32.0.21045.5002) the read keeps float denormals, the sign bit alone and quiet and signaling NaN payloads bit for bit. A host that canonicalizes NaNs or flushes denormals on a 32-bit float fetch would change those dwords, and other drivers are not measured. A live depth surface whose extent or base level differs from the T# is not used; the read takes the guest bytes, as the 32-bit float and 16-bit views already do.
-- [Reused depth storage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp): a storage view with another extent or a format that cannot hold the cached depth plane uses guest memory. Depth rendering is not written back to those guest bytes; this admission rule does not prove allocation reuse or preserve a depth writer through an incompatible view. A 2D storage view, or a one-layer 2D array view of layer 0, of level 0 with the plane's extent and format (32-bit float or the 32-bit depth-bits layout for the depth plane, 16-bit unorm for D16, 8-bit uint for the stencil plane) is a storage image that is [filled](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) from the depth image before every use and, when the shader writes it, copied back after the work: a whole-plane copy through a staging buffer each way. A dispatch of the 15-word 8x8x1 image clear kernel ([`MatchStorageImageClear`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp): one colour read from the V# in `user[8..11]` stored to every texel of the T# in `user[0..7]`) that covers the whole plane and stores 0 or 1 through a 16-bit unorm view, 0 or 0xffff through a 16-bit uint view, or 0 or a normal float in (0, 1] through a 32-bit float or integer view leaves out the copy-in and replaces the copy-out by a clear of the depth image to that value; the dispatch still writes the storage image. The colour is read again when the copy-out is replaced, and a changed value keeps the copy-out. Indirect dispatches, partial last groups, dispatches that queue on the draw pipeline, other values and formats, a plane the kernel covers only partly and stencil planes keep both copies. A written view is also left pending like any other storage image, so the plane's content, drawn depth included, reaches guest memory on the next flush of that range. A 2D array view of more than one slice of the depth plane, or of a later slice, is a storage image over the slices from 0 to its last (`LayeredDepthStorage`); only the slices from its base slice to its last are copied: a slice that has a depth surface at the plane's address plus a whole depth slice per layer (`DepthSliceBytes`, as for the depth plane copies below) is copied from that surface before every use and back to it after the work, every bound slice each time, through a staging buffer; the other slices hold guest memory like any storage image. These images are kept per address, extent, slice count, base slice, format and tile mode until the device goes away, outside the storage cache's budget. Such a view needs a layer pitch equal to that slice size, and another view of the same memory (the 2D view of its first slice, a view from another base slice, or a sampled copy) is a separate image, copied in before and out after each use, so views that are written before a flush and share a slice do not merge: the later copy-out wins, so their results are not merged. A matching view still throws when it is a cube, a 2D array of more than one layer of the stencil plane or from a later slice, or another level, when the surface is multisampled, when it names the depth plane of a 16-bit depth with stencil surface the device stores in a wider format, and when it was written after another view of the same plane (another format, tile mode, address or dimension) replaced it, as two such views bound in one dispatch are. Stored depth values outside 0..1 are not clamped, and Vulkan leaves that copy undefined without `VK_EXT_depth_range_unrestricted`. `agc_driver_depth_storage_dispatch` pins these paths; none is measured on the console.
+- [Reused depth storage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp): a storage view with another extent or a format that cannot hold the cached depth plane uses guest memory. Depth rendering is not written back to those guest bytes; this admission rule does not prove allocation reuse or preserve a depth writer through an incompatible view. A 2D storage view, or a one-layer 2D array view of layer 0, of level 0 with the plane's extent and format (32-bit float or the 32-bit depth-bits layout for the depth plane, 16-bit unorm for D16, 8-bit uint for the stencil plane) is a storage image that is [filled](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) from the depth image before every use and, when the shader writes it, copied back after the work: a whole-plane copy through a staging buffer each way. A dispatch of the 15-word 8x8x1 image clear kernel ([`MatchStorageImageClear`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp): one colour read from the V# in `user[8..11]` stored to every texel of the T# in `user[0..7]`) that covers the whole plane and stores 0 or 1 through a 16-bit unorm view, 0 or 0xffff through a 16-bit uint view, or 0 or a normal float in (0, 1] through a 32-bit float or integer view leaves out the copy-in and replaces the copy-out by a clear of the depth image to that value; the dispatch still writes the storage image. The colour is read again when the copy-out is replaced, and a changed value keeps the copy-out. Indirect dispatches, partial last groups, dispatches that queue on the draw pipeline, other values and formats, a plane the kernel covers only partly and stencil planes keep both copies. A written view is also left pending like any other storage image, so the plane's content, drawn depth included, reaches guest memory on the next flush of that range. A 2D array view of more than one slice of the depth plane, or of a later slice, is a storage image over the slices from 0 to its last (`LayeredDepthStorage`); only the slices from its base slice to its last are copied: a slice that has a depth surface at the plane's address plus a whole depth slice per layer (`DepthSliceBytes`, as for the depth plane copies below) is copied from that surface before every use and back to it after the work, every bound slice each time, through a staging buffer; the other slices hold guest memory like any storage image. These images are kept per address, extent, slice count, base slice, format and tile mode until the device goes away, outside the storage cache's budget. Such a view needs a layer pitch equal to that slice size, and another view of the same memory (the 2D view of its first slice, a view from another base slice, or a sampled copy) is a separate image, copied in before and out after each use, so views that are written before a flush and share a slice do not merge: the later copy-out wins, so their results are not merged. A matching view still throws when it is a cube or a 2D array of more than one layer of the stencil plane or from a later slice, when the surface is multisampled, when it names the depth plane of a 16-bit depth with stencil surface the device stores in a wider format, and when it was written after another view of the same plane (another format, tile mode, address or dimension) replaced it, as two such views bound in one dispatch are. Stored depth values outside 0..1 are not clamped, and Vulkan leaves that copy undefined without `VK_EXT_depth_range_unrestricted`. `agc_driver_depth_storage_dispatch` pins these paths; none is measured on the console.
 - [Collapsed color array views](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) preserve the selected slice in the XOR address equation when the view is represented as a shifted 2D surface. Native Vulkan coverage checks R_X draws, array reads, publication and re-upload for slices 1-3; Lost Soul Aside PPSA26358 validates the RGBA16F cube mip chain on Windows/NVIDIA. Other devices and console comparisons remain unverified. Full-array views retain their layer addressing.
 - A [depth surface](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) is retired when a color target or a written storage image it does not serve overlaps it, or when it is sampled through a view it cannot serve and guest memory over it was written since it was last bound; lookups then skip it, so sampling reads the memory like any texture. Bound again, it keeps its own depth instead of the bytes written over it, except for the depth planes the next entry keeps in guest memory. Without write watching, a view it cannot serve still throws. A retired surface also gives up its depth and stencil planes, so another surface sharing them no longer copies from it.
 - [Depth planes in guest memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): only single-sample `D32_SFLOAT` and `D32_SFLOAT_S8_UINT` planes with the 64 KiB Z swizzle (`SW_MODE` 24) reach guest memory; D16, other swizzles, stencil and multisampled planes keep depth in the host image only. A plane drawn since its last store is stored, uncompressed, in 64 KiB units (128x128 tiles): a buffer upload, a `GuestBuffers` V#, an image lookup or a pending-store flush stores the units it overlaps, a color target or written storage image over the plane all of them. CPU reads and reads through address-based heaps are not caught. Guest writes are ordered when collected (bind, flush, collect epoch), not when made: a collected write reloads the units it touched unless an HTILE clear is pending. A store outside a recorder waits for the GPU. The console keeps HTILE-compressed tiles compressed in memory until a decompress (Mesa `ac_descriptors.h`).
+- [Depth surfaces over compared shared memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a depth surface over Windows direct memory that is compared once it is shared sees CPU writes made after the sharing no more than one over unwatched memory does. Its generations come from refused collects (0) or `TrackerGeneration()`, and nothing stamps compared memory after the one report at the sharing.
+- [Unmapped depth planes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a drawn depth plane whose guest memory the title unmapped before it was stored is not stored; its pending depth is dropped with a one-time warning. What the console does with such a store is not known. Readable planes without write permission retain the unsupported-store failure and their pending results.
 - [Depth plane copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a depth plane sampled as a 2D array or a cube, or a D16 plane read as `R16_UINT`, is copied into an image of its own (`DepthPlaneCopy`), kept per base address, extent, format and slice count; a slice comes from the live depth surface when one is bound at the slice's address and from guest memory (detiled) otherwise. A draw or dispatch that binds the plane copies again only the slices that changed and records nothing when none did: a surface slice when its image or write serial differs from the one copied (the serial is bumped when the surface is created, when a draw binds it as its depth target, when a pending fast clear is applied and when a written storage view of the plane is copied back), a guest-memory slice when its bytes were written since they were last read (`GuestMemory::UnchangedSince`), a snapshot write overlaps them, or its address, size or tile mode changed. The surface of the latest depth draw is copied at every use until another depth target is bound, since that draw may still be recorded after the copy. A slice's address is the base plus a whole 64 KiB-block depth slice per layer (`DepthSliceBytes`), and the cube face order is the array order; both are inferred from the titles' use, not measured on hardware. A 2D-array T# whose `BASE_ARRAY` is past slice 0 reads slices `BASE_ARRAY` to `LAST_ARRAY` of the copy, which holds slices 0 to `LAST_ARRAY`, and a 2D binding of it reads slice `BASE_ARRAY`; that follows the colour 2D-array semantics and the titles that hit it (PPSA01556, PPSA03912), and was not measured on hardware for depth surfaces. Planes with mips, a cube or a 2D T# with a base slice other than 0, a `BASE_ARRAY` past `LAST_ARRAY`, a cube with other than 1 or 6 slices, and other views of the planes still throw, and so do these copies of a 16-bit plane with stencil that the device stores as D24 or D32 (16-bit depth with stencil, below).
+- [New depth surface from storage writes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - `TakeStorage` discards the depth aspect (`UNDEFINED` to `TRANSFER_DST_OPTIMAL`) before copying the storage image over the whole surface. On AMD's Windows driver 32.0.31041.1004 (RX 7800 XT) a copy into the depth image after its creation clear left one or two 8x8 blocks testing as the clear value in about 1 of 10 runs, although a copy back read the copied values (#6630); not seen on a Radeon 860M or RX 6700 XT. A surface with a stencil plane keeps the clear before the copy, since its depth aspect is not discarded alone.
 - [Repacked format-43 copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver): a sampled texture of format 43 (10-bit R, 11-bit G and B unsigned floats from bit 0) is uploaded into a `B10G11R11_UFLOAT` image with its R and B fields swapped (`RepackTextureWord`) and viewed with R and B swapped back. A texture whose results a storage image still holds is copied from it again, whole, whenever the image changed (`RefreshDepthCopy`); a 3D one is flushed to guest memory and uploaded instead. Storage reads and writes of format 43 keep the packed `R32_UINT` path.
 - [SW_64KB_Z_X color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ColorTargetLayout.cpp) (libSceAgcDriver) use the texture equations and 64 KiB block geometry of `SW_64KB_Z_X`, whose addresses are checked against [AMD addrlib GFX10](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp) in the texture tiling tests. Any 256-byte pipe/bank XOR below the block size is accepted, as for `SW_64KB_R_X` targets and Z_X textures; which of those bits the console honours, and the render results, are not measured.
 - [SW_64KB_D_X color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ColorTargetLayout.cpp) (libSceAgcDriver) use the existing texture block/mip geometry and equations from [AMD addrlib GFX10 non-RB+](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp) for 16 pipes and 256-byte interleave. The address-reference tests use legal pipe/bank XOR bits for that configuration. Raw column bits outside the source configuration's pipe/bank mask 0xcf00 throw; their console meaning is unresolved. Console address equations and render results have not been measured.
@@ -96,28 +108,36 @@
 - [8_8 UINT color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) decode as `R8G8_UINT` with the same component-swap mapping as 8_8 UNORM/SNORM (`0xe4` / `0xec`). Follows the existing 8 and 8_8_8_8 UINT paths; not measured on the console. RetroArch (PPSA99169) uses it during menu startup.
 - [Quad-list primitives](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver): primitive type 19 (DI_PT_QUADLIST, 0x13) translates to Vulkan triangle lists by generating 6 indices per 4-vertex quad in a synthetic 32-bit index buffer during draw input preparation (triangles (0, 1, 2) and (0, 2, 3) for first provoking vertex; (0, 1, 3) and (1, 2, 3) for last provoking vertex). Incomplete trailing vertices (< 4) are discarded. Indirect draws, primitive restart and draw recipes are unsupported for quad-list primitives. Console behavior for incomplete quads has not been measured on hardware.
 - [Separate alpha blend into 8_8 SWAP_ALT targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver): the second channel of a two-channel target with `COMP_SWAP` 1 holds the alpha export, but Vulkan blends it with the color equation of the R8G8 attachment, so a draw whose alpha equation differs from its color equation is recorded twice, the first channel with the color equation and the second with the alpha factors and operation moved into the color equation. The vertex stages run twice, so a vertex shader that writes memory writes twice, and occlusion counts include both passes. Draws that write depth or stencil, pixel shaders that write memory and factors of the destination alpha throw. That the hardware blends the second channel with the alpha equation is taken from Mesa's `si_translate_colorswap` and radeonsi's use of it for luminance-alpha formats, not measured on hardware.
+- [Color logic operations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): `CB_COLOR_CONTROL.ROP3` accepts the 28 codes of the source and destination form (`pqrspqrs`) or the brush and destination form (`pqpqrsrs`, the brush is the shader color), as the R6xx 3D register reference describes the field and Mesa's `gfx10.json` `ROP3` enum lists. A code that combines source and brush, which the console emulates in software, throws.
 - [Unexported pixel inputs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp) (libSceAgcDriver): a pixel input whose `SPI_PS_INPUT_CNTL` parameter the previous stage does not export is programmed as a default-value input (`OFFSET` bit 5, `DEFAULT_VAL` 0, FP16 high half too) and reads (0, 0, 0, 0), as radeonsi's `SI_PS_INPUT_CNTL_UNUSED` does and as rect-list draws already do. The console's value for an unwritten parameter cache entry is not measured on hardware.
 - [Per-sample pixel shading](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): `PA_SC_MODE_CNTL_1.PS_ITER_SAMPLE` (bit 16, [PS5_Mesa GFX10.3 registers](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/registers/gfx103.json)) on a multisampled draw enables Vulkan sample shading with a minimum rate of 1.0, so the pixel program runs once per sample. The draw throws when the device lacks `sampleRateShading`. On a single-sample draw the bit has no effect and is dropped. That the console runs the pixel program once per covered sample, and what it does with the other multisample registers in that mode, is taken from the register name and Vulkan's definition, not measured on hardware. Without the bit the pixel program runs once per pixel: the recompile request carries the mode (`iteratesSamples`), the ancillary's sample number reads 0 instead of `SampleId`, whose use would make Vulkan shade per sample, and the sample barycentrics and positions are evaluated at sample 0, whose locations the request carries (`sampleLocations`, every sample's in an iterated draw). `DB_EQAA.PS_ITER_SAMPLES`, the number of samples an iterated shader covers, is not read: an iterated draw runs once per sample.
 - [Unused pixel programs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): a bound pixel program is skipped when color masks have no intersection and DB export and execution enables are clear, regardless of retained SPI_SHADER_Z_FORMAT. This follows [AMD PAL DbShaderControl](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9AbiToPipelineRegisters.h) and its [GFX10 register definitions](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/chip/gfx9_plus_merged_registers.h), not a hardware measurement. Enabled DB_ALPHA_TO_MASK conservatively retains the program even with ALPHA_TO_MASK_DISABLE, because DecodeState currently enables Vulkan alpha-to-coverage without applying that override. Console behavior for these combinations has not been measured.
 - [Sample masks](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `PA_SC_AA_MASK_X0Y0_X1Y0` and `PA_SC_AA_MASK_X0Y1_X1Y1` hold one 16-bit sample mask for each pixel of the aligned 2x2 quad ([Mesa gfx10.json](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/registers/gfx10.json#L13512)); only the bits of the `MSAA_NUM_SAMPLES` rasterized samples count, and at one sample bit 0 of a pixel's field covers every sample of the target the draw is raised to. A mask equal for the four pixels is the Vulkan `pSampleMask`, the case [radv](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_cmd_buffer.c#L13633) and [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/gallium/drivers/radeonsi/si_state.c#L4218) program; with early fragment tests it needs `earlyFragmentSampleMaskTestBeforeSampleCounting` ([radv](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_physical_device.c#L2079) reports it). A mask that differs between the pixels is applied in the pixel shader without early fragment tests: a pixel whose mask covers all or none of its samples is demoted to a helper invocation by `gl_FragCoord` parity and killed when the program returns (the Radeon 860M's Windows driver 32.0.13058.8001 writes undefined colour for a demoted pixel whose export leaves its output unwritten), and otherwise the pixel's mask is ANDed into `gl_SampleMask` (with alpha-to-coverage and the mask export) after demoting invocations whose `SampleMask` input it leaves empty. A pixel program with early Z that writes memory under depth, stencil or depth-bounds tests is therefore refused. That XnYm is the pixel at (x mod 2, y mod 2) = (n, m) is read from the field names; that the mask removes samples before the depth and stencil tests and occlusion counting is inferred from radv implementing the Vulkan sample mask test with it; and that it takes no part in the centroid (`AA_MASK_CENTROID_DTMN` 0) is inferred from radv setting that bit only for conservative rasterization. None of it is measured on gfx1013. A mask equal for the four pixels that removes some but not all samples of a pixel is refused with active centroid inputs, since where Vulkan puts the centroid relative to `pSampleMask` is implementation-defined, and any partial mask is refused with conservative rasterization (radv sets `PREZ_AA_MASK_ENABLE` and `POSTZ_AA_MASK_ENABLE` [there](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_cmd_buffer.c#L13653), which 0x6001 leaves clear).
 - [Covered-centroid raster state](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) accepts PA_SC_AA_CONFIG.COVERED_CENTROID_IS_CENTER only when the pixel program is skipped or SPI_PS_INPUT_ENA and SPI_PS_INPUT_ADDR have no active perspective or linear centroid input. Bit 29 follows [PS5_Mesa GFX10.3 registers](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/registers/gfx103.json); [RADV](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/radv_cmd_buffer.c) sets it on GFX10.3 and later. Active centroid interpolation and unspecified input registers still throw. Console covered-pixel centroid results were not measured.
+- [Buffer destruction on MoltenVK](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp) (libSceAgcDriver): on MoltenVK, buffers and device memory released through the graphics context are destroyed only while the graphics queue is idle. MoltenVK makes every live `SHADER_DEVICE_ADDRESS` buffer resident, unretained, in each command buffer that uses device addresses, also in ones submitted after the release, and passes Metal a nil buffer once its memory is freed ([KhronosGroup/MoltenVK#2876](https://github.com/KhronosGroup/MoltenVK/issues/2876)). A recorder or command batch submission drains the queue under the GPU mutex once 512 objects wait or the oldest has waited 100 ms (`vkQueueWaitIdle`, then the buffers, then the memory), which stalls the CPU until the GPU is idle; memory released under pressure only returns at that drain. `VulkanDevice`'s own destroys are not deferred. `APS5_NO_DEFERRED_DESTRUCTION=1` turns this off; remove it once MoltenVK fixes #2876.
 - [Compute LDS beyond the device's shared-memory limit](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) lives in a coherent storage buffer with one slice of `LDS bytes / 4 + 1` dwords, rounded up to an even count so that 64-bit atomics stay 8-byte aligned, per workgroup (the dword after the LDS is the atomic lock on a device without `shaderBufferInt64Atomics`), shared by all such dispatches and grown in 1 MiB steps up to `maxStorageBufferRange`; a dispatch whose slices do not fit throws. It is slower than shared memory and its cost was not measured. An indirect dispatch of such a program always reads its group counts on the CPU. Its results are pinned against the in-limit semantics in `agc_driver_lds_beyond_device_limit`, not measured on hardware.
-- [AGC buffer allocations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) retry host/device out-of-memory once after reclaiming idle pool buffers and fully unused slab blocks. Live buffers and blocks with live slots are retained. Live images and other retained resources have no global memory bound; allocation failure still throws when reclaim cannot satisfy the request.
+- [AGC buffer allocations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) retry host/device out-of-memory once after reclaiming idle pool buffers and fully unused slab blocks. Live buffers and blocks with live slots are retained. Live images and other retained resources have no global memory bound; allocation failure still throws when reclaim cannot satisfy the request, except for the device buffers and images that the "Host placement after a device-memory refusal" entry places in host memory.
+- [Storage-cache pressure and idle device buffers](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp): the one-second idle observation interval is a retention choice, not a console rule; buffers reused less often can be recreated under pressure. Before a storage-cache eviction, independently allocated device-tier buffers unused throughout that interval can be released, oldest first, for the cache's shortfall below its existing ceiling. Live buffers, host tiers and slab allocations are not reclaimed this way. Reclamation requires exactly one device-local heap because retained buffers do not record their heap. The heap budget is read again after an actual release; a delayed driver report can still cause an eviction. This is not a shared budget for all retained GPU resources, and its effect on titles with intermittent large buffer use is unmeasured.
 - [Host placement after a device-memory refusal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) (libSceAgcDriver): when the driver refuses a device-local allocation with `VK_ERROR_OUT_OF_DEVICE_MEMORY` after the pool's trim and the texture-cache release, device buffers and images (textures, storage textures, block, repacked, depth, depth plane and stencil copies, render, depth and multisampled targets and attachment proxies) are allocated in a host memory type their requirements allow. A host-placed device buffer leaves the pool on release. A host-placed image keeps that placement until it is destroyed and is never moved back to device memory, so every access to it crosses PCIe for its lifetime. The placements are counted in a rate-limited `[bufferpool]` line with the cumulative MiB, not the resident bytes. The 1x1 denormal clear probe still allocates device memory directly and throws on a refusal.
-- [Pipeline journal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp) (libSceAgcDriver): the journal is append-only and never compacted, so a module a later run no longer builds pipelines from stays in the file until it is deleted, and the whole file is read into memory while the replay runs (its modules reference that buffer until the last replayed pipeline was built). Only the first `APS5_PIPELINE_JOURNAL_ENTRIES` pipelines recorded are replayed (a record is never rewritten, so a pipeline past the bound stays past it), and the pipeline store evicts the least recently used entry past `APS5_PIPELINE_STORE_ENTRIES` (1024 each): a title with more configurations rebuilds the rest at the draw as before. A compute pipeline is replayed over the set layout `DescribeSetLayouts` derives from the result's bindings, which a dispatch that finds it resident checks against its `ShaderResources` layout only under `APS5_VERIFY_SET_LAYOUTS=1`. Recording and replay are best effort: a record whose write fails is lost, an entry whose build fails is skipped, and both are counted in the `[pipeline-journal]` line rather than stopping the run. A replayed pipeline that the title never asks for again costs its build time and its driver memory (its optimized relink is deferred to its first draw, so a run whose first frames bind many replayed pipelines queues their relinks then); nothing ages recipes out of the file. Two runs sharing the file take turns under its lock file, but each only knows the modules it loaded or wrote itself, so a module the other run appended meanwhile may be appended again (the loader keeps the first copy). Records a run appends after another run's load are replayed by that run only after its next start. The file header's format number is the only guard against a change of the recipe codec, `CanonicalPipelineState` or the store key that keeps the structures' sizes (the recompiler's source version does not cover the driver's sources).
+- [Pipeline journal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp) (libSceAgcDriver): resident graphics pipelines are bounded by count, not bytes: the store grows from 1024 to 4096 entries for a replay that does not fit and for evicted pipelines that keep coming back, and the last `APS5_PIPELINE_JOURNAL_ENTRIES` (4096) records are all replayed, so a pipeline the title never asks for again costs its memory until teardown. `agc_driver_recorder_tests --benchmark-pipeline-store-memory [count]` gives a floor with the triangle shaders: about 59 KiB host and no device memory per pipeline on an RTX 4090, 100 KiB host and 8 KiB device-local on a UHD 770; larger shaders cost more. The file is rewritten to three quarters of `APS5_PIPELINE_JOURNAL_MAX_MIB` when full. A compute pipeline is replayed over the layout `DescribeSetLayouts` derives, checked only under `APS5_VERIFY_SET_LAYOUTS=1`. The header's format number guards the recipe codec and the store key.
 - [Graphics pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp) (libSceAgcDriver): a pipeline is fast-linked at the draw and relinked with `VK_PIPELINE_CREATE_LINK_TIME_OPTIMIZATION_BIT_EXT` on a background thread, and binds the optimized one from the next draw on. Draws recorded before that use the fast link, whose vertex stage keeps the outputs the fragment stage does not read: on RADV (Radeon 660M, Mesa 26.2.4) 346 of 483 Astro's Playroom vertex shaders paired with a fragment stage that reads none of them used more VGPRs (median 8 more, up to 2.5 times), and on an RTX 4090 13 of 15 PPSA36082 vertex shaders up to 68 instead of 38 (#2242). The optimized link compiles to the same code as a whole pipeline
+- [Fragment shader interlock pipelines](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver): a pipeline whose fragment shader declares a fragment shader interlock capability is never built from graphics pipeline libraries, on every driver, so it is compiled whole at the draw with no fast link to bridge the compile. RADV's fast link ([mesa#16653](https://gitlab.freedesktop.org/mesa/mesa/-/work_items/16653), Mesa 26.2.5, RX 7900 GRE) jumps to the PS epilog without waiting for the shader's stores, and the epilog's `done` export ends the GFX11 primitive-ordered section, so the next overlapping wave reads the old value: `agc_driver_pixel_interlock` lost read-modify-writes in 108 of 120 loaded runs under `APS5_NO_PIPELINE_LTO=1`. On an RTX 4090 (NVIDIA 617.42, Windows) the fast link kept the ordering in 240 of 240 loaded runs; other drivers are not measured.
 - [Prebuilt pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver): each registered vertex or pixel shader in registration form gets its pre-rasterization or fragment-shader library built on one background thread, with a fixed state the draw may not use: triangle list, counter-clockwise front face, no depth clamp, depth bias or conservative rasterization, first provoking vertex, one sample. Libraries are kept until the device is torn down; on Astro's Playroom 1948 of them added 0.44 GB of peak memory on RADV.
 - [`APS5_THREAD_PRIORITY=rt`](../../../core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp) (libSceAgcDriver) lowers the process's hard `RLIMIT_RTTIME` when it is above `APS5_THREAD_RTTIME_US` or rtkit's `RTTimeUSecMax`, because [rtkit](https://github.com/heftig/rtkit/blob/c295fa849f52b487be6433e69e08b46251950399/rtkit-daemon.c#L592-L637) (`verify_process_rttime`) reads the hard limit from `/proc/<pid>/limits` and refuses real-time scheduling when it is higher. An unprivileged process cannot raise the hard limit again, so it stays lowered for the process and its threads even when rtkit then refuses the request (burst limit, user or start-time checks) and the thread throws. rtkit's `MaxRealtimePriority` and `RTTimeUSecMax` are read first, so an unreachable rtkit or a priority above its maximum leaves the limit untouched. The lowered limit only matters for threads that later run under a real-time policy
-- AMD image descriptors with `TYPE=0` are treated as null for read-only image slots even when the base and other words are nonzero: `image_load` on a gfx1035 with such a T# returns 0,0,0,0, and the same descriptors were seen in direct reads in PPSA01341 on an RTX 4070. Writable and atomic image slots and entries of an image table keep faulting because there is no hardware measurement for them, and the reserved types 2-7 also fault. `TYPE=1` is treated as null in the same read-only slots: gfx1035 reads it as zeros too, and gfx1010 returns zeros for `image_sample_lz`, `image_sample_b`, `image_load` and `image_get_resinfo` with format 22 (#5828); it is not measured on RDNA2, with other formats or with depth-compare reads (`image_sample_c*`). gfx1013 behavior is unverified
 - On a device without VK_EXT_robustness2's `nullDescriptor`, such as MoltenVK, a null image descriptor in a typed heap is a [placeholder image](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PlaceholderImages.cpp) of that heap's type, 1×1 and cleared to zero, which every null descriptor of the heap shares. Reads give zeros, as `nullDescriptor` allows, but stores and atomics to it are kept, so a later read of a null storage image can return them, and a depth comparison compares against depth 0. A heap whose placeholder the device cannot create, for example 1D or 3D depth, 64-bit atomics without 64-bit image atomics, or multisampled storage without `shaderStorageImageMultisample`, throws when a null descriptor reaches it.
 - [Draw input snapshots](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver): `PrepareDrawBindings` caps read-only input buffer snapshots at 64 MiB (overridable via `APS5_DRAW_SNAPSHOT_MAX_MIB`). Larger inputs (streaming heaps, bindless pools) or draws exceeding the cumulative budget skip the per-draw snapshot and bind in place, avoiding multi-gigabyte CPU copy stalls (such as Ratchet & Clank: Rift Apart PPSA01474 stalling at frame ~380 copying 36 GB every 5 s). If the title rewrites those large ranges on the CPU before GPU completion, the in-place binding observes the modification, as verified by `drawSnapshotCapTests`.
-- [Pending storage-image results](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) are stored when something reads their memory, not when the GPU work that wrote them completes. A title that waits for that work, frees the image and reuses its memory can have the new data overwritten by the late store (#1970). A title's own CPU reads are not seen either, so a title that reads the results after waiting for a label reads stale memory. Explicit-size file writes (`write`, `pwrite`, `writev`, `pwritev`, AIO and `fwrite`) synchronize their source ranges through the [host-read hook](../../../core/libs/prx/libc/src/GuestArena.cpp); other host readers are not covered. `APS5_STORE_AT_FLIP=1` stores every pending result at each flip and `APS5_STORE_AT_LABEL=1` before each label the GPU writes; both store every pending image, not only the ones the waited-for work wrote, and neither is on by default.
+- [Pending storage-image results](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver), except drawn resident linear targets (next entry), are stored when something reads their memory, not when the GPU work that wrote them completes. A title that waits for that work, frees the image and reuses its memory can have the new data overwritten by the late store (#1970). A title's own CPU reads are not seen either, so a title that reads the results after waiting for a label reads stale memory. Explicit-size file writes (`write`, `pwrite`, `writev`, `pwritev`, AIO and `fwrite`) synchronize their source ranges through the [host-read hook](../../../core/libs/prx/libc/src/GuestArena.cpp); other host readers are not covered. `APS5_STORE_AT_FLIP=1` stores every pending result at each flip and `APS5_STORE_AT_LABEL=1` before each label the GPU writes; both store every pending image, not only the ones the waited-for work wrote, and neither is on by default.
+- [Resident linear color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver): a CPU store inside a drawn scissor rectangle, on a pixel no primitive wrote, made before the target's store is overwritten by it, where the console keeps it. Recorded draws' results are stored before the graphics queue's next flip, label, end-of-pipe interrupt, drain or device wait, as the union of their scissor rectangles; a draw that brings a 17th rectangle that does not merge stores the target at once. A target with an attachment proxy, several mips or layers, a 3D or DCC surface, or results of a dispatch, fill or copy is stored after each draw. One that a fill or copy writes after its draws is stored whole at the next of those points, and GPU results in its CPU-written 64 KiB blocks are dropped. A store the draw pipeline's committer makes (label, end-of-pipe interrupt, device wait) skips a target whose range a queued draw still reads (`DrawPipeline::HeldReads`).
+- [Direct writes over a drawn linear target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver): a CPU store into a 64 KiB block of a drawn resident linear target that lands while the completion of a direct write recorded before the draws checks and stamps that block (`StampKeepingNewerResults`) drops the draws' results in that block, where the console keeps them: the stamp's own collect records the store per page only, so the store reads the block as written by the driver.
 - [`APS5_SKIP_REFUSED_DRAWS`](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp) (libSceAgcDriver) drops a draw whose graphics stage the recompiler refuses instead of failing the queue, so the frame lacks that draw, and the stage is compiled and refused again at each such draw. Compute refusals still fail.
-- [Pending storage-image results over memory outside the write watch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) leave to the CPU the 64 KiB blocks whose bytes differ from the ones saved at the upload, the fill, the image copy, the previous store or the moment their range left the watch (`Unwatch`, or a host import that does not stay watched), and the blocks the watch saw the CPU write before that moment. A store made on the GPU saves its bytes through a host-visible copy that becomes the saved bytes when its batch completes; a store or a refresh that needs them earlier waits for that batch. A unit without a write generation saves the guest bytes when results land in it outside the watch. One whose range leaves the watch while its results are pending saves its bytes through the unwatch hook, which also runs when a failed collect takes a range out of the watch. A range that leaves the watch without the hook running over it (an import fallback that unwatched without saving) leaves its pending results without saved bytes; storing such results throws. A unit whose results were stored while its blocks were watched keeps only a generation; when its blocks leave the watch while nothing is pending, the hook saves nothing, and results that land in it afterwards have neither saved bytes nor a watch, so storing them throws too.
+- [Pending storage-image results over memory outside the write watch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) leave to the CPU the 64 KiB blocks whose bytes differ from the ones saved at the upload, the fill, the image copy, the previous store or the moment their range left the watch (`Unwatch`, or a host import that does not stay watched or whose page walk fails), and the blocks the watch saw the CPU write before that moment. A store made on the GPU saves its bytes through a host-visible copy that becomes the saved bytes when its batch completes; a store or a refresh that needs them earlier waits for that batch. A unit without a write generation saves the guest bytes when results land in it outside the watch. One whose range leaves the watch while its results are pending saves its bytes through the unwatch hook, which also runs when a failed collect takes a range out of the watch. A range that leaves the watch without the hook running over it leaves its pending results without saved bytes; storing such results throws. A unit whose results were stored while its blocks were watched keeps only a generation; when its blocks leave the watch while nothing is pending, the hook saves nothing, and results that land in it afterwards have neither saved bytes nor a watch, so storing them throws too.
+- [Storage images over uncommitted guest memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) - a storage image whose guest range has no committed page when it is created throws in the `StorageTexture` constructor, which aborts the guest. Several titles reach this intermittently in runs of a few minutes, on AMD and NVIDIA alike; in two of the three logs, lines about storage images over released or rewritten memory (`memory no longer registered`, `guest memory changed while GPU results were pending`) come shortly before it. The log does not name the image's address. What the console does with a storage descriptor over memory that is not committed is unknown, and which allocation the guest recreates there was not found.
 - Windows host-pointer imports of the guest mapping itself are compared instead of write-watched, except writable imports of private `MEM_WRITE_WATCH` memory when the import probe keeps the write watch and a settle queue exists: those of 1 MiB or more stay watched, and smaller ones return to the watch once their settle has completed, unless a storage image overlaps them (see Pages under an import window): a driver can mark imported pages dirty after the synchronous import window. Shared memory imported through a separate writable alias retains protection-based tracking on the guest views; driver access to the import alias does not disarm those views. [GuestMemory](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) excludes every overlapping 64 KiB tracker block while its backing is retained. A full block replaced by fresh private backing regains tracking and gets a new generation; protection changes, partial replacements and shared remappings do not restore it. Excluded blocks keep their write-watch marks as a hint only (`UntrackedHint`): a storage image or a sampled texture snapshot over them compares its bytes again after a mark in its range, a driver store, a mapping change or a recorded GPU write instead of at every collect epoch or lookup, and a mark the driver makes without a CPU store costs one comparison. This preserves CPU edits through byte comparisons but limits snapshot reuse on excluded blocks to draws of one collect epoch and disables unit shadows for them; restoring tracking on import retirement without replacing the backing remains unimplemented.
-- [Pages under an import window](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) (libSceAgcDriver) whose write protection was resolved while a host import that leaves its range watched was made are compared with the bytes they held before the import and count as stored over only when those differ. A CPU store of the bytes already there within the window cannot be told apart from an import that resolves the write protection without storing, as the NVIDIA driver (610.57.04) does for every imported page, so such a store does not win over pending results. Where host-pointer and dma-buf imports differ in whether they stay watched, a failed host-pointer import and the dma-buf import after it are two windows, and the pages the failed one resolved count as stored over. On Windows, the NVIDIA driver (617.42) marks every page of a host import of private `MEM_WRITE_WATCH` memory written, asynchronously, until a GPU use of the import completes; a 4-byte read of it on the settle queue ends that even while main-queue work that used the import first is still running, and an earlier import of the same pages whose first use runs after that read marks none of them (`agc_import_settle_first_use`, `agc_import_settle_earlier_import`). Such an import stays watched only after a 4-byte read of it on the settle queue has completed inside the window. Each one waits for that read, which keeps its window open for one round trip on the settle queue, so a same-value CPU store from another thread in that time counts as unchanged too. An import made where no settle queue exists is compared instead. An import of under 1 MiB is not settled inside its window, because the settle blocks the importing thread and a title that imports a 64 KiB buffer around every submission lost about 19 % of its frame rate to that wait (Dripl1x, #6060). It is compared until its read, submitted in a batch by a later import lookup under `GpuMutex` while the imports match the registry, has completed; a later lookup then returns its whole blocks to the write watch, each stamped as a CPU store, so whatever was derived from them while they were compared reads as changed once. Its blocks stay compared while storage results are pending over them, and those of an import retired before that stay compared.
+- [Pages under an import window](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) whose protection an import resolves count as stored only when their bytes change. A same-value CPU store during that window cannot be distinguished from driver activity and does not win over pending results. On Windows, NVIDIA 617.42 marks every private MEM_WRITE_WATCH page after import until a GPU use completes. The driver behavior was measured on this driver; other drivers are unverified. Imports of at least 1 MiB wait for a four-byte read on the separate settle queue inside the window. Smaller imports stay compared until a deferred read completes; a later lookup returns their pages to write watching, stamping their blocks as CPU stores; the rest of a partly covered block stays compared. Blocks overlapping a live storage image, blocks of an import retired before rewatching, and imports without a settle queue stay compared. Shared-memory imports retain their separate-alias tracking.
+- [Deferred host-import reads](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) use the main queue with barriers ordering earlier and later writes around the reads. Submission does not wait on the CPU. An initial multisampled DCC import needing a range whose import still awaits its read submits it if needed and waits under the GPU mutex (`WatchedAfterSettle`, #9724). Imports of partial 64 KiB blocks get no deferred read; only that path reads them, returning their pages as CPU stores unless a live, trimmed or parked compared import or storage image shares their blocks; one a recorder holds is unseen. The latency cost of placing batches behind main-queue work is unmeasured. The first-use test now checks that earlier main-queue reads finish before the import returns to write watching; the original two-queue canary measured driver marking while those reads were still in flight. The earlier-import canary still checks later use of another import of the same pages.
 - [Settled dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a dma-buf import of 1 MiB or more is read by a 4-byte copy on the settle queue right after it is made (`settleImport`), so the kernel maps its pages for the GPU there and not in the first submission that uses it (about 2 s for a 3 GiB import on RADV). The import's buffer is shared with the settle queue's family. An import made at map time settles on the guest thread that maps the range, inside its map call, so that thread waits while the kernel maps the pages: 0.47 to 2.2 s for the 3 GiB range of Hades (PPSA03355) and 0.49 to 4.3 s for the 4.5 GiB range of ASTRO BOT (PPSA21567) on RADV. Both titles map these ranges at start-up; a title that maps large ranges during gameplay stalls its mapping thread for as long. An import made from a submission settles under the GPU mutex, so its frame still pays for it; a smaller import, and every import on a device with no settle queue (one without a copy-capable queue besides the main one), pays in its first submission. A range imported through a host pointer, as lavapipe imports shared memory, is not settled
 - [Sparse dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a shared-backed range larger than one 64 MiB udmabuf buffer is imported as one sparse buffer bound to the 64 MiB buffers, on a queue of its own when the device has a second family that binds sparse memory. The path is decided before anything is imported, and a failure after that throws. A range whose offset in the backing file is not a multiple of 64 KiB starts its sparse buffer at the 64 KiB block below it (`HostImport::lead`). A range takes the single udmabuf import instead, which udmabuf's `size_limit_mb` refuses above 64 MiB by default so the range is copied, when the buffer's sparse block size is larger than 64 KiB (it is 64 KiB on RADV), when the sparse buffer does not accept every memory type a chunk import can have, when the backing file ends inside its last chunk, or when it is imported at map time on a device with no second family (the bind then needs the GPU mutex); the NVIDIA proprietary driver imports no dma-buf memory
+- [Presentation under the GPU mutex](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - on a device whose presentation family has no queue left after the main and settle queues, such as RADV, lavapipe and Intel's Windows driver (Arc Graphics on Meteor Lake, 101.9150), which expose a single graphics queue, `vkQueuePresentKHR` still runs on the main queue under `GuestMemory::GpuMutex`, so the draw committer and the queue workers wait for as long as the present blocks. How long that is on those drivers was not measured; on NVIDIA in FIFO mode it is about 6 ms per present. A device with a free queue in that family presents on it under its own mutex, after the GPU mutex is released. Closes when: a trace on a single-queue device shows no `GpuMutex.wait.*` behind `Vulkan.QueuePresent`.
 - [Unnormalized S# coordinates](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) - `FORCE_UNNORMALIZED` uses a Vulkan `unnormalizedCoordinates` sampler, so the S# LOD range, LOD bias and mip filter are not applied, which is exact only on a one-level view.
 - An [unnormalized S#](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) maps clamp mode 0 (repeat) on X and Y to clamp-to-edge as required by Vulkan unnormalized coordinates, and assigns the magnification filter when minification and magnification filters differ (since unnormalized coordinates sample at LOD 0). Anisotropy, TRUNC_COORD, MC_COORD_TRUNC and other clamp modes still throw. Secondary LOD bias (LOD_BIAS_SEC, bits [19:14]) is accepted and ignored, matching RDNA2 hardware measurements across explicit and implicit samples. High on Life (PPSA15388, #4736) uses secondary LOD bias and unnormalized coordinates with clamp mode 0 and differing min/mag filters during home base and city rendering.
 - [TRUNC_COORD](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) is not applied: the texel a point sample reads and the bilinear weights follow the host sampler's rounding. On RDNA 2 (RX 6700 XT), an S# with TRUNC_COORD 0 rounds the exact scaled coordinate to 8 fractional bits, ties to even, and one with TRUNC_COORD 1 truncates it, for point and bilinear filters. AMD's Windows driver (32.0.21045.5002) truncates for nearest samplers and rounds for linear ones. Under it, a TRUNC_COORD 0 point sample at most 1/512 texel below a texel edge reads the texel below the edge where the console reads the one above, and `k / width` computed in f32 lands there for about half of all k. A TRUNC_COORD 1 bilinear weight can be 1/256 above the console's. Other host drivers are not measured.
@@ -125,49 +145,52 @@
 - [8_SRGB and 8_8_SRGB textures](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp) (libSceAgcDriver) that the device samples as R8_SRGB or R8G8_SRGB use its own decode, which need not match gfx1035: NVIDIA's R8_SRGB is one bf16 step off in 29 of 256 codes. A device that cannot sample them gets an RGBA8 sRGB copy instead (a blit of the R8 or RG8 texels, refreshed with the storage image's version), whose decode is likewise the device's; 3D textures and storage images that are not single-depth and format-matched are copied from their snapshot instead.
 - [PM4 submission rings](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/SubmissionRing.cpp) (libSceAgcDriver) keep only the first 512 dwords of each submission, so the packets past them are not printed. The [failure report](../../../core/libs/prx/libc/src/FailureReport.cpp) dump does not allocate from the C runtime heap: packet names come from static strings, each line is formatted with integer and string conversions into a 512-byte stack buffer and written with one `WriteFile`. It still runs on whatever state the crash left. It waits about 100 yields for each ring's lock and otherwise prints that queue as busy, so a crash while recording a submission loses that queue's ring. It reads the rings without checking them, so a crash that corrupted them can fault inside the dump; such a fault during the report of an unhandled exception stops in that report's `Sleep(INFINITE)` and the process hangs instead of ending. The reports run at most once per process. Linux has no crash report: there the rings are printed only by `APS5_STALL_WATCHDOG_SECS`.
 - [WAIT_REG_MEM](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp) reports a diagnostic after `APS5_GPU_WAIT_TIMEOUT_MS` without treating the timeout as completion. An unsatisfied wait keeps polling and checking driver failures; a missing producer can therefore leave its queue waiting indefinitely. Existing recorded-label shortcuts remain in use.
-- A [WAIT_REG_MEM](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp) (libSceAgcDriver) on a queue 0x20 label can time out while the awaited word holds the address of another slot of the same label area instead of 0 or 1, with no store to that label in the PM4 ring window (`APS5_PM4_RING`). What writes the address (guest CPU or the emulator) and whether the console would have satisfied the wait before the slot was reused are unverified; the wait keeps polling and its queue stays blocked. Seen in several titles on a Windows NVIDIA GPU; not measured on hardware.
+- A [WAIT_REG_MEM](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp) (libSceAgcDriver) on a queue 0x20 label can time out while the awaited word holds the address of another slot of the same label area instead of 0 or 1. On a Windows NVIDIA GPU the PM4 ring window (`APS5_PM4_RING`) held no store to that label. On a Windows AMD RX 6400 (PPSA01746) the address was already in the word when the wait began (6 of 6 timeouts) and a RELEASE_MEM storing 1 to the slot had been queued (5 of 5 with a record, another run), not necessarily landed. What writes the address and whether the console satisfies the wait are unverified; the queue stays blocked while the wait polls. Not measured on hardware.
 - [PM4 type-0 packets](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/CommandValidation.cpp) (libSceAgcDriver) - a dword whose packet type is 0, a zero header word included, is rejected with `unsupported PM4 packet type`, so the submission throws. Whether the console's command processor skips or executes such dwords, and what a run of them in front of a REWIND packet means, is unverified; shadPS4 (`liverpool.cpp`) and KytyPS5 (`pm4.cpp`) also treat type 0 as unsupported. One such submission begins with a seven-dword NOP and an eight-dword ACQUIRE_MEM, then 169 dwords of zero headers (dwords 15 to 183, zero in one run and stale words in another), and its packets start at dword 184, as sections of NUM_INSTANCES, SET_BASE, REWIND, NOP and ACQUIRE_MEM separated by zero gaps of 26 to 455 dwords (odd lengths included); letting a zero header through only moved the stop to a stale word.
 - [COND_EXEC](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp) reads its condition after the earlier packets of its queue complete. Without PFP_SYNC_ME the console's graphics PFP reads it ahead of the ME, so a title that races the read sees a later value here.
 - A [flip inside a COND_EXEC range](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/CommandValidation.cpp) throws: the flip is reserved with the video output when the buffer is submitted, and how the console withdraws a skipped one is unknown.
 - A [COND_EXEC range](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) must hold whole packets and end inside its command buffer. A chained INDIRECT_BUFFER or a REWIND inside a range throws, as what the CP does with the skipped dwords then is unknown.
 - A [COND_INDIRECT_BUFFER](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) (`sceAgcCbBranch`) runs only with the always-pass compare function; a comparison or a predicated packet throws. Modes 1 and 2 run the first buffer, assumed to be the if-then and if-then-else modes of AMD's PM4 packet. [sceAgcCbBranch](../../../core/libs/prx/libSceAgc/Cb/src/Branch.cpp) does not check the compare address of an always-pass branch or the address of an empty buffer, as PPSA14632 passes an uninitialised compare address and a null else buffer of 0 dwords.
 - A [label or store](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (`RELEASE_MEM`, `WRITE_DATA`, `DMA_DATA`) into guest memory the device has no host import of waits for all recorded work and is then written by the CPU, so the queue worker stalls once per such label. The console's CP stores it in stream order without that stall.
+- A [label](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) of 8 bytes or less recorded while a copied writer is listed, or while an earlier completion store is pending, is stored by the CPU when its batch is reaped, after the write-backs, so it becomes visible up to one reap later than on the console, also after GPU writes recorded behind it. Larger stores (DUMP_CONST_RAM, COPY_DATA, DMA_DATA) and DMA_DATA copies the GPU makes stay on the GPU unless they cover a copied writer's range or a pending completion store, so they can be visible before an unrelated earlier write-back. The order also breaks when a write-back's guest store syncs a pending storage image from inside the completion: that nested sync finishes later batches, whose completion stores land first. `APS5_DRAIN_COMPLETION_LABELS=1` drains instead (reason 2).
 - [WRITE_DATA to thread-trace user-data registers](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver) updates the queue's UCONFIG values for register destinations `0xc340..0xc347`, including repeated writes to one address; these are not guest-memory labels. The range follows AMD's GFX10 `SQ_THREAD_TRACE_USERDATA_0..7` definitions in [the Linux register header](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/include/asic_reg/gc/gc_10_1_0_offset.h) and the packets emitted by PPSA21564's bundled AGC driver before its EOP flip. Other register destinations throw. GPU thread-trace capture and its user-data stream are not emitted; only the final register state is retained. Console trace behavior is unverified.
 - [WRITE_DATA with DST_SEL 3](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver) writes guest memory like DST_SEL 5, which a PS5 does not: on firmware 13.40 (measured 2026-10-19 with buffers submitted through `sceAgcDriverSubmitDcb` inside a retail title) a DST_SEL 3 `WRITE_DATA` (control 0x00100300, or 0x06100300 with cache policy 3) left its label in direct memory unwritten, also after a `RELEASE_MEM` with GL2 write-back and invalidate (0x00300514), and a GDS `COPY_DATA` (SRC_SEL 3) at that address read 0. The console's own `sceAgcDcbWriteData(dst 6)` builds DST_SEL 3 (0x00110300) as here, and Killzone: Liberation (PPSA11142) fences its frame with it and waits on that label with `WAIT_REG_MEM`, so the write is kept until the path that lands the label is known. Closes when: that path is measured
 - [SET_*_REG_INDIRECT](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) (libSceAgcDriver) reads its register list when the command buffer is submitted, with the packets. The console's graphics PFP reads it when it reaches the packet, so a list written after the submission (by the CPU, or by GPU work ahead of the packet behind PFP_SYNC_ME) is read here before that write. When the list read at submission holds an offset dword that is not a register offset (bits 16-27 set, or the 0xffffffff sentinel), the worker reads the list again where the packet executes and writes that copy. PPSA23566 (UFC 6) intermittently submits a SET_CONTEXT_REG_INDIRECT whose first entry is 0x038f038f or 0x03900390 in both copies; what the PFP does with such an entry is unknown, so a copy that still holds one throws unless `APS5_SKIP_INVALID_INDIRECT_REGISTERS=1`, which skips its invalid entries and writes its valid ones.
-- The [shader float mode](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (`FLOAT_MODE`, `DX10_CLAMP`, `IEEE_MODE` and `FP16_OVFL` of `COMPUTE_PGM_RSRC1` and `SPI_SHADER_PGM_RSRC1_PS/GS/HS`, bit positions from Mesa's `gfx10.json` and `gfx103.json`) is decoded into `GuestContext::floatMode` and is part of the shader cache keys and the serialized request (#981). `IEEE_MODE` is read by `v_min_f32`, `v_max_f32`, `v_min3_f32`, `v_max3_f32` and `v_med3_f32`, their f16 forms, `v_min_f64` and `v_max_f64`, `IEEE_MODE` and the `FLOAT_MODE` output denormal bits by the output modifier, `DX10_CLAMP` by the clamp modifier, `FP16_OVFL` by every instruction with an f16 result (see its entry), and the whole mode by the 16-bit interpolation instructions (see their entries). With IEEE=1 a signaling NaN operand returns that NaN quieted (the first operand checked first, min3/max3 as two nested pairs, med3 as min3 when any operand is NaN), measured on RDNA2 (gfx1035) over every combination of ±0, ±1, ±inf, denormals, quiet and signaling NaNs with f32 denormals kept and flushed. IEEE=0 and unknown modes keep the previous f32 lowering, which matches IEEE=0. The f16 forms choose their NaN results on the bits: a NaN operand returns the other operand unchanged (src0 when both are NaN), and with IEEE=1 a signaling NaN operand returns that NaN quieted, in the same order as f32. `v_min_f64` and `v_max_f64` quiet a signaling NaN operand the same way with IEEE=1; with IEEE=0 they return src0 unchanged when src1 is NaN, otherwise src1 when src0 is NaN. Both were measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1 with f32 denormals kept and flushed and f16/f64 denormals kept; RDNA2 has no f64 min3, max3 or med3. Unknown modes follow IEEE=0. `v_min_f16` and `v_max_f16` flush each denormal input to its signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3 preserve inputs, even when output flushing is enabled. Measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1, including signed zeros, NaNs and neg/abs modifiers. Unknown modes keep f16 denormals. `v_min_f64` and `v_max_f64` flush subnormal inputs to signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3, and an unknown mode, preserve inputs. The fully flushed and preserved f64 behavior was [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/2036); split-mode selection follows [LLVM's denormal-mode enumeration](https://llvm.org/docs/AMDGPUUsage.html#floating-point-denorm-mode-enumeration-values). Other f64 arithmetic does not model these denormal controls. NaN quieting in f16 arithmetic (the unary instructions and the f32 arithmetic follow it, see below) and `FLOAT_MODE` (f32 denormals flushed before the min/max compare in Astro's Playroom's 0xc0) still follow a single mode, as the entries below record. The mode comes from the registered shader header's `sh_registers`, the same source at registration and at draw/dispatch so the prepared artifact keys match. A title that rewrites RSRC1 at run time, or a raw compute program with no header, compiles with that mode or none.
+- The [shader float mode](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (`FLOAT_MODE`, `DX10_CLAMP`, `IEEE_MODE` and `FP16_OVFL` of `COMPUTE_PGM_RSRC1` and `SPI_SHADER_PGM_RSRC1_PS/GS/HS`, bit positions from Mesa's `gfx10.json` and `gfx103.json`) is decoded into `GuestContext::floatMode` and is part of the shader cache keys and the serialized request (#981). `IEEE_MODE` is read by `v_min_f32`, `v_max_f32`, `v_min3_f32`, `v_max3_f32` and `v_med3_f32`, their f16 forms, `v_min_f64` and `v_max_f64`, `IEEE_MODE` and the `FLOAT_MODE` output denormal bits by the output modifier, `DX10_CLAMP` by the clamp modifier, `FP16_OVFL` by every instruction with an f16 result (see its entry), and the whole mode by the 16-bit interpolation instructions (see their entries). With IEEE=1 a signaling NaN operand returns that NaN quieted (the first operand checked first, min3/max3 as two nested pairs, med3 as min3 when any operand is NaN), measured on RDNA2 (gfx1035) over every combination of ±0, ±1, ±inf, denormals, quiet and signaling NaNs with f32 denormals kept and flushed. IEEE=0 and unknown modes keep the previous f32 lowering, which matches IEEE=0. The f16 forms choose their NaN results on the bits: a NaN operand returns the other operand unchanged (src0 when both are NaN), and with IEEE=1 a signaling NaN operand returns that NaN quieted, in the same order as f32. `v_min_f64` and `v_max_f64` quiet a signaling NaN operand the same way with IEEE=1; with IEEE=0 they return src0 unchanged when src1 is NaN, otherwise src1 when src0 is NaN. Both were measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1 with f32 denormals kept and flushed and f16/f64 denormals kept; RDNA2 has no f64 min3, max3 or med3. Unknown modes follow IEEE=0. `v_min_f16` and `v_max_f16` flush each denormal input to its signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3 preserve inputs, even when output flushing is enabled. Measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1, including signed zeros, NaNs and neg/abs modifiers. Unknown modes keep f16 denormals. `v_min_f64` and `v_max_f64` flush subnormal inputs to signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3, and an unknown mode, preserve inputs. The fully flushed and preserved f64 behavior was [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/2036); split-mode selection follows [LLVM's denormal-mode enumeration](https://llvm.org/docs/AMDGPUUsage.html#floating-point-denorm-mode-enumeration-values). `v_fma_f64`, `v_div_fmas_f64`, `v_div_scale_f64`, `v_ldexp_f64`, `v_rcp_f64`, `v_rsq_f64`, `v_sqrt_f64` and `v_trig_preop_f64` do not model these denormal controls. NaN quieting in f16 arithmetic (the unary instructions and the f32 arithmetic follow it, see below) and `FLOAT_MODE` (f32 denormals flushed before the min/max compare in Astro's Playroom's 0xc0) still follow a single mode, as the entries below record. The mode comes from the registered shader header's `sh_registers`, the same source at registration and at draw/dispatch so the prepared artifact keys match. A registered shader keeps that mode when a title rewrites RSRC1; a raw compute program takes the live RSRC1.
 - A [WAIT_REG_MEM](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp) (libSceAgcDriver) that a compute queue passes on another queue's recorded label store, before the GPU has executed it, is landed before the queue's next dispatch, draw, COND_EXEC or predicated packet reads guest memory: the worker polls until memory satisfies the wait or no unfinished batch writes the label. The graphics queue (queue 0) is exempt, as landing its waits costs PPSA01341 about a quarter of its frame rate; a title that fills memory a graphics command buffer reads after it submits the buffer behind such a wait reads it early there. `APS5_LAND_WAITS_ALL_QUEUES=1` lands the graphics queue's waits too.
 - [CPU reads behind an address-based build](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp) (libSceAgcDriver) - an address-based store (FLAT/GLOBAL, or through a descriptor the recompiler cannot resolve to a static buffer) is not recorded as a pending write: its batch holds a lease on the registered allocations instead, and the flush hook does not wait for it. A DISPATCH_INDIRECT whose arguments are read on the CPU first finishes the batches recorded with a lease (`Graphics::FinishLeaseWork`). These reads do not, so they can see guest memory from before such a build ran: the indirect draw arguments and draw count of a draw resolved on the CPU (`Pm4::ReadDrawArguments`, `Pm4::ReadDrawCount`), the count record of the [copy kernel](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp) HLE (guarded only by its shape check), and the checks in [Submission.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) that decide whether a queue awaits a label only the title writes (`awaitsTitle`, `orderReleased`). No test covers them and no title has been seen to read such memory there.
 - The [dispatches that follow a compute queue's wait](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp) (libSceAgcDriver), up to the next wait that memory does not satisfy, a packet that writes guest memory other than a label, or a conditional packet, are resolved (memory captured, shader recompiled) when the wait passes, as the CP reads them right after it; the graphics queue is exempt (`APS5_GROUP_CAPTURE_ALL_QUEUES=1` includes it). The device still reads guest memory when the dispatch is issued; when that memory no longer matches the capture, the dispatch is resolved again from current memory.
 - [PA_CL_CLIP_CNTL](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `CLIP_DISABLE` (bit 16) and `DX_LINEAR_ATTR_CLIP_ENA` (bit 24) are accepted without changing pipeline state: Vulkan clips primitives against viewport guard bands and clips `NoPerspective` outputs linearly; what clearing bit 24 or setting bit 16 changes on the console beyond standard clipping is undocumented.
 - [10_11_11 unorm color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into R32_UINT attachments: the pixel shader packs each export, rounded to nearest even like format-30 image stores, which is assumed to match the CB's conversion.
 - [11_11_10 float color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into R32_UINT attachments: the pixel shader packs each export toward zero like format-43 image stores (overflow to the largest finite value, negatives to zero, NaN kept), which is assumed to match the CB's conversion; only the standard (COMP_SWAP 0) and reversed (COMP_SWAP 2) component orders are accepted, putting red and blue in the 10-bit low field. That follows from the format's layout and from the standard swap Mesa pairs with COLOR_10_11_11 for R11G11B10_FLOAT (ac_formats.c); it was not measured on the console.
-- [PA_SU_SC_MODE_CNTL.PROVOKING_VTX_LAST](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver) is not measured on the console: bit 19 follows opengnm's `flatshade_first` and Vulkan's vertex selection; rect lists take flat inputs from the third vertex (first mode: first); a geometry program gets odd strip triangle i as (i+1, i, i+2) in both modes (an RX 6700 XT, first mode: (i, i+2, i+1)); in last mode its primitives take flat inputs and layer from the last index, per-vertex ones in first-mode order; a flat input without pass-through read only via `v_interp_mov_f32` P10 (P20) is the provoking vertex's (ps5-opengl, #1413; first (last) mode throws). Barycentric tessellation stages give each corner the last vertex's flat values. Else last mode throws without `VK_EXT_provoking_vertex`, for tessellation, geometry-program fans, explicit per-vertex flat inputs, and strips whose pixel shader reads a vertex slot (`v_interp_mov_f32`; 16-bit interpolation unchecked).
+- [PA_SU_SC_MODE_CNTL.PROVOKING_VTX_LAST](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver) is not measured on the console: bit 19 follows opengnm's `flatshade_first` and Vulkan's vertex selection; rect lists take flat inputs from the third vertex (first mode: first); a geometry program gets odd strip triangle i as (i+1, i, i+2) in both modes (an RX 6700 XT, first mode: (i, i+2, i+1)); in last mode its primitives take flat inputs and layer from the last index, per-vertex ones in first-mode order; a flat input without pass-through read only via `v_interp_mov_f32` P10 (P20) is the provoking vertex's (ps5-opengl, #1413; first (last) mode throws). Barycentric tessellation stages give each corner the last vertex's flat values. Without `VK_EXT_provoking_vertex`, last mode throws only when a pixel shader input could show which vertex provokes (a flat input, a P10 flat read, a per-vertex or custom per-vertex input, or a `Flat` or `PerVertexKHR` decoration in its SPIR-V, ignoring built-ins the pixel stage generates) or another stage's SPIR-V decorates a `Layer` or `ViewportIndex` built-in that is not `PerPrimitiveEXT`; otherwise the draw uses first mode, since the provoking vertex then selects nothing it reads or writes. With the extension, last mode throws for tessellation, geometry-program fans, explicit per-vertex flat inputs, and strips whose pixel shader reads a vertex slot (`v_interp_mov_f32`; 16-bit interpolation unchecked).
 - [Triangle strips through the barycentric tessellation stages](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - without `geometryShader`, a triangle strip without primitive restart is expanded on the CPU into one three-point patch per triangle in Vulkan's strip order: (i, i+1, i+2), and for odd triangles (i, i+2, i+1), or (i+1, i, i+2) with `PROVOKING_VTX_LAST`. That is the order the geometry stage receives, so both routes give the same weights and per-vertex values; which order the console uses for odd triangles is not measured. Indirect strips throw.
 - [Dual-source blending](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) takes the MRT1 export as the second source of the MRT0 blend, as RADV and radeonsi program it; what the CB does with other export or target layouts is unknown, so they throw.
 - [Blending into reversed-order color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - 8_8_8_8 and 16_16_16_16 targets with `COMP_SWAP` 2 or 3 keep the exported alpha in their first channel and red or blue in their fourth, which Vulkan would blend with the color and the alpha equation respectively. The color block is taken to blend in shader export order and apply `COMP_SWAP` afterwards: the alpha equation and every source-alpha factor use the exported alpha, and the destination alpha is the first channel. This follows the `CB_TARGET_MASK` text of the AMD [SI](https://xorg.freedesktop.org/docs/AMD/old/SI_3D_registers.pdf) (p. 229) and [CIK](https://xorg.freedesktop.org/docs/AMD/old/CIK_3D_registers_v2.pdf) (p. 238) register references ("the order of components after blending and before COMP_SWAP is applied"). RADV builds `CB_BLENDn_CONTROL` without regard to the swap ([radv_pipeline_graphics.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/vulkan/radv_pipeline_graphics.c#L650-L709)) and renders R4G4B4A4, B4G4R4A4, R5G5B5A1 and B5G5R5A1 with `SWAP_STD_REV` and `SWAP_ALT_REV` ([vk_format.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/vulkan/util/vk_format.c#L43-L48), [ac_formats.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/common/ac_formats.c#L609-L624)). Mesa CI's Navi10 (gfx1010) CTS run ([job 112381553](https://gitlab.freedesktop.org/mesa/mesa/-/jobs/112381553), [112381554](https://gitlab.freedesktop.org/mesa/mesa/-/jobs/112381554)) passes all 400 `blend.format.<format>.states` cases of each of those formats, including separate alpha and destination-alpha factors. It is not measured on gfx1013 or on 8_8_8_8 and 16_16_16_16 targets. Factor pairs Vulkan applies per channel are used directly. Otherwise the pixel shader only copies values: it writes the exported alpha, each channel's own export or the constants 0 and 1 into a second color at location 0 index 1 (and 1 into a channel of the first color whose source factor is ONE, moving its export into the factor), and the blend forms every factor, `1 -` and product from those copies through `SRC1_COLOR`/`SRC1_ALPHA` factors. The blend unit therefore rounds them as it rounds a plain Vulkan blend of the same export; Vulkan does not require a second-source color to be converted like the first, but on an RTX 5080 and lavapipe every reversed-order case of the execution test is bit-identical to the same draw into a `SWAP_STD` target, which the test checks. Factor combinations that copies cannot express (for example `ONE_MINUS_SRC_ALPHA` in the alpha equation with `SRC_COLOR` in the color equation), sRGB, SNORM and integer targets, constant and second-source factors, destination-alpha and `SRC_ALPHA_SATURATE` factors in the color equation, different color and alpha operations, MIN or MAX with factors other than ONE, other color exports when the blend needs the second color, and devices without `dualSrcBlend` throw. Gran Turismo 7 (PPSA01317) blends `CB_BLEND0_CONTROL` 0x65010504 into such a target (#4782).
 - [DB_SHADER_CONTROL.CONSERVATIVE_Z_EXPORT](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp) (libSceAgcDriver) becomes `DepthLess`/`DepthGreater`. For a pixel shader that breaks the promise, the host driver decides whether its interpolated Z is depth-tested before shading; what the console does then was not measured.
 - [DB_SHADER_CONTROL.STENCIL_TEST_VAL_EXPORT_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) becomes `FragStencilRefEXT` when available, taken from the second MRTZ channel of the 32_GR and 32_ABGR formats as Mesa's AMD drivers write it ([`emit_ps_mrtz_export`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/3e32b0e1f132231b7a972c1b0b5b06c7e16cf8b9/src/amd/common/nir/ac_nir_lower_ps_late.c#L194)); the console was not measured. The host value is the test value of both faces and what `REPLACE_TEST` writes, so a stencil operation that writes all ones or the operation value throws with it, as do a stencil clear draw and the UINT16_ABGR layout. A device without the extension uses the bounded replay described above. On such a device a draw first drops the export when the reference cannot change its result (`StencilReferenceUnused`: no stencil test or attachment, or on both faces a compare that ignores it and no reachable `REPLACE` through a non-zero write mask), and its pixel shader is then compiled at its first draw, not when its ABI is resolved. A device with the extension keeps the export, so each such shader keeps one pixel variant.
 - [DB_SHADER_CONTROL.STENCIL_OP_VAL_EXPORT_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - the pixel shader supplies the stencil operation source value per pixel, in place of `DB_STENCILREFMASK.STENCILOPVAL`. Only the operations that take that value read it: `REPLACE_OP` and the clamped and wrapping add and subtract (codes 4, 5, 6, 8 and 9), and the logic operations, which throw already ([AMD_stencil_operation_extended](https://registry.khronos.org/OpenGL/extensions/AMD/AMD_stencil_operation_extended.txt), [AMD_shader_stencil_value_export](https://registry.khronos.org/OpenGL/extensions/AMD/AMD_shader_stencil_value_export.txt)). Vulkan has no per-pixel operation value. Without `STENCIL_TEST_VAL_EXPORT_ENABLE`, a `REPLACE_OP` reachable through a non-zero write mask (`StencilOperationValueReplaces`) becomes `REPLACE` with the exported value as `FragStencilRefEXT`, or the bounded replay without the extension; this requires a compare that ignores the test value and no `ONES` or `REPLACE_TEST` on either face, and early tests throw. The value is taken from bits 8-15 of the second MRTZ channel: the PPSA27836 pixel shader that uses it shifts it left by 8 before `exp mrtz` (`v_lshlrev_b32 v0, 8, v0`), which is the only evidence for the layout. The add and subtract operations, and `REPLACE_OP` with a test value export, throw. With the 32_GR or 32_ABGR Z format and no such operation, or without a stencil test, the export cannot change the result and is ignored. Other Z formats throw. The console was not measured.
+- [Stencil logic operations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `STENCIL_NAND` and `STENCIL_NOR` (`DB_STENCIL_CONTROL` 13 and 14, [PS5_Mesa](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/registers/gfx103.json#L581-L598)) throw. AND, OR, XOR and XNOR (10, 11, 12 and 15) apply `STENCILOPVAL` as [AMD_stencil_operation_extended](https://registry.khronos.org/OpenGL/extensions/AMD/AMD_stencil_operation_extended.txt) defines them, not measured on the console, drawn as `ZERO`, `REPLACE` with those reference bits set, or `INVERT` under the write mask narrowed to the bits they change. A face whose other operations write other bits throws, as does OR on a compared test value bit it would set, or with a stencil test value export.
 - [DB_SHADER_CONTROL.DEPTH_BEFORE_SHADER](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp) (libSceAgcDriver) becomes `EarlyFragmentTests`, and so does `Z_ORDER` `EARLY_Z_THEN_LATE_Z` or `EARLY_Z_THEN_RE_Z` without kill, Z export, mask export or stencil export; with alpha-to-coverage the tests stay late. The meaning of the bit and of `Z_ORDER` 3 follows Mesa (`src/amd/registers/gfx10.json`; RADV sets the bit for `early_fragment_tests` in `src/amd/vulkan/radv_shader.c`). What the console does with `DEPTH_BEFORE_SHADER` and a Z export, a mask export, a stencil export or alpha-to-coverage together was not measured.
 - [PA_SC_CONSERVATIVE_RASTERIZATION_CNTL](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - 0x6001 uses Vulkan overestimation on devices that add at most 1/256 pixel and keep degenerate triangles; the console's uncertainty region and degenerate handling are unmeasured. A value with `OVER_RAST_ENABLE` and `UNDER_RAST_ENABLE` clear is decoded as disabled even when `UNCERTAINTY_REGION_MODE` or the `OUTER_`/`INNER_UNCERTAINTY_EDGERULE_OVERRIDE` bits (19:16) are set, as PPSA01474 writes 0xe6000; that these fields have no effect without over- or underestimation is assumed from their names, not measured. With `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` = 0 the `PERSP_CENTROID` and `LINEAR_CENTROID` inputs get the pixel-centre barycentrics, as without conservative rasterization ([shader debt](shader.md)): the one rasterized sample sits at the pixel centre, so every centroid the rasterizer could pick for an overestimated pixel is that point; that it does not move the centroid towards the primitive when the sample is uncovered is inferred, not measured. With more rasterized samples, and when a single-sample draw is raised to a multisampled color target, centroid inputs throw.
 - [Descriptor pool chain](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - each pool holds two storage buffer descriptors more than a set can take, as a workaround: RADV (Mesa 26.0 and later) lets a `FREE_DESCRIPTOR_SET` pool place a set up to 32 bytes past the pool's buffer ([`util_vma_heap_init`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/amd/vulkan/radv_descriptor_pool.c) is given `bo_size + RADV_POOL_HEAP_OFFSET` as a size), and with a page-multiple pool size those bytes are an unmapped page
 - [CMASK fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - each fast-cleared CMASK tile (code 0) is stored as `CB_COLOR_CLEAR_WORD` into its 8x8 texels at the first draw into the target or at its fast-clear eliminate or DCC decompress pass, not as the color block writes the tile, and the CMASK is then stored as expanded (0xF): a texture or copy read of the target after that draw and before the title's eliminate sees the clear value in tiles no draw wrote, where the console keeps their previous bytes. Tile addresses follow the pipe-aligned SW_64KB_Z_X CMASK equation for 16 pipes; other CMASK swizzle modes, a cleared tile of a DCC target and a fast clear of a 3D or array color target throw; base mip 0 of a 2D mipmapped color target is supported (offset follows AMD Addrlib `Gfx10Lib::HwlComputeCmaskInfo` reverse mip-chain ordering preceding base mip 0, unverified on PS5 hardware; mipmapped targets with 8 or 16 bpp throw until `dsMipmapHtileFix` mip-tail shrinkage is modelled). A tile with a code other than 0 and 0xF keeps its texels like an expanded tile: PPSA18391 (engine: Clickteam Fusion) fast clears a target whose CMASK it never initialized, so some of its nibbles hold leftover values such as 1 and 10; what the console does with such codes on a single-sample target is unverified on hardware. Single-sample views with `viewMip > 0` skip CMASK fast-clear decoding since CMASK metadata only covers base mip 0 on AMD hardware (Mesa `si_state.c` similarly clears `FAST_CLEAR` for level > 0).
-- [CMASK clear pass on AMD without pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp) (libSceAgcDriver) - the compute pass that stores a fast-cleared CMASK into a resident render target (`DispatchCmaskClear`) is unverified on AMD's Windows driver with `APS5_NO_GPL=1`: on a Radeon 860M (driver 32.0.13058.8001, Windows 11) `agc_driver_cmask_fast_clear` keeps the stale 0x5A5A5A5A in its `SW_64KB_R_X` pass instead of the clear value, while it passes with pipeline libraries on and on an NVIDIA RTX 4080 SUPER in both modes. An RX 6400 (driver 32.0.21033.3005) lost the device (read invalid at 0xbeefdeadc000) in an earlier build tree, but clean rebuilds of four main commits of 19 October pass there (three of three runs each), so that failure is not reproduced. The cause is not found (#5150). Closes when: the cause is found, or `ctest -R '^agc_driver_cmask_fast_clear$' --repeat until-fail:5` passes with `ANYPS5_GPU=Radeon` and `APS5_NO_GPL=1` on AMD.
-- [HTILE depth fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - HTILE is not modeled. Only RADV's `clear_htile_mask` compute kernel (17 GFX10 words, 64x1x1 groups) is recognized, and only when it leaves ZMASK at 0 (`user[4]` and `user[5]` low nibbles both 0); the dispatch still runs, and the host depth image is cleared to `DB_DEPTH_CLEAR` the next time the surface with that `DB_HTILE_DATA_BASE` address is bound. The address match is exact, so a clear of a different HTILE range does not hit. HTILE initialization, the stencil-only update, and fast clears made by the SDK's own paths, CP DMA fills or other kernels are not covered and leave the depth image as it was. The kernel words are the ones the PR author saw RADV submit; they are not compared with Mesa's source. A second kernel, the 9-word dword fill PPSA01802 (Kena: Bridge of Spirits) clears its depth HTILE with (64x1x1 groups, one `buffer_store_format_x` per thread through the stride-4 V# in `user[0..3]`, the value read by `s_buffer_load_dword` through the V# in `user[4..7]`), is taken as a fill of that range when the store format is 32_UINT, 32_SINT or 32_FLOAT and the value V# covers the dword (NUM_RECORDS times its stride, or NUM_RECORDS bytes when the stride is 0) ([`MatchMemoryValueFill`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp), then the whole-HTILE and ZMask rules of `NoteDepthMetadataFill`). The value is read from guest memory when the dispatch is decoded, so a value that earlier GPU work in the same submission has not written back yet is not seen. When the [fill HLE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) takes the dispatch instead (an output descriptor of one 32-bit value per element, a value descriptor that covers the loaded dword, a 16-byte aligned range), the value is read again when the fill is recorded, after the labels queued before it, and the HTILE fill is noted with that value.
+- [HTILE depth fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - HTILE is not modeled. Only RADV's `clear_htile_mask` compute kernel (17 GFX10 words, 64x1x1 groups) is recognized, and only when it leaves ZMASK at 0 (`user[4]` and `user[5]` low nibbles both 0); the dispatch still runs, and the host depth image is cleared to `DB_DEPTH_CLEAR` the next time the surface with that `DB_HTILE_DATA_BASE` address is bound. A clear hits a surface only when its range covers that surface's whole HTILE, which need not start where the clear does. Fast clears that other writers leave in HTILE are taken at bind as the next entry describes. The kernel words are the ones the PR author saw RADV submit; they are not compared with Mesa's source. A second kernel, the 9-word dword fill PPSA01802 (Kena: Bridge of Spirits) clears its depth HTILE with (64x1x1 groups, one `buffer_store_format_x` per thread through the stride-4 V# in `user[0..3]`, the value read by `s_buffer_load_dword` through the V# in `user[4..7]`), is taken as a fill of that range when the store format is 32_UINT, 32_SINT or 32_FLOAT and the value V# covers the dword (NUM_RECORDS times its stride, or NUM_RECORDS bytes when the stride is 0) ([`MatchMemoryValueFill`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp), then the whole-HTILE and ZMask rules of `NoteDepthMetadataFill`). The value is read from guest memory when the dispatch is decoded, so a value that earlier GPU work in the same submission has not written back yet is not seen. When the [fill HLE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) takes the dispatch instead (an output descriptor of one 32-bit value per element, a value descriptor that covers the loaded dword, a 16-byte aligned range), the value is read again when the fill is recorded, after the labels queued before it, and the HTILE fill is noted with that value.
 - [HTILE written by other kernels](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - when a depth target is bound and its HTILE was written since it was last read, the words over its whole pipe-aligned metadata (`HtileMetadataBytes`, the extent `HtileFillCovers` takes) are read, outside the surfaces mutex since the read waits for recorded work: when every one marks the depth (ZMask 0) or the stencil (SMem 0) cleared, the surface takes that fast clear and the words are stored back as expanded (depth only: ZMask 15 over the full Z range; with stencil: ZMask 15, Z range and SMem, SR1 and SR0 3), so only the title's next clear clears it again. PPSA29141 clears its depth every frame with a compute kernel the fill hooks do not recognize (`InvokeHTileClearComputeShader` in its `ClearMRT` pass); without this its depth kept every earlier frame and moving objects left black trails. PPSA25344 (Unreal Engine 5) reads its HTILE after the depth prepass in its Nanite depth export, which takes a tile with ZMask 0 as holding the clear value; without the expanded words the export put Nanite depth over the prepass and the Nanite material pass painted over the meshes in front. The word layouts are Mesa radv's for GFX10. Metadata with some tiles cleared is not modelled, and the compression state draws leave in HTILE is not tracked, so a title reading its HTILE after a draw sees the stored expanded words. A recognized HTILE fill or clear makes the next bind read the words again. A slice other than 0 of a depth array is read at its own HTILE (`DB_HTILE_DATA_BASE` plus the slice times `HtileMetadataBytes`) but the HTILE word layout of slices 1 and up is not modelled (PPSA05684's tile masks need X8 and Y8 to take Z0 and Z1 as well, slices 4 and up unmeasured), which neither the check that every word is cleared nor the store-back of each word in place needs, so such a slice takes the clear like slice 0. A depth-only HTILE whose tiles all have ZMask 0 but different Min/Max Z (per-tile clear values, PPSA05684's cascades) is taken as a whole-surface clear to `DB_DEPTH_CLEAR`, the value the DB's depth test reads for a cleared tile (`HTILE_Z_CLEAR_REG` in Mesa's `src/amd/common/ac_descriptors.h`: the clear word "only clears HiZ", "the DB register contain[s] the full clear values"); the HiZ test before it, which rejects against each tile's own Min/Max Z range (the HTILE definitions in the same file), is not modelled, so a draw that HiZ would reject over a tile cleared with Min/Max Z 0 is tested against `DB_DEPTH_CLEAR` instead. A multisampled depth target, and any target whose HTILE overlaps a resident native depth guard, skips this read and store-back and goes to the native multisample depth owner, which keeps its own refusal for a fast-clear transition.
 - [RADV fill-memory kernel](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) (libSceAgcDriver) - the [fill HLE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) takes RADV's 16-byte `fill_memory` compute kernel (`MatchClampedGlobalFill`: 11 GFX10.3 words, 64x1x1 groups, six user SGPRs with the address in `user[2..3]`, the largest store offset in `user[4]` and the value in `user[5]`; each thread stores 16 bytes at `min(thread * 16, user[4])`) as a fill of `min(threads * 16, user[4] + 16)` bytes. RADV initializes and fast-clears DCC keys and other metadata with it, so the key and metadata tracking sees such a fill where it is in the command stream; run as a dispatch, its global stores name no range, and a key fill was only seen once it had landed, after later writes to the surface. Only a 16-byte aligned address and largest offset are taken. RADV's 4-byte variant (fills below 16 bytes), other Mesa versions' encodings and other compilers still run as dispatches. The kernel words are the ones vkQuake's PS5 RADV build (Mesa 25.2) submitted; they are not compared with the NIR builder's output for other targets.
-- [Host imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) on Linux skip ranges that are not mapped read-write, which are copied instead. The NVIDIA driver (595.91.07) refuses `VK_EXT_external_memory_host` imports of read-only or executable mappings (and shared mappings of regular files) with `VK_ERROR_OUT_OF_DEVICE_MEMORY`, after which every `vkAllocateMemory` on the device fails the same way. Read-only ranges are never imported, even on drivers that accept them. Shared mappings of regular files are not checked for. On Windows, an alias of adjacent registered ranges is refused if any page is not a shared view; a range made entirely of shared views is aliased run by run, including across sections or nonconsecutive section offsets. Adjacent registered ranges are joined into one import: the largest aligned power-of-two block, from twice the import alignment up to the 8 MiB window, that holds the requested address and that they fill exactly, so a block only grows by doubling as its window fills. A block that would exceed the budget, would replace an import a build holds, or fails (a refused Windows alias, `vkAllocateMemory`) steps down to the next smaller block; a failed block is not tried again until one of its ranges changes. Ranges larger than the window are imported one at a time. A buffer bound across adjacent ranges that are each larger than the window, or bound exactly over adjacent ranges of any size (from the first one's start to the last one's end), joins them into one import when it is bound, and their own imports are retired; a buffer that crosses any other two imports is copied. A heap grown in pieces re-imports its joined run only when a buffer is bound exactly over all of its pieces, or when a sparse descriptor heap over it is bound: a heap a shader binds whole while only the pieces from its base are mapped is bound in place from the import of that run, its views ending at the import's end as the copy's do, once the previous bind of that address saw the same last mapped byte (a heap that grows between every two of its binds stays copied; one bound more often than it grows is joined again after each growth) and at most 64 times per joined run base; past that, with a message, it is not joined again: it is bound in place while an existing import covers its run and copied otherwise, until no registered range starts at that base or the device changes. Ranges larger than the window are taken to be registered whole and never grown in pieces: a title that grows a heap in pieces larger than 8 MiB re-imports the joined run each time a bound buffer crosses into a new piece. The 8 MiB window is a choice: unbounded runs were re-imported whole on every growth of a heap mapped in small pieces, and the NVIDIA driver (610.57.04, 615.78.08) then refused imports or lost the device. Not measured on RADV.
+- [Host imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) on Linux skip ranges that are not mapped read-write, which are copied instead. The NVIDIA driver (595.91.07) refuses `VK_EXT_external_memory_host` imports of read-only or executable mappings (and shared mappings of regular files) with `VK_ERROR_OUT_OF_DEVICE_MEMORY`, after which every `vkAllocateMemory` on the device fails the same way. Read-only ranges are never imported, even on drivers that accept them. Shared mappings of regular files are not checked for. On Windows, an alias of adjacent registered ranges is refused if any page is not a shared view; a range made entirely of shared views is aliased run by run, including across sections or nonconsecutive section offsets. Adjacent registered ranges are joined into one import: the largest aligned power-of-two block, from twice the import alignment up to the 8 MiB window, that holds the requested address and that they fill exactly, so a block only grows by doubling as its window fills. A block that would exceed the budget, would replace an import a build holds, or fails (a refused Windows alias, `vkAllocateMemory`) steps down to the next smaller block; a failed block is not tried again until one of its ranges changes. Ranges larger than the window are imported one at a time. A buffer bound across adjacent ranges that are each larger than the window, or bound over adjacent ranges of any size from the first one's start (ending anywhere in the last range it crosses), joins the ranges it crosses into one import when it is bound, and their own imports are retired; a buffer that crosses any other two imports is copied. A heap grown in pieces re-imports its joined run only when a buffer bound from its first piece's start crosses into a piece the joined import does not cover, or when a sparse descriptor heap over it is bound: a heap a shader binds whole while only the pieces from its base are mapped is bound in place from the import of that run, its views ending at the import's end as the copy's do, once the previous bind of that address saw the same last mapped byte (a heap that grows between every two of its binds stays copied; one bound more often than it grows is joined again after each growth) and at most 64 times per joined run base; past that, with a message, it is not joined again: it is bound in place while an existing import covers its run and copied otherwise, until no registered range starts at that base or the device changes. Ranges larger than the window are taken to be registered whole and never grown in pieces: a title that grows a heap in pieces larger than 8 MiB re-imports the joined run each time a bound buffer crosses into a new piece. The 8 MiB window is a choice: unbounded runs were re-imported whole on every growth of a heap mapped in small pieces, and the NVIDIA driver (610.57.04, 615.78.08) then refused imports or lost the device. Not measured on RADV.
 - [Cube texture descriptors](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp) with equal `BASE_ARRAY` and `DEPTH` expose six faces starting at `BASE_ARRAY`. Measured with `image_load`, `image_sample` and `image_get_resinfo` on RX 6600 (gfx1032), using 64x64 R32_UINT faces and base slices 0, 5 and 6. Other ranges containing fewer than six faces still throw: hardware load bounds and filtered-sample addressing differ. A range of six faces or more that does not end on a whole cube keeps every slice up to `DEPTH`, the bound loads use on hardware; sampling the cube it cuts short is out-of-range cube-array sampling. Out-of-range cube-array sampling remains unimplemented. Samplers with `DISABLE_CUBE_WRAP` are created with `VK_SAMPLER_CREATE_NON_SEAMLESS_CUBE_MAP_BIT_EXT`, the flag RADV maps to that bit (Mesa `src/amd/vulkan/radv_sampler.c`, `src/amd/common/ac_descriptors.c`); without `VK_EXT_non_seamless_cube_map` a cube texture sampled through such a sampler throws. PS5 equivalence has not been measured on console hardware.
 - [Array layer views](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp) (libSceAgcDriver) - `ArrayLayersServeView` lets a 2D texture at a 2D array image's base address, or a 2D array texture over its first layers, view that image (`Texture::CanCopyFrom`). Mesa-built homebrew (ps5-opengl) writes the view's last slice plus one to `CB_COLOR_ATTRIB3.MIP0_DEPTH`, so a slice-0 render target is a two-layer array image, and the title samples it as a plain 2D texture (SuperTuxKart PPSA69421 drew a black 3D scene and minimap without this). The per-layer layout of a mipmapped array is assumed equal to a standalone surface's; it is not measured on the console. A 2D texture at a later slice's address still gets an image of its own.
 - [Multisampled CMASK](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a multisampled color target's CMASK is decoded under CB_COLOR_INFO FAST_CLEAR (bit 13, as for a single-sample target) or COMPRESSION (bit 14). Which bit a multisampled target sets is inferred: its fast clears were seen on GTA V's multisampled targets through their CMASK fills, not in a register dump. A COMPRESSION-only target's zero CMASK is not read as cleared (inferred: zero means cleared only under FAST_CLEAR), so only a fill after its first use clears it. A slice of a multisampled array is its own image at its own address with its own CB_COLOR0_CMASK (inferred from the register layout). Its CMASK is main's whole-metablock size.
-- [Compressed FMASK reads](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) without an exact resident native owner throw. Native reads require eight fragments, one slice and mip, pipe-aligned DCC/CMASK, Z_64KB_X FMASK and unchanged, disjoint watched planes. The host stores independent samples and exposes their expanded indices (`0x76543210`, AMD PAL `c5e80007`, `Gfx9Fmask::GetPackedExpandedValue`); console equivalence is unmeasured. Other layouts, standalone compressed decoding, guest publication and recipe reuse remain unsupported. Metadata writes invalidate the native view, including same-value stores.
-- [Multisampled CMASK state](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - a multisampled target has no guest texels, so its CMASK state comes from fills rather than from a read at each draw as a single-sample target's does. A fill of the whole CMASK with 0 clears the host image at the target's next use, one with 0xffffffff marks it expanded, and any other pattern, or a fill that covers only part of the CMASK, throws at the next use (inferred: main's rule that a mixed CMASK is unmodeled, applied to the one host image). A FAST_CLEAR target starts from its CMASK keys at its first use, and a COMPRESSION-only target starts expanded. Copies by DMA into the CMASK are not seen, and a later use with another CMASK address throws. The clear does not rewrite the CMASK bytes as expanded, so a new target over the same CMASK (a different extent, so a different image) seeds from them again and clears once more.
+- [Compressed FMASK reads](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) without an exact resident native owner throw. Native reads require eight fragments, one slice and mip, pipe-aligned DCC/CMASK, Z_64KB_X FMASK and unchanged, disjoint planes, each watched or in a host import the Linux write-watch probe compares (kept as a copy and compared at most once per collect epoch); an FMASK import awaiting its Windows deferred read is read first (`WatchedAfterSettle`). The host stores independent samples and exposes their expanded indices (`0x76543210`, AMD PAL `c5e80007`, `Gfx9Fmask::GetPackedExpandedValue`); console equivalence is unmeasured. Other layouts, standalone compressed decoding, guest publication and recipe reuse remain unsupported. Metadata writes invalidate the native view, including same-value stores, except a same-value CPU store to a compared plane.
+- [Multisampled CMASK state](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - a multisampled target has no guest texels, so its CMASK state comes from fills rather than from a read at each draw as a single-sample target's does. A fill of the whole CMASK with 0 clears the host image at the target's next use, one with 0xcccccccc, 0xdddddddd, 0xeeeeeeee or 0xffffffff marks it expanded, and any other pattern, or a fill that covers only part of the CMASK, throws at the next use (inferred: main's rule that a mixed CMASK is unmodeled, applied to the one host image). A FAST_CLEAR target starts from its CMASK keys at its first use, and a COMPRESSION-only target starts expanded. Copies by DMA into the CMASK are not seen, and a later use with another CMASK address throws. The clear does not rewrite the CMASK bytes as expanded, so a new target over the same CMASK (a different extent, so a different image) seeds from them again and clears once more.
+- [Multisampled DCC CMASK without fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - the initial CMASK of a multisampled DCC target is not checked when CB_COLOR_INFO enables COMPRESSION but not FAST_CLEAR: it then holds only FMASK compression, and a uniform DCC clear sets every fragment, so the target imports as that clear. What the console reads where such an FMASK names no fragment, as an uninitialized CMASK can, is unverified.
 - [Multisampled color fills](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - a multisampled target's samples are on the host, so a fill of its color memory is applied at its next use: a uniform fill over the whole of it clears the host image to that value, and a pending CMASK fast clear takes precedence over the fill and over a fill that would throw. Its color memory is a single mip and slice of addrlib's block dimensions for its sample count (ComputeThinBlockDimension). A fill over part of it, a fill reaching the start of a target whose footprint is not computed (linear), and a fill value with no exact clear value in the format (sRGB channels other than 0 and 1) throw at the next use. A fill before the target's first use is not seen (the host image starts at 0), nor are copies or shader writes into its color memory. A uniform compute fill over exactly the whole color memory with an exact clear value is not stored into guest memory, since only the host image holds the samples. A target is retired only when its whole guarded range is unmapped or its allocation removed, so if a title reuses that memory for other data while it stays mapped, a read the guard does not check (a buffer read through a V# or a pointer) sees the bytes from before the fill.
-- [Multisampled texture no draw rendered to](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - sampling a multisampled texture whose surface no draw rendered to creates the host target from the T# and clears it to the color a single 32-bit value repeated over the whole footprint encodes, padding up to whole tile blocks included. Inferred, not measured on the console: that the samples of such a surface are the guest color memory, as a title that clears its canvas on the CPU (ps5-opengl `ps5_clear_msaa4_color`) relies on. Memory that is not one repeated value, tile modes other than Standard4KB, Standard64KB and RenderTarget, unmapped memory and values with no exact clear color throw. CPU writes to the surface after its host target exists are not seen by the host.
-- [Multisampled targets in CB passes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a CB eliminate or DCC pass over a multisampled target throws, since its texels are on the host and only a CB resolve and an FMASK decompress (`CB_COLOR_CONTROL` mode 5) are modeled. The FMASK decompress only applies the pending CMASK fast clear to the host image; it requires a CMASK address, and the target's DCC and FMASK contents are not interpreted. DCC over a multisampled target is accepted only in that pass and throws everywhere else. A CB resolve into a fast-clear destination throws: the resolve writes the destination's texels but not its CMASK, which would still read as cleared.
-- [Multisampled target guest access](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - the memory a multisampled color target throws on (CPU read, index buffer read, fixed-function vertex buffer read, DMA copy, texture or storage image read) uses fragment-aware 64 KiB render-target blocks. [AMD Addrlib's GFX10 thin-block rule](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L1680-L1712) gives the block width and height from element bytes and fragment count; its [surface-size calculation](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L4000-L4005) rounds both extents to those blocks and multiplies by element bytes and fragments. Thus a 1920x1080 4x RGBA8 surface occupies 0x1fe0000 bytes, leaving the next allocation at +0x2000000 outside the guard. The 2x and 8x block orientations differ from treating the fragments as a larger element. Console address-layout equivalence has not been measured. Other tile modes retain the conservative `max(CB bytes * samples, width * height * element bytes * samples)` bound, which may still reject a distinct allocation. Live targets remain cached per device, surface address, format, extent and sample count. Retired cache owners are removed on the next target, sampled or storage lookup; outstanding recorded work and sampled views retain their images. Ordinary sampled and storage bindings check the color-target guard before resource reuse, including precollected sampled lookups. Reused image tables do not invalidate on multisample color-target registration yet; their per-element fault handling and native multisample sampling require a separate reuse proof.
-- [DB depth copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a draw with `DB_RENDER_CONTROL.DEPTH_COPY` is run as a compute pass that copies one sample of the `Z_32_FLOAT` depth surface into a single-sample R32 float color target over the whole surface. With `COPY_CENTROID` the sample is the first one the draw covers, which is sample 0 under the full `PA_SC_AA_MASK` the driver requires: [radeonsi copies one sample per draw with `COPY_CENTROID` and a one-sample mask](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state.c#L1679-1681); the console is not measured. Stencil copies, depth tests, other depth formats, multisampled or other-format targets and copies over part of the surface throw.
+- [Multisampled texture no draw rendered to](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - sampling a multisampled texture whose surface no draw rendered to creates the host target from the T# and clears it to the color a single 32-bit value repeated over the whole footprint encodes, padding up to whole tile blocks included. Inferred, not measured on the console: that the samples of such a surface are the guest color memory, as a title that clears its canvas on the CPU (ps5-opengl `ps5_clear_msaa4_color`) relies on. Memory that is not one repeated value, tile modes other than Standard4KB, Standard64KB, Z64KBX, D64KBX and RenderTarget, unmapped memory and values with no exact clear color throw. CPU writes to the surface after its host target exists are not seen by the host.
+- [Sample 0 of a multisampled color target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp) (libSceAgcDriver) - a 2D image read of a multisampled color target returns its float, UNORM, SNORM or sRGB sample 0 exactly only where the driver keeps those values through a shader and a color attachment, which Vulkan does not require, and one of a multisampled depth surface throws. The read binds a one-sample copy that a fragment pass (`texelFetch` of sample 0) draws before every such binding; integer formats copy exactly.
+- [Multisampled targets in CB passes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a CB eliminate or DCC pass over a multisampled target throws, since its texels are on the host and only a CB resolve and an FMASK decompress (`CB_COLOR_CONTROL` mode 5) are modeled. The FMASK decompress only applies the pending CMASK fast clear to the host image; it requires a CMASK address, and the target's FMASK contents are not interpreted. In that pass as elsewhere, multisampled DCC is accepted only as a native multisampled DCC fast clear or comp-to-single clear. A CB resolve into a fast-clear destination throws: the resolve writes the destination's texels but not its CMASK, which would still read as cleared.
+- [Multisampled target guest access](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - the memory a multisampled color target throws on (CPU read, index buffer read, fixed-function vertex buffer read, DMA copy, texture or storage image read) uses fragment-aware 64 KiB blocks for the RenderTarget, Z64KBX and D64KBX tile modes. [AMD Addrlib's GFX10 thin-block rule](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L1680-L1712) gives the block width and height from element bytes and fragment count; its [surface-size calculation](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L4000-L4005) rounds both extents to those blocks and multiplies by element bytes and fragments. Thus a 1920x1080 4x RGBA8 surface occupies 0x1fe0000 bytes, leaving the next allocation at +0x2000000 outside the guard. The 2x and 8x block orientations differ from treating the fragments as a larger element. Console address-layout equivalence has not been measured. Other tile modes retain the conservative `max(CB bytes * samples, width * height * element bytes * samples)` bound, which may still reject a distinct allocation. Live targets remain cached per device, surface address, format, extent and sample count. Retired cache owners are removed on the next target, sampled or storage lookup; outstanding recorded work and sampled views retain their images. Ordinary sampled and storage bindings check the color-target guard before resource reuse, including precollected sampled lookups. Reused image tables do not invalidate on multisample color-target registration yet; their per-element fault handling and native multisample sampling require a separate reuse proof.
+- [DB depth copies](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp) (libSceAgcDriver) - with `COPY_CENTROID` the copied sample is sample 0, as [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state.c#L1679-1681) programs it under a full sample mask, so an edge pixel whose sample 0 the draw doesn't cover can differ from the console's first covered sample; not measured on the console. The copy runs as the title's draw with a driver-authored guest pixel program (hand-encoded RDNA2) that loads the sample through a driver-built T# and exports it as `32_R`. A multisampled plane is read without the native multisample import checks. Stencil copies, depth tests, planes other than `Z_32_FLOAT`, mips, a partial sample mask, blending, indirect draws and other targets throw.
 - [CB resolve sample count](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a draw with CB_COLOR_CONTROL in resolve mode is a CB resolve when either PA_SC_AA_CONFIG or CB_COLOR0_ATTRIB.NUM_SAMPLES is multisampled, and takes its sample count from CB0. Inferred, not from documentation: PPSA36082 resolves its 4x targets with no sample count in PA_SC_AA_CONFIG, and radeonsi sets PA_SC_AA_CONFIG to 0 for a multisampled framebuffer when rasterizer multisampling and line smoothing are off. PA_SC_AA_CONFIG is only compared with CB0 while PA_SC_MODE_CNTL_0.MSAA_ENABLE is set: PPSA08270 resolves a 4x 512x512 target with MSAA_ENABLE off and PA_SC_AA_CONFIG still at 2x (0x00108001) from earlier draws.
 - [Custom MSAA sample locations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) support a uniform 1x1 pattern for 2, 4 or 8 samples through VK_EXT_sample_locations. Patterns varying across the guest's 2x2 pixel grid use a 2x2 sample location grid, anchored at the framebuffer origin like the guest's while the window offset is zero, on devices whose `maxSampleLocationGridSize` for the sample count is a multiple of 2x2. On other devices every pixel takes the pattern's pixel (0,0) locations (`PA_SC_AA_SAMPLE_LOCS_PIXEL_X0Y0_*`, its first registers and the corner the grid is anchored at), and the first such pipeline of each sample count logs `[gpu] no 2x2 sample location grid`. The RTX 5070 reports 2x4 for 2 samples, 2x2 for 4 and 1x2 for 8; an AMD Radeon integrated GPU reports 2x2 for each count, per count and for every count; an RTX 3070 Laptop GPU (driver 617.42) reports `maxSampleLocationGridSize` 1x1 for every count (`VkPhysicalDeviceSampleLocationsPropertiesEXT`), but per count (`VkMultisamplePropertiesEXT`, which the device setup reads and logs) a 2x4 grid at 2 samples, 2x2 at 4 and 1x2 at 8. So the 3070's 2x patterns, the 2x checkerboard among them, take the native grid, and the stand-in plus the exact path serve its 8-sample patterns and devices without a grid. A pattern that only reorders one set of positions between pixels, as a 2x checkerboard pattern puts its samples at x = +4/16 and -4/16 and swaps them on odd rows, is drawn exactly through that stand-in: before every render pass that draws with it each pixel's samples are put in the stand-in's order and after it back in the guest's, through a storage view of a multisampled color target and through a copy and a per-sample pass for depth (writing stencil through VK_EXT_shader_stencil_export, or one pass per bit without it), while the pixel shader reads SampleID, applies the sample mask and exports coverage in the guest's order, and the second log line names the reordering. A uniform partial sample mask that the order moves is applied in the pixel shader. With early Z, a depth or stencil test and memory writes in the pixel program, the draw throws, where #6451's stand-in alone ran it with odd rows' sample indices swapped. A fix would choose the stand-in after compilation. That costs two passes over each multisampled attachment per render pass, and on those devices every multisampled color target is created with a mutable format and storage usage for its view, which a driver may answer by not compressing it. It needs shaderStorageImageMultisample with a storage view of the color format at the sample count, sampleRateShading, and a depth format a FragDepth write gives back exactly (16-bit, or 32-bit float; not 24-bit depth, the stand-in for 16-bit depth with stencil where the device has neither); without them, and for patterns whose pixels hold different positions, the stand-in alone is used, and the log line says why. A device without shaderStorageImageMultisample takes the stand-in alone for every pass, depth-only passes included, so a depth target that a depth-only pass and a color pass both draw keeps one order. On a device that has it, a pass is still refused for a color format without a storage view at its sample count, while a depth-only pass on the same depth target is reordered, so that target's samples change order between those passes; a fix would decide the order per target. Then the top-left pixel of every 2x2 quad matches the console and the other three use its positions. A same-set pattern keeps every position and the number of samples a primitive covers in each pixel, so a resolve that averages a pixel's samples, or takes their minimum or maximum, sees the console's values, but sample i of an odd row holds what the console stores in sample 1 - i: a pass that reads the samples by index, as checkerboard reconstruction does, exchanges the two half-pixels of odd rows, which can show as combing along vertical edges, and per-sample shading, sample-mask exports and coverage inputs see the swapped indices too. A pattern whose pixels hold different positions draws pixel (0,0)'s positions in each pixel whose own differ. A device's pipelines and render pass begins take the same stand-in for a given pattern, so a sample-location-compatible depth image is not drawn with one set of locations and transitioned or tested with another. A multisampled rasterizer drawing into one-sample color targets, and a one-sample depth target if any, with MSAA_ENABLE set, no alpha-to-coverage and no coverage pixel input is drawn with one sample at sample 0's location in each pixel of the grid, as the targets keep only sample 0's coverage. Without PS_ITER_SAMPLE such a draw also refuses centroid inputs, and keeps PERSP_SAMPLE, LINEAR_SAMPLE and ANCILLARY: a pixel shaded once is taken to get sample 0's barycentrics and sample index 0. With PS_ITER_SAMPLE only sample 0's invocation reaches the targets, so its sample and centroid barycentrics are taken to be sample 0's and the draw is shaded once. Both are inferred, not measured. The pixel shader runs once per pixel with sample number 0, so ANCILLARY reads sample 0 and POS_X_FLOAT and POS_Y_FLOAT keep the position `SPI_BARYC_CNTL` names. PERSP_CENTER and LINEAR_CENTER inputs on this path are interpolated at sample 0's location on the host, where the console uses the pixel center; one-sample depth images are created with `SAMPLE_LOCATIONS_COMPATIBLE_DEPTH` when the device supports it, as multisampled ones already were; this is how VK_AMD_mixed_attachment_samples defines the case, and it is not measured on PS5 hardware. Other mixed sample counts throw. Devices without the required sample count, four subpixel bits or the full guest coordinate range refuse custom patterns. Depth images remain in GENERAL between draws, and render passes cannot continue across pattern changes. A pass that draws depth at custom sample locations ends with a transition to TRANSFER_SRC_OPTIMAL and back that names them. Guest offsets retain the existing decoder's signed four-bit, sixteenth-pixel interpretation; PS5 coverage and interpolation equivalence have not been measured on hardware.
 - [Single-sample scan into a multisampled depth target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a draw with `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` = 0 and `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear into a multisampled depth target rasterizes the depth target's sample count with every sample at the pixel center, as a single-sample scan into a multisampled color target already does. radeonsi programs this `MSAA_ENABLE` and `PA_SC_AA_CONFIG` with the depth buffer's own sample count when GL multisampling is disabled on a multisampled framebuffer ([L1066-L1068](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L1066-L1068), [L3485-L3512](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L3485-L3512)), although its comment lists Z samples as at most the coverage samples ([L3439](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L3439)) and it sets `DB_EQAA.MAX_ANCHOR_SAMPLES` to the Z sample count, where PPSA18216 sets `DB_EQAA` to 0. GL then lets every sample take the single-sample depth ([L185-L190](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L185-L190)) and the fragment be treated as in multisampling with full coverage ([L422-L425](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L422-L425)), which is what this draws: each depth and stencil sample is tested and written with the depth at the pixel center. GL also lets an implementation test only a centermost sample and set every sample from it ([L425-L434](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L425-L434)), which differs when a pixel's stored samples differ; which one the console does, whether it instead evaluates the depth plane at each sample position, and how its occlusion queries count such a draw, is not measured on hardware. Points, lines, alpha-to-coverage, `DB_EQAA` Z interpolation or overrasterization, a pixel program reading the sample index and a sample-mask export throw
@@ -179,15 +202,21 @@
 - [HDR output override](../../../core/libs/prx/libSceAgcDriver/Execution/src/HostHdr.cpp) - setting `APS5_FORCE_SDR` suppresses HDR availability reported to titles while retaining the detected display and surface capabilities. It selects the existing SDR presentation path; it does not add support for floating-point BT.2100 PQ buffers (`0xC001070722000000` and `0xC001070700000000`), whose presentation remains refused. The override does not change the host display settings.
 - [DCC key stores](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp) cover the console's DCC extent only for pipe-aligned DCC of single-level, single-layer 4-byte SW_64KB_R_X surfaces; other surfaces, and every texture and color target key read, cover one byte per 256 bytes.
 - [DCC key fills over other images](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) - a uniform fill at a live image's `dccAddress`, at least one key per 256 bytes long, is a key fill of that image even when other live images overlap it, but only while it is no longer than the image's key extent (`DccKeyCount`, the pipe-aligned count); a longer one is classified by its overlaps as before. The bound is inferred, not measured on a title: a longer fill also writes the bytes past the keys, which the overlapping image may own. Whether the title's bloom-target key fills stay within the extent was not checked (`APS5_TRACE_DCC_KEYS` prints the length of the fills classified as keys, not of the refused ones).
+- [Mipmapped DCC color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - the keys of a 2D color target with more than one mip are modeled for its whole surface only, as for a multi-mip storage image. The resident image takes a uniform clear over all of them, then marks them all uncompressed at its first write. The per-draw handling of a single-mip target's keys does not apply. A draw through the copied (non-resident) path leaves the keys as they were, and the CB metadata passes still refuse such a target. Keys that hold a different state per mip, and `ClearRegister` keys (whose value is a CB register), are not modeled for such a target. The keys of mipmapped DCC array and 3D targets are ignored.
 - [Comp-to-single DCC keys](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp) (libSceAgcDriver) - key 0x10 (`GFX9_DCC_CLEAR_SINGLE` in Mesa `ac_descriptors.h`) uniform over a surface makes every texel the element at the start of its 256-byte block, the top-left texel of the block where radv's `build_clear_dcc_comp_to_single_shader` stores the clear color. Sampled textures and storage images read that expansion (a storage image's first write stores the keys uncompressed, as under a clear code), and a CB DCC decompress pass stores it over the texels. A fast-clear eliminate over such keys throws, as a metadata pass over mixed keys does; color targets that render over such keys use their stored texels, and textures read mixed keys, and comp-to-single keys of a format whose element does not divide 256 bytes, as stored. "Uniform" is judged over the key bytes the driver reads, one per 256 surface bytes (see DCC key stores above), so a pipe-aligned surface whose keys differ past that range is expanded as if all were comp-to-single, as for the other clear codes. Not verified on hardware
 - [8_SRGB color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) on a device that cannot attach and blend R8_SRGB render into an RGBA8_SRGB copy of the target, so the sRGB encode, decode and blend rounding are the device's; the console's are not measured.
 - [8_SRGB color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) on such a device throw unless they are single-mip 2D surfaces with a resident image; linear targets have none.
 - [5_6_5 color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into R5G6B5. The field holding X is in bits 0-4, Y in 5-10 and Z in 11-15, as for the other AMD formats; the component swap picks which export fills them, following `ac_translate_colorswap` in [Mesa 26.2.2 ac_formats.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/common/ac_formats.c), which programs `SWAP_STD_REV` (2) for a surface with red in bits 11-15. With `SWAP_STD_REV` red goes to bits 11-15, R5G6B5's red, so the exports are written as they are; with `SWAP_STD` (0) red goes to bits 0-4 and the exports are written with X and Z exchanged, as for 1_5_5_5. The decoded format, component mapping and write mask are tested, and an execution test draws 32_ABGR exports into tiled and linear targets in both orders and compares every stored texel with that layout on the host device; the export direction is not measured on a PS5. Only UNORM with those two component orders is accepted; `SWAP_ALT` and `SWAP_ALT_REV` keep throwing. Destination alpha reads as 1, as Vulkan defines it for a format without alpha, which is not measured on the console. Constant blend colors with `SWAP_STD` go through the `0xc6` component-swap handling, which is not tested for this format. R5G6B5 has no entry in the DCC and multisample clear-encoding tables, so a CB DCC decompress or eliminate of DCC clear codes other than 0000 and a fast clear of a multisampled 5_6_5 target throw, as for 1_5_5_5. PPSA27305 renders into this format with `SWAP_STD_REV` (discussion #6434).
 - [1_5_5_5 color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into A1R5G5B5. AMD formats keep the first component in the least significant bits (X in bits 0-4, Y in 5-9, Z in 10-14, W in bit 15, as in the [fpPS4](https://github.com/red-prig/fpPS4) `kSurfaceFormat1_5_5_5` doc comment and as measured for textures in the packed 16-bit textures entry), while A1R5G5B5 keeps R in bits 10-14 and B in bits 0-4, so the pixel exports are written with X and Z exchanged, which makes the stored bits follow the guest layout. The decoded format, component mapping and write mask are tested, and an execution test draws 32_ABGR exports into tiled and linear targets and compares every stored texel with the guest layout on the host device; the export direction is not measured on a PS5. Only UNORM with the standard component swap is accepted. Constant blend colors go through the same component-swap handling as other targets with that export mapping (`0xc6`), which is not tested for this format. PPSA06699 renders into this format.
+- [4_4_4_4 partial writes, sample positions](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a partial write of a multisampled 4_4_4_4 UNORM target runs the pixel shader once per sample. For a shader the guest runs per pixel it throws on inputs that would follow the invocation's sample: the ancillary word and, unless every sample sits at the pixel centre, centroid, sample-located or pull-model barycentrics, Z, 1/W and positions at the centroid or a sample; off-centre samples make centre barycentrics throw without interpolation functions and fragment shader barycentrics. Centre barycentrics and positions, upper-left and fixed-point positions and the front face are kept, so each invocation reaches the console's colour and kill decision. A shader that writes guest memory throws, as each covered sample would repeat the writes, also when the guest iterates it itself (the request does not say). Not measured on a PS5.
+- [4_4_4_4 CB resolves](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a CB resolve from a packed color target throws, so a 2-sample 4_4_4_4 target cannot be resolved by the color block.
+- [4_4_4_4 partial writes, merged coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a partial write of a one-sample 4_4_4_4 UNORM target drawn with merged coverage (a multisampled rasterizer over a one-sample target, as radeonsi line and polygon smoothing does) throws: the merge leaves the target out of the colour attachments, so such a draw would rasterize the extra samples with no one-sample attachment for `VK_NV_framebuffer_mixed_samples` coverage reduction, a combination that is not tested.
+- [4_4_4_4 partial writes, measured hardware](../../../core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp) (libSceAgcDriver) - the single-sample merges and the 2-, 4- and 8-sample merges are measured only on an NVIDIA RTX 4070 SUPER, not on other host GPUs or a PS5.
 - [COPY_DATA from the GPU clock](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, `SRC_SEL` 9) writes the host steady clock in 10 ns ticks when the packet runs, the same counter as the `RELEASE_MEM` timestamp. On a PS5 (firmware 13.40, measured 2026-10-19 on the GPU through `sceAgcDriverSubmitDcb` from inside a retail title) `SRC_SEL` 9 and the `RELEASE_MEM` DATA_SEL 3 timestamp were the same counter (0x1C and 0x5C ticks apart within one buffer), and it ran at 98.0 and 99.8 MHz over two 1.1 s intervals timed by the CPU, i.e. 100 MHz within the submission jitter, as the 10 ns ticks here; only its starting value is the host's. The `COPY_DATA` cache policy fields are accepted and have no effect.
 - [COPY_DATA from a register](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, `SRC_SEL` 0) copies the value the queue holds for a shader, context or user config register (`COUNT_SEL` two consecutive ones) and throws for a register with no value. A dispatch records `COMPUTE_DISPATCH_INITIATOR` and, for `DISPATCH_DIRECT`, `COMPUTE_DIM_X/Y/Z` in the shader registers; `DISPATCH_INDIRECT` clears the three counts. Neither the register values the CP writes nor the copy's ordering against in-flight dispatches have been measured on hardware.
 - [EVENT_WRITE stream-out statistics events](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, opcode 0x46) - `SAMPLE_STREAMOUTSTATS1`-`3` and `SAMPLE_STREAMOUTSTATS` (event types 0x01-0x03 and 0x20 in [navi10_enum.h](https://github.com/torvalds/linux/blob/0fcb05b72344f40806cbe810de8872f1698bf053/drivers/gpu/drm/amd/include/navi10_enum.h#L14155-L14188)) are accepted on the graphics queue as a 2-dword packet with event index 0 and do nothing. [nvd.h](https://github.com/torvalds/linux/blob/0fcb05b72344f40806cbe810de8872f1698bf053/drivers/gpu/drm/amd/amdgpu/nvd.h#L326-L347) documents these events only with the sampling index (3, or `EVENT_INDEX__SAMPLE_STREAMOUTSTATS*` 8-11 on gfx10); the index-0 packet has no destination dwords, and what the CP does with it is neither documented nor measured on hardware. AnyPS5 does not emulate the VGT stream-out counters, so there is nothing to sample. The sampling indices throw that sampling to memory is not implemented, and other indices, other sizes and the compute queue throw. [sceAgcDcbEventWrite](../../../core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp) ignores the address for every event type except 0x38 and 0x39, so a call with one of these event types and an address builds the index-0 packet: nothing is written and nothing throws. Whether the console's builder emits a sampling packet for an address is not known.
 - [INDEX_ATTRIBUTES_INDIRECT](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, opcode 0x91) loads INDEX_BASE, INDEX_BUFFER_SIZE (in indices) and INDEX_TYPE from the 16-byte record at `attribute_base + attribute_index * 16`, read when the packet runs. The record layout (address low, address high, size, type) is PAL's [`IndexAttribIndirect`](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9Chip.h#L60-L67) and the packet is the one [`BuildIndexAttributesIndirect`](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9CmdUtil.cpp#L2586-L2613) writes. The console's `sceAgcDcbSetIndexIndirectArgs` writes this packet, with `indirect_mode` 0, the attribute base in the address dwords and the attribute index in bits 0-15 ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L172-L174) by the prosper console oracle); the record layout is not measured on a PS5, and neither is seen in a title. `indirect_mode` 1 (`addr_offset`, which only PAL's ExecuteIndirect path emits) throws, and so does a record whose index type is above 3, as INDEX_TYPE does.
+- [Indexed indirect draws without an index limit](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, opcodes 0x25 and 0x38) - on a queue that has received neither INDEX_BUFFER_SIZE (0x13) nor INDEX_ATTRIBUTES_INDIRECT (0x91) since its last reset, the draw has no index limit: it takes the CPU record path ([IndirectDraw.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp)), and [Draw.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp) reads each record's firstIndex and indexCount range as written, without clamping, and refuses a range that overflows or is not readable. An INDEX_BUFFER_SIZE of 0 that was written still throws. The console's initial INDEX_BUFFER_SIZE and whether DRAW_INDEX_2 or DRAW_INDEX_OFFSET_2 MAX_SIZE changes it are not measured. The suspend-point queue reset also clears a written size. PPSA08338 issues DRAW_INDEX_INDIRECT_MULTI this way without ever emitting either packet.
 - [16-bit RGBA color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) support the standard and the alternate (`COMP_SWAP` 1) component order. Alternate swaps red and blue in shader exports, write masks and constant-color blend factors, following `ac_translate_colorswap` in [Mesa 26.2.2 ac_formats.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/common/ac_formats.c). Blending into the reverse orders (`COMP_SWAP` 2 and 3) is covered by the reversed-order blending entry, and simultaneous targets requiring conflicting blend constants throw. Console equivalence has not been measured on hardware.
 - [UINT16_ABGR color exports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - export format 7 is accepted only into an unsigned integer target, and each 16-bit value reaches the target unchanged; a value beyond a narrower target's range (`R8_UINT`) is undefined in Vulkan, and whether the console clamps or truncates it is not confirmed. SINT16_ABGR (8) throws
 - [Layered color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - 3D color targets with 64 KiB render-target or 4 KiB standard tiling render several slices, and so does a `CB_COLOR_VIEW` slice range on a 2D array target through the array's resident image, or on a surface of one slice as an array of the view's last slice + 1 slices, one slice pitch apart: a layered draw into an array without its resident image, a layered draw with a depth target, and color targets of different slice counts throw. The vertex layer export (`PA_CL_VS_OUT_CNTL` USE_VTX_RENDER_TARGET_INDX) reaches the shader only for a layered draw and is otherwise ignored, as before; a layer beyond the view's last slice is undefined in Vulkan, while the console's handling (clamping to `SLICE_MAX`) is not modeled, and a view whose last slice lies past the surface is clamped to its last slice. DCC keys of a 3D color target are taken as one key per 256 bytes over the whole surface, every slice included, and only uniform keys (all uncompressed, or one fast-clear code) are interpreted, as for 2D targets; mixed keys leave the stored texels as they are. The console's DCC key layout for 3D surfaces is not checked (LEGO Horizon Adventures' (PPSA14632) lighting volumes are DCC)
@@ -196,7 +225,7 @@
 - [Packed 16-bit textures](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp) (libSceAgcDriver) - `5_6_5`, `1_5_5_5` and `4_4_4_4` are viewed as R5G6B5, A1R5G5B5 and B4G4R4A4 (the 4-bit format every Vulkan device can sample; R4G4B4A4 is optional and lavapipe lacks it) with a swizzle that reads X from the low bits, and a DST_SEL of the missing W of `5_6_5` reads X. Measured on RDNA2 (gfx1035), not on the console: through `image_load` and `image_sample_lz`, X, Y, Z (and W of `1_5_5_5` and `4_4_4_4`) come from the low, middle and high fields, and W of `5_6_5` returns X (the low 5 bits), not 1. Storage images use compatible R16_UINT views with the [buffer UNORM store conversion](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp); quantization uses nearest even and maps NaN to zero. Rounding ties and NaN handling for packed stores have not been checked on AMD or PS5 hardware.
 - [Min/max S# reduction](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) - `FILTER_MODE` 1 and 2 use Vulkan's min and max reduction (the same `SQ_IMG_FILTER_MODE` values RADV programs). Measured on RDNA2 (gfx1035), not on the console: only texels of non-zero weight are reduced, and the weight is taken after rounding to the 8-bit subtexel grid (a sample within 1/512 texel of a centre reduces that texel alone); a driver with other `subTexelPrecisionBits` reduces a different set there. Gathers ignore the mode.
 - [Min/max S#](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver, shader recompiler) - throws with a linear mip filter, depth or color-texture compare, or bilinear or anisotropic filtering of an image the recompiler point-samples (sint, converted, depth-bits). With anisotropy the host sampler reduces over its own footprint; [RADV](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/amd/vulkan/radv_sampler.c#L185-L232) programs the same S# for such a Vulkan sampler. Measured on RDNA2 (gfx1030 in [#5156](https://github.com/boykopovar/AnyPS5/pull/5156#issuecomment-6155265616), gfx1035 in #5821), not on the console: without derivatives (`image_sample_lz`), min or max with anisotropic bilinear returns the bilinear minimum or maximum and with anisotropic point the point result, at every ratio field 0 to 4; with derivatives (`image_sample_d`, a 4:1 footprint), anisotropic bilinear at ratio field 2 or 4 reduces over the texels of all its anisotropic taps (the minimum or maximum along the major axis), not one bilinear footprint. A host that is not AMD reduces over its own anisotropic footprint, and Vulkan leaves nearest filtering with anisotropy to the host driver.
-- [FORCE_DEGAMMA](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Sampler.cpp) (libSceAgcDriver) - not measured on the console. A sampler that forces sRGB decoding throws for an SNORM `8`, `8_8` or `8_8_8_8` texture, which RDNA2 (gfx1031) reads bit for bit as the sRGB format of the same bytes, and for a format not measured on RDNA2. The rest follows gfx1035 and gfx1031 (point and bilinear): sRGB textures sample as without the bit, as in shadPS4 (PS4); UNORM `8`, `8_8`, `8_8_8_8`, BC1, BC2, BC3 and BC7 sample through their sRGB view (decoded before filtering); `16`, `16_16` and `16_16_16_16` UNORM, SNORM and FLOAT, `32`, `32_32` and `32_32_32_32` FLOAT, `10_11_11`, `2_10_10_10`, `5_9_9_9`, `5_6_5`, `1_5_5_5`, `4_4_4_4`, BC4, BC5 and BC6H sample as without the bit, as gfx1031 does.
+- [FORCE_DEGAMMA](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Sampler.cpp) (libSceAgcDriver) - not measured on the console. A sampler that forces sRGB decoding throws for a format not measured on RDNA2. The rest follows gfx1035 and gfx1031 (point and bilinear): sRGB textures sample as without the bit, as in shadPS4 (PS4); UNORM `8`, `8_8`, `8_8_8_8`, BC1, BC2, BC3 and BC7 sample through their sRGB view (decoded before filtering), and SNORM `8`, `8_8` and `8_8_8_8` through the sRGB view of their bytes, as gfx1031 reads them; `16`, `16_16` and `16_16_16_16` UNORM, SNORM and FLOAT, `32`, `32_32` and `32_32_32_32` FLOAT, `10_11_11` FLOAT, `2_10_10_10` UNORM, `5_9_9_9`, `5_6_5`, `1_5_5_5`, `4_4_4_4`, BC4, BC5 and BC6H sample as without the bit, as gfx1031 does.
 - [Tessellation factor ring](../../../core/libs/prx/libSceAgcDriver/State/src/Configuration.cpp) (libSceAgcDriver) - `sceAgcDriverSetTFRing` records the ring and `sceAgcDriverGetTFRing` reports it. Before a title sets one, it reports the console's default, 0xFF0000000 and 128 KiB, as measured in [PS5_Vulkan's hardware findings](https://github.com/mihawk-99/PS5_Vulkan/blob/fde9e3798c2ec1d8fccc90d5067cd6060490607f/docs/HARDWARE_FINDINGS.md). Nothing is written to the recorded ring: tessellated draws run as Vulkan tessellation stages, which keep their factors on the host, so a title that reads tessellation factors from the ring finds none. A null base or a zero size throws; [ps5-opengl's AGC runtime](https://github.com/blackbearreloaded/ps5-opengl/blob/67c873f985eaefe0a72f713529e5632eaa01139c/src/platform/ps5_agc_native_runtime.c) calls `sceAgcDriverSetTFRing(0, 0)` in its cleanup, and what that does on the console is unknown.
 - [VertexBufferReadSize](../../../core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp) and the [vertex staging copy](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - a vertex fetch whose index is at or past the descriptor's `num_records` no longer throws for `OOB_SELECT` 0 and 1. The copy still spans the whole fetch, but the bytes from `num_records * stride` onward read as zeros, so the out-of-range vertex is `(0, 0, 0, 0)`. Measured with `buffer_load_format_xyzw` (`idxen`) through the [hardware oracle](../HW_ORACLE.md) on RDNA2 gfx1036 for PPSA01325's word 3 `0x0004dfac` (`OOB_SELECT` 0) in #2241: indices 3, 4 and 5 over 3 records each return `00000000 00000000 00000000 00000000`, W included, unlike Vulkan `robustBufferAccess`, which returns `(0, 0, 0, 1)`. The zeros come from the record check, not from memory: stored values placed past the records are ignored, and a `num_records` 6 control returns them. `RESOURCE_LEVEL` 1, `OOB_SELECT` 1 and FORMAT 74 `32_32_32_FLOAT` give the same zeros, in wave32 and wave64; gfx1013 (the console) is not measured. `OOB_SELECT` 2 returns the stored values past the records and `OOB_SELECT` 3 compares `num_records` against the byte offset, both measured on the same setup in #2241; the two keep throwing past `num_records` here, since each needs its own rule. Zero-stride descriptors (`stride` 0) keep their separate byte-count check and are not covered here. Each out-of-range fetch is copied alone and outside the draw-snapshot cache, which is neither read nor written for it: a reused snapshot would carry another draw's bytes into the zero region, and a stored zero-padded copy would hand zeros to a later in-range draw at the same address. The valid prefix is still flushed for GPU writes before it is read.
 - [Draw snapshot buffer descriptors](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) rewrite each affected array from element zero, preserving unchanged descriptors. MoltenVK 1.4.2 writes auxiliary buffer lengths at index `i` instead of `start + i` for partial array updates ([MVKDescriptorSet.mm, BufferAuxSize](https://github.com/KhronosGroup/MoltenVK/blob/v1.4.2/MoltenVK/MoltenVK/GPUObjects/MVKDescriptorSet.mm#L1051)). Per-element writes therefore let one buffer length replace another even when Vulkan buffer handles and ranges are correct.
@@ -210,16 +239,17 @@
 - An [image table](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) whose record range overlaps a buffer or storage image written by its own dispatch faults (`table written by its dispatch`) when any entry is selected, even if the write misses the selected record. A selected column's range is its record and the bytes of the record before the descriptor.
 - An [image table](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) T# whose surface has no mapped byte faults when selected instead of becoming a zero texture as a direct T# does; what the console returns for it is not measured.
 - [User-data callees](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (libSceAgcDriver) - a compute shader's `s_swappc_b64` whose source pair is a user-data pair, or a copy of one made with `s_mov_b32` or `s_mov_b64` in the same block, calls the code at the address that user data holds. At dispatch the callee is read from guest memory up to its `s_setpc_b64` on the link pair, one copy of it is appended per call after the caller's last instruction, and the call is rewritten to `s_call_b64` to that copy. The words after the caller's last instruction are dropped from the recompiled code; in the shaders seen they are metadata or constants the caller reads relative to its program counter, and those reads go to the captured guest code, which linking does not change. A caller that jumps through a table among those words, which the control flow analysis reads from the recompiled code, throws. A copy runs at another program counter than the callee, so a callee that reads its program counter, makes a call, ends the program, jumps through another pair, returns before code it branches to, spans more than 64 KiB or is not readable throws. Callees are read again whenever a dispatch misses the dispatch cache; a dispatch that hits it reuses the linked program, so a title that rewrote a callee in place at the same address would keep running the old code.
-- [Table callees](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (libSceAgcDriver) - a compute shader's `s_swappc_b64` whose source pair is two consecutive dwords of an `s_buffer_load_dword*`, or a copy of them made with `s_mov_b32` or `s_mov_b64` in the same block (a conditional branch forward past the call between them is crossed), calls one of the targets that buffer holds when the load's buffer descriptor comes from an `s_load_dwordx4` without SOFFSET from a user-data pointer, or from a pointer pair that two `s_mov_b32` of a literal or inline constant set, and the load's SOFFSET from an `s_lshl_b32` by 2 to 24 bits. The descriptor load may be in an earlier block, such as before a per-lane loop around the call, when it is the only write of the descriptor registers that reaches the buffer load on every path back from it, and no `s_call_b64` or statically resolved call lies on those paths; the paths may run through any `s_swappc_b64` that is not resolved statically, the table call itself included, whose callee is assumed to keep the descriptor registers. The chain compares the target each iteration actually loads, so a callee that changes them can only make a later target miss the chain and fault as an unlinked call. Paths follow fall-through, direct branches and the `s_setpc_b64` jumps whose target the control flow analysis resolves. A path that reaches, before a write of the descriptor registers, the program's first instruction, the entry of an in-program function (an `s_call_b64` target, whose callers are not followed), or an instruction that nothing modelled jumps or falls into fails the search. At dispatch the descriptor and the buffer are read from guest memory, and every non-zero 64-bit value at the loaded offset plus a multiple of the shift's stride, below the descriptor's size (stride times num_records, or num_records bytes with stride 0), is read as a user-data callee and appended once per call. The call becomes a branch to a chain that compares the source pair with each target (`s_cmp_lg_u32` with a literal and `s_cbranch_scc1` per dword) and `s_call_b64`s the copy that matches; no match runs the original `s_swappc_b64` as an unlinked call. There is one chain for each value SCC has at the call, and the chain sets SCC back to that value (`s_cmp_eq_u32 0, 0` or `s_cmp_lg_u32 0, 0`) before the callee or the unlinked call runs. The searched range is the descriptor's whole size, which covers the range the load can reach whether it is checked in bytes or in strides; which one the PS5 uses for `s_buffer_load` was not measured. More than 64 distinct targets, a buffer above 64 MiB or a copy out of `s_call_b64` range throws. As with user-data callees, the buffer is read again only when a dispatch misses the dispatch cache, so a target a title adds to the buffer later is an unlinked call when a cached program runs.
+- [Table callees](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (libSceAgcDriver) - a compute shader's `s_swappc_b64` whose source pair is two consecutive dwords of an `s_buffer_load_dword*`, or a copy of them made with `s_mov_b32` or `s_mov_b64` in the same block (a conditional branch forward past the call between them is crossed), calls one of the targets that buffer holds when the load's buffer descriptor comes from an `s_load_dwordx4`, or a 4-dword-aligned slice of an `s_load_dwordx8` or `s_load_dwordx16`, without SOFFSET from a user-data pointer, or from a pointer pair that two `s_mov_b32` of a literal or inline constant set, and the load's SOFFSET from an `s_lshl_b32` by 2 to 24 bits. The descriptor load may be in an earlier block, such as before a per-lane loop around the call, when it is the only write of the descriptor registers that reaches the buffer load on every path back from it, and no `s_call_b64` or statically resolved call lies on those paths; the paths may run through any `s_swappc_b64` that is not resolved statically, the table call itself included, whose callee is assumed to keep the descriptor registers. The chain compares the target each iteration actually loads, so a callee that changes them can only make a later target miss the chain and fault as an unlinked call. Paths follow fall-through, direct branches and the `s_setpc_b64` jumps whose target the control flow analysis resolves. A path that reaches, before a write of the descriptor registers, the program's first instruction, the entry of an in-program function (an `s_call_b64` target, whose callers are not followed), or an instruction that nothing modelled jumps or falls into fails the search. At dispatch the descriptor and the buffer are read from guest memory, and every non-zero 64-bit value at the loaded offset plus a multiple of the shift's stride, below the descriptor's size (stride times num_records, or num_records bytes with stride 0), is read as a user-data callee and appended once per call. The call becomes a branch to a chain that compares the source pair with each target (`s_cmp_lg_u32` with a literal and `s_cbranch_scc1` per dword) and `s_call_b64`s the copy that matches; no match runs the original `s_swappc_b64` as an unlinked call. There is one chain for each value SCC has at the call, and the chain sets SCC back to that value (`s_cmp_eq_u32 0, 0` or `s_cmp_lg_u32 0, 0`) before the callee or the unlinked call runs. Each copy follows its own compares and call, so no branch spans more than one copy. A later call's branch to its chain and its return cross earlier calls' copies through a pair of `s_branch` relays before the first of those copies and after each one, so they don't span more than one copy either. The searched range is the descriptor's whole size, which covers the range the load can reach whether it is checked in bytes or in strides; which one the PS5 uses for `s_buffer_load` was not measured. More than 64 distinct targets, a buffer above 64 MiB, or a call more than 0x7fff dwords before the end of the program and its user-data callees throws. As with user-data callees, the buffer is read again only when a dispatch misses the dispatch cache, so a target a title adds to the buffer later is an unlinked call when a cached program runs.
 - [AGC FS table](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp) (libSceAgcDriver) - the driver maps 2 MiB at 0xF_E0000000 when it is created and fills the table that libSceAgc keeps at 0xF_E0040000 (six 16-byte V# slots, slot 0 describing eight 16-byte records) the way PS5 12.00 libSceAgcDriver and libSceAgc do, but every record points at one AnyPS5 routine that only returns (`s_setpc_b64` on the link pair). Sony's routines, which order work before a title's `ds_ordered_count`, are not modeled.
 - [DB_RENDER_CONTROL resummarize draws](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - HTILE is not modeled, so a RESUMMARIZE_ENABLE draw without depth or stencil tests and without color writes changes no modeled state and draws nothing. A pure resummarize with pass-through D16/D32 depth, no depth writes or bounds test, no stencil plane, no color writes and no running pixel stage also draws nothing; other resummarize, copy or decompress draws throw.
 - [Comparison-sampled R32 float and R16 unorm textures](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) whose surface a storage image holds are sampled from a D32_SFLOAT or D16_UNORM image that the GPU refills from the storage image whenever its version moves, because Vulkan compares only depth formats. Only surfaces of at least 1 MiB (`APS5_DEPTH_COPY_MIN_KIB`) that are not 3D take the copy; smaller ones stay CPU snapshots compared against guest memory. With copies of small surfaces, one title hit an intermittent boot-time crash that was not explained.
 - [Null vertex buffer V#](../../../core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp) (libSceAgcDriver) - a V# whose four dwords are all zero is bound to a zeroed vertex buffer of the attribute's size with stride 0, so every component of its attribute reads 0. This follows the V# fields in the [AMD RDNA2 ISA](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf) (`NUM_RECORDS` 0, `DST_SEL` 0 selects 0), not measured on hardware.
-- [Descriptor pool recycling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) avoids individually freed sets: [RADV 26.2.2](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/vulkan/radv_descriptor_pool.c) initializes its free-set heap with 32 bytes beyond the backing allocation. An allocation-only RX 6600 test reproduces acceptance of a 4,128-byte set in a 4,096-byte pool; the path without individual frees rejects it. Pools reset after their last set is released. A cached set can retain unused slots in an exhausted pool until eviction; peak gameplay pool memory remains unmeasured.
+- [Descriptor pool recycling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) frees sets individually only on lavapipe: [RADV 26.2.2](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/vulkan/radv_descriptor_pool.c) initializes its free-set heap with 32 bytes beyond the backing allocation. An allocation-only RX 6600 test reproduces acceptance of a 4,128-byte set in a 4,096-byte pool; the reset-only path rejects it. Pools reset after their last set is released. A cached set can retain unused slots in an exhausted pool until eviction; peak gameplay pool memory remains unmeasured.
 - [16-bit depth with stencil](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) is stored as `D24_UNORM_S8_UINT`, or `D32_SFLOAT_S8_UINT`, on a device without `D16_UNORM_S8_UINT` as an attachment. Depth comparisons, clears and the depth image see the wider format's precision, so results at the 16-bit quantization boundary can differ from the console; the constant depth bias is scaled by 256 for D24, and a non-zero constant on the D32 float fallback throws. Not measured on console hardware.
 - [Depth surfaces created over storage writes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a depth surface created without HTILE copies its depth plane from the storage image at the plane's address, a pending one first, when that image has the plane's extent, one level, a 2D view or a 2D array view (its layer 0 is copied) and a 16-bit format for a 16-bit plane or a 32-bit format for a 32-bit plane. A multisampled surface, a surface the device stores in another format, a surface with HTILE and a surface without such an image start from `DB_DEPTH_CLEAR`, and the stencil plane from `DB_STENCIL_CLEAR`; CPU writes to the plane's memory are not read. Not measured on the console, where the plane is that memory.
 - [Flip packets raise the graphics end-of-pipe event](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp) (libSceAgcDriver) - a flip delivers the queue's end-of-pipe event (`sceAgcDriverAddEqEvent`) once the work recorded before it completes, as a `RELEASE_MEM` with `INT_SEL` does, but only on a queue that has never delivered an interrupt from such a release: the queue is latched the first time a release interrupt reaches the event queue, and flips on that queue deliver nothing while its own release interrupts keep arriving. The latch is cleared when the queue has flipped five times without another interrupt from its own releases: the fifth flip delivers the event and unlatched the queue, so a title that waits on the flip event after latching recovers only if it submits further flips. The bound cannot be by time: the next release interrupt can arrive seconds later than a suppressed flip across loading stalls, and delivering an unexpected flip event on a queue that pairs flips with releases can crash; no fixed window short enough to unblock a waiting title keeps such a title alive. Whether the console raises the event from the flip itself or from an interrupt its flip sequence contains is not measured; nor is how the console behaves for a title that waits on the flip event and also raises release interrupts on the same queue.
-- [Host import windows and budget](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): a registered range larger than 64 MiB is imported one 64 MiB window at a time for buffer and fill accesses; an access across window edges imports the cells it touches, grown to the union of the range's imports it overlaps. An address-based build (`AcquireRegistered`) imports the range whole and replaces its windows. Live imports stay under a budget: `APS5_HOST_IMPORT_MIB`, else the larger of 6 GiB and half the physical memory, at most the largest host heap less the larger of 2 GiB and half that heap (imports, type-3 mirrors and buffers and textures placed in host memory share it; on a 16 GiB machine whose host heap is half the memory, a 2 GiB reserve left too little for the rest). Where the device enables `VK_EXT_memory_budget`, that host heap's reported budget less its other usage and an eighth, in 64 MiB steps, read at most once a second, also bounds the default budget once an import's `vkAllocateMemory` has failed; a set `APS5_HOST_IMPORT_MIB` is never lowered by the report. The report's other usage includes the host-visible copies and heap mirrors that stand in for refused imports, so it grows with the refusals; the first time the report would lower the budget, `[gpu] host import budget: host heap ...` prints the heap's reported budget and usage and the live imports. An import's `vkAllocateMemory` failure within an eighth of the budget, or the third in a row, lowers the budget to the live imports until the device or the configured budget changes; an isolated failure further below only marks its range failed. Live imports are not capped by `maxMemoryAllocationCount`: NVIDIA's Windows driver reports 4096, while Village held 27,167 live imports without a failure. A new import beyond it retires the least recently used imports not used in the last 256 lookups; one that would not fit even then is refused before anything is retired, and imports made when a range is mapped never evict. A heap mirror, sparse or not, whose range has left the write watch is refreshed in full at each use, every block counted as written; a build plans its range again only once the import path takes the range. A request that may not evict (an address-based build, an import when a range is mapped) remembers a refused range or block, with the live bytes and the budget at the refusal, and is answered from that memory, still counted as refused, until live imports drop below those bytes, the budget changes or one of its ranges changes. A request that may evict remembers its refusal too, answering later requests for the same run from memory with the room the refusal left (a request whose range fits in that room steps down to a smaller block without scanning the imports again, and a refusal that stepped down is remembered for each block it tried), while no import was made or retired, the budget has not grown, the import window and the run are unchanged, and no import can have become evictable since: the use count stays below the first use at which an import that was neither evictable nor held could leave the 256-lookup protection, and either the build floor has not risen or no held import could leave it yet. A join remembers its refusal the same way, apart from other requests for the same run, so a buffer bound across refused ranges does not try the join again at every upload. The shutdown line `[gpu] host imports at shutdown` gives the live, made, refused (and remembered) and failed counts per requester. The 64 MiB window, the 256-lookup protection, the 2 GiB reserve, the eighth, the 64 MiB steps and the three failures are choices, not measured.
+- [Host import windows and budget](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): a registered range larger than 64 MiB is imported one 64 MiB window at a time for buffer and fill accesses; an access across window edges imports the cells it touches, grown to the union of the range's imports it overlaps. An address-based build (`AcquireRegistered`) imports the range whole and replaces its windows. Live imports stay under a budget: `APS5_HOST_IMPORT_MIB`, else the larger of 6 GiB and half the physical memory, at most the largest host heap less the larger of 2 GiB and half that heap (imports, type-3 mirrors and buffers and textures placed in host memory share it; on a 16 GiB machine whose host heap is half the memory, a 2 GiB reserve left too little for the rest). Where the device enables `VK_EXT_memory_budget`, that host heap's reported budget less its other usage and an eighth, in 64 MiB steps, read at most once a second, also bounds the default budget once an import's `vkAllocateMemory` has failed; a set `APS5_HOST_IMPORT_MIB` is never lowered by the report. The report's other usage includes the host-visible copies and heap mirrors that stand in for refused imports, so it grows with the refusals; the first time the report would lower the budget, `[gpu] host import budget: host heap ...` prints the heap's reported budget and usage and the live imports. An import's `vkAllocateMemory` failure within an eighth of the budget, or the third in a row, lowers the budget to the live imports until the device or the configured budget changes; an isolated failure further below only marks its range failed. Live imports are not capped by `maxMemoryAllocationCount`: NVIDIA's Windows driver reports 4096, while Village held 27,167 live imports without a failure. A new import beyond it retires the least recently used imports not used in the last 256 lookups; one that would not fit even then is refused before anything is retired, and imports made when a range is mapped never evict. An address-based build does not evict either, except for a range the budget refused (or remembers refusing) and no mirror serves whose copy would take the build's copies past `APS5_ADDRESS_COPY_MAX_MIB`. A heap mirror, sparse or not, whose range has left the write watch is refreshed in full at each use, every block counted as written; a build plans its range again only once the import path takes the range. A request that may not evict (an address-based build, an import when a range is mapped) remembers a refused range or block, with the live bytes and the budget at the refusal, and is answered from that memory, still counted as refused, until live imports drop below those bytes, the budget changes or one of its ranges changes. A request that may evict remembers its refusal too, answering later requests for the same run from memory with the room the refusal left (a request whose range fits in that room steps down to a smaller block without scanning the imports again, and a refusal that stepped down is remembered for each block it tried), while no import was made or retired, the budget has not grown, the import window and the run are unchanged, and no import can have become evictable since: the use count stays below the first use at which an import that was neither evictable nor held could leave the 256-lookup protection, and either the build floor has not risen or no held import could leave it yet. A join remembers its refusal the same way, apart from other requests for the same run, so a buffer bound across refused ranges does not try the join again at every upload. The shutdown line `[gpu] host imports at shutdown` gives the live, made, refused (and remembered) and failed counts per requester. The 64 MiB window, the 256-lookup protection, the 2 GiB reserve, the eighth, the 64 MiB steps and the three failures are choices, not measured.
+- [Piece-split ranges over the host import budget](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): an address-based build imports a registered range larger than the device's largest allocation in pieces. If the budget refuses a piece, the range is mirrored or copied without the evicting retry other refused ranges get when their copy would pass `APS5_ADDRESS_COPY_MAX_MIB`, so such a copy can still exceed that cap and end the build.
 - [Device-local staging](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) - a written or atomic buffer element inside a host import, including one an address-based compute build reaches through its pointers, is copied to device memory before the dispatch and copied back whole after it, so a CPU store into that range in between is rolled back.
 - [Periodic pipeline cache saves skip busy intervals](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp) (libSceAgcDriver) - the saver thread snapshots the Vulkan pipeline cache only when no pipeline creation holds it (`TryLockForSnapshot`); otherwise it skips that 10 s interval. A blocking snapshot queued behind a long creation (an NVIDIA compile of a 1.5M-word compute pipeline runs for minutes) makes the writer-preferring `shared_mutex` hold every later pipeline creation on every queue until that compile ends, which froze Yōtei's (PPSA26344) loading at frame 797-799 for the whole compile. While creations overlap without a gap, no periodic save happens, so a crash in that stretch loses the pipelines built since the last save; `SaveNow` and the teardown save still wait for the lock. How often busy stretches skip saves in practice is not measured.
 - [Registration preparation at submit](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) (libSceAgcDriver) - `Driver::Submit` waits for every registration-time shader preparation queued before the call, not only those of the shaders the commands use, so a submission behind a long queue of unrelated preparations waits for all of them on the submitting thread. Waiting there instead of in the queue worker keeps the GPU side of a submission short: a title that sees a submission take seconds treats the GPU as hung (Goat Simulator 3, PPSA04159, then stops submitting and its garbage collector fails a 10 s timeout). On the console shaders are compiled ahead of time, so neither wait exists; how long a title tolerates a slow submit call is not known.
@@ -234,7 +264,7 @@
 - [Viewport depth range remap](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - on a device without `VK_EXT_depth_range_unrestricted` a viewport depth range outside [0, 1] (Minecraft PPSA17221 draws its world with `PA_CL_VPORT_ZSCALE` 1, `ZOFFSET` 0 in negative-one-to-one clip space) is folded into the vertex shader: `RemapPositionDepth` scales clip z so z/w is the console's depth, the pipeline's depth clamp applies the console's `PA_SC_VPORT_ZMIN/ZMAX` clipped to [0, 1] (exact for a normalized depth target or none; Minecraft clamps its float depth target to [-1, 1], so a depth below 0 is stored as 0 there, which only a later test or read at exactly 0 can tell, and the first such draw is reported once), and two extra `gl_ClipDistance` elements restore the near and far planes depth clamping removes. The mode is a pipeline specialization constant (`PipelineSpecialization::DepthRemapBase`); scale and offset are read from the draw's push block (two words at byte 104, `DepthRemapPushOffsetBytes`, so a remapped draw's stage push data ends before it), so draws that differ only in them share one vertex module and one pipeline. The remap serves the vertex path only; mesh and tessellation draws with such a range still throw. Whether the console clamps before or after its depth bias and how it treats a clamp range narrower than the transform's are not measured.
 - [Benchmark rewrite failure test off Windows](../../../core/libs/prx/libSceAgcDriver/tests/PerformanceTrace.cpp) (libSceAgcDriver) - `ReplaceGzipFile` checks that a write failing at `<name>.tmp` keeps the previous `aps5-bench.json.gz` only on non-Windows builds: the `std::ios_base::failure` thrown inside the MinGW ofstream did not unwind to the test's catch, so Windows CI covers only the failed move.
 
-- [Sampled array windows](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp) (libSceAgcDriver) - a sampled 2D array, 1D array or cube view whose base array slice is past 0 is built from its viewed slices only (`ViewedArrayWindow`), at the guest address of its base slice. The window is taken only when the surface is thin, has no DCC metadata, and, for a 64 KiB XOR swizzle, when the base slice keeps every slice bit of the swizzle equation at zero (R_X 1-byte elements: a base slice that is a multiple of 16). Any other view still builds slices 0 to its last slice. A window and a whole-array view of the same surface are separate images over overlapping memory, kept coherent by the existing overlap rules, at the cost of the memory and uploads of both. PPSA26344 samples a 256x256 cube array at slices 4299..7232, built at 1467 MiB instead of about 3.8 GB.
+- [Sampled array windows](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureTiling.cpp) (libSceAgcDriver) - a sampled 2D array, 1D array or cube view past slice 0 is built from its viewed slices only (`ViewedArrayWindow`). The window needs a thin surface without DCC metadata, or with keys that resolve over the whole surface to Uncompressed (the window then drops the metadata; keys are rescanned at each lookup). For a 64 KiB XOR swizzle it starts at the last slice at or before the base whose swizzle slice bits are zero (R_X 1-byte and Z_X 4-byte: a multiple of 16); when that is slice 0 the view builds slices 0 to its last slice. A window and a whole-array view of the same surface are separate images over overlapping memory, kept coherent by the existing overlap rules, at the cost of both. PPSA26344 samples a cube array at slices 4299..7232 at 1467 MiB instead of about 3.8 GB; PPSA01341 samples slice 636 of a DCC 2D array at 52 MiB instead of 2.5 GiB.
 - [2D reads of 2D arrays](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - a sampled image whose shader shape is 2D and whose T# is a 2D array is built from its base slice alone: the T# is narrowed to that slice (`FirstLayerDescriptor`) before its decode, cache key and image, in stage A records, stage B bindings, revalidation and image tables. A whole-array read of the same T# keeps its own cache entry, so both images exist when a title uses both. Storage images read or written through a 2D shape are not narrowed and still build every slice the T# names. PPSA26344 reads a 3328x1872 R_X T# of 1537 slices this way: the whole array was a 12.4 GiB image that did not fit the device-local budget of an RTX 4090.
 - [Sampled and storage views of 1 GiB or more](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) that stay whole are only logged (sampled views by `cachedTexture`, storage views by `cachedStorageTexture`), with the registered guest range holding their base and how many of their slices fit in it; nothing is capped to that range. PPSA26344 samples a 1467 MiB cube array window of which only 838 of 2934 slices lie inside its 3380 MiB range: the rest is read from whatever follows the range. Whether such slices are ever sampled is not measured.
 - [Color export type against the target format](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - the export-format check refuses a `UINT16_ABGR` export (`SPI_SHADER_COL_FORMAT` 7) into a target whose color-buffer number format is not unsigned integer, but not the reverse. A 32-bit export (`32_R`, `32_GR`, `32_AR` or `32_ABGR`) into an unsigned-integer target leaves `uintExport` clear, so the recompiler declares the fragment output `float4`; `DecodeColorBuffer` maps a number format of 4 to `R32_UINT` from the color buffer alone, independent of the export format, so the float output reaches an integer attachment. Desktop drivers keep the raw bits, but the Khronos validation layer reports `Undefined-Value-ShaderFragmentOutputMismatch` and MoltenVK's Metal compiler refuses the pipeline. Which export format a title pairs with a 32-bit integer target is not measured, so the output type is left following the export format rather than the attachment.
@@ -242,6 +272,7 @@
 
 - [Long Windows pipeline-cache paths](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp): `readHeader` and the failed-read existence check still use ordinary paths. A filename beyond MAX_PATH can prevent header reuse or be reported missing; the shared content reader and journal normalization do not cover these calls.
 - [DB_RENDER_CONTROL.STENCIL_CLEAR_ENABLE without a stencil plane](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): a stencil clear on a depth target whose `DB_STENCIL_INFO` format is `STENCIL_INVALID` is dropped; the depth clear and color writes proceed. AMD PAL ([`gfx9RsrcProcMgr.cpp`](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32/src/core/hw/gfxip/rpm/gfx9/gfx9RsrcProcMgr.cpp)) and radeonsi (`si_clear.c`) never set the bit without a stencil plane, and shadPS4 drops it the same way (`vk_rasterizer.cpp`, `StencilValid`). No source states what the hardware does with the bit then; the console was not measured. A read-only stencil plane still throws
+- [Swept write-only staging](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver): on a discrete GPU a write-only element whose V# stride is wider than the widest buffer store (16 bytes) and that a direct dispatch sweeps is staged in a device-local shadow. The shadow still takes a copy-in, because the copy-back covers the whole element and the stores may leave part of each record unwritten. A sweep proven to write every byte of the element (from the offsets and widths of its stores within the record) could skip the copy-in, about 10 ms per frame in Diablo II: Resurrected; that proof is not made. Store widths are not recorded per instruction either, so a record of 16 bytes or less stays in place even when its stores are narrower.
 
 ### Opt-in draw paths
 
diff --git a/docs/dev/debt/libSceAgcVsh.md b/docs/dev/debt/libSceAgcVsh.md
new file mode 100644
index 0000000000..c2fb6a18d8
--- /dev/null
+++ b/docs/dev/debt/libSceAgcVsh.md
@@ -0,0 +1,5 @@
+# libSceAgcVsh technical debt
+
+### Unknown function info
+
+- The 150 declarations in [Export.cpp](../../../core/libs/prx/libSceAgcVsh/Export.cpp) are present in the PS5 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAgcVsh.c) and the local import-stub table. Their signatures and behavior are unverified; the parameterless declarations are for import resolution only and throw through NotImplemented_nid_no_patch.
diff --git a/docs/dev/debt/libSceAjm.native.md b/docs/dev/debt/libSceAjm.native.md
index 5fd76482c4..5c693e0f85 100644
--- a/docs/dev/debt/libSceAjm.native.md
+++ b/docs/dev/debt/libSceAjm.native.md
@@ -3,10 +3,10 @@
 ### Unknown function info
 
 - [sceAjmBatchGetLog, sceAjmInstanceAvailable](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjm.native) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAjm.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
-- [sceAjmInstanceExtend, sceAjmInstanceSwitch](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjm.native) - their signatures follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/ajm/ajm.h#L19-L20) and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ajm.cs#L100-L104), not measured on a console; these throwing declarations only resolve imports.
+- [sceAjmInstanceExtend, sceAjmInstanceSwitch](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjm.native) - their four-argument signatures come only from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ajm.cs#L98-L104), whose comments do not describe them; shadPS4 [declares both without parameters](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ajm/ajm.h#L222-L223). Neither is measured on a console; these throwing declarations only resolve imports.
 - [sceAjmInstanceCreate](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - a full 14-bit instance slot namespace returns `0x80930007` (`OUT_OF_RESOURCES`), as [shadPS4's InstanceCreate](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ajm/ajm_context.cpp) does for its own instance pool (PS4). The 16384 slots per codec prefix are this runtime's existing ID layout, not a measured console capacity; the PS5 capacity and exhaustion result are unverified.
 - [ATRAC9 vibration decoding](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native): channel configurations 6 (mono) and 7 (dual mono) use the pinned [vgmstream decoder](https://github.com/vgmstream/vgmstream/blob/7c520e8f9b078dfde2f84f1b5bcbad0c6c415806/src/coding/libs/atrac9_dec.c), including its 12/24/48 kHz profile limits. Synthetic fixtures cover interleaving, reset after malformed input, partial superframes and PCM16/PCM32/float output; console PCM rounding and physical haptic output are unverified. Ordinary channel configurations and discrete multichannel streams still use LibAtrac9. Decoder creation and decoding run under the existing AJM instance lock because the dependency rebuilds shared Huffman tables during initialization.
-- [sceAjmBatchJobGetInfo](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - writes the result and format sideband of a run job without buffers with the `SIDEBAND_FORMAT` flag (0x400000000000), as [KytyPS5](https://github.com/KytyPS5/KytyPS5) does, not confirmed on a PS5 title; the format reports bitrate 0 for ATRAC9 as in KytyPS5, while [shadPS4](https://github.com/shadps4-emu/shadPS4) derives it from the superframe size; before the instance is initialized it returns the not-initialized result (1) and no format, like the other run jobs here, while KytyPS5 returns result 0 with the format of the uninitialized decoder
+- [sceAjmBatchJobGetInfo](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - writes the result and format sideband of a run job without buffers with the `SIDEBAND_FORMAT` flag (0x400000000000), as [KytyPS5](https://github.com/KytyPS5/KytyPS5) does, not confirmed on a PS5 title; the ATRAC9 format's bitrate is the superframe's bits per second (superframe bytes * 8 * sample rate / samples per superframe), as [shadPS4](https://github.com/shadps4-emu/shadPS4) derives it and as a PS4 reported it (168000 for 448-byte superframes at 48 kHz), where KytyPS5 reports 0; before the instance is initialized it returns the not-initialized result (1) and no format, like the other run jobs here, while KytyPS5 returns result 0 with the format of the uninitialized decoder
 - [sceAjmDecMp3ParseFrame](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - signature, result layout and rate tables taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) reimplementation of the PS4 library, not confirmed on a PS5 title: Layer I/II headers are accepted when no original-file-length (`parse_ofl`) lookup is requested, which is supported only for Layer III; MPEG-2.5 stops at 64 kbps. The `parse_ofl` layout (Xing/Info + LAME tag after side information, with the standard fixed Xing/Info offset retained for encoders such as [LAME](https://github.com/lameproject/lame/blob/master/libmp3lame/VbrTag.c#L854-L862), VBRI at byte 36 or after side information, Fraunhofer `0xB4` block with its CRC, encoder delay = samples per frame + LAME delay + 529) also comes from shadPS4 only, and the Fraunhofer block has no other public description.
 - [sceAjmBatchJobGetCodecInfo, sceAjmBatchJobGetGaplessDecode](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - the `RUN_GET_CODEC_INFO` flag (0x800), the ATRAC9 codec info layout and its next frame size are taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) and [RPCSX](https://github.com/RPCSX/rpcsx) reimplementations, not confirmed on a PS5 title (the one call in PPSA04354 passes a 24-byte result buffer, the 8-byte result plus the 16-byte ATRAC9 codec info written here; the call does not show the codec or the fields); a run job without buffers returns result 0, as in shadPS4. The gapless sideband reports the total and skip counts the title set and does not count them down: RPCSX does the same, shadPS4 counts them down and BryKytyPS5 returns its current counts
 - [AJM Opus decoder](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native, codec 24) - the initialize parameter layout and little-endian `u16` packet byte count come from The Smurfs Dreams (`2, 48000, 0`) and Lost Soul Aside (`4, 48000, 1`). The third word is interpreted as the mapping family, as in [KytyPS5's initialize structure](https://github.com/KytyPS5/KytyPS5/blob/984cfcebd141b211aa9e0a8cde63b0ebe652d07a/src/libs/ajm/opus_decoder.h#L11-L15). Family 1 uses the conventional stream counts, coupled counts and channel map from [libopus 1.5.2's surround layout](https://github.com/xiph/opus/blob/v1.5.2/src/opus_multistream_encoder.c#L47-L55), passed to FFmpeg through an [RFC 7845 section 5.1](https://datatracker.ietf.org/doc/html/rfc7845#section-5.1) header with zero pre-skip and gain; gapless skipping remains controlled by AJM sideband parameters. FFmpeg returns PCM in its native speaker order. The implicit stream layout, PCM channel order and invalid family-0 channel count result are not verified on a console. NHL 27 (PPSA34063) passes `1, 48000, 255`. Family 255 with one channel is decoded as one mono stream, the same as family 0; this is assumed, since the stream count, coupled stream count and channel mapping that a family-255 Opus header carries ([RFC 7845 section 5.1.1](https://datatracker.ietf.org/doc/html/rfc7845#section-5.1.1)) are not passed. Only 48000 Hz, mapping families 0 and 1, and family 255 with one channel are implemented; other rates and families, and family 255 with more channels, throw
@@ -17,13 +17,20 @@
 - [sceAjmBatchJobControl](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - initialize parameters are 8 bytes for ATRAC9 and M4AAC, 12 for Opus and none for MP3, as one title passes them; other codecs and sizes, and an output other than the 8-byte result, throw
 - [sceAjmBatchJobControl](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - SIDEBAND_GAPLESS_DECODE with RESET overwrites both counts as in [RPCSX](https://github.com/RPCSX/rpcsx); shadPS4 ignores a zero count when the other is nonzero. Without RESET they differ, so it throws
 - [sceAjmBatchJobSetResampleParameters, sceAjmBatchJobGetResampleInfo](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm) - the ratio is taken as decoded samples per output sample and num_samples as the decoded samples the resampler holds, both inferred from FMOD (Hades II); the console's interpolation is unknown, a 4-point Catmull-Rom is used. The flags argument is ignored, as in shadPS4 and Kyty
+- [sceAjmBatchJobControlBufferRa, sceAjmBatchJobRunBufferRa, sceAjmBatchJobRunSplitBufferRa, sceAjmBatchStartBuffer](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm, PS4) - the batch layout (chunk kinds, 20-bit payload, flags bits 32-51 as the flags chunk's payload, the builders' chunk order) follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/854b291c63360ff24e590809aff54cf5ab2dd4c9/src/core/libraries/ajm/ajm_batch.cpp) and was confirmed byte for byte for 64-byte control and 80-byte run jobs by a PS4 trace of Knowledge is Power: Decades (CUSA12435, Wwise, 32 545 batches dumped by a GoldHEN plugin). The console's builders write only bits 0-3 (kind), bit 4 (a buffer chunk's output direction) and bits 6-25 (payload) of the header word and leave bits 5, 26, 27 and 31 as the previous batch left them, so the kind is read as 4 bits plus the direction bit, not as 6 bits
+- [sceAjmBatchStartBuffer](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm, PS4) - the statistics instance 0x80000 and the inline chunk come from shadPS4 only: the traced title builds every batch with the builders and a return address, and no title was seen writing an inline chunk. Flags are kept as passed. Unknown chunk kinds, control flags other than RESET, INITIALIZE and SIDEBAND_GAPLESS_DECODE, control jobs with run buffers and run jobs with a control input throw
+- [sceAjmBatchStartBuffer refusals](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm, PS4) - probe batches through the console's builders on a PS4 showed that a run buffer chunk of size zero is dropped whatever its address (the job runs as without it: 0x10 and nothing consumed for no room, 0 for no input), and that a null address with a nonzero size refuses the batch before any of its jobs runs, with 0x80930011 returned and the error record holding 0x80930016, the job chunk's address, the chunk's offset in the job and the job's return address. Control buffer chunks follow the same rule here, not measured. A size not a multiple of 8, a chunk that overruns its job or the batch, or a job without flags are refused the same way with 0x80930011 in the record; the console's report for those was not measured
+- [sceAjmBatchStartBuffer null and empty batches](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm, PS4) - a null batch address returns 0x80930005 whatever the size, as the PS5 builders' sceAjmBatchInitialize does for a null buffer, and a batch of zero bytes at a non-null address is accepted, runs nothing and completes at once (a null address with size 0 is refused like any null address); neither was measured on a console (the probe that passed a null batch froze the console before a result was written, so it is not retried on hardware)
+- [ATRAC9 run results](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - probe runs of a title's ATRAC9 stream through the console's builders on a PS4 showed the run result naming the side that ran out: `PARTIAL_INPUT` (0x8) when the input ran out with room left, on a superframe boundary or not; `NOT_ENOUGH_ROOM` (0x10) when the room ran out with input left, after any number of frames, and with nothing consumed for a zero room; both (0x18) when the input ended just as the output filled, which is every Wwise run job. ATRAC9 run jobs with `RUN_MULTIPLE_FRAMES` follow those rules here, vibration streams included, which were not traced; resampled runs and the other codecs keep the earlier rule (a trailing partial frame is partial input, a run that produced nothing is out of room)
+- [ATRAC9 run without RUN_MULTIPLE_FRAMES](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - the same PS4 probe decoded exactly one frame and reported 0 for such a run, and a job read from a PS4 batch buffer (sceAjmBatchStartBuffer) does the same here. A job from the PS5 builders still decodes its whole input, as FMOD in PPSA29141 needs (it puts two run jobs in one batch with the second's input right after the whole of the first's); whether a PS5 stops after one frame is not measured. MP3 and Opus run jobs stop after one frame on both paths. The console also rejected the tests' synthetic silent superframe after three frames (`CODEC_ERROR | FATAL`, internal result -577) where LibAtrac9 decodes four, so that vector proves job plumbing, not decoding; on the title's stream LibAtrac9 matched the console's PCM within 4 LSB, 83.5% of the samples exactly
 
 ### Functional
 
 - [sceAjmDecWVorbisCreateHeaderPacket](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjmWVorbis, implemented in libSceAjm.native) - refuses an output smaller than the whole packet (56 bytes plus the setup packet) with `0x8A6E0003`. The PS5 12.00 bit writer only checks that each write starts inside the buffer, so the console can accept a buffer a few bytes short and write past it
 - [AJM batch contexts](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native): start, wait and cancel reject context IDs not allocated by initialization; batches belong to their creating context, as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0ebea15c24253b60f514fc37a348dabc8d0bcb90/src/core/libraries/ajm/ajm.cpp). This is not verified on PS5. Finalization still does not invalidate contexts or release their instances and outstanding batches; jobs execute synchronously and cancellation does not interrupt them.
+- [sceAjmBatchStart](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp): console results for malformed batch descriptors and corrupted jobs are unverified. A null batch buffer or an offset beyond its capacity returns the existing invalid-parameter error; a truncated or inconsistent private packed job throws before its payload is read. The packed representation belongs to this implementation.
 
-- [ATRAC9 gapless segments](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - a run job stops after the gapless total of output samples counted from the start of the segment, leaving the rest of its input unconsumed, and the next run starts the next segment with the decoder as it is and without a second skip. FMOD in PPSA29141 sets a total shorter than a sound's frames and reads the frames after it on later runs; with the output held at the total its stream reader waited for them forever and the last buffer repeated. The console's handling of the frames after the total is not documented; a reset (`SetGaplessDecode` with the reset flag, `ClearContext`, initialization) starts a new segment. An ATRAC9 run job without `RUN_MULTIPLE_FRAMES` decodes its whole input as one with it: FMOD in PPSA29141 puts two run jobs in one batch with the second's input right after the whole of the first's. Whether the console stops after one frame there is not verified; MP3 and Opus run jobs still stop after one frame
+- [ATRAC9 gapless segments](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - a run job stops after the gapless total of output samples counted from the start of the segment, leaving the rest of its input unconsumed, and the next run starts the next segment with the decoder as it is and without a second skip. FMOD in PPSA29141 sets a total shorter than a sound's frames and reads the frames after it on later runs; with the output held at the total its stream reader waited for them forever and the last buffer repeated. The console's handling of the frames after the total is not documented; a reset (`SetGaplessDecode` with the reset flag, `ClearContext`, initialization) starts a new segment.
 - [AJM M4AAC decoder](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native, codec 2) - Ghost of Yotei (PPSA26344) initializes it through `sceAjmBatchJobControl`. The initialize parameters (`u32` config type, 1 ADTS or 2 raw, then `u32` sampling frequency index), instance flags (channels in bits 3-6, `ENABLE_SBR_DECODE` bit 32, `ENABLE_NONDELAY_OUTPUT` bit 33, surround interleave order bits 34-35), `{heaac, reserved}` codec info and decoder error result (`CODEC_ERROR | FATAL`) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/443f022450f6857256e780daa3d5a14029a748f7/src/core/libraries/ajm/ajm_aac.cpp) (PS4, fdk-aac) and are unverified on PS5; decoding uses FFmpeg's AAC decoder. Without `ENABLE_NONDELAY_OUTPUT`, the first two frames after initialization or reset are consumed without output. Raw input takes its channel configuration from the instance (0 means stereo) and is decoded as one access unit per run job. The format reports the last frame's bitrate. Invalid config type or raw sampling frequency index above 11 returns invalid-parameter result 4. The implementation throws for ADTS without a frame header, profiles other than AAC LC, multiple raw data blocks per ADTS frame, unsupported channel configurations, more channels than the instance supports, HE-AAC without `ENABLE_SBR_DECODE`, raw input with `RUN_MULTIPLE_FRAMES`, output room smaller than the previous frame length, and unknown codec flags.
 - [AJM](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp), [APR](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) and [NGS2](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) state is allocated with `new` and never freed on purpose: title threads still call into these libraries while `std::exit` runs static destructors, so ordinary statics would be destroyed under them. Keep them leaked; `guest_ajm_teardown` covers the AJM case on Unix.
 - [AJM Opus mapping family 255 with several channels](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native): the initialization words carry no stream count or channel mapping, so the decoder opens on the first packet. It counts the self-delimited streams of that multistream packet ([RFC 6716 appendix B](https://datatracker.ietf.org/doc/html/rfc6716#appendix-B)) and takes each stream's stereo flag from its TOC byte as coupled, then decodes with an identity channel mapping. A packet whose streams do not add up to the channel count throws. The layout is inferred, not read from the console; unverified on hardware.
diff --git a/docs/dev/debt/libSceAjmi.md b/docs/dev/debt/libSceAjmi.md
index d3ac224c47..0a5d293464 100644
--- a/docs/dev/debt/libSceAjmi.md
+++ b/docs/dev/debt/libSceAjmi.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [libSceAjmi pending exports](../../../core/libs/prx/libSceAjmi/Export.cpp) - 5 named callable exports were identified in the PS5 3.20 export table and cross-checked against firmware 13.60. Signatures and behavior remain unverified; declarations use the unknown-signature convention and throw through `NotImplemented_nid_no_patch`. Evidence: [3.20 export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAjmi.c).
+- [libSceAjmi pending exports](../../../core/libs/prx/libSceAjmi/Export.cpp) - of the 5 named callable exports identified in the PS5 3.20 export table and cross-checked against firmware 13.60, 2 are declared here: `sceAjmBatchJobInlineBuffer` and `sceAjmBatchJobRunBufferRa`, the latter as `sceAjmBatchJobRunBufferRa_nid_disambig1`, which the NID patcher exports under the name's NID, because libSceAjm implements the same name for PS4 titles; a title importing it from libSceAjmi still gets the not-implemented error at call time. Signatures and behavior remain unverified; the declarations use the unknown-signature convention and throw through `NotImplemented_nid_no_patch`. Evidence: [3.20 export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAjmi.c).
diff --git a/docs/dev/debt/libSceAppContent.md b/docs/dev/debt/libSceAppContent.md
index 1780d0bde0..1dbcd434cf 100644
--- a/docs/dev/debt/libSceAppContent.md
+++ b/docs/dev/debt/libSceAppContent.md
@@ -6,10 +6,11 @@
 - [sceAppContentDownloadDataFormat](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - empties the `/download0` directory, creating it if needed. Imported by PPSA01317. A null mount point returns `PARAMETER` and another mount point returns `NOT_MOUNTED` as in `sceAppContentTemporaryDataFormat` and `sceAppContentDownloadDataGetAvailableSpaceKb`; the console's error codes for both and its behaviour with files still open are unverified
 
 
-- [libSceAppContent pending exports](../../../core/libs/prx/libSceAppContent/Export.cpp) - 16 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAppContent.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceAppContent pending exports](../../../core/libs/prx/libSceAppContent/Export.cpp) - 15 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAppContent.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
 ### Functional
 
 - [Initialization](../../../core/libs/prx/libSceAppContent/Export.cpp) - service readiness and boot attributes are not modeled; successful initialization returns a zero boot record. Initialization-state guards, SDK 0x01500000 repeated-initialization errors and reserved-field checks are recovered. SDK-dependent service-error translation remains incomplete.
 
 - [Additional content](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) is not installed or mounted: `sceAppContentAddcontMount` answers `NOT_FOUND` for every entitlement label and `sceAppContentAddcontUnmount` for every mount point, as no add-content mount is ever handed out; `sceAppContentGetAddcontInfo` answers `DRM_NO_ENTITLEMENT` for every label and `sceAppContentGetAddcontInfoList` reports 0 entries; `sceAppContentAddcontEnqueueDownload` answers `PARAMETER` for a null label and `NOT_FOUND` otherwise, since no download is ever queued; `sceAppContentAddcontDelete` answers `PARAMETER` for a null label and `NOT_FOUND` otherwise, since no additional content is ever installed. `sceAppContentGetAddcontDownloadProgress` answers `PARAMETER` for a null label or progress and `NOT_FOUND` otherwise, as [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2328-L2341) does for a label that is not installed additional content, and never writes the progress. Its 16-byte layout (`DataSize`, then `DownloadedSize`, both 64-bit) follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/AppContent/AppContent.cs#L45-L54) and is unused here. The signatures of `sceAppContentAddcontEnqueueDownload` and `sceAppContentGetAddcontDownloadProgress` follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/AppContent/AppContent.cs#L140-L148), and the signature of `sceAppContentAddcontDelete` follows [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.h#L91-L92); dlc_emu is not a console measurement and no console source gives the error codes, so the signatures and the error codes are unverified
+- [sceAppContentGetEntitlementKey](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - the service result without an entitlement is unverified: this model returns `DRM_NO_ENTITLEMENT` and leaves the 16-byte key unchanged. Initialization, null-pointer and SDK 0x01500000 label-padding checks match the reported [firmware 13.42 module probe](https://github.com/boykopovar/AnyPS5/pull/9638#issuecomment-6390573735), run in an emulator, not on hardware. That module forwards service labels 0, 7, 8 and 0xFFFFFFFF without checking them; this library ignores the service label. The system service's own validation and errors remain unknown.
 - [Temporary app-content storage](../../../core/libs/prx/libSceAppContent/Export.cpp) console behaviour and hardware return values are unverified, including behaviour with open files across unmount; host filesystem failures throw. Storage models one `/temp0` mount, preserving files on unmount while rejecting new path resolutions until remount, and leaving existing open host descriptors usable. `sceAppContentTemporaryDataMount` delegates to `sceAppContentTemporaryDataMount2` with option 1 (`TEMPORARY_DATA_OPTION_FORMAT`) to format on mount as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/app_content/app_content.cpp#L550-L553) does. Mount, format, space-query and unmount errors follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/sys/sys_path.pas); pointer ABI follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/AppContent/AppContent.cs).
diff --git a/docs/dev/debt/libSceAppInstUtil.md b/docs/dev/debt/libSceAppInstUtil.md
index 92d88fb4a6..28ed171a11 100644
--- a/docs/dev/debt/libSceAppInstUtil.md
+++ b/docs/dev/debt/libSceAppInstUtil.md
@@ -5,3 +5,101 @@
 - [sceAppInstUtilAppInstallPkg](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) - the package path is followed by an opaque 64-bit value sent to the install service; its meaning and pointer-versus-integer type remain unresolved.
 - [sceAppInstUtilGetInstallProgressInfo, sceAppInstUtilGetInstallProgress and sceAppInstUtilGetPrimaryAppSlot](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) - take a title-id string and an output pointer. The IPC replies contain 48, 4 and 4 bytes respectively; callers and reply producers are needed to establish the field types.
 - [sceAppInstUtilAppPrepareOverwritePkg, sceAppInstUtilAppRecoverApp and sceAppInstUtilAppUnInstallTheme](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) - absent from the supplied system module and from the supplied decompiled callers; the old export inventory establishes names but not prototypes.
+- [sceAppInstUtilAppGetAppInstallStatusByAppInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstall2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstallForRemote](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstallForRemote2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontListTotalSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontInfoByContentId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddcontInstalledStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetInsertedDiscTitleId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUpdateStartTime](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallSharePlayLink](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallSharePlayLinkByUser](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontNum](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelUnInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppDestroyMetadata](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCheckAppSystemVer](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppConvertAppDownloadToDisc](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetMainAppTitleIdForSP](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetSubAppTitleIdForSP](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetMainAppTitleId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetSubAppTitleId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAppInstallStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppDestroyPkg](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilJson](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInsertedDiscRoleType](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRequestInstallDiscGame](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRequestDataDiscCopy](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelDataDiscCopy](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetDataDiscCopyProgress](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilSetPrimaryAppSlot](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAppSlotInfoList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAppEmptySlot](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallGetLinkState](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstallForMultiInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallPs4CloudGame](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppStoreCompilationDiscInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetCompilationDiscInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetStoreCompilationDiscInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetInsertedDiscTitleIdList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallRequestCompilationDiscApp](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetNoRelatedAddcontTitleList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetIrremovableAppList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppRequestMoveApps](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppProhibitDownloadInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppAllowDownloadInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAppMoveProgressInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelMoveApps](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetMoveErrorAppList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAllAppSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelGetAllAppSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetInsertedDiscMasterDataId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAppOtherSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelGetAppOtherSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInsertedDiscTotal](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppSetRemasterInstallType](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInstallProgressInfoForMultiDisc](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilMountBdEmu](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilUnmountBdEmu](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInstallStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilResumeInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilPauseInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRegisterDownload](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilStartInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstallPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetPatchInstallStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilResumePatchInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilPausePatchInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelInstallPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelInstallAddcont](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelForMultiInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstallByPackage](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilIsRestoreState](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetRestoreState](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddons](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInstallOptions](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetContentSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelGetInformation](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetWorkspaceStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilDeleteWorkspace](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetParentalControlLevel](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCheckLatestPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelCheckPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallPsNowIcon](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddcontInfoList2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddcontInfoList3](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilClearAddcontInfoCache](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetContentSize2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallContentPush](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAvailableStorage](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilSwitchInstallLocation](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetConfigList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilSwitchConfig](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRestoreDataSource](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetNeededStorageSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetStorageDestType](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstallAddons](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
diff --git a/docs/dev/debt/libSceAudioIn.md b/docs/dev/debt/libSceAudioIn.md
index abb06131ee..161952ae1e 100644
--- a/docs/dev/debt/libSceAudioIn.md
+++ b/docs/dev/debt/libSceAudioIn.md
@@ -40,5 +40,5 @@
 ### Functional
 
 - [sceAudioInIsPadEmbeddedMic](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - returns 0 for every open port: on the console it returns 1 when the port captures from the controller's built-in microphone and 0 for another input device, but ports here capture from the host's default input device
-- [sceAudioInHqOpen, sceAudioInAsyncOpen](../../../core/libs/prx/libSceAudioIn/Export.cpp) - PS5 wrapper validation requires 48000 Hz followed by exactly 128 samples for both calls; HqOpen then requires format 2. The host uses the same SDL capture path for both, so native asynchronous scheduling and high-quality processing are not reproduced. Common port validation, device selection and host capture pacing remain incomplete.
+- [sceAudioInHqOpen, sceAudioInAsyncOpen](../../../core/libs/prx/libSceAudioIn/Export.cpp) - PS5 wrapper validation requires 48000 Hz followed by exactly 128 samples for both calls; HqOpen then requires format 2. The host uses the same SDL capture path for both, so native asynchronous scheduling and high-quality processing are not reproduced. Common port validation, device selection and host capture pacing remain incomplete. One title (PPSA03355, in its libfmod plugin) disassembled for this entry calls `sceAudioInAsyncOpen` from one call site (0xe5972) with index 0, 128 samples, 48000 Hz and a last argument of 2, plus a type argument of 0 or 1, which agrees with the 48000 Hz and 128 samples above; it stores the result in a slot of its own and branches on a negative result. What the last argument 2 means is not shown.
 - [sceAudioInGetGain, sceAudioInGetRerouteCount](../../../core/libs/prx/libSceAudioIn/Export.cpp) - GetGain writes 1.0f before handle validation and returns 0x80260105 for a null output, as confirmed by the PS5 module. Native handle bit checks and uninitialized/inactive port errors differ from the host port table. Native reroute counters follow device reassignment; the host opens each SDL device once and reports zero.
diff --git a/docs/dev/debt/libSceAudioOut.md b/docs/dev/debt/libSceAudioOut.md
index 37e4a53c5a..d11e3678ee 100644
--- a/docs/dev/debt/libSceAudioOut.md
+++ b/docs/dev/debt/libSceAudioOut.md
@@ -3,6 +3,8 @@
 ### Silent stubs
 
 - [sceAudioOut2LoTerminate](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp) (libSceAudioOut) - returns 0, as the PS5 12.00 module (0x248d0) does whether or not the low-latency service runs. The module disconnects from the audio server and clears the service tables; here `sceAudioOut2LoInit` starts no service and open contexts and ports are left as they are
+- [sceAudioOutMasteringTerm](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - returns 0 without doing anything: there is no mastering stage to tear down, and `sceAudioOutMasteringInit` keeps no state. Whether the console fails a Term without a matching Init is unknown
+- [sceAudioOutSetMainOutput](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - returns 0 and does nothing, as the console function does on firmware 12.70: [PS5-Audio-Passthrough-Research](https://github.com/sainsaji/PS5-Audio-Passthrough-Research/blob/cf3c921d79bf00db4847f31b68a7bd95a8037cd7/docs/FINDINGS.md#L25) reads that export as `xor eax,eax; ret`. The export reads no argument, so its parameters stay unknown; other firmware versions are unverified
 
 ### Unknown function info
 
@@ -12,12 +14,13 @@
 - [sceAudioOutExOpen, sceAudioOutExConfigureOutput, sceAudioOutExClose](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the HDMI bitstream calls follow [PS5-Audio-Passthrough-Research](https://github.com/sainsaji/PS5-Audio-Passthrough-Research/blob/cf3c921d79bf00db4847f31b68a7bd95a8037cd7/docs/FINDINGS.md#L31-L80), which disassembles firmware 12.70's libSceAudioOut and logs the calls on a console. `sceAudioOutExOpen(user, mode)` returns `0x80260015` for a mode above 10 or outside mask `0x61F`; otherwise it opens a port of internal type 6 in S16 stereo, 256 frames at 48000 Hz for modes 0, 1, 2 and 9 and 1024 frames at 192000 Hz for modes 3, 4 and 10. `sceAudioOutExConfigureOutput(control, flags, mode, target, option)` returns `0x80268009` when `control` is not 0, takes modes 0 to 10 and 0xFF and targets 1 to 3 and 0xFF, and returned 0 on the console; `sceAudioOutExClose` returned 0. The argument registers match [Jelly5](https://github.com/02dnot/Jelly5/blob/552b866d89b2a58b27f7f7b0484dc743ce235526/app/src/jelly5_bitstream.cpp#L26-L28) and PPSA99051's [bitstream_out.cpp](https://github.com/sainsaji/PS5-Audio-Passthrough-Research/blob/cf3c921d79bf00db4847f31b68a7bd95a8037cd7/sample-app/src/platform/ps5/bitstream_out.cpp#L29-L32). Audio reaches the host through SDL as PCM and the host has no HDMI bitstream output, so an Ex port has no host device: `sceAudioOutOutput` paces it at its own rate and drops its IEC 61937 bursts, and `sceAudioOutExConfigureOutput` changes nothing. Nonzero `flags` or `option`, other modes or targets, `sceAudioOutExClose` of a handle that is not an Ex port, and `sceAudioOutGetPortState` on an Ex port throw, since the console's answers are unknown
 - [sceAudioOutExGetMonitorInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) - native validation requires first argument zero, a non-null buffer and exactly 1024 bytes, in that order (errors 0x80260003/04/06); the second argument is ignored. The host still reports no audio descriptors by zeroing the record. Native content comes from monitor/device services and system audio configuration, which the SDL backend does not reproduce.
 - [sceAudioOut2Set3DLatency](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - the two 32-bit arguments and selector validation match the system library: selector 0 accepts outputs 0 through 2; selector 255 accepts outputs 1 and 2. No third latency argument exists. The host has no system 3D rendering stage, so the call still does not apply latency and does not reproduce the system initialization and output-availability checks.
-- [sceAudioOut2MasteringInit and sceAudioOut2MasteringInitEx](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the initialized flag and the flag checks follow the PS5 12.00 module (0x22360): a repeated initialization returns 0, other flags return `0x80268201`, and InitEx also accepts bit 31, which the console passes to the audio server as a mastering mode. Nothing is sent to an audio server, and the `0x80268006` the console returns before `sceAudioOut2Initialize` is not returned, since that initialization is not tracked. PPSA01289 calls Init twice before Term twice; by the module its second Term gets `0x80268203`, and the title only logs a non-zero result
+- [sceAudioOut2MasteringInit and sceAudioOut2MasteringInitEx](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the initialized flag and the flag checks follow the PS5 12.00 module (0x22360): a repeated initialization returns 0, other flags return `0x80268201`, and InitEx also accepts bit 31, which the console passes to the audio server as a mastering mode. Nothing is sent to an audio server, and `sceAudioOut2MasteringInit` does not return the `0x80268006` the console returns before `sceAudioOut2Initialize`, which is a missing state check of its own. PPSA01289 calls Init twice before Term twice; by the module its second Term gets `0x80268203`, and the title only logs a non-zero result
 - [sceAudioOut2MasteringGetState and sceAudioOut2MasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the state layout, the states ids 1 (default) and 2 (V2), the descriptor ids `0x01010001`, `0x01020001` and `0x01010003` and the error `0x80268204` follow [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp), not a console measurement. GetState zeroes the states and writes the two descriptors; with no mastering stage the compressor and limiter values stay zero. SetParam accepts any parameter set and records nothing, as KytyPS5 does. The checks before them follow the PS5 12.00 module: both return `0x80268203` before mastering is initialized, GetState returns `0x8026800C` for a null state, SetParam returns `0x80268201` for a null parameter and `0x80268205` for flags above 1. The console's checks of `output` and `user` are not reproduced; both are ignored
 - [sceAudioOut2SetSystemDebugState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - records the debug state id in the trace and returns 0, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp) does; the host has no system mix to apply it to. Id `0x20` with a 4-byte param throws, and the not-initialized error is not returned. Not measured on a console
 - [sceAudioOut2GetSpeakerArrayCoefficients](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - validates the handle and the coefficient count like the ambisonics call, then writes the front pair at full gain and silence for every other speaker, ignoring the position, spread, height awareness and downmix spread radius: [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp) and [prosper](https://github.com/mattias800/prosper/blob/main/prosper/src/hle/audio/hle_audio.cpp) both return that pair. The console's VBAP gains over the array's directions are not measured
 - [sceAudioOutSetMixLevelPadSpk](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - no source applies the level (shadPS4 only stores it); it is assumed to be a linear gain on the port's own output, and the -9 dB default (11626) is applied to every pad speaker port, including those of titles that never call the function
 - [sceAudioOutGetLastOutputTime](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - signature and behaviour taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) and [fpPS4](https://github.com/red-prig/fpPS4) reimplementations of the PS4 library, not confirmed on a PS5 title: the time is the process time at which `sceAudioOutOutput` or `sceAudioOutOutputs` accepted the port's last block, not the time the block reached the device
+- [sceAudioOutGetSystemState](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the 32-byte layout (`float loudness`, 4 reserved bytes, 3 reserved 64-bit words) follows shadPS4's `OrbisAudioOutSystemState` and SharpProspero's `SceAudioOutSystemState` (`Size = 32`); it is not confirmed on a console. Loudness is reported as a constant 0.0f, although SharpProspero documents it in LKFS, so the value is unconfirmed. shadPS4 returns NOT_INIT before `sceAudioOutInit`; that check is not modelled. Imported by PPSA30528, which fails to load without it
 - [sceAudioOutSysOpen, sceAudioOutSysConfigureOutput, sceAudioOutSysClose](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - imported by PPSA99051 and PPSA99997, which fail to load without them; the signatures follow [EVO-PLAYER-PS5](https://github.com/sainsaji/EVO-PLAYER-PS5/blob/da0c0451333bab82e79fffd2de4718e917f9dcb0/projects/evoplayer/core/src/audio/evo_pt.cpp#L24-L29), whose audio code both titles share, and are not confirmed on a console. `sceAudioOutSysOpen(user, mode)` opens a port only for mode 5, the TrueHD MAT route: [the same project's carrier table](https://github.com/sainsaji/EVO-PLAYER-PS5/blob/da0c0451333bab82e79fffd2de4718e917f9dcb0/projects/evoplayer/core/src/audio/iec61937.cpp#L125-L140), read from sceAudioOutExOpen's own tables in firmware 12.70, describes it as a 768 kHz port of 1024 S16 8-channel frames whose 16-byte frames are consumed at 192 kHz; every other mode throws. Audio reaches the host through SDL as PCM and the host has no HDMI bitstream output, so like an Ex port a Sys port has no host device: `sceAudioOutOutput` paces it at its own rate and drops the MAT bursts. `sceAudioOutSysConfigureOutput(type, flags, mode, target, option)` accepts only the observed `(1, 0, 5, 1, 0)` HDMI MAT switch and changes nothing; other arguments throw. `sceAudioOutSysClose` closes a Sys port and throws for any other handle. The restore path EVO-PLAYER-PS5 takes after a Sys port calls `sceAudioOutExConfigureOutput(0, 0, 0xFF, 0xFF, 0)`, so no Sys reset combination is known
 - [sceAudioOut2PortCreate](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) (libSceAudioOut) - MAIN (type 0) format validation follows PS5 firmware 13.60 measurements: bits 8-11 accept 1, 2, 8 or 12, bits 0-6 accept 0 or 1, bit 7 requires 8 channels, and bits 12-31 do not affect validation. The sample types are still read as float and int16; bit 7's layout, the PCM effect of bits 12-31 and the port `flags` are unverified. Other port types retain unverified format validation, including 6 channels and rejection of bits 12-31
 - [sceAudioOut2PortCreate](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) (libSceAudioOut) - 12 channels are assumed to be L R C LFE Ls Rs Lb Rb Ltf Rtf Ltb Rtb as in KytyPS5's 12-to-8 fold, and 6 and 8 channels to be its first 6 and 8; no title or SDK header confirms the order
@@ -26,7 +29,10 @@
 - [Legacy vibration ports](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp): PPSA99902's [public input wrapper](https://github.com/Nazky/UnleashedRecomp-Prospero/blob/2ce067a1d51bb58670c7ee4a3aed893c504da805/UnleashedRecomp/hid/driver/sdl_hid.cpp#L316) opens type 10 with 256 stereo S16 or F32 frames at 48000 Hz. Mono duplicates its channel as AudioOut2 does; wider vibration layouts throw. Native controller output uses AudioOut2's four-channel layout, or its six-channel PulseAudio mapping. Without a controller sound card the existing RMS motor transform is applied to segments of at most 256 frames, scheduled by the legacy queue's frame count and rate; drain and close remove only that port's segments. Concurrent sources combine by the maximum per motor, and the pad consumer uses this approximation only for controllers other than DualSense. This host timing and motor model is not a console measurement or waveform reproduction; legacy native output is unmeasured on hardware, and user routing retains the single-controller limitation. AudioOut2 retains its separate 80 ms peak hold.
 
 - [sceAudioOutDeviceIdOpen](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the native wrapper consumes a 64-bit device ID, port type, sample count, frequency and format from argument slots 1, 2, 4, 5 and 6. Slot 3 is discarded, with the common open API index position preserved. Device enumeration and mapping to host outputs remain unimplemented; the throwing body is unchanged.
-- [sceAudioOut2PortGetState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) and [sceAudioOut2GetSpeakerInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - the port state reports the channel count of the port's data format, output main, volume 127 and a zero reroute counter and flags. Taking the channel count from the data format follows [SharpEmu](https://github.com/sharpemu/sharpemu/blob/main/src/SharpEmu.Libs/Audio/AudioOut2Exports.cs), another emulator. A payload process on a PS5 (firmware 13.60), which is not the foreground application, read output 0, volume -1 and reroute counter 5 for its main ports, and 6 channels for an 8-channel port on a 5.1 system, so a title's values are unverified, including the output of a pad port, the volume after `sceAudioOut2PortSetAttributes` and the reroute counter on a device change. The speaker info reports type 0 with available bits `0x3`, the front left speaker at +30 degrees and the front right one at -30, and -360 for the azimuth and elevation of every other slot. On that console the type followed the HDMI device type and the available bits its channels: type 0 with the device set to TV, 1 to AV amplifier and 2 to sound bar, which [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut2.cs) names television, AV receiver and sound bar (3 is headphones there), and available bits `0x3` for 2 channels and `0x3F` for 5.1 (centre at 0, surround pair at +110 and -110, -360 for the LFE). The front pair and the empty slots read the same in every setting; 7.1 on the AV amplifier reported 2 channels on that console's HDMI chain. The host output is always reported as a stereo television here. The console also returns `0x80268006` before `sceAudioOut2Initialize`, `0x80268001` for flags above 1 and `0x8026800C` for a null pointer, which are not modelled. ASTRO BOT and ASTRO's PLAYROOM reportedly stop on an assertion that depends on these values (#4317), but which field matters has not been isolated
+- [sceAudioOut2PortGetState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) (libSceAudioOut) - the port state reports the channel count of the port's data format, output main, volume 127 and a zero reroute counter and flags. Taking the channel count from the data format follows [SharpEmu](https://github.com/sharpemu/sharpemu/blob/main/src/SharpEmu.Libs/Audio/AudioOut2Exports.cs), another emulator. A payload process on a PS5 (firmware 13.60), which is not the foreground application, read output 0, volume -1 and reroute counter 5 for its main ports, and 6 channels for an 8-channel port on a 5.1 system, so a title's values are unverified, including the output of a pad port, the volume after `sceAudioOut2PortSetAttributes` and the reroute counter on a device change.
+- [sceAudioOut2GetSpeakerInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - The speaker info reports type 0 with available bits `0x3`, the front left speaker at +30 degrees and the front right one at -30, and -360 for the azimuth and elevation of every other slot. On that console the type followed the HDMI device type and the available bits its channels: type 0 with the device set to TV, 1 to AV amplifier and 2 to sound bar, which [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut2.cs) names television, AV receiver and sound bar (3 is headphones there), and available bits `0x3` for 2 channels and `0x3F` for 5.1 (centre at 0, surround pair at +110 and -110, -360 for the LFE).
+- [sceAudioOut2GetSpeakerInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - The front pair and the empty slots read the same in every setting; 7.1 on the AV amplifier reported 2 channels on that console's HDMI chain. The host output is always reported as a stereo television here. The console also refuses flag 1 below a per-process libkernel value whose source is unidentified; BunnyFl measured the boundary between `0x14FFFFF` and `0x1500000`, and it is not modelled here. ASTRO BOT and ASTRO's PLAYROOM reportedly stop on an assertion that depends on these values (#4317), but which field matters has not been isolated
+- [sceAudioOutInit and sceAudioOut2Initialize repeats](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - a repeated `sceAudioOutInit` returns 0 here, while the firmware returns `0x8026000e` on the second call; whether a repeated `sceAudioOut2Initialize` returns 0 is unmeasured. That `sceAudioOutInit` initializes AudioOut2, and that `sceAudioOut2GetSpeakerInfo` then succeeds, follow the firmware and are covered by tests.
 - [sceAudioOut2UserCreateEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutOpenEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetSystemDebugState](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
@@ -46,17 +52,12 @@
 - [sceAudioOutExGetLastOutputTime](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutGetInfoOpenNum](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutGetInfo](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringInit](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringGetState](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringTerm](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetPadSpkVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetPadJackVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetUsbVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetCaesarVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetHeadphoneOutMode](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutGetFocusEnablePid](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutSetMainOutput](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetVolumeDown](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetChatBalance](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetRecMode](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
@@ -112,6 +113,8 @@
 
 ### Functional
 
+- [sceAudioOutMasteringInit, sceAudioOutMasteringTerm and sceAudioOutMasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - non-zero flags, a null pointer and a params id other than 1 throw; a repeated Init, a Term without Init and a SetParam or GetState before Init are unknown. There is no mastering stage, so Init and Term keep no state and SetParam reads only the id. The signatures and the default params id 1 follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut.cs#L312-L344), not a console measurement. SharpProspero documents flag bit 0 as `SwapEqCompressor`, and shadPS4's PS4 stub [rejects any non-zero Init flags](https://github.com/shadps4-emu/shadPS4/blob/8d50471b7dc141dd700b51276b8edd1f293bce26/src/core/libraries/audio/audioout.cpp#L956-L962) with 0x80260201
+- [sceAudioOutMasteringGetState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the states id 1 and the meter offsets 32, 128, 240, 272 and 304 in a 336-byte struct follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Audio/AudioOutMastering.cs#L97-L110), not a console measurement. With no mastering stage it zeroes the compressor input RMS and gain, and the limiter input, output and gain peaks, and leaves the other bytes, including the descriptors the AudioOut2 call writes, untouched; zero is not known to be what the console reports for an idle chain. A null pointer and a states id other than 1 throw; the console error codes are unknown
 - [sceAudioOut2EnableChat and sceAudioOut2DisableChat](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) - both PS5 exports take no arguments, return 0x80268006 before AudioOut2 initialization, and invoke the system chat service with selector 3. A negative service result maps to 0x80268000, otherwise they return zero. The host only records a local enabled flag, without initialization validation or a chat service; repeated-call and no-session behavior therefore still depends on the missing service.
 - [sceAudioOut2Set3DLatency](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - the two 32-bit arguments and selector validation match the system library: selector 0 accepts outputs 0 through 2; selector 255 accepts outputs 1 and 2. No third latency argument exists. The host has no system 3D rendering stage, so the call still does not apply latency and does not reproduce the system initialization and output-availability checks.
 - [AudioOut2 contexts](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp) (libSceAudioOut) with an SDL device and no `sceAudioOut2ContextAdvance` calls read a grain's port buffers at the next push, at least 100 us after the grain was pushed, and play the mix behind a 40 ms cushion that the queue level leaves out. When the hardware reads the buffers is not known. The timing follows a title whose mixer fills a buffer after pushing it, reuses it two pushes later, and may still be writing it when the next push follows within microseconds. The last grain pushed before a title stops pushing is never read or played.
diff --git a/docs/dev/debt/libSceAudioPropagation.md b/docs/dev/debt/libSceAudioPropagation.md
index ee209da65f..66ebc2c6f3 100644
--- a/docs/dev/debt/libSceAudioPropagation.md
+++ b/docs/dev/debt/libSceAudioPropagation.md
@@ -2,10 +2,10 @@
 
 ### Silent stubs
 
-- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp) lacks acoustic propagation: attributes have no effect, sources expose no paths or rays, rendering preserves the destination mix without adding path contributions, and allocated CPU work memory is mostly unused. Ray results and audio paths accept empty lists and throw otherwise; calculation returns initial native validation errors and throws for unsupported propagation. Room, portal, source and material handles are tracked, but destruction after their system is destroyed silently succeeds without native lifetime semantics being confirmed. Occlusion, reflections and reverb are absent.
+- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp) lacks acoustic propagation: attributes have no effect, sources expose 36 initially empty, invalid path slots and no rays, rendering preserves the destination mix without adding path contributions, and allocated CPU work memory is mostly unused. Ray results and audio paths accept empty lists and throw otherwise; calculation returns initial native validation errors and throws for unsupported propagation. Room, portal, source and material handles are tracked, but destruction after their system is destroyed silently succeeds without native lifetime semantics being confirmed. Occlusion, reflections and reverb are absent.
 
 ### Unknown function info
 
-- [sceAudioPropagationSourceSetAudioPath](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): the native path lookup and update confirm a 64-bit path handle, a read-only 224-byte path description and a float gain in XMM0. The description contains four 48-byte points, a point count and flags; each point contains a descriptor, room handle, gain and three position floats. The last eight bytes of each point and of the description are not consumed by these paths and remain opaque. Protected implementation remains unchanged; allocation, ownership and rendering are not implemented.
-- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): system options use a recovered 56-byte record; the field at byte 24 and final eight bytes remain semantically unresolved. CPU memory requirements and option limits are recovered; GPU memory queries throw because their platform-specific runtime condition is unresolved. Descriptor validation, ray ownership and path generation are unimplemented. Native rendering accepts multiple mutable records; the host supports only format 2 and writes one silent frame without native accumulation. Frame capacity and source-count limits follow the recovered options. Other formats and native validation precedence remain unimplemented.
+- [sceAudioPropagationSourceSetAudioPath](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): native evidence establishes a 64-bit path handle, a read-only 224-byte path description and a float gain. The four 48-byte points contain a room handle, gain and position; trailing eight-byte fields remain opaque. Updates copy the description and validate room ownership. Each source owns 36 initially invalid, empty slots, following public SharpProspero MaxPaths and SAROS's immediate lookup of slot 0. Allocation before calculation, the count of 36 and update validation precedence are inferred, not measured on a console. Native lookup error codes and their handle/null/index precedence are retained. Source/system destruction invalidates owned slots. Active nonempty path rendering still throws.
+- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): system options use a recovered 56-byte record; the field at byte 24 and final eight bytes remain semantically unresolved. CPU memory requirements and option limits are recovered; GPU memory queries throw because their platform-specific runtime condition is unresolved. Descriptor validation, ray ownership and path generation are unimplemented. Native rendering accepts multiple mutable records; the host accepts public formats 0/1/2/4/5 (4/9/16/8/8 float channels), preserves the output mix without path contributions and clears the returned channel count; non-format-2 behavior remains unverified on a console. Frame capacity and source-count limits follow the recovered options. Other formats throw; native validation precedence remains unimplemented.
 - [Initialization exports](../../../core/libs/prx/libSceAudioPropagation/Export.cpp) ending in `Init`, plus `sceAudioPropagationSystem`, are not exported: the SDK declares the helpers `static inline` and none is in the SDK stub library or the supplied native module. Query, locking, enumeration and report callback signatures are recovered; diagnostic layouts are recovered, but source attributes 2/3 and the constant-one fields still lack semantic names. The final system word and the fourth position/direction words have no confirmed semantics.
diff --git a/docs/dev/debt/libSceAvPlayer.md b/docs/dev/debt/libSceAvPlayer.md
index fb24c0d166..b248df63b3 100644
--- a/docs/dev/debt/libSceAvPlayer.md
+++ b/docs/dev/debt/libSceAvPlayer.md
@@ -2,8 +2,8 @@
 
 ### Silent stubs
 
-- [libSceAvPlayer](../../../core/libs/prx/libSceAvPlayer/Export.cpp): `sceAvPlayerSetLogCallback` accepts a callback that is never called, as the player produces no log messages, and `sceAvPlayerSetAvailableBandwidth` has no effect, as it governs HLS sources, which `sceAvPlayerAddSource` does not implement.
-- [sceAvPlayerSetTrickSpeed](../../../core/libs/prx/libSceAvPlayer/src/Source.cpp) (libSceAvPlayer) with a negative speed runs the clock backwards but delivers no frames; when a forward speed is set again, playback resumes from the rewound time.
+- [libSceAvPlayer](../../../core/libs/prx/libSceAvPlayer/Export.cpp): `sceAvPlayerSetLogCallback` accepts a callback that is never called, as the player produces no log messages, and `sceAvPlayerSetAvailableBandwidth` has no effect, as it governs HLS sources, which `sceAvPlayerAddSource` does not implement; after a source is added it returns `OPERATION_FAILED`, as [prosper's reading of the module](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/video/avplayer.cpp#L960-L972) describes.
+- [sceAvPlayerSetTrickSpeed](../../../core/libs/prx/libSceAvPlayer/src/Source.cpp) (libSceAvPlayer) with a negative speed runs the clock backwards but delivers no frames; when a forward speed is set again, playback resumes from the rewound time. With a source, a zero speed returns `INVALID_PARAMS` before the `OPERATION_FAILED` of a stopped, finished or failed player, the order AnyPS5 had before; that order is unmeasured. In [prosper's reading of the module](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/video/avplayer.cpp#L929-L959), only the missing source is checked first. A zero speed is refused with `NOT_SUPPORTED`, with every other speed from -399 to 399 except 100, and no player state is checked.
 
 ### Unknown function info
 
diff --git a/docs/dev/debt/libSceBgft.md b/docs/dev/debt/libSceBgft.md
index 385f701d0f..95b8d7ac06 100644
--- a/docs/dev/debt/libSceBgft.md
+++ b/docs/dev/debt/libSceBgft.md
@@ -4,4 +4,14 @@
 
 - [sceBgftServiceDownloadGetProgress](../../../core/libs/prx/libSceBgft/Export.cpp), `sceBgftServiceIntDownloadGetProgress`, `sceBgftServiceIntDownloadGetGameAndGameAcProgress` and `sceBgftServiceIntDownloadGetPlayGoProgress`: signatures and the shared 88-byte output are confirmed. The library forwards the output through IPC without accessing individual fields; their types remain unresolved.
 - [sceBgftServiceIntDownloadRegisterTaskByStorageEx](../../../core/libs/prx/libSceBgft/Export.cpp): confirmed parameter pointer and 32-bit task ID output. The input contains 32-bit scalars at offsets 0, 4, 56 and 104, strings at offsets 8, 16, 32, 40, 48, 64, 72, 80 and 88, and a 64-bit scalar at offset 96. The typed layout preserves the unused eight bytes at offset 24; scalar meanings and several string roles remain unresolved.
-- [sceBgftServiceIntDownloadGetPatchProgress](../../../core/libs/prx/libSceBgft/Export.cpp) and `sceBgftServiceIntDownloadGetTaskInfo`: neither export nor a caller was found in the supplied decompiled library corpus. Their signatures remain unresolved.
+- [sceBgftServiceIntDownloadGetPatchProgress](../../../core/libs/prx/libSceBgft/Export.cpp) and `sceBgftServiceIntDownloadGetTaskInfo`: both throw through `NotImplemented_nid_no_patch`; neither export nor a caller was found in the supplied decompiled library corpus. The `(const char* contentId, BgftProgress*)` and `(int32_t taskId, BgftTaskInfo*)` signatures follow the OpenOrbis headers, whose other Bgft prototypes match the confirmed ones here; they are not measured on a console. The task info layout is unknown.
+
+- [sceBgftServiceIntDebugPlayGoClearSetFreeZone](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - It is in the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDebugPlayGoIsSetFreeZone](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - It is in the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadCheckPatchUpdateState and sceBgftServiceIntDownloadClearStats](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadGetApplicationDataSize](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - It is in the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadGetPatchGoProgress and sceBgftServiceIntDownloadHideTask](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadSetResumeState and sceBgftServiceIntDownloadSetStartState](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntPlayGoCheckDiscIniChunksInstall and sceBgftServiceIntPlayGoStartDataDiscInstall](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntSetTaskVisible, sceBgftServiceIntUploadGetAvailableTaskCount, sceBgftServiceIntUploadGetTaskInfo and sceBgftServiceIntUploadHideTask](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntUploadSetStartState and sceBgftServiceIntUploadSetUploadError](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
diff --git a/docs/dev/debt/libSceCamera.md b/docs/dev/debt/libSceCamera.md
index d0346584a7..955b1e157c 100644
--- a/docs/dev/debt/libSceCamera.md
+++ b/docs/dev/debt/libSceCamera.md
@@ -7,3 +7,112 @@
 ### Functional
 
 - [sceCameraIsAttached](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera) - no camera is ever attached: index 0 returns 0 (not attached) and any other index returns `SCE_CAMERA_ERROR_PARAM` (0x802E0000), as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/9a8ae4417bbfc79b1a43eb8a2eb0bb602148261e/src/core/libraries/camera/camera.cpp#L187-L200) does without a configured camera, with the error value from its [camera_error.h](https://github.com/shadps4-emu/shadPS4/blob/9a8ae4417bbfc79b1a43eb8a2eb0bb602148261e/src/core/libraries/camera/camera_error.h). Not measured on a console. Closes when: a host camera is exposed to guests.
+
+### Additional PS5 3.20 imports
+
+- [sceCameraStopByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `+X1Kgnn3bzg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceIDWithoutOpen](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `-H3UwGQvNZI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetAttribute](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `0btIPD5hg5A`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraInitializeRegistryCalibData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `0wnf2a60FqI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `1-IJHxzRJGw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Finalize](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `186Jz869gsc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetConnectedDeviceAndDriverMode](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `2dBOiluwiMw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2IsAttached](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `2v21-m4gljU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `2zCd8XDOe-Y`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetTrackerMode](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `3VJOpzKoIeM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `3i5MEzrC1pg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibDataForEve](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `4IGO2LPD3h8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibDataFromDevice](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `5Oie5RArfWs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `66IVWcdNHyI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraIsConnectedForSystem](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `68S3GKWhY6o`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `8MEjogxPrv0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetRegister](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `8MjO05qk5hA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetVideoSyncInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `8WtmqmE4edw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetConfigInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `9+SNhbctk64`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAttributeInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `96F7zp1Xo+k`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `AfIDd+2ycTs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetMmapConnectedCount](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `B260o9pSzM8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `DAycoVmY3Mw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceConfig](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `DSOLCrc3Kh8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioOpen](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `DhqqFiBU+6g`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `FZkD-E6MNTQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibDataFromDeviceForEve](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `H-7tWq8gfKs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `HX5524E5tMY`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetVrCaptureInfo](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `IAz2HgZQWzE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetCalibDataForEve](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `Jkz3xxMeyIM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetAttribute](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `JtD7ZG45rdw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetLensCorrection](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `K7W7H4ZRwbc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetCalibData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `LEMk5cTHKEA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetProcessFocusByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `NVITuK83Z7o`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetConfig](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `O5x-G9Rqwx4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ObIste7hqdk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `P-7MVfzvpsM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Initialize](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `PFRl8SmSW+4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `QI8GVJUy2ZY`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAccGetData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `QhjrPkRPUZQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetAttribute](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `Qk6kEJ0RJlM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibrationData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `RHYJ7GKOSMg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `RTDOsWWqdME`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `T8jy0JWa210`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Stop](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `TZWR3p6XxXk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `TzkL-nUWfaQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `U8oNsRef+jI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioClose](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `UFonL7xopFM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetProductInfo](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ULxbwqiYYuU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `WVox2rwGuSc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetLensCorrection](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `XqYRHc4aw3w`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraChangeAppModuleState](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `Y0pCDajzkVQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetFrameData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `YlFCMjbyzh8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `a5xFueMZIMs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `bSKEi2PzzXI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `c6Fp9M1EXXc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `c9XZGDF1OcM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraStartByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `cLxF1QtHch0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Open](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `dmLUJh3bVTc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Start](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `eGkcUia48ts`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetLensCorrectionInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `eHa3vhGu2rQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraOpenByModuleId](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `eTywOSWsEiI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetCalibrationData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `emZBXv7cuAI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioGetData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `fkZE7Hup2ro`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `gB+OkFvkSXE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `gJqqsinextg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hHA1frlMxYE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraWaitForEveReady](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hPVradh5wpo`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetRegistryInfo](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hawKak+Auw4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioGetData2](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hftC5A1C8OQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAppModuleFocus](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `j5isFVIlZLk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetDefectivePixelCancellation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `jMv40y2A23g`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceID](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `jTJCdyv9GLU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetForceActivate](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `jeTpU0MqKU0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `k3zPIcgFNv0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetFieldOfView](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `kVWBITsSB3o`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2IsValidFrameData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `lQ7rWWlOArI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetProcessFocus](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `lS0tM6n+Q5E`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `lhEIsHzB8r4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetConfig](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `mLRzKdIDwiU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `n+R7PGJa6MI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceConfigWithoutHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `n+rFeP1XXyM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraDeviceOpen](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `nBH6i2s4Glc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetUacModeInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `nnR7KAIDPv8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `oEi6vM-3E2c`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetRegister](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `olojYZKYiYs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `pfiqU2f6PQY`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraRemoveAppModuleFocus](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `py8p6kZcHmA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `qTPRMh4eY60`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDefectivePixelCancellation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `tslCukqFE+E`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Close](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `uBRW3tEoWWM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetVideoSync](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ubD+FitjqhA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraWaitForLukeReady](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `v9XTZHXoJyQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetDefectivePixelCancellationInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vER3cIMBHqI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vPi3gSzw79M`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vS20kteXHdw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetDebugStop](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vejouEusC7g`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vx9MQYicBVQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraIsConfigChangeDone](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wQfd7kfRZvo`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wgBMXJJA6K4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetVideoSync](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wpeyFwJ+UEI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioReset](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wyU98EXAYxU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `yfSdswDaElo`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `zIKL4kZleuc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `zrIUDKZx0iE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraCloseByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ztqH5qNTpTk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
diff --git a/docs/dev/debt/libSceCesCs.md b/docs/dev/debt/libSceCesCs.md
index 4fb901f0db..5a561e4a4e 100644
--- a/docs/dev/debt/libSceCesCs.md
+++ b/docs/dev/debt/libSceCesCs.md
@@ -2,19 +2,24 @@
 
 ### Silent stubs
 
-- [sceCesMbcsUcsContextInit](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) stores the profile pointer in the first 8 bytes of the caller's context; the console's context layout is not known. It returns the invalid-parameter error for a null context. The signature `int sceCesMbcsUcsContextInit(union* context, const union* mbcsUcsPrf)` follows the [Orbital IDA type database](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json). `sceCesRefersUcsProfileCp1251` returns a profile accepted by `sceCesSbcToUtf8` and `sceCesUtf8ToSbc` only, with the Windows-1251 table of Microsoft's [bestfit1251.txt](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit1251.txt), where byte 0x98 (unassigned) maps to U+0098 like the unassigned Cp1252 bytes; the console behavior for that byte is not verified
-- [EUC-JP (CP51932) conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs): `sceCesUcsProfileInitEucJpCp51932` marks the caller's sheet with an 8-byte tag and returns it as the profile. `sceCesUtf8StrToMbcsStr`, `sceCesUcs2StrToMbcsStr`, `sceCesMbcsStrToUtf8Str`, `sceCesMbcsStrToUcs2Str`, their `Get*Len` forms and `sceCesEucJpToUcs2` convert ASCII, the JIS X 0201 half-width katakana (`0x8E` + `0xA1`-`0xDF`, U+FF61-U+FF9F) and the two-byte rows `0xA1`-`0xFE` for that profile, and every character for the CP1252 and CP1251 profiles. The two-byte table ([JisX0208.hpp](../../../core/libs/prx/libSceCesCs/JisX0208.hpp), 7336 of 8836 cells) is Microsoft code page 932 read through the standard JIS row/cell to Shift-JIS arithmetic, so it includes NEC row 13 and the NEC-selected IBM rows 89-92 and maps the Microsoft variants (U+FF5E at `0xA1C1`, U+2225, U+FF0D, U+FFE0-U+FFE2) instead of JIS X 0208's; that the console's CP51932 table equals it is assumed from the Microsoft code page, not measured. A character with several cells encodes to the lowest cell. A well-formed but unassigned cell answers `UNASSIGNED_CODE`, a trail byte outside `0xA1`-`0xFE` `INVALID_ENCODE`, a cut pair `SRC_BUFFER_END`; the console's errors for these are not known. Three-byte JIS X 0212 (`0x8F`) characters convert through a second table ([JisX0212.hpp](../../../core/libs/prx/libSceCesCs/JisX0212.hpp), 6067 of 8836 cells) read from the Unicode consortium's [JIS0212.TXT](https://unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/JIS/JIS0212.TXT); that the console's CP51932 table equals it is assumed from that mapping, not measured. A well-formed but unassigned three-byte cell answers `UNASSIGNED_CODE` and a cut triple `SRC_BUFFER_END`. A character with cells in both JIS X 0208 and JIS X 0212 encodes to the two-byte form, and one only in JIS X 0212 to the three-byte form. Signatures follow [orbital](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json). The string forms stop at the source limit or at a zero code unit, which is neither converted nor counted, and write no terminator; `*Len` outputs count code units consumed and produced. A code point outside the BMP answers `UNASSIGNED_CODE`. Unverified on hardware.
-- [Shift-JIS (CP932) conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs): `sceCesUcsProfileInitSJis1997Cp932` marks the caller's sheet with an 8-byte tag and returns it as the profile. `sceCesUtf8StrToMbcsStr`, `sceCesUcs2StrToMbcsStr`, `sceCesMbcsStrToUtf8Str`, `sceCesMbcsStrToUcs2Str`, and their `Get*Len` forms convert ASCII, JIS X 0201 half-width katakana (`0xA1`-`0xDF`, U+FF61-U+FF9F), two-byte Shift-JIS sequences (`0x81`-`0x9F` and `0xE0`-`0xFC` lead, `0x40`-`0x7E` and `0x80`-`0xFC` trail) mapped to JIS X 0208 row/cell indices against the CP932 table ([JisX0208.hpp](../../../core/libs/prx/libSceCesCs/JisX0208.hpp)), and the IBM extensions (`0xFA40`-`0xFC4B`, 388 characters) decoded to their corresponding JIS X 0208 code points. The user-defined area (`0xF040`-`0xF9FC`, which CP932 maps to Private Use Area U+E000-U+E757) and unassigned lead/trail combinations answer `UNASSIGNED_CODE`, an invalid lead or trail byte `INVALID_ENCODE`, a cut sequence `SRC_BUFFER_END`. Characters with multiple cells encode to the lowest cell. Signatures follow [orbital](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json). Unverified on hardware.
+- [sceCesMbcsUcsContextInit](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) stores the profile pointer in the first 8 bytes of the caller's context; the console's context layout is not known. It returns the invalid-parameter error for a null context and, as a payload process on a PS5 (firmware 13.60) did, for a null profile. The signature `int sceCesMbcsUcsContextInit(union* context, const union* mbcsUcsPrf)` follows the [Orbital IDA type database](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json). `sceCesRefersUcsProfileCp1251` returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with the Windows-1251 table of Microsoft's [bestfit1251.txt](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit1251.txt), except byte 0x98, which is unassigned
+- [EUC-JP (CP51932) conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs): `sceCesUcsProfileInitEucJpCp51932` marks the caller's sheet with an 8-byte tag and returns it as the profile. Decoding follows the console (see the `sceCesEucJpToUtf8` entry), with the Microsoft code page 932 table read through the JIS row/cell arithmetic ([JisX0208.hpp](../../../core/libs/prx/libSceCesCs/JisX0208.hpp)); the console does not decode or encode JIS X 0212 either way (U+02D8 answered `0x805C0020`). Encoding takes the lowest cell of a character. Signatures follow [orbital](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json)
+- [Shift-JIS (CP932) conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs): decoding matches a payload process on a PS5 (firmware 13.60) for every two-byte input through `sceCesMbcsStrToUcs2Str`, in result, lengths and output. `sceCesUcsProfileInitSJis1997Cp932` tags the caller's sheet and returns it as the profile. The string conversions decode ASCII, half-width katakana (`0xA1`-`0xDF`) and two-byte sequences (`0x81`-`0x9F` and `0xE0`-`0xFC` lead, `0x40`-`0x7E` and `0x80`-`0xFC` trail) through the CP932 table ([JisX0208.hpp](../../../core/libs/prx/libSceCesCs/JisX0208.hpp)), including the IBM extensions `0xFA40`-`0xFC4B`. The user-defined area `0xF040`-`0xF9FC` and unassigned cells answer `UNASSIGNED_CODE`, an invalid lead or trail `INVALID_ENCODE`, a cut sequence `SRC_BUFFER_END`. Signatures follow [orbital](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json)
 
 ### Unknown function info
 
 - [Unicode scalar conversions](../../../core/libs/prx/libSceCesCs/Unicode.cpp) (libSceCesCs) - console error precedence, optional length pointers and length units are unverified. Signatures follow the [Orbital type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); names are in the aerolib table pinned by `tools/nid_names.py`. Encoding follows [Unicode section 3.9](https://www.unicode.org/versions/Unicode17.0.0/core-spec/chapter-3/). Each call converts one scalar, including zero and U+FEFF, without a terminator or byte-order detection; lengths count bytes for UTF-8 and 16-bit units for UTF-16. Native forms use host byte order (supported hosts are little-endian). Errors follow the existing CES converters, not console measurements, and failure leaves outputs unchanged. No console or title comparison has been run
-- [sceCesEucJpToUtf8](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the scalar conversion's errors and optional length pointers are unverified against the console. Its signature follows the Orbital type database linked above; it uses the existing CP51932 profile and JIS tables, with their mapping and profile-layout assumptions listed above, converts one character (including zero), and writes no terminator. Failure leaves the output and length pointers unchanged
-- [Shift-JIS and EUC-JP scalar conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - errors, their precedence and the optional length pointers of `sceCesSJisTo*`, `sceCesEucJpTo{Utf16,Utf32}*` and `sceCes{Ucs2,Utf8,Utf16,Utf32}*To{SJis,EucJp}` are unverified against the console. Signatures follow the Orbital type database linked above; the CP932 and CP51932 table and profile assumptions above apply. A profile of another encoding answers `INVALID_PARAMETER`, a surrogate or a value above U+10FFFF `INVALID_ENCODE`, a code point outside the BMP `UNASSIGNED_CODE`. `sceCesSJisCodeToJisX0208` and `sceCesJisX0208ToSJisCode` do not check that the cell is assigned; their `INVALID_ENCODE` for rows or cells outside 1-94 and `INVALID_DST_BUFFER` for a null output are not console measurements
+- [sceCesEucJpToUtf8 and sceCesEucJpToUcs2](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) with the CP51932 profile follow a payload process on a PS5 (firmware 13.60): every two-byte input and every `0x8F` three-byte input gives the console's result, length and output (the test pins a hash of both sweeps). Bytes below 0xA0 other than 0x0E, 0x8E and 0x8F convert to themselves; JIS X 0212 is not decoded, so `0x8F` forms return `0x805C0020` in rows X 0212 leaves empty and `0x805C0014` elsewhere; a null profile returns `0x805C0004`, and the lengths are cleared first and then set as the console sets them. Their signatures follow the Orbital type database linked above. The console reads any other profile pointer as a sheet, where these return the invalid-parameter error.
+- [Shift-JIS and EUC-JP scalar conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - errors, their precedence and the optional length pointers of `sceCesSJisTo*`, `sceCesEucJpTo{Utf16,Utf32}*` and `sceCes{Ucs2,Utf8,Utf16,Utf32}*To{SJis,EucJp}` are unverified against the console. Signatures follow the Orbital type database linked above; the CP932 and CP51932 table and profile assumptions above apply. A profile of another encoding answers `INVALID_PARAMETER`, a surrogate or a value above U+10FFFF `INVALID_ENCODE`, a code point outside the BMP `UNASSIGNED_CODE`. UTF-8 input is decoded as `sceCesUtf8ToSbc` decodes it, so overlong forms answer `0x805C0015`. `sceCesSJisCodeToJisX0208` and `sceCesJisX0208ToSJisCode` do not check that the cell is assigned; their `INVALID_ENCODE` for rows or cells outside 1-94 and `INVALID_DST_BUFFER` for a null output are not console measurements
+- [Strict JIS X 0208 profiles](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables were measured on a PS5 (`sceCesMbcToUtf32` and `sceCesUtf32ToMbc` over every one- and two-byte sequence and every scalar); the errors follow the other JIS profiles, a missing SS2 or SS3 answering `INVALID_ENCODE`. The table is CP932's without rows 13 and 89-92 and with seven cells changed (`0x213D` U+2014 and the six of [JIS0208.TXT](https://unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/JIS/JIS0208.TXT)). Cell `0x2140` is U+005C in `sceCesUcsProfileInitSJis1997X0208`, whose bytes `0x5C` and `0x7E` are U+00A5 and U+203E, and U+FF3C in the EUC-JP profiles, which keep ASCII and also encode U+00A5 and U+203E as `0xA1EF` and `0xA1B1`. Per [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Text/Ces.cs#L57-L67), `X0208Ss2` adds SS2 katakana and `X0208Ss2Ss3` SS3 JIS X 0212
 - [UTF-16 and UTF-32 forms of the single-byte and MBCS string conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - errors, their precedence and the optional length pointers of `sceCesSbcTo{Ucs2,Utf16,Utf32}*`, `sceCes{Ucs2,Utf16,Utf32}*ToSbc`, `sceCesMbcsStr{To,Get}{Utf16,Utf32}*` and `sceCes{Utf16,Utf32}Str{To,Get}Mbcs*` are unverified against the console. Signatures follow the Orbital type database linked above. They follow `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the UTF-8 MBCS string forms with the profiles and tables listed above. A surrogate or a value above U+10FFFF answers `INVALID_ENCODE`, a valid code point no profile maps `UNASSIGNED_CODE`. The string forms stop at a zero code unit, write no terminator and count code units
-- [GBK (CP936) and EUC-CN conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - `sceCesUcsProfileInitGbkCp936` and `sceCesUcsProfileInitEucCnGb2312` mark the caller's sheet with an 8-byte tag; the console's profile layout is not known. Both use one table ([Cp936.hpp](../../../core/libs/prx/libSceCesCs/Cp936.hpp)) read from Microsoft's [CP936.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP936.TXT); the EUC-CN profile accepts only its `0xA1`-`0xFE` lead and trail bytes, so it includes the GBK cells inside that range and the CP936 forms of `0xA1A4` (U+00B7) and `0xA1AA` (U+2014) instead of GB 2312's. That the console's GB 2312 and CP936 tables equal it is not measured. User-defined areas, GB 18030 four-byte forms and `sceCesGbUcsProfileSet*` are not handled. Errors, their precedence and the length pointers follow the Shift-JIS forms above and are unverified
-- [sceCesRefersUcsProfileCp1250](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with the Windows-1250 table of Microsoft's [bestfit1250.txt](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit1250.txt), where the unassigned bytes map to their Latin-1 control characters as the Cp1252 and Cp1251 tables do; the console behavior for those bytes and the whole profile is not verified. PPSA34501 fails to start without this export (`qYu6y1E0Qbg`)
-- [Generic MBCS character and Shift-JIS code helpers](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - `sceCesMbcTo*` convert one character with any profile the MBCS context accepts, as the per-encoding forms above do. `sceCesSJisGetCode` and `sceCesSJisPutCode` read and write one raw Shift-JIS code (one byte for ASCII and `0xA1`-`0xDF`) without checking that it is assigned. `sceCesSJisCodeToJisX0213` and `sceCesJisX0213ToSJisCode` use the Shift_JIS-2004 arithmetic of JIS X 0213 annex 1 (plane 2 rows 1, 3-5, 8, 12-15 and 78-94 on leads `0xF0`-`0xFC`). `sceCesMbcsUcsContextInitCopy` copies the stored profile pointer. Signatures follow the Orbital type database linked above; errors, their precedence and the optional size pointers follow the other converters and are unverified against the console
+- [GBK (CP936) and EUC-CN conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - `sceCesUcsProfileInitGbkCp936` and `sceCesUcsProfileInitEucCnGb2312` mark the caller's sheet with an 8-byte tag; the console's profile layout is not known. Both use one table ([Cp936.hpp](../../../core/libs/prx/libSceCesCs/Cp936.hpp)) read from Microsoft's [CP936.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP936.TXT); the EUC-CN profile accepts only its `0xA1`-`0xFE` lead and trail bytes, so it includes the GBK cells inside that range and the CP936 forms of `0xA1A4` (U+00B7) and `0xA1AA` (U+2014) instead of GB 2312's. That the console's GB 2312 and CP936 tables equal it is not measured. User-defined areas and `sceCesGbUcsProfileSet*` are not handled. Errors, their precedence and the length pointers follow the Shift-JIS forms above and are unverified
+- [GB 18030 profiles](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the console's tables are not measured, and the sources disagree on 26 sequences. The 2000 profile follows ICU's `gb-18030-2000.ucm` at icu-data d9d3a6ed (before ICU-8427), which matches Python's codec: `0xA8BC` is U+E7C7 and `0x8135F437` U+1E3F. The 2005 profile follows `gb-18030-2005.ucm` (91850aec), which swaps those two and maps 24 PUA cells to U+FE10-U+FE19, U+9FB4-U+9FBB and six supplementary ideographs, keeping the PUA code points as encode fallbacks. Two-byte cells are CP936 plus [Gb18030.hpp](../../../core/libs/prx/libSceCesCs/Gb18030.hpp); four-byte runs include ICU's `gb18030Ranges`. The inits tag the sheet like GBK's; the `sceCesGb*`, `sceCesMbc*` and MBCS string forms accept them. The full mapping is assumed as the default of `sceCesGbUcsProfileSetUdaMapping` and `Set4ByteCharRange`, which throw. Supplementary characters to UCS-2 answer `UNASSIGNED_CODE`; other errors follow the GBK forms
+- [sceCesRefersUcsProfileCp1250](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with the Windows-1250 table of Microsoft's [bestfit1250.txt](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit1250.txt), except bytes 0x81, 0x83, 0x88, 0x90 and 0x98, which are unassigned. PPSA34501 fails to start without this export (`qYu6y1E0Qbg`)
+- [sceCesSbcToUtf8 and sceCesUtf8ToSbc](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) follow a payload process on a PS5 (firmware 13.60): the three tables match the console byte for byte, with Cp1252 bytes 0x81, 0x8D, 0x8F, 0x90 and 0x9D unassigned; a null profile returns `0x805C0004`; and the length and output are cleared first, as the console does. `sceCesUtf8ToSbc` decodes leads up to 0xFD (5- and 6-byte forms), returns `0x805C0015` for overlong forms and surrogates and reports the measured lengths. The console reads any other profile pointer as a table, where these return the invalid-parameter error; which of a null profile and a scalar above U+10FFFF it reports first is not measured
+- [MBCS string conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - `sceCesUtf8StrToMbcsStr`, `sceCesUcs2StrToMbcsStr`, `sceCesMbcsStrToUtf8Str`, `sceCesMbcsStrToUcs2Str` and their `Get*Len` forms follow a payload process on a PS5 (firmware 13.60) with the Cp1252 and EUC-JP profiles: the lengths are cleared and a terminator is written first, then the context, the source and the output are checked in that order; a source limit of 0 reads up to the terminating zero; the output keeps room for a terminator; and on an error the characters before it stay converted, terminated and counted. They decode UTF-8 as `sceCesUtf8ToSbc` does, and a UTF-16 surrogate answers `0x805C0015`. The UCS-2 forms and the other profiles were not measured beyond these cases. A zero-filled context converted nothing and returned 0 on the console, where this returns the invalid-parameter error
+- [EUC-JP and Shift-JIS encoding](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) with the CP51932 and CP932 profiles gives the result, lengths and bytes a payload process read on a PS5 (firmware 13.60) for every UCS-2 value through `sceCesUcs2StrToMbcsStr` (the test pins a hash of both sweeps): the JIS forms U+00A2, U+00A3, U+00A5, U+00AC, U+2014, U+2016, U+203E, U+2212 and U+301C encode to the cells of their Microsoft forms, U+FEFF is consumed and writes nothing, EUC-JP writes U+0080-U+009F other than U+008E and U+008F as single bytes and answers `UNASSIGNED_CODE` for U+000E, and Shift-JIS answers `0x805C0024` for U+0080-U+009F. Decoding those bytes back is unchanged
+- [Generic MBCS character and Shift-JIS code helpers](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - UTF-8/UTF-16 buffer errors and size pointers are unverified. Measured on a PS5: the single-character encoders (`sceCesUtf32ToMbc` over U+0000-U+110001 per profile, surrogates, a one-byte target) give 0x805C0015 for a surrogate, 0x805C0014 past U+10FFFF, the needed length with `DST_BUFFER_END` and 0 otherwise; a rejected decoded character (`sceCesMbcTo*` and each encoding's `To{Ucs2,Utf8,Utf16,Utf32}`, not `sceCesEucJpToUcs2`/`ToUtf8`) stores its length (the bytes before a NUL after the lead, the needed length when truncated, 1 for a bad lead, the sequence for a bad or unassigned trail), a zero UCS-2/UTF-32 character and no UTF-8/UTF-16 units. `sceCesMbcTo*` and `sceCes*ToMbc` take any profile the MBCS context accepts. `sceCesSJisGetCode`/`PutCode` are unchecked; `sceCesSJisCodeToJisX0213` and back use JIS X 0213 annex 1. Signatures follow Orbital
 - [Single-byte profiles](../../../core/libs/prx/libSceCesCs/SingleByte.hpp) (libSceCesCs) - the console's tables for these 27 profiles are not verified. Each returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with bytes 0x00-0x7F unchanged and the high half of a public table: ISO 8859-1, -2, -4, -5, -9, -10, -13, -14, -15 and -16 from [unicode.org](https://unicode.org/Public/MAPPINGS/ISO8859/), code pages 437, 737, 775, 850, 852, 855, 860-863, 865 and 866 from [Microsoft's PC tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/), KOI8-R and KOI8-U from [unicode.org](https://unicode.org/Public/MAPPINGS/VENDORS/MISC/), and 1254, 1256 and 1258 from Microsoft's [best-fit tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/), whose unassigned bytes map to C1 controls as in Cp1250. Profiles whose public table leaves bytes undefined or maps them to private use still throw
-- [libSceCesCs firmware 3.20 pending exports](../../../core/libs/prx/libSceCesCs/PendingExports.cpp) - 121 symbol names are present in [the PS5 3.20 libSceCesCs export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCesCs.c). Their signatures and console behaviour are unverified. The declarations use the existing no-parameter unknown-signature convention solely to resolve imports, and every call throws through `NotImplemented_nid_no_patch`.
-- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables, errors and Big5 duplicate choices are assumed, not measured. `sceCesUcsProfileInitEucKr`, `sceCesUcsProfileInitUhc` and `sceCesUcsProfileInitBig5Cp950` tag the caller's sheet like the EUC-JP profile. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT) and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`. Bytes below `0x80` are ASCII; the KS X 1003 single-byte profile (`sceCesEucKrUcsProfileSetSbcs`) is not implemented. The user-defined areas, which Windows maps to the Private Use Area, answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+2550, U+255E, U+2561, U+256A, U+5341 and U+5345, as Windows code page 950 does. The `*ToUtf8` calls convert one character and leave their outputs unchanged on failure
+- [libSceCesCs firmware 3.20 pending exports](../../../core/libs/prx/libSceCesCs/PendingExports.cpp) - 62 symbol names are present in [the PS5 3.20 libSceCesCs export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCesCs.c). Their signatures and console behaviour are unverified. The declarations use the existing no-parameter unknown-signature convention solely to resolve imports, and every call throws through `NotImplemented_nid_no_patch`.
+- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the errors are assumed; the decode tables and the Big5 duplicate choices were measured on a PS5 (`sceCesMbcToUtf32` and each `ToUtf8` over every one- and two-byte sequence): UHC and Big5 match, EUC-KR apart from its single bytes. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT), plus `0xA2E8` U+327E from KS X 1001:2002, and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`, below `0x80` ASCII; the KS X 1003 profile is not implemented. User-defined areas answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+5341 and U+5345, as a PS5's `sceCesUtf32ToMbc` does for every scalar (CP950 takes the higher cell of U+2550, U+255E, U+2561 and U+256A; the console does not). The profiles tag the caller's sheet like the EUC-JP profile
diff --git a/docs/dev/debt/libSceCompanionUtil.md b/docs/dev/debt/libSceCompanionUtil.md
index 48d3c1cb47..652949f2b7 100644
--- a/docs/dev/debt/libSceCompanionUtil.md
+++ b/docs/dev/debt/libSceCompanionUtil.md
@@ -2,4 +2,5 @@
 
 ### Unknown function info
 
-- [sceCompanionUtilGetEvent, sceCompanionUtilGetRemoteOskEvent, sceCompanionUtilInitialize, sceCompanionUtilOptParamInitialize and sceCompanionUtilTerminate](../../../core/libs/prx/libSceCompanionUtil/Export.cpp) (libSceCompanionUtil) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCompanionUtil.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceCompanionUtilGetEvent](../../../core/libs/prx/libSceCompanionUtil/Export.cpp) - the PS5 argument contract, event size and alignment remain unverified for the output pointer. The supplied `libSceCompanionUtil.sprx` export `cE5Msy11WhU` at 0x100 only returns `0x80AD0008`, without reading argument registers or memory. The implementation preserves that return and does not access the buffer.
+- [sceCompanionUtilGetRemoteOskEvent, sceCompanionUtilInitialize, sceCompanionUtilOptParamInitialize and sceCompanionUtilTerminate](../../../core/libs/prx/libSceCompanionUtil/Export.cpp) (libSceCompanionUtil) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCompanionUtil.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceComposite.md b/docs/dev/debt/libSceComposite.md
index 45ba88b721..36d78197ce 100644
--- a/docs/dev/debt/libSceComposite.md
+++ b/docs/dev/debt/libSceComposite.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [sceCompositorAllocateIndex, sceCompositorCheckCrash, sceCompositorCommandGpuPerfBegin, sceCompositorCommandGpuPerfEnd, sceCompositorCreateIndirectRenderTarget, sceCompositorDeleteIndirectRenderTarget, sceCompositorFlush, sceCompositorFlushWithRepeat, sceCompositorGetAnotherProcessSystemAddress, sceCompositorGetAnotherProcessSystemSize, sceCompositorGetAnotherProcessVideoAddress, sceCompositorGetAnotherProcessVideoSize, sceCompositorGetCanvasHandle, sceCompositorGetClientList, sceCompositorGetDmemOffset, sceCompositorGetDummyAddress, sceCompositorGetDummySize, sceCompositorGetRemainedCommandNum, sceCompositorGetRenderTargetResolution, sceCompositorGetSystemAddress, sceCompositorGetSystemSize, sceCompositorGetVideoAddress, sceCompositorGetVideoSize, sceCompositorHandleProcessEvents, sceCompositorInit, sceCompositorInitWithProcessOrder, sceCompositorInsertThreadTraceMarker, sceCompositorIsDebugCaptureEnabled, sceCompositorIsReady4K, sceCompositorLockCommandBuffer, sceCompositorMakeCanvasHandle, sceCompositorMapAnotherProcess, sceCompositorMemoryPoolDecommit, sceCompositorPrivacyMaskPushArea, sceCompositorQuit, sceCompositorReleaseCommandBuffer, sceCompositorReleaseIndex, sceCompositorReleaseLocalStall, sceCompositorReserveCommandBuffer, sceCompositorResetZoomCommand, sceCompositorSetAgcCompositeCanvasCommand, sceCompositorSetAgcContextCommand, sceCompositorSetCompositeCanvasCommandInC, sceCompositorSetCursorImageAddress, sceCompositorSetDebugPositionCommand, sceCompositorSetEndOfFrameCommand, sceCompositorSetEventCommand, sceCompositorSetFilterType, sceCompositorSetFlipCommand2, sceCompositorSetGameSufaceControlCommand, sceCompositorSetGnmContextCommand, sceCompositorSetIndirectCanvasCommand, sceCompositorSetIndirectCompositionCommand, sceCompositorSetIndirectRenderTargetConfigCommand, sceCompositorSetInvisibleCanvasCommand, sceCompositorSetKeepDisplayBufferCommand, sceCompositorSetLocalStallCommand, sceCompositorSetMemoryCommand, sceCompositorSetPatchCommand, sceCompositorSetPostEventCommand, sceCompositorSetRepeatCommand, sceCompositorSetResolutionCommand, sceCompositorSetScalingLayoutInfo, sceCompositorSetSeparateContextCommand, sceCompositorSetSystemConfigWithMask, sceCompositorSetVideoOutMode, sceCompositorSetVirtualCanvasAgcContextCommand, sceCompositorSetVirtualCanvasCommandFooter, sceCompositorSetVirtualCanvasPatchCommand, sceCompositorSetVrMode, sceCompositorSetZoomCommand, sceCompositorSystemConfig, sceCompositorWaitEndOfRendering, sceCompositorWaitEvent, sceCompositorWaitPostEvent, sceCompsoitorGetGpuClock, sceCompsoitorGetProcessRenderingTime and sceCompsoitorGetRenderingTime](../../../core/libs/prx/libSceComposite/Export.cpp) (libSceComposite) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceComposite.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceCompositorAllocateIndex, sceCompositorCheckCrash, sceCompositorCommandGpuPerfBegin, sceCompositorCommandGpuPerfEnd, sceCompositorFlush, sceCompositorFlushWithRepeat, sceCompositorGetAnotherProcessSystemAddress, sceCompositorGetAnotherProcessSystemSize, sceCompositorGetAnotherProcessVideoAddress, sceCompositorGetAnotherProcessVideoSize, sceCompositorGetCanvasHandle, sceCompositorGetClientList, sceCompositorGetDmemOffset, sceCompositorGetDummyAddress, sceCompositorGetDummySize, sceCompositorGetRemainedCommandNum, sceCompositorGetRenderTargetResolution, sceCompositorGetSystemAddress, sceCompositorGetSystemSize, sceCompositorGetVideoAddress, sceCompositorGetVideoSize, sceCompositorHandleProcessEvents, sceCompositorInit, sceCompositorInitWithProcessOrder, sceCompositorInsertThreadTraceMarker, sceCompositorIsDebugCaptureEnabled, sceCompositorIsReady4K, sceCompositorLockCommandBuffer, sceCompositorMakeCanvasHandle, sceCompositorMapAnotherProcess, sceCompositorMemoryPoolDecommit, sceCompositorPrivacyMaskPushArea, sceCompositorQuit, sceCompositorReleaseCommandBuffer, sceCompositorReleaseIndex, sceCompositorReleaseLocalStall, sceCompositorReserveCommandBuffer, sceCompositorResetZoomCommand, sceCompositorSetAgcCompositeCanvasCommand, sceCompositorSetAgcContextCommand, sceCompositorSetCompositeCanvasCommandInC, sceCompositorSetCursorImageAddress, sceCompositorSetDebugPositionCommand, sceCompositorSetEndOfFrameCommand, sceCompositorSetEventCommand, sceCompositorSetFilterType, sceCompositorSetFlipCommand2, sceCompositorSetGameSufaceControlCommand, sceCompositorSetGnmContextCommand, sceCompositorSetInvisibleCanvasCommand, sceCompositorSetKeepDisplayBufferCommand, sceCompositorSetLocalStallCommand, sceCompositorSetMemoryCommand, sceCompositorSetPatchCommand, sceCompositorSetPostEventCommand, sceCompositorSetRepeatCommand, sceCompositorSetResolutionCommand, sceCompositorSetScalingLayoutInfo, sceCompositorSetSeparateContextCommand, sceCompositorSetSystemConfigWithMask, sceCompositorSetVideoOutMode, sceCompositorSetVirtualCanvasAgcContextCommand, sceCompositorSetVirtualCanvasCommandFooter, sceCompositorSetVirtualCanvasPatchCommand, sceCompositorSetVrMode, sceCompositorSetZoomCommand, sceCompositorSystemConfig, sceCompositorWaitEndOfRendering, sceCompositorWaitEvent, sceCompositorWaitPostEvent, sceCompsoitorGetGpuClock, sceCompsoitorGetProcessRenderingTime and sceCompsoitorGetRenderingTime](../../../core/libs/prx/libSceComposite/Export.cpp) (libSceComposite) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceComposite.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceDiscId.md b/docs/dev/debt/libSceDiscId.md
index 17eb02c445..8401e28ef4 100644
--- a/docs/dev/debt/libSceDiscId.md
+++ b/docs/dev/debt/libSceDiscId.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [sceDiscIdGet](../../../core/libs/prx/libSceDiscId/Export.cpp) takes one output pointer; `sceDiscIdGet2` takes an output pointer and a 32-bit argument that must be zero. Both pass the pointer to a device ioctl without accessing its contents. Output structure sizes and fields require the device-side implementation or a caller and remain unresolved.
+- [sceDiscIdGet, sceDiscIdGet2](../../../core/libs/prx/libSceDiscId/Export.cpp): `sceDiscIdGet` takes one output pointer; `sceDiscIdGet2` takes an output pointer and a 32-bit argument whose accepted values remain unresolved (it may be a bitfield). Both throw `NotImplemented_nid_no_patch` without reading or writing caller memory: the optical drive backend, the output structure layout, accepted flags and error returns remain unverified on hardware, so the unsupported behavior stays explicit.
diff --git a/docs/dev/debt/libSceFiber.md b/docs/dev/debt/libSceFiber.md
index 9ad010851f..da142ae02b 100644
--- a/docs/dev/debt/libSceFiber.md
+++ b/docs/dev/debt/libSceFiber.md
@@ -6,7 +6,8 @@
 
 ### Unknown function info
 
-- [_sceFiberInitializeWithInternalOptionImpl](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - its signature follows shadPS4's [initialize implementations](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L150-L153); its export alias is mapped at [RegisterLib](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L548-L551). Not measured on a console; the throwing declaration only resolves the import.
-- [_sceFiberAttachContextAndRun, _sceFiberAttachContextAndSwitch](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - signatures follow shadPS4's [run implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L260-L261) and [switch implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L336-L337); their export aliases are mapped at [RegisterLib](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L555-L563). Not measured on a console; the throwing declarations only resolve imports.
+- [_sceFiberInitializeWithInternalOptionImpl](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - its signature and the flag values `0x1` (no ulobjmgr registration), `0x10` (context size check) and `0x100` (start with MXCSR `0x9fc0` and x87 control word `0x037f`) follow shadPS4's [initialize implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L150-L153) and [flags](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.h#L27-L32). Not measured on a console. `0x1` has no effect because no ulobjmgr exists; other flag bits throw. shadPS4 also sets `0x100` for `build_version` 3.50 and later in every initialize; `opt_param` and `build_version` are ignored.
+- [_sceFiberAttachContextAndRun, _sceFiberAttachContextAndSwitch](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - signatures and behaviour follow shadPS4's [run](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L260-L261), [switch](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L336-L337) and [attach](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L46-L79) implementations, not measured on a console. A context is attached only to an idle fiber initialized without one; a fiber that already has a context, or is not idle, returns `SCE_FIBER_ERROR_INVALID`. A size that is not a multiple of 16 returns `SCE_FIBER_ERROR_ALIGNMENT` as in initialize, where shadPS4 returns `SCE_FIBER_ERROR_INVALID`.
+- [Fibers without a context](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - caller-stack execution and restart after yielding follow shadPS4 at commit `f68923fe807f657348e6719ce658bcbd0a2b1c72` ([run](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L238-L307), [switch](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L309-L360), [return](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L376-L401)), not measurements on a PS5. The original calling thread stack is reused even when switching from an attached fiber; contextless continuations are discarded.
 - [_sceFiberGetThreadFramePointerAddress](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber, NID `0dy4JtMUcMQ`) forwards to `sceFiberGetThreadFramePointerAddress`; that the argument list matches is inferred from the export without the underscore, as for the underscore Ult exports, not measured
 - [Fiber stacks](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - a fiber whose context is smaller than 64 KiB runs on an mmap'd host stack of its context size plus 1 MiB, so host calls made from it (21 KiB deep when PPSA01341 reaches SPIRV-Tools from a 16 KiB context) do not overwrite the contexts packed next to it; a larger context is the stack, as on the console. PPSA05684 needs the second: its job fibers have 64 KiB and 512 KiB contexts, the 512 KiB ones at 1 MiB-aligned addresses, and find their job record by masking the stack pointer (`~0xfffff` for the 512 KiB ones), which a host stack breaks (the game waits forever in GameInit, or faults later in a 64 KiB fiber). The 64 KiB limit is chosen between these two titles, not measured: a title with small contexts that also derives state from the stack pointer, or one whose host calls exceed what is left of a large context, is not covered
diff --git a/docs/dev/debt/libSceFios2.md b/docs/dev/debt/libSceFios2.md
index ac6b0499b6..7b43eb0959 100644
--- a/docs/dev/debt/libSceFios2.md
+++ b/docs/dev/debt/libSceFios2.md
@@ -2,4 +2,6 @@
 
 ### Unknown function info
 
-- [sceFiosArchiveGetDecompressorThreadCount, sceFiosArchiveGetMountBufferSize, sceFiosArchiveGetMountBufferSizeSync, sceFiosArchiveMount, sceFiosArchiveMountSync, sceFiosArchiveMountWithOrder, sceFiosArchiveMountWithOrderSync, sceFiosArchiveSetDecompressorThreadCount, sceFiosArchiveUnmount, sceFiosArchiveUnmountSync, sceFiosCacheContainsFileRangeSync, sceFiosCacheContainsFileSync, sceFiosCacheFlushFileRangeSync, sceFiosCacheFlushFileSync, sceFiosCacheFlushSync, sceFiosCachePrefetchFH, sceFiosCachePrefetchFHRange, sceFiosCachePrefetchFHRangeSync, sceFiosCachePrefetchFHSync, sceFiosCachePrefetchFile, sceFiosCachePrefetchFileRange, sceFiosCachePrefetchFileRangeSync, sceFiosCachePrefetchFileSync, sceFiosCancelAllOps, sceFiosClearTimeStamps, sceFiosCloseAllFiles, sceFiosDHClose, sceFiosDHCloseSync, sceFiosDHGetPath, sceFiosDHOpen, sceFiosDHOpenSync, sceFiosDHRead, sceFiosDHReadSync, sceFiosDLLInitialize, sceFiosDLLTerminate, sceFiosDateFromComponents, sceFiosDateGetCurrent, sceFiosDateToComponents, sceFiosDeallocatePassthruFH, sceFiosDebugDumpDH, sceFiosDebugDumpDate, sceFiosDebugDumpError, sceFiosDebugDumpFH, sceFiosDebugDumpOp, sceFiosDelete, sceFiosDeleteSync, sceFiosDirectoryCreate, sceFiosDirectoryCreateSync, sceFiosDirectoryCreateWithMode, sceFiosDirectoryCreateWithModeSync, sceFiosDirectoryDelete, sceFiosDirectoryDeleteSync, sceFiosDirectoryExists, sceFiosDirectoryExistsSync, sceFiosExists, sceFiosExistsSync, sceFiosFHClose, sceFiosFHCloseSync, sceFiosFHGetOpenParams, sceFiosFHGetPath, sceFiosFHGetSize, sceFiosFHOpen, sceFiosFHOpenSync, sceFiosFHOpenWithMode, sceFiosFHOpenWithModeSync, sceFiosFHPread, sceFiosFHPreadSync, sceFiosFHPreadv, sceFiosFHPreadvSync, sceFiosFHPwrite, sceFiosFHPwriteSync, sceFiosFHPwritev, sceFiosFHPwritevSync, sceFiosFHRead, sceFiosFHReadSync, sceFiosFHReadv, sceFiosFHReadvSync, sceFiosFHSeek, sceFiosFHStat, sceFiosFHStatSync, sceFiosFHSync, sceFiosFHSyncSync, sceFiosFHTell, sceFiosFHToFileno, sceFiosFHTruncate, sceFiosFHTruncateSync, sceFiosFHWrite, sceFiosFHWriteSync, sceFiosFHWritev, sceFiosFHWritevSync, sceFiosFileDelete, sceFiosFileDeleteSync, sceFiosFileExists, sceFiosFileExistsSync, sceFiosFileGetSize, sceFiosFileGetSizeSync, sceFiosFileRead, sceFiosFileReadSync, sceFiosFileTruncate, sceFiosFileTruncateSync, sceFiosFileWrite, sceFiosFileWriteSync, sceFiosFilenoToFH, sceFiosGetAllDHs, sceFiosGetAllFHs, sceFiosGetAllOps, sceFiosGetDefaultOpAttr, sceFiosGetGlobalDefaultOpAttr, sceFiosGetSuspendCount, sceFiosGetThreadDefaultOpAttr, sceFiosIOFilterAdd, sceFiosIOFilterCache, sceFiosIOFilterGetInfo, sceFiosIOFilterPsarcDearchiver, sceFiosIOFilterRemove, sceFiosInitialize, sceFiosIsIdle, sceFiosIsInitialized, sceFiosIsSuspended, sceFiosIsValidHandle, sceFiosOpCancel, sceFiosOpDelete, sceFiosOpGetActualCount, sceFiosOpGetAttr, sceFiosOpGetBuffer, sceFiosOpGetError, sceFiosOpGetOffset, sceFiosOpGetPath, sceFiosOpGetRequestCount, sceFiosOpIsCancelled, sceFiosOpIsDone, sceFiosOpReschedule, sceFiosOpRescheduleWithPriority, sceFiosOpSetBuffer, sceFiosOpSyncWait, sceFiosOpSyncWaitForIO, sceFiosOpWait, sceFiosOpWaitUntil, sceFiosOverlayAdd, sceFiosOverlayGetInfo, sceFiosOverlayGetList, sceFiosOverlayModify, sceFiosOverlayRemove, sceFiosOverlayResolveSync, sceFiosPathNormalize, sceFiosPathcmp, sceFiosPathncmp, sceFiosPrintTimeStamps, sceFiosPrintf, sceFiosRename, sceFiosRenameSync, sceFiosResolve, sceFiosResolveSync, sceFiosResume, sceFiosSaveTimeStamp, sceFiosSetGlobalDefaultOpAttr, sceFiosSetThreadDefaultOpAttr, sceFiosShutdownAndCancelOps, sceFiosStat, sceFiosStatSync, sceFiosSuspend, sceFiosTerminate, sceFiosTimeGetCurrent, sceFiosTimeIntervalFromNanoseconds, sceFiosTimeIntervalToNanoseconds, sceFiosTraceTimestamp, sceFiosUpdateParameters and sceFiosVprintf](../../../core/libs/prx/libSceFios2/Export.cpp) (libSceFios2) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFios2.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceFiosArchiveGetDecompressorThreadCount, sceFiosArchiveGetMountBufferSize, sceFiosArchiveGetMountBufferSizeSync, sceFiosArchiveMount, sceFiosArchiveMountSync, sceFiosArchiveMountWithOrder, sceFiosArchiveMountWithOrderSync, sceFiosArchiveSetDecompressorThreadCount, sceFiosArchiveUnmount, sceFiosArchiveUnmountSync, sceFiosCacheContainsFileRangeSync, sceFiosCacheContainsFileSync, sceFiosCacheFlushFileRangeSync, sceFiosCacheFlushFileSync, sceFiosCacheFlushSync, sceFiosCachePrefetchFH, sceFiosCachePrefetchFHRange, sceFiosCachePrefetchFHRangeSync, sceFiosCachePrefetchFHSync, sceFiosCachePrefetchFile, sceFiosCachePrefetchFileRange, sceFiosCachePrefetchFileRangeSync, sceFiosCachePrefetchFileSync, sceFiosCancelAllOps, sceFiosClearTimeStamps, sceFiosCloseAllFiles, sceFiosDHClose, sceFiosDHCloseSync, sceFiosDHGetPath, sceFiosDHOpen, sceFiosDHOpenSync, sceFiosDHRead, sceFiosDHReadSync, sceFiosDLLInitialize, sceFiosDLLTerminate, sceFiosDeallocatePassthruFH, sceFiosDebugDumpDH, sceFiosDebugDumpDate, sceFiosDebugDumpError, sceFiosDebugDumpFH, sceFiosDebugDumpOp, sceFiosDelete, sceFiosDeleteSync, sceFiosDirectoryCreate, sceFiosDirectoryCreateSync, sceFiosDirectoryCreateWithMode, sceFiosDirectoryCreateWithModeSync, sceFiosDirectoryDelete, sceFiosDirectoryDeleteSync, sceFiosDirectoryExists, sceFiosDirectoryExistsSync, sceFiosExists, sceFiosExistsSync, sceFiosFHClose, sceFiosFHCloseSync, sceFiosFHGetOpenParams, sceFiosFHGetPath, sceFiosFHGetSize, sceFiosFHOpen, sceFiosFHOpenSync, sceFiosFHOpenWithMode, sceFiosFHOpenWithModeSync, sceFiosFHPread, sceFiosFHPreadSync, sceFiosFHPreadv, sceFiosFHPreadvSync, sceFiosFHPwrite, sceFiosFHPwriteSync, sceFiosFHPwritev, sceFiosFHPwritevSync, sceFiosFHRead, sceFiosFHReadSync, sceFiosFHReadv, sceFiosFHReadvSync, sceFiosFHSeek, sceFiosFHStat, sceFiosFHStatSync, sceFiosFHSync, sceFiosFHSyncSync, sceFiosFHTell, sceFiosFHToFileno, sceFiosFHTruncate, sceFiosFHTruncateSync, sceFiosFHWrite, sceFiosFHWriteSync, sceFiosFHWritev, sceFiosFHWritevSync, sceFiosFileDelete, sceFiosFileDeleteSync, sceFiosFileExists, sceFiosFileExistsSync, sceFiosFileGetSize, sceFiosFileGetSizeSync, sceFiosFileRead, sceFiosFileReadSync, sceFiosFileTruncate, sceFiosFileTruncateSync, sceFiosFileWrite, sceFiosFileWriteSync, sceFiosFilenoToFH, sceFiosGetAllDHs, sceFiosGetAllFHs, sceFiosGetAllOps, sceFiosGetDefaultOpAttr, sceFiosGetGlobalDefaultOpAttr, sceFiosGetSuspendCount, sceFiosGetThreadDefaultOpAttr, sceFiosIOFilterAdd, sceFiosIOFilterCache, sceFiosIOFilterGetInfo, sceFiosIOFilterPsarcDearchiver, sceFiosIOFilterRemove, sceFiosInitialize, sceFiosIsIdle, sceFiosIsInitialized, sceFiosIsSuspended, sceFiosOpCancel, sceFiosOpDelete, sceFiosOpGetActualCount, sceFiosOpGetAttr, sceFiosOpGetBuffer, sceFiosOpGetError, sceFiosOpGetOffset, sceFiosOpGetPath, sceFiosOpGetRequestCount, sceFiosOpIsCancelled, sceFiosOpIsDone, sceFiosOpReschedule, sceFiosOpRescheduleWithPriority, sceFiosOpSetBuffer, sceFiosOpSyncWait, sceFiosOpSyncWaitForIO, sceFiosOpWait, sceFiosOpWaitUntil, sceFiosOverlayAdd, sceFiosOverlayGetInfo, sceFiosOverlayGetList, sceFiosOverlayModify, sceFiosOverlayRemove, sceFiosOverlayResolveSync, sceFiosPathNormalize, sceFiosPathcmp, sceFiosPathncmp, sceFiosPrintTimeStamps, sceFiosPrintf, sceFiosRename, sceFiosRenameSync, sceFiosResolve, sceFiosResolveSync, sceFiosResume, sceFiosSaveTimeStamp, sceFiosSetGlobalDefaultOpAttr, sceFiosSetThreadDefaultOpAttr, sceFiosShutdownAndCancelOps, sceFiosStat, sceFiosStatSync, sceFiosSuspend, sceFiosTerminate, sceFiosTimeGetCurrent, sceFiosTimeIntervalFromNanoseconds, sceFiosTimeIntervalToNanoseconds, sceFiosTraceTimestamp, sceFiosUpdateParameters and sceFiosVprintf](../../../core/libs/prx/libSceFios2/Export.cpp) (libSceFios2) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFios2.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+
+- [sceFiosDateFromComponents, sceFiosDateGetCurrent, sceFiosDateToComponents and sceFiosIsValidHandle](../../../core/libs/prx/libSceFios2/Export.cpp) (libSceFios2) - the date packing and the handle validity rule are unverified and the declarations in Export.cpp still carry no parameters. kalaposfos13/fios2 (`src/fios2.h`, PS4) and RPCS3 (`Emu/PSP2/Modules/sceFios.cpp`) independently declare `sceFiosDateFromComponents(tm*)` and `sceFiosDateGetCurrent()` returning a 64-bit date, `sceFiosDateToComponents(int64_t, tm*)` returning the `tm` pointer and `sceFiosIsValidHandle(int)` returning a bool, but both may descend from one leaked Vita SDK and kalaposfos13's bodies are guesses (`mktime` times 1e9). sonny-tel/libSceFios2 (a header read from a Fortnite build) also declares `sceFiosIsValidHandle(int)` and gives `SceFiosParams`, `SceFiosOpAttr`, `SceFiosOpenParams` and `SceFiosStat` layouts, unverified against firmware
diff --git a/docs/dev/debt/libSceFont.md b/docs/dev/debt/libSceFont.md
index b1b5e56398..13154d0ebc 100644
--- a/docs/dev/debt/libSceFont.md
+++ b/docs/dev/debt/libSceFont.md
@@ -2,13 +2,17 @@
 
 ### Unknown function info
 
+
+- [sceFontRenderCharGlyphImage, sceFontRenderCharGlyphImageHorizontal, sceFontRenderCharGlyphImageVertical](../../../core/libs/prx/libSceFont/src/Layout.cpp) (libSceFont) accept a surface whose width or height is 0, with any row stride, and return the glyph metrics and an empty update rectangle without writing to the surface. A negative width, height or stride, a zero stride on a surface with pixels, a null buffer and a pixel size other than 1 or 4 bytes still return `SCE_FONT_ERROR_NO_SUPPORT_SURFACE`; those cases and the exact console result for a zero-extent surface are not measured. The extent-0 behaviour is inferred from the Tekken Dark Resurrection PSP emulator which, to measure a string, initialises the surface with width 0 and height 31 and an unbound stride, renders each character and sums the returned advances.
+
+- [sceFontCreateString](../../../core/libs/prx/libSceFont/src/Text.cpp): a string created from a default-form (0x10) text source gets the direction of its first strong character, 0x11 for right to left and 0x12 for left to right, and 0x12 when there is none; explicit 0x11 and 0x12 sources keep their form and [sceFontStringGetWritingForm](../../../core/libs/prx/libSceFont/src/Text.cpp) returns the stored form. LRM and RLM count as strong, embeddings and overrides do not, and text between an isolate initiator and its PDI is skipped. The rule follows a run of the firmware 13.42 library in a harness reported on the pull request: for non-empty text it was checked before a later glyph-stage failure and only empty text completed, so it is not full native right-to-left rendering. Which characters are strong is decided here by Unicode block ranges, not by the full bidi class tables.
 - [Typographic design](../../../core/libs/prx/libSceFont/src/Style.cpp): native selector, feature, font-set eligibility and output-clearing rules are recovered. Driver typography selection and queries, feature-cache updates and glyph substitution remain unimplemented and throw instead of storing arbitrary selector/value pairs.
 - [sceFontSetScriptLanguage and sceFontGetScriptLanguage](../../../core/libs/prx/libSceFont/src/Style.cpp): native script/language ranges, handle-error precedence and clearing of failed getter outputs are implemented. Valid driver queries and updates throw; the previous arbitrary-value map and fabricated zero default are no longer used. Driver selection and actual language-dependent shaping remain unimplemented.
 - [sceFontGetRenderScaledKerning](../../../core/libs/prx/libSceFont/src/Render.cpp) (libSceFont) - arguments, the cleared output and the bound renderer check taken from `cellFontGetRenderScaledKerning` in [RPCS3](https://github.com/RPCS3/rpcs3/blob/master/rpcs3/Emu/Cell/Modules/cellFont.cpp) (PS3 predecessor of the library), not confirmed on a title. The kerning is the `sceFontGetKerning` one at the render scale
 - [sceFontGetFontGlyphsCount, sceFontGetCharGlyphCode](../../../core/libs/prx/libSceFont/src/Open.cpp): signatures, error precedence, failed-output clearing and external-font glyph-code encoding are confirmed by the PS5 library. Multi-face system-font glyph counts, face-selection bits and typographic glyph substitutions are not modeled.
 - [sceFontGetFontResolution](../../../core/libs/prx/libSceFont/src/Open.cpp): the 32-bit resolution output, float scale and nullable outputs are confirmed by the PS5 library and FontFt driver. Native system font sets return resolution 1000; the host still uses its selected face resolution because multi-face system font sets are not modeled.
 - [Writing-line ABI and allocation](../../../core/libs/prx/libSceFont/src/WritingLine.cpp): PS5 layouts, creation forms, memory validation, allocator callbacks and error handling are recovered. The 2208-byte line and 64-byte orders use caller memory. Host registry bookkeeping still allocates separately; memory lifetime and concurrent destruction require caller synchronization.
-- [sceFontWritingRefersRenderStepCharacter](../../../core/libs/prx/libSceFont/src/Text.cpp) (libSceFont) - the second argument is an out pointer to the writing's letter step, as in [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1882-L1896) and the [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Font/SceFont.Engine.cs) bindings. Measured on PS4 firmware 11.00 `libSceFont.sprx` (not on a PS5): exactly 8 bytes are written, the address of a step stored inside the writing, and a null writing writes null; shadPS4 and prosper treat the argument as a struct, which the measurement contradicts. The letter step lives in the writing, so the pointer stays valid as long as the writing does, and its contents are rebuilt by each call of this function. On the PS4 library repeated calls on one step walk the characters it covers and then return null; here every call returns the step's one character, so the second call differs. Assumed: each step covers one character and one glyph. PPSA06699 (Hot Shots Golf 2) dereferences the returned pointer for its character counts.
+- [sceFontWritingRefersRenderStepCharacter](../../../core/libs/prx/libSceFont/src/Text.cpp): PS5 traversal and multi-character shaping remain unverified; the host has one character and glyph per step. PS4 11.00 measurements establish an 8-byte pointer output into the writing, null for a null writing, and traversal to null after the current step is exhausted. The pointer ABI agrees with [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1882-L1896) and SharpProspero; shadPS4 and prosper instead treat the output as a struct. The internal letter step remains valid until writing destruction and is rebuilt when a character is returned.
 - [sceFontWritingLineGetOrderingSpace](../../../core/libs/prx/libSceFont/src/WritingLine.cpp): PS5 confirms output order, calculations and zeroed outputs on invalid handles. A non-null head output with a null tail output causes an unchecked native write; the host throws instead. With no head output, the tail output remains untouched.
 - [sceFontCharacterGetSyllableStringState](../../../core/libs/prx/libSceFont/src/Text.cpp) (libSceFont) - the signature `(textCharacter, int* syllableStringState)` follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Font/SceFont.Engine.cs). Measured on PS4 firmware 11.00 `libSceFont.sprx` (not on a PS5): the state is 0 for Latin, CJK, Hangul, Arabic, Hebrew, Devanagari and the other scripts tried, and the library sets 1, 3 or 4 (never 2 on real text) for Thai while it creates the string; a null character or a null result returns `SCE_FONT_ERROR_INVALID_PARAMETER`, and a null character writes 0 to a non-null result. This returns 0 for every character outside the Thai block (U+0E00 to U+0E7F), as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1805-L1815) does, and throws for Thai characters, whose cluster states are not modelled. SharpProspero's `SceFontSyllableString` names 0 NonDetection, 1 Starting, 2 Following, 3 Depending and 4 Connecting. PPSA06699 (Hot Shots Golf 2) calls it.
 - [sceFontCharactersRefersTextCodes, sceFontTextCodesStepNext and sceFontTextCodesStepBack](../../../core/libs/prx/libSceFont/src/Text.cpp) (libSceFont) - the signatures follow the [Orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json#L679) IDA type database and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Font/SceFont.Engine.cs#L395-L406), and the 64-byte `FontTextCodes` with the order pointer at 0 and the code at 8 follows SharpProspero's [SceFontTextCodes](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Font/SceFontStructs.cs#L216-L228). The traversal follows the PS4 11.00 `libSceFont.sprx` disassembly posted in [#4050](https://github.com/boykopovar/AnyPS5/pull/4050#issuecomment-6114504202), not a PS5 measurement: the cursor keeps the current, start and term characters at +0x28, +0x30 and +0x38; `Refers` never compares the character with the term and returns null for a clustered or synthetic character; `StepNext` returns null at the term after visiting it; `StepBack` returns null when the current character is the start; both steps skip synthetic characters. Assumed and not covered by the report, which says `StepNext` returns null only at the term: `StepNext` also returns null at the end of the chain (for example with a null term), and `StepBack` at the head of the chain. A null cursor or output returns null as in [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1696-L1740); a null text character throws, as its console result is unknown
@@ -17,14 +21,17 @@
 
 ### Functional
 
-- [sceFontOpenFontSet](../../../core/libs/prx/libSceFont/src/SystemFont.cpp) (libSceFont) - the other script files of a set are chosen from its type, not measured on a console: Vietnamese for low-byte bit 0x10, Thai for script bit 0x10, Japanese for 0x04, simplified Chinese for 0x80 (before Japanese with 0x08), Hangul for 0x20 and Arabic for low-byte bit 0x80, as the SDK set names (`..._JP_AR`, `..._GBCJK_TH`) listed by [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/font/font_internal.cpp) suggest; the file order and the Hangul file name (`SCEPS4Yoongd-Medium.otf`, `SCEPS4Yoongd-Bold.otf`) also come from shadPS4. A character the primary file lacks is taken from the first of them that has it; kerning between two files is 0, and `sceFontGetCharGlyphCode` and `sceFontGetFontGlyphsCount` answer for the primary file only
+- [sceFontOpenFontSet](../../../core/libs/prx/libSceFont/src/SystemFont.cpp) (libSceFont) - the other script files of a set and their priority are inferred, not measured on a console: Vietnamese for low-byte bit 0x10, Thai for script bit 0x10, Japanese for 0x04, simplified Chinese for 0x80 (before Japanese with 0x08), Hangul for 0x20 and Arabic for low-byte bit 0x80. The SDK set names (`..._JP_AR`, `..._GBCJK_TH`) and Hangul aliases (`SCEPS4Yoongd-Light.otf`, `SCEPS4Yoongd-Medium.otf`, `SCEPS4Yoongd-Bold.otf`) come from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/b45b289761ffcb4feed44df5f51b4bb5b5c0dfdc/src/core/libraries/font/font_internal.cpp); the Vietnamese bit rule and the priority used here are our inferences, not its fallback implementation. A character the primary file lacks is taken from the first of them that has it; kerning between two files is 0, and `sceFontGetCharGlyphCode` and `sceFontGetFontGlyphsCount` answer for the primary file only
 - [sceFontOpenFontSet](../../../core/libs/prx/libSceFont/src/SystemFont.cpp) (libSceFont) - the console file names are those of the PS4 firmware; the names of the PS5-only JG2 sets (`0x1A......`) are unknown, so they use the SSTJpPro files. When a console file is missing, an openly licensed substitute (Noto Sans, Noto Sans Mono, Noto Sans Thai, Noto Sans Arabic, Noto Sans CJK with its Korean face for Hangul) is loaded instead; its metrics differ, so text width, line height and wrapping differ from the console. System font faces are loaded by FreeType in host memory, not in the font memory the title passes to the library: FreeType needs about 1 MiB per CJK face, which the title's font memory is not sized for.
 - [sceFontGetCharGlyphMetrics, sceFontGetRenderCharGlyphMetrics](../../../core/libs/prx/libSceFont/src/Layout.cpp) (libSceFont) report the vertical metrics the way the [FreeType driver](../../../core/libs/prx/libSceFontFt/src/Driver.cpp) reports them for a rendered glyph, not confirmed on a title: FreeType's vertical advance, and for a face without vertical metrics a bearing of half the horizontal advance left of the horizontal bearing and of half the advance left over by the glyph height.
+- [sceFontGetFontMetrics](../../../core/libs/prx/libSceFont/src/Layout.cpp) (libSceFont) - the 64-byte output, the form fallbacks (2 and 3 fall back to the `hhea` values when OS/2 is missing or gives an empty range, 4 builds vertical values from `vhea` or OS/2) and the raw weight deltas and slant copied from the style are not measured on a console. For a font set the values are those of its primary file; which file the console reports is not recovered. Closes when: measured on a PS5
+- [sceFontGetFontStyleInformation](../../../core/libs/prx/libSceFont/src/Layout.cpp) (libSceFont) - the 24-byte output (FreeType family and style names, italic and bold flags, OS/2 weight class when it is a multiple of 100 from 100 to 900, width class below 10, and 1 plus a right-to-left `head` direction plus 0x80 for vertical metrics) and the font-set record path are not measured on a console. A face without a `head` table, such as a BDF font, throws, as its console result is unknown. Closes when: measured on a PS5
+- [sceFontGetFontGlyphsOutlineProfile](../../../core/libs/prx/libSceFont/src/Layout.cpp) (libSceFont) - the 16-byte output (the `maxp` maximum contours, points, composite contours and composite points) and `SCE_FONT_ERROR_NO_SUPPORT_FUNCTION` for a `maxp` older than 1.0 are not measured on a console. A handle with a font-set record throws, as the maximum over the record's system font entries is not modelled. A face without a `maxp` table throws, as its console result is unknown. Closes when: measured on a PS5
 - [Font writing lines](../../../core/libs/prx/libSceFont/src/WritingLine.cpp): visual ordering and spacing originated from PS4 measurements and match the supplied PS5 structure and control flow. Exhaustive floating-point equivalence, including NaN payloads and rounding, has not been verified against a running PS5 module.
 
-- [Font graphics and metric signatures](../../../core/libs/prx/libSceFont/src/Unimplemented.cpp): graphics-device/service creation takes font memory, parameters and a handle output; destruction takes a handle pointer. Attribute selectors and outputs are 32-bit values. Metric, outline-profile, style-information and expansion-buffer outputs remain opaque pending field recovery. Protected implementations are unchanged.
+- [Font graphics and metric signatures](../../../core/libs/prx/libSceFont/src/Unimplemented.cpp): graphics-device/service creation takes font memory, parameters and a handle output; destruction takes a handle pointer. Attribute selectors and outputs are 32-bit values. Expansion-buffer outputs remain opaque pending field recovery. Protected implementations are unchanged.
 
-- [Font graphics fill and transform signatures](../../../core/libs/prx/libSceFont/src/Unimplemented.cpp): region layout and scalar float arguments are confirmed from assembly, including the extra 32-bit corner flags omitted by the roundish-region decompilation. Fill-method, plot and rates layouts, layout selector meanings and mapping parameter meanings remain unresolved. Protected bodies are unchanged.
+- [Font graphics fill descriptors](../../../core/libs/prx/libSceFont/src/Graphics.cpp): the region, fill-method, fill-plot and fill-rates initialisers and setters, and `sceFontSetGraphicsErrorCallback`, follow firmware 13.60 `libSceFont.sprx` (read from disassembly, not measured on a console): argument checks in the same order, error codes, tags and the bytes written. What the layout selectors, mapping values, region corner flags and fill effects mean is unknown, because the calls that read these descriptors (`sceFontGraphicsSetup*`, `sceFontGraphicsUpdate*`) still throw. The error codes `0x80460086` to `0x80460089` have no public names; the source names them after the argument they reject
 
 Frame lifecycle, drawing completion, device usage, frame policy, clipping and fill setup/update argument signatures in [Unimplemented.cpp](../../../core/libs/prx/libSceFont/src/Unimplemented.cpp) are recovered. Frame and resource layouts remain opaque; their runtime implementation is still unavailable.
 
@@ -37,3 +44,4 @@ Canvas, design, surface texture and fill-pattern construction signatures in [Uni
 The [glyph support registration and texture-image fill signatures](../../../core/libs/prx/libSceFont/src/Unimplemented.cpp) are recovered from native argument use. The image constructor takes a byte span and four scalar coordinates; the decompiler omits its successful path. `CreateWords` and `CreateGraphicsServiceWithEdition` consume the output pointer in the fourth general-purpose argument slot but do not read the third slot, whose source type is not established.
 
 - [sceFontCreateGraphicsServiceWithEdition and sceFontCreateWords](../../../core/libs/prx/libSceFont/src/Unimplemented.cpp) take their handle output in the fourth integer argument slot. The third slot is not read by the supplied module and is represented as an opaque 64-bit value; its declared source type remains unknown.
+- [Word dictionaries](../../../core/libs/prx/libSceFont/src/Words.cpp): building, depth limit, sort and error rules and longest-match selection are read from disassembly, not measured on a console. The text source is parsed once instead of twice. More than 65535 nodes return `SCE_FONT_ERROR_FUNCTIONAL_LIMIT`, where the native 16-bit indices would wrap. The shape-entry test on the next character is skipped since strings built here have no shape entry. The low flag byte and flag bits 43-45 are tested as read; strings built here leave them clear, so names are ours.
diff --git a/docs/dev/debt/libSceFreeType.md b/docs/dev/debt/libSceFreeType.md
index c2af9e6074..205ee0df69 100644
--- a/docs/dev/debt/libSceFreeType.md
+++ b/docs/dev/debt/libSceFreeType.md
@@ -1,15 +1,28 @@
 # libSceFreeType technical debt
 
 ### Unknown function info
+- [FT_New_Size, FT_Activate_Size and FT_Done_Size](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures, errors and generic-finalizer ordering are unverified; the LP64 guest adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Private size fields are bridge-owned. Sizes created outside the bridge throw when selected.
+
+- [FT_Reference_Face](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signature, reference-counter limits and finalizer behavior are unverified; the LP64 guest adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Counter overflow and reentrant finalization have not been measured on the console.
 
 - [FT_Get_Sfnt_Name_Count, FT_Get_Sfnt_Name](../../../core/libs/prx/libSceFreeType/src/Names.cpp) (libSceFreeType) - console signatures, record layout and errors are unverified; the adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftsnames.c) and assumes the public LP64 `FT_SfntName` layout (24 bytes, string pointer at 8, byte length at 16). Strings retain their original encoding, borrow native face storage and remain valid only while the face is alive
 
 - [FT_Select_Charmap, FT_Set_Charmap, FT_Get_First_Char, FT_Get_Next_Char](../../../core/libs/prx/libSceFreeType/Export.cpp), [FT_Get_Glyph_Name, FT_Get_Name_Index, FT_Get_Postscript_Name](../../../core/libs/prx/libSceFreeType/src/Names.cpp) (libSceFreeType) - console signatures, naming rules and errors are unverified; the LP64 adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Iteration uses the low 32 input bits and updates only the selected guest charmap; charmap fields are read-only copies. Naming preserves LP64 invalid-index errors on Windows. PostScript names borrow native face storage and remain valid only while the face is alive
 
+- [FT_Cos, FT_Sin, FT_Tan, FT_Vector_Unit and FT_Angle_Diff](../../../core/libs/prx/libSceFreeType/src/Trigonometry.cpp) (libSceFreeType) - console ABI/version and CORDIC equivalence are unverified; the LP64 adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/fttrigon.c). Tangent retains the 64-bit quotient near poles instead of Windows FT_Long truncation. Angle differences whose signed 64-bit subtraction overflows throw; the bundled source's subtraction is undefined there.
+
+- [FT_Outline_Copy](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - compatibility with the console FreeType build and its errors is unverified. The LP64 guest adapter follows the unsigned counts and copy contract of bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c).
+
+- [FT_Outline_Decompose](../../../core/libs/prx/libSceFreeType/src/OutlineDecompose.cpp) (libSceFreeType) - console callback ABI and FreeType-version equivalence are unverified; the LP64 adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c). Nonempty outlines with shifts outside 0-62 or signed 64-bit overflow in scaling, translation or midpoint sums throw; native behavior for that arithmetic is undefined. Callers must supply valid point/tag/contour arrays and the callbacks their contours use.
+
 - [FT_Init_FreeType, FT_New_Face, FT_Set_Pixel_Sizes, FT_Get_Char_Index, FT_Load_Glyph, FT_Render_Glyph](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - the PS4 library is taken to be FreeType 2 built for LP64: the face, size, charmap, glyph slot, bitmap and outline layouts follow the public headers of the bundled FreeType 2.13.3 with a 64-bit `long`, which matches the offsets the OpenOrbis samples read (`face->glyph` at 0x98, `slot->advance` at 0x80, `slot->bitmap` at 0x98, `slot->bitmap_left` at 0xc0). Which FreeType version and options the console library is built with is unknown, so the behaviour and error codes are those of FreeType 2.13.3. The OpenOrbis font, keyboard, threading, system and SDL2 samples import these six functions
 
+- [FT_Bitmap_New, FT_Bitmap_Copy, FT_Bitmap_Convert, FT_Bitmap_Done](../../../core/libs/prx/libSceFreeType/src/Bitmap.cpp) (libSceFreeType) - console behaviour and error codes are unmeasured; these follow bundled FreeType 2.13.3. Copy and Convert throw when source and target share a non-null buffer; Convert also throws when they are the same object. Other overlapping storage remains forbidden by the native API contract
+
 - [FT_Request_Size](../../../core/libs/prx/libSceFreeType/src/SizeRequest.cpp) (libSceFreeType) - console signature, request layout and errors are unverified; the guest request follows the LP64 public headers of the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/include/freetype/freetype.h). Host overflow behavior remains that of the bundled build. On Windows, native `FT_Long` is 32 bits; valid requests whose width or height exceeds that range throw before changing the size.
 
+- [FT_Select_Size](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures and errors are unverified; the LP64 guest adapter follows the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Bitmap-strike selection and size metrics are checked against native FreeType with generated BDF fonts; other font drivers have not been exercised through this entry point.
+
 - [FT_New_Memory_Face, FT_Done_Face and FT_Done_FreeType](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures, errors and generic-finalizer ordering are unverified; they follow the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/include/freetype/freetype.h) with LP64 guest arguments. Caller-owned font bytes must remain valid until the face is freed.
 
 - [FT_Outline_Check, FT_Outline_Get_CBox](../../../core/libs/prx/libSceFreeType/src/Outline.cpp) (libSceFreeType) - console signatures, count signedness and errors are unverified; the adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c), including its unsigned 16-bit counts and contour endpoints. Control-box coordinates use the existing guest LP64 layout and retain their full 64-bit range on Windows; contour checking does not validate point tags
@@ -33,3 +46,7 @@
 
 - [FT_Outline_Get_Orientation](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console ABI/version and large-outline equivalence are unverified. The adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) with the existing unsigned guest counts and an LP64 area accumulator, including on Windows.
 - [FT_Set_Char_Size](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console ABI, FreeType version and error compatibility are unverified. The name and NID `xuY99Qcb108` are in the [PS5 3.20 inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFreeTypeOt.c); the LP64 signature and behavior follow bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c), not a console measurement. After applying its defaults and minimum-size clamp, requests whose `dimension * dpi + 36` exceeds the host's signed `FT_Long` range throw before the native call. This is a 32-bit limit on Windows; larger console requests remain unsupported.
+
+- [FT_Get_Gasp](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console FreeType version and query-result compatibility are unverified. The guest face adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftgasp.c) and its existing LP64 face bridge.
+
+- [FT_Get_CID_Registry_Ordering_Supplement, FT_Get_CID_Is_Internally_CID_Keyed and FT_Get_CID_From_Glyph_Index](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console ABI/version and CID metadata equivalence are unverified. The adapters follow bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftcid.c) through the existing face bridge; returned registry/ordering strings have the native face's lifetime.
diff --git a/docs/dev/debt/libSceFreeTypeOptOl.md b/docs/dev/debt/libSceFreeTypeOptOl.md
new file mode 100644
index 0000000000..ea253fc9c5
--- /dev/null
+++ b/docs/dev/debt/libSceFreeTypeOptOl.md
@@ -0,0 +1,9 @@
+# libSceFreeTypeOptOl technical debt
+
+### Unknown function info
+
+- [FT_Get_PFR_Advance, FT_Get_PFR_Kerning and FT_Get_PFR_Metrics](../../../core/libs/prx/libSceFreeTypeOptOl/Export.cpp) use the LP64 face adapter and bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftpfr.c) through [Pfr.cpp](../../../core/libs/prx/libSceFreeType/src/Pfr.cpp). A null face returns Invalid_Argument (6) without writing outputs or calling host imports, matching [FreeType 2.4.11](https://github.com/freetype/freetype/blob/VER-2-4-11/src/base/ftpfr.c) and [BunnyFl's firmware 13.42 Unicorn report](https://github.com/boykopovar/AnyPS5/pull/9646#issuecomment-6405909027). That report attributes a 2.4.11 version to Ol disassembly and finds these NIDs in OptOl and Ol under logical library libSceFreeType; it does not run real-face paths or establish all firmware versions. This implementation exports them only from OptOl; Ol remains missing. Sony prototypes, guest layouts, module/library versions and nonnull-face equivalence remain unverified. Signed positions, scales and vectors use 64-bit guest storage even on Windows. Invalid PFR advance indices write zero as the bundled service does; non-PFR advance errors leave output untouched, while non-PFR metrics write fallback values before returning the format error. Those nonnull rules still follow 2.13.3 and have not been measured in the console modules.
+
+### Functional
+
+- [PFR faces](../../../core/libs/prx/libSceFreeTypeOptOl/Export.cpp) share the existing libSceFreeType ownership and lifetime rules. The optional module forwards to native helpers in that library rather than constructing another FreeType runtime. Private face records, stale or arbitrary pointers, caller-replaced internal records and simultaneous operations on the same face are not made safe by these adapters; callers must obey FreeType's face lifetime and threading requirements. The synthetic PFR regression exercises metrics, signed advances, metric-space kerning and an empty outline; it does not test bitmap-only PFR faces or every format feature.
diff --git a/docs/dev/debt/libSceFreeTypeOt.md b/docs/dev/debt/libSceFreeTypeOt.md
new file mode 100644
index 0000000000..6e93bdf35f
--- /dev/null
+++ b/docs/dev/debt/libSceFreeTypeOt.md
@@ -0,0 +1,9 @@
+# libSceFreeTypeOt technical debt
+
+### Unknown function info
+
+- [FT_Outline_GetInsideBorder, FT_Outline_GetOutsideBorder](../../../core/libs/prx/libSceFreeTypeOt/CMakeLists.txt) (libSceFreeTypeOl, libSceFreeTypeOt) - console prototypes, enum/layout equivalence, FreeType configuration and module/library versions are unverified. The existing LP64 outline layout and unsigned 16-bit counts follow bundled FreeType 2.13.3; border selection follows [ftstroke.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftstroke.c), with the shifted polygon area from [ftoutln.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) accumulated in 64 bits. Null positive-count arrays and out-of-range or non-increasing contour endpoints throw when reached; their console behavior is unknown. Tags and flags are not read, and input arrays remain caller-owned.
+
+- The 140 `sceFreeTypeOtUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.
+
+- The FT_Outline_Get_Orientation, FT_Request_Size, FT_Sin, FT_Tan, FT_Vector_Unit, FT_New_Size, FT_Outline_Copy and FT_Outline_Decompose NIDs in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are identified, but their provider-specific prototypes and behavior remain unverified. Their named helpers retain the explicit inventory aliases and throw; the separate libSceFreeType implementations do not supply this provider.
diff --git a/docs/dev/debt/libSceFsInternalForVsh.md b/docs/dev/debt/libSceFsInternalForVsh.md
index 92591afa7b..4e242ae883 100644
--- a/docs/dev/debt/libSceFsInternalForVsh.md
+++ b/docs/dev/debt/libSceFsInternalForVsh.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [sceBdSchedCancelBackgroundCopyRequest, sceBdSchedCancelPrioritizedBackgroundCopyRequest, sceBdSchedConfigure, sceBdSchedConfigure2, sceBdSchedDeconfigure, sceBdSchedGetBackgroundCopyRequest, sceBdSchedGetExtentMap, sceBdSchedGetPrioritizedBackgroundCopyRequest, sceBdSchedGetState, sceBdSchedSetBackgroundCopyRequest, sceBdSchedSetDiscIdentity, sceBdSchedSetPrioritizedBackgroundCopyRequest, sceBdSchedStartGame, sceBdSchedStartRipping, sceBdSchedStopScheduling, sceFsBfsCheckCleanFlag, sceFsBindApplication, sceFsBindPackages, sceFsCheckFormat, sceFsCheckSingleUser, sceFsCreateExfatPartition, sceFsCreatePfsSaveDataImage, sceFsCreatePfsTrophyDataImage, sceFsCreatePprPfsTrophyDataImage, sceFsDeviceAlignedPread, sceFsDeviceAlignedPwrite, sceFsDevpfsA53IocGetBuildMetadataStatus, sceFsDevpfsCancelWaitEvent, sceFsDevpfsCreateForVSH, sceFsDevpfsDeleteForVSH, sceFsDevpfsDeregisterEvent, sceFsDevpfsEventComplete, sceFsDevpfsEventResponseComplete, sceFsDevpfsFetchMetaEntry, sceFsDevpfsFsck, sceFsDevpfsInitFetchMetaEntryCtx, sceFsDevpfsMountForFSMP, sceFsDevpfsRegisterEvent, sceFsDevpfsWaitEvent, sceFsDrfsRegisterSocket, sceFsDrfsResumeSocket, sceFsErriCtl, sceFsErriGetState, sceFsExfatMkfsExternalHdd, sceFsExfatfsMkfs, sceFsExtUSBSchedDestroy, sceFsExtUSBSchedInsert, sceFsExtUSBSchedInsertForHDD, sceFsExternalStorageDeconfigure, sceFsExternalStorageGetRawDevice, sceFsExternalStorageInitialize, sceFsExternalStorageVerifyMetadata, sceFsGetAttribute, sceFsGetClusterStatistics, sceFsGetDeviceSectorsize, sceFsGetFsMetadata, sceFsGetFsMetadataWithProgress, sceFsGetSmrInfo, sceFsGschedCtl, sceFsISSchedConfigCurrentThread, sceFsISSchedConfigDescriptor, sceFsISSchedConfigThread, sceFsISSchedMapStat, sceFsISSchedResultToPriority, sceFsISSchedResultToSlot, sceFsISSchedStatCurrentThread, sceFsISSchedStatDescriptor, sceFsISSchedStatThread, sceFsISSchedUnmapStat, sceFsInitCreatePfsSaveDataOpt, sceFsInitCreatePfsTrophyDataOpt, sceFsInitMountDownloadDataOpt, sceFsInitMountGamePkgOpt, sceFsInitMountLwfsCompatOpt, sceFsInitMountLwfsOpt, sceFsInitMountPprPkgOpt, sceFsInitMountSaveDataOpt, sceFsInitMountTrophyDataOpt, sceFsInitUmountDownloadDataOpt, sceFsInitUmountGamePkgOpt, sceFsInitUmountLwfsCompatOpt, sceFsInitUmountLwfsOpt, sceFsInitUmountPprPkgOpt, sceFsInitUmountSaveDataOpt, sceFsInitUmountTrophyDataOpt, sceFsInitWorkspaceFileMetadataParam, sceFsLvdAttach, sceFsLvdAttach2, sceFsLvdAttachPartiallyCryptedDownloadData, sceFsLvdAttachSingleDefaultImage, sceFsLvdAttachSingleImage, sceFsLvdDetach, sceFsLvdDisableLayer, sceFsLvdEnableLayer, sceFsLvdSetDiscIdentity, sceFsLvdWaitResumed, sceFsMlfsMount, sceFsMlfsMountWithFlags, sceFsMlfsUmount, sceFsMountDownloadData, sceFsMountGamePkg, sceFsMountLwfs, sceFsMountLwfsCompat, sceFsMountPartiallyCryptedDownloadData, sceFsMountPprPkg, sceFsMountSaveData, sceFsMountTrophyData, sceFsNsfsAddOverlayToNamespace, sceFsNsfsMountWithFlags, sceFsNsfsSetGlobalExclude, sceFsNsfsUmount, sceFsPartitionTrim, sceFsReserveCluster, sceFsSetAttribute, sceFsSetClusterCacheSize, sceFsSetFileReservedTotal, sceFsSetSystemReserveSize, sceFsSetWorkspaceFileHash, sceFsStatWorkspace, sceFsSysStorageGetStatus, sceFsTransactionCancel, sceFsTransactionSaveDataInitMountOpt, sceFsTransactionSaveDataMount, sceFsTransactionStart, sceFsTrophyImageError, sceFsUfsAllocateAdditionalContents, sceFsUfsAllocateAligned, sceFsUfsAllocateDownloadData, sceFsUfsAllocateGameImage, sceFsUfsAllocatePatchImage, sceFsUfsAllocateSaveData, sceFsUfsAllocateTrophyData, sceFsUfsCheckCleanFlag, sceFsUfsCheckFixedCylinderGroupSize, sceFsUfsCollectTelemetry, sceFsUfsCollectTelemetry2, sceFsUfsDirectWrite, sceFsUfsEstimateZoneCapacityForUser, sceFsUfsExtendFile, sceFsUfsFsck, sceFsUfsFsckWithMM, sceFsUfsGetExtentMap, sceFsUfsGrowLwfs, sceFsUfsGrowfs, sceFsUfsHideBlocksFromUser, sceFsUfsInitalizeSparseFile, sceFsUfsLargewriteFsck, sceFsUfsLargewriteFsckWithMM, sceFsUfsMkLwfs, sceFsUfsMkfs, sceFsUfsMkfsForExternalHDD, sceFsUfsMkfsForSystem, sceFsUfsMkfsWithFixedCylinderGroupSize, sceFsUfsReallocateSparseFile, sceFsUfsRecryptBlocks, sceFsUfsRecryptGetState, sceFsUfsRecryptIsUnfinished, sceFsUfsRecryptSyncMetadata, sceFsUfsSeekHoleInFile, sceFsUfsStopOperation, sceFsUmountDownloadData, sceFsUmountGamePkg, sceFsUmountLwfs, sceFsUmountLwfsCompat, sceFsUmountSaveData, sceFsUmountTrophyData, sceFsUmountWorkspace, sceFsUnbindApplication, sceFsUnbindPackages, sceFsWsCreate, sceFsWsDelete, sceFsWsFetchFileMetadata, sceFsWsFsck, sceFsWsGetStatus, sceFsWsMount and sceFsWsUmount](../../../core/libs/prx/libSceFsInternalForVsh/Export.cpp) (libSceFsInternalForVsh) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFsInternalForVsh.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceBdSchedCancelBackgroundCopyRequest, sceBdSchedCancelPrioritizedBackgroundCopyRequest, sceBdSchedConfigure, sceBdSchedConfigure2, sceBdSchedDeconfigure, sceBdSchedGetBackgroundCopyRequest, sceBdSchedGetExtentMap, sceBdSchedGetPrioritizedBackgroundCopyRequest, sceBdSchedGetState, sceBdSchedSetBackgroundCopyRequest, sceBdSchedSetDiscIdentity, sceBdSchedSetPrioritizedBackgroundCopyRequest, sceBdSchedStartGame, sceBdSchedStartRipping, sceBdSchedStopScheduling, sceFsBfsCheckCleanFlag, sceFsBindApplication, sceFsBindPackages, sceFsCheckFormat, sceFsCheckSingleUser, sceFsCreateExfatPartition, sceFsCreatePfsSaveDataImage, sceFsCreatePfsTrophyDataImage, sceFsCreatePprPfsTrophyDataImage, sceFsDeviceAlignedPread, sceFsDeviceAlignedPwrite, sceFsDevpfsA53IocGetBuildMetadataStatus, sceFsDevpfsCancelWaitEvent, sceFsDevpfsCreateForVSH, sceFsDevpfsDeleteForVSH, sceFsDevpfsDeregisterEvent, sceFsDevpfsEventComplete, sceFsDevpfsEventResponseComplete, sceFsDevpfsFetchMetaEntry, sceFsDevpfsFsck, sceFsDevpfsInitFetchMetaEntryCtx, sceFsDevpfsMountForFSMP, sceFsDevpfsRegisterEvent, sceFsDevpfsWaitEvent, sceFsDrfsRegisterSocket, sceFsDrfsResumeSocket, sceFsExfatMkfsExternalHdd, sceFsExfatfsMkfs, sceFsExtUSBSchedDestroy, sceFsExtUSBSchedInsert, sceFsExtUSBSchedInsertForHDD, sceFsExternalStorageDeconfigure, sceFsExternalStorageGetRawDevice, sceFsExternalStorageInitialize, sceFsExternalStorageVerifyMetadata, sceFsGetAttribute, sceFsGetClusterStatistics, sceFsGetDeviceSectorsize, sceFsGetFsMetadata, sceFsGetFsMetadataWithProgress, sceFsGetSmrInfo, sceFsGschedCtl, sceFsISSchedConfigCurrentThread, sceFsISSchedConfigDescriptor, sceFsISSchedConfigThread, sceFsISSchedMapStat, sceFsISSchedResultToPriority, sceFsISSchedResultToSlot, sceFsISSchedStatCurrentThread, sceFsISSchedStatDescriptor, sceFsISSchedStatThread, sceFsISSchedUnmapStat, sceFsInitCreatePfsSaveDataOpt, sceFsInitCreatePfsTrophyDataOpt, sceFsInitMountDownloadDataOpt, sceFsInitMountGamePkgOpt, sceFsInitMountLwfsCompatOpt, sceFsInitMountLwfsOpt, sceFsInitMountPprPkgOpt, sceFsInitMountSaveDataOpt, sceFsInitMountTrophyDataOpt, sceFsInitUmountDownloadDataOpt, sceFsInitUmountGamePkgOpt, sceFsInitUmountLwfsCompatOpt, sceFsInitUmountLwfsOpt, sceFsInitUmountPprPkgOpt, sceFsInitUmountSaveDataOpt, sceFsInitUmountTrophyDataOpt, sceFsInitWorkspaceFileMetadataParam, sceFsLvdAttach, sceFsLvdAttach2, sceFsLvdAttachPartiallyCryptedDownloadData, sceFsLvdAttachSingleDefaultImage, sceFsLvdAttachSingleImage, sceFsLvdDetach, sceFsLvdDisableLayer, sceFsLvdEnableLayer, sceFsLvdSetDiscIdentity, sceFsLvdWaitResumed, sceFsMlfsMount, sceFsMlfsMountWithFlags, sceFsMlfsUmount, sceFsMountDownloadData, sceFsMountGamePkg, sceFsMountLwfs, sceFsMountLwfsCompat, sceFsMountPartiallyCryptedDownloadData, sceFsMountPprPkg, sceFsMountSaveData, sceFsMountTrophyData, sceFsNsfsAddOverlayToNamespace, sceFsNsfsMountWithFlags, sceFsNsfsSetGlobalExclude, sceFsNsfsUmount, sceFsPartitionTrim, sceFsReserveCluster, sceFsSetAttribute, sceFsSetClusterCacheSize, sceFsSetFileReservedTotal, sceFsSetSystemReserveSize, sceFsSetWorkspaceFileHash, sceFsStatWorkspace, sceFsSysStorageGetStatus, sceFsTransactionCancel, sceFsTransactionSaveDataInitMountOpt, sceFsTransactionSaveDataMount, sceFsTransactionStart, sceFsTrophyImageError, sceFsUfsAllocateAdditionalContents, sceFsUfsAllocateAligned, sceFsUfsAllocateDownloadData, sceFsUfsAllocateGameImage, sceFsUfsAllocatePatchImage, sceFsUfsAllocateSaveData, sceFsUfsAllocateTrophyData, sceFsUfsCheckCleanFlag, sceFsUfsCheckFixedCylinderGroupSize, sceFsUfsCollectTelemetry, sceFsUfsCollectTelemetry2, sceFsUfsDirectWrite, sceFsUfsEstimateZoneCapacityForUser, sceFsUfsExtendFile, sceFsUfsFsck, sceFsUfsFsckWithMM, sceFsUfsGetExtentMap, sceFsUfsGrowLwfs, sceFsUfsGrowfs, sceFsUfsHideBlocksFromUser, sceFsUfsInitalizeSparseFile, sceFsUfsLargewriteFsck, sceFsUfsLargewriteFsckWithMM, sceFsUfsMkLwfs, sceFsUfsMkfs, sceFsUfsMkfsForExternalHDD, sceFsUfsMkfsForSystem, sceFsUfsMkfsWithFixedCylinderGroupSize, sceFsUfsReallocateSparseFile, sceFsUfsRecryptBlocks, sceFsUfsRecryptGetState, sceFsUfsRecryptIsUnfinished, sceFsUfsRecryptSyncMetadata, sceFsUfsSeekHoleInFile, sceFsUfsStopOperation, sceFsUmountDownloadData, sceFsUmountGamePkg, sceFsUmountLwfs, sceFsUmountLwfsCompat, sceFsUmountSaveData, sceFsUmountTrophyData, sceFsUmountWorkspace, sceFsUnbindApplication, sceFsUnbindPackages, sceFsWsCreate, sceFsWsDelete, sceFsWsFetchFileMetadata, sceFsWsFsck, sceFsWsGetStatus, sceFsWsMount and sceFsWsUmount](../../../core/libs/prx/libSceFsInternalForVsh/Export.cpp) (libSceFsInternalForVsh) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFsInternalForVsh.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceGameLiveStreaming.md b/docs/dev/debt/libSceGameLiveStreaming.md
index 75299aa071..b52bed6644 100644
--- a/docs/dev/debt/libSceGameLiveStreaming.md
+++ b/docs/dev/debt/libSceGameLiveStreaming.md
@@ -18,7 +18,7 @@
 - [sceGameLiveStreamingScreenSetMode](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingPermitLiveStreaming](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingSetMaxBitrate](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
-- [sceGameLiveStreamingGetCurrentStatus](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
+- [sceGameLiveStreamingGetCurrentStatus](../../../core/libs/prx/libSceGameLiveStreaming/include/Api.hpp) - still throws; the meaning, division and SDK types of the first 12 bytes remain unknown. In the supplied `libSceGameLiveStreaming.sprx`, export `CoPMx369EqM` at 0x1810 takes one output pointer, clears 72 bytes, obtains service command 9's status, copies its first 12 bytes and clears bytes 0x0C..0x47. `GameLiveStreamingStatus` exposes this byte storage without assuming the `GetCurrentStatus2` field layout or SDK alignment. The decompiler's extra SIMD parameter is not an input: the assembly initializes the register before use.
 - [sceGameLiveStreamingEnableSocialFeedback](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingGetSocialFeedbackMessagesCount](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingGetSocialFeedbackMessages](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
diff --git a/docs/dev/debt/libSceGameUpdate.md b/docs/dev/debt/libSceGameUpdate.md
index fd8f0f341a..75626c8e75 100644
--- a/docs/dev/debt/libSceGameUpdate.md
+++ b/docs/dev/debt/libSceGameUpdate.md
@@ -1,7 +1,11 @@
 # libSceGameUpdate technical debt
 
+### Silent stubs
+
+- [sceGameUpdateCreateRequest, sceGameUpdateCheck](../../../core/libs/prx/libSceGameUpdate/Export.cpp) (libSceGameUpdate) - requests are kept in the module's 8 slots with ids from `0x20000000` (a ninth returns `0x80412806`, an aborted request's Check `0x80412807`), as [prosper](https://github.com/mattias800/prosper) reads the PS5 3.20 `libSceGameUpdate.sprx`. Check never asks a patch service: it always answers no update (`found` and the byte after it cleared, the rest of the result untouched, return 0), which is what the module returns when its service reports `0x80412883`; KytyPS5 also answers no update. What the service returns on an offline console is not measured. The answer only decides whether a title offers a patch. PPSA22408 aborted on the throw in sceGameUpdateCreateRequest at its title screen. Closes when: measured on a PS5
+
 ### Functional
 
-- [libSceGameUpdate](../../../core/libs/prx/libSceGameUpdate/Export.cpp): initialization tracks host state but does not connect the patch service. Request creation and entitlement version lookup throw instead of fabricating an offline error or a successful no-update result. The original maintains eight service-backed requests with IDs starting at `0x20000000`; the service's offline response is still unknown. Check, Abort and Delete implement argument/state checks but have no live requests to operate on.
+- [libSceGameUpdate](../../../core/libs/prx/libSceGameUpdate/Export.cpp): initialization tracks host state but does not connect the patch service. Entitlement version lookup throws.
 - [sceGameUpdateCheck](../../../core/libs/prx/libSceGameUpdate/Export.cpp): option zero is supported for argument validation. The original additionally permits option one when a kernel platform predicate succeeds; that platform mode is not modeled.
 - [sceGameUpdateGetAddcontLatestVersion](../../../core/libs/prx/libSceGameUpdate/Export.cpp): the supplied module confirms a 20-byte entitlement-label input and a 48-byte service output. Null pointers are rejected before initialization is checked. There is no local output-size validation or blanket clearing of the output; the host leaves it untouched when the missing service causes an exception.
diff --git a/docs/dev/debt/libSceGnmDriverForNeoMode.md b/docs/dev/debt/libSceGnmDriverForNeoMode.md
index 4d80911108..507eeee80f 100644
--- a/docs/dev/debt/libSceGnmDriverForNeoMode.md
+++ b/docs/dev/debt/libSceGnmDriverForNeoMode.md
@@ -2,10 +2,14 @@
 
 ### Unknown function info
 
-- [libSceGnmDriverForNeoMode pending exports](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) - 48 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceGnmDriverForNeoMode.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceGnmDriverForNeoMode pending exports](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) - 34 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceGnmDriverForNeoMode.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
 
 ### Functional
 
 - [retail-only answers](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - the debug resets, the resource and owner registration calls, the SDMA calls and the SQ counter calls return `0x8EEE00FF`, the five `sceGnmDriverInternalRetrieveGnmInterface*` calls return `0x80000000`, `sceGnmGetDbgGcHandle` returns -1, `sceGnmDriverTraceInProgress` and `sceGnmValidateOnSubmitEnabled` return 0 and the other validation calls return `0x80D13FFF`. These are the values [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp) returns for calls it marks as not available in retail firmware; they are not measured on a console, and the arguments are not read
 - [default state packets](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmDrawInitDefaultHardwareState`, `sceGnmDrawInitDefaultHardwareState200`, `sceGnmDrawInitDefaultHardwareState350`, `sceGnmDrawInitToDefaultContextState` and `sceGnmDrawInitToDefaultContextState400` write the sequences in [InitSequences.hpp](../../../core/libs/prx/libSceGnmDriverForNeoMode/include/InitSequences.hpp), taken from [shadPS4's gnmdriver_init.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver_init.h): its Neo sequences, except the plain hardware state, which shadPS4 also writes unchanged in Neo mode. The size checks and returned sizes are shadPS4's. Not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
 - [draw, dispatch, wait and VGT packets](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - the signatures, size checks, PM4 words and refusals (-1) of the 17 command writers follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp) on its Neo-mode path, since this module is the Neo-mode driver: draw initiators keep flag bits 29 to 31, and `sceGnmSetVgtControl` and `sceGnmResetVgtControl` write `IA_MULTI_VGT_PARAM` through `SET_UCONFIG_REG` (shadPS4's `UseNeoCompatSequences` is false). The packets are not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
+- [embedded shaders](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmSetEmbeddedVsShader` (id 0, a fullscreen triangle) and `sceGnmSetEmbeddedPsShader` (id 0 writes black, id 1 exports depth only) write the register packets of [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp), pointing at the shader code in [EmbeddedShaders.hpp](../../../core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp) in this module's memory instead of the console's `0xfe000f00` area. That code is shadPS4's instruction listing assembled with LLVM 19 `llvm-mc -arch=amdgcn -mcpu=bonaire`, without the binary header and register block that follow it on the console, since nothing here reads them; another id returns `0x8EEE00FF`. The size and modifier arguments are not checked, as in shadPS4. Not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
+- [shader register packets](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmUpdateVsShader`, `sceGnmUpdatePsShader`, `sceGnmUpdatePsShader350`, `sceGnmSetPsShader350`, `sceGnmUpdateGsShader`, `sceGnmUpdateHsShader` and `sceGnmSetCsShaderWithModifier` write the packets, size checks and -1 refusals of [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp); the update forms carry context registers inside NOP packets as there. Not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
+- [workloads](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmCreateWorkloadStream`, `sceGnmBeginWorkload` and `sceGnmEndWorkload` return shadPS4's values (3 for a null output or name, 1 for a stream above 15, 2 for workload 0 or one with a top byte above 15) and keep no state; not measured on a console
+- [sceGnmGetGpuCoreClockFrequency](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - returns 911 MHz, shadPS4's Neo-mode value, which it derives from Neo mode instead of the console's ioctl. `sceGnmGetOffChipTessellationBufferSize` returns shadPS4's `0x800000`
diff --git a/docs/dev/debt/libSceHmd2.md b/docs/dev/debt/libSceHmd2.md
index 25f1bc36a6..e8cbc5eacd 100644
--- a/docs/dev/debt/libSceHmd2.md
+++ b/docs/dev/debt/libSceHmd2.md
@@ -6,7 +6,7 @@
 
 ### Unknown function info
 
-- [sceHmd2Open](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - the handle is the value the console's driver returned to the first open; titles built with an SDK before 7.00 may open for any user, and the firmware's `sceMbusAddHandleByUserId` result for a user other than the initial one is unknown, so that case throws. 0x8a720006 for a second open is named `AlreadyOpened` from its use
+- [sceHmd2Open](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - the handle is the value the console's driver returned to the first open; titles built with an SDK before 7.00 may open for any user, and the firmware's `sceMbusAddHandleByUserId` result for a user other than the initial one is unknown, so that case throws. 0x8a720006 for a second open is named `AlreadyOpened` from its use. One title (PPSA29866) disassembled for this entry calls it once (0x2d1e2e) with a user ID from a variable of the title whose origin was not read, type 0, index 0 and a null parameter, stores the result in a field of its own object and tests it for a negative value. Which user it opens for is not shown.
 - [sceHmd2SetVibration](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - the second parameter is checked against 25 only while a headset is connected; its name and unit are unknown. The field of view member names are assumed: of the firmware's default tangents the first is the widest and the last two are equal
 - [libSceHmd2 legacy exports](../../../core/libs/prx/libSceHmd2/Export.cpp) - SeeThroughDraw, SeeThroughIC, VideoOutEq, WaitShader, SeeThroughCallbackGetPoseDataFunc, ReprojectionClear, ReprojectionSet and RpeorjectionSetParam have no matching symbols or callers in the supplied system modules. Their signatures remain unresolved. ClearUserEventEnd/Start, GazeStart/StopUserCalibration and GazeObjectSelectionTerminate are confirmed to take no arguments; their behavior after initialization remains unimplemented.
 - [sceHmd2InternalSetPortStatus](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - unknown signature
@@ -31,7 +31,7 @@
 
 ### Functional
 
-- [sceHmd2Initialize](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - the firmware also fails with 0x8a72001f when `sceKernelGetAppInfo` fails and with 0x8a72000a for some applications, depending on app info fields at 0x2c, 0x4b and 0x4d whose meaning is unknown, and then calls `sceMbusInit`; none of this is modelled
+- [sceHmd2Initialize](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - the firmware also fails with 0x8a72001f when `sceKernelGetAppInfo` fails and with 0x8a72000a for some applications, depending on app info fields at 0x2c, 0x4b and 0x4d whose meaning is unknown, and then calls `sceMbusInit`; none of this is modelled. One title (PPSA29866) disassembled for this entry calls it once (0x2d2f6c) with the address of a zeroed 16-byte local block and hands the result straight to another function; a branch on the result was not read.
 - [Reprojection size/alignment queries](../../../core/libs/prx/libSceHmd2/Export.cpp) - all five exports consume no arguments and return two uint64 values in RAX:RDX. Four host queries return values measured without a headset; native display sizes are calculated through the graphics layout service and see-through size follows internal configuration. QueryBufferSizeAlign changes calculation with runtime state; its native pair return type is restored, while its protected body remains unchanged and throws.
 - [Hmd2BeforeInitializeZero](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - before `sceHmd2Initialize` the console answers 0 to these 45 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: `vDgpdS2N9Rw` (sceHmd2InternalRegisterVibrationCallback), `Ri35gKTZpvE` (sceHmd2InternalUnregisterVibrationCallback), `9oyW8puiKeI`, `1HZNE6jhBnQ` (sceHmd2InternalPowerEventInitialize), `cdwAKBZLXjs`, `Yub1MF58jfY`, `JYXAuQFnPyw` (sceHmd2InternalDfuOpen), `VuPKqCu3wzw` (sceHmd2InternalDfuClose), `GSThagVyW5U` (sceHmd2InternalCrashReportOpen), `J4qE5N937MY` (sceHmd2InternalCrashReportClose), `9KnNj-dyASg`, `Qta2bkstbFk`, `5ZcObnDRBXE`, `AvPNn0qx4WQ`, `jp0apqNGgi8` (sceHmd2SetIpdOffset), `-kZT7X7OMg0` (sceHmd2InternalRelocalizerOpen), `1ewLtng-SVk` (sceHmd2InternalRelocalizerClose), `B0b8DeIUGes` (sceHmd2InternalTrackingOpen), `HclLg4Oj5yw` (sceHmd2InternalTrackingClose), `VbEvrQXsZyY` (sceHmd2InternalLedDetectorOpen), `bB6MKZi5UCQ` (sceHmd2InternalLedDetectorClose), `OXQ1EDf02XU` (sceHmd2InternalImageOpen), `IAxfMTvFm0M` (sceHmd2InternalImageClose), `qTJtAtaLeno` (sceHmd2InternalGenDataOpen), `j7Q16UX6l34` (sceHmd2InternalGenDataClose), `pmmNM06rLqU`, `zdQfyDK9Ods` (sceHmd2InternalSlamTraceOpen), `aPRwp9GnljM` (sceHmd2InternalSlamTraceClose), `MjY1gBSaed0` (sceHmd2InternalGazeOpen), `evAMjJYHqW4` (sceHmd2InternalGazeClose), `r93FLEZ3BBk` (sceHmd2InternalGazeStart), `IdYURdEdNFo` (sceHmd2InternalGazeStop), `CVcL2Cu2AEI` (sceHmd2GazeActivateGazeTracking), `NmKIfVxr2s0`, `KeDLkkp62Gg`, `+aadu6-ra+A`, `FgnTiwwGSzk`, `PWAUwOTHbbo` (sceHmd2InternalCreateSharedMemory), `WzaEApHnsP8` (sceHmd2InternalIsGameVr2d), `dXzQI8QVY7Y` (sceHmd2InternalIsMiniAppVr2d), `cCvFKGqRh1k` (sceHmd2InternalIsCommonDlgVr2d), `uj4-2VEAFPU` (sceHmd2InternalIsCommonDlgMiniAppVr2d), `sIaGStI-iLM` (sceHmd2InternalMapSharedMemory), `JzwpZOemDO8`, `IsC4R4bZFVU`. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once `sceHmd2Initialize` has succeeded
 - [Hmd2BeforeInitializeNotInitialized](../../../core/libs/prx/libSceHmd2/Export.cpp) (libSceHmd2) - before `sceHmd2Initialize` the console answers `0x8a720002` to these 9 exports both with every argument null and with every argument pointing at a zeroed 16 KiB buffer, writing nothing: `sXaPEPY-fLA` (sceHmd2InternalOpen), `3F5inHhKzXg` (sceHmd2InternalGetDeviceInformation), `sJAiB-6p55U`, `E8hDydLjsSs`, `xEQkSb2WJ7Y`, `aaP4dnR4q-0`, `lEU0TeUoGwI`, `cFVyjHBpUUU`, `zROtb46jTj4`. Measured from a payload process on firmware 13.60, so a game process before initialization is assumed to answer the same; the arguments and the behaviour after initialization are not measured, and the handler throws once `sceHmd2Initialize` has succeeded
diff --git a/docs/dev/debt/libSceHttp.md b/docs/dev/debt/libSceHttp.md
index 7d65b883c1..fdf9aeac06 100644
--- a/docs/dev/debt/libSceHttp.md
+++ b/docs/dev/debt/libSceHttp.md
@@ -29,6 +29,8 @@
 - [sceHttpDbgShowConnectionStat](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the native diagnostic consumes no arguments; it prints library state. The throwing implementation remains unchanged.
 - [sceHttpDbgShowRequestStat](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the native diagnostic consumes no arguments; it prints library state. The throwing implementation remains unchanged.
 - [sceHttpDbgShowMemoryPoolStat](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the native diagnostic consumes no arguments; it prints library state. The throwing implementation remains unchanged.
+- [sceHttpGetMemoryPoolStats](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - not measured on a console. The library takes nothing from the pool given to `sceHttpInit`, so it reports that size with peak and current use 0, where a console already holds bytes for a live context (0x1640 for Http2, see libSceNet). No live context returns `BEFORE_INIT` (0x80431001) and an unknown or terminated id `INVALID_ID` (0x80431100), as in `sceHttpCookieFlush`, with the output untouched; both codes are unmeasured. A null output throws, as its error code is unknown. Only the 24 bytes of the declared layout are written; [SharpProspero's struct](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http.cs#L398-L413) adds a 32-bit reserved field after them
+- [sceHttpGetRegisteredCtxIds](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - not measured on a console. It reports the libnet memory pool id and the SSL context id given to `sceHttpInit` for the context, in the order of the recovered prototype `(int contextId, int* netPoolId, int* sslContextId)`; no public source names its outputs, and neither id is checked against libSceNet or libSceSsl. No live context returns `BEFORE_INIT` and an unknown or terminated id `INVALID_ID`, as in `sceHttpGetMemoryPoolStats`, with the outputs untouched; both codes are unmeasured. A null output throws, as its error code is unknown
 
 ### Functional
 
diff --git a/docs/dev/debt/libSceHttpCache.md b/docs/dev/debt/libSceHttpCache.md
index a2d7b748a6..265fb144aa 100644
--- a/docs/dev/debt/libSceHttpCache.md
+++ b/docs/dev/debt/libSceHttpCache.md
@@ -2,5 +2,5 @@
 
 ### Unknown function info
 
-- [sceHttpCacheSystemSendStatistics and sceHttpCacheSystemTerm](../../../core/libs/prx/libSceHttpCache/Export.cpp): the supplied implementations return zero without reading arguments. No callers have yet established whether their public prototypes include unused arguments.
-- The following pending declarations have unverified signatures and behavior; they are parameterless import-resolution declarations and throw through `NotImplemented_nid_no_patch`: [`sceHttpCacheClearAllUserTags`](../../../core/libs/prx/libSceHttpCache/Export.cpp), [`sceHttpCacheClearCacheInfo`](../../../core/libs/prx/libSceHttpCache/Export.cpp), [`sceHttpCacheDebugSetUrl`](../../../core/libs/prx/libSceHttpCache/Export.cpp), [`sceHttpCacheRegisterCacheInfoUrl`](../../../core/libs/prx/libSceHttpCache/Export.cpp), [`sceHttpCacheRemoveTag`](../../../core/libs/prx/libSceHttpCache/Export.cpp).
+- [sceHttpCacheDebugSetUrl, sceHttpCacheSystemSendStatistics and sceHttpCacheSystemTerm](../../../core/libs/prx/libSceHttpCache/Export.cpp): the supplied implementations return zero without reading arguments. No callers have yet established whether their public prototypes include unused arguments.
+- The following pending declarations have unverified signatures and behavior; they are parameterless import-resolution declarations and throw through `NotImplemented_nid_no_patch`: [`sceHttpCacheClearAllUserTags`](../../../core/libs/prx/libSceHttpCache/Export.cpp), [`sceHttpCacheClearCacheInfo`](../../../core/libs/prx/libSceHttpCache/Export.cpp), [`sceHttpCacheRegisterCacheInfoUrl`](../../../core/libs/prx/libSceHttpCache/Export.cpp), [`sceHttpCacheRemoveTag`](../../../core/libs/prx/libSceHttpCache/Export.cpp).
diff --git a/docs/dev/debt/libSceIme.md b/docs/dev/debt/libSceIme.md
index b26437726a..e1f91cbc74 100644
--- a/docs/dev/debt/libSceIme.md
+++ b/docs/dev/debt/libSceIme.md
@@ -11,6 +11,7 @@
 - [sceImeGetPanelPositionAndForm](../../../core/libs/prx/libSceIme/Export.cpp) (libSceIme) - the output is taken to be the `PositionAndForm` that `sceImeDialogGetPanelPositionAndForm` fills. While a panel is open it reports the type, position and alignments passed to `sceImeOpen` and the size `sceImeGetPanelSize` gives; the console's values for a panel moved by its own position adjustment are unknown.
 - [sceImeFilterText](../../../core/libs/prx/libSceIme/Export.cpp) (libSceIme) - the behaviour follows the disassembly of `libSceIme.sprx` from firmware 13.60 and is differential-tested against that function in an emulator, not measured on a console. [ImeFilterCodepages.hpp](../../../core/libs/prx/libSceIme/include/ImeFilterCodepages.hpp) holds the two codepage checks (helpers at 0x4850 and 0x48f0), rebuilt from Unicode's public [CP932](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP932.TXT) and [CP936](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP936.TXT) tables plus the Latin-1, CJK Extension A and a few other units the firmware also accepts (listed in the PR). The parameter layout beyond `type` is inferred: `mask` is the allowed-class bitmask, and `version` and `variant` derive it when it is 0. [sceImeCheckFilterText](../../../core/libs/prx/libSceIme/Export.cpp) throws, as its contract is unknown
 - [sceImeOpen, sceImeUpdate, sceImeSetText, sceImeSetCaret, sceImeClose](../../../core/libs/prx/libSceIme/Export.cpp) (libSceIme) - the event ids (Open 0, UpdateText 1, UpdateCaret 2, PressClose 4, PressEnter 5), the caret directions (left 1, right 2), the error codes and the text event payload follow the PS4 reimplementation in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/b72489d8c24e63fc56a29fe2c90120ab768a210d/src/core/libraries/ime/ime.cpp); none is measured on a PS5. Events are queued and delivered by `sceImeUpdate` only when it is passed the handler given to `sceImeOpen`, with that call's `arg`. A text event points `str` at a copy of the text kept in `work`, and `inputTextBuffer` holds the same text; both are terminated, `caret_index` is the caret after the edit and the one edit area has the edit position and the change in UTF-16 units (0 for Enter and Close). An edit sends one UpdateText; a caret move sends one UpdateCaret per UTF-16 unit, as shadPS4 does. Enter inserts a line break with the multiline option and sends PressEnter otherwise; Escape sends PressClose. Typed text is cut to `maxTextLength` without splitting a surrogate pair, line breaks are dropped without the multiline option, and the BasicLatin, URL, mail and number types do not filter characters. `sceImeOpen` checks, in shadPS4's order, the user, type, enter label, input method, option bits (the `sceImeGetPanelSize` mask), `maxTextLength` (1 to 2048), the text buffer, the position (below 1920x1080, or 3840x2160 with the over-2K option), the alignments, the extended priority and reserved bytes, `work` (non-null, 4-byte aligned), the handler, the reserved bytes and the initial text (no unpaired surrogate, no line break without the multiline option); shadPS4's SDK-dependent option, language and extended-option masks and its work-overlap check are not applied, and only the text copy is written to `work`. `sceImeSetText` keeps the caret unless the text became shorter, `sceImeSetCaret` rejects an index past the text with `0x80bc0030`, and neither sends an event. `sceImeSetTextGeometry` accepts any geometry while a panel is open, since no panel is drawn
+- [sceImeUpdate and sceImeKeyboardOpen](../../../core/libs/prx/libSceIme/Export.cpp) (libSceIme) - returning 0x80BC0031 (ErrorInvalidAddress) for a null parameter in `sceImeKeyboardOpen` follows the reimplementations in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/b72489d8c24e63fc56a29fe2c90120ab768a210d/src/core/libraries/ime/ime.cpp#L557-L560) and [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/1211958b4eb38256cc0c5c7ba92d668820c05389/src/libs/ime.cpp#L540-L542). In contrast, returning 0x80BC0022 (ErrorInvalidHandler) from `sceImeUpdate(nullptr)` is an assumption based on the error code name and sibling parameter checks; neither shadPS4 nor KytyPS5 returns INVALID_HANDLER for a null handler (both return NOT_OPENED when no session or keyboard is open or when no active handler matches), so the existing shadPS4 reference does not establish this result. The regression tests establish the host implementation's behavior rather than verified native return codes.
 - [sceImeForTestFunction](../../../core/libs/prx/libSceIme/Export.cpp) returns a constant error without consuming arguments in the supplied module; unused argument types cannot be recovered from that body.
 - [sceImeConfigSet and sceImeConfigGet](../../../core/libs/prx/libSceIme/Export.cpp) preserve the native argument slots: an unused first slot, a 64-bit configuration value, a 32-bit key and, for set, a 32-bit value. The service receives a 24-byte request; configuration/key semantics and unused argument types remain unresolved. The getter advertises one output transfer but does not initialize its descriptor in this module. Protected bodies remain unchanged.
 
diff --git a/docs/dev/debt/libSceInvitationDialog.md b/docs/dev/debt/libSceInvitationDialog.md
new file mode 100644
index 0000000000..9038d9da62
--- /dev/null
+++ b/docs/dev/debt/libSceInvitationDialog.md
@@ -0,0 +1,6 @@
+# libSceInvitationDialog technical debt
+
+### Unknown function info
+
+- [sceInvitationDialogGetResult](../../../core/libs/prx/libSceInvitationDialog/include/Api.hpp) - still throws; SDK field names and types at offsets 0x00 and 0x0C are unknown. In the supplied `libSceInvitationDialog.sprx`, export `8XKR6wa64iQ` at 0xFF0 takes one result pointer, checks reserved bytes 0x18..0x37 and writes the returned status at 0x08. The helper at 0x410 copies eight bytes from the saved open parameter to 0x00 and eight result bytes to 0x08, then copies 20-byte online IDs through the pointer at 0x10, after a four-byte count. Validation at 0xC20 limits recipients to 1..16. `InvitationDialogRecipients` provides the accessed 324-byte storage; any unused SDK tail is unverified. `InvitationDialogResult` provides the accessed 56 bytes, with unknown fields kept opaque; this is not a recovered SDK source declaration.
+- [sceInvitationDialogClose](../../../core/libs/prx/libSceInvitationDialog/Export.cpp) (libSceInvitationDialog) - imported by PS4 titles, which do not load without it, and added without an implementation: declared without parameters, every call throws
diff --git a/docs/dev/debt/libSceJobManager.md b/docs/dev/debt/libSceJobManager.md
index 123977e935..93d8f3ec8a 100644
--- a/docs/dev/debt/libSceJobManager.md
+++ b/docs/dev/debt/libSceJobManager.md
@@ -2,4 +2,7 @@
 
 ### Functional
 
-- [sce::Job::JobManager](../../../core/libs/prx/libSceJobManager/Export.cpp) (libSceJobManager) is written from the disassembly of the copies PPSA01474 and PPSA36082 ship in `sce_module`, and `guest_job_manager_tests` passes against both of those modules as well: the memory size formula, the error codes, sync point ordering, the per-sequence limits and the priority order are the original's. Compute sequences submit through `sceAgcDriverSubmitAcb` on the queue their mask bit selects and are checked the same way by `agc_driver_job_manager_compute_tests`: results, ordering against CPU dispatches and sync points, limits and sizes match the two modules. The command stream is simpler than the original's: every compute dispatch is submitted with its own label write and interrupt, where the original batches the label write and rewinds commands it encoded ahead, and the command buffers and labels live on the host heap. The per-queue command size in `calculateRequiredMemorySize` is a constant (104, 148 and 32 bytes per dispatch, sync point and wait), which is what the original measures by running the builders of this project's libSceAgc. A compute dispatch on a CPU sequence throws (the original does not check), and a failing `sceAgcDriverAddEqEvent` throws. `shutdown` throws while a compute sequence has work in flight, a sequence's label total is written as 32 bits, and since the label is host memory no GPU import covers, the driver drains recorded work before each label write. The manager's state lives on the host heap, with only the block header written to the title's memory; the original keeps everything in that block, and a block smaller than 0x2d8 bytes throws here. The worker sleep policy, the spin count and the persistent thread count are validated and stored but change nothing, a factory priority above 1 throws, `shutdown` throws while a thread is blocked in a sequence wait, and using a sequence after its `destroy` throws. `initialize` returns 0 where the original returns the result of its last import (`BG26hBGiNlw`, not resolved to a name), the `sceRazorCpuJobManager*` profiler calls are not made, and a worker thread that cannot be created or configured throws where the original does not check. The order of the sequence and factory virtual functions is read from the modules' vtables only, since no title that calls them has been run
+- [Compute sequences](../../../core/libs/prx/libSceJobManager/Export.cpp) encode ahead across GPU barriers using explicit release packets instead of the native rewind protocol and completion-packet patching recovered from PPSA06888's module (offsets 0x2210 and 0x2650). Commands are recycled after a completed wait. Command capacity is a separate bound from the dispatch count: the native size query measures one register and a 31-character marker, then its exhaustion callback at 0x29d0 traps instead of growing storage. The fallback throws. Original-module execution with the host AGC builders accepts two dispatches with 255 registers and 65,535-character markers, then traps on a third. Console timing equivalence remains unverified. Compute dispatch on a CPU sequence throws.
+- [Scheduling](../../../core/libs/prx/libSceJobManager/Export.cpp) uses host mutexes and condition variables instead of native atomic queues and semaphores; spin intervals deliberately use unscaled host TSC, while the original module reads scaled guest TSC under the host-only `APS5_TIME_SCALE` diagnostic. Blocks below 0x2d8 bytes, factory priorities above one, use of destroyed sequences and shutdown from a worker throw. New calls concurrent with shutdown are unverified.
+- [Pool allocation](../../../core/libs/prx/libSceJobManager/Export.cpp) reuses freed nodes in a different order; profiler dispatch IDs can differ from native allocation. The fallback Wait deliberately allocates no pool node; native Wait can stall on global pool exhaustion. Resource-creation failures throw after cleanup, where the original does not check every return. Vtable order was checked, but no calling title or PS5 timing equivalence has been tested.
+- Console behavior for [worker waits](../../../core/libs/prx/libSceJobManager/Export.cpp) is unverified. The owned original module stalls on the zero-spin, zero-persistence `worker_wait` fixture with native Windows and Linux host kernel services; the fallback wakes a spare worker and completes the child. The reference runner keeps this case selectable but excludes it from the shared-behavior parity suite.
diff --git a/docs/dev/debt/libSceJpegDec.md b/docs/dev/debt/libSceJpegDec.md
index 174718fdd4..af33d224c8 100644
--- a/docs/dev/debt/libSceJpegDec.md
+++ b/docs/dev/debt/libSceJpegDec.md
@@ -7,4 +7,4 @@
 ### Functional
 
 - [libSceJpegDec](../../../core/libs/prx/libSceJpegDec/Export.cpp): work-memory size, alignment, creation checks, image-info fields, progressive coefficient-buffer capacity, row-buffer capacity and scaled dimensions are recovered from the native module. The host still allocates its decoder storage separately rather than using the guest work and coefficient regions. Malformed-header diagnostics and output mutation on failure are not fully matched.
-- [sceJpegDecDecode](../../../core/libs/prx/libSceJpegDec/Export.cpp): decode mode 1 and pixel formats 9, 10 and 11 remain unimplemented and throw. Exact decoded pixel values and color conversion are not verified against the native decoder.
+- [sceJpegDecDecode](../../../core/libs/prx/libSceJpegDec/Export.cpp): decode mode 1 and pixel formats 9, 10 and 11 remain unimplemented and throw. Exact decoded pixel values and color conversion are not verified against the native decoder. One title (PPSA29866) disassembled for this entry has one call site (0x2c111d); it passes a null `imageInfo` and a parameter structure with decode mode 0, down-scale 1 and pixel format 0, and hands the result to another function whose handling of a negative result was not read. In the parameter structure built around this call site, mode 1 and formats 9, 10 and 11 do not show up; whether a down-scale of 1 means no scaling was not compared.
diff --git a/docs/dev/debt/libSceJson2.md b/docs/dev/debt/libSceJson2.md
index b9fac63328..bb2d163782 100644
--- a/docs/dev/debt/libSceJson2.md
+++ b/docs/dev/debt/libSceJson2.md
@@ -10,6 +10,7 @@
 - [sce::Json::Value::setTypeMismatchHandler, setElementAccessFailureHandler and setSpecialFloatHandler](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - members of `Value` that return an int, inferred from a caller that registers them on its root `Value` before parsing into it, with the handler and its context, and accepts 0 or 0x80848104 as success; they return 0. The PS Vita library's `Value::setNullAccessCallback` is such a member too ([vitasdk](https://github.com/vitasdk/vita-headers/blob/15605617cbbb23d266f88af28899fdb573e2355e/include/psp2/json.h#L638)). The handler signatures follow the mangled names. A handler applies to the `Value` it is set on and to the values that `Value` holds then, and `Parser::parse` gives the values it creates the handlers of the `Value` it parses into, since the title reads the errors its handlers record after accessing parsed members; copies, `push_back` and `Object::operator[]` do not carry them, and how the console finds the handler of an accessed value is unknown. A typed getter on a non-null value of another type calls the type mismatch handler with the requested type, the value, null and the context, and returns the value the handler returns if it has the requested type, else the getter's default; passing null as the third handler argument (the second `Value` pointer), and the order of the two `Value` pointers, remain unverified against the console. The element access failure handler is not called: a failed `operator[]` or `getValue` on a value carrying it throws, as the error code the console passes, which the title records as its error, is unknown; without one the access still reaches the null-access callback. The special float handler is not called: serializing a non-finite real throws with or without it, as the `FunctionType` values and the `bool*` output are unknown, and the title's handler returns a different replacement for each of its two types
 - [sce::Json::MemAllocator::notifyError](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the base class's virtual does nothing. A title's allocator that does not override it calls it through its own vtable; the library never calls the title's allocator, so it never reports an allocation failure. Whether the console's base implementation logs anything is unknown
 - [sce::Json::String size, capacity, resize, append(const char*, size_t), operator+=](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - storage uses `std::string`; capacity and allocation growth do not match the system 32-bit capacity and allocator settings. Appending null text with a nonzero length throws instead of dereferencing it.
+- [sce::Json::String at, find and rfind](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the return types follow the PS Vita library's `String` ([vitasdk](https://github.com/vitasdk/vita-headers/blob/15605617cbbb23d266f88af28899fdb573e2355e/include/psp2/json.h#L338)) and the search follows `std::string`. `at` past the end and a null text or `String` throw; what the console returns or does there is unverified.
 - [sce::Json::Array::iterator::advance and Object::iterator members](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the return type of `advance` remains unverified. Object iterator advancement past the end throws instead of asserting. Dereferencing an empty array iterator throws instead of returning the system null-value pointer or an invalid address.
 - [sce::Json::Value::operator bool](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - callback dispatch before conversion is not implemented. The system library invokes the applicable type mismatch handler before converting a non-boolean value, with SDK-dependent global callback handling.
 
@@ -42,7 +43,6 @@
 - [_ZN3sce4Json5ArrayC2ERKS1_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `6NlbpyIfUuY` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
 - [_ZN3sce4Json5ArrayC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `t6AHhkWu4mY` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
 - [_ZN3sce4Json5ArrayD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `MIyMPw7YTGM` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZN3sce4Json5ArrayaSERKS1_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `w5UbvPLGye0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
 - [_ZN3sce4Json5Value11referStringEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `m5J28iw-QPs` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
 - [_ZN3sce4Json5Value12referBooleanEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `QxjfcfBhEdc` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
 - [_ZN3sce4Json5Value12referIntegerEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `R0ac5QOdlpo` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
@@ -82,10 +82,3 @@
 - [_ZNK3sce4Json14InitParameter217getFileBufferSizeEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Pcg6xQUhq9E` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
 - [_ZNK3sce4Json14InitParameter225getSpecialFloatFormatTypeEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `PDkib0zyABg` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
 - [_ZNK3sce4Json5ValueixERKNS0_6StringE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `clF7J7N9xXE` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZNK3sce4Json6String2atEm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `KrKM-5SdQrA` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZNK3sce4Json6String4findEPKcm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `yjsf6SvXA08` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZNK3sce4Json6String4findEPKcmm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `wwDnDDsQVc0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZNK3sce4Json6String4findERKS1_m](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `awkeNR6Ukp8` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZNK3sce4Json6String5rfindEPKcm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `VpQBXbaHXOo` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZNK3sce4Json6String5rfindEPKcmm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `A29RHrlfTM0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
-- [_ZNK3sce4Json6String5rfindERKS1_m](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `-R9mdXBspeQ` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
diff --git a/docs/dev/debt/libSceJxr.md b/docs/dev/debt/libSceJxr.md
index 0fbc29eb6c..2d93664275 100644
--- a/docs/dev/debt/libSceJxr.md
+++ b/docs/dev/debt/libSceJxr.md
@@ -2,8 +2,10 @@
 
 ### Unknown function info
 
-- [libSceJxr pending exports](../../../core/libs/prx/libSceJxr/Export.cpp) - 4 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceJxr.c) and were cross-checked against the same module in PS5 firmware 13.60. `PixelFormatLookup`, `readIS` and `writeIS` have unverified signatures and behaviour; their declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [PixelFormatLookup](../../../core/libs/prx/libSceJxr/Export.cpp) is listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceJxr.c) and was cross-checked against firmware 13.60. Its signature and behaviour remain unverified; the declaration uses the no-parameter unknown-signature convention and throws through `NotImplemented_nid_no_patch`.
 
 ### Functional
 
 - [PKFree](../../../core/libs/prx/libSceJxr/Export.cpp) (libSceJxr) follows Microsoft's jxrlib [JXRGlue.c](https://github.com/4creators/jxrlib/blob/f7521879862b9085318e814c6157490dd9dbbdb4/jxrgluelib/JXRGlue.c#L53-L62), whose four exported names the module shares: a non-null `ppv` has `*ppv` released with the guest `free` and set to null, and the result is always `WMP_errSuccess` (0) as a 64-bit `ERR` (`long`). That the console's module is built from jxrlib, and that its `PKFree` releases through libc's `free`, is inferred from the export names and not checked against the console's code. Closes when: the console's `PKFree` is disassembled or measured on a PS5
+
+- [readIS and writeIS](../../../core/libs/prx/libSceJxr/Export.cpp) use the non-ARM, LP64 `BitIOInfo` and `WMPStream` ABI and packet algorithm from [Microsoft's JPEG XR reference implementation](https://github.com/4creators/jxrlib/blob/f7521879862b9085318e814c6157490dd9dbbdb4/image/sys/strcodec.c#L1090-L1177). Console structure layouts and execution remain unverified. Profiling callbacks are omitted as in the reference Unix build with `DISABLE_PERF_MEASUREMENT`; the codec argument is unused. Invalid null state or required callbacks throw instead of dereferencing them. No codec is instantiated by these helpers; callers must supply the reference ring buffer and guest-ABI stream callbacks.
diff --git a/docs/dev/debt/libSceKeyboard.md b/docs/dev/debt/libSceKeyboard.md
index ba3dcb499f..12c1ff0c79 100644
--- a/docs/dev/debt/libSceKeyboard.md
+++ b/docs/dev/debt/libSceKeyboard.md
@@ -2,7 +2,7 @@
 
 ### Functional
 
-- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): the original validates HID usages 4 through 231 before the handle and preserves unconverted HID usages in the output with `processed == 0`. The host instead accepts out-of-range usages and writes zero for unconverted keys. The original ignores the Kana LED, while the host throws for it. This partially implemented function contains `NotImplemented_nid_no_patch(__func__)`; its body is preserved under the requested restriction. One title (PPSA15246) disassembled for this entry calls it once with an output buffer cleared to 24 bytes, uses a character only when the result is 0 and the first output byte is nonzero, and then reads the 16-bit value at offset 8, which agrees with `processed` and `char_code` as laid out here. Which other output fields it reads and what its other arguments mean are not shown.
+- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): initialization, output length and reserved bytes remain unverified on a console; unconverted keys retain the host's length of 0. One title (PPSA15246) disassembled for this entry calls it after clearing the first 20 bytes of its output buffer (16-byte store 0x69942d, 32-bit store 0x699435; no size argument), uses a character only when the result is 0 and the first output byte is nonzero, and then reads the 16-bit value at offset 8. Which other output fields it reads and what its other arguments mean are not shown.
 
 ### Unknown function info
 
diff --git a/docs/dev/debt/libSceLibcInternal.md b/docs/dev/debt/libSceLibcInternal.md
index ff8c271f1f..3ac4b14e2d 100644
--- a/docs/dev/debt/libSceLibcInternal.md
+++ b/docs/dev/debt/libSceLibcInternal.md
@@ -7,13 +7,16 @@
 
 ### Functional
 
+- [std::filesystem::_Xfilesystem_error](../../../core/libs/prx/libSceLibcInternal/Filesystem.cpp) (libSceLibcInternal, NIDs `B0CeIhQty7Y` and `C6-7Mo5WbwU`) - both overloads still throw `NotImplemented`: on the console they throw `std::filesystem::filesystem_error`, whose guest type information and layout this library does not provide yet. The filesystem primitives beside them follow the PS5 13.60 module
 - [makecontext](../../../core/libs/prx/libSceLibcInternal/UserContext.cpp) (libSceLibcInternal) follows FreeBSD 11's `lib/libc/amd64/gen/makecontext.c`: at most six arguments, a stack of at least `MINSIGSTKSZ` (2048) bytes, and `exit(0)` when the function returns with no `uc_link`. The console's version is not verified
 - [makecontext](../../../core/libs/prx/libSceLibcInternal/UserContext.cpp) (libSceLibcInternal) on Windows pins its stack writable until a later `makecontext` stack overlaps it, since nothing tells the library when the guest frees the stack
 - [Thread exit destructors](../../../core/libs/prx/libSceLibcInternal/Export.cpp) (libSceLibcInternal) run when a libkernel thread finishes; on the main or a host thread only `_sceLibcInternalThreadDtors` runs them, as `exit` does, else they are dropped
 - [fdopendir](../../../core/libs/prx/libSceLibcInternal/Directory.cpp) (libSceLibcInternal) follows FreeBSD 11's [`fdopendir`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/gen/opendir.c#L67-L74): it sets `FD_CLOEXEC` on the descriptor first, and the stream starts at the descriptor's current position instead of the first entry. On Windows the stream skips the entries the descriptor's cursor (`lseek` or `getdirentries`) has passed, which assumes that the descriptor and the stream list a directory in the same host order; on Linux the stream is opened on a duplicate of the descriptor, which shares its position. The Linux path is not run by the tests here. As in FreeBSD, a descriptor that is not open fails with `EBADF`, one that is not a directory with `ENOTDIR` (both leave it open, and `FD_CLOEXEC` stays set on the latter), and `closedir` closes it
 - [fstatvfs](../../../core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp) (libSceLibcInternal) converts `_fstatfs` to the 88-byte `struct statvfs` as FreeBSD 9.2's `sfs2svfs` does (`f_bsize` from the transfer size, `f_frsize` from the block size, `f_favail` equal to `f_ffree`, `f_fsid` 0, `ST_RDONLY` and `ST_NOSUID` only). Differences: `f_namemax` is the `statfs` value, not `fpathconf(_PC_NAME_MAX)`; negative `f_bavail` and `f_ffree` wrap to unsigned without `EOVERFLOW`, as the same-width copy in FreeBSD does; inode counts are 0 on Windows, inherited from `_fstatfs`; a null output returns `EFAULT` after the descriptor is validated, where FreeBSD would fault. Layout and conversion are unverified against the PS5 library (PS5MC imports `fstatvfs` but was not run)
-- [posix_spawn and posix_spawnp](../../../core/libs/prx/libSceLibcInternal/Spawn.cpp) (libSceLibcInternal) create no process. FreeBSD 11.4 returns the error the child's exec leaves ([`_posix_spawn_thr`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/posix_spawn.c#L227-L231), [`do_posix_spawn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/posix_spawn.c#L295-L303)), and `posix_spawnp` searches `PATH`, or `_PATH_DEFPATH` when it is unset, ending with `ENOENT` when no directory holds the program ([`_execvpe`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/exec.c#L272-L281), [`execvPe`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/exec.c#L257-L260)). So when the program is not in the guest file system both return `ENOENT` and leave the process ID unwritten; when it is there they throw. PPSA99305 (Dusklight) reaches this when SDL looks for `zenity` to show a file dialog. The attributes and file actions are not applied, so one that would fail in the child is not reported, and whether the console's application sandbox lets the child be created at all (FreeBSD returns that error first) is unverified. The attribute and file action calls keep FreeBSD 11.4's objects. Null or uninitialized objects, which FreeBSD dereferences, throw.
+- [posix_spawn and posix_spawnp](../../../core/libs/prx/libSceLibcInternal/Spawn.cpp) (libSceLibcInternal) create a native child running the requested program's converted image, which must be under `/app0/` (`/app0/eboot.bin` maps to the running image); `posix_spawnp` searches `PATH` as FreeBSD 11's `_execvpe`, and the FreeBSD 11.4 file actions and attributes are applied to the child. A null `argv` returns `EFAULT`; a null `envp` inherits the parent environment; guest process IDs are the host's. Limits: the child executes the conversion made at relink time; Windows redirects only descriptors 0 to 2 and starts the child on the parent's std handles; Linux applies only `POSIX_SPAWN_RESETIDS` and `POSIX_SPAWN_SETPGROUP`, other flags or a nonzero set on Windows throw. The console sandbox's effect on child creation is unverified, and null or uninitialized objects, which FreeBSD dereferences, throw. PPSA99305 (Dusklight) reaches this when SDL looks for `zenity`
 - [getopt, getopt_long](../../../core/libs/prx/libSceLibcInternal/Getopt.cpp) (libSceLibcInternal) follow FreeBSD 11 [getopt.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/getopt.c) and [getopt_long.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/getopt_long.c) with `GNU_COMPATIBLE`: `getopt` does not permute, `getopt_long` permutes unless `POSIXLY_CORRECT` is set in the guest environment or the option string starts with `+`, and the exported `opterr`, `optind`, `optopt`, `optreset` and `optarg` start at 1, 1, 0, 0 and null. Warnings go to the guest's current `stderr` prefixed with `__progname`, where FreeBSD's `warnx` keeps the `stderr` of its first call. A null `getopt` option string, a null argument vector or argument, a negative `optind` and an `optind` moved inside a pending permutation throw where FreeBSD faults. `getopt_long_only` is not exported. That the console's `libSceLibcInternal` uses this FreeBSD code is unverified
 - [posix_spawnattr_getflags, getpgroup, getschedparam, getschedpolicy, getsigdefault, getsigmask, setpgroup, setschedparam, setschedpolicy and setsigmask](../../../core/libs/prx/libSceLibcInternal/Spawn.cpp) (libSceLibcInternal) read and write the 0x30-byte attribute object at the offsets of the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x8D860 to 0x8D910: flags at 0, process group at 4, scheduling parameter at 8, policy at 0xC, default and masked signal sets at 0x10 and 0x20), which never fail there and return 0; the layout matched on a PS5 (firmware 13.60). Uninitialized attributes and null pointers, which the console dereferences, throw as the existing setters do
 - [sys_siglist and sys_nsig](../../../core/libs/prx/libSceLibcInternal/SignalList.cpp) (libSceLibcInternal) hold the 32 descriptions and the count of [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/siglist.c#L73-L107) `siglist.c` (`NSIG` 32, signal 0 to `SIGUSR2`); the console's table was not read
+- [_err, _warn](../../../core/libs/prx/libSceLibcInternal/Err.cpp) and [_getprogname](../../../core/libs/prx/libSceLibcInternal/Export.cpp) (libSceLibcInternal) are assumed to be the same functions as `err`, `warn` and `getprogname` and run their code; the console's module was not read. FreeBSD 11.4 defines the underscore names and makes the public names weak references to them ([`_err`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/err.c#L70-L79), [`_warn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/err.c#L135-L144), [`_getprogname`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/getprogname.c#L10-L17))
 - [inet_aton, inet_addr, inet_ntoa and inet_ntoa_r](../../../core/libs/prx/libSceLibcInternal/Inet.cpp) (libSceLibcInternal) follow the FreeBSD code in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x8ADE0 to 0x8B3D0) and matched it on a PS5 (firmware 13.60) for 20 `inet_aton` inputs; a null text, which the console dereferences, throws. `inet_ntoa_r` formats through libkernel's `__inet_ntop`, so a null buffer with room for the text throws and a null buffer that is too small sets `ENOSPC`, as `__inet_ntop` does for a null destination; the console's `inet_ntoa_r` was not measured with a null buffer
+- [__inet_ntoa_r](../../../core/libs/prx/libSceLibcInternal/Inet.cpp) (libSceLibcInternal) was not measured on the console: it runs `inet_ntoa_r`, as FreeBSD 11.4 names the function `__inet_ntoa_r` ([arpa/inet.h](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/include/arpa/inet.h#L129)) and makes `inet_ntoa_r` a weak alias of it ([inet_ntoa.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/inet/inet_ntoa.c#L62-L76))
diff --git a/docs/dev/debt/libSceLibreSsl.md b/docs/dev/debt/libSceLibreSsl.md
index f84ef0fbf6..1f8ebb39eb 100644
--- a/docs/dev/debt/libSceLibreSsl.md
+++ b/docs/dev/debt/libSceLibreSsl.md
@@ -2,7 +2,21 @@
 
 ### Unknown function info
 
-- [libSceLibreSsl pending exports](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - 373 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
-- [MD4, MD5, SHA1, SHA224, SHA256, SHA384 and SHA512 Init/Update/Final and SHA256](../../../core/libs/prx/libSceLibreSsl/src/Digest.cpp) (libSceLibreSsl) - signatures and context layouts follow the [LibreSSL headers](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha/sha.h), and buffering and `Final` follow its [sources](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha); the module's LibreSSL version is unknown and nothing is checked on the console. Behaviour that differs between LibreSSL versions throws: `SHA256` with a null digest buffer (older versions return a static buffer) and `SHA512_Final` with the SHA-512/224 or SHA-512/256 digest length. Null contexts, null input with a nonzero length, null digest buffers in the 32-bit `Final` functions and a buffered byte count that is not below the block size, which LibreSSL does not check, throw
+- [libSceLibreSsl pending exports](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - 340 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [MD4, MD5, SHA1, SHA224, SHA256, SHA384 and SHA512 Init/Update/Final and SHA256](../../../core/libs/prx/libSceLibreSsl/src/Digest.cpp) (libSceLibreSsl) - signatures and context layouts follow the [LibreSSL headers](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha/sha.h), and buffering and `Final` follow its [sources](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha); nothing is checked on the console. Null contexts, null input with a nonzero length, null digest buffers in the 32-bit `Final` functions and a buffered byte count that is not below the block size, which LibreSSL does not check, throw
 - [DES_set_key, DES_ecb_encrypt, DES_set_odd_parity](../../../core/libs/prx/libSceLibreSsl/Export.cpp) (libSceLibreSsl) - the 128-byte `DES_key_schedule` holds the 8-byte key followed by zeros instead of LibreSSL's precomputed subkeys, so a title reading its contents sees different bytes; `DES_ecb_encrypt` derives the subkeys through mbedtls on each call. Not compared with the console. Results follow LibreSSL [des_key.c](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/des/des_key.c) and [des.c](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/des/des.c): `DES_set_key` skips the parity and weak-key checks and returns 0, as it does while `DES_check_key` is 0 (that variable is not in the PS5 export inventory), a nonzero `enc` encrypts, and `DES_set_odd_parity` sets each byte's low bit for odd parity. Null pointers throw where LibreSSL faults
 - [X509_verify_cert_error_string](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - no console call is verified. The 64-bit argument, low-32-bit lookup, messages and shared numeric fallback follow [LibreSSL 2.5.4](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/x509/x509_txt.c), the version identified in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214). Console modifications and other firmware versions remain unverified. Unknown-code results share an overwritten static buffer and are not safe for concurrent use, as in that release; code 1 and codes above 54 use the numeric fallback.
+- [RAND_add, RAND_bytes, RAND_status, RAND_load_file, RAND_file_name, CRYPTO_malloc, CRYPTO_free, CRYPTO_set_mem_functions](../../../core/libs/prx/libSceLibreSsl/src/Runtime.cpp) (libSceLibreSsl) - follow LibreSSL's [rand_lib.c, randfile.c](https://github.com/libressl/openbsd/tree/0f0b16dc977f6ca499f0f4540078d992c96da597/src/lib/libcrypto/rand) and [malloc-wrapper.c](https://github.com/libressl/openbsd/blob/0f0b16dc977f6ca499f0f4540078d992c96da597/src/lib/libcrypto/malloc-wrapper.c), which are the same in 2.6.5 (3.4.3 linked); nothing is checked on the console. `RAND_bytes` reads host entropy and `CRYPTO_malloc` and `CRYPTO_free` use the guest heap. `CRYPTO_malloc` returns null for a size of zero or less, as LibreSSL 2.5.4 to 3.4 do; later versions take a `size_t` size and call `malloc`. A null buffer with a positive length throws
+- [AES_set_encrypt_key, AES_set_decrypt_key, AES_encrypt, AES_decrypt, AES_ecb_encrypt, AES_cbc_encrypt, AES_cfb128_encrypt, AES_ctr128_encrypt](../../../core/libs/prx/libSceLibreSsl/src/Aes.cpp) (libSceLibreSsl) - follow LibreSSL's [aes.h](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/aes/aes.h) and [mode code](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/modes). Nothing is checked on the console. Key setup follows [LibreSSL 2.5.4's aes_core.c](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/aes/aes_core.c), the version the `X509_verify_cert_error_string` entry names: a null pointer returns -1 and a key length other than 128, 192 or 256 bits returns -2 before the key is written, and only the 44, 52 or 60 words the key length needs are written. The `AES_KEY` schedule uses that file's generic C layout (big-endian words, `rounds` 10, 12 or 14). The 2.5.4 amd64 build uses [aes-x86_64](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/aes/asm/aes-x86_64.pl) instead, which copies the key bytes without swapping, so each word is byte-reversed compared with the C layout (OpenSSL 3.0.13's x86-64 code gives the same schedules byte-reversed); the console's build options are unknown, so a schedule the title reads or fills is unverified. CTR leaves the last keystream block in `ecount_buf` even at a block boundary. Null pointers in the cipher and mode functions, other `rounds` values and a CFB or CTR position outside 0-15 throw
+- [ERR_get_error, ERR_peek_error, ERR_clear_error, ERR_remove_thread_state](../../../core/libs/prx/libSceLibreSsl/src/Error.cpp) (libSceLibreSsl) - no export of this library adds an error yet, so the queue stays empty for guest code. The per-thread queue of 16 slots holding 15 codes, its order and the `ERR_PACK` layout follow LibreSSL's [err.c](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/err/err.c) and [err.h](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/err/err.h); the module's LibreSSL version is unknown and nothing is checked on the console. The queue keeps no file, line or data, as no export reads them. `ERR_remove_thread_state` with a thread id throws: that version asserts a null id, while older versions remove the state of the thread the id names
+- [OCSP_response_status_str, OCSP_cert_status_str and OCSP_crl_reason_str](../../../core/libs/prx/libSceLibreSsl/src/Ocsp.cpp) (libSceLibreSsl) - the module's strings are not measured on the console. The tables follow LibreSSL [ocsp_prn.c](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/ocsp/ocsp_prn.c), unchanged from revision 1.8 (2015) to 1.12 (2025), with codes from `ocsp.h`; the argument is a 64-bit `long` and every value not in a table returns `(UNKNOWN)`
+
+- [SSL_CIPHER_get_bits, SSL_CIPHER_get_name and SSL_CIPHER_get_version](../../../core/libs/prx/libSceLibreSsl/src/Cipher.cpp) - the 88-byte guest cipher layout and these calls are not console-verified. They follow [LibreSSL 2.5.4 ssl.h](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libssl/ssl.h) and [ssl_ciph.c](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libssl/ssl_ciph.c), matching the version in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214). Console modifications and other firmware layouts remain unverified. Protocol labels use the full 64-bit cipher ID, not the protocol flags; TLS 1.2 ciphers still report `TLSv1/SSLv3`, as in that release.
+
+### Functional
+
+- [ASN1_INTEGER_get](../../../core/libs/prx/libSceLibreSsl/src/Asn1.cpp) has no console verification for nonpositive lengths. It follows [LibreSSL 2.5.4](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/asn1/a_int.c#L363-L389): valid integer types return zero without reading data when length is zero or negative; invalid types return -1 first. Later LibreSSL versions reject negative lengths through `ASN1_INTEGER_get_int64`; that later contract is not used for this library.
+
+- [ASN1_INTEGER_get and ASN1_STRING_data/length/type/to_UTF8](../../../core/libs/prx/libSceLibreSsl/src/Asn1.cpp) are unverified on PS5. Signatures, the 24-byte guest string layout and conversions follow [LibreSSL 2.5.4's ASN.1 sources](https://github.com/libressl/openbsd/tree/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/asn1), the version reported for firmware 13.40 in [discussion #8981](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214). Null accessor inputs, null conversion outputs, missing nonempty data, oversized converted output and unrepresentable signed integer values throw where the source has undefined behaviour. Malformed encodings and allocation failure throw until ASN.1 error-queue reporting is implemented. Conversion buffers use the guest libc allocator and can be released with guest `free`.
+
+- [SSL_alert_desc_string_long](../../../core/libs/prx/libSceLibreSsl/Alert.cpp) - Console execution and equivalence across other firmware revisions remain unverified. BunnyFl reports identical strings for 3,841 inputs across three runs against the firmware 13.42 module executed natively on a PC ([comparison](https://github.com/boykopovar/AnyPS5/pull/9870#issuecomment-6406774281)); this is not a console run. The mapping follows LibreSSL 2.5.4.
diff --git a/docs/dev/debt/libSceLibreSsl3.md b/docs/dev/debt/libSceLibreSsl3.md
index dba672f91f..c98952a914 100644
--- a/docs/dev/debt/libSceLibreSsl3.md
+++ b/docs/dev/debt/libSceLibreSsl3.md
@@ -7,4 +7,4 @@
 ### Functional
 
 - [CRYPTO_memcmp](../../../core/libs/prx/libSceLibreSsl3/Export.cpp) follows the public [LibreSSL signature and equality contract](https://man.openbsd.org/CRYPTO_memcmp.3), without PS5 verification. The exact nonzero result for unequal buffers is unspecified by that contract. Content-independent execution of its volatile byte reads still depends on the compiler; inspect optimized code when changing toolchains. Closes when: measured on a PS5 and the supported toolchains' generated code is checked.
-- [MD5 and SHA1](../../../core/libs/prx/libSceLibreSsl3/src/Digest.cpp) (libSceLibreSsl3) - follow LibreSSL's [md5.c, sha1.c](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto) and hash through libSceLibreSsl's `MD5_*` and `SHA1_*`. A null digest buffer throws: LibreSSL up to 3.8 returns a static buffer, later versions do not check it. Nothing is checked on the console
+- [MD5 and SHA1](../../../core/libs/prx/libSceLibreSsl3/src/Digest.cpp) (libSceLibreSsl3) - follow LibreSSL's [md5.c, sha1.c](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto) and hash through libSceLibreSsl's `MD5_*` and `SHA1_*`. A null digest buffer, which LibreSSL 4.0.0 does not check, throws. Nothing is checked on the console
diff --git a/docs/dev/debt/libSceMsgDialog.md b/docs/dev/debt/libSceMsgDialog.md
new file mode 100644
index 0000000000..71acb51911
--- /dev/null
+++ b/docs/dev/debt/libSceMsgDialog.md
@@ -0,0 +1,9 @@
+# libSceMsgDialog technical debt
+
+### Silent stubs
+
+- [libSceMsgDialog](../../../core/libs/prx/libSceMsgDialog/Export.cpp) - message dialogs show no UI. `sceMsgDialogOpen` opens one without `sceMsgDialogInitialize` as well, and a user message or system message dialog finishes on the second `sceMsgDialogGetStatus` or `sceMsgDialogUpdateStatus` call; the first 160 characters of a user message are only logged. The button it picks (2 for `YES_NO_FOCUS_NO`, otherwise 1) is kept but not returned, as `sceMsgDialogGetResult` is exported by libSceMsgDialog.native. A progress bar dialog runs until `sceMsgDialogClose` or for 30 seconds, and `sceMsgDialogProgressBarInc`, `sceMsgDialogProgressBarSetMsg` and `sceMsgDialogProgressBarSetValue` ignore their arguments
+
+### Unknown function info
+
+- [sceMsgDialogOpen](../../../core/libs/prx/libSceMsgDialog/Export.cpp) (libSceMsgDialog) - the `SceMsgDialogParam` layout it reads is not measured on a PS5: the mode at 0x38 (1 user message, 2 progress bar, 3 system message), the user message parameter pointer at 0x40, and in that parameter the button type at 0 and the message pointer at 8. A mode outside 1 to 3, or a parameter that cannot be read, is treated as a user message; only Windows checks that the memory is readable, so on Linux any non-null pointer is read. The errors `0x80b80003` (not initialized), `0x80b80007` (busy), `0x80b8000b` (not running) and `0x80b8000d` (null argument) are not measured either. Closes when: measured on a PS5
diff --git a/docs/dev/debt/libSceNet.md b/docs/dev/debt/libSceNet.md
index 625feb8f4e..bdb60647aa 100644
--- a/docs/dev/debt/libSceNet.md
+++ b/docs/dev/debt/libSceNet.md
@@ -2,22 +2,26 @@
 
 ### Silent stubs
 
+- [sceNetShowRouteWithMemory](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - validates memory pool ID and returns success without printing anything: the `(poolId)` signature and pool validation follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp) and `sceNetShowNetstatWithMemory`. What the console prints and where is unverified
 - [sceNetShowIfconfig, sceNetShowNetstat](../../../core/libs/prx/libSceNet/Export.cpp) return the native not-initialized error and set errno before initialization. Initialized calls throw because native diagnostic collection and formatting are not implemented.
-- [sceNetShowRoute, sceNetShowRoute6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - return success without printing anything: the `()` signatures and the success return follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/net.cpp), which stubs each the same way. PPSA01530 fails to load without the `sceNetShowIfconfig` export (#3177); PPSA11386 imports `sceNetShowNetstat` but does not call it during start-up. What the console prints and where is unverified
+- [sceNetShowPolicy, sceNetShowNetstatEx, sceNetShowRoute, sceNetShowRoute6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - return success without printing anything: the `()` signatures and the success return follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/net.cpp), which stubs each the same way. PPSA01530 fails to load without the `sceNetShowIfconfig` export (#3177); PPSA11386 imports `sceNetShowNetstat` but does not call it during start-up. What the console prints and where is unverified
 
 ### Unknown function info
 
+- [sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) - `SO_PROTOCOL` on raw sockets throws: FreeBSD's raw protocol-switch selection has not been mapped to host raw sockets. For stream and datagram sockets, the effective creation protocol and accepted-socket inheritance follow FreeBSD 11.4's [protocol tables](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/in_proto.c) and [sogetopt](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/kern/uipc_socket.c); the `0x1016` option and truncated integer output are not measured on PS5. Existing null-pointer validation still returns `EINVAL`.
+- [sceNetRecv, sceNetRecvfrom and sceNetRecvmsg](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - zero-length TCP receives while connecting, after disconnect, or with a pending host error still use the host receive path. Error and output precedence in those states is unmeasured on a console. The established, error-free case follows FreeBSD 11.4's [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1568-L1583).
+
 - [sceNetConfigAddIfaddr](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - disassembly confirms the same interface/address/broadcast/netmask arguments as SetIfaddr, entering its shared handler with add mode selected. GetIfaddr copies up to two 16-byte interface-address records. GetRouteInfo uses a family, record buffer, signed capacity and byte flags; internal statistics output is 16 bytes. The address-record and internal-statistics fields remain incomplete.
 
-- [Resolver-connect, thread creation, interface and diagnostic queries, WLAN configuration and DHCP queries](../../../core/libs/prx/libSceNet/Export.cpp) retain unsupported implementations. Their restored argument lists still reference incomplete connection, thread, interface, route, WLAN and statistics types. Kernel ioctl payloads need reconstruction from their handlers or consumers; buffer lengths alone do not establish field types.
+- [Resolver-connect, interface and diagnostic queries, WLAN configuration and DHCP queries](../../../core/libs/prx/libSceNet/Export.cpp) retain unsupported implementations. Their restored argument lists still reference incomplete connection, interface, route, WLAN and statistics types. Kernel ioctl payloads need reconstruction from their handlers or consumers; buffer lengths alone do not establish field types.
+- [sceNetThreadCreate, sceNetThreadExit, sceNetThreadJoin, sceNetEmulationGet and sceNetEmulationSet](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the signatures, the `{ entry, arg, reserved, flags }` parameter block and the `EOPNOTSUPP` of the two emulation calls ("not available on retail units") follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/net/net.cpp) (PS4), not a PS5 measurement. The block is read on the new thread, so it must stay valid until the thread starts, `flags` is ignored (shadPS4 ends the thread with `pthread_exit` when bit 0 is set, which ends it the same way), and a failing `scePthreadCreate` or `scePthreadJoin` result is returned as it is, where shadPS4 also sets the net errno from it
 - [sceHttp2GetMemoryPoolStats, sceSslGetMemoryPoolStats, sceNetGetMemoryPoolStats](../../../core/libs/prx/libSceNet/Export.cpp) (libSceHttp2, libSceSsl, libSceNet) - the signatures `(int id, stats*)`, the layouts (pool size, peak and current use, and for Http2 and Ssl a 32-bit reserved field) and the error codes were measured on a PS5 (firmware 13.60). The pool size is the one given at init or pool creation. Http2 and Net allocate nothing from these pools. Ssl counts its certificate backend allocations and returned data against its pool; C++ bookkeeping is outside that budget. All three initially report zero use, where the console already reports 0x15C0 bytes for Ssl, 0x1640 for Http2 and 4 for a Net pool. Ssl's allocation sizes and peak usage do not reproduce the console allocator
 - [sceNetClearDnsCache](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the library has no DNS cache to clear because lookups use the host resolver. The host resolver cache is left unchanged.
 - [sceNetEtherStrton](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - strings shorter than 17 bytes return EINVAL without changing the output, rather than reading past the terminating NUL as in the [firmware 13.60 probe](https://gist.github.com/orezraey/789290577123af3c45b340d6db6f395c/71e0a6215c7ee86f49fdb31de989dd2b50720b7a). Non-ASCII digit bytes throw because their decoding is unmeasured; other firmware versions remain unverified. Fixed character pairs, ignored separators, alphabetic values beyond f, non-alphanumeric ASCII values of 0x7f, and null-pointer EINVAL follow those measurements, not the strict [shadPS4 parser](https://github.com/shadps4-emu/shadPS4/blob/d615b3887ba29025a59242e1a26f5b68bb176158/src/core/libraries/net/net.cpp#L1274-L1297)
-- [sceNetGetDnsInfo](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the `(info, int flags)` signature, the two IPv4 server slots in network byte order and the server count as the return value follow the PS4 [OpenOrbis musl resolver](https://github.com/OpenOrbis/musl/blob/2b0bb8ce2fa64ac255cb656785729d159a5f074c/src/network/resolvconf.c) and [OpenOrbis Net.h](https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/0a1aaf9dd4a92695538bdeb09fb056d06dd11725/include/orbis/Net.h); unverified on PS5 hardware. It reports the host DNS servers of the interface `sceNetCtlGetInfo` reports, never servers set through `sceNetSetDnsInfo`. Zeroing the unused slots and returning 0 without a host IPv4 interface are unverified. Nonzero flags and a null info throw because their console results are unknown
+- [sceNetGetDnsInfo](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - host-interface selection, zeroing unused slots and returning 0 without a host IPv4 interface remain unverified on PS5 hardware. It reports the host interface's DNS servers until a guest override is set. The two network-order IPv4 slots and returned count follow the PS4 [OpenOrbis musl resolver](https://github.com/OpenOrbis/musl/blob/2b0bb8ce2fa64ac255cb656785729d159a5f074c/src/network/resolvconf.c) and [Net.h](https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/0a1aaf9dd4a92695538bdeb09fb056d06dd11725/include/orbis/Net.h).
 - [sceNetGetRandom](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - generates values with the host random device; the system library maintains its own seeded PRNG state.
-- [sceNetInetPtonEx](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the `(int af, const char* src, void* dst, int flags)` signature follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp); IPv4 conversion and the ignored flags follow PS4 firmware 10.71, not yet confirmed on PS5. There IPv4 text is read as `inet_aton` reads it (`a`, `a.b`, `a.b.c`, hex and octal parts, values wrapping at 32 bits, the text ending at the first space, tab or VT), except that a part starting with `09` is decimal (`"0989"` is 989) and an octal part with `8` or `9` fails. Flags 0, each single bit up to 0x100, 0x10000, 0x80000000 and -1 gave the same results; other values were not measured. LF, FF and CR as terminators, and `NET_EINVAL` for a null `src` or `dst`, follow `sceNetInetPton` and were not measured for this function. IPv6 converts as `sceNetInetPton` does.
+- [sceNetInetPtonEx](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - for IPv6 a null `dst` returns `NET_EINVAL` here, where it crashed a payload process on a PS5 (firmware 13.60). The `(int af, const char* src, void* dst, int flags)` signature follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp). On PS4 firmware 10.71 and on that PS5, IPv4 text is read as `inet_aton` reads it (`a`, `a.b`, `a.b.c`, hex and octal parts, values wrapping at 32 bits, the text ending at a space, tab or VT), except that a part starting with `09` is decimal (`"0989"` is 989) and an octal part with `8` or `9` fails; flags were ignored (PS4: 0, single bits up to 0x100, 0x10000, 0x80000000, -1; PS5: 1, 2, 4, 0x100, 0x10000, -1). On the PS5 only: LF, FF and CR also end the text, a null `src` returns `NET_EINVAL`, and a null `dst` returns 1 or 0 without writing or setting errno. IPv6 converts as `sceNetInetPton` does
 - [sceNetMemoryAllocate and sceNetMemoryFree](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - allocations use the guest heap instead of the system network pool. Pool limits, its allocation accounting and free-time fill are not reproduced: a reused block allocated without flag 2 holds 0xdd bytes on the console and its previous contents here. Flag 4 bypasses the system pool reserve threshold; with no pool there is no threshold, so it allocates as other flags do. What the console returns once the pool is exhausted is unmeasured; AnyPS5 returns null without setting an errno. Measured on a PS5 (firmware 13.60): a size of 0 or less returns null and leaves `sceNetErrnoLoc` unchanged, flag 2 zero-fills, flags 1, 4, 8, 0x10, 0x100 and 0x80000000 had no visible effect, and every block of 1 to 65536 bytes was 64-byte aligned
-- [sceNetThreadExit](../../../core/libs/prx/libSceNet/Export.cpp) is a zero-argument, non-returning void export in the native module. The protected host stub still declares int and contains `return 0`; changing it to void requires changing that protected body, so the return-type mismatch is retained.
 - [sceNetConfigCleanUpAllInterfaces](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the native routine consumes no arguments; the throwing implementation remains unchanged.
 - [sceNetDhcpdStart](../../../core/libs/prx/libSceNet/Export.cpp): six arguments and the three-argument address callback are confirmed. The 24-byte parameter contains five network-order addresses and a client limit. Individual address roles and the two unused thread-option meanings remain unresolved.
 - [sceNetPppoeStart](../../../core/libs/prx/libSceNet/Export.cpp): seven arguments are confirmed, including the parameter pointer on the stack. The 272-byte parameter contains two DNS addresses, two 128-byte credential arrays, MTU and flags. Callback arguments are user data, event and error; the two unused thread-option meanings remain unresolved.
@@ -26,25 +30,35 @@
 
 ### Functional
 
-- [sceNetUsleep](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) prints nothing for a negative count, where the console prints `[LIBNET] usleep <count>` to standard output before failing with `EINVAL`. What an interrupted sleep returns is unmeasured: AnyPS5 returns the result of libkernel's `sceKernelUsleep`, a cancellation point. The signed 32-bit count (the upper half of the register is ignored) and the 0 result were measured on a PS5 (firmware 13.60)
+- [sceNetRecv/sceNetRecvfrom](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) translate Windows WSAEMSGSIZE into the copied byte count for datagram sockets, including MSG_PEEK, and retain the sender address. This follows FreeBSD 11.4 recv(2) and Winsock's documented truncated-datagram behavior; the console measurement covered only libkernel_sys `recv` and `recvfrom`, not libSceNet.
+- [sceNetUsleep](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - whether the console prints its `[LIBNET] usleep <count>` line for a negative count before `sceNetInit` is unmeasured; nothing is printed here. What an interrupted sleep returns is unmeasured: AnyPS5 returns the result of libkernel's `sceKernelUsleep`, a cancellation point. The signed 32-bit count (the upper half of the register is ignored) and the 0 result were measured on a PS5 (firmware 13.60)
 - [sceNetIoctl](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - on a `sceNetSocket` socket only `FIONBIO` and `FIONREAD` are handled and other requests fail with `ENOTTY`, as in libkernel's `ioctl`, though FreeBSD 11.4's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L156-L262) handles more; not measured on a console. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/60c42b925c3d1e00008621b8587819999260ec31/src/core/libraries/net/net.cpp#L1839) (PS4) returns `EINVAL` for other requests. `FIONBIO` sets `SO_NBIO`, assumed to be `soo_ioctl`'s `SS_NBIO`. `FIONREAD` asks the host, which on Linux counts only the next datagram where `soo_ioctl` counts all. Libkernel's own sockets go to its `ioctl`; other descriptors get `EBADF`.
 - [sceNetResolverStartAton6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) reverse-resolves a 16-byte IPv6 address through the host resolver (`getnameinfo` with `NI_NAMEREQD`) into the caller's buffer of `len` bytes, as `sceNetResolverStartAton` does for IPv4. The `(rid, addr, hostname, len, timeout, retry, flags)` signature comes from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs#L992-L997). An address with no name, or a name longer than `len - 1` bytes, fails with `RESOLVER_ENODNS` (`0x804101E1`) and leaves the buffer untouched; whether the console truncates instead is not verified. Abort flag 2 (ATON preservation) fails the next call with `EINTR` as it does `sceNetResolverStartAton`. Timeout and retry are ignored, and any nonzero flags throw because their meaning is unknown
-- [sceNetAccept](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) inherits the listener's non-blocking mode through the existing `SO_NBIO` setter, as the libkernel socket path does and FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L571) copies the socket state. The mode is sampled when accept starts; changes between connection creation and accept are not modelled. Not measured on a console.
+- [sceNetAccept](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) inherits the listener's non-blocking mode through the existing `SO_NBIO` setter, as the libkernel socket path does and FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L571) copies the socket state. The mode is read after the host accept returns; changes between connection creation and accept are not modelled. Not measured on a console.
 
-- [sceNetConnect to AF_UNSPEC](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux a socket bound to an explicit port keeps its local address as well (`127.0.0.1:<port>` stays `127.0.0.1:<port>`), because a bound socket cannot be bound again; one bound to port 0 is bound again to the wildcard address with the port it had
+- [sceNetConnect to AF_UNSPEC](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux and on Windows a socket bound to an explicit port keeps its local address as well (`127.0.0.1:<port>` stays `127.0.0.1:<port>`), because a bound socket cannot be bound again, and `sceNetGetsockname` reports that host address. On Windows a `sendto` on such a host socket to a non-loopback address fails with Winsock error 10051 (measured on the host socket, not through `sceNetSendto`), where FreeBSD sends it from the wildcard address. One bound to port 0 is bound again to the wildcard address with the port it had
 - [sceNetSetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) sets `SO_RCVTIMEO` and `SO_SNDTIMEO` as the host socket's timeouts. Windows sockets stay non-blocking and the library waits for readiness until the stored timeout. Blocking stream sends return the queued byte count on timeout, or `EAGAIN` when no bytes were queued.
 - [sceNetSetsockopt, sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) take `SO_SNDTIMEO` and `SO_RCVTIMEO` (0x1005, 0x1006) as a 16-byte `struct timeval`, as FreeBSD 11.4's [`sosetopt` and `sogetopt`](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/uipc_socket.c#L2657-L2690) do, and Sony's 0x1105 and 0x1106 as an `int` of microseconds. A [console log of ProsperoLight](https://github.com/blackbearreloaded/ProsperoLight/issues/49) (firmware 12.20) shows receives timing out every 100 ms after it gave 0x1006 a `{0, 100000}` timeval. The errors for a value shorter than a timeval (`EINVAL`) or out of range (`EDOM`), and `sceNetGetsockopt` cutting the timeval to the caller's length, follow FreeBSD's `sooptcopyin` and `sooptcopyout` and are not measured on a console
+- [SO_OOBINLINE](../../../core/libs/prx/libSceNet/Export.cpp) uses native TCP urgent-data handling; its urgent-pointer and signalling behavior has not been compared with PS5. The flag bit (0x100), non-stream flag storage and truncated readback follow FreeBSD 11.4 [sosetopt/sogetopt](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/kern/uipc_socket.c). Null pointers retain the existing libSceNet `EINVAL` result.
 - [sceNetSetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) stores `SO_ONESBCAST` (`0x10000`, [shadPS4's `ORBIS_NET_SO_ONESBCAST`](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net_types.h)) per socket and `sceNetGetsockopt` reads back the value that was set, as shadPS4 does; PPSA34501 sets it and crashes later when it fails with `EOPNOTSUPP`. Sends ignore it. FreeBSD 11.4's [ip(4)](https://man.freebsd.org/cgi/man.cgi?manpath=FreeBSD+11.4-RELEASE&query=ip&sektion=4) documents the like-named `IPPROTO_IP` option `IP_ONESBCAST`: a datagram sent to an interface's directed broadcast address, such as 192.168.2.255, leaves through that interface with its destination rewritten to 255.255.255.255, and only on a socket allowed to set `SO_BROADCAST`. Here host routing selects the outgoing interface and the destination is not rewritten. shadPS4 also leaves sends unchanged, and its [TODO](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp#L2467-L2470) reads the option the other way round: a send to 255.255.255.255 would be converted to the interface's broadcast address. Whether the console's `SOL_SOCKET` option behaves like `IP_ONESBCAST`, and what it reads back, is not verified on hardware. FreeBSD 11.4's `sogetopt()` reads several boolean socket options back as their flag bit (`so_options & optname`, `sys/kern/uipc_socket.c`), not as the value set; whether the console does so for `0x10000` is unknown
-- [sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) reads `SO_ERROR` from the host socket. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new `sceNetConnect`; a second failure with the same code on the same socket without a `sceNetConnect` in between would be hidden.
-- [sceNetSetsockopt, sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) set `TCP_NODELAY` (`IPPROTO_TCP`, 1) on the host socket of a stream socket and read it back as `TF_NODELAY` (4) or 0, as FreeBSD 11.4's [`tcp_default_ctloutput`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/tcp_usrreq.c#L1626-L1650) does. Every other `IPPROTO_TCP` option (`TCP_MAXSEG`, `TCP_NOPUSH` and `TCP_KEEPIDLE` among them, which FreeBSD implements) fails with `ENOPROTOOPT`, and the `IPPROTO_TCP` level on a socket that is not a stream socket fails with `EINVAL`, as [`ip_ctloutput`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/ip_output.c#L943-L944) answers it. A set on a connection that FreeBSD's [`tcp_ctloutput`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/tcp_usrreq.c#L1498-L1502) refuses with `ECONNRESET` (refused, reset or in `TIME_WAIT`) succeeds here because the host accepts it. A null value with a nonzero length fails with `EINVAL`, where FreeBSD's `kern_setsockopt` returns `EFAULT`, and a get into less than an `int` fails with `EINVAL`, where `sooptcopyout` truncates. None of this was measured on a console.
+- [SO_REUSEADDR and SO_BROADCAST readback](../../../core/libs/prx/libSceNet/Export.cpp) follows FreeBSD 11.4's [sogetopt](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/kern/uipc_socket.c#L2674-L2688): enabled options return their flag bit, and output is truncated to the supplied length. PS5 results are unverified. Values reflect the native socket; host restrictions on setting the options are unchanged. Null pointers retain libSceNet's existing `EINVAL` result. Windows passes `SO_REUSEADDR` directly to Winsock, which permits a second bind to an occupied address and port under its [reuse rules](https://learn.microsoft.com/en-us/windows/win32/winsock/using-so-reuseaddr-and-so-exclusiveaddruse), unlike FreeBSD's separate `SO_REUSEPORT` requirement for duplicate unicast binds. Guest `SO_REUSEPORT` (`0x200`) still fails with `EOPNOTSUPP`.
+- [sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) reads `SO_ERROR` from the host socket. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new `sceNetConnect`; a second failure with the same code on the same socket without a `sceNetConnect` in between would be hidden. One title (PPSA02225) disassembled for this entry has one call site (0x1056d34), with level 0xffff, option 0x1007 (FreeBSD's `SOL_SOCKET` and `SO_ERROR`) and a length variable set to 4 beforehand, reached only after a helper called with the value 2 returned true. For a negative result it takes the thread's error code as the value; for a result of 0 or more with a value of 0 it reports the connection as made, and otherwise it turns the value into an error code of its own. The call does not show how often the title reads it or whether it keeps using the socket after an error.
+- [SO_KEEPALIVE](../../../core/libs/prx/libSceNet/Export.cpp) uses the host TCP keepalive timers and probe count, which can differ from the console. The boolean flag, bit-valued readback and truncated output follow FreeBSD 11.4's [sosetopt and sogetopt](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/kern/uipc_socket.c), without PS5 hardware verification. Non-stream sockets retain the flag without sending probes, as FreeBSD does. Null pointers retain the existing libSceNet `EINVAL` result instead of FreeBSD's `EFAULT`.
+- [sceNetSetsockopt, sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) - `TCP_MAXSEG`, `TCP_NOPUSH`, `TCP_KEEPIDLE` and other TCP options remain unsupported (`ENOPROTOOPT`). `TCP_NODELAY` sets on refused, reset or `TIME_WAIT` sockets can succeed through the host where FreeBSD 11.4's [tcp_ctloutput](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/tcp_usrreq.c#L1498-L1502) returns `ECONNRESET`. A null setter value returns `EINVAL` rather than `kern_setsockopt`'s `EFAULT`. The non-stream `IPPROTO_TCP` error (`EINVAL`) and `TF_NODELAY` flag readback follow FreeBSD, not PS5 measurements.
+- [SO_TYPE and SO_ACCEPTCONN](../../../core/libs/prx/libSceNet/Export.cpp) read the guest socket type and listening flag, with bit-valued listening results and truncated output following FreeBSD 11.4's [sogetopt](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/kern/uipc_socket.c#L2667-L2693), without PS5 verification. Null pointers retain the existing libSceNet `EINVAL` result instead of FreeBSD's pointer handling.
 - [sceNetGetSockInfo](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) reports 0 for the name, pid, policy, priority, queue lengths, virtual ports, state, bandwidth, drops and waits, sets no status flag except `SELF` (0x1) and `NONBLOCK` (0x200000), and reports the host's buffer sizes where none was set. An IPv6 socket fails with `EAFNOSUPPORT` and is not counted or listed; shadPS4 lists it with zero addresses. `flags` bits other than 0x40 fail with `EINVAL`, where shadPS4 ignores `flags`; 0x40 adds sockets in TIME_WAIT ([SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs)), but closed sockets are not kept. Otherwise the `s` below 0 count and list, the return value and `EINVAL` for a null `info` or an `n` below 1 follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/06e813ff8c8e2a6d81b02cabfcc9543c3debf78e/src/core/libraries/net/net.cpp#L1498-L1522). Not measured on a console.
 - [SO_SNDBUF and SO_RCVBUF validation](../../../core/libs/prx/libSceNet/Export.cpp) remains unverified on PS5, and positive sizes remain subject to host buffer limits. Nonpositive sizes fail with `EINVAL` before changing the native socket, following FreeBSD 11.4 [sosetopt](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/kern/uipc_socket.c#L2494-L2509).
 - [sceNetSendmsg and sceNetRecvmsg](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) copy the scatter/gather list through one host buffer and accept only the flags `sceNetSend`/`sceNetRecv` accept. Sending control data throws; a receive never returns control data (`msg_controllen` 0), since no socket option that queues it is supported
+- [sceNetGetSockInfo6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) is not measured on a console; shadPS4 stubs it. It lists only IPv6 sockets and `flags` 0x1000 adds IPv4 sockets, reported with the IPv4 addresses, all-zero IPv6 addresses and no `F_IPV6` (0x400000), which every IPv6 socket sets ([SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs#L251-L343), [flags](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs#L698-L705), [docs](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/docs/net.md#L301-L304)). The default of leaving IPv4 sockets out, the zero IPv6 addresses of an IPv4 socket and accepting 0x40 are inferred from those names, not documented. An IPv4 socket without 0x1000 fails with `EAFNOSUPPORT`. The other gaps are those of `sceNetGetSockInfo`.
 - [sceNetSocketClose, sceNetEpollControl and sceNetEpollWait](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - close and concurrent registration ordering are unmeasured on a console. Closed descriptors retire their registrations, and a wait discards snapshots invalidated by close, DEL or MOD; descriptor identity follows [Linux epoll(7)](https://man7.org/linux/man-pages/man7/epoll.7.html). ADD, MOD and DEL reject closed or invalid socket descriptors with `EBADF`, as [Linux epoll_ctl(2)](https://man7.org/linux/man-pages/man2/epoll_ctl.2.html) does; this error ordering is unmeasured on a console. Duplicate-descriptor alias lifetime is not modeled by this epoll backend.
 - [MSG_DONTWAIT](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - console ordering between competing readers and writers is unmeasured. The per-call behavior follows FreeBSD 11.4's `soreceive_generic` and `sosend_generic` (`sys/kern/uipc_socket.c`); `0x80` is FreeBSD's flag value (`sys/sys/socket.h`). On Windows native sockets stay non-blocking. `MSG_DONTWAIT` and guest `SO_NBIO` return one host transfer's result. Blocking stream sends queue the whole buffer with one deadline and return progress after a timeout or host error. SSL uses this path through the native owner, retaining the socket, its mode and timeouts. Readiness waits poll at most every 10 ms for local close, so idle blocked operations wake periodically.
+- [Stream sends on macOS](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - a `MSG_DONTWAIT` transfer also passes XNU's `MSG_NBIO` (`0x20000`, absent from the SDK headers), because XNU's `MSG_DONTWAIT` does not keep a stream send from waiting for buffer space. A blocking stream send goes to the host in sends of 64 KiB, so an error after some progress, such as an abort, reports the bytes already queued, which one host send would drop; the bytes that the failing 64 KiB send had queued are not counted
 - [sceNetRecv, sceNetRecvfrom and sceNetRecvmsg](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) on a datagram socket with no local address wait on Windows and macOS until a bind, connect or send gives it one, checking the host socket every 10 ms. Winsock fails such a receive with `WSAEINVAL`, where FreeBSD 11.4's `soreceive_dgram` waits for a datagram (`sys/kern/uipc_socket.c`). On macOS the host receive waits, but a receive-side `shutdown` does not wake it. A non-blocking socket fails with `EAGAIN` at once, and the receive timeout ends the wait with `EAGAIN`; when the address comes first, the call waits for a datagram only for what is left of the timeout. A `sceNetShutdown` of the receive side ends the wait and the receive returns 0, and a zero-length receive returns 0 without waiting, as `soreceive_dgram` does when the socket can't receive more or nothing was asked for. An abort or close ends the wait, and the host receive then fails as it did before
 - [sceNetResolverAbort and sceNetResolverStartNtoaMultipleRecords](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) follow shadPS4 ([net.cpp](https://github.com/shadps4-emu/shadPS4/blob/811bfcd7d17ed8ae975c477d9ff28abc744e1ca8/src/core/libraries/net/net.cpp), [net_resolver.cpp](https://github.com/shadps4-emu/shadPS4/blob/811bfcd7d17ed8ae975c477d9ff28abc744e1ca8/src/core/libraries/net/net_resolver.cpp)); the `(int rid, int flags)` signature of the abort also matches [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs). Unverified on hardware. Lookups run synchronously over the host resolver, which cannot be interrupted: an abort while a lookup runs on another thread returns at once, and that lookup fails with `EINTR` without writing its output only when the host call returns; the abort flags are then ignored, as shadPS4 does for a running lookup. With nothing running, abort flag 1 (NTOA preservation) or 2 (ATON preservation) makes the next `sceNetResolverStartNtoa*` or `sceNetResolverStartAton` call on that resolver fail with `EINTR`, reported by `sceNetResolverGetError`, after its arguments are checked. Unlike shadPS4, which ignores them, other abort flag bits throw, and `sceNetResolverStartNtoaMultipleRecords` throws for any flag, including async (1) and 0x10000 (IP address literals disabled), as `sceNetResolverStartNtoaMultipleRecordsEx` does
 - [sceNetResolverStartNtoa6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) resolves a host name to its first IPv6 address through the host resolver (`getaddrinfo` with `AF_INET6`) and writes the 16-byte address; the `(rid, hostname, addr, timeout, retry, flags)` signature follows `sceNetResolverStartNtoa`. A name with no IPv6 address fails with `RESOLVER_ENODNS` (`0x804101E1`) like a failed lookup; whether the console returns IPv4-mapped addresses instead is not verified. Timeout and retry are ignored as in `sceNetResolverStartNtoa`, and any nonzero flags throw because their meaning for this call is not known. Unverified on hardware.
-- [sceNetInetPton](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) ends an IPv4 address at the first space, tab, LF, VT, FF or CR and ignores the rest (`"1.2.3.4 x"` converts), leaves the destination and `sceNetErrnoLoc` unchanged when a conversion fails, as PS4 firmware 10.71 does; not yet confirmed on PS5. Leading whitespace, any other trailing byte (`0x01`, `0xa0`) and IPv6 text with whitespace fail.
+- [sceNetInetPton](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - an IPv6 conversion with a null `dst` returns `NET_EINVAL` here, where it crashed a payload process on a PS5 (firmware 13.60). On that PS5 and on PS4 firmware 10.71 an IPv4 address ends at the first space, tab, LF, VT, FF or CR and the rest is ignored (`"1.2.3.4 x"` converts), and a failed conversion leaves the destination and `sceNetErrnoLoc` unchanged. On the PS5 the dotted IPv4 part of IPv6 text is read the same way (`"::ffff:1.2.3.4 x"` converts, `"::ffff:01.2.3.4"` fails), and an IPv4 conversion with a null `dst` returns 1 or 0 without writing. Leading whitespace, any other trailing byte (`0x01`, `0xa0`) and whitespace after hexadecimal IPv6 text fail
+- [sceNetInetPton, sceNetInetNtop](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) convert IPv6 text with libkernel's [inet_pton and inet_ntop](../../../core/libs/prx/libkernel/Socket/src/AddressConversion.cpp), so they take the same FreeBSD 11.4 text forms; beyond the PS5 measurements in the entry above, these are unverified on a console. IPv4 text keeps the host conversion. The checks and errors before the conversion are libSceNet's own and unchanged
+- [sceNetResolverStartNtoa](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) ignores flag bits 0x1 and 0x10000 and does not apply the timeout or retry count: every lookup runs once, synchronously, through the host resolver. What those two bits do on a console is not known; the sceNetResolverAbort entry above gives shadPS4's names for them. A negative timeout or retry and any other flag bit fail with `EINVAL` before anything else is checked, as [prosper's reading of the libSceNet module](https://github.com/mattias800/prosper/blob/6c09a34a092a00898fcead5f855200ca7c368cd2/prosper/src/hle/net/hle_net.cpp#L579-L587) gives
 
 - [sceNetDhcpStart, sceNetAddrConfig6Start, sceNetDuplicateIpStart and sceNetInfoDumpStart](../../../core/libs/prx/libSceNet/Export.cpp) - argument widths and callback ABI are recovered. Address callbacks receive user data, a 32-bit event and a 32-bit error. DHCP configuration is mutable; the 512-byte IPv6 configuration is read-only. Their complete field layouts remain unknown. The two 32-bit thread parameters are stored but not consumed by this firmware thread wrapper, so their original names and units are unconfirmed. Information-dump options contain flags, an interval in seconds and a 64-byte path. All four exports remain unimplemented.
+- [sceNetSetDnsInfo, sceNetSetDns6Info and sceNetGetDns6Info](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the resolver still uses the host's DNS servers; setters only store servers for the getters. Without an IPv6 override, the getter reports none. Counts follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0918faa0255e9816b795b62c9b09eaea51a1bc5e/src/core/libraries/net/net.cpp), not hardware measurements. All four DNS calls' initialization and argument errors match a reported [firmware 13.42 module probe](https://github.com/boykopovar/AnyPS5/pull/9506#issuecomment-6390574180): ENOTINIT first, then EINVAL for nonzero flags, null getter outputs or zero primary servers; null setters clear the override. Setters use a checked guest read and return EFAULT for unreadable non-null inputs, an AnyPS5 safety measure absent from the probed module.
diff --git a/docs/dev/debt/libSceNetCtl.md b/docs/dev/debt/libSceNetCtl.md
index aaa9cf2f9d..8665c624a8 100644
--- a/docs/dev/debt/libSceNetCtl.md
+++ b/docs/dev/debt/libSceNetCtl.md
@@ -2,7 +2,7 @@
 
 ### Functional
 
-- [sceNetCtlGetNatInfo and sceNetCtlGetResult](../../../core/libs/prx/libSceNetCtl/Export.cpp) - NAT discovery and service event results are not implemented and throw after native initialization and argument checks. NAT information is 16 bytes with a 32-bit size prefix; the remaining fields are unresolved.
+- [sceNetCtlGetNatInfo](../../../core/libs/prx/libSceNetCtl/Export.cpp) - NAT discovery is not implemented and throws after native initialization and argument checks. NAT information is 16 bytes with a 32-bit size prefix; the remaining fields are unresolved.
 
 ### Unknown function info
 
@@ -10,7 +10,10 @@
 
 - [sceNetCtlGetInfo](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - answers from the host interface that holds an IPv4 address, preferring the one that carries the default route: its address, netmask, gateway, MTU and first two IPv4 DNS servers. The device is reported as wired, the link as connected, the IP configuration as DHCP and the HTTP proxy as off, whatever the host uses, and the Ethernet address is the one `sceNetGetMacAddress` reports. A gateway or DNS server the interface does not have is reported as `0.0.0.0`; what a console reports then is unknown. The DHCP host name (12), the PPPoE user name (13), the HTTP proxy server (20) and the Wi-Fi BSSID and SSID (5, 6) are empty strings, as that configuration sets none of them; the remaining Wi-Fi codes (7-10) and the HTTP proxy port (21) report 0; this follows [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/network.cpp) and is not measured on hardware
 - [sceNetCtlGetInfoV6](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl, NID `Jy1EO5GdlcM`) - imported by PPSA08587. `(int code, SceNetCtlInfoV6* info)` with codes 1-5 (IP address, link-local address, default route, primary and secondary DNS) comes only from [SharpProspero](https://github.com/SvenGDK/SharpProspero), whose source is unknown; shadPS4 and fpPS4 only stub it. A null `info` answers `INVALID_ADDR`, a code outside 1-5 `INVALID_CODE`, and a host without an IPv6 address `NOT_CONNECTED`, as `sceNetCtlGetStateV6` reports it. The layout of each answer is unverified, so every code throws on a host with an IPv6 address
+- [sceNetCtlGetResult](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - `(int eventType, int* errorCode)` reports no error: event types 1-3 (disconnected to IP obtained, the numbering `sceNetCtlCheckCallback` delivers) write 0 to `errorCode`, as `sceNetCtlGetResultV6` does. The error code a console reports for each event, a disconnection's cause in particular, is unconfirmed. Callers found: PPSA20052 (Worms Armageddon: Anniversary Edition 01.003.000) calls it 2 s into boot, and PPSA24191 (Monster Hunter Wilds) without a network, with event 1 (disconnected) as its first call. A null `errorCode` answers `INVALID_ADDR` and other event types throw, as their error code on a console is unknown
 - [sceNetCtlGetResultV6](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl, NID `H5yARg37U5g`) - `(int eventType, int* errorCode)` comes only from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/NetCtl.cs#L246-L251), whose source is unknown; shadPS4 only stubs it. Callbacks registered with `sceNetCtlRegisterCallbackV6` receive no event, so event types 1-3 write 0 to `errorCode`; what a console writes before the first event is unmeasured. A null `errorCode` answers `INVALID_ADDR`, as `sceNetCtlGetResult` does, and other event types throw, as their error code on a console is unknown
+- [sceNetCtlRegisterCallbackForNpToolkit, sceNetCtlUnregisterCallbackForNpToolkit, sceNetCtlCheckCallbackForNpToolkit](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - a table of eight callbacks apart from the IPv4 and IPv6 ones, with the `(int eventType, void* arg)` callback, follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/net_ctl_obj.h), whose NpToolkit check delivers the same events to that table. The three share the register, unregister and dispatch of `sceNetCtlRegisterCallback`, `sceNetCtlUnregisterCallback` and `sceNetCtlCheckCallback`, so they return the same initialization, address, slot-limit and ID errors, and the check reports the state `sceNetCtlCheckCallback` does. Whether the console keeps this table apart, and what `sceNetCtlCheckCallback` does with it, is unverified on hardware
+- [sceNetCtlGetStateIpcInt, sceNetCtlGetStateV6IpcInt, sceNetCtlGetResultIpcInt, sceNetCtlGetResultV6IpcInt, sceNetCtlGetInfoIpcInt, sceNetCtlGetInfoV6IpcInt, sceNetCtlRegisterCallbackIpcInt, sceNetCtlUnregisterCallbackIpcInt, sceNetCtlRegisterCallbackV6IpcInt and sceNetCtlUnregisterCallbackV6IpcInt](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - answer as their public twins, whose recovered argument registers they share: the getters return and write what `sceNetCtlGetState`, `GetStateV6`, `GetResult`, `GetResultV6`, `GetInfo` and `GetInfoV6` do, throws included, and the callback forms use the IPv4 and IPv6 tables, as no IpcInt check is exported to deliver a table of their own. This rests on the matching call shapes, not on a measurement; whether the internal client answers a null pointer or a bad code before its service does is unknown
 - [ApRp exports](../../../core/libs/prx/libSceNetCtl/Export.cpp) are constant-success functions in the supplied native module and consume no arguments. No callers were found in the supplied system-library decompilations, so unused callback, output and configuration argument types remain unresolved. Protected stub bodies are unchanged.
 
 ### Functional
diff --git a/docs/dev/debt/libSceNetCtlAp.md b/docs/dev/debt/libSceNetCtlAp.md
index 94b54af330..59dab4dfd7 100644
--- a/docs/dev/debt/libSceNetCtlAp.md
+++ b/docs/dev/debt/libSceNetCtlAp.md
@@ -6,6 +6,8 @@
 
 ### Unknown function info
 
+- [sceNetCtlApRegisterCallback](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) (libSceNetCtlAp) - writing `InvalidCid` (`-1`) to `cid` when all eight slots are taken (`CALLBACK_MAX`) is unmeasured and interprets [SharpProspero's comment](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/NetCtlAp.cs#L117-L118) that it is the value written into an unclaimed callback id, which does not name this path. [`libSceNetCtl`](https://github.com/boykopovar/AnyPS5/blob/aeeaefad98613c63a49ea2daae4d4558304b14cd/core/libs/prx/libSceNetCtl/Export.cpp#L103-L115) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/network/netctl.cpp#L381-L390) leave `cid` unchanged on a full table
+
 - [sceNetCtlApInit, sceNetCtlApTerm](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) (libSceNetCtlAp) - every other call returns `NOT_INITIALIZED` (`0x80412994`) before `sceNetCtlApInit` and after `sceNetCtlApTerm`, which also drops the registered callbacks. A second `sceNetCtlApInit` throws, as no error for it is documented
 - [sceNetCtlApGetInfo, sceNetCtlApGetConnectInfo, sceNetCtlApStop](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) - stopped-state results come from a service on the console and remain unverified. Wrapper validation is recovered: initialization precedes arguments, the optional connection string is at most eight bytes, then output pointers and exact 152/184-byte sizes are checked. The service interpretation of the option string remains unresolved.
 - [sceNetCtlApGetResult](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) - with no event delivered, the host writes zero; the service result before the first event remains unknown. Wrapper validation checks initialization, output pointer and event type in that order. Event types 1 through 4 and lowest-free callback IDs 0 through 7 are confirmed.
diff --git a/docs/dev/debt/libSceNgs2.native.md b/docs/dev/debt/libSceNgs2.native.md
index a49957e009..453bb09f88 100644
--- a/docs/dev/debt/libSceNgs2.native.md
+++ b/docs/dev/debt/libSceNgs2.native.md
@@ -2,6 +2,8 @@
 
 ### Unknown function info
 
+- [NGS2 PCM sampler playback](../../../core/libs/prx/libSceNgs2.native/src/Pcm.cpp) is not console-verified. Types 0x11, 0x12, 0x14, 0x16, 0x18 and 0x1a follow [prosper's waveform parser analysis](https://github.com/mattias800/prosper/blob/30572df43ae20ff28f995db56149f7af42235741/prosper/src/hle/audio/ngs2_waveform.cpp#L194-L223) and the WAVE representations it selects: unsigned 8-bit, signed little-endian 16/24/32-bit and little-endian IEEE float/double. Integer samples use the existing signed-16 normalization generalized to their width; double samples narrow to host float. Console rounding, float clipping, nonfinite and subnormal handling are unknown: floating input outside -1..1, nonfinite values and nonzero magnitudes below the smallest normal float throw. Other types and nonzero configuration words on the new formats throw. Incomplete streamed blocks and dataless silence blocks remain supported only for signed-16 PCM; the new formats require complete blocks.
+
 - [NGS2 voice validation](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) returns `0x804A8203` for an invalid voice in Control, RunCommands, GetState, GetStateFlags, GetPortInfo and QueryInfo, following the type-4 handle error in [prosper's PS5 module analysis](https://github.com/mattias800/prosper/blob/d61eb2c0ad2de879ef74df9c4aa050c512804a18/prosper/src/hle/audio/hle_audio.cpp#L4478). Control checks a null parameter list first (`0x804A8360`); GetState resolves the voice before output validation, and GetState rejects sizes below 8 before a null output. Existing rack-specific exact state sizes, other argument precedence and command layouts are retained; arbitrary-sized state copies and full console behavior remain unverified. These values follow module analysis, not new console execution.
 
 - [NGS2 system and rack handle errors](../../../core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp) use `0x804A8201` and `0x804A8202`, following the native handle-type error helper recorded in [prosper's PS5 module analysis](https://github.com/mattias800/prosper/blob/d61eb2c0ad2de879ef74df9c4aa050c512804a18/prosper/src/hle/audio/hle_audio.cpp). [sceNgs2RackGetVoiceHandle](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) resolves the rack before checking the output pointer, matching the export in firmware 1.00 through 12.70 reported in [#5916](https://github.com/boykopovar/AnyPS5/pull/5916#issuecomment-6172832590). Other exports retain their existing validation order; complete invalid-input precedence and console execution remain unverified.
@@ -14,26 +16,29 @@
 - [NGS2 submixer UserFx](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (control `0x20000004`) invokes the title's callback after input mixing on every playing grain, including silence. The 40-byte control and 48-byte process context follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/945dbc3cc3eee80ac3e053b438502ed936fa6bb2/src/core/libraries/ngs2/ngs2_submixer.h). PPSA03747 installs a peak-meter callback; its code confirms the channel pointers, user data 0, channel count, grain size and sample-rate offsets and returns 0. Other user data words are preserved. Flags are assumed to be 1 after registration/restart and 0 thereafter, following UserFx2's first-process convention; this callback does not inspect them. Null handlers disable the effect, setup clears it, and nonzero callback results throw. These lifecycle and error semantics are unverified on console hardware.
 - [NGS2 voice callback after setup](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a sampler or mixer setup clears the voice callback with the rest of the voice state. PPSA18216 registers a block-end callback for a streamed music voice, later sets the same voice up again for one-shot ATRAC9 blocks with user data 0, and registers the callback again before it streams again; its callback dereferences the block's user data, so it must not run for the one-shot blocks. A setup made from inside the voice's own callback clears that callback as well, so a callback that sets its voice up again and queues the next block runs once instead of for every block; PPSA18216 never sets a voice up from inside its callback, so that ordering is unverified. Unverified on console hardware.
 - [NGS2 ATRAC9 streaming](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) keeps waveform duration and skip counts across compressed input blocks. The shared `APPEND` flag (2), called `ONLY_DATA` in the compressed-data reference, ignores an ATRAC9 continuation block's sample, skip and repeat counts, following [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/bb98f26433fa9e711c219aac1711fe8ecba5bf3a/src/libs/ngs2.cpp); PPSA03747 confirms a 262044-byte initial buffer declaring 11310532 samples, followed by 16384-byte buffers with flags 3. Incomplete superframes are retained until more input arrives. Input-block completion callbacks allow refills; the final callback of a logical waveform waits for its buffered PCM to drain, preserving the existing complete-block repeat behaviour. This buffering, callback timing, decoded-byte accounting and starvation silence are unverified on hardware. A closed ATRAC9 stream ending before its declared samples throws; fragmented ATRAC9 waveforms with repeats are unsupported. PCM streaming retains its existing append validation and early-close behaviour.
-- [NGS2 mastering voice gain](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - the param id 0x30000004 is taken from PPSA22520 and the layout from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `OrbisNgs2MasteringVoiceGainParam`; no reference gives the units or range. The levels are assumed to be linear factors applied when the mastering voice is mixed into the render buffer, so the voice's own samples stay unscaled; the LFE level applies to channel 3 of 6- and 8-channel voices, assuming the L R C LFE order of the AudioOut2 entries above, and the full-band level to the rest. Negative levels are accepted, and a new setup resets both levels to 1
+- [NGS2 mastering voice gain](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a NaN sample in a PCM_I16L render buffer throws, because PS5 firmware 3.20 and 4.03 were measured only into float buffers, where a NaN gain gives NaN samples. Measured there: param 0x30000004 (id seen in PPSA22520) sets linear full-band and LFE factors on the mastering output, applied from the next render, flat for the first gain a voice receives and ramped over the next grain in eight lanes after that, which this change does not implement; each is clamped to [-32, 32] with NaN kept, and every value returns 0. The LFE level acts on channel 3 of 6- and 8-channel voices and the full-band level on every other channel, 1- and 2-channel voices included; a mastering setup resets both to 1, and STOP_IMM plus PLAY keeps them
 - [NGS2 stereo mastering voice into a surround buffer](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - PPSA21402 renders a 2-channel mastering voice into a 6- or 8-channel render buffer, which the mixing stage rejected. The console's conversion is unknown: the left and right channels are assumed to go to the first two buffer channels (front left and right) and the remaining channels stay silent, with no centre, LFE or surround content. Any other channel count mismatch still throws
 - [NGS2 voices without a format](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a sampler voice whose setup has no format (all zero) accepts an add of no waveform blocks without `APPEND`, which only applies `RESET` and the `CONTINUE` state, and matrix levels with no levels, which clear that matrix. PPSA36591 sets such a voice up, adds no blocks and sets no levels when a button is pressed at its title screen. Whether the console returns success or an error there is not measured; blocks with data, `APPEND` and an empty matrix on a voice with a format are still refused
+- [NGS2 play without setup](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - differs from PS5 firmware 3.20 and 4.03 `libSceNgs2.native.sprx` in two cases: a set-up voice given an add of no waveform blocks and played keeps state flags 1 there for as long as it was watched and only until the next render here; an add of no blocks to a voice that already played and ended returns `0x804A8054` there and succeeds here. A `PLAY` on a voice with no channels (never set up; an all-zero setup leaves an earlier setup untouched) returns `0x804A8351` (`SCE_NGS2_ERROR_INVALID_VOICE_ACCESS`) from Control and RunCommands, leaves it idle and skips the rest of the list, as that module does for every rack; PPSA03061 (Void Terrarium) frees its sound slots that way
 - [NGS2 silent waveform blocks](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native): flag `0x10` (named `SILENCE` here; no public reference names it) lets a waveform block declare samples without data. PPSA04867 adds one block with flags `0x11`, `data_size` 0 and `num_samples` 16385, then another with flags `0x11` and a fully specified 0x800-byte, 1024-sample mono block, which takes the ordinary path. A dataless block under the flag outputs `num_samples` frames of silence, reports them through `decoded_data_size`, and finishes like a complete block; a dataless block without the flag still throws as not fitting its data. The flag's real name, its interaction with ATRAC9 and repeats, and the console's `waveform_data` for silent blocks are unverified on hardware
 - [NGS2 streaming PCM waveforms](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - PPSA21402 streams its music by adding one block whose `num_samples` is the whole track and whose `data_size` is a 16 KiB first piece, with `CONTINUE`, and then adds each following piece with flag `0x2` (called `APPEND` here) and the same `num_samples`. No reference describes flag `0x2`. A 16-bit PCM block without skipped samples or repeats whose `num_samples` exceed its data is assumed to start such a stream; flag `0x2` is assumed to append the block's data to the last streaming block, ignoring its `num_samples`; the voice is assumed to output silence without advancing while it has played all appended data and `CONTINUE` is set; and the waveform is assumed to end at `num_samples` or, once `CONTINUE` is cleared, at the end of the appended data. `sceNgs2VoiceGetState` reports the bytes played as `decoded_data_size`, which the title uses to release its queued data, and the read position as `waveform_data`. Appending to a block that is not a stream, or other formats, skipped samples, repeats and partial frames, throw
 - [NGS2 matrix levels](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - levels are clamped to -4..4 and NaN is kept, as the PS4 firmware 11.00 `libSceNgs2.sprx` stores them; not yet confirmed on the PS5 library. That library rejects a level count of 0 and keeps the matrix; the PS5 error code is unknown, so a count of 0 throws, except on a sampler voice without a format, where it clears the matrix (see NGS2 voices without a format). `sceNgs2VoiceRunCommands` is not in that library, so its matrix levels command is assumed to clamp the same way
 - [NGS2 sampler voice state flag EMPTY](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - a playing sampler voice that still accepts blocks (`CONTINUE`) and has played all queued blocks reports `INUSE|PLAYING|EMPTY` (0x20) and keeps playing, so blocks added later play on. PPSA18391 (engine: Clickteam Fusion) reads `state_flags & 0x22 != 2` from `sceNgs2VoiceGetState` as the end of a sound and only then reuses the voice. When the console sets and clears EMPTY, and whether it also reports it for other voice types, is unverified on hardware.
+- [NGS2 reverb channel conversion](../../../core/libs/prx/libSceNgs2.native/src/Reverb.cpp) (libSceNgs2.native) - a reverb voice whose `num_input_channels` differs from `num_output_channels` (PPSA03747 sets up 2 inputs and 8 outputs) mixes its ports in the input layout and folds that to mono with the input count's gains, as an equal-count voice does, and runs the comb and allpass stages per output channel. The PS4 library's handling of the dry signal in this case is not checked: here it reaches the output layout through the default channel map, so a stereo input keeps its dry signal on the front left and right and the other outputs carry only the reverb
 - [NGS2 port matrix](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - a port without a matrix, or with a selected matrix whose levels were never set, mixes through a default channel map: mono reaches both stereo channels at -3 dB and the 5.1 and 7.1 centre, stereo folds to mono at -3 dB per side, and wider sources fold down with 0.5 and -3 dB gains. The map and the equivalence of an unset matrix with no matrix were measured from the PS4 firmware 11.00 `libSceNgs2.sprx`, not yet from the PS5 library. That library only accepts submixer and mastering voices with 1, 2, 6 or 8 channels, so the map into 3, 4, 5 or 7 channels throws. A matrix set with fewer levels than the destination needs still mixes only the rows it has
 - [NGS2 custom submixer rack](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4002) - UserFx2 process flags and setup/process/cleanup order follow only [KytyPS5](https://github.com/KytyPS5/KytyPS5), not a console measurement; layouts follow [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_custom.h`. A module control handler, unequal input and output channels, setup flags and default rack options throw. Module state is a separate buffer, not the `state_offset` slice of voice state; `sceNgs2VoiceGetState` throws for this rack. UserFx2 runs only on grains with input samples, so an effect tail stops with the input
 - [NGS2 custom UserFx](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - the 48-byte process context, process flags, callback error handling and null-handler behavior retain the existing submixer callback model and are not console-verified. Non-null module options throw because their console error is unknown. UserFx on custom sampler rack 0x4001 throws: its parameter indexing and routing are not implemented. Module id 0x19, the 40-byte voice parameter (handler and three user-data words), parameter id `0x40001900 | index`, and lack of option and module state follow [fma-rc's PS5 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943), including parameter dispatch at 0x25ec4.
 - [NGS2 custom Delay](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, 0x1d) - processing and defaults remain unverified on PS5. The [agreed compatibility path](https://github.com/boykopovar/AnyPS5/pull/9337#issuecomment-6351205140) preserves main's PCM pass-through for Void Terrarium (PPSA03061) until any Delay parameter is set; every `0x40001dxx` parameter throws. Only one-buffer custom submixers with no module state and a 20-byte option are accepted. Option type 0/1, taps 1..8, length 1..20000 and reserved 0 follow [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943). Other shapes and values throw because their console errors are unknown. This preserves host behavior, not console-equivalent Delay processing
-- [NGS2 custom module ids](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - Reverb (0x1b), PitchShift (0x20) and Convolution (0x23) are not processed: a rack that passes their creation checks throws. Gain (0x15) on custom sampler racks also throws. Per [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6294323150), creation returns `0x804A8302` for a wrong non-zero state size, and `0x804A8013`, `0x804A8099` and `0x804A8098` for a bad Reverb option size or word and PitchShift word. Unknown: check order, errors for a Gain option, missing Reverb or PitchShift options, other PitchShift and Convolution option sizes, and Convolution's state (64 bytes from SDK 3.0). PPSA04540 uses 0x15, 0x19, 0x1b and 0x23 (#8039), PPSA35169 0x20 (#4246)
+- [NGS2 custom module ids](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - Reverb (0x1b), PitchShift (0x20) and Convolution (0x23) are not processed: a rack that passes their creation checks throws. Gain (0x15) on custom sampler racks also throws. Per [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6294323150), creation returns `0x804A8302` for a wrong non-zero state size, and `0x804A8013`, `0x804A8099` and `0x804A8098` for a bad Reverb option size or word and PitchShift word. Unknown: check order, errors for a Gain option, missing Reverb or PitchShift options, other PitchShift and Convolution option sizes, and Convolution's state (64 bytes from SDK 3.0). PPSA04540 uses 0x15, 0x19, 0x1b and 0x23 (#8039), PPSA35169 0x20 (#4246) and PPSA33655 0x15, 0x19 and 0x1b
 - [NGS2 custom Gain module](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4002) - follows [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943): parameter `0x40001500 | module index` holds 37 linear levels, one per channel, default 0, and the module writes source × level into dest, ramping linearly over the grain from the previous level. Unverified: where the ramp starts and ends (here the grain's first sample is one step past the previous level and its last sample is at the new level), whether stopping or setting up the voice again resets the levels, and what the library does with a level outside -32 to 32 (here it throws). On a custom sampler rack, whose parameter index is one higher per fma-rc, Gain throws. A Gain module with an option throws: fma-rc reads Gain as taking none, and the error the library returns for one is unknown. The extra buffer is ignored, as fma-rc reads it
+- [NGS2 custom mastering rack](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native, rack 0x4003) - follows [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943): option size is 0x508, matching the custom submixer rack layout. Creation returns `0x804A8052` above 37 channels; channels 9 to 37 throw because voices hold at most 8 channels. Mastering racks with modules throw: attached modules and non-default option fields are unverified on PS5. Voice control parameters 0x40030000 (setup), 0x40030004 (gain) and 0x40030005 (output) configure channels, levels and destination buffer. `sceNgs2VoiceGetState` fills common voice state flags. PPSA10278 and PPSA04540 create rack 0x4003 without modules (#8039)
 - [NGS2 custom rack buffers and channels](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, racks 0x4001 and 0x4002) - racks with 2 to 4 buffers, custom submixers with 9 to 37 channels and submixer `max_inputs` other than 1 or 2 throw: how modules and ports route several buffers is unknown, and voices hold at most 8 channels. Per [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6294323150), creation returns `0x804A830B` for a buffer count outside 1 to 4 or below the submixer's `max_inputs`, `0x804A8306` for a module source, extra or dest buffer id at or above the count, and `0x804A8052` for more than 37 submixer channels; the check order is not known. `sceNgs2RackQueryBufferSize` throws for these options, as no source says whether it checks them. A port buffer id other than 0 throws. PPSA04540 creates racks with up to 4 buffers and a 16-channel custom submixer (#8039)
 - [NGS2 reverb rack](../../../core/libs/prx/libSceNgs2.native/src/Reverb.cpp) (libSceNgs2.native, rack 0x2001) - follows the PS4 firmware 11.00 `libSceNgs2.sprx`, read and checked against its output at 11.025 to 48 kHz, including parameter changes during playback (differences at float rounding level); not yet compared with the PS5 library. Structure layouts come from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_reverb.h` and the param ids 0x20010000 (setup) and 0x20010001 (I3DL2) from PPSA22520. Only the default `reverb_size` of 1 is handled, with its 14400-sample reflection buffer; other sizes and the library's half-rate mode throw. System sample rates below about 7.5 kHz, where an allpass delay would have no samples, throw. Setup only accepts equal input and output channel counts
 - [sceNgs2ReportRegisterHandler, sceNgs2ReportUnregisterHandler](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native, NIDs `uBIN24Tv2MI`, `nPzb7Ly-VjE`) keep a registry of report handlers. Register rejects a null handler with an invalid argument and returns `INVALID_OUT_ADDRESS` for a null out handle, then stores the report type, handler and user data under a freshly allocated opaque handle; unregister removes and frees the matching record and throws for a handle that is not registered. The signatures (report type, handler, user data, out handle) and (report handle) follow [SharpProspero](https://github.com/SvenGDK/SharpProspero) and [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_report.h`, and the 24-byte `Ngs2ReportDataHeader` passed to a handler is its `OrbisNgs2ReportDataHeader`. No report is produced yet, so no registered handler is ever invoked and PPSA04540, which imports both and registers a CPU load handler (type 5), still receives none.
 - [sceNgs2SystemSetUserData, sceNgs2SystemGetUserData, sceNgs2SystemLock, sceNgs2SystemUnlock](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - shadPS4 only checks the system handle (`INVALID_SYSTEM_HANDLE`) and SharpProspero names what each call does; neither gives the other limits. A null user data pointer throws. `sceNgs2SystemLock` and `sceNgs2SystemUnlock` follow [prosper's notes](https://github.com/mattias800/prosper/blob/d61eb2c0ad2de879ef74df9c4aa050c512804a18/prosper/src/hle/audio/hle_audio.cpp#L4367-L4384) on the PS5 module: Lock takes a per-system lock and counts nested holds, Unlock releases one hold from any thread and returns 0 without a hold, and `sceNgs2SystemRender` only tries the lock: while another thread holds it, Render clears one grain of each output, leaves the render count and voices unchanged and returns 0. The other calls do not wait for the system lock. Peace Walker (PPSA18216) holds it while it spins on a flag that its audio thread clears only after `sceNgs2SystemRender` and eight `sceNgs2VoiceGetStateFlags` calls, so on the console neither can wait for it. Whether the console's voice and rack calls take the lock at all is not known. `sceNgs2RackLock` still holds the library's lock until `sceNgs2RackUnlock`, as before
 - [sceNgs2GetWaveformFrameInfo](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - not measured on a console; shadPS4 only stubs it, and prosper does not cover the call. The outputs are taken to be the frame fields of the parsed waveform info, which [prosper's reading of `libSceNgs2.native.sprx`](https://github.com/mattias800/prosper/blob/30572df43ae20ff28f995db56149f7af42235741/prosper/src/hle/audio/ngs2_waveform.cpp#L224-L231) fills for ATRAC9 with the superframe bytes and samples, the frames per superframe and a one-frame delay, whatever the `fact` chunk says. `PCM_I16L` answers channels * 2 bytes, 1 sample, 1 unit and no delay, as for parsed 16-bit PCM, itself assumed. Other types throw. Null outputs return `INVALID_OUT_ADDRESS` and an ATRAC9 format the codec does not accept `INVALID_WAVEFORM_FORMAT`; the codes are unverified
 - [sceNgs2RackSetUserData, sceNgs2RackGetUserData](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native) - the signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs#L418-L421) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2.cpp#L86-L111), which only logs them; neither gives an error. A handle that is not a live rack answers `INVALID_RACK_HANDLE` before a null user data pointer is checked, and the null pointer throws, as in `sceNgs2SystemGetUserData`. A new rack starts with 0. Not measured on a console
-- [sceNgs2RackGetInfo](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native) - field order from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `OrbisNgs2RackInfo` with the 64-byte name of the other info structures (216 bytes); `type` is assumed to be the rack id divided by 0x1000, `min_grain_samples` 64 (the system minimum) and `state_flags` 1; `uid` comes from a per-process rack counter, `render_count` is the owning system's render count and `active_voice_count` counts voices that are not empty (paused and stopped voices included). The last process ratio and tick and `active_channel_work_count` are left zero
+- [sceNgs2RackGetInfo](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native) - field order from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `OrbisNgs2RackInfo` with the 64-byte name of the other info structures (216 bytes); `type` is assumed to be the rack id divided by 0x1000, `min_grain_samples` 64 (the system minimum) and `state_flags` 1; `uid` comes from a per-process rack counter, `render_count` is the owning system's render count and `active_voice_count` counts voices that are not empty (paused and stopped voices included). The last process ratio and tick and `active_channel_work_count` are left zero. One title (PPSA13356, call at 0xB4F74) passes a zeroed 0xe8-byte buffer and the size 0xe8, and reads a 32-bit count at offset 0xa4 only when the result is 0. This implementation returns the out-size error for that size; neither the 216-byte layout nor a 232-byte structure is verified on the console.
 - [NGS2 system option checks](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - not verified on a console. `sceNgs2SystemQueryBufferSize`, `sceNgs2SystemCreate` and `sceNgs2SystemCreateWithAllocator` return `0x804A8013` (size), `0x804A8311` (max grain, a multiple of 64 up to 2048), `0x804A8310` (grain, a multiple of 64 up to the max), `0x804A8051` (one of ten sample rates) and `0x804A8052` (1 to 37 channels) in that order, following [prosper's PS5 module analysis](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/audio/hle_audio.cpp#L4151-L4226). The four job scheduler pointers are neither inspected nor used.
 - [sceNgs2SystemSetGrainSamples, sceNgs2SystemSetSampleRate](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - a grain that is not a multiple of 64 is accepted, where the module returns `0x804A8310`, because the NGS2 tests render 8-sample grains. Changing the rate while a sampler filter is enabled throws, as the filter coefficients were computed for the old rate. After the handle check, a grain of 0 or above the system's maximum returns `0x804A8310`, and a rate other than 11025, 12000, 22050, 24000, 44100, 48000, 88200, 96000, 176400 or 192000 returns `0x804A8051`, per [prosper's reading of the module's command validators](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/audio/hle_audio.cpp#L4355-L4399); not measured on a console
 - [sceNgs2VoiceQueryInfo](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - only info id 0x4001 is known: PPSA22520 passes an 8-byte buffer and branches on the first word being 1 or 2, so it is assumed to be the voice channel count (0 before the voice is set up); the second word is zeroed and other ids throw
@@ -42,9 +47,10 @@
 - [sceNgs2VoiceGetMatrixInfo](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a matrix id past the rack's `max_matrices` throws, as the PS5 code for shadPS4's PS4 [`INVALID_MATRIX_INDEX`](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2_error.h#L92) is unknown. A matrix without levels reports 0 levels, though it mixes through the default channel map. Signature from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs#L442), layout (a count and 64 levels) from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2.h#L263-L266); levels are the stored, clamped ones. Unmeasured: a null info answers `INVALID_OUT_ADDRESS` and a size other than 260 `INVALID_OUT_SIZE` before the voice is checked, as in `sceNgs2VoiceGetPortInfo`
 - [sceNgs2CustomRackGetModuleInfo](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native) - a size over 32 bytes throws, as the longer per-module info in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2_custom.h#L419-L442) is not kept. A size under 32 and an index past the rack's modules (any on a non-custom rack) also throw: the PS5 codes for shadPS4's PS4 [`INVALID_MODULE_INDEX` and `INVALID_MODULE_INFO_SIZE`](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2_error.h#L117-L118) are unknown. It repeats the ids, state offset and size from rack creation, reserved words 0, as [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs#L323-L341) lays it out. Unmeasured: a null info gives `INVALID_OUT_ADDRESS`, then a bad handle `INVALID_RACK_HANDLE`
 - [sceNgs2VoiceControl patch](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a destination rack handle with input id 0 resolves to that rack's first voice; this matches the Dead Cells call in #4334, but selection for racks with multiple voices has not been checked against a console. Nonzero destination input ids still throw. `sceNgs2VoiceGetPortInfo` reports the resolved voice handle and zero delay.
+- [NGS2 PCM waveform parsing](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - `sceNgs2ParseWaveformData` reads integer PCM (tag 1, or `WAVE_FORMAT_EXTENSIBLE` with the PCM GUID) of 8, 16, 24 and 32 bits as types 0x11, 0x12, 0x14 and 0x16, and float (tag 3) of 32 and 64 bits as 0x18 and 0x1a, and returns 0x804A8432 for other depths, after [prosper's reading of `libSceNgs2.native.sprx`](https://github.com/mattias800/prosper/blob/30572df43ae20ff28f995db56149f7af42235741/prosper/src/hle/audio/ngs2_waveform.cpp#L194-L223); not measured on a console. Every depth keeps the checks of the 16-bit path (channels, rate, block align, whole frames, a looped `smpl` chunk throws), which that reading does not apply. Voices still play only 16-bit PCM and ATRAC9
 - [sceNgs2ParseWaveformFile](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - the signature `(path, offset, info)` is taken from the call site of PPSA21402, which sets only three argument registers; the file is read from `offset` to its end, the data and block offsets are taken to be relative to the start of the file, not of `offset`, and an unreadable file throws. The audio unit fields of a 16-bit PCM waveform are assumed to be one sample frame per unit and per frame; `INVALID_WAVEFORM_DATA` for a `data` chunk that runs past the buffer or ends inside a frame is assumed, and looped PCM and other PCM formats throw
 - [sceNgs2VoiceControl sampler filter](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - param `0x1000000a`, its layout and meaning follow KytyPS5 only: location 1 type 1 is an RBJ low-pass biquad at the system sample rate after resampling, scaled by `level`, a set `channel_mask` bit bypasses that channel, type 0 turns the filter off. Other locations and types throw. The voice keeps playing a filter tail after its last block until the history is zero, with outputs below 1e-20 flushed to zero (a KytyPS5 choice); the console's tail length is unknown
-- [sceNgs2PanInit / sceNgs2PanGetVolumeMatrix](../../../core/libs/prx/libSceNgs2.native/src/Pan.cpp) (libSceNgs2.native) - follow the PS4 firmware 11.00 `libSceNgs2.sprx`, read and checked against its output for 2, 4, 5 and 7 speakers into 1, 2, 6 and 8 channels; not yet confirmed on the PS5 library. Speakers are taken in the order L R, L R Ls Rs, L R C Ls Rs or L R C Ls Rs Lb Rb and kept in a fixed circular order, not sorted; without angles the defaults are 90/270, 40/110/250/320, 0/40/110/250/320 and 0/40/110/150/210/250/320 degrees. As in that library, defaults converted to radians keep the wrap-around entry in degrees, so angles past the last speaker pan almost fully to it. A speaker count of 0 without angles, which the firmware accepts, a non-finite speaker angle and a speaker angle equal to the unit angle, on which that library loops forever, throw. Angles so large that adding or subtracting a turn leaves them unchanged throw for the same reason
+- [sceNgs2PanInit / sceNgs2PanGetVolumeMatrix](../../../core/libs/prx/libSceNgs2.native/src/Pan.cpp) (libSceNgs2.native) - inputs on which the PS5 `libSceNgs2.native.sprx` of firmware 3.20 and 4.03 did not return within 60 s throw; whether it returns at all for them is unknown. They are an infinite speaker or param angle, an angle too large for a turn to change it, a speaker angle that wraps to exactly the unit angle, and a param angle that wraps onto the first speaker plus one turn, such as one float below the first speaker in radians
 - [sceNgs2GeomResetListenerParam, sceNgs2GeomResetSourceParam](../../../core/libs/prx/libSceNgs2.native/src/Geom.cpp) (libSceNgs2.native) - the structures (12, 16, 16, 60, 96, 108, 32 and 308 bytes) come from [KytyPS5](https://github.com/KytyPS5/KytyPS5)'s `ngs2.cpp` and match [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_geom.h` field for field, but only KytyPS5 gives the behaviour - shadPS4 logs and returns success without writing the output. The defaults (orient front +Z, orient up +Y, sound speed 343, cone 1/360/1/360, rolloff 0/1000000/1/1, doppler factor, full-band, LFE and maximum level 1, two speakers and matrix format 2) are unverified on a PS5 title; KytyPS5 and iStark/PS5PCEM agree on them. PPSA15552 (Dead Cells) calls `sceNgs2GeomResetSourceParam` after creating its racks. A null output address returns `INVALID_OUT_ADDRESS` as elsewhere in the library rather than throwing as KytyPS5 does. `sceNgs2GeomApply` is now a minimal pass-through that follows [KytyPS5](https://github.com/KytyPS5/KytyPS5)'s `Ngs2GeomApply` (shadPS4 only stubs it): pitch 1, source position, volume the larger of the source minimum and maximum level, and a diagonal of the source maximum level (1 when it is not positive) over `matrix_format` channels (0 is two, at most 8). The listener and `flags` are ignored, so source attenuation, distance rolloff, panning and Doppler stay unimplemented; neither KytyPS5 nor this has been measured on a PS5, and a null output address returns `INVALID_OUT_ADDRESS` where KytyPS5 exits
 - [sceNgs2GeomCalcListener](../../../core/libs/prx/libSceNgs2.native/src/Geom.cpp) builds an orthonormal world-to-listener transform. The row-major matrix, front-axis priority and flag 1 for right-handed input follow [PS5PCEM](https://github.com/iStark/PS5PCEM/blob/d2534bac6325a2c61c0fa88977e5321074304484/src/hle/ngs2_geom.zig); they have not been measured on PS5 hardware. Velocity stays in world coordinates and positive finite sound speed is preserved. Orientation vectors are normalised and up is made perpendicular to front, so non-unit and slightly tilted vectors are accepted. When front and up are parallel, up is replaced by `(0,1,0)` or `(1,0,0)` so the basis stays defined: PPSA15552 (Dead Cells) passes `orient_front={0,0,1}` with `orient_up={0,0,1}` after moving the listener, which PS5PCEM rejects; the console error code is unknown. Zero orientation vectors, nonfinite input and an unrepresentable translation still throw without changing the output; console error codes are unknown, and a nonpositive sound speed throws where PS5PCEM and [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/ngs2.cpp) default it to 343. KytyPS5 always writes the identity matrix, so the transform rests on PS5PCEM plus that Dead Cells case. Dead Cells (PPSA15552) reaches this call after the custom sampler rack in #4334. This does not implement source attenuation, panning or Doppler in `sceNgs2GeomApply`.
 - [NGS2 custom sampler rack](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4001) - implements bounded support for the custom sampler rack and its built-in module 0x13 (Custom Voice Filter), unblocking PPSA15552 (Dead Cells) startup. Structure layouts come from [shadPS4's ngs2_custom.h](https://raw.githubusercontent.com/shadps4-emu/shadPS4/main/src/core/libraries/ngs2/ngs2_custom.h) (OrbisNgs2CustomVoiceFilterParam, 40 bytes) and live trace correlation from [prosper's hle_audio.cpp](https://raw.githubusercontent.com/mattias800/prosper/main/prosper/src/hle/audio/hle_audio.cpp) (0x40001300 command and parameters like 10000.0f and 0.707f). Routes parameter updates via the 0x40001300 command family into the Biquad filter engine. Filter type 0 clears the destination filter; type 1 configures the RBJ low-pass biquad frequency, Q and level. Other filter types and unmodeled configurations throw.
diff --git a/docs/dev/debt/libSceNotification.md b/docs/dev/debt/libSceNotification.md
new file mode 100644
index 0000000000..6245484e54
--- /dev/null
+++ b/docs/dev/debt/libSceNotification.md
@@ -0,0 +1,6 @@
+# libSceNotification technical debt
+
+### Unknown function info
+
+- [sceNotificationSend, sceNotificationSendById, sceNotificationShowPsButtonPersistentBanner, sceNotificationHidePsButtonPersistentBanner](../../../core/libs/prx/libSceNotification/Export.cpp) (libSceNotification) - notification sending and banner presentation interfaces throw through `NotImplemented_nid_no_patch`. Native notification service IPC and parameter structures remain unimplemented.
+- [sceNotificationSend](../../../core/libs/prx/libSceNotification/Export.cpp) (libSceNotification) - what the console shows, checks and returns is not measured. The parameters are the ones homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) declares, `int sceNotificationSend(int userId, bool isLogged, const char* payload)`: its `notify` sample passes the system user (`0xFE`), `true` and a JSON document whose `rawData` names a `viewTemplateType` such as `InteractiveToastTemplateB` and holds the `viewData` to show, and exits with the result. Closes when: measured on a PS5.
diff --git a/docs/dev/debt/libSceNpAuth.md b/docs/dev/debt/libSceNpAuth.md
index e918766151..83f702e202 100644
--- a/docs/dev/debt/libSceNpAuth.md
+++ b/docs/dev/debt/libSceNpAuth.md
@@ -2,7 +2,7 @@
 
 ### Unknown function info
 
-- [sceNpAuthAbortRequest, sceNpAuthGetAuthorizationCode, sceNpAuthGetAuthorizationCodeA, sceNpAuthGetAuthorizationCodeV3, sceNpAuthGetIdToken, sceNpAuthGetIdTokenA, sceNpAuthGetIdTokenV3, sceNpAuthPollAsync, sceNpAuthWaitAsync](../../../core/libs/prx/libSceNpAuth/Export.cpp) (libSceNpAuth) - request tracking, `ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND` (0x80550306) on unknown IDs, `ORBIS_NP_AUTH_ERROR_INVALID_ID` (0x80550307) on non-async or unprocessed requests in Poll/Wait, `ORBIS_NP_AUTH_ERROR_INVALID_ARGUMENT` (0x80550301) on null arguments, and `ORBIS_NP_AUTH_ERROR_ABORTED` (0x80550304) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp) (PS4); the A calls forward to their V3 counterparts, which in shadPS4 ([AuthorizationCode A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L189-L193), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L195-L199); [IdToken A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L375-L378), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L380-L383)) call the same helper and differ only in a version flag; async requests defer `SCE_NP_ERROR_SIGNED_OUT` to Poll/Wait while sync requests fail immediately; PSN is not contacted. Call sites in three disassembled titles (PPSA02225, PPSA15246, PPSA30601; static reading only) show the V3 parameter layouts: the code request parameter is 0x20 bytes (size, a 32-bit value that the titles take from their user object, a pointer to a client-ID-like string, a pointer to a constant string) and the call is `(reqId, param, code[128], int* issuerId)`; the ID token request parameter is 0x28 bytes (size, the same kind of 32-bit value, a pointer to a client-ID-like string, a pointer to a second buffer (256 bytes in one title) and a pointer to a constant string) and the call is `(reqId, param, token)`. The client-ID-like string is 36 characters plus a terminator in one title and a 128-byte buffer in two. In two titles the calls follow `sceNpAuthCreateAsyncRequest` (whose parameter holds only a size of 0x18) and are polled with `sceNpAuthPollAsync` (one title once per frame, one in a blocking loop of up to 40 polls 100 ms apart); the third title is a synchronous caller that takes the request ID from an argument-less call. All three call `sceNpAuthDeleteRequest` once the request has finished or failed (immediately after the call in the synchronous title, after a poll return of 0 in the per-frame title, on every path in the blocking one). The titles treat a poll return of 0 as finished and any negative result as a failure without looking at the specific code; one title, after 40 polls that still return non-zero, treats a return of exactly 1 as a timeout and calls `sceNpAuthAbortRequest`, and reports 0x80550301 and 0x80550306 from Poll as an invalid result pointer and an unknown request ID. The size fields are not checked here; the console's size checks and the behaviour of the calls on a console are unverified
+- [sceNpAuthAbortRequest, sceNpAuthGetAuthorizationCode, sceNpAuthGetAuthorizationCodeA, sceNpAuthGetAuthorizationCodeV3, sceNpAuthGetIdToken, sceNpAuthGetIdTokenA, sceNpAuthGetIdTokenV3, sceNpAuthPollAsync, sceNpAuthWaitAsync](../../../core/libs/prx/libSceNpAuth/Export.cpp) (libSceNpAuth) - request tracking, `ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND` (0x80550306) on unknown IDs, `ORBIS_NP_AUTH_ERROR_INVALID_ID` (0x80550307) on non-async or unprocessed requests in Poll/Wait, `ORBIS_NP_AUTH_ERROR_INVALID_ARGUMENT` (0x80550301) on null arguments, and `ORBIS_NP_AUTH_ERROR_ABORTED` (0x80550304) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp) (PS4); the A calls forward to their V3 counterparts, which in shadPS4 ([AuthorizationCode A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L189-L193), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L195-L199); [IdToken A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L375-L378), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L380-L383)) call the same helper and differ only in a version flag; async requests defer `SCE_NP_ERROR_SIGNED_OUT` to Poll/Wait while sync requests fail immediately; PSN is not contacted. Call sites in three disassembled titles (PPSA02225, PPSA15246, PPSA30601; static reading only) show the V3 parameter layouts: the code request parameter is 0x20 bytes (size, a 32-bit value that the titles take from their user object, a pointer to a client-ID-like string, a pointer to a constant string) and the call is `(reqId, param, code[128], int* issuerId)`; the ID token request parameter is 0x28 bytes (size, the same kind of 32-bit value, a pointer to a client-ID-like string, a pointer to a second buffer (256 bytes in two titles: a 256-byte copy in one, a 256-byte zeroed area holding a 16-character string in the other) and a pointer to a constant string) and the call is `(reqId, param, token)`. The client-ID-like string is 36 characters plus a terminator in one title and a 128-byte buffer in two. In two titles the calls follow `sceNpAuthCreateAsyncRequest` (whose parameter holds only a size of 0x18) and are polled with `sceNpAuthPollAsync` (PPSA15246 at 0x4feefd with one non-blocking poll per run of a title function, PPSA30601 at 0x16edb90 in a blocking loop that polls once and then up to 40 more times, each after a 100 ms sleep); the third title is a synchronous caller that takes the request ID from an argument-less call. All three call `sceNpAuthDeleteRequest` once the request has finished or failed (immediately after the call in the synchronous title, after a poll return of 0 in the non-blocking one, on every path in the blocking one). The titles treat a poll return of 0 as finished and any negative result as a failure without looking at the specific code; one title, when the 41st poll still returns non-zero, treats a return of exactly 1 as a timeout and calls `sceNpAuthAbortRequest`, and reports 0x80550301 and 0x80550306 from Poll as an invalid result pointer and an unknown request ID. The size fields are not checked here; the console's size checks and the behaviour of the calls on a console are unverified
 
 - [sceNpAuthPollAsync and sceNpAuthWaitAsync](../../../core/libs/prx/libSceNpAuth/Export.cpp) (libSceNpAuth) - PS5 abort-before-start behavior is unmeasured. Poll/Wait keep returning `ORBIS_NP_AUTH_ERROR_INVALID_ID` without changing output after a pre-start abort, including subsequent rejected getter calls, following [shadPS4 StartRequest and FindAsyncRequest](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp).
 
diff --git a/docs/dev/debt/libSceNpCommon.md b/docs/dev/debt/libSceNpCommon.md
index e6e51903bb..be7ac29c21 100644
--- a/docs/dev/debt/libSceNpCommon.md
+++ b/docs/dev/debt/libSceNpCommon.md
@@ -2,113 +2,27 @@
 
 ### Unknown function info
 
-The 129 declarations below use names mapped from the local `libSceNpCommon.sprx` export table. Each NID was verified against that table and recomputed from its name with `tools/nid_names.py`. The public [PS5 3.20 libSceNpCommon export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/main/libSceNpCommon.c) contains all 150 symbol names. No prototype or behavior is claimed. Each declaration uses the no-parameter unknown-signature convention solely for import resolution and throws if called.
+The 34 declarations below use names mapped from the local `libSceNpCommon.sprx` export table. Each NID was verified against that table and recomputed from its name with `tools/nid_names.py`. The public [PS5 3.20 libSceNpCommon export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/main/libSceNpCommon.c) contains all 150 symbol names. No prototype or behavior is claimed. Each declaration uses the no-parameter unknown-signature convention solely for import resolution and throws if called.
 
-- [sceNpAllocateKernelMemoryNoAlignment](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `MWPOkqzYss0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAllocateKernelMemoryWithAlignment](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `gMlY6eewr-c`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpArchInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `jGF+MaB4b-M`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpArchTerm](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `UskWpVWxSvg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAtomicCas32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `+9+kKMY9YIw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAtomicDec32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Yohe0MMDfj0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAtomicInc32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pfJgSA4jO3M`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64Decoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `l67qBmMmKP4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64Encoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pu39pU8UgCo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64GetDecodeSize](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `a5IfPlpchXI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64UrlDecoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `moGcgMNTHvQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64UrlEncoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `IeNj+OcWgU8`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64UrlGetDecodeSize](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `7BjZKcN+oZ4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutInitCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `9+m5nRdJ-wQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutStartOnCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fClnlkZmA6k`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutStartOnCtx64](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `lpr66Gby8dQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutStopOnCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `in19gH7G040`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutTermCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `AqJ4xkWsV+I`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCancelEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kb2thTuS8t8`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpClearEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `9pLoHoPMxeg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCloseEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `+nmn+Z0nWDo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpCloseSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `8hPzfjZzV88`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondSignalAll](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `bsjWg59A7aE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondSignalTo](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `bAHIOyNnx5Y`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondWait](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fZShld2PQ7w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCreateEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `6jFWpAfqAcc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCreateSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `LHZtCT2W1Pw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCreateThread](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fhJ5uKzcn0w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDbgAssignDebugId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `90pmGqDK4BI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDbgDumpBinary](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Etq15-l9yko`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDbgDumpText](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ZaKa5x61hGA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDeleteEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `sjnIeFCuTD0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDeleteSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xPrF2nGPBXQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpFreeKernelMemory](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `vjwlDmsGtME`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpGetNavSdkVersion](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `QmDEFikd3VA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetProcessId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Z3mnqcGmf8E`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetRandom](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pJlGhXEt5CU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetSdkVersionUInt](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ljqnF0hmLjo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocator](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `-gN6uE+zWng`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocatorEx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `VUHUasztbUY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocatorExPtr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `P4YpPziLBd4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocatorPtr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `DI5n4aOdxmk`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `wVdn78HKc30`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapGetAllocator](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `lvek8w7yqyE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapGetStat](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `2jdHoPpS+W0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `B+yGIX1+BTI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapShowStat](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `evz0-93ucJc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHexToInt](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Hvpr+otU4bo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpInt32ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `5y0wMPQkaeU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpInt64ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `HoPC33siDD4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpIntGetPlatformType](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `G6qytFoBJ-w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIntIsOnlineIdString](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fY4XQoA20i8`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpIntSetPlatformType](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `X6emt+LbSEI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIntToHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `TWPY1x1Atys`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIpc2ClientInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kgDwlmy78k0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIpc2ClientTerm](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `CI2p6Viee9w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParse](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `vJGDnNh4I0g`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseBuf](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `RgfCYkjW7As`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseBufInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `SnAdybtBK3o`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseEx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `p5ZkSMRR7AU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseExInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `nhgjiwPUIzI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `teVnFAL6GNY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `zNb6IxegrCE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `++eqYdzB8Go`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondSignal](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Xkn6VoN-wuQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondSignalAll](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `FJ4DCt8VzVE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondSignalTo](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Bwi+EP8VQ+g`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondWait](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ExeLuE3EQCQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `dfXSH2Tsjkw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapGetAllocator](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `FaMNvjMA6to`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapGetAllocatorEx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xHAiSVEEjSI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kZizwrFvWZY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpOpenEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `5DkyduAF2rs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpOpenSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `-blITIdtUd0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpPanic](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ZoXUrTiwKNw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpPollEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `9YmBJ8KF9eI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpPollSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xmF0yIF4iXc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpRtcConvertToPosixTime](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `VMjIo2Z-aW0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpRtcFormatRFC3339](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `W0YWLVDndx0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpRtcParseRFC3339](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `LtkeQwMIEWY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonGetErrorCode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `0lZHbA-HRD0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonMultiGetErrorCode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `cRabutqUG7c`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonParse](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `WSQxnAVLKgw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonParseInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `UbStlMKTBeU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonParseMultiInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `hbe+DdooIi4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpSetEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `29ftOGIrUCo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpSetPlatformType](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `m9JzZSoDVFY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpSignalSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `-W28+9p1CKI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrBuildHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `i5TP5NLmkoQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrParseHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `DUHzVPNlugg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToInt32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fElyBSn-l24`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToInt64](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `CwqYdG4TrjA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToUInt32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `uj86YxCYid0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToUInt64](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Ted2YU9lv94`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrcpyToBuf](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ivnnssCwjGI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrnParseHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `h1SWCcBdImo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrncpyToBuf](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `PHrpHMSU8Cs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpThreadGetId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `yvaNTRiKXmo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUInt32ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `rRN89jBArEM`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUInt64ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `QjNUYQbGoHA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUserGetUserIdList](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Gh74vNl06sg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilBuildTitleId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `N3tAHlBnowE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilCanonicalizeNpIdForPs4](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `4mEAk-UKVNw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilCanonicalizeNpIdForPsp2](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `N3FB4r8JoRE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilCmpAccountId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xPRHNaD3kTc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetDateSetAuto](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `owm52JoZ8uc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetDbgCommerce](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `1Gfhi+tZ9IE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetEnv](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kBON3bAtfGs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
@@ -116,26 +30,29 @@ The 129 declarations below use names mapped from the local `libSceNpCommon.sprx`
 - [sceNpUtilGetFakeRateLimit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `O86rgZ2azfg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetIgnoreNpTitleId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `FrxliFYAO8Y`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetNpDebug](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `GRvK1ZE+FEQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `OFiFmfsADas`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCode2](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `X9CqyP164Hc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCode2Str](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Fxux7Ob+Ynk`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCodeStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `RfiA17kV+xs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetNpTestPatch](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `OA8f3KF9JsM`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNthChar](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `KCk4OGu8+sc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetShareTitleCheck](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fB5hE65pzbU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetSystemLanguage](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `SXUNKr9Zkv0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetTrcNotify](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `AjzLvR0g5Zs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetWebApi2FakeRateLimit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pmHBFJyju9E`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetWebApi2FakeRateLimitTarget](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ZRxKp9vjcNc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetWebTraceSetting](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `4CqfNm3pisU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilHttpUrlEncode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ajoqGz0D9Dw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilJidToNpId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `458yjI+OECI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilJsonEscape](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `EftEB4kmkSg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilJsonGetOneChar](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `vj04qzp7uKY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilJsonUnescape](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `4YJ5gYtRAAE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 
 ### Functional
 
 - [Online ID and NpId utilities](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - `sceNpCmpOnlineId`, `sceNpCmpNpIdInOrder`, `sceNpGetPlatformType` and `sceNpIntIsValidOnlineId` are not measured on a console; their signatures, checks and results follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_common.cpp), including the platform tags read from `opt[4..7]` and the 3 to 16 character online ID rule.
 - [Mutex, condition and thread wrappers](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - the `sceNpMutex*`, `sceNpLwMutex*`, `sceNpCond*` and `sceNpJoinThread` wrappers forward to the libkernel `scePthread*` calls as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_common.cpp) and are not measured on a console. Only `EBUSY` from try-lock and `ETIMEDOUT` from a timed wait are mapped to NP errors; every other kernel error is returned unchanged. The `flags` argument of `sceNpCondInit` is ignored.
 - [sceNpGetSdkVersion](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - writes the libkernel system software version as `major.minor` into an 8-byte buffer without checking it, as shadPS4 does; that version is the fixed `1.00`, not the SDK version a title was built with.
+- [The exports in Runtime.cpp](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) and [Strings.cpp](../../../core/libs/prx/libSceNpCommon/Strings.cpp) follow `libSceNpCommon.sprx` from firmware 13.60, read from disassembly and not measured on a console.
+- [sceNpCreateThread](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) always applies an explicit priority when one is given; the firmware picks between explicit and inherited scheduling from the title's compiled SDK version, which is not available here.
+- [sceNpCalloutStartOnCtx and sceNpCalloutStartOnCtx64](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) look for the callout in the queue before writing it and return `0x80558006` with the entry and the queue unchanged. Firmware 13.60, read from disassembly and not measured on a console, clears and fills the entry before it takes the lock and checks the queue, so restarting a queued callout returns the same error but drops every callout queued after it.
+- [sceNpArchInit and sceNpArchTerm](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) keep a reference count under a lock and create the global heap once. Firmware 13.60, read from disassembly and not measured on a console, uses no lock and never sets its count on the first call, so every call made while the count is zero creates the heap again, and a call to sceNpArchTerm at zero destroys the heap and leaves the count negative.
+- [sceNpGetRandom](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) draws from a 32-bit Mersenne Twister seeded once per process; the console uses SFMT-19937 with a seed set inside the module, so the sequences differ.
+- [sceNpHeapShowStat](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) and [sceNpDbgDumpBinary](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) print the same information as the console in a different layout.
+- [The string-to-integer exports](../../../core/libs/prx/libSceNpCommon/Strings.cpp) clear `errno` before parsing; the firmware reads whatever `errno` held before the call when the result saturates.
+- [The integer-to-string exports](../../../core/libs/prx/libSceNpCommon/Strings.cpp) return `0x80558008` when the hexadecimal prefix does not fit; the firmware writes the prefix without checking the size. [The base64 decoders](../../../core/libs/prx/libSceNpCommon/Strings.cpp) treat bytes above 0x7F as invalid; the firmware indexes its table with them as signed values. [sceNpUtilJsonGetOneChar](../../../core/libs/prx/libSceNpCommon/Strings.cpp) checks that a `\u` escape and a surrogate pair fit in the input; the firmware reads past it.
+- [sceNpUtilGetNpDebug, sceNpUtilGetNpTestPatch, sceNpUtilGetTrcNotify, sceNpUtilGetIgnoreNpTitleId, sceNpUtilGetFakeDisplayNameMode, sceNpUtilGetWebTraceSetting, sceNpUtilGetWebApi2FakeRateLimit, sceNpUtilGetWebApi2FakeRateLimitTarget, sceNpUtilGetFakeRateLimit, sceNpUtilGetDbgCommerce, sceNpUtilGetSystemLanguage, sceNpUtilGetEnv, sceNpUtilGetDateSetAuto and sceNpUtilGetShareTitleCheck](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) read system and debug registry keys through libSceRegMgr, whose `sceRegMgrNonSysGetInt` and string reads still throw; they throw until those exist.
+- [sceNpOpenSema and sceNpCloseSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) forward to the libkernel open and close calls for named semaphores, which still throw.
+- [sceNpSetPlatformType, sceNpIntGetPlatformType, sceNpIntSetPlatformType, sceNpUtilCanonicalizeNpIdForPs4, sceNpUtilCanonicalizeNpIdForPsp2, sceNpUtilJidToNpId and sceNpGetNavSdkVersion](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) depend on console platform tags, network domain names or a version string of the console; they throw.
+- [sceNpJsonParse, sceNpJsonParseInit, sceNpJsonParseBuf, sceNpJsonParseBufInit, sceNpJsonParseEx, sceNpJsonParseExInit and the sceNpServerErrorJson exports](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) are a streaming, schema-checked JSON parser whose event and error rules are not yet specified; they throw.
diff --git a/docs/dev/debt/libSceNpCppWebApi.md b/docs/dev/debt/libSceNpCppWebApi.md
index ee3994c483..4f28810e85 100644
--- a/docs/dev/debt/libSceNpCppWebApi.md
+++ b/docs/dev/debt/libSceNpCppWebApi.md
@@ -5,7 +5,7 @@
 - [sce::Np::CppWebApi::Common](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - the `finish` overrides of `TransactionBase<...>` (13 instantiations), `DownStreamTransaction<...>` (2 instantiations) and `Vector<IntrusivePtr<Leaderboards::V1::User>>::pushBack` return success without doing work; a failed request never produces a transaction to finish. `Transaction<...>::setOnFinishedCallback` and `TransactionBase<...>::setResponseInformationOption` (5 instantiations each, the `UserProfile::V1`, `ProfanityFilter::V2` and `CommunicationRestrictionStatus::V3` responses) return success without storing the callback or the option: `start` fails, so neither is ever used. The constructors and destructors of the same five `Transaction<...>` instantiations succeed without keeping state
 - [sce::Np::CppWebApi::Leaderboards::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - request-body and parameter bookkeeping succeeds without storing state: `GetRankingRequestBody::set{StartSerialRank,Group,Limit,Users,Offset}`, `RecordScoreRequestBody::set{Comment,SmallData,NeedsTmpRank,ComparedDateTime,PcId}`, `User::{setAccountId,setPcId}`, `BoardsApi::ParameterToGetBoardDefinition::{initialize,terminate}`, `RecordApi::ParameterToRecordLargeData::{initialize,terminate}`, `RecordApi::ParameterToRecordScore::{initialize,setxPsnAtomicOperation,terminate}`, `ViewApi::ParameterToGetLargeDataByObjectId::{initialize,terminate}`, `ViewApi::ParameterToGetRanking::{initialize,setgetRankingRequestBody,terminate}`
 - [sce::Np::CppWebApi::SessionManager::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - parameter bookkeeping succeeds without storing state: `PlayerSessionsApi::ParameterToCreatePlayerSessions::{ctor,dtor,initialize}`, `PlayerSessionsApi::ParameterToGetPlayerSessionInvitations::{ctor,dtor,initialize,setfields,setinvitationInvalidFilter}`, `PlayerSessionsApi::ParameterToJoinPlayerSessionAsPlayer::{ctor,dtor,initialize,terminate}`, `PlayerSessionsApi::ParameterToLeavePlayerSession::{ctor,dtor,initialize}`, `RequestPlayerSession::set{MaxSpectators,InvitableUserType,JoinableUserType,ExclusiveLeaderPrivileges}`, `RequestPlayerSessionPlayer::setPushContexts`
-- [sce::Np::CppWebApi::TitleCloudStorage::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - `DataApi::ParameterToDownloadData::{initialize,terminate}` succeed without storing state
+- [sce::Np::CppWebApi::TitleCloudStorage::V1 and InGameCatalog::V5](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - `DataApi::ParameterToDownloadData`, `DataApi::ParameterToGetMultiDataStatusesByUser` and `ContainerApi::ParameterToGetContainer` keep only whether they are initialized. `initialize`, `terminate` and the string setters return the codes of the module bundled with PPSA21564: 0x80553503 for a null `LibContext` or string, 0x80553502 for a `LibContext` that `Common::initialize` did not set or a parameter not yet initialized, 0x8055350f for a second `initialize` and 0x80553510 for `terminate` without one. They store none of the values, and `ParameterToGetContainer::set{sort,offset,limit,serviceLabel}` store nothing either: only a request would read them
 - [sce::Np::CppWebApi::UserProfile::V1, ProfanityFilter::V2, CommunicationRestrictionStatus::V3](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - parameter bookkeeping succeeds without storing state: `FriendsApi::ParameterToGetFriends`, `PresenceApi::ParameterToGetBasicPresences`, `BlocksApi::ParameterToGetBlockingUsers`, `ProfanityApi::ParameterToFilterProfanity` and `CommunicationRestrictionStatusApi::ParameterToGetCommunicationRestrictionStatus`, each `{ctor,dtor,initialize,terminate}`
 
 ### Unknown function info
diff --git a/docs/dev/debt/libSceNpGameIntent.md b/docs/dev/debt/libSceNpGameIntent.md
index 622b40a2c2..cc0daa50c5 100644
--- a/docs/dev/debt/libSceNpGameIntent.md
+++ b/docs/dev/debt/libSceNpGameIntent.md
@@ -2,11 +2,12 @@
 
 ### Silent stubs
 
-- [sceNpGameIntentVshInitialize, sceNpGameIntentVshTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - VSH initialization and termination return 0 without performing shell operations, matching `sceNpGameIntentInitialize` and `sceNpGameIntentTerminate`
-- [sceNpAppLauncherInitialize, sceNpAppLauncherTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - app-launcher lifecycle returns success without tracking launch state; `sceNpAppLauncherInitialize` accepts its init parameter without validation, following the silent-stub precedent of `sceNpGameIntentInitialize` — a title calls it early in boot, and returning success lets it continue
+- [sceNpGameIntentVshInitialize, sceNpGameIntentVshTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - VSH initialization and termination return 0 without performing shell operations
+- [sceNpAppLauncherInitialize, sceNpAppLauncherTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - app-launcher lifecycle returns success without tracking launch state; `sceNpAppLauncherInitialize` accepts its init parameter without validation — a title calls it early in boot, and returning success lets it continue
 
 ### Unknown function info
 
+- [sceNpGameIntentReceiveIntent, sceNpGameIntentGetPropertyValueString](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - firmware 13.42 traces report `0x80553802` before `sceNpGameIntentInitialize` (precedence over argument validity), and `0x80553804` for invalid arguments (null pointer, empty key, or zero buffer size); `sceNpGameIntentTerminate` resetting initialized state is modeled lifecycle behavior rather than hardware-verified. `sceNpGameIntentReceiveIntent` reportedly requires `info->size == 0x4140` on firmware 13.42, while AnyPS5 `NpGameIntentInfo` is `0x560` bytes (matching fpPS4) and set by `sceNpGameIntentInfoInit`, so initialized objects are rejected by the receiver's measured size guard. Complete retail layout, output field offsets, and retail behavior of `sceNpGameIntentInfoInit` are unverified; expanding the type with unverified reserved bytes is not an evidence-backed solution.
 - [sceNpAppLauncherLaunchApp, sceNpGameIntentGetUdsNpComId, sceNpGameIntentLaunchApp, sceNpGameIntentLaunchApp2, sceNpGameIntentNotifyAppLaunched, sceNpSessionServiceGetJoinedPartySession, sceNpSessionServiceGetRunningGamePlayerSession and sceNpSessionServiceSendPlayerSessionInvitations](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpGameIntent.c). Call sites in a title's executable give a partial prototype: `sceNpAppLauncherLaunchApp` takes `(user_id, uri struct, context)` and returns int — throws because no launcher-service semantics are derivable. The rest are declared without parameters solely to resolve known imports and make no ABI claim.
 - [sceNpGameIntentInitParamInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L17) `SceNpGameIntentInitParam`; setting `size`, zeroing reserved bytes, and throwing on null pointer follow Sony SDK `*ParamInit` conventions but are unverified on retail hardware
-- [sceNpGameIntentInfoInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L28) `SceNpGameIntentInfo`; setting `size`, `user_id = -1`, zeroing fields, and throwing on null pointer match `sceNpGameIntentReceiveIntent` defaults but are unverified on retail hardware
+- [sceNpGameIntentInfoInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L28) `SceNpGameIntentInfo`; setting `size = 0x560`, `user_id = -1`, zeroing fields, and throwing on null pointer follow fpPS4 defaults, but reported firmware 13.42 behavior requires `0x4140` for `sceNpGameIntentReceiveIntent`, so the helper's `0x560` size does not match retail receiver defaults; the complete retail structure layout and retail behavior of `sceNpGameIntentInfoInit` remain unverified
diff --git a/docs/dev/debt/libSceNpManager.md b/docs/dev/debt/libSceNpManager.md
index a484f93b3a..88f66d3920 100644
--- a/docs/dev/debt/libSceNpManager.md
+++ b/docs/dev/debt/libSceNpManager.md
@@ -24,8 +24,14 @@
 - [sceNpGetAccountId, sceNpSetGamePresenceOnline](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - PS4 forms; the `(online id, account id output)` and `(request id, online id, presence)` signatures follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp#L1092-L1096). A null online id or output, or request id 0 for `sceNpSetGamePresenceOnline`, returns `SCE_NP_ERROR_INVALID_ARGUMENT`. `sceNpSetGamePresenceOnline` then returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` for a request that was never created or was deleted, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c1b26558352b863f80142256e4df38585aa7d727/src/core/libraries/np/np_manager.cpp#L1098-L1104) does. Otherwise both return `SCE_NP_ERROR_SIGNED_OUT` without writing, as `sceNpGetAccountIdA` does. The console's result for a signed-out user is not measured
 - [NP reachability callbacks](../../../core/libs/prx/libSceNpManager/Export.cpp) retain one callback and its user data; duplicate registration and unregistering an absent callback return the errors used by [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/945dbc3cc3eee80ac3e053b438502ed936fa6bb2/src/core/libraries/np/np_manager.cpp). No callback is delivered because the existing NP model remains signed out with reachability unavailable.
 - [sceNpCheckNpAvailability](../../../core/libs/prx/libSceNpManager/Export.cpp): native NP initialization and online-ID lookup are not modeled. The offline host returns user-not-found for valid arguments after clearing the optional one-byte availability output; request ID 0 and a null online-ID pointer return invalid-argument before writing the output.
-- [NP state callbacks](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the registration rules are [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L857-L901)'s: `sceNpRegisterStateCallbackA` keeps up to 8 callbacks and returns the slot plus 1, a null callback returns `INVALID_ARGUMENT`, a callback already registered `CALLBACK_ALREADY_REGISTERED` and a ninth one `CALLBACK_MAX` (0x8055001D, [np_error.h](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_error.h#L38)); `sceNpUnregisterStateCallbackA` returns `INVALID_ARGUMENT` for an id outside 1..8 and `CALLBACK_NOT_REGISTERED` for an empty slot; the legacy [sceNpRegisterStateCallback](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L981-L1005) keeps one callback with the same errors. Each registration gets `SIGNED_OUT` for the initial user (0x10000000) once, from the next `sceNpCheckCallback` on the calling thread. For the A form this follows [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/network.cpp#L3959-L3974), whose [sceNpRegisterStateCallbackA](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/network.cpp#L4021-L4034) marks the registration pending. KytyPS5 never calls the legacy callback ([sceNpRegisterStateCallback](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/network.cpp#L4009-L4019) stores nothing); it is called as `(user, SIGNED_OUT, nullptr, userdata)`, as in shadPS4, which passes an NpId only for `SIGNED_IN` ([L823](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L823), [L938-L940](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L938-L940)). shadPS4 instead queues `SIGNED_OUT` from the user service login event and delivers it from `sceNpCheckCallback` ([DispatchPendingNpStateCallbacks](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L903-L962)); the reachability callback is not given an initial `UNAVAILABLE`, unlike that function ([L922-L961](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L922-L961)). A callback being delivered when another thread unregisters it is still called once. When and how often the console calls the state callbacks, and the errors, are not measured
+- [NP state callbacks](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the registration rules are [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L857-L901)'s: `sceNpRegisterStateCallbackA` keeps up to 8 callbacks and returns the slot plus 1, a null callback returns `INVALID_ARGUMENT`, a callback already registered `CALLBACK_ALREADY_REGISTERED` and a ninth one `CALLBACK_MAX` (0x8055001D, [np_error.h](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_error.h#L38)); the unregister errors are in the next entry; the legacy [sceNpRegisterStateCallback](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L981-L1005) keeps one callback with the same errors. Each registration gets `SIGNED_OUT` for the initial user (0x10000000) once, from the next `sceNpCheckCallback` on the calling thread. For the A form this follows [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/network.cpp#L3959-L3974), whose [sceNpRegisterStateCallbackA](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/network.cpp#L4021-L4034) marks the registration pending. KytyPS5 never calls the legacy callback ([sceNpRegisterStateCallback](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/network.cpp#L4009-L4019) stores nothing); it is called as `(user, SIGNED_OUT, nullptr, userdata)`, as in shadPS4, which passes an NpId only for `SIGNED_IN` ([L823](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L823), [L938-L940](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L938-L940)). shadPS4 instead queues `SIGNED_OUT` from the user service login event and delivers it from `sceNpCheckCallback` ([DispatchPendingNpStateCallbacks](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L903-L962)); the reachability callback is not given an initial `UNAVAILABLE`, unlike that function ([L922-L961](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/np/np_manager.cpp#L922-L961)). A callback being delivered when another thread unregisters it is still called once. When and how often the console calls the state callbacks, and the errors, are not measured
+- [sceNpRegisterStateCallbackA and sceNpUnregisterStateCallbackA](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - never return the module's `0x80550002` for a failed [readiness check](https://github.com/mattias800/prosper/blob/6c09a34a092a00898fcead5f855200ca7c368cd2/prosper/src/hle/np/state_callbacks.cpp#L152-L153), whose input is not known, and are not measured on a PS5. An unregister id outside 1..8, compared unsigned so 0 and negative ids are included, returns `INVALID_ID` (0x80550015) and an empty slot `CALLBACK_NOT_REGISTERED`, as [prosper](https://github.com/mattias800/prosper/blob/6c09a34a092a00898fcead5f855200ca7c368cd2/prosper/src/hle/np/state_callbacks.cpp#L176-L188) reads `libSceNpManager.sprx` at RVA 0x15b10, without recording its firmware version; the same reading gives the registration rules above ([L162-L175](https://github.com/mattias800/prosper/blob/6c09a34a092a00898fcead5f855200ca7c368cd2/prosper/src/hle/np/state_callbacks.cpp#L162-L175))
 - [sceNpRegisterGamePresenceCallback](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - accepts any callback, null included, and returns nothing; no game presence event is delivered because the NP model remains signed out. [Kyty](https://github.com/InoriRus/Kyty/blob/4733b7e1c91b10554a52007903d74dc76c39a230/source/emulator/src/Network.cpp#L1549-L1552) ignores the callback the same way, and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/8d50471b7dc141dd700b51276b8edd1f293bce26/src/core/libraries/np/np_manager.cpp#L1121-L1126) keeps the last one without calling it. Not measured on a PS5
 - [sceNpIsPlusMember and sceNpSetContentRestriction](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the signatures and checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_manager.cpp): a null output or restriction is `INVALID_ARGUMENT`, a restriction size other than 0x18 is `INVALID_SIZE` (0x80550011), and a negative default age, more than 256 age restrictions or a count without an array is `INVALID_ARGUMENT`. Any user is reported as not a Plus member, and a valid restriction is accepted and not stored. Not measured on a PS5
 
 - [sceNpCheckCallbackForLib](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - not measured on a PS5: it delivers the pending state callbacks like `sceNpCheckCallback`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_manager.cpp) does with its pending state events; shadPS4's `sceNpCheckCallback` also runs other registered NP callbacks, which this library does not keep
+
+- [sceNpAbortRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` and a live request returns 0, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpAbortRequest`; shadPS4 there also moves the request into an `Aborted` state that its later requests read as `ABORTED`, and whether aborting on the console changes a live request's completion is not measured on a PS5 ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)), so nothing in this library reads an abort state and the id stays live
+- [sceNpDeleteRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND`, and a live request is removed and returns 0, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpDeleteRequest` ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277))
+- [sceNpPollAsync](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a null result pointer returns `SCE_NP_ERROR_INVALID_ARGUMENT` before the id is read, a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` without writing the caller's result, and a live request keeps its signed-out completion `0` with `SCE_NP_ERROR_SIGNED_OUT`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpPollAsync` ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)). The parts of that model beyond the validation are not implemented: shadPS4 keeps a per-request state machine decorated by `sceNpCheckNpAvailability` and neighbors and refuses `InvalidId` for a ready async request in wait/poll, whose completion publication, poll-versus-wait precedence and already-complete errors remain unattributable to the PS5
+- [sceNpCreateAsyncRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the parameter is not read ([NpCreateAsyncRequestParameter](../../../core/libs/SceTypes.hpp) is a 0x40-byte opaque blob, so shadPS4's nonnull check and `size == sizeof` reject ([81be949167d0060b08f26dc3e055a0b640d129c8](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp)) cannot be applied without inventing a layout) and no async kind or completion state is stored until the console's contract for them is evidenced ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)); `sceNpWaitAsync` (`jyi5p9XWUSs`) has no export here yet and stays with [PR #9282](https://github.com/boykopovar/AnyPS5/pull/9282)
diff --git a/docs/dev/debt/libSceNpMatching2.md b/docs/dev/debt/libSceNpMatching2.md
new file mode 100644
index 0000000000..edbc279625
--- /dev/null
+++ b/docs/dev/debt/libSceNpMatching2.md
@@ -0,0 +1,6 @@
+# libSceNpMatching2 technical debt
+
+### Functional
+
+- [sceNpMatching2Initialize, sceNpMatching2Terminate](../../../core/libs/prx/libSceNpMatching2/Export.cpp) (libSceNpMatching2) - only the library state is kept: initialization checks the parameter's `size` field (0x28, or 0x30 with an SSL pool) as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_matching2/np_matching2.cpp) does and starts no thread; a second initialization returns `ALREADY_INITIALIZED` and a termination without one `NOT_INITIALIZED`. The pool, thread and SSL settings are not used: no matching server is reached. Not measured on a console
+- [sceNpMatching2CreateContext and the context calls](../../../core/libs/prx/libSceNpMatching2/Export.cpp) (libSceNpMatching2) - offline only, not measured on a PS5: the checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_matching2/np_matching2.cpp#L26-L349) and its [context manager](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_matching2/np_matching2_internal.cpp#L1348-L1457) (a `0x28`-byte parameter, ten ids handed out round-robin). `sceNpMatching2ContextStart` returns `0x804101E2` (`SCE_NET_ERROR_RESOLVER_ETIMEDOUT`), which shadPS4 says was confirmed on a console disconnected from the internet, so no context starts and `sceNpMatching2ContextStop` answers `CONTEXT_NOT_STARTED`. Callbacks and the default request option are checked but never used. The room, user, world, server-id and signaling-info calls still throw
diff --git a/docs/dev/debt/libSceNpParty.md b/docs/dev/debt/libSceNpParty.md
index e88c71d92d..8d6176415e 100644
--- a/docs/dev/debt/libSceNpParty.md
+++ b/docs/dev/debt/libSceNpParty.md
@@ -5,4 +5,5 @@
 - [sceNpPartyGetState and sceNpPartyGetStateAsUserA](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the 16-bit state, its `NOT_IN_PARTY` value 2 and the `INVALID_ARGUMENT` (`0x80552504`) error follow shadPS4's [np_party.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_party.h) and [np_error.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_error.h) (PS4); shadPS4 does not check for a null state, and whether the console needs an initialized party library first is not known. Not measured on a PS5
 - [sceNpPartyGetId, sceNpPartyGetMembersA, sceNpPartyGetMemberInfoA, sceNpPartyGetMemberSessionInfo, sceNpPartyGetMemberVoiceInfo and sceNpPartySendBinaryMessage](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the user is never in a party, so these return `NOT_IN_PARTY` (`0x80552506`, shadPS4's np_error.h) and write nothing, or `INVALID_ARGUMENT` for a null pointer; the signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json). Like `sceNpPartyGetState` they do not require `sceNpPartyInitialize`, and the order of the null and party checks on the console is not known. Not measured on a PS5
 - [sceNpPartyInitialize, sceNpPartyTerminate, sceNpPartyCheckCallback and sceNpPartyRegisterHandlerA](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - an initialized flag with `ALREADY_INITIALIZED` (`0x80552502`) and `NOT_INITIALIZED` (`0x80552503`) from shadPS4's np_error.h; the handlers are accepted but never called, since no party event can happen. Whether the console refuses a null initialize parameter, and which check comes first, is not known
-- [sceNpPartyCreate, sceNpPartyCreateA, sceNpPartyGetMemberInfo, sceNpPartyGetMembers, sceNpPartyGetStateAsUser, sceNpPartyGetVoiceChatPriority, sceNpPartyJoin, sceNpPartyLeave, sceNpPartyRegisterHandler, sceNpPartyRegisterPrivateHandler, sceNpPartySetVoiceChatPriority, sceNpPartyShowInvitationList, sceNpPartyShowInvitationListA and sceNpPartyUnregisterPrivateHandler](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - Orbital has no prototypes for these and no credible ones were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceNpPartyCreate, sceNpPartyCreateA, sceNpPartyGetStateAsUser, sceNpPartyGetVoiceChatPriority, sceNpPartyJoin, sceNpPartyLeave, sceNpPartyRegisterPrivateHandler, sceNpPartySetVoiceChatPriority, sceNpPartyShowInvitationList, sceNpPartyShowInvitationListA and sceNpPartyUnregisterPrivateHandler](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - Orbital has no prototypes for these and no credible ones were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceNpPartyGetMembers, sceNpPartyGetMemberInfo and sceNpPartyRegisterHandler](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the signatures are from [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/src/np/ps4_libscenpparty.pas) (PS4) and match their `A` variants, so they behave like them: no party, `NOT_IN_PARTY` from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_party.cpp), and handlers accepted but never called. How the console's non-`A` member structures differ from the `A` ones is not known, and nothing is written to them. Not measured on a PS5
diff --git a/docs/dev/debt/libSceNpScoreRanking.md b/docs/dev/debt/libSceNpScoreRanking.md
new file mode 100644
index 0000000000..d373e91695
--- /dev/null
+++ b/docs/dev/debt/libSceNpScoreRanking.md
@@ -0,0 +1,5 @@
+# libSceNpScoreRanking technical debt
+
+### Functional
+
+- [libSceNpScoreRanking](../../../core/libs/prx/libSceNpScoreRanking/Export.cpp) (libSceNpScoreRanking) - offline only, not measured on a PS5: the argument checks, their order, the limit of 32 title contexts and 32 requests and the array sizes follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_score/np_score.cpp#L64-L1210), and a valid call then returns `SCE_NP_ERROR_SIGNED_OUT` and finishes its request with it, as shadPS4 does when the user [has no connection](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_handler/np_handler_score.cpp#L18-L26). No output is written, where shadPS4 first clears the rank, comment and info arrays. A null `boardInfo` throws: shadPS4 answers it by the title's SDK version
diff --git a/docs/dev/debt/libSceNpSignaling.md b/docs/dev/debt/libSceNpSignaling.md
index 40dc465615..1adbc6177b 100644
--- a/docs/dev/debt/libSceNpSignaling.md
+++ b/docs/dev/debt/libSceNpSignaling.md
@@ -3,3 +3,5 @@
 ### Functional
 
 - [libSceNpSignaling](../../../core/libs/prx/libSceNpSignaling/Export.cpp) (libSceNpSignaling) - offline only, not measured on a PS5: the checks, their order, context ids 1 to 8 and the NpId rule (`term` 0, 3 to 16 characters, the first an ASCII letter or digit, the rest ASCII letters, digits, `_` or `-`) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_signaling/np_signaling.cpp#L118-L170) and its [state helpers](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_signaling/np_signaling_state.cpp#L120-L170). `sceNpSignalingInitialize` reserves no heap and starts no thread, so its arguments are not checked, and callbacks are never called. `sceNpSignalingActivateConnection` returns `SCE_NP_ERROR_SIGNED_OUT` after shadPS4's checks up to `OWN_NP_ID`, without its rate limit, and creates no connection, so the connection calls answer `CONN_NOT_FOUND`
+
+- [sceNpSignalingDeactivateConnection](../../../core/libs/prx/libSceNpSignaling/Export.cpp) (libSceNpSignaling) - not measured on a PS5: it has the same checks as `sceNpSignalingTerminateConnection` (not initialized, unknown context, then `CONN_NOT_FOUND`), after shadPS4's [call](https://github.com/shadps4-emu/shadPS4/blob/12a4564543ccec527f9723676d2180580d1d7a94/src/core/libraries/np/np_signaling/np_signaling.cpp#L378-L400). No connection is ever created, so none can be deactivated.
diff --git a/docs/dev/debt/libSceNpSns.md b/docs/dev/debt/libSceNpSns.md
index 9f14bbcc3a..29b552135c 100644
--- a/docs/dev/debt/libSceNpSns.md
+++ b/docs/dev/debt/libSceNpSns.md
@@ -2,7 +2,7 @@
 
 ### Unknown function info
 
-- [sceNpSnsFacebookAbortRequest, sceNpSnsFacebookCreateRequest, sceNpSnsFacebookDeleteRequest, sceNpSnsFacebookGetAccessToken, sceNpSnsIntAbortRequest, sceNpSnsIntCreateRequest, sceNpSnsIntDeleteRequest, sceNpSnsIntFbGetGameAccessToken, sceNpSnsIntFbGetGameAccessTokenAllowed, sceNpSnsIntFbGetSystemAccessToken, sceNpSnsIntFbGetTitleInfo, sceNpSnsIntLinkedStatus, sceNpSnsIntTwGetSystemAccessToken, sceNpSnsIntUnlink, sceNpSnsIntYtGetAccessToken, sceNpSnsIntYtRefreshMasterToken, sceNpSnsTwitchAbortRequest, sceNpSnsTwitchCreateRequest, sceNpSnsTwitchDeleteRequest, sceNpSnsTwitchGetAccessToken, sceNpSnsYouTubeAbortRequest, sceNpSnsYouTubeCreateRequest, sceNpSnsYouTubeDeleteRequest and sceNpSnsYouTubeGetAccessToken](../../../core/libs/prx/libSceNpSns/Export.cpp) (libSceNpSns) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpSns.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceNpSnsFacebookAbortRequest, sceNpSnsIntAbortRequest, sceNpSnsIntCreateRequest, sceNpSnsIntDeleteRequest, sceNpSnsIntFbGetGameAccessToken, sceNpSnsIntFbGetGameAccessTokenAllowed, sceNpSnsIntFbGetSystemAccessToken, sceNpSnsIntFbGetTitleInfo, sceNpSnsIntLinkedStatus, sceNpSnsIntTwGetSystemAccessToken, sceNpSnsIntUnlink, sceNpSnsIntYtGetAccessToken, sceNpSnsIntYtRefreshMasterToken, sceNpSnsTwitchAbortRequest, sceNpSnsTwitchCreateRequest, sceNpSnsTwitchDeleteRequest, sceNpSnsTwitchGetAccessToken, sceNpSnsYouTubeAbortRequest, sceNpSnsYouTubeCreateRequest, sceNpSnsYouTubeDeleteRequest and sceNpSnsYouTubeGetAccessToken](../../../core/libs/prx/libSceNpSns/Export.cpp) (libSceNpSns) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpSns.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
 
 ### Inventory exports declared elsewhere
- sceNpSnsFacebookCreateRequest, sceNpSnsFacebookDeleteRequest and sceNpSnsFacebookGetAccessToken are also 3.20 exports of this module but are currently declared by #6977 in libSceNpSnsFacebookDialog, so they are omitted here to respect the duplicate-export rule; re-add if that PR's module attribution is rejected.
+ sceNpSnsFacebookCreateRequest, sceNpSnsFacebookDeleteRequest and sceNpSnsFacebookGetAccessToken are also 3.20 exports of this module but are declared in `libSceNpManager` ([`Export.cpp`](../../../core/libs/prx/libSceNpManager/Export.cpp)), so they are omitted here to respect the duplicate-export rule; re-add them here if that module attribution is corrected.
diff --git a/docs/dev/debt/libSceNpTrophy.md b/docs/dev/debt/libSceNpTrophy.md
index c445f4e8d8..b1b1fe76c5 100644
--- a/docs/dev/debt/libSceNpTrophy.md
+++ b/docs/dev/debt/libSceNpTrophy.md
@@ -2,4 +2,11 @@
 
 ### Unknown function info
 
-- [sceNpTrophyRegisterContext, sceNpTrophyGetTrophyUnlockState, sceNpTrophyUnlockTrophy](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy, PS4) - the trophy definitions in `TROPCONF.ESFM` are encrypted, so the trophy count is the number of consecutive `TROPnnn.PNG` icons in the title's `/app0/sce_sys/trophy/trophyNN.trp`, and the calls that return names and details (`sceNpTrophyGetGameInfo`, `sceNpTrophyGetGroupInfo`, `sceNpTrophyGetTrophyInfo`) throw. Unlocks are kept per user and service label in `_trophy/trophyNN.<user id>` under the working directory, no platinum trophy is reported (`platinumId` is -1), and a locked trophy's icon fails with `TROPHY_NOT_UNLOCKED`. None of it is checked on a console.
+- [sceNpTrophyRegisterContext, sceNpTrophyGetTrophyUnlockState, sceNpTrophyUnlockTrophy](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy, PS4) - the trophy definitions in `TROPCONF.ESFM` are encrypted, so the trophy count is the number of consecutive `TROPnnn.PNG` icons in the title's `/app0/sce_sys/trophy/trophyNN.trp`. Unlocks are kept per user and service label in `_trophy/trophyNN.<user id>` under the working directory, no platinum trophy is reported (`platinumId` is -1), and a locked trophy's icon fails with `TROPHY_NOT_UNLOCKED`. None of it is checked on a console.
+- [sceNpTrophyAbortHandle](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy, PS4) - measured on a PS4 Pro (firmware 10.71): after an abort, `sceNpTrophyGetTrophyUnlockState` and `sceNpTrophyGetGameIcon` through that handle answer 0x80551607, before the not-registered check, and `sceNpTrophyRegisterContext` answers 0x80551607 before the missing trophy package (0x80551626 for a live handle); aborting again answers 0. The other calls that take the handle are assumed to answer 0x80551607 the same way, as `libSceNpTrophy.sprx` of firmware 10.71 maps the service's abort answer to it on the shared request path. On the console `sceNpTrophyRegisterContext` checks the process's NP title id before it reaches the service, so a title without one gets the NP title id error instead; AnyPS5 has no NP title id and does not model that step
+
+### Functional
+
+- [sceNpTrophyGetGameInfo](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy) - the trophy configuration `TROPCONF.ESFM` is encrypted and not read, so the game details report the trophy count taken from the `TROPnnn.PNG` icons and the group count taken from the `GRnnn.PNG` icons of the trophy package; the per-grade counts are 0, the title and description are empty, and the progress percentage is unlocked trophies over all trophies instead of the console's grade-weighted points
+- [sceNpTrophyGetGroupInfo](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy) - only the base game group (id -1) is answered, with the same counts as the game; an id past the `GRnnn.PNG` icons returns `INVALID_GROUP_ID`, and an existing group throws because the trophies of a group are listed only in the encrypted configuration
+- [sceNpTrophyGetTrophyInfo](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy) - the grade is reported as unknown, the trophy is never hidden, the name and description are empty and the unlock timestamp is 0; a package with groups throws, since a trophy's group is listed only in the encrypted configuration
diff --git a/docs/dev/debt/libSceNpTrophy2.md b/docs/dev/debt/libSceNpTrophy2.md
index e6cb5cd197..8552c9e0de 100644
--- a/docs/dev/debt/libSceNpTrophy2.md
+++ b/docs/dev/debt/libSceNpTrophy2.md
@@ -2,20 +2,20 @@
 
 ### Silent stubs
 
+- [sceNpTrophy2GetRewardIcon](../../../core/libs/prx/libSceNpTrophy2/src/Context.cpp) (libSceNpTrophy2) - zeroes size and returns `SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND` (-2141898479): the `(int context, int handle, int reward_id, void* buffer, size_t* size)` signature and two-stage query pattern follow the bundled `Media/Plugins/PSNCore.prx` of PPSA06888 and SharpProspero; returning -2141898479 (0x80553911) when icons are unavailable is inferred from sibling calls (sceNpTrophy2GetGameIcon, sceNpTrophy2GetGroupIcon, sceNpTrophy2GetTrophyIcon) in KytyPS5 (libTrophy.cpp:464/483/502)
 - [libSceNpTrophy2](../../../core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp): `sceNpTrophy2RegisterUnlockCallback` accepts a callback that is never called, as the callback's signature and when the console calls it are not known, `sceNpTrophy2UnregisterUnlockCallback` only returns success, and `sceNpTrophy2ShowTrophyList` returns success without showing a list (there is no system trophy UI; seen on PPSA15552).
 
 ### Unknown function info
 
 - [Query structures](../../../core/libs/prx/libSceNpTrophy2/include/NpTrophy2Types.hpp): a progress value is a 16-byte `{int32 type, 4 reserved bytes, uint64 value}` and the game, group and trophy structures are 152, 24, 152, 32, 1312 and 32 bytes, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/libTrophy.cpp) asserts; no other public source confirms the layout. Progress type 1 marks a progressive trophy's target and progress, as in KytyPS5. Trophies without a `groupId` belong to group -1, KytyPS5's base game group.
 
-- [sceNpTrophy2GetRewardIcon](../../../core/libs/prx/libSceNpTrophy2/src/Context.cpp) (libSceNpTrophy2) takes `(int context, int handle, int reward_id, void* buffer, size_t* size)`, from the call sites in the bundled `Media/Plugins/PSNCore.prx` of PPSA06888, the same shape as `sceNpTrophy2GetTrophyIcon`. The title calls it twice: first with a null buffer to read the size, then with a buffer of that size allocated with `malloc`. The meaning of the third argument is unverified, and the reward icon data is unknown, so every call throws
-
-
 - [libSceNpTrophy2 pending exports](../../../core/libs/prx/libSceNpTrophy2/Export.cpp) - 23 named callable exports were identified in the PS5 3.20 export table and cross-checked against firmware 13.60. Signatures and behavior remain unverified; declarations use the unknown-signature convention and throw through `NotImplemented_nid_no_patch`. Evidence: [3.20 export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpTrophy2.c).
+
 ### Functional
 
 - [Trophy queries](../../../core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp) - not confirmed on the console: `sceNpTrophy2GetTrophyInfo` of a trophy id that is not in the title's [trophy data](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp) (`sce_sys/trophy2/trophyNN.ucp`) returns `0x8055390A` (KytyPS5's `NP_TROPHY2_ERROR_INVALID_TROPHY_ID`) and writes nothing; a context not created or destroyed reports placeholders and no unlocks and returns success; hidden trophies report their names and descriptions before the unlock; `progress_percentage` weighs gold 6, silver 2 and bronze 1 and leaves the platinum out, as KytyPS5 does (the ratio of the published PSN trophy points). A group that is not in the data throws. Without the file, or when it is malformed, the queries report the old placeholders and `sceNpTrophy2GetTrophyInfoArray` lists only trophy 0. Icons are not read. Unlocks come from the [trophy store](../../../core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp).
 - [Trophy data limits](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp): a `trophyNN.ucp` or `udsNN.ucp` larger than 256 MiB or listing more than 4096 files, and a JSON file in it that nests deeper than 64 levels or holds more than 1048576 values, are not used, and the title runs as without that file. The limits keep the memory the reader takes to the file and about 140 MiB of parsed JSON; the console's limits are not known.
 - [Text language](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp): texts come from `tropmeta_<tag>.json` for the console language, then `en-US`, then the file's `defaultLanguage`. The tags for languages 0 to 29 are KytyPS5's; `uk-UA` for 30 (Ukrainian) is an assumption.
+- [Trophy progress statistics](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp): `max` (the largest value posted, starting from `initialValue`, or `minValue` without one), `int32` (0 to 2147483647) and a rule condition of an `eventName` and one `property` whose `comparator` is `==` and `value` an unsigned integer follow the rules a title ships for its progressive trophies, not a console measurement. Borderlands 4 (PPSA01494) feeds each one's `udsStatId` from `$._trophy_progress` of `_UpdateTrophyProgress`, through an `int32` `max` statistic and a rule on `$._trophy_id`. `latest` and the unsigned types follow KytyPS5.
 - [Platinum](../../../core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp): an unlock through any path unlocks the platinum that the trophy names in `platinumTrophyId` once every trophy naming that platinum is unlocked, as KytyPS5 does; trophies without `platinumTrophyId` are not required. With the title's trophy data loaded, a posted `_UnlockTrophy` of a trophy that is not in the data, of a platinum or of a progressive trophy is not stored and prints a `[trophy] ignored` line, as KytyPS5 refuses them, so a progressive trophy unlocks only through its statistic; without trophy data any id of 0 or more is stored, including ids the data would make the platinum, a progressive trophy or no trophy, and the platinum is not unlocked when the trophies it needs are. The console's behaviour is not known.
 - [Damaged records](../../../core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp): a line in `_trophy/<user id>_<service label>.txt` or `.stats.txt` that is not a new `<id> <value>` pair (a blank line, a carriage return, a repeated or negative id, a value that is not a number) makes `readRecord` throw a `std::runtime_error` that names the file and the line. Every call that reads that record then throws it instead of returning, which stops the title as any throwing export does, so the title gets no return value; main returned 0 from these calls. The failed read is not kept, so each later call reads the file again and throws again until the file is fixed or deleted. The unlock record is read by `sceNpTrophy2GetTrophyInfo`, `sceNpTrophy2GetTrophyInfoArray` and `sceNpTrophy2GetGameInfo` for a created context, by `sceNpTrophy2GetGroupInfo` and `sceNpTrophy2GetGroupInfoArray` when the title's trophy data is loaded, by a `sceNpUniversalDataSystemPostEvent` of an `_UnlockTrophy` that the trophy data does not refuse, and by a statistic change when the trophy data is loaded; the stat record by a `sceNpUniversalDataSystemPostEvent` of an event that a statistics rule copies and by the trophy queries of a progressive trophy with a statistic. What the console does with a damaged record is not known.
diff --git a/docs/dev/debt/libSceNpTus.md b/docs/dev/debt/libSceNpTus.md
index cb413bbf34..142eda2d11 100644
--- a/docs/dev/debt/libSceNpTus.md
+++ b/docs/dev/debt/libSceNpTus.md
@@ -16,7 +16,6 @@
 - [sceNpTssGetDataAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetDataForCrossSaveVUser](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetDataForCrossSaveVUserAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
-- [sceNpTusGetMultiUserVariableForCrossSave](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetFriendsVariableA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetFriendsVariableAAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetFriendsVariableForCrossSave](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
@@ -32,3 +31,4 @@
 - [sceNpTusCreateNpTitleCtxA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - creates a title context without checking sign-in, up to 32 contexts (`TOO_MANY_OBJECTS` beyond); shadPS4 returns the `sceNpGetNpId` error instead. Requests are limited to 256, and the limits are not measured on a console.
 - [sceNpTssCreateNpTitleCtx and sceNpTssCreateNpTitleCtxA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - that TSS title contexts share the TUS context table and its 32-context limit is inferred from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/core/libraries/np/np_tus/np_tus.cpp#L146-L168), which redirects both to the TUS creators, and from TSS requests coming from `sceNpTusCreateRequest`; nothing is measured on a console. The `A` form is `sceNpTusCreateNpTitleCtxA`. The `NpId` form returns `INSUFFICIENT_ARGUMENT` for a null `npId` and `INVALID_ARGUMENT` for service label `0xFFFFFFFF` before the limit, as shadPS4's [sceNpTusCreateNpTitleCtx](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/core/libraries/np/np_tus/np_tus.cpp#L122-L143) does; the signatures are shadPS4's and fpPS4's, and Orbital's for the `A` form.
 - [sceNpTusPollAsync, sceNpTusWaitAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - there is no PSN, so every implemented `*Async` call whose arguments pass the checks starts a request that finishes at once with `SCE_NP_ERROR_SIGNED_OUT`, which poll and wait report and the blocking calls return; shadPS4 returns `SIGNED_OUT` from the `*Async` call itself when no shadNet client is signed in, and RPCS3 returns `INVALID_ONLINE_ID` while offline, marked there as probable behaviour. An abort stays set, so every later operation on the request, blocking ones included, finishes with `ABORTED`; in shadPS4 an abort only ends the operation in progress. Until an operation has started, poll returns 1 and wait returns `INVALID_ARGUMENT` as in shadPS4; RPCS3 [blocks until a result is set](https://github.com/RPCS3/rpcs3/blob/1a9dca3a3a84a18df866e3021918322bd295160a/rpcs3/Emu/NP/np_contexts.cpp#L40-L52).
+- [sceNpTusGetData, sceNpTusGetDataVUser, sceNpTusGetMultiSlotVariable, sceNpTusGetMultiSlotVariableVUser, sceNpTusGetMultiUserVariableForCrossSave, sceNpTusSetData, sceNpTusSetDataVUser, sceNpTusSetMultiSlotVariable and sceNpTusSetMultiSlotVariableVUser](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - block on their `*Async` forms with the same parameters, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/np/np_tus/np_tus.cpp) does, so they inherit those forms' unmeasured checks and the offline `SIGNED_OUT` result
diff --git a/docs/dev/debt/libSceNpUniversalDataSystem.md b/docs/dev/debt/libSceNpUniversalDataSystem.md
index 6c8a996278..cbc943be5e 100644
--- a/docs/dev/debt/libSceNpUniversalDataSystem.md
+++ b/docs/dev/debt/libSceNpUniversalDataSystem.md
@@ -4,7 +4,20 @@
 
 - [Events](../../../core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp): `sceNpUniversalDataSystemCreateEvent` copies `prop` and returns the event's own property object through `prop_ptr`, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/libTrophy.cpp) does; `sceNpUniversalDataSystemEventPropertyObjectSetObject`, `SetArray` and the array setters for objects and arrays store a copy of `value` and return the stored copy through `value_ptr`. Destroying a property object or array that its Create function did not return (an event's property object or a stored copy) does nothing, as its owner frees it. These ownership rules are not verified on a console, nor are the output of `sceNpUniversalDataSystemEventToString` (still `{}`) and `sceNpUniversalDataSystemEventEstimateSize` (still 3).
 
+- [sceNpUniversalDataSystemIntCreateRecordArray, sceNpUniversalDataSystemIntCreateRecordData and sceNpUniversalDataSystemIntCreateRecordObject](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntDeleteAllRecord](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - It is in the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntDestroyRecordArray and sceNpUniversalDataSystemIntDestroyRecordData](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntDestroyRecordObject and sceNpUniversalDataSystemIntGetMemoryStat](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntPostRecordData, sceNpUniversalDataSystemIntRecordArraySetArray and sceNpUniversalDataSystemIntRecordArraySetBinary](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordArraySetBool, sceNpUniversalDataSystemIntRecordArraySetFloat32 and sceNpUniversalDataSystemIntRecordArraySetFloat64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordArraySetInt32, sceNpUniversalDataSystemIntRecordArraySetInt64 and sceNpUniversalDataSystemIntRecordArraySetObject](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordArraySetString, sceNpUniversalDataSystemIntRecordArraySetUInt32 and sceNpUniversalDataSystemIntRecordArraySetUInt64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordDataEstimateSize, sceNpUniversalDataSystemIntRecordObjectSetArray and sceNpUniversalDataSystemIntRecordObjectSetBinary](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordObjectSetBool, sceNpUniversalDataSystemIntRecordObjectSetFloat32 and sceNpUniversalDataSystemIntRecordObjectSetFloat64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordObjectSetInt32, sceNpUniversalDataSystemIntRecordObjectSetInt64 and sceNpUniversalDataSystemIntRecordObjectSetObject](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordObjectSetString, sceNpUniversalDataSystemIntRecordObjectSetUInt32 and sceNpUniversalDataSystemIntRecordObjectSetUInt64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+
 ### Functional
 
-- [Trophy events](../../../core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp): `sceNpUniversalDataSystemPostEvent` stores an `_UnlockTrophy` event with an int32 `_trophy_id` of 0 or more as an unlock for the user and service label of its context, as KytyPS5 does, except an id that [libSceNpTrophy2](../../../core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp) refuses when the title's trophy data is loaded (one not in the data, a platinum or a progressive trophy). `_UpdateTrophyProgress`, named only by a third-party unlocker, is logged once per trophy and not interpreted. A context need not be registered, and every post of an event that `sceNpUniversalDataSystemCreateEvent` returned and that is not yet destroyed returns success (a null or any other event pointer stops the game): KytyPS5's errors for an unknown or unregistered context and for a malformed unlock are not verified. The storage statistics stay zero.
-- [Statistics](../../../core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp): every other event goes through the title's rules in `sce_sys/uds/udsNN.ucp`, which [libSceNpTrophy2](../../../core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp) reads. Only statistics with `"aggregation":"latest"` and `dataType` `uint32` or `uint64` are kept, as in KytyPS5; no public source documents the other aggregations or types, so their definitions and rules are skipped. Only rules whose condition is an `eventName` alone and whose input is a `$.name` path (dotted for nested objects) are applied. A value is used when it is an integer of any width that is not negative and fits the statistic's type and `minValue`/`maxValue`; KytyPS5 requires the statistic's exact width, and whether the console converts, clamps or rejects other values is not known. Statistics are stored per user and service label, and every trophy's `unlockCondition` is compared after each event that sets one.
+- [Trophy events](../../../core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp): `sceNpUniversalDataSystemPostEvent` stores an `_UnlockTrophy` event with an int32 `_trophy_id` of 0 or more as an unlock for the user and service label of its context, as KytyPS5 does, except an id that [libSceNpTrophy2](../../../core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp) refuses when the title's trophy data is loaded (one not in the data, a platinum or a progressive trophy). `_UpdateTrophyProgress` goes through the title's statistic rules like any other event (below). A context need not be registered, and every post of an event that `sceNpUniversalDataSystemCreateEvent` returned and that is not yet destroyed returns success (a null or any other event pointer stops the game): KytyPS5's errors for an unknown or unregistered context and for a malformed unlock are not verified. The storage statistics stay zero.
+- [Statistics](../../../core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp): every other event goes through the title's rules in `sce_sys/uds/udsNN.ucp`, which [libSceNpTrophy2](../../../core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp) reads. Only `"aggregation":"latest"` and `"max"` statistics of `dataType` `uint32`, `uint64` or `int32` are kept; no public source documents the other aggregations (such as `count`, `collection` and `eachLatest`) or types, so their definitions and rules are skipped. Only rules whose input is a `$.name` path (dotted for nested objects) are applied. A value is used when it is an integer of any width that is not negative and fits the statistic's type and `minValue`/`maxValue`; KytyPS5 requires the statistic's exact width, and whether the console converts, clamps or rejects other values is not known. Statistics are stored per user and service label, and every trophy's `unlockCondition` is compared after each event that sets one.
diff --git a/docs/dev/debt/libSceNpUtility.md b/docs/dev/debt/libSceNpUtility.md
index b1cd969543..95ec9ab84a 100644
--- a/docs/dev/debt/libSceNpUtility.md
+++ b/docs/dev/debt/libSceNpUtility.md
@@ -1,5 +1,23 @@
 # libSceNpUtility technical debt
 
+### Unknown function info
+
+- [sceNpAppInfoIntAbortRequest, sceNpAppInfoIntCheckAvailability, sceNpAppInfoIntCheckAvailabilityA, sceNpAppInfoIntCheckAvailabilityAll, sceNpAppInfoIntCheckAvailabilityAllA and sceNpAppInfoIntCheckServiceAvailability](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppInfoIntCheckServiceAvailabilityA, sceNpAppInfoIntCheckServiceAvailabilityAll, sceNpAppInfoIntCheckServiceAvailabilityAllA, sceNpAppInfoIntCreateRequest, sceNpAppInfoIntDestroyRequest and sceNpAppInfoIntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppInfoIntInitialize, sceNpAppLaunchLink2IntAbortRequest, sceNpAppLaunchLink2IntCreateRequest, sceNpAppLaunchLink2IntDestroyRequest, sceNpAppLaunchLink2IntFinalize and sceNpAppLaunchLink2IntGetCompatibleTitleIdList](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppLaunchLink2IntGetCompatibleTitleIdNum, sceNpAppLaunchLink2IntInitialize, sceNpAppLaunchLinkIntAbortRequest, sceNpAppLaunchLinkIntCreateRequest, sceNpAppLaunchLinkIntDestroyRequest and sceNpAppLaunchLinkIntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppLaunchLinkIntGetCompatibleTitleIdList, sceNpAppLaunchLinkIntGetCompatibleTitleIdNum, sceNpAppLaunchLinkIntInitialize and sceNpBandwidthTestShutdownWithDetailedInfo](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupCreateTitleCtxA, sceNpLookupNetAbortRequest and sceNpLookupNetCensorComment](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupNetConvertJidToNpId, sceNpLookupNetConvertNpIdToJid, sceNpLookupNetCreateRequest, sceNpLookupNetCreateTitleCtx, sceNpLookupNetDeleteRequest, sceNpLookupNetDeleteTitleCtx and sceNpLookupNetInit](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupNetInitWithFunctionPointer, sceNpLookupNetInitWithMemoryPool, sceNpLookupNetIsInit, sceNpLookupNetNpId, sceNpLookupNetSanitizeComment, sceNpLookupNetSetTimeout and sceNpLookupNetTerm](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceChecker2IntAbortRequest, sceNpServiceChecker2IntCreateRequest, sceNpServiceChecker2IntDestroyRequest and sceNpServiceChecker2IntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceChecker2IntGetServiceAvailability, sceNpServiceChecker2IntGetServiceAvailabilityA, sceNpServiceChecker2IntInitialize, sceNpServiceChecker2IntIsSetServiceType and sceNpServiceCheckerIntAbortRequest](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceCheckerIntCreateRequest, sceNpServiceCheckerIntDestroyRequest, sceNpServiceCheckerIntFinalize, sceNpServiceCheckerIntGetAvailability, sceNpServiceCheckerIntGetAvailabilityList and sceNpServiceCheckerIntInitialize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceCheckerIntIsCached, sceNpTitleMetadataIntAbortRequest, sceNpTitleMetadataIntCreateRequest, sceNpTitleMetadataIntDeleteRequest, sceNpTitleMetadataIntGetInfo, sceNpTitleMetadataIntGetNpTitleId and sceNpUtilityInit](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUtilityTerm and sceNpWordFilterCreateTitleCtxA](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+
 ### Functional
 
+- [sceNpBandwidthTestInitStart, sceNpBandwidthTestShutdownWithDetailedInfo](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - offline answers, not measured on a PS5: InitStart returns `SCE_NP_ERROR_SIGNED_OUT` as `sceNpBandwidthTestInitStartDownload` and `InitStartUpload` do, so no test is ever started, and ShutdownWithDetailedInfo returns `SCE_NP_ERROR_INVALID_ARGUMENT` and writes nothing, as `sceNpBandwidthTestShutdown` does. Neither reads an argument, so their parameterless declarations stand; their prototypes are still unknown
 - [NpLookup and NpWordFilter](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - offline only, not measured on a PS5: the argument checks and their order, the limit of 32 title contexts and 32 requests, the word filter id bases `0x01000001` and `0x02000001`, the 0x400-byte comment limit and single-use requests (`INVALID_TYPE`) follow shadPS4's [lookup](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L41-L222) and [word filter](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L705-L909) calls. `sceNpLookupNpId`, `sceNpWordFilterCensorComment` and `sceNpWordFilterSanitizeComment` then finish with `SCE_NP_ERROR_SIGNED_OUT` and write no NpId or comment; shadPS4's word filter accepts every comment as a stand-in for the server, so its result is not used
+- [NpLookup and NpWordFilter waits and timeouts](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - IDs here carry no service: on the console, measured on firmware 13.42's module in an emulator (#10640), each ID holds its service in its high bits (Lookup requests `0x2xxxxxxx` and title contexts `0x4xxxxxxx`, word filter `0x02xxxxxx` and `0x04xxxxxx`), and `SetTimeout`, `AbortRequest`, `PollAsync` and `WaitAsync` find the object by those bits whichever service's call is made; here each call finds only its own service's IDs, which keep the ranges above. The timeouts are checked as measured and then have no effect, since no request reaches a server; the console stores them. A wait on a request deleted meanwhile returns `INVALID_ID`, unmeasured. The measured checks are followed: a null result first (`0x80550704`), a synchronous request (`0x80550307` for Lookup, `INVALID_ID` for the word filter), the timeout bounds and the 0x18-byte async parameter
diff --git a/docs/dev/debt/libSceNpWebApi.md b/docs/dev/debt/libSceNpWebApi.md
index 95fb314c74..af76876d59 100644
--- a/docs/dev/debt/libSceNpWebApi.md
+++ b/docs/dev/debt/libSceNpWebApi.md
@@ -3,4 +3,6 @@
 ### Unknown function info
 
 - [sceNpWebApiInitialize, sceNpWebApiTerminate, sceNpWebApiCreateHandle, sceNpWebApiDeleteHandle, sceNpWebApiCreatePushEventFilter, sceNpWebApiDeletePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - signatures, id ranges (library contexts 1 to 0x7fff, handles and filters below 0xf0000000) and errors (`LIB_CONTEXT_NOT_FOUND`, `HANDLE_NOT_FOUND`, `PUSH_EVENT_FILTER_NOT_FOUND`, `INVALID_ARGUMENT` for a missing filter parameter) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp); they are not checked on a console. The libHttp context and pool size are kept but not used, since no request is ever sent. Limbo (CUSA01664) creates a context, a handle and filters when its game starts.
-- [sceNpWebApiCreateServicePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - a filter for a PSN service needs the signed-in user, and no user is signed in to PSN, so a valid call returns `SIGNED_IN_USER_NOT_FOUND` after the context and handle checks, as shadPS4 does with its network disabled. shadPS4 also rejects an invalid service label for titles built with SDK 2.00 or later; AnyPS5 has no compiled-SDK version for libraries yet, so such a call returns `SIGNED_IN_USER_NOT_FOUND` instead of `INVALID_ARGUMENT`. `sceNpWebApiDeleteServicePushEventFilter` therefore never finds a filter.
+- [sceNpWebApiCreateServicePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - a filter for a PSN service needs the signed-in user, and no user is signed in to PSN, so a valid call returns `SIGNED_IN_USER_NOT_FOUND` after the context and handle checks, as shadPS4 does with its network disabled. `sceNpWebApiDeleteServicePushEventFilter` therefore never finds a filter.
+- [sceNpWebApiCreateContext, sceNpWebApiDeleteContext, sceNpWebApiCreateRequest, sceNpWebApiDeleteRequest, sceNpWebApiAbortRequest, sceNpWebApiSendRequest](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - the online id is not looked up: as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp), a user context belongs to the initial user, so a library context holds at most one. With no user signed in to PSN, `sceNpWebApiSendRequest` returns `NOT_SIGNED_IN` unless the request is aborted. Id layouts and the delete, abort and not-found results match an offline PS4 Pro probe on firmware 10.71 (#9797); other checks follow shadPS4. That homebrew probe, with a non-retail SDK version, accepted method 99, so `INVALID_ARGUMENT` for a method after DELETE from SDK 2.50 is unverified. `sceNpWebApiTerminate` also deletes user contexts and requests; shadPS4 stops after the first user context.
+- [sceNpWebApiRegisterPushEventCallback, sceNpWebApiUnregisterPushEventCallback, sceNpWebApiRegisterServicePushEventCallback, sceNpWebApiUnregisterServicePushEventCallback](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - registered callbacks are never called, since no push event arrives. A null function is rejected from SDK 1.00 and the filter must exist in the library context from SDK 2.50, as in shadPS4; this is not checked on a console. No service filter can be created, so from SDK 2.50 a service callback returns `SERVICE_PUSH_EVENT_FILTER_NOT_FOUND`. Callback ids come from the counter of handles and filters.
diff --git a/docs/dev/debt/libSceOpusCeltDec.md b/docs/dev/debt/libSceOpusCeltDec.md
index 4ba1fc6999..731f5bbad3 100644
--- a/docs/dev/debt/libSceOpusCeltDec.md
+++ b/docs/dev/debt/libSceOpusCeltDec.md
@@ -2,7 +2,7 @@
 
 ### Unknown function info
 
-- [sceOpusCeltDecCreate, sceOpusCeltDecCtl, sceOpusCeltDecDecodeFloat, sceOpusCeltDecDecodeFloatWithPriority, sceOpusCeltDecDecodeWithPriority](../../../core/libs/prx/libSceOpusCeltDec/Export.cpp) (libSceOpusCeltDec) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceOpusCeltDec.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
+- [sceOpusCeltDecCreate, sceOpusCeltDecCtl](../../../core/libs/prx/libSceOpusCeltDec/Export.cpp) (libSceOpusCeltDec) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceOpusCeltDec.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
 - [sceOpusCeltDecTerminate](../../../core/libs/prx/libSceOpusCeltDec/Export.cpp): the non-null path forwards the AJM finalization result, but the null path returns without setting the return register. Its source return type cannot be established from this callee alone. The existing integer return is retained.
 
 ### Functional
diff --git a/docs/dev/debt/libSceOpusDec.md b/docs/dev/debt/libSceOpusDec.md
index d98513d94b..18d5334b3d 100644
--- a/docs/dev/debt/libSceOpusDec.md
+++ b/docs/dev/debt/libSceOpusDec.md
@@ -2,7 +2,8 @@
 
 ### Unknown function info
 
-- [sceOpusDecCancel, sceOpusDecCreate, sceOpusDecCtl, sceOpusDecDecodeFloat, sceOpusDecDecodeFloatWithPriority, sceOpusDecDecodeFloatWithPriorityAndTimeout, sceOpusDecDecodeWithPriority and sceOpusDecDecodeWithPriorityAndTimeout](../../../core/libs/prx/libSceOpusDec/Export.cpp) (libSceOpusDec) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceOpusDec.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
+- [sceOpusDecCancel, sceOpusDecCreate and sceOpusDecCtl](../../../core/libs/prx/libSceOpusDec/Export.cpp) (libSceOpusDec) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceOpusDec.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
+- [sceOpusDecDecodeWithPriorityAndTimeout and sceOpusDecDecodeFloatWithPriorityAndTimeout](../../../core/libs/prx/libSceOpusDec/Export.cpp) (libSceOpusDec) decode synchronously only for the infinite timeout 0xFFFFFFFF, the value sceOpusDecDecode passes, so the batch ID output is never written. libSceOpusDec.sprx (firmware 13.60, read from disassembly, not measured on a console) passes the timeout to its AJM batch wait; when the wait does not finish it stores the batch ID and returns 0x81740015. Whether a finite timeout finishes depends on the console's decode time, so any other timeout returns the argument errors and then throws. The priority (20 to 100) is validated but does not schedule anything
 
 ### Functional
 
diff --git a/docs/dev/debt/libScePad.md b/docs/dev/debt/libScePad.md
index dc6579857e..5c75033c4d 100644
--- a/docs/dev/debt/libScePad.md
+++ b/docs/dev/debt/libScePad.md
@@ -11,8 +11,12 @@
 - [libScePad report and tracking exports](../../../core/libs/prx/libScePad/Export.cpp) - read, extended-read, tracker, UI, VR-controller and report argument registers are recovered. Feature reports use a byte report ID and 64-bit byte count, capped at 64. VR trigger effects consume a 56-byte record; the dual-controller call uses two handles and a mask with records at offsets 8 and 64. Remaining payload field layouts use incomplete declarations, including extended samples and kernel-owned extension reports.
 
 - [scePadUnknown_n3kSX62fgNo](../../../core/libs/prx/libScePad/Export.cpp) (libScePad, NID `n3kSX62fgNo`) - the name is unknown, and the 0 returned after `scePadInit` is inferred, not measured. In the OS 10.01 system module the function takes no arguments, returns `0x80920005` before `scePadInit`, and otherwise sends a per-process value of 1 to ShellCore over Mbus, returning `0x809200ff` if that call fails and 0 if it succeeds, with or without an open handle. The #3177 probe measured `0x809200ff` in a process that is not a game; a game process is assumed to get 0. The ShellCore setting it changes is unknown and not modelled
-- [scePadSetAngularVelocityDeadbandState](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - with the deadband on, each angular velocity axis whose magnitude is below 0.017453292 rad/s (1 degree per second) reads as 0, before the orientation is integrated; it starts off. Threshold, per-axis test and default follow [duaLib](https://github.com/WujekFoliarz/duaLib/blob/03bad1bea2a36561b520846776f2a07ced6773e0/src/source/duaLib.cpp#L44), which reimplements the PC `libScePad.dll`; the console's threshold is not measured, and the deadband is kept per library rather than per handle since one pad handle exists
-- [scePadOpen and scePadOpenExt](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the special port (type 2) opens a handle per user (`PAD_SPECIAL_HANDLE` + slot, 16 slots for the console's 16 accounts, a 17th user gets the unknown-user code 0x809b0081) that every pad call accepts: reads give the rest record (sticks 0x80, orientation w 1, acceleration y 1, `connected` false), information is zeroed, extended information has device class -1, setters succeed without effect. Not measured: the console's own handle values (fresh per open), a PS5, and the calls the PS4 Pro survey (firmware 10.71, no special controller) did not cover; it measured open, `ALREADY_OPENED`, `scePadGetHandle`, both reads, both informations, the five setters above, close, and that two logged-in users get independent handles. `scePadOpenExt` returns `DEVICE_NOT_CONNECTED` (0x80920007) for special ports, unmeasured; PPSA01317 skips a user on any negative result. Other port types throw
+- [scePadSetAngularVelocityDeadbandState](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - with the deadband on, each angular velocity axis whose magnitude is below 0.017453292 rad/s (1 degree per second) reads as 0, before the orientation is integrated; it starts off. Threshold, per-axis test and default follow [duaLib](https://github.com/WujekFoliarz/duaLib/blob/03bad1bea2a36561b520846776f2a07ced6773e0/src/source/duaLib.cpp#L44), which reimplements the PC `libScePad.dll`; the console's threshold is not measured, and the deadband is kept per port slot. One title (PPSA04354) disassembled for this entry calls it once (0xead26b), only when a change bit of its own is set, with a 32-bit value read through a pointer and 0 or 1 taken from the 0x4 bit of a flags value, and ignores the result. The call does not show the threshold or the default.
+- [PadQueueLegacyAudioHaptics, PadClearLegacyAudioHaptics](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - PadQueueLegacyAudioHaptics and PadClearLegacyAudioHaptics route legacy audio haptics only to port 0; multi-port queueing is not modelled
+- [scePadGetControllerInformation](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - scePadGetControllerInformation always reports connectedCount = 1 and connected = true; behaviour across multiple open controller handles is not measured on hardware
+- [scePadOpen and scePadOpenExt](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the special port (type 2) opens a handle per user (`PAD_SPECIAL_HANDLE` + slot, 16 slots for the console's 16 accounts, a 17th user gets the unknown-user code 0x809b0081) that every pad call accepts: reads give the rest record (sticks 0x80, orientation w 1, acceleration y 1, `connected` false), information is zeroed, extended information has device class -1, setters succeed without effect. Not measured: the console's own handle values (fresh per open), a PS5, and the calls the PS4 Pro survey (firmware 10.71, no special controller) did not cover; it measured open, `ALREADY_OPENED`, `scePadGetHandle`, both reads, both informations, the five setters above, close, and that two logged-in users get independent handles. `scePadOpenExt` returns `DEVICE_NOT_CONNECTED` (0x80920007) for special ports, unmeasured; PPSA01317 skips a user on any negative result. `scePadOpenExt` throws for other port types
+- [scePadOpen, scePadGetHandle, scePadRead and scePadReadState for the remote control port](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - whether a console without a media remote opens the system user's remote control port (type 16), returns `DEVICE_NOT_CONNECTED` or fills other fields is not measured. The host has no remote, so the port opens its own handle (`PAD_REMOTE_HANDLE`) that reads one zeroed entry with no buttons and `connected` false; the other pad calls reject it with `INVALID_HANDLE`. SDL's PS5 video driver maps this port's buttons to keys, so a remote that read the DualSense turned Cross into Return (Raptor PPSA94002).
+- [scePadOpen](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - port types 3 and 4 throw: a payload process on a PS5 (firmware 13.60) let them past the type check, but it cannot open a port for its own logged-in user (0x809b0081), so what they open is unknown. The argument checks it did reach are followed: types 1, 5, 6, 255 and -1, and 16 for a user other than the system user, fail with `INVALID_ARG` before the user is looked at, user -1 with 0x809b0001 on types 0, 2, 3 and 4 and on index 1, and index 1 of a logged-in user with 0x809b0003; whether index 1 of types 3 and 4 fails the same way was not measured; the payload never tried type 16 with the system user (255), which opens the remote control port as below
 - [scePadVrControllerReadState](../../../core/libs/prx/libScePad/Export.cpp) - the 104-byte output layout is recovered, including buttons, stick, triggers, touch fields, motion, connection state and timestamp. Touch-value semantics and kernel report production remain incomplete; the export still throws.
 - [scePadVrControllerReadCombinedState](../../../core/libs/prx/libScePad/Export.cpp) - the two handle arguments and 128-byte output are recovered; output field semantics remain incomplete.
 - [scePadSetVibrationMode](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - modes 1 to 3 and 5 are accepted and stored. On a PS5 (firmware 13.60) the call returns `0x80920005` before `scePadInit`, then rejects a mode of 0 or below with `INVALID_ARG` before it checks the handle, and returns `INVALID_HANDLE` for a bad handle with any higher mode; whether an open handle accepts modes above 3 was not measured, since the payload could not open a pad; 5 is accepted because PPSA25286 passes it on its open handle at start-up; the meanings of modes 3 and 5 are unknown (PPSA21480 calls it with 3 right after `scePadOpen` and aborts on failure; [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Pad/Pad.cs) names only 1 and 2). The stored mode has no other effect
@@ -20,9 +24,8 @@
 - [scePadIsDS4Connected, scePadIsBlasterConnected and scePadIsMoveConnected](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the `bool (int handle)` signatures are recovered; the library reports one DualSense to every title (see Touchpad resolution below), so no DualShock 4, Blaster or Move controller is ever behind a handle and each call answers false for any handle. The console's answer for an invalid handle is not measured
 - [scePadSetAngularVelocityBiasCorrectionState](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - inferred signature `(int handle, bool enabled)` follows `scePadSetTiltCorrectionState` and `scePadSetAngularVelocityDeadbandState`; an invalid handle returns `PAD_ERROR_INVALID_HANDLE`, disabling is a no-op, and enabling throws because bias correction is not modelled
 - [scePadGetAccessibilityControllerState](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the value a console reports for a DualSense is not measured; the emulated pad, which is not an Access controller, reports 0. The name hashes to NID `zBsgF0q8DIM`. In the OS 10.01 system module the `(int handle, uint32_t* state)` function returns `0x80920005` before `scePadInit`, then `INVALID_ARG` for a NULL `state` and `INVALID_HANDLE` for a bad handle, and otherwise asks the pad driver for a per-device value of the device behind the handle: 0 when no device is behind it, 1 when the driver has no answer, else the driver's value. What the values mean is unknown
-
+- [scePadGetControllerType](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the value a console reports for a DualSense is not measured; the emulated pad reports `PAD_CONTROLLER_TYPE_DUAL_SENSE` (2), following [duaLib](https://github.com/WujekFoliarz/duaLib/blob/master/src/include/duaLib.h)'s `s_SceControllerType` enum where `UNKNOWN = 0` and `DUALSENSE = 2`; special handles report 0 (`UNKNOWN`). The signature `(int handle, int32_t* type)` follows duaLib, while the validation order (checking initialization, null pointer, then handle) follows the library's other pad queries; duaLib does not validate null pointers and returns `PAD_ERROR_DEVICE_NOT_CONNECTED` for an invalid pad.
 - [libScePad internal data and device control](../../../core/libs/prx/libScePad/Export.cpp) - kernel-owned version, telemetry, Lotus-button and update payload fields remain unresolved. Lotus-button parameter units and the three blinking byte meanings are unknown. Port information occupies 152 bytes; history records occupy 72 bytes; Leonardo unique data occupies 24 bytes. Their complete field semantics remain unresolved.
-
 - [libScePad profile writes and virtual devices](../../../core/libs/prx/libScePad/Export.cpp) - profile writes take a handle, profile ID, profile pointer and a 32-bit result pointer; the profile payload direction and fields remain unresolved. Virtual-device creation takes an input record and an output ID pointer, whose width is not exposed by the wrapper. Component information copies 16 bytes; field meanings remain unknown. Virtual trigger state contains two 32-bit states and three control bytes, but the control semantics remain incomplete.
 
 ### Functional
diff --git a/docs/dev/debt/libScePlayGo.md b/docs/dev/debt/libScePlayGo.md
index 40a6135747..89f271596b 100644
--- a/docs/dev/debt/libScePlayGo.md
+++ b/docs/dev/debt/libScePlayGo.md
@@ -4,5 +4,5 @@
 
 - [scePlayGoRequestNextChunk, scePlayGoSnapshot](../../../core/libs/prx/libScePlayGo/Export.cpp) (libScePlayGo) - their names and NIDs are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePlayGo.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim
 - [scePlayGoSetLanguageMask](../../../core/libs/prx/libScePlayGo/Export.cpp) (libScePlayGo) - stores the mask that `scePlayGoGetLanguageMask` then reports, and returns `SCE_PLAYGO_ERROR_BAD_HANDLE` for another handle, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/8d50471b7dc141dd700b51276b8edd1f293bce26/src/core/libraries/playgo/playgo.cpp#L346-L359) does on the PS4. shadPS4 also returns `SCE_PLAYGO_ERROR_NOT_INITIALIZED` before `scePlayGoInitialize` and starts from the system language's mask; here the mask starts with every language and initialization is not tracked. Not measured on a PS5
-- [libScePlayGo](../../../core/libs/prx/libScePlayGo/Export.cpp) - the chunk set comes from `playgo-chunkdefs.xml` (every listed chunk plus chunks 0 through the default chunk), otherwise from `sce_sys/playgo-chunk.dat`, whose `plgx` header is read as holding the chunk count as a 16-bit value at offset 0x0A and ids 0 to count - 1 are taken as valid. The field was identified on four dumps, where exactly that many 0x20-byte entries follow from offset 0x100 (RIDE 4 PPSA01599: 35, Persona 5 Royal PPSA05110: 25, LEGO Horizon Adventures PPSA14632 and Kena PPSA01802: 1); the rest of the format is not decoded and ids are assumed to be contiguous. Every listed chunk is reported as installed (`LOCAL_FAST`). Without either file, a package with `sce_sys/playgo-scenario.json` (PPSA01748, whose dump lists no chunks) accepts every chunk id as installed, and `scePlayGoGetChunkId` lists ids 0 to 999. A title that builds its set of installed chunks from that list skips any chunk it does not see. The console's chunk limit is not known here, and a package with more chunks would see ids from 1000 up as not listed. A package with no `playgo-*` file in `sce_sys` (PPSA03001, PPSA03490 and PPSA01285 here) accepts chunk 0; querying any other id throws with a message naming the missing `playgo-chunk.dat` and `playgo-scenario.json`, since the incomplete dump cannot establish whether that id exists; `APS5_PLAYGO_UNLISTED_CHUNKS=installed` answers every such id as installed (`LOCAL_FAST`, which PPSA15388 needs to load its saves) and `=absent` answers `SCE_PLAYGO_ERROR_BAD_CHUNK_ID` (which ends PPSA03001's id walk), as the user's choice for that dump. A `sce_sys` that holds other `playgo-*` files (`playgo-ficm.dat`, `playgo-hash-table.dat`) without `playgo-chunk.dat` or `playgo-scenario.json`, or a `playgo-chunk.dat` without a `plgx` header and a nonzero count, throws naming the file, because no such dump is known. These answers are unverified on a console, as is the console's answer for an id outside a package's chunk table.
+- [libScePlayGo](../../../core/libs/prx/libScePlayGo/Export.cpp) - the chunk set comes from `playgo-chunkdefs.xml` (every listed chunk plus chunks 0 through the default chunk), otherwise from `sce_sys/playgo-chunk.dat`, whose `plgx` header is read as holding the chunk count as a 16-bit value at offset 0x0A and ids 0 to count - 1 are taken as valid. The field was identified on four dumps, where exactly that many 0x20-byte entries follow from offset 0x100 (RIDE 4 PPSA01599: 35, Persona 5 Royal PPSA05110: 25, LEGO Horizon Adventures PPSA14632 and Kena PPSA01802: 1); the rest of the format is not decoded and ids are assumed to be contiguous. Every listed chunk is reported as installed (`LOCAL_FAST`). Without either file, a package with `sce_sys/playgo-scenario.json` (PPSA01748, whose dump lists no chunks) accepts ids 0 to 999 as installed, and `scePlayGoGetChunkId` lists the same ids. A title that builds its set of installed chunks from that list skips any chunk it does not see. The console's chunk limit is not known here, so an id from 1000 up is answered like an unlisted id of a package with no `playgo-*` file: it throws unless `APS5_PLAYGO_UNLISTED_CHUNKS` answers it (`=absent` ends PPSA02630's id walk, which otherwise asks for every id until one is rejected and wraps the 16-bit id). A package with no `playgo-*` file in `sce_sys` (PPSA03001, PPSA03490 and PPSA01285 here) accepts chunk 0; querying any other id throws with a message naming the missing `playgo-chunk.dat` and `playgo-scenario.json`, since the incomplete dump cannot establish whether that id exists; `APS5_PLAYGO_UNLISTED_CHUNKS=installed` answers every such id as installed (`LOCAL_FAST`, which PPSA15388 needs to load its saves) and `=absent` answers `SCE_PLAYGO_ERROR_BAD_CHUNK_ID` (which ends PPSA03001's id walk), as the user's choice for that dump. A `sce_sys` that holds other `playgo-*` files (`playgo-ficm.dat`, `playgo-hash-table.dat`) without `playgo-chunk.dat` or `playgo-scenario.json`, or a `playgo-chunk.dat` without a `plgx` header and a nonzero count, throws naming the file, because no such dump is known. These answers are unverified on a console, as is the console's answer for an id outside a package's chunk table.
 - [libScePlayGo](../../../core/libs/prx/libScePlayGo/Export.cpp) - `scePlayGoGetSupportedOptionalChunk` and `scePlayGoGetOptionalChunk` report every bit set for `type` 0, 1 or 2, i.e. every optional chunk (language pack) supported and installed, like `scePlayGoGetLanguageMask`. Native requests confirm types 0 through 2 and an eight-byte result; their meanings and bit layout are still determined by the external service, not this module; PPSA01748 calls both with type 0 and hides every text language listed in `playgo-scenario.json` `chunkSupportedLanguages` when the bitmask is 0. The console's answer for a package that ships no optional chunks is unverified.
diff --git a/docs/dev/debt/libScePlayReady.md b/docs/dev/debt/libScePlayReady.md
index f3b7a6a60c..c7677e9529 100644
--- a/docs/dev/debt/libScePlayReady.md
+++ b/docs/dev/debt/libScePlayReady.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [sceBufferAlloc, sceBufferDup, sceBufferFree, sceBufferInit, sceBufferRealloc, scePlayReadyApiInitializeInitParams, scePlayReadyApiIsStarted, scePlayReadyApiStart, scePlayReadyApiStop, scePlayReadyApiVersion, scePlayReadyApiVersionString, scePlayReadyBufferFree, scePlayReadyBufferInit, scePlayReadyBufferMalloc, scePlayReadyBufferRealloc, scePlayReadyContentGetProperty, scePlayReadyContentSetProperty, scePlayReadyDomainCertEnumFini, scePlayReadyDomainCertEnumInit, scePlayReadyDomainCertEnumNext, scePlayReadyDomainCertFind, scePlayReadyDomainJoinGenerateChallenge, scePlayReadyDomainJoinProcessResponse, scePlayReadyDomainLeaveGenerateChallenge, scePlayReadyDomainLeaveProcessResponse, scePlayReadyEnvelopeClose, scePlayReadyEnvelopeGetSize, scePlayReadyEnvelopeInitializeRead, scePlayReadyEnvelopeOpen, scePlayReadyEnvelopeRead, scePlayReadyEnvelopeSeek, scePlayReadyFinalize, scePlayReadyFreeDecryptContext, scePlayReadyInitialize, scePlayReadyInitializeInitParams, scePlayReadyLicenseAcqGenerateAck, scePlayReadyLicenseAcqGenerateChallenge, scePlayReadyLicenseAcqGetAdditionalResponseData, scePlayReadyLicenseAcqProcessAckResponse, scePlayReadyLicenseAcqProcessResponse, scePlayReadyMemAlloc, scePlayReadyMemFree, scePlayReadyMemGetStats, scePlayReadyMemRealloc, scePlayReadyNewDecryptContext, scePlayReadyReaderBind, scePlayReadyReaderCommit, scePlayReadyReaderDecrypt, scePlayReadyReset and scePlayReadyStoreCleanup](../../../core/libs/prx/libScePlayReady/Export.cpp) (libScePlayReady) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePlayReady.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceBufferAlloc, sceBufferDup, sceBufferFree, sceBufferInit, sceBufferRealloc, scePlayReadyApiInitializeInitParams, scePlayReadyApiIsStarted, scePlayReadyApiStart, scePlayReadyApiStop, scePlayReadyApiVersion, scePlayReadyApiVersionString, scePlayReadyBufferFree, scePlayReadyBufferInit, scePlayReadyBufferMalloc, scePlayReadyBufferRealloc, scePlayReadyContentGetProperty, scePlayReadyContentSetProperty, scePlayReadyDomainCertEnumFini, scePlayReadyDomainCertEnumInit, scePlayReadyDomainCertEnumNext, scePlayReadyDomainCertFind, scePlayReadyDomainJoinGenerateChallenge, scePlayReadyDomainJoinProcessResponse, scePlayReadyDomainLeaveGenerateChallenge, scePlayReadyDomainLeaveProcessResponse, scePlayReadyEnvelopeClose, scePlayReadyEnvelopeGetSize, scePlayReadyEnvelopeInitializeRead, scePlayReadyEnvelopeOpen, scePlayReadyEnvelopeRead, scePlayReadyEnvelopeSeek, scePlayReadyFinalize, scePlayReadyFreeDecryptContext, scePlayReadyInitialize, scePlayReadyInitializeInitParams, scePlayReadyLicenseAcqGenerateAck, scePlayReadyLicenseAcqGenerateChallenge, scePlayReadyLicenseAcqGetAdditionalResponseData, scePlayReadyLicenseAcqProcessAckResponse, scePlayReadyLicenseAcqProcessResponse, scePlayReadyMemAlloc, scePlayReadyMemFree, scePlayReadyMemRealloc, scePlayReadyNewDecryptContext, scePlayReadyReaderBind, scePlayReadyReaderCommit, scePlayReadyReaderDecrypt, scePlayReadyReset and scePlayReadyStoreCleanup](../../../core/libs/prx/libScePlayReady/Export.cpp) (libScePlayReady) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePlayReady.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libScePngDec.md b/docs/dev/debt/libScePngDec.md
index 9449f5a2e9..260202e2bf 100644
--- a/docs/dev/debt/libScePngDec.md
+++ b/docs/dev/debt/libScePngDec.md
@@ -3,7 +3,7 @@
 ### Functional
 
 - [libScePngDec](../../../core/libs/prx/libScePngDec/Export.cpp): the supplied module confirms the work-memory size formula, 16-byte handle alignment, the first 24 bytes of its context, and Create/QueryMemorySize validation order. The host now exposes these values but still allocates decoder working storage on the host instead of using the guest work region.
-- [scePngDecDecode](../../../core/libs/prx/libScePngDec/Export.cpp): 16-bit output and the original's accepted pixel format 132 remain unsupported and throw. Malformed-image diagnostics and decoder scratch-memory behavior are not fully matched to the supplied module.
+- [scePngDecDecode](../../../core/libs/prx/libScePngDec/Export.cpp): the original's accepted pixel format 132 remains unsupported and throws. The input bit-depth limit and 16-to-8-bit conversion follow [Prosper's PS5 3.20 module analysis](https://github.com/mattias800/prosper/blob/550886e3677e4a2ef81ad1603bf313f6a9696de2/prosper/src/hle/util/hle_pngdec.cpp#L412-L414), and the large-dimension image-info requirement and its validation order follow [Prosper's PS5 3.20 module analysis](https://github.com/mattias800/prosper/blob/550886e3677e4a2ef81ad1603bf313f6a9696de2/prosper/src/hle/util/hle_pngdec.cpp#L385-L396), not console measurements here. Malformed-image diagnostics and decoder scratch-memory behavior are not fully matched to the supplied module.
 
 ### Unknown function info
 
diff --git a/docs/dev/debt/libScePosixForWebKit.md b/docs/dev/debt/libScePosixForWebKit.md
index 39e20c0542..bf4a170fa8 100644
--- a/docs/dev/debt/libScePosixForWebKit.md
+++ b/docs/dev/debt/libScePosixForWebKit.md
@@ -4,12 +4,14 @@
 
 - [gethostbyname](../../../core/libs/prx/libScePosixForWebKit/Resolver.cpp) (libScePosixForWebKit) - numeric IPv4 forms, trailing whitespace and 64-bit accumulation follow FreeBSD 11.4 [inet_aton](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/inet/inet_addr.c); clearing the resolver error on numeric success follows [fakeaddr](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/net/gethostnamadr.c). Exact PS5 behavior is unverified; hostname lookup still uses the host resolver
 - [clock_gettime_np, getenv_np, gethostbyname_r (`scePosixForWebKit_gethostbyname_r`), mmap_np, msetname, pthread_setschedparam_np, setenv_np, sysinfo (`scePosixForWebKit_sysinfo`)](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) - names/NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePosixForWebKit.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); credible prototypes are unknown. These exports use renamed helpers; defining `gethostbyname_r` would interpose on the host function this library calls itself. All are parameterless import stubs, not ABI claims; callers must not use them until signatures are verified.
-- [__wrap_fchown, __wrap_link, __wrap_readlink, __wrap_statvfs, __wrap_symlink](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) - parameterless throwing stubs. Under the `--wrap` convention assumed for the forwarding wrappers (see Functional) each would take the POSIX signature of the function it wraps, but the targets are in libkernel_sys (`fchown`, `link`, `readlink`, `symlink`) and libSceLibcInternal (`statvfs`), which no prx links; libkernel_sys's `fchown`, `readlink` and `symlink` also still throw for some arguments
 
 ### Functional
 
+- [strcasestr](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) - console locale behavior is unmeasured. It follows FreeBSD 11.4's [strcasestr.c](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/string/strcasestr.c) in the guest's supported C locale; other guest locales are not implemented.
 - [mkstemp and isatty](../../../core/libs/prx/libScePosixForWebKit/Filesystem.cpp) (libScePosixForWebKit) follow FreeBSD's [temporary-file API](https://github.com/freebsd/freebsd-src/blob/stable/9/lib/libc/stdio/mktemp.c) and [terminal check](https://github.com/freebsd/freebsd-src/blob/stable/9/lib/libc/gen/isatty.c), without console verification. `mkstemp` replaces all trailing `X` characters, accepts a fixed name, and creates files through the guest path resolver with exclusive read/write access and mode 0600. Windows file permissions follow the existing kernel file implementation. `isatty` tests Windows console handles rather than all character devices; files, pipes and guest sockets return `ENOTTY`, closed descriptors return `EBADF`.
+- [__wrap_fchown, __wrap_link, __wrap_readlink, __wrap_statvfs and __wrap_symlink](../../../core/libs/prx/libScePosixForWebKit/Wrap.cpp) (libScePosixForWebKit) - whether the console's wrappers add sandbox checks or path rewriting for WebKit is unknown. Each takes the signature of the function it is named after, as GNU ld's `--wrap` does, and calls it: libkernel_sys's `fchown`, `link`, `readlink` and `symlink`, and libSceLibcInternal's `statvfs`, with their gaps
 - [arc4random](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) returns four bytes of host OS entropy (`getentropy`, `rand_s` on Windows), as `arc4random_buf` does, uniform over the 32-bit range like FreeBSD 11.4's RC4 keystream in [arc4random.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/arc4random.c). The console's generator and its reseeding are unknown; `arc4random_uniform`, `arc4random_stir` and `arc4random_addrandom` are not in the module's export set and are absent
+- [pthread_setname_np](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) stores the guest thread name in libkernel's thread object, so `pthread_getname_np` returns it, and follows libkernel's `pthread_rename_np`: `EINVAL` (22) for a null thread or name, `ENAMETOOLONG` (63) from 32 bytes on, `0` otherwise, with the name truncated to 31 bytes when read back. It does not apply the Windows thread description or the job affinity that `scePthreadRename` sets, because those helpers are private to libkernel; the console's exact error numbers for this module are unverified
 - [fnmatch](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) follows FreeBSD 11 [fnmatch.c](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/libc/gen/fnmatch.c) in the C locale: each byte is one character, `FNM_CASEFOLD` folds ASCII letters only, and bracket ranges compare byte values. `[:class:]` names are not character classes: as in FreeBSD 11 through 14, `[[:digit:]]` is the set of `[`, `:`, `d`, `i`, `g`, `t` followed by a literal `]` (classes were added to `fnmatch.c` after 14). Multibyte characters and locale collation are not modelled. A null pattern or string throws
 - [getservbyname](../../../core/libs/prx/libScePosixForWebKit/Resolver.cpp) (libScePosixForWebKit) searches a built-in copy of 37 lines of FreeBSD 11.4's [etc/services](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/etc/services) (ftp-data, ftp, ssh, telnet, smtp, domain, tftp, http, pop3, ntp, imap, https, rtsp, submission, imaps, pop3s with their aliases and protocols, in file order) the way [getservent.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/net/getservent.c) searches the file: case-sensitive name or alias, a null protocol takes the first match, the port in network byte order, the result in per-thread storage. The console's `/etc/services` is unknown, so any other service returns null without setting `errno`, as for a name the file lacks. `getaddrinfo` still resolves service names through the host's service database
 - [__wrap_access, __wrap_clock_gettime, __wrap_getcwd, __wrap_getenv, __wrap_lstat and __wrap_mmap](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) assume, from the export names alone, the GNU ld [`--wrap`](https://sourceware.org/binutils/docs/ld/Options.html) convention (a reference to `<name>` resolves to `__wrap_<name>`): each takes its target's POSIX signature and forwards to libc's (`access`, `getcwd`, `getenv`) or libkernel's (`clock_gettime`, `lstat`, `mmap`) implementation, which sets `errno`. No PS5 module or WebKit call site was read to confirm that WebKit imports `__wrap_<name>` in place of `<name>` or that the console wrappers only forward. Any sandbox or path handling the console module adds is not modelled, and how the wrappers relate to `getenv_np`, `setenv_np`, `mmap_np` and `clock_gettime_np` (such as a separate environment that `setenv_np` fills) is unknown
diff --git a/docs/dev/debt/libScePsml_debug.md b/docs/dev/debt/libScePsml_debug.md
index f77c32d0b1..b8bdedf383 100644
--- a/docs/dev/debt/libScePsml_debug.md
+++ b/docs/dev/debt/libScePsml_debug.md
@@ -3,7 +3,7 @@
 ### Unknown function info
 
 - [scePsmlMfsrGetSharedResourcesInitRequirement, scePsmlMfsrCreateSharedResources, scePsmlMfsrReleaseSharedResources, scePsmlMfsrGetContextBufferRequirement800M3_2, scePsmlMfsrCreateContext800M3_2, scePsmlMfsrReleaseContext](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml) - only resource type 0 is supported. The context requirement reports four 2 MiB blocks regardless of its parameters, while the system calculation depends on the context configuration. The descriptor pointer at 0x28 is not read. Validation throws for null pointers, short block lists and foreign handles instead of reproducing the system error and fault behaviour.
-- [scePsmlMfsr2GetDispatchPacketsSizeInDwords](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml_mfsr2) - writes a 32-bit size through the second argument; the unused first argument still needs caller verification.
+- [scePsmlMfsr2Init and the other MFSR2 calls](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml) - only a console without PSSR is modelled. In firmware 13.60 `libScePsml.sprx` (read from disassembly, not measured on a console), `scePsmlMfsr2Init` returns 0x8A8A0012 when `sceKernelIsTrinityMode` returns 0, and until `Init` succeeds every other MFSR2 call returns 0x8A8A0001 without touching its arguments. AnyPS5 reports 0, so `Init` throws only if that changes: the initialization after the check, the shared resource and context requirements, and the 0x800-dword size that `GetDispatchPacketsSizeInDwords` writes through its second argument are not implemented
 - [scePsmlMfsrGetContextBufferRequirement1100, scePsmlMfsrCreateContext1100, scePsmlMfsrGetDispatchMfsrPacket1100](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml_debug) - argument layouts unknown; PPSA26344 imports but does not call the first two and at `0x87EFA` passes `(rdi, rsi=&stack, rdx)` as three pointers to `GetDispatchMfsrPacket1100`; before `scePsmlMfsrInit` they return 0x8A810001 (not initialized) and after it they throw. `scePsmlMfsrCreateContext1300` and `scePsmlMfsrGetDispatchMfsrPacket900`, `1000` and `1300` take the same shapes (context slot and parameter; context, command buffer and parameter) and behave the same way. PPSA08330 and PPSA03016 pass `GetDispatchMfsrPacket900`/`1000` the context handle, a `{cursor, size in dwords}` command buffer and the dispatch parameters, and advance their cursor by the size `scePsmlMfsrGetDispatchMfsrPacketSizeInDwords` returned. Whether the 1100 and 1300 versions take these arguments, and the console's error, are unverified
 - [scePsmlMfsrGetDispatchMfsrPacket1000](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml) - imported by PPSA25344. libScePsml and libScePsml_debug are built from the same source
 - [scePsmlMfsrCreateContext1300, scePsmlMfsrGetDispatchMfsrPacket1300](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml) - imported by PPSA28416 next to `scePsmlMfsrGetContextBufferRequirement1100`. The names are not in the aerolib NID list; they hash to the imported NIDs `kLF7WtQ1-Dg` and `DDVUyPyYHTA` (`tools/nid_names.py`)
@@ -11,4 +11,4 @@
 ### Functional
 
 - [scePsmlMfsrGetDispatchMfsrPacketSizeInDwords, scePsmlMfsrGetMipmapBias, scePsmlMfsrSelectConfig, scePsmlMfsrRequestCapture, scePsmlMfsrIsCaptureInProgress](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml) - semantics from the APR-EMU `fakelib/libScePsml.sprx`. Guards: `0x8A810001` uninitialized, `0x8A810005` null/foreign handle (fakelib checks an engine id `0xA9C4`/`0x9231`; our map check is the equivalent), `0x8A810009` null output. `GetDispatchMfsrPacketSizeInDwords` writes `0x600`; `GetMipmapBias(context, bias, dimension)` writes `log2f(dimension / context->inputWidth) - 1.0f`, width recorded at `CreateContext800M3_2` from the parameter pair at 0x18 or `descriptor0 + 0x20` for callers that pass a descriptor pointer there (indirection inferred; zero width returns `0x8A810005`). `SelectConfig`, `RequestCapture`, `IsCaptureInProgress` validate then return 0. The `GetDispatchMfsrPacket*` calls still throw: the 0x158-byte template's packet routine is not understood
-- [scePsmlMfsrInit](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml) - succeeds and only sets the initialized state; the shared resources and contexts are bookkeeping objects that use none of the guest blocks. Whether Sony's library fails on hardware without PSSR is unknown. PPSA08330 calls the setup unconditionally and only uses a context when its cached `sceKernelIsTrinityMode` result is set (0x3c643d, 0x567f97; otherwise it stores a -0.25 mip bias itself at 0x567fe2), which AnyPS5 reports as 0
+- [scePsmlMfsrInit](../../../core/libs/prx/libScePsml_debug/Export.cpp) (libScePsml) - succeeds and only sets the initialized state; the shared resources and contexts are bookkeeping objects that use none of the guest blocks. The console's library fails there instead: in firmware 13.60 (read from disassembly, not measured on a console) `scePsmlMfsrInit` returns 0x8A810012 when `sceKernelIsTrinityMode` returns 0, so its later MFSR calls return 0x8A810001. PPSA08330 calls the setup unconditionally and only uses a context when its cached `sceKernelIsTrinityMode` result is set (0x3c643d, 0x567f97; otherwise it stores a -0.25 mip bias itself at 0x567fe2), which AnyPS5 reports as 0
diff --git a/docs/dev/debt/libSceRegMgr.md b/docs/dev/debt/libSceRegMgr.md
index 24cd287ce7..939ecae49d 100644
--- a/docs/dev/debt/libSceRegMgr.md
+++ b/docs/dev/debt/libSceRegMgr.md
@@ -1,5 +1,10 @@
 # libSceRegMgr technical debt
 
+### Functional
+
+- [Registry store](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - entries are queried through an in-memory process-local store without persistence. Callable prototypes for `sceRegMgrGetInt`, `sceRegMgrGetStr`, and `sceRegMgrGetBin` derive from [regmgr.h](https://github.com/ps5-payload-dev/regdump/blob/883524cc48c8497267ba7fc94ff0ac58880c4227/regmgr.h#L3713-L3729). Implemented getters return error codes for invalid parameters (`0x80820001`), missing keys (`0x80820002`), buffer sizing (`0x80820004`), and type mismatches (`0x80820006`) as unverified host implementation assumptions, as the cited regmgr.h does not establish error codes or validation behavior. Setters (`sceRegMgrSetInt`, `sceRegMgrSetStr`, `sceRegMgrSetBin`, `sceRegMgrSetbin`), reset (`sceRegMgrResetVal`), and zero-length getter paths remain unimplemented throwing `NotImplemented_nid_no_patch` until callable contracts and error codes are supported by evidence.
+- [Unverified registry APIs](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - export names and NIDs for initial-value getters, version queries, region queries and conversions, error checks, control/backup routines, and `sceRegMgrNonSys*` variants are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/cf6eede3f6588d779664e01874638f09484324b7/libSceRegMgr.c) and [NID database](https://github.com/zecoxao/sce_symbols/blob/9620e03b2964dbf0cfc1cb143ab24a65125091de/aerolib.csv), but their callable contracts and runtime behavior remain unverified and retain `NotImplemented_nid_no_patch`.
+
 ### Unknown function info
 
 - [sceRegMgrCheckError](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - unknown signature
diff --git a/docs/dev/debt/libSceRtc.md b/docs/dev/debt/libSceRtc.md
index 56985f25a2..12645457b4 100644
--- a/docs/dev/debt/libSceRtc.md
+++ b/docs/dev/debt/libSceRtc.md
@@ -7,6 +7,8 @@
 ### Unknown function info
 
 - [sceRtcParseDateTime](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - a blank zone after seconds is accepted. With fully allocated input storage on PS5 firmware 13.42 and again on 13.60, the same NUL-terminated text returned `BAD_PARSE` when the byte after its terminator was zero and succeeded when that byte was uppercase `T`. This dependence on storage after the terminator is not modeled; controlled backing-byte measurements in a title process are unavailable.
+- [sceRtcFormatRFC2822, sceRtcFormatRFC2822LocalTime, sceRtcFormatRFC3339LocalTime](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - measured on PS4 firmware 10.71, not on a PS5: the RFC 2822 text, `INVALID_YEAR` when the zone-shifted tick is past 9999 as a signed value, otherwise `INVALID_VALUE` when the source tick or the zone-shifted tick is negative as a signed value, and the local-time variants using the offset in effect at the given instant (+01:00 in January, +02:00 in July on a Central European console). A null tick formatting the current time and the ±1439 minute offset limit come from the PS5 measurement in the next entry and are not measured on the PS4
+- [sceRtcFormatRFC3339, sceRtcGetDayOfWeek, sceRtcSetTime_t](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - measured on PS4 firmware 10.71 from processes compiled with SDK versions 0x01000051, 0x02ffffff, 0x03000000 and 0x05050001, not on a PS5. From 0x03000000 on: `FormatRFC3339` returns `INVALID_VALUE` when adding the zone shift to the tick overflows or underflows 64 bits (earlier SDKs wrap); `GetDayOfWeek` checks the month before the year and rejects a year past 9999 (earlier SDKs check the year first, with no upper bound); `SetTime_t` rejects negative seconds with `INVALID_VALUE` and converts all 64 bits (earlier SDKs take the low 32 bits). 0x02ffffff still behaves the earlier way and 0x03000000 the later way. The earlier rules apply only to a PS4 title (a CUSA title ID): a PS5 title has its own SDK numbering, so it always gets the later rules, the behaviour main had before; those are not measured on a PS5.
 - [sceRtcGetDosTime, sceRtcSetDosTime](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - bit layout from shadPS4 (PS4, the standard FAT date/time). A year outside 1980-2107 makes `GetDosTime` return `INVALID_YEAR` after writing 0 for an earlier one and `0xff9fbf7d` (2107-12-31 23:59:58, the largest encodable time) for a later one, and `SetDosTime` decodes the year as the unsigned 7-bit FAT field (1980-2107) without validating the fields, as the disassembly-derived [fpPS4](https://github.com/red-prig/fpPS4) reimplementation of the PS4 library does; not confirmed on a PS5 title, and shadPS4 instead masks out-of-range years into the packed value and sign-extends the 16-bit date
 - [sceRtcFormatRFC2822LocalTime, sceRtcFormatRFC3339LocalTime](../../../core/libs/prx/libSceRtc/Export.cpp): the native wrappers obtain the zone from a kernel timezone query, while the host uses the offset at the supplied instant. The kernel timezone configuration and its failure paths are not modeled. Native formatting confirms that null tick pointers select current time, RFC3339 uses two fractional digits, and explicit offsets are limited to -1439 through 1439 minutes.
 - [sceRtcGetCurrentRawNetworkTick](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - the console reads clock 0x13 and returns its time plus the Unix epoch in ticks, or `0x80B50001` when the clock is unsupported (errno 5). The raw network clock is not modelled; this returns the host clock. Read from the disassembly of libSceRtc.sprx on firmware 13.60, not measured on a console
diff --git a/docs/dev/debt/libSceSaveData.native.md b/docs/dev/debt/libSceSaveData.native.md
index 5dd2782a8b..b022421794 100644
--- a/docs/dev/debt/libSceSaveData.native.md
+++ b/docs/dev/debt/libSceSaveData.native.md
@@ -16,9 +16,9 @@
 ### Functional
 
 - [sceSaveDataDirNameSearch, sceSaveDataDirNameSearch2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - only the running title's saves are kept, so a search with another title's `title_id` reports zero hits, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/ec334904604ba41f5d4753f4a2498ec82540e5d6/src/core/libraries/save_data/savedata.cpp#L791-L802) and [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/569ec04d1a77127c601eed522ad5bba187173f9d/src/libs/libSaveData.cpp#L592-L596) do when that title has no save directory; what a console returns for another title's saves is not verified. The running title's ID is the `titleId` in its `param.json`
-- [sceSaveDataDirNameSearch2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) runs the same search as `sceSaveDataDirNameSearch` with the same condition and result structures, as [SharpEmu](https://github.com/sharpemu/sharpemu/blob/main/src/SharpEmu.Libs/SaveData/SaveDataExports.cs) does, its only source; what distinguishes it on the console is unknown.
+- [sceSaveDataDirNameSearch2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) runs the same search as `sceSaveDataDirNameSearch` with the same condition and result structures, as [SharpEmu](https://github.com/sharpemu/sharpemu/blob/main/src/SharpEmu.Libs/SaveData/SaveDataExports.cs) does, its only source; what distinguishes it on the console is unknown. One title (PPSA35669, in a plugin) disassembled for this entry has one call site (0x2eda71); it clears 56 bytes for the result structure first (the size of the structure used here), puts a value returned by a call with the argument 0x8000 at offset 8 and 0x400 at offset 0x10, and afterwards branches on a negative result and reads the 32-bit field at offset 0, skipping its loop when it is 0. That agrees with the result structure of `sceSaveDataDirNameSearch`. The condition structure was not read.
 - [sceSaveDataMount3](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - a failed mount (BUSY, EXISTS, NOT_FOUND, MOUNT_FULL) leaves the result as it was, as shadPS4 does; not checked on hardware. Animal Well (PPSA22520) depends on it: it checks for its save with a mount it never unmounts, then saves with a second mount of the same directory, ignores its BUSY and keeps using the first mount point for `sceSaveDataPrepare`, its file and `sceSaveDataUmount2`
 - [sceSaveDataMount3](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - an unterminated or empty directory name, `.`, `..`, or a name containing `/`, `\` or `:` returns `SAVE_DATA_ERROR_PARAMETER`, which the [SDK 12.000 reference](https://github.com/peterpuppy/bm/blob/3f9d1ba6b896a53080460c903f5c15af8affb80d/features/ps5/document/output/psn_12/System/Save_Data/SaveData-Reference/sce-save-data-mount3.md#L196-L204) lists for an invalid parameter, and leaves the result as it was, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/569ec04d1a77127c601eed522ad5bba187173f9d/src/libs/libSaveData.cpp#L652-L658) does. The [SDK](https://github.com/peterpuppy/bm/blob/3f9d1ba6b896a53080460c903f5c15af8affb80d/features/ps5/document/output/psn_12/System/Save_Data/SaveData-Reference/sce-save-data-dir-name.md#L32-L36) lets an application use only letters, digits, `-`, `.` and `@` in a name, and KytyPS5 also accepts `_` ([`valid_path_component`](https://github.com/KytyPS5/KytyPS5/blob/569ec04d1a77127c601eed522ad5bba187173f9d/src/libs/libSaveData.cpp#L276-L287)); which other names the console's mount rejects is not checked on hardware
-- [sceSaveDataBackup, sceSaveDataGetEventResult, sceSaveDataGetMountInfo, sceSaveDataGetParam, sceSaveDataLoadIcon, sceSaveDataSaveIcon, sceSaveDataSetParam, sceSaveDataUmount2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - null pointer arguments return `SAVE_DATA_ERROR_PARAMETER` instead of throwing C++ exceptions; unmounted targets return `SAVE_DATA_ERROR_NOT_MOUNTED`, and parameter type or buffer size violations return `SAVE_DATA_ERROR_PARAMETER` after slot lookup
+- [sceSaveDataBackup, sceSaveDataDelete, sceSaveDataDirNameSearch, sceSaveDataGetEventResult, sceSaveDataGetMountInfo, sceSaveDataGetParam, sceSaveDataLoadIcon, sceSaveDataMount3, sceSaveDataSaveIcon, sceSaveDataSetParam, sceSaveDataUmount2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - null pointer arguments return `SAVE_DATA_ERROR_PARAMETER` instead of throwing C++ exceptions, an implementation assumption matching guest error expectations not checked on hardware; unmounted targets return `SAVE_DATA_ERROR_NOT_MOUNTED`, and parameter type or buffer size violations return `SAVE_DATA_ERROR_PARAMETER` after slot lookup
 
 - [sceSaveDataSyncSaveDataMemory](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - validates library initialization and parameters; since in-memory saves flush synchronously on write, sync confirms existence and readiness of the memory blob
diff --git a/docs/dev/debt/libSceSdma.md b/docs/dev/debt/libSceSdma.md
index 78b6855431..bef40fd068 100644
--- a/docs/dev/debt/libSceSdma.md
+++ b/docs/dev/debt/libSceSdma.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [libSceSdma pending exports](../../../core/libs/prx/libSceSdma/Export.cpp) - 26 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSdma.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceSdma pending exports](../../../core/libs/prx/libSceSdma/Export.cpp) - 21 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSdma.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
diff --git a/docs/dev/debt/libSceSharePlay.md b/docs/dev/debt/libSceSharePlay.md
index f7255df0d8..915f67c4c2 100644
--- a/docs/dev/debt/libSceSharePlay.md
+++ b/docs/dev/debt/libSceSharePlay.md
@@ -2,11 +2,12 @@
 
 ### Unknown function info
 
-- [sceSharePlayCrashDaemon, sceSharePlayGetCurrentConnectionInfo, sceSharePlayGetCurrentInfo, sceSharePlayGetEvent, sceSharePlayNotifyDialogOpen, sceSharePlayNotifyForceCloseForCdlg, sceSharePlayResumeScreenForCdlg, sceSharePlayServerLock](../../../core/libs/prx/libSceSharePlay/Export.cpp) (libSceSharePlay) - the list is the intersection of the export table of the console's [libSceSharePlay](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSharePlay.c) (function symbols only), the pinned [aerolib names](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv) and the functions not yet defined anywhere in the repo. No credible prototypes were found; they are declared without parameters solely to resolve known imports, not as an ABI claim, and callers must not call them until signatures are verified.
+- [sceSharePlayCrashDaemon, sceSharePlayGetCurrentInfo, sceSharePlayGetEvent, sceSharePlayNotifyDialogOpen, sceSharePlayNotifyForceCloseForCdlg, sceSharePlayResumeScreenForCdlg, sceSharePlayServerLock](../../../core/libs/prx/libSceSharePlay/Export.cpp) (libSceSharePlay) - the list is the intersection of the export table of the console's [libSceSharePlay](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSharePlay.c) (function symbols only), the pinned [aerolib names](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv) and the functions not yet defined anywhere in the repo. No credible prototypes were found; they are declared without parameters solely to resolve known imports, not as an ABI claim, and callers must not call them until signatures are verified.
 - [sceSharePlayServerUnLock, sceSharePlaySetMode, sceSharePlaySetProhibition, sceSharePlaySetProhibitionModeWithAppId, sceSharePlayStartStandby, sceSharePlayStartStreaming, sceSharePlayStopStandby, sceSharePlayStopStreaming](../../../core/libs/prx/libSceSharePlay/Export.cpp) (libSceSharePlay) - the list is the intersection of the export table of the console's [libSceSharePlay](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSharePlay.c) (function symbols only), the pinned [aerolib names](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv) and the functions not yet defined anywhere in the repo. No credible prototypes were found; they are declared without parameters solely to resolve known imports, not as an ABI claim, and callers must not call them until signatures are verified.
 
 ### Functional
 
 - [sceSharePlayInitialize and sceSharePlayTerminate](../../../core/libs/prx/libSceSharePlay/Export.cpp) - native heap validation and initialization state are recovered: a null heap ignores the supplied size, a supplied heap requires at least 0x1800 bytes, repeated initialization returns 0x810E0003 and termination before initialization returns 0x810E0004. The host does not allocate the native internal heap, connect to the Share Play service or reproduce its failures.
 - [sceSharePlayGetCurrentConnectionInfoA](../../../core/libs/prx/libSceSharePlay/Export.cpp) - the native module confirms a 72-byte result, initial zero fields and both user IDs -1. Initialization is checked before the output pointer. The host retains this initial disconnected state; native event draining, cached updates and service reconnection are unimplemented.
+- [sceSharePlayGetCurrentConnectionInfo](../../../core/libs/prx/libSceSharePlay/Export.cpp) - the 56-byte layout without account IDs is from [shadPS4's shareplay.h](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/share_play/shareplay.h); the checks and values copy `sceSharePlayGetCurrentConnectionInfoA`, while shadPS4 leaves both user IDs 0 and checks nothing. Not measured on a console.
 - [sceSharePlayProhibitController](../../../core/libs/prx/libSceSharePlay/Export.cpp) - the argument is one byte, forwarded unchanged to the service. The host checks initialization, accepts 0/1 without a visitor controller, and returns 0x810E0001 (SCE_SHARE_PLAY_ERROR_INVALID_ARGS) for other values; dynamic service communication and controller state remain unimplemented.
diff --git a/docs/dev/debt/libSceSpSysCallWrapper.md b/docs/dev/debt/libSceSpSysCallWrapper.md
index ea6d5fbf4e..1a664e18fd 100644
--- a/docs/dev/debt/libSceSpSysCallWrapper.md
+++ b/docs/dev/debt/libSceSpSysCallWrapper.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [sceSpGetPid, sceSpKernelGettimeofday, sceSpKernelNanosleep, sceSpNetConnect, sceSpNetEpollAbort, sceSpNetEpollControl, sceSpNetEpollCreate, sceSpNetEpollDestroy, sceSpNetEpollWait, sceSpNetErrnoLoc, sceSpNetPoolCreate, sceSpNetPoolDestroy, sceSpNetRecv, sceSpNetResolverAbort, sceSpNetResolverCreate, sceSpNetResolverDestroy, sceSpNetResolverGetError, sceSpNetResolverStartNtoa, sceSpNetSend, sceSpNetSetsockopt, sceSpNetSocket, sceSpNetSocketClose, sceSpPthreadAttrDestroy, sceSpPthreadAttrInit, sceSpPthreadAttrSetinheritsched, sceSpPthreadAttrSetschedparam, sceSpPthreadAttrSetstacksize, sceSpPthreadCondDestroy, sceSpPthreadCondInit, sceSpPthreadCondSignal, sceSpPthreadCondWait, sceSpPthreadCondattrDestroy, sceSpPthreadCondattrInit, sceSpPthreadCreate, sceSpPthreadDetach, sceSpPthreadExit, sceSpPthreadJoin, sceSpPthreadMutexDestroy, sceSpPthreadMutexInit, sceSpPthreadMutexLock, sceSpPthreadMutexUnlock, sceSpPthreadMutexattrDestroy, sceSpPthreadMutexattrInit, sceSpPthreadMutexattrSetprioceiling, sceSpPthreadMutexattrSetprotocol, sceSpPthreadMutexattrSettype, sceSpPthreadSetprio and sceSpSelect](../../../core/libs/prx/libSceSpSysCallWrapper/Export.cpp) (libSceSpSysCallWrapper) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSpSysCallWrapper.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceSpPthreadMutexattrSetprioceiling](../../../core/libs/prx/libSceSpSysCallWrapper/Export.cpp) (libSceSpSysCallWrapper) - still throws. In firmware 13.60's `libSceSpSysCallWrapper.sprx` it only jumps to libkernel's `scePthreadMutexattrSetprioceiling`, which AnyPS5 does not implement yet (read from disassembly, not measured on a console)
diff --git a/docs/dev/debt/libSceSsl.md b/docs/dev/debt/libSceSsl.md
index 20e9e19b1d..cbd359521e 100644
--- a/docs/dev/debt/libSceSsl.md
+++ b/docs/dev/debt/libSceSsl.md
@@ -2,13 +2,15 @@
 
 ### Unknown function info
 
-- [CA_MGMT_extractKeyBlobEx, CA_MGMT_extractPublicKeyInfo, CA_MGMT_freeKeyBlob, CRYPTO_initAsymmetricKey, CRYPTO_uninitAsymmetricKey, RSA_verifySignature, VLONG_freeVlongQueue, sceSslCheckRecvPending, sceSslCreateSslConnection and sceSslDeleteSslConnection](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - the list is the intersection of the export table of the console's libSceSsl (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); no credible prototypes were found. They are declared without parameters solely to resolve known imports, not as an ABI claim; callers must not call them until signatures are verified.
+- [CA_MGMT_extractKeyBlobEx, CA_MGMT_extractPublicKeyInfo, CA_MGMT_freeKeyBlob, CRYPTO_initAsymmetricKey, RSA_verifySignature, sceSslCheckRecvPending, sceSslCreateSslConnection and sceSslDeleteSslConnection](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - the list is the intersection of the export table of the console's libSceSsl (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); no credible prototypes were found. They are declared without parameters solely to resolve known imports, not as an ABI claim; callers must not call them until signatures are verified.
 - [sceSslDisableOption, sceSslDisableOptionInternal, sceSslDisableOptionInternalInsecure, sceSslEnableOption, sceSslEnableOptionInternal, sceSslGetNanoSSLModuleId, sceSslGetPeerCert, sceSslGetSslError, sceSslLoadRootCACert and sceSslSetSslVersion](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - the list is the intersection of the export table of the console's libSceSsl (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); no credible prototypes were found. They are declared without parameters solely to resolve known imports, not as an ABI claim; callers must not call them until signatures are verified.
 - [sceSslReuseConnection](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - its name and NID appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); its parameter shape follows [SharpProspero's pinned binding](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http.cs#L2231-L2235). No console observation or reliable implementation source for session reuse was found.
 
-- [sceSslCreateConnection, sceSslDeleteConnection, sceSslSetVerifyCallback, sceSslConnect, sceSslRead, sceSslWrite](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - imported by `ffmpeg.prx`. Signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/60977b29103452b9681ae10c7a9011d44965bf16/src/SharpProspero/Interop/Net/Http.cs#L195-L252), which also says the socket stays open after `sceSslDeleteConnection`. The behaviour below was measured on a PS5 on system software 13.40 with a ps5-payload-dev payload (every call printed with its return, a TLS 1.2 test server on the LAN presenting leaves issued by the test fixture root loaded with `sceSslLoadCert`, from an elfldr process rather than a title); what differs for a title process is unknown. An unknown context returns `SSL_ERROR_INVALID_ID` (0x8095F006) from `sceSslCreateConnection`, and every connection call on an unknown or deleted connection id or on a connection whose context was terminated returns `SSL_ERROR_INVALID_ID`. `sceSslCreateConnection` returns `SSL_ERROR_INVALID_VALUE` (0x8095F007) for a null host and does not check the socket: `sceSslConnect` on a descriptor that is not a socket returns `SCE_NET_ERROR_EBADF` (0x80410109). `sceSslConnect` runs a TLS 1.2 client handshake with Mbed TLS 3.6.7 over the host socket that the guest number maps to in the libkernel or libSceNet socket table, and `sceSslRead` and `sceSslWrite` carry application data over it. TLS 1.3 is compiled out: the console offers TLS 1.2 only (its ClientHello carries 12 suites and no supported_versions extension) and a TLS 1.3-only server gets `SSL_ERROR_FATAL_ALERT` (0x8095F010) from it, as from this build. Connection state is allocated from the context's pool and returned to it by `sceSslDeleteConnection`; a connection keeps the pool alive after `sceSslTerm`, whose connections return `SSL_ERROR_INVALID_ID` from then on. The console's pool use for one connection with a two-certificate chain peaked at 80,544 bytes in a 256 KiB pool (5,568 after `sceSslInit`, 12,000 after loading one CA); a 16 KiB pool fails the connect with `SSL_ERROR_OUT_OF_MEMORY` (0x809517D5) there and here. The server's chain is checked against the CAs loaded with `sceSslLoadCert`, the host name the connection was created with (case-insensitively; an IP literal sends no SNI and matches an IP subject alternative name; an empty host sends an empty SNI and fails `CN_CHECK`) and, when enabled, its validity dates, and `sceSslConnect` returns the first failure the connection's verify options select (the verify option entry below lists the bits, codes and initial options); no root bundle is shipped and the console's built-in roots are unknown, so with no CA loaded a connection with the initial options returns `SSL_ERROR_UNKNOWN_CA` (0x8095F00C), as on the console. A client certificate loaded with `sceSslLoadCert` is sent when the server asks for one. A failed verification is final: close_notify is sent, later `sceSslConnect` calls return the same code (also after the `WANT_POLLIN` rounds of a non-blocking socket), and `sceSslRead` and `sceSslWrite` throw, as the console's codes for them were not measured. With a verify callback set it is called once after the handshake, outside the connection's lock, with the context id, the bits of the enabled checks that failed (`KNOWN_CA_CHECK` 0x20, `CN_CHECK` 0x4, the date checks when enabled, 0 when the chain passed), handles to a copy of the peer chain as received (the leaf first, the root last when the server sent it) that the certificate readers of the connection's context accept until the connection is deleted (the handles stay registered in the context until it is terminated; the console frees them at the delete), the chain length and the user argument. A chain fault that no option names (`SSL_ERROR_INVALID_CERT` without a callback) throws when a callback is set, as the bits the console passes for it were not measured. A non-negative return accepts the connection whatever the bits were; a negative return fails the connect with `SSL_ERROR_APPLICATION_VERIFICATION_CALLBACK_CHECK` (0x8095F0FD) and the callback runs again, with the same chain, from every later `sceSslConnect`, `sceSslRead` and `sceSslWrite` of the connection, which return 0x8095F0FD while it keeps refusing and proceed once it accepts. A `sceSslConnect` from inside the callback, or from another thread while it runs, throws. `sceSslRead` and `sceSslWrite` before `sceSslConnect` run the handshake and verification themselves and return its code when it fails. A non-blocking socket that would block returns `SSL_ERROR_WANT_POLLIN` (0x8095F013) or `SSL_ERROR_WANT_POLLOUT` (0x8095F014) from `sceSslConnect`, `sceSslRead` and `sceSslWrite`; the next `sceSslConnect` resumes the handshake, and `sceSslWrite` returns the part it sent before blocking (the console returned 32 KiB of a 64 KiB write). A blocking libSceNet socket whose `SO_RCVTIMEO` expires returns `SSL_ERROR_WANT_POLLIN` as well, and the call can be repeated; `SSL_ERROR_READ_TIMEOUT` (0x80951710) is never returned. libkernel keeps its timeouts above the host socket, so they do not bound SSL reads and writes on a libkernel socket. `sceSslRead` with flags 0 reads until `len` bytes arrived or the stream ended and with flags 1 or 2 returns what the first record delivers. Native flags 3 peek without consuming data; values outside 0 through 3 return `SSL_ERROR_INVALID_VALUE` before connection lookup. A non-blocking read that got some bytes returns them. It returns 0 after the server's close_notify and after a transport that ends without one, every later read 0 again, and `SSL_ERROR_EOF` (0x8095177C) and `SSL_ERROR_SOCKET_CLOSED` (0x8095170D) never from a read. A reset (`ECONNRESET`, `EPIPE`, `WSAECONNRESET`, `WSAECONNABORTED`, `WSAENETRESET`) returns `SCE_NET_ERROR_ECONNRESET` (0x80410136) from `sceSslRead` and `SCE_NET_ERROR_EPIPE` (0x80410120) from `sceSslWrite`, on every later call too; a record that fails its MAC returns 0x80951D55 from `sceSslRead` after the fatal alert goes out. `sceSslWrite` accepts flags 0 only, `SSL_ERROR_INVALID_VALUE` otherwise, sends all of `len`, capped at `INT_MAX`, and returns the count; it keeps writing after the peer's close_notify or a stream that ended without one, as the console does. A fatal alert during the handshake returns `SSL_ERROR_FATAL_ALERT` and ends the transport: later `sceSslConnect` calls return 0, `sceSslRead` 0 and `sceSslWrite` `SSL_ERROR_SOCKET_CLOSED`, as measured. A transport that ends without close_notify or a reset during the handshake returns `SSL_ERROR_SOCKET_CLOSED`, the session is dropped and the next `sceSslConnect` starts over; those two handshake cases and `SSL_ERROR_INVALID_CERT` (0x8095F00A) for a verification failure no option names were not measured. Other handshake and socket failures, a read or write after a failed verification, a write after `sceSslClose`, a null buffer and a read or write from inside the callback throw, as their console codes are unknown. A connection serializes its reads and writes, so a read blocked in one thread holds back a write on the same connection from another. `sceSslDeleteConnection` sends no close_notify and returns `SSL_ERROR_INVALID_ID` when repeated. `sceSslTerm` leaves the context's connections to `sceSslDeleteConnection`, which then returns `SSL_ERROR_INVALID_ID`; a second `sceSslTerm` returns `SSL_ERROR_INVALID_ID` and `sceSslInit` with a pool size of 0 returns `SCE_KERNEL_ERROR_EINVAL` (0x80020016). `sceSslSetVerifyCallback` accepts any callback, null included, and returns 0. The console's first `sceSslConnect` in a process took 23.8 s before its ClientHello left, a one-time initialisation not emulated. `SSL_ERROR_BEFORE_INIT` (0x8095F001) is never returned, as the library keeps no state apart from its contexts
+- [sceSslCreateConnection, sceSslDeleteConnection, sceSslSetVerifyCallback, sceSslConnect, sceSslRead, sceSslWrite](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - imported by `ffmpeg.prx`. Signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/60977b29103452b9681ae10c7a9011d44965bf16/src/SharpProspero/Interop/Net/Http.cs#L195-L252), which also says the socket stays open after `sceSslDeleteConnection`. The behaviour below was measured on a PS5 on system software 13.40 with a ps5-payload-dev payload (every call printed with its return, a TLS 1.2 test server on the LAN presenting leaves issued by the test fixture root loaded with `sceSslLoadCert`, from an elfldr process rather than a title); what differs for a title process is unknown. An unknown context returns `SSL_ERROR_INVALID_ID` (0x8095F006) from `sceSslCreateConnection`, and every connection call on an unknown or deleted connection id or on a connection whose context was terminated returns `SSL_ERROR_INVALID_ID`. `sceSslCreateConnection` returns `SSL_ERROR_INVALID_VALUE` (0x8095F007) for a null host and does not check the socket: `sceSslConnect` on a descriptor that is not a socket returns `SCE_NET_ERROR_EBADF` (0x80410109). `sceSslConnect` runs a TLS 1.2 client handshake with Mbed TLS 3.6.7 over the host socket that the guest number maps to in the libkernel or libSceNet socket table, and `sceSslRead` and `sceSslWrite` carry application data over it. TLS 1.3 is compiled out: the console offers TLS 1.2 only (its ClientHello carries 12 suites and no supported_versions extension) and a TLS 1.3-only server gets `SSL_ERROR_FATAL_ALERT` (0x8095F010) from it, as from this build. Connection state is allocated from the context's pool and returned to it by `sceSslDeleteConnection`. The console's pool use for one connection with a two-certificate chain peaked at 80,544 bytes in a 256 KiB pool (5,568 after `sceSslInit`, 12,000 after loading one CA); a 16 KiB pool fails the connect with `SSL_ERROR_OUT_OF_MEMORY` (0x809517D5) there and here. The server's chain is checked against the CAs loaded with `sceSslLoadCert`, the host name the connection was created with (case-insensitively; an IP literal sends no SNI and matches an IP subject alternative name; an empty host sends an empty SNI and fails `CN_CHECK`) and, when enabled, its validity dates, and `sceSslConnect` returns the first failure the connection's verify options select (the verify option entry below lists the bits, codes and initial options); no root bundle is shipped and the console's built-in roots are unknown, so with no CA loaded a connection with the initial options returns `SSL_ERROR_UNKNOWN_CA` (0x8095F00C), as on the console. A client certificate loaded with `sceSslLoadCert` is sent when the server asks for one. A failed verification is final: close_notify is sent, later `sceSslConnect` calls return the same code (also after the `WANT_POLLIN` rounds of a non-blocking socket), and `sceSslRead` and `sceSslWrite` throw, as the console's codes for them were not measured. With a verify callback set it is called once after the handshake, outside the connection's lock, with the context id, the bits of the enabled checks that failed (`KNOWN_CA_CHECK` 0x20, `CN_CHECK` 0x4, the date checks when enabled, 0 when the chain passed), handles to a copy of the peer chain as received (the leaf first, the root last when the server sent it) that the certificate readers of the connection's context accept until the connection is deleted (the handles stay registered in the context until it is terminated; the console frees them at the delete), the chain length and the user argument. A chain fault that no option names (`SSL_ERROR_INVALID_CERT` without a callback) throws when a callback is set, as the bits the console passes for it were not measured. A non-negative return accepts the connection whatever the bits were; a negative return fails the connect with `SSL_ERROR_APPLICATION_VERIFICATION_CALLBACK_CHECK` (0x8095F0FD) and the callback runs again, with the same chain, from every later `sceSslConnect`, `sceSslRead` and `sceSslWrite` of the connection, which return 0x8095F0FD while it keeps refusing and proceed once it accepts. A `sceSslConnect` from inside the callback, or from another thread while it runs, throws. `sceSslRead` and `sceSslWrite` before `sceSslConnect` run the handshake and verification themselves and return its code when it fails. A non-blocking socket that would block returns `SSL_ERROR_WANT_POLLIN` (0x8095F013) or `SSL_ERROR_WANT_POLLOUT` (0x8095F014) from `sceSslConnect`, `sceSslRead` and `sceSslWrite`; the next `sceSslConnect` resumes the handshake, and `sceSslWrite` returns the part it sent before blocking (the console returned 32 KiB of a 64 KiB write). A blocking libSceNet socket whose `SO_RCVTIMEO` expires returns `SSL_ERROR_WANT_POLLIN` as well, and the call can be repeated; `SSL_ERROR_READ_TIMEOUT` (0x80951710) is never returned. libkernel keeps its timeouts above the host socket, so they do not bound SSL reads and writes on a libkernel socket. `sceSslRead` with flags 0 reads until `len` bytes arrived or the stream ended and with flags 1 or 2 returns what the first record delivers. Native flags 3 peek without consuming data; values outside 0 through 3 return `SSL_ERROR_INVALID_VALUE` before connection lookup. A non-blocking read that got some bytes returns them. It returns 0 after the server's close_notify and after a transport that ends without one, every later read 0 again, and `SSL_ERROR_EOF` (0x8095177C) and `SSL_ERROR_SOCKET_CLOSED` (0x8095170D) never from a read. A reset (`ECONNRESET`, `EPIPE`, `WSAECONNRESET`, `WSAECONNABORTED`, `WSAENETRESET`) returns `SCE_NET_ERROR_ECONNRESET` (0x80410136) from `sceSslRead` and `SCE_NET_ERROR_EPIPE` (0x80410120) from `sceSslWrite`, on every later call too; a record that fails its MAC returns 0x80951D55 from `sceSslRead` after the fatal alert goes out. `sceSslWrite` accepts flags 0 only, `SSL_ERROR_INVALID_VALUE` otherwise, sends all of `len`, capped at `INT_MAX`, and returns the count; it keeps writing after the peer's close_notify or a stream that ended without one, as the console does. A fatal alert during the handshake returns `SSL_ERROR_FATAL_ALERT` and ends the transport: later `sceSslConnect` calls return 0, `sceSslRead` 0 and `sceSslWrite` `SSL_ERROR_SOCKET_CLOSED`, as measured. A transport that ends without close_notify or a reset during the handshake returns `SSL_ERROR_SOCKET_CLOSED`, the session is dropped and the next `sceSslConnect` starts over; those two handshake cases and `SSL_ERROR_INVALID_CERT` (0x8095F00A) for a verification failure no option names were not measured. Other handshake and socket failures, a read or write after a failed verification, a write after `sceSslClose`, a null buffer and a read or write from inside the callback throw, as their console codes are unknown. A connection serializes its reads and writes, so a read blocked in one thread holds back a write on the same connection from another. `sceSslDeleteConnection` sends no close_notify and returns `SSL_ERROR_INVALID_ID` when repeated. A second `sceSslTerm` returns `SSL_ERROR_INVALID_ID` and `sceSslInit` with a pool size of 0 returns `SCE_KERNEL_ERROR_EINVAL` (0x80020016). `sceSslSetVerifyCallback` accepts any callback, null included, and returns 0. The console's first `sceSslConnect` in a process took 23.8 s before its ClientHello left, a one-time initialisation not emulated. `SSL_ERROR_BEFORE_INIT` (0x8095F001) is never returned, as the library keeps no state apart from its contexts
 - [sceSslClose](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - takes the connection id, as in [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/60977b29103452b9681ae10c7a9011d44965bf16/src/SharpProspero/Interop/Net/Http.cs#L195-L252). Measured on 13.40 as the connection entry describes: it sends close_notify once if the handshake completed and returns 0, 0 again when repeated and 0 on a connection that never connected, already failed verification or lost its transport to a fatal alert; a close before the handshake changes nothing, so the connection can still connect. After the close `sceSslConnect` returns 0 and `sceSslRead` 0, as on the console; `sceSslWrite` after it throws, as the console's code was not measured. A close_notify that a non-blocking socket cannot take at once returns `SSL_ERROR_WANT_POLLOUT` (0x8095F014) and the close can be repeated; after a reset it returns `SCE_NET_ERROR_ECONNRESET` (0x80410136) every time. The socket is left to the title; an unknown connection returns `SSL_ERROR_INVALID_ID` (0x8095F006). Whether the console closes the socket is unknown
 - [Certificate readers](../../../core/libs/prx/libSceSsl/Export.cpp): foreign and expired certificate/name handles throw instead of following native unchecked pointers. Name views track certificate lifetime and preserve identity; the native no-op name release is implemented. View storage remains allocated until context destruction. Numeric names for attributes Mbed TLS cannot identify may differ from native names. Fingerprint stack-space validation and backend digest failures are not reproduced. Signatures, valid-context/null-argument precedence, serial truncation, name copy bounds, validity timestamps and supported hash selectors are confirmed by the supplied module.
 - [sceSslLoadCert, sceSslGetCaList, sceSslFreeCaList, sceSslGetCaCerts, sceSslFreeCaCerts, sceSslUnloadCert](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - signatures and layouts follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http.cs). PPSA15508/01.002.000 calls `sceSslLoadCert` with one 1,408-byte PEM CA and null client certificate/key arguments; this confirms that call shape, not console error behavior. Mbed TLS parses DER/PEM chains. CA imports still commit together instead of preserving successful entries before a later failure. Client certificate replacement clears the previous identity; raw private keys load independently and are parsed when configuring TLS. Partial client chains on decode failure, native key parse errors and incomplete identities during TLS setup remain unsupported. CA queries return independently owned snapshots; unload clears active credentials while outstanding snapshots remain valid. Appending repeated CA imports, snapshot lifetime across unload, memory overhead and error precedence have not been measured on a PS5. Invalid loads, malformed material, exhausted pools and unsupported keys throw rather than inventing console error codes. Native CA queries include built-in roots; the host still queries loaded authorities and returns `NOT_FOUND` for an empty context. No native root bundle is copied. Null-output and invalid-context precedence, output preservation on invalid contexts and the SDK 7.50 unload error boundary are recovered. Legacy clearing of foreign raw CA lists remains unchanged. Certificate reader queries reflect active certificates or outstanding snapshots. Loading credentials does not start a TLS connection; `sceSslConnect` verifies the server against the loaded CAs and offers the loaded client certificate
 - [sceSslEnableVerifyOption, sceSslDisableVerifyOption, sceSslSetMinSslVersion, sceSslSetAlpn, sceSslGetAlpnSelected](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/60977b29103452b9681ae10c7a9011d44965bf16/src/SharpProspero/Interop/Net/Http.cs), the source of the other connection signatures; the behaviour was measured on a PS5 on system software 13.40 with a ps5-payload-dev payload (every call printed with its return, a TLS 1.2 test server on the LAN presenting leaves issued by the test fixture root loaded with `sceSslLoadCert`, from an elfldr process rather than a title). The verify options select which verification failures `sceSslConnect` reports (see the connection entry above), with the bit values SharpProspero's `SceSslVerifyOption` gives: `SERVER_VERIFY` 0x1, `CN_CHECK` 0x4, `NOT_AFTER_CHECK` 0x8, `NOT_BEFORE_CHECK` 0x10, `KNOWN_CA_CHECK` 0x20. The initial options are `SERVER_VERIFY`, `CN_CHECK` and `KNOWN_CA_CHECK` (0x25): the console accepted an expired and a not-yet-valid server certificate until 0x8 or 0x10 was enabled, which then returned `SSL_ERROR_NOT_AFTER_CHECK` (0x8095F00D) and `SSL_ERROR_NOT_BEFORE_CHECK` (0x8095F00E); whether 0x2 (`CLIENT_VERIFY`) starts enabled was not determined and it is kept off. A check that is disabled is not reported, whatever the chain. Bits outside 0x3F return `SSL_ERROR_INVALID_VALUE` (0x8095F007) from both calls. Disabling 0x1, 0x4 or 0x20 from the payload stopped its process through the kernel's debug exception path (`mDBG: Sending signal ... signo: 0xa0020101`, 6 of 6 attempts; disabling 0x2, 0x8 and 0x10 returned 0), so whether a title may clear them is unknown; this build clears them, as titles import the call. `sceSslSetMinSslVersion` accepts the `SceSslVersion` values 2 (SSL 3.0) to 5 (TLS 1.2) and returns `SSL_ERROR_INVALID_VALUE` for 0, 1 and anything above 5; the console has no TLS 1.3 value. Every accepted value gives the same handshake, as Mbed TLS 3 speaks TLS 1.2 and nothing older and TLS 1.3 is compiled out, which matches the console offering TLS 1.2 only. `sceSslSetAlpn` stores the string up to its terminator, split on commas into the protocols offered in the handshake (the console sent `h2,http/1.1` as the two names and a wire-format string as one name), a second call replaces the list, an empty string returns `SSL_ERROR_BAD_LENGTH` (0x80951773), and a null list clears the configured protocols. Native inspection confirms that replacement clears the old list even on failure, that each comma-separated name must contain 1-255 bytes and that the whole string must be shorter than 65535 bytes. `sceSslGetAlpnSelected` returns the protocol the server selected, still after `sceSslClose`, or null before the handshake and when none was selected; the pointer is owned by the connection. An unknown connection and a connection whose context was terminated return `SSL_ERROR_INVALID_ID` (0x8095F006) from the four setters and null from `sceSslGetAlpnSelected`, as confirmed by the supplied native module
 - [sceSslGetPem](../../../core/libs/prx/libSceSsl/Export.cpp): native argument validation, CRLF line endings, 64-character Base64 lines, NUL-inclusive length and buffer clearing on insufficient capacity are recovered. Foreign and expired certificate handles throw instead of performing native unchecked pointer access. DER reserialization differences for noncanonical certificates remain unverified.
+
+- This pending declaration has an unverified signature and behavior; it is a parameterless import-resolution declaration and throws through `NotImplemented_nid_no_patch`: [`sceSslSetServerName`](../../../core/libs/prx/libSceSsl/Export.cpp).
diff --git a/docs/dev/debt/libSceSulphaDrv.md b/docs/dev/debt/libSceSulphaDrv.md
index 88b6f9091f..990eaa1951 100644
--- a/docs/dev/debt/libSceSulphaDrv.md
+++ b/docs/dev/debt/libSceSulphaDrv.md
@@ -1,5 +1,5 @@
 # libSceSulphaDrv technical debt
 
-### Inventory exports declared elsewhere
+### Unknown function info
 
-sceSulphaGetClientInfo, sceSulphaGetConnectedClientCount, sceSulphaGetDefaultConfig, sceSulphaGetNeededMemory, sceSulphaInit, sceSulphaMessage, sceSulphaSetBookmark and sceSulphaShutdown are the complete PS5 3.20 export table of this module per the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSulphaDrv.c), but all eight are currently declared by #7416 in libSceSulpha, so this module keeps its `APS5_DUMMY_FUN` skeleton to respect the duplicate-export rule. Declare them here (with no parameters, matching the `1b5004d77` unknown-prototype shape) if that PR's module attribution is rejected.
+- [libSceSulphaDrv](../../../core/libs/prx/libSceSulphaDrv/Export.cpp) - signatures and behavior remain unknown for `sceSulphaGetClientInfo`, `sceSulphaGetConnectedClientCount`, `sceSulphaGetNeededMemory`, `sceSulphaInit`, `sceSulphaMessage`, `sceSulphaSetBookmark` and `sceSulphaShutdown`. Their no-parameter declarations resolve imports and throw through `NotImplemented_nid_no_patch`; they make no ABI claim.
diff --git a/docs/dev/debt/libSceSysCore.md b/docs/dev/debt/libSceSysCore.md
index 969d61b1fe..386b64d98d 100644
--- a/docs/dev/debt/libSceSysCore.md
+++ b/docs/dev/debt/libSceSysCore.md
@@ -3,3 +3,15 @@
 ### Unknown function info
 
 - [sceApplicationGetAppInfoByAppId](../../../core/libs/prx/libSceSysCore/Export.cpp) takes a 32-bit application ID and a writable 152-byte record. The service fills the record through IPC; its complete field layout remains unresolved. The SystemService caller consumes a subrecord beginning at byte 48.
+
+- [_sceApplicationGetAppId, sceApplicationAddProcess2, sceApplicationBeginSclkChange, sceApplicationBlockingKill2, sceApplicationBlockingKill3, sceApplicationContinue, sceApplicationCrashSyscore, sceApplicationCrashSystemProcess](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationEndSclkChange, sceApplicationExitSpawn, sceApplicationExitSpawn2, sceApplicationFinalize, sceApplicationGetAppPackageInfoForCoredump, sceApplicationGetCompiledSdkVersionByAppId and sceApplicationGetCoredumpDirAndFileName](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationGetCoredumpState, sceApplicationGetCpuUsage, sceApplicationGetCpuUsage2, sceApplicationGetDbgExecutablePath, sceApplicationGetMode, sceApplicationGetProcs and sceApplicationGetShellCoreAppId](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationGetStateForDebugger, sceApplicationInitialize, sceApplicationInitializeForShellCore, sceApplicationIsCrashReportBeingProcessed, sceApplicationIsPrimaryProcess, sceApplicationIsResumable and sceApplicationIsSuspendable](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationKickCoredump, sceApplicationKickCoredump2, sceApplicationKill, sceApplicationLocalProcessKill, sceApplicationLocalProcessKill2, sceApplicationLocalProcessResume and sceApplicationLocalProcessSuspend](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationNotifyCoredumpRequestEnd, sceApplicationNotifyCoredumpRequestProgress, sceApplicationNotifyVshMainOnStandby, sceApplicationNotifyVshReady, sceApplicationOnAllResourceReleased and sceApplicationRaiseException](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationRaiseExceptionToLocalPid, sceApplicationRaiseExceptionToPid, sceApplicationRequestToChangeRenderingMode, sceApplicationRestore, sceApplicationResume, sceApplicationSave and sceApplicationSendDebugSpawnResult2](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSendResultOfDebuggerKillRequest, sceApplicationSendResultOfDebuggerResumeRequest, sceApplicationSendResultOfDebuggerSuspendRequest, sceApplicationSendResultOfDebuggerTitleIdLaunchRequest and sceApplicationSetApplicationFocus](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSetControllerFocus, sceApplicationSetControllerFocusPermissionToSubProcess, sceApplicationSetMemoryPstate, sceApplicationSignalShellCoreHeartBeat, sceApplicationSpawn2 and sceApplicationSuspend](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSuspendSystemForDebugger, sceApplicationSwitchToBaseMode, sceApplicationSwitchToNeoMode, sceApplicationSwitchToNeoMode2, sceApplicationSystemReboot and sceApplicationSystemShutdown2](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSystemSuspend, sceApplicationSystemSuspend2, sceApplictionGetStateForDebugger, sceSysCoreGetEventCount and sceSysCoreReceiveEvent](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
diff --git a/docs/dev/debt/libSceSysmodule.md b/docs/dev/debt/libSceSysmodule.md
index 6105002234..7049c717ee 100644
--- a/docs/dev/debt/libSceSysmodule.md
+++ b/docs/dev/debt/libSceSysmodule.md
@@ -2,7 +2,7 @@
 
 ### Silent stubs
 
-- [sceSysmoduleIsLoaded, sceSysmoduleLoadModule, sceSysmoduleUnloadModule](../../../core/libs/prx/libSceSysmodule/Export.cpp) (libSceSysmodule) accept the 141 ids `sceSysmoduleIsLoaded` did not reject in a payload process on a PS5 (firmware 13.60) and return `0x805A1000` for every other id, as the console does; that includes 51 ids the module table names from older firmware, such as 0x0001 (`libSceAudioOut`) and 0x0080 (`libSceJson`). Load and unload are counted as measured. The 21 accepted ids the table does not name (0x0111, 0x0117, 0x011c to 0x011f, 0x0121 to 0x0124, 0x0129, 0x012c to 0x012e, 0x0133, 0x0134, 0x0136 and 0x013a to 0x013d) are logged and return 0 without loading anything, so `sceSysmoduleIsLoaded` reports them as loaded; which module each loads is not known. Loading id 0x00ff ended the payload process, so that id was not measured further
+- [sceSysmoduleIsLoaded, sceSysmoduleLoadModule, sceSysmoduleUnloadModule](../../../core/libs/prx/libSceSysmodule/Export.cpp) (libSceSysmodule) accept the 141 ids `sceSysmoduleIsLoaded` did not reject in a payload process on a PS5 (firmware 13.60) and return `0x805A1000` for every other id, as the console does; that includes 51 ids the module table names from older firmware, such as 0x0001 (`libSceAudioOut`) and 0x0080 (`libSceJson`). Load and unload are counted as measured. The 21 accepted ids the table does not name (0x0111, 0x0117, 0x011c to 0x011f, 0x0121 to 0x0124, 0x0129, 0x012c to 0x012e, 0x0133, 0x0134, 0x0136 and 0x013a to 0x013d) are logged and return 0 without loading anything, so `sceSysmoduleIsLoaded` reports them as loaded; which module each loads is not known. Loading id 0x00ff ended the payload process. One title (PPSA04354) calls `sceSysmoduleIsLoaded` with id 0x96 at twelve sites and loads it only when the result is 0x805a1001; any other result lets it continue.
 
 ### Unknown function info
 
diff --git a/docs/dev/debt/libSceSystemService.md b/docs/dev/debt/libSceSystemService.md
index c11d910836..40dfa92cfa 100644
--- a/docs/dev/debt/libSceSystemService.md
+++ b/docs/dev/debt/libSceSystemService.md
@@ -14,6 +14,7 @@
 ### Unknown function info
 
 - [sceSystemServiceAddLocalProcessForPsmKit, sceSystemServiceKillLocalProcessForPsmKit](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - AnyPS5 runs one process and starts or stops no other, so both throw without reading their arguments. The parameters follow Forever Launcher's own firmware 5.50 probes (`ps5/probes/localproc` in [bizkut/ps5-forever](https://github.com/bizkut/ps5-forever)): a path, a null-terminated argv and a 0x90-byte parameter block in, a handle out; the kill takes that handle. Their results on the console are unknown. Forever Launcher (PPSA99030) imports both and stops at load without them.
+- [sceSystemServiceGetAppId, sceSystemServiceGetAppTitleId, sceLncUtilGetAppTitleId](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - the console's results for a title ID or app ID other than the running title are unknown, and so are its errors for null pointers, so those calls throw. `sceSystemServiceGetAppId` compares the title ID exactly with the one in `param.json` or `param.sfo`. The title ID buffer is 10 bytes, so a running title ID of 10 or more characters throws too. The signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/SystemService/SystemService.cs#L236-L260), except that `sceLncUtilGetAppTitleId` returns an `int`, as declared in the pending exports, and 0 on success like `sceSystemServiceGetAppTitleId`; SharpProspero names `ErrorNoAppInfo` (0x80A10009) only for `sceSystemServiceGetAppFocusedAppStatus`.
 - [sceSystemServiceLaunchApp](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - AnyPS5 runs one title and cannot start another, so every call throws without reading its arguments. The (title ID, null-terminated argv, launch parameters) signature follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/SystemService/SystemService.cs#L141-L148), whose `AppLauncher` Prospero Explorer (PPSA99109) and Prospero Multi Tools (PPSA99110) import it through and which passes a 0x20-byte launch context or null; the console's argument checks and errors are unknown
 - [sceSystemServiceLaunchWebBrowser](../../../core/libs/prx/libSceSystemService/Export.cpp): the native export takes one URI argument. Null input, the 6015-byte length limit and supported scheme checks are recovered. The host still returns kernel `EOPNOTSUPP` for valid input; a missing browser service's native error is unresolved.
 - [sceSystemServiceParamGetString](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - the system name (parameter 6) is the fixed `PS5`, not the console's name. As in a payload process on a PS5 (firmware 13.60), the name is written NUL-padded to the whole buffer, and a buffer under 65 bytes, a null buffer or any other parameter returns `SYSTEM_SERVICE_ERROR_PARAMETER` without writing. Parameters 0 to 40, 100 to 110, 1000 to 1010, -1 and `INT_MAX` were tried there; the others are assumed to fail the same way. PPSA26344 at `0xA87935` passes parameter 6 with a 65-byte buffer
diff --git a/docs/dev/debt/libSceUlt.md b/docs/dev/debt/libSceUlt.md
index d539ce9772..c9e0118fab 100644
--- a/docs/dev/debt/libSceUlt.md
+++ b/docs/dev/debt/libSceUlt.md
@@ -7,10 +7,13 @@
 - [libSceUlt ulthreads](../../../core/libs/prx/libSceUlt/Export.cpp) - Runtime option defaults still omit the native header, stack size, worker affinity and priority fields; affinity depends on unresolved process configuration queries. Concurrent join ownership is not modeled: the native runtime distinguishes an ordinary running thread from one with another joiner. Host threads do not use the guest context or worker scheduler.
 - [libSceUlt queues](../../../core/libs/prx/libSceUlt/Export.cpp) - Queue-data pool destruction and shared slot limits still require comparison with the native node allocator.
 - [`sceUltConditionVariableCreate` and `sceUltConditionVariableOptParamInitialize`](../../../core/libs/prx/libSceUlt/Export.cpp) (libSceUlt) are absent from the console export list, where only the underscored variants `_sceUltConditionVariableCreate` and `_sceUltConditionVariableOptParamInitialize` appear; their non-underscored signatures are assumed. Condition variable option parameter initialization only zeroes 128 bytes, and its layout without the common header remains unverified on hardware.
+- [Status query exports](../../../core/libs/prx/libSceUlt/Export.cpp) lack waiter identities, types and wait values. All five synchronization queries throw before writing output when capacity is nonzero and waiters exist; capacity-zero queries still report counts. `sceUltGetUlthreadRuntimeInfo` throws for a non-empty worker array because no worker threads are started. Recovered layouts, waiting records, worker scheduling and priority accounting lack full console validation.
+- [Mutex and reader-writer status queries](../../../core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp) throw for held recursive mutexes and ulthread-owned mutexes or write locks: recursive counts and ulthread owner encoding remain unverified. [Firmware 13.42 observations](https://github.com/boykopovar/AnyPS5/pull/9975#issuecomment-6417685562), from native x86-64 module runs with stubbed imports rather than PS5 hardware, supply `lockType` 1/2/0 for read/write/free, pthread `owner` from the thread block's first 8 bytes, `ownerType` 1 and default mutex `lockCount` 0 when held once. Both queries reject any supplied waiting record whose `size` is not 64 with `ULT_ERROR_INVALID` before writing output, as observed without waiters. Validation precedence and record-size checks for the other queries remain unverified.
 - [Ult factory and creation exports](../../../core/libs/prx/libSceUlt/Export.cpp) without a leading underscore are absent from the supplied module; their signatures remain unresolved. Diagnostic signatures and synchronization argument lists are recovered.
 
 - [sceUltMutexTryLock, the reader-writer lock and sceUltUlthreadGetSelf, sceUltUlthreadYield and sceUltUlthreadExit](../../../core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp) (libSceUlt) - the signatures follow the PS Vita libult in [RPCS3](https://github.com/RPCS3/rpcs3/blob/13aa88c3c4d66ea8799e987f7d762d90943ab17b/rpcs3/Emu/PSP2/Modules/sceUlt.cpp) (a 256-byte lock and 128-byte option structures), not a PS5 binary. The rules are assumed: readers may take the lock while a writer waits, a thread that holds the write lock gets `ULT_ERROR_STATE` for any further lock instead of waiting on itself, a reader asking for the write lock waits on its own read lock, and the try forms return `ULT_ERROR_BUSY`. Outside an ulthread, `sceUltUlthreadGetSelf`, `sceUltUlthreadYield` and `sceUltUlthreadExit` return `ULT_ERROR_STATE`; inside one they act on the guest thread it runs on, since ulthreads are not scheduled cooperatively here
 ### Functional
 
+- [sceUltFinalize](../../../core/libs/prx/libSceUlt/Export.cpp) - allocator-failure behavior is unverified on a PS5. The host may throw `std::bad_alloc` while reserving temporary wake lists; guest waiting-pool exhaustion and native finalization errors are not modeled.
 - [libSceUlt queues](../../../core/libs/prx/libSceUlt/Export.cpp) use preallocated host storage instead of the supplied guest work area; the guest object layouts remain incomplete. Waiting-queue pool thread limits and waiter priority ordering are not implemented. Finalization wakes blocked queue callers with `ULT_ERROR_STATE`.
 - [sceUltWaitingQueueResourcePoolDestroy](../../../core/libs/prx/libSceUlt/Export.cpp) refuses with `ULT_ERROR_STATE` only when a thread is currently waiting on a pool-backed mutex, semaphore or queue, matching the PS5 libSceUlt disassembly (0x473a in or55417wcDk); bound but idle objects do not block pool destruction. Waiting-queue pool guest work area node accounting is not implemented.
diff --git a/docs/dev/debt/libSceUsbStorage.md b/docs/dev/debt/libSceUsbStorage.md
index e1bc7fc86b..c901faca35 100644
--- a/docs/dev/debt/libSceUsbStorage.md
+++ b/docs/dev/debt/libSceUsbStorage.md
@@ -1,6 +1,19 @@
 # libSceUsbStorage technical debt
 
+### Silent stubs
+
+- [sceUsbStorageInit, sceUsbStorageTerm](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - no USB mass-storage device is ever attached, so there is nothing to initialize or tear down: both accept every call and keep no state, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L91-L99) does with its plain ORBIS_OK returns. A passthrough that lists devices must build its list in `Init` and free it in `Term`.
+
 ### Unknown function info
 
+- [sceUsbStorageRegisterCallback, sceUsbStorageUnregisterCallback, sceUsbStorageRegisterCallbackForMapAvailable, sceUsbStorageUnregisterCallbackForMapAvailable, sceUsbStorageRegisterCallbackForMapUnavailable, sceUsbStorageUnregisterCallbackForMapUnavailable](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - what a successful registration stores, what unregistering a never-registered callback answers, and when any callback fires is unverified: no device is ever attached, and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L110-L174) logs all six as `(STUBBED)` and returns 0 without storing anything, the success-without-a-reference pattern #6288 was closed for. The argument validation is implemented (0x80f40002 for a null callback, an event type outside 1 and 2, or a null directory); past it they keep the marker until a reference or a measurement says what success does.
+- [sceUsbStorageRequestUnmap, sceUsbStorageGetdentsClose](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - what the console answers for a directory that was never mapped and a getdents descriptor that was never opened is unknown: nothing can be mapped or opened in this model, shadPS4's [unmap](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L281-L288) only logs without keeping state and its [close](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L378-L383) succeeds only because `erase` ignores a missing key, and the no-device libraries throw on this path (`sceMoveClose` for a handle that was never opened, `sceContentSearchCloseMetadata` because no metadata id is ever handed out). Both keep the marker after their argument validation.
 - [sceUsbStorageClearFakeWriteProtection, sceUsbStorageSetFakeMapLockForDebug, sceUsbStorageSetFakeWriteProtection](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceUsbStorage.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
-- [sceUsbStorageRequestMapWSB](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - its prototype follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L245-L246), not measured on a console; the throwing declaration only resolves imports.
+- [sceUsbStorageGetMountPointOfShellCore](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the prototype is known, but no reference says what a console without a mapped device writes into the mount-point buffer or returns; it keeps the marker until a reference or a console measurement answers it.
+
+### Functional
+
+- [the argument validation](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the null-pointer, null-callback, event-type and null-directory refusals with 0x80f40002, and the getdents read of a never-opened descriptor answering 0x80f40005 with zero bytes, follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L176-L383); the validation runs before the markers the register, unregister, unmap and getdents-close exports keep above. None of this is measured on a console.
+- [the no-device answers](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - AnyPS5 has no USB mass-storage passthrough, so no device is ever attached: the device list is empty, `sceUsbStorageIsExist` succeeds and reports non-existence for every device id and directory, and the device-info query and the map and getdents-open requests answer 0x80f40004 for every device id. A passthrough that lists devices follows shadPS4's virtual-device model at the same commit for the filled paths, including its packed dirent.
+- [the device-info record](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the 0x338-byte record a passthrough fills for `sceUsbStorageGetDeviceInfo` is unverified on hardware; its layout follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Platform/UsbStorage.cs#L34-L45), which recovered it from the module's own export and was checked against #6288's "volume size at 0x0": the u64 volume size at offset 0, the vendor, product and serial strings at 0x16, 0x120 and 0x228, and the flags field the service masks with 0xd0 at 0x330. shadPS4's record starts with a u32 device id at offset 0; filling it that way puts a device id where a title reads the volume size.
+- [the prototypes of sceUsbStorageRequestMap and sceUsbStorageGetDeviceList](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the signatures follow the ABI restored on `main` (the firmware-database sweep of 2026-10-21), which matches [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L176-L383): `RequestMap`'s six parameters, the typed `UsbStorageCallback` of the register/unregister family, `IsExist`'s three-argument bool form and `GetDeviceList`'s `std::int32_t*` count (the count also follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Platform/UsbStorage.cs#L233-L235), whose earlier eight-parameter `RequestMap` reading carried the trailing reserved pair the restored ABI drops).
diff --git a/docs/dev/debt/libSceUsbd.md b/docs/dev/debt/libSceUsbd.md
index f23c18fd72..e7e535f68b 100644
--- a/docs/dev/debt/libSceUsbd.md
+++ b/docs/dev/debt/libSceUsbd.md
@@ -6,4 +6,10 @@
 
 ### Unknown function info
 
-- [sceUsbdClearHalt, sceUsbdDetachKernelDriver, sceUsbdEventHandlerActive, sceUsbdGetConfigDescriptorByValue, sceUsbdGetConfiguration, sceUsbdGetDescriptor, sceUsbdGetDevice, sceUsbdGetDeviceSpeed, sceUsbdGetMaxIsoPacketSize, sceUsbdGetMaxPacketSize, sceUsbdGetStringDescriptorAscii, sceUsbdHandleEvents, sceUsbdHandleEventsLocked, sceUsbdLockEventWaiters, sceUsbdLockEvents, sceUsbdOpenDeviceWithVidPid, sceUsbdSetInterfaceAltSetting, sceUsbdTryLockEvents, sceUsbdUnlockEventWaiters, sceUsbdUnlockEvents, sceUsbdWaitForEvent](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - signatures follow the console type database in [orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json#L2268-L2322), but their behavior is unknown and each call throws; not measured on a console
+- [sceUsbdEventHandlerActive, sceUsbdHandleEvents, sceUsbdHandleEventsLocked, sceUsbdLockEventWaiters, sceUsbdLockEvents, sceUsbdTryLockEvents, sceUsbdUnlockEventWaiters, sceUsbdUnlockEvents, sceUsbdWaitForEvent](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - signatures follow the console type database in [orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json#L2268-L2322), but their behavior is unknown and each call throws; not measured on a console
+
+### Functional
+
+- [sceUsbdGetConfiguration, sceUsbdGetConfigDescriptorByValue, sceUsbdGetDescriptor, sceUsbdGetStringDescriptorAscii](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - not measured on a console; they follow FreeBSD 11.4 ([libusb10_desc.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libusb/libusb10_desc.c), [libusb20.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libusb/libusb20.c)). The configuration and descriptor queries return host libusb errors. `sceUsbdGetStringDescriptorAscii` rebuilds `libusb20_dev_req_string_simple_sync` with only its 255-byte read: libusb's Windows HID backend reports the requested length as `bLength`, cutting a 4-byte header read to one character. Unlike the host `libusb_get_string_descriptor_ascii` it accepts index 0, drops non-printable characters and `<>` instead of writing `?`, and fails with `0x802400FF`. Closes when: measured on a PS5
+- [sceUsbdGetDevice, sceUsbdGetDeviceSpeed, sceUsbdGetMaxPacketSize, sceUsbdGetMaxIsoPacketSize, sceUsbdOpenDeviceWithVidPid](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - not measured on a console; they follow FreeBSD 11.4 [libusb10.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libusb/libusb10.c) over the host libusb. The packet sizes are searched in the active configuration and the iso size is scaled as FreeBSD does, not through the host's versions, which differ for an unreadable configuration and for SuperSpeed endpoints. A host SuperSpeed+ device reports SuperSpeed, the fastest speed FreeBSD 11.4 has. A null device in `sceUsbdGetMaxIsoPacketSize` throws, as FreeBSD dereferences it. A device stays known while a handle to it is open, so the device of a handle from `sceUsbdOpenDeviceWithVidPid` can be used until that handle is closed. Closes when: measured on a PS5
+- [sceUsbdSetInterfaceAltSetting, sceUsbdClearHalt, sceUsbdDetachKernelDriver](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - not measured on a console; they follow FreeBSD 11.4 [libusb10.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libusb/libusb10.c) over the host libusb. `sceUsbdSetInterfaceAltSetting` checks the interface range and this library's record of claimed interfaces, and returns `0x802400FF` for any other failure; it throws while the device has transfers in flight, which FreeBSD cancels first. `sceUsbdClearHalt` returns 0, or `0x802400FF` for an endpoint the host does not find; FreeBSD ignores the result of the clear itself, so the host's other errors throw, and so does a null handle, which FreeBSD dereferences. `sceUsbdDetachKernelDriver` returns `0x802400FF` for any failure, which on Windows is every call, as libusb cannot detach drivers there. Closes when: measured on a PS5
diff --git a/docs/dev/debt/libSceUserService.md b/docs/dev/debt/libSceUserService.md
index cd811dc408..f1cb7b914e 100644
--- a/docs/dev/debt/libSceUserService.md
+++ b/docs/dev/debt/libSceUserService.md
@@ -4,8 +4,9 @@
 
 - [sceUserServiceGetNpAccountId](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the account id for a user with no linked PSN account is assumed to be 0 with success; libSceNpManager's `sceNpGetAccountIdA` answers the same question with `SCE_NP_ERROR_SIGNED_OUT`
 - [sceUserServiceInitialize and sceUserServiceInitialize2](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - event delivery has no background service thread, so the confirmed priority and Initialize2 CPU affinity mask do not affect host scheduling.
-- [sceUserServiceGetUserColor](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the default profile colour is assumed to be blue (0)
-- [sceUserServiceGetUserName](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - `0x80960105`, which a PS5 (firmware 13.60) returns for a user id it does not know, has no known name; it is `USER_SERVICE_ERROR_UNKNOWN_USER` here. On the console a registered user who is not logged in still gets their name; here only the initial user exists
+- [sceUserServiceGetUserColor](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the profile colour corresponds to user index (0: blue, 1: red, 2: green, 3: pink); colours 1, 2 and 3 are assumed, not measured
+- [sceUserServiceGetUserName](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - `0x80960105`, which a PS5 (firmware 13.60) returns for a user id it does not know, has no known name; it is `USER_SERVICE_ERROR_UNKNOWN_USER` here. On the console a registered user who is not logged in still gets their name; here up to 4 users ("Player", "Player2", "Player3", "Player4") are supported; user names "Player2", "Player3" and "Player4" are assumed, not measured
+- [sceUserServiceGetEvent](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - login and logout events queued dynamically on controller hotplug have no source and are assumed, not measured
 - [sceUserServiceGetAgeLevel](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - on a PS5 (firmware 13.60) the value is the age set in the user's parental restriction (0, 7, 12 and 15 were measured) and `0xFFFFFFFF` without one; a user who is not logged in returns `0x80960009` with or without an output. Parental restrictions are not modelled, so the initial user is always reported as unrestricted. PPSA12544 (Unity) only stores the value for its user profile
 - [sceUserServiceGetAccessibilityChatTranscription, PressAndHoldDelay, TriggerEffect, Vibration, ZoomEnabled, ZoomFollowFocus](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - report 0, 0, 1, 1, 0 and 1, what a PS5 (firmware 13.60) reports for a user whose accessibility settings are all at their defaults; the console reports the user's own settings (a changed vibration intensity read 3), which are not modelled. What each number means is unknown. A user who is not logged in returns `0x80960009` with or without an output
 - [sceUserServiceGetKeyboardType, sceUserServiceGetJapaneseInputType, sceUserServiceGetTraditionalChineseInputType](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - AnyPS5 stores no per-user keyboard setting, so the initial user reports the keyboard type of the configured system language (`ANYPS5_LANGUAGE`, English US by default) and 0 for the two input variants, and any other user id returns `USER_SERVICE_ERROR_UNKNOWN_USER`. The language-to-keyboard-type table is the repository owner's (languages 0 to 29); a valid language outside it, such as Ukrainian (30), reports 20 (US English). A value that is not a console language number is rejected by `sceSystemServiceParamGetInt` with an error naming `ANYPS5_LANGUAGE`; the call throws it and leaves the output untouched. The input variant is 0 because the owner's table gives 0 for Japanese and Traditional Chinese, the only languages needing one. `sceConvertKeycodeGetImeKeyboardType` consumes these values.
diff --git a/docs/dev/debt/libSceVdecsw.md b/docs/dev/debt/libSceVdecsw.md
index 4818e0bfea..ca1399ba19 100644
--- a/docs/dev/debt/libSceVdecsw.md
+++ b/docs/dev/debt/libSceVdecsw.md
@@ -5,3 +5,5 @@
 - [libSceVdecsw](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - structure layouts follow shadPS4's `vdecsw.h` and were checked against PPSA05684's movie decoder (`movie-decoder-vdecsw.cpp`), which asserts `pictureCount == 1` at offset 0xb of `OutputInfo` and reads `InputResult` offset 0x10 as the number of frames an access unit produced. The compute, decoder memory and decode input structures and the first 0x28 bytes of the 0x50-byte decoder config are those of libSceVideodec2, and decoding goes through it. The 0x78-byte AVC picture info is filled with Videodec2's leading fields and the cropping fields only. OUTPUT_PENDING (0x81510115), INPUT_QUEUE_EMPTY (0x81510116) and DECODE_PENDING (0x81510117) follow from the codes each call's assert accepts. At most four decoded pictures are queued and the last one is held until `sceVdecswFinalizeDecodeSequence`; the console's queue depth is unknown. `sceVdecswSyncDecodeInput` / `sceVdecswSyncDecodeOutput` retry the TrySync variants until they stop returning DECODE_PENDING / OUTPUT_PENDING; they do not sleep beyond a yield, so another thread must drain outputs when the picture queue is full. The 0xb8-byte HEVC picture info (shadPS4's `vdecsw.h`) carries only the timestamps, coded size, bit depth, IDR and IRAP flags, profile, level and conformance window (in chroma samples, repeated in the frame cropping fields, whose console unit is unknown)
 
 - [sceVdecswGetVp9PictureInfo](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - no console behaviour is recorded; the signature and 0x58-byte layout come from [SharpProspero's Vdecsw.cs](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Video/Vdecsw.cs#L892-L952), and shadPS4 has no VP9 getter. It copies the leading `thisSize - 8` bytes of the picture's info, as [shadPS4's `sceVdecswGetPictureInfo`](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/videodec/vdecsw.cpp#L303-L334) does for AVC and HEVC, from Videodec2's VP9 info (`level` is 0 there). An output with no picture returns 0 and writes nothing. Null pointers, `thisSize` below 8, two pictures and a frame buffer no VP9 decoder returned (an H.264 picture too) throw; console error codes are unknown. VP9 decoding goes through Videodec2 and rejects pictures deeper than 10 bits
+
+- [sceVdecswGetPictureInfo](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - console behaviour and errors are unmeasured. The signature, 0x30/0x38 output descriptor sizes, optional first output, unchanged size field and empty-picture handling follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/videodec/vdecsw.cpp#L303-L334). Metadata comes from the existing AVC, HEVC or VP9 delivered-frame records, not the guest frame-buffer tail; copying is capped at the known record size, as in the typed getters. Invalid descriptor pointers/sizes, result sizes below 8 and unknown frame buffers throw instead of returning unverified console error codes. Two-picture field output remains unimplemented and throws before writing; the second output is untouched for zero or one picture. Metadata completeness and decoder limitations above still apply.
diff --git a/docs/dev/debt/libSceVideoOut.md b/docs/dev/debt/libSceVideoOut.md
index 5fdf3bd52f..97a7439d7e 100644
--- a/docs/dev/debt/libSceVideoOut.md
+++ b/docs/dev/debt/libSceVideoOut.md
@@ -9,6 +9,7 @@
 
 ### Unknown function info
 
+- PPSA29866 imports declared without parameters, signatures unknown, added without an implementation because the title fails to load without them: [sceVideoOutSetFlipMaster and sceVideoOutClearFlipMaster](../../../core/libs/prx/libSceVideoOut/Unimplemented.cpp) (libSceVideoOut)
 - [sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_, sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_, sceVideoOutAdjustColorSpaceConversion_, sceVideoOutSetGlobalBlendSpace](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - PPSA30630 imports these to configure color space conversion and global blend space. Color space conversion settings are accepted with size validation (32 bytes) but conversion blocks and blend space parameters are not applied to the presentation swapchain
 - [sceVideoOutDeleteVrrActiveStatusEvent](../../../core/libs/prx/libSceVideoOut/src/Event.cpp) (libSceVideoOut, NID `-q-vbO859Tw`) - the name hashes to the NID PPSA02530 imports and is listed in [sce_symbols](https://github.com/zecoxao/sce_symbols) `aerolib.csv` at `fe2cc2948e`. The signature `(eq, handle)` and the behaviour, removing the handle's VRR status registration from the queue as the other `Delete*Event` calls do, follow sceVideoOutAddVrrActiveStatusEvent; no title has been observed calling it
 - [sceVideoOutCursorEnable, sceVideoOutCursorDisable, sceVideoOutCursorSetImageAddress, sceVideoOutCursorSetPosition](../../../core/libs/prx/libSceVideoOut/Unimplemented.cpp) (libSceVideoOut, NIDs `UPZWCH8qTM4`, `fEPEwROdCwM`, `u-9bhWQApq8`, `N17AK88NdD0`) - the names hash to the NIDs Prospero Win (PPSA99995) imports, and the parameter lists `(handle, index, address)`, `(handle, index)`, `(handle, index, address)` and `(handle, index, x, y)` follow its [declarations](https://github.com/mpereiraesaa/prospero-win/blob/644e32e400c555e340d507383398c5d21b39b0b0/wine/ps5/pw_vulkan_radv.c#L65-L68). The cursor image's format and size and the console's return values are not known; the functions report that they are not implemented.
@@ -18,8 +19,9 @@
 - [sceVideoOutRegisterBuffers2](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) (libSceVideoOut) - DCC buffers (category 1): `dcc_control` is taken as the CB_DCC_CONTROL block layout, only bits 0x10026c are accepted; `dcc_cb_register_clear_color` as the register-clear texel, only 32-bit values are presented
 - [sceVideoOutIsOutputSupported](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - mode 1 is supported; mode 15 is supported when the current host display runs at 120 Hz or above. Configuring mode 15 requires attribute3 bit 0x40; this single-bit mask is inferred from the measured full value 0x80040, not isolated by a console measurement. Vblanks run at 119.88 Hz until mode 1 restores 59.94 Hz. Display modes are read through SDL; a move to a slower display falls back the configured output mode to mode 1, fires the output-mode event and continues at 59.94 Hz. The console's exact fallback behaviour when a 120 Hz display is lost has not been measured; this fallback avoids the abort in #7877 and matches the HDMI output mode renegotiation that a display change requires. Selecting another host display mode and VRR are not implemented. The console answers per display and per title: with a 120 Hz TV it also answers 1 for mode 15 (119.88 Hz), and [PS5_Vulkan](https://github.com/mihawk-99/PS5_Vulkan/blob/5b5e4fc2d80fdb67a4f61ba9e6a8a424026bb8a5/docs/HARDWARE_FINDINGS.md) measured that `sceVideoOutConfigureOutput` accepts 15 only from a title whose param.json declares high-frame-rate output (attribute3 0x80040). Modes 4, 7, 8, 12-14, 16-17 and 19 return `VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE` here, as they did on the measured display. Mode 18 throws, because one console answered 0x80290016 and two others 0x8029001E, the last a PS5 on 13.40 with a 120 Hz TV (measured 2026-10-19 inside a retail title), whose answers for every other mode match the ones here. The name `VIDEO_OUT_ERROR_UNKNOWN_OUTPUT_MODE` for 0x8029001E is ours. Word 3 of the output options is accepted with any value, as on the console, and its meaning is unknown. PPSA12544 probes `0xd000000a`, which the console answers with 0x8029001E, so the title selects 3840 pixels; PPSA26344 at `0xCD0946` passes `(handle, 0xf, nullptr, nullptr, 0)` and branches on the result equalling 1
 - [sceVideoOutGetResolutionStatus](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - `screenSizeInInch` is 0, the value EDID uses for an undefined size, since the host display's size is not read; a PS5 (firmware 13.40, measured 2026-10-19 inside a retail title) reported its TV's 60.0f. The 48-byte layout, from the declarations in ps5-opengl and EVO-PLAYER-PS5 (#1578), is confirmed there: full size and pane 3840 x 2160, `refreshRate` 3, `flags` 0 and the rest 0 on the title's handle, 0x8029000B for handles 0 to 8. `flags` is 0 here too; its bits are unknown. The pane equals the full size because `sceVideoOutSetWindowModeMargins` applies no margins
+- [sceVideoOutGetOutputStatus](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - the status after a buffer is registered, a 1440p output and a display below 4K with the console's resolution on Automatic were not measured. A payload process on a PS5 (firmware 12.70) with no buffer registered reported `resolution` 2 right after `sceVideoOutOpen(0xff, 0, 0, NULL)` with the console's resolution on Automatic on a 4K display and 1 with it set to 1080p, and `dynamicRange` 2 with `flags` 0 on an HDR display with HDR on, while this code sets flag bit 0 whenever it reports dynamic range 2. `resolution` is 2 when the current display mode SDL reports for the window's display is at least 3840 pixels wide or 2160 high and 1 otherwise, read with the refresh rate and independent of the registered buffers; on Wayland SDL's mode is the output's logical size (from SDL's source, not run), so a scaled 3840x2160 output reports 1. `APS5_OUTPUT_RESOLUTION` replaces that size
 - [sceVideoOutOpen](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - the open param's first word is unknown (PPSA21564 passes 16; it is not the byte size, since the affinity mask is at offset 16); only 16 is accepted. PPSA26344's only call at `0xCCF5EA` passes `(0xFF, 0, 0, nullptr)`. Whether a non-null param continues past offset 24 is also unknown
-- [sceVideoOutGetBufferLabelAddress](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) exposes a port-owned contiguous array of 16 aligned 64-bit labels and returns its count. Astro Bot PPSA21564's bundled AGC driver passes a pointer output and addresses each label at `base + index * 8`. The count, zero initialization on registration, and release of the previous displayed buffer when its replacement completes follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/23c41333822fe8eca4c609b43119180af63ae4ac/src/core/libraries/videoout/video_out.cpp) and its driver; PS5 console equivalence has not been measured. Labels live until the port closes, and reopening creates a new array. Error precedence follows the reference for null output and the existing open-port policy for handles. Exact scanout release timing, repeated same-buffer flips and concurrent guest label stores remain unverified. EOP-flip registration and interrupt tokens remain unimplemented; exposing these labels does not implement that separate API.
+- [sceVideoOutGetBufferLabelAddress](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) exposes a port-owned contiguous array of 16 aligned 64-bit labels and returns its count. Astro Bot PPSA21564's bundled AGC driver passes a pointer output and addresses each label at `base + index * 8`. The count, zero initialization on registration, and release of the previous displayed buffer when its replacement completes follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/23c41333822fe8eca4c609b43119180af63ae4ac/src/core/libraries/videoout/video_out.cpp) and its driver; PS5 console equivalence has not been measured. Labels live until the port closes, and reopening creates a new array. Error precedence follows the reference for null output and the existing open-port policy for handles. Exact scanout release timing, repeated same-buffer flips and concurrent guest label stores remain unverified. EOP-flip registration and interrupt tokens are the separate `sceVideoOutSubmitEopFlip` API.
 - [GPU flips](../../../core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp) (libSceVideoOut) - a command-buffer flip of a buffer index with no registered buffer when the GPU reaches it presents black and completes like any flip (flip event, count, `flipPendingNum`). The console's behaviour is unknown; PPSA05684 requires that it completes: its renderer submits a flip of buffer 0 while another thread waits for `sceVideoOutIsFlipPending` to reach 0 before registering the buffers, and `flipPendingNum` counts that flip from its submission as in shadPS4
 - [sceVideoOutSubmitFlip](../../../core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp) (libSceVideoOut, libSceAgcDriver) - in the [AGC driver](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp), a CPU flip waits for the graphics-queue submissions ahead of it when the calling thread has submitted graphics-queue work itself: a title that submits a frame and flips it without waiting relies on that order, since emulated GPU work finishes later than the console's. A flip from a thread that has never submitted graphics-queue work is presented without waiting for queued submissions, unless a command-buffer or EOP flip ahead of it has not been reached. Such a thread can only know its frame is finished by waiting for it, as the PS5 RADV WSI's flip thread waits on the frame's fence. Whether the console ever orders a CPU flip behind the graphics queue is not measured; `APS5_CPU_FLIP_IN_ORDER=1` orders every CPU flip
 - [sceVideoOutGetVblankStatus](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - the third 64-bit word of the PS5 status (`reserved` in [SceTypes.hpp](../../../core/libs/SceTypes.hpp)) is written 0. On a PS5 (firmware 13.40, measured 2026-10-19) a retail title's own call, caught inside it, got count 0xb16b, `processTime` 0x381a8790 (941 s), third word 0x1c485ffaadc, `processTimeCounter` 0x15dd63c364b, flags 0x04 and phase 0: the third word is a running counter, about 970 s at ~2 GHz, consistent with a TSC, not zero. Its clock and what it counts from are not established. Closes when: the third word's source is measured and written
diff --git a/docs/dev/debt/libSceVideoRecordingP.md b/docs/dev/debt/libSceVideoRecordingP.md
index 0b82a50648..835fa5eb21 100644
--- a/docs/dev/debt/libSceVideoRecordingP.md
+++ b/docs/dev/debt/libSceVideoRecordingP.md
@@ -8,7 +8,6 @@
 - [sceVideoRecordingCloseByHandle, sceVideoRecordingGetInfoByHandle](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp) - native handles are context pointers. Recording state and per-handle queries remain unimplemented.
 - [sceVideoRecordingCopyBGRAtoNV12](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp) - the destination, source, 32-bit width and height arguments are confirmed. Pixel conversion remains unimplemented.
 - [sceVideoRecordingGetSupportInfo, sceVideoRecordingGetVideoOutMode](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp) - GetSupportInfo writes an 18-byte payload whose fields remain unresolved. GetVideoOutMode takes a four-byte output confirmed by the native recording assembly and Avcap2 IPC descriptor; the mode values remain unresolved. Both exports remain unimplemented.
-- [sceVideoRecordingInit, sceVideoRecordingTerm](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp) (libSceVideoRecordingP) - parameterless initialization and termination stubs; unimplemented and throw `NotImplemented_nid_no_patch`
 - [sceVideoRecordingInitialize](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp): the native initializer consumes no caller arguments; the former optional parameter is not read by the Avcap2 initializer or recording setup. Its unused parameter slot is retained because the protected body references it.
 - [sceVideoRecordingOpen, sceVideoRecordingOpen2](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp) - the 32-byte and 40-byte parameter variants, four argument registers and 32-bit heap size are recovered. Mode, output mode, option and format semantics remain incomplete. QueryHddSize2 returns a signed 64-bit size or error; recording and sizing exports remain unimplemented.
 
@@ -16,4 +15,4 @@
 
 ### Functional
 
-- [sceVideoRecordingGetStatus](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp) (libSceVideoRecordingP) always returns 0, `None` ("The recorder is not open") in [SharpProspero's `VideoRecordingStatus`](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Video/VideoRecording.cs#L18-L29), also listed in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/video_recording/video_recording.h#L32-L36). It is true here because `sceVideoRecordingOpen` throws, so no recorder is ever open. Unverified: whether the console returns 0 or an error before `sceVideoRecordingInit`/`sceVideoRecordingInitialize`, which throw, and when it reports `Running` (1) or `Paused` (2)
+- [sceVideoRecordingGetStatus](../../../core/libs/prx/libSceVideoRecordingP/Export.cpp) (libSceVideoRecordingP) always returns 0, `None` ("The recorder is not open") in [SharpProspero's `VideoRecordingStatus`](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Video/VideoRecording.cs#L18-L29), also listed in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/video_recording/video_recording.h#L32-L36). It is true here because `sceVideoRecordingOpen` throws, so no recorder is ever open. Unverified: whether the console returns 0 or an error before `sceVideoRecordingInit`/`sceVideoRecordingInitialize`, and when it reports `Running` (1) or `Paused` (2)
diff --git a/docs/dev/debt/libSceVideodec2.md b/docs/dev/debt/libSceVideodec2.md
index 74a8f81c0f..3b7fb61675 100644
--- a/docs/dev/debt/libSceVideodec2.md
+++ b/docs/dev/debt/libSceVideodec2.md
@@ -11,7 +11,7 @@
 
 - [AVC parameter-set units](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) - an H.264 access unit with no slice NAL (types 1 to 5), such as the sequence and picture parameter sets Twispero (PPSA99474) submits on their own before a stream's first slices, is kept and put in front of the next unit that has a slice, and `sceVideodec2Decode` returns 0 with no picture for it, since libavcodec refuses a packet without a slice. What the console returns for such a unit is not known. HEVC units of parameter sets alone are still passed to libavcodec as they are
 
-- [sceVideodec2CreateDecoder](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) decodes HEVC (codec type 974921) and VP9 (2382845) through FFmpeg, besides H.264. The tags come from SharpProspero's `Videodec2CodecType` and EVO-PLAYER-PS5's `sce_videodec2.h`, which records them from hardware runs. HEVC input is converted from length-prefixed NAL units to Annex B as for H.264, and VP9 frames are passed through. Output is NV12 for 8-bit pictures. A 10-bit picture is written as 16-bit little-endian words with the sample in the low 10 bits, Y rows then interleaved UV rows at `framePitchInBytes` times the picture height, with `framePitch` in samples and `framePitchInBytes` in bytes (twice the width, aligned to 256), and `QueryDecoderMemoryInfo` sizes a frame of an HEVC or VP9 profile 2 configuration with two bytes per sample. Evidence is from [EVO-PLAYER-PS5](https://github.com/sainsaji/EVO-PLAYER-PS5/tree/9715f6ee9bf9b53461d6fdf9a2e11b4c48357783), which decodes and presents 1080p HEVC Main10 on hardware through this path (`docs/evo-pro/on-demand-decoder-handoff.md`): it takes a picture as 10-bit when `pitch_bytes >= pitch * 2`, puts UV at `pitch_bytes` times the height and samples with a low-bit factor (`projects/evoplayer/media/src/evo_vdec_native.c`, `ro_harvest`), and its hardware logs give 6128 KB and 24496 KB frame buffers for 1920x1088 and 3840x2176 Main10 decoders after rounding to 16 KiB. The 1080p size is what this formula gives; at 3840x2176 it gives 16 KiB less, so the console's size there has another term that is not known. Unverified: `frameFormat` (still 0; no consumer found reads it), VP9 profile 2 output (no hardware evidence), and the layout of 12-bit pictures and of decoded formats other than yuv420p10le, which throw. `sceVideodec2GetPictureInfo` and `sceVideodec2GetAvcPictureInfo` throw for HEVC pictures (`SceVideodec2HevcPictureInfo` is not filled), and `sceVideodec2GetHevcPictureInfo` reports that it is not implemented
+- [sceVideodec2CreateDecoder](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) decodes HEVC (codec type 974921) and VP9 (2382845) through FFmpeg, besides H.264. The tags come from SharpProspero's `Videodec2CodecType` and EVO-PLAYER-PS5's `sce_videodec2.h`, which records them from hardware runs. HEVC input is converted from length-prefixed NAL units to Annex B as for H.264, and VP9 frames are passed through. Output is NV12 for 8-bit pictures. A 10-bit picture is written as 16-bit little-endian words with the sample in the low 10 bits, Y rows then interleaved UV rows at `framePitchInBytes` times the picture height, with `framePitch` in samples and `framePitchInBytes` in bytes (twice the width, aligned to 256), and `QueryDecoderMemoryInfo` sizes a frame of an HEVC or VP9 profile 2 configuration with two bytes per sample. Evidence is from [EVO-PLAYER-PS5](https://github.com/sainsaji/EVO-PLAYER-PS5/tree/9715f6ee9bf9b53461d6fdf9a2e11b4c48357783), which decodes and presents 1080p HEVC Main10 on hardware through this path (`docs/evo-pro/on-demand-decoder-handoff.md`): it takes a picture as 10-bit when `pitch_bytes >= pitch * 2`, puts UV at `pitch_bytes` times the height and samples with a low-bit factor (`projects/evoplayer/media/src/evo_vdec_native.c`, `ro_harvest`), and its hardware logs give 6128 KB and 24496 KB frame buffers for 1920x1088 and 3840x2176 Main10 decoders after rounding to 16 KiB. The 1080p size is what this formula gives; at 3840x2176 it gives 16 KiB less, so the console's size there has another term that is not known. Unverified: `frameFormat` (still 0; no consumer found reads it), VP9 profile 2 output (no hardware evidence), and the layout of 12-bit pictures and of decoded formats other than yuv420p10le, which throw. `sceVideodec2GetPictureInfo` and `sceVideodec2GetAvcPictureInfo` throw for HEVC pictures (`SceVideodec2HevcPictureInfo` is not filled), and `sceVideodec2GetHevcPictureInfo` reports that it is not implemented. One title (PPSA02225) disassembled for this entry calls it once (arguments set up at 0x8b5095-0x8b50a6) with three pointers: a structure built on its stack, a structure inside its decoder object and the address of a field of the same object. A nonzero result makes it leave the decoder setup; on one path (a flag byte set and two 32-bit fields equal to values it computed before) it passes that field to the next Videodec2 call. The codec type it requests and the meaning of the structure fields are not shown.
 
 - [sceVideodec2GetVp9PictureInfo](../../../core/libs/prx/libSceVideodec2/Export.cpp) uses the 88-byte layout and two-pointer signature from [SharpProspero Videodec2.cs](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Video/Videodec2.cs). Frame metadata follows the [VP9 specification](https://storage.googleapis.com/downloads.webmproject.org/docs/vp9/vp9-bitstream-specification-v0.7-20170222-draft.pdf), sections 5.26 and 6.2: profile, key/intra-only flags, bit depth, color space/range, coded/render dimensions and superframe count are retained per emitted buffer. Level is 0 because the elementary stream does not signal a level; the console value is unverified. Null pointers, undersized structures and querying another codec throw; console error codes and support for other structure sizes are unknown. Pictures deeper than 10 bits are rejected. Superframes are submitted as individual coded frames to keep each output associated with its input metadata. `sceVideodec2GetPictureInfo` writes this layout for a VP9 picture, as shadPS4's `videodec2.cpp` writes the decoder's own layout; Mortal Shell 2 (PPSA34008) calls it with `thisSize` 88.
 - [sceVideodec2Decode after sceVideodec2Flush](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) without `sceVideodec2Reset` restarts FFmpeg's decoder (`avcodec_flush_buffers`) and decodes the unit, where it threw before. TEKKEN DARK RESURRECTION (PPSA31371), which runs in Sony's PSP emulator, decodes after a flush without a reset (#7118), so the console accepts the call. Pictures the flush decoded but has not returned yet are returned before the new ones. A flush with no picture pending (each decoded unit has returned its picture) leaves the decoder and its reference pictures as they are, so a stream that continues without a new IDR picture keeps decoding: Daxter (PPSA09695), also in the PSP emulator, flushes after every access unit of its H.264 movies, and restarting the decoder there lost every P picture until the next keyframe. What the console returns for pending pictures, and for a stream that continues across a flush that had pictures pending, is not measured.
diff --git a/docs/dev/debt/libSceVisionManager.md b/docs/dev/debt/libSceVisionManager.md
index 6e8c187895..f8f41d421e 100644
--- a/docs/dev/debt/libSceVisionManager.md
+++ b/docs/dev/debt/libSceVisionManager.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [sceVisionManagerApplyCalibrateHmdResult, sceVisionManagerCancelRequest, sceVisionManagerClose, sceVisionManagerFinalize, sceVisionManagerGenerateRegisterUserData, sceVisionManagerGenerateRegisterUserDataFinalize, sceVisionManagerGenerateRegisterUserDataInitialize, sceVisionManagerGetCalibrateTrackingLedInfo, sceVisionManagerGetCalibrateTrackingLedNecessity, sceVisionManagerGetHitCountOfRegisterUserData, sceVisionManagerGetLibraryVersion, sceVisionManagerGetNumOfRegisterUserDataSlot, sceVisionManagerGetRegisterUserDataSize, sceVisionManagerGetRegisterUserDataVersion, sceVisionManagerGetResultOfCalibrateHmd, sceVisionManagerGetResultOfCalibrateStereoCamera, sceVisionManagerGetResultOfCalibrateTrackingLed, sceVisionManagerGetResultOfFindFace, sceVisionManagerGetResultOfFindPad, sceVisionManagerGetResultOfFindPadCorrespondRegion, sceVisionManagerGetResultOfFindUser, sceVisionManagerGetResultOfFindUserInRegion, sceVisionManagerGetResultOfFindUserWithoutIdentify, sceVisionManagerGetResultOfRegisterUserInRegion, sceVisionManagerGetStoreCameraImgYPtr, sceVisionManagerGetWorkingMemorySize, sceVisionManagerInitialize, sceVisionManagerLoadSettings, sceVisionManagerOpen, sceVisionManagerRegistryClear, sceVisionManagerRequestCalibrateHmd, sceVisionManagerRequestCalibrateStereoCamera, sceVisionManagerRequestCalibrateTrackingLed, sceVisionManagerRequestClose, sceVisionManagerRequestFindFace, sceVisionManagerRequestFindPad, sceVisionManagerRequestFindPadCorrespondRegion, sceVisionManagerRequestFindUser, sceVisionManagerRequestFindUserInRegion, sceVisionManagerRequestFindUserWithoutIdentify, sceVisionManagerRequestHeadDetection, sceVisionManagerRequestInitializeRegisterUserData, sceVisionManagerRequestOpen, sceVisionManagerRequestPadTracking, sceVisionManagerRequestRecogUtility, sceVisionManagerRequestRegisterUserInRegion, sceVisionManagerRequestStoreCameraImgY, sceVisionManagerSetCallbackForUpdateCalibrateHmdResult, sceVisionManagerSetCallbackForUpdateCalibrateStereoCameraResult, sceVisionManagerSetCallbackForUpdateCalibrateTrackingLedResult, sceVisionManagerSetCallbackForUpdateCameraFrame, sceVisionManagerSetCallbackForUpdateCtrlCore, sceVisionManagerSetCallbackForUpdateRecog, sceVisionManagerSetCallbackForUpdateRunningStatus, sceVisionManagerSetCallbackForUpdateStoreFrame and sceVisionManagerWaitResponse](../../../core/libs/prx/libSceVisionManager/Export.cpp) (libSceVisionManager) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVisionManager.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceVisionManagerApplyCalibrateHmdResult, sceVisionManagerCancelRequest, sceVisionManagerFinalize, sceVisionManagerGenerateRegisterUserData, sceVisionManagerGenerateRegisterUserDataFinalize, sceVisionManagerGenerateRegisterUserDataInitialize, sceVisionManagerGetCalibrateTrackingLedInfo, sceVisionManagerGetCalibrateTrackingLedNecessity, sceVisionManagerGetHitCountOfRegisterUserData, sceVisionManagerGetLibraryVersion, sceVisionManagerGetNumOfRegisterUserDataSlot, sceVisionManagerGetRegisterUserDataSize, sceVisionManagerGetRegisterUserDataVersion, sceVisionManagerGetResultOfCalibrateHmd, sceVisionManagerGetResultOfCalibrateStereoCamera, sceVisionManagerGetResultOfCalibrateTrackingLed, sceVisionManagerGetResultOfFindFace, sceVisionManagerGetResultOfFindPad, sceVisionManagerGetResultOfFindPadCorrespondRegion, sceVisionManagerGetStoreCameraImgYPtr, sceVisionManagerGetWorkingMemorySize, sceVisionManagerInitialize, sceVisionManagerRegistryClear, sceVisionManagerRequestCalibrateHmd, sceVisionManagerRequestCalibrateStereoCamera, sceVisionManagerRequestCalibrateTrackingLed, sceVisionManagerRequestClose, sceVisionManagerRequestFindFace, sceVisionManagerRequestFindPad, sceVisionManagerRequestFindPadCorrespondRegion, sceVisionManagerRequestHeadDetection, sceVisionManagerRequestInitializeRegisterUserData, sceVisionManagerRequestOpen, sceVisionManagerRequestPadTracking, sceVisionManagerRequestRecogUtility, sceVisionManagerRequestStoreCameraImgY, sceVisionManagerSetCallbackForUpdateCalibrateHmdResult, sceVisionManagerSetCallbackForUpdateCalibrateStereoCameraResult, sceVisionManagerSetCallbackForUpdateCalibrateTrackingLedResult, sceVisionManagerSetCallbackForUpdateCameraFrame, sceVisionManagerSetCallbackForUpdateCtrlCore, sceVisionManagerSetCallbackForUpdateRecog, sceVisionManagerSetCallbackForUpdateRunningStatus, sceVisionManagerSetCallbackForUpdateStoreFrame and sceVisionManagerWaitResponse](../../../core/libs/prx/libSceVisionManager/Export.cpp) (libSceVisionManager) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVisionManager.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceVoice.md b/docs/dev/debt/libSceVoice.md
index 3dcdeae2a9..32d3ca5475 100644
--- a/docs/dev/debt/libSceVoice.md
+++ b/docs/dev/debt/libSceVoice.md
@@ -7,13 +7,13 @@
 
 ### Unknown function info
 
+- [sceVoiceVADAdjustment](../../../core/libs/prx/libSceVoice/Export.cpp) - throws through `NotImplemented_nid_no_patch`; behaviour and the PS5 prototypes are unmeasured. The only source of the parameter lists is shadPS4's PS4-derived prototypes (GPLv2, used as a reference only), with no second reference; structure pointers are `void*` because no layout is known.
 - [sceVoiceInit, sceVoiceStart, sceVoiceCreatePort, sceVoiceGetPortInfo](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - a second `sceVoiceInit` returns 0x804E0802, and Start, CreatePort and GetPortInfo return 0x804E0801 before checking any argument while the library is not initialized, as [prosper](https://github.com/mattias800/prosper/blob/ed42e499888d5a86792c3e1b2df3aebd8ca1a681/prosper/src/hle/audio/hle_audio.cpp#L4697-L4713) reads them from the shipped module. The other port and lifecycle calls still throw when the library is not initialized, since prosper gives no module address for them. Whether `sceVoiceInit` checks a null param before its state is unknown, so a null param still throws first, and that `sceVoiceEnd` returns the library to the not-initialized state is assumed. Closes when: the other entry points are read from the module or measured on a PS5
 - [sceVoiceInitHQ, sceVoiceVADSetVersion](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - not measured on a PS5: the signatures and rules follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/voice/voice.cpp). `sceVoiceInitHQ` runs `sceVoiceInit`, as shadPS4's two share one path. `sceVoiceVADSetVersion` accepts versions 0 and 1 and returns `0x804E0805` for any other; nothing uses the version, as no voice activity detection runs
 - [sceVoicePausePortAll, sceVoiceResumePortAll](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - not measured on a PS5: both return 0x804E0801 while the library is not initialized and 0 otherwise, as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c1b26558352b863f80142256e4df38585aa7d727/src/core/libraries/voice/voice.cpp#L356-L437); prosper reads the same code for `sceVoiceStart`, and the PS3 calls in [RPCS3](https://github.com/RPCS3/rpcs3/blob/be69c054eeac57e2e671697a463473d37fe5a7b2/rpcs3/Emu/Cell/Modules/cellVoice.cpp#L462-L543) make the same check. Like `sceVoicePausePort` they change nothing that is reported: [VitaSDK](https://github.com/vitasdk/vita-headers/blob/ae5808f3105c42fa3373ba4ab64ab54e2e3ca848/include/psp2/voice.h#L540-L557) documents that pausing every port keeps the buffered data and the reported state, and nothing here processes port data
 - [sceVoiceGetMemorySize](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceDeviceInCustomerData](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceQAEnableRecording](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
-- [sceVoiceVADAdjustment](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceVADPVTAdjustment](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceSetMuteFlagAll, sceVoiceSetBitRate, sceVoiceUpdatePort](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - not measured on a PS5; signatures follow [Orbital](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json), behaviour the Vita's [VitaSDK](https://github.com/vitasdk/vita-headers/blob/ae5808f3105c42fa3373ba4ab64ab54e2e3ca848/include/psp2/voice.h#L250-L557). They return the not-initialized, port-range and missing-port codes the other port calls return. The mute-all flag makes `sceVoiceGetMuteFlag` report every port muted without changing port flags. A non-voice port, a bitrate `sceVoiceCreatePort` rejects, a null param or a different port type throw, since the console's codes for them are unknown
 - [sceVoiceGetPortAttr](../../../core/libs/prx/libSceVoice/Export.cpp): native initialization, port-range, pointer, attribute-size and port-type validation is implemented. Supported device attributes throw because the host has no device state or voice-activity processing. The former constant-zero voice-activity fallback is removed; failed calls leave output untouched.
diff --git a/docs/dev/debt/libSceVrTracker2.md b/docs/dev/debt/libSceVrTracker2.md
index 29b19cc61c..5bb664cbf1 100644
--- a/docs/dev/debt/libSceVrTracker2.md
+++ b/docs/dev/debt/libSceVrTracker2.md
@@ -2,11 +2,11 @@
 
 ### Silent stubs
 
-- [libSceVrTracker2](../../../core/libs/prx/libSceVrTracker2/Export.cpp) never initializes; initialized tracking behavior is absent. Its uninitialized responses were measured on firmware 13.60 without a headset: most exports return 0x8A740001 without writes, while specific output/reset helpers clear buffers or write defaults. These helpers still lack complete signatures. Named export signatures and play-area output layouts are recovered; initialization option semantics and result fields need reconstruction. Anonymous exports remain grouped by their observed response rather than their individual contracts.
+- [libSceVrTracker2](../../../core/libs/prx/libSceVrTracker2/Export.cpp) never initializes; initialized tracking behavior is absent. Its uninitialized responses were measured without a headset: most exports return 0x8A740001 without writes, while specific output/reset helpers clear buffers or write defaults. These helpers still lack complete signatures. Named export signatures and play-area output layouts are recovered; initialization option semantics and result fields need reconstruction. Anonymous exports remain grouped by their observed response rather than their individual contracts.
 
 ### Unknown function info
 
-- [sceVrTracker2Initialize](../../../core/libs/prx/libSceVrTracker2/Export.cpp) - the 72-byte parameter layout is recovered, including thread priorities, CPU affinity masks, work memory, size/alignment and coordinate system. Meanings of the 32-bit option at 0x30 and byte options at 0x38/0x39 remain unresolved; initialization remains unimplemented.
+- [sceVrTracker2Initialize](../../../core/libs/prx/libSceVrTracker2/Export.cpp) - never initializes: after validation it returns the first non-zero libSceHmd2 tracking or LED-detector open/start result and resets to uninitialized, and throws if all four succeed or for modes 1000/1001, whose application category the host lacks. Unverified: the mode 0 category query is assumed to succeed, the `sceKernelGetAppInfo2` attribute checks are skipped (the host has no such record; a zeroed one passes), the daemon IPC client and work-memory heap are not created, rollback only undoes what the call opened, and the meanings of the options at 0x30, 0x38 and 0x39 remain unknown (0x39 is only range-checked). The behaviour is not measured on a console; the -1 a no-headset host gets relies on libSceHmd2's measured pre-initialization answers. PPSA05666 calls it with no headset and, with #7463, #7690 and #7658 applied, stopped on the NotImplemented.
 - [libSceVrTracker2](../../../core/libs/prx/libSceVrTracker2/Export.cpp) - the seven anonymous throwing exports now have their consumed argument slots restored. Calibration output (`jRmuXjsknsI`) uses a 32-bit capacity with 608/1216-byte variants; its fields remain unresolved. Mesh requirements (`NBhWy+Gl0tY`) contain four 32-bit counts/sizes. The mode/buffer/capacity/size export (`9R6W33Au4B4`) uses 64-bit sizes. The 32/48-byte result parameters are recovered; result output and pose parameters still need full layouts; the telemetry input (`oZDm1bynCaA`) spans 7024 bytes. Their bodies remain unimplemented.
 
 - [Anonymous tracking queries](../../../core/libs/prx/libSceVrTracker2/Export.cpp) still lack initialized behavior. The paired option setter/getter consume 28/40-byte records with three integer options, a reset byte and one/two float vectors; option meanings remain unresolved. The scalar query uses an 8-byte size/float record. Diagnostic output spans 4096 bytes, extended output 0xD02E8 bytes, and tracking configuration input 1024 bytes; their fields remain unresolved. The relative-pose query uses two coordinate-system selectors and a 64-byte output containing a pose and 32 cleared bytes; the counter query uses a 64-bit output and a 32-bit selector whose meaning remains unresolved. Remaining aliases still need individual signatures.
diff --git a/docs/dev/debt/libSceZlib.md b/docs/dev/debt/libSceZlib.md
index 8cbfd2864e..85bd381724 100644
--- a/docs/dev/debt/libSceZlib.md
+++ b/docs/dev/debt/libSceZlib.md
@@ -2,4 +2,4 @@
 
 ### Functional
 
-- [libSceZlib](../../../core/libs/prx/libSceZlib/Export.cpp) decompresses synchronously and supports one outstanding request. Timed waits, multiple outstanding requests and repeated retrieval throw. Work-memory registration and driver-side destination alignment validation remain unsupported; non-null work memory and unaligned destinations throw. Native user-space validation confirms the 64-bit initialization length, 2 KiB output-length granularity up to 64 KiB, null-argument errors and initialization precedence. Finalization discards the host's completed result. Driver scheduling, completion consumption, cancellation, scratch-memory requirements and decompression error details remain unverified; host decoding maps malformed streams to 0x811200FF and exhausted output to 0x8112001C.
+- [libSceZlib](../../../core/libs/prx/libSceZlib/Export.cpp) is unverified on PS5 for several outstanding requests in submission order, repeated `sceZlibGetResult`, `0x81120002` for an unknown ID, `0x81120027` on timeout and results dropped by `sceZlibFinalize`: they follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/libraries/zlib/zlib.cpp) (PS4), and the microsecond timeout follows SharpProspero. `0x8112000B` (not ready) is never returned: requests finish at submission. A wait interrupted by `sceZlibFinalize`, non-null work memory and an unaligned destination throw. Native validation confirms the 64-bit initialization length, 2 KiB output granularity up to 64 KiB, null-argument errors and initialization precedence. Driver scheduling, cancellation and scratch memory are unverified; malformed streams map to `0x811200FF`, exhausted output to `0x8112001C`.
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index 3a606286a0..6a2be3edf8 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -1,50 +1,66 @@
 # libc technical debt
 
+### Silent stubs
+
+- [_Mtx_current_owns](../../../core/libs/prx/libc/src/Threads.cpp) (libSceLibcInternal, implemented in libc, NID `VYQwFs4CC4Y`) returns 1 and ignores its argument. This follows the PS5 12.00 body reading reported in [PR8859](https://github.com/boykopovar/AnyPS5/pull/8859), rather than inspecting host mutex ownership. The firmware observation is attributed to that contributor; other firmware versions and the argument's console type remain unverified.
+
 ### Unknown function info
 
-- [strtonum](../../../core/libs/prx/libc/src/StringExtensions.cpp) (libc) is unverified on the console. Its signature, decimal parsing, inclusive bounds, error strings, error precedence and errno preservation follow [FreeBSD 11.4 strtonum.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/strtonum.c). Parsing uses the host `strtoll` with base 10.
+- [strtonum](../../../core/libs/prx/libc/src/StringExtensions.cpp) (libc) is unverified on the console. Its signature, decimal parsing, inclusive bounds, error strings, error precedence and errno preservation follow [FreeBSD 11.4 strtonum.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/strtonum.c). Parsing uses the host `strtoll` with base 10. It is not exported by `libSceLibcInternal.sprx` on a PS5 (firmware 13.60), so a payload process cannot call it there
+- [fegetexcept](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libSceLibcInternal, implemented in libc) has not been read from the PS5 library or measured on a console. It follows FreeBSD 11.4 amd64 [fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h#L121-L133), reporting the six unmasked x87 exceptions independently of MXCSR; whether the PS5 uses the same rule when the units disagree is unverified.
 
 - [sceLibcBacktraceGetBufferSize, sceLibcBacktraceSelf](../../../core/libs/prx/libc/src/Backtrace.cpp) (libc) - signatures and frame record layout inferred from a title (next pointer, u32 module offset, module name at +0x10); the u32 at +0xC is unknown and written as 0. Module names are host file names without the `.guest.prx` suffix, so their case may differ from the PS5 module name. On Windows, unwinding uses `_Unwind_Backtrace` and stops at a frame without `.ehmeta` or `.ehfram` tables whose PE unwind data has an exception or termination handler, leaving the trace empty or cut short while still returning 0. Implemented only on Linux and Windows; other platforms throw
 - [ApplicationGuestHeapApi](../../../core/libs/prx/libc/src/ApplicationProcessParameters.cpp) (libc) - on Linux, HLE application allocation uses a loaded guest SDK's ten allocator exports when the title's replacement table has an allocator entry and the exports belong to one native module. With an empty table it keeps the default heap, since a bundled `libc.prx` may export the allocator NIDs while forwarding them to HLE. Its CRT owns application allocator initialization and finalization; HLE retains the module until process exit. Partial or mixed providers throw. This avoids reinitializing an allocator already used by SDK startup; console behavior and other host platforms remain unverified.
 - [fdopen](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) validates descriptor access modes as FreeBSD 11.4 [fdopen.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/fdopen.c) does: a requested mode incompatible with a descriptor not opened for both reading and writing returns null with `EINVAL`, leaving the descriptor open. Windows reads the handle's granted access through the same host helper as `fcntl(F_GETFL)`; a closed descriptor returns null with `EBADF`. Console behavior is unverified.
 - [scriptingGetMem, scriptingFreeMem](../../../core/libs/prx/libc/src/ApplicationHeap.cpp) (libc) - runtime allocator hooks for Unity titles. The allocation signature `(alignment, size)`, minimum alignment 16 and null result for a non-power-of-two alignment follow [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libKernel.cpp); the free hook's one-pointer signature follows [Raeen's recorded contract](https://github.com/Whoisraeen/Raeen/blob/2db56923204b89719916b95e29c2f3c4e1d9f90b/docs/unity-dlsym-blocker.md). Both use libc's own guest heap, not the title's registered allocator. A title that ships its own `libc.prx` (Metal Gear Solid Master Collection, PPSA18194) has already initialized that allocator, and reaching it from here would run its initializer a second time. That title's IL2CPP runtime looks up only `scriptingGetMem`, by name from `Il2cppUserAssemblies.prx`, and asks it for 256 KiB blocks aligned to 4 KiB. Which console library exports the hooks is unknown, and there is no console measurement. Allocation failure and sizes that overflow return null.
 
-- [_Mtx_trylock](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `k6pGNMwJB08`) - returns busy for a non-recursive mutex already owned by the caller, assumed to match `_Mtx_lock`'s ownership handling; exact console behavior is unverified.
-- [nearbyintf](../../../core/libs/prx/libc/src/Math.cpp) (libc, NID `c+4r-T-tEIc`) uses the host rounding mode, not the console's; console rounding mode state remains unverified.
+- [_Mtx_trylock](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `k6pGNMwJB08`) - returns busy for a non-recursive mutex already owned by the caller. The `libc.prx` that titles ship (read from disassembly of PPSA13934's copy, 0x5cf0, not measured on a console) passes its argument to `scePthreadMutexTrylock` and returns 0 for success, `_Thrd_busy` (3) for `SCE_KERNEL_ERROR_EBUSY` and `_Thrd_error` (4) for any other error, so busy for an owned non-recursive mutex comes from the kernel mutex there; this libc keeps its own owner and count instead, and its result for a kernel error other than busy is not compared.
+- [nearbyintf](../../../core/libs/prx/libc/src/Math.cpp) (libc, NID `c+4r-T-tEIc`) rounds with the MXCSR rounding mode, as the console's `libSceLibcInternal.sprx` does in a payload process on a PS5 (firmware 13.60): with the x87 mode set to upward and MXCSR to nearest it rounded 2.5 to 2, and with MXCSR upward to 3, and the four modes gave the results the host gives. The console also raised `FE_INEXACT` for those inexact inputs, which the host's `nearbyintf` does not; whether it does for exact inputs was not measured
 - [__std_find_trivial_unsized_N](../../../core/libs/prx/libc/src/VectorAlgorithms.cpp) (libc) - matches the `libc.prx` bundled with PPSA08427 (disassembly, and that binary run side by side on random inputs): when nothing matches between `first` and the end of its 32-byte-aligned block, the console rescans that whole block without masking and so can return a match up to 31 bytes before `first`
 - [_Thrd_sleep](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `jfRI3snge3o`) follows the Dinkumware threads library shipped with [Visual C++ 2013](https://github.com/adityaramesh/concurrency_runtime/tree/master/VS2013_SP2/crt/src/thr) (`xtime.c`) and C11 Annex K, without console verification. It reads a 16-byte xtime (64-bit seconds and nanoseconds) on the guest `CLOCK_REALTIME`, normalizes the nanoseconds and sleeps through `nanosleep` on POSIX, retrying on `EINTR`, or high-resolution waitable timers on Windows; a null xtime or one whose normalization overflows throws. Guest thread cancellation is not integrated with this wait. The console's `_Thrd_sleep` (disassembled from a title's `libc.prx`) also takes an optional `xtime*` of remaining time and returns `int`; here the sleep is never cut short, so it returns 0 and leaves the remaining time untouched.
+- [setjmp, longjmp](../../../core/libs/prx/libc/src/JumpBuffer.cpp) (libc) save the signal mask at 72 in the jump buffer and restore it, as FreeBSD 11.4's [`setjmp` and `longjmp`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/amd64/gen/setjmp.S#L51-L85) do, which is unverified on a console. They go through the `sigprocmask` libkernel registers when it loads and mark the buffer at 88 as `sigsetjmp` does, so a buffer saved before then is jumped to without changing the mask
 - [_Mtx_init_with_name](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `tgioGpKtmbE`) forwards to `_Mtx_init` and ignores the mutex name parameter.
 - [_Cnd_timedwait](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `McaImWKXong`) follows the console's `_Cnd_timedwait` (disassembled from a title's `libc.prx`), where xtime is an absolute deadline converted against the current time: it returns `_Thrd_timedout` (2) on expiration and `_Thrd_success` (0) on notification. The console returns 4 for other internal pthread errors while this implementation throws.
-- [fegetround, fesetround, fetestexcept, feclearexcept, fegetexceptflag and fesetexceptflag](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libSceLibcInternal, implemented in libc) follow FreeBSD 11.4 amd64 [fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h): rounding modes use x87 control bits 10-11, exception flags include denormals (`0x3f`), and `fexcept_t` is 16 bits. They access the current host thread's x87 and MXCSR state. This console ABI is assumed, as for `fegetenv`, not measured on hardware. Null flag pointers throw instead of faulting.
+- [fegetround, fesetround, fetestexcept, feclearexcept, fegetexceptflag and fesetexceptflag](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libSceLibcInternal, implemented in libc) follow FreeBSD 11.4 amd64 [fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h): rounding modes use x87 control bits 10-11, exception flags include denormals (`0x3f`), and `fexcept_t` is 16 bits. They access the current host thread's x87 and MXCSR state. Under Rosetta 2 the six MXCSR exception masks always read back set, so an SSE exception the guest unmasks stays masked; the x87 masks and the other MXCSR bits are kept. This console ABI is assumed, as for `fegetenv`, not measured on hardware. Null flag pointers throw instead of faulting.
+- [feenableexcept, fedisableexcept, __feenableexcept, __fedisableexcept, fegettrapenable and fesettrapenable](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libc) change only the x87 masks under Rosetta 2: MXCSR keeps its six exception masks set there, so no SSE trap is enabled, and the enable and disable results, which report the traps enabled on both units, report none
 - [fegetenv](../../../core/libs/prx/libc/src/Math.cpp) (libSceLibcInternal, implemented in libc, NID `psx0YiAKm7k`) follows FreeBSD 11 amd64 [fenv.c](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/amd64/fenv.c) with the 32-byte `fenv_t` of [x86/fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h): `fnstenv` fills the 28-byte x87 part, MXCSR follows at 0x1c, and the x87 control word is reloaded because `fnstenv` masks every x87 exception. That the console's `libSceLibcInternal` has the same code and layout is assumed, not read from its binary. A null pointer throws instead of faulting
-- [Guest arena](../../../core/libs/prx/libc/src/GuestArena.cpp) (libc) - the application map area is assumed to end at 0xFC_0000_0000, as `SCE_KERNEL_APP_MAP_AREA_END_ADDR` does on the PS4. On Windows, host allocations made in the arena before libc loads stay, and a fixed guest mapping over one throws
+- [feholdexcept](../../../core/libs/prx/libc/src/Math.cpp) (libSceLibcInternal, implemented in libc, NID `1kduKXMqx7k`) - console equivalence and module/library versions are unverified. The signature and 32-byte amd64 environment layout follow the public SDK [fenv.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/fenv.h); saving both units, masking exceptions and clearing pending flags follows FreeBSD 11 amd64 [fenv.c](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/amd64/fenv.c). The NID comes from the public 3.20 stub inventory, not a module examined here. Null storage throws before modifying the environment, where the reference dereferences it
+- [feupdateenv](../../../core/libs/prx/libc/src/Math.cpp) (libSceLibcInternal, implemented in libc, NID `YXQ4gXamCrY`) follows FreeBSD 11.4 amd64 [fenv.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/msun/amd64/fenv.c): capture the old x87/MXCSR exception union (`0x3f`), restore the saved 32-byte environment, raise those flags in both units, then `fwait`. The console's layout, behavior and module versions are unmeasured; state belongs to the current host thread. A null input or MXCSR bits unsupported by the host's `FXSAVE` mask throw before changing floating-point state; the mask's architectural zero fallback is `0xffbf`. Console fault behavior for malformed environments is unknown. The separate `__fe_dfl_env` object remains unimplemented; no host `FE_DFL_ENV` sentinel is substituted.
+- [Guest arena](../../../core/libs/prx/libc/src/GuestArena.cpp) (libc) - the application map area is assumed to end at 0xFC_0000_0000, as `SCE_KERNEL_APP_MAP_AREA_END_ADDR` does on the PS4. On Windows, host allocations made in the arena before libc loads stay, and a fixed guest mapping over one throws. The console's low-address layout is not measured. Linux and Windows reserve free addresses from 64 KiB, except host mappings and low chunks the Linux address policy refuses; null hints still allocate from 8 GiB. macOS and ASan builds still start the arena at 8 GiB and cannot supply low 32-bit addresses. Guest thread creation ignores a stack address set in its attributes. A host-loaded executable is not moved, so a PIE above the arena gets no memory within 2 GiB of its code ([#5217](https://github.com/boykopovar/AnyPS5/issues/5217))
 - [sceLibcInternalBacktraceForGame](../../../core/libs/prx/libc/src/HeapDiagnostics.cpp) (libSceLibcInternal, implemented in libc) - `(const char* heapName)` and its return follow the `libc.prx` ASTRO BOT (PPSA21564 01.007.000) bundles: its four calls (0x6801, 0x7F46, 0xE75E, 0xEE02) are in the `malloc_stats` and `sceLibcMspaceMallocStats` paths, each after a `[%s] ...` line printed with the same heap name buffer, and the caller ignores the result and continues. The console's backtrace output is not reproduced: the heap name and the guest return address are written to the host standard error
-- [sceLibcInternalHeapErrorReportForGame](../../../core/libs/prx/libc/src/HeapDiagnostics.cpp) (libSceLibcInternal, implemented in libc) - `(void* heap, void* block, uint32 error)` follows the same `libc.prx` (call at 0xF634): it passes the heap, the block and the nonzero result of its block check, and then calls a function that never returns, so the report only has to return. The meaning of the error values is unknown; the three values and the guest return address are written to the host standard error
+- [sceLibcInternalHeapErrorReportForGame](../../../core/libs/prx/libc/src/HeapDiagnostics.cpp) (libSceLibcInternal, implemented in libc) - `(void* heap, void* block, uint32 error)` writes to the guest's standard output what a payload process on a PS5 (firmware 13.60) wrote: `[SceLibc] A heap error is detected.`, `[SceLibc] -- Mspace Name --`, then the C string at heap+0x3B0 followed by ` (%2u)` of the 32-bit value at heap+0x3F4 when it is not 0, the reason `segment out of range.` for error 1 only (38 other measured values print none), and `pid:<0x..> tid:<0x..>`, and returns. The pid and tid are the host's, where the console prints its own process and kernel thread ids. The block's contents did not change the console's output and it is not read here; the values and the guest return address also go to the host's standard error. A null heap faulted on the console and throws here. What the other heap fields and error values mean is unknown
 - [sceLibcPafMspaceCreate, Destroy, Malloc, Memalign, PosixMemalign, Free, Calloc, Realloc, Reallocalign, MallocStats and MallocStatsFast](../../../core/libs/prx/libc/src/Mspace.cpp) - PAF exports delegate to `sceLibcMspace` without malloc hooks; `Memalign` and `PosixMemalign` forward to their `Mspace` counterparts with owner ignored and are unverified on console. `Create`'s options block (version, type 1 or 2 at +2, field at +0x10) throws when non-null as its meaning is unknown. Block footers are not modelled, so owners are ignored: on PS5 firmware 13.60 mismatched owners in `Reallocalign` or in-place `Realloc` kill the process and `MallocStats` returns 1 if non-heap-owned blocks exist, which is not reproduced. `MallocUsableSize`, `Trim`, `IsHeapEmpty`, `CheckMemoryBounds`, `ReportMemoryBlocks` and `GetFooterValue` are not implemented.
 - [malloc_usable_size](../../../core/libs/prx/libc/src/ApplicationHeap.cpp) (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (`malloc_usable_size` in KytyPS5's `MallocReplace` order) and throws when the table leaves it null, like `malloc_stats_fast`
 - [malloc_stats_fast](../../../core/libs/prx/libc/src/GuestHeap.cpp) (libc) - with the default allocator it fills the 0x28-byte managed-size block as `sceLibcMspaceMallocStatsFast` does, from the default heap's own accounting, not Sony's allocator: the system sizes count the 1 MiB spans of its small-block classes and its committed large blocks, cached free ones included, and the in-use sizes count each handed-out block at its size-class or 64 KiB-granule size, header included. A block size below 0x28 or a null pointer returns 22, as in the mspace version; the version field is not checked. Ship of Harkinian (PPSA99320) calls it about 10 s after start-up.
-- [malloc, calloc, realloc, memalign, aligned_alloc and reallocalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - follow FreeBSD 11.4 `contrib/jemalloc/src/jemalloc.c` for failures, not measured on the console: a size the default heap rejects or the guest arena cannot place (including a `calloc` product that overflows) returns null with `errno` `ENOMEM`, and `memalign` and `aligned_alloc` return null with `EINVAL` for an alignment that is zero or not a power of two. FreeBSD's libc has no `memalign`, so setting `errno` there is assumed. A host commit failure for a block that fits in the arena (Windows `ERROR_NOT_ENOUGH_MEMORY`, `ERROR_OUTOFMEMORY` or `ERROR_COMMITMENT_LIMIT`, Linux `ENOMEM`) resets and releases the reserved range and returns null with `ENOMEM`; any other commit failure releases the range and throws. `reallocalign` returns null with `EINVAL` for an invalid alignment and `ENOMEM` like the others, which is an assumption as it is not in FreeBSD. `realloc(ptr, 0)` frees the block and returns null, where FreeBSD 11.4's jemalloc 4.5 resizes it to one byte and returns a block
-- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, not measured on the console: size 0 frees the block and returns null as `realloc` does here, so the block is not freed twice; when `realloc` fails because the application allocator returns null or the default heap rejects the size, the block is freed through the same allocator, `errno` is `ENOMEM` and null is returned. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc`
+- [malloc, calloc, realloc, memalign, aligned_alloc, reallocalign and posix_memalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - the console's own heap was measured in a payload process on firmware 13.60, not in a title. A heap a title replaces was not measured and keeps the FreeBSD jemalloc behaviour: `ENOMEM` on failure, `EINVAL` for an alignment that is zero or not a power of two, and `realloc(ptr, 0)` frees the block. With the console's heap, failures set `EINVAL`, and `errno` is left alone for a size above `SIZE_MAX - 0x1008f` (`SIZE_MAX - (A + 0x100af)` for an alignment over 32 rounded up to A), a `calloc` overflow or an alignment of 2^63 or more. Alignments round up to a power of two, and `realloc(ptr, 0)` keeps the block with 0 usable bytes. `reallocalign(ptr, 0, alignment)` for a block without that alignment was not measured and throws
+- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, as a payload process on a PS5 (firmware 13.60) does with the default heap (null and 0, size 0, 2^40 with `errno` 22 and the block freed, `SIZE_MAX` with `errno` untouched): size 0 does what `realloc` does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when `realloc` fails, the block is freed through the same allocator and null is returned with the `errno` that `realloc` left. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc`
 - [sceLibcMspaceReallocalign](../../../core/libs/prx/libc/src/Mspace.cpp) (libSceLibcInternal, implemented in libc) takes `(void* heap, void* block, size_t alignment, size_t size)`, the order of the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x13880, whose internal routine at 0x12390 treats the third argument as the alignment and, for a null block, passes it to the routine `sceLibcMspaceMemalign` uses). Measured on a PS5 (firmware 13.60) from a homebrew payload: a null block with alignment 4096 and size 100 returns a 4096-aligned block; an alignment of 0 or 3 succeeds and 100 gives a 128-aligned block, as the routine raises it to at least 32 and to the next power of two; an alignment of 2^63 or more returns null, keeps the block and leaves `errno` alone; and a size of 0 returns a block (the same one when it is already suitable) instead of freeing it. A block that is aligned and large enough is kept where it is, without giving back the bytes past the new size as the console's in-place resize does
 - [acosl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's `libc.prx`): results can differ from the console's in the last bit, and on Linux glibc sets `errno` to `EDOM` for `acosl` outside [-1, 1] where msun only raises the floating-point exception. `long double` is the x87 80-bit format, as Sony's `frexpl` uses it (`fldt 0x8(%rsp)`, result in `st(0)`)
 - [atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, as `acosl` is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's `log10l(1000)` is not exactly 3), and on Linux glibc sets `errno` to `EDOM` or `ERANGE` where msun only raises the floating-point exception. `ldexpl` and `truncl` are exact operations and give the console's result; `logb` and `remainder` give the console's value too, but on Linux glibc sets `errno` (`ERANGE` for `logb(0)`, `EDOM` for `remainder` by zero or of an infinity) where msun only raises the floating-point exception
 - [Dinkumware atomics](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) - every operation is sequentially consistent whatever memory order it is given, which is never weaker than the console. Matching the `libc.prx` bundled with PPSA08427 (that binary run side by side on every order from 0 to 7), `_Atomic_load_8` returns 0 for a release, acq_rel or invalid order and the 8-byte exchange and fetch operations return 0 without touching memory for an order above `memory_order_seq_cst`; the generic `_Atomic_copy`, `_Atomic_exchange` and `_Atomic_compare_exchange_*` lock the byte flag passed first, as the console does
+- [_Fetch_{and,or,xor}_seq_cst_{1,2,4}](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) follow the two-argument unsigned 8-, 16- and 32-bit helpers in Dinkumware [VC12 xatomic.h](https://github.com/ganboing/crt.vc12/blob/f1d47126bf13d1c9dccaa6c53b72217fd0474968/src/xatomic.h), using sequentially consistent atomic read-modify-write operations and returning the original value. The firmware 3.20 export inventory supplies the names and NIDs; the reference defines inline namespace helpers, so the equivalence to the console exports and their calling convention are inferred, not console-measured. A live, suitably aligned object is required as in the reference; invalid-pointer and misalignment fault behavior on the console is unverified. Windows tests cover raw and patched exports, values, neighboring storage and concurrent updates; a finite ordering litmus cannot prove the memory model.
 - [std_execute_once](../../../core/libs/prx/libc/Export.cpp) (libc) - assumed to be the plain-named twin of `std::_Execute_once` (`_ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1_`, the callee of Dinkumware `call_once`): it delegates there and gets the [thread.once.callonce] semantics already verified for that symbol (one invocation per flag, concurrent callers block until it completes, and a failing or throwing invocation leaves the flag unready so the next caller runs it). The name equivalence is not confirmed on a title, and the callback convention (called with (null, arg, null), non-zero return meaning success) is the twin's, unverified for this symbol
 - [__atomic_load, __atomic_store, __atomic_exchange and __atomic_compare_exchange](../../../core/libs/prx/libc/src/AtomicBuiltins.cpp) (libc) - the generic, size-parameterised libatomic entry points are a single `ud2` in the `libc.prx` bundled with PPSA08427 (disassembly), so the console traps on any call; these throw instead
+- [Sized __atomic calls](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) - the 36 `__atomic_load_N`, `__atomic_store_N`, `__atomic_exchange_N`, `__atomic_compare_exchange_N` and `__atomic_fetch_{add,sub,and,or,xor}_N` calls (N = 1, 2, 4, 8) are sequentially consistent whatever order they are given. The `libc.prx` bundled with PPSA08427, run side by side on random values and on every order from -1 to 7, switches on the order but always uses a locked instruction or CAS loop, except that a store with an order other than `memory_order_seq_cst` is a plain store, so these are never weaker than the console. Unlike `_Atomic_load_8` and the 8-byte `_Atomic_*` exchange and fetch calls above, the console accepts every order here, including release, acq_rel and invalid ones, and these do the same
 - [Dinkumware mutexes and conditions](../../../core/libs/prx/libc/src/Threads.cpp) (libc) use pointer-to-handle arguments, matching the console aerolib signatures reported in [#3079](https://github.com/boykopovar/AnyPS5/pull/3079). The title's `_Mtx_lock` maps `0` to `_Thrd_success` (0), `0x8002000b` to `_Thrd_busy` (3), and other failures to `_Thrd_error` (4); its internal mutex init recognizes recursive flag `0x100`, while every other type uses default attributes. The observed relock failure for a plain mutex suggests those defaults are error-checking, but that has not been confirmed on hardware. The title's `_Mtx_unlock` and `_Cnd_wait` return success regardless of their internal result. The host implementation treats invalid ownership preconditions as no-ops, and throws for invalid handles, host wait errors and destroying a locked mutex as debug guards; those cases are not confirmed against the console.
+- [_Mtx_timedlock](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `hPzYSd5Nasc`) follows the console's `libc.prx` at `0x5d50` (PPSA02530): it takes an absolute xtime and returns `_Thrd_timedout` (2) on expiry (`0x8002003c`) or 5 on other failures. On non-Windows hosts the native mutex and condition are `std::timed_mutex` and `std::condition_variable_any`; Windows keeps the `CRITICAL_SECTION`/`CONDITION_VARIABLE` pair because `std::condition_variable_any` failed `guest_libc_cnd_timed_wait` on the Windows runner, and its `_Mtx_timedlock` polls `TryEnterCriticalSection` until the deadline. Windows timing is not measured on the console.
 - [Floating-point compiler-rt builtins](../../../core/libs/prx/libc/src/FloatBuiltins.cpp) (libc) follow the `libc.prx` bundled with PPSA08427 (disassembly, and that binary run side by side on random inputs) where it differs from current compiler-rt: the soft-float `__add`, `__sub`, `__mul` and `__div` (`sf3`, `df3`) round to nearest, raise no exception flags and ignore MXCSR, here done with SSE under a default MXCSR that is restored afterwards; division flushes a quotient below the smallest normal to a signed zero; `__extendsfdf2` and `__truncdfsf2` copy NaN payloads unshifted; float-to-integer conversions do not saturate but shift the significand by a count masked to the shift width. `__mulsc3`, `__muldc3`, `__divsc3` and `__divdc3` fuse the same products as the console with `fma` and scale through the x87 like its `scalbn`, so their values match, but NaN payloads and exception flags can differ, as the host `fma` and `logb` are not the console's VEX FMA code and libm
-- [random, srandom, initstate, setstate](../../../core/libs/prx/libc/src/Random.cpp) (libc) follow FreeBSD 11 [random.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdlib/random.c): the additive feedback generator on a default 128-byte `TYPE_3` table, `good_rand` seeding, state sizes rounded down to 8, 32, 64, 128 or 256 bytes, and `setstate` returning the previous state or null for a rear position past the degree. `initstate` below 8 bytes returns null without setting errno, as that file and its manual do (glibc sets `EINVAL`). FreeBSD does not lock the generator; here every call is serialised by one lock, so concurrent callers draw the serial sequence between them. A null state throws, where FreeBSD faults. That the console's `libSceLibcInternal` uses this FreeBSD code and not another generator is unverified
+- [random, srandom, initstate, setstate](../../../core/libs/prx/libc/src/Random.cpp) (libc) - not measured: the state `setstate` returns and its null return for a rear position past the degree, `errno` after `initstate` below 8 bytes, a null state (throws here), an `initstate` seed other than 1, concurrent callers (one lock serialises every call here) and a title's own libc. Measured in a payload process on a PS5 (firmware 12.70): a fresh process draws the `srandom(1)` sequence; `srandom` seeds an additive feedback generator through a `good_rand` that reads its argument as an int32, turns 0 into 123459876 and applies `x = 16807 * (x % 127773) - 2836 * (x / 127773)`, adding 0x7fffffff to a negative result, which reproduces seeds 0, 1, 2, 12345, 0xffffffff and 0x80000000; `initstate` returns null at 0 and 7 bytes and selects types 0 to 4 by size as measured at 8, 15, 31, 32, 63, 64, 127, 128, 129, 255, 256, 257 and 1000 bytes.
+- [srandomdev](../../../core/libs/prx/libc/src/Random.cpp) (libSceLibcInternal, implemented in libc) is not verified against the console. The firmware 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibcInternal.c) names NID `a2MOZf++Wjg`; it follows FreeBSD 11 [random.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdlib/random.c), filling every active generator word from host OS entropy instead of `KERN_ARND`, then resetting additive feedback positions without warming up. An entropy failure throws rather than leaving `sysctl`'s failure unchecked. Calls share the generator lock.
 - [Integer compiler-rt builtins](../../../core/libs/prx/libc/src/IntegerBuiltins.cpp) (libc) - the console traps in `__divsi3`, `__modsi3` and the 64- and 128-bit divisions on a zero divisor (`div`) and in `__negv*`, `__absv*` and `__mulv*` on overflow (an abort helper, then `ud2`); these throw instead. As in the `libc.prx` bundled with PPSA08427 (disassembly), `__addv*` and `__subv*` wrap without an overflow check, and `__udivsi3`, `__umodsi3` and `__udivmodsi4` divide in software, giving a quotient of 0 and the dividend as remainder for a zero divisor; `__clzdi2` and `__ctzdi2` of 0 return 32 and `__clzti2` and `__ctzti2` of 0 return 64
 - [qsort](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) follows FreeBSD 11 [qsort.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libc/stdlib/qsort.c): Bentley and McIlroy's quicksort, with insertion sort below 7 elements and after a partition pass that swaps nothing, so elements that compare equal end in FreeBSD's order and the comparator is called in the same sequence. That the console's libc uses this FreeBSD code is unverified
 - [memcpy_s, memmove_s, strcpy_s, strncpy_s, strcat_s, strncat_s, wmemcpy_s, wmemmove_s, wcsncpy_s, wcscat_s, wcsncat_s](../../../core/libs/prx/libc/src/Strings.cpp) (libc) use the C11 Annex K destination size constraints, with RSIZE_MAX taken as (SIZE_MAX >> 1) / sizeof(char16_t) for wide operations and SIZE_MAX >> 1 for byte operations. An oversized destination size returns ERANGE (34) without touching the destination; the console's RSIZE_MAX and exact error value are unverified. Constraint violations return an error without invoking the registered constraint handler, as before.
+- [wcsncat_s and wcscat_s](../../../core/libs/prx/libc/src/Strings.cpp) (libc) refuse a copy as overlapping only when the written range `[dest + len1, dest + len1 + len2)` meets the read range `[src, src + len2)`. The rule comes from a static reading of the console's `wcsncat_s` in `libc.prx` (not run on a console); `wcscat_s` gets it through `wcsncat_s`, and its own console code was not read. The narrow `strncat_s` keeps a wider rule, `[dest, dest + used + length + 1)` against `[src, src + length + 1)`, whose console code was not read either, so it refuses some copies whose wide equivalent proceeds.
 - [snwprintf_s](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - follows C11 K.3.9.1.3 with `RSIZE_MAX` assumed to be `SIZE_MAX >> 1`. A runtime-constraint violation only returns a negative value: the handler installed with `set_constraint_handler_s` is not invoked, and the console's default handler is unknown. An invalid multibyte `%s` argument is copied byte by byte instead of being reported as an encoding error, as in `vswprintf`
-- [swprintf_s and vswprintf_s](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - follow C11 K.3.9.1.4 with `RSIZE_MAX` assumed to be `SIZE_MAX >> 1`: the complete output, including the terminating null, must fit in the buffer, otherwise it is a runtime-constraint violation that sets `buffer[0]` to zero and returns a negative value, and the buffer is not partially written. Argument and encoding checks match `snwprintf_s`
+- [swprintf_s and vswprintf_s](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - follow C11 K.3.9.1.4 with `RSIZE_MAX` assumed to be `(SIZE_MAX >> 1) / sizeof(char16_t)`: the complete output, including the terminating null, must fit in the buffer, otherwise it is a runtime-constraint violation that sets `buffer[0]` to zero and returns a negative value, and the buffer is not partially written. Argument and encoding checks match `snwprintf_s`
+- [strerror](../../../core/libs/prx/libc/src/Errors.cpp) (libc) - follows the `libc.prx` that CUSA04865 and CUSA12435 ship, loaded on a PS4 Pro (firmware 10.71): 0 gives "No error", 1 to 94 the FreeBSD texts, any other number "error_code=0x%08x", and errno is left alone. The console's system libc, which homebrew without a bundled `libc.prx` uses, answers differently ("No error information" for 0 and unknown numbers, 95 and 96 named). `strerror_r` and `perror` keep "No error: 0" and "Unknown error: %d"; they are not measured.
 - [strerror_s and strerrorlen_s](../../../core/libs/prx/libc/src/WideConversion.cpp) (libc) follow [C11 K.3.7.4.2 and K.3.7.4.3](https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf), using the existing FreeBSD error messages and unknown-error formatting. Truncation writes an ellipsis when capacity exceeds 3; constraint failures leave the destination untouched and invoke the registered guest-ABI handler. The console's `RSIZE_MAX` (`SIZE_MAX >> 1` here), nonzero returns (`EINVAL` 22 for constraints, `ERANGE` 34 for truncation), handler arguments and default abort behavior are unverified. Messages remain in the C locale, and guest errno is preserved.
-- [getw and putw](../../../core/libs/prx/libc/src/BinaryWordIo.cpp) (libc) follow FreeBSD 11.4 [getw.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/getw.c) and [putw.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/putw.c): one 32-bit little-endian word, `getw` returns -1 for EOF or an error, and `putw` returns 0 on success or -1 on error while holding the stream lock. They use the existing host-backed streams, so buffering and error timing follow the host CRT. Null streams throw and closed streams return -1 with `EBADF`, as existing byte I/O does. Console behavior is unverified.
+- [getw and putw](../../../core/libs/prx/libc/src/BinaryWordIo.cpp) (libc) follow FreeBSD 11.4 [getw.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/getw.c) and [putw.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/putw.c): one 32-bit little-endian word, `getw` returns -1 for EOF or an error, and `putw` returns 0 on success or -1 on error while holding the stream lock. They use the existing host-backed streams, so buffering and error timing follow the host CRT. Null streams throw and closed streams return -1 with `EBADF`, as existing byte I/O does. Console behavior is unverified. A payload process on a PS5 (firmware 13.60) gave the same results: two words written little-endian, -1 with end of file after them and for a 2-byte file, and -1 with the error flag for `putw` on a read-only stream
 - [vsnwprintf_s](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - `va_list` counterpart of `snwprintf_s` (C11 K.3.9.1.3): truncates to the buffer and returns the full length, with the same constraints and argument checks
-- [strndup and strdup](../../../core/libs/prx/libc/src/AllocatingStrings.cpp) (libc) return null with `errno` set to `EINVAL` (22) when `source` is null, preventing a host segfault on invalid guest input. POSIX.1-2008 and FreeBSD 11.4 libc leave `strndup(NULL)` and `strdup(NULL)` undefined (faulting); exact console behavior on hardware is unverified.
+- [strndup and strdup](../../../core/libs/prx/libc/src/AllocatingStrings.cpp) (libc) return null with `errno` set to `EINVAL` (22) when `source` is null, preventing a host segfault on invalid guest input. POSIX.1-2008 and FreeBSD 11.4 libc leave `strndup(NULL)` and `strdup(NULL)` undefined (faulting). The `libc.prx` that titles ship has no null check either (read from disassembly of PPSA13934's copy, not measured on a console): `strdup` (0x6b440) calls `strlen` and `strndup` (0x6b650) calls `strnlen` on the source before allocating, so both fault on a null source there, except `strndup(NULL, 0)`, whose `strnlen` reads nothing and which returns an empty copy; here it returns null with `EINVAL`.
 - [snprintf_s and vsnprintf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) - follow C11 K.3.5.3.5 and K.3.5.3.12 with `RSIZE_MAX` assumed to be `SIZE_MAX >> 1`, as `snwprintf_s` does: a null buffer or format, `size` of 0 or above `RSIZE_MAX`, any `%n` and a null `%s`, `%ls` or `%S` argument return a negative value and set `buffer[0]` to zero when the buffer and size allow it; otherwise the output is truncated to the buffer and the full length is returned. A violation only returns: the constraint handler is not invoked, and the console's error value is unverified. Not confirmed on a PS5 title
 - [vsscanf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) - returns the count of items converted before an undersized `%s`/`%c`/`%[` destination (0 when it is the first), not EOF. Not confirmed on a PS5 title
+- [setlocale](../../../core/libs/prx/libc/src/StdioExtras.cpp) (libc) knows only the "C" locale, as the `libc.prx` that titles ship does: it ignores the category, returns "C" for a null, empty or "C" name and a null pointer for any other, "POSIX" included, without setting `errno`. Checked by running the copies bundled with PPSA07923 and PPSA13934 side by side for categories -40 to 79 and 2^30, not measured on a console.
 - [localeconv](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, re-exported by libSceAmpr) - the 0x90-byte Dinkumware struct (empty monetary strings, `CHAR_MAX` for the 14 `char` fields, `decimal_point` ".", `_False`/`_True` "false"/"true") is read from the `libc.prx` that Astro's Playroom ships. It is a fixed C-locale table: whether the console changes it with `setlocale` is not known, and `_Frac_grouping`, `_Frac_sep`, `_No`, `_Yes` are empty strings as in that dump
 - [set_constraint_handler_s](../../../core/libs/prx/libc/src/WideConversion.cpp) (libc, re-exported by libSceAmpr) - the default handler is assumed to abort; each module keeps its own handler state, so a handler set through one library is not seen by the other. Within a module every `_s` function calls the installed handler, with the guest's calling convention. `ctime_s` and `asctime_s` follow the Dinkumware 26-byte format with `EINVAL` for a buffer under 26 bytes, a null pointer or an out-of-range weekday/month; `ctime_s` uses the guest time zone of `localtime_s`, and the console's exact checks are not verified
 - [qsort_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) sorts as `qsort` does and passes its context as the comparator's third argument, as FreeBSD 13's [`qsort_s`](https://github.com/freebsd/freebsd-src/blob/release/13.0.0/lib/libc/stdlib/qsort.c#L97-L127) (C11 Annex K) does. It returns `EINVAL` after calling the constraint handler when `n` or `es` exceeds `RSIZE_MAX`, or when `n` is not 0 and `a` or `cmp` is null; FreeBSD 11, which the rest of libc follows, has no `qsort_s`. An element size of 0 sorts nothing, where FreeBSD loops over the same address. The console's behaviour is unverified; the Quake homebrew (#6698) imports it from its `libOSMesa.so.8`
@@ -52,44 +68,65 @@
 - [__umodti3](../../../core/libs/prx/libc/src/RuntimeSupport.cpp) (libc) - the hardware traps on a zero divisor; this throws instead
 - [__modti3](../../../core/libs/prx/libc/src/RuntimeSupport.cpp) (libc) - the hardware traps on a zero divisor; this throws instead
 
-- [snprintf and vsnprintf](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) reject sizes above `INT_MAX + 1` with `EOVERFLOW` (84), a terminating NUL and return value -1, following FreeBSD 11.4 [snprintf.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/snprintf.c) and [vsnprintf.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/vsnprintf.c). This limit is unverified on the console. A null buffer at an oversized nonzero size returns the error without writing, where FreeBSD dereferences it.
+- [snprintf and vsnprintf](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) accept any size up to `SIZE_MAX`, as a payload process on a PS5 (firmware 13.60) does. A null buffer with a nonzero size throws here, where the console writes through it, and a result longer than `INT_MAX` throws, which was not measured
 
 ### Functional
 
 - [_Cosh](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the two-argument Dinkumware CRT helper used by `std::complex`, including a scaled large-finite-input path; the signature, exact result and floating-point exception behavior are not verified against the console.
-- [_FSinh and _FCosh](../../../core/libs/prx/libc/src/Math.cpp) (libc) finite results are not verified bit for bit against the console: the scaled product uses the host's binary64 hyperbolic function before rounding to binary32, rather than the float rational and `_FExp` sequence in PRAGMATA's bundled `libc.prx`. NaN preference and payloads, signed zeros, infinite operands and the range-error thresholds follow that binary's instructions; the system `libSceLibcInternal` implementation and nondefault flush-to-zero modes are unverified.
+- [std::thread::hardware_concurrency](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `CHrhwd8QSBs`) returns the host's `std::thread::hardware_concurrency()` (which may be 0 when unknown) instead of the console's processor count; no reference implements it and the value a title expects (PPSA34015 imports it) is unverified.
+- [fmodf](../../../core/libs/prx/libc/src/Math.cpp) (libc) - console `errno`, exception flags and NaN payloads remain unverified. The wrapper preserves `errno` like the existing double `fmod`, following FreeBSD 11.4 [`e_fmodf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_fmodf.c); host `std::fmod` still supplies the result and exception flags.
+- [_LCosh and _LSinh](../../../core/libs/prx/libc/src/Math.cpp) (libc) follow the two-argument Dinkumware CRT helpers `y * cosh(x)` and `y * sinh(x)`, including scaled large-finite-input paths; the signatures are confirmed by Dinkumware's public `ymath.h`, but the exact console results, range-error thresholds and floating-point exception behavior are not verified.
+- [_FSinh and _FCosh](../../../core/libs/prx/libc/src/Math.cpp) (libc) finite results are not verified bit for bit against the console: the scaled product uses the host's binary64 hyperbolic function before rounding to binary32, rather than the float rational and `_FExp` sequence in PRAGMATA's bundled `libc.prx`. NaN preference and payloads, signed zeros, infinite operands and the range-error thresholds follow that binary's instructions; the system `libSceLibcInternal` implementation and nondefault flush-to-zero modes are unverified. Against `libSceLibcInternal.sprx` on a PS5 (firmware 13.60), 12 of 36 measured results differ by one unit in the last place (`_FSinh(0.5, y)` and `_FCosh(1, y)`, `_FCosh(10, y)` for y of 0.5, 1 and 2); zeros, the overflow to infinity at 89 and 90 and the tiny-argument results matched
+- [_Divide, _FDivide, _Recip and _FRecip](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libc) follow the Dinkumware CRT division and reciprocal contracts with IEEE-754 signed-zero, infinity and NaN behavior. The exact console results, signaling-NaN handling and floating-point exception behavior are not verified.
 
 - [sscanf_s and vsscanf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) return `EOF` when a reached conversion has a null destination, stopping before further assignments, following C11 K.3.5.3.7 and K.3.5.3.14. Earlier assignments are retained. The constraint handler is not invoked, and console behaviour is unverified.
 - [memmem and memccpy](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - `memmem` searches for needle occurrences in memory buffers and `memccpy` copies buffers until a character match, following FreeBSD and POSIX specifications; behavior is unverified on console.
+- [strtof and wcstof](../../../core/libs/prx/libc/src/Strings.cpp) (libc) round to the nearest float, where the console's `_Stof` in `libSceLibcInternal.sprx` (0x734a0) does not always: about a third of decimal inputs within a relative 2^-51 of a point halfway between two floats, and some hexadecimal inputs with more than 24 significant bits, come out one unit apart in the last place (`1e-40` is `0x1.16c3p-133` there and `0x1.16c2p-133` here). The console's own rounding is not reproduced
+- [strtof and wcstof](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - `ERANGE` follows the `libc.prx` bundled with PPSA08427 (J03547016) and PPSA03671 (J03848509), both run side by side with this libc on a Linux host: a decimal input whose result is a nonzero subnormal sets it only when inexact, a hexadecimal one only when it lies below the smallest subnormal and rounds up to it, and underflow to zero and overflow set it. Both builds also take a `NAN(...)` payload in `strtof` from the sequence's leading digits (`nan(0x123)` is `0x7fc00123`, `-nan(5)` is `0xffc00005`); the sign is kept here, the payload is not. `libSceLibcInternal`'s `_Stof` differs: no `ERANGE` for hexadecimal input, a positive `nan`, and after a minus sign a failed parse is `-0.0` for a lone sign and `+0.0` before an `inf`/`nan` spelling, the reverse of `libc.prx`. Decimal `strtod` sets `ERANGE` for a nonzero subnormal in J03547016 but not in J03848509 or `libSceLibcInternal`, whose result is kept.
 
-- [Guest time conversions](../../../core/libs/prx/libc/src/Time.cpp) rewrite the host process `TZ` when a guest changes its own `TZ`, so other host consumers of that variable (including libSceRtc local time) shift too; code outside libc does not take the zone lock. Zone syntax follows the host C runtime, not FreeBSD: Windows only accepts the `std offset [dst]` form, treats an empty guest `TZ` as `UTC0` and reads `:Europe/Berlin` as an abbreviation (for example `rop`); only Linux honours zone file names. If the guest accepts a `TZ` value that the host rejects (on Windows, for example, one longer than the host environment limit), conversions throw `std::runtime_error`. A `tm_zone` saved before a `TZ` change can refer to storage now holding the new zone name, changing `%Z` output.
-- [__isfinitel](../../../core/libs/prx/libc/src/Math.cpp) - classifies the x87 80-bit exponent without narrowing to double or performing floating-point comparisons, following [FreeBSD msun](https://github.com/freebsd/freebsd-src/blob/main/lib/msun/src/s_isfinite.c). The signature and classification follow FreeBSD; console behaviour is unmeasured. Requires little-endian x87 long double stored in 16 bytes, as the existing guest long-double ABI does.
+- [Guest time conversions](../../../core/libs/prx/libc/src/Time.cpp) rewrite the host process `TZ` when a guest changes its own `TZ`, so other host consumers of that variable (including libSceRtc local time) shift too; code outside libc does not take the zone lock. Zone syntax follows the host C runtime, not FreeBSD: Windows only accepts the `std offset [dst]` form, treats an empty guest `TZ` as `UTC0` and reads `:Europe/Berlin` as an abbreviation (for example `rop`); only Linux honours zone file names. If the guest accepts a `TZ` value that the host rejects (on Windows, for example, one longer than the host environment limit), conversions throw `std::runtime_error`. A `tm_zone` saved before a `TZ` change can refer to storage now holding the new zone name; `strftime` does not read it.
+- [cbrtf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`s_cbrtf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_cbrtf.c): a 5-bit first guess from the exponent bits, then two Newton steps in double precision. It sets no `errno`, as the `libc.prx` that titles ship does not. Floating-point exceptions are not compared. It gives the same bits as the `cbrtf` of the `libc.prx` bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.
+- [__isfinitel](../../../core/libs/prx/libc/src/Math.cpp) - classifies the x87 80-bit exponent without narrowing to double or performing floating-point comparisons, following [FreeBSD msun](https://github.com/freebsd/freebsd-src/blob/main/lib/msun/src/s_isfinite.c). The signature and classification follow FreeBSD; console behaviour is unmeasured. Requires little-endian x87 long double stored in 16 bytes, as the existing guest long-double ABI does. On a PS5 (firmware 13.60) `__isfinitel` returned 1 for 0, -0, 1, a denormal and ±1e4000, and 0 for a NaN and for the maximum exponent without the integer bit, which this classification gives too
+- [logf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`e_logf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_logf.c), with `vzero` read at run time as msun's `volatile` read does. As in the `libc.prx` that titles ship, `errno` is set to `ERANGE` for ±0 and to `EDOM` for every argument with the sign bit set, negative NaNs and -inf included; positive NaNs and +inf leave it unchanged. Floating-point exceptions are not compared. It gives the same bits and `errno` as the `logf` of the `libc.prx` bundled with PPSA07923 and PPSA05916 for all 2^32 arguments, run on a Windows host. The FMA-contracted build bundled with PPSA13934 differs from it by 1 ulp on 961,881 arguments, so no single port matches every title's last bit.
 
 - Windows direct-memory backing reserves a paging-file section. A [direct memory page](../../../core/libs/prx/libc/include/WindowsMappings.hpp) mapped at one guest address is private write-watched memory at that address and is not committed in the section; a page mapped at a second address moves its whole resident run into the section (committed there) and every address becomes a view of it, tracked by write protection. An unmapped resident page that is not all zeros is kept in a private reservation until it is mapped again. Committed section contents remain across unmap/remap and are released when the backing and its remaining views are destroyed. A host import alias over part of a resident run is refused. Linux retains its existing backing. Peak gameplay memory and Windows versions other than the tested host remain unverified.
-- Stable Windows resident runs of at least 256 KiB use temporary read-only protection for clean write-watch proofs. The first CPU write restores the logical protection of the whole run; that run remains on native write watching until it is remapped, so repeatedly rewritten runs stay writable. Native kernel writes into guest buffers must hold [GuestArena::HostWrite](../../../core/libs/prx/libc/include/GuestArena.hpp), as shared views already require: an unbracketed WinAPI ReadFile can fail with ERROR_NOACCESS while the resident proof is armed. Guest read, pread and socket receive paths already bracket their destinations. GPU host-import access suppresses resident rearming without inventing shared-page stores. This is a host integration requirement, not a change to guest logical protection.
 - [getc_unlocked, putc_unlocked, getchar_unlocked, putchar_unlocked](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - byte I/O uses the host unlocked operations; guest EOF/error flags and macro counters follow `FileStream`. Linux status queries use `feof_unlocked`/`ferror_unlocked` because [glibc `feof`](https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/libio/feof.c) and [`ferror`](https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/libio/ferror.c) can acquire the stream lock. Windows uses [the CRT no-lock byte operations](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/fgetc-nolock-fgetwc-nolock) and `feof`/`ferror`, verified under a held stream lock on UCRT. Console behavior and other host CRTs remain unverified.
+- [strcasecmp and strncasecmp](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - console locale behavior is unmeasured. They use the guest's C-locale case conversion and return -1, 0 or 1, the sign of the folded unsigned-byte difference, as the `libc.prx` bundled with eleven titles does (FreeBSD 11.4's [strcasecmp.c](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/string/strcasecmp.c) returns the difference itself); other guest locales are not implemented.
 - [feof_unlocked and ferror_unlocked](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libSceLibcInternal, implemented in libc) have no console measurement. The firmware 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibcInternal.c) names NIDs `NuydofHcR1w` and `yxbGzBQC5xA`. They follow FreeBSD 11 [feof.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/stdio/feof.c) and [ferror.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/stdio/ferror.c), returning 0 or 1 from the stream status without acquiring the stream lock. They inherit the host CRT limitations of the unlocked byte operations above.
-- [fgetws, getwc, getwchar, putwc, putwchar](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; `fgetws` reads characters into the destination buffer until newline or EOF and null-terminates, returning null on stream error. Console wide stream buffering and encoding details remain unverified.
-- [Closed standard descriptors](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - on Linux and macOS, a descriptor 0, 1 or 2 that is closed when libc loads is opened on `/dev/null` (read-only for 0, write-only for 1 and 2) by a static initializer of libc, which runs before the libraries that depend on libc initialize and before the title starts. Within libc this relies on no static initializer opening a descriptor before it, which `guest_closed_standard_descriptors` checks. glibc does the same for set-user-ID programs ([`check_fds.c`](https://sourceware.org/git/?p=glibc.git;a=blob;f=csu/check_fds.c)). Without it the first descriptor a library opens, the write watch's `userfaultfd` for one, becomes the guest's standard input or output. What the console gives a title as its standard descriptors is not measured, and on Windows a process started without standard handles is not handled.
+- [gets](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libSceLibcInternal, implemented in libc, NID `Ok+SYcoL19Y`) follows [FreeBSD 11.4 gets.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/gets.c) for byte input, newline removal and EOF, without PS5 verification or known module/library versions. It reads the guest stdin under its stream lock and preserves the destination when EOF or a read error precedes any byte; a partial line is terminated and returned. A null destination throws; its console behavior is unverified. It emits no diagnostic; FreeBSD writes a warning once, and the console's diagnostic behavior and stream orientation are unverified.
+- [fgetws, getwc, getwchar, putwc, putwchar](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; `fgetws` follows the `libc.prx` that titles ship (read from disassembly of three titles' copies, PPSA13934, PPSA07923 and PPSA05916, not measured on a console): it returns null for a size below 2 without writing the buffer, `errno` or the stream, stores each `fgetwc` result as its low 16 bits until a newline (compared on all 32 bits), `-1` or a full buffer, and null-terminates and returns the buffer whenever it stored a character, also after a read error. A null buffer or stream, which the console dereferences, sets `errno` to 22 here. The calls the console makes before and after reading, and the one it makes when bits 0xC of the stream's second flag byte are set, are not reproduced. Console wide stream buffering and `fgetwc`'s decoding remain unverified.
+- [Closed standard descriptors](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - console startup descriptors remain unmeasured. [Halo: Combat Evolved's PS5 host](https://github.com/thelinkin3000/halo-ce-universal/blob/201e0f18011a30ea6d098ad249bf17eba005d653/port/ps5/host/host_main.c#L407-L429) expects 0 to 2 closed and opens its eboot on them; here it leaves them open. Missing descriptors are opened on `/dev/null` on Linux/macOS or `NUL` on Windows, read-only for 0 and write-only for 1 and 2. Windows also reattaches the UCRT streams before any guest `FileStream` captures their descriptor. Initialization runs before libraries depending on libc; no earlier libc initializer may consume a missing standard descriptor. The `guest_closed_standard_descriptors` and `guest_closed_standard_descriptors_windows` tests cover startup.
 - [Guest path names](../../../core/libs/prx/libc/src/General.cpp) (libc) are checked against FreeBSD 11.4's `NAME_MAX` (255 bytes per component) and `MAXPATHLEN` (1024 bytes with the terminating NUL) before they are resolved, and a longer name fails with `ENAMETOOLONG`, as `namei` does. The host's own limit still applies below that: on Windows a path whose host form exceeds `MAX_PATH` fails with `ENOENT`. A backslash counts as a path separator for the component length, because the guest path resolver turns it into `/` before the host call, while FreeBSD treats it as an ordinary name character, so a 301-byte name that contains one is accepted here. `sceNgs2ParseWaveformFile` resolves its path without a try block, so a long component ends in an uncaught `filesystem_error` there where a missing file ended in a `runtime_error` (both end the title). A path through a regular file (`file/x`, `file/`) is not always `ENOTDIR` on the calls that resolve it. None of this was measured on a console.
+- [Guest path names](../../../core/libs/prx/libc/src/General.cpp) (libc) fail on macOS with `ENAMETOOLONG` once their host form, the root directory followed by the guest path, reaches 1024 bytes, so a guest path of 1023 bytes, which FreeBSD accepts, fails there under any root directory
 - [ftrylockfile](../../../core/libs/prx/libc/src/RuntimeSupport.cpp) (libc) - tries the host CRT stream lock that `flockfile`, `funlockfile` and each locking host stdio call on the stream take, so it returns -1 while another thread holds the stream through `flockfile` or is inside such a call, and 0 when it acquires the lock or already owns it (recursively, released by as many `funlockfile` calls), as FreeBSD 11 [`_ftrylockfile`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/_flock_stub.c#L89-L104) does. A libc export holds the lock only for each host call it makes, not across several host calls or while it updates the guest `FILE` prefix. Linux uses glibc `ftrylockfile`. UCRT has no try variant of `_lock_file`, so Windows calls `TryEnterCriticalSection` on the `CRITICAL_SECTION` that `_lock_file` enters, found through the private UCRT stream layout (`__crt_stdio_stream_data` in `ucrt/inc/corecrt_internal_stdio.h`, unchanged from Windows SDK 10.0.19041 to 10.0.26100); another CRT or a change of that layout breaks it. A null or closed stream throws where FreeBSD dereferences it
+- [sinf, cosf, tanf and sincosf](../../../core/libs/prx/libc/src/Math.cpp) (libc) are FreeBSD msun's [`s_sinf.c`, `s_cosf.c` and `s_tanf.c`](https://github.com/freebsd/freebsd-src/tree/release/11.4.0/lib/msun/src) over its double-precision kernels and `e_rem_pio2f.c`, with `k_rem_pio2.c` (for `|x| >= 2^28 * pi/2`) ported only for one input word and `prec` 0; `sincosf` returns the two. As in the `libc.prx` that titles ship, only an infinite argument sets `errno` (`EDOM`); NaN leaves it unchanged. Floating-point exceptions are not compared. All four give the same bits and `errno` as the copies bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.
 - [fgetln](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libSceLibcInternal, implemented in libc) throws: in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x5FE80) the export is a `hlt` instruction, which faults in user mode and ends the process
 - [Wide-character conversions](../../../core/libs/prx/libc/src/Multibyte.cpp) (libc) - The wide `wcsto*` functions parse the ASCII prefix of the guest string, as the C locale accepts only ASCII white space and digits. The multibyte conversions follow the C locale of the console's `libSceLibcInternal.sprx`: UTF-8 of at most three bytes, so `_Getmbcurmax` returns 3, overlong forms and encoded surrogates decode, and four-byte forms are invalid. `__mb_cur_max` stays 1 like the console's variable; `___mb_cur_max` is not in that module and also stays 1, unverified. Other locales are not supported. With a null destination, `wcstombs` returns the byte count; the console's count is wrong when the capacity argument equals the running count, because it reads past the terminator
 - [realpath](../../../core/libs/prx/libc/src/RealPath.cpp) (libc) follows FreeBSD 11's [`realpath.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/libc/stdlib/realpath.c) except for symlinks. The console's guest filesystem has none, so a host symlink under the guest root is followed for existence and type but not expanded, and `..` drops the previous component lexically, as `Resolve` does for every guest path. Through a host link `linkdir -> sub/deep`, `linkdir/../x` gives `x` beside the link, not beside its target.
 - [strtod, strtof, strtold](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - `strtod` and `wcstod` (and `atof`, which calls `strtod` here) read a `NAN(...)` sequence as FreeBSD 11's gdtoa [`hexnan`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/contrib/gdtoa/hexnan.c) does: hexadecimal digits with an optional `0x`, blanks starting a new 32-bit word, the first 16 digits kept and the payload cut to 52 bits, a zero payload made 1, any other character giving the default NaN but consuming up to the closing parenthesis, and an unterminated sequence keeping its payload while consuming only `nan`. The payload goes under the quiet bit with the sign, as in gdtoa's [`strtod`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/contrib/gdtoa/strtod.c#L316-L328). `strtof`, `wcstof`, `strtold` and `wcstold` return the positive default quiet NaN (`0x7fc00000`; exponent `0x7fff`, significand `0xc000000000000000`) whatever the sign and the sequence, and consume a sequence of letters, digits and underscores up to its closing parenthesis. The console's `libSceLibcInternal.sprx`, called from a payload process on a PS5 (firmware 12.70), gives these results for the 64 NaN inputs tried through `strtod` and `strtof`, 50 of them also through `strtold` and `wcstod`, and 18 through `wcstof` and `wcstold`, and, through `strtod`, for `nan(1 2)` and for `nan( ` followed by NUL and `)`; that a title's own `libc.prx` does the same is assumed. In `hexnan`, a blank after a payload digit, while a 32-bit word of the payload is still free, starts a blank skip that has no NUL check, so when only blanks follow up to the terminating NUL the console's `strtod` reads past it: `nan(1 ` followed by NUL and `)` consumes the `)` after the NUL, so the result depends on the bytes after the string, and here that case throws. A blank right after `nan(` is skipped with a NUL check, and the console stopped at the NUL there
 - [remquol](../../../core/libs/prx/libc/src/MathExact.cpp) (libc) leaves `*quo` unchanged when the result is NaN; the `libc.prx` bundled with PPSA08427 writes a value that depends on earlier x87 state (`remquol(1, 0)` stored 0 on a first call and 4 on later ones)
-- [_Stod](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libSceLibcInternal, implemented in libc) throws for hexadecimal text with a non-zero power-of-ten scale. The console's result there does not follow a simple rule: `0x3` with a scale of -1 gives 0.29999999999999999
+- [_Stod, _Stodx, _Stofx, _Stoldx, _Stof and _Stold](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libSceLibcInternal, implemented in libc) throw for hexadecimal text with a non-zero power-of-ten scale. The console's result there does not follow a simple rule: `0x3` with a scale of -1 gives 0.29999999999999999. A nonzero subnormal result sets neither `errno` nor the error argument, as measured in firmware 13.60's `libSceLibcInternal.sprx` run in a Linux host process, not on a console; there about a fifth of decimal inputs with a subnormal result come out one unit apart in the last place (`_Stodx("2.2250738585072014e-308", 0)` is the largest subnormal), which is not reproduced
+- [_LDivide, _LRecip and _LLog](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libc) follow the public Dinkumware CRT contracts: long-double division and reciprocal, and the `_LLog` base flag (`0` natural, positive base 10, negative base 2). The exact console results, signaling-NaN behavior and floating-point exception behavior are not verified.
 - [Long double math in MathExact.cpp](../../../core/libs/prx/libc/src/MathExact.cpp) (libc) was compared with the `libc.prx` bundled with PPSA08427 only for canonical 80-bit encodings; unnormals, pseudo-denormals and pseudo-infinities passed to arithmetic functions (not the classifiers) follow the host x87 instead of the console
-- [rename, sceKernelRename](../../../core/libs/prx/libc/include/RenameDot.hpp) (libc, libkernel) fail a last path component of `.` or `..` with `EINVAL`, after FreeBSD 11.4's [`lookup`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_lookup.c), which refuses `.` and, through its `ISDOTDOT` and `ISLASTCN` flags, `..` as the last component for the `DELETE` and `RENAME` operations. `rmdir("dir/.")`, `unlink("dir/.")` and the same calls with `..` follow the same lookup rule in FreeBSD but are not changed here: the guest still resolves the dot component away and acts on `dir` or its parent. Both arguments are checked before any host access, so `rename` of a missing source onto `dir/.` answers `EINVAL`, where FreeBSD's [`kern_renameat`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_syscalls.c) looks the source up first and answers `ENOENT`. A backslash counts as a path separator here (the guest path resolver turns it into `/`); FreeBSD treats it as an ordinary name character. None of this was measured on a console.
-- [nan and nanf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return fixed quiet NaN values (`0x7fc00000` and `0x7ff8000000000000`), ignoring the tag argument as observed in the console's `libc.prx` (both exports load a global constant via `mov rax,[rip+..]; vmovsd xmm0,[rax]; ret`); VLC (PPSA85300) stops on nanf at start-up after strsep.
+- [atanf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`s_atanf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_atanf.c), with `atanlo[3]` read at run time as msun's `volatile` does. Tiny arguments return `x` without raising `FE_INEXACT`. It gives the same bits as the `atanf` of the `libc.prx` bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host, and none of those sets `errno`. Whether other titles' builds differ is unverified.
+- [rename, sceKernelRename](../../../core/libs/prx/libc/include/RenameDot.hpp) (libc, libkernel) fail a last path component of `.` or `..` with `EINVAL`, after FreeBSD 11.4's [`lookup`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_lookup.c), which refuses `.` and, through its `ISDOTDOT` and `ISLASTCN` flags, `..` as the last component for the `DELETE` and `RENAME` operations. `unlink`, `rmdir`, `sceKernelUnlink` and `sceKernelRmdir` follow the same rule. Both arguments are checked before any host access, so `rename` of a missing source onto `dir/.` answers `EINVAL`, where FreeBSD's [`kern_renameat`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_syscalls.c) looks the source up first and answers `ENOENT`. A backslash counts as a path separator here (the guest path resolver turns it into `/`); FreeBSD treats it as an ordinary name character. None of this was measured on a console.
+- [nan and nanf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return fixed quiet NaN values (`0x7fc00000` and `0x7ff8000000000000`), ignoring the tag argument as observed in the console's `libc.prx` (both exports load a global constant via `mov rax,[rip+..]; vmovsd xmm0,[rax]; ret`); VLC (PPSA85300) imports nanf.
 - [jrand48 and mrand48](../../../core/libs/prx/libc/src/Random.cpp) (libSceLibcInternal, implemented in libc) return the high 32 bits of the new 48-bit state zero-extended to 64 bits, as the console's `libSceLibcInternal.sprx` does when called from a homebrew payload process on a PS5 (firmware 12.70): a result with bit 31 set comes back between 0x80000000 and 0xFFFFFFFF, as FreeBSD 11.0's [`jrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/gen/jrand48.c#L23) and [`mrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/gen/mrand48.c#L25) return it; FreeBSD 11.1 and later cast it to `int32_t` ([`jrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.1.0/lib/libc/gen/jrand48.c#L26), [`mrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.1.0/lib/libc/gen/mrand48.c#L28)), which makes it negative. `lrand48` and `nrand48` matched FreeBSD there. Whether a title's own libc does the same is unverified
 - [seed48 and lcong48](../../../core/libs/prx/libc/src/Random.cpp) (libSceLibcInternal, implemented in libc) follow the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x6F460 and 0x6F420): the multiplier and addend are shared by the whole `rand48` family, including `erand48`, `nrand48` and `jrand48` on a caller's seed; `lcong48` sets them with the seed, and `srand48` and `seed48` restore 0x5DEECE66D and 0xB. Unlike FreeBSD, `seed48` returns a static copy of the new seed rather than the previous one. A null argument, which the console dereferences, throws
+- [drand48 and erand48](../../../core/libs/prx/libc/src/Random.cpp) (libc) return the upper 32 bits of the new 48-bit state over 2^32, as the `libc.prx` bundled with eleven titles does on 10,000 values per function; FreeBSD returns all 48 bits. Whether the console's `libSceLibcInternal.sprx` copy does the same is unmeasured.
 - [lgamma and signgam](../../../core/libs/prx/libc/src/Math.cpp) (libc) - `lgamma` returns the host's `lgamma` and stores the sign of Γ(x) in the exported `signgam` (NID `5gOOC0kzW0c`, starting at 0 as in FreeBSD 11's [`s_signgam.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/s_signgam.c)) by the rules of [`e_lgamma_r.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/e_lgamma_r.c): -1 for -0 and for a negative non-integer whose floor is odd, 1 otherwise, including poles, infinities and NaN. Taken from the FreeBSD source, not measured on the console. The NID is in the aerolib symbol list; no title is known to read `signgam`. PPSA99004 imports `lgamma`
+- [coshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows FreeBSD msun's [`e_coshf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_coshf.c), using the `expm1f` and `expf` paths already inlined for `sinhf` below; the Windows UCRT differed from the `libc.prx` copies in PPSA07923 and PPSA13934 on 500,554 and 500,614 of 20 million inputs in the #9707 survey. The exact system `libSceLibcInternal` behavior and the FMA-contracted `libc.prx` results remain unverified
+- [expm1](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_expm1.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_expm1.c) with `huge` read at run time, and sets `ERANGE` only when a finite argument overflows to infinity, as the titles' `libc.prx` does. It gives the same bits and `errno` as the `expm1` bundled with PPSA07923 and PPSA05916 on 320 million random and 47,222 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 43,433 of the random ones.
+- [log1p](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_log1p.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_log1p.c). As the titles' `libc.prx` does, it sets `EDOM` at msun's NaN return (arguments below -1, `-inf` and negative NaNs) and leaves `errno` alone for `log1p(-1)`, where it returns `-inf`. It gives the same bits, NaN payloads included, and `errno` as the `log1p` bundled with PPSA07923 and PPSA05916 on 320 million random and 68,216 structured arguments on a Windows host. The FMA-contracted build bundled with PPSA13934 differs on 73,682 of the random ones.
+- [nextafter and nextafterf](../../../core/libs/prx/libc/src/Math.cpp) (libc) do not compare floating-point exceptions, and their inputs are checked by sampling, not exhaustively. They are FreeBSD msun's [`s_nextafter.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafter.c) and [`s_nextafterf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafterf.c), with `ERANGE` at msun's overflow and underflow returns as the titles' `libc.prx` sets it; a step away from zero returns early and sets none. The copies bundled with eleven titles give the same bits and `errno` on 4,000,784 sampled pairs per function on a Windows host.
+- [tanh](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_tanh.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_tanh.c) over this file's msun `Expm1`, with `tiny` read at run time; it sets no `errno`, as the titles' `libc.prx` does not. It gives the same bits as the `tanh` bundled with PPSA07923 and PPSA05916 on 16 million random and 68,211 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 1,054 of them.
 - [sinhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `sinhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_sinhf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_sinhf.c) from before `__ldexp_expf`, which squares `expf(|x| / 2)` between `logf(FLT_MAX)` and the overflow threshold, calling msun's [`expm1f`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_expm1f.c) and [`expf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_expf.c), whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets `errno` to `ERANGE` before returning `x * 1e37`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system `libSceLibcInternal`, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return `libc.prx`, has the same code is assumed
+- [acoshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) exact system `libSceLibcInternal` behavior and FMA-contracted copies remain unverified. Positive finite inputs use [msun](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_acoshf.c) range handling and this file's `logf`; the middle range divides -1 before addition under directed rounding. Bits, errno and SSE/x87 status and controls match the supplied PPSA03766/PPSA07923 copies on 236,592 positive finite calls (4,929 inputs, four rounding modes, DAZ/FTZ combinations and sticky flags); these samples are not exhaustive. Invalid-domain errno and SSE/x87 invalid flags are checked against two supplied bundled copies; those samples are not exhaustive either.
 - [acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ (`y0f`, `y1f`, `ynf` follow the console at `+-0`). As in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x56410), `lgammal` does not store the sign in `signgam`; `hypotl` returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. [hypot3, hypot3f and hypot3l](../../../core/libs/prx/libc/src/Math.cpp) follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two
 - [asinl](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `asinl` of the `libc.prx` bundled with PPSA28319 (disassembly), FreeBSD msun's [`e_asinl.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/src/e_asinl.c) with the ld80 [`invtrig.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/ld80/invtrig.c) coefficients, which the binary holds as the same 80-bit constants. For |x| > 1, the infinities and NaN, Sony's error helper raises `FE_INVALID` and sets `errno` to `EDOM` before returning `(x - x) / (x - x)`, so a NaN argument also sets `EDOM`; msun itself sets no `errno`. 20 million random arguments in (-1, 1) give the same bits as that code run on a Windows host. The result needs the x87 precision control at 64 bits, as FreeBSD amd64 starts threads (control word `0x37f`), but guest threads do not set it: on Windows a thread started by `_beginthreadex` runs at 53 bits (`0x27f`), where `asinl(0.75)` returns mantissa `0xd91a98ae3406e000` instead of `0xd91a98ae3406e041`. The system `libSceLibcInternal` that RetroArch (PPSA99169) imports is assumed to have the same code
+- [acosf](../../../core/libs/prx/libc/src/Math.cpp) (libc) - for |x| > 1 and NaN the console stores `EDOM` and raises `FE_INVALID` before returning `(x - x) / (x - x)`; here those return the same NaNs and leave `errno` as it was (#3688). For |x| <= 1 it follows the `acosf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_acosf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_acosf.c), with the same constants, `pio2_lo` read at run time and the `0xfffff000` mask on `sqrtf(z)`, which the binary holds. Titles ship different builds of that `libc.prx`: PPSA13934's is FMA-contracted and differs from this one by 1 ulp on 129,170 inputs (#9668), so no single port matches every title's last bit.
 - [atanhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `atanhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_atanhf.c`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_atanhf.c) calling msun's [`log1pf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_log1pf.c), whose paths for the positive arguments it passes are inlined here; the exported `log1pf` is still the host's. For |x| > 1, the infinities and NaN, Sony's error helper raises `FE_INVALID` and sets `errno` to `EDOM` before returning `(x - x) / (x - x)`, and for |x| = 1 it raises `FE_DIVBYZERO` and sets `errno` to `ERANGE` before returning `x / 0`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits, `errno` and floating-point exceptions as this implementation for all 2^32 arguments; it was not run on Linux. That the system `libSceLibcInternal`, which Dusklight (PPSA99305) imports while bundling a zero-return `libc.prx`, has the same code is assumed
-- [j0, j1, jn, y0, y1 and yn](../../../core/libs/prx/libc/src/Bessel.cpp) (libc) call the host's `sin`, `cos`, `sincos` and `log`, so the last bits can differ from the console. The rest follows the system `libc.prx` built as `J03093718` (disassembly), which given the console's own `sin`, `cos`, `sincos` and `log` gave the same bits and exception flags for 90 million arguments: msun's [`e_j0.c`, `e_j1.c` and `e_jn.c`](https://github.com/freebsd/freebsd-src/tree/release/10.0.0/lib/msun/src) with each multiply-add the console fuses done as one FMA. As in that release, before FreeBSD commit `186f620727`, `y0`, `y1` and `yn` return `-inf` for ±0 and `0x7ff8000000000000` for a negative argument without raising an exception. The console's `y0f`, `y1f` and `ynf` raise none either, unlike [ours](../../../core/libs/prx/libc/src/Math.cpp), which raise `FE_DIVBYZERO` at ±0. The order wraps at 32 bits as on the console: `jn(1 << 30, x)` never returns for 2^-29 <= |x| < 2^30
+- [j0, j1, jn, y0, y1 and yn](../../../core/libs/prx/libc/src/Bessel.cpp) (libc) call the host's `sin`, `cos`, `sincos` and `log`, so the last bits can differ from the console. The rest follows the system `libc.prx` built as `J03093718` (disassembly), which given the console's own `sin`, `cos`, `sincos` and `log` gave the same bits and exception flags for 90 million arguments: msun's [`e_j0.c`, `e_j1.c` and `e_jn.c`](https://github.com/freebsd/freebsd-src/tree/release/10.0.0/lib/msun/src) with each multiply-add the console fuses done as one FMA. As in that release, before FreeBSD commit `186f620727`, `y0`, `y1` and `yn` return `-inf` for ±0 and `0x7ff8000000000000` for a negative argument without raising an exception. The order wraps at 32 bits as on the console: `jn(1 << 30, x)` never returns for 2^-29 <= |x| < 2^30
 - [getenv, setenv, unsetenv, putenv](../../../core/libs/prx/libc/src/Environment.cpp) (libc) keep one guest environment that starts empty, like the `environ` libkernel exports, and never reads or changes the host's. A title sees only the variables it sets itself; host variables such as `HOME` and `PATH` name host paths a guest cannot use (PS5MC, PPSA99420, exits with `XBMC_Run returned -1` when it gets the host's `HOME`). Whether the console starts a title with any variables set is not measured
 - [mergesort](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) checks its arguments like the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x762D0): an element size under 4 sets `errno` to `EINVAL` (22) and returns -1, an empty array returns 0, and a failed `malloc` of the count times the size plus 8 bytes returns -1. The sort is a stable bottom-up merge, not FreeBSD's natural merge with its insertion sort for short runs, so the comparator is called in a different order and number of times; the result is the same for a consistent comparator. A null base or comparator and a size product that overflows, which the console does not check, throw
 - On macOS the [write watch](../../../core/libs/prx/libc/src/GuestWriteWatch.cpp) write-protects watched pages and records the first write to each from a SIGBUS/SIGSEGV handler, because macOS has no counterpart to `userfaultfd` write-protect or `MEM_WRITE_WATCH`. The protection is real, so:
@@ -107,35 +144,53 @@
 - The [`_Unwind_Context`](../../../core/libs/prx/libc/include/exceptions/Unwind.hpp) that `_Unwind_Backtrace` passes to its callback starts with a table laid out like LLVM libunwind's `AbstractUnwindCursor` virtual table, because homebrew built with the ps5-payload-dev SDK links libunwind statically and reads the frames with its own `_Unwind_GetIP` (`__unw_get_reg`), which calls through that table. Only register reads and writes (`validReg`, `getReg`, `setReg`, with `UNW_REG_IP` and `UNW_REG_SP`), `validFloatReg` (always false) and `isSignalFrame` are answered; the other slots throw. The layout follows libunwind's `UnwindCursor.hpp`, not the console's own `libSceLibcInternal`, which is not checked
 - The Windows libc [exception unwinder](../../../core/libs/prx/libc/src/exception/Unwind.cpp) cannot run arbitrary Windows exception or termination handlers. It accepts GCC C and C++ handlers identified by a project's `.sehgcc` section and interprets their LSDA with the guest personalities. A handler in an unmarked module, such as a C++ cleanup through `__gxx_personality_seh0` in `libstdc++-6.dll` or a system DLL function like `qsort` in `ucrtbase.dll` (Windows 10 22H2), still stops unwinding and the exception is reported as unhandled. SjLj exceptions are unsupported; Scoop GCC 15.2.0 selects them when SEH is disabled and lacks the System V ABI SEH compiler fix carried by MSYS2.
 - The libc [SSE4a trap emulation](../../../core/libs/prx/libc/src/specifics/windows/Sse4aEmulation.hpp) on Windows is superseded by `--to-intel` and remains only until the relinked title has been verified without it.
-- [getifaddrs](../../../core/libs/prx/libc/src/Interfaces.cpp) (libc) lists host interfaces and IPv4/IPv6 addresses in FreeBSD's layouts. Windows omits per-interface AF_LINK entries and interfaces without an address; its flags are only `IFF_UP`, `IFF_RUNNING`, `IFF_LOOPBACK`, `IFF_BROADCAST` and `IFF_MULTICAST` (PPP/tunnel adapters omit broadcast and point-to-point, and an unspecified prefix length gets a host mask). On Linux, `AF_LINK` `if_data` maps non-Ethernet/loopback/PPP types to `IFT_OTHER` (1) and leaves `ifi_omcasts`, `ifi_noproto`, `ifi_hwassist`, `ifi_metric`, `ifi_epoch`, `ifi_lastchange`, unknown baud rates and address-entry `ifa_data` as 0/null; a point-to-point address without a peer loses `IFF_POINTOPOINT`, and an omitted IPv4 broadcast is derived from the netmask. Interface names are the host's (`if<index>` on Windows above 15 bytes).
-- [gethostname](../../../core/libs/prx/libc/src/Hostname.cpp) (libc) reports the fixed guest name `AnyPS5` without querying the host machine name. Buffer copying, null queries and `ENAMETOOLONG` follow [FreeBSD gethostname](https://github.com/freebsd/freebsd-src/blob/main/lib/libc/gen/gethostname.c); the console's configurable hostname and its integration with `sysctl` and name resolution are unverified and not implemented.
+- [getifaddrs](../../../core/libs/prx/libc/src/Interfaces.cpp) (libc) lists host interfaces and IPv4/IPv6 addresses in FreeBSD's layouts. Windows and macOS omit per-interface AF_LINK entries and interfaces without an address; on Windows the flags are only `IFF_UP`, `IFF_RUNNING`, `IFF_LOOPBACK`, `IFF_BROADCAST` and `IFF_MULTICAST` (PPP/tunnel adapters omit broadcast and point-to-point, and an unspecified prefix length gets a host mask). On Linux, `AF_LINK` `if_data` maps non-Ethernet/loopback/PPP types to `IFT_OTHER` (1) and leaves `ifi_omcasts`, `ifi_noproto`, `ifi_hwassist`, `ifi_metric`, `ifi_epoch`, `ifi_lastchange`, unknown baud rates and address-entry `ifa_data` as 0/null; a point-to-point address without a peer loses `IFF_POINTOPOINT`, and an omitted IPv4 broadcast is derived from the netmask. Interface names are the host's (`if<index>` on Windows above 15 bytes).
+- [gethostname](../../../core/libs/prx/libc/src/Hostname.cpp) (libc) reports an empty name without querying the host machine name, as a payload process read on a PS5 (firmware 13.60): 0 with only the terminator for a 256-byte and a 1-byte buffer. Buffer copying, null queries and `ENAMETOOLONG` follow [FreeBSD gethostname](https://github.com/freebsd/freebsd-src/blob/main/lib/libc/gen/gethostname.c); whether a title process or a console with a configured name reads another name, and the integration with `sysctl` and name resolution, are unverified and not implemented.
 - [wctomb_s, wcrtomb_s, mbstowcs_s and mbsrtowcs_s](../../../core/libs/prx/libc/src/BoundsChecking.cpp) (libc) follow the console's `libc.prx`, but convert in the single-byte C locale of `wctomb`, `wcrtomb` and `mbrtowc` (`MB_CUR_MAX` 1): a character above 0xFF is `EILSEQ` in `wctomb_s` and `wcrtomb_s`, and each byte is one wide character in `mbstowcs_s` and `mbsrtowcs_s`. The locale of a title's `libc.prx` was not measured. The `wcrtomb_s` path where a character does not fit `smax` and the `EILSEQ` paths of `mbstowcs_s` and `mbsrtowcs_s` are not reached
 - [wcsrtombs_s](../../../core/libs/prx/libc/src/Multibyte.cpp) (libc) follows the console's `libc.prx`, but a runtime-constraint violation only returns its error: the default handler there writes the message and a newline to `stderr` before returning, which is not done here. Conversion uses the C locale of `wcrtomb` (`MB_CUR_MAX` 1), so the path where a multibyte character does not fit the remaining space is not reached
 - [c16rtomb, c32rtomb, mbrtoc16 and mbrtoc32](../../../core/libs/prx/libc/src/Multibyte.cpp) (libSceLibcInternal, implemented in libc) - a null state, which the console dereferences, throws. Otherwise they follow the console's `libSceLibcInternal.sprx` (0x7D480 to 0x7D920), read from disassembly: UTF-8 whatever the locale, up to six bytes per sequence, with no surrogate or 0x10FFFF check when encoding. The state holds the value in its first eight bytes and the expected byte count (0x10 for a pending low surrogate, 1 for a stored high one) as 16 bits at 0xA. `mbrtoc16` builds a low surrogate from the value the state last held, `c16rtomb` returns -1 without `errno` for an unpaired high surrogate, and `EILSEQ` is 86. On a PS5 (13.60) the system library's default locale converts UTF-8 in `wcrtomb`, `wctomb`, `mbrtowc` and `mblen`; a title's bundled `libc.prx` does too until `setlocale` installs a table ([disassembly](https://github.com/boykopovar/AnyPS5/pull/8855#issuecomment-6335267758))
-- [The narrow printf family](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) converts 16-bit guest wide arguments to UTF-8 on both platforms, independently of the host locale. It does not go through the guest's `wcrtomb`; the console's treatment of invalid UTF-16 and locale-specific encoding remains unverified. Linux retains host formatting for formats without wide arguments, `%m` or `%p`, so a NaN there still follows the host (glibc prints its sign, `-nan`, and honors the `+` and space flags, where FreeBSD prints `nan`); argument positions above 99 (FreeBSD's `NL_ARGMAX`) throw when a format requires the guest formatter
+- [The narrow printf family](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) follows a payload process on a PS5 (firmware 13.60): each 16-bit unit of a `%ls` or `%lc` argument is encoded alone, so a surrogate pair gives two 3-byte sequences; a NaN keeps its sign and the `+` and space flags, and `0` pads it with spaces; argument positions above 99 work (up to 400 measured; above 65535 throw here); an unknown conversion such as `%m` or `%k` prints `%` and its letter, padded to the width, without taking an argument. The guest's `wcrtomb` and locales are not used. On Linux the formats without those conversions or a floating-point conversion go to glibc, which prints NaN the same way. The `_s` forms throw for an unknown conversion, `%m` included, which was not measured
+- [%a and %A](../../../core/libs/prx/libc/include/WindowsFormatting.hpp) (libc) format a finite double as the `libc.prx` that titles ship does, instead of through the host: a subnormal is normalised (`0x1p-1074`), a shorter precision rounds half up on the dropped hexadecimal digits and a carry stays in the leading digit (`%.3a` of `0x0.fffffffffffffp-1022` is `0x2.000p-1023`), and `-` overrides `0`. Checked by running the copies of PPSA13934, PPSA07923 and PPSA05916 side by side on 7 million random formats, not measured on a console. Infinities and `long double` still go to the host; NaN keeps its sign and flags through the formatter on current main.
+- [%e, %f and %g](../../../core/libs/prx/libc/include/WindowsFormatting.hpp) (libc) format a finite `double` or `long double` as the `libc.prx` that titles ship does, instead of through the host. It keeps the exact decimal digits down to position `4 * floor(k / 4) - 20`, where `k` is the `frexp` exponent times 30103 / 100000 truncated, and prints zeros after them; a shorter precision rounds half up on the kept digits, except that an exact tie rounds down when `k` is at least 8 (`%.0f` of 67108865.5 is `67108865`). The console computes the kept digits in extended precision, so about 7% of outputs longer than 17 significant digits end one unit lower than here (`%f` of 1e22 is `9999999999999999999999.000000`). Checked by running the copies of PPSA07923, PPSA05916 and PPSA13934 side by side, not measured on a console. The wide printf family uses the same digits, as the titles' `swprintf` gives the same text as their `snprintf`.
 - [%p and %lp](../../../core/libs/prx/libc/include/WindowsFormatting.hpp) (libc) follow the console's `libSceLibcInternal.sprx` measured from a homebrew payload on firmware 12.70 ([#7549](https://github.com/boykopovar/AnyPS5/issues/7549)), not FreeBSD: bare lowercase hex with no `0x` prefix even under `#`, `0` for a null pointer, `+` and the space flag ignored, the width counting only the digits, `-` padding on the right, `0` padding with zeros when there is no precision, the precision as the minimum number of digits, nothing for a null pointer under `%.0p`, and `l` accepted. Only `snprintf` and `swprintf` of that module were measured, from a payload process rather than a title process, so a width beside `%.0p`, the `0` flag beside a precision (which C17 ignores) and `%.0p` of a non-null pointer follow this formatter's own rules and are not measured; `swprintf` was not run with `%lp`, so the wide family still refuses that conversion and returns -1. Linux routes `%p` and `%lp` to this formatter because glibc prints the FreeBSD form and `(nil)` for a null pointer, which means a format that combines `%p` with a conversion this formatter refuses, such as an argument position above 99, throws there instead of reaching glibc
 - [collate<char> and collate<wchar_t> _Getcat](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) build the facet for the C locale only and throw for any other locale name, the wide entry point following the narrow one it sits next to. The wide facet carries its own vtable, whose `compare`, `transform` and `hash` take the guest's 16-bit characters, so the length of a range is a count of characters: `compare` orders by 16-bit value (the C locale, as Dinkumware's `char_traits<wchar_t>::compare` does), `transform` copies the characters into the result and records size and capacity in 16-bit elements (inline capacity 7, heap capacity `length | 7`, `(capacity + 1) * 2` bytes including the terminator), following Dinkumware's [VC12 `basic_string`](https://github.com/ganboing/crt.vc12/blob/f1d47126bf13d1c9dccaa6c53b72217fd0474968/src/xstring#L500-L531), and `hash` mixes one whole character per round, so wide text below 0x100 hashes like its narrow spelling and a character above 0xff hashes as one value instead of the two bytes it holds. The console's `libc.prx` exports both `_Getcat` (NIDs BSVJqITGCyI and 2wz4rthdiy8) with identical 0x19d-byte bodies, believed to build the same 0x20-byte facet; the console bodies themselves are unreadable (obfuscated dynsym, and the text of the relinked `libc.prx` is zeroed), so the wide entries follow the narrow algorithm and the C locale instead of the console's wide code, and no console run checks the two. The console's `libc.prx` stores pointers to its collation state tables at offsets 0x10 and 0x18 of the facet; ours leaves them null, as only the facet's own functions read them. `do_transform` throws for input with embedded null characters, which the console drops depending on the output buffer size. The narrow result capacity (`length | 15`) and the over-aligned storage of results of 4080 characters or more follow the console's `libc.prx` code and are not checked on hardware. No module of the PPSA59322, PPSA76677 or PPSA97358 dumps in this tree imports either `_Getcat`, so neither has been exercised by a title.
+- [codecvt, numpunct, num_put and time_put _Getcat](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) build facets matching a bundled console `libc.prx` (dynsym decoded by NID, vtables disassembled): categories 2, 4, 4 and 5, sizes 0x10, 0x30, 0x10 and 0xb8. `codecvt<char>` reproduces the console virtuals (`noconv` conversions, `length` the shorter range); `numpunct<char>` copies its C-locale table (`""`, `.`, `,`, `false`, `true`). `num_put`/`time_put` formatting virtuals throw rather than fabricate output, and `time_put`'s `_Locinfo` table is unpopulated — the console's `do_put` bodies were not mirrored. The facets share the no-op `destroy`/`deleteObject`/`retain`/`release` base used for `collate`, so `numpunct`'s static C-locale strings are never freed. Unlike `collate`, these `_Getcat` entries ignore the locale argument and always build the C-locale facet; the console's behaviour for a non-C name is unverified. `std::clog` and `std::wclog` are 0x400-byte zeroed objects like the rest of the `NSTDSTR` stream set (the console's `libc.prx` sizes `std::clog` at 96 bytes, measured from its dynsym `st_size`), and the `numpunct<char>::id` and `time_put<char>::id` objects are 8-byte zeros like the other facet ids.
 - [std::__throw_bad_variant_access](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) throws `std::bad_variant_access` with the `what()` string `bad_variant_access`, the one [LLVM libc++](https://github.com/llvm/llvm-project/blob/main/libcxx/src/variant.cpp) returns, since the export carries libc++'s `__throw_bad_variant_access` name; the console's string is unverified. Onimusha: Way of the Sword (PPSA27836 01.000.001) imports it from `libc`, and its bundled `libc.prx` does not export it.
-- [std::bad_optional_access and std::_Throw_bad_optional_access](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) provide the exception type, constructor, destructor, and `what()` exports alongside `_Throw_bad_optional_access`, returning the `what()` string `bad_optional_access` matching Dinkumware and libc++ conventions; the console libc.prx string is unverified. PPSA26578 (issue #7624) and PPSA34015 import `_ZSt26_Throw_bad_optional_accessv` (`KwzEip7m6TM`) from `libc`, and fail to load on main with unresolved import (0xC0000139).
+- [std::bad_optional_access and std::_Throw_bad_optional_access](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) provide the exception type, constructor, destructor, and `what()` exports alongside `_Throw_bad_optional_access`, returning the `what()` string `bad_optional_access` matching Dinkumware and libc++ conventions; the console libc.prx string is unverified. PPSA26578 (issue #7624) and PPSA34015 import `_ZSt26_Throw_bad_optional_accessv` (`KwzEip7m6TM`) from `libc`.
 - [The scanf family](../../../core/libs/prx/libc/src/Formatting.cpp) (libc), the `_s` forms included, decodes the input of the 16-bit wide conversions (`%ls`, `%lc`, `%l[`, `%S`, `%C`) on Linux as UTF-8, mirroring the narrow printf family, where FreeBSD uses the locale's `mbrtowc` (one byte per character in the C locale); the console's locale encoding is unverified. Input that is not UTF-8, a character outside the BMP, a scanset member outside ASCII, positional arguments next to a wide conversion and wide conversions in `fscanf` throw. Each character is stored as one 16-bit unit, widths and `_s` sizes count characters, and a `%lc` field cut short by the end of the input keeps what it read, as FreeBSD's `convert_wchar` does. Windows hands `%ls`, `%lc` and `%l[` to the host, whose `wchar_t` is 16 bits
 - [The scanf family](../../../core/libs/prx/libc/include/WindowsScanning.hpp) (libc) on Windows returns 0, as C17 and FreeBSD do, when input fails after only suppressed conversions have completed (`sscanf("12", "%*d%d", &value)`). Linux hands the format to glibc, which returns `EOF` there. On Windows the host stops a `%x`, `%X`, `%i` or `%p` after the `x` of a `0x` that no hex digit follows (or that the width cuts off), and a float conversion (`%e`, `%f`, `%g`, `%a`) after the `e` of an exponent with no digits (`1e`), where C17 and FreeBSD stop before the `x` or the `e`
+- [The scanf family](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) on Linux reads a `q` length as `ll`, as glibc does. On Windows a `q` directive ends the scan with nothing stored, as the console's own libc does for `%qd`; FreeBSD 11.4's source reads it as `ll`.
 - [Guest path resolution](../../../core/libs/prx/libc/src/General.cpp) falls back to ASCII case-insensitive component lookup, following [shadPS4's host filesystem](https://github.com/shadps4-emu/shadPS4/blob/945dbc3cc3eee80ac3e053b438502ed936fa6bb2/src/core/file_sys/backends/host_fs.cpp). PPSA03747 requests `Skyrim.INI`, `Data/Video` and lowercase archive/plugin names that differ from the dump's filenames. Exact host names take precedence; multiple fallback matches throw instead of selecting an arbitrary file. Existing parent names are resolved when creating a new file, and guest mount aliases use the same ASCII comparison. Results are not cached, so renames and newly created files remain visible. Unicode case folding and PS5 behaviour for case-colliding host entries are unverified; host roots are used as supplied. Explicit native Windows drive and UNC paths bypass guest parent-component validation.. A relinked module's `<name>.guest.prx` is matched the same way when the original module is not beside it: Borderlands 4 (PPSA01494) loads `/app0/prx/libRenoirCore.PS5.prx`, which it ships as `librenoircore.ps5.prx`. A relinked module request that misses both the exact and the case-insensitive `<name>.guest.prx` takes the sibling whose stem (the name without its last extension, ASCII case ignored) equals the requested stem and that ends with `.guest.prx`, shortest name first: Unity IL2CPP titles load `Media/Modules/<name>.prx` and `Media/Plugins/<name>.prx`, and the relinker names the converted module after the ELF it was built from, `<name>.elf.guest.prx`. The console's module namespace is assumed to ignore case and the extension; several stem matches pick the shortest name instead of throwing, which is not measured on a console
+- [Guest file names on Windows](../../../core/libs/prx/libc/src/General.cpp) (libc) are not escaped or mapped before the host call, so names Windows treats specially differ from FreeBSD, where only `/` and NUL are special. `a*b`, `a?b`, `a<b>c`, `a|b` and `a"b` fail with `EINVAL` (22) where FreeBSD creates them. `trail.` and `trail ` both create the host file `trail`, so three FreeBSD names are one file here. `NUL` and a reopen of it succeed, but no file is created. `con`, `aux.txt` and `COM1` create ordinary files. Colons are under Colons in guest names. Measured on Windows 11 (10.0.26200), MinGW-w64 GCC 15.2.0 r7, with `open` (`O_CREAT|O_EXCL|O_WRONLY`), a one-byte write and a listing of the host directory; not measured on Linux or a console. A fix needs a guest-to-host name mapping.
 - [Colons in guest names](../../../core/libs/prx/libc/src/General.cpp) (libc) - on Windows (NTFS) a guest name containing `:` is not a plain file name: `name:stream` opens or creates the alternate data stream `stream` of the file `name`. Creating `/savedata0/C:file` makes an empty file `C` whose stream `file` holds the data, and `stat` of `/savedata0/C` then reports a regular file. `mkdir` of a name containing `:`, such as `C:` or `dir:x`, fails with EINVAL. `name:stream` already behaved this way before drive-letter components were kept under their mount
-- [tzname](../../../core/libs/prx/libc/src/Time.cpp) (libc) points at the host's zone names, read at load and again by `tzset`: the abbreviations a `TZ` string gives (`EST5EDT` is `EST` and `EDT` on both hosts), but on Windows without `TZ` the CRT's full names such as `GMT Standard Time`, which ICU's [uprv_tzname](https://github.com/unicode-org/icu/blob/457157a92aa053e632cc7fcfd0e12f8a943b2d11/icu4c/source/common/putil.cpp#L1244-L1264) (ES-DE in PPSA99169) cannot map to a zone ID. A zone with no daylight-saving time has `tzname[1]` empty on Windows and equal to `tzname[0]` on Linux, where FreeBSD leaves three spaces. The console's names are not known
-- [Trailing slash on a mount alias](../../../core/libs/prx/libc/src/General.cpp) (libc) - on Windows a trailing slash after a file name under a mount alias such as `/savedata0` is still dropped, so `unlink`, `rename`, `open` and the other path calls act on the file where FreeBSD 11.4's `lookup()` fails with `ENOTDIR`; Linux and macOS pass the slash to the host, as for paths outside an alias
+- [tzname](../../../core/libs/prx/libc/src/Time.cpp) (libc) points at the host's zone names, read at load and again by `tzset`: the abbreviations a `TZ` string gives (`EST5EDT` is `EST` and `EDT` on both hosts), but on Windows without `TZ` the CRT's full names such as `GMT Standard Time`, which ICU's [uprv_tzname](https://github.com/unicode-org/icu/blob/457157a92aa053e632cc7fcfd0e12f8a943b2d11/icu4c/source/common/putil.cpp#L1244-L1264) (ES-DE in PPSA99169) cannot map to a zone ID. A payload process on a PS5 (firmware 13.60) read both names empty with `TZ` unset, and its `%Z` printed nothing whatever `tm_zone` held; the names a title process sees are not known
 - [localtime, mktime](../../../core/libs/prx/libc/src/Time.cpp) (libc) on Windows convert through the CRT's `localtime_s` and `mktime`, which accept about 1970 to January 3001 UTC and apply the CRT's daylight-saving rule. A time outside that range is converted a whole number of 400-year Gregorian cycles away, where the calendar repeats, so it gets the rule the CRT applies to that year and not the zone's historical one. On macOS `mktime` converts through the host's `mktime`, which refuses every year before 1900. A local time before 1900 is instead solved for directly: the offset `localtime_r` gives for a candidate time, which follows the zone's history (local mean time before its first transition), is subtracted from the local fields, and the step is repeated until the offset holds. `tm_isdst` is not consulted there, so a time with `tm_isdst` set where the zone had no daylight offset is taken as standard time. FreeBSD's [`time1`](https://github.com/freebsd/freebsd-src/blob/stable/11/contrib/tzcode/stdtime/localtime.c#L2036) would instead shift it by the difference between one of the zone's daylight types and a standard one. `gmtime` converts every time whose year fits an `int` on both hosts.
-- [strftime and asctime](../../../core/libs/prx/libc/src/Time.cpp) (libc) follow FreeBSD 11 [strftime.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libc/stdtime/strftime.c) and [asctime.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/contrib/tzcode/stdtime/asctime.c) with the C locale on every host, not measured on the console; other locales are not implemented. `%s` follows FreeBSD 9 and 11 and is the local-time `mktime` of the broken-down time (current FreeBSD uses `tm_gmtoff`), which is -1 on Windows outside the range above. `%Z` is `tm_zone`, or `tzname[tm_isdst != 0]` when it is null and `tm_isdst` is not negative. The two-digit year warning FreeBSD writes to `stderr` when `CHECK_STRFTIME_FORMATS_FOR_TWO_DIGIT_YEARS` is set is not written
+- [strftime and asctime](../../../core/libs/prx/libc/src/Time.cpp) (libc) follow a payload process on a PS5 (firmware 13.60) in the C locale. `%G`, `%g` and `%V` throw for a negative `tm_yday`, a `tm_yday` past the year or a `tm_wday` below -6, where no rule fits the console: `%V` is 01, 00, 00 and 52 for `tm_yday` -25, -13, -12 and -1 (`tm_wday` 5), `tm_yday` 400 of 2026 is week 01 of 2027 but 415 of 1997 is week 59 and 365 of 2013 week 53, and `tm_wday` -12 with `tm_yday` 18 is week 04. `%k`, `%l`, `%P`, `%s`, `%+`, `%v`, flags and widths are copied as written, `E` or `O` before an unknown conversion is dropped, and a format ending in either throws, where the console crashed. Negative fields print 0 and fields wrap at 100 (`%j` at 1000, `%u` and `%w` at 10); `%Y` and `%G` are the year mod 10000, `%C` is `tm_year / 100 + 19`. A negative weekday or month gives `Sun` or `Jan`. `%z` and `%Z` ignore `tm_gmtoff` and `tm_zone` and use the guest zone and `tzname`
 - [wcsftime](../../../core/libs/prx/libc/src/Time.cpp) (libc) converts the format to UTF-8, runs this library's `strftime` and converts the result back, where the console's `libSceLibcInternal.sprx` (0x854e0) copies literal wide characters and expands each conversion straight into the buffer; the results match for the formats tried, and it has the `strftime` gaps above. A result that does not fit returns 0 with the buffer untouched, where the console leaves the characters written so far. A null buffer returns 0, where the console writes through it, and a size too large for the narrow buffer returns 0 with `EINVAL`, where the console formats as usual. A null format or `tm` throws
 - [syslog](../../../core/libs/prx/libc/src/Syslog.cpp) (libc) writes each message to `stderr` as `[syslog:<priority>] <message>`, with a newline added when missing, instead of sending it to the console's system log. Priority and facility handling follow FreeBSD's `vsyslog`: `%m` expands to the guest errno's message, unknown bits are reported (as priority 0x23, since FreeBSD passes `LOG_ERR|LOG_CONS|LOG_PERROR|LOG_PID` as the priority) and masked, a missing facility becomes `LOG_USER` or the facility set by `openlog`, and errno is preserved. `openlog` applies its identity and `LOG_PID`; a null identity retains the previous one, and a valid nonzero facility replaces the default. `closelog` clears the identity but retains the options and facility, as in FreeBSD 11; when no identity is set, FreeBSD falls back to the program name, which this backend does not emit. `LOG_PERROR` has no extra effect because stderr is the emulated log sink; `LOG_NDELAY`/`LOG_ODELAY`, `LOG_NOWAIT` and `LOG_CONS` have no daemon, child or console backend to control. `setlogmask` follows [FreeBSD 11](https://github.com/freebsd/freebsd-src/blob/8d2708de5d6112a492744d367cfdfb8fd219227a/lib/libc/gen/syslog.c): the process-wide mask defaults to 0xff, zero queries it, and nonzero values replace it; masked messages are skipped before formatting, including the unknown-priority diagnostic. The console's mask behaviour is unverified
 - [fwscanf, vfwscanf, wscanf, vwscanf and their `_s` forms](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) run the `swscanf` scanner on characters read with `fgetwc`, so everything listed for `swscanf` in this file applies to them. As in the console's `libc.prx`, a field takes characters while they can still begin a valid item, so a failed field such as `0x` for `%x` stays consumed, and only the character that ended the scan goes back to the stream. That character is pushed back as its UTF-8 bytes with `ungetc`, because `ungetwc` takes single bytes only; the Windows C runtime guarantees one byte of push-back, so a non-ASCII lookahead can be lost there. A null stream or format returns `EOF`; the console checks them only in the `_s` forms.
 - [daemon](../../../core/libs/prx/libc/src/Process.cpp) (libc) throws: forking into the background is not supported. PPSA85300 imports it and fails to load without it. VLC 3.0 calls it only when its `daemon` option is set ([libvlc.c](https://github.com/videolan/vlc/blob/6de05adcbaf2e8b85fe86aad4169393098628119/src/libvlc.c#L190-L197)), and the title starts libVLC with `--ignore-config` and without `--daemon` ([player.cc](https://github.com/ZiZc3/VLC/blob/f3253020a64368153233ede29183014c0b6c8979/src/player.cc#L960-L981))
-- [_WStoul](../../../core/libs/prx/libc/src/Strings.cpp), [_Iswctype](../../../core/libs/prx/libc/src/RuneLocale.cpp), [swscanf_s and swscanf](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) - `_WStoul` is `wcstoul` and throws for a base other than 0 or 2 to 36. `_Iswctype` takes the class numbers of Dinkumware's [xwcc.h](https://github.com/superna9999/ti-cgt6x/blob/cgt6x_7_3_4/include/xwcc.h) (1 `alnum` to 11 `xdigit`, 12 `blank`) and throws for any other value, including the FreeBSD masks `wctype` returns; the numbering is not confirmed on the console's `libc.prx`. `swscanf_s` follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as `unsigned int` like `sscanf_s` where K.3.9.1.5 specifies `rsize_t`; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns `EOF`, and a too small array gets a null first element as in `sscanf_s`. A literal at end of input returns the number of assignments, including zero, rather than `EOF` as FreeBSD does, as reported from the console scanner in #8479; `%%` at end of input still returns `EOF`. A literal mismatch is a matching failure, where FreeBSD's `vfwscanf` reports an input failure. An incomplete floating exponent such as `1e+` converts its mantissa, as reported from the console scanner in #8479; other incomplete exponent forms are not separately verified. A short `%c` field is currently a matching failure without storing its available prefix, while #9321 reports that the console stores a short `%3lc` field; its return count, partial-output extent and precedence are unverified. An integer field that is only a prefix, such as `0x`, does not convert; FreeBSD's `vfwscanf` pushes back the `x` and converts the `0`. Integers out of range are truncated from `strtoll`/`strtoull`. `%p` follows FreeBSD 11's [vfwscanf.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdio/vfwscanf.c#L610-L615): a hexadecimal integer with an optional `0x`, converted as unsigned and stored as a pointer; a length modifier on it throws, where FreeBSD ignores it. It throws for `%S`, `%C`, unknown length modifiers, scanset ranges, `%n` with suppression or width, and narrow `%s`, `%c` or `%[` input that the C-locale `wcrtomb` cannot convert. `swscanf` runs the same scanner without the size arguments of `%s`, `%c` and `%[`, as FreeBSD's [swscanf.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/swscanf.c) passes its arguments to `vswscanf`, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning `EOF`, where C leaves those undefined. Neither variant is confirmed on a PS5 title
+- [_WStoul](../../../core/libs/prx/libc/src/Strings.cpp), [_Iswctype](../../../core/libs/prx/libc/src/RuneLocale.cpp), [swscanf_s and swscanf](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) - `_WStoul` is `wcstoul` and throws for a base other than 0 or 2 to 36. `_Iswctype` takes the class numbers of Dinkumware's [xwcc.h](https://github.com/superna9999/ti-cgt6x/blob/cgt6x_7_3_4/include/xwcc.h) (1 `alnum` to 11 `xdigit`, 12 `blank`) and throws for any other value, including the FreeBSD masks `wctype` returns; the numbering is not confirmed on the console's `libc.prx`. `swscanf_s` follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as `unsigned int` like `sscanf_s` where K.3.9.1.5 specifies `rsize_t`; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns `EOF`, and a too small array gets a null first element as in `sscanf_s`. A literal at end of input returns the number of assignments, including zero, rather than `EOF` as FreeBSD does, as reported from the console scanner in #8479; `%%` at end of input still returns `EOF`. A literal mismatch is a matching failure, where FreeBSD's `vfwscanf` reports an input failure. An incomplete floating exponent such as `1e+` converts its mantissa, as reported from the console scanner in #8479; other incomplete exponent forms are not separately verified. A short `%c` field is currently a matching failure without storing its available prefix, while #9321 reports that the console stores a short `%3lc` field; its return count, partial-output extent and precedence are unverified. An integer field that is only a prefix, such as `0x`, does not convert; FreeBSD's `vfwscanf` pushes back the `x` and converts the `0`. Integers out of range are truncated from `strtoll`/`strtoull`. `%p` follows FreeBSD 11's [vfwscanf.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdio/vfwscanf.c#L610-L615): a hexadecimal integer with an optional `0x`, converted as unsigned and stored as a pointer; a length modifier on it throws, where FreeBSD ignores it. `%S` and `%C`, with any length modifier or `*`, end the scan as a matching failure, as the console's Dinkumware scanner in PPSA21564's `libc.prx` treats them as invalid conversions; this was read from the module, not run on a console, and whether input ending before them is an input failure instead is unverified. It throws for unknown length modifiers, scanset ranges, `%n` with suppression or width, and narrow `%s`, `%c` or `%[` input that the C-locale `wcrtomb` cannot convert. `swscanf` runs the same scanner without the size arguments of `%s`, `%c` and `%[`, as FreeBSD's [swscanf.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/swscanf.c) passes its arguments to `vswscanf`, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning `EOF`, where C leaves those undefined. Neither variant is confirmed on a PS5 title
 - [flock](../../../core/libs/prx/libc/src/FileLock.cpp) (libkernel) on Windows shares one lock state between duplicated descriptors, following FreeBSD 11.4's [flock(2)](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/sys/flock.2). Independent opens have separate states; closing a descriptor or reopening a stream drops only its reference. Lock transitions on one open file description are serialized. The lock is a host [LockFileEx](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-lockfileex) lock on one byte at offset 2^63 - 2, which no file reaches, so it excludes other `flock` calls and leaves reads, writes and mapped views alone, like FreeBSD's advisory locks. Console behavior, signal interruption and concurrent closure of a descriptor while its lock call is pending are unverified.
 - [std::_Throw_Cpp_error](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) follows Dinkumware `thread0.cpp` ([VC12](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/thread0.cpp), [STL](https://github.com/microsoft/STL/blob/da52dc0f/stl/src/thread0.cpp)), without console verification. Codes outside 0..6 throw `std::out_of_range`, the deleting destructor throws, and STREAMS errnos absent from FreeBSD 11.4 [`errno.h`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/sys/errno.h) (`ENODATA`, `ENOSR`, `ENOSTR`, `ETIME`) are omitted. Codes 0..6 throw a 32-byte [VC12 `system_error`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/system_error) with FreeBSD errnos (16, 22, 3, 12, 1, 11, 35), a static `generic_category` (not `_Generic_object`), and unverified 40-byte [GuestLocale::String](../../../core/libs/prx/libc/include/GuestLocale.hpp) messages from [`syserror.cpp`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/syserror.cpp)
-- [Call tracing](../../../core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp) (`--trace-imports`, `APS5_TRACE_CALLS`) is missing on macOS and records only the entry of a call, not its arguments or result. One process-wide ring keeps the last 65536 calls, so a busy thread pushes the others out; the reporting thread's own calls are listed only while they are still in that ring. Calls are counted per traced target; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and `xmm0` to `xmm7`; wider vector arguments survive only while the recording code avoids AVX, which is untested. Linux has no crash report, so it prints the trace only on `SIGABRT` (guest or host `abort()`), not on `SIGSEGV`; a caller in a module loaded after the last traced import prints without a module name, and a thread aborting while another writes the report waits for it at most 2 seconds
+- [Call tracing](../../../core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp) (`--trace-imports`, `APS5_TRACE_CALLS`) records only the entry of a call, not its arguments or result. One process-wide ring keeps the last 65536 calls, so a busy thread pushes the others out; the reporting thread's own calls are listed only while they are still in that ring. Calls are counted per traced target; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and `xmm0` to `xmm7`; wider vector arguments survive only while the recording code avoids AVX, which is untested. Linux and macOS have no crash report, so they print the trace only on `SIGABRT` (guest or host `abort()`), not on `SIGSEGV`; a caller in a module loaded after the last traced import prints without a module name, and a thread aborting while another writes the report waits for it at most 2 seconds. An arm64 libc build omits the recorder
 - [_Dtest](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows Dinkumware double classification matching _FDtest: finite values return -1, subnormals -2, zeros 0, infinities 1, and NaNs 2.
+- [_Exp and _FExp](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libc) follow PRAGMATA PPSA02530's bundled `libc.prx` (static disassembly): both operands are classified first and only finite/denormal pairs take the finite path. The strict x-only cutoffs at ±229/±1842 store `0.0*y` without an error below and `y*inf` with overflow above, so an offset does not compensate them. A zero multiplier keeps its sign, a NaN multiplier leaves `*px` unchanged, `+inf` with zero or `-inf` with infinity is invalid, and finite multipliers with `+inf`/`-inf` return signed infinity/zero without flags. Inside the cutoffs subnormals are `Finite` without flags, a zero from scaling raises underflow, and the negative cutoff itself raises nothing. `_FExp` uses the measured `c1`, `c2`, `invln2`, `Q` and `P`; `_Exp` finite constants, exact finite bits, signaling NaNs, directed rounding and flush-to-zero modes remain unverified.
+- [exp2f](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`s_exp2f.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_exp2f.c), with `huge` and `twom100` read at run time and `x + redux` rounded to float, as msun's `volatile` reads and `STRICT_ASSIGN` do. As in the `libc.prx` that titles ship, `errno` is set to `ERANGE` only in msun's overflow (`x >= 128`) and underflow (`x <= -150`) branches, so a subnormal result leaves it unchanged. Floating-point exceptions are not compared. It gives the same bits and `errno` as the `exp2f` of the `libc.prx` bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.
 - [app0.zar](../../../core/libs/prx/libc/src/AppArchive.cpp) (libc) - a [ZArchive](https://github.com/Exzap/ZArchive) beside `app0/` is a read-only layer under it: a path missing from `app0/` is looked up in the archive, case-insensitively. It is not a console format; titles ship their files in a PFS image instead. Resolving an archive-only path through any call other than the archive-aware libkernel ones throws, so `fopen`, `stat`, `access`, `opendir` and the rest do not read the archive yet, and `opendir` of a directory that exists in both places, `app0/` itself included, and `fdopen` of an archived descriptor throw instead of missing its entries or reading the null device. A damaged compressed block throws instead of returning `EIO`
 - [fopen_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - returns the errno of the failed open, as C11 K.3.5.2.1 leaves the nonzero value open and Microsoft's CRT returns errno; the console's Dinkumware `fopen_s` is not verified
+- [codecvt<wchar_t,char,_Mbstatet> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `H-TDszhsYuY`) is thirteen zeroed `uintptr_t` slots matching `st_size` 104 on title `libc.prx` from PPSA26344 and on `libSceLibcInternal.sprx` (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and seven conversion virtuals). Facet calls through the object fault until those methods are wired.
+- [num_put<wchar_t> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `59oywaaZbJk`) is fourteen zeroed `uintptr_t` slots matching `st_size` 112 on the title `libc.prx` from PPSA16833 (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and eight `do_put` virtuals). Facet calls through the object fault until those methods are wired.
+- [time_get<char> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `o4kt51-uO48`) is thirteen zeroed `uintptr_t` slots matching `st_size` 104 on console `libSceLibcInternal.sprx` (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and seven `do_*` virtuals). Facet calls through the object fault until those methods are wired.
+- [time_get<wchar_t> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `sEca1nUOueA`) is thirteen zeroed `uintptr_t` slots matching `st_size` 104 on console `libSceLibcInternal.sprx` (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and seven `do_*` virtuals). Facet calls through the object fault until those methods are wired.
+- [num_get<wchar_t> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `Y9C9GeKyZ3A`) is seventeen zeroed `uintptr_t` slots matching `st_size` 136 on console `libSceLibcInternal.sprx` (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and eleven `do_get` virtuals). Facet calls through the object fault until those methods are wired.
 - [ios_base standard streams](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) `_Addstd` queues the stream in the standard stream table of Dinkumware [ios.cpp](https://github.com/ganboing/crt.vc12/blob/master/src/ios.cpp) (`stdstr`, `stdopens`, `_Addstd`, `_Ios_base_dtor`): it takes the first of slots 1 to 7 that is free or already holds the stream, and slot 8 (`NSTDSTR`) when none is, so slot 8 is shared by every stream past the first seven and registration never fails. It stores the 1-based slot index in the guest `IosBase::standardStream` (Dinkumware's `_Stdstr`, where 0 means not a standard stream) and counts the stream objects registered per slot; registering the same stream again reuses its slot and raises its count. Measured on a PS5 (firmware 13.60) from a homebrew payload calling the system `libSceLibcInternal` export: in a process whose own standard streams already hold slots 1 to 7, twelve distinct streams and a repeated one all get 8, written as a 64-bit value at offset 0x8 with no other byte of the object touched; the assignment of slots 1 to 7 to fresh streams is not observable there and follows VC12. The counts are `int`, not VC12's `char`, and the registration and the destructor lock the table where VC12 locks only `_Addstd`; a slot index past the table throws in the destructor instead of indexing out of bounds. The destructor decrements its slot's count and suppresses the rest of the destruction while the count stays positive, as `_Ios_base_dtor` does, and the slots of destroyed streams keep their pointer and stay reserved for that stream, as `stdstr` does. The streams themselves are destroyed by the title's own code as it registers them through `__cxa_atexit`; when the last reference closes, the unsupported stream storage and callback cleanup is still the throw it was and the locale is released as for a non-standard stream.
-- [std::_Pad, _Thrd_join, _Thrd_detach, _Thrd_id](../../../core/libs/prx/libc/src/Threads.cpp) (libc) follow Dinkumware V6.00 `thr/xthread` and `thr/threadcall.cpp` ([crt.vc12 `f1d47126`](https://github.com/ganboing/crt.vc12/tree/f1d47126/src/thr)), without console verification. `_Thrd_id` throws because whether the console returns `pthread_t` or a kernel thread ID and at what width is unknown; `_Launch` omits `_Cnd_do_broadcast_at_thread_exit` and calls `pthread_create` registered by libkernel with default attributes. The 32-byte pad layout (`_Go()` vtable at 0x0, `_Cnd_t` at 0x8, `_Mtx_t` at 0x10, `bool _Started` at 0x18) is assumed from VC12, unverified. Failing primitives or thread start throw the guest `std::system_error`; null arguments throw. `_Thrd_join` returns `_Thrd_error` (4) on `pthread_join` failure and truncates the exit code to `int`; `_Thrd_detach` returns `_Thrd_error` (4) on `pthread_detach` failure and throws when none is registered
+- [std::_Pad, _Thrd_join, _Thrd_detach, _Thrd_id](../../../core/libs/prx/libc/src/Threads.cpp) (libc) follow Dinkumware V6.00 `thr/xthread` and `thr/threadcall.cpp` ([crt.vc12 `f1d47126`](https://github.com/ganboing/crt.vc12/tree/f1d47126/src/thr)), otherwise without console verification. `_Thrd_id` returns `scePthreadSelf()` unchanged, as measured on a PS5 (firmware 13.40) in two threads (#4164, #8711); `_Launch` omits `_Cnd_do_broadcast_at_thread_exit`; the two-argument form starts with default attributes and the three-argument form forwards the caller's attribute pointer, as PPSA02530's `libc.prx` does at `0x18090`. The 32-byte pad layout is assumed from VC12, unverified. Failing primitives or thread start throw the guest `std::system_error`; null arguments throw. `_Thrd_join` returns `_Thrd_error` (4) on `pthread_join` failure and truncates the exit code to `int`; `_Thrd_detach` returns `_Thrd_error` (4) on `pthread_detach` failure and throws when none is registered
+- [siginterrupt](../../../core/libs/prx/libc/src/Process.cpp) (libc) runs FreeBSD 11.4's `siginterrupt.c` sequence through the `sigaction` and the `_sigintr` set that libkernel registers at load: it reads the signal's disposition, sets or clears the signal's bit and `SA_RESTART`, and installs the disposition again. The set is written outside libkernel's registration lock, as FreeBSD's libc writes it without one; a call before libkernel has registered throws.
+- [collate<char> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `ruZtIwbCFjk`) is nine zeroed `uintptr_t` slots matching `st_size` 72 on the title `libc.prx` from PPSA16833 (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and three `do_*` virtuals). Facet calls through the object fault until those methods are wired; `_Getcat` still installs the host `g_collateVtable` for facets it builds.
 - [num_get<char>::id, time_get<char>::id and the num_get<char> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) are data objects, as the public SDK's libSceLibcInternal table declares them and as the other facet ids and the `num_put` and `codecvt` vtables are kept: the ids start at zero and the vtable is 17 zeroed slots, the 136-byte size of `KfcTPbeaOqg` in the console's libSceLibcInternal, whose relocations fill the offset-to-top and typeinfo entries, the two destructors, `locale::facet::_Incref` and `_Decref`, and the eleven `do_get` of Dinkumware's crt.vc12 `xlocnum`, so a guest resolves the symbols and reads data, and a facet call through the vtable faults. libSceAmpr exported the three as throwing functions, which a data consumer reads as code; its qualified imports fall back to libc.
+- [printf family conversions](../../../core/libs/prx/libc/include/WindowsFormatting.hpp) (libc) - Windows `FormatWindows` follows the title `libc.prx` `_Printf` measured from PPSA13934, PPSA07923, PPSA05916 and PPSA04158: `%q`, `%D`, `%O` and `%U` are unknown conversions; an unknown character is printed with its leading `%`, and width, `-` and discarded length modifiers behave as measured (`%5y` is `   %y`, `%hhz` is `%z`). `%%` takes a width. A trailing `%` reads past the format's NUL and is not reproduced; it throws. `#`, precision and a `0` without a width are ignored, as a payload process on a PS5 (firmware 13.60) printed `%#k` and `%.2k` as `%k`; `+`, space, `'` and `0` with a width on an unknown conversion are unverified and throw. On Linux a format with an unknown conversion also goes to this formatter
+- [child process registry](../../../core/libs/prx/libc/src/Process.cpp) (libc) - `RegisterChildProcess_nid_no_patch` and `WaitChildProcess_nid_no_patch` track the native handles of children created by `posix_spawn` ([libSceLibcInternal](../../../core/libs/prx/libSceLibcInternal/Spawn.cpp)) so libkernel can reap them on Windows, where the host has no `waitpid`. The registry lives in libc because libSceLibcInternal imports libc but not libkernel. `RegisterChildProcess_nid_no_patch` stores the process ID and handle; only reaped handles are closed, and a process that exits without waiting leaks them. Registration without a live child is not validated, and a duplicate process ID is accepted. The decoder maps recognized structured-exception codes to guest signals, keeping the guest `exit` byte layout for anything else. These exports are internal glue for libkernel, not console ABI: their behavior is unverified against any PS5 library and a title importing their NIDs directly is not expected.
+- [fprintf_s, vfprintf_s, vprintf_s, fwprintf_s, wprintf_s, vfwprintf_s and vwprintf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) follow C11 K.3.5.3.1, K.3.5.3.10 and K.3.9.1.1 with the constraints of `snprintf_s` and `swprintf_s`: a null stream, format or argument list, any `%n`, and a null `%s`, `%ls` or `%S` argument return -1 and write nothing, because the output is formatted completely before it is written. A violation only returns: the constraint handler is not invoked, `errno` is untouched, and the value is the one the narrow `snprintf_s` returns on this branch, not a result measured for a stream function on a PS5. A closed stream sets `EBADF` (9) as `fprintf` does. `vprintf_s` and `vwprintf_s` write to the guest standard output stream, and the wide forms count characters while the narrow ones count bytes, as their unchecked siblings do
+- [scanf_s, fscanf_s, vscanf_s and vfscanf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) run the scanner of `sscanf_s` over the stream, taking the size of `%s`, `%c` and `%[` as `unsigned int` after the pointer, so everything listed for `sscanf_s` applies, including the count of items converted before an undersized destination, whose first element is set to zero. Each directive is read from the stream with the host `fscanf`, with one character of look-ahead pushed back, so the stream stops after the last character a conversion used. A null stream, null format or null destination returns `EOF`, a closed stream also sets `EBADF`, and the constraint handler is not invoked. The 16-bit wide conversions (`%ls`, `%lc`, `%l[`, `%S`, `%C`) throw on Linux, as in `fscanf`. None of the stream forms were measured on a PS5, and the size type follows `sscanf_s` rather than `rsize_t`
+- [freopen_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) follows C11 K.3.5.2.2 through `freopen`: a null result, mode or stream returns `EINVAL` (22) with `*result` set to null when it exists, and a null name is passed to `freopen`, which reports mode-only reopening as unsupported (`ENOTSUP`, 45) with `*result` null, and the constraint handler is not invoked, as in `fopen_s`. A successful reopen stores the stream in `*result` and returns 0, and a failed one stores null and returns the errno `freopen` left, closing the stream as `freopen` does. The console's return values are unverified
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index 5d913ef866..24cb00cab9 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -2,22 +2,28 @@
 
 ### Silent stubs
 
+- [SO_TIMESTAMP, SO_BINTIME](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - set and read back as their bits, as a payload process on a PS5 (firmware 13.60) answered them, but `recvmsg` adds no `SCM_TIMESTAMP` or `SCM_BINTIME` control message, which FreeBSD 11.4's `ip_savecontrol` and `ip6_savecontrol` add to a received datagram while the option is set; what the console's `recvmsg` returns was not measured
 - [sceKernelGetSocPowerConsumption](../../../core/libs/prx/libkernel/System/src/ThermalSensors.cpp) (libkernel) - returns `EINVAL` and writes nothing, as `sceKernelGetSocSensorTemperature` does when the host has no sensor: the host's package power is not read (Linux RAPL `energy_uj` is readable by root only, and Windows has no general source). The prototype is not documented. PS5LM Plus (PPSA99581) passes a zeroed 128-byte buffer and, on success, reads its first 32-bit word as milliwatts, accepting 1000 to 350000; on failure it shows 0 W
-- [scePthreadMutexattrSetprotocol](../../../core/libs/prx/libkernel/Pthread/src/Mutex.cpp) (libkernel) - accepts 0 to 2 as a PS5 (firmware 13.60) does and returns `EINVAL` otherwise, but the protocol is not stored or applied: priority inheritance and protection are not modelled. On the console a null or uninitialized mutex attribute returns `EINVAL` from the SCE attribute calls, `scePthreadMutexInit` takes an uninitialized attribute as the default one, and a destroyed mutex returns `EINVAL` from `scePthreadMutexDestroy`; a null mutex pointer crashed the payload and still throws
+- [scePthreadMutexattrSetprotocol, scePthreadMutexattrGetprotocol, scePthreadMutexattrSetprioceiling, scePthreadMutexattrGetprioceiling](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) - `scePthreadMutexattrSetprotocol` accepts 0 to 2 as a PS5 (firmware 13.60) does and returns `EINVAL` otherwise, but the protocol is not applied: priority inheritance and protection are not modelled. On the console a null or uninitialized mutex attribute returns `EINVAL` from the SCE attribute calls, `scePthreadMutexInit` takes an uninitialized attribute as the default one, and a destroyed mutex returns `EINVAL` from `scePthreadMutexDestroy`; a null mutex pointer crashed the payload and still throws
 - [pthread_mutexattr_setprotocol, pthread_mutexattr_getprotocol, pthread_mutexattr_setprioceiling, pthread_mutexattr_getprioceiling](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) - the protocol and the priority ceiling are stored and reported as in [FreeBSD 11 libthr](https://github.com/freebsd/freebsd-src/blob/releng/11.0/lib/libthr/thread/thr_mutexattr.c#L192-L245) (the ceiling is set or read only under `PTHREAD_PRIO_PROTECT`, and setting a protocol resets it to the highest `SCHED_RR` priority). A null, uninitialized or destroyed attribute returns `EINVAL` before the other arguments are checked; this error behavior is unverified on the console. Mutexes do not apply the protocol or ceiling: a priority-inherit or priority-protect mutex locks like a normal one and does not change its owner's priority
-- [sceCoredumpSetUserDataType](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `Uxqkdta7wEg`) - `(int type)` follows the PS5 12.00 `libkernel.sprx` at 0x138B0: the sign-extended `type` goes to syscall 601 (command 29, third argument 0), and the raw result comes back with no SCE code mapping, so a kernel error is -1 with `errno` set. Which types the kernel accepts is not measured. No dump is produced here, so every type returns 0. Palworld (PPSA23126, #2598) and Hello Neighbor (PPSA35154, discussion #6991) import it; #4144 left it throwing because no signature was known
+- [sceCoredumpSetUserDataType](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `Uxqkdta7wEg`) - `(int type)` follows the PS5 12.00 `libkernel.sprx` at 0x138B0: the sign-extended `type` goes to syscall 601 (command 29, third argument 0), and the raw result comes back with no SCE code mapping, so a kernel error is -1 with `errno` set. Which types the kernel accepts is not measured. No dump is produced here, so every type returns 0. Palworld (PPSA23126, #2598) and Hello Neighbor (PPSA35154, discussion #6991) import it; #4144 left it throwing because no signature was known. PPSA02225 also imports it: its one call (at 0x6a1b2) passes 1 and does not read the result.
+- [pthread_rwlockattr_settype_np](../../../core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp) (libkernel) - stores types 1 and 2 through `scePthreadRwlockattrSettype` and returns 0, but the type is not applied: `scePthreadRwlockInit` ignores its attribute. Any other type, 0 included, and a null attribute or object return `EINVAL` and store nothing, as in [BunnyFl's measurements](https://github.com/boykopovar/AnyPS5/pull/9632#issuecomment-6363402814) of firmware 13.42's libkernel. Only the name is public; the `(attr, int)` signature follows the SCE twin and shadPS4, which also registers it as `scePthreadRwlockattrSettype`
 - [sceKernelGetMainSocId and sceKernelGetCpumode](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) both return 0, and [sceKernelGetCpuFrequency](../../../core/libs/prx/libkernel/Time/Time.cpp) returns the host TSC frequency measured for `sceKernelGetTscFrequency`, not the console CPU clock. The PS5's SoC id and CPU mode are unknown; shadPS4's PS4 values are [0x710f10/0x740f30 and 0, 2 or 5 from the param.sfo CPU-mode flags](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1a/src/core/libraries/kernel/process.cpp). PPSA99203 only logs them (`[console] main SoC id: result=%#x out=%#x`, `CPU: %llu Hz, cpumode %d`), passing a pointer that `sceKernelGetMainSocId` leaves untouched
 - [sceKernelEnableDmemAliasing](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) returns 0 and changes nothing: direct memory can always be mapped more than once here, as `DoMapDirect` in [DirectMemory.cpp](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) only checks that the physical pages are allocated, so there is no aliasing to turn on. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/libraries/kernel/memory.cpp#L39-L43) (PS4) sets a flag there that lifts the `EBUSY` its [`sceKernelMapDirectMemory2`](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/libraries/kernel/memory.cpp#L299-L301), and [`sceKernelMapDirectMemory` for SDK 2.50 and later](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/libraries/kernel/memory.cpp#L237-L242), return for direct memory that is [already mapped](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/memory.cpp#L548-L553); that check is not applied here. The no-argument `int` signature follows shadPS4 and ProsperoEden (PPSA99008), which calls it before mapping the same direct memory again. Whether the PS5 refuses such a mapping without the call is unverified
 - [sceKernelInternalMemoryGetAvailableSize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - internal pool allocation and statistics are not implemented, so a non-null query throws without changing its output. Native null output returns -1; an absent pool returns -2, a failed statistics query returns -3, and success writes total pool bytes minus used bytes.
 - [sceKernelIsThreadSanitizerEnabled](../../../core/libs/prx/libkernel/System/src/Sanitizer.cpp) - the native zero-argument query returns bit 3 of the process sanitizer flags loaded from sysctl `{1, 14, 41}`. The host always reports disabled because guest sanitizer activation is not modeled.
+- [pthread_cond_setname_np](../../../core/libs/prx/libkernel/Pthread/Posix/Cond.cpp) (libkernel) - takes `(cond, name)` and returns 0 without keeping the name, as `scePthreadCondInit` also ignores its name and nothing reads one back; a statically initialized condition variable is created first, and a destroyed one returns `EINVAL`. FreeBSD 11.4 libthr has no such function; the signature comes only from shadPS4 ([`condvar.cpp`](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/kernel/threads/condvar.cpp#L80-L88)), which stores the name, returns `EINVAL` for a null `name`, and returns 0 for a statically initialized condition variable without creating it. A null `cond` or a null `name` throws here, because the console's result for either was not measured.
 
 ### Unknown function info
 
 - [sceCoredumpRegisterCoredumpHandler, sceCoredumpUnregisterCoredumpHandler](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) retain registration metadata but do not create the native report thread or deliver callbacks. Native registration-state precedence, stack bounds and SDK capture are recovered; thread-creation failures and active-report synchronization remain unimplemented.
+- [scePthreadMutexattrSetkind, scePthreadMutexattrGetkind](../../../core/libs/prx/libkernel/Pthread/src/Mutex.cpp) (libkernel) - `scePthreadMutexattrSetkind` throws `NotImplemented_nid_no_patch` for a kind other than `MutexType::ErrorCheck` (1) to `MutexType::Adaptive` (4): the firmware stores any kind as 16 bits of the type field unchecked, but what a mutex does with such a kind is not measured. Kinds 1 to 4 are set through `scePthreadMutexattrSettype`, and a null attribute or object returns 0x8001FFFF. `scePthreadMutexattrGetkind` takes the attribute itself and returns 0x80020000 plus its kind, or 0x8001FFFF for a null one. The firmware returns 0 for kind 0, which no setter here stores, so that case is untested. Both follow [BunnyFl's measurements](https://github.com/boykopovar/AnyPS5/pull/9632#issuecomment-6363402814) of firmware 13.42's libkernel
 
 - [sceKernelError](../../../core/libs/prx/libkernel/System/src/Error.cpp) follows [shadPS4's kernel implementation](https://github.com/shadps4-emu/shadPS4/blob/23c41333822fe8eca4c609b43119180af63ae4ac/src/core/libraries/kernel/kernel.cpp): zero returns zero; other guest POSIX error values receive the `0x80020000` bias without modifying errno. Arithmetic is defined modulo 32 bits to avoid signed overflow for inputs outside the errno domain. Console behavior for those inputs and PS5 equivalence have not been measured.
 - [physhm_open, physhm_unlink](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel, NIDs `n371J5cP+uo` and `AUqJNkobQ1c`) - declared as throwing stubs: the PS5 physical shared memory API is not documented, and [shadPS4's module generator](https://github.com/shadps4-emu/moduleGenerator/blob/main/libraries/kernel.cpp) also declares both with no arguments and returns `ORBIS_OK`, so the signature, the handle a success would return and the console's behaviour are unmeasured. The no-argument `int` signature follows shadPS4. Forever Launcher (PPSA99030) imports both and stops at load on `physhm_open`, and the relinker resolves no call site for either in that title, so no handle is fabricated and both throw
 - [getlogin_r](../../../core/libs/prx/libkernel/System/src/Login.cpp) (libkernel) returns the host effective account name: `GetUserNameW` as UTF-8 on Windows and `getpwuid_r(geteuid())` on POSIX. A valid account returns a name even without a login session; host `getlogin_r`, `USER` and `LOGNAME` are not consulted. The console's login name and behaviour without a session are unknown. Account lookup or encoding failures, a missing or empty account name, and POSIX account records exceeding the 16 KiB lookup buffer throw; there is no replacement name or retry. A short guest buffer returns `ERANGE` without modifying it, and a null output returns `EFAULT`.
+- [getlogin](../../../core/libs/prx/libkernel/System/src/Getlogin.cpp) (libkernel) follows FreeBSD 11 `lib/libc/gen/getlogin.c` and returns a pointer to one static 33-byte buffer filled by `getlogin_r`; on an error it sets `errno` to `getlogin_r`'s code and returns NULL. These semantics are not checked against a PS5. It exports the test seam `LoginNameForTest_nid_no_patch`, which replaces the host account name for tests.
+- [setlogin](../../../core/libs/prx/libkernel/System/src/Login.cpp) (libkernel_sys) keeps one name for the process, where FreeBSD 11.4's [`sys_setlogin`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_prot.c#L2138-L2161) sets it for the session, and does not check `PRIV_PROC_SETLOGIN`, which a jailed process fails with `EPERM`; the console's answer is not known. As in FreeBSD, a null name fails with `EFAULT` and a name of 33 bytes or more (`MAXLOGNAME` with the NUL) with `EINVAL`, and nothing is stored. Once a name is stored, `getlogin_r` returns it instead of the host account name described for `getlogin_r`, and ahead of the `LoginNameForTest_nid_no_patch` seam. The name is copied from the guest with the same 33-byte bound as `copyinstr`, so a name with no NUL in its first 33 bytes fails with `EINVAL` without reading past them.
 - [sceKernelGetSystemSwVersion](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) reports baseline system software version `0x01000000` ("01.000.000") for ProsperoStore (PPSA99000); the console's firmware version is not modeled. Measured on PS5 firmware 13.42: record values 0, 24, 39, 40, 41, 48 and 64 in the leading 64-bit field are accepted and preserved, the 28-byte string at offset 8 and packed version at 0x24 are filled, and bytes from 0x28 onward remain untouched. This API reports "13.590.001" / `0x13590001` in that environment, while the Prospero variant reports "13.420.000" / `0x13420000`; their values must not be assumed identical. A null pointer still returns `SCE_KERNEL_ERROR_EFAULT`, which was not measured; other firmware versions and record values remain unverified.
 - [kern.rng_pseudo](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctlbyname` draws a new block of 64 bytes from the host's `std::random_device` for each read (no new value) that passes a buffer and a length, and sizes its answers as a payload process on a PS5 (firmware 12.70) sees it: a size query reports 64; a buffer of 64 bytes or more gets 64 bytes and a length of 64 (tried up to 65536); a smaller buffer gets as many bytes as its length, which is left as given, and a null length gets none, both with -1 and `ENOMEM`; a null buffer with a null length returns 0. `errno` is kept when the call succeeds. A write returns -1 with `EPERM`, which was not tried on the console. The only caller seen is mbedTLS's `mbedtls_hardware_poll` in the catalog's ProsperoLight boilerplate, which asks for 64-byte blocks and fails if fewer come back. The console's generator is unknown, and a title process was not measured. On the console `sysctlnametomib` gives MIB {1, 50} for the name, and `sysctl` with it answers reads of 0, 1, 63, 64, 65 and 128 bytes, a size query, a null length and a null buffer with a null length as the name does; here `sysctlnametomib` maps the name to {1, 50} and `sysctl` {1, 50} answers as the name does; a write through the MIB was not measured and throws
 - [sysconf](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `_SC_CLK_TCK` returns 128, FreeBSD's `CLK_TCK` as its [`sysconf`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/sysconf.c#L100-L101) returns it ([`time.h`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/include/time.h#L48-L54)); the console's value is not checked, and no `times` reports ticks at that rate. CPython's `posix` module stops its import with "cannot read ticks_per_second" when the value is below 1, as the Python in PS5MC (PPSA99420) does. `_SC_ARG_MAX` returns 262144 (FreeBSD's `NCARGS`), `_SC_OPEN_MAX` returns the `RLIMIT_NOFILE` soft limit via `getrlimit` ([`sysconf.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/sysconf.c#L106-L115)), and `_SC_IOV_MAX` returns 1024 (FreeBSD's `UIO_MAXIOV`). Names other than `_SC_ARG_MAX`, `_SC_CLK_TCK`, `_SC_OPEN_MAX`, `_SC_PAGESIZE`, `_SC_IOV_MAX`, `_SC_NPROCESSORS_CONF`, `_SC_NPROCESSORS_ONLN` and `_SC_PHYS_PAGES` fail with `EINVAL`
@@ -26,6 +32,7 @@
 - [kern.sdk_version](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctlbyname` reports the system software version as the 4-byte value `0x01000000` (1.00), the value `sceKernelGetSystemSwVersion` reports; a write returns -1 with `EPERM`. The major version is byte 3 and the minor version byte 2, in hex digits that read as decimal (13.60 is `0x1360xxxx`), as [Capy Mobile](https://github.com/khalifa007/CapyMobile/blob/2758c016/src/ps5/platform.c#L64-L71) (PPSA92280), [remote_lua_loader](https://github.com/n0llptr/remote_lua_loader/blob/7c2840e475/savedata/misc.lua#L195-L209) and the [lapse payload](https://github.com/NetflixNHack/Netflix-N-Hack/blob/605eb93ba5/PS4/payloads/lapse.js#L436-L450) read it. Capy Mobile only displays it. The console's firmware version is not modeled and the low two bytes are unknown
 - [kern.ostype, kern.osrelease, kern.version, kern.hostname, hw.machine](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctl` (1.1, 1.2, 1.4, 1.10, 6.1), `sysctlbyname` and `sysctlnametomib` serve the names `uname` reads as read-only strings: "FreeBSD", "11.4-RELEASE" and "FreeBSD 11.4-RELEASE\n", the values FreeBSD 11.4-RELEASE builds without source control information ([newvers.sh](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/conf/newvers.sh#L45-L52), [L293-L294](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/conf/newvers.sh#L293-L294)), the host name `gethostname` reports ("AnyPS5") and "amd64"; a short buffer returns `ENOMEM` and a write `EPERM`. The console's strings are not measured
 - [kern.osreldate](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - reports MIB `{CTL_KERN, KERN_OSRELDATE}` as `1104001`, FreeBSD 11.4's `__FreeBSD_version` in `sys/sys/param.h`; this is consistent with `kern.osrelease` and `kern.version` above, but the value reported by a PS5 title has not been measured.
+- [kern.boottime](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctl` {`CTL_KERN`, `KERN_BOOTTIME`} and `sysctlbyname` report a read-only 16-byte `struct timeval`, as FreeBSD 11.4's [`sysctl_kern_boottime`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_tc.c#L144-L163) does: the guest's `CLOCK_REALTIME` minus its `CLOCK_UPTIME`, taken at the first read and kept, so a later step of the host clock does not move it as FreeBSD's `tc_setclock` would. The value a PS5 title gets has not been measured.
 - [sceKernelGetProsperoSystemSwVersion](../../../core/libs/prx/libkernel/System/src/SoftwareVersion.cpp) (libkernel) reports system software version `0x01000000` ("01.000.000"); the console's firmware version is not modeled. The 0x28-byte block (a 64-bit size at 0, the version string at 8 and the packed version at 0x24) follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Kernel/KernelSystem.cs), which Prospero Multi Tools (PPSA99110) and Prospero Explorer (PPSA99109) are built with and which sets the size to 40, and the same fields in [etaHEN](https://github.com/etaHEN/etaHEN/blob/main/Source%20Code/daemon/include/ipc.hpp) and [shsrv](https://github.com/ps5-payload-dev/shsrv/blob/master/sh.c). A size other than 0x28 returns `SCE_KERNEL_ERROR_EINVAL` without writing; whether the console checks the size is unverified, since etaHEN and shsrv declare a 0x30-byte block and do not set it
 - [sceKernelGetAllowedSdkVersionOnSystem](../../../core/libs/prx/libkernel/System/src/SoftwareVersion.cpp) (libkernel) reports the system software version with the 12 patch bits set, `0x01000fff`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/98fd0689/src/core/libraries/kernel/kernel.cpp) does on the PS4 and as [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Kernel/KernelSystem.cs) describes it, which Prospero Explorer (PPSA99109) reads it through; a null pointer returns `SCE_KERNEL_ERROR_EINVAL`. The console's value and its errors are unverified
 - [sceKernelConvertUtcToLocaltime, sceKernelConvertLocaltimeToUtc](../../../core/libs/prx/libkernel/Time/Time.cpp) (libkernel) convert with the host time zone at the given instant, as libc `localtime` does, instead of the console's time zone setting. `west_sec` holds the standard-time offset in seconds east of UTC, despite its name, and `dst_sec` the daylight saving seconds in effect. This follows PPSA99203 ([PS5SX2](https://github.com/Swordpdf/PS5SX2/blob/b4cf55e87c34e8a2a1cd9302df4373e5a94d28f4/ps5/frontend/fe_ps5.cpp#L54-L63)), whose author saw a console write 7200 and 3600 into the 16-byte block; which zone that console was set to is not recorded, so whether `west_sec` includes daylight saving is not settled. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/23c41333/src/core/libraries/kernel/time.cpp) also stores seconds east. PPSA99203 declares the last argument of `sceKernelConvertUtcToLocaltime` as `uint64_t*`; 32 bits are written. On Windows the standard offset and the daylight saving amount are the C runtime's current `_get_timezone` and `_get_dstbias` for every instant, as libc `localtime_s` uses them, so instants under a zone's earlier rules get today's offsets; a `TZ` variable does not set `_dstbias`, which keeps the value an earlier `_tzset` read from the system (0 when the system zone has no daylight saving), and summer time then adds nothing. In a repeated or skipped local hour, `sceKernelConvertLocaltimeToUtc` takes the offset in effect one standard offset earlier. Its last argument receives the zone's daylight saving amount whether or not it is in effect, found by sampling the host zone over the year around the result, while `dst_sec` is the amount in effect: the libc `mktime` that PPSA99109 bundles (text 0x70ebb-0x70ee5) subtracts that amount when `tm_isdst` is set outside summer time. That `mktime` passes `tm_isdst` as the second argument, which is ignored, so it does not choose the offset in a repeated hour. `sceKernelGettimezone` and the `gettimeofday` time zone still report no offset and no daylight saving. A host time the C runtime cannot convert throws
@@ -36,35 +43,39 @@
 - [APR reads past the end of a file](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libkernel) - a read that reaches the current end of the file on disk copies the bytes the file has and fills the rest of the destination with zeros; a read that comes back short before that end still throws. PPSA18605 resolves its settings file once, rewrites it one byte shorter and reads it again with the size that resolve returned. The console's behaviour for a read past the end of a file is unverified: it may zero-fill, leave the destination untouched or fail the command
 - [AMPR counter access](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and checks of `WaitOnCounter_04_00`, `WriteCounter_04_00`, `ConstructNop` and `ConstructMarker` taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, which hands counter commands to the console and does not show their effect. The counters are taken as 32 bits each: the 8-byte access of counter n spans n (low) and n + 1 (high), the 2- and 1-byte accesses select a half or a byte of the counter by its offset, waits compare at the access width (signed and wrapped compares included), the AND mask applies to both sides and the atomic writes wrap within the access. The `ConstructNop` type is not recorded
 - [APR gather and scatter reads](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures, argument checks and the read cursor taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, not confirmed on a title: each read leaves the file, the next file offset and the next destination; a gather reads that file at a new offset into the next destination, a scatter continues in the file into a new destination, a gather-scatter takes both. Recording one needs a read file since the last `ResetGatherScatterState`; like ampr_emu, `sceAmprCommandBufferReset` keeps that state, and a gather or scatter with no read before it in the submitted buffer throws instead of returning `SCE_AMPR_ERROR_APR_INVALIDGATHERSCATTERSTATE`
-- [AMM map, map direct and unmap](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and the protection mask (CPU, GPU, AMPR and ACP read and write) taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, which hands the remaining checks and the mapping to the console kernel; the mapper model taken from [PS5PCEM](https://github.com/iStark/PS5PCEM): `sceAmprAmmGiveDirectMemory` usage 1 gives the allocated direct memory to the pool plain maps take pages from, usage 0 only allocates it. Not confirmed on a title. The AMM virtual address ranges are a 256 GiB range (PPSA02015 places its heaps 64 GiB above the start of the range, so 32 GiB is too small, and reached 84 GiB above it in its first 159 s; KytyPS5 reports 512 GiB, but every 64 GiB-aligned 544 GiB window in the guest arena covers 448 to 608 GiB, and on Windows one host thread stack there is enough to block it) and a 32 GiB multimap range reserved on first use at the top of the guest arena with the start on a 64 GiB boundary (PPSA02015 tells its pool pointers from its heap pointers by address bits 28 to 35, which needs such a start for its layout), above the addresses that maps without `MAP_FIXED` are given lowest first and that titles derive their next hints from; the console's addresses are not known (ampr_emu takes them from `sceKernelMapperGetParam`), and a reservation that cannot be made there throws. Maps outside them throw. Addresses, sizes and direct offsets must be 16 KiB aligned. The memory type and the GPU mask are ignored, AMPR and ACP access maps as CPU access, unmapped pages go back to the pool and stay reserved. Submission runs the buffer before returning, the submit result is always 0 and a failing command throws; the AMM measures return errors sign-extended, as ampr_emu does. A map returns its target to the reservation before releasing the old pages, so pool exhaustion leaves that target reserved; mapping failure also restores the reservation before returning newly taken pages to the pool. The console's map failure and rollback behavior is unverified. `sceAmprAmmGetVirtualAddressRanges` throws for a null output
+- [AMM map, map direct and unmap](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and the protection mask (CPU, GPU, AMPR and ACP read and write) taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, which hands the remaining checks and the mapping to the console kernel; the mapper model taken from [PS5PCEM](https://github.com/iStark/PS5PCEM): `sceAmprAmmGiveDirectMemory` usage 1 gives the allocated direct memory to the pool plain maps take pages from, usage 0 only allocates it. Not confirmed on a title. The AMM virtual address ranges are a 256 GiB range (PPSA02015 places its heaps 64 GiB above the start of the range, so 32 GiB is too small, and reached 84 GiB above it in its first 159 s; KytyPS5 reports 512 GiB, but every 64 GiB-aligned 544 GiB window in the guest arena covers 448 to 608 GiB, and on Windows one host thread stack there is enough to block it) and a 32 GiB multimap range reserved on first use at the top of the guest arena with the start on a 64 GiB boundary (PPSA02015 tells its pool pointers from its heap pointers by address bits 28 to 35, which needs such a start for its layout), above the addresses that maps without `MAP_FIXED` are given lowest first and that titles derive their next hints from; the console's addresses are not known (ampr_emu takes them from `sceKernelMapperGetParam`), and a reservation that cannot be made there throws. Maps outside them throw. Addresses, sizes and direct offsets must be 16 KiB aligned. The memory type and the GPU mask are ignored, AMPR and ACP access maps as CPU access, unmapped pages go back to the pool and stay reserved. A buffer may run after submission returns, the submit result is always 0 and a failing command throws; the AMM measures return errors sign-extended, as ampr_emu does. A map returns its target to the reservation before releasing the old pages, so pool exhaustion leaves that target reserved; mapping failure also restores the reservation before returning newly taken pages to the pool. The console's map failure and rollback behavior is unverified. `sceAmprAmmGetVirtualAddressRanges` throws for a null output
 - [AMM remap, multimap and protection changes](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and the protection and mask checks taken from ampr_emu; the effects are inferred from the names, not confirmed on a title. A remap moves every page of a fully mapped range to the new address with the given protection and leaves the old range reserved; a multimap maps the same pages at a second address, anywhere in the AMM ranges, and a pool page goes back to the pool once its last mapping is unmapped; a multimap onto its own source range throws. A protection change sets the masked bits on every page of a fully mapped range; the memory type is recorded and ignored. A command on a range that is not fully mapped throws
 - [AMM PRT ranges](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures, checks and their order taken from ampr_emu, where `MapAsPrt` is a map with the PRT flag and protection 0 and `AllocatePaForPrt` a memory type and protection change with mask 1019, both checking the buffer memory after its size; the effects are inferred from the names, not confirmed on a title. Unbacked PRT pages are zero-filled pages with GPU read access, so CPU reads see zeros instead of faulting and GPU writes fault instead of being dropped. `AllocatePaForPrt` backs each unbacked page with a pool page and sets the type and protection of backed ones; `RemapIntoPrt` moves a fully mapped range into a PRT range, its opcode argument (1011 when 0, as in ampr_emu) is recorded and ignored; `UnmapToPrt` returns the pages to the pool and zero-fills them again. A plain map, unmap or remap over a PRT range ends it; `AllocatePaForPrt`, `RemapIntoPrt` or `UnmapToPrt` outside a PRT range throws
 - [AMM kernel write commands](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libkernel) - signatures of `sceKernelWriteModifyMtypeProtectCommand` and `sceKernelWriteRemapIntoPrtCommand` taken from [ampr_emu's libkernel hook targets](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr_libkernel_hook_targets.h), which forward to the real kernel; the measure mode (`dst` null reports the size, `outSize` null skips the report) follows ampr_emu's measure-then-record calls, not confirmed on a title. The range, protection and mask checks mirror the `libSceAmpr` siblings, and the recorded bytes match them exactly so the submitted buffer executes on the existing paths
 - [sceCoredumpWriteUserString](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `32KQRUK13kI`) - `(uint32_t, const char* text, int)` follows the console's `libkernel.sprx` (SDK 4.5x build of `J03950001`) at 0x13050: a null `text` returns `0x81180000`; otherwise the three arguments go to syscall 601 (command 10), whose `EPERM` becomes `SCE_COREDUMP_ERROR_NOT_IN_COREDUMP_HANDLER` (0x81180003), `EINVAL` `0x81180000`, and a success returns the value the kernel wrote back. Measured on a PS5 (firmware 13.60) from a homebrew payload with no core dump handler: the call succeeds with 0, the kernel rejects a first argument above 15 or a third outside 0 to 256 with `0x81180000`, and a 2047-character text is accepted. Those checks are reproduced and anything else returns 0; nothing is recorded, as there is no dump, and what the two numbers mean is unknown. PPSA16064 imports it
 - [sceCoredumpConfigDumpMode](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `gzLt9Qrauk0`) - `(int mode)` follows the same `libkernel.sprx` at 0x134D0: a mode other than 1 returns `0x81180000`; mode 1 issues syscall 601 (command 16, arguments 0 and 1) and returns 0 whether or not it fails, since only a raw return of 22 would map to `0x81180000`. No dump is produced here, so mode 1 returns 0 without the syscall. PPSA16833 imports it
 - [sceCoredumpGetStopInfoGpu_Agc](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `Jrs7UUkGOFo`) - `(void* info, size_t size)` follows the same `libkernel.sprx` at 0x137E0: a null `info` returns `0x81180000`; syscall 601 (command 21) failing with `EPERM` returns `NOT_IN_COREDUMP_HANDLER`; otherwise two `libSceAgcDriver` imports (NIDs `+NIAY3DWpOw` and `LgctzJSGy7s`, names unknown) decide between `0x81180005` and, for a `size` of 8, storing the second one's 64-bit result and returning 0, with any other size returning `0x81180000`. The handler is never invoked here, so a non-null `info` returns `NOT_IN_COREDUMP_HANDLER` without writing, assuming `EPERM` outside the handler as above; the AGC branch is not reached
-- [sceKernelInternalMemoryGetModuleSegmentInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the `(InternalSegmentInfo* result)` signature, the 16-byte `{address, size}` result and the choice of the main program's first segment follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L343-L355) only, which fills it through its `sceKernelGetLibkernelTextLocation` from the first segment of `eboot.bin`; whether the console reports that segment, the text of libkernel itself or the calling module's is unknown. The segment is the first one `sceKernelGetModuleInfo` reports for the main program, and 0 is returned. A null result throws. 44 audited titles that bundle their own `libc.prx` import it; no call has been observed
+- [sceKernelInternalMemoryGetModuleSegmentInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - returns the main program's first segment, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L343-L355) does through its `sceKernelGetLibkernelTextLocation`. In a payload process on a PS5 (firmware 13.60) both returned 0 with address and size 0, and a null result faulted (here it throws); what a title process gets is not known. 44 audited titles that bundle their own `libc.prx` import it; no call has been observed
 - [sceKernelGetModuleInfoForUnwind](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) - on Linux the tables come from `sceKernelGetModuleInfoFromAddr`, whose `eh_frame_size` includes the zero terminator, as measured on firmware 13.60 (reported in [#2419](https://github.com/boykopovar/AnyPS5/issues/2419), not reproduced here); on Windows it is assumed to stop before the terminator. LLVM libunwind's `CFI_Parser::findFDE` stops at the terminator or the length, whichever comes first, so it finds the same FDEs either way. Only the main executable and `.guest.prx` images report tables; other host images report none, as on Windows
 - [sceKernelGetModuleInfoForUnwind](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) - on Windows the `.ehmeta` tables and the image file name are cached per allocation base and dropped after a loader free (`dlclose`, `sceKernelStopUnloadModule`, the thread atexit release) when the module is no longer loaded. A table changed in place, or an image freed by anything other than the loader, is not noticed. An address inside an image of the Windows loader's module list whose tables are cached is resolved with `RtlPcToFileHeader` and no `VirtualQuery`; other addresses, and images without tables, still use `VirtualQuery`. The `.eh_frame` walk that finds its end is done once per image instead of once per call
-- [sceKernelGetModuleInfoFromAddr](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the 0x1A8-byte info layout follows the [shadPS4](https://github.com/shadps4-emu/shadPS4) reimplementation; a title's `libc.prx` reads only `id` (PPSA14632). The meaning of `flags` is unknown; only 2 is accepted. The input `st_size` is ignored, because PPSA21703's `libc.prx` passes an uninitialized 0x1A8-byte buffer; the full size is written back. The id is the `sceKernelLoadStartModule` handle of an image opened through the loader and otherwise a stable id from the same range. The name is the host file name without `.guest.prx`. An image with more than 4 load segments (the converted executable has 7) reports its first 4. `tls_offset` is 0 and `ref_count` is 1, as the host loader exposes neither. On Windows the module is the PE image holding the address: a relinked image reports its `.elf` sections as segments and the eh_frame_hdr recorded in `.ehmeta`, any other image its first 4 sections with memory access and the `.ehfram` section without an eh_frame_hdr; the TLS fields and `init_proc_addr`/`fini_proc_addr` are 0
+- [sceKernelGetModuleInfoFromAddr](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - as in a payload process on a PS5 (firmware 13.60), flags 1 finds any module and flags 2 refuses the system ones (`ESRCH`), here the host libraries; other flags clear the 0x1A8 bytes and return `EINVAL`, any failure clears them, `st_size` is left 0, and a null info returns `EFAULT` (with other flags the console faulted; here it throws). Flags 2 finding a title module was not measured. The layout follows [shadPS4](https://github.com/shadps4-emu/shadPS4). The id is the loader handle or a stable id from that range, and the name is the host file name without `.guest.prx`, where the console keeps `.sprx`. Only the first 4 load segments are reported. `tls_offset` is 0 and `ref_count` 1 (the console gave 5 for system modules). On Windows a relinked image reports its `.elf` sections and the `.ehmeta` eh_frame_hdr; the TLS fields and init/fini are 0
 - [sceKernelGetModuleList](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - lists the main program and every loaded `.prx` image in load order; host runtime libraries are left out. The handles are the ids `sceKernelGetModuleInfoFromAddr` reports, not the console's. The `(int32_t* handles, size_t count, size_t* actual)` signature and returning `ENOMEM` without writing `actual` after filling the first `count` handles when more images are loaded follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/libraries/kernel/process.cpp#L244-L264); whether the console writes any handles in that case is unknown
 - [sceKernelGetModuleInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the 0x160-byte layout (`st_size`, `name[256]`, 4 segments, `segment_count`, `fingerprint[20]`) follows [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/sys/sys_types.pas#L319-L337) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/module.h#L15-L31). Only that `st_size` is accepted, as in shadPS4; other sizes return `EINVAL`, a null pointer `EFAULT` and a handle `sceKernelGetModuleList` does not list `ESRCH`. Name and segments are the ones `sceKernelGetModuleInfoFromAddr` reports, on Windows from the same PE sections, so `prot` uses the read/write/execute bits 1/2/4, while fpPS4 and shadPS4 store the ELF `p_flags`. The fingerprint is left zero, as the host image does not carry it
 - [sceKernelGetModuleList2 and sceKernelGetModuleInfo2](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the title-module variants follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/kernel/process.cpp): `sceKernelGetModuleList2` lists what `sceKernelGetModuleList` lists without system libraries, and `sceKernelGetModuleInfo2` answers `EPERM` for a system library after the `EFAULT`, `EINVAL` and `ESRCH` checks of `sceKernelGetModuleInfo`. A system library here is a loaded `.prx` image that is not a relinked title module (`.guest.prx`); the main program and the title's own modules are listed. Not verified on the console. PPSA34063 imports both and fails to load without them
 - [sceKernelGetLibkernelTextLocation](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the `(void** address, std::size_t* size)` signature and the choice of the main program's first segment follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L338-L348); whether the console reports that segment, the text of libkernel itself or the calling module's is unverified. The segment is the first one `sceKernelGetModuleInfo` reports for the main program, and 0 is returned. A null argument throws.
-- [sceKernelReleaseFlexibleMemory](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - unmaps the range like sceKernelMunmap, as fpPS4 and prosper do; whether the console keeps the virtual range reserved after releasing its pages is unverified
+- [sceKernelReleaseFlexibleMemory](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - on a PS5 (firmware 13.60) the released range stays mapped, with its protection and contents (64 MiB checked after 0.5 s), and a fixed no-overwrite map over it fails with `ENOMEM`, as here. What it does to the flexible budget was not measured, because a payload process has none (`sceKernelAvailableFlexibleMemorySize` did not change on map or release); here the released bytes return to the budget while the pages stay mapped, and a later map over them charges them again. The host pages behind a released range stay committed until `sceKernelMunmap`, as `madvise` keeps them for every advice; freeing them would lose the contents the console still returns.
 - [sceKernelAvailableFlexibleMemorySize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - the segments of the title's executable and of its `.guest.prx` modules count against the configured flexible-memory budget (448 MiB by default) while loaded, for this size and for flexible maps. A title may declare a larger budget through `kernel.flexibleMemorySize` in `param.json`; this does not reduce the 13.5 GiB direct-memory size. Rejection of zero or a value not aligned to 16 KiB has not been measured on a console. This segment-accounting model follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/module.cpp#L165), which maps every segment of a module outside its system module directory as flexible memory on the PS4. [Counted](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) are the segments the title's ELF gives permissions, each rounded to 16 KiB pages; not counted are segments without permissions, the relinker's own blocks (on Linux both are the read/write/execute `PT_LOAD`s, plus the header block at file offset 0; on Windows everything outside the `.elf` sections) and the host system libraries. The Linux image carries no marker for the relinker's blocks, so they are told apart by those flags and that offset only: a title segment that is writable and executable, or starts at file offset 0, is not counted. A module whose segments exceed what is left still loads, and the available size then reads 0; shadPS4 fails the segment map instead ([memory.cpp](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/memory.cpp#L519-L524) returns `EINVAL`, [module.cpp](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/module.cpp#L168-L169) asserts). Which segments the PS5 charges, its rounding, whether system modules use the title's budget and when an unload releases the charge are not measured. PPSA15508 subtracts the reported size and a 10 MiB module allowance from its own 448 MiB budget at start-up and stops when the result exceeds its 146 MiB code and data limit ([#2883](https://github.com/boykopovar/AnyPS5/issues/2883))
-- [sceKernelAvailableDirectMemorySize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - how the console handles invalid arguments is not measured. A negative `search_start`, a `search_end` at or below `search_start` and an alignment that overflows when rounded up to 16 KiB return `EAGAIN` (`0x80020023`); bounds that are not multiples of 16 KiB are rounded inward, the alignment is raised to a multiple of 16 KiB and need not be a power of two, and a `search_end` past the pool is cut to it. fpPS4's HLE wrapper on its trunk branch refuses all of these with `EINVAL` ([ps4_map_mm.pas](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_map_mm.pas#L558-L570))
+- [sceKernelAvailableDirectMemorySize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - its arguments follow a payload process on a PS5 (firmware 13.60) ([probes](https://gist.github.com/orezraey/42a06a7ea0d9fb57ac9c06eaf9e6756c)). One answer is not modelled: in a process that had not yet called `sceKernelGetDirectMemorySize` or otherwise touched direct memory, the console returned `EBADF` (`0x80020009`); here the call always searches the pool. Titles open the direct-memory device during start-up, so they are not expected to see it
+- [sceKernelReleaseDirectMemory](../../../core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp) (libkernel) - releases the allocated pages of the range and skips pages that are not allocated, returning 0, while `sceKernelCheckedReleaseDirectMemory` returns `ENOENT` for them, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c206f35a546230d9c9808b823c0f36f5850cd4af/src/core/memory.cpp#L295-L313) does; not measured on a console. Absolum (PPSA28311) releases such a range when it disposes of its video logos
 - [Memory protection bits 0x100 and 0x200](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - taken as audio coprocessor (ACP) read and write, as in the [KytyPS5](https://github.com/KytyPS5/KytyPS5) and [etaHEN](https://github.com/etaHEN/etaHEN) headers; the coprocessor work runs on the host CPU, so they grant host read and read/write access like the GPU bits
 - [Protecting a host thread's stack](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - on Windows `sceKernelIsStack` reports a host thread's whole stack reservation, which Windows commits on demand from the top down behind a guard page. A protect over that range changes only the pages above the guard; the guard page and the reserved pages below it are left as they are, so the stack still grows and an overflow still raises a stack overflow. A protect that starts at the bottom of the reservation and stops short of the guard page, as HotSpot makes its stack guard zones, is committed and protected. Windows moves the guard page down by committing the pages below it as read/write guard pages, whether they were reserved or committed, so those pages come in read/write as the stack grows to within one guard region of them (three pages on GitHub's runners). A protection other than read/write on them, `PROT_NONE` included, does not hold once the stack is that close, where on the console every page of the reported range takes the protection. Holding it would mean removing the thread's guard page and keeping the stack limit in its TEB by hand. On Linux the reported range of the main thread is mostly unmapped; the unmapped pages from the bottom of a protect up to the top of the stack are mapped read/write in place, then the protect is applied, so the stack never has to grow down to the protected pages, which Linux refuses within its stack guard gap (1 MiB by default) above a readable mapping. The pages below a protect stay unmapped and out of the stack's reach, where on the console the stack goes on below them
 - [Foreign guest module image protection on Windows](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMprotect` on Windows allows protection mutations on mapped PE images containing a `.elf0` section (as relinked guest modules produce, such as NVIDIA Real-time Denoisers `libNRD.prx` bundled in Dying Light 2: Stay Human PPSA02262), registering their sections into `GuestAllocations`. Host libraries and system DLLs (such as `libkernel.prx` and `kernel32.dll`) without a `.elf0` section continue to be rejected
 - [_umtx_op](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the mutex, condition variable, read-write lock, legacy lock and `SEM2` operations throw, and so does a misaligned object. Implemented as FreeBSD 11's [kern_umtx.c](https://github.com/freebsd/freebsd-src/blob/stable/11/sys/kern/kern_umtx.c): `UMTX_OP_WAIT`, `UMTX_OP_WAKE`, `UMTX_OP_WAIT_UINT`, `UMTX_OP_WAIT_UINT_PRIVATE`, `UMTX_OP_WAKE_PRIVATE`, `UMTX_OP_NWAKE_PRIVATE`, `UMTX_OP_SEM_WAIT` and `UMTX_OP_SEM_WAKE` (the last two built under `COMPAT_FREEBSD9`/`10`). Operations 0 and 1 fail with `EOPNOTSUPP`, as measured on a PS5 (firmware 12.70). The `SEM2` operations, 23 and 24, were measured on the console and returned `0` for a count of 0 where FreeBSD would time out, so they stay unimplemented.
+- [sceKernelCreateSema, sceKernelPollSema, sceKernelSignalSema, sceKernelDeleteSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - a poll, a signal or a second delete of a deleted semaphore reads freed memory here, where the console returns `0x80020003` (ESRCH) ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L17-L19)). A null output pointer to `sceKernelCreateSema`, an attribute above 2, a negative maximum and a negative signal count throw, as they were not measured. `SCE_KERNEL_ERROR_EINVAL` for an initial count above the maximum or negative, a maximum of 0, a null name, a poll of 0 or above the maximum and a signal of 0 is [measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L10-L23).
 - [sceKernelSyncOnAddressWait](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the only known caller passes a null timeout and a name string as the fourth argument; the timeout is assumed to point to microseconds like the other kernel waits, and the name is ignored
 - [sceKernelSyncOnAddressWait8 / sceKernelSyncOnAddressWait16 / sceKernelSyncOnAddressWait32 / sceKernelSyncOnAddressWait64](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - libc's `__std_atomic_wait_direct_8/16/32/64` pass a microsecond timeout or null and ignore the result; the by-value comparand, return values and the 2- and 8-byte alignment of Wait16 and Wait64 are assumed
 - [scePthreadRwlockDestroy, pthread_rwlock_destroy](../../../core/libs/prx/libkernel/Pthread/src/Rwlock.cpp) (libkernel) - measured on a PS5 (firmware 13.60): destroying a rwlock returns 0 whether it is free or held for reading or writing, and leaves 1 in the handle; every call on that handle then returns `EINVAL` until it is initialized again, and a zero handle is initialized on first use by the `scePthreadRwlock` calls as by the POSIX ones. A rwlock destroyed while held is not freed, so its memory leaks. Destroying a rwlock while another thread is acquiring it is not guarded
-- [scePthreadCondWait / scePthreadCondTimedwait](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) - before waiting, FreeBSD libthr's [`cond_wait_common`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_cond.c#L1992-L2029) checks ownership through [`_mutex_owned`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_mutex.c#L1166-L1178): an unowned mutex returns `EPERM`, while its destroyed marker returns `EINVAL`. An untouched adaptive static initializer (slot value 1) therefore returns `EPERM`; the test covers this, an uninitialized slot, a mutex owned by another thread, and the destroyed marker for both timed and untimed sce and POSIX waits. A recursive mutex locked several times is released completely for the wait and relocked to the same depth afterwards, as FreeBSD libthr does (`_mutex_cv_unlock`, `_mutex_cv_lock`). These FreeBSD-derived behaviors remain unverified on console hardware. Cancellation follows the [POSIX condition wait contract](https://pubs.opengroup.org/onlinepubs/9799919799/functions/pthread_cond_clockwait.html): the original mutex and recursive depth are restored before cleanup, and a canceled waiter forwards a wake to the remaining waiters. The host condition state is retained across mutex reacquisition so the guest can destroy and free its condition after notification; cancellation ordering and signal replacement are not measured on a console
-- [sceKernelSetEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - multi-waiter satisfaction follows fpPS4 in-order evaluation: registered waiters are evaluated in FIFO order and each satisfied waiter's clear mode is applied immediately to the pattern before evaluating subsequent waiters; this ordering is unverified on PS5 console hardware
-- [sceKernelOpenEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - returns the handle of an undeleted event flag this process created with the same name, and `SCE_KERNEL_ERROR_ENOENT` otherwise. Flags owned by other processes, such as the shell's `SceShellCoreUtilAppFocus`, do not exist here, and which attribute makes a flag openable on the console is not modelled. The error code for a missing name and the choice between flags sharing a name are unverified.
-- [sceKernelAioSubmitReadCommandsMultiple / sceKernelAioSubmitWriteCommandsMultiple / sceKernelAioWaitRequests / sceKernelAioPollRequests / sceKernelAioCancelRequest / sceKernelAioCancelRequests / sceKernelAioDeleteRequests](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) - behaviour from shadPS4 (one id per request for the Multiple submits, cancel turns any request aborted and id 0 reports processing, wait mode 2 returns once one request completed, poll copies every state without waiting); the 128 requests or ids per batch limit is from SharpProspero, with an unknown error, so larger batches throw; wait modes other than 1 (and) and 2 (or) throw; null pointers, negative counts and invalid ids return the codes the single-request siblings use, checked before any state is written
+- [scePthreadMutexTimedlock](../../../core/libs/prx/libkernel/Pthread/src/Mutex.cpp), [scePthreadRwlockTimedrdlock, scePthreadRwlockTimedwrlock](../../../core/libs/prx/libkernel/Pthread/src/Rwlock.cpp) (libkernel) - a timed lock of a mutex the caller holds, or of a rwlock it holds for writing, sleeps until its timeout before returning `ETIMEDOUT` (`0x8002003c`), as FreeBSD 11.4 libthr does ([mutex](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutex.c#L878-L928)); whether the console waits is not measured. The prosper oracle measured only the result, for a default mutex and a rwlock with a 1000 us timeout ([kernelx.golden.tsv](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernelx.golden.tsv#L16-L47)); the other mutex types and the POSIX timed locks follow the same rule unmeasured.
+- [scePthreadCondWait / scePthreadCondTimedwait](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) - the mutex's owner is checked before waiting, as in FreeBSD libthr's [`cond_wait_common`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_cond.c#L1992-L2029). Measured in a payload process on a PS5 (firmware 13.60): `EPERM` (`0x80020001`) for an unowned mutex of every type, the adaptive initializer (slot 1), an uninitialized slot and a mutex owned by another thread, `EINVAL` for the destroyed mutex (slot 2), and a recursive mutex is released completely and relocked to its depth. `scePthreadCondDestroy` stores 1, which every condition call refuses with `EINVAL`, and leaves an uninitialized slot alone. Cancellation restores the mutex and depth before cleanup and a canceled waiter forwards a wake, per POSIX; its ordering is not measured
+- [sceKernelOpenEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - opens only flags this process created with attribute 0x100. On the console, other processes' 0x100 flags, such as the shell's `SceShellCoreUtilAppFocus`, can be opened too. They do not exist here, so opening them returns `SCE_KERNEL_ERROR_ESRCH`. A null output with the name of an openable flag returns `SCE_KERNEL_ERROR_EFAULT`, the host's answer to the console's fault there, not a measured code. With a plain flag's name it returns `SCE_KERNEL_ERROR_ESRCH`, as measured; with a missing name it also returns `SCE_KERNEL_ERROR_ESRCH`, which was not measured.
+- [sceKernelCreateEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - when a call has both an invalid attribute and a name of 32 bytes or more, `SCE_KERNEL_ERROR_EINVAL` is returned, because the attribute checks run before the name length check. The console was only measured with long names and valid attributes (0x20 and 0x120), so which error it returns first is not known. Event flag handles are host addresses here, while the console returns small IDs.
+- [sceKernelAioSubmitReadCommandsMultiple / sceKernelAioSubmitWriteCommandsMultiple / sceKernelAioWaitRequests / sceKernelAioPollRequests / sceKernelAioCancelRequest / sceKernelAioCancelRequests / sceKernelAioDeleteRequests](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) - one id per request for the Multiple submits and wait mode 2 returning once one request completed follow shadPS4. Requests run synchronously on submit, so cancel never finds one processing. The console's ids are not the small numbers used here (it returned 33, 0x2021, 0x4021)
+- [sceKernelWaitSema, sceKernelPollSema, sceKernelSignalSema, sceKernelCancelSema, sceKernelDeleteSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - `SCE_KERNEL_ERROR_ESRCH` for a null handle follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/60c42b925c3d1e00008621b8587819999260ec31/src/core/libraries/kernel/threads/semaphore.cpp#L329-L366) (PS4), unverified on PS5. Handles are pointers, so a non-null handle that is not a live semaphore is not detected; shadPS4 returns `ESRCH` for any unallocated handle.
 - [scePthreadAttr setters and getters](../../../core/libs/prx/libkernel/Pthread/src/Attr.cpp) (libkernel) - measured on a PS5 (firmware 13.60): a null or uninitialized attribute returns `EINVAL`, as does a null output of the stack size, detach state and scheduling parameter getters; a policy other than 1 and 3, an inheritance other than 0 and 4, or a priority outside 256 to 767 (or a null parameter) returns `ENOTSUP` (`0x8002002D`); a detach state other than 0 and 1 and a stack size below 16384 return `EINVAL`; any affinity mask is accepted. A null attribute pointer to `scePthreadAttrInit` and a null output of `scePthreadAttrGetaffinity` crashed the payload, so they still throw. A new attribute holds a 64 KiB stack size on the console and 1 MiB here, which the host code that runs on guest threads needs. `scePthreadAttrGetschedpolicy` and `scePthreadAttrGetinheritsched` were not measured and follow [FreeBSD 11.4 libthr](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_attr.c#L216-L262); a null output of `scePthreadAttrGetinheritsched` throws, since libthr writes through it unchecked
 - [scePthreadAttrGet](../../../core/libs/prx/libkernel/Pthread/src/Attr.cpp) and [pthread_attr_get_np](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) - the returned scheduling policy is unmeasured on a console. Both report the recorded guest policy, following [FreeBSD 11.4 libthr](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_attr.c#L134-L164)
 - [pthread_getprio](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) is unmeasured on the console. NID `aO+WS2xWuo4` is named in the firmware 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libkernel.c). Its return and errno contract follows FreeBSD 11 [thr_getprio.c](https://github.com/freebsd/freebsd-src/blob/671fb7df97631020c42ce55527dc49fffe0656b7/lib/libthr/thread/thr_getprio.c): return the recorded guest priority, or -1 with `ESRCH` for an unknown or finished thread. The live-thread registry lock protects the read from a concurrent join. This reports guest scheduler state, not the host scheduling priority.
@@ -72,28 +83,30 @@
 - [sceKernelGetAvailableCpumask](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - returns the default thread affinity, 0x1FFF (CPUs 0 to 12), as KytyPS5 does. Titles pin threads within it (PPSA02664 passes 0x1FFB, Hades II PPSA36082 0x3 and 0x3F); whether CPU 13 is available to a title is not confirmed
 - [sceKernelGetCurrentCpu](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - guest affinities are not applied to host threads, so the host CPU index is mapped into the calling thread's affinity clipped to `sceKernelGetAvailableCpumask` (the available mask when they do not overlap): host CPU n reports the (n modulo the CPU count)-th CPU of that mask, so a thread pinned to one CPU reports that CPU, as a FreeBSD `cpuset` guarantees on the console. Which CPU the console reports for a thread allowed on several is not known; shadPS4 returns 0
 - [pthread_attr_setsolosched_np](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) takes `(attr, int)` and stores the value through `scePthreadAttrSetsolosched`, returning `EINVAL` (22) for a null or uninitialized attribute like the other POSIX attribute setters. Only the name is public (aerolib `2+pVfgiEd7A`); the signature and behaviour follow the SCE twin, which [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/947627d10d4ef4b68ba3c0189aab6c368e70a8d2/src/kernel/pthread.cpp#L2188-L2199) and [sharpemu](https://github.com/sharpemu/sharpemu/blob/a2983692930564815a77f81e74c151268f5b935f/src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs#L891-L913) store as an `int` without a range check, and [PS5PCEM](https://github.com/iStark/PS5PCEM/blob/71de7681f06c5db59a1120a3bb554c86780c3f5f/src/hle/libs/kernel_threading.zig#L1396-L1398) implements this alias over it. On a PS5 (firmware 13.60) only 0 and 16 are accepted; every other value returns `ENOTSUP` (45, `0x8002002D` from the SCE call) and keeps the stored one, and the SCE calls return `EINVAL` for a null or uninitialized attribute. PPSA15878 passes 16. Threads created from the attribute are not scheduled differently; what solo scheduling does on the console is unknown. Returnal (PPSA01285 v03.000.005) stopped on it with `what(): pthread_attr_setsolosched_np_nid_postfix not implemented` (#2872, #1155); LEGO Horizon Adventures (PPSA14632, #734) and Palworld (PPSA23126, #2598) import it
+- [pthread_main_np and scePthreadMain](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel_sys) - console behaviour is unmeasured. Linux identifies the process initial thread by kernel TID/PID equality, including worker-first loading. Other hosts identify the thread that initialized libkernel; loading it first from a worker can misidentify the initial thread. The pre-initialization -1 state is not exposed.
 - [sceKernelMapFlexibleMemory / sceKernelMapNamedFlexibleMemoryInternal](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - flag 0x8000 is accepted and ignored; its meaning is not established. KytyPS5 (`GUEST_MAP_UNKNOWN_8000`) and sharpemu accept it without reading it. Every known caller is an SDK 9 `libc.prx` heap, which passes it with read/write protection and uses the mapping as an older `libc.prx` uses `sceKernelMapNamedFlexibleMemory` with flags 0: through the Internal variant in PPSA21564, through `sceKernelMapFlexibleMemory` in PPSA22520 01.000.011
 - [sceKernelMtypeprotect](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - sets the memory type of the direct mappings in the page-rounded range and of the direct memory behind them, as shadPS4 and prosper do (KytyPS5 ignores the type); the type is not validated, flexible pages in the range only get the protection, and a later map of the retyped direct memory reports the type it was allocated with. `sceKernelBatchMap2` operation 4 takes the same path with the entry type
 - [Map hints inside a reservation](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMapDirectMemory` and the flexible and anonymous maps place a mapping without `MAP_FIXED` at its hint address when the whole range lies in a range still reserved by `sceKernelReserveVirtualRange`, as if `MAP_FIXED` were set. Taken from PPSA01474, which reserves 64 GiB and then maps its heaps inside it with hints and no `MAP_FIXED`, and uses the hint addresses afterwards; not measured on the console. Hints outside a reservation, or over a range that is partly mapped, stay hints
-- [Fixed anonymous mmap](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `MAP_PRIVATE | MAP_ANON | MAP_FIXED` replaces the requested range through the existing guest mapping machinery and zeroes the new memory. `MAP_EXCL` is checked under the allocation-registry mutation lock, including virtual reservations, and returns `ENOMEM` without changing an occupied range; without `MAP_FIXED` it is `EINVAL`. Lengths are rounded to 16 KiB and fixed addresses must be aligned. The complete rounded range must lie inside the guest arena or, for POSIX fixed anonymous `mmap` on Windows, one current or registered native thread stack; other mapping APIs do not opt into stack replacement. Native stack replacement keeps the reservation, decommits and recommits fresh pages, and rejects foreign allocations, ranges spanning reservations and host `PAGE_GUARD` pages before mutation. Current-stack ranges must end at least 64 KiB below the active host frame; callers replacing another thread's stack must coordinate with that thread. If recommitting fails, the call returns `ENOMEM` with the range still reserved; thread cleanup attempts to recommit it before restoring write access. This follows FreeBSD 11.4 [argument validation and rounding](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L226-L299), [fixed replacement](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1455-L1464), and [collision errno](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1604-L1613). The console behaviour has not been measured. AnyPS5 starts the guest arena at 0x200000000, so the fixed path rejects the low 0x400000 address requested by PICO-8 PPSA99808. The console address-space layout is unmeasured; executable placement outside the host arena is tracked in #5217. Static catalog disassembly finds `0x1012` in PPSA98001/PPSA99808 and `0x5012` in PPSA99808; these titles were not run.
+- [Fixed anonymous mmap](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `MAP_PRIVATE | MAP_ANON | MAP_FIXED` replaces the requested range through the existing guest mapping machinery and zeroes the new memory. `MAP_EXCL` is checked under the allocation-registry mutation lock, including virtual reservations, and returns `ENOMEM` without changing an occupied range; without `MAP_FIXED` it is `EINVAL`. Lengths are rounded to 16 KiB and fixed addresses must be aligned. The complete rounded range must lie inside the guest arena or, for POSIX fixed anonymous `mmap` on Windows, one current or registered native thread stack; other mapping APIs do not opt into stack replacement. Native stack replacement keeps the reservation, decommits and recommits fresh pages, and rejects foreign allocations, ranges spanning reservations and host `PAGE_GUARD` pages before mutation. Current-stack ranges must end at least 64 KiB below the active host frame; callers replacing another thread's stack must coordinate with that thread. If recommitting fails, the call returns `ENOMEM` with the range still reserved; thread cleanup attempts to recommit it before restoring write access. This follows FreeBSD 11.4 [argument validation and rounding](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L226-L299), [fixed replacement](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1455-L1464), and [collision errno](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1604-L1613). The console behaviour has not been measured. Linux and Windows accept addresses from 64 KiB that no host mapping occupies, such as the 0x400000 imported by PICO-8 PPSA99808; macOS keeps the 0x200000000 start. Non-fixed private anonymous mappings keep their hint; null hints still use the 8 GiB area. On Windows the host's `KUSER_SHARED_DATA` always occupies 0x7ffe0000, so Wine's shared user data page (Forever Launcher PPSA99030) cannot be placed there. The console address-space layout is unmeasured; executable placement outside the host arena is tracked in #5217. Static catalog disassembly finds `0x1012` in PPSA98001/PPSA99808 and `0x5012` in PPSA99808; these titles were not run.
 - [Mapping hints with no room above them](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - a mapping without `MAP_FIXED` whose hint lies above the guest address space, or has no free range at or above it, is placed from the bottom of the guest arena, as FreeBSD 11.4's [`vm_mmap_object`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1569) retries through [`vm_map_find_min`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1555-L1584) from its minimum address. FreeBSD's minimum is the end of the largest possible data segment rather than the start of the arena, and the console's address-space layout is not measured. PS5CEMU-HAR (PPSA99360) gives `sceKernelReserveVirtualRange` a hint near its own code, which is a host address here because the relinked executable lies outside the guest arena, so its JIT gets memory more than 2 GiB from its code and does not start
-- [_sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement](../../../core/libs/prx/libkernel/System/src/Rtld.cpp) (libkernel) - the argument is the `dso` address a title's `libc.prx` passes to `__cxa_thread_atexit` (PPSA14632), which fails when Increment returns nonzero. As in the [fpPS4](https://github.com/red-prig/fpPS4) reimplementation, Increment takes a reference on the loaded image containing the address and Decrement releases one; the variants without the leading underscore are assumed to match
+- [_sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement](../../../core/libs/prx/libkernel/System/src/Rtld.cpp) (libkernel) - the argument is the `dso` address a title's `libc.prx` passes to `__cxa_thread_atexit` (PPSA14632), which fails when Increment returns nonzero. As in a payload process on a PS5 (firmware 13.60), Increment returns -1 for an address outside every module (null, stack, heap) and 0 otherwise, and Decrement never fails on an address outside every module or after a matching Increment; the console's Decrement returns nothing, here 0. A Decrement on a module's address without a matching Increment was not measured and throws here. The module's `ref_count` did not change on the console. As in [fpPS4](https://github.com/red-prig/fpPS4), Increment here takes a reference on the image and Decrement releases one. The variants without the leading underscore are not exported by firmware 13.60's `libkernel_sys`; here they match
+- [pthread_cleanup_push, pthread_cleanup_pop](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel, NIDs `4ZeZWcMsAV0`, `RVxb0Ssa5t0`) share the caller-record cleanup list with `__pthread_cleanup_push_imp` and `__pthread_cleanup_pop_imp`, following [FreeBSD 11.4 thr_clean.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libthr/thread/thr_clean.c). The firmware body reading reported by [PR8428](https://github.com/boykopovar/AnyPS5/pull/8428) also sets the thread's unwind-disabled flag in the heap form; that flag is not modeled here, and runtime-created guest threads skip guest-frame unwinding in these exit paths. The firmware observation is attributed to that contributor, not independently reproduced. Heap records use C++ `new` here, whereas the FreeBSD reference leaves the cleanup list unchanged if `malloc` fails; console allocation-failure behavior and its interaction with unwinding remain unverified.
 - [tcgetattr, tcsetattr](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel) - every file and pipe descriptor is taken as not a terminal (`ENOTTY`), and a socket gets `EADDRNOTAVAIL` for `AF_INET` and `EOPNOTSUPP` otherwise, as FreeBSD's `in_control` and `pru_control_notsupp` answer a termios ioctl; what descriptors 0 to 2 of a title are on the console, and whether any of them is a terminal there, is unknown
 - [cfsetspeed](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel, NID `C1MQ6OaXRjo`) - console behavior and module/library versions are unverified. The prototype, uint32 speed and 44-byte termios layout (input speed at 36, output speed at 40) follow the public PS5 payload SDK [termios.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/termios.h) and [sys/_termios.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/sys/_termios.h). The module association follows its libkernel stub table and the NID rehashes to the aerolib name. Both speed fields accept every uint32 value and no flags or control characters change, as [FreeBSD 11.4 termios.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/gen/termios.c) does. No terminal I/O is performed. Null pointers throw where the reference dereferences them.
-- [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) - descriptor 0 is never reported readable and descriptors 1 and 2 are always writable, as for a console title with no input; reads from descriptor 0 still go to the host stdin. `/dev/random` and `/dev/urandom` follow `randomdev_poll` for a seeded device under [`selscan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1178-L1236), which asks once with the flags of every set the descriptor is in: in the read set they are readable and reported in no other set, and otherwise they are reported in the write and exception sets they were asked in. A regular file, a directory or a file read from app0.zar is always readable and writable and never in the exception set, as `vop_stdpoll` answers, on every host. Guest sockets and libSceNet sockets are polled. A kqueue is readable while one of its events is triggered and is never writable or in the exception set, as FreeBSD 11.4's [`kqueue_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c#L1900-L1924) answers, on every host. Other descriptors are polled through the host on Linux, while on Windows pipes are checked every millisecond with the readiness test `poll` uses and any other descriptor throws. Dungeons (PPSA16064) selects on descriptor 0, and RetroArch (PPSA99169) selects on its web server's wake-up pipe next to its listening socket
-- [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) - a descriptor the socket poller reports as unknown that is below `GuestSockets::FirstDescriptor` is polled on the host instead of throwing (on Windows only a pipe, as above); an invalid host descriptor fails with `EBADF`, and mixed host and socket sets are polled in short alternating slices so neither side waits out the full slice alone. A descriptor that stops being a socket, a kqueue or a pipe during the wait fails the call with `EBADF` when it is closed and is selected again with the rest of the timeout when its number was reused, as FreeBSD 11.4's [`kern_select`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1129-L1140) looks every descriptor up again in each pass. A close that has already removed the descriptor from the guest's kqueue, pipe or file tables but not yet closed its host descriptor is seen by that new look-up as a descriptor of unknown kind, which throws on Windows and is polled through the host on Linux. Wobbly Life (PPSA29413) selects on file descriptors while streaming its bundles
+- [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) - console standard-stream behavior is unverified. Regular files, directories and archived files at descriptors 0 to 2 use vnode readiness, including host redirection (`< file`, `> log.txt` or `2> log.txt`): they are readable and writable even at EOF. Other standard descriptors reaching the fallback use the console model: descriptor 0 is never reported readable and descriptors 1 and 2 are writable; reads from descriptor 0 still go to host stdin. `/dev/random` and `/dev/urandom` follow `randomdev_poll` for a seeded device under [`selscan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1178-L1236), which asks once with the flags of every set the descriptor is in: in the read set they are readable and reported in no other set, and otherwise they are reported in the write and exception sets they were asked in. A regular file, a directory or a file read from app0.zar is always readable and writable and never in the exception set, as `vop_stdpoll` answers, on every host. Guest sockets and libSceNet sockets are polled. A kqueue is readable while one of its events is triggered and is never writable or in the exception set, as FreeBSD 11.4's [`kqueue_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c#L1900-L1924) answers, on every host. Other descriptors are polled through the host on Linux, while on Windows pipes are checked every millisecond with the readiness test `poll` uses and any other descriptor throws. Dungeons (PPSA16064) selects on descriptor 0, and RetroArch (PPSA99169) selects on its web server's wake-up pipe next to its listening socket
+- [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) - a descriptor the socket poller reports as unknown is polled on the host instead of throwing (on Windows only a pipe, as above); an invalid host descriptor fails with `EBADF`, and mixed host and socket sets are polled in short alternating slices so neither side waits out the full slice alone. A descriptor that stops being a socket, a kqueue or a pipe during the wait fails the call with `EBADF` when it is closed and is selected again with the rest of the timeout when its number was reused, as FreeBSD 11.4's [`kern_select`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1129-L1140) looks every descriptor up again in each pass. A close that has already removed the descriptor from the guest's kqueue, pipe or file tables but not yet closed its host descriptor is seen by that new look-up as a descriptor of unknown kind, which throws on Windows and is polled through the host on Linux. Wobbly Life (PPSA29413) selects on file descriptors while streaming its bundles
 - [__progname](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - unknown data export
 - [environ](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - data export pointing to a fixed empty environment so titles that import it load; it is not the environment libc's `getenv` reads, so it lists none of those variables and `setenv`/`putenv` changes do not appear in it
 - [seteuid, setegid, setuid, setgid, setreuid, setregid, setresuid, setresgid, setgroups, getgroups](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - the guest process is assumed to run as root, with real, effective and saved user and group ids 0. As in FreeBSD's `sys_seteuid`, `sys_setegid`, `sys_setuid`, `sys_setgid`, `sys_setreuid`, `sys_setregid`, `sys_setresuid` and `sys_setresgid`, id 0 (or -1 for an unchanged `setreuid`/`setregid`/`setresuid`/`setresgid` id) is then accepted without a privilege check and changes no credential, so 0 is returned; any other id would change an id, which is not modelled, and throws. `setgroups` keeps the supplementary group list as `kern_setgroups` does (`NGROUPS_MAX` 1023, an empty list leaves the effective group as the only entry, a first entry other than 0 would change the effective group and throws) and `getgroups` reports it. The ids and privileges a title has on a console are unverified
 - [pthread_getname_np](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - a thread that has already been joined returns `ESRCH` (3) and its output buffer is left untouched, as measured on a PS5 (firmware 13.60) by the author of this entry; since [#4481](https://github.com/boykopovar/AnyPS5/pull/4481) the joined thread's object is retained, so the posix wrapper answers `ESRCH` for it instead of reading the retained name. A null name buffer is answered with `EFAULT` before that, an order the console table does not measure. The SCE sibling `scePthreadGetname` has no measured joined-thread behaviour on the console and still reads the retained object's name, so it is unchanged, as is the pre-existing dangling case of a thread that ended detached (its object is released at exit; see the scePthreadJoin entry)
 - [sceKernelGetOperationMode](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - the signature `(int* mode, int* submode)` comes from PPSA12544, which logs both values after the call and ignores the result. A homebrew payload on a PS5 (firmware 13.60) reads mode 2 and submode 0, nothing else is written, and the result register holds no status, so the function is taken to return nothing. Whether a title process reads the same values is unverified. Null outputs throw
-- [sceCoredumpGetStopInfoCpu](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) has no active coredump context. Native null/size validation is recovered, including both 8-byte and 16-byte records; valid requests return `NOT_IN_COREDUMP_HANDLER` without accessing the output. Active-handler data retrieval remains unimplemented.
+- [sceCoredumpGetStopInfoCpu](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) has no active coredump context. Native null/size validation is recovered, including both 8-byte and 16-byte records; valid requests return `NOT_IN_COREDUMP_HANDLER` without accessing the output. Active-handler data retrieval remains unimplemented. One title (PPSA02225) disassembled for this entry calls it once (arguments set up at 0x8d67dd and 0x8d67e1) with a stack buffer and the length 0x10: for 0x81180005 it branches away, for 0 it reads a 32-bit code at offset 8 of the buffer, and for any other nonzero result, which includes the `NOT_IN_COREDUMP_HANDLER` result returned here, it formats an error text containing the code. The call does not show what the console returns outside a coredump handler.
 - [sceCoredumpGetThreadContextInfo](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) validates a nonnull 144-byte output using the native checks. Active-handler register capture remains unimplemented; valid requests return `NOT_IN_COREDUMP_HANDLER` without accessing the output.
 - [sceCoredumpAttachMemoryRegion, sceCoredumpAttachUserMemoryFile](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) cannot attach memory to an active coredump. The native signed 32-bit length is recovered: negative lengths are ignored successfully; other calls return the outside-handler error without accessing memory. Capture and kernel-side record limits remain unimplemented.
-- [sceCoredumpWriteUserData, sceCoredumpDebugTextOut](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) have no active coredump report. WriteUserData validates a nonnull buffer and size at most `INT32_MAX`, including zero; accepted requests return the sign-extended outside-handler error. DebugTextOut still prints to stderr instead of a report; its validation and report integration remain unverified.
-- [sceCoredumpAttachUserFile, sceCoredumpAttachMemoryRegionAsUserFile](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) cannot write files to an active coredump. Native null-name checks, the signed 32-bit memory length and SDK 6.50 flag validation are recovered. Nonnegative requests return the outside-handler error; negative memory lengths are ignored after name/flag validation. Kernel-side path handling and capture limits remain unimplemented.
+- [sceCoredumpWriteUserData, sceCoredumpDebugTextOut](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) have no active coredump report. WriteUserData validates a nonnull buffer and size at most `INT32_MAX`, including zero; accepted requests return the sign-extended outside-handler error. DebugTextOut still prints to stderr instead of a report; its validation and report integration remain unverified. One title (PPSA02225) disassembled for this entry makes six calls to `sceCoredumpWriteUserData` (at 0x6a1c4, 0x6a1e1, 0x6a1fe, 0x6a21b, 0x6a235 and 0x6a24e) right after `sceCoredumpSetUserDataType(1)`: five with a length of 1 and one with a length of 5. After each call it stores a negative result in a 32-bit field of its own object and ignores other results, so the outside-handler error returned here would be stored. What the bytes mean is not shown.
+- [sceCoredumpAttachUserFile, sceCoredumpAttachMemoryRegionAsUserFile](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) cannot write files to an active coredump. Native null-name checks, the signed 32-bit memory length and SDK 6.50 flag validation are recovered. Nonnegative requests return the outside-handler error; negative memory lengths are ignored after name/flag validation. Kernel-side path handling and capture limits remain unimplemented. One title (PPSA21480) disassembled for this entry calls `sceCoredumpAttachMemoryRegionAsUserFile` (0x83177-0x83186) with 0, a stack buffer passed to a helper first, the length 0x1618 and a file name string, only when a flag of the title is set, and `sceCoredumpAttachUserFile` (0x831cb, 0x831d2) with 0 and a string, only when a method of the title returns a nonzero pointer. It checks both results only for a negative value. What the first argument 0 and the strings mean on the console is not shown.
 - [sceKernelAddTimerEvent](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) - `usec` is taken as the period in microseconds; re-adding an existing timer keeps its pending expiration count and restarts the period from the time of the call, where FreeBSD 12+ `filt_timertouch` clears pending expirations on `EV_ADD`; `usec == 0` fires on every wait. None of this is confirmed on a PS5 title
-- [sceKernelWaitEqueue](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) - a level-triggered user event (`sceKernelAddUserEvent`) is reported at most once per call, as in FreeBSD `kqueue_scan` (`sys/kern/kern_event.c`), which re-queues a reported knote without `EV_CLEAR` or `EV_DISPATCH` behind the scan marker, and kevent(2), where several triggers do not produce several kevents. Not measured on a console. Events are scanned in list order and the list is not rotated, so when `num` is smaller than the number of ready level events the later ones can starve, where FreeBSD moves a reported level knote to the tail. Several completions of one AMPR or VideoOut event within one call are returned as separate entries, where FreeBSD would aggregate them; the Orbis behaviour is unconfirmed
+- [sceKernelWaitEqueue](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) - a level-triggered user event (`sceKernelAddUserEvent`) is reported at most once per call, as in FreeBSD `kqueue_scan` (`sys/kern/kern_event.c`), which re-queues a reported knote without `EV_CLEAR` or `EV_DISPATCH` behind the scan marker, and kevent(2), where several triggers do not produce several kevents. Not measured on a console. A reported event moves to the end of the list, so events are reported in the order they were last reported, and those never reported come first in registration order. FreeBSD `knote_enqueue` queues them in the order they fire. Several completions of one AMPR or VideoOut event within one call are returned as separate entries, where FreeBSD would aggregate them; the Orbis behaviour is unconfirmed
 - [AC1FtjqMCL0](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
 - [0iEKNAvT600](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
 - [2cELEBPdYQ0](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
@@ -111,10 +124,9 @@
 - [pnz21I6VjDs](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
 - [qk043QPsrZU](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
 - [uDGXwUKqi8s](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
-- [sceKernelGetCpuTemperature, sceKernelGetSocSensorTemperature](../../../core/libs/prx/libkernel/System/src/ThermalSensors.cpp) (libkernel) - read the host's thermal sensors: on Linux from `/sys/class/hwmon` and `/sys/class/thermal`, on Windows from the ACPI thermal zones (`MSAcpi_ThermalZoneTemperature` over WMI) and the storage temperature property of the first physical drive. Sensor 0 is the CPU/package value, 1 the first other value and 2 an NVMe value; a host that exposes none reports every sensor as unsupported (`EINVAL`). The console's SoC channel count and meanings are hardware-dependent and differ from the host's, the host sensors are not the console's, the ACPI reading is unavailable on many machines, and the storage temperature property is numbered 52 on Windows 10 2004 and later and 22 before it, so the mapping, the values and the unsupported-input error are unverified; the storage channel was checked against the drive's own SMART composite temperature on one NVMe host (`StorageDeviceTemperatureProperty`, 36 °C on a WD_BLACK SN7100). `sceKernelGetCpuTemperature` reports sensor 0. PPSA99058 and PPSA99420 call both
-- [LinuxProtFromSce](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - protection bits 0x100 and 0x200 are accepted and assumed not to affect host CPU access; host protection is derived only from the read, write and execute bits
-- [getdtablesize](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - returns the smaller of the `RLIMIT_NOFILE` soft limit of `getrlimit` and the host's `getdtablesize()`, capped at `INT_MAX`: FreeBSD returns the smaller of the `RLIMIT_NOFILE` soft limit and `maxfilesperproc` ([`sys_getdtablesize`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L338-L355)), and the host call supplies that bound on macOS, where the soft limit alone is not one (`setrlimit` accepts soft limits above `maxfilesperproc`, `RLIM_INFINITY` included); `maxfilesperproc` is not measured on the console. The guest limit is the host's soft limit, raised to the hard limit when libkernel loads only on Linux: `core/libs/prx/libkernel/File/src/OpenFileLimit.cpp` is `__linux__`-only, so on macOS the guest gets whatever soft limit the host process inherited. VLC (PPSA85300) imports it for a `closefrom` loop in the child of its spawn helper ([libc_stubs.c](https://github.com/ZiZc3/VLC/blob/d46be6a68f4244466b041c2dc1b640915ac1a983/ps5/compat/libc_stubs.c#L66-L72)), which never runs because its `fork` fails with `ENOSYS`
-- [close, sceKernelClose](../../../core/libs/prx/libkernel/File/src/HostStreams.cpp) (libkernel) - descriptors 0 to 2 that are open when libkernel loads belong to the host process: closing one fails with `EBADF` and leaves it open. The console's result is unknown. PPSA21703 calls `sceKernelClose(0)` repeatedly; closing the host stream let the host C runtime give descriptor 0 to the next file opened, which the next call then closed
+- [sceKernelGetCpuTemperature, sceKernelGetSocSensorTemperature](../../../core/libs/prx/libkernel/System/src/ThermalSensors.cpp) (libkernel) - channels 3 to 64 throw, and a channel the host has no sensor for returns `EINVAL`, where a payload process on PS5 firmware 13.60 read 49 to 54 °C from channels 0 to 63 and always -49 from 64; a null output with a valid channel returns `EFAULT`, where the console faults. Otherwise they follow the console: a channel outside 0 to 64 returns `EINVAL` before the output is looked at, and `errno` is set with the error. The values come from the host: on Linux `/sys/class/hwmon` and `/sys/class/thermal`, on Windows the ACPI thermal zones over WMI and the storage temperature property of the first physical drive (52 on Windows 10 2004 and later, 22 before). Channel 0 is the CPU/package value, 1 the first other value and 2 an NVMe value; `sceKernelGetCpuTemperature` reports channel 0. PPSA99058 and PPSA99420 call both
+- [getdtablesize](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - returns the smaller of the `RLIMIT_NOFILE` soft limit of `getrlimit` and the host's `getdtablesize()`, capped at `INT_MAX`: FreeBSD returns the smaller of the `RLIMIT_NOFILE` soft limit and `maxfilesperproc` ([`sys_getdtablesize`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L338-L355)), and the host call supplies that bound on macOS, where the soft limit alone is not one (`setrlimit` accepts soft limits above `maxfilesperproc`, `RLIM_INFINITY` included); `maxfilesperproc` is not measured on the console. On Linux and macOS the guest limit is the host's soft limit. VLC (PPSA85300) imports it for a `closefrom` loop in the child of its spawn helper ([libc_stubs.c](https://github.com/ZiZc3/VLC/blob/d46be6a68f4244466b041c2dc1b640915ac1a983/ps5/compat/libc_stubs.c#L66-L72)), which never runs because its `fork` fails with `ENOSYS`
+- [close, sceKernelClose](../../../core/libs/prx/libkernel/File/src/HostStreams.cpp) (libkernel) - descriptors 0 to 2 that are open when libkernel loads belong to the host process: closing one fails with `EPERM` (`sceKernelClose`: `0x80020001`) and leaves it open, as closing the open descriptors 0 to 2 of a payload process did on a PS5 (firmware 13.60); whether a title process can close them is unverified. PPSA21703 calls `sceKernelClose(0)` repeatedly; closing the host stream let the host C runtime give descriptor 0 to the next file opened, which the next call then closed
 - [sceKernelPrintBacktraceWithModuleInfo](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - imported by PS4 titles, which do not load without it, and added without an implementation: declared without parameters, every call throws
 
 - [pthread_timedjoin_np](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel, NID `PkS44IGrDkM`) - the signature follows [ps5-payload-dev/sdk](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/pthread_np.h#L71); deadline validation, absolute realtime deadlines, error precedence and join ownership follow [FreeBSD libthr](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libthr/thread/thr_join.c). The [public 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libkernel.c) lists this NID, but PS5 behavior and module/library versions have not been measured. Realtime is rechecked at most two seconds apart while waiting. After guest cleanup completes, final native thread teardown uses the existing unbounded join and may finish after the deadline; host teardown is not bounded by this implementation.
@@ -122,13 +134,20 @@
 ### Functional
 
 - [scePthreadYield](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) on Windows calls Sleep(1) after 512 consecutive yields that find no other thread ready on the current processor and arrive less than ~10,000 TSC ticks apart (so the span varies with host CPU TSC rate); FreeBSD sched_yield never sleeps.
+- [__tls_get_addr](../../../core/libs/prx/libkernel/Module/src/Tls.cpp) (libkernel, NID `vNe1w4diLCs`) throws on macOS, where the relinker binds guest modules to `Aps5GuestTlsGetAddr_nid_no_patch`, which no library defines yet; it also throws for a null index, module 0 and a Windows thread without a block for the module. It reads the module word as the relinker writes it for `R_X86_64_DTPMOD64`: on Windows the address of the module's PE `_tls_index`, resolved through the thread's `ThreadLocalStoragePointer` as in [WindowsGuestStartup.cpp](../../../core/relinker/elfpatcher/src/windows/WindowsGuestStartup.cpp); on Linux the glibc module ID, passed to glibc's `__tls_get_addr`. Guest modules' imports are bound to the host resolver, so this export is reached only through a lookup by NID.
+- [sceKernelGetTscFrequency](../../../core/libs/prx/libkernel/Time/Time.cpp) (libkernel) pins its thread to the CPU it runs on for the 20 ms measurement, so that both TSC reads come from one counter. If the pin can't be set (`sched_getcpu` or `pthread_getaffinity_np` fails on Linux, `SetThreadAffinityMask` fails on Windows), the measurement runs unpinned. On a host whose CPU TSCs differ, the result can then be wrong as before. Neither call is known to fail for the calling thread's own CPU, which is always in its allowed set. macOS never pins.
 - [Guest thread scheduling](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - the policies and priorities that `sched_get_priority_max`, `sched_get_priority_min`, `pthread_setschedparam` and `scePthreadSetschedparam` accept, and those a created thread takes, follow a PS5 (firmware 13.60), but they are only recorded and reported: they are not applied to host threads, so a title's priority order has no effect on host scheduling
+- [Linux runtime module initialization](../../../core/libs/prx/libkernel/Module/src/DynamicLoader.cpp) (libkernel) - modules in explicit runtime directories can be mapped for bindings before an explicit guest load runs their entry and init array once with the caller arguments. Finalizers run only after initialization completed. Console dependency-start and finalization ordering are unmeasured. Windows and macOS use their existing lifecycle paths.
+
 - [sceKernelMprotect, sceKernelMtypeprotect](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) over a range with a gap that is not registered in the allocation tracker protect the registered parts and skip the gap, and return 0, as FreeBSD 11.4's [`vm_map_protect`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/vm/vm_map.c) does (it has no check for holes); a range whose start is unmapped (also when later pages are mapped) returns `SCE_KERNEL_ERROR_EINVAL` (`mprotect`: `EINVAL`) because an existing test pins that for an unmapped start; FreeBSD answers 0 there too (`vm_map_protect` takes the next entry), so this errno is not taken from the source and was not changed. `sceKernelMprotect` threw for a gap before, which ended the title. Every part is checked for a GPU or image pin before the first one is protected; the parts are then protected one after the other, so a host protection failure in a later part leaves the earlier parts changed (FreeBSD's `vm_map_protect` cannot fail in its second pass). The behaviour on the console is not known. None of this was measured on a console.
 - [sceKernelMprotect protection bits](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - bits outside `0x3F7` are dropped instead of refused, in the POSIX `mprotect` as well (FreeBSD 11.4 masks the argument, `sys/vm/vm_mmap.c:613`; the console was measured only through `sceKernelMprotect`), as a PS5 (firmware 13.60) drops them: Onimusha: Way of the Sword (PPSA27836 01.000.001) maps direct memory with `0xf2` and then protects it with `0xfffffff2`, which the console reports as `0xf3` and then `0x3f3`. In a payload process the console also drops the CPU execute bit (`0x4`) of flexible, direct and JIT memory, and POSIX `mprotect` with write and execute reports write only (`0x2`). A title process may keep execute, so it is kept here. The map calls and `sceKernelMtypeprotect` refuse undefined bits on the console with `EINVAL` (`0x80020016`), and the direct map calls refuse execute; here both throw for undefined bits, and the direct map calls map execute
+- [JIT shared memory on macOS](../../../core/libs/prx/libkernel/DirectMemory/Jit.cpp) (libkernel) - the object is an unlinked `mkstemp` file in the temporary directory, as `shm_open` makes its anonymous objects. macOS refuses an executable shared file mapping (`EPERM`), so an executable view is mapped without execute and then given it with `mprotect`. Under Rosetta 2 (Apple M2, macOS 26), code rewritten through one view after it ran from another keeps its old translation until the executable view's protection changes; first writes and a single read-write-execute view, as XPSemu PPSA97358 and VLC PPSA85300 map, are seen. `mmap` of a JIT descriptor is not supported, as file-backed guest `mmap` throws on macOS.
 - [JIT shared memory](../../../core/libs/prx/libkernel/DirectMemory/Jit.cpp) (libkernel) - `sceKernelJitCreateSharedMemory`, `sceKernelJitCreateAliasOfSharedMemory` and `sceKernelJitMapSharedMemory` take the signatures of [Orbital](https://github.com/AlexAltea/orbital)'s `tools/ida/db_types.json` (name, length, maximum protection, descriptor out; descriptor, maximum protection, descriptor out; descriptor, protection, address in and out), which ps4sdk, ps5-jar-loader and the call sites in RetroArch PPSA99169, XPSemu PPSA97358 and VLC PPSA85300 match; SharpProspero declares the alias as returning the descriptor. The object is a host anonymous file shared by its descriptors (a `memfd` on Linux, a delete-on-close temporary file mapped as an executable section on Windows), the alias is a duplicate descriptor, and every map maps the whole object, so writes through one view show through the others; a non-null address is a hint, as in `mmap` without `MAP_FIXED`. Not measured on the console: a length that is zero or not a multiple of 16 KiB and protection bits other than CPU read, write and execute are `EINVAL`; an alias or a map asking for more than the descriptor's maximum protection (write and execute counting as read) is `EACCES`, as FreeBSD 11's `vm_map_protect` treats a protection past `max_protection`; a descriptor that is not a JIT object is `EBADF`. The name is ignored, the objects do not count against the flexible memory budget, `mprotect` of a view is not limited to the maximum protection, and `mmap` of the descriptors maps the object as a [regular file](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp), so its views and the JIT views see each other's writes. On Linux the `memfd` is created without `MFD_EXEC`, which Linux 6.3 added and older kernels reject with `EINVAL`, and relies on the protection of the mapping: the flag only sets the file's execute permission bits, and the direct memory `memfd` is mapped executable the same way; a host with `vm.memfd_noexec` set to 2 refuses the creation and the call throws
-- [kqueue and kevent](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) follow FreeBSD 11's [`kern_event.c`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/kern_event.c) (`kqueue_kevent`, `kqueue_register`, `kqueue_scan`, the timer and user filters) over the event queue; nothing is measured on a console. The descriptor is a host null device registered as the kqueue: `close` and `sceKernelClose` close the queue and `dup`/`dup2` of it throw, but `read`, `write` and `fstat` act on the null device instead of failing with `EOPNOTSUPP` or reporting `S_IFIFO`. Read and write events are supported on guest sockets only, plus `EVFILT_READ` on the read end and `EVFILT_WRITE` on the write end of a pipe (see the kevent on a pipe entry) and the timer, user and [vnode](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) filters and a read event on the host stream on descriptor 0, which never triggers, as `select` never reports descriptor 0 readable; PPSA34015 registers descriptor 0 for reading in a new kqueue at start-up and does not check the result; other filters, `EV_CLEAR` on a socket or a pipe off Linux (see the kevent EV_CLEAR entry), a `NOTE_NSECONDS` period above one second with a fraction (11.0 converts the fraction with the microsecond macro) and any change to an existing timer (11.0 keeps the armed expiry and applies the new period after it, 11.4's `filt_timertouch` restarts it) throw. `EV_DISABLE`, `EV_DISPATCH` and `EV_FORCEONESHOT` follow kern_event.c: a disabled knote stays registered, stops polling or firing and is not reported, a trigger raised while it is disabled is kept and reported after `EV_ENABLE`, where `knote` would drop it, `EV_DISPATCH` reports once and then disables the knote, and `EV_FORCEONESHOT` is ignored on a new knote while on an existing one it sets `EV_ONESHOT` and fires the knote; a negative `nevents` fails with `EINVAL`. A new user event keeps its `fflags` unmasked and is not triggered by `NOTE_TRIGGER`, because `filt_userattach` reads the already cleared `kn_fflags`. The timer limit `kq_calloutmax` (`ENOMEM`) is not enforced, and closing a kqueue wakes a thread waiting on it in `kevent` with `EBADF`, where `kqueue_drain` makes the close wait for that thread. A level-triggered event is reported once per call and moved behind the other events, as in `kqueue_scan`; the `sceKernel*Equeue` calls keep their own collection loop. `NOTE_LOWAT` on a socket sets the low-water mark as FreeBSD 11's [`filt_soread` and `filt_sowrite`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/uipc_socket.c) do, and a later change of the knote replaces it as `kqueue_register` replaces `kn_sdata`: a read event fires once the buffered bytes reach the mark, or at end of file or on a listening socket. A read mark above 1 is taken on stream sockets only: on a datagram socket Linux's `FIONREAD` reports the next datagram where FreeBSD's `sbavail` counts every queued byte, so it throws. A write event fires once the send buffer's free space reaches the mark, as `filt_sowrite` does with `sbspace`; the host reports that space as `SO_SNDBUF` less `SIOCOUTQ` on Linux and as `SO_SNDBUF` alone elsewhere, so off Linux it does not shrink while data is queued. Marks below 1, which make FreeBSD's read filter always fire, throw
+- [kqueue and kevent](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) follow FreeBSD 11's [`kern_event.c`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/kern_event.c) (`kqueue_kevent`, `kqueue_register`, `kqueue_scan`, the timer and user filters) over the event queue; nothing here is taken from a console except what the kevent measurements entry lists. The descriptor is a host null device registered as the kqueue: `close` and `sceKernelClose` close the queue and `dup`/`dup2` of it throw, but `read`, `write` and `fstat` act on the null device instead of failing with `EOPNOTSUPP` or reporting `S_IFIFO`. Read and write events are supported on guest sockets only, plus `EVFILT_READ` on the read end and `EVFILT_WRITE` on the write end of a pipe (see the kevent on a pipe entry) and the timer, user and [vnode](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) filters and a read event on the host stream on descriptor 0, which never triggers, as `select` never reports descriptor 0 readable; PPSA34015 registers descriptor 0 for reading in a new kqueue at start-up and does not check the result; other filters except `EVFILT_AIO`, `EVFILT_LIO`, `EVFILT_SENDFILE` and `EVFILT_PROCDESC` (see the kevent measurements entry), `EV_CLEAR` on a socket or a pipe off Linux (see the kevent EV_CLEAR entry) and every change to an existing timer except `EV_DELETE` and the `EV_ADD` re-adds that the kevent measurements entry describes throw. A `NOTE_NSECONDS` period above one second with a fraction is kept to the nanosecond, where 11.0 converts the fraction with the microsecond macro. `EV_DISABLE`, `EV_DISPATCH` and `EV_FORCEONESHOT` follow kern_event.c: a disabled knote stays registered, stops polling or firing and is not reported, a trigger raised while it is disabled is kept and reported after `EV_ENABLE`, where `knote` would drop it, `EV_DISPATCH` reports once and then disables the knote, and `EV_FORCEONESHOT` is ignored on a new knote while on an existing one it sets `EV_ONESHOT` and fires the knote; a negative `nevents` fails with `EINVAL`. A new user event keeps its `fflags` unmasked and is not triggered by `NOTE_TRIGGER`, because `filt_userattach` reads the already cleared `kn_fflags`. The timer limit `kq_calloutmax` (`ENOMEM`) is not enforced, and closing a kqueue wakes a thread waiting on it in `kevent` with `EBADF`, where `kqueue_drain` makes the close wait for that thread. A level-triggered event is reported once per call and moved behind the other events, as in `kqueue_scan`; the `sceKernel*Equeue` calls keep their own collection loop. `NOTE_LOWAT` on a socket sets the low-water mark as FreeBSD 11's [`filt_soread` and `filt_sowrite`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/uipc_socket.c) do, and a later change of the knote replaces it as `kqueue_register` replaces `kn_sdata`: a read event fires once the buffered bytes reach the mark, or at end of file or on a listening socket. A read mark above 1 is taken on stream sockets only: on a datagram socket Linux's `FIONREAD` reports the next datagram where FreeBSD's `sbavail` counts every queued byte, so it throws. A write event fires once the send buffer's free space reaches the mark, as `filt_sowrite` does with `sbspace`; the host reports that space as `SO_SNDBUF` less `SIOCOUTQ` on Linux and as `SO_SNDBUF` alone elsewhere, so off Linux it does not shrink while data is queued. Marks below 1, which make FreeBSD's read filter always fire, throw
 - [EVFILT_VNODE, sceKernelAddFileEvent and sceKernelDeleteFileEvent](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) (libkernel) watch the host file or directory behind the descriptor and turn host changes into FreeBSD 11 vnode hints, which [`filt_vfsvnode`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/vfs_subr.c#L5032) adds whole when they share a bit with the requested `fflags`: a write that grows a file is `NOTE_WRITE | NOTE_EXTEND`, another write `NOTE_WRITE`, a shrinking truncate or an attribute change `NOTE_ATTRIB`, a higher link count `NOTE_LINK`, a lower one or a pending delete `NOTE_DELETE`, a new path `NOTE_RENAME`; in a directory, an entry created, removed or renamed is `NOTE_WRITE`, with `NOTE_LINK` for a subdirectory, and on Linux an entry moved from or to another directory adds `NOTE_EXTEND`; inotify queues the two halves of a rename one after the other, so a watcher woken by the first can read it alone, and a half read without the other is classified only after a `getdents64` on the watched directory, which takes the directory lock that `rename` holds until both halves are queued ([`do_renameat2`](https://github.com/torvalds/linux/blob/v6.8/fs/namei.c#L4975) around `vfs_rename` and its `fsnotify_move`, [`iterate_dir`](https://github.com/torvalds/linux/blob/v6.8/fs/readdir.c#L103)), an ordering taken from the kernel source, not from inotify(7), which promises none; a directory registered with `NOTE_EXTEND` on Windows is accepted, as `vfs_kqfilter` does not check it, but never receives it, because the directory handle cannot tell a move between directories from a removal plus an addition. FreeBSD's hints depend on the filesystem and the console's filesystems are not known: a growing `ftruncate` reports `NOTE_WRITE | NOTE_EXTEND` where `vop_setattr_post` reports `NOTE_ATTRIB`, and on Windows `utimes` on a file reports `NOTE_WRITE`. The three Windows notifications are told apart in the error, which names the `parent`, `entries` or `subdirectories` watch, the path it was given and `GetLastError`, but a `FindFirstChangeNotification` that fails still throws rather than returning an error to the guest: the EVFILT_VNODE attach path is [`vfs_kqfilter`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/vfs_subr.c#L4936), which returns `EINVAL`, `ENOMEM` or 0 after `fget` has turned a descriptor that is not open into `EBADF`, and consults no directory permission, so no FreeBSD errno stands for a host that refuses to notify, and what the console does on such a host is not measured. Only the `parent` watch can fail this way in practice: `entries` and `subdirectories` need the `FILE_LIST_DIRECTORY` that opening the watched directory already took. The parent handle produces no hint of its own, as `RunHostWatch` only calls `FindNextChangeNotification` on it, so a later change may leave the watch on its 50 ms poll instead of throwing; that is not done here. Windows uses `FindFirstChangeNotification` on the parent directory (and on a watched directory itself) and compares `GetFileInformationByHandleEx` snapshots at least every 50 ms, because a write through an open handle is reported only when the handle is flushed or closed, so file hints can arrive 50 ms late, and a file deleted while watched, which the POSIX delete of Windows 10 1903 moves into `$Extend\$Deleted` until its last handle closes, reports `NOTE_DELETE` without `NOTE_RENAME` and keeps its handle without a parent directory watch, as that directory cannot be watched; Linux uses inotify on the file and is not run. `NOTE_REVOKE`, `NOTE_OPEN`, `NOTE_CLOSE`, `NOTE_CLOSE_WRITE`, `NOTE_READ`, unknown bits and descriptors other than files, directories, pipes and sockets throw. `sceKernelAddFileEvent(eq, fd, watch, udata)` and `sceKernelDeleteFileEvent(eq, fd)` take the [OpenOrbis](https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/0a1aaf9d/include/orbis/libkernel.h#L35) and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0/src/SharpProspero/Interop/Kernel/KernelEqueue.cs#L164) signatures; `watch` is taken as the `fflags` and the event is added with `EV_CLEAR`, neither confirmed on a title (feat(libkernel): implement kevent EV_DISABLE, EV_DISPATCH and EV_FORCEONESHOT) (fix(libkernel): follow kqueue_register for EV_FORCEONESHOT and modify flags)
+- [sem_open, sem_close, sem_unlink](../../../core/libs/prx/libkernel/Pthread/Posix/Sem.cpp) (libkernel) keep named semaphores in a table inside the process; FreeBSD 11.4's [`sem_new.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/sem_new.c#L138-L308) backs each with a file `/tmp/SEMD<name>`. A semaphore lasts until `sem_unlink` and its last `sem_close` but is not shared with other processes, and the mode is ignored (no permission errors, as for a root caller). Whether a title can create files under `/tmp` on the console is unverified. A name with a further `/` throws, as it would resolve below `/tmp`, and so does an initial value above `SEM_VALUE_MAX`, which FreeBSD stores unchecked.
 - [sem_timedwait](../../../core/libs/prx/libkernel/Pthread/Posix/Sem.cpp) (libkernel) consumes an available count before checking the timeout and waits indefinitely for a null timeout, following FreeBSD 11's `sem_timedwait`. Console behavior for null and invalid timeouts when a count is available is unverified.
+- [kevent measurements](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - in payload processes on a PS5 (firmware 12.70), re-adding an existing periodic `EVFILT_TIMER` with `EV_ADD`, `fflags` 0 and a positive period kept the armed expiry and the expirations already counted and applied the new period after that expiry, as FreeBSD 11.0 does, where 11.4's `filt_timertouch` restarts the timer: a 50 ms timer re-added with 10 ms fired first 46 ms after the re-add and then every 10 ms, a 10 ms timer re-added with 100 ms fired first 5 ms after the re-add and then every 100 ms, the 12 expirations counted before a re-add were reported after it, and `EV_ONESHOT` in the re-add left the timer periodic. Here such a re-add does the same; re-adding a one-shot or disabled timer, a re-add with nonzero `fflags` (`NOTE_MSECONDS` included), a period of 0 or less, a period too large to add to the armed expiry or flags other than `EV_ONESHOT` were not measured and throw here, and the other changes to an existing timer except `EV_DELETE` throw here too. There `EV_ADD` failed with `EPERM` for `EVFILT_AIO`, `EVFILT_LIO` and `EVFILT_SENDFILE` at every ident tried (0, 5, 999, 2^40 and an open pipe) and, at ident 5, also with `EV_CLEAR`, `EV_ONESHOT` or `EV_DISABLE` added, and `EV_DELETE` and `EV_ENABLE` without `EV_ADD` failed with `ENOENT`. `EVFILT_PROCDESC` failed with `EBADF` on a descriptor that is not open and on an ident above `INT_MAX`, and with `EINVAL` on every open descriptor tried: Unix-domain stream and datagram sockets, descriptor 0 (a socket), an `AF_INET` UDP socket, both ends of a pipe, a regular file, a directory, another kqueue and the kqueue itself; `EV_DELETE` on a socket failed with `ENOENT`. Here these four filters answer the same way. `EV_ADD` of `EVFILT_PROCDESC` fails with `EINVAL` on the kinds of descriptor tried, since there are no process descriptors here, and also on shared memory and JIT shared memory, which are host files here: FreeBSD 11.0 gives `shm_open` objects [`invfo_kqfilter`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/uipc_shm.c#L136), which answers `EINVAL`, but neither was measured. It throws on any other kind, such as `/dev/random` and `/dev/urandom`, and on descriptors 0 to 2 that are not sockets or kqueues, whatever they hold: the host's standard streams, a pipe or file that `dup2` put on one of them, or a descriptor opened on a number that was free when libkernel loaded. A change of any of the four without `EV_ADD` fails with `ENOENT`, for `EVFILT_PROCDESC` after the descriptor check, as `kqueue_register` finds no knote. When `EV_ADD` of one of the four fails with `EPERM`, or with `EINVAL` on a descriptor other than the kqueue itself, the error event has `fflags` 0 and the errno in `data`, as FreeBSD 11.0's [`kqueue_register`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_event.c#L1302-L1316) clears `fflags` and `data` before the attach and [`kqueue_kevent`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_event.c#L1005-L1006) then stores the error in `data`; a descriptor that is not open, the kqueue itself and `EV_ENABLE` with `EV_DISABLE` fail before that and keep their `fflags`. That error event was not measured. `EVFILT_PROC` on the process itself with `NOTE_EXIT`, `EVFILT_SIGNAL` for `SIGUSR1` and `EVFILT_FS` at ident 0 were accepted there and still throw here. Also measured there on Unix-domain socketpairs, and still throwing here: a `NOTE_LOWAT` mark of 0 on an empty stream socket gave a read event at once (`data` 0), and so did re-adding that knote with a mark of -1 once the socket was drained; a write mark of 2 on the other end of that stream socketpair gave an event (`data` 8192), and re-adding that knote with 2^30 gave none; a mark of 5 on a datagram socket gave no read event after one 1-byte datagram and a read event (`data` 11) after a second, 10-byte datagram. `EVFILT_READ` on another kqueue reported the number of events pending in it there (1, then 2) and throws here; `EVFILT_WRITE` on a kqueue and a kqueue registered on itself failed with `EINVAL` there, as they do here
 - [tcsendbreak, tcdrain, tcflush, tcflow, tcgetpgrp, tcsetpgrp](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel) follow FreeBSD 11.4's [`termios.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/termios.c): `tcflush` answers `EINVAL` for a queue other than `TCIFLUSH`, `TCOFLUSH` or `TCIOFLUSH` and `tcflow` for an action outside `TCOOFF`..`TCION` before the descriptor is looked at, and every other call fails as its terminal ioctl does on a descriptor that is not a terminal, with the errors `tcgetattr` gives, so `tcsendbreak` never reaches its 0.4 s pause. FreeBSD's `pipe_ioctl` answers `TIOCGPGRP` and `TIOCSPGRP` on a pipe or FIFO with the descriptor's SIGIO owner, which is not modelled, so `tcgetpgrp` and `tcsetpgrp` throw on a host pipe or FIFO above descriptor 2; descriptors 0 to 2 are taken as non-terminals that are not pipes, whatever the host attaches to them, so a pipe the guest creates on a freed descriptor 0 to 2 gets `ENOTTY` there. The PS5 `libkernel` is assumed to use this FreeBSD code, and `tcdrain` is not a cancellation point here
 - [Windows file timestamps](../../../core/libs/prx/libkernel/File/include/WindowsFileTime.hpp) use the host filesystem's timestamp range and resolution. `utimes`, `futimes`, and `lutimes` reject timestamps outside nonnegative signed 64-bit Windows file-time ticks with `EINVAL`, including exactly 1601-01-01 00:00:00 UTC, whose zero value means "leave unchanged" to `SetFileTime`. Directory timestamp updates resolve the current path of the opened handle. Filesystems with coarser timestamp resolution cannot retain every guest microsecond. Birth-time clamping is not atomic with concurrent host timestamp updates and has not been measured on a console
 - [EVFILT_VNODE on macOS](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) (libkernel) registers `EVFILT_VNODE` on a duplicate of the descriptor in a host kqueue, whose notes have FreeBSD's values, and drops the `NOTE_LINK` that XNU adds to `NOTE_DELETE` when the watched file or directory is removed, since FreeBSD's `vop_remove_post` and `vop_rmdir_post` report `NOTE_DELETE` alone. As on Windows, a directory registered with `NOTE_EXTEND` is accepted but never receives it: XNU reports a move between directories as `NOTE_WRITE` alone, with `NOTE_LINK` for a subdirectory
@@ -139,100 +158,123 @@
 - On Linux, [direct memory](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) lives in one sparse memfd at file offset = physical address, so the [GPU imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) can share one udmabuf buffer object per 64 MiB of it. Released direct memory is not punched out of the file, because a live import of its chunk pins the pages and the GPU would keep reading the old ones: its pages stay committed (the process keeps the high-water mark of the direct memory it used) and are zeroed when the range is allocated again.
 - [system](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) runs no command. It follows FreeBSD 11's `lib/libc/stdlib/system.c` for a sandbox without `/bin/sh`: a null command returns 1 unconditionally, as that version does, and any command returns the wait status of a child that could not exec the shell and called `_exit(127)` (`0x7f00`). Whether the console's application sandbox has no shell, and whether `vfork` succeeds there (FreeBSD returns -1 when it fails), is unverified
 - [sceKernelWriteThrottlingStatus](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) reports no write throttling: the host SSD has no write budget, so the first qword of the 32-byte status is set to `UINT32_MAX` and the rest is zeroed; returns `EFAULT` (`0x8002000e`) when passed a null status buffer pointer. PPSA17221 reads only that qword: it multiplies it by 64 KiB and compares the product with byte thresholds up to 0x4AF00000 to pick one of five tiers. When the call fails the title assumes 0x4B000001 bytes, which selects the same top tier as `UINT32_MAX`. What the value measures on hardware (a remaining budget or a rate) and the meaning of the other three qwords are unknown
-- [Windows directory descriptors](../../../core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp) (libkernel) take one snapshot of the directory, on the first `getdents`, `getdirentries` or non-zero `lseek` (`SEEK_SET` or `SEEK_CUR`), and keep it until it is discarded; `lseek` to offset 0 only discards the snapshot, and the next read lists the directory again, so every rewind costs O(entries) on the next read. `lseek` takes the offset as an entry index and `SEEK_CUR` with offset 0 only reports the index. `SEEK_END` throws because FreeBSD defines it relative to the directory size, which is not modelled. A negative result returns `EINVAL` and a `SEEK_CUR` offset that overflows returns `EOVERFLOW`, as FreeBSD `vn_seek` reports them. Names whose UTF-8 encoding exceeds the one-byte `d_namlen` limit are not representable in this guest directory-record layout: `getdents` returns `ENAMETOOLONG` without consuming the entry. Repeated calls therefore report the same error and entries after that name cannot be reached through this descriptor; FreeBSD's `getdents` behavior for host filenames that exceed its `MAXNAMLEN` is not verified. `getdirentries` still reports 0 through `basep` instead of the position of the block it read, so only 0 and values returned by `lseek` are valid offsets; FreeBSD offsets are filesystem cookies. Descriptors retain the opened directory's native handle across renames. Enumeration reloads and `*at` operations resolve its current path, so a concurrent rename between resolution and the operation is not atomic. Enumeration of a removed directory and network-share path queries have not been verified
+- [Windows directory descriptors](../../../core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp) (libkernel) take one snapshot of the directory, on the first `getdents`, `getdirentries` or non-zero `lseek` (`SEEK_SET` or `SEEK_CUR`), and keep it until it is discarded; `lseek` to offset 0 only discards the snapshot, and the next read lists the directory again, so every rewind costs O(entries) on the next read. `lseek` takes the offset as an entry index and `SEEK_CUR` with offset 0 only reports the index. `SEEK_END` throws because FreeBSD defines it relative to the directory size, which is not modelled. A negative result returns `EINVAL` and a `SEEK_CUR` offset that overflows returns `EOVERFLOW`, as FreeBSD `vn_seek` reports them. Names whose UTF-8 encoding exceeds the one-byte `d_namlen` limit are not representable in this guest directory-record layout, so `getdents` and `getdirentries` throw when they reach one; FreeBSD's behavior for host filenames that exceed its `MAXNAMLEN` is not verified. `getdirentries` reports through `basep` the entry index its block starts at, so only 0 and the values from `basep` or `lseek` are valid offsets; FreeBSD offsets are filesystem cookies. Descriptors retain the opened directory's native handle across renames. Enumeration reloads and `*at` operations resolve its current path, so a concurrent rename between resolution and the operation is not atomic. Enumeration of a removed directory and network-share path queries have not been verified
 - [Linux directory entry types](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) - `sceKernelGetdirentries` reports a host symlink inside the app0 tree as the type of its target (directory or regular file), since a console app0 has no links and links there come from how the title was unpacked; a link elsewhere, or a dangling one, stays a link. A directory opened through an app0 link resolves to its target's host path, so links nested inside that target keep the link type.
-- [ftruncate, truncate, sceKernelFtruncate](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) extend a file on Windows with `SetFileInformationByHandle` (`FileEndOfFileInfo`), which reserves the clusters but writes no zero bytes, and report `EFBIG` for a length the volume cannot hold (`ERROR_INVALID_PARAMETER` on a disk file; seen with a length of `INT64_MAX`, the size from which NTFS refuses it was not measured) and `ENOSPC` when the free space is smaller. FreeBSD 11.4 makes the extension a hole on a file system that has them ([`ffs_truncate`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/ufs/ffs/ffs_inode.c) writes only the last block), so a length above the free space succeeds there. A write behind the end of the file still makes NTFS write zero bytes over the gap, as the file is not sparse. None of this was measured on a console.
-- [readv, writev, preadv, pwritev and their sceKernel forms](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) - unreadable iovec-table errors follow FreeBSD 11.4's [`copyinuio`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/subr_uio.c#L401-L434), not console measurements. The table is copied before inspecting its entries; payload-buffer validation is unchanged. A Linux `process_vm_readv` failure other than `EFAULT` throws, including when the host denies that API.
+- [ftruncate, truncate, sceKernelFtruncate](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) extend a file on Windows with `SetFileInformationByHandle` (`FileEndOfFileInfo`), which reserves the clusters but writes no zero bytes, and report `EFBIG` for a length the volume cannot hold (`ERROR_INVALID_PARAMETER` on a disk file; seen with a length of `INT64_MAX`, the size from which NTFS refuses it was not measured) and `ENOSPC` when the free space is smaller. FreeBSD 11.4 makes the extension a hole on a file system that has them ([`ffs_truncate`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/ufs/ffs/ffs_inode.c) writes only the last block), so a length above the free space succeeds there. A write behind the end of the file still makes NTFS write zero bytes over the gap, as the file is not sparse. None of this was measured on a console. One title (PPSA04354) calls it at 0xe9d4f2 and tests only the sign of the result; the lengths it passes are not examined.
+- [Windows directory entry types](../../../core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp) (libkernel) - types other than regular files, directories and symbolic links, and reparse points unsupported by `lstat`, throw. If the host cannot stat an entry, its type is `DT_UNKNOWN`. Console directory-entry types have not been measured; the host `lstat` modes map to `DT_REG`, `DT_DIR` and `DT_LNK` following [FreeBSD 11.4 dirent.h](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/sys/dirent.h). A host link inside canonical app0 is reported as its target's type (directory or regular file); a link elsewhere, or a dangling one, stays a link. A directory opened through an app0 link resolves to its target's host path, so links nested inside a target outside app0 keep the link type.
+- [readv, writev, preadv, pwritev and their sceKernel forms](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) - unreadable iovec-table errors follow FreeBSD 11.4's [`copyinuio`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/subr_uio.c#L401-L434), not console measurements. The table is copied before inspecting its entries; payload-buffer validation is unchanged. A total length above `SSIZE_MAX` fails with `EINVAL` before the descriptor is looked up, and the positioned forms, `pread` and `pwrite` included, report `EBADF` for a descriptor not open in that direction, then `ESPIPE` for a pipe, socket or kqueue, before `EINVAL` or `EFAULT`, as [`kern_preadv`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c) does. FreeBSD passes a negative offset on a character device to the driver; here it still returns `EINVAL`. A Linux `process_vm_readv` failure other than `EFAULT` throws, including when the host denies that API.
 - [/dev/random and /dev/urandom](../../../core/libs/prx/libkernel/File/src/RandomDevice.cpp) (libkernel) opened for reading return a descriptor backed by the host null device whose reads are filled with host OS entropy (`getentropy`, `rand_s` on Windows); both paths behave the same, never block, and positioned reads ignore the offset (FreeBSD `random(4)`). Only the exact paths are recognised, `fstat`, `lseek` and `mmap` see the null device, and opening them for writing throws
 - [pthread_attr_getinheritsched, pthread_attr_setinheritsched, pthread_attr_getscope, pthread_attr_setscope, pthread_attr_getstackaddr](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) follow FreeBSD 11 libthr ([thr_attr.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libthr/thread/thr_attr.c), [thr_create.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libthr/thread/thr_create.c)), not measured on the console: the scope defaults to `PTHREAD_SCOPE_SYSTEM` (2), only it and `PTHREAD_SCOPE_PROCESS` (0) are accepted and other values return `EINVAL`, and an inherit value other than `PTHREAD_INHERIT_SCHED` (4) or `PTHREAD_EXPLICIT_SCHED` (0) returns `ENOTSUP`. `pthread_attr_getstackaddr` returns the configured stack address pointer (null by default). A null output of `pthread_attr_getinheritsched` throws, since libthr writes through it unchecked. A thread keeps the scope it was created with, taken from the creating thread under `PTHREAD_INHERIT_SCHED`, and `pthread_attr_get_np` and `scePthreadAttrGet` report it, but every guest thread is a host thread at system scope, so process scope changes nothing
-- [Shared memory](../../../core/libs/prx/libkernel/File/src/SharedMemory.cpp) (libkernel) on Linux implements anonymous and named objects, bounded descriptor writes and seeks, and `shm_unlink` with effective read/write permission checks from FreeBSD 11. Named paths up to 1023 bytes use `/anyps5-shm-` plus SHA-1; collisions are not detected, and the namespace is shared across processes in the host mount namespace. Named creation applies the guest umask without changing the host mask. Linux procfs and `/dev/shm` are required. Operations use an advisory directory lock; external host operations bypass it, unrelated objects serialize, and descriptor operations require two spare host descriptors and compare device/inode with the initial descriptor identity on both the pinned-object and ordinary-file fallback paths. [Guest mappings](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) support shared and private mappings of these descriptors through the allocation tracker and pin a duplicate descriptor during validation and mapping; mapping requires one spare host descriptor; file-backed mappings use the write-watch scan fallback because aliases and descriptor writes bypass per-mapping tracking. On Windows, anonymous objects are delete-on-close temporary files and `mmap` maps them as [regular files](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp); named objects remain unsupported. Invalid non-null name pointers, console behaviour and title compatibility remain unverified.
+- [Shared memory](../../../core/libs/prx/libkernel/File/src/SharedMemory.cpp) (libkernel) on Linux implements anonymous and named objects, bounded descriptor writes and seeks, and `shm_unlink` with effective read/write permission checks from FreeBSD 11. Named paths up to 1023 bytes use `/anyps5-shm-` plus SHA-1; collisions are not detected, and the namespace is shared across processes in the host mount namespace. Named creation applies the guest umask without changing the host mask. Linux procfs and `/dev/shm` are required. Operations use an advisory directory lock; external host operations bypass it, unrelated objects serialize, and descriptor operations require two spare host descriptors and compare device/inode with the initial descriptor identity on both the pinned-object and ordinary-file fallback paths. [Guest mappings](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) support shared and private mappings of these descriptors through the allocation tracker and pin a duplicate descriptor during validation and mapping; mapping requires one spare host descriptor; file-backed mappings use the write-watch scan fallback because aliases and descriptor writes bypass per-mapping tracking. On Windows, anonymous objects are delete-on-close temporary files and `mmap` maps them as [regular files](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp); named objects are described in the next entry. Invalid non-null name pointers, console behaviour and title compatibility remain unverified.
+- [shm_open, shm_unlink](../../../core/libs/prx/libkernel/File/src/SharedMemory.cpp) (libkernel, Windows) - named objects are regular files in the current user's temporary directory under `AnyPS5/shm`, identified by SHA-1 of the exact guest name. The namespace is per host user and shared by every AnyPS5 process using that temporary root, so two titles using the same name share the object. Namespace operations use a cross-session named mutex, while file-size changes and writes use a mutex keyed by the host file identity; unlink renames the visible object to a unique internal name so already-open handles remain usable while the guest name can be recreated. Orphaned files are reaped when the last tracked guest descriptor closes or opportunistically during a later open. Closing through host stdio wrappers does not update this bookkeeping or reap immediately. The namespace directory has a protected ACL for the owner, SYSTEM and Administrators; newly created objects map the guest owner read/write bits after applying the guest creation mask. `fchmod` updates those owner permissions on the descriptor's file object. Guest group/other permission classes are not represented independently on Windows. Mapping a named object uses the same Windows file mapper as anonymous objects and no test covers it, and no behavior here has been measured on PS5. Lifecycle, cross-process resize/write, and mode behavior are exercised by Windows tests. See Microsoft's [file sharing modes](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea), [DeleteFile](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-deletefilew) and [mutex objects](https://learn.microsoft.com/en-us/windows/win32/sync/mutex-objects).
 - [sceKernelAddReadEvent and sceKernelAddWriteEvent](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel): a read event on a listening socket, here and in `kevent`, reports the number of completed connections waiting to be accepted in `data`, as FreeBSD 11.4's [`filt_solisten`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L3384-L3392) reports `so_qlen`: on Linux a TCP listener's accept queue from `TCP_INFO` (`tcpi_unacked`, which Linux fills with the accept backlog for a listening socket), and elsewhere, or for a listener that is not TCP, 1 while a connection is waiting, as no host call reports that count. A write event reports the free space of the socket's send buffer in `data`, as FreeBSD 11.4's [`filt_sowrite`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L3358-L3382) reports `sbspace`: on Linux the host's `SO_SNDBUF` less the bytes `SIOCOUTQ` counts as queued, which include the host's per-packet overhead, so the space shrinks by somewhat more than the bytes sent. Windows has no query for that space and macOS is not wired up, so both report the whole `SO_SNDBUF`, which does not shrink as data is queued. Only guest sockets are supported; other descriptors and a low watermark above 1 throw
-- [sceKernelAddReadEvent on pipes](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) is the one exception to the sockets-only rule above: it also takes the read end of a pipe, as `kevent` does through FreeBSD's `filt_piperead`, and ignores the size argument there. Host streams, other descriptors and a write event on a pipe throw
-- [close](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) and [setsockopt](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) reach a [libSceNet](../../../core/libs/prx/libSceNet/Export.cpp) socket through hooks libSceNet registers, as `select` polls them; the other libkernel socket calls do not. libSceNet numbers its sockets from 32 in its own table, so a CRT file descriptor and a socket can share a number; `close` then closes the socket. On the console both are one kernel descriptor space
+- [sceKernelAddReadEvent on pipes](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) is an exception to the sockets-only rule above: it also takes the read end of a pipe, as `kevent` does through FreeBSD's `filt_piperead`, and ignores the size argument there. Host streams, other descriptors and a write event on a pipe throw
+- [sceKernelAddReadEvent and sceKernelAddWriteEvent on regular files](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) are the other exception: a size argument above 1, directories and other vnode types throw, and whether the console's file systems answer as `vfs_kqfilter` does was not measured. A wait holding one of these events polls it every millisecond, as no host call reports every file change, so a write through another descriptor shows up to 1 ms late. Unlike FreeBSD, a seek can make a read event fire again: FreeBSD 11.4's [`kqueue_scan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c) deactivates a level-triggered read knote once `filt_vfsread` reports `data` 0, and only a vnode `KNOTE` (a write, an extend or a truncate) activates it again; `lseek` posts none, so after a file read to its end is seeked back, the 1 ms poll here reports the new `data` (10 for a 10-byte file seeked to 0) where FreeBSD keeps waiting until the file changes. Otherwise they follow FreeBSD 11.4's [`filt_vfsread` and `filt_vfswrite`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_subr.c#L5122-L5168): a read event reports the size less the descriptor's offset in `data` and fires while that is not 0; a write event always fires with `data` 0
+- [close](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) and [setsockopt](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) reach a [libSceNet](../../../core/libs/prx/libSceNet/Export.cpp) socket through hooks libSceNet registers, as `select` and `poll` poll them and `fcntl` answers `F_GETFL` and `F_SETFL`, failing other commands with `EINVAL`; the other libkernel socket calls do not. libSceNet numbers its sockets from 32 in its own table, so a CRT file descriptor and a socket can share a number; `close` then closes the socket. On the console both are one kernel descriptor space
 - [sceKernelPread, sceKernelPwrite, sceKernelPreadv, sceKernelPwritev](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) on Windows transfer with an overlapped `ReadFile`/`WriteFile` and restore the descriptor's file pointer afterwards. Guest scalar transfers, positioned transfers, vectored transfers and seeks share a position lock across duplicated descriptors; a vector holds it for the whole operation. Independently opened descriptors and other processes do not share that lock, so vector transfers over their overlapping file ranges are not coordinated. Handles that are not disk files return `ESPIPE`. A pipe or console `readv` can return a short read when no more input is available; each iovec is transferred separately, so a failure after the first transfer returns the bytes already done
 - [sceKernelAioSubmitReadCommands, sceKernelAioSubmitWriteCommands and their Multiple variants](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) on Windows transfer through the same positioned path as `sceKernelPread`/`sceKernelPwrite` and restore the descriptor's file pointer afterwards; positioned transfers, plain transfers and seeks of one descriptor are serialized per descriptor (shared across duplicated descriptors), so a concurrent transfer observes a stable file pointer
-- [sceKernelAioSetParam](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) writes the five values into the 20-byte scheduling struct the first argument points to, following the declarations in [Orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json), [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Kernel/KernelAio.cs) and [ampr_emu](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/ps5/include/sce/_fs.h). Whether the console checks the values is unknown, so a null struct, a scheduling window or delayed count limit outside 0..128, a split flag other than 0 or 1 and a split size or chunk size above 0x1000000 (SharpProspero's maximums) throw. The scheduling settings are not used: `sceKernelAioInitializeImpl` ignores the struct and requests run synchronously on submit
+- [sceKernelAioSetParam](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) - the limits and `sceKernelAioInitializeParam`'s defaults (three 20-byte scheduling structs, the last without split) are measured on a PS5 (firmware 13.60), where a null struct crashes both calls; here both throw. The scheduling settings are not used: `sceKernelAioInitializeImpl` ignores the struct and requests run synchronously on submit
 - [sceKernelGetFsSandboxRandomWord](../../../core/libs/prx/libkernel/System/src/Sandbox.cpp) (libkernel) returns a fixed directory name, `gkbHtXc3Wq`. On the console the name is the process's randomized path (syscall 602, `randomized_path`), and the sandbox exposes system files under it, such as `common/lib` and `common/cert`. Nothing is mounted under the name here, so `/gkbHtXc3Wq/common/...` resolves under the guest root like any other path and does not exist, except `/gkbHtXc3Wq/common/cert/CA_LIST.cer`, which [SandboxCertificates.cpp](../../../core/libs/prx/libkernel/File/src/SandboxCertificates.cpp) serves from the host trust store
 - [ktimer_create, ktimer_settime, ktimer_gettime, ktimer_getoverrun, ktimer_delete](../../../core/libs/prx/libkernel/Time/Ktimer.cpp) (libkernel) - a `SIGEV_SIGNAL` or `SIGEV_THREAD_ID` timer, and one created with a null `sigevent` (FreeBSD defaults it to `SIGEV_SIGNAL`), throws, because delivering a guest signal from a timer is not modelled. A non-zero value under one tick rounds up to 1 ms, as FreeBSD 11 does at hz 1000; the console's hz is not measured (`kern.clockrate` is unanswered). `SIGEV_NONE` timers on `CLOCK_REALTIME` and `CLOCK_MONOTONIC` follow `kern_time.c`: ids 3 to 31 (`EAGAIN` when full), `EINVAL` for another clock, a bad notify type or signal, an id that is not live or a bad `itimerspec` field, and `TIMER_ABSTIME` (1). Expiry is worked out from the guest clock when the timer is read, and `ktimer_getoverrun` returns 0, as FreeBSD only updates it when a signal is accepted
 - [The sandbox CA list](../../../core/libs/prx/libkernel/File/src/SandboxCertificates.cpp) (libkernel), `/<sandbox word>/common/cert/CA_LIST.cer`, is a PEM bundle of the host's trust anchors, written once per process to `cert_cache/CA_LIST.cer` in the run directory with the owner write bit cleared: on Windows the current user's `ROOT` store, filtered through Disallowed and the combined EKU extension/property for TLS server authentication (Windows fetches missing roots on demand, so a root that was never fetched is absent), elsewhere `SSL_CERT_FILE` or the first of `/etc/ssl/certs/ca-certificates.crt`, `/etc/pki/tls/certs/ca-bundle.crt`, `/etc/ssl/ca-bundle.pem` and `/etc/ssl/cert.pem` that exists. On macOS, `/etc/ssl/cert.pem` is a static snapshot and does not reflect roots added to or distrusted in the Keychain. Existing guest files, explicit aliases and blocked mounts take precedence over the provider. The PEM snapshot does not carry Windows CTL restrictions beyond EKU, native revocation policy or later trust-store changes. Without any certificate the path does not exist. The console file's format is unverified: only that bundled OpenSSL accepts a PEM bundle there is shown (ProsperoRadio PPSA99001 and SwanStation PPSA98510, #5001). The other entries of the console's `common/cert` directory, the directory itself (it does not exist here) and the error a write open gets (`EACCES` from the host here) are unverified
+- [pselect](../../../core/libs/prx/libkernel/Socket/src/Pselect.cpp) (libkernel) sets the signal mask, calls `select` and restores the mask, as FreeBSD 11 `kern_pselect` does. A pending signal that the new mask unblocks has its handler run during the swap, and `pselect` then returns `EINTR` unless a descriptor is already ready, the timeout is zero or an argument is invalid, as FreeBSD's `kern_select` decides before it sleeps. A signal raised during the wait, including one sent by another thread, does not interrupt it, because `select` has no `EINTR` path; and the mask is the process-wide one, so it applies to every thread for the duration of the call
 - [getcontext and setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) and [makecontext](../../../core/libs/prx/libSceLibcInternal/UserContext.cpp) (libSceLibcInternal) use FreeBSD 11's amd64 `ucontext_t` (`mcontext` at 0x10, `mc_len` 800, `uc_link` at 0x330, `uc_stack` at 0x338, 0x370 bytes), the layout homebrew built against FreeBSD's headers passes: PPSA99039's OpenSSL `ASYNC` (`crypto/async/arch/async_posix.c`) captures into a 0x370-byte stack buffer. `getcontext` writes the 0x330 bytes before `uc_link`, as FreeBSD's `UC_COPY_SIZE`. The console's own layout for these functions is not verified; the exception handler's context is a different one (see `sceKernelRaiseException`)
 - [getcontext and setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) keep the 512-byte FXSAVE image in `mc_fpstate` (x87, MXCSR, XMM0-15), so the upper halves of YMM0-15 are neither saved nor restored, and `getcontext` leaves `mc_xfpustate` and `mc_xfpustate_len` 0. `getcontext` sets `mc_fpformat` and `mc_ownedfp` to FreeBSD's `_MC_FPFMT_XMM` and `_MC_FPOWNED_FPU`, `mc_cs` and `mc_ss` to the host selectors, and `mc_flags`, `mc_fsbase` and `mc_gsbase` to 0. `setcontext` loads `mc_fpstate` whatever `mc_fpformat` and `mc_ownedfp` say, and restores neither the segment selectors, `mc_fsbase` and `mc_gsbase` nor the extended state, which FreeBSD restores when `mc_flags` asks for them
 - [setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) and [longjmp](../../../core/libs/prx/libc/src/JumpBuffer.cpp) (libc) on Windows set the thread's stack bounds in the TEB to the stack they switch to: a `makecontext` stack, or else the committed region around the target stack pointer. A switch to any other guest stack, such as a context built by hand, gets the bounds of that region only
-- [scePthreadAttrGet](../../../core/libs/prx/libkernel/Pthread/src/Attr.cpp) (libkernel) - the answer for a thread that has ended is not measured on the console, and [`pthread_attr_get_np`](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) still returns 0 for such a thread, reading a detached one's object after it is freed. `scePthreadAttrGet` returns `ESRCH` (`0x80020003`) for a thread that has ended, joined or not and detached or not, as FreeBSD 11.4's [`_pthread_attr_get_np`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_attr.c#L139-L172) does through `_thr_find_thread`; a thread counts as ended once its thread-specific data destructors have run, where FreeBSD marks it `PS_DEAD`. On Windows a host thread adopted by `scePthreadSelf` that ends without `scePthreadExit` keeps answering 0. Monster Hunter Wilds (PPSA24191) reuses a slot of its thread table only when `scePthreadAttrGet` returns `0x80020003`
+- [scePthreadAttrGet](../../../core/libs/prx/libkernel/Pthread/src/Attr.cpp) and [pthread_attr_get_np](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) - the answer for a thread that has ended is not measured on the console; the implementation follows FreeBSD 11.4's [`_pthread_attr_get_np`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_attr.c#L139-L172) through `_thr_find_thread`. On Windows a host thread adopted by `scePthreadSelf` that ends without `scePthreadExit` keeps answering 0. Monster Hunter Wilds (PPSA24191) reuses a slot of its thread table only when `scePthreadAttrGet` returns `0x80020003`
 - [scePthreadAttrGet, pthread_attr_get_np and sceKernelIsStack](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) report the stack of a host thread the library did not create, on Windows, from one allocation granule (64 KiB) above the bottom of its reservation when everything above that is committed read-write, as in a relinked executable's main thread and its default-size host threads (0x200000 committed of 0x210000 reserved), so the guest can protect the lowest reported pages, as HotSpot does for its stack guard pages in Java 25 LAN / DNS (PPSA99869). Any other such thread, and every such thread on Linux, gets its whole host stack: on Windows `mprotect` commits its reserved lower pages before protecting them and drops the guard flag of Windows' guard pages, and on Linux it cannot change the unmapped lower pages
 - [sceKernelInstallExceptionHandler](../../../core/libs/prx/libkernel/System/src/Exception.cpp) records the handler, but a host fault still ends the process: only signals raised with `sceKernelRaiseException` are delivered. Unity's PS5Util module installs a SIGUSR1 handler that reads `uc_mcontext.mc_rsp` (offset 0xf8 of the context) and raises SIGUSR1 on other threads to stop them for garbage collection
-- [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Linux sends the host SIGUSR1, which the library takes over, to the target thread, so the handler runs wherever the thread was interrupted, emulator code included. On the console kernel objects are system calls and libthr defers signals while a thread holds its internal locks; here a handler that needs a host lock the interrupted code holds deadlocks, and a thread that the handler keeps waiting keeps its host locks. Host waits resume after the handler. The host calls Linux does not restart end early: sleeps that do not retry return before their time, and the poll of `sceNetEpollWait` and socket calls with a send or receive timeout return `EINTR` to the guest
+- [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Linux sends the host SIGUSR1, which the library takes over, to the target thread, so the handler runs wherever the thread was interrupted, emulator code included. On the console kernel objects are system calls and libthr defers signals while a thread holds its internal locks; here a handler that needs a host lock the interrupted code holds deadlocks, and a thread that the handler keeps waiting keeps its host locks. A thread holding the address-wait lock (`sceKernelSyncOnAddressWait`, `sceKernelSyncOnAddressWake`, `_umtx_op`) records the signal and runs the handler once it releases the lock or while it waits; other emulator locks are not deferred. Host waits resume after the handler. The host calls Linux does not restart end early: sleeps that do not retry return before their time, and the poll of `sceNetEpollWait` and socket calls with a send or receive timeout return `EINTR` to the guest
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Windows suspends the target and redirects it to the handler. A target running host code (any module other than the executable and the `*.guest.prx` modules, so libkernel, libc and the other HLE modules count too) is resumed and sampled again until it is back in guest code, since a handler that waits there would keep the host locks that code holds. The raising thread spins for 20 µs before each new host-code sample: suspended again at once, the target could stay at the same instruction for every sample until the 50 ms below ran out (on a 16-core Ryzen 9 5950X, `guest_raise_in_host_code` then raised into `fwrite` and deadlocked on its stream lock), and the 20 µs is a measured choice, not a console value; a target blocked in an ntdll wait is redirected in place, as are NtContinue and winpthreads after their retry limit. A target that stays in host code without waiting for 50 ms after the raise began, such as a long HLE or driver call, is then redirected in host code anyway, with the same hazard. A target seen right after a `syscall` instruction in ntdll, inside a system call that is not a wait such as the `NtWriteFile` of an `fwrite` holding its stream lock, restarts those 50 ms, so a raise can cost the raising thread up to the 1 s retry limit. While the target is suspended only `VirtualQuery` and a lock-free cache of image bases are consulted; an image not yet in the cache is classified with `GetModuleFileNameW` after the target is resumed. An APC queued at the first host-code sample, which an alertable guest wait would run sooner, is not implemented
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) builds the handler's `ucontext` with FreeBSD's amd64 layout (16-byte sigmask, `mcontext` at 0x40, `mc_rsp` at 0xf8); the console's layout is not verified beyond the fields PS5Util reads
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) does not consult the target thread's signal mask
-- [pthread_sigmask](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) shares the process-wide mask of `sigprocmask` and `_sigprocmask`, which keeps only the first 32 signals; FreeBSD keeps a mask per thread
+- [pthread_sigmask](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) shares the process-wide mask of `sigprocmask` and `_sigprocmask`; FreeBSD keeps a mask per thread
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) reaches a thread that waits in an alertable `TimedWait` wait through an APC. A thread blocked anywhere else, including all waits under `APS5_COARSE_TIMED_WAITS` and host waits inside the emulator, is redirected and runs the handler only when that wait returns
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Windows runs the handler wherever the target thread was interrupted. It waits only while the thread is inside winpthreads or restoring a context through `NtContinue`, and throws if that lasts 1 s, so a handler that calls into other host code the thread was interrupted in, such as the C runtime's heap or a lock of the emulator, can deadlock on it or reenter it. A thread that holds the address-wait lock of `sceKernelSyncOnAddressWait`, `sceKernelSyncOnAddressWake` and `_umtx_op`, or the park queue lock of the guest mutexes, gets the raise as an APC instead, which runs once it has released the lock or while it waits; the other locks of the emulator are not deferred this way
+- [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Windows throws for a target thread that was created suspended and is not resumed yet. FreeBSD 11.4 libthr starts such a thread with every signal but `SIGTRAP` blocked ([`thr_create.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_create.c#L177-L183)) and restores its mask only once it is resumed ([`thread_start`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_create.c#L252-L294)), so a signal sent to it stays pending until then. The console's behaviour is unverified
 - [sigaltstack](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records each thread's alternate signal stack and reports it back, following FreeBSD's `kern_sigaltstack` (`EINVAL` for flags other than `SS_DISABLE`, `ENOMEM` below `MINSIGSTKSZ` 2048), but handlers never run on it, so `SS_ONSTACK` and `EPERM` are never reported
-- [sigpending](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) reports the intersection of the process-wide pending set of `sigtimedwait` and the blocked mask of `_sigprocmask`, as FreeBSD's `sys_sigpending` intersects the pending list with `td_sigmask`, and returns -1 with `EFAULT` for a null set. Because `_sigprocmask` keeps only the first 32 signals, signals 33 to 128 are never blocked and never appear in the set, and setting `SIG_IGN` (or `SIG_DFL` on a signal whose default action is to ignore) does not clear a signal that was already marked pending. PPSA99420 imports it
-- [scePthreadJoin, scePthreadCreate](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - on a PS5 (firmware 13.60) joining a thread a second time returns `ESRCH` (`0x80020003`), as it does here, but a joined thread is kept until `scePthreadCreate` publishes over the same handle storage, so one host object and its handle are retained per distinct guest handle storage location for the lifetime of the process; a guest that joins into a fresh storage location every time keeps every one of them. A null entry crashed the payload and still throws. Joining the calling thread returns `EDEADLK` and a zeroed attribute creates a default thread, as on the console. `scePthreadDetach` on a joined thread answers `EINVAL`, as FreeBSD does on a thread that is not joinable; the console answer for a detach after a join is unverified. Detaching a thread while another thread waits to join it returns `EINVAL`, and a second concurrent join returns `EOPNOTSUPP`, as FreeBSD 11.4's [`thr_detach.c`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_detach.c) and [`thr_join.c`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_join.c) check `joiner`; before this PPSA34015 stopped once with `Joining guest thread: Access is denied` when a thread it was joining was released under the join, and which of the two calls released it was not captured. A detached thread is still released when it ends, so joining it after it ended reads freed memory. A handle value copied to a second storage and joined there retains the object under the original storage key, so a later `scePthreadCreate` over that original storage releases an object the copy still points at, and the copy reads freed memory
+- [sigpending](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) reports the intersection of the process-wide pending set of `sigtimedwait` and the blocked mask of `_sigprocmask`, as FreeBSD's `sys_sigpending` intersects the pending list with `td_sigmask`, and returns -1 with `EFAULT` for a null set. PPSA99420 imports it
+- [scePthreadJoin, scePthreadCreate](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - a joined thread is kept until `scePthreadCreate` publishes over the same handle storage, so one host object and its handle are retained per distinct guest storage location for the life of the process; a guest that joins into a fresh location every time keeps every one. A handle copied to a second storage and joined there retains the object under the original storage key, so a later `scePthreadCreate` over the original storage releases an object the copy still points at, and the copy reads freed memory. A detached thread is released when it ends, so joining it after it ended reads freed memory. A null entry crashed the payload and throws. Joining the calling thread returns `EDEADLK` and a zeroed attribute creates a default thread, as on the console. PPSA34015 once stopped with `Joining guest thread: Access is denied` before the join and detach checks followed the console
+- [scePthreadCreate and scePthreadDetach, measured](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - as in a payload process on a PS5 (firmware 13.60): a name of 32 bytes or more returns `ENAMETOOLONG` (`0x8002003f`) without creating a thread, 31 is kept whole, and a null name gives an empty one; detaching a joined thread returns `ESRCH`; detaching a thread another thread is joining, or a detached one, returns `EINVAL`, as does joining a detached one; a second concurrent join returns `EOPNOTSUPP`; a null thread returns `EINVAL` from both; a null handle pointer to `scePthreadCreate` faulted and throws here. Whether the handle is written before the name check was not measured; here it is left alone
 - [Thread cancellation](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) follows FreeBSD libthr (states and types 0/1 and 0/2, `PTHREAD_CANCELED` 1, the `_pthread_cleanup_info` node layout), not measured on the console. A request is acted on only in `scePthreadTestcancel`, the condition variable, `sem` and `scePthreadSem` waits, `scePthreadJoin` and the sleeps, and their POSIX names; file and socket calls are not cancellation points. An enabled cancellation request wakes POSIX `sleep` and exits the thread. `usleep`, `sceKernelUsleep`, `nanosleep`, `_nanosleep`, `sceKernelNanosleep` and `sceKernelSleep` check cancellation only before and after the host sleep, so an enabled request during those waits is delivered when the sleep ends. The asynchronous type acts like the deferred one, except at the two set calls.
 - [cpuset_setaffinity](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the calling thread, another live guest thread selected by its guest TID, or the calling process is handled; other levels (ROOT/CPUSET) and other scopes (CPUSET/JAIL) throw as unmodelled, invalid levels or scopes return `EINVAL` and unknown thread or process IDs return `ESRCH`, following [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L1281-L1286) thread selection. Bits outside `sceKernelGetAvailableCpumask` are dropped, and a mask with none of those bits fails with `EDEADLK`, as FreeBSD does when the new set has no CPU in common with the parent set. Guest-TID lookup and the update hold the thread registry lock so a join cannot release the target during access. Affinity is recorded for guest CPU reporting and child inheritance, not applied to host scheduling; PS5 behaviour has not been measured
 - [cpuset_getaffinity](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the calling thread, another live guest thread selected by its guest TID, or the calling process is handled; other levels (ROOT/CPUSET) and other scopes (CPUSET/JAIL) throw as unmodelled, invalid levels or scopes return `EINVAL` and unknown thread or process IDs return `ESRCH`, following [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L426-L437) guest-TID selection, not measured on PS5. For the process the mask is the union of the affinities of the live guest threads, as [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L1150-L1156) ORs the mask of every thread in the process; threads the guest did not create through libkernel are not included, and the console result is unverified
 - [pthread_setaffinity_np](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - follows [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_affinity.c#L41-L62) libthr over `kern_cpuset_setaffinity` for the calling thread and any live guest thread: a size other than the 32-byte `cpuset_t` returns `ERANGE`, an unknown or finished thread `ESRCH`. Bits outside `sceKernelGetAvailableCpumask` are dropped and a mask with none of those bits returns `EDEADLK`, as `cpuset_setaffinity` does; the affinity is recorded on the guest thread and not applied to the host thread, and the console result is unverified
-- [dup and dup2](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) throw for the combinations they do not model: `dup2` of a guest socket onto descriptors 0 to 2, whose host streams libc writes without the socket table, and on Windows duplicating a directory descriptor. Guest sockets share one socket object between the duplicates; the numbers come from the host descriptor table like those of files. The errno values for descriptor exhaustion are not verified against the console. On Windows a guest `dup2` onto descriptor 1 or 2 keeps host logging on an `_fdopen` of a duplicate, and the guest `FILE` stays on the descriptor that was replaced; opening that duplicate throws (#7791)
-- [waitpid](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) returns -1 with `ECHILD` (`EINVAL` for unknown options): nothing here creates a child process; child processes would need a real `waitpid`.
+- [dup and dup2](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) throw for the combinations they do not model: `dup2` of a guest socket onto descriptors 0 to 2, whose host streams libc writes without the socket table. Guest sockets share one socket object between the duplicates; the numbers come from the host descriptor table like those of files. The errno values for descriptor exhaustion are not verified against the console. On Windows a guest `dup2` onto descriptor 1 or 2 keeps host logging on an `_fdopen` of a duplicate, and the guest `FILE` stays on the descriptor that was replaced; opening that duplicate throws (#7791)
+- [waitpid and wait](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) reaps [posix_spawn](../../../core/libs/prx/libSceLibcInternal/Spawn.cpp) children, whose guest process IDs are the host's. On Linux the host call runs: the guest signal numbering applies in bits 8-15 for a stopped child and bits 0-6 for a killed one (7, 10, 12, 17, 18, 19, 20, 23, 29, 31 to 10, 30, 31, 20, 19, 17, 18, 16, 23, 12; Linux 16 and 30 are unmapped and throw), a continued status becomes 0x13, and guest `WCONTINUED` 4 becomes Linux 8. On Windows an unrecognized exit code keeps the guest `exit` byte layout, so `exit(-1)` reads as 255, and a structured-exception code maps to `SIGSEGV`, `SIGILL`, `SIGTRAP`, `SIGFPE` or `SIGABRT` (access violation/stack overflow, illegal instruction, breakpoint, division, fastfail). Windows has no stop/continue status; unknown `options` bits fail with `EINVAL`. Without an unreaped matching child, even after another thread reaps it, the call gives `ECHILD`.
 - [execv](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) throws: replacing the process image is not supported, the same as `execvp`. PPSA97358 imports it and fails to load without it.
 - [execve](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) throws like `execvp`: replacing the process image is not supported. The console behavior for invalid arguments and executable path lookups is not modeled.
 - [sysarch](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - `AMD64_GET_FSBASE`, `AMD64_GET_GSBASE` and `AMD64_SET_GSBASE` follow FreeBSD 11's amd64 [`sysarch`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/amd64/amd64/sys_machdep.c) on Linux x86-64 hosts, through the host's `arch_prctl`. The GS base belongs to the calling thread, a base at or above `0x800000000000` (`VM_MAXUSER_ADDRESS`) returns `EINVAL`, and a null argument returns `EFAULT`. `AMD64_SET_FSBASE` throws, since guest and host code share the thread's FS base for their TLS. In a payload process on a PS5 (firmware 12.70), `I386_GET_FSBASE` (7) and `I386_GET_GSBASE` (9) wrote 4 bytes, the low 32 bits of the FS and GS bases, and failed with `EFAULT` for a null argument; here they do the same on Linux x86-64 hosts. There a GS base set by one thread left the main thread's unchanged, and threads made with `pthread_create` and `scePthreadCreate` started with their creator's GS base; here a guest thread's host thread is created by the creating thread, and Linux's [`copy_thread`](https://github.com/torvalds/linux/blob/v6.6/arch/x86/kernel/process.c#L182-L186) gives a new thread its creator's GS base. The operation numbers FreeBSD 11's amd64 `sysarch` has no case for returned `EINVAL` there for the nine tried, each with a null argument (2, 5, 6, 12, 127, 133, 134, 1000 and -1; 6 is `I386_VM86`, which its header names), as its [default case](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/amd64/amd64/sys_machdep.c#L324-L325) does; here every such number returns `EINVAL` on every host; the numbers other than those nine follow that default case and were not measured. `AMD64_GET_XFPUSTATE` (132) returned 0 there for lengths 0, 64, 128, 256 and 512 (512 was also the largest length a search accepted) and failed with `EINVAL` for 1024, 2048, 4096 and 8192 and with `EFAULT` for a null argument or address, and `I386_GET_XFPUSTATE` (11) failed with `EFAULT` for a null argument; both throw here. The other operations FreeBSD 11's amd64 `sysarch` handles, and every operation it handles on other hosts (Windows keeps its TEB in GS), throw.
 - [kern.proc.pathname](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) returns `/app0/eboot.bin` for pid -1 and the calling process, following FreeBSD's `sysctl_kern_proc_pathname`; the exact pathname on retail consoles remains unverified.
 - [kern.proc.env](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - which variables, if any, the console starts an application with is unverified; `sysctl` {`CTL_KERN`, `KERN_PROC`, `KERN_PROC_ENV`, pid} returns 0 bytes, the empty start-up environment `environ` and libc's `getenv` also begin with, as FreeBSD 11's [`sysctl_kern_proc_env`](https://github.com/freebsd/freebsd-src/blob/releng/11.0/sys/kern/kern_proc.c) copies a process's start-up strings, not later `setenv` changes. Only the calling process's pid is accepted (`ESRCH` otherwise, -1 included); a write returns `EPERM`. PS5VR (PPSA99177) reads it for its own pid at start-up.
 - [kern.proc.vmmap](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctl` {`CTL_KERN`, `KERN_PROC`, `KERN_PROC_VMMAP`, pid} returns packed FreeBSD 11 `kinfo_vmentry` records (144 bytes each, an empty path) for the used ranges of the guest address-space arena, in address order, as [`kinfo_getvmmap`](https://github.com/freebsd/freebsd-src/blob/releng/11.0/lib/libutil/kinfo_getvmmap.c) reads them. A range is one record: the type is always `KVME_TYPE_DEFAULT`, the protection is `sceKernelVirtualQuery`'s for the range's first page (0 where it reports none), and offset, object, resident page counts, flags and path are 0. Only the calling process's pid is accepted (`ESRCH` otherwise, -1 included, as FreeBSD's `pget` gives); a write returns `EPERM` and a short buffer `ENOMEM`. Ranges outside the arena, which guest code cannot map, are not reported. The walk takes the arena lock once per range, not for the whole walk as FreeBSD holds the map lock, so an `mmap` or `munmap` on another thread can change the list between two records. Whether a PS5 application may read its own map, and what types and paths the console reports, is unverified
-- [sysctl names a PS5 payload process gets ENOENT for](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctlbyname` returns -1 with `ENOENT` for `hw.byteorder`, `hw.cacheline_size`, `hw.machine_arch`, `hw.usermem`, `kern.clockrate`, `kern.maxfiles`, `kern.maxfilesperproc`, `kern.maxproc`, `kern.ps_strings`, `kern.sched.name`, `kern.smp.maxcpus`, `kern.stackprot`, `kern.timecounter.hardware` and `machdep.cacheline_size`, and `sysctl` does the same for the MIBs {1, 6}, {1, 7}, {1, 12}, {1, 27}, {1, 32}, {6, 4} and {6, 11}. The buffer and the length are left alone. A payload process on a PS5 (firmware 12.70) gets this for a read, a size query, a null length and a null buffer with a null length, by name and by MIB. `sysctlnametomib` gives those seven MIBs, and returns `ENOENT` for `hw.cacheline_size`, `hw.usermem` and `machdep.cacheline_size` without touching the count or the first three words of the MIB, as the console does. A write to these names and MIBs throws, except for `machdep.cacheline_size`, which returns `ENOENT` as FreeBSD amd64 does for an OID it does not define; the console's answer to a write was not tried. The console's `sysctlnametomib` gives `kern.smp.maxcpus`, `kern.stackprot`, `kern.sched.name` and `kern.timecounter.hardware` the MIBs {1, 2147482816, 2147482814}, {1, 2147483151}, {1, 2147483182, 2147483181} and {1, 2147482838, 2147482834}, and its `sysctl` returns `ENOENT` for them; here `sysctlnametomib` throws for them. `hw.physmem`, `hw.realmem` and `vm.overcommit` return `ENOENT` on the console too but report values here, as the `hw.realmem` and `vm.overcommit` entries say. A payload process also gets `ENOENT` for `kern.anyps5_no_such_name`, which its `sysctlnametomib` does not resolve; other names still throw here. A title process was not measured
+- [sysctl names measured absent on a PS5 payload](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - On firmware 12.70, a payload gets `ENOENT` for `hw.byteorder`, `hw.cacheline_size`, `hw.machine_arch`, `hw.usermem`, `kern.clockrate`, `kern.maxfiles`, `kern.maxfilesperproc`, `kern.maxproc`, `kern.ps_strings`, `kern.sched.name`, `kern.smp.maxcpus`, `kern.stackprot`, `kern.timecounter.hardware` and `machdep.cacheline_size`. `sysctl` returns `ENOENT` for MIBs {1, 6}, {1, 7}, {1, 12}, {1, 27}, {1, 32}, {6, 4} and {6, 11}; reads and size queries leave output buffers and lengths untouched. `sysctlnametomib` resolves the seven corresponding MIB names and returns `ENOENT` for `hw.cacheline_size`, `hw.usermem` and `machdep.cacheline_size`. Writes and title behavior are unmeasured.
+- [Unknown sysctl names and MIBs](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - a numeric MIB under a known top-level node, or under one of 256 or more (where FreeBSD numbers dynamic nodes), that is not implemented throws, where a payload process on PS5 firmware 13.60 gets `ENOENT` for {1, 9999}, {6, 9999}, {0, 9999}, {1, 14, 9999, pid} and 24 levels starting {1, 9999}, since an unimplemented MIB here may exist there. A top-level node below 0 or from 10 to 255 gets `ENOENT` with the buffer and length untouched, as {99, 1} did there. Unrecognized names get `ENOENT` through `sysctlbyname` and `sysctlnametomib`, as `kern.anyps5.x` did. The ten FreeBSD top-level names (`sysctl` to `p1003_1b`), with or without a trailing dot, map to one level, and `sysctlbyname` fails them with `EINVAL`; a name of 1024 bytes or more gets `ENAMETOOLONG` from both, as measured for `kern` and `kern.`
 - [hw.pagesize](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) reports the system page size (16384 bytes, PS5_PAGE_SIZE) as an integer through sysctl MIB {6, 7} (CTL_HW, HW_PAGESIZE) and the "hw.pagesize" sysctlbyname lookup, following FreeBSD's [`hw.pagesize`](https://github.com/freebsd/freebsd-src/blob/main/sys/kern/kern_mib.c#L177), a read-only `SYSCTL_INT` of `PAGE_SIZE`. The value on a PS5 follows the 16 KiB page size the rest of libkernel uses and is unmeasured. A write returns -1 with EPERM.
 - [hw.model](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) reports the [host CPU's name](../../../core/libs/prx/libkernel/System/src/HostCpu.cpp), built as FreeBSD 11 builds `hw.model`: the CPUID brand string (leaves 0x80000002 to 0x80000004) without leading spaces ([identcpu.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/x86/x86/identcpu.c#L683-L691)). Trailing padding stays, as it does there, so an AMD host's name ends in spaces. The name a PS5 reports is unknown. A write returns -1 with `EPERM`. A host without an x86 CPUID brand string, such as an Apple Silicon Mac, throws. PPSA99203 only prints it (`[console] hw.model: %s`)
 - [Host CPU check](../../../core/libs/prx/libkernel/System/src/HostCpu.cpp) (libkernel) - when libkernel loads on a Linux or Windows x86-64 host, it logs which of the PS5 CPU's user-mode extensions CPUID reports and throws, naming the host CPU, if any extension is missing that LLVM selects from plain C/C++ for the PS5's Zen 2 (`-march=znver2`, [feature list](https://github.com/llvm/llvm-project/blob/llvmorg-19.1.7/llvm/lib/Target/X86/X86.td#L1459-L1513)): SSE to SSE4.2, SSSE3, POPCNT, LZCNT, BMI1, BMI2, MOVBE, CMPXCHG16B, LAHF/SAHF, AVX, AVX2, FMA, F16C, and the operating system's AVX state in XCR0 (#3719). SSE4A, CLZERO and SHA, which `--to-intel` converts, and AES, PCLMULQDQ, RDRAND, RDSEED, ADX, CLFLUSHOPT, CLWB, RDPID, XSAVEOPT, XSAVEC and PREFETCHW, which compilers emit only for intrinsics or explicit prefetches, are logged but not required: a title that executes one of them on a host without it still stops with an illegal instruction. macOS hosts are not checked: some Rosetta versions execute extensions without reporting them through CPUID, but support differs by host. ANDN and RDRAND fault on an M1 with macOS 15.3.1; see the [Rosetta conversion limits](relinker.md)
+- [sceKernelGetSystemExVersion, sysKernelGetLowerLimitSysexVersion, sysKernelGetLowerLimitUpdVersion](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) and [sceKernelGetTraceMemoryStats](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - follow libkernel.sprx, libkernel_sys.sprx and libkernel_web.sprx of firmware 13.42, read from disassembly and not measured on a console. None of them asks the kernel: the first writes an empty string to both outputs and returns a plain 22, not `SCE_KERNEL_ERROR_EINVAL`, when either is null; the lower limits write an empty string and a 32-bit 0; the trace memory statistics write 0 to each output that is not null. The meaning of the outputs is not known
 - [machdep.tsc_freq](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) reports the host TSC frequency that `sceKernelGetTscFrequency` measures, as a 64-bit value like FreeBSD 11's [`sysctl_machdep_tsc_freq`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/x86/x86/tsc.c#L658-L676). FreeBSD lets root write it to change the TSC timecounter's frequency; a write here returns -1 with `EPERM`. PPSA99203 reads it at start-up and measures the TSC itself when the value is 100 MHz or less
 - [getrlimit](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - `RLIMIT_CPU`, `RLIMIT_FSIZE`, `RLIMIT_CORE`, `RLIMIT_SBSIZE`, `RLIMIT_VMEM`/`AS`, `RLIMIT_NPTS`, `RLIMIT_SWAP`, `RLIMIT_KQUEUES` and `RLIMIT_UMTXP` report infinity as in FreeBSD's process-0 defaults, and `RLIMIT_DATA` mirrors the host limit; a payload process on a PS5 (firmware 12.70) reads 0x800000000 for both limits. `RLIMIT_NOFILE` reports, as both soft and hard limit, the number of descriptors after which AnyPS5 itself fails with `EMFILE`: on Windows the C runtime's 8192 low-level descriptors, which guest files, pipes and sockets all take, and as many stdio streams, which libkernel raises from 512 at load with [`_setmaxstdio`](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/setmaxstdio), on Linux the host's `RLIMIT_NOFILE`, whose soft limit libkernel raises to the hard limit at load, and on macOS the smaller of the host's hard limit and `kern.maxfilesperproc`, which libkernel sets as both limits at load, since macOS fails with `EMFILE` at `kern.maxfilesperproc` whatever the soft limit. A payload process on a PS5 (firmware 12.70) reads 13952 for both limits, while `getdtablesize` returns 12555 and the process can open descriptors up to 12554. XPSemu (PPSA97358) reads `RLIMIT_NOFILE` in QEMU's `os_setup_limits` and raises the soft limit to the hard one when they differ. `RLIMIT_STACK` (0x200000), `RLIMIT_RSS` and `RLIMIT_MEMLOCK` (infinity) and `RLIMIT_NPROC` (1604) report the soft and hard limits a payload process reads on a PS5 (firmware 12.70). Guest locking still follows the host: `mlock` and `sceKernelMlock` fail at the host's hard `RLIMIT_MEMLOCK` on Linux, and on Windows when the process working set cannot grow, although `RLIMIT_MEMLOCK` reports infinity. There the main thread's stack is 0x200000 as well (`pthread_attr_get_np`); here the main thread runs on the host thread's stack, whose size can differ. Whether a title process reads the same limits is unverified.
+- [EVFILT_TIMER modify with data 0](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - a timer change with `EV_ADD`, `data` and `fflags` unset keeps the note's period instead of taking FreeBSD's zero default, which would fire without delay; whether the console keeps or zeroes the period is unverified. `EV_ENABLE` on a disabled timer reports the expiries it missed while disabled, as FreeBSD 11's `filt_timerexpire` counts a disabled note and keeps its phase: the missed count is summed in one step at the first wait and the next expiry keeps the note's phase, which `TimerDisableEnableRearm` pins; not measured on a console. A change that sets `EV_ADD`, `data` or `fflags` still throws, waiting for the measured re-add rules: FreeBSD 11's `kqueue_register` copies `data` and `fflags` onto the note and the new period applies at the next expiry.
 - [setrlimit](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) validates the resource and input in FreeBSD order, maps negative limits to infinity, and lowers a soft limit above the hard limit. A request other than `RLIMIT_NPROC` succeeds when its normalized values match `getrlimit`, or, for `RLIMIT_NOFILE`, when `rlim_max` does not exceed the current hard limit and `rlim_cur` does not exceed `rlim_max`, storing the updated limits for subsequent `getrlimit` queries; descriptor allocation enforcement of the lowered soft limit is not implemented, and changing other limits throws because guest limit state is not stored. In a payload process on a PS5 (firmware 12.70), `setrlimit(RLIMIT_NOFILE)` lowers a requested 13952 to 12555, as the hard and as the soft limit; here a request within the current hard limit is stored as given and one above it throws; setting `RLIMIT_STACK`, `RLIMIT_RSS` and `RLIMIT_MEMLOCK` to their current values succeeds and changes nothing, as here; setting `RLIMIT_NPROC` to its current 1604 also succeeds but leaves 1443. `RLIMIT_NPROC` follows FreeBSD 11 by clamping both values to 1 through `maxprocperuid`, stores the result and returns it from `getrlimit`. The initial 1604 and `maxprocperuid` 1443 follow that measurement: process 0's limit starts at `maxproc` ([`init_main.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/init_main.c#L550-L551)), `maxprocperuid` starts at nine tenths of it ([`subr_param.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/subr_param.c#L258)), and `setrlimit` applies that bound ([`kern_resource.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_resource.c#L714-L718)). `kern.maxproc` fails with `ENOENT` in the payload process, so the values cannot be queried independently, and process creation does not enforce the stored limit. Java 25 LAN / DNS (PPSA99869) sets `rlim_cur = MIN(0x100000, rlim_max)` during VM initialization
+- [socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) turns off Winsock's report of an ICMP port-unreachable reply on datagram sockets (`SIO_UDP_CONNRESET`). Winsock fails the next receive on any datagram socket with `WSAECONNRESET`, where FreeBSD's [`udp_common_ctlinput`](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/netinet/udp_usrreq.c#L774-L798) reports the reply only to a socket connected to the sender. So on Windows a datagram socket connected to a port nobody listens on does not fail its next send or receive with `ECONNREFUSED` either
 - [execvp](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) throws: replacing the process image is not supported. PPSA85300 imports it and fails to load without it; its `fork` and `vfork` fail with `ENOSYS` ([libc_missing.c](https://github.com/ZiZc3/VLC/blob/f3253020a64368153233ede29183014c0b6c8979/ps5/compat/libc_missing.c#L290-L292)), so the child process that would call it is never created.
 - [nmount](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) throws: mounting file systems is not supported. Prospero Themes (PPSA90210) imports it and fails to load without it; it opens its theme library without calling it, and its strings (`/dev/ssd0.system_ex`, `/system_ex`, `exfatfs`, `fstype`, `fspath`, `from`, `ignoreacl`) point to remounting the console's `/system_ex` partition to write theme files there.
-- [socketpair](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - the pair is the host's `AF_UNIX` pair on Linux and macOS and, on Windows, a loopback TCP connection for `SOCK_STREAM` or two connected UDP sockets for `SOCK_DGRAM`; `SOCK_SEQPACKET` throws on Windows and macOS, which has no such `AF_UNIX` pair. A datagram sent to a full receiver gets `ENOBUFS` on the console, waits or gets `EAGAIN` on Linux and is dropped on Windows, and on Windows a datagram `recv` after the peer closed reports `ECONNRESET` instead of the console's `ENOTCONN`, and the first stream `send` after the peer closed succeeds on the loopback connection, where the console returns `EPIPE`; the sends after it report `EPIPE`. `read` and `write` on a pair end go to the host like on every guest socket. `getpeername` on a pair end succeeds after the peer closed, where the console returns `ENOTCONN`, and `connect`, `bind` and `sendto` with an address on a pair end report an address-family error instead of the console's `EISCONN`. On Windows `poll` on a stream end reports `POLLIN` after the peer's `shutdown(SHUT_WR)` or `close`, as the console does after a `shutdown(SHUT_WR)`; after the peer's `close` the console reports `POLLIN` with `POLLHUP`, because `unp_drop` disconnects the other end, and the loopback connection cannot tell that from a shutdown, so no `POLLHUP` is reported
+- [socketpair](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - the pair is the host's `AF_UNIX` pair on Linux and macOS and, on Windows, a loopback TCP connection for `SOCK_STREAM` or two connected UDP sockets for `SOCK_DGRAM`; `SOCK_SEQPACKET` throws on Windows and macOS, which has no such `AF_UNIX` pair. A datagram sent to a full receiver gets `ENOBUFS` on the console, waits or gets `EAGAIN` on Linux and is dropped on Windows, and on Windows a datagram `recv` after the peer closed reports `ECONNRESET` instead of the console's `ENOTCONN`, and the first stream `send` after the peer closed succeeds on the loopback connection, where the console returns `EPIPE`; the sends after it report `EPIPE`. `read` and `write` on a pair end go to the host as on every guest socket. `connect`, `bind` and `sendto` with an address on a pair end report an address-family error instead of the console's `EISCONN`. On Windows `poll` on a stream end reports `POLLIN` after the peer's `shutdown(SHUT_WR)` or `close`, as the console does after a `shutdown(SHUT_WR)`; after the peer's `close` the console reports `POLLIN` with `POLLHUP`, because `unp_drop` disconnects the other end, and the loopback connection cannot tell that from a shutdown, so no `POLLHUP` is reported
 - Guest sockets on macOS ([the equeue wait, kevent, fstat and ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp), [gethostbyname](../../../core/libs/prx/libScePosixForWebKit/Resolver.cpp)): macOS has no `ppoll`, so the wait uses `poll` with the timeout rounded up to a millisecond; it has no `POLLRDHUP`, so a stream that the peer closed is found by peeking one byte when it is readable; `FIONREAD` on a datagram socket, and the byte count that `fstat` and `kevent` report for it, is `SO_NREAD`, the size of the next datagram, because macOS adds the source address to `FIONREAD`; and `gethostbyname` replaces `gethostbyname_r`, which macOS lacks.
-- [UDP recv/recvfrom](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) and [sceNetRecv/sceNetRecvfrom](../../../core/libs/prx/libSceNet/Export.cpp) translate Windows WSAEMSGSIZE into the copied byte count for datagram sockets, including MSG_PEEK, and retain the sender address. This follows FreeBSD 11.4 recv(2) and Winsock's documented truncated-datagram behavior; console behavior and existing title impact are unverified.
 - [recvmsg](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) loses received stream data on an output copy fault: outputs are checked after the host receive. FreeBSD 11.4 leaves unread stream data queued, though it also drops a datagram on a copy fault ([`soreceive_dgram`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L2308-L2312), [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1758-L1774)). A Linux `process_vm_readv` or `process_vm_writev` failure other than `EFAULT` throws
 - [MSG_DONTWAIT](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) in `send`, `sendto`, `sendmsg`, `recv`, `recvfrom` and `recvmsg` makes that one call non-blocking through the host's `MSG_DONTWAIT`, as FreeBSD 11.4's `soreceive_generic` returns `EWOULDBLOCK` for it (`sys/kern/uipc_socket.c`). Winsock has no per-call non-blocking flag, so on Windows the call first asks `WSAPoll` with a zero timeout whether the socket is ready and fails with `EAGAIN` when it is not. The check and the transfer are two host calls: a second thread that takes the data in between can leave a `recv` blocked, and a `send` of more bytes than the socket buffer holds can still block until it has sent them, where FreeBSD's `sosend_generic` returns a partial count
 - [MSG_WAITALL](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) in `recv`, `recvfrom` and `recvmsg` on a stream socket is passed to the host, which returns when the buffer is full, the peer closes or an error occurs, as FreeBSD 11.4's [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1855-L1860) does; a datagram socket ignores it. It is not measured on a console, a nonblocking socket and a call that also passes `MSG_PEEK` follow the host's rules, and `SO_RCVTIMEO` bounds only the wait for the first data. Any other flag still fails with `EOPNOTSUPP`.
-- [recv and recvfrom](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answer without the host a zero-length receive on a stream socket (0, or `ENOTCONN` when it is not connected, [L1566-L1578](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1566-L1578)) and, on Windows only, a receive on a socket whose read side `shutdown` closed (0, as [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1556-L1562) returns at `SBS_CANTRCVMORE`); Winsock fails the second with `EPIPE` and blocks on the first. Linux and macOS still return data buffered before the `shutdown`, where FreeBSD discards it. `recvmsg` still asks the host in both cases. Not measured on a console.
+- [recv and recvfrom](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answer some cases without the host. A zero-length receive on a stream socket returns 0, or `ENOTCONN` when it is not connected ([L1566-L1578](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1566-L1578)), as on a PS5 (firmware 13.60). On an empty datagram socket it returns 0 at once; the console was measured only with `MSG_DONTWAIT`, and the blocking case follows FreeBSD 11.4's `soreceive_dgram`, which returns 0 before waiting. `recvmsg` answers the empty datagram socket the same way but asks the host in the stream cases. A datagram another thread takes after the check makes a zero-length receive wait
+- [recv and recvfrom after `shutdown(SHUT_RD)`](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) return 0 on Windows ([`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1556-L1562)) where Winsock fails with `EPIPE`; Linux and macOS still return data buffered before it, which the console discards.
 - [send, sendto](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - send and sendto without an address on an unconnected datagram socket map Windows `WSAENOTCONN` to FreeBSD's `EDESTADDRREQ` (39).
-- [bind, connect, sendto](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) check a socket address length as FreeBSD 11.4's [`getsockaddr`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_syscalls.c) and the `sa_len` test of `tcp_usr_connect` and `in_pcbconnect` do: below 2 or an `AF_INET` address below 16 or an `AF_INET6` address below 28 bytes fails with `EINVAL`, above 255 with `ENAMETOOLONG`. An address longer than `sockaddr_in` or `sockaddr_in6` is still accepted where FreeBSD answers `EINVAL`, and an address of another family still fails with `EAFNOSUPPORT`, as the console's behaviour for these is not known. None of this was measured on a console.
+- [bind, connect, sendto](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) check a socket address as a payload process on a PS5 (firmware 13.60) did on datagram sockets: a length below 2 fails with `EINVAL` and above 255 with `ENAMETOOLONG`; an `AF_INET` socket needs exactly 16 bytes and an `AF_INET6` socket 28, or `EINVAL`; another family fails with `EAFNOSUPPORT`; `sendto` on an `AF_INET` socket, and all three on an `AF_INET6` socket, check the length first. Unmeasured: `bind` and `connect` on an `AF_INET` socket check the family first, where FreeBSD 11.4's `tcp_usr_bind` and `tcp_usr_connect` check the length first; stream sockets follow the datagram order; `AF_UNSPEC` with `INADDR_ANY`, which FreeBSD's `bind` accepts, fails; `connect` on a listening stream socket fails with `EOPNOTSUPP` first, as `soconnect` does. A connected stream socket's `sendto` ignores the address once its length passes, as `tcp_usr_send` does
+- [bind, connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) on an `AF_INET6` datagram socket with `IPV6_V6ONLY` cleared accept an IPv4-mapped address longer than 28 bytes and use its first 28, as FreeBSD 11.4's `udp6_bind` and `udp6_connect` hand it to `in_pcbbind` and `in_pcbconnect` as a `sockaddr_in` without the length test of `in6_pcbbind`; `sendto` still fails it with `EINVAL`, as `udp6_send` tests the length first. The console was measured only with `::1` and `IPV6_V6ONLY` at its default, so this case is not measured
 - [read, write and vector I/O](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) on a guest socket use `recv` and `send` without flags; `sceKernelReadv` and `sceKernelWritev` gather or scatter through one socket operation, preserving stream short reads and datagram boundaries. The positioned `pread`, `pwrite`, `preadv` and `pwritev` forms, and their `sceKernel` forms, return `ESPIPE` for an open guest socket and `EBADF` for a closed one. `EPIPE` from a write raises the host's `SIGPIPE` on Linux unless the socket has `SO_NOSIGPIPE` set, and the guest cannot ignore it: `signal(SIGPIPE, SIG_IGN)` and `sigaction` record the disposition, as they do for every number from 1 to 128, but only the six signals with host equivalents (2, 4, 6, 8, 11 and 15) take effect on the host or are delivered, so the host `SIGPIPE` is not stopped; nothing is raised on Windows; a `write` longer than `INT_MAX` bytes is `EMSGSIZE` where the console sends it. AIO on a guest socket still goes to the host, which has no such descriptor
-- [Socket descriptor numbers](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel, libSceNet) - `socket`, `accept`, `socketpair`, `dup`, `sceNetSocket` and `sceNetAccept` take the lowest free number of the host descriptor table that files use, as FreeBSD 11.4 `fdalloc` takes the lowest free entry of the one process table (`kern_descrip.c`), so every number stays below `FD_SETSIZE` (1024) while fewer than 1024 descriptors are open. The number holds a zero-access `NUL` handle on Windows and a duplicate of the host socket on Linux, and the socket tables map it to the socket. The host table also holds the runtime's own files, so the numbers differ from the console's; the first number `socket` and `sceNetSocket` return on a console and its `getdtablesize` are not measured. Paths that bypass the socket tables see the placeholder: libc `fdopen` on a socket opens it, and libkernel `close` of a libSceNet socket releases the number but leaves the libSceNet socket open. Palworld (PPSA23126), The Mound (PPSA26223) and Dying Light 2 (PPSA02262) set socket bits in a 1024-bit `fd_set`
+- [Socket descriptor numbers](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel, libSceNet) - `socket`, `accept`, `socketpair`, `dup`, `sceNetSocket` and `sceNetAccept` take the lowest free number of the host descriptor table that files use, as FreeBSD 11.4 `fdalloc` takes the lowest free entry of the one process table (`kern_descrip.c`), so every number stays below `FD_SETSIZE` (1024) while fewer than 1024 descriptors are open. The number holds a zero-access `NUL` handle on Windows and a duplicate of the host socket on Linux, and the socket tables map it to the socket. The host table also holds the runtime's own files, so the numbers differ from the console's; the first number `socket` and `sceNetSocket` return on a console and its `getdtablesize` are not measured. Paths that bypass the socket tables see the placeholder: libc `fdopen` on a socket opens it, and libkernel `sceKernelClose` of a libSceNet socket releases the number but leaves the libSceNet socket open. Palworld (PPSA23126), The Mound (PPSA26223) and Dying Light 2 (PPSA02262) set socket bits in a 1024-bit `fd_set`
 - [fstat on a guest socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) fills the fields FreeBSD 11's soo_stat and pru_sense_null fill and zeroes the rest: S_IFSOCK, the read bits while the receive side is open or data is queued, the write bits while the send side is open, st_size and st_blksize. Only this process's shutdown closes a side here; a peer's shutdown, close or reset does not clear the bits as FreeBSD's socantrcvmore and socantsendmore do. st_size is the host's FIONREAD, which for a Linux datagram socket is the size of the next datagram where FreeBSD counts every queued byte, and st_blksize is the host's SO_SNDBUF, which Linux reports as twice the size that was set. A socketpair end reports st_dev and st_ino 0, where FreeBSD's uipc_sense reports NODEV and a per-socket number
-- [poll](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) waits on guest sockets and pipes, through `WSAPoll` on Windows and `poll` on Linux; the `pollfd` layout and flag values are FreeBSD's. A libSceNet socket joins the same host wait through the native socket libSceNet lends to libkernel. `WSAPoll` rejects `POLLPRI`, so on Windows a socket's `POLLPRI` is asked as `POLLRDBAND` and `POLLIN` as `POLLRDNORM`; Winsock reports urgent data until it is read with `MSG_OOB`, where FreeBSD 11.4's `sopoll_generic` stops once the normal stream passes the mark. Guest `send` and `recv` refuse `MSG_OOB` with `EOPNOTSUPP`, so urgent data can only come from an outside peer and Windows keeps reporting `POLLPRI` after the stream passes the mark. A pipe follows FreeBSD's `pipe_poll`: the read end is readable when data is buffered, either end reports `POLLHUP` once the other end is closed, with the requested `POLLIN` and `POLLRDNORM` bits and without `POLLOUT`, which `pollscan` clears, and the write end is writable when `PIPE_BUF` (512) bytes are free on Windows, or when the host kernel says so on Linux. `POLLOUT` on a read end throws: FreeBSD opens both ends for reading and writing and reports it writable, and host pipes are one-way. Windows pipes cannot be waited on, so while a pipe is polled `poll` checks it with `NtQueryInformationFile` and waits on the sockets in slices of 1 ms. A regular file, a directory or a file read from app0.zar is always ready for `POLLIN`, `POLLRDNORM` and `POLLOUT` and never for `POLLPRI`, `POLLRDBAND` or `POLLWRBAND`, as FreeBSD 11.4's [`vop_stdpoll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_default.c#L563-L574) and `vop_nopoll` answer every event `poll` accepts; which of the two the console's filesystems use is not known, and they agree on these events. `/dev/random` and `/dev/urandom` follow FreeBSD 11.4's [`randomdev_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/dev/random/randomdev.c#L274-L285) for a seeded device: a request with `POLLIN` or `POLLRDNORM` gets only those bits back, and any other request gets every requested bit. Open descriptors 0 to 2 follow the console model `select` uses: descriptor 0 never reports an event and descriptors 1 and 2 report `POLLOUT`, whatever the host attaches to them. A closed descriptor reports `POLLNVAL`, and an open descriptor that is neither a guest socket, a libSceNet socket, a pipe, a file, a directory, the random device nor descriptor 0 to 2 (other devices, a kqueue) throws, as do event bits other than `POLLIN`, `POLLPRI`, `POLLOUT`, `POLLRDNORM`, `POLLRDBAND` and `POLLWRBAND` (the `POLLERR`, `POLLHUP` and `POLLNVAL` bits are ignored in `events`), an infinite timeout with no socket or pipe to wait on. A closed socket descriptor reports `POLLNVAL`; the console's limit on the descriptor count is unknown and not checked
+- [poll](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) waits on guest sockets and pipes, through `WSAPoll` on Windows and `poll` on Linux; the `pollfd` layout and flag values are FreeBSD's. A libSceNet socket joins the same host wait through the native socket libSceNet lends to libkernel. `WSAPoll` rejects `POLLPRI`, so on Windows a socket's `POLLPRI` is asked as `POLLRDBAND` and `POLLIN` as `POLLRDNORM`; Winsock reports urgent data until it is read with `MSG_OOB`, where FreeBSD 11.4's `sopoll_generic` stops once the normal stream passes the mark. Guest `send` and `recv` refuse `MSG_OOB` with `EOPNOTSUPP`, so urgent data can only come from an outside peer and Windows keeps reporting `POLLPRI` after the stream passes the mark. A pipe follows FreeBSD's `pipe_poll`: the read end is readable when data is buffered, either end reports `POLLHUP` once the other end is closed, with the requested `POLLIN` and `POLLRDNORM` bits and without `POLLOUT`, which `pollscan` clears, and the write end is writable when `PIPE_BUF` (512) bytes are free on Windows, or when the host kernel says so on Linux. `POLLOUT` on a read end throws: FreeBSD opens both ends for reading and writing and reports it writable, and host pipes are one-way. Windows pipes cannot be waited on, so while a pipe is polled `poll` checks it with `NtQueryInformationFile` and waits on the sockets in slices of 1 ms. A kqueue is ready for `POLLIN` and `POLLRDNORM` while one of its events is triggered and for no other event, as FreeBSD 11.4's [`kqueue_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c#L1900-L1924) answers. A kqueue cannot be waited on either, so on every host `poll` checks it every millisecond and waits on the other descriptors in slices of 1 ms. A kqueue closed during the wait reports `POLLNVAL`, and one whose number was reused is polled again with the rest of the timeout, as FreeBSD 11.4's [`pollrescan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1499-L1519) looks the descriptor up again. A close that has already removed the kqueue but not yet closed its host descriptor is seen as a descriptor of unknown kind, which throws. A regular file, a directory or a file read from app0.zar is always ready for `POLLIN`, `POLLRDNORM` and `POLLOUT` and never for `POLLPRI`, `POLLRDBAND` or `POLLWRBAND`, as FreeBSD 11.4's [`vop_stdpoll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_default.c#L563-L574) and `vop_nopoll` answer every event `poll` accepts; which of the two the console's filesystems use is not known, and they agree on these events. `/dev/random` and `/dev/urandom` follow FreeBSD 11.4's [`randomdev_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/dev/random/randomdev.c#L274-L285) for a seeded device: a request with `POLLIN` or `POLLRDNORM` gets only those bits back, and any other request gets every requested bit. At descriptors 0 to 2, regular files, directories and archived files use vnode readiness too, including host redirection (`< file`, `> log.txt` or `2> log.txt`). A standard descriptor that is not a socket, a kqueue, a random device or a vnode still takes the console fallback: descriptor 0 never reports an event and descriptors 1 and 2 report `POLLOUT`. A closed descriptor reports `POLLNVAL`, and an open descriptor that is neither a guest socket, a libSceNet socket, a pipe, a file, a directory, the random device nor descriptor 0 to 2 (other devices) throws, as do event bits other than `POLLIN`, `POLLPRI`, `POLLOUT`, `POLLRDNORM`, `POLLRDBAND` and `POLLWRBAND` (the `POLLERR`, `POLLHUP` and `POLLNVAL` bits are ignored in `events`), an infinite timeout with no socket, pipe or kqueue to wait on. A closed socket descriptor reports `POLLNVAL`; the console's limit on the descriptor count is unknown and not checked
 - [poll](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) on Windows reports a guest stream socket whose peer closed as readable and adds `POLLHUP` only once the socket has shut its own sending side, as FreeBSD 11.4's [`sopoll_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L3080-L3086) does; `WSAPoll` reports `POLLHUP` alone in both cases. A reset or refused connection (`POLLHUP` with `POLLERR`) keeps `WSAPoll`'s flags, a libSceNet socket keeps them too, and a call that asks for no event still returns early on the peer's close with nothing reported. Not measured on a console.
+- [poll on a stream socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - on Linux a socket that reports `POLLHUP` reports it without `POLLOUT`, as FreeBSD 11.4's `pollscan` clears `POLLOUT` whenever it reports `POLLHUP`; Linux, like FreeBSD, reports `POLLHUP` only once both of the socket's directions are shut. Windows keeps the flags `WSAPoll` reports. Not measured on a console
 - [kevent EV_CLEAR on a socket or a pipe](../../../core/libs/prx/libkernel/Equeue/src/EdgeWatch.cpp) (libkernel) - FreeBSD 11 activates an `EV_CLEAR` knote when `kqueue_register` finds it ready, which every `EV_ADD` or `EV_ENABLE` of an enabled knote does again, and on each `KNOTE` the socket or pipe raises (`sorwakeup`, `sowwakeup`, `pipeselwakeup`); [`kqueue_scan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c) checks the filter again before reporting, drops a knote that is no longer ready and deactivates a reported one until the next activation. On Linux each such knote registers the host socket or pipe with its own epoll instance in edge-triggered mode (`EPOLLIN | EPOLLRDHUP` for `EVFILT_READ`, `EPOLLOUT` for `EVFILT_WRITE`), and a wakeup of the host descriptor with that mask stands for a `KNOTE`: the knote is then checked with the same readiness test as a level-triggered one, `NOTE_LOWAT` mark included, and a wait blocks on the epoll descriptor instead of the socket, so a socket that stays readable does not wake it. The host's wakeups are not FreeBSD's: FreeBSD raises `sowwakeup` whenever send buffer space is freed, while Linux TCP wakes `EPOLLOUT` waiters only once the socket is writable again after a write found it full (`SOCK_NOSPACE`, [`tcp_check_space`](https://github.com/torvalds/linux/blob/v6.8/net/ipv4/tcp_input.c#L5639)), so a TCP writer that never fills its buffer sees fewer `EVFILT_WRITE` events than on FreeBSD; a host stack may also coalesce data wakeups, so the number of times a busy socket fires can differ. Windows and macOS throw, as the host there has no edge-triggered wait over these descriptors that is wired up; `EV_CLEAR` on the timer, user and vnode filters does not use this and works everywhere.
 - [kevent on a pipe](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - host pipes are one-way, where FreeBSD's [`kern_pipe`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/sys_pipe.c#L422) opens both ends for reading and writing, so `EVFILT_READ` on the write end and `EVFILT_WRITE` on the read end throw; on macOS `EVFILT_WRITE` on a pipe throws, as the host has no call for a pipe's capacity. `EVFILT_WRITE` reports the free space of the host buffer, not of FreeBSD's 16 KiB one, and on Linux fires when the host says the pipe is writable rather than at `PIPE_BUF` (512) free bytes. Windows pipes cannot be waited on, so a kqueue waiting on one checks it every 1 ms. Otherwise [`filt_piperead`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/sys_pipe.c#L1787-L1828) and `filt_pipewrite` are followed: `EV_EOF` once the other end closes, `EPIPE` for a write event added after the read end closed, and `NOTE_LOWAT` ignored. On Windows `fcntl` cannot make a pipe write end non-blocking, so the full-pipe and drain case of `EVFILT_WRITE` is tested on Linux only and the `NtQueryInformationFile` write quota is checked there only for the free space, `EV_EOF` and `EPIPE`.
 - [kevent on a kqueue](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - `EVFILT_READ` on a kqueue counts the watched queue's enabled notes that are ready when it is evaluated, where [`filt_kqueue`](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/sys/kern/kern_event.c#L363-L370) reports `kq_count`, the queued notes: a queued note counts until that kqueue is scanned, even once disabled or no longer ready (a socket or pipe read empty, a user note cleared, a watched kqueue drained), so FreeBSD can report it readable where this reports nothing. A queued `EV_ONESHOT` note is reported there with its last count and deleted; here it is evaluated again and, if the watched queue is empty by then, neither reported nor deleted. `EV_CLEAR` throws, as FreeBSD re-arms it only when the watched kqueue queues a note. A cycle of watches throws; a note on the queue itself is `EINVAL`. Not measured on a console
 - [Socket error numbers](../../../core/libs/prx/libkernel/Socket/include/SocketError.hpp) (libkernel) - a host socket error becomes the FreeBSD 11 `errno.h` number of the same name; the numbers are not checked on the console. Winsock `WSAESHUTDOWN` becomes `EPIPE`, as a send after `shutdown` does on FreeBSD, and a host error with no FreeBSD socket counterpart becomes `EIO`. On Windows a refused nonblocking `connect` is never reported (`SO_ERROR` is unsupported), so a repeated one keeps reporting `EALREADY` where FreeBSD reports `ECONNREFUSED`. A receive after `shutdown(SHUT_RD)` reports `EPIPE` on Windows where FreeBSD returns 0
-- [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) on a guest socket handle the SOL_SOCKET level, `TCP_NODELAY` and `IPV6_V6ONLY`, after FreeBSD 11.4's [`sosetopt` and `sogetopt`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c): `SO_REUSEADDR`, `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and `SO_ERROR`, `SO_TYPE`, `SO_ACCEPTCONN`, `SO_SNDBUF` and `SO_RCVBUF` are read. A boolean option reads back as its own bit, as FreeBSD returns `so_options & option`. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new `connect`; a second failure with the same code on the same socket without a `connect` in between would be hidden. `SO_SNDBUF` and `SO_RCVBUF` read the host's value, which is not the size FreeBSD reports (Linux doubles it). `SO_NOSIGPIPE` is kept per socket and reads back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal. An accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. `SO_NBIO` (`0x1200`) is the console's own option, not FreeBSD's. It switches the socket between blocking and non-blocking as `FIONBIO` does and reads back as 0 or 1, as `sceNetSetsockopt` and `sceNetGetsockopt` treat it here; what the console reads back for it is not measured. `TCP_NODELAY` (`IPPROTO_TCP`, 1) is set on the host socket and reads back as `TF_NODELAY` (4), as [`tcp_default_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/tcp_usrreq.c#L1860-L1861) returns it. The `IPPROTO_TCP` level on a datagram or `AF_UNIX` socket fails with `EINVAL`, as [`ip_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/ip_output.c#L943-L944) and [`uipc_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_usrreq.c#L1228-L1229) answer it, and an accepted socket takes `TCP_NODELAY` through the host. `SO_SNDTIMEO` and `SO_RCVTIMEO` follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689) and [`sogetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2846-L2850). A 16-byte `timeval` with a negative field or 1000000 microseconds or more fails with `EDOM`, and more than `INT32_MAX` seconds becomes the longest wait. The value is kept and read back through FreeBSD's 32.32 fixed-point conversion ([`tvtosbt`, `sbttotv`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/sys/time.h#L178-L286)), so half a second reads back as 499999 microseconds and one microsecond as 0. A `recv`, `recvfrom`, `recvmsg`, `read` or `readv`, and a `send`, `sendto`, `sendmsg`, `write` or `writev`, on a blocking socket then waits that long for the host to report the socket readable or writable, and fails with `EWOULDBLOCK`; a call with `MSG_DONTWAIT` does not wait. An accepted socket takes both from its listener ([`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L629-L630)). The wait covers only the first transfer: once the socket is writable the host send runs without a limit, where FreeBSD stops a send that cannot finish and returns the bytes sent so far, and a receive whose data another thread takes between the wait and the host call blocks again. `sendfile` ignores the send timeout. The host wait has millisecond steps, so a shorter timeout lasts up to a millisecond longer. A null value fails with `EINVAL`, where FreeBSD's [`kern_setsockopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L1414-L1415) returns `EFAULT`. `IPV6_V6ONLY` (`IPPROTO_IPV6`, 27) on an `AF_INET6` socket is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL` ([L1572](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1572)), as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as FreeBSD's default `net.inet6.ip6.v6only` does, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The `IPPROTO_IPV6` level on an `AF_INET` or `AF_UNIX` socket fails with `EINVAL`, as `ip_ctloutput` and `uipc_ctloutput` answer it. Every other SOL_SOCKET option (`SO_DEBUG`, `SO_USELOOPBACK`, `SO_REUSEPORT` and `SO_TIMESTAMP`, which FreeBSD stores, the low-water marks among them; PPSA99871 sets `SO_REUSEPORT` and carries on when it fails), every other `IPPROTO_TCP` option (`TCP_MAXSEG`, `TCP_KEEPIDLE`, `TCP_KEEPINTVL` and `TCP_KEEPCNT` among them), every other `IPPROTO_IPV6` option ([L1928-L1929](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1928-L1929), [L2158-L2159](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L2158-L2159)) and the `IPPROTO_IP` level fail with `ENOPROTOOPT`. None of this was measured on a console.
-- [connect to AF_UNSPEC](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux a socket bound to an explicit port keeps its local address as well (`127.0.0.1:<port>` stays `127.0.0.1:<port>`), because a bound socket cannot be bound again; one bound to port 0 is bound again to the wildcard address with the port it had
-- [connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - `connect` to port 0 on an unconnected `AF_INET` or `AF_INET6` stream or datagram socket fails with `EADDRNOTAVAIL` (49), as FreeBSD 11.4's `in_pcbconnect_setup()` and `in6_pcbconnect()` do. A connected stream socket keeps its host `EISCONN` answer. Known gaps: on an already connected datagram socket `connect` to port 0 keeps the old peer, where FreeBSD's `soconnect()` disconnects first and then fails with 49; `sendto` and `sendmsg` to port 0 on an `AF_INET` datagram socket fail with 49 unless the socket is bound to a specific address and port and the destination is neither `INADDR_ANY` nor `INADDR_BROADCAST`, which is the path where `udp_output()` skips `in_pcbconnect_setup()` and FreeBSD sends to port 0. There nothing can receive on port 0, so the call returns the length without the host, because Linux's `udp_sendmsg` refuses port 0 with `EINVAL`; an `AF_INET6` socket still goes to the host. The answers are taken from the FreeBSD source and are not measured on a console. [sceNetConnect](../../../core/libs/prx/libSceNet/Export.cpp) is not changed
-- [msync](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `kern_msync` and `vm_map_sync`, not measured on the console: the address is rounded down to the page, a range that wraps is `EINVAL`, as is `MS_ASYNC` with `MS_INVALIDATE`, and a range whose start or any page is not mapped (as `sceKernelVirtualQuery` reports it, reservations included) is `ENOMEM`; a page unmapped from inside a larger mapping still counts as mapped there, since `sceKernelVirtualQuery` keeps reporting the whole mapping. The guest has no file mappings, so a successful call writes nothing back. `MS_INVALIDATE` on a mapped range throws: FreeBSD returns `EBUSY` when the range holds `mlock`ed pages, and locked pages are not tracked
+- [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - a guest socket has the SOL_SOCKET level, eight `IPPROTO_TCP` options, `IPV6_V6ONLY` and ten `IPPROTO_IP` options. `SO_ACCEPTFILTER` (0x1000) fails with `ENOPROTOOPT` (42), where a payload process on a PS5 (firmware 13.60) failed it with `EINVAL` for a set and a get on a non-listening socket, as FreeBSD 11.4 does; the other options of these levels fail with `ENOPROTOOPT` and were not all measured. `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and a boolean one reads back as its own bit, as there. Winsock does not clear a pending error when `SO_ERROR` reads it, so on Windows a pending error is reported once and again only after a new `connect`; a second failure with the same code without a `connect` in between is hidden
+- [TCP_NOPUSH, TCP_NOOPT, TCP option 0x80, IP_RECVDSTADDR, IP_RECVIF, IP_RECVTTL](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept and read back as a payload process on a PS5 (firmware 13.60) did: the TCP ones as the bits 0x1000, 0x8 and 0x10000 (so 0x80 is not FreeBSD's `TCP_KEEPINIT` there), the IP ones as 0 or 1. None of them changes what the socket does: `TCP_NOPUSH` does not hold back sends, and the IP ones add no control message to `recvmsg`. `IP_RECVTTL` was only read, never set, on the console, and an accepted socket takes `TCP_NOPUSH` from its listener as FreeBSD 11.4's `syncache_socket` does, which was not measured
+- [SO_DEBUG, SO_REUSEADDR, SO_USELOOPBACK, SO_REUSEPORT, SO_TIMESTAMP, SO_BINTIME and option 0x10000](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept as bits that read back as on a PS5 (firmware 13.60, payload process), and options 0x4000 and 0x8000 are accepted and cannot be read, as there; only `SO_REUSEADDR` and `SO_REUSEPORT` change what the socket does. Both are set on the host, `SO_REUSEPORT` as `SO_REUSEADDR` on Windows, which has no `SO_REUSEPORT` and there also lets the socket bind over one that did not set it; Linux spreads unicast datagrams across the sockets, where FreeBSD gives each to one. Option 0x10000 is only kept: if the console treats it as FreeBSD 12's `SO_REUSEPORT_LB`, two sockets that set it share a port there, where the second `bind` here fails with `EADDRINUSE`. An accepted socket takes the bits from its listener, as FreeBSD 11.4's `sonewconn` copies `so_options`; that was not measured
+- [IP_ADD_MEMBERSHIP, IP_DROP_MEMBERSHIP, IP_MULTICAST_IF](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - set on the host socket after the checks a PS5 (firmware 13.60, payload process) showed: `EOPNOTSUPP` on a stream socket, `EINVAL` for a short value or a group outside 224.0.0.0/4, `EADDRINUSE` for a group joined twice and `EADDRNOTAVAIL` for one not joined, tracked per socket. An interface the host lacks fails with the host's error (`EADDRNOTAVAIL` on the console). A group joined through `INADDR_ANY` and through that interface's address counts as two here. Not measured, after FreeBSD 11.4: a drop through `INADDR_ANY` leaves the first such group on any interface (`inp_leave_group`), and the other multicast options fail with `EOPNOTSUPP` on a stream socket (`inp_setmoptions`). An `ip_mreqn` with a non-zero index or address throws, as only a zeroed one was measured, and so does reading `IP_MULTICAST_IF` into 12 bytes, where FreeBSD returns an `ip_mreqn`
+- [TCP_MAXSEG](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - a connected socket reads 536 (1220 for `AF_INET6`) until a segment is set, where a payload process on PS5 firmware 13.60 read the negotiated segment (16344 over loopback, lo0's MTU less 40) on both ends; the segment is not set on the host socket, and a listening socket was not measured. Otherwise it follows that console: a fresh socket reads 536, or 1220 for `AF_INET6`, and fails every set with `EINVAL` (175, 176, 200, 400, 536, 537, 1460 tried); a connected one fails a segment above the current one or below 176, and stores the rest raised to 216 (176 and 200 both read back 216), as FreeBSD 11.4's `tcp_default_ctloutput` with `V_tcp_minmss` does
+- [TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per stream socket and read back as a payload process on a PS5 (firmware 13.60) did: 7200, 75 and 8 at first, 0 restoring a keepalive default, and a count stored as an unsigned value. They are not set on the host socket, so the host's keepalive timers are its own while `SO_KEEPALIVE` is applied there. An interval above 4294967 seconds fails with `EINVAL`, after FreeBSD 11.4's `tcp_default_ctloutput` with `hz` taken as 1000, and an accepted socket takes the keepalive values from its listener as `syncache_socket` copies them; neither was measured
+- [IP_TTL, IP_TOS, IP_MULTICAST_TTL, IP_MULTICAST_LOOP](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per `AF_INET` socket with the defaults (64, 0, 1, 1), the low-byte storage of `IP_TTL` and `IP_TOS`, the one-byte forms and the `EINVAL` above 255 of the multicast options that a payload process on a PS5 (firmware 13.60) showed. `IP_TTL` and the multicast options are also set on the host socket, except a time to live of 0, which hosts refuse; `IP_TOS` is only kept, so the host's packets carry its own type of service, and the host's default time to live (128 on Windows) is not changed to 64. An accepted socket takes `IP_TTL` and `IP_TOS` from its listener, as FreeBSD's `syncache_socket` does, and an `int` `IP_MULTICAST_LOOP` keeps only its low byte, as FreeBSD 11.4's `inp_setmoptions` does; neither was measured. Winsock applies `IP_MULTICAST_LOOP` on the receiving socket, not the sender, so on Windows the receiver's setting decides loopback
+- [SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT, SO_RCVLOWAT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket with the defaults, the 524288-byte limit, the `ENOBUFS` above 5592405 bytes and the low-water clipping of a payload process on a PS5 (firmware 13.60); the host socket gets the size asked for, so a request above the limit still enlarges the host's buffer. The host's real buffering, FreeBSD's automatic growth of a connected TCP socket's buffers, and a low-water mark's effect on `select`, `poll` and a receive are not reproduced. An accepted socket takes all four from its listener, as FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) does; that was not measured
+- [SO_NOSIGPIPE](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket and read back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal, and an accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. Not measured on a console
+- [SO_SNDTIMEO, SO_RCVTIMEO](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the value checks and the 32.32 fixed-point read-back follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689), as a payload process on a PS5 (firmware 13.60) answered them. A receive or send on a blocking socket waits that long for the host to report the socket readable or writable and fails with `EWOULDBLOCK`, but only before the first transfer: once writable the host send has no limit, where FreeBSD returns the bytes sent so far, and a receive whose data another thread takes after the wait blocks again. `sendfile` ignores the send timeout, the host wait has millisecond steps, and an accepted socket takes both from its listener
+- [IPV6_V6ONLY](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the `IPPROTO_IPV6` option 27 is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL`, as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as a payload process on a PS5 (firmware 13.60) reported, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The value checks and the bound-socket answer were not measured
+- [connect to AF_UNSPEC](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux and on Windows a socket bound to an explicit port keeps its local address as well (`127.0.0.1:<port>` stays `127.0.0.1:<port>`), because a bound socket cannot be bound again, and `getsockname` reports that host address. On Windows a `sendto` to a non-loopback address from such a socket then fails with `ENETUNREACH` (Winsock 10051, measured on Windows 10), where FreeBSD sends it from the wildcard address. One bound to port 0 is bound again to the wildcard address with the port it had
+- [connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - `connect` to port 0 on an `AF_INET` or `AF_INET6` stream or datagram socket fails with `EADDRNOTAVAIL` (49), and on a connected datagram socket it disconnects first, as on a PS5 (firmware 13.60) and in FreeBSD 11.4's `soconnect()`. A connected stream socket keeps its host `EISCONN` answer. Known gap: `sendto` and `sendmsg` to port 0 on an `AF_INET` datagram socket fail with 49 (measured for an unbound socket) unless the socket is bound to a specific address and port and the destination is neither `INADDR_ANY` nor `INADDR_BROADCAST`, which is the path where `udp_output()` skips `in_pcbconnect_setup()` and FreeBSD sends to port 0. There the call returns the length without the host, as Linux's `udp_sendmsg` refuses port 0 with `EINVAL`; an `AF_INET6` socket still goes to the host. [sceNetConnect](../../../core/libs/prx/libSceNet/Export.cpp) is not changed
+- [msync](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `kern_msync` and `vm_map_sync`: the address is rounded down to the page, a range that wraps is `EINVAL`, as is `MS_ASYNC` with `MS_INVALIDATE`, and a range whose start or any page is not mapped (as `sceKernelVirtualQuery` reports it, reservations included) is `ENOMEM`; a page unmapped from inside a larger mapping still counts as mapped there, since `sceKernelVirtualQuery` keeps reporting the whole mapping. The guest has no file mappings, so a successful call writes nothing back. `MS_INVALIDATE` on a mapped range fails with `EBUSY`, as it did in a payload process on a PS5 (firmware 13.60) for anonymous memory, locked or not, also with a hole unmapped inside it; a title process, reservations, direct memory and flexible memory were not measured
 - [madvise](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) accepts `MADV_PROTECT` (10) as a no-op hint without modifying process protection. FreeBSD 11's `kern_madvise` (`sys/vm/vm_mmap.c`) handles it before the address check, ignores the address and length, and calls `kern_procctl(..., PROC_SPROTECT, PPROT_SET)`, which requires `PRIV_VM_MADV_PROTECT` and fails with `EPERM` without it. Returning 0 unconditionally assumes the calling process is privileged. Console behaviour is unverified
 - [mincore](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `sys_mincore` (`sys/vm/vm_mmap.c`), not measured on the console: the address is rounded down to the page, length 0 returns 0, a null vector over a mapped range returns `EFAULT`, an overflowing range or any unmapped page in the range (as reported by `sceKernelVirtualQuery`) returns `ENOMEM`. For valid ranges, a page reports `MINCORE_INCORE` (0x1) when `sceKernelVirtualQuery` reports it committed and 0 when it is only reserved; actual residency, referenced and modified bits are not modelled. Length 0 returns 0 when the start page is mapped and `ENOMEM` otherwise, and the range and mapping checks come before the null vector `EFAULT`, as in `kern_mincore` Java 25 LAN / DNS (PPSA99869) imports it
-- [mlockall, munlockall](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `mlockall` returns `EINVAL` for zero or unknown flags. Valid `MCL_CURRENT` throws because it would lock host stacks, heaps, modules and driver mappings along with guest memory; `MCL_FUTURE` throws because later mappings are not tracked for locking. FreeBSD 11.4's `sys_munlockall` (`sys/vm/vm_mmap.c`:1133-1165) checks `priv_check(td, PRIV_VM_MUNLOCK)` first (returning `EPERM` without it) and unwires the user map (`vm_map_unwire` over `vm_map_min`...`vm_map_max` with `VM_MAP_WIRE_HOLESOK`). Returning 0 unconditionally assumes the calling process is privileged. `munlockall` unlocks memory locked by `mlock` (`VirtualUnlock` on Windows, tolerating `ERROR_NOT_LOCKED` for pages never locked, and `munlockall` on Linux). On main, XPSemu (PPSA97358) fails to load at these imports (mlockall #4386, munlockall); their calls in QEMU `os-posix.c` execute only when `-overcommit mem-lock=on` is enabled. The call has not been observed in a run with this implementation.
-- [socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) creates only `SOCK_STREAM` and `SOCK_DGRAM` sockets in `AF_INET` and `AF_INET6`. A type that FreeBSD 11.4's inet domain has no protocol for in any configuration ([`in_proto.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/netinet/in_proto.c) has no `SOCK_RDM` entry and no unknown type) fails with `EPROTOTYPE` when the protocol is 0 and `EPROTONOSUPPORT` otherwise, as [`socreate`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c) does. `SOCK_RAW`, which `in_proto.c` always has (`socreate` creates it for a privileged process), and `SOCK_SEQPACKET`, which it has only in a kernel built with `SCTP`, fail with `EPROTONOSUPPORT`; whether the console allows either is not known. `SOCK_DGRAM` with `IPPROTO_UDPLITE` and `AF_UNIX` (`socketpair` supports it) fail with `EPROTONOSUPPORT` and `EAFNOSUPPORT` where FreeBSD creates the socket
+- [mlockall, munlockall](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `mlockall` returns `EINVAL` for zero or unknown flags. Valid `MCL_CURRENT` throws because it would lock host stacks, heaps, modules and driver mappings along with guest memory; `MCL_FUTURE` throws because later mappings are not tracked for locking. FreeBSD 11.4's `sys_munlockall` (`sys/vm/vm_mmap.c`:1133-1165) checks `priv_check(td, PRIV_VM_MUNLOCK)` first (returning `EPERM` without it) and unwires the user map (`vm_map_unwire` over `vm_map_min`...`vm_map_max` with `VM_MAP_WIRE_HOLESOK`). Returning 0 unconditionally assumes the calling process is privileged. `munlockall` unlocks memory locked by `mlock` (`VirtualUnlock` on Windows, tolerating `ERROR_NOT_LOCKED` for pages never locked, and `munlockall` on Linux). XPSemu (PPSA97358) imports `mlockall` and `munlockall`; their calls in QEMU `os-posix.c` execute only when `-overcommit mem-lock=on` is enabled. The call has not been observed in a run with this implementation.
+- [socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) creates only `SOCK_STREAM` and `SOCK_DGRAM` sockets in `AF_INET` and `AF_INET6`. In a payload process on a PS5 (firmware 13.60) `SOCK_RDM`, `SOCK_SEQPACKET` and an unknown type failed with `EPROTOTYPE` when the protocol was 0 and `EPROTONOSUPPORT` otherwise, as here, and a family other than `AF_INET`, `AF_INET6` and `AF_UNIX` with `EAFNOSUPPORT`. The console also created `SOCK_RAW` (for that payload process, which may hold privileges a title does not), `SOCK_DGRAM` with `IPPROTO_UDPLITE`, and `AF_UNIX` stream, datagram and seqpacket sockets; these fail here with `EPROTONOSUPPORT` and `EAFNOSUPPORT` (`socketpair` supports `AF_UNIX`)
 - [sigtimedwait](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) waits on a process-wide pending set instead of throwing: a signal raised while blocked stays pending and is taken by `sigwait`, `sigwaitinfo` or `sigtimedwait`, delivered to the handler when `_sigprocmask` unblocks it, or delivered by `pause`. The set covers all 128 signals and the lowest number that is pending and in the set is selected (FreeBSD specifies the lowest number only among real-time signals). Selection, `EAGAIN` on timeout, `EINVAL` for a `tv_nsec` outside 0 to 1000000000 while nothing is pending and `NULL` timeout blocking indefinitely follow FreeBSD's [sigtimedwait(2)](https://man.freebsd.org/cgi/man.cgi?query=sigtimedwait). `sigwait` returns 0 with the number in its output, as POSIX specifies, and `sigwaitinfo` and `sigtimedwait` return the number, as FreeBSD does. The guest `siginfo_t` follows FreeBSD 11's `sys/sys/siginfo.h`: 80 bytes, `si_signo` at 0, `si_code` at 8, `si_pid` at 12, `si_uid` at 16, `si_addr` at 24, `si_value` at 32 and `si_band` at 40; only `si_signo`, `si_code` (`SI_USER`) and `si_pid` (the guest pid) are written, `si_uid` stays 0 because no uid is modelled, and the console's layout is not verified. PPSA85300 imports `sigtimedwait` and fails to load without it; its only call site is VLC's `vlc_writev` ([filesystem.c](https://github.com/videolan/vlc/blob/6de05adcbaf2e8b85fe86aad4169393098628119/src/posix/filesystem.c#L243-L278)), which polls with a zero timeout to drain a `SIGPIPE` only after `writev` fails with `EPIPE`. The waits are not cancellation points and an unblocked caught signal does not interrupt them with `EINTR`, where FreeBSD's `sigwaitinfo` and `sigtimedwait` may return it. `SIGPIPE` has no host equivalent and is never raised by a host write here (see `read, write and vector I/O`), so VLC's drain finds nothing
 - [pause, sigsuspend, sigwait, sigwaitinfo](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) take the pending set of `sigtimedwait` instead of throwing. `pause` waits for a pending signal that is not blocked and whose disposition can be delivered, runs its handler on the calling thread and returns -1 with `EINTR`; an ignored signal is discarded and the wait continues, and it never returns for a signal whose handler cannot run. A signal whose registered handler has `SA_SIGINFO` still throws, and one whose disposition is the default action and that has no host equivalent (every signal except 2, 4, 6, 8, 11 and 15) is neither delivered nor discarded: it stays pending until a wait takes it, where FreeBSD runs the default action, which terminates the process for most of them. A pending `SIGALRM` with the default disposition exits the process with status 142 once it is unblocked, as FreeBSD's default action does. PPSA68091, PPSA99169, PPSA99420 and PPSA97358 import them and fail to load without them. PPSA68091 calls `pause` at one site (0x8F7266), in a loop that waits while a global holds another thread's `errno` address. PPSA99169 only stores the address of `pause` in a table of symbol addresses (0x30DB1). PPSA99420 calls `pause` at 0x3BD80F6 and 0x3C9E220, `sigwait` at 0x3C9E4C7 and `sigwaitinfo` at 0x3C9E588. PPSA97358 calls `sigwait` from QEMU's `sigwait_compat` thread ([compatfd.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/util/compatfd.c#L28-L53)), which `qemu_signal_init` ([main-loop.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/util/main-loop.c#L110-L147)) starts for `SIGIO`, `SIGALRM` and `SIGBUS` when the main loop is created, so it reaches the wait at start-up, and from the vCPU thread of the dummy accelerator ([dummy-cpus.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/accel/dummy-cpus.c#L48-L56)). `sigsuspend` swaps the process-wide mask of `_sigprocmask` for its argument, waits as `pause` does through the same helper, then restores the mask through `_sigprocmask`, and returns -1 with `EINTR`; a null set throws, as the console faults in libthr instead of returning `EFAULT`. All four words of the argument replace the mask and are restored afterwards, as in `_sigprocmask`. Java 25 LAN / DNS (PPSA99869, #5501) imports it and fails to load without it, after `sysctlnametomib`, `fegetenv` and `mincore`. None of the five waits is a cancellation point
-- [getsid](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) returns the calling process ID for pid 0 and the calling process, and `ESRCH` for other process IDs, assuming the single guest process is its own session leader. PPSA74126 imports it and fails to load without it
-- [sigaction](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records the handler, flags and mask of every signal from 1 to 128 and reports them back, following FreeBSD's `sigaction` (`EINVAL` for other signals, and for a handler on `SIGKILL` or `SIGSTOP`); `signal` records its handler with `SA_RESTART`, as FreeBSD's libc does. Only handlers without `SA_SIGINFO` on the signals `signal` already delivers (`SIGINT`, `SIGILL`, `SIGABRT`, `SIGFPE`, `SIGSEGV`, `SIGTERM`) run, the same way `signal` handlers do; their mask and flags are not applied. `SA_SIGINFO` handlers are recorded but never called, since that needs FreeBSD's `siginfo_t` and `ucontext_t`, and neither are the handlers of other signals (`SIGBUS`, `SIGHUP`, ...), whether they are set by `sigaction` or by `signal`, which records them too (every number from 1 to 128, with `SA_RESTART` and an empty mask replacing what `sigaction` stored; `SIGKILL` and `SIGSTOP` accept only the default handler in both calls, as in FreeBSD's `kern_sigaction`). `raise` and `kill` accept every number from 1 to 128 now: a blocked one stays pending on the set of `sigtimedwait`, an unblocked one whose handler is registered runs it on the calling thread, and an unblocked one that has no host equivalent and no handler still fails with `EINVAL`, where FreeBSD runs its default action. `raise` of an `SA_SIGINFO` handler still throws instead of terminating
-- [signal](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records its handler with `SA_RESTART` unless the signal is in the exported `_sigintr` set, as FreeBSD's libc does (`lib/libc/gen/signal.c`). `siginterrupt`, which fills that set, is a libSceLibcInternal export and is not provided: libc does not link libkernel and cannot reach the dispositions, so only a guest that writes the set itself clears `SA_RESTART` this way.
+- [getsid, setpgid, setpgrp](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - getsid returns the calling process ID for pid 0 and the calling process, and `ESRCH` for other process IDs, assuming the single guest process is its own session leader. setpgid and setpgrp follow FreeBSD 11.4's `sys_setpgid` for the only guest process: a negative group ID fails with `EINVAL`, a process ID other than 0 or the caller's PID (including a negative PID) fails with `ESRCH`, and because the single guest process is modeled as its own session leader, `SESS_LEADER(targp)` fails with `EPERM` before normalizing the process group or reaching the same-process-group no-op. PPSA74126 imports `getsid` and fails to load without it
+- [sigaction](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records the handler, flags and mask of every signal from 1 to 128 and reports them back, following FreeBSD's `sigaction` (`EINVAL` for other signals, and for a handler on `SIGKILL` or `SIGSTOP`); `signal` records its handler with `SA_RESTART`, as FreeBSD's libc does. Only handlers without `SA_SIGINFO` on the signals `signal` already delivers (`SIGINT`, `SIGILL`, `SIGABRT`, `SIGFPE`, `SIGSEGV`, `SIGTERM`) run, the same way `signal` handlers do. While a handler runs, its own signal (unless `SA_NODEFER`) and the signals of its mask other than `SIGKILL` and `SIGSTOP` are blocked, and `SA_RESETHAND` resets the disposition to the default before it runs, as FreeBSD's `postsig_done` does. Those blocks are held apart from the process-wide mask that `sigprocmask` sets, which reports them, and are released when the handler returns, so a block another thread adds meanwhile is kept, for the same signal too, and so is one the handler adds itself, which FreeBSD's `sigreturn` would undo. `SIG_UNBLOCK` of a held signal releases its hold and `SIG_SETMASK` releases them all. When the handler's own thread released one, that signal gets back its bit of the process mask from before the handler when the handler returns, as FreeBSD's `sigreturn` puts back the mask from before it, so a handler that saves and restores the mask with `SIG_SETMASK`, or calls `pselect`, leaves its signal unblocked. A `sigsuspend` inside a handler keeps the holds, where FreeBSD replaces the whole thread mask. A handler left with `longjmp`, or with `siglongjmp` to a buffer that saved the mask, gets back the mask that buffer saved, as on FreeBSD; a signal raised meanwhile stays pending and is delivered when the handler returns to `raise`, but one left pending by a handler that a host signal ran asynchronously waits for the next `raise` or `_sigprocmask`. `SA_ONSTACK` is not applied. `SA_SIGINFO` handlers are recorded but never called, since that needs FreeBSD's `siginfo_t` and `ucontext_t`, and neither are the handlers of other signals (`SIGBUS`, `SIGHUP`, ...), whether they are set by `sigaction` or by `signal`, which records them too (every number from 1 to 128, with `SA_RESTART` and an empty mask replacing what `sigaction` stored; `SIGKILL` and `SIGSTOP` accept only the default handler in both calls, as in FreeBSD's `kern_sigaction`). `raise` and `kill` accept every number from 1 to 128 now: a blocked one stays pending on the set of `sigtimedwait`, an unblocked one whose handler is registered runs it on the calling thread, and an unblocked one that has no host equivalent and no handler still fails with `EINVAL`, where FreeBSD runs its default action. `raise` of an `SA_SIGINFO` handler still throws instead of terminating
+- [signal](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records its handler with `SA_RESTART` unless the signal is in the exported `_sigintr` set, as FreeBSD's libc does (`lib/libc/gen/signal.c`). `siginterrupt`, which fills that set, is a libSceLibcInternal export that libc serves through the `sigaction` and the set libkernel registers at load (see libc).
 - [kill, killpg](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) follow FreeBSD's `kern_kill` and `killpg1` for the only guest process: `EINVAL` for signals outside 0 to 128 and for negative `killpg` process groups, signal 0 only checks that the target exists, and its own pid, 0 and minus its own pid (the guest is taken to lead its own process group) signal it through `raise`, so they share `raise`'s limits above. Any other pid, and -1, which skips the caller, report `ESRCH`, so `EPERM` is never reported
 - [sceKernelFcntl](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) runs the POSIX `fcntl` below and returns its guest errno as `SCE_KERNEL_ERROR_*`, the form the other `sceKernel` file exports use. The return values and error codes are unverified on a console
-- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_GETFL` takes the access mode from the host (the granted access of the handle on Windows), so pipe ends report `O_RDONLY` and `O_WRONLY` where FreeBSD's bidirectional pipes report `O_RDWR`. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. Changing `O_APPEND` on a Windows file, changing `O_FSYNC` on a file, `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console
+- [Creating through a trailing slash](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) - `open` and `sceKernelOpen` with `O_CREAT` on a missing name followed by a slash (`new/`) fail with `EINVAL` on Windows and with the host's `EISDIR` on Linux, where FreeBSD 11.4's `lookup()` (sys/kern/vfs_lookup.c) fails with `ENOENT` because only a directory may be created through a trailing slash
+- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_FSYNC` set by `open` or `F_SETFL` makes each `write`, `pwrite`, `writev` and `pwritev` on a file sync it before returning, as `vn_write` adds `IO_SYNC`; the `sceKernelAioSubmitWriteCommands` writes are not synced, as whether the console's AIO honours the flag is unknown; on Linux a file opened with it keeps the host `O_SYNC` after `F_SETFL` clears it. `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console
 - [fcntl on a guest socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answers `F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFD`, `F_SETFD`, `F_GETFL` and `F_SETFL` and fails every other command with `EINVAL`; FreeBSD 11.4's `kern_fcntl` also handles `F_GETOWN` and `F_SETOWN` on a socket. `FD_CLOEXEC` is only recorded (there is no `exec`): `dup`, `dup2`, `F_DUPFD`, `F_DUP2FD` onto another descriptor and an accepted socket start without it, `F_DUP2FD` onto the same descriptor keeps it, and `SOCK_CLOEXEC`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC` and `F_SETFD` set it. None of this was measured on a console.
 - [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) handle only `FIONBIO` and `FIONREAD` on a socket, and any other request there fails with `ENOTTY`. On the other descriptors they follow FreeBSD's [`kern_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L758), [`vn_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_vnops.c#L1488) and [`pipe_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_pipe.c#L1346): `FIONBIO` sets `O_NONBLOCK` as `fcntl` does, `FIOCLEX` and `FIONCLEX` set and clear the close-on-exec flag `F_GETFD` reports, and `FIONREAD` reports the size past the offset of a file, the queued bytes of a pipe's read end, 0 on its write end and `ENOTTY` on the random device, while it throws on a directory or another character device. Every termios request (group `t`, `TIOCGWINSZ` included) fails with `ENOTTY`, since those descriptors are taken as not a terminal, as in `tcgetattr`, and any other well-formed request throws. An input request with length 0 is not rejected as malformed: [`sys_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L703-L718) rejects it only in a kernel built without `COMPAT_FREEBSD4`, `COMPAT_FREEBSD5` and `COMPAT_43`, and which of these the PS5 kernel has is unknown. Stremio Plus (PPSA74126) imports `_ioctl` for its statically linked `tc*` functions, which send `TIOCGETA`, `TIOCSETA`, `TIOCSPGRP` and the other termios requests
 - [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) do not pass a `sceNetSocket` socket to libSceNet as `fcntl` does. On Linux its number duplicates the host socket, so `FIONBIO` switches the host `O_NONBLOCK` but not the library's `SO_NBIO` state; on Windows it is a `NUL` placeholder, so `FIONREAD` and enabling `FIONBIO` throw as on a character device. `sceNetIoctl` handles both requests on such a socket.
 - [_accept, _bind, _connect, _getpeername, _getsockname, _getsockopt, _listen, _recvfrom, _recvmsg, _sendmsg, _sendto, _setsockopt](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp), [_getdirentries](../../../core/libs/prx/libkernel/File/src/Stdio.cpp), [_sigaction, _sigsuspend](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) are not measured on the console. They forward to the calls without the underscore, which have no libthr layer here, as FreeBSD 11.4 makes the underscore names the plain system calls. `_sigaction` and `sigaction` share one handler table, where FreeBSD's `__thr_sigaction` hands its own wrapper to the system call `_sigaction` reads back, and rejects `SIGCANCEL` (32). A null set throws in `_sigsuspend` as in `sigsuspend`, while the system call FreeBSD 11.4 exports as `_sigsuspend` ([`Symbol.map`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/sys/Symbol.map#L961)) returns `EFAULT`
 - [Regular file mappings](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - on Linux `mmap` maps a regular file's descriptor shared or private like a shared memory object, with the same access checks; SQLite's WAL index (`-shm`) in Dusklight PPSA99305 needs it. FreeBSD 11 `mmap(2)` and shadPS4's `MemoryManager::MapFile` map regular files; the console's behaviour is not measured. Other descriptors (pipes, sockets, directories, devices) still fail with `EOPNOTSUPP`. On Windows a shared mapping is a view of a file section (`CreateFileMappingW` on the descriptor's handle, read-write when the descriptor is, otherwise read-only), so writes through the descriptor and the mapping see each other. This also maps anonymous `shm_open` objects and JIT shared memory descriptors, which are temporary files on Windows. A shared mapping may end inside the 16 KiB page that holds the end of the file, as POSIX [`mmap`](https://pubs.opengroup.org/onlinepubs/9799919799/functions/mmap.html) allows (llama.cpp in PS5LM Plus PPSA99581 maps a whole model file this way): the section keeps the file's size, so the file never grows, the view ends with the 4 KiB host page that holds the end of the file, which Windows fills with zeros past it, and the rest of the guest page is private zero pages. As POSIX requires, the bytes past the end read zero and are never written to the file; bytes written to those private pages are seen only through that mapping, not through other mappings of the file, and a file that grows later does not show its new bytes there. A shared mapping that reaches a whole page past the end of the file fails with `EOPNOTSUPP`, where POSIX maps it and delivers `SIGBUS` on access, as do `PROT_EXEC` and a write-only descriptor. A read-write alias (`GuestArenaMapAlias`) of a mapped page that holds the end of the file throws. `mprotect` above the view's protection (writing through a read-only descriptor, or adding `PROT_EXEC`) fails with `EACCES` before anything changes; FreeBSD allows `PROT_EXEC` on a readable descriptor. Shrinking the file with `ftruncate` fails with `EINVAL` while any shared mapping of it exists, even one that does not cover the removed part, because the section keeps the file's size at `mmap`; FreeBSD truncates. A read-write alias of a view (`GuestArenaMapAlias`, used when the GPU imports guest memory) of a read-only file section fails, as the alias is mapped `PAGE_READWRITE`. Views of the same file made by separate `mmap` calls are separate sections, so write tracking does not treat them as aliases of each other. A private mapping on Windows is a copy of the file read at `mmap`, which POSIX allows (later changes to the file need not show); pages wholly past the end of the file fail with `EOPNOTSUPP` instead of faulting on access, and a write-only descriptor fails with `EOPNOTSUPP`.
 - [File mappings on macOS](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `mmap` of a regular file, of an anonymous `shm_open` object (an unlinked temporary file on macOS) or of a JIT shared memory descriptor maps the descriptor shared or private as on Linux, with the same access checks. macOS refuses to create an executable file mapping (`EPERM`), so an executable mapping is made without execute and then given it with `mprotect`. Under Rosetta 2 (Apple M2, macOS 26), code rewritten through one view of a file after it ran from another view keeps its old translation until the executable view's protection changes. Named `shm_open` objects still throw on macOS.
-- [sendfile](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) follows FreeBSD 11's `sendfile` for a connected stream socket: headers, the file from `offset` (to its end when `nbytes` is 0) and trailers, the file offset left unchanged, `EAGAIN` with `*sbytes` set after a partial send on a non-blocking socket. It reads the file through `sceKernelPread` in 64 KiB blocks and sends each with `send`. A socket as the file fails with `EINVAL`, as on FreeBSD, but any other descriptor `sceKernelPread` reads, such as `/dev/urandom`, is sent where FreeBSD requires a regular file or shared memory. `flags` are ignored: reads complete before sending, so `SF_NODISKIO` never fails with `EBUSY`, and `SF_SYNC` returns once the data is queued on the socket rather than sent. PS5MC (PPSA99420) imports it
+- [sendfile](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) follows FreeBSD 11's `sendfile` for a connected stream socket: headers, the file from `offset` (to its end when `nbytes` is 0) and trailers, the file offset left unchanged, `EAGAIN` with `*sbytes` set after a partial send on a non-blocking socket. It reads the file through `sceKernelPread` in 64 KiB blocks and sends each with `send`. A file that is not a regular file or shared memory, such as a socket, `/dev/urandom` or a kqueue, fails with `EINVAL` and `*sbytes` 0, as FreeBSD's [`sendfile_getobj`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_sendfile.c#L421-L463) refuses it. `flags` are ignored: reads complete before sending, so `SF_NODISKIO` never fails with `EBUSY`, and `SF_SYNC` returns once the data is queued on the socket rather than sent. PS5MC (PPSA99420) imports it
 - [pthread_kill](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) returns the error number like FreeBSD's `pthread_kill`: `EINVAL` for signals outside 0 to 128 and `ESRCH` for a null thread. A signal to the calling thread goes through `raise`, so it shares `raise`'s limits; a signal to another thread is left on the pending set for whichever thread waits for or unblocks it, since it is not delivered to the chosen thread, and a handle that is not a live guest thread returns `ESRCH` without touching it
 - [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) validates `tv_usec` but saturates a valid timeout beyond the remaining `steady_clock` range at `time_point::max()`, so the wait can continue effectively indefinitely. The console's behavior for a valid timeout outside the host clock's range is unknown.
 - [inet_ntop, inet_pton](../../../core/libs/prx/libkernel/Socket/src/AddressConversion.cpp) (libkernel) - an `AF_INET6` result of `inet_ntop` is followed by zero bytes up to `size`. In a payload process on a PS5 (firmware 12.70), the text forms, the order of the checks and this padding were measured through both exports. The padding was sampled at sizes from 3 to 65536, above 64 only at 65, 128, 256, 1024, 4096 and 65536; the sizes that were not sampled, sizes above 65536 and a title process are assumed to behave the same
@@ -240,20 +282,24 @@
 - [pthread_spin_lock](../../../core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp) (libkernel) - a lock taken again by the thread that holds it throws here. On a PS5 (firmware 12.70) that call had not returned after 2 s, as FreeBSD 11.4 libthr [`thr_pspinlock.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_pspinlock.c) spins forever
 - [pthread_mutex_getspinloops_np, pthread_mutex_setspinloops_np, pthread_mutex_getyieldloops_np, pthread_mutex_setyieldloops_np and their scePthreadMutex counterparts](../../../core/libs/prx/libkernel/Pthread/src/Mutex.cpp) (libkernel) store and report the counts, but host mutexes do not spin or yield by them. The defaults follow FreeBSD 11.4's [`mutex_init_body`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutex.c#L236-L272) without `LIBPTHREAD_SPINLOOPS` and `LIBPTHREAD_YIELDLOOPS`: 2000 spins for an adaptive mutex, 0 otherwise; the console's defaults are unverified. Setting the yield count of a destroyed mutex returns 0 as FreeBSD's [`__pthread_mutex_setyieldloops_np`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutex.c#L1125-L1135) does; the console's result is unverified
 - [pthread_rwlockattr_getpshared, pthread_rwlockattr_setpshared](../../../core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp) (libkernel) - `pthread_rwlockattr_destroy` clears the attribute here, so a later get, or a set of 0, throws. On a PS5 (firmware 12.70) destroy leaves the attribute set; a get afterwards returned 0 with a stale value and a set of 0 returned 0
+- [pthread_mutexattr_setkind_np](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) throws for a kind outside 1 to 4. FreeBSD 11.4's [`_pthread_mutexattr_setkind_np`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutexattr.c#L108-L120) stores any kind and [`mutex_check_attr`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutex.c#L207-L218) then makes `pthread_mutex_init` fail with `EINVAL`, but `pthread_mutex_init` here does not check the type
+- [pthread_cond_signalto_np, scePthreadCondSignalto](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) wake every waiter of the condition variable, not only the given thread, and do not check the thread; the other waiters see a spurious wakeup. Which waiters the console wakes, and its result for a thread that is not waiting, are unverified
+- [pthread_rwlockattr_gettype_np, scePthreadRwlockattrGettype](../../../core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp) (libkernel) report the type stored by `scePthreadRwlockattrSettype`, which accepts any value and which read-write locks do not apply; the console's valid types and their effect are unverified. A null or uninitialized attribute throws, as for `pthread_rwlockattr_getpshared`
 - [sceKernelGetEventError](../../../core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp) (libkernel) throws for `fflags` above 0xFFFF, where OR and addition of 0x80020000 differ and the console was not measured. Otherwise it returns 0 for `fflags` 0 and `0x80020000 | fflags`, whatever `flags` and `data` hold, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_queue.pas#L643) does and a PS5 (firmware 13.40, measured 2026-10-19 in a payload process) answered: `{flags 0x4000, fflags 0, data 22}`, `{0x4000, 0, -1}`, `{0x4000, 0, 0x80020016}` and `{0, 0, 0}` gave 0, `{0x4000, 5, 0}` and `{0x4000, 5, 22}` 0x80020005, `{0, 7, 22}` 0x80020007, `{0x8000, 3, 9}` 0x80020003. Video-out events carry their count in `fflags`, so they get 0x80020001 and up; only events built by the caller were measured. Closes when: `fflags` above 0xFFFF is measured
 - [pthread_cond_reltimedwait_np](../../../core/libs/prx/libkernel/Pthread/Posix/Cond.cpp) (libkernel) takes `(cond, mutex, usec)`, a relative timeout in microseconds, and is `scePthreadCondTimedwait` with POSIX error numbers. FreeBSD 11.4 has no such function; the signature comes only from shadPS4, which registers one function for this NID and for `scePthreadCondTimedwait` ([`condvar.cpp`](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/libraries/kernel/threads/condvar.cpp#L229-L234)). shadPS4 reads a 64-bit count; here it is the 32-bit `SceKernelUseconds` of the SCE twin, as for `sem_reltimedwait_np`. Unverified on the console
 - [pthread_mutex_reltimedlock_np](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) takes `(mutex, usec)`, a relative timeout in microseconds, and is `scePthreadMutexTimedlock` with POSIX error numbers. FreeBSD 11.4 has no such function; the signature comes only from shadPS4, which registers one function for this NID and for `scePthreadMutexTimedlock` ([`mutex.cpp`](https://github.com/shadps4-emu/shadPS4/blob/7c960eae136b956cf4c1d72aacd2426b650330df/src/core/libraries/kernel/threads/mutex.cpp#L284-L287)). shadPS4 reads a 64-bit count; here it is the 32-bit `SceKernelUseconds` of the SCE twin, as for `pthread_cond_reltimedwait_np`, so a count of 2^32 microseconds or more would be truncated if the console reads 64 bits. Unverified on the console
 - [sysctl kern.arandom](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) serves FreeBSD 11's MIB {1, 37} (CTL_KERN, KERN_ARANDOM) and the "kern.arandom" sysctlbyname lookup through std::random_device, returning min(*oldLength, 256) random bytes. Following FreeBSD's sysctl_kern_arnd, a null buffer reports min(*oldLength, 256) without writing, a null length returns 0 without writing, and requests with a new value return EPERM (1) as the node is read-only. Cryptographic quality depends on the host's random device implementation.
-- [pthread_atfork](../../../core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp) (libkernel) appends the three handlers to a process-wide list and returns 0, or `ENOMEM` when the entry cannot be allocated, as FreeBSD 11.4's [`_pthread_atfork`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_fork.c#L78-L100) does; null handlers are accepted. The handlers never run: `fork` throws and `vfork` is absent, so no child process is created. Handlers of a module that is unloaded stay in the list, where FreeBSD's `__pthread_cxa_finalize` removes them. PPSA97358 has a source-level call from the constructor `rcu_init` ([rcu.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/util/rcu.c#L488-L495)), but current-main runtime reachability is unverified; XPSemu currently stops first at the unresolved `mlockall` import (#4386)
+- [pthread_atfork](../../../core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp) (libkernel) appends the three handlers to a process-wide list and returns 0, or `ENOMEM` when the entry cannot be allocated, as FreeBSD 11.4's [`_pthread_atfork`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_fork.c#L78-L100) does; null handlers are accepted. The handlers never run: `fork` throws and `vfork` is absent, so no child process is created. Handlers of a module that is unloaded stay in the list, where FreeBSD's `__pthread_cxa_finalize` removes them. PPSA97358 has a source-level call from the constructor `rcu_init` ([rcu.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/util/rcu.c#L488-L495)), but current-main runtime reachability is unverified
 - [sceKernelGetPageTableStats](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) reports 8192 entries on each side and counts them as a PS5 (firmware 13.60) counted them for a payload process: one cpu entry for each 2 MiB granule that holds a committed mapping, whatever its protection (none included), and one gpu entry for each 1 GiB region that holds a GPU-accessible mapping, plus one for each 2 MiB granule of such a mapping that is not a whole granule of direct memory at a 2 MiB-aligned physical address. A granule or region shared by several mappings counts once, and reservations do not count. On the console the first GPU mapping of a process also takes three gpu entries and one cpu entry that stay after it is unmapped, which is not modelled, and only the ranges whose protection is recorded here are counted. A null pointer returns `SCE_KERNEL_ERROR_EFAULT`, where the console faults. Resonance: A Plague Tale Legacy (PPSA30601) calls it at start-up (#4067)
+- [settimeofday](../../../core/libs/prx/libkernel/Time/Time.cpp) (libkernel_sys) checks like FreeBSD 11.4's [`kern_settimeofday`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_time.c#L688-L707) for a root caller: `EINVAL` for a negative second count or a microsecond count outside 0 to 999999, before anything is stored. A valid time throws, naming it, since the host clock is never set, and its time zone is not stored, as FreeBSD stores the zone only after setting the clock. A time zone without a time is kept for the process and reported by `gettimeofday`; `sceKernelGettimezone` still reports 0 and 0, since whether the console reads the same value is not known. FreeBSD checks `PRIV_SETTIMEOFDAY` first, which a jailed process fails with `EPERM`; whether a title holds it on the console is not known.
 - [clock_settime](../../../core/libs/prx/libkernel/Time/Time.cpp) (libkernel) validates like FreeBSD 11.4's [`kern_clock_settime`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_time.c#L396-L412) for a root caller: `EFAULT` for a null time, `EINVAL` for any clock but `CLOCK_REALTIME`, a negative second count or a nanosecond count outside 0 to 999999999. A valid `CLOCK_REALTIME` request throws, naming the requested time, since the host clock is never set and no guest clock offset is kept. FreeBSD checks `PRIV_CLOCK_SETTIME` first, which a jailed process fails with `EPERM`; whether a title holds it on the console is unverified. PS5MC (PPSA99420) imports it; no call site is known
 - [Short sleeps ended by GPU and flip completions](../../../core/libs/prx/libkernel/Time/SleepWake.cpp) (libkernel) - a `sceKernelUsleep`, `usleep`, `nanosleep` or `sceKernelNanosleep` of 1 ms or less returns before the requested time, which FreeBSD and the console do not do: it ends once the AGC driver reports a completed GPU batch or batch completion action, or VideoOut completes a flip, so a title that polls a GPU label or the flip status between sleeps does not sleep the rest. A title that paces frames with such a sleep can wake up to 1 ms early. A thread returns early at most 8 times in a run of sleeps; the run restarts when the thread submits AGC work or did not sleep the requested time since its last sleep, so a loop that counts sleeps to time out still sleeps all but 8 in full. `APS5_NO_SLEEP_WAKE=1` keeps every sleep in full
 - [chflags](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) follows FreeBSD 11.4's [`kern_chflagsat`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L2366-L2383) and UFS's [`ufs_setattr`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/ufs/ufs/ufs_vnops.c#L509-L556) for a root caller: the path lookup reports `EFAULT`, `ENOENT` and `ENOTDIR`, a flag outside the 17 UFS stores (`VNOVAL` included) `EOPNOTSUPP`, and `SF_SNAPSHOT` `EPERM`. Neither host keeps BSD file flags, so every file is taken to have none (`stat` reports `st_flags` 0): flags 0 succeed without touching the file, and any other flag throws, naming the flags. `UF_READONLY`, `UF_HIDDEN`, `UF_SYSTEM` and `UF_ARCHIVE` are FreeBSD's names for the Windows attributes but are not mapped to them: UFS stores them without enforcing them, `FILE_ATTRIBUTE_READONLY` already carries the owner write bit of `chmod` on Windows, and Linux has no equivalent a process can set without `CAP_LINUX_IMMUTABLE`. The console's filesystem types, `EROFS` on read-only mounts and the change-time update are not modelled
 - [fchflags](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) has the gaps of `chflags`: a valid non-zero flag throws, and the console's filesystem types, `EROFS` and the change-time update are not modelled. Character devices, the random device, other host descriptors and files read from app0.zar throw, since their console filesystems and the privilege check for devices are not modelled. On Windows, anonymous shared memory objects are temporary files that are not told apart from regular files, so they are treated as files instead of reporting `EINVAL` as FreeBSD 11.4's [`getvnode`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L3850-L3877) does.
 - [getpriority](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) follows FreeBSD 11.4's [`sys_getpriority`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_resource.c#L93-L165) for the only guest process, which is taken to run at nice 0: `PRIO_PROCESS` and `PRIO_PGRP` with 0 or its own pid (the guest is taken to lead its own process group, see `kill`) and `PRIO_USER` with 0 or its user id 0 return 0, any other id fails with `ESRCH` and any other `which` with `EINVAL`. As in FreeBSD's libc, where `getpriority` is the bare system call, errno is left unchanged on success. The nice value of a title process on the console is unverified, and the host nice of the process or of the threads `APS5_THREAD_PRIORITY=high` raises is not reported. `setpriority` accepts the same target ids (any other id fails with `ESRCH`, any other `which` with `EINVAL`), clamps the value to FreeBSD's `PRIO_MIN`-`PRIO_MAX` (-20 to 20) and stores it as the guest process's nice value, which `getpriority` returns; the host scheduling class is not changed, and whether a title process may lower the value without privilege is unverified
-- [rtprio_thread, pthread_setconcurrency, pthread_getconcurrency](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - `rtprio_thread` follows FreeBSD 11.4's `rtprio_thread(2)`. Every guest thread here runs under `SCHED_FIFO` or `SCHED_RR` (priority 256-767), whose rtprio class is real-time; the console's mapping from that priority to the rtprio `prio` range (0-31) is unmeasured, so `RTP_LOOKUP` and `RTP_SET` throw for such a thread rather than report an impossible priority. A thread that is not real-time reports `RTP_PRIO_NORMAL` (3) with 0, and `RTP_SET` accepts only that value. Another function fails with `EINVAL`, a null `rtprio` with `EFAULT`, a thread other than the calling one throws, and an id that is not a live guest thread with `ESRCH`. `pthread_setconcurrency` stores 0 or more and returns `EINVAL` for a negative level (the error itself, as FreeBSD's libthr does, with errno untouched); `pthread_getconcurrency` returns the level, which is a hint and changes nothing about the host's concurrency. Morrowind (`mshivam019/morrowind-ps5`) imports all three at start-up
+- [rtprio_thread, pthread_setconcurrency, pthread_getconcurrency](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - `RTP_SET` throws for a real-time thread (sce attributes allow only `SCHED_FIFO`/`SCHED_RR`) and for another thread: a payload process on a PS5 (firmware 12.70) answered type 2, prio 0/15/31 on the calling thread with `EINVAL`; no accepted value or set by another thread's id measured. A non-real-time thread (POSIX attributes store `SCHED_OTHER`), unmeasured, reports 3 with 0, and `RTP_SET` accepts only that. `RTP_LOOKUP` reports the policy's type (10 or 2) and the scheduling priority, as measured, not FreeBSD's 0-31; another function fails with `ESRCH` (2 measured), a null `rtprio` with `EFAULT`, an id of no live thread with `ESRCH` (unknown ids measured). `pthread_setconcurrency` stores 0 or more, returns `EINVAL` (not errno) below 0, as libthr does; `pthread_getconcurrency` returns it, a hint. Morrowind (`mshivam019/morrowind-ps5`) imports them
 - [sceKernelVirtualQuery](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) returns [VirtualQueryInfo](../../../core/libs/SceTypes.hpp) with a one-byte flag allocation unit so Windows and SysV hosts return the same 72-byte representation, with the name at byte 33 and GPU mask at byte 65. This preserves the existing SysV representation; the console offsets beyond the address, protection and size fields observed in Astro Bot's AGC calls are not hardware-measured. Size and offset assertions plus a raw-byte named-mapping regression guard the host ABI.
-- [app0.zar files](../../../core/libs/prx/libkernel/File/src/ArchivedFile.cpp) (libkernel) - `sceKernelOpen`, `open`, `sceKernelStat` and `sceKernelCheckReachability` resolve a path missing from `app0/` in `app0.zar`. An archived file is a read-only host null device whose reads, positioned and vectored reads, AIO reads, seeks, `fstat` and `FIONREAD` are served from the archive, with the position shared by `dup`, `dup2` and `F_DUPFD`; writes fail with `EBADF` as on a read-only descriptor, opening one for writing or truncation fails with `EROFS` and `O_CREAT | O_EXCL` with `EEXIST`. `fstat` and `sceKernelStat` report mode `0444` (`0555` for a directory), the node index as inode and the archive file's device and times. Opening an archived directory or a directory present both on disk and in the archive throws, as `getdents` would miss entries. On an archived descriptor `mmap`, `flock`, record locks, `fstatfs`, `ftruncate`, `fsync`, `fdatasync`, `getdirentries`, `fchmod` and `futimes` throw instead of acting on the null device; `mmap` is `noexcept`, so its refusal terminates the process. `lstat` and the other path calls on archived files are not implemented
+- [app0.zar files and directories](../../../core/libs/prx/libkernel/File/src/ArchivedFile.cpp) (libkernel) - archive directory snapshots refresh on rewind; ordering and seek cookies are host packaging behavior, not console-measured behavior. Disk entries shadow archive names under the archive component comparison. Virtual directory descriptors reject data I/O, mapping, locks, filesystem queries and metadata mutation before touching their null-device backing; ordinary host directories retain native operations. Archived files remain read-only, with duplicate descriptors sharing their cursor. `lstat`, access and other ordinary path operations on archive-only entries remain unsupported. Validation uses synthetic archives on Windows and WSL, without PS5 or title runs.
 - [sceKernelLoadStartModule](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) loads a system library named by its console path, `/system/common/lib/<name>.sprx` or the sandboxed `/<sandbox word>/common/lib/<name>.sprx` that `sceKernelGetFsSandboxRandomWord` names, from the host `libs/<name>.prx`, as libSceSysmodule loads modules by ID; a host library has no `module_start`, so `res` is 0. Other system directories, such as `/system/priv/lib`, are not mapped. The OpenOrbis piglet sample loads `libScePigletv2VSH.sprx` and `libScePrecompiledShaders.sprx` this way
 - [param.sfo](../../../core/libs/prx/libkernel/AppMetadata/src/ParamSfoParser.cpp) (libkernel) is read when `param.json` is absent, for `TITLE`, `TITLE_ID`, `DOWNLOAD_DATA_SIZE` and `USER_DEFINED_PARAM_1` to `_4`, and mounts `/data` and `/download0` like `param.json`; the localized `TITLE_00` to `TITLE_30` are not selected by the console language.
 - [sysctl MIBs for kern.smp.maxcpus, kern.stackprot, kern.sched.name and kern.timecounter.hardware](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - on a PS5 (firmware 12.70), a payload process resolves these names to {1, 2147482816, 2147482814}, {1, 2147483151}, {1, 2147483182, 2147483181} and {1, 2147482838, 2147482834}; `sysctl` returns -1 with `ENOENT` for reads and size queries by those exact MIBs, leaving the buffer and length unchanged, including when either or both output pointers are null. Writes were not measured and throw. `sysctlnametomib` still throws for these four names; #7541 implements the mappings for nine of the other names.
diff --git a/docs/dev/debt/libkernel_sys.md b/docs/dev/debt/libkernel_sys.md
index 49e8539bbc..b2868bb494 100644
--- a/docs/dev/debt/libkernel_sys.md
+++ b/docs/dev/debt/libkernel_sys.md
@@ -12,22 +12,26 @@
 
 - [sched_rr_get_interval](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) accepts pid 0 or the host-backed guest pid and reports the FreeBSD 11 ULE default time slice for the usual AMD64 clock rates (94 ms); other pids return `ESRCH`, and a null interval returns `EFAULT`. AnyPS5 does not run a guest ULE scheduler or track a per-process configured quantum, so this reports the modeled default and does not reflect runtime scheduling. Console-specific clock rates and quantum configuration are unverified
 - [fchdir](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) changes the guest working directory to the descriptor's directory: on Windows through the path recorded when the descriptor was opened, on Linux through the `/proc/self/fd` link target. It returns `EBADF` for a descriptor that is not open, `EINVAL` for a pipe or socket, as FreeBSD `getvnode` does for a descriptor without a vnode, and `ENOTDIR` for any other descriptor that is not a directory. Outside Windows it checks search permission on the directory with `faccessat`, which fails with `EACCES` as FreeBSD `change_dir` does; on Windows that check is not modelled. A directory renamed after it was opened is still reached through the recorded path. Console behaviour is unverified
-- [openat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `open`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. As with `open`, `O_NOFOLLOW` and `O_NONBLOCK` are ignored. PPSA99003 opens directory entries this way. Console behaviour is unverified
+- [openat, _openat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) pass `AT_FDCWD` (-100) and absolute paths to `open`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. They return `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. As with `open`, `O_NONBLOCK` is ignored. PPSA99003 opens directory entries through `openat`. Console behaviour is unverified
 - [fchmodat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `chmod`; any other relative path is joined to the descriptor's host directory the same way as for `openat`, so guest path aliases and case-insensitive name matching do not apply to it and a `..` component is not kept inside the guest root. A flag other than `0` or `AT_SYMLINK_NOFOLLOW` (0x200) returns `EINVAL`; the mode is masked to `07777`. With `AT_SYMLINK_NOFOLLOW` a symbolic link returns success silently on Windows and Linux, since the host cannot change a link's own mode, while a regular file is changed either way. The mode maps to the host file mode, which on Windows is only the CRT's read-only bit. PPSA99621 calls it through `std::filesystem::permissions`. Console behaviour is unverified
 - [lchmod](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws for a symbolic link on Windows and Linux, whose hosts cannot change a link's own mode; on macOS the link's mode is changed. Anything else goes to `fchmodat(AT_FDCWD, path, mode, AT_SYMLINK_NOFOLLOW)`, as FreeBSD 11.4's [`sys_lchmod`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L2490-L2496) does, so a file or directory is changed as by `chmod`, with `fchmodat`'s path lookup and Windows mode mapping. On Windows any reparse point counts as a link. Console behaviour is unverified
-- [pathconf](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) looks the path up as FreeBSD 11's `kern_pathconf` does (links followed, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255) and returns the constants of FreeBSD 11's UFS `ufs_pathconf` for files and directories alike: `_PC_LINK_MAX` 32767, `_PC_NAME_MAX` 255, `_PC_PATH_MAX` and `_PC_SYMLINK_MAX` 1024, `_PC_PIPE_BUF` 512, `_PC_CHOWN_RESTRICTED` and `_PC_NO_TRUNC` 1, `_PC_FILESIZEBITS` 64, `_PC_REC_MAX_XFER_SIZE` -1, `_PC_PRIO_IO` and `_PC_SYNC_IO` 0. Whether the console's filesystems report the same is not verified. It throws for the names whose UFS value depends on the mount (`_PC_ALLOC_SIZE_MIN`, `_PC_REC_INCR_XFER_SIZE`, `_PC_REC_MIN_XFER_SIZE`, `_PC_MIN_HOLE_SIZE`), the kernel options (`_PC_ACL_EXTENDED`, `_PC_ACL_PATH_MAX`, `_PC_ACL_NFS4`, `_PC_MAC_PRESENT`) or the page size (`_PC_REC_XFER_ALIGN`), and on which UFS and `vop_stdpathconf` disagree (`_PC_MAX_CANON`, `_PC_MAX_INPUT`, `_PC_VDISABLE`, `_PC_ASYNC_IO`); other names fail with `EINVAL`
+- [pathconf, fpathconf, _fpathconf](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) report FreeBSD 11's `ufs_pathconf` constants for files and directories alike (`_PC_LINK_MAX` 32767, `_PC_NAME_MAX` 255, `_PC_PATH_MAX` and `_PC_SYMLINK_MAX` 1024, `_PC_PIPE_BUF` 512, `_PC_CHOWN_RESTRICTED` and `_PC_NO_TRUNC` 1, `_PC_FILESIZEBITS` 64, `_PC_REC_MAX_XFER_SIZE` -1, `_PC_PRIO_IO` and `_PC_SYNC_IO` 0); whether the console's filesystems report the same is not verified. They throw for names whose UFS value depends on the mount, the kernel options or the page size, and where UFS and `vop_stdpathconf` disagree (`_PC_MAX_CANON`, `_PC_MAX_INPUT`, `_PC_VDISABLE`, and `_PC_ASYNC_IO` in `pathconf`); other names fail with `EINVAL`. `fpathconf` and `_fpathconf` answer `_PC_ASYNC_IO` 200112 and, for a pipe, `_PC_PIPE_BUF` 512 and `EINVAL` otherwise, as FreeBSD 11's `kern_fpathconf` does; a guest socket is not a host descriptor, so the `fstat` check reports it as `EBADF`, as in `fchown`
 - [mkdirat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `mkdir`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. On Windows, `mode` is ignored. Console behaviour is unverified
 - [readlink](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) on Windows reads a symbolic link's target from its reparse data and returns it with `/` separators, only when the target is relative, as `symlink` creates them. A symbolic link with an absolute target returns its print name, or its substitute name when the print name is empty, without a `\??\` or `\\?\` prefix. A directory junction returns the same kind of name when it is a drive path (`X:\...`), using the print name when that is a drive path and the substitute name otherwise. A mounted volume (`\??\Volume{GUID}\`), any other name surrogate and every reparse point without the name surrogate bit (WOF compression, deduplication, cloud files) return `EINVAL`, as FreeBSD does for a file that is not a link and as CPython's `os.readlink`, which reads only symbolic links and junctions, does
 - [aio_read, aio_write, aio_fsync, aio_error, aio_return, aio_suspend, aio_waitcomplete, aio_cancel](../../../core/libs/prx/libkernel_sys/Aio.cpp) (libkernel_sys) - a request with `SIGEV_SIGNAL`, `SIGEV_THREAD_ID` or `SIGEV_KEVENT` completion, or on a socket, throws, because delivering a guest signal or kevent and socket aio are not modelled. One worker thread runs the process's requests one at a time in submission order, so a request is cancellable only until that thread takes it. A queued request keeps the descriptor number, not the open file: closing or reusing the descriptor before it runs changes what it reaches. Pipes fail with `EOPNOTSUPP`, as FreeBSD 11 does with `vfs.aio.enable_unsafe` 0; the console's setting is unverified. Waits are not interrupted by signals (`EINTR`), and timeouts under 1 ms round up to 1 ms (hz 1000). Otherwise the rules follow FreeBSD 11 `vfs_aio.c`
 - [readlinkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `readlink`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Console behaviour is unverified
 - [link](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) on Windows resolves a symbolic link source through the host, which follows longer chains than FreeBSD: a chain of 40 links is linked, where FreeBSD 11.4 returns `ELOOP` after 32 (`MAXSYMLINKS`). A loop returns `ELOOP` as on FreeBSD
+- [pthread_attr_setcreatesuspend_np, pthread_resume_np, pthread_resume_all_np, pthread_multi_np, scePthreadAttrSetcreatesuspend, scePthreadResume, scePthreadResumeAll and scePthreadMulti](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) - when a thread created suspended stops relative to its signal mask is unmeasured on a console. Return values and errors follow FreeBSD 11.4 libthr ([`thr_attr.c`](https://github.com/freebsd/freebsd-src/blob/8c639945/lib/libthr/thread/thr_attr.c#L369-L381), [`thr_resume_np.c`](https://github.com/freebsd/freebsd-src/blob/8c639945/lib/libthr/thread/thr_resume_np.c#L47-L97), [`thr_multi_np.c`](https://github.com/freebsd/freebsd-src/blob/8c639945/lib/libthr/thread/thr_multi_np.c#L40-L51)) and the code of firmware 13.42's `libkernel_sys.sprx` ([#9573](https://github.com/boykopovar/AnyPS5/pull/9573#issuecomment-6393877843)), where the sce forms add `0x80020000` to a non-zero errno
 - [fstatat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `stat`, or to `lstat` with `AT_SYMLINK_NOFOLLOW` (0x200). Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory, and flags other than `AT_SYMLINK_NOFOLLOW` return `EINVAL`. PPSA74126 imports it. Console behaviour is unverified
 - [unlinkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `rmdir` (with `AT_REMOVEDIR`, 0x800) or `unlink`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Removing a directory without `AT_REMOVEDIR` fails with `EPERM`, removing `.` or `..` with `AT_REMOVEDIR` fails with `EINVAL`, and flags other than `AT_REMOVEDIR` fail with `EINVAL`. Console behaviour is unverified
 - [renameat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `rename`. Any other relative path is joined to its descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to relative descriptors, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Console behaviour is unverified
 - [fork](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws: creating a child process is not supported. PPSA19111 imports it and fails to load without it. Its engine calls `fork` in `Posix_Daemonize`, only with `-daemonize`, and in `Platform_ShellExecute` before `execvp("xdg-open")`, which the main menu's Previews button reaches, so pressing Previews ends in this throw. [setsid](../../../core/libs/prx/libkernel_sys/Export.cpp) fails with `EPERM`, as FreeBSD's does for a process group leader, since the guest is taken to lead its own process group (see `kill`). [umask](../../../core/libs/prx/libkernel_sys/Export.cpp) keeps the guest's mask (initially 022, masked to 07777) and returns the previous one, Linux named shared-memory creation applies it, but ordinary files are still created with the host process's mask
-- [sceKernelGetModuleInfoInternal and sceKernelGetModuleListInternal](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5
+- [sceKernelGetModuleInfoInternal, sceKernelGetModuleListInternal and sceKernelLoadStartModuleForSysmodule](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5. `sceKernelLoadStartModuleForSysmodule` forwards to `sceKernelLoadStartModule`
 - [chroot](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L776-L807) and [`pwd_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L3059-L3085) for a root caller: `EFAULT` for a null path, `ENOENT` for an empty or missing one, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255, and `ENOTDIR` for a path that is not a directory or passes through a file. A directory that is the guest root (`/`, `/..`, or `.` after `fchdir` to a descriptor of `/`) succeeds and changes nothing, as the root stays the same directory; the guest is taken never to have changed its root, so open directory descriptors do not make it fail with `EPERM` (`kern.chroot_allow_open_directories` 1). Any other directory throws, naming the path: the guest path resolver has a fixed root and mount aliases (`/app0`, `/savedata0`) that do not move with it. On the console a title starts in a sandbox root, where `pwd_chroot` refuses with `EPERM` while a directory is open; whether that holds for titles, and whether a title holds `PRIV_VFS_CHROOT`, are unverified. Porpoise (PPSA99764) weak-imports it and calls it only as `fchdir` to its saved descriptor of `/` then `chroot(".")`, to put its sandbox root back after a jailbreak daemon replaced it ([`put_root_back`](https://github.com/elripalda/Porpoise-Dolphin-Emulator-for-PS5/blob/2ed1ab5a06995aa198f7bccd4da0f90c3fc29d39/src/porpoise_jailbreak.cpp#L303-L331))
+- [Console identity](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - `get_authinfo` errors and capability bits remain unverified on PS5; they follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/kernel.cpp), leaving the authority ID and other capability, attribute and credential words zero. The host models a retail unit (`IsCEX` 1, `IsDevKit` 0). The system OpenPSID reuses the ordinary ID; firmware 13.42 reads a separate `machdep.openpsid_for_sys`, whose value is unknown. Null returns positive 22 per the [module report](https://github.com/boykopovar/AnyPS5/pull/10524#issuecomment-6393566914).
 - [fchown](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled: the guest's own owner and group (0) and the unchanged value (-1) are accepted, a descriptor that is not open fails with `EBADF`, and any other owner or group throws, naming it. The check reads the descriptor with `fstat`, ignoring the CRT's invalid-parameter handler on Windows as `DescriptorControl` does. The console's ownership rules are unverified. Morrowind (`mshivam019/morrowind-ps5`) imports it
+- [chown, lchown and fchownat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled, as for `fchown`: owner and group 0 and the unchanged value (-1) are accepted, and any other owner or group throws, naming it. The path is looked up first, as in FreeBSD 11's `kern_fchownat`, with `stat`, with `lstat` for `lchown`, and with `fstatat` for `fchownat`, so a lookup error is returned before the owner is checked and nothing is changed on the host. `fchownat` flags other than `AT_SYMLINK_NOFOLLOW` (0x200) return `EINVAL`, as in FreeBSD 11. The console's ownership rules are unverified
+- [linkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) resolves `AT_FDCWD` (-100) and absolute paths as `link` does, and flags other than `AT_SYMLINK_FOLLOW` (0x400) return `EINVAL`, as in FreeBSD 11. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. A symbolic link as the source without `AT_SYMLINK_FOLLOW` throws, where FreeBSD links the symbolic link itself. Console behaviour is unverified
 - [pthread_set_defaultstacksize_np and scePthreadSetDefaultstacksize](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) set the stack size that `scePthreadAttrInit` and a thread created without attributes use, as [fpPS4's `pthread_set_defaultstacksize_np`](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_pthread_attr.pas#L89-L102) does: a size of 16384 bytes or less fails with `EINVAL` (`0x80020016` from the sce form) and there is no upper limit, so a default the host cannot allocate fails only when a thread is created. Attributes initialised earlier keep their size. Not checked on a PS5
 - [sceKernelTitleWorkaroundIsEnabled](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - not measured on a console; the `{version, align, ids[2]}` layout, the bit test and the limit of 0x3A bits follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/kernel.cpp), which notes that the limit changes between firmwares. A negative bit is `EINVAL` here; shadPS4 compares it signed and reads outside `ids`. Titles usually pass the `title_workaround` block of `sceKernelGetAppInfo`, which does not write that block here, so the bits read are whatever the caller's memory held
 - [sceKernelGetProcessType](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - not measured on a console; as in shadPS4, the title's own pid, -1 and 0 are type 0 (big application) and any other pid is `ESRCH`
diff --git a/docs/dev/debt/libmdbg_syscore.md b/docs/dev/debt/libmdbg_syscore.md
index cb843c4f05..0201062426 100644
--- a/docs/dev/debt/libmdbg_syscore.md
+++ b/docs/dev/debt/libmdbg_syscore.md
@@ -2,4 +2,4 @@
 
 ### Unknown function info
 
-- [sceDebugAcquireAndUpdateDebugRegister, sceDebugAttachProcess, sceDebugCancelCoredump, sceDebugClearStepThread, sceDebugCreatePerfScratchDataArea, sceDebugCreatePerfScratchExecutableArea, sceDebugCreateScratchDataArea, sceDebugCreateScratchDataAreaForPrx, sceDebugCreateScratchExecutableArea, sceDebugCreateScratchExecutableAreaForPrx, sceDebugDestroyPerfScratchDataArea, sceDebugDestroyPerfScratchExecutableArea, sceDebugDestroyScratchDataArea, sceDebugDestroyScratchExecutableArea, sceDebugDetachProcess, sceDebugGetApplicationIdByTitleId, sceDebugGetApplicationInfo, sceDebugGetApplicationList, sceDebugGetCrashInfoDetailForCoredump, sceDebugGetCrashInfoForCoredump, sceDebugGetDLLoadFlag, sceDebugGetDataListOfUltQueue, sceDebugGetDebugRegisterStatusMap, sceDebugGetEventList, sceDebugGetEventListForEQueueFd, sceDebugGetEventSubscriptionList, sceDebugGetEventSubscriptionListForEQueueFd, sceDebugGetFiberInfo, sceDebugGetFileInfo, sceDebugGetFileInfoForCoredump, sceDebugGetFileList, sceDebugGetFileListForCoredump, sceDebugGetGpuInfoArea, sceDebugGetJobManagerInfo, sceDebugGetJobManagerSequenceInfo, sceDebugGetJobManagerSequenceList, sceDebugGetModuleInfo, sceDebugGetModuleList, sceDebugGetModuleMetaData, sceDebugGetMonoVMInfo, sceDebugGetMonoVMList, sceDebugGetProcessCoredumpHandlerEventBlob, sceDebugGetProcessCoredumpHandlerEventInfo, sceDebugGetProcessCoredumpHandlerResult, sceDebugGetProcessEventCntlFlag, sceDebugGetProcessInfo, sceDebugGetProcessList, sceDebugGetProcessPropertyForCoredump, sceDebugGetProcessResourceStatCount, sceDebugGetProcessResourceStatData, sceDebugGetProcessTime, sceDebugGetProcessTimeCounter, sceDebugGetSyncExclusiveWaiterList, sceDebugGetSyncObjectData, sceDebugGetSyncObjectList, sceDebugGetSyncWaiterList, sceDebugGetSyncWaiterListForEQueueFd, sceDebugGetSystemStatusBlob, sceDebugGetSystemStatusCount, sceDebugGetThreadInfo, sceDebugGetThreadInfoByIdent, sceDebugGetThreadList, sceDebugGetThreadListAsIdent, sceDebugGetUlObjectList, sceDebugGetUltCondvarInfo, sceDebugGetUltInfo, sceDebugGetUltListOfUltRuntime, sceDebugGetUltMutexInfo, sceDebugGetUltQueueDataResourcePoolInfo, sceDebugGetUltQueueInfo, sceDebugGetUltRuntimeInfo, sceDebugGetUltRwlockInfo, sceDebugGetUltSemaphoreInfo, sceDebugGetUltWaitingQueueResourcePoolInfo, sceDebugGetVirtualMemoryDetailInfoForCoredump, sceDebugGetVirtualMemoryInfo, sceDebugGetVirtualMemoryInfoForCoredump, sceDebugGetWaitingListOfUltCondvar, sceDebugGetWaitingListOfUltMutex, sceDebugGetWaitingListOfUltQueue, sceDebugGetWaitingListOfUltRwlock, sceDebugGetWaitingListOfUltSemaphore, sceDebugGetWorkerThreadListOfUltRuntime, sceDebugInit, sceDebugInitForCoredump, sceDebugInitForTest, sceDebugIpmiGetBlockTimeInfoList, sceDebugIpmiGetBlockedIpcInfo, sceDebugIpmiGetChannelInfo, sceDebugIpmiGetChannelKidList, sceDebugIpmiGetChannelWaitingThreadList, sceDebugIpmiGetClientInfo, sceDebugIpmiGetClientKidList, sceDebugIpmiGetClientKidListByDump, sceDebugIpmiGetClientKidListByServerKid, sceDebugIpmiGetConnectRequestInfoList, sceDebugIpmiGetConnectionInfoList, sceDebugIpmiGetConnectionWaitingThreadListByClientKid, sceDebugIpmiGetConnectionWaitingThreadListBySessionKid, sceDebugIpmiGetDump, sceDebugIpmiGetEncryptedInfoAllForCoredump, sceDebugIpmiGetKidInfoListForCoredump, sceDebugIpmiGetServerDispatchInfo, sceDebugIpmiGetServerInfo, sceDebugIpmiGetServerKidList, sceDebugIpmiGetServerKidListByDump, sceDebugIpmiGetServerWaitingThreadList, sceDebugIpmiGetSessionInfo, sceDebugIpmiGetSessionKidList, sceDebugIpmiGetSessionKidListByServerKid, sceDebugIpmiGetTidListByDump, sceDebugKillApplication, sceDebugKillProcess, sceDebugNoStopChildProcesses, sceDebugNoStopOnDLLoad, sceDebugProcessSpawn, sceDebugReadEvent, sceDebugReadEventForTest, sceDebugReadProcessMemory, sceDebugReadProcessMemoryForSDBGP, sceDebugReadProcessRegister, sceDebugReadProcessRegisterForSDBGP, sceDebugReadProcessResourceStatData, sceDebugReadThreadRegister, sceDebugReadThreadRegisterForSDBGP, sceDebugReleaseDebugRegister, sceDebugResumeApplication, sceDebugResumeProcess, sceDebugResumeThread, sceDebugSetProcessEventCntlFlag, sceDebugSetStepThread, sceDebugSpawnApplication, sceDebugStopChildProcesses, sceDebugStopOnDLLoad, sceDebugSuspendApplication, sceDebugSuspendProcess, sceDebugSuspendThread, sceDebugTriggerCoredump, sceDebugTriggerCoredumpForSystem, sceDebugTriggerVrCaptureDump, sceDebugWriteProcessMemory, sceDebugWriteProcessRegister and sceDebugWriteThreadRegister](../../../core/libs/prx/libmdbg_syscore/Export.cpp) (libmdbg_syscore) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libmdbg_syscore.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceDebugAcquireAndUpdateDebugRegister, sceDebugAttachProcess, sceDebugCancelCoredump, sceDebugClearStepThread, sceDebugCreatePerfScratchDataArea, sceDebugCreatePerfScratchExecutableArea, sceDebugCreateScratchDataArea, sceDebugCreateScratchDataAreaForPrx, sceDebugCreateScratchExecutableArea, sceDebugCreateScratchExecutableAreaForPrx, sceDebugDestroyPerfScratchDataArea, sceDebugDestroyPerfScratchExecutableArea, sceDebugDestroyScratchDataArea, sceDebugDestroyScratchExecutableArea, sceDebugDetachProcess, sceDebugGetApplicationIdByTitleId, sceDebugGetApplicationInfo, sceDebugGetApplicationList, sceDebugGetCrashInfoDetailForCoredump, sceDebugGetCrashInfoForCoredump, sceDebugGetDLLoadFlag, sceDebugGetDataListOfUltQueue, sceDebugGetDebugRegisterStatusMap, sceDebugGetEventList, sceDebugGetEventListForEQueueFd, sceDebugGetEventSubscriptionList, sceDebugGetEventSubscriptionListForEQueueFd, sceDebugGetFiberInfo, sceDebugGetFileInfo, sceDebugGetFileInfoForCoredump, sceDebugGetFileList, sceDebugGetFileListForCoredump, sceDebugGetGpuInfoArea, sceDebugGetJobManagerInfo, sceDebugGetJobManagerSequenceInfo, sceDebugGetJobManagerSequenceList, sceDebugGetModuleInfo, sceDebugGetModuleList, sceDebugGetModuleMetaData, sceDebugGetMonoVMInfo, sceDebugGetMonoVMList, sceDebugGetProcessCoredumpHandlerEventBlob, sceDebugGetProcessCoredumpHandlerEventInfo, sceDebugGetProcessCoredumpHandlerResult, sceDebugGetProcessInfo, sceDebugGetProcessList, sceDebugGetProcessPropertyForCoredump, sceDebugGetProcessResourceStatCount, sceDebugGetProcessResourceStatData, sceDebugGetProcessTime, sceDebugGetProcessTimeCounter, sceDebugGetSyncExclusiveWaiterList, sceDebugGetSyncObjectData, sceDebugGetSyncObjectList, sceDebugGetSyncWaiterList, sceDebugGetSyncWaiterListForEQueueFd, sceDebugGetSystemStatusBlob, sceDebugGetSystemStatusCount, sceDebugGetThreadInfo, sceDebugGetThreadInfoByIdent, sceDebugGetThreadList, sceDebugGetThreadListAsIdent, sceDebugGetUlObjectList, sceDebugGetUltCondvarInfo, sceDebugGetUltInfo, sceDebugGetUltListOfUltRuntime, sceDebugGetUltMutexInfo, sceDebugGetUltQueueDataResourcePoolInfo, sceDebugGetUltQueueInfo, sceDebugGetUltRuntimeInfo, sceDebugGetUltRwlockInfo, sceDebugGetUltSemaphoreInfo, sceDebugGetUltWaitingQueueResourcePoolInfo, sceDebugGetVirtualMemoryDetailInfoForCoredump, sceDebugGetVirtualMemoryInfo, sceDebugGetVirtualMemoryInfoForCoredump, sceDebugGetWaitingListOfUltCondvar, sceDebugGetWaitingListOfUltMutex, sceDebugGetWaitingListOfUltQueue, sceDebugGetWaitingListOfUltRwlock, sceDebugGetWaitingListOfUltSemaphore, sceDebugGetWorkerThreadListOfUltRuntime, sceDebugInit, sceDebugInitForCoredump, sceDebugInitForTest, sceDebugIpmiGetBlockTimeInfoList, sceDebugIpmiGetBlockedIpcInfo, sceDebugIpmiGetChannelInfo, sceDebugIpmiGetChannelKidList, sceDebugIpmiGetChannelWaitingThreadList, sceDebugIpmiGetClientInfo, sceDebugIpmiGetClientKidList, sceDebugIpmiGetClientKidListByDump, sceDebugIpmiGetClientKidListByServerKid, sceDebugIpmiGetConnectRequestInfoList, sceDebugIpmiGetConnectionInfoList, sceDebugIpmiGetConnectionWaitingThreadListByClientKid, sceDebugIpmiGetConnectionWaitingThreadListBySessionKid, sceDebugIpmiGetDump, sceDebugIpmiGetEncryptedInfoAllForCoredump, sceDebugIpmiGetKidInfoListForCoredump, sceDebugIpmiGetServerDispatchInfo, sceDebugIpmiGetServerInfo, sceDebugIpmiGetServerKidList, sceDebugIpmiGetServerKidListByDump, sceDebugIpmiGetServerWaitingThreadList, sceDebugIpmiGetSessionInfo, sceDebugIpmiGetSessionKidList, sceDebugIpmiGetSessionKidListByServerKid, sceDebugIpmiGetTidListByDump, sceDebugKillApplication, sceDebugKillProcess, sceDebugNoStopChildProcesses, sceDebugNoStopOnDLLoad, sceDebugProcessSpawn, sceDebugReadEvent, sceDebugReadEventForTest, sceDebugReadProcessMemory, sceDebugReadProcessMemoryForSDBGP, sceDebugReadProcessRegister, sceDebugReadProcessRegisterForSDBGP, sceDebugReadProcessResourceStatData, sceDebugReadThreadRegister, sceDebugReadThreadRegisterForSDBGP, sceDebugReleaseDebugRegister, sceDebugResumeApplication, sceDebugResumeProcess, sceDebugResumeThread, sceDebugSetStepThread, sceDebugSpawnApplication, sceDebugStopChildProcesses, sceDebugStopOnDLLoad, sceDebugSuspendApplication, sceDebugSuspendProcess, sceDebugSuspendThread, sceDebugTriggerCoredump, sceDebugTriggerCoredumpForSystem, sceDebugTriggerVrCaptureDump, sceDebugWriteProcessMemory, sceDebugWriteProcessRegister and sceDebugWriteThreadRegister](../../../core/libs/prx/libmdbg_syscore/Export.cpp) (libmdbg_syscore) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libmdbg_syscore.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/relinker.md b/docs/dev/debt/relinker.md
index f4e849cbda..f2d970f219 100644
--- a/docs/dev/debt/relinker.md
+++ b/docs/dev/debt/relinker.md
@@ -2,20 +2,27 @@
 
 ### Functional
 
+- The [syscall scanner](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) decodes executable ranges linearly without code/data boundaries. Embedded data between routines can fail decoding or be reported as a forbidden syscall ([#7547](https://github.com/boykopovar/AnyPS5/issues/7547)). Unwind ranges alone omit real code. The [synthetic fixture](../../../core/relinker/relinker/tests/CodeDataScanningTests.cpp) characterizes these rejections and checks a reachable routine beyond the gap; it does not resolve the boundary problem.
+
 - [Executable guest imports](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) - on Linux and macOS, a relocated executable import resolved to one guest provider requires that module and its dependencies at startup, even when it was discovered through `--module-dir` without a DT_NEEDED entry. Unreferenced symbols and no-op relocations do not require an otherwise deferred module. Console module-start ordering is unmeasured.
 
-- [Runtime-loaded modules](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) that another module needs are initialized at startup with no start arguments, before the module that needs them is loaded; the console is assumed to start them when that module is loaded.
-- [Runtime-loaded modules the executable needs](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) are mapped at startup on Windows and started when the title loads them with `sceKernelLoadStartModule`, with their start arguments, as a Unity player loads `mono-ps4.sprx`. A title that calls such a module before loading it finds its initializers not run; whether the console starts it earlier is not measured. A module the executable only imports from and the title never loads itself gets no `module_start` and no initializers at all under this deferral, and nothing reports it. Linux and macOS still start it at startup.
+- [Runtime-loaded modules](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) can be mapped early for bindings. Linux defers their initialization to an explicit load of each module; standard SDK folders keep their mapping initializer, including through the browser conversion API. On Windows and macOS, a module another module needs is initialized at startup without start arguments; console dependency-start ordering is unmeasured.
+- [Runtime-loaded modules the executable needs](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) are mapped at startup on Windows and started when the title loads them with `sceKernelLoadStartModule`, with their start arguments, as a Unity player loads `mono-ps4.sprx`. A title that calls such a module before loading it finds its initializers not run; whether the console starts it earlier is not measured. A module the executable only imports from and the title never loads itself gets no `module_start` and no initializers at all under this deferral. The [entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) prints `Deferred module <path>` at startup for each such module that an import of the executable names, whether or not the title loads it later; an import without a module name is not reported. macOS still starts it at startup.
 - The executable file that [relinker](../../../core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp) generates opens a console when launched, unless it is relinked with `--windows-gui`, which selects the GUI subsystem. A GUI build started from Explorer has no standard output or error handle; the [entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) gives each missing one `anyps5.log` beside the executable, replacing the previous run's file (#3282). Errors about the executable path or about waiting for the previous LoadExec process are written before the log is opened and are lost when the standard error handle is missing. If the log cannot be created, output to the missing handles is lost.
 - [Guest import registries](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) - declared host imports of bundled modules are recorded with their module name and relocation target, even when another guest module exports the same stripped NID. No-op relocations are omitted. Registries describe import bindings, not implementation correctness or runtime reachability.
-- Converted Windows main executables [omit `DYNAMIC_BASE`](../../../core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp) by default, not only with `--windows-fixed-base`: on the console the executable lies inside the 40-bit window that the title's own `sceLibcMspaceCreate` checks (#3043). Relocations are kept, so if `0x140000000` is taken Windows relocates the image, possibly above that window. Verified only on Windows 10.
+- Registry [call-site analysis](../../../core/relinker/relinker/src/analysis/CallSiteResolver.cpp) does not classify instructions with `F3`, `66`, `67`, `F0`, `2E`, `26`, `36`, FS/GS prefixes, or `8B` loads without REX.W, so missing call sites do not establish that an import is unused.
+- Converted Windows main executables [omit `DYNAMIC_BASE`](../../../core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp) and [prefer `0x400000`](../../../core/relinker/elfpatcher/src/windows/WindowsPePatcher.cpp) for their lowest ELF load page by default, not only with `--windows-fixed-base`: on the console the executable lies inside the 40-bit window that the title's own `sceLibcMspaceCreate` checks (#3043). Where the console loads an executable that does not require an address is not measured; `0x400000` is the base that executables reading their GOT through `app0/imports.txt` assume (#4013). Relocations are kept, so if that range is taken Windows can relocate the image, possibly above that window; no run has observed this, and from this base an image cannot reach the shared user data page at `0x7ffe0000`, since Windows refuses a `SizeOfImage` above `0x77000000` (#9332). Verified on Windows 11 only.
 - [SDK memory-management syscall traps](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) under `--trap-sdk-syscall-stubs` recognize three exact instruction sequences from [ps5-payload-dev SDK libc/mman.c](https://github.com/ps5-payload-dev/sdk/blob/12cf3dda40/libc/mman.c), observed in Nuvio Maxd 0.5.15 (PPSA99288): syscall 74 and the two syscall 477 paths, with their argument preparation and carry-flag error handling. Matching requires a decoded instruction boundary and the complete sequence inside the scanned code range. Other SDK/compiler output remains rejected. The matched syscall becomes `UD2`; this does not implement mmap or mprotect and a call still faults.
 - The [instruction decoder](../../../core/relinker/codegen/src/x86/X64InstructionDecoder.cpp) reads a 16-bit displacement for `66 E8`, `66 E9` and `66 0F 80`-`8F` without REX.W, as AMD processors, the console included, do (binutils `objdump -M amd64`; REX.W selects the 32-bit form). AMD also truncates the target of every near relative branch with that prefix, rel8, LOOP and JRCXZ forms included, to 16 bits. Instruction metadata marks these branches as truncated and reports no branch target for them, and stubs refuse to move them. Compilers do not emit these forms.
 - Converted Linux main executables are [placed at `0x400000`](../../../core/relinker/relinker/src/pipeline/Conversion.cpp) by default, as `ET_EXEC` without ASLR, not only with `--linux-fixed-base`: the console executable lies inside the 40-bit window that the title's own `sceLibcMspaceCreate` checks (#3043). Where the console loads an executable that does not require an address is not measured; `0x400000` is the base that executables reading their GOT through `app0/imports.txt` assume (#4013). The relinker refuses an image that spans 2 GiB or more, so the executable ends below the guest arena at `0x200000000`. With `--lazy-binding` the executable stays position independent.
+- `--frame-red-zone` frames only leaf functions that start with a chain of pushes of at least five bytes (`push rbp; mov rbp, rsp; push ...`, or pushes alone, which may be followed by `sub $n, %rsp` or `lea -n(%rsp), %rsp`) and leave through exits of at least five bytes that undo that allocation with `add` or `lea`, pop the same registers and `ret` ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)). Leaves with a frame pointer that allocate, leaves with neither pushes nor an allocation, shorter prologues and exits, exits that free another size, and functions with indirect jumps or other RSP arithmetic keep their red zone.
+- In a red-zone leaf without a frame pointer, `--frame-red-zone` lowers RSP after the prologue by the deepest displacement below RSP, rounded up to 16, and moves every RSP operand by the same amount ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)). A leaf that takes the address of a slot below RSP, or uses an RSP operand with an index register, is lowered by the whole 128 bytes, since a pointer or an index can reach deeper than any displacement; values below RSP reached through any other register are not seen. Leaves with a frame pointer are lowered by 128 bytes. Inside a moved frame the CFA rules of the guest's unwind tables are off by the shift.
+- An RSP operand that `--frame-red-zone` cannot move in place, an 8-bit displacement the shift takes past 0x7f or one without a displacement, moves to a stub with the instructions after it up to five bytes and is re-encoded there with the moved displacement ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)). The leaf is skipped when that site would take in a branch target, a branch, ret or RIP-relative instruction, or another site, and when the operand is EVEX, whose 8-bit displacement is scaled. A game patch over a framed site or a moved displacement is refused.
+- In `--frame-red-zone`, function bounds come from the executable's `.eh_frame` FDEs: each function is decoded from its FDE start to its FDE end, or to int3 padding before it, and the relinker stops with an error when the executable has none. Code outside every FDE, such as a function without unwind information, is not framed ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)).
 - `--to-intel` lowers MCOMMIT to STC plus NOP padding and RDPRU through a runtime-checked stub in the [matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp): AMD APM Vol. 3 defines RDPRU ECX 0 as MPERF and ECX 1 as APERF, neither readable on Intel hosts, so both selectors return the host TSC as a disclosed monotonic-counter approximation (their ratio always reads 1.0) while other selectors yield zero EDX:EAX. STC asserts CF=1 because under x86-TSO prior stores are already ordered and guest memory is host-DRAM-backed, leaving the commit-success case as the only observable one. Non-zero RDPRU selectors, the TSC-for-MPERF/APERF substitution, and any console path reporting MCOMMIT CF=0 are unverified.
 - [Unscoped imports on Windows](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) - an import without a module that no searched library exports under its name is searched again under the NID of that name, because homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) imports by symbol name (Quake, from the websrv homebrew launcher; Mari0, #6239) while the libraries in `libs/` export NIDs. A dependency named with `.sprx`, `.suprx` or `.debug_prx` loads the `.prx` library of the same stem from `libs/`, and `libkernel_web` also loads `libkernel.prx`, as `libSceLibcInternal` already loads `libc.prx`: AnyPS5's `libkernel_web.prx` exports only two functions, where the console's `libkernel_web.sprx` is a libkernel variant. A name that matches a library's export as written still binds to that export first. macOS resolves these imports through the host loader by name and is unchanged.
-- [Unscoped imports on Linux](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp) - in an executable that names a dependency with `.sprx`, `.suprx` or `.debug_prx`, as homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) does, an import without a module that is named by symbol is bound to the NID of that name only. Unlike Windows, the name as written is not tried first, because the host loader also searches the host C library, which exports `malloc` or `pthread_create` under their names. A name that a bundled module exports still binds to that module, and such a dependency loads the `.prx` library of the same stem. Unqualified imports of other executables, and imports of bundled modules, are still bound by name.
-- The length-changing path of the [instruction rewriter](../../../core/relinker/codegen/src/x86/X64InstructionRewriter.cpp) is not used by the [converter](../../../core/relinker/codegen/src/Amd64OnlyConverter.cpp): it does not adjust data-to-code references (relocations, FDEs, jump tables) or segment sizes, so every substitution keeps the instruction length.
+- [Unscoped imports on Linux](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp) - in an executable or bundled module that names a dependency with `.sprx`, `.suprx` or `.debug_prx`, as homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) does, an import without a module that is named by symbol is bound to the NID of that name only. Unlike Windows, the name as written is not tried first, because the host loader also searches the host C library, which exports `malloc` or `pthread_create` under their names. A name that a bundled module exports still binds to that module, as does a bundled module's import of a name the executable exports, and such a dependency loads the `.prx` library of the same stem. Unqualified imports of other executables and bundled modules are still bound by name.
+- The length-changing path of the [instruction rewriter](../../../core/relinker/codegen/src/x86/X64InstructionRewriter.cpp) is not used by the [converter](../../../core/relinker/codegen/src/Amd64OnlyConverter.cpp): it does not adjust data-to-code references (relocations, FDEs, jump tables) or segment sizes, so every substitution keeps the instruction length. The rewriter conservatively rejects length-changing edits when a surviving truncated relative branch would move relative to its target (only one of the two lies after the cut) or when its section-relative target falls outside the 16-bit range, because the runtime address base needed to resolve a wrapped destination is unavailable; truncated branches that keep their distance and stay in range are accepted.
 - The [converter](../../../core/relinker/codegen/src/Amd64OnlyConverter.cpp) takes the branch targets that keep an instruction in place from a linear scan of the code segment, so data in that segment decodes as branches too: OpenSSL's x86-64 assembly keeps strings such as "SHA1 block transform for x86_64, CRYPTOGAMS by <appro@openssl.org>" in its code, and in SuperTuxKart (PPSA69421) and Mortalfin (PPSA99141) the `jae` read from "sf" points into the VEX prefix of a 256-bit store. A direct branch target inside a scanned instruction counts only where every byte before it is a legacy prefix or REX, which a real branch can skip (a `lock` prefix, for example); a target in a VEX prefix, opcode or operand is ignored, as a jump-table entry that starts no instruction already is. A real branch to such a target, overlapping instructions as hand-written code can, is not seen, and the instruction it enters can be moved.
 - A `PT_SCE_RELRO` segment that no `PT_LOAD` covers, the PS4 layout, is [loaded](../../../core/relinker/relinker/src/parsing/ElfReader.cpp) as a read-write `PT_LOAD` and stays writable after relocation; FreeBSD rtld makes `PT_GNU_RELRO` read-only once relocation is done, and what the console does with `PT_SCE_RELRO` is not checked.
 - In Windows output, a guest instruction that addresses memory through GS becomes `UD2` and NOP padding of its own length ([TLS builder](../../../core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp)): the host owns GS, and the guest GS base that FreeBSD's `sysarch(AMD64_SET_GSBASE)` would set is not emulated. A converted module runs until such an instruction is reached, which then faults. Prospero Win (PPSA99995) has six in its Wine `ntdll`.
@@ -24,12 +31,16 @@
 - In the same executables and modules, the bytes between unwind functions are 16-byte slots of function tails and padding, and a tail can begin inside an instruction. The [instruction scanner](../../../core/relinker/codegen/src/InstructionScanner.cpp) of the syscall and call-site scans therefore resumes at the next byte when bytes outside every unwind function do not decode, and ends a decoding outside them at the start of the next unwind function. Code without an unwind entry that does not decode from its first byte is skipped by these scans instead of failing the relink; inside an unwind function a decode failure still fails it.
 - Read-only data can also sit between the unwind functions of such images. There, a `syscall`, `sysenter` or `int 0x80` pattern fails the [syscall scan](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) only when a constant syscall number is set before it; the others, and every `sysret`, are skipped and counted in one message. The number is looked for in the decoded instructions and, whatever alignment the decoding took, in the bytes before the pattern: a `mov eax, imm32`, `mov rax, imm32`, `mov rax, imm64` or `xor eax, eax`, optionally followed by `mov al, imm8` or `mov ax, imm16`, then by any number of register moves or zeroings that leave `rax` alone. A real syscall without an unwind entry whose number is set otherwise is not refused and runs on the host: from memory or another register (`mov eax, ecx`), by `push`/`pop` or arithmetic (`or eax, imm32`), or with any other instruction between the load and the pattern.
 - In the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs for such images, a relocation or `lea` target outside every unwind function is followed as code only when its linear decoding, up to the first jump, return or trap, the next unwind function or 256 instructions, holds an `fs:[disp32]` access, or when it is 16-byte aligned, starts less than 256 bytes after an unwind function and ends in a jump, return or trap. Every other such target is taken as data and counted in one message, and the Windows TLS rewrite fails instead of overwriting one. A TLS access of another form, such as `mov rax, fs:[rax]`, or a `gs` instruction in code reached only through such a target is therefore not rewritten or trapped. Other fs and gs instructions do not tell code from data there: string bytes decode as these prefixes, and in two measured titles about 2,500 of about 5,500 such targets decode to one before their first jump.
+- [Embedded data tables and relative jump tables in inter-FDE gaps](../../../core/relinker/relinker/src/analysis/RelativeJumpTables.cpp) - in modules with `PT_GNU_EH_FRAME` or `PT_SCE_DYNLIBDATA`, a constant table of undecodable bytes that a RIP-relative `LEA` references, and a trailing relative jump table, are masked with `0x90` in the scan buffer before syscall scanning and kept out of the code roots of [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp), so `0F 78` data in `ubiservices.prx` (PPSA28155, #7547) is no longer refused as an illegal opcode. Masking starts at the `LEA` target, stops at the first byte whose linear decoding reaches a jump, return or trap, keeps gap code being scanned, and needs padding only from the function end to the table; A gap that decodes as valid instructions or that a direct branch targets is left alone. The gap properties are computed once in a backward pass. Output bytes are unchanged apart from syscall traps.
 - In executables and guest modules with a `PT_SCE_DYNLIBDATA` segment, the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs follows code only from the end of `PT_INTERP`, or of the `/libexec/ld-elf.so.1` string that begins the segment when no `PT_INTERP` covers it, as in OpenOrbis modules, to the end of the PLT after the last function of the unwind table, or to the end of that function when the PLT comes before the code, as in the `libSceFios2.prx` and `libc.prx` that CUSA02636 bundles (PLT at 0xc8); the pipeline's scans of executables above stop at this same end, also when the PLT comes before the code. A guest module with PLT relocations and no PLT before or after its unwind functions, or with a PLT that overlaps one, fails as the executable does. Code after that end is not analyzed, such as the `DT_FINI` routine without an unwind entry that follows the last unwind function in both modules and that the Windows and macOS outputs call when the program exits: a TLS access in it is not rewritten, the ELF entry point, `DT_INIT`, `DT_FINI`, a branch or a pointer into it is ignored, and a function symbol or init/fini array entry pointing into it fails the conversion.
+- Under Rosetta (M5, macOS 27.0.1), a VMASKMOVPS, VMASKMOVPD, VPMASKMOVD or VPMASKMOVQ store or load that faults on an element other than an active first one ends the process (`unexpectedly need to EmulateForward on a synchronous exception`) instead of raising SIGSEGV or SIGBUS, so a masked store into a page the macOS write watch keeps read-only ends the title. `--to-rosetta` moves each masked store to a [stub](../../../core/relinker/codegen/src/x86/MaskedStoreLowering.cpp) that first writes to the first and last byte of every active element with `LOCK OR` of 0, which faults normally and changes nothing; each store then costs up to 16 locked byte writes. A page made read-only again by another thread between those writes and the store still ends the process. A stack-relative displacement that exceeds signed disp32 after the spill frame throws. Masked loads are not converted.
 - A relocation against a dynamic symbol entry that is all zero, like the null symbol, takes the value 0 plus its addend, as the gABI defines for `STN_UNDEF` ([pipeline](../../../core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp)). The Linux output imports such an entry as an unnamed weak symbol, which the host loader resolves to 0; the Windows and macOS outputs write the value into the slot ([relocation builder](../../../core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp)). What the console's loader does with such an entry is not measured. OliSe Player (PPSA01153) has seven of them, and its code calls through those slots only when they are not 0 ([#4437](https://github.com/boykopovar/AnyPS5/issues/4437)).
 - In macOS output, a guest instruction that addresses memory through GS becomes `UD2` and NOP padding of its own length ([macOS image writer](../../../core/relinker/elfpatcher/src/macos/MacOsImage.cpp)): the host owns GS, which holds the pthread TSD base the guest TLS stubs read, and the guest GS base that FreeBSD's `sysarch(AMD64_SET_GSBASE)` would set is not emulated. A converted module runs until such an instruction is reached, which then faults. Prospero Win (PPSA99995) has six in its Wine `ntdll`.
 - The Linux placement of the `--to-intel` stubs in the [ELF patcher](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp) is covered only by a synthetic test.
 - `--to-rosetta` lowers what Rosetta lacks on top of `--to-intel` ([matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp)). AVX2, FMA, BMI1/2, F16C and MOVBE were observed to execute on an M5 Max without being reported through CPUID; this is not a guarantee for other Rosetta hosts. ANDN and RDRAND fault on an M1 running macOS 15.3.1 and execute on an M1 running macOS 26.6.2, so on the M1 the difference follows the macOS version; on that host BEXTR, BLSI, BLSMSK, BLSR, TZCNT, LZCNT, POPCNT, BZHI, MULX, PDEP, PEXT, RORX, SARX, SHLX, SHRX, MOVBE, FMA, AVX2 and F16C execute as well, its CPUID leaf 1 reports none of MOVBE, FMA, AVX or F16C, and RDSEED, RDPID, CLWB, ADCX and ADOX raise SIGILL. They also execute on an M5 running macOS 26.4, where the rest of BMI1 and BMI2, LZCNT, PREFETCHW, CLFLUSHOPT, AVX, AVX2, FMA, F16C and MOVBE execute as well although CPUID leaf 7 reads zero and leaves 1 and 0x80000001 report none of them, and where RDSEED, CLWB, RDPID, ADCX and ADOX raise an illegal instruction. ANDN is lowered, but RDRAND and other BMI instructions still depend on the host. RDSEED becomes RDRAND and CLWB a NOP. RDPID returns processor 0, and RDTSCP runs unchanged with ECX set to 0 after it, because Rosetta's TSC_AUX is the constant 0xAAAAAAAB (also measured on an M5, macOS 27.0.1). An RDPID or RDTSCP site with no movable instruction after it for the jump is kept; a kept RDTSCP reports 0xAAAAAAAB. ADCX/ADOX fault under Rosetta and are not converted: compilers do not emit them, and code that checks CPUID sees no ADX. The conversions are covered by the converter tests. ANDN lowering is also executed by an x86-64 test build under Rosetta on the M1; the other conversions were originally checked on an M5 Max, outside this repository's CI.
+- `--to-rosetta` output faults on an M2 running macOS 14.8.9 when it reaches AVX, AVX2, FMA, F16C, RDRAND or a BMI1/BMI2 instruction other than ANDN, TZCNT and LZCNT: Rosetta on that host raises SIGILL for them and for RDSEED, RDPID, CLWB, ADCX and ADOX ([matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp)). Only TZCNT, LZCNT, POPCNT, MOVBE, CLFLUSHOPT, PREFETCHW and RDTSCP execute, and RDTSCP sets ECX to 0xAAAAAAAB. CPUID leaf 1 reports POPCNT and none of MOVBE, AVX, FMA, F16C or RDRAND, leaf 7 reads zero, and leaf 0x80000001 reports RDTSCP but neither LZCNT nor PREFETCHW. An M2 Max on macOS 27.2 reports the same CPUID but executes everything except RDSEED, RDPID, CLWB, ADCX and ADOX, so the faults follow the macOS version, not the chip.
 - `--to-intel` replaces the approximate legacy SSE and VEX.128 register forms of RSQRTPS/RCPPS and VRSQRTPS/VRCPPS with [correctly rounded](../../../core/relinker/codegen/src/x86/ReciprocalLowering.cpp) 1/sqrt(x) and 1/x, not with the AMD approximation: its tables are not public. Intel's approximation of 1/sqrt(1.0) is 0x3F7FF000, and two Newton-Raphson steps on it settle on 0.99999994 instead of 1.0; a renormalised identity quaternion then turns into a NaN axis in PPSA21564, which the console does not show. Refined results now reach the exact value; unrefined ones can still differ from the console in the low bits. Each site costs an out-of-line stub (two jumps, a spill below the red zone, SQRTPS/DIVPS). Legacy SSE forms preserve the destination's upper YMM bits; VEX forms clear them. The 256-bit, scalar and memory forms keep the native instruction, as does a site shorter than 5 bytes with no movable instruction after it for the jump (5 sites in PPSA21564, counted before a following RIP-relative instruction could move into the stub; not recounted).
-- `--trace-imports` ([Windows entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp), [Linux entry stub](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp)) exists for Windows and Linux output, not macOS. Only imports bound through a PLT slot, or through a GOT slot whose symbol is a function, are traced; a function reached through any other relocation, or looked up at run time with `sceKernelDlsym`, is not, and neither are weak imports or the imports of modules loaded at run time. On Linux the entry stub makes the page of every traced slot readable, writable and executable with `mprotect` before it stores the thunk, so a slot inside `PT_GNU_RELRO` can be replaced; those pages stay writable, and data pages become executable, while tracing is on
+- XSAVEC raises an illegal instruction under Rosetta and is not converted, because it writes the compacted format. XSAVEOPT, which also faults there, is rewritten to XSAVE in place by the [matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp) under `--to-rosetta` (`0F AE /6` becomes `/4`; prefixes and operand are kept). The two differ only in the init and modified optimizations, which let XSAVEOPT skip writing unchanged or initial state ([Intel SDM volume 1](https://cdrdv2-public.intel.com/812382/253665-sdm-vol-1.pdf), chapter 13), so XRSTOR restores the same state from either area. Measured on one M5 with macOS 27.0.1: XSAVE and XRSTOR handle x87, SSE and AVX state in the standard format, although CPUID leaf 1 reports neither XSAVE nor OSXSAVE and leaf 0xD sub-leaf 1 reports neither XSAVEOPT nor XSAVEC. The converter tests' x86-64 build executes the replacement XSAVE under Rosetta on that host.
+- `--trace-imports` ([Windows entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp), [Linux entry stub](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp), [macOS entry](../../../core/relinker/elfpatcher/src/macos/MacOsImage.cpp)) leaves every import that is not a PLT slot or a function GOT slot untraced, and the same for a function reached through any other relocation, `sceKernelDlsym`, a weak import, or a module loaded at run time. On Linux the entry stub makes the page of every traced slot readable, writable and executable with `mprotect` before it stores the thunk, so a slot inside `PT_GNU_RELRO` can be replaced; those pages stay writable, and data pages become executable, while tracing is on. On macOS the stub writes the thunk into the bound slot and does not change its protection, because that slot stays in a writable segment
 
 - [ANDN lowering](../../../core/relinker/codegen/src/x86/AndnLowering.cpp) uses scalar NOT and AND for 32- and 64-bit register and memory operands under `--to-rosetta`, following the ANDN entry in [Intel SDM volume 2A](https://cdrdv2-public.intel.com/812383/253666-sdm-vol-2a.pdf). SF and ZF follow the result, CF and OF clear, and AF and PF are undefined. The scratch register is saved below the 128-byte red zone. A 64-bit stack-relative displacement that exceeds signed disp32 after reserving the spill frame throws; other BMI instructions are not lowered. The M1 test covers register overlap, RSP operands, memory addressing, RIP relocation, flags and red-zone preservation; precise fault delivery inside a spill sequence has not been verified.
diff --git a/docs/dev/debt/shader.md b/docs/dev/debt/shader.md
index 2b6ace99db..e7aba24b21 100644
--- a/docs/dev/debt/shader.md
+++ b/docs/dev/debt/shader.md
@@ -2,6 +2,8 @@
 
 ### Build
 
+- [GuestContext memory](../../../core/shader/recompiler/Recompiler.hpp) rejects direct construction from temporary owning ranges. The view does not own the region array or its referenced bytes. That storage must outlive the request and its consumers, including when supplied through named containers, existing spans or pointers.
+
 - winpthreads initializes a statically initialized rwlock on its first lock and fails a concurrent first lock with `EINVAL`, which `std::shared_mutex` and `std::shared_timed_mutex` ignore, so that lock does not exclude. The host `std::shared_mutex` objects in [Recompiler.cpp](../../../core/shader/recompiler/Recompiler.cpp) are locked once when created. A new host `std::shared_mutex` used on Windows needs the same.
 
 - The bundled [SPIRV-Tools build](../../../core/shader/recompiler/PatchSpirvTools.cmake) replaces the redundancy-elimination source with a build-directory copy. A depth-first traversal keeps one value map and removes each subtree's added values on return, avoiding growing map copies and preventing sibling values from leaking into one another. This extends the processed-map release fix in [SPIRV-Tools #6962](https://github.com/KhronosGroup/SPIRV-Tools/pull/6962). Remove the patch when the pinned dependency has equivalent copy-free traversal; #6962 alone still copies maps for sibling branches. System-dependency builds need an equivalent fix in their installed package. Optimization passes and validation remain unchanged; wider shader and game performance measurement is needed.
@@ -12,7 +14,7 @@
 - [MSAA-address image loads on 2D textures](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) - 32-bit `image_load` with DIM 2D_MSAA reads a non-multisampled 2D T# as the same DIM 2D load, ignoring the sample index. Measured on RX 6650 XT (gfx1032), wave32 and wave64, for R32_UINT, R32_FLOAT, RGBA8_UNORM and RGBA8_SRGB, sample indices 0/1/2/7/31/0xffffffff and in-range/out-of-range coordinates; IEEE 0, DX10 clamp 1, denorm32 0, denorm16 3, round32/16 0, fp16 overflow 0. Pinned in ImageMsaaAddressOnPlane.cpp. Not measured on gfx1013. Stores, atomics, mip-bearing or A16 addresses, packed accesses, converted formats, depth-bit views, array-MSAA addresses and image-table accesses are not enabled by this compatibility mode.
 
 - [MUBUF/MTBUF descriptors ending in VCC](../../../core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp): the four dword descriptor at s104 is s104, s105, vcc_lo and vcc_hi, as LLVM's [VCCTuple/SReg_128](https://github.com/llvm/llvm-project/blob/d8219b47422f7322db252ad29ca8ea87993fb433/llvm/lib/Target/AMDGPU/SIRegisterInfo.td#L422) and [buffer resource operands](https://github.com/llvm/llvm-project/blob/d8219b47422f7322db252ad29ca8ea87993fb433/llvm/lib/Target/AMDGPU/BUFInstructions.td) describe. Existing translation maps scalar codes106/107 to the raw VCC words. Recompiled loads/stores, both words, bounds, formats and wave32/wave64 execute on NVIDIA and AMD Vulkan; raw gfx10/gfx1013 hardware is not measured. Higher descriptor bases remain refused; the normal SGPR bound is unchanged.
-- [Packed pixel ancillary word](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) (shader recompiler) - the sample index at bits 8-11 and the render target index at bits 16-28 follow #295. The sample index is the SampleId builtin in a pixel shader the guest iterates per sample (`PS_ITER_SAMPLE` on a multisampled draw), an equality inferred, not measured. In any other pixel shader it is 0, the iterated sample number of a pixel the hardware does not iterate (also inferred), so reading it does not make the host shade per sample. The render target index is the Layer builtin when the draw exports it (a layered draw, `PA_CL_VS_OUT_CNTL` bit 18; the pipeline specialization constant `LayerExported`) and 0 otherwise, the first layer Vulkan renders when no pre-rasterization stage writes Layer. Reading the unwritten Layer builtin instead makes AMD's Windows driver drop the fragment's writes (#4800); with the constant at 0 the load is folded away. Mesa reads both fields from those bits, with the layer 14 bits wide only from GFX12 on ([ac_nir_lower_intrinsics_to_args.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/amd/common/nir/ac_nir_lower_intrinsics_to_args.c#L342-L368)). A value passed through a select, move or phi whose every read is an extract inside one of those fields is rebuilt from the two fields alone. Any other read the masked-select pass cannot drop gets the whole word: the primitive class at bits 0-1 (0 point, 1 line, 2 triangle, 3 rectangle), which the draw sets as a pipeline specialization constant ([RasterPrimitiveOf](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp)) in the shaders that read it, plus the sample field, with every other bit zero. That layout comes from the RDNA 3 and 3.5 ISA guides (prim type 1:0, VRS rates 3:2 and 5:4, eye id 7, sample 11:8, render target index 28:16). The GCN register guides give the same prim type and sample fields and put the render target index at 26:16, so the two sources agree for layers below 2048. AMD's LLPC reads the primitive class from bits 1:0 with the same encoding ([LowerGlCompatibility.cpp](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/llpc/lowering/LowerGlCompatibility.cpp#L830-L836)) and without a GFX-level check ([getPrimType](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/lgc/lowering/LowerInOut.cpp#L5307-L5315)). Nobody has checked it on gfx1013. In the whole word only bits 0-1 and 8-11 have a source. Bits 2-7, 12-15 and 29-31 are assumed zero, not measured: the VRS rates (2-5) and the eye id (7) because the driver supports neither variable-rate shading nor multiview, so a title that enables either would read other bits on the console, and bits 6, 12-15 and 29-31 because no source gives them a meaning. The sample field reads SampleId only in iterated shaders. The whole word has the same 0 at bits 16-28. A change that makes draws export a layer must restore the Layer read in both places
+- [Packed pixel ancillary word](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) (shader recompiler) - the sample index at bits 8-11 and the render target index at bits 16-28 follow #295. The sample index is the SampleId builtin in a pixel shader the guest iterates per sample (`PS_ITER_SAMPLE` on a multisampled draw), an equality inferred, not measured. In any other pixel shader it is 0, the iterated sample number of a pixel the hardware does not iterate (also inferred), so reading it does not make the host shade per sample. The render target index is the Layer builtin when the draw exports it (a layered draw, `PA_CL_VS_OUT_CNTL` bit 18; the pipeline specialization constant `LayerExported`) and 0 otherwise, the first layer Vulkan renders when no pre-rasterization stage writes Layer. Reading the unwritten Layer builtin instead makes AMD's Windows driver drop the fragment's writes (#4800); with the constant at 0 the load is folded away. Mesa reads both fields from those bits, with the layer 14 bits wide only from GFX12 on ([ac_nir_lower_intrinsics_to_args.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/amd/common/nir/ac_nir_lower_intrinsics_to_args.c#L342-L368)). A value passed through a select, move or phi whose every read is an extract inside one of those fields is rebuilt from the two fields alone. Any other read the masked-select pass cannot drop gets the whole word: the primitive class at bits 0-1 (0 point, 1 line, 2 triangle, 3 rectangle), which the draw sets as a pipeline specialization constant ([RasterPrimitiveOf](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp)) in the shaders that read it, plus the two fields, with every other bit zero. That layout comes from the RDNA 3 and 3.5 ISA guides (prim type 1:0, VRS rates 3:2 and 5:4, eye id 7, sample 11:8, render target index 28:16). The GCN register guides give the same prim type and sample fields and put the render target index at 26:16, so the two sources agree for layers below 2048. AMD's LLPC reads the primitive class from bits 1:0 with the same encoding ([LowerGlCompatibility.cpp](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/llpc/lowering/LowerGlCompatibility.cpp#L830-L836)) and without a GFX-level check ([getPrimType](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/lgc/lowering/LowerInOut.cpp#L5307-L5315)). Nobody has checked it on gfx1013. In the whole word only bits 0-1, 8-11 and 16-28 have a source. Bits 2-7, 12-15 and 29-31 are assumed zero, not measured: the VRS rates (2-5) and the eye id (7) because the driver supports neither variable-rate shading nor multiview, so a title that enables either would read other bits on the console, and bits 6, 12-15 and 29-31 because no source gives them a meaning. The sample field reads SampleId only in iterated shaders. The whole word has the same render target index at bits 16-28
 - [Front-face input with `FRONT_FACE_ALL_BITS`](../../../core/shader/recompiler/Translation/src/InstructionTranslator.cpp) (shader recompiler) - with `SPI_BARYC_CNTL.FRONT_FACE_ALL_BITS` set, a back face reads 0 and a front face 0xffffffff. Mesa 22.0 RADV sets the bit ([radv_pipeline.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-22.0.0/src/amd/vulkan/radv_pipeline.c#L5953)) and ACO tests the input with `v_cmp_lg_u32 0` ([aco_instruction_selection.cpp](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-22.0.0/src/amd/compiler/aco_instruction_selection.cpp#L8123-L8128)), so only back = 0 and front ≠ 0 are sourced; PPSA05684's two-sided cloth shaders test it with `v_cmp_lt_u32 0`. The exact front value is not measured. Without the bit the input is ±1.0, as current Mesa reads it (`fgt 0`, `fsign`; [ac_nir_lower_intrinsics_to_args.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/amd/common/nir/ac_nir_lower_intrinsics_to_args.c))
 - [Color comparison descriptor forms](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp): for formats AnyPS5 can sample as floating-point from GFX10 codes 1–77, `image_sample_c*` returns 0 for every comparison function except codes 7 (`16_UNORM`) and 22 (`32_FLOAT`), which use the native comparison path. The split was measured with point sampling on RDNA2 (gfx1031 and gfx1036) and with point and bilinear sampling on RDNA3 (gfx1100); the PS5's gfx1013 and 2D-array/cube comparisons across these formats remain unverified. Codes 128–130 (8-bit sRGB) also return 0, measured on gfx1035 over references -0.5..1.5 and texel codes 0..255. Scaled, integer and formats requiring converted sampling remain unsupported, although the tested hardware formats also return 0 for them. Anisotropic comparison of the remaining formats has not been measured.
 - [s_setkill](../../../core/shader/recompiler/RdnaDecoder/src/RdnaScalarOpDecoder.cpp) (core/shader/recompiler) - decoded as `s_endpgm` for any immediate: measured on RDNA2 hardware (gfx1035), a store before it is visible and nothing after it runs ([#771](https://github.com/boykopovar/AnyPS5/pull/771)); whether the KILL status bit it sets is observable differently from `s_endpgm` is unverified
@@ -20,11 +22,12 @@
 - [s_subvector_loop_begin and s_subvector_loop_end](../../../core/shader/recompiler/Translation/src/ControlFlowInstructions.cpp) (core/shader/recompiler) - follow AMD's RDNA 2 instruction set reference and a gfx1036 (wave64) measurement, pinned in [SubvectorLoop.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/SubvectorLoop.cpp); `S0` in the end instruction's `elif(S0 == 0)` is read as its SGPR operand. A wave32 shader and a destination other than an SGPR throw because neither is measured. The begin instruction tests for an empty mask as `(exec_lo | exec_hi) == 0`: AMD's Windows driver (32.0.21045.5002 and 32.0.21042.62) compiled `exec_lo == 0 && exec_hi == 0` as a test of the whole 64-bit mask when guest loads use selects, as they do with `robustBufferAccess2` (#7376, #7623). Measured on PC RDNA2 (Radeon 610M), not on a PS5. The [specialization pass](../../../core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp) keeps a constant-condition branch whose untaken target is a loop header, since folding it removes the loop's back edge, which SPIR-V requires exactly once per loop header (SPIRV-Tools rejects the module and the NVIDIA driver 615.78.08 crashes compiling it); a loop whose back-edge block becomes unreachable in another way is not handled
 - [Vertex entry merged wave info](../../../core/shader/recompiler/Translation/src/InstructionTranslator.cpp) (recompiler) - `s3` of every vertex-path shader is set to `waveSize | waveSize << 8` (vertex and primitive count of a full wave, wave index 0), or to `32 | 32 << 8` for a wave64 program on a 32-lane host subgroup, which runs it at one lane per invocation and holds no lanes 32-63. On a device whose `subgroupSupportedStages` lacks the vertex stage (lavapipe, MoltenVK), vertex and local programs run as one-lane waves: `s3` is `1 | 1 << 8`, the lane id is 0, a ballot is the invocation's own bit, a shuffle or broadcast returns the invocation's value, an elect is true and a subgroup reduction is the value itself, so no `GroupNonUniform` capability is declared. Layout taken from the prologue Mesa's ACO emits for NGG vertex shaders (`s_bfe_u64 exec` from `s3`), not measured on hardware. The driver gives every graphics program user data from `s8`, so the condition does not tell NGG from legacy vertex shaders: they just never read `s3`. A draw whose last wave is partial still reports a full wave, and so does a host wave with idle invocations (an RTX 5070 ran every vertex warp of a non-indexed triangle list with 30 of its 32 invocations).
 - [s_barrier in vertex-path programs](../../../core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp) (recompiler) - emits no instruction when the program has no LDS or GDS access and no memory write or atomic, so no wave of the subgroup can observe another, or when the barrier runs before every memory access of the program (it is on the entry's straight-line path with no load, store, atomic, image or LDS access ahead of it), so it orders nothing; the `GS_ALLOC_REQ` such a barrier orders on NGG passthrough programs is already dropped on the vertex path. The Vertex execution model has no workgroup barrier. Other programs with LDS, GDS or memory writes throw. Not measured on hardware
-- [Vertex clip and cull distances](../../../core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp) (libSceAgcDriver) - `PA_CL_VS_OUT_CNTL` enable bit `s` of `CLIP_DIST_ENA`/`CULL_DIST_ENA` is taken to select component `s` of the `pos1`/`pos2` exports, with the Vulkan array index counted by the enabled bits below it, and `VS_OUT_CCDIST0_VEC_ENA` as bit 22; this follows the recompiler's existing position-export mapping, not hardware or documentation. The guest clip distances share one `gl_ClipDistance` array with the all-zero clip position distance, which takes the index after them. A vertex program whose own code has no `pos1`..`pos3` export is compiled and prepared without these bits (`PositionExportLayout`), so registration and draws agree on its artifact; an export in a subroutine it calls is not seen by that scan
+- [Vertex clip and cull distances](../../../core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp) (libSceAgcDriver) - `PA_CL_VS_OUT_CNTL` enable bit `s` of `CLIP_DIST_ENA`/`CULL_DIST_ENA` is taken to select component `s` of the `pos1`/`pos2` exports, with the Vulkan array index counted by the enabled bits below it, and `VS_OUT_CCDIST0_VEC_ENA` as bit 22; this follows the recompiler's existing position-export mapping, not hardware or documentation. The guest clip distances share one `gl_ClipDistance` array with the all-zero clip position distance, which takes the index after them. A vertex program whose own code has no `pos1`..`pos3` export is compiled and prepared without these bits (`PositionExportLayout`), so registration and draws agree on its artifact; an export in a subroutine it calls is not seen by that scan. A device without `shaderCullDistance` (MoltenVK) throws on a draw that enables a cull distance; none is emulated.
 - [32_AR color exports](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - with `SPI_SHADER_COL_FORMAT` 3 the red value is export channel 0 and the alpha is export channel 1, the GFX10 layout of Mesa's [`emit_ps_color_export`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/3e32b0e1f132231b7a972c1b0b5b06c7e16cf8b9/src/amd/common/nir/ac_nir_lower_ps_late.c#L400-L411), ACO and radeonsi in Mesa 22.0 ([aco_instruction_selection.cpp](https://gitlab.freedesktop.org/mesa/mesa/-/blob/a82920af6efa4a7a66919885c6477fbd8fdc7b9d/src/amd/compiler/aco_instruction_selection.cpp#L11087-L11096), [si_shader_llvm_ps.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/a82920af6efa4a7a66919885c6477fbd8fdc7b9d/src/gallium/drivers/radeonsi/si_shader_llvm_ps.c#L323-L333)) and AMD's [LLPC](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/lgc/lowering/FragmentColorExport.cpp#L157-L168); before GFX10 the alpha was channel 3. Channels 2 and 3, which none of these compilers enables, are ignored; green and blue are 0 and the alpha of an export without channel 1 is 1.0, the defaults of the other formats, which no source gives. Not measured on hardware, neither on gfx1013 nor on a PC RDNA 2 GPU; pinned in [Pixel32ArExport.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/Pixel32ArExport.cpp)
 - [GCN instructions](../../../core/shader/recompiler/RdnaDecoder/src/GcnInstructionDecoder.cpp) (shader, PS4) - PS4 (Sea Islands) instructions are re-encoded to their RDNA encodings with opcode tables built from shadPS4's `opcodes.h` and decoded by the RDNA decoder; an encoding without an RDNA counterpart throws. MIMG has no DIM field on GCN: the dimension is taken as 2D, or 2D array when DA is set, and the [materializer](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) rejects a T# whose type needs another address count. MIMG word 1 bits [31:26] are reserved on GCN (A16 and D16 on RDNA).
 - [GCN buffer and image descriptors](../../../core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp) (shader, PS4) - a GCN V# word 3 (DATA_FORMAT [18:15], NUM_FORMAT [14:12], names read from the most significant field) is rewritten to the unified format of the PS5 layout with OOB_SELECT 1 for a strided buffer and 3 otherwise, following the GFX6-7 NUM_RECORDS rules in Mesa's `ac_descriptors`; ATC, HASH, HEAP and MTYPE are dropped. The V# base is 44 bits, as in shadPS4's `AmdGpu::Buffer`: Limbo leaves 0x7 in word 1 bits [15:12]. A GCN T# is rewritten to the PS5 layout with SW_MODE linear, keeping TILING_INDEX [4:0], POW2_PAD [5] and PITCH - 1 [19:6] in word 7. None of it is checked on a console.
 - [PS4 legacy vertex shaders](../../../core/shader/recompiler/Recompiler.cpp) (shader, PS4) - a PS4 vertex program at the VS slot takes its user data from s0, its vertex index in v0 and its instance index in v1-v3, and a fetch shader it calls through the user pair (`s_swappc_b64 s[0:1], s[0:1]`) returns through the same pair. These rules apply only while GCN shaders are decoded.
+- [4_4_4_4 partial writes, refused draws](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp) (shader recompiler) - a merge throws when its shader exports depth, stencil or a sample mask, uses alpha-to-coverage or a quad sample mask, kills pixels under late tests in a draw that writes depth or stencil (a depth write, or a stencil test with a nonzero write mask and a non-keep operation), writes guest memory (stores, atomics, GDS writes) under late tests in a draw with a depth, stencil or depth-bounds test, as the forced early tests would drop the writes of rejected pixels, or kills pixels under late tests after the game has read an occlusion counter, as the early tests would count them. On an RTX 4070 SUPER (driver 610.88) a fragment killed after early tests still wrote depth, and `FragDepth` was ignored with `EarlyFragmentTests`, so the depth write cannot move after the shader there.
 
 ### Functional
 
@@ -32,8 +35,11 @@
 - [Windows cache housekeeping](../../../core/shader/recompiler/ShaderDiskCache.cpp): eviction of old versions and temporary files is skipped for `\\?\` and `\\.\` cache roots because the supported WinLibs directory iterator can enumerate the process working directory for long prefixed paths. The active version's `last-used` stamp update still runs; it fails for long `\\.\` aliases with the supported toolchain. Ordinary Windows directory enumeration remains subject to MAX_PATH.
 
 - [f64 compares](../../../core/shader/recompiler/Translation/src/CompareInstructions.cpp) flush denormal inputs to signed zero when bit 0 of the `FLOAT_MODE` f16/f64 denormal field is clear (modes 0 and 2); modes 1 and 3 and an unknown mode keep them. This follows the RDNA2 ISA section 6.4 and LLVM's sign-preserving AMDGPU denormal modes. The gfx1036 audit in [#981](https://github.com/boykopovar/AnyPS5/issues/981#issuecomment-6070046381) reports mode-sensitive `VopcCompareF64` results. Class compares still inspect the original bits. The full four-mode matrix has not been newly measured on AMD hardware or the PS5's gfx1013.
+- [Shader disk cache source version](../../../core/shader/recompiler/ShaderCacheVersion.cmake) - the version that names `shader_cache/<version>` and stamps `pipelines.journal` hashes every file under `core/shader/recompiler` (line endings normalized), `HostThreadLocal.hpp`, the SPIR-V and glslang submodule commits, and the compiler, build type and flags. Any edit there changes it and empties the cache, including edits that cannot change a translation (logging, the disk cache's own I/O, the recompiler's tests), and so does a rebuild with another compiler or flags. Driver sources outside the recompiler are not hashed: their recompiler calls are only checked against `shaderCacheReviewedNames`, so a driver change that alters a `RecompileRequest` field's meaning without changing its value keeps a stale cache.
 - [Unlinked calls](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) - the `s_swappc_b64` a table call's compare chain falls back to, when its target matches no linked copy, records the `UnlinkedCall` fault with the target and the program counter and stops the invocation, or continues after the call in programs whose faults do not stop invocations (see `bdaStopsInvocations`). The driver lists those calls in the request (`linkedCallFallbacks`), and it reports the fault like a BDA fault, naming the target: a dispatch that checks its faults when it completes throws, one whose check runs in a deferred write-back logs it and continues. The hardware would jump to the target, which is not modelled. Any other `s_swappc_b64` whose target is not resolved still throws when the shader is compiled.
 - [Cached source IR](../../../core/shader/recompiler/Recompiler.cpp) releases lazily allocated SSA construction tables after resource preparation and reclaims values unreachable from instructions, metadata and resource plans when retaining a pending source program. Immediate shader preparation skips reclamation because compilation consumes the program. Reclamation must account for every new IR pointer owner; a remaining external use throws. Live IDs are retained. Source and variant entries remain cached without an eviction bound. A pending source program is released after its first variant is obtained; memory beyond the measured title checkpoint and Linux performance remain unmeasured.
+
+- Cycles through non-phi instructions are not removed by [unobserved phi elimination](../../../core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp). The pass removes phi-only cycles before resource planning when no transitive user is a non-phi instruction.
 - [Vertex user-data tail jumps](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) link a linear raw vertex prolog's terminal `s_setpc_b64` through an unchanged user-data pair to its continuation. The instruction semantics follow AMD RDNA2 ISA section 12.3; the prolog convention follows Mesa `aco_select_vs_prolog.cpp` at `0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8`. Console hardware has not been measured. Branching prologs, computed low pointers and continuations reading `s_getpc_b64` remain unsupported
 - [Raw fragment user-data tails](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) also link a terminal `s_setpc_b64` when the low half is unchanged user data and the last high-half writer is an unconditional immediate `s_mov_b32`. Other computed high halves remain unsupported. This follows AMD RDNA2 ISA section 12.3 and Mesa `aco_select_nir.cpp` (`create_fs_jump_to_epilog`), `aco_isel_helpers.cpp` (`convert_pointer_to_64_bit`) and `aco_lower_to_hw_instr.cpp` (`p_jump_to_epilog`) at `0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8`; console hardware has not been measured
 
@@ -46,8 +52,9 @@
 - An [image table](../../../core/shader/recompiler/Optimization/src/ResourceTracker.cpp) whose key is neither a V#-relative scalar read nor a value the SRT walker evaluates (for example a shifted or masked runtime-offset V# read, a per-lane value made uniform by `v_readfirstlane`, or a loop-carried phi) binds every record of the snapshot domain instead of the selected ones. So does a table read at `(key << n) & mask` with such a key: a key domain would select records by the unmasked key, so that key is not narrowed. A key the walker evaluates selects its one record instead, unless the shader may write the memory the key is read from at run time (the same buffer, or any memory when the read or a write goes through a pointer or a GPU-only descriptor); then the column binds the whole domain too. A write to the key's memory through another V# over the same bytes is not detected. A shader whose selected records would pass 64 images or 64 sampled image/sampler pairs binds, for the heaps with the most such reads, the union of their keys in one table instead.
 - [Image table pointer indexing](../../../core/shader/recompiler/Optimization/src/ResourceTracker.cpp) propagates 32-bit value bounds through `ReadFirstLane` and `SelectU32` so waterfall key masks keep their bit domain. The SRT walker validates runtime select conditions whose active lane mask implies the condition through `LogicalAnd` conjunctions, assuming unselected inactive lanes need not be uniform across the full wave. The same assumption lets the two `s_load`s of one T# record match when one offset is added before `v_readfirstlane` and the other after (`ReadFirstLane(Select(mask, (key << 5) + 16, old), mask)` against `ReadFirstLane(key, mask) << 5`): with no active lane the hardware reads lane 0 of the inactive arm, and the table still binds the whole record.
 - An [image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) T# of an MSAA or FMASK image, or of a color format under a depth compare, faults when selected: tables have no multisampled descriptors and no emulated color compare.
-- Direct [FMASK image loads](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) read uncompressed `Fmask32_S8_F8` through a single-mip 2D or 2D-array `R32_UINT` snapshot with `Z_64KB_X` addressing. Destination selectors may name X, zero or one. Other FMASK formats, CMASK compression, packed accesses and other layouts throw. The layout follows PAL's [FMASK-to-surface conversion](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L877) and [32-bit view selectors](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9Device.cpp#L4973). Native RDNA/PS5 image-load results and title rendering are unmeasured; compressed color sampling remains unsupported.
-- `image_store`, image atomics, PCK2/PCK4 and MIMG BY2/BY4 through an [image table](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) T# fault (`unsupported operation`) when an active lane executes them; the store is dropped and the load reads zeros. A T# whose words the SRT walker evaluates is bound directly instead, for every operation of the shader on it (`DirectImageHandles`), so only T#s keyed per lane or by a value the walker cannot evaluate reach a table with these operations; such a direct T# is read when the work is recorded, so a key its own dispatch writes is read before that write.
+- Direct [FMASK image loads](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) of 16 samples, CMASK compression (bar the 8-fragment native owner path), packed accesses and other layouts throw. Uncompressed FMASK of up to 8 samples reads a single-mip 2D or 2D-array 8-, 16- or 32-bit `UINT` snapshot with `Z_64KB_X` addressing; selectors may name X, zero or one. `Fmask32_S8_F8` returns the stored word; others expand to 4 bits per sample, an index at or past the fragment count reading 8 (unknown), samples past the count 0. Layouts follow PAL's [expanded values](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9MaskRam.cpp#L5005) and [FMASK surfaces](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L877). Console results, unused nibbles included, are unmeasured; compressed color sampling is unsupported.
+- A [DIM 2D read of a 2D MSAA T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) returns sample 0, which is not measured on the console's gfx1013, at an implicit LOD above 0, at an explicit one for texels over 16 bits except formats 22 and 56 in SW_64KB_R_X, or for other formats and swizzle modes; 64- and 128-bit SW_64KB_Z_X texels are not covered: gfx1031 does not address their samples. Such a read is an `image_load` without a mip, `image_sample`, `image_sample_lz` or `image_sample_l` of a direct sampled image; other accesses (gathers, bias, gradients, offsets, LOD clamps, depth compares, `image_load_mip`, `image_get_resinfo`, `image_get_lod`, PCK, BY2/BY4) throw, as does a depth-bits T# (16_UINT, 32_UINT or 32_SINT in a Z swizzle mode). On gfx1031 (RX 6700 XT, HIP), such reads return sample 0 at 2x, 4x and 8x for 8- to 128-bit texels in SW_64KB_R_X and 8- to 32-bit ones in SW_64KB_Z_X (formats 1, 5, 7, 11, 13, 14, 18, 22, 29, 56, 60, 64, 71, 77, 133).
+- `image_store_mip`, `image_store_pck`, PCK2/PCK4 and MIMG BY2/BY4 through an [image table](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) T# fault (`unsupported operation`) when an active lane executes them; the store is dropped and the load reads zeros. 32-bit and 64-bit image atomics through a table lower to `OpAtomic*` on the table `AtomicView`/`Atomic64View` (`Device` scope, relaxed, `AcquireRelease`/`UniformMemory` barrier as the direct path) instead of faulting; the host needs `VK_FORMAT_FEATURE_STORAGE_IMAGE_ATOMIC_BIT` for the view format. Packed formats and BY element counts still fault.
 - An [image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) S# with a min or max reduction or FORCE_UNNORMALIZED faults when selected, as does an integer, converted or depth-bits table T# paired with a direct min or max S# that filters between texels.
 - Uint and Sint [image table](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp) entries and direct T#s under a table S# sample through a point-filtered copy of the S#: Vulkan leaves linear filtering of integer formats undefined; the console is assumed to point-sample.
 - Comparison sampling of a color texture through an [image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) S# throws at the first dispatch or draw that binds it.
@@ -60,12 +67,14 @@
 - [MIMG `tfe` and `lwe`](../../../core/shader/recompiler/RdnaDecoder/src/RdnaImageOpDecoder.cpp) never write the status VGPR after the data. On hardware it is written only when a texel fetch hits an unmapped page of a partially resident texture, or, for `lwe` on sample/gather, when the LOD is below the T# `MIN_LOD_WARN`; texture memory is always resident here, the LOD warning (texture-streaming feedback, like the T# `MIN_LOD_WARN` itself) is never reported, and `lwe` on `image_get_lod` throws.
 - [Packed horizontal gathers](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_gather4h_pck`, MIMG opcode 98): the four window texels are read raw and concatenated into a little-endian bitstream, with DMASK bit i writing stream word i to the next destination register; measured on RDNA2 (gfx1031) at every edge: the anchor is floor(x-0.5) with elements at -1, 0, +1 and +2 clamped horizontally into the width, the row is floor(y), negative rows clamp to row 0, rows at or past the height return zeros, sampler addressing modes do not affect the window, and formats wider than 32 bits per texel write zeros in every register. The emitter fetches each window texel at LOD 0 and packs its bits like `image_load_pck`, so the sampler's filter, addressing and LOD state are not used; formats whose bits are not recoverable from the view and D16 data throw. The anchor and row multiply the normalized coordinate by the image size without contraction. The stream rule was measured for R8_UNORM, RG8_UNORM and RGBA8; only RGBA8 has an execution test. `image_gather8h_pck` (opcode 99) never returns texel data on this hardware - across dmasks 0x1 to 0xFF including the upper nibble, RGBA8, RGBA16 and RGBA32 formats, 1D, 2D and 3D descriptors and normalized and unnormalized sampling it only zero-fills popcount(dmask) registers (sentinel-prefilled destinations) - so it decodes but throws at translation; its eight-texel semantics remain unmeasured.
 - [MIMG BY2/BY4 loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_load[_mip]_by2/by4`, opcodes 0x42, 0x43, 0x4a and 0x4b) were measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md) for 2D images with identity swizzle. They read N texels (BY2: 2, BY4: 4) from `x & ~(N - 1)` on row y, texel by texel and component by component within each texel, with each texel converted like `image_load`. Every register is zero when the mip level is past the last level, `x + N - 1` is outside the level's width (unaligned x, unsigned), or y is outside its height. Data only comes back when the N texels fit in one dword: R8 and R16 (DMASK 0x3) or RG8 (0xf) for BY2, and R8 (0xf) for BY4. With 32-bit texels (R32, RG32, RG16, RGBA8) the hardware returns zeros. Other formats, masks, dimensions, swizzles, D16/A16 and indirect descriptors throw. The stores (0x52, 0x53, 0x5a and 0x5b) decode but throw at translation. Measured on hardware, they write from the unaligned x up to the end of its dword, which is not implemented.
-- [2D stores to 1D storage images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp): an `image_store` with DIM 2D through a 1D T# writes texel x and ignores y, as measured on RDNA2 (gfx1035) for y from 0 to 4 and 0xffffffff, single- and four-component formats and a 1x1 8_8_8_8_UNORM T#: the T# type decides the addressing, DIM only how many address VGPRs are read. Storage loads, atomics and `image_store_mip` through such a pair still throw
+- [2D stores to 1D storage images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp): an `image_store` with DIM 2D through a 1D T# writes texel x and ignores y, as measured on RDNA2 (gfx1035) for y from 0 to 4 and 0xffffffff, single- and four-component formats and a 1x1 8_8_8_8_UNORM T#: the T# type decides the addressing, DIM only how many address VGPRs are read. An `image_store` with DIM 2D_ARRAY through a 1D T# writes texel x, ignoring y, only when the slice is 0, and is dropped for any other slice: measured on RDNA2 (gfx1036) with the [hardware oracle](../HW_ORACLE.md) through the AMD Windows driver's comgr and HIP runtime (wave32, IEEE off, DX10 clamp on, denormals preserved, round to nearest even) on a 64-texel linear 32_UINT T# with DEPTH 0 and 3, for x of 0, 5 and 63, y of 0, 1, 3 and 0xffffffff and slices 0, 1, 2, 5 and 0xffffffff; the PS5's gfx1013 is not measured. Storage loads, atomics and `image_store_mip` through such a pair still throw
 - [MIMG PCK2/PCK4 loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_load[_mip]_pck2/pck4`, opcodes 0x70, 0x71, 0x73 and 0x74) were measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md) for 2D images with identity swizzle. With data mask 0x1, they write one dword: the raw bits of the N texels (PCK2: 2, PCK4: 4) from `x & ~(N - 1)` on row y, concatenated (element k at bit `k * texel bits`) and zero-extended. The dword is zero when the mip level is past the last level, `x + N - 1` is outside the level's width (unaligned x, unsigned), or y is outside its height. Data only comes back when N texels fit in 32 bits: R8, R16 or RG8 for PCK2, R8 for PCK4. Wider texels (R32, RG16, RGBA8) and masks other than 0x1 write zeros on hardware. Those masks throw at decode, and formats outside UNORM/UINT/SINT R8, R16 and RG8 throw. #1314's earlier measurement saw only zeros because it used masks 0x3 and 0xf. The stores (0x76, 0x77, 0x79 and 0x7a) decode but throw at translation. They are not measured, and opcode 0x76 on 32_32_32_32_FLOAT hung the GPU (#1314).
+- [`image_get_resinfo` through DIM 1D on a cube, 2D-array or 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) follows thuanquang's measurement on RDNA2 (RX 6700 XT, gfx1031, #7550), not the PS5's gfx1013: width, height and the level count come from the T#, and the third component is the 3D T#'s depth, or 0 for a cube or 2D array, as for every DIM without layers (1D, 2D, 2D MSAA). Such a query on a 1D-array T# still reads it as its first layer, whose height is not measured. On a 2D MSAA or 2D MSAA-array T# it throws: gfx1031 was measured only with one fragment, which the driver cannot bind, and the level component for 2, 4 or 8 fragments is not measured.
 - [3D image accesses bound to a 2D or 2D-array T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) follow CouchRiv's [hardware oracle](../HW_ORACLE.md) measurement on RDNA2 (gfx1036, #2023) and adriadam10's (gfx1035, #2140), not the PS5's gfx1013. On a 2D T#, `image_sample_lz` ignores r and reads the (u,v) texel, `image_load` and `image_load_mip` read the (x,y) texel when z is 0 and return zero otherwise, and `image_get_resinfo` returns (width, height, 1, levels). On a 2D-array T#, these accesses behave like dim 2D-array: r or z is the layer, and `image_get_resinfo` returns the layer count as its third component. Every other access of such an image, including samples with an LOD, bias, derivatives, offset or comparison, gathers, `image_get_lod` and stores, keeps throwing because it is not measured.
-- [2D-array samples through a 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) (`image_sample`, `image_sample_l` and `image_sample_lz` with DIM 2D_ARRAY) sample the volume as DIM 3D does: the third address VGPR is the normalized r coordinate, addressed by the sampler's Z mode (only wrap was measured), not a layer index, and a plain sample in a pixel shader takes its LOD from the derivatives of all three coordinates. Measured on RDNA2 (RX 6700 XT, gfx1031, driver 32.0.21045.5002, Windows 11) with the [hardware oracle](../HW_ORACLE.md) template run through the driver's comgr and HIP runtime, not on the PS5's gfx1013: on 16x16x4 R32_FLOAT 3D T#s with one and three levels, the three instructions with DIM 2D_ARRAY returned the same value as with DIM 3D in all 256 lanes of 66 cases (point, bilinear and z-linear filters, wrap addressing, r from -0.125 to 3, quad steps of 1 to 4 texels in u and v and of 0 to 4 slices in r, LOD 1). Other samples of such a pair (bias, LOD clamp, derivatives, offsets, comparison, 16-bit addresses), gathers, `image_get_lod` and a sample mixed with a load of the same image keep throwing because they are not measured. The host sampler ignores `Z_FILTER`, as for every 3D sample, so r is filtered with the XY filter.
+- [2D-array samples through a 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) (`image_sample`, `image_sample_l` and `image_sample_lz` with DIM 2D_ARRAY) are measured only on RDNA2 (gfx1031, [hardware oracle](../HW_ORACLE.md)), not on the PS5's gfx1013, and only with wrap addressing. They sample the volume as DIM 3D does: the third address VGPR is the normalized r coordinate, addressed by the S#'s `CLAMP_Z`, not a layer index. The host sampler ignores `Z_FILTER`, as for every 3D sample, so r is filtered with the XY filter. Other samples through such a pair (bias, LOD clamp, derivatives, offsets, comparison, `_a`, 16-bit addresses), gathers, `image_get_lod` and `image_get_resinfo` throw, as do the three samples of a T# selected from an image table, of a T# the program also loads with DIM 2D_ARRAY, and of an 11_11_10_UNORM, 11_11_10_UINT or depth-bits T#.
+- AMD image descriptors with `TYPE=0` are treated as null for [read-only image slots](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) even when the base and other words are nonzero: `image_load` on a gfx1035 with such a T# returns 0,0,0,0, and the same descriptors were seen in direct reads in PPSA01341 on an RTX 4070. Writable and atomic image slots and entries of an image table keep faulting because there is no hardware measurement for them, and the reserved types 2-7 also fault. `TYPE=1` is treated as null in the same read-only slots: gfx1035 reads it as zeros too, and gfx1010 returns zeros for `image_sample_lz`, `image_sample_b`, `image_load` and `image_get_resinfo` with format 22 (#5828); it is not measured on RDNA2, with other formats or with depth-compare reads (`image_sample_c*`). gfx1013 behavior is unverified
 - [2D accesses through a cube T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) (#4139) read the T#'s `BASE_ARRAY` face as a cube access with face coordinate 0 does, measured on RDNA1 (gfx1010, RX 5700 XT) with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime on 8x8 and 32x32 32_FLOAT cubes (`DEPTH` 5 and 11, `BASE_ARRAY` 0 and 6): `image_sample_lz`, plain `image_sample` (one level, and six levels in 2x2 compute quads) and `image_sample_l` (the third address VGPR is the LOD, integer and fractional) with DIM 2D equal DIM CUBE with face 0 on every row, with point and bilinear filters, wrap, clamp and mirror addressing and `DISABLE_CUBE_WRAP` 0 and 1, and the VGPR after the two coordinates is not read; `image_load` with DIM 2D reads texel (x, y) of the `BASE_ARRAY` face. So the face coordinates are cube coordinates in [1, 2]: the texel is `floor((u - 1) * width)`. They are translated through the cube mode DIM CUBE accesses use, which samples the face of the 2D-array view at (u - 1, v - 1) with the S# addressing. That matches the hardware inside the face, except within half a texel of its edges with a bilinear filter and `DISABLE_CUBE_WRAP` 0, where the hardware blends texels of the neighbouring faces (also measured on RDNA2, gfx1035, 8x8 cubes with `BASE_ARRAY` 0 and 6). Outside it the hardware clamps a coordinate below 1 to the first texel under every filter, wrap mode and `DISABLE_CUBE_WRAP` setting measured, clamps a coordinate of 2 or more to the last texel when `DISABLE_CUBE_WRAP` is 0 (point filter) and applies the S# addressing to it when it is 1; the translation does none of this, as for DIM CUBE. Only `image_sample_lz`, plain `image_sample`, `image_sample_l`, mip-less `image_load`, and mip-less `image_store` to an image the program only stores to take this mode. Such a store writes texel (x, y) of the `BASE_ARRAY` face, measured on RDNA2 (gfx1036, [by simonbbby](https://github.com/boykopovar/AnyPS5/pull/6799#issuecomment-6217609589), not the PS5's gfx1013) with the [hardware oracle](../HW_ORACLE.md) on 8x8 mip-less cube arrays (`DEPTH` 11) of 32_UINT, 32_FLOAT and 16_16_16_16_FLOAT ([the last also by simonbbby](https://github.com/boykopovar/AnyPS5/pull/6799#issuecomment-6224023050), with exactly representable half values) with `BASE_ARRAY` 0 and 6, wave32 and wave64: the 64 stored texels land on that face and every other byte of the 64 KiB backing is unchanged. Other formats, and Crimson Desert's own 256x256 tiled descriptor, are not measured. Other DIM 2D accesses through a cube T# (gathers, bias, comparison, offsets, derivatives, atomics, stores to an image the program also reads, stores of formats written through a conversion such as 32_SINT, mip loads and stores) still throw.
-- [Unnormalized S#s](../../../core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp) are accepted only when direct and used only by explicit-LOD `image_sample` without comparison, derivatives or `_a`, on a single-level, single-layer 1D or 2D view of mip 0, even when the image is also sampled through a normalized S#.
+- [Unnormalized S#s](../../../core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp) are accepted only when direct and used only by `image_sample` without comparison or `_a`, on a single-layer 1D or 2D view that is one level at mip 0 (even when the image is also sampled through a normalized S#), or that only unnormalized S#s sample, each without a mip filter or only by `image_sample_lz` without minimum LOD or bias.
 - [Unnormalized texel offsets](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) are added to the f32 coordinates: exact on RDNA2 (gfx1035), which applies the offset before the clamp ([measured by adriadam10](https://github.com/boykopovar/AnyPS5/pull/822#issuecomment-6033192725)).
 - [Cube image gradients](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (shader recompiler) - `image_sample_d` and `image_sample_cd` on a cube pass their gradients to the host sample without the -1.0 that moves the face coordinates from [1, 2] to [0, 1], as Mesa's AMD lowering builds them (`src/amd/common/nir/ac_nir_lower_tex_coords.c`, `prepare_cube_coords`: face-space derivatives with no offset, coordinates offset by 1.5). Measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md): on a 16x16 32_FLOAT cube with five levels, point mip filter, `image_sample_d` reads the level of `round(log2(16 * max(|ddx|, |ddy|)))` for gradients of 2^(level ± 0.3) texels on each of the four components, both signs, mixed components, every face and two coordinates (1032 rows). `image_sample_cd` takes one level per quad of lanes, from the gradients of its first lane; the host sample computes it per lane.
 - [Image atomics](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) on 32_SINT and 32_FLOAT surfaces act on the raw dword through an R32_UINT storage view. On gfx1100 (RDNA3, [hardware oracle](../HW_ORACLE.md), wave32 and wave64), all 13 integer image atomics, `swap` to `dec`, return the old dword and store the raw-dword result identically on 32_UINT, 32_SINT and 32_FLOAT T#s, over 121 old/data pairs per op, among them 0x80000000, 0xffffffff, 1.0, -1.0 and NaN: `add` adds the bits and `umin` is unsigned on every format. A 16_UINT control differs, so the format is read. gfx1031 (RDNA2) gives the same rows, and its `fmin`, `fmax` and `fcmpswap`, which gfx1100 lacks, also match on the three formats ([measured by thuanquang](https://github.com/boykopovar/AnyPS5/pull/7939#issuecomment-6275099482)). The console's gfx1013 is unmeasured. Other formats throw.
@@ -77,8 +86,9 @@
 - [8_SRGB and 8_8_SRGB loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) on a device that cannot sample R8_SRGB or R8G8_SRGB return the sRGB EOTF rounded to nearest even at bf16 precision, as adriadam10 measured on RDNA2 (gfx1035) in #866; the PS5's gfx1013 is not measured. This is the path on a device that cannot blit R8 or RG8 to RGBA8, and with `APS5_SRGB_SHADER_DECODE=1`; otherwise a load of a sampled texture reads the RGBA8 sRGB copy and gets the device's own decode.
 - [Samples and gathers](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) of 8_SRGB and 8_8_SRGB textures read an RGBA8 sRGB copy of the texture (libSceAgcDriver, [Texture.cpp](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp)) on a device that cannot sample R8_SRGB or R8G8_SRGB but can blit R8 or RG8 to RGBA8, so they use that device's own decode. They still throw on a device that cannot blit, and with `APS5_SRGB_SHADER_DECODE=1`. `APS5_SRGB_SHADER_DECODE=copy` also takes the copy on a device that samples these formats natively, so the copy can be tested on any device that can blit R8 or RG8 to RGBA8; on a device that cannot blit, it behaves like `APS5_SRGB_SHADER_DECODE=1`. A multisampled or depth view of these formats gets no copy.
 - [Bindless image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) entries of 8_SRGB and 8_8_SRGB textures read zeros, like converted formats, on a device that cannot sample R8_SRGB or R8G8_SRGB.
-- [Shader MODE register access](../../../core/shader/recompiler/Translation/src/RoundingMode.cpp) starts from the rounding fields of `GuestContext::floatMode` and follows immediate rounding writes (`s_round_mode`, `s_setreg_imm32_b32` on MODE bits 0-3) through the control flow graph; `s_getreg_b32` of those bits returns the tracked value. Only `v_cvt_f32_i32`, `v_cvt_f32_u32`, `v_ldexp_f32`, the f16 conversions and `v_ldexp_f16` (with f16 denormals kept) and the instructions that already read `FLOAT_MODE` follow a rounding mode set at run time; any other float instruction that runs while a directed rounding mode differs from the initial one throws at that instruction. Rounding bits written from an SGPR (`s_setreg_b32`) or that differ between the paths reaching an instruction throw where they are read or used. A shader without `FLOAT_MODE` metadata throws on any rounding change. Non-rounding register reads still throw; `s_setreg_b32` writes to other hardware registers are still ignored. Tests follow the public RDNA2/LLVM contract, not console measurements.
+- [Shader MODE register access](../../../core/shader/recompiler/Translation/src/RoundingMode.cpp) starts from the rounding fields of `GuestContext::floatMode` and follows immediate rounding writes (`s_round_mode`, `s_setreg_imm32_b32` on MODE bits 0-3) through the control flow graph; `s_getreg_b32` of those bits returns the tracked value. Only `v_cvt_f32_i32`, `v_cvt_f32_u32`, `v_ldexp_f32`, `v_cvt_pk_u8_f32`, the f16 conversions and `v_ldexp_f16` (with f16 denormals kept) and the instructions that already read `FLOAT_MODE` follow a rounding mode set at run time; any other float instruction that runs while a directed rounding mode differs from the initial one throws at that instruction. Rounding bits written from an SGPR (`s_setreg_b32`) or that differ between the paths reaching an instruction throw where they are read or used. A shader without `FLOAT_MODE` metadata throws on any rounding change. Non-rounding register reads still throw; `s_setreg_b32` writes to other hardware registers are still ignored. Tests follow the public RDNA2/LLVM contract, not console measurements.
 - [Flat scalar-read reachability](../../../core/shader/recompiler/Optimization/src/ResourceTracker.cpp) keeps both successors active for non-clean predicates and loop headers, so an inaccessible direct root on such a path still refuses capture. Skipping a read under a clean, evaluable scalar branch follows RDNA2 conditional PC semantics and synthetic fixtures; console execution and title behavior are unverified.
+- [v_cvt_pk_u8_f32](../../../core/shader/recompiler/Translation/src/ConvertInstructions.cpp): the PS5's gfx1013 is not measured. It rounds its source in the `FLOAT_MODE` f32 round mode (ties to even, toward +infinity, -infinity or zero), clamps it to 0..255 (a NaN gives 0) and flushes a denormal source when f32 denormals are flushed. A kept positive denormal gives 1 toward +infinity, decided on the bits, as a driver without `DenormPreserve 32` may flush it. Measured on RDNA2 (gfx1030, RX 6800, AMD Windows driver 32.0.21045.5002) over 2,133 sources (k/8 for k = -16 to 2,099, values next to 0.5 and 255.5, ±1e10, denormals, infinities, NaNs) at IEEE 0 and 1, f32 denormal modes 0 and 3 and f32 round modes 0 to 3, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even, FP16_OVFL=0. A round mode set by `s_round_mode` gives the results of the same mode in `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2,148 such sources in every f32 denormal and round mode.
 - A [flat SRT read](../../../core/shader/recompiler/Optimization/src/SrtWalker/SrtDescriptorEvaluation.cpp) through a null or unmapped pointer loaded from memory raises a [BDA fault](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp) only if the program executes it, then stops or reads zero like a BDA read.
 - Repeated `s_load`s of one [flat SRT](../../../core/shader/recompiler/Optimization/src/SrtWalker/SrtDescriptorEvaluation.cpp) dword through a null or unmapped pointer report one of their pcs, and an `s_load` whose inaccessible dwords are all unused, or only address repeated loads, reports no fault of its own.
 - A value read through a null or unmapped pointer still throws at record time if a [uniform fill or table base](../../../core/shader/recompiler/Optimization/src/SrtWalker/SrtDescriptorEvaluation.cpp) needs it, or if the pointer comes from user data and is not null, even if the console skips the read.
@@ -98,16 +108,16 @@
 - [Mesh shader grid size](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - every mesh shader loads `NumWorkgroups.x` and declares no vertices when it is 0, which no dispatch produces. The read is a workaround for RADV (Mesa 26.2.4, seen on an RX 9070 XT, GFX12): binding a mesh pipeline whose shader reads neither `NumWorkgroups` nor `DrawIndex` keeps the user SGPR count and draw-id flag of the vertex pipeline bound before it in the same command buffer (`radv_bind_pre_rast_shader` updates them only when the shader has the `AC_UD_VS_BASE_VERTEX_START_INSTANCE` slot), so `radv_emit_userdata_mesh` opens a 3-register `SET_SH_REG` and writes one value, the CP takes the following `DISPATCH_MESH_DIRECT` as register data and the GPU hangs (gfx ring timeout, MODE1 reset). Kena: Bridge of Spirits (PPSA01802) hits it on its layered volume draws. Reading `NumWorkgroups` gives every mesh shader the grid-size slot, so the count and the values match; drop the read once a fixed Mesa is the minimum
 - [Mesh layer output](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - a mesh shader writes each primitive's layer through a one-member `Block` struct array whose member is decorated `BuiltIn Layer` and `PerPrimitiveEXT`, as glslang declares `gl_Layer` inside `gl_MeshPerPrimitiveEXT`, not through a standalone `PerPrimitiveEXT` `Layer` array. Both forms pass `spirv-val`, but AMD's Windows driver (32.0.21045.5002, RX 6700 XT) crashes in `amdvlk64.dll` creating a pipeline whose mesh shader writes the standalone form, whether the layer is signed or unsigned and whatever the target, while the block form draws, also with a pixel shader that reads the layer.
 - [Shader recompilation](../../../core/shader/recompiler/Recompiler.cpp) currently occurs right before it was transferred to Vulkan with caching, but should be moved to the [relinker](../../../core/relinker/main.cpp) stage. For this purpose, [shader/recompiler](../../../core/shader/recompiler) was written completely independently from [libs/prx](../../../core/libs/prx).
-- [v_interp_p1ll_f16, v_interp_p1lv_f16 and v_interp_p2_f16](../../../core/shader/recompiler/Translation/src/AttributeInstructions.cpp) read the 16-bit halves of each vertex's parameter through `VK_KHR_fragment_shader_barycentric`, as fixed-function interpolation cannot split a 32-bit attribute. Without the extension the pixel shader takes the [barycentric emulation](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), whose generated geometry stage passes each vertex's parameter to it as a flat input, so the halves arrive bit for bit; a device without geometry shaders takes the tessellation stages of the same emulation instead, which no 16-bit interpolation test has run through yet. P10 and P20 are the vertex differences rounded to f16 to nearest even, which is not confirmed on hardware. v_interp_p1ll_f16 and v_interp_p1lv_f16 round the exact `P10 * I + P0` once to f32 and v_interp_p2_f16 rounds the exact `P20 * J + S2` once to f16, as measured on RDNA2 (#697); the exact sums are computed in f64 or, on a device without the Float64 capability, in 64-bit integers: the exact product is added with a sticky bit and rounded once. They follow the shader's float mode, measured on RDNA2 (gfx1035) in all eight combinations of `IEEE_MODE` and kept/flushed f32 and f16 denormals over 768 special and 1,024 random rows. With IEEE=1 a NaN operand is returned quieted; with IEEE=0 it is returned unquieted, except that v_interp_p2_f16's f16 result is always quiet. Flushed f32 denormals flush I/J, v_interp_p2_f16's f32 S2 and the f32 result; flushed f16 denormals flush P0, P10/P20, v_interp_p1lv_f16's f16 S2 and the f16 result. Denormal modes 1 and 2 (flush only inputs or only outputs) and rounding other than to nearest even are not measured and throw. An unknown mode follows IEEE=0 with denormals kept. Lavapipe has no barycentrics, so the draw test is skipped in CI; `agc_driver_interpolation_modes` checks the integer arithmetic on every device, and the f64 arithmetic on devices with Float64. It checks both against the hardware rows in every mode, and against a CPU reference on random rows in every mode and f16 rounding.
-- Without `VK_KHR_fragment_shader_barycentric`, a pixel shader whose I/J VGPRs [only feed `v_interp_p1_f32`/`v_interp_p2_f32` of their own pair](../../../core/shader/recompiler/Optimization/src/HostInterpolationChecker.cpp) reads the attribute Vulkan interpolated. Any other read of them or of a raw vertex parameter takes the weights and the three vertex values from a [generated geometry stage](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), which needs `geometryShader` and a vertex shader before it. On a device with `tessellationShader` but no `geometryShader` (MoltenVK), a triangle list without primitive restart takes them from [generated tessellation stages](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp) instead: each triangle is one three-point patch at tessellation level 1, the evaluation stage writes the corner `gl_TessCoord` points at as the weights, and the vertex clip distances are forwarded: the control stage reads them as the separate `ClipDistance` array the vertex shader writes, so the vertex-to-control interfaces match, and passes them on inside its per-vertex block, which the evaluation stage reads and writes. MoltenVK 1.4.2 (SPIRV-Cross) cannot translate a separate `ClipDistance` array in a tessellation evaluation stage (`no member named 'gl_ClipDistance' in 'main0_out'`), so the two generated stages keep it in their blocks. A flat parameter takes the provoking vertex's value there, the first or with `PROVOKING_VTX_LAST` the last, and every corner of the patch writes it, so the host's own provoking vertex does not matter and `VK_EXT_provoking_vertex` is not needed; a flat per-vertex parameter with the last provoking vertex still throws. The patch keeps the triangle's facing with `VertexOrderCw`, checked with face culling on MoltenVK 1.4.2 (Apple M2) only. Tessellation, mesh and rect-list pipelines, primitives other than triangles, triangle fans and primitive restart without `geometryShader`, more than 32 fragment input locations and interfaces beyond the device's geometry or tessellation limits throw.
-- [v_fma_f64 and v_div_fmas_f64](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterFloat64.cpp) with a subnormal operand or result round once, as IEEE 754 fusedMultiplyAdd does with f64 denormals kept, measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1, `v_div_fmas_f64` with VCC clear and set. The f16/f64 denormal field of `FLOAT_MODE` (bits 7:6) is not read: when it flushes, the hardware flushes the operands and the result of `v_fma_f64` (tininess before rounding) and only the result of `v_div_fmas_f64`, while these keep them. Shaders with f64 instructions declare `DenormPreserve` for 64-bit floats only when `shaderDenormPreserveFloat64` is true and Vulkan reports `denormBehaviorIndependence` as `ALL`; other independence modes are not handled by the current backend because they require coupled execution modes. See [VkShaderFloatControlsIndependence](https://docs.vulkan.org/refpages/latest/refpages/source/VkShaderFloatControlsIndependence.html). Elsewhere (including lavapipe), the driver may flush f64 subnormals, and `agc_driver_f64_fma_subnormals` is skipped.
-- [v_floor_f64, v_ceil_f64, v_fract_f64, v_frexp_mant_f64 and v_frexp_exp_i32_f64](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) follow the `FLOAT_MODE` f16/f64 denormal field: a denormal input is flushed to a zero of its sign when bit 0 is clear (0 and 2), and `v_fract_f64` flushes a denormal result, the fraction of a positive denormal input, to +0 when bit 1 is clear (0 and 1). `v_trunc_f64` and `v_rndne_f64` give the same results either way and are unchanged. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3 over 23 f64 values (zeros, denormals, minimum normals, ±0.5, ±1, values next to 1, the largest finite value, infinities and quiet and signaling NaNs) and 16 of them with neg and abs modifiers. Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
+- [v_interp_p1ll_f16, v_interp_p1lv_f16 and v_interp_p2_f16](../../../core/shader/recompiler/Translation/src/AttributeInstructions.cpp) read the 16-bit halves of each vertex's parameter through `VK_KHR_fragment_shader_barycentric`, as fixed-function interpolation cannot split a 32-bit attribute. Without the extension the pixel shader takes the [barycentric emulation](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), whose generated geometry stage passes each vertex's parameter to it as a flat input, so the halves arrive bit for bit; a device without geometry shaders takes the tessellation stages of the same emulation instead, which no 16-bit interpolation test has run through yet. P10 and P20 are the vertex differences rounded to f16 to nearest even, which is not confirmed on hardware. v_interp_p1ll_f16 and v_interp_p1lv_f16 round the exact `P10 * I + P0` once to f32 and v_interp_p2_f16 rounds the exact `P20 * J + S2` once to f16, as measured on RDNA2 (#697); the exact sums are computed in f64 or, on a device without the Float64 capability, in 64-bit integers: the exact product is added with a sticky bit and rounded once. They follow the shader's float mode, measured on RDNA2 (gfx1035) in all eight combinations of `IEEE_MODE` and kept/flushed f32 and f16 denormals over 768 special and 1,024 random rows. With IEEE=1 a NaN operand is returned quieted; with IEEE=0 it is returned unquieted, except that v_interp_p2_f16's f16 result is always quiet. Flushed f32 denormals flush I/J, v_interp_p2_f16's f32 S2 and the f32 result; flushed f16 denormals flush P0, P10/P20, v_interp_p1lv_f16's f16 S2 and the f16 result. Denormal modes 1 and 2 (flush only inputs or only outputs) and rounding other than to nearest even are not measured and throw. An unknown mode follows IEEE=0 with denormals kept. `agc_driver_interpolation_modes` checks the integer arithmetic on every device, and the f64 arithmetic on devices with Float64. It checks both against the hardware rows in every mode, and against a CPU reference on random rows in every mode and f16 rounding.
+- Without `VK_KHR_fragment_shader_barycentric`, a pixel shader whose I/J VGPRs [only feed `v_interp_p1_f32`/`v_interp_p2_f32` of their own pair](../../../core/shader/recompiler/Optimization/src/HostInterpolationChecker.cpp) reads the attribute Vulkan interpolated. Any other read of them or of a raw vertex parameter takes the weights and the three vertex values from a [generated geometry stage](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), which needs `geometryShader` and a vertex shader before it. On a device with `tessellationShader` but no `geometryShader` (MoltenVK), a triangle list without primitive restart takes them from [generated tessellation stages](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp) instead: each triangle is one three-point patch at tessellation level 1, the evaluation stage writes the corner `gl_TessCoord` points at as the weights, and the vertex clip distances are forwarded: the control stage reads them as the separate `ClipDistance` array the vertex shader writes, so the vertex-to-control interfaces match, and passes them on inside its per-vertex block, which the evaluation stage reads and writes. MoltenVK 1.4.2 (SPIRV-Cross) cannot translate a separate `ClipDistance` array in a tessellation evaluation stage (`no member named 'gl_ClipDistance' in 'main0_out'`), so the two generated stages keep it in their blocks. A flat parameter takes the provoking vertex's value there, the first or with `PROVOKING_VTX_LAST` the last, and every corner of the patch writes it, so the host's own provoking vertex does not matter and `VK_EXT_provoking_vertex` is not needed; a flat per-vertex parameter with the last provoking vertex still throws. The patch keeps the triangle's facing with `VertexOrderCw`, checked with face culling on MoltenVK 1.4.2 (Apple M2) only. A rect-list draw takes them from its own generated tessellation stages; its test passes on MoltenVK 1.4.2 (Apple M2), RADV (Radeon RX 7900 XT, Mesa 25.2.8), lavapipe, and on Windows on an RTX 3080 (NVIDIA 617.42) and Radeon RDNA 2 iGPUs (AMD 32.0.21045 and 32.0.21030); no title was run through it except Ruffle PPSA68091 on the M2. Tessellation and mesh pipelines, primitives other than triangles, triangle fans and primitive restart without `geometryShader`, more than 32 fragment input locations and interfaces beyond the device's geometry or tessellation limits throw.
+- [v_fma_f64 and v_div_fmas_f64](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterFloat64.cpp) with a subnormal operand or result round once, as IEEE 754 fusedMultiplyAdd does with f64 denormals kept, measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1, `v_div_fmas_f64` with VCC clear and set. The f16/f64 denormal field of `FLOAT_MODE` (bits 7:6) is not read: when it flushes, the hardware flushes the operands and the result of `v_fma_f64` (tininess before rounding) and only the result of `v_div_fmas_f64`, while these keep them. Shaders with f64 instructions declare `DenormPreserve` for 64-bit floats only when `shaderDenormPreserveFloat64` is true and Vulkan reports `denormBehaviorIndependence` as `ALL`; other independence modes are not handled by the current backend because they require coupled execution modes. See [VkShaderFloatControlsIndependence](https://docs.vulkan.org/refpages/latest/refpages/source/VkShaderFloatControlsIndependence.html). Elsewhere the driver may flush f64 subnormals, and `agc_driver_f64_fma_subnormals` skips if it does.
+- [v_floor_f64, v_ceil_f64, v_fract_f64, v_frexp_mant_f64 and v_frexp_exp_i32_f64](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) follow the `FLOAT_MODE` f16/f64 denormal field: a denormal input is flushed to a zero of its sign when bit 0 is clear (0 and 2), and `v_fract_f64` flushes a denormal result, the fraction of a positive denormal input, to +0 when bit 1 is clear (0 and 1). `v_trunc_f64` and `v_rndne_f64` give the same results either way and are unchanged. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3 over 23 f64 values (zeros, denormals, minimum normals, ±0.5, ±1, values next to 1, the largest finite value, infinities and quiet and signaling NaNs), and with neg and abs modifiers over 16 values (13 of those, -1.5, 2.75 and 1 - 2^-53). Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
 - [v_add_f64 and v_mul_f64 denormals](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) follow the `FLOAT_MODE` f16/f64 denormal field; the PS5's gfx1013 is not measured. Inputs flush to a zero of their sign when bit 0 is clear (0 and 2). When bit 1 is clear (0 and 1), a sum below 2^-1022, or a product whose exact value rounded to 53 significant bits with an unbounded exponent is below 2^-1022, flushes to a zero of its sign, so `0x2000000000000001 * 0x1ffffffffffffffe` (exactly 2^-1022 - 2^-1126) rounds to 2^-1022 and is kept. Measured on RDNA2 (gfx1031, RX 6700 XT, AMD Windows driver 32.0.21045.5002, HIP) at IEEE=0 and 1, denorm16 0..3, over 576 pairs of 24 f64 values (zeros, denormals, minimum normals, values next to 1 and to 2^-1022, products just below 2^-1022, the largest finite value, infinities), with neg, abs and clamp. `v_fma_f64`, `v_div_fmas_f64` and shaders without a known float mode keep the previous lowering.
 - [SINT storage images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) of 8- and 16-bit components saturate each stored 32-bit value to the component range, as adriadam10 measured for image stores on RDNA2 (gfx1035) in #944 (448 rows match); the PS5's gfx1013 is not measured. A D16 store sign-extends each 16-bit half before that saturation, as measured on RDNA2 (gfx1035) for `image_store d16` to all eight SINT formats with DMASK 0xf, 0x7, 0x5, 0x3, 0x2, 0xa and 0x1 (1792 rows match).
 - [`StoreTexel`](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) writes channel 1 of a two-channel format from the data slot whose DST_SEL is Y, for SINT and UINT alike. With DST_SEL X,Y,Z,W, gfx1035 writes it from the W slot, as adriadam10 measured in #944.
 - [v_ldexp_f16](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the `FLOAT_MODE` f16 denormal field: bit 0 preserves the half input and bit 1 the half result. Otherwise a denormal input is flushed to its signed zero, and a result whose exact scaled value is below the minimum normal (2^-14) is flushed to its signed zero before rounding, so `v_ldexp_f16 0x07ff, -1` gives +0 instead of 0x0400. Measured on RDNA2 (gfx1036) with round to nearest, IEEE 0 and 1 and denorm16 0..3, over every half magnitude 0x0000..0x0fff of both signs scaled by 2^-1 and 2^0 (16384 rows per mode): no mismatch. NaN and infinity handling and destination high-half preservation are unchanged. Shaders without a known float mode keep the previous lowering.
 - [v_div_fixup_f64](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) flushes its src1 and src2 to a zero of the same sign when bit 0 of the `FLOAT_MODE` f16/f64 denormal field is clear (0 and 2) and keeps a denormal src0 and result in every mode, as `v_div_fixup_f32` does with the f32 field. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) over 1728 triples of 12 f64 values (zeros, denormals, the minimum normal, ±1, the largest finite value, infinity and quiet and signaling NaNs) at IEEE=0 and IEEE=1 with denorm16 0..3. Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
-- [v_mullit_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the hardware measured with the MODE register at IEEE=1 and denormals kept (a signaling NaN src0 is quieted only with IEEE=1, as measured at IEEE=0 too; a positive denormal src2 counts as positive); with f32 denormals flushed it follows the f32 denormals entry below, and denormal modes 1 and 2 throw.
+- [v_mullit_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the hardware measured with the MODE register at IEEE=1 and denormals kept (a signaling NaN src0 is quieted only with IEEE=1, as measured at IEEE=0 too; a positive denormal src2 counts as positive); with f32 denormals flushed it follows the f32 denormals entry below. Denormal mode 2 flushes only the sources, and mode 1 only the result: a result below 2^-126 after rounding becomes a zero of its sign, also when a preserved denormal source produced it. Measured on RDNA2 (gfx1030) over 13,824 operand sets, and 1,632 with an inline or literal constant factor, in all four modes at IEEE=0 and IEEE=1 with f32 round to nearest even. Modes 1 and 2 throw when the module cannot declare `DenormPreserve 32` (no `shaderDenormPreserveFloat32`, or the hardware f32 flush in use), and mode 1 also with another f32 rounding.
 - [v_mad_legacy_f32 and v_mac_legacy_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (VOP3 0x140, VOP2 0x06) round the product to f32 before the add, give a +0 product for a zero factor, and flush their f32 denormal sources, their product and their result to a zero of the same sign in every f32 denormal mode, an exception to the `FLOAT_MODE` model in [f32DenormalFlushFor](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp). Measured on gfx1010 (RX 5700 XT) with `tools/hw-oracle/template.s`, assembled by the AMD Windows driver's `amd_comgr_2.dll` and launched through its `amdhip64_6.dll` instead of `oracle.c` and ROCr, over the 32 rows of the five `FmaLegacy.cpp` and the four `MacLegacy.cpp` encodings: identical in wave32 and wave64 at IEEE 0 and 1 with f32 denormal modes 0 to 3, except that the two signaling NaN rows are quieted only with IEEE=1 (#1281, #1290). A sum of two zeros takes its sign on the bits (+0 unless both are -0), as lavapipe returned -0 for +0 + -0. The PS5's gfx1013 is not measured; LLVM decodes the encoding as `v_mad_legacy_f32` there, as on gfx1010. RDNA2 differs: on gfx1031 (RX 6700 XT, measured by pandather in #1281) the encoding is `v_fma_legacy_f32` and fused, with the same zero rule and denormal-source flush, so an RDNA2 measurement is not evidence for the console.
 - [v_mad_f32, v_mac_f32, v_madak_f32 and v_madmk_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (gfx10.1 only) leave f32 denormals and NaN bits to the driver, unlike the console. Measured on gfx1010 (RX 5700 XT, #5782): the product is rounded before the add; f32 sources, product and result are flushed to a zero of the same sign in every f32 denormal mode; the product is flushed when tiny after rounding to 24 bits with an unbounded exponent; NaN results follow the fma rule, an invalid product beating a NaN src2; in round mode 2 a sum of zeros of opposite signs is -0. Translating this cost 15× `main` on a `v_mac_f32` chain on the RX 5700 XT and 23× on an RTX 3070, and a never-taken branch around it 6×, so it waits for the SPIR-V float controls of #981.
 - [v_fma_mixlo_f16 and v_fma_mixhi_f16](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) round the exact product-sum once to f16 with the arithmetic of v_interp_p2_f16, in f64 or, without the Float64 capability, in 64-bit integers. On RDNA2 (gfx1036) they follow the `FLOAT_MODE` f16 round and denormal fields, not the f32 round field: -1.5 * 2^-24 + 2^-126 from f32 sources (0xbfc00000, 0x33800000, 0x00800000) gives 0x8001 with f16 denormals kept and round to nearest even, 0x8000 with f16 denormals flushed and 0x8002 with f16 round toward -infinity. With f16 denormals kept, every f16 rounding mode is translated: the exact product-sum is rounded once in the mode's direction. All four modes match RDNA2 (gfx1036) on the 2,233 rows of the #2631 sweep, including `FLOAT_MODE` 0xcc (toward zero, used by ps5-opengl) and the exact cancellations toward -infinity; the PS5's gfx1013 is not measured. A result beyond 65504 becomes infinity or 65504 as IEEE 754 gives for the mode. Flushed f16 denormals still throw, and packed f16 throws with any f16 rounding but nearest even. `FP16_OVFL` set is not measured.
@@ -116,13 +126,18 @@
 - [f16 unary, frexp and conversion denormals](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follow the `FLOAT_MODE` f16 denormal field: `v_ceil_f16`, `v_floor_f16`, `v_fract_f16`, `v_rcp_f16`, `v_rsq_f16`, `v_sqrt_f16`, `v_log_f16`, `v_exp_f16`, `v_sin_f16`, `v_frexp_mant_f16`, `v_frexp_exp_i16_f16`, `v_cvt_norm_i16_f16`, `v_cvt_norm_u16_f16` and `v_cvt_f32_f16` flush a denormal half input to its signed zero when bit 0 is clear (0 and 2), and the f16-result ones flush a denormal half result to its signed zero when bit 1 is clear (0 and 1), after the host rounds it to half. Measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1 with denorm16 0..3 over every non-NaN f16 input (63,490 rows per mode and instruction): the only mismatches are the 1-ULP driver differences of `v_exp_f16` (2 inputs) and `v_sin_f16` (14), which are the same with denormals kept. NaN inputs are not compared. `v_ldexp_f16` shares the input rule. `v_cvt_pknorm_i16_f16` and `v_cvt_pknorm_u16_f16` flush both half inputs by the same bit, measured on RDNA2 (gfx1030) over every f16 input (each half also negated in the other source) at IEEE=0 and IEEE=1 with denorm16 0..3 and at f16 rounding 1..3: every row matches. Shaders without a known float mode keep the previous lowering.
 - [v_div_fixup_f16](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) flushes its src1 and src2 to a zero of the same sign when bit 0 of the `FLOAT_MODE` f16 denormal field is clear (0 and 2) and keeps a denormal src0 and result in every mode, as `v_div_fixup_f32` does with the f32 field. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) over 6859 triples of 19 halves (zeros, denormals, minimum normals, ±0.5, ±1, the largest finite value, infinities and quiet and signaling NaNs) at IEEE=0 and IEEE=1 with denorm16 0..3 and FP16_OVFL 0 and 1, also with neg and abs source modifiers and with op_sel high halves. Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
 - [Packed f16 NaN results](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (`v_pk_add/mul/fma/min/max_f16`) follow the hardware measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1 with f16 round-to-nearest-even and f16 denormals kept: with IEEE=1 a signaling NaN input is quieted and min/max return the other operand only for a quiet NaN; with IEEE=0 NaN inputs pass through unquieted and min/max ignore signaling. In `v_pk_fma_f16` an invalid product (inf * 0) gives the default NaN even when src2 is a NaN. A shader without a known float mode is translated as IEEE=0, the mode titles use; a mode with another f16 rounding throws. In the f16 denormal modes that flush, each denormal input lane is flushed to a zero of its sign when bit 0 of the field is clear (0 and 2), so `inf * 0x0001` is an invalid product there, and when bit 1 is clear (0 and 1) a `v_pk_add_f16` result below 2^-14, or a `v_pk_mul_f16`, `v_pk_fma_f16` or `v_pk_fmac_f16` result whose exact value rounded to 11 significant bits with an unbounded exponent is below 2^-14, is flushed to a zero of its sign; `v_pk_min/max_f16` flush only their inputs. The native f16x2 add and multiply is not used while results are flushed. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3, over 19,192 to 162,204 lanes per instruction with op_sel, op_sel_hi, neg_lo, neg_hi and clamp variants and products and sums at the 2^-14 boundary.
-- [f32 denormals](../../../core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp) follow the shader's `FLOAT_MODE` f32 denormal field (bits 5:4) when it flushes them (0, and shaders without a known float mode, as in the 0xc0 most titles use), measured on RDNA2 (gfx1035) over 1444 rows per instruction at IEEE=0 and IEEE=1. `v_add/sub/subrev/mul/mul_legacy/mullit/fma/fmac/fmamk/fmaak/min/max/min3/max3/med3/fract/floor/ceil/frexp_mant/sin/cos_f32` flush their f32 inputs and their result to a zero of the same sign (`v_mullit_f32` measured on RDNA2 (gfx1036) over 6907 rows per mode at IEEE=0 and IEEE=1, so a positive denormal src2 counts as zero); the f32 compares, `v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_f16_f32`, `v_cvt_pkrtz_f16_f32`, `v_cvt_pknorm_i16/u16_f32` and `v_cvt_pk_u8_f32` flush their f32 inputs. `v_div_scale_f32` flushes all three inputs to signed zeros, measured on RDNA2 (gfx1036) over 2744 operand triples per mode at IEEE=0 and IEEE=1 with f32 denormals flushed and kept; its scale-down behaviour and host denormal preservation remain incomplete. `v_div_fixup_f32` flushes its src1 and src2 and keeps a denormal src0 and result, measured on RDNA2 (gfx1036) over 6859 rows per mode at IEEE=0 and IEEE=1. Tininess is detected after rounding, measured on RDNA2 (gfx1036) for `v_mul_f32` and `v_mullit_f32` at IEEE=0 and IEEE=1: a product is flushed when its value rounded to 24 bits with an unbounded exponent is below 2^-126, so `0x3f7ffffe * 0x00800001` (2^-126 * (1 - 2^-46)) gives `0x00800000` and `0x3f7fffff * 0x00800000` (2^-126 * (1 - 2^-24)) gives zero. The check rounds in the f32 round mode of `FLOAT_MODE` (bits 1:0), measured in all four modes, while the products themselves are still rounded to nearest even. This applies to `v_mul_f32`, `v_mul_legacy_f32`, `v_mullit_f32`, and to `v_fma_f32`, `v_fmac_f32`, `v_fmamk_f32`, `v_fmaak_f32` and `v_fma_mix_f32` when the addend is zero; with a nonzero addend the fused result is kept, so an exact result just below 2^-126 that rounds to it is not flushed. In the three directed modes the check is computed exactly from the significands. To nearest even (0, the mode of shaders without a known float mode) one factor is multiplied by 2^64, which is exact below 2^64, and the product with the other factor is compared with 2^-62. That multiply is a plain `OpFMul` like the product, and no f32 rounding mode is requested in the SPIR-V, so the check relies on the driver rounding f32 to nearest even by default, as the products do, and a product that rounds up to 2^-126 is the emitted product. `v_fma_mix_f32` follows this rule with mixed f16/f32 sources too, measured on RDNA2 (gfx1036) with f16 in either multiplicand slot, low and high half selection, and an f32 or f16 zero addend: f32 `0x00801002` times f16 `0x3bff` gives `0x00800000` to nearest at IEEE=0 and IEEE=1, while the neighbours `0x00801001` and `0x00801003` give zero and `0x00800001`. The tiny-product boundary was also measured for both signs in all four f32 round modes at IEEE=0; Its f16 sources are flushed to a zero of their sign when bit 0 of the f16/f64 denormal field is clear (0 and 2), whatever the f32 field, measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with f32 denormal modes 0 and 3 and f16 denormal modes 0 to 3, over 2744 triples of 14 halves with all three sources f16 and 1960 rows with an f32 multiplicand. `v_fma_mixlo_f16` and `v_fma_mixhi_f16` flush their f32 sources too and keep a product below 2^-126, measured on RDNA2 (gfx1036). `v_mad_legacy_f32` and `v_mac_legacy_f32` flush their inputs, their product and their result in every mode, see its entry; their product is still checked for tininess on its exact value, so one below 2^-126 gives zero even when it rounds to 2^-126, as the console's separately rounded encoding is not measured at this boundary. Denormal modes 1 and 2 throw for the other instructions. Not covered, and not measurable on RDNA2 (no such opcodes) or not measured: `v_mac_f32`, `v_mad_f32`, `v_madak_f32` and `v_madmk_f32` (rounded separately), `v_dot2_f32_f16` and `v_div_fmas_f32` (on hardware `v_div_fmas_f32` flushes only its result), f32 interpolation and `ds_add_f32` keep the previous lowering; `ds_min/max/cmpst_f32` flush both operands by the field, see the LDS float atomics entry. With f32 denormals kept (3) the results depend on the driver's default denormal behaviour, as no `DenormPreserve` execution mode is requested; `v_ldexp_f32` and the f32 compares are the exceptions. `v_cmp_X_f32` and `v_cmpx_X_f32` compare the operands as sign-magnitude integers with the NaN cases handled apart, so a denormal is not read as zero, measured on RDNA2 (gfx1036) over 256 operand pairs per opcode at IEEE=0 and IEEE=1 with f32 denormals kept and flushed. `v_ldexp_f32` preserves subnormal inputs and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2163 rows in each of the four round modes at IEEE=0 and IEEE=1. An overflow rounds like any other result (infinity, or the largest finite value when the mode rounds that sign toward zero). With f32 denormals flushed it flushes a subnormal input and result, measured over the same rows in each round mode at IEEE=0 only. A device whose driver splits `Fma` into a multiply and an add flushes a product below 2^-126 before adding a non-zero addend in `v_fma_f32` and `v_fmac_f32`: `0x1fffffff * 0x1fffffff + 0x00800000` gives `0x00800000` instead of the fused `0x00ffffff` on RADV RENOIR (Mesa 26.2.4), whose compiled shader has `v_mad_f32` and no `v_fma_f32`. [F32DenormalFlush](../../../core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp) accepts that sum on such a device.
+- [f32 denormals](../../../core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp) follow the shader's `FLOAT_MODE` f32 denormal field (bits 5:4) when it flushes them (0, and shaders without a known float mode, as in the 0xc0 most titles use), measured on RDNA2 (gfx1035) over 1444 rows per instruction at IEEE=0 and IEEE=1. `v_add/sub/subrev/mul/mul_legacy/mullit/fma/fmac/fmamk/fmaak/min/max/min3/max3/med3/fract/floor/ceil/frexp_mant/sin/cos_f32` flush their f32 inputs and their result to a zero of the same sign (`v_mullit_f32` measured on RDNA2 (gfx1036) over 6907 rows per mode at IEEE=0 and IEEE=1, so a positive denormal src2 counts as zero); the f32 compares, `v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_f16_f32`, `v_cvt_pkrtz_f16_f32`, `v_cvt_pknorm_i16/u16_f32` and `v_cvt_pk_u8_f32` flush their f32 inputs. `v_div_scale_f32` flushes all three inputs to signed zeros, measured on RDNA2 (gfx1036) over 2744 operand triples per mode at IEEE=0 and IEEE=1 with f32 denormals flushed and kept; its scale-down behaviour and host denormal preservation remain incomplete. `v_div_fixup_f32` flushes its src1 and src2 and keeps a denormal src0 and result, measured on RDNA2 (gfx1036) over 6859 rows per mode at IEEE=0 and IEEE=1. Tininess is detected after rounding, measured on RDNA2 (gfx1036) for `v_mul_f32` and `v_mullit_f32` at IEEE=0 and IEEE=1: a product is flushed when its value rounded to 24 bits with an unbounded exponent is below 2^-126, so `0x3f7ffffe * 0x00800001` (2^-126 * (1 - 2^-46)) gives `0x00800000` and `0x3f7fffff * 0x00800000` (2^-126 * (1 - 2^-24)) gives zero. The check rounds in the f32 round mode of `FLOAT_MODE` (bits 1:0), measured in all four modes, while the products themselves are still rounded to nearest even. This applies to `v_mul_f32`, `v_mul_legacy_f32`, `v_mullit_f32`, and to `v_fma_f32`, `v_fmac_f32`, `v_fmamk_f32`, `v_fmaak_f32` and `v_fma_mix_f32` when the addend is zero; with a nonzero addend the fused result is kept, so an exact result just below 2^-126 that rounds to it is not flushed. In the three directed modes the check is computed exactly from the significands. To nearest even (0, the mode of shaders without a known float mode) one factor is multiplied by 2^64, which is exact below 2^64, and the product with the other factor is compared with 2^-62. That multiply is a plain `OpFMul` like the product, and no f32 rounding mode is requested in the SPIR-V, so the check relies on the driver rounding f32 to nearest even by default, as the products do, and a product that rounds up to 2^-126 is the emitted product. `v_fma_mix_f32` follows this rule with mixed f16/f32 sources too, measured on RDNA2 (gfx1036) with f16 in either multiplicand slot, low and high half selection, and an f32 or f16 zero addend: f32 `0x00801002` times f16 `0x3bff` gives `0x00800000` to nearest at IEEE=0 and IEEE=1, while the neighbours `0x00801001` and `0x00801003` give zero and `0x00800001`. The tiny-product boundary was also measured for both signs in all four f32 round modes at IEEE=0; Its f16 sources are flushed to a zero of their sign when bit 0 of the f16/f64 denormal field is clear (0 and 2), whatever the f32 field, measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with f32 denormal modes 0 and 3 and f16 denormal modes 0 to 3, over 2744 triples of 14 halves with all three sources f16 and 1960 rows with an f32 multiplicand. `v_fma_mixlo_f16` and `v_fma_mixhi_f16` flush their f32 sources too and keep a product below 2^-126, measured on RDNA2 (gfx1036). `v_mad_legacy_f32` and `v_mac_legacy_f32` flush their inputs, their product and their result in every mode, see its entry; their product is still checked for tininess on its exact value, so one below 2^-126 gives zero even when it rounds to 2^-126, as the console's separately rounded encoding is not measured at this boundary. Denormal modes 1 and 2 throw for the other instructions except the f32 compares and the f32 conversions in their entries. Not covered, and not measurable on RDNA2 (no such opcodes) or not measured: `v_mac_f32`, `v_mad_f32`, `v_madak_f32` and `v_madmk_f32` (rounded separately), `v_dot2_f32_f16` and `v_div_fmas_f32` (on hardware `v_div_fmas_f32` flushes only its result), f32 interpolation and `ds_add_f32` keep the previous lowering; `ds_min/max/cmpst_f32` and the image, buffer, global and flat `fmin/fmax/fcmpswap` flush both operands by the field, see the float atomics entries. With f32 denormals kept (3) the results depend on the driver's default denormal behaviour, as no `DenormPreserve` execution mode is requested; `v_ldexp_f32` and the f32 compares are the exceptions. `v_cmp_X_f32` and `v_cmpx_X_f32` compare the operands as sign-magnitude integers with the NaN cases handled apart, so a denormal is not read as zero, measured on RDNA2 (gfx1036) over 256 operand pairs per opcode at IEEE=0 and IEEE=1 with f32 denormals kept and flushed. `v_ldexp_f32` preserves subnormal inputs and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2163 rows in each of the four round modes at IEEE=0 and IEEE=1. An overflow rounds like any other result (infinity, or the largest finite value when the mode rounds that sign toward zero). With f32 denormals flushed it flushes a subnormal input and result, measured over the same rows in each round mode at IEEE=0 only. A device whose driver splits `Fma` into a multiply and an add flushes a product below 2^-126 before adding a non-zero addend in `v_fma_f32` and `v_fmac_f32`: `0x1fffffff * 0x1fffffff + 0x00800000` gives `0x00800000` instead of the fused `0x00ffffff` on RADV RENOIR (Mesa 26.2.4), whose compiled shader has `v_mad_f32` and no `v_fma_f32`. [F32DenormalFlush](../../../core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp) accepts that sum on such a device.
 - [v_rcp, v_rsq, v_sqrt, v_log, v_exp, v_sin and v_cos](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (f32 and f16) use the driver's approximation for finite results, not the console's: the low bits can differ. Only NaN, invalid, zero and infinite results and the exact sin/cos zeros are chosen on the bits. Measured on RDNA2 (gfx1036) over every f16 input and 32,832 f32 inputs: RADV returns the hardware's bits for every input of rcp, rsq, sqrt and log and all but one of exp (f16 0x11c5, 1 ULP); NVIDIA (615.71.09) stays within 2 ULP except `v_log_f32` near 1.0 (next entry). [v_sin and v_cos](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) take the driver's sine or cosine of the radians of the exact cycle, except within 2^-12 of a turn from a zero of the function, where the result is the linear term of the exact distance to the zero: the hardware's constant 6.2831826 (0x40c90fd5) at the integers, which the hardware applies exactly to inputs below 2^-12 of a turn, and the f32 2π at the half and quarter turns, where the hardware is within 7 ULP of it. Outside those bands, a driver result more than 4 ULP from a Taylor series in turns of the exact cycle is replaced by the series, which is within 2 ULP of the true sine and cosine; the hardware is up to 9 ULP from them (gfx1035, 243,092 f32 inputs), so results stay within 13 ULP of the hardware on any driver. RADV returns the hardware's bits for every f16 input and for 32,422 sine and 32,486 cosine results of the 32,832 f32 inputs; the rest are 1 ULP off, except up to 14 ULP on either side of non-zero integers and up to 15 ULP beyond ±256 cycles, where the hardware's own reduction differs from the exact fraction, and up to 6 ULP inside the half- and quarter-turn bands. NVIDIA's own sine is within 1 ULP on 93% of the f32 inputs and up to 1,166 ULP off just outside the bands, its cosine within 163 ULP; the series replaces those results. A denormal f32 input with f32 denormals kept gives the hardware the input times 6.2831826; both hosts flush it.
+- [v_rcp_f32 and v_rcp_iflag_f32 with `APS5_EXACT_RCP`](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp) return the hardware reciprocal for normal inputs with normal results: a cubic over 32 mantissa segments, the linear term rounded to nearest even, plus 2,761 one-ULP corrections. It matches all 2^23 mantissas of an RDNA2 (gfx1031) sweep; inputs or results that are not normal keep the driver's 1/x. It is off by default because the coefficient and correction tables add about 13k SPIR-V words to each shader that uses it. The switch also reaches v_rcp_f16 (rounded from the f32 reciprocal) and the pixel shader's position W input.
 - [v_ldexp_f32 in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the `FLOAT_MODE` f32 denormal field: mode 1 keeps a subnormal input and flushes a result below 2^-126 to a zero of its sign in every f32 round mode, also one that rounds to 2^-126 at subnormal precision (`0x3fffffff` scaled by 2^-127); mode 2 flushes a subnormal input to a zero of its sign and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, as mode 3 does. Measured on RDNA2 (gfx1030, Radeon RX 6800, AMD Windows driver 32.0.21045.5002 through HIP) over 10,260 rows (54 inputs of both signs: zeros, subnormals, normals near 2^-126 and 1.0, the largest finite value, infinities and NaNs, each scaled by 190 exponents from -2^31 to 2^31-1) at IEEE=0 and IEEE=1 with each f32 denormal mode 0 to 3 and f32 round mode 0 to 3, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even and FP16_OVFL=0; with the `clamp` modifier the result is clamped as in the other modes. The PS5's gfx1013 is not measured.
+- [32-bit denormal execution mode](../../../core/shader/recompiler/Recompiler.cpp) (shader recompiler) - the hardware f32 flush that the startup probe chooses (`DenormFlushToZero 32`) is declared only in shaders whose `FLOAT_MODE` flushes f32 denormals (field 0, or no known float mode). A shader that keeps them on either side (field 1, 2 or 3) declares `DenormPreserve 32` when the device has `shaderDenormPreserveFloat32` with a `denormBehaviorIndependence` other than NONE; on other devices it gets the driver's default f32 denormal handling, which flushes the denormals it keeps on MoltenVK.
 - [v_log_f32 and v_log_f16](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) keep the driver's log2 unless, for inputs within 1/8 of 1.0, it is more than 4 ULP from an eight-term series in x - 1, which then replaces it. `v_log_f16` goes through the same f32 lowering and is rounded to half. The series is evaluated for every `v_log` and chosen with `OpSelect` rather than a branch, so its seven fused multiply-adds and two multiplies are an unconditional cost. Measured on RDNA2 over all 3,145,728 f32 inputs within 1/8 of 1.0 (gfx1035, IEEE 0, f32 denormals flushed), the hardware is within 1 ULP of the correctly rounded log2 and the series within 2 ULP of it and within 3 ULP of the hardware (2 except at 0x3f752e47, 0x3f7baab0 and 0x3f7bc4fb), so a kept driver value is within 7 ULP of the hardware and a driver that returns the hardware's bits never triggers the gate; RADV (Mesa 26.2.4) returns the hardware's bits on the 9,280 such inputs measured on gfx1036; NVIDIA (615.71.09) was up to 23,947,836 ULP off at 1 - 2^-24 and is within 6 ULP inside the band after the change; outside it its own log2 stays up to 9 ULP off (measured up to 1.375). Over every f16 input, the change moves one `v_log_f16` result on NVIDIA (0x3bed, 1 ULP, onto the hardware's bits) and none on RADV.
+- [v_add_f32, v_sub_f32, v_subrev_f32, v_mul_f32 and v_mul_legacy_f32 in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp) throw with a directed f32 round mode, as the host rounds these sums and products to nearest even (a difference that modes 0 and 3 also have then), and when the module cannot declare `DenormPreserve 32` (no `shaderDenormPreserveFloat32`, or the hardware f32 flush in use); the PS5's gfx1013 is not measured. Otherwise mode 1 keeps denormal inputs and flushes a result below 2^-126 to a zero of its sign (a product only when it stays below 2^-126 after rounding to 24 bits with an unbounded exponent), and mode 2 flushes denormal inputs and keeps a denormal result. Measured on RDNA2 (gfx1030, RX 6800) over 1,296 operand pairs, 896 products around 2^-126 and 1,632 with a constant factor, at IEEE 0 and 1 in every f32 denormal mode, with DX10_CLAMP=1, f16 denormals kept and FP16_OVFL=0.
+- [f32 min and max in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp) (`v_min_f32`, `v_max_f32`, `v_min3_f32`, `v_max3_f32`, `v_med3_f32`) throw in mode 1 when the module cannot declare `DenormPreserve 32` (no `shaderDenormPreserveFloat32`, or the hardware f32 flush in use), and mode 3 keeps depending on the driver there; the PS5's gfx1013 is not measured. They follow only bit 0 of the `FLOAT_MODE` f32 denormal field: mode 2 flushes denormal inputs to zeros of their sign as mode 0 does, and mode 1 keeps them and returns a selected denormal unflushed as mode 3 does. Measured on RDNA2 (gfx1030, RX 6800) over the 2,744 operand triples of ±0, ±2^-149, ±0x007fffff, ±2^-126, ±1, ±infinity, a quiet and a signaling NaN at IEEE 0 and 1 in each f32 denormal mode, round to nearest even, DX10_CLAMP=1, f16 denormals kept, FP16_OVFL=0: modes 1 and 3 give identical results, and so do modes 2 and 0.
 - [Ordered not-equal, less-than and greater-than compares](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) (shader recompiler) - `FPOrdNotEqual32` is emitted as `OpFUnordNotEqual`, and `FPOrdLessThan32` and `FPOrdGreaterThan32` as their ordered forms, each with both operands checked for NaN on their bits; the results are the same for every input. The AMD Windows driver 32.0.13058.8001 (Radeon 860M, RDNA 3.5) returns 1 for a NaN operand when any float form of not-equal feeds a ballot on a 32-wide subgroup (#825), and so does a less-than or greater-than against an infinity the driver sees as a constant (#3536), presumably rewritten into a not-equal by its compiler
 - [16-bit integer multiplies](../../../core/shader/recompiler/Translation/src/IntegerInstructions.cpp) (`v_mul_lo_u16`, `v_pk_mul_lo_u16`) (shader recompiler) - a factor taken from the low half of its source is read as the low 24 bits of the register, not the low 16; the low 16 bits of the product are the same for every input. The AMD Windows driver 32.0.21045.5002 (RX 6700 XT, RDNA 2) stores the full 32-bit product when two values it knows fit in 16 bits are multiplied, the product is reduced to 16 bits and nothing else is merged into the stored value: `v_mul_lo_u16` into a register whose high half is zero, also with factors masked to 16 bits by the program, and `v_pk_mul_lo_u16` whose high lanes are zero wrote 0xfffe0001 for 0xffff * 0xffff where the GPU writes 0x00000001. Reducing the product with `v_and_b32`, `v_bfe_u32` or a shift pair loses the same bits; factors read as 24-bit fields do not. The [constant folder](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) keeps a field read that a multiply uses, even when the program already masked the factor to 16 bits, since folding it away brings the full product back (#8271). Measured against the same instructions run through the [hardware oracle](../HW_ORACLE.md) on that GPU; other drivers are not checked
 - [f32 compares in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp) (`v_cmp_X_f32` and `v_cmpx_X_f32` with X = eq, ge, gt, le, lg, lt, neq, nge, ngt, nle, nlg, nlt) flush their f32 denormal inputs by bit 0 of the `FLOAT_MODE` f32 denormal field: mode 1 keeps them as mode 3 does, and mode 2 flushes them as mode 0 does. Measured on RDNA2 (gfx1030, Radeon RX 6800, AMD Windows driver 32.0.21045.5002 through HIP) over 484 operand pairs of zeros, denormals, minimum normals, ones, the largest finite value, infinities and quiet and signaling NaNs of both signs, in VOPC form, at IEEE=0 and IEEE=1 with each f32 denormal mode 0 to 3, f32 round to nearest even, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even and FP16_OVFL=0. The PS5's gfx1013 is not measured.
+- [f32 conversions in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp) (`v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_pknorm_i16/u16_f32`, `v_cvt_pk_u8_f32`, `v_cvt_pkrtz_f16_f32` and `v_cvt_f16_f32`) flush their f32 denormal inputs by bit 0 of the `FLOAT_MODE` f32 denormal field: mode 1 keeps them as mode 3 does, and mode 2 flushes them as mode 0 does. Measured on RDNA2 (gfx1036, ROCm 7.1.1, Linux 7.2) over 148 sources and 484 operand pairs (zeros, denormals, minimum normals, f16 limits, the largest finite value, infinities, NaNs) at IEEE=0 and IEEE=1 in every f32 denormal and round mode, and for the f16 and f64 results in every f16/f64 denormal and round mode. `v_div_scale_f32` and `v_div_fixup_f32` do not follow this rule and still throw in modes 1 and 2, as do `v_mad_mixlo/mixhi_f16`, which RDNA2 lacks. The PS5's gfx1013 is not measured.
 - [f16 compares](../../../core/shader/recompiler/Translation/src/CompareInstructions.cpp) (`v_cmp_X_f16` and `v_cmpx_X_f16` with X = eq, ge, gt, le, lg, lt, neq, nge, ngt, nle, nlg, nlt) flush their f16 denormal inputs to a zero of the same sign by bit 0 of the `FLOAT_MODE` f16 denormal field: modes 0 and 2 flush them, 1 and 3 keep them. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) over 256 operand pairs of zeros, denormals, minimum normals, ones, the largest finite value, infinities and quiet and signaling NaNs of both signs, in VOPC form, at IEEE=0 and IEEE=1 with each f16 denormal mode 0 to 3, f16 round to nearest even, DX10_CLAMP=1, f32 denormals kept and FP16_OVFL=0. Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
 - [DB_SHADER_CONTROL.PRIMITIVE_ORDERED_PIXEL_SHADER](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - the host pixel interlock spans the whole shader, not only up to `s_sendmsg` ORDERED_PS_DONE.
 - [POPS collision SGPRs](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - the collision wave ID and intrawave collision mask read 0, so a title skips its POPS wait and runs its per-collision loop once.
@@ -145,10 +160,11 @@
 - [Comparison sampling of a color texture](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_sample_c`/`image_sample_c_lz` on a texture that is not R32 float or R16 unorm) returns 0 for every comparison function on formats AnyPS5 can sample as floating-point measured on GFX10 (codes 1–77 except native comparison codes 7 and 22) and on the corresponding GFX11 formats measured on gfx1100. The current Vulkan path still lowers these formats through the shader; the compare result is constant zero. Scaled, integer and formats requiring converted sampling remain refused. Only 2D, 2D-array and cube views are accepted; image tables, min/max reduction, unnormalized coordinates and unsupported addressing remain refused. Point and bilinear results match on gfx1100. The PS5's gfx1013, array/cube behavior for the measured formats, and anisotropic comparisons remain unverified. Bilinear weights are full float, not the hardware's fixed-point subtexel weights
 - [Negative color-texture comparison wrap indices](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (libSceAgcDriver) use explicit `OpSRem` normalization to implement modulo; the negative-offset point-wrap regression fails with direct `OpSMod` and passes with normalization on Mesa 22.3.6 llvmpipe (LLVM 15.0.6), but negative-index wrap has not been measured on PS5 hardware.
 - [Converted unorm images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (10_11_11_UNORM, read and written through an R32_UINT view) are sampled in the shader, the way color comparisons are emulated: `image_sample` of a 2D or 2D array view fetches the one or four texels at LOD 0, decodes them and blends them, for point or bilinear filtering with equal minification and magnification filters and wrap or clamp-to-edge addressing. A shader gets these sample modes only once a converted descriptor reaches one of its sampled images: that capture throws `ConvertedSampleRequired`, the driver records the program and prepares it again with `GuestContext::convertedSamples`, so such a shader is prepared twice per run and its first capture is repeated. The record lives with the registered program and is not kept across runs. Bilinear weights are rounded to the hardware's 8-bit grid (`roundEven(fraction * 256) / 256`, ties to even), as measured with `image_sample_lz` on RDNA2 (gfx1035) for 10_11_11 UNORM texels by adriadam10 in #5958; point sampling, decoding, swizzles and wrap and clamp-to-edge addressing matched the same measurement. A sample that is not `_lz` needs an image with one mip level; gathers, LOD queries, clamp-to-border and mirrored addressing, other filters, min/max reduction, unnormalized coordinates, images selected at run time, 16-bit data and a DST_SEL of the missing W channel throw.
-- [Converted unorm image loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) divide by 2^n - 1 with the buffer format path's `OpFDiv`, which Vulkan allows to be up to 2.5 ULP off, so some drivers are not bit-exact.
-- [64-bit LDS atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_*_u64`, `ds_*_b64`, `ds_*_f64`) read and write the two dwords under a workgroup lock stored after the guest LDS, as LDS is a 32-bit array without 64-bit atomics. On RDNA2 (gfx1036) the LDS serialises a 32-bit atomic on a slot's high dword and a 64-bit atomic on that slot: 128 lanes of `ds_add_u32` and 128 lanes of `ds_add_u64` on one slot sum exactly. Only that pair was measured. Every 32-bit LDS atomic of a program that contains a 64-bit LDS atomic therefore takes the same lock, including a 32-bit `flat_atomic_*` whose address lands in the LDS aperture (a 64-bit one takes it already); the flat forms were not measured against a 64-bit atomic either (the other 32-bit LDS atomics, `ds_min/max`, `ds_cmpst`, the float forms, `ds_inc/dec`, `ds_mskor` and `ds_wrxchg`, are extrapolated from `ds_add_u32` and were not measured against a 64-bit atomic); a program without a 64-bit LDS atomic keeps its native 32-bit atomics. `ds_condxchg32_rtn_b64` is two `ds_mskor` halves, each under the lock but not atomic as a pair, so a 64-bit atomic between the two halves is not excluded. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms) and plain `ds_read_*`, `ds_write_*`, `ds_append_u32` and `ds_consume_u32` are not taken under the lock, so a plain access racing a 64-bit atomic on the same dwords can see or overwrite one half of it; whether the hardware orders them was not measured. The lock serialises the workgroup's LDS atomics of such a program; the throughput cost was not measured. `VK_KHR_workgroup_memory_explicit_layout` with `shaderSharedInt64Atomics` would make both widths native and is not used. A 64-bit atomic at an address that is 4-byte but not 8-byte aligned faults the wave on gfx1036, as on gfx1035. When the LDS lives in device memory (compute LDS beyond the device's shared-memory limit) and the device has `shaderBufferInt64Atomics`, no lock is used: a 64-bit atomic is a compare-exchange loop on a 64-bit view of the storage buffer and a 32-bit atomic is a native buffer atomic, a misaligned 64-bit atomic records the `Unaligned` shader fault with the LDS byte address instead of updating, so a mixed-width pair on one slot relies on the device ordering both widths on one buffer address; only `ds_add_u32` against `ds_add_u64` was measured, on gfx1036 (AMD Windows driver 32.0.21042.62) and an RTX 4070 SUPER. The lock is not used there because AMD's Windows driver compiles an acquire or release on a storage buffer, at workgroup scope or wider, to `s_barrier`, and those barriers inside the lock's divergent loop pair with the program's own `s_barrier`s. The fence after each LDS atomic compiles to `s_barrier` on that driver as well, so a wave that skips an LDS atomic that other waves of its workgroup execute misses a barrier they reach; its effect was not measured. On that path a 64-bit atomic at an address that is 4-byte but not 8-byte aligned is skipped and returns 0.
-- [LDS float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_min/max/cmpst_f32`, `ds_min/max/cmpst_f64` and their `_rtn` forms) follow the hardware measured on RDNA2 (gfx1036) over 14 x 14 operand sets (zeros, ones, infinities, denormals, quiet and signalling NaNs of both signs and with payloads) in IEEE 0 and 1 with every value 0-3 of the type's denormal field: both operands are flushed to a signed zero when bit 0 of the field is clear (0 and 2; 1 and 3 keep them; the f32 field for the f32 forms, the f16/f64 field for the f64 forms; a shader without a known float mode flushes f32 and keeps f64), then a signalling-NaN data operand is stored quieted, else a signalling-NaN old value is stored quieted, else a quiet-NaN old value is replaced by the data, else a quiet-NaN data operand loses, else the ordered compare with -0 below +0 decides, and the flushed value is what is written, also when the old value wins. `cmpst` compares the flushed bits (both zeros equal, NaN never equal) and leaves memory unchanged when they differ. The returned value is always the old value as it was in memory. `IEEE_MODE` has no effect. The same bit rule serves the buffer float atomics (`AtomicFloatBits`). Not measured: a denormal or signalling-NaN `data1` of `cmpst` (stored as given). `ds_add_f32` and `ds_add_rtn_f32` follow RDNA1 (gfx1010, RX 5700 XT), measured with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime over 1574 operand pairs (signed zeros, denormals, the smallest normals, infinities, quiet and signalling NaNs with payloads, the largest normals, random pairs near the denormal range and pairs that nearly cancel) in all 16 combinations of the f32 denormal field and the f32 round mode, and at IEEE 1 and DX10 clamp 0: both operands are flushed to a signed zero when bit 0 of the field is clear and the result when bit 1 is clear, the sum is rounded to nearest even whatever the round mode, a NaN data operand is stored quieted, else a NaN old value is stored quieted, `+inf + -inf` stores 0xffc00000, and `IEEE_MODE` and `DX10_CLAMP` have no effect. The sum is the host's `OpFAdd` between those flushes, so where the field keeps f32 denormals the result also depends on the host preserving them, which the module does not request. thuanquang measured the same rule on RDNA2 (gfx1031, RX 6700 XT) in #5492, with the same operand classes and 18 modes in wave32 and wave64; the PS5's gfx1013 is not measured.
-- [LDS in pixel, vertex-path and fetch programs](../../../core/shader/recompiler/SpirvBackend/src/SpirvAnalysis.cpp) (shader recompiler) - is an array private to each host invocation, in `Function` storage, as only compute and mesh programs get workgroup memory; on the console one LDS region is shared by the wave (RDNA 2 ISA sections 3.6.6 and 10.4), so a lane does not see another lane's LDS writes. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms), the 32-bit LDS atomics, `ds_append` and `ds_consume` load, update and store the invocation's own dword without an atomic, as Vulkan allows atomics only on `Uniform`, `Workgroup`, `Image`, `StorageBuffer`, `PhysicalStorageBuffer` and `TaskPayloadWorkgroupEXT` pointers (VUID-StandaloneSpirv-None-04686). `ds_append` and `ds_consume` update only the first active lane's copy and return its old value to every lane, so a second append after the first active lane changes, or a read of the counter by another lane, differs from the hardware. Not measured on hardware.
+- [64-bit LDS atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_*_u64`, `ds_*_b64`, `ds_*_f64`) read and write the two dwords under a workgroup lock stored after the guest LDS, as LDS is a 32-bit array without 64-bit atomics. On RDNA2 (gfx1036) the LDS serialises a 32-bit atomic on a slot's high dword and a 64-bit atomic on that slot: 128 lanes of `ds_add_u32` and 128 lanes of `ds_add_u64` on one slot sum exactly. Only that pair was measured. Every 32-bit LDS atomic of a program that contains a 64-bit LDS atomic therefore takes the same lock, including a 32-bit `flat_atomic_*` whose address lands in the LDS aperture (a 64-bit one takes it already); the flat forms were not measured against a 64-bit atomic either (the other 32-bit LDS atomics, `ds_min/max`, `ds_cmpst`, the float forms, `ds_inc/dec`, `ds_mskor` and `ds_wrxchg`, are extrapolated from `ds_add_u32` and were not measured against a 64-bit atomic); a program without a 64-bit LDS atomic keeps its native 32-bit atomics. `ds_condxchg32_rtn_b64` is two `ds_mskor` halves, each under the lock but not atomic as a pair, so a 64-bit atomic between the two halves is not excluded. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms) and plain `ds_read_*`, `ds_write_*`, `ds_append_u32` and `ds_consume_u32` are not taken under the lock, so a plain access racing a 64-bit atomic on the same dwords can see or overwrite one half of it; whether the hardware orders them was not measured. The lock serialises the workgroup's LDS atomics of such a program; the throughput cost was not measured. `VK_KHR_workgroup_memory_explicit_layout` with `shaderSharedInt64Atomics` would make both widths native and is not used. A 64-bit atomic at an address that is 4-byte but not 8-byte aligned faults the wave on gfx1036, as on gfx1035; with the workgroup lock, in device memory and in the invocation-private LDS of other stages alike, the recompiler records the `Unaligned` shader fault with the LDS byte address, leaves both dwords unchanged and returns 0, but the lane and the rest of its wave keep running. When the LDS lives in device memory (compute LDS beyond the device's shared-memory limit) and the device has `shaderBufferInt64Atomics`, no lock is used: a 64-bit atomic is a compare-exchange loop on a 64-bit view of the storage buffer and a 32-bit atomic is a native buffer atomic, so a mixed-width pair on one slot relies on the device ordering both widths on one buffer address; only `ds_add_u32` against `ds_add_u64` was measured, on gfx1036 (AMD Windows driver 32.0.21042.62) and an RTX 4070 SUPER. The lock is not used there because AMD's Windows driver compiles an acquire or release on a storage buffer, at workgroup scope or wider, to `s_barrier`, and those barriers inside the lock's divergent loop pair with the program's own `s_barrier`s. The fence after each LDS atomic compiles to `s_barrier` on that driver as well, so a wave that skips an LDS atomic that other waves of its workgroup execute misses a barrier they reach; its effect was not measured.
+- [Image, buffer and global float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`image_atomic_fmin/fmax/fcmpswap`, the same three `buffer_atomic_*` and `global_atomic_*` forms and their `_x2` forms) follow the rule of the LDS float atomics below, including its operand flush: the 32-bit forms flush both operands to a signed zero when bit 0 of the f32 denormal field is clear, the `_x2` forms by the f16/f64 field, and `fcmpswap` stores a denormal source as given. The `flat_atomic_*` forms take the same path and are not measured. Measured on RDNA2 (gfx1031, RX 6700 XT) with the [hardware oracle](../HW_ORACLE.md) over 20 x 20 f32 and 18 x 18 f64 operand pairs in every value of both fields, at IEEE 0 and 1, in wave32 and wave64, and for the image forms on 32_UINT, 32_SINT and 32_FLOAT surfaces. The console's gfx1013 is not measured.
+- [LDS float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_min/max/cmpst_f32`, `ds_min/max/cmpst_f64` and their `_rtn` forms) follow the hardware measured on RDNA2 (gfx1036) over 14 x 14 operand sets (zeros, ones, infinities, denormals, quiet and signalling NaNs of both signs and with payloads) in IEEE 0 and 1 with every value 0-3 of the type's denormal field: both operands are flushed to a signed zero when bit 0 of the field is clear (0 and 2; 1 and 3 keep them; the f32 field for the f32 forms, the f16/f64 field for the f64 forms; a shader without a known float mode flushes f32 and keeps f64), then a signalling-NaN data operand is stored quieted, else a signalling-NaN old value is stored quieted, else a quiet-NaN old value is replaced by the data, else a quiet-NaN data operand loses, else the ordered compare with -0 below +0 decides, and the flushed value is what is written, also when the old value wins. `cmpst` compares the flushed bits (both zeros equal, NaN never equal) and leaves memory unchanged when they differ. The returned value is always the old value as it was in memory. `IEEE_MODE` has no effect. Not measured: a denormal or signalling-NaN `data1` of `cmpst` (stored as given). `ds_add_f32` and `ds_add_rtn_f32` follow RDNA1 (gfx1010, RX 5700 XT), measured with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime over 1574 operand pairs (signed zeros, denormals, the smallest normals, infinities, quiet and signalling NaNs with payloads, the largest normals, random pairs near the denormal range and pairs that nearly cancel) in all 16 combinations of the f32 denormal field and the f32 round mode, and at IEEE 1 and DX10 clamp 0: both operands are flushed to a signed zero when bit 0 of the field is clear and the result when bit 1 is clear, the sum is rounded to nearest even whatever the round mode, a NaN data operand is stored quieted, else a NaN old value is stored quieted, `+inf + -inf` stores 0xffc00000, and `IEEE_MODE` and `DX10_CLAMP` have no effect. The sum is the host's `OpFAdd` between those flushes, so where the field keeps f32 denormals the result also depends on the host preserving them, which the module does not request. thuanquang measured the same rule on RDNA2 (gfx1031, RX 6700 XT) in #5492, with the same operand classes and 18 modes in wave32 and wave64; the PS5's gfx1013 is not measured.
+- [LDS in pixel, vertex-path and fetch programs](../../../core/shader/recompiler/SpirvBackend/src/SpirvAnalysis.cpp) (shader recompiler) - console waves share one LDS region; the host uses a private `Function` array (8192 dwords when unbounded). On NVIDIA proprietary, past about 4 GiB of private memory over every resident invocation that array fails (4090 on 617.42: 5456 ok, 5472 fault at 128×48×32 from `VK_NV_shader_sm_builtins`; 5090: 4096 ok, 6144 timeout). Above `min(4096, 4 GiB / (SMs × warps/SM × subgroup × 4))` it is a storage buffer per lane; other drivers keep `Function`. Only the 4090 sizes are measured. The NVIDIA-only pool fits subgroups in min(2 GiB, storage range) until teardown; excess slots sticky-flag and `WaitIdle` throws (no recycle). Header mapped host-visible/coherent (prefer device-local). Sub-dword writes, 32-bit atomics, `ds_append` and `ds_consume` are non-atomic on the lane's copy; append/consume update only the first active lane. Not measured on hardware.
+
 - [V# bases off a DWORD boundary](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (shader recompiler) - raw accesses use the exact bytes, as measured on gfx1035 (Linux, alignment mode UNALIGNED), which differs from the console's mode DWORD: on a PS5 (13.40, measured 2026-10-19 by a gfx1013 kernel run from inside a retail title) a raw `buffer_load_dword` with the V# base 1 byte past a dword, or an aligned base and `voffset` 1, returned the aligned dword (0x44332211, not 0x55443322). `s_buffer_load` reads `(base & ~3) + (offset & ~3)`, as on the console. Formatted accesses off their element's alignment throw. Atomics use the byte address `base + offset`, base's low two bits included: measured on RDNA2 (gfx1031, AMD Windows driver 32.0.21045.5002, HIP) with `buffer_atomic_add`, `_swap` and `_cmpswap`, bases 0 to 3 bytes past a DWORD boundary and offsets 0 to 7, an aligned address updates that DWORD and any other stops the dispatch, which the recompiler reports as an unaligned access fault. Closes when: raw buffer accesses drop the two low address bits as on the console
 - [Unaligned 32-bit buffer atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp) (shader recompiler) act on the dword that holds their address, as section 8.1.7 of the [RDNA2 ISA](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf) describes for alignment mode DWORD, the mode `SH_MEM_CONFIG.alignment_mode` selects on the console: on a PS5 (13.40, measured 2026-10-19 by a gfx1013 kernel run from inside a retail title) a `buffer_atomic_add` of 1 at byte offset 0x0D incremented the dword at 0x0C and left its neighbours unchanged. A 64-bit buffer atomic off an 8-byte boundary still records an unaligned BDA fault: mode DWORD would align it only to 4 bytes, which a host 64-bit atomic cannot address. When the V# base itself is off a DWORD boundary and the containing dword lies before the first aligned dword the buffer view binds to, that atomic is out of bounds and returns 0 without writing. Covered by [BufferAtomicUnaligned.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicUnaligned.cpp).
 - [32-bit bitfield masks](../../../core/shader/recompiler/Translation/src/IntegerInstructions.cpp) (`S_BFM_B32`, `V_BFM_B32`) use the truncating 32-bit shift specified by the [RDNA 1.0 ISA](https://www.amd.com/content/dam/amd/en/documents/radeon-tech-docs/instruction-set-architectures/rdna-shader-instruction-set-architecture.pdf), sections 12.1 (opcode 36) and 12.12 (opcode 867). Width and offset use their low five bits. This matches gfx1035 (Linux) for every width/offset pair, with and without upper operand bits set, and both leave SCC unchanged; not measured on the console.
@@ -169,13 +185,17 @@
 - [Static scalar calls](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) (`s_call_b64` and `s_swappc_b64`) require an ordinary even-aligned SGPR link pair (s0:s1 through s104:s105) and a later `s_setpc_b64` return reading that exact pair. Outside every region of its calls the pair is free to use wherever no return address can reach: a dataflow over the decoded instructions follows each dword of the pair from the calls that write it until a scalar load, SALU or VALU result is known to overwrite it, and an instruction there that may read a dword still holding a return address throws; SOPC compares are exempt, as they only set SCC. A VALU mask covers one SGPR in wave32 and a pair in wave64. When the graph is built without the wave size, the dataflow runs for both: a program that escapes under both throws there, and one that escapes under only one throws when it is translated at that size.
 - [Static scalar call link pairs](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) each serve one call, or several calls whose regions are disjoint, each call closed by the first return reading the pair after its target. Regions must nest or be disjoint; recursion, other shared links, escaping link values (including overlapping tuples and resource descriptors), invalid targets, interleaved regions, cross-region branches or fall-through, relative SGPR reads and dynamic `s_setpc_b64` in a program with calls throw. The analysis checks all decoded instructions, including unreachable code. Arbitrary indirect calls and general call frames are not implemented.
 - [Relative vector addressing](../../../core/shader/recompiler/Translation/src/ControlFlowInstructions.cpp) (`v_movrels_b32`, `v_movreld_b32`, `v_movrelsd_b32`, `v_movrelsd_2_b32`, `v_swaprel_b32`) keeps every vector register from the lowest base register the program addresses relatively up to the last register the program names in zero-initialised function-scope storage per invocation (`LoadVectorWindow`/`StoreVectorWindow`, one element per register), so an indexed access is one load or store instead of a compare-and-select chain over the window. [`IndexedWindowSlots`](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp) bounds each relative index through the IR (bit-field extracts, masks, shifts, adds, selects, phis, `ReadFirstLane` and the window stores that reach a load); the storage is an array of the slots below the largest bound that is under half the window, and one function variable per slot after it. A constant index uses the array element or the slot's variable; a relative access whose index has no such bound, or lands past the array at run time, indexes the array below its size and otherwise branches through an `OpSwitch` over the slot variables, so the bound only decides speed. When no index has a bound under half the window, the whole window is the array, as with `APS5_NO_WINDOW_NARROWING=1` (a recompiler switch in the shader cache key). Measured on an NVIDIA GeForce RTX 3060 (driver 615.78.08, Linux) with a compute program whose 167-register window an ALU loop reads and writes in full and whose relative accesses take `m0 = s8 & 3`: a 2048-group dispatch took 70.2 ms in wave32 and 123.3 ms in wave64 with the whole window in the array (as before narrowing) and 1.9-2.1 ms and 7.8 ms narrowed; with a second relative access whose index has no bound and lands past the array at run time (index 50 or 166), 113 ms and 5.8-6.0 ms in wave32. In the PPSA08427 (Killing Floor 3) hub it made no measurable difference to presents or to the GPU time of the eight most expensive programs. Whether the host compiler keeps the array and the slot variables in registers or spills them to scratch is not measured. A register in the window the program never wrote reads 0, as an unwritten SSA register does; the console's value is undefined. M0 is unsigned: an index at or past the window reads `v0` and drops its write, and `v_swaprel_b32` writes neither side when either is out of range, as measured on RDNA2 (gfx1035, `agc_driver_relative_indexing`). The window ends at the last register the program names rather than at the shader's VGPR allocation, which the recompiler does not receive, so a relative write past the named registers but inside the allocation is dropped where the hardware keeps it for a later relative read. Killzone: Liberation's PSP vertex program (PPSA11142, 3176 ISA words, 104 relative accesses over 154 registers) went from 649,515 to 392,333 SPIR-V words with this. Pixel programs whose relative span contains the packed ancillary input instead keep that span in SSA and implement indexed operations with compare/select chains. This keeps ancillary definitions visible to field lowering and masked-write proofs; storing the unmodelled whole word in a private array would require composing unknown bits. A fold after masked-select elimination lowers fields whose consumers become visible only after redundant copies are removed. A whole-word use that the masked-select pass keeps gets the composed word described under the packed pixel ancillary word. Both representations include implicit entry inputs in the inferred register limit and retain unsigned M0, inactive-write and DPP update rules; wave32/wave64 native Vulkan readbacks cover relative reads, writes, split-offset swaps, inactive writes, DPP masks and out-of-range accesses, but console comparison and the performance cost of selecting over this span are unverified.
+- [Lane spills read back with `v_readlane_b32`](../../../core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp) (shader recompiler) - not verified for the guest compiler: a relative write (`v_movreld_b32`, `v_movrelsd_b32`, `v_movrelsd_2_b32`, `v_swaprel_b32`) with a computed index is taken to miss a register between a `v_writelane_b32` of a lane and a later `v_readlane_b32` of it, so the read becomes the spilled scalar. That holds when the compiler keeps spill registers out of its relatively indexed arrays. Each such write that a replaced read depends on is checked at run time: one that changes that lane of that register records a fault, and the dispatch or draw fails with `which holds a scalar spilled with v_writelane_b32`, where the console would read the new value ([m0 = 1 counterexample](https://github.com/boykopovar/AnyPS5/pull/6277#issuecomment-6215244790)). An inactive or out-of-range lane writes nothing. A constant-index write of the register still ends the spill.
 - [s_call_b64](../../../core/shader/recompiler/Translation/src/ScalarInstructions.cpp) saves `PC + 4` over `GetShaderBase` and branches to `PC + 4 + signext(SIMM16) * 4`, following [AMD RDNA2 ISA](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf) sections 3.6.3, 12.2 and 12.3. Forward callees after `s_endpgm` are decoded. Measured on RDNA2 (gfx1036) in wave32 and wave64 with SIMM16 = 3: the link pair receives `PC + 4`, the branch goes to `PC + 4 + signext(SIMM16) * 4`, and `s_setpc_b64` of the link returns to the instruction after the call. Execution on the PS5 (gfx1013) and title compatibility for these bounded scalar calls remain unverified; `s_rfe_b64` still throws in translation.
 - [BDA anchor halfword reads](../../../core/shader/recompiler/SpirvBackend/src/SpirvBdaRead.cpp) retain volatile byte loads even for noncoherent memory. On RX 6650 XT / RADV Mesa 26.2.4, the valid SPIR-V for two adjacent nonvolatile byte loads returned `0x80a0` for bytes `0xa0, 0xa1`, where lookup-based reads returned `0xa1a0`. Adding the volatile operand makes the same GPU exactness fixture pass, including mixed direct/fallback lanes. The driver transformation responsible has not been isolated; removing this restriction needs equivalent readback coverage on the affected driver. Single-byte reads keep their original access mask.
 - [BDA span reads](../../../core/shader/recompiler/SpirvBackend/src/SpirvBdaRead.cpp) (shader recompiler) - `read_bda_span` is one selection: one arm calls `load_bda_span`, a `DontInline` function that holds the in-place dword loads and calls nothing, and the other arm is the per-dword byte fallback. Two other shapes of the same reads each hang a group of NVIDIA drivers, where a dispatch never finishes and the device is lost. With the loads emitted in the arm itself, a dispatch whose lanes took both arms hung on an RTX 3060 and an RTX 4060 Laptop GPU (Windows, driver 591.86) and an RTX 5060 (Linux, driver 590.48.01) ([#3291](https://github.com/boykopovar/AnyPS5/issues/3291)). With the loads and the fallback as two selections, the first under the span's condition and the second under its negation, it hung on an RTX 4070 Laptop GPU (Windows, drivers 595.97 and 596.36), an RTX 5080 (Windows, driver 610.62) and an RTX 4090 (Linux, driver 610.57.04) ([#4975](https://github.com/boykopovar/AnyPS5/issues/4975)). The current shape is measured on the RTX 4090 with driver 610.57.04 only, where it does not hang with or without SPIRV-Tools; a shape with the loads in their own `DontInline` function was reported passing on driver 591.86 in #3291. The cause inside the driver is not known.
-- [SDWA source selects on `v_cvt_f32_ubyte1`, `v_cvt_f32_ubyte2` and `v_cvt_f32_ubyte3`](../../../core/shader/recompiler/RdnaDecoder/src/RdnaVectorOpDecoder.cpp) (shader recompiler) - byte N is taken from source 0 after `SRC0_SEL` and `SRC0_SEXT` select and extend it, since SDWA supplies source 0 (RDNA 2 ISA guide 6.8 and 13.3.7) and the opcode reads `S0.u[8N+7:8N]` (12.8). Not measured on hardware.
+- [GFX10 scratch address operands](../../../core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp) (shader recompiler) - `core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp` and `core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp` use the SV/SS/ST scratch operand widths described by LLVM FLATInstructions.td at 3eb867f9b63ae2881bbe3c25d3c12842f2bdc55e (operand pseudos L557-L630, GFX10 encoding L2973-L3038). Decoding and IR tests cover the one-dword VGPR offset; PS5 hardware address-result validation remains outstanding. Unsupported scalar registers still throw.
+- [SDWA source selects on `v_cvt_f32_ubyte0` to `v_cvt_f32_ubyte3`](../../../core/shader/recompiler/RdnaDecoder/src/RdnaVectorOpDecoder.cpp) (shader recompiler) - the PS5's gfx1013 is not measured. Byte N is taken from source 0 after `SRC0_SEL` and `SRC0_SEXT` select and extend it, as measured on RDNA2 (gfx1036, Ryzen 7 9800X3D integrated graphics, AMD Windows driver 32.0.21030.31) for all seven source selects with and without `SRC0_SEXT` over 16 sources (zero, all ones, each byte's and word's sign bit set alone, mixed patterns), wave32, IEEE 0, DX10_CLAMP 1, f32 denormals flushed, f16 denormals kept, round to nearest even, FP16_OVFL 0.
 - [Flag structurization](../../../core/shader/recompiler/ControlFlow/src/Structurizer.cpp) (shader recompiler) - a graph that every structurizer attempt refuses, irreducible and non-terminating graphs included, is rebuilt with one reach flag per block and one again flag per loop (`structurizeWithFlags`): each block keeps one copy and runs behind a guard on its flag, and each strongly connected component becomes a loop whose single latch repeats it while a back edge set its flag. The output has about 8 times the input's blocks and one route variable per block, and ends in an empty Return that never runs. Only blocks that start the top-level order unconditionally run unguarded, so resource planning also sees the static paths that skip a guarded block and can plan extra descriptor candidates for them. The attempts still run first. Shared merge splitting refuses an attempt once the graph has grown past 16 times its block count at the start of splitting (at least 64 blocks); succeeding attempts grew at most 10.6 times on random graphs of up to 128 blocks, and an attempt that would succeed only beyond the budget leaves the graph to a later attempt or to this construction. Splitting that adds one block per round stays within that budget until its 4 rounds per block run out, so the attempts can still take more than 10 s (9 of 2,000 random graphs of up to 128 blocks, 63 s at most). `APS5_FORCE_STRUCTURIZER_FALLBACK=1` builds every graph this way, for tests
+- [Shared loop latches](../../../core/shader/recompiler/ControlFlow/src/Structurizer.cpp) (shader recompiler) - a loop whose single latch holds instructions and is reached by one edge gets an empty continue block, so its continue construct is that one block. A latch that several `continue` paths share keeps its instructions in the continue construct, since isolating it would clone them into each path. When such a latch emits more than one SPIR-V block, as a memory or image access does, SPIRV-Cross (MoltenVK) folds the construct into a `for` increment and drops the header's `OpPhi` updates, so the loop never advances on Metal. No title is known to reach this case.
 - [Scalar buffer descriptors](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) use only the base address, stride and record count for resources accessed exclusively by scalar loads; their fourth word is normalized to zero, following AMD RDNA2 ISA section 7.2.2. Vector and mixed accesses retain descriptor validation. Native Vulkan readbacks cover ignored fourth-word fields on Windows/NVIDIA; their console behavior has not been measured.
 - [Spanned wave64 compute](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvSubgroup.cpp) (shader recompiler) - `APS5_SPANNED_WAVE=1`, off by default, runs a single-wave wave64 compute program at one lane per invocation on a 32-lane host subgroup and exchanges ballots, shuffles and reductions between the two host subgroups through workgroup memory and barriers. The driver turns it on only where compute subgroups can be pinned at 32 full lanes (`subgroupSizeControl` and `computeFullSubgroups`), passes it as `SpirvTarget::spannedWaves` (part of the cache key and the serialized request), and creates the pipelines of spanned programs with `REQUIRE_FULL_SUBGROUPS`, since the lane number `SubgroupId * 32 + SubgroupLocalInvocationId` needs two full subgroups. Those barriers are correct only where every invocation of the workgroup reaches them, which holds for the guest's wave-uniform control flow. The emulated 64-bit LDS atomics ([LockedLdsUpdate](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp)) run only on the lanes the exec mask keeps, so their lock loop ballots within its own host subgroup, as its elect already does. Any other cross-lane exchange emitted inside per-lane control flow would hang a spanned wave in the same way, and the emitter does not reject one: there is no uniformity check. The only check so far is manual: disassemble the module (`spirv-dis`), list the selection and loop constructs that enclose each `OpControlBarrier`, and read the condition of each enclosing selection. In Ghost of Yōtei's program 0x80003af600 (PPSA26344), 108 of 111 barriers sat only in loops on wave-uniform conditions and 3 inside per-invocation conditionals, all in the lock loop. Other programs and titles have not been scanned. An earlier, cheaper ballot (one barrier instead of three) also lost the device for a reason that is not understood, which may be another barrier placement problem. Measured on an RTX 4090 (Windows): an offline replay of that program and two Yōtei runs that previously lost the device (NVIDIA TDR) now run past it, and [LdsMaskWaterfall.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/LdsMaskWaterfall.cpp) runs both modes and covers a half-inactive wave. Stray (PPSA02101) on Intel ANV and a Demon's Souls (PPSA01342) request replay showed no fault, before this fix
 - [Guest memory load guards](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (shader recompiler) - a guest load whose lane is inactive or whose address is out of bounds is still performed and its result replaced by 0 with `OpSelect`, instead of a selection per guard, when the load can be pointed at a location nothing writes: scratch reads its own element 0; storage buffers (direct buffers, GDS) read element 0xfffffffe, which `robustBufferAccess2` turns into a zero load with no memory access, so the extra read cannot race with a write the guarded program would not have raced with ([Vulkan memory model](https://docs.vulkan.org/spec/latest/appendices/memorymodel.html#data-race)). Without `robustBufferAccess2` ([VulkanDevice.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) enables it when the device has it) those loads keep their selections; LDS loads, stores, atomics, formatted and physical-address (BDA) accesses always do. LDS keeps the branch because NVIDIA's compiler predicates a branched LDS load at no cost, while the select form costs about 2.5 instructions per dword and splits a `ds_read_b128` into four loads (RTX 4060 measurements by @karanvora2599 in #4048); Intel's static counts favour the select only for wide reads, and run time was not measured on either. The aligned high word of a misaligned-capable buffer read re-reads the low word's own element. A selection guard costs four blocks per lane half and the host compiler's time grows with the block count: PPSA11142's merged PSP vertex program (3176 ISA words, wave64) emitted 16,983 blocks and 1,710 conditional branches, 5,907 and 868 with the selects. `agc_guarded_memory_loads` traces the emitted loads in both device modes.
 - [Merged hull programs](../../../core/shader/recompiler/Optimization/src/TessellationLowering.cpp) (registered binary type 3) run whole in the hull stage, one invocation per output control point. On the console hull lane i keeps local lane i's registers, which with fewer input than output control points stop matching the patch's control points from i = inputs on; here invocation i holds control point min(i, inputs - 1) of its own patch. A wave-mask branch (`s_cbranch_exec[n]z`, `s_cbranch_vcc[n]z`) tests the invocation's own lane, so it can skip a block, scalar instructions included, that the console runs for the wave; `v_readfirstlane_b32` returns the invocation's own value, not the first active lane's, and another lane's register throws. The register layout (`s3`, `v0`-`v5`, as for the separate halves) is not measured on hardware. s[0:1] hold the hull user-data address (SH 0x102/0x103) when a draw sets it and zero otherwise, so a program reading it unset faults at the null address.
 - [Wave LDS ordering on AMD's proprietary driver](../../../core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp) (shader recompiler) - there ([SubgroupBarrier.hpp](../../../core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp)) one guest wave's LDS accesses are ordered by a subgroup-scope `OpMemoryBarrier` with no control barrier, relying on a 32-lane subgroup being one hardware wave whose lanes run in lockstep and issue LDS instructions in order, which Vulkan does not guarantee; for LDS kept in device memory the same is assumed of global loads and stores, unmeasured. Driver 32.0.21042.62 (Radeon 0x13c0, RDNA 2) compiled the subgroup-scope `OpControlBarrier` to `s_barrier`, which waves in a branch paired with other waves' barriers (PS5LM Plus). Measured on that driver only ([LdsTreeReduction.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/LdsTreeReduction.cpp)); a Radeon 860M on 32.0.13058.8001 reportedly did not show the fault.
+- [LDS atomic fences on AMD's proprietary driver](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp) (shader recompiler) - there ([SubgroupBarrier.hpp](../../../core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp)) the fence after an LDS atomic or a sub-dword or misaligned LDS store is a device-scope `OpMemoryBarrier`, which that driver compiles to GL0 and GL1 cache invalidations; the cost is unmeasured. Driver 32.0.21042.62 (Radeon 0x13c0, RDNA 2) compiled the workgroup-scope fence to `s_barrier`, which waves in a branch paired with other waves' barriers (PS5LM Plus with flash attention). Measured on that driver only ([LdsSubwordStoreBranch.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp)); a Radeon 860M (RDNA 3.5, 32.0.13058.8001) reportedly gave correct flash-attention output, but the gate covers every version.
diff --git a/docs/user/INPUT_MAPPING.md b/docs/user/INPUT_MAPPING.md
index 7fd7a8d16d..05c49f2559 100644
--- a/docs/user/INPUT_MAPPING.md
+++ b/docs/user/INPUT_MAPPING.md
@@ -1,6 +1,6 @@
 # Controller, keyboard and mouse input
 
-AnyPS5 accepts SDL-mapped game controllers as well as its built-in keyboard and mouse bindings. Xbox-style controllers and PlayStation controllers recognized by SDL use the standard PS button layout; sticks and analog triggers are passed through, and controllers can be connected or disconnected while the game is running. The first recognized controller is used. AnyPS5 uses its built-in keyboard and mouse bindings when no configuration file is present. To change selected keyboard and mouse bindings, create `anyps5-input.ini` beside the generated game executable. Set `ANYPS5_INPUT_CONFIG` to use a file at another path. Both the game directory and that path may contain any characters, such as `ü` or `日本`.
+AnyPS5 accepts SDL-mapped game controllers as well as its built-in keyboard and mouse bindings. Up to 4 controllers are supported simultaneously. The first connected controller is assigned to Player 1 and composed with keyboard and mouse input; additional controllers are sequentially assigned to Players 2, 3, and 4 (matching `libSceUserService` users). Xbox-style controllers and PlayStation controllers recognized by SDL use the standard PS button layout; sticks and analog triggers are passed through, and controllers can be connected or disconnected dynamically while the game is running. AnyPS5 uses its built-in keyboard and mouse bindings when no configuration file is present. To change selected keyboard and mouse bindings, create `anyps5-input.ini` beside the generated game executable. Set `ANYPS5_INPUT_CONFIG` to use a file at another path. Both the game directory and that path may contain any characters, such as `ü` or `日本`.
 
 For an Xbox-layout controller, A/B/X/Y map to Cross/Circle/Square/Triangle, LB/RB map to L1/R1, and LT/RT map to analog L2/R2. Start maps to Options. D-pad and stick-click buttons are supported. On a PlayStation controller, touchpad clicks and the positions of up to two fingers on the touchpad are forwarded. On other controllers, View (Back) presses the touchpad at its center.
 
@@ -131,3 +131,27 @@ MouseCurve = 1.3
 Earlier versions sampled the mouse every 33 ms and tilted the stick at least halfway for any movement. `MouseDeadzoneOffset = 0.5`, `MouseSmoothingMs = 0` and `MouseDecayMs = 33` come close to that behavior.
 
 An invalid line reports the file and line number and stops input initialization. If the configured file does not exist or cannot be read, AnyPS5 reports an error. With no `anyps5-input.ini` and no `ANYPS5_INPUT_CONFIG`, the built-in mapping is used.
+
+## Web configurator
+
+The [input mapper](../../tools/input-mapper/index.html) edits keyboard, mouse and wheel overrides in the browser. It supports alternate bindings, physical-key capture, search, INI import, preview, copy and download. Invalid imports preserve the current configuration. Invalid bindings block export; duplicate and shared inputs, including retained built-in bindings, produce warnings. Removing every binding for an action restores its built-in inputs.
+
+From the repository root, with Node.js 22 or later:
+
+```sh
+npm --prefix tools/input-mapper start
+```
+
+Open `http://127.0.0.1:4173`. Stop the server with Ctrl+C. No package installation is required. Set `PORT` to use another port. Run the tests with:
+
+```sh
+npm --prefix tools/input-mapper test
+```
+
+Controls, Configuration and Help are separate views; switching views preserves bindings. Search covers all control groups. The group selector supports arrow keys, Home and End. Input and language menus support search, arrow keys and Enter; Escape cancels selection. Menus open beside their fields on larger screens and as bottom sheets on phones. The interface uses system fonts and respects reduced-motion preferences.
+
+The translation button selects one of 22 interface and FAQ languages. First visits use English; a saved language choice takes priority. Egyptian Arabic appears first in the language list. Arabic, Urdu and Persian use right-to-left layouts. Only the language preference is persisted; copy or download input changes before reloading.
+
+Keyboard capture converts physical browser key codes to SDL scancode names. Escape cancels capture; select Escape manually to assign it. Composition, ambiguous keys and some browser or system shortcuts require manual selection. Names containing `#` or `;` cannot be exported because those characters start INI comments. The key catalogue follows SDL commit `4b69833bc54abf3dd3288d4aa7afbba527775e5b`. The source-contract tests compare actions, restrictions and defaults with the current native input code.
+
+For static hosting, serve `index.html`, `styles.css`, `app.js`, `mapping.js`, `keys.js`, `capture.js`, `validation.js`, `i18n.js` and `dropdown.js` from one directory. The configurator is not published on the project's GitHub Pages site yet.
diff --git a/docs/user/USAGE.md b/docs/user/USAGE.md
index bf137f6dd6..bba0b4d542 100644
--- a/docs/user/USAGE.md
+++ b/docs/user/USAGE.md
@@ -29,6 +29,8 @@ relinker [options] <input.elf> <output>
 
 An explicit `--module-dir` also works when the module parent has no `sce_module`, `sce_modules` or `prx` directory. For a homebrew bundle with shared libraries beside its executable, use `--module-dir .`; no empty standard directory is required. Without an explicit module directory, the standard-directory requirement remains.
 
+A module the executable needs that is not converted is looked for under the module parent directory, outside the module directories. Each SELF container or `ET_SCE_DYNAMIC` ELF found there whose name matches, up to the `.prx`, `.sprx`, `.suprx` or `.debug_prx` suffix (ignoring case with `--windows`, as the guest module match does), is reported after the conversion with the `--module-dir` that would include it; the output still refers to a host library of that name. A file that cannot be read is not reported.
+
 Linux output:
 
 ```sh
@@ -64,20 +66,20 @@ All switches are disabled by default. `unused-filter` defaults to `0`; `--rpath`
 | `--macos`                     | Produce an x86-64 Mach-O executable, with bundled modules as Mach-O libraries in `app0/sce_module`. Conflicts with `--windows`.                                                                                                                                                                                                                                                                                                                                             |
 | `--windows-diagnostics`       | Include startup dependency diagnostics. Requires `--windows`.                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `--windows-gui`               | Select the Windows GUI subsystem instead of the console subsystem. Requires `--windows`.                                                                                                                                                                                                                                                                                                                                                                                    |
-| `--windows-fixed-base <address>` | Map the lowest ELF load page at this fixed Windows address, given in decimal or hexadecimal (`0x`). Requires `--windows`, a 64 KiB-aligned address from `0x20000` through `0x7fffffff0000`, and a complete image fitting in the user address space. The main executable has no ASLR or base relocations; an occupied address fails to load. Bundled modules keep their normal placement. |
-| `--trace-imports`             | Pass each function import through the libc.prx call tracer, see [tracing system library calls](#tracing-system-library-calls). Windows and Linux output only; conflicts with `--lazy-binding`.                                                                                                                                                                                                                                                                              |
+| `--windows-fixed-base <address>` | Map the lowest ELF load page at this fixed Windows address instead of the preferred `0x400000`, given in decimal or hexadecimal (`0x`). Requires `--windows`, a 64 KiB-aligned address from `0x20000` through `0x7fffffff0000`, and a complete image fitting in the user address space. The main executable has no ASLR or base relocations; an occupied address fails to load. Bundled modules keep their normal placement. |
+| `--trace-imports`             | Pass each function import through the libc.prx call tracer, see [tracing system library calls](#tracing-system-library-calls). Windows, Linux and macOS output; conflicts with `--lazy-binding`.                                                                                                                                                                                                                                                                             |
 | `--linux-fixed-base <address>` | Load the Linux executable at this fixed address instead of the default `0x400000`, given in decimal or hexadecimal (`0x`): every virtual address of the image is offset by it, so virtual address 0 is placed at the address, as the console places an executable. Requires a 64 KiB-aligned address from `0x10000` through `0x7fffffff0000` that is a multiple of every `PT_LOAD` alignment, and an image that ends in the user address space. The executable is written as `ET_EXEC`, without ASLR, as it is at the default address. Bundled modules keep their normal placement. Conflicts with `--windows`, `--macos` and `--lazy-binding`. |
 | `--macos-fixed-base <address>` | Map the lowest ELF load page of the macOS executable at this fixed address, given in decimal or hexadecimal (`0x`). Requires `--macos`, a 64 KiB-aligned address from `0x20000` through `0x7fffffff0000`, and an image that ends in the macOS user address space. `__PAGEZERO` ends 64 KiB below the address and the Mach-O header occupies those 64 KiB. The executable has no ASLR; an address the process cannot map fails to load. Bundled modules keep their normal placement. |
 | `--to-intel`                  | Convert supported AMD-only instructions in the executable and bundled modules. Unsupported instructions or unreachable conversion stubs cause an error.                                                                                                                                                                                                                                                                                                                     |
-| `--to-rosetta`                | Convert as `--to-intel` does and also lower what Rosetta lacks: ANDN becomes scalar NOT/AND, RDSEED becomes RDRAND, CLWB a NOP, and RDPID and the ECX of RDTSCP return processor 0. Implies `--to-intel`. Independent of `--macos`: `--macos` alone leaves these instructions as they are. Conflicts with `--windows`.                                                    |
+| `--to-rosetta`                | Convert as `--to-intel` does and also lower what Rosetta lacks: ANDN becomes scalar NOT/AND, RDSEED becomes RDRAND, CLWB a NOP, XSAVEOPT becomes XSAVE, and RDPID and the ECX of RDTSCP return processor 0. Implies `--to-intel`. Independent of `--macos`: `--macos` alone leaves these instructions as they are. Conflicts with `--windows`.                                                    |
 | `unused-filter=0`             | Keep all imported NID references.                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `unused-filter=1`             | Filter unused non-PLT imports using control-flow and GOT access analysis, treating address-taken code as reachable; preserve PLT imports.                                                                                                                                                                                                                                                                                                                                   |
 | `unused-filter=2`             | Apply strict unused-import analysis and compact the PLT. Unsupported analysis cases cause an error.                                                                                                                                                                                                                                                                                                                                                                         |
 | `--registry`                  | Write `<output-stem>.registry.json` beside the output executable, and `<output-stem>.<module>.registry.json` for each converted bundled module.                                                                                                                                                                                                                                                                                                                             |
-| `--rpath <path>`              | Set the system library search path. Quote `$ORIGIN` to prevent shell expansion, for example `--rpath '$ORIGIN/libs'` in Bash or PowerShell. Linux guest modules require an absolute path or a path beginning with `$ORIGIN`. Windows requires a nonempty ASCII path and supports `$ORIGIN` as the executable directory.                                                                                                                                                     |
+| `--rpath <path>`              | Set the system library search path. Quote `$ORIGIN` to prevent shell expansion, for example `--rpath '$ORIGIN/libs'` in Bash or PowerShell. On Linux every colon-separated entry must be nonempty, and with guest modules each must be absolute or begin with `$ORIGIN`. Windows requires a nonempty ASCII path and supports `$ORIGIN` as the executable directory.                                                                                                         |
 | `--autorun`                   | Run the output after conversion, print its exit code, and wait for Enter. Adds executable permissions for Linux output. Requires the target OS and prepared runtime layout.                                                                                                                                                                                                                                                                                                 |
 | `--sce-module-path <path>`    | Parent of the module directories, not the module directory itself. Default: input ELF parent; relative input paths resolve from the process working directory. Explicit absolute path: used directly. Explicit relative path (including `.` and `..`): relative to the process working directory. Output path has no effect. Requires one nonempty value; repeats, nonexistent or nondirectory paths, access failures, and combination with `--skip-sce-module` are errors. |
-| `--module-dir <dir>`          | Relink the ELF modules of a directory under the module parent directory, besides `sce_module`/`sce_modules`/`prx`; outputs keep the relative path. A module another module needs is initialized at startup, and on Linux and macOS also one the executable needs; any other when the title loads it with `sceKernelLoadStartModule`, with its start arguments (for example Unity plugins in `Media/Plugins`, or `mono-ps4.sprx` on Windows). Repeatable; `.` is the parent itself, without the input ELF. Conflicts with `--skip-sce-module`.  |
+| `--module-dir <dir>`          | Relink the ELF modules of a directory under the module parent directory, besides `sce_module`/`sce_modules`/`prx`; outputs keep the relative path. Needed modules are mapped at startup. On Linux, modules in these extra directories initialize only when explicitly loaded, with the arguments from `sceKernelLoadStartModule` (for example Unity plugins in `Media/Plugins`). A module another module needs initializes at startup on Windows and macOS; one only the executable needs initializes when explicitly loaded on Windows and at startup on macOS. Other modules initialize when loaded. Repeatable; `.` is the parent itself, without the input ELF. Conflicts with `--skip-sce-module`.  |
 | `--executable <path>`         | Also convert another executable of the title, which it starts with `sceSystemServiceLoadExec`; the path is relative to the module parent directory, for example `picker/picker.bin`. It is written beside the output, named after the path with `/` replaced by `.` and given the output's extension (`picker.picker.bin.exe`), and uses the same `libs/`, `app0/` and guest modules. It is an error if a guest module converts differently for it. Repeatable. Conflicts with `--skip-sce-module`. |
 | `--patches <file>`            | Apply the byte patches of this file during conversion, see [game patches](#game-patches). Overrides `relinker-patches.toml` discovery. Conflicts with `--no-patches`. |
 | `--no-patches`                | Do not apply patches, and do not load `relinker-patches.toml` from the input directory. |
@@ -87,6 +89,7 @@ All switches are disabled by default. `unused-filter` defaults to `0`; `--rpath`
 | `--exclude-sce-module <file>` | Deprecated. Exclude a bundled module by exact filename, not path. Repeat for multiple files; a missing filename is an error. Conflicts with `--skip-sce-module`.                                                                                                                                                                                                                                                                                                            |
 | `--skip-syscall-check`        | Deprecated. Disable syscall scanning in the executable and bundled modules.                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `--trap-sdk-syscall-stubs`    | Replace the exact ps5-payload-dev generic and numbered syscall wrapper stubs and the recognized inline mmap/mprotect sequences from SDK libc/mman.c with `UD2`, so unused wrappers do not block relinking. Other syscall instructions still cause an error. If a trapped wrapper runs, it raises an illegal-instruction exception. For debugging only.                                                                                                                                                                    |
+| `--frame-red-zone`            | Windows only: give leaf functions that keep values below RSP (the System V red zone) a frame, so an exception Windows delivers on a guest thread cannot overwrite them. Covers leaves with a `push rbp; mov rbp, rsp; push ...` prologue and leaves that only push registers, with or without a `sub` allocation after the pushes; in those, RSP is lowered only as far as the leaf reaches below it and their RSP operands are moved with it, in place or, when their encoding cannot hold the moved displacement, in a stub. Function bounds come from the executable's `.eh_frame`, and the relinker stops with an error when it has none. The relinker prints how many it framed and why it skipped the others, and refuses a game patch over a framed site. |
 | `--lazy-binding`              | Deprecated. Enable lazy symbol binding instead of eager binding. Incompatible with bundled ELF modules. The Linux executable stays position independent (`ET_DYN`) instead of being placed at `0x400000`. |
 
 Specify `unused-filter=0|1|2` without `--`, at most once. Unknown options and extra positional arguments are errors. Use `relinker --help` to print the usage syntax to stdout and exit with code `0` without converting files. Invoking `relinker` without arguments prints the usage syntax to stderr and exits with code `1`.
@@ -99,6 +102,34 @@ The `--skip-sce-module`, `--exclude-sce-module <file>`, `--skip-syscall-check`,
 
 A patch file changes bytes of the input executable or of a bundled module before conversion, for a title that hard-codes a value the host cannot meet. The relinker checks the bytes it replaces, so a patch for another version of the title fails instead of corrupting it. With no patch file the output is unchanged.
 
+The advisor requires Python 3.11 or newer. To check a local patch catalog, run:
+
+```sh
+python3 tools/suggest_patches.py --catalog <directory> --param-json <sce_sys/param.json> --input <input.elf> --relinker <relinker> [--sce-module-path <directory>] [--module-dir <directory>]... [--executable <path>]... [--skip-sce-module] [--timeout-seconds <seconds>] [--list-verified]
+```
+
+The advisor reads `titleId` and `contentVersion` from the specified `param.json`, checks the SHA-256 of every file targeted by a candidate patch, then calls the relinker specified by `--relinker` to run `--verify-patches`. A relative path such as `--relinker ./relinker` resolves to that local file. The explicit metadata path also works when `param.json` and the unwrapped ELF files are stored separately. The catalog directory must contain an `index.json` with `format: 1` and an `entries` array. Each entry has `titleId`, `contentVersion`, a relative `patch` path, and `targets` mapping every patch target to its SHA-256. Hexadecimal digests are case-insensitive. For example:
+
+```json
+{
+  "format": 1,
+  "entries": [{
+    "titleId": "TEST00001",
+    "contentVersion": "01.000.000",
+    "patch": "patch.toml",
+    "targets": {"Media/Modules/module.prx": "<SHA-256 in hexadecimal>"}
+  }]
+}
+```
+
+The advisor validates patch files only for entries matching the requested title and version. It reports and skips a malformed matching entry or a relinker verification error, so another valid entry can still be recommended. Verification times out after 120 seconds per entry by default; use `--timeout-seconds <positive integer>` to change the limit. For synthetic inputs without system modules, use `--skip-sce-module` if conversion also uses it; this option conflicts with `--sce-module-path`. No matching entry or no verified patch exits `1`; invalid input or no verified patch after a relinker error exits `2`. If multiple entries verify, the advisor recommends none because it cannot choose or combine them, and points to `--list-verified` to inspect the matches. The tool does not fetch or apply patches. A recommendation prints `--patches` and the module and executable options to use when converting. Keep catalog patch files outside the input executable's directory to avoid automatic `relinker-patches.toml` discovery.
+
+With `--list-verified`, the advisor prints every entry that passes metadata, hash and relinker checks, in catalog order. Each result includes its catalog number, patch file, target hashes and conversion options. It exits `0` when at least one entry verifies, even if another entry was rejected; with no verified entries, the existing `1` or `2` exit status still applies. Without this option, a single verified entry is recommended and multiple verified entries remain ambiguous. The listing tells users to choose one patch file. It does not combine patch files or apply them during conversion; review the chosen patch before applying it.
+
+The target hashes identify the exact unwrapped files changed by a patch, which might not include the main executable. Different dump tools could produce different bytes for the same title version; the advisor then rejects a patch even if it would work. It has not been confirmed that all dump tools produce identical files. The hashes do not authenticate a catalog or establish that a patch is safe or that the title is fully playable. Use catalogs from sources you trust and review the patch before applying it.
+
+If the patch targets another title executable, pass `--executable <path>` to the advisor for each additional executable, using paths relative to the module parent directory, such as `picker/picker.bin`. The advisor hashes those target files and forwards the same options to `relinker --verify-patches`. Use the same `--executable` options when converting with `--patches`.
+
 `relinker-patches.toml` in the directory of the input executable is loaded automatically and announced as `Patches: <path>`. `--patches <file>` names another file, and `--no-patches` loads none. Each applied patch is reported:
 
 ```
@@ -149,7 +180,7 @@ Verify mode rejects the conversion options (`--windows`, `--macos`, `--to-intel`
 
 ## Runtime layout
 
-For an executable that assumes its image starts at `0x400000`, use `relinker --windows --windows-fixed-base 0x400000 source/input.elf app.exe`. This maps its lowest ELF load page there; the PE headers occupy the preceding 64 KiB. Use this option only when the executable requires an exact address. Without it, the Windows executable has no `DYNAMIC_BASE` and loads at its preferred base `0x140000000`; relocations are kept, so Windows relocates it if that range is taken. Modules keep `DYNAMIC_BASE`. This option does not change macOS output.
+The Windows executable has no `DYNAMIC_BASE` and prefers to load with its lowest ELF load page at `0x400000`, where Ruffle (PPSA68091), VLC (PPSA85300) and XPSemu (PPSA97358) expect their image when they read their `app0/imports.txt`; the PE headers occupy the preceding 64 KiB (preferred base `0x3f0000`). Relocations are kept, so Windows can relocate it if that range is taken. When the executable requires an exact address, use `relinker --windows --windows-fixed-base <address> source/input.elf app.exe`, which maps the lowest ELF load page at that address without relocations, so an occupied address fails to load. Modules keep `DYNAMIC_BASE`. This option does not change macOS output.
 
 For an executable that assumes its image starts at `0x400000`, as Ruffle (PPSA68091), VLC (PPSA85300) and XPSemu (PPSA97358) do when they read their `app0/imports.txt`, use `relinker --macos --macos-fixed-base 0x400000 source/input.elf app` on macOS. Use this option only when the executable requires a fixed address; without it, macOS output places the lowest ELF load page at `0x140010000`. Linux output places virtual address 0 at `0x400000` without an option, inside the 40-bit window that a title's own `sceLibcMspaceCreate` checks; `--linux-fixed-base` selects another address, and with `--lazy-binding` the executable stays position independent.
 
@@ -174,9 +205,9 @@ Some applications also need their original `app0/sce_sys/param.json` at runtime.
 
 Resources can also be packed into `app0.zar` beside `app0/`, a [ZArchive](https://github.com/Exzap/ZArchive) whose root is the `app0/` directory. A file present in `app0/` is read from there and any other file from the archive; the executable, `sce_module/` and `sce_sys/` stay in `app0/`. The archive is read only through `sceKernelOpen`/`open`, the read, seek and stat calls on its descriptors and `sceKernelStat`; other calls on an archived path, listing a directory that the archive also contains and opening a file in it for writing fail as described in [technical debt](../dev/debt/libkernel.md). An archive that cannot be opened stops the title at its first file access.
 
-Use the generated files printed as `Guest module:` for bundled title modules. `libs/` is for AnyPS5 system libraries, not the original PS5 `.prx` files. Placing an original PS5 module in `libs/` on Windows makes Windows try to load it as a DLL and can fail with error 193 (not a valid Win32 application). A module the title loads while it runs that was not relinked, such as one in a directory not given to `--module-dir`, is not loaded either: the title gets an error and continues, and the runtime prints `[module] dlopen: <path> was not relinked: ...` once for each file. Relink that module's directory with `--module-dir <dir>`.
+For bundled title modules, use the `.guest.prx` files the relinker writes into `app0/` and lists in the layout it prints. `libs/` is for AnyPS5 system libraries, not the original PS5 `.prx` files. Placing an original PS5 module in `libs/` on Windows makes Windows try to load it as a DLL and can fail with error 193 (not a valid Win32 application). A module the title loads while it runs that was not relinked, such as one in a directory not given to `--module-dir`, is not loaded either: the title gets an error and continues, and the runtime prints `[module] dlopen: <path> was not relinked: ...` once for each file. Relink that module's directory with `--module-dir <dir>`.
 
-On Windows, a self-built `libs/` also needs `libgcc_s_seh-1.dll`, `libstdc++-6.dll` and `libwinpthread-1.dll` from the `mingw64/bin` directory of the toolchain that built the libraries; the release archives already contain them. The libraries are loaded without searching `PATH`, so a copy elsewhere on the system is not used, and a library that needs one of them fails with error 126 (the specified module could not be found) although its `.prx` file is present.
+On Windows, a self-built `libs/` also needs `libgcc_s_seh-1.dll`, `libstdc++-6.dll` and `libwinpthread-1.dll` from the `mingw64/bin` directory of the toolchain that built the libraries; the release archives already contain them. The libraries are loaded without searching `PATH`, so a copy elsewhere on the system is not used, and a library that needs one of them fails with error 126 (the specified module could not be found) although its `.prx` file is present. With `APS5_MIMALLOC` set, the title loads `mimalloc.dll` and `mimalloc-redirect.dll` from `libs/` and allocates through mimalloc. Copy both from `build/core/libs/libs`; the release archives contain them. Without them the title keeps the C runtime's heap and prints nothing.
 
 On Windows, direct memory (`sceKernelAllocateDirectMemory`, up to 13824 MiB per title) is committed when the title maps it, not when the title allocates it or first uses its pages. The system commit limit (installed memory plus page file size, the second value of Committed in Task Manager) must cover the mapped direct memory together with all other committed memory. Otherwise `sceKernelMapDirectMemory` throws `replace guest placeholder with resident direct memory` with the Windows error (`commit direct memory pages` when a page is mapped at a second address, `keep unmapped direct memory` when it is unmapped); enlarge the page file or close other applications.
 
@@ -243,9 +274,9 @@ A game unlocks a trophy by posting a `_UnlockTrophy` event with an int32 `_troph
 
 The trophy data comes from the game's own `app0/sce_sys/trophy2/trophyNN.ucp`, where `NN` is the service label (`00` for most games). The trophy queries report its names, descriptions and rewards in the console language (`ANYPS5_LANGUAGE`, see above), or in English (United States) or the data's default language when it has no text in that language, and its grades, groups, hidden flags, number of trophies and grade counts. A platinum trophy unlocks as soon as every trophy that names it in `platinumTrophyId` is unlocked. The first trophy query or event prints what was read, such as `[trophy] /app0/sce_sys/trophy2/trophy00.ucp: 52 trophies, 1 group, texts in en-US`.
 
-Many games unlock trophies through statistics instead: `app0/sce_sys/uds/udsNN.ucp` names, for each event, the property whose value becomes a statistic, and a trophy's `unlockCondition` compares a statistic with a target. The latest value of each statistic is stored in `_trophy/<user id>_<service label>.stats.txt`, one `<stat id> <value>` line per statistic, and is kept across runs; delete it together with the unlock file to start over. A progressive trophy reports its statistic as progress. Only statistics that keep the latest value (`"aggregation":"latest"`) as `uint32` or `uint64`, and rules that copy one property of an event chosen by its name (`$.name` or `$.object.name`), are applied; the others are listed in `[trophy]` lines when the file is read.
+Many games unlock trophies through statistics instead: `app0/sce_sys/uds/udsNN.ucp` names, for each event, the property whose value becomes a statistic, and a trophy's `unlockCondition` compares a statistic with a target. The latest value of each statistic is stored in `_trophy/<user id>_<service label>.stats.txt`, one `<stat id> <value>` line per statistic, and is kept across runs; delete it together with the unlock file to start over. A progressive trophy reports its statistic as progress. Only statistics that keep the latest (`"aggregation":"latest"`) or the largest value (`"max"`) as `uint32`, `uint64` or `int32`, and rules that copy one property of an event chosen by its name (`$.name` or `$.object.name`), optionally only when one property equals an integer (`_UpdateTrophyProgress` by its `_trophy_id`), are applied; the others are listed in `[trophy]` lines when the file is read.
 
-`APS5_TRACE_UDS=1` prints every posted event, such as `[uds] context 1 posted _UnlockTrophy {"_trophy_id":12}`, every statistic an event sets, such as `[uds] stat 10 of user 268435456 is 10 (COLLECT $.counter)`, and a `[uds]` line for a missing `trophyNN.ucp` or `udsNN.ucp`. An event that is not used prints the reason in a `[trophy] ignored` line: an `_UnlockTrophy` event without an int32 `_trophy_id` of 0 or more, or posted to a context that does not exist; the first `_UpdateTrophyProgress` event of each trophy, because that event is not interpreted; and, once per rule, an event whose property is missing, negative, not an integer or outside the statistic's range.
+`APS5_TRACE_UDS=1` prints every posted event, such as `[uds] context 1 posted _UnlockTrophy {"_trophy_id":12}`, every statistic an event sets, such as `[uds] stat 10 of user 268435456 is 10 (COLLECT $.counter)`, and a `[uds]` line for a missing `trophyNN.ucp` or `udsNN.ucp`. An event that is not used prints the reason in a `[trophy] ignored` line: an `_UnlockTrophy` event without an int32 `_trophy_id` of 0 or more, or posted to a context that does not exist; and, once per rule, an event whose property is missing, negative, not an integer or outside the statistic's range.
 
 A missing or malformed `trophyNN.ucp` or `udsNN.ucp` turns off only what it provides, and a malformed one prints the reason once: without trophy data the queries report placeholders and statistics unlock nothing, and without statistics rules events change no statistic. Icons are not read: `sceNpTrophy2GetGameIcon`, `sceNpTrophy2GetGroupIcon`, `sceNpTrophy2GetTrophyIcon` and `sceNpTrophy2GetRewardIcon` stop the game with an error. So does an unlock or statistics file in `_trophy/` that is damaged (a line that is not a new `<id> <value>` pair, such as a line an edit left blank or ended with a carriage return) or cannot be read or written. No notification is shown, and callbacks registered with `sceNpTrophy2RegisterUnlockCallback` are not called.
 
@@ -291,7 +322,7 @@ Recompiled shaders and the Vulkan pipeline cache are kept in a `shader_cache/` d
 
 ### Pipeline journal
 
-Besides the recompiled shaders, the shader cache directory holds `pipelines.journal`: every Vulkan graphics pipeline the pipeline store kept and every compute pipeline a run built, with the specialized shader modules they were built from. The next run of the title builds those pipelines on background threads while it loads, so a draw or dispatch the earlier run already made does not compile its pipeline when it is first reached. The journal belongs to the GPU and driver that wrote it, like the driver's pipeline cache file next to it: a run on another GPU or driver version starts it over, and the driver's own pipeline cache decides how fast each pipeline is rebuilt. Two runs sharing the directory take turns on `pipelines.journal.lock`; a run that cannot lock it records nothing. `APS5_NO_PIPELINE_JOURNAL=1` disables recording and replay; `APS5_PIPELINE_JOURNAL_THREADS` sets the replay threads (half the CPU threads by default; `0` records without replaying), `APS5_PIPELINE_JOURNAL_ENTRIES` how many pipelines are replayed (the first recorded, which a run reaches first) and `APS5_PIPELINE_STORE_ENTRIES` how many graphics pipelines stay resident (1024 each), and `APS5_PIPELINE_JOURNAL_MAX_MIB` (1024) the file size at which recording stops. Deleting the file loses nothing but the head start. With `APS5_PROFILE_DRAW=1` a `[pipeline-journal]` line reports what was loaded, replayed and recorded.
+Besides the recompiled shaders, the shader cache directory holds `pipelines.journal`: every Vulkan graphics pipeline the pipeline store kept and every compute pipeline a run built, with the specialized shader modules they were built from. The next run of the title builds those pipelines on background threads while it loads, so a draw or dispatch the earlier run already made does not compile its pipeline when it is first reached. The journal belongs to the GPU and driver that wrote it, like the driver's pipeline cache file next to it: a run on another GPU or driver version starts it over, and the driver's own pipeline cache decides how fast each pipeline is rebuilt. Two runs sharing the directory take turns on `pipelines.journal.lock`; a run that cannot lock it records nothing. `APS5_NO_PIPELINE_JOURNAL=1` disables recording and replay; `APS5_PIPELINE_JOURNAL_THREADS` sets the replay threads (half the CPU threads by default; `0` records without replaying), `APS5_PIPELINE_JOURNAL_ENTRIES` how many pipelines are replayed (4096, the last recorded) and `APS5_PIPELINE_STORE_ENTRIES` how many graphics pipelines stay resident (by default the store grows from 1024 up to 4096 to hold the replay and the pipelines that keep coming back), and `APS5_PIPELINE_JOURNAL_MAX_MIB` (1024) the file size at which recording stops. Deleting the file loses nothing but the head start. With `APS5_PROFILE_DRAW=1` a `[pipeline-journal]` line reports what was loaded, replayed and recorded.
 
 ### Draw pipeline
 
@@ -299,6 +330,8 @@ Besides the recompiled shaders, the shader cache directory holds `pipelines.jour
 
 ### Texture cache budget
 
+Image and buffer memory allocations retry after releasing unused pooled buffers and reclaimable texture cache entries. Recovery preserves storage images with pending GPU results and resources retained by recorded work. `[bufferpool]` recovery and failure lines report the requested allocation, memory released and retry count. An allocation still fails if recovery cannot free enough memory.
+
 Sampled textures and storage images stay in device memory in two caches that evict their least recently used entries when they grow past their budgets. The storage image budget is what the `VK_EXT_memory_budget` budget of the largest device-local heap leaves after the heap's use other than the cached storage images themselves and an eighth of the budget; it is capped at a quarter of that budget, at most a quarter of the heap's size or 2 GiB, whichever is larger, and never below 512 MiB. The sampled texture budget is what the reported budget leaves after the heap's use other than cached textures, a quarter of the heap's size (at least 2 GiB) and an eighth of the budget, and never below 2 GiB. As the heap's other use grows the sampled budget falls first, to that floor, then the storage budget; the storage budget also gives back what the sampled textures alive take as they grow. Each cache trims at its next insert. Both budgets are read again every second; `[gpu] sampled texture cache budget` lines report them at start-up and when either moves by more than a tenth, at most every 10 s. `APS5_TEXTURE_CACHE_MIB=<n>` fixes both budgets at `n` MiB, and the lines are then not printed.
 
 A fixed budget above the automatic one can exceed what the card holds next to the rest of the frame. Allocations then go to host memory (`[gpu] ... placed in host memory` lines), where the GPU reads them over PCIe. PPSA16064 on an RTX 4060 8 GB, whose automatic storage image budget was 1797 MiB under the earlier rule, placed 868 and 878 MiB in host memory with `APS5_TEXTURE_CACHE_MIB=3072` and walked through its first level at 4.46 and 4.83 FPS; with the variable unset it placed none and ran the same walk at 6.48 and 6.07 FPS. Leave it unset unless a measurement on the card shows otherwise.
@@ -315,7 +348,7 @@ To measure how a title runs on a machine, start it with `APS5_TRACE_SUMMARY_EVER
 
 ### Tracing system library calls
 
-Windows and Linux. An executable converted with `--trace-imports` records the calls it makes to the libraries named in `APS5_TRACE_CALLS`, a comma-separated list such as `libkernel,libSceSaveData`, or `all`. Without the variable nothing is recorded. The crash and abort reports then end with the last 64 calls (on Linux, which has no crash report, only an abort prints them): sequence number, thread, library, import name as the executable imports it (a NID) and the caller's address. The last 32 of these calls made by the reporting thread follow, taken from the 65536 most recent calls, so a thread whose calls were pushed out of the last 64 by a busier one still shows them. Then come the 32 most called imports since start-up, with their number of calls.
+Windows, Linux and macOS. An executable converted with `--trace-imports` records the calls it makes to the libraries named in `APS5_TRACE_CALLS`, a comma-separated list such as `libkernel,libSceSaveData`, or `all`. Without the variable nothing is recorded. The crash and abort reports then end with the last 64 calls (on Linux and macOS, which have no crash report, only an abort prints them): sequence number, thread, library, import name as the executable imports it (a NID) and the caller's address. The last 32 of these calls made by the reporting thread follow, taken from the 65536 most recent calls, so a thread whose calls were pushed out of the last 64 by a busier one still shows them. Then come the 32 most called imports since start-up, with their number of calls.
 
 ```
 last traced system library calls (APS5_TRACE_CALLS):
@@ -326,6 +359,13 @@ most called traced imports (1 calls in total):
              1 libkernel.prx k+AXqu2-eBc
 ```
 
+To list every import a title calls during a run that ends without a crash, also set `APS5_TRACE_CALLS_FILE` to a file path. Every 10 seconds the file is rewritten with one line per import called so far, most called first: the number of calls, the library and the import name. It survives a run that is killed, up to its last rewrite.
+
+```
+245557 libc.prx gQX+4GDQjpM#guest
+3866 libSceAgc.prx 57labkp+rSQ
+```
+
 Limits are listed in the [libc](../dev/debt/libc.md) and [relinker](../dev/debt/relinker.md) technical debt.
 
 ### Performance overlay
@@ -387,6 +427,8 @@ python3 tools/import_audit.py app.registry.json app.libc.prx.guest.prx.registry.
 | `absent` | No built library exports the NID: the loader fails. |
 | `module` | The import names a file found in `--modules` (the title's own library), which is trusted to provide it. |
 
+An import that names a library requires the literal export name. If its implementation is found only by hashing the import name, it still counts as `implemented` or `stub`, but the report lists the name mismatch, sets `symbol_mismatch` on the JSON import record and counts it in the summary, and exits with code 1. A strong import with a name mismatch is a current stop. Imports without a library retain the audit's name-to-NID fallback.
+
 Module registries mark ELF weak imports with `"weak": true`, allowing the audit's current-stop selection to skip them. Strong imports omit the field. Older module registries do not preserve weak bindings; regenerate them to distinguish optional imports.
 
 ELF modules in `--modules` are audited regardless of filename: their undefined symbols are classified against the built libraries and the other modules' exports, with the module file named in the report, and the libraries they need must have a file in `--libs` or `--modules`. Ordinary non-module sidecars are ignored; malformed ELF, PE/SELF containers and non-ELF files with module extensions remain errors. The audit reads dynamic tables from ELF section headers or, for sectionless files, from `PT_DYNAMIC` and a SysV or GNU hash table.
@@ -410,3 +452,13 @@ Registry `nid` fields may contain either encoded NIDs or ordinary ELF symbol nam
 Exit codes: `0` nothing blocks loading, `1` there are `absent` imports or needed libraries without a file, `2` an input could not be read; the message names the file and the value.
 
 A module registry lists `nid`, `library` and `targetOffset` for each relocation against a function that no other bundled module exports, without the `#` suffix of the executable's NIDs.
+
+## Patching imports of native applications
+
+`nid_patcher --exec <file> [file2 ...]` patches imports in place and preserves the application's exports. It detects PE, ELF64 and Mach-O64 from file contents. No library name is required. Build a separate executable for each target platform.
+
+By default, imports use the library export naming rules: `_nid_no_patch` and `SDL_*` stay unchanged; `_nid_no_patch_cut` is removed without hashing; `_nid_postfix` and numeric `_nid_disambig` suffixes are removed before computing the NID. When both `foo` and `foo_nid_postfix` are imported, `foo` stays unchanged. These rules also apply to host imports unless they are explicitly preserved.
+
+`nid_patcher --exec --only-sce <file>` restricts renaming to names starting with `sce` (case-insensitive) or ending with `_nid_postfix`. Both modes accept `--preserve-exports <unpatched-library>` or `--preserve-export-list <export-list>` for explicit exclusions. The existing `nid_patcher <library_name> <file>` mode is unchanged.
+
+Unsupported layouts fail before the input file is written.
diff --git a/tools/audit_dump.py b/tools/audit_dump.py
new file mode 100644
index 0000000000..3653731d05
--- /dev/null
+++ b/tools/audit_dump.py
@@ -0,0 +1,177 @@
+import argparse
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import import_audit
+import unwrap_self
+
+DESCRIPTION = """Audit the imports of an extracted title before it is launched. Unwraps the dump's eboot.bin and the modules
+it ships (sce_module/, sce_modules/ and prx/, Unity's Media/Modules/ and Media/Plugins/, and .prx files beside
+eboot.bin) into a work directory, converts them with relinker --registry, and runs tools/import_audit.py on the
+registries with the unwrapped modules as --modules. The dump is only read; the source/ and output/ directories of a
+reused --work directory are emptied first. Exit code: that of import_audit.py, or 2
+when unwrapping or conversion fails."""
+
+STANDARD_DIRECTORIES = ("sce_module", "sce_modules", "prx")
+EXTRA_DIRECTORIES = ("Media/Modules", "Media/Plugins")
+MODULE_SUFFIXES = (".prx", ".sprx")
+ELF_MAGIC = b"\x7fELF"
+
+
+def stage(source, destination):
+    try:
+        unwrap_self.unwrap(source, destination)
+        return "unwrapped"
+    except unwrap_self.Refused:
+        with open(source, "rb") as file:
+            if file.read(4) != ELF_MAGIC:
+                raise
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(source, destination)
+        return "copied"
+
+
+def modules_of(directory):
+    return sorted(path for path in directory.iterdir() if (path.is_file() or path.is_symlink()) and path.suffix.lower() in MODULE_SUFFIXES)
+
+
+def prepare(dump, source, log=print):
+    stage(dump / "eboot.bin", source / "eboot.elf")
+    module_directories = []
+    extra = []
+    for relative in STANDARD_DIRECTORIES + EXTRA_DIRECTORIES:
+        directory = dump / relative
+        if not directory.is_dir():
+            continue
+        modules = modules_of(directory)
+        if not modules:
+            continue
+        for module in modules:
+            stage(module, source / relative / module.name)
+        module_directories.append(source / relative)
+        if relative in EXTRA_DIRECTORIES:
+            extra.append(relative)
+    beside = modules_of(dump)
+    if beside:
+        for module in beside:
+            stage(module, source / module.name)
+        module_directories.append(source)
+        extra.append(".")
+    log(f"staged eboot.bin and {sum(len(modules_of(directory)) for directory in module_directories)} modules")
+    return module_directories, extra
+
+
+def convert(relinker, source, output, extra, windows):
+    command = [str(relinker), "--registry"]
+    if windows:
+        command.append("--windows")
+    for relative in extra:
+        command += ["--module-dir", relative]
+    command += [str(source / "eboot.elf"), str(output)]
+    return subprocess.run(command, capture_output=True, text=True)
+
+
+def comparison_path(path, links=frozenset()):
+    for prefix in (*reversed(path.parents), path):
+        if not prefix.is_symlink():
+            continue
+        identity = prefix.parent.resolve() / prefix.name
+        if identity in links:
+            raise RuntimeError("symbolic link cycle")
+        target = prefix.readlink()
+        destination = target if target.is_absolute() else prefix.parent / target
+        resolved_target = comparison_path(destination, links | {identity})
+        return comparison_path(resolved_target / path.relative_to(prefix), links)
+    resolved = path.resolve()
+    drive = resolved.drive
+    if drive.casefold().startswith("\\\\?\\unc\\"):
+        return type(resolved)("\\\\" + str(resolved)[8:])
+    if len(drive) == 6 and drive.startswith("\\\\?\\") and drive.endswith(":"):
+        return type(resolved)(str(resolved)[4:])
+    return resolved
+
+
+def report_overlaps_dump(report, dump):
+    destination = comparison_path(report)
+    dump_path = comparison_path(dump)
+    if report.absolute().is_relative_to(dump.absolute()) or destination.is_relative_to(dump_path) or comparison_path(report.parent).is_relative_to(dump_path):
+        return True
+    exists = report.exists()
+    for path in dump.rglob("*"):
+        if path.is_symlink() and path.is_dir() and destination.is_relative_to(comparison_path(path)):
+            return True
+        if exists and path.is_file() and report.samefile(path):
+            return True
+    return False
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=DESCRIPTION, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("dump", help="the title's extracted app0 directory, holding eboot.bin")
+    parser.add_argument("--relinker", required=True, help="the relinker executable")
+    parser.add_argument("--libs", action="append", required=True, help="built .prx directory, as for import_audit.py (repeatable)")
+    parser.add_argument("--work", help="directory for the unwrapped files and registries (default: a temporary one, removed afterwards)")
+    parser.add_argument("--windows", action="store_true", help="convert for Windows, as the title would be run there")
+    parser.add_argument("--json", help="also write import_audit.py's JSON report to this file outside the input dump")
+    args = parser.parse_args(argv)
+    dump = Path(args.dump)
+    if not (dump / "eboot.bin").is_file():
+        parser.error(f"{dump}: no eboot.bin")
+    relinker = Path(args.relinker).resolve()
+    if not relinker.is_file():
+        parser.error(f"{args.relinker}: no such relinker")
+    dump_path = comparison_path(dump)
+    if args.json:
+        report = Path(args.json)
+        try:
+            overlaps = report_overlaps_dump(report, dump)
+        except (OSError, RuntimeError) as error:
+            parser.error(f"{report}: cannot check JSON output against the input dump: {error}")
+        if overlaps:
+            parser.error(f"{report}: JSON output overlaps the input dump")
+    with tempfile.TemporaryDirectory() as temporary:
+        work = Path(args.work) if args.work else Path(temporary)
+        source, output = work / "source", work / "output"
+        for generated in (source, output):
+            generated_path = comparison_path(generated)
+            if dump_path.is_relative_to(generated_path) or generated_path.is_relative_to(dump_path):
+                parser.error(f"{generated}: work directory overlaps the input dump")
+        for generated in (source, output):
+            try:
+                if generated.is_symlink():
+                    generated.unlink()
+                elif generated.exists():
+                    shutil.rmtree(generated)
+            except OSError as error:
+                print(f"FAIL: cannot empty {generated}: {error}", file=sys.stderr)
+                return 2
+            if generated.exists() or generated.is_symlink():
+                print(f"FAIL: cannot empty {generated}: it still exists", file=sys.stderr)
+                return 2
+        output.mkdir(parents=True, exist_ok=True)
+        try:
+            module_directories, extra = prepare(dump, source)
+        except (unwrap_self.Refused, OSError) as error:
+            print(f"FAIL: unwrapping {dump}: {error}", file=sys.stderr)
+            return 2
+        result = convert(relinker, source, output / ("app.exe" if args.windows else "app.elf"), extra, args.windows)
+        if result.returncode != 0:
+            print(f"FAIL: relinker exited with {result.returncode}", file=sys.stderr)
+            print((result.stderr or result.stdout).strip(), file=sys.stderr)
+            return 2
+        registries = sorted(str(path) for path in output.rglob("*.registry.json"))
+        audit = registries + [option for library in args.libs for option in ("--libs", library)]
+        audit += [option for directory in module_directories for option in ("--modules", str(directory))]
+        if args.json:
+            audit += ["--json", args.json]
+        return import_audit.main(audit)
+
+
+if __name__ == "__main__":
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8")
+    sys.exit(main())
diff --git a/tools/build_web.py b/tools/build_web.py
index ed871bb1d4..4127eaf9a0 100644
--- a/tools/build_web.py
+++ b/tools/build_web.py
@@ -71,7 +71,8 @@ def publish_libraries(output, release=None):
                     raise ValueError("Invalid library archive")
                 names = {}
                 for file in files:
-                    if not file.filename.startswith("libs/") or any(part in ("..", ".", "") for part in file.filename.rstrip("/").split("/")) or "\\" in file.filename:
+                    if (file.orig_filename != file.filename or not file.filename.startswith("libs/")
+                            or any(part in ("..", ".", "") for part in file.filename.rstrip("/").split("/")) or "\\" in file.filename):
                         raise ValueError("Invalid library archive layout")
                     name = file.filename.rstrip("/").lower()
                     if name in names:
@@ -90,6 +91,8 @@ def publish_libraries(output, release=None):
             path = f"libraries/{platform}-{checksum}.zip"
             temporary.replace(output / path)
             manifest["platforms"][platform] = {"path": path, "size": size, "expandedBytes": expanded, "sha256": checksum}
+        except zipfile.BadZipFile as error:
+            raise ValueError(f"Invalid release archive {asset['name']}: {error}") from error
         finally:
             temporary.unlink(missing_ok=True)
     (output / "release.json").write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
@@ -158,6 +161,8 @@ def publish_release(output):
                     raise RuntimeError(f"Could not restore release output. Previous site is preserved at {previous}") from error
             raise
         published = True
+    except zipfile.BadZipFile as error:
+        raise ValueError(f"Invalid release archive {asset['name']}: {error}") from error
     finally:
         if published or not previous.exists():
             shutil.rmtree(temporary)
@@ -167,7 +172,7 @@ def publish_release(output):
 def main(argv=None):
     for stream in (sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser()
     parser.add_argument("--build", type=Path, required=True)
     parser.add_argument("--release", "--libraries", dest="release", action="store_true",
diff --git a/tools/check_compile.py b/tools/check_compile.py
index 9b66a1cd16..24daf7321a 100644
--- a/tools/check_compile.py
+++ b/tools/check_compile.py
@@ -11,8 +11,19 @@ from contextlib import nullcontext
 from pathlib import Path
 
 CPP = (".cpp", ".cc", ".cxx", ".c")
-DROP = ("-c", "-MD", "-MMD", "-MP")
+DROP = ("-c", "-MD", "-MMD", "-MP", "-fsyntax-only", "-fno-syntax-only", "-save-temps", "--save-temps",
+        "-save-temps=cwd", "-save-temps=obj", "--save-temps=cwd", "--save-temps=obj")
 DROP_WITH_VALUE = ("-o", "-MT", "-MF", "-MQ", "-MJ")
+PREPROCESSING = ("-E", "--preprocess", "-M", "--dependencies", "-MM", "--user-dependencies",
+                 "-MG", "--print-missing-file-dependencies", "-P", "--no-line-commands",
+                 "-C", "-CC", "-dM", "-dD", "-dI")
+WITH_VALUE = ("-I", "-L", "-F", "-B", "-D", "-U", "-x", "-include", "--include", "-imacros", "--imacros",
+              "--define-macro", "--undefine-macro", "-iquote", "-isystem", "-idirafter", "-iprefix",
+              "-iwithprefix", "-iwithprefixbefore", "-isysroot", "--sysroot", "-target", "--target",
+              "-arch", "-std", "-T", "-u", "-e", "--param", "-Xclang", "-Xpreprocessor", "-Xassembler", "-Xlinker")
+WITHOUT_VALUE = (*DROP, *PREPROCESSING, "-S", "-fsyntax-only", "-Werror", "-Wall", "-Wextra",
+                 "-pedantic", "-pedantic-errors", "-pthread", "-pipe", "-v")
+JOINED_OPTIONS = ("-I", "-L", "-F", "-B", "-D", "-U", "-O", "-g", "-W")
 
 
 def capture(command, cwd=None, encoding="utf-8"):
@@ -40,19 +51,53 @@ def repository():
     return Path(result.stdout.strip())
 
 
+def validate_arguments(arguments):
+    if not isinstance(arguments, list) or not arguments or any(not isinstance(argument, str) for argument in arguments) or not arguments[0]:
+        raise ValueError("arguments must be a nonempty list of strings with an executable")
+
+
+def compilation_database(text, source, skip_empty_commands=False):
+    database = json.loads(text)
+    if not isinstance(database, list):
+        raise ValueError(f"{source}: expected an array of command objects")
+    commands = []
+    for index, entry in enumerate(database):
+        context = f"{source}: entry {index}"
+        if not isinstance(entry, dict):
+            raise ValueError(f"{context}: expected a command object")
+        for field in ("directory", "file"):
+            if field not in entry:
+                raise ValueError(f"{context}: missing {field}")
+            if not isinstance(entry[field], str) or not entry[field]:
+                raise ValueError(f"{context}: {field} must be a nonempty string")
+        if skip_empty_commands and "arguments" not in entry and entry.get("command") == "":
+            continue
+        if "arguments" in entry:
+            try:
+                validate_arguments(entry["arguments"])
+            except ValueError as error:
+                raise ValueError(f"{context}: {error}") from error
+        elif "command" not in entry:
+            raise ValueError(f"{context}: expected arguments or command")
+        elif not isinstance(entry["command"], str) or not entry["command"].strip():
+            raise ValueError(f"{context}: command must be a nonempty string")
+        commands.append(entry)
+    return commands
+
+
 def entries(build):
     if not build.is_dir():
         raise ValueError(f"{build} is not a directory; configure the build first")
     manifest = build / "compile_commands.json"
     if manifest.is_file():
-        return json.loads(manifest.read_text(encoding="utf-8-sig"))
+        return compilation_database(manifest.read_text(encoding="utf-8-sig"), manifest)
     ninja = shutil.which("ninja")
     if ninja is None:
         raise ValueError(f"no {manifest} and ninja is not on PATH")
     result = capture([ninja, "-C", str(build), "-t", "compdb", "-x"], encoding=ninja_encoding(ninja))
     if result.returncode != 0:
         raise ValueError(f"ninja -t compdb: {result.stderr.strip()}")
-    return json.loads(result.stdout)
+    return compilation_database(result.stdout, "ninja -t compdb", skip_empty_commands=True)
 
 
 def entry_key(entry, root):
@@ -115,33 +160,88 @@ def syntax_only(entry, source):
     return syntax_arguments(arguments, directory, source)
 
 
+def preprocessor_arguments(argument):
+    forwarded = argument[4:].split(",")
+    if any(option.startswith("@") for option in forwarded):
+        raise ValueError(f"unsupported forwarded compiler option response file in {argument}")
+    options = iter(forwarded)
+    kept = []
+    for option in options:
+        if option in ("-MD", "-MMD", "-MF", "-MT", "-MQ", "--write-dependencies", "--write-user-dependencies"):
+            if not next(options, None):
+                raise ValueError(f"missing value for {option} in {argument}")
+            continue
+        if option in ("-M", "-MM", "-MG", "-MP", "--dependencies", "--user-dependencies",
+                      "--print-missing-file-dependencies") or option.startswith(("-MF", "-MT", "-MQ")):
+            continue
+        kept.append(option)
+        if option in ("-D", "-U", "-I", "-F", "-include", "--include", "-imacros", "--imacros",
+                      "-isystem", "-iquote", "-idirafter", "-isysroot"):
+            value = next(options, None)
+            if not value:
+                raise ValueError(f"missing operand for {option} in {argument}")
+            kept.append(value)
+        elif not (option.startswith(("-D", "-U", "-I", "-F")) and len(option) > 2):
+            raise ValueError(f"unsupported forwarded compiler option {option} in {argument}")
+    return "-Wp," + ",".join(kept) if kept else None
+
+
 def syntax_arguments(arguments, directory, source):
-    if not isinstance(arguments, list) or not arguments or any(not isinstance(argument, str) for argument in arguments) or not arguments[0]:
-        raise ValueError("arguments must be a nonempty list of strings with an executable")
+    validate_arguments(arguments)
     for argument in arguments[1:]:
         if argument.startswith("@"):
             raise ValueError(f"unexpanded response file {argument[1:]}; provide expanded compile arguments before checking syntax")
     wanted = source.resolve()
-    trimmed = []
-    index = 0
+    trimmed = [arguments[0]]
+    index = 1
+    positional = False
+    syntax_added = False
     while index < len(arguments):
         argument = arguments[index]
-        if argument in DROP_WITH_VALUE:
-            index += 2
-            continue
-        if argument in DROP or argument.startswith(("-MT", "-MF", "-MQ", "-MJ")):
+        if not syntax_added and argument.startswith("-"):
+            trimmed.append("-fsyntax-only")
+            syntax_added = True
+        if not positional and argument == "--":
+            positional = True
+            trimmed.append(argument)
             index += 1
             continue
-        if not argument.startswith("-"):
+        if not positional and (argument in ("-Xclang", "-Xpreprocessor") or argument.startswith(("-Xclang=", "-Xpreprocessor="))):
+            raise ValueError(f"unsupported forwarded compiler option {argument}")
+        if not positional and argument in (*DROP_WITH_VALUE, *WITH_VALUE):
+            if index + 1 == len(arguments):
+                raise ValueError(f"missing operand for {argument}")
+            if argument in WITH_VALUE:
+                trimmed.extend(arguments[index:index + 2])
+            index += 2
+            continue
+        if not positional and argument.startswith("-Wp,"):
+            if forwarded := preprocessor_arguments(argument):
+                trimmed.append(forwarded)
+            index += 1
+            continue
+        if not positional and (argument in (*DROP, *PREPROCESSING) or argument.startswith(("-MT", "-MF", "-MQ", "-MJ"))):
+            index += 1
+            continue
+        if positional or not argument.startswith("-"):
             candidate = Path(argument)
             if not candidate.is_absolute():
                 candidate = directory / candidate
             if candidate.resolve() == wanted:
                 index += 1
                 continue
+            if positional:
+                trimmed.append(str(candidate.resolve()))
+                index += 1
+                continue
+        elif (argument not in WITHOUT_VALUE and not argument.startswith(JOINED_OPTIONS) and "=" not in argument and index + 1 < len(arguments)
+              and arguments[index + 1] in PREPROCESSING):
+            raise ValueError(f"unknown operand count for {argument} before {arguments[index + 1]}")
         trimmed.append(argument)
         index += 1
-    trimmed += ["-fsyntax-only", str(wanted)]
+    if not syntax_added:
+        trimmed.append("-fsyntax-only")
+    trimmed.append(str(wanted))
     return trimmed
 
 
diff --git a/tools/check_conventions.py b/tools/check_conventions.py
index fb378cda0d..8503faf71d 100644
--- a/tools/check_conventions.py
+++ b/tools/check_conventions.py
@@ -1,5 +1,6 @@
 import argparse
 import io
+import itertools
 import json
 import os
 import posixpath
@@ -24,6 +25,7 @@ RULES = {
     "system-dependency": ("error", "CONTRIBUTING.md#code", "Third-party code is a submodule under 3rdparty/ built from source, not found on the system"),
     "title-specific": ("error", "CONTRIBUTING.md#code", "Implement the general behaviour, not what one title needs; title-specific code belongs in its sce_module"),
     "extension": ("error", "CONTRIBUTING.md#code", "Avoid non-standard extensions where standard C++ is enough"),
+    "alignment": ("error", "CONTRIBUTING.md#code", "MinGW GCC rejects static objects aligned above 8192 bytes; align a larger block at run time inside a bigger buffer"),
     "notes-file": ("error", "CONTRIBUTING.md#branches-and-pull-requests", "Notes, investigation and agent files go in the pull request, not in the repository; only the root AGENTS.md is allowed"),
     "binary": ("error", "docs/dev/CONVENTIONS.md", "Only UTF-8 text files in the repository; images go in the gist comments"),
     "ci-gate": ("error", "CONTRIBUTING.md#build-and-test", "A job that runs for pull requests needs a file filter: paths on the pull_request trigger, or needs eligibility and an if on its outputs"),
@@ -59,6 +61,12 @@ STUB_BODY = re.compile(r"^(?:\(void\)\s*\w+\s*;|static_cast<void>\(\s*\w+\s*\)\s
 SYSTEM_DEPENDENCY = re.compile(r"\b(find_package\s*\((?!\s*(Python3|Threads|Git)\b)|pkg_check_modules\b|pkg_search_module\b|find_(library|path|program|file)\b)", re.I)
 TITLE = re.compile(r"\b(PPSA|CUSA)\d{5}\b")
 EXTENSION = re.compile(r"__attribute__|__declspec|#\s*pragma\s+(?!once\b)")
+INTEGER = r"(0[xX][0-9a-fA-F']+|0[bB][01']+|[0-9][0-9']*)[uUlLzZ]*"
+ALIGNAS = re.compile(rf"\balignas\s*\(\s*(?:{INTEGER}|([A-Za-z_][A-Za-z0-9_]*))\s*\)")
+CONSTANT = re.compile(rf"\bconstexpr\b[^;=]*?\b([A-Za-z_][A-Za-z0-9_]*)\s*(?:=\s*|\{{\s*){INTEGER}\s*[;}}]")
+NAMESPACE = re.compile(r"\bnamespace\s+((?:[A-Za-z_][A-Za-z0-9_]*\s*::\s*(?:inline\s+)?)*[A-Za-z_][A-Za-z0-9_]*)\s*$|\bnamespace\s*$")
+LINKAGE = re.compile(r'\bextern\s*""\s*$')
+ALIGNMENT_LIMIT = 8192
 LINK = re.compile(r"\[[^\]]+\]\(([^)\s]+)")
 FENCE = re.compile(r"^ {0,3}(```|~~~).*?^ {0,3}\1[ \t]*\r?$|^ {0,3}(?:```|~~~).*\Z", re.S | re.M)
 INLINE = re.compile(r"`[^`\n]*`")
@@ -172,12 +180,20 @@ class Check:
             source = self.show(path).split("\n")
             masked = cpp_text("\n".join(source), preserve_comments=True).split("\n")
             assembly = asm_exports("\n".join(source)) if core and path.startswith("core/libs/prx/") else {}
+            constants, starts = None, None
             for number, text in lines:
                 bare = masked[number - 1]
                 if ("//" in bare or "/*" in bare) and not ALLOWED_COMMENT.match(bare):
                     self.report("comment", path, number)
                 if EXTENSION.search(bare):
                     self.report("extension", path, number, EXTENSION.search(bare).group(0))
+                if "alignas" in bare:
+                    if constants is None:
+                        constants = named_constants(cpp_text("\n".join(source)))
+                        starts = list(itertools.accumulate((len(line) + 1 for line in masked), initial=0))
+                    alignment = over_aligned(bare, constants, starts[number - 1])
+                    if alignment:
+                        self.report("alignment", path, number, alignment)
                 if core and TITLE.search(text):
                     self.report("title-specific", path, number, TITLE.search(text).group(0))
                 if core and path.startswith("core/libs/prx/"):
@@ -464,13 +480,44 @@ def block(lines, start):
     return lines[start + 1:end]
 
 
+def flow_mapping(value):
+    tokens = re.findall(r'''"(?:\\.|[^"\\])*"|'(?:''|[^'])*'|[^{}\[\],:\s]+|[{}\[\],:]''', value)
+    if not tokens or tokens[0] != "{" or tokens[-1] != "}":
+        return {}
+    result = {}
+    stack = []
+    start, colon = 1, None
+    for index, token in enumerate(tokens):
+        if token in ("{", "["):
+            stack.append(token)
+        elif token in ("}", "]"):
+            if not stack or stack.pop() != ("{" if token == "}" else "["):
+                return {}
+            if not stack and index != len(tokens) - 1:
+                return {}
+        if len(stack) == 1 and token == ":" and colon is None:
+            colon = index
+        if (len(stack) == 1 and token == ",") or (not stack and token == "}"):
+            if colon == start + 1:
+                result[tokens[start].strip("'\"")] = " ".join(tokens[colon + 1:index])
+            elif start != index:
+                return {}
+            start, colon = index + 1, None
+    return result if not stack else {}
+
+
 def pull_request_filtered(lines, trigger):
     _, _, _, value = trigger
     if value:
+        if value.lstrip().startswith("{"):
+            triggers = flow_mapping(value)
+            return "pull_request" not in triggers or bool({"paths", "paths-ignore"} & flow_mapping(triggers["pull_request"]).keys())
         return "pull_request" not in re.findall(r"[A-Za-z_]+", value)
     triggers = block(lines, lines.index(trigger))
     for index, (_, indent, name, value) in enumerate(triggers):
         if name == "pull_request" and indent == triggers[0][1]:
+            if value:
+                return bool({"paths", "paths-ignore"} & flow_mapping(value).keys())
             return any(entry[2] in ("paths", "paths-ignore") for entry in block(triggers, index))
     return True
 
@@ -580,6 +627,68 @@ def cpp_text(text, preserve_comments=False):
     return CPP_TOKEN.sub(mask, text)
 
 
+def integer_literal(text):
+    digits = text.replace("'", "").lower()
+    if digits.startswith(("0x", "0b")):
+        return int(digits, 0)
+    return int(digits, 8 if len(digits) > 1 and digits[0] == "0" else 10)
+
+
+def brace_scopes(text):
+    stack, scopes, boundary = [], [], -1
+    for index, character in enumerate(text):
+        if character not in "{};":
+            continue
+        if character == "{":
+            head = text[boundary + 1:index]
+            outer = next((key[1] for _, key in reversed(stack) if key and key[0] == "namespace"), "")
+            match = NAMESPACE.search(head)
+            if match and re.search(r"\binline\s+namespace\b", head):
+                key = ("namespace", outer)
+            elif match:
+                key = ("namespace", outer + "::" + re.sub(r"\binline\b|\s+", "", match.group(1) or "{anonymous}"))
+            else:
+                key = None if LINKAGE.search(head) else ("block", index)
+            stack.append((index, key))
+        elif character == "}" and stack:
+            start, key = stack.pop()
+            scopes.append((start, index, key))
+        boundary = index
+    return scopes
+
+
+def scope_chain(scopes, position):
+    chain = []
+    for _, _, key in sorted((scope for scope in scopes if scope[0] < position < scope[1]), reverse=True):
+        if key and key[0] == "namespace":
+            parts = key[1].split("::")
+            chain.extend(prefix for prefix in (("namespace", "::".join(parts[:count])) for count in range(len(parts), 1, -1)) if prefix not in chain)
+        elif key:
+            chain.append(key)
+    return chain + [("namespace", "")]
+
+
+def named_constants(text):
+    scopes = brace_scopes(text)
+    definitions = [(match.group(1), integer_literal(match.group(2)), match.start(), scope_chain(scopes, match.start())[0]) for match in CONSTANT.finditer(text)]
+    return definitions, scopes
+
+
+def constant_value(constants, name, position):
+    definitions, scopes = constants
+    chain = scope_chain(scopes, position)
+    visible = [(-chain.index(scope), start, value) for found, value, start, scope in definitions if found == name and start < position and scope in chain]
+    return max(visible)[2] if visible else 0
+
+
+def over_aligned(text, constants=((), ()), offset=0):
+    for match in ALIGNAS.finditer(text):
+        value = integer_literal(match.group(1)) if match.group(1) else constant_value(constants, match.group(2), offset + match.start())
+        if value > ALIGNMENT_LIMIT:
+            return match.group(0)
+    return None
+
+
 def function_body(lines, start):
     text = cpp_text("\n".join(lines[start:start + 400]))
     brace, semicolon = text.find("{"), text.find(";")
diff --git a/tools/check_main_sync.py b/tools/check_main_sync.py
index f6d7532082..a8be7392f2 100644
--- a/tools/check_main_sync.py
+++ b/tools/check_main_sync.py
@@ -4,7 +4,7 @@ import subprocess
 import sys
 from pathlib import Path
 
-PULL_REQUEST = re.compile(r"Merge pull request #(\d+)")
+PULL_REQUEST = re.compile(r"Merge pull request #(\d+)|\(#(\d+)\)$")
 BASES = ("upstream/main", "origin/main", "main")
 
 
@@ -47,15 +47,17 @@ def merged_pull_requests(repo, mergebase, base, paths):
     for line in lines(repo, "-c", "core.quotepath=off", "log", "--first-parent", "--format=%h %s", f"{mergebase}..{base}", "--", *paths):
         match = PULL_REQUEST.search(line)
         if match:
-            found[int(match.group(1))] = line.split(" ", 1)[0]
+            found[int(match.group(1) or match.group(2))] = line.split(" ", 1)[0]
     return found
 
 
 def report(repo, base, head):
     repo = git(repo, "rev-parse", "--show-toplevel").stdout.strip()
     found = git(repo, "merge-base", base, head, check=False)
-    if found.returncode:
+    if found.returncode == 1:
         raise RuntimeError(f"{head} and {base} have no common ancestor")
+    if found.returncode:
+        raise RuntimeError(f"git merge-base failed: {found.stderr.strip()}")
     mergebase = found.stdout.strip()
     behind = int(git(repo, "rev-list", "--count", f"{head}..{base}").stdout)
     ahead = int(git(repo, "rev-list", "--count", f"{base}..{head}").stdout)
diff --git a/tools/check_skips.py b/tools/check_skips.py
index e44304872d..936570e00e 100644
--- a/tools/check_skips.py
+++ b/tools/check_skips.py
@@ -11,26 +11,34 @@ NO_DISPLAY = re.compile(r"skipped,.*no display", re.IGNORECASE)
 NO_VULKAN_DEVICE = re.compile(r"skipped,.*no usable Vulkan device", re.IGNORECASE)
 
 HIGH_REFRESH_LIMITATION = re.compile(r"current display does not provide 120 Hz", re.IGNORECASE)
+CTEST_SKIP_STATUS = re.compile(r"SKIP_RETURN_CODE=\d+|SKIP_REGULAR_EXPRESSION_MATCHED", re.IGNORECASE)
 
 WINDOWS_PREFIX = "agc"
 
 
+def device_limitations(output, patterns):
+    reasons = [match.group(0) for line in output.splitlines() if (match := re.search(r"skipped,.*", line, re.IGNORECASE))]
+    return bool(reasons) and all(any(pattern.search(reason) for pattern in patterns) for reason in reasons)
+
+
 def high_refresh_limitation(output):
     reasons = []
     for line in output.splitlines():
         reason = line.strip()
-        if reason.lower().startswith("skipped,"):
-            reason = reason[len("skipped,"):].strip()
+        if match := re.search(r"skipped,", reason, re.IGNORECASE):
+            reason = reason[match.end():].strip()
         if reason:
             reasons.append(reason)
     return bool(reasons) and all(HIGH_REFRESH_LIMITATION.fullmatch(reason) for reason in reasons)
 
 
-def skips(path):
+def skips(path, require_tests=False):
     root = ET.parse(path).getroot()
     if root.tag not in ("testsuite", "testsuites"):
         raise ValueError(f"{path}: expected a JUnit testsuite or testsuites root, got {root.tag!r}")
+    found = False
     for case in root.iter("testcase"):
+        found = True
         if case.get("status") == "disabled":
             raise ValueError(f"{path}: testcase {case.get('name')!r} is disabled and was not run")
         skipped = case.find("skipped")
@@ -39,34 +47,39 @@ def skips(path):
         name = case.get("name")
         if not name:
             raise ValueError(f"{path}: skipped testcase has no name")
-        output = ["skipped, " + reason.strip() for reason in (skipped.get("message", ""), skipped.text or "") if reason.strip()]
+        output = ["skipped, " + reason.strip() for reason in (skipped.get("message", ""), skipped.text or "")
+                  if reason.strip() and not CTEST_SKIP_STATUS.fullmatch(reason.strip())]
         output += [case.findtext(channel) or "" for channel in ("system-out", "system-err")]
         yield name, "\n".join(output)
+    if require_tests and not found:
+        raise ValueError(f"{path}: report contains no testcases")
 
 
 def main(argv=None):
     for stream in (sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="fail when a test is skipped that the job's device is not expected to skip")
     parser.add_argument("junit", type=Path, help="the file written by ctest --output-junit")
     parser.add_argument("--job", choices=("linux", "windows"), default="linux")
     parser.add_argument("--list", action="store_true", help="print the skipped tests and why the file says they skipped")
+    parser.add_argument("--require-tests", action="store_true", help="fail if the report contains no testcases")
     args = parser.parse_args(argv)
     try:
-        found = sorted(skips(args.junit))
+        found = sorted(skips(args.junit, require_tests=args.require_tests))
     except (OSError, ET.ParseError, ValueError) as error:
         parser.error(str(error))
     if args.list:
         for name, output in found:
-            reason = next((line.strip() for line in output.splitlines() if line.strip().lower().startswith("skipped")), "")
+            reason = next((match.group(0) for line in output.splitlines()
+                           if (match := re.search(r"skipped,.*", line, re.IGNORECASE))), "")
             print(f"{name}: {reason}")
         return 0
     if args.job == "windows":
-        unexpected = [name for name, output in found if not name.startswith(WINDOWS_PREFIX) and not NO_DISPLAY.search(output) and not NO_VULKAN_DEVICE.search(output) and not high_refresh_limitation(output)]
+        unexpected = [name for name, output in found if not name.startswith(WINDOWS_PREFIX) and not device_limitations(output, (NO_DISPLAY, NO_VULKAN_DEVICE)) and not high_refresh_limitation(output)]
         expected = f"any {WINDOWS_PREFIX}* test, which the runner has no Vulkan driver for, or a test that reports no display or Vulkan device or a display without a 120 Hz mode"
     else:
-        unexpected = [name for name, output in found if not DEVICE_LIMITATION.search(output) and not high_refresh_limitation(output)]
+        unexpected = [name for name, output in found if not device_limitations(output, (DEVICE_LIMITATION,)) and not high_refresh_limitation(output)]
         expected = "any test that reports the device limitation it needs, such as narrow subgroups, a missing extension, no display for a Vulkan window or a display without a 120 Hz mode"
     for name in unexpected:
         print(f"error: {name} skipped")
diff --git a/tools/check_test_registration.py b/tools/check_test_registration.py
index 7903e7262c..518a885bd4 100644
--- a/tools/check_test_registration.py
+++ b/tools/check_test_registration.py
@@ -11,7 +11,7 @@ LEXICAL = re.compile(r'\\.|"(?:\\.|[^"\\])*"|\[(?P<literal_equals>=*)\[.*?\](?P=
                      r'|(?P<comment>\#\[(?P<comment_equals>=*)\[.*?\](?P=comment_equals)\]|\#[^\n]*)', re.S)
 
 KNOWN_UNRUN = set()
-SCRIPT = re.compile(r"(?:[\w.-]+/)*test_\w+\.py")
+SCRIPT = re.compile(r"(?<![\w./-])(?:[\w.-]+/)*test_\w+\.py(?![\w./-])")
 
 
 def built(build):
@@ -78,7 +78,9 @@ def commands(content):
                 raise ValueError(f"invalid CTest argument at position {position}")
             argument = token.group(0)
             if argument.startswith('"'):
-                argument = re.sub(r"\\(.)", lambda match: {"n": "\n", "r": "\r", "t": "\t"}.get(match[1], match[1]), argument[1:-1], flags=re.S)
+                argument = re.sub(r"\\(\r?\n|.)",
+                                  lambda match: {"\n": "", "\r\n": "", "n": "\n", "r": "\r", "t": "\t"}.get(match[1], match[1]),
+                                  argument[1:-1], flags=re.S)
             elif token.group("equals") is not None:
                 width = len(token.group("equals")) + 2
                 argument = argument[width:-width].removeprefix("\n")
@@ -160,7 +162,7 @@ def unrun_scripts(root):
 def main(argv=None):
     for stream in (sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="fail when a test executable is built that no ctest test runs")
     parser.add_argument("build", type=Path, nargs="?", default=Path("build"), help="configured build directory")
     parser.add_argument("--list", action="store_true", help="print every test executable and whether ctest runs it")
diff --git a/tools/configure_seed.py b/tools/configure_seed.py
index 8e042f9722..1dd9e52f29 100644
--- a/tools/configure_seed.py
+++ b/tools/configure_seed.py
@@ -4,7 +4,7 @@ import re
 import sys
 from pathlib import Path
 
-CHECK = re.compile(r"^//(Have (include|includes|function|symbol|library) |Test |Result of (TRY_COMPILE|TRY_RUN|TEST_BIG_ENDIAN|check_))")
+CHECK = re.compile(r"^//(Have (include|includes|function|symbol|library) |Test |Result of (TRY_COMPILE|TRY_RUN|TEST_BIG_ENDIAN|check_)|CHECK_TYPE_SIZE: )")
 ENTRY = re.compile(r"^([^#/:][^:]*):([A-Z]+)=(.*)$")
 
 
@@ -28,7 +28,7 @@ def quote(value):
 def main(argv=None):
     for stream in (sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Write the configure check results of a CMake cache as an initial cache file")
     parser.add_argument("cache", help="CMakeCache.txt of a configured tree")
     parser.add_argument("seed", help="file to pass to cmake -C")
diff --git a/tools/env_reference.py b/tools/env_reference.py
index b7277df3bb..d7f80595ff 100644
--- a/tools/env_reference.py
+++ b/tools/env_reference.py
@@ -10,13 +10,14 @@ ROOTS = ("core",)
 EXTENSIONS = {".c", ".cc", ".cpp", ".cxx", ".h", ".hh", ".hpp", ".hxx", ".inl", ".ipp", ".py"}
 SKIP = {"build", "build-linux", "build-relinker", "3rdparty", ".git"}
 
-INTEGER_READERS = {"kibSetting", "MaskFromEnvironment", "EnvInt", "configured", "environmentCount"}
+INTEGER_READERS = {"kibSetting", "MaskFromEnvironment", "EnvInt", "configured", "environmentCount", "EnvironmentNumber"}
 STRING_READERS = {"GetEnvironmentVariableA", "GetEnvironmentVariableW", "addWideString"}
-NULL_TEST = re.compile(r"[!=]=\s*(nullptr|NULL|0)\b|!\s*(?:std::)?_?w?getenv\(")
+NULL_TEST = re.compile(r"[!=]=\s*(nullptr|NULL|0)\b|!\s*(?:std::)?_?w?getenv\s*\(")
 INTEGER_TEST = re.compile(r"\b(atoi|strtol|strtoul|strtoll|strtoull|stoi|stol|stoul|from_chars|atoi64|_wtoi|_wtol|_wtoi64)\s*\(")
 GREP = (r'(getenv|_wgetenv|wgetenv|IsEnvironmentSet|kibSetting|MaskFromEnvironment|EnvInt|GetEnvironmentVariable[AW]'
-        r'|configured|PipelineSwitch|environmentCount|addWideString)'
+        r'|configured|PipelineSwitch|environmentCount|EnvironmentNumber|addWideString)'
         r'\([[:space:]]*(u|L)?"(APS5|ANYPS5)_[A-Za-z0-9_]+"')
+GREP = GREP.replace(r"\(", r"[[:space:]]*\(")
 
 
 def _name(prefixes):
@@ -26,7 +27,7 @@ def _name(prefixes):
 @functools.lru_cache(maxsize=None)
 def forms(prefixes=PREFIXES):
     name = _name(prefixes)
-    return (
+    readers = (
         ("getenv", re.compile(r'(?:std::)?getenv\(\s*"(?P<name>' + name + r')"\s*\)')),
         ("_wgetenv", re.compile(r'(?:std::)?_?wgetenv\(\s*L"(?P<name>' + name + r')"\s*\)')),
         ("IsEnvironmentSet", re.compile(r'IsEnvironmentSet\(\s*"(?P<name>' + name + r')"\s*\)')),
@@ -36,10 +37,12 @@ def forms(prefixes=PREFIXES):
         ("configured", re.compile(r'\b(?:configured|PipelineSwitch)\(\s*"(?P<name>' + name + r')"'
                                   r'(?:\s*,\s*(?P<default>[0-9]+)[uUlL]*)?')),
         ("environmentCount", re.compile(r'\benvironmentCount\(\s*"(?P<name>' + name + r')"\s*,\s*(?P<default>[0-9]+)')),
+        ("EnvironmentNumber", re.compile(r'\bEnvironmentNumber\(\s*"(?P<name>' + name + r')"\s*\)')),
         ("GetEnvironmentVariableA", re.compile(r'GetEnvironmentVariableA\(\s*"(?P<name>' + name + r')"')),
         ("GetEnvironmentVariableW", re.compile(r'GetEnvironmentVariableW\(\s*L"(?P<name>' + name + r')"')),
         ("addWideString", re.compile(r'\baddWideString\(\s*u"(?P<name>' + name + r')"\s*\)')),
     )
+    return tuple((reader, re.compile(form.pattern.replace(r"\(", r"\s*\(", 1), form.flags)) for reader, form in readers)
 
 
 def line_reads(line, prefixes=PREFIXES):
@@ -88,8 +91,8 @@ def reads(roots, prefixes=PREFIXES):
         for path in source_files(root):
             try:
                 text = path.read_text(encoding="utf-8")
-            except (OSError, UnicodeDecodeError):
-                continue
+            except (OSError, UnicodeDecodeError) as error:
+                raise ValueError(f"cannot read {path.as_posix()}: {error}") from error
             lines = text.splitlines()
             for number, line in enumerate(lines, 1):
                 window = "\n".join(lines[number - 1:number + 2])
@@ -160,6 +163,9 @@ def check(found, doc, prefixes, out):
 
 
 def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(
         description="list the environment names the code reads, or check them against a reference document")
     parser.add_argument("--check", action="store_true",
@@ -178,7 +184,11 @@ def main(argv=None):
         if not Path(root).is_dir():
             print(f"error: scan root {root} is not a directory", file=sys.stderr)
             return 1
-    found = reads(roots, prefixes)
+    try:
+        found = reads(roots, prefixes)
+    except ValueError as error:
+        print(f"error: {error}", file=sys.stderr)
+        return 1
     if args.check:
         return check(found, args.doc, prefixes, sys.stdout)
     if args.table:
diff --git a/tools/import_audit.py b/tools/import_audit.py
index 75540f1667..83ad3722d4 100644
--- a/tools/import_audit.py
+++ b/tools/import_audit.py
@@ -2,6 +2,7 @@ import argparse
 import hashlib
 import json
 import os
+import re
 import struct
 import subprocess
 import sys
@@ -15,7 +16,12 @@ import progress
 ROOT = Path(__file__).resolve().parent.parent
 PRX = ROOT / "core" / "libs" / "prx"
 MODULE_SUFFIX = "#"
-CLASSES = ("implemented", "stub", "absent", "module")
+CLASSES = ("implemented", "partial", "stub", "absent", "module")
+CONDITIONAL = re.compile(r"(?:if|else|for|while|do|switch|case|default|try|catch|co_await|co_yield)\b")
+BRANCHING = re.compile(r"\?|&&|\|\||\b(?:and|or)\b")
+EXIT = re.compile(r"\b(?:return|co_return|goto)\b")
+PREPROCESSOR_LINE = re.compile(r"^[ \t]*#[ \t]*(ifdef|ifndef|if|elifdef|elifndef|elif|else|endif)\b[^\n]*$", re.M)
+BRANCH_VARIANT_LIMIT = 256
 PE_DIRECTORY_OFFSET = {0x20b: 112, 0x10b: 96}
 
 
@@ -84,16 +90,21 @@ def elf_program_dynamic_symbols(path, data):
     _, _, dynamic_offset, _, _, dynamic_size, _, _ = dynamic_segments[0]
     if dynamic_size % 16:
         raise AuditError(f"{path}: dynamic segment size {dynamic_size} is not a multiple of 16")
+    take(data, dynamic_offset, dynamic_size, path, "dynamic segment")
     dynamic = {}
     needed_offsets = []
+    terminated = False
     for position in range(0, dynamic_size, 16):
         tag, value = unpack("<qQ", data, dynamic_offset + position, path, "dynamic entry")
         if tag == 0:
+            terminated = True
             break
         if tag == 1:
             needed_offsets.append(value)
         else:
             dynamic[tag] = value
+    if not terminated:
+        raise AuditError(f"{path}: dynamic segment is not terminated by DT_NULL")
     string_address = dynamic.get(5)
     string_size = dynamic.get(10)
     symbol_address = dynamic.get(6)
@@ -134,7 +145,7 @@ def elf_program_dynamic_symbols(path, data):
     if symbol_count is None:
         raise AuditError(f"{path}: dynamic symbol table has no supported hash table")
     symbol_offset = file_offset(symbol_address, symbol_count * symbol_size, "dynamic symbol table")
-    imports = set()
+    imports = {}
     exports = set()
     for index in range(symbol_count):
         name, info, other, section_index, _, _ = unpack("<IBBHQQ", data, symbol_offset + index * symbol_size, path, "dynamic symbol")
@@ -142,7 +153,7 @@ def elf_program_dynamic_symbols(path, data):
             continue
         symbol = cstring(data, string_offset + name, string_offset + string_size, path, "dynamic symbol name").split(MODULE_SUFFIX, 1)[0]
         if section_index == 0:
-            imports.add(symbol)
+            imports[symbol] = imports.get(symbol, True) and info >> 4 == 2
         elif info >> 4 in (1, 2, 10) and other & 3 in (0, 3):
             exports.add(symbol)
     needed = {cstring(data, string_offset + value, string_offset + string_size, path, "needed library name") for value in needed_offsets}
@@ -190,31 +201,38 @@ def elf_imports(path, data):
         imports, _, needed = elf_program_dynamic_symbols(path, data)
         return imports, needed
     sections = elf_sections(path, data)
-    symbols = set()
+    symbols = {}
     needed = set()
     for section in sections:
         kind, offset, size, link, entry = section[1], section[4], section[5], section[6], section[9]
         if kind == 11:
             if entry != 24 or size % 24 or link >= len(sections) or sections[link][1] != 3:
                 raise AuditError(f"{path}: invalid dynamic symbol table (entry size {entry}, size {size}, string table section {link})")
+            take(data, offset, size, path, "dynamic symbol table")
             strings_offset, strings_size = sections[link][4], sections[link][5]
             take(data, strings_offset, strings_size, path, "dynamic string table")
             for position in range(0, size, 24):
-                name, _, _, index, _, _ = unpack("<IBBHQQ", data, offset + position, path, "dynamic symbol")
+                name, info, _, index, _, _ = unpack("<IBBHQQ", data, offset + position, path, "dynamic symbol")
                 if name and index == 0:
                     symbol = cstring(data, strings_offset + name, strings_offset + strings_size, path, "import name")
-                    symbols.add(symbol.split(MODULE_SUFFIX, 1)[0])
+                    symbol = symbol.split(MODULE_SUFFIX, 1)[0]
+                    symbols[symbol] = symbols.get(symbol, True) and info >> 4 == 2
         elif kind == 6:
             if entry != 16 or size % 16 or link >= len(sections) or sections[link][1] != 3:
                 raise AuditError(f"{path}: invalid dynamic section (entry size {entry}, size {size}, string table section {link})")
+            take(data, offset, size, path, "dynamic section")
             strings_offset, strings_size = sections[link][4], sections[link][5]
             take(data, strings_offset, strings_size, path, "dynamic string table")
+            terminated = False
             for position in range(0, size, 16):
                 tag, value = unpack("<qQ", data, offset + position, path, "dynamic entry")
                 if tag == 0:
+                    terminated = True
                     break
                 if tag == 1:
                     needed.add(cstring(data, strings_offset + value, strings_offset + strings_size, path, "needed library name"))
+            if not terminated:
+                raise AuditError(f"{path}: dynamic section is not terminated by DT_NULL")
     return symbols, needed
 
 
@@ -258,6 +276,8 @@ def pe_headers(path, data):
 def pe_exports(path, data):
     to_offset, directory, _ = pe_headers(path, data)
     rva, size = unpack("<II", data, directory, path, "export data directory")
+    if not rva and not size:
+        return set()
     if not rva or size < 40:
         raise AuditError(f"{path}: PE file has no export table")
 
@@ -449,7 +469,7 @@ def read_modules(directories):
                 names = pe_exports(file, data)
             else:
                 symbols, needed = elf_imports(file, data)
-                imports[file.name] = (sorted(symbols), sorted(needed))
+                imports[file.name] = (sorted(symbols.items()), sorted(needed))
                 names = elf_exports(file, data)
             for name in names:
                 exports[name.split(MODULE_SUFFIX, 1)[0]].add(file.name)
@@ -462,23 +482,144 @@ def nids_of(name, aliases):
     return {nid_names.compute_nid(nid_names.strip_nid_postfix(name))}
 
 
+def top_level_statements(body):
+    braces, parens, start, parts = 0, 0, 1, []
+    for i, character in enumerate(body[1:-1], 1):
+        if character in "([":
+            parens += 1
+        elif character in ")]":
+            parens -= 1
+        elif character == "{":
+            braces += 1
+        elif character == "}":
+            braces -= 1
+            if not braces and not parens:
+                parts.append((start, body[start:i + 1]))
+                start = i + 1
+        elif character == ";" and not braces and not parens:
+            parts.append((start, body[start:i + 1]))
+            start = i + 1
+    parts.append((start, body[start:-1]))
+    return parts
+
+
+def branch_variants(body):
+    root = []
+    lists, groups = [root], []
+    position = 0
+    for directive in PREPROCESSOR_LINE.finditer(body):
+        lists[-1].append(body[position:directive.start()])
+        position = directive.end()
+        kind = directive.group(1)
+        if kind in ("if", "ifdef", "ifndef"):
+            group = {"alternatives": [[]], "default": False}
+            lists[-1].append(group)
+            groups.append(group)
+            lists.append(group["alternatives"][-1])
+            continue
+        if not groups:
+            raise AuditError(f"#{kind} without a matching #if")
+        group = groups[-1]
+        lists.pop()
+        if kind == "endif":
+            if not group["default"]:
+                group["alternatives"].append([])
+            groups.pop()
+            continue
+        group["default"] = group["default"] or kind == "else"
+        group["alternatives"].append([])
+        lists.append(group["alternatives"][-1])
+    if groups:
+        raise AuditError("#if without a matching #endif")
+    root.append(body[position:])
+
+    def expand(items):
+        variants = [""]
+        for item in items:
+            if isinstance(item, str):
+                variants = [variant + item for variant in variants]
+                continue
+            choices = [choice for alternative in item["alternatives"] for choice in expand(alternative)]
+            variants = [variant + choice for variant in variants for choice in choices]
+            if len(variants) > BRANCH_VARIANT_LIMIT:
+                raise AuditError(f"more than {BRANCH_VARIANT_LIMIT} preprocessor branch combinations in one function")
+        return variants
+
+    return expand(root)
+
+
+def variant_calls(body):
+    return [unconditional_calls(variant) for variant in branch_variants(body)]
+
+
+def unconditional_calls(body):
+    names = set()
+    for offset, statement in top_level_statements(body):
+        block = statement.strip()
+        if block.startswith("{") and block.endswith("}"):
+            names |= unconditional_calls(block)
+        elif not (CONDITIONAL.match(block) or BRANCHING.search(statement)):
+            for call in progress.CALL.finditer(statement):
+                before = statement[:call.start()]
+                if before.count("{") == before.count("}") and not progress.QUALIFIED.search(body, 0, offset + call.start()):
+                    names.add(call.group(1))
+        if EXIT.search(statement):
+            break
+    return names
+
+
+def always_stub_calls(text):
+    helpers = {}
+    for match in progress.STUB_WRAPPER.finditer(text):
+        body = text[match.end() - 1:progress.body_end(text, match.end() - 1) + 1]
+        helpers.setdefault(match.group(1), []).extend(variant_calls(body))
+    calls = {progress.STUB}
+    while True:
+        found = {name for name, bodies in helpers.items() if name not in calls and all(targets & calls for targets in bodies)}
+        if not found:
+            return calls
+        calls |= found
+
+
+def conditional_stubs(library):
+    conditional = set()
+    for source in library.rglob("*.cpp"):
+        if "tests" in source.relative_to(library).parts:
+            continue
+        text = progress.code(source.read_text(errors="ignore"))
+        calls = always_stub_calls(text)
+        for match in progress.DEFINITION.finditer(text):
+            body = text[match.end() - 1:progress.body_end(text, match.end() - 1) + 1]
+            if not all(targets & calls for targets in variant_calls(body)):
+                conditional.add(match.group(1))
+    return conditional
+
+
 def source_stubs(source):
+    return source_stub_classes(source)[0]
+
+
+def source_stub_classes(source):
     if not Path(source).is_dir():
         raise AuditError(f"{source}: not a directory")
     stubs = {}
+    partial = set()
     shared = {}
     for library in sorted(item for item in Path(source).iterdir() if item.is_dir()):
         aliases = {}
         for file in nid_names.source_files(library):
-            for nid, name in nid_names.source_aliases(file.read_text(errors="ignore")):
+            for nid, name in nid_names.source_aliases(file.read_text(encoding="utf-8-sig", errors="ignore")):
                 aliases.setdefault(name, set()).add(nid)
         group = progress.scan_library(library)
         if "shared_sources" in group:
             shared[library.name] = group["shared_sources"]
         done = {nid for name in group["done_names"] for nid in nids_of(name, aliases)}
+        conditional = conditional_stubs(library) if group["todo_names"] else set()
         for name in group["todo_names"]:
             for nid in nids_of(name, aliases) - done:
                 stubs.setdefault((library.name + ".prx", nid), name)
+                if name in conditional:
+                    partial.add((library.name + ".prx", nid))
     for library, owner in shared.items():
         chain = [library]
         while owner in shared:
@@ -489,7 +630,9 @@ def source_stubs(source):
         for (provider, nid), name in list(stubs.items()):
             if provider == owner + ".prx":
                 stubs[(library + ".prx", nid)] = name
-    return stubs
+                if (provider, nid) in partial:
+                    partial.add((library + ".prx", nid))
+    return stubs, partial
 
 
 def read_registry(path):
@@ -538,11 +681,13 @@ MODULE_FILE_SUFFIXES = (".debug_prx", ".suprx", ".sprx", ".prx")
 
 
 def module_stem(name, fold):
+    if fold:
+        name = name.lower()
     for suffix in MODULE_FILE_SUFFIXES:
         if len(name) > len(suffix) and name.endswith(suffix):
             name = name[:-len(suffix)]
             break
-    return name.lower() if fold else name
+    return name
 
 
 class ModuleNames(set):
@@ -558,17 +703,17 @@ class ModuleNames(set):
         return isinstance(library, str) and module_stem(library, self.fold) in self.stems
 
 
-def classify(nid, library, providers, stubs, modules):
+def classify(nid, library, providers, stubs, modules, partial=frozenset()):
     if library and library in modules:
         return "module"
     if not providers:
         return "absent"
     if all((provider, nid) in stubs for provider in providers):
-        return "stub"
+        return "partial" if any((provider, nid) in partial for provider in providers) else "stub"
     return "implemented"
 
 
-def audit(imports, exports, stubs, libraries, modules, module_imports=None, module_exports=None, *, needed_libraries=(), windows_libraries=()):
+def audit(imports, exports, stubs, libraries, modules, module_imports=None, module_exports=None, *, needed_libraries=(), windows_libraries=(), partial=frozenset()):
     windows_names = {}
     for library in windows_libraries:
         windows_names.setdefault(library.casefold(), set()).add(library)
@@ -594,25 +739,28 @@ def audit(imports, exports, stubs, libraries, modules, module_imports=None, modu
         record["references"] += 1
         record["weak"] = record["weak"] and weak
     for module, (symbols, needed) in (module_imports or {}).items():
-        for nid in symbols:
-            record = records.setdefault((nid, None, module), {"nid": nid, "library": None, "module": module, "references": 0, "weak": False})
+        for nid, weak in symbols:
+            record = records.setdefault((nid, None, module), {"nid": nid, "library": None, "module": module, "references": 0, "weak": weak})
             record["references"] += 1
+            record["weak"] = record["weak"] and weak
     for record in records.values():
         nid, library = record["nid"], record["library"]
         providers = exports.get(nid, [])
         if not library:
             providers = sorted(set(providers) | set((module_exports or {}).get(nid, [])))
         resolved_nid = nid
+        record["symbol_mismatch"] = False
         if not providers:
             resolved_nid = nid_names.compute_nid(nid)
             providers = exports.get(resolved_nid, [])
+            record["symbol_mismatch"] = bool(library) and library not in modules and bool(providers) and resolved_nid != nid
             if not library:
                 providers = sorted(set(providers) | set((module_exports or {}).get(resolved_nid, [])))
-        kind = classify(resolved_nid, library, providers, stubs, modules)
+        kind = classify(resolved_nid, library, providers, stubs, modules, partial)
         record["class"] = kind
         record["providers"] = providers
-        record["library_mismatch"] = kind in ("implemented", "stub") and bool(library) and system_library(library) not in providers and "libc.prx" not in providers
-        record["name"] = next((stubs[(provider, resolved_nid)] for provider in providers if (provider, resolved_nid) in stubs), None) if kind == "stub" else None
+        record["library_mismatch"] = kind in ("implemented", "partial", "stub") and bool(library) and system_library(library) not in providers and "libc.prx" not in providers
+        record["name"] = next((stubs[(provider, resolved_nid)] for provider in providers if (provider, resolved_nid) in stubs), None) if kind in ("partial", "stub") else None
     ordered = sorted(records.values(), key=lambda record: (record["class"], record["library"] or "", record.get("module") or "", record["nid"]))
     check_conservation(len(imports) + sum(len(symbols) for symbols, _ in (module_imports or {}).values()), ordered)
     missing = defaultdict(int)
@@ -637,7 +785,7 @@ def current_stop(imports, records):
         if weak:
             continue
         record = classes.get((nid, library))
-        if record is not None and record["class"] == "absent":
+        if record is not None and (record["class"] == "absent" or record["symbol_mismatch"]):
             return record
     return None
 
@@ -696,6 +844,7 @@ def summarize(records, references, missing, missing_hosts=()):
         "missing_libraries": missing,
         "missing_host_dependencies": [{"importer": entry["importer"], "chain": list(entry["chain"])} for entry in missing_hosts],
         "library_mismatch": sum(1 for record in records if record["library_mismatch"]),
+        "symbol_mismatch": sum(1 for record in records if record["symbol_mismatch"]),
     }
 
 
@@ -705,6 +854,8 @@ def label(record):
     else:
         mark = "" if record.get("name_verified", True) else " (name does not hash to this NID)"
         text = f"{record['nid']}  {record['name']}{mark}"
+    if record["weak"]:
+        text += "  (weak import)"
     return f"{text}  (imported by {record['module']})" if record.get("module") else text
 
 
@@ -730,7 +881,8 @@ def render(summary, records, missing, stops, missing_hosts=(), located=None):
     lines = [f"{summary['references']} references, {summary['unique_imports']} unique imports"]
     for kind in CLASSES:
         lines.append(f"  {kind:<12}{summary['unique_by_class'][kind]:>6} imports  {summary['references_by_class'][kind]:>6} references")
-    for title, kind in (("Absent: no built library exports these, so the loader fails", "absent"), ("Stub: exported but throws when called", "stub")):
+    for title, kind in (("Absent: no built library exports these", "absent"), ("Stub: exported but throws when called", "stub"),
+                        ("Partial: exported, throws only for inputs whose behaviour is unknown", "partial")):
         selected = [record for record in records if record["class"] == kind]
         if selected:
             lines.append("")
@@ -741,6 +893,10 @@ def render(summary, records, missing, stops, missing_hosts=(), located=None):
                     current = record["library"]
                     lines.append(f"  [{current or 'library not named'}]")
                 lines.append(f"    {label(record)}")
+    mismatched = [record for record in records if record["symbol_mismatch"]]
+    if mismatched:
+        lines.extend(["", f"Qualified import names exported only as their NID ({len(mismatched)}): the loader cannot resolve these names"])
+        lines.extend(f"  {label(record)} -> {nid_names.compute_nid(record['nid'])}" for record in mismatched)
     if stops:
         lines.append("")
         lines.append("Current stop (first unresolved import, in registry order)")
@@ -766,6 +922,10 @@ def render(summary, records, missing, stops, missing_hosts=(), located=None):
 
 
 def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="classify the imports of a converted game against the built system libraries")
     parser.add_argument("registries", nargs="+", type=Path, help="JSON written by 'relinker --registry'")
     parser.add_argument("--libs", action="append", required=True, help="directory of built .prx files; repeat for several")
@@ -785,6 +945,7 @@ def main(argv=None):
             inputs += [file for directory in args.libs for file in directory_files(directory, "*.prx")]
             inputs += [file for directory in args.modules for file in directory_files(directory, "*")]
             inputs += list(Path(args.source).rglob("*.cpp"))
+            inputs += [file for file in Path(args.source).glob("*/CMakeLists.txt") if file.is_file()]
             output = args.json.resolve()
             if any(output == path.resolve() or (args.json.exists() and args.json.samefile(path)) for path in inputs):
                 raise AuditError(f"{args.json}: JSON output would overwrite an input file")
@@ -797,7 +958,8 @@ def main(argv=None):
         modules = set(module_imports)
         modules |= {name.removesuffix(".guest.prx") for name in modules if name.endswith(".guest.prx")}
         modules = ModuleNames(modules, fold=bool(windows))
-        records, missing = audit(imports, exports, source_stubs(args.source), libraries, modules, module_imports, module_exports, needed_libraries=needed, windows_libraries=windows)
+        stubs, partial = source_stub_classes(args.source)
+        records, missing = audit(imports, exports, stubs, libraries, modules, module_imports, module_exports, needed_libraries=needed, windows_libraries=windows, partial=partial)
         missing_hosts = audit_host_dependencies(host_dependencies, libraries, modules, windows)
         if args.names:
             attach_names(records, load_names(args.names))
@@ -819,11 +981,8 @@ def main(argv=None):
         return 2
     located = locate_missing(missing, {path.resolve().parent for path in args.registries}) if missing else None
     print(render(summary, records, missing, stops, missing_hosts, located))
-    return 1 if summary["unique_by_class"]["absent"] or missing or missing_hosts or (args.strict_providers and summary["library_mismatch"]) or (args.strict_stubs and summary["unique_by_class"]["stub"]) else 0
+    return 1 if summary["unique_by_class"]["absent"] or summary["symbol_mismatch"] or missing or missing_hosts or (args.strict_providers and summary["library_mismatch"]) or (args.strict_stubs and summary["unique_by_class"]["stub"]) else 0
 
 
 if __name__ == "__main__":
-    for stream in (sys.stdout, sys.stderr):
-        if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8", errors="replace")
     raise SystemExit(main())
diff --git a/tools/input-mapper/app.js b/tools/input-mapper/app.js
new file mode 100644
index 0000000000..4703578fe0
--- /dev/null
+++ b/tools/input-mapper/app.js
@@ -0,0 +1,446 @@
+import {actions, defaults, groups, mouseValues, typesForAction, wheelValues} from './mapping.js';
+import {exportableKeys} from './keys.js';
+import {captureKey} from './capture.js';
+import {parseIni, serialize, validate} from './validation.js';
+import {diagnostic, initialLocale, locales, translate} from './i18n.js';
+import {createDropdown} from './dropdown.js';
+
+const byId = id => document.getElementById(id);
+let entries = [];
+let savedConfiguration = '[]';
+let captureTarget;
+let captureButton;
+let selectedGroup = groups[0].name;
+let locale = initialLocale();
+let languageControl;
+const bindingControls = new WeakMap();
+let activeView = ['controls', 'configuration', 'help'].includes(location.hash.slice(1)) ? location.hash.slice(1) : 'controls';
+let currentStatus;
+let importReport;
+const dialog = byId('capture-dialog');
+try {
+    const savedLocale = localStorage.getItem('anyps5-controls-language');
+    locale = initialLocale(savedLocale);
+} catch {}
+const t = (key, values) => translate(locale, key, values);
+const groupLabel = name => t(`group${groups.findIndex(group => group.name === name)}`);
+
+function setStatus(key, values = {}) {
+    currentStatus = {key, values};
+    byId('status').textContent = t(key, values);
+}
+
+function showView(view, focus = true, updateHash = true) {
+    activeView = view;
+    const controls = view === 'controls';
+    byId('categories').hidden = !controls;
+    byId('toolbar').hidden = !controls;
+    byId('mappings').hidden = !controls;
+    byId('configuration').hidden = view !== 'configuration';
+    byId('help').hidden = view !== 'help';
+    byId('validation').hidden = view === 'help';
+    byId('status').hidden = view === 'help';
+    byId('import-report').hidden = view === 'help' || !importReport;
+    byId('view-intro').textContent = t(controls ? 'intro' : view === 'help' ? 'helpIntro' : 'configIntro');
+    if (controls) filterActions();
+    else byId('group-title').textContent = t(view);
+    for (const link of document.querySelectorAll('[data-view]')) {
+        const current = link.dataset.view === view;
+        link.classList.toggle('current', current);
+        if (current) link.setAttribute('aria-current', 'page');
+        else link.removeAttribute('aria-current');
+    }
+    if (updateHash && location.hash !== `#${view}`) history.pushState(null, '', `#${view}`);
+    if (focus) {
+        byId('content').focus({preventScroll: true});
+        window.scrollTo({top: 0, behavior: 'auto'});
+    }
+}
+
+function renderHelp() {
+    const opened = [...byId('help').querySelectorAll('details')].map(item => item.open);
+    byId('help').replaceChildren();
+    for (let index = 0; index < 4; index++) {
+        const question = element('details', undefined, 'faq');
+        question.open = opened[index] || false;
+        question.append(element('summary', t(`faq${index}Question`)), element('p', t(`faq${index}Answer`)));
+        byId('help').append(question);
+    }
+}
+
+function renderImportReport() {
+    if (!importReport) return;
+    const report = byId('import-report');
+    report.replaceChildren(element('h2', t(importReport.errors.length ? 'importRejected' : 'importRead')));
+    const messages = [...importReport.errors, ...importReport.warnings];
+    if (messages.length) {
+        const list = element('ul');
+        for (const item of messages) list.append(element('li', t('line', {line: item.line, message: diagnostic(locale, item.message)})));
+        report.append(list);
+    }
+    if (importReport.errors.length) report.append(element('p', t('preserved'), 'error'));
+    report.hidden = false;
+}
+
+function applyLocale() {
+    document.documentElement.lang = locale;
+    document.documentElement.dir = locales.find(item => item.code === locale).direction;
+    for (const node of document.querySelectorAll('[data-i18n]')) node.textContent = t(node.dataset.i18n);
+    for (const node of document.querySelectorAll('[data-i18n-label]')) node.setAttribute('aria-label', t(node.dataset.i18nLabel));
+    for (const node of document.querySelectorAll('[data-i18n-placeholder]')) node.placeholder = t(node.dataset.i18nPlaceholder);
+    languageControl.label = t('language');
+    languageControl.direction = document.documentElement.dir;
+    languageControl.text = dropdownText();
+    languageControl.setValue(locale);
+    byId('settings').title = t('language');
+    byId('categories').replaceChildren();
+    renderCategories();
+    renderHelp();
+    render();
+    renderImportReport();
+    if (currentStatus) setStatus(currentStatus.key, currentStatus.values);
+    showView(activeView, false, false);
+    updateClock();
+}
+
+function element(tag, text, className) {
+    const node = document.createElement(tag);
+    if (text !== undefined) node.textContent = text;
+    if (className) node.className = className;
+    return node;
+}
+
+function isDirty() {
+    return JSON.stringify(entries) !== savedConfiguration;
+}
+
+async function confirmReplacement() {
+    if (!isDirty()) return true;
+    const confirmation = byId('replace-dialog');
+    confirmation.returnValue = 'cancel';
+    return new Promise(resolve => {
+        confirmation.addEventListener('close', () => resolve(confirmation.returnValue === 'discard'), {once: true});
+        confirmation.showModal();
+    });
+}
+
+function valueChoices(type) {
+    return type === 'KEY' ? exportableKeys : type === 'MOUSE' ? mouseValues : type === 'WHEEL' ? wheelValues : [];
+}
+
+function dropdownText() {
+    return {search: t('searchOptions'), close: t('close'), empty: t('noOptions')};
+}
+
+function selectControl(label, choices, value) {
+    return createDropdown({label, choices: [{value: '', label: t('select')}, ...choices], value, placeholder: t('select'), text: dropdownText()});
+}
+
+function button(text, label, click) {
+    const control = element('button', text);
+    control.type = 'button';
+    control.setAttribute('aria-label', label);
+    control.addEventListener('click', click);
+    return control;
+}
+
+function renderCategories() {
+    const icons = ['face-icon', 'shoulder-icon', 'direction-icon', 'stick-icon', 'stick-icon', 'touch-icon'];
+    const symbols = ['△ ○ × □', 'L2 R2', '', 'L', 'R', ''];
+    groups.forEach((group, index) => {
+        const category = button('', groupLabel(group.name), () => {
+            selectedGroup = group.name;
+            byId('search').value = '';
+            filterActions();
+        });
+        category.className = 'category';
+        category.dataset.group = group.name;
+        const icon = element('span', undefined, 'category-icon');
+        icon.setAttribute('aria-hidden', 'true');
+        const mark = element('span', undefined, icons[index]);
+        if (index === 0) {
+            for (const symbol of symbols[index].split(' ')) mark.append(element('span', symbol));
+        } else mark.textContent = symbols[index];
+        icon.append(mark);
+        category.append(icon, element('span', t(`group${index}`), 'category-label'));
+        category.addEventListener('keydown', event => {
+            const direction = document.documentElement.dir === 'rtl' ? -1 : 1;
+            const offset = event.key === 'ArrowRight' ? direction : event.key === 'ArrowLeft' ? -direction : 0;
+            if (!offset && event.key !== 'Home' && event.key !== 'End') return;
+            event.preventDefault();
+            const next = event.key === 'Home' ? 0 : event.key === 'End' ? groups.length - 1 : (index + offset + groups.length) % groups.length;
+            const target = byId('categories').children[next];
+            target.click();
+            target.focus();
+            target.scrollIntoView({block: 'nearest', inline: 'nearest'});
+        });
+        byId('categories').append(category);
+    });
+}
+
+function renderBinding(entry, position) {
+    const row = element('div', undefined, 'binding');
+    const label = t('bindingLabel', {action: entry.action, number: position + 1});
+    const type = selectControl(t('typeLabel', {binding: label}), typesForAction(entry.action), entry.type);
+    const value = selectControl(t('valueLabel', {binding: label}), valueChoices(entry.type), entry.value);
+    type.element.dir = 'ltr';
+    value.element.dir = 'ltr';
+    const capture = button(t('capture'), t('captureLabel', {binding: label}), () => {
+        captureTarget = entry;
+        captureButton = capture;
+        byId('capture-title').textContent = t('captureTitle', {action: entry.action});
+        byId('capture-status').textContent = '';
+        dialog.showModal();
+    });
+    capture.disabled = entry.type !== 'KEY';
+    const remove = button(t('remove'), t('removeLabel', {binding: label}), () => {
+        entries = entries.filter(binding => binding !== entry);
+        render();
+        const remaining = document.querySelector(`[data-action="${entry.action}"] .dropdown-trigger`);
+        (remaining || document.querySelector(`[data-action="${entry.action}"] .add-binding`)).focus();
+    });
+    type.select.addEventListener('change', () => {
+        entry.type = type.select.value;
+        entry.value = '';
+        value.setChoices([{value: '', label: t('select')}, ...valueChoices(entry.type)]);
+        value.setValue('');
+        capture.disabled = entry.type !== 'KEY';
+        updateOutput();
+    });
+    value.select.addEventListener('change', () => {
+        entry.value = value.select.value;
+        updateOutput();
+    });
+    row.append(type.element, value.element, capture, remove);
+    bindingControls.set(entry, value);
+    return row;
+}
+
+function render() {
+    const container = byId('mappings');
+    container.replaceChildren();
+    for (const group of groups) {
+        const section = element('section', undefined, 'group');
+        section.dataset.group = group.name;
+        section.append(element('h2', groupLabel(group.name)));
+        for (const action of group.actions) {
+            const article = element('div', undefined, 'action');
+            article.dataset.action = action;
+            const heading = element('div', undefined, 'action-heading');
+            const add = button(t('add'), t('addLabel', {action}), () => {
+                entries.push({action, type: 'KEY', value: ''});
+                render();
+                const rows = document.querySelectorAll(`[data-action="${action}"] .binding`);
+                rows[rows.length - 1].querySelectorAll('.dropdown-trigger')[1].focus();
+            });
+            add.className = 'add-binding';
+            const title = element('div', undefined, 'action-title');
+            const symbols = {Cross: '×', Circle: '○', Triangle: '△', Square: '□', Up: '↑', Right: '→', Down: '↓', Left: '←'};
+            if (symbols[action]) {
+                const symbol = element('span', symbols[action], 'action-symbol');
+                symbol.setAttribute('aria-hidden', 'true');
+                title.append(symbol);
+            }
+            const actionName = element('h3', action);
+            actionName.dir = 'ltr';
+            title.append(actionName);
+            heading.append(title, add);
+            article.append(heading);
+            const configured = entries.filter(entry => entry.action === action);
+            article.append(element('p', configured.length ? t('custom') : t('builtin', {inputs: defaults[action].join(', ') || t('noDefault')}), 'hint'));
+            configured.forEach((entry, position) => article.append(renderBinding(entry, position)));
+            section.append(article);
+        }
+        container.append(section);
+    }
+    filterActions();
+    updateOutput();
+}
+
+function filterActions() {
+    const search = byId('search').value.trim().toLowerCase();
+    if (activeView === 'controls') byId('group-title').textContent = search ? t('search') : groupLabel(selectedGroup);
+    for (const category of byId('categories').children) {
+        category.setAttribute('aria-pressed', String(!search && category.dataset.group === selectedGroup));
+    }
+    let visible = 0;
+    for (const section of document.querySelectorAll('.group')) {
+        let matches = 0;
+        for (const action of section.querySelectorAll('.action')) {
+            action.hidden = search ? !`${section.dataset.group} ${groupLabel(section.dataset.group)} ${action.dataset.action}`.toLowerCase().includes(search) : section.dataset.group !== selectedGroup;
+            if (!action.hidden) matches++;
+        }
+        section.hidden = matches === 0;
+        visible += matches;
+    }
+    let empty = byId('no-results');
+    if (!empty) {
+        empty = element('p', t('noResults'), 'hint');
+        empty.id = 'no-results';
+        byId('mappings').append(empty);
+    }
+    empty.hidden = visible !== 0;
+}
+
+function updateOutput() {
+    const result = validate(entries);
+    const valid = result.errors.length === 0;
+    byId('preview').value = valid ? serialize(entries) : '';
+    byId('count').textContent = `${new Set(result.bindings.map(binding => binding.action)).size} / ${actions.length}`;
+    byId('download').disabled = !valid;
+    byId('copy').disabled = !valid;
+    const report = byId('validation');
+    report.replaceChildren();
+    for (const [name, messages] of [['error', result.errors], ['warning', result.warnings]]) {
+        if (!messages.length) continue;
+        const list = element('ul', undefined, name);
+        for (const item of messages) list.append(element('li', diagnostic(locale, item.message)));
+        report.append(list);
+    }
+    const rows = [...document.querySelectorAll('.binding')];
+    const renderedEntries = groups.flatMap(group => group.actions.flatMap(action => entries.filter(entry => entry.action === action)));
+    rows.forEach((row, index) => {
+        const invalid = result.errors.some(error => entries[error.index] === renderedEntries[index]);
+        for (const control of row.querySelectorAll('.dropdown-trigger')) control.setAttribute('aria-invalid', String(invalid));
+    });
+}
+
+function cancelCapture(message) {
+    captureTarget = undefined;
+    dialog.close();
+    captureButton?.focus();
+    if (message) setStatus(message);
+}
+
+byId('cancel-capture').addEventListener('click', () => cancelCapture('captureCancelled'));
+dialog.addEventListener('cancel', event => {
+    event.preventDefault();
+    cancelCapture('captureCancelled');
+});
+window.addEventListener('blur', () => {
+    if (captureTarget) cancelCapture('captureBlur');
+});
+window.addEventListener('keydown', event => {
+    if (!captureTarget) return;
+    event.preventDefault();
+    event.stopImmediatePropagation();
+    if (event.code === 'Escape' || event.key === 'Escape') {
+        cancelCapture('captureCancelled');
+        return;
+    }
+    if (event.repeat) return;
+    const result = captureKey(event);
+    if (result.error) {
+        byId('capture-status').textContent = diagnostic(locale, result.error);
+        return;
+    }
+    const target = captureTarget;
+    target.value = result.value;
+    cancelCapture();
+    bindingControls.get(target)?.setValue(result.value);
+    updateOutput();
+    setStatus('captured', {value: result.value, action: target.action});
+}, true);
+
+byId('search').addEventListener('input', filterActions);
+byId('reset').addEventListener('click', async () => {
+    if (!await confirmReplacement()) return;
+    entries = [];
+    savedConfiguration = '[]';
+    importReport = undefined;
+    byId('import-report').hidden = true;
+    render();
+    setStatus('resetDone');
+});
+byId('import').addEventListener('click', () => byId('file').click());
+byId('file').addEventListener('change', async event => {
+    const file = event.target.files[0];
+    if (!file) return;
+    event.target.value = '';
+    try {
+        if (file.size > 1024 * 1024) throw new Error(t('fileTooLarge'));
+        const text = new TextDecoder('utf-8', {fatal: true}).decode(await file.arrayBuffer());
+        const result = parseIni(text);
+        const report = byId('import-report');
+        importReport = result;
+        renderImportReport();
+        if (result.errors.length) {
+            report.focus();
+            return;
+        }
+        if (!await confirmReplacement()) return;
+        entries = result.entries;
+        savedConfiguration = JSON.stringify(entries);
+        render();
+        setStatus('imported', {name: file.name});
+    } catch (error) {
+        setStatus('importFailed', {message: error instanceof TypeError ? t('invalidUtf8') : error.message});
+    }
+});
+byId('download').addEventListener('click', () => {
+    const content = serialize(entries);
+    const url = URL.createObjectURL(new Blob([content], {type: 'text/plain;charset=utf-8'}));
+    const link = element('a');
+    link.href = url;
+    link.download = 'anyps5-input.ini';
+    document.body.append(link);
+    link.click();
+    link.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 1000);
+    savedConfiguration = JSON.stringify(entries);
+    setStatus('downloaded');
+});
+byId('copy').addEventListener('click', async () => {
+    try {
+        const content = serialize(entries);
+        const copiedConfiguration = JSON.stringify(entries);
+        await navigator.clipboard.writeText(content);
+        savedConfiguration = copiedConfiguration;
+        setStatus('copied');
+    } catch {
+        byId('preview').focus();
+        byId('preview').select();
+        setStatus('clipboardFailed');
+    }
+});
+window.addEventListener('beforeunload', event => {
+    if (!isDirty()) return;
+    event.preventDefault();
+    event.returnValue = '';
+});
+byId('focus-search').addEventListener('click', () => {
+    showView('controls');
+    byId('search').focus();
+});
+for (const link of document.querySelectorAll('[data-view]')) {
+    link.addEventListener('click', event => {
+        event.preventDefault();
+        showView(link.dataset.view);
+    });
+}
+byId('back-controls').addEventListener('click', () => showView('controls'));
+function restoreView() {
+    const view = location.hash.slice(1);
+    if (['controls', 'configuration', 'help'].includes(view)) showView(view, false, false);
+    else if (!view) showView('controls', false, false);
+}
+window.addEventListener('popstate', restoreView);
+window.addEventListener('hashchange', restoreView);
+languageControl = createDropdown({
+    label: t('language'), choices: locales.map(item => ({value: item.code, label: item.name, lang: item.code, direction: item.direction})),
+    value: locale, placeholder: t('language'), text: dropdownText(), trigger: byId('settings'), direction: locales.find(item => item.code === locale).direction
+});
+byId('language-control').append(languageControl.element);
+languageControl.select.addEventListener('change', event => {
+    locale = event.target.value;
+    try { localStorage.setItem('anyps5-controls-language', locale); } catch {}
+    applyLocale();
+});
+function updateClock() {
+    const now = new Date();
+    byId('clock').textContent = new Intl.DateTimeFormat(locale, {hour: '2-digit', minute: '2-digit'}).format(now);
+    byId('clock').dateTime = now.toISOString();
+}
+updateClock();
+setInterval(updateClock, 60000);
+applyLocale();
diff --git a/tools/input-mapper/capture.js b/tools/input-mapper/capture.js
new file mode 100644
index 0000000000..05bbce0c36
--- /dev/null
+++ b/tools/input-mapper/capture.js
@@ -0,0 +1,30 @@
+import {exportableKeys} from './keys.js';
+
+const codes = {
+    Enter: 'Return', Escape: 'Escape', Space: 'Space', Backspace: 'Backspace', Tab: 'Tab',
+    Minus: '-', Equal: '=', BracketLeft: '[', BracketRight: ']', Backslash: '\\',
+    Semicolon: ';', Quote: "'", Backquote: '`', Comma: ',', Period: '.', Slash: '/',
+    CapsLock: 'CapsLock', PrintScreen: 'PrintScreen', ScrollLock: 'ScrollLock', Pause: 'Pause',
+    Insert: 'Insert', Home: 'Home', PageUp: 'PageUp', Delete: 'Delete', End: 'End', PageDown: 'PageDown',
+    ArrowRight: 'Right', ArrowLeft: 'Left', ArrowDown: 'Down', ArrowUp: 'Up', NumLock: 'Numlock',
+    NumpadDivide: 'Keypad /', NumpadMultiply: 'Keypad *', NumpadSubtract: 'Keypad -',
+    NumpadAdd: 'Keypad +', NumpadEnter: 'Keypad Enter', NumpadDecimal: 'Keypad .',
+    NumpadEqual: 'Keypad =', NumpadComma: 'Keypad ,', ContextMenu: 'Application',
+    ControlLeft: 'Left Ctrl', ControlRight: 'Right Ctrl', ShiftLeft: 'Left Shift', ShiftRight: 'Right Shift',
+    AltLeft: 'Left Alt', AltRight: 'Right Alt', MetaLeft: 'Left GUI', MetaRight: 'Right GUI'
+};
+
+export function captureKey(event) {
+    if (event.isComposing || event.key === 'Dead' || event.key === 'Process') {
+        return {error: 'Composition and dead keys are ambiguous. Select an SDL key from the list.'};
+    }
+    let value = codes[event.code];
+    if (/^Key[A-Z]$/u.test(event.code)) value = event.code.slice(3);
+    else if (/^Digit[0-9]$/u.test(event.code)) value = event.code.slice(5);
+    else if (/^Numpad[0-9]$/u.test(event.code)) value = `Keypad ${event.code.slice(6)}`;
+    else if (/^F(?:[1-9]|1[0-9]|2[0-4])$/u.test(event.code)) value = event.code;
+    if (!value || !exportableKeys.includes(value)) {
+        return {error: 'This physical key cannot be captured in the current INI format. Select an SDL key from the list.'};
+    }
+    return {value};
+}
diff --git a/tools/input-mapper/dropdown.js b/tools/input-mapper/dropdown.js
new file mode 100644
index 0000000000..63a962e2ea
--- /dev/null
+++ b/tools/input-mapper/dropdown.js
@@ -0,0 +1,167 @@
+const dialog = document.getElementById('picker-dialog');
+const title = document.getElementById('picker-title');
+const search = document.getElementById('picker-search');
+const list = document.getElementById('picker-options');
+const empty = document.getElementById('picker-empty');
+const close = document.getElementById('picker-close');
+let active;
+let visible = [];
+let focused = 0;
+
+function renderOptions() {
+    const query = search.value.trim().toLocaleLowerCase();
+    visible = active.choices.filter(item => `${item.label} ${item.value}`.toLocaleLowerCase().includes(query));
+    list.replaceChildren();
+    const exactMatch = query ? visible.findIndex(item => item.label.toLocaleLowerCase() === query || item.value.toLocaleLowerCase() === query) : -1;
+    focused = Math.max(0, exactMatch >= 0 ? exactMatch : visible.findIndex(item => item.value === active.select.value));
+    visible.forEach((item, index) => {
+        const option = document.createElement('button');
+        option.type = 'button';
+        option.className = 'picker-option';
+        option.setAttribute('role', 'option');
+        option.setAttribute('aria-selected', String(item.value === active.select.value));
+        option.tabIndex = index === focused ? 0 : -1;
+        option.textContent = item.label;
+        if (item.lang) option.lang = item.lang;
+        option.dir = item.direction || active.direction;
+        option.addEventListener('click', () => choose(item));
+        option.addEventListener('focus', () => { focused = index; });
+        list.append(option);
+    });
+    empty.hidden = visible.length !== 0;
+    if (dialog.open) list.children[focused]?.scrollIntoView({block: 'nearest'});
+}
+
+function choose(item) {
+    const current = active;
+    current.setValue(item.value);
+    dialog.close();
+    current.select.dispatchEvent(new Event('change', {bubbles: true}));
+}
+
+function focusOption(index) {
+    if (!visible.length) return;
+    focused = (index + visible.length) % visible.length;
+    [...list.children].forEach((option, position) => { option.tabIndex = position === focused ? 0 : -1; });
+    list.children[focused].focus({preventScroll: true});
+    list.children[focused].scrollIntoView({block: 'nearest'});
+}
+
+function positionPicker() {
+    if (!dialog.open || !active) return;
+    if (matchMedia('(max-width: 600px)').matches) {
+        for (const name of ['top', 'left', 'width']) dialog.style.removeProperty(name);
+        return;
+    }
+    const rect = active.trigger.getBoundingClientRect();
+    const width = Math.min(Math.max(rect.width, 320), innerWidth - 32);
+    dialog.style.width = `${width}px`;
+    const height = dialog.getBoundingClientRect().height;
+    const preferred = rect.bottom + 10;
+    const top = preferred + height <= innerHeight - 16 ? preferred : Math.max(16, rect.top - height - 10);
+    const left = active.direction === 'rtl' ? rect.right - width : rect.left;
+    dialog.style.top = `${Math.min(top, Math.max(16, innerHeight - height - 16))}px`;
+    dialog.style.left = `${Math.max(16, Math.min(left, innerWidth - width - 16))}px`;
+}
+
+function openPicker(control) {
+    active = control;
+    title.textContent = control.label;
+    list.setAttribute('aria-label', control.label);
+    search.value = '';
+    search.placeholder = control.text.search;
+    search.setAttribute('aria-label', control.text.search);
+    close.textContent = control.text.close;
+    empty.textContent = control.text.empty;
+    dialog.style.setProperty('--picker-height', `${Math.min(480, 136 + Math.min(control.choices.length, 8) * 46)}px`);
+    renderOptions();
+    control.trigger.setAttribute('aria-expanded', 'true');
+    dialog.showModal();
+    positionPicker();
+    list.children[focused]?.scrollIntoView({block: 'nearest'});
+    search.focus();
+}
+
+search.addEventListener('input', renderOptions);
+dialog.addEventListener('keydown', event => {
+    if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+        event.preventDefault();
+        const inSearch = event.target === search;
+        focusOption(inSearch ? focused : focused + (event.key === 'ArrowDown' ? 1 : -1));
+    } else if (event.target !== search && (event.key === 'Home' || event.key === 'End')) {
+        event.preventDefault();
+        focusOption(event.key === 'Home' ? 0 : visible.length - 1);
+    } else if (event.target === search && event.key === 'Enter' && visible.length) {
+        event.preventDefault();
+        choose(visible[focused]);
+    }
+});
+close.addEventListener('click', () => dialog.close());
+dialog.addEventListener('click', event => {
+    if (event.target !== dialog) return;
+    const rect = dialog.getBoundingClientRect();
+    if (event.clientX < rect.left || event.clientX > rect.right || event.clientY < rect.top || event.clientY > rect.bottom) dialog.close();
+});
+dialog.addEventListener('close', () => {
+    const current = active;
+    active = undefined;
+    current?.trigger.setAttribute('aria-expanded', 'false');
+    if (current?.trigger.isConnected) current.trigger.focus({preventScroll: true});
+});
+window.addEventListener('resize', positionPicker);
+
+export function createDropdown({label, choices, value, placeholder, text, trigger, direction = 'ltr'}) {
+    const wrapper = document.createElement('div');
+    wrapper.className = 'dropdown';
+    const select = document.createElement('select');
+    select.hidden = true;
+    const providedTrigger = Boolean(trigger);
+    const control = trigger || document.createElement('button');
+    control.type = 'button';
+    if (!providedTrigger) {
+        control.className = 'dropdown-trigger';
+        control.setAttribute('role', 'combobox');
+    }
+    control.setAttribute('aria-label', label);
+    control.setAttribute('aria-haspopup', 'dialog');
+    control.setAttribute('aria-controls', 'picker-dialog');
+    control.setAttribute('aria-expanded', 'false');
+    const selected = document.createElement('span');
+    selected.className = 'dropdown-value';
+    if (!providedTrigger) control.append(selected);
+    const api = {
+        element: wrapper, select, trigger: control, label, direction, text, choices: [],
+        setValue(next) {
+            select.value = next;
+            const choice = api.choices.find(item => item.value === select.value);
+            if (!providedTrigger) selected.textContent = choice?.label || placeholder;
+            if (!providedTrigger) control.title = choice?.label || placeholder;
+        },
+        setChoices(next) {
+            const previous = select.value;
+            api.choices = next.map(item => typeof item === 'string' ? {value: item, label: item} : item);
+            select.replaceChildren();
+            for (const item of api.choices) {
+                const option = document.createElement('option');
+                option.value = item.value;
+                option.textContent = item.label;
+                select.append(option);
+            }
+            api.setValue(previous);
+        },
+        focus() { control.focus(); }
+    };
+    api.setChoices(choices);
+    api.setValue(value);
+    select.addEventListener('change', () => api.setValue(select.value));
+    control.addEventListener('click', () => openPicker(api));
+    control.addEventListener('keydown', event => {
+        if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+            event.preventDefault();
+            openPicker(api);
+        }
+    });
+    wrapper.append(select);
+    if (!providedTrigger) wrapper.append(control);
+    return api;
+}
diff --git a/tools/input-mapper/i18n.js b/tools/input-mapper/i18n.js
new file mode 100644
index 0000000000..3f6b3f0d86
--- /dev/null
+++ b/tools/input-mapper/i18n.js
@@ -0,0 +1,1263 @@
+export const locales = [
+    {
+        "code": "ar-EG",
+        "name": "العربية (المصري)",
+        "direction": "rtl"
+    },
+    {
+        "code": "en",
+        "name": "English",
+        "direction": "ltr"
+    },
+    {
+        "code": "es",
+        "name": "Español",
+        "direction": "ltr"
+    },
+    {
+        "code": "fr",
+        "name": "Français",
+        "direction": "ltr"
+    },
+    {
+        "code": "de",
+        "name": "Deutsch",
+        "direction": "ltr"
+    },
+    {
+        "code": "it",
+        "name": "Italiano",
+        "direction": "ltr"
+    },
+    {
+        "code": "pt",
+        "name": "Português",
+        "direction": "ltr"
+    },
+    {
+        "code": "ru",
+        "name": "Русский",
+        "direction": "ltr"
+    },
+    {
+        "code": "tr",
+        "name": "Türkçe",
+        "direction": "ltr"
+    },
+    {
+        "code": "zh-Hans",
+        "name": "简体中文",
+        "direction": "ltr"
+    },
+    {
+        "code": "ja",
+        "name": "日本語",
+        "direction": "ltr"
+    },
+    {
+        "code": "ko",
+        "name": "한국어",
+        "direction": "ltr"
+    },
+    {
+        "code": "hi",
+        "name": "हिन्दी",
+        "direction": "ltr"
+    },
+    {
+        "code": "bn",
+        "name": "বাংলা",
+        "direction": "ltr"
+    },
+    {
+        "code": "ur",
+        "name": "اردو",
+        "direction": "rtl"
+    },
+    {
+        "code": "fa",
+        "name": "فارسی",
+        "direction": "rtl"
+    },
+    {
+        "code": "id",
+        "name": "Bahasa Indonesia",
+        "direction": "ltr"
+    },
+    {
+        "code": "vi",
+        "name": "Tiếng Việt",
+        "direction": "ltr"
+    },
+    {
+        "code": "th",
+        "name": "ไทย",
+        "direction": "ltr"
+    },
+    {
+        "code": "sw",
+        "name": "Kiswahili",
+        "direction": "ltr"
+    },
+    {
+        "code": "nl",
+        "name": "Nederlands",
+        "direction": "ltr"
+    },
+    {
+        "code": "pl",
+        "name": "Polski",
+        "direction": "ltr"
+    }
+];
+
+export const messages = {
+    "en": {
+        "controls": "Controls",
+        "configuration": "Configuration",
+        "help": "Help",
+        "settings": "Settings",
+        "language": "Language",
+        "close": "Close",
+        "eyebrow": "Accessories / Custom controls",
+        "intro": "Choose a control, then assign your keyboard or mouse inputs.",
+        "search": "Search controls",
+        "import": "Import INI",
+        "reset": "Reset",
+        "group0": "Face buttons",
+        "group1": "Shoulders",
+        "group2": "D-pad",
+        "group3": "Left stick",
+        "group4": "Right stick",
+        "group5": "Touch & utility",
+        "select": "Select…",
+        "add": "+ Add binding",
+        "capture": "Capture",
+        "remove": "Remove",
+        "builtin": "Built-in: {inputs}",
+        "custom": "Custom inputs replace built-in inputs.",
+        "noResults": "No controls match your search.",
+        "download": "Download INI",
+        "copy": "Copy configuration",
+        "previewEmpty": "Add a binding to begin.",
+        "backControls": "Back to controls",
+        "switchGroup": "Switch group",
+        "moveFocus": "Move focus",
+        "helpIntro": "A few answers to help you get started.",
+        "configIntro": "Review your inputs, then copy or download your file.",
+        "captureTitle": "Press a key for {action}",
+        "cancelCapture": "Cancel capture",
+        "keepEditing": "Keep editing",
+        "discard": "Discard changes",
+        "faq0Question": "How do I assign a key?",
+        "faq0Answer": "Choose a group, select Add binding, then Capture or choose a key from the list. Multiple bindings are alternatives.",
+        "faq1Question": "Where does my INI file go?",
+        "faq1Answer": "Download anyps5-input.ini and put it next to the generated game executable. For another location, set ANYPS5_INPUT_CONFIG to the file path.",
+        "faq2Question": "Why does a key not get captured?",
+        "faq2Answer": "Browser or system shortcuts may intercept it. Choose it manually from the list. Escape cancels capture; bind Escape using the list.",
+        "faq3Question": "Are my edits saved automatically?",
+        "faq3Answer": "Input edits stay in memory: copy or download before reloading. Only your language choice is saved in this browser. Unconfigured actions keep their defaults.",
+        "skip": "Skip to content",
+        "mainNav": "Main navigation",
+        "groups": "Control groups",
+        "find": "Find an action",
+        "clock": "Local time",
+        "output": "Configuration output",
+        "captureHelp": "Capture uses physical key positions. Escape cancels capture; choose Escape from the list to assign it. Some browser and system shortcuts require manual selection.",
+        "replaceTitle": "Discard unsaved changes?",
+        "replaceHelp": "Copy or download your configuration first if you want to keep it.",
+        "captureCancelled": "Capture cancelled.",
+        "captureBlur": "Capture cancelled because the window lost focus.",
+        "captured": "Captured {value} for {action}.",
+        "resetDone": "Configuration reset.",
+        "importRejected": "Import rejected",
+        "importRead": "Import read successfully",
+        "line": "Line {line}: {message}",
+        "preserved": "Your current configuration has been preserved.",
+        "imported": "Imported {name}.",
+        "importFailed": "Import failed: {message}",
+        "fileTooLarge": "INI file must be smaller than 1 MiB.",
+        "invalidUtf8": "The file must be valid UTF-8 text.",
+        "downloaded": "Configuration download requested.",
+        "copied": "Configuration copied.",
+        "clipboardFailed": "Clipboard unavailable. Copy the selected preview with Ctrl+C.",
+        "noScript": "Enable JavaScript to use this configurator.",
+        "noDefault": "no keyboard or mouse input",
+        "bindingLabel": "{action} binding {number}",
+        "typeLabel": "{binding} input type",
+        "valueLabel": "{binding} input value",
+        "addLabel": "Add binding to {action}",
+        "captureLabel": "Capture key for {binding}",
+        "removeLabel": "Remove {binding}",
+        "searchOptions": "Search options",
+        "noOptions": "No matching options."
+    },
+    "ar-EG": {
+        "controls": "التحكم",
+        "configuration": "ملف الإعدادات",
+        "help": "المساعدة",
+        "settings": "الإعدادات",
+        "language": "اللغة",
+        "close": "قفل",
+        "eyebrow": "الملحقات / تخصيص التحكم",
+        "intro": "اختار زرار، وبعدين حدد له زرار من الكيبورد أو الماوس.",
+        "search": "دور على زرار",
+        "import": "استيراد INI",
+        "reset": "إعادة ضبط",
+        "group0": "أزرار التحكم",
+        "group1": "الأزرار العلوية",
+        "group2": "الاتجاهات",
+        "group3": "الانالوج الشمال",
+        "group4": "الانالوج اليمين",
+        "group5": "اللمس وأدوات تانية",
+        "select": "اختار…",
+        "add": "+ ضيف زرار",
+        "capture": "تسجيل زرار",
+        "remove": "إزالة",
+        "builtin": "الافتراضي: {inputs}",
+        "custom": "الزرار اللي اخترته بيستبدل التحكم الافتراضي.",
+        "noResults": "مفيش أزرار مطابقة للبحث.",
+        "download": "تنزيل INI",
+        "copy": "نسخ الإعدادات",
+        "previewEmpty": "ضيف زرار عشان تبدأ.",
+        "backControls": "ارجع للتحكم",
+        "switchGroup": "بدّل المجموعة",
+        "moveFocus": "انقل التركيز",
+        "helpIntro": "إجابات سريعة تساعدك تبدأ.",
+        "configIntro": "راجع اختياراتك، وبعدين انسخ الملف أو نزّله.",
+        "captureTitle": "اضغط زرار لـ {action}",
+        "cancelCapture": "إلغاء التسجيل",
+        "keepEditing": "كمّل التعديل",
+        "discard": "تجاهل التعديلات",
+        "faq0Question": "أربط زرار إزاي؟",
+        "faq0Answer": "اختار المجموعة واضغط ضيف زرار. بعدها اضغط تسجيل زرار أو اختاره من القائمة. تقدر تضيف أكتر من زرار لنفس الحركة.",
+        "faq1Question": "أحط ملف INI فين؟",
+        "faq1Answer": "نزّل anyps5-input.ini وحطه جنب ملف تشغيل اللعبة اللي اتولّد. لو عايزه في مكان تاني، حط مساره في ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "ليه فيه زرار مش بيتسجل؟",
+        "faq2Answer": "ممكن المتصفح أو النظام يكون بيستخدمه كاختصار. اختاره من القائمة يدويًا. Escape بيلغي التسجيل؛ لو عايز تربطه اختاره من القائمة.",
+        "faq3Question": "تعديلاتي بتتحفظ لوحدها؟",
+        "faq3Answer": "التعديلات بتفضل في الذاكرة بس: انسخها أو نزّلها قبل تحديث الصفحة. اللغة بس هي اللي بتتحفظ في المتصفح. الأزرار اللي ماعدّلتهاش بتفضل على الافتراضي.",
+        "skip": "روح للمحتوى",
+        "mainNav": "التنقل الرئيسي",
+        "groups": "مجموعات التحكم",
+        "find": "دور على زرار",
+        "clock": "الوقت الحالي",
+        "output": "ملف الإعدادات",
+        "captureHelp": "التسجيل بيستخدم مكان الزرار على الكيبورد. Escape بيلغي التسجيل؛ عشان تربطه اختاره من القائمة. بعض اختصارات المتصفح والنظام لازم تختارها يدويًا.",
+        "replaceTitle": "تتجاهل التعديلات اللي لسه ماحفظتهاش؟",
+        "replaceHelp": "انسخ الإعدادات أو نزّلها الأول لو عايز تحتفظ بيها.",
+        "captureCancelled": "تم إلغاء تسجيل الزرار.",
+        "captureBlur": "التسجيل اتلغى عشان خرجت من النافذة.",
+        "captured": "تم تسجيل {value} لـ {action}.",
+        "resetDone": "الإعدادات رجعت للافتراضي.",
+        "importRejected": "الملف مااتقبلش",
+        "importRead": "الملف اتقري بنجاح",
+        "line": "سطر {line}: {message}",
+        "preserved": "إعداداتك الحالية لسه زي ما هي.",
+        "imported": "تم استيراد {name}.",
+        "importFailed": "الاستيراد ماكملش: {message}",
+        "fileTooLarge": "ملف INI لازم يكون أصغر من 1 MiB.",
+        "invalidUtf8": "الملف لازم يكون نص بترميز UTF-8 سليم.",
+        "downloaded": "تم طلب تنزيل الإعدادات.",
+        "copied": "الإعدادات اتنسخت.",
+        "clipboardFailed": "النسخ مش متاح. انسخ النص المحدد بـ Ctrl+C.",
+        "noScript": "فعّل JavaScript عشان تستخدم الصفحة.",
+        "noDefault": "مفيش زرار كيبورد أو ماوس افتراضي",
+        "bindingLabel": "{action}، الربط {number}",
+        "typeLabel": "نوع الإدخال لـ {binding}",
+        "valueLabel": "الزرار لـ {binding}",
+        "addLabel": "ضيف زرار لـ {action}",
+        "captureLabel": "سجّل زرار لـ {binding}",
+        "removeLabel": "شيل {binding}",
+        "searchOptions": "دور في القائمة",
+        "noOptions": "مفيش اختيار مطابق للبحث."
+    },
+    "es": {
+        "controls": "Controles",
+        "configuration": "Configuración",
+        "help": "Ayuda",
+        "settings": "Ajustes",
+        "language": "Idioma",
+        "close": "Cerrar",
+        "eyebrow": "Accesorios / Controles personalizados",
+        "intro": "Elige un control y asigna entradas del teclado o ratón.",
+        "search": "Buscar controles",
+        "import": "Importar INI",
+        "reset": "Restablecer",
+        "group0": "Botones frontales",
+        "group1": "Botones superiores",
+        "group2": "Cruceta",
+        "group3": "Stick izquierdo",
+        "group4": "Stick derecho",
+        "group5": "Táctil y utilidades",
+        "select": "Seleccionar…",
+        "add": "+ Añadir entrada",
+        "capture": "Capturar",
+        "remove": "Eliminar",
+        "builtin": "Predeterminado: {inputs}",
+        "custom": "Las entradas personalizadas sustituyen las predeterminadas.",
+        "noResults": "No se encontraron controles.",
+        "download": "Descargar INI",
+        "copy": "Copiar configuración",
+        "previewEmpty": "Añade una entrada para empezar.",
+        "backControls": "Volver a controles",
+        "switchGroup": "Cambiar grupo",
+        "moveFocus": "Mover el foco",
+        "helpIntro": "Respuestas rápidas para empezar.",
+        "configIntro": "Revisa las entradas y copia o descarga el archivo.",
+        "captureTitle": "Pulsa una tecla para {action}",
+        "cancelCapture": "Cancelar captura",
+        "keepEditing": "Seguir editando",
+        "discard": "Descartar cambios",
+        "faq0Question": "¿Cómo asigno una tecla?",
+        "faq0Answer": "Elige un grupo y Añadir entrada. Usa Capturar o la lista. Puedes asignar varias entradas a una acción.",
+        "faq1Question": "¿Dónde guardo el archivo INI?",
+        "faq1Answer": "Pon anyps5-input.ini junto al ejecutable generado del juego. Para otra ruta, usa ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "¿Por qué no se captura una tecla?",
+        "faq2Answer": "El navegador o sistema puede interceptarla. Elígela en la lista. Escape cancela la captura; asígnala desde la lista.",
+        "faq3Question": "¿Se guardan mis cambios solos?",
+        "faq3Answer": "Los cambios están en memoria: cópialos o descárgalos antes de recargar. Solo se guarda el idioma. Las acciones no configuradas conservan sus valores predeterminados.",
+        "searchOptions": "Buscar opciones",
+        "noOptions": "No hay opciones coincidentes."
+    },
+    "fr": {
+        "controls": "Commandes",
+        "configuration": "Configuration",
+        "help": "Aide",
+        "settings": "Paramètres",
+        "language": "Langue",
+        "close": "Fermer",
+        "eyebrow": "Accessoires / Commandes personnalisées",
+        "intro": "Choisissez une commande, puis une touche ou un bouton de souris.",
+        "search": "Rechercher une commande",
+        "import": "Importer INI",
+        "reset": "Réinitialiser",
+        "group0": "Boutons principaux",
+        "group1": "Boutons supérieurs",
+        "group2": "Croix directionnelle",
+        "group3": "Stick gauche",
+        "group4": "Stick droit",
+        "group5": "Tactile et utilitaires",
+        "select": "Choisir…",
+        "add": "+ Ajouter une entrée",
+        "capture": "Capturer",
+        "remove": "Supprimer",
+        "builtin": "Par défaut : {inputs}",
+        "custom": "Les entrées personnalisées remplacent celles par défaut.",
+        "noResults": "Aucune commande trouvée.",
+        "download": "Télécharger INI",
+        "copy": "Copier la configuration",
+        "previewEmpty": "Ajoutez une entrée pour commencer.",
+        "backControls": "Retour aux commandes",
+        "switchGroup": "Changer de groupe",
+        "moveFocus": "Déplacer le focus",
+        "helpIntro": "Quelques réponses pour bien commencer.",
+        "configIntro": "Vérifiez les entrées, puis copiez ou téléchargez le fichier.",
+        "captureTitle": "Appuyez sur une touche pour {action}",
+        "cancelCapture": "Annuler la capture",
+        "keepEditing": "Continuer la modification",
+        "discard": "Ignorer les modifications",
+        "faq0Question": "Comment attribuer une touche ?",
+        "faq0Answer": "Choisissez un groupe et Ajouter une entrée. Utilisez Capturer ou la liste. Plusieurs entrées peuvent déclencher la même action.",
+        "faq1Question": "Où placer le fichier INI ?",
+        "faq1Answer": "Placez anyps5-input.ini près de l’exécutable généré du jeu. Pour un autre chemin, utilisez ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Pourquoi une touche n’est-elle pas capturée ?",
+        "faq2Answer": "Un raccourci du navigateur ou du système peut l’intercepter. Choisissez-la dans la liste. Escape annule la capture ; attribuez-la via la liste.",
+        "faq3Question": "Mes modifications sont-elles enregistrées ?",
+        "faq3Answer": "Les modifications restent en mémoire : copiez-les ou téléchargez-les avant de recharger. Seule la langue est mémorisée. Les actions non configurées gardent leurs valeurs par défaut.",
+        "searchOptions": "Rechercher une option",
+        "noOptions": "Aucune option trouvée."
+    },
+    "de": {
+        "controls": "Steuerung",
+        "configuration": "Konfiguration",
+        "help": "Hilfe",
+        "settings": "Einstellungen",
+        "language": "Sprache",
+        "close": "Schließen",
+        "eyebrow": "Zubehör / Eigene Steuerung",
+        "intro": "Wähle eine Steuerung und weise Tastatur- oder Mauseingaben zu.",
+        "search": "Steuerung suchen",
+        "import": "INI importieren",
+        "reset": "Zurücksetzen",
+        "group0": "Aktionstasten",
+        "group1": "Schultertasten",
+        "group2": "Steuerkreuz",
+        "group3": "Linker Stick",
+        "group4": "Rechter Stick",
+        "group5": "Touch und Werkzeuge",
+        "select": "Auswählen…",
+        "add": "+ Eingabe hinzufügen",
+        "capture": "Erfassen",
+        "remove": "Entfernen",
+        "builtin": "Standard: {inputs}",
+        "custom": "Eigene Eingaben ersetzen die Standardeingaben.",
+        "noResults": "Keine passende Steuerung gefunden.",
+        "download": "INI herunterladen",
+        "copy": "Konfiguration kopieren",
+        "previewEmpty": "Füge eine Eingabe hinzu, um zu beginnen.",
+        "backControls": "Zurück zur Steuerung",
+        "switchGroup": "Gruppe wechseln",
+        "moveFocus": "Fokus verschieben",
+        "helpIntro": "Kurze Antworten für den Einstieg.",
+        "configIntro": "Prüfe die Eingaben und kopiere oder lade die Datei herunter.",
+        "captureTitle": "Drücke eine Taste für {action}",
+        "cancelCapture": "Erfassung abbrechen",
+        "keepEditing": "Weiter bearbeiten",
+        "discard": "Änderungen verwerfen",
+        "faq0Question": "Wie weise ich eine Taste zu?",
+        "faq0Answer": "Wähle eine Gruppe und Eingabe hinzufügen. Nutze Erfassen oder die Liste. Mehrere Eingaben können dieselbe Aktion auslösen.",
+        "faq1Question": "Wohin gehört die INI-Datei?",
+        "faq1Answer": "Lege anyps5-input.ini neben die erzeugte Spielprogrammdatei. Für einen anderen Pfad nutze ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Warum wird eine Taste nicht erfasst?",
+        "faq2Answer": "Browser- oder Systemkürzel können sie abfangen. Wähle sie in der Liste. Escape bricht die Erfassung ab; weise Escape über die Liste zu.",
+        "faq3Question": "Werden Änderungen automatisch gespeichert?",
+        "faq3Answer": "Änderungen bleiben im Speicher: vor dem Neuladen kopieren oder herunterladen. Nur die Sprache wird gespeichert. Nicht konfigurierte Aktionen behalten ihre Standardwerte.",
+        "searchOptions": "Optionen suchen",
+        "noOptions": "Keine passenden Optionen."
+    },
+    "it": {
+        "controls": "Controlli",
+        "configuration": "Configurazione",
+        "help": "Aiuto",
+        "settings": "Impostazioni",
+        "language": "Lingua",
+        "close": "Chiudi",
+        "eyebrow": "Accessori / Controlli personalizzati",
+        "intro": "Scegli un controllo e assegna un tasto o un pulsante del mouse.",
+        "search": "Cerca controlli",
+        "import": "Importa INI",
+        "reset": "Reimposta",
+        "group0": "Pulsanti principali",
+        "group1": "Pulsanti superiori",
+        "group2": "Croce direzionale",
+        "group3": "Stick sinistro",
+        "group4": "Stick destro",
+        "group5": "Touch e utilità",
+        "select": "Seleziona…",
+        "add": "+ Aggiungi input",
+        "capture": "Acquisisci",
+        "remove": "Rimuovi",
+        "builtin": "Predefinito: {inputs}",
+        "custom": "Gli input personalizzati sostituiscono quelli predefiniti.",
+        "noResults": "Nessun controllo trovato.",
+        "download": "Scarica INI",
+        "copy": "Copia configurazione",
+        "previewEmpty": "Aggiungi un input per iniziare.",
+        "backControls": "Torna ai controlli",
+        "switchGroup": "Cambia gruppo",
+        "moveFocus": "Sposta il focus",
+        "helpIntro": "Risposte rapide per iniziare.",
+        "configIntro": "Controlla gli input e copia o scarica il file.",
+        "captureTitle": "Premi un tasto per {action}",
+        "cancelCapture": "Annulla acquisizione",
+        "keepEditing": "Continua a modificare",
+        "discard": "Scarta modifiche",
+        "faq0Question": "Come assegno un tasto?",
+        "faq0Answer": "Scegli un gruppo e Aggiungi input. Usa Acquisisci o l’elenco. Puoi assegnare più input alla stessa azione.",
+        "faq1Question": "Dove metto il file INI?",
+        "faq1Answer": "Metti anyps5-input.ini accanto all’eseguibile generato del gioco. Per un altro percorso, usa ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Perché un tasto non viene acquisito?",
+        "faq2Answer": "Il browser o il sistema potrebbe intercettarlo. Sceglilo dall’elenco. Escape annulla l’acquisizione; assegnalo dall’elenco.",
+        "faq3Question": "Le modifiche si salvano automaticamente?",
+        "faq3Answer": "Le modifiche restano in memoria: copiale o scaricale prima di ricaricare. Si salva solo la lingua. Le azioni non configurate mantengono i valori predefiniti.",
+        "searchOptions": "Cerca opzioni",
+        "noOptions": "Nessuna opzione trovata."
+    },
+    "pt": {
+        "controls": "Controles",
+        "configuration": "Configuração",
+        "help": "Ajuda",
+        "settings": "Configurações",
+        "language": "Idioma",
+        "close": "Fechar",
+        "eyebrow": "Acessórios / Controles personalizados",
+        "intro": "Escolha um controle e atribua entradas do teclado ou mouse.",
+        "search": "Buscar controles",
+        "import": "Importar INI",
+        "reset": "Redefinir",
+        "group0": "Botões principais",
+        "group1": "Botões superiores",
+        "group2": "Direcional",
+        "group3": "Analógico esquerdo",
+        "group4": "Analógico direito",
+        "group5": "Toque e utilidades",
+        "select": "Selecionar…",
+        "add": "+ Adicionar entrada",
+        "capture": "Capturar",
+        "remove": "Remover",
+        "builtin": "Padrão: {inputs}",
+        "custom": "As entradas personalizadas substituem as entradas padrão.",
+        "noResults": "Nenhum controle encontrado.",
+        "download": "Baixar INI",
+        "copy": "Copiar configuração",
+        "previewEmpty": "Adicione uma entrada para começar.",
+        "backControls": "Voltar aos controles",
+        "switchGroup": "Trocar grupo",
+        "moveFocus": "Mover o foco",
+        "helpIntro": "Respostas rápidas para começar.",
+        "configIntro": "Confira as entradas e copie ou baixe o arquivo.",
+        "captureTitle": "Pressione uma tecla para {action}",
+        "cancelCapture": "Cancelar captura",
+        "keepEditing": "Continuar editando",
+        "discard": "Descartar alterações",
+        "faq0Question": "Como atribuo uma tecla?",
+        "faq0Answer": "Escolha um grupo e Adicionar entrada. Use Capturar ou a lista. Uma ação pode ter várias entradas alternativas.",
+        "faq1Question": "Onde coloco o arquivo INI?",
+        "faq1Answer": "Coloque anyps5-input.ini junto do executável gerado do jogo. Para outro caminho, use ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Por que uma tecla não é capturada?",
+        "faq2Answer": "O navegador ou sistema pode interceptá-la. Escolha na lista. Escape cancela a captura; atribua Escape pela lista.",
+        "faq3Question": "As alterações são salvas sozinhas?",
+        "faq3Answer": "As alterações ficam na memória: copie ou baixe antes de recarregar. Só o idioma é salvo. Ações não configuradas mantêm os padrões.",
+        "searchOptions": "Buscar opções",
+        "noOptions": "Nenhuma opção encontrada."
+    },
+    "ru": {
+        "controls": "Управление",
+        "configuration": "Конфигурация",
+        "help": "Помощь",
+        "settings": "Настройки",
+        "language": "Язык",
+        "close": "Закрыть",
+        "eyebrow": "Аксессуары / Настройка управления",
+        "intro": "Выберите действие и назначьте клавишу или кнопку мыши.",
+        "search": "Поиск действий",
+        "import": "Импорт INI",
+        "reset": "Сбросить",
+        "group0": "Основные кнопки",
+        "group1": "Верхние кнопки",
+        "group2": "Крестовина",
+        "group3": "Левый стик",
+        "group4": "Правый стик",
+        "group5": "Сенсор и инструменты",
+        "select": "Выбрать…",
+        "add": "+ Добавить ввод",
+        "capture": "Записать",
+        "remove": "Удалить",
+        "builtin": "По умолчанию: {inputs}",
+        "custom": "Новые назначения заменяют стандартные.",
+        "noResults": "Действия не найдены.",
+        "download": "Скачать INI",
+        "copy": "Копировать конфигурацию",
+        "previewEmpty": "Добавьте назначение, чтобы начать.",
+        "backControls": "Назад к управлению",
+        "switchGroup": "Сменить группу",
+        "moveFocus": "Переместить фокус",
+        "helpIntro": "Краткие ответы для начала работы.",
+        "configIntro": "Проверьте назначения и скопируйте или скачайте файл.",
+        "captureTitle": "Нажмите клавишу для {action}",
+        "cancelCapture": "Отменить запись",
+        "keepEditing": "Продолжить изменение",
+        "discard": "Отменить изменения",
+        "faq0Question": "Как назначить клавишу?",
+        "faq0Answer": "Выберите группу и Добавить ввод. Используйте Записать или список. Одно действие может иметь несколько назначений.",
+        "faq1Question": "Куда поместить INI-файл?",
+        "faq1Answer": "Поместите anyps5-input.ini рядом с созданным исполняемым файлом игры. Для другого пути используйте ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Почему клавиша не записывается?",
+        "faq2Answer": "Браузер или система может перехватывать её. Выберите клавишу в списке. Escape отменяет запись; назначайте Escape через список.",
+        "faq3Question": "Изменения сохраняются автоматически?",
+        "faq3Answer": "Изменения хранятся в памяти: копируйте или скачивайте их перед перезагрузкой. Сохраняется только язык. Ненастроенные действия используют значения по умолчанию.",
+        "searchOptions": "Поиск вариантов",
+        "noOptions": "Совпадений нет."
+    },
+    "tr": {
+        "controls": "Kontroller",
+        "configuration": "Yapılandırma",
+        "help": "Yardım",
+        "settings": "Ayarlar",
+        "language": "Dil",
+        "close": "Kapat",
+        "eyebrow": "Aksesuarlar / Özel kontroller",
+        "intro": "Bir kontrol seçip klavye veya fare girdisi atayın.",
+        "search": "Kontrol ara",
+        "import": "INI içe aktar",
+        "reset": "Sıfırla",
+        "group0": "Ana düğmeler",
+        "group1": "Üst düğmeler",
+        "group2": "Yön tuşları",
+        "group3": "Sol çubuk",
+        "group4": "Sağ çubuk",
+        "group5": "Dokunma ve araçlar",
+        "select": "Seç…",
+        "add": "+ Girdi ekle",
+        "capture": "Yakala",
+        "remove": "Kaldır",
+        "builtin": "Varsayılan: {inputs}",
+        "custom": "Özel girdiler varsayılanların yerini alır.",
+        "noResults": "Kontrol bulunamadı.",
+        "download": "INI indir",
+        "copy": "Yapılandırmayı kopyala",
+        "previewEmpty": "Başlamak için bir girdi ekleyin.",
+        "backControls": "Kontrollere dön",
+        "switchGroup": "Grubu değiştir",
+        "moveFocus": "Odağı taşı",
+        "helpIntro": "Başlamanıza yardımcı olacak kısa yanıtlar.",
+        "configIntro": "Girdileri kontrol edip dosyayı kopyalayın veya indirin.",
+        "captureTitle": "{action} için bir tuşa basın",
+        "cancelCapture": "Yakalamayı iptal et",
+        "keepEditing": "Düzenlemeye devam et",
+        "discard": "Değişiklikleri sil",
+        "faq0Question": "Nasıl tuş atarım?",
+        "faq0Answer": "Bir grup seçip Girdi ekle düğmesine basın. Yakala veya listeyi kullanın. Bir eyleme birden fazla girdi atanabilir.",
+        "faq1Question": "INI dosyasını nereye koyarım?",
+        "faq1Answer": "anyps5-input.ini dosyasını oluşturulan oyun yürütülebilir dosyasının yanına koyun. Başka yol için ANYPS5_INPUT_CONFIG kullanın.",
+        "faq2Question": "Neden bir tuş yakalanmıyor?",
+        "faq2Answer": "Tarayıcı veya sistem kısayolu engelleyebilir. Listeden seçin. Escape yakalamayı iptal eder; Escape tuşunu listeden atayın.",
+        "faq3Question": "Değişiklikler otomatik kaydedilir mi?",
+        "faq3Answer": "Değişiklikler bellekte kalır: yenilemeden önce kopyalayın veya indirin. Yalnızca dil kaydedilir. Ayarlanmayan eylemler varsayılanlarını korur.",
+        "searchOptions": "Seçenek ara",
+        "noOptions": "Eşleşen seçenek yok."
+    },
+    "zh-Hans": {
+        "controls": "控制",
+        "configuration": "配置",
+        "help": "帮助",
+        "settings": "设置",
+        "language": "语言",
+        "close": "关闭",
+        "eyebrow": "配件 / 自定义控制",
+        "intro": "选择一个控制，然后分配键盘或鼠标输入。",
+        "search": "搜索控制",
+        "import": "导入 INI",
+        "reset": "重置",
+        "group0": "主要按钮",
+        "group1": "肩部按钮",
+        "group2": "方向键",
+        "group3": "左摇杆",
+        "group4": "右摇杆",
+        "group5": "触摸和工具",
+        "select": "选择…",
+        "add": "+ 添加输入",
+        "capture": "录入",
+        "remove": "移除",
+        "builtin": "默认：{inputs}",
+        "custom": "自定义输入会替换默认输入。",
+        "noResults": "没有找到匹配的控制。",
+        "download": "下载 INI",
+        "copy": "复制配置",
+        "previewEmpty": "添加输入以开始。",
+        "backControls": "返回控制",
+        "switchGroup": "切换分组",
+        "moveFocus": "移动焦点",
+        "helpIntro": "帮助您入门的简短解答。",
+        "configIntro": "检查输入，然后复制或下载文件。",
+        "captureTitle": "为 {action} 按下一个键",
+        "cancelCapture": "取消录入",
+        "keepEditing": "继续编辑",
+        "discard": "放弃更改",
+        "faq0Question": "如何分配按键？",
+        "faq0Answer": "选择分组和添加输入，然后使用录入或列表。同一操作可以使用多个输入。",
+        "faq1Question": "INI 文件放在哪里？",
+        "faq1Answer": "将 anyps5-input.ini 放在生成的游戏可执行文件旁。其他位置可使用 ANYPS5_INPUT_CONFIG 指定路径。",
+        "faq2Question": "为什么无法录入某个键？",
+        "faq2Answer": "浏览器或系统快捷键可能会拦截它。请从列表选择。Escape 会取消录入；要分配 Escape，请使用列表。",
+        "faq3Question": "修改会自动保存吗？",
+        "faq3Answer": "输入修改只保留在内存中，刷新前请复制或下载。浏览器只保存语言选择。未配置的操作保留默认输入。",
+        "searchOptions": "搜索选项",
+        "noOptions": "没有匹配选项。"
+    },
+    "ja": {
+        "controls": "操作",
+        "configuration": "構成",
+        "help": "ヘルプ",
+        "settings": "設定",
+        "language": "言語",
+        "close": "閉じる",
+        "eyebrow": "アクセサリー / 操作のカスタマイズ",
+        "intro": "操作を選び、キーボードやマウスの入力を割り当てます。",
+        "search": "操作を検索",
+        "import": "INI を読み込む",
+        "reset": "リセット",
+        "group0": "メインボタン",
+        "group1": "ショルダーボタン",
+        "group2": "方向キー",
+        "group3": "左スティック",
+        "group4": "右スティック",
+        "group5": "タッチとツール",
+        "select": "選択…",
+        "add": "+ 入力を追加",
+        "capture": "記録",
+        "remove": "削除",
+        "builtin": "初期設定：{inputs}",
+        "custom": "カスタム入力は初期設定を置き換えます。",
+        "noResults": "一致する操作がありません。",
+        "download": "INI をダウンロード",
+        "copy": "構成をコピー",
+        "previewEmpty": "入力を追加して開始します。",
+        "backControls": "操作に戻る",
+        "switchGroup": "グループを切り替え",
+        "moveFocus": "フォーカスを移動",
+        "helpIntro": "使い始めるための簡単な説明です。",
+        "configIntro": "入力を確認してファイルをコピーまたはダウンロードします。",
+        "captureTitle": "{action} のキーを押してください",
+        "cancelCapture": "記録をキャンセル",
+        "keepEditing": "編集を続ける",
+        "discard": "変更を破棄",
+        "faq0Question": "キーを割り当てるには？",
+        "faq0Answer": "グループと入力を追加を選び、記録または一覧を使います。同じ操作に複数の入力を割り当てられます。",
+        "faq1Question": "INI ファイルはどこに置きますか？",
+        "faq1Answer": "anyps5-input.ini を生成されたゲーム実行ファイルの隣に置きます。別の場所には ANYPS5_INPUT_CONFIG でパスを指定します。",
+        "faq2Question": "キーが記録されないのはなぜですか？",
+        "faq2Answer": "ブラウザーやシステムのショートカットが優先される場合があります。一覧から選んでください。Escape は記録をキャンセルするため、一覧から割り当てます。",
+        "faq3Question": "変更は自動保存されますか？",
+        "faq3Answer": "入力の変更はメモリ内だけです。再読み込み前にコピーかダウンロードをしてください。言語のみ保存されます。未設定の操作は初期設定を使います。",
+        "searchOptions": "選択肢を検索",
+        "noOptions": "一致する選択肢がありません。"
+    },
+    "ko": {
+        "controls": "컨트롤",
+        "configuration": "구성",
+        "help": "도움말",
+        "settings": "설정",
+        "language": "언어",
+        "close": "닫기",
+        "eyebrow": "액세서리 / 컨트롤 맞춤 설정",
+        "intro": "컨트롤을 선택하고 키보드 또는 마우스 입력을 지정하세요.",
+        "search": "컨트롤 검색",
+        "import": "INI 가져오기",
+        "reset": "초기화",
+        "group0": "주요 버튼",
+        "group1": "상단 버튼",
+        "group2": "방향키",
+        "group3": "왼쪽 스틱",
+        "group4": "오른쪽 스틱",
+        "group5": "터치 및 도구",
+        "select": "선택…",
+        "add": "+ 입력 추가",
+        "capture": "기록",
+        "remove": "제거",
+        "builtin": "기본값: {inputs}",
+        "custom": "사용자 입력이 기본 입력을 대체합니다.",
+        "noResults": "일치하는 컨트롤이 없습니다.",
+        "download": "INI 다운로드",
+        "copy": "구성 복사",
+        "previewEmpty": "입력을 추가하여 시작하세요.",
+        "backControls": "컨트롤로 돌아가기",
+        "switchGroup": "그룹 전환",
+        "moveFocus": "포커스 이동",
+        "helpIntro": "시작을 돕는 간단한 답변입니다.",
+        "configIntro": "입력을 확인하고 파일을 복사하거나 다운로드하세요.",
+        "captureTitle": "{action}에 사용할 키를 누르세요",
+        "cancelCapture": "기록 취소",
+        "keepEditing": "계속 편집",
+        "discard": "변경 사항 삭제",
+        "faq0Question": "키는 어떻게 지정하나요?",
+        "faq0Answer": "그룹과 입력 추가를 선택한 뒤 기록 또는 목록을 사용하세요. 같은 동작에 여러 입력을 지정할 수 있습니다.",
+        "faq1Question": "INI 파일은 어디에 두나요?",
+        "faq1Answer": "생성된 게임 실행 파일 옆에 anyps5-input.ini를 두세요. 다른 경로는 ANYPS5_INPUT_CONFIG로 지정하세요.",
+        "faq2Question": "키가 기록되지 않는 이유는 무엇인가요?",
+        "faq2Answer": "브라우저나 시스템 단축키가 가로챌 수 있습니다. 목록에서 선택하세요. Escape는 기록을 취소하므로 목록에서 지정하세요.",
+        "faq3Question": "변경 사항이 자동 저장되나요?",
+        "faq3Answer": "입력 변경은 메모리에만 있습니다. 새로고침 전에 복사하거나 다운로드하세요. 언어 선택만 저장됩니다. 설정하지 않은 동작은 기본값을 유지합니다.",
+        "searchOptions": "옵션 검색",
+        "noOptions": "일치하는 옵션이 없습니다."
+    },
+    "hi": {
+        "controls": "नियंत्रण",
+        "configuration": "कॉन्फ़िगरेशन",
+        "help": "मदद",
+        "settings": "सेटिंग्स",
+        "language": "भाषा",
+        "close": "बंद करें",
+        "eyebrow": "सहायक उपकरण / कस्टम नियंत्रण",
+        "intro": "नियंत्रण चुनें और कीबोर्ड या माउस इनपुट जोड़ें।",
+        "search": "नियंत्रण खोजें",
+        "import": "INI आयात करें",
+        "reset": "रीसेट",
+        "group0": "मुख्य बटन",
+        "group1": "ऊपरी बटन",
+        "group2": "दिशा बटन",
+        "group3": "बायाँ स्टिक",
+        "group4": "दायाँ स्टिक",
+        "group5": "टच और उपकरण",
+        "select": "चुनें…",
+        "add": "+ इनपुट जोड़ें",
+        "capture": "रिकॉर्ड करें",
+        "remove": "हटाएँ",
+        "builtin": "डिफ़ॉल्ट: {inputs}",
+        "custom": "कस्टम इनपुट डिफ़ॉल्ट इनपुट की जगह लेते हैं।",
+        "noResults": "कोई नियंत्रण नहीं मिला।",
+        "download": "INI डाउनलोड करें",
+        "copy": "कॉन्फ़िगरेशन कॉपी करें",
+        "previewEmpty": "शुरू करने के लिए इनपुट जोड़ें।",
+        "backControls": "नियंत्रण पर वापस जाएँ",
+        "switchGroup": "समूह बदलें",
+        "moveFocus": "फ़ोकस बदलें",
+        "helpIntro": "शुरू करने के लिए कुछ आसान जवाब।",
+        "configIntro": "इनपुट जाँचें और फ़ाइल कॉपी या डाउनलोड करें।",
+        "captureTitle": "{action} के लिए कोई कुंजी दबाएँ",
+        "cancelCapture": "रिकॉर्डिंग रद्द करें",
+        "keepEditing": "संपादन जारी रखें",
+        "discard": "बदलाव हटाएँ",
+        "faq0Question": "कुंजी कैसे जोड़ूँ?",
+        "faq0Answer": "समूह और इनपुट जोड़ें चुनें, फिर रिकॉर्ड करें या सूची का उपयोग करें। एक काम के लिए कई इनपुट जोड़ सकते हैं।",
+        "faq1Question": "INI फ़ाइल कहाँ रखें?",
+        "faq1Answer": "anyps5-input.ini को बनाए गए गेम प्रोग्राम के पास रखें। दूसरे स्थान के लिए ANYPS5_INPUT_CONFIG में पथ दें।",
+        "faq2Question": "कुंजी रिकॉर्ड क्यों नहीं होती?",
+        "faq2Answer": "ब्राउज़र या सिस्टम का शॉर्टकट उसे रोक सकता है। सूची से चुनें। Escape रिकॉर्डिंग रद्द करता है; इसे सूची से जोड़ें।",
+        "faq3Question": "क्या बदलाव अपने आप सेव होते हैं?",
+        "faq3Answer": "बदलाव केवल मेमोरी में रहते हैं: रीलोड से पहले कॉपी या डाउनलोड करें। केवल भाषा सेव होती है। बिना बदले काम अपने डिफ़ॉल्ट रखते हैं।",
+        "searchOptions": "विकल्प खोजें",
+        "noOptions": "कोई विकल्प नहीं मिला।"
+    },
+    "bn": {
+        "controls": "নিয়ন্ত্রণ",
+        "configuration": "কনফিগারেশন",
+        "help": "সাহায্য",
+        "settings": "সেটিংস",
+        "language": "ভাষা",
+        "close": "বন্ধ করুন",
+        "eyebrow": "আনুষঙ্গিক / নিজস্ব নিয়ন্ত্রণ",
+        "intro": "একটি নিয়ন্ত্রণ বেছে কিবোর্ড বা মাউস ইনপুট দিন।",
+        "search": "নিয়ন্ত্রণ খুঁজুন",
+        "import": "INI আমদানি",
+        "reset": "রিসেট",
+        "group0": "প্রধান বোতাম",
+        "group1": "ওপরের বোতাম",
+        "group2": "দিক বোতাম",
+        "group3": "বাম স্টিক",
+        "group4": "ডান স্টিক",
+        "group5": "টাচ ও সরঞ্জাম",
+        "select": "বাছুন…",
+        "add": "+ ইনপুট যোগ",
+        "capture": "রেকর্ড",
+        "remove": "সরান",
+        "builtin": "ডিফল্ট: {inputs}",
+        "custom": "নিজস্ব ইনপুট ডিফল্ট ইনপুটের বদলে কাজ করে।",
+        "noResults": "কোনো নিয়ন্ত্রণ পাওয়া যায়নি।",
+        "download": "INI ডাউনলোড",
+        "copy": "কনফিগারেশন কপি",
+        "previewEmpty": "শুরু করতে একটি ইনপুট যোগ করুন।",
+        "backControls": "নিয়ন্ত্রণে ফিরে যান",
+        "switchGroup": "গ্রুপ বদলান",
+        "moveFocus": "ফোকাস সরান",
+        "helpIntro": "শুরু করার জন্য কিছু সহজ উত্তর।",
+        "configIntro": "ইনপুট দেখে ফাইল কপি বা ডাউনলোড করুন।",
+        "captureTitle": "{action}-এর জন্য একটি কী চাপুন",
+        "cancelCapture": "রেকর্ড বাতিল",
+        "keepEditing": "সম্পাদনা চালান",
+        "discard": "পরিবর্তন বাদ দিন",
+        "faq0Question": "কী কীভাবে যোগ করব?",
+        "faq0Answer": "গ্রুপ ও ইনপুট যোগ বেছে রেকর্ড বা তালিকা ব্যবহার করুন। এক কাজের জন্য একাধিক ইনপুট দিতে পারেন।",
+        "faq1Question": "INI ফাইল কোথায় রাখব?",
+        "faq1Answer": "তৈরি হওয়া গেম চালানোর ফাইলের পাশে anyps5-input.ini রাখুন। অন্য পথের জন্য ANYPS5_INPUT_CONFIG ব্যবহার করুন।",
+        "faq2Question": "কোনো কী রেকর্ড হচ্ছে না কেন?",
+        "faq2Answer": "ব্রাউজার বা সিস্টেম শর্টকাট সেটি আটকাতে পারে। তালিকা থেকে বাছুন। Escape রেকর্ড বাতিল করে; তালিকা থেকে যোগ করুন।",
+        "faq3Question": "পরিবর্তন কি নিজে থেকে সেভ হয়?",
+        "faq3Answer": "পরিবর্তন শুধু মেমোরিতে থাকে: রিলোডের আগে কপি বা ডাউনলোড করুন। শুধু ভাষা সেভ হয়। না বদলানো কাজগুলো ডিফল্ট রাখে।",
+        "searchOptions": "বিকল্প খুঁজুন",
+        "noOptions": "কোনো বিকল্প মেলেনি।"
+    },
+    "ur": {
+        "controls": "کنٹرول",
+        "configuration": "ترتیب",
+        "help": "مدد",
+        "settings": "سیٹنگز",
+        "language": "زبان",
+        "close": "بند کریں",
+        "eyebrow": "لوازمات / حسب ضرورت کنٹرول",
+        "intro": "کنٹرول منتخب کرکے کی بورڈ یا ماؤس ان پٹ مقرر کریں۔",
+        "search": "کنٹرول تلاش کریں",
+        "import": "INI درآمد کریں",
+        "reset": "ری سیٹ",
+        "group0": "بنیادی بٹن",
+        "group1": "اوپری بٹن",
+        "group2": "سمت کے بٹن",
+        "group3": "بائیں اسٹک",
+        "group4": "دائیں اسٹک",
+        "group5": "ٹچ اور اوزار",
+        "select": "منتخب کریں…",
+        "add": "+ ان پٹ شامل کریں",
+        "capture": "ریکارڈ کریں",
+        "remove": "ہٹائیں",
+        "builtin": "پہلے سے طے شدہ: {inputs}",
+        "custom": "حسب ضرورت ان پٹ پہلے سے طے شدہ ان پٹ کی جگہ لیتے ہیں۔",
+        "noResults": "کوئی کنٹرول نہیں ملا۔",
+        "download": "INI ڈاؤن لوڈ کریں",
+        "copy": "ترتیب کاپی کریں",
+        "previewEmpty": "شروع کرنے کے لیے ان پٹ شامل کریں۔",
+        "backControls": "کنٹرول پر واپس جائیں",
+        "switchGroup": "گروپ بدلیں",
+        "moveFocus": "فوکس بدلیں",
+        "helpIntro": "شروع کرنے کے لیے مختصر جوابات۔",
+        "configIntro": "ان پٹ دیکھ کر فائل کاپی یا ڈاؤن لوڈ کریں۔",
+        "captureTitle": "{action} کے لیے کوئی کلید دبائیں",
+        "cancelCapture": "ریکارڈنگ منسوخ کریں",
+        "keepEditing": "ترمیم جاری رکھیں",
+        "discard": "تبدیلیاں چھوڑ دیں",
+        "faq0Question": "کلید کیسے مقرر کروں؟",
+        "faq0Answer": "گروپ اور ان پٹ شامل کریں منتخب کریں، پھر ریکارڈ یا فہرست استعمال کریں۔ ایک عمل کے لیے کئی ان پٹ رکھ سکتے ہیں۔",
+        "faq1Question": "INI فائل کہاں رکھوں؟",
+        "faq1Answer": "anyps5-input.ini کو بنائی گئی گیم کی قابل اجرا فائل کے ساتھ رکھیں۔ دوسرے راستے کے لیے ANYPS5_INPUT_CONFIG استعمال کریں۔",
+        "faq2Question": "کلید ریکارڈ کیوں نہیں ہوتی؟",
+        "faq2Answer": "براؤزر یا نظام کا شارٹ کٹ روک سکتا ہے۔ فہرست سے منتخب کریں۔ Escape ریکارڈنگ منسوخ کرتا ہے؛ اسے فہرست سے مقرر کریں۔",
+        "faq3Question": "کیا تبدیلیاں خود محفوظ ہوتی ہیں؟",
+        "faq3Answer": "تبدیلیاں صرف میموری میں رہتی ہیں: ری لوڈ سے پہلے کاپی یا ڈاؤن لوڈ کریں۔ صرف زبان محفوظ ہوتی ہے۔ غیر تبدیل شدہ اعمال اپنی طے شدہ ترتیب رکھتے ہیں۔",
+        "searchOptions": "اختیارات تلاش کریں",
+        "noOptions": "کوئی اختیار نہیں ملا۔"
+    },
+    "fa": {
+        "controls": "کنترل‌ها",
+        "configuration": "پیکربندی",
+        "help": "راهنما",
+        "settings": "تنظیمات",
+        "language": "زبان",
+        "close": "بستن",
+        "eyebrow": "لوازم جانبی / کنترل سفارشی",
+        "intro": "یک کنترل را انتخاب کنید و ورودی صفحه‌کلید یا ماوس بدهید.",
+        "search": "جستجوی کنترل",
+        "import": "وارد کردن INI",
+        "reset": "بازنشانی",
+        "group0": "دکمه‌های اصلی",
+        "group1": "دکمه‌های بالایی",
+        "group2": "دکمه‌های جهت",
+        "group3": "دسته چپ",
+        "group4": "دسته راست",
+        "group5": "لمس و ابزارها",
+        "select": "انتخاب…",
+        "add": "+ افزودن ورودی",
+        "capture": "ثبت",
+        "remove": "حذف",
+        "builtin": "پیش‌فرض: {inputs}",
+        "custom": "ورودی سفارشی جای ورودی پیش‌فرض را می‌گیرد.",
+        "noResults": "کنترلی پیدا نشد.",
+        "download": "دانلود INI",
+        "copy": "کپی پیکربندی",
+        "previewEmpty": "برای شروع یک ورودی اضافه کنید.",
+        "backControls": "بازگشت به کنترل‌ها",
+        "switchGroup": "تغییر گروه",
+        "moveFocus": "جابجایی تمرکز",
+        "helpIntro": "پاسخ‌های کوتاه برای شروع.",
+        "configIntro": "ورودی‌ها را بررسی و فایل را کپی یا دانلود کنید.",
+        "captureTitle": "برای {action} کلیدی فشار دهید",
+        "cancelCapture": "لغو ثبت",
+        "keepEditing": "ادامه ویرایش",
+        "discard": "کنار گذاشتن تغییرات",
+        "faq0Question": "چطور کلید تعیین کنم؟",
+        "faq0Answer": "گروه و افزودن ورودی را انتخاب کنید، سپس ثبت یا فهرست را به کار ببرید. یک عمل می‌تواند چند ورودی داشته باشد.",
+        "faq1Question": "فایل INI را کجا بگذارم؟",
+        "faq1Answer": "anyps5-input.ini را کنار فایل اجرایی ساخته‌شده بازی قرار دهید. برای مسیر دیگر از ANYPS5_INPUT_CONFIG استفاده کنید.",
+        "faq2Question": "چرا کلید ثبت نمی‌شود؟",
+        "faq2Answer": "میانبر مرورگر یا سیستم ممکن است آن را بگیرد. از فهرست انتخاب کنید. Escape ثبت را لغو می‌کند؛ آن را از فهرست تعیین کنید.",
+        "faq3Question": "آیا تغییرات خودکار ذخیره می‌شوند؟",
+        "faq3Answer": "تغییرات فقط در حافظه‌اند: قبل از بارگذاری دوباره کپی یا دانلود کنید. تنها زبان ذخیره می‌شود. اعمال تنظیم‌نشده پیش‌فرض خود را حفظ می‌کنند.",
+        "searchOptions": "جستجوی گزینه‌ها",
+        "noOptions": "گزینه‌ای پیدا نشد."
+    },
+    "id": {
+        "controls": "Kontrol",
+        "configuration": "Konfigurasi",
+        "help": "Bantuan",
+        "settings": "Pengaturan",
+        "language": "Bahasa",
+        "close": "Tutup",
+        "eyebrow": "Aksesori / Kontrol khusus",
+        "intro": "Pilih kontrol, lalu tetapkan input keyboard atau mouse.",
+        "search": "Cari kontrol",
+        "import": "Impor INI",
+        "reset": "Atur ulang",
+        "group0": "Tombol utama",
+        "group1": "Tombol atas",
+        "group2": "Tombol arah",
+        "group3": "Stik kiri",
+        "group4": "Stik kanan",
+        "group5": "Sentuh dan alat",
+        "select": "Pilih…",
+        "add": "+ Tambah input",
+        "capture": "Rekam",
+        "remove": "Hapus",
+        "builtin": "Bawaan: {inputs}",
+        "custom": "Input khusus menggantikan input bawaan.",
+        "noResults": "Kontrol tidak ditemukan.",
+        "download": "Unduh INI",
+        "copy": "Salin konfigurasi",
+        "previewEmpty": "Tambahkan input untuk memulai.",
+        "backControls": "Kembali ke kontrol",
+        "switchGroup": "Ganti grup",
+        "moveFocus": "Pindahkan fokus",
+        "helpIntro": "Jawaban singkat untuk memulai.",
+        "configIntro": "Periksa input, lalu salin atau unduh berkas.",
+        "captureTitle": "Tekan tombol untuk {action}",
+        "cancelCapture": "Batalkan rekaman",
+        "keepEditing": "Lanjutkan mengedit",
+        "discard": "Buang perubahan",
+        "faq0Question": "Bagaimana menetapkan tombol?",
+        "faq0Answer": "Pilih grup dan Tambah input, lalu Rekam atau gunakan daftar. Satu aksi dapat memiliki beberapa input.",
+        "faq1Question": "Di mana berkas INI diletakkan?",
+        "faq1Answer": "Letakkan anyps5-input.ini di samping berkas program game yang dihasilkan. Untuk lokasi lain, gunakan ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Mengapa tombol tidak direkam?",
+        "faq2Answer": "Pintasan browser atau sistem mungkin menangkapnya. Pilih dari daftar. Escape membatalkan rekaman; tetapkan Escape melalui daftar.",
+        "faq3Question": "Apakah perubahan disimpan otomatis?",
+        "faq3Answer": "Perubahan hanya di memori: salin atau unduh sebelum memuat ulang. Hanya bahasa yang disimpan. Aksi yang tidak diatur tetap memakai bawaan.",
+        "searchOptions": "Cari opsi",
+        "noOptions": "Tidak ada opsi yang cocok."
+    },
+    "vi": {
+        "controls": "Điều khiển",
+        "configuration": "Cấu hình",
+        "help": "Trợ giúp",
+        "settings": "Cài đặt",
+        "language": "Ngôn ngữ",
+        "close": "Đóng",
+        "eyebrow": "Phụ kiện / Điều khiển tùy chỉnh",
+        "intro": "Chọn điều khiển rồi gán phím hoặc nút chuột.",
+        "search": "Tìm điều khiển",
+        "import": "Nhập INI",
+        "reset": "Đặt lại",
+        "group0": "Nút chính",
+        "group1": "Nút phía trên",
+        "group2": "Phím hướng",
+        "group3": "Cần trái",
+        "group4": "Cần phải",
+        "group5": "Cảm ứng và công cụ",
+        "select": "Chọn…",
+        "add": "+ Thêm đầu vào",
+        "capture": "Ghi phím",
+        "remove": "Xóa",
+        "builtin": "Mặc định: {inputs}",
+        "custom": "Đầu vào tùy chỉnh thay thế đầu vào mặc định.",
+        "noResults": "Không tìm thấy điều khiển.",
+        "download": "Tải INI",
+        "copy": "Sao chép cấu hình",
+        "previewEmpty": "Thêm đầu vào để bắt đầu.",
+        "backControls": "Trở về điều khiển",
+        "switchGroup": "Đổi nhóm",
+        "moveFocus": "Di chuyển tiêu điểm",
+        "helpIntro": "Câu trả lời nhanh để bắt đầu.",
+        "configIntro": "Kiểm tra đầu vào rồi sao chép hoặc tải tệp.",
+        "captureTitle": "Nhấn phím cho {action}",
+        "cancelCapture": "Hủy ghi phím",
+        "keepEditing": "Tiếp tục chỉnh sửa",
+        "discard": "Bỏ thay đổi",
+        "faq0Question": "Làm sao gán phím?",
+        "faq0Answer": "Chọn nhóm và Thêm đầu vào, rồi dùng Ghi phím hoặc danh sách. Một hành động có thể có nhiều đầu vào.",
+        "faq1Question": "Đặt tệp INI ở đâu?",
+        "faq1Answer": "Đặt anyps5-input.ini cạnh tệp chạy trò chơi được tạo. Dùng ANYPS5_INPUT_CONFIG cho đường dẫn khác.",
+        "faq2Question": "Tại sao không ghi được phím?",
+        "faq2Answer": "Trình duyệt hoặc hệ thống có thể chặn phím tắt. Chọn từ danh sách. Escape hủy ghi phím; hãy gán Escape từ danh sách.",
+        "faq3Question": "Thay đổi có tự lưu không?",
+        "faq3Answer": "Thay đổi chỉ ở trong bộ nhớ: sao chép hoặc tải xuống trước khi tải lại. Chỉ ngôn ngữ được lưu. Hành động chưa cấu hình giữ mặc định.",
+        "searchOptions": "Tìm tùy chọn",
+        "noOptions": "Không có tùy chọn phù hợp."
+    },
+    "th": {
+        "controls": "การควบคุม",
+        "configuration": "การกำหนดค่า",
+        "help": "ช่วยเหลือ",
+        "settings": "การตั้งค่า",
+        "language": "ภาษา",
+        "close": "ปิด",
+        "eyebrow": "อุปกรณ์เสริม / ปรับแต่งการควบคุม",
+        "intro": "เลือกการควบคุม แล้วกำหนดปุ่มแป้นพิมพ์หรือเมาส์",
+        "search": "ค้นหาการควบคุม",
+        "import": "นำเข้า INI",
+        "reset": "รีเซ็ต",
+        "group0": "ปุ่มหลัก",
+        "group1": "ปุ่มด้านบน",
+        "group2": "ปุ่มทิศทาง",
+        "group3": "สติ๊กซ้าย",
+        "group4": "สติ๊กขวา",
+        "group5": "สัมผัสและเครื่องมือ",
+        "select": "เลือก…",
+        "add": "+ เพิ่มอินพุต",
+        "capture": "บันทึกปุ่ม",
+        "remove": "ลบ",
+        "builtin": "ค่าเริ่มต้น: {inputs}",
+        "custom": "อินพุตที่กำหนดเองจะแทนที่ค่าเริ่มต้น",
+        "noResults": "ไม่พบการควบคุม",
+        "download": "ดาวน์โหลด INI",
+        "copy": "คัดลอกการกำหนดค่า",
+        "previewEmpty": "เพิ่มอินพุตเพื่อเริ่มต้น",
+        "backControls": "กลับไปการควบคุม",
+        "switchGroup": "เปลี่ยนกลุ่ม",
+        "moveFocus": "ย้ายโฟกัส",
+        "helpIntro": "คำตอบสั้นๆ เพื่อช่วยเริ่มต้น",
+        "configIntro": "ตรวจสอบอินพุต แล้วคัดลอกหรือดาวน์โหลดไฟล์",
+        "captureTitle": "กดปุ่มสำหรับ {action}",
+        "cancelCapture": "ยกเลิกการบันทึก",
+        "keepEditing": "แก้ไขต่อ",
+        "discard": "ทิ้งการเปลี่ยนแปลง",
+        "faq0Question": "กำหนดปุ่มอย่างไร?",
+        "faq0Answer": "เลือกกลุ่มและเพิ่มอินพุต แล้วใช้บันทึกปุ่มหรือรายการ หนึ่งการกระทำมีได้หลายอินพุต",
+        "faq1Question": "วางไฟล์ INI ที่ไหน?",
+        "faq1Answer": "วาง anyps5-input.ini ข้างไฟล์โปรแกรมเกมที่สร้างขึ้น ใช้ ANYPS5_INPUT_CONFIG สำหรับตำแหน่งอื่น",
+        "faq2Question": "ทำไมบางปุ่มจึงบันทึกไม่ได้?",
+        "faq2Answer": "ทางลัดของเบราว์เซอร์หรือระบบอาจดักปุ่มไว้ เลือกจากรายการแทน Escape ยกเลิกการบันทึก จึงต้องกำหนดจากรายการ",
+        "faq3Question": "บันทึกการเปลี่ยนแปลงอัตโนมัติไหม?",
+        "faq3Answer": "การเปลี่ยนแปลงอยู่ในหน่วยความจำเท่านั้น คัดลอกหรือดาวน์โหลดก่อนโหลดใหม่ บันทึกเฉพาะภาษา การกระทำที่ยังไม่ตั้งค่าจะใช้ค่าเริ่มต้น",
+        "searchOptions": "ค้นหาตัวเลือก",
+        "noOptions": "ไม่พบตัวเลือกที่ตรงกัน"
+    },
+    "sw": {
+        "controls": "Vidhibiti",
+        "configuration": "Usanidi",
+        "help": "Msaada",
+        "settings": "Mipangilio",
+        "language": "Lugha",
+        "close": "Funga",
+        "eyebrow": "Vifaa / Vidhibiti maalum",
+        "intro": "Chagua kidhibiti kisha weka ingizo la kibodi au kipanya.",
+        "search": "Tafuta vidhibiti",
+        "import": "Ingiza INI",
+        "reset": "Weka upya",
+        "group0": "Vibonye vikuu",
+        "group1": "Vibonye vya juu",
+        "group2": "Vibonye vya mwelekeo",
+        "group3": "Kijiti cha kushoto",
+        "group4": "Kijiti cha kulia",
+        "group5": "Mguso na zana",
+        "select": "Chagua…",
+        "add": "+ Ongeza ingizo",
+        "capture": "Rekodi",
+        "remove": "Ondoa",
+        "builtin": "Chaguo-msingi: {inputs}",
+        "custom": "Ingizo maalum linachukua nafasi ya ingizo la kawaida.",
+        "noResults": "Hakuna vidhibiti vilivyopatikana.",
+        "download": "Pakua INI",
+        "copy": "Nakili usanidi",
+        "previewEmpty": "Ongeza ingizo ili kuanza.",
+        "backControls": "Rudi kwenye vidhibiti",
+        "switchGroup": "Badili kundi",
+        "moveFocus": "Hamisha fokasi",
+        "helpIntro": "Majibu mafupi ya kukusaidia kuanza.",
+        "configIntro": "Kagua ingizo kisha nakili au pakua faili.",
+        "captureTitle": "Bonyeza kitufe kwa {action}",
+        "cancelCapture": "Ghairi kurekodi",
+        "keepEditing": "Endelea kuhariri",
+        "discard": "Tupa mabadiliko",
+        "faq0Question": "Ninawekaje kitufe?",
+        "faq0Answer": "Chagua kundi na Ongeza ingizo, kisha Rekodi au tumia orodha. Kitendo kimoja kinaweza kuwa na ingizo nyingi.",
+        "faq1Question": "Ninaweka wapi faili la INI?",
+        "faq1Answer": "Weka anyps5-input.ini karibu na faili la programu ya mchezo lililozalishwa. Tumia ANYPS5_INPUT_CONFIG kwa njia nyingine.",
+        "faq2Question": "Kwa nini kitufe hakirekodiwi?",
+        "faq2Answer": "Njia ya mkato ya kivinjari au mfumo inaweza kukizuia. Chagua kwenye orodha. Escape hughairi kurekodi; kiweke kupitia orodha.",
+        "faq3Question": "Mabadiliko huhifadhiwa kiotomatiki?",
+        "faq3Answer": "Mabadiliko hubaki kwenye kumbukumbu: nakili au pakua kabla ya kupakia upya. Lugha pekee huhifadhiwa. Vitendo visivyosanidiwa hutumia chaguo-msingi.",
+        "searchOptions": "Tafuta chaguo",
+        "noOptions": "Hakuna chaguo linalolingana."
+    },
+    "nl": {
+        "controls": "Bediening",
+        "configuration": "Configuratie",
+        "help": "Hulp",
+        "settings": "Instellingen",
+        "language": "Taal",
+        "close": "Sluiten",
+        "eyebrow": "Accessoires / Eigen bediening",
+        "intro": "Kies een actie en wijs toetsenbord- of muisinvoer toe.",
+        "search": "Bediening zoeken",
+        "import": "INI importeren",
+        "reset": "Herstellen",
+        "group0": "Actieknoppen",
+        "group1": "Schouderknoppen",
+        "group2": "Richtingsknoppen",
+        "group3": "Linker stick",
+        "group4": "Rechter stick",
+        "group5": "Aanraakvlak en hulpmiddelen",
+        "select": "Selecteren…",
+        "add": "+ Invoer toevoegen",
+        "capture": "Vastleggen",
+        "remove": "Verwijderen",
+        "builtin": "Standaard: {inputs}",
+        "custom": "Eigen invoer vervangt de standaardinvoer.",
+        "noResults": "Geen passende bediening gevonden.",
+        "download": "INI downloaden",
+        "copy": "Configuratie kopiëren",
+        "previewEmpty": "Voeg invoer toe om te beginnen.",
+        "backControls": "Terug naar bediening",
+        "switchGroup": "Groep wisselen",
+        "moveFocus": "Focus verplaatsen",
+        "helpIntro": "Korte antwoorden om te beginnen.",
+        "configIntro": "Controleer de invoer en kopieer of download het bestand.",
+        "captureTitle": "Druk op een toets voor {action}",
+        "cancelCapture": "Vastleggen annuleren",
+        "keepEditing": "Verder bewerken",
+        "discard": "Wijzigingen weggooien",
+        "faq0Question": "Hoe wijs ik een toets toe?",
+        "faq0Answer": "Kies een groep en Invoer toevoegen, dan Vastleggen of de lijst. Eén actie kan meerdere invoeren hebben.",
+        "faq1Question": "Waar plaats ik het INI-bestand?",
+        "faq1Answer": "Zet anyps5-input.ini naast het gegenereerde spelprogramma. Gebruik ANYPS5_INPUT_CONFIG voor een ander pad.",
+        "faq2Question": "Waarom wordt een toets niet vastgelegd?",
+        "faq2Answer": "Een browser- of systeemsneltoets kan hem onderscheppen. Kies uit de lijst. Escape annuleert vastleggen; wijs Escape via de lijst toe.",
+        "faq3Question": "Worden wijzigingen automatisch opgeslagen?",
+        "faq3Answer": "Wijzigingen staan alleen in het geheugen: kopieer of download vóór herladen. Alleen de taal wordt opgeslagen. Ongewijzigde acties houden hun standaardwaarden.",
+        "searchOptions": "Opties zoeken",
+        "noOptions": "Geen passende opties."
+    },
+    "pl": {
+        "controls": "Sterowanie",
+        "configuration": "Konfiguracja",
+        "help": "Pomoc",
+        "settings": "Ustawienia",
+        "language": "Język",
+        "close": "Zamknij",
+        "eyebrow": "Akcesoria / Własne sterowanie",
+        "intro": "Wybierz akcję i przypisz klawisz lub przycisk myszy.",
+        "search": "Szukaj sterowania",
+        "import": "Importuj INI",
+        "reset": "Resetuj",
+        "group0": "Główne przyciski",
+        "group1": "Górne przyciski",
+        "group2": "Przyciski kierunkowe",
+        "group3": "Lewy drążek",
+        "group4": "Prawy drążek",
+        "group5": "Dotyk i narzędzia",
+        "select": "Wybierz…",
+        "add": "+ Dodaj wejście",
+        "capture": "Zarejestruj",
+        "remove": "Usuń",
+        "builtin": "Domyślne: {inputs}",
+        "custom": "Własne wejścia zastępują domyślne.",
+        "noResults": "Nie znaleziono pasującej akcji.",
+        "download": "Pobierz INI",
+        "copy": "Kopiuj konfigurację",
+        "previewEmpty": "Dodaj wejście, aby zacząć.",
+        "backControls": "Wróć do sterowania",
+        "switchGroup": "Zmień grupę",
+        "moveFocus": "Przenieś fokus",
+        "helpIntro": "Krótkie odpowiedzi na początek.",
+        "configIntro": "Sprawdź wejścia i skopiuj lub pobierz plik.",
+        "captureTitle": "Naciśnij klawisz dla {action}",
+        "cancelCapture": "Anuluj rejestrację",
+        "keepEditing": "Edytuj dalej",
+        "discard": "Odrzuć zmiany",
+        "faq0Question": "Jak przypisać klawisz?",
+        "faq0Answer": "Wybierz grupę i Dodaj wejście, potem Zarejestruj lub listę. Jedna akcja może mieć kilka wejść.",
+        "faq1Question": "Gdzie umieścić plik INI?",
+        "faq1Answer": "Umieść anyps5-input.ini obok wygenerowanego pliku wykonywalnego gry. Inny adres podaj w ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Dlaczego klawisz nie jest rejestrowany?",
+        "faq2Answer": "Skrót przeglądarki lub systemu może go przechwycić. Wybierz z listy. Escape anuluje rejestrację; przypisz go z listy.",
+        "faq3Question": "Czy zmiany zapisują się automatycznie?",
+        "faq3Answer": "Zmiany są tylko w pamięci: skopiuj lub pobierz przed odświeżeniem. Zapisywany jest tylko język. Nieustawione akcje zachowują wartości domyślne.",
+        "searchOptions": "Szukaj opcji",
+        "noOptions": "Brak pasujących opcji."
+    }
+};
+
+export function translate(locale, key, values = {}) {
+    const text = messages[locale]?.[key] ?? messages.en[key] ?? key;
+    return text.replace(/\{(\w+)\}/gu, (match, name) => String(values[name] ?? match));
+}
+
+export function diagnostic(locale, message) {
+    if (locale !== 'ar-EG') return message;
+    return message
+        .replace('Configuration must be a list of bindings.', 'الإعدادات لازم تكون قائمة روابط أزرار.')
+        .replace('Unknown or empty action.', 'الحركة مش معروفة أو فاضية.')
+        .replace('Input type must be KEY, MOUSE or WHEEL.', 'نوع الإدخال لازم يكون KEY أو MOUSE أو WHEEL.')
+        .replace(/(\w+) cannot use (\w+)\./gu, '$1 مينفعش يستخدم $2.')
+        .replace(/Unknown or empty (\w+) value\./gu, 'قيمة $1 مش معروفة أو فاضية.')
+        .replace('This SDL key name cannot be represented in the current INI comment syntax.', 'اسم الزرار ده مينفعش يتحفظ بالصيغة الحالية لملف INI.')
+        .replace(/duplicate (.+) will be omitted\./gu, 'الربط $1 متكرر وهيتحفظ مرة واحدة.')
+        .replace(' controls ', ' بيشغّل ')
+        .replaceAll(' (built-in)', ' (افتراضي)')
+        .replaceAll(' and ', ' و ')
+        .replace('Expected Action = TYPE:VALUE.', 'الصيغة المطلوبة: Action = TYPE:VALUE.')
+        .replace('Duplicate binding ignored.', 'الربط المتكرر تم تجاهله.')
+        .replace('This physical key cannot be captured in the current INI format. Select an SDL key from the list.', 'الزرار ده مينفعش يتسجل بالصيغة الحالية لملف INI. اختار زرار SDL من القائمة.')
+        .replace('Composition and dead keys are ambiguous. Select an SDL key from the list.', 'زرار تركيب الحروف مش واضح في التسجيل. اختار زرار SDL من القائمة.');
+}
+
+export function initialLocale(savedLocale) {
+    return locales.some(item => item.code === savedLocale) ? savedLocale : 'en';
+}
diff --git a/tools/input-mapper/index.html b/tools/input-mapper/index.html
new file mode 100644
index 0000000000..3b340b95e6
--- /dev/null
+++ b/tools/input-mapper/index.html
@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="color-scheme" content="dark">
+    <title>AnyPS5 · Input mapper</title>
+    <link rel="stylesheet" href="styles.css">
+    <script type="module" src="app.js"></script>
+</head>
+<body>
+    <div class="ambient" aria-hidden="true"><div class="ambient-glow"></div><div class="particles"></div><div class="particles distant"></div></div>
+    <a class="skip-link" href="#content" data-i18n="skip">Skip to content</a>
+    <header>
+        <a class="brand" href="https://github.com/boykopovar/AnyPS5">AnyPS5</a>
+        <nav class="system-nav" aria-label="Main navigation" data-i18n-label="mainNav"><a class="current" href="#controls" data-view="controls" data-i18n="controls">Controls</a><a href="#configuration" data-view="configuration" data-i18n="configuration">Configuration</a><a href="#help" data-view="help" data-i18n="help">Help</a></nav>
+        <div class="system-tools">
+            <button id="focus-search" class="icon-button" type="button" aria-label="Find an action" data-i18n-label="find"><span class="search-icon" aria-hidden="true"></span></button>
+            <button id="settings" class="icon-button" type="button" aria-label="Language" data-i18n-label="language"><span class="translation-icon" aria-hidden="true"><span>A</span><span>ع</span></span></button>
+            <time id="clock" aria-label="Local time" data-i18n-label="clock"></time>
+        </div>
+    </header>
+    <main id="content" tabindex="-1">
+        <nav id="categories" aria-label="Control groups" data-i18n-label="groups"></nav>
+        <div class="intro">
+            <p class="eyebrow" data-i18n="eyebrow">Accessories / Custom controls</p>
+            <h1 id="group-title">Face buttons</h1>
+            <p id="view-intro" data-i18n="intro">Choose a control, then assign your keyboard or mouse inputs.</p>
+        </div>
+        <div id="toolbar" class="toolbar">
+            <label class="search"><span class="sr-only" data-i18n="find">Find an action</span><input id="search" type="search" placeholder="Search controls" data-i18n-placeholder="search" autocomplete="off"></label>
+            <div class="tools">
+                <button id="import" type="button" data-i18n="import">Import INI</button>
+                <input id="file" type="file" accept=".ini,text/plain" hidden>
+                <button id="reset" type="button" data-i18n="reset">Reset</button>
+            </div>
+        </div>
+        <div id="mappings" tabindex="-1" aria-label="Controls" data-i18n-label="controls"></div>
+        <section id="configuration" class="configuration-panel" aria-label="Configuration output" data-i18n-label="output" tabindex="-1" hidden>
+                <div class="output-heading"><h2 data-i18n="configuration">Configuration</h2><span id="count" class="tag">0 / 31</span></div>
+                <label for="preview">anyps5-input.ini</label>
+                <textarea id="preview" readonly spellcheck="false" placeholder="Add a binding to begin." data-i18n-placeholder="previewEmpty" dir="ltr"></textarea>
+                <div class="export-actions">
+                    <button id="download" class="primary" type="button" data-i18n="download">Download INI</button>
+                    <button id="copy" type="button" data-i18n="copy">Copy configuration</button>
+                    <button id="back-controls" type="button" data-i18n="backControls">Back to controls</button>
+                </div>
+        </section>
+        <section id="help" tabindex="-1" aria-label="Help" data-i18n-label="help" hidden></section>
+        <div id="validation" aria-live="polite"></div>
+        <p id="status" role="status"></p>
+        <section id="import-report" hidden aria-label="Import diagnostics" tabindex="-1"></section>
+    </main>
+    <footer><span>© Amr Yasser</span><span class="navigation-hint"><kbd>←</kbd><kbd>→</kbd> <span data-i18n="switchGroup">Switch group</span><span class="footer-divider"></span><kbd>Tab</kbd> <span data-i18n="moveFocus">Move focus</span></span></footer>
+    <dialog id="capture-dialog" aria-labelledby="capture-title" aria-describedby="capture-help">
+        <h2 id="capture-title">Press a key</h2>
+        <p id="capture-help" data-i18n="captureHelp">Capture uses physical key positions. Escape cancels capture; choose Escape from the list to assign it. Some browser and system shortcuts require manual selection.</p>
+        <p id="capture-status" role="status"></p>
+        <button id="cancel-capture" type="button" data-i18n="cancelCapture" autofocus>Cancel capture</button>
+    </dialog>
+    <dialog id="replace-dialog" aria-labelledby="replace-title" aria-describedby="replace-help">
+        <h2 id="replace-title" data-i18n="replaceTitle">Discard unsaved changes?</h2>
+        <p id="replace-help" data-i18n="replaceHelp">Copy or download your configuration first if you want to keep it.</p>
+        <form method="dialog">
+            <button type="submit" value="cancel" data-i18n="keepEditing" autofocus>Keep editing</button>
+            <button type="submit" value="discard" data-i18n="discard">Discard changes</button>
+        </form>
+    </dialog>
+    <div id="language-control" hidden></div>
+    <dialog id="picker-dialog" aria-labelledby="picker-title">
+        <div class="picker-heading"><h2 id="picker-title"></h2><button id="picker-close" type="button">Close</button></div>
+        <input id="picker-search" type="search" autocomplete="off" spellcheck="false" dir="auto">
+        <div id="picker-options" role="listbox"></div>
+        <p id="picker-empty" class="hint" hidden></p>
+    </dialog>
+    <noscript>This configurator needs JavaScript enabled.</noscript>
+</body>
+</html>
diff --git a/tools/input-mapper/keys.js b/tools/input-mapper/keys.js
new file mode 100644
index 0000000000..5c44d49036
--- /dev/null
+++ b/tools/input-mapper/keys.js
@@ -0,0 +1,230 @@
+export const keyNames = [
+    "A",
+    "B",
+    "C",
+    "D",
+    "E",
+    "F",
+    "G",
+    "H",
+    "I",
+    "J",
+    "K",
+    "L",
+    "M",
+    "N",
+    "O",
+    "P",
+    "Q",
+    "R",
+    "S",
+    "T",
+    "U",
+    "V",
+    "W",
+    "X",
+    "Y",
+    "Z",
+    "1",
+    "2",
+    "3",
+    "4",
+    "5",
+    "6",
+    "7",
+    "8",
+    "9",
+    "0",
+    "Return",
+    "Escape",
+    "Backspace",
+    "Tab",
+    "Space",
+    "-",
+    "=",
+    "[",
+    "]",
+    "\\",
+    "#",
+    ";",
+    "'",
+    "`",
+    ",",
+    ".",
+    "/",
+    "CapsLock",
+    "F1",
+    "F2",
+    "F3",
+    "F4",
+    "F5",
+    "F6",
+    "F7",
+    "F8",
+    "F9",
+    "F10",
+    "F11",
+    "F12",
+    "PrintScreen",
+    "ScrollLock",
+    "Pause",
+    "Insert",
+    "Home",
+    "PageUp",
+    "Delete",
+    "End",
+    "PageDown",
+    "Right",
+    "Left",
+    "Down",
+    "Up",
+    "Numlock",
+    "Keypad /",
+    "Keypad *",
+    "Keypad -",
+    "Keypad +",
+    "Keypad Enter",
+    "Keypad 1",
+    "Keypad 2",
+    "Keypad 3",
+    "Keypad 4",
+    "Keypad 5",
+    "Keypad 6",
+    "Keypad 7",
+    "Keypad 8",
+    "Keypad 9",
+    "Keypad 0",
+    "Keypad .",
+    "Application",
+    "Power",
+    "Keypad =",
+    "F13",
+    "F14",
+    "F15",
+    "F16",
+    "F17",
+    "F18",
+    "F19",
+    "F20",
+    "F21",
+    "F22",
+    "F23",
+    "F24",
+    "Execute",
+    "Help",
+    "Menu",
+    "Select",
+    "Stop",
+    "Again",
+    "Undo",
+    "Cut",
+    "Copy",
+    "Paste",
+    "Find",
+    "Mute",
+    "VolumeUp",
+    "VolumeDown",
+    "Keypad ,",
+    "Keypad = (AS400)",
+    "AltErase",
+    "SysReq",
+    "Cancel",
+    "Clear",
+    "Prior",
+    "Separator",
+    "Out",
+    "Oper",
+    "Clear / Again",
+    "CrSel",
+    "ExSel",
+    "Keypad 00",
+    "Keypad 000",
+    "ThousandsSeparator",
+    "DecimalSeparator",
+    "CurrencyUnit",
+    "CurrencySubUnit",
+    "Keypad (",
+    "Keypad )",
+    "Keypad {",
+    "Keypad }",
+    "Keypad Tab",
+    "Keypad Backspace",
+    "Keypad A",
+    "Keypad B",
+    "Keypad C",
+    "Keypad D",
+    "Keypad E",
+    "Keypad F",
+    "Keypad XOR",
+    "Keypad ^",
+    "Keypad %",
+    "Keypad <",
+    "Keypad >",
+    "Keypad &",
+    "Keypad &&",
+    "Keypad |",
+    "Keypad ||",
+    "Keypad :",
+    "Keypad #",
+    "Keypad Space",
+    "Keypad @",
+    "Keypad !",
+    "Keypad MemStore",
+    "Keypad MemRecall",
+    "Keypad MemClear",
+    "Keypad MemAdd",
+    "Keypad MemSubtract",
+    "Keypad MemMultiply",
+    "Keypad MemDivide",
+    "Keypad +/-",
+    "Keypad Clear",
+    "Keypad ClearEntry",
+    "Keypad Binary",
+    "Keypad Octal",
+    "Keypad Decimal",
+    "Keypad Hexadecimal",
+    "Left Ctrl",
+    "Left Shift",
+    "Left Alt",
+    "Left GUI",
+    "Right Ctrl",
+    "Right Shift",
+    "Right Alt",
+    "Right GUI",
+    "ModeSwitch",
+    "AudioNext",
+    "AudioPrev",
+    "AudioStop",
+    "AudioPlay",
+    "AudioMute",
+    "MediaSelect",
+    "WWW",
+    "Mail",
+    "Calculator",
+    "Computer",
+    "AC Search",
+    "AC Home",
+    "AC Back",
+    "AC Forward",
+    "AC Stop",
+    "AC Refresh",
+    "AC Bookmarks",
+    "BrightnessDown",
+    "BrightnessUp",
+    "DisplaySwitch",
+    "KBDIllumToggle",
+    "KBDIllumDown",
+    "KBDIllumUp",
+    "Eject",
+    "Sleep",
+    "App1",
+    "App2",
+    "AudioRewind",
+    "AudioFastForward",
+    "SoftLeft",
+    "SoftRight",
+    "Call",
+    "EndCall"
+];
+
+export const exportableKeys = keyNames.filter(name => !/[#;]/u.test(name));
diff --git a/tools/input-mapper/mapping.js b/tools/input-mapper/mapping.js
new file mode 100644
index 0000000000..fe476f10f5
--- /dev/null
+++ b/tools/input-mapper/mapping.js
@@ -0,0 +1,35 @@
+export const groups = [
+    {name: 'Face buttons', actions: ['Cross', 'Circle', 'Triangle', 'Square']},
+    {name: 'Shoulders, triggers and stick clicks', actions: ['L1', 'R1', 'L2', 'R2', 'L3', 'R3']},
+    {name: 'Directional controls', actions: ['Up', 'Right', 'Down', 'Left']},
+    {name: 'Left analog stick', actions: ['LeftStickLeft', 'LeftStickRight', 'LeftStickUp', 'LeftStickDown']},
+    {name: 'Right analog stick', actions: ['RightStickLeft', 'RightStickRight', 'RightStickUp', 'RightStickDown']},
+    {name: 'Touch and utility', actions: ['Options', 'TouchLeft', 'TouchRight', 'StickModifier', 'Shake', 'ToggleMouse', 'ToggleFullscreen', 'TogglePerformanceOverlay', 'Screenshot']}
+];
+
+export const actions = groups.flatMap(group => group.actions);
+export const padButtons = new Set(['Cross', 'Circle', 'Triangle', 'Square', 'L1', 'R1', 'L2', 'R2', 'L3', 'R3', 'Options', 'Up', 'Right', 'Down', 'Left']);
+export const mouseValues = ['Left', 'Middle', 'Right', 'X1', 'X2'];
+export const wheelValues = ['Up', 'Down'];
+
+export const defaults = {
+    Cross: ['KEY:Return', 'KEY:Space'], Circle: ['KEY:C'], Triangle: ['KEY:I'], Square: ['MOUSE:Left'],
+    L1: ['KEY:Q'], R1: ['KEY:E', 'KEY:Left Alt', 'KEY:Right Alt'], L2: ['KEY:R', 'MOUSE:X1'], R2: ['MOUSE:Right'],
+    L3: ['KEY:Left Shift', 'KEY:Right Shift'], R3: ['KEY:Left Ctrl', 'KEY:Right Ctrl'], Options: ['KEY:Escape'],
+    Up: ['KEY:Up', 'WHEEL:Up'], Right: ['KEY:Right'], Down: ['KEY:Down', 'WHEEL:Down'], Left: ['KEY:Left'],
+    LeftStickLeft: ['KEY:A'], LeftStickRight: ['KEY:D'], LeftStickUp: ['KEY:W'], LeftStickDown: ['KEY:S'],
+    RightStickLeft: ['KEY:F'], RightStickRight: ['KEY:H'], RightStickUp: ['KEY:T'], RightStickDown: ['KEY:G'],
+    TouchLeft: ['KEY:Backspace'], TouchRight: ['KEY:Tab'], StickModifier: [], Shake: ['KEY:X'],
+    ToggleMouse: ['KEY:F7', 'MOUSE:Middle'], ToggleFullscreen: ['KEY:F11'], TogglePerformanceOverlay: ['KEY:F10'], Screenshot: ['KEY:F12']
+};
+
+export function typesForAction(action) {
+    if (!actions.includes(action)) return [];
+    if (['ToggleFullscreen', 'TogglePerformanceOverlay', 'Screenshot'].includes(action)) return ['KEY'];
+    return padButtons.has(action) ? ['KEY', 'MOUSE', 'WHEEL'] : ['KEY', 'MOUSE'];
+}
+
+export function canonicalValue(value, choices) {
+    if (typeof value !== 'string') return undefined;
+    return choices.find(choice => choice.toUpperCase() === value.trim().toUpperCase());
+}
diff --git a/tools/input-mapper/package.json b/tools/input-mapper/package.json
new file mode 100644
index 0000000000..064ea01892
--- /dev/null
+++ b/tools/input-mapper/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "anyps5-input-mapper",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Browser-based keyboard and mouse input configurator for AnyPS5",
+  "type": "module",
+  "license": "GPL-2.0",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "start": "node serve.js",
+    "test": "node --test tests/*.test.js"
+  }
+}
diff --git a/tools/input-mapper/serve.js b/tools/input-mapper/serve.js
new file mode 100644
index 0000000000..ccdb20e26c
--- /dev/null
+++ b/tools/input-mapper/serve.js
@@ -0,0 +1,30 @@
+import {createServer} from 'node:http';
+import {readFile} from 'node:fs/promises';
+
+const files = new Set(['index.html', 'styles.css', 'app.js', 'mapping.js', 'keys.js', 'capture.js', 'validation.js', 'i18n.js', 'dropdown.js']);
+const mime = {html: 'text/html', css: 'text/css', js: 'text/javascript'};
+const port = Number(process.env.PORT || 4173);
+const server = createServer(async (request, response) => {
+    const path = new URL(request.url, 'http://127.0.0.1').pathname;
+    const file = path === '/' ? 'index.html' : path.slice(1);
+    if (!['GET', 'HEAD'].includes(request.method)) {
+        response.writeHead(405, {Allow: 'GET, HEAD'}).end();
+        return;
+    }
+    if (!files.has(file)) {
+        response.writeHead(404).end('Not found');
+        return;
+    }
+    try {
+        const content = await readFile(new URL(file, import.meta.url));
+        response.writeHead(200, {'Content-Type': `${mime[file.split('.').pop()]}; charset=utf-8`, 'Cache-Control': 'no-store'});
+        response.end(request.method === 'HEAD' ? undefined : content);
+    } catch {
+        response.writeHead(500).end('Cannot read static file');
+    }
+});
+server.on('error', error => {
+    console.error(error.message);
+    process.exitCode = 1;
+});
+server.listen(port, '127.0.0.1', () => console.log(`Input mapper: http://127.0.0.1:${port}`));
diff --git a/tools/input-mapper/styles.css b/tools/input-mapper/styles.css
new file mode 100644
index 0000000000..1be7b42096
--- /dev/null
+++ b/tools/input-mapper/styles.css
@@ -0,0 +1,203 @@
+:root { color-scheme: dark; font-family: "Segoe UI", Helvetica, Arial, sans-serif; font-weight: 400; color: #f4f5f7; background: #101116; --muted: #c1c4ce; --line: #ffffff1c; --ease: cubic-bezier(.2,.75,.25,1); }
+* { box-sizing: border-box; }
+* { scrollbar-width: thin; scrollbar-color: #dbe0ea70 transparent; }
+::-webkit-scrollbar { width: 4px; height: 4px; }
+::-webkit-scrollbar-track { background: transparent; }
+::-webkit-scrollbar-thumb { background: #dbe0ea70; border-radius: 20px; }
+::-webkit-scrollbar-thumb:hover { background: #eef1f8c0; }
+::-webkit-scrollbar-button { display: none; width: 0; height: 0; }
+::-webkit-scrollbar-corner { background: transparent; }
+@supports selector(::-webkit-scrollbar) { * { scrollbar-width: auto; scrollbar-color: auto; } }
+[hidden] { display: none !important; }
+html { scroll-behavior: smooth; scroll-padding-top: 30px; }
+body { margin: 0; min-height: 100vh; isolation: isolate; }
+a { color: inherit; }
+button, input, select, textarea { font: inherit; }
+button, input, select { min-height: 42px; border: 1px solid #ffffff24; border-radius: 4px; color: inherit; background: #ffffff09; padding: 9px 14px; transition: color .2s, background .2s, border-color .2s, box-shadow .25s, transform .25s var(--ease); }
+button { cursor: pointer; font-weight: 400; }
+button:hover:not(:disabled) { background: #ffffff16; border-color: #ffffff70; }
+button:active:not(:disabled) { transform: scale(.97); }
+button:disabled { cursor: not-allowed; opacity: .42; }
+:focus-visible { outline: none; box-shadow: inset 0 -2px 0 #7d9ac9; }
+button:focus-visible:not(:disabled) { background: #31415b80; }
+input:focus-visible, textarea:focus-visible { border-color: #788da9; }
+select option { color: #f4f5f7; background: #22232a; }
+.ambient { position: fixed; inset: 0; z-index: -1; overflow: hidden; pointer-events: none; background: radial-gradient(ellipse at 80% 100%, #16385278, transparent 65%), radial-gradient(ellipse at 20% 18%, #4c484b50, transparent 60%), linear-gradient(140deg, #18191e, #101116 50%, #111820); }
+.ambient-glow { position: absolute; width: 110%; height: 75%; top: -45%; left: -20%; border-radius: 50%; background: radial-gradient(ellipse, #c9b99a33, #b3bfd614 38%, transparent 68%); filter: blur(36px); animation: atmosphere 24s ease-in-out infinite alternate; }
+.particles { position: absolute; inset: -12%; opacity: .7; background-image: radial-gradient(circle at 12% 29%, #e3d5b5d0 0 1px, transparent 2px), radial-gradient(circle at 32% 68%, #e0d5b9a0 0 1px, transparent 3px), radial-gradient(circle at 68% 23%, #e8d8b6b0 0 1px, transparent 3px), radial-gradient(circle at 88% 59%, #f4ead2a0 0 1px, transparent 2px), radial-gradient(circle at 54% 48%, #a2bfda90 0 1px, transparent 2px), radial-gradient(circle at 76% 78%, #ebd9ada0 0 1px, transparent 3px); background-size: 410px 370px, 590px 530px, 670px 490px, 710px 630px, 830px 730px, 970px 810px; animation: particles 38s linear infinite alternate; }
+.particles.distant { opacity: .25; filter: blur(1px); animation-duration: 58s; animation-direction: alternate-reverse; }
+header { max-width: 1640px; margin: auto; display: flex; align-items: center; gap: 42px; padding: 34px 5.5%; }
+.brand { font-size: 20px; text-decoration: none; font-weight: 300; letter-spacing: -.5px; }
+.system-nav { display: flex; gap: 32px; }
+.system-nav a { text-decoration: none; font-size: 23px; font-weight: 300; color: #b8bac1; transition: color .2s; }
+.system-nav .current, .system-nav a:hover { color: white; }
+.system-tools { display: flex; align-items: center; gap: 24px; margin-inline-start: auto; }
+.icon-button { display: grid; place-items: center; width: 38px; min-height: 38px; border: 0; border-radius: 50%; padding: 0; background: transparent; text-decoration: none; font-size: 26px; }
+.search-icon { width: 15px; height: 15px; border: 2px solid currentColor; border-radius: 50%; position: relative; }
+.search-icon::after { content: ''; position: absolute; height: 7px; width: 2px; background: currentColor; right: -4px; bottom: -5px; transform: rotate(-45deg); }
+.translation-icon { display: flex; align-items: center; gap: 2px; direction: ltr; font-size: 18px; line-height: 1; }
+.translation-icon span { display: grid; place-items: center; width: 21px; height: 23px; border: 1px solid #aab7cb70; border-radius: 4px; }
+.translation-icon span:last-child { margin-left: -7px; margin-top: 11px; background: #252a34; }
+#clock { font-size: 22px; font-weight: 300; min-width: 58px; font-variant-numeric: tabular-nums; white-space: nowrap; }
+main { max-width: 1440px; min-height: calc(100vh - 210px); margin: auto; padding: 6px 5% 35px; }
+main:focus { outline: none; box-shadow: none; }
+#categories { display: flex; align-items: flex-start; gap: 20px; padding: 16px 8px 22px; margin-inline-start: -8px; min-height: 155px; overflow-x: auto; }
+.category { background: transparent; border: 0; padding: 0; width: 108px; flex: 0 0 108px; text-align: center; }
+.category:hover:not(:disabled), .category:focus-visible:not(:disabled) { background: transparent; color: white; }
+.category:focus-visible { outline: none; box-shadow: none; }
+.category-icon { display: grid; place-items: center; height: 92px; width: 92px; margin: 0 auto 13px; border-radius: 16px; border: 1px solid #ffffff24; background: linear-gradient(145deg, #565860a0, #272b33c0); color: #eeeeef; box-shadow: 0 8px 20px #0002; transition: transform .3s var(--ease), box-shadow .3s, background .3s; }
+.category[aria-pressed="true"] .category-icon, .category:focus-visible .category-icon { transform: scale(1.06); background: linear-gradient(145deg, #6a778db0, #354359c0); border-color: #91a4c366; box-shadow: 0 12px 30px #0004; }
+.category:hover .category-icon { transform: translateY(-3px); }
+.category[aria-pressed="true"]:hover .category-icon { transform: scale(1.06) translateY(-2px); }
+.category-label { display: block; font-size: 12px; color: #babdc6; line-height: 1.4; }
+.category[aria-pressed="true"] .category-label { color: white; }
+.face-icon { position: relative; width: 60px; height: 60px; font-size: 24px; line-height: 1; font-weight: 300; }
+.face-icon span { position: absolute; display: grid; place-items: center; width: 24px; height: 24px; }
+.face-icon span:nth-child(1) { top: 0; left: 18px; }
+.face-icon span:nth-child(2) { right: 0; top: 18px; }
+.face-icon span:nth-child(3) { bottom: 0; left: 18px; }
+.face-icon span:nth-child(4) { left: 0; top: 18px; }
+.shoulder-icon { border: 2px solid currentColor; border-radius: 6px 6px 13px 13px; padding: 7px 10px; font-size: 17px; }
+.direction-icon { position: relative; width: 42px; height: 42px; background: currentColor; clip-path: polygon(34% 0,66% 0,66% 34%,100% 34%,100% 66%,66% 66%,66% 100%,34% 100%,34% 66%,0 66%,0 34%,34% 34%); }
+.stick-icon { display: grid; place-items: center; border: 2px solid currentColor; border-radius: 50%; width: 43px; height: 43px; font-size: 18px; box-shadow: 0 4px 0 1px #ffffff45; }
+.touch-icon { width: 50px; height: 33px; border: 2px solid currentColor; border-radius: 7px; background: radial-gradient(circle, #ffffff60 1px, transparent 1.5px) 0 0 / 7px 7px; }
+.intro { margin: 8px 0 26px; animation: enter .6s var(--ease) both; }
+.eyebrow { color: #b9bbc2; font-size: 13px; margin: 0 0 13px; }
+h1 { font-size: clamp(34px, 4vw, 48px); font-weight: 300; letter-spacing: -.9px; line-height: 1.15; margin: 0; }
+.intro > p:last-child { color: var(--muted); font-size: 15px; margin: 13px 0 0; }
+.toolbar, .tools, .output-heading { display: flex; gap: 12px; align-items: center; }
+.toolbar { justify-content: space-between; margin-bottom: 22px; }
+.search { width: min(350px, 55%); }
+.search input { width: 100%; border-radius: 30px; padding: 10px 20px; background: #ffffff08; }
+input::placeholder { color: #b6b9c4; }
+.tools button { border-radius: 30px; padding: 9px 22px; }
+.group, .configuration-panel, .faq { background: #181a22b0; border: 1px solid var(--line); border-radius: 6px; backdrop-filter: blur(20px); box-shadow: 0 18px 45px #0002; }
+.group { margin-bottom: 20px; animation: enter .35s var(--ease); }
+.group h2 { font-size: 12px; font-weight: 400; color: #bdc2ce; margin: 0; padding: 18px 24px; border-bottom: 1px solid var(--line); }
+.action { padding: 19px 24px; border-bottom: 1px solid #ffffff10; transition: background .25s; }
+.action:last-child { border-bottom: 0; }
+.action:hover { background: #ffffff06; }
+.action:focus-within { background: #ffffff0c; }
+.action-heading { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.action-title { display: flex; align-items: center; gap: 15px; }
+.action-symbol { display: grid; place-items: center; width: 30px; height: 30px; font-size: 29px; line-height: 1; font-weight: 300; color: #eaedf5; }
+.action h3 { margin: 0; font-size: 18px; font-weight: 300; }
+.action-heading button { border: 0; min-height: 34px; font-size: 12px; border-radius: 30px; padding: 7px 14px; background: #ffffff0a; }
+.hint { font-size: 12px; color: var(--muted); line-height: 1.65; overflow-wrap: anywhere; }
+.action > .hint { margin: 7px 0 0; margin-inline-start: 45px; }
+.binding { display: grid; grid-template-columns: 110px minmax(0, 1fr) auto auto; gap: 10px; margin-top: 17px; animation: enter .25s var(--ease); }
+.dropdown { min-width: 0; }
+.dropdown-trigger { display: flex; align-items: center; gap: 10px; width: 100%; min-height: 44px; padding: 10px 13px; font-size: 13px; text-align: start; border-radius: 9px; background: #0e131e66; }
+.dropdown-trigger::after { content: ''; width: 6px; height: 6px; flex-shrink: 0; border-right: 1.5px solid #a7b2c5; border-bottom: 1.5px solid #a7b2c5; transform: rotate(45deg); margin-inline-start: auto; margin-top: -4px; }
+.dropdown-value { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.dropdown-trigger[aria-expanded="true"] { background: #27344999; border-color: #677c9a; }
+.binding button { font-size: 12px; padding: 8px 11px; }
+[aria-invalid="true"] { border-color: #ff9a9a; }
+.configuration-panel { padding: 32px; max-width: 960px; margin: auto; animation: enter .35s var(--ease); }
+.output-heading { justify-content: space-between; }
+.output-heading h2 { font-size: 22px; font-weight: 300; margin: 0; }
+.tag { font-size: 11px; color: #b6bcc9; white-space: nowrap; }
+.configuration-panel label { display: block; margin: 20px 0 10px; color: #d0d3db; font-size: 12px; direction: ltr; }
+textarea { width: 100%; height: 340px; resize: vertical; padding: 18px; border: 1px solid #ffffff18; border-radius: 4px; background: #090b1290; color: #edf0f8; font: 14px/1.9 Consolas, ui-monospace, monospace; text-align: left; }
+.export-actions { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 14px; margin-top: 20px; }
+.export-actions button { border-radius: 30px; }
+.primary { background: #f0f1f5; color: #171920; border-color: #f0f1f5; }
+.primary:hover:not(:disabled), .primary:focus-visible:not(:disabled) { background: #d8e0ee; color: #171920; box-shadow: none; }
+.error { color: #ffb5b5; }
+.warning { color: #e8cf9b; }
+#validation { font-size: 12px; line-height: 1.6; }
+#validation ul { padding-inline-start: 18px; }
+#count { direction: ltr; unicode-bidi: isolate; }
+#help { max-width: 960px; margin: auto; }
+.faq { margin-bottom: 14px; }
+.faq summary { cursor: pointer; padding: 22px 26px; font-size: 18px; font-weight: 300; }
+.faq[open] summary { border-bottom: 1px solid var(--line); }
+.faq p { padding: 0 26px 12px; color: var(--muted); line-height: 1.9; }
+#picker-dialog { position: fixed; inset: auto; margin: 0; padding: 18px; border: 1px solid #70809c45; border-radius: 16px; background: linear-gradient(145deg, #242a36fa, #131a27fc); max-width: calc(100% - 32px); height: min(var(--picker-height, 480px), calc(100dvh - 32px)); max-height: calc(100dvh - 32px); box-shadow: 0 24px 80px #0008; }
+#picker-dialog[open] { display: grid; grid-template-rows: auto auto minmax(0, 1fr); gap: 14px; }
+#picker-dialog::backdrop { background: #080b1540; backdrop-filter: blur(3px); }
+.picker-heading { display: flex; gap: 12px; align-items: center; justify-content: space-between; min-width: 0; }
+.picker-heading h2 { font-size: 17px; line-height: 1.5; overflow-wrap: anywhere; }
+.picker-heading button { min-height: 36px; margin: 0; padding: 6px 12px; border: 0; background: #ffffff08; font-size: 12px; flex-shrink: 0; }
+#picker-search { width: 100%; min-width: 0; border-radius: 10px; padding: 11px 14px; font-size: 16px; }
+#picker-options { min-height: 0; overflow-y: auto; overscroll-behavior: contain; padding: 2px 3px; }
+.picker-option { display: block; width: 100%; min-height: 44px; margin: 0 0 3px; border: 0; border-radius: 8px; padding: 12px 14px; background: transparent; text-align: start; font-size: 14px; line-height: 1.5; overflow-wrap: anywhere; }
+.picker-option[aria-selected="true"] { background: #3547629c; color: #e4edff; }
+.picker-option:focus-visible { background: #3b506fa6; box-shadow: none; }
+#picker-empty { position: absolute; top: 160px; inset-inline: 18px; text-align: center; }
+html[dir="rtl"] h1 { letter-spacing: 0; }
+html[dir="rtl"] .intro > p:last-child { line-height: 1.9; }
+html[dir="rtl"] .brand, footer > span:first-child { direction: ltr; unicode-bidi: isolate; }
+#status { color: #dae3f6; font-size: 13px; line-height: 1.6; }
+#import-report { margin-top: 22px; padding: 24px; border: 1px solid var(--line); background: #171b25c0; border-radius: 6px; overflow-wrap: anywhere; }
+#import-report h2 { font-size: 23px; font-weight: 300; }
+dialog { width: min(520px, calc(100% - 32px)); max-height: calc(100dvh - 32px); overflow-y: auto; color: inherit; background: linear-gradient(140deg, #30323bef, #181d28f5); border: 1px solid #ffffff3c; border-radius: 6px; padding: 32px; box-shadow: 0 20px 100px #0008; }
+dialog[open] { animation: dialog-enter .3s var(--ease); }
+dialog h2 { font-size: 28px; font-weight: 300; margin: 0; }
+dialog p { line-height: 1.7; font-size: 14px; color: var(--muted); }
+dialog button { border-radius: 30px; margin-top: 12px; }
+dialog form { display: flex; gap: 12px; flex-wrap: wrap; }
+dialog::backdrop { background: #080b15a0; backdrop-filter: blur(12px); }
+footer { display: flex; justify-content: space-between; align-items: center; gap: 18px; padding: 20px 5.5% 30px; max-width: 1640px; margin: auto; color: #b1b6c2; font-size: 12px; }
+.navigation-hint { display: flex; gap: 7px; align-items: center; }
+kbd { border: 1px solid #ffffff50; border-radius: 4px; padding: 1px 5px; font: inherit; color: #e3e5eb; }
+.footer-divider { width: 1px; height: 12px; background: #ffffff30; margin: 0 8px; }
+.skip-link { position: fixed; top: -80px; left: 16px; padding: 12px; z-index: 2; background: #242836; }
+.skip-link:focus { top: 12px; }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0; }
+@keyframes atmosphere { to { transform: translate(15%, 20%) scale(1.15); opacity: .7; } }
+@keyframes particles { from { transform: translate3d(0, 0, 0); } to { transform: translate3d(-35px, -65px, 0); } }
+@keyframes enter { from { opacity: 0; transform: translateY(10px); } to { opacity: 1; transform: translateY(0); } }
+@keyframes dialog-enter { from { opacity: 0; transform: translateY(16px) scale(.98); } to { opacity: 1; transform: translateY(0) scale(1); } }
+@media (max-width: 1100px) { header { gap: 26px; } #categories { gap: 14px; } .category { width: 96px; flex-basis: 96px; } .category-icon { width: 82px; height: 82px; } }
+@media (max-width: 760px) {
+    header { display: grid; grid-template-columns: 1fr auto; gap: 18px 12px; padding: 22px 5% 14px; }
+    .brand { font-size: 18px; }
+    .system-tools { margin: 0; gap: 12px; }
+    .system-nav { grid-column: 1 / -1; grid-row: 2; display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 3px; background: #ffffff04; border-radius: 12px; padding: 4px; }
+    .system-nav a { min-width: 0; padding: 10px 6px; font-size: clamp(12px, 3.7vw, 16px); text-align: center; border-radius: 8px; overflow-wrap: anywhere; }
+    .system-nav .current { background: #3b4b6233; }
+    #clock { font-size: 15px; }
+    main { min-height: calc(100vh - 225px); padding-inline: 5%; }
+    #categories { gap: 10px; padding: 12px 8px 16px; min-height: 119px; scroll-snap-type: x proximity; }
+    .category { flex-basis: 80px; width: 80px; scroll-snap-align: center; }
+    .category-icon { width: 66px; height: 66px; border-radius: 13px; margin-bottom: 10px; }
+    .category-label { font-size: 10px; min-height: 28px; }
+    .face-icon { transform: scale(.8); }
+    .intro { margin: 9px 0 22px; }
+    h1 { font-size: clamp(28px, 7.5vw, 36px); }
+    .intro > p:last-child { font-size: 13px; line-height: 1.7; }
+    .eyebrow { font-size: 11px; margin-bottom: 10px; }
+    .toolbar { flex-wrap: wrap; gap: 10px; }
+    .search, .tools { width: 100%; }
+    .search input { font-size: 16px; min-height: 44px; }
+    .tools button { flex: 1; min-height: 44px; padding: 10px 14px; font-size: 13px; }
+    .group h2 { padding: 15px 16px; font-size: 11px; }
+    .action { padding: 17px 16px; }
+    .action-heading { flex-wrap: wrap; gap: 10px; }
+    .action-title { gap: 10px; min-width: 0; flex: 1 1 140px; }
+    .action h3 { font-size: 16px; overflow-wrap: anywhere; }
+    .action-heading button { min-height: 38px; max-width: 100%; }
+    .action-symbol { width: 25px; flex-shrink: 0; }
+    .action > .hint { margin-inline-start: 0; font-size: 11px; }
+    .binding { grid-template-columns: 104px minmax(0, 1fr); gap: 10px; margin-top: 14px; }
+    .binding > button { min-height: 44px; border-radius: 9px; }
+    .dropdown-trigger { font-size: 14px; }
+    .configuration-panel { padding: 18px; }
+    textarea { height: clamp(220px, 40dvh, 340px); font-size: 13px; }
+    .export-actions { grid-template-columns: 1fr; gap: 10px; }
+    .export-actions button { min-height: 44px; }
+    .faq summary { padding: 18px; font-size: 16px; }
+    .faq p { padding-inline: 18px; font-size: 14px; }
+    dialog { padding: 22px; border-radius: 16px; }
+    dialog h2 { font-size: 23px; }
+    footer { justify-content: center; padding-block: 22px; }
+    .navigation-hint { display: none; }
+}
+@media (max-width: 600px) {
+    #picker-dialog { inset-inline: 8px; top: auto; bottom: 8px; width: calc(100% - 16px); max-width: calc(100% - 16px); height: min(var(--picker-height, 480px), 76dvh); max-height: calc(100dvh - 16px); padding: 18px 16px calc(16px + env(safe-area-inset-bottom)); border-radius: 22px; }
+    #picker-dialog::backdrop { background: #05081080; backdrop-filter: blur(7px); }
+    .picker-option { min-height: 46px; font-size: 15px; }
+}
+@media (max-width: 360px) { #clock { display: none; } .system-tools { gap: 16px; } .binding { grid-template-columns: 94px minmax(0, 1fr); } .action-title { flex-basis: 120px; } }
+@media (prefers-reduced-motion: reduce) { html { scroll-behavior: auto; } *, *::before, *::after { animation: none !important; transition: none !important; } }
diff --git a/tools/input-mapper/tests/i18n.test.js b/tools/input-mapper/tests/i18n.test.js
new file mode 100644
index 0000000000..65d98f0140
--- /dev/null
+++ b/tools/input-mapper/tests/i18n.test.js
@@ -0,0 +1,39 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {diagnostic, initialLocale, locales, messages, translate} from '../i18n.js';
+import {parseIni, serialize} from '../validation.js';
+
+test('every selectable language supplies the main interface and every FAQ', () => {
+    assert.equal(locales[0].code, 'ar-EG');
+    assert.equal(new Set(locales.map(item => item.code)).size, locales.length);
+    const required = ['controls', 'configuration', 'help', 'settings', 'language', 'close', 'intro', 'search', 'import', 'reset', 'select', 'add', 'capture', 'remove', 'download', 'copy', 'backControls', 'helpIntro', 'configIntro'];
+    for (let index = 0; index < 6; index++) required.push(`group${index}`);
+    for (let index = 0; index < 4; index++) required.push(`faq${index}Question`, `faq${index}Answer`);
+    for (const locale of locales) {
+        assert.doesNotThrow(() => new Intl.DateTimeFormat(locale.code));
+        assert.equal(locale.direction, ['ar-EG', 'ur', 'fa'].includes(locale.code) ? 'rtl' : 'ltr');
+        for (const key of required) assert.ok(messages[locale.code][key], `${locale.code}: ${key}`);
+    }
+});
+
+test('first visits use English while valid saved language preferences are retained', () => {
+    for (const saved of [undefined, null, '', 'unsupported']) assert.equal(initialLocale(saved), 'en');
+    for (const locale of locales) assert.equal(initialLocale(locale.code), locale.code);
+});
+
+test('language substitution preserves canonical inputs and exported INI bytes', () => {
+    const source = 'Cross = KEY:F\nCross = KEY:Space\nToggleMouse = MOUSE:X1\n';
+    const entries = parseIni(source).entries;
+    for (const locale of locales) {
+        assert.ok(translate(locale.code, 'builtin', {inputs: 'KEY:F, KEY:Space'}).includes('KEY:F, KEY:Space'));
+        assert.equal(serialize(entries), source);
+    }
+    assert.equal(translate('ar-EG', 'captured', {value: 'F', action: 'Cross'}), 'تم تسجيل F لـ Cross.');
+    assert.equal(translate('unsupported', 'help'), 'Help');
+});
+
+test('Egyptian diagnostics retain action tokens and unknown technical details', () => {
+    assert.equal(diagnostic('ar-EG', 'Cross: Unknown or empty KEY value.'), 'Cross: قيمة KEY مش معروفة أو فاضية.');
+    assert.equal(diagnostic('ar-EG', 'Unexpected diagnostic'), 'Unexpected diagnostic');
+    assert.equal(diagnostic('fr', 'Cross: Unknown or empty KEY value.'), 'Cross: Unknown or empty KEY value.');
+});
diff --git a/tools/input-mapper/tests/mapping.test.js b/tools/input-mapper/tests/mapping.test.js
new file mode 100644
index 0000000000..8c34cceb70
--- /dev/null
+++ b/tools/input-mapper/tests/mapping.test.js
@@ -0,0 +1,154 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {actions, defaults, mouseValues, padButtons, typesForAction} from '../mapping.js';
+import {exportableKeys, keyNames} from '../keys.js';
+import {captureKey} from '../capture.js';
+import {parseIni, serialize, validate} from '../validation.js';
+
+const binding = (action, type = 'KEY', value = 'F') => ({action, type, value});
+
+test('action names and pad button categories agree with the current native parser', () => {
+    const source = readFileSync(new URL('../../../core/libs/prx/libSceVideoOut/src/InputMapping.cpp', import.meta.url), 'utf8');
+    const definitions = [...source.matchAll(/InputAction\{"(\w+)", Pad::InputControl::(\w+),/gu)];
+    assert.deepEqual([...actions].sort(), definitions.map(match => match[1]).sort());
+    assert.deepEqual([...padButtons].sort(), definitions.filter(match => match[2] === 'Button').map(match => match[1]).sort());
+    assert.match(source, /SDL_GetScancodeFromName\(keyName\.c_str\(\)\)/u);
+    const keyboardOnly = [...source.matchAll(/if \(action\.control == Pad::InputControl::(\w+)\) \{\s*throw std::runtime_error\("\w+ can only use a keyboard key"\);/gu)].map(match => match[1]);
+    assert.deepEqual(actions.filter(action => typesForAction(action).length === 1).sort(), keyboardOnly.sort());
+    assert.match(source, /if \(action\.control != Pad::InputControl::Button\)/u);
+});
+
+test('built-in conflict catalogue agrees with the current native bindings', () => {
+    const source = readFileSync(new URL('../../../core/libs/prx/libScePad/include/InputMapping.hpp', import.meta.url), 'utf8');
+    const special = {RETURN: 'Return', SPACE: 'Space', ESCAPE: 'Escape', BACKSPACE: 'Backspace', TAB: 'Tab', UP: 'Up', RIGHT: 'Right', DOWN: 'Down', LEFT: 'Left', LALT: 'Left Alt', RALT: 'Right Alt', LSHIFT: 'Left Shift', RSHIFT: 'Right Shift', LCTRL: 'Left Ctrl', RCTRL: 'Right Ctrl'};
+    const native = Object.fromEntries(actions.map(action => [action, []]));
+    for (const match of source.matchAll(/InputBinding\{SDL_SCANCODE_(\w+), MouseButton::(\w+), InputControl::(\w+)(?:, PadButton::(\w+))?(?:, (-?\d+))?\}/gu)) {
+        const [, key, mouse, control, button, wheel] = match;
+        const action = control === 'Button' ? button : control;
+        const value = key !== 'UNKNOWN' ? `KEY:${special[key] || key}` : mouse !== 'None' ? `MOUSE:${mouse}` : `WHEEL:${wheel === '1' ? 'Up' : 'Down'}`;
+        native[action].push(value);
+    }
+    assert.deepEqual(native, defaults);
+});
+
+test('every action serializes with a supported key', () => {
+    const input = actions.map(action => binding(action));
+    assert.equal(serialize(input), actions.map(action => `${action} = KEY:F\n`).join(''));
+});
+
+test('multiple inputs are alternatives and omitted actions stay omitted', () => {
+    assert.equal(serialize([binding('Cross'), binding('Cross', 'KEY', 'Space')]), 'Cross = KEY:F\nCross = KEY:Space\n');
+    assert.equal(serialize([]), '');
+    assert.equal(serialize([binding('R2', 'MOUSE', 'Right')]), 'R2 = MOUSE:Right\n');
+});
+
+test('case and whitespace normalize; duplicate bindings warn and serialize once', () => {
+    const input = [binding(' cross ', ' key ', ' f '), binding('Cross')];
+    assert.equal(serialize(input), 'Cross = KEY:F\n');
+    assert.equal(validate(input).warnings.filter(warning => warning.message.includes('duplicate')).length, 1);
+});
+
+test('invalid and incomplete bindings block export', () => {
+    for (const input of [binding('Unknown'), binding('Cross', 'GAMEPAD'), binding('Cross', 'KEY', 'Enter'), binding('Cross', 'KEY', 'KeyF'), binding('Cross', 'KEY', ''), binding('Cross', 'KEY', 'F\nR2 = MOUSE:Left'), null, {}]) {
+        assert.ok(validate([input]).errors.length);
+        assert.throws(() => serialize([input]));
+    }
+    assert.ok(validate({}).errors.length);
+});
+
+test('all exportable SDL names validate and unsafe comment names are rejected', () => {
+    for (const key of exportableKeys) assert.equal(validate([binding('Cross', 'KEY', key)]).errors.length, 0, key);
+    for (const key of [';', '#', 'Keypad #']) assert.ok(validate([binding('Cross', 'KEY', key)]).errors.length, key);
+    assert.equal(new Set(keyNames).size, keyNames.length);
+});
+
+test('mouse values and action restrictions match the current INI format', () => {
+    for (const action of actions) {
+        for (const value of mouseValues) {
+            assert.equal(validate([binding(action, 'MOUSE', value)]).errors.length === 0, !['ToggleFullscreen', 'TogglePerformanceOverlay', 'Screenshot'].includes(action));
+        }
+    }
+    assert.ok(validate([binding('Cross', 'MOUSE', 'Button1')]).errors.length);
+});
+
+test('wheel directions only map to pad buttons', () => {
+    for (const action of actions) {
+        for (const value of ['Up', 'Down']) {
+            assert.equal(validate([binding(action, 'WHEEL', value)]).errors.length === 0, padButtons.has(action));
+        }
+        assert.deepEqual(typesForAction(action).includes('WHEEL'), padButtons.has(action));
+    }
+    assert.ok(validate([binding('Cross', 'WHEEL', 'Left')]).errors.length);
+});
+
+test('new utility actions import and round trip without accepting unsupported sources', () => {
+    const source = 'StickModifier = MOUSE:X2\nShake = MOUSE:Left\nTogglePerformanceOverlay = KEY:F9\nScreenshot = KEY:F8\n';
+    const imported = parseIni(source);
+    assert.deepEqual(imported.errors, []);
+    assert.equal(serialize(imported.entries), source);
+    for (const action of ['StickModifier', 'Shake', 'TogglePerformanceOverlay', 'Screenshot']) {
+        assert.ok(validate([binding(action, 'WHEEL', 'Up')]).errors.length);
+    }
+    for (const action of ['TogglePerformanceOverlay', 'Screenshot']) {
+        assert.deepEqual(parseIni(`${action} = MOUSE:Left`).errors.map(error => error.line), [1]);
+    }
+});
+
+test('updated built-in inputs warn until their owning action is overridden', () => {
+    for (const [action, type, value] of [['L2', 'KEY', 'R'], ['L2', 'MOUSE', 'X1'], ['ToggleMouse', 'KEY', 'F7'], ['Shake', 'KEY', 'X'], ['Screenshot', 'KEY', 'F12'], ['TogglePerformanceOverlay', 'KEY', 'F10']]) {
+        const input = binding('Cross', type, value);
+        assert.ok(validate([input]).warnings.some(warning => warning.message.includes(`${action} (built-in)`)));
+        assert.equal(validate([input, binding(action, 'KEY', 'J')]).warnings.length, 0);
+    }
+});
+
+test('conflicts warn without blocking, including omitted built-in actions', () => {
+    const input = [binding('Cross'), binding('Square')];
+    const result = validate(input);
+    assert.equal(result.errors.length, 0);
+    assert.ok(result.warnings.some(warning => warning.message.includes('Cross and Square and RightStickLeft (built-in)')));
+    assert.doesNotThrow(() => serialize(input));
+    const overridden = validate([binding('Cross'), binding('RightStickLeft', 'KEY', 'J')]);
+    assert.equal(overridden.warnings.length, 0);
+});
+
+test('serialization is deterministic in action order and preserves alternative order', () => {
+    const input = [binding('ToggleMouse', 'MOUSE', 'X1'), binding('Cross', 'KEY', 'Space'), binding('Cross')];
+    assert.equal(serialize(input), 'Cross = KEY:Space\nCross = KEY:F\nToggleMouse = MOUSE:X1\n');
+    assert.deepEqual(input, [binding('ToggleMouse', 'MOUSE', 'X1'), binding('Cross', 'KEY', 'Space'), binding('Cross')]);
+});
+
+test('import supports BOM, CRLF, inline comments, extra equals and colons in key names', () => {
+    const result = parseIni('\uFEFF# config\r\n cross = key : space ; note\r\nCross=KEY:Space\r\nR2=mouse:right\r\nL1=KEY:=\r\nL2=KEY:Keypad :\r\n');
+    assert.deepEqual(result.errors, []);
+    assert.equal(result.warnings.length, 1);
+    assert.deepEqual(result.entries, [binding('Cross', 'KEY', 'Space'), binding('R2', 'MOUSE', 'Right'), binding('L1', 'KEY', '='), binding('L2', 'KEY', 'Keypad :')]);
+});
+
+test('import rejects sections, unsupported extensions and malformed lines with line numbers', () => {
+    const result = parseIni('[Bindings]\nCross=NONE\nCross=KEY:4\nToggleFullscreen=MOUSE:Left\nLeftStickUp=WHEEL:Up\nCross=KEY:;\nCross=KEY:KeyF\nCross=KEY:\n');
+    assert.deepEqual(result.errors.map(error => error.line), [1, 2, 4, 5, 6, 7, 8]);
+    assert.deepEqual(result.entries, [binding('Cross', 'KEY', '4')]);
+    assert.throws(() => parseIni(null), TypeError);
+});
+
+test('round trip is stable for every safe key and supported mouse/wheel source', () => {
+    const input = [...exportableKeys.map(value => binding('Cross', 'KEY', value)), ...mouseValues.map(value => binding('Square', 'MOUSE', value)), binding('R2', 'WHEEL', 'Down')];
+    const text = serialize(input);
+    const imported = parseIni(text);
+    assert.equal(imported.errors.length, 0);
+    assert.equal(serialize(imported.entries), text);
+});
+
+test('capture maps physical positions and distinguishes modifiers and keypad', () => {
+    const cases = {KeyA: 'A', Digit1: '1', Enter: 'Return', NumpadEnter: 'Keypad Enter', Numpad1: 'Keypad 1', ControlLeft: 'Left Ctrl', AltRight: 'Right Alt', ArrowUp: 'Up', F24: 'F24', Equal: '=', Backslash: '\\'};
+    for (const [code, value] of Object.entries(cases)) assert.deepEqual(captureKey({code, key: 'ignored'}), {value});
+    assert.equal(captureKey({code: 'KeyQ', key: 'a'}).value, 'Q');
+});
+
+test('capture rejects missing identifiers, composition and unsafe punctuation', () => {
+    for (const event of [{code: 'Unidentified'}, {key: 'a'}, {code: 'IntlBackslash'}, {code: 'Semicolon'}, {code: 'KeyA', isComposing: true}, {code: 'Quote', key: 'Dead'}, {code: 'KeyA', key: 'Process'}]) {
+        assert.ok(captureKey(event).error);
+    }
+});
diff --git a/tools/input-mapper/validation.js b/tools/input-mapper/validation.js
new file mode 100644
index 0000000000..ce4c7a8bb9
--- /dev/null
+++ b/tools/input-mapper/validation.js
@@ -0,0 +1,93 @@
+import {actions, canonicalValue, defaults, mouseValues, typesForAction, wheelValues} from './mapping.js';
+import {keyNames} from './keys.js';
+
+export function validate(entries) {
+    const errors = [];
+    const warnings = [];
+    const bindings = [];
+    const seen = new Set();
+    if (!Array.isArray(entries)) return {errors: [{message: 'Configuration must be a list of bindings.'}], warnings, bindings};
+    entries.forEach((entry, index) => {
+        const action = canonicalValue(entry?.action, actions);
+        const type = canonicalValue(entry?.type, ['KEY', 'MOUSE', 'WHEEL']);
+        let message;
+        if (!action) message = 'Unknown or empty action.';
+        else if (!type) message = 'Input type must be KEY, MOUSE or WHEEL.';
+        else if (!typesForAction(action).includes(type)) message = `${action} cannot use ${type}.`;
+        const choices = type === 'KEY' ? keyNames : type === 'MOUSE' ? mouseValues : wheelValues;
+        const value = canonicalValue(entry?.value, choices);
+        if (!message && !value) message = `Unknown or empty ${type} value.`;
+        if (!message && /[#;\r\n]/u.test(value)) message = 'This SDL key name cannot be represented in the current INI comment syntax.';
+        if (message) {
+            errors.push({index, message: `${entry?.action || 'Binding'}: ${message}`});
+            return;
+        }
+        const binding = {action, type, value};
+        const identity = `${action}:${type}:${value}`;
+        if (seen.has(identity)) warnings.push({index, message: `${action}: duplicate ${type}:${value} will be omitted.`});
+        else bindings.push(binding);
+        seen.add(identity);
+    });
+    const configured = new Set(bindings.map(binding => binding.action));
+    const sources = new Map();
+    const effective = bindings.map(binding => ({action: binding.action, source: `${binding.type}:${binding.value}`, builtin: false}));
+    for (const action of actions) {
+        if (!configured.has(action)) {
+            for (const source of defaults[action]) effective.push({action, source, builtin: true});
+        }
+    }
+    for (const binding of effective) {
+        const owners = sources.get(binding.source) || [];
+        owners.push(binding);
+        sources.set(binding.source, owners);
+    }
+    for (const [source, owners] of sources) {
+        if (owners.length > 1 && owners.some(owner => !owner.builtin)) {
+            warnings.push({message: `${source} controls ${owners.map(owner => `${owner.action}${owner.builtin ? ' (built-in)' : ''}`).join(' and ')}.`});
+        }
+    }
+    return {errors, warnings, bindings};
+}
+
+export function serialize(entries) {
+    const result = validate(entries);
+    if (result.errors.length) throw new Error(result.errors.map(error => error.message).join('\n'));
+    const lines = [];
+    for (const action of actions) {
+        for (const binding of result.bindings.filter(binding => binding.action === action)) {
+            lines.push(`${action} = ${binding.type}:${binding.value}`);
+        }
+    }
+    return lines.length ? `${lines.join('\n')}\n` : '';
+}
+
+export function parseIni(text) {
+    if (typeof text !== 'string') throw new TypeError('INI content must be text.');
+    const entries = [];
+    const errors = [];
+    const warnings = [];
+    const identities = new Set();
+    text.replace(/^\uFEFF/u, '').split('\n').forEach((line, index) => {
+        const content = line.split(/[#;]/u, 1)[0].trim();
+        if (!content) return;
+        const separator = content.indexOf('=');
+        const source = content.slice(separator + 1);
+        const colon = source.indexOf(':');
+        if (separator === -1 || colon === -1) {
+            errors.push({line: index + 1, message: 'Expected Action = TYPE:VALUE.'});
+            return;
+        }
+        const entry = {action: content.slice(0, separator), type: source.slice(0, colon), value: source.slice(colon + 1)};
+        const result = validate([entry]);
+        if (result.errors.length) {
+            errors.push(...result.errors.map(error => ({line: index + 1, message: error.message})));
+            return;
+        }
+        const binding = result.bindings[0];
+        const identity = JSON.stringify(binding);
+        if (identities.has(identity)) warnings.push({line: index + 1, message: 'Duplicate binding ignored.'});
+        else entries.push(binding);
+        identities.add(identity);
+    });
+    return {entries, errors, warnings};
+}
diff --git a/tools/nid_names.py b/tools/nid_names.py
index 86610f409c..9c32236fe8 100644
--- a/tools/nid_names.py
+++ b/tools/nid_names.py
@@ -51,7 +51,7 @@ def load_db(path):
     if not path.exists():
         path.parent.mkdir(parents=True, exist_ok=True)
         print("downloading NID database to %s ..." % path, file=sys.stderr)
-        with tempfile.NamedTemporaryFile(dir=path.parent, prefix=path.name + ".", suffix=".tmp", delete=False) as download:
+        with tempfile.NamedTemporaryFile(dir=path.parent, prefix=".nid-db-", suffix=".tmp", delete=False) as download:
             temporary = Path(download.name)
         try:
             urllib.request.urlretrieve(DB_URL, str(temporary))
@@ -181,6 +181,9 @@ def symbol_file(path):
 
 
 def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(
         description="Suggest real names for Unknown NID stubs")
     parser.add_argument("--db", default=os.environ.get("ANYPS5_NID_DB"),
@@ -222,7 +225,7 @@ def main(argv=None):
 
     db_path = Path(args.db) if args.db else DEFAULT_CACHE
     try:
-        db = load_db(db_path)
+        db = {} if requested_nids and not args.nid else load_db(db_path)
         if requested_nids:
             unknowns = {nid: "<cli>" for nid in (args.nid or [])}
         else:
@@ -261,7 +264,4 @@ def main(argv=None):
 
 
 if __name__ == "__main__":
-    for stream in (sys.stdout, sys.stderr):
-        if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
     sys.exit(main())
diff --git a/tools/pr_overlap.py b/tools/pr_overlap.py
index 29008a4d9d..992a1e4b2e 100644
--- a/tools/pr_overlap.py
+++ b/tools/pr_overlap.py
@@ -1,4 +1,5 @@
 import argparse
+import io
 import json
 import os
 import re
@@ -7,9 +8,10 @@ import sys
 from concurrent.futures import ThreadPoolExecutor
 from itertools import combinations
 from pathlib import Path
+import tarfile
 from urllib.parse import quote, urlencode
 
-from nid_names import compute_nid, source_aliases
+import nid_names
 
 PARENT = 'if .parent then "\\(.parent.owner.login)/\\(.parent.name)" else .nameWithOwner end'
 EXPORT = re.compile(r"^\+.*\bAPS5_VABI\s+(\w+)\s*\(")
@@ -19,10 +21,33 @@ PLAIN_DEPENDS = re.compile(r'Depends on[ \t]+(#\d+\b(?:(?:[ \t]*,[ \t]*(?:and[ \
 HUNK = re.compile(r"^@@ -(\d+)(?:,(\d+))?", re.M)
 MARKER = "<!-- pr-overlap -->"
 FETCH_REFS = 100
+_REPO_ROOTS = {}
 
 
 def git(*args):
-    result = subprocess.run(["git", "-c", "core.quotePath=false", *args], capture_output=True)
+    cwd = Path.cwd()
+    root = _REPO_ROOTS.get(cwd)
+    if root is None:
+        root = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"], cwd=cwd, capture_output=True, check=True
+        ).stdout.decode("utf-8", errors="replace").strip()
+        _REPO_ROOTS[cwd] = root
+    args = list(args)
+    if "--" in args:
+        separator = args.index("--")
+        for index in range(separator + 1, len(args)):
+            pathspec = args[index]
+            if pathspec.startswith(("../", "..\\")):
+                absolute = (cwd / pathspec).resolve()
+                try:
+                    args[index] = absolute.relative_to(Path(root)).as_posix()
+                except ValueError:
+                    pass
+    result = subprocess.run(
+        ["git", "-c", "core.quotePath=false", *args],
+        cwd=root,
+        capture_output=True,
+    )
     result.stdout = result.stdout.decode("utf-8", errors="replace")
     result.stderr = result.stderr.decode("utf-8", errors="replace")
     result.check_returncode()
@@ -46,10 +71,10 @@ def depends_on(body):
     body = re.sub(r"<!--.*?-->", "", body or "", flags=re.S)
     repo = re.escape(globals().get("REPO", "boykopovar/AnyPS5"))
     repo_pattern = rf"(?:{repo}|boykopovar/AnyPS5)"
-    body = re.sub(rf"\[([^\]]*)\]\(https?://github\.com/{repo_pattern}/pull/(\d+)(?:[#/?][^)\s]*)?\)", r"#\2", body, flags=re.IGNORECASE)
-    body = re.sub(rf"\[([^\]]*)\]\(https?://github\.com/(?!{repo_pattern}/)[^/\s]+/[^/\s]+/pull/\d+[^)\s]*\)", "", body, flags=re.IGNORECASE)
+    body = re.sub(rf"\[([^\]]*)\]\(https?://(?:www\.)?github\.com/{repo_pattern}/pull/(\d+)(?:[#/?][^)\s]*)?\)", r"#\2", body, flags=re.IGNORECASE)
+    body = re.sub(rf"\[([^\]]*)\]\(https?://(?:www\.)?github\.com/(?!{repo_pattern}/)[^/\s]+/[^/\s]+/pull/\d+[^)\s]*\)", "", body, flags=re.IGNORECASE)
     body = re.sub(r"\[([^\]]+)\]\([^)]+\)", r"\1", body)
-    body = re.sub(rf"https?://github\.com/{repo_pattern}/pull/(\d+)\b(?:/[^\s]*)?", r"#\1", body, flags=re.IGNORECASE)
+    body = re.sub(rf"https?://(?:www\.)?github\.com/{repo_pattern}/pull/(\d+)\b(?:/[^\s]*)?", r"#\1", body, flags=re.IGNORECASE)
     match = next((match for match in DEPENDS.finditer(body) if match.group(1).strip()), None) or PLAIN_DEPENDS.search(body)
     return {int(n) for n in re.findall(r"#(\d+)", match.group(1))} if match else set()
 
@@ -91,8 +116,15 @@ def fetch(base, prs):
 
 
 def merge(*args):
+    cwd = Path.cwd()
+    root = _REPO_ROOTS.get(cwd)
+    if root is None:
+        root = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"], cwd=cwd, capture_output=True, check=True
+        ).stdout.decode("utf-8", errors="replace").strip()
+        _REPO_ROOTS[cwd] = root
     result = subprocess.run(["git", "-c", "core.quotePath=false", "merge-tree", "--write-tree", "--name-only", "--no-messages", "-z", *args],
-                            capture_output=True)
+                            cwd=root, capture_output=True)
     lines = result.stdout.decode("utf-8", errors="replace").rstrip("\0").split("\0")
     if result.returncode not in (0, 1) or not lines[0]:
         error = result.stderr.decode("utf-8", errors="replace").strip()
@@ -105,16 +137,18 @@ def commit(tree):
                "-p", "refs/pr/base", "-m", "pr_overlap").strip()
 
 
-def exports(diff):
+def exports(diff, prefix="+"):
     found = set()
     lines = diff.splitlines()
     for i, line in enumerate(lines):
-        m = EXPORT.match(line)
+        if not line.startswith(prefix) or line.startswith(prefix * 3):
+            continue
+        m = EXPORT.match(prefix + line[1:])
         if not m or m.group(1).endswith(("_nid_no_patch", "_nid_no_patch_cut")):
             continue
         text = line[1:]
         for nxt in lines[i + 1:]:
-            if ";" in text or "{" in text or not nxt.startswith("+") or nxt.startswith("+++"):
+            if ";" in text or "{" in text or not nxt.startswith(prefix) or nxt.startswith(prefix * 3):
                 break
             text += nxt[1:]
         semi, brace = text.find(";"), text.find("{")
@@ -124,19 +158,71 @@ def exports(diff):
     return found
 
 
-def aliases(diff):
-    added = "\n".join(line[1:] for line in diff.splitlines() if line.startswith("+") and not line.startswith("+++"))
-    return {nid for nid, _ in source_aliases(added)}
+def changed_source(diff, prefix):
+    files, current, path = [], [], None
+    for line in diff.splitlines():
+        if line.startswith("diff --git "):
+            if current and path:
+                files.append((path, "\n".join(current)))
+            path = line.split(" b/", 1)[1] if " b/" in line else None
+            current = []
+        elif line.startswith(prefix) and not line.startswith(prefix * 3):
+            current.append(line[1:])
+    if current and path:
+        files.append((path, "\n".join(current)))
+    return files
 
 
-def export_ids(pr):
-    return {compute_nid(name) for name in pr["exports"]} | pr.get("aliases", set())
+def library_for_path(path):
+    parts = Path(path).parts
+    return "/".join(parts[:4]) if len(parts) > 3 and parts[:3] == ("core", "libs", "prx") else ""
 
 
-def same_exports(pa, pb, shared):
-    common = (export_ids(pa) & export_ids(pb)).difference(*(export_ids(pr) for pr in shared))
-    named = {name for name in pa["exports"] | pb["exports"] if compute_nid(name) in common}
-    return named | common.difference(compute_nid(name) for name in named)
+def source_exports(text, library=""):
+    found = {}
+    for match in nid_names.source_definitions(text):
+        name = nid_names.strip_nid_postfix(match.group(1))
+        if not name.endswith(("_nid_no_patch", "_nid_no_patch_cut")):
+            found.setdefault((library, nid_names.compute_nid(name)), set()).add(name)
+    for name in nid_names.source_assembly_definitions(text):
+        name = nid_names.strip_nid_postfix(name)
+        if not name.endswith(("_nid_no_patch", "_nid_no_patch_cut")):
+            found.setdefault((library, nid_names.compute_nid(name)), set()).add(name)
+    for nid, name in nid_names.source_aliases(text):
+        found.setdefault((library, nid), set()).add(name)
+    return found
+
+
+def source_changed_exports(diff, prefix):
+    found = {}
+    for path, text in changed_source(diff, prefix):
+        library = library_for_path(path)
+        for key, names in source_exports(text, library).items():
+            found.setdefault(key, set()).update(names)
+        file_diff = "\n".join(prefix + line for line in text.splitlines())
+        for name in exports(file_diff, prefix):
+            canonical = nid_names.strip_nid_postfix(name)
+            found.setdefault((library, nid_names.compute_nid(canonical)), set()).add(canonical)
+    return found
+
+
+def base_exports(ref):
+    root = git("rev-parse", "--show-toplevel").strip()
+    archive = subprocess.run(
+        ["git", "-C", root, "archive", "--format=tar", ref, "core/libs"], capture_output=True, check=True
+    ).stdout
+    found = {}
+    with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as source:
+        for entry in source:
+            path = Path(entry.name)
+            if not entry.isfile() or path.suffix != ".cpp" or any(
+                    part.lower() in {"test", "tests"} for part in path.parts[2:-1]):
+                continue
+            text = source.extractfile(entry).read().decode("utf-8", errors="replace")
+            library = library_for_path(entry.name)
+            for key, names in source_exports(text, library).items():
+                found.setdefault(key, set()).update(names)
+    return found
 
 
 def scan(pr):
@@ -151,7 +237,8 @@ def scan(pr):
             pr["added"].add(path)
     diff = git("diff", "-U0", "--no-color", old, new, "--", "core/libs/prx/*.cpp")
     pr["exports"] = exports(diff)
-    pr["aliases"] = aliases(diff)
+    pr["added_exports"] = source_changed_exports(diff, "+")
+    pr["removed_exports"] = source_changed_exports(diff, "-")
 
 
 def scan_all(prs, jobs):
@@ -206,7 +293,7 @@ def overlaps(prs, a, b):
     found = {"added": (pa["added"] & pb["added"]).difference(*(pr["added"] for pr in shared))}
     if pa["author"] != pb["author"]:
         found["conflicts"] = conflicts(pa, pb)
-        found["exports"] = same_exports(pa, pb, shared)
+        found["exports"] = (pa["exports"] & pb["exports"]).difference(*(pr["exports"] for pr in shared))
         if not (pa["tree"] and pb["tree"]):
             uncompared = pa.get("files", set()) & pb.get("files", set())
             if uncompared:
@@ -227,9 +314,10 @@ def pull(blob, number):
     return f'[PR {number}]({blob.split("/blob/", 1)[0].replace("https://github.com/", "https://www.github.com/", 1)}/pull/{number})'
 
 
-def report(rows, blob):
+def report(rows, blob, main_exports=None):
     if not rows:
-        return ""
+        if not main_exports:
+            return ""
     confirmed = {number: found for number, found in rows.items()
                  if found.get("conflicts") or found.get("exports") or found["added"]}
     uncompared = {number: found["uncompared"] for number, found in rows.items() if found.get("uncompared")}
@@ -244,6 +332,12 @@ def report(rows, blob):
         ])
         for number, found in sorted(confirmed.items()):
             lines.append(f'| {pull(blob, number)} | {spans(found.get("conflicts"), blob)} | {cell(found.get("exports"))} | {cell(found["added"])} |')
+    if main_exports:
+        if confirmed:
+            lines.append("")
+        lines.append("Exports introduced here that are already present in `main`:")
+        lines.append("")
+        lines.append(f"- {cell(main_exports)}")
     if uncompared:
         if confirmed:
             lines.append("")
@@ -259,10 +353,24 @@ def report(rows, blob):
     return "\n".join(lines) + "\n"
 
 
-def write_reports(out, rows, blob):
+def write_reports(out, rows, blob, main_exports=None):
+    main_exports = main_exports or {}
     out.mkdir(parents=True, exist_ok=True)
     for number, found in rows.items():
-        (out / f"{number}.md").write_text(report(found, blob), encoding="utf-8")
+        (out / f"{number}.md").write_text(report(found, blob, main_exports.get(number)), encoding="utf-8")
+
+
+def main_export_findings(prs, current_exports):
+    findings = {}
+    for number, pr in prs.items():
+        candidates = set(pr.get("added_exports", {})) - set(pr.get("removed_exports", {}))
+        names = set()
+        for key in candidates & set(current_exports):
+            names.update(pr["added_exports"][key])
+            names.update(current_exports[key])
+        if names:
+            findings[number] = names
+    return findings
 
 
 def describe_failure(error):
@@ -288,10 +396,7 @@ def main(argv=None):
     if args.jobs < 1:
         parser.error("--jobs must be at least 1")
     global REPO
-    if args.out:
-        args.out = args.out.resolve()
     try:
-        os.chdir(git("rev-parse", "--show-toplevel").strip())
         REPO = args.repo or upstream()
         prs = open_prs(args.base)
         fetch(args.base, prs)
@@ -300,7 +405,9 @@ def main(argv=None):
             prs = own(prs, sha)
             prs[0] = {"ref": sha, "author": None, "depends": set()}
         scan_all(prs, args.jobs)
+        current_exports = base_exports("refs/pr/base")
         rows = {n: {} for n in prs}
+        main_exports = main_export_findings(prs, current_exports)
         pairs = [(0, n) for n in prs if n] if args.branch else combinations(prs, 2)
         for a, b in pairs:
             if found := overlaps(prs, a, b):
@@ -309,9 +416,9 @@ def main(argv=None):
     except subprocess.CalledProcessError as error:
         raise SystemExit(describe_failure(error))
     if args.branch:
-        print(report(rows[0], blob) or "No overlap with open pull requests.", end="")
+        print(report(rows[0], blob, main_exports.get(0)) or "No overlap with open pull requests.", end="")
         return 0
-    write_reports(args.out, rows, blob)
+    write_reports(args.out, rows, blob, main_exports)
     return 0
 
 
diff --git a/tools/prepare_release_notes.py b/tools/prepare_release_notes.py
index 0163999059..0b8c6c72db 100644
--- a/tools/prepare_release_notes.py
+++ b/tools/prepare_release_notes.py
@@ -3,6 +3,7 @@ import json
 import os
 import re
 import stat
+import sys
 from pathlib import Path
 
 BODY_LIMIT = 125000
@@ -26,7 +27,7 @@ def prepare_notes(source, body, full):
         for second in paths[index + 1:]:
             if first.resolve() == second.resolve() or (first.exists() and second.exists() and first.samefile(second)):
                 raise ValueError("Release note input and outputs must be distinct files")
-    notes = json.loads(source.read_text(encoding="utf-8"))["body"]
+    notes = json.loads(source.read_text(encoding="utf-8-sig"))["body"]
     if not isinstance(notes, str):
         raise ValueError("Generated release notes body must be a string")
     for destination in (body, full):
@@ -40,13 +41,21 @@ def prepare_notes(source, body, full):
     body.write_bytes(release_body(notes).encode("utf-8"))
 
 
-def main():
+def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Prepare size-safe GitHub release notes")
     parser.add_argument("--input", type=Path, required=True)
     parser.add_argument("--body", type=Path, required=True)
     parser.add_argument("--full", type=Path, required=True)
-    args = parser.parse_args()
-    prepare_notes(args.input, args.body, args.full)
+    args = parser.parse_args(argv)
+    try:
+        prepare_notes(args.input, args.body, args.full)
+    except (OSError, ValueError) as error:
+        parser.error(str(error))
+    return 0
 
 
 if __name__ == "__main__":
diff --git a/tools/progress.py b/tools/progress.py
index 153975e4d5..aaef552f7b 100644
--- a/tools/progress.py
+++ b/tools/progress.py
@@ -441,8 +441,46 @@ def compare(title, column, unit, base, head):
     return lines + [""]
 
 
+def library_progress(group):
+    if group is None:
+        return "Not present", None
+    if "shared_sources" in group:
+        return f'Shared sources: `{group["shared_sources"]}`', None
+    if "done" not in group or "todo" not in group:
+        return "Counts unavailable", None
+    total = group["done"] + group["todo"]
+    if not total:
+        return "No exports", None
+    percent = 100 * group["done"] / total
+    return f'{group["done"]}/{total} ({percent:.2f}%)', percent
+
+
+def library_report(base, head):
+    before, after = ({group["name"]: group for group in data["groups"]} for data in (base, head))
+    fields = ("done", "todo", "done_names", "todo_names", "shared_sources")
+    rows = []
+    for name in sorted(before.keys() | after.keys(), key=str.casefold):
+        old, new = before.get(name), after.get(name)
+        if old is not None and new is not None and all(old.get(field) == new.get(field) for field in fields):
+            continue
+        old_text, old_percent = library_progress(old)
+        new_text, new_percent = library_progress(new)
+        delta = "n/a"
+        if old_percent is not None and new_percent is not None:
+            delta = f'{round(new_percent - old_percent, 2) or 0:+.2f} pp'
+        rows.append(f"| {name} | {old_text} | {new_text} | {delta} |")
+    if not rows:
+        return []
+    lines = ["#### Changed libraries (implemented exports)", "",
+             "| Library | Before | After | Change |", "| - | - | - | - |"] + rows[:REPORT_ROWS]
+    if len(rows) > REPORT_ROWS:
+        lines.append(f"| ... | {len(rows) - REPORT_ROWS} more libraries | | |")
+    return lines + [""]
+
+
 def report(base, head):
     lines = compare("System libraries", "Library", "functions", base["libraries"], head["libraries"])
+    lines += library_report(base["libraries"], head["libraries"])
     lines += compare("GPU shader instructions", "Encoding", "instructions", base["shaders"], head["shaders"])
     return "\n".join(lines)
 
@@ -482,6 +520,10 @@ def validate_snapshot(snapshot):
 
 
 def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     global PRX, OPCODES
     previous = PRX, OPCODES
     parser = argparse.ArgumentParser()
@@ -501,7 +543,7 @@ def main(argv=None):
             snapshots = []
             for path in args.compare:
                 try:
-                    snapshots.append(json.loads(path.read_text(encoding="utf-8")))
+                    snapshots.append(json.loads(path.read_text(encoding="utf-8-sig")))
                 except (OSError, ValueError) as error:
                     parser.error(f"{path}: {error}")
             for path, snapshot in zip(args.compare, snapshots):
@@ -541,6 +583,4 @@ def main(argv=None):
 
 
 if __name__ == "__main__":
-    if hasattr(sys.stdout, "reconfigure"):
-        sys.stdout.reconfigure(encoding="utf-8")
     raise SystemExit(main())
diff --git a/tools/progress_history.py b/tools/progress_history.py
index b223ab7c58..e98eaa5df8 100644
--- a/tools/progress_history.py
+++ b/tools/progress_history.py
@@ -25,8 +25,13 @@ def git(*args):
 
 
 def daily_commits(ref):
+    try:
+        log = git("log", "--first-parent", "--format=%H %ct", ref)
+    except subprocess.CalledProcessError as error:
+        reason = error.stderr.decode("utf-8", errors="replace").strip()
+        raise ValueError(f"cannot read the history of {ref}: {reason}") from error
     seen = {}
-    for line in git("log", "--first-parent", "--format=%H %ct", ref).decode("utf-8").splitlines():
+    for line in log.decode("utf-8").splitlines():
         sha, timestamp = line.split()
         seen.setdefault(datetime.fromtimestamp(int(timestamp), timezone.utc).date().isoformat(), sha)
     return sorted(seen.items())
diff --git a/tools/run_job_manager_reference.py b/tools/run_job_manager_reference.py
new file mode 100644
index 0000000000..705d0e1228
--- /dev/null
+++ b/tools/run_job_manager_reference.py
@@ -0,0 +1,155 @@
+import argparse
+import hashlib
+import json
+import os
+import shutil
+import struct
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+from import_audit import read_host_imports
+from unwrap_self import Refused, unwrap
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "core/relinker/relinker/tests"))
+from guest_import_fixtures import executable
+
+CASES = ("memory", "owned_state", "concurrent_wait", "validation", "dispatch", "ordering", "nested", "limits", "node_pool", "priority", "shutdown", "worker_policy", "worker_wake", "worker_wait", "worker_count", "worker_spin")
+PARITY_CASES = tuple(case for case in CASES if case not in ("node_pool", "worker_wait"))
+
+
+def stage_libraries(directory, build, toolchain, dependencies):
+    providers = {path.name.lower(): path for path in (build / "core/libs/libs").glob("*.prx")}
+    if toolchain is not None:
+        providers.update({path.name.lower(): path for path in toolchain.glob("*.dll")})
+    pending = list(dependencies)
+    staged = set()
+    while pending:
+        name = pending.pop().lower()
+        if name in staged:
+            continue
+        staged.add(name)
+        source = providers.get(name)
+        if source is None:
+            if name.endswith(".prx"):
+                raise RuntimeError(f"Missing patched runtime {name}; build core/libs/libs/{name}")
+            continue
+        shutil.copy2(source, directory / source.name)
+        pending.extend(read_host_imports(source))
+
+
+def run(args, directory):
+    libraries = directory / "libs"
+    libraries.mkdir()
+    helper = args.build / "tests/job_manager_reference.prx"
+    if not helper.is_file():
+        raise RuntimeError("Build the job_manager_reference target first")
+    shutil.copy2(helper, libraries / "jobref.prx")
+    suffix = ".exe" if sys.platform == "win32" else ""
+    subprocess.run([str(args.build / f"core/libs/nid_patcher{suffix}"), "jobref", "--preserve-export-list",
+                    str(args.build / "core/libs/libc.exports"), str(libraries / "jobref.prx")], check=True, capture_output=True)
+    module_hash = None
+    if args.module:
+        module_data = args.module.read_bytes()
+        module_hash = hashlib.sha256(module_data).hexdigest()
+        modules = directory / "sce_module"
+        modules.mkdir()
+        target = modules / "libSceJobManager.prx"
+        if module_data[:4] == b"\x7fELF":
+            shutil.copy2(args.module, target)
+        else:
+            unwrap(args.module, target)
+    source = directory / "input.elf"
+    entry = executable("jobref.prx", symbol="Run_nid_no_patch")
+    entry[0x4000:0x400f] = b"\x48\x83\xec\x08\xff\x15" + struct.pack("<i", 0x4a20 - 0x400a) + b"\x48\x83\xc4\x08\xc3"
+    source.write_bytes(entry)
+    output = directory / f"reference{suffix}"
+    options = ["--skip-sce-module"] if args.host else []
+    platform = ["--windows"] if sys.platform == "win32" else []
+    result = subprocess.run([str(args.relinker), *platform, "--registry", *options, str(source), str(output)],
+                            cwd=directory, capture_output=True, timeout=60)
+    (directory / "relink.log").write_bytes(result.stdout + result.stderr)
+    if result.returncode:
+        raise RuntimeError(f"Relinker failed ({result.returncode}); see {directory / 'relink.log'}")
+    if sys.platform != "win32":
+        output.chmod(output.stat().st_mode | 0o111)
+    dependencies = set(read_host_imports(helper)) | {"libc.prx"}
+    for registry in directory.glob("*.registry.json"):
+        dependencies.update(entry["library"] for entry in json.loads(registry.read_text())
+                            if entry.get("library") not in ("jobref.prx", "libSceJobManager.prx"))
+    if args.host:
+        dependencies.add("libSceJobManager.prx")
+    stage_libraries(libraries, args.build, args.toolchain, dependencies)
+    environment = os.environ.copy()
+    environment["PATH"] = str(libraries) + os.pathsep + environment.get("PATH", "")
+    if sys.platform != "win32":
+        environment["LD_LIBRARY_PATH"] = str(libraries) + os.pathsep + environment.get("LD_LIBRARY_PATH", "")
+    environment.pop("ANYPS5_JOB_MANAGER_HOST", None)
+    if args.host:
+        environment["ANYPS5_JOB_MANAGER_HOST"] = "1"
+    results = []
+    for case in args.cases:
+        environment["ANYPS5_JOB_MANAGER_CASE"] = case
+        try:
+            result = subprocess.run([str(output)], cwd=directory, env=environment,
+                                    capture_output=True, timeout=args.timeout)
+            log = result.stdout + result.stderr
+            status = "passed" if result.returncode == 0 else "failed"
+            code = result.returncode
+        except subprocess.TimeoutExpired as error:
+            log = (error.stdout or b"") + (error.stderr or b"")
+            status, code = "timeout", None
+        (directory / f"{case}.log").write_bytes(log)
+        results.append({"case": case, "status": status, "returncode": code})
+        print(json.dumps(results[-1]), flush=True)
+    summary = {"provider": "host" if args.host else "guest", "module_sha256": module_hash,
+               "selection": getattr(args, "suite", None) or "custom",
+               "excluded_cases": [case for case in CASES if case not in args.cases], "cases": results}
+    (directory / "results.json").write_text(json.dumps(summary, indent=2) + "\n")
+    return 0 if all(result["status"] == "passed" for result in results) else 1
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Run the CPU JobManager fixtures through native relinker startup using an owned module or the host fallback.")
+    provider = parser.add_mutually_exclusive_group(required=True)
+    provider.add_argument("--module", type=Path, help="Owned decrypted SELF or ELF libSceJobManager.prx")
+    provider.add_argument("--host", action="store_true", help="Validate the runner against the built host fallback")
+    parser.add_argument("--build", type=Path, required=True)
+    parser.add_argument("--relinker", type=Path, required=True)
+    parser.add_argument("--toolchain", type=Path, help="Directory containing the matching compiler runtime DLLs (required on Windows)")
+    parser.add_argument("--output", type=Path, help="New directory for staged modules, per-case logs and results.json; defaults to a temporary directory")
+    selection = parser.add_mutually_exclusive_group()
+    selection.add_argument("--cases", nargs="+", choices=CASES)
+    selection.add_argument("--suite", choices=("all", "parity"), help="all runs every case (default); parity excludes original-module node_pool and worker_wait stalls with host kernel services")
+    parser.add_argument("--timeout", type=float, default=20)
+    args = parser.parse_args()
+    if args.cases is None:
+        args.suite = args.suite or "all"
+        args.cases = list(PARITY_CASES if args.suite == "parity" else CASES)
+    if sys.platform not in ("win32", "linux"):
+        parser.error("The reference adapter supports Windows and Linux")
+    if sys.platform == "win32" and args.toolchain is None:
+        parser.error("--toolchain is required on Windows")
+    if args.timeout <= 0 or args.timeout > 30:
+        parser.error("--timeout must be greater than zero and at most 30 seconds")
+    try:
+        for name in ("build", "relinker", "toolchain", "module"):
+            value = getattr(args, name)
+            if value is not None:
+                setattr(args, name, value.resolve(strict=True))
+        directory = args.output.resolve() if args.output else Path(tempfile.mkdtemp(prefix="anyps5-jobmanager-"))
+        if args.output:
+            directory.mkdir(parents=True, exist_ok=False)
+        print(f"Artifacts: {directory}", flush=True)
+        return run(args, directory)
+    except (OSError, Refused, RuntimeError, subprocess.SubprocessError) as error:
+        print(str(error), file=sys.stderr)
+        if isinstance(error, subprocess.CalledProcessError) and error.stderr:
+            print(error.stderr.decode(errors="replace"), file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/select_tests.py b/tools/select_tests.py
index 80005e556d..8d3563274a 100644
--- a/tools/select_tests.py
+++ b/tools/select_tests.py
@@ -89,6 +89,10 @@ class Build:
                 leaves.add(name)
         return sorted(leaves)
 
+    def outputs(self, paths):
+        built = {line.rpartition(": ")[0] for line in self.run("-t", "targets", "all").splitlines()}
+        return [path for path in paths if path in built]
+
     def tests(self, *arguments):
         listing = json.loads(subprocess.run(["ctest", "--test-dir", self.path, "--show-only=json-v1", *arguments],
                                             capture_output=True, text=True, check=True).stdout)
@@ -143,14 +147,24 @@ def relative(path, root):
     return path[root_len + 1:].replace(os.sep, "/")
 
 
+def paths(arguments):
+    for argument in arguments:
+        value = argument.partition("=")[2] if argument.startswith("-D") else argument
+        if os.path.isabs(value):
+            yield value
+
+
 def chunks(names):
     batch, size = [], 0
     for name in names:
-        if batch and size + len(name) + 1 > BATCH:
+        length = len(name) + 1
+        if sys.platform == "win32":
+            length = len(subprocess.list2cmdline([name]).encode("utf-16-le", "surrogatepass")) // 2 + 1
+        if batch and size + length > BATCH:
             yield batch
             batch, size = [], 0
         batch.append(name)
-        size += len(name) + 1
+        size += length
     if batch:
         yield batch
 
@@ -158,11 +172,12 @@ def chunks(names):
 def dump(build, out):
     deps = collections.defaultdict(set)
     current = None
-    for line in build.run("-t", "deps").splitlines():
-        if not line.startswith(" ") and ": #deps" in line:
-            current = build.key(line.split(": #deps")[0])
+    recorded = subprocess.run([build.program, "-C", build.path, "-t", "deps"], capture_output=True, check=True).stdout
+    for line in recorded.splitlines():
+        if not line.startswith(b" ") and b": #deps" in line:
+            current = build.key(line.split(b": #deps")[0].decode(build.encoding))
         elif line.strip() and current:
-            path = build.repo(line.strip())
+            path = build.repo(line.strip().decode("utf-8"))
             if path:
                 deps[current].add(path)
     listing, listed = build.tests()
@@ -190,7 +205,7 @@ def dump(build, out):
             registered.add(build.repo(graph["files"][graph["nodes"][node]["file"]]))
             node = graph["nodes"][node].get("parent")
         props = {p["name"]: p["value"] for p in test.get("properties", [])}
-        arguments = sorted({build.repo(a) for a in (test.get("command") or [])[1:] if os.path.isabs(a)} - {None})
+        arguments = sorted({build.repo(a) for a in paths((test.get("command") or [])[1:])} - {None})
         tests[test["name"]] = {"registered": sorted(registered - {None}), "arguments": arguments,
                                "requires": props.get("FIXTURES_REQUIRED", []), "sets": props.get("FIXTURES_SETUP", []),
                                "depends": props.get("DEPENDS", []), "target": build.target(test)}
@@ -251,9 +266,10 @@ def plan(build, graph, picked):
     run = [i for i, t in enumerate(listed, 1) if t["name"] in names]
     if any(not t.get("command") for t in listed if t["name"] in names):
         return run, build.leaves(), len(listed)
-    keep = {build.output(a) for t in listed if t["name"] in names for a in t.get("command") or [] if os.path.isabs(a)}
+    keep = {build.output(a) for t in listed if t["name"] in names for a in paths(t.get("command") or [])}
     skip = {build.target(t) for t in listed if t["name"] not in names} - keep - {None}
-    return run, [t for t in build.leaves() if t not in skip], len(listed)
+    targets = [t for t in build.leaves() if t not in skip]
+    return run, targets + build.outputs(sorted(keep - set(targets) - {None})), len(listed)
 
 
 def escape(name):
@@ -263,7 +279,7 @@ def escape(name):
 def main(argv=None):
     for stream in (sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Select the tests whose build inputs a change touches")
     sub = parser.add_subparsers(dest="command", required=True)
     d = sub.add_parser("dump", help="write the test graph of a built tree")
diff --git a/tools/stubgen.py b/tools/stubgen.py
index 7426cd8aa2..436233cb23 100644
--- a/tools/stubgen.py
+++ b/tools/stubgen.py
@@ -187,7 +187,7 @@ def write_outputs(outputs):
             path = Path(filename).resolve()
             if path.is_dir():
                 raise IsADirectoryError(str(path))
-            with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", newline="\n", dir=path.parent, prefix=path.name + ".", suffix=".tmp", delete=False) as handle:
+            with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", newline="\n", dir=path.parent, prefix=".stubgen-", suffix=".tmp", delete=False) as handle:
                 temporary = Path(handle.name)
                 staged.append((temporary, path))
                 handle.write(content)
diff --git a/tools/suggest_patches.py b/tools/suggest_patches.py
new file mode 100644
index 0000000000..f927d31dc6
--- /dev/null
+++ b/tools/suggest_patches.py
@@ -0,0 +1,209 @@
+import argparse
+import hashlib
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+import tomllib
+from pathlib import Path, PurePosixPath
+
+
+SHA256 = re.compile(r"[0-9a-fA-F]{64}\Z")
+VERIFY_SUMMARY = re.compile(r"^Verified (\d+) patches: (\d+) ok, (\d+) not-checked, (\d+) mismatch$", re.MULTILINE)
+
+
+def confined(root, name):
+    if not isinstance(name, str) or not name or "\\" in name:
+        raise ValueError(f"invalid relative path: {name!r}")
+    path = PurePosixPath(name)
+    if path.is_absolute() or any(part in (".", "..") for part in name.split("/")):
+        raise ValueError(f"invalid relative path: {name!r}")
+    resolved = (root / Path(*path.parts)).resolve()
+    if not resolved.is_relative_to(root.resolve()) or not resolved.is_file():
+        raise ValueError(f"file missing or outside directory: {name}")
+    return resolved
+
+
+def sha256(path):
+    digest = hashlib.sha256()
+    with path.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def command_line(arguments):
+    return subprocess.list2cmdline(arguments) if os.name == "nt" else shlex.join(arguments)
+
+
+def conversion_options(args, patch):
+    options = ["--patches", str(patch)]
+    if args.skip_sce_module:
+        options.append("--skip-sce-module")
+    if args.sce_module_path:
+        options.extend(("--sce-module-path", str(args.sce_module_path)))
+    for module_dir in args.module_dir:
+        options.extend(("--module-dir", module_dir))
+    for executable in args.executable:
+        options.extend(("--executable", executable))
+    return command_line(options)
+
+
+def load_catalog(directory, title, version):
+    data = json.loads(confined(directory, "index.json").read_text(encoding="utf-8"))
+    if not isinstance(data, dict) or set(data) != {"format", "entries"} or type(data["format"]) is not int or data["format"] != 1 or not isinstance(data["entries"], list):
+        raise ValueError("catalog must have format 1 and an entries array")
+    entries = []
+    for number, entry in enumerate(data["entries"], 1):
+        if not isinstance(entry, dict) or (entry.get("titleId"), entry.get("contentVersion")) != (title, version):
+            continue
+        entries.append((number, entry))
+    return entries
+
+
+def validate_entry(directory, entry):
+    if set(entry) != {"titleId", "contentVersion", "patch", "targets"}:
+        raise ValueError("invalid fields")
+    patch = confined(directory, entry["patch"])
+    targets = entry["targets"]
+    if not isinstance(targets, dict) or not targets:
+        raise ValueError("targets must be a nonempty object")
+    if any(not isinstance(name, str) or not isinstance(digest, str) or not SHA256.fullmatch(digest) for name, digest in targets.items()):
+        raise ValueError("invalid target digest")
+    parsed = tomllib.loads(patch.read_text(encoding="utf-8"))
+    patches = parsed.get("patch")
+    if not isinstance(patches, list) or not patches or any(not isinstance(item, dict) or not isinstance(item.get("target"), str) for item in patches):
+        raise ValueError("patch file has no valid targets")
+    if set(targets) != {item["target"] for item in patches}:
+        raise ValueError("target hashes must cover exactly the patch targets")
+    return patch, {name: digest.lower() for name, digest in targets.items()}
+
+
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
+    parser = argparse.ArgumentParser(description="Recommend a local patch only after metadata, hashes and relinker verification match")
+    parser.add_argument("--catalog", required=True, type=Path, help="directory containing index.json and patch files")
+    parser.add_argument("--param-json", required=True, type=Path, help="title metadata file")
+    parser.add_argument("--input", required=True, type=Path, help="unwrapped main ELF")
+    parser.add_argument("--relinker", required=True, type=Path, help="relinker executable to run")
+    parser.add_argument("--sce-module-path", type=Path, help="parent directory of bundled modules")
+    parser.add_argument("--module-dir", action="append", default=[], help="module directory relative to the module parent; repeatable")
+    parser.add_argument("--executable", action="append", default=[], help="additional title executable relative to the module parent; repeatable")
+    parser.add_argument("--skip-sce-module", action="store_true", help="skip bundled modules during verification")
+    parser.add_argument("--timeout-seconds", type=int, default=120, help="maximum seconds per relinker verification (default: 120)")
+    parser.add_argument("--list-verified", action="store_true", help="list every verified catalog entry without choosing one")
+    args = parser.parse_args(argv)
+    prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
+    try:
+        metadata = json.loads(args.param_json.read_text(encoding="utf-8"))
+        if not isinstance(metadata, dict):
+            raise ValueError("param.json must be an object")
+        title = metadata.get("titleId")
+        version = metadata.get("contentVersion")
+        if not isinstance(title, str) or not title or not isinstance(version, str) or not version:
+            raise ValueError("param.json needs nonempty titleId and contentVersion")
+        if not args.input.is_file() or not args.relinker.is_file():
+            raise ValueError("input and relinker must be files")
+        if args.skip_sce_module and args.sce_module_path:
+            raise ValueError("--skip-sce-module conflicts with --sce-module-path")
+        if args.timeout_seconds <= 0:
+            raise ValueError("timeout-seconds must be positive")
+        root = (args.sce_module_path or args.input.parent).resolve()
+        if not root.is_dir():
+            raise ValueError("module parent must be a directory")
+        for executable in args.executable:
+            confined(root, executable)
+        matches = []
+        entries = load_catalog(args.catalog.resolve(), title, version)
+        if not entries:
+            print(f"{prefix}: no catalog entry for {title} {version}.")
+            return 1
+        relinker_errors = False
+        for number, entry in entries:
+            label = f"Catalog entry {number} ({entry.get('patch')!r})"
+            try:
+                patch, targets = validate_entry(args.catalog.resolve(), entry)
+            except (OSError, ValueError, tomllib.TOMLDecodeError) as error:
+                print(f"{label}: rejected: {error}")
+                continue
+            errors = []
+            for name, expected in targets.items():
+                try:
+                    source = args.input.resolve() if name == args.input.name else confined(root, name)
+                    actual = sha256(source)
+                    if actual != expected:
+                        errors.append(f"{name}: SHA-256 mismatch ({actual})")
+                except (OSError, ValueError) as error:
+                    errors.append(f"{name}: {error}")
+            if errors:
+                print(f"{label}: rejected: {'; '.join(errors)}")
+                continue
+            command = [str(args.relinker.resolve()), "--verify-patches", str(patch)]
+            if args.skip_sce_module:
+                command.append("--skip-sce-module")
+            if args.sce_module_path:
+                command.extend(("--sce-module-path", str(args.sce_module_path)))
+            for module_dir in args.module_dir:
+                command.extend(("--module-dir", module_dir))
+            for executable in args.executable:
+                command.extend(("--executable", executable))
+            command.append(str(args.input))
+            try:
+                result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8", errors="replace",
+                                        timeout=args.timeout_seconds)
+            except subprocess.TimeoutExpired:
+                print(f"{label}: rejected: relinker verification exceeded {args.timeout_seconds} seconds")
+                continue
+            summary = VERIFY_SUMMARY.search(result.stdout)
+            verified = tuple(map(int, summary.groups())) if summary else None
+            if result.returncode:
+                detail = (result.stdout + result.stderr).strip()
+                if result.returncode == 1 and verified and verified[3] > 0:
+                    print(f"{label}: rejected by relinker: {detail}")
+                    continue
+                if result.returncode == 2:
+                    print(f"{label}: relinker error (exit 2): {detail}")
+                    relinker_errors = True
+                    continue
+                raise ValueError(f"{label}: relinker error (exit {result.returncode}): {detail}")
+            if not verified:
+                raise ValueError(f"{label}: relinker produced no verification summary")
+            if verified[0] == 0 or verified[1] != verified[0] or verified[2] or verified[3]:
+                print(f"{label}: rejected: relinker did not confirm every patch")
+                continue
+            matches.append((number, entry, patch, targets))
+        if args.list_verified and matches:
+            print(f"Verified catalog entries: {len(matches)}")
+            print("Choose one patch file; listed entries are not combined.")
+            for number, entry, patch, targets in matches:
+                print(f"Catalog entry {number}: {patch}")
+                for name, digest in targets.items():
+                    print(f"  {name} SHA-256 {digest}")
+                print(f"Use these options when converting:\n  {conversion_options(args, patch)}")
+            return 0
+        if len(matches) == 1:
+            number, entry, patch, targets = matches[0]
+            print(f"Recommended: {patch} (catalog entry {number})")
+            for name, digest in targets.items():
+                print(f"  {name} SHA-256 {digest}")
+            print(f"Use these options when converting:\n  {conversion_options(args, patch)}")
+            return 0
+        if len(matches) > 1:
+            print("No recommendation: multiple verified catalog entries match; use --list-verified to see them.")
+            return 1
+        if relinker_errors:
+            print(f"{prefix}: relinker errors occurred; see catalog entries above.", file=sys.stderr)
+            return 2
+        print(f"{prefix}: no catalog entry passed all checks.")
+        return 1
+    except (OSError, ValueError, json.JSONDecodeError, tomllib.TOMLDecodeError) as error:
+        print(f"Patch advisor: {error}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/symbolize_samples.py b/tools/symbolize_samples.py
new file mode 100644
index 0000000000..f61b586e53
--- /dev/null
+++ b/tools/symbolize_samples.py
@@ -0,0 +1,300 @@
+import argparse
+import bisect
+import collections
+import shutil
+import struct
+import subprocess
+import sys
+from pathlib import Path
+
+DESCRIPTION = """Symbolize the output of the Windows samplers (APS5_SAMPLE_WORKER, APS5_SAMPLE_COMMITTER and
+APS5_SAMPLE_THREADS) against the modules that ran. Each sampled frame is written as module+0xRVA; this reads the
+COFF symbol table of each module found in --libs (the MinGW-built .prx and .dll files keep one), or its export
+table when it has none, and names every frame module!function.
+
+The '# module name size timestamp' header lines the samplers write are compared with the SizeOfImage and
+TimeDateStamp of the file that is found; a module whose file does not match is left unsymbolized, since its
+addresses would name the wrong functions.
+
+The sampler rewrites its files every 20 s with totals since start-up. --since takes an earlier copy of the same
+file and subtracts it, which keeps only the samples taken between the two copies (a steady-state window).
+
+A module with no such record is also left unsymbolized, since nothing shows which build it was; --unverified
+symbolizes it anyway against the file found.
+
+Input: a collapsed-stack file (<file stem>.collapsed.txt, 'frame;...;frame count' lines) or an address file
+('module offset self inclusive' lines, under 'thread <id> samples <n>' headings for APS5_SAMPLE_THREADS; --thread
+keeps one thread). Output: the hottest functions by self and by inclusive samples, and with --out a symbolized
+collapsed-stack file for speedscope.app or flamegraph.pl. For an address file, a function's inclusive count is the
+sum of its addresses' counts, which overcounts the samples in which it is on the stack more than once."""
+
+IMAGE_SCN_CNT_CODE = 0x20
+IMAGE_SYM_CLASS_EXTERNAL = 2
+IMAGE_SYM_CLASS_STATIC = 3
+
+
+class PeModule:
+    def __init__(self, path):
+        data = Path(path).read_bytes()
+        if data[:2] != b"MZ":
+            raise ValueError(f"{path}: not a PE file")
+        pe = struct.unpack_from("<I", data, 0x3C)[0]
+        if data[pe:pe + 4] != b"PE\0\0":
+            raise ValueError(f"{path}: not a PE file")
+        _, sections, self.timestamp, symbol_table, symbol_count, optional_size, _ = struct.unpack_from("<HHIIIHH", data, pe + 4)
+        optional = pe + 24
+        if struct.unpack_from("<H", data, optional)[0] != 0x20B:
+            raise ValueError(f"{path}: not a PE32+ image")
+        self.image_base = struct.unpack_from("<Q", data, optional + 24)[0]
+        self.size = struct.unpack_from("<I", data, optional + 56)[0]
+        export_rva, export_size = struct.unpack_from("<II", data, optional + 112)
+        self.sections = []
+        for index in range(sections):
+            entry = optional + optional_size + index * 40
+            virtual_size, rva, raw_size, raw_pointer = struct.unpack_from("<IIII", data, entry + 8)
+            characteristics = struct.unpack_from("<I", data, entry + 36)[0]
+            self.sections.append((rva, max(virtual_size, raw_size), raw_pointer, characteristics))
+        symbols = self.coff_symbols(data, symbol_table, symbol_count) if symbol_table and symbol_count else []
+        self.exported = not symbols
+        if self.exported and export_rva:
+            symbols = self.export_symbols(data, export_rva, export_size)
+        symbols.sort()
+        self.code = []
+        for start, size, _, characteristics in self.sections:
+            if not characteristics & IMAGE_SCN_CNT_CODE:
+                continue
+            inside = [(address, name) for address, name in symbols if start <= address < start + size]
+            self.code.append((start, start + size, [address for address, _ in inside], [name for _, name in inside]))
+        self.names = [name for _, name in symbols]
+
+    def offset(self, rva):
+        for start, size, raw, _ in self.sections:
+            if start <= rva < start + size:
+                return raw + rva - start
+        raise ValueError(f"RVA {rva:#x} is in no section")
+
+    def coff_symbols(self, data, table, count):
+        strings = table + count * 18
+        result = []
+        index = 0
+        while index < count:
+            entry = table + index * 18
+            name, value, section, kind, storage, aux = struct.unpack_from("<8sIhHBB", data, entry)
+            index += 1 + aux
+            if storage not in (IMAGE_SYM_CLASS_EXTERNAL, IMAGE_SYM_CLASS_STATIC) or not 1 <= section <= len(self.sections):
+                continue
+            start, _, _, characteristics = self.sections[section - 1]
+            if not characteristics & IMAGE_SCN_CNT_CODE:
+                continue
+            if storage == IMAGE_SYM_CLASS_STATIC and (kind >> 4) != 2 and value == 0:
+                continue
+            if name[:4] == b"\0\0\0\0":
+                at = strings + struct.unpack_from("<I", name, 4)[0]
+                end = data.index(b"\0", at)
+                text = data[at:end]
+            else:
+                text = name.rstrip(b"\0")
+            result.append((start + value, text.decode("utf-8", "replace")))
+        return result
+
+    def export_symbols(self, data, rva, size):
+        directory = self.offset(rva)
+        _, names, function_rva, name_rva, ordinal_rva = struct.unpack_from("<IIIII", data, directory + 20)
+        function_table = self.offset(function_rva)
+        result = []
+        if names:
+            name_table = self.offset(name_rva)
+            ordinal_table = self.offset(ordinal_rva)
+            for index in range(names):
+                ordinal = struct.unpack_from("<H", data, ordinal_table + index * 2)[0]
+                address = struct.unpack_from("<I", data, function_table + ordinal * 4)[0]
+                if rva <= address < rva + size:
+                    continue
+                at = self.offset(struct.unpack_from("<I", data, name_table + index * 4)[0])
+                result.append((address, data[at:data.index(b"\0", at)].decode("utf-8", "replace")))
+        return result
+
+    def name(self, rva):
+        for start, end, addresses, names in self.code:
+            if start <= rva < end:
+                index = bisect.bisect_right(addresses, rva) - 1
+                return None if index < 0 else ("~" if self.exported else "") + names[index]
+        return None
+
+
+class Symbolizer:
+    def __init__(self, libs, headers, demangle=False, warn=print, unverified=False):
+        self.files = {}
+        for directory in libs:
+            for path in Path(directory).iterdir():
+                if path.is_file():
+                    self.files.setdefault(path.name.lower(), path)
+        self.headers = headers
+        self.modules = {}
+        self.demangle = demangle and shutil.which("c++filt") is not None
+        self.demangled = {}
+        self.warn = warn
+        self.unverified = unverified
+
+    def module(self, name):
+        if name in self.modules:
+            return self.modules[name]
+        module = None
+        path = self.files.get(name.lower())
+        if path is not None:
+            try:
+                module = PeModule(path)
+            except (ValueError, struct.error) as error:
+                self.warn(f"{name}: {error}")
+            if module is not None and name not in self.headers and not self.unverified:
+                self.warn(f"{name}: the samples have no '# module' record for it, so {path} may be another build; its frames stay unsymbolized (--unverified symbolizes them anyway)")
+                module = None
+            if module is not None and name in self.headers and self.headers[name] != (module.size, module.timestamp):
+                size, timestamp = self.headers[name]
+                self.warn(f"{name}: the sampled module had size {size:#x} and timestamp {timestamp:#x}, but {path} has {module.size:#x} and {module.timestamp:#x}; its frames stay unsymbolized")
+                module = None
+        self.modules[name] = module
+        return module
+
+    def frame(self, frame):
+        name, separator, offset = frame.partition("+0x")
+        if not separator:
+            return frame
+        module = self.module(name)
+        if module is None:
+            return frame
+        try:
+            symbol = module.name(int(offset, 16))
+        except ValueError:
+            return frame
+        if symbol is None:
+            return frame
+        return f"{name}!{self.pretty(symbol)}"
+
+    def pretty(self, symbol):
+        if not self.demangle or not symbol.lstrip("~").startswith("_Z"):
+            return symbol
+        if symbol not in self.demangled:
+            plain = symbol.lstrip("~")
+            result = subprocess.run(["c++filt", plain], capture_output=True, text=True)
+            text = result.stdout.strip() if result.returncode == 0 and result.stdout.strip() else plain
+            self.demangled[symbol] = ("~" if symbol.startswith("~") else "") + text
+        return self.demangled[symbol]
+
+
+def read_headers(lines):
+    headers = {}
+    for line in lines:
+        parts = line.split()
+        if len(parts) == 5 and parts[:2] == ["#", "module"]:
+            headers[parts[2]] = (int(parts[3], 16), int(parts[4], 16))
+    return headers
+
+
+class Samples:
+    def __init__(self):
+        self.headers = {}
+        self.stacks = collections.Counter()
+        self.self_counts = collections.Counter()
+        self.inclusive = collections.Counter()
+        self.total = collections.Counter()
+
+
+def load(path, thread=None):
+    lines = Path(path).read_text(encoding="utf-8-sig").splitlines()
+    samples = Samples()
+    samples.headers = read_headers(lines)
+    current = None
+    for number, line in enumerate(lines, 1):
+        parts = line.split()
+        if len(parts) == 3 and parts[0] == "#" and parts[2] == "samples" and parts[1].isdigit():
+            samples.total["samples"] += int(parts[1])
+            continue
+        if line.startswith("#") or not line.strip():
+            continue
+        if len(parts) == 4 and parts[0] == "thread" and parts[2] == "samples" and parts[1].isdigit() and parts[3].isdigit():
+            current = parts[1]
+            if thread is None or current == thread:
+                samples.total["threads"] += int(parts[3])
+            continue
+        if len(parts) == 4 and parts[1].startswith("0x") and parts[2].isdigit() and parts[3].isdigit():
+            if thread is None or current == thread:
+                samples.self_counts[(parts[0], parts[1])] += int(parts[2])
+                samples.inclusive[(parts[0], parts[1])] += int(parts[3])
+            continue
+        frames, _, count = line.rpartition(" ")
+        if not frames or not count.isdigit():
+            raise ValueError(f"{path}:{number}: expected 'frame;...;frame count', 'module offset self inclusive' or 'thread <id> samples <n>'")
+        samples.stacks[frames] += int(count)
+    return samples
+
+
+def subtract(later, earlier):
+    result = collections.Counter(later)
+    result.subtract(earlier)
+    return collections.Counter({key: count for key, count in result.items() if count > 0})
+
+
+def window(later, earlier):
+    result = Samples()
+    result.headers = {**earlier.headers, **later.headers}
+    for name in ("stacks", "self_counts", "inclusive", "total"):
+        setattr(result, name, subtract(getattr(later, name), getattr(earlier, name)))
+    return result
+
+
+def summarize(symbolizer, samples, top):
+    self_counts = collections.Counter()
+    inclusive = collections.Counter()
+    total = 0
+    if samples.stacks:
+        for frames, count in samples.stacks.items():
+            names = [symbolizer.frame(frame) for frame in frames.split(";")]
+            total += count
+            self_counts[names[-1]] += count
+            for name in set(names):
+                inclusive[name] += count
+    else:
+        for (module, offset), count in samples.self_counts.items():
+            self_counts[symbolizer.frame(f"{module}+{offset}")] += count
+        for (module, offset), count in samples.inclusive.items():
+            inclusive[symbolizer.frame(f"{module}+{offset}")] += count
+        total = samples.total["threads"] or samples.total["samples"] or sum(samples.self_counts.values())
+    lines = [f"{total} samples"]
+    for title, counter in (("self", self_counts), ("inclusive", inclusive)):
+        if not counter:
+            continue
+        lines.append(f"hottest by {title}:")
+        for name, count in counter.most_common(top):
+            lines.append(f"  {count:8d} {100.0 * count / total if total else 0.0:5.1f}%  {name}")
+    return lines
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=DESCRIPTION, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("samples", help="collapsed-stack file or address file written by a Windows sampler")
+    parser.add_argument("--libs", action="append", required=True, help="directory holding the modules that ran (repeatable)")
+    parser.add_argument("--since", help="an earlier copy of the same file, subtracted to keep the samples taken after it")
+    parser.add_argument("--out", help="write the symbolized collapsed stacks to this file")
+    parser.add_argument("--top", type=int, default=30, help="functions listed per table (default 30)")
+    parser.add_argument("--demangle", action="store_true", help="demangle C++ names with c++filt when it is on PATH")
+    parser.add_argument("--thread", help="keep only this thread of an APS5_SAMPLE_THREADS file")
+    parser.add_argument("--unverified", action="store_true", help="also symbolize modules the samples have no '# module' record for")
+    args = parser.parse_args(argv)
+    samples = load(args.samples, args.thread)
+    if args.since:
+        samples = window(samples, load(args.since, args.thread))
+    symbolizer = Symbolizer(args.libs, samples.headers, args.demangle, warn=lambda text: print("warning: " + text, file=sys.stderr), unverified=args.unverified)
+    for line in summarize(symbolizer, samples, args.top):
+        print(line)
+    if args.out:
+        if not samples.stacks:
+            parser.error("--out needs a collapsed-stack file")
+        with open(args.out, "w", encoding="utf-8") as output:
+            for frames, count in samples.stacks.items():
+                output.write(";".join(symbolizer.frame(frame) for frame in frames.split(";")) + f" {count}\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/test_web.py b/tools/test_web.py
index 9da700335f..03fe29a0c7 100644
--- a/tools/test_web.py
+++ b/tools/test_web.py
@@ -26,7 +26,9 @@ def main(argv=None):
     if not archive.is_file():
         parser.error(f"archive module does not exist: {archive}")
     try:
-        subprocess.run(["node", "--test", str(ROOT / "demo/web/tests/output-directory.test.mjs")], check=True)
+        subprocess.run(["node", "--test", *(str(ROOT / "demo/web/tests" / name) for name in (
+            "app.test.mjs", "batch.test.mjs", "output-directory.test.mjs"
+        ))], check=True)
         with tempfile.TemporaryDirectory(prefix="anyps5-web-") as directory:
             fixture = Path(directory)
             (fixture / "main.elf").write_bytes(main_fixture())
diff --git a/tools/tests/test_audit_dump.py b/tools/tests/test_audit_dump.py
new file mode 100644
index 0000000000..1578239720
--- /dev/null
+++ b/tools/tests/test_audit_dump.py
@@ -0,0 +1,392 @@
+import contextlib
+import io
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path, PureWindowsPath
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import audit_dump
+import unwrap_self
+
+SELF = b"\x4f\x15\x3d\x1d" + b"\0" * 60
+ELF = b"\x7fELF" + b"\0" * 60
+
+
+def fake_unwrap(source, destination, verbose=False):
+    data = Path(source).read_bytes()
+    if not data.startswith(SELF[:4]):
+        raise unwrap_self.Refused("not a SELF container")
+    Path(destination).parent.mkdir(parents=True, exist_ok=True)
+    Path(destination).write_bytes(ELF + Path(source).name.encode())
+    return len(data)
+
+
+class AuditDumpTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.root = Path(self.directory.name)
+        self.dump = self.root / "app0"
+        self.dump.mkdir()
+        (self.dump / "eboot.bin").write_bytes(SELF)
+        self.relinker = self.root / "relinker.exe"
+        self.relinker.write_bytes(b"")
+        patcher = mock.patch.object(unwrap_self, "unwrap", side_effect=fake_unwrap)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+    def tearDown(self):
+        self.directory.cleanup()
+
+    def module(self, relative, data=SELF):
+        path = self.dump / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(data)
+
+    def test_every_module_location_is_staged_and_the_extra_ones_become_module_dirs(self):
+        self.module("sce_module/libc.prx")
+        self.module("Media/Modules/Il2CppUserAssemblies.prx")
+        self.module("Media/Plugins/PSNCore.prx", ELF)
+        self.module("libfmod.prx")
+        self.module("Media/Plugins/readme.txt", b"text")
+        (self.dump / "sce_modules").mkdir()
+        source = self.root / "work" / "source"
+        directories, extra = audit_dump.prepare(self.dump, source, log=lambda text: None)
+        self.assertTrue((source / "eboot.elf").read_bytes().startswith(ELF))
+        self.assertTrue((source / "sce_module" / "libc.prx").read_bytes().endswith(b"libc.prx"))
+        self.assertEqual((source / "Media/Plugins/PSNCore.prx").read_bytes(), ELF)
+        self.assertTrue((source / "libfmod.prx").is_file())
+        self.assertFalse((source / "Media/Plugins/readme.txt").exists())
+        self.assertEqual(extra, ["Media/Modules", "Media/Plugins", "."])
+        self.assertEqual(directories, [source / "sce_module", source / "Media/Modules", source / "Media/Plugins", source])
+
+    def test_a_module_that_is_neither_a_self_nor_an_elf_is_refused(self):
+        self.module("sce_module/broken.prx", b"MZ" + b"\0" * 62)
+        with self.assertRaises(unwrap_self.Refused):
+            audit_dump.prepare(self.dump, self.root / "source", log=lambda text: None)
+
+    def test_the_relinker_gets_the_registry_windows_and_module_dir_options(self):
+        with mock.patch.object(subprocess, "run", return_value=subprocess.CompletedProcess([], 0, "", "")) as run:
+            audit_dump.convert(self.relinker, self.root / "source", self.root / "out" / "app.exe", ["Media/Modules", "."], True)
+        command = run.call_args.args[0]
+        self.assertEqual(command[:3], [str(self.relinker), "--registry", "--windows"])
+        self.assertEqual(command[3:7], ["--module-dir", "Media/Modules", "--module-dir", "."])
+        self.assertEqual(command[7:], [str(self.root / "source" / "eboot.elf"), str(self.root / "out" / "app.exe")])
+
+    def run_main(self, *arguments):
+        errors = io.StringIO()
+        printed = io.StringIO()
+        with contextlib.redirect_stderr(errors), contextlib.redirect_stdout(printed):
+            code = audit_dump.main([str(argument) for argument in arguments])
+        return code, errors.getvalue()
+
+    def test_the_audit_gets_every_registry_library_and_module_directory(self):
+        self.module("sce_module/libc.prx")
+        work = self.root / "work"
+
+        def relink(command, capture_output, text):
+            output = Path(command[-1]).parent
+            (output / "app.registry.json").write_text("[]")
+            (output / "app.libc.prx.guest.prx.registry.json").write_text("[]")
+            (output / "app.libc.prx.guest.prx.needed.json").write_text("{}")
+            return subprocess.CompletedProcess(command, 0, "", "")
+
+        with mock.patch.object(subprocess, "run", side_effect=relink), mock.patch.object(audit_dump.import_audit, "main", return_value=1) as audit:
+            code, _ = self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs-a", "--libs", "libs-b", "--work", work, "--json", "report.json")
+        self.assertEqual(code, 1)
+        argv = audit.call_args.args[0]
+        output = work / "output"
+        self.assertEqual(argv[:2], [str(output / "app.libc.prx.guest.prx.registry.json"), str(output / "app.registry.json")])
+        self.assertEqual(argv[2:], ["--libs", "libs-a", "--libs", "libs-b", "--modules", str(work / "source" / "sce_module"), "--json", "report.json"])
+
+    def test_a_reused_work_directory_does_not_audit_registries_left_by_an_earlier_run(self):
+        work = self.root / "work"
+        stale = work / "output" / "app.old.prx.guest.prx.registry.json"
+        stale.parent.mkdir(parents=True)
+        stale.write_text("[]")
+        (work / "source" / "sce_module").mkdir(parents=True)
+        (work / "source" / "sce_module" / "gone.prx").write_bytes(ELF)
+
+        def relink(command, capture_output, text):
+            (Path(command[-1]).parent / "app.registry.json").write_text("[]")
+            return subprocess.CompletedProcess(command, 0, "", "")
+
+        with mock.patch.object(subprocess, "run", side_effect=relink), mock.patch.object(audit_dump.import_audit, "main", return_value=0) as audit:
+            code, _ = self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs", "--work", work)
+        self.assertEqual(code, 0)
+        self.assertEqual(audit.call_args.args[0][:2], [str(work / "output" / "app.registry.json"), "--libs"])
+        self.assertFalse((work / "source" / "sce_module" / "gone.prx").exists())
+
+    def test_an_undeletable_stale_registry_stops_before_conversion(self):
+        work = self.root / "work"
+        stale = work / "output" / "locked" / "stale.registry.json"
+        stale.parent.mkdir(parents=True)
+        stale.write_text("[]")
+        real_rmtree = audit_dump.shutil.rmtree
+
+        def rmtree(path, ignore_errors=False, **kwargs):
+            if Path(path) == work / "output":
+                if ignore_errors:
+                    return None
+                raise PermissionError(13, "Permission denied", str(stale))
+            return real_rmtree(path, ignore_errors=ignore_errors, **kwargs)
+
+        with mock.patch.object(audit_dump.shutil, "rmtree", side_effect=rmtree), mock.patch.object(audit_dump, "convert") as convert, mock.patch.object(audit_dump.import_audit, "main", return_value=0) as audit:
+            code, errors = self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs", "--work", work)
+        self.assertEqual(code, 2)
+        self.assertIn("cannot empty", errors)
+        self.assertIn(str(work / "output"), errors)
+        convert.assert_not_called()
+        audit.assert_not_called()
+        self.assertTrue(stale.exists())
+
+    @unittest.skipIf(os.name == "nt" or (hasattr(os, "geteuid") and os.geteuid() == 0), "needs POSIX permissions and a non-root user")
+    def test_a_non_writable_stale_directory_stops_before_conversion(self):
+        work = self.root / "work"
+        locked = work / "output" / "locked"
+        locked.mkdir(parents=True)
+        (locked / "stale.registry.json").write_text("[]")
+        locked.chmod(0o500)
+        try:
+            with mock.patch.object(audit_dump, "convert") as convert, mock.patch.object(audit_dump.import_audit, "main", return_value=0) as audit:
+                code, errors = self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs", "--work", work)
+            self.assertEqual(code, 2)
+            self.assertIn("cannot empty", errors)
+            convert.assert_not_called()
+            audit.assert_not_called()
+        finally:
+            locked.chmod(0o700)
+
+    def test_a_generated_directory_that_survives_removal_stops_before_conversion(self):
+        work = self.root / "work"
+        (work / "source").mkdir(parents=True)
+        with mock.patch.object(audit_dump.shutil, "rmtree"), mock.patch.object(audit_dump, "convert") as convert, mock.patch.object(audit_dump.import_audit, "main", return_value=0) as audit:
+            code, errors = self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs", "--work", work)
+        self.assertEqual(code, 2)
+        self.assertIn("still exists", errors)
+        convert.assert_not_called()
+        audit.assert_not_called()
+
+    def assert_overlap_rejected(self, dump, work):
+        marker = dump / "original-marker"
+        marker.write_bytes(b"preserve original")
+        original = (dump / "eboot.bin").read_bytes()
+        with mock.patch.object(audit_dump, "prepare", return_value=([], [])) as prepare, mock.patch.object(audit_dump, "convert", return_value=subprocess.CompletedProcess([], 0)) as convert, mock.patch.object(audit_dump.import_audit, "main", return_value=0):
+            with self.assertRaises(SystemExit) as error:
+                self.run_main(dump, "--relinker", self.relinker, "--libs", "libs", "--work", work)
+        self.assertEqual(error.exception.code, 2)
+        prepare.assert_not_called()
+        convert.assert_not_called()
+        self.assertEqual((dump / "eboot.bin").read_bytes(), original)
+        self.assertEqual(marker.read_bytes(), b"preserve original")
+
+    def test_overlapping_work_paths_are_rejected_before_input_is_removed(self):
+        for name, relative in (("source", "source"), ("output", "output"), ("nested-source", "source/nested"), ("nested-output", "output/nested"), ("work-is-dump", "."), ("work-in-dump", "ancestor")):
+            with self.subTest(name=name):
+                root = self.root / name
+                dump = root / relative
+                dump.mkdir(parents=True)
+                (dump / "eboot.bin").write_bytes(SELF)
+                work = dump / "work" if name == "work-in-dump" else root
+                self.assert_overlap_rejected(dump, work)
+
+    def assert_report_rejected(self, report):
+        work = self.root / "report-work"
+        marker = work / "source" / "preserve"
+        marker.parent.mkdir(parents=True, exist_ok=True)
+        marker.write_bytes(b"previous work")
+        original = (self.dump / "eboot.bin").read_bytes()
+        with mock.patch.object(audit_dump, "prepare", return_value=([], [])) as prepare, mock.patch.object(audit_dump, "convert", return_value=subprocess.CompletedProcess([], 0)) as convert, mock.patch.object(audit_dump.import_audit, "main", return_value=0) as audit:
+            with self.assertRaises(SystemExit) as error:
+                self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs", "--work", work, "--json", report)
+        self.assertEqual(error.exception.code, 2)
+        prepare.assert_not_called()
+        convert.assert_not_called()
+        audit.assert_not_called()
+        self.assertEqual((self.dump / "eboot.bin").read_bytes(), original)
+        self.assertEqual(marker.read_bytes(), b"previous work")
+
+    def test_json_outputs_inside_the_dump_are_rejected_before_staging(self):
+        for relative in (".", "eboot.bin", "report.json", "new/directory/report.json"):
+            with self.subTest(relative=relative):
+                self.assert_report_rejected(self.dump / relative)
+
+    def test_json_output_symlink_aliases_of_the_dump_are_rejected(self):
+        for name, target, directory in (("file", self.dump / "eboot.bin", False), ("directory", self.dump, True), ("missing", self.dump / "not-created.json", False)):
+            with self.subTest(name=name):
+                link = self.root / ("report-link-" + name)
+                try:
+                    os.symlink(target, link, target_is_directory=directory)
+                except OSError:
+                    self.skipTest("symbolic links unavailable")
+                self.assert_report_rejected(link / "new.json" if directory else link)
+
+    def test_windows_resolved_path_spellings_protect_missing_reports(self):
+        for normal, extended in (
+            (PureWindowsPath("C:/dump"), PureWindowsPath("//?/C:/dump")),
+            (PureWindowsPath("//server/share/dump"), PureWindowsPath("//?/UNC/server/share/dump")),
+        ):
+            for report_root, dump_root in ((normal, extended), (extended, normal)):
+                with self.subTest(report_root=report_root, dump_root=dump_root):
+                    dump = mock.Mock()
+                    dump.resolve.return_value = dump_root
+                    dump.absolute.return_value = normal
+                    dump.rglob.return_value = ()
+                    dump.parents = ()
+                    dump.is_symlink.return_value = False
+                    report = mock.Mock()
+                    report.resolve.return_value = report_root / "not-created.json"
+                    report.absolute.return_value = normal.parent / "outside-report.json"
+                    report.parent.resolve.return_value = normal.parent
+                    report.parents = ()
+                    report.is_symlink.return_value = False
+                    report.parent.parents = ()
+                    report.parent.is_symlink.return_value = False
+                    report.exists.return_value = False
+                    self.assertTrue(audit_dump.report_overlaps_dump(report, dump))
+                    report.resolve.return_value = report_root.parent / "outside-report.json"
+                    self.assertFalse(audit_dump.report_overlaps_dump(report, dump))
+
+    def test_json_report_links_are_checked_when_resolve_leaves_the_alias(self):
+        resolve = Path.resolve
+        for name, target, directory in (
+            ("file", self.dump / "missing-report.json", False),
+            ("directory", self.dump / "missing-directory", True),
+        ):
+            with self.subTest(name=name):
+                link = self.root / ("unresolved-report-" + name)
+                try:
+                    os.symlink(target, link, target_is_directory=directory)
+                except OSError:
+                    self.skipTest("symbolic links unavailable")
+                report = link / "report.json" if directory else link
+
+                def unresolved_alias(path, *args, **kwargs):
+                    if path == link or path.is_relative_to(link):
+                        return path.absolute()
+                    return resolve(path, *args, **kwargs)
+
+                with mock.patch.object(Path, "resolve", unresolved_alias):
+                    self.assert_report_rejected(report)
+
+    def test_json_report_link_cycles_are_rejected_before_staging(self):
+        first = self.root / "report-cycle-first"
+        second = self.root / "report-cycle-second"
+        try:
+            os.symlink(second, first)
+            os.symlink(first, second)
+        except OSError:
+            self.skipTest("symbolic links unavailable")
+        self.assert_report_rejected(first)
+
+    def test_repeated_parent_alias_in_link_target_is_not_a_cycle(self):
+        alias = self.root / "parent-alias"
+        link = self.root / "report-through-parent"
+        target = self.root / "external-report.json"
+        try:
+            os.symlink(self.root, alias, target_is_directory=True)
+            os.symlink(alias / target.name, link)
+        except OSError:
+            self.skipTest("symbolic links unavailable")
+        self.assertEqual(audit_dump.comparison_path(alias / link.name), target.resolve())
+        self.assertFalse(audit_dump.report_overlaps_dump(alias / link.name, self.dump))
+
+    def test_json_output_hardlink_aliases_of_dump_files_are_rejected(self):
+        self.module("Media/Plugins/libfmod.prx")
+        for name in ("eboot.bin", "Media/Plugins/libfmod.prx"):
+            with self.subTest(name=name):
+                link = self.root / (Path(name).name + ".report")
+                try:
+                    os.link(self.dump / name, link)
+                except OSError:
+                    self.skipTest("hard links unavailable")
+                self.assert_report_rejected(link)
+
+    def test_json_output_inside_the_dump_cannot_escape_through_a_symlink(self):
+        report = self.root / "outside-report.json"
+        report.write_bytes(b"preserve report")
+        link = self.dump / "report.json"
+        try:
+            os.symlink(report, link)
+        except OSError:
+            self.skipTest("symbolic links unavailable")
+        self.assert_report_rejected(link)
+        self.assertEqual(report.read_bytes(), b"preserve report")
+
+    def test_json_output_cannot_replace_files_in_a_linked_dump_directory(self):
+        modules = self.root / "shared-modules"
+        modules.mkdir()
+        module = modules / "libc.prx"
+        module.write_bytes(ELF)
+        try:
+            os.symlink(modules, self.dump / "sce_module", target_is_directory=True)
+        except OSError:
+            self.skipTest("symbolic links unavailable")
+        for report in (module, modules / "new-report.json"):
+            with self.subTest(report=report):
+                self.assert_report_rejected(report)
+                self.assertEqual(module.read_bytes(), ELF)
+        self.assertFalse((modules / "new-report.json").exists())
+
+    def test_a_dump_alias_still_protects_an_outward_report_link(self):
+        original = self.dump
+        alias = self.root / "dump-alias"
+        report = original / "report.json"
+        outside = self.root / "not-created.json"
+        try:
+            os.symlink(original, alias, target_is_directory=True)
+            os.symlink(outside, report)
+        except OSError:
+            self.skipTest("symbolic links unavailable")
+        self.dump = alias
+        try:
+            self.assert_report_rejected(report)
+        finally:
+            self.dump = original
+        self.assertFalse(outside.exists())
+
+    def test_symlinked_work_paths_are_checked_against_the_resolved_dump(self):
+        for generated in ("source", "output"):
+            with self.subTest(generated=generated):
+                work = self.root / ("linked-" + generated)
+                work.mkdir()
+                try:
+                    os.symlink(self.dump, work / generated, target_is_directory=True)
+                except OSError:
+                    self.skipTest("symbolic links unavailable")
+                self.assert_overlap_rejected(self.dump, work)
+
+    def test_a_broken_module_link_fails_instead_of_being_skipped(self):
+        (self.dump / "sce_module").mkdir()
+        try:
+            os.symlink(self.dump / "sce_module" / "missing.prx", self.dump / "sce_module" / "libc.prx")
+        except OSError:
+            self.skipTest("symbolic links unavailable")
+        with mock.patch.object(subprocess, "run") as run:
+            code, errors = self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs")
+        self.assertEqual(code, 2)
+        self.assertIn("libc.prx", errors)
+        run.assert_not_called()
+
+    def test_a_relinker_failure_returns_2_with_its_message(self):
+        with mock.patch.object(subprocess, "run", return_value=subprocess.CompletedProcess([], 3, "", "bad input")), mock.patch.object(audit_dump.import_audit, "main") as audit:
+            code, errors = self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs")
+        self.assertEqual(code, 2)
+        self.assertIn("relinker exited with 3", errors)
+        self.assertIn("bad input", errors)
+        audit.assert_not_called()
+
+    def test_a_dump_without_eboot_or_a_missing_relinker_is_an_argument_error(self):
+        (self.dump / "eboot.bin").unlink()
+        with self.assertRaises(SystemExit):
+            self.run_main(self.dump, "--relinker", self.relinker, "--libs", "libs")
+        (self.dump / "eboot.bin").write_bytes(SELF)
+        with self.assertRaises(SystemExit):
+            self.run_main(self.dump, "--relinker", self.root / "missing.exe", "--libs", "libs")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/tests/test_build_web.py b/tools/tests/test_build_web.py
index 91e093b70d..78cdb95d0e 100644
--- a/tools/tests/test_build_web.py
+++ b/tools/tests/test_build_web.py
@@ -5,12 +5,14 @@ import io
 import json
 from pathlib import Path
 import subprocess
+import struct
 import sys
 import tempfile
 import unittest
 from unittest.mock import patch
 import warnings
 import zipfile
+import zlib
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import build_web
@@ -26,6 +28,60 @@ def library_zip(entries):
 
 
 class LibraryPublicationTests(unittest.TestCase):
+    def test_unicode_path_rewrite_is_rejected_before_decompression(self):
+        original = "libs/../libc.prx"
+        rewritten = "libs/libc.prx"
+        entry = zipfile.ZipInfo(original)
+        unicode_path = b"\x01" + struct.pack("<I", zlib.crc32(original.encode())) + rewritten.encode()
+        entry.extra = struct.pack("<HH", 0x7075, len(unicode_path)) + unicode_path
+        invalid = library_zip([(entry, b"content")])
+        with zipfile.ZipFile(io.BytesIO(invalid)) as archive:
+            decoded = archive.infolist()[0]
+            self.assertEqual(decoded.orig_filename, original)
+            if decoded.filename == original:
+                self.skipTest("zipfile does not interpret Unicode Path extra fields")
+            self.assertEqual(decoded.filename, rewritten)
+        valid = library_zip([("libs/libc.prx", b"valid")])
+        with patch.object(zipfile.ZipFile, "testzip", side_effect=AssertionError("archive decompressed")):
+            with self.assertRaisesRegex(ValueError, "Invalid library archive layout"):
+                self.publish(invalid, valid)
+        self.assertEqual(self.manifest.read_bytes(), self.previous)
+        self.assertEqual(list(self.libraries.iterdir()), [self.existing])
+
+    def test_original_archive_paths_are_rejected_before_decompression(self):
+        valid = library_zip([("libs/libc.prx", b"valid")])
+        for name in ("libs/libc.prx\0ignored", "libs/sub\0dir/libc.prx",
+                     "libs\\libc.prx", "libs/sub\\libc.prx"):
+            with self.subTest(name=name):
+                placeholder = name.replace("\0", "!").replace("\\", "!")
+                invalid = library_zip([(placeholder, b"content")])
+                invalid = invalid.replace(placeholder.encode(), name.encode())
+                with zipfile.ZipFile(io.BytesIO(invalid)) as archive:
+                    self.assertEqual(archive.infolist()[0].orig_filename, name)
+                with patch.object(zipfile.ZipFile, "testzip", side_effect=AssertionError("archive decompressed")):
+                    with self.assertRaisesRegex(ValueError, "Invalid library archive layout"):
+                        self.publish(invalid, valid)
+                self.assertEqual(self.manifest.read_bytes(), self.previous)
+                self.assertEqual(list(self.libraries.iterdir()), [self.existing])
+
+    def test_rewritten_path_in_second_platform_preserves_previous_manifest(self):
+        valid = library_zip([("libs/libc.prx", b"valid")])
+        invalid = library_zip([("libs/libc.prx!ignored", b"content")])
+        invalid = invalid.replace(b"libs/libc.prx!ignored", b"libs/libc.prx\0ignored")
+        with self.assertRaisesRegex(ValueError, "Invalid library archive layout"):
+            self.publish(valid, invalid)
+        self.assertEqual(self.manifest.read_bytes(), self.previous)
+        self.assertEqual(self.existing.read_bytes(), b"previous archive")
+        self.assertFalse(any(file.suffix == ".download" for file in self.libraries.iterdir()))
+
+    def test_unicode_archive_paths_are_published_unchanged(self):
+        payload = library_zip([("libs/\u65e5\u672c\u8a9e/\u00e9.prx", b"content"),
+                               ("libs/licenses/Third party.txt", b"license")])
+        self.publish(payload, payload)
+        manifest = json.loads(self.manifest.read_text(encoding="utf-8"))
+        for asset in manifest["platforms"].values():
+            self.assertEqual((self.output / asset["path"]).read_bytes(), payload)
+
     def test_expanded_limit_is_checked_before_decompression(self):
         payload = library_zip([("libs/libc.prx", b"a" * 4097)])
         with patch.object(build_web, "MAX_EXPANDED_BYTES", 4096, create=True), \
@@ -149,6 +205,33 @@ class BuildWebCliTests(unittest.TestCase):
                 code = build_web.main(["--build", str(build)])
             self.assertEqual(code, 0)
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(build_web.sys, "stdout", out), patch.object(build_web.sys, "stderr", err):
+            try:
+                build_web.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_check_compile.py b/tools/tests/test_check_compile.py
index ffd20390ab..d1963387b3 100644
--- a/tools/tests/test_check_compile.py
+++ b/tools/tests/test_check_compile.py
@@ -15,7 +15,49 @@ import check_compile
 TOOL = Path(__file__).resolve().parents[1] / "check_compile.py"
 
 
-class CheckCompileTests(unittest.TestCase):
+class CheckCompileFixture(unittest.TestCase):
+    def setUp(self):
+        holder = tempfile.TemporaryDirectory()
+        self.addCleanup(holder.cleanup)
+        self.root = Path(holder.name).resolve()
+        subprocess.run(["git", "init", "-q", str(self.root)], check=True)
+        subprocess.run(["git", "-C", str(self.root), "config", "user.email", "tests@example.com"], check=True)
+        subprocess.run(["git", "-C", str(self.root), "config", "user.name", "tests"], check=True)
+        self.build = self.root / "build"
+        self.build.mkdir()
+
+    def tool(self, *arguments, env=None):
+        environment = dict(os.environ)
+        environment.update(env or {})
+        return subprocess.run([sys.executable, "-I", str(TOOL), *arguments], cwd=self.root,
+                              capture_output=True, text=True, encoding="utf-8", env=environment)
+
+    def source(self, relative, text="int x;\n"):
+        path = self.root / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text, encoding="utf-8")
+        return path
+
+    def compiler(self, body, name="compiler.py"):
+        script = self.root / name
+        script.write_text(body, encoding="utf-8")
+        return script
+
+    def entry(self, relative, command):
+        return {"directory": str(self.build), "command": command, "file": str(self.root / relative)}
+
+    def manifest(self, entries):
+        (self.build / "compile_commands.json").write_text(json.dumps(entries), encoding="utf-8")
+
+    def failing(self, relative, message=None):
+        source = self.source(relative)
+        message = message if message is not None else f"{relative}:1:1: error: no\n"
+        script = self.compiler("import sys\nsys.stderr.write(%r)\nsys.exit(1)\n" % message)
+        self.manifest([self.entry(relative, f'"{sys.executable}" "{script}" "{source}"')])
+        return source
+
+
+class CheckCompileOutputTests(CheckCompileFixture):
     def test_unexpanded_response_files_cannot_rewrite_build_outputs(self):
         compiler = shutil.which("clang")
         if compiler is None:
@@ -79,6 +121,58 @@ class CheckCompileTests(unittest.TestCase):
                     for path, content in outputs.items():
                         self.assertEqual(path.read_bytes(), content)
 
+    def test_saved_temporaries_do_not_rewrite_files_or_hide_compiler_errors(self):
+        compiler = shutil.which("gcc") or shutil.which("clang")
+        if compiler is None:
+            self.skipTest("needs a C compiler")
+        source = self.source("unit.c")
+        for option, field in (("-save-temps", "arguments"), ("--save-temps", "command"),
+                              ("-save-temps=cwd", "arguments"), ("-save-temps=obj", "command")):
+            with self.subTest(option=option, field=field):
+                source.write_text("#ifndef REQUIRED\n#error missing definition\n#endif\nint value;\n", encoding="utf-8")
+                arguments = [compiler, "-Werror", "-DREQUIRED", option, "-c", str(source),
+                             "-o", str(self.build / "unit.o")]
+                original = subprocess.run(arguments, cwd=self.build, capture_output=True, text=True)
+                self.assertEqual(original.returncode, 0, original.stderr)
+                for name in ("a-unit", "a-unit.i", "unit.i"):
+                    (self.build / name).write_bytes(b"previous build output")
+                command = (subprocess.list2cmdline(arguments) if os.name == "nt" else
+                           " ".join(shlex.quote(argument) for argument in arguments))
+                self.manifest([{"directory": str(self.build), "file": str(source),
+                                field: arguments if field == "arguments" else command}])
+                preserved = {path: path.read_bytes() for path in self.build.iterdir()}
+                result = self.tool("unit.c")
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                self.assertIn("1 translation units compile", result.stdout)
+                for path, content in preserved.items():
+                    self.assertEqual(path.read_bytes(), content, str(path))
+                self.assertEqual(set(self.build.iterdir()), set(preserved))
+                source.write_text("#error syntax_check_must_fail\n", encoding="utf-8")
+                result = self.tool("unit.c")
+                self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                self.assertIn("syntax_check_must_fail", result.stderr)
+                for path, content in preserved.items():
+                    self.assertEqual(path.read_bytes(), content, str(path))
+                self.assertEqual(set(self.build.iterdir()), set(preserved))
+
+    def test_rejected_saved_temporary_mode_is_not_hidden(self):
+        compiler = shutil.which("gcc") or shutil.which("clang")
+        if compiler is None:
+            self.skipTest("needs a C compiler")
+        source = self.source("unit.c")
+        original = subprocess.run([compiler, "-save-temps=invalid", "-fsyntax-only", str(source)],
+                                  cwd=self.build, capture_output=True, text=True)
+        if original.returncode == 0:
+            self.skipTest("compiler accepts unknown saved-temporary modes with -fsyntax-only")
+        self.assertIn("save-temps", original.stderr)
+        self.manifest([{"directory": str(self.build), "file": str(source),
+                        "arguments": [compiler, "-save-temps=invalid", "-c", str(source),
+                                      "-o", str(self.build / "unit.o")]}])
+        result = self.tool("unit.c")
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("save-temps", result.stderr)
+        self.assertFalse((self.build / "unit.o").exists())
+
     def test_ninja_response_file_is_expanded_before_syntax_rewriting(self):
         compiler = shutil.which("clang") or shutil.which("gcc")
         if compiler is None or shutil.which("ninja") is None:
@@ -88,7 +182,7 @@ class CheckCompileTests(unittest.TestCase):
         (self.build / "build.ninja").write_text(
             "rule cc\n  command = " + command + " @$out.rsp\n"
             "  rspfile = $out.rsp\n  rspfile_content = -DREQUIRED -c $in -o $out -MD -MF $out.d\n"
-            "build unit.o: cc ../unit.c\n", encoding="utf-8")
+            "build order: phony\nbuild unit.o: cc ../unit.c || order\n", encoding="utf-8")
         self.assertFalse((self.build / "unit.o.rsp").exists())
         result = self.tool("unit.c")
         self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
@@ -149,46 +243,7 @@ class CheckCompileTests(unittest.TestCase):
                 self.assertEqual(fragment.read_bytes(), b"previous compilation fragment")
 
 
-    def setUp(self):
-        holder = tempfile.TemporaryDirectory()
-        self.addCleanup(holder.cleanup)
-        self.root = Path(holder.name).resolve()
-        subprocess.run(["git", "init", "-q", str(self.root)], check=True)
-        subprocess.run(["git", "-C", str(self.root), "config", "user.email", "tests@example.com"], check=True)
-        subprocess.run(["git", "-C", str(self.root), "config", "user.name", "tests"], check=True)
-        self.build = self.root / "build"
-        self.build.mkdir()
-
-    def tool(self, *arguments, env=None):
-        environment = dict(os.environ)
-        environment.update(env or {})
-        return subprocess.run([sys.executable, "-I", str(TOOL), *arguments], cwd=self.root,
-                              capture_output=True, text=True, encoding="utf-8", env=environment)
-
-    def source(self, relative, text="int x;\n"):
-        path = self.root / relative
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text, encoding="utf-8")
-        return path
-
-    def compiler(self, body, name="compiler.py"):
-        script = self.root / name
-        script.write_text(body, encoding="utf-8")
-        return script
-
-    def entry(self, relative, command):
-        return {"directory": str(self.build), "command": command, "file": str(self.root / relative)}
-
-    def manifest(self, entries):
-        (self.build / "compile_commands.json").write_text(json.dumps(entries), encoding="utf-8")
-
-    def failing(self, relative, message=None):
-        source = self.source(relative)
-        message = message if message is not None else f"{relative}:1:1: error: no\n"
-        script = self.compiler("import sys\nsys.stderr.write(%r)\nsys.exit(1)\n" % message)
-        self.manifest([self.entry(relative, f'"{sys.executable}" "{script}" "{source}"')])
-        return source
-
+class CheckCompileTests(CheckCompileFixture):
     def test_a_translation_unit_that_does_not_compile_fails_with_the_compiler_output(self):
         self.failing("unit.cpp")
         result = self.tool("unit.cpp")
@@ -290,7 +345,7 @@ class CheckCompileTests(unittest.TestCase):
         result = self.tool("unit.cpp")
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertEqual(json.loads(seen.read_text(encoding="utf-8")),
-                         [*flags, "-fsyntax-only", str(source)])
+                         ["-fsyntax-only", *flags, str(source)])
 
     def test_nothing_checked_is_a_failure(self):
         self.manifest([])
@@ -503,7 +558,7 @@ class CheckCompileTests(unittest.TestCase):
                 result = self.tool(source.name)
                 self.assertEqual(result.returncode, 0, result.stderr)
                 self.assertEqual(json.loads(seen.read_text(encoding="utf-8")),
-                                 [*flags, "-fsyntax-only", str(source)])
+                                 ["-fsyntax-only", *flags, str(source)])
 
     def test_invalid_argument_arrays_are_rejected_without_a_traceback(self):
         source = self.source("unit.cpp")
@@ -515,6 +570,57 @@ class CheckCompileTests(unittest.TestCase):
                 self.assertIn("arguments must be a nonempty list of strings with an executable", result.stderr)
                 self.assertNotIn("Traceback", result.stderr)
 
+    def test_invalid_compilation_databases_are_rejected_without_a_traceback(self):
+        for database in ({}, {"file": "unit.cpp"}, None, 42, "commands"):
+            with self.subTest(database=database):
+                self.manifest(database)
+                result = self.tool("unit.cpp")
+                self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                self.assertIn("compile_commands.json: expected an array of command objects", result.stderr)
+                self.assertNotIn("Traceback", result.stderr)
+
+    def test_invalid_entries_are_rejected_before_any_compiler_runs(self):
+        source = self.source("unit.cpp")
+        invoked = self.root / "invoked"
+        script = self.compiler("import sys\nfrom pathlib import Path\nPath(sys.argv[1]).touch()\n")
+        valid = self.entry("unit.cpp", f'"{sys.executable}" "{script}" "{invoked}" "{source}"')
+        cases = [(value, "expected a command object") for value in (None, [], 42, "command")]
+        for field in ("directory", "file"):
+            missing = dict(valid)
+            del missing[field]
+            cases.append((missing, f"missing {field}"))
+            cases.extend(({**valid, field: value}, f"{field} must be a nonempty string")
+                         for value in (None, [], 42, ""))
+        cases.append(({key: value for key, value in valid.items() if key != "command"},
+                      "expected arguments or command"))
+        cases.extend(({**valid, "command": value}, "command must be a nonempty string")
+                     for value in (None, [], 42, "", " \t"))
+        cases.append(({**valid, "arguments": []},
+                      "arguments must be a nonempty list of strings with an executable"))
+        for invalid, message in cases:
+            with self.subTest(invalid=invalid):
+                self.manifest([valid, invalid])
+                result = self.tool("--jobs", "2", "unit.cpp")
+                self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                self.assertIn(f"compile_commands.json: entry 1: {message}", result.stderr)
+                self.assertNotIn("Traceback", result.stderr)
+                self.assertFalse(invoked.exists(), result.stdout + result.stderr)
+
+    def test_invalid_ninja_databases_are_validated_before_compilation(self):
+        source = self.source("unit.cpp")
+        cases = (({}, "expected an array of command objects"),
+                 ([self.entry("unit.cpp", "compiler"), None], "entry 1: expected a command object"))
+        for database, message in cases:
+            with self.subTest(database=database), \
+                    patch.object(check_compile.shutil, "which", return_value="ninja"), \
+                    patch.object(check_compile, "ninja_encoding", return_value="utf-8"), \
+                    patch.object(check_compile, "capture", return_value=subprocess.CompletedProcess(
+                        [], 0, json.dumps(database), "")), \
+                    patch.object(check_compile.subprocess, "run") as compiler:
+                with self.assertRaisesRegex(ValueError, "ninja -t compdb: " + message):
+                    check_compile.check(self.root, self.build, [source])
+                compiler.assert_not_called()
+
     def test_parallel_checks_overlap_but_diagnostics_keep_source_order(self):
         barrier = self.root / "barrier"
         barrier.mkdir()
diff --git a/tools/tests/test_check_compile_modes.py b/tools/tests/test_check_compile_modes.py
new file mode 100644
index 0000000000..9664440b2c
--- /dev/null
+++ b/tools/tests/test_check_compile_modes.py
@@ -0,0 +1,275 @@
+import json
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+TOOL = ROOT / "tools/check_compile.py"
+
+
+class CheckCompileModeTests(unittest.TestCase):
+    def compilers(self, names=("gcc", "clang")):
+        values = list(dict.fromkeys(value for value in map(shutil.which, names) if value))
+        if not values:
+            self.skipTest("needs GCC or Clang")
+        return values
+
+    def run_tool(self, root, build, source, arguments, field):
+        if not (root / ".git").exists():
+            subprocess.run(["git", "init", "-q", str(root)], capture_output=True, check=True)
+        command = (subprocess.list2cmdline(arguments) if os.name == "nt" else
+                   " ".join(shlex.quote(value) for value in arguments))
+        entry = {"directory": str(build), "file": str(source),
+                 field: arguments if field == "arguments" else command}
+        (build / "compile_commands.json").write_text(json.dumps([entry]), encoding="utf-8")
+        before = {path: path.read_bytes() for path in root.rglob("*") if path.is_file()}
+        result = subprocess.run([sys.executable, "-I", str(TOOL), "--build", str(build), str(source)],
+                                cwd=root, capture_output=True, text=True, encoding="utf-8", check=False)
+        self.assertEqual({path for path in root.rglob("*") if path.is_file()}, set(before), result.stderr)
+        for path, data in before.items():
+            self.assertEqual(path.read_bytes(), data, path.name)
+        self.assertNotIn("Traceback", result.stderr)
+        return result
+
+    def check_modes(self, variants, dependency=False, configure=None, invalid=None, marker="syntax_must_be_checked", compiler_names=("gcc", "clang"), wrap=False, trailing=False):
+        for compiler in self.compilers(compiler_names):
+            for flags in variants:
+                for field in ("arguments", "command"):
+                    with self.subTest(compiler=compiler, flags=flags, field=field), tempfile.TemporaryDirectory(prefix="syntax mode ") as name:
+                        root = Path(name).resolve()
+                        build = root / "build"
+                        build.mkdir()
+                        source = root / "unit.c"
+                        object_file, dependency_file = build / "unit.o", build / "unit.d"
+                        prefix = "#if REQUIRED != 42\n#error definition was lost\n#endif\n"
+                        suffix = ""
+                        extra = list(flags)
+                        if configure is not None:
+                            additions, opening, suffix = configure(root, build, source)
+                            extra += additions
+                            prefix = opening + prefix
+                        valid = prefix + "int main(void) { return 0; }\n" + suffix
+                        invalid_text = prefix + (invalid or "int syntax_must_be_checked = ;\n") + suffix
+                        compile_flags = [] if any(flag in flags for flag in ("-E", "--preprocess", "-M", "--dependencies", "-MM", "--user-dependencies")) else ["-c"]
+                        driver = [compiler]
+                        if wrap:
+                            wrapper = root / "wrapper.py"
+                            wrapper.write_text("import subprocess, sys\n"
+                                               "if sys.argv[2:].count('-fsyntax-only') != 1: sys.exit(78)\n"
+                                               "sys.exit(subprocess.run(sys.argv[1:]).returncode)\n", encoding="utf-8")
+                            driver = [sys.executable, str(wrapper), compiler]
+                        arguments = [*driver, "-D", "REQUIRED=42", *([] if trailing else extra),
+                                     *compile_flags, str(source), *(extra if trailing else []), "-o", str(object_file)]
+                        if dependency:
+                            arguments += ["-MF", str(dependency_file)]
+                        source.write_text(valid, encoding="utf-8")
+                        control = subprocess.run(arguments, cwd=build, capture_output=True, text=True, check=False)
+                        self.assertEqual(control.returncode, 0, control.stderr)
+                        object_file.write_bytes(b"existing object output\n")
+                        dependency_file.write_bytes(b"existing dependency output\n")
+                        for text, expected in ((valid, 0), (invalid_text, 1)):
+                            source.write_text(text, encoding="utf-8")
+                            result = self.run_tool(root, build, source, arguments, field)
+                            self.assertEqual(result.returncode, expected, result.stdout + result.stderr)
+                            if expected:
+                                self.assertIn(marker, result.stderr)
+                            else:
+                                self.assertIn("1 translation units compile", result.stdout)
+
+    def test_preprocessing_modes_reach_syntax_errors(self):
+        self.check_modes((("-E",), ("--preprocess",)))
+
+    def test_dependency_modes_reach_syntax_errors(self):
+        self.check_modes((("-M",), ("--dependencies",)), dependency=True)
+
+    def test_user_dependency_modes_reach_syntax_errors(self):
+        self.check_modes((("-MM",), ("--user-dependencies",)), dependency=True)
+
+    def test_generated_header_mode_does_not_hide_missing_headers(self):
+        self.check_modes((("-M", "-MG"), ("--dependencies", "--print-missing-file-dependencies")),
+                         dependency=True, invalid='#include "missing_generated_header.h"\n',
+                         marker="missing_generated_header.h")
+
+    def test_preprocessor_output_companions_do_not_block_syntax_checks(self):
+        self.check_modes((("-Werror", "-E", "-P"), ("-Werror", "--preprocess", "--no-line-commands")))
+
+    def test_macro_dump_modes_still_check_syntax(self):
+        self.check_modes((("-Werror", "-E", "-dM"), ("-Werror", "-E", "-dD")))
+
+    def test_include_dump_mode_still_checks_syntax(self):
+        self.check_modes((("-Werror", "-E", "-dI"),))
+
+    def test_real_compiler_wrapper_keeps_one_syntax_mode(self):
+        self.check_modes((("-fsyntax-only", "-E"),), wrap=True)
+
+    def test_trailing_preprocessing_mode_still_checks_syntax(self):
+        self.check_modes((("-E",),), trailing=True)
+
+    def test_comment_output_modes_still_check_syntax(self):
+        self.check_modes((("-Werror", "-E", "-C"), ("-Werror", "-E", "-CC")))
+
+    def test_joined_definitions_before_preprocessing_modes_are_preserved(self):
+        self.check_modes((("-DANOTHER_MACRO", "-E"),))
+
+    def test_joined_undefinitions_before_preprocessing_modes_are_preserved(self):
+        self.check_modes((("-UUNUSED_MACRO", "-E"),))
+
+    def test_optimization_and_warning_options_before_preprocessing_modes_are_preserved(self):
+        self.check_modes((("-O2", "-Wall", "-E"),))
+
+    def test_gcc_negative_syntax_mode_cannot_enable_output(self):
+        compiler = self.compilers(("gcc",))[0]
+        version = subprocess.run([compiler, "--version"], capture_output=True, text=True, check=False)
+        if "clang" in (version.stdout + version.stderr).lower():
+            self.skipTest("GCC's negative syntax mode is unsupported by Clang")
+        self.check_modes((("-fno-syntax-only",),), compiler_names=("gcc",))
+
+    def test_explicit_cpp_language_is_preserved(self):
+        self.check_modes((("-E", "-x", "c++"),))
+
+    def test_clang_end_of_options_preserves_mode_named_inputs(self):
+        compiler = shutil.which("clang")
+        if compiler is None:
+            self.skipTest("needs Clang")
+        for field in ("arguments", "command"):
+            with self.subTest(field=field), tempfile.TemporaryDirectory(prefix="syntax positional ") as name:
+                root = Path(name).resolve()
+                build = root / "build"
+                build.mkdir()
+                source = root / "unit.c"
+                source.write_text("int main(void) { return 0; }\n", encoding="utf-8")
+                other = build / "-E"
+                arguments = [compiler, "-x", "c", "--", "-E", str(source)]
+                for text, expected in (("int extra;\n", 0), ("int positional_syntax_error = ;\n", 1)):
+                    other.write_text(text, encoding="utf-8")
+                    result = self.run_tool(root, build, source, arguments, field)
+                    self.assertEqual(result.returncode, expected, result.stdout + result.stderr)
+                    if expected:
+                        self.assertIn("positional_syntax_error", result.stderr)
+
+    def check_forwarded_options(self, variants, response_text=None):
+        compiler = self.compilers(("clang",))[0]
+        for flags in variants:
+            for field in ("arguments", "command"):
+                for text in ("int value;\n", "int forwarded_syntax_error = ;\n"):
+                    with self.subTest(flags=flags, field=field, text=text), tempfile.TemporaryDirectory(prefix="syntax forwarded ") as name:
+                        root = Path(name).resolve()
+                        build = root / "build"
+                        build.mkdir()
+                        source = root / "unit.c"
+                        if response_text is not None:
+                            (build / "operand.rsp").write_text(response_text, encoding="utf-8")
+                        source.write_text(text, encoding="utf-8")
+                        object_file, dependency_file = build / "unit.o", build / "unit.d"
+                        object_file.write_bytes(b"existing object output\n")
+                        dependency_file.write_bytes(b"existing dependency output\n")
+                        arguments = [compiler, *flags, "-c", str(source), "-o", str(object_file), "-MF", str(dependency_file)]
+                        result = self.run_tool(root, build, source, arguments, field)
+                        self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                        self.assertIn("unsupported forwarded compiler option", result.stderr)
+
+    def test_forwarded_clang_actions_are_rejected(self):
+        self.check_forwarded_options((("-Xclang", "-E"), ("-Xclang=-E",), ("-Xclang", "-emit-obj")))
+
+    def test_forwarded_preprocessor_actions_are_rejected(self):
+        self.check_forwarded_options((("-Xpreprocessor", "-E"), ("-Xpreprocessor", "-M")))
+
+    def test_comma_forwarded_preprocessor_actions_are_rejected(self):
+        self.check_forwarded_options((("-Wp,-E",), ("-Wp,-E,-P",)))
+
+    def test_forwarded_response_operands_cannot_hide_actions(self):
+        self.check_forwarded_options((("-Wp,-I,@operand.rsp",),), response_text="somewhere -E")
+
+    def test_include_directory_values_can_look_like_modes(self):
+        def configure(root, build, source):
+            directory = build / "-E"
+            directory.mkdir()
+            (directory / "only_here.h").write_text("#define FROM_INCLUDE 1\n", encoding="utf-8")
+            return ["-I", "-E"], '#include "only_here.h"\n#ifndef FROM_INCLUDE\n#error include lost\n#endif\n', ""
+        self.check_modes(((),), configure=configure)
+
+    def test_forwarded_macro_options_are_preserved(self):
+        self.check_modes((("-Wp,-DOTHER=1,-UUNUSED",),))
+
+    def test_forwarded_include_operands_can_look_like_modes(self):
+        def configure(root, build, source):
+            directory = build / "-E"
+            directory.mkdir()
+            (directory / "forwarded.h").write_text("#define FROM_INCLUDE 1\n", encoding="utf-8")
+            return ["-Wp,-I,-E"], '#include "forwarded.h"\n#ifndef FROM_INCLUDE\n#error include lost\n#endif\n', ""
+        self.check_modes(((),), configure=configure)
+
+    def test_library_directory_values_can_look_like_modes(self):
+        self.check_modes((("-L", "-E"),))
+
+    def test_forced_include_values_can_look_like_modes(self):
+        def configure(root, build, source):
+            (build / "-M").write_text("#define FROM_INCLUDE 1\n", encoding="utf-8")
+            return ["-include", "-M"], "#ifndef FROM_INCLUDE\n#error include lost\n#endif\n", ""
+        self.check_modes(((),), configure=configure)
+
+    def test_source_path_used_as_an_option_value_is_preserved(self):
+        def configure(root, build, source):
+            return ["-include", str(source)], "#ifndef INCLUDED_ONCE\n#define INCLUDED_ONCE\n", "#endif\n"
+        self.check_modes(((),), configure=configure)
+
+    def test_missing_path_values_fail_before_a_syntax_flag_is_injected(self):
+        self.check_missing_values(("-I", "-L", "-include"))
+
+    def test_missing_language_and_output_values_fail_before_a_syntax_flag_is_injected(self):
+        self.check_missing_values(("-x", "-o", "-MF"))
+
+    def check_missing_values(self, options):
+        for compiler in self.compilers():
+            for option in options:
+                for field in ("arguments", "command"):
+                    with self.subTest(compiler=compiler, option=option, field=field), tempfile.TemporaryDirectory(prefix="syntax missing ") as name:
+                        root = Path(name).resolve()
+                        build = root / "build"
+                        build.mkdir()
+                        source = root / "unit.c"
+                        source.write_text("int main(void) { return 0; }\n", encoding="utf-8")
+                        result = self.run_tool(root, build, source, [compiler, option], field)
+                        self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                        self.assertIn("missing", result.stderr.lower())
+
+    def test_unknown_options_still_fail(self):
+        for compiler in self.compilers():
+            for field in ("arguments", "command"):
+                with self.subTest(compiler=compiler, field=field), tempfile.TemporaryDirectory(prefix="syntax unknown ") as name:
+                    root = Path(name).resolve()
+                    build = root / "build"
+                    build.mkdir()
+                    source = root / "unit.c"
+                    source.write_text("int main(void) { return 0; }\n", encoding="utf-8")
+                    option = "-funknown-syntax-mode-test"
+                    result = self.run_tool(root, build, source, [compiler, "-E", option, "-c", str(source)], field)
+                    self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                    self.assertIn(option, result.stderr)
+
+    def test_unknown_operand_counts_are_rejected_before_mode_rewriting(self):
+        compiler = shutil.which("clang")
+        if compiler is None:
+            self.skipTest("needs Clang")
+        for field in ("arguments", "command"):
+            with self.subTest(field=field), tempfile.TemporaryDirectory(prefix="syntax arity ") as name:
+                root = Path(name).resolve()
+                build = root / "build"
+                build.mkdir()
+                source = root / "unit.c"
+                source.write_text("int main(void) { return 0; }\n", encoding="utf-8")
+                arguments = [compiler, "-fdebug-compilation-dir", "-E", "-c", str(source), "-o", str(build / "unit.o")]
+                control = subprocess.run(arguments, cwd=build, capture_output=True, text=True, check=False)
+                self.assertEqual(control.returncode, 0, control.stderr)
+                result = self.run_tool(root, build, source, arguments, field)
+                self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                self.assertIn("unknown operand count", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/tests/test_check_compile_preprocessor.py b/tools/tests/test_check_compile_preprocessor.py
new file mode 100644
index 0000000000..0778572011
--- /dev/null
+++ b/tools/tests/test_check_compile_preprocessor.py
@@ -0,0 +1,101 @@
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import check_compile
+
+
+class CheckCompilePreprocessorTests(unittest.TestCase):
+    def test_forwarded_dependencies_preserve_outputs_and_compiler_errors(self):
+        self.check_forwarded_dependencies(shutil.which("clang") or shutil.which("gcc"), ("-MD", "-MMD"))
+
+    def test_gcc_dependency_aliases_preserve_outputs_and_compiler_errors(self):
+        compiler = shutil.which("gcc")
+        if compiler is not None:
+            version = subprocess.run([compiler, "--version"], capture_output=True, text=True)
+            if "clang" in version.stdout.lower():
+                self.skipTest("GCC dependency aliases are not supported by Clang")
+        self.check_forwarded_dependencies(compiler, ("--write-dependencies", "--write-user-dependencies"))
+
+    def check_forwarded_dependencies(self, compiler, options):
+        if compiler is None:
+            self.skipTest("needs a C compiler")
+        with tempfile.TemporaryDirectory(prefix="syntax check ") as folder:
+            root = Path(folder).resolve()
+            source = root / "unit source.c"
+            dependency = root / "unit deps.d"
+            object_file = root / "unit.o"
+            valid = "#ifndef REQUIRED\n#error lost_preprocessor_definition\n#endif\nint value;\n"
+            for option in options:
+                for field in ("arguments", "command"):
+                    with self.subTest(option=option, field=field):
+                        source.write_text(valid, encoding="utf-8")
+                        forwarded = [f"-Wp,{option},{dependency}", "-Wp,-DREQUIRED,-MP,-MT,custom_target,-UUNUSED"]
+                        arguments = [compiler, "-Werror", "-c", str(source), *forwarded, "-o", str(object_file)]
+                        original = subprocess.run(arguments, cwd=root, capture_output=True, text=True)
+                        self.assertEqual(original.returncode, 0, original.stderr)
+                        preserved = {path: path.read_bytes() for path in (dependency, object_file)}
+                        command = (subprocess.list2cmdline(arguments) if os.name == "nt" else
+                                   " ".join(shlex.quote(argument) for argument in arguments))
+                        entry = {"directory": str(root), "file": str(source),
+                                 field: arguments if field == "arguments" else command}
+                        for text, failures in ((valid, 0), (valid + "#error syntax_check_must_fail\n", 1)):
+                            source.write_text(text, encoding="utf-8")
+                            checked, failed, diagnostics = check_compile.check_source(
+                                (source, source.name, root, [entry]))
+                            self.assertEqual((checked, failed), (1, failures), diagnostics)
+                            if failures:
+                                self.assertIn("syntax_check_must_fail", diagnostics)
+                            for path, content in preserved.items():
+                                self.assertEqual(path.read_bytes(), content, str(path))
+                            self.assertEqual(set(root.iterdir()), {source, dependency, object_file})
+                        dependency.unlink()
+                        object_file.unlink()
+                        source.write_text(valid, encoding="utf-8")
+                        self.assertEqual(check_compile.check_source((source, source.name, root, [entry]))[:2], (1, 0))
+                        self.assertEqual(set(root.iterdir()), {source})
+
+    def test_dependency_only_arguments_are_removed(self):
+        source = Path("unit.c").resolve()
+        flags = ["-Wp,-MD,unit.d", "-Wp,-MMD,unit.d,-MP", "-Wp,-MF,unit.d,-MT,target,-MQ,quoted",
+                 "-Wp,-MFunit.d,-MTtarget,-MQquoted", "-Wp,-M,-MM,-MG,-MP",
+                 "-Wp,--write-dependencies,unit.d,--dependencies,--user-dependencies,--print-missing-file-dependencies",
+                 "-Wp,--write-user-dependencies,unit.d"]
+        for flag in flags:
+            with self.subTest(flag=flag):
+                self.assertEqual(check_compile.syntax_arguments(["cc", flag, "-c", str(source)], Path.cwd(), source),
+                                 ["cc", "-fsyntax-only", str(source)])
+
+    def test_other_preprocessor_arguments_are_preserved(self):
+        source = Path("unit.c").resolve()
+        for flag, expected in (("-Wp,-DNAME=value,-MD,unit.d,-I,include files", "-Wp,-DNAME=value,-I,include files"),
+                               ("-Wp,-include,-MD,-MMD,unit.d", "-Wp,-include,-MD"),
+                               ("-Wp,--include,-MD,--write-dependencies,unit.d", "-Wp,--include,-MD")):
+            with self.subTest(flag=flag):
+                self.assertEqual(check_compile.syntax_arguments(["cc", flag, str(source)], Path.cwd(), source),
+                                 ["cc", "-fsyntax-only", expected, str(source)])
+
+    def test_unsupported_options_and_response_operands_are_still_rejected(self):
+        source = Path("unit.c").resolve()
+        for flag in ("-Wp,-unknown-option", "-Wp,-MD,unit.d,-E", "-Wp,-MD,unit.d,-I,@operand.rsp",
+                     "-Wp,-MD,@operand.rsp"):
+            with self.subTest(flag=flag):
+                with self.assertRaisesRegex(ValueError, "unsupported forwarded compiler option"):
+                    check_compile.syntax_arguments(["cc", flag, str(source)], Path.cwd(), source)
+
+    def test_missing_dependency_values_are_rejected(self):
+        source = Path("unit.c").resolve()
+        for option in ("-MD", "-MMD", "-MF", "-MT", "-MQ", "--write-dependencies", "--write-user-dependencies"):
+            with self.subTest(option=option):
+                with self.assertRaisesRegex(ValueError, "missing value"):
+                    check_compile.syntax_arguments(["cc", f"-Wp,{option}", str(source)], Path.cwd(), source)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/tests/test_check_conventions_alignment.py b/tools/tests/test_check_conventions_alignment.py
new file mode 100644
index 0000000000..d1456cc770
--- /dev/null
+++ b/tools/tests/test_check_conventions_alignment.py
@@ -0,0 +1,153 @@
+import itertools
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from check_conventions import Check, cpp_text, named_constants, over_aligned
+
+SOURCE = "core/libs/prx/libSceExample/tests/Example.cpp"
+
+SMALL = "void Small() {\n    constexpr std::size_t Alignment = 64;\n    alignas(Alignment) static char small[4];\n}\n"
+LARGE = "void Large() {\n    constexpr std::size_t Alignment = 16384;\n    alignas(Alignment) static char large[4];\n}\n"
+
+
+def reported(text):
+    constants = named_constants(cpp_text(text))
+    lines = text.split("\n")
+    starts = list(itertools.accumulate((len(line) + 1 for line in lines), initial=0))
+    return [number for number, line in enumerate(lines, 1) if over_aligned(line, constants, starts[number - 1])]
+
+
+class OverAlignedTests(unittest.TestCase):
+    def test_alignments_above_the_limit(self):
+        for line, match in (
+            ("alignas(65536) std::array<std::uint8_t, 4u << 20u> Texels{};", "alignas(65536)"),
+            ("alignas(16384) static char block[16];", "alignas(16384)"),
+            ("alignas( 0x10000 ) char block[16];", "alignas( 0x10000 )"),
+            ("alignas(0X4000u) char block[16];", "alignas(0X4000u)"),
+            ("alignas(65'536) char block[16];", "alignas(65'536)"),
+            ("alignas(040000) char block[16];", "alignas(040000)"),
+            ("alignas(0b100000000000000) char block[16];", "alignas(0b100000000000000)"),
+            ("alignas(256) char small[4]; alignas(32768) char large[4];", "alignas(32768)"),
+        ):
+            with self.subTest(line=line):
+                self.assertEqual(over_aligned(line), match)
+
+    def test_alignments_within_the_limit(self):
+        for line in (
+            "alignas(8192) char block[16];",
+            "alignas(0x2000) char block[16];",
+            "alignas(256) std::array<std::uint32_t, 128> Input{};",
+            "alignas(4096) char page[4096];",
+            "alignas(std::max_align_t) char storage[16];",
+            "alignas(Shader) char storage[sizeof(Shader)];",
+            "realignas(65536)",
+            "constexpr std::size_t TexelAlignment = 65536;",
+        ):
+            with self.subTest(line=line):
+                self.assertIsNone(over_aligned(line))
+
+    def test_named_constants_of_the_file(self):
+        self.assertEqual(reported("constexpr std::size_t BlockBytes = 65536;\n"
+                                  "static constexpr std::uint32_t PageBytes{0x1000u};\n"
+                                  "constexpr auto Large = 0x10000;\n"
+                                  "constexpr std::size_t Texels = 4u << 20u;\n"
+                                  "alignas(BlockBytes) std::array<std::uint8_t, BlockBytes> Block{};\n"
+                                  "alignas( Large ) char block[16];\n"
+                                  "alignas(PageBytes) char page[4096];\n"
+                                  "alignas(Texels) char texels[16];\n"
+                                  "alignas(inotify_event) char buffer[16384];\n"), [5, 6])
+        self.assertEqual(reported("alignas(BlockBytes) char block[16];\n"
+                                  "constexpr std::size_t BlockBytes = 65536;\n"), [])
+
+    def test_constants_in_separate_scopes(self):
+        self.assertEqual(reported(SMALL + LARGE), [7])
+        self.assertEqual(reported(LARGE + SMALL), [3])
+
+    def test_constants_in_nested_scopes(self):
+        for outer, inner, expected in ((64, 16384, [6]), (16384, 64, [3, 8])):
+            text = ("void Nested() {\n"
+                    f"    constexpr std::size_t Alignment = {outer};\n"
+                    "    alignas(Alignment) static char before[4];\n"
+                    "    {\n"
+                    f"        constexpr std::size_t Alignment = {inner};\n"
+                    "        alignas(Alignment) static char inside[4];\n"
+                    "    }\n"
+                    "    alignas(Alignment) static char after[4];\n"
+                    "}\n")
+            with self.subTest(outer=outer, inner=inner):
+                self.assertEqual(reported(text), expected)
+
+    def test_constants_in_reopened_namespaces(self):
+        large = "constexpr std::size_t Alignment = 16384;"
+        use = "alignas(Alignment) static char data[4];"
+        for text, expected in (
+            (f"namespace N {{ {large} }}\nnamespace N {{ {use} }}\n", [2]),
+            (f"namespace N {{ {large} }}\nnamespace M {{ {use} }}\n", []),
+            (f"namespace {{ {large} }}\nnamespace {{ {use} }}\n", [2]),
+            (f"namespace A::B {{ {large} }}\nnamespace A {{ namespace B {{ {use} }} }}\n", [2]),
+            (f"namespace A {{ {large} }}\nnamespace A::B {{ {use} }}\n", [2]),
+            (f"namespace A {{ inline namespace V1 {{ {large} }} }}\nnamespace A {{ {use} }}\n", [2]),
+            (f"namespace A {{ inline namespace V1 {{ {large} }} }}\nnamespace B {{ {use} }}\n", []),
+            (f"namespace N {{ {large} }}\nnamespace N {{ void F() {{ constexpr std::size_t Alignment = 64; {use} }} }}\n", []),
+            (f'extern "C" {{ {large} }}\n{use}\n', [2]),
+        ):
+            with self.subTest(text=text):
+                self.assertEqual(reported(text), expected)
+
+
+class AlignmentRuleTests(unittest.TestCase):
+    def findings(self, after):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+
+            def git(*args):
+                return subprocess.run(["git", "-c", f"safe.directory={root}", "-c", "user.name=Conventions Test",
+                                       "-c", "user.email=test@example.com", "-c", "commit.gpgsign=false", *args],
+                                      cwd=root, capture_output=True, check=True, encoding="utf-8").stdout
+
+            source = root / SOURCE
+            source.parent.mkdir(parents=True)
+            source.write_text("alignas(65536) char existing[16];\n", encoding="utf-8")
+            git("init", "-q")
+            git("add", ".")
+            git("commit", "-qm", "test: add fixture")
+            source.write_text("alignas(65536) char existing[16];\n" + after, encoding="utf-8")
+            git("commit", "-qam", "test: add over-aligned blocks")
+            original = Path.cwd()
+            try:
+                os.chdir(root)
+                check = Check("HEAD~1", "HEAD")
+                check.code()
+            finally:
+                os.chdir(original)
+            return check.findings
+
+    def test_only_added_code_is_reported(self):
+        self.assertEqual(self.findings("alignas(256) char small[16];\n"
+                                       "const char* text = \"alignas(65536)\";\n"
+                                       "alignas(0x10000) char added[16];\n"
+                                       "constexpr std::size_t BlockBytes = 65536;\n"
+                                       "alignas(BlockBytes) std::array<std::uint8_t, BlockBytes> Block{};\n"),
+                         [("alignment", SOURCE, 4, "alignas(0x10000)"), ("alignment", SOURCE, 6, "alignas(BlockBytes)")])
+
+    def test_constants_are_resolved_in_their_scope(self):
+        self.assertEqual(self.findings("namespace First {\n" + SMALL + LARGE + "}\nnamespace Second {\n" + LARGE + SMALL + "}\n"),
+                         [("alignment", SOURCE, 9, "alignas(Alignment)"), ("alignment", SOURCE, 15, "alignas(Alignment)")])
+
+    def test_reopened_namespace_keeps_its_constants(self):
+        self.assertEqual(self.findings("namespace N {\n"
+                                       "    constexpr std::size_t Alignment = 16384;\n"
+                                       "}\n"
+                                       "namespace N {\n"
+                                       "    alignas(Alignment) static char data[4];\n"
+                                       "}\n"),
+                         [("alignment", SOURCE, 6, "alignas(Alignment)")])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/tests/test_check_conventions_ci_gate.py b/tools/tests/test_check_conventions_ci_gate.py
index 200d32f39b..ca942cd702 100644
--- a/tools/tests/test_check_conventions_ci_gate.py
+++ b/tools/tests/test_check_conventions_ci_gate.py
@@ -86,6 +86,47 @@ class CiGateTests(unittest.TestCase):
     def test_paths_of_another_trigger_do_not_count(self):
         self.assertUngated(workflow("  push:\n    paths:\n      - 'core/**'\n  pull_request:\n    branches: [main]\n", "  tests:\n    runs-on: ubuntu-latest\n"), "tests")
 
+    def test_flow_mapping_paths_passes(self):
+        self.assertGated(workflow("  pull_request: {paths: ['core/**']}\n", "  tests:\n    runs-on: ubuntu-latest\n"))
+
+    def test_flow_mapping_paths_ignore_passes(self):
+        self.assertGated(workflow("  pull_request: {paths-ignore: ['docs/**']}\n", "  tests:\n    runs-on: ubuntu-latest\n"))
+
+    def test_flow_mapping_without_paths_fails(self):
+        self.assertUngated(workflow("  pull_request: {branches: [main]}\n", "  tests:\n    runs-on: ubuntu-latest\n"), "tests")
+
+    def test_flow_mapping_quoted_values_do_not_count(self):
+        for filters in (
+            "{branches-ignore: ['paths:unused']}",
+            '{branches-ignore: ["paths-ignore:unused"]}',
+            "{branches-ignore: ['it''s, paths:unused']}",
+            r'{branches-ignore: ["escaped\", paths:unused"]}',
+            "{branches-ignore: ['}, paths: [core/**], {']}",
+        ):
+            with self.subTest(filters=filters):
+                self.assertUngated(workflow(f"  pull_request: {filters}\n", "  tests:\n    runs-on: ubuntu-latest\n"), "tests")
+                self.assertUngated(f"name: Test\non: {{pull_request: {filters}}}\njobs:\n  tests:\n    runs-on: ubuntu-latest\n", "tests")
+
+    def test_flow_mapping_nested_paths_do_not_count(self):
+        self.assertUngated(workflow("  pull_request: {branches: [{paths: ['core/**']}]}\n", "  tests:\n    runs-on: ubuntu-latest\n"), "tests")
+        self.assertUngated("name: Test\non: {push: {paths: ['core/**']}, pull_request: {branches: [{paths-ignore: ['docs/**']}]}}\njobs:\n  tests:\n    runs-on: ubuntu-latest\n", "tests")
+
+    def test_flow_mapping_quoted_keys_and_delimiters_pass(self):
+        for filters in (
+            "{branches: ['release,}'], paths: ['core/**']}",
+            "{'paths': ['core/**']}",
+            '{"paths-ignore": ["docs/**"]}',
+        ):
+            with self.subTest(filters=filters):
+                self.assertGated(workflow(f"  pull_request: {filters}\n", "  tests:\n    runs-on: ubuntu-latest\n"))
+                self.assertGated(f"name: Test\non: {{'pull_request': {filters}, push: {{branches: [main]}}}}\njobs:\n  tests:\n    runs-on: ubuntu-latest\n")
+
+    def test_top_level_flow_mapping_paths_passes(self):
+        self.assertGated(f"name: Test\n\non: {{pull_request: {{paths: ['core/**']}}}}\njobs:\n{GATE}  tests:\n    runs-on: ubuntu-latest\n")
+
+    def test_top_level_flow_paths_of_another_trigger_do_not_count(self):
+        self.assertUngated("name: Test\n\non: {push: {paths: ['core/**']}, pull_request: {branches: [main]}}\njobs:\n" + GATE + "  tests:\n    runs-on: ubuntu-latest\n", "tests")
+
     def test_inline_trigger_list_fails(self):
         self.assertUngated("name: Test\non: [push, pull_request]\njobs:\n  tests:\n    runs-on: ubuntu-latest\n", "tests")
 
diff --git a/tools/tests/test_check_conventions_env_reference.py b/tools/tests/test_check_conventions_env_reference.py
index 270218d686..ce341ce439 100644
--- a/tools/tests/test_check_conventions_env_reference.py
+++ b/tools/tests/test_check_conventions_env_reference.py
@@ -58,11 +58,15 @@ def findings_of(root, base, head, ref="base", directory="."):
 
 
 class EnvReferenceDiffTests(unittest.TestCase):
-    def run_case(self, base, head, target=None, directory="."):
+    def create_repository(self, base, head, target=None):
         temporary = tempfile.TemporaryDirectory()
         self.addCleanup(temporary.cleanup)
         root = Path(temporary.name)
         repository(root, base, head, target)
+        return root
+
+    def run_case(self, base, head, target=None, directory="."):
+        root = self.create_repository(base, head, target)
         return findings_of(root, base, head, "base" if target is None else "target", directory)
 
     def test_a_check_from_a_subdirectory_reports_the_same_findings(self):
@@ -80,10 +84,31 @@ class EnvReferenceDiffTests(unittest.TestCase):
             other: None,
         }
         expected = [("env-reference", SAMPLE, 2, f"APS5_NEW_READ is read here but has no row in {DOC}")]
-        self.assertEqual(self.run_case(base, head, target), expected)
-        for directory in ("core", "core/libs/prx/libSceExample", "docs/dev"):
+        root = self.create_repository(base, head, target)
+        for directory in (".", "core", "core/libs/prx/libSceExample", "docs/dev"):
             with self.subTest(directory=directory):
-                self.assertEqual(self.run_case(base, head, target, directory), expected)
+                self.assertEqual(findings_of(root, base, head, "target", directory), expected)
+
+    def test_a_new_spaced_read_is_reported_at_its_line(self):
+        base = {DOC: DOC_TEXT, SAMPLE: "int unrelated;\n"}
+        head = {SAMPLE: base[SAMPLE] + 'auto value = !std::getenv \t("APS5_NEW_READ");\n'}
+        self.assertEqual(self.run_case(base, head), [("env-reference", SAMPLE, 2,
+                                                    f"APS5_NEW_READ is read here but has no row in {DOC}")])
+
+    def test_removing_a_compact_read_keeps_a_row_still_used_by_a_spaced_read(self):
+        other = "core/libs/prx/libSceExample/Other.cpp"
+        base = {
+            DOC: DOC_TEXT,
+            SAMPLE: 'auto a = std::getenv("APS5_DOCUMENTED");\n',
+            other: 'auto b = _wgetenv \t(L"APS5_DOCUMENTED");\n',
+        }
+        self.assertEqual(self.run_case(base, {SAMPLE: "int unrelated;\n"}), [])
+
+    def test_a_removed_row_is_reported_when_a_spaced_read_remains(self):
+        base = {DOC: DOC_TEXT, SAMPLE: 'auto value = std::getenv \t("APS5_DOCUMENTED");\n'}
+        head = {DOC: "| `APS5_GONE` | presence |\n"}
+        self.assertEqual(self.run_case(base, head), [("env-reference", DOC, 0,
+                                                    "APS5_DOCUMENTED is still read by the code but this pull request removes its row")])
 
     def test_only_a_name_the_pull_request_adds_is_reported_at_its_line(self):
         base = {
diff --git a/tools/tests/test_check_main_sync.py b/tools/tests/test_check_main_sync.py
index a82463563e..85292d1d51 100644
--- a/tools/tests/test_check_main_sync.py
+++ b/tools/tests/test_check_main_sync.py
@@ -121,6 +121,51 @@ class CheckMainSyncTests(unittest.TestCase):
         self.assertIn("1 file(s) changed on both sides", result.stdout)
         self.assertIn("#77", result.stdout)
 
+    def check_squash_merge(self, conflict):
+        self.branch("feature")
+        self.repo.write("shared.txt", "one\nmine\nthree\n" if conflict else "zero\none\ntwo\nthree\n")
+        self.repo.commit("feature edit")
+        self.repo.git("checkout", "-q", "main")
+        self.repo.git("checkout", "-q", "-b", "theirs")
+        self.repo.write("shared.txt", "one\ntheirs\nthree\n" if conflict else "one\ntwo\nthree\nfour\n")
+        self.repo.commit("their edit")
+        self.repo.git("checkout", "-q", "main")
+        self.repo.git("merge", "--squash", "-q", "theirs")
+        self.repo.commit("fix(test): change the shared file (#4242)")
+        revision = check_main_sync.git(self.repo.path, "rev-parse", "--short", "main").stdout.strip()
+        data = check_main_sync.report(self.repo.path, "main", "feature")
+        self.assertEqual(data["pulls"], {4242: revision})
+        self.assertEqual(data["shared"], ["shared.txt"])
+        self.assertEqual(data["conflicts"], ["shared.txt"] if conflict else [])
+        for strict in ((False,) if conflict else (False, True)):
+            with self.subTest(strict=strict):
+                result = run_tool(self.repo.path, "--head", "feature", *(["--strict"] if strict else []))
+                self.assertEqual(result.returncode, 1 if conflict or strict else 0, result.stderr)
+                self.assertIn("merge: CONFLICT" if conflict else "merge: clean", result.stdout)
+                self.assertIn("merged pull requests that touched them: #4242", result.stdout)
+                self.assertNotIn("Traceback", result.stderr)
+
+    def test_clean_squash_merge_names_the_pull_request(self):
+        self.check_squash_merge(False)
+
+    def test_conflicting_squash_merge_names_the_pull_request(self):
+        self.check_squash_merge(True)
+
+    def test_squash_numbers_must_end_the_subject_and_touch_shared_paths(self):
+        self.branch("feature")
+        self.repo.write("shared.txt", "zero\none\ntwo\nthree\n")
+        self.repo.commit("feature edit")
+        self.repo.git("checkout", "-q", "main")
+        self.repo.write("shared.txt", "one\ntwo\nthree\nfour\n")
+        self.repo.commit("fix(test): reference (#13) without merging it")
+        self.assertEqual(check_main_sync.report(self.repo.path, "main", "feature")["pulls"], {})
+        self.repo.write("shared.txt", "one\ntwo\nthree\nfour\nfive\n")
+        self.repo.commit("fix(test): mention (#13) but merge (#4242)")
+        revision = check_main_sync.git(self.repo.path, "rev-parse", "--short", "main").stdout.strip()
+        self.repo.write("other.txt", "unrelated\n")
+        self.repo.commit("fix(test): an unrelated pull request (#9000)")
+        self.assertEqual(check_main_sync.report(self.repo.path, "main", "feature")["pulls"], {4242: revision})
+
     def test_a_subdirectory_reports_the_same_conflicts_and_pull_requests(self):
         (self.repo.path / "docs").mkdir()
         self.repo.write("docs/notes.txt", "x\n")
@@ -166,6 +211,15 @@ class CheckMainSyncTests(unittest.TestCase):
         result = run_tool(self.repo.path, "--head", "island")
         self.assertEqual(result.returncode, 2)
         self.assertIn("no common ancestor", result.stderr)
+        result = run_tool(self.repo.path, "--head", "missing")
+        expected = subprocess.run(
+            ["git", "-C", str(self.repo.path), "merge-base", "main", "missing"],
+            capture_output=True,
+            encoding="utf-8",
+        ).stderr.strip()
+        self.assertEqual(result.returncode, 2)
+        self.assertIn(f"git merge-base failed: {expected}", result.stderr)
+        self.assertNotIn("no common ancestor", result.stderr)
 
     def check_unicode_output(self, conflict):
         name = "sp ace \u00e9 \u6e2c \U0001f680.txt"
diff --git a/tools/tests/test_check_skips.py b/tools/tests/test_check_skips.py
index d0b03c0742..567a04612c 100644
--- a/tools/tests/test_check_skips.py
+++ b/tools/tests/test_check_skips.py
@@ -5,6 +5,7 @@ import subprocess
 import sys
 import tempfile
 import unittest
+from unittest import mock
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import check_skips
@@ -36,6 +37,102 @@ OTHER = [
 
 
 class CheckSkipsTests(unittest.TestCase):
+    def test_ctest_status_and_prefixed_device_reasons_are_expected(self):
+        reports = (
+            ('<skipped message="SKIP_RETURN_CODE=77"/><system-out>skipped, the device lacks geometryShader</system-out>', "linux"),
+            ('<skipped message="SKIP_RETURN_CODE=77"/><system-out>f16 native: skipped, the device has no native f16 with RTE rounding and kept denormals</system-out>', "linux"),
+            ('<skipped message="SKIP_RETURN_CODE=77"/><system-err>video: skipped, no display or Vulkan device: ErrorInitializationFailed</system-err>', "windows"),
+            ('<skipped message="SKIP_REGULAR_EXPRESSION_MATCHED"/><system-out>skipped, no usable Vulkan device: none</system-out>', "windows"),
+        )
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "junit.xml"
+            for report, job in reports:
+                with self.subTest(job=job, report=report):
+                    junit.write_text(f'<testsuite><testcase name="guest_probe">{report}</testcase></testsuite>', encoding="utf-8")
+                    result = subprocess.run([sys.executable, "-I", str(TOOL), str(junit), "--job", job],
+                                            capture_output=True, text=True)
+                    self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                    self.assertIn("all expected", result.stdout)
+
+    def test_ctest_status_does_not_allow_missing_or_unexpected_reasons(self):
+        reports = (
+            '<skipped message="SKIP_RETURN_CODE=77"/>',
+            '<skipped message="SKIP_REGULAR_EXPRESSION_MATCHED"/>',
+            '<skipped message="SKIP_RETURN_CODE=77"/><system-out>skipped, flaky\nskipped, the device lacks geometryShader</system-out>',
+        )
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "junit.xml"
+            for report in reports:
+                for job in ("linux", "windows"):
+                    with self.subTest(job=job, report=report):
+                        junit.write_text(f'<testsuite><testcase name="guest_probe">{report}</testcase></testsuite>', encoding="utf-8")
+                        result = subprocess.run([sys.executable, "-I", str(TOOL), str(junit), "--job", job],
+                                                capture_output=True, text=True)
+                        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                        self.assertIn("error: guest_probe skipped", result.stdout)
+
+    def test_ctest_status_preserves_high_refresh_policy(self):
+        reason = "skipped, current display does not provide 120 Hz"
+        reports = (
+            (f'<skipped message="SKIP_RETURN_CODE=77"/><system-out>{reason}</system-out>', 0),
+            (f'<skipped message="SKIP_REGULAR_EXPRESSION_MATCHED"/><system-out>{reason}</system-out>', 0),
+            (f'<skipped message="SKIP_RETURN_CODE=77"/><system-out>{reason}\nunexpected failure detail</system-out>', 1),
+            (f'<skipped message="SKIP_RETURN_CODE=77"/><system-out>{reason}\nskipped, flaky</system-out>', 1),
+            (f'<skipped message="SKIP_RETURN_CODE=77"/><system-out>skipped, no display\n{reason}</system-out>', 1),
+        )
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "junit.xml"
+            for report, expected_code in reports:
+                for job in ("linux", "windows"):
+                    with self.subTest(job=job, report=report):
+                        junit.write_text(f'<testsuite><testcase name="guest_video_out_high_frame_rate">{report}</testcase></testsuite>', encoding="utf-8")
+                        result = subprocess.run([sys.executable, "-I", str(TOOL), str(junit), "--job", job],
+                                                capture_output=True, text=True)
+                        self.assertEqual(result.returncode, expected_code, result.stdout + result.stderr)
+
+    def test_list_reports_device_reason_after_ctest_status(self):
+        xml = ('<testsuite><testcase name="guest_probe"><skipped message="SKIP_RETURN_CODE=77"/>'
+               '<system-out>f16 native: skipped, the device has no native f16</system-out></testcase></testsuite>')
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "junit.xml"
+            junit.write_text(xml, encoding="utf-8")
+            result = subprocess.run([sys.executable, "-I", str(TOOL), str(junit), "--list"],
+                                    capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertIn("guest_probe: skipped, the device has no native f16", result.stdout)
+            self.assertNotIn("SKIP_RETURN_CODE", result.stdout)
+
+    def test_unexpected_skip_reason_cannot_hide_behind_a_device_limitation(self):
+        reports = (
+            ('<skipped message="flaky"/><system-out>skipped, the device lacks geometryShader</system-out>', "linux"),
+            ('<skipped message="flaky"/><system-err>skipped, no display</system-err>', "windows"),
+            ('<skipped>flaky</skipped><system-out>skipped, no usable Vulkan device</system-out>', "windows"),
+            ('<skipped/><system-out>skipped, flaky\nskipped, the device lacks geometryShader</system-out>', "linux"),
+        )
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "junit.xml"
+            for report, job in reports:
+                with self.subTest(job=job, report=report):
+                    junit.write_text(f'<testsuite><testcase name="guest_probe">{report}</testcase></testsuite>', encoding="utf-8")
+                    result = subprocess.run([sys.executable, "-I", str(TOOL), str(junit), "--job", job],
+                                            capture_output=True, text=True)
+                    self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                    self.assertIn("error: guest_probe skipped", result.stdout)
+
+    def test_multiple_allowed_skip_reasons_remain_expected(self):
+        reports = (
+            ('<skipped message="the device lacks geometryShader"/><system-out>skipped, no display</system-out>', "linux"),
+            ('<skipped message="no display"/><system-err>skipped, no usable Vulkan device</system-err>', "windows"),
+        )
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "junit.xml"
+            for report, job in reports:
+                with self.subTest(job=job, report=report):
+                    junit.write_text(f'<testsuite><testcase name="guest_probe">{report}</testcase></testsuite>', encoding="utf-8")
+                    result = subprocess.run([sys.executable, "-I", str(TOOL), str(junit), "--job", job],
+                                            capture_output=True, text=True)
+                    self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
     def test_non_junit_xml_fails_in_every_cli_mode(self):
         reports = ('<config/>', '<Site><Testing><Test Status="notrun"><Name>coverage</Name></Test></Testing></Site>')
         with tempfile.TemporaryDirectory() as directory:
@@ -218,7 +315,68 @@ class CheckSkipsTests(unittest.TestCase):
                 code = check_skips.main([str(junit), "--job", "linux"])
             self.assertEqual(code, 0)
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
 
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(check_skips.sys, "stdout", out), mock.patch.object(check_skips.sys, "stderr", err):
+            try:
+                check_skips.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
+
+
+class RequiredTestsTests(unittest.TestCase):
+    def test_required_reports_without_testcases_fail_in_both_jobs(self):
+        for xml in ('<testsuite/>', '<testsuites><testsuite tests="0"/></testsuites>'):
+            with tempfile.TemporaryDirectory() as directory:
+                junit = Path(directory) / "junit.xml"
+                junit.write_text(xml, encoding="utf-8")
+                for job in ("linux", "windows"):
+                    for options in ([], ["--list"]):
+                        with self.subTest(xml=xml, job=job, options=options):
+                            result = subprocess.run(
+                                [sys.executable, "-I", str(TOOL), str(junit), "--job", job, "--require-tests", *options],
+                                capture_output=True, text=True, timeout=5)
+                            self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                            self.assertIn("no testcases", result.stderr)
+                            result = subprocess.run(
+                                [sys.executable, "-I", str(TOOL), str(junit), "--job", job, *options],
+                                capture_output=True, text=True, timeout=5)
+                            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+    def test_executed_tests_without_skips_pass_in_both_jobs(self):
+        for xml in ('<testsuite><testcase name="normal"/></testsuite>',
+                    '<testsuites><testsuite><testcase name="normal"/></testsuite></testsuites>'):
+            with tempfile.TemporaryDirectory() as directory:
+                junit = Path(directory) / "junit.xml"
+                junit.write_text(xml, encoding="utf-8")
+                for job in ("linux", "windows"):
+                    with self.subTest(xml=xml, job=job):
+                        result = subprocess.run(
+                            [sys.executable, "-I", str(TOOL), str(junit), "--job", job, "--require-tests"],
+                            capture_output=True, text=True, timeout=5)
+                        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                        self.assertIn("0 test(s) skipped, all expected", result.stdout)
 
 
 class SkipReportTests(unittest.TestCase):
diff --git a/tools/tests/test_configure_seed.py b/tools/tests/test_configure_seed.py
index 785b724136..36d6c6a66d 100644
--- a/tools/tests/test_configure_seed.py
+++ b/tools/tests/test_configure_seed.py
@@ -1,9 +1,11 @@
+import ctypes
 import os
 import shutil
 import subprocess
 import sys
 import tempfile
 import unittest
+from unittest import mock
 from pathlib import Path
 
 TOOL = Path(__file__).resolve().parents[1] / "configure_seed.py"
@@ -16,11 +18,20 @@ project(mini C)
 include(CheckIncludeFile)
 include(CheckSymbolExists)
 include(CheckCSourceCompiles)
+include(CheckTypeSize)
 check_include_file(stdio.h MINI_HAVE_STDIO_H)
 check_include_file(mini_missing_header.h MINI_HAVE_MISSING_H)
 check_symbol_exists(printf stdio.h MINI_HAVE_PRINTF)
 check_c_source_compiles("int main(void) { return 0; }" MINI_COMPILES)
 check_c_source_compiles("int main(void) { return undefined_name; }" MINI_FAILS)
+check_type_size(int MINI_SIZEOF_INT)
+check_type_size(mini_no_such_type_t MINI_SIZEOF_NONE)
+if(NOT HAVE_MINI_SIZEOF_INT OR NOT MINI_SIZEOF_INT)
+    message(FATAL_ERROR "Unsupported integer size: int")
+endif()
+if(HAVE_MINI_SIZEOF_NONE OR NOT "${MINI_SIZEOF_NONE}" STREQUAL "")
+    message(FATAL_ERROR "A missing type has a size")
+endif()
 set(MINI_OPTION "value" CACHE STRING "An option, not a check result")
 """
 
@@ -157,8 +168,9 @@ class ConfigureSeedProject(unittest.TestCase):
 class ConfigureSeedTests(ConfigureSeedProject):
     def test_only_check_results_are_seeded(self):
         found = configure_seed.checks(self.root / "fresh" / "CMakeCache.txt")
-        self.assertEqual({n for n in found if n.startswith("MINI_")},
-                         {"MINI_HAVE_STDIO_H", "MINI_HAVE_MISSING_H", "MINI_HAVE_PRINTF", "MINI_COMPILES", "MINI_FAILS"})
+        self.assertEqual({n for n in found if "MINI_" in n},
+                         {"MINI_HAVE_STDIO_H", "MINI_HAVE_MISSING_H", "MINI_HAVE_PRINTF", "MINI_COMPILES", "MINI_FAILS",
+                          "HAVE_MINI_SIZEOF_INT", "MINI_SIZEOF_INT", "HAVE_MINI_SIZEOF_NONE", "MINI_SIZEOF_NONE"})
         self.assertNotIn("CMAKE_C_COMPILER", found)
 
     def test_cache_without_checks_writes_an_empty_seed(self):
@@ -201,13 +213,17 @@ class ConfigureSeedRoundTripTests(ConfigureSeedProject):
         self.assertNotIn("HAVE:INTERNAL=", seeded.read_text(encoding="utf-8"))
 
     def test_seeded_configure_runs_no_check_and_gets_the_same_results(self):
-        self.assertRegex(self.fresh, r"Looking for|Performing Test")
+        self.assertRegex(self.fresh, r"Looking for|Performing Test|Check size of")
         output = self.configure("seeded", "-C", str(self.seed(self.root / "fresh" / "CMakeCache.txt", "seed.cmake")))
-        self.assertNotRegex(output, r"Looking for|Performing Test")
+        self.assertNotRegex(output, r"Looking for|Performing Test|Check size of")
         fresh = configure_seed.checks(self.root / "fresh" / "CMakeCache.txt")
         self.assertEqual(configure_seed.checks(self.root / "seeded" / "CMakeCache.txt"), fresh)
         self.assertEqual(fresh["MINI_HAVE_STDIO_H"][0], "1")
         self.assertEqual(fresh["MINI_FAILS"][0], "")
+        self.assertEqual(fresh["HAVE_MINI_SIZEOF_INT"][0], "TRUE")
+        self.assertEqual(fresh["MINI_SIZEOF_INT"][0], str(ctypes.sizeof(ctypes.c_int)))
+        self.assertEqual(fresh["HAVE_MINI_SIZEOF_NONE"][0], "FALSE")
+        self.assertEqual(fresh["MINI_SIZEOF_NONE"][0], "")
 
     def test_values_with_cmake_syntax_round_trip(self):
         cache = self.root / "odd" / "CMakeCache.txt"
@@ -229,6 +245,33 @@ class ChecksParsingTests(unittest.TestCase):
             found = configure_seed.checks(cache)
             self.assertEqual(found, {"FIRST_CHECK": ("1", "Test FIRST_CHECK")})
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(configure_seed.sys, "stdout", out), mock.patch.object(configure_seed.sys, "stderr", err):
+            try:
+                configure_seed.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_debt_split.py b/tools/tests/test_debt_split.py
index 1f2cf31775..ae68754774 100644
--- a/tools/tests/test_debt_split.py
+++ b/tools/tests/test_debt_split.py
@@ -44,15 +44,14 @@ class DebtSplitTests(unittest.TestCase):
         self.root = Path(self.directory.name)
         self.git("init", "-q", "-b", "main")
         self.write(INDEX, ORIGINAL)
-        self.git("add", ".")
-        self.git("commit", "-qm", "docs: record technical debt")
 
     def tearDown(self):
         self.directory.cleanup()
 
     def git(self, *args, check=True):
         return subprocess.run(
-            ["git", "-c", "user.name=Debt Test", "-c", "user.email=test@example.com", "-c", "commit.gpgsign=false", *args],
+            ["git", "-c", "user.name=Debt Test", "-c", "user.email=test@example.com", "-c", "commit.gpgsign=false",
+             "-c", "maintenance.auto=false", *args],
             cwd=self.root, capture_output=True, text=True, check=check,
             env={**os.environ, "GIT_EDITOR": "true"},
         )
@@ -68,10 +67,19 @@ class DebtSplitTests(unittest.TestCase):
         return subprocess.run([sys.executable, str(TOOL), command], cwd=self.root, capture_output=True, text=True, timeout=20)
 
     def split(self):
-        result = self.tool("split")
-        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        directory, streams = os.getcwd(), (sys.stdout, sys.stderr)
+        os.chdir(self.root)
+        try:
+            with open(os.devnull, "w", encoding="utf-8") as sink:
+                sys.stdout = sys.stderr = sink
+                debt_split.main(["split"])
+        finally:
+            os.chdir(directory)
+            sys.stdout, sys.stderr = streams
+
+    def commit(self, message):
         self.git("add", "-A")
-        self.git("commit", "-qm", "docs: split technical debt")
+        self.git("commit", "-qm", message)
 
     def test_split_preserves_external_urls_and_rewrites_local_links(self):
         links = ["HTTPS://example.test/guide#intro", "//example.test/guide#intro",
@@ -114,11 +122,13 @@ class DebtSplitTests(unittest.TestCase):
         self.assertEqual(self.read(INDEX).count("[debt](debt/)"), 1)
 
     def rebase(self, stubs, functional):
+        self.commit("docs: record technical debt")
         self.git("checkout", "-qb", "change")
         self.write(INDEX, index(stubs, functional))
         self.git("commit", "-qam", "feat: change debt")
         self.git("checkout", "-q", "main")
         self.split()
+        self.commit("docs: split technical debt")
         self.git("checkout", "-q", "change")
         rebase = self.git("rebase", "main", check=False)
         self.assertNotEqual(rebase.returncode, 0, rebase.stdout + rebase.stderr)
@@ -170,11 +180,13 @@ class DebtSplitTests(unittest.TestCase):
         self.assertIn("<<<<<<<", self.read(INDEX))
 
     def test_resolve_refuses_an_entry_main_changed_too(self):
+        self.commit("docs: record technical debt")
         self.git("checkout", "-qb", "change")
         self.write(INDEX, index([A_STUB, B_STUB + " here", C_STUB], [A_FUNCTIONAL, SHADER, SHARED]))
         self.git("commit", "-qam", "feat: change b")
         self.git("checkout", "-q", "main")
         self.split()
+        self.commit("docs: split technical debt")
         path = "docs/dev/debt/libSceB.md"
         self.write(path, self.read(path).replace("returns 0", "returns 1"))
         self.git("commit", "-qam", "docs: change b")
@@ -185,6 +197,7 @@ class DebtSplitTests(unittest.TestCase):
         self.assertIn("entry not found", result.stderr)
 
     def test_resolve_needs_a_conflict(self):
+        self.commit("docs: record technical debt")
         result = self.tool("resolve")
         self.assertNotEqual(result.returncode, 0)
         self.assertIn("not in a three-way conflict", result.stderr)
diff --git a/tools/tests/test_env_reference.py b/tools/tests/test_env_reference.py
index f56a933b14..3b43421864 100644
--- a/tools/tests/test_env_reference.py
+++ b/tools/tests/test_env_reference.py
@@ -3,7 +3,9 @@ import io
 import sys
 import tempfile
 import unittest
+from unittest import mock
 from pathlib import Path
+from unittest.mock import patch
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import env_reference
@@ -30,6 +32,8 @@ static bool q = _wgetenv(L"APS5_WIDE_PRESENT") != nullptr;
 static int r = _wtoi(_wgetenv(L"APS5_WIDE_INT"));
 static const wchar_t* s = _wgetenv(L"ANYPS5_WIDE_CONFIG");
 static const char* t = std::getenv("NOT_AN_ENV");
+static std::uint64_t u = std::min<std::uint64_t>(EnvironmentNumber("APS5_CRASH_STACK_BYTES"), std::uint64_t{1} << 20);
+static std::uint64_t v = MyEnvironmentNumber("APS5_NOT_A_NUMBER_READ");
 """
 
 
@@ -52,7 +56,8 @@ class EnvReferenceTests(unittest.TestCase):
              "APS5_CRASH_INDIRECT_MEMORY", "APS5_PIPELINE_JOURNAL_MAX_MIB",
              "APS5_PIPELINE_STORE_ENTRIES", "APS5_PIPELINE_JOURNAL_THREADS", "APS5_PM4_RING",
              "ANYPS5_LOADEXEC_ARGV_SKIP", "ANYPS5_LOADEXEC_PARENT",
-             "ANYPS5_WIDE_CONFIG", "APS5_WIDE_PRESENT", "APS5_WIDE_INT"})
+             "ANYPS5_WIDE_CONFIG", "APS5_WIDE_PRESENT", "APS5_WIDE_INT",
+             "APS5_CRASH_STACK_BYTES"})
         self.assertEqual(found["APS5_PROFILE_DRAW"][0][1], 1)
         self.assertEqual(found["APS5_THREAD_NICE"][0][2:], ("integer", "-10"))
         self.assertEqual(found["APS5_HOST_IMPORT_MIB"][0][2:], ("integer", "6144"))
@@ -65,6 +70,7 @@ class EnvReferenceTests(unittest.TestCase):
         self.assertEqual(found["ANYPS5_WIDE_CONFIG"][0][2:], ("string", ""))
         self.assertEqual(found["APS5_WIDE_PRESENT"][0][2:], ("presence", ""))
         self.assertEqual(found["APS5_WIDE_INT"][0][2:], ("integer", ""))
+        self.assertEqual(found["APS5_CRASH_STACK_BYTES"][0][2:], ("integer", ""))
 
     def test_reads_environmental_variable_with_multiline_getenv(self):
         root = self.fixture()
@@ -78,6 +84,51 @@ class EnvReferenceTests(unittest.TestCase):
         found = env_reference.reads([root / "core"])
         self.assertIn("APS5_MULTILINE", found)
 
+    def test_whitespace_before_parentheses_preserves_names_kinds_and_defaults(self):
+        root = self.fixture()
+        source = root / "core" / "Sample.cpp"
+        expected = env_reference.reads([root / "core"])
+        for separator in (" ", "\t", " \t "):
+            with self.subTest(separator=separator):
+                source.write_text(CODE.replace("(", separator + "("), encoding="utf-8")
+                self.assertEqual(env_reference.reads([root / "core"]), expected)
+
+    def test_reader_and_parenthesis_on_separate_lines_keep_line_numbers_and_kinds(self):
+        root = self.fixture()
+        source = root / "core" / "Sample.cpp"
+        source.write_text('auto a = !std::getenv\n    ("APS5_PRESENT");\n'
+                          'auto b = _wtoi(_wgetenv\n    (L"ANYPS5_INTEGER"));\n', encoding="utf-8")
+        found = env_reference.reads([root / "core"])
+        self.assertEqual(set(found), {"APS5_PRESENT", "ANYPS5_INTEGER"})
+        self.assertEqual(found["APS5_PRESENT"], [(source.as_posix(), 1, "presence", "")])
+        self.assertEqual(found["ANYPS5_INTEGER"], [(source.as_posix(), 3, "integer", "")])
+
+    def test_main_check_rejects_an_undocumented_spaced_read(self):
+        root = self.fixture()
+        (root / "core" / "Sample.cpp").write_text('auto value = !std::getenv \t("APS5_UNDOCUMENTED");\n', encoding="utf-8")
+        doc = root / "ENVIRONMENT.md"
+        doc.write_text("", encoding="utf-8")
+        with contextlib.redirect_stdout(io.StringIO()) as out:
+            code = env_reference.main(["--check", "--root", str(root / "core"), "--doc", str(doc)])
+        self.assertEqual(code, 1)
+        self.assertIn("APS5_UNDOCUMENTED is read", out.getvalue())
+        self.assertNotIn("all documented", out.getvalue())
+
+    def test_negated_spaced_getenv_is_a_presence_read(self):
+        root = self.fixture()
+        (root / "core" / "Sample.cpp").write_text('auto a = !std::getenv ("APS5_PRESENT");\n'
+                                                  'auto b = !_wgetenv\t(L"ANYPS5_PRESENT");\n', encoding="utf-8")
+        found = env_reference.reads([root / "core"])
+        self.assertEqual(set(found), {"APS5_PRESENT", "ANYPS5_PRESENT"})
+        self.assertEqual([sites[0][2] for sites in found.values()], ["presence", "presence"])
+
+    def test_spacing_does_not_change_literal_parentheses_in_a_custom_prefix(self):
+        for separator in ("", " ", "\t"):
+            with self.subTest(separator=separator):
+                source = f'getenv{separator}("CUSTOM(NAME"); getenv{separator}("CUSTOM (WRONG");'
+                found = env_reference.line_reads(source, ("CUSTOM(",))
+                self.assertEqual([match.group("name") for _, match in found], ["CUSTOM(NAME"])
+
     def test_multiline_reads_keep_line_numbers_and_do_not_duplicate(self):
         root = self.fixture()
         source = root / "core" / "Sample.cpp"
@@ -118,6 +169,19 @@ class EnvReferenceTests(unittest.TestCase):
         self.assertTrue([name for name in found if name.startswith("APS5_")])
         self.assertTrue([name for name in found if name.startswith("ANYPS5_")])
 
+    def test_reads_fails_on_a_source_file_it_cannot_decode(self):
+        root = self.fixture()
+        (root / "core" / "Latin.cpp").write_bytes(b'static const char* s = "caf\xe9";\n')
+        with self.assertRaises(ValueError) as raised:
+            env_reference.reads([root / "core"], BOTH)
+        self.assertIn("Latin.cpp", str(raised.exception))
+        stderr = io.StringIO()
+        with contextlib.redirect_stderr(stderr):
+            code = env_reference.main(["--check", "--doc", str(root / "missing.md"), "--root", str(root / "core")])
+        self.assertEqual(code, 1)
+        self.assertIn("cannot read", stderr.getvalue())
+        self.assertIn("Latin.cpp", stderr.getvalue())
+
     def test_check_passes_when_every_read_name_has_a_row(self):
         root = self.fixture()
         found = env_reference.reads([root / "core"])
@@ -164,6 +228,64 @@ class EnvReferenceTests(unittest.TestCase):
         (core / "3rdparty" / "Ignored.cpp").write_text('static bool b = IsEnvironmentSet("APS5_IGNORED");\n', encoding="utf-8")
         self.assertEqual(set(env_reference.reads([core], BOTH)), {"APS5_TRACE_GPU"})
 
+    def test_main_reconfigures_streams_for_unicode_report_paths(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = "ascii"
+                self.errors = "strict"
+                self.text = ""
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                text.encode(self.encoding, self.errors)
+                self.text += text
+                return len(text)
+
+            def flush(self):
+                pass
+
+        root = self.fixture() / "source-Ж"
+        root.mkdir()
+        core = root / "core"
+        core.mkdir()
+        (core / "Sample.cpp").write_text('static bool a = std::getenv("APS5_TRACE_GPU") != nullptr;\n', encoding="utf-8")
+        out, err = Stream(), Stream()
+        with mock.patch.object(env_reference.sys, "stdout", out), mock.patch.object(env_reference.sys, "stderr", err):
+            self.assertEqual(env_reference.main(["--root", str(core)]), 0)
+        self.assertEqual((out.encoding, out.errors), ("utf-8", "backslashreplace"))
+        self.assertEqual((err.encoding, err.errors), ("utf-8", "backslashreplace"))
+        self.assertIn((core / "Sample.cpp").as_posix(), out.text)
+
+    def test_main_reports_unicode_scan_root_with_non_utf8_stderr(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = "ascii"
+                self.errors = "strict"
+                self.text = ""
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                text.encode(self.encoding, self.errors)
+                self.text += text
+                return len(text)
+
+            def flush(self):
+                pass
+
+        root = Path(tempfile.gettempdir()) / "missing-source-Ж"
+        out, err = Stream(), Stream()
+        with mock.patch.object(env_reference.sys, "stdout", out), mock.patch.object(env_reference.sys, "stderr", err):
+            self.assertEqual(env_reference.main(["--root", str(root)]), 1)
+        self.assertEqual((out.encoding, out.errors), ("utf-8", "backslashreplace"))
+        self.assertEqual((err.encoding, err.errors), ("utf-8", "backslashreplace"))
+        self.assertIn(str(root), err.text)
+
     def test_main_rejects_a_scan_root_that_is_not_a_directory(self):
         root = self.fixture()
         for name in ("missing", "core/Sample.cpp"):
@@ -176,5 +298,33 @@ class EnvReferenceTests(unittest.TestCase):
                 self.assertNotIn("no longer reads", out.getvalue())
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(env_reference.sys, "stdout", out), patch.object(env_reference.sys, "stderr", err):
+            try:
+                env_reference.main(["--root", "nonexistent"])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_import_audit.py b/tools/tests/test_import_audit.py
index b719d91dc6..5554152a68 100644
--- a/tools/tests/test_import_audit.py
+++ b/tools/tests/test_import_audit.py
@@ -104,6 +104,13 @@ def exporting(*names):
     return build_elf([(name, 1, GLOBAL_FUNCTION) for name in names])
 
 
+def elf_dynamic_range_fields(image):
+    sections = struct.unpack_from("<Q", image, 40)[0]
+    if sections:
+        return sections + 192 + 24, sections + 192 + 32
+    return 120 + 8, 120 + 32
+
+
 def with_elf_symbol_table_range(image, offset, size):
     image = bytearray(image)
     section_offset = struct.unpack_from("<Q", image, 40)[0] + 64
@@ -172,7 +179,7 @@ def build_pe_with_imports(dlls, names=()):
 def write_source(root, library, text):
     directory = Path(root) / library
     directory.mkdir(parents=True, exist_ok=True)
-    (directory / "Export.cpp").write_text(text)
+    (directory / "Export.cpp").write_text(text, encoding="utf-8")
 
 
 def write_registry(path, entries, encoding="utf-8"):
@@ -323,7 +330,7 @@ class ImportAuditTests(unittest.TestCase):
         data = json.loads(report.read_text(encoding="utf-8"))
         records = {record["nid"]: record for record in data["imports"]}
         self.assertEqual(data["references"], 5)
-        self.assertEqual(data["unique_by_class"], {"implemented": 3, "stub": 0, "absent": 1, "module": 0})
+        self.assertEqual(data["unique_by_class"], {"implemented": 3, "partial": 0, "stub": 0, "absent": 1, "module": 0})
         self.assertEqual(records["strcmp"]["references"], 2)
         self.assertEqual(records["strcmp"]["providers"], ["libc.prx"])
         self.assertTrue(records["missing_function"]["weak"])
@@ -347,6 +354,68 @@ class ImportAuditTests(unittest.TestCase):
         self.assertTrue(records["missing_function"]["weak"])
         self.assertIsNone(data["stops"][0]["nid"])
 
+    def test_nid_only_exports_do_not_resolve_literal_import_names(self):
+        work = self.work
+        name, nid = "strlen", nid_names.compute_nid("strlen")
+        registry, report = work.root / "sdk.registry.json", work.root / "audit.json"
+        for image in (exporting(nid), build_pe([nid])):
+            (work.libs / "libc.prx").write_bytes(image)
+            for stub in (False, True):
+                write_source(work.source, "libc", (STUB_SOURCE if stub else DONE_SOURCE).format(name=name))
+                for weak in (False, True):
+                    with self.subTest(pe=image.startswith(b"MZ"), stub=stub, weak=weak):
+                        write_registry(registry, [(name, "libc.prx", weak)])
+                        code, out, err = work.run(registry, "--json", str(report))
+                        self.assertEqual((code, err), (1, ""))
+                        data = json.loads(report.read_text(encoding="utf-8"))
+                        record, = data["imports"]
+                        self.assertEqual(record["class"], "stub" if stub else "implemented")
+                        self.assertEqual(record["providers"], ["libc.prx"])
+                        self.assertTrue(record["symbol_mismatch"])
+                        self.assertEqual(data["symbol_mismatch"], 1)
+                        self.assertEqual(data["stops"][0]["nid"], None if weak else name)
+                        self.assertIn("Qualified import names exported only as their NID", out)
+                        self.assertIn(f"-> {nid}", out)
+
+    def test_name_mismatch_requires_a_resolved_host_fallback(self):
+        name, library = "strlen", "libc.prx"
+        exports = {nid_names.compute_nid(name): [library]}
+        for providers, modules, kind, mismatch in (({}, set(), "absent", False),
+                                                   (exports, {library}, "module", False),
+                                                   (exports, set(), "implemented", True)):
+            with self.subTest(kind=kind):
+                records, _ = import_audit.audit([(name, library, False)], providers, {}, {library}, modules)
+                self.assertEqual(records[0]["class"], kind)
+                self.assertEqual(records[0]["symbol_mismatch"], mismatch)
+
+    def test_literal_exports_resolve_without_a_name_mismatch(self):
+        work = self.work
+        name, nid = "strlen", nid_names.compute_nid("strlen")
+        registry, report = work.root / "sdk.registry.json", work.root / "audit.json"
+        for image in (exporting(name, nid), build_pe(sorted([name, nid]))):
+            with self.subTest(pe=image.startswith(b"MZ")):
+                (work.libs / "libc.prx").write_bytes(image)
+                write_registry(registry, [(name, "libc.prx"), (nid, "libc.prx")])
+                code, out, err = work.run(registry, "--json", str(report))
+                self.assertEqual((code, err), (0, ""))
+                data = json.loads(report.read_text(encoding="utf-8"))
+                self.assertEqual(data["symbol_mismatch"], 0)
+                self.assertTrue(all(not record["symbol_mismatch"] for record in data["imports"]))
+                self.assertIsNone(data["stops"][0]["nid"])
+                self.assertNotIn("Qualified import names exported only as their NID", out)
+
+    def test_unscoped_windows_imports_keep_the_loaders_nid_fallback(self):
+        work = self.work
+        name, nid = "strlen", nid_names.compute_nid("strlen")
+        registry, report = work.root / "sdk.registry.json", work.root / "audit.json"
+        write_registry(registry, [(name, "")])
+        (work.libs / "libc.prx").write_bytes(build_pe([nid]))
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (0, ""))
+        data = json.loads(report.read_text(encoding="utf-8"))
+        self.assertEqual(data["symbol_mismatch"], 0)
+        self.assertIsNone(data["stops"][0]["nid"])
+
     def test_named_nid_fallback_preserves_stub_and_library_classification(self):
         nid = nid_names.compute_nid(MESSAGE_NAME)
         imports = [(MESSAGE_NAME, "libSceOther.prx", False)]
@@ -366,7 +435,7 @@ class ImportAuditTests(unittest.TestCase):
         records, _ = import_audit.audit(imports, exports, stubs, set(exports), set())
         self.assertEqual(records[0]["class"], "stub")
         self.assertEqual(records[0]["providers"], ["literal.prx"])
-        module_imports = {"guest.so": (["strlen"], [])}
+        module_imports = {"guest.so": ([("strlen", False)], [])}
         records, _ = import_audit.audit([], {"j4ViWNHEgww": ["libc.prx"]}, {},
                                        {"libc.prx"}, set(module_imports), module_imports,
                                        {"strlen": ["other.so"]})
@@ -552,8 +621,8 @@ class ImportAuditTests(unittest.TestCase):
         data = json.loads(result.read_text())
         self.assertEqual(data["references"], 10)
         self.assertEqual(data["unique_imports"], 9)
-        self.assertEqual(data["unique_by_class"], {"implemented": 3, "stub": 2, "absent": 3, "module": 1})
-        self.assertEqual(data["references_by_class"], {"implemented": 3, "stub": 3, "absent": 3, "module": 1})
+        self.assertEqual(data["unique_by_class"], {"implemented": 3, "partial": 0, "stub": 2, "absent": 3, "module": 1})
+        self.assertEqual(data["references_by_class"], {"implemented": 3, "partial": 0, "stub": 3, "absent": 3, "module": 1})
         self.assertEqual(data["missing_libraries"], {"libSceFoo.prx": 1, "libSceOther.prx": 1})
         self.assertEqual(data["library_mismatch"], 1)
         kinds = {(record["nid"], record["library"]): record["class"] for record in data["imports"]}
@@ -582,7 +651,7 @@ class ImportAuditTests(unittest.TestCase):
         self.assertEqual((code, err), (1, ""))
         data = json.loads(result.read_text())
         self.assertEqual(data["references"], 4)
-        self.assertEqual(data["unique_by_class"], {"implemented": 2, "stub": 1, "absent": 1, "module": 0})
+        self.assertEqual(data["unique_by_class"], {"implemented": 2, "partial": 0, "stub": 1, "absent": 1, "module": 0})
         self.assertEqual(data["missing_libraries"], {})
         records = {(record["nid"], record["module"]): record for record in data["imports"]}
         self.assertEqual(records[("AAAAAAAAAAA", "main.prx")]["class"], "implemented")
@@ -595,6 +664,28 @@ class ImportAuditTests(unittest.TestCase):
         self.assertIn("[library not named]", out)
         self.assertIn("EEEEEEEEEEE  (imported by main.prx)", out)
 
+    def test_module_import_bindings_survive_the_audit(self):
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(exporting())
+        registry, result = work.root / "game.json", work.root / "audit.json"
+        write_registry(registry, [])
+        symbols = [("optional", 0, 0x22), ("required", 0, GLOBAL_FUNCTION),
+                   ("mixed#first", 0, 0x22), ("mixed#second", 0, GLOBAL_FUNCTION)]
+        images = [build_elf(symbols), build_sectionless_elf(symbols),
+                  build_sectionless_elf(symbols, gnu_hash=True)]
+        for index, image in enumerate(images):
+            with self.subTest(image=index):
+                (work.modules / "guest.so").write_bytes(image)
+                code, out, err = work.run(registry, "--json", str(result))
+                self.assertEqual((code, err), (1, ""))
+                data = json.loads(result.read_text())
+                records = {record["nid"]: record for record in data["imports"]}
+                self.assertTrue(records["optional"]["weak"])
+                self.assertFalse(records["required"]["weak"])
+                self.assertFalse(records["mixed"]["weak"])
+                self.assertEqual(data["references"], 3)
+                self.assertIn("optional  (weak import)", out)
+
     def test_module_sidecars_do_not_change_the_audit(self):
         work = self.work
         (work.libs / "libSceA.prx").write_bytes(exporting("AAAAAAAAAAA"))
@@ -636,7 +727,7 @@ class ImportAuditTests(unittest.TestCase):
         self.assertEqual((code, err), (0, ""))
         data = json.loads(result.read_text())
         self.assertEqual(data["references"], 3)
-        self.assertEqual(data["unique_by_class"], {"implemented": 2, "stub": 0, "absent": 0, "module": 1})
+        self.assertEqual(data["unique_by_class"], {"implemented": 2, "partial": 0, "stub": 0, "absent": 0, "module": 1})
         self.assertEqual(data["missing_libraries"], {})
         records = {(record["nid"], record.get("module")): record for record in data["imports"]}
         self.assertEqual(records[("AAAAAAAAAAA", "provider.data")]["providers"], ["libSceA.prx"])
@@ -662,6 +753,46 @@ class ImportAuditTests(unittest.TestCase):
         records, missing = import_audit.audit(imports, {}, {}, set(), import_audit.ModuleNames({"sdk-shipping.prx"}))
         self.assertEqual((records[0]["class"], missing), ("absent", {"SDK-Shipping.debug_prx": 1}))
 
+    def test_windows_module_suffix_case_does_not_report_existing_modules_as_missing(self):
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(build_pe([]))
+        registry, report = work.root / "game.registry.json", work.root / "audit.json"
+        cases = (("sdk-shipping.prx", "SDK-Shipping.DEBUG_PRX"),
+                 ("SDK-SHIPPING.PRX", "sdk-shipping.sprx"),
+                 ("Sdk-Shipping.SuPrX", "SDK-SHIPPING.debug_prx"),
+                 ("SDK-SHIPPING.DEBUG_PRX", "sdk-shipping.PRX"))
+        for filename, needed in cases:
+            with self.subTest(filename=filename, needed=needed):
+                module = work.modules / filename
+                module.write_bytes(exporting("AAAAAAAAAAA"))
+                try:
+                    write_registry(registry, [("AAAAAAAAAAA", needed)])
+                    import_audit.needed_registry_path(registry).write_text(json.dumps([needed]), encoding="utf-8")
+                    code, _, err = work.run(registry, "--json", str(report), "--strict-providers")
+                    self.assertEqual((code, err), (0, ""))
+                    data = json.loads(report.read_text(encoding="utf-8"))
+                    self.assertEqual(data["missing_libraries"], {})
+                    self.assertEqual(data["unique_by_class"], {"implemented": 0, "partial": 0, "stub": 0, "absent": 0, "module": 1})
+                    self.assertEqual(data["references"], 1)
+                    self.assertEqual(data["imports"][0]["library"], needed)
+                finally:
+                    module.unlink()
+
+    def test_elf_module_suffix_case_stays_significant(self):
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(exporting())
+        (work.modules / "sdk-shipping.prx").write_bytes(exporting("AAAAAAAAAAA"))
+        registry, report = work.root / "game.registry.json", work.root / "audit.json"
+        for suffix in ("PRX", "SPRX", "SUPRX", "DEBUG_PRX"):
+            needed = "sdk-shipping." + suffix
+            with self.subTest(needed=needed):
+                write_registry(registry, [("AAAAAAAAAAA", needed)])
+                code, _, err = work.run(registry, "--json", str(report))
+                self.assertEqual((code, err), (1, ""))
+                data = json.loads(report.read_text(encoding="utf-8"))
+                self.assertEqual(data["missing_libraries"], {needed: 1})
+                self.assertEqual(data["unique_by_class"], {"implemented": 0, "partial": 0, "stub": 0, "absent": 1, "module": 0})
+
     def test_converted_module_matches_imports_of_its_base_name(self):
         work = self.work
         (work.libs / "libc.prx").write_bytes(exporting())
@@ -808,7 +939,7 @@ class ImportAuditTests(unittest.TestCase):
                 self.assertEqual((code, err), (1, ""))
                 data = json.loads(result.read_text())
                 self.assertEqual((data["references"], data["unique_imports"]), (2, 2))
-                self.assertEqual(data["unique_by_class"], {"implemented": 1, "stub": 0, "absent": 1, "module": 0})
+                self.assertEqual(data["unique_by_class"], {"implemented": 1, "partial": 0, "stub": 0, "absent": 1, "module": 0})
                 self.assertEqual(data["references_by_class"], data["unique_by_class"])
                 self.assertEqual(data["missing_libraries"], {"libSceMissing.prx": 1})
                 records = {record["nid"]: record for record in data["imports"]}
@@ -849,7 +980,7 @@ class ImportAuditTests(unittest.TestCase):
             ("AAAAAAAAAAA", 0, GLOBAL_FUNCTION), ("BBBBBBBBBBB", 1, GLOBAL_FUNCTION)], ["libSceA.prx"])
         expected_imports = import_audit.elf_imports(path, image)
         expected_exports = import_audit.elf_exports(path, image)
-        self.assertEqual(expected_imports, ({"AAAAAAAAAAA"}, {"libSceA.prx"}))
+        self.assertEqual(expected_imports, ({"AAAAAAAAAAA": False}, {"libSceA.prx"}))
         self.assertEqual(expected_exports, {"BBBBBBBBBBB"})
         for section_offset in (len(image), len(image) + 64):
             for section_count in (1, 0):
@@ -909,12 +1040,94 @@ class ImportAuditTests(unittest.TestCase):
                 self.assertIn(str(path), err)
                 self.assertIn("lies outside the file", err)
 
+    def test_elf_import_symbol_tables_reject_ranges_outside_the_file(self):
+        original = build_elf([("alpha", 0, GLOBAL_FUNCTION)])
+        for offset, size in ((len(original) + 1, 0), (2**64 - 1, 0),
+                             (len(original) - 23, 24), (len(original), 24)):
+            with self.subTest(offset=offset, size=size):
+                with self.assertRaisesRegex(import_audit.AuditError, "dynamic symbol table.*outside the file"):
+                    import_audit.elf_imports(Path("invalid-imports.prx"), with_elf_symbol_table_range(original, offset, size))
+
+    def test_elf_import_symbol_tables_can_end_at_eof(self):
+        original = build_elf([("alpha", 0, GLOBAL_FUNCTION)])
+        empty = with_elf_symbol_table_range(original, len(original), 0)
+        symbols, needed = import_audit.elf_imports(Path("empty.prx"), empty)
+        self.assertFalse(symbols)
+        self.assertFalse(needed)
+        sections = struct.unpack_from("<Q", original, 40)[0]
+        offset, size = struct.unpack_from("<QQ", original, sections + 64 + 24)
+        relocated = with_elf_symbol_table_range(original + original[offset:offset + size], len(original), size)
+        symbols, needed = import_audit.elf_imports(Path("relocated.prx"), relocated)
+        self.assertEqual(set(symbols), {"alpha"})
+        self.assertFalse(needed)
+
+    def test_elf_dynamic_table_ranges_are_checked_before_the_terminator(self):
+        for sectioned in (False, True):
+            original = build_elf([], ["libc.prx"]) if sectioned else build_sectionless_elf([], ["libc.prx"])
+            offset_field, size_field = elf_dynamic_range_fields(original)
+            offset = struct.unpack_from("<Q", original, offset_field)[0]
+            excessive_size = ((len(original) - offset) // 16 + 1) * 16
+            for start, size in ((offset, excessive_size), (offset, 2**64 - 16),
+                                (len(original) + 1, 0), (2**64 - 1, 16)):
+                with self.subTest(sectioned=sectioned, offset=start, size=size):
+                    image = bytearray(original)
+                    struct.pack_into("<Q", image, offset_field, start)
+                    struct.pack_into("<Q", image, size_field, size)
+                    with self.assertRaisesRegex(import_audit.AuditError, "dynamic (segment|section).*outside the file"):
+                        import_audit.elf_imports(Path("truncated.prx"), image)
+
+    def test_elf_dynamic_tables_ending_at_eof_and_terminated_padding(self):
+        for sectioned in (False, True):
+            original = build_elf([], ["libc.prx"]) if sectioned else build_sectionless_elf([], ["libc.prx"])
+            offset_field, size_field = elf_dynamic_range_fields(original)
+            offset = struct.unpack_from("<Q", original, offset_field)[0]
+            size = struct.unpack_from("<Q", original, size_field)[0]
+            for padding in (b"", struct.pack("<qQ", 1, 2**64 - 1)):
+                with self.subTest(sectioned=sectioned, padding=bool(padding)):
+                    image = bytearray(original + original[offset:offset + size] + padding)
+                    struct.pack_into("<Q", image, offset_field, len(original))
+                    struct.pack_into("<Q", image, size_field, size + len(padding))
+                    if not sectioned:
+                        struct.pack_into("<QQ", image, 64 + 32, len(image), len(image))
+                        struct.pack_into("<QQ", image, offset_field + 8, 0x400000 + len(original), 0x400000 + len(original))
+                        struct.pack_into("<Q", image, size_field + 8, size + len(padding))
+                    symbols, needed = import_audit.elf_imports(Path("valid.prx"), image)
+                    self.assertFalse(symbols)
+                    self.assertEqual(needed, {"libc.prx"})
+
+    def test_invalid_elf_dynamic_ranges_preserve_the_previous_report(self):
+        registry = self.work.root / "game.json"
+        report = self.work.root / "audit.json"
+        module = self.work.modules / "broken.prx"
+        write_registry(registry, [])
+        (self.work.libs / "libc.prx").write_bytes(exporting())
+        cases = []
+        for sectioned in (False, True):
+            original = build_elf([], ["libc.prx"]) if sectioned else build_sectionless_elf([], ["libc.prx"])
+            offset_field, size_field = elf_dynamic_range_fields(original)
+            offset = struct.unpack_from("<Q", original, offset_field)[0]
+            image = bytearray(original)
+            struct.pack_into("<Q", image, size_field, ((len(image) - offset) // 16 + 1) * 16)
+            cases.append(("dynamic section" if sectioned else "dynamic segment", image))
+        original = build_elf([], ["libc.prx"])
+        cases.append(("dynamic symbol table", with_elf_symbol_table_range(original, len(original) + 1, 0)))
+        for table, image in cases:
+            with self.subTest(table=table):
+                module.write_bytes(image)
+                report.write_bytes(b"previous report")
+                code, output, error = self.work.run(registry, "--json", str(report))
+                self.assertEqual((code, output), (2, ""))
+                self.assertIn(str(module), error)
+                self.assertIn(table, error)
+                self.assertNotIn("Traceback", error)
+                self.assertEqual(report.read_bytes(), b"previous report")
+
     def test_sectionless_elf_gnu_hash(self):
         image = build_sectionless_elf([
             ("AAAAAAAAAAA", 0, GLOBAL_FUNCTION), ("BBBBBBBBBBB", 1, GLOBAL_FUNCTION)],
             ["libSceA.prx"], gnu_hash=True)
         self.assertEqual(import_audit.elf_program_dynamic_symbols(Path("module.prx"), image),
-                         ({"AAAAAAAAAAA"}, {"BBBBBBBBBBB"}, {"libSceA.prx"}))
+                         ({"AAAAAAAAAAA": False}, {"BBBBBBBBBBB"}, {"libSceA.prx"}))
 
     def test_sectionless_hash_metadata_must_be_file_backed(self):
         for gnu_hash in (False, True):
@@ -953,7 +1166,7 @@ class ImportAuditTests(unittest.TestCase):
         code, out, err = work.run(registry, "--json", str(result))
         self.assertEqual((code, err), (0, ""))
         data = json.loads(result.read_text())
-        self.assertEqual(data["unique_by_class"], {"implemented": 1, "stub": 0, "absent": 0, "module": 0})
+        self.assertEqual(data["unique_by_class"], {"implemented": 1, "partial": 0, "stub": 0, "absent": 0, "module": 0})
         self.assertEqual(data["references"], 1)
 
     def test_module_export_suffix_is_stripped_with_and_without_sections(self):
@@ -1005,7 +1218,7 @@ class ImportAuditTests(unittest.TestCase):
                     data = json.loads(result.read_text())
                     self.assertEqual(data["references"], 4 + int(unresolved))
                     self.assertEqual(data["unique_by_class"],
-                                     {"implemented": 3, "stub": 0, "absent": int(unresolved), "module": 0})
+                                     {"implemented": 3, "partial": 0, "stub": 0, "absent": int(unresolved), "module": 0})
                     records = {record["nid"]: record for record in data["imports"]}
                     for symbol in (MESSAGE_NID, MESSAGE_NAME, "strlen"):
                         self.assertEqual(records[symbol]["providers"], [provider.name])
@@ -1184,6 +1397,27 @@ class ImportAuditTests(unittest.TestCase):
         self.assertNotIn(("libSceTwin.native.prx", twin), stubs)
         self.assertNotEqual(nid_names.compute_nid("printf"), nid_names.compute_nid("printf_nid_postfix"))
 
+    def test_source_stubs_decodes_source_with_utf8_bom(self):
+        source = self.work.source
+        write_source(source, "libSceBom", "\ufeff" + STUB_SOURCE.format(name="sceBomPending"))
+        stubs = import_audit.source_stubs(source)
+        self.assertEqual(stubs.get(("libSceBom.prx", nid_names.compute_nid("sceBomPending"))), "sceBomPending")
+
+    def test_source_stubs_passes_decoded_text_without_bom_to_alias_scanner(self):
+        source = self.work.source
+        write_source(source, "libSceBomAlias", "\ufeff" + 'APS5_EXPORT("AAAAAAAAAAA", sceBomAlias);\n' + STUB_SOURCE.format(name="sceBomAlias"))
+        seen = []
+        real = nid_names.source_aliases
+
+        def spy(text):
+            seen.append(text)
+            return real(text)
+
+        with patch.object(nid_names, "source_aliases", spy):
+            import_audit.source_stubs(source)
+        self.assertTrue(seen)
+        self.assertTrue(all(text.startswith("APS5_EXPORT(") for text in seen))
+
     def test_disambiguated_stubs_use_the_nid_of_their_symbol(self):
         source = self.work.source
         write_source(source, "libkernel", STUB_SOURCE.format(name="fstat_nid_disambig1_nid_postfix")
@@ -1253,6 +1487,77 @@ class ImportAuditTests(unittest.TestCase):
         self.assertEqual(import_audit.source_stubs(source), {
             (library + ".prx", nid): "scePending" for library in ("libA", "libB", "libZOwner")})
 
+    def test_guarded_exports_are_partial_and_unconditional_ones_are_stubs(self):
+        source = self.work.source
+        write_source(source, "libGuard",
+                     "void Fail() { NotImplemented_nid_no_patch(__func__); }\n"
+                     "void Check(int value) { if (value) NotImplemented_nid_no_patch(__func__); }\n"
+                     "int APS5_VABI sceDirect(int value) { NotImplemented_nid_no_patch(__func__); return 0; }\n"
+                     "int APS5_VABI sceReturned(int value) { return NotImplemented_nid_no_patch(__func__); }\n"
+                     "int APS5_VABI sceWrapped(int value) { value += 1; Fail(); return value; }\n"
+                     "int APS5_VABI sceIf(int value) { if (value > 1) NotImplemented_nid_no_patch(__func__); return value; }\n"
+                     "int APS5_VABI sceBlock(int value) { if (value) { NotImplemented_nid_no_patch(__func__); } return 0; }\n"
+                     "int APS5_VABI sceElse(int value) { if (value) return 1; else Fail(); return 0; }\n"
+                     "int APS5_VABI sceGuarded(int value) { Check(value); return value; }\n"
+                     "int APS5_VABI sceLoop(int value) { for (int i = 0; i < value; ++i) Fail(); return 0; }\n"
+                     "int APS5_VABI sceSwitch(int value) { switch (value) { case 0: return 0; default: Fail(); } return 1; }\n"
+                     "int APS5_VABI sceTernary(int value) { return value ? value : NotImplemented_nid_no_patch(__func__); }\n"
+                     "int APS5_VABI sceShort(int value) { return value && NotImplemented_nid_no_patch(__func__); }\n"
+                     "int APS5_VABI sceLambda(int value) { auto f = [&]() { Fail(); }; return value; }\n"
+                     "int APS5_VABI sceMember(int value) { if (value) Fail(); other.Fail(); return value; }\n"
+                     "int APS5_VABI sceHost(int value) {\n#if defined(_WIN32)\n    return value;\n#elif defined(__linux__)\n"
+                     "    return value + 1;\n#else\n    NotImplemented_nid_no_patch(__func__);\n    return 0;\n#endif\n}\n"
+                     "int APS5_VABI sceHostHelper(int value) {\n#ifdef HOST_WITHOUT_IT\n    Fail();\n#endif\n    return value;\n}\n"
+                     "#ifdef ONLY_HERE\nint APS5_VABI sceOuter(int value) { NotImplemented_nid_no_patch(__func__); return 0; }\n#endif\n"
+                     "int APS5_VABI sceEveryHost(int value) {\n#if defined(_WIN32)\n    NotImplemented_nid_no_patch(__func__);\n#else\n"
+                     "    NotImplemented_nid_no_patch(__func__);\n#endif\n    return 0;\n}\n"
+                     "int APS5_VABI sceEveryElif(int value) {\n#if defined(HOST_A)\n    Fail();\n#elif defined(HOST_B)\n"
+                     "    NotImplemented_nid_no_patch(__func__);\n#else\n    Fail();\n#endif\n    return 0;\n}\n"
+                     "int APS5_VABI sceNested(int value) {\n#if defined(HOST_A)\n#ifdef FEATURE\n    return value;\n#else\n    Fail();\n#endif\n"
+                     "#else\n    Fail();\n#endif\n    return 0;\n}\n"
+                     "void SoftFail(int value) { if (value == 0) return; NotImplemented_nid_no_patch(__func__); }\n"
+                     "void HardFail(int value) { if (value == 0) throw std::invalid_argument(\"zero\"); NotImplemented_nid_no_patch(__func__); }\n"
+                     "int APS5_VABI sceGuardReturn(int value) { if (value == 0) return 0; NotImplemented_nid_no_patch(__func__); return 1; }\n"
+                     "int APS5_VABI sceGuardThrow(int value) { if (value == 0) throw std::invalid_argument(\"zero\"); "
+                     "NotImplemented_nid_no_patch(__func__); return 1; }\n"
+                     "int APS5_VABI sceGuardBlock(int value) { { if (value == 0) return 0; } Fail(); return 1; }\n"
+                     "int APS5_VABI sceGuardGoto(int value) { if (value == 0) goto done; Fail(); done: return 0; }\n"
+                     "int APS5_VABI sceGuardHost(int value) {\n#ifdef HOST_A\n    if (value == 0) return 0;\n#endif\n    Fail();\n    return 1;\n}\n"
+                     "int APS5_VABI sceSoftHelper(int value) { SoftFail(value); return 0; }\n"
+                     "int APS5_VABI sceHardHelper(int value) { HardFail(value); return 0; }\n"
+                     "int APS5_VABI scePlainBlock(int value) { { NotImplemented_nid_no_patch(__func__); } return 0; }\n"
+                     "int APS5_VABI sceNestedBlock(int value) { value += 1; { { Fail(); } } return value; }\n"
+                     "int APS5_VABI sceBlockThenGuard(int value) { { if (value == 0) return 0; NotImplemented_nid_no_patch(__func__); } return 1; }\n")
+        write_source(source, "libShared", '#include "prx/libGuard/Export.cpp"\n')
+        stubs, partial = import_audit.source_stub_classes(source)
+        names = ("sceDirect", "sceReturned", "sceWrapped", "sceIf", "sceBlock", "sceElse", "sceGuarded",
+                 "sceLoop", "sceSwitch", "sceTernary", "sceShort", "sceLambda", "sceMember", "sceHost", "sceHostHelper",
+                 "sceOuter", "sceEveryHost", "sceEveryElif", "sceNested", "sceGuardReturn", "sceGuardThrow",
+                 "sceGuardBlock", "sceGuardGoto", "sceGuardHost", "sceSoftHelper", "sceHardHelper",
+                 "scePlainBlock", "sceNestedBlock", "sceBlockThenGuard")
+        kinds = {name: "partial" if ("libGuard.prx", nid_names.compute_nid(name)) in partial else "stub" for name in names}
+        self.assertEqual({name for name, kind in kinds.items() if kind == "stub"},
+                         {"sceDirect", "sceReturned", "sceWrapped", "sceOuter", "sceEveryHost", "sceEveryElif",
+                          "sceGuardThrow", "sceHardHelper", "scePlainBlock", "sceNestedBlock"})
+        self.assertEqual(set(stubs), {(library, nid_names.compute_nid(name)) for library in ("libGuard.prx", "libShared.prx") for name in names})
+        self.assertEqual(partial, {(library, nid_names.compute_nid(name)) for library in ("libGuard.prx", "libShared.prx")
+                                   for name, kind in kinds.items() if kind == "partial"})
+
+    def test_partial_import_is_its_own_class(self):
+        direct, guarded = nid_names.compute_nid("sceDirect"), nid_names.compute_nid("sceGuarded")
+        stubs = {("libA.prx", direct): "sceDirect", ("libA.prx", guarded): "sceGuarded", ("libB.prx", guarded): "sceGuarded"}
+        partial = {("libB.prx", guarded)}
+        exports = {direct: ["libA.prx"], guarded: ["libA.prx", "libB.prx"]}
+        imports = [(direct, "libA.prx", False), (guarded, "libA.prx", False), (guarded, "libA.prx", False)]
+        records, _ = import_audit.audit(imports, exports, stubs, {"libA.prx", "libB.prx"}, set(), partial=partial)
+        self.assertEqual({record["nid"]: (record["class"], record["name"]) for record in records},
+                         {direct: ("stub", "sceDirect"), guarded: ("partial", "sceGuarded")})
+        summary = import_audit.summarize(records, 3, {})
+        self.assertEqual(summary["references_by_class"], {"implemented": 0, "partial": 2, "stub": 1, "absent": 0, "module": 0})
+        text = import_audit.render(summary, records, {}, [])
+        self.assertIn("Stub: exported but throws when called (1)", text)
+        self.assertIn("Partial: exported, throws only for inputs whose behaviour is unknown (1)", text)
+
     def test_shared_source_cycle_fails(self):
         source = self.work.source
         for library, owner in (("libA", "libB"), ("libB", "libA")):
@@ -1371,8 +1676,8 @@ class ImportAuditTests(unittest.TestCase):
     def test_elf_imports_reader(self):
         image = build_elf([("one", 1, GLOBAL_FUNCTION), ("two", 0, GLOBAL_FUNCTION), ("three", 0, 0x22)], ["libc.prx", "libSceZip.prx"])
         path = Path("mod.prx")
-        self.assertEqual(import_audit.elf_imports(path, image), ({"two", "three"}, {"libc.prx", "libSceZip.prx"}))
-        self.assertEqual(import_audit.elf_imports(path, exporting()), (set(), set()))
+        self.assertEqual(import_audit.elf_imports(path, image), ({"two": False, "three": True}, {"libc.prx", "libSceZip.prx"}))
+        self.assertEqual(import_audit.elf_imports(path, exporting()), ({}, set()))
         for cut in (10, 64, len(image) - 5):
             with self.assertRaisesRegex(import_audit.AuditError, "mod.prx"):
                 import_audit.elf_imports(path, image[:cut])
@@ -1415,6 +1720,61 @@ class ImportAuditTests(unittest.TestCase):
             with self.assertRaisesRegex(import_audit.AuditError, "lib.prx"):
                 import_audit.pe_exports(path, image[:cut])
 
+    def test_pe_without_an_export_directory_has_no_exports(self):
+        for magic, directory in ((0x10b, 96), (0x20b, 112)):
+            image = bytearray(build_pe([]))
+            struct.pack_into("<H", image, 0x58, magic)
+            struct.pack_into("<I", image, 0x58 + directory - 4, 16)
+            struct.pack_into("<II", image, 0x58 + directory, 0, 0)
+            with self.subTest(magic=magic):
+                self.assertEqual(import_audit.read_exports(Path("empty.prx"), image), set())
+
+    def test_pe_missing_export_directory_does_not_hide_malformed_tables(self):
+        for magic, directory in ((0x10b, 96), (0x20b, 112)):
+            for rva, size in ((0, 40), (0x1000, 0), (0x1000, 39), (0xffffff, 40)):
+                image = bytearray(build_pe([]))
+                struct.pack_into("<H", image, 0x58, magic)
+                struct.pack_into("<I", image, 0x58 + directory - 4, 16)
+                struct.pack_into("<II", image, 0x58 + directory, rva, size)
+                with self.subTest(magic=magic, rva=rva, size=size):
+                    with self.assertRaises(import_audit.AuditError):
+                        import_audit.read_exports(Path("malformed.prx"), image)
+
+    def test_audit_accepts_pe_libraries_and_modules_without_export_directories(self):
+        work = self.work
+        image = bytearray(build_pe_with_imports(["KERNEL32.dll"]))
+        struct.pack_into("<II", image, 0x58 + 112, 0, 0)
+        (work.libs / "empty.prx").write_bytes(image)
+        (work.modules / "module.prx.guest.prx").write_bytes(image)
+        registry, report = work.root / "game.json", work.root / "audit.json"
+        write_registry(registry, [])
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (0, ""), out)
+        data = json.loads(report.read_text(encoding="utf-8"))
+        self.assertEqual(data["references"], 0)
+        self.assertEqual(data["missing_libraries"], {})
+        self.assertEqual(data["missing_host_dependencies"], [])
+        write_registry(registry, [("AAAAAAAAAAA", "empty.prx")])
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (1, ""), out)
+        data = json.loads(report.read_text(encoding="utf-8"))
+        self.assertEqual(data["imports"][0]["class"], "absent")
+        self.assertEqual(data["imports"][0]["providers"], [])
+        self.assertEqual(data["stops"][0]["nid"], "AAAAAAAAAAA")
+
+    def test_exportless_pe_library_still_reports_missing_host_dependencies(self):
+        work = self.work
+        image = bytearray(build_pe_with_imports(["libSceMissing.prx"]))
+        struct.pack_into("<II", image, 0x58 + 112, 0, 0)
+        (work.libs / "empty.prx").write_bytes(image)
+        registry, report = work.root / "game.json", work.root / "audit.json"
+        write_registry(registry, [])
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (1, ""), out)
+        self.assertEqual(json.loads(report.read_text(encoding="utf-8"))["missing_host_dependencies"], [
+            {"importer": "empty.prx", "chain": ["empty.prx", "libSceMissing.prx"]},
+        ])
+
     def test_pe_ignores_bytes_after_the_declared_directory_count(self):
         image = bytearray(build_pe(["alpha"]))
         struct.pack_into("<I", image, 0x58 + 108, 0)
@@ -1479,6 +1839,58 @@ class ImportAuditTests(unittest.TestCase):
         struct.pack_into("<H", image, 0x200 + 56 + 2, 0)
         self.assertEqual(import_audit.pe_exports(Path("lib.prx"), image), {"alpha", "beta"})
 
+    def test_elf_dynamic_tables_require_dt_null(self):
+        sectionless = bytearray(build_sectionless_elf(
+            [("alpha", 0, GLOBAL_FUNCTION)], ["libc.prx"]))
+        phoff = struct.unpack_from("<Q", sectionless, 32)[0]
+        phnum = struct.unpack_from("<H", sectionless, 56)[0]
+        dynamic = next(struct.unpack_from("<IIQQQQQQ", sectionless, phoff + index * 56)
+                       for index in range(phnum)
+                       if struct.unpack_from("<IIQQQQQQ", sectionless, phoff + index * 56)[0] == 2)
+        struct.pack_into("<qQ", sectionless, dynamic[2] + dynamic[5] - 16, 0x70000000, 0)
+        with self.assertRaisesRegex(import_audit.AuditError, "not terminated by DT_NULL"):
+            import_audit.elf_program_dynamic_symbols(Path("sectionless.prx"), sectionless)
+
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(build_elf([("alpha", 1, GLOBAL_FUNCTION)]))
+        (work.modules / "module.prx").write_bytes(sectionless)
+        registry = work.root / "malformed.registry.json"
+        report = work.root / "malformed.json"
+        write_registry(registry, [])
+        code, _, error = work.run(registry, "--json", str(report))
+        self.assertEqual(code, 2)
+        self.assertIn("not terminated by DT_NULL", error)
+        self.assertFalse(report.exists())
+
+        sectioned = bytearray(build_elf(
+            [("alpha", 0, GLOBAL_FUNCTION)], ["libc.prx"]))
+        shoff = struct.unpack_from("<Q", sectioned, 40)[0]
+        shnum = struct.unpack_from("<H", sectioned, 60)[0]
+        dynamic = next(struct.unpack_from("<IIQQQQIIQQ", sectioned, shoff + index * 64)
+                       for index in range(shnum)
+                       if struct.unpack_from("<IIQQQQIIQQ", sectioned, shoff + index * 64)[1] == 6)
+        struct.pack_into("<qQ", sectioned, dynamic[4] + dynamic[5] - 16, 0x70000000, 0)
+        with self.assertRaisesRegex(import_audit.AuditError, "not terminated by DT_NULL"):
+            import_audit.elf_imports(Path("sectioned.prx"), sectioned)
+
+    def test_sectionless_dynamic_padding_after_dt_null_is_ignored(self):
+        image = bytearray(build_sectionless_elf(
+            [("alpha", 0, GLOBAL_FUNCTION)], ["libc.prx"]))
+        phoff = struct.unpack_from("<Q", image, 32)[0]
+        phnum = struct.unpack_from("<H", image, 56)[0]
+        headers = [struct.unpack_from("<IIQQQQQQ", image, phoff + index * 56)
+                   for index in range(phnum)]
+        dynamic = next(header for header in headers if header[0] == 2)
+        image.extend(struct.pack("<qQ", 1, 0xFFFFFFFF))
+        for index, header in enumerate(headers):
+            if header[0] == 2 or header[0] == 1:
+                updated = list(header)
+                updated[5] += 16
+                updated[6] += 16
+                struct.pack_into("<IIQQQQQQ", image, phoff + index * 56, *updated)
+        self.assertEqual(import_audit.elf_program_dynamic_symbols(Path("padded.prx"), image),
+                         ({"alpha": False}, set(), {"libc.prx"}))
+
     def test_module_dependencies_stop_at_dynamic_terminator(self):
         work = self.work
         (work.libs / "libc.prx").write_bytes(exporting())
@@ -1800,6 +2212,44 @@ class ImportAuditTests(unittest.TestCase):
         self.assertIn("input", err)
         self.assertEqual(registry.read_bytes(), before)
 
+    def test_json_output_preserves_shared_source_cmake_inputs(self):
+        work = self.work
+        name = "scePending"
+        nid = nid_names.compute_nid(name)
+        write_source(work.source, "libOwner", STUB_SOURCE.format(name=name))
+        shared = work.source / "libShared"
+        shared.mkdir()
+        cmake = shared / "CMakeLists.txt"
+        cmake.write_text('include(${CMAKE_CURRENT_SOURCE_DIR}/../libOwner/OwnerLibrary.cmake)\n', encoding="utf-8")
+        before = cmake.read_bytes()
+        (work.libs / "libShared.prx").write_bytes(exporting(nid))
+        registry = work.root / "game.json"
+        write_registry(registry, [(nid, "libShared.prx")])
+        outputs = [cmake]
+        for kind in ("symlink", "hardlink"):
+            alias = work.root / (kind + ".json")
+            try:
+                if kind == "symlink":
+                    alias.symlink_to(cmake)
+                else:
+                    os.link(cmake, alias)
+            except (OSError, NotImplementedError):
+                continue
+            outputs.append(alias)
+        for output in outputs:
+            with self.subTest(output=output):
+                code, out, err = work.run(registry, "--json", str(output))
+                self.assertEqual((code, out), (2, ""))
+                self.assertIn("JSON output would overwrite an input file", err)
+                self.assertEqual(cmake.read_bytes(), before)
+                self.assertEqual(output.read_bytes(), before)
+        report = work.root / "audit.json"
+        code, _, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (0, ""))
+        record, = json.loads(report.read_text(encoding="utf-8"))["imports"]
+        self.assertEqual((record["class"], record["name"]), ("stub", name))
+        self.assertEqual(cmake.read_bytes(), before)
+
     def test_git_stamp_uses_selected_source_tree(self):
         completed = type("Completed", (), {"stdout": "abcdef\n"})()
         with patch.object(import_audit.subprocess, "run", return_value=completed) as run:
@@ -1832,7 +2282,7 @@ class ImportAuditTests(unittest.TestCase):
         data = json.loads(report.read_text(encoding="utf-8"))
         self.assertEqual(data["source_commit"], commit)
         self.assertIsNone(data["source_dirty"])
-        self.assertEqual(data["unique_by_class"], {"implemented": 1, "stub": 0, "absent": 0, "module": 0})
+        self.assertEqual(data["unique_by_class"], {"implemented": 1, "partial": 0, "stub": 0, "absent": 0, "module": 0})
 
     def test_git_stamp_keeps_commit_when_status_cannot_start(self):
         completed = subprocess.CompletedProcess([], 0, stdout="abcdef\n")
@@ -1930,15 +2380,17 @@ class ImportAuditTests(unittest.TestCase):
         registry = self.work.root / "game.json"
         output = self.work.root / "audit.json"
         (self.work.libs / "libSceExample.prx").write_bytes(exporting(nid))
-        write_source(self.work.source, "libSceExample", STUB_SOURCE.format(name=name))
-        for weak in (False, True):
-            with self.subTest(weak=weak):
-                write_registry(registry, [(nid, "libSceExample.prx", weak)])
-                self.assertEqual(self.work.run(registry)[0], 0)
-                code, out, err = self.work.run(registry, "--strict-stubs", "--json", str(output))
-                self.assertEqual((code, err), (1, ""))
-                self.assertIn("stub", out)
-                self.assertEqual(json.loads(output.read_text(encoding="utf-8"))["unique_by_class"]["stub"], 1)
+        block = "int APS5_VABI {name}(int value) {{ {{ NotImplemented_nid_no_patch(__func__); }} return 0; }}\n"
+        for form in (STUB_SOURCE, block):
+            write_source(self.work.source, "libSceExample", form.format(name=name))
+            for weak in (False, True):
+                with self.subTest(form=form, weak=weak):
+                    write_registry(registry, [(nid, "libSceExample.prx", weak)])
+                    self.assertEqual(self.work.run(registry)[0], 0)
+                    code, out, err = self.work.run(registry, "--strict-stubs", "--json", str(output))
+                    self.assertEqual((code, err), (1, ""))
+                    self.assertIn("stub", out)
+                    self.assertEqual(json.loads(output.read_text(encoding="utf-8"))["unique_by_class"]["stub"], 1)
         write_source(self.work.source, "libSceExample", DONE_SOURCE.format(name=name)
                      + STUB_SOURCE.format(name="sceUnreferencedPending"))
         self.assertEqual(self.work.run(registry, "--strict-stubs")[0], 0)
@@ -1987,6 +2439,33 @@ class StrictProviderTests(unittest.TestCase):
         write_registry(registry, [("AAAAAAAAAAA", "libSceMissing.prx")])
         self.assertEqual(work.run(registry, "--strict-providers")[0], 1)
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(import_audit.sys, "stdout", out), patch.object(import_audit.sys, "stderr", err):
+            try:
+                import_audit.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_nid_names.py b/tools/tests/test_nid_names.py
index e317357de5..ffbab88a81 100644
--- a/tools/tests/test_nid_names.py
+++ b/tools/tests/test_nid_names.py
@@ -15,6 +15,60 @@ import nid_names
 
 
 class DatabaseCacheTests(unittest.TestCase):
+    def long_cache_path(self, directory):
+        root = Path(directory)
+        if os.name == "nt":
+            root = Path("\\\\?\\" + str(root.resolve()))
+        limit = os.pathconf(root, "PC_NAME_MAX") if os.name == "posix" else 255
+        cache = root / ("n" * (limit - len(".csv")) + ".csv")
+        cache.touch()
+        cache.unlink()
+        return cache
+
+    def test_valid_long_cache_filename_can_be_downloaded(self):
+        with tempfile.TemporaryDirectory() as directory:
+            cache = self.long_cache_path(directory)
+
+            def complete(url, filename):
+                self.assertEqual(url, nid_names.DB_URL)
+                self.assertEqual(Path(filename).parent, cache.parent)
+                self.assertFalse(cache.exists())
+                Path(filename).write_text("nid1 sceComplete\n", encoding="utf-8")
+
+            try:
+                with patch.object(nid_names.urllib.request, "urlretrieve", side_effect=complete) as download:
+                    self.assertEqual(nid_names.load_db(cache), {"nid1": "sceComplete"})
+                    download.assert_called_once()
+                self.assertEqual(list(cache.parent.iterdir()), [cache])
+                with patch.object(nid_names.urllib.request, "urlretrieve") as download:
+                    self.assertEqual(nid_names.load_db(cache), {"nid1": "sceComplete"})
+                    download.assert_not_called()
+            finally:
+                cache.unlink(missing_ok=True)
+
+    def test_long_cache_filename_preserves_interruption_cleanup_and_retry(self):
+        with tempfile.TemporaryDirectory() as directory:
+            cache = self.long_cache_path(directory)
+
+            def interrupted(url, filename):
+                Path(filename).write_text("nid1 scePartial\n", encoding="utf-8")
+                raise URLError("connection interrupted")
+
+            def complete(url, filename):
+                Path(filename).write_text("nid1 sceComplete\n", encoding="utf-8")
+
+            try:
+                with patch.object(nid_names.urllib.request, "urlretrieve", side_effect=interrupted):
+                    with self.assertRaises(URLError):
+                        nid_names.load_db(cache)
+                self.assertFalse(cache.exists())
+                self.assertEqual(list(cache.parent.iterdir()), [])
+                with patch.object(nid_names.urllib.request, "urlretrieve", side_effect=complete):
+                    self.assertEqual(nid_names.load_db(cache), {"nid1": "sceComplete"})
+                self.assertEqual(list(cache.parent.iterdir()), [cache])
+            finally:
+                cache.unlink(missing_ok=True)
+
     def test_empty_symbol_filters_do_not_open_database(self):
         with tempfile.TemporaryDirectory() as directory:
             for option in ("--name", "--symbol", "--na", "--sym"):
@@ -30,6 +84,21 @@ class DatabaseCacheTests(unittest.TestCase):
                         else:
                             self.assertEqual(result.stdout.split(), ["NAME", "NID"])
 
+    def test_empty_nid_filters_do_not_open_database(self):
+        with tempfile.TemporaryDirectory() as directory:
+            for option in ("--nid", "--ni"):
+                for json_output in (False, True):
+                    with self.subTest(option=option, json_output=json_output):
+                        result = subprocess.run(
+                            [sys.executable, str(Path(nid_names.__file__)), option, "--db", directory,
+                             *(["--json"] if json_output else [])], capture_output=True, text=True, timeout=5)
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertEqual(result.stderr, "")
+                        if json_output:
+                            self.assertEqual(json.loads(result.stdout), {"db_entries": 0, "rows": []})
+                        else:
+                            self.assertIn("0 unknowns, 0 suggestions (0 already implemented)", result.stdout)
+
     def test_environment_variable_selects_the_database_and_help_names_it(self):
         script = str(Path(nid_names.__file__))
         helped = subprocess.run([sys.executable, script, "--help"], capture_output=True, text=True, timeout=60)
@@ -41,8 +110,13 @@ class DatabaseCacheTests(unittest.TestCase):
             database.write_text(f"{nid} sceExample\n", encoding="utf-8")
             scratch = str(Path(directory) / "scratch")
             Path(scratch).mkdir()
+            tree = Path(directory) / "tree"
+            (tree / "core" / "libs" / "prx").mkdir(parents=True)
+            (tree / "tools").mkdir()
+            tool = tree / "tools" / "nid_names.py"
+            tool.write_bytes(Path(script).read_bytes())
             environment = {**os.environ, "ANYPS5_NID_DB": str(database), "TEMP": scratch, "TMP": scratch, "TMPDIR": scratch}
-            result = subprocess.run([sys.executable, script, "--nid", nid, "--json"], capture_output=True, text=True,
+            result = subprocess.run([sys.executable, str(tool), "--nid", nid, "--json"], capture_output=True, text=True,
                                     env=environment, timeout=20)
             self.assertEqual(list(Path(scratch).iterdir()), [])
         self.assertEqual(result.returncode, 0, result.stderr)
@@ -425,6 +499,33 @@ int APS5_VABI sceReal() { return 0; }
         self.write_source('// continued \\\nAPS5_EXPORT("AAAAAAAAAAA", exampleUnknown00);\nAPS5_EX\\\nPORT("BBBBBBBBBBB", exampleUnknown01);\n')
         self.assertEqual(nid_names.collect_unknowns(), {"BBBBBBBBBBB": "core/libs/prx/libSceExample/Export.cpp:exampleUnknown01"})
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(nid_names.sys, "stdout", out), patch.object(nid_names.sys, "stderr", err):
+            try:
+                nid_names.main(["--invalid-argument"])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 
 if __name__ == "__main__":
diff --git a/tools/tests/test_package_release.py b/tools/tests/test_package_release.py
index fb0ec3cd62..0a55febac1 100644
--- a/tools/tests/test_package_release.py
+++ b/tools/tests/test_package_release.py
@@ -629,6 +629,78 @@ class ReleaseNotesEdgeCaseTests(unittest.TestCase):
             self.assertEqual(body_path.read_text(encoding="utf-8"), notes)
             self.assertEqual(full_path.read_text(encoding="utf-8"), notes)
 
+    def test_prepare_notes_accepts_utf8_bom(self):
+        notes = "# Release v1.0.0\n"
+        source = "\ufeff" + json.dumps({"body": notes})
+        with tempfile.TemporaryDirectory() as directory:
+            directory = Path(directory)
+            source_path = directory / "source.json"
+            body_path = directory / "body.md"
+            full_path = directory / "full.md"
+            source_path.write_text(source, encoding="utf-8")
+            prepare_release_notes.prepare_notes(source_path, body_path, full_path)
+            self.assertEqual(body_path.read_text(encoding="utf-8"), notes)
+            self.assertEqual(full_path.read_text(encoding="utf-8"), notes)
+
+    def test_main_with_explicit_argv(self):
+        notes = "# Release v1.0.0\n"
+        source = json.dumps({"body": notes})
+        with tempfile.TemporaryDirectory() as directory:
+            directory = Path(directory)
+            source_path = directory / "source.json"
+            body_path = directory / "body.md"
+            full_path = directory / "full.md"
+            source_path.write_text(source, encoding="utf-8")
+            result = prepare_release_notes.main(["--input", str(source_path), "--body", str(body_path), "--full", str(full_path)])
+            self.assertEqual(result, 0)
+            self.assertEqual(body_path.read_text(encoding="utf-8"), notes)
+            self.assertEqual(full_path.read_text(encoding="utf-8"), notes)
+
+    def test_main_reports_error_without_a_traceback(self):
+        with tempfile.TemporaryDirectory() as directory:
+            directory = Path(directory)
+            input_dir = directory / "input_dir"
+            input_dir.mkdir()
+            body_path = directory / "body.md"
+            full_path = directory / "full.md"
+            stderr = io.StringIO()
+            with contextlib.redirect_stderr(stderr), self.assertRaises(SystemExit) as error:
+                prepare_release_notes.main(["--input", str(input_dir), "--body", str(body_path), "--full", str(full_path)])
+            self.assertEqual(error.exception.code, 2)
+            self.assertIn(input_dir.name, stderr.getvalue())
+            self.assertNotIn("Traceback", stderr.getvalue())
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, s):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(prepare_release_notes.sys, "stdout", out), patch.object(prepare_release_notes.sys, "stderr", err):
+            with tempfile.TemporaryDirectory() as directory:
+                directory = Path(directory)
+                source_path = directory / "source.json"
+                body_path = directory / "body.md"
+                full_path = directory / "full.md"
+                source_path.write_text(json.dumps({"body": "notes"}), encoding="utf-8")
+                result = prepare_release_notes.main(["--input", str(source_path), "--body", str(body_path), "--full", str(full_path)])
+                self.assertEqual(result, 0)
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
     def test_body_over_limit_without_whats_changed_is_returned_unchanged(self):
         notes = "# Release\n\n## Details\n\n" + "x" * (prepare_release_notes.BODY_LIMIT + 1)
         result = prepare_release_notes.release_body(notes)
diff --git a/tools/tests/test_pr_overlap_dependencies.py b/tools/tests/test_pr_overlap_dependencies.py
index 9af379f868..fdab9124e6 100644
--- a/tools/tests/test_pr_overlap_dependencies.py
+++ b/tools/tests/test_pr_overlap_dependencies.py
@@ -129,6 +129,22 @@ class DependencyTests(unittest.TestCase):
         self.assertIsNone(pr_overlap.overlaps(prs, 1, 2))
         self.assertIsNone(pr_overlap.overlaps(prs, 2, 1))
 
+    def test_reported_link_round_trips_as_a_dependency(self):
+        with patch.object(pr_overlap, "REPO", "owner/repo", create=True):
+            link = pr_overlap.pull("https://github.com/owner/repo/blob/abc123", 2)
+        self.assertIn("https://www.github.com/owner/repo/pull/2", link)
+        prs = pull_requests(f"Depends on: {link}")
+        self.assertEqual(prs[1]["depends"], {2})
+        for pr in prs.values():
+            pr["added"] = {"shared.cpp"}
+        self.assertIsNone(pr_overlap.overlaps(prs, 1, 2))
+
+    def test_www_github_dependencies_are_supported(self):
+        for reference in ("https://www.github.com/owner/repo/pull/2",
+                          "[PR 2](https://www.github.com/owner/repo/pull/2)"):
+            with self.subTest(reference=reference):
+                self.assertEqual(pull_requests(f"Depends on: {reference}")[1]["depends"], {2})
+
     def test_unrelated_reference_keeps_overlap(self):
         prs = pull_requests("Related to #2.")
         for pr in prs.values():
diff --git a/tools/tests/test_pr_overlap_encoding.py b/tools/tests/test_pr_overlap_encoding.py
index 1dad26c746..2e6f412edc 100644
--- a/tools/tests/test_pr_overlap_encoding.py
+++ b/tools/tests/test_pr_overlap_encoding.py
@@ -42,9 +42,13 @@ def command_output(stdout, stderr="", returncode=0):
             f"sys.exit({returncode})\n")
 
     def run(command, **kwargs):
+        if command[:3] == ["git", "rev-parse", "--show-toplevel"]:
+            root = (str(Path.cwd()) + "\n").encode("utf-8")
+            return subprocess.CompletedProcess(command, 0, stdout=root, stderr=b"")
         return RUN([sys.executable, "-c", code], **kwargs)
 
     with simulated_cp1252(), \
+            patch.dict(pr_overlap._REPO_ROOTS, clear=True), \
             patch.object(subprocess, "run", side_effect=run):
         yield
 
diff --git a/tools/tests/test_pr_overlap_exports.py b/tools/tests/test_pr_overlap_exports.py
index d109c06966..fbdb824013 100644
--- a/tools/tests/test_pr_overlap_exports.py
+++ b/tools/tests/test_pr_overlap_exports.py
@@ -4,6 +4,7 @@ from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import pr_overlap
+import nid_names
 
 TRAILING = "+extern \"C\" std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int) noexcept;   \n"
 DIFF = """diff --git a/core/libs/prx/libkernel/File/src/Open.cpp b/core/libs/prx/libkernel/File/src/Open.cpp
@@ -52,23 +53,80 @@ class ExportTests(unittest.TestCase):
         self.assertNotIn("context_nid_postfix", found)
         self.assertNotIn("Helper_nid_no_patch", found)
 
+    def test_added_definitions_match_base_names_with_nid_postfix(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        base = {("core/libs/prx/libkernel", nid): {"sceKernelRead_nid_postfix"}}
+        added = pr_overlap.source_changed_exports(
+            "diff --git a/core/libs/prx/libkernel/a.cpp b/core/libs/prx/libkernel/a.cpp\n+int APS5_VABI sceKernelRead(int fd) { return fd; }\n", "+")
+        self.assertEqual(set(added) & set(base), {("core/libs/prx/libkernel", nid)})
 
-    def test_explicit_export_aliases_are_collected(self):
-        diff = ('+int APS5_VABI placeholder_nid_no_patch() {\n'
-                '+    NotImplemented_nid_no_patch(__func__);\n'
-                '+}\n'
-                '+APS5_EXPORT("Pz262plj20w", placeholder_nid_no_patch);\n'
-                '-APS5_EXPORT("sKneJjUXWkQ", removed_nid_no_patch);\n')
-        self.assertEqual(pr_overlap.exports(diff), set())
-        self.assertEqual(pr_overlap.aliases(diff), {"Pz262plj20w"})
-        self.assertEqual(pr_overlap.aliases(diff.replace('+APS5_EXPORT("Pz262plj20w", placeholder_nid_no_patch);\n', "")), set())
+    def test_added_assembly_export_matches_base_definition(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        added = pr_overlap.source_changed_exports(
+            'diff --git a/a.cpp b/a.cpp\n+APS5_ASM_FUNCTION("sceKernelRead")\n', "+")
+        self.assertIn(("", nid), added)
 
-    def test_explicit_alias_overlaps_named_export_with_the_same_nid(self):
-        named = {"author": "a", "exports": {"FT_Outline_GetInsideBorder"}, "aliases": set()}
-        explicit = {"author": "b", "exports": set(), "aliases": {"Pz262plj20w"}}
-        self.assertEqual(pr_overlap.same_exports(named, explicit, []), {"FT_Outline_GetInsideBorder"})
-        self.assertEqual(pr_overlap.same_exports(explicit, dict(explicit, author="c"), []), {"Pz262plj20w"})
-        self.assertEqual(pr_overlap.same_exports(named, explicit, [explicit]), set())
+    def test_added_raw_export_matches_base_definition(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        added = pr_overlap.source_changed_exports(
+            f'diff --git a/a.cpp b/a.cpp\n+APS5_EXPORT("{nid}", sceKernelReadAlias);\n', "+")
+        self.assertEqual(added[("", nid)], {"sceKernelReadAlias"})
+
+    def test_raw_main_export_is_preserved_as_literal_nid(self):
+        nid = "123456789ab"
+        self.assertEqual(pr_overlap.source_exports(f'APS5_EXPORT("{nid}", alias);'), {("", nid): {"alias"}})
+
+    def test_replacing_an_export_in_place_cancels_the_same_nid(self):
+        diff = """diff --git a/a.cpp b/a.cpp
+-int APS5_VABI sceKernelRead_nid_postfix(int fd) { throw std::runtime_error("not implemented"); }
++int APS5_VABI sceKernelRead(int fd) { return fd; }
+"""
+        added = pr_overlap.source_changed_exports(diff, "+")
+        removed = pr_overlap.source_changed_exports(diff, "-")
+        self.assertEqual(set(added) - set(removed), set())
+
+    def test_exports_with_same_nid_in_different_libraries_do_not_overlap(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        added = pr_overlap.source_changed_exports(
+            "diff --git a/core/libs/prx/libSceAmpr/a.cpp b/core/libs/prx/libSceAmpr/a.cpp\n"
+            "+int APS5_VABI sceKernelRead(int fd) { return fd; }\n", "+")
+        base = {("core/libs/prx/libkernel", nid): {"sceKernelRead"}}
+        self.assertFalse(set(added) & set(base))
+
+    def test_main_exports_have_a_separate_report_section_not_a_fake_pr(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        prs = {9: {"added_exports": {("core/libs/prx/libkernel", nid): {"sceKernelRead"}}, "removed_exports": {}}}
+        findings = pr_overlap.main_export_findings(prs, {("core/libs/prx/libkernel", nid): {"sceKernelRead"}})
+        rows = {9: {"added": set()}}
+        report = pr_overlap.report(rows, "https://example.invalid/blob/base", findings[9])
+        self.assertIn("Exports introduced here that are already present in `main`", report)
+        self.assertNotIn("PR 0", report)
+        self.assertNotIn("PR 9", report)
+        self.assertNotIn("Already on `main` |", report)
+        self.assertEqual(rows, {9: {"added": set()}})
+
+
+    def test_explicit_export_aliases_are_collected_by_library_and_nid(self):
+        source = ('int APS5_VABI placeholder_nid_no_patch() {\n'
+                  '    NotImplemented_nid_no_patch(__func__);\n'
+                  '}\n'
+                  'APS5_EXPORT("Pz262plj20w", placeholder_nid_no_patch);\n')
+        self.assertEqual(
+            pr_overlap.source_exports(source, "core/libs/prx/libSceExample"),
+            {("core/libs/prx/libSceExample", "Pz262plj20w"): {"placeholder_nid_no_patch"}},
+        )
+
+    def test_explicit_alias_and_named_export_share_a_key_in_the_same_library(self):
+        explicit = pr_overlap.source_exports(
+            'APS5_EXPORT("Pz262plj20w", placeholder_nid_no_patch);',
+            "core/libs/prx/libSceExample",
+        )
+        named = pr_overlap.source_changed_exports(
+            "diff --git a/core/libs/prx/libSceExample/a.cpp b/core/libs/prx/libSceExample/a.cpp\n"
+            "+int APS5_VABI FT_Outline_GetInsideBorder() { return 0; }\n",
+            "+",
+        )
+        self.assertEqual(set(explicit) & set(named), {("core/libs/prx/libSceExample", "Pz262plj20w")})
 
 
 if __name__ == "__main__":
diff --git a/tools/tests/test_progress.py b/tools/tests/test_progress.py
index f018237531..1c8e33b4d7 100644
--- a/tools/tests/test_progress.py
+++ b/tools/tests/test_progress.py
@@ -107,6 +107,105 @@ class ProgressSnapshotTests(unittest.TestCase):
 
 
 class ProgressTests(unittest.TestCase):
+    def report_library(self, name, done=(), todo=(), **extra):
+        return {"name": name, "label": name, "done": len(done), "todo": len(todo),
+                "done_names": list(done), "todo_names": list(todo), **extra}
+
+    def report_snapshot(self, *groups):
+        return {"libraries": progress.summarize(list(groups)), "shaders": progress.summarize([])}
+
+    def test_report_shows_each_changed_library_and_keeps_global_details(self):
+        pad = self.report_library("libScePad", ["Ready"], ["Pending"])
+        video = self.report_library("libSceVideoOut", ["A", "B", "C"], ["D"])
+        unchanged = self.report_library("libSceUnused", ["Keep"])
+        base = self.report_snapshot(video, unchanged, pad)
+        head = self.report_snapshot(self.report_library("libScePad", ["Ready", "Pending"]), unchanged,
+                                    self.report_library("libSceVideoOut", ["A", "B"], ["C", "D"]))
+        report = progress.report(base, head)
+        self.assertIn("**System libraries**", report)
+        self.assertIn("| Library | Name |", report)
+        self.assertIn("| libScePad | 1/2 (50.00%) | 2/2 (100.00%) | +50.00 pp |", report)
+        self.assertIn("| libSceVideoOut | 3/4 (75.00%) | 2/4 (50.00%) | -25.00 pp |", report)
+        table = report.split("#### Changed libraries (implemented exports)")[1]
+        self.assertNotIn("libSceUnused", table)
+        self.assertLess(table.index("libScePad"), table.index("libSceVideoOut"))
+
+    def test_report_includes_changed_function_names_when_counts_stay_equal(self):
+        base = self.report_snapshot(self.report_library("libScePad", ["Old"], ["Pending"]))
+        head = self.report_snapshot(self.report_library("libScePad", ["New"], ["Pending"]))
+        self.assertIn("| libScePad | 1/2 (50.00%) | 1/2 (50.00%) | +0.00 pp |", progress.report(base, head))
+
+    def test_report_marks_new_removed_and_empty_libraries_without_percentages(self):
+        base = self.report_snapshot(self.report_library("libSceRemoved", ["Ready"]),
+                                    self.report_library("libSceEmptied", ["Old"]))
+        head = self.report_snapshot(self.report_library("libSceAdded", ["New"], ["Pending"]),
+                                    self.report_library("libSceEmpty"), self.report_library("libSceEmptied"))
+        report = progress.report(base, head)
+        self.assertIn("| libSceAdded | Not present | 1/2 (50.00%) | n/a |", report)
+        self.assertIn("| libSceRemoved | 1/1 (100.00%) | Not present | n/a |", report)
+        self.assertIn("| libSceEmpty | Not present | No exports | n/a |", report)
+        self.assertIn("| libSceEmptied | 1/1 (100.00%) | No exports | n/a |", report)
+
+    def test_report_marks_missing_counts_unavailable_with_no_delta(self):
+        complete = {"name": "libSceLegacy", "done": 1, "todo": 0, "done_names": ["Current"]}
+        for missing in ({"done_names": ["Legacy"]}, {"done": 0}, {"todo": 0}, {}):
+            minimal = {"name": "libSceLegacy", **missing}
+            for before, after in ((minimal, complete), (complete, minimal)):
+                with self.subTest(before=before, after=after):
+                    base = {"libraries": {"groups": [before], "percent": 0},
+                            "shaders": {"groups": [], "percent": 0}}
+                    head = {"libraries": {"groups": [after], "percent": 0},
+                            "shaders": {"groups": [], "percent": 0}}
+                    report = progress.report(base, head)
+                    self.assertIn("Counts unavailable", report)
+                    self.assertIn("| n/a |", report)
+                    self.assertNotIn("No exports", report)
+
+    def test_report_omits_unchanged_minimal_snapshots(self):
+        minimal = {"name": "libSceLegacy"}
+        snapshot = {"libraries": {"groups": [minimal], "percent": 0},
+                    "shaders": {"groups": [], "percent": 0}}
+        self.assertEqual(progress.report(snapshot, snapshot), "")
+
+    def test_report_labels_shared_sources_without_duplicate_counts(self):
+        owner = self.report_library("libScePad", ["Ready"], ["Pending"])
+        alias = self.report_library("libScePad.native", ["Ready"], ["Pending"])
+        shared = self.report_library("libScePad.native", shared_sources="libScePad")
+        base, head = self.report_snapshot(owner, alias), self.report_snapshot(owner, shared)
+        report = progress.report(base, head)
+        self.assertIn("| libScePad.native | 1/2 (50.00%) | Shared sources: `libScePad` | n/a |", report)
+        self.assertNotIn("removed", report)
+        reverse = progress.report(head, base)
+        self.assertIn("| libScePad.native | Shared sources: `libScePad` | 1/2 (50.00%) | n/a |", reverse)
+        changed = self.report_snapshot(owner, self.report_library("libScePad.native", shared_sources="libSceOther"))
+        self.assertIn("| libScePad.native | Shared sources: `libScePad` | Shared sources: `libSceOther` | n/a |",
+                      progress.report(head, changed))
+
+    def test_report_omits_unchanged_libraries_and_preserves_shader_report(self):
+        library = self.report_library("libScePad", ["Ready"])
+        base, head = self.report_snapshot(library), self.report_snapshot(dict(library, inert_names=["Ready"]))
+        self.assertEqual(progress.report(base, head), "")
+        head["shaders"] = progress.summarize([self.report_library("VOP1", ["V_MOV_B32"])])
+        report = progress.report(base, head)
+        self.assertEqual(report, "\n".join(progress.compare("GPU shader instructions", "Encoding", "instructions",
+                                                          base["shaders"], head["shaders"])))
+        self.assertNotIn("Changed libraries", report)
+
+    def test_report_rounds_percentage_point_change_without_negative_zero(self):
+        base = self.report_snapshot(self.report_library("libScePad", ["Ready"], ["A", "B"]))
+        head = self.report_snapshot(self.report_library("libScePad", ["Ready", "A"], ["B"]))
+        self.assertIn("| libScePad | 1/3 (33.33%) | 2/3 (66.67%) | +33.33 pp |", progress.report(base, head))
+        before = dict(self.report_library("libSceLarge", ["Ready"]), todo=100000)
+        after = dict(before, todo=100001)
+        self.assertIn("| +0.00 pp |", progress.report(self.report_snapshot(before), self.report_snapshot(after)))
+
+    def test_report_limits_library_rows(self):
+        head = self.report_snapshot(*(self.report_library(f"libSce{i:03}", ["Ready"]) for i in range(103)))
+        report = progress.report(self.report_snapshot(), head)
+        table = report.split("#### Changed libraries (implemented exports)")[1]
+        self.assertEqual(sum(line.startswith("| libSce") for line in table.splitlines()), progress.REPORT_ROWS)
+        self.assertIn("3 more libraries", table)
+
     def test_raw_string_example_does_not_declare_an_export(self):
         source = 'const char* example = R"help(\nint APS5_VABI Fake() { return 0; }\n)help";\n'
         source += 'int APS5_VABI Real() { return 7; }\n'
@@ -498,12 +597,13 @@ class ProgressTests(unittest.TestCase):
                     self.assertIn(str(path), stderr.getvalue())
 
     def test_output_directory_that_cannot_be_written_is_named(self):
+        libraries, shaders = self.library_snapshot()
         with tempfile.TemporaryDirectory() as directory:
             blocked = Path(directory) / "blocked output"
             blocked.write_text("a file, not a directory", encoding="utf-8")
             stderr = io.StringIO()
             with patch("sys.stderr", stderr), self.assertRaises(SystemExit) as raised:
-                progress.main([str(blocked)])
+                self.run_main([str(blocked)], libraries, shaders)
             self.assertEqual(raised.exception.code, 2)
             self.assertIn(str(blocked), stderr.getvalue())
             self.assertNotIn("Traceback", stderr.getvalue())
@@ -523,5 +623,50 @@ class ProgressTests(unittest.TestCase):
                     self.assertIn("is not a source tree", stderr.getvalue())
                     self.assertIn(str(path), stderr.getvalue())
 
+    def test_compare_accepts_snapshots_with_utf8_bom(self):
+        def snapshot(names):
+            return {"libraries": progress.summarize([
+                        {"name": "libScePad", "label": "Pad", "done": len(names), "todo": 0,
+                         "done_names": names, "todo_names": [], "inert_names": []}]),
+                    "shaders": {"done": 0, "total": 0, "percent": 0, "groups": [], "extra": []}}
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory) / "base.json"
+            head = Path(directory) / "head.json"
+            base.write_text("\ufeff" + json.dumps(snapshot([])), encoding="utf-8")
+            head.write_text("\ufeff" + json.dumps(snapshot(["Ready"])), encoding="utf-8")
+            stdout = io.StringIO()
+            with patch("sys.stdout", stdout):
+                code = progress.main(["--compare", str(base), str(head)])
+            self.assertEqual(code, 0)
+            self.assertIn("implemented", stdout.getvalue())
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(progress.sys, "stdout", out), patch.object(progress.sys, "stderr", err):
+            try:
+                progress.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_progress_history.py b/tools/tests/test_progress_history.py
index 38b9f5de86..7dbec9aa67 100644
--- a/tools/tests/test_progress_history.py
+++ b/tools/tests/test_progress_history.py
@@ -99,6 +99,17 @@ class ProgressHistoryTests(unittest.TestCase):
         self.assertIn("<svg", html)
         self.assertIn("2026-01-02", html)
 
+    def test_unknown_ref_is_reported_with_git_reason(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            subprocess.run(["git", "-C", directory, "init", "-q"], check=True)
+            commit(root, "2026-01-01", "first", "int APS5_VABI A() { return 0; }\n")
+            with patch.multiple(progress, ROOT=root, PRX=root / "core/libs/prx", OPCODES=root / OPCODES):
+                with self.assertRaises(ValueError) as raised:
+                    progress_history.daily_commits("no-such-ref")
+        self.assertIn("no-such-ref", str(raised.exception))
+        self.assertIn("unknown revision", str(raised.exception))
+
     def test_days_are_utc_whatever_the_committer_offset(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
diff --git a/tools/tests/test_select_tests.py b/tools/tests/test_select_tests.py
index b89ba0904a..515dc16930 100644
--- a/tools/tests/test_select_tests.py
+++ b/tools/tests/test_select_tests.py
@@ -156,6 +156,53 @@ class SelectTests(unittest.TestCase):
             subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
             subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
 
+    def test_script_test_builds_the_executable_it_gets_as_a_definition(self):
+        cmake, script = self.source / "alpha/CMakeLists.txt", self.source / "data/run.cmake"
+        original = cmake.read_text(encoding="utf-8")
+        try:
+            script.write_text('execute_process(COMMAND "${FIXTURE}" RESULT_VARIABLE result)\n'
+                              'if(NOT result STREQUAL "0")\n  message(FATAL_ERROR "fixture: ${result}")\nendif()\n',
+                              encoding="utf-8")
+            cmake.write_text(original + "add_test(NAME alpha_run COMMAND ${CMAKE_COMMAND} -DFIXTURE=$<TARGET_FILE:alpha_tests>"
+                                        " -P ${CMAKE_SOURCE_DIR}/data/run.cmake)\n", encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+            graph = self.build / "run-graph.json"
+            self.tool("dump", self.build, graph)
+            self.assertEqual(self.select("beta/main.c", graph=graph)[1], {"alpha_run", "beta", "beta_setup", "script"})
+            subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
+            output = self.tool("ctest", self.build, "-R", "alpha_run", "--output-on-failure")
+            self.assertIn("100% tests passed", output)
+        finally:
+            cmake.write_text(original, encoding="utf-8")
+            script.unlink(missing_ok=True)
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
+
+    def test_script_test_builds_an_excluded_executable_it_gets_as_a_definition(self):
+        cmake, script = self.source / "alpha/CMakeLists.txt", self.source / "data/run.cmake"
+        original = cmake.read_text(encoding="utf-8")
+        try:
+            script.write_text('execute_process(COMMAND "${TOOL}" RESULT_VARIABLE result)\n'
+                              'if(NOT result STREQUAL "0")\n  message(FATAL_ERROR "tool: ${result}")\nendif()\n',
+                              encoding="utf-8")
+            cmake.write_text(original + "add_executable(alpha_tool EXCLUDE_FROM_ALL main.c)\n"
+                                        "add_test(NAME alpha_run COMMAND ${CMAKE_COMMAND} -DTOOL=$<TARGET_FILE:alpha_tool>"
+                                        " -P ${CMAKE_SOURCE_DIR}/data/run.cmake)\n", encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+            graph = self.build / "run-graph.json"
+            self.tool("dump", self.build, graph)
+            self.assertEqual(self.select("beta/main.c", graph=graph)[1], {"alpha_run", "beta", "beta_setup", "script"})
+            subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
+            output = self.tool("ctest", self.build, "-R", "alpha_run", "--output-on-failure")
+            self.assertIn("100% tests passed", output)
+        finally:
+            cmake.write_text(original, encoding="utf-8")
+            script.unlink(missing_ok=True)
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
+
     def test_retargeted_test_does_not_prune_its_previous_executable(self):
         cmake = self.source / "alpha/CMakeLists.txt"
         original = cmake.read_text(encoding="utf-8")
@@ -255,6 +302,31 @@ class FixtureBuildTests(unittest.TestCase):
             self.assertIn(name, output)
 
 
+@unittest.skipUnless(shutil.which("ninja") and (shutil.which("gcc") or shutil.which("cc")), "needs ninja and a C compiler")
+class NonAsciiDirectoryTests(unittest.TestCase):
+    def test_header_under_a_non_ascii_directory_is_an_input_of_its_tests(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory) / "ação"
+            if os.name == "nt":
+                try:
+                    str(root).encode("mbcs", "strict")
+                except UnicodeEncodeError:
+                    self.skipTest("the ANSI code page cannot represent the fixture directory")
+            source, build, graph = root / "source", root / "build", root / "graph.json"
+            for name, content in PROJECT.items():
+                (source / name).parent.mkdir(parents=True, exist_ok=True)
+                (source / name).write_text(content, encoding="utf-8")
+            compiler = shutil.which("gcc") or shutil.which("cc")
+            subprocess.run(["cmake", "-S", str(source), "-B", str(build), "-G", "Ninja", f"-DCMAKE_C_COMPILER={compiler}"],
+                           check=True, capture_output=True)
+            subprocess.run(["cmake", "--build", str(build)], check=True, capture_output=True)
+            SelectTests.tool("dump", build, graph)
+            reasons = {}
+            select_tests.select(json.loads(graph.read_text(encoding="utf-8")), ["alpha/alpha.h"], reasons)
+        self.assertIn("input: alpha/alpha.h", reasons["alpha"])
+        self.assertIn("input: alpha/alpha.h", reasons["alpha_data"])
+
+
 class BuildErrorTests(unittest.TestCase):
     def run_tool(self, *args):
         return subprocess.run([sys.executable, "-I", str(TOOL), *map(str, args)], capture_output=True, text=True, timeout=60)
@@ -339,6 +411,51 @@ class CaseInsensitivePathTests(unittest.TestCase):
             self.assertIsNone(build.repo(os.path.join(os.sep, "WORK", "SOURCE", "BUILD", "Generated.h")))
 
 
+class ChunkTests(unittest.TestCase):
+    def test_windows_batches_fit_the_serialized_utf16_budget(self):
+        cases = (
+            (20000, ["\U0001f600" * 50 + f"/{index}.obj" for index in range(400)]),
+            (64, ['space name\\', 'embedded"quote', "\t", "", 'both \\" slash\\'] * 20),
+            (64, ["\ud800" * 10, "\U0001f600" * 10] * 20),
+        )
+        for budget, names in cases:
+            with self.subTest(budget=budget, first=names[0]), mock.patch.object(select_tests.sys, "platform", "win32"), \
+                    mock.patch.object(select_tests, "BATCH", budget):
+                batches = list(select_tests.chunks(iter(names)))
+                self.assertEqual([name for batch in batches for name in batch], names)
+                self.assertGreater(len(batches), 1)
+                for batch in batches:
+                    self.assertTrue(batch)
+                    command = subprocess.list2cmdline(batch)
+                    self.assertLessEqual(len(command.encode("utf-16-le", "surrogatepass")) // 2 + 1, budget)
+
+    def test_windows_batch_keeps_an_exact_boundary(self):
+        with mock.patch.object(select_tests.sys, "platform", "win32"), mock.patch.object(select_tests, "BATCH", 8):
+            self.assertEqual(list(select_tests.chunks(["a b", "c", "d"])), [["a b", "c"], ["d"]])
+
+    def test_other_platforms_keep_the_existing_character_budget(self):
+        names = ["\U0001f600" * 3, "abc", "\udcff"]
+        for platform in ("linux", "darwin"):
+            with self.subTest(platform=platform), mock.patch.object(select_tests.sys, "platform", platform), \
+                    mock.patch.object(select_tests, "BATCH", 8):
+                self.assertEqual(list(select_tests.chunks(iter(names))), [names[:2], names[2:]])
+
+    def test_empty_input_and_an_oversized_single_argument_are_preserved(self):
+        for platform in ("win32", "linux"):
+            with self.subTest(platform=platform), mock.patch.object(select_tests.sys, "platform", platform), \
+                    mock.patch.object(select_tests, "BATCH", 4):
+                self.assertEqual(list(select_tests.chunks(iter([]))), [])
+                self.assertEqual(list(select_tests.chunks(["long target", "x"])), [["long target"], ["x"]])
+
+    @unittest.skipUnless(sys.platform == "win32", "needs the Windows command line limit")
+    def test_windows_batches_launch_without_losing_arguments(self):
+        names = ["\U0001f600" * 50 + f"/{index}.obj" for index in range(400)]
+        for batch in select_tests.chunks(names):
+            result = subprocess.run([sys.executable, "-I", "-c", "import json,sys; print(json.dumps(sys.argv[1:]))", *batch],
+                                    capture_output=True, text=True, check=True, timeout=5)
+            self.assertEqual(json.loads(result.stdout), batch)
+
+
 class PlanTests(unittest.TestCase):
     def test_unresolved_selected_command_keeps_unselected_build_targets(self):
         build = mock.Mock()
@@ -392,5 +509,33 @@ class MissingCommandTests(unittest.TestCase):
                                         "ambiguous": None, "existing": [helper], "stale": None})
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(select_tests.sys, "stdout", out), mock.patch.object(select_tests.sys, "stderr", err):
+            try:
+                select_tests.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_shader_cache_runtime_sources.py b/tools/tests/test_shader_cache_runtime_sources.py
index 6aebbb7529..eec57f2fb3 100644
--- a/tools/tests/test_shader_cache_runtime_sources.py
+++ b/tools/tests/test_shader_cache_runtime_sources.py
@@ -78,7 +78,7 @@ file(WRITE "${{CMAKE_CURRENT_BINARY_DIR}}/runtime-sources.txt" "${{runtimeSource
 
     def configure(self, flags=''):
         result = subprocess.run([CMAKE, '-S', str(self.root), '-B', str(self.build), '-G', 'Ninja', f'-DCMAKE_CXX_FLAGS={flags}'],
-                                capture_output=True, encoding='utf-8', errors='replace', timeout=15)
+                                capture_output=True, encoding='utf-8', errors='replace', timeout=120)
         if result.returncode:
             raise AssertionError(result.stdout + result.stderr)
         if (self.root / 'compiler-invoked').exists():
@@ -101,7 +101,7 @@ file(WRITE "${{CMAKE_CURRENT_BINARY_DIR}}/runtime-sources.txt" "${{runtimeSource
                                  f'-DRECOMPILER_DIR={self.recompiler.as_posix()}',
                                  f'-DLIST_FILE={self.listing.as_posix()}', f'-DOUTPUT={output.as_posix()}',
                                  f'-DEXTRA={self.extra}', '-P', str(self.recompiler / 'ShaderCacheVersion.cmake')],
-                                capture_output=True, encoding='utf-8', errors='replace', timeout=10)
+                                capture_output=True, encoding='utf-8', errors='replace', timeout=60)
         if not success:
             if result.returncode == 0 or output.exists():
                 raise AssertionError('The generator accepted an unkeyed dependency')
@@ -147,7 +147,7 @@ class ShaderCacheRuntimeSourceTests(unittest.TestCase):
                       'if(NOT result EQUAL 99)', 'message(FATAL_ERROR "Unexpected compiler arguments were accepted")', 'endif()']
         script.write_text('\n'.join(lines) + '\n', encoding='utf-8')
         result = subprocess.run([CMAKE, '-P', str(script)], capture_output=True,
-                                encoding='utf-8', errors='replace', timeout=10)
+                                encoding='utf-8', errors='replace', timeout=60)
         self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
         self.assertEqual(len(marker.read_text(encoding='utf-8').splitlines()), len(rejected))
 
@@ -176,17 +176,33 @@ class ShaderCacheRuntimeSourceTests(unittest.TestCase):
         fixture.configure()
         self.assertEqual(fixture.version(), previous)
 
-    def test_runtime_sources_headers_and_cmake_change_version(self):
+    def assertEditChangesVersion(self, name):
         fixture = self.fixture()
         previous = fixture.version()
-        for name in ('Recompiler.cpp', 'tests/DummyShaders.cpp', 'tests/DummyShaders.hpp', 'BdaAbi.hpp', 'CMakeLists.txt', 'ShaderCacheVersion.cmake'):
-            with self.subTest(source=name):
-                path = fixture.recompiler / name
-                before = path.read_bytes()
-                path.write_bytes(before + b'\n')
-                self.assertNotEqual(fixture.version(), previous)
-                path.write_bytes(before)
-                self.assertEqual(fixture.version(), previous)
+        path = fixture.recompiler / name
+        before = path.read_bytes()
+        path.write_bytes(before + b'\n')
+        self.assertNotEqual(fixture.version(), previous)
+        path.write_bytes(before)
+        self.assertEqual(fixture.version(), previous)
+
+    def test_runtime_source_changes_version(self):
+        self.assertEditChangesVersion('Recompiler.cpp')
+
+    def test_compiled_test_source_changes_version(self):
+        self.assertEditChangesVersion('tests/DummyShaders.cpp')
+
+    def test_compiled_test_header_changes_version(self):
+        self.assertEditChangesVersion('tests/DummyShaders.hpp')
+
+    def test_runtime_header_changes_version(self):
+        self.assertEditChangesVersion('BdaAbi.hpp')
+
+    def test_cmake_list_changes_version(self):
+        self.assertEditChangesVersion('CMakeLists.txt')
+
+    def test_version_script_changes_version(self):
+        self.assertEditChangesVersion('ShaderCacheVersion.cmake')
 
     def test_flags_change_version(self):
         fixture = self.fixture()
@@ -222,5 +238,45 @@ class ShaderCacheRuntimeSourceTests(unittest.TestCase):
         self.assertIn('has not been reviewed', fixture.version(False))
 
 
+def iter_test_cases(suite):
+    for test in suite:
+        if isinstance(test, unittest.TestSuite):
+            yield from iter_test_cases(test)
+        else:
+            yield test
+
+
+def shard_suite(index, count):
+    if count <= 0 or index < 0 or index >= count:
+        raise ValueError('shard index must be within the shard count')
+    tests = sorted(iter_test_cases(unittest.defaultTestLoader.loadTestsFromModule(sys.modules[__name__])), key=lambda test: test.id())
+    return unittest.TestSuite(test for position, test in enumerate(tests) if position % count == index)
+
+
+class ShardTests(unittest.TestCase):
+    def test_shards_run_each_case_once(self):
+        discovered = sorted(test.id() for test in iter_test_cases(unittest.defaultTestLoader.loadTestsFromModule(sys.modules[__name__])))
+        for count in range(1, len(discovered) + 2):
+            with self.subTest(count=count):
+                sharded = [test.id() for index in range(count) for test in iter_test_cases(shard_suite(index, count))]
+                self.assertEqual(sorted(sharded), discovered)
+
+    def test_invalid_shard_is_rejected(self):
+        for index, count in ((0, 0), (-1, 2), (2, 2)):
+            with self.subTest(index=index, count=count), self.assertRaises(ValueError):
+                shard_suite(index, count)
+
+
 if __name__ == '__main__':
+    if len(sys.argv) > 1 and sys.argv[1] == '--shard':
+        if len(sys.argv) != 3 or '/' not in sys.argv[2]:
+            print('usage: test_shader_cache_runtime_sources.py [SOURCE CMAKE] --shard INDEX/COUNT', file=sys.stderr)
+            raise SystemExit(2)
+        try:
+            shard_index, shard_count = (int(part) for part in sys.argv[2].split('/', 1))
+            suite = shard_suite(shard_index, shard_count)
+        except ValueError as error:
+            print(f'invalid shard: {error}', file=sys.stderr)
+            raise SystemExit(2)
+        raise SystemExit(0 if unittest.TextTestRunner().run(suite).wasSuccessful() else 1)
     unittest.main()
diff --git a/tools/tests/test_stubgen.py b/tools/tests/test_stubgen.py
index eedd1e3a09..41fab273fb 100644
--- a/tools/tests/test_stubgen.py
+++ b/tools/tests/test_stubgen.py
@@ -42,6 +42,34 @@ class StubgenTests(unittest.TestCase):
 
 
 class StubGeneratorTests(unittest.TestCase):
+    def test_long_output_names(self):
+        import subprocess
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory).resolve()
+            if os.name == "nt":
+                root = Path("\\\\?\\" + str(root))
+            limit = os.pathconf(root, "PC_NAME_MAX") if os.name == "posix" else 255
+            nids = root / "nids.txt"
+            nids.write_text("AAAAAAAAAAA\n", encoding="utf-8")
+            expected = stubgen.generate("libSceExample", ["AAAAAAAAAAA"], {})
+            for option, extra, content in (("--out", [], expected[0]),
+                                           ("--td-out", ["--td-only"], expected[1])):
+                for existing in (False, True):
+                    with self.subTest(option=option, existing=existing):
+                        output = root / ("a" * (limit - 4) + ".txt")
+                        output.write_bytes(b"previous output\n")
+                        if not existing:
+                            output.unlink()
+                        result = subprocess.run(
+                            [sys.executable, str(Path(stubgen.__file__)), "--module", "libSceExample",
+                             "--nids", str(nids), option, str(output), *extra],
+                            capture_output=True, text=True)
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertEqual(output.read_text(encoding="utf-8"), content)
+                        self.assertEqual(nids.read_text(encoding="utf-8"), "AAAAAAAAAAA\n")
+                        self.assertEqual(set(root.iterdir()), {nids, output})
+                        output.unlink()
+
     @unittest.skipUnless(os.name == "nt", "Windows denies replacing read-only output files")
     def test_readonly_second_output_preserves_both_outputs(self):
         import subprocess
diff --git a/tools/tests/test_suggest_patches.py b/tools/tests/test_suggest_patches.py
new file mode 100644
index 0000000000..f24f84b86d
--- /dev/null
+++ b/tools/tests/test_suggest_patches.py
@@ -0,0 +1,374 @@
+import contextlib
+import hashlib
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import suggest_patches
+
+VERIFIED = "Verified 1 patches: 1 ok, 0 not-checked, 0 mismatch\n"
+
+
+class PatchAdvisorTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.catalog = self.root / "catalog"
+        self.catalog.mkdir()
+        self.input = self.root / "eboot.bin"
+        self.input.write_bytes(b"main executable")
+        self.module = self.root / "Media" / "Modules" / "module.prx"
+        self.module.parent.mkdir(parents=True)
+        self.module.write_bytes(b"module version one")
+        self.param = self.root / "param.json"
+        self.param.write_text(json.dumps({"titleId": "TEST00001", "contentVersion": "01.000.000"}))
+        self.relinker = self.root / "relinker"
+        self.relinker.write_bytes(b"fixture")
+        (self.catalog / "patch.toml").write_text('format = 1\n[[patch]]\ntarget = "Media/Modules/module.prx"\nva = 0x1000\nexpected = "00"\nvalue = "01"\n')
+        self.entry = {"titleId": "TEST00001", "contentVersion": "01.000.000", "patch": "patch.toml",
+                      "targets": {"Media/Modules/module.prx": hashlib.sha256(self.module.read_bytes()).hexdigest()}}
+        self.write_index()
+
+    def write_index(self, entries=None):
+        (self.catalog / "index.json").write_text(json.dumps({"format": 1, "entries": entries if entries is not None else [self.entry]}))
+
+    def advise(self, *extra):
+        return suggest_patches.main(["--catalog", str(self.catalog), "--param-json", str(self.param),
+                                     "--input", str(self.input), "--relinker", str(self.relinker),
+                                     "--module-dir", "Media/Modules", *extra])
+
+    def additional_executable(self):
+        executable = self.root / "picker" / "picker.bin"
+        executable.parent.mkdir()
+        executable.write_bytes(b"secondary executable")
+        (self.catalog / "patch.toml").write_text('format = 1\n[[patch]]\ntarget = "picker/picker.bin"\nva = 0x1000\nexpected = "00"\nvalue = "01"\n')
+        self.entry["targets"] = {"picker/picker.bin": hashlib.sha256(executable.read_bytes()).hexdigest()}
+        self.write_index()
+        return executable
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_verified_match_requires_explicit_application(self, run):
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        self.assertEqual(self.advise(), 0)
+        self.assertEqual(run.call_args.args[0], [str(self.relinker), "--verify-patches",
+                                                 str(self.catalog / "patch.toml"), "--module-dir", "Media/Modules",
+                                                 str(self.input)])
+        self.assertFalse((self.root / "relinker-patches.toml").exists())
+
+    def test_relinker_output_is_utf8_independent_of_host_encoding(self):
+        actual_run = subprocess.run
+        for diagnostic in ("caf\u00e9 \u65e5\u672c\u8a9e".encode(), b"invalid byte \xff"):
+            for status in (0, 2):
+                with self.subTest(diagnostic=diagnostic, status=status):
+                    stdout = VERIFIED.encode() + diagnostic + b"\n"
+                    stderr = diagnostic + b"\n"
+                    captured = []
+                    output, errors = io.StringIO(), io.StringIO()
+
+                    def verify(command, **options):
+                        script = f"import os; os.write(1, {stdout!r}); os.write(2, {stderr!r}); raise SystemExit({status})"
+                        options.setdefault("encoding", "ascii")
+                        result = actual_run([sys.executable, "-c", script], **options)
+                        captured.append(result)
+                        return result
+
+                    with contextlib.redirect_stdout(output), contextlib.redirect_stderr(errors), \
+                            patch.object(suggest_patches.subprocess, "run", side_effect=verify):
+                        self.assertEqual(self.advise(), status)
+                    self.assertEqual(captured[0].stdout, stdout.decode("utf-8", errors="replace"))
+                    self.assertEqual(captured[0].stderr, stderr.decode("utf-8", errors="replace"))
+                    if status == 2:
+                        self.assertIn("relinker error (exit 2)", output.getvalue())
+                        self.assertIn((stdout + stderr).decode("utf-8", errors="replace").strip(), output.getvalue())
+                        self.assertIn("No recommendation: relinker errors occurred", errors.getvalue())
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_output_streams_use_utf8(self, run):
+        catalog = self.root / "caf\u00e9"
+        self.catalog.rename(catalog)
+        self.catalog = catalog
+        self.param = self.root / "caf\u00e9.json"
+        self.param.write_text(json.dumps({"titleId": "TEST00001", "contentVersion": "01.000.000"}))
+        stdout = io.TextIOWrapper(io.BytesIO(), encoding="ascii")
+        stderr = io.TextIOWrapper(io.BytesIO(), encoding="ascii")
+        self.addCleanup(stdout.close)
+        self.addCleanup(stderr.close)
+        run.return_value = subprocess.CompletedProcess([], 0, VERIFIED, "")
+        with patch.object(suggest_patches.sys, "stdout", stdout), patch.object(suggest_patches.sys, "stderr", stderr):
+            self.assertEqual(self.advise(), 0)
+            stdout.flush()
+            self.assertIn(b"Recommended:", stdout.buffer.getvalue())
+            self.assertIn(str(self.catalog).encode("utf-8"), stdout.buffer.getvalue())
+            self.param.unlink()
+            self.assertEqual(self.advise(), 2)
+            stderr.flush()
+            self.assertIn(self.param.name.encode("utf-8"), stderr.buffer.getvalue())
+            for stream in (stdout, stderr):
+                self.assertEqual(stream.encoding, "utf-8")
+                self.assertEqual(stream.errors, "backslashreplace")
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_changed_module_is_not_sent_to_relinker(self, run):
+        self.module.write_bytes(b"module version two")
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_rejection_is_not_a_recommendation(self, run):
+        run.return_value.returncode = 1
+        run.return_value.stdout = "Mismatch: patch\nVerified 1 patches: 0 ok, 0 not-checked, 1 mismatch\n"
+        run.return_value.stderr = ""
+        self.assertEqual(self.advise(), 1)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_catalog_cannot_escape_directory(self, run):
+        self.entry["patch"] = "../outside.toml"
+        self.write_index()
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_hashes_cover_all_patch_targets(self, run):
+        self.entry["targets"] = {"eboot.bin": hashlib.sha256(self.input.read_bytes()).hexdigest()}
+        self.write_index()
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_additional_executable_is_hashed_and_verified(self, run):
+        self.additional_executable()
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        self.assertEqual(self.advise("--executable", "picker/picker.bin"), 0)
+        self.assertEqual(run.call_args.args[0], [str(self.relinker), "--verify-patches",
+                                                 str(self.catalog / "patch.toml"), "--module-dir", "Media/Modules",
+                                                 "--executable", "picker/picker.bin", str(self.input)])
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_changed_additional_executable_is_not_verified(self, run):
+        executable = self.additional_executable()
+        executable.write_bytes(b"different executable")
+        self.assertEqual(self.advise("--executable", "picker/picker.bin"), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_additional_executable_cannot_escape_module_parent(self, run):
+        self.assertEqual(self.advise("--executable", "../outside.bin"), 2)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_unrelated_malformed_patch_does_not_block_recommendation(self, run):
+        bad = {"titleId": "OTHER0001", "contentVersion": "01.000.000", "patch": "missing.toml", "targets": {}}
+        (self.catalog / "index.json").write_text(json.dumps({"format": 1, "entries": [bad, self.entry]}))
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        self.assertEqual(self.advise(), 0)
+        run.assert_called_once()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_matching_malformed_patch_is_rejected(self, run):
+        self.entry["patch"] = "missing.toml"
+        self.write_index()
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_timeout_is_not_a_recommendation(self, run):
+        run.side_effect = subprocess.TimeoutExpired([str(self.relinker)], 7)
+        self.assertEqual(self.advise("--timeout-seconds", "7"), 1)
+        self.assertEqual(run.call_args.kwargs["timeout"], 7)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_broken_matching_entry_does_not_block_valid_entry(self, run):
+        bad = dict(self.entry, patch="broken.toml")
+        (self.catalog / "broken.toml").write_text("format = @")
+        self.write_index([bad, self.entry])
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 0)
+        self.assertIn("Catalog entry 1 ('broken.toml'): rejected", output.getvalue())
+        self.assertIn("Recommended:", output.getvalue())
+        run.assert_called_once()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_timeout_does_not_block_valid_entry(self, run):
+        self.write_index([self.entry, self.entry])
+        run.side_effect = [subprocess.TimeoutExpired([str(self.relinker)], 7), subprocess.CompletedProcess([], 0, VERIFIED, "")]
+        self.assertEqual(self.advise("--timeout-seconds", "7"), 0)
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_error_without_verified_entries_exits_two(self, run):
+        run.return_value.returncode = 2
+        run.return_value.stdout = ""
+        run.return_value.stderr = "FAIL: broken input"
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_error_does_not_block_verified_entry(self, run):
+        self.write_index([self.entry, self.entry])
+        run.side_effect = [subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch"),
+                           subprocess.CompletedProcess([], 0, VERIFIED, "")]
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 0)
+        self.assertIn("Catalog entry 1 ('patch.toml'): relinker error (exit 2)", output.getvalue())
+        self.assertIn("Recommended:", output.getvalue())
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_error_and_mismatch_exit_two(self, run):
+        self.write_index([self.entry, self.entry])
+        run.side_effect = [subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch"),
+                           subprocess.CompletedProcess([], 1, "Verified 1 patches: 0 ok, 0 not-checked, 1 mismatch\n", "")]
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_multiple_verified_entries_are_ambiguous(self, run):
+        self.write_index([self.entry, self.entry])
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 1)
+        self.assertIn("multiple verified catalog entries match; use --list-verified to see them.", output.getvalue())
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_shows_each_match_and_quoted_patch_path(self, run):
+        second = self.catalog / "second patch.toml"
+        second.write_bytes((self.catalog / "patch.toml").read_bytes())
+        self.write_index([self.entry, dict(self.entry, patch=second.name)])
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified"), 0)
+        self.assertIn("Verified catalog entries: 2", output.getvalue())
+        self.assertIn("Choose one patch file; listed entries are not combined.", output.getvalue())
+        self.assertIn(f"Catalog entry 1: {self.catalog / 'patch.toml'}", output.getvalue())
+        self.assertIn(f"Catalog entry 2: {second}", output.getvalue())
+        quoted = f'"{second}"' if os.name == "nt" else f"'{second}'"
+        self.assertIn(f"--patches {quoted} --module-dir Media/Modules", output.getvalue())
+        self.assertEqual(output.getvalue().count("SHA-256"), 2)
+        self.assertNotIn("Recommended:", output.getvalue())
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_single_match_preserves_conversion_options(self, run):
+        self.additional_executable()
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified", "--executable", "picker/picker.bin",
+                                         "--sce-module-path", str(self.root)), 0)
+        expected = suggest_patches.command_line(["--patches", str(self.catalog / "patch.toml"),
+                                                  "--sce-module-path", str(self.root), "--module-dir",
+                                                  "Media/Modules", "--executable", "picker/picker.bin"])
+        self.assertIn(expected, output.getvalue())
+        self.assertIn("Verified catalog entries: 1", output.getvalue())
+        self.assertIn("Choose one patch file; listed entries are not combined.", output.getvalue())
+        self.assertNotIn("Recommended:", output.getvalue())
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_skips_individual_errors(self, run):
+        bad = dict(self.entry, patch="missing.toml")
+        wrong_hash = dict(self.entry, targets={"Media/Modules/module.prx": "0" * 64})
+        self.write_index([bad, wrong_hash, self.entry, self.entry, self.entry])
+        run.side_effect = [subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch"),
+                           subprocess.CompletedProcess([], 1, "Verified 1 patches: 0 ok, 0 not-checked, 1 mismatch\n", ""),
+                           subprocess.CompletedProcess([], 0, VERIFIED, "")]
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified"), 0)
+        self.assertIn("Catalog entry 1 ('missing.toml'): rejected", output.getvalue())
+        self.assertIn("Catalog entry 2 ('patch.toml'): rejected: Media/Modules/module.prx: SHA-256 mismatch", output.getvalue())
+        self.assertIn("Catalog entry 3 ('patch.toml'): relinker error (exit 2)", output.getvalue())
+        self.assertIn("Catalog entry 4 ('patch.toml'): rejected by relinker", output.getvalue())
+        self.assertIn("Verified catalog entries: 1", output.getvalue())
+        self.assertIn(f"Catalog entry 5: {self.catalog / 'patch.toml'}", output.getvalue())
+        self.assertEqual(run.call_count, 3)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_no_match_keeps_exit_statuses(self, run):
+        self.write_index([])
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified"), 1)
+        self.assertIn("No verified catalog entries: no catalog entry", output.getvalue())
+        run.assert_not_called()
+        self.write_index()
+        run.return_value = subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch")
+        errors = io.StringIO()
+        with contextlib.redirect_stderr(errors):
+            self.assertEqual(self.advise("--list-verified"), 2)
+        self.assertIn("No verified catalog entries: relinker errors occurred", errors.getvalue())
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_not_checked_patch_is_not_recommended(self, run):
+        run.return_value.returncode = 0
+        run.return_value.stdout = "Verified 1 patches: 0 ok, 1 not-checked, 0 mismatch\n"
+        self.assertEqual(self.advise(), 1)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_success_without_verification_summary_is_an_error(self, run):
+        run.return_value.returncode = 0
+        run.return_value.stdout = "unrecognized verifier"
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_argument_error_is_not_a_patch_rejection(self, run):
+        run.return_value.returncode = 1
+        run.return_value.stdout = ""
+        run.return_value.stderr = "FAIL: invalid option"
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_conflicting_module_options_are_rejected_before_relinker(self, run):
+        self.assertEqual(self.advise("--skip-sce-module", "--sce-module-path", str(self.root)), 2)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_uppercase_digest_and_conversion_options(self, run):
+        self.additional_executable()
+        self.entry["targets"]["picker/picker.bin"] = self.entry["targets"]["picker/picker.bin"].upper()
+        self.write_index()
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--executable", "picker/picker.bin", "--sce-module-path", str(self.root)), 0)
+        self.assertIn("--patches", output.getvalue())
+        self.assertIn("--module-dir Media/Modules", output.getvalue())
+        self.assertIn("--executable picker/picker.bin", output.getvalue())
+        self.assertIn(f"--sce-module-path {self.root}", output.getvalue())
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_no_entries_for_title_is_distinct(self, run):
+        self.write_index([])
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 1)
+        self.assertIn("no catalog entry for TEST00001 01.000.000", output.getvalue())
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_invalid_timeout_is_rejected_before_relinker(self, run):
+        self.assertEqual(self.advise("--timeout-seconds", "0"), 2)
+        run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/tests/test_symbolize_samples.py b/tools/tests/test_symbolize_samples.py
new file mode 100644
index 0000000000..5e000527dc
--- /dev/null
+++ b/tools/tests/test_symbolize_samples.py
@@ -0,0 +1,202 @@
+import contextlib
+import io
+import struct
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import symbolize_samples
+
+TIMESTAMP = 0x6AD92AC4
+SIZE_OF_IMAGE = 0x3000
+
+
+def symbol(name, value, section, kind, storage, aux=0):
+    return struct.pack("<8sIhHBB", name, value, section, kind, storage, aux)
+
+
+def build_pe(path, with_symbols=True, with_exports=False, second_code=False):
+    image = bytearray(0xC00)
+    image[0:2] = b"MZ"
+    struct.pack_into("<I", image, 0x3C, 0x40)
+    image[0x40:0x44] = b"PE\0\0"
+    symbols = b""
+    strings = b""
+    if with_symbols:
+        long_name = b"AgcDriver_long_function_name\0"
+        strings = struct.pack("<I", 4 + len(long_name)) + long_name
+        symbols = b"".join([
+            symbol(b".text", 0, 1, 0, 3, aux=1), b"\0" * 18,
+            symbol(b"short", 0x10, 1, 0x20, 2),
+            symbol(b"\0\0\0\0" + struct.pack("<I", 4), 0x40, 1, 0x20, 2),
+            symbol(b"static_f", 0x80, 1, 0x20, 3),
+            symbol(b"data_obj", 0x08, 2, 0, 2),
+        ] + ([symbol(b"late_fn", 0x40, 3, 0x20, 2)] if second_code else []))
+    symbol_count = len(symbols) // 18
+    struct.pack_into("<HHIIIHH", image, 0x44, 0x8664, 3 if second_code else 2, TIMESTAMP, 0x800 if with_symbols else 0, symbol_count, 240, 0x22)
+    optional = 0x58
+    struct.pack_into("<H", image, optional, 0x20B)
+    struct.pack_into("<Q", image, optional + 24, 0x140000000)
+    struct.pack_into("<I", image, optional + 56, SIZE_OF_IMAGE)
+    if with_exports:
+        struct.pack_into("<II", image, optional + 112, 0x2000, 0x100)
+    sections = optional + 240
+    struct.pack_into("<8sIIII", image, sections, b".text", 0x100, 0x1000, 0x100, 0x400)
+    struct.pack_into("<I", image, sections + 36, 0x60000020)
+    struct.pack_into("<8sIIII", image, sections + 40, b".rdata", 0x200, 0x2000, 0x200, 0x600)
+    struct.pack_into("<I", image, sections + 76, 0x40000040)
+    if second_code:
+        struct.pack_into("<8sIIII", image, sections + 80, b".text2", 0x100, 0x2800, 0x100, 0xA00)
+        struct.pack_into("<I", image, sections + 116, 0x60000020)
+    if with_exports:
+        directory = 0x600
+        struct.pack_into("<IIHHIIIIIII", image, directory, 0, 0, 0, 0, 0, 1, 2, 2, 0x2040, 0x2048, 0x2050)
+        struct.pack_into("<II", image, 0x640, 0x1020, 0x1060)
+        struct.pack_into("<II", image, 0x648, 0x2060, 0x2070)
+        struct.pack_into("<HH", image, 0x650, 0, 1)
+        image[0x660:0x660 + 11] = b"first_func\0"
+        image[0x670:0x670 + 12] = b"second_func\0"
+    if with_symbols:
+        image[0x800:0x800 + len(symbols)] = symbols
+        image[0x800 + len(symbols):0x800 + len(symbols) + len(strings)] = strings
+    Path(path).write_bytes(bytes(image))
+
+
+class SymbolizeSamplesTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.root = Path(self.directory.name)
+        self.libs = self.root / "libs"
+        self.libs.mkdir()
+        build_pe(self.libs / "libSceAgcDriver.prx")
+        build_pe(self.libs / "libwinpthread-1.dll", with_symbols=False, with_exports=True)
+
+    def tearDown(self):
+        self.directory.cleanup()
+
+    def test_coff_symbols_name_code_addresses(self):
+        module = symbolize_samples.PeModule(self.libs / "libSceAgcDriver.prx")
+        self.assertEqual((module.size, module.timestamp), (SIZE_OF_IMAGE, TIMESTAMP))
+        self.assertFalse(module.exported)
+        self.assertIsNone(module.name(0x1005))
+        self.assertEqual(module.name(0x1010), "short")
+        self.assertEqual(module.name(0x103F), "short")
+        self.assertEqual(module.name(0x1045), "AgcDriver_long_function_name")
+        self.assertEqual(module.name(0x1085), "static_f")
+        self.assertIsNone(module.name(0x1100))
+        self.assertIsNone(module.name(0x2008))
+        self.assertNotIn("data_obj", module.names)
+        self.assertNotIn(".text", module.names)
+
+    def test_export_table_names_a_module_without_symbols(self):
+        module = symbolize_samples.PeModule(self.libs / "libwinpthread-1.dll")
+        self.assertTrue(module.exported)
+        self.assertEqual(module.name(0x1030), "~first_func")
+        self.assertEqual(module.name(0x1070), "~second_func")
+
+    def test_frames_keep_unknown_modules_and_out_of_range_addresses(self):
+        symbolizer = symbolize_samples.Symbolizer([self.libs], {}, warn=lambda text: None, unverified=True)
+        self.assertEqual(symbolizer.frame("libSceAgcDriver.prx+0x1046"), "libSceAgcDriver.prx!AgcDriver_long_function_name")
+        self.assertEqual(symbolizer.frame("LIBSCEAGCDRIVER.PRX+0x1011"), "LIBSCEAGCDRIVER.PRX!short")
+        self.assertEqual(symbolizer.frame("ntdll.dll+0x10"), "ntdll.dll+0x10")
+        self.assertEqual(symbolizer.frame("libSceAgcDriver.prx+0x10"), "libSceAgcDriver.prx+0x10")
+        self.assertEqual(symbolizer.frame("[truncated]"), "[truncated]")
+
+    def test_a_module_whose_size_or_timestamp_differs_stays_unsymbolized(self):
+        warnings = []
+        headers = {"libSceAgcDriver.prx": (SIZE_OF_IMAGE, TIMESTAMP + 1)}
+        symbolizer = symbolize_samples.Symbolizer([self.libs], headers, warn=warnings.append)
+        self.assertEqual(symbolizer.frame("libSceAgcDriver.prx+0x1011"), "libSceAgcDriver.prx+0x1011")
+        self.assertEqual(len(warnings), 1)
+        self.assertIn("timestamp", warnings[0])
+        matching = symbolize_samples.Symbolizer([self.libs], {"libSceAgcDriver.prx": (SIZE_OF_IMAGE, TIMESTAMP)}, warn=warnings.append)
+        self.assertEqual(matching.frame("libSceAgcDriver.prx+0x1011"), "libSceAgcDriver.prx!short")
+
+    def test_since_subtracts_an_earlier_snapshot_and_out_writes_symbolized_stacks(self):
+        header = f"# samples=9 depth=64 truncated=0\n# module libSceAgcDriver.prx {SIZE_OF_IMAGE:#x} {TIMESTAMP:#x}\n"
+        earlier = self.root / "worker-early.collapsed.txt"
+        later = self.root / "worker-late.collapsed.txt"
+        earlier.write_text(header + "ntdll.dll+0x1;libSceAgcDriver.prx+0x1011 4\nntdll.dll+0x1;libSceAgcDriver.prx+0x1081 2\n", encoding="utf-8")
+        later.write_text(header + "ntdll.dll+0x1;libSceAgcDriver.prx+0x1011 7\nntdll.dll+0x1;libSceAgcDriver.prx+0x1081 2\nntdll.dll+0x1;libSceAgcDriver.prx+0x1041 3\n", encoding="utf-8")
+        out = self.root / "steady.collapsed.txt"
+        printed = io.StringIO()
+        with contextlib.redirect_stdout(printed):
+            self.assertEqual(symbolize_samples.main([str(later), "--since", str(earlier), "--libs", str(self.libs), "--out", str(out), "--top", "5"]), 0)
+        text = printed.getvalue()
+        self.assertIn("6 samples", text)
+        self.assertIn("libSceAgcDriver.prx!short", text)
+        self.assertIn("libSceAgcDriver.prx!AgcDriver_long_function_name", text)
+        self.assertNotIn("static_f", text)
+        written = sorted(out.read_text(encoding="utf-8").splitlines())
+        self.assertEqual(written, ["ntdll.dll+0x1;libSceAgcDriver.prx!AgcDriver_long_function_name 3", "ntdll.dll+0x1;libSceAgcDriver.prx!short 3"])
+
+    def run_main(self, *arguments):
+        printed = io.StringIO()
+        errors = io.StringIO()
+        with contextlib.redirect_stdout(printed), contextlib.redirect_stderr(errors):
+            self.assertEqual(symbolize_samples.main([str(argument) for argument in arguments]), 0)
+        return printed.getvalue().splitlines(), errors.getvalue()
+
+    def test_address_files_are_summarized_by_self_and_inclusive_samples(self):
+        samples = self.root / "worker.txt"
+        samples.write_text(f"# 5 samples\nlibSceAgcDriver.prx 0x1011 3 9\nlibSceAgcDriver.prx 0x1012 1 4\nlibSceAgcDriver.prx 0x1045 0 5\nntdll.dll 0x10 1 1\n# module libSceAgcDriver.prx {SIZE_OF_IMAGE:#x} {TIMESTAMP:#x}\n", encoding="utf-8")
+        lines, _ = self.run_main(samples, "--libs", self.libs)
+        self.assertEqual(lines[0], "5 samples")
+        self.assertIn("4  80.0%  libSceAgcDriver.prx!short", lines[2])
+        inclusive = lines[lines.index("hottest by inclusive:") + 1:]
+        self.assertIn("13 260.0%  libSceAgcDriver.prx!short", inclusive[0])
+        self.assertIn("5 100.0%  libSceAgcDriver.prx!AgcDriver_long_function_name", inclusive[1])
+
+    def test_a_symbol_does_not_reach_into_a_later_code_section(self):
+        build_pe(self.libs / "two.prx", second_code=True)
+        module = symbolize_samples.PeModule(self.libs / "two.prx")
+        self.assertEqual(module.name(0x1085), "static_f")
+        self.assertIsNone(module.name(0x2810))
+        self.assertEqual(module.name(0x2840), "late_fn")
+        self.assertEqual(module.name(0x28F0), "late_fn")
+
+    def test_a_module_without_a_record_stays_unsymbolized_unless_unverified(self):
+        samples = self.root / "worker.txt"
+        samples.write_text("# 4 samples\nlibSceAgcDriver.prx 0x1011 4 4\n", encoding="utf-8")
+        lines, errors = self.run_main(samples, "--libs", self.libs)
+        self.assertIn("libSceAgcDriver.prx+0x1011", lines[2])
+        self.assertIn("no '# module' record", errors)
+        lines, errors = self.run_main(samples, "--libs", self.libs, "--unverified")
+        self.assertIn("libSceAgcDriver.prx!short", lines[2])
+        self.assertEqual(errors, "")
+
+    def test_thread_files_keep_each_heading_and_can_select_one_thread(self):
+        samples = self.root / "threads.txt"
+        record = f"# module libSceAgcDriver.prx {SIZE_OF_IMAGE:#x} {TIMESTAMP:#x}\n"
+        samples.write_text("# 50 rounds\nthread 7 samples 10\n  libSceAgcDriver.prx 0x1011 6 8\nthread 9 samples 40\n  libSceAgcDriver.prx 0x1045 20 30\n  libSceAgcDriver.prx 0x1011 2 12\n" + record, encoding="utf-8")
+        lines, _ = self.run_main(samples, "--libs", self.libs)
+        self.assertEqual(lines[0], "50 samples")
+        self.assertIn("20  40.0%  libSceAgcDriver.prx!AgcDriver_long_function_name", lines[2])
+        lines, _ = self.run_main(samples, "--libs", self.libs, "--thread", "7")
+        self.assertEqual(lines[0], "10 samples")
+        self.assertIn("6  60.0%  libSceAgcDriver.prx!short", lines[2])
+        self.assertNotIn("AgcDriver_long_function_name", "\n".join(lines))
+
+    def test_since_subtracts_both_counters_of_an_address_file(self):
+        record = f"# module libSceAgcDriver.prx {SIZE_OF_IMAGE:#x} {TIMESTAMP:#x}\n"
+        earlier = self.root / "early.txt"
+        later = self.root / "late.txt"
+        earlier.write_text("# 4 samples\nlibSceAgcDriver.prx 0x1011 4 6\n" + record, encoding="utf-8")
+        later.write_text("# 10 samples\nlibSceAgcDriver.prx 0x1011 7 12\nlibSceAgcDriver.prx 0x1045 3 3\n" + record, encoding="utf-8")
+        lines, _ = self.run_main(later, "--since", earlier, "--libs", self.libs)
+        self.assertEqual(lines[0], "6 samples")
+        self.assertIn("3  50.0%  libSceAgcDriver.prx!short", "\n".join(lines[2:4]))
+        inclusive = lines[lines.index("hottest by inclusive:") + 1:]
+        self.assertIn("6 100.0%  libSceAgcDriver.prx!short", inclusive[0])
+
+    def test_malformed_lines_are_rejected_with_their_line_number(self):
+        bad = self.root / "bad.collapsed.txt"
+        bad.write_text("# header\nlibSceAgcDriver.prx+0x1011 many\n", encoding="utf-8")
+        with self.assertRaisesRegex(ValueError, r"bad\.collapsed\.txt:2:"):
+            symbolize_samples.load(bad)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/tests/test_test_registration.py b/tools/tests/test_test_registration.py
index c6bc83ae2b..a329b64cf2 100644
--- a/tools/tests/test_test_registration.py
+++ b/tools/tests/test_test_registration.py
@@ -15,6 +15,30 @@ import check_test_registration
 
 
 class RegistrationTests(unittest.TestCase):
+    @unittest.skipUnless(shutil.which("cmake"), "CMake is required for the argument oracle")
+    def test_quoted_continuations_follow_cmake(self):
+        for ending, backslashes in (("\n", 1), ("\r\n", 1), ("\n", 2), ("\n", 3), ("\n", 4)):
+            with self.subTest(ending=repr(ending), backslashes=backslashes), tempfile.TemporaryDirectory() as directory:
+                content = 'add_test("real" "tools/tests/test_' + '\\' * backslashes + ending + 'bounds.py")\n'
+                script = Path(directory) / "oracle.cmake"
+                script.write_bytes(('function(add_test)\n'
+                                    'file(WRITE "${CMAKE_CURRENT_LIST_DIR}/argument.txt" "${ARGV1}")\n'
+                                    'endfunction()\n' + content).encode())
+                subprocess.run(["cmake", "-P", str(script)], capture_output=True, text=True, check=True)
+                actual = (Path(directory) / "argument.txt").read_text()
+                expected = "tools/tests/test_" + '\\' * (backslashes // 2) + ("\n" if backslashes % 2 == 0 else "") + "bounds.py"
+                self.assertEqual(actual, expected)
+                self.assertEqual(list(check_test_registration.commands(content)), [("add_test", ["real", actual])])
+                if backslashes == 1:
+                    (Path(directory) / "CMakeLists.txt").write_bytes(content.encode())
+                    self.assertEqual(check_test_registration.run_scripts(Path(directory), ["CMakeLists.txt"]), {actual})
+
+    def test_literal_escaped_newline_and_bracket_continuation_are_preserved(self):
+        quoted = r'add_test("real" "a\nb")' + '\n'
+        bracket = 'add_test("real" [=[a' + '\\' + '\n' + 'b]=])\n'
+        self.assertEqual(list(check_test_registration.commands(quoted)), [("add_test", ["real", "a\nb"])])
+        self.assertEqual(list(check_test_registration.commands(bracket)), [("add_test", ["real", "a\\\nb"])])
+
     def test_bracket_arguments_ignore_only_one_initial_newline(self):
         values = (("path", "path"), ("\npath", "path"), ("\n\npath", "\npath"),
                   ("\n path", " path"), (" \npath", " \npath"), ("\\npath", "\\npath"),
@@ -363,6 +387,22 @@ class ScriptRegistrationTests(unittest.TestCase):
             ".github/workflows/web.yml": "on:\n  pull_request:\n    paths:\n      - tools/test_paths.py\n",
             "tools/test_web.py": "", "tools/test_paths.py": ""}), ["tools/test_paths.py"])
 
+    def test_workflow_script_inside_a_longer_name_does_not_run(self):
+        self.assertEqual(self.unrun({
+            ".github/workflows/build.yml": "jobs:\n  t:\n    steps:\n      - run: python3 tools/check_test_registration.py build\n"
+                                           "      - run: python3 tools/run_test_a.py\n",
+            "tools/check_test_registration.py": "", "tools/run_test_a.py": "",
+            "tools/tests/test_registration.py": "", "tools/tests/test_a.py": ""}),
+            ["tools/tests/test_a.py", "tools/tests/test_registration.py"])
+
+    def test_workflow_script_with_a_longer_suffix_does_not_run(self):
+        self.assertEqual(self.unrun({
+            ".github/workflows/ci.yml": "jobs:\n  t:\n    steps:\n      - run: python3 tools/tests/test_a.pyc\n"
+                                        "      - run: python3 tools/tests/test_b.py.bak\n"
+                                        "      - run: python3 \"./tools/tests/test_c.py\" --quick\n",
+            "tools/tests/test_a.py": "", "tools/tests/test_b.py": "", "tools/tests/test_c.py": ""}),
+            ["tools/tests/test_a.py", "tools/tests/test_b.py"])
+
     def test_commented_workflow_line_does_not_run_a_script(self):
         self.assertEqual(self.unrun({
             ".github/workflows/ci.yml": "# python3 tools/tests/test_f.py\njobs:\n  t:\n    steps:\n      # python3 tools/tests/test_a.py\n"
@@ -394,6 +434,33 @@ class CheckRegistrationCliTests(unittest.TestCase):
                 code = check_test_registration.main(["--scripts"])
             self.assertEqual(code, 0)
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(check_test_registration.sys, "stdout", out), patch.object(check_test_registration.sys, "stderr", err):
+            try:
+                check_test_registration.main(["--invalid-argument"])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_trace_digest.py b/tools/tests/test_trace_digest.py
index 7df5e64fae..f3cdc26fe5 100644
--- a/tools/tests/test_trace_digest.py
+++ b/tools/tests/test_trace_digest.py
@@ -7,6 +7,7 @@ import subprocess
 import sys
 import tempfile
 import unittest
+from unittest import mock
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
@@ -46,6 +47,86 @@ STACKS = "# samples=5 depth=64 truncated=1\n# module a.prx 0x1000 0x1\nntdll.dll
 
 
 class TraceDigestTests(unittest.TestCase):
+    def test_summary_jsonl_record_shapes_are_validated(self):
+        path = Path(self.directory.name) / "invalid-summary.jsonl"
+        for record in (None, True, False, 7, 1.5, "", "interval_start_s", [], ["interval_start_s"]):
+            for mode in ("capture", "intervals"):
+                with self.subTest(record=record, mode=mode):
+                    path.write_text("{}\n\n" + json.dumps(record) + "\n", encoding="utf-8")
+                    with self.assertRaises(ValueError) as raised:
+                        if mode == "capture":
+                            trace_digest.load_summary(path, self.trace)
+                        else:
+                            trace_digest.load_intervals(path)
+                    self.assertEqual(str(raised.exception), f"{path}:3: summary record must be an object")
+
+    def test_summary_jsonl_syntax_errors_name_the_source_line(self):
+        path = Path(self.directory.name) / "invalid-summary.jsonl"
+        for record in ("{", '{"trace": }', "{} trailing"):
+            for mode in ("capture", "intervals"):
+                with self.subTest(record=record, mode=mode):
+                    path.write_text("{}\n\n" + record + "\n", encoding="utf-8")
+                    with self.assertRaises(ValueError) as raised:
+                        if mode == "capture":
+                            trace_digest.load_summary(path, self.trace)
+                        else:
+                            trace_digest.load_intervals(path)
+                    self.assertTrue(str(raised.exception).startswith(f"{path}:3: invalid JSON: "), str(raised.exception))
+
+    def test_cli_rejects_invalid_summary_records_without_partial_output(self):
+        summary = self.trace.with_name("aps5-summary.jsonl")
+        explicit = summary.with_name("explicit-\u03a9.jsonl")
+        invalid = [json.dumps(record) for record in (None, True, 7, "interval_start_s", [], ["interval_start_s"])]
+        for record in [*invalid, "{", "{} trailing"]:
+            data = (json.dumps(SUMMARY) + "\n\n" + record + "\n").encode("utf-8")
+            summary.write_bytes(data)
+            explicit.write_bytes(data)
+            for arguments, path in (([str(self.trace)], summary), ([str(self.trace), "--summary", str(explicit)], explicit),
+                                    ([str(summary)], summary)):
+                for output in ([], ["--json"]):
+                    with self.subTest(record=record, arguments=arguments, output=output):
+                        result = subprocess.run([sys.executable, trace_digest.__file__, *arguments, *output],
+                                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+                        self.assertEqual(result.returncode, 2, result.stderr)
+                        self.assertTrue(result.stderr.startswith(f"FAIL: {path}:3: "), result.stderr)
+                        self.assertNotIn("Traceback", result.stderr)
+                        self.assertEqual(result.stdout, "")
+                        self.assertEqual(path.read_bytes(), data)
+
+    def test_mixed_summary_jsonl_objects_preserve_selection_and_intervals(self):
+        path = self.trace.with_name("aps5-summary.jsonl")
+        expected = self.json_output(self.trace)
+        interval = interval_line(0.0, 30.0, 20.0, 5.0)
+        records = [{}, dict(SUMMARY, trace="other.json.gz"), SUMMARY, interval, {"unrelated": "\u03a9"}]
+        text = "\r\n \t\r\n" + "\r\n\r\n".join(json.dumps(record) for record in records) + "\r\n"
+        path.write_text(text, encoding="utf-8-sig")
+        self.assertEqual(self.json_output(self.trace), expected)
+        self.assertEqual(trace_digest.load_intervals(path), [interval])
+        records.extend([dict(SUMMARY, commit="latest"), dict(SUMMARY, trace=self.trace.with_suffix("").name, commit="alternate")])
+        path.write_text("\n".join(json.dumps(record) for record in records), encoding="utf-8")
+        self.assertEqual(trace_digest.load_summary(path, self.trace)["commit"], "latest")
+        self.assertEqual(trace_digest.load_summary(path, self.trace.with_suffix(""))["commit"], "alternate")
+
+    def test_empty_summary_jsonl_files_remain_valid(self):
+        path = self.trace.with_name("aps5-summary.jsonl")
+        for text in ("", "\n \t\r\n"):
+            for encoding in ("utf-8", "utf-8-sig"):
+                with self.subTest(text=text, encoding=encoding):
+                    path.write_text(text, encoding=encoding)
+                    self.assertIsNone(trace_digest.load_summary(path, self.trace))
+                    self.assertEqual(trace_digest.load_intervals(path), [])
+
+    def test_unicode_separators_inside_summary_strings_are_not_record_boundaries(self):
+        path = self.trace.with_name("aps5-summary.jsonl")
+        for separator in ("\u0085", "\u2028", "\u2029"):
+            with self.subTest(separator=separator):
+                gpu = f"GPU{separator}name"
+                summary = dict(SUMMARY, gpu=gpu)
+                interval = interval_line(0.0, 30.0, 20.0, 5.0, gpu=gpu)
+                path.write_text("\n".join(json.dumps(record, ensure_ascii=False) for record in (summary, interval)), encoding="utf-8")
+                self.assertEqual(trace_digest.load_summary(path, self.trace), summary)
+                self.assertEqual(trace_digest.load_intervals(path), [interval])
+
     def test_cli_rejects_invalid_event_container_shapes_without_partial_output(self):
         cases = [(value, "trace must be an event array or object") for value in (None, True, 7, "trace")]
         cases += [({"traceEvents": value}, "traceEvents must be an array")
@@ -651,7 +732,71 @@ class IntervalDigestTests(unittest.TestCase):
                  for index, commit in enumerate(("a", "a", "b", "b", "a"))]
         result = trace_digest.digest_intervals(lines)
         self.assertEqual(result["identity_changed_at"], [2, 4])
-        self.assertIn("commit, environment, GPU, driver or OS changed at interval 3, 5", trace_digest.markdown_intervals(result).splitlines())
+        self.assertIn("build, environment, host, resolution or title metadata changed at interval 3, 5", trace_digest.markdown_intervals(result).splitlines())
+
+    def test_machine_and_title_identity_fields_are_retained_and_compared(self):
+        metadata = {"cpu": "CPU A", "cpu_threads": 16, "memory_mib": 32768,
+                    "title_id": "PPSA00001", "title": "Title One", "content_version": "01.000.000"}
+        first = interval_line(0.0, 30.0, 20.0, 5.0, **metadata)
+        for key, value in (("cpu", "CPU B"), ("cpu_threads", 32), ("memory_mib", 65536),
+                           ("title_id", "PPSA00002"), ("title", "Title Two"), ("content_version", "02.000.000")):
+            with self.subTest(key=key):
+                changed = dict(first, **{key: value})
+                result = trace_digest.digest_intervals([first, first, changed, changed, first])
+                self.assertEqual({key: result["identity"].get(key) for key in metadata}, metadata)
+                self.assertEqual(result["identity_changed_at"], [2, 4])
+                self.assertIn("changed at interval 3, 5", trace_digest.markdown_intervals(result))
+
+    def test_optional_identity_appearance_disappearance_and_return(self):
+        absent = interval_line(0.0, 30.0, 20.0, 5.0)
+        for key, value in (("cpu", "CPU A"), ("cpu_threads", 0), ("memory_mib", 0),
+                           ("title_id", "PPSA00001"), ("title", "Title One"), ("content_version", "")):
+            with self.subTest(key=key, value=value):
+                present = dict(absent, **{key: value})
+                result = trace_digest.digest_intervals([absent, present, present, absent, present])
+                self.assertEqual(result["identity_changed_at"], [1, 3, 4])
+                self.assertIn(key, result["identity"])
+                self.assertIsNone(result["identity"][key])
+                self.assertIn("changed at interval 2, 4, 5", trace_digest.markdown_intervals(result))
+
+    def test_stable_or_absent_optional_identity_does_not_report_changes(self):
+        absent = interval_line(0.0, 30.0, 20.0, 5.0)
+        metadata = {"cpu": "CPU A", "cpu_threads": 0, "memory_mib": 0,
+                    "title_id": "PPSA00001", "title": "Title One", "content_version": ""}
+        for line in (absent, dict(absent, **metadata)):
+            with self.subTest(line=line):
+                result = trace_digest.digest_intervals([line, line])
+                self.assertEqual(result["identity_changed_at"], [])
+                self.assertNotIn("changed at interval", trace_digest.markdown_intervals(result))
+
+    def test_resolution_changes_are_reported(self):
+        first = interval_line(0.0, 30.0, 20.0, 5.0)
+        result = trace_digest.digest_intervals([first, dict(first, resolution="1280x720")])
+        self.assertEqual(result["identity_changed_at"], [1])
+        self.assertIn("build, environment, host, resolution or title metadata changed at interval 2",
+                      trace_digest.markdown_intervals(result))
+
+    def test_cli_retains_machine_and_title_identity_and_reports_changes(self):
+        metadata = {"cpu": "CPU A", "cpu_threads": 16, "memory_mib": 32768,
+                    "title_id": "PPSA00001", "title": "Title One", "content_version": "01.000.000"}
+        first = interval_line(0.0, 30.0, 20.0, 5.0, **metadata)
+        second = interval_line(30.0, 60.0, 40.0, 10.0, **dict(metadata, content_version="02.000.000"))
+        self.path.write_text("\n".join(json.dumps(line) for line in (first, second)) + "\n", encoding="utf-8")
+        result = subprocess.run([sys.executable, trace_digest.__file__, str(self.path), "--json"],
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        report = json.loads(result.stdout)
+        self.assertEqual({key: report["identity"].get(key) for key in metadata}, metadata)
+        self.assertEqual(report["identity_changed_at"], [1])
+        without_metadata = [{key: value for key, value in line.items() if key not in metadata} for line in (first, second)]
+        unchanged_metrics = trace_digest.digest_intervals(without_metadata)
+        self.assertEqual(report["intervals"], unchanged_metrics["intervals"])
+        result = subprocess.run([sys.executable, trace_digest.__file__, str(self.path)],
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("build, environment, host, resolution or title metadata changed at interval 2", result.stdout)
+        expected = trace_digest.markdown_intervals(unchanged_metrics)
+        self.assertEqual(result.stdout[result.stdout.index("| # |"):], expected[expected.index("| # |"):])
 
     def test_sparkline_scales_to_the_largest_value(self):
         self.assertEqual(trace_digest.sparkline([0.0, 5.0, 10.0]), ".+@")
@@ -744,6 +889,33 @@ class IntervalDigestTests(unittest.TestCase):
             loaded = trace_digest.load_summary(str(summary_file), SUMMARY["trace"])
             self.assertEqual(loaded["commit"], SUMMARY["commit"])
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(trace_digest.sys, "stdout", out), mock.patch.object(trace_digest.sys, "stderr", err):
+            try:
+                trace_digest.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_unwrap_self.py b/tools/tests/test_unwrap_self.py
index f30eb5a74f..33cfe1f642 100644
--- a/tools/tests/test_unwrap_self.py
+++ b/tools/tests/test_unwrap_self.py
@@ -1,4 +1,5 @@
 import contextlib
+import errno
 import io
 import os
 import struct
@@ -116,6 +117,267 @@ class UnwrapTest(unittest.TestCase):
         self.assertEqual(code, 0)
         self.assertTrue(output.exists())
 
+    def test_segment_stale_offset_before_the_recorded_shift_is_refused(self):
+        segments = default_segments() + [(SCE_COMMENT, 4, 0x100, 0, 0x20, 1)]
+        container = build_container(segments, default_records(), default_payloads())
+        source = Path(self.directory) / "input.self"
+        output = Path(self.directory) / "output.elf"
+        source.write_bytes(container)
+        result = subprocess.run([sys.executable, str(Path(unwrap_self.__file__)), str(source), str(output)],
+                                capture_output=True, text=True, timeout=30)
+        self.assertEqual(result.returncode, 2, result.stderr)
+        self.assertIn("does not fit the file", result.stderr)
+        self.assertNotIn("Traceback", result.stderr)
+        self.assertFalse(output.exists())
+
+    def test_huge_stale_offset_is_refused_instead_of_exhausting_memory(self):
+        segments = default_segments()
+        segments[2] = (PT_DYNAMIC, 6, 0x49000000001580, 0x1040, 0x10, 8)
+        segments.append((SCE_COMMENT, 4, 0x1600, 0, 0x4000000000000000, 1))
+        container = build_container(segments, default_records(), default_payloads())
+        source = Path(self.directory) / "input.self"
+        output = Path(self.directory) / "output.elf"
+        source.write_bytes(container)
+        result = subprocess.run([sys.executable, str(Path(unwrap_self.__file__)), str(source), str(output)],
+                                capture_output=True, text=True, timeout=30)
+        self.assertEqual(result.returncode, 2, result.stderr)
+        self.assertIn("does not fit the file", result.stderr)
+        self.assertNotIn("Traceback", result.stderr)
+        self.assertFalse(output.exists())
+
+    def test_write_failure_preserves_output_and_removes_temporary_files(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        real_open = io.open
+
+        def failing_open(path, mode="r", *args, **kwargs):
+            stream = real_open(path, mode, *args, **kwargs)
+            if "w" not in mode and "x" not in mode:
+                return stream
+            writer = mock.MagicMock(wraps=stream)
+            writer.__enter__.return_value = writer
+            writer.__exit__.side_effect = lambda *args: stream.close()
+
+            def fail_after_partial_write(data):
+                stream.write(data[:16])
+                stream.flush()
+                raise OSError(errno.ENOSPC, "simulated write failure")
+
+            writer.write.side_effect = fail_after_partial_write
+            return writer
+
+        for previous in (None, b"previous output"):
+            with self.subTest(previous=previous):
+                output.unlink(missing_ok=True)
+                if previous is not None:
+                    output.write_bytes(previous)
+                before = set(directory.iterdir())
+                errors = io.StringIO()
+                with mock.patch("io.open", side_effect=failing_open), contextlib.redirect_stderr(errors):
+                    status = unwrap_self.main([str(source), str(output)])
+                self.assertEqual(status, 2)
+                self.assertIn("simulated write failure", errors.getvalue())
+                self.assertEqual(set(directory.iterdir()), before)
+                if previous is not None:
+                    self.assertEqual(output.read_bytes(), previous)
+                self.assertEqual(source.read_bytes(), container)
+
+    def test_replace_failure_preserves_output_and_removes_temporary_files(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        output.write_bytes(b"previous output")
+        before = set(directory.iterdir())
+        errors = io.StringIO()
+        with mock.patch.object(Path, "replace", side_effect=OSError("simulated replacement failure")), \
+                contextlib.redirect_stderr(errors), contextlib.redirect_stdout(io.StringIO()):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertIn("simulated replacement failure", errors.getvalue())
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(source.read_bytes(), container)
+        self.assertEqual(set(directory.iterdir()), before)
+
+    def test_successful_conversion_replaces_existing_output_without_temporary_files(self):
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        expected = output.read_bytes()
+        before = set(Path(self.directory).iterdir())
+        output.write_bytes(b"previous output")
+        with contextlib.redirect_stdout(io.StringIO()):
+            status = unwrap_self.main([str(Path(self.directory) / "input.self"), str(output)])
+        self.assertEqual(status, 0)
+        self.assertEqual(output.read_bytes(), expected)
+        self.assertEqual(set(Path(self.directory).iterdir()), before)
+
+    def test_close_failure_preserves_existing_output(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        source.write_bytes(build_container(default_segments(), default_records(), default_payloads()))
+        output.write_bytes(b"previous output")
+        before = set(directory.iterdir())
+        real_open = io.open
+
+        def failing_open(path, mode="r", *args, **kwargs):
+            stream = real_open(path, mode, *args, **kwargs)
+            if "w" not in mode and "x" not in mode:
+                return stream
+            writer = mock.MagicMock(wraps=stream)
+            writer.__enter__.return_value = writer
+
+            def fail_on_close(*args):
+                stream.close()
+                raise OSError("simulated close failure")
+
+            writer.__exit__.side_effect = fail_on_close
+            return writer
+
+        errors = io.StringIO()
+        with mock.patch("io.open", side_effect=failing_open), contextlib.redirect_stderr(errors):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertIn("simulated close failure", errors.getvalue())
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(set(directory.iterdir()), before)
+
+    def test_temporary_file_creation_failure_preserves_existing_output(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        source.write_bytes(build_container(default_segments(), default_records(), default_payloads()))
+        output.write_bytes(b"previous output")
+        before = set(directory.iterdir())
+        errors = io.StringIO()
+        real_open = io.open
+
+        def failing_open(path, mode="r", *args, **kwargs):
+            if "x" in mode:
+                raise OSError("simulated creation failure")
+            return real_open(path, mode, *args, **kwargs)
+
+        with mock.patch("io.open", side_effect=failing_open), contextlib.redirect_stderr(errors):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertIn("simulated creation failure", errors.getvalue())
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(set(directory.iterdir()), before)
+
+    def test_temporary_name_collision_preserves_all_existing_files(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        collision = directory / ".unwrap-self-collision"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        output.write_bytes(b"previous output")
+        collision.write_bytes(b"unrelated file")
+        before = set(directory.iterdir())
+        errors = io.StringIO()
+        with mock.patch.object(unwrap_self.secrets, "token_hex", return_value="collision"), \
+                contextlib.redirect_stderr(errors):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(collision.read_bytes(), b"unrelated file")
+        self.assertEqual(source.read_bytes(), container)
+        self.assertEqual(set(directory.iterdir()), before)
+
+    @unittest.skipUnless(sys.platform == "win32", "Windows ACL inheritance")
+    def test_new_output_inherits_the_destination_directory_acl(self):
+        directory = Path(self.directory)
+        grant = subprocess.run(["icacls.exe", str(directory), "/grant", "*S-1-1-0:(OI)(CI)(RX)"],
+                               capture_output=True, text=True, timeout=30)
+        self.assertEqual(grant.returncode, 0, grant.stdout + grant.stderr)
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        permissions = directory / "output-acl.txt"
+        saved = subprocess.run(["icacls.exe", str(output), "/save", str(permissions)],
+                               capture_output=True, text=True, timeout=30)
+        self.assertEqual(saved.returncode, 0, saved.stdout + saved.stderr)
+        self.assertIn(";;;WD)", permissions.read_text(encoding="utf-16-le"))
+        self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+        self.assertEqual((directory / "input.self").read_bytes(), container)
+        self.assertFalse(any(path.name.startswith(".unwrap-self-") for path in directory.iterdir()))
+
+    @unittest.skipUnless(os.name == "posix", "POSIX permission bits")
+    def test_new_output_permissions_follow_the_process_umask(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        for mask in (0o000, 0o022, 0o027, 0o077, 0o200, 0o777):
+            with self.subTest(umask=oct(mask)):
+                output = directory / f"output-{mask:o}.elf"
+                result = subprocess.run([sys.executable, str(Path(unwrap_self.__file__)), str(source), str(output)],
+                                        capture_output=True, text=True, timeout=30, umask=mask)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                mode = output.stat().st_mode & 0o777
+                self.assertEqual(mode, 0o666 & ~mask)
+                output.chmod(mode | 0o400)
+                self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+                self.assertFalse(any(path.name.startswith(".unwrap-self-") for path in directory.iterdir()))
+        self.assertEqual(source.read_bytes(), container)
+
+    @unittest.skipUnless(os.name == "posix", "POSIX group inheritance")
+    def test_new_output_inherits_the_destination_directory_group(self):
+        groups = [group for group in os.getgroups() if group != os.getegid()]
+        if not groups:
+            self.skipTest("requires a supplementary group")
+        directory = Path(self.directory)
+        group = groups[0]
+        try:
+            os.chown(directory, -1, group)
+            directory.chmod(0o2700)
+        except PermissionError as error:
+            self.skipTest(str(error))
+        if not directory.stat().st_mode & 0o2000:
+            self.skipTest("filesystem does not retain the setgid bit")
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output.stat().st_gid, group)
+        self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+        self.assertEqual((directory / "input.self").read_bytes(), container)
+        self.assertEqual(set(directory.iterdir()), {directory / "input.self", output})
+
+    @unittest.skipUnless(os.name == "posix", "POSIX permission bits")
+    def test_replacing_output_preserves_existing_permissions(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        source.write_bytes(build_container(default_segments(), default_records(), default_payloads()))
+        output.write_bytes(b"previous output")
+        output.chmod(0o640)
+        unwrap_self.unwrap(source, output)
+        self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+        self.assertEqual(output.stat().st_mode & 0o777, 0o640)
+
+    def test_output_symlink_is_kept_and_its_target_is_replaced(self):
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        expected = output.read_bytes()
+        output.unlink()
+        target = Path(self.directory) / "target.elf"
+        target.write_bytes(b"previous output")
+        try:
+            output.symlink_to(target.name)
+        except OSError as error:
+            self.skipTest(str(error))
+        before = set(Path(self.directory).iterdir())
+        unwrap_self.unwrap(Path(self.directory) / "input.self", output)
+        self.assertTrue(output.is_symlink())
+        self.assertEqual(target.read_bytes(), expected)
+        self.assertEqual(set(Path(self.directory).iterdir()), before)
+
     def convert(self, container, name="input.self"):
         directory = Path(self.directory)
         source = directory / name
@@ -222,6 +484,30 @@ class UnwrapTest(unittest.TestCase):
                     self.assertEqual(embedded[2] - host[2], embedded[3] - host[3])
                     self.assertEqual(data[embedded[2]:embedded[2] + size], payload[0x90:0x90 + size])
 
+    def test_recorded_embedded_segments_keep_their_overlapping_load_host(self):
+        payload = b"overlapping load payload\0" * 16
+        for kind in (PT_DYNAMIC, PT_TLS):
+            for delta, size in ((0, 0x10), (0x10, 0x10), (0x40, 0x20), (0xF0, 0x10)):
+                for relocated in (False, True):
+                    with self.subTest(kind=kind, delta=delta, size=size, relocated=relocated):
+                        source = 0x800 if relocated else 0x1000
+                        segments = [(PT_LOAD, 5, 0x1000, 0x1000, 0x100, PAGE),
+                                    (PT_LOAD, 6, 0x1080, 0x3080, 0x100, PAGE),
+                                    (kind, 4, 0x1080 + delta, 0x3080 + delta, size, 8)]
+                        records = [(0x800, source, 0x100), (0x100800, source + 0x80, 0x100)] if relocated else []
+                        records.append((0x200800, source + 0x80 + delta, size))
+                        container = build_container(segments, records, {source: payload})
+                        result, output = self.convert(container)
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        data, headers = read_program_headers(output)
+                        host, embedded = headers[1:]
+                        self.assertEqual(embedded[2] - host[2], delta)
+                        for header, start in zip(headers[:2], (0, 0x80)):
+                            self.assertEqual(header[2] % header[7], header[3] % header[7])
+                            self.assertEqual(data[header[2]:header[2] + header[5]], payload[start:start + 0x100])
+                        self.assertEqual(data[embedded[2]:embedded[2] + size], payload[0x80 + delta:0x80 + delta + size])
+                        self.assertEqual((Path(self.directory) / "input.self").read_bytes(), container)
+
     def test_segments_after_the_recorded_comment_are_read_from_the_container(self):
         segments = default_segments() + [(SCE_COMMENT, 4, 0x15A0, 0x0, 0x20, 0x10), (PT_NOTE, 4, 0x15C0, 0x0, 0x18, 4),
                                          (SCE_VERSION, 4, 0x15D8, 0x0, 0x10, 1)]
@@ -779,5 +1065,92 @@ class UnwrapTest(unittest.TestCase):
         self.assertTrue(output.exists())
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(unwrap_self.sys, "stdout", out), mock.patch.object(unwrap_self.sys, "stderr", err):
+            try:
+                unwrap_self.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
+class JobManagerModuleRefusalTests(unittest.TestCase):
+    def setUp(self):
+        self.temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temporary.cleanup)
+        self.root = Path(self.temporary.name)
+        self.build = self.root / "build"
+        self.helper = self.build / "tests" / "job_manager_reference.prx"
+        self.helper.parent.mkdir(parents=True)
+        self.helper.write_bytes(b"reference helper")
+        self.relinker = self.root / "relinker.exe"
+        self.relinker.touch()
+        self.toolchain = self.root / "toolchain"
+        self.toolchain.mkdir()
+        self.module = self.root / "module.self"
+
+    def invoke(self, output):
+        import run_job_manager_reference
+        arguments = ["run_job_manager_reference.py", "--module", str(self.module),
+                     "--build", str(self.build), "--relinker", str(self.relinker),
+                     "--toolchain", str(self.toolchain), "--output", str(output)]
+        stdout, stderr = io.StringIO(), io.StringIO()
+        with mock.patch.object(sys, "argv", arguments), mock.patch.object(sys, "platform", "win32"), \
+                mock.patch.object(run_job_manager_reference.subprocess, "run") as process, \
+                contextlib.redirect_stdout(stdout), contextlib.redirect_stderr(stderr):
+            code = run_job_manager_reference.main()
+        return code, stdout.getvalue(), stderr.getvalue(), process
+
+    def test_module_refusals_stop_reference_setup_with_a_diagnostic(self):
+        malformed_elf = bytearray(build_container(default_segments(), default_records(), default_payloads()))
+        malformed_elf[ELF_HEADER_OFFSET + 4] = 1
+        cases = ((b"short", "file is smaller than the SELF header area"),
+                 (bytes(FIRST_REGION), "not a SELF container (magic 0x0)"),
+                 (bytes(malformed_elf), "inner ELF is not 64-bit little-endian"))
+        for index, (data, diagnostic) in enumerate(cases):
+            with self.subTest(diagnostic=diagnostic):
+                self.module.write_bytes(data)
+                output = self.build / ".." / f"artifacts-{index}"
+                code, stdout, stderr, process = self.invoke(output)
+                self.assertEqual(code, 2)
+                self.assertEqual(stderr, diagnostic + "\n")
+                self.assertEqual(stdout, f"Artifacts: {output.resolve()}\n")
+                self.assertNotIn("Traceback", stderr)
+                self.assertEqual(self.module.read_bytes(), data)
+                self.assertEqual((output / "libs" / "jobref.prx").read_bytes(), b"reference helper")
+                self.assertFalse((output / "sce_module" / "libSceJobManager.prx").exists())
+                self.assertFalse((output / "relink.log").exists())
+                self.assertFalse((output / "results.json").exists())
+                process.assert_called_once()
+                self.assertEqual(process.call_args.args[0][0], str(self.build.resolve() / "core/libs/nid_patcher.exe"))
+
+    def test_missing_reference_helper_keeps_existing_error_handling(self):
+        self.helper.unlink()
+        self.module.write_bytes(b"short")
+        code, stdout, stderr, process = self.invoke(self.root / "artifacts")
+        self.assertEqual(code, 2)
+        self.assertEqual(stderr, "Build the job_manager_reference target first\n")
+        process.assert_not_called()
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_web_release.py b/tools/tests/test_web_release.py
index e48e3fd3c7..7a496c32fe 100644
--- a/tools/tests/test_web_release.py
+++ b/tools/tests/test_web_release.py
@@ -105,6 +105,20 @@ class WebReleaseTests(unittest.TestCase):
         self.assertTrue((self.output / ".nojekyll").is_file())
         self.assertEqual(self.requests.count(LATEST), 1)
 
+    def test_rewritten_library_paths_preserve_the_previous_site(self):
+        invalid = zipped([("libs/libkernel.prx!ignored", b"content")])
+        invalid = invalid.replace(b"libs/libkernel.prx!ignored", b"libs/libkernel.prx\0ignored")
+        for platform in ("windows", "linux"):
+            with self.subTest(platform=platform):
+                self.requests.clear()
+                name = f"prx-{platform}-v1.zip"
+                original = self.responses["https://example.test/" + name]
+                self.set_asset(name, invalid)
+                try:
+                    self.assert_rejected("Invalid library archive layout")
+                finally:
+                    self.set_asset(name, original)
+
     def test_libraries_flag_also_replaces_an_incompatible_local_converter(self):
         self.seed_previous()
         source = self.root / "source/demo/web"
@@ -212,6 +226,27 @@ class WebReleaseTests(unittest.TestCase):
             build_web.main()
         self.assertEqual((self.output / "native/relinker_wasm.mjs").read_bytes(), self.contents["native/relinker_wasm.mjs"])
 
+    def test_invalid_zip_reports_cli_error_and_preserves_previous_site(self):
+        self.seed_previous()
+        previous = self.snapshot()
+        for name in ("web-v1.zip", "prx-windows-v1.zip", "prx-linux-v1.zip"):
+            with self.subTest(asset=name):
+                self.requests.clear()
+                original = self.responses[f"https://example.test/{name}"]
+                self.set_asset(name, original[:-22])
+                errors = io.StringIO()
+                try:
+                    with patch.object(build_web, "request", self.request), contextlib.redirect_stderr(errors):
+                        with self.assertRaises(SystemExit) as error:
+                            build_web.main(["--build", str(self.build), "--release"])
+                    self.assertEqual(error.exception.code, 2)
+                    self.assertIn(f"error: Invalid release archive {name}: File is not a zip file", errors.getvalue())
+                    self.assertNotIn("Traceback", errors.getvalue())
+                    self.assertEqual(self.snapshot(), previous)
+                    self.assertEqual(list(self.build.glob(".web-release-*")), [])
+                finally:
+                    self.set_asset(name, original)
+
     def test_local_build_still_copies_sources_without_network(self):
         source = self.root / "source/demo/web"
         source.mkdir(parents=True)
@@ -420,10 +455,17 @@ class TestWebRunnerTests(unittest.TestCase):
                 self.encoding = encoding
                 self.errors = errors
 
+            def write(self, text):
+                return len(text)
+
+            def flush(self):
+                pass
+
         out, err = Stream(), Stream()
         with patch.object(test_web.sys, "stdout", out), patch.object(test_web.sys, "stderr", err):
-            with self.assertRaises(SystemExit):
+            with self.assertRaises(SystemExit) as error:
                 test_web.main([])
+        self.assertEqual(error.exception.code, 2)
         self.assertEqual(out.encoding, "utf-8")
         self.assertEqual(out.errors, "backslashreplace")
         self.assertEqual(err.encoding, "utf-8")
diff --git a/tools/trace_digest.py b/tools/trace_digest.py
index d259fbb62d..b5e21a6fb8 100644
--- a/tools/trace_digest.py
+++ b/tools/trace_digest.py
@@ -93,11 +93,26 @@ def load_trace(path):
         return Trace(json.load(handle))
 
 
+def load_summary_lines(path):
+    records = []
+    for number, line in enumerate(Path(path).read_text(encoding="utf-8-sig").split("\n"), 1):
+        if not line.strip():
+            continue
+        try:
+            record = json.loads(line)
+        except json.JSONDecodeError as error:
+            raise ValueError(f"{path}:{number}: invalid JSON: {error.msg}") from error
+        if not isinstance(record, dict):
+            raise ValueError(f"{path}:{number}: summary record must be an object")
+        records.append(record)
+    return records
+
+
 def load_summary(path, trace_path):
     candidate = Path(path) if path else Path(trace_path).with_name("aps5-summary.jsonl")
     if not candidate.exists():
         return None
-    lines = [json.loads(line) for line in candidate.read_text(encoding="utf-8-sig").splitlines() if line.strip()]
+    lines = load_summary_lines(candidate)
     name = Path(trace_path).name
     alternate = name[:-3] if name.endswith(".gz") else name + ".gz"
     for filename in (name, alternate):
@@ -284,7 +299,7 @@ def markdown(result):
 
 
 def load_intervals(path):
-    lines = [json.loads(line) for line in Path(path).read_text(encoding="utf-8-sig").splitlines() if line.strip()]
+    lines = load_summary_lines(path)
     return [line for line in lines if "interval_start_s" in line]
 
 
@@ -308,7 +323,8 @@ def digest_intervals(lines):
                      "top_phase": {"name": largest[0], "ms_per_frame": largest[1]} if largest else None,
                      "trace_dropped": line.get("trace_dropped", False)})
     first = lines[0] if lines else {}
-    keys = ("commit", "dirty", "env", "gpu", "driver", "os", "resolution")
+    keys = ("commit", "dirty", "env", "gpu", "driver", "os", "resolution",
+            "cpu", "cpu_threads", "memory_mib", "title_id", "title", "content_version")
     changed = [index for index in range(1, len(lines)) if any(lines[index].get(key) != lines[index - 1].get(key) for key in keys)]
     return {"intervals": rows, "identity": {key: first.get(key) for key in keys}, "identity_changed_at": changed}
 
@@ -322,7 +338,7 @@ def markdown_intervals(result):
              f"{identity['gpu']}, {identity['driver']}, {identity['os']}, {identity['resolution']}, commit {identity['commit']}"
              f"{' (dirty)' if identity.get('dirty') else ''}"]
     if result["identity_changed_at"]:
-        lines.append("commit, environment, GPU, driver or OS changed at interval " + ", ".join(str(index + 1) for index in result["identity_changed_at"]))
+        lines.append("build, environment, host, resolution or title metadata changed at interval " + ", ".join(str(index + 1) for index in result["identity_changed_at"]))
     lines += ["", "| # | seconds | presents | p50 | p90 | p99 | max | GPU busy | busiest worker | largest phase |", "|---|---|---|---|---|---|---|---|---|---|"]
     for index, row in enumerate(rows, 1):
         frame = row["frame_ms"]
@@ -344,6 +360,9 @@ def nonnegative_integer(value):
 
 
 def main(arguments=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description=DESCRIPTION)
     parser.add_argument("trace", help="aps5-trace-*.json.gz (or .json), or a .jsonl summary file with APS5_TRACE_SUMMARY_EVERY lines")
     parser.add_argument("--summary", help="file with the summary line (default: aps5-summary.jsonl next to the trace)")
@@ -378,9 +397,6 @@ def main(arguments=None):
 
 
 if __name__ == "__main__":
-    for stream in (sys.stdout, sys.stderr):
-        if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8", errors="replace")
     try:
         sys.exit(main())
     except (EOFError, OSError, ValueError, zlib.error) as error:
diff --git a/tools/unwrap_self.py b/tools/unwrap_self.py
index 659f4eb07a..bf874360b6 100644
--- a/tools/unwrap_self.py
+++ b/tools/unwrap_self.py
@@ -30,7 +30,9 @@ usage: unwrap_self.py <input.self> <output.elf> [--verbose]
 """
 
 import argparse
+import io
 import math
+import secrets
 import struct
 import sys
 from collections import Counter
@@ -184,6 +186,12 @@ def place_segments(data, headers, records):
         if header["type"] == PT_LOAD:
             continue
         if header["index"] in placed:
+            host = load_for(header["vaddr"], header["size"])
+            if host is not None:
+                offset = header["vaddr"] - host["vaddr"]
+                if (host["size"] and offset <= host["size"] and header["size"] <= host["size"] - offset
+                        and header["source"] == host["source"] + offset):
+                    header["host"] = host
             if header["size"] and (tail is None or header["offset"] > tail[0]):
                 tail = (header["offset"], header["source"] - header["offset"])
             continue
@@ -216,7 +224,7 @@ def place_segments(data, headers, records):
     for header in headers:
         if header["type"] == PT_LOAD and header["size"] == 0:
             continue
-        if header["source"] > len(data) or header["size"] > len(data) - header["source"]:
+        if header["source"] < 0 or header["source"] > len(data) or header["size"] > len(data) - header["source"]:
             raise Refused("segment %d does not fit the file" % header["index"])
 
 
@@ -235,8 +243,8 @@ def check_decrypted(data, headers):
 
 
 def unwrap(path, output, verbose=False):
-    source, destination = Path(path), Path(output)
-    if source.resolve() == destination.resolve() or (destination.exists() and source.samefile(destination)):
+    source, destination = Path(path), Path(output).resolve()
+    if source.resolve() == destination or (destination.exists() and source.samefile(destination)):
         raise Refused("output aliases the input container")
     data = bytes(source.read_bytes())
     if len(data) < FIRST_REGION:
@@ -326,17 +334,24 @@ def unwrap(path, output, verbose=False):
             print("  [%2d] %-18s vaddr=%#011x filesz=%#010x offset=%#010x%s"
                   % (item["index"], name, item["vaddr"], item["size"], item["new"], moved))
 
-    destination = Path(output)
-    if destination.parent != Path(""):
-        destination.parent.mkdir(parents=True, exist_ok=True)
-    destination.write_bytes(result)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    temporary_path = destination.parent / (".unwrap-self-" + secrets.token_hex(16))
+    temporary = io.open(temporary_path, "xb")
+    try:
+        with temporary:
+            temporary.write(result)
+        if sys.platform != "win32" and destination.exists():
+            temporary_path.chmod(destination.stat().st_mode)
+        temporary_path.replace(destination)
+    finally:
+        temporary_path.unlink(missing_ok=True)
     return len(result)
 
 
 def main(argv=None):
     for stream in (sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="unwrap a decrypted SELF or fSELF container into a clean ELF")
     parser.add_argument("input", help="SELF container to read")
     parser.add_argument("output", help="ELF executable to write")